@yielded/auth 0.1.0-beta.1

package/dist/passkey/definition.mjs

@@ -0,0 +1,114 @@
+import { capturePasskeyConfiguration, makePasskeyMethod } from "./module.mjs";
+//#region src/passkey/definition.ts
+/** Relying-party configuration is static; storage, claims and session completion are Layers. */
+const captureDefine = (_namespace, input) => {
+	const options = Object.freeze({ ...input });
+	return {
+		options,
+		source: capturePasskeyConfiguration(options)
+	};
+};
+const bindDefine = (binding, captured) => {
+	const { options, source } = captured;
+	return makePasskeyMethod(binding.namespace, {
+		...options,
+		sessions: binding.sessions
+	}, source);
+};
+const define = (namespace, input) => {
+	const captured = captureDefine(namespace, input);
+	const bind = (binding) => bindDefine(binding, captured);
+	return Object.freeze({
+		namespace,
+		bind
+	});
+};
+function make(options) {
+	return define(options.namespace, options);
+}
+const captureDefineRegistration = (_namespace, input) => {
+	const options = Object.freeze({ ...input });
+	return {
+		options,
+		source: capturePasskeyConfiguration(options)
+	};
+};
+const bindDefineRegistration = (binding, captured) => {
+	const { options, source } = captured;
+	return makePasskeyMethod(binding.namespace, {
+		...options,
+		sessions: binding.sessions
+	}, source).registration(options.registration);
+};
+const defineRegistration = (namespace, input) => {
+	const captured = captureDefineRegistration(namespace, input);
+	const bind = (binding) => bindDefineRegistration(binding, captured);
+	return Object.freeze({
+		namespace,
+		bind
+	});
+};
+function makeRegistration(options) {
+	return defineRegistration(options.namespace, options);
+}
+const captureDefineManagement = (_namespace, input) => {
+	const options = Object.freeze({
+		...input,
+		management: Object.freeze({ ...input.management })
+	});
+	return {
+		options,
+		source: capturePasskeyConfiguration(options)
+	};
+};
+const bindDefineManagement = (binding, captured) => {
+	const { options, source } = captured;
+	return makePasskeyMethod(binding.namespace, {
+		...options,
+		sessions: binding.sessions
+	}, source).management(options.management);
+};
+const defineManagement = (namespace, input) => {
+	const captured = captureDefineManagement(namespace, input);
+	const bind = (binding) => bindDefineManagement(binding, captured);
+	return Object.freeze({
+		namespace,
+		bind
+	});
+};
+function makeManagement(options) {
+	return defineManagement(options.namespace, options);
+}
+const captureDefineCompletion = (capability, _namespace, input) => {
+	const options = Object.freeze({ ...input });
+	return {
+		capability,
+		options,
+		source: capturePasskeyConfiguration(options)
+	};
+};
+const bindDefineCompletion = (binding, captured) => {
+	const { capability, options, source } = captured;
+	return makePasskeyMethod(binding.namespace, {
+		...options,
+		sessions: binding.sessions
+	}, source)[capability];
+};
+const defineCompletion = (capability, namespace, input) => {
+	const captured = captureDefineCompletion(capability, namespace, input);
+	const bind = (binding) => bindDefineCompletion(binding, captured);
+	return Object.freeze({
+		namespace,
+		bind
+	});
+};
+function makePending(options) {
+	return defineCompletion("pending", options.namespace, options);
+}
+function makeStepUp(options) {
+	return defineCompletion("stepUp", options.namespace, options);
+}
+//#endregion
+export { make, makeManagement, makePending, makeRegistration, makeStepUp };
+
+//# sourceMappingURL=definition.mjs.map

package/dist/passkey/definition.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"definition.mjs","names":[],"sources":["../../src/passkey/definition.ts"],"sourcesContent":["import type {\n  BindingOf,\n  ClaimsCodec,\n  StrategyBinding,\n  StrategyDefinition,\n  StrategyTypeLambda,\n} from \"../auth/definition\";\nimport { capturePasskeyConfiguration, makePasskeyMethod } from \"./module\";\nimport type { PasskeyManagementPolicy } from \"./policy\";\n\ntype MethodConfiguration<T> = T extends unknown ? Omit<T, \"sessions\"> : never;\n\nexport type PasskeyOptions<Namespace extends string | undefined = undefined> = MethodConfiguration<\n  Parameters<typeof makePasskeyMethod>[1]\n> & { readonly namespace?: Namespace };\n\n/** Relying-party configuration is static; storage, claims and session completion are Layers. */\nconst captureDefine = <const Namespace extends string | undefined>(\n  _namespace: Namespace,\n  input: PasskeyOptions<Namespace>,\n) => {\n  const options = Object.freeze({ ...input });\n  const source = capturePasskeyConfiguration(options);\n\n  return { options, source };\n};\n\nconst bindDefine = <\n  const Namespace extends string | undefined,\n  Claims extends ClaimsCodec,\n  const Id extends string,\n  const SessionId extends string,\n>(\n  binding: StrategyBinding<Claims, Id, SessionId>,\n  captured: ReturnType<typeof captureDefine<Namespace>>,\n) => {\n  const { options, source } = captured;\n\n  return makePasskeyMethod<Id, SessionId, Claims>(\n    binding.namespace,\n    {\n      ...options,\n      sessions: binding.sessions,\n    },\n    source,\n  );\n};\n\nexport interface DefineStrategy<Namespace extends string | undefined> extends StrategyTypeLambda {\n  readonly type: ReturnType<\n    typeof bindDefine<\n      Namespace,\n      BindingOf<this>[\"claims\"],\n      BindingOf<this>[\"namespace\"],\n      BindingOf<this>[\"sessionNamespace\"]\n    >\n  >;\n}\n\nconst define = <const Namespace extends string | undefined>(\n  namespace: Namespace,\n  input: PasskeyOptions<Namespace>,\n) => {\n  const captured = captureDefine<Namespace>(namespace, input);\n\n  const bind = <\n    Claims extends ClaimsCodec,\n    const Id extends string,\n    const SessionId extends string,\n  >(\n    binding: StrategyBinding<Claims, Id, SessionId>,\n  ) => bindDefine<Namespace, Claims, Id, SessionId>(binding, captured);\n\n  const definition: StrategyDefinition<DefineStrategy<Namespace>, Namespace> = {\n    namespace,\n    bind,\n  };\n\n  return Object.freeze(definition);\n};\n\nexport function make<const Namespace extends string>(\n  options: PasskeyOptions<Namespace> & { readonly namespace: Namespace },\n): ReturnType<typeof define<Namespace>>;\n\nexport function make<const Namespace extends string | undefined = undefined>(\n  options: PasskeyOptions<Namespace>,\n): ReturnType<typeof define<Namespace | undefined>>;\n\nexport function make<const Namespace extends string | undefined>(\n  options: PasskeyOptions<Namespace>,\n) {\n  return define(options.namespace, options);\n}\n\nexport type PasskeyRegistrationConfiguration<\n  Registration extends ClaimsCodec,\n  Namespace extends string | undefined = undefined,\n> = PasskeyOptions<Namespace> & {\n  readonly registration: Registration;\n};\n\nexport type PasskeyManagementOptions<Namespace extends string | undefined = undefined> =\n  PasskeyOptions<Namespace> & {\n    readonly management: PasskeyManagementPolicy;\n  };\n\nconst captureDefineRegistration = <\n  Registration extends ClaimsCodec,\n  const Namespace extends string | undefined,\n>(\n  _namespace: Namespace,\n  input: PasskeyRegistrationConfiguration<Registration, Namespace>,\n) => {\n  const options = Object.freeze({ ...input });\n  const source = capturePasskeyConfiguration(options);\n\n  return { options, source };\n};\n\nconst bindDefineRegistration = <\n  Registration extends ClaimsCodec,\n  const Namespace extends string | undefined,\n  Claims extends ClaimsCodec,\n  const Id extends string,\n  const SessionId extends string,\n>(\n  binding: StrategyBinding<Claims, Id, SessionId>,\n  captured: ReturnType<typeof captureDefineRegistration<Registration, Namespace>>,\n) => {\n  const { options, source } = captured;\n\n  return makePasskeyMethod<Id, SessionId, Claims>(\n    binding.namespace,\n    {\n      ...options,\n      sessions: binding.sessions,\n    },\n    source,\n  ).registration(options.registration);\n};\n\nexport interface DefineRegistrationStrategy<\n  Registration extends ClaimsCodec,\n  Namespace extends string | undefined,\n> extends StrategyTypeLambda {\n  readonly type: ReturnType<\n    typeof bindDefineRegistration<\n      Registration,\n      Namespace,\n      BindingOf<this>[\"claims\"],\n      BindingOf<this>[\"namespace\"],\n      BindingOf<this>[\"sessionNamespace\"]\n    >\n  >;\n}\n\nconst defineRegistration = <\n  Registration extends ClaimsCodec,\n  const Namespace extends string | undefined,\n>(\n  namespace: Namespace,\n  input: PasskeyRegistrationConfiguration<Registration, Namespace>,\n) => {\n  const captured = captureDefineRegistration<Registration, Namespace>(namespace, input);\n\n  const bind = <\n    Claims extends ClaimsCodec,\n    const Id extends string,\n    const SessionId extends string,\n  >(\n    binding: StrategyBinding<Claims, Id, SessionId>,\n  ) => bindDefineRegistration<Registration, Namespace, Claims, Id, SessionId>(binding, captured);\n\n  const definition: StrategyDefinition<\n    DefineRegistrationStrategy<Registration, Namespace>,\n    Namespace\n  > = { namespace, bind };\n\n  return Object.freeze(definition);\n};\n\nexport function makeRegistration<Registration extends ClaimsCodec, const Namespace extends string>(\n  options: PasskeyRegistrationConfiguration<Registration, Namespace> & {\n    readonly namespace: Namespace;\n  },\n): ReturnType<typeof defineRegistration<Registration, Namespace>>;\n\nexport function makeRegistration<\n  Registration extends ClaimsCodec,\n  const Namespace extends string | undefined = undefined,\n>(\n  options: PasskeyRegistrationConfiguration<Registration, Namespace>,\n): ReturnType<typeof defineRegistration<Registration, Namespace | undefined>>;\n\nexport function makeRegistration<\n  Registration extends ClaimsCodec,\n  const Namespace extends string | undefined,\n>(options: PasskeyRegistrationConfiguration<Registration, Namespace>) {\n  return defineRegistration(options.namespace, options);\n}\n\nconst captureDefineManagement = <const Namespace extends string | undefined>(\n  _namespace: Namespace,\n  input: PasskeyManagementOptions<Namespace>,\n) => {\n  const options = Object.freeze({ ...input, management: Object.freeze({ ...input.management }) });\n  const source = capturePasskeyConfiguration(options);\n\n  return { options, source };\n};\n\nconst bindDefineManagement = <\n  const Namespace extends string | undefined,\n  Claims extends ClaimsCodec,\n  const Id extends string,\n  const SessionId extends string,\n>(\n  binding: StrategyBinding<Claims, Id, SessionId>,\n  captured: ReturnType<typeof captureDefineManagement<Namespace>>,\n) => {\n  const { options, source } = captured;\n\n  return makePasskeyMethod<Id, SessionId, Claims>(\n    binding.namespace,\n    {\n      ...options,\n      sessions: binding.sessions,\n    },\n    source,\n  ).management(options.management);\n};\n\nexport interface DefineManagementStrategy<\n  Namespace extends string | undefined,\n> extends StrategyTypeLambda {\n  readonly type: ReturnType<\n    typeof bindDefineManagement<\n      Namespace,\n      BindingOf<this>[\"claims\"],\n      BindingOf<this>[\"namespace\"],\n      BindingOf<this>[\"sessionNamespace\"]\n    >\n  >;\n}\n\nconst defineManagement = <const Namespace extends string | undefined>(\n  namespace: Namespace,\n  input: PasskeyManagementOptions<Namespace>,\n) => {\n  const captured = captureDefineManagement<Namespace>(namespace, input);\n\n  const bind = <\n    Claims extends ClaimsCodec,\n    const Id extends string,\n    const SessionId extends string,\n  >(\n    binding: StrategyBinding<Claims, Id, SessionId>,\n  ) => bindDefineManagement<Namespace, Claims, Id, SessionId>(binding, captured);\n\n  const definition: StrategyDefinition<DefineManagementStrategy<Namespace>, Namespace> = {\n    namespace,\n    bind,\n  };\n\n  return Object.freeze(definition);\n};\n\nexport function makeManagement<const Namespace extends string>(\n  options: PasskeyManagementOptions<Namespace> & { readonly namespace: Namespace },\n): ReturnType<typeof defineManagement<Namespace>>;\n\nexport function makeManagement<const Namespace extends string | undefined = undefined>(\n  options: PasskeyManagementOptions<Namespace>,\n): ReturnType<typeof defineManagement<Namespace | undefined>>;\n\nexport function makeManagement<const Namespace extends string | undefined>(\n  options: PasskeyManagementOptions<Namespace>,\n) {\n  return defineManagement(options.namespace, options);\n}\n\nconst captureDefineCompletion = <\n  const Capability extends \"pending\" | \"stepUp\",\n  const Namespace extends string | undefined,\n>(\n  capability: Capability,\n  _namespace: Namespace,\n  input: PasskeyOptions<Namespace>,\n) => {\n  const options = Object.freeze({ ...input });\n  const source = capturePasskeyConfiguration(options);\n\n  return { capability, options, source };\n};\n\nconst bindDefineCompletion = <\n  const Capability extends \"pending\" | \"stepUp\",\n  const Namespace extends string | undefined,\n  Claims extends ClaimsCodec,\n  const Id extends string,\n  const SessionId extends string,\n>(\n  binding: StrategyBinding<Claims, Id, SessionId>,\n  captured: ReturnType<typeof captureDefineCompletion<Capability, Namespace>>,\n) => {\n  const { capability, options, source } = captured;\n\n  return makePasskeyMethod<Id, SessionId, Claims>(\n    binding.namespace,\n    {\n      ...options,\n      sessions: binding.sessions,\n    },\n    source,\n  )[capability];\n};\n\nexport interface DefineCompletionStrategy<\n  Capability extends \"pending\" | \"stepUp\",\n  Namespace extends string | undefined,\n> extends StrategyTypeLambda {\n  readonly type: ReturnType<\n    typeof bindDefineCompletion<\n      Capability,\n      Namespace,\n      BindingOf<this>[\"claims\"],\n      BindingOf<this>[\"namespace\"],\n      BindingOf<this>[\"sessionNamespace\"]\n    >\n  >;\n}\n\nconst defineCompletion = <\n  const Capability extends \"pending\" | \"stepUp\",\n  const Namespace extends string | undefined,\n>(\n  capability: Capability,\n  namespace: Namespace,\n  input: PasskeyOptions<Namespace>,\n) => {\n  const captured = captureDefineCompletion<Capability, Namespace>(capability, namespace, input);\n\n  const bind = <\n    Claims extends ClaimsCodec,\n    const Id extends string,\n    const SessionId extends string,\n  >(\n    binding: StrategyBinding<Claims, Id, SessionId>,\n  ) => bindDefineCompletion<Capability, Namespace, Claims, Id, SessionId>(binding, captured);\n\n  const definition: StrategyDefinition<\n    DefineCompletionStrategy<Capability, Namespace>,\n    Namespace\n  > = { namespace, bind };\n\n  return Object.freeze(definition);\n};\n\nexport function makePending<const Namespace extends string>(\n  options: PasskeyOptions<Namespace> & { readonly namespace: Namespace },\n): ReturnType<typeof defineCompletion<\"pending\", Namespace>>;\n\nexport function makePending<const Namespace extends string | undefined = undefined>(\n  options: PasskeyOptions<Namespace>,\n): ReturnType<typeof defineCompletion<\"pending\", Namespace | undefined>>;\n\nexport function makePending<const Namespace extends string | undefined>(\n  options: PasskeyOptions<Namespace>,\n) {\n  return defineCompletion(\"pending\", options.namespace, options);\n}\n\nexport function makeStepUp<const Namespace extends string>(\n  options: PasskeyOptions<Namespace> & { readonly namespace: Namespace },\n): ReturnType<typeof defineCompletion<\"stepUp\", Namespace>>;\n\nexport function makeStepUp<const Namespace extends string | undefined = undefined>(\n  options: PasskeyOptions<Namespace>,\n): ReturnType<typeof defineCompletion<\"stepUp\", Namespace | undefined>>;\n\nexport function makeStepUp<const Namespace extends string | undefined>(\n  options: PasskeyOptions<Namespace>,\n) {\n  return defineCompletion(\"stepUp\", options.namespace, options);\n}\n"],"mappings":";;;AAiBA,MAAM,iBACJ,YACA,UACG;CACH,MAAM,UAAU,OAAO,OAAO,EAAE,GAAG,MAAM,CAAC;CAG1C,OAAO;EAAE;EAAS,QAFH,4BAA4B,OAEpB;CAAE;AAC3B;AAEA,MAAM,cAMJ,SACA,aACG;CACH,MAAM,EAAE,SAAS,WAAW;CAE5B,OAAO,kBACL,QAAQ,WACR;EACE,GAAG;EACH,UAAU,QAAQ;CACpB,GACA,MACF;AACF;AAaA,MAAM,UACJ,WACA,UACG;CACH,MAAM,WAAW,cAAyB,WAAW,KAAK;CAE1D,MAAM,QAKJ,YACG,WAA6C,SAAS,QAAQ;CAOnE,OAAO,OAAO,OAAO;EAJnB;EACA;CAG4B,CAAC;AACjC;AAUA,SAAgB,KACd,SACA;CACA,OAAO,OAAO,QAAQ,WAAW,OAAO;AAC1C;AAcA,MAAM,6BAIJ,YACA,UACG;CACH,MAAM,UAAU,OAAO,OAAO,EAAE,GAAG,MAAM,CAAC;CAG1C,OAAO;EAAE;EAAS,QAFH,4BAA4B,OAEpB;CAAE;AAC3B;AAEA,MAAM,0BAOJ,SACA,aACG;CACH,MAAM,EAAE,SAAS,WAAW;CAE5B,OAAO,kBACL,QAAQ,WACR;EACE,GAAG;EACH,UAAU,QAAQ;CACpB,GACA,MACF,CAAC,CAAC,aAAa,QAAQ,YAAY;AACrC;AAiBA,MAAM,sBAIJ,WACA,UACG;CACH,MAAM,WAAW,0BAAmD,WAAW,KAAK;CAEpF,MAAM,QAKJ,YACG,uBAAuE,SAAS,QAAQ;CAO7F,OAAO,OAAO,OAAO;EAFf;EAAW;CAEa,CAAC;AACjC;AAeA,SAAgB,iBAGd,SAAoE;CACpE,OAAO,mBAAmB,QAAQ,WAAW,OAAO;AACtD;AAEA,MAAM,2BACJ,YACA,UACG;CACH,MAAM,UAAU,OAAO,OAAO;EAAE,GAAG;EAAO,YAAY,OAAO,OAAO,EAAE,GAAG,MAAM,WAAW,CAAC;CAAE,CAAC;CAG9F,OAAO;EAAE;EAAS,QAFH,4BAA4B,OAEpB;CAAE;AAC3B;AAEA,MAAM,wBAMJ,SACA,aACG;CACH,MAAM,EAAE,SAAS,WAAW;CAE5B,OAAO,kBACL,QAAQ,WACR;EACE,GAAG;EACH,UAAU,QAAQ;CACpB,GACA,MACF,CAAC,CAAC,WAAW,QAAQ,UAAU;AACjC;AAeA,MAAM,oBACJ,WACA,UACG;CACH,MAAM,WAAW,wBAAmC,WAAW,KAAK;CAEpE,MAAM,QAKJ,YACG,qBAAuD,SAAS,QAAQ;CAO7E,OAAO,OAAO,OAAO;EAJnB;EACA;CAG4B,CAAC;AACjC;AAUA,SAAgB,eACd,SACA;CACA,OAAO,iBAAiB,QAAQ,WAAW,OAAO;AACpD;AAEA,MAAM,2BAIJ,YACA,YACA,UACG;CACH,MAAM,UAAU,OAAO,OAAO,EAAE,GAAG,MAAM,CAAC;CAG1C,OAAO;EAAE;EAAY;EAAS,QAFf,4BAA4B,OAER;CAAE;AACvC;AAEA,MAAM,wBAOJ,SACA,aACG;CACH,MAAM,EAAE,YAAY,SAAS,WAAW;CAExC,OAAO,kBACL,QAAQ,WACR;EACE,GAAG;EACH,UAAU,QAAQ;CACpB,GACA,MACF,CAAC,CAAC;AACJ;AAiBA,MAAM,oBAIJ,YACA,WACA,UACG;CACH,MAAM,WAAW,wBAA+C,YAAY,WAAW,KAAK;CAE5F,MAAM,QAKJ,YACG,qBAAmE,SAAS,QAAQ;CAOzF,OAAO,OAAO,OAAO;EAFf;EAAW;CAEa,CAAC;AACjC;AAUA,SAAgB,YACd,SACA;CACA,OAAO,iBAAiB,WAAW,QAAQ,WAAW,OAAO;AAC/D;AAUA,SAAgB,WACd,SACA;CACA,OAAO,iBAAiB,UAAU,QAAQ,WAAW,OAAO;AAC9D"}

package/dist/passkey/errors.d.mts

@@ -0,0 +1,20 @@
+import { HookDenied } from "../hooks/models.mjs";
+import { Schema } from "effect";
+//#region src/passkey/errors.d.ts
+declare const PasskeyRejected_base: Schema.Class<PasskeyRejected, Schema.TaggedStruct<"PasskeyRejected", {}>, import("effect/Cause").YieldableError>;
+declare class PasskeyRejected extends PasskeyRejected_base {}
+declare const PasskeyUnavailable_base: Schema.Class<PasskeyUnavailable, Schema.TaggedStruct<"PasskeyUnavailable", {}>, import("effect/Cause").YieldableError>;
+declare class PasskeyUnavailable extends PasskeyUnavailable_base {}
+declare const PasskeyActionRequired_base: Schema.Class<PasskeyActionRequired, Schema.TaggedStruct<"PasskeyActionRequired", {}>, import("effect/Cause").YieldableError>;
+declare class PasskeyActionRequired extends PasskeyActionRequired_base {}
+declare const PasskeyMethodUnsupported_base: Schema.Class<PasskeyMethodUnsupported, Schema.TaggedStruct<"PasskeyMethodUnsupported", {}>, import("effect/Cause").YieldableError>;
+declare class PasskeyMethodUnsupported extends PasskeyMethodUnsupported_base {}
+declare const PasskeyConfigurationError_base: Schema.Class<PasskeyConfigurationError, Schema.TaggedStruct<"PasskeyConfigurationError", {}>, import("effect/Cause").YieldableError>;
+declare class PasskeyConfigurationError extends PasskeyConfigurationError_base {}
+declare const PasskeyProtocolRejected_base: Schema.Class<PasskeyProtocolRejected, Schema.TaggedStruct<"PasskeyProtocolRejected", {}>, import("effect/Cause").YieldableError>;
+declare class PasskeyProtocolRejected extends PasskeyProtocolRejected_base {}
+declare const PasskeyFailure: Schema.Union<readonly [typeof PasskeyRejected, typeof PasskeyUnavailable, typeof PasskeyActionRequired, typeof PasskeyMethodUnsupported, typeof HookDenied]>;
+type PasskeyFailure = typeof PasskeyFailure.Type;
+//#endregion
+export { PasskeyActionRequired, PasskeyConfigurationError, PasskeyFailure, PasskeyMethodUnsupported, PasskeyProtocolRejected, PasskeyRejected, PasskeyUnavailable };
+//# sourceMappingURL=errors.d.mts.map

package/dist/passkey/errors.mjs

@@ -0,0 +1,20 @@
+import { HookDenied } from "../hooks/models.mjs";
+import { Schema } from "effect";
+//#region src/passkey/errors.ts
+var PasskeyRejected = class extends Schema.TaggedError()("PasskeyRejected", {}) {};
+var PasskeyUnavailable = class extends Schema.TaggedError()("PasskeyUnavailable", {}) {};
+var PasskeyActionRequired = class extends Schema.TaggedError()("PasskeyActionRequired", {}) {};
+var PasskeyMethodUnsupported = class extends Schema.TaggedError()("PasskeyMethodUnsupported", {}) {};
+var PasskeyConfigurationError = class extends Schema.TaggedError()("PasskeyConfigurationError", {}) {};
+var PasskeyProtocolRejected = class extends Schema.TaggedError()("PasskeyProtocolRejected", {}) {};
+const PasskeyFailure = Schema.Union([
+	PasskeyRejected,
+	PasskeyUnavailable,
+	PasskeyActionRequired,
+	PasskeyMethodUnsupported,
+	HookDenied
+]);
+//#endregion
+export { PasskeyActionRequired, PasskeyConfigurationError, PasskeyFailure, PasskeyMethodUnsupported, PasskeyProtocolRejected, PasskeyRejected, PasskeyUnavailable };
+
+//# sourceMappingURL=errors.mjs.map

package/dist/passkey/errors.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.mjs","names":[],"sources":["../../src/passkey/errors.ts"],"sourcesContent":["import { Schema } from \"effect\";\n\nimport { HookDenied } from \"../hooks/models\";\nexport class PasskeyRejected extends Schema.TaggedError<PasskeyRejected>()(\"PasskeyRejected\", {}) {}\n\nexport class PasskeyUnavailable extends Schema.TaggedError<PasskeyUnavailable>()(\n  \"PasskeyUnavailable\",\n  {},\n) {}\n\nexport class PasskeyActionRequired extends Schema.TaggedError<PasskeyActionRequired>()(\n  \"PasskeyActionRequired\",\n  {},\n) {}\n\nexport class PasskeyMethodUnsupported extends Schema.TaggedError<PasskeyMethodUnsupported>()(\n  \"PasskeyMethodUnsupported\",\n  {},\n) {}\n\nexport class PasskeyConfigurationError extends Schema.TaggedError<PasskeyConfigurationError>()(\n  \"PasskeyConfigurationError\",\n  {},\n) {}\n\nexport class PasskeyProtocolRejected extends Schema.TaggedError<PasskeyProtocolRejected>()(\n  \"PasskeyProtocolRejected\",\n  {},\n) {}\n\nexport const PasskeyFailure = Schema.Union([\n  PasskeyRejected,\n  PasskeyUnavailable,\n  PasskeyActionRequired,\n  PasskeyMethodUnsupported,\n  HookDenied,\n]);\n\nexport type PasskeyFailure = typeof PasskeyFailure.Type;\n"],"mappings":";;;AAGA,IAAa,kBAAb,cAAqC,OAAO,YAA6B,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC;AAEnG,IAAa,qBAAb,cAAwC,OAAO,YAAgC,CAAC,CAC9E,sBACA,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,IAAa,wBAAb,cAA2C,OAAO,YAAmC,CAAC,CACpF,yBACA,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,IAAa,2BAAb,cAA8C,OAAO,YAAsC,CAAC,CAC1F,4BACA,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,IAAa,4BAAb,cAA+C,OAAO,YAAuC,CAAC,CAC5F,6BACA,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,IAAa,0BAAb,cAA6C,OAAO,YAAqC,CAAC,CACxF,2BACA,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,MAAa,iBAAiB,OAAO,MAAM;CACzC;CACA;CACA;CACA;CACA;AACF,CAAC"}

package/dist/passkey/management.mjs

@@ -0,0 +1,276 @@
+import { TokenDigest } from "../Schema.mjs";
+import { LastSignInMethod } from "../identity/models.mjs";
+import { LifecycleEventId, lifecycleEvent, lifecycleSnapshot } from "../hooks/models.mjs";
+import { operationGroup } from "../operations/operation.mjs";
+import { sessionInvalidationWindow } from "../sessions/invalidation.mjs";
+import { LifecycleHooks } from "../hooks/LifecycleHooks.mjs";
+import { assessAuthentication } from "../sessions/assurance.mjs";
+import { PasskeyEnrollmentContext } from "./PasskeyEnrollmentContext.mjs";
+import { PasskeyActionRequired, PasskeyConfigurationError, PasskeyRejected, PasskeyUnavailable } from "./errors.mjs";
+import { PasskeyActionAuthorization, PasskeyActionChallenge, PasskeyBegin, PasskeyCeremony, PasskeyCredential, PasskeyCredentialSummary, PasskeyDescriptor, PasskeyEnrollmentSnapshot, PasskeyIssueDecision, PasskeyLabel, PasskeyModuleId, PasskeyProfile, PasskeyRemoved, PasskeyRevision, PasskeyUserHandle } from "./models.mjs";
+import { PasskeyManagementPersistence } from "./PasskeyManagementPersistence.mjs";
+import { snapshotPasskey, snapshotPasskeySync } from "./snapshot.mjs";
+import { PasskeyManagementPolicy } from "./policy.mjs";
+import { PasskeyActionEvidence } from "./PasskeyActionEvidence.mjs";
+import { makePasskeyManagementContract } from "../PasskeyContract.mjs";
+import { makePasskeyCeremony, passkeyNoAmbient, passkeyUnexpected, readPasskeyCommit } from "./actions.mjs";
+import { Context, Crypto, DateTime, Effect, Encoding, Layer, Schema } from "effect";
+//#region src/passkey/management.ts
+const enrollmentDecision = Schema.Union([Schema.TaggedStruct("Enrolled", { credential: PasskeyCredentialSummary }), Schema.TaggedStruct("Rejected", {})]);
+const removeInspection = Schema.Union([
+	Schema.TaggedStruct("Target", { credential: PasskeyCredential }),
+	Schema.TaggedStruct("Replay", { result: PasskeyRemoved }),
+	Schema.TaggedStruct("Rejected", {})
+]);
+const removeDecision = Schema.Union([
+	Schema.TaggedStruct("Removed", { result: PasskeyRemoved }),
+	Schema.TaggedStruct("Rejected", {}),
+	Schema.TaggedStruct("LastSignInMethod", {})
+]);
+const renameDecision = Schema.Union([Schema.TaggedStruct("Renamed", {
+	credential: PasskeyCredentialSummary,
+	replayed: Schema.Boolean
+}), Schema.TaggedStruct("Rejected", {})]);
+const subject = Effect.fn("PasskeyManagement.subject")(function* (invocation) {
+	yield* passkeyNoAmbient();
+	if (invocation._tag !== "Authenticated") return yield* PasskeyRejected.make({});
+	return invocation.subjectId;
+}, passkeyUnexpected);
+const makePasskeyManagement = (moduleId, source, input, sessions) => {
+	const captured = (() => {
+		try {
+			return Effect.succeed(snapshotPasskeySync(PasskeyManagementPolicy, input));
+		} catch {
+			return Effect.fail(PasskeyConfigurationError.make({}));
+		}
+	})();
+	const ceremony = makePasskeyCeremony(moduleId, source, "enrollment");
+	const { BeginInput, CompleteInput, ListInput, RenameInput, RemoveInput, Failure, listResult, operations: { Begin, Complete, List, Rename, Remove } } = makePasskeyManagementContract(moduleId);
+	const Management = Context.Service(`effect-auth/PasskeyManagement/${moduleId.length}:${moduleId}`);
+	const layer = Layer.effect(Management, Effect.gen(function* () {
+		const policy = yield* captured, runtime = yield* ceremony.make, persistence = yield* PasskeyManagementPersistence, context = yield* PasskeyEnrollmentContext, actions = yield* PasskeyActionEvidence, strategy = yield* sessions.SessionStrategy, crypto = yield* Crypto.Crypto, hooks = yield* LifecycleHooks;
+		if (policy.requireImmediateInvalidation && strategy.capabilities.subjectInvalidation !== "immediate") return yield* PasskeyConfigurationError.make({});
+		const invalidation = sessionInvalidationWindow("credential-change", strategy.capabilities, strategy.policy);
+		const digest = (schema, value) => Schema.encodeEffect(Schema.fromJsonString(Schema.toCodecJson(Schema.toType(schema))))(value).pipe(Effect.flatMap((encoded) => crypto.digest("SHA-256", new TextEncoder().encode(encoded))), Effect.map((bytes) => TokenDigest.make(Encoding.encodeBase64Url(bytes))), Effect.mapError(() => PasskeyUnavailable.make({})));
+		const authorize = Effect.fn("PasskeyManagement.authorize")(function* (invocation, challenge, actionProof) {
+			const answer = yield* actions.verify({
+				invocation,
+				challenge,
+				...actionProof === void 0 ? {} : { proof: actionProof }
+			});
+			const authorization = yield* snapshotPasskey(PasskeyActionAuthorization, {
+				challenge,
+				...answer
+			});
+			const evidence = authorization.evidence, now = yield* DateTime.now;
+			if (String(evidence.flowId) !== String(challenge.flowId) || evidence.bindingDigest !== challenge.bindingDigest || evidence.revision.subjectId !== challenge.revision.subjectId || evidence.revision.securityRevision !== challenge.revision.securityRevision || challenge.revision.credentials.some((original) => !evidence.revision.credentials.some((current) => current.credentialId === original.credentialId && current.revision === original.revision))) return yield* PasskeyActionRequired.make({});
+			if (!(yield* assessAuthentication(evidence, authorization.requirement).pipe(Effect.mapError(() => PasskeyActionRequired.make({})))).satisfied || evidence.proofs.some((item) => DateTime.toEpochMillis(now) - DateTime.toEpochMillis(item.verifiedAt) > policy.maximumEvidenceAgeMillis)) return yield* PasskeyActionRequired.make({});
+			return authorization;
+		}, passkeyUnexpected);
+		const event = (operation, commandId, subjectId, nowMillis) => lifecycleEvent({
+			id: LifecycleEventId.make(`passkey/${moduleId}/${operation}/${commandId}`),
+			occurredAtMillis: nowMillis,
+			snapshot: lifecycleSnapshot({
+				action: "credential-change",
+				operation: `${moduleId}/passkey/${operation}`,
+				subjectId,
+				method: "passkey",
+				identifiers: []
+			})
+		});
+		return Management.of({
+			begin: Effect.fn("PasskeyManagement.begin")(function* (invocation, input) {
+				input = yield* snapshotPasskey(Schema.toType(BeginInput), input);
+				const subjectId = yield* subject(invocation), selected = yield* runtime.profile(input.profileId), captured = yield* context.capture({
+					moduleId,
+					rpId: selected.rpId,
+					subjectId
+				});
+				if (captured === void 0 || captured.revision.subjectId !== subjectId || captured.credentials.length >= policy.maximumCredentials) return yield* PasskeyRejected.make({});
+				const fixedCapture = yield* snapshotPasskey(PasskeyEnrollmentSnapshot, captured);
+				const userHandle = fixedCapture.userHandle ?? PasskeyUserHandle.make(yield* runtime.random());
+				const challenge = yield* snapshotPasskey(PasskeyActionChallenge, {
+					moduleId,
+					action: "enroll-begin",
+					commandId: input.commandId,
+					flowId: input.flowId,
+					revision: fixedCapture.revision,
+					bindingDigest: yield* digest(Schema.Tuple([
+						PasskeyModuleId,
+						Schema.Literal("enrollment"),
+						Schema.Struct({
+							...PasskeyBegin.fields,
+							name: PasskeyLabel
+						}),
+						PasskeyProfile,
+						PasskeyRevision,
+						PasskeyUserHandle,
+						Schema.Array(PasskeyDescriptor)
+					]), [
+						moduleId,
+						"enrollment",
+						input,
+						selected,
+						fixedCapture.revision,
+						userHandle,
+						fixedCapture.credentials
+					])
+				});
+				const authorization = yield* authorize(invocation, challenge, input.actionProof);
+				const draft = yield* runtime.prepareRegistration(input, {
+					_tag: "Enrollment",
+					revision: fixedCapture.revision,
+					userHandle,
+					name: input.name,
+					authorization
+				}, fixedCapture.credentials);
+				const authority = yield* PasskeyManagementPersistence;
+				const issued = yield* readPasskeyCommit(yield* authority.issueEnrollment({
+					ceremony: draft.ceremony,
+					policy: runtime.policy,
+					management: policy,
+					authorization
+				}, (value, journal) => journal.prepare(snapshotPasskeySync(PasskeyIssueDecision, value))));
+				return yield* runtime.acceptRegistrationIssue(draft, issued);
+			}, passkeyUnexpected, Effect.provideService(PasskeyManagementPersistence, persistence)),
+			complete: Effect.fn("PasskeyManagement.complete")(function* (invocation, input) {
+				input = yield* snapshotPasskey(Schema.toType(CompleteInput), input);
+				const subjectId = yield* subject(invocation), inspected = yield* runtime.inspect(input);
+				const original = inspected.ceremony.context;
+				if (original._tag !== "Enrollment" || original.revision.subjectId !== subjectId) return yield* PasskeyRejected.make({});
+				const challenge = yield* snapshotPasskey(PasskeyActionChallenge, {
+					moduleId,
+					action: "enroll-complete",
+					commandId: inspected.ceremony.commandId,
+					flowId: input.flowId,
+					revision: original.revision,
+					bindingDigest: yield* digest(PasskeyCeremony, inspected.ceremony)
+				});
+				const authorization = yield* authorize(invocation, challenge, input.actionProof);
+				if (!(yield* assessAuthentication(authorization.evidence, original.authorization.requirement).pipe(Effect.mapError(() => PasskeyActionRequired.make({})))).satisfied) return yield* PasskeyActionRequired.make({});
+				const { claim, verified } = yield* runtime.verifyRegistration(input, original);
+				const authority = yield* PasskeyManagementPersistence;
+				const timestamp = DateTime.toEpochMillis(yield* DateTime.now);
+				const result = yield* readPasskeyCommit(yield* authority.completeEnrollment({
+					claim,
+					verified,
+					authorization,
+					management: policy,
+					invalidation,
+					nowMillis: timestamp
+				}, (value, journal) => {
+					const projected = snapshotPasskeySync(enrollmentDecision, value);
+					if (projected._tag === "Enrolled") journal.stage(event("enrollment", claim.ceremony.commandId, subjectId, timestamp));
+					return journal.prepare(projected);
+				}));
+				if (result._tag !== "Enrolled") return yield* PasskeyRejected.make({});
+				return {
+					value: {
+						credential: result.credential,
+						invalidation
+					},
+					credentialCommands: [runtime.clear]
+				};
+			}, passkeyUnexpected, Effect.provideService(PasskeyManagementPersistence, persistence)),
+			list: Effect.fn("PasskeyManagement.list")(function* (invocation, input) {
+				const subjectId = yield* subject(invocation);
+				const request = yield* snapshotPasskey(ListInput, input);
+				return yield* snapshotPasskey(listResult, yield* persistence.list({
+					moduleId,
+					subjectId,
+					...request
+				}));
+			}, passkeyUnexpected),
+			rename: Effect.fn("PasskeyManagement.rename")(function* (invocation, input) {
+				const subjectId = yield* subject(invocation), request = yield* snapshotPasskey(RenameInput, input), timestamp = DateTime.toEpochMillis(yield* DateTime.now);
+				yield* hooks.before(event("rename", request.commandId, subjectId, timestamp).snapshot);
+				const result = yield* readPasskeyCommit(yield* persistence.rename({
+					moduleId,
+					subjectId,
+					...request,
+					nowMillis: timestamp,
+					retentionUntilMillis: timestamp + runtime.policy.retentionMillis
+				}, (value, journal) => {
+					const projected = snapshotPasskeySync(renameDecision, value);
+					if (projected._tag === "Renamed" && !projected.replayed) journal.stage(event("rename", request.commandId, subjectId, timestamp));
+					return journal.prepare(projected);
+				}));
+				if (result._tag !== "Renamed" || result.credential.credentialId !== request.credentialId) return yield* PasskeyRejected.make({});
+				return {
+					credential: result.credential,
+					replayed: result.replayed
+				};
+			}, passkeyUnexpected),
+			remove: Effect.fn("PasskeyManagement.remove")(function* (invocation, input) {
+				const subjectId = yield* subject(invocation), request = yield* snapshotPasskey(Schema.toType(RemoveInput), input);
+				const inspected = yield* snapshotPasskey(removeInspection, yield* persistence.inspectRemove({
+					moduleId,
+					subjectId,
+					commandId: request.commandId,
+					credentialId: request.credentialId
+				}));
+				if (inspected._tag === "Rejected") return yield* PasskeyRejected.make({});
+				if (inspected._tag === "Replay") {
+					if (inspected.result.credentialId !== request.credentialId || !inspected.result.replayed) return yield* PasskeyUnavailable.make({});
+					return inspected.result;
+				}
+				if (inspected.credential.revision.subjectId !== subjectId || inspected.credential.credentialId !== request.credentialId) return yield* PasskeyRejected.make({});
+				const challenge = yield* snapshotPasskey(PasskeyActionChallenge, {
+					moduleId,
+					action: "remove",
+					commandId: request.commandId,
+					flowId: Schema.decodeSync(PasskeyBegin.fields.flowId)(request.commandId),
+					revision: inspected.credential.revision,
+					bindingDigest: yield* digest(Schema.Tuple([
+						PasskeyModuleId,
+						Schema.Literal("remove"),
+						PasskeyBegin.fields.commandId,
+						PasskeyCredential
+					]), [
+						moduleId,
+						"remove",
+						request.commandId,
+						inspected.credential
+					])
+				});
+				const authorization = yield* authorize(invocation, challenge, request.actionProof), timestamp = DateTime.toEpochMillis(yield* DateTime.now);
+				yield* hooks.before(event("remove", request.commandId, subjectId, timestamp).snapshot);
+				const result = yield* readPasskeyCommit(yield* persistence.remove({
+					moduleId,
+					commandId: request.commandId,
+					credential: inspected.credential,
+					authorization,
+					management: policy,
+					invalidation,
+					nowMillis: timestamp,
+					retentionUntilMillis: timestamp + runtime.policy.retentionMillis
+				}, (value, journal) => {
+					const projected = snapshotPasskeySync(removeDecision, value);
+					if (projected._tag === "Removed" && !projected.result.replayed) journal.stage(event("remove", request.commandId, subjectId, timestamp));
+					return journal.prepare(projected);
+				}));
+				if (result._tag === "LastSignInMethod") return yield* LastSignInMethod.make({});
+				if (result._tag !== "Removed" || result.result.credentialId !== request.credentialId) return yield* PasskeyRejected.make({});
+				return result.result;
+			}, passkeyUnexpected)
+		});
+	}));
+	return Object.freeze({
+		Management,
+		binding: ceremony.binding,
+		layer,
+		operations: Object.freeze({
+			Begin,
+			Complete,
+			List,
+			Rename,
+			Remove
+		}),
+		group: operationGroup(Begin, Complete, List, Rename, Remove),
+		handlersLayer: Layer.mergeAll(Begin.credentialHandlerLayer((input, invocation) => Effect.flatMap(Management, (service) => service.begin(invocation, input))), Complete.credentialHandlerLayer((input, invocation) => Effect.flatMap(Management, (service) => service.complete(invocation, input))), List.handlerLayer((input, invocation) => Effect.flatMap(Management, (service) => service.list(invocation, input))), Rename.handlerLayer((input, invocation) => Effect.flatMap(Management, (service) => service.rename(invocation, input))), Remove.handlerLayer((input, invocation) => Effect.flatMap(Management, (service) => service.remove(invocation, input))))
+	});
+};
+//#endregion
+export { makePasskeyManagement };
+
+//# sourceMappingURL=management.mjs.map

package/dist/passkey/management.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"management.mjs","names":[],"sources":["../../src/passkey/management.ts"],"sourcesContent":["import { Context, Crypto, DateTime, Effect, Encoding, Layer, Schema } from \"effect\";\n\nimport { LifecycleHooks } from \"../hooks/LifecycleHooks\";\nimport { LifecycleEventId, lifecycleEvent, lifecycleSnapshot } from \"../hooks/models\";\nimport { LastSignInMethod } from \"../identity/models\";\nimport type { AuthInvocation } from \"../operations/context\";\nimport type { AuthOperationResult } from \"../operations/credentials\";\nimport { operationGroup } from \"../operations/operation\";\nimport { makePasskeyManagementContract } from \"../PasskeyContract\";\nimport { TokenDigest } from \"../Schema\";\nimport { assessAuthentication } from \"../sessions/assurance\";\nimport { sessionInvalidationWindow } from \"../sessions/invalidation\";\nimport type { makeSessionModule } from \"../sessions/module\";\nimport {\n  passkeyUnexpected,\n  makePasskeyCeremony,\n  passkeyNoAmbient,\n  readPasskeyCommit,\n} from \"./actions\";\nimport type { PasskeyFailure } from \"./errors\";\nimport {\n  PasskeyActionRequired,\n  PasskeyConfigurationError,\n  PasskeyRejected,\n  PasskeyUnavailable,\n} from \"./errors\";\nimport type { PasskeyEnrolled, PasskeyRegistrationStarted } from \"./models\";\nimport {\n  PasskeyActionAuthorization,\n  PasskeyActionChallenge,\n  PasskeyBegin,\n  PasskeyCeremony,\n  PasskeyDescriptor,\n  PasskeyModuleId,\n  PasskeyProfile,\n  PasskeyRevision,\n  PasskeyCredential,\n  PasskeyCredentialSummary,\n  PasskeyEnrollmentSnapshot,\n  PasskeyIssueDecision,\n  PasskeyLabel,\n  PasskeyRemoved,\n  PasskeyUserHandle,\n} from \"./models\";\nimport { PasskeyActionEvidence } from \"./PasskeyActionEvidence\";\nimport { PasskeyEnrollmentContext } from \"./PasskeyEnrollmentContext\";\nimport { PasskeyManagementPersistence } from \"./PasskeyManagementPersistence\";\nimport { PasskeyManagementPolicy, type PasskeyMethodPolicy } from \"./policy\";\nimport { snapshotPasskey, snapshotPasskeySync } from \"./snapshot\";\n\nconst enrollmentDecision = Schema.Union([\n  Schema.TaggedStruct(\"Enrolled\", { credential: PasskeyCredentialSummary }),\n  Schema.TaggedStruct(\"Rejected\", {}),\n]);\n\nconst removeInspection = Schema.Union([\n  Schema.TaggedStruct(\"Target\", { credential: PasskeyCredential }),\n  Schema.TaggedStruct(\"Replay\", { result: PasskeyRemoved }),\n  Schema.TaggedStruct(\"Rejected\", {}),\n]);\n\nconst removeDecision = Schema.Union([\n  Schema.TaggedStruct(\"Removed\", { result: PasskeyRemoved }),\n  Schema.TaggedStruct(\"Rejected\", {}),\n  Schema.TaggedStruct(\"LastSignInMethod\", {}),\n]);\n\nconst renameDecision = Schema.Union([\n  Schema.TaggedStruct(\"Renamed\", {\n    credential: PasskeyCredentialSummary,\n    replayed: Schema.Boolean,\n  }),\n  Schema.TaggedStruct(\"Rejected\", {}),\n]);\n\nconst subject = Effect.fn(\"PasskeyManagement.subject\")(function* (invocation: AuthInvocation) {\n  yield* passkeyNoAmbient();\n  if (invocation._tag !== \"Authenticated\") return yield* PasskeyRejected.make({});\n\n  return invocation.subjectId;\n}, passkeyUnexpected);\n\nexport const makePasskeyManagement = <\n  const Id extends string,\n  const SessionId extends string,\n  Claims extends Schema.Codec<unknown, unknown, unknown, unknown>,\n>(\n  moduleId: Id,\n  source: Effect.Effect<PasskeyMethodPolicy, PasskeyConfigurationError>,\n  input: PasskeyManagementPolicy,\n  sessions: ReturnType<typeof makeSessionModule<SessionId, Claims>>,\n) => {\n  const captured = (() => {\n    try {\n      return Effect.succeed(snapshotPasskeySync(PasskeyManagementPolicy, input));\n    } catch {\n      return Effect.fail(PasskeyConfigurationError.make({}));\n    }\n  })();\n\n  const ceremony = makePasskeyCeremony(moduleId, source, \"enrollment\");\n\n  const {\n    BeginInput,\n    CompleteInput,\n    ListInput,\n    RenameInput,\n    RemoveInput,\n    Failure,\n    listResult,\n    operations: { Begin, Complete, List, Rename, Remove },\n  } = makePasskeyManagementContract(moduleId);\n\n  type Failure = typeof Failure.Type;\n\n  const Management = Context.Service<\n    { readonly moduleId: Id; readonly kind: \"passkey-management\" },\n    {\n      readonly begin: (\n        invocation: AuthInvocation,\n        input: typeof BeginInput.Type,\n      ) => Effect.Effect<\n        AuthOperationResult<typeof PasskeyRegistrationStarted.Type>,\n        PasskeyFailure\n      >;\n      readonly complete: (\n        invocation: AuthInvocation,\n        input: typeof CompleteInput.Type,\n      ) => Effect.Effect<AuthOperationResult<typeof PasskeyEnrolled.Type>, PasskeyFailure>;\n      readonly list: (\n        invocation: AuthInvocation,\n        input: typeof ListInput.Type,\n      ) => Effect.Effect<typeof listResult.Type, PasskeyFailure>;\n      readonly rename: (\n        invocation: AuthInvocation,\n        input: typeof RenameInput.Type,\n      ) => Effect.Effect<\n        { readonly credential: typeof PasskeyCredentialSummary.Type; readonly replayed: boolean },\n        PasskeyFailure\n      >;\n      readonly remove: (\n        invocation: AuthInvocation,\n        input: typeof RemoveInput.Type,\n      ) => Effect.Effect<typeof PasskeyRemoved.Type, Failure>;\n    }\n  >(`effect-auth/PasskeyManagement/${moduleId.length}:${moduleId}`);\n\n  const layer = Layer.effect(\n    Management,\n    Effect.gen(function* () {\n      const policy = yield* captured,\n        runtime = yield* ceremony.make,\n        persistence = yield* PasskeyManagementPersistence,\n        context = yield* PasskeyEnrollmentContext,\n        actions = yield* PasskeyActionEvidence,\n        strategy = yield* sessions.SessionStrategy,\n        crypto = yield* Crypto.Crypto,\n        hooks = yield* LifecycleHooks;\n\n      if (\n        policy.requireImmediateInvalidation &&\n        strategy.capabilities.subjectInvalidation !== \"immediate\"\n      )\n        return yield* PasskeyConfigurationError.make({});\n\n      const invalidation = sessionInvalidationWindow(\n        \"credential-change\",\n        strategy.capabilities,\n        strategy.policy,\n      );\n\n      const digest = <S extends Schema.Codec<unknown, unknown, never, never>>(\n        schema: S,\n        value: S[\"Type\"],\n      ) =>\n        Schema.encodeEffect(Schema.fromJsonString(Schema.toCodecJson(Schema.toType(schema))))(\n          value,\n        ).pipe(\n          Effect.flatMap((encoded) => crypto.digest(\"SHA-256\", new TextEncoder().encode(encoded))),\n          Effect.map((bytes) => TokenDigest.make(Encoding.encodeBase64Url(bytes))),\n          Effect.mapError(() => PasskeyUnavailable.make({})),\n        );\n\n      const authorize = Effect.fn(\"PasskeyManagement.authorize\")(function* (\n        invocation: AuthInvocation,\n        challenge: PasskeyActionChallenge,\n        actionProof: typeof BeginInput.Type.actionProof,\n      ) {\n        const answer = yield* actions.verify({\n          invocation,\n          challenge,\n          ...(actionProof === undefined ? {} : { proof: actionProof }),\n        });\n\n        const authorization = yield* snapshotPasskey(PasskeyActionAuthorization, {\n          challenge,\n          ...answer,\n        });\n\n        const evidence = authorization.evidence,\n          now = yield* DateTime.now;\n\n        if (\n          String(evidence.flowId) !== String(challenge.flowId) ||\n          evidence.bindingDigest !== challenge.bindingDigest ||\n          evidence.revision.subjectId !== challenge.revision.subjectId ||\n          evidence.revision.securityRevision !== challenge.revision.securityRevision ||\n          challenge.revision.credentials.some(\n            (original) =>\n              !evidence.revision.credentials.some(\n                (current) =>\n                  current.credentialId === original.credentialId &&\n                  current.revision === original.revision,\n              ),\n          )\n        )\n          return yield* PasskeyActionRequired.make({});\n\n        const assessment = yield* assessAuthentication(evidence, authorization.requirement).pipe(\n          Effect.mapError(() => PasskeyActionRequired.make({})),\n        );\n\n        if (\n          !assessment.satisfied ||\n          evidence.proofs.some(\n            (item) =>\n              DateTime.toEpochMillis(now) - DateTime.toEpochMillis(item.verifiedAt) >\n              policy.maximumEvidenceAgeMillis,\n          )\n        )\n          return yield* PasskeyActionRequired.make({});\n\n        return authorization;\n      }, passkeyUnexpected);\n\n      const event = (\n        operation: string,\n        commandId: string,\n        subjectId: typeof PasskeyCredential.Type.revision.subjectId,\n        nowMillis: number,\n      ) =>\n        lifecycleEvent({\n          id: LifecycleEventId.make(`passkey/${moduleId}/${operation}/${commandId}`),\n          occurredAtMillis: nowMillis,\n          snapshot: lifecycleSnapshot({\n            action: \"credential-change\",\n            operation: `${moduleId}/passkey/${operation}`,\n            subjectId,\n            method: \"passkey\",\n            identifiers: [],\n          }),\n        });\n\n      return Management.of({\n        begin: Effect.fn(\"PasskeyManagement.begin\")(\n          function* (invocation, input) {\n            input = yield* snapshotPasskey(Schema.toType(BeginInput), input);\n\n            const subjectId = yield* subject(invocation),\n              selected = yield* runtime.profile(input.profileId),\n              captured = yield* context.capture({ moduleId, rpId: selected.rpId, subjectId });\n\n            if (\n              captured === undefined ||\n              captured.revision.subjectId !== subjectId ||\n              captured.credentials.length >= policy.maximumCredentials\n            )\n              return yield* PasskeyRejected.make({});\n            const fixedCapture = yield* snapshotPasskey(PasskeyEnrollmentSnapshot, captured);\n\n            const userHandle =\n              fixedCapture.userHandle ?? PasskeyUserHandle.make(yield* runtime.random());\n\n            const challenge = yield* snapshotPasskey(PasskeyActionChallenge, {\n              moduleId,\n              action: \"enroll-begin\",\n              commandId: input.commandId,\n              flowId: input.flowId,\n              revision: fixedCapture.revision,\n              bindingDigest: yield* digest(\n                Schema.Tuple([\n                  PasskeyModuleId,\n                  Schema.Literal(\"enrollment\"),\n                  Schema.Struct({ ...PasskeyBegin.fields, name: PasskeyLabel }),\n                  PasskeyProfile,\n                  PasskeyRevision,\n                  PasskeyUserHandle,\n                  Schema.Array(PasskeyDescriptor),\n                ]),\n                [\n                  moduleId,\n                  \"enrollment\",\n                  input,\n                  selected,\n                  fixedCapture.revision,\n                  userHandle,\n                  fixedCapture.credentials,\n                ],\n              ),\n            });\n\n            const authorization = yield* authorize(invocation, challenge, input.actionProof);\n\n            const draft = yield* runtime.prepareRegistration(\n              input,\n              {\n                _tag: \"Enrollment\",\n                revision: fixedCapture.revision,\n                userHandle,\n                name: input.name,\n                authorization,\n              },\n              fixedCapture.credentials,\n            );\n\n            const authority = yield* PasskeyManagementPersistence;\n\n            const issued = yield* readPasskeyCommit(\n              yield* authority.issueEnrollment(\n                {\n                  ceremony: draft.ceremony,\n                  policy: runtime.policy,\n                  management: policy,\n                  authorization,\n                },\n                (value, journal) =>\n                  journal.prepare(snapshotPasskeySync(PasskeyIssueDecision, value)),\n              ),\n            );\n\n            return yield* runtime.acceptRegistrationIssue(draft, issued);\n          },\n          passkeyUnexpected,\n          Effect.provideService(PasskeyManagementPersistence, persistence),\n        ),\n        complete: Effect.fn(\"PasskeyManagement.complete\")(\n          function* (invocation, input) {\n            input = yield* snapshotPasskey(Schema.toType(CompleteInput), input);\n\n            const subjectId = yield* subject(invocation),\n              inspected = yield* runtime.inspect(input);\n\n            const original = inspected.ceremony.context;\n\n            if (original._tag !== \"Enrollment\" || original.revision.subjectId !== subjectId)\n              return yield* PasskeyRejected.make({});\n\n            const challenge = yield* snapshotPasskey(PasskeyActionChallenge, {\n              moduleId,\n              action: \"enroll-complete\",\n              commandId: inspected.ceremony.commandId,\n              flowId: input.flowId,\n              revision: original.revision,\n              bindingDigest: yield* digest(PasskeyCeremony, inspected.ceremony),\n            });\n\n            const authorization = yield* authorize(invocation, challenge, input.actionProof);\n\n            const assessment = yield* assessAuthentication(\n              authorization.evidence,\n              original.authorization.requirement,\n            ).pipe(Effect.mapError(() => PasskeyActionRequired.make({})));\n\n            if (!assessment.satisfied) return yield* PasskeyActionRequired.make({});\n            const { claim, verified } = yield* runtime.verifyRegistration(input, original);\n            const authority = yield* PasskeyManagementPersistence;\n            const timestamp = DateTime.toEpochMillis(yield* DateTime.now);\n\n            const result = yield* readPasskeyCommit(\n              yield* authority.completeEnrollment(\n                {\n                  claim,\n                  verified,\n                  authorization,\n                  management: policy,\n                  invalidation,\n                  nowMillis: timestamp,\n                },\n                (value, journal) => {\n                  const projected = snapshotPasskeySync(enrollmentDecision, value);\n\n                  if (projected._tag === \"Enrolled\")\n                    journal.stage(\n                      event(\"enrollment\", claim.ceremony.commandId, subjectId, timestamp),\n                    );\n\n                  return journal.prepare(projected);\n                },\n              ),\n            );\n\n            if (result._tag !== \"Enrolled\") return yield* PasskeyRejected.make({});\n\n            return {\n              value: { credential: result.credential, invalidation },\n              credentialCommands: [runtime.clear],\n            };\n          },\n          passkeyUnexpected,\n          Effect.provideService(PasskeyManagementPersistence, persistence),\n        ),\n        list: Effect.fn(\"PasskeyManagement.list\")(function* (invocation, input) {\n          const subjectId = yield* subject(invocation);\n          const request = yield* snapshotPasskey(ListInput, input);\n\n          return yield* snapshotPasskey(\n            listResult,\n            yield* persistence.list({ moduleId, subjectId, ...request }),\n          );\n        }, passkeyUnexpected),\n        rename: Effect.fn(\"PasskeyManagement.rename\")(function* (invocation, input) {\n          const subjectId = yield* subject(invocation),\n            request = yield* snapshotPasskey(RenameInput, input),\n            timestamp = DateTime.toEpochMillis(yield* DateTime.now);\n\n          yield* hooks.before(event(\"rename\", request.commandId, subjectId, timestamp).snapshot);\n\n          const result = yield* readPasskeyCommit(\n            yield* persistence.rename(\n              {\n                moduleId,\n                subjectId,\n                ...request,\n                nowMillis: timestamp,\n                retentionUntilMillis: timestamp + runtime.policy.retentionMillis,\n              },\n              (value, journal) => {\n                const projected = snapshotPasskeySync(renameDecision, value);\n\n                if (projected._tag === \"Renamed\" && !projected.replayed)\n                  journal.stage(event(\"rename\", request.commandId, subjectId, timestamp));\n\n                return journal.prepare(projected);\n              },\n            ),\n          );\n\n          if (result._tag !== \"Renamed\" || result.credential.credentialId !== request.credentialId)\n            return yield* PasskeyRejected.make({});\n\n          return { credential: result.credential, replayed: result.replayed };\n        }, passkeyUnexpected),\n        remove: Effect.fn(\"PasskeyManagement.remove\")(function* (invocation, input) {\n          const subjectId = yield* subject(invocation),\n            request = yield* snapshotPasskey(Schema.toType(RemoveInput), input);\n\n          const inspected = yield* snapshotPasskey(\n            removeInspection,\n            yield* persistence.inspectRemove({\n              moduleId,\n              subjectId,\n              commandId: request.commandId,\n              credentialId: request.credentialId,\n            }),\n          );\n\n          if (inspected._tag === \"Rejected\") return yield* PasskeyRejected.make({});\n          if (inspected._tag === \"Replay\") {\n            if (\n              inspected.result.credentialId !== request.credentialId ||\n              !inspected.result.replayed\n            )\n              return yield* PasskeyUnavailable.make({});\n\n            return inspected.result;\n          }\n          if (\n            inspected.credential.revision.subjectId !== subjectId ||\n            inspected.credential.credentialId !== request.credentialId\n          )\n            return yield* PasskeyRejected.make({});\n\n          const challenge = yield* snapshotPasskey(PasskeyActionChallenge, {\n            moduleId,\n            action: \"remove\",\n            commandId: request.commandId,\n            flowId: Schema.decodeSync(PasskeyBegin.fields.flowId)(request.commandId),\n            revision: inspected.credential.revision,\n            bindingDigest: yield* digest(\n              Schema.Tuple([\n                PasskeyModuleId,\n                Schema.Literal(\"remove\"),\n                PasskeyBegin.fields.commandId,\n                PasskeyCredential,\n              ]),\n              [moduleId, \"remove\", request.commandId, inspected.credential],\n            ),\n          });\n\n          const authorization = yield* authorize(invocation, challenge, request.actionProof),\n            timestamp = DateTime.toEpochMillis(yield* DateTime.now);\n\n          yield* hooks.before(event(\"remove\", request.commandId, subjectId, timestamp).snapshot);\n\n          const result = yield* readPasskeyCommit(\n            yield* persistence.remove(\n              {\n                moduleId,\n                commandId: request.commandId,\n                credential: inspected.credential,\n                authorization,\n                management: policy,\n                invalidation,\n                nowMillis: timestamp,\n                retentionUntilMillis: timestamp + runtime.policy.retentionMillis,\n              },\n              (value, journal) => {\n                const projected = snapshotPasskeySync(removeDecision, value);\n\n                if (projected._tag === \"Removed\" && !projected.result.replayed)\n                  journal.stage(event(\"remove\", request.commandId, subjectId, timestamp));\n\n                return journal.prepare(projected);\n              },\n            ),\n          );\n\n          if (result._tag === \"LastSignInMethod\") return yield* LastSignInMethod.make({});\n          if (result._tag !== \"Removed\" || result.result.credentialId !== request.credentialId)\n            return yield* PasskeyRejected.make({});\n\n          return result.result;\n        }, passkeyUnexpected),\n      });\n    }),\n  );\n\n  return Object.freeze({\n    Management,\n    binding: ceremony.binding,\n    layer,\n    operations: Object.freeze({ Begin, Complete, List, Rename, Remove }),\n    group: operationGroup(Begin, Complete, List, Rename, Remove),\n    handlersLayer: Layer.mergeAll(\n      Begin.credentialHandlerLayer((input, invocation) =>\n        Effect.flatMap(Management, (service) => service.begin(invocation, input)),\n      ),\n      Complete.credentialHandlerLayer((input, invocation) =>\n        Effect.flatMap(Management, (service) => service.complete(invocation, input)),\n      ),\n      List.handlerLayer((input, invocation) =>\n        Effect.flatMap(Management, (service) => service.list(invocation, input)),\n      ),\n      Rename.handlerLayer((input, invocation) =>\n        Effect.flatMap(Management, (service) => service.rename(invocation, input)),\n      ),\n      Remove.handlerLayer((input, invocation) =>\n        Effect.flatMap(Management, (service) => service.remove(invocation, input)),\n      ),\n    ),\n  });\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AAkDA,MAAM,qBAAqB,OAAO,MAAM,CACtC,OAAO,aAAa,YAAY,EAAE,YAAY,yBAAyB,CAAC,GACxE,OAAO,aAAa,YAAY,CAAC,CAAC,CACpC,CAAC;AAED,MAAM,mBAAmB,OAAO,MAAM;CACpC,OAAO,aAAa,UAAU,EAAE,YAAY,kBAAkB,CAAC;CAC/D,OAAO,aAAa,UAAU,EAAE,QAAQ,eAAe,CAAC;CACxD,OAAO,aAAa,YAAY,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,iBAAiB,OAAO,MAAM;CAClC,OAAO,aAAa,WAAW,EAAE,QAAQ,eAAe,CAAC;CACzD,OAAO,aAAa,YAAY,CAAC,CAAC;CAClC,OAAO,aAAa,oBAAoB,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,iBAAiB,OAAO,MAAM,CAClC,OAAO,aAAa,WAAW;CAC7B,YAAY;CACZ,UAAU,OAAO;AACnB,CAAC,GACD,OAAO,aAAa,YAAY,CAAC,CAAC,CACpC,CAAC;AAED,MAAM,UAAU,OAAO,GAAG,2BAA2B,CAAC,CAAC,WAAW,YAA4B;CAC5F,OAAO,iBAAiB;CACxB,IAAI,WAAW,SAAS,iBAAiB,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;CAE9E,OAAO,WAAW;AACpB,GAAG,iBAAiB;AAEpB,MAAa,yBAKX,UACA,QACA,OACA,aACG;CACH,MAAM,kBAAkB;EACtB,IAAI;GACF,OAAO,OAAO,QAAQ,oBAAoB,yBAAyB,KAAK,CAAC;EAC3E,QAAQ;GACN,OAAO,OAAO,KAAK,0BAA0B,KAAK,CAAC,CAAC,CAAC;EACvD;CACF,EAAA,CAAG;CAEH,MAAM,WAAW,oBAAoB,UAAU,QAAQ,YAAY;CAEnE,MAAM,EACJ,YACA,eACA,WACA,aACA,aACA,SACA,YACA,YAAY,EAAE,OAAO,UAAU,MAAM,QAAQ,aAC3C,8BAA8B,QAAQ;CAI1C,MAAM,aAAa,QAAQ,QA8BzB,iCAAiC,SAAS,OAAO,GAAG,UAAU;CAEhE,MAAM,QAAQ,MAAM,OAClB,YACA,OAAO,IAAI,aAAa;EACtB,MAAM,SAAS,OAAO,UACpB,UAAU,OAAO,SAAS,MAC1B,cAAc,OAAO,8BACrB,UAAU,OAAO,0BACjB,UAAU,OAAO,uBACjB,WAAW,OAAO,SAAS,iBAC3B,SAAS,OAAO,OAAO,QACvB,QAAQ,OAAO;EAEjB,IACE,OAAO,gCACP,SAAS,aAAa,wBAAwB,aAE9C,OAAO,OAAO,0BAA0B,KAAK,CAAC,CAAC;EAEjD,MAAM,eAAe,0BACnB,qBACA,SAAS,cACT,SAAS,MACX;EAEA,MAAM,UACJ,QACA,UAEA,OAAO,aAAa,OAAO,eAAe,OAAO,YAAY,OAAO,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CACnF,KACF,CAAC,CAAC,KACA,OAAO,SAAS,YAAY,OAAO,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,GACvF,OAAO,KAAK,UAAU,YAAY,KAAK,SAAS,gBAAgB,KAAK,CAAC,CAAC,GACvE,OAAO,eAAe,mBAAmB,KAAK,CAAC,CAAC,CAAC,CACnD;EAEF,MAAM,YAAY,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACzD,YACA,WACA,aACA;GACA,MAAM,SAAS,OAAO,QAAQ,OAAO;IACnC;IACA;IACA,GAAI,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,YAAY;GAC5D,CAAC;GAED,MAAM,gBAAgB,OAAO,gBAAgB,4BAA4B;IACvE;IACA,GAAG;GACL,CAAC;GAED,MAAM,WAAW,cAAc,UAC7B,MAAM,OAAO,SAAS;GAExB,IACE,OAAO,SAAS,MAAM,MAAM,OAAO,UAAU,MAAM,KACnD,SAAS,kBAAkB,UAAU,iBACrC,SAAS,SAAS,cAAc,UAAU,SAAS,aACnD,SAAS,SAAS,qBAAqB,UAAU,SAAS,oBAC1D,UAAU,SAAS,YAAY,MAC5B,aACC,CAAC,SAAS,SAAS,YAAY,MAC5B,YACC,QAAQ,iBAAiB,SAAS,gBAClC,QAAQ,aAAa,SAAS,QAClC,CACJ,GAEA,OAAO,OAAO,sBAAsB,KAAK,CAAC,CAAC;GAM7C,IACE,EAAC,OALuB,qBAAqB,UAAU,cAAc,WAAW,CAAC,CAAC,KAClF,OAAO,eAAe,sBAAsB,KAAK,CAAC,CAAC,CAAC,CACtD,EAAA,CAGc,aACZ,SAAS,OAAO,MACb,SACC,SAAS,cAAc,GAAG,IAAI,SAAS,cAAc,KAAK,UAAU,IACpE,OAAO,wBACX,GAEA,OAAO,OAAO,sBAAsB,KAAK,CAAC,CAAC;GAE7C,OAAO;EACT,GAAG,iBAAiB;EAEpB,MAAM,SACJ,WACA,WACA,WACA,cAEA,eAAe;GACb,IAAI,iBAAiB,KAAK,WAAW,SAAS,GAAG,UAAU,GAAG,WAAW;GACzE,kBAAkB;GAClB,UAAU,kBAAkB;IAC1B,QAAQ;IACR,WAAW,GAAG,SAAS,WAAW;IAClC;IACA,QAAQ;IACR,aAAa,CAAC;GAChB,CAAC;EACH,CAAC;EAEH,OAAO,WAAW,GAAG;GACnB,OAAO,OAAO,GAAG,yBAAyB,CAAC,CACzC,WAAW,YAAY,OAAO;IAC5B,QAAQ,OAAO,gBAAgB,OAAO,OAAO,UAAU,GAAG,KAAK;IAE/D,MAAM,YAAY,OAAO,QAAQ,UAAU,GACzC,WAAW,OAAO,QAAQ,QAAQ,MAAM,SAAS,GACjD,WAAW,OAAO,QAAQ,QAAQ;KAAE;KAAU,MAAM,SAAS;KAAM;IAAU,CAAC;IAEhF,IACE,aAAa,KAAA,KACb,SAAS,SAAS,cAAc,aAChC,SAAS,YAAY,UAAU,OAAO,oBAEtC,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;IACvC,MAAM,eAAe,OAAO,gBAAgB,2BAA2B,QAAQ;IAE/E,MAAM,aACJ,aAAa,cAAc,kBAAkB,KAAK,OAAO,QAAQ,OAAO,CAAC;IAE3E,MAAM,YAAY,OAAO,gBAAgB,wBAAwB;KAC/D;KACA,QAAQ;KACR,WAAW,MAAM;KACjB,QAAQ,MAAM;KACd,UAAU,aAAa;KACvB,eAAe,OAAO,OACpB,OAAO,MAAM;MACX;MACA,OAAO,QAAQ,YAAY;MAC3B,OAAO,OAAO;OAAE,GAAG,aAAa;OAAQ,MAAM;MAAa,CAAC;MAC5D;MACA;MACA;MACA,OAAO,MAAM,iBAAiB;KAChC,CAAC,GACD;MACE;MACA;MACA;MACA;MACA,aAAa;MACb;MACA,aAAa;KACf,CACF;IACF,CAAC;IAED,MAAM,gBAAgB,OAAO,UAAU,YAAY,WAAW,MAAM,WAAW;IAE/E,MAAM,QAAQ,OAAO,QAAQ,oBAC3B,OACA;KACE,MAAM;KACN,UAAU,aAAa;KACvB;KACA,MAAM,MAAM;KACZ;IACF,GACA,aAAa,WACf;IAEA,MAAM,YAAY,OAAO;IAEzB,MAAM,SAAS,OAAO,kBACpB,OAAO,UAAU,gBACf;KACE,UAAU,MAAM;KAChB,QAAQ,QAAQ;KAChB,YAAY;KACZ;IACF,IACC,OAAO,YACN,QAAQ,QAAQ,oBAAoB,sBAAsB,KAAK,CAAC,CACpE,CACF;IAEA,OAAO,OAAO,QAAQ,wBAAwB,OAAO,MAAM;GAC7D,GACA,mBACA,OAAO,eAAe,8BAA8B,WAAW,CACjE;GACA,UAAU,OAAO,GAAG,4BAA4B,CAAC,CAC/C,WAAW,YAAY,OAAO;IAC5B,QAAQ,OAAO,gBAAgB,OAAO,OAAO,aAAa,GAAG,KAAK;IAElE,MAAM,YAAY,OAAO,QAAQ,UAAU,GACzC,YAAY,OAAO,QAAQ,QAAQ,KAAK;IAE1C,MAAM,WAAW,UAAU,SAAS;IAEpC,IAAI,SAAS,SAAS,gBAAgB,SAAS,SAAS,cAAc,WACpE,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;IAEvC,MAAM,YAAY,OAAO,gBAAgB,wBAAwB;KAC/D;KACA,QAAQ;KACR,WAAW,UAAU,SAAS;KAC9B,QAAQ,MAAM;KACd,UAAU,SAAS;KACnB,eAAe,OAAO,OAAO,iBAAiB,UAAU,QAAQ;IAClE,CAAC;IAED,MAAM,gBAAgB,OAAO,UAAU,YAAY,WAAW,MAAM,WAAW;IAO/E,IAAI,EAAC,OALqB,qBACxB,cAAc,UACd,SAAS,cAAc,WACzB,CAAC,CAAC,KAAK,OAAO,eAAe,sBAAsB,KAAK,CAAC,CAAC,CAAC,CAAC,EAAA,CAE5C,WAAW,OAAO,OAAO,sBAAsB,KAAK,CAAC,CAAC;IACtE,MAAM,EAAE,OAAO,aAAa,OAAO,QAAQ,mBAAmB,OAAO,QAAQ;IAC7E,MAAM,YAAY,OAAO;IACzB,MAAM,YAAY,SAAS,cAAc,OAAO,SAAS,GAAG;IAE5D,MAAM,SAAS,OAAO,kBACpB,OAAO,UAAU,mBACf;KACE;KACA;KACA;KACA,YAAY;KACZ;KACA,WAAW;IACb,IACC,OAAO,YAAY;KAClB,MAAM,YAAY,oBAAoB,oBAAoB,KAAK;KAE/D,IAAI,UAAU,SAAS,YACrB,QAAQ,MACN,MAAM,cAAc,MAAM,SAAS,WAAW,WAAW,SAAS,CACpE;KAEF,OAAO,QAAQ,QAAQ,SAAS;IAClC,CACF,CACF;IAEA,IAAI,OAAO,SAAS,YAAY,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;IAErE,OAAO;KACL,OAAO;MAAE,YAAY,OAAO;MAAY;KAAa;KACrD,oBAAoB,CAAC,QAAQ,KAAK;IACpC;GACF,GACA,mBACA,OAAO,eAAe,8BAA8B,WAAW,CACjE;GACA,MAAM,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAAW,YAAY,OAAO;IACtE,MAAM,YAAY,OAAO,QAAQ,UAAU;IAC3C,MAAM,UAAU,OAAO,gBAAgB,WAAW,KAAK;IAEvD,OAAO,OAAO,gBACZ,YACA,OAAO,YAAY,KAAK;KAAE;KAAU;KAAW,GAAG;IAAQ,CAAC,CAC7D;GACF,GAAG,iBAAiB;GACpB,QAAQ,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAAW,YAAY,OAAO;IAC1E,MAAM,YAAY,OAAO,QAAQ,UAAU,GACzC,UAAU,OAAO,gBAAgB,aAAa,KAAK,GACnD,YAAY,SAAS,cAAc,OAAO,SAAS,GAAG;IAExD,OAAO,MAAM,OAAO,MAAM,UAAU,QAAQ,WAAW,WAAW,SAAS,CAAC,CAAC,QAAQ;IAErF,MAAM,SAAS,OAAO,kBACpB,OAAO,YAAY,OACjB;KACE;KACA;KACA,GAAG;KACH,WAAW;KACX,sBAAsB,YAAY,QAAQ,OAAO;IACnD,IACC,OAAO,YAAY;KAClB,MAAM,YAAY,oBAAoB,gBAAgB,KAAK;KAE3D,IAAI,UAAU,SAAS,aAAa,CAAC,UAAU,UAC7C,QAAQ,MAAM,MAAM,UAAU,QAAQ,WAAW,WAAW,SAAS,CAAC;KAExE,OAAO,QAAQ,QAAQ,SAAS;IAClC,CACF,CACF;IAEA,IAAI,OAAO,SAAS,aAAa,OAAO,WAAW,iBAAiB,QAAQ,cAC1E,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;IAEvC,OAAO;KAAE,YAAY,OAAO;KAAY,UAAU,OAAO;IAAS;GACpE,GAAG,iBAAiB;GACpB,QAAQ,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAAW,YAAY,OAAO;IAC1E,MAAM,YAAY,OAAO,QAAQ,UAAU,GACzC,UAAU,OAAO,gBAAgB,OAAO,OAAO,WAAW,GAAG,KAAK;IAEpE,MAAM,YAAY,OAAO,gBACvB,kBACA,OAAO,YAAY,cAAc;KAC/B;KACA;KACA,WAAW,QAAQ;KACnB,cAAc,QAAQ;IACxB,CAAC,CACH;IAEA,IAAI,UAAU,SAAS,YAAY,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;IACxE,IAAI,UAAU,SAAS,UAAU;KAC/B,IACE,UAAU,OAAO,iBAAiB,QAAQ,gBAC1C,CAAC,UAAU,OAAO,UAElB,OAAO,OAAO,mBAAmB,KAAK,CAAC,CAAC;KAE1C,OAAO,UAAU;IACnB;IACA,IACE,UAAU,WAAW,SAAS,cAAc,aAC5C,UAAU,WAAW,iBAAiB,QAAQ,cAE9C,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;IAEvC,MAAM,YAAY,OAAO,gBAAgB,wBAAwB;KAC/D;KACA,QAAQ;KACR,WAAW,QAAQ;KACnB,QAAQ,OAAO,WAAW,aAAa,OAAO,MAAM,CAAC,CAAC,QAAQ,SAAS;KACvE,UAAU,UAAU,WAAW;KAC/B,eAAe,OAAO,OACpB,OAAO,MAAM;MACX;MACA,OAAO,QAAQ,QAAQ;MACvB,aAAa,OAAO;MACpB;KACF,CAAC,GACD;MAAC;MAAU;MAAU,QAAQ;MAAW,UAAU;KAAU,CAC9D;IACF,CAAC;IAED,MAAM,gBAAgB,OAAO,UAAU,YAAY,WAAW,QAAQ,WAAW,GAC/E,YAAY,SAAS,cAAc,OAAO,SAAS,GAAG;IAExD,OAAO,MAAM,OAAO,MAAM,UAAU,QAAQ,WAAW,WAAW,SAAS,CAAC,CAAC,QAAQ;IAErF,MAAM,SAAS,OAAO,kBACpB,OAAO,YAAY,OACjB;KACE;KACA,WAAW,QAAQ;KACnB,YAAY,UAAU;KACtB;KACA,YAAY;KACZ;KACA,WAAW;KACX,sBAAsB,YAAY,QAAQ,OAAO;IACnD,IACC,OAAO,YAAY;KAClB,MAAM,YAAY,oBAAoB,gBAAgB,KAAK;KAE3D,IAAI,UAAU,SAAS,aAAa,CAAC,UAAU,OAAO,UACpD,QAAQ,MAAM,MAAM,UAAU,QAAQ,WAAW,WAAW,SAAS,CAAC;KAExE,OAAO,QAAQ,QAAQ,SAAS;IAClC,CACF,CACF;IAEA,IAAI,OAAO,SAAS,oBAAoB,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IAC9E,IAAI,OAAO,SAAS,aAAa,OAAO,OAAO,iBAAiB,QAAQ,cACtE,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;IAEvC,OAAO,OAAO;GAChB,GAAG,iBAAiB;EACtB,CAAC;CACH,CAAC,CACH;CAEA,OAAO,OAAO,OAAO;EACnB;EACA,SAAS,SAAS;EAClB;EACA,YAAY,OAAO,OAAO;GAAE;GAAO;GAAU;GAAM;GAAQ;EAAO,CAAC;EACnE,OAAO,eAAe,OAAO,UAAU,MAAM,QAAQ,MAAM;EAC3D,eAAe,MAAM,SACnB,MAAM,wBAAwB,OAAO,eACnC,OAAO,QAAQ,aAAa,YAAY,QAAQ,MAAM,YAAY,KAAK,CAAC,CAC1E,GACA,SAAS,wBAAwB,OAAO,eACtC,OAAO,QAAQ,aAAa,YAAY,QAAQ,SAAS,YAAY,KAAK,CAAC,CAC7E,GACA,KAAK,cAAc,OAAO,eACxB,OAAO,QAAQ,aAAa,YAAY,QAAQ,KAAK,YAAY,KAAK,CAAC,CACzE,GACA,OAAO,cAAc,OAAO,eAC1B,OAAO,QAAQ,aAAa,YAAY,QAAQ,OAAO,YAAY,KAAK,CAAC,CAC3E,GACA,OAAO,cAAc,OAAO,eAC1B,OAAO,QAAQ,aAAa,YAAY,QAAQ,OAAO,YAAY,KAAK,CAAC,CAC3E,CACF;CACF,CAAC;AACH"}