@yielded/auth 0.1.0-beta.1

package/dist/drizzle/passkey-flow.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-flow.mjs","names":[],"sources":["../../src/drizzle/passkey-flow.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- private mapped-row kernel; public wrappers retain concrete tables. */\nimport { sql } from \"drizzle-orm\";\nimport { DateTime, Effect } from \"effect\";\n\nimport {\n  PasskeyClaim,\n  type PasskeyAccess,\n  type PasskeyAssertionVerified,\n  type PasskeyCeremony,\n  type PasskeyCredential,\n  type PasskeyEvidence,\n} from \"../passkey/models\";\nimport type { PasskeyMethodPolicy } from \"../passkey/policy\";\nimport { snapshotPasskeySync } from \"../passkey/snapshot\";\nimport type { SubjectId } from \"../Schema\";\nimport {\n  admissionCondition,\n  chargeScopes,\n  guardAdmission,\n  guardChargeSet,\n  insertCharges,\n  lockAdmission,\n  readCharges,\n} from \"./passkey-admission\";\nimport {\n  readCredential,\n  readModule,\n  readPolicyGuards,\n  readRevision,\n  readSubject,\n  type CredentialRead,\n  type SubjectRead,\n} from \"./passkey-credentials\";\nimport type { PasskeyFlowState } from \"./passkey-model\";\nimport {\n  releaseRegistrationCustody,\n  scrubRegistrationIntent,\n} from \"./passkey-registration-custody\";\nimport {\n  ceremonyStorage,\n  col,\n  credentialStorage,\n  equal,\n  existsExact,\n  invariant,\n  mappedColumns,\n  policyStorage,\n  profileStorage,\n  sameCredential,\n  sameRevision,\n  semanticCredentialColumns,\n  subjectScope,\n  targetScope,\n  CurrentPasskeyTransaction,\n} from \"./passkey-state\";\nimport { both } from \"./transaction-owner\";\n\nexport const assertionPurposes = [\"sign-in\", \"pending\", \"step-up\", \"action\"] as const;\n\nexport const contextPurpose = {\n  SignIn: \"sign-in\",\n  Pending: \"pending\",\n  StepUp: \"step-up\",\n  Action: \"action\",\n  Enrollment: \"enrollment\",\n  Registration: \"registration\",\n} as const;\n\nexport interface FlowRead {\n  readonly row: Record<string, any>;\n  readonly ceremony: PasskeyCeremony;\n  readonly policy: PasskeyMethodPolicy;\n  readonly state: PasskeyFlowState;\n  readonly claim?: PasskeyClaim;\n  readonly credential?: PasskeyCredential;\n}\n\nexport const knownSubject = (ceremony: PasskeyCeremony): SubjectId | undefined =>\n  \"target\" in ceremony.context\n    ? ceremony.context.target.revision.subjectId\n    : ceremony.context._tag === \"Enrollment\"\n      ? ceremony.context.revision.subjectId\n      : undefined;\n\nexport const compatiblePolicy = (\n  ceremony: PasskeyCeremony,\n  original: PasskeyMethodPolicy,\n  current: PasskeyMethodPolicy,\n) => {\n  const selected = current.profiles.find(\n    (profile) => profile.profileId === ceremony.profile.profileId,\n  );\n\n  const issued = original.profiles.find(\n    (profile) => profile.profileId === ceremony.profile.profileId,\n  );\n\n  return (\n    ceremony.generation === current.generation &&\n    ceremony.generation === original.generation &&\n    selected !== undefined &&\n    issued !== undefined &&\n    profileStorage.encode(selected) === profileStorage.encode(ceremony.profile) &&\n    profileStorage.encode(issued) === profileStorage.encode(ceremony.profile) &&\n    ceremony.claimLifetimeMillis === original.claimLifetimeMillis &&\n    ceremony.expiresAtMillis > ceremony.issuedAtMillis &&\n    ceremony.expiresAtMillis <= ceremony.requestBindingExpiresAtMillis &&\n    ceremony.expiresAtMillis - ceremony.issuedAtMillis <= original.lifetimeMillis &&\n    ceremony.expiresAtMillis - ceremony.issuedAtMillis <= current.lifetimeMillis &&\n    ceremony.retentionUntilMillis === ceremony.issuedAtMillis + original.retentionMillis &&\n    contextPurpose[ceremony.context._tag] === ceremony.purpose &&\n    new Set(ceremony.allowedCredentials.map((item) => item.id)).size ===\n      ceremony.allowedCredentials.length\n  );\n};\n\nexport const liveCondition = (mapping: any, ceremony: PasskeyCeremony, claim?: PasskeyClaim) => {\n  const now = mapping.clock.engineNowMillis;\n\n  return both(\n    sql`${now} >= ${ceremony.issuedAtMillis}`,\n    sql`${now} < ${ceremony.expiresAtMillis}`,\n    sql`${now} < ${ceremony.requestBindingExpiresAtMillis}`,\n    \"target\" in ceremony.context\n      ? sql`${now} < ${ceremony.context.target.expiresAtMillis}`\n      : undefined,\n    claim === undefined\n      ? undefined\n      : both(sql`${now} >= ${claim.claimedAtMillis}`, sql`${now} < ${claim.claimExpiresAtMillis}`),\n  );\n};\n\nexport const matchesAccess = (ceremony: PasskeyCeremony, access: PasskeyAccess) =>\n  ceremony.moduleId === access.moduleId &&\n  ceremony.generation === access.generation &&\n  ceremony.purpose === access.purpose &&\n  ceremony.flowId === access.flowId &&\n  ceremony.requestBindingVerifier === access.requestBindingVerifier &&\n  ceremony.requestBindingExpiresAtMillis === access.requestBindingExpiresAtMillis;\n\nexport const readFlow = Effect.fn(\"passkey.readFlow\")(function* (mapping: any, flowId: string) {\n  const owner = yield* CurrentPasskeyTransaction;\n  const table = mapping.flow;\n\n  const row = (yield* owner.read(\n    table.table,\n    equal(table.table, {\n      [table.moduleId]: mapping.moduleId,\n      [table.flowId]: flowId,\n    }),\n    { limit: 1, columns: mappedColumns(table) },\n  )).rows[0];\n\n  if (row === undefined) return undefined;\n  const ceremony = ceremonyStorage.decode(row[table.snapshot]);\n  const policy = policyStorage.decode(row[table.policySnapshot]);\n\n  const state = Object.keys(table.states).find(\n    (name) => table.states[name] === row[table.state],\n  ) as PasskeyFlowState | undefined;\n\n  invariant(\n    state !== undefined && ceremony.moduleId === mapping.moduleId && ceremony.flowId === flowId,\n  );\n  invariant(\n    row[table.moduleId] === ceremony.moduleId &&\n      row[table.flowId] === ceremony.flowId &&\n      row[table.commandId] === ceremony.commandId,\n  );\n  invariant(\n    row[table.purpose] === ceremony.purpose && row[table.generation] === ceremony.generation,\n  );\n  invariant(\n    row[table.requestBindingVerifier] === ceremony.requestBindingVerifier &&\n      mapping.clock.decodeInstant(row[table.requestBindingExpiresAt]) ===\n        ceremony.requestBindingExpiresAtMillis,\n  );\n  invariant(\n    mapping.clock.decodeInstant(row[table.issuedAt]) === ceremony.issuedAtMillis &&\n      mapping.clock.decodeInstant(row[table.expiresAt]) === ceremony.expiresAtMillis &&\n      mapping.clock.decodeInstant(row[table.retentionUntil]) === ceremony.retentionUntilMillis,\n  );\n  invariant(compatiblePolicy(ceremony, policy, policy));\n\n  const credential =\n    row[table.credentialSnapshot] === null\n      ? undefined\n      : credentialStorage.decode(row[table.credentialSnapshot]);\n\n  const subject = credential?.revision.subjectId ?? knownSubject(ceremony);\n\n  invariant(\n    row[table.subjectScope] === (subject === undefined ? null : subjectScope(subject)) &&\n      row[table.targetScope] === targetScope(ceremony),\n  );\n  if (state === \"Pending\") {\n    invariant(\n      row[table.claimId] === null &&\n        row[table.claimedAt] === null &&\n        row[table.claimExpiresAt] === null &&\n        credential === undefined,\n    );\n\n    return { row, ceremony, policy, state };\n  }\n\n  const claim =\n    row[table.claimId] === null\n      ? undefined\n      : snapshotPasskeySync(PasskeyClaim, {\n          ceremony,\n          claimId: row[table.claimId],\n          claimedAtMillis: mapping.clock.decodeInstant(row[table.claimedAt]),\n          claimExpiresAtMillis: mapping.clock.decodeInstant(row[table.claimExpiresAt]),\n        });\n\n  invariant(state !== \"Claimed\" || claim !== undefined);\n  if (claim !== undefined)\n    invariant(\n      claim.claimExpiresAtMillis ===\n        Math.min(claim.claimedAtMillis + ceremony.claimLifetimeMillis, ceremony.expiresAtMillis),\n    );\n\n  return {\n    row,\n    ceremony,\n    policy,\n    state,\n    ...(claim === undefined ? {} : { claim }),\n    ...(credential === undefined ? {} : { credential }),\n  };\n});\n\nexport const terminalFlow = Effect.fn(\"passkey.terminalFlow\")(function* (\n  mapping: any,\n  read: FlowRead,\n  state: \"Verified\" | \"Rejected\" | \"Ambiguous\",\n) {\n  const owner = yield* CurrentPasskeyTransaction;\n  const table = mapping.flow;\n\n  yield* owner.update(\n    table.table,\n    { [table.moduleId]: mapping.moduleId, [table.flowId]: read.ceremony.flowId },\n    {\n      [table.state]: table.states[state],\n      [table.version]: owner.marker,\n    },\n  );\n  owner.postconditions.push(\n    yield* existsExact(table.table, {\n      [table.moduleId]: mapping.moduleId,\n      [table.flowId]: read.ceremony.flowId,\n      [table.state]: table.states[state],\n      [table.version]: owner.marker,\n    }),\n  );\n\n  return state;\n});\n\nconst targetRevision = (ceremony: PasskeyCeremony) =>\n  \"target\" in ceremony.context\n    ? ceremony.context.target.revision\n    : ceremony.context._tag === \"Enrollment\"\n      ? ceremony.context.revision\n      : undefined;\n\nconst currentTarget = Effect.fn(\"passkey.currentTarget\")(function* (\n  mapping: any,\n  subject: SubjectRead | undefined,\n  ceremony: PasskeyCeremony,\n) {\n  const target = targetRevision(ceremony);\n\n  if (target === undefined) return true;\n  if (\n    subject === undefined ||\n    subject.subjectId !== target.subjectId ||\n    subject.securityRevision !== target.securityRevision\n  )\n    return false;\n\n  const current = yield* readRevision(\n    mapping.read,\n    subject,\n    target.credentials.map((item) => item.credentialId),\n  );\n\n  return current !== undefined && sameRevision(current, target);\n});\n\nexport const issueAssertion = Effect.fn(\"passkey.issueAssertion\")(function* (\n  mapping: any,\n  ceremony: PasskeyCeremony,\n  suppliedPolicy: PasskeyMethodPolicy,\n) {\n  const owner = yield* CurrentPasskeyTransaction;\n  const current = yield* readModule(mapping);\n\n  if (\n    current === undefined ||\n    ceremony.moduleId !== mapping.moduleId ||\n    !compatiblePolicy(ceremony, suppliedPolicy, current) ||\n    policyStorage.encode(suppliedPolicy) !== policyStorage.encode(current)\n  )\n    return { _tag: \"Rejected\" } as const;\n  yield* lockAdmission(mapping);\n  const subjectId = knownSubject(ceremony);\n  const subject = subjectId === undefined ? undefined : yield* readSubject(mapping.read, subjectId);\n\n  yield* readPolicyGuards(mapping);\n  if (!(yield* currentTarget(mapping, subject, ceremony))) return { _tag: \"Rejected\" } as const;\n  if (\n    ceremony.context._tag === \"SignIn\" &&\n    (!ceremony.profile.primarySignIn ||\n      ceremony.profile.userVerification !== \"required\" ||\n      ceremony.profile.residentKey !== \"required\")\n  )\n    return { _tag: \"Rejected\" } as const;\n  const table = mapping.flow;\n\n  const sameCommand = yield* owner.read(\n    table.table,\n    equal(table.table, {\n      [table.moduleId]: mapping.moduleId,\n      [table.commandId]: ceremony.commandId,\n    }),\n    { limit: 1 },\n  );\n\n  const sameFlow = yield* readFlow(mapping, ceremony.flowId);\n\n  if (sameCommand.rows.length !== 0 || sameFlow !== undefined) return { _tag: \"Rejected\" } as const;\n  const kinds = chargeScopes(ceremony, subjectId).map((item) => item.kind);\n\n  if (\n    !(yield* owner.check(liveCondition(mapping, ceremony))) ||\n    !(yield* owner.check(\n      admissionCondition(mapping, [current], ceremony, subjectId, kinds, true, false),\n    ))\n  )\n    return { _tag: \"Rejected\" } as const;\n\n  const values = {\n    ...table.encodeInsert({ ceremony, policy: suppliedPolicy, marker: owner.marker }),\n    [table.moduleId]: ceremony.moduleId,\n    [table.flowId]: ceremony.flowId,\n    [table.commandId]: ceremony.commandId,\n    [table.purpose]: ceremony.purpose,\n    [table.state]: table.states.Pending,\n    [table.version]: owner.marker,\n    [table.generation]: ceremony.generation,\n    [table.snapshot]: ceremonyStorage.encode(ceremony),\n    [table.policySnapshot]: policyStorage.encode(suppliedPolicy),\n    [table.requestBindingVerifier]: ceremony.requestBindingVerifier,\n    [table.requestBindingExpiresAt]: mapping.clock.encodeInstant(\n      ceremony.requestBindingExpiresAtMillis,\n    ),\n    [table.issuedAt]: mapping.clock.encodeInstant(ceremony.issuedAtMillis),\n    [table.expiresAt]: mapping.clock.encodeInstant(ceremony.expiresAtMillis),\n    [table.retentionUntil]: mapping.clock.encodeInstant(ceremony.retentionUntilMillis),\n    [table.claimId]: null,\n    [table.claimedAt]: null,\n    [table.claimExpiresAt]: null,\n    [table.credentialSnapshot]: null,\n    [table.subjectScope]: subjectId === undefined ? null : subjectScope(subjectId),\n    [table.targetScope]: targetScope(ceremony),\n  };\n\n  // Empty-key observations now expect this exact inserted row as well.\n  const inserted = yield* owner.insert(table.table, values, {\n    [table.moduleId]: mapping.moduleId,\n    [table.flowId]: ceremony.flowId,\n  });\n\n  sameCommand.rows = inserted.rows;\n  for (const observation of owner.observations)\n    if (observation.table === table.table && observation.rows.length === 0)\n      observation.rows = inserted.rows;\n  yield* insertCharges(mapping, ceremony, suppliedPolicy, kinds, subjectId);\n  yield* guardChargeSet(mapping, ceremony, subjectId);\n  yield* guardAdmission(mapping, [current], ceremony, subjectId);\n  owner.postconditions.push(liveCondition(mapping, ceremony));\n\n  return { _tag: \"Issued\", ceremony } as const;\n});\n\nexport const contextAssertion = Effect.fn(\"passkey.contextAssertion\")(function* (\n  mapping: any,\n  access: PasskeyAccess,\n) {\n  const owner = yield* CurrentPasskeyTransaction;\n\n  if (access.moduleId !== mapping.moduleId) return undefined;\n  const current = yield* readModule(mapping);\n\n  if (current === undefined) return undefined;\n  yield* readPolicyGuards(mapping);\n  const read = yield* readFlow(mapping, access.flowId);\n\n  if (\n    read === undefined ||\n    read.state !== \"Pending\" ||\n    !matchesAccess(read.ceremony, access) ||\n    !compatiblePolicy(read.ceremony, read.policy, current)\n  )\n    return undefined;\n  if (!(yield* owner.check(liveCondition(mapping, read.ceremony)))) return undefined;\n  owner.postconditions.push(liveCondition(mapping, read.ceremony));\n\n  return read.ceremony;\n});\n\nexport const claimAssertion = Effect.fn(\"passkey.claimAssertion\")(function* (\n  mapping: any,\n  input: {\n    readonly access: PasskeyAccess;\n    readonly policy: PasskeyMethodPolicy;\n    readonly ceremony: PasskeyCeremony;\n    readonly claimId: string;\n    readonly credential?: PasskeyCredential;\n  },\n) {\n  const owner = yield* CurrentPasskeyTransaction;\n  const current = yield* readModule(mapping);\n\n  if (current === undefined || input.access.moduleId !== mapping.moduleId)\n    return { _tag: \"Rejected\" } as const;\n  yield* lockAdmission(mapping);\n  const expectedSubject = knownSubject(input.ceremony);\n  const subjectId = expectedSubject ?? input.credential?.revision.subjectId;\n  const subject = subjectId === undefined ? undefined : yield* readSubject(mapping.read, subjectId);\n\n  yield* readPolicyGuards(mapping);\n\n  const requested =\n    targetRevision(input.ceremony)?.credentials.map((item) => item.credentialId) ??\n    input.credential?.revision.credentials.map((item) => item.credentialId);\n\n  const credential =\n    input.credential === undefined || subject === undefined\n      ? undefined\n      : yield* readCredential(\n          mapping.read,\n          subject,\n          input.ceremony.profile.rpId,\n          input.credential.protocolCredentialId,\n          requested,\n        );\n\n  const read = yield* readFlow(mapping, input.access.flowId);\n\n  if (read === undefined || read.state !== \"Pending\" || !matchesAccess(read.ceremony, input.access))\n    return { _tag: \"Rejected\" } as const;\n  invariant(ceremonyStorage.encode(read.ceremony) === ceremonyStorage.encode(input.ceremony));\n\n  const reject = Effect.gen(function* () {\n    yield* terminalFlow(mapping, read, \"Rejected\");\n\n    return { _tag: \"Rejected\" } as const;\n  });\n\n  if (\n    !compatiblePolicy(read.ceremony, read.policy, current) ||\n    policyStorage.encode(input.policy) !== policyStorage.encode(current) ||\n    !(yield* currentTarget(mapping, subject, read.ceremony))\n  )\n    return yield* reject;\n  if (\n    input.credential !== undefined &&\n    (credential === undefined || !sameCredential(input.credential, credential.credential))\n  )\n    return yield* reject;\n  if (input.credential !== undefined && credential !== undefined) {\n    const original = input.credential.revision;\n    const actual = credential.credential.revision;\n    const ids = [...new Set([...(requested ?? []), input.credential.credentialId])];\n\n    if (\n      original.subjectId !== actual.subjectId ||\n      original.securityRevision !== actual.securityRevision ||\n      ids.some((id) => {\n        const before = original.credentials.find((item) => item.credentialId === id);\n        const after = actual.credentials.find((item) => item.credentialId === id);\n\n        // A target can include non-passkey factors absent from the minimum\n        // lookup snapshot; currentTarget independently checks those originals.\n        return (\n          after === undefined ||\n          (before === undefined\n            ? id === input.credential?.credentialId || targetRevision(read.ceremony) === undefined\n            : before.revision !== after.revision)\n        );\n      })\n    )\n      return yield* reject;\n  }\n  if (!(yield* owner.check(liveCondition(mapping, read.ceremony)))) return yield* reject;\n  yield* readCharges(mapping, read.ceremony, read.policy, expectedSubject);\n  const resolved = expectedSubject === undefined && subjectId !== undefined;\n\n  if (\n    !(yield* owner.check(\n      admissionCondition(\n        mapping,\n        [read.policy, current],\n        read.ceremony,\n        subjectId,\n        resolved ? [\"subject\"] : [],\n        false,\n        resolved,\n      ),\n    ))\n  )\n    return yield* reject;\n  const claimedAtMillis = yield* owner.now(mapping.clock);\n\n  const claim = snapshotPasskeySync(PasskeyClaim, {\n    ceremony: read.ceremony,\n    claimId: input.claimId,\n    claimedAtMillis,\n    claimExpiresAtMillis: Math.min(\n      claimedAtMillis + read.ceremony.claimLifetimeMillis,\n      read.ceremony.expiresAtMillis,\n    ),\n  });\n\n  const table = mapping.flow;\n\n  yield* owner.update(\n    table.table,\n    { [table.moduleId]: mapping.moduleId, [table.flowId]: read.ceremony.flowId },\n    {\n      [table.state]: table.states.Claimed,\n      [table.version]: owner.marker,\n      [table.claimId]: claim.claimId,\n      [table.claimedAt]: mapping.clock.encodeInstant(claim.claimedAtMillis),\n      [table.claimExpiresAt]: mapping.clock.encodeInstant(claim.claimExpiresAtMillis),\n      [table.credentialSnapshot]:\n        input.credential === undefined ? null : credentialStorage.encode(input.credential),\n      [table.subjectScope]: subjectId === undefined ? null : subjectScope(subjectId),\n    },\n  );\n  if (resolved) yield* insertCharges(mapping, read.ceremony, read.policy, [\"subject\"], subjectId);\n  yield* guardChargeSet(mapping, read.ceremony, subjectId);\n  yield* guardAdmission(mapping, [read.policy, current], read.ceremony, subjectId);\n  owner.postconditions.push(liveCondition(mapping, read.ceremony, claim));\n\n  return { _tag: \"Claimed\", claim } as const;\n});\n\nexport const exactClaim = (read: FlowRead, claim: PasskeyClaim) =>\n  read.state === \"Claimed\" &&\n  read.claim !== undefined &&\n  read.claim.claimId === claim.claimId &&\n  read.claim.claimedAtMillis === claim.claimedAtMillis &&\n  read.claim.claimExpiresAtMillis === claim.claimExpiresAtMillis &&\n  ceremonyStorage.encode(read.ceremony) === ceremonyStorage.encode(claim.ceremony);\n\nconst evidenceMatches = (\n  ceremony: PasskeyCeremony,\n  captured: PasskeyCredential,\n  credential: PasskeyCredential,\n  assertion: PasskeyAssertionVerified,\n  evidence: typeof PasskeyEvidence.Type,\n) => {\n  const proof = evidence.proofs[0];\n  const target = targetRevision(ceremony);\n  const original = target ?? captured.revision;\n\n  const ids = [\n    ...new Set([...original.credentials.map((item) => item.credentialId), credential.credentialId]),\n  ];\n\n  const expected = {\n    ...credential.revision,\n    credentials: credential.revision.credentials.filter((item) => ids.includes(item.credentialId)),\n  };\n\n  const selected = captured.revision.credentials.find(\n    (item) => item.credentialId === credential.credentialId,\n  );\n\n  return (\n    evidence.proofs.length === 1 &&\n    proof !== undefined &&\n    proof.method === \"passkey\" &&\n    proof.credentialId === credential.credentialId &&\n    proof.factors.length === 1 &&\n    proof.factors[0] === \"possession\" &&\n    proof.userVerified === assertion.userVerified &&\n    proof.phishingResistant &&\n    DateTime.toEpochMillis(proof.verifiedAt) === ceremony.issuedAtMillis &&\n    evidence.flowId ===\n      (\"target\" in ceremony.context ? ceremony.context.target.flowId : ceremony.flowId) &&\n    evidence.bindingDigest ===\n      (\"target\" in ceremony.context\n        ? ceremony.context.target.bindingDigest\n        : ceremony.requestBindingVerifier) &&\n    expected.credentials.length === ids.length &&\n    sameRevision(evidence.revision, expected) &&\n    original.subjectId === expected.subjectId &&\n    original.securityRevision === expected.securityRevision &&\n    original.credentials.every((item) =>\n      expected.credentials.some(\n        (current) =>\n          current.credentialId === item.credentialId && current.revision === item.revision,\n      ),\n    ) &&\n    selected !== undefined &&\n    expected.credentials.some(\n      (item) => item.credentialId === selected.credentialId && item.revision === selected.revision,\n    )\n  );\n};\n\nconst updateTelemetry = Effect.fn(\"passkey.updateTelemetry\")(function* (\n  mapping: any,\n  found: CredentialRead,\n  assertion: PasskeyAssertionVerified,\n  dialect: \"pg\" | \"mysql\" | \"sqlite\",\n) {\n  const owner = yield* CurrentPasskeyTransaction;\n  const table = mapping.read.credential;\n  const counter = sql`${col(table.table, table.counter)}`;\n  const maximum = sql`${col(table.table, table.maximumCounter)}`;\n\n  const max = (...values: ReadonlyArray<ReturnType<typeof sql>>) =>\n    dialect === \"sqlite\"\n      ? sql`max(${sql.join([...values], sql`, `)})`\n      : sql`greatest(${sql.join([...values], sql`, `)})`;\n\n  const semantic = Object.fromEntries(\n    semanticCredentialColumns(table).map((column) => [column, found.row[column]]),\n  );\n\n  const bs = mapping.telemetry.encodeBackupState(assertion.backupState);\n  const synced = found.credential.backupEligible;\n  const merged = max(counter, maximum, sql`${assertion.counter}`);\n\n  const currentCounter = synced\n    ? sql`1 = 1`\n    : sql`((${counter} = 0 and ${assertion.counter} = 0) or ${counter} < ${assertion.counter})`;\n\n  yield* owner.updateGuarded(\n    table.table,\n    both(owner.exact(table.table, semantic), table.activeCondition, currentCounter),\n    {\n      [table.counter]: synced ? merged : assertion.counter,\n      [table.maximumCounter]: merged,\n      [table.backupState]: bs,\n    },\n    {\n      rows: 1,\n      postcondition: yield* existsExact(\n        table.table,\n        { ...semantic, [table.backupState]: bs },\n        both(\n          synced ? sql`${counter} = ${maximum}` : sql`${counter} = ${assertion.counter}`,\n          sql`${maximum} >= ${assertion.counter}`,\n        ),\n      ),\n    },\n  );\n  const earliest = yield* owner.now(mapping.clock);\n  const lastUsed = sql`${col(table.table, mapping.telemetry.lastUsedAt)}`;\n  const millis = mapping.clock.toMillis(lastUsed);\n\n  yield* owner.finalUpdate(\n    table.table,\n    owner.exact(table.table, semantic),\n    {\n      [mapping.telemetry.lastUsedAt]: mapping.clock.fromMillis(\n        max(sql`coalesce(${millis}, 0)`, mapping.clock.engineNowMillis),\n      ),\n    },\n    {\n      rows: 1,\n      postcondition: yield* existsExact(\n        table.table,\n        semantic,\n        both(sql`${millis} >= ${earliest}`, sql`${millis} <= ${mapping.clock.engineNowMillis}`),\n      ),\n    },\n  );\n});\n\nexport const settleAssertion = Effect.fn(\"passkey.settleAssertion\")(function* (\n  mapping: any,\n  claim: PasskeyClaim,\n  outcome:\n    | { readonly _tag: \"Rejected\" | \"Ambiguous\" }\n    | {\n        readonly _tag: \"Assertion\";\n        readonly credential: PasskeyCredential;\n        readonly assertion: PasskeyAssertionVerified;\n        readonly evidence: typeof PasskeyEvidence.Type;\n      },\n  dialect: \"pg\" | \"mysql\" | \"sqlite\",\n) {\n  const owner = yield* CurrentPasskeyTransaction;\n  const assertedCredential = outcome._tag === \"Assertion\" ? outcome.credential : undefined;\n  const current = yield* readModule(mapping);\n\n  if (current === undefined || claim.ceremony.moduleId !== mapping.moduleId)\n    return \"Rejected\" as const;\n  yield* lockAdmission(mapping);\n\n  const originalIds =\n    targetRevision(claim.ceremony)?.credentials.map((item) => item.credentialId) ??\n    (outcome._tag === \"Assertion\"\n      ? outcome.credential.revision.credentials.map((item) => item.credentialId)\n      : undefined);\n\n  const subjectId =\n    outcome._tag === \"Assertion\"\n      ? outcome.credential.revision.subjectId\n      : knownSubject(claim.ceremony);\n\n  const subject = subjectId === undefined ? undefined : yield* readSubject(mapping.read, subjectId);\n\n  yield* readPolicyGuards(mapping);\n\n  const found =\n    outcome._tag !== \"Assertion\" || subject === undefined\n      ? undefined\n      : yield* readCredential(\n          mapping.read,\n          subject,\n          claim.ceremony.profile.rpId,\n          outcome.credential.protocolCredentialId,\n          originalIds,\n        );\n\n  const read = yield* readFlow(mapping, claim.ceremony.flowId);\n\n  if (read === undefined || !exactClaim(read, claim)) return \"Rejected\" as const;\n  if (outcome._tag !== \"Assertion\") return yield* terminalFlow(mapping, read, outcome._tag);\n  invariant(assertedCredential !== undefined);\n  const captured = \"credential\" in read ? read.credential : undefined;\n  const assertion = outcome.assertion;\n\n  if (\n    captured === undefined ||\n    found === undefined ||\n    !compatiblePolicy(read.ceremony, read.policy, current) ||\n    !sameCredential(captured, assertedCredential) ||\n    !sameCredential(captured, found.credential)\n  )\n    return yield* terminalFlow(mapping, read, \"Rejected\");\n  const credential = found.credential;\n  const profile = read.ceremony.profile;\n\n  if (\n    assertion.protocolCredentialId !== credential.protocolCredentialId ||\n    (assertion.userHandle !== undefined && assertion.userHandle !== credential.userHandle) ||\n    assertion.backupEligible !== credential.backupEligible ||\n    (assertion.backupState && !assertion.backupEligible) ||\n    (profile.userVerification === \"required\" && !assertion.userVerified) ||\n    !profile.algorithms.includes(credential.algorithm) ||\n    (read.ceremony.allowedCredentials.length !== 0 &&\n      !read.ceremony.allowedCredentials.some(\n        (item) => item.id === credential.protocolCredentialId,\n      )) ||\n    (read.ceremony.purpose === \"sign-in\" &&\n      (assertion.userHandle !== credential.userHandle ||\n        !credential.primarySignIn ||\n        !credential.enrollmentUserVerified ||\n        !credential.profile.primarySignIn ||\n        credential.profile.userVerification !== \"required\" ||\n        !assertion.userVerified)) ||\n    !evidenceMatches(read.ceremony, captured, credential, assertion, outcome.evidence) ||\n    !(yield* owner.check(liveCondition(mapping, read.ceremony, claim)))\n  )\n    return yield* terminalFlow(mapping, read, \"Rejected\");\n  yield* readCharges(mapping, read.ceremony, read.policy, credential.revision.subjectId);\n  yield* guardChargeSet(mapping, read.ceremony, credential.revision.subjectId);\n  yield* updateTelemetry(mapping, found, assertion, dialect);\n  yield* terminalFlow(mapping, read, \"Verified\");\n  owner.postconditions.push(liveCondition(mapping, read.ceremony, claim));\n\n  return \"Verified\" as const;\n});\n\nconst purposeCondition = (table: any, purposes: ReadonlyArray<string>) =>\n  sql`${col(table.table, table.purpose)} in (${sql.join(\n    purposes.map((purpose) => sql`${purpose}`),\n    sql`, `,\n  )})`;\n\nconst custodyFree = (mapping: any, flowExpression: ReturnType<typeof sql>) => {\n  if (mapping.intent === undefined) return sql`1 = 1`;\n  const intent = mapping.intent;\n\n  return sql`not exists (select 1 from ${intent.table} where ${both(\n    equal(intent.table, { [intent.moduleId]: mapping.moduleId }),\n    sql`${col(intent.table, intent.flowId)} = ${flowExpression}`,\n    intent.custodyCondition,\n  )})`;\n};\n\nconst flowDue = (mapping: any, purposes: ReadonlyArray<string>) => {\n  const flow = mapping.flow,\n    charge = mapping.charge,\n    now = mapping.clock.engineNowMillis;\n\n  const state = sql`${col(flow.table, flow.state)}`;\n  const retained = sql`${mapping.clock.toMillis(sql`${col(flow.table, flow.retentionUntil)}`)} <= ${now}`;\n\n  const chargeLive = sql`exists (select 1 from ${charge.table} where ${both(\n    equal(charge.table, { [charge.moduleId]: mapping.moduleId }),\n    sql`${col(charge.table, charge.flowId)} = ${col(flow.table, flow.flowId)}`,\n    sql`(${col(charge.table, charge.retainUntil)} is null or ${mapping.clock.toMillis(sql`${col(charge.table, charge.retainUntil)}`)} > ${now})`,\n  )})`;\n\n  return both(\n    equal(flow.table, { [flow.moduleId]: mapping.moduleId }),\n    purposeCondition(flow, purposes),\n    sql`((${state} = ${flow.states.Pending} and ${mapping.clock.toMillis(sql`${col(flow.table, flow.expiresAt)}`)} <= ${now}) or\n      (${state} = ${flow.states.Claimed} and ${mapping.clock.toMillis(sql`${col(flow.table, flow.claimExpiresAt)}`)} <= ${now}) or\n      (${state} in (${flow.states.Verified}, ${flow.states.Rejected}, ${flow.states.Ambiguous}, ${flow.states.RegistrationAccepted}) and ${retained} and not (${chargeLive}) and ${custodyFree(mapping, sql`${col(flow.table, flow.flowId)}`)}))`,\n  );\n};\n\nconst chargeDue = (mapping: any, purposes: ReadonlyArray<string>) => {\n  const charge = mapping.charge;\n\n  return both(\n    equal(charge.table, { [charge.moduleId]: mapping.moduleId }),\n    purposeCondition(charge, purposes),\n    sql`${col(charge.table, charge.admittedAt)} is not null and ${mapping.clock.toMillis(sql`${col(charge.table, charge.retainUntil)}`)} <= ${mapping.clock.engineNowMillis}`,\n    custodyFree(mapping, sql`${col(charge.table, charge.flowId)}`),\n  );\n};\n\n/** Flow transitions and row removals share one bound. Prepared hasMore is\n * predicted from this owner's staged changes, then asserted after final writes. */\nexport const cleanupCeremonies = Effect.fn(\"passkey.cleanupCeremonies\")(function* (\n  mapping: any,\n  input: { readonly moduleId: string; readonly nowMillis: number; readonly limit: number },\n  purposes: ReadonlyArray<string>,\n) {\n  const owner = yield* CurrentPasskeyTransaction;\n\n  invariant(\n    input.moduleId === mapping.moduleId &&\n      Number.isSafeInteger(input.nowMillis) &&\n      input.nowMillis >= 0 &&\n      Number.isSafeInteger(input.limit) &&\n      input.limit >= 1 &&\n      input.limit <= 1000,\n  );\n  yield* readModule(mapping);\n  yield* lockAdmission(mapping);\n  yield* readPolicyGuards(mapping);\n\n  const flow = mapping.flow,\n    charge = mapping.charge;\n\n  const rows = (yield* owner.read(flow.table, flowDue(mapping, purposes), {\n    limit: input.limit,\n    takeOnly: true,\n    observe: false,\n    orderBy: sql`${col(flow.table, flow.flowId)}`,\n  })).rows;\n\n  const touched: string[] = [];\n  const transitioned: FlowRead[] = [];\n\n  let terminalized = 0,\n    removed = 0;\n\n  for (const candidate of rows) {\n    const read = yield* readFlow(mapping, candidate[flow.flowId]);\n\n    if (read === undefined) continue;\n    invariant(\n      yield* owner.check(\n        sql`exists (select 1 from ${flow.table} where ${both(equal(flow.table, { [flow.moduleId]: mapping.moduleId, [flow.flowId]: read.ceremony.flowId }), flowDue(mapping, purposes))})`,\n      ),\n    );\n    touched.push(read.ceremony.flowId);\n    if (read.state === \"Pending\" || read.state === \"Claimed\") {\n      const deadline =\n        read.state === \"Pending\" ? read.ceremony.expiresAtMillis : read.claim!.claimExpiresAtMillis;\n\n      if (read.state === \"Pending\") yield* releaseRegistrationCustody(mapping, read.ceremony);\n      yield* terminalFlow(mapping, read, read.state === \"Pending\" ? \"Rejected\" : \"Ambiguous\");\n      owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${deadline}`);\n      transitioned.push(read);\n      terminalized++;\n    } else {\n      yield* scrubRegistrationIntent(mapping, read.ceremony);\n      yield* owner.remove(flow.table, {\n        [flow.moduleId]: mapping.moduleId,\n        [flow.flowId]: read.ceremony.flowId,\n      });\n      owner.postconditions.push(\n        sql`${mapping.clock.engineNowMillis} >= ${read.ceremony.retentionUntilMillis}`,\n        custodyFree(mapping, sql`${read.ceremony.flowId}`),\n        sql`not exists (select 1 from ${charge.table} where ${both(\n          equal(charge.table, {\n            [charge.moduleId]: mapping.moduleId,\n            [charge.flowId]: read.ceremony.flowId,\n          }),\n          sql`(${col(charge.table, charge.retainUntil)} is null or ${mapping.clock.toMillis(sql`${col(charge.table, charge.retainUntil)}`)} > ${mapping.clock.engineNowMillis})`,\n        )})`,\n      );\n      removed++;\n    }\n  }\n  const removedCharges: Array<{ flowId: string; kind: string }> = [];\n  const remaining = input.limit - terminalized - removed;\n\n  if (remaining > 0) {\n    const charges = (yield* owner.read(charge.table, chargeDue(mapping, purposes), {\n      limit: remaining,\n      takeOnly: true,\n      observe: false,\n      orderBy: sql`${col(charge.table, charge.flowId)}, ${col(charge.table, charge.kind)}`,\n    })).rows;\n\n    for (const candidate of charges) {\n      const identity = {\n        [charge.moduleId]: mapping.moduleId,\n        [charge.flowId]: candidate[charge.flowId],\n        [charge.kind]: candidate[charge.kind],\n      };\n\n      const selected = (yield* owner.read(charge.table, equal(charge.table, identity), {\n        limit: 1,\n      })).rows[0];\n\n      invariant(selected !== undefined);\n      const horizon = mapping.clock.decodeInstant(selected[charge.retainUntil]);\n\n      invariant(Number.isSafeInteger(horizon));\n      yield* owner.remove(charge.table, identity);\n      owner.postconditions.push(\n        sql`${mapping.clock.engineNowMillis} >= ${horizon}`,\n        custodyFree(mapping, sql`${candidate[charge.flowId]}`),\n      );\n      removedCharges.push({ flowId: candidate[charge.flowId], kind: candidate[charge.kind] });\n      removed++;\n    }\n  }\n\n  const excludeFlows =\n    touched.length === 0\n      ? undefined\n      : sql`${col(flow.table, flow.flowId)} not in (${sql.join(\n          touched.map((id) => sql`${id}`),\n          sql`, `,\n        )})`;\n\n  const excludeCharges = removedCharges.map(\n    (item) =>\n      sql`not (${equal(charge.table, { [charge.flowId]: item.flowId, [charge.kind]: item.kind })})`,\n  );\n\n  const predicted = sql`exists (select 1 from ${flow.table} where ${both(flowDue(mapping, purposes), excludeFlows)}) or exists (select 1 from ${charge.table} where ${both(chargeDue(mapping, purposes), ...excludeCharges)})`;\n  // A transitioned row cannot also be removed by this call, but may be due now.\n  // Read through check only for unchanged rows; D1's prebatch assertion must use\n  // this predictive predicate, while the final assertion uses actual states.\n  let hasMore = yield* owner.check(predicted);\n\n  for (const read of transitioned) {\n    if (read.ceremony.retentionUntilMillis > (yield* owner.now(mapping.clock))) continue;\n    const liveCharges = sql`exists (select 1 from ${charge.table} where ${both(equal(charge.table, { [charge.moduleId]: mapping.moduleId, [charge.flowId]: read.ceremony.flowId }), sql`${mapping.clock.toMillis(sql`${col(charge.table, charge.retainUntil)}`)} > ${mapping.clock.engineNowMillis}`, ...excludeCharges)})`;\n\n    if (\n      !(yield* owner.check(liveCharges)) &&\n      (yield* owner.check(custodyFree(mapping, sql`${read.ceremony.flowId}`)))\n    )\n      hasMore = true;\n  }\n  const actual = sql`exists (select 1 from ${flow.table} where ${flowDue(mapping, purposes)}) or exists (select 1 from ${charge.table} where ${chargeDue(mapping, purposes)})`;\n\n  owner.postconditions.push(hasMore ? actual : sql`not (${actual})`);\n\n  return { terminalized, removed, hasMore };\n});\n"],"mappings":";;;;;;;;;;AAyDA,MAAa,oBAAoB;CAAC;CAAW;CAAW;CAAW;AAAQ;AAE3E,MAAa,iBAAiB;CAC5B,QAAQ;CACR,SAAS;CACT,QAAQ;CACR,QAAQ;CACR,YAAY;CACZ,cAAc;AAChB;AAWA,MAAa,gBAAgB,aAC3B,YAAY,SAAS,UACjB,SAAS,QAAQ,OAAO,SAAS,YACjC,SAAS,QAAQ,SAAS,eACxB,SAAS,QAAQ,SAAS,YAC1B,KAAA;AAER,MAAa,oBACX,UACA,UACA,YACG;CACH,MAAM,WAAW,QAAQ,SAAS,MAC/B,YAAY,QAAQ,cAAc,SAAS,QAAQ,SACtD;CAEA,MAAM,SAAS,SAAS,SAAS,MAC9B,YAAY,QAAQ,cAAc,SAAS,QAAQ,SACtD;CAEA,OACE,SAAS,eAAe,QAAQ,cAChC,SAAS,eAAe,SAAS,cACjC,aAAa,KAAA,KACb,WAAW,KAAA,KACX,eAAe,OAAO,QAAQ,MAAM,eAAe,OAAO,SAAS,OAAO,KAC1E,eAAe,OAAO,MAAM,MAAM,eAAe,OAAO,SAAS,OAAO,KACxE,SAAS,wBAAwB,SAAS,uBAC1C,SAAS,kBAAkB,SAAS,kBACpC,SAAS,mBAAmB,SAAS,iCACrC,SAAS,kBAAkB,SAAS,kBAAkB,SAAS,kBAC/D,SAAS,kBAAkB,SAAS,kBAAkB,QAAQ,kBAC9D,SAAS,yBAAyB,SAAS,iBAAiB,SAAS,mBACrE,eAAe,SAAS,QAAQ,UAAU,SAAS,WACnD,IAAI,IAAI,SAAS,mBAAmB,KAAK,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,SAC1D,SAAS,mBAAmB;AAElC;AAEA,MAAa,iBAAiB,SAAc,UAA2B,UAAyB;CAC9F,MAAM,MAAM,QAAQ,MAAM;CAE1B,OAAO,KACL,GAAG,GAAG,IAAI,MAAM,SAAS,kBACzB,GAAG,GAAG,IAAI,KAAK,SAAS,mBACxB,GAAG,GAAG,IAAI,KAAK,SAAS,iCACxB,YAAY,SAAS,UACjB,GAAG,GAAG,IAAI,KAAK,SAAS,QAAQ,OAAO,oBACvC,KAAA,GACJ,UAAU,KAAA,IACN,KAAA,IACA,KAAK,GAAG,GAAG,IAAI,MAAM,MAAM,mBAAmB,GAAG,GAAG,IAAI,KAAK,MAAM,sBAAsB,CAC/F;AACF;AAEA,MAAa,iBAAiB,UAA2B,WACvD,SAAS,aAAa,OAAO,YAC7B,SAAS,eAAe,OAAO,cAC/B,SAAS,YAAY,OAAO,WAC5B,SAAS,WAAW,OAAO,UAC3B,SAAS,2BAA2B,OAAO,0BAC3C,SAAS,kCAAkC,OAAO;AAEpD,MAAa,WAAW,OAAO,GAAG,kBAAkB,CAAC,CAAC,WAAW,SAAc,QAAgB;CAC7F,MAAM,QAAQ,OAAO;CACrB,MAAM,QAAQ,QAAQ;CAEtB,MAAM,OAAO,OAAO,MAAM,KACxB,MAAM,OACN,MAAM,MAAM,OAAO;GAChB,MAAM,WAAW,QAAQ;GACzB,MAAM,SAAS;CAClB,CAAC,GACD;EAAE,OAAO;EAAG,SAAS,cAAc,KAAK;CAAE,CAC5C,EAAA,CAAG,KAAK;CAER,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;CAC9B,MAAM,WAAW,gBAAgB,OAAO,IAAI,MAAM,SAAS;CAC3D,MAAM,SAAS,cAAc,OAAO,IAAI,MAAM,eAAe;CAE7D,MAAM,QAAQ,OAAO,KAAK,MAAM,MAAM,CAAC,CAAC,MACrC,SAAS,MAAM,OAAO,UAAU,IAAI,MAAM,MAC7C;CAEA,UACE,UAAU,KAAA,KAAa,SAAS,aAAa,QAAQ,YAAY,SAAS,WAAW,MACvF;CACA,UACE,IAAI,MAAM,cAAc,SAAS,YAC/B,IAAI,MAAM,YAAY,SAAS,UAC/B,IAAI,MAAM,eAAe,SAAS,SACtC;CACA,UACE,IAAI,MAAM,aAAa,SAAS,WAAW,IAAI,MAAM,gBAAgB,SAAS,UAChF;CACA,UACE,IAAI,MAAM,4BAA4B,SAAS,0BAC7C,QAAQ,MAAM,cAAc,IAAI,MAAM,wBAAwB,MAC5D,SAAS,6BACf;CACA,UACE,QAAQ,MAAM,cAAc,IAAI,MAAM,SAAS,MAAM,SAAS,kBAC5D,QAAQ,MAAM,cAAc,IAAI,MAAM,UAAU,MAAM,SAAS,mBAC/D,QAAQ,MAAM,cAAc,IAAI,MAAM,eAAe,MAAM,SAAS,oBACxE;CACA,UAAU,iBAAiB,UAAU,QAAQ,MAAM,CAAC;CAEpD,MAAM,aACJ,IAAI,MAAM,wBAAwB,OAC9B,KAAA,IACA,kBAAkB,OAAO,IAAI,MAAM,mBAAmB;CAE5D,MAAM,UAAU,YAAY,SAAS,aAAa,aAAa,QAAQ;CAEvE,UACE,IAAI,MAAM,mBAAmB,YAAY,KAAA,IAAY,OAAO,aAAa,OAAO,MAC9E,IAAI,MAAM,iBAAiB,YAAY,QAAQ,CACnD;CACA,IAAI,UAAU,WAAW;EACvB,UACE,IAAI,MAAM,aAAa,QACrB,IAAI,MAAM,eAAe,QACzB,IAAI,MAAM,oBAAoB,QAC9B,eAAe,KAAA,CACnB;EAEA,OAAO;GAAE;GAAK;GAAU;GAAQ;EAAM;CACxC;CAEA,MAAM,QACJ,IAAI,MAAM,aAAa,OACnB,KAAA,IACA,oBAAoB,cAAc;EAChC;EACA,SAAS,IAAI,MAAM;EACnB,iBAAiB,QAAQ,MAAM,cAAc,IAAI,MAAM,UAAU;EACjE,sBAAsB,QAAQ,MAAM,cAAc,IAAI,MAAM,eAAe;CAC7E,CAAC;CAEP,UAAU,UAAU,aAAa,UAAU,KAAA,CAAS;CACpD,IAAI,UAAU,KAAA,GACZ,UACE,MAAM,yBACJ,KAAK,IAAI,MAAM,kBAAkB,SAAS,qBAAqB,SAAS,eAAe,CAC3F;CAEF,OAAO;EACL;EACA;EACA;EACA;EACA,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;EACvC,GAAI,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW;CACnD;AACF,CAAC;AAED,MAAa,eAAe,OAAO,GAAG,sBAAsB,CAAC,CAAC,WAC5D,SACA,MACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,QAAQ,QAAQ;CAEtB,OAAO,MAAM,OACX,MAAM,OACN;GAAG,MAAM,WAAW,QAAQ;GAAW,MAAM,SAAS,KAAK,SAAS;CAAO,GAC3E;GACG,MAAM,QAAQ,MAAM,OAAO;GAC3B,MAAM,UAAU,MAAM;CACzB,CACF;CACA,MAAM,eAAe,KACnB,OAAO,YAAY,MAAM,OAAO;GAC7B,MAAM,WAAW,QAAQ;GACzB,MAAM,SAAS,KAAK,SAAS;GAC7B,MAAM,QAAQ,MAAM,OAAO;GAC3B,MAAM,UAAU,MAAM;CACzB,CAAC,CACH;CAEA,OAAO;AACT,CAAC;AAED,MAAM,kBAAkB,aACtB,YAAY,SAAS,UACjB,SAAS,QAAQ,OAAO,WACxB,SAAS,QAAQ,SAAS,eACxB,SAAS,QAAQ,WACjB,KAAA;AAER,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,SACA,UACA;CACA,MAAM,SAAS,eAAe,QAAQ;CAEtC,IAAI,WAAW,KAAA,GAAW,OAAO;CACjC,IACE,YAAY,KAAA,KACZ,QAAQ,cAAc,OAAO,aAC7B,QAAQ,qBAAqB,OAAO,kBAEpC,OAAO;CAET,MAAM,UAAU,OAAO,aACrB,QAAQ,MACR,SACA,OAAO,YAAY,KAAK,SAAS,KAAK,YAAY,CACpD;CAEA,OAAO,YAAY,KAAA,KAAa,aAAa,SAAS,MAAM;AAC9D,CAAC;AAED,MAAa,iBAAiB,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAChE,SACA,UACA,gBACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,UAAU,OAAO,WAAW,OAAO;CAEzC,IACE,YAAY,KAAA,KACZ,SAAS,aAAa,QAAQ,YAC9B,CAAC,iBAAiB,UAAU,gBAAgB,OAAO,KACnD,cAAc,OAAO,cAAc,MAAM,cAAc,OAAO,OAAO,GAErE,OAAO,EAAE,MAAM,WAAW;CAC5B,OAAO,cAAc,OAAO;CAC5B,MAAM,YAAY,aAAa,QAAQ;CACvC,MAAM,UAAU,cAAc,KAAA,IAAY,KAAA,IAAY,OAAO,YAAY,QAAQ,MAAM,SAAS;CAEhG,OAAO,iBAAiB,OAAO;CAC/B,IAAI,EAAE,OAAO,cAAc,SAAS,SAAS,QAAQ,IAAI,OAAO,EAAE,MAAM,WAAW;CACnF,IACE,SAAS,QAAQ,SAAS,aACzB,CAAC,SAAS,QAAQ,iBACjB,SAAS,QAAQ,qBAAqB,cACtC,SAAS,QAAQ,gBAAgB,aAEnC,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAM,QAAQ,QAAQ;CAEtB,MAAM,cAAc,OAAO,MAAM,KAC/B,MAAM,OACN,MAAM,MAAM,OAAO;GAChB,MAAM,WAAW,QAAQ;GACzB,MAAM,YAAY,SAAS;CAC9B,CAAC,GACD,EAAE,OAAO,EAAE,CACb;CAEA,MAAM,WAAW,OAAO,SAAS,SAAS,SAAS,MAAM;CAEzD,IAAI,YAAY,KAAK,WAAW,KAAK,aAAa,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CACvF,MAAM,QAAQ,aAAa,UAAU,SAAS,CAAC,CAAC,KAAK,SAAS,KAAK,IAAI;CAEvE,IACE,EAAE,OAAO,MAAM,MAAM,cAAc,SAAS,QAAQ,CAAC,MACrD,EAAE,OAAO,MAAM,MACb,mBAAmB,SAAS,CAAC,OAAO,GAAG,UAAU,WAAW,OAAO,MAAM,KAAK,CAChF,IAEA,OAAO,EAAE,MAAM,WAAW;CAE5B,MAAM,SAAS;EACb,GAAG,MAAM,aAAa;GAAE;GAAU,QAAQ;GAAgB,QAAQ,MAAM;EAAO,CAAC;GAC/E,MAAM,WAAW,SAAS;GAC1B,MAAM,SAAS,SAAS;GACxB,MAAM,YAAY,SAAS;GAC3B,MAAM,UAAU,SAAS;GACzB,MAAM,QAAQ,MAAM,OAAO;GAC3B,MAAM,UAAU,MAAM;GACtB,MAAM,aAAa,SAAS;GAC5B,MAAM,WAAW,gBAAgB,OAAO,QAAQ;GAChD,MAAM,iBAAiB,cAAc,OAAO,cAAc;GAC1D,MAAM,yBAAyB,SAAS;GACxC,MAAM,0BAA0B,QAAQ,MAAM,cAC7C,SAAS,6BACX;GACC,MAAM,WAAW,QAAQ,MAAM,cAAc,SAAS,cAAc;GACpE,MAAM,YAAY,QAAQ,MAAM,cAAc,SAAS,eAAe;GACtE,MAAM,iBAAiB,QAAQ,MAAM,cAAc,SAAS,oBAAoB;GAChF,MAAM,UAAU;GAChB,MAAM,YAAY;GAClB,MAAM,iBAAiB;GACvB,MAAM,qBAAqB;GAC3B,MAAM,eAAe,cAAc,KAAA,IAAY,OAAO,aAAa,SAAS;GAC5E,MAAM,cAAc,YAAY,QAAQ;CAC3C;CAGA,MAAM,WAAW,OAAO,MAAM,OAAO,MAAM,OAAO,QAAQ;GACvD,MAAM,WAAW,QAAQ;GACzB,MAAM,SAAS,SAAS;CAC3B,CAAC;CAED,YAAY,OAAO,SAAS;CAC5B,KAAK,MAAM,eAAe,MAAM,cAC9B,IAAI,YAAY,UAAU,MAAM,SAAS,YAAY,KAAK,WAAW,GACnE,YAAY,OAAO,SAAS;CAChC,OAAO,cAAc,SAAS,UAAU,gBAAgB,OAAO,SAAS;CACxE,OAAO,eAAe,SAAS,UAAU,SAAS;CAClD,OAAO,eAAe,SAAS,CAAC,OAAO,GAAG,UAAU,SAAS;CAC7D,MAAM,eAAe,KAAK,cAAc,SAAS,QAAQ,CAAC;CAE1D,OAAO;EAAE,MAAM;EAAU;CAAS;AACpC,CAAC;AAED,MAAa,mBAAmB,OAAO,GAAG,0BAA0B,CAAC,CAAC,WACpE,SACA,QACA;CACA,MAAM,QAAQ,OAAO;CAErB,IAAI,OAAO,aAAa,QAAQ,UAAU,OAAO,KAAA;CACjD,MAAM,UAAU,OAAO,WAAW,OAAO;CAEzC,IAAI,YAAY,KAAA,GAAW,OAAO,KAAA;CAClC,OAAO,iBAAiB,OAAO;CAC/B,MAAM,OAAO,OAAO,SAAS,SAAS,OAAO,MAAM;CAEnD,IACE,SAAS,KAAA,KACT,KAAK,UAAU,aACf,CAAC,cAAc,KAAK,UAAU,MAAM,KACpC,CAAC,iBAAiB,KAAK,UAAU,KAAK,QAAQ,OAAO,GAErD,OAAO,KAAA;CACT,IAAI,EAAE,OAAO,MAAM,MAAM,cAAc,SAAS,KAAK,QAAQ,CAAC,IAAI,OAAO,KAAA;CACzE,MAAM,eAAe,KAAK,cAAc,SAAS,KAAK,QAAQ,CAAC;CAE/D,OAAO,KAAK;AACd,CAAC;AAED,MAAa,iBAAiB,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAChE,SACA,OAOA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,UAAU,OAAO,WAAW,OAAO;CAEzC,IAAI,YAAY,KAAA,KAAa,MAAM,OAAO,aAAa,QAAQ,UAC7D,OAAO,EAAE,MAAM,WAAW;CAC5B,OAAO,cAAc,OAAO;CAC5B,MAAM,kBAAkB,aAAa,MAAM,QAAQ;CACnD,MAAM,YAAY,mBAAmB,MAAM,YAAY,SAAS;CAChE,MAAM,UAAU,cAAc,KAAA,IAAY,KAAA,IAAY,OAAO,YAAY,QAAQ,MAAM,SAAS;CAEhG,OAAO,iBAAiB,OAAO;CAE/B,MAAM,YACJ,eAAe,MAAM,QAAQ,CAAC,EAAE,YAAY,KAAK,SAAS,KAAK,YAAY,KAC3E,MAAM,YAAY,SAAS,YAAY,KAAK,SAAS,KAAK,YAAY;CAExE,MAAM,aACJ,MAAM,eAAe,KAAA,KAAa,YAAY,KAAA,IAC1C,KAAA,IACA,OAAO,eACL,QAAQ,MACR,SACA,MAAM,SAAS,QAAQ,MACvB,MAAM,WAAW,sBACjB,SACF;CAEN,MAAM,OAAO,OAAO,SAAS,SAAS,MAAM,OAAO,MAAM;CAEzD,IAAI,SAAS,KAAA,KAAa,KAAK,UAAU,aAAa,CAAC,cAAc,KAAK,UAAU,MAAM,MAAM,GAC9F,OAAO,EAAE,MAAM,WAAW;CAC5B,UAAU,gBAAgB,OAAO,KAAK,QAAQ,MAAM,gBAAgB,OAAO,MAAM,QAAQ,CAAC;CAE1F,MAAM,SAAS,OAAO,IAAI,aAAa;EACrC,OAAO,aAAa,SAAS,MAAM,UAAU;EAE7C,OAAO,EAAE,MAAM,WAAW;CAC5B,CAAC;CAED,IACE,CAAC,iBAAiB,KAAK,UAAU,KAAK,QAAQ,OAAO,KACrD,cAAc,OAAO,MAAM,MAAM,MAAM,cAAc,OAAO,OAAO,KACnE,EAAE,OAAO,cAAc,SAAS,SAAS,KAAK,QAAQ,IAEtD,OAAO,OAAO;CAChB,IACE,MAAM,eAAe,KAAA,MACpB,eAAe,KAAA,KAAa,CAAC,eAAe,MAAM,YAAY,WAAW,UAAU,IAEpF,OAAO,OAAO;CAChB,IAAI,MAAM,eAAe,KAAA,KAAa,eAAe,KAAA,GAAW;EAC9D,MAAM,WAAW,MAAM,WAAW;EAClC,MAAM,SAAS,WAAW,WAAW;EACrC,MAAM,MAAM,CAAC,mBAAG,IAAI,IAAI,CAAC,GAAI,aAAa,CAAC,GAAI,MAAM,WAAW,YAAY,CAAC,CAAC;EAE9E,IACE,SAAS,cAAc,OAAO,aAC9B,SAAS,qBAAqB,OAAO,oBACrC,IAAI,MAAM,OAAO;GACf,MAAM,SAAS,SAAS,YAAY,MAAM,SAAS,KAAK,iBAAiB,EAAE;GAC3E,MAAM,QAAQ,OAAO,YAAY,MAAM,SAAS,KAAK,iBAAiB,EAAE;GAIxE,OACE,UAAU,KAAA,MACT,WAAW,KAAA,IACR,OAAO,MAAM,YAAY,gBAAgB,eAAe,KAAK,QAAQ,MAAM,KAAA,IAC3E,OAAO,aAAa,MAAM;EAElC,CAAC,GAED,OAAO,OAAO;CAClB;CACA,IAAI,EAAE,OAAO,MAAM,MAAM,cAAc,SAAS,KAAK,QAAQ,CAAC,IAAI,OAAO,OAAO;CAChF,OAAO,YAAY,SAAS,KAAK,UAAU,KAAK,QAAQ,eAAe;CACvE,MAAM,WAAW,oBAAoB,KAAA,KAAa,cAAc,KAAA;CAEhE,IACE,EAAE,OAAO,MAAM,MACb,mBACE,SACA,CAAC,KAAK,QAAQ,OAAO,GACrB,KAAK,UACL,WACA,WAAW,CAAC,SAAS,IAAI,CAAC,GAC1B,OACA,QACF,CACF,IAEA,OAAO,OAAO;CAChB,MAAM,kBAAkB,OAAO,MAAM,IAAI,QAAQ,KAAK;CAEtD,MAAM,QAAQ,oBAAoB,cAAc;EAC9C,UAAU,KAAK;EACf,SAAS,MAAM;EACf;EACA,sBAAsB,KAAK,IACzB,kBAAkB,KAAK,SAAS,qBAChC,KAAK,SAAS,eAChB;CACF,CAAC;CAED,MAAM,QAAQ,QAAQ;CAEtB,OAAO,MAAM,OACX,MAAM,OACN;GAAG,MAAM,WAAW,QAAQ;GAAW,MAAM,SAAS,KAAK,SAAS;CAAO,GAC3E;GACG,MAAM,QAAQ,MAAM,OAAO;GAC3B,MAAM,UAAU,MAAM;GACtB,MAAM,UAAU,MAAM;GACtB,MAAM,YAAY,QAAQ,MAAM,cAAc,MAAM,eAAe;GACnE,MAAM,iBAAiB,QAAQ,MAAM,cAAc,MAAM,oBAAoB;GAC7E,MAAM,qBACL,MAAM,eAAe,KAAA,IAAY,OAAO,kBAAkB,OAAO,MAAM,UAAU;GAClF,MAAM,eAAe,cAAc,KAAA,IAAY,OAAO,aAAa,SAAS;CAC/E,CACF;CACA,IAAI,UAAU,OAAO,cAAc,SAAS,KAAK,UAAU,KAAK,QAAQ,CAAC,SAAS,GAAG,SAAS;CAC9F,OAAO,eAAe,SAAS,KAAK,UAAU,SAAS;CACvD,OAAO,eAAe,SAAS,CAAC,KAAK,QAAQ,OAAO,GAAG,KAAK,UAAU,SAAS;CAC/E,MAAM,eAAe,KAAK,cAAc,SAAS,KAAK,UAAU,KAAK,CAAC;CAEtE,OAAO;EAAE,MAAM;EAAW;CAAM;AAClC,CAAC;AAED,MAAa,cAAc,MAAgB,UACzC,KAAK,UAAU,aACf,KAAK,UAAU,KAAA,KACf,KAAK,MAAM,YAAY,MAAM,WAC7B,KAAK,MAAM,oBAAoB,MAAM,mBACrC,KAAK,MAAM,yBAAyB,MAAM,wBAC1C,gBAAgB,OAAO,KAAK,QAAQ,MAAM,gBAAgB,OAAO,MAAM,QAAQ;AAEjF,MAAM,mBACJ,UACA,UACA,YACA,WACA,aACG;CACH,MAAM,QAAQ,SAAS,OAAO;CAE9B,MAAM,WADS,eAAe,QACR,KAAK,SAAS;CAEpC,MAAM,MAAM,CACV,mBAAG,IAAI,IAAI,CAAC,GAAG,SAAS,YAAY,KAAK,SAAS,KAAK,YAAY,GAAG,WAAW,YAAY,CAAC,CAChG;CAEA,MAAM,WAAW;EACf,GAAG,WAAW;EACd,aAAa,WAAW,SAAS,YAAY,QAAQ,SAAS,IAAI,SAAS,KAAK,YAAY,CAAC;CAC/F;CAEA,MAAM,WAAW,SAAS,SAAS,YAAY,MAC5C,SAAS,KAAK,iBAAiB,WAAW,YAC7C;CAEA,OACE,SAAS,OAAO,WAAW,KAC3B,UAAU,KAAA,KACV,MAAM,WAAW,aACjB,MAAM,iBAAiB,WAAW,gBAClC,MAAM,QAAQ,WAAW,KACzB,MAAM,QAAQ,OAAO,gBACrB,MAAM,iBAAiB,UAAU,gBACjC,MAAM,qBACN,SAAS,cAAc,MAAM,UAAU,MAAM,SAAS,kBACtD,SAAS,YACN,YAAY,SAAS,UAAU,SAAS,QAAQ,OAAO,SAAS,SAAS,WAC5E,SAAS,mBACN,YAAY,SAAS,UAClB,SAAS,QAAQ,OAAO,gBACxB,SAAS,2BACf,SAAS,YAAY,WAAW,IAAI,UACpC,aAAa,SAAS,UAAU,QAAQ,KACxC,SAAS,cAAc,SAAS,aAChC,SAAS,qBAAqB,SAAS,oBACvC,SAAS,YAAY,OAAO,SAC1B,SAAS,YAAY,MAClB,YACC,QAAQ,iBAAiB,KAAK,gBAAgB,QAAQ,aAAa,KAAK,QAC5E,CACF,KACA,aAAa,KAAA,KACb,SAAS,YAAY,MAClB,SAAS,KAAK,iBAAiB,SAAS,gBAAgB,KAAK,aAAa,SAAS,QACtF;AAEJ;AAEA,MAAM,kBAAkB,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,SACA,OACA,WACA,SACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,QAAQ,QAAQ,KAAK;CAC3B,MAAM,UAAU,GAAG,GAAG,IAAI,MAAM,OAAO,MAAM,OAAO;CACpD,MAAM,UAAU,GAAG,GAAG,IAAI,MAAM,OAAO,MAAM,cAAc;CAE3D,MAAM,OAAO,GAAG,WACd,YAAY,WACR,GAAG,OAAO,IAAI,KAAK,CAAC,GAAG,MAAM,GAAG,GAAG,IAAI,EAAE,KACzC,GAAG,YAAY,IAAI,KAAK,CAAC,GAAG,MAAM,GAAG,GAAG,IAAI,EAAE;CAEpD,MAAM,WAAW,OAAO,YACtB,0BAA0B,KAAK,CAAC,CAAC,KAAK,WAAW,CAAC,QAAQ,MAAM,IAAI,OAAO,CAAC,CAC9E;CAEA,MAAM,KAAK,QAAQ,UAAU,kBAAkB,UAAU,WAAW;CACpE,MAAM,SAAS,MAAM,WAAW;CAChC,MAAM,SAAS,IAAI,SAAS,SAAS,GAAG,GAAG,UAAU,SAAS;CAE9D,MAAM,iBAAiB,SACnB,GAAG,UACH,GAAG,KAAK,QAAQ,WAAW,UAAU,QAAQ,WAAW,QAAQ,KAAK,UAAU,QAAQ;CAE3F,OAAO,MAAM,cACX,MAAM,OACN,KAAK,MAAM,MAAM,MAAM,OAAO,QAAQ,GAAG,MAAM,iBAAiB,cAAc,GAC9E;GACG,MAAM,UAAU,SAAS,SAAS,UAAU;GAC5C,MAAM,iBAAiB;GACvB,MAAM,cAAc;CACvB,GACA;EACE,MAAM;EACN,eAAe,OAAO,YACpB,MAAM,OACN;GAAE,GAAG;IAAW,MAAM,cAAc;EAAG,GACvC,KACE,SAAS,GAAG,GAAG,QAAQ,KAAK,YAAY,GAAG,GAAG,QAAQ,KAAK,UAAU,WACrE,GAAG,GAAG,QAAQ,MAAM,UAAU,SAChC,CACF;CACF,CACF;CACA,MAAM,WAAW,OAAO,MAAM,IAAI,QAAQ,KAAK;CAC/C,MAAM,WAAW,GAAG,GAAG,IAAI,MAAM,OAAO,QAAQ,UAAU,UAAU;CACpE,MAAM,SAAS,QAAQ,MAAM,SAAS,QAAQ;CAE9C,OAAO,MAAM,YACX,MAAM,OACN,MAAM,MAAM,MAAM,OAAO,QAAQ,GACjC,GACG,QAAQ,UAAU,aAAa,QAAQ,MAAM,WAC5C,IAAI,GAAG,YAAY,OAAO,OAAO,QAAQ,MAAM,eAAe,CAChE,EACF,GACA;EACE,MAAM;EACN,eAAe,OAAO,YACpB,MAAM,OACN,UACA,KAAK,GAAG,GAAG,OAAO,MAAM,YAAY,GAAG,GAAG,OAAO,MAAM,QAAQ,MAAM,iBAAiB,CACxF;CACF,CACF;AACF,CAAC;AAED,MAAa,kBAAkB,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAClE,SACA,OACA,SAQA,SACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,qBAAqB,QAAQ,SAAS,cAAc,QAAQ,aAAa,KAAA;CAC/E,MAAM,UAAU,OAAO,WAAW,OAAO;CAEzC,IAAI,YAAY,KAAA,KAAa,MAAM,SAAS,aAAa,QAAQ,UAC/D,OAAO;CACT,OAAO,cAAc,OAAO;CAE5B,MAAM,cACJ,eAAe,MAAM,QAAQ,CAAC,EAAE,YAAY,KAAK,SAAS,KAAK,YAAY,MAC1E,QAAQ,SAAS,cACd,QAAQ,WAAW,SAAS,YAAY,KAAK,SAAS,KAAK,YAAY,IACvE,KAAA;CAEN,MAAM,YACJ,QAAQ,SAAS,cACb,QAAQ,WAAW,SAAS,YAC5B,aAAa,MAAM,QAAQ;CAEjC,MAAM,UAAU,cAAc,KAAA,IAAY,KAAA,IAAY,OAAO,YAAY,QAAQ,MAAM,SAAS;CAEhG,OAAO,iBAAiB,OAAO;CAE/B,MAAM,QACJ,QAAQ,SAAS,eAAe,YAAY,KAAA,IACxC,KAAA,IACA,OAAO,eACL,QAAQ,MACR,SACA,MAAM,SAAS,QAAQ,MACvB,QAAQ,WAAW,sBACnB,WACF;CAEN,MAAM,OAAO,OAAO,SAAS,SAAS,MAAM,SAAS,MAAM;CAE3D,IAAI,SAAS,KAAA,KAAa,CAAC,WAAW,MAAM,KAAK,GAAG,OAAO;CAC3D,IAAI,QAAQ,SAAS,aAAa,OAAO,OAAO,aAAa,SAAS,MAAM,QAAQ,IAAI;CACxF,UAAU,uBAAuB,KAAA,CAAS;CAC1C,MAAM,WAAW,gBAAgB,OAAO,KAAK,aAAa,KAAA;CAC1D,MAAM,YAAY,QAAQ;CAE1B,IACE,aAAa,KAAA,KACb,UAAU,KAAA,KACV,CAAC,iBAAiB,KAAK,UAAU,KAAK,QAAQ,OAAO,KACrD,CAAC,eAAe,UAAU,kBAAkB,KAC5C,CAAC,eAAe,UAAU,MAAM,UAAU,GAE1C,OAAO,OAAO,aAAa,SAAS,MAAM,UAAU;CACtD,MAAM,aAAa,MAAM;CACzB,MAAM,UAAU,KAAK,SAAS;CAE9B,IACE,UAAU,yBAAyB,WAAW,wBAC7C,UAAU,eAAe,KAAA,KAAa,UAAU,eAAe,WAAW,cAC3E,UAAU,mBAAmB,WAAW,kBACvC,UAAU,eAAe,CAAC,UAAU,kBACpC,QAAQ,qBAAqB,cAAc,CAAC,UAAU,gBACvD,CAAC,QAAQ,WAAW,SAAS,WAAW,SAAS,KAChD,KAAK,SAAS,mBAAmB,WAAW,KAC3C,CAAC,KAAK,SAAS,mBAAmB,MAC/B,SAAS,KAAK,OAAO,WAAW,oBACnC,KACD,KAAK,SAAS,YAAY,cACxB,UAAU,eAAe,WAAW,cACnC,CAAC,WAAW,iBACZ,CAAC,WAAW,0BACZ,CAAC,WAAW,QAAQ,iBACpB,WAAW,QAAQ,qBAAqB,cACxC,CAAC,UAAU,iBACf,CAAC,gBAAgB,KAAK,UAAU,UAAU,YAAY,WAAW,QAAQ,QAAQ,KACjF,EAAE,OAAO,MAAM,MAAM,cAAc,SAAS,KAAK,UAAU,KAAK,CAAC,IAEjE,OAAO,OAAO,aAAa,SAAS,MAAM,UAAU;CACtD,OAAO,YAAY,SAAS,KAAK,UAAU,KAAK,QAAQ,WAAW,SAAS,SAAS;CACrF,OAAO,eAAe,SAAS,KAAK,UAAU,WAAW,SAAS,SAAS;CAC3E,OAAO,gBAAgB,SAAS,OAAO,WAAW,OAAO;CACzD,OAAO,aAAa,SAAS,MAAM,UAAU;CAC7C,MAAM,eAAe,KAAK,cAAc,SAAS,KAAK,UAAU,KAAK,CAAC;CAEtE,OAAO;AACT,CAAC;AAED,MAAM,oBAAoB,OAAY,aACpC,GAAG,GAAG,IAAI,MAAM,OAAO,MAAM,OAAO,EAAE,OAAO,IAAI,KAC/C,SAAS,KAAK,YAAY,GAAG,GAAG,SAAS,GACzC,GAAG,IACL,EAAE;AAEJ,MAAM,eAAe,SAAc,mBAA2C;CAC5E,IAAI,QAAQ,WAAW,KAAA,GAAW,OAAO,GAAG;CAC5C,MAAM,SAAS,QAAQ;CAEvB,OAAO,GAAG,6BAA6B,OAAO,MAAM,SAAS,KAC3D,MAAM,OAAO,OAAO,GAAG,OAAO,WAAW,QAAQ,SAAS,CAAC,GAC3D,GAAG,GAAG,IAAI,OAAO,OAAO,OAAO,MAAM,EAAE,KAAK,kBAC5C,OAAO,gBACT,EAAE;AACJ;AAEA,MAAM,WAAW,SAAc,aAAoC;CACjE,MAAM,OAAO,QAAQ,MACnB,SAAS,QAAQ,QACjB,MAAM,QAAQ,MAAM;CAEtB,MAAM,QAAQ,GAAG,GAAG,IAAI,KAAK,OAAO,KAAK,KAAK;CAC9C,MAAM,WAAW,GAAG,GAAG,QAAQ,MAAM,SAAS,GAAG,GAAG,IAAI,KAAK,OAAO,KAAK,cAAc,GAAG,EAAE,MAAM;CAElG,MAAM,aAAa,GAAG,yBAAyB,OAAO,MAAM,SAAS,KACnE,MAAM,OAAO,OAAO,GAAG,OAAO,WAAW,QAAQ,SAAS,CAAC,GAC3D,GAAG,GAAG,IAAI,OAAO,OAAO,OAAO,MAAM,EAAE,KAAK,IAAI,KAAK,OAAO,KAAK,MAAM,KACvE,GAAG,IAAI,IAAI,OAAO,OAAO,OAAO,WAAW,EAAE,cAAc,QAAQ,MAAM,SAAS,GAAG,GAAG,IAAI,OAAO,OAAO,OAAO,WAAW,GAAG,EAAE,KAAK,IAAI,EAC5I,EAAE;CAEF,OAAO,KACL,MAAM,KAAK,OAAO,GAAG,KAAK,WAAW,QAAQ,SAAS,CAAC,GACvD,iBAAiB,MAAM,QAAQ,GAC/B,GAAG,KAAK,MAAM,KAAK,KAAK,OAAO,QAAQ,OAAO,QAAQ,MAAM,SAAS,GAAG,GAAG,IAAI,KAAK,OAAO,KAAK,SAAS,GAAG,EAAE,MAAM,IAAI;SACnH,MAAM,KAAK,KAAK,OAAO,QAAQ,OAAO,QAAQ,MAAM,SAAS,GAAG,GAAG,IAAI,KAAK,OAAO,KAAK,cAAc,GAAG,EAAE,MAAM,IAAI;SACrH,MAAM,OAAO,KAAK,OAAO,SAAS,IAAI,KAAK,OAAO,SAAS,IAAI,KAAK,OAAO,UAAU,IAAI,KAAK,OAAO,qBAAqB,QAAQ,SAAS,YAAY,WAAW,QAAQ,YAAY,SAAS,GAAG,GAAG,IAAI,KAAK,OAAO,KAAK,MAAM,GAAG,EAAE,GAC5O;AACF;AAEA,MAAM,aAAa,SAAc,aAAoC;CACnE,MAAM,SAAS,QAAQ;CAEvB,OAAO,KACL,MAAM,OAAO,OAAO,GAAG,OAAO,WAAW,QAAQ,SAAS,CAAC,GAC3D,iBAAiB,QAAQ,QAAQ,GACjC,GAAG,GAAG,IAAI,OAAO,OAAO,OAAO,UAAU,EAAE,mBAAmB,QAAQ,MAAM,SAAS,GAAG,GAAG,IAAI,OAAO,OAAO,OAAO,WAAW,GAAG,EAAE,MAAM,QAAQ,MAAM,mBACxJ,YAAY,SAAS,GAAG,GAAG,IAAI,OAAO,OAAO,OAAO,MAAM,GAAG,CAC/D;AACF;;;AAIA,MAAa,oBAAoB,OAAO,GAAG,2BAA2B,CAAC,CAAC,WACtE,SACA,OACA,UACA;CACA,MAAM,QAAQ,OAAO;CAErB,UACE,MAAM,aAAa,QAAQ,YACzB,OAAO,cAAc,MAAM,SAAS,KACpC,MAAM,aAAa,KACnB,OAAO,cAAc,MAAM,KAAK,KAChC,MAAM,SAAS,KACf,MAAM,SAAS,GACnB;CACA,OAAO,WAAW,OAAO;CACzB,OAAO,cAAc,OAAO;CAC5B,OAAO,iBAAiB,OAAO;CAE/B,MAAM,OAAO,QAAQ,MACnB,SAAS,QAAQ;CAEnB,MAAM,QAAQ,OAAO,MAAM,KAAK,KAAK,OAAO,QAAQ,SAAS,QAAQ,GAAG;EACtE,OAAO,MAAM;EACb,UAAU;EACV,SAAS;EACT,SAAS,GAAG,GAAG,IAAI,KAAK,OAAO,KAAK,MAAM;CAC5C,CAAC,EAAA,CAAG;CAEJ,MAAM,UAAoB,CAAC;CAC3B,MAAM,eAA2B,CAAC;CAElC,IAAI,eAAe,GACjB,UAAU;CAEZ,KAAK,MAAM,aAAa,MAAM;EAC5B,MAAM,OAAO,OAAO,SAAS,SAAS,UAAU,KAAK,OAAO;EAE5D,IAAI,SAAS,KAAA,GAAW;EACxB,UACE,OAAO,MAAM,MACX,GAAG,yBAAyB,KAAK,MAAM,SAAS,KAAK,MAAM,KAAK,OAAO;IAAG,KAAK,WAAW,QAAQ;IAAW,KAAK,SAAS,KAAK,SAAS;EAAO,CAAC,GAAG,QAAQ,SAAS,QAAQ,CAAC,EAAE,EAClL,CACF;EACA,QAAQ,KAAK,KAAK,SAAS,MAAM;EACjC,IAAI,KAAK,UAAU,aAAa,KAAK,UAAU,WAAW;GACxD,MAAM,WACJ,KAAK,UAAU,YAAY,KAAK,SAAS,kBAAkB,KAAK,MAAO;GAEzE,IAAI,KAAK,UAAU,WAAW,OAAO,2BAA2B,SAAS,KAAK,QAAQ;GACtF,OAAO,aAAa,SAAS,MAAM,KAAK,UAAU,YAAY,aAAa,WAAW;GACtF,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,UAAU;GAC9E,aAAa,KAAK,IAAI;GACtB;EACF,OAAO;GACL,OAAO,wBAAwB,SAAS,KAAK,QAAQ;GACrD,OAAO,MAAM,OAAO,KAAK,OAAO;KAC7B,KAAK,WAAW,QAAQ;KACxB,KAAK,SAAS,KAAK,SAAS;GAC/B,CAAC;GACD,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,KAAK,SAAS,wBACxD,YAAY,SAAS,GAAG,GAAG,KAAK,SAAS,QAAQ,GACjD,GAAG,6BAA6B,OAAO,MAAM,SAAS,KACpD,MAAM,OAAO,OAAO;KACjB,OAAO,WAAW,QAAQ;KAC1B,OAAO,SAAS,KAAK,SAAS;GACjC,CAAC,GACD,GAAG,IAAI,IAAI,OAAO,OAAO,OAAO,WAAW,EAAE,cAAc,QAAQ,MAAM,SAAS,GAAG,GAAG,IAAI,OAAO,OAAO,OAAO,WAAW,GAAG,EAAE,KAAK,QAAQ,MAAM,gBAAgB,EACtK,EAAE,EACJ;GACA;EACF;CACF;CACA,MAAM,iBAA0D,CAAC;CACjE,MAAM,YAAY,MAAM,QAAQ,eAAe;CAE/C,IAAI,YAAY,GAAG;EACjB,MAAM,WAAW,OAAO,MAAM,KAAK,OAAO,OAAO,UAAU,SAAS,QAAQ,GAAG;GAC7E,OAAO;GACP,UAAU;GACV,SAAS;GACT,SAAS,GAAG,GAAG,IAAI,OAAO,OAAO,OAAO,MAAM,EAAE,IAAI,IAAI,OAAO,OAAO,OAAO,IAAI;EACnF,CAAC,EAAA,CAAG;EAEJ,KAAK,MAAM,aAAa,SAAS;GAC/B,MAAM,WAAW;KACd,OAAO,WAAW,QAAQ;KAC1B,OAAO,SAAS,UAAU,OAAO;KACjC,OAAO,OAAO,UAAU,OAAO;GAClC;GAEA,MAAM,YAAY,OAAO,MAAM,KAAK,OAAO,OAAO,MAAM,OAAO,OAAO,QAAQ,GAAG,EAC/E,OAAO,EACT,CAAC,EAAA,CAAG,KAAK;GAET,UAAU,aAAa,KAAA,CAAS;GAChC,MAAM,UAAU,QAAQ,MAAM,cAAc,SAAS,OAAO,YAAY;GAExE,UAAU,OAAO,cAAc,OAAO,CAAC;GACvC,OAAO,MAAM,OAAO,OAAO,OAAO,QAAQ;GAC1C,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,WAC1C,YAAY,SAAS,GAAG,GAAG,UAAU,OAAO,SAAS,CACvD;GACA,eAAe,KAAK;IAAE,QAAQ,UAAU,OAAO;IAAS,MAAM,UAAU,OAAO;GAAM,CAAC;GACtF;EACF;CACF;CAEA,MAAM,eACJ,QAAQ,WAAW,IACf,KAAA,IACA,GAAG,GAAG,IAAI,KAAK,OAAO,KAAK,MAAM,EAAE,WAAW,IAAI,KAChD,QAAQ,KAAK,OAAO,GAAG,GAAG,IAAI,GAC9B,GAAG,IACL,EAAE;CAER,MAAM,iBAAiB,eAAe,KACnC,SACC,GAAG,QAAQ,MAAM,OAAO,OAAO;GAAG,OAAO,SAAS,KAAK;GAAS,OAAO,OAAO,KAAK;CAAK,CAAC,EAAE,EAC/F;CAEA,MAAM,YAAY,GAAG,yBAAyB,KAAK,MAAM,SAAS,KAAK,QAAQ,SAAS,QAAQ,GAAG,YAAY,EAAE,6BAA6B,OAAO,MAAM,SAAS,KAAK,UAAU,SAAS,QAAQ,GAAG,GAAG,cAAc,EAAE;CAI1N,IAAI,UAAU,OAAO,MAAM,MAAM,SAAS;CAE1C,KAAK,MAAM,QAAQ,cAAc;EAC/B,IAAI,KAAK,SAAS,wBAAwB,OAAO,MAAM,IAAI,QAAQ,KAAK,IAAI;EAC5E,MAAM,cAAc,GAAG,yBAAyB,OAAO,MAAM,SAAS,KAAK,MAAM,OAAO,OAAO;IAAG,OAAO,WAAW,QAAQ;IAAW,OAAO,SAAS,KAAK,SAAS;EAAO,CAAC,GAAG,GAAG,GAAG,QAAQ,MAAM,SAAS,GAAG,GAAG,IAAI,OAAO,OAAO,OAAO,WAAW,GAAG,EAAE,KAAK,QAAQ,MAAM,mBAAmB,GAAG,cAAc,EAAE;EAErT,IACE,EAAE,OAAO,MAAM,MAAM,WAAW,OAC/B,OAAO,MAAM,MAAM,YAAY,SAAS,GAAG,GAAG,KAAK,SAAS,QAAQ,CAAC,IAEtE,UAAU;CACd;CACA,MAAM,SAAS,GAAG,yBAAyB,KAAK,MAAM,SAAS,QAAQ,SAAS,QAAQ,EAAE,6BAA6B,OAAO,MAAM,SAAS,UAAU,SAAS,QAAQ,EAAE;CAE1K,MAAM,eAAe,KAAK,UAAU,SAAS,GAAG,QAAQ,OAAO,EAAE;CAEjE,OAAO;EAAE;EAAc;EAAS;CAAQ;AAC1C,CAAC"}

package/dist/drizzle/passkey-management.mjs

@@ -0,0 +1,225 @@
+import { both } from "./transaction-owner.mjs";
+import { PasskeyCredentialSummary, PasskeyRemoved } from "../passkey/models.mjs";
+import { CurrentPasskeyTransaction, credentialKey, equal, invariant, sameCredential, sameRevision } from "./passkey-state.mjs";
+import { lockAdmission } from "./passkey-admission.mjs";
+import { readModule, readPolicyGuards } from "./passkey-credentials.mjs";
+import { authorizeAction, credentialRows, currentSubject, invalidate, invalidationMatches, jsonStorage, managementPolicy, metadataAllowed, ownedCredential, removeDigest, summary } from "./passkey-write-state.mjs";
+import { Effect, Schema } from "effect";
+import { sql } from "drizzle-orm";
+//#region src/drizzle/passkey-management.ts
+const decisionCodec = jsonStorage(Schema.Union([Schema.TaggedStruct("Renamed", { credential: PasskeyCredentialSummary }), Schema.TaggedStruct("Removed", { result: PasskeyRemoved })]));
+const intentCodec = jsonStorage(Schema.Struct({
+	operation: Schema.Literals(["rename", "remove"]),
+	credentialId: Schema.String,
+	name: Schema.optionalKey(Schema.String)
+}));
+const command = Effect.fn("passkey.managementCommand")(function* (mapping, subject, commandId, credentialId, intent) {
+	const owner = yield* CurrentPasskeyTransaction;
+	const table = mapping.command;
+	const observation = yield* owner.read(table.table, equal(table.table, {
+		[table.moduleId]: mapping.moduleId,
+		[table.commandId]: commandId
+	}), { limit: 1 });
+	const row = observation.rows[0];
+	if (row === void 0) return {
+		_tag: "New",
+		observation
+	};
+	if (!mapping.read.subjectIds.equals(row[table.subjectId], subject.nativeId) || row[table.credentialId] !== credentialId || row[table.intent] !== intent) return { _tag: "Rejected" };
+	return {
+		_tag: "Replay",
+		decision: decisionCodec.decode(row[table.decision])
+	};
+});
+const record = Effect.fn("passkey.recordManagementCommand")(function* (mapping, subject, commandId, credentialId, intent, decision, retentionUntilMillis, observation) {
+	const owner = yield* CurrentPasskeyTransaction;
+	const table = mapping.command;
+	observation.rows = (yield* owner.insert(table.table, {
+		...table.encodeInsert({
+			moduleId: mapping.moduleId,
+			subjectId: subject.nativeId,
+			commandId,
+			credentialId
+		}),
+		[table.moduleId]: mapping.moduleId,
+		[table.commandId]: commandId,
+		[table.subjectId]: subject.nativeId,
+		[table.credentialId]: credentialId,
+		[table.intent]: intent,
+		[table.decision]: decisionCodec.encode(decision),
+		[table.retentionUntil]: mapping.clock.encodeInstant(retentionUntilMillis),
+		[table.version]: owner.marker
+	}, {
+		[table.moduleId]: mapping.moduleId,
+		[table.commandId]: commandId
+	})).rows;
+});
+const access = Effect.fn("passkey.managementAccess")(function* (mapping, moduleId, subjectId, mutation) {
+	if (moduleId !== mapping.moduleId || (yield* readModule(mapping)) === void 0) return void 0;
+	if (mutation) yield* lockAdmission(mapping);
+	const subject = yield* currentSubject(mapping, subjectId);
+	if (subject === void 0) return void 0;
+	yield* readPolicyGuards(mapping);
+	return (yield* metadataAllowed(mapping, subject)) ? subject : void 0;
+});
+const listCredentials = Effect.fn("passkey.listCredentials")(function* (mapping, input) {
+	const subject = yield* access(mapping, input.moduleId, input.subjectId, false);
+	invariant(subject !== void 0);
+	const rows = [...yield* credentialRows(mapping, subject)];
+	rows.sort((left, right) => {
+		const a = left[mapping.read.credential.credentialId], b = right[mapping.read.credential.credentialId];
+		return a < b ? -1 : a > b ? 1 : 0;
+	});
+	const eligible = rows.filter((row) => input.cursor === void 0 || row[mapping.read.credential.credentialId] > input.cursor);
+	const page = eligible.slice(0, input.limit);
+	const credentials = [];
+	for (const row of page) {
+		invariant((yield* ownedCredential(mapping, subject, row)) !== void 0);
+		credentials.push(summary(mapping, row));
+	}
+	return {
+		credentials,
+		...eligible.length > input.limit ? { cursor: credentials.at(-1).credentialId } : {}
+	};
+});
+const renameCredential = Effect.fn("passkey.renameCredential")(function* (mapping, input) {
+	const subject = yield* access(mapping, input.moduleId, input.subjectId, true);
+	if (subject === void 0) return { _tag: "Rejected" };
+	const intent = intentCodec.encode({
+		operation: "rename",
+		credentialId: input.credentialId,
+		name: input.name
+	});
+	const prior = yield* command(mapping, subject, input.commandId, input.credentialId, intent);
+	if (prior._tag === "Rejected") return prior;
+	const row = (yield* credentialRows(mapping, subject)).find((item) => item[mapping.read.credential.credentialId] === input.credentialId);
+	if (row === void 0 || (yield* ownedCredential(mapping, subject, row)) === void 0) return { _tag: "Rejected" };
+	if (prior._tag === "Replay") return prior.decision._tag === "Renamed" ? {
+		...prior.decision,
+		replayed: true
+	} : { _tag: "Rejected" };
+	const owner = yield* CurrentPasskeyTransaction;
+	const table = mapping.read.credential;
+	yield* owner.update(table.table, {
+		[table.credentialId]: input.credentialId,
+		[table.subjectId]: subject.nativeId
+	}, { [mapping.write.credential.name]: input.name });
+	const credential = summary(mapping, {
+		...row,
+		[mapping.write.credential.name]: input.name
+	});
+	yield* record(mapping, subject, input.commandId, input.credentialId, intent, {
+		_tag: "Renamed",
+		credential
+	}, input.retentionUntilMillis, prior.observation);
+	return {
+		_tag: "Renamed",
+		credential,
+		replayed: false
+	};
+});
+const inspectRemove = Effect.fn("passkey.inspectRemove")(function* (mapping, input) {
+	const subject = yield* access(mapping, input.moduleId, input.subjectId, false);
+	if (subject === void 0) return { _tag: "Rejected" };
+	const prior = yield* command(mapping, subject, input.commandId, input.credentialId, intentCodec.encode({
+		operation: "remove",
+		credentialId: input.credentialId
+	}));
+	if (prior._tag === "Rejected") return prior;
+	if (prior._tag === "Replay") return prior.decision._tag === "Removed" ? {
+		_tag: "Replay",
+		result: {
+			...prior.decision.result,
+			replayed: true
+		}
+	} : { _tag: "Rejected" };
+	const row = (yield* credentialRows(mapping, subject)).find((item) => item[mapping.read.credential.credentialId] === input.credentialId);
+	const credential = row === void 0 ? void 0 : yield* ownedCredential(mapping, subject, row);
+	return credential === void 0 ? { _tag: "Rejected" } : {
+		_tag: "Target",
+		credential
+	};
+});
+const removeCredential = Effect.fn("passkey.removeCredential")(function* (mapping, input) {
+	const subject = yield* access(mapping, input.moduleId, input.credential.revision.subjectId, true);
+	if (subject === void 0) return { _tag: "Rejected" };
+	const id = input.credential.credentialId;
+	const intent = intentCodec.encode({
+		operation: "remove",
+		credentialId: id
+	});
+	const prior = yield* command(mapping, subject, input.commandId, id, intent);
+	if (prior._tag === "Rejected") return prior;
+	if (prior._tag === "Replay") return prior.decision._tag === "Removed" ? {
+		_tag: "Removed",
+		result: {
+			...prior.decision.result,
+			replayed: true
+		}
+	} : { _tag: "Rejected" };
+	const row = (yield* credentialRows(mapping, subject)).find((item) => item[mapping.read.credential.credentialId] === id);
+	const credential = row === void 0 ? void 0 : yield* ownedCredential(mapping, subject, row);
+	const policy = managementPolicy(mapping, subject);
+	if (credential === void 0 || !sameCredential(input.credential, credential) || !sameRevision(input.credential.revision, credential.revision) || !invalidationMatches(mapping, input.invalidation, policy) || !invalidationMatches(mapping, input.invalidation, input.management)) return { _tag: "Rejected" };
+	if (!(yield* authorizeAction(mapping, subject, input.authorization, {
+		action: "remove",
+		commandId: input.commandId,
+		flowId: input.commandId,
+		bindingDigest: removeDigest(mapping.moduleId, input.commandId, input.credential),
+		revision: input.credential.revision
+	}, {
+		...policy,
+		maximumEvidenceAgeMillis: Math.min(policy.maximumEvidenceAgeMillis, input.management.maximumEvidenceAgeMillis)
+	}))) return { _tag: "Rejected" };
+	const owner = yield* CurrentPasskeyTransaction;
+	const remaining = mapping.write.policy.remainingSignIn(subject.nativeId, id);
+	if (!(yield* owner.check(remaining))) return { _tag: "LastSignInMethod" };
+	const read = mapping.read;
+	const table = read.credential;
+	yield* owner.update(table.table, {
+		[table.credentialId]: id,
+		[table.subjectId]: subject.nativeId
+	}, {
+		[table.status]: mapping.write.credential.removedStatus,
+		[table.credentialRevision]: owner.marker
+	});
+	const factor = read.authority;
+	yield* owner.update(factor.table, {
+		[factor.subjectId]: subject.nativeId,
+		[factor.credentialId]: id
+	}, {
+		[factor.status]: mapping.write.authority.removedStatus,
+		[factor.revision]: owner.marker
+	});
+	for (const observation of owner.observations) {
+		if (observation.table === table.table) observation.rows = observation.rows.filter((item) => item[table.credentialId] !== id);
+		if (observation.table === factor.table) observation.rows = observation.rows.filter((item) => item[factor.credentialId] !== id);
+	}
+	const tuple = read.credentialOwnership;
+	yield* owner.update(tuple.table, { [tuple.credentialKey]: credentialKey(credential.rpId, credential.protocolCredentialId) }, {
+		[tuple.state]: mapping.write.credentialOwnership.removedState,
+		[tuple.version]: owner.marker
+	});
+	yield* invalidate(mapping, subject, input.invalidation);
+	owner.postconditions.push(remaining, sql`not exists(select 1 from ${table.table} where ${both(equal(table.table, { [table.credentialId]: id }), table.activeCondition)})`, sql`not exists(select 1 from ${factor.table} where ${both(equal(factor.table, {
+		[factor.subjectId]: subject.nativeId,
+		[factor.credentialId]: id
+	}), factor.activeCondition)})`);
+	const result = {
+		credentialId: credential.credentialId,
+		replayed: false,
+		invalidation: input.invalidation
+	};
+	yield* record(mapping, subject, input.commandId, id, intent, {
+		_tag: "Removed",
+		result
+	}, input.retentionUntilMillis, prior.observation);
+	return {
+		_tag: "Removed",
+		result
+	};
+});
+//#endregion
+export { inspectRemove, listCredentials, removeCredential, renameCredential };
+
+//# sourceMappingURL=passkey-management.mjs.map

package/dist/drizzle/passkey-management.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-management.mjs","names":[],"sources":["../../src/drizzle/passkey-management.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- private mapped-row kernel; public descriptors retain concrete table types. */\nimport { sql } from \"drizzle-orm\";\nimport { Effect, Schema } from \"effect\";\n\nimport { PasskeyCredentialSummary, PasskeyRemoved } from \"../passkey/models\";\nimport type { PasskeyManagementPersistence } from \"../passkey/PasskeyManagementPersistence\";\nimport { lockAdmission } from \"./passkey-admission\";\nimport { readModule, readPolicyGuards } from \"./passkey-credentials\";\nimport {\n  credentialKey,\n  equal,\n  invariant,\n  sameCredential,\n  sameRevision,\n  CurrentPasskeyTransaction,\n} from \"./passkey-state\";\nimport {\n  authorizeAction,\n  credentialRows,\n  currentSubject,\n  invalidate,\n  invalidationMatches,\n  jsonStorage,\n  managementPolicy,\n  metadataAllowed,\n  ownedCredential,\n  removeDigest,\n  summary,\n  type WriteSubject,\n} from \"./passkey-write-state\";\nimport { both } from \"./transaction-owner\";\n\ntype Port = PasskeyManagementPersistence[\"Service\"];\n\nconst decisionCodec = jsonStorage(\n  Schema.Union([\n    Schema.TaggedStruct(\"Renamed\", { credential: PasskeyCredentialSummary }),\n    Schema.TaggedStruct(\"Removed\", { result: PasskeyRemoved }),\n  ]),\n);\n\nconst intentCodec = jsonStorage(\n  Schema.Struct({\n    operation: Schema.Literals([\"rename\", \"remove\"]),\n    credentialId: Schema.String,\n    name: Schema.optionalKey(Schema.String),\n  }),\n);\n\nconst command = Effect.fn(\"passkey.managementCommand\")(function* (\n  mapping: any,\n  subject: WriteSubject,\n  commandId: string,\n  credentialId: string,\n  intent: string,\n) {\n  const owner = yield* CurrentPasskeyTransaction;\n  const table = mapping.command;\n\n  const observation = yield* owner.read(\n    table.table,\n    equal(table.table, { [table.moduleId]: mapping.moduleId, [table.commandId]: commandId }),\n    { limit: 1 },\n  );\n\n  const row = observation.rows[0];\n\n  if (row === undefined) return { _tag: \"New\", observation } as const;\n  if (\n    !mapping.read.subjectIds.equals(row[table.subjectId], subject.nativeId) ||\n    row[table.credentialId] !== credentialId ||\n    row[table.intent] !== intent\n  )\n    return { _tag: \"Rejected\" } as const;\n\n  return { _tag: \"Replay\", decision: decisionCodec.decode(row[table.decision]) } as const;\n});\n\nconst record = Effect.fn(\"passkey.recordManagementCommand\")(function* (\n  mapping: any,\n  subject: WriteSubject,\n  commandId: string,\n  credentialId: string,\n  intent: string,\n  decision: Parameters<typeof decisionCodec.encode>[0],\n  retentionUntilMillis: number,\n  observation: any,\n) {\n  const owner = yield* CurrentPasskeyTransaction;\n  const table = mapping.command;\n\n  const inserted = yield* owner.insert(\n    table.table,\n    {\n      ...table.encodeInsert({\n        moduleId: mapping.moduleId,\n        subjectId: subject.nativeId,\n        commandId,\n        credentialId,\n      }),\n      [table.moduleId]: mapping.moduleId,\n      [table.commandId]: commandId,\n      [table.subjectId]: subject.nativeId,\n      [table.credentialId]: credentialId,\n      [table.intent]: intent,\n      [table.decision]: decisionCodec.encode(decision),\n      [table.retentionUntil]: mapping.clock.encodeInstant(retentionUntilMillis),\n      [table.version]: owner.marker,\n    },\n    { [table.moduleId]: mapping.moduleId, [table.commandId]: commandId },\n  );\n\n  observation.rows = inserted.rows;\n});\n\nconst access = Effect.fn(\"passkey.managementAccess\")(function* (\n  mapping: any,\n  moduleId: string,\n  subjectId: Parameters<Port[\"list\"]>[0][\"subjectId\"],\n  mutation: boolean,\n) {\n  if (moduleId !== mapping.moduleId || (yield* readModule(mapping)) === undefined) return undefined;\n  if (mutation) yield* lockAdmission(mapping);\n  const subject = yield* currentSubject(mapping, subjectId);\n\n  if (subject === undefined) return undefined;\n  yield* readPolicyGuards(mapping);\n\n  return (yield* metadataAllowed(mapping, subject)) ? subject : undefined;\n});\n\nexport const listCredentials = Effect.fn(\"passkey.listCredentials\")(function* (\n  mapping: any,\n  input: Parameters<Port[\"list\"]>[0],\n) {\n  const subject = yield* access(mapping, input.moduleId, input.subjectId, false);\n\n  invariant(subject !== undefined);\n  const rows = [...(yield* credentialRows(mapping, subject))];\n\n  rows.sort((left, right) => {\n    const a = left[mapping.read.credential.credentialId],\n      b = right[mapping.read.credential.credentialId];\n\n    return a < b ? -1 : a > b ? 1 : 0;\n  });\n\n  const eligible = rows.filter(\n    (row) => input.cursor === undefined || row[mapping.read.credential.credentialId] > input.cursor,\n  );\n\n  const page = eligible.slice(0, input.limit);\n  const credentials = [];\n\n  for (const row of page) {\n    invariant((yield* ownedCredential(mapping, subject, row)) !== undefined);\n    credentials.push(summary(mapping, row));\n  }\n\n  return {\n    credentials,\n    ...(eligible.length > input.limit ? { cursor: credentials.at(-1)!.credentialId } : {}),\n  };\n});\n\nexport const renameCredential = Effect.fn(\"passkey.renameCredential\")(function* (\n  mapping: any,\n  input: Parameters<Port[\"rename\"]>[0],\n) {\n  const subject = yield* access(mapping, input.moduleId, input.subjectId, true);\n\n  if (subject === undefined) return { _tag: \"Rejected\" } as const;\n\n  const intent = intentCodec.encode({\n    operation: \"rename\",\n    credentialId: input.credentialId,\n    name: input.name,\n  });\n\n  const prior = yield* command(mapping, subject, input.commandId, input.credentialId, intent);\n\n  if (prior._tag === \"Rejected\") return prior;\n  const rows = yield* credentialRows(mapping, subject);\n\n  const row = rows.find(\n    (item) => item[mapping.read.credential.credentialId] === input.credentialId,\n  );\n\n  if (row === undefined || (yield* ownedCredential(mapping, subject, row)) === undefined)\n    return { _tag: \"Rejected\" } as const;\n  if (prior._tag === \"Replay\")\n    return prior.decision._tag === \"Renamed\"\n      ? { ...prior.decision, replayed: true }\n      : ({ _tag: \"Rejected\" } as const);\n  const owner = yield* CurrentPasskeyTransaction;\n  const table = mapping.read.credential;\n\n  yield* owner.update(\n    table.table,\n    { [table.credentialId]: input.credentialId, [table.subjectId]: subject.nativeId },\n    { [mapping.write.credential.name]: input.name },\n  );\n  const credential = summary(mapping, { ...row, [mapping.write.credential.name]: input.name });\n\n  yield* record(\n    mapping,\n    subject,\n    input.commandId,\n    input.credentialId,\n    intent,\n    { _tag: \"Renamed\", credential },\n    input.retentionUntilMillis,\n    prior.observation,\n  );\n\n  return { _tag: \"Renamed\", credential, replayed: false } as const;\n});\n\nexport const inspectRemove = Effect.fn(\"passkey.inspectRemove\")(function* (\n  mapping: any,\n  input: Parameters<Port[\"inspectRemove\"]>[0],\n) {\n  const subject = yield* access(mapping, input.moduleId, input.subjectId, false);\n\n  if (subject === undefined) return { _tag: \"Rejected\" } as const;\n\n  const prior = yield* command(\n    mapping,\n    subject,\n    input.commandId,\n    input.credentialId,\n    intentCodec.encode({ operation: \"remove\", credentialId: input.credentialId }),\n  );\n\n  if (prior._tag === \"Rejected\") return prior;\n  if (prior._tag === \"Replay\")\n    return prior.decision._tag === \"Removed\"\n      ? ({ _tag: \"Replay\", result: { ...prior.decision.result, replayed: true } } as const)\n      : ({ _tag: \"Rejected\" } as const);\n\n  const row = (yield* credentialRows(mapping, subject)).find(\n    (item) => item[mapping.read.credential.credentialId] === input.credentialId,\n  );\n\n  const credential = row === undefined ? undefined : yield* ownedCredential(mapping, subject, row);\n\n  return credential === undefined\n    ? ({ _tag: \"Rejected\" } as const)\n    : ({ _tag: \"Target\", credential } as const);\n});\n\nexport const removeCredential = Effect.fn(\"passkey.removeCredential\")(function* (\n  mapping: any,\n  input: Parameters<Port[\"remove\"]>[0],\n) {\n  const subject = yield* access(mapping, input.moduleId, input.credential.revision.subjectId, true);\n\n  if (subject === undefined) return { _tag: \"Rejected\" } as const;\n  const id = input.credential.credentialId;\n  const intent = intentCodec.encode({ operation: \"remove\", credentialId: id });\n  const prior = yield* command(mapping, subject, input.commandId, id, intent);\n\n  if (prior._tag === \"Rejected\") return prior;\n  if (prior._tag === \"Replay\")\n    return prior.decision._tag === \"Removed\"\n      ? ({ _tag: \"Removed\", result: { ...prior.decision.result, replayed: true } } as const)\n      : ({ _tag: \"Rejected\" } as const);\n\n  const row = (yield* credentialRows(mapping, subject)).find(\n    (item) => item[mapping.read.credential.credentialId] === id,\n  );\n\n  const credential = row === undefined ? undefined : yield* ownedCredential(mapping, subject, row);\n  const policy = managementPolicy(mapping, subject);\n\n  if (\n    credential === undefined ||\n    !sameCredential(input.credential, credential) ||\n    !sameRevision(input.credential.revision, credential.revision) ||\n    !invalidationMatches(mapping, input.invalidation, policy) ||\n    !invalidationMatches(mapping, input.invalidation, input.management)\n  )\n    return { _tag: \"Rejected\" } as const;\n  if (\n    !(yield* authorizeAction(\n      mapping,\n      subject,\n      input.authorization,\n      {\n        action: \"remove\",\n        commandId: input.commandId,\n        flowId: input.commandId,\n        bindingDigest: removeDigest(mapping.moduleId, input.commandId, input.credential),\n        revision: input.credential.revision,\n      },\n      {\n        ...policy,\n        maximumEvidenceAgeMillis: Math.min(\n          policy.maximumEvidenceAgeMillis,\n          input.management.maximumEvidenceAgeMillis,\n        ),\n      },\n    ))\n  )\n    return { _tag: \"Rejected\" } as const;\n  const owner = yield* CurrentPasskeyTransaction;\n  const remaining = mapping.write.policy.remainingSignIn(subject.nativeId, id);\n\n  if (!(yield* owner.check(remaining))) return { _tag: \"LastSignInMethod\" } as const;\n  const read = mapping.read;\n  const table = read.credential;\n\n  yield* owner.update(\n    table.table,\n    { [table.credentialId]: id, [table.subjectId]: subject.nativeId },\n    {\n      [table.status]: mapping.write.credential.removedStatus,\n      [table.credentialRevision]: owner.marker,\n    },\n  );\n  const factor = read.authority;\n\n  yield* owner.update(\n    factor.table,\n    { [factor.subjectId]: subject.nativeId, [factor.credentialId]: id },\n    { [factor.status]: mapping.write.authority.removedStatus, [factor.revision]: owner.marker },\n  );\n  for (const observation of owner.observations) {\n    if (observation.table === table.table)\n      observation.rows = observation.rows.filter((item) => item[table.credentialId] !== id);\n    if (observation.table === factor.table)\n      observation.rows = observation.rows.filter((item) => item[factor.credentialId] !== id);\n  }\n  const tuple = read.credentialOwnership;\n\n  yield* owner.update(\n    tuple.table,\n    { [tuple.credentialKey]: credentialKey(credential.rpId, credential.protocolCredentialId) },\n    {\n      [tuple.state]: mapping.write.credentialOwnership.removedState,\n      [tuple.version]: owner.marker,\n    },\n  );\n  yield* invalidate(mapping, subject, input.invalidation);\n  owner.postconditions.push(\n    remaining,\n    sql`not exists(select 1 from ${table.table} where ${both(equal(table.table, { [table.credentialId]: id }), table.activeCondition)})`,\n    sql`not exists(select 1 from ${factor.table} where ${both(equal(factor.table, { [factor.subjectId]: subject.nativeId, [factor.credentialId]: id }), factor.activeCondition)})`,\n  );\n\n  const result = {\n    credentialId: credential.credentialId,\n    replayed: false,\n    invalidation: input.invalidation,\n  };\n\n  yield* record(\n    mapping,\n    subject,\n    input.commandId,\n    id,\n    intent,\n    { _tag: \"Removed\", result },\n    input.retentionUntilMillis,\n    prior.observation,\n  );\n\n  return { _tag: \"Removed\", result } as const;\n});\n"],"mappings":";;;;;;;;;AAkCA,MAAM,gBAAgB,YACpB,OAAO,MAAM,CACX,OAAO,aAAa,WAAW,EAAE,YAAY,yBAAyB,CAAC,GACvE,OAAO,aAAa,WAAW,EAAE,QAAQ,eAAe,CAAC,CAC3D,CAAC,CACH;AAEA,MAAM,cAAc,YAClB,OAAO,OAAO;CACZ,WAAW,OAAO,SAAS,CAAC,UAAU,QAAQ,CAAC;CAC/C,cAAc,OAAO;CACrB,MAAM,OAAO,YAAY,OAAO,MAAM;AACxC,CAAC,CACH;AAEA,MAAM,UAAU,OAAO,GAAG,2BAA2B,CAAC,CAAC,WACrD,SACA,SACA,WACA,cACA,QACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,QAAQ,QAAQ;CAEtB,MAAM,cAAc,OAAO,MAAM,KAC/B,MAAM,OACN,MAAM,MAAM,OAAO;GAAG,MAAM,WAAW,QAAQ;GAAW,MAAM,YAAY;CAAU,CAAC,GACvF,EAAE,OAAO,EAAE,CACb;CAEA,MAAM,MAAM,YAAY,KAAK;CAE7B,IAAI,QAAQ,KAAA,GAAW,OAAO;EAAE,MAAM;EAAO;CAAY;CACzD,IACE,CAAC,QAAQ,KAAK,WAAW,OAAO,IAAI,MAAM,YAAY,QAAQ,QAAQ,KACtE,IAAI,MAAM,kBAAkB,gBAC5B,IAAI,MAAM,YAAY,QAEtB,OAAO,EAAE,MAAM,WAAW;CAE5B,OAAO;EAAE,MAAM;EAAU,UAAU,cAAc,OAAO,IAAI,MAAM,SAAS;CAAE;AAC/E,CAAC;AAED,MAAM,SAAS,OAAO,GAAG,iCAAiC,CAAC,CAAC,WAC1D,SACA,SACA,WACA,cACA,QACA,UACA,sBACA,aACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,QAAQ,QAAQ;CAuBtB,YAAY,QAAO,OArBK,MAAM,OAC5B,MAAM,OACN;EACE,GAAG,MAAM,aAAa;GACpB,UAAU,QAAQ;GAClB,WAAW,QAAQ;GACnB;GACA;EACF,CAAC;GACA,MAAM,WAAW,QAAQ;GACzB,MAAM,YAAY;GAClB,MAAM,YAAY,QAAQ;GAC1B,MAAM,eAAe;GACrB,MAAM,SAAS;GACf,MAAM,WAAW,cAAc,OAAO,QAAQ;GAC9C,MAAM,iBAAiB,QAAQ,MAAM,cAAc,oBAAoB;GACvE,MAAM,UAAU,MAAM;CACzB,GACA;GAAG,MAAM,WAAW,QAAQ;GAAW,MAAM,YAAY;CAAU,CACrE,EAAA,CAE4B;AAC9B,CAAC;AAED,MAAM,SAAS,OAAO,GAAG,0BAA0B,CAAC,CAAC,WACnD,SACA,UACA,WACA,UACA;CACA,IAAI,aAAa,QAAQ,aAAa,OAAO,WAAW,OAAO,OAAO,KAAA,GAAW,OAAO,KAAA;CACxF,IAAI,UAAU,OAAO,cAAc,OAAO;CAC1C,MAAM,UAAU,OAAO,eAAe,SAAS,SAAS;CAExD,IAAI,YAAY,KAAA,GAAW,OAAO,KAAA;CAClC,OAAO,iBAAiB,OAAO;CAE/B,QAAQ,OAAO,gBAAgB,SAAS,OAAO,KAAK,UAAU,KAAA;AAChE,CAAC;AAED,MAAa,kBAAkB,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAClE,SACA,OACA;CACA,MAAM,UAAU,OAAO,OAAO,SAAS,MAAM,UAAU,MAAM,WAAW,KAAK;CAE7E,UAAU,YAAY,KAAA,CAAS;CAC/B,MAAM,OAAO,CAAC,GAAI,OAAO,eAAe,SAAS,OAAO,CAAE;CAE1D,KAAK,MAAM,MAAM,UAAU;EACzB,MAAM,IAAI,KAAK,QAAQ,KAAK,WAAW,eACrC,IAAI,MAAM,QAAQ,KAAK,WAAW;EAEpC,OAAO,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI;CAClC,CAAC;CAED,MAAM,WAAW,KAAK,QACnB,QAAQ,MAAM,WAAW,KAAA,KAAa,IAAI,QAAQ,KAAK,WAAW,gBAAgB,MAAM,MAC3F;CAEA,MAAM,OAAO,SAAS,MAAM,GAAG,MAAM,KAAK;CAC1C,MAAM,cAAc,CAAC;CAErB,KAAK,MAAM,OAAO,MAAM;EACtB,WAAW,OAAO,gBAAgB,SAAS,SAAS,GAAG,OAAO,KAAA,CAAS;EACvE,YAAY,KAAK,QAAQ,SAAS,GAAG,CAAC;CACxC;CAEA,OAAO;EACL;EACA,GAAI,SAAS,SAAS,MAAM,QAAQ,EAAE,QAAQ,YAAY,GAAG,EAAE,CAAC,CAAE,aAAa,IAAI,CAAC;CACtF;AACF,CAAC;AAED,MAAa,mBAAmB,OAAO,GAAG,0BAA0B,CAAC,CAAC,WACpE,SACA,OACA;CACA,MAAM,UAAU,OAAO,OAAO,SAAS,MAAM,UAAU,MAAM,WAAW,IAAI;CAE5E,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAErD,MAAM,SAAS,YAAY,OAAO;EAChC,WAAW;EACX,cAAc,MAAM;EACpB,MAAM,MAAM;CACd,CAAC;CAED,MAAM,QAAQ,OAAO,QAAQ,SAAS,SAAS,MAAM,WAAW,MAAM,cAAc,MAAM;CAE1F,IAAI,MAAM,SAAS,YAAY,OAAO;CAGtC,MAAM,OAAM,OAFQ,eAAe,SAAS,OAAO,EAAA,CAElC,MACd,SAAS,KAAK,QAAQ,KAAK,WAAW,kBAAkB,MAAM,YACjE;CAEA,IAAI,QAAQ,KAAA,MAAc,OAAO,gBAAgB,SAAS,SAAS,GAAG,OAAO,KAAA,GAC3E,OAAO,EAAE,MAAM,WAAW;CAC5B,IAAI,MAAM,SAAS,UACjB,OAAO,MAAM,SAAS,SAAS,YAC3B;EAAE,GAAG,MAAM;EAAU,UAAU;CAAK,IACnC,EAAE,MAAM,WAAW;CAC1B,MAAM,QAAQ,OAAO;CACrB,MAAM,QAAQ,QAAQ,KAAK;CAE3B,OAAO,MAAM,OACX,MAAM,OACN;GAAG,MAAM,eAAe,MAAM;GAAe,MAAM,YAAY,QAAQ;CAAS,GAChF,GAAG,QAAQ,MAAM,WAAW,OAAO,MAAM,KAAK,CAChD;CACA,MAAM,aAAa,QAAQ,SAAS;EAAE,GAAG;GAAM,QAAQ,MAAM,WAAW,OAAO,MAAM;CAAK,CAAC;CAE3F,OAAO,OACL,SACA,SACA,MAAM,WACN,MAAM,cACN,QACA;EAAE,MAAM;EAAW;CAAW,GAC9B,MAAM,sBACN,MAAM,WACR;CAEA,OAAO;EAAE,MAAM;EAAW;EAAY,UAAU;CAAM;AACxD,CAAC;AAED,MAAa,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WAC9D,SACA,OACA;CACA,MAAM,UAAU,OAAO,OAAO,SAAS,MAAM,UAAU,MAAM,WAAW,KAAK;CAE7E,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAErD,MAAM,QAAQ,OAAO,QACnB,SACA,SACA,MAAM,WACN,MAAM,cACN,YAAY,OAAO;EAAE,WAAW;EAAU,cAAc,MAAM;CAAa,CAAC,CAC9E;CAEA,IAAI,MAAM,SAAS,YAAY,OAAO;CACtC,IAAI,MAAM,SAAS,UACjB,OAAO,MAAM,SAAS,SAAS,YAC1B;EAAE,MAAM;EAAU,QAAQ;GAAE,GAAG,MAAM,SAAS;GAAQ,UAAU;EAAK;CAAE,IACvE,EAAE,MAAM,WAAW;CAE1B,MAAM,OAAO,OAAO,eAAe,SAAS,OAAO,EAAA,CAAG,MACnD,SAAS,KAAK,QAAQ,KAAK,WAAW,kBAAkB,MAAM,YACjE;CAEA,MAAM,aAAa,QAAQ,KAAA,IAAY,KAAA,IAAY,OAAO,gBAAgB,SAAS,SAAS,GAAG;CAE/F,OAAO,eAAe,KAAA,IACjB,EAAE,MAAM,WAAW,IACnB;EAAE,MAAM;EAAU;CAAW;AACpC,CAAC;AAED,MAAa,mBAAmB,OAAO,GAAG,0BAA0B,CAAC,CAAC,WACpE,SACA,OACA;CACA,MAAM,UAAU,OAAO,OAAO,SAAS,MAAM,UAAU,MAAM,WAAW,SAAS,WAAW,IAAI;CAEhG,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CACrD,MAAM,KAAK,MAAM,WAAW;CAC5B,MAAM,SAAS,YAAY,OAAO;EAAE,WAAW;EAAU,cAAc;CAAG,CAAC;CAC3E,MAAM,QAAQ,OAAO,QAAQ,SAAS,SAAS,MAAM,WAAW,IAAI,MAAM;CAE1E,IAAI,MAAM,SAAS,YAAY,OAAO;CACtC,IAAI,MAAM,SAAS,UACjB,OAAO,MAAM,SAAS,SAAS,YAC1B;EAAE,MAAM;EAAW,QAAQ;GAAE,GAAG,MAAM,SAAS;GAAQ,UAAU;EAAK;CAAE,IACxE,EAAE,MAAM,WAAW;CAE1B,MAAM,OAAO,OAAO,eAAe,SAAS,OAAO,EAAA,CAAG,MACnD,SAAS,KAAK,QAAQ,KAAK,WAAW,kBAAkB,EAC3D;CAEA,MAAM,aAAa,QAAQ,KAAA,IAAY,KAAA,IAAY,OAAO,gBAAgB,SAAS,SAAS,GAAG;CAC/F,MAAM,SAAS,iBAAiB,SAAS,OAAO;CAEhD,IACE,eAAe,KAAA,KACf,CAAC,eAAe,MAAM,YAAY,UAAU,KAC5C,CAAC,aAAa,MAAM,WAAW,UAAU,WAAW,QAAQ,KAC5D,CAAC,oBAAoB,SAAS,MAAM,cAAc,MAAM,KACxD,CAAC,oBAAoB,SAAS,MAAM,cAAc,MAAM,UAAU,GAElE,OAAO,EAAE,MAAM,WAAW;CAC5B,IACE,EAAE,OAAO,gBACP,SACA,SACA,MAAM,eACN;EACE,QAAQ;EACR,WAAW,MAAM;EACjB,QAAQ,MAAM;EACd,eAAe,aAAa,QAAQ,UAAU,MAAM,WAAW,MAAM,UAAU;EAC/E,UAAU,MAAM,WAAW;CAC7B,GACA;EACE,GAAG;EACH,0BAA0B,KAAK,IAC7B,OAAO,0BACP,MAAM,WAAW,wBACnB;CACF,CACF,IAEA,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAM,QAAQ,OAAO;CACrB,MAAM,YAAY,QAAQ,MAAM,OAAO,gBAAgB,QAAQ,UAAU,EAAE;CAE3E,IAAI,EAAE,OAAO,MAAM,MAAM,SAAS,IAAI,OAAO,EAAE,MAAM,mBAAmB;CACxE,MAAM,OAAO,QAAQ;CACrB,MAAM,QAAQ,KAAK;CAEnB,OAAO,MAAM,OACX,MAAM,OACN;GAAG,MAAM,eAAe;GAAK,MAAM,YAAY,QAAQ;CAAS,GAChE;GACG,MAAM,SAAS,QAAQ,MAAM,WAAW;GACxC,MAAM,qBAAqB,MAAM;CACpC,CACF;CACA,MAAM,SAAS,KAAK;CAEpB,OAAO,MAAM,OACX,OAAO,OACP;GAAG,OAAO,YAAY,QAAQ;GAAW,OAAO,eAAe;CAAG,GAClE;GAAG,OAAO,SAAS,QAAQ,MAAM,UAAU;GAAgB,OAAO,WAAW,MAAM;CAAO,CAC5F;CACA,KAAK,MAAM,eAAe,MAAM,cAAc;EAC5C,IAAI,YAAY,UAAU,MAAM,OAC9B,YAAY,OAAO,YAAY,KAAK,QAAQ,SAAS,KAAK,MAAM,kBAAkB,EAAE;EACtF,IAAI,YAAY,UAAU,OAAO,OAC/B,YAAY,OAAO,YAAY,KAAK,QAAQ,SAAS,KAAK,OAAO,kBAAkB,EAAE;CACzF;CACA,MAAM,QAAQ,KAAK;CAEnB,OAAO,MAAM,OACX,MAAM,OACN,GAAG,MAAM,gBAAgB,cAAc,WAAW,MAAM,WAAW,oBAAoB,EAAE,GACzF;GACG,MAAM,QAAQ,QAAQ,MAAM,oBAAoB;GAChD,MAAM,UAAU,MAAM;CACzB,CACF;CACA,OAAO,WAAW,SAAS,SAAS,MAAM,YAAY;CACtD,MAAM,eAAe,KACnB,WACA,GAAG,4BAA4B,MAAM,MAAM,SAAS,KAAK,MAAM,MAAM,OAAO,GAAG,MAAM,eAAe,GAAG,CAAC,GAAG,MAAM,eAAe,EAAE,IAClI,GAAG,4BAA4B,OAAO,MAAM,SAAS,KAAK,MAAM,OAAO,OAAO;GAAG,OAAO,YAAY,QAAQ;GAAW,OAAO,eAAe;CAAG,CAAC,GAAG,OAAO,eAAe,EAAE,EAC9K;CAEA,MAAM,SAAS;EACb,cAAc,WAAW;EACzB,UAAU;EACV,cAAc,MAAM;CACtB;CAEA,OAAO,OACL,SACA,SACA,MAAM,WACN,IACA,QACA;EAAE,MAAM;EAAW;CAAO,GAC1B,MAAM,sBACN,MAAM,WACR;CAEA,OAAO;EAAE,MAAM;EAAW;CAAO;AACnC,CAAC"}