@nxgt/janus-drizzle 0.1.0

package/dist/index.js

@@ -0,0 +1,448 @@
+// src/relations.ts
+import { withTransaction } from "@nxgt/drizzle/pg";
+import {
+  isSubjectSet
+} from "@nxgt/janus";
+import { and, asc, eq, gt, isNotNull, isNull, or } from "drizzle-orm";
+
+// src/tables.ts
+import { sql } from "drizzle-orm";
+import {
+  boolean,
+  check,
+  customType,
+  foreignKey,
+  index,
+  integer,
+  jsonb,
+  pgTable,
+  primaryKey,
+  text,
+  timestamp,
+  unique
+} from "drizzle-orm/pg-core";
+var key = customType({
+  dataType: () => 'text collate "C"'
+});
+var at = (name) => timestamp(name, { withTimezone: true, precision: 3 });
+function defineJanusTables(options = {}) {
+  const { schema } = options;
+  const table = schema === undefined ? pgTable : schema.table;
+  const users = table("users", {
+    id: key("id").primaryKey(),
+    type: key("type").notNull(),
+    schemaVersion: text("schema_version").notNull(),
+    active: boolean("active").notNull(),
+    fields: jsonb("fields").notNull(),
+    logins: text("logins").array().notNull(),
+    passwordHash: text("password_hash"),
+    passwordUpdatedAt: at("password_updated_at"),
+    emailVerifiedAt: at("email_verified_at"),
+    version: integer("version").notNull(),
+    createdAt: at("created_at").notNull(),
+    updatedAt: at("updated_at").notNull()
+  }, (t) => [
+    unique("users_id_type_unique").on(t.id, t.type),
+    index("users_type_id").on(t.type, t.id),
+    check("users_password_whole", sql`(${t.passwordHash} is null) = (${t.passwordUpdatedAt} is null)`)
+  ]);
+  const logins = table("logins", {
+    type: key("type").notNull(),
+    login: key("login").notNull(),
+    userId: key("user_id").notNull()
+  }, (t) => [
+    primaryKey({ name: "logins_pkey", columns: [t.type, t.login] }),
+    foreignKey({
+      name: "logins_user_fk",
+      columns: [t.userId, t.type],
+      foreignColumns: [users.id, users.type]
+    }).onDelete("cascade"),
+    index("logins_user_id").on(t.userId)
+  ]);
+  const sessions = table("sessions", {
+    id: key("id").primaryKey(),
+    tokenHash: key("token_hash").notNull(),
+    userId: key("user_id").notNull(),
+    authenticatedAt: at("authenticated_at").notNull(),
+    expiresAt: at("expires_at").notNull(),
+    revokedAt: at("revoked_at"),
+    createdAt: at("created_at").notNull()
+  }, (t) => [
+    unique("sessions_token_hash_unique").on(t.tokenHash),
+    index("sessions_user_id").on(t.userId),
+    index("sessions_expires_at").on(t.expiresAt)
+  ]);
+  const tokens = table("tokens", {
+    tokenHash: key("token_hash").primaryKey(),
+    kind: text("kind", { enum: ["verifyEmail", "resetPassword"] }).notNull(),
+    userId: key("user_id").notNull(),
+    address: text("address").notNull(),
+    expiresAt: at("expires_at").notNull(),
+    spentAt: at("spent_at"),
+    createdAt: at("created_at").notNull()
+  }, (t) => [
+    check("tokens_kind", sql`${t.kind} in ('verifyEmail', 'resetPassword')`),
+    index("tokens_user_id").on(t.userId)
+  ]);
+  const relations = table("relations", {
+    objectType: key("object_type").notNull(),
+    objectId: key("object_id").notNull(),
+    relation: key("relation").notNull(),
+    subjectType: key("subject_type").notNull(),
+    subjectId: key("subject_id").notNull(),
+    subjectRelation: key("subject_relation")
+  }, (t) => [
+    unique("relations_tuple_unique").on(t.subjectType, t.subjectId, t.subjectRelation, t.relation, t.objectType, t.objectId).nullsNotDistinct(),
+    index("relations_object").on(t.objectType, t.objectId, t.relation)
+  ]);
+  return { users, logins, sessions, tokens, relations };
+}
+
+// src/translate.ts
+import { toDataError } from "@nxgt/drizzle";
+import { JanusError, StoreConflict, StoreFailure } from "@nxgt/janus";
+async function run(slot, operation, body) {
+  try {
+    return await body();
+  } catch (error) {
+    if (error instanceof JanusError)
+      throw error;
+    throw new StoreFailure(`${slot}.${operation}: the store could not answer`, {
+      slot,
+      operation,
+      cause: toDataError(error)
+    });
+  }
+}
+function loginTaken(operation, type, login) {
+  return new StoreConflict("login", `${operation}: the login is taken by another ${type}`, { login, userType: type, operation });
+}
+
+// src/relations.ts
+function createDrizzleRelations(db, options = {}) {
+  const tables = options.tables ?? defineJanusTables();
+  const { rowOf, subjectIs, matching } = tupleSql(tables.relations);
+  const run$ = (operation, body) => run("relations", operation, body);
+  const holding = (object, relation, sets) => db.select({
+    type: tables.relations.subjectType,
+    id: tables.relations.subjectId,
+    relation: tables.relations.subjectRelation
+  }).from(tables.relations).where(and(eq(tables.relations.objectType, object.type), eq(tables.relations.objectId, object.id), eq(tables.relations.relation, relation), sets ? isNotNull(tables.relations.subjectRelation) : isNull(tables.relations.subjectRelation)));
+  const apply = async (tx, add, remove) => {
+    for (const tuple of inOrder(remove)) {
+      await tx.delete(tables.relations).where(matching(tuple));
+    }
+    if (add.length > 0) {
+      await tx.insert(tables.relations).values(inOrder(add).map(rowOf)).onConflictDoNothing();
+    }
+  };
+  return {
+    write: ({ add = [], remove = [] }) => run$("write", async () => {
+      if (add.length + remove.length <= 1)
+        return apply(db, add, remove);
+      await withTransaction(db, (tx) => apply(tx, add, remove));
+    }),
+    has: (tuple) => run$("has", async () => {
+      const found = await db.select({ relation: tables.relations.relation }).from(tables.relations).where(matching(tuple)).limit(1);
+      return found.length === 1;
+    }),
+    findSubjectSets: (object, relation) => run$("findSubjectSets", async () => (await holding(object, relation, true)).map((row) => ({
+      type: row.type,
+      id: row.id,
+      relation: row.relation ?? ""
+    }))),
+    findEntities: (object, relation) => run$("findEntities", async () => (await holding(object, relation, false)).map((row) => ({ type: row.type, id: row.id }))),
+    findObjects: ({ type, relation, subject, after, limit }) => run$("findObjects", async () => {
+      const conditions = [
+        subjectIs(subject),
+        eq(tables.relations.relation, relation),
+        eq(tables.relations.objectType, type)
+      ];
+      if (after !== null)
+        conditions.push(gt(tables.relations.objectId, after));
+      const found = await db.select({ id: tables.relations.objectId }).from(tables.relations).where(and(...conditions)).orderBy(asc(tables.relations.objectId)).limit(limit + 1);
+      const items = found.slice(0, limit).map((row) => row.id);
+      const last = items.at(-1);
+      return {
+        items,
+        nextCursor: found.length > limit && last !== undefined ? last : null
+      };
+    }),
+    deleteEntity: (entity) => run$("deleteEntity", async () => {
+      const deleted = await db.delete(tables.relations).where(or(and(eq(tables.relations.objectType, entity.type), eq(tables.relations.objectId, entity.id)), and(eq(tables.relations.subjectType, entity.type), eq(tables.relations.subjectId, entity.id)))).returning({ relation: tables.relations.relation });
+      return deleted.length;
+    })
+  };
+}
+function inOrder(tuples) {
+  const keyOf = (tuple) => JSON.stringify([
+    tuple.object.type,
+    tuple.object.id,
+    tuple.relation,
+    tuple.subject.type,
+    tuple.subject.id,
+    isSubjectSet(tuple.subject) ? tuple.subject.relation : null
+  ]);
+  return [...tuples].sort((a, b) => {
+    const [x, y] = [keyOf(a), keyOf(b)];
+    return x < y ? -1 : x > y ? 1 : 0;
+  });
+}
+function tupleSql(relations) {
+  function rowOf(tuple) {
+    return {
+      objectType: tuple.object.type,
+      objectId: tuple.object.id,
+      relation: tuple.relation,
+      subjectType: tuple.subject.type,
+      subjectId: tuple.subject.id,
+      subjectRelation: isSubjectSet(tuple.subject) ? tuple.subject.relation : null
+    };
+  }
+  function subjectIs(subject) {
+    return and(eq(relations.subjectType, subject.type), eq(relations.subjectId, subject.id), isSubjectSet(subject) ? eq(relations.subjectRelation, subject.relation) : isNull(relations.subjectRelation));
+  }
+  function matching(tuple) {
+    return and(eq(relations.objectType, tuple.object.type), eq(relations.objectId, tuple.object.id), eq(relations.relation, tuple.relation), subjectIs(tuple.subject));
+  }
+  return { rowOf, subjectIs, matching };
+}
+
+// src/stores.ts
+import { withTransaction as withTransaction2 } from "@nxgt/drizzle/pg";
+import { NotFoundError, StoreConflict as StoreConflict2 } from "@nxgt/janus";
+import { and as and2, asc as asc2, eq as eq2, gt as gt2, isNull as isNull2, lte, ne, sql as sql2 } from "drizzle-orm";
+function createDrizzleStores(db, options = {}) {
+  const tables = options.tables ?? defineJanusTables();
+  return {
+    users: userStore(db, tables),
+    sessions: sessionStore(db, tables),
+    tokens: tokenStore(db, tables)
+  };
+}
+function userStore(db, tables) {
+  const run$ = (operation, body) => run("users", operation, body);
+  const find = async (id) => {
+    const [row] = await db.select().from(tables.users).where(eq2(tables.users.id, id));
+    return row === undefined ? null : toUser(row);
+  };
+  const claim = async (tx, operation, user, logins) => {
+    const distinct = [...new Set(logins)].sort();
+    if (distinct.length === 0)
+      return;
+    const written = await tx.insert(tables.logins).values(distinct.map((login) => ({ type: user.type, login, userId: user.id }))).onConflictDoNothing().returning({ login: tables.logins.login });
+    if (written.length === distinct.length)
+      return;
+    const claimed = new Set(written.map((row) => row.login));
+    const taken = distinct.find((login) => !claimed.has(login)) ?? "";
+    throw loginTaken(operation, user.type, taken);
+  };
+  return {
+    insertUser: (record) => run$("insertUser", async () => {
+      const inserted = await withTransaction2(db, async (tx) => {
+        const [row] = await tx.insert(tables.users).values(toUserRow(record)).onConflictDoNothing({ target: tables.users.id }).returning();
+        if (row === undefined)
+          return null;
+        await claim(tx, "insertUser", record, record.logins);
+        return toUser(row);
+      });
+      if (inserted !== null)
+        return inserted;
+      const stored = await find(record.id);
+      if (stored !== null)
+        return stored;
+      throw new NotFoundError("insertUser: the user was deleted meanwhile", {
+        userId: record.id,
+        operation: "insertUser"
+      });
+    }),
+    findUser: (id) => run$("findUser", () => find(id)),
+    findUserByLogin: (type, login) => run$("findUserByLogin", async () => {
+      const [row] = await db.select({ user: tables.users }).from(tables.logins).innerJoin(tables.users, eq2(tables.users.id, tables.logins.userId)).where(and2(eq2(tables.logins.type, type), eq2(tables.logins.login, login)));
+      return row === undefined ? null : toUser(row.user);
+    }),
+    listUsers: ({ type, after, limit }) => run$("listUsers", async () => {
+      const found = await db.select().from(tables.users).where(after === null ? eq2(tables.users.type, type) : and2(eq2(tables.users.type, type), gt2(tables.users.id, after))).orderBy(asc2(tables.users.id)).limit(limit + 1);
+      const items = found.slice(0, limit).map(toUser);
+      const last = items.at(-1);
+      return {
+        items,
+        nextCursor: found.length > limit && last !== undefined ? last.id : null
+      };
+    }),
+    updateUser: (id, patch, ifVersion) => run$("updateUser", () => withTransaction2(db, async (tx) => {
+      const [row] = await tx.update(tables.users).set({
+        ...toUserSet(patch),
+        version: sql2`${tables.users.version} + 1`
+      }).where(and2(eq2(tables.users.id, id), eq2(tables.users.version, ifVersion))).returning();
+      if (row === undefined) {
+        const [stored] = await tx.select({ version: tables.users.version }).from(tables.users).where(eq2(tables.users.id, id));
+        if (stored === undefined) {
+          throw new NotFoundError("updateUser: no user has this id", {
+            userId: id,
+            operation: "updateUser"
+          });
+        }
+        throw new StoreConflict2("version", `updateUser: expected version ${ifVersion}, found ${stored.version}`, {
+          userId: id,
+          expectedVersion: ifVersion,
+          actualVersion: stored.version,
+          operation: "updateUser"
+        });
+      }
+      if (patch.logins !== undefined) {
+        await tx.delete(tables.logins).where(eq2(tables.logins.userId, id));
+        await claim(tx, "updateUser", row, patch.logins);
+      }
+      return toUser(row);
+    })),
+    deleteUser: (id) => run$("deleteUser", async () => {
+      const deleted = await db.delete(tables.users).where(eq2(tables.users.id, id)).returning({ id: tables.users.id });
+      return deleted.length === 1;
+    })
+  };
+}
+function sessionStore(db, tables) {
+  const run$ = (operation, body) => run("sessions", operation, body);
+  return {
+    insertSession: (record) => run$("insertSession", async () => {
+      await db.insert(tables.sessions).values(record).onConflictDoNothing({ target: tables.sessions.id });
+    }),
+    findSessionByTokenHash: (tokenHash) => run$("findSessionByTokenHash", async () => {
+      const [row] = await db.select().from(tables.sessions).where(eq2(tables.sessions.tokenHash, tokenHash));
+      return row === undefined ? null : toSession(row);
+    }),
+    extendSession: (id, expiresAt) => run$("extendSession", async () => {
+      const [row] = await db.update(tables.sessions).set({ expiresAt }).where(and2(eq2(tables.sessions.id, id), isNull2(tables.sessions.revokedAt))).returning();
+      return row === undefined ? null : toSession(row);
+    }),
+    revokeSession: (id, at) => run$("revokeSession", async () => {
+      const matched = await db.update(tables.sessions).set({
+        revokedAt: sql2`coalesce(${tables.sessions.revokedAt}, ${stamp(at)})`
+      }).where(eq2(tables.sessions.id, id)).returning({ id: tables.sessions.id });
+      return matched.length === 1;
+    }),
+    revokeUserSessions: (userId, at, except) => run$("revokeUserSessions", async () => {
+      const standing = and2(eq2(tables.sessions.userId, userId), isNull2(tables.sessions.revokedAt));
+      const revoked = await db.update(tables.sessions).set({ revokedAt: at }).where(except === undefined ? standing : and2(standing, ne(tables.sessions.id, except))).returning({ id: tables.sessions.id });
+      return revoked.length;
+    }),
+    deleteUserSessions: (userId) => run$("deleteUserSessions", async () => {
+      const deleted = await db.delete(tables.sessions).where(eq2(tables.sessions.userId, userId)).returning({ id: tables.sessions.id });
+      return deleted.length;
+    }),
+    deleteExpiredSessions: (before) => run$("deleteExpiredSessions", async () => {
+      const deleted = await db.delete(tables.sessions).where(lte(tables.sessions.expiresAt, before)).returning({ id: tables.sessions.id });
+      return deleted.length;
+    })
+  };
+}
+function tokenStore(db, tables) {
+  const run$ = (operation, body) => run("tokens", operation, body);
+  return {
+    insertToken: (record) => run$("insertToken", async () => {
+      await db.insert(tables.tokens).values(record).onConflictDoNothing();
+    }),
+    consumeToken: (tokenHash, kind, at) => run$("consumeToken", async () => {
+      const before = db.$with("before").as(db.select().from(tables.tokens).where(and2(eq2(tables.tokens.tokenHash, tokenHash), eq2(tables.tokens.kind, kind))).for("update"));
+      const [spent] = await db.with(before).update(tables.tokens).set({
+        spentAt: sql2`coalesce(${tables.tokens.spentAt}, ${stamp(at)})`
+      }).from(before).where(eq2(tables.tokens.tokenHash, before.tokenHash)).returning({
+        tokenHash: before.tokenHash,
+        kind: before.kind,
+        userId: before.userId,
+        address: before.address,
+        expiresAt: before.expiresAt,
+        spentAt: before.spentAt,
+        createdAt: before.createdAt
+      });
+      return spent === undefined ? null : { ...spent, userId: spent.userId };
+    }),
+    deleteUserTokens: (userId) => run$("deleteUserTokens", async () => {
+      const deleted = await db.delete(tables.tokens).where(eq2(tables.tokens.userId, userId)).returning({ tokenHash: tables.tokens.tokenHash });
+      return deleted.length;
+    })
+  };
+}
+function toUserRow(record) {
+  return {
+    id: record.id,
+    type: record.type,
+    schemaVersion: record.schemaVersion,
+    active: record.active,
+    fields: record.fields,
+    logins: [...record.logins],
+    passwordHash: record.password?.hash ?? null,
+    passwordUpdatedAt: record.password?.updatedAt ?? null,
+    emailVerifiedAt: record.emailVerifiedAt,
+    version: record.version,
+    createdAt: record.createdAt,
+    updatedAt: record.updatedAt
+  };
+}
+function toUserSet(patch) {
+  const set = {
+    updatedAt: patch.updatedAt
+  };
+  if (patch.schemaVersion !== undefined)
+    set.schemaVersion = patch.schemaVersion;
+  if (patch.active !== undefined)
+    set.active = patch.active;
+  if (patch.fields !== undefined)
+    set.fields = patch.fields;
+  if (patch.logins !== undefined)
+    set.logins = [...patch.logins];
+  if (patch.emailVerifiedAt !== undefined)
+    set.emailVerifiedAt = patch.emailVerifiedAt;
+  if (patch.password !== undefined) {
+    set.passwordHash = patch.password?.hash ?? null;
+    set.passwordUpdatedAt = patch.password?.updatedAt ?? null;
+  }
+  return set;
+}
+function toUser(row) {
+  return {
+    id: row.id,
+    type: row.type,
+    schemaVersion: row.schemaVersion,
+    active: row.active,
+    fields: row.fields,
+    logins: [...row.logins],
+    password: row.passwordHash === null || row.passwordUpdatedAt === null ? null : { hash: row.passwordHash, updatedAt: row.passwordUpdatedAt },
+    emailVerifiedAt: row.emailVerifiedAt,
+    version: row.version,
+    createdAt: row.createdAt,
+    updatedAt: row.updatedAt
+  };
+}
+function toSession(row) {
+  return {
+    id: row.id,
+    tokenHash: row.tokenHash,
+    userId: row.userId,
+    authenticatedAt: row.authenticatedAt,
+    expiresAt: row.expiresAt,
+    revokedAt: row.revokedAt,
+    createdAt: row.createdAt
+  };
+}
+function stamp(at) {
+  return sql2`${at.toISOString()}::timestamptz`;
+}
+
+// src/adapter.ts
+function createDrizzleAdapter(db, options = {}) {
+  return {
+    store: createDrizzleStores(db, options),
+    relations: createDrizzleRelations(db, options)
+  };
+}
+export {
+  createDrizzleAdapter,
+  createDrizzleRelations,
+  createDrizzleStores,
+  defineJanusTables
+};
+
+//# debugId=C86E53CADC19B15A64756E2164756E21
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1,14 @@
+{
+  "version": 3,
+  "sources": ["../src/relations.ts", "../src/tables.ts", "../src/translate.ts", "../src/stores.ts", "../src/adapter.ts"],
+  "sourcesContent": [
+    "import { type PgDatabase, withTransaction } from '@nxgt/drizzle/pg';\nimport {\n\ttype Entity,\n\tisSubjectSet,\n\ttype RelationTuple,\n\ttype Subject,\n\ttype SubjectSet,\n} from '@nxgt/janus';\nimport type { RelationStore } from '@nxgt/janus/permissions';\nimport { and, asc, eq, gt, isNotNull, isNull, or, type SQL } from 'drizzle-orm';\nimport {\n\ttype DrizzleAdapterOptions,\n\tdefineJanusTables,\n\ttype JanusTables,\n} from './tables';\nimport { run } from './translate';\n\n/**\n * The relation store `permissions()` takes, over one PostgreSQL database\n * through Drizzle — and the one `janus({ relations })` deletes a user's\n * tuples from.\n *\n * ```ts\n * const access = permissions({ model, store: createDrizzleRelations(db) });\n * ```\n *\n * **A write of more than one tuple is a transaction**, `@nxgt/drizzle`'s\n * `withTransaction`: removals first, then additions, all or nothing. It is not\n * retried here — a write is idempotent, so the caller retries.\n */\nexport function createDrizzleRelations(\n\tdb: PgDatabase,\n\toptions: DrizzleAdapterOptions<'relations'> = {},\n): RelationStore {\n\tconst tables = options.tables ?? defineJanusTables();\n\tconst { rowOf, subjectIs, matching } = tupleSql(tables.relations);\n\tconst run$ = <T>(operation: string, body: () => Promise<T>) =>\n\t\trun('relations', operation, body);\n\n\t/** One hop from an object: its subject sets, or its entities. */\n\tconst holding = (object: Entity, relation: string, sets: boolean) =>\n\t\tdb\n\t\t\t.select({\n\t\t\t\ttype: tables.relations.subjectType,\n\t\t\t\tid: tables.relations.subjectId,\n\t\t\t\trelation: tables.relations.subjectRelation,\n\t\t\t})\n\t\t\t.from(tables.relations)\n\t\t\t.where(\n\t\t\t\tand(\n\t\t\t\t\teq(tables.relations.objectType, object.type),\n\t\t\t\t\teq(tables.relations.objectId, object.id),\n\t\t\t\t\teq(tables.relations.relation, relation),\n\t\t\t\t\tsets\n\t\t\t\t\t\t? isNotNull(tables.relations.subjectRelation)\n\t\t\t\t\t\t: isNull(tables.relations.subjectRelation),\n\t\t\t\t),\n\t\t\t);\n\n\tconst apply = async (\n\t\ttx: PgDatabase,\n\t\tadd: readonly RelationTuple[],\n\t\tremove: readonly RelationTuple[],\n\t) => {\n\t\t// In one order, so two writes touching the same tuples take their locks\n\t\t// alike and never deadlock.\n\t\tfor (const tuple of inOrder(remove)) {\n\t\t\tawait tx.delete(tables.relations).where(matching(tuple));\n\t\t}\n\t\tif (add.length > 0) {\n\t\t\t// A stored tuple meets the unique constraint, and is a no-op.\n\t\t\tawait tx\n\t\t\t\t.insert(tables.relations)\n\t\t\t\t.values(inOrder(add).map(rowOf))\n\t\t\t\t.onConflictDoNothing();\n\t\t}\n\t};\n\n\treturn {\n\t\twrite: ({ add = [], remove = [] }) =>\n\t\t\trun$('write', async () => {\n\t\t\t\tif (add.length + remove.length <= 1) return apply(db, add, remove);\n\t\t\t\tawait withTransaction(db, (tx) => apply(tx, add, remove));\n\t\t\t}),\n\n\t\thas: (tuple) =>\n\t\t\trun$('has', async () => {\n\t\t\t\tconst found = await db\n\t\t\t\t\t.select({ relation: tables.relations.relation })\n\t\t\t\t\t.from(tables.relations)\n\t\t\t\t\t.where(matching(tuple))\n\t\t\t\t\t.limit(1);\n\t\t\t\treturn found.length === 1;\n\t\t\t}),\n\n\t\tfindSubjectSets: (object, relation) =>\n\t\t\trun$('findSubjectSets', async () =>\n\t\t\t\t(await holding(object, relation, true)).map(\n\t\t\t\t\t(row): SubjectSet => ({\n\t\t\t\t\t\ttype: row.type,\n\t\t\t\t\t\tid: row.id,\n\t\t\t\t\t\trelation: row.relation ?? '',\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t),\n\n\t\tfindEntities: (object, relation) =>\n\t\t\trun$('findEntities', async () =>\n\t\t\t\t(await holding(object, relation, false)).map(\n\t\t\t\t\t(row): Entity => ({ type: row.type, id: row.id }),\n\t\t\t\t),\n\t\t\t),\n\n\t\tfindObjects: ({ type, relation, subject, after, limit }) =>\n\t\t\trun$('findObjects', async () => {\n\t\t\t\tconst conditions = [\n\t\t\t\t\tsubjectIs(subject),\n\t\t\t\t\teq(tables.relations.relation, relation),\n\t\t\t\t\teq(tables.relations.objectType, type),\n\t\t\t\t];\n\t\t\t\tif (after !== null)\n\t\t\t\t\tconditions.push(gt(tables.relations.objectId, after));\n\t\t\t\tconst found = await db\n\t\t\t\t\t.select({ id: tables.relations.objectId })\n\t\t\t\t\t.from(tables.relations)\n\t\t\t\t\t.where(and(...conditions))\n\t\t\t\t\t.orderBy(asc(tables.relations.objectId))\n\t\t\t\t\t.limit(limit + 1);\n\t\t\t\tconst items = found.slice(0, limit).map((row) => row.id);\n\t\t\t\tconst last = items.at(-1);\n\t\t\t\treturn {\n\t\t\t\t\titems,\n\t\t\t\t\tnextCursor: found.length > limit && last !== undefined ? last : null,\n\t\t\t\t};\n\t\t\t}),\n\n\t\tdeleteEntity: (entity) =>\n\t\t\trun$('deleteEntity', async () => {\n\t\t\t\tconst deleted = await db\n\t\t\t\t\t.delete(tables.relations)\n\t\t\t\t\t.where(\n\t\t\t\t\t\tor(\n\t\t\t\t\t\t\tand(\n\t\t\t\t\t\t\t\teq(tables.relations.objectType, entity.type),\n\t\t\t\t\t\t\t\teq(tables.relations.objectId, entity.id),\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\tand(\n\t\t\t\t\t\t\t\teq(tables.relations.subjectType, entity.type),\n\t\t\t\t\t\t\t\teq(tables.relations.subjectId, entity.id),\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t),\n\t\t\t\t\t)\n\t\t\t\t\t.returning({ relation: tables.relations.relation });\n\t\t\t\treturn deleted.length;\n\t\t\t}),\n\t};\n}\n\n/** Tuples in one order: their notation, compared by code unit. */\nfunction inOrder(tuples: readonly RelationTuple[]): readonly RelationTuple[] {\n\tconst keyOf = (tuple: RelationTuple) =>\n\t\tJSON.stringify([\n\t\t\ttuple.object.type,\n\t\t\ttuple.object.id,\n\t\t\ttuple.relation,\n\t\t\ttuple.subject.type,\n\t\t\ttuple.subject.id,\n\t\t\tisSubjectSet(tuple.subject) ? tuple.subject.relation : null,\n\t\t]);\n\treturn [...tuples].sort((a, b) => {\n\t\tconst [x, y] = [keyOf(a), keyOf(b)];\n\t\treturn x < y ? -1 : x > y ? 1 : 0;\n\t});\n}\n\ntype Relations = JanusTables['relations'];\n\n/** The SQL of one tuple, over the `relations` table in use. */\nfunction tupleSql(relations: Relations) {\n\t/** A tuple as a row: an entity's `subject_relation` is `null`. */\n\tfunction rowOf(tuple: RelationTuple): Relations['$inferInsert'] {\n\t\treturn {\n\t\t\tobjectType: tuple.object.type,\n\t\t\tobjectId: tuple.object.id,\n\t\t\trelation: tuple.relation,\n\t\t\tsubjectType: tuple.subject.type,\n\t\t\tsubjectId: tuple.subject.id,\n\t\t\tsubjectRelation: isSubjectSet(tuple.subject)\n\t\t\t\t? tuple.subject.relation\n\t\t\t\t: null,\n\t\t};\n\t}\n\n\t/** Exactly this subject: a subject set is not its entity, and the reverse. */\n\tfunction subjectIs(subject: Subject): SQL | undefined {\n\t\treturn and(\n\t\t\teq(relations.subjectType, subject.type),\n\t\t\teq(relations.subjectId, subject.id),\n\t\t\tisSubjectSet(subject)\n\t\t\t\t? eq(relations.subjectRelation, subject.relation)\n\t\t\t\t: isNull(relations.subjectRelation),\n\t\t);\n\t}\n\n\t/** Exactly this tuple. */\n\tfunction matching(tuple: RelationTuple): SQL | undefined {\n\t\treturn and(\n\t\t\teq(relations.objectType, tuple.object.type),\n\t\t\teq(relations.objectId, tuple.object.id),\n\t\t\teq(relations.relation, tuple.relation),\n\t\t\tsubjectIs(tuple.subject),\n\t\t);\n\t}\n\n\treturn { rowOf, subjectIs, matching };\n}\n",
+    "import { sql } from 'drizzle-orm';\nimport {\n\tboolean,\n\tcheck,\n\tcustomType,\n\tforeignKey,\n\tindex,\n\tinteger,\n\tjsonb,\n\ttype PgSchema,\n\tpgTable,\n\tprimaryKey,\n\ttext,\n\ttimestamp,\n\tunique,\n} from 'drizzle-orm/pg-core';\n\n/**\n * The five tables, as Drizzle definitions: **your migrations create them**.\n * Export them from the schema file drizzle-kit reads, and `drizzle-kit\n * generate` writes them into your next migration like any table of your own.\n *\n * **The names carry no prefix** — `users`, `logins`, `sessions`, `tokens`,\n * `relations` — because the setup this package recommends is **a database of\n * its own**, backed up and restored on its own. Beside an application's own\n * tables, give them a PostgreSQL schema instead: `{ schema: pgSchema('janus') }`\n * makes them `janus.users` and the rest, and `pg_dump -n janus` backs them up\n * alone.\n *\n * Columns are `snake_case`, as PostgreSQL's own catalog and `@nxgt/drizzle`'s\n * columns are: a camelCase column would have to be quoted in every query\n * written by hand. The records the stores answer are camelCase, as everywhere\n * in Janus.\n *\n * **What the tables hold is the port's record**, field by field. Nothing is\n * encoded, so a row read in `psql` reads like the record in the code.\n */\n\n/** Where the tables live. */\nexport interface JanusTablesOptions {\n\t/**\n\t * A PostgreSQL schema of their own, `pgSchema('janus')`, for a database the\n\t * application's tables share. **Export it from the schema file too**:\n\t * drizzle-kit writes `CREATE SCHEMA` only for a schema it finds exported.\n\t * Absent, the tables are in the connection's `search_path`, `public` by\n\t * default: the database of their own.\n\t */\n\treadonly schema?: PgSchema;\n}\n\n/**\n * A key compared byte by byte, as the port asks (rule 4): `collate \"C\"`. Under\n * a database's default collation, `en_US.UTF-8` or the like, `B` sorts after\n * `a` — and a page in \"ascending id order\" repeats or skips rows.\n */\nconst key = customType<{ data: string; driverData: string }>({\n\tdataType: () => 'text collate \"C\"',\n});\n\n// Millisecond precision: a JavaScript `Date` has no more. At PostgreSQL's\n// default of microseconds, a timestamp written and read back is not the one\n// the core wrote.\nconst at = (name: string) =>\n\ttimestamp(name, { withTimezone: true, precision: 3 });\n\n/**\n * The five tables, in the schema `options` names, or in none.\n *\n * ```ts\n * // src/janus/schema.ts — the schema file of Janus's own drizzle-kit config\n * export const { users, logins, sessions, tokens, relations } = defineJanusTables();\n *\n * // or, in a database the application's tables share\n * export const janus = pgSchema('janus');\n * export const { users, logins, sessions, tokens, relations } = defineJanusTables({ schema: janus });\n * ```\n *\n * Pass what the schema file exports to `createDrizzleAdapter` as `{ tables }`,\n * so the stores query the very tables your migration created.\n */\nexport function defineJanusTables(options: JanusTablesOptions = {}) {\n\tconst { schema } = options;\n\tconst table = (\n\t\tschema === undefined ? pgTable : schema.table\n\t) as typeof pgTable;\n\n\t/**\n\t * Users and their passwords: one row each. `logins` is the port's array,\n\t * verbatim and in order; its uniqueness is `logins`' primary key.\n\t */\n\tconst users = table(\n\t\t'users',\n\t\t{\n\t\t\t/** The UUIDv7 the core minted. `text`, not `uuid`: the store parses nothing. */\n\t\t\tid: key('id').primaryKey(),\n\t\t\ttype: key('type').notNull(),\n\t\t\tschemaVersion: text('schema_version').notNull(),\n\t\t\tactive: boolean('active').notNull(),\n\t\t\t/** The application's fields. The core validated them already. */\n\t\t\tfields: jsonb('fields').notNull(),\n\t\t\tlogins: text('logins').array().notNull(),\n\t\t\tpasswordHash: text('password_hash'),\n\t\t\tpasswordUpdatedAt: at('password_updated_at'),\n\t\t\temailVerifiedAt: at('email_verified_at'),\n\t\t\tversion: integer('version').notNull(),\n\t\t\tcreatedAt: at('created_at').notNull(),\n\t\t\tupdatedAt: at('updated_at').notNull(),\n\t\t},\n\t\t(t) => [\n\t\t\t/** What `logins` references, so a login's type is its user's. */\n\t\t\tunique('users_id_type_unique').on(t.id, t.type),\n\t\t\t/** `listUsers` reads one type in id order. */\n\t\t\tindex('users_type_id').on(t.type, t.id),\n\t\t\t/** A password is a hash and when it was set, or neither. */\n\t\t\tcheck(\n\t\t\t\t'users_password_whole',\n\t\t\t\tsql`(${t.passwordHash} is null) = (${t.passwordUpdatedAt} is null)`,\n\t\t\t),\n\t\t],\n\t);\n\n\t/**\n\t * **The uniqueness of a login, per type** (rule 3): one row per login a\n\t * user holds, and the primary key refuses a second holder. PostgreSQL has\n\t * no unique index over the elements of an array, so this table is that\n\t * index, written in the same transaction as the user. Deleting the user\n\t * deletes its rows.\n\t */\n\tconst logins = table(\n\t\t'logins',\n\t\t{\n\t\t\ttype: key('type').notNull(),\n\t\t\tlogin: key('login').notNull(),\n\t\t\tuserId: key('user_id').notNull(),\n\t\t},\n\t\t(t) => [\n\t\t\tprimaryKey({ name: 'logins_pkey', columns: [t.type, t.login] }),\n\t\t\tforeignKey({\n\t\t\t\tname: 'logins_user_fk',\n\t\t\t\tcolumns: [t.userId, t.type],\n\t\t\t\tforeignColumns: [users.id, users.type],\n\t\t\t}).onDelete('cascade'),\n\t\t\tindex('logins_user_id').on(t.userId),\n\t\t],\n\t);\n\n\t/**\n\t * Sessions. No foreign key to the user: deleting a user deletes the user,\n\t * and the core deletes the sessions next — as it does when they live\n\t * elsewhere, in Redis.\n\t */\n\tconst sessions = table(\n\t\t'sessions',\n\t\t{\n\t\t\tid: key('id').primaryKey(),\n\t\t\t/** `sha256` of the session token. The secret itself is never stored. */\n\t\t\ttokenHash: key('token_hash').notNull(),\n\t\t\tuserId: key('user_id').notNull(),\n\t\t\tauthenticatedAt: at('authenticated_at').notNull(),\n\t\t\texpiresAt: at('expires_at').notNull(),\n\t\t\trevokedAt: at('revoked_at'),\n\t\t\tcreatedAt: at('created_at').notNull(),\n\t\t},\n\t\t(t) => [\n\t\t\tunique('sessions_token_hash_unique').on(t.tokenHash),\n\t\t\tindex('sessions_user_id').on(t.userId),\n\t\t\t/** `deleteExpiredSessions`: PostgreSQL has no TTL, so the core collects. */\n\t\t\tindex('sessions_expires_at').on(t.expiresAt),\n\t\t],\n\t);\n\n\t/** One-time tokens, keyed by their hash. */\n\tconst tokens = table(\n\t\t'tokens',\n\t\t{\n\t\t\ttokenHash: key('token_hash').primaryKey(),\n\t\t\tkind: text('kind', { enum: ['verifyEmail', 'resetPassword'] }).notNull(),\n\t\t\tuserId: key('user_id').notNull(),\n\t\t\taddress: text('address').notNull(),\n\t\t\texpiresAt: at('expires_at').notNull(),\n\t\t\tspentAt: at('spent_at'),\n\t\t\tcreatedAt: at('created_at').notNull(),\n\t\t},\n\t\t(t) => [\n\t\t\tcheck('tokens_kind', sql`${t.kind} in ('verifyEmail', 'resetPassword')`),\n\t\t\tindex('tokens_user_id').on(t.userId),\n\t\t],\n\t);\n\n\t/**\n\t * Permission tuples, one row each: `record:r1#owners@patient:u1`, or\n\t * `…@team:t1#members` for a subject set, whose `subject_relation` an\n\t * entity's row leaves `null`.\n\t *\n\t * **The uniqueness of a tuple is the unique constraint**, `nulls not\n\t * distinct` so two rows for one entity collide — PostgreSQL 15 or later.\n\t * Its column order is the reverse index `findObjects` pages: every equality\n\t * first, the object id last.\n\t */\n\tconst relations = table(\n\t\t'relations',\n\t\t{\n\t\t\tobjectType: key('object_type').notNull(),\n\t\t\tobjectId: key('object_id').notNull(),\n\t\t\trelation: key('relation').notNull(),\n\t\t\tsubjectType: key('subject_type').notNull(),\n\t\t\tsubjectId: key('subject_id').notNull(),\n\t\t\tsubjectRelation: key('subject_relation'),\n\t\t},\n\t\t(t) => [\n\t\t\tunique('relations_tuple_unique')\n\t\t\t\t.on(\n\t\t\t\t\tt.subjectType,\n\t\t\t\t\tt.subjectId,\n\t\t\t\t\tt.subjectRelation,\n\t\t\t\t\tt.relation,\n\t\t\t\t\tt.objectType,\n\t\t\t\t\tt.objectId,\n\t\t\t\t)\n\t\t\t\t.nullsNotDistinct(),\n\t\t\t/** One hop forwards: `findSubjectSets`, `findEntities`, `deleteEntity` as the object. */\n\t\t\tindex('relations_object').on(t.objectType, t.objectId, t.relation),\n\t\t],\n\t);\n\n\treturn { users, logins, sessions, tokens, relations };\n}\n\n/** The five tables `defineJanusTables` answers. */\nexport type JanusTables = ReturnType<typeof defineJanusTables>;\n\n/**\n * Which tables the stores query: **the ones your schema file exports**, so\n * the migration and the stores cannot disagree. Absent, `defineJanusTables()`:\n * the tables in the connection's `search_path`.\n *\n * ```ts\n * // src/db/schema.ts\n * export const janus = pgSchema('janus');\n * export const janusTables = defineJanusTables({ schema: janus });\n * export const { users, logins, sessions, tokens, relations } = janusTables;\n *\n * // where the adapter is wired\n * const postgres = createDrizzleAdapter(db, { tables: janusTables });\n * ```\n */\nexport interface DrizzleAdapterOptions<\n\tK extends keyof JanusTables = keyof JanusTables,\n> {\n\treadonly tables?: Pick<JanusTables, K>;\n}\n",
+    "import { toDataError } from '@nxgt/drizzle';\nimport { JanusError, StoreConflict, StoreFailure } from '@nxgt/janus';\n\n/**\n * **The database's errors, as the port's.** One file, and one default.\n *\n * | What happens | Becomes |\n * | --- | --- |\n * | A login another user of the type holds | `StoreConflict('login')`, carrying `login` and `userType` |\n * | A row with this id already there | nothing: the insert is a retry, and answers what is stored |\n * | A unique violation on **any other constraint** | **`StoreFailure`** |\n * | A check or foreign key refusing a row | **`StoreFailure`** |\n * | Anything else, absolutely | `StoreFailure`, with `@nxgt/drizzle`'s `DataError` as `cause` |\n *\n * The first two are never errors here: a login is written with `on conflict\n * do nothing`, and a login the statement did not write is one somebody else\n * holds — so no conflict is ever told apart by parsing a driver's message.\n *\n * The bold rows go against the obvious reading. A violation the adapter did\n * not mean to cause is an adapter bug, and reporting it as `LOGIN_TAKEN`\n * would tell somebody their login is taken when it is not. The core\n * validated every record before it reached a store, so a constraint refusing\n * one means the adapter and the port disagree — never the caller's fault.\n *\n * **The default is a failure, not an absence.** That branch is what keeps the\n * port's first rule: nothing here answers `null` for an error.\n */\n\nexport type Slot = 'users' | 'sessions' | 'tokens' | 'relations';\n\n/** Runs one port method, and makes every rejection one the port allows. */\nexport async function run<T>(\n\tslot: Slot,\n\toperation: string,\n\tbody: () => Promise<T>,\n): Promise<T> {\n\ttry {\n\t\treturn await body();\n\t} catch (error) {\n\t\t// Already the port's — a conflict, a NOT_FOUND after a read.\n\t\tif (error instanceof JanusError) throw error;\n\t\tthrow new StoreFailure(`${slot}.${operation}: the store could not answer`, {\n\t\t\tslot,\n\t\t\toperation,\n\t\t\tcause: toDataError(error),\n\t\t});\n\t}\n}\n\n/** The refusal the port promises for a taken login. */\nexport function loginTaken(\n\toperation: string,\n\ttype: string,\n\tlogin: string,\n): StoreConflict {\n\treturn new StoreConflict(\n\t\t'login',\n\t\t`${operation}: the login is taken by another ${type}`,\n\t\t{ login, userType: type, operation },\n\t);\n}\n",
+    "import { type PgDatabase, withTransaction } from '@nxgt/drizzle/pg';\nimport type {\n\tId,\n\tJanusStores,\n\tSessionRecord,\n\tSessionStore,\n\tTokenStore,\n\tUserPatch,\n\tUserRecord,\n\tUserStore,\n} from '@nxgt/janus';\nimport { NotFoundError, StoreConflict } from '@nxgt/janus';\nimport { and, asc, eq, gt, isNull, lte, ne, type SQL, sql } from 'drizzle-orm';\nimport {\n\ttype DrizzleAdapterOptions,\n\tdefineJanusTables,\n\ttype JanusTables,\n} from './tables';\nimport { loginTaken, run } from './translate';\n\ntype UserRow = JanusTables['users']['$inferSelect'];\ntype UserInsert = JanusTables['users']['$inferInsert'];\ntype SessionRow = JanusTables['sessions']['$inferSelect'];\n\n/** The four tables the identity stores query. */\ntype IdentityTable = 'users' | 'logins' | 'sessions' | 'tokens';\ntype IdentityTables = Pick<JanusTables, IdentityTable>;\n\n/**\n * The three stores `janus()` takes, over one PostgreSQL database through\n * Drizzle.\n *\n * ```ts\n * const db = drizzle(process.env.DATABASE_URL);\n * const auth = janus({ user, password: { login: 'email' }, store: createDrizzleStores(db), hasher });\n * ```\n *\n * **Every read is one statement**, whose absence is an empty result, turned\n * into `null` here; everything that arrives as a rejection is a failure. There\n * is no path on which an absence and an outage travel the same channel.\n *\n * **A user is written in one transaction** with its logins, whose table holds\n * their uniqueness — `@nxgt/drizzle`'s `withTransaction`, inside the method,\n * as rule 5 allows. Every other write is one statement.\n *\n * `sessions.deleteExpiredSessions` is implemented: PostgreSQL has no TTL, so\n * `auth.collectExpired()` is how lapsed sessions leave the table.\n *\n * `{ tables }` is what your schema file exports; absent, the tables in the\n * connection's `search_path`.\n */\nexport function createDrizzleStores(\n\tdb: PgDatabase,\n\toptions: DrizzleAdapterOptions<IdentityTable> = {},\n): JanusStores {\n\tconst tables = options.tables ?? defineJanusTables();\n\treturn {\n\t\tusers: userStore(db, tables),\n\t\tsessions: sessionStore(db, tables),\n\t\ttokens: tokenStore(db, tables),\n\t};\n}\n\nfunction userStore(db: PgDatabase, tables: IdentityTables): UserStore {\n\tconst run$ = <T>(operation: string, body: () => Promise<T>) =>\n\t\trun('users', operation, body);\n\n\tconst find = async (id: string) => {\n\t\tconst [row] = await db\n\t\t\t.select()\n\t\t\t.from(tables.users)\n\t\t\t.where(eq(tables.users.id, id));\n\t\treturn row === undefined ? null : toUser(row);\n\t};\n\n\t/**\n\t * Writes the logins of one user, and throws the port's conflict for the\n\t * first one another user of the type holds. `on conflict do nothing`: a\n\t * login the statement did not write is one somebody else holds, and a\n\t * concurrent sign-up waits for the first to commit, then writes nothing.\n\t */\n\tconst claim = async (\n\t\ttx: PgDatabase,\n\t\toperation: string,\n\t\tuser: { readonly id: string; readonly type: string },\n\t\tlogins: readonly string[],\n\t) => {\n\t\t// Sorted: two transactions claiming the same logins take their locks in\n\t\t// one order, and never deadlock — the loser waits, then finds them taken.\n\t\tconst distinct = [...new Set(logins)].sort();\n\t\tif (distinct.length === 0) return;\n\t\tconst written = await tx\n\t\t\t.insert(tables.logins)\n\t\t\t.values(\n\t\t\t\tdistinct.map((login) => ({ type: user.type, login, userId: user.id })),\n\t\t\t)\n\t\t\t.onConflictDoNothing()\n\t\t\t.returning({ login: tables.logins.login });\n\t\tif (written.length === distinct.length) return;\n\t\tconst claimed = new Set(written.map((row) => row.login));\n\t\tconst taken = distinct.find((login) => !claimed.has(login)) ?? '';\n\t\tthrow loginTaken(operation, user.type, taken);\n\t};\n\n\treturn {\n\t\tinsertUser: (record) =>\n\t\t\trun$('insertUser', async () => {\n\t\t\t\tconst inserted = await withTransaction(db, async (tx) => {\n\t\t\t\t\tconst [row] = await tx\n\t\t\t\t\t\t.insert(tables.users)\n\t\t\t\t\t\t.values(toUserRow(record))\n\t\t\t\t\t\t.onConflictDoNothing({ target: tables.users.id })\n\t\t\t\t\t\t.returning();\n\t\t\t\t\tif (row === undefined) return null;\n\t\t\t\t\tawait claim(tx, 'insertUser', record, record.logins);\n\t\t\t\t\treturn toUser(row);\n\t\t\t\t});\n\t\t\t\tif (inserted !== null) return inserted;\n\n\t\t\t\t// A retry whose first attempt landed: the user with this id is\n\t\t\t\t// there, and is the answer — logins included, which are theirs.\n\t\t\t\tconst stored = await find(record.id);\n\t\t\t\tif (stored !== null) return stored;\n\t\t\t\t// Deleted between the two statements: a retry of nothing.\n\t\t\t\tthrow new NotFoundError('insertUser: the user was deleted meanwhile', {\n\t\t\t\t\tuserId: record.id,\n\t\t\t\t\toperation: 'insertUser',\n\t\t\t\t});\n\t\t\t}),\n\n\t\tfindUser: (id) => run$('findUser', () => find(id)),\n\n\t\tfindUserByLogin: (type, login) =>\n\t\t\trun$('findUserByLogin', async () => {\n\t\t\t\tconst [row] = await db\n\t\t\t\t\t.select({ user: tables.users })\n\t\t\t\t\t.from(tables.logins)\n\t\t\t\t\t.innerJoin(tables.users, eq(tables.users.id, tables.logins.userId))\n\t\t\t\t\t.where(\n\t\t\t\t\t\tand(eq(tables.logins.type, type), eq(tables.logins.login, login)),\n\t\t\t\t\t);\n\t\t\t\treturn row === undefined ? null : toUser(row.user);\n\t\t\t}),\n\n\t\tlistUsers: ({ type, after, limit }) =>\n\t\t\trun$('listUsers', async () => {\n\t\t\t\t// One more than the page, to know whether another follows.\n\t\t\t\tconst found = await db\n\t\t\t\t\t.select()\n\t\t\t\t\t.from(tables.users)\n\t\t\t\t\t.where(\n\t\t\t\t\t\tafter === null\n\t\t\t\t\t\t\t? eq(tables.users.type, type)\n\t\t\t\t\t\t\t: and(eq(tables.users.type, type), gt(tables.users.id, after)),\n\t\t\t\t\t)\n\t\t\t\t\t.orderBy(asc(tables.users.id))\n\t\t\t\t\t.limit(limit + 1);\n\t\t\t\tconst items = found.slice(0, limit).map(toUser);\n\t\t\t\tconst last = items.at(-1);\n\t\t\t\treturn {\n\t\t\t\t\titems,\n\t\t\t\t\tnextCursor:\n\t\t\t\t\t\tfound.length > limit && last !== undefined ? last.id : null,\n\t\t\t\t};\n\t\t\t}),\n\n\t\tupdateUser: (id, patch, ifVersion) =>\n\t\t\trun$('updateUser', () =>\n\t\t\t\twithTransaction(db, async (tx) => {\n\t\t\t\t\tconst [row] = await tx\n\t\t\t\t\t\t.update(tables.users)\n\t\t\t\t\t\t.set({\n\t\t\t\t\t\t\t...toUserSet(patch),\n\t\t\t\t\t\t\tversion: sql`${tables.users.version} + 1`,\n\t\t\t\t\t\t})\n\t\t\t\t\t\t.where(\n\t\t\t\t\t\t\tand(eq(tables.users.id, id), eq(tables.users.version, ifVersion)),\n\t\t\t\t\t\t)\n\t\t\t\t\t\t.returning();\n\n\t\t\t\t\tif (row === undefined) {\n\t\t\t\t\t\t// The write matched nothing, which alone cannot tell an unknown\n\t\t\t\t\t\t// id from a moved version: read again, and say which.\n\t\t\t\t\t\tconst [stored] = await tx\n\t\t\t\t\t\t\t.select({ version: tables.users.version })\n\t\t\t\t\t\t\t.from(tables.users)\n\t\t\t\t\t\t\t.where(eq(tables.users.id, id));\n\t\t\t\t\t\tif (stored === undefined) {\n\t\t\t\t\t\t\tthrow new NotFoundError('updateUser: no user has this id', {\n\t\t\t\t\t\t\t\tuserId: id,\n\t\t\t\t\t\t\t\toperation: 'updateUser',\n\t\t\t\t\t\t\t});\n\t\t\t\t\t\t}\n\t\t\t\t\t\tthrow new StoreConflict(\n\t\t\t\t\t\t\t'version',\n\t\t\t\t\t\t\t`updateUser: expected version ${ifVersion}, found ${stored.version}`,\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\tuserId: id,\n\t\t\t\t\t\t\t\texpectedVersion: ifVersion,\n\t\t\t\t\t\t\t\tactualVersion: stored.version,\n\t\t\t\t\t\t\t\toperation: 'updateUser',\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\n\t\t\t\t\tif (patch.logins !== undefined) {\n\t\t\t\t\t\tawait tx.delete(tables.logins).where(eq(tables.logins.userId, id));\n\t\t\t\t\t\tawait claim(tx, 'updateUser', row, patch.logins);\n\t\t\t\t\t}\n\t\t\t\t\treturn toUser(row);\n\t\t\t\t}),\n\t\t\t),\n\n\t\tdeleteUser: (id) =>\n\t\t\trun$('deleteUser', async () => {\n\t\t\t\t// The logins go with it: their foreign key cascades.\n\t\t\t\tconst deleted = await db\n\t\t\t\t\t.delete(tables.users)\n\t\t\t\t\t.where(eq(tables.users.id, id))\n\t\t\t\t\t.returning({ id: tables.users.id });\n\t\t\t\treturn deleted.length === 1;\n\t\t\t}),\n\t};\n}\n\nfunction sessionStore(db: PgDatabase, tables: IdentityTables): SessionStore {\n\tconst run$ = <T>(operation: string, body: () => Promise<T>) =>\n\t\trun('sessions', operation, body);\n\n\treturn {\n\t\tinsertSession: (record) =>\n\t\t\trun$('insertSession', async () => {\n\t\t\t\t// Idempotent under retry: a session with this id is already there.\n\t\t\t\t// A collision on the token hash is not a retry, and fails.\n\t\t\t\tawait db\n\t\t\t\t\t.insert(tables.sessions)\n\t\t\t\t\t.values(record)\n\t\t\t\t\t.onConflictDoNothing({ target: tables.sessions.id });\n\t\t\t}),\n\n\t\tfindSessionByTokenHash: (tokenHash) =>\n\t\t\trun$('findSessionByTokenHash', async () => {\n\t\t\t\tconst [row] = await db\n\t\t\t\t\t.select()\n\t\t\t\t\t.from(tables.sessions)\n\t\t\t\t\t.where(eq(tables.sessions.tokenHash, tokenHash));\n\t\t\t\treturn row === undefined ? null : toSession(row);\n\t\t\t}),\n\n\t\textendSession: (id, expiresAt) =>\n\t\t\trun$('extendSession', async () => {\n\t\t\t\t// `revoked_at is null` in the condition: an extension racing a\n\t\t\t\t// revocation matches nothing, and never brings the session back.\n\t\t\t\tconst [row] = await db\n\t\t\t\t\t.update(tables.sessions)\n\t\t\t\t\t.set({ expiresAt })\n\t\t\t\t\t.where(\n\t\t\t\t\t\tand(eq(tables.sessions.id, id), isNull(tables.sessions.revokedAt)),\n\t\t\t\t\t)\n\t\t\t\t\t.returning();\n\t\t\t\treturn row === undefined ? null : toSession(row);\n\t\t\t}),\n\n\t\trevokeSession: (id, at) =>\n\t\t\trun$('revokeSession', async () => {\n\t\t\t\t// `coalesce`, so a session already revoked keeps its first\n\t\t\t\t// `revokedAt` and still counts as matched.\n\t\t\t\tconst matched = await db\n\t\t\t\t\t.update(tables.sessions)\n\t\t\t\t\t.set({\n\t\t\t\t\t\trevokedAt: sql`coalesce(${tables.sessions.revokedAt}, ${stamp(at)})`,\n\t\t\t\t\t})\n\t\t\t\t\t.where(eq(tables.sessions.id, id))\n\t\t\t\t\t.returning({ id: tables.sessions.id });\n\t\t\t\treturn matched.length === 1;\n\t\t\t}),\n\n\t\trevokeUserSessions: (userId, at, except) =>\n\t\t\trun$('revokeUserSessions', async () => {\n\t\t\t\tconst standing = and(\n\t\t\t\t\teq(tables.sessions.userId, userId),\n\t\t\t\t\tisNull(tables.sessions.revokedAt),\n\t\t\t\t);\n\t\t\t\tconst revoked = await db\n\t\t\t\t\t.update(tables.sessions)\n\t\t\t\t\t.set({ revokedAt: at })\n\t\t\t\t\t.where(\n\t\t\t\t\t\texcept === undefined\n\t\t\t\t\t\t\t? standing\n\t\t\t\t\t\t\t: and(standing, ne(tables.sessions.id, except)),\n\t\t\t\t\t)\n\t\t\t\t\t.returning({ id: tables.sessions.id });\n\t\t\t\treturn revoked.length;\n\t\t\t}),\n\n\t\tdeleteUserSessions: (userId) =>\n\t\t\trun$('deleteUserSessions', async () => {\n\t\t\t\tconst deleted = await db\n\t\t\t\t\t.delete(tables.sessions)\n\t\t\t\t\t.where(eq(tables.sessions.userId, userId))\n\t\t\t\t\t.returning({ id: tables.sessions.id });\n\t\t\t\treturn deleted.length;\n\t\t\t}),\n\n\t\tdeleteExpiredSessions: (before) =>\n\t\t\trun$('deleteExpiredSessions', async () => {\n\t\t\t\tconst deleted = await db\n\t\t\t\t\t.delete(tables.sessions)\n\t\t\t\t\t.where(lte(tables.sessions.expiresAt, before))\n\t\t\t\t\t.returning({ id: tables.sessions.id });\n\t\t\t\treturn deleted.length;\n\t\t\t}),\n\t};\n}\n\nfunction tokenStore(db: PgDatabase, tables: IdentityTables): TokenStore {\n\tconst run$ = <T>(operation: string, body: () => Promise<T>) =>\n\t\trun('tokens', operation, body);\n\n\treturn {\n\t\tinsertToken: (record) =>\n\t\t\trun$('insertToken', async () => {\n\t\t\t\t// The hash is the key: a collision is a retry.\n\t\t\t\tawait db.insert(tables.tokens).values(record).onConflictDoNothing();\n\t\t\t}),\n\n\t\tconsumeToken: (tokenHash, kind, at) =>\n\t\t\trun$('consumeToken', async () => {\n\t\t\t\t// **One conditional write**, answering the row as it was before\n\t\t\t\t// it. `for update` makes a concurrent call wait for this one and\n\t\t\t\t// then read the spent row, so exactly one caller ever reads\n\t\t\t\t// `spentAt: null`; `coalesce` keeps a first `spentAt`.\n\t\t\t\tconst before = db.$with('before').as(\n\t\t\t\t\tdb\n\t\t\t\t\t\t.select()\n\t\t\t\t\t\t.from(tables.tokens)\n\t\t\t\t\t\t.where(\n\t\t\t\t\t\t\tand(\n\t\t\t\t\t\t\t\teq(tables.tokens.tokenHash, tokenHash),\n\t\t\t\t\t\t\t\teq(tables.tokens.kind, kind),\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t)\n\t\t\t\t\t\t.for('update'),\n\t\t\t\t);\n\t\t\t\tconst [spent] = await db\n\t\t\t\t\t.with(before)\n\t\t\t\t\t.update(tables.tokens)\n\t\t\t\t\t.set({\n\t\t\t\t\t\tspentAt: sql`coalesce(${tables.tokens.spentAt}, ${stamp(at)})`,\n\t\t\t\t\t})\n\t\t\t\t\t.from(before)\n\t\t\t\t\t.where(eq(tables.tokens.tokenHash, before.tokenHash))\n\t\t\t\t\t.returning({\n\t\t\t\t\t\ttokenHash: before.tokenHash,\n\t\t\t\t\t\tkind: before.kind,\n\t\t\t\t\t\tuserId: before.userId,\n\t\t\t\t\t\taddress: before.address,\n\t\t\t\t\t\texpiresAt: before.expiresAt,\n\t\t\t\t\t\tspentAt: before.spentAt,\n\t\t\t\t\t\tcreatedAt: before.createdAt,\n\t\t\t\t\t});\n\t\t\t\treturn spent === undefined\n\t\t\t\t\t? null\n\t\t\t\t\t: { ...spent, userId: spent.userId as Id };\n\t\t\t}),\n\n\t\tdeleteUserTokens: (userId) =>\n\t\t\trun$('deleteUserTokens', async () => {\n\t\t\t\tconst deleted = await db\n\t\t\t\t\t.delete(tables.tokens)\n\t\t\t\t\t.where(eq(tables.tokens.userId, userId))\n\t\t\t\t\t.returning({ tokenHash: tables.tokens.tokenHash });\n\t\t\t\treturn deleted.length;\n\t\t\t}),\n\t};\n}\n\n// ─── Rows and records ─────────────────────────────────────────────────────\n//\n// Each record is rebuilt field by field: the port's records are exactly what\n// it declares, and a row carries columns the record names differently.\n\nfunction toUserRow(record: UserRecord): UserInsert {\n\treturn {\n\t\tid: record.id,\n\t\ttype: record.type,\n\t\tschemaVersion: record.schemaVersion,\n\t\tactive: record.active,\n\t\tfields: record.fields,\n\t\tlogins: [...record.logins],\n\t\tpasswordHash: record.password?.hash ?? null,\n\t\tpasswordUpdatedAt: record.password?.updatedAt ?? null,\n\t\temailVerifiedAt: record.emailVerifiedAt,\n\t\tversion: record.version,\n\t\tcreatedAt: record.createdAt,\n\t\tupdatedAt: record.updatedAt,\n\t};\n}\n\n/**\n * The columns a patch names. A key present with `undefined` is absent, as the\n * port says — never an erasure. `password: null` is named, and removes the\n * password.\n */\nfunction toUserSet(patch: UserPatch): Partial<UserInsert> {\n\tconst set: Partial<UserInsert> = {\n\t\tupdatedAt: patch.updatedAt,\n\t};\n\tif (patch.schemaVersion !== undefined)\n\t\tset.schemaVersion = patch.schemaVersion;\n\tif (patch.active !== undefined) set.active = patch.active;\n\tif (patch.fields !== undefined) set.fields = patch.fields;\n\tif (patch.logins !== undefined) set.logins = [...patch.logins];\n\tif (patch.emailVerifiedAt !== undefined)\n\t\tset.emailVerifiedAt = patch.emailVerifiedAt;\n\tif (patch.password !== undefined) {\n\t\tset.passwordHash = patch.password?.hash ?? null;\n\t\tset.passwordUpdatedAt = patch.password?.updatedAt ?? null;\n\t}\n\treturn set;\n}\n\nfunction toUser(row: UserRow): UserRecord {\n\treturn {\n\t\tid: row.id as Id,\n\t\ttype: row.type,\n\t\tschemaVersion: row.schemaVersion,\n\t\tactive: row.active,\n\t\tfields: row.fields as UserRecord['fields'],\n\t\tlogins: [...row.logins],\n\t\tpassword:\n\t\t\trow.passwordHash === null || row.passwordUpdatedAt === null\n\t\t\t\t? null\n\t\t\t\t: { hash: row.passwordHash, updatedAt: row.passwordUpdatedAt },\n\t\temailVerifiedAt: row.emailVerifiedAt,\n\t\tversion: row.version,\n\t\tcreatedAt: row.createdAt,\n\t\tupdatedAt: row.updatedAt,\n\t};\n}\n\nfunction toSession(row: SessionRow): SessionRecord {\n\treturn {\n\t\tid: row.id,\n\t\ttokenHash: row.tokenHash,\n\t\tuserId: row.userId as Id,\n\t\tauthenticatedAt: row.authenticatedAt,\n\t\texpiresAt: row.expiresAt,\n\t\trevokedAt: row.revokedAt,\n\t\tcreatedAt: row.createdAt,\n\t};\n}\n\n/**\n * A `Date` inside a `sql` template, as every driver takes it: `timestamptz`\n * from its ISO string. Drizzle's column mapping does not reach a raw\n * template, and postgres.js refuses a `Date` object there.\n */\nfunction stamp(at: Date): SQL {\n\treturn sql`${at.toISOString()}::timestamptz`;\n}\n",
+    "import type { PgDatabase } from '@nxgt/drizzle/pg';\nimport type { JanusStores } from '@nxgt/janus';\nimport type { RelationStore } from '@nxgt/janus/permissions';\nimport { createDrizzleRelations } from './relations';\nimport { createDrizzleStores } from './stores';\nimport type { DrizzleAdapterOptions } from './tables';\n\n/** The whole adapter over one database, keyed as `janus()` takes it. */\nexport interface DrizzleAdapter {\n\t/** The identity stores: `createDrizzleStores(db)`. */\n\treadonly store: JanusStores;\n\t/** The relation store: `createDrizzleRelations(db)`. */\n\treadonly relations: RelationStore;\n}\n\n/**\n * The identity stores and the relation store over one database, under the\n * names `janus()` takes them — so one spread wires both, and deleting a user\n * deletes every tuple naming them:\n *\n * ```ts\n * const postgres = createDrizzleAdapter(db);\n * const auth = janus({ user, password: { login: 'email' }, hasher, ...postgres });\n * const access = permissions({ model, store: postgres.relations });\n * ```\n *\n * It connects to nothing and creates nothing: `db` is your Drizzle instance,\n * and the tables are your migrations'. `{ tables }` is what your schema file\n * exports, needed when they are in a PostgreSQL schema of their own. An\n * application that only authenticates can take `createDrizzleStores(db)` alone.\n */\nexport function createDrizzleAdapter(\n\tdb: PgDatabase,\n\toptions: DrizzleAdapterOptions = {},\n): DrizzleAdapter {\n\treturn {\n\t\tstore: createDrizzleStores(db, options),\n\t\trelations: createDrizzleRelations(db, options),\n\t};\n}\n"
+  ],
+  "mappings": ";AAAA;AACA;AAAA;AAAA;AAQA;;;ACTA;AACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAsDA,IAAM,MAAM,WAAiD;AAAA,EAC5D,UAAU,MAAM;AACjB,CAAC;AAKD,IAAM,KAAK,CAAC,SACX,UAAU,MAAM,EAAE,cAAc,MAAM,WAAW,EAAE,CAAC;AAiB9C,SAAS,iBAAiB,CAAC,UAA8B,CAAC,GAAG;AAAA,EACnE,QAAQ,WAAW;AAAA,EACnB,MAAM,QACL,WAAW,YAAY,UAAU,OAAO;AAAA,EAOzC,MAAM,QAAQ,MACb,SACA;AAAA,IAEC,IAAI,IAAI,IAAI,EAAE,WAAW;AAAA,IACzB,MAAM,IAAI,MAAM,EAAE,QAAQ;AAAA,IAC1B,eAAe,KAAK,gBAAgB,EAAE,QAAQ;AAAA,IAC9C,QAAQ,QAAQ,QAAQ,EAAE,QAAQ;AAAA,IAElC,QAAQ,MAAM,QAAQ,EAAE,QAAQ;AAAA,IAChC,QAAQ,KAAK,QAAQ,EAAE,MAAM,EAAE,QAAQ;AAAA,IACvC,cAAc,KAAK,eAAe;AAAA,IAClC,mBAAmB,GAAG,qBAAqB;AAAA,IAC3C,iBAAiB,GAAG,mBAAmB;AAAA,IACvC,SAAS,QAAQ,SAAS,EAAE,QAAQ;AAAA,IACpC,WAAW,GAAG,YAAY,EAAE,QAAQ;AAAA,IACpC,WAAW,GAAG,YAAY,EAAE,QAAQ;AAAA,EACrC,GACA,CAAC,MAAM;AAAA,IAEN,OAAO,sBAAsB,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI;AAAA,IAE9C,MAAM,eAAe,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;AAAA,IAEtC,MACC,wBACA,OAAO,EAAE,4BAA4B,EAAE,4BACxC;AAAA,EACD,CACD;AAAA,EASA,MAAM,SAAS,MACd,UACA;AAAA,IACC,MAAM,IAAI,MAAM,EAAE,QAAQ;AAAA,IAC1B,OAAO,IAAI,OAAO,EAAE,QAAQ;AAAA,IAC5B,QAAQ,IAAI,SAAS,EAAE,QAAQ;AAAA,EAChC,GACA,CAAC,MAAM;AAAA,IACN,WAAW,EAAE,MAAM,eAAe,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAAA,IAC9D,WAAW;AAAA,MACV,MAAM;AAAA,MACN,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAI;AAAA,MAC1B,gBAAgB,CAAC,MAAM,IAAI,MAAM,IAAI;AAAA,IACtC,CAAC,EAAE,SAAS,SAAS;AAAA,IACrB,MAAM,gBAAgB,EAAE,GAAG,EAAE,MAAM;AAAA,EACpC,CACD;AAAA,EAOA,MAAM,WAAW,MAChB,YACA;AAAA,IACC,IAAI,IAAI,IAAI,EAAE,WAAW;AAAA,IAEzB,WAAW,IAAI,YAAY,EAAE,QAAQ;AAAA,IACrC,QAAQ,IAAI,SAAS,EAAE,QAAQ;AAAA,IAC/B,iBAAiB,GAAG,kBAAkB,EAAE,QAAQ;AAAA,IAChD,WAAW,GAAG,YAAY,EAAE,QAAQ;AAAA,IACpC,WAAW,GAAG,YAAY;AAAA,IAC1B,WAAW,GAAG,YAAY,EAAE,QAAQ;AAAA,EACrC,GACA,CAAC,MAAM;AAAA,IACN,OAAO,4BAA4B,EAAE,GAAG,EAAE,SAAS;AAAA,IACnD,MAAM,kBAAkB,EAAE,GAAG,EAAE,MAAM;AAAA,IAErC,MAAM,qBAAqB,EAAE,GAAG,EAAE,SAAS;AAAA,EAC5C,CACD;AAAA,EAGA,MAAM,SAAS,MACd,UACA;AAAA,IACC,WAAW,IAAI,YAAY,EAAE,WAAW;AAAA,IACxC,MAAM,KAAK,QAAQ,EAAE,MAAM,CAAC,eAAe,eAAe,EAAE,CAAC,EAAE,QAAQ;AAAA,IACvE,QAAQ,IAAI,SAAS,EAAE,QAAQ;AAAA,IAC/B,SAAS,KAAK,SAAS,EAAE,QAAQ;AAAA,IACjC,WAAW,GAAG,YAAY,EAAE,QAAQ;AAAA,IACpC,SAAS,GAAG,UAAU;AAAA,IACtB,WAAW,GAAG,YAAY,EAAE,QAAQ;AAAA,EACrC,GACA,CAAC,MAAM;AAAA,IACN,MAAM,eAAe,MAAM,EAAE,0CAA0C;AAAA,IACvE,MAAM,gBAAgB,EAAE,GAAG,EAAE,MAAM;AAAA,EACpC,CACD;AAAA,EAYA,MAAM,YAAY,MACjB,aACA;AAAA,IACC,YAAY,IAAI,aAAa,EAAE,QAAQ;AAAA,IACvC,UAAU,IAAI,WAAW,EAAE,QAAQ;AAAA,IACnC,UAAU,IAAI,UAAU,EAAE,QAAQ;AAAA,IAClC,aAAa,IAAI,cAAc,EAAE,QAAQ;AAAA,IACzC,WAAW,IAAI,YAAY,EAAE,QAAQ;AAAA,IACrC,iBAAiB,IAAI,kBAAkB;AAAA,EACxC,GACA,CAAC,MAAM;AAAA,IACN,OAAO,wBAAwB,EAC7B,GACA,EAAE,aACF,EAAE,WACF,EAAE,iBACF,EAAE,UACF,EAAE,YACF,EAAE,QACH,EACC,iBAAiB;AAAA,IAEnB,MAAM,kBAAkB,EAAE,GAAG,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ;AAAA,EAClE,CACD;AAAA,EAEA,OAAO,EAAE,OAAO,QAAQ,UAAU,QAAQ,UAAU;AAAA;;;ACjOrD;AACA;AA8BA,eAAsB,GAAM,CAC3B,MACA,WACA,MACa;AAAA,EACb,IAAI;AAAA,IACH,OAAO,MAAM,KAAK;AAAA,IACjB,OAAO,OAAO;AAAA,IAEf,IAAI,iBAAiB;AAAA,MAAY,MAAM;AAAA,IACvC,MAAM,IAAI,aAAa,GAAG,QAAQ,yCAAyC;AAAA,MAC1E;AAAA,MACA;AAAA,MACA,OAAO,YAAY,KAAK;AAAA,IACzB,CAAC;AAAA;AAAA;AAKI,SAAS,UAAU,CACzB,WACA,MACA,OACgB;AAAA,EAChB,OAAO,IAAI,cACV,SACA,GAAG,4CAA4C,QAC/C,EAAE,OAAO,UAAU,MAAM,UAAU,CACpC;AAAA;;;AF7BM,SAAS,sBAAsB,CACrC,IACA,UAA8C,CAAC,GAC/B;AAAA,EAChB,MAAM,SAAS,QAAQ,UAAU,kBAAkB;AAAA,EACnD,QAAQ,OAAO,WAAW,aAAa,SAAS,OAAO,SAAS;AAAA,EAChE,MAAM,OAAO,CAAI,WAAmB,SACnC,IAAI,aAAa,WAAW,IAAI;AAAA,EAGjC,MAAM,UAAU,CAAC,QAAgB,UAAkB,SAClD,GACE,OAAO;AAAA,IACP,MAAM,OAAO,UAAU;AAAA,IACvB,IAAI,OAAO,UAAU;AAAA,IACrB,UAAU,OAAO,UAAU;AAAA,EAC5B,CAAC,EACA,KAAK,OAAO,SAAS,EACrB,MACA,IACC,GAAG,OAAO,UAAU,YAAY,OAAO,IAAI,GAC3C,GAAG,OAAO,UAAU,UAAU,OAAO,EAAE,GACvC,GAAG,OAAO,UAAU,UAAU,QAAQ,GACtC,OACG,UAAU,OAAO,UAAU,eAAe,IAC1C,OAAO,OAAO,UAAU,eAAe,CAC3C,CACD;AAAA,EAEF,MAAM,QAAQ,OACb,IACA,KACA,WACI;AAAA,IAGJ,WAAW,SAAS,QAAQ,MAAM,GAAG;AAAA,MACpC,MAAM,GAAG,OAAO,OAAO,SAAS,EAAE,MAAM,SAAS,KAAK,CAAC;AAAA,IACxD;AAAA,IACA,IAAI,IAAI,SAAS,GAAG;AAAA,MAEnB,MAAM,GACJ,OAAO,OAAO,SAAS,EACvB,OAAO,QAAQ,GAAG,EAAE,IAAI,KAAK,CAAC,EAC9B,oBAAoB;AAAA,IACvB;AAAA;AAAA,EAGD,OAAO;AAAA,IACN,OAAO,GAAG,MAAM,CAAC,GAAG,SAAS,CAAC,QAC7B,KAAK,SAAS,YAAY;AAAA,MACzB,IAAI,IAAI,SAAS,OAAO,UAAU;AAAA,QAAG,OAAO,MAAM,IAAI,KAAK,MAAM;AAAA,MACjE,MAAM,gBAAgB,IAAI,CAAC,OAAO,MAAM,IAAI,KAAK,MAAM,CAAC;AAAA,KACxD;AAAA,IAEF,KAAK,CAAC,UACL,KAAK,OAAO,YAAY;AAAA,MACvB,MAAM,QAAQ,MAAM,GAClB,OAAO,EAAE,UAAU,OAAO,UAAU,SAAS,CAAC,EAC9C,KAAK,OAAO,SAAS,EACrB,MAAM,SAAS,KAAK,CAAC,EACrB,MAAM,CAAC;AAAA,MACT,OAAO,MAAM,WAAW;AAAA,KACxB;AAAA,IAEF,iBAAiB,CAAC,QAAQ,aACzB,KAAK,mBAAmB,aACtB,MAAM,QAAQ,QAAQ,UAAU,IAAI,GAAG,IACvC,CAAC,SAAqB;AAAA,MACrB,MAAM,IAAI;AAAA,MACV,IAAI,IAAI;AAAA,MACR,UAAU,IAAI,YAAY;AAAA,IAC3B,EACD,CACD;AAAA,IAED,cAAc,CAAC,QAAQ,aACtB,KAAK,gBAAgB,aACnB,MAAM,QAAQ,QAAQ,UAAU,KAAK,GAAG,IACxC,CAAC,SAAiB,EAAE,MAAM,IAAI,MAAM,IAAI,IAAI,GAAG,EAChD,CACD;AAAA,IAED,aAAa,GAAG,MAAM,UAAU,SAAS,OAAO,YAC/C,KAAK,eAAe,YAAY;AAAA,MAC/B,MAAM,aAAa;AAAA,QAClB,UAAU,OAAO;AAAA,QACjB,GAAG,OAAO,UAAU,UAAU,QAAQ;AAAA,QACtC,GAAG,OAAO,UAAU,YAAY,IAAI;AAAA,MACrC;AAAA,MACA,IAAI,UAAU;AAAA,QACb,WAAW,KAAK,GAAG,OAAO,UAAU,UAAU,KAAK,CAAC;AAAA,MACrD,MAAM,QAAQ,MAAM,GAClB,OAAO,EAAE,IAAI,OAAO,UAAU,SAAS,CAAC,EACxC,KAAK,OAAO,SAAS,EACrB,MAAM,IAAI,GAAG,UAAU,CAAC,EACxB,QAAQ,IAAI,OAAO,UAAU,QAAQ,CAAC,EACtC,MAAM,QAAQ,CAAC;AAAA,MACjB,MAAM,QAAQ,MAAM,MAAM,GAAG,KAAK,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE;AAAA,MACvD,MAAM,OAAO,MAAM,GAAG,EAAE;AAAA,MACxB,OAAO;AAAA,QACN;AAAA,QACA,YAAY,MAAM,SAAS,SAAS,SAAS,YAAY,OAAO;AAAA,MACjE;AAAA,KACA;AAAA,IAEF,cAAc,CAAC,WACd,KAAK,gBAAgB,YAAY;AAAA,MAChC,MAAM,UAAU,MAAM,GACpB,OAAO,OAAO,SAAS,EACvB,MACA,GACC,IACC,GAAG,OAAO,UAAU,YAAY,OAAO,IAAI,GAC3C,GAAG,OAAO,UAAU,UAAU,OAAO,EAAE,CACxC,GACA,IACC,GAAG,OAAO,UAAU,aAAa,OAAO,IAAI,GAC5C,GAAG,OAAO,UAAU,WAAW,OAAO,EAAE,CACzC,CACD,CACD,EACC,UAAU,EAAE,UAAU,OAAO,UAAU,SAAS,CAAC;AAAA,MACnD,OAAO,QAAQ;AAAA,KACf;AAAA,EACH;AAAA;AAID,SAAS,OAAO,CAAC,QAA4D;AAAA,EAC5E,MAAM,QAAQ,CAAC,UACd,KAAK,UAAU;AAAA,IACd,MAAM,OAAO;AAAA,IACb,MAAM,OAAO;AAAA,IACb,MAAM;AAAA,IACN,MAAM,QAAQ;AAAA,IACd,MAAM,QAAQ;AAAA,IACd,aAAa,MAAM,OAAO,IAAI,MAAM,QAAQ,WAAW;AAAA,EACxD,CAAC;AAAA,EACF,OAAO,CAAC,GAAG,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM;AAAA,IACjC,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC;AAAA,IAClC,OAAO,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI;AAAA,GAChC;AAAA;AAMF,SAAS,QAAQ,CAAC,WAAsB;AAAA,EAEvC,SAAS,KAAK,CAAC,OAAiD;AAAA,IAC/D,OAAO;AAAA,MACN,YAAY,MAAM,OAAO;AAAA,MACzB,UAAU,MAAM,OAAO;AAAA,MACvB,UAAU,MAAM;AAAA,MAChB,aAAa,MAAM,QAAQ;AAAA,MAC3B,WAAW,MAAM,QAAQ;AAAA,MACzB,iBAAiB,aAAa,MAAM,OAAO,IACxC,MAAM,QAAQ,WACd;AAAA,IACJ;AAAA;AAAA,EAID,SAAS,SAAS,CAAC,SAAmC;AAAA,IACrD,OAAO,IACN,GAAG,UAAU,aAAa,QAAQ,IAAI,GACtC,GAAG,UAAU,WAAW,QAAQ,EAAE,GAClC,aAAa,OAAO,IACjB,GAAG,UAAU,iBAAiB,QAAQ,QAAQ,IAC9C,OAAO,UAAU,eAAe,CACpC;AAAA;AAAA,EAID,SAAS,QAAQ,CAAC,OAAuC;AAAA,IACxD,OAAO,IACN,GAAG,UAAU,YAAY,MAAM,OAAO,IAAI,GAC1C,GAAG,UAAU,UAAU,MAAM,OAAO,EAAE,GACtC,GAAG,UAAU,UAAU,MAAM,QAAQ,GACrC,UAAU,MAAM,OAAO,CACxB;AAAA;AAAA,EAGD,OAAO,EAAE,OAAO,WAAW,SAAS;AAAA;;;AGtNrC,4BAA0B;AAW1B,yCAAwB;AACxB,gBAAS,aAAK,YAAK,WAAI,eAAI,yBAA2B;AAuC/C,SAAS,mBAAmB,CAClC,IACA,UAAgD,CAAC,GACnC;AAAA,EACd,MAAM,SAAS,QAAQ,UAAU,kBAAkB;AAAA,EACnD,OAAO;AAAA,IACN,OAAO,UAAU,IAAI,MAAM;AAAA,IAC3B,UAAU,aAAa,IAAI,MAAM;AAAA,IACjC,QAAQ,WAAW,IAAI,MAAM;AAAA,EAC9B;AAAA;AAGD,SAAS,SAAS,CAAC,IAAgB,QAAmC;AAAA,EACrE,MAAM,OAAO,CAAI,WAAmB,SACnC,IAAI,SAAS,WAAW,IAAI;AAAA,EAE7B,MAAM,OAAO,OAAO,OAAe;AAAA,IAClC,OAAO,OAAO,MAAM,GAClB,OAAO,EACP,KAAK,OAAO,KAAK,EACjB,MAAM,IAAG,OAAO,MAAM,IAAI,EAAE,CAAC;AAAA,IAC/B,OAAO,QAAQ,YAAY,OAAO,OAAO,GAAG;AAAA;AAAA,EAS7C,MAAM,QAAQ,OACb,IACA,WACA,MACA,WACI;AAAA,IAGJ,MAAM,WAAW,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,EAAE,KAAK;AAAA,IAC3C,IAAI,SAAS,WAAW;AAAA,MAAG;AAAA,IAC3B,MAAM,UAAU,MAAM,GACpB,OAAO,OAAO,MAAM,EACpB,OACA,SAAS,IAAI,CAAC,WAAW,EAAE,MAAM,KAAK,MAAM,OAAO,QAAQ,KAAK,GAAG,EAAE,CACtE,EACC,oBAAoB,EACpB,UAAU,EAAE,OAAO,OAAO,OAAO,MAAM,CAAC;AAAA,IAC1C,IAAI,QAAQ,WAAW,SAAS;AAAA,MAAQ;AAAA,IACxC,MAAM,UAAU,IAAI,IAAI,QAAQ,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC;AAAA,IACvD,MAAM,QAAQ,SAAS,KAAK,CAAC,UAAU,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK;AAAA,IAC/D,MAAM,WAAW,WAAW,KAAK,MAAM,KAAK;AAAA;AAAA,EAG7C,OAAO;AAAA,IACN,YAAY,CAAC,WACZ,KAAK,cAAc,YAAY;AAAA,MAC9B,MAAM,WAAW,MAAM,iBAAgB,IAAI,OAAO,OAAO;AAAA,QACxD,OAAO,OAAO,MAAM,GAClB,OAAO,OAAO,KAAK,EACnB,OAAO,UAAU,MAAM,CAAC,EACxB,oBAAoB,EAAE,QAAQ,OAAO,MAAM,GAAG,CAAC,EAC/C,UAAU;AAAA,QACZ,IAAI,QAAQ;AAAA,UAAW,OAAO;AAAA,QAC9B,MAAM,MAAM,IAAI,cAAc,QAAQ,OAAO,MAAM;AAAA,QACnD,OAAO,OAAO,GAAG;AAAA,OACjB;AAAA,MACD,IAAI,aAAa;AAAA,QAAM,OAAO;AAAA,MAI9B,MAAM,SAAS,MAAM,KAAK,OAAO,EAAE;AAAA,MACnC,IAAI,WAAW;AAAA,QAAM,OAAO;AAAA,MAE5B,MAAM,IAAI,cAAc,8CAA8C;AAAA,QACrE,QAAQ,OAAO;AAAA,QACf,WAAW;AAAA,MACZ,CAAC;AAAA,KACD;AAAA,IAEF,UAAU,CAAC,OAAO,KAAK,YAAY,MAAM,KAAK,EAAE,CAAC;AAAA,IAEjD,iBAAiB,CAAC,MAAM,UACvB,KAAK,mBAAmB,YAAY;AAAA,MACnC,OAAO,OAAO,MAAM,GAClB,OAAO,EAAE,MAAM,OAAO,MAAM,CAAC,EAC7B,KAAK,OAAO,MAAM,EAClB,UAAU,OAAO,OAAO,IAAG,OAAO,MAAM,IAAI,OAAO,OAAO,MAAM,CAAC,EACjE,MACA,KAAI,IAAG,OAAO,OAAO,MAAM,IAAI,GAAG,IAAG,OAAO,OAAO,OAAO,KAAK,CAAC,CACjE;AAAA,MACD,OAAO,QAAQ,YAAY,OAAO,OAAO,IAAI,IAAI;AAAA,KACjD;AAAA,IAEF,WAAW,GAAG,MAAM,OAAO,YAC1B,KAAK,aAAa,YAAY;AAAA,MAE7B,MAAM,QAAQ,MAAM,GAClB,OAAO,EACP,KAAK,OAAO,KAAK,EACjB,MACA,UAAU,OACP,IAAG,OAAO,MAAM,MAAM,IAAI,IAC1B,KAAI,IAAG,OAAO,MAAM,MAAM,IAAI,GAAG,IAAG,OAAO,MAAM,IAAI,KAAK,CAAC,CAC/D,EACC,QAAQ,KAAI,OAAO,MAAM,EAAE,CAAC,EAC5B,MAAM,QAAQ,CAAC;AAAA,MACjB,MAAM,QAAQ,MAAM,MAAM,GAAG,KAAK,EAAE,IAAI,MAAM;AAAA,MAC9C,MAAM,OAAO,MAAM,GAAG,EAAE;AAAA,MACxB,OAAO;AAAA,QACN;AAAA,QACA,YACC,MAAM,SAAS,SAAS,SAAS,YAAY,KAAK,KAAK;AAAA,MACzD;AAAA,KACA;AAAA,IAEF,YAAY,CAAC,IAAI,OAAO,cACvB,KAAK,cAAc,MAClB,iBAAgB,IAAI,OAAO,OAAO;AAAA,MACjC,OAAO,OAAO,MAAM,GAClB,OAAO,OAAO,KAAK,EACnB,IAAI;AAAA,WACD,UAAU,KAAK;AAAA,QAClB,SAAS,OAAM,OAAO,MAAM;AAAA,MAC7B,CAAC,EACA,MACA,KAAI,IAAG,OAAO,MAAM,IAAI,EAAE,GAAG,IAAG,OAAO,MAAM,SAAS,SAAS,CAAC,CACjE,EACC,UAAU;AAAA,MAEZ,IAAI,QAAQ,WAAW;AAAA,QAGtB,OAAO,UAAU,MAAM,GACrB,OAAO,EAAE,SAAS,OAAO,MAAM,QAAQ,CAAC,EACxC,KAAK,OAAO,KAAK,EACjB,MAAM,IAAG,OAAO,MAAM,IAAI,EAAE,CAAC;AAAA,QAC/B,IAAI,WAAW,WAAW;AAAA,UACzB,MAAM,IAAI,cAAc,mCAAmC;AAAA,YAC1D,QAAQ;AAAA,YACR,WAAW;AAAA,UACZ,CAAC;AAAA,QACF;AAAA,QACA,MAAM,IAAI,eACT,WACA,gCAAgC,oBAAoB,OAAO,WAC3D;AAAA,UACC,QAAQ;AAAA,UACR,iBAAiB;AAAA,UACjB,eAAe,OAAO;AAAA,UACtB,WAAW;AAAA,QACZ,CACD;AAAA,MACD;AAAA,MAEA,IAAI,MAAM,WAAW,WAAW;AAAA,QAC/B,MAAM,GAAG,OAAO,OAAO,MAAM,EAAE,MAAM,IAAG,OAAO,OAAO,QAAQ,EAAE,CAAC;AAAA,QACjE,MAAM,MAAM,IAAI,cAAc,KAAK,MAAM,MAAM;AAAA,MAChD;AAAA,MACA,OAAO,OAAO,GAAG;AAAA,KACjB,CACF;AAAA,IAED,YAAY,CAAC,OACZ,KAAK,cAAc,YAAY;AAAA,MAE9B,MAAM,UAAU,MAAM,GACpB,OAAO,OAAO,KAAK,EACnB,MAAM,IAAG,OAAO,MAAM,IAAI,EAAE,CAAC,EAC7B,UAAU,EAAE,IAAI,OAAO,MAAM,GAAG,CAAC;AAAA,MACnC,OAAO,QAAQ,WAAW;AAAA,KAC1B;AAAA,EACH;AAAA;AAGD,SAAS,YAAY,CAAC,IAAgB,QAAsC;AAAA,EAC3E,MAAM,OAAO,CAAI,WAAmB,SACnC,IAAI,YAAY,WAAW,IAAI;AAAA,EAEhC,OAAO;AAAA,IACN,eAAe,CAAC,WACf,KAAK,iBAAiB,YAAY;AAAA,MAGjC,MAAM,GACJ,OAAO,OAAO,QAAQ,EACtB,OAAO,MAAM,EACb,oBAAoB,EAAE,QAAQ,OAAO,SAAS,GAAG,CAAC;AAAA,KACpD;AAAA,IAEF,wBAAwB,CAAC,cACxB,KAAK,0BAA0B,YAAY;AAAA,MAC1C,OAAO,OAAO,MAAM,GAClB,OAAO,EACP,KAAK,OAAO,QAAQ,EACpB,MAAM,IAAG,OAAO,SAAS,WAAW,SAAS,CAAC;AAAA,MAChD,OAAO,QAAQ,YAAY,OAAO,UAAU,GAAG;AAAA,KAC/C;AAAA,IAEF,eAAe,CAAC,IAAI,cACnB,KAAK,iBAAiB,YAAY;AAAA,MAGjC,OAAO,OAAO,MAAM,GAClB,OAAO,OAAO,QAAQ,EACtB,IAAI,EAAE,UAAU,CAAC,EACjB,MACA,KAAI,IAAG,OAAO,SAAS,IAAI,EAAE,GAAG,QAAO,OAAO,SAAS,SAAS,CAAC,CAClE,EACC,UAAU;AAAA,MACZ,OAAO,QAAQ,YAAY,OAAO,UAAU,GAAG;AAAA,KAC/C;AAAA,IAEF,eAAe,CAAC,IAAI,OACnB,KAAK,iBAAiB,YAAY;AAAA,MAGjC,MAAM,UAAU,MAAM,GACpB,OAAO,OAAO,QAAQ,EACtB,IAAI;AAAA,QACJ,WAAW,gBAAe,OAAO,SAAS,cAAc,MAAM,EAAE;AAAA,MACjE,CAAC,EACA,MAAM,IAAG,OAAO,SAAS,IAAI,EAAE,CAAC,EAChC,UAAU,EAAE,IAAI,OAAO,SAAS,GAAG,CAAC;AAAA,MACtC,OAAO,QAAQ,WAAW;AAAA,KAC1B;AAAA,IAEF,oBAAoB,CAAC,QAAQ,IAAI,WAChC,KAAK,sBAAsB,YAAY;AAAA,MACtC,MAAM,WAAW,KAChB,IAAG,OAAO,SAAS,QAAQ,MAAM,GACjC,QAAO,OAAO,SAAS,SAAS,CACjC;AAAA,MACA,MAAM,UAAU,MAAM,GACpB,OAAO,OAAO,QAAQ,EACtB,IAAI,EAAE,WAAW,GAAG,CAAC,EACrB,MACA,WAAW,YACR,WACA,KAAI,UAAU,GAAG,OAAO,SAAS,IAAI,MAAM,CAAC,CAChD,EACC,UAAU,EAAE,IAAI,OAAO,SAAS,GAAG,CAAC;AAAA,MACtC,OAAO,QAAQ;AAAA,KACf;AAAA,IAEF,oBAAoB,CAAC,WACpB,KAAK,sBAAsB,YAAY;AAAA,MACtC,MAAM,UAAU,MAAM,GACpB,OAAO,OAAO,QAAQ,EACtB,MAAM,IAAG,OAAO,SAAS,QAAQ,MAAM,CAAC,EACxC,UAAU,EAAE,IAAI,OAAO,SAAS,GAAG,CAAC;AAAA,MACtC,OAAO,QAAQ;AAAA,KACf;AAAA,IAEF,uBAAuB,CAAC,WACvB,KAAK,yBAAyB,YAAY;AAAA,MACzC,MAAM,UAAU,MAAM,GACpB,OAAO,OAAO,QAAQ,EACtB,MAAM,IAAI,OAAO,SAAS,WAAW,MAAM,CAAC,EAC5C,UAAU,EAAE,IAAI,OAAO,SAAS,GAAG,CAAC;AAAA,MACtC,OAAO,QAAQ;AAAA,KACf;AAAA,EACH;AAAA;AAGD,SAAS,UAAU,CAAC,IAAgB,QAAoC;AAAA,EACvE,MAAM,OAAO,CAAI,WAAmB,SACnC,IAAI,UAAU,WAAW,IAAI;AAAA,EAE9B,OAAO;AAAA,IACN,aAAa,CAAC,WACb,KAAK,eAAe,YAAY;AAAA,MAE/B,MAAM,GAAG,OAAO,OAAO,MAAM,EAAE,OAAO,MAAM,EAAE,oBAAoB;AAAA,KAClE;AAAA,IAEF,cAAc,CAAC,WAAW,MAAM,OAC/B,KAAK,gBAAgB,YAAY;AAAA,MAKhC,MAAM,SAAS,GAAG,MAAM,QAAQ,EAAE,GACjC,GACE,OAAO,EACP,KAAK,OAAO,MAAM,EAClB,MACA,KACC,IAAG,OAAO,OAAO,WAAW,SAAS,GACrC,IAAG,OAAO,OAAO,MAAM,IAAI,CAC5B,CACD,EACC,IAAI,QAAQ,CACf;AAAA,MACA,OAAO,SAAS,MAAM,GACpB,KAAK,MAAM,EACX,OAAO,OAAO,MAAM,EACpB,IAAI;AAAA,QACJ,SAAS,gBAAe,OAAO,OAAO,YAAY,MAAM,EAAE;AAAA,MAC3D,CAAC,EACA,KAAK,MAAM,EACX,MAAM,IAAG,OAAO,OAAO,WAAW,OAAO,SAAS,CAAC,EACnD,UAAU;AAAA,QACV,WAAW,OAAO;AAAA,QAClB,MAAM,OAAO;AAAA,QACb,QAAQ,OAAO;AAAA,QACf,SAAS,OAAO;AAAA,QAChB,WAAW,OAAO;AAAA,QAClB,SAAS,OAAO;AAAA,QAChB,WAAW,OAAO;AAAA,MACnB,CAAC;AAAA,MACF,OAAO,UAAU,YACd,OACA,KAAK,OAAO,QAAQ,MAAM,OAAa;AAAA,KAC1C;AAAA,IAEF,kBAAkB,CAAC,WAClB,KAAK,oBAAoB,YAAY;AAAA,MACpC,MAAM,UAAU,MAAM,GACpB,OAAO,OAAO,MAAM,EACpB,MAAM,IAAG,OAAO,OAAO,QAAQ,MAAM,CAAC,EACtC,UAAU,EAAE,WAAW,OAAO,OAAO,UAAU,CAAC;AAAA,MAClD,OAAO,QAAQ;AAAA,KACf;AAAA,EACH;AAAA;AAQD,SAAS,SAAS,CAAC,QAAgC;AAAA,EAClD,OAAO;AAAA,IACN,IAAI,OAAO;AAAA,IACX,MAAM,OAAO;AAAA,IACb,eAAe,OAAO;AAAA,IACtB,QAAQ,OAAO;AAAA,IACf,QAAQ,OAAO;AAAA,IACf,QAAQ,CAAC,GAAG,OAAO,MAAM;AAAA,IACzB,cAAc,OAAO,UAAU,QAAQ;AAAA,IACvC,mBAAmB,OAAO,UAAU,aAAa;AAAA,IACjD,iBAAiB,OAAO;AAAA,IACxB,SAAS,OAAO;AAAA,IAChB,WAAW,OAAO;AAAA,IAClB,WAAW,OAAO;AAAA,EACnB;AAAA;AAQD,SAAS,SAAS,CAAC,OAAuC;AAAA,EACzD,MAAM,MAA2B;AAAA,IAChC,WAAW,MAAM;AAAA,EAClB;AAAA,EACA,IAAI,MAAM,kBAAkB;AAAA,IAC3B,IAAI,gBAAgB,MAAM;AAAA,EAC3B,IAAI,MAAM,WAAW;AAAA,IAAW,IAAI,SAAS,MAAM;AAAA,EACnD,IAAI,MAAM,WAAW;AAAA,IAAW,IAAI,SAAS,MAAM;AAAA,EACnD,IAAI,MAAM,WAAW;AAAA,IAAW,IAAI,SAAS,CAAC,GAAG,MAAM,MAAM;AAAA,EAC7D,IAAI,MAAM,oBAAoB;AAAA,IAC7B,IAAI,kBAAkB,MAAM;AAAA,EAC7B,IAAI,MAAM,aAAa,WAAW;AAAA,IACjC,IAAI,eAAe,MAAM,UAAU,QAAQ;AAAA,IAC3C,IAAI,oBAAoB,MAAM,UAAU,aAAa;AAAA,EACtD;AAAA,EACA,OAAO;AAAA;AAGR,SAAS,MAAM,CAAC,KAA0B;AAAA,EACzC,OAAO;AAAA,IACN,IAAI,IAAI;AAAA,IACR,MAAM,IAAI;AAAA,IACV,eAAe,IAAI;AAAA,IACnB,QAAQ,IAAI;AAAA,IACZ,QAAQ,IAAI;AAAA,IACZ,QAAQ,CAAC,GAAG,IAAI,MAAM;AAAA,IACtB,UACC,IAAI,iBAAiB,QAAQ,IAAI,sBAAsB,OACpD,OACA,EAAE,MAAM,IAAI,cAAc,WAAW,IAAI,kBAAkB;AAAA,IAC/D,iBAAiB,IAAI;AAAA,IACrB,SAAS,IAAI;AAAA,IACb,WAAW,IAAI;AAAA,IACf,WAAW,IAAI;AAAA,EAChB;AAAA;AAGD,SAAS,SAAS,CAAC,KAAgC;AAAA,EAClD,OAAO;AAAA,IACN,IAAI,IAAI;AAAA,IACR,WAAW,IAAI;AAAA,IACf,QAAQ,IAAI;AAAA,IACZ,iBAAiB,IAAI;AAAA,IACrB,WAAW,IAAI;AAAA,IACf,WAAW,IAAI;AAAA,IACf,WAAW,IAAI;AAAA,EAChB;AAAA;AAQD,SAAS,KAAK,CAAC,IAAe;AAAA,EAC7B,OAAO,OAAM,GAAG,YAAY;AAAA;;;AC5atB,SAAS,oBAAoB,CACnC,IACA,UAAiC,CAAC,GACjB;AAAA,EACjB,OAAO;AAAA,IACN,OAAO,oBAAoB,IAAI,OAAO;AAAA,IACtC,WAAW,uBAAuB,IAAI,OAAO;AAAA,EAC9C;AAAA;",
+  "debugId": "C86E53CADC19B15A64756E2164756E21",
+  "names": []
+}

package/dist/relations.d.ts

@@ -0,0 +1,18 @@
+import { type PgDatabase } from '@nxgt/drizzle/pg';
+import type { RelationStore } from '@nxgt/janus/permissions';
+import { type DrizzleAdapterOptions } from './tables';
+/**
+ * The relation store `permissions()` takes, over one PostgreSQL database
+ * through Drizzle — and the one `janus({ relations })` deletes a user's
+ * tuples from.
+ *
+ * ```ts
+ * const access = permissions({ model, store: createDrizzleRelations(db) });
+ * ```
+ *
+ * **A write of more than one tuple is a transaction**, `@nxgt/drizzle`'s
+ * `withTransaction`: removals first, then additions, all or nothing. It is not
+ * retried here — a write is idempotent, so the caller retries.
+ */
+export declare function createDrizzleRelations(db: PgDatabase, options?: DrizzleAdapterOptions<'relations'>): RelationStore;
+//# sourceMappingURL=relations.d.ts.map

package/dist/relations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relations.d.ts","sourceRoot":"","sources":["../src/relations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,UAAU,EAAmB,MAAM,kBAAkB,CAAC;AAQpE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAE7D,OAAO,EACN,KAAK,qBAAqB,EAG1B,MAAM,UAAU,CAAC;AAGlB;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CACrC,EAAE,EAAE,UAAU,EACd,OAAO,GAAE,qBAAqB,CAAC,WAAW,CAAM,GAC9C,aAAa,CA2Hf"}

package/dist/stores.d.ts

@@ -0,0 +1,31 @@
+import { type PgDatabase } from '@nxgt/drizzle/pg';
+import type { JanusStores } from '@nxgt/janus';
+import { type DrizzleAdapterOptions } from './tables';
+/** The four tables the identity stores query. */
+type IdentityTable = 'users' | 'logins' | 'sessions' | 'tokens';
+/**
+ * The three stores `janus()` takes, over one PostgreSQL database through
+ * Drizzle.
+ *
+ * ```ts
+ * const db = drizzle(process.env.DATABASE_URL);
+ * const auth = janus({ user, password: { login: 'email' }, store: createDrizzleStores(db), hasher });
+ * ```
+ *
+ * **Every read is one statement**, whose absence is an empty result, turned
+ * into `null` here; everything that arrives as a rejection is a failure. There
+ * is no path on which an absence and an outage travel the same channel.
+ *
+ * **A user is written in one transaction** with its logins, whose table holds
+ * their uniqueness — `@nxgt/drizzle`'s `withTransaction`, inside the method,
+ * as rule 5 allows. Every other write is one statement.
+ *
+ * `sessions.deleteExpiredSessions` is implemented: PostgreSQL has no TTL, so
+ * `auth.collectExpired()` is how lapsed sessions leave the table.
+ *
+ * `{ tables }` is what your schema file exports; absent, the tables in the
+ * connection's `search_path`.
+ */
+export declare function createDrizzleStores(db: PgDatabase, options?: DrizzleAdapterOptions<IdentityTable>): JanusStores;
+export {};
+//# sourceMappingURL=stores.d.ts.map

package/dist/stores.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stores.d.ts","sourceRoot":"","sources":["../src/stores.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,UAAU,EAAmB,MAAM,kBAAkB,CAAC;AACpE,OAAO,KAAK,EAEX,WAAW,EAOX,MAAM,aAAa,CAAC;AAGrB,OAAO,EACN,KAAK,qBAAqB,EAG1B,MAAM,UAAU,CAAC;AAOlB,iDAAiD;AACjD,KAAK,aAAa,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,GAAG,QAAQ,CAAC;AAGhE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,mBAAmB,CAClC,EAAE,EAAE,UAAU,EACd,OAAO,GAAE,qBAAqB,CAAC,aAAa,CAAM,GAChD,WAAW,CAOb"}