@yielded/auth 0.1.0-beta.1

package/dist/phone/definition.mjs

@@ -0,0 +1,28 @@
+import { makePhoneOtp, snapshotPhoneConfiguration } from "./module.mjs";
+//#region src/phone/definition.ts
+/** Bind the phone method to its Auth definition; runtime authorities come from Layers. */
+const captureDefine = (_namespace, input) => {
+	return { options: snapshotPhoneConfiguration(input) };
+};
+const bindDefine = (binding, captured) => {
+	const { options } = captured;
+	return makePhoneOtp(binding.namespace, {
+		...options,
+		sessions: binding.sessions
+	});
+};
+const define = (namespace, input) => {
+	const captured = captureDefine(namespace, input);
+	const bind = (binding) => bindDefine(binding, captured);
+	return Object.freeze({
+		namespace,
+		bind
+	});
+};
+function make(options) {
+	return define(options.namespace, options);
+}
+//#endregion
+export { make };
+
+//# sourceMappingURL=definition.mjs.map

package/dist/phone/definition.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"definition.mjs","names":[],"sources":["../../src/phone/definition.ts"],"sourcesContent":["import type {\n  BindingOf,\n  ClaimsCodec,\n  StrategyBinding,\n  StrategyDefinition,\n  StrategyTypeLambda,\n} from \"../auth/definition\";\nimport { makePhoneOtp, snapshotPhoneConfiguration } from \"./module\";\n\nexport type PhoneOtpOptions<Namespace extends string | undefined = undefined> = Omit<\n  Parameters<typeof makePhoneOtp>[1],\n  \"sessions\"\n> & { readonly namespace?: Namespace };\n\n/** Bind the phone method to its Auth definition; runtime authorities come from Layers. */\nconst captureDefine = <const Namespace extends string | undefined>(\n  _namespace: Namespace,\n  input: PhoneOtpOptions<Namespace>,\n) => {\n  const options = snapshotPhoneConfiguration(input);\n\n  return { options };\n};\n\nconst bindDefine = <\n  const Namespace extends string | undefined,\n  Claims extends ClaimsCodec,\n  const Id extends string,\n  const SessionId extends string,\n>(\n  binding: StrategyBinding<Claims, Id, SessionId>,\n  captured: ReturnType<typeof captureDefine<Namespace>>,\n) => {\n  const { options } = captured;\n\n  return makePhoneOtp<Id, SessionId, Claims>(binding.namespace, {\n    ...options,\n    sessions: binding.sessions,\n  });\n};\n\nexport interface DefineStrategy<Namespace extends string | undefined> extends StrategyTypeLambda {\n  readonly type: ReturnType<\n    typeof bindDefine<\n      Namespace,\n      BindingOf<this>[\"claims\"],\n      BindingOf<this>[\"namespace\"],\n      BindingOf<this>[\"sessionNamespace\"]\n    >\n  >;\n}\n\nconst define = <const Namespace extends string | undefined>(\n  namespace: Namespace,\n  input: PhoneOtpOptions<Namespace>,\n) => {\n  const captured = captureDefine<Namespace>(namespace, input);\n\n  const bind = <\n    Claims extends ClaimsCodec,\n    const Id extends string,\n    const SessionId extends string,\n  >(\n    binding: StrategyBinding<Claims, Id, SessionId>,\n  ) => bindDefine<Namespace, Claims, Id, SessionId>(binding, captured);\n\n  const definition: StrategyDefinition<DefineStrategy<Namespace>, Namespace> = {\n    namespace,\n    bind,\n  };\n\n  return Object.freeze(definition);\n};\n\nexport function make<const Namespace extends string>(\n  options: PhoneOtpOptions<Namespace> & { readonly namespace: Namespace },\n): ReturnType<typeof define<Namespace>>;\n\nexport function make<const Namespace extends string | undefined = undefined>(\n  options: PhoneOtpOptions<Namespace>,\n): ReturnType<typeof define<Namespace | undefined>>;\n\nexport function make<const Namespace extends string | undefined>(\n  options: PhoneOtpOptions<Namespace>,\n) {\n  return define(options.namespace, options);\n}\n"],"mappings":";;;AAeA,MAAM,iBACJ,YACA,UACG;CAGH,OAAO,EAAE,SAFO,2BAA2B,KAE5B,EAAE;AACnB;AAEA,MAAM,cAMJ,SACA,aACG;CACH,MAAM,EAAE,YAAY;CAEpB,OAAO,aAAoC,QAAQ,WAAW;EAC5D,GAAG;EACH,UAAU,QAAQ;CACpB,CAAC;AACH;AAaA,MAAM,UACJ,WACA,UACG;CACH,MAAM,WAAW,cAAyB,WAAW,KAAK;CAE1D,MAAM,QAKJ,YACG,WAA6C,SAAS,QAAQ;CAOnE,OAAO,OAAO,OAAO;EAJnB;EACA;CAG4B,CAAC;AACjC;AAUA,SAAgB,KACd,SACA;CACA,OAAO,OAAO,QAAQ,WAAW,OAAO;AAC1C"}

package/dist/phone/failure.mjs

@@ -0,0 +1,23 @@
+import { HookDenied } from "../hooks/models.mjs";
+import { PendingAuthenticationInvalid, SessionConflict, SessionInvalid, StaleAuthentication } from "../sessions/errors.mjs";
+import { ProofInvalid, ProofRequestConflict } from "../proofs/errors.mjs";
+import { RequestBindingInvalid } from "../operations/requestBinding.mjs";
+import { PhoneOtpRejected, PhoneOtpUnavailable } from "./models.mjs";
+import { PhoneActionRequired } from "./lifecycleModels.mjs";
+import { Schema } from "effect";
+//#region src/phone/failure.ts
+/** An unavailable/ambiguous commit cannot truthfully be reported as rejected. */
+const phoneFailure = (error) => {
+	if (Schema.is(HookDenied)(error)) return error;
+	if (Schema.is(PhoneOtpUnavailable)(error)) return error;
+	if (Schema.is(PhoneOtpRejected)(error) || Schema.is(RequestBindingInvalid)(error) || Schema.is(ProofInvalid)(error) || Schema.is(ProofRequestConflict)(error) || Schema.is(StaleAuthentication)(error) || Schema.is(PendingAuthenticationInvalid)(error) || Schema.is(SessionInvalid)(error) || Schema.is(SessionConflict)(error)) return PhoneOtpRejected.make({});
+	return PhoneOtpUnavailable.make({});
+};
+const phoneActionFailure = (error) => {
+	const failure = phoneFailure(error);
+	return failure._tag === "PhoneOtpRejected" ? PhoneActionRequired.make({}) : failure;
+};
+//#endregion
+export { phoneActionFailure, phoneFailure };
+
+//# sourceMappingURL=failure.mjs.map

package/dist/phone/failure.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"failure.mjs","names":[],"sources":["../../src/phone/failure.ts"],"sourcesContent":["import { Schema } from \"effect\";\n\nimport { HookDenied } from \"../hooks/models\";\nimport { RequestBindingInvalid } from \"../operations/requestBinding\";\nimport { ProofInvalid, ProofRequestConflict } from \"../proofs/errors\";\nimport {\n  PendingAuthenticationInvalid,\n  SessionConflict,\n  SessionInvalid,\n  StaleAuthentication,\n} from \"../sessions/errors\";\nimport { PhoneActionRequired } from \"./lifecycleModels\";\nimport { PhoneOtpRejected, PhoneOtpUnavailable } from \"./models\";\n\n/** An unavailable/ambiguous commit cannot truthfully be reported as rejected. */\nexport const phoneFailure = (\n  error: unknown,\n): PhoneOtpRejected | PhoneOtpUnavailable | HookDenied => {\n  if (Schema.is(HookDenied)(error)) return error;\n  if (Schema.is(PhoneOtpUnavailable)(error)) return error;\n  if (\n    Schema.is(PhoneOtpRejected)(error) ||\n    Schema.is(RequestBindingInvalid)(error) ||\n    Schema.is(ProofInvalid)(error) ||\n    Schema.is(ProofRequestConflict)(error) ||\n    Schema.is(StaleAuthentication)(error) ||\n    Schema.is(PendingAuthenticationInvalid)(error) ||\n    Schema.is(SessionInvalid)(error) ||\n    Schema.is(SessionConflict)(error)\n  )\n    return PhoneOtpRejected.make({});\n\n  return PhoneOtpUnavailable.make({});\n};\n\nexport const phoneActionFailure = (error: unknown) => {\n  const failure = phoneFailure(error);\n\n  return failure._tag === \"PhoneOtpRejected\" ? PhoneActionRequired.make({}) : failure;\n};\n"],"mappings":";;;;;;;;;AAeA,MAAa,gBACX,UACwD;CACxD,IAAI,OAAO,GAAG,UAAU,CAAC,CAAC,KAAK,GAAG,OAAO;CACzC,IAAI,OAAO,GAAG,mBAAmB,CAAC,CAAC,KAAK,GAAG,OAAO;CAClD,IACE,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,qBAAqB,CAAC,CAAC,KAAK,KACtC,OAAO,GAAG,YAAY,CAAC,CAAC,KAAK,KAC7B,OAAO,GAAG,oBAAoB,CAAC,CAAC,KAAK,KACrC,OAAO,GAAG,mBAAmB,CAAC,CAAC,KAAK,KACpC,OAAO,GAAG,4BAA4B,CAAC,CAAC,KAAK,KAC7C,OAAO,GAAG,cAAc,CAAC,CAAC,KAAK,KAC/B,OAAO,GAAG,eAAe,CAAC,CAAC,KAAK,GAEhC,OAAO,iBAAiB,KAAK,CAAC,CAAC;CAEjC,OAAO,oBAAoB,KAAK,CAAC,CAAC;AACpC;AAEA,MAAa,sBAAsB,UAAmB;CACpD,MAAM,UAAU,aAAa,KAAK;CAElC,OAAO,QAAQ,SAAS,qBAAqB,oBAAoB,KAAK,CAAC,CAAC,IAAI;AAC9E"}

package/dist/phone/lifecycle.mjs

@@ -0,0 +1,427 @@
+import { TokenDigest } from "../Schema.mjs";
+import { LoginIdentifier } from "../identity/models.mjs";
+import { LifecycleEventId, lifecycleEvent, lifecycleSnapshot } from "../hooks/models.mjs";
+import { makeOperation, operationGroup } from "../operations/operation.mjs";
+import { SessionInvalidationWindow, sessionInvalidationWindow } from "../sessions/invalidation.mjs";
+import { AuthenticationFlowId, AuthenticationRequirement } from "../sessions/models.mjs";
+import { LifecycleHooks } from "../hooks/LifecycleHooks.mjs";
+import { cryptoLayer, defaultLayer, hooksLayer } from "../auth/defaults.mjs";
+import { hasCommitScope } from "../hooks/commit.mjs";
+import { assessAuthentication } from "../sessions/assurance.mjs";
+import { AuthenticationAuthority } from "../sessions/AuthenticationAuthority.mjs";
+import { ProofBinding, ProofCleanupResult, ProofPurpose, ProofReference, ProofRequestId, ProofRequestReceipt } from "../proofs/models.mjs";
+import { RequestBindingCredential, RequestBindingFlowId } from "../operations/requestBindingModels.mjs";
+import { makeRequestBinding } from "../operations/requestBinding.mjs";
+import { PhoneAdmission } from "./PhoneAdmission.mjs";
+import { PhonePersistence } from "./PhonePersistence.mjs";
+import { PhoneNumber, PhoneOtpRejected, PhoneOtpUnavailable } from "./models.mjs";
+import { PhoneActionChallenge, PhoneActionRequired, PhoneCommandId, PhoneConfigurationError, PhoneLifecycleAction, PhoneLifecycleFailure, PhoneLifecyclePolicy } from "./lifecycleModels.mjs";
+import { readProofCommit } from "../proofs/dispatch.mjs";
+import { makeProofModule } from "../proofs/module.mjs";
+import { phoneActionFailure, phoneFailure } from "./failure.mjs";
+import { PhoneActionEvidence } from "./PhoneActionEvidence.mjs";
+import { PhoneDeliveryEligibility } from "./PhoneDeliveryEligibility.mjs";
+import { PhoneRequestContext } from "./PhoneRequestContext.mjs";
+import { Crypto, DateTime, Effect, Encoding, Layer, Redacted, Schema } from "effect";
+//#region src/phone/lifecycle.ts
+const Code = Schema.RedactedFromValue(Schema.String.check(Schema.isPattern(/^[0-9]{6,10}$/)));
+const ActionProof = Schema.RedactedFromValue(Schema.String.check(Schema.isMaxLength(4096)));
+const fields = {
+	action: PhoneLifecycleAction,
+	flowId: RequestBindingFlowId,
+	commandId: PhoneCommandId,
+	phoneNumber: PhoneNumber,
+	sourcePhoneNumber: Schema.optionalKey(PhoneNumber)
+};
+const Start = Schema.Struct({
+	...fields,
+	requestId: ProofRequestId,
+	locale: Schema.NonEmptyString.check(Schema.isMaxLength(64))
+});
+const Bound = Schema.Struct({
+	...fields,
+	requestBinding: RequestBindingCredential
+});
+const ResendInput = Schema.Struct({
+	...Start.fields,
+	requestBinding: RequestBindingCredential,
+	reference: ProofReference
+});
+const CompleteInput = Schema.Struct({
+	...Bound.fields,
+	reference: ProofReference,
+	code: Code,
+	actionProof: Schema.optionalKey(ActionProof)
+});
+const Challenge = Schema.Struct({
+	...ProofRequestReceipt.fields,
+	flowId: RequestBindingFlowId,
+	actionChallenge: Schema.NullOr(PhoneActionChallenge)
+});
+const defaultPhoneLifecyclePolicy = {
+	maximumEvidenceAgeMillis: 3e5,
+	requireImmediateInvalidation: false
+};
+const tuple = Schema.fromJsonString(Schema.Array(Schema.String));
+const phoneDigest = Effect.fn("Phone.digest")(function* (values) {
+	const bytes = new TextEncoder().encode(yield* Schema.encodeEffect(tuple)(values).pipe(Effect.mapError(phoneFailure)));
+	return TokenDigest.make(Encoding.encodeBase64Url(yield* (yield* Crypto.Crypto).digest("SHA-256", bytes).pipe(Effect.mapError(phoneFailure))));
+});
+/** Trusted network scope is resolved per invocation, including suppressed requests. */
+const phoneAdmission = Effect.fn("Phone.admission")(function* (moduleId, action, requestId, fingerprint, replayLifetimeMillis = 0) {
+	const context = yield* PhoneRequestContext;
+	return yield* (yield* PhoneAdmission).admit({
+		moduleId,
+		action,
+		requestId,
+		fingerprint,
+		replayLifetimeMillis,
+		networkKey: Redacted.value(context.networkKey)
+	});
+});
+const phoneAttemptAdmission = Effect.fn("Phone.admitAttempt")(function* (moduleId, flowId, proofId) {
+	const requestId = yield* (yield* Crypto.Crypto).randomUUIDv4.pipe(Effect.mapError(phoneFailure));
+	if (!(yield* phoneAdmission(moduleId, "attempt", requestId, yield* phoneDigest([
+		"attempt",
+		flowId,
+		proofId
+	])))) return yield* PhoneOtpRejected.make({});
+});
+const makePhoneLifecycle = (moduleId, options, ClaimsForPhone) => {
+	const { sessions } = options, policy = Object.freeze({ ...options.lifecycle ?? defaultPhoneLifecyclePolicy }), binding = makeRequestBinding(moduleId, "phone-lifecycle");
+	const proof = makeProofModule(`${moduleId}/lifecycle`, {
+		purpose: ProofPurpose.make("phone-lifecycle"),
+		binding: ProofBinding,
+		channel: "sms",
+		template: options.template,
+		keys: options.keys,
+		secret: {
+			_tag: "NumericCode",
+			digits: options.digits
+		},
+		policy: options.policy
+	});
+	const Result = Schema.Union([Schema.TaggedStruct("Registered", { completion: sessions.CompletionResult }), Schema.TaggedStruct("Updated", { invalidation: SessionInvalidationWindow })]);
+	const admitRequest = Effect.fn("PhoneLifecycle.admitRequest")(function* (input) {
+		if (!(yield* phoneAdmission(moduleId, "request", input.requestId, yield* phoneDigest([
+			"lifecycle",
+			input.action,
+			input.flowId,
+			input.commandId,
+			input.phoneNumber,
+			input.sourcePhoneNumber ?? "",
+			input.locale,
+			input.reference?.proofId ?? ""
+		]), options.policy.requestRetentionMillis))) return yield* PhoneOtpRejected.make({});
+	});
+	const Begin = makeOperation(`${moduleId}/begin`, {
+		payload: Start,
+		authorize: admitRequest,
+		success: Challenge,
+		error: PhoneLifecycleFailure,
+		access: "any",
+		exposure: "public",
+		replay: "non-idempotent",
+		credentials: true
+	});
+	const Resend = makeOperation(`${moduleId}/resend`, {
+		payload: ResendInput,
+		authorize: admitRequest,
+		success: Challenge,
+		error: PhoneLifecycleFailure,
+		access: "any",
+		exposure: "public",
+		replay: "idempotent",
+		credentials: true
+	});
+	const CompleteLifecycle = makeOperation(`${moduleId}/complete-lifecycle`, {
+		payload: CompleteInput,
+		authorize: (input) => phoneAttemptAdmission(moduleId, input.flowId, input.reference.proofId),
+		success: Result,
+		error: PhoneLifecycleFailure,
+		access: "any",
+		exposure: "public",
+		replay: "single-use",
+		credentials: true
+	});
+	const Cancel = makeOperation(`${moduleId}/cancel-lifecycle`, {
+		payload: Bound,
+		success: Schema.Void,
+		error: PhoneLifecycleFailure,
+		access: "any",
+		exposure: "public",
+		replay: "idempotent",
+		credentials: true
+	});
+	const Cleanup = makeOperation(`${moduleId}/cleanup-lifecycle`, {
+		payload: Schema.Struct({
+			limit: Schema.Int.check(Schema.isBetween({
+				minimum: 1,
+				maximum: 1e3
+			})),
+			after: Schema.optionalKey(Schema.NonEmptyString.check(Schema.isMaxLength(256)))
+		}),
+		success: Schema.Struct({
+			proofs: ProofCleanupResult,
+			admission: Schema.Struct({
+				deleted: Schema.Natural,
+				nextCursor: Schema.NullOr(Schema.String)
+			})
+		}),
+		error: PhoneLifecycleFailure,
+		access: "system",
+		exposure: "internal",
+		replay: "idempotent"
+	});
+	const noAmbient = Effect.gen(function* () {
+		if (yield* hasCommitScope) return yield* PhoneOtpUnavailable.make({});
+		yield* Schema.decodeEffect(PhoneLifecyclePolicy)(policy).pipe(Effect.mapError(() => PhoneConfigurationError.make({})));
+	});
+	const capture = Effect.fn("PhoneLifecycle.capture")(function* (input, invocation) {
+		yield* noAmbient;
+		if (input.action === "register" ? invocation._tag !== "Guest" || input.sourcePhoneNumber !== void 0 : invocation._tag !== "Authenticated" || (input.action === "change" ? input.sourcePhoneNumber === void 0 : input.sourcePhoneNumber !== void 0)) return yield* PhoneOtpRejected.make({});
+		const verified = yield* (yield* binding.RequestBinding).verify(input.flowId, input.requestBinding).pipe(Effect.mapError(phoneFailure));
+		const target = yield* (yield* PhonePersistence).target({
+			moduleId,
+			action: input.action,
+			phoneNumber: input.phoneNumber,
+			...invocation._tag === "Authenticated" ? { subjectId: invocation.subjectId } : {},
+			...input.sourcePhoneNumber === void 0 ? {} : { sourcePhoneNumber: input.sourcePhoneNumber }
+		});
+		const contextDigest = yield* phoneDigest([
+			"effect-auth/phone-lifecycle/v1",
+			moduleId,
+			input.action,
+			input.flowId,
+			input.commandId,
+			verified.verifier,
+			input.phoneNumber,
+			input.sourcePhoneNumber ?? "",
+			target.custody?.custodyRevision ?? "",
+			target.source?.custodyRevision ?? "",
+			target.revision?.subjectId ?? "",
+			target.revision?.securityRevision ?? ""
+		]);
+		const base = {
+			flowId: input.flowId,
+			contextDigest,
+			identifier: LoginIdentifier.make({
+				namespace: "phone",
+				value: input.phoneNumber
+			})
+		};
+		return {
+			target,
+			binding: target.revision === null || input.action === "register" ? {
+				_tag: "Identifier",
+				...base
+			} : {
+				_tag: input.action === "change" ? "IdentifierChange" : "Subject",
+				...base,
+				revision: target.revision
+			},
+			challenge: input.action === "register" || target.revision === null ? null : {
+				moduleId,
+				action: input.action,
+				commandId: input.commandId,
+				flowId: AuthenticationFlowId.make(input.flowId),
+				phoneNumber: input.phoneNumber,
+				...input.sourcePhoneNumber === void 0 ? {} : { sourcePhoneNumber: input.sourcePhoneNumber },
+				revision: target.revision,
+				bindingDigest: contextDigest
+			}
+		};
+	});
+	const request = Effect.fn("PhoneLifecycle.request")(function* (input, invocation, credential, supersedes) {
+		const current = yield* capture({
+			...input,
+			requestBinding: credential
+		}, invocation);
+		const allowed = yield* (yield* PhoneDeliveryEligibility).allowed(input.phoneNumber);
+		const dispatch = yield* (yield* proof.Proofs).prepareIssue({
+			requestId: input.requestId,
+			binding: current.binding,
+			locale: input.locale,
+			eligible: current.target.eligible && allowed,
+			...supersedes === void 0 ? {} : { supersedes: supersedes.proofId }
+		}).pipe(Effect.flatMap(readProofCommit), Effect.mapError(phoneFailure));
+		yield* dispatch.dispatch.pipe(Effect.mapError(phoneFailure));
+		return {
+			...dispatch.receipt,
+			flowId: input.flowId,
+			actionChallenge: current.challenge
+		};
+	});
+	const handlersLayer = Layer.mergeAll(Begin.credentialHandlerLayer(Effect.fn("PhoneLifecycle.begin")(function* (input, invocation) {
+		yield* noAmbient;
+		const issued = yield* (yield* binding.RequestBinding).issue(input.flowId).pipe(Effect.mapError(phoneFailure));
+		const credential = issued.credentialCommands.find((c) => c._tag === "Issue" && c.slot === "request-binding");
+		if (credential?._tag !== "Issue") return yield* PhoneOtpUnavailable.make({});
+		return {
+			value: yield* request(input, invocation, credential.credential),
+			credentialCommands: issued.credentialCommands
+		};
+	})), Resend.credentialHandlerLayer(Effect.fn("PhoneLifecycle.resend")(function* (input, invocation) {
+		return {
+			value: yield* request(input, invocation, input.requestBinding, input.reference),
+			credentialCommands: []
+		};
+	})), CompleteLifecycle.credentialHandlerLayer(Effect.fn("PhoneLifecycle.complete")(function* (input, invocation) {
+		const current = yield* capture(input, invocation);
+		const strategy = yield* sessions.SessionStrategy;
+		if (policy.requireImmediateInvalidation && strategy.capabilities.subjectInvalidation !== "immediate") return yield* PhoneConfigurationError.make({});
+		const proofs = yield* proof.Proofs, attempted = yield* proofs.prepareAttempt({
+			binding: current.binding,
+			reference: input.reference,
+			credential: input.code
+		}).pipe(Effect.flatMap(readProofCommit), Effect.mapError(phoneFailure));
+		if (attempted.value._tag !== "Accepted" || !current.target.eligible) return yield* PhoneOtpRejected.make({});
+		const continuation = attempted.credentialCommands.find((c) => c._tag === "Issue" && c.slot === "proof-continuation");
+		if (continuation?._tag !== "Issue") return yield* PhoneOtpUnavailable.make({});
+		let authorization;
+		if (input.action !== "register") {
+			if (current.challenge === null) return yield* PhoneActionRequired.make({});
+			const verified = yield* (yield* PhoneActionEvidence).verify({
+				invocation,
+				challenge: current.challenge,
+				...input.actionProof === void 0 ? {} : { proof: input.actionProof }
+			});
+			const evidence = verified.evidence;
+			const actionRequirement = yield* Schema.decodeEffect(Schema.toCodecIso(AuthenticationRequirement))(Schema.encodeSync(Schema.toCodecIso(AuthenticationRequirement))(verified.requirement)).pipe(Effect.mapError(phoneActionFailure));
+			if (evidence.flowId !== current.challenge.flowId || evidence.bindingDigest !== current.challenge.bindingDigest || evidence.revision.subjectId !== current.challenge.revision.subjectId || evidence.revision.securityRevision !== current.challenge.revision.securityRevision) return yield* PhoneActionRequired.make({});
+			const requirement = yield* (yield* AuthenticationAuthority).requirements(evidence).pipe(Effect.mapError(phoneActionFailure));
+			if (!(yield* assessAuthentication(evidence, {
+				...requirement,
+				maximumAgeMillis: Math.min(policy.maximumEvidenceAgeMillis, requirement.maximumAgeMillis)
+			}).pipe(Effect.mapError(phoneActionFailure))).satisfied) return yield* PhoneActionRequired.make({});
+			if (!(yield* assessAuthentication(evidence, {
+				...actionRequirement,
+				maximumAgeMillis: Math.min(policy.maximumEvidenceAgeMillis, actionRequirement.maximumAgeMillis)
+			}).pipe(Effect.mapError(phoneActionFailure))).satisfied) return yield* PhoneActionRequired.make({});
+			authorization = {
+				challenge: current.challenge,
+				evidence,
+				requirement,
+				actionRequirement
+			};
+		}
+		const completion = yield* proofs.planComplete({
+			binding: current.binding,
+			continuationId: attempted.value.continuation.continuationId,
+			credential: continuation.credential
+		}).pipe(Effect.mapError(phoneFailure)), now = yield* DateTime.now, hooks = yield* LifecycleHooks;
+		const snapshot = lifecycleSnapshot({
+			action: input.action === "register" ? "registration" : "identifier-change",
+			operation: `${moduleId}/${input.action}`,
+			method: "phone-otp",
+			identifiers: [current.binding.identifier],
+			...current.target.revision === null ? {} : { subjectId: current.target.revision.subjectId }
+		});
+		yield* hooks.before(snapshot);
+		const decision = yield* (yield* PhonePersistence).mutate({
+			moduleId,
+			action: input.action,
+			commandId: input.commandId,
+			target: current.target,
+			policy,
+			completion,
+			...authorization === void 0 ? {} : { authorization }
+		}, (decision, journal) => {
+			if (decision._tag === "Accepted") journal.stage(lifecycleEvent({
+				id: LifecycleEventId.make(`phone/${moduleId}/${input.commandId}`),
+				occurredAtMillis: now.epochMilliseconds,
+				snapshot: {
+					...snapshot,
+					subjectId: decision.credential.revision.subjectId
+				}
+			}));
+			return journal.prepare(decision);
+		}).pipe(Effect.flatMap((receipt) => receipt.read), Effect.mapError(phoneFailure));
+		if (decision._tag !== "Accepted") return yield* PhoneOtpRejected.make({});
+		if (input.action !== "register") return {
+			value: {
+				_tag: "Updated",
+				invalidation: sessionInvalidationWindow("identifier-change", strategy.capabilities, strategy.policy)
+			},
+			credentialCommands: [{
+				_tag: "Clear",
+				slot: "request-binding"
+			}]
+		};
+		const credential = decision.credential, evidence = {
+			flowId: AuthenticationFlowId.make(input.flowId),
+			bindingDigest: current.binding.contextDigest,
+			revision: credential.revision,
+			proofs: [{
+				method: "phone-otp",
+				credentialId: credential.credentialId,
+				factors: ["possession"],
+				userVerified: false,
+				phishingResistant: false,
+				verifiedAt: now
+			}]
+		};
+		const claims = yield* (yield* ClaimsForPhone).resolve(credential);
+		const established = yield* (yield* sessions.AuthenticationCompletion).prepare({
+			evidence,
+			claims
+		}).pipe(Effect.flatMap((receipt) => receipt.read), Effect.mapError(phoneFailure));
+		return {
+			value: {
+				_tag: "Registered",
+				completion: established.value
+			},
+			credentialCommands: [...established.credentialCommands, {
+				_tag: "Clear",
+				slot: "request-binding"
+			}]
+		};
+	})), Cancel.credentialHandlerLayer(Effect.fn("PhoneLifecycle.cancel")(function* (input, invocation) {
+		const current = yield* capture(input, invocation);
+		yield* (yield* proof.Proofs).cancel(current.binding).pipe(Effect.flatMap(readProofCommit), Effect.mapError(phoneFailure));
+		return {
+			value: void 0,
+			credentialCommands: [{
+				_tag: "Clear",
+				slot: "request-binding"
+			}]
+		};
+	})), Cleanup.handlerLayer(Effect.fn("PhoneLifecycle.cleanup")(function* (input) {
+		yield* noAmbient;
+		return {
+			proofs: yield* (yield* proof.Proofs).cleanup(input.limit).pipe(Effect.flatMap(readProofCommit), Effect.mapError(phoneFailure)),
+			admission: yield* (yield* PhoneAdmission).cleanup({
+				moduleId,
+				limit: input.limit,
+				...input.after === void 0 ? {} : { after: input.after }
+			})
+		};
+	})));
+	const layer = handlersLayer.pipe(Layer.provide(defaultLayer(binding.RequestBinding, binding.layer)), Layer.provide(defaultLayer(proof.Proofs, proof.smsLayer)), Layer.provide([cryptoLayer, hooksLayer]));
+	return Object.freeze({
+		binding,
+		proof,
+		Result,
+		layer,
+		handlersLayer,
+		operations: {
+			Begin,
+			Resend,
+			CompleteLifecycle,
+			Cancel,
+			Cleanup
+		},
+		group: operationGroup(Begin, Resend, CompleteLifecycle, Cancel, Cleanup),
+		methods: {
+			begin: Begin.invoke,
+			resend: Resend.invoke,
+			completeLifecycle: CompleteLifecycle.invoke,
+			cancelLifecycle: Cancel.invoke,
+			cleanupLifecycle: Cleanup.invoke
+		}
+	});
+};
+//#endregion
+export { defaultPhoneLifecyclePolicy, makePhoneLifecycle, phoneAdmission, phoneAttemptAdmission, phoneDigest };
+
+//# sourceMappingURL=lifecycle.mjs.map

package/dist/phone/lifecycle.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle.mjs","names":[],"sources":["../../src/phone/lifecycle.ts"],"sourcesContent":["import type { Context } from \"effect\";\nimport { Crypto, DateTime, Effect, Encoding, Layer, Redacted, Schema } from \"effect\";\n\nimport { cryptoLayer, defaultLayer, hooksLayer } from \"../auth/defaults\";\nimport { hasCommitScope } from \"../hooks/commit\";\nimport { LifecycleHooks } from \"../hooks/LifecycleHooks\";\nimport { lifecycleEvent, lifecycleSnapshot, LifecycleEventId } from \"../hooks/models\";\nimport { LoginIdentifier } from \"../identity/models\";\nimport type { AuthInvocation } from \"../operations/context\";\nimport { makeOperation, operationGroup } from \"../operations/operation\";\nimport {\n  makeRequestBinding,\n  RequestBindingCredential,\n  RequestBindingFlowId,\n} from \"../operations/requestBinding\";\nimport type { ProofKeyring } from \"../proofs/crypto\";\nimport { readProofCommit } from \"../proofs/dispatch\";\nimport {\n  ProofBinding,\n  ProofPurpose,\n  ProofRequestId,\n  ProofRequestReceipt,\n  ProofReference,\n  ProofCleanupResult,\n} from \"../proofs/models\";\nimport { makeProofModule } from \"../proofs/module\";\nimport type { ProofPolicy } from \"../proofs/policy\";\nimport { TokenDigest } from \"../Schema\";\nimport { assessAuthentication } from \"../sessions/assurance\";\nimport { AuthenticationAuthority } from \"../sessions/AuthenticationAuthority\";\nimport { SessionInvalidationWindow, sessionInvalidationWindow } from \"../sessions/invalidation\";\nimport {\n  AuthenticationFlowId,\n  AuthenticationRequirement,\n  type AuthenticationEvidence,\n} from \"../sessions/models\";\nimport type { makeSessionModule } from \"../sessions/module\";\nimport { phoneFailure, phoneActionFailure } from \"./failure\";\nimport {\n  PhoneActionChallenge,\n  PhoneActionRequired,\n  PhoneCommandId,\n  PhoneConfigurationError,\n  PhoneLifecycleAction,\n  PhoneLifecycleFailure,\n  PhoneLifecyclePolicy,\n  type PhoneActionAuthorization,\n} from \"./lifecycleModels\";\nimport {\n  PhoneNumber,\n  PhoneOtpRejected,\n  PhoneOtpUnavailable,\n  type PhoneCredentialSnapshot,\n} from \"./models\";\nimport { PhoneActionEvidence } from \"./PhoneActionEvidence\";\nimport { PhoneAdmission } from \"./PhoneAdmission\";\nimport { PhoneDeliveryEligibility } from \"./PhoneDeliveryEligibility\";\nimport { PhonePersistence } from \"./PhonePersistence\";\nimport { PhoneRequestContext } from \"./PhoneRequestContext\";\nconst Code = Schema.RedactedFromValue(Schema.String.check(Schema.isPattern(/^[0-9]{6,10}$/)));\nconst ActionProof = Schema.RedactedFromValue(Schema.String.check(Schema.isMaxLength(4096)));\n\nconst fields = {\n  action: PhoneLifecycleAction,\n  flowId: RequestBindingFlowId,\n  commandId: PhoneCommandId,\n  phoneNumber: PhoneNumber,\n  sourcePhoneNumber: Schema.optionalKey(PhoneNumber),\n};\n\nconst Start = Schema.Struct({\n  ...fields,\n  requestId: ProofRequestId,\n  locale: Schema.NonEmptyString.check(Schema.isMaxLength(64)),\n});\n\nconst Bound = Schema.Struct({ ...fields, requestBinding: RequestBindingCredential });\n\nconst ResendInput = Schema.Struct({\n  ...Start.fields,\n  requestBinding: RequestBindingCredential,\n  reference: ProofReference,\n});\n\nconst CompleteInput = Schema.Struct({\n  ...Bound.fields,\n  reference: ProofReference,\n  code: Code,\n  actionProof: Schema.optionalKey(ActionProof),\n});\n\nconst Challenge = Schema.Struct({\n  ...ProofRequestReceipt.fields,\n  flowId: RequestBindingFlowId,\n  actionChallenge: Schema.NullOr(PhoneActionChallenge),\n});\n\nexport const defaultPhoneLifecyclePolicy: PhoneLifecyclePolicy = {\n  maximumEvidenceAgeMillis: 300_000,\n  requireImmediateInvalidation: false,\n};\n\nconst tuple = Schema.fromJsonString(Schema.Array(Schema.String));\n\nexport const phoneDigest = Effect.fn(\"Phone.digest\")(function* (values: ReadonlyArray<string>) {\n  const bytes = new TextEncoder().encode(\n    yield* Schema.encodeEffect(tuple)(values).pipe(Effect.mapError(phoneFailure)),\n  );\n\n  return TokenDigest.make(\n    Encoding.encodeBase64Url(\n      yield* (yield* Crypto.Crypto).digest(\"SHA-256\", bytes).pipe(Effect.mapError(phoneFailure)),\n    ),\n  );\n});\n\n/** Trusted network scope is resolved per invocation, including suppressed requests. */\nexport const phoneAdmission = Effect.fn(\"Phone.admission\")(function* (\n  moduleId: string,\n  action: \"request\" | \"attempt\",\n  requestId: string,\n  fingerprint: string,\n  replayLifetimeMillis = 0,\n) {\n  const context = yield* PhoneRequestContext;\n\n  return yield* (yield* PhoneAdmission).admit({\n    moduleId,\n    action,\n    requestId,\n    fingerprint,\n    replayLifetimeMillis,\n    networkKey: Redacted.value(context.networkKey),\n  });\n});\n\nexport const phoneAttemptAdmission = Effect.fn(\"Phone.admitAttempt\")(function* (\n  moduleId: string,\n  flowId: string,\n  proofId: string,\n) {\n  const requestId = yield* (yield* Crypto.Crypto).randomUUIDv4.pipe(Effect.mapError(phoneFailure));\n\n  if (\n    !(yield* phoneAdmission(\n      moduleId,\n      \"attempt\",\n      requestId,\n      yield* phoneDigest([\"attempt\", flowId, proofId]),\n    ))\n  )\n    return yield* PhoneOtpRejected.make({});\n});\n\nexport const makePhoneLifecycle = <\n  const Id extends string,\n  const SessionId extends string,\n  Claims extends Schema.Codec<unknown, unknown, unknown, unknown>,\n  ClaimsId,\n>(\n  moduleId: Id,\n  options: {\n    readonly sessions: ReturnType<typeof makeSessionModule<SessionId, Claims>>;\n    readonly template: string;\n    readonly keys: ProofKeyring;\n    readonly policy: ProofPolicy;\n    readonly digits: 6 | 7 | 8 | 9 | 10;\n    readonly lifecycle?: PhoneLifecyclePolicy;\n  },\n  ClaimsForPhone: Context.Key<\n    ClaimsId,\n    {\n      readonly resolve: (\n        credential: PhoneCredentialSnapshot,\n      ) => Effect.Effect<Claims[\"Type\"], PhoneOtpUnavailable>;\n    }\n  >,\n) => {\n  const { sessions } = options,\n    policy = Object.freeze({ ...(options.lifecycle ?? defaultPhoneLifecyclePolicy) }),\n    binding = makeRequestBinding(moduleId, \"phone-lifecycle\");\n\n  const proof = makeProofModule(`${moduleId}/lifecycle`, {\n    purpose: ProofPurpose.make(\"phone-lifecycle\"),\n    binding: ProofBinding,\n    channel: \"sms\",\n    template: options.template,\n    keys: options.keys,\n    secret: { _tag: \"NumericCode\", digits: options.digits },\n    policy: options.policy,\n  });\n\n  const Result = Schema.Union([\n    Schema.TaggedStruct(\"Registered\", { completion: sessions.CompletionResult }),\n    Schema.TaggedStruct(\"Updated\", { invalidation: SessionInvalidationWindow }),\n  ]);\n\n  const admitRequest = Effect.fn(\"PhoneLifecycle.admitRequest\")(function* (\n    input: typeof Start.Type & { readonly reference?: typeof ProofReference.Type },\n  ) {\n    if (\n      !(yield* phoneAdmission(\n        moduleId,\n        \"request\",\n        input.requestId,\n        yield* phoneDigest([\n          \"lifecycle\",\n          input.action,\n          input.flowId,\n          input.commandId,\n          input.phoneNumber,\n          input.sourcePhoneNumber ?? \"\",\n          input.locale,\n          input.reference?.proofId ?? \"\",\n        ]),\n        options.policy.requestRetentionMillis,\n      ))\n    )\n      return yield* PhoneOtpRejected.make({});\n  });\n\n  const Begin = makeOperation(`${moduleId}/begin`, {\n    payload: Start,\n    authorize: admitRequest,\n    success: Challenge,\n    error: PhoneLifecycleFailure,\n    access: \"any\",\n    exposure: \"public\",\n    replay: \"non-idempotent\",\n    credentials: true,\n  });\n\n  const Resend = makeOperation(`${moduleId}/resend`, {\n    payload: ResendInput,\n    authorize: admitRequest,\n    success: Challenge,\n    error: PhoneLifecycleFailure,\n    access: \"any\",\n    exposure: \"public\",\n    replay: \"idempotent\",\n    credentials: true,\n  });\n\n  const CompleteLifecycle = makeOperation(`${moduleId}/complete-lifecycle`, {\n    payload: CompleteInput,\n    authorize: (input) => phoneAttemptAdmission(moduleId, input.flowId, input.reference.proofId),\n    success: Result,\n    error: PhoneLifecycleFailure,\n    access: \"any\",\n    exposure: \"public\",\n    replay: \"single-use\",\n    credentials: true,\n  });\n\n  const Cancel = makeOperation(`${moduleId}/cancel-lifecycle`, {\n    payload: Bound,\n    success: Schema.Void,\n    error: PhoneLifecycleFailure,\n    access: \"any\",\n    exposure: \"public\",\n    replay: \"idempotent\",\n    credentials: true,\n  });\n\n  const Cleanup = makeOperation(`${moduleId}/cleanup-lifecycle`, {\n    payload: Schema.Struct({\n      limit: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 1000 })),\n      after: Schema.optionalKey(Schema.NonEmptyString.check(Schema.isMaxLength(256))),\n    }),\n    success: Schema.Struct({\n      proofs: ProofCleanupResult,\n      admission: Schema.Struct({\n        deleted: Schema.Natural,\n        nextCursor: Schema.NullOr(Schema.String),\n      }),\n    }),\n    error: PhoneLifecycleFailure,\n    access: \"system\",\n    exposure: \"internal\",\n    replay: \"idempotent\",\n  });\n\n  const noAmbient = Effect.gen(function* () {\n    if (yield* hasCommitScope) return yield* PhoneOtpUnavailable.make({});\n    yield* Schema.decodeEffect(PhoneLifecyclePolicy)(policy).pipe(\n      Effect.mapError(() => PhoneConfigurationError.make({})),\n    );\n  });\n\n  const capture = Effect.fn(\"PhoneLifecycle.capture\")(function* (\n    input: typeof Bound.Type,\n    invocation: AuthInvocation,\n  ) {\n    yield* noAmbient;\n    if (\n      input.action === \"register\"\n        ? invocation._tag !== \"Guest\" || input.sourcePhoneNumber !== undefined\n        : invocation._tag !== \"Authenticated\" ||\n          (input.action === \"change\"\n            ? input.sourcePhoneNumber === undefined\n            : input.sourcePhoneNumber !== undefined)\n    )\n      return yield* PhoneOtpRejected.make({});\n\n    const verified = yield* (yield* binding.RequestBinding)\n      .verify(input.flowId, input.requestBinding)\n      .pipe(Effect.mapError(phoneFailure));\n\n    const target = yield* (yield* PhonePersistence).target({\n      moduleId,\n      action: input.action,\n      phoneNumber: input.phoneNumber,\n      ...(invocation._tag === \"Authenticated\" ? { subjectId: invocation.subjectId } : {}),\n      ...(input.sourcePhoneNumber === undefined\n        ? {}\n        : { sourcePhoneNumber: input.sourcePhoneNumber }),\n    });\n\n    const contextDigest = yield* phoneDigest([\n      \"effect-auth/phone-lifecycle/v1\",\n      moduleId,\n      input.action,\n      input.flowId,\n      input.commandId,\n      verified.verifier,\n      input.phoneNumber,\n      input.sourcePhoneNumber ?? \"\",\n      target.custody?.custodyRevision ?? \"\",\n      target.source?.custodyRevision ?? \"\",\n      target.revision?.subjectId ?? \"\",\n      target.revision?.securityRevision ?? \"\",\n    ]);\n\n    const base = {\n      flowId: input.flowId,\n      contextDigest,\n      identifier: LoginIdentifier.make({ namespace: \"phone\", value: input.phoneNumber }),\n    };\n\n    const proofBinding: ProofBinding =\n      target.revision === null || input.action === \"register\"\n        ? { _tag: \"Identifier\", ...base }\n        : {\n            _tag: input.action === \"change\" ? \"IdentifierChange\" : \"Subject\",\n            ...base,\n            revision: target.revision,\n          };\n\n    const challenge: PhoneActionChallenge | null =\n      input.action === \"register\" || target.revision === null\n        ? null\n        : {\n            moduleId,\n            action: input.action,\n            commandId: input.commandId,\n            flowId: AuthenticationFlowId.make(input.flowId),\n            phoneNumber: input.phoneNumber,\n            ...(input.sourcePhoneNumber === undefined\n              ? {}\n              : { sourcePhoneNumber: input.sourcePhoneNumber }),\n            revision: target.revision,\n            bindingDigest: contextDigest,\n          };\n\n    return { target, binding: proofBinding, challenge };\n  });\n\n  const request = Effect.fn(\"PhoneLifecycle.request\")(function* (\n    input: typeof Start.Type,\n    invocation: AuthInvocation,\n    credential: typeof RequestBindingCredential.Type,\n    supersedes?: typeof ProofReference.Type,\n  ) {\n    const current = yield* capture({ ...input, requestBinding: credential }, invocation);\n    const allowed = yield* (yield* PhoneDeliveryEligibility).allowed(input.phoneNumber);\n\n    const dispatch = yield* (yield* proof.Proofs)\n      .prepareIssue({\n        requestId: input.requestId,\n        binding: current.binding,\n        locale: input.locale,\n        eligible: current.target.eligible && allowed,\n        ...(supersedes === undefined ? {} : { supersedes: supersedes.proofId }),\n      })\n      .pipe(Effect.flatMap(readProofCommit), Effect.mapError(phoneFailure));\n\n    yield* dispatch.dispatch.pipe(Effect.mapError(phoneFailure));\n\n    return { ...dispatch.receipt, flowId: input.flowId, actionChallenge: current.challenge };\n  });\n\n  const handlersLayer = Layer.mergeAll(\n    Begin.credentialHandlerLayer(\n      Effect.fn(\"PhoneLifecycle.begin\")(function* (input, invocation) {\n        yield* noAmbient;\n\n        const issued = yield* (yield* binding.RequestBinding)\n          .issue(input.flowId)\n          .pipe(Effect.mapError(phoneFailure));\n\n        const credential = issued.credentialCommands.find(\n          (c) => c._tag === \"Issue\" && c.slot === \"request-binding\",\n        );\n\n        if (credential?._tag !== \"Issue\") return yield* PhoneOtpUnavailable.make({});\n\n        return {\n          value: yield* request(input, invocation, credential.credential),\n          credentialCommands: issued.credentialCommands,\n        };\n      }),\n    ),\n    Resend.credentialHandlerLayer(\n      Effect.fn(\"PhoneLifecycle.resend\")(function* (input, invocation) {\n        return {\n          value: yield* request(input, invocation, input.requestBinding, input.reference),\n          credentialCommands: [],\n        };\n      }),\n    ),\n    CompleteLifecycle.credentialHandlerLayer(\n      Effect.fn(\"PhoneLifecycle.complete\")(function* (input, invocation) {\n        const current = yield* capture(input, invocation);\n        const strategy = yield* sessions.SessionStrategy;\n\n        if (\n          policy.requireImmediateInvalidation &&\n          strategy.capabilities.subjectInvalidation !== \"immediate\"\n        )\n          return yield* PhoneConfigurationError.make({});\n\n        const proofs = yield* proof.Proofs,\n          attempted = yield* proofs\n            .prepareAttempt({\n              binding: current.binding,\n              reference: input.reference,\n              credential: input.code,\n            })\n            .pipe(Effect.flatMap(readProofCommit), Effect.mapError(phoneFailure));\n\n        if (attempted.value._tag !== \"Accepted\" || !current.target.eligible)\n          return yield* PhoneOtpRejected.make({});\n\n        const continuation = attempted.credentialCommands.find(\n          (c) => c._tag === \"Issue\" && c.slot === \"proof-continuation\",\n        );\n\n        if (continuation?._tag !== \"Issue\") return yield* PhoneOtpUnavailable.make({});\n        let authorization: PhoneActionAuthorization | undefined;\n\n        if (input.action !== \"register\") {\n          if (current.challenge === null) return yield* PhoneActionRequired.make({});\n\n          const verified = yield* (yield* PhoneActionEvidence).verify({\n            invocation,\n            challenge: current.challenge,\n            ...(input.actionProof === undefined ? {} : { proof: input.actionProof }),\n          });\n\n          const evidence = verified.evidence;\n\n          const actionRequirement = yield* Schema.decodeEffect(\n            Schema.toCodecIso(AuthenticationRequirement),\n          )(\n            Schema.encodeSync(Schema.toCodecIso(AuthenticationRequirement))(verified.requirement),\n          ).pipe(Effect.mapError(phoneActionFailure));\n\n          if (\n            evidence.flowId !== current.challenge.flowId ||\n            evidence.bindingDigest !== current.challenge.bindingDigest ||\n            evidence.revision.subjectId !== current.challenge.revision.subjectId ||\n            evidence.revision.securityRevision !== current.challenge.revision.securityRevision\n          )\n            return yield* PhoneActionRequired.make({});\n\n          const requirement = yield* (yield* AuthenticationAuthority)\n            .requirements(evidence)\n            .pipe(Effect.mapError(phoneActionFailure));\n\n          const assessment = yield* assessAuthentication(evidence, {\n            ...requirement,\n            maximumAgeMillis: Math.min(\n              policy.maximumEvidenceAgeMillis,\n              requirement.maximumAgeMillis,\n            ),\n          }).pipe(Effect.mapError(phoneActionFailure));\n\n          if (!assessment.satisfied) return yield* PhoneActionRequired.make({});\n\n          const actionAssessment = yield* assessAuthentication(evidence, {\n            ...actionRequirement,\n            maximumAgeMillis: Math.min(\n              policy.maximumEvidenceAgeMillis,\n              actionRequirement.maximumAgeMillis,\n            ),\n          }).pipe(Effect.mapError(phoneActionFailure));\n\n          if (!actionAssessment.satisfied) return yield* PhoneActionRequired.make({});\n          authorization = {\n            challenge: current.challenge,\n            evidence,\n            requirement,\n            actionRequirement,\n          };\n        }\n\n        const completion = yield* proofs\n            .planComplete({\n              binding: current.binding,\n              continuationId: attempted.value.continuation.continuationId,\n              credential: continuation.credential,\n            })\n            .pipe(Effect.mapError(phoneFailure)),\n          now = yield* DateTime.now,\n          hooks = yield* LifecycleHooks;\n\n        const snapshot = lifecycleSnapshot({\n          action: input.action === \"register\" ? \"registration\" : \"identifier-change\",\n          operation: `${moduleId}/${input.action}`,\n          method: \"phone-otp\",\n          identifiers: [current.binding.identifier],\n          ...(current.target.revision === null\n            ? {}\n            : { subjectId: current.target.revision.subjectId }),\n        });\n\n        yield* hooks.before(snapshot);\n\n        const decision = yield* (yield* PhonePersistence)\n          .mutate(\n            {\n              moduleId,\n              action: input.action,\n              commandId: input.commandId,\n              target: current.target,\n              policy,\n              completion,\n              ...(authorization === undefined ? {} : { authorization }),\n            },\n            (decision, journal) => {\n              if (decision._tag === \"Accepted\")\n                journal.stage(\n                  lifecycleEvent({\n                    id: LifecycleEventId.make(`phone/${moduleId}/${input.commandId}`),\n                    occurredAtMillis: now.epochMilliseconds,\n                    snapshot: { ...snapshot, subjectId: decision.credential.revision.subjectId },\n                  }),\n                );\n\n              return journal.prepare(decision);\n            },\n          )\n          .pipe(\n            Effect.flatMap((receipt) => receipt.read),\n            Effect.mapError(phoneFailure),\n          );\n\n        if (decision._tag !== \"Accepted\") return yield* PhoneOtpRejected.make({});\n        if (input.action !== \"register\")\n          return {\n            value: {\n              _tag: \"Updated\" as const,\n              invalidation: sessionInvalidationWindow(\n                \"identifier-change\",\n                strategy.capabilities,\n                strategy.policy,\n              ),\n            },\n            credentialCommands: [{ _tag: \"Clear\" as const, slot: \"request-binding\" as const }],\n          };\n\n        const credential = decision.credential,\n          evidence: AuthenticationEvidence = {\n            flowId: AuthenticationFlowId.make(input.flowId),\n            bindingDigest: current.binding.contextDigest,\n            revision: credential.revision,\n            proofs: [\n              {\n                method: \"phone-otp\",\n                credentialId: credential.credentialId,\n                factors: [\"possession\"],\n                userVerified: false,\n                phishingResistant: false,\n                verifiedAt: now,\n              },\n            ],\n          };\n\n        const claims = yield* (yield* ClaimsForPhone).resolve(credential);\n\n        const established = yield* (yield* sessions.AuthenticationCompletion)\n          .prepare({ evidence, claims })\n          .pipe(\n            Effect.flatMap((receipt) => receipt.read),\n            Effect.mapError(phoneFailure),\n          );\n\n        return {\n          value: { _tag: \"Registered\" as const, completion: established.value },\n          credentialCommands: [\n            ...established.credentialCommands,\n            { _tag: \"Clear\" as const, slot: \"request-binding\" as const },\n          ],\n        };\n      }),\n    ),\n    Cancel.credentialHandlerLayer(\n      Effect.fn(\"PhoneLifecycle.cancel\")(function* (input, invocation) {\n        const current = yield* capture(input, invocation);\n\n        yield* (yield* proof.Proofs)\n          .cancel(current.binding)\n          .pipe(Effect.flatMap(readProofCommit), Effect.mapError(phoneFailure));\n\n        return {\n          value: undefined,\n          credentialCommands: [{ _tag: \"Clear\" as const, slot: \"request-binding\" as const }],\n        };\n      }),\n    ),\n    Cleanup.handlerLayer(\n      Effect.fn(\"PhoneLifecycle.cleanup\")(function* (input) {\n        yield* noAmbient;\n\n        const proofResult = yield* (yield* proof.Proofs)\n          .cleanup(input.limit)\n          .pipe(Effect.flatMap(readProofCommit), Effect.mapError(phoneFailure));\n\n        const admission = yield* (yield* PhoneAdmission).cleanup({\n          moduleId,\n          limit: input.limit,\n          ...(input.after === undefined ? {} : { after: input.after }),\n        });\n\n        return { proofs: proofResult, admission };\n      }),\n    ),\n  );\n\n  const layer = handlersLayer.pipe(\n    Layer.provide(defaultLayer(binding.RequestBinding, binding.layer)),\n    Layer.provide(defaultLayer(proof.Proofs, proof.smsLayer)),\n    Layer.provide([cryptoLayer, hooksLayer]),\n  );\n\n  return Object.freeze({\n    binding,\n    proof,\n    Result,\n    layer,\n    handlersLayer,\n    operations: { Begin, Resend, CompleteLifecycle, Cancel, Cleanup },\n    group: operationGroup(Begin, Resend, CompleteLifecycle, Cancel, Cleanup),\n    methods: {\n      begin: Begin.invoke,\n      resend: Resend.invoke,\n      completeLifecycle: CompleteLifecycle.invoke,\n      cancelLifecycle: Cancel.invoke,\n      cleanupLifecycle: Cleanup.invoke,\n    },\n  });\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AA2DA,MAAM,OAAO,OAAO,kBAAkB,OAAO,OAAO,MAAM,OAAO,UAAU,eAAe,CAAC,CAAC;AAC5F,MAAM,cAAc,OAAO,kBAAkB,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC,CAAC;AAE1F,MAAM,SAAS;CACb,QAAQ;CACR,QAAQ;CACR,WAAW;CACX,aAAa;CACb,mBAAmB,OAAO,YAAY,WAAW;AACnD;AAEA,MAAM,QAAQ,OAAO,OAAO;CAC1B,GAAG;CACH,WAAW;CACX,QAAQ,OAAO,eAAe,MAAM,OAAO,YAAY,EAAE,CAAC;AAC5D,CAAC;AAED,MAAM,QAAQ,OAAO,OAAO;CAAE,GAAG;CAAQ,gBAAgB;AAAyB,CAAC;AAEnF,MAAM,cAAc,OAAO,OAAO;CAChC,GAAG,MAAM;CACT,gBAAgB;CAChB,WAAW;AACb,CAAC;AAED,MAAM,gBAAgB,OAAO,OAAO;CAClC,GAAG,MAAM;CACT,WAAW;CACX,MAAM;CACN,aAAa,OAAO,YAAY,WAAW;AAC7C,CAAC;AAED,MAAM,YAAY,OAAO,OAAO;CAC9B,GAAG,oBAAoB;CACvB,QAAQ;CACR,iBAAiB,OAAO,OAAO,oBAAoB;AACrD,CAAC;AAED,MAAa,8BAAoD;CAC/D,0BAA0B;CAC1B,8BAA8B;AAChC;AAEA,MAAM,QAAQ,OAAO,eAAe,OAAO,MAAM,OAAO,MAAM,CAAC;AAE/D,MAAa,cAAc,OAAO,GAAG,cAAc,CAAC,CAAC,WAAW,QAA+B;CAC7F,MAAM,QAAQ,IAAI,YAAY,CAAC,CAAC,OAC9B,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,OAAO,SAAS,YAAY,CAAC,CAC9E;CAEA,OAAO,YAAY,KACjB,SAAS,gBACP,QAAQ,OAAO,OAAO,OAAA,CAAQ,OAAO,WAAW,KAAK,CAAC,CAAC,KAAK,OAAO,SAAS,YAAY,CAAC,CAC3F,CACF;AACF,CAAC;;AAGD,MAAa,iBAAiB,OAAO,GAAG,iBAAiB,CAAC,CAAC,WACzD,UACA,QACA,WACA,aACA,uBAAuB,GACvB;CACA,MAAM,UAAU,OAAO;CAEvB,OAAO,QAAQ,OAAO,eAAA,CAAgB,MAAM;EAC1C;EACA;EACA;EACA;EACA;EACA,YAAY,SAAS,MAAM,QAAQ,UAAU;CAC/C,CAAC;AACH,CAAC;AAED,MAAa,wBAAwB,OAAO,GAAG,oBAAoB,CAAC,CAAC,WACnE,UACA,QACA,SACA;CACA,MAAM,YAAY,QAAQ,OAAO,OAAO,OAAA,CAAQ,aAAa,KAAK,OAAO,SAAS,YAAY,CAAC;CAE/F,IACE,EAAE,OAAO,eACP,UACA,WACA,WACA,OAAO,YAAY;EAAC;EAAW;EAAQ;CAAO,CAAC,CACjD,IAEA,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;AAC1C,CAAC;AAED,MAAa,sBAMX,UACA,SAQA,mBAQG;CACH,MAAM,EAAE,aAAa,SACnB,SAAS,OAAO,OAAO,EAAE,GAAI,QAAQ,aAAa,4BAA6B,CAAC,GAChF,UAAU,mBAAmB,UAAU,iBAAiB;CAE1D,MAAM,QAAQ,gBAAgB,GAAG,SAAS,aAAa;EACrD,SAAS,aAAa,KAAK,iBAAiB;EAC5C,SAAS;EACT,SAAS;EACT,UAAU,QAAQ;EAClB,MAAM,QAAQ;EACd,QAAQ;GAAE,MAAM;GAAe,QAAQ,QAAQ;EAAO;EACtD,QAAQ,QAAQ;CAClB,CAAC;CAED,MAAM,SAAS,OAAO,MAAM,CAC1B,OAAO,aAAa,cAAc,EAAE,YAAY,SAAS,iBAAiB,CAAC,GAC3E,OAAO,aAAa,WAAW,EAAE,cAAc,0BAA0B,CAAC,CAC5E,CAAC;CAED,MAAM,eAAe,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAC5D,OACA;EACA,IACE,EAAE,OAAO,eACP,UACA,WACA,MAAM,WACN,OAAO,YAAY;GACjB;GACA,MAAM;GACN,MAAM;GACN,MAAM;GACN,MAAM;GACN,MAAM,qBAAqB;GAC3B,MAAM;GACN,MAAM,WAAW,WAAW;EAC9B,CAAC,GACD,QAAQ,OAAO,sBACjB,IAEA,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;CAC1C,CAAC;CAED,MAAM,QAAQ,cAAc,GAAG,SAAS,SAAS;EAC/C,SAAS;EACT,WAAW;EACX,SAAS;EACT,OAAO;EACP,QAAQ;EACR,UAAU;EACV,QAAQ;EACR,aAAa;CACf,CAAC;CAED,MAAM,SAAS,cAAc,GAAG,SAAS,UAAU;EACjD,SAAS;EACT,WAAW;EACX,SAAS;EACT,OAAO;EACP,QAAQ;EACR,UAAU;EACV,QAAQ;EACR,aAAa;CACf,CAAC;CAED,MAAM,oBAAoB,cAAc,GAAG,SAAS,sBAAsB;EACxE,SAAS;EACT,YAAY,UAAU,sBAAsB,UAAU,MAAM,QAAQ,MAAM,UAAU,OAAO;EAC3F,SAAS;EACT,OAAO;EACP,QAAQ;EACR,UAAU;EACV,QAAQ;EACR,aAAa;CACf,CAAC;CAED,MAAM,SAAS,cAAc,GAAG,SAAS,oBAAoB;EAC3D,SAAS;EACT,SAAS,OAAO;EAChB,OAAO;EACP,QAAQ;EACR,UAAU;EACV,QAAQ;EACR,aAAa;CACf,CAAC;CAED,MAAM,UAAU,cAAc,GAAG,SAAS,qBAAqB;EAC7D,SAAS,OAAO,OAAO;GACrB,OAAO,OAAO,IAAI,MAAM,OAAO,UAAU;IAAE,SAAS;IAAG,SAAS;GAAK,CAAC,CAAC;GACvE,OAAO,OAAO,YAAY,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC;EAChF,CAAC;EACD,SAAS,OAAO,OAAO;GACrB,QAAQ;GACR,WAAW,OAAO,OAAO;IACvB,SAAS,OAAO;IAChB,YAAY,OAAO,OAAO,OAAO,MAAM;GACzC,CAAC;EACH,CAAC;EACD,OAAO;EACP,QAAQ;EACR,UAAU;EACV,QAAQ;CACV,CAAC;CAED,MAAM,YAAY,OAAO,IAAI,aAAa;EACxC,IAAI,OAAO,gBAAgB,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;EACpE,OAAO,OAAO,aAAa,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC,KACvD,OAAO,eAAe,wBAAwB,KAAK,CAAC,CAAC,CAAC,CACxD;CACF,CAAC;CAED,MAAM,UAAU,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAClD,OACA,YACA;EACA,OAAO;EACP,IACE,MAAM,WAAW,aACb,WAAW,SAAS,WAAW,MAAM,sBAAsB,KAAA,IAC3D,WAAW,SAAS,oBACnB,MAAM,WAAW,WACd,MAAM,sBAAsB,KAAA,IAC5B,MAAM,sBAAsB,KAAA,IAEpC,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;EAExC,MAAM,WAAW,QAAQ,OAAO,QAAQ,eAAA,CACrC,OAAO,MAAM,QAAQ,MAAM,cAAc,CAAC,CAC1C,KAAK,OAAO,SAAS,YAAY,CAAC;EAErC,MAAM,SAAS,QAAQ,OAAO,iBAAA,CAAkB,OAAO;GACrD;GACA,QAAQ,MAAM;GACd,aAAa,MAAM;GACnB,GAAI,WAAW,SAAS,kBAAkB,EAAE,WAAW,WAAW,UAAU,IAAI,CAAC;GACjF,GAAI,MAAM,sBAAsB,KAAA,IAC5B,CAAC,IACD,EAAE,mBAAmB,MAAM,kBAAkB;EACnD,CAAC;EAED,MAAM,gBAAgB,OAAO,YAAY;GACvC;GACA;GACA,MAAM;GACN,MAAM;GACN,MAAM;GACN,SAAS;GACT,MAAM;GACN,MAAM,qBAAqB;GAC3B,OAAO,SAAS,mBAAmB;GACnC,OAAO,QAAQ,mBAAmB;GAClC,OAAO,UAAU,aAAa;GAC9B,OAAO,UAAU,oBAAoB;EACvC,CAAC;EAED,MAAM,OAAO;GACX,QAAQ,MAAM;GACd;GACA,YAAY,gBAAgB,KAAK;IAAE,WAAW;IAAS,OAAO,MAAM;GAAY,CAAC;EACnF;EA2BA,OAAO;GAAE;GAAQ,SAxBf,OAAO,aAAa,QAAQ,MAAM,WAAW,aACzC;IAAE,MAAM;IAAc,GAAG;GAAK,IAC9B;IACE,MAAM,MAAM,WAAW,WAAW,qBAAqB;IACvD,GAAG;IACH,UAAU,OAAO;GACnB;GAkBkC,WAftC,MAAM,WAAW,cAAc,OAAO,aAAa,OAC/C,OACA;IACE;IACA,QAAQ,MAAM;IACd,WAAW,MAAM;IACjB,QAAQ,qBAAqB,KAAK,MAAM,MAAM;IAC9C,aAAa,MAAM;IACnB,GAAI,MAAM,sBAAsB,KAAA,IAC5B,CAAC,IACD,EAAE,mBAAmB,MAAM,kBAAkB;IACjD,UAAU,OAAO;IACjB,eAAe;GACjB;EAE4C;CACpD,CAAC;CAED,MAAM,UAAU,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAClD,OACA,YACA,YACA,YACA;EACA,MAAM,UAAU,OAAO,QAAQ;GAAE,GAAG;GAAO,gBAAgB;EAAW,GAAG,UAAU;EACnF,MAAM,UAAU,QAAQ,OAAO,yBAAA,CAA0B,QAAQ,MAAM,WAAW;EAElF,MAAM,WAAW,QAAQ,OAAO,MAAM,OAAA,CACnC,aAAa;GACZ,WAAW,MAAM;GACjB,SAAS,QAAQ;GACjB,QAAQ,MAAM;GACd,UAAU,QAAQ,OAAO,YAAY;GACrC,GAAI,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY,WAAW,QAAQ;EACvE,CAAC,CAAC,CACD,KAAK,OAAO,QAAQ,eAAe,GAAG,OAAO,SAAS,YAAY,CAAC;EAEtE,OAAO,SAAS,SAAS,KAAK,OAAO,SAAS,YAAY,CAAC;EAE3D,OAAO;GAAE,GAAG,SAAS;GAAS,QAAQ,MAAM;GAAQ,iBAAiB,QAAQ;EAAU;CACzF,CAAC;CAED,MAAM,gBAAgB,MAAM,SAC1B,MAAM,uBACJ,OAAO,GAAG,sBAAsB,CAAC,CAAC,WAAW,OAAO,YAAY;EAC9D,OAAO;EAEP,MAAM,SAAS,QAAQ,OAAO,QAAQ,eAAA,CACnC,MAAM,MAAM,MAAM,CAAC,CACnB,KAAK,OAAO,SAAS,YAAY,CAAC;EAErC,MAAM,aAAa,OAAO,mBAAmB,MAC1C,MAAM,EAAE,SAAS,WAAW,EAAE,SAAS,iBAC1C;EAEA,IAAI,YAAY,SAAS,SAAS,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;EAE3E,OAAO;GACL,OAAO,OAAO,QAAQ,OAAO,YAAY,WAAW,UAAU;GAC9D,oBAAoB,OAAO;EAC7B;CACF,CAAC,CACH,GACA,OAAO,uBACL,OAAO,GAAG,uBAAuB,CAAC,CAAC,WAAW,OAAO,YAAY;EAC/D,OAAO;GACL,OAAO,OAAO,QAAQ,OAAO,YAAY,MAAM,gBAAgB,MAAM,SAAS;GAC9E,oBAAoB,CAAC;EACvB;CACF,CAAC,CACH,GACA,kBAAkB,uBAChB,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAAW,OAAO,YAAY;EACjE,MAAM,UAAU,OAAO,QAAQ,OAAO,UAAU;EAChD,MAAM,WAAW,OAAO,SAAS;EAEjC,IACE,OAAO,gCACP,SAAS,aAAa,wBAAwB,aAE9C,OAAO,OAAO,wBAAwB,KAAK,CAAC,CAAC;EAE/C,MAAM,SAAS,OAAO,MAAM,QAC1B,YAAY,OAAO,OAChB,eAAe;GACd,SAAS,QAAQ;GACjB,WAAW,MAAM;GACjB,YAAY,MAAM;EACpB,CAAC,CAAC,CACD,KAAK,OAAO,QAAQ,eAAe,GAAG,OAAO,SAAS,YAAY,CAAC;EAExE,IAAI,UAAU,MAAM,SAAS,cAAc,CAAC,QAAQ,OAAO,UACzD,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;EAExC,MAAM,eAAe,UAAU,mBAAmB,MAC/C,MAAM,EAAE,SAAS,WAAW,EAAE,SAAS,oBAC1C;EAEA,IAAI,cAAc,SAAS,SAAS,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;EAC7E,IAAI;EAEJ,IAAI,MAAM,WAAW,YAAY;GAC/B,IAAI,QAAQ,cAAc,MAAM,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;GAEzE,MAAM,WAAW,QAAQ,OAAO,oBAAA,CAAqB,OAAO;IAC1D;IACA,WAAW,QAAQ;IACnB,GAAI,MAAM,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,MAAM,YAAY;GACxE,CAAC;GAED,MAAM,WAAW,SAAS;GAE1B,MAAM,oBAAoB,OAAO,OAAO,aACtC,OAAO,WAAW,yBAAyB,CAC7C,CAAC,CACC,OAAO,WAAW,OAAO,WAAW,yBAAyB,CAAC,CAAC,CAAC,SAAS,WAAW,CACtF,CAAC,CAAC,KAAK,OAAO,SAAS,kBAAkB,CAAC;GAE1C,IACE,SAAS,WAAW,QAAQ,UAAU,UACtC,SAAS,kBAAkB,QAAQ,UAAU,iBAC7C,SAAS,SAAS,cAAc,QAAQ,UAAU,SAAS,aAC3D,SAAS,SAAS,qBAAqB,QAAQ,UAAU,SAAS,kBAElE,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;GAE3C,MAAM,cAAc,QAAQ,OAAO,wBAAA,CAChC,aAAa,QAAQ,CAAC,CACtB,KAAK,OAAO,SAAS,kBAAkB,CAAC;GAU3C,IAAI,EAAC,OARqB,qBAAqB,UAAU;IACvD,GAAG;IACH,kBAAkB,KAAK,IACrB,OAAO,0BACP,YAAY,gBACd;GACF,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,kBAAkB,CAAC,EAAA,CAE3B,WAAW,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;GAUpE,IAAI,EAAC,OAR2B,qBAAqB,UAAU;IAC7D,GAAG;IACH,kBAAkB,KAAK,IACrB,OAAO,0BACP,kBAAkB,gBACpB;GACF,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,kBAAkB,CAAC,EAAA,CAErB,WAAW,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;GAC1E,gBAAgB;IACd,WAAW,QAAQ;IACnB;IACA;IACA;GACF;EACF;EAEA,MAAM,aAAa,OAAO,OACrB,aAAa;GACZ,SAAS,QAAQ;GACjB,gBAAgB,UAAU,MAAM,aAAa;GAC7C,YAAY,aAAa;EAC3B,CAAC,CAAC,CACD,KAAK,OAAO,SAAS,YAAY,CAAC,GACrC,MAAM,OAAO,SAAS,KACtB,QAAQ,OAAO;EAEjB,MAAM,WAAW,kBAAkB;GACjC,QAAQ,MAAM,WAAW,aAAa,iBAAiB;GACvD,WAAW,GAAG,SAAS,GAAG,MAAM;GAChC,QAAQ;GACR,aAAa,CAAC,QAAQ,QAAQ,UAAU;GACxC,GAAI,QAAQ,OAAO,aAAa,OAC5B,CAAC,IACD,EAAE,WAAW,QAAQ,OAAO,SAAS,UAAU;EACrD,CAAC;EAED,OAAO,MAAM,OAAO,QAAQ;EAE5B,MAAM,WAAW,QAAQ,OAAO,iBAAA,CAC7B,OACC;GACE;GACA,QAAQ,MAAM;GACd,WAAW,MAAM;GACjB,QAAQ,QAAQ;GAChB;GACA;GACA,GAAI,kBAAkB,KAAA,IAAY,CAAC,IAAI,EAAE,cAAc;EACzD,IACC,UAAU,YAAY;GACrB,IAAI,SAAS,SAAS,YACpB,QAAQ,MACN,eAAe;IACb,IAAI,iBAAiB,KAAK,SAAS,SAAS,GAAG,MAAM,WAAW;IAChE,kBAAkB,IAAI;IACtB,UAAU;KAAE,GAAG;KAAU,WAAW,SAAS,WAAW,SAAS;IAAU;GAC7E,CAAC,CACH;GAEF,OAAO,QAAQ,QAAQ,QAAQ;EACjC,CACF,CAAC,CACA,KACC,OAAO,SAAS,YAAY,QAAQ,IAAI,GACxC,OAAO,SAAS,YAAY,CAC9B;EAEF,IAAI,SAAS,SAAS,YAAY,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;EACxE,IAAI,MAAM,WAAW,YACnB,OAAO;GACL,OAAO;IACL,MAAM;IACN,cAAc,0BACZ,qBACA,SAAS,cACT,SAAS,MACX;GACF;GACA,oBAAoB,CAAC;IAAE,MAAM;IAAkB,MAAM;GAA2B,CAAC;EACnF;EAEF,MAAM,aAAa,SAAS,YAC1B,WAAmC;GACjC,QAAQ,qBAAqB,KAAK,MAAM,MAAM;GAC9C,eAAe,QAAQ,QAAQ;GAC/B,UAAU,WAAW;GACrB,QAAQ,CACN;IACE,QAAQ;IACR,cAAc,WAAW;IACzB,SAAS,CAAC,YAAY;IACtB,cAAc;IACd,mBAAmB;IACnB,YAAY;GACd,CACF;EACF;EAEF,MAAM,SAAS,QAAQ,OAAO,eAAA,CAAgB,QAAQ,UAAU;EAEhE,MAAM,cAAc,QAAQ,OAAO,SAAS,yBAAA,CACzC,QAAQ;GAAE;GAAU;EAAO,CAAC,CAAC,CAC7B,KACC,OAAO,SAAS,YAAY,QAAQ,IAAI,GACxC,OAAO,SAAS,YAAY,CAC9B;EAEF,OAAO;GACL,OAAO;IAAE,MAAM;IAAuB,YAAY,YAAY;GAAM;GACpE,oBAAoB,CAClB,GAAG,YAAY,oBACf;IAAE,MAAM;IAAkB,MAAM;GAA2B,CAC7D;EACF;CACF,CAAC,CACH,GACA,OAAO,uBACL,OAAO,GAAG,uBAAuB,CAAC,CAAC,WAAW,OAAO,YAAY;EAC/D,MAAM,UAAU,OAAO,QAAQ,OAAO,UAAU;EAEhD,QAAQ,OAAO,MAAM,OAAA,CAClB,OAAO,QAAQ,OAAO,CAAC,CACvB,KAAK,OAAO,QAAQ,eAAe,GAAG,OAAO,SAAS,YAAY,CAAC;EAEtE,OAAO;GACL,OAAO,KAAA;GACP,oBAAoB,CAAC;IAAE,MAAM;IAAkB,MAAM;GAA2B,CAAC;EACnF;CACF,CAAC,CACH,GACA,QAAQ,aACN,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAAW,OAAO;EACpD,OAAO;EAYP,OAAO;GAAE,QAAQ,QAVW,OAAO,MAAM,OAAA,CACtC,QAAQ,MAAM,KAAK,CAAC,CACpB,KAAK,OAAO,QAAQ,eAAe,GAAG,OAAO,SAAS,YAAY,CAAC;GAQxC,WAAA,QANJ,OAAO,eAAA,CAAgB,QAAQ;IACvD;IACA,OAAO,MAAM;IACb,GAAI,MAAM,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;GAC5D,CAAC;EAEuC;CAC1C,CAAC,CACH,CACF;CAEA,MAAM,QAAQ,cAAc,KAC1B,MAAM,QAAQ,aAAa,QAAQ,gBAAgB,QAAQ,KAAK,CAAC,GACjE,MAAM,QAAQ,aAAa,MAAM,QAAQ,MAAM,QAAQ,CAAC,GACxD,MAAM,QAAQ,CAAC,aAAa,UAAU,CAAC,CACzC;CAEA,OAAO,OAAO,OAAO;EACnB;EACA;EACA;EACA;EACA;EACA,YAAY;GAAE;GAAO;GAAQ;GAAmB;GAAQ;EAAQ;EAChE,OAAO,eAAe,OAAO,QAAQ,mBAAmB,QAAQ,OAAO;EACvE,SAAS;GACP,OAAO,MAAM;GACb,QAAQ,OAAO;GACf,mBAAmB,kBAAkB;GACrC,iBAAiB,OAAO;GACxB,kBAAkB,QAAQ;EAC5B;CACF,CAAC;AACH"}