@yielded/auth-persistence 0.1.0-beta.30 → 0.1.0-beta.32

package/dist/internal/passkey-native-state.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"passkey-native-state.mjs","names":[],"sources":["../../src/internal/passkey-native-state.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- physical mapping generics are erased only at this shared adapter boundary. */\nimport * as M from \"@yielded/auth/Passkey\";\nimport { Effect, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\nimport type { Fragment } from \"effect/sql/Statement\";\n\nimport type { PasskeyCredentialMapping, PasskeyPersistenceMapping } from \"./models/passkey-model\";\nimport { sqlMapping, type NativeSqlTables } from \"./native-sql-table\";\nimport { makePasskeyNativeFlow } from \"./passkey-native-flow\";\nimport { passkeyCredentialKey } from \"./passkey-policy\";\nimport { exactSqlText } from \"./sql-change\";\nimport type { TableModel } from \"./table-model\";\n\n// Physical expression types are validated by NativeSqlTables at this boundary.\nexport type PasskeyNativeRead = PasskeyCredentialMapping<\n  TableModel,\n  TableModel,\n  TableModel,\n  unknown,\n  any\n>;\n\nexport type PasskeyNativeMapping = PasskeyPersistenceMapping<\n  PasskeyNativeRead,\n  TableModel,\n  unknown,\n  any\n>;\n\nexport type PasskeyNativeRow = Readonly<Record<string, unknown>>;\n\nexport const passkeyNativeInvariant: (value: unknown) => asserts value = (value) => {\n  if (!value) throw M.PasskeyUnavailable.make({});\n};\n\nexport const makePasskeyNativeReadState = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  read: PasskeyNativeRead,\n  clock?: PasskeyNativeMapping[\"clock\"],\n) {\n  const sql = (yield* SqlClient.SqlClient).withoutTransforms();\n  const subject = tables(read.subject.table);\n  const credential = tables(read.credential.table);\n  const factor = tables(read.authority.table);\n  const now = clock === undefined ? sql`0` : tables.expression(clock.engineNowMillis);\n\n  const millis = (expression: Fragment) =>\n    clock === undefined ? expression : tables.expression(clock.toMillis(expression));\n\n  const storedNow =\n    clock === undefined ? sql`0` : tables.expression(clock.fromMillis(clock.engineNowMillis));\n\n  const active = (table: \"subject\" | \"credential\" | \"authority\") =>\n    tables.expression(read[table].activeCondition);\n\n  const invariant: typeof passkeyNativeInvariant = passkeyNativeInvariant;\n  const sameId = (nativeId: unknown, value: unknown) => read.subjectIds.equals(nativeId, value);\n\n  const native = (id: M.PasskeyCredential[\"revision\"][\"subjectId\"]) => {\n    const value = read.subjectIds.toNative(id);\n\n    invariant(read.subjectIds.toSubject(value) === id);\n\n    return value;\n  };\n\n  const revisions = (nativeId: unknown, rows: ReadonlyArray<PasskeyNativeRow>) => {\n    const entries = new Map<string, M.PasskeyCredential[\"revision\"][\"securityRevision\"]>();\n\n    for (const row of rows) {\n      if (row[read.authority.credentialId] === null) continue;\n      invariant(sameId(nativeId, row[read.authority.subjectId]));\n      if (!read.authority.isActiveStatus(row[read.authority.status])) continue;\n\n      const decoded = Schema.decodeUnknownSync(M.PasskeyRevision.fields.credentials)([\n        {\n          credentialId: row[read.authority.credentialId],\n          revision: row[read.authority.revision],\n        },\n      ]);\n\n      const entry = decoded[0];\n\n      invariant(entry !== undefined);\n      const previous = entries.get(entry.credentialId);\n\n      invariant(previous === undefined || previous === entry.revision);\n      entries.set(entry.credentialId, entry.revision);\n    }\n    invariant(entries.size <= 64);\n\n    return [...entries]\n      .sort(([a], [b]) => a.localeCompare(b))\n      .map(([credentialId, revision]) => ({ credentialId, revision }));\n  };\n\n  const revision = (row: PasskeyNativeRow, factors: ReadonlyArray<PasskeyNativeRow>) => {\n    const id = read.subject.decodeId(row);\n    const subjectId = read.subjectIds.toSubject(id);\n\n    invariant(sameId(native(subjectId), id));\n\n    return Schema.decodeUnknownSync(M.PasskeyRevision)({\n      subjectId,\n      securityRevision: row[read.subject.securityRevision],\n      credentials: revisions(id, factors),\n    });\n  };\n\n  const decodeCredential = Effect.fnUntraced(function* (\n    row: PasskeyNativeRow,\n    current: M.PasskeyCredential[\"revision\"],\n    subjectRow: PasskeyNativeRow,\n  ) {\n    const value = read.credential.decode(row);\n    const owned = current.credentials.find((entry) => entry.credentialId === value.credentialId);\n\n    if (\n      !read.credential.isActiveStatus(row[read.credential.status]) ||\n      owned?.revision !== row[read.credential.credentialRevision]\n    )\n      return undefined;\n    invariant(\n      read.subjectIds.toSubject(read.credential.decodeSubjectId(row)) === current.subjectId,\n    );\n\n    return M.snapshotPasskeySync(M.PasskeyCredential, {\n      ...value,\n      revision: current,\n      requirement: yield* read.subject.decodeRequirement(subjectRow),\n      active: true,\n    });\n  });\n\n  const readAuthority = Effect.fnUntraced(function* (\n    nativeId: unknown,\n    lock: boolean,\n    credentialId?: string,\n  ) {\n    // The subject lock is a distinct first statement; joined FOR UPDATE cannot\n    // establish the lock order required by coordinated application transactions.\n    if (lock) {\n      const locked =\n        yield* sql<PasskeyNativeRow>`select ${subject.fields(\"s_\")}, ${now} as \"engineNow\" from ${subject.name} where ${subject.column(read.subject.id)} = ${subject.value(read.subject.id, nativeId)} and ${active(\"subject\")} ${sql.onDialectOrElse({ pg: () => sql`for update`, mysql: () => sql`for update`, orElse: () => sql`` })}`;\n\n      if (locked.length !== 1) return undefined;\n      const row = subject.decode(locked[0]!, \"s_\");\n\n      if (\n        !sameId(read.subject.decodeId(row), nativeId) ||\n        !read.subject.isActiveStatus(row[read.subject.status])\n      )\n        return undefined;\n\n      const lockedFactors = sql`select ${factor.fields(\"f_\")} from ${factor.name} where ${factor.column(read.authority.subjectId)} = ${factor.value(read.authority.subjectId, nativeId)} and ${active(\"authority\")} order by ${factor.column(read.authority.credentialId)} limit 65 ${sql.onDialectOrElse({ pg: () => sql`for update`, mysql: () => sql`for update`, orElse: () => sql`` })}`;\n\n      const rows =\n        credentialId === undefined\n          ? yield* sql<PasskeyNativeRow>`${lockedFactors}`\n          : yield* sql<PasskeyNativeRow>`with locked_factors as ${sql.onDialectOrElse({ pg: () => sql`materialized`, orElse: () => sql`` })} (${lockedFactors})\n        select locked_factors.*, ${credential.fields(\"c_\")} from ${credential.name} left join locked_factors on 1 = 1\n        where ${credential.column(read.credential.subjectId)} = ${credential.value(read.credential.subjectId, nativeId)} and ${exactSqlText(sql, credential.column(read.credential.credentialId), credential.value(read.credential.credentialId, credentialId))} and ${active(\"credential\")}`;\n\n      invariant(rows.length <= 64);\n\n      return {\n        row,\n        credential:\n          credentialId === undefined || rows[0] === undefined\n            ? undefined\n            : credential.decode(rows[0], \"c_\"),\n        revision: revision(\n          row,\n          rows.map((row) => factor.decode(row, \"f_\")),\n        ),\n        nowMillis: yield* Schema.decodeEffect(Schema.Int)(Number(locked[0]!.engineNow)),\n      };\n    }\n\n    const observedSubject = joinedSubject,\n      observedFactor = joinedFactor;\n\n    const rows =\n      yield* sql<PasskeyNativeRow>`select ${observedSubject.fields(\"s_\")}, ${observedFactor.fields(\"f_\")}, ${now} as \"engineNow\" ${credentialId === undefined ? sql`` : sql`, ${joinedCredential.fields(\"c_\")}`} from ${selected(\"subject\", \"passkey_subject\")} left join ${selected(\"authority\", \"passkey_factor\")} on ${observedFactor.column(read.authority.subjectId)} = ${observedFactor.value(read.authority.subjectId, nativeId)} ${credentialId === undefined ? sql`` : sql`join ${selected(\"credential\", \"passkey_credential\")} on ${joinedCredential.column(read.credential.subjectId)} = ${joinedCredential.value(read.credential.subjectId, nativeId)} and ${exactSqlText(sql, joinedCredential.column(read.credential.credentialId), joinedCredential.value(read.credential.credentialId, credentialId))}`} where ${observedSubject.column(read.subject.id)} = ${observedSubject.value(read.subject.id, nativeId)} limit 65`;\n\n    if (rows.length === 0 || rows.length > 64) return undefined;\n    const row = observedSubject.decode(rows[0]!, \"s_\");\n\n    if (\n      !sameId(read.subject.decodeId(row), nativeId) ||\n      !read.subject.isActiveStatus(row[read.subject.status])\n    )\n      return undefined;\n    invariant(\n      rows.every((selected) => {\n        const other = observedSubject.decode(selected, \"s_\");\n\n        return (\n          sameId(read.subject.decodeId(other), nativeId) &&\n          other[read.subject.securityRevision] === row[read.subject.securityRevision] &&\n          read.subject.isActiveStatus(other[read.subject.status])\n        );\n      }),\n    );\n\n    return {\n      row,\n      credential: credentialId === undefined ? undefined : joinedCredential.decode(rows[0]!, \"c_\"),\n      revision: revision(\n        row,\n        rows.map((selected) => observedFactor.decode(selected, \"f_\")),\n      ),\n      nowMillis: yield* Schema.decodeEffect(Schema.Int)(Number(rows[0]!.engineNow)),\n    };\n  });\n\n  // Active predicates retain their original table qualification inside each\n  // subquery; aliases allow applications to map several roles to one table.\n  const joinedSubject = subject.as(\"passkey_subject\");\n  const joinedFactor = factor.as(\"passkey_factor\");\n  const joinedCredential = credential.as(\"passkey_credential\");\n\n  const selected = (kind: \"subject\" | \"authority\" | \"credential\", alias: string) => {\n    const table = kind === \"subject\" ? subject : kind === \"authority\" ? factor : credential;\n\n    return sql`(select * from ${table.name} where ${active(kind)}) as ${sql(alias)}`;\n  };\n\n  const lookup = Effect.fnUntraced(function* (rpId: string, protocolCredentialId: string) {\n    const key = yield* passkeyCredentialKey(rpId, protocolCredentialId);\n\n    if (\n      subject.unencodedTextColumn?.(read.subject.id) !== undefined &&\n      credential.unencodedTextColumn?.(read.credential.subjectId) !== undefined &&\n      factor.unencodedTextColumn?.(read.authority.subjectId) !== undefined\n    ) {\n      const s = joinedSubject,\n        c = joinedCredential,\n        f = joinedFactor;\n\n      const rows =\n        yield* sql<PasskeyNativeRow>`select ${s.fields(\"s_\")}, ${c.fields(\"c_\")}, ${f.fields(\"f_\")}\n        from ${selected(\"credential\", \"passkey_credential\")}\n        join ${selected(\"subject\", \"passkey_subject\")} on ${exactSqlText(sql, s.column(read.subject.id), c.column(read.credential.subjectId))}\n        left join ${selected(\"authority\", \"passkey_factor\")} on ${exactSqlText(sql, f.column(read.authority.subjectId), c.column(read.credential.subjectId))}\n        where ${exactSqlText(sql, c.column(read.credential.credentialKey), c.value(read.credential.credentialKey, key))} limit 65`;\n\n      if (rows.length === 0 || rows.length > 64) return undefined;\n      const row = c.decode(rows[0]!, \"c_\");\n      const subjectRow = s.decode(rows[0]!, \"s_\");\n      const owner = read.credential.decodeSubjectId(row);\n\n      invariant(\n        row[read.credential.rpId] === rpId &&\n          row[read.credential.protocolCredentialId] === protocolCredentialId,\n      );\n      invariant(\n        rows.every((selected) => {\n          const other = c.decode(selected, \"c_\");\n          const subjectValue = s.decode(selected, \"s_\");\n\n          return (\n            sameId(owner, read.credential.decodeSubjectId(other)) &&\n            sameId(owner, read.subject.decodeId(subjectValue)) &&\n            other[read.credential.credentialId] === row[read.credential.credentialId] &&\n            other[read.credential.credentialRevision] === row[read.credential.credentialRevision] &&\n            subjectValue[read.subject.securityRevision] ===\n              subjectRow[read.subject.securityRevision]\n          );\n        }),\n      );\n\n      return yield* decodeCredential(\n        row,\n        revision(\n          subjectRow,\n          rows.map((row) => f.decode(row, \"f_\")),\n        ),\n        subjectRow,\n      );\n    }\n\n    const rows =\n      yield* sql<PasskeyNativeRow>`select ${credential.fields(\"c_\")} from ${credential.name} where ${credential.column(read.credential.credentialKey)} = ${credential.value(read.credential.credentialKey, key)} and ${active(\"credential\")}`;\n\n    if (rows.length !== 1) return undefined;\n    const row = credential.decode(rows[0]!, \"c_\");\n\n    invariant(\n      row[read.credential.rpId] === rpId &&\n        row[read.credential.protocolCredentialId] === protocolCredentialId,\n    );\n    const current = yield* readAuthority(read.credential.decodeSubjectId(row), false);\n\n    return current === undefined\n      ? undefined\n      : yield* decodeCredential(row, current.revision, current.row);\n  });\n\n  return {\n    sql,\n    tables,\n    subject,\n    credential,\n    factor,\n    now,\n    storedNow,\n    millis,\n    active,\n    native,\n    sameId,\n    revision,\n    decodeCredential,\n    readAuthority,\n    lookup,\n    joinedSubject,\n    joinedFactor,\n    joinedCredential,\n    selected,\n    mapped: sqlMapping,\n  };\n});\n\nexport const makePasskeyNativeState = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: PasskeyNativeMapping,\n) {\n  const state = yield* makePasskeyNativeReadState(tables, mapping.read, mapping.clock);\n  const ceremony = yield* makePasskeyNativeFlow(tables, mapping);\n\n  return { ...state, mapping, ceremony, flow: ceremony.flow, access: ceremony.access };\n});\n\nexport type PasskeyNativeReadState = Effect.Success<ReturnType<typeof makePasskeyNativeReadState>>;\nexport type PasskeyNativeState = Effect.Success<ReturnType<typeof makePasskeyNativeState>>;\n"],"mappings":";;;;;;;;AA+BA,MAAa,0BAA6D,UAAU;CAClF,IAAI,CAAC,OAAO,MAAM,EAAE,mBAAmB,KAAK,CAAC,CAAC;AAChD;AAEA,MAAa,6BAA6B,OAAO,WAAW,WAC1D,QACA,MACA,OACA;CACA,MAAM,OAAO,OAAO,UAAU,UAAA,CAAW,kBAAkB;CAC3D,MAAM,UAAU,OAAO,KAAK,QAAQ,KAAK;CACzC,MAAM,aAAa,OAAO,KAAK,WAAW,KAAK;CAC/C,MAAM,SAAS,OAAO,KAAK,UAAU,KAAK;CAC1C,MAAM,MAAM,UAAU,KAAA,IAAY,GAAG,MAAM,OAAO,WAAW,MAAM,eAAe;CAElF,MAAM,UAAU,eACd,UAAU,KAAA,IAAY,aAAa,OAAO,WAAW,MAAM,SAAS,UAAU,CAAC;CAEjF,MAAM,YACJ,UAAU,KAAA,IAAY,GAAG,MAAM,OAAO,WAAW,MAAM,WAAW,MAAM,eAAe,CAAC;CAE1F,MAAM,UAAU,UACd,OAAO,WAAW,KAAK,MAAM,CAAC,eAAe;CAE/C,MAAM,YAA2C;CACjD,MAAM,UAAU,UAAmB,UAAmB,KAAK,WAAW,OAAO,UAAU,KAAK;CAE5F,MAAM,UAAU,OAAqD;EACnE,MAAM,QAAQ,KAAK,WAAW,SAAS,EAAE;EAEzC,UAAU,KAAK,WAAW,UAAU,KAAK,MAAM,EAAE;EAEjD,OAAO;CACT;CAEA,MAAM,aAAa,UAAmB,SAA0C;EAC9E,MAAM,0BAAU,IAAI,IAAiE;EAErF,KAAK,MAAM,OAAO,MAAM;GACtB,IAAI,IAAI,KAAK,UAAU,kBAAkB,MAAM;GAC/C,UAAU,OAAO,UAAU,IAAI,KAAK,UAAU,UAAU,CAAC;GACzD,IAAI,CAAC,KAAK,UAAU,eAAe,IAAI,KAAK,UAAU,OAAO,GAAG;GAShE,MAAM,QAPU,OAAO,kBAAkB,EAAE,gBAAgB,OAAO,WAAW,CAAC,CAAC,CAC7E;IACE,cAAc,IAAI,KAAK,UAAU;IACjC,UAAU,IAAI,KAAK,UAAU;GAC/B,CACF,CAEoB,CAAC,CAAC;GAEtB,UAAU,UAAU,KAAA,CAAS;GAC7B,MAAM,WAAW,QAAQ,IAAI,MAAM,YAAY;GAE/C,UAAU,aAAa,KAAA,KAAa,aAAa,MAAM,QAAQ;GAC/D,QAAQ,IAAI,MAAM,cAAc,MAAM,QAAQ;EAChD;EACA,UAAU,QAAQ,QAAQ,EAAE;EAE5B,OAAO,CAAC,GAAG,OAAO,CAAC,CAChB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,CACtC,KAAK,CAAC,cAAc,eAAe;GAAE;GAAc;EAAS,EAAE;CACnE;CAEA,MAAM,YAAY,KAAuB,YAA6C;EACpF,MAAM,KAAK,KAAK,QAAQ,SAAS,GAAG;EACpC,MAAM,YAAY,KAAK,WAAW,UAAU,EAAE;EAE9C,UAAU,OAAO,OAAO,SAAS,GAAG,EAAE,CAAC;EAEvC,OAAO,OAAO,kBAAkB,EAAE,eAAe,CAAC,CAAC;GACjD;GACA,kBAAkB,IAAI,KAAK,QAAQ;GACnC,aAAa,UAAU,IAAI,OAAO;EACpC,CAAC;CACH;CAEA,MAAM,mBAAmB,OAAO,WAAW,WACzC,KACA,SACA,YACA;EACA,MAAM,QAAQ,KAAK,WAAW,OAAO,GAAG;EACxC,MAAM,QAAQ,QAAQ,YAAY,MAAM,UAAU,MAAM,iBAAiB,MAAM,YAAY;EAE3F,IACE,CAAC,KAAK,WAAW,eAAe,IAAI,KAAK,WAAW,OAAO,KAC3D,OAAO,aAAa,IAAI,KAAK,WAAW,qBAExC,OAAO,KAAA;EACT,UACE,KAAK,WAAW,UAAU,KAAK,WAAW,gBAAgB,GAAG,CAAC,MAAM,QAAQ,SAC9E;EAEA,OAAO,EAAE,oBAAoB,EAAE,mBAAmB;GAChD,GAAG;GACH,UAAU;GACV,aAAa,OAAO,KAAK,QAAQ,kBAAkB,UAAU;GAC7D,QAAQ;EACV,CAAC;CACH,CAAC;CAED,MAAM,gBAAgB,OAAO,WAAW,WACtC,UACA,MACA,cACA;EAGA,IAAI,MAAM;GACR,MAAM,SACJ,OAAO,GAAqB,UAAU,QAAQ,OAAO,IAAI,EAAE,IAAI,IAAI,uBAAuB,QAAQ,KAAK,SAAS,QAAQ,OAAO,KAAK,QAAQ,EAAE,EAAE,KAAK,QAAQ,MAAM,KAAK,QAAQ,IAAI,QAAQ,EAAE,OAAO,OAAO,SAAS,EAAE,GAAG,IAAI,gBAAgB;IAAE,UAAU,GAAG;IAAc,aAAa,GAAG;IAAc,cAAc,GAAG;GAAG,CAAC;GAEhU,IAAI,OAAO,WAAW,GAAG,OAAO,KAAA;GAChC,MAAM,MAAM,QAAQ,OAAO,OAAO,IAAK,IAAI;GAE3C,IACE,CAAC,OAAO,KAAK,QAAQ,SAAS,GAAG,GAAG,QAAQ,KAC5C,CAAC,KAAK,QAAQ,eAAe,IAAI,KAAK,QAAQ,OAAO,GAErD,OAAO,KAAA;GAET,MAAM,gBAAgB,GAAG,UAAU,OAAO,OAAO,IAAI,EAAE,QAAQ,OAAO,KAAK,SAAS,OAAO,OAAO,KAAK,UAAU,SAAS,EAAE,KAAK,OAAO,MAAM,KAAK,UAAU,WAAW,QAAQ,EAAE,OAAO,OAAO,WAAW,EAAE,YAAY,OAAO,OAAO,KAAK,UAAU,YAAY,EAAE,YAAY,IAAI,gBAAgB;IAAE,UAAU,GAAG;IAAc,aAAa,GAAG;IAAc,cAAc,GAAG;GAAG,CAAC;GAEpX,MAAM,OACJ,iBAAiB,KAAA,IACb,OAAO,GAAqB,GAAG,kBAC/B,OAAO,GAAqB,0BAA0B,IAAI,gBAAgB;IAAE,UAAU,GAAG;IAAgB,cAAc,GAAG;GAAG,CAAC,EAAE,IAAI,cAAc;mCAC3H,WAAW,OAAO,IAAI,EAAE,QAAQ,WAAW,KAAK;gBACnE,WAAW,OAAO,KAAK,WAAW,SAAS,EAAE,KAAK,WAAW,MAAM,KAAK,WAAW,WAAW,QAAQ,EAAE,OAAO,aAAa,KAAK,WAAW,OAAO,KAAK,WAAW,YAAY,GAAG,WAAW,MAAM,KAAK,WAAW,cAAc,YAAY,CAAC,EAAE,OAAO,OAAO,YAAY;GAEpR,UAAU,KAAK,UAAU,EAAE;GAE3B,OAAO;IACL;IACA,YACE,iBAAiB,KAAA,KAAa,KAAK,OAAO,KAAA,IACtC,KAAA,IACA,WAAW,OAAO,KAAK,IAAI,IAAI;IACrC,UAAU,SACR,KACA,KAAK,KAAK,QAAQ,OAAO,OAAO,KAAK,IAAI,CAAC,CAC5C;IACA,WAAW,OAAO,OAAO,aAAa,OAAO,GAAG,CAAC,CAAC,OAAO,OAAO,EAAE,CAAE,SAAS,CAAC;GAChF;EACF;EAEA,MAAM,kBAAkB,eACtB,iBAAiB;EAEnB,MAAM,OACJ,OAAO,GAAqB,UAAU,gBAAgB,OAAO,IAAI,EAAE,IAAI,eAAe,OAAO,IAAI,EAAE,IAAI,IAAI,kBAAkB,iBAAiB,KAAA,IAAY,GAAG,KAAK,GAAG,KAAK,iBAAiB,OAAO,IAAI,IAAI,QAAQ,SAAS,WAAW,iBAAiB,EAAE,aAAa,SAAS,aAAa,gBAAgB,EAAE,MAAM,eAAe,OAAO,KAAK,UAAU,SAAS,EAAE,KAAK,eAAe,MAAM,KAAK,UAAU,WAAW,QAAQ,EAAE,GAAG,iBAAiB,KAAA,IAAY,GAAG,KAAK,GAAG,QAAQ,SAAS,cAAc,oBAAoB,EAAE,MAAM,iBAAiB,OAAO,KAAK,WAAW,SAAS,EAAE,KAAK,iBAAiB,MAAM,KAAK,WAAW,WAAW,QAAQ,EAAE,OAAO,aAAa,KAAK,iBAAiB,OAAO,KAAK,WAAW,YAAY,GAAG,iBAAiB,MAAM,KAAK,WAAW,cAAc,YAAY,CAAC,IAAI,SAAS,gBAAgB,OAAO,KAAK,QAAQ,EAAE,EAAE,KAAK,gBAAgB,MAAM,KAAK,QAAQ,IAAI,QAAQ,EAAE;EAE33B,IAAI,KAAK,WAAW,KAAK,KAAK,SAAS,IAAI,OAAO,KAAA;EAClD,MAAM,MAAM,gBAAgB,OAAO,KAAK,IAAK,IAAI;EAEjD,IACE,CAAC,OAAO,KAAK,QAAQ,SAAS,GAAG,GAAG,QAAQ,KAC5C,CAAC,KAAK,QAAQ,eAAe,IAAI,KAAK,QAAQ,OAAO,GAErD,OAAO,KAAA;EACT,UACE,KAAK,OAAO,aAAa;GACvB,MAAM,QAAQ,gBAAgB,OAAO,UAAU,IAAI;GAEnD,OACE,OAAO,KAAK,QAAQ,SAAS,KAAK,GAAG,QAAQ,KAC7C,MAAM,KAAK,QAAQ,sBAAsB,IAAI,KAAK,QAAQ,qBAC1D,KAAK,QAAQ,eAAe,MAAM,KAAK,QAAQ,OAAO;EAE1D,CAAC,CACH;EAEA,OAAO;GACL;GACA,YAAY,iBAAiB,KAAA,IAAY,KAAA,IAAY,iBAAiB,OAAO,KAAK,IAAK,IAAI;GAC3F,UAAU,SACR,KACA,KAAK,KAAK,aAAa,eAAe,OAAO,UAAU,IAAI,CAAC,CAC9D;GACA,WAAW,OAAO,OAAO,aAAa,OAAO,GAAG,CAAC,CAAC,OAAO,KAAK,EAAE,CAAE,SAAS,CAAC;EAC9E;CACF,CAAC;CAID,MAAM,gBAAgB,QAAQ,GAAG,iBAAiB;CAClD,MAAM,eAAe,OAAO,GAAG,gBAAgB;CAC/C,MAAM,mBAAmB,WAAW,GAAG,oBAAoB;CAE3D,MAAM,YAAY,MAA8C,UAAkB;EAGhF,OAAO,GAAG,mBAFI,SAAS,YAAY,UAAU,SAAS,cAAc,SAAS,WAAA,CAE3C,KAAK,SAAS,OAAO,IAAI,EAAE,OAAO,IAAI,KAAK;CAC/E;CAyEA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,QAtFa,OAAO,WAAW,WAAW,MAAc,sBAA8B;GACtF,MAAM,MAAM,OAAO,qBAAqB,MAAM,oBAAoB;GAElE,IACE,QAAQ,sBAAsB,KAAK,QAAQ,EAAE,MAAM,KAAA,KACnD,WAAW,sBAAsB,KAAK,WAAW,SAAS,MAAM,KAAA,KAChE,OAAO,sBAAsB,KAAK,UAAU,SAAS,MAAM,KAAA,GAC3D;IACA,MAAM,IAAI,eACR,IAAI,kBACJ,IAAI;IAEN,MAAM,OACJ,OAAO,GAAqB,UAAU,EAAE,OAAO,IAAI,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE;eACpF,SAAS,cAAc,oBAAoB,EAAE;eAC7C,SAAS,WAAW,iBAAiB,EAAE,MAAM,aAAa,KAAK,EAAE,OAAO,KAAK,QAAQ,EAAE,GAAG,EAAE,OAAO,KAAK,WAAW,SAAS,CAAC,EAAE;oBAC1H,SAAS,aAAa,gBAAgB,EAAE,MAAM,aAAa,KAAK,EAAE,OAAO,KAAK,UAAU,SAAS,GAAG,EAAE,OAAO,KAAK,WAAW,SAAS,CAAC,EAAE;gBAC7I,aAAa,KAAK,EAAE,OAAO,KAAK,WAAW,aAAa,GAAG,EAAE,MAAM,KAAK,WAAW,eAAe,GAAG,CAAC,EAAE;IAElH,IAAI,KAAK,WAAW,KAAK,KAAK,SAAS,IAAI,OAAO,KAAA;IAClD,MAAM,MAAM,EAAE,OAAO,KAAK,IAAK,IAAI;IACnC,MAAM,aAAa,EAAE,OAAO,KAAK,IAAK,IAAI;IAC1C,MAAM,QAAQ,KAAK,WAAW,gBAAgB,GAAG;IAEjD,UACE,IAAI,KAAK,WAAW,UAAU,QAC5B,IAAI,KAAK,WAAW,0BAA0B,oBAClD;IACA,UACE,KAAK,OAAO,aAAa;KACvB,MAAM,QAAQ,EAAE,OAAO,UAAU,IAAI;KACrC,MAAM,eAAe,EAAE,OAAO,UAAU,IAAI;KAE5C,OACE,OAAO,OAAO,KAAK,WAAW,gBAAgB,KAAK,CAAC,KACpD,OAAO,OAAO,KAAK,QAAQ,SAAS,YAAY,CAAC,KACjD,MAAM,KAAK,WAAW,kBAAkB,IAAI,KAAK,WAAW,iBAC5D,MAAM,KAAK,WAAW,wBAAwB,IAAI,KAAK,WAAW,uBAClE,aAAa,KAAK,QAAQ,sBACxB,WAAW,KAAK,QAAQ;IAE9B,CAAC,CACH;IAEA,OAAO,OAAO,iBACZ,KACA,SACE,YACA,KAAK,KAAK,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC,CACvC,GACA,UACF;GACF;GAEA,MAAM,OACJ,OAAO,GAAqB,UAAU,WAAW,OAAO,IAAI,EAAE,QAAQ,WAAW,KAAK,SAAS,WAAW,OAAO,KAAK,WAAW,aAAa,EAAE,KAAK,WAAW,MAAM,KAAK,WAAW,eAAe,GAAG,EAAE,OAAO,OAAO,YAAY;GAEtO,IAAI,KAAK,WAAW,GAAG,OAAO,KAAA;GAC9B,MAAM,MAAM,WAAW,OAAO,KAAK,IAAK,IAAI;GAE5C,UACE,IAAI,KAAK,WAAW,UAAU,QAC5B,IAAI,KAAK,WAAW,0BAA0B,oBAClD;GACA,MAAM,UAAU,OAAO,cAAc,KAAK,WAAW,gBAAgB,GAAG,GAAG,KAAK;GAEhF,OAAO,YAAY,KAAA,IACf,KAAA,IACA,OAAO,iBAAiB,KAAK,QAAQ,UAAU,QAAQ,GAAG;EAChE,CAiBO;EACL;EACA;EACA;EACA;EACA,QAAQ;CACV;AACF,CAAC;AAED,MAAa,yBAAyB,OAAO,WAAW,WACtD,QACA,SACA;CACA,MAAM,QAAQ,OAAO,2BAA2B,QAAQ,QAAQ,MAAM,QAAQ,KAAK;CACnF,MAAM,WAAW,OAAO,sBAAsB,QAAQ,OAAO;CAE7D,OAAO;EAAE,GAAG;EAAO;EAAS;EAAU,MAAM,SAAS;EAAM,QAAQ,SAAS;CAAO;AACrF,CAAC"}
+{"version":3,"file":"passkey-native-state.mjs","names":[],"sources":["../../src/internal/passkey-native-state.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- physical mapping generics are erased only at this shared adapter boundary. */\nimport { AuthenticationClock } from \"@yielded/auth/Operations\";\nimport * as M from \"@yielded/auth/Passkey\";\nimport { Effect, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\nimport type { Fragment } from \"effect/sql/Statement\";\n\nimport type { PasskeyCredentialMapping, PasskeyPersistenceMapping } from \"./models/passkey-model\";\nimport { sqlMapping, type NativeSqlTables } from \"./native-sql-table\";\nimport { makePasskeyNativeFlow } from \"./passkey-native-flow\";\nimport { passkeyCredentialKey } from \"./passkey-policy\";\nimport { exactSqlText } from \"./sql-change\";\nimport { canJoinTextColumns } from \"./storage-validation\";\nimport type { TableModel } from \"./table-model\";\n\n// Physical expression types are validated by NativeSqlTables at this boundary.\nexport type PasskeyNativeRead = PasskeyCredentialMapping<\n  TableModel,\n  TableModel,\n  TableModel,\n  unknown,\n  any\n>;\n\nexport type PasskeyNativeMapping = PasskeyPersistenceMapping<\n  PasskeyNativeRead,\n  TableModel,\n  unknown,\n  any\n>;\n\nexport type PasskeyNativeRow = Readonly<Record<string, unknown>>;\n\nexport const passkeyNativeInvariant: (value: unknown) => asserts value = (value) => {\n  if (!value) throw M.PasskeyUnavailable.make({});\n};\n\nexport const makePasskeyNativeReadState = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  read: PasskeyNativeRead,\n  clock?: PasskeyNativeMapping[\"clock\"],\n) {\n  const sql = (yield* SqlClient.SqlClient).withoutTransforms();\n  const subject = tables(read.subject.table);\n  const credential = tables(read.credential.table);\n  const factor = tables(read.authority.table);\n  const now = clock === undefined ? sql`0` : tables.expression(clock.engineNowMillis);\n\n  const millis = (expression: Fragment) =>\n    clock === undefined ? expression : tables.expression(clock.toMillis(expression));\n\n  const storedNow =\n    clock === undefined ? sql`0` : tables.expression(clock.fromMillis(clock.engineNowMillis));\n\n  const active = (table: \"subject\" | \"credential\" | \"authority\") =>\n    tables.expression(read[table].activeCondition);\n\n  const invariant: typeof passkeyNativeInvariant = passkeyNativeInvariant;\n  const sameId = (nativeId: unknown, value: unknown) => read.subjectIds.equals(nativeId, value);\n\n  const native = (id: M.PasskeyCredential[\"revision\"][\"subjectId\"]) => {\n    const value = read.subjectIds.toNative(id);\n\n    invariant(read.subjectIds.toSubject(value) === id);\n\n    return value;\n  };\n\n  const revisions = (nativeId: unknown, rows: ReadonlyArray<PasskeyNativeRow>) => {\n    const entries = new Map<string, M.PasskeyCredential[\"revision\"][\"securityRevision\"]>();\n\n    for (const row of rows) {\n      if (row[read.authority.credentialId] === null) continue;\n      invariant(sameId(nativeId, row[read.authority.subjectId]));\n      if (!read.authority.isActiveStatus(row[read.authority.status])) continue;\n\n      const decoded = Schema.decodeUnknownSync(M.PasskeyRevision.fields.credentials)([\n        {\n          credentialId: row[read.authority.credentialId],\n          revision: row[read.authority.revision],\n        },\n      ]);\n\n      const entry = decoded[0];\n\n      invariant(entry !== undefined);\n      const previous = entries.get(entry.credentialId);\n\n      invariant(previous === undefined || previous === entry.revision);\n      entries.set(entry.credentialId, entry.revision);\n    }\n    invariant(entries.size <= 64);\n\n    return [...entries]\n      .sort(([a], [b]) => a.localeCompare(b))\n      .map(([credentialId, revision]) => ({ credentialId, revision }));\n  };\n\n  const revision = (row: PasskeyNativeRow, factors: ReadonlyArray<PasskeyNativeRow>) => {\n    const id = read.subject.decodeId(row);\n    const subjectId = read.subjectIds.toSubject(id);\n\n    invariant(sameId(native(subjectId), id));\n\n    return Schema.decodeUnknownSync(M.PasskeyRevision)({\n      subjectId,\n      securityRevision: row[read.subject.securityRevision],\n      credentials: revisions(id, factors),\n    });\n  };\n\n  const decodeCredential = Effect.fnUntraced(function* (\n    row: PasskeyNativeRow,\n    current: M.PasskeyCredential[\"revision\"],\n    subjectRow: PasskeyNativeRow,\n  ) {\n    const value = read.credential.decode(row);\n    const owned = current.credentials.find((entry) => entry.credentialId === value.credentialId);\n\n    if (\n      !read.credential.isActiveStatus(row[read.credential.status]) ||\n      owned?.revision !== row[read.credential.credentialRevision]\n    )\n      return undefined;\n    invariant(\n      read.subjectIds.toSubject(read.credential.decodeSubjectId(row)) === current.subjectId,\n    );\n\n    return M.snapshotPasskeySync(M.PasskeyCredential, {\n      ...value,\n      revision: current,\n      requirement: yield* read.subject.decodeRequirement(subjectRow),\n      active: true,\n    });\n  });\n\n  const readAuthority = Effect.fnUntraced(function* (\n    nativeId: unknown,\n    lock: boolean,\n    credentialId?: string,\n  ) {\n    // The subject lock is a distinct first statement; joined FOR UPDATE cannot\n    // establish the lock order required by coordinated application transactions.\n    if (lock) {\n      const locked =\n        yield* sql<PasskeyNativeRow>`select ${subject.fields(\"s_\")}, ${now} as \"engineNow\" from ${subject.name} where ${subject.column(read.subject.id)} = ${subject.value(read.subject.id, nativeId)} and ${active(\"subject\")} ${sql.onDialectOrElse({ pg: () => sql`for update`, mysql: () => sql`for update`, orElse: () => sql`` })}`;\n\n      if (locked.length !== 1) return undefined;\n      const row = subject.decode(locked[0]!, \"s_\");\n\n      if (\n        !sameId(read.subject.decodeId(row), nativeId) ||\n        !read.subject.isActiveStatus(row[read.subject.status])\n      )\n        return undefined;\n\n      const lockedFactors = sql`select ${factor.fields(\"f_\")} from ${factor.name} where ${factor.column(read.authority.subjectId)} = ${factor.value(read.authority.subjectId, nativeId)} and ${active(\"authority\")} order by ${factor.column(read.authority.credentialId)} limit 65 ${sql.onDialectOrElse({ pg: () => sql`for update`, mysql: () => sql`for update`, orElse: () => sql`` })}`;\n\n      const rows =\n        credentialId === undefined\n          ? yield* sql<PasskeyNativeRow>`${lockedFactors}`\n          : yield* sql<PasskeyNativeRow>`with locked_factors as ${sql.onDialectOrElse({ pg: () => sql`materialized`, orElse: () => sql`` })} (${lockedFactors})\n        select locked_factors.*, ${credential.fields(\"c_\")} from ${credential.name} left join locked_factors on 1 = 1\n        where ${credential.column(read.credential.subjectId)} = ${credential.value(read.credential.subjectId, nativeId)} and ${exactSqlText(sql, credential.column(read.credential.credentialId), credential.value(read.credential.credentialId, credentialId))} and ${active(\"credential\")}`;\n\n      invariant(rows.length <= 64);\n\n      return {\n        row,\n        credential:\n          credentialId === undefined || rows[0] === undefined\n            ? undefined\n            : credential.decode(rows[0], \"c_\"),\n        revision: revision(\n          row,\n          rows.map((row) => factor.decode(row, \"f_\")),\n        ),\n        nowMillis: yield* Schema.decodeEffect(Schema.Int)(Number(locked[0]!.engineNow)),\n      };\n    }\n\n    const observedSubject = joinedSubject,\n      observedFactor = joinedFactor;\n\n    const rows =\n      yield* sql<PasskeyNativeRow>`select ${observedSubject.fields(\"s_\")}, ${observedFactor.fields(\"f_\")}, ${now} as \"engineNow\" ${credentialId === undefined ? sql`` : sql`, ${joinedCredential.fields(\"c_\")}`} from ${selected(\"subject\", \"passkey_subject\")} left join ${selected(\"authority\", \"passkey_factor\")} on ${observedFactor.column(read.authority.subjectId)} = ${observedFactor.value(read.authority.subjectId, nativeId)} ${credentialId === undefined ? sql`` : sql`join ${selected(\"credential\", \"passkey_credential\")} on ${joinedCredential.column(read.credential.subjectId)} = ${joinedCredential.value(read.credential.subjectId, nativeId)} and ${exactSqlText(sql, joinedCredential.column(read.credential.credentialId), joinedCredential.value(read.credential.credentialId, credentialId))}`} where ${observedSubject.column(read.subject.id)} = ${observedSubject.value(read.subject.id, nativeId)} limit 65`;\n\n    if (rows.length === 0 || rows.length > 64) return undefined;\n    const row = observedSubject.decode(rows[0]!, \"s_\");\n\n    if (\n      !sameId(read.subject.decodeId(row), nativeId) ||\n      !read.subject.isActiveStatus(row[read.subject.status])\n    )\n      return undefined;\n    invariant(\n      rows.every((selected) => {\n        const other = observedSubject.decode(selected, \"s_\");\n\n        return (\n          sameId(read.subject.decodeId(other), nativeId) &&\n          other[read.subject.securityRevision] === row[read.subject.securityRevision] &&\n          read.subject.isActiveStatus(other[read.subject.status])\n        );\n      }),\n    );\n\n    return {\n      row,\n      credential: credentialId === undefined ? undefined : joinedCredential.decode(rows[0]!, \"c_\"),\n      revision: revision(\n        row,\n        rows.map((selected) => observedFactor.decode(selected, \"f_\")),\n      ),\n      nowMillis: yield* Schema.decodeEffect(Schema.Int)(Number(rows[0]!.engineNow)),\n    };\n  });\n\n  // Active predicates retain their original table qualification inside each\n  // subquery; aliases allow applications to map several roles to one table.\n  const joinedSubject = subject.as(\"passkey_subject\");\n  const joinedFactor = factor.as(\"passkey_factor\");\n  const joinedCredential = credential.as(\"passkey_credential\");\n\n  const selected = (kind: \"subject\" | \"authority\" | \"credential\", alias: string) => {\n    const table = kind === \"subject\" ? subject : kind === \"authority\" ? factor : credential;\n\n    return sql`(select * from ${table.name} where ${active(kind)}) as ${sql(alias)}`;\n  };\n\n  const joinedIds = yield* canJoinTextColumns([\n    subject.unencodedTextColumn?.(read.subject.id),\n    credential.unencodedTextColumn?.(read.credential.subjectId),\n    factor.unencodedTextColumn?.(read.authority.subjectId),\n  ]).pipe(Effect.mapError(() => M.PasskeyUnavailable.make({})));\n\n  const lookup = Effect.fnUntraced(function* (rpId: string, protocolCredentialId: string) {\n    const key = yield* passkeyCredentialKey(rpId, protocolCredentialId);\n    let nativeId: unknown;\n\n    if (!joinedIds) {\n      const found =\n        yield* sql<PasskeyNativeRow>`select ${credential.fields(\"c_\")} from ${credential.name} where ${exactSqlText(sql, credential.column(read.credential.credentialKey), credential.value(read.credential.credentialKey, key))} and ${active(\"credential\")}`;\n\n      if (found.length !== 1) return undefined;\n      const row = credential.decode(found[0]!, \"c_\");\n\n      invariant(\n        row[read.credential.rpId] === rpId &&\n          row[read.credential.protocolCredentialId] === protocolCredentialId,\n      );\n      nativeId = read.credential.decodeSubjectId(row);\n    }\n\n    const s = joinedSubject,\n      c = joinedCredential,\n      f = joinedFactor;\n\n    const bindOwner = (table: typeof subject, key: string) =>\n      joinedIds\n        ? exactSqlText(sql, table.column(key), c.column(read.credential.subjectId))\n        : sql`${table.column(key)} = ${table.value(key, nativeId)}`;\n\n    const rows =\n      yield* sql<PasskeyNativeRow>`select ${s.fields(\"s_\")}, ${c.fields(\"c_\")}, ${f.fields(\"f_\")}\n      from ${selected(\"credential\", \"passkey_credential\")}\n      join ${selected(\"subject\", \"passkey_subject\")} on ${bindOwner(s, read.subject.id)}\n      left join ${selected(\"authority\", \"passkey_factor\")} on ${bindOwner(f, read.authority.subjectId)}\n      where ${exactSqlText(sql, c.column(read.credential.credentialKey), c.value(read.credential.credentialKey, key))}${joinedIds ? sql`` : sql` and ${bindOwner(c, read.credential.subjectId)}`} limit 65`;\n\n    if (rows.length === 0 || rows.length > 64) return undefined;\n    const row = c.decode(rows[0]!, \"c_\");\n    const subjectRow = s.decode(rows[0]!, \"s_\");\n    const owner = read.credential.decodeSubjectId(row);\n\n    invariant(\n      (joinedIds || sameId(owner, nativeId)) &&\n        row[read.credential.rpId] === rpId &&\n        row[read.credential.protocolCredentialId] === protocolCredentialId,\n    );\n    invariant(\n      rows.every((selected) => {\n        const other = c.decode(selected, \"c_\");\n        const subjectValue = s.decode(selected, \"s_\");\n\n        return (\n          sameId(owner, read.credential.decodeSubjectId(other)) &&\n          sameId(owner, read.subject.decodeId(subjectValue)) &&\n          other[read.credential.credentialId] === row[read.credential.credentialId] &&\n          other[read.credential.credentialRevision] === row[read.credential.credentialRevision] &&\n          subjectValue[read.subject.securityRevision] === subjectRow[read.subject.securityRevision]\n        );\n      }),\n    );\n\n    return yield* decodeCredential(\n      row,\n      revision(\n        subjectRow,\n        rows.map((row) => f.decode(row, \"f_\")),\n      ),\n      subjectRow,\n    );\n  });\n\n  return {\n    sql,\n    tables,\n    subject,\n    credential,\n    factor,\n    now,\n    storedNow,\n    millis,\n    active,\n    native,\n    sameId,\n    revision,\n    decodeCredential,\n    readAuthority,\n    lookup,\n    joinedSubject,\n    joinedFactor,\n    joinedCredential,\n    selected,\n    mapped: sqlMapping,\n  };\n});\n\nexport const makePasskeyNativeState = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: PasskeyNativeMapping,\n) {\n  const state = yield* makePasskeyNativeReadState(tables, mapping.read, mapping.clock);\n  const clockPolicy = yield* AuthenticationClock;\n  const ceremony = yield* makePasskeyNativeFlow(tables, mapping);\n\n  return { ...state, clockPolicy, mapping, ceremony, flow: ceremony.flow, access: ceremony.access };\n});\n\nexport type PasskeyNativeReadState = Effect.Success<ReturnType<typeof makePasskeyNativeReadState>>;\nexport type PasskeyNativeState = Effect.Success<ReturnType<typeof makePasskeyNativeState>>;\n"],"mappings":";;;;;;;;;;AAiCA,MAAa,0BAA6D,UAAU;CAClF,IAAI,CAAC,OAAO,MAAM,EAAE,mBAAmB,KAAK,CAAC,CAAC;AAChD;AAEA,MAAa,6BAA6B,OAAO,WAAW,WAC1D,QACA,MACA,OACA;CACA,MAAM,OAAO,OAAO,UAAU,UAAA,CAAW,kBAAkB;CAC3D,MAAM,UAAU,OAAO,KAAK,QAAQ,KAAK;CACzC,MAAM,aAAa,OAAO,KAAK,WAAW,KAAK;CAC/C,MAAM,SAAS,OAAO,KAAK,UAAU,KAAK;CAC1C,MAAM,MAAM,UAAU,KAAA,IAAY,GAAG,MAAM,OAAO,WAAW,MAAM,eAAe;CAElF,MAAM,UAAU,eACd,UAAU,KAAA,IAAY,aAAa,OAAO,WAAW,MAAM,SAAS,UAAU,CAAC;CAEjF,MAAM,YACJ,UAAU,KAAA,IAAY,GAAG,MAAM,OAAO,WAAW,MAAM,WAAW,MAAM,eAAe,CAAC;CAE1F,MAAM,UAAU,UACd,OAAO,WAAW,KAAK,MAAM,CAAC,eAAe;CAE/C,MAAM,YAA2C;CACjD,MAAM,UAAU,UAAmB,UAAmB,KAAK,WAAW,OAAO,UAAU,KAAK;CAE5F,MAAM,UAAU,OAAqD;EACnE,MAAM,QAAQ,KAAK,WAAW,SAAS,EAAE;EAEzC,UAAU,KAAK,WAAW,UAAU,KAAK,MAAM,EAAE;EAEjD,OAAO;CACT;CAEA,MAAM,aAAa,UAAmB,SAA0C;EAC9E,MAAM,0BAAU,IAAI,IAAiE;EAErF,KAAK,MAAM,OAAO,MAAM;GACtB,IAAI,IAAI,KAAK,UAAU,kBAAkB,MAAM;GAC/C,UAAU,OAAO,UAAU,IAAI,KAAK,UAAU,UAAU,CAAC;GACzD,IAAI,CAAC,KAAK,UAAU,eAAe,IAAI,KAAK,UAAU,OAAO,GAAG;GAShE,MAAM,QAPU,OAAO,kBAAkB,EAAE,gBAAgB,OAAO,WAAW,CAAC,CAAC,CAC7E;IACE,cAAc,IAAI,KAAK,UAAU;IACjC,UAAU,IAAI,KAAK,UAAU;GAC/B,CACF,CAEoB,CAAC,CAAC;GAEtB,UAAU,UAAU,KAAA,CAAS;GAC7B,MAAM,WAAW,QAAQ,IAAI,MAAM,YAAY;GAE/C,UAAU,aAAa,KAAA,KAAa,aAAa,MAAM,QAAQ;GAC/D,QAAQ,IAAI,MAAM,cAAc,MAAM,QAAQ;EAChD;EACA,UAAU,QAAQ,QAAQ,EAAE;EAE5B,OAAO,CAAC,GAAG,OAAO,CAAC,CAChB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,CACtC,KAAK,CAAC,cAAc,eAAe;GAAE;GAAc;EAAS,EAAE;CACnE;CAEA,MAAM,YAAY,KAAuB,YAA6C;EACpF,MAAM,KAAK,KAAK,QAAQ,SAAS,GAAG;EACpC,MAAM,YAAY,KAAK,WAAW,UAAU,EAAE;EAE9C,UAAU,OAAO,OAAO,SAAS,GAAG,EAAE,CAAC;EAEvC,OAAO,OAAO,kBAAkB,EAAE,eAAe,CAAC,CAAC;GACjD;GACA,kBAAkB,IAAI,KAAK,QAAQ;GACnC,aAAa,UAAU,IAAI,OAAO;EACpC,CAAC;CACH;CAEA,MAAM,mBAAmB,OAAO,WAAW,WACzC,KACA,SACA,YACA;EACA,MAAM,QAAQ,KAAK,WAAW,OAAO,GAAG;EACxC,MAAM,QAAQ,QAAQ,YAAY,MAAM,UAAU,MAAM,iBAAiB,MAAM,YAAY;EAE3F,IACE,CAAC,KAAK,WAAW,eAAe,IAAI,KAAK,WAAW,OAAO,KAC3D,OAAO,aAAa,IAAI,KAAK,WAAW,qBAExC,OAAO,KAAA;EACT,UACE,KAAK,WAAW,UAAU,KAAK,WAAW,gBAAgB,GAAG,CAAC,MAAM,QAAQ,SAC9E;EAEA,OAAO,EAAE,oBAAoB,EAAE,mBAAmB;GAChD,GAAG;GACH,UAAU;GACV,aAAa,OAAO,KAAK,QAAQ,kBAAkB,UAAU;GAC7D,QAAQ;EACV,CAAC;CACH,CAAC;CAED,MAAM,gBAAgB,OAAO,WAAW,WACtC,UACA,MACA,cACA;EAGA,IAAI,MAAM;GACR,MAAM,SACJ,OAAO,GAAqB,UAAU,QAAQ,OAAO,IAAI,EAAE,IAAI,IAAI,uBAAuB,QAAQ,KAAK,SAAS,QAAQ,OAAO,KAAK,QAAQ,EAAE,EAAE,KAAK,QAAQ,MAAM,KAAK,QAAQ,IAAI,QAAQ,EAAE,OAAO,OAAO,SAAS,EAAE,GAAG,IAAI,gBAAgB;IAAE,UAAU,GAAG;IAAc,aAAa,GAAG;IAAc,cAAc,GAAG;GAAG,CAAC;GAEhU,IAAI,OAAO,WAAW,GAAG,OAAO,KAAA;GAChC,MAAM,MAAM,QAAQ,OAAO,OAAO,IAAK,IAAI;GAE3C,IACE,CAAC,OAAO,KAAK,QAAQ,SAAS,GAAG,GAAG,QAAQ,KAC5C,CAAC,KAAK,QAAQ,eAAe,IAAI,KAAK,QAAQ,OAAO,GAErD,OAAO,KAAA;GAET,MAAM,gBAAgB,GAAG,UAAU,OAAO,OAAO,IAAI,EAAE,QAAQ,OAAO,KAAK,SAAS,OAAO,OAAO,KAAK,UAAU,SAAS,EAAE,KAAK,OAAO,MAAM,KAAK,UAAU,WAAW,QAAQ,EAAE,OAAO,OAAO,WAAW,EAAE,YAAY,OAAO,OAAO,KAAK,UAAU,YAAY,EAAE,YAAY,IAAI,gBAAgB;IAAE,UAAU,GAAG;IAAc,aAAa,GAAG;IAAc,cAAc,GAAG;GAAG,CAAC;GAEpX,MAAM,OACJ,iBAAiB,KAAA,IACb,OAAO,GAAqB,GAAG,kBAC/B,OAAO,GAAqB,0BAA0B,IAAI,gBAAgB;IAAE,UAAU,GAAG;IAAgB,cAAc,GAAG;GAAG,CAAC,EAAE,IAAI,cAAc;mCAC3H,WAAW,OAAO,IAAI,EAAE,QAAQ,WAAW,KAAK;gBACnE,WAAW,OAAO,KAAK,WAAW,SAAS,EAAE,KAAK,WAAW,MAAM,KAAK,WAAW,WAAW,QAAQ,EAAE,OAAO,aAAa,KAAK,WAAW,OAAO,KAAK,WAAW,YAAY,GAAG,WAAW,MAAM,KAAK,WAAW,cAAc,YAAY,CAAC,EAAE,OAAO,OAAO,YAAY;GAEpR,UAAU,KAAK,UAAU,EAAE;GAE3B,OAAO;IACL;IACA,YACE,iBAAiB,KAAA,KAAa,KAAK,OAAO,KAAA,IACtC,KAAA,IACA,WAAW,OAAO,KAAK,IAAI,IAAI;IACrC,UAAU,SACR,KACA,KAAK,KAAK,QAAQ,OAAO,OAAO,KAAK,IAAI,CAAC,CAC5C;IACA,WAAW,OAAO,OAAO,aAAa,OAAO,GAAG,CAAC,CAAC,OAAO,OAAO,EAAE,CAAE,SAAS,CAAC;GAChF;EACF;EAEA,MAAM,kBAAkB,eACtB,iBAAiB;EAEnB,MAAM,OACJ,OAAO,GAAqB,UAAU,gBAAgB,OAAO,IAAI,EAAE,IAAI,eAAe,OAAO,IAAI,EAAE,IAAI,IAAI,kBAAkB,iBAAiB,KAAA,IAAY,GAAG,KAAK,GAAG,KAAK,iBAAiB,OAAO,IAAI,IAAI,QAAQ,SAAS,WAAW,iBAAiB,EAAE,aAAa,SAAS,aAAa,gBAAgB,EAAE,MAAM,eAAe,OAAO,KAAK,UAAU,SAAS,EAAE,KAAK,eAAe,MAAM,KAAK,UAAU,WAAW,QAAQ,EAAE,GAAG,iBAAiB,KAAA,IAAY,GAAG,KAAK,GAAG,QAAQ,SAAS,cAAc,oBAAoB,EAAE,MAAM,iBAAiB,OAAO,KAAK,WAAW,SAAS,EAAE,KAAK,iBAAiB,MAAM,KAAK,WAAW,WAAW,QAAQ,EAAE,OAAO,aAAa,KAAK,iBAAiB,OAAO,KAAK,WAAW,YAAY,GAAG,iBAAiB,MAAM,KAAK,WAAW,cAAc,YAAY,CAAC,IAAI,SAAS,gBAAgB,OAAO,KAAK,QAAQ,EAAE,EAAE,KAAK,gBAAgB,MAAM,KAAK,QAAQ,IAAI,QAAQ,EAAE;EAE33B,IAAI,KAAK,WAAW,KAAK,KAAK,SAAS,IAAI,OAAO,KAAA;EAClD,MAAM,MAAM,gBAAgB,OAAO,KAAK,IAAK,IAAI;EAEjD,IACE,CAAC,OAAO,KAAK,QAAQ,SAAS,GAAG,GAAG,QAAQ,KAC5C,CAAC,KAAK,QAAQ,eAAe,IAAI,KAAK,QAAQ,OAAO,GAErD,OAAO,KAAA;EACT,UACE,KAAK,OAAO,aAAa;GACvB,MAAM,QAAQ,gBAAgB,OAAO,UAAU,IAAI;GAEnD,OACE,OAAO,KAAK,QAAQ,SAAS,KAAK,GAAG,QAAQ,KAC7C,MAAM,KAAK,QAAQ,sBAAsB,IAAI,KAAK,QAAQ,qBAC1D,KAAK,QAAQ,eAAe,MAAM,KAAK,QAAQ,OAAO;EAE1D,CAAC,CACH;EAEA,OAAO;GACL;GACA,YAAY,iBAAiB,KAAA,IAAY,KAAA,IAAY,iBAAiB,OAAO,KAAK,IAAK,IAAI;GAC3F,UAAU,SACR,KACA,KAAK,KAAK,aAAa,eAAe,OAAO,UAAU,IAAI,CAAC,CAC9D;GACA,WAAW,OAAO,OAAO,aAAa,OAAO,GAAG,CAAC,CAAC,OAAO,KAAK,EAAE,CAAE,SAAS,CAAC;EAC9E;CACF,CAAC;CAID,MAAM,gBAAgB,QAAQ,GAAG,iBAAiB;CAClD,MAAM,eAAe,OAAO,GAAG,gBAAgB;CAC/C,MAAM,mBAAmB,WAAW,GAAG,oBAAoB;CAE3D,MAAM,YAAY,MAA8C,UAAkB;EAGhF,OAAO,GAAG,mBAFI,SAAS,YAAY,UAAU,SAAS,cAAc,SAAS,WAAA,CAE3C,KAAK,SAAS,OAAO,IAAI,EAAE,OAAO,IAAI,KAAK;CAC/E;CAEA,MAAM,YAAY,OAAO,mBAAmB;EAC1C,QAAQ,sBAAsB,KAAK,QAAQ,EAAE;EAC7C,WAAW,sBAAsB,KAAK,WAAW,SAAS;EAC1D,OAAO,sBAAsB,KAAK,UAAU,SAAS;CACvD,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,EAAE,mBAAmB,KAAK,CAAC,CAAC,CAAC,CAAC;CAuE5D,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,QApFa,OAAO,WAAW,WAAW,MAAc,sBAA8B;GACtF,MAAM,MAAM,OAAO,qBAAqB,MAAM,oBAAoB;GAClE,IAAI;GAEJ,IAAI,CAAC,WAAW;IACd,MAAM,QACJ,OAAO,GAAqB,UAAU,WAAW,OAAO,IAAI,EAAE,QAAQ,WAAW,KAAK,SAAS,aAAa,KAAK,WAAW,OAAO,KAAK,WAAW,aAAa,GAAG,WAAW,MAAM,KAAK,WAAW,eAAe,GAAG,CAAC,EAAE,OAAO,OAAO,YAAY;IAErP,IAAI,MAAM,WAAW,GAAG,OAAO,KAAA;IAC/B,MAAM,MAAM,WAAW,OAAO,MAAM,IAAK,IAAI;IAE7C,UACE,IAAI,KAAK,WAAW,UAAU,QAC5B,IAAI,KAAK,WAAW,0BAA0B,oBAClD;IACA,WAAW,KAAK,WAAW,gBAAgB,GAAG;GAChD;GAEA,MAAM,IAAI,eACR,IAAI,kBACJ,IAAI;GAEN,MAAM,aAAa,OAAuB,QACxC,YACI,aAAa,KAAK,MAAM,OAAO,GAAG,GAAG,EAAE,OAAO,KAAK,WAAW,SAAS,CAAC,IACxE,GAAG,GAAG,MAAM,OAAO,GAAG,EAAE,KAAK,MAAM,MAAM,KAAK,QAAQ;GAE5D,MAAM,OACJ,OAAO,GAAqB,UAAU,EAAE,OAAO,IAAI,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE;aACpF,SAAS,cAAc,oBAAoB,EAAE;aAC7C,SAAS,WAAW,iBAAiB,EAAE,MAAM,UAAU,GAAG,KAAK,QAAQ,EAAE,EAAE;kBACtE,SAAS,aAAa,gBAAgB,EAAE,MAAM,UAAU,GAAG,KAAK,UAAU,SAAS,EAAE;cACzF,aAAa,KAAK,EAAE,OAAO,KAAK,WAAW,aAAa,GAAG,EAAE,MAAM,KAAK,WAAW,eAAe,GAAG,CAAC,IAAI,YAAY,GAAG,KAAK,GAAG,QAAQ,UAAU,GAAG,KAAK,WAAW,SAAS,IAAI;GAE7L,IAAI,KAAK,WAAW,KAAK,KAAK,SAAS,IAAI,OAAO,KAAA;GAClD,MAAM,MAAM,EAAE,OAAO,KAAK,IAAK,IAAI;GACnC,MAAM,aAAa,EAAE,OAAO,KAAK,IAAK,IAAI;GAC1C,MAAM,QAAQ,KAAK,WAAW,gBAAgB,GAAG;GAEjD,WACG,aAAa,OAAO,OAAO,QAAQ,MAClC,IAAI,KAAK,WAAW,UAAU,QAC9B,IAAI,KAAK,WAAW,0BAA0B,oBAClD;GACA,UACE,KAAK,OAAO,aAAa;IACvB,MAAM,QAAQ,EAAE,OAAO,UAAU,IAAI;IACrC,MAAM,eAAe,EAAE,OAAO,UAAU,IAAI;IAE5C,OACE,OAAO,OAAO,KAAK,WAAW,gBAAgB,KAAK,CAAC,KACpD,OAAO,OAAO,KAAK,QAAQ,SAAS,YAAY,CAAC,KACjD,MAAM,KAAK,WAAW,kBAAkB,IAAI,KAAK,WAAW,iBAC5D,MAAM,KAAK,WAAW,wBAAwB,IAAI,KAAK,WAAW,uBAClE,aAAa,KAAK,QAAQ,sBAAsB,WAAW,KAAK,QAAQ;GAE5E,CAAC,CACH;GAEA,OAAO,OAAO,iBACZ,KACA,SACE,YACA,KAAK,KAAK,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC,CACvC,GACA,UACF;EACF,CAiBO;EACL;EACA;EACA;EACA;EACA,QAAQ;CACV;AACF,CAAC;AAED,MAAa,yBAAyB,OAAO,WAAW,WACtD,QACA,SACA;CACA,MAAM,QAAQ,OAAO,2BAA2B,QAAQ,QAAQ,MAAM,QAAQ,KAAK;CACnF,MAAM,cAAc,OAAO;CAC3B,MAAM,WAAW,OAAO,sBAAsB,QAAQ,OAAO;CAE7D,OAAO;EAAE,GAAG;EAAO;EAAa;EAAS;EAAU,MAAM,SAAS;EAAM,QAAQ,SAAS;CAAO;AAClG,CAAC"}

package/dist/internal/passkey-native-write.mjs

@@ -2,11 +2,11 @@ import { PersistenceMappingError } from "./mapping-error.mjs";
 import { sqlBatchAssertion } from "./d1-planning.mjs";
 import { exactSqlText } from "./sql-change.mjs";
 import { appendSqlBatchStatement, registerSqlBatchPostcondition, registerSqlPostcondition } from "./sql-commit.mjs";
+import { randomId } from "./crypto.mjs";
 import { passkeyManagementInputs } from "./passkey-inputs.mjs";
 import { assessPasskeyAction, passkeyCredentialKey, passkeyMatchesAccess, samePasskeyCredential, samePasskeyRevision } from "./passkey-policy.mjs";
 import { passkeyNativeInvariant } from "./passkey-native-state.mjs";
 import { preparePasskeyNative } from "./passkey-native.mjs";
-import { randomId } from "./crypto.mjs";
 import { passkeyEnrollmentDigest, passkeyRemoveDigest } from "./passkey-actions.mjs";
 import { Effect, Schema } from "effect";
 import { SqlClient } from "effect/sql";
@@ -185,7 +185,7 @@ const makePasskeyNativeManagement = (base, mapping) => {
 			if (current === void 0) return yield* preparePasskeyNative({ _tag: "Rejected" }, prepare);
 			const policy = M.snapshotPasskeySync(M.PasskeyManagementPolicy, mapping.write.policy.management(current.row));
 			const requirement = yield* mapping.write.policy.requirement(current.row, "enroll-begin");
-			const authority = assessPasskeyAction({
+			const authority = yield* assessPasskeyAction({
 				moduleId: mapping.moduleId,
 				revision: current.revision,
 				nowMillis: current.nowMillis,
@@ -254,7 +254,7 @@ const makePasskeyNativeManagement = (base, mapping) => {
 			const policy = M.snapshotPasskeySync(M.PasskeyManagementPolicy, mapping.write.policy.management(current.row));
 			if (captured === void 0 || !samePasskeyCredential(captured, input.credential) || !samePasskeyRevision(captured.revision, input.credential.revision) || (policy.requireImmediateInvalidation || input.management.requireImmediateInvalidation) && mapping.invalidation.window.existingSessions !== "immediate" || Schema.encodeSync(Schema.fromJsonString(M.PasskeyRemoved.fields.invalidation))(input.invalidation) !== Schema.encodeSync(Schema.fromJsonString(M.PasskeyRemoved.fields.invalidation))(mapping.invalidation.window)) return yield* preparePasskeyNative({ _tag: "Rejected" }, prepare);
 			const requirement = yield* mapping.write.policy.requirement(current.row, "remove");
-			const authority = assessPasskeyAction({
+			const authority = yield* assessPasskeyAction({
 				moduleId: mapping.moduleId,
 				revision: current.revision,
 				nowMillis: current.nowMillis,

package/dist/internal/passkey-native-write.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"passkey-native-write.mjs","names":[],"sources":["../../src/internal/passkey-native-write.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- physical mapping generics are erased only at this shared adapter boundary. */\nimport * as M from \"@yielded/auth/Passkey\";\nimport { SecurityRevision } from \"@yielded/auth/Sessions\";\nimport { Effect, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\nimport type { Fragment } from \"effect/sql/Statement\";\n\nimport { randomId } from \"./crypto\";\nimport { sqlBatchAssertion } from \"./d1-planning\";\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport type {\n  PasskeyCredentialInsert,\n  PasskeyManagementMapping,\n} from \"./models/passkey-write-model\";\nimport type { SqlTable } from \"./native-sql-table\";\nimport { passkeyEnrollmentDigest, passkeyRemoveDigest } from \"./passkey-actions\";\nimport { passkeyManagementInputs } from \"./passkey-inputs\";\nimport { preparePasskeyNative, type NativePasskeyServices } from \"./passkey-native\";\nimport { passkeyNativeInvariant, type PasskeyNativeRow } from \"./passkey-native-state\";\nimport {\n  assessPasskeyAction,\n  passkeyCredentialKey,\n  passkeyMatchesAccess,\n  samePasskeyCredential,\n  samePasskeyRevision,\n} from \"./passkey-policy\";\nimport { exactSqlText } from \"./sql-change\";\nimport {\n  appendSqlBatchStatement,\n  registerSqlBatchPostcondition,\n  registerSqlPostcondition,\n} from \"./sql-commit\";\nimport type { TableModel } from \"./table-model\";\n\n// Mapping callbacks retain concrete row/SQL types at the public driver boundary.\nexport type NativePasskeyManagementMapping = PasskeyManagementMapping<\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  unknown,\n  any\n>;\n\nexport type NativePasskeyWriteMapping = Pick<\n  NativePasskeyManagementMapping,\n  \"moduleId\" | \"read\" | \"write\" | \"clock\" | \"telemetry\"\n>;\n\nexport const makePasskeyNativeWrites = (\n  base: NativePasskeyServices,\n  mapping: NativePasskeyWriteMapping,\n) => {\n  const { state } = base;\n  const { sql, tables, subject, credential, factor, ceremony: flow } = state;\n  const read = mapping.read;\n  const invariant: typeof passkeyNativeInvariant = passkeyNativeInvariant;\n  const expression = tables.expression;\n\n  const eq = (table: SqlTable, key: string, value: unknown) =>\n    typeof value === \"string\"\n      ? exactSqlText(sql, table.column(key), table.value(key, value))\n      : sql`${table.column(key)} = ${table.value(key, value)}`;\n\n  const match = (table: SqlTable, values: Readonly<Record<string, unknown>>) =>\n    sql.and(\n      Object.entries(values)\n        .filter(([, value]) => value !== undefined)\n        .map(([key, value]) =>\n          value === null ? sql`${table.column(key)} is null` : eq(table, key, value),\n        ),\n    );\n\n  const check = (condition: Fragment) =>\n    Effect.gen(function* () {\n      const current = (yield* SqlClient.SqlClient).withoutTransforms();\n      const rows = yield* current`select case when ${condition} then 1 else 0 end as valid`;\n\n      if (rows.length !== 1 || Number(rows[0]!.valid) !== 1)\n        return yield* PersistenceMappingError.make({\n          operation: \"mapping\",\n          cause: \"Passkey mutation postcondition failed\",\n        });\n    });\n\n  const postcondition = (name: string, condition: Fragment) =>\n    base.batch\n      ? registerSqlBatchPostcondition({ name, statement: sqlBatchAssertion(sql, condition) })\n      : registerSqlPostcondition({ name, check: check(condition) });\n\n  const write = (statement: Fragment, count: number) =>\n    base.batch\n      ? flow.stage(statement, count)\n      : flow.change(statement).pipe(\n          Effect.flatMap((changed) =>\n            changed === count\n              ? Effect.void\n              : Effect.fail(\n                  PersistenceMappingError.make({\n                    operation: \"mapping\",\n                    cause: \"Passkey conditional write did not match\",\n                  }),\n                ),\n          ),\n        );\n\n  const summary = (row: PasskeyNativeRow) =>\n    Schema.decodeUnknownSync(M.PasskeyCredentialSummary)({\n      credentialId: row[read.credential.credentialId],\n      name: row[mapping.write.credential.name],\n      primarySignIn: read.credential.decode(row).primarySignIn,\n      createdAtMillis: mapping.clock.decodeInstant(row[mapping.write.credential.createdAt]),\n      ...(row[mapping.telemetry.lastUsedAt] === null ||\n      row[mapping.telemetry.lastUsedAt] === undefined\n        ? {}\n        : { lastUsedAtMillis: mapping.clock.decodeInstant(row[mapping.telemetry.lastUsedAt]) }),\n    });\n\n  const owned = (nativeId: unknown, credentialId?: string) =>\n    sql.and([\n      sql`${credential.column(read.credential.subjectId)} = ${credential.value(read.credential.subjectId, nativeId)}`,\n      ...(credentialId === undefined\n        ? []\n        : [eq(credential, read.credential.credentialId, credentialId)]),\n      state.active(\"credential\"),\n    ]);\n\n  const subjectCondition = (current: M.PasskeyCredential[\"revision\"]) => {\n    const id = state.native(current.subjectId);\n\n    return sql`exists(select 1 from ${subject.name} where ${subject.column(read.subject.id)} = ${subject.value(read.subject.id, id)} and ${eq(subject, read.subject.securityRevision, current.securityRevision)} and ${state.active(\"subject\")}) and ${sql.and(current.credentials.map((entry) => sql`exists(select 1 from ${factor.name} where ${factor.column(read.authority.subjectId)} = ${factor.value(read.authority.subjectId, id)} and ${eq(factor, read.authority.credentialId, entry.credentialId)} and ${eq(factor, read.authority.revision, entry.revision)} and ${state.active(\"authority\")})`))}`;\n  };\n\n  const insertCredential = Effect.fnUntraced(function* (\n    nativeId: unknown,\n    ceremony: M.PasskeyCeremony,\n    verified: M.PasskeyRegistrationVerified,\n    revision: M.PasskeyCredential[\"revision\"],\n    name: string,\n    nowMillis: number,\n    subjectRow: Readonly<Record<string, unknown>>,\n  ) {\n    invariant(ceremony.context._tag === \"Enrollment\" || ceremony.context._tag === \"Registration\");\n    const credentialId = yield* randomId;\n    const marker = yield* randomId;\n    const credentialRevision = SecurityRevision.make(marker);\n\n    const value = M.snapshotPasskeySync(M.PasskeyCredential, {\n      credentialId,\n      requirement: yield* read.subject.decodeRequirement(subjectRow),\n      rpId: ceremony.profile.rpId,\n      protocolCredentialId: verified.protocolCredentialId,\n      userHandle: ceremony.context.userHandle,\n      publicKey: verified.publicKey,\n      algorithm: verified.algorithm,\n      profile: ceremony.profile,\n      revision: {\n        ...revision,\n        credentials: [...revision.credentials, { credentialId, revision: credentialRevision }],\n      },\n      active: true,\n      primarySignIn: ceremony.profile.primarySignIn && verified.userVerified,\n      enrollmentUserVerified: verified.userVerified,\n      backupEligible: verified.backupEligible,\n      backupState: verified.backupState,\n      counter: verified.counter,\n    });\n\n    const details = M.snapshotPasskeySync(M.PasskeyCredentialSummary, {\n      credentialId,\n      name,\n      primarySignIn: value.primarySignIn,\n      createdAtMillis: nowMillis,\n    });\n\n    const input: PasskeyCredentialInsert<unknown> = {\n      subjectId: nativeId,\n      credential: value,\n      summary: details,\n      marker,\n    };\n\n    const values = {\n      ...mapping.write.credential.encodeInsert(input),\n      [read.credential.credentialKey]: yield* passkeyCredentialKey(\n        value.rpId,\n        value.protocolCredentialId,\n      ),\n    };\n\n    const authorityValues = mapping.write.authority.encodeInsert(input);\n\n    yield* write(credential.insert(values), 1);\n    yield* write(factor.insert(authorityValues), 1);\n\n    // Application work may change telemetry or names, but cannot replace the\n    // enrolled key, ownership, semantic revision, or its authority factor.\n    const semanticKeys = [\n      read.credential.credentialId,\n      read.credential.subjectId,\n      read.credential.rpId,\n      read.credential.protocolCredentialId,\n      read.credential.credentialKey,\n      read.credential.userHandle,\n      read.credential.publicKey,\n      read.credential.algorithm,\n      read.credential.profile,\n      read.credential.credentialRevision,\n      read.credential.status,\n      read.credential.primarySignIn,\n      read.credential.enrollmentUserVerified,\n      read.credential.backupEligible,\n    ];\n\n    const semantic = Object.fromEntries(semanticKeys.map((key) => [key, values[key]]));\n\n    const authority = Object.fromEntries(\n      [\n        read.authority.subjectId,\n        read.authority.credentialId,\n        read.authority.revision,\n        read.authority.status,\n      ].map((key) => [key, authorityValues[key]]),\n    );\n\n    return {\n      details,\n      condition: sql`exists(select 1 from ${credential.name} where ${match(credential, semantic)}) and exists(select 1 from ${factor.name} where ${match(factor, authority)})`,\n    };\n  });\n\n  return {\n    summary,\n    owned,\n    subjectCondition,\n    insertCredential,\n    postcondition,\n    write,\n    check,\n    eq,\n    expression,\n    match,\n  };\n};\n\nexport const makePasskeyNativeManagement = (\n  base: NativePasskeyServices,\n  mapping: NativePasskeyManagementMapping,\n) => {\n  const { state, run, advisory } = base;\n  const { sql, tables, subject, credential, factor, ceremony: flow } = state;\n  const read = mapping.read;\n  const invariant: typeof passkeyNativeInvariant = passkeyNativeInvariant;\n\n  const {\n    summary,\n    owned,\n    subjectCondition,\n    insertCredential,\n    postcondition,\n    write,\n    eq,\n    expression,\n    match,\n  } = makePasskeyNativeWrites(base, mapping);\n\n  const service: M.PasskeyManagementPersistence[\"Service\"] = {\n    list: (original) =>\n      advisory(\n        Effect.gen(function* () {\n          const input = M.snapshotPasskeySync(passkeyManagementInputs.list, original);\n\n          invariant(flow.validModule(input.moduleId));\n          const nativeId = state.native(input.subjectId);\n\n          const rows =\n            yield* sql`select ${credential.fields(\"c_\")} from ${credential.name} where ${owned(nativeId)} and ${expression(mapping.write.policy.metadata(nativeId))}\n        ${input.cursor === undefined ? sql`` : sql`and ${credential.column(read.credential.credentialId)} > ${credential.value(read.credential.credentialId, input.cursor)}`}\n        order by ${credential.column(read.credential.credentialId)} limit ${input.limit + 1}`;\n\n          const credentials = rows\n            .slice(0, input.limit)\n            .map((row) => summary(credential.decode(row, \"c_\")));\n\n          const cursor = rows.length > input.limit ? credentials.at(-1)?.credentialId : undefined;\n\n          return { credentials, ...(cursor === undefined ? {} : { cursor }) };\n        }),\n      ),\n    inspectRemove: (original) =>\n      advisory(\n        Effect.gen(function* () {\n          const input = M.snapshotPasskeySync(passkeyManagementInputs.inspectRemove, original);\n\n          if (!flow.validModule(input.moduleId)) return { _tag: \"Rejected\" } as const;\n          const nativeId = state.native(input.subjectId);\n          const current = yield* state.readAuthority(nativeId, false, input.credentialId);\n\n          if (current === undefined) return { _tag: \"Rejected\" } as const;\n\n          const value =\n            current.credential === undefined\n              ? undefined\n              : yield* state.decodeCredential(current.credential, current.revision, current.row);\n\n          return value === undefined\n            ? ({ _tag: \"Rejected\" } as const)\n            : ({ _tag: \"Target\", credential: value } as const);\n        }),\n      ),\n    completeEnrollment: (original, prepare) =>\n      run(\n        Effect.gen(function* () {\n          const input = M.snapshotPasskeySync(passkeyManagementInputs.completeEnrollment, original);\n          const ceremony = input.ceremony;\n\n          if (\n            !flow.validModule(ceremony.moduleId) ||\n            ceremony.context._tag !== \"Enrollment\" ||\n            !passkeyMatchesAccess(ceremony, input.access)\n          )\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n          const context = ceremony.context;\n          const nativeId = state.native(context.revision.subjectId);\n          const current = yield* state.readAuthority(nativeId, !base.batch);\n\n          if (current === undefined)\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n\n          const policy = M.snapshotPasskeySync(\n            M.PasskeyManagementPolicy,\n            mapping.write.policy.management(current.row),\n          );\n\n          const requirement = yield* mapping.write.policy.requirement(current.row, \"enroll-begin\");\n\n          const authority = assessPasskeyAction(\n            {\n              moduleId: mapping.moduleId,\n              revision: current.revision,\n              nowMillis: current.nowMillis,\n              currentRequirement: requirement,\n              expected: {\n                action: \"enroll-begin\",\n                commandId: ceremony.commandId,\n                flowId: ceremony.flowId,\n                bindingDigest: yield* passkeyEnrollmentDigest(ceremony),\n                revision: context.revision,\n              },\n            },\n            context.authorization,\n            {\n              ...policy,\n              maximumEvidenceAgeMillis: Math.min(\n                policy.maximumEvidenceAgeMillis,\n                input.management.maximumEvidenceAgeMillis,\n              ),\n            },\n          );\n\n          if (authority === undefined)\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n          const cap = Math.min(policy.maximumCredentials, input.management.maximumCredentials);\n\n          const policyValues = Object.fromEntries(\n            mapping.write.policy.subjectColumns.map((key) => [key, current.row[key]]),\n          );\n\n          const policyUnchanged = sql`exists(select 1 from ${subject.name} where ${subject.column(read.subject.id)} = ${subject.value(read.subject.id, nativeId)} and ${match(subject, policyValues)})`;\n\n          const condition = sql`${subjectCondition(current.revision)} and ${policyUnchanged} and ${expression(mapping.write.policy.action(nativeId, context.authorization))} and ${expression(mapping.write.policy.metadata(nativeId))}\n        and ${state.now} < ${authority.expiresBeforeMillis} and (select count(*) from ${credential.name} where ${owned(nativeId)}) < ${cap}`;\n\n          const statement = flow.consume(input.access, ceremony, condition);\n\n          if (base.batch) yield* flow.stage(statement, 1);\n          else if ((yield* flow.change(statement)) !== 1)\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n\n          const enrolled = yield* insertCredential(\n            nativeId,\n            ceremony,\n            input.verified,\n            current.revision,\n            context.name,\n            current.nowMillis,\n            current.row,\n          );\n\n          yield* postcondition(\n            \"passkey-enrollment-authority\",\n            sql`${enrolled.condition} and ${flow.absent(input.access)} and ${subjectCondition(current.revision)} and ${policyUnchanged} and (select count(*) from ${credential.name} where ${owned(nativeId)}) <= ${cap} and ${expression(mapping.write.policy.action(nativeId, context.authorization))} and ${state.now} < ${authority.expiresBeforeMillis}`,\n          );\n\n          return yield* preparePasskeyNative(\n            { _tag: \"Enrolled\", credential: enrolled.details },\n            prepare,\n          );\n        }),\n      ),\n    rename: (original, prepare) =>\n      run(\n        Effect.gen(function* () {\n          const input = M.snapshotPasskeySync(passkeyManagementInputs.rename, original);\n\n          if (!flow.validModule(input.moduleId))\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n          const nativeId = state.native(input.subjectId);\n          const statement = sql`${credential.update({ [mapping.write.credential.name]: input.name })} where ${owned(nativeId, input.credentialId)} and ${expression(mapping.write.policy.metadata(nativeId))}`;\n          let rows: ReadonlyArray<PasskeyNativeRow>;\n\n          if (base.batch) {\n            rows =\n              yield* sql`select ${credential.fields(\"c_\")} from ${credential.name} where ${owned(nativeId, input.credentialId)} and ${expression(mapping.write.policy.metadata(nativeId))}`;\n            if (rows.length !== 1)\n              return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n            yield* flow.stage(statement, 1);\n          } else {\n            rows = yield* sql.onDialectOrElse({\n              mysql: () =>\n                Effect.gen(function* () {\n                  const changed = yield* flow.change(statement);\n\n                  if (changed > 1) return [];\n\n                  // With mysql2 -FOUND_ROWS an idempotent rename reports zero changes.\n                  return yield* sql`select ${credential.fields(\"c_\")} from ${credential.name} where ${owned(nativeId, input.credentialId)} and ${eq(credential, mapping.write.credential.name, input.name)} and ${expression(mapping.write.policy.metadata(nativeId))}`;\n                }),\n              orElse: () => sql`${statement} returning ${credential.fields(\"c_\")}`,\n            });\n          }\n          if (rows.length !== 1) return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n          const row = credential.decode(rows[0]!, \"c_\");\n\n          return yield* preparePasskeyNative(\n            {\n              _tag: \"Renamed\",\n              credential: summary({ ...row, [mapping.write.credential.name]: input.name }),\n            },\n            prepare,\n          );\n        }),\n        \"statement\",\n      ),\n    remove: (original, prepare) =>\n      run(\n        Effect.gen(function* () {\n          const input = M.snapshotPasskeySync(passkeyManagementInputs.remove, original);\n\n          if (!flow.validModule(input.moduleId))\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n          const nativeId = state.native(input.credential.revision.subjectId);\n\n          const current = yield* state.readAuthority(\n            nativeId,\n            !base.batch,\n            input.credential.credentialId,\n          );\n\n          if (current === undefined)\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n\n          const captured =\n            current.credential === undefined\n              ? undefined\n              : yield* state.decodeCredential(current.credential, current.revision, current.row);\n\n          const policy = M.snapshotPasskeySync(\n            M.PasskeyManagementPolicy,\n            mapping.write.policy.management(current.row),\n          );\n\n          if (\n            captured === undefined ||\n            !samePasskeyCredential(captured, input.credential) ||\n            !samePasskeyRevision(captured.revision, input.credential.revision) ||\n            ((policy.requireImmediateInvalidation ||\n              input.management.requireImmediateInvalidation) &&\n              mapping.invalidation.window.existingSessions !== \"immediate\") ||\n            Schema.encodeSync(Schema.fromJsonString(M.PasskeyRemoved.fields.invalidation))(\n              input.invalidation,\n            ) !==\n              Schema.encodeSync(Schema.fromJsonString(M.PasskeyRemoved.fields.invalidation))(\n                mapping.invalidation.window,\n              )\n          )\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n          const requirement = yield* mapping.write.policy.requirement(current.row, \"remove\");\n\n          const authority = assessPasskeyAction(\n            {\n              moduleId: mapping.moduleId,\n              revision: current.revision,\n              nowMillis: current.nowMillis,\n              currentRequirement: requirement,\n              expected: {\n                action: \"remove\",\n                commandId: input.commandId,\n                flowId: input.commandId,\n                bindingDigest: yield* passkeyRemoveDigest(\n                  mapping.moduleId,\n                  input.commandId,\n                  input.credential,\n                ),\n                revision: input.credential.revision,\n              },\n            },\n            input.authorization,\n            {\n              ...policy,\n              maximumEvidenceAgeMillis: Math.min(\n                policy.maximumEvidenceAgeMillis,\n                input.management.maximumEvidenceAgeMillis,\n              ),\n            },\n          );\n\n          if (authority === undefined)\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n\n          const remaining = expression(\n            yield* mapping.write.policy.remainingSignIn(\n              nativeId,\n              captured.credentialId,\n              current.row,\n            ),\n          );\n\n          const allowed = expression(mapping.write.policy.action(nativeId, input.authorization));\n\n          const classify = Effect.gen(function* () {\n            const rows =\n              yield* sql`select case when ${remaining} then 1 else 0 end as remaining, case when ${allowed} and ${state.now} < ${authority.expiresBeforeMillis} and ${subjectCondition(current.revision)} then 1 else 0 end as allowed`;\n\n            return Number(rows[0]?.allowed) !== 1\n              ? (\"Rejected\" as const)\n              : Number(rows[0]?.remaining) !== 1\n                ? (\"LastSignInMethod\" as const)\n                : undefined;\n          });\n\n          const next = SecurityRevision.make(yield* randomId);\n          const update = sql`${subject.update({ [read.subject.securityRevision]: next })} where ${subject.column(read.subject.id)} = ${subject.value(read.subject.id, nativeId)} and ${eq(subject, read.subject.securityRevision, current.revision.securityRevision)} and ${state.active(\"subject\")} and ${remaining} and ${allowed} and ${state.now} < ${authority.expiresBeforeMillis}`;\n\n          if (base.batch) {\n            const rejected = yield* classify;\n\n            if (rejected !== undefined)\n              return yield* preparePasskeyNative({ _tag: rejected }, prepare);\n            yield* write(update, 1);\n          } else if ((yield* flow.change(update)) !== 1) {\n            const rejected = yield* classify;\n\n            return yield* preparePasskeyNative({ _tag: rejected ?? \"Rejected\" }, prepare);\n          }\n          yield* write(\n            sql`${credential.update({ [read.credential.status]: mapping.write.credential.removedStatus, [read.credential.credentialRevision]: next })} where ${owned(nativeId, captured.credentialId)} and ${eq(credential, read.credential.credentialRevision, captured.revision.credentials.find((entry) => entry.credentialId === captured.credentialId)?.revision)}`,\n            1,\n          );\n          yield* write(\n            sql`${factor.update({ [read.authority.status]: mapping.write.authority.removedStatus, [read.authority.revision]: next })} where ${factor.column(read.authority.subjectId)} = ${factor.value(read.authority.subjectId, nativeId)} and ${eq(factor, read.authority.credentialId, captured.credentialId)}`,\n            1,\n          );\n\n          const policyValues = Object.fromEntries(\n            mapping.write.policy.subjectColumns.map((key) => [\n              key,\n              key === read.subject.securityRevision ? next : current.row[key],\n            ]),\n          );\n\n          const policyUnchanged = sql`exists(select 1 from ${subject.name} where ${subject.column(read.subject.id)} = ${subject.value(read.subject.id, nativeId)} and ${match(subject, policyValues)})`;\n\n          const invalidation = {\n            subjectId: nativeId,\n            previousRevision: current.revision.securityRevision,\n            securityRevision: next,\n            invalidation: input.invalidation,\n          };\n\n          const finalConditions: Array<Fragment> = [];\n\n          for (const mutation of mapping.invalidation.mutations) {\n            const table = tables(mutation.table);\n            const query = sql`${table.update(mutation.values(invalidation))} where ${expression(mutation.where(invalidation))}`;\n\n            if (base.batch) yield* appendSqlBatchStatement(query);\n            else yield* query;\n            finalConditions.push(expression(mutation.postcondition(invalidation)));\n          }\n          finalConditions.push(\n            sql`exists(select 1 from ${credential.name} where ${credential.column(read.credential.subjectId)} = ${credential.value(read.credential.subjectId, nativeId)} and ${eq(credential, read.credential.credentialId, captured.credentialId)} and ${eq(credential, read.credential.credentialRevision, next)} and ${eq(credential, read.credential.status, mapping.write.credential.removedStatus)}) and exists(select 1 from ${factor.name} where ${factor.column(read.authority.subjectId)} = ${factor.value(read.authority.subjectId, nativeId)} and ${eq(factor, read.authority.credentialId, captured.credentialId)} and ${eq(factor, read.authority.revision, next)} and ${eq(factor, read.authority.status, mapping.write.authority.removedStatus)})`,\n          );\n          finalConditions.push(\n            sql`${expression(mapping.invalidation.postcondition(invalidation))} and ${policyUnchanged} and ${remaining} and ${state.now} < ${authority.expiresBeforeMillis}`,\n          );\n          yield* postcondition(\"passkey-removal\", sql.and(finalConditions));\n\n          return yield* preparePasskeyNative(\n            {\n              _tag: \"Removed\",\n              result: { credentialId: captured.credentialId, invalidation: input.invalidation },\n            },\n            prepare,\n          );\n        }),\n      ),\n  };\n\n  return { passkeyManagementPersistence: service };\n};\n"],"mappings":";;;;;;;;;;;;;;;AAiDA,MAAa,2BACX,MACA,YACG;CACH,MAAM,EAAE,UAAU;CAClB,MAAM,EAAE,KAAK,QAAQ,SAAS,YAAY,QAAQ,UAAU,SAAS;CACrE,MAAM,OAAO,QAAQ;CACrB,MAAM,YAA2C;CACjD,MAAM,aAAa,OAAO;CAE1B,MAAM,MAAM,OAAiB,KAAa,UACxC,OAAO,UAAU,WACb,aAAa,KAAK,MAAM,OAAO,GAAG,GAAG,MAAM,MAAM,KAAK,KAAK,CAAC,IAC5D,GAAG,GAAG,MAAM,OAAO,GAAG,EAAE,KAAK,MAAM,MAAM,KAAK,KAAK;CAEzD,MAAM,SAAS,OAAiB,WAC9B,IAAI,IACF,OAAO,QAAQ,MAAM,CAAC,CACnB,QAAQ,GAAG,WAAW,UAAU,KAAA,CAAS,CAAC,CAC1C,KAAK,CAAC,KAAK,WACV,UAAU,OAAO,GAAG,GAAG,MAAM,OAAO,GAAG,EAAE,YAAY,GAAG,OAAO,KAAK,KAAK,CAC3E,CACJ;CAEF,MAAM,SAAS,cACb,OAAO,IAAI,aAAa;EAEtB,MAAM,OAAO,OAAO,CADH,OAAO,UAAU,UAAA,CAAW,kBACnB,CAAC,oBAAoB,UAAU;EAEzD,IAAI,KAAK,WAAW,KAAK,OAAO,KAAK,EAAE,CAAE,KAAK,MAAM,GAClD,OAAO,OAAO,wBAAwB,KAAK;GACzC,WAAW;GACX,OAAO;EACT,CAAC;CACL,CAAC;CAEH,MAAM,iBAAiB,MAAc,cACnC,KAAK,QACD,8BAA8B;EAAE;EAAM,WAAW,kBAAkB,KAAK,SAAS;CAAE,CAAC,IACpF,yBAAyB;EAAE;EAAM,OAAO,MAAM,SAAS;CAAE,CAAC;CAEhE,MAAM,SAAS,WAAqB,UAClC,KAAK,QACD,KAAK,MAAM,WAAW,KAAK,IAC3B,KAAK,OAAO,SAAS,CAAC,CAAC,KACrB,OAAO,SAAS,YACd,YAAY,QACR,OAAO,OACP,OAAO,KACL,wBAAwB,KAAK;EAC3B,WAAW;EACX,OAAO;CACT,CAAC,CACH,CACN,CACF;CAEN,MAAM,WAAW,QACf,OAAO,kBAAkB,EAAE,wBAAwB,CAAC,CAAC;EACnD,cAAc,IAAI,KAAK,WAAW;EAClC,MAAM,IAAI,QAAQ,MAAM,WAAW;EACnC,eAAe,KAAK,WAAW,OAAO,GAAG,CAAC,CAAC;EAC3C,iBAAiB,QAAQ,MAAM,cAAc,IAAI,QAAQ,MAAM,WAAW,UAAU;EACpF,GAAI,IAAI,QAAQ,UAAU,gBAAgB,QAC1C,IAAI,QAAQ,UAAU,gBAAgB,KAAA,IAClC,CAAC,IACD,EAAE,kBAAkB,QAAQ,MAAM,cAAc,IAAI,QAAQ,UAAU,WAAW,EAAE;CACzF,CAAC;CAEH,MAAM,SAAS,UAAmB,iBAChC,IAAI,IAAI;EACN,GAAG,GAAG,WAAW,OAAO,KAAK,WAAW,SAAS,EAAE,KAAK,WAAW,MAAM,KAAK,WAAW,WAAW,QAAQ;EAC5G,GAAI,iBAAiB,KAAA,IACjB,CAAC,IACD,CAAC,GAAG,YAAY,KAAK,WAAW,cAAc,YAAY,CAAC;EAC/D,MAAM,OAAO,YAAY;CAC3B,CAAC;CAEH,MAAM,oBAAoB,YAA6C;EACrE,MAAM,KAAK,MAAM,OAAO,QAAQ,SAAS;EAEzC,OAAO,GAAG,wBAAwB,QAAQ,KAAK,SAAS,QAAQ,OAAO,KAAK,QAAQ,EAAE,EAAE,KAAK,QAAQ,MAAM,KAAK,QAAQ,IAAI,EAAE,EAAE,OAAO,GAAG,SAAS,KAAK,QAAQ,kBAAkB,QAAQ,gBAAgB,EAAE,OAAO,MAAM,OAAO,SAAS,EAAE,QAAQ,IAAI,IAAI,QAAQ,YAAY,KAAK,UAAU,GAAG,wBAAwB,OAAO,KAAK,SAAS,OAAO,OAAO,KAAK,UAAU,SAAS,EAAE,KAAK,OAAO,MAAM,KAAK,UAAU,WAAW,EAAE,EAAE,OAAO,GAAG,QAAQ,KAAK,UAAU,cAAc,MAAM,YAAY,EAAE,OAAO,GAAG,QAAQ,KAAK,UAAU,UAAU,MAAM,QAAQ,EAAE,OAAO,MAAM,OAAO,WAAW,EAAE,EAAE,CAAC;CAC1kB;CAoGA,OAAO;EACL;EACA;EACA;EACA,kBAtGuB,OAAO,WAAW,WACzC,UACA,UACA,UACA,UACA,MACA,WACA,YACA;GACA,UAAU,SAAS,QAAQ,SAAS,gBAAgB,SAAS,QAAQ,SAAS,cAAc;GAC5F,MAAM,eAAe,OAAO;GAC5B,MAAM,SAAS,OAAO;GACtB,MAAM,qBAAqB,iBAAiB,KAAK,MAAM;GAEvD,MAAM,QAAQ,EAAE,oBAAoB,EAAE,mBAAmB;IACvD;IACA,aAAa,OAAO,KAAK,QAAQ,kBAAkB,UAAU;IAC7D,MAAM,SAAS,QAAQ;IACvB,sBAAsB,SAAS;IAC/B,YAAY,SAAS,QAAQ;IAC7B,WAAW,SAAS;IACpB,WAAW,SAAS;IACpB,SAAS,SAAS;IAClB,UAAU;KACR,GAAG;KACH,aAAa,CAAC,GAAG,SAAS,aAAa;MAAE;MAAc,UAAU;KAAmB,CAAC;IACvF;IACA,QAAQ;IACR,eAAe,SAAS,QAAQ,iBAAiB,SAAS;IAC1D,wBAAwB,SAAS;IACjC,gBAAgB,SAAS;IACzB,aAAa,SAAS;IACtB,SAAS,SAAS;GACpB,CAAC;GAED,MAAM,UAAU,EAAE,oBAAoB,EAAE,0BAA0B;IAChE;IACA;IACA,eAAe,MAAM;IACrB,iBAAiB;GACnB,CAAC;GAED,MAAM,QAA0C;IAC9C,WAAW;IACX,YAAY;IACZ,SAAS;IACT;GACF;GAEA,MAAM,SAAS;IACb,GAAG,QAAQ,MAAM,WAAW,aAAa,KAAK;KAC7C,KAAK,WAAW,gBAAgB,OAAO,qBACtC,MAAM,MACN,MAAM,oBACR;GACF;GAEA,MAAM,kBAAkB,QAAQ,MAAM,UAAU,aAAa,KAAK;GAElE,OAAO,MAAM,WAAW,OAAO,MAAM,GAAG,CAAC;GACzC,OAAO,MAAM,OAAO,OAAO,eAAe,GAAG,CAAC;GAI9C,MAAM,eAAe;IACnB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;GAClB;GAEA,MAAM,WAAW,OAAO,YAAY,aAAa,KAAK,QAAQ,CAAC,KAAK,OAAO,IAAI,CAAC,CAAC;GAEjF,MAAM,YAAY,OAAO,YACvB;IACE,KAAK,UAAU;IACf,KAAK,UAAU;IACf,KAAK,UAAU;IACf,KAAK,UAAU;GACjB,CAAC,CAAC,KAAK,QAAQ,CAAC,KAAK,gBAAgB,IAAI,CAAC,CAC5C;GAEA,OAAO;IACL;IACA,WAAW,GAAG,wBAAwB,WAAW,KAAK,SAAS,MAAM,YAAY,QAAQ,EAAE,6BAA6B,OAAO,KAAK,SAAS,MAAM,QAAQ,SAAS,EAAE;GACxK;EACF,CAMiB;EACf;EACA;EACA;EACA;EACA;EACA;CACF;AACF;AAEA,MAAa,+BACX,MACA,YACG;CACH,MAAM,EAAE,OAAO,KAAK,aAAa;CACjC,MAAM,EAAE,KAAK,QAAQ,SAAS,YAAY,QAAQ,UAAU,SAAS;CACrE,MAAM,OAAO,QAAQ;CACrB,MAAM,YAA2C;CAEjD,MAAM,EACJ,SACA,OACA,kBACA,kBACA,eACA,OACA,IACA,YACA,UACE,wBAAwB,MAAM,OAAO;CAyVzC,OAAO,EAAE,8BAA8B;EAtVrC,OAAO,aACL,SACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,oBAAoB,wBAAwB,MAAM,QAAQ;GAE1E,UAAU,KAAK,YAAY,MAAM,QAAQ,CAAC;GAC1C,MAAM,WAAW,MAAM,OAAO,MAAM,SAAS;GAE7C,MAAM,OACJ,OAAO,GAAG,UAAU,WAAW,OAAO,IAAI,EAAE,QAAQ,WAAW,KAAK,SAAS,MAAM,QAAQ,EAAE,OAAO,WAAW,QAAQ,MAAM,OAAO,SAAS,QAAQ,CAAC,EAAE;UAC1J,MAAM,WAAW,KAAA,IAAY,GAAG,KAAK,GAAG,OAAO,WAAW,OAAO,KAAK,WAAW,YAAY,EAAE,KAAK,WAAW,MAAM,KAAK,WAAW,cAAc,MAAM,MAAM,IAAI;mBAC1J,WAAW,OAAO,KAAK,WAAW,YAAY,EAAE,SAAS,MAAM,QAAQ;GAEhF,MAAM,cAAc,KACjB,MAAM,GAAG,MAAM,KAAK,CAAC,CACrB,KAAK,QAAQ,QAAQ,WAAW,OAAO,KAAK,IAAI,CAAC,CAAC;GAErD,MAAM,SAAS,KAAK,SAAS,MAAM,QAAQ,YAAY,GAAG,EAAE,CAAC,EAAE,eAAe,KAAA;GAE9E,OAAO;IAAE;IAAa,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO;GAAG;EACpE,CAAC,CACH;EACF,gBAAgB,aACd,SACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,oBAAoB,wBAAwB,eAAe,QAAQ;GAEnF,IAAI,CAAC,KAAK,YAAY,MAAM,QAAQ,GAAG,OAAO,EAAE,MAAM,WAAW;GACjE,MAAM,WAAW,MAAM,OAAO,MAAM,SAAS;GAC7C,MAAM,UAAU,OAAO,MAAM,cAAc,UAAU,OAAO,MAAM,YAAY;GAE9E,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;GAErD,MAAM,QACJ,QAAQ,eAAe,KAAA,IACnB,KAAA,IACA,OAAO,MAAM,iBAAiB,QAAQ,YAAY,QAAQ,UAAU,QAAQ,GAAG;GAErF,OAAO,UAAU,KAAA,IACZ,EAAE,MAAM,WAAW,IACnB;IAAE,MAAM;IAAU,YAAY;GAAM;EAC3C,CAAC,CACH;EACF,qBAAqB,UAAU,YAC7B,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,oBAAoB,wBAAwB,oBAAoB,QAAQ;GACxF,MAAM,WAAW,MAAM;GAEvB,IACE,CAAC,KAAK,YAAY,SAAS,QAAQ,KACnC,SAAS,QAAQ,SAAS,gBAC1B,CAAC,qBAAqB,UAAU,MAAM,MAAM,GAE5C,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAClE,MAAM,UAAU,SAAS;GACzB,MAAM,WAAW,MAAM,OAAO,QAAQ,SAAS,SAAS;GACxD,MAAM,UAAU,OAAO,MAAM,cAAc,UAAU,CAAC,KAAK,KAAK;GAEhE,IAAI,YAAY,KAAA,GACd,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAElE,MAAM,SAAS,EAAE,oBACf,EAAE,yBACF,QAAQ,MAAM,OAAO,WAAW,QAAQ,GAAG,CAC7C;GAEA,MAAM,cAAc,OAAO,QAAQ,MAAM,OAAO,YAAY,QAAQ,KAAK,cAAc;GAEvF,MAAM,YAAY,oBAChB;IACE,UAAU,QAAQ;IAClB,UAAU,QAAQ;IAClB,WAAW,QAAQ;IACnB,oBAAoB;IACpB,UAAU;KACR,QAAQ;KACR,WAAW,SAAS;KACpB,QAAQ,SAAS;KACjB,eAAe,OAAO,wBAAwB,QAAQ;KACtD,UAAU,QAAQ;IACpB;GACF,GACA,QAAQ,eACR;IACE,GAAG;IACH,0BAA0B,KAAK,IAC7B,OAAO,0BACP,MAAM,WAAW,wBACnB;GACF,CACF;GAEA,IAAI,cAAc,KAAA,GAChB,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAClE,MAAM,MAAM,KAAK,IAAI,OAAO,oBAAoB,MAAM,WAAW,kBAAkB;GAEnF,MAAM,eAAe,OAAO,YAC1B,QAAQ,MAAM,OAAO,eAAe,KAAK,QAAQ,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAC1E;GAEA,MAAM,kBAAkB,GAAG,wBAAwB,QAAQ,KAAK,SAAS,QAAQ,OAAO,KAAK,QAAQ,EAAE,EAAE,KAAK,QAAQ,MAAM,KAAK,QAAQ,IAAI,QAAQ,EAAE,OAAO,MAAM,SAAS,YAAY,EAAE;GAE3L,MAAM,YAAY,GAAG,GAAG,iBAAiB,QAAQ,QAAQ,EAAE,OAAO,gBAAgB,OAAO,WAAW,QAAQ,MAAM,OAAO,OAAO,UAAU,QAAQ,aAAa,CAAC,EAAE,OAAO,WAAW,QAAQ,MAAM,OAAO,SAAS,QAAQ,CAAC,EAAE;cACzN,MAAM,IAAI,KAAK,UAAU,oBAAoB,6BAA6B,WAAW,KAAK,SAAS,MAAM,QAAQ,EAAE,MAAM;GAE7H,MAAM,YAAY,KAAK,QAAQ,MAAM,QAAQ,UAAU,SAAS;GAEhE,IAAI,KAAK,OAAO,OAAO,KAAK,MAAM,WAAW,CAAC;QACzC,KAAK,OAAO,KAAK,OAAO,SAAS,OAAO,GAC3C,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAElE,MAAM,WAAW,OAAO,iBACtB,UACA,UACA,MAAM,UACN,QAAQ,UACR,QAAQ,MACR,QAAQ,WACR,QAAQ,GACV;GAEA,OAAO,cACL,gCACA,GAAG,GAAG,SAAS,UAAU,OAAO,KAAK,OAAO,MAAM,MAAM,EAAE,OAAO,iBAAiB,QAAQ,QAAQ,EAAE,OAAO,gBAAgB,6BAA6B,WAAW,KAAK,SAAS,MAAM,QAAQ,EAAE,OAAO,IAAI,OAAO,WAAW,QAAQ,MAAM,OAAO,OAAO,UAAU,QAAQ,aAAa,CAAC,EAAE,OAAO,MAAM,IAAI,KAAK,UAAU,qBAC9T;GAEA,OAAO,OAAO,qBACZ;IAAE,MAAM;IAAY,YAAY,SAAS;GAAQ,GACjD,OACF;EACF,CAAC,CACH;EACF,SAAS,UAAU,YACjB,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,oBAAoB,wBAAwB,QAAQ,QAAQ;GAE5E,IAAI,CAAC,KAAK,YAAY,MAAM,QAAQ,GAClC,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAClE,MAAM,WAAW,MAAM,OAAO,MAAM,SAAS;GAC7C,MAAM,YAAY,GAAG,GAAG,WAAW,OAAO,GAAG,QAAQ,MAAM,WAAW,OAAO,MAAM,KAAK,CAAC,EAAE,SAAS,MAAM,UAAU,MAAM,YAAY,EAAE,OAAO,WAAW,QAAQ,MAAM,OAAO,SAAS,QAAQ,CAAC;GACjM,IAAI;GAEJ,IAAI,KAAK,OAAO;IACd,OACE,OAAO,GAAG,UAAU,WAAW,OAAO,IAAI,EAAE,QAAQ,WAAW,KAAK,SAAS,MAAM,UAAU,MAAM,YAAY,EAAE,OAAO,WAAW,QAAQ,MAAM,OAAO,SAAS,QAAQ,CAAC;IAC5K,IAAI,KAAK,WAAW,GAClB,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;IAClE,OAAO,KAAK,MAAM,WAAW,CAAC;GAChC,OACE,OAAO,OAAO,IAAI,gBAAgB;IAChC,aACE,OAAO,IAAI,aAAa;KAGtB,KAAI,OAFmB,KAAK,OAAO,SAAS,KAE9B,GAAG,OAAO,CAAC;KAGzB,OAAO,OAAO,GAAG,UAAU,WAAW,OAAO,IAAI,EAAE,QAAQ,WAAW,KAAK,SAAS,MAAM,UAAU,MAAM,YAAY,EAAE,OAAO,GAAG,YAAY,QAAQ,MAAM,WAAW,MAAM,MAAM,IAAI,EAAE,OAAO,WAAW,QAAQ,MAAM,OAAO,SAAS,QAAQ,CAAC;IACpP,CAAC;IACH,cAAc,GAAG,GAAG,UAAU,aAAa,WAAW,OAAO,IAAI;GACnE,CAAC;GAEH,IAAI,KAAK,WAAW,GAAG,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GACvF,MAAM,MAAM,WAAW,OAAO,KAAK,IAAK,IAAI;GAE5C,OAAO,OAAO,qBACZ;IACE,MAAM;IACN,YAAY,QAAQ;KAAE,GAAG;MAAM,QAAQ,MAAM,WAAW,OAAO,MAAM;IAAK,CAAC;GAC7E,GACA,OACF;EACF,CAAC,GACD,WACF;EACF,SAAS,UAAU,YACjB,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,oBAAoB,wBAAwB,QAAQ,QAAQ;GAE5E,IAAI,CAAC,KAAK,YAAY,MAAM,QAAQ,GAClC,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAClE,MAAM,WAAW,MAAM,OAAO,MAAM,WAAW,SAAS,SAAS;GAEjE,MAAM,UAAU,OAAO,MAAM,cAC3B,UACA,CAAC,KAAK,OACN,MAAM,WAAW,YACnB;GAEA,IAAI,YAAY,KAAA,GACd,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAElE,MAAM,WACJ,QAAQ,eAAe,KAAA,IACnB,KAAA,IACA,OAAO,MAAM,iBAAiB,QAAQ,YAAY,QAAQ,UAAU,QAAQ,GAAG;GAErF,MAAM,SAAS,EAAE,oBACf,EAAE,yBACF,QAAQ,MAAM,OAAO,WAAW,QAAQ,GAAG,CAC7C;GAEA,IACE,aAAa,KAAA,KACb,CAAC,sBAAsB,UAAU,MAAM,UAAU,KACjD,CAAC,oBAAoB,SAAS,UAAU,MAAM,WAAW,QAAQ,MAC/D,OAAO,gCACP,MAAM,WAAW,iCACjB,QAAQ,aAAa,OAAO,qBAAqB,eACnD,OAAO,WAAW,OAAO,eAAe,EAAE,eAAe,OAAO,YAAY,CAAC,CAAC,CAC5E,MAAM,YACR,MACE,OAAO,WAAW,OAAO,eAAe,EAAE,eAAe,OAAO,YAAY,CAAC,CAAC,CAC5E,QAAQ,aAAa,MACvB,GAEF,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAClE,MAAM,cAAc,OAAO,QAAQ,MAAM,OAAO,YAAY,QAAQ,KAAK,QAAQ;GAEjF,MAAM,YAAY,oBAChB;IACE,UAAU,QAAQ;IAClB,UAAU,QAAQ;IAClB,WAAW,QAAQ;IACnB,oBAAoB;IACpB,UAAU;KACR,QAAQ;KACR,WAAW,MAAM;KACjB,QAAQ,MAAM;KACd,eAAe,OAAO,oBACpB,QAAQ,UACR,MAAM,WACN,MAAM,UACR;KACA,UAAU,MAAM,WAAW;IAC7B;GACF,GACA,MAAM,eACN;IACE,GAAG;IACH,0BAA0B,KAAK,IAC7B,OAAO,0BACP,MAAM,WAAW,wBACnB;GACF,CACF;GAEA,IAAI,cAAc,KAAA,GAChB,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAElE,MAAM,YAAY,WAChB,OAAO,QAAQ,MAAM,OAAO,gBAC1B,UACA,SAAS,cACT,QAAQ,GACV,CACF;GAEA,MAAM,UAAU,WAAW,QAAQ,MAAM,OAAO,OAAO,UAAU,MAAM,aAAa,CAAC;GAErF,MAAM,WAAW,OAAO,IAAI,aAAa;IACvC,MAAM,OACJ,OAAO,GAAG,oBAAoB,UAAU,6CAA6C,QAAQ,OAAO,MAAM,IAAI,KAAK,UAAU,oBAAoB,OAAO,iBAAiB,QAAQ,QAAQ,EAAE;IAE7L,OAAO,OAAO,KAAK,EAAE,EAAE,OAAO,MAAM,IAC/B,aACD,OAAO,KAAK,EAAE,EAAE,SAAS,MAAM,IAC5B,qBACD,KAAA;GACR,CAAC;GAED,MAAM,OAAO,iBAAiB,KAAK,OAAO,QAAQ;GAClD,MAAM,SAAS,GAAG,GAAG,QAAQ,OAAO,GAAG,KAAK,QAAQ,mBAAmB,KAAK,CAAC,EAAE,SAAS,QAAQ,OAAO,KAAK,QAAQ,EAAE,EAAE,KAAK,QAAQ,MAAM,KAAK,QAAQ,IAAI,QAAQ,EAAE,OAAO,GAAG,SAAS,KAAK,QAAQ,kBAAkB,QAAQ,SAAS,gBAAgB,EAAE,OAAO,MAAM,OAAO,SAAS,EAAE,OAAO,UAAU,OAAO,QAAQ,OAAO,MAAM,IAAI,KAAK,UAAU;GAE1V,IAAI,KAAK,OAAO;IACd,MAAM,WAAW,OAAO;IAExB,IAAI,aAAa,KAAA,GACf,OAAO,OAAO,qBAAqB,EAAE,MAAM,SAAS,GAAG,OAAO;IAChE,OAAO,MAAM,QAAQ,CAAC;GACxB,OAAO,KAAK,OAAO,KAAK,OAAO,MAAM,OAAO,GAAG;IAC7C,MAAM,WAAW,OAAO;IAExB,OAAO,OAAO,qBAAqB,EAAE,MAAM,YAAY,WAAW,GAAG,OAAO;GAC9E;GACA,OAAO,MACL,GAAG,GAAG,WAAW,OAAO;KAAG,KAAK,WAAW,SAAS,QAAQ,MAAM,WAAW;KAAgB,KAAK,WAAW,qBAAqB;GAAK,CAAC,EAAE,SAAS,MAAM,UAAU,SAAS,YAAY,EAAE,OAAO,GAAG,YAAY,KAAK,WAAW,oBAAoB,SAAS,SAAS,YAAY,MAAM,UAAU,MAAM,iBAAiB,SAAS,YAAY,CAAC,EAAE,QAAQ,KACzV,CACF;GACA,OAAO,MACL,GAAG,GAAG,OAAO,OAAO;KAAG,KAAK,UAAU,SAAS,QAAQ,MAAM,UAAU;KAAgB,KAAK,UAAU,WAAW;GAAK,CAAC,EAAE,SAAS,OAAO,OAAO,KAAK,UAAU,SAAS,EAAE,KAAK,OAAO,MAAM,KAAK,UAAU,WAAW,QAAQ,EAAE,OAAO,GAAG,QAAQ,KAAK,UAAU,cAAc,SAAS,YAAY,KACpS,CACF;GAEA,MAAM,eAAe,OAAO,YAC1B,QAAQ,MAAM,OAAO,eAAe,KAAK,QAAQ,CAC/C,KACA,QAAQ,KAAK,QAAQ,mBAAmB,OAAO,QAAQ,IAAI,IAC7D,CAAC,CACH;GAEA,MAAM,kBAAkB,GAAG,wBAAwB,QAAQ,KAAK,SAAS,QAAQ,OAAO,KAAK,QAAQ,EAAE,EAAE,KAAK,QAAQ,MAAM,KAAK,QAAQ,IAAI,QAAQ,EAAE,OAAO,MAAM,SAAS,YAAY,EAAE;GAE3L,MAAM,eAAe;IACnB,WAAW;IACX,kBAAkB,QAAQ,SAAS;IACnC,kBAAkB;IAClB,cAAc,MAAM;GACtB;GAEA,MAAM,kBAAmC,CAAC;GAE1C,KAAK,MAAM,YAAY,QAAQ,aAAa,WAAW;IACrD,MAAM,QAAQ,OAAO,SAAS,KAAK;IACnC,MAAM,QAAQ,GAAG,GAAG,MAAM,OAAO,SAAS,OAAO,YAAY,CAAC,EAAE,SAAS,WAAW,SAAS,MAAM,YAAY,CAAC;IAEhH,IAAI,KAAK,OAAO,OAAO,wBAAwB,KAAK;SAC/C,OAAO;IACZ,gBAAgB,KAAK,WAAW,SAAS,cAAc,YAAY,CAAC,CAAC;GACvE;GACA,gBAAgB,KACd,GAAG,wBAAwB,WAAW,KAAK,SAAS,WAAW,OAAO,KAAK,WAAW,SAAS,EAAE,KAAK,WAAW,MAAM,KAAK,WAAW,WAAW,QAAQ,EAAE,OAAO,GAAG,YAAY,KAAK,WAAW,cAAc,SAAS,YAAY,EAAE,OAAO,GAAG,YAAY,KAAK,WAAW,oBAAoB,IAAI,EAAE,OAAO,GAAG,YAAY,KAAK,WAAW,QAAQ,QAAQ,MAAM,WAAW,aAAa,EAAE,6BAA6B,OAAO,KAAK,SAAS,OAAO,OAAO,KAAK,UAAU,SAAS,EAAE,KAAK,OAAO,MAAM,KAAK,UAAU,WAAW,QAAQ,EAAE,OAAO,GAAG,QAAQ,KAAK,UAAU,cAAc,SAAS,YAAY,EAAE,OAAO,GAAG,QAAQ,KAAK,UAAU,UAAU,IAAI,EAAE,OAAO,GAAG,QAAQ,KAAK,UAAU,QAAQ,QAAQ,MAAM,UAAU,aAAa,EAAE,EACttB;GACA,gBAAgB,KACd,GAAG,GAAG,WAAW,QAAQ,aAAa,cAAc,YAAY,CAAC,EAAE,OAAO,gBAAgB,OAAO,UAAU,OAAO,MAAM,IAAI,KAAK,UAAU,qBAC7I;GACA,OAAO,cAAc,mBAAmB,IAAI,IAAI,eAAe,CAAC;GAEhE,OAAO,OAAO,qBACZ;IACE,MAAM;IACN,QAAQ;KAAE,cAAc,SAAS;KAAc,cAAc,MAAM;IAAa;GAClF,GACA,OACF;EACF,CAAC,CACH;CAGyC,EAAE;AACjD"}
+{"version":3,"file":"passkey-native-write.mjs","names":[],"sources":["../../src/internal/passkey-native-write.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- physical mapping generics are erased only at this shared adapter boundary. */\nimport * as M from \"@yielded/auth/Passkey\";\nimport { SecurityRevision } from \"@yielded/auth/Sessions\";\nimport { Effect, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\nimport type { Fragment } from \"effect/sql/Statement\";\n\nimport { randomId } from \"./crypto\";\nimport { sqlBatchAssertion } from \"./d1-planning\";\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport type {\n  PasskeyCredentialInsert,\n  PasskeyManagementMapping,\n} from \"./models/passkey-write-model\";\nimport type { SqlTable } from \"./native-sql-table\";\nimport { passkeyEnrollmentDigest, passkeyRemoveDigest } from \"./passkey-actions\";\nimport { passkeyManagementInputs } from \"./passkey-inputs\";\nimport { preparePasskeyNative, type NativePasskeyServices } from \"./passkey-native\";\nimport { passkeyNativeInvariant, type PasskeyNativeRow } from \"./passkey-native-state\";\nimport {\n  assessPasskeyAction,\n  passkeyCredentialKey,\n  passkeyMatchesAccess,\n  samePasskeyCredential,\n  samePasskeyRevision,\n} from \"./passkey-policy\";\nimport { exactSqlText } from \"./sql-change\";\nimport {\n  appendSqlBatchStatement,\n  registerSqlBatchPostcondition,\n  registerSqlPostcondition,\n} from \"./sql-commit\";\nimport type { TableModel } from \"./table-model\";\n\n// Mapping callbacks retain concrete row/SQL types at the public driver boundary.\nexport type NativePasskeyManagementMapping = PasskeyManagementMapping<\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  unknown,\n  any\n>;\n\nexport type NativePasskeyWriteMapping = Pick<\n  NativePasskeyManagementMapping,\n  \"moduleId\" | \"read\" | \"write\" | \"clock\" | \"telemetry\"\n>;\n\nexport const makePasskeyNativeWrites = (\n  base: NativePasskeyServices,\n  mapping: NativePasskeyWriteMapping,\n) => {\n  const { state } = base;\n  const { sql, tables, subject, credential, factor, ceremony: flow } = state;\n  const read = mapping.read;\n  const invariant: typeof passkeyNativeInvariant = passkeyNativeInvariant;\n  const expression = tables.expression;\n\n  const eq = (table: SqlTable, key: string, value: unknown) =>\n    typeof value === \"string\"\n      ? exactSqlText(sql, table.column(key), table.value(key, value))\n      : sql`${table.column(key)} = ${table.value(key, value)}`;\n\n  const match = (table: SqlTable, values: Readonly<Record<string, unknown>>) =>\n    sql.and(\n      Object.entries(values)\n        .filter(([, value]) => value !== undefined)\n        .map(([key, value]) =>\n          value === null ? sql`${table.column(key)} is null` : eq(table, key, value),\n        ),\n    );\n\n  const check = (condition: Fragment) =>\n    Effect.gen(function* () {\n      const current = (yield* SqlClient.SqlClient).withoutTransforms();\n      const rows = yield* current`select case when ${condition} then 1 else 0 end as valid`;\n\n      if (rows.length !== 1 || Number(rows[0]!.valid) !== 1)\n        return yield* PersistenceMappingError.make({\n          operation: \"mapping\",\n          cause: \"Passkey mutation postcondition failed\",\n        });\n    });\n\n  const postcondition = (name: string, condition: Fragment) =>\n    base.batch\n      ? registerSqlBatchPostcondition({ name, statement: sqlBatchAssertion(sql, condition) })\n      : registerSqlPostcondition({ name, check: check(condition) });\n\n  const write = (statement: Fragment, count: number) =>\n    base.batch\n      ? flow.stage(statement, count)\n      : flow.change(statement).pipe(\n          Effect.flatMap((changed) =>\n            changed === count\n              ? Effect.void\n              : Effect.fail(\n                  PersistenceMappingError.make({\n                    operation: \"mapping\",\n                    cause: \"Passkey conditional write did not match\",\n                  }),\n                ),\n          ),\n        );\n\n  const summary = (row: PasskeyNativeRow) =>\n    Schema.decodeUnknownSync(M.PasskeyCredentialSummary)({\n      credentialId: row[read.credential.credentialId],\n      name: row[mapping.write.credential.name],\n      primarySignIn: read.credential.decode(row).primarySignIn,\n      createdAtMillis: mapping.clock.decodeInstant(row[mapping.write.credential.createdAt]),\n      ...(row[mapping.telemetry.lastUsedAt] === null ||\n      row[mapping.telemetry.lastUsedAt] === undefined\n        ? {}\n        : { lastUsedAtMillis: mapping.clock.decodeInstant(row[mapping.telemetry.lastUsedAt]) }),\n    });\n\n  const owned = (nativeId: unknown, credentialId?: string) =>\n    sql.and([\n      sql`${credential.column(read.credential.subjectId)} = ${credential.value(read.credential.subjectId, nativeId)}`,\n      ...(credentialId === undefined\n        ? []\n        : [eq(credential, read.credential.credentialId, credentialId)]),\n      state.active(\"credential\"),\n    ]);\n\n  const subjectCondition = (current: M.PasskeyCredential[\"revision\"]) => {\n    const id = state.native(current.subjectId);\n\n    return sql`exists(select 1 from ${subject.name} where ${subject.column(read.subject.id)} = ${subject.value(read.subject.id, id)} and ${eq(subject, read.subject.securityRevision, current.securityRevision)} and ${state.active(\"subject\")}) and ${sql.and(current.credentials.map((entry) => sql`exists(select 1 from ${factor.name} where ${factor.column(read.authority.subjectId)} = ${factor.value(read.authority.subjectId, id)} and ${eq(factor, read.authority.credentialId, entry.credentialId)} and ${eq(factor, read.authority.revision, entry.revision)} and ${state.active(\"authority\")})`))}`;\n  };\n\n  const insertCredential = Effect.fnUntraced(function* (\n    nativeId: unknown,\n    ceremony: M.PasskeyCeremony,\n    verified: M.PasskeyRegistrationVerified,\n    revision: M.PasskeyCredential[\"revision\"],\n    name: string,\n    nowMillis: number,\n    subjectRow: Readonly<Record<string, unknown>>,\n  ) {\n    invariant(ceremony.context._tag === \"Enrollment\" || ceremony.context._tag === \"Registration\");\n    const credentialId = yield* randomId;\n    const marker = yield* randomId;\n    const credentialRevision = SecurityRevision.make(marker);\n\n    const value = M.snapshotPasskeySync(M.PasskeyCredential, {\n      credentialId,\n      requirement: yield* read.subject.decodeRequirement(subjectRow),\n      rpId: ceremony.profile.rpId,\n      protocolCredentialId: verified.protocolCredentialId,\n      userHandle: ceremony.context.userHandle,\n      publicKey: verified.publicKey,\n      algorithm: verified.algorithm,\n      profile: ceremony.profile,\n      revision: {\n        ...revision,\n        credentials: [...revision.credentials, { credentialId, revision: credentialRevision }],\n      },\n      active: true,\n      primarySignIn: ceremony.profile.primarySignIn && verified.userVerified,\n      enrollmentUserVerified: verified.userVerified,\n      backupEligible: verified.backupEligible,\n      backupState: verified.backupState,\n      counter: verified.counter,\n    });\n\n    const details = M.snapshotPasskeySync(M.PasskeyCredentialSummary, {\n      credentialId,\n      name,\n      primarySignIn: value.primarySignIn,\n      createdAtMillis: nowMillis,\n    });\n\n    const input: PasskeyCredentialInsert<unknown> = {\n      subjectId: nativeId,\n      credential: value,\n      summary: details,\n      marker,\n    };\n\n    const values = {\n      ...mapping.write.credential.encodeInsert(input),\n      [read.credential.credentialKey]: yield* passkeyCredentialKey(\n        value.rpId,\n        value.protocolCredentialId,\n      ),\n    };\n\n    const authorityValues = mapping.write.authority.encodeInsert(input);\n\n    yield* write(credential.insert(values), 1);\n    yield* write(factor.insert(authorityValues), 1);\n\n    // Application work may change telemetry or names, but cannot replace the\n    // enrolled key, ownership, semantic revision, or its authority factor.\n    const semanticKeys = [\n      read.credential.credentialId,\n      read.credential.subjectId,\n      read.credential.rpId,\n      read.credential.protocolCredentialId,\n      read.credential.credentialKey,\n      read.credential.userHandle,\n      read.credential.publicKey,\n      read.credential.algorithm,\n      read.credential.profile,\n      read.credential.credentialRevision,\n      read.credential.status,\n      read.credential.primarySignIn,\n      read.credential.enrollmentUserVerified,\n      read.credential.backupEligible,\n    ];\n\n    const semantic = Object.fromEntries(semanticKeys.map((key) => [key, values[key]]));\n\n    const authority = Object.fromEntries(\n      [\n        read.authority.subjectId,\n        read.authority.credentialId,\n        read.authority.revision,\n        read.authority.status,\n      ].map((key) => [key, authorityValues[key]]),\n    );\n\n    return {\n      details,\n      condition: sql`exists(select 1 from ${credential.name} where ${match(credential, semantic)}) and exists(select 1 from ${factor.name} where ${match(factor, authority)})`,\n    };\n  });\n\n  return {\n    summary,\n    owned,\n    subjectCondition,\n    insertCredential,\n    postcondition,\n    write,\n    check,\n    eq,\n    expression,\n    match,\n  };\n};\n\nexport const makePasskeyNativeManagement = (\n  base: NativePasskeyServices,\n  mapping: NativePasskeyManagementMapping,\n) => {\n  const { state, run, advisory } = base;\n  const { sql, tables, subject, credential, factor, ceremony: flow } = state;\n  const read = mapping.read;\n  const invariant: typeof passkeyNativeInvariant = passkeyNativeInvariant;\n\n  const {\n    summary,\n    owned,\n    subjectCondition,\n    insertCredential,\n    postcondition,\n    write,\n    eq,\n    expression,\n    match,\n  } = makePasskeyNativeWrites(base, mapping);\n\n  const service: M.PasskeyManagementPersistence[\"Service\"] = {\n    list: (original) =>\n      advisory(\n        Effect.gen(function* () {\n          const input = M.snapshotPasskeySync(passkeyManagementInputs.list, original);\n\n          invariant(flow.validModule(input.moduleId));\n          const nativeId = state.native(input.subjectId);\n\n          const rows =\n            yield* sql`select ${credential.fields(\"c_\")} from ${credential.name} where ${owned(nativeId)} and ${expression(mapping.write.policy.metadata(nativeId))}\n        ${input.cursor === undefined ? sql`` : sql`and ${credential.column(read.credential.credentialId)} > ${credential.value(read.credential.credentialId, input.cursor)}`}\n        order by ${credential.column(read.credential.credentialId)} limit ${input.limit + 1}`;\n\n          const credentials = rows\n            .slice(0, input.limit)\n            .map((row) => summary(credential.decode(row, \"c_\")));\n\n          const cursor = rows.length > input.limit ? credentials.at(-1)?.credentialId : undefined;\n\n          return { credentials, ...(cursor === undefined ? {} : { cursor }) };\n        }),\n      ),\n    inspectRemove: (original) =>\n      advisory(\n        Effect.gen(function* () {\n          const input = M.snapshotPasskeySync(passkeyManagementInputs.inspectRemove, original);\n\n          if (!flow.validModule(input.moduleId)) return { _tag: \"Rejected\" } as const;\n          const nativeId = state.native(input.subjectId);\n          const current = yield* state.readAuthority(nativeId, false, input.credentialId);\n\n          if (current === undefined) return { _tag: \"Rejected\" } as const;\n\n          const value =\n            current.credential === undefined\n              ? undefined\n              : yield* state.decodeCredential(current.credential, current.revision, current.row);\n\n          return value === undefined\n            ? ({ _tag: \"Rejected\" } as const)\n            : ({ _tag: \"Target\", credential: value } as const);\n        }),\n      ),\n    completeEnrollment: (original, prepare) =>\n      run(\n        Effect.gen(function* () {\n          const input = M.snapshotPasskeySync(passkeyManagementInputs.completeEnrollment, original);\n          const ceremony = input.ceremony;\n\n          if (\n            !flow.validModule(ceremony.moduleId) ||\n            ceremony.context._tag !== \"Enrollment\" ||\n            !passkeyMatchesAccess(ceremony, input.access)\n          )\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n          const context = ceremony.context;\n          const nativeId = state.native(context.revision.subjectId);\n          const current = yield* state.readAuthority(nativeId, !base.batch);\n\n          if (current === undefined)\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n\n          const policy = M.snapshotPasskeySync(\n            M.PasskeyManagementPolicy,\n            mapping.write.policy.management(current.row),\n          );\n\n          const requirement = yield* mapping.write.policy.requirement(current.row, \"enroll-begin\");\n\n          const authority = yield* assessPasskeyAction(\n            {\n              moduleId: mapping.moduleId,\n              revision: current.revision,\n              nowMillis: current.nowMillis,\n              currentRequirement: requirement,\n              expected: {\n                action: \"enroll-begin\",\n                commandId: ceremony.commandId,\n                flowId: ceremony.flowId,\n                bindingDigest: yield* passkeyEnrollmentDigest(ceremony),\n                revision: context.revision,\n              },\n            },\n            context.authorization,\n            {\n              ...policy,\n              maximumEvidenceAgeMillis: Math.min(\n                policy.maximumEvidenceAgeMillis,\n                input.management.maximumEvidenceAgeMillis,\n              ),\n            },\n          );\n\n          if (authority === undefined)\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n          const cap = Math.min(policy.maximumCredentials, input.management.maximumCredentials);\n\n          const policyValues = Object.fromEntries(\n            mapping.write.policy.subjectColumns.map((key) => [key, current.row[key]]),\n          );\n\n          const policyUnchanged = sql`exists(select 1 from ${subject.name} where ${subject.column(read.subject.id)} = ${subject.value(read.subject.id, nativeId)} and ${match(subject, policyValues)})`;\n\n          const condition = sql`${subjectCondition(current.revision)} and ${policyUnchanged} and ${expression(mapping.write.policy.action(nativeId, context.authorization))} and ${expression(mapping.write.policy.metadata(nativeId))}\n        and ${state.now} < ${authority.expiresBeforeMillis} and (select count(*) from ${credential.name} where ${owned(nativeId)}) < ${cap}`;\n\n          const statement = flow.consume(input.access, ceremony, condition);\n\n          if (base.batch) yield* flow.stage(statement, 1);\n          else if ((yield* flow.change(statement)) !== 1)\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n\n          const enrolled = yield* insertCredential(\n            nativeId,\n            ceremony,\n            input.verified,\n            current.revision,\n            context.name,\n            current.nowMillis,\n            current.row,\n          );\n\n          yield* postcondition(\n            \"passkey-enrollment-authority\",\n            sql`${enrolled.condition} and ${flow.absent(input.access)} and ${subjectCondition(current.revision)} and ${policyUnchanged} and (select count(*) from ${credential.name} where ${owned(nativeId)}) <= ${cap} and ${expression(mapping.write.policy.action(nativeId, context.authorization))} and ${state.now} < ${authority.expiresBeforeMillis}`,\n          );\n\n          return yield* preparePasskeyNative(\n            { _tag: \"Enrolled\", credential: enrolled.details },\n            prepare,\n          );\n        }),\n      ),\n    rename: (original, prepare) =>\n      run(\n        Effect.gen(function* () {\n          const input = M.snapshotPasskeySync(passkeyManagementInputs.rename, original);\n\n          if (!flow.validModule(input.moduleId))\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n          const nativeId = state.native(input.subjectId);\n          const statement = sql`${credential.update({ [mapping.write.credential.name]: input.name })} where ${owned(nativeId, input.credentialId)} and ${expression(mapping.write.policy.metadata(nativeId))}`;\n          let rows: ReadonlyArray<PasskeyNativeRow>;\n\n          if (base.batch) {\n            rows =\n              yield* sql`select ${credential.fields(\"c_\")} from ${credential.name} where ${owned(nativeId, input.credentialId)} and ${expression(mapping.write.policy.metadata(nativeId))}`;\n            if (rows.length !== 1)\n              return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n            yield* flow.stage(statement, 1);\n          } else {\n            rows = yield* sql.onDialectOrElse({\n              mysql: () =>\n                Effect.gen(function* () {\n                  const changed = yield* flow.change(statement);\n\n                  if (changed > 1) return [];\n\n                  // With mysql2 -FOUND_ROWS an idempotent rename reports zero changes.\n                  return yield* sql`select ${credential.fields(\"c_\")} from ${credential.name} where ${owned(nativeId, input.credentialId)} and ${eq(credential, mapping.write.credential.name, input.name)} and ${expression(mapping.write.policy.metadata(nativeId))}`;\n                }),\n              orElse: () => sql`${statement} returning ${credential.fields(\"c_\")}`,\n            });\n          }\n          if (rows.length !== 1) return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n          const row = credential.decode(rows[0]!, \"c_\");\n\n          return yield* preparePasskeyNative(\n            {\n              _tag: \"Renamed\",\n              credential: summary({ ...row, [mapping.write.credential.name]: input.name }),\n            },\n            prepare,\n          );\n        }),\n        \"statement\",\n      ),\n    remove: (original, prepare) =>\n      run(\n        Effect.gen(function* () {\n          const input = M.snapshotPasskeySync(passkeyManagementInputs.remove, original);\n\n          if (!flow.validModule(input.moduleId))\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n          const nativeId = state.native(input.credential.revision.subjectId);\n\n          const current = yield* state.readAuthority(\n            nativeId,\n            !base.batch,\n            input.credential.credentialId,\n          );\n\n          if (current === undefined)\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n\n          const captured =\n            current.credential === undefined\n              ? undefined\n              : yield* state.decodeCredential(current.credential, current.revision, current.row);\n\n          const policy = M.snapshotPasskeySync(\n            M.PasskeyManagementPolicy,\n            mapping.write.policy.management(current.row),\n          );\n\n          if (\n            captured === undefined ||\n            !samePasskeyCredential(captured, input.credential) ||\n            !samePasskeyRevision(captured.revision, input.credential.revision) ||\n            ((policy.requireImmediateInvalidation ||\n              input.management.requireImmediateInvalidation) &&\n              mapping.invalidation.window.existingSessions !== \"immediate\") ||\n            Schema.encodeSync(Schema.fromJsonString(M.PasskeyRemoved.fields.invalidation))(\n              input.invalidation,\n            ) !==\n              Schema.encodeSync(Schema.fromJsonString(M.PasskeyRemoved.fields.invalidation))(\n                mapping.invalidation.window,\n              )\n          )\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n          const requirement = yield* mapping.write.policy.requirement(current.row, \"remove\");\n\n          const authority = yield* assessPasskeyAction(\n            {\n              moduleId: mapping.moduleId,\n              revision: current.revision,\n              nowMillis: current.nowMillis,\n              currentRequirement: requirement,\n              expected: {\n                action: \"remove\",\n                commandId: input.commandId,\n                flowId: input.commandId,\n                bindingDigest: yield* passkeyRemoveDigest(\n                  mapping.moduleId,\n                  input.commandId,\n                  input.credential,\n                ),\n                revision: input.credential.revision,\n              },\n            },\n            input.authorization,\n            {\n              ...policy,\n              maximumEvidenceAgeMillis: Math.min(\n                policy.maximumEvidenceAgeMillis,\n                input.management.maximumEvidenceAgeMillis,\n              ),\n            },\n          );\n\n          if (authority === undefined)\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n\n          const remaining = expression(\n            yield* mapping.write.policy.remainingSignIn(\n              nativeId,\n              captured.credentialId,\n              current.row,\n            ),\n          );\n\n          const allowed = expression(mapping.write.policy.action(nativeId, input.authorization));\n\n          const classify = Effect.gen(function* () {\n            const rows =\n              yield* sql`select case when ${remaining} then 1 else 0 end as remaining, case when ${allowed} and ${state.now} < ${authority.expiresBeforeMillis} and ${subjectCondition(current.revision)} then 1 else 0 end as allowed`;\n\n            return Number(rows[0]?.allowed) !== 1\n              ? (\"Rejected\" as const)\n              : Number(rows[0]?.remaining) !== 1\n                ? (\"LastSignInMethod\" as const)\n                : undefined;\n          });\n\n          const next = SecurityRevision.make(yield* randomId);\n          const update = sql`${subject.update({ [read.subject.securityRevision]: next })} where ${subject.column(read.subject.id)} = ${subject.value(read.subject.id, nativeId)} and ${eq(subject, read.subject.securityRevision, current.revision.securityRevision)} and ${state.active(\"subject\")} and ${remaining} and ${allowed} and ${state.now} < ${authority.expiresBeforeMillis}`;\n\n          if (base.batch) {\n            const rejected = yield* classify;\n\n            if (rejected !== undefined)\n              return yield* preparePasskeyNative({ _tag: rejected }, prepare);\n            yield* write(update, 1);\n          } else if ((yield* flow.change(update)) !== 1) {\n            const rejected = yield* classify;\n\n            return yield* preparePasskeyNative({ _tag: rejected ?? \"Rejected\" }, prepare);\n          }\n          yield* write(\n            sql`${credential.update({ [read.credential.status]: mapping.write.credential.removedStatus, [read.credential.credentialRevision]: next })} where ${owned(nativeId, captured.credentialId)} and ${eq(credential, read.credential.credentialRevision, captured.revision.credentials.find((entry) => entry.credentialId === captured.credentialId)?.revision)}`,\n            1,\n          );\n          yield* write(\n            sql`${factor.update({ [read.authority.status]: mapping.write.authority.removedStatus, [read.authority.revision]: next })} where ${factor.column(read.authority.subjectId)} = ${factor.value(read.authority.subjectId, nativeId)} and ${eq(factor, read.authority.credentialId, captured.credentialId)}`,\n            1,\n          );\n\n          const policyValues = Object.fromEntries(\n            mapping.write.policy.subjectColumns.map((key) => [\n              key,\n              key === read.subject.securityRevision ? next : current.row[key],\n            ]),\n          );\n\n          const policyUnchanged = sql`exists(select 1 from ${subject.name} where ${subject.column(read.subject.id)} = ${subject.value(read.subject.id, nativeId)} and ${match(subject, policyValues)})`;\n\n          const invalidation = {\n            subjectId: nativeId,\n            previousRevision: current.revision.securityRevision,\n            securityRevision: next,\n            invalidation: input.invalidation,\n          };\n\n          const finalConditions: Array<Fragment> = [];\n\n          for (const mutation of mapping.invalidation.mutations) {\n            const table = tables(mutation.table);\n            const query = sql`${table.update(mutation.values(invalidation))} where ${expression(mutation.where(invalidation))}`;\n\n            if (base.batch) yield* appendSqlBatchStatement(query);\n            else yield* query;\n            finalConditions.push(expression(mutation.postcondition(invalidation)));\n          }\n          finalConditions.push(\n            sql`exists(select 1 from ${credential.name} where ${credential.column(read.credential.subjectId)} = ${credential.value(read.credential.subjectId, nativeId)} and ${eq(credential, read.credential.credentialId, captured.credentialId)} and ${eq(credential, read.credential.credentialRevision, next)} and ${eq(credential, read.credential.status, mapping.write.credential.removedStatus)}) and exists(select 1 from ${factor.name} where ${factor.column(read.authority.subjectId)} = ${factor.value(read.authority.subjectId, nativeId)} and ${eq(factor, read.authority.credentialId, captured.credentialId)} and ${eq(factor, read.authority.revision, next)} and ${eq(factor, read.authority.status, mapping.write.authority.removedStatus)})`,\n          );\n          finalConditions.push(\n            sql`${expression(mapping.invalidation.postcondition(invalidation))} and ${policyUnchanged} and ${remaining} and ${state.now} < ${authority.expiresBeforeMillis}`,\n          );\n          yield* postcondition(\"passkey-removal\", sql.and(finalConditions));\n\n          return yield* preparePasskeyNative(\n            {\n              _tag: \"Removed\",\n              result: { credentialId: captured.credentialId, invalidation: input.invalidation },\n            },\n            prepare,\n          );\n        }),\n      ),\n  };\n\n  return { passkeyManagementPersistence: service };\n};\n"],"mappings":";;;;;;;;;;;;;;;AAiDA,MAAa,2BACX,MACA,YACG;CACH,MAAM,EAAE,UAAU;CAClB,MAAM,EAAE,KAAK,QAAQ,SAAS,YAAY,QAAQ,UAAU,SAAS;CACrE,MAAM,OAAO,QAAQ;CACrB,MAAM,YAA2C;CACjD,MAAM,aAAa,OAAO;CAE1B,MAAM,MAAM,OAAiB,KAAa,UACxC,OAAO,UAAU,WACb,aAAa,KAAK,MAAM,OAAO,GAAG,GAAG,MAAM,MAAM,KAAK,KAAK,CAAC,IAC5D,GAAG,GAAG,MAAM,OAAO,GAAG,EAAE,KAAK,MAAM,MAAM,KAAK,KAAK;CAEzD,MAAM,SAAS,OAAiB,WAC9B,IAAI,IACF,OAAO,QAAQ,MAAM,CAAC,CACnB,QAAQ,GAAG,WAAW,UAAU,KAAA,CAAS,CAAC,CAC1C,KAAK,CAAC,KAAK,WACV,UAAU,OAAO,GAAG,GAAG,MAAM,OAAO,GAAG,EAAE,YAAY,GAAG,OAAO,KAAK,KAAK,CAC3E,CACJ;CAEF,MAAM,SAAS,cACb,OAAO,IAAI,aAAa;EAEtB,MAAM,OAAO,OAAO,CADH,OAAO,UAAU,UAAA,CAAW,kBACnB,CAAC,oBAAoB,UAAU;EAEzD,IAAI,KAAK,WAAW,KAAK,OAAO,KAAK,EAAE,CAAE,KAAK,MAAM,GAClD,OAAO,OAAO,wBAAwB,KAAK;GACzC,WAAW;GACX,OAAO;EACT,CAAC;CACL,CAAC;CAEH,MAAM,iBAAiB,MAAc,cACnC,KAAK,QACD,8BAA8B;EAAE;EAAM,WAAW,kBAAkB,KAAK,SAAS;CAAE,CAAC,IACpF,yBAAyB;EAAE;EAAM,OAAO,MAAM,SAAS;CAAE,CAAC;CAEhE,MAAM,SAAS,WAAqB,UAClC,KAAK,QACD,KAAK,MAAM,WAAW,KAAK,IAC3B,KAAK,OAAO,SAAS,CAAC,CAAC,KACrB,OAAO,SAAS,YACd,YAAY,QACR,OAAO,OACP,OAAO,KACL,wBAAwB,KAAK;EAC3B,WAAW;EACX,OAAO;CACT,CAAC,CACH,CACN,CACF;CAEN,MAAM,WAAW,QACf,OAAO,kBAAkB,EAAE,wBAAwB,CAAC,CAAC;EACnD,cAAc,IAAI,KAAK,WAAW;EAClC,MAAM,IAAI,QAAQ,MAAM,WAAW;EACnC,eAAe,KAAK,WAAW,OAAO,GAAG,CAAC,CAAC;EAC3C,iBAAiB,QAAQ,MAAM,cAAc,IAAI,QAAQ,MAAM,WAAW,UAAU;EACpF,GAAI,IAAI,QAAQ,UAAU,gBAAgB,QAC1C,IAAI,QAAQ,UAAU,gBAAgB,KAAA,IAClC,CAAC,IACD,EAAE,kBAAkB,QAAQ,MAAM,cAAc,IAAI,QAAQ,UAAU,WAAW,EAAE;CACzF,CAAC;CAEH,MAAM,SAAS,UAAmB,iBAChC,IAAI,IAAI;EACN,GAAG,GAAG,WAAW,OAAO,KAAK,WAAW,SAAS,EAAE,KAAK,WAAW,MAAM,KAAK,WAAW,WAAW,QAAQ;EAC5G,GAAI,iBAAiB,KAAA,IACjB,CAAC,IACD,CAAC,GAAG,YAAY,KAAK,WAAW,cAAc,YAAY,CAAC;EAC/D,MAAM,OAAO,YAAY;CAC3B,CAAC;CAEH,MAAM,oBAAoB,YAA6C;EACrE,MAAM,KAAK,MAAM,OAAO,QAAQ,SAAS;EAEzC,OAAO,GAAG,wBAAwB,QAAQ,KAAK,SAAS,QAAQ,OAAO,KAAK,QAAQ,EAAE,EAAE,KAAK,QAAQ,MAAM,KAAK,QAAQ,IAAI,EAAE,EAAE,OAAO,GAAG,SAAS,KAAK,QAAQ,kBAAkB,QAAQ,gBAAgB,EAAE,OAAO,MAAM,OAAO,SAAS,EAAE,QAAQ,IAAI,IAAI,QAAQ,YAAY,KAAK,UAAU,GAAG,wBAAwB,OAAO,KAAK,SAAS,OAAO,OAAO,KAAK,UAAU,SAAS,EAAE,KAAK,OAAO,MAAM,KAAK,UAAU,WAAW,EAAE,EAAE,OAAO,GAAG,QAAQ,KAAK,UAAU,cAAc,MAAM,YAAY,EAAE,OAAO,GAAG,QAAQ,KAAK,UAAU,UAAU,MAAM,QAAQ,EAAE,OAAO,MAAM,OAAO,WAAW,EAAE,EAAE,CAAC;CAC1kB;CAoGA,OAAO;EACL;EACA;EACA;EACA,kBAtGuB,OAAO,WAAW,WACzC,UACA,UACA,UACA,UACA,MACA,WACA,YACA;GACA,UAAU,SAAS,QAAQ,SAAS,gBAAgB,SAAS,QAAQ,SAAS,cAAc;GAC5F,MAAM,eAAe,OAAO;GAC5B,MAAM,SAAS,OAAO;GACtB,MAAM,qBAAqB,iBAAiB,KAAK,MAAM;GAEvD,MAAM,QAAQ,EAAE,oBAAoB,EAAE,mBAAmB;IACvD;IACA,aAAa,OAAO,KAAK,QAAQ,kBAAkB,UAAU;IAC7D,MAAM,SAAS,QAAQ;IACvB,sBAAsB,SAAS;IAC/B,YAAY,SAAS,QAAQ;IAC7B,WAAW,SAAS;IACpB,WAAW,SAAS;IACpB,SAAS,SAAS;IAClB,UAAU;KACR,GAAG;KACH,aAAa,CAAC,GAAG,SAAS,aAAa;MAAE;MAAc,UAAU;KAAmB,CAAC;IACvF;IACA,QAAQ;IACR,eAAe,SAAS,QAAQ,iBAAiB,SAAS;IAC1D,wBAAwB,SAAS;IACjC,gBAAgB,SAAS;IACzB,aAAa,SAAS;IACtB,SAAS,SAAS;GACpB,CAAC;GAED,MAAM,UAAU,EAAE,oBAAoB,EAAE,0BAA0B;IAChE;IACA;IACA,eAAe,MAAM;IACrB,iBAAiB;GACnB,CAAC;GAED,MAAM,QAA0C;IAC9C,WAAW;IACX,YAAY;IACZ,SAAS;IACT;GACF;GAEA,MAAM,SAAS;IACb,GAAG,QAAQ,MAAM,WAAW,aAAa,KAAK;KAC7C,KAAK,WAAW,gBAAgB,OAAO,qBACtC,MAAM,MACN,MAAM,oBACR;GACF;GAEA,MAAM,kBAAkB,QAAQ,MAAM,UAAU,aAAa,KAAK;GAElE,OAAO,MAAM,WAAW,OAAO,MAAM,GAAG,CAAC;GACzC,OAAO,MAAM,OAAO,OAAO,eAAe,GAAG,CAAC;GAI9C,MAAM,eAAe;IACnB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;GAClB;GAEA,MAAM,WAAW,OAAO,YAAY,aAAa,KAAK,QAAQ,CAAC,KAAK,OAAO,IAAI,CAAC,CAAC;GAEjF,MAAM,YAAY,OAAO,YACvB;IACE,KAAK,UAAU;IACf,KAAK,UAAU;IACf,KAAK,UAAU;IACf,KAAK,UAAU;GACjB,CAAC,CAAC,KAAK,QAAQ,CAAC,KAAK,gBAAgB,IAAI,CAAC,CAC5C;GAEA,OAAO;IACL;IACA,WAAW,GAAG,wBAAwB,WAAW,KAAK,SAAS,MAAM,YAAY,QAAQ,EAAE,6BAA6B,OAAO,KAAK,SAAS,MAAM,QAAQ,SAAS,EAAE;GACxK;EACF,CAMiB;EACf;EACA;EACA;EACA;EACA;EACA;CACF;AACF;AAEA,MAAa,+BACX,MACA,YACG;CACH,MAAM,EAAE,OAAO,KAAK,aAAa;CACjC,MAAM,EAAE,KAAK,QAAQ,SAAS,YAAY,QAAQ,UAAU,SAAS;CACrE,MAAM,OAAO,QAAQ;CACrB,MAAM,YAA2C;CAEjD,MAAM,EACJ,SACA,OACA,kBACA,kBACA,eACA,OACA,IACA,YACA,UACE,wBAAwB,MAAM,OAAO;CAyVzC,OAAO,EAAE,8BAA8B;EAtVrC,OAAO,aACL,SACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,oBAAoB,wBAAwB,MAAM,QAAQ;GAE1E,UAAU,KAAK,YAAY,MAAM,QAAQ,CAAC;GAC1C,MAAM,WAAW,MAAM,OAAO,MAAM,SAAS;GAE7C,MAAM,OACJ,OAAO,GAAG,UAAU,WAAW,OAAO,IAAI,EAAE,QAAQ,WAAW,KAAK,SAAS,MAAM,QAAQ,EAAE,OAAO,WAAW,QAAQ,MAAM,OAAO,SAAS,QAAQ,CAAC,EAAE;UAC1J,MAAM,WAAW,KAAA,IAAY,GAAG,KAAK,GAAG,OAAO,WAAW,OAAO,KAAK,WAAW,YAAY,EAAE,KAAK,WAAW,MAAM,KAAK,WAAW,cAAc,MAAM,MAAM,IAAI;mBAC1J,WAAW,OAAO,KAAK,WAAW,YAAY,EAAE,SAAS,MAAM,QAAQ;GAEhF,MAAM,cAAc,KACjB,MAAM,GAAG,MAAM,KAAK,CAAC,CACrB,KAAK,QAAQ,QAAQ,WAAW,OAAO,KAAK,IAAI,CAAC,CAAC;GAErD,MAAM,SAAS,KAAK,SAAS,MAAM,QAAQ,YAAY,GAAG,EAAE,CAAC,EAAE,eAAe,KAAA;GAE9E,OAAO;IAAE;IAAa,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO;GAAG;EACpE,CAAC,CACH;EACF,gBAAgB,aACd,SACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,oBAAoB,wBAAwB,eAAe,QAAQ;GAEnF,IAAI,CAAC,KAAK,YAAY,MAAM,QAAQ,GAAG,OAAO,EAAE,MAAM,WAAW;GACjE,MAAM,WAAW,MAAM,OAAO,MAAM,SAAS;GAC7C,MAAM,UAAU,OAAO,MAAM,cAAc,UAAU,OAAO,MAAM,YAAY;GAE9E,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;GAErD,MAAM,QACJ,QAAQ,eAAe,KAAA,IACnB,KAAA,IACA,OAAO,MAAM,iBAAiB,QAAQ,YAAY,QAAQ,UAAU,QAAQ,GAAG;GAErF,OAAO,UAAU,KAAA,IACZ,EAAE,MAAM,WAAW,IACnB;IAAE,MAAM;IAAU,YAAY;GAAM;EAC3C,CAAC,CACH;EACF,qBAAqB,UAAU,YAC7B,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,oBAAoB,wBAAwB,oBAAoB,QAAQ;GACxF,MAAM,WAAW,MAAM;GAEvB,IACE,CAAC,KAAK,YAAY,SAAS,QAAQ,KACnC,SAAS,QAAQ,SAAS,gBAC1B,CAAC,qBAAqB,UAAU,MAAM,MAAM,GAE5C,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAClE,MAAM,UAAU,SAAS;GACzB,MAAM,WAAW,MAAM,OAAO,QAAQ,SAAS,SAAS;GACxD,MAAM,UAAU,OAAO,MAAM,cAAc,UAAU,CAAC,KAAK,KAAK;GAEhE,IAAI,YAAY,KAAA,GACd,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAElE,MAAM,SAAS,EAAE,oBACf,EAAE,yBACF,QAAQ,MAAM,OAAO,WAAW,QAAQ,GAAG,CAC7C;GAEA,MAAM,cAAc,OAAO,QAAQ,MAAM,OAAO,YAAY,QAAQ,KAAK,cAAc;GAEvF,MAAM,YAAY,OAAO,oBACvB;IACE,UAAU,QAAQ;IAClB,UAAU,QAAQ;IAClB,WAAW,QAAQ;IACnB,oBAAoB;IACpB,UAAU;KACR,QAAQ;KACR,WAAW,SAAS;KACpB,QAAQ,SAAS;KACjB,eAAe,OAAO,wBAAwB,QAAQ;KACtD,UAAU,QAAQ;IACpB;GACF,GACA,QAAQ,eACR;IACE,GAAG;IACH,0BAA0B,KAAK,IAC7B,OAAO,0BACP,MAAM,WAAW,wBACnB;GACF,CACF;GAEA,IAAI,cAAc,KAAA,GAChB,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAClE,MAAM,MAAM,KAAK,IAAI,OAAO,oBAAoB,MAAM,WAAW,kBAAkB;GAEnF,MAAM,eAAe,OAAO,YAC1B,QAAQ,MAAM,OAAO,eAAe,KAAK,QAAQ,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAC1E;GAEA,MAAM,kBAAkB,GAAG,wBAAwB,QAAQ,KAAK,SAAS,QAAQ,OAAO,KAAK,QAAQ,EAAE,EAAE,KAAK,QAAQ,MAAM,KAAK,QAAQ,IAAI,QAAQ,EAAE,OAAO,MAAM,SAAS,YAAY,EAAE;GAE3L,MAAM,YAAY,GAAG,GAAG,iBAAiB,QAAQ,QAAQ,EAAE,OAAO,gBAAgB,OAAO,WAAW,QAAQ,MAAM,OAAO,OAAO,UAAU,QAAQ,aAAa,CAAC,EAAE,OAAO,WAAW,QAAQ,MAAM,OAAO,SAAS,QAAQ,CAAC,EAAE;cACzN,MAAM,IAAI,KAAK,UAAU,oBAAoB,6BAA6B,WAAW,KAAK,SAAS,MAAM,QAAQ,EAAE,MAAM;GAE7H,MAAM,YAAY,KAAK,QAAQ,MAAM,QAAQ,UAAU,SAAS;GAEhE,IAAI,KAAK,OAAO,OAAO,KAAK,MAAM,WAAW,CAAC;QACzC,KAAK,OAAO,KAAK,OAAO,SAAS,OAAO,GAC3C,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAElE,MAAM,WAAW,OAAO,iBACtB,UACA,UACA,MAAM,UACN,QAAQ,UACR,QAAQ,MACR,QAAQ,WACR,QAAQ,GACV;GAEA,OAAO,cACL,gCACA,GAAG,GAAG,SAAS,UAAU,OAAO,KAAK,OAAO,MAAM,MAAM,EAAE,OAAO,iBAAiB,QAAQ,QAAQ,EAAE,OAAO,gBAAgB,6BAA6B,WAAW,KAAK,SAAS,MAAM,QAAQ,EAAE,OAAO,IAAI,OAAO,WAAW,QAAQ,MAAM,OAAO,OAAO,UAAU,QAAQ,aAAa,CAAC,EAAE,OAAO,MAAM,IAAI,KAAK,UAAU,qBAC9T;GAEA,OAAO,OAAO,qBACZ;IAAE,MAAM;IAAY,YAAY,SAAS;GAAQ,GACjD,OACF;EACF,CAAC,CACH;EACF,SAAS,UAAU,YACjB,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,oBAAoB,wBAAwB,QAAQ,QAAQ;GAE5E,IAAI,CAAC,KAAK,YAAY,MAAM,QAAQ,GAClC,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAClE,MAAM,WAAW,MAAM,OAAO,MAAM,SAAS;GAC7C,MAAM,YAAY,GAAG,GAAG,WAAW,OAAO,GAAG,QAAQ,MAAM,WAAW,OAAO,MAAM,KAAK,CAAC,EAAE,SAAS,MAAM,UAAU,MAAM,YAAY,EAAE,OAAO,WAAW,QAAQ,MAAM,OAAO,SAAS,QAAQ,CAAC;GACjM,IAAI;GAEJ,IAAI,KAAK,OAAO;IACd,OACE,OAAO,GAAG,UAAU,WAAW,OAAO,IAAI,EAAE,QAAQ,WAAW,KAAK,SAAS,MAAM,UAAU,MAAM,YAAY,EAAE,OAAO,WAAW,QAAQ,MAAM,OAAO,SAAS,QAAQ,CAAC;IAC5K,IAAI,KAAK,WAAW,GAClB,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;IAClE,OAAO,KAAK,MAAM,WAAW,CAAC;GAChC,OACE,OAAO,OAAO,IAAI,gBAAgB;IAChC,aACE,OAAO,IAAI,aAAa;KAGtB,KAAI,OAFmB,KAAK,OAAO,SAAS,KAE9B,GAAG,OAAO,CAAC;KAGzB,OAAO,OAAO,GAAG,UAAU,WAAW,OAAO,IAAI,EAAE,QAAQ,WAAW,KAAK,SAAS,MAAM,UAAU,MAAM,YAAY,EAAE,OAAO,GAAG,YAAY,QAAQ,MAAM,WAAW,MAAM,MAAM,IAAI,EAAE,OAAO,WAAW,QAAQ,MAAM,OAAO,SAAS,QAAQ,CAAC;IACpP,CAAC;IACH,cAAc,GAAG,GAAG,UAAU,aAAa,WAAW,OAAO,IAAI;GACnE,CAAC;GAEH,IAAI,KAAK,WAAW,GAAG,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GACvF,MAAM,MAAM,WAAW,OAAO,KAAK,IAAK,IAAI;GAE5C,OAAO,OAAO,qBACZ;IACE,MAAM;IACN,YAAY,QAAQ;KAAE,GAAG;MAAM,QAAQ,MAAM,WAAW,OAAO,MAAM;IAAK,CAAC;GAC7E,GACA,OACF;EACF,CAAC,GACD,WACF;EACF,SAAS,UAAU,YACjB,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,oBAAoB,wBAAwB,QAAQ,QAAQ;GAE5E,IAAI,CAAC,KAAK,YAAY,MAAM,QAAQ,GAClC,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAClE,MAAM,WAAW,MAAM,OAAO,MAAM,WAAW,SAAS,SAAS;GAEjE,MAAM,UAAU,OAAO,MAAM,cAC3B,UACA,CAAC,KAAK,OACN,MAAM,WAAW,YACnB;GAEA,IAAI,YAAY,KAAA,GACd,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAElE,MAAM,WACJ,QAAQ,eAAe,KAAA,IACnB,KAAA,IACA,OAAO,MAAM,iBAAiB,QAAQ,YAAY,QAAQ,UAAU,QAAQ,GAAG;GAErF,MAAM,SAAS,EAAE,oBACf,EAAE,yBACF,QAAQ,MAAM,OAAO,WAAW,QAAQ,GAAG,CAC7C;GAEA,IACE,aAAa,KAAA,KACb,CAAC,sBAAsB,UAAU,MAAM,UAAU,KACjD,CAAC,oBAAoB,SAAS,UAAU,MAAM,WAAW,QAAQ,MAC/D,OAAO,gCACP,MAAM,WAAW,iCACjB,QAAQ,aAAa,OAAO,qBAAqB,eACnD,OAAO,WAAW,OAAO,eAAe,EAAE,eAAe,OAAO,YAAY,CAAC,CAAC,CAC5E,MAAM,YACR,MACE,OAAO,WAAW,OAAO,eAAe,EAAE,eAAe,OAAO,YAAY,CAAC,CAAC,CAC5E,QAAQ,aAAa,MACvB,GAEF,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAClE,MAAM,cAAc,OAAO,QAAQ,MAAM,OAAO,YAAY,QAAQ,KAAK,QAAQ;GAEjF,MAAM,YAAY,OAAO,oBACvB;IACE,UAAU,QAAQ;IAClB,UAAU,QAAQ;IAClB,WAAW,QAAQ;IACnB,oBAAoB;IACpB,UAAU;KACR,QAAQ;KACR,WAAW,MAAM;KACjB,QAAQ,MAAM;KACd,eAAe,OAAO,oBACpB,QAAQ,UACR,MAAM,WACN,MAAM,UACR;KACA,UAAU,MAAM,WAAW;IAC7B;GACF,GACA,MAAM,eACN;IACE,GAAG;IACH,0BAA0B,KAAK,IAC7B,OAAO,0BACP,MAAM,WAAW,wBACnB;GACF,CACF;GAEA,IAAI,cAAc,KAAA,GAChB,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAElE,MAAM,YAAY,WAChB,OAAO,QAAQ,MAAM,OAAO,gBAC1B,UACA,SAAS,cACT,QAAQ,GACV,CACF;GAEA,MAAM,UAAU,WAAW,QAAQ,MAAM,OAAO,OAAO,UAAU,MAAM,aAAa,CAAC;GAErF,MAAM,WAAW,OAAO,IAAI,aAAa;IACvC,MAAM,OACJ,OAAO,GAAG,oBAAoB,UAAU,6CAA6C,QAAQ,OAAO,MAAM,IAAI,KAAK,UAAU,oBAAoB,OAAO,iBAAiB,QAAQ,QAAQ,EAAE;IAE7L,OAAO,OAAO,KAAK,EAAE,EAAE,OAAO,MAAM,IAC/B,aACD,OAAO,KAAK,EAAE,EAAE,SAAS,MAAM,IAC5B,qBACD,KAAA;GACR,CAAC;GAED,MAAM,OAAO,iBAAiB,KAAK,OAAO,QAAQ;GAClD,MAAM,SAAS,GAAG,GAAG,QAAQ,OAAO,GAAG,KAAK,QAAQ,mBAAmB,KAAK,CAAC,EAAE,SAAS,QAAQ,OAAO,KAAK,QAAQ,EAAE,EAAE,KAAK,QAAQ,MAAM,KAAK,QAAQ,IAAI,QAAQ,EAAE,OAAO,GAAG,SAAS,KAAK,QAAQ,kBAAkB,QAAQ,SAAS,gBAAgB,EAAE,OAAO,MAAM,OAAO,SAAS,EAAE,OAAO,UAAU,OAAO,QAAQ,OAAO,MAAM,IAAI,KAAK,UAAU;GAE1V,IAAI,KAAK,OAAO;IACd,MAAM,WAAW,OAAO;IAExB,IAAI,aAAa,KAAA,GACf,OAAO,OAAO,qBAAqB,EAAE,MAAM,SAAS,GAAG,OAAO;IAChE,OAAO,MAAM,QAAQ,CAAC;GACxB,OAAO,KAAK,OAAO,KAAK,OAAO,MAAM,OAAO,GAAG;IAC7C,MAAM,WAAW,OAAO;IAExB,OAAO,OAAO,qBAAqB,EAAE,MAAM,YAAY,WAAW,GAAG,OAAO;GAC9E;GACA,OAAO,MACL,GAAG,GAAG,WAAW,OAAO;KAAG,KAAK,WAAW,SAAS,QAAQ,MAAM,WAAW;KAAgB,KAAK,WAAW,qBAAqB;GAAK,CAAC,EAAE,SAAS,MAAM,UAAU,SAAS,YAAY,EAAE,OAAO,GAAG,YAAY,KAAK,WAAW,oBAAoB,SAAS,SAAS,YAAY,MAAM,UAAU,MAAM,iBAAiB,SAAS,YAAY,CAAC,EAAE,QAAQ,KACzV,CACF;GACA,OAAO,MACL,GAAG,GAAG,OAAO,OAAO;KAAG,KAAK,UAAU,SAAS,QAAQ,MAAM,UAAU;KAAgB,KAAK,UAAU,WAAW;GAAK,CAAC,EAAE,SAAS,OAAO,OAAO,KAAK,UAAU,SAAS,EAAE,KAAK,OAAO,MAAM,KAAK,UAAU,WAAW,QAAQ,EAAE,OAAO,GAAG,QAAQ,KAAK,UAAU,cAAc,SAAS,YAAY,KACpS,CACF;GAEA,MAAM,eAAe,OAAO,YAC1B,QAAQ,MAAM,OAAO,eAAe,KAAK,QAAQ,CAC/C,KACA,QAAQ,KAAK,QAAQ,mBAAmB,OAAO,QAAQ,IAAI,IAC7D,CAAC,CACH;GAEA,MAAM,kBAAkB,GAAG,wBAAwB,QAAQ,KAAK,SAAS,QAAQ,OAAO,KAAK,QAAQ,EAAE,EAAE,KAAK,QAAQ,MAAM,KAAK,QAAQ,IAAI,QAAQ,EAAE,OAAO,MAAM,SAAS,YAAY,EAAE;GAE3L,MAAM,eAAe;IACnB,WAAW;IACX,kBAAkB,QAAQ,SAAS;IACnC,kBAAkB;IAClB,cAAc,MAAM;GACtB;GAEA,MAAM,kBAAmC,CAAC;GAE1C,KAAK,MAAM,YAAY,QAAQ,aAAa,WAAW;IACrD,MAAM,QAAQ,OAAO,SAAS,KAAK;IACnC,MAAM,QAAQ,GAAG,GAAG,MAAM,OAAO,SAAS,OAAO,YAAY,CAAC,EAAE,SAAS,WAAW,SAAS,MAAM,YAAY,CAAC;IAEhH,IAAI,KAAK,OAAO,OAAO,wBAAwB,KAAK;SAC/C,OAAO;IACZ,gBAAgB,KAAK,WAAW,SAAS,cAAc,YAAY,CAAC,CAAC;GACvE;GACA,gBAAgB,KACd,GAAG,wBAAwB,WAAW,KAAK,SAAS,WAAW,OAAO,KAAK,WAAW,SAAS,EAAE,KAAK,WAAW,MAAM,KAAK,WAAW,WAAW,QAAQ,EAAE,OAAO,GAAG,YAAY,KAAK,WAAW,cAAc,SAAS,YAAY,EAAE,OAAO,GAAG,YAAY,KAAK,WAAW,oBAAoB,IAAI,EAAE,OAAO,GAAG,YAAY,KAAK,WAAW,QAAQ,QAAQ,MAAM,WAAW,aAAa,EAAE,6BAA6B,OAAO,KAAK,SAAS,OAAO,OAAO,KAAK,UAAU,SAAS,EAAE,KAAK,OAAO,MAAM,KAAK,UAAU,WAAW,QAAQ,EAAE,OAAO,GAAG,QAAQ,KAAK,UAAU,cAAc,SAAS,YAAY,EAAE,OAAO,GAAG,QAAQ,KAAK,UAAU,UAAU,IAAI,EAAE,OAAO,GAAG,QAAQ,KAAK,UAAU,QAAQ,QAAQ,MAAM,UAAU,aAAa,EAAE,EACttB;GACA,gBAAgB,KACd,GAAG,GAAG,WAAW,QAAQ,aAAa,cAAc,YAAY,CAAC,EAAE,OAAO,gBAAgB,OAAO,UAAU,OAAO,MAAM,IAAI,KAAK,UAAU,qBAC7I;GACA,OAAO,cAAc,mBAAmB,IAAI,IAAI,eAAe,CAAC;GAEhE,OAAO,OAAO,qBACZ;IACE,MAAM;IACN,QAAQ;KAAE,cAAc,SAAS;KAAc,cAAc,MAAM;IAAa;GAClF,GACA,OACF;EACF,CAAC,CACH;CAGyC,EAAE;AACjD"}

package/dist/internal/passkey-native.d.mts

@@ -144,12 +144,15 @@ export declare const makeNativePasskeyServices: (tables: NativeSqlTables, mappin
       readonly backupEligible: boolean;
       readonly backupState: boolean;
       readonly counter: number;
-    } | undefined, PersistenceMappingError | import("effect/PlatformError").PlatformError | Schema.SchemaError | SqlError, Crypto.Crypto>;
+    } | undefined, PersistenceMappingError | import("effect/PlatformError").PlatformError | SqlError, Crypto.Crypto>;
     joinedSubject: SqlTable;
     joinedFactor: SqlTable;
     joinedCredential: SqlTable;
     selected: (kind: "subject" | "authority" | "credential", alias: string) => import("effect/sql/Statement").Statement<import("effect/sql/SqlConnection").Row>;
     mapped: typeof sqlMapping;
+    clockPolicy: {
+      readonly futureToleranceMillis: number;
+    };
     mapping: PasskeyNativeMapping;
     ceremony: {
       sql: import("effect/sql/SqlClient").SqlClient;
@@ -233,6 +236,7 @@ export declare const makeNativePasskeyServices: (tables: NativeSqlTables, mappin
             };
             readonly evidence: {
               readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+              readonly completionExpiresAt?: import("effect/DateTime").Utc;
               readonly revision: {
                 readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
                 readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
@@ -382,7 +386,7 @@ export declare const makeNativePasskeyServices: (tables: NativeSqlTables, mappin
     access: (input: M.PasskeyAccess, ceremony?: M.PasskeyCeremony) => import("effect/sql/Statement").Fragment;
   };
   executor: SqlCommitExecutor<M.PasskeyUnavailable>;
-  run: <A, E, R>(effect: Effect.Effect<A, E, R>, mode?: "transaction" | "statement") => Effect.Effect<A, M.PasskeyUnavailable, Exclude<Exclude<Exclude<Exclude<Exclude<R, Crypto.Crypto>, CurrentSqlCommit>, CurrentCommitJournal>, import("effect/sql/SqlClient").SqlClient>, import("@yielded/auth/Hooks").LifecycleHooks>> | Effect.Effect<A, M.PasskeyUnavailable, Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<R, Crypto.Crypto>, CurrentSqlCommit>, CurrentCommitJournal>, import("effect/sql/SqlClient").SqlClient>, import("@yielded/auth/Hooks").LifecycleHooks>, SqlBatchCommit>>;
+  run: <A, E, R>(effect: Effect.Effect<A, E, R>, mode?: "transaction" | "statement") => never;
   advisory: <A, E, R>(effect: Effect.Effect<A, E, R>) => Effect.Effect<A, M.PasskeyUnavailable, Exclude<Exclude<Exclude<R, Crypto.Crypto>, import("effect/sql/SqlClient").SqlClient>, import("@yielded/auth/Hooks").LifecycleHooks>>;
   passkeyPersistence: {
     readonly issue: <A>(input: {
@@ -411,7 +415,7 @@ export declare const makeNativePasskeyServices: (tables: NativeSqlTables, mappin
       readonly protocolCredentialId: M.PasskeyProtocolCredentialId;
     }) => Effect.Effect<M.PasskeyCredential | undefined, M.PasskeyUnavailable>;
   };
-}, never, Crypto.Crypto | import("@yielded/auth/Hooks").LifecycleHooks | import("effect/sql/SqlClient").SqlClient>;
+}, M.PasskeyUnavailable, Crypto.Crypto | import("@yielded/auth/Hooks").LifecycleHooks | import("effect/sql/SqlClient").SqlClient>;
 export declare const makeBatchPasskeyServices: (tables: NativeSqlTables, mapping: PasskeyNativeMapping) => Effect.Effect<{
   batch: boolean;
   state: {
@@ -549,12 +553,15 @@ export declare const makeBatchPasskeyServices: (tables: NativeSqlTables, mapping
       readonly backupEligible: boolean;
       readonly backupState: boolean;
       readonly counter: number;
-    } | undefined, PersistenceMappingError | import("effect/PlatformError").PlatformError | Schema.SchemaError | SqlError, Crypto.Crypto>;
+    } | undefined, PersistenceMappingError | import("effect/PlatformError").PlatformError | SqlError, Crypto.Crypto>;
     joinedSubject: SqlTable;
     joinedFactor: SqlTable;
     joinedCredential: SqlTable;
     selected: (kind: "subject" | "authority" | "credential", alias: string) => import("effect/sql/Statement").Statement<import("effect/sql/SqlConnection").Row>;
     mapped: typeof sqlMapping;
+    clockPolicy: {
+      readonly futureToleranceMillis: number;
+    };
     mapping: PasskeyNativeMapping;
     ceremony: {
       sql: import("effect/sql/SqlClient").SqlClient;
@@ -638,6 +645,7 @@ export declare const makeBatchPasskeyServices: (tables: NativeSqlTables, mapping
             };
             readonly evidence: {
               readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+              readonly completionExpiresAt?: import("effect/DateTime").Utc;
               readonly revision: {
                 readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
                 readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
@@ -787,7 +795,7 @@ export declare const makeBatchPasskeyServices: (tables: NativeSqlTables, mapping
     access: (input: M.PasskeyAccess, ceremony?: M.PasskeyCeremony) => import("effect/sql/Statement").Fragment;
   };
   executor: SqlCommitExecutor<M.PasskeyUnavailable>;
-  run: <A, E, R>(effect: Effect.Effect<A, E, R>, mode?: "transaction" | "statement") => Effect.Effect<A, M.PasskeyUnavailable, Exclude<Exclude<Exclude<Exclude<Exclude<R, Crypto.Crypto>, CurrentSqlCommit>, CurrentCommitJournal>, import("effect/sql/SqlClient").SqlClient>, import("@yielded/auth/Hooks").LifecycleHooks>> | Effect.Effect<A, M.PasskeyUnavailable, Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<R, Crypto.Crypto>, CurrentSqlCommit>, CurrentCommitJournal>, import("effect/sql/SqlClient").SqlClient>, import("@yielded/auth/Hooks").LifecycleHooks>, SqlBatchCommit>>;
+  run: <A, E, R>(effect: Effect.Effect<A, E, R>, mode?: "transaction" | "statement") => never;
   advisory: <A, E, R>(effect: Effect.Effect<A, E, R>) => Effect.Effect<A, M.PasskeyUnavailable, Exclude<Exclude<Exclude<R, Crypto.Crypto>, import("effect/sql/SqlClient").SqlClient>, import("@yielded/auth/Hooks").LifecycleHooks>>;
   passkeyPersistence: {
     readonly issue: <A>(input: {
@@ -816,7 +824,7 @@ export declare const makeBatchPasskeyServices: (tables: NativeSqlTables, mapping
       readonly protocolCredentialId: M.PasskeyProtocolCredentialId;
     }) => Effect.Effect<M.PasskeyCredential | undefined, M.PasskeyUnavailable>;
   };
-}, never, Crypto.Crypto | import("@yielded/auth/Hooks").LifecycleHooks | SqlBatchCommit | import("effect/sql/SqlClient").SqlClient>;
+}, M.PasskeyUnavailable, Crypto.Crypto | import("@yielded/auth/Hooks").LifecycleHooks | SqlBatchCommit | import("effect/sql/SqlClient").SqlClient>;
 export type NativePasskeyServices = Effect.Success<ReturnType<typeof makeNativePasskeyServices>>;
 export declare const makeNativePasskeyCredentialServices: (tables: NativeSqlTables, mapping: PasskeyNativeRead) => Effect.Effect<{
   passkeyCredentials: {
@@ -830,6 +838,6 @@ export declare const makeNativePasskeyCredentialServices: (tables: NativeSqlTabl
       readonly protocolCredentialId: M.PasskeyProtocolCredentialId;
     }) => Effect.Effect<M.PasskeyCredential | undefined, M.PasskeyUnavailable>;
   };
-}, never, Crypto.Crypto | import("@yielded/auth/Hooks").LifecycleHooks | import("effect/sql/SqlClient").SqlClient>;
+}, M.PasskeyUnavailable, Crypto.Crypto | import("@yielded/auth/Hooks").LifecycleHooks | import("effect/sql/SqlClient").SqlClient>;
 //#endregion
 //# sourceMappingURL=passkey-native.d.mts.map

package/dist/internal/passkey-native.mjs

@@ -7,6 +7,7 @@ import { makePasskeyNativeReadState, makePasskeyNativeState, passkeyNativeInvari
 import { Crypto, Effect, Option, Schema } from "effect";
 import { CurrentCommitJournal } from "@yielded/auth/Hooks";
 import * as M from "@yielded/auth/Passkey";
+import { AuthenticationClock } from "@yielded/auth/Operations";
 import { SqlError } from "effect/sql/SqlError";
 //#region src/internal/passkey-native.ts
 const unavailable = () => M.PasskeyUnavailable.make({});
@@ -24,7 +25,7 @@ const services = Effect.fnUntraced(function* (tables, mapping, batch) {
 	const { sql, ceremony: flow, credential } = state;
 	const read = mapping.read;
 	const provide = (effect) => Effect.provideService(effect, Crypto.Crypto, crypto);
-	const run = (effect, mode = "transaction") => batch === void 0 ? executor.run(provide(effect), mode) : executor.batch(provide(effect)).pipe(Effect.provideService(SqlBatchCommit, batch));
+	const run = (effect, mode = "transaction") => (batch === void 0 ? executor.run(provide(effect), mode) : executor.batch(provide(effect)).pipe(Effect.provideService(SqlBatchCommit, batch))).pipe(Effect.provideService(AuthenticationClock, state.clockPolicy));
 	const advisory = (effect) => executor.read(provide(effect));
 	const issue = (original, prepare) => run(Effect.gen(function* () {
 		const ceremony = M.snapshotPasskeySync(passkeyOperationInputs.issue, original).ceremony;

package/dist/internal/passkey-native.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"passkey-native.mjs","names":[],"sources":["../../src/internal/passkey-native.ts"],"sourcesContent":["import { CurrentCommitJournal } from \"@yielded/auth/Hooks\";\nimport * as M from \"@yielded/auth/Passkey\";\nimport { Crypto, Effect, Option, Schema } from \"effect\";\nimport { SqlError } from \"effect/sql/SqlError\";\n\nimport { sqlBatchAssertion } from \"./d1-planning\";\nimport type { NativeSqlTables } from \"./native-sql-table\";\nimport { passkeyOperationInputs } from \"./passkey-inputs\";\nimport {\n  makePasskeyNativeReadState,\n  makePasskeyNativeState,\n  passkeyNativeInvariant,\n  type PasskeyNativeMapping,\n  type PasskeyNativeRead,\n  type PasskeyNativeReadState,\n} from \"./passkey-native-state\";\nimport {\n  passkeyAssertionPurposes,\n  passkeyCredentialKey,\n  passkeyMatchesAccess,\n  validPasskeyCeremony,\n} from \"./passkey-policy\";\nimport { exactSqlText } from \"./sql-change\";\nimport {\n  CurrentSqlCommit,\n  makeSqlCommitExecutor,\n  registerSqlCommitReceipt,\n  registerSqlPostcondition,\n  registerSqlBatchPostcondition,\n  SqlBatchCommit,\n} from \"./sql-commit\";\n\nconst unavailable = () => M.PasskeyUnavailable.make({});\n\nexport const preparePasskeyNative = <Value, A>(\n  value: Value,\n  prepare: M.PreparePasskeyCommit<Value, A>,\n) =>\n  Effect.gen(function* () {\n    const journal = yield* CurrentCommitJournal;\n\n    const receipt = prepare(value, journal);\n\n    passkeyNativeInvariant(receipt?._tag === \"PreparedCommit\" && Effect.isEffect(receipt.read));\n    yield* registerSqlCommitReceipt(receipt);\n\n    return receipt;\n  });\n\nconst services = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: PasskeyNativeMapping,\n  batch?: SqlBatchCommit[\"Service\"],\n) {\n  const boundOwner = yield* Effect.serviceOption(CurrentSqlCommit);\n  const state = yield* makePasskeyNativeState(tables, mapping);\n  const executor = yield* makeSqlCommitExecutor(unavailable);\n  const crypto = yield* Crypto.Crypto;\n  const { sql, ceremony: flow, credential } = state;\n  const read = mapping.read;\n\n  const provide = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n    Effect.provideService(effect, Crypto.Crypto, crypto);\n\n  const run = <A, E, R>(\n    effect: Effect.Effect<A, E, R>,\n    mode: \"transaction\" | \"statement\" = \"transaction\",\n  ) =>\n    batch === undefined\n      ? executor.run(provide(effect), mode)\n      : executor.batch(provide(effect)).pipe(Effect.provideService(SqlBatchCommit, batch));\n\n  const advisory = <A, E, R>(effect: Effect.Effect<A, E, R>) => executor.read(provide(effect));\n\n  const issue: M.PasskeyPersistence[\"Service\"][\"issue\"] = (original, prepare) =>\n    run(\n      Effect.gen(function* () {\n        const input = M.snapshotPasskeySync(passkeyOperationInputs.issue, original);\n        const ceremony = input.ceremony;\n\n        if (\n          !flow.validModule(ceremony.moduleId) ||\n          !validPasskeyCeremony(ceremony) ||\n          ceremony.purpose === \"registration\"\n        )\n          return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n        const statement = flow.insert(ceremony);\n        let changed: number;\n\n        if (batch !== undefined) {\n          yield* flow.stage(statement, 1);\n          changed = 1;\n        } else {\n          changed = yield* flow.change(statement).pipe(\n            Effect.catchIf(\n              (error) => Schema.is(SqlError)(error) && error.reason._tag === \"UniqueViolation\",\n              () => Effect.succeed(0),\n            ),\n          );\n        }\n\n        return yield* preparePasskeyNative(\n          changed === 1 ? { _tag: \"Issued\", ceremony } : { _tag: \"Rejected\" },\n          prepare,\n        );\n      }),\n      \"statement\",\n    );\n\n  const persistence: M.PasskeyPersistence[\"Service\"] = {\n    issue,\n    context: (original) =>\n      advisory(\n        Effect.suspend(() => flow.context(M.snapshotPasskeySync(M.PasskeyAccess, original))),\n      ),\n    consume: (original, prepare) =>\n      run(\n        Effect.gen(function* () {\n          const input = M.snapshotPasskeySync(passkeyOperationInputs.consume, original);\n          const captured = input.credential;\n\n          const revision = captured.revision.credentials.find(\n            (entry) => entry.credentialId === captured.credentialId,\n          );\n\n          const assertion = input.assertion;\n\n          if (\n            !flow.validModule(input.access.moduleId) ||\n            !passkeyMatchesAccess(input.ceremony, input.access) ||\n            !passkeyAssertionPurposes.some((purpose) => purpose === input.ceremony.purpose) ||\n            !validPasskeyCeremony(input.ceremony) ||\n            revision === undefined ||\n            !captured.active ||\n            captured.rpId !== input.ceremony.profile.rpId ||\n            assertion.protocolCredentialId !== captured.protocolCredentialId ||\n            assertion.backupEligible !== captured.backupEligible ||\n            (assertion.userHandle !== undefined && assertion.userHandle !== captured.userHandle)\n          )\n            return yield* preparePasskeyNative(\"Rejected\", prepare);\n          const consumed = flow.consume(input.access, input.ceremony);\n\n          if (batch === undefined) {\n            if ((yield* flow.change(consumed)) !== 1)\n              return yield* preparePasskeyNative(\"Rejected\", prepare);\n          } else yield* flow.stage(consumed, 1);\n          const key = yield* passkeyCredentialKey(captured.rpId, captured.protocolCredentialId);\n\n          const exact = (column: string, value: unknown) =>\n            exactSqlText(sql, credential.column(column), credential.value(column, value));\n\n          const counter = credential.column(read.credential.counter);\n          const next = credential.value(read.credential.counter, assertion.counter);\n\n          const merged = captured.backupEligible\n            ? sql`case when ${counter} > ${next} then ${counter} else ${next} end`\n            : next;\n\n          const identity = [\n            exact(read.credential.credentialId, captured.credentialId),\n            exact(read.credential.credentialKey, key),\n            exact(read.credential.credentialRevision, revision.revision),\n            sql`${credential.column(read.credential.backupEligible)} = ${credential.value(read.credential.backupEligible, mapping.telemetry.encodeBackupEligible(captured.backupEligible))}`,\n            state.active(\"credential\"),\n          ];\n\n          const statement = sql`${credential.update({\n            [read.credential.counter]: merged,\n            [read.credential.backupState]: mapping.telemetry.encodeBackupState(\n              assertion.backupState,\n            ),\n            [mapping.telemetry.lastUsedAt]: state.storedNow,\n          })} where ${sql.and([\n            ...identity,\n            captured.backupEligible\n              ? sql`true`\n              : sql`((${counter} = 0 and ${next} = 0) or ${counter} < ${next})`,\n          ])}`;\n\n          let changed: number;\n\n          if (batch === undefined) {\n            changed = yield* flow.change(statement);\n            if (\n              changed === 0 &&\n              sql.onDialectOrElse({ mysql: () => true, orElse: () => false }) &&\n              (captured.backupEligible || assertion.counter === 0)\n            ) {\n              // mysql2 can disable FOUND_ROWS. The UPDATE still holds the row lock;\n              // prove the unchanged telemetry matched this exact semantic key.\n              const matched =\n                yield* sql`select 1 as matched from ${credential.name} where ${sql.and(identity)} and ${captured.backupEligible ? sql`${counter} >= ${next}` : sql`${counter} = 0`} and ${credential.column(read.credential.backupState)} = ${credential.value(read.credential.backupState, mapping.telemetry.encodeBackupState(assertion.backupState))}`;\n\n              if (matched.length === 1) changed = 1;\n            }\n          } else {\n            yield* flow.stage(statement, 1);\n            changed = 1;\n          }\n\n          if (Option.isSome(boundOwner)) {\n            // Protect the accepted result from later bound application SQL. BE\n            // retains the observed accepted floor; it does not compare an entire\n            // telemetry snapshot or reject valid out-of-order assertions.\n            const acceptedCounter = captured.backupEligible\n              ? sql`${counter} >= ${credential.value(read.credential.counter, Math.max(captured.counter, assertion.counter))}`\n              : sql`${counter} = ${next}`;\n\n            const condition = sql.and([\n              flow.absent(input.access),\n              changed === 1\n                ? sql`exists(select 1 from ${credential.name} where ${sql.and(identity)} and ${acceptedCounter}\n                    and ${credential.column(read.credential.backupState)} = ${credential.value(read.credential.backupState, mapping.telemetry.encodeBackupState(assertion.backupState))})`\n                : sql`true`,\n            ]);\n\n            if (batch === undefined) {\n              yield* registerSqlPostcondition({\n                name: \"passkey-consume-preserved\",\n                check: Effect.gen(function* () {\n                  const rows = yield* sql`select 1 where ${condition}`;\n\n                  passkeyNativeInvariant(rows.length === 1);\n                }),\n              });\n            } else {\n              yield* registerSqlBatchPostcondition({\n                name: \"passkey-consume-preserved\",\n                statement: sqlBatchAssertion(sql, condition),\n              });\n            }\n          }\n\n          return yield* preparePasskeyNative(changed === 1 ? \"Verified\" : \"Rejected\", prepare);\n        }),\n      ),\n    cleanup: (original, prepare) =>\n      run(\n        Effect.gen(function* () {\n          const input = M.snapshotPasskeySync(passkeyOperationInputs.cleanup, original);\n\n          passkeyNativeInvariant(flow.validModule(input.moduleId));\n\n          return yield* preparePasskeyNative(\n            yield* flow.cleanup(input.moduleId, input.limit, batch !== undefined),\n            prepare,\n          );\n        }),\n        \"statement\",\n      ),\n  };\n\n  const credentials = makePasskeyNativeCredentialService(state, read, advisory);\n\n  return {\n    batch: batch !== undefined,\n    state,\n    executor,\n    run,\n    advisory,\n    passkeyPersistence: persistence,\n    passkeyCredentials: credentials,\n  };\n});\n\nexport const makeNativePasskeyServices = (tables: NativeSqlTables, mapping: PasskeyNativeMapping) =>\n  services(tables, mapping);\n\nexport const makeBatchPasskeyServices = (tables: NativeSqlTables, mapping: PasskeyNativeMapping) =>\n  Effect.flatMap(SqlBatchCommit, (batch) => services(tables, mapping, batch));\n\nexport type NativePasskeyServices = Effect.Success<ReturnType<typeof makeNativePasskeyServices>>;\n\nconst makePasskeyNativeCredentialService = (\n  state: PasskeyNativeReadState,\n  read: PasskeyNativeRead,\n  advisory: <A, E, R>(\n    effect: Effect.Effect<A, E, R>,\n  ) => Effect.Effect<\n    A,\n    M.PasskeyUnavailable,\n    Exclude<\n      Exclude<Exclude<R, Crypto.Crypto>, import(\"effect/sql/SqlClient\").SqlClient>,\n      import(\"@yielded/auth/Hooks\").LifecycleHooks\n    >\n  >,\n) => {\n  const { sql, joinedSubject: subject, joinedFactor: factor, joinedCredential: credential } = state;\n\n  const credentials: M.PasskeyCredentials[\"Service\"] = {\n    lookup: (original) =>\n      advisory(\n        Effect.gen(function* () {\n          const input = M.snapshotPasskeySync(passkeyOperationInputs.lookup, original);\n\n          return yield* state.lookup(input.rpId, input.protocolCredentialId);\n        }),\n      ),\n    listForSubject: (original) =>\n      advisory(\n        Effect.gen(function* () {\n          const input = M.snapshotPasskeySync(passkeyOperationInputs.listForSubject, original);\n\n          const nativeId = state.native(input.subjectId);\n\n          const rows =\n            yield* sql`select ${subject.fields(\"s_\")}, ${factor.fields(\"f_\")}, ${credential.fields(\"c_\")}\n        from ${state.selected(\"subject\", \"passkey_subject\")}\n        left join ${state.selected(\"authority\", \"passkey_factor\")} on ${factor.column(read.authority.subjectId)} = ${factor.value(read.authority.subjectId, nativeId)}\n        left join ${state.selected(\"credential\", \"passkey_credential\")} on ${credential.column(read.credential.subjectId)} = ${credential.value(read.credential.subjectId, nativeId)} and ${credential.column(read.credential.rpId)} = ${credential.value(read.credential.rpId, input.rpId)}\n        where ${subject.column(read.subject.id)} = ${subject.value(read.subject.id, nativeId)} limit 4097`;\n\n          if (rows.length === 0 || rows.length > 4096) return undefined;\n          const subjectRow = subject.decode(rows[0]!, \"s_\");\n\n          passkeyNativeInvariant(\n            rows.every((selected) => {\n              const other = subject.decode(selected, \"s_\");\n\n              return (\n                state.sameId(read.subject.decodeId(other), nativeId) &&\n                other[read.subject.securityRevision] === subjectRow[read.subject.securityRevision]\n              );\n            }),\n          );\n\n          const revision = state.revision(\n            subjectRow,\n            rows.map((row) => factor.decode(row, \"f_\")),\n          );\n\n          passkeyNativeInvariant(revision.subjectId === input.subjectId);\n          const values = new Map<string, M.PasskeyCredential>();\n\n          for (const selected of rows) {\n            const row = credential.decode(selected, \"c_\");\n\n            if (row[read.credential.credentialId] === null) continue;\n            const decoded = yield* state.decodeCredential(row, revision, subjectRow);\n\n            if (decoded !== undefined) values.set(decoded.credentialId, decoded);\n          }\n          const userHandle = values.values().next().value?.userHandle;\n\n          return M.snapshotPasskeySync(M.PasskeyEnrollmentSnapshot, {\n            revision,\n            ...(userHandle === undefined ? {} : { userHandle }),\n            credentials: [...values.values()].map((value) => ({\n              type: \"public-key\" as const,\n              id: value.protocolCredentialId,\n            })),\n          });\n        }),\n      ),\n  };\n\n  return credentials;\n};\n\nexport const makeNativePasskeyCredentialServices = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: PasskeyNativeRead,\n) {\n  const state = yield* makePasskeyNativeReadState(tables, mapping);\n  const executor = yield* makeSqlCommitExecutor(unavailable);\n  const crypto = yield* Crypto.Crypto;\n\n  const advisory = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n    executor.read(Effect.provideService(effect, Crypto.Crypto, crypto));\n\n  return { passkeyCredentials: makePasskeyNativeCredentialService(state, mapping, advisory) };\n});\n"],"mappings":";;;;;;;;;;;AAgCA,MAAM,oBAAoB,EAAE,mBAAmB,KAAK,CAAC,CAAC;AAEtD,MAAa,wBACX,OACA,YAEA,OAAO,IAAI,aAAa;CAGtB,MAAM,UAAU,QAAQ,OAAO,OAFR,oBAEe;CAEtC,uBAAuB,SAAS,SAAS,oBAAoB,OAAO,SAAS,QAAQ,IAAI,CAAC;CAC1F,OAAO,yBAAyB,OAAO;CAEvC,OAAO;AACT,CAAC;AAEH,MAAM,WAAW,OAAO,WAAW,WACjC,QACA,SACA,OACA;CACA,MAAM,aAAa,OAAO,OAAO,cAAc,gBAAgB;CAC/D,MAAM,QAAQ,OAAO,uBAAuB,QAAQ,OAAO;CAC3D,MAAM,WAAW,OAAO,sBAAsB,WAAW;CACzD,MAAM,SAAS,OAAO,OAAO;CAC7B,MAAM,EAAE,KAAK,UAAU,MAAM,eAAe;CAC5C,MAAM,OAAO,QAAQ;CAErB,MAAM,WAAoB,WACxB,OAAO,eAAe,QAAQ,OAAO,QAAQ,MAAM;CAErD,MAAM,OACJ,QACA,OAAoC,kBAEpC,UAAU,KAAA,IACN,SAAS,IAAI,QAAQ,MAAM,GAAG,IAAI,IAClC,SAAS,MAAM,QAAQ,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CAEvF,MAAM,YAAqB,WAAmC,SAAS,KAAK,QAAQ,MAAM,CAAC;CAE3F,MAAM,SAAmD,UAAU,YACjE,IACE,OAAO,IAAI,aAAa;EAEtB,MAAM,WADQ,EAAE,oBAAoB,uBAAuB,OAAO,QAC7C,CAAC,CAAC;EAEvB,IACE,CAAC,KAAK,YAAY,SAAS,QAAQ,KACnC,CAAC,qBAAqB,QAAQ,KAC9B,SAAS,YAAY,gBAErB,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;EAClE,MAAM,YAAY,KAAK,OAAO,QAAQ;EACtC,IAAI;EAEJ,IAAI,UAAU,KAAA,GAAW;GACvB,OAAO,KAAK,MAAM,WAAW,CAAC;GAC9B,UAAU;EACZ,OACE,UAAU,OAAO,KAAK,OAAO,SAAS,CAAC,CAAC,KACtC,OAAO,SACJ,UAAU,OAAO,GAAG,QAAQ,CAAC,CAAC,KAAK,KAAK,MAAM,OAAO,SAAS,yBACzD,OAAO,QAAQ,CAAC,CACxB,CACF;EAGF,OAAO,OAAO,qBACZ,YAAY,IAAI;GAAE,MAAM;GAAU;EAAS,IAAI,EAAE,MAAM,WAAW,GAClE,OACF;CACF,CAAC,GACD,WACF;CAEF,MAAM,cAA+C;EACnD;EACA,UAAU,aACR,SACE,OAAO,cAAc,KAAK,QAAQ,EAAE,oBAAoB,EAAE,eAAe,QAAQ,CAAC,CAAC,CACrF;EACF,UAAU,UAAU,YAClB,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,oBAAoB,uBAAuB,SAAS,QAAQ;GAC5E,MAAM,WAAW,MAAM;GAEvB,MAAM,WAAW,SAAS,SAAS,YAAY,MAC5C,UAAU,MAAM,iBAAiB,SAAS,YAC7C;GAEA,MAAM,YAAY,MAAM;GAExB,IACE,CAAC,KAAK,YAAY,MAAM,OAAO,QAAQ,KACvC,CAAC,qBAAqB,MAAM,UAAU,MAAM,MAAM,KAClD,CAAC,yBAAyB,MAAM,YAAY,YAAY,MAAM,SAAS,OAAO,KAC9E,CAAC,qBAAqB,MAAM,QAAQ,KACpC,aAAa,KAAA,KACb,CAAC,SAAS,UACV,SAAS,SAAS,MAAM,SAAS,QAAQ,QACzC,UAAU,yBAAyB,SAAS,wBAC5C,UAAU,mBAAmB,SAAS,kBACrC,UAAU,eAAe,KAAA,KAAa,UAAU,eAAe,SAAS,YAEzE,OAAO,OAAO,qBAAqB,YAAY,OAAO;GACxD,MAAM,WAAW,KAAK,QAAQ,MAAM,QAAQ,MAAM,QAAQ;GAE1D,IAAI,UAAU,KAAA,GACP;SAAA,OAAO,KAAK,OAAO,QAAQ,OAAO,GACrC,OAAO,OAAO,qBAAqB,YAAY,OAAO;GAAA,OACnD,OAAO,KAAK,MAAM,UAAU,CAAC;GACpC,MAAM,MAAM,OAAO,qBAAqB,SAAS,MAAM,SAAS,oBAAoB;GAEpF,MAAM,SAAS,QAAgB,UAC7B,aAAa,KAAK,WAAW,OAAO,MAAM,GAAG,WAAW,MAAM,QAAQ,KAAK,CAAC;GAE9E,MAAM,UAAU,WAAW,OAAO,KAAK,WAAW,OAAO;GACzD,MAAM,OAAO,WAAW,MAAM,KAAK,WAAW,SAAS,UAAU,OAAO;GAExE,MAAM,SAAS,SAAS,iBACpB,GAAG,aAAa,QAAQ,KAAK,KAAK,QAAQ,QAAQ,QAAQ,KAAK,QAC/D;GAEJ,MAAM,WAAW;IACf,MAAM,KAAK,WAAW,cAAc,SAAS,YAAY;IACzD,MAAM,KAAK,WAAW,eAAe,GAAG;IACxC,MAAM,KAAK,WAAW,oBAAoB,SAAS,QAAQ;IAC3D,GAAG,GAAG,WAAW,OAAO,KAAK,WAAW,cAAc,EAAE,KAAK,WAAW,MAAM,KAAK,WAAW,gBAAgB,QAAQ,UAAU,qBAAqB,SAAS,cAAc,CAAC;IAC7K,MAAM,OAAO,YAAY;GAC3B;GAEA,MAAM,YAAY,GAAG,GAAG,WAAW,OAAO;KACvC,KAAK,WAAW,UAAU;KAC1B,KAAK,WAAW,cAAc,QAAQ,UAAU,kBAC/C,UAAU,WACZ;KACC,QAAQ,UAAU,aAAa,MAAM;GACxC,CAAC,EAAE,SAAS,IAAI,IAAI,CAClB,GAAG,UACH,SAAS,iBACL,GAAG,SACH,GAAG,KAAK,QAAQ,WAAW,KAAK,WAAW,QAAQ,KAAK,KAAK,EACnE,CAAC;GAED,IAAI;GAEJ,IAAI,UAAU,KAAA,GAAW;IACvB,UAAU,OAAO,KAAK,OAAO,SAAS;IACtC,IACE,YAAY,KACZ,IAAI,gBAAgB;KAAE,aAAa;KAAM,cAAc;IAAM,CAAC,MAC7D,SAAS,kBAAkB,UAAU,YAAY,IAO9C;UAAA,OAFK,GAAG,4BAA4B,WAAW,KAAK,SAAS,IAAI,IAAI,QAAQ,EAAE,OAAO,SAAS,iBAAiB,GAAG,GAAG,QAAQ,MAAM,SAAS,GAAG,GAAG,QAAQ,MAAM,OAAO,WAAW,OAAO,KAAK,WAAW,WAAW,EAAE,KAAK,WAAW,MAAM,KAAK,WAAW,aAAa,QAAQ,UAAU,kBAAkB,UAAU,WAAW,CAAC,IAAA,CAE5T,WAAW,GAAG,UAAU;IAAA;GAExC,OAAO;IACL,OAAO,KAAK,MAAM,WAAW,CAAC;IAC9B,UAAU;GACZ;GAEA,IAAI,OAAO,OAAO,UAAU,GAAG;IAI7B,MAAM,kBAAkB,SAAS,iBAC7B,GAAG,GAAG,QAAQ,MAAM,WAAW,MAAM,KAAK,WAAW,SAAS,KAAK,IAAI,SAAS,SAAS,UAAU,OAAO,CAAC,MAC3G,GAAG,GAAG,QAAQ,KAAK;IAEvB,MAAM,YAAY,IAAI,IAAI,CACxB,KAAK,OAAO,MAAM,MAAM,GACxB,YAAY,IACR,GAAG,wBAAwB,WAAW,KAAK,SAAS,IAAI,IAAI,QAAQ,EAAE,OAAO,gBAAgB;0BACrF,WAAW,OAAO,KAAK,WAAW,WAAW,EAAE,KAAK,WAAW,MAAM,KAAK,WAAW,aAAa,QAAQ,UAAU,kBAAkB,UAAU,WAAW,CAAC,EAAE,KACtK,GAAG,MACT,CAAC;IAED,IAAI,UAAU,KAAA,GACZ,OAAO,yBAAyB;KAC9B,MAAM;KACN,OAAO,OAAO,IAAI,aAAa;MAC7B,MAAM,OAAO,OAAO,GAAG,kBAAkB;MAEzC,uBAAuB,KAAK,WAAW,CAAC;KAC1C,CAAC;IACH,CAAC;SAED,OAAO,8BAA8B;KACnC,MAAM;KACN,WAAW,kBAAkB,KAAK,SAAS;IAC7C,CAAC;GAEL;GAEA,OAAO,OAAO,qBAAqB,YAAY,IAAI,aAAa,YAAY,OAAO;EACrF,CAAC,CACH;EACF,UAAU,UAAU,YAClB,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,oBAAoB,uBAAuB,SAAS,QAAQ;GAE5E,uBAAuB,KAAK,YAAY,MAAM,QAAQ,CAAC;GAEvD,OAAO,OAAO,qBACZ,OAAO,KAAK,QAAQ,MAAM,UAAU,MAAM,OAAO,UAAU,KAAA,CAAS,GACpE,OACF;EACF,CAAC,GACD,WACF;CACJ;CAEA,MAAM,cAAc,mCAAmC,OAAO,MAAM,QAAQ;CAE5E,OAAO;EACL,OAAO,UAAU,KAAA;EACjB;EACA;EACA;EACA;EACA,oBAAoB;EACpB,oBAAoB;CACtB;AACF,CAAC;AAED,MAAa,6BAA6B,QAAyB,YACjE,SAAS,QAAQ,OAAO;AAE1B,MAAa,4BAA4B,QAAyB,YAChE,OAAO,QAAQ,iBAAiB,UAAU,SAAS,QAAQ,SAAS,KAAK,CAAC;AAI5E,MAAM,sCACJ,OACA,MACA,aAUG;CACH,MAAM,EAAE,KAAK,eAAe,SAAS,cAAc,QAAQ,kBAAkB,eAAe;CAqE5F,OAAO;EAlEL,SAAS,aACP,SACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,oBAAoB,uBAAuB,QAAQ,QAAQ;GAE3E,OAAO,OAAO,MAAM,OAAO,MAAM,MAAM,MAAM,oBAAoB;EACnE,CAAC,CACH;EACF,iBAAiB,aACf,SACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,oBAAoB,uBAAuB,gBAAgB,QAAQ;GAEnF,MAAM,WAAW,MAAM,OAAO,MAAM,SAAS;GAE7C,MAAM,OACJ,OAAO,GAAG,UAAU,QAAQ,OAAO,IAAI,EAAE,IAAI,OAAO,OAAO,IAAI,EAAE,IAAI,WAAW,OAAO,IAAI,EAAE;eAC1F,MAAM,SAAS,WAAW,iBAAiB,EAAE;oBACxC,MAAM,SAAS,aAAa,gBAAgB,EAAE,MAAM,OAAO,OAAO,KAAK,UAAU,SAAS,EAAE,KAAK,OAAO,MAAM,KAAK,UAAU,WAAW,QAAQ,EAAE;oBAClJ,MAAM,SAAS,cAAc,oBAAoB,EAAE,MAAM,WAAW,OAAO,KAAK,WAAW,SAAS,EAAE,KAAK,WAAW,MAAM,KAAK,WAAW,WAAW,QAAQ,EAAE,OAAO,WAAW,OAAO,KAAK,WAAW,IAAI,EAAE,KAAK,WAAW,MAAM,KAAK,WAAW,MAAM,MAAM,IAAI,EAAE;gBAC5Q,QAAQ,OAAO,KAAK,QAAQ,EAAE,EAAE,KAAK,QAAQ,MAAM,KAAK,QAAQ,IAAI,QAAQ,EAAE;GAEpF,IAAI,KAAK,WAAW,KAAK,KAAK,SAAS,MAAM,OAAO,KAAA;GACpD,MAAM,aAAa,QAAQ,OAAO,KAAK,IAAK,IAAI;GAEhD,uBACE,KAAK,OAAO,aAAa;IACvB,MAAM,QAAQ,QAAQ,OAAO,UAAU,IAAI;IAE3C,OACE,MAAM,OAAO,KAAK,QAAQ,SAAS,KAAK,GAAG,QAAQ,KACnD,MAAM,KAAK,QAAQ,sBAAsB,WAAW,KAAK,QAAQ;GAErE,CAAC,CACH;GAEA,MAAM,WAAW,MAAM,SACrB,YACA,KAAK,KAAK,QAAQ,OAAO,OAAO,KAAK,IAAI,CAAC,CAC5C;GAEA,uBAAuB,SAAS,cAAc,MAAM,SAAS;GAC7D,MAAM,yBAAS,IAAI,IAAiC;GAEpD,KAAK,MAAM,YAAY,MAAM;IAC3B,MAAM,MAAM,WAAW,OAAO,UAAU,IAAI;IAE5C,IAAI,IAAI,KAAK,WAAW,kBAAkB,MAAM;IAChD,MAAM,UAAU,OAAO,MAAM,iBAAiB,KAAK,UAAU,UAAU;IAEvE,IAAI,YAAY,KAAA,GAAW,OAAO,IAAI,QAAQ,cAAc,OAAO;GACrE;GACA,MAAM,aAAa,OAAO,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO;GAEjD,OAAO,EAAE,oBAAoB,EAAE,2BAA2B;IACxD;IACA,GAAI,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW;IACjD,aAAa,CAAC,GAAG,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,WAAW;KAChD,MAAM;KACN,IAAI,MAAM;IACZ,EAAE;GACJ,CAAC;EACH,CAAC,CACH;CAGa;AACnB;AAEA,MAAa,sCAAsC,OAAO,WAAW,WACnE,QACA,SACA;CACA,MAAM,QAAQ,OAAO,2BAA2B,QAAQ,OAAO;CAC/D,MAAM,WAAW,OAAO,sBAAsB,WAAW;CACzD,MAAM,SAAS,OAAO,OAAO;CAE7B,MAAM,YAAqB,WACzB,SAAS,KAAK,OAAO,eAAe,QAAQ,OAAO,QAAQ,MAAM,CAAC;CAEpE,OAAO,EAAE,oBAAoB,mCAAmC,OAAO,SAAS,QAAQ,EAAE;AAC5F,CAAC"}
+{"version":3,"file":"passkey-native.mjs","names":[],"sources":["../../src/internal/passkey-native.ts"],"sourcesContent":["import { CurrentCommitJournal } from \"@yielded/auth/Hooks\";\nimport { AuthenticationClock } from \"@yielded/auth/Operations\";\nimport * as M from \"@yielded/auth/Passkey\";\nimport { Crypto, Effect, Option, Schema } from \"effect\";\nimport { SqlError } from \"effect/sql/SqlError\";\n\nimport { sqlBatchAssertion } from \"./d1-planning\";\nimport type { NativeSqlTables } from \"./native-sql-table\";\nimport { passkeyOperationInputs } from \"./passkey-inputs\";\nimport {\n  makePasskeyNativeReadState,\n  makePasskeyNativeState,\n  passkeyNativeInvariant,\n  type PasskeyNativeMapping,\n  type PasskeyNativeRead,\n  type PasskeyNativeReadState,\n} from \"./passkey-native-state\";\nimport {\n  passkeyAssertionPurposes,\n  passkeyCredentialKey,\n  passkeyMatchesAccess,\n  validPasskeyCeremony,\n} from \"./passkey-policy\";\nimport { exactSqlText } from \"./sql-change\";\nimport {\n  CurrentSqlCommit,\n  makeSqlCommitExecutor,\n  registerSqlCommitReceipt,\n  registerSqlPostcondition,\n  registerSqlBatchPostcondition,\n  SqlBatchCommit,\n} from \"./sql-commit\";\n\nconst unavailable = () => M.PasskeyUnavailable.make({});\n\nexport const preparePasskeyNative = <Value, A>(\n  value: Value,\n  prepare: M.PreparePasskeyCommit<Value, A>,\n) =>\n  Effect.gen(function* () {\n    const journal = yield* CurrentCommitJournal;\n\n    const receipt = prepare(value, journal);\n\n    passkeyNativeInvariant(receipt?._tag === \"PreparedCommit\" && Effect.isEffect(receipt.read));\n    yield* registerSqlCommitReceipt(receipt);\n\n    return receipt;\n  });\n\nconst services = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: PasskeyNativeMapping,\n  batch?: SqlBatchCommit[\"Service\"],\n) {\n  const boundOwner = yield* Effect.serviceOption(CurrentSqlCommit);\n  const state = yield* makePasskeyNativeState(tables, mapping);\n  const executor = yield* makeSqlCommitExecutor(unavailable);\n  const crypto = yield* Crypto.Crypto;\n  const { sql, ceremony: flow, credential } = state;\n  const read = mapping.read;\n\n  const provide = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n    Effect.provideService(effect, Crypto.Crypto, crypto);\n\n  const run = <A, E, R>(\n    effect: Effect.Effect<A, E, R>,\n    mode: \"transaction\" | \"statement\" = \"transaction\",\n  ) =>\n    (batch === undefined\n      ? executor.run(provide(effect), mode)\n      : executor.batch(provide(effect)).pipe(Effect.provideService(SqlBatchCommit, batch))\n    ).pipe(Effect.provideService(AuthenticationClock, state.clockPolicy));\n\n  const advisory = <A, E, R>(effect: Effect.Effect<A, E, R>) => executor.read(provide(effect));\n\n  const issue: M.PasskeyPersistence[\"Service\"][\"issue\"] = (original, prepare) =>\n    run(\n      Effect.gen(function* () {\n        const input = M.snapshotPasskeySync(passkeyOperationInputs.issue, original);\n        const ceremony = input.ceremony;\n\n        if (\n          !flow.validModule(ceremony.moduleId) ||\n          !validPasskeyCeremony(ceremony) ||\n          ceremony.purpose === \"registration\"\n        )\n          return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n        const statement = flow.insert(ceremony);\n        let changed: number;\n\n        if (batch !== undefined) {\n          yield* flow.stage(statement, 1);\n          changed = 1;\n        } else {\n          changed = yield* flow.change(statement).pipe(\n            Effect.catchIf(\n              (error) => Schema.is(SqlError)(error) && error.reason._tag === \"UniqueViolation\",\n              () => Effect.succeed(0),\n            ),\n          );\n        }\n\n        return yield* preparePasskeyNative(\n          changed === 1 ? { _tag: \"Issued\", ceremony } : { _tag: \"Rejected\" },\n          prepare,\n        );\n      }),\n      \"statement\",\n    );\n\n  const persistence: M.PasskeyPersistence[\"Service\"] = {\n    issue,\n    context: (original) =>\n      advisory(\n        Effect.suspend(() => flow.context(M.snapshotPasskeySync(M.PasskeyAccess, original))),\n      ),\n    consume: (original, prepare) =>\n      run(\n        Effect.gen(function* () {\n          const input = M.snapshotPasskeySync(passkeyOperationInputs.consume, original);\n          const captured = input.credential;\n\n          const revision = captured.revision.credentials.find(\n            (entry) => entry.credentialId === captured.credentialId,\n          );\n\n          const assertion = input.assertion;\n\n          if (\n            !flow.validModule(input.access.moduleId) ||\n            !passkeyMatchesAccess(input.ceremony, input.access) ||\n            !passkeyAssertionPurposes.some((purpose) => purpose === input.ceremony.purpose) ||\n            !validPasskeyCeremony(input.ceremony) ||\n            revision === undefined ||\n            !captured.active ||\n            captured.rpId !== input.ceremony.profile.rpId ||\n            assertion.protocolCredentialId !== captured.protocolCredentialId ||\n            assertion.backupEligible !== captured.backupEligible ||\n            (assertion.userHandle !== undefined && assertion.userHandle !== captured.userHandle)\n          )\n            return yield* preparePasskeyNative(\"Rejected\", prepare);\n          const consumed = flow.consume(input.access, input.ceremony);\n\n          if (batch === undefined) {\n            if ((yield* flow.change(consumed)) !== 1)\n              return yield* preparePasskeyNative(\"Rejected\", prepare);\n          } else yield* flow.stage(consumed, 1);\n          const key = yield* passkeyCredentialKey(captured.rpId, captured.protocolCredentialId);\n\n          const exact = (column: string, value: unknown) =>\n            exactSqlText(sql, credential.column(column), credential.value(column, value));\n\n          const counter = credential.column(read.credential.counter);\n          const next = credential.value(read.credential.counter, assertion.counter);\n\n          const merged = captured.backupEligible\n            ? sql`case when ${counter} > ${next} then ${counter} else ${next} end`\n            : next;\n\n          const identity = [\n            exact(read.credential.credentialId, captured.credentialId),\n            exact(read.credential.credentialKey, key),\n            exact(read.credential.credentialRevision, revision.revision),\n            sql`${credential.column(read.credential.backupEligible)} = ${credential.value(read.credential.backupEligible, mapping.telemetry.encodeBackupEligible(captured.backupEligible))}`,\n            state.active(\"credential\"),\n          ];\n\n          const statement = sql`${credential.update({\n            [read.credential.counter]: merged,\n            [read.credential.backupState]: mapping.telemetry.encodeBackupState(\n              assertion.backupState,\n            ),\n            [mapping.telemetry.lastUsedAt]: state.storedNow,\n          })} where ${sql.and([\n            ...identity,\n            captured.backupEligible\n              ? sql`true`\n              : sql`((${counter} = 0 and ${next} = 0) or ${counter} < ${next})`,\n          ])}`;\n\n          let changed: number;\n\n          if (batch === undefined) {\n            changed = yield* flow.change(statement);\n            if (\n              changed === 0 &&\n              sql.onDialectOrElse({ mysql: () => true, orElse: () => false }) &&\n              (captured.backupEligible || assertion.counter === 0)\n            ) {\n              // mysql2 can disable FOUND_ROWS. The UPDATE still holds the row lock;\n              // prove the unchanged telemetry matched this exact semantic key.\n              const matched =\n                yield* sql`select 1 as matched from ${credential.name} where ${sql.and(identity)} and ${captured.backupEligible ? sql`${counter} >= ${next}` : sql`${counter} = 0`} and ${credential.column(read.credential.backupState)} = ${credential.value(read.credential.backupState, mapping.telemetry.encodeBackupState(assertion.backupState))}`;\n\n              if (matched.length === 1) changed = 1;\n            }\n          } else {\n            yield* flow.stage(statement, 1);\n            changed = 1;\n          }\n\n          if (Option.isSome(boundOwner)) {\n            // Protect the accepted result from later bound application SQL. BE\n            // retains the observed accepted floor; it does not compare an entire\n            // telemetry snapshot or reject valid out-of-order assertions.\n            const acceptedCounter = captured.backupEligible\n              ? sql`${counter} >= ${credential.value(read.credential.counter, Math.max(captured.counter, assertion.counter))}`\n              : sql`${counter} = ${next}`;\n\n            const condition = sql.and([\n              flow.absent(input.access),\n              changed === 1\n                ? sql`exists(select 1 from ${credential.name} where ${sql.and(identity)} and ${acceptedCounter}\n                    and ${credential.column(read.credential.backupState)} = ${credential.value(read.credential.backupState, mapping.telemetry.encodeBackupState(assertion.backupState))})`\n                : sql`true`,\n            ]);\n\n            if (batch === undefined) {\n              yield* registerSqlPostcondition({\n                name: \"passkey-consume-preserved\",\n                check: Effect.gen(function* () {\n                  const rows = yield* sql`select 1 where ${condition}`;\n\n                  passkeyNativeInvariant(rows.length === 1);\n                }),\n              });\n            } else {\n              yield* registerSqlBatchPostcondition({\n                name: \"passkey-consume-preserved\",\n                statement: sqlBatchAssertion(sql, condition),\n              });\n            }\n          }\n\n          return yield* preparePasskeyNative(changed === 1 ? \"Verified\" : \"Rejected\", prepare);\n        }),\n      ),\n    cleanup: (original, prepare) =>\n      run(\n        Effect.gen(function* () {\n          const input = M.snapshotPasskeySync(passkeyOperationInputs.cleanup, original);\n\n          passkeyNativeInvariant(flow.validModule(input.moduleId));\n\n          return yield* preparePasskeyNative(\n            yield* flow.cleanup(input.moduleId, input.limit, batch !== undefined),\n            prepare,\n          );\n        }),\n        \"statement\",\n      ),\n  };\n\n  const credentials = makePasskeyNativeCredentialService(state, read, advisory);\n\n  return {\n    batch: batch !== undefined,\n    state,\n    executor,\n    run,\n    advisory,\n    passkeyPersistence: persistence,\n    passkeyCredentials: credentials,\n  };\n});\n\nexport const makeNativePasskeyServices = (tables: NativeSqlTables, mapping: PasskeyNativeMapping) =>\n  services(tables, mapping);\n\nexport const makeBatchPasskeyServices = (tables: NativeSqlTables, mapping: PasskeyNativeMapping) =>\n  Effect.flatMap(SqlBatchCommit, (batch) => services(tables, mapping, batch));\n\nexport type NativePasskeyServices = Effect.Success<ReturnType<typeof makeNativePasskeyServices>>;\n\nconst makePasskeyNativeCredentialService = (\n  state: PasskeyNativeReadState,\n  read: PasskeyNativeRead,\n  advisory: <A, E, R>(\n    effect: Effect.Effect<A, E, R>,\n  ) => Effect.Effect<\n    A,\n    M.PasskeyUnavailable,\n    Exclude<\n      Exclude<Exclude<R, Crypto.Crypto>, import(\"effect/sql/SqlClient\").SqlClient>,\n      import(\"@yielded/auth/Hooks\").LifecycleHooks\n    >\n  >,\n) => {\n  const { sql, joinedSubject: subject, joinedFactor: factor, joinedCredential: credential } = state;\n\n  const credentials: M.PasskeyCredentials[\"Service\"] = {\n    lookup: (original) =>\n      advisory(\n        Effect.gen(function* () {\n          const input = M.snapshotPasskeySync(passkeyOperationInputs.lookup, original);\n\n          return yield* state.lookup(input.rpId, input.protocolCredentialId);\n        }),\n      ),\n    listForSubject: (original) =>\n      advisory(\n        Effect.gen(function* () {\n          const input = M.snapshotPasskeySync(passkeyOperationInputs.listForSubject, original);\n\n          const nativeId = state.native(input.subjectId);\n\n          const rows =\n            yield* sql`select ${subject.fields(\"s_\")}, ${factor.fields(\"f_\")}, ${credential.fields(\"c_\")}\n        from ${state.selected(\"subject\", \"passkey_subject\")}\n        left join ${state.selected(\"authority\", \"passkey_factor\")} on ${factor.column(read.authority.subjectId)} = ${factor.value(read.authority.subjectId, nativeId)}\n        left join ${state.selected(\"credential\", \"passkey_credential\")} on ${credential.column(read.credential.subjectId)} = ${credential.value(read.credential.subjectId, nativeId)} and ${credential.column(read.credential.rpId)} = ${credential.value(read.credential.rpId, input.rpId)}\n        where ${subject.column(read.subject.id)} = ${subject.value(read.subject.id, nativeId)} limit 4097`;\n\n          if (rows.length === 0 || rows.length > 4096) return undefined;\n          const subjectRow = subject.decode(rows[0]!, \"s_\");\n\n          passkeyNativeInvariant(\n            rows.every((selected) => {\n              const other = subject.decode(selected, \"s_\");\n\n              return (\n                state.sameId(read.subject.decodeId(other), nativeId) &&\n                other[read.subject.securityRevision] === subjectRow[read.subject.securityRevision]\n              );\n            }),\n          );\n\n          const revision = state.revision(\n            subjectRow,\n            rows.map((row) => factor.decode(row, \"f_\")),\n          );\n\n          passkeyNativeInvariant(revision.subjectId === input.subjectId);\n          const values = new Map<string, M.PasskeyCredential>();\n\n          for (const selected of rows) {\n            const row = credential.decode(selected, \"c_\");\n\n            if (row[read.credential.credentialId] === null) continue;\n            const decoded = yield* state.decodeCredential(row, revision, subjectRow);\n\n            if (decoded !== undefined) values.set(decoded.credentialId, decoded);\n          }\n          const userHandle = values.values().next().value?.userHandle;\n\n          return M.snapshotPasskeySync(M.PasskeyEnrollmentSnapshot, {\n            revision,\n            ...(userHandle === undefined ? {} : { userHandle }),\n            credentials: [...values.values()].map((value) => ({\n              type: \"public-key\" as const,\n              id: value.protocolCredentialId,\n            })),\n          });\n        }),\n      ),\n  };\n\n  return credentials;\n};\n\nexport const makeNativePasskeyCredentialServices = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: PasskeyNativeRead,\n) {\n  const state = yield* makePasskeyNativeReadState(tables, mapping);\n  const executor = yield* makeSqlCommitExecutor(unavailable);\n  const crypto = yield* Crypto.Crypto;\n\n  const advisory = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n    executor.read(Effect.provideService(effect, Crypto.Crypto, crypto));\n\n  return { passkeyCredentials: makePasskeyNativeCredentialService(state, mapping, advisory) };\n});\n"],"mappings":";;;;;;;;;;;;AAiCA,MAAM,oBAAoB,EAAE,mBAAmB,KAAK,CAAC,CAAC;AAEtD,MAAa,wBACX,OACA,YAEA,OAAO,IAAI,aAAa;CAGtB,MAAM,UAAU,QAAQ,OAAO,OAFR,oBAEe;CAEtC,uBAAuB,SAAS,SAAS,oBAAoB,OAAO,SAAS,QAAQ,IAAI,CAAC;CAC1F,OAAO,yBAAyB,OAAO;CAEvC,OAAO;AACT,CAAC;AAEH,MAAM,WAAW,OAAO,WAAW,WACjC,QACA,SACA,OACA;CACA,MAAM,aAAa,OAAO,OAAO,cAAc,gBAAgB;CAC/D,MAAM,QAAQ,OAAO,uBAAuB,QAAQ,OAAO;CAC3D,MAAM,WAAW,OAAO,sBAAsB,WAAW;CACzD,MAAM,SAAS,OAAO,OAAO;CAC7B,MAAM,EAAE,KAAK,UAAU,MAAM,eAAe;CAC5C,MAAM,OAAO,QAAQ;CAErB,MAAM,WAAoB,WACxB,OAAO,eAAe,QAAQ,OAAO,QAAQ,MAAM;CAErD,MAAM,OACJ,QACA,OAAoC,mBAEnC,UAAU,KAAA,IACP,SAAS,IAAI,QAAQ,MAAM,GAAG,IAAI,IAClC,SAAS,MAAM,QAAQ,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC,EAAA,CACnF,KAAK,OAAO,eAAe,qBAAqB,MAAM,WAAW,CAAC;CAEtE,MAAM,YAAqB,WAAmC,SAAS,KAAK,QAAQ,MAAM,CAAC;CAE3F,MAAM,SAAmD,UAAU,YACjE,IACE,OAAO,IAAI,aAAa;EAEtB,MAAM,WADQ,EAAE,oBAAoB,uBAAuB,OAAO,QAC7C,CAAC,CAAC;EAEvB,IACE,CAAC,KAAK,YAAY,SAAS,QAAQ,KACnC,CAAC,qBAAqB,QAAQ,KAC9B,SAAS,YAAY,gBAErB,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;EAClE,MAAM,YAAY,KAAK,OAAO,QAAQ;EACtC,IAAI;EAEJ,IAAI,UAAU,KAAA,GAAW;GACvB,OAAO,KAAK,MAAM,WAAW,CAAC;GAC9B,UAAU;EACZ,OACE,UAAU,OAAO,KAAK,OAAO,SAAS,CAAC,CAAC,KACtC,OAAO,SACJ,UAAU,OAAO,GAAG,QAAQ,CAAC,CAAC,KAAK,KAAK,MAAM,OAAO,SAAS,yBACzD,OAAO,QAAQ,CAAC,CACxB,CACF;EAGF,OAAO,OAAO,qBACZ,YAAY,IAAI;GAAE,MAAM;GAAU;EAAS,IAAI,EAAE,MAAM,WAAW,GAClE,OACF;CACF,CAAC,GACD,WACF;CAEF,MAAM,cAA+C;EACnD;EACA,UAAU,aACR,SACE,OAAO,cAAc,KAAK,QAAQ,EAAE,oBAAoB,EAAE,eAAe,QAAQ,CAAC,CAAC,CACrF;EACF,UAAU,UAAU,YAClB,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,oBAAoB,uBAAuB,SAAS,QAAQ;GAC5E,MAAM,WAAW,MAAM;GAEvB,MAAM,WAAW,SAAS,SAAS,YAAY,MAC5C,UAAU,MAAM,iBAAiB,SAAS,YAC7C;GAEA,MAAM,YAAY,MAAM;GAExB,IACE,CAAC,KAAK,YAAY,MAAM,OAAO,QAAQ,KACvC,CAAC,qBAAqB,MAAM,UAAU,MAAM,MAAM,KAClD,CAAC,yBAAyB,MAAM,YAAY,YAAY,MAAM,SAAS,OAAO,KAC9E,CAAC,qBAAqB,MAAM,QAAQ,KACpC,aAAa,KAAA,KACb,CAAC,SAAS,UACV,SAAS,SAAS,MAAM,SAAS,QAAQ,QACzC,UAAU,yBAAyB,SAAS,wBAC5C,UAAU,mBAAmB,SAAS,kBACrC,UAAU,eAAe,KAAA,KAAa,UAAU,eAAe,SAAS,YAEzE,OAAO,OAAO,qBAAqB,YAAY,OAAO;GACxD,MAAM,WAAW,KAAK,QAAQ,MAAM,QAAQ,MAAM,QAAQ;GAE1D,IAAI,UAAU,KAAA,GACP;SAAA,OAAO,KAAK,OAAO,QAAQ,OAAO,GACrC,OAAO,OAAO,qBAAqB,YAAY,OAAO;GAAA,OACnD,OAAO,KAAK,MAAM,UAAU,CAAC;GACpC,MAAM,MAAM,OAAO,qBAAqB,SAAS,MAAM,SAAS,oBAAoB;GAEpF,MAAM,SAAS,QAAgB,UAC7B,aAAa,KAAK,WAAW,OAAO,MAAM,GAAG,WAAW,MAAM,QAAQ,KAAK,CAAC;GAE9E,MAAM,UAAU,WAAW,OAAO,KAAK,WAAW,OAAO;GACzD,MAAM,OAAO,WAAW,MAAM,KAAK,WAAW,SAAS,UAAU,OAAO;GAExE,MAAM,SAAS,SAAS,iBACpB,GAAG,aAAa,QAAQ,KAAK,KAAK,QAAQ,QAAQ,QAAQ,KAAK,QAC/D;GAEJ,MAAM,WAAW;IACf,MAAM,KAAK,WAAW,cAAc,SAAS,YAAY;IACzD,MAAM,KAAK,WAAW,eAAe,GAAG;IACxC,MAAM,KAAK,WAAW,oBAAoB,SAAS,QAAQ;IAC3D,GAAG,GAAG,WAAW,OAAO,KAAK,WAAW,cAAc,EAAE,KAAK,WAAW,MAAM,KAAK,WAAW,gBAAgB,QAAQ,UAAU,qBAAqB,SAAS,cAAc,CAAC;IAC7K,MAAM,OAAO,YAAY;GAC3B;GAEA,MAAM,YAAY,GAAG,GAAG,WAAW,OAAO;KACvC,KAAK,WAAW,UAAU;KAC1B,KAAK,WAAW,cAAc,QAAQ,UAAU,kBAC/C,UAAU,WACZ;KACC,QAAQ,UAAU,aAAa,MAAM;GACxC,CAAC,EAAE,SAAS,IAAI,IAAI,CAClB,GAAG,UACH,SAAS,iBACL,GAAG,SACH,GAAG,KAAK,QAAQ,WAAW,KAAK,WAAW,QAAQ,KAAK,KAAK,EACnE,CAAC;GAED,IAAI;GAEJ,IAAI,UAAU,KAAA,GAAW;IACvB,UAAU,OAAO,KAAK,OAAO,SAAS;IACtC,IACE,YAAY,KACZ,IAAI,gBAAgB;KAAE,aAAa;KAAM,cAAc;IAAM,CAAC,MAC7D,SAAS,kBAAkB,UAAU,YAAY,IAO9C;UAAA,OAFK,GAAG,4BAA4B,WAAW,KAAK,SAAS,IAAI,IAAI,QAAQ,EAAE,OAAO,SAAS,iBAAiB,GAAG,GAAG,QAAQ,MAAM,SAAS,GAAG,GAAG,QAAQ,MAAM,OAAO,WAAW,OAAO,KAAK,WAAW,WAAW,EAAE,KAAK,WAAW,MAAM,KAAK,WAAW,aAAa,QAAQ,UAAU,kBAAkB,UAAU,WAAW,CAAC,IAAA,CAE5T,WAAW,GAAG,UAAU;IAAA;GAExC,OAAO;IACL,OAAO,KAAK,MAAM,WAAW,CAAC;IAC9B,UAAU;GACZ;GAEA,IAAI,OAAO,OAAO,UAAU,GAAG;IAI7B,MAAM,kBAAkB,SAAS,iBAC7B,GAAG,GAAG,QAAQ,MAAM,WAAW,MAAM,KAAK,WAAW,SAAS,KAAK,IAAI,SAAS,SAAS,UAAU,OAAO,CAAC,MAC3G,GAAG,GAAG,QAAQ,KAAK;IAEvB,MAAM,YAAY,IAAI,IAAI,CACxB,KAAK,OAAO,MAAM,MAAM,GACxB,YAAY,IACR,GAAG,wBAAwB,WAAW,KAAK,SAAS,IAAI,IAAI,QAAQ,EAAE,OAAO,gBAAgB;0BACrF,WAAW,OAAO,KAAK,WAAW,WAAW,EAAE,KAAK,WAAW,MAAM,KAAK,WAAW,aAAa,QAAQ,UAAU,kBAAkB,UAAU,WAAW,CAAC,EAAE,KACtK,GAAG,MACT,CAAC;IAED,IAAI,UAAU,KAAA,GACZ,OAAO,yBAAyB;KAC9B,MAAM;KACN,OAAO,OAAO,IAAI,aAAa;MAC7B,MAAM,OAAO,OAAO,GAAG,kBAAkB;MAEzC,uBAAuB,KAAK,WAAW,CAAC;KAC1C,CAAC;IACH,CAAC;SAED,OAAO,8BAA8B;KACnC,MAAM;KACN,WAAW,kBAAkB,KAAK,SAAS;IAC7C,CAAC;GAEL;GAEA,OAAO,OAAO,qBAAqB,YAAY,IAAI,aAAa,YAAY,OAAO;EACrF,CAAC,CACH;EACF,UAAU,UAAU,YAClB,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,oBAAoB,uBAAuB,SAAS,QAAQ;GAE5E,uBAAuB,KAAK,YAAY,MAAM,QAAQ,CAAC;GAEvD,OAAO,OAAO,qBACZ,OAAO,KAAK,QAAQ,MAAM,UAAU,MAAM,OAAO,UAAU,KAAA,CAAS,GACpE,OACF;EACF,CAAC,GACD,WACF;CACJ;CAEA,MAAM,cAAc,mCAAmC,OAAO,MAAM,QAAQ;CAE5E,OAAO;EACL,OAAO,UAAU,KAAA;EACjB;EACA;EACA;EACA;EACA,oBAAoB;EACpB,oBAAoB;CACtB;AACF,CAAC;AAED,MAAa,6BAA6B,QAAyB,YACjE,SAAS,QAAQ,OAAO;AAE1B,MAAa,4BAA4B,QAAyB,YAChE,OAAO,QAAQ,iBAAiB,UAAU,SAAS,QAAQ,SAAS,KAAK,CAAC;AAI5E,MAAM,sCACJ,OACA,MACA,aAUG;CACH,MAAM,EAAE,KAAK,eAAe,SAAS,cAAc,QAAQ,kBAAkB,eAAe;CAqE5F,OAAO;EAlEL,SAAS,aACP,SACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,oBAAoB,uBAAuB,QAAQ,QAAQ;GAE3E,OAAO,OAAO,MAAM,OAAO,MAAM,MAAM,MAAM,oBAAoB;EACnE,CAAC,CACH;EACF,iBAAiB,aACf,SACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,oBAAoB,uBAAuB,gBAAgB,QAAQ;GAEnF,MAAM,WAAW,MAAM,OAAO,MAAM,SAAS;GAE7C,MAAM,OACJ,OAAO,GAAG,UAAU,QAAQ,OAAO,IAAI,EAAE,IAAI,OAAO,OAAO,IAAI,EAAE,IAAI,WAAW,OAAO,IAAI,EAAE;eAC1F,MAAM,SAAS,WAAW,iBAAiB,EAAE;oBACxC,MAAM,SAAS,aAAa,gBAAgB,EAAE,MAAM,OAAO,OAAO,KAAK,UAAU,SAAS,EAAE,KAAK,OAAO,MAAM,KAAK,UAAU,WAAW,QAAQ,EAAE;oBAClJ,MAAM,SAAS,cAAc,oBAAoB,EAAE,MAAM,WAAW,OAAO,KAAK,WAAW,SAAS,EAAE,KAAK,WAAW,MAAM,KAAK,WAAW,WAAW,QAAQ,EAAE,OAAO,WAAW,OAAO,KAAK,WAAW,IAAI,EAAE,KAAK,WAAW,MAAM,KAAK,WAAW,MAAM,MAAM,IAAI,EAAE;gBAC5Q,QAAQ,OAAO,KAAK,QAAQ,EAAE,EAAE,KAAK,QAAQ,MAAM,KAAK,QAAQ,IAAI,QAAQ,EAAE;GAEpF,IAAI,KAAK,WAAW,KAAK,KAAK,SAAS,MAAM,OAAO,KAAA;GACpD,MAAM,aAAa,QAAQ,OAAO,KAAK,IAAK,IAAI;GAEhD,uBACE,KAAK,OAAO,aAAa;IACvB,MAAM,QAAQ,QAAQ,OAAO,UAAU,IAAI;IAE3C,OACE,MAAM,OAAO,KAAK,QAAQ,SAAS,KAAK,GAAG,QAAQ,KACnD,MAAM,KAAK,QAAQ,sBAAsB,WAAW,KAAK,QAAQ;GAErE,CAAC,CACH;GAEA,MAAM,WAAW,MAAM,SACrB,YACA,KAAK,KAAK,QAAQ,OAAO,OAAO,KAAK,IAAI,CAAC,CAC5C;GAEA,uBAAuB,SAAS,cAAc,MAAM,SAAS;GAC7D,MAAM,yBAAS,IAAI,IAAiC;GAEpD,KAAK,MAAM,YAAY,MAAM;IAC3B,MAAM,MAAM,WAAW,OAAO,UAAU,IAAI;IAE5C,IAAI,IAAI,KAAK,WAAW,kBAAkB,MAAM;IAChD,MAAM,UAAU,OAAO,MAAM,iBAAiB,KAAK,UAAU,UAAU;IAEvE,IAAI,YAAY,KAAA,GAAW,OAAO,IAAI,QAAQ,cAAc,OAAO;GACrE;GACA,MAAM,aAAa,OAAO,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO;GAEjD,OAAO,EAAE,oBAAoB,EAAE,2BAA2B;IACxD;IACA,GAAI,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW;IACjD,aAAa,CAAC,GAAG,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,WAAW;KAChD,MAAM;KACN,IAAI,MAAM;IACZ,EAAE;GACJ,CAAC;EACH,CAAC,CACH;CAGa;AACnB;AAEA,MAAa,sCAAsC,OAAO,WAAW,WACnE,QACA,SACA;CACA,MAAM,QAAQ,OAAO,2BAA2B,QAAQ,OAAO;CAC/D,MAAM,WAAW,OAAO,sBAAsB,WAAW;CACzD,MAAM,SAAS,OAAO,OAAO;CAE7B,MAAM,YAAqB,WACzB,SAAS,KAAK,OAAO,eAAe,QAAQ,OAAO,QAAQ,MAAM,CAAC;CAEpE,OAAO,EAAE,oBAAoB,mCAAmC,OAAO,SAAS,QAAQ,EAAE;AAC5F,CAAC"}

package/dist/internal/passkey-policy.mjs

@@ -1,5 +1,6 @@
 import { Crypto, DateTime, Effect, Schema } from "effect";
 import { PasskeyCredential, PasskeyUnavailable, snapshotPasskeySync } from "@yielded/auth/Passkey";
+import { AuthenticationClock } from "@yielded/auth/Operations";
 //#region src/internal/passkey-policy.ts
 const invariant = (value) => {
 	if (!value) throw PasskeyUnavailable.make({});
@@ -78,18 +79,19 @@ const contextPurpose = {
 const validPasskeyCeremony = (ceremony) => ceremony.expiresAtMillis > ceremony.issuedAtMillis && ceremony.expiresAtMillis <= ceremony.requestBindingExpiresAtMillis && contextPurpose[ceremony.context._tag] === ceremony.purpose && new Set(ceremony.allowedCredentials.map((item) => item.id)).size === ceremony.allowedCredentials.length;
 const passkeyMatchesAccess = (ceremony, access) => ceremony.moduleId === access.moduleId && ceremony.purpose === access.purpose && ceremony.flowId === access.flowId && ceremony.requestBindingVerifier === access.requestBindingVerifier && ceremony.requestBindingExpiresAtMillis === access.requestBindingExpiresAtMillis;
 /** Reject stale bindings before evaluating application requirements. */
-const validPasskeyActionEvidence = (facts, authorization) => {
+const validPasskeyActionEvidence = Effect.fnUntraced(function* (facts, authorization) {
+	const { futureToleranceMillis } = yield* AuthenticationClock;
 	const { challenge, evidence } = authorization;
 	const { expected, revision, nowMillis: now } = facts;
 	if (challenge.moduleId !== facts.moduleId || challenge.action !== expected.action || challenge.commandId !== expected.commandId || challenge.flowId !== expected.flowId || challenge.bindingDigest !== expected.bindingDigest || evidence.flowId !== expected.flowId || evidence.bindingDigest !== expected.bindingDigest || !samePasskeyRevision(challenge.revision, expected.revision) || revision.subjectId !== expected.revision.subjectId || revision.securityRevision !== expected.revision.securityRevision || evidence.revision.subjectId !== revision.subjectId || evidence.revision.securityRevision !== revision.securityRevision) return false;
 	for (const requested of [expected.revision, evidence.revision]) if (requested.credentials.some((item) => !revision.credentials.some((current) => current.credentialId === item.credentialId && current.revision === item.revision))) return false;
-	if (evidence.proofs.some((proof) => DateTime.toEpochMillis(proof.verifiedAt) > now || !evidence.revision.credentials.some((item) => item.credentialId === proof.credentialId))) return false;
+	if (evidence.proofs.some((proof) => DateTime.toEpochMillis(proof.verifiedAt) - now > futureToleranceMillis || !evidence.revision.credentials.some((item) => item.credentialId === proof.credentialId))) return false;
 	return true;
-};
+});
 /** SQL policy predicates remain native. This authorizes the exact evidence and
 * returns the deadline every backend must retain through its final commit. */
-const assessPasskeyAction = (facts, authorization, policy) => {
-	if (!validPasskeyActionEvidence(facts, authorization)) return void 0;
+const assessPasskeyAction = Effect.fnUntraced(function* (facts, authorization, policy) {
+	if (!(yield* validPasskeyActionEvidence(facts, authorization))) return void 0;
 	const { evidence } = authorization;
 	const now = facts.nowMillis;
 	let expiresBefore = Infinity;
@@ -99,7 +101,7 @@ const assessPasskeyAction = (facts, authorization, policy) => {
 		...facts.originalRequirement === void 0 ? [] : [facts.originalRequirement]
 	]) {
 		const age = Math.min(policy.maximumEvidenceAgeMillis, requirement.maximumAgeMillis);
-		const fresh = evidence.proofs.filter((proof) => now - DateTime.toEpochMillis(proof.verifiedAt) < age);
+		const fresh = evidence.proofs.filter((proof) => Math.max(0, now - DateTime.toEpochMillis(proof.verifiedAt)) < age);
 		const factors = new Set(fresh.flatMap((proof) => proof.factors));
 		if (!requirement.alternatives.some((alternative) => alternative.factors.every((factor) => factors.has(factor)) && new Set(fresh.map((proof) => proof.credentialId)).size >= alternative.minimumCredentials && fresh.some((proof) => (!alternative.userVerified || proof.userVerified) && (!alternative.phishingResistant || proof.phishingResistant)))) return void 0;
 		for (const proof of fresh) expiresBefore = Math.min(expiresBefore, DateTime.toEpochMillis(proof.verifiedAt) + age);
@@ -108,7 +110,7 @@ const assessPasskeyAction = (facts, authorization, policy) => {
 		notBeforeMillis: now,
 		expiresBeforeMillis: expiresBefore
 	};
-};
+});
 //#endregion
 export { assessPasskeyAction, passkeyAssertionPurposes, passkeyCredentialKey, passkeyCredentialStorage, passkeyKey, passkeyMatchesAccess, passkeyStorage, samePasskeyCredential, samePasskeyRevision, validPasskeyActionEvidence, validPasskeyCeremony };