@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.26

package/dist/internal/passkey/write-state.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"write-state.mjs","names":["digest","digestText"],"sources":["../../../src/internal/passkey/write-state.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- existing mapped-row bridge; public adapters preserve table, ID, and Effect types. */\n\nimport {\n  type PasskeyActionAuthorization,\n  type PasskeyCeremony,\n  PasskeyBegin,\n  PasskeyCredential,\n  PasskeyCredentialSummary,\n  PasskeyDescriptor,\n  PasskeyLabel,\n  PasskeyModuleId,\n  PasskeyProfile,\n  PasskeyRequirement,\n  PasskeyRevision,\n  PasskeyUserHandle,\n  PasskeyManagementPolicy,\n  snapshotPasskeySync,\n} from \"@yielded/auth/Passkey\";\nimport { type SubjectId } from \"@yielded/auth/Schema\";\nimport { SessionInvalidationWindow } from \"@yielded/auth/Sessions\";\nimport { DateTime, Effect, Schema } from \"effect\";\n\nimport { digest as digestText } from \"../crypto\";\nimport type { PersistenceMappingError } from \"../mapping-error\";\nimport type { QueryOperations } from \"../query-operations\";\nimport type { makeTransactionKernel } from \"../transaction-kernel\";\nimport { CurrentPasskeyTransaction } from \"./state\";\nimport type { makePasskeyStateKernel } from \"./state\";\n\nexport interface WriteSubject {\n  readonly subjectId: SubjectId;\n  readonly nativeId: any;\n  readonly row: Record<string, any>;\n  readonly revision: typeof PasskeyRevision.Type;\n}\n\nexport const makePasskeyWriteStateKernel = (\n  operations: QueryOperations,\n  state: Pick<\n    ReturnType<typeof makePasskeyStateKernel>,\n    | \"col\"\n    | \"copiedRow\"\n    | \"credentialKey\"\n    | \"equal\"\n    | \"handleKey\"\n    | \"invariant\"\n    | \"mappedColumns\"\n    | \"sameCredential\"\n    | \"sameRevision\"\n    | \"subjectScope\"\n  >,\n  transactions: Pick<ReturnType<typeof makeTransactionKernel>, \"both\">,\n) => {\n  const { sql } = operations;\n\n  const {\n    col,\n    copiedRow,\n    credentialKey,\n    equal,\n    handleKey,\n    mappedColumns,\n    sameCredential,\n    sameRevision,\n    subjectScope,\n  } = state;\n\n  const invariant: (value: unknown) => asserts value = state.invariant;\n  const { both } = transactions;\n\n  const jsonStorage = <S extends Schema.Codec<unknown, unknown, never, never>>(schema: S) => {\n    const codec = Schema.fromJsonString(Schema.toCodecJson(Schema.toType(schema)));\n\n    return {\n      encode: (value: S[\"Type\"]) => Schema.encodeSync(codec)(snapshotPasskeySync(schema, value)),\n      decode: (text: unknown): S[\"Type\"] => {\n        // oxlint-disable-next-line no-restricted-properties -- persisted private JSON enters through its schema.\n        return Schema.decodeUnknownSync(codec)(text);\n      },\n    };\n  };\n\n  const digest = <S extends Schema.Codec<unknown, unknown, never, never>>(\n    schema: S,\n    value: S[\"Type\"],\n  ) => digestText(jsonStorage(schema).encode(value));\n\n  const currentSubject = Effect.fn(\"passkey.currentWriteSubject\")(function* (\n    mapping: any,\n    subjectId: SubjectId,\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const read = mapping.read;\n    const table = read.subject;\n    const nativeId = read.subjectIds.toNative(subjectId);\n\n    invariant(read.subjectIds.toSubject(nativeId) === subjectId);\n\n    const row = (yield* owner.read(table.table, equal(table.table, { [table.id]: nativeId }), {\n      limit: 1,\n      columns: [\n        ...new Set<string>([\n          table.id,\n          table.status,\n          table.securityRevision,\n          ...mapping.write.policy.subjectColumns,\n        ]),\n      ],\n    })).rows[0];\n\n    if (row === undefined || !table.isActiveStatus(row[table.status])) return undefined;\n    invariant(read.subjectIds.equals(table.decodeId(copiedRow(row)), nativeId));\n    const active = sql`exists(select 1 from ${table.table} where ${both(equal(table.table, { [table.id]: nativeId }), table.activeCondition)})`;\n\n    if (!(yield* owner.check(active))) return undefined;\n    owner.postconditions.push(active);\n    const factor = read.authority;\n\n    const factors = (yield* owner.read(\n      factor.table,\n      both(equal(factor.table, { [factor.subjectId]: nativeId }), factor.activeCondition),\n      {\n        limit: 64,\n        columns: mappedColumns(factor),\n        orderBy: col(factor.table, factor.credentialId),\n      },\n    )).rows;\n\n    const revision = snapshotPasskeySync(PasskeyRevision, {\n      subjectId,\n      securityRevision: row[table.securityRevision],\n      credentials: factors.map((value) => ({\n        credentialId: value[factor.credentialId],\n        revision: value[factor.revision],\n      })),\n    });\n\n    invariant(\n      new Set(revision.credentials.map((item) => item.credentialId)).size ===\n        revision.credentials.length,\n    );\n\n    return { subjectId, nativeId, row, revision };\n  });\n\n  const credentialRows = Effect.fn(\"passkey.writeCredentialRows\")(function* (\n    mapping: any,\n    subject: WriteSubject,\n    rpId?: string,\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const table = mapping.read.credential;\n\n    return (yield* owner.read(\n      table.table,\n      both(\n        equal(table.table, { [table.subjectId]: subject.nativeId }),\n        table.activeCondition,\n        rpId === undefined ? undefined : equal(table.table, { [table.rpId]: rpId }),\n      ),\n      { limit: 64, orderBy: col(table.table, table.credentialId) },\n    )).rows;\n  });\n\n  const summary = (mapping: any, row: any) => {\n    const table = mapping.read.credential;\n    const write = mapping.write.credential;\n    const decoded = table.decode(copiedRow(row));\n\n    return snapshotPasskeySync(PasskeyCredentialSummary, {\n      credentialId: decoded.credentialId,\n      name: row[write.name],\n      primarySignIn: decoded.primarySignIn,\n      createdAtMillis: mapping.clock.decodeInstant(row[write.createdAt]),\n      ...(row[mapping.telemetry.lastUsedAt] === null ||\n      row[mapping.telemetry.lastUsedAt] === undefined\n        ? {}\n        : { lastUsedAtMillis: mapping.clock.decodeInstant(row[mapping.telemetry.lastUsedAt]) }),\n    });\n  };\n\n  const ownedCredential = Effect.fn(\"passkey.ownedWriteCredential\")(function* (\n    mapping: any,\n    subject: WriteSubject,\n    row: any,\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const read = mapping.read;\n    const table = read.credential;\n\n    const decoded = snapshotPasskeySync(PasskeyCredential, {\n      ...table.decode(copiedRow(row)),\n      revision: subject.revision,\n      active: true,\n    });\n\n    invariant(\n      decoded.credentialId === row[table.credentialId] &&\n        decoded.profile.rpId === decoded.rpId &&\n        read.subjectIds.equals(table.decodeSubjectId(copiedRow(row)), subject.nativeId),\n    );\n    const ownership = read.credentialOwnership;\n    const key = yield* credentialKey(decoded.rpId, decoded.protocolCredentialId);\n\n    const tuple = (yield* owner.read(\n      ownership.table,\n      equal(ownership.table, { [ownership.credentialKey]: key }),\n      { limit: 1, columns: mappedColumns(ownership) },\n    )).rows[0];\n\n    if (\n      tuple === undefined ||\n      !ownership.isOwnedState(tuple[ownership.state]) ||\n      !read.subjectIds.equals(ownership.decodeSubjectId(copiedRow(tuple)), subject.nativeId)\n    )\n      return undefined;\n    invariant(\n      tuple[ownership.rpId] === decoded.rpId &&\n        tuple[ownership.protocolCredentialId] === decoded.protocolCredentialId &&\n        tuple[ownership.credentialId] === decoded.credentialId &&\n        row[table.credentialKey] === key,\n    );\n    const handle = read.handleOwnership;\n    const hashedHandle = yield* handleKey(decoded.rpId, decoded.userHandle);\n\n    const held = (yield* owner.read(\n      handle.table,\n      equal(handle.table, { [handle.handleKey]: hashedHandle }),\n      { limit: 1, columns: mappedColumns(handle) },\n    )).rows[0];\n\n    if (\n      held === undefined ||\n      !handle.isOwnedState(held[handle.state]) ||\n      !read.subjectIds.equals(handle.decodeSubjectId(copiedRow(held)), subject.nativeId)\n    )\n      return undefined;\n    invariant(\n      held[handle.rpId] === decoded.rpId &&\n        held[handle.userHandle] === decoded.userHandle &&\n        row[table.handleKey] === hashedHandle,\n    );\n    invariant(\n      subject.revision.credentials.some(\n        (item) =>\n          item.credentialId === decoded.credentialId &&\n          item.revision === row[table.credentialRevision],\n      ),\n    );\n\n    return decoded;\n  });\n\n  const managementPolicy = (mapping: any, subject: WriteSubject) =>\n    snapshotPasskeySync(\n      PasskeyManagementPolicy,\n      mapping.write.policy.management(copiedRow(subject.row)),\n    );\n\n  const metadataAllowed = Effect.fn(\"passkey.metadataAllowed\")(function* (\n    mapping: any,\n    subject: WriteSubject,\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const condition = mapping.write.policy.metadata(subject.nativeId);\n    const allowed = yield* owner.check(condition);\n\n    if (allowed) owner.postconditions.push(condition);\n\n    return allowed;\n  });\n\n  const enrollmentDigest = (ceremony: PasskeyCeremony) => {\n    invariant(ceremony.context._tag === \"Enrollment\");\n    const context = ceremony.context;\n\n    return digest(\n      Schema.Tuple([\n        PasskeyModuleId,\n        Schema.Literal(\"enrollment\"),\n        Schema.Struct({ ...PasskeyBegin.fields, name: PasskeyLabel }),\n        PasskeyProfile,\n        PasskeyRevision,\n        PasskeyUserHandle,\n        Schema.Array(PasskeyDescriptor),\n      ]),\n      [\n        ceremony.moduleId,\n        \"enrollment\",\n        {\n          flowId: ceremony.flowId,\n          commandId: ceremony.commandId,\n          profileId: ceremony.profile.profileId,\n          name: context.name,\n        },\n        ceremony.profile,\n        context.revision,\n        context.userHandle,\n        ceremony.allowedCredentials,\n      ],\n    );\n  };\n\n  const removeDigest = (moduleId: string, commandId: string, credential: PasskeyCredential) =>\n    digest(\n      Schema.Tuple([\n        PasskeyModuleId,\n        Schema.Literal(\"remove\"),\n        PasskeyBegin.fields.commandId,\n        PasskeyCredential,\n      ]),\n      [\n        PasskeyModuleId.make(moduleId),\n        \"remove\",\n        PasskeyBegin.fields.commandId.make(commandId),\n        credential,\n      ],\n    );\n\n  const authorizeAction = Effect.fn(\"passkey.authorizeWriteAction\")(function* (\n    mapping: any,\n    subject: WriteSubject,\n    authorization: PasskeyActionAuthorization,\n    expected: {\n      readonly action: PasskeyActionAuthorization[\"challenge\"][\"action\"];\n      readonly commandId: string;\n      readonly flowId: string;\n      readonly bindingDigest: string;\n      readonly revision: typeof PasskeyRevision.Type;\n    },\n    policy: PasskeyManagementPolicy,\n    original?: typeof PasskeyRequirement.Type,\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const { challenge, evidence } = authorization;\n\n    if (\n      challenge.moduleId !== mapping.moduleId ||\n      challenge.action !== expected.action ||\n      challenge.commandId !== expected.commandId ||\n      challenge.flowId !== expected.flowId ||\n      challenge.bindingDigest !== expected.bindingDigest ||\n      evidence.flowId !== expected.flowId ||\n      evidence.bindingDigest !== expected.bindingDigest ||\n      !sameRevision(challenge.revision, expected.revision) ||\n      subject.revision.subjectId !== expected.revision.subjectId ||\n      subject.revision.securityRevision !== expected.revision.securityRevision ||\n      evidence.revision.subjectId !== subject.subjectId ||\n      evidence.revision.securityRevision !== subject.revision.securityRevision\n    )\n      return false;\n    for (const revision of [expected.revision, evidence.revision])\n      if (\n        revision.credentials.some(\n          (item) =>\n            !subject.revision.credentials.some(\n              (current) =>\n                current.credentialId === item.credentialId && current.revision === item.revision,\n            ),\n        )\n      )\n        return false;\n    const now = yield* owner.now(mapping.clock);\n\n    if (\n      evidence.proofs.some(\n        (proof) =>\n          DateTime.toEpochMillis(proof.verifiedAt) > now ||\n          !evidence.revision.credentials.some((item) => item.credentialId === proof.credentialId),\n      )\n    )\n      return false;\n\n    const currentRequirement: Effect.Effect<\n      typeof PasskeyRequirement.Type,\n      PersistenceMappingError\n    > = mapping.write.policy.requirement(copiedRow(subject.row), expected.action);\n\n    const current = snapshotPasskeySync(PasskeyRequirement, yield* currentRequirement);\n\n    for (const requirement of [\n      authorization.requirement,\n      current,\n      ...(original === undefined ? [] : [original]),\n    ]) {\n      const age = Math.min(policy.maximumEvidenceAgeMillis, requirement.maximumAgeMillis);\n\n      const fresh = evidence.proofs.filter(\n        (proof) => now - DateTime.toEpochMillis(proof.verifiedAt) < age,\n      );\n\n      const factors = new Set(fresh.flatMap((proof) => proof.factors));\n\n      if (\n        !requirement.alternatives.some(\n          (alternative) =>\n            alternative.factors.every((factor) => factors.has(factor)) &&\n            new Set(fresh.map((proof) => proof.credentialId)).size >=\n              alternative.minimumCredentials &&\n            fresh.some(\n              (proof) =>\n                (!alternative.userVerified || proof.userVerified) &&\n                (!alternative.phishingResistant || proof.phishingResistant),\n            ),\n        )\n      )\n        return false;\n      owner.postconditions.push(\n        both(\n          sql`${mapping.clock.engineNowMillis} >= ${now}`,\n          ...fresh.map(\n            (proof) =>\n              sql`${mapping.clock.engineNowMillis} < ${DateTime.toEpochMillis(proof.verifiedAt) + age}`,\n          ),\n        ),\n      );\n    }\n    const condition = mapping.write.policy.action(subject.nativeId, authorization);\n\n    if (!(yield* owner.check(condition))) return false;\n    owner.postconditions.push(condition);\n\n    return true;\n  });\n\n  const invalidationMatches = (\n    mapping: any,\n    supplied: SessionInvalidationWindow,\n    policy: PasskeyManagementPolicy,\n  ) => {\n    if (supplied.existingSessions === \"cache-expiry\" && supplied.maximumExposureMillis === 0)\n      return false;\n\n    // Cookie-cache exposure does not weaken the mapping's authoritative\n    // revision bump. Compare that immediate guarantee independently of the TTL.\n    const authoritative: SessionInvalidationWindow =\n      supplied.existingSessions === \"cache-expiry\" &&\n      mapping.invalidation.window.existingSessions === \"immediate\"\n        ? { ...supplied, existingSessions: \"immediate\", maximumExposureMillis: 0 }\n        : supplied;\n\n    return (\n      jsonStorage(SessionInvalidationWindow).encode(authoritative) ===\n        jsonStorage(SessionInvalidationWindow).encode(mapping.invalidation.window) &&\n      (!policy.requireImmediateInvalidation || supplied.existingSessions === \"immediate\")\n    );\n  };\n\n  const invalidate = Effect.fn(\"passkey.invalidateCredentialChange\")(function* (\n    mapping: any,\n    subject: WriteSubject,\n    invalidation: SessionInvalidationWindow,\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const table = mapping.read.subject;\n    const revision = PasskeyRevision.fields.securityRevision.make(owner.marker);\n\n    yield* owner.update(\n      table.table,\n      { [table.id]: subject.nativeId },\n      { [table.securityRevision]: revision },\n    );\n\n    const input = {\n      subjectId: subject.nativeId,\n      previousRevision: subject.revision.securityRevision,\n      securityRevision: revision,\n      invalidation,\n    };\n\n    for (const mutation of mapping.invalidation.mutations) {\n      yield* owner.write(\n        owner.database\n          .update(mutation.table)\n          .set(mutation.values(input))\n          .where(mutation.where(input)),\n      );\n      owner.postconditions.push(mutation.postcondition(input));\n    }\n    owner.postconditions.push(mapping.invalidation.postcondition(input));\n    const flow = mapping.flow;\n    const scope = yield* subjectScope(subject.subjectId);\n\n    const where = both(\n      equal(flow.table, { [flow.subjectScope]: scope }),\n      sql`${col(flow.table, flow.state)} in (${flow.states.Pending}, ${flow.states.Claimed})`,\n    );\n\n    yield* owner.write(\n      owner.database\n        .update(flow.table)\n        .set({ [flow.state]: flow.states.Rejected, [flow.version]: owner.marker })\n        .where(where),\n    );\n    for (const observation of owner.observations)\n      if (observation.table === flow.table)\n        observation.rows = observation.rows.map((row) =>\n          row[flow.subjectScope] === scope &&\n          [flow.states.Pending, flow.states.Claimed].includes(row[flow.state])\n            ? { ...row, [flow.state]: flow.states.Rejected, [flow.version]: owner.marker }\n            : row,\n        );\n    owner.postconditions.push(sql`not exists(select 1 from ${flow.table} where ${where})`);\n\n    return revision;\n  });\n\n  const validRegistration = (\n    ceremony: PasskeyCeremony,\n    verified: {\n      readonly algorithm: number;\n      readonly userVerified: boolean;\n      readonly backupEligible: boolean;\n      readonly backupState: boolean;\n      readonly protocolCredentialId: string;\n    },\n  ) =>\n    ceremony.profile.algorithms.some((algorithm) => algorithm === verified.algorithm) &&\n    (ceremony.profile.userVerification !== \"required\" || verified.userVerified) &&\n    (!verified.backupState || verified.backupEligible) &&\n    !ceremony.allowedCredentials.some((item) => item.id === verified.protocolCredentialId);\n\n  const insertCredential = Effect.fn(\"passkey.insertCredential\")(function* (\n    mapping: any,\n    subject: WriteSubject,\n    ceremony: PasskeyCeremony,\n    verified: any,\n    now: number,\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n\n    invariant(ceremony.context._tag === \"Enrollment\" || ceremony.context._tag === \"Registration\");\n    const read = mapping.read;\n    const write = mapping.write;\n    const id = PasskeyCredential.fields.credentialId.make(owner.marker);\n\n    const credential = snapshotPasskeySync(PasskeyCredential, {\n      credentialId: id,\n      rpId: ceremony.profile.rpId,\n      protocolCredentialId: verified.protocolCredentialId,\n      userHandle: ceremony.context.userHandle,\n      publicKey: verified.publicKey,\n      algorithm: verified.algorithm,\n      profile: ceremony.profile,\n      revision: {\n        ...subject.revision,\n        credentials: [\n          ...subject.revision.credentials,\n          {\n            credentialId: id,\n            revision: PasskeyRevision.fields.securityRevision.make(owner.marker),\n          },\n        ],\n      },\n      active: true,\n      primarySignIn: ceremony.profile.primarySignIn && verified.userVerified,\n      enrollmentUserVerified: verified.userVerified,\n      backupEligible: verified.backupEligible,\n      backupState: verified.backupState,\n      counter: verified.counter,\n      maximumCounter: verified.counter,\n    });\n\n    const safe = snapshotPasskeySync(PasskeyCredentialSummary, {\n      credentialId: id,\n      name: ceremony.context.name,\n      primarySignIn: credential.primarySignIn,\n      createdAtMillis: now,\n    });\n\n    const input = { subjectId: subject.nativeId, credential, summary: safe, marker: owner.marker };\n    const tupleKey = yield* credentialKey(credential.rpId, credential.protocolCredentialId);\n    const hashedHandle = yield* handleKey(credential.rpId, credential.userHandle);\n    const tuple = read.credentialOwnership;\n\n    const absent = yield* owner.read(\n      tuple.table,\n      equal(tuple.table, { [tuple.credentialKey]: tupleKey }),\n      { limit: 1 },\n    );\n\n    invariant(absent.rows.length === 0);\n\n    const inserted = yield* owner.insert(\n      tuple.table,\n      {\n        ...write.credentialOwnership.encodeInsert(input),\n        [tuple.credentialKey]: tupleKey,\n        [tuple.rpId]: credential.rpId,\n        [tuple.protocolCredentialId]: credential.protocolCredentialId,\n        [tuple.subjectId]: subject.nativeId,\n        [tuple.credentialId]: id,\n        [tuple.state]: write.credentialOwnership.ownedState,\n        [tuple.version]: owner.marker,\n        [tuple.reservationId]: null,\n      },\n      { [tuple.credentialKey]: tupleKey },\n    );\n\n    absent.rows = inserted.rows;\n    const table = read.credential;\n\n    const values = {\n      ...write.credential.encodeInsert(input),\n      [table.credentialId]: id,\n      [table.subjectId]: subject.nativeId,\n      [table.rpId]: credential.rpId,\n      [table.protocolCredentialId]: credential.protocolCredentialId,\n      [table.credentialKey]: tupleKey,\n      [table.handleKey]: hashedHandle,\n      [table.userHandle]: credential.userHandle,\n      [table.algorithm]: credential.algorithm,\n      [table.credentialRevision]: owner.marker,\n      [table.status]: write.credential.activeStatus,\n      [table.primarySignIn]: write.credential.encodePrimarySignIn(credential.primarySignIn),\n      [table.enrollmentUserVerified]: write.credential.encodeEnrollmentUserVerified(\n        credential.enrollmentUserVerified,\n      ),\n      [table.backupEligible]: write.credential.encodeBackupEligible(credential.backupEligible),\n      [table.backupState]: mapping.telemetry.encodeBackupState(credential.backupState),\n      [table.counter]: credential.counter,\n      [table.maximumCounter]: credential.maximumCounter,\n      [write.credential.name]: safe.name,\n      [write.credential.createdAt]: mapping.clock.encodeInstant(now),\n      [mapping.telemetry.lastUsedAt]: null,\n    };\n\n    yield* owner.insert(table.table, values, { [table.credentialId]: id });\n    for (const observation of owner.observations)\n      if (\n        observation.table === table.table &&\n        observation.rows !== inserted.rows &&\n        !observation.rows.some((row) => row[table.credentialId] === id)\n      )\n        observation.rows = [...observation.rows, values];\n    const factor = read.authority;\n\n    const factorValues = {\n      ...write.authority.encodeInsert(input),\n      [factor.subjectId]: subject.nativeId,\n      [factor.credentialId]: id,\n      [factor.revision]: owner.marker,\n      [factor.status]: write.authority.activeStatus,\n    };\n\n    yield* owner.insert(factor.table, factorValues, {\n      [factor.subjectId]: subject.nativeId,\n      [factor.credentialId]: id,\n    });\n    for (const observation of owner.observations)\n      if (\n        observation.table === factor.table &&\n        !observation.rows.some((row) => row[factor.credentialId] === id)\n      )\n        observation.rows = [...observation.rows, factorValues];\n\n    const decoded = snapshotPasskeySync(PasskeyCredential, {\n      ...table.decode(copiedRow(values)),\n      revision: credential.revision,\n      active: true,\n    });\n\n    invariant(\n      sameCredential(decoded, credential) &&\n        decoded.counter === credential.counter &&\n        decoded.maximumCounter === credential.maximumCounter &&\n        decoded.backupState === credential.backupState,\n    );\n    invariant(summary(mapping, values).credentialId === id);\n    owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${now}`);\n\n    return safe;\n  });\n\n  return {\n    jsonStorage,\n    digest,\n    currentSubject,\n    credentialRows,\n    summary,\n    ownedCredential,\n    managementPolicy,\n    metadataAllowed,\n    enrollmentDigest,\n    removeDigest,\n    authorizeAction,\n    invalidationMatches,\n    invalidate,\n    validRegistration,\n    insertCredential,\n  };\n};\n"],"mappings":";;;;;;;AAoCA,MAAa,+BACX,YACA,OAaA,iBACG;CACH,MAAM,EAAE,QAAQ;CAEhB,MAAM,EACJ,KACA,WACA,eACA,OACA,WACA,eACA,gBACA,cACA,iBACE;CAEJ,MAAM,YAA+C,MAAM;CAC3D,MAAM,EAAE,SAAS;CAEjB,MAAM,eAAuE,WAAc;EACzF,MAAM,QAAQ,OAAO,eAAe,OAAO,YAAY,OAAO,OAAO,MAAM,CAAC,CAAC;EAE7E,OAAO;GACL,SAAS,UAAqB,OAAO,WAAW,KAAK,CAAC,CAAC,oBAAoB,QAAQ,KAAK,CAAC;GACzF,SAAS,SAA6B;IAEpC,OAAO,OAAO,kBAAkB,KAAK,CAAC,CAAC,IAAI;GAC7C;EACF;CACF;CAEA,MAAMA,YACJ,QACA,UACGC,OAAW,YAAY,MAAM,CAAC,CAAC,OAAO,KAAK,CAAC;CAEjD,MAAM,iBAAiB,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAC9D,SACA,WACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,OAAO,QAAQ;EACrB,MAAM,QAAQ,KAAK;EACnB,MAAM,WAAW,KAAK,WAAW,SAAS,SAAS;EAEnD,UAAU,KAAK,WAAW,UAAU,QAAQ,MAAM,SAAS;EAE3D,MAAM,OAAO,OAAO,MAAM,KAAK,MAAM,OAAO,MAAM,MAAM,OAAO,GAAG,MAAM,KAAK,SAAS,CAAC,GAAG;GACxF,OAAO;GACP,SAAS,CACP,mBAAG,IAAI,IAAY;IACjB,MAAM;IACN,MAAM;IACN,MAAM;IACN,GAAG,QAAQ,MAAM,OAAO;GAC1B,CAAC,CACH;EACF,CAAC,EAAA,CAAG,KAAK;EAET,IAAI,QAAQ,KAAA,KAAa,CAAC,MAAM,eAAe,IAAI,MAAM,OAAO,GAAG,OAAO,KAAA;EAC1E,UAAU,KAAK,WAAW,OAAO,MAAM,SAAS,UAAU,GAAG,CAAC,GAAG,QAAQ,CAAC;EAC1E,MAAM,SAAS,GAAG,wBAAwB,MAAM,MAAM,SAAS,KAAK,MAAM,MAAM,OAAO,GAAG,MAAM,KAAK,SAAS,CAAC,GAAG,MAAM,eAAe,EAAE;EAEzI,IAAI,EAAE,OAAO,MAAM,MAAM,MAAM,IAAI,OAAO,KAAA;EAC1C,MAAM,eAAe,KAAK,MAAM;EAChC,MAAM,SAAS,KAAK;EAEpB,MAAM,WAAW,OAAO,MAAM,KAC5B,OAAO,OACP,KAAK,MAAM,OAAO,OAAO,GAAG,OAAO,YAAY,SAAS,CAAC,GAAG,OAAO,eAAe,GAClF;GACE,OAAO;GACP,SAAS,cAAc,MAAM;GAC7B,SAAS,IAAI,OAAO,OAAO,OAAO,YAAY;EAChD,CACF,EAAA,CAAG;EAEH,MAAM,WAAW,oBAAoB,iBAAiB;GACpD;GACA,kBAAkB,IAAI,MAAM;GAC5B,aAAa,QAAQ,KAAK,WAAW;IACnC,cAAc,MAAM,OAAO;IAC3B,UAAU,MAAM,OAAO;GACzB,EAAE;EACJ,CAAC;EAED,UACE,IAAI,IAAI,SAAS,YAAY,KAAK,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,SAC7D,SAAS,YAAY,MACzB;EAEA,OAAO;GAAE;GAAW;GAAU;GAAK;EAAS;CAC9C,CAAC;CAED,MAAM,iBAAiB,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAC9D,SACA,SACA,MACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,QAAQ,KAAK;EAE3B,QAAQ,OAAO,MAAM,KACnB,MAAM,OACN,KACE,MAAM,MAAM,OAAO,GAAG,MAAM,YAAY,QAAQ,SAAS,CAAC,GAC1D,MAAM,iBACN,SAAS,KAAA,IAAY,KAAA,IAAY,MAAM,MAAM,OAAO,GAAG,MAAM,OAAO,KAAK,CAAC,CAC5E,GACA;GAAE,OAAO;GAAI,SAAS,IAAI,MAAM,OAAO,MAAM,YAAY;EAAE,CAC7D,EAAA,CAAG;CACL,CAAC;CAED,MAAM,WAAW,SAAc,QAAa;EAC1C,MAAM,QAAQ,QAAQ,KAAK;EAC3B,MAAM,QAAQ,QAAQ,MAAM;EAC5B,MAAM,UAAU,MAAM,OAAO,UAAU,GAAG,CAAC;EAE3C,OAAO,oBAAoB,0BAA0B;GACnD,cAAc,QAAQ;GACtB,MAAM,IAAI,MAAM;GAChB,eAAe,QAAQ;GACvB,iBAAiB,QAAQ,MAAM,cAAc,IAAI,MAAM,UAAU;GACjE,GAAI,IAAI,QAAQ,UAAU,gBAAgB,QAC1C,IAAI,QAAQ,UAAU,gBAAgB,KAAA,IAClC,CAAC,IACD,EAAE,kBAAkB,QAAQ,MAAM,cAAc,IAAI,QAAQ,UAAU,WAAW,EAAE;EACzF,CAAC;CACH;CAEA,MAAM,kBAAkB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WAChE,SACA,SACA,KACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,OAAO,QAAQ;EACrB,MAAM,QAAQ,KAAK;EAEnB,MAAM,UAAU,oBAAoB,mBAAmB;GACrD,GAAG,MAAM,OAAO,UAAU,GAAG,CAAC;GAC9B,UAAU,QAAQ;GAClB,QAAQ;EACV,CAAC;EAED,UACE,QAAQ,iBAAiB,IAAI,MAAM,iBACjC,QAAQ,QAAQ,SAAS,QAAQ,QACjC,KAAK,WAAW,OAAO,MAAM,gBAAgB,UAAU,GAAG,CAAC,GAAG,QAAQ,QAAQ,CAClF;EACA,MAAM,YAAY,KAAK;EACvB,MAAM,MAAM,OAAO,cAAc,QAAQ,MAAM,QAAQ,oBAAoB;EAE3E,MAAM,SAAS,OAAO,MAAM,KAC1B,UAAU,OACV,MAAM,UAAU,OAAO,GAAG,UAAU,gBAAgB,IAAI,CAAC,GACzD;GAAE,OAAO;GAAG,SAAS,cAAc,SAAS;EAAE,CAChD,EAAA,CAAG,KAAK;EAER,IACE,UAAU,KAAA,KACV,CAAC,UAAU,aAAa,MAAM,UAAU,MAAM,KAC9C,CAAC,KAAK,WAAW,OAAO,UAAU,gBAAgB,UAAU,KAAK,CAAC,GAAG,QAAQ,QAAQ,GAErF,OAAO,KAAA;EACT,UACE,MAAM,UAAU,UAAU,QAAQ,QAChC,MAAM,UAAU,0BAA0B,QAAQ,wBAClD,MAAM,UAAU,kBAAkB,QAAQ,gBAC1C,IAAI,MAAM,mBAAmB,GACjC;EACA,MAAM,SAAS,KAAK;EACpB,MAAM,eAAe,OAAO,UAAU,QAAQ,MAAM,QAAQ,UAAU;EAEtE,MAAM,QAAQ,OAAO,MAAM,KACzB,OAAO,OACP,MAAM,OAAO,OAAO,GAAG,OAAO,YAAY,aAAa,CAAC,GACxD;GAAE,OAAO;GAAG,SAAS,cAAc,MAAM;EAAE,CAC7C,EAAA,CAAG,KAAK;EAER,IACE,SAAS,KAAA,KACT,CAAC,OAAO,aAAa,KAAK,OAAO,MAAM,KACvC,CAAC,KAAK,WAAW,OAAO,OAAO,gBAAgB,UAAU,IAAI,CAAC,GAAG,QAAQ,QAAQ,GAEjF,OAAO,KAAA;EACT,UACE,KAAK,OAAO,UAAU,QAAQ,QAC5B,KAAK,OAAO,gBAAgB,QAAQ,cACpC,IAAI,MAAM,eAAe,YAC7B;EACA,UACE,QAAQ,SAAS,YAAY,MAC1B,SACC,KAAK,iBAAiB,QAAQ,gBAC9B,KAAK,aAAa,IAAI,MAAM,mBAChC,CACF;EAEA,OAAO;CACT,CAAC;CAED,MAAM,oBAAoB,SAAc,YACtC,oBACE,yBACA,QAAQ,MAAM,OAAO,WAAW,UAAU,QAAQ,GAAG,CAAC,CACxD;CAEF,MAAM,kBAAkB,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,SACA,SACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,YAAY,QAAQ,MAAM,OAAO,SAAS,QAAQ,QAAQ;EAChE,MAAM,UAAU,OAAO,MAAM,MAAM,SAAS;EAE5C,IAAI,SAAS,MAAM,eAAe,KAAK,SAAS;EAEhD,OAAO;CACT,CAAC;CAED,MAAM,oBAAoB,aAA8B;EACtD,UAAU,SAAS,QAAQ,SAAS,YAAY;EAChD,MAAM,UAAU,SAAS;EAEzB,OAAOD,SACL,OAAO,MAAM;GACX;GACA,OAAO,QAAQ,YAAY;GAC3B,OAAO,OAAO;IAAE,GAAG,aAAa;IAAQ,MAAM;GAAa,CAAC;GAC5D;GACA;GACA;GACA,OAAO,MAAM,iBAAiB;EAChC,CAAC,GACD;GACE,SAAS;GACT;GACA;IACE,QAAQ,SAAS;IACjB,WAAW,SAAS;IACpB,WAAW,SAAS,QAAQ;IAC5B,MAAM,QAAQ;GAChB;GACA,SAAS;GACT,QAAQ;GACR,QAAQ;GACR,SAAS;EACX,CACF;CACF;CAEA,MAAM,gBAAgB,UAAkB,WAAmB,eACzDA,SACE,OAAO,MAAM;EACX;EACA,OAAO,QAAQ,QAAQ;EACvB,aAAa,OAAO;EACpB;CACF,CAAC,GACD;EACE,gBAAgB,KAAK,QAAQ;EAC7B;EACA,aAAa,OAAO,UAAU,KAAK,SAAS;EAC5C;CACF,CACF;CAEF,MAAM,kBAAkB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WAChE,SACA,SACA,eACA,UAOA,QACA,UACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,EAAE,WAAW,aAAa;EAEhC,IACE,UAAU,aAAa,QAAQ,YAC/B,UAAU,WAAW,SAAS,UAC9B,UAAU,cAAc,SAAS,aACjC,UAAU,WAAW,SAAS,UAC9B,UAAU,kBAAkB,SAAS,iBACrC,SAAS,WAAW,SAAS,UAC7B,SAAS,kBAAkB,SAAS,iBACpC,CAAC,aAAa,UAAU,UAAU,SAAS,QAAQ,KACnD,QAAQ,SAAS,cAAc,SAAS,SAAS,aACjD,QAAQ,SAAS,qBAAqB,SAAS,SAAS,oBACxD,SAAS,SAAS,cAAc,QAAQ,aACxC,SAAS,SAAS,qBAAqB,QAAQ,SAAS,kBAExD,OAAO;EACT,KAAK,MAAM,YAAY,CAAC,SAAS,UAAU,SAAS,QAAQ,GAC1D,IACE,SAAS,YAAY,MAClB,SACC,CAAC,QAAQ,SAAS,YAAY,MAC3B,YACC,QAAQ,iBAAiB,KAAK,gBAAgB,QAAQ,aAAa,KAAK,QAC5E,CACJ,GAEA,OAAO;EACX,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;EAE1C,IACE,SAAS,OAAO,MACb,UACC,SAAS,cAAc,MAAM,UAAU,IAAI,OAC3C,CAAC,SAAS,SAAS,YAAY,MAAM,SAAS,KAAK,iBAAiB,MAAM,YAAY,CAC1F,GAEA,OAAO;EAET,MAAM,qBAGF,QAAQ,MAAM,OAAO,YAAY,UAAU,QAAQ,GAAG,GAAG,SAAS,MAAM;EAE5E,MAAM,UAAU,oBAAoB,oBAAoB,OAAO,kBAAkB;EAEjF,KAAK,MAAM,eAAe;GACxB,cAAc;GACd;GACA,GAAI,aAAa,KAAA,IAAY,CAAC,IAAI,CAAC,QAAQ;EAC7C,GAAG;GACD,MAAM,MAAM,KAAK,IAAI,OAAO,0BAA0B,YAAY,gBAAgB;GAElF,MAAM,QAAQ,SAAS,OAAO,QAC3B,UAAU,MAAM,SAAS,cAAc,MAAM,UAAU,IAAI,GAC9D;GAEA,MAAM,UAAU,IAAI,IAAI,MAAM,SAAS,UAAU,MAAM,OAAO,CAAC;GAE/D,IACE,CAAC,YAAY,aAAa,MACvB,gBACC,YAAY,QAAQ,OAAO,WAAW,QAAQ,IAAI,MAAM,CAAC,KACzD,IAAI,IAAI,MAAM,KAAK,UAAU,MAAM,YAAY,CAAC,CAAC,CAAC,QAChD,YAAY,sBACd,MAAM,MACH,WACE,CAAC,YAAY,gBAAgB,MAAM,kBACnC,CAAC,YAAY,qBAAqB,MAAM,kBAC7C,CACJ,GAEA,OAAO;GACT,MAAM,eAAe,KACnB,KACE,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,OAC1C,GAAG,MAAM,KACN,UACC,GAAG,GAAG,QAAQ,MAAM,gBAAgB,KAAK,SAAS,cAAc,MAAM,UAAU,IAAI,KACxF,CACF,CACF;EACF;EACA,MAAM,YAAY,QAAQ,MAAM,OAAO,OAAO,QAAQ,UAAU,aAAa;EAE7E,IAAI,EAAE,OAAO,MAAM,MAAM,SAAS,IAAI,OAAO;EAC7C,MAAM,eAAe,KAAK,SAAS;EAEnC,OAAO;CACT,CAAC;CAED,MAAM,uBACJ,SACA,UACA,WACG;EACH,IAAI,SAAS,qBAAqB,kBAAkB,SAAS,0BAA0B,GACrF,OAAO;EAIT,MAAM,gBACJ,SAAS,qBAAqB,kBAC9B,QAAQ,aAAa,OAAO,qBAAqB,cAC7C;GAAE,GAAG;GAAU,kBAAkB;GAAa,uBAAuB;EAAE,IACvE;EAEN,OACE,YAAY,yBAAyB,CAAC,CAAC,OAAO,aAAa,MACzD,YAAY,yBAAyB,CAAC,CAAC,OAAO,QAAQ,aAAa,MAAM,MAC1E,CAAC,OAAO,gCAAgC,SAAS,qBAAqB;CAE3E;CAEA,MAAM,aAAa,OAAO,GAAG,oCAAoC,CAAC,CAAC,WACjE,SACA,SACA,cACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,QAAQ,KAAK;EAC3B,MAAM,WAAW,gBAAgB,OAAO,iBAAiB,KAAK,MAAM,MAAM;EAE1E,OAAO,MAAM,OACX,MAAM,OACN,GAAG,MAAM,KAAK,QAAQ,SAAS,GAC/B,GAAG,MAAM,mBAAmB,SAAS,CACvC;EAEA,MAAM,QAAQ;GACZ,WAAW,QAAQ;GACnB,kBAAkB,QAAQ,SAAS;GACnC,kBAAkB;GAClB;EACF;EAEA,KAAK,MAAM,YAAY,QAAQ,aAAa,WAAW;GACrD,OAAO,MAAM,MACX,MAAM,SACH,OAAO,SAAS,KAAK,CAAC,CACtB,IAAI,SAAS,OAAO,KAAK,CAAC,CAAC,CAC3B,MAAM,SAAS,MAAM,KAAK,CAAC,CAChC;GACA,MAAM,eAAe,KAAK,SAAS,cAAc,KAAK,CAAC;EACzD;EACA,MAAM,eAAe,KAAK,QAAQ,aAAa,cAAc,KAAK,CAAC;EACnE,MAAM,OAAO,QAAQ;EACrB,MAAM,QAAQ,OAAO,aAAa,QAAQ,SAAS;EAEnD,MAAM,QAAQ,KACZ,MAAM,KAAK,OAAO,GAAG,KAAK,eAAe,MAAM,CAAC,GAChD,GAAG,GAAG,IAAI,KAAK,OAAO,KAAK,KAAK,EAAE,OAAO,KAAK,OAAO,QAAQ,IAAI,KAAK,OAAO,QAAQ,EACvF;EAEA,OAAO,MAAM,MACX,MAAM,SACH,OAAO,KAAK,KAAK,CAAC,CAClB,IAAI;IAAG,KAAK,QAAQ,KAAK,OAAO;IAAW,KAAK,UAAU,MAAM;EAAO,CAAC,CAAC,CACzE,MAAM,KAAK,CAChB;EACA,KAAK,MAAM,eAAe,MAAM,cAC9B,IAAI,YAAY,UAAU,KAAK,OAC7B,YAAY,OAAO,YAAY,KAAK,KAAK,QACvC,IAAI,KAAK,kBAAkB,SAC3B,CAAC,KAAK,OAAO,SAAS,KAAK,OAAO,OAAO,CAAC,CAAC,SAAS,IAAI,KAAK,MAAM,IAC/D;GAAE,GAAG;IAAM,KAAK,QAAQ,KAAK,OAAO;IAAW,KAAK,UAAU,MAAM;EAAO,IAC3E,GACN;EACJ,MAAM,eAAe,KAAK,GAAG,4BAA4B,KAAK,MAAM,SAAS,MAAM,EAAE;EAErF,OAAO;CACT,CAAC;CAED,MAAM,qBACJ,UACA,aAQA,SAAS,QAAQ,WAAW,MAAM,cAAc,cAAc,SAAS,SAAS,MAC/E,SAAS,QAAQ,qBAAqB,cAAc,SAAS,kBAC7D,CAAC,SAAS,eAAe,SAAS,mBACnC,CAAC,SAAS,mBAAmB,MAAM,SAAS,KAAK,OAAO,SAAS,oBAAoB;CA0JvF,OAAO;EACL;EACA,QAAA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,kBAvKuB,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,SACA,UACA,UACA,KACA;GACA,MAAM,QAAQ,OAAO;GAErB,UAAU,SAAS,QAAQ,SAAS,gBAAgB,SAAS,QAAQ,SAAS,cAAc;GAC5F,MAAM,OAAO,QAAQ;GACrB,MAAM,QAAQ,QAAQ;GACtB,MAAM,KAAK,kBAAkB,OAAO,aAAa,KAAK,MAAM,MAAM;GAElE,MAAM,aAAa,oBAAoB,mBAAmB;IACxD,cAAc;IACd,MAAM,SAAS,QAAQ;IACvB,sBAAsB,SAAS;IAC/B,YAAY,SAAS,QAAQ;IAC7B,WAAW,SAAS;IACpB,WAAW,SAAS;IACpB,SAAS,SAAS;IAClB,UAAU;KACR,GAAG,QAAQ;KACX,aAAa,CACX,GAAG,QAAQ,SAAS,aACpB;MACE,cAAc;MACd,UAAU,gBAAgB,OAAO,iBAAiB,KAAK,MAAM,MAAM;KACrE,CACF;IACF;IACA,QAAQ;IACR,eAAe,SAAS,QAAQ,iBAAiB,SAAS;IAC1D,wBAAwB,SAAS;IACjC,gBAAgB,SAAS;IACzB,aAAa,SAAS;IACtB,SAAS,SAAS;IAClB,gBAAgB,SAAS;GAC3B,CAAC;GAED,MAAM,OAAO,oBAAoB,0BAA0B;IACzD,cAAc;IACd,MAAM,SAAS,QAAQ;IACvB,eAAe,WAAW;IAC1B,iBAAiB;GACnB,CAAC;GAED,MAAM,QAAQ;IAAE,WAAW,QAAQ;IAAU;IAAY,SAAS;IAAM,QAAQ,MAAM;GAAO;GAC7F,MAAM,WAAW,OAAO,cAAc,WAAW,MAAM,WAAW,oBAAoB;GACtF,MAAM,eAAe,OAAO,UAAU,WAAW,MAAM,WAAW,UAAU;GAC5E,MAAM,QAAQ,KAAK;GAEnB,MAAM,SAAS,OAAO,MAAM,KAC1B,MAAM,OACN,MAAM,MAAM,OAAO,GAAG,MAAM,gBAAgB,SAAS,CAAC,GACtD,EAAE,OAAO,EAAE,CACb;GAEA,UAAU,OAAO,KAAK,WAAW,CAAC;GAElC,MAAM,WAAW,OAAO,MAAM,OAC5B,MAAM,OACN;IACE,GAAG,MAAM,oBAAoB,aAAa,KAAK;KAC9C,MAAM,gBAAgB;KACtB,MAAM,OAAO,WAAW;KACxB,MAAM,uBAAuB,WAAW;KACxC,MAAM,YAAY,QAAQ;KAC1B,MAAM,eAAe;KACrB,MAAM,QAAQ,MAAM,oBAAoB;KACxC,MAAM,UAAU,MAAM;KACtB,MAAM,gBAAgB;GACzB,GACA,GAAG,MAAM,gBAAgB,SAAS,CACpC;GAEA,OAAO,OAAO,SAAS;GACvB,MAAM,QAAQ,KAAK;GAEnB,MAAM,SAAS;IACb,GAAG,MAAM,WAAW,aAAa,KAAK;KACrC,MAAM,eAAe;KACrB,MAAM,YAAY,QAAQ;KAC1B,MAAM,OAAO,WAAW;KACxB,MAAM,uBAAuB,WAAW;KACxC,MAAM,gBAAgB;KACtB,MAAM,YAAY;KAClB,MAAM,aAAa,WAAW;KAC9B,MAAM,YAAY,WAAW;KAC7B,MAAM,qBAAqB,MAAM;KACjC,MAAM,SAAS,MAAM,WAAW;KAChC,MAAM,gBAAgB,MAAM,WAAW,oBAAoB,WAAW,aAAa;KACnF,MAAM,yBAAyB,MAAM,WAAW,6BAC/C,WAAW,sBACb;KACC,MAAM,iBAAiB,MAAM,WAAW,qBAAqB,WAAW,cAAc;KACtF,MAAM,cAAc,QAAQ,UAAU,kBAAkB,WAAW,WAAW;KAC9E,MAAM,UAAU,WAAW;KAC3B,MAAM,iBAAiB,WAAW;KAClC,MAAM,WAAW,OAAO,KAAK;KAC7B,MAAM,WAAW,YAAY,QAAQ,MAAM,cAAc,GAAG;KAC5D,QAAQ,UAAU,aAAa;GAClC;GAEA,OAAO,MAAM,OAAO,MAAM,OAAO,QAAQ,GAAG,MAAM,eAAe,GAAG,CAAC;GACrE,KAAK,MAAM,eAAe,MAAM,cAC9B,IACE,YAAY,UAAU,MAAM,SAC5B,YAAY,SAAS,SAAS,QAC9B,CAAC,YAAY,KAAK,MAAM,QAAQ,IAAI,MAAM,kBAAkB,EAAE,GAE9D,YAAY,OAAO,CAAC,GAAG,YAAY,MAAM,MAAM;GACnD,MAAM,SAAS,KAAK;GAEpB,MAAM,eAAe;IACnB,GAAG,MAAM,UAAU,aAAa,KAAK;KACpC,OAAO,YAAY,QAAQ;KAC3B,OAAO,eAAe;KACtB,OAAO,WAAW,MAAM;KACxB,OAAO,SAAS,MAAM,UAAU;GACnC;GAEA,OAAO,MAAM,OAAO,OAAO,OAAO,cAAc;KAC7C,OAAO,YAAY,QAAQ;KAC3B,OAAO,eAAe;GACzB,CAAC;GACD,KAAK,MAAM,eAAe,MAAM,cAC9B,IACE,YAAY,UAAU,OAAO,SAC7B,CAAC,YAAY,KAAK,MAAM,QAAQ,IAAI,OAAO,kBAAkB,EAAE,GAE/D,YAAY,OAAO,CAAC,GAAG,YAAY,MAAM,YAAY;GAEzD,MAAM,UAAU,oBAAoB,mBAAmB;IACrD,GAAG,MAAM,OAAO,UAAU,MAAM,CAAC;IACjC,UAAU,WAAW;IACrB,QAAQ;GACV,CAAC;GAED,UACE,eAAe,SAAS,UAAU,KAChC,QAAQ,YAAY,WAAW,WAC/B,QAAQ,mBAAmB,WAAW,kBACtC,QAAQ,gBAAgB,WAAW,WACvC;GACA,UAAU,QAAQ,SAAS,MAAM,CAAC,CAAC,iBAAiB,EAAE;GACtD,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,KAAK;GAEzE,OAAO;EACT,CAiBiB;CACjB;AACF"}

package/dist/internal/passkey/write-target.mjs

@@ -1,192 +0,0 @@
-import { CurrentPasskeyTransaction } from "./state.mjs";
-import { Effect, Layer, Schema } from "effect";
-import * as M from "@yielded/auth/Passkey";
-import { PasskeyConfigurationError, PasskeyManagementPersistence, PasskeyManagementPolicy, PasskeyMethodPolicy, snapshotPasskeySync } from "@yielded/auth/Passkey";
-import { SubjectId } from "@yielded/auth/Schema";
-import { LifecycleHooks } from "@yielded/auth/Hooks";
-import { SessionInvalidationWindow } from "@yielded/auth/Sessions";
-//#region src/internal/passkey/write-target.ts
-const makePasskeyWriteTargetKernel = (operations, enrollment, management, registrationWrite, state, target, execution) => {
-	const { getTableColumns } = operations;
-	const { completeEnrollment, issueEnrollment } = enrollment;
-	const { inspectRemove, listCredentials, removeCredential, renameCredential } = management;
-	const { completeRegistration, inspectRegistration, issueRegistration } = registrationWrite;
-	const { nonce, unavailable } = state;
-	const invariant = state.invariant;
-	const { capturedMapping, capturedService, makePasskeyExecution, makePasskeyPersistence, observationalContext, prepareValue } = target;
-	const { coordinateTransactionOwner } = execution;
-	const passkeyManagementPersistenceLayer = (services) => Layer.effect(PasskeyManagementPersistence, Effect.map(services, (value) => value.passkeyManagementPersistence));
-	const issueSchema = Schema.Struct({
-		ceremony: M.PasskeyCeremony,
-		policy: PasskeyMethodPolicy,
-		management: PasskeyManagementPolicy,
-		authorization: M.PasskeyActionAuthorization
-	});
-	const completeSchema = Schema.Struct({
-		claim: M.PasskeyClaim,
-		verified: M.PasskeyRegistrationVerified,
-		authorization: M.PasskeyActionAuthorization,
-		management: PasskeyManagementPolicy,
-		nowMillis: M.PasskeyInstant
-	});
-	const metadata = {
-		moduleId: M.PasskeyModuleId,
-		subjectId: SubjectId
-	};
-	const identity = {
-		...metadata,
-		commandId: M.PasskeyCommandId,
-		credentialId: M.PasskeyCredentialId
-	};
-	const retention = {
-		nowMillis: M.PasskeyInstant,
-		retentionUntilMillis: M.PasskeyInstant
-	};
-	const managementSchemas = {
-		list: Schema.Struct({
-			...metadata,
-			cursor: Schema.optionalKey(M.PasskeyCredentialId),
-			limit: Schema.Int.check(Schema.isBetween({
-				minimum: 1,
-				maximum: 64
-			}))
-		}),
-		issueEnrollment: issueSchema,
-		completeEnrollment: completeSchema,
-		inspectRemove: Schema.Struct(identity),
-		rename: Schema.Struct({
-			...identity,
-			...retention,
-			name: M.PasskeyLabel
-		}),
-		remove: Schema.Struct({
-			moduleId: M.PasskeyModuleId,
-			commandId: M.PasskeyCommandId,
-			credential: M.PasskeyCredential,
-			authorization: M.PasskeyActionAuthorization,
-			management: PasskeyManagementPolicy,
-			invalidation: SessionInvalidationWindow,
-			...retention
-		})
-	};
-	const enrolled = Schema.Union([Schema.TaggedStruct("Enrolled", { credential: M.PasskeyCredentialSummary }), Schema.TaggedStruct("Rejected", {})]);
-	const renamed = Schema.Union([Schema.TaggedStruct("Renamed", {
-		credential: M.PasskeyCredentialSummary,
-		replayed: Schema.Boolean
-	}), Schema.TaggedStruct("Rejected", {})]);
-	const removed = Schema.Union([
-		Schema.TaggedStruct("Removed", { result: M.PasskeyRemoved }),
-		Schema.TaggedStruct("Rejected", {}),
-		Schema.TaggedStruct("LastSignInMethod", {})
-	]);
-	const registrationDecision = Schema.Union([M.PasskeyRegistrationResult, Schema.TaggedStruct("Rejected", {})]);
-	const managementService = (mapping, execute) => capturedService({
-		list: (input) => execute.run(observationalContext(listCredentials(mapping, input)), false),
-		inspectRemove: (input) => execute.run(observationalContext(inspectRemove(mapping, input)), false),
-		issueEnrollment: (input, prepare) => execute.run(Effect.gen(function* () {
-			return yield* prepareValue(snapshotPasskeySync(M.PasskeyIssueDecision, yield* issueEnrollment(mapping, input)), prepare);
-		})),
-		completeEnrollment: (input, prepare) => execute.run(Effect.gen(function* () {
-			return yield* prepareValue(snapshotPasskeySync(enrolled, yield* completeEnrollment(mapping, input)), prepare);
-		})),
-		rename: (input, prepare) => execute.run(Effect.gen(function* () {
-			return yield* prepareValue(snapshotPasskeySync(renamed, yield* renameCredential(mapping, input)), prepare);
-		})),
-		remove: (input, prepare) => execute.run(Effect.gen(function* () {
-			return yield* prepareValue(snapshotPasskeySync(removed, yield* removeCredential(mapping, input)), prepare);
-		}))
-	}, managementSchemas, execute);
-	const registrationService = (mapping, execute) => capturedService({
-		inspect: (registration) => execute.run(observationalContext(inspectRegistration(mapping, registration)), false),
-		issueRegistration: (input, prepare) => execute.run(Effect.gen(function* () {
-			return yield* prepareValue(snapshotPasskeySync(M.PasskeyIssueDecision, yield* issueRegistration(mapping, input)), prepare);
-		})),
-		completeRegistration: (input, prepare) => execute.run(Effect.gen(function* () {
-			return yield* prepareValue(snapshotPasskeySync(registrationDecision, yield* completeRegistration(mapping, input)), prepare);
-		}))
-	}, {
-		inspect: Schema.toType(mapping.registration.schema),
-		issueRegistration: Schema.Struct({
-			ceremony: M.PasskeyCeremony,
-			policy: PasskeyMethodPolicy,
-			registration: Schema.toType(mapping.registration.schema)
-		}),
-		completeRegistration: Schema.Struct({
-			claim: M.PasskeyClaim,
-			verified: M.PasskeyRegistrationVerified,
-			nowMillis: M.PasskeyInstant
-		})
-	}, execute);
-	const descriptor = (table) => {
-		const columns = getTableColumns(table.table);
-		for (const [field, name] of Object.entries(table)) if (typeof name === "string" && !field.endsWith("State")) invariant(columns[name] !== void 0);
-	};
-	const writeMapping = (source, configuration, registration) => Effect.flatMap(capturedMapping(source, "assertion", configuration), (mapping) => Effect.try({
-		try: () => {
-			const m = mapping;
-			for (const name of [m.write.credential.name, m.write.credential.createdAt]) invariant(getTableColumns(m.read.credential.table)[name] !== void 0);
-			for (const name of m.write.policy.subjectColumns) invariant(getTableColumns(m.read.subject.table)[name] !== void 0);
-			invariant(m.write.credential.activeStatus !== m.write.credential.removedStatus && m.write.authority.activeStatus !== m.write.authority.removedStatus && m.write.credentialOwnership.ownedState !== m.write.credentialOwnership.removedState);
-			invariant(m.read.credential.isActiveStatus(m.write.credential.activeStatus) && !m.read.credential.isActiveStatus(m.write.credential.removedStatus) && m.read.authority.isActiveStatus(m.write.authority.activeStatus) && !m.read.authority.isActiveStatus(m.write.authority.removedStatus) && m.read.credentialOwnership.isOwnedState(m.write.credentialOwnership.ownedState) && !m.read.credentialOwnership.isOwnedState(m.write.credentialOwnership.removedState) && m.read.handleOwnership.isOwnedState(m.write.handleOwnership.ownedState));
-			if (registration) {
-				descriptor(m.intent);
-				descriptor(m.handle);
-				invariant(m.handle.table === m.read.handleOwnership.table);
-				invariant(m.handle.reservedState !== m.write.handleOwnership.ownedState && m.intent.pendingState !== m.intent.acceptedState && m.intent.rejectedState !== m.intent.pendingState && m.intent.rejectedState !== m.intent.acceptedState);
-				invariant(m.registrationConstraints.intentFlow.join("/") === "moduleId/flowId" && m.registrationConstraints.intentCommand.join("/") === "moduleId/commandId" && m.registrationConstraints.handle.join("/") === "handleKey");
-			} else {
-				descriptor(m.command);
-				invariant(m.managementConstraints.command.join("/") === "moduleId/commandId");
-				snapshotPasskeySync(SessionInvalidationWindow, m.invalidation.window);
-				invariant(m.invalidation.window.trigger === "credential-change" && m.invalidation.mutations.length <= 32);
-			}
-			return mapping;
-		},
-		catch: () => PasskeyConfigurationError.make({})
-	}));
-	const managementServices = (mapping, execute, configuration) => ({
-		passkeyManagementPersistence: managementService(mapping, execute),
-		passkeyPersistence: makePasskeyPersistence(mapping, execute, configuration, false, true)
-	});
-	const registrationServices = (mapping, execute, configuration) => ({
-		passkeyRegistrationAuthority: registrationService(mapping, execute),
-		passkeyPersistence: makePasskeyPersistence(mapping, execute, configuration, true)
-	});
-	const makeTargetPasskeyManagement = (source, configuration) => Effect.gen(function* () {
-		const mapping = yield* writeMapping(source, configuration, false);
-		const execution = yield* makePasskeyExecution(configuration, mapping);
-		return managementServices(mapping, execution, configuration);
-	});
-	const makeTargetPasskeyRegistrationWriter = (source, configuration) => Effect.gen(function* () {
-		const mapping = yield* writeMapping(source, configuration, true);
-		const execution = yield* makePasskeyExecution(configuration, mapping);
-		return registrationServices(mapping, execution, configuration);
-	});
-	const coordinateTargetPasskeyManagement = (database, source, configuration, body) => Effect.gen(function* () {
-		const mapping = yield* writeMapping(source, configuration, false);
-		const hooks = yield* LifecycleHooks;
-		return yield* coordinateTransactionOwner(database, CurrentPasskeyTransaction, configuration, operations.validateStorage?.(mapping) ?? Effect.void, unavailable, nonce, (execute) => managementServices(mapping, {
-			...execute,
-			run: (operation, mutation) => execute.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks))
-		}, configuration), body).pipe(Effect.provideService(LifecycleHooks, hooks));
-	});
-	const coordinateTargetPasskeyRegistrationWriter = (database, source, configuration, body) => Effect.gen(function* () {
-		const mapping = yield* writeMapping(source, configuration, true);
-		const hooks = yield* LifecycleHooks;
-		return yield* coordinateTransactionOwner(database, CurrentPasskeyTransaction, configuration, operations.validateStorage?.(mapping) ?? Effect.void, unavailable, nonce, (execute) => registrationServices(mapping, {
-			...execute,
-			run: (operation, mutation) => execute.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks))
-		}, configuration), body).pipe(Effect.provideService(LifecycleHooks, hooks));
-	});
-	return {
-		passkeyManagementPersistenceLayer,
-		makeTargetPasskeyManagement,
-		makeTargetPasskeyRegistrationWriter,
-		coordinateTargetPasskeyManagement,
-		coordinateTargetPasskeyRegistrationWriter
-	};
-};
-//#endregion
-export { makePasskeyWriteTargetKernel };
-
-//# sourceMappingURL=write-target.mjs.map

package/dist/internal/passkey/write-target.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"write-target.mjs","names":[],"sources":["../../../src/internal/passkey/write-target.ts"],"sourcesContent":["import { LifecycleHooks } from \"@yielded/auth/Hooks\";\n/* oxlint-disable no-explicit-any -- existing mapped-row bridge; public adapters preserve table, ID, and Effect types. */\nimport {\n  PasskeyConfigurationError,\n  PasskeyManagementPersistence,\n  PasskeyManagementPolicy,\n  PasskeyMethodPolicy,\n  snapshotPasskeySync,\n} from \"@yielded/auth/Passkey\";\nimport * as M from \"@yielded/auth/Passkey\";\nimport { SubjectId } from \"@yielded/auth/Schema\";\nimport { SessionInvalidationWindow } from \"@yielded/auth/Sessions\";\nimport { type Crypto, Effect, Layer, Schema } from \"effect\";\nimport type { Statement } from \"effect/sql/Statement\";\n\nimport type { PasskeyMappingSource } from \"../models/passkey-model\";\nimport type {\n  PasskeyManagementServices,\n  PasskeyRegistrationServices,\n  PasskeyRegistrationWriter,\n} from \"../models/passkey-write-model\";\nimport type { QueryOperations } from \"../query-operations\";\nimport type { makeTransactionExecutionKernel } from \"../transaction-execution-kernel\";\nimport type { NativeDatabase } from \"../transaction-kernel\";\nimport type { makePasskeyEnrollmentKernel } from \"./enrollment\";\nimport type { makePasskeyManagementKernel } from \"./management\";\nimport type { makePasskeyRegistrationWriteKernel } from \"./registration-write\";\nimport { CurrentPasskeyTransaction } from \"./state\";\nimport type { makePasskeyStateKernel } from \"./state\";\nimport type {\n  PasskeyExecution,\n  PasskeyCoordinatorError,\n  PasskeyTargetConfiguration,\n  makePasskeyTargetKernel,\n} from \"./target\";\n\nexport const makePasskeyWriteTargetKernel = (\n  operations: QueryOperations,\n  enrollment: Pick<\n    ReturnType<typeof makePasskeyEnrollmentKernel>,\n    \"completeEnrollment\" | \"issueEnrollment\"\n  >,\n  management: Pick<\n    ReturnType<typeof makePasskeyManagementKernel>,\n    \"inspectRemove\" | \"listCredentials\" | \"removeCredential\" | \"renameCredential\"\n  >,\n  registrationWrite: Pick<\n    ReturnType<typeof makePasskeyRegistrationWriteKernel>,\n    \"completeRegistration\" | \"inspectRegistration\" | \"issueRegistration\"\n  >,\n  state: Pick<ReturnType<typeof makePasskeyStateKernel>, \"invariant\" | \"nonce\" | \"unavailable\">,\n  target: Pick<\n    ReturnType<typeof makePasskeyTargetKernel>,\n    | \"capturedMapping\"\n    | \"capturedService\"\n    | \"makePasskeyExecution\"\n    | \"makePasskeyPersistence\"\n    | \"observationalContext\"\n    | \"prepareValue\"\n  >,\n  execution: Pick<ReturnType<typeof makeTransactionExecutionKernel>, \"coordinateTransactionOwner\">,\n) => {\n  const { getTableColumns } = operations;\n  const { completeEnrollment, issueEnrollment } = enrollment;\n  const { inspectRemove, listCredentials, removeCredential, renameCredential } = management;\n  const { completeRegistration, inspectRegistration, issueRegistration } = registrationWrite;\n  const { nonce, unavailable } = state;\n  const invariant: (value: unknown) => asserts value = state.invariant;\n\n  const {\n    capturedMapping,\n    capturedService,\n    makePasskeyExecution,\n    makePasskeyPersistence,\n    observationalContext,\n    prepareValue,\n  } = target;\n\n  const { coordinateTransactionOwner } = execution;\n\n  const passkeyManagementPersistenceLayer = <E, R>(\n    services: Effect.Effect<PasskeyManagementServices, E, R>,\n  ) =>\n    Layer.effect(\n      PasskeyManagementPersistence,\n      Effect.map(services, (value) => value.passkeyManagementPersistence),\n    );\n\n  const issueSchema = Schema.Struct({\n    ceremony: M.PasskeyCeremony,\n    policy: PasskeyMethodPolicy,\n    management: PasskeyManagementPolicy,\n    authorization: M.PasskeyActionAuthorization,\n  });\n\n  const completeSchema = Schema.Struct({\n    claim: M.PasskeyClaim,\n    verified: M.PasskeyRegistrationVerified,\n    authorization: M.PasskeyActionAuthorization,\n    management: PasskeyManagementPolicy,\n    nowMillis: M.PasskeyInstant,\n  });\n\n  const metadata = { moduleId: M.PasskeyModuleId, subjectId: SubjectId };\n\n  const identity = {\n    ...metadata,\n    commandId: M.PasskeyCommandId,\n    credentialId: M.PasskeyCredentialId,\n  };\n\n  const retention = { nowMillis: M.PasskeyInstant, retentionUntilMillis: M.PasskeyInstant };\n\n  const managementSchemas = {\n    list: Schema.Struct({\n      ...metadata,\n      cursor: Schema.optionalKey(M.PasskeyCredentialId),\n      limit: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 64 })),\n    }),\n    issueEnrollment: issueSchema,\n    completeEnrollment: completeSchema,\n    inspectRemove: Schema.Struct(identity),\n    rename: Schema.Struct({ ...identity, ...retention, name: M.PasskeyLabel }),\n    remove: Schema.Struct({\n      moduleId: M.PasskeyModuleId,\n      commandId: M.PasskeyCommandId,\n      credential: M.PasskeyCredential,\n      authorization: M.PasskeyActionAuthorization,\n      management: PasskeyManagementPolicy,\n      invalidation: SessionInvalidationWindow,\n      ...retention,\n    }),\n  };\n\n  const enrolled = Schema.Union([\n    Schema.TaggedStruct(\"Enrolled\", { credential: M.PasskeyCredentialSummary }),\n    Schema.TaggedStruct(\"Rejected\", {}),\n  ]);\n\n  const renamed = Schema.Union([\n    Schema.TaggedStruct(\"Renamed\", {\n      credential: M.PasskeyCredentialSummary,\n      replayed: Schema.Boolean,\n    }),\n    Schema.TaggedStruct(\"Rejected\", {}),\n  ]);\n\n  const removed = Schema.Union([\n    Schema.TaggedStruct(\"Removed\", { result: M.PasskeyRemoved }),\n    Schema.TaggedStruct(\"Rejected\", {}),\n    Schema.TaggedStruct(\"LastSignInMethod\", {}),\n  ]);\n\n  const registrationDecision = Schema.Union([\n    M.PasskeyRegistrationResult,\n    Schema.TaggedStruct(\"Rejected\", {}),\n  ]);\n\n  const managementService = (\n    mapping: any,\n    execute: PasskeyExecution,\n  ): PasskeyManagementPersistence[\"Service\"] =>\n    capturedService<PasskeyManagementPersistence[\"Service\"]>(\n      {\n        list: (input) => execute.run(observationalContext(listCredentials(mapping, input)), false),\n        inspectRemove: (input) =>\n          execute.run(observationalContext(inspectRemove(mapping, input)), false),\n        issueEnrollment: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              return yield* prepareValue(\n                snapshotPasskeySync(M.PasskeyIssueDecision, yield* issueEnrollment(mapping, input)),\n                prepare,\n              );\n            }),\n          ),\n        completeEnrollment: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              return yield* prepareValue(\n                snapshotPasskeySync(enrolled, yield* completeEnrollment(mapping, input)),\n                prepare,\n              );\n            }),\n          ),\n        rename: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              return yield* prepareValue(\n                snapshotPasskeySync(renamed, yield* renameCredential(mapping, input)),\n                prepare,\n              );\n            }),\n          ),\n        remove: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              return yield* prepareValue(\n                snapshotPasskeySync(removed, yield* removeCredential(mapping, input)),\n                prepare,\n              );\n            }),\n          ),\n      },\n      managementSchemas,\n      execute,\n    );\n\n  const registrationService = <R>(\n    mapping: any,\n    execute: PasskeyExecution,\n  ): PasskeyRegistrationWriter<R> =>\n    capturedService<PasskeyRegistrationWriter<R>>(\n      {\n        inspect: (registration) =>\n          execute.run(observationalContext(inspectRegistration(mapping, registration)), false),\n        issueRegistration: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              return yield* prepareValue(\n                snapshotPasskeySync(\n                  M.PasskeyIssueDecision,\n                  yield* issueRegistration(mapping, input),\n                ),\n                prepare,\n              );\n            }),\n          ),\n        completeRegistration: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              return yield* prepareValue(\n                snapshotPasskeySync(\n                  registrationDecision,\n                  yield* completeRegistration(mapping, input),\n                ),\n                prepare,\n              );\n            }),\n          ),\n      },\n      {\n        inspect: Schema.toType(mapping.registration.schema),\n        issueRegistration: Schema.Struct({\n          ceremony: M.PasskeyCeremony,\n          policy: PasskeyMethodPolicy,\n          registration: Schema.toType(mapping.registration.schema),\n        }),\n        completeRegistration: Schema.Struct({\n          claim: M.PasskeyClaim,\n          verified: M.PasskeyRegistrationVerified,\n          nowMillis: M.PasskeyInstant,\n        }),\n      },\n      execute,\n    );\n\n  const descriptor = (table: any) => {\n    const columns = getTableColumns(table.table);\n\n    for (const [field, name] of Object.entries(table))\n      if (typeof name === \"string\" && !field.endsWith(\"State\"))\n        invariant(columns[name] !== undefined);\n  };\n\n  const writeMapping = <M, RSetup>(\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n    registration: boolean,\n  ) =>\n    Effect.flatMap(capturedMapping(source, \"assertion\", configuration), (mapping) =>\n      Effect.try({\n        try: () => {\n          const m = mapping as any;\n\n          for (const name of [m.write.credential.name, m.write.credential.createdAt])\n            invariant(getTableColumns(m.read.credential.table)[name] !== undefined);\n          for (const name of m.write.policy.subjectColumns)\n            invariant(getTableColumns(m.read.subject.table)[name] !== undefined);\n          invariant(\n            m.write.credential.activeStatus !== m.write.credential.removedStatus &&\n              m.write.authority.activeStatus !== m.write.authority.removedStatus &&\n              m.write.credentialOwnership.ownedState !== m.write.credentialOwnership.removedState,\n          );\n          invariant(\n            m.read.credential.isActiveStatus(m.write.credential.activeStatus) &&\n              !m.read.credential.isActiveStatus(m.write.credential.removedStatus) &&\n              m.read.authority.isActiveStatus(m.write.authority.activeStatus) &&\n              !m.read.authority.isActiveStatus(m.write.authority.removedStatus) &&\n              m.read.credentialOwnership.isOwnedState(m.write.credentialOwnership.ownedState) &&\n              !m.read.credentialOwnership.isOwnedState(m.write.credentialOwnership.removedState) &&\n              m.read.handleOwnership.isOwnedState(m.write.handleOwnership.ownedState),\n          );\n          if (registration) {\n            descriptor(m.intent);\n            descriptor(m.handle);\n            invariant(m.handle.table === m.read.handleOwnership.table);\n            invariant(\n              m.handle.reservedState !== m.write.handleOwnership.ownedState &&\n                m.intent.pendingState !== m.intent.acceptedState &&\n                m.intent.rejectedState !== m.intent.pendingState &&\n                m.intent.rejectedState !== m.intent.acceptedState,\n            );\n            invariant(\n              m.registrationConstraints.intentFlow.join(\"/\") === \"moduleId/flowId\" &&\n                m.registrationConstraints.intentCommand.join(\"/\") === \"moduleId/commandId\" &&\n                m.registrationConstraints.handle.join(\"/\") === \"handleKey\",\n            );\n          } else {\n            descriptor(m.command);\n            invariant(m.managementConstraints.command.join(\"/\") === \"moduleId/commandId\");\n            snapshotPasskeySync(SessionInvalidationWindow, m.invalidation.window);\n            invariant(\n              m.invalidation.window.trigger === \"credential-change\" &&\n                m.invalidation.mutations.length <= 32,\n            );\n          }\n\n          return mapping;\n        },\n        catch: () => PasskeyConfigurationError.make({}),\n      }),\n    );\n\n  const managementServices = (\n    mapping: any,\n    execute: PasskeyExecution,\n    configuration: PasskeyTargetConfiguration,\n  ): PasskeyManagementServices => ({\n    passkeyManagementPersistence: managementService(mapping, execute),\n    passkeyPersistence: makePasskeyPersistence(mapping, execute, configuration, false, true),\n  });\n\n  const registrationServices = <R>(\n    mapping: any,\n    execute: PasskeyExecution,\n    configuration: PasskeyTargetConfiguration,\n  ): PasskeyRegistrationServices<R> => ({\n    passkeyRegistrationAuthority: registrationService<R>(mapping, execute),\n    passkeyPersistence: makePasskeyPersistence(mapping, execute, configuration, true),\n  });\n\n  const makeTargetPasskeyManagement = <M, RSetup>(\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n  ) =>\n    Effect.gen(function* () {\n      const mapping = yield* writeMapping(source, configuration, false);\n      const execution = yield* makePasskeyExecution(configuration, mapping);\n\n      return managementServices(mapping, execution, configuration);\n    });\n\n  const makeTargetPasskeyRegistrationWriter = <M, R, RSetup>(\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n  ) =>\n    Effect.gen(function* () {\n      const mapping = yield* writeMapping(source, configuration, true);\n      const execution = yield* makePasskeyExecution(configuration, mapping);\n\n      return registrationServices<R>(mapping, execution, configuration);\n    });\n\n  const coordinateTargetPasskeyManagement = <M, RSetup, Transaction, A, E, R>(\n    database: any,\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n    body: (\n      transaction: Transaction,\n      services: PasskeyManagementServices,\n      append: (statement: Statement<unknown>) => void,\n    ) => Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    PasskeyCoordinatorError<E>,\n    R | RSetup | LifecycleHooks | NativeDatabase | Crypto.Crypto\n  > =>\n    Effect.gen(function* () {\n      const mapping = yield* writeMapping(source, configuration, false);\n      const hooks = yield* LifecycleHooks;\n\n      return yield* coordinateTransactionOwner(\n        database,\n        CurrentPasskeyTransaction,\n        configuration,\n        operations.validateStorage?.(mapping) ?? Effect.void,\n        unavailable,\n        nonce,\n        (execute) =>\n          managementServices(\n            mapping,\n            {\n              ...execute,\n              run: (operation, mutation) =>\n                execute.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks)),\n            },\n            configuration,\n          ),\n        body,\n      ).pipe(Effect.provideService(LifecycleHooks, hooks));\n    });\n\n  const coordinateTargetPasskeyRegistrationWriter = <M, Value, RSetup, Transaction, A, E, R>(\n    database: any,\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n    body: (\n      transaction: Transaction,\n      services: PasskeyRegistrationServices<Value>,\n      append: (statement: Statement<unknown>) => void,\n    ) => Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    PasskeyCoordinatorError<E>,\n    R | RSetup | LifecycleHooks | NativeDatabase | Crypto.Crypto\n  > =>\n    Effect.gen(function* () {\n      const mapping = yield* writeMapping(source, configuration, true);\n      const hooks = yield* LifecycleHooks;\n\n      return yield* coordinateTransactionOwner(\n        database,\n        CurrentPasskeyTransaction,\n        configuration,\n        operations.validateStorage?.(mapping) ?? Effect.void,\n        unavailable,\n        nonce,\n        (execute) =>\n          registrationServices<Value>(\n            mapping,\n            {\n              ...execute,\n              run: (operation, mutation) =>\n                execute.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks)),\n            },\n            configuration,\n          ),\n        body,\n      ).pipe(Effect.provideService(LifecycleHooks, hooks));\n    });\n\n  return {\n    passkeyManagementPersistenceLayer,\n    makeTargetPasskeyManagement,\n    makeTargetPasskeyRegistrationWriter,\n    coordinateTargetPasskeyManagement,\n    coordinateTargetPasskeyRegistrationWriter,\n  };\n};\n"],"mappings":";;;;;;;;AAoCA,MAAa,gCACX,YACA,YAIA,YAIA,mBAIA,OACA,QASA,cACG;CACH,MAAM,EAAE,oBAAoB;CAC5B,MAAM,EAAE,oBAAoB,oBAAoB;CAChD,MAAM,EAAE,eAAe,iBAAiB,kBAAkB,qBAAqB;CAC/E,MAAM,EAAE,sBAAsB,qBAAqB,sBAAsB;CACzE,MAAM,EAAE,OAAO,gBAAgB;CAC/B,MAAM,YAA+C,MAAM;CAE3D,MAAM,EACJ,iBACA,iBACA,sBACA,wBACA,sBACA,iBACE;CAEJ,MAAM,EAAE,+BAA+B;CAEvC,MAAM,qCACJ,aAEA,MAAM,OACJ,8BACA,OAAO,IAAI,WAAW,UAAU,MAAM,4BAA4B,CACpE;CAEF,MAAM,cAAc,OAAO,OAAO;EAChC,UAAU,EAAE;EACZ,QAAQ;EACR,YAAY;EACZ,eAAe,EAAE;CACnB,CAAC;CAED,MAAM,iBAAiB,OAAO,OAAO;EACnC,OAAO,EAAE;EACT,UAAU,EAAE;EACZ,eAAe,EAAE;EACjB,YAAY;EACZ,WAAW,EAAE;CACf,CAAC;CAED,MAAM,WAAW;EAAE,UAAU,EAAE;EAAiB,WAAW;CAAU;CAErE,MAAM,WAAW;EACf,GAAG;EACH,WAAW,EAAE;EACb,cAAc,EAAE;CAClB;CAEA,MAAM,YAAY;EAAE,WAAW,EAAE;EAAgB,sBAAsB,EAAE;CAAe;CAExF,MAAM,oBAAoB;EACxB,MAAM,OAAO,OAAO;GAClB,GAAG;GACH,QAAQ,OAAO,YAAY,EAAE,mBAAmB;GAChD,OAAO,OAAO,IAAI,MAAM,OAAO,UAAU;IAAE,SAAS;IAAG,SAAS;GAAG,CAAC,CAAC;EACvE,CAAC;EACD,iBAAiB;EACjB,oBAAoB;EACpB,eAAe,OAAO,OAAO,QAAQ;EACrC,QAAQ,OAAO,OAAO;GAAE,GAAG;GAAU,GAAG;GAAW,MAAM,EAAE;EAAa,CAAC;EACzE,QAAQ,OAAO,OAAO;GACpB,UAAU,EAAE;GACZ,WAAW,EAAE;GACb,YAAY,EAAE;GACd,eAAe,EAAE;GACjB,YAAY;GACZ,cAAc;GACd,GAAG;EACL,CAAC;CACH;CAEA,MAAM,WAAW,OAAO,MAAM,CAC5B,OAAO,aAAa,YAAY,EAAE,YAAY,EAAE,yBAAyB,CAAC,GAC1E,OAAO,aAAa,YAAY,CAAC,CAAC,CACpC,CAAC;CAED,MAAM,UAAU,OAAO,MAAM,CAC3B,OAAO,aAAa,WAAW;EAC7B,YAAY,EAAE;EACd,UAAU,OAAO;CACnB,CAAC,GACD,OAAO,aAAa,YAAY,CAAC,CAAC,CACpC,CAAC;CAED,MAAM,UAAU,OAAO,MAAM;EAC3B,OAAO,aAAa,WAAW,EAAE,QAAQ,EAAE,eAAe,CAAC;EAC3D,OAAO,aAAa,YAAY,CAAC,CAAC;EAClC,OAAO,aAAa,oBAAoB,CAAC,CAAC;CAC5C,CAAC;CAED,MAAM,uBAAuB,OAAO,MAAM,CACxC,EAAE,2BACF,OAAO,aAAa,YAAY,CAAC,CAAC,CACpC,CAAC;CAED,MAAM,qBACJ,SACA,YAEA,gBACE;EACE,OAAO,UAAU,QAAQ,IAAI,qBAAqB,gBAAgB,SAAS,KAAK,CAAC,GAAG,KAAK;EACzF,gBAAgB,UACd,QAAQ,IAAI,qBAAqB,cAAc,SAAS,KAAK,CAAC,GAAG,KAAK;EACxE,kBAAkB,OAAO,YACvB,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,OAAO,OAAO,aACZ,oBAAoB,EAAE,sBAAsB,OAAO,gBAAgB,SAAS,KAAK,CAAC,GAClF,OACF;EACF,CAAC,CACH;EACF,qBAAqB,OAAO,YAC1B,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,OAAO,OAAO,aACZ,oBAAoB,UAAU,OAAO,mBAAmB,SAAS,KAAK,CAAC,GACvE,OACF;EACF,CAAC,CACH;EACF,SAAS,OAAO,YACd,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,OAAO,OAAO,aACZ,oBAAoB,SAAS,OAAO,iBAAiB,SAAS,KAAK,CAAC,GACpE,OACF;EACF,CAAC,CACH;EACF,SAAS,OAAO,YACd,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,OAAO,OAAO,aACZ,oBAAoB,SAAS,OAAO,iBAAiB,SAAS,KAAK,CAAC,GACpE,OACF;EACF,CAAC,CACH;CACJ,GACA,mBACA,OACF;CAEF,MAAM,uBACJ,SACA,YAEA,gBACE;EACE,UAAU,iBACR,QAAQ,IAAI,qBAAqB,oBAAoB,SAAS,YAAY,CAAC,GAAG,KAAK;EACrF,oBAAoB,OAAO,YACzB,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,OAAO,OAAO,aACZ,oBACE,EAAE,sBACF,OAAO,kBAAkB,SAAS,KAAK,CACzC,GACA,OACF;EACF,CAAC,CACH;EACF,uBAAuB,OAAO,YAC5B,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,OAAO,OAAO,aACZ,oBACE,sBACA,OAAO,qBAAqB,SAAS,KAAK,CAC5C,GACA,OACF;EACF,CAAC,CACH;CACJ,GACA;EACE,SAAS,OAAO,OAAO,QAAQ,aAAa,MAAM;EAClD,mBAAmB,OAAO,OAAO;GAC/B,UAAU,EAAE;GACZ,QAAQ;GACR,cAAc,OAAO,OAAO,QAAQ,aAAa,MAAM;EACzD,CAAC;EACD,sBAAsB,OAAO,OAAO;GAClC,OAAO,EAAE;GACT,UAAU,EAAE;GACZ,WAAW,EAAE;EACf,CAAC;CACH,GACA,OACF;CAEF,MAAM,cAAc,UAAe;EACjC,MAAM,UAAU,gBAAgB,MAAM,KAAK;EAE3C,KAAK,MAAM,CAAC,OAAO,SAAS,OAAO,QAAQ,KAAK,GAC9C,IAAI,OAAO,SAAS,YAAY,CAAC,MAAM,SAAS,OAAO,GACrD,UAAU,QAAQ,UAAU,KAAA,CAAS;CAC3C;CAEA,MAAM,gBACJ,QACA,eACA,iBAEA,OAAO,QAAQ,gBAAgB,QAAQ,aAAa,aAAa,IAAI,YACnE,OAAO,IAAI;EACT,WAAW;GACT,MAAM,IAAI;GAEV,KAAK,MAAM,QAAQ,CAAC,EAAE,MAAM,WAAW,MAAM,EAAE,MAAM,WAAW,SAAS,GACvE,UAAU,gBAAgB,EAAE,KAAK,WAAW,KAAK,CAAC,CAAC,UAAU,KAAA,CAAS;GACxE,KAAK,MAAM,QAAQ,EAAE,MAAM,OAAO,gBAChC,UAAU,gBAAgB,EAAE,KAAK,QAAQ,KAAK,CAAC,CAAC,UAAU,KAAA,CAAS;GACrE,UACE,EAAE,MAAM,WAAW,iBAAiB,EAAE,MAAM,WAAW,iBACrD,EAAE,MAAM,UAAU,iBAAiB,EAAE,MAAM,UAAU,iBACrD,EAAE,MAAM,oBAAoB,eAAe,EAAE,MAAM,oBAAoB,YAC3E;GACA,UACE,EAAE,KAAK,WAAW,eAAe,EAAE,MAAM,WAAW,YAAY,KAC9D,CAAC,EAAE,KAAK,WAAW,eAAe,EAAE,MAAM,WAAW,aAAa,KAClE,EAAE,KAAK,UAAU,eAAe,EAAE,MAAM,UAAU,YAAY,KAC9D,CAAC,EAAE,KAAK,UAAU,eAAe,EAAE,MAAM,UAAU,aAAa,KAChE,EAAE,KAAK,oBAAoB,aAAa,EAAE,MAAM,oBAAoB,UAAU,KAC9E,CAAC,EAAE,KAAK,oBAAoB,aAAa,EAAE,MAAM,oBAAoB,YAAY,KACjF,EAAE,KAAK,gBAAgB,aAAa,EAAE,MAAM,gBAAgB,UAAU,CAC1E;GACA,IAAI,cAAc;IAChB,WAAW,EAAE,MAAM;IACnB,WAAW,EAAE,MAAM;IACnB,UAAU,EAAE,OAAO,UAAU,EAAE,KAAK,gBAAgB,KAAK;IACzD,UACE,EAAE,OAAO,kBAAkB,EAAE,MAAM,gBAAgB,cACjD,EAAE,OAAO,iBAAiB,EAAE,OAAO,iBACnC,EAAE,OAAO,kBAAkB,EAAE,OAAO,gBACpC,EAAE,OAAO,kBAAkB,EAAE,OAAO,aACxC;IACA,UACE,EAAE,wBAAwB,WAAW,KAAK,GAAG,MAAM,qBACjD,EAAE,wBAAwB,cAAc,KAAK,GAAG,MAAM,wBACtD,EAAE,wBAAwB,OAAO,KAAK,GAAG,MAAM,WACnD;GACF,OAAO;IACL,WAAW,EAAE,OAAO;IACpB,UAAU,EAAE,sBAAsB,QAAQ,KAAK,GAAG,MAAM,oBAAoB;IAC5E,oBAAoB,2BAA2B,EAAE,aAAa,MAAM;IACpE,UACE,EAAE,aAAa,OAAO,YAAY,uBAChC,EAAE,aAAa,UAAU,UAAU,EACvC;GACF;GAEA,OAAO;EACT;EACA,aAAa,0BAA0B,KAAK,CAAC,CAAC;CAChD,CAAC,CACH;CAEF,MAAM,sBACJ,SACA,SACA,mBAC+B;EAC/B,8BAA8B,kBAAkB,SAAS,OAAO;EAChE,oBAAoB,uBAAuB,SAAS,SAAS,eAAe,OAAO,IAAI;CACzF;CAEA,MAAM,wBACJ,SACA,SACA,mBACoC;EACpC,8BAA8B,oBAAuB,SAAS,OAAO;EACrE,oBAAoB,uBAAuB,SAAS,SAAS,eAAe,IAAI;CAClF;CAEA,MAAM,+BACJ,QACA,kBAEA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,aAAa,QAAQ,eAAe,KAAK;EAChE,MAAM,YAAY,OAAO,qBAAqB,eAAe,OAAO;EAEpE,OAAO,mBAAmB,SAAS,WAAW,aAAa;CAC7D,CAAC;CAEH,MAAM,uCACJ,QACA,kBAEA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,aAAa,QAAQ,eAAe,IAAI;EAC/D,MAAM,YAAY,OAAO,qBAAqB,eAAe,OAAO;EAEpE,OAAO,qBAAwB,SAAS,WAAW,aAAa;CAClE,CAAC;CAEH,MAAM,qCACJ,UACA,QACA,eACA,SAUA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,aAAa,QAAQ,eAAe,KAAK;EAChE,MAAM,QAAQ,OAAO;EAErB,OAAO,OAAO,2BACZ,UACA,2BACA,eACA,WAAW,kBAAkB,OAAO,KAAK,OAAO,MAChD,aACA,QACC,YACC,mBACE,SACA;GACE,GAAG;GACH,MAAM,WAAW,aACf,QAAQ,IAAI,WAAW,QAAQ,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;EACtF,GACA,aACF,GACF,IACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CACrD,CAAC;CAEH,MAAM,6CACJ,UACA,QACA,eACA,SAUA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,aAAa,QAAQ,eAAe,IAAI;EAC/D,MAAM,QAAQ,OAAO;EAErB,OAAO,OAAO,2BACZ,UACA,2BACA,eACA,WAAW,kBAAkB,OAAO,KAAK,OAAO,MAChD,aACA,QACC,YACC,qBACE,SACA;GACE,GAAG;GACH,MAAM,WAAW,aACf,QAAQ,IAAI,WAAW,QAAQ,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;EACtF,GACA,aACF,GACF,IACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CACrD,CAAC;CAEH,OAAO;EACL;EACA;EACA;EACA;EACA;CACF;AACF"}