@nxgt/janus-drizzle 0.8.1 → 0.9.0

package/README.md

@@ -85,7 +85,7 @@ declarations import without extensions, so `nodenext` is not supported.
 | --- | --- |
 | `createDrizzleAdapter(db, options?)` | Returns `{ store, relations }`, both of the entries below, keyed as `janus()` takes them, so `janus({ …, ...postgres })` wires both. It connects to nothing and creates nothing. `options.tables` is what your schema file's `defineJanusTables(…)` returned. |
 | `DrizzleAdapter` | The type of what `createDrizzleAdapter` returns. |
-| `createDrizzleStores(db, options?)` | The `{ users, sessions, tokens }` that `janus()` takes as `store`. Implements both optional methods: `sessions.deleteExpiredSessions`, and `users.findUsers`, so `auth.<type>.findMany(ids)` is one `inArray` statement. |
+| `createDrizzleStores(db, options?)` | The `{ users, sessions, tokens }` that `janus()` takes as `store`. Implements all three optional methods: `sessions.deleteExpiredSessions`, `tokens.deleteExpiredTokens` and `users.findUsers`, so `auth.<type>.findMany(ids)` is one `inArray` statement. |
 | `createDrizzleRelations(db, options?)` | The `RelationStore` that `permissions()` takes as `store`, and `janus()` takes as `relations`. |
 | `defineJanusTables(options?)` | The five tables, `{ users, logins, sessions, tokens, relations }`, as Drizzle tables. Export each from a schema file so your migrations create them. |
 | `JanusTablesOptions` | `{ schema? }`: a `pgSchema(…)` to put the tables in. Absent, they are in the connection's `search_path`, `public` by default. |
@@ -108,7 +108,7 @@ tables.
 | `users` | `id` · `(id, type)` unique, for the logins' foreign key · `(type, id)` for listing · a check that a password has both its hash and its date, or neither · a check that a second factor (`second_factor_method`, `_secret`, `_confirmed_at`, `_last_step`, `_recovery_codes`) has its method and its secret, or none of the five · a check that the method is `totp` and the last step not negative |
 | `logins` | primary key `(type, login)`: **a login is unique per user type** · `(user_id, type)` references the user, `on delete cascade` |
 | `sessions` | `id` · `token_hash` unique · `user_id` · `expires_at`, for `collectExpired()` |
-| `tokens` | `token_hash` · `user_id` · a check on `kind` · `code_hash`, and `attempts`, `not null default 0`, checked `>= 0` |
+| `tokens` | `token_hash` · `user_id` · `expires_at`, for `collectExpired()` · a check on `kind` · `code_hash`, and `attempts`, `not null default 0`, checked `>= 0` |
 | `relations` | one row per tuple, unique `nulls not distinct` over all six columns, subject first: the index `findObjects` pages · `(object_type, object_id, relation)` for one hop forwards |
 
 `logins` is also a `text[]` on `users`, which the store reads back in order.
@@ -174,11 +174,18 @@ a code, in the order written; no codes are `null`, read as `[]`.
   `createDrizzleAdapter(db, { tables: janusTables })`, with the object your
   schema file exports.
 - **Call `auth.collectExpired()` on a schedule.** PostgreSQL has no TTL, so
-  lapsed sessions stay in `sessions` until something deletes them. The
-  core still refuses them on every read. **Lapsed tokens stay too**, and
-  `collectExpired()` does not delete them: `@nxgt/janus`'s sign-in throttle
-  adds a row per login tried and per 15-minute window — a login nobody holds
-  included — and its mail throttle one per flow, address or user and window, so schedule `delete from tokens where expires_at < now() - interval '1 hour';` beside it — `<schema>.tokens` when the tables have a schema of their own. `tokens` has no index on `expires_at`, so the delete scans the table: add `create index on tokens (expires_at)` in a migration of yours if it grows.
+  lapsed sessions stay in `sessions` and lapsed tokens in `tokens` until
+  something deletes them. The core still refuses them on every read.
+  `collectExpired()` deletes both and answers how many in all. The tokens
+  matter: `@nxgt/janus`'s sign-in throttle adds a row per login tried and per
+  15-minute window — a login nobody holds included — and its mail throttle
+  one per flow, address or user and window. The first run after an upgrade
+  deletes the whole backlog in one statement, so run it off-peak.
+- **Upgrading to 0.9 recommends a migration.** `tokens` gains an index on
+  `expires_at`, one `CREATE INDEX`. Without it the delete scans the table.
+  Drop a hand-made `tokens (expires_at)` index first, or the column keeps two.
+  [To 0.9](docs/guide/migrations.md#to-09-an-index-on-tokensexpires_at) shows
+  the statement.
 - **A unique violation on anything but a login is a `StoreFailure`, not
   `LOGIN_TAKEN`.** Such a violation is an adapter bug. Reporting it as a taken
   login would tell somebody their e-mail is in use when it is not.

package/dist/index.js

@@ -89,7 +89,8 @@ function tokensTable(table) {
   }, (t) => [
     check("tokens_kind", sql`${t.kind} in ('verifyEmail', 'resetPassword', 'secondFactor', 'signInCode', 'magicLink', 'stepUp', 'changeEmail')`),
     check("tokens_attempts", sql`${t.attempts} >= 0`),
-    index4("tokens_user_id").on(t.userId)
+    index4("tokens_user_id").on(t.userId),
+    index4("tokens_expires_at").on(t.expiresAt)
   ]);
 }
 
@@ -277,10 +278,18 @@ function createDrizzleRelations(db, options = {}) {
 }
 
 // src/stores/sessions.ts
-import { and as and4, eq as eq4, isNull as isNull3, lte, ne, sql as sql4 } from "drizzle-orm";
+import { and as and4, eq as eq4, isNull as isNull3, lte, ne, sql as sql5 } from "drizzle-orm";
+
+// src/stores/count-deleted.ts
+import { count, sql as sql3 } from "drizzle-orm";
+async function deleteAndCount(db, table, where) {
+  const deleted = db.$with("deleted").as(db.delete(table).where(where).returning({ one: sql3`1`.as("one") }));
+  const [row] = await db.with(deleted).select({ n: count() }).from(deleted);
+  return row?.n ?? 0;
+}
 
 // src/stores/records.ts
-import { sql as sql3 } from "drizzle-orm";
+import { sql as sql4 } from "drizzle-orm";
 function toUserRow(record) {
   return {
     id: record.id,
@@ -365,7 +374,7 @@ function toSession(row) {
   };
 }
 function stamp(at) {
-  return sql3`${at.toISOString()}::timestamptz`;
+  return sql4`${at.toISOString()}::timestamptz`;
 }
 
 // src/stores/sessions.ts
@@ -391,8 +400,7 @@ function sessionStore(db, tables) {
       return deleted.length;
     }),
     deleteExpiredSessions: (before) => run$("deleteExpiredSessions", async () => {
-      const deleted = await db.delete(tables.sessions).where(lte(tables.sessions.expiresAt, before)).returning({ id: tables.sessions.id });
-      return deleted.length;
+      return deleteAndCount(db, tables.sessions, lte(tables.sessions.expiresAt, before));
     })
   };
 }
@@ -402,7 +410,7 @@ async function reauthenticateSession(db, tables, id, at) {
 }
 async function revokeSession(db, tables, id, at) {
   const matched = await db.update(tables.sessions).set({
-    revokedAt: sql4`coalesce(${tables.sessions.revokedAt}, ${stamp(at)})`
+    revokedAt: sql5`coalesce(${tables.sessions.revokedAt}, ${stamp(at)})`
   }).where(eq4(tables.sessions.id, id)).returning({ id: tables.sessions.id });
   return matched.length === 1;
 }
@@ -413,7 +421,7 @@ async function revokeUserSessions(db, tables, userId, at, except) {
 }
 
 // src/stores/tokens.ts
-import { and as and5, eq as eq5, isNull as isNull4, ne as ne2, sql as sql5 } from "drizzle-orm";
+import { and as and5, eq as eq5, isNull as isNull4, lte as lte2, ne as ne2, sql as sql6 } from "drizzle-orm";
 function tokenStore(db, tables) {
   const run$ = (operation, body) => run("tokens", operation, body);
   return {
@@ -429,13 +437,16 @@ function tokenStore(db, tables) {
     deleteUserTokens: (userId) => run$("deleteUserTokens", async () => {
       const deleted = await db.delete(tables.tokens).where(eq5(tables.tokens.userId, userId)).returning({ tokenHash: tables.tokens.tokenHash });
       return deleted.length;
+    }),
+    deleteExpiredTokens: (before) => run$("deleteExpiredTokens", async () => {
+      return deleteAndCount(db, tables.tokens, lte2(tables.tokens.expiresAt, before));
     })
   };
 }
 async function consumeToken(db, tables, tokenHash, kind, at) {
   const before = db.$with("before").as(db.select().from(tables.tokens).where(and5(eq5(tables.tokens.tokenHash, tokenHash), eq5(tables.tokens.kind, kind))).for("update"));
   const [spent] = await db.with(before).update(tables.tokens).set({
-    spentAt: sql5`coalesce(${tables.tokens.spentAt}, ${stamp(at)})`
+    spentAt: sql6`coalesce(${tables.tokens.spentAt}, ${stamp(at)})`
   }).from(before).where(eq5(tables.tokens.tokenHash, before.tokenHash)).returning({
     tokenHash: before.tokenHash,
     kind: before.kind,
@@ -451,7 +462,7 @@ async function consumeToken(db, tables, tokenHash, kind, at) {
 }
 async function countAttempt(db, tables, tokenHash, kind) {
   const match = and5(eq5(tables.tokens.tokenHash, tokenHash), eq5(tables.tokens.kind, kind));
-  const [counted] = await db.update(tables.tokens).set({ attempts: sql5`${tables.tokens.attempts} + 1` }).where(and5(match, isNull4(tables.tokens.spentAt))).returning();
+  const [counted] = await db.update(tables.tokens).set({ attempts: sql6`${tables.tokens.attempts} + 1` }).where(and5(match, isNull4(tables.tokens.spentAt))).returning();
   const row = counted ?? (await db.select().from(tables.tokens).where(match))[0];
   return row === undefined ? null : { ...row, userId: row.userId };
 }
@@ -459,7 +470,7 @@ async function countAttempt(db, tables, tokenHash, kind) {
 // src/stores/users.ts
 import { withTransaction as withTransaction2 } from "@nxgt/drizzle/pg";
 import { NotFoundError, StoreConflict as StoreConflict2 } from "@nxgt/janus";
-import { and as and6, asc as asc2, eq as eq6, gt as gt2, inArray, sql as sql6 } from "drizzle-orm";
+import { and as and6, asc as asc2, eq as eq6, gt as gt2, inArray, sql as sql7 } from "drizzle-orm";
 
 // src/stores/logins.ts
 async function claimLogins(tx, tables, operation, user, logins) {
@@ -529,7 +540,7 @@ async function insertUser(db, tables, record) {
 async function updateUser(tx, tables, id, patch, ifVersion) {
   const [row] = await tx.update(tables.users).set({
     ...toUserSet(patch),
-    version: sql6`${tables.users.version} + 1`
+    version: sql7`${tables.users.version} + 1`
   }).where(and6(eq6(tables.users.id, id), eq6(tables.users.version, ifVersion))).returning();
   if (row === undefined) {
     const [stored] = await tx.select({ version: tables.users.version }).from(tables.users).where(eq6(tables.users.id, id));
@@ -577,5 +588,5 @@ export {
   defineJanusTables
 };
 
-//# debugId=80BE8EFD8F44209964756E2164756E21
+//# debugId=4769BF1300BE303164756E2164756E21
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1,28 +1,29 @@
 {
   "version": 3,
-  "sources": ["../src/tables/index.ts", "../src/tables/logins.ts", "../src/tables/columns.ts", "../src/tables/relations.ts", "../src/tables/sessions.ts", "../src/tables/tokens.ts", "../src/tables/users.ts", "../src/translate.ts", "../src/relations/reads.ts", "../src/relations/tuples.ts", "../src/relations/writes.ts", "../src/relations/index.ts", "../src/stores/sessions.ts", "../src/stores/records.ts", "../src/stores/tokens.ts", "../src/stores/users.ts", "../src/stores/logins.ts", "../src/stores/index.ts", "../src/adapter.ts"],
+  "sources": ["../src/tables/index.ts", "../src/tables/logins.ts", "../src/tables/columns.ts", "../src/tables/relations.ts", "../src/tables/sessions.ts", "../src/tables/tokens.ts", "../src/tables/users.ts", "../src/translate.ts", "../src/relations/reads.ts", "../src/relations/tuples.ts", "../src/relations/writes.ts", "../src/relations/index.ts", "../src/stores/sessions.ts", "../src/stores/count-deleted.ts", "../src/stores/records.ts", "../src/stores/tokens.ts", "../src/stores/users.ts", "../src/stores/logins.ts", "../src/stores/index.ts", "../src/adapter.ts"],
   "sourcesContent": [
     "import { type PgSchema, pgTable } from 'drizzle-orm/pg-core';\nimport type { TableFactory } from './columns';\nimport { loginsTable } from './logins';\nimport { relationsTable } from './relations';\nimport { sessionsTable } from './sessions';\nimport { tokensTable } from './tokens';\nimport { usersTable } from './users';\n\n/**\n * The five tables, as Drizzle definitions: **your migrations create them**.\n * Export them from the schema file drizzle-kit reads, and `drizzle-kit\n * generate` writes them into your next migration like any table of your own.\n *\n * **The names carry no prefix** — `users`, `logins`, `sessions`, `tokens`,\n * `relations` — because the setup this package recommends is **a database of\n * its own**, backed up and restored on its own. Beside an application's own\n * tables, give them a PostgreSQL schema instead: `{ schema: pgSchema('janus') }`\n * makes them `janus.users` and the rest, and `pg_dump -n janus` backs them up\n * alone.\n *\n * Columns are `snake_case`, as PostgreSQL's own catalog and `@nxgt/drizzle`'s\n * columns are: a camelCase column would have to be quoted in every query\n * written by hand. The records the stores answer are camelCase, as everywhere\n * in Janus.\n *\n * **What the tables hold is the port's record**, field by field. Nothing is\n * encoded, so a row read in `psql` reads like the record in the code.\n */\n\n/** Where the tables live. */\nexport interface JanusTablesOptions {\n\t/**\n\t * A PostgreSQL schema of their own, `pgSchema('janus')`, for a database the\n\t * application's tables share. **Export it from the schema file too**:\n\t * drizzle-kit writes `CREATE SCHEMA` only for a schema it finds exported.\n\t * Absent, the tables are in the connection's `search_path`, `public` by\n\t * default: the database of their own.\n\t */\n\treadonly schema?: PgSchema;\n}\n\n/**\n * The five tables, in the schema `options` names, or in none.\n *\n * ```ts\n * // src/janus/schema.ts — the schema file of Janus's own drizzle-kit config\n * export const { users, logins, sessions, tokens, relations } = defineJanusTables();\n *\n * // or, in a database the application's tables share\n * export const janus = pgSchema('janus');\n * export const { users, logins, sessions, tokens, relations } = defineJanusTables({ schema: janus });\n * ```\n *\n * Pass what the schema file exports to `createDrizzleAdapter` as `{ tables }`,\n * so the stores query the very tables your migration created.\n */\nexport function defineJanusTables(options: JanusTablesOptions = {}) {\n\tconst { schema } = options;\n\tconst table = (schema === undefined ? pgTable : schema.table) as TableFactory;\n\tconst users = usersTable(table);\n\tconst logins = loginsTable(table, users);\n\tconst sessions = sessionsTable(table);\n\tconst tokens = tokensTable(table);\n\tconst relations = relationsTable(table);\n\treturn { users, logins, sessions, tokens, relations };\n}\n\n/** The five tables `defineJanusTables` answers. */\nexport type JanusTables = ReturnType<typeof defineJanusTables>;\n\n/**\n * Which tables the stores query: **the ones your schema file exports**, so\n * the migration and the stores cannot disagree. Absent, `defineJanusTables()`:\n * the tables in the connection's `search_path`.\n *\n * ```ts\n * // src/db/schema.ts\n * export const janus = pgSchema('janus');\n * export const janusTables = defineJanusTables({ schema: janus });\n * export const { users, logins, sessions, tokens, relations } = janusTables;\n *\n * // where the adapter is wired\n * const postgres = createDrizzleAdapter(db, { tables: janusTables });\n * ```\n */\nexport interface DrizzleAdapterOptions<\n\tK extends keyof JanusTables = keyof JanusTables,\n> {\n\treadonly tables?: Pick<JanusTables, K>;\n}\n",
     "import { foreignKey, index, primaryKey } from 'drizzle-orm/pg-core';\nimport { key, type TableFactory } from './columns';\nimport type { usersTable } from './users';\n\n/**\n * **The uniqueness of a login, per type** (rule 3): one row per login a\n * user holds, and the primary key refuses a second holder. PostgreSQL has\n * no unique index over the elements of an array, so this table is that\n * index, written in the same transaction as the user. Deleting the user\n * deletes its rows.\n */\nexport function loginsTable(\n\ttable: TableFactory,\n\tusers: ReturnType<typeof usersTable>,\n) {\n\treturn table(\n\t\t'logins',\n\t\t{\n\t\t\ttype: key('type').notNull(),\n\t\t\tlogin: key('login').notNull(),\n\t\t\tuserId: key('user_id').notNull(),\n\t\t},\n\t\t(t) => [\n\t\t\tprimaryKey({ name: 'logins_pkey', columns: [t.type, t.login] }),\n\t\t\tforeignKey({\n\t\t\t\tname: 'logins_user_fk',\n\t\t\t\tcolumns: [t.userId, t.type],\n\t\t\t\tforeignColumns: [users.id, users.type],\n\t\t\t}).onDelete('cascade'),\n\t\t\tindex('logins_user_id').on(t.userId),\n\t\t],\n\t);\n}\n",
     "// The building blocks every table is made of: the table factory's type and\n// the column kinds the five tables share.\nimport { customType, type pgTable, timestamp } from 'drizzle-orm/pg-core';\n\n/** `pgTable`, or the `table` of the schema the tables live in. */\nexport type TableFactory = typeof pgTable;\n\n/**\n * A key compared byte by byte, as the port asks (rule 4): `collate \"C\"`. Under\n * a database's default collation, `en_US.UTF-8` or the like, `B` sorts after\n * `a` — and a page in \"ascending id order\" repeats or skips rows.\n */\nexport const key = customType<{ data: string; driverData: string }>({\n\tdataType: () => 'text collate \"C\"',\n});\n\n// Millisecond precision: a JavaScript `Date` has no more. At PostgreSQL's\n// default of microseconds, a timestamp written and read back is not the one\n// the core wrote.\nexport const at = (name: string) =>\n\ttimestamp(name, { withTimezone: true, precision: 3 });\n",
     "import { index, unique } from 'drizzle-orm/pg-core';\nimport { key, type TableFactory } from './columns';\n\n/**\n * Permission tuples, one row each: `record:r1#owners@patient:u1`, or\n * `…@team:t1#members` for a subject set, whose `subject_relation` an\n * entity's row leaves `null`.\n *\n * **The uniqueness of a tuple is the unique constraint**, `nulls not\n * distinct` so two rows for one entity collide — PostgreSQL 15 or later.\n * Its column order is the reverse index `findObjects` pages: every equality\n * first, the object id last.\n */\nexport function relationsTable(table: TableFactory) {\n\treturn table(\n\t\t'relations',\n\t\t{\n\t\t\tobjectType: key('object_type').notNull(),\n\t\t\tobjectId: key('object_id').notNull(),\n\t\t\trelation: key('relation').notNull(),\n\t\t\tsubjectType: key('subject_type').notNull(),\n\t\t\tsubjectId: key('subject_id').notNull(),\n\t\t\tsubjectRelation: key('subject_relation'),\n\t\t},\n\t\t(t) => [\n\t\t\tunique('relations_tuple_unique')\n\t\t\t\t.on(\n\t\t\t\t\tt.subjectType,\n\t\t\t\t\tt.subjectId,\n\t\t\t\t\tt.subjectRelation,\n\t\t\t\t\tt.relation,\n\t\t\t\t\tt.objectType,\n\t\t\t\t\tt.objectId,\n\t\t\t\t)\n\t\t\t\t.nullsNotDistinct(),\n\t\t\t/** One hop forwards: `findSubjectSets`, `findEntities`, `deleteEntity` as the object. */\n\t\t\tindex('relations_object').on(t.objectType, t.objectId, t.relation),\n\t\t],\n\t);\n}\n",
     "import { index, unique } from 'drizzle-orm/pg-core';\nimport { at, key, type TableFactory } from './columns';\n\n/**\n * Sessions. No foreign key to the user: deleting a user deletes the user,\n * and the core deletes the sessions next — as it does when they live\n * elsewhere, in Redis.\n */\nexport function sessionsTable(table: TableFactory) {\n\treturn table(\n\t\t'sessions',\n\t\t{\n\t\t\tid: key('id').primaryKey(),\n\t\t\t/** `sha256` of the session token. The secret itself is never stored. */\n\t\t\ttokenHash: key('token_hash').notNull(),\n\t\t\tuserId: key('user_id').notNull(),\n\t\t\tauthenticatedAt: at('authenticated_at').notNull(),\n\t\t\texpiresAt: at('expires_at').notNull(),\n\t\t\trevokedAt: at('revoked_at'),\n\t\t\tcreatedAt: at('created_at').notNull(),\n\t\t},\n\t\t(t) => [\n\t\t\tunique('sessions_token_hash_unique').on(t.tokenHash),\n\t\t\tindex('sessions_user_id').on(t.userId),\n\t\t\t/** `deleteExpiredSessions`: PostgreSQL has no TTL, so the core collects. */\n\t\t\tindex('sessions_expires_at').on(t.expiresAt),\n\t\t],\n\t);\n}\n",
-    "import { sql } from 'drizzle-orm';\nimport { check, index, integer, text } from 'drizzle-orm/pg-core';\nimport { at, key, type TableFactory } from './columns';\n\n/** One-time tokens, keyed by their hash. */\nexport function tokensTable(table: TableFactory) {\n\treturn table(\n\t\t'tokens',\n\t\t{\n\t\t\ttokenHash: key('token_hash').primaryKey(),\n\t\t\tkind: text('kind', {\n\t\t\t\tenum: [\n\t\t\t\t\t'verifyEmail',\n\t\t\t\t\t'resetPassword',\n\t\t\t\t\t'secondFactor',\n\t\t\t\t\t'signInCode',\n\t\t\t\t\t'magicLink',\n\t\t\t\t\t'stepUp',\n\t\t\t\t\t'changeEmail',\n\t\t\t\t],\n\t\t\t}).notNull(),\n\t\t\tuserId: key('user_id').notNull(),\n\t\t\taddress: text('address').notNull(),\n\t\t\t/**\n\t\t\t * An e-mailed code's hash, keyed by the token's secret — for a\n\t\t\t * `changeEmail` token, the address it replaces, keyed the same way.\n\t\t\t */\n\t\t\tcodeHash: text('code_hash'),\n\t\t\t/** Codes tried against it. The default fills the rows a migration finds. */\n\t\t\tattempts: integer('attempts').notNull().default(0),\n\t\t\texpiresAt: at('expires_at').notNull(),\n\t\t\tspentAt: at('spent_at'),\n\t\t\tcreatedAt: at('created_at').notNull(),\n\t\t},\n\t\t(t) => [\n\t\t\tcheck(\n\t\t\t\t'tokens_kind',\n\t\t\t\tsql`${t.kind} in ('verifyEmail', 'resetPassword', 'secondFactor', 'signInCode', 'magicLink', 'stepUp', 'changeEmail')`,\n\t\t\t),\n\t\t\tcheck('tokens_attempts', sql`${t.attempts} >= 0`),\n\t\t\tindex('tokens_user_id').on(t.userId),\n\t\t],\n\t);\n}\n",
+    "import { sql } from 'drizzle-orm';\nimport { check, index, integer, text } from 'drizzle-orm/pg-core';\nimport { at, key, type TableFactory } from './columns';\n\n/** One-time tokens, keyed by their hash. */\nexport function tokensTable(table: TableFactory) {\n\treturn table(\n\t\t'tokens',\n\t\t{\n\t\t\ttokenHash: key('token_hash').primaryKey(),\n\t\t\tkind: text('kind', {\n\t\t\t\tenum: [\n\t\t\t\t\t'verifyEmail',\n\t\t\t\t\t'resetPassword',\n\t\t\t\t\t'secondFactor',\n\t\t\t\t\t'signInCode',\n\t\t\t\t\t'magicLink',\n\t\t\t\t\t'stepUp',\n\t\t\t\t\t'changeEmail',\n\t\t\t\t],\n\t\t\t}).notNull(),\n\t\t\tuserId: key('user_id').notNull(),\n\t\t\taddress: text('address').notNull(),\n\t\t\t/**\n\t\t\t * An e-mailed code's hash, keyed by the token's secret — for a\n\t\t\t * `changeEmail` token, the address it replaces, keyed the same way.\n\t\t\t */\n\t\t\tcodeHash: text('code_hash'),\n\t\t\t/** Codes tried against it. The default fills the rows a migration finds. */\n\t\t\tattempts: integer('attempts').notNull().default(0),\n\t\t\texpiresAt: at('expires_at').notNull(),\n\t\t\tspentAt: at('spent_at'),\n\t\t\tcreatedAt: at('created_at').notNull(),\n\t\t},\n\t\t(t) => [\n\t\t\tcheck(\n\t\t\t\t'tokens_kind',\n\t\t\t\tsql`${t.kind} in ('verifyEmail', 'resetPassword', 'secondFactor', 'signInCode', 'magicLink', 'stepUp', 'changeEmail')`,\n\t\t\t),\n\t\t\tcheck('tokens_attempts', sql`${t.attempts} >= 0`),\n\t\t\tindex('tokens_user_id').on(t.userId),\n\t\t\t/** `deleteExpiredTokens`: PostgreSQL has no TTL, so the core collects. */\n\t\t\tindex('tokens_expires_at').on(t.expiresAt),\n\t\t],\n\t);\n}\n",
     "import { sql } from 'drizzle-orm';\nimport {\n\tboolean,\n\tcheck,\n\tindex,\n\tinteger,\n\tjsonb,\n\ttext,\n\tunique,\n} from 'drizzle-orm/pg-core';\nimport { at, key, type TableFactory } from './columns';\n\n/**\n * Users and their passwords: one row each. `logins` is the port's array,\n * verbatim and in order; its uniqueness is `logins`' primary key.\n */\nexport function usersTable(table: TableFactory) {\n\treturn table(\n\t\t'users',\n\t\t{\n\t\t\t/** The UUIDv7 the core minted. `text`, not `uuid`: the store parses nothing. */\n\t\t\tid: key('id').primaryKey(),\n\t\t\ttype: key('type').notNull(),\n\t\t\tschemaVersion: text('schema_version').notNull(),\n\t\t\tactive: boolean('active').notNull(),\n\t\t\t/** The application's fields. The core validated them already. */\n\t\t\tfields: jsonb('fields').notNull(),\n\t\t\tlogins: text('logins').array().notNull(),\n\t\t\tpasswordHash: text('password_hash'),\n\t\t\tpasswordUpdatedAt: at('password_updated_at'),\n\t\t\t/** `'totp'`, or `null` for a user with no second factor. */\n\t\t\tsecondFactorMethod: text('second_factor_method', { enum: ['totp'] }),\n\t\t\t/** Sealed by the core with the application's key: never the plain secret. */\n\t\t\tsecondFactorSecret: text('second_factor_secret'),\n\t\t\tsecondFactorConfirmedAt: at('second_factor_confirmed_at'),\n\t\t\tsecondFactorLastStep: integer('second_factor_last_step'),\n\t\t\t/**\n\t\t\t * The recovery codes' keyed hashes, in order — `null` for none, read\n\t\t\t * as `[]`, so a row written before the column existed reads as no\n\t\t\t * codes.\n\t\t\t */\n\t\t\tsecondFactorRecoveryCodes: text('second_factor_recovery_codes').array(),\n\t\t\temailVerifiedAt: at('email_verified_at'),\n\t\t\tversion: integer('version').notNull(),\n\t\t\tcreatedAt: at('created_at').notNull(),\n\t\t\tupdatedAt: at('updated_at').notNull(),\n\t\t},\n\t\t(t) => [\n\t\t\t/** What `logins` references, so a login's type is its user's. */\n\t\t\tunique('users_id_type_unique').on(t.id, t.type),\n\t\t\t/** `listUsers` reads one type in id order. */\n\t\t\tindex('users_type_id').on(t.type, t.id),\n\t\t\t/** A password is a hash and when it was set, or neither. */\n\t\t\tcheck(\n\t\t\t\t'users_password_whole',\n\t\t\t\tsql`(${t.passwordHash} is null) = (${t.passwordUpdatedAt} is null)`,\n\t\t\t),\n\t\t\t/**\n\t\t\t * A second factor is a method and a secret, or neither; its\n\t\t\t * confirmation, last step and recovery codes exist only beside them.\n\t\t\t */\n\t\t\tcheck(\n\t\t\t\t'users_second_factor_whole',\n\t\t\t\tsql`(${t.secondFactorMethod} is null) = (${t.secondFactorSecret} is null) and (${t.secondFactorMethod} is not null or (${t.secondFactorConfirmedAt} is null and ${t.secondFactorLastStep} is null and ${t.secondFactorRecoveryCodes} is null))`,\n\t\t\t),\n\t\t\t/** `'totp'` is the one method; a step counts up from the epoch. */\n\t\t\tcheck(\n\t\t\t\t'users_second_factor_values',\n\t\t\t\tsql`${t.secondFactorMethod} in ('totp') and ${t.secondFactorLastStep} >= 0`,\n\t\t\t),\n\t\t],\n\t);\n}\n",
     "import { toDataError } from '@nxgt/drizzle';\nimport { JanusError, StoreConflict, StoreFailure } from '@nxgt/janus';\n\n/**\n * **The database's errors, as the port's.** One file, and one default.\n *\n * | What happens | Becomes |\n * | --- | --- |\n * | A login another user of the type holds | `StoreConflict('login')`, carrying `login` and `userType` |\n * | A row with this id already there | nothing: the insert is a retry, and answers what is stored |\n * | A unique violation on **any other constraint** | **`StoreFailure`** |\n * | A check or foreign key refusing a row | **`StoreFailure`** |\n * | Anything else, absolutely | `StoreFailure`, with `@nxgt/drizzle`'s `DataError` as `cause` |\n *\n * The first two are never errors here: a login is written with `on conflict\n * do nothing`, and a login the statement did not write is one somebody else\n * holds — so no conflict is ever told apart by parsing a driver's message.\n *\n * The bold rows go against the obvious reading. A violation the adapter did\n * not mean to cause is an adapter bug, and reporting it as `LOGIN_TAKEN`\n * would tell somebody their login is taken when it is not. The core\n * validated every record before it reached a store, so a constraint refusing\n * one means the adapter and the port disagree — never the caller's fault.\n *\n * **The default is a failure, not an absence.** That branch is what keeps the\n * port's first rule: nothing here answers `null` for an error.\n */\n\nexport type Slot = 'users' | 'sessions' | 'tokens' | 'relations';\n\n/** Runs one port method, and makes every rejection one the port allows. */\nexport async function run<T>(\n\tslot: Slot,\n\toperation: string,\n\tbody: () => Promise<T>,\n): Promise<T> {\n\ttry {\n\t\treturn await body();\n\t} catch (error) {\n\t\t// Already the port's — a conflict, a NOT_FOUND after a read.\n\t\tif (error instanceof JanusError) throw error;\n\t\tthrow new StoreFailure(`${slot}.${operation}: the store could not answer`, {\n\t\t\tslot,\n\t\t\toperation,\n\t\t\tcause: toDataError(error),\n\t\t});\n\t}\n}\n\n/** The refusal the port promises for a taken login. */\nexport function loginTaken(\n\toperation: string,\n\ttype: string,\n\tlogin: string,\n): StoreConflict {\n\treturn new StoreConflict(\n\t\t'login',\n\t\t`${operation}: the login is taken by another ${type}`,\n\t\t{ login, userType: type, operation },\n\t);\n}\n",
     "import type {\n\tCursorPage,\n\tEntity,\n\tRelationTuple,\n\tSubjectSet,\n} from '@nxgt/janus';\nimport type { ObjectPageRequest } from '@nxgt/janus/permissions';\nimport { and, asc, eq, gt, isNotNull, isNull } from 'drizzle-orm';\nimport type { RelationContext } from './context';\nimport { matching, subjectIs } from './tuples';\n\nexport async function has(\n\t{ db, relations }: RelationContext,\n\ttuple: RelationTuple,\n): Promise<boolean> {\n\tconst found = await db\n\t\t.select({ relation: relations.relation })\n\t\t.from(relations)\n\t\t.where(matching(relations, tuple))\n\t\t.limit(1);\n\treturn found.length === 1;\n}\n\nexport async function findSubjectSets(\n\tcontext: RelationContext,\n\tobject: Entity,\n\trelation: string,\n): Promise<SubjectSet[]> {\n\treturn (await holding(context, object, relation, true)).map(\n\t\t(row): SubjectSet => ({\n\t\t\ttype: row.type,\n\t\t\tid: row.id,\n\t\t\trelation: row.relation ?? '',\n\t\t}),\n\t);\n}\n\nexport async function findEntities(\n\tcontext: RelationContext,\n\tobject: Entity,\n\trelation: string,\n): Promise<Entity[]> {\n\treturn (await holding(context, object, relation, false)).map(\n\t\t(row): Entity => ({ type: row.type, id: row.id }),\n\t);\n}\n\n/** One hop from an object: its subject sets, or its entities. */\nfunction holding(\n\t{ db, relations }: RelationContext,\n\tobject: Entity,\n\trelation: string,\n\tsets: boolean,\n) {\n\treturn db\n\t\t.select({\n\t\t\ttype: relations.subjectType,\n\t\t\tid: relations.subjectId,\n\t\t\trelation: relations.subjectRelation,\n\t\t})\n\t\t.from(relations)\n\t\t.where(\n\t\t\tand(\n\t\t\t\teq(relations.objectType, object.type),\n\t\t\t\teq(relations.objectId, object.id),\n\t\t\t\teq(relations.relation, relation),\n\t\t\t\tsets\n\t\t\t\t\t? isNotNull(relations.subjectRelation)\n\t\t\t\t\t: isNull(relations.subjectRelation),\n\t\t\t),\n\t\t);\n}\n\n/** A page of object ids, in id order, after the cursor. */\nexport async function findObjects(\n\t{ db, relations }: RelationContext,\n\t{ type, relation, subject, after, limit }: ObjectPageRequest,\n): Promise<CursorPage<string>> {\n\tconst conditions = [\n\t\tsubjectIs(relations, subject),\n\t\teq(relations.relation, relation),\n\t\teq(relations.objectType, type),\n\t];\n\tif (after !== null) conditions.push(gt(relations.objectId, after));\n\tconst found = await db\n\t\t.select({ id: relations.objectId })\n\t\t.from(relations)\n\t\t.where(and(...conditions))\n\t\t.orderBy(asc(relations.objectId))\n\t\t.limit(limit + 1);\n\tconst items = found.slice(0, limit).map((row) => row.id);\n\tconst last = items.at(-1);\n\treturn {\n\t\titems,\n\t\tnextCursor: found.length > limit && last !== undefined ? last : null,\n\t};\n}\n",
     "import { isSubjectSet, type RelationTuple, type Subject } from '@nxgt/janus';\nimport { and, eq, isNull, type SQL } from 'drizzle-orm';\nimport type { Relations } from './context';\n\n/** Tuples in one order: their notation, compared by code unit. */\nexport function inOrder(\n\ttuples: readonly RelationTuple[],\n): readonly RelationTuple[] {\n\tconst keyOf = (tuple: RelationTuple) =>\n\t\tJSON.stringify([\n\t\t\ttuple.object.type,\n\t\t\ttuple.object.id,\n\t\t\ttuple.relation,\n\t\t\ttuple.subject.type,\n\t\t\ttuple.subject.id,\n\t\t\tisSubjectSet(tuple.subject) ? tuple.subject.relation : null,\n\t\t]);\n\treturn [...tuples].sort((a, b) => {\n\t\tconst [x, y] = [keyOf(a), keyOf(b)];\n\t\treturn x < y ? -1 : x > y ? 1 : 0;\n\t});\n}\n\n/** A tuple as a row: an entity's `subject_relation` is `null`. */\nexport function rowOf(tuple: RelationTuple): Relations['$inferInsert'] {\n\treturn {\n\t\tobjectType: tuple.object.type,\n\t\tobjectId: tuple.object.id,\n\t\trelation: tuple.relation,\n\t\tsubjectType: tuple.subject.type,\n\t\tsubjectId: tuple.subject.id,\n\t\tsubjectRelation: isSubjectSet(tuple.subject)\n\t\t\t? tuple.subject.relation\n\t\t\t: null,\n\t};\n}\n\n/** Exactly this subject: a subject set is not its entity, and the reverse. */\nexport function subjectIs(\n\trelations: Relations,\n\tsubject: Subject,\n): SQL | undefined {\n\treturn and(\n\t\teq(relations.subjectType, subject.type),\n\t\teq(relations.subjectId, subject.id),\n\t\tisSubjectSet(subject)\n\t\t\t? eq(relations.subjectRelation, subject.relation)\n\t\t\t: isNull(relations.subjectRelation),\n\t);\n}\n\n/** Exactly this tuple. */\nexport function matching(\n\trelations: Relations,\n\ttuple: RelationTuple,\n): SQL | undefined {\n\treturn and(\n\t\teq(relations.objectType, tuple.object.type),\n\t\teq(relations.objectId, tuple.object.id),\n\t\teq(relations.relation, tuple.relation),\n\t\tsubjectIs(relations, tuple.subject),\n\t);\n}\n",
     "import { type PgDatabase, withTransaction } from '@nxgt/drizzle/pg';\nimport type { Entity, RelationTuple } from '@nxgt/janus';\nimport { and, eq, or } from 'drizzle-orm';\nimport type { RelationContext, Relations } from './context';\nimport { inOrder, matching, rowOf } from './tuples';\n\n/** One tuple in one statement; more in one transaction. */\nexport async function write(\n\t{ db, relations }: RelationContext,\n\tadd: readonly RelationTuple[],\n\tremove: readonly RelationTuple[],\n): Promise<void> {\n\tif (add.length + remove.length <= 1) return apply(db, relations, add, remove);\n\tawait withTransaction(db, (tx) => apply(tx, relations, add, remove));\n}\n\n/** Removals first, then additions. */\nasync function apply(\n\ttx: PgDatabase,\n\trelations: Relations,\n\tadd: readonly RelationTuple[],\n\tremove: readonly RelationTuple[],\n): Promise<void> {\n\t// In one order, so two writes touching the same tuples take their locks\n\t// alike and never deadlock.\n\tfor (const tuple of inOrder(remove)) {\n\t\tawait tx.delete(relations).where(matching(relations, tuple));\n\t}\n\tif (add.length > 0) {\n\t\t// A stored tuple meets the unique constraint, and is a no-op.\n\t\tawait tx\n\t\t\t.insert(relations)\n\t\t\t.values(inOrder(add).map(rowOf))\n\t\t\t.onConflictDoNothing();\n\t}\n}\n\n/** Every tuple naming the entity, as object or as subject. */\nexport async function deleteEntity(\n\t{ db, relations }: RelationContext,\n\tentity: Entity,\n): Promise<number> {\n\tconst deleted = await db\n\t\t.delete(relations)\n\t\t.where(\n\t\t\tor(\n\t\t\t\tand(\n\t\t\t\t\teq(relations.objectType, entity.type),\n\t\t\t\t\teq(relations.objectId, entity.id),\n\t\t\t\t),\n\t\t\t\tand(\n\t\t\t\t\teq(relations.subjectType, entity.type),\n\t\t\t\t\teq(relations.subjectId, entity.id),\n\t\t\t\t),\n\t\t\t),\n\t\t)\n\t\t.returning({ relation: relations.relation });\n\treturn deleted.length;\n}\n",
     "import type { PgDatabase } from '@nxgt/drizzle/pg';\nimport type { RelationStore } from '@nxgt/janus/permissions';\nimport { type DrizzleAdapterOptions, defineJanusTables } from '../tables';\nimport { run } from '../translate';\nimport type { RelationContext } from './context';\nimport { findEntities, findObjects, findSubjectSets, has } from './reads';\nimport { deleteEntity, write } from './writes';\n\n/**\n * The relation store `permissions()` takes, over one PostgreSQL database\n * through Drizzle — and the one `janus({ relations })` deletes a user's\n * tuples from.\n *\n * ```ts\n * const access = permissions({ model, store: createDrizzleRelations(db) });\n * ```\n *\n * **A write of more than one tuple is a transaction**, `@nxgt/drizzle`'s\n * `withTransaction`: removals first, then additions, all or nothing. It is not\n * retried here — a write is idempotent, so the caller retries.\n */\nexport function createDrizzleRelations(\n\tdb: PgDatabase,\n\toptions: DrizzleAdapterOptions<'relations'> = {},\n): RelationStore {\n\tconst tables = options.tables ?? defineJanusTables();\n\tconst context: RelationContext = { db, relations: tables.relations };\n\tconst run$ = <T>(operation: string, body: () => Promise<T>) =>\n\t\trun('relations', operation, body);\n\n\treturn {\n\t\twrite: ({ add = [], remove = [] }) =>\n\t\t\trun$('write', () => write(context, add, remove)),\n\t\thas: (tuple) => run$('has', () => has(context, tuple)),\n\t\tfindSubjectSets: (object, relation) =>\n\t\t\trun$('findSubjectSets', () => findSubjectSets(context, object, relation)),\n\t\tfindEntities: (object, relation) =>\n\t\t\trun$('findEntities', () => findEntities(context, object, relation)),\n\t\t// The request is unpacked before `run$`, as `write`'s is and as it was\n\t\t// before the split, so a malformed request throws the caller's\n\t\t// TypeError at once instead of reading as an outage.\n\t\tfindObjects: ({ type, relation, subject, after, limit }) =>\n\t\t\trun$('findObjects', () =>\n\t\t\t\tfindObjects(context, { type, relation, subject, after, limit }),\n\t\t\t),\n\t\tdeleteEntity: (entity) =>\n\t\t\trun$('deleteEntity', () => deleteEntity(context, entity)),\n\t};\n}\n",
-    "import type { PgDatabase } from '@nxgt/drizzle/pg';\nimport type { SessionRecord, SessionStore } from '@nxgt/janus';\nimport { and, eq, isNull, lte, ne, sql } from 'drizzle-orm';\nimport { run } from '../translate';\nimport type { IdentityTables } from './identity-tables';\nimport { stamp, toSession } from './records';\n\nexport function sessionStore(\n\tdb: PgDatabase,\n\ttables: IdentityTables,\n): SessionStore {\n\tconst run$ = <T>(operation: string, body: () => Promise<T>) =>\n\t\trun('sessions', operation, body);\n\n\treturn {\n\t\tinsertSession: (record) =>\n\t\t\trun$('insertSession', async () => {\n\t\t\t\t// Idempotent under retry: a session with this id is already there.\n\t\t\t\t// A collision on the token hash is not a retry, and fails.\n\t\t\t\tawait db\n\t\t\t\t\t.insert(tables.sessions)\n\t\t\t\t\t.values(record)\n\t\t\t\t\t.onConflictDoNothing({ target: tables.sessions.id });\n\t\t\t}),\n\n\t\tfindSessionByTokenHash: (tokenHash) =>\n\t\t\trun$('findSessionByTokenHash', async () => {\n\t\t\t\tconst [row] = await db\n\t\t\t\t\t.select()\n\t\t\t\t\t.from(tables.sessions)\n\t\t\t\t\t.where(eq(tables.sessions.tokenHash, tokenHash));\n\t\t\t\treturn row === undefined ? null : toSession(row);\n\t\t\t}),\n\n\t\textendSession: (id, expiresAt) =>\n\t\t\trun$('extendSession', async () => {\n\t\t\t\t// `revoked_at is null` in the condition: an extension racing a\n\t\t\t\t// revocation matches nothing, and never brings the session back.\n\t\t\t\tconst [row] = await db\n\t\t\t\t\t.update(tables.sessions)\n\t\t\t\t\t.set({ expiresAt })\n\t\t\t\t\t.where(\n\t\t\t\t\t\tand(eq(tables.sessions.id, id), isNull(tables.sessions.revokedAt)),\n\t\t\t\t\t)\n\t\t\t\t\t.returning();\n\t\t\t\treturn row === undefined ? null : toSession(row);\n\t\t\t}),\n\n\t\treauthenticateSession: (id, at) =>\n\t\t\trun$('reauthenticateSession', () =>\n\t\t\t\treauthenticateSession(db, tables, id, at),\n\t\t\t),\n\n\t\trevokeSession: (id, at) =>\n\t\t\trun$('revokeSession', () => revokeSession(db, tables, id, at)),\n\n\t\trevokeUserSessions: (userId, at, except) =>\n\t\t\trun$('revokeUserSessions', () =>\n\t\t\t\trevokeUserSessions(db, tables, userId, at, except),\n\t\t\t),\n\n\t\tdeleteUserSessions: (userId) =>\n\t\t\trun$('deleteUserSessions', async () => {\n\t\t\t\tconst deleted = await db\n\t\t\t\t\t.delete(tables.sessions)\n\t\t\t\t\t.where(eq(tables.sessions.userId, userId))\n\t\t\t\t\t.returning({ id: tables.sessions.id });\n\t\t\t\treturn deleted.length;\n\t\t\t}),\n\n\t\tdeleteExpiredSessions: (before) =>\n\t\t\trun$('deleteExpiredSessions', async () => {\n\t\t\t\tconst deleted = await db\n\t\t\t\t\t.delete(tables.sessions)\n\t\t\t\t\t.where(lte(tables.sessions.expiresAt, before))\n\t\t\t\t\t.returning({ id: tables.sessions.id });\n\t\t\t\treturn deleted.length;\n\t\t\t}),\n\t};\n}\n\nasync function reauthenticateSession(\n\tdb: PgDatabase,\n\ttables: IdentityTables,\n\tid: string,\n\tat: Date,\n): Promise<SessionRecord | null> {\n\t// The same condition as an extension's: a confirmation racing a\n\t// revocation matches nothing.\n\tconst [row] = await db\n\t\t.update(tables.sessions)\n\t\t.set({ authenticatedAt: at })\n\t\t.where(and(eq(tables.sessions.id, id), isNull(tables.sessions.revokedAt)))\n\t\t.returning();\n\treturn row === undefined ? null : toSession(row);\n}\n\nasync function revokeSession(\n\tdb: PgDatabase,\n\ttables: IdentityTables,\n\tid: string,\n\tat: Date,\n): Promise<boolean> {\n\t// `coalesce`, so a session already revoked keeps its first\n\t// `revokedAt` and still counts as matched.\n\tconst matched = await db\n\t\t.update(tables.sessions)\n\t\t.set({\n\t\t\trevokedAt: sql`coalesce(${tables.sessions.revokedAt}, ${stamp(at)})`,\n\t\t})\n\t\t.where(eq(tables.sessions.id, id))\n\t\t.returning({ id: tables.sessions.id });\n\treturn matched.length === 1;\n}\n\nasync function revokeUserSessions(\n\tdb: PgDatabase,\n\ttables: IdentityTables,\n\tuserId: string,\n\tat: Date,\n\texcept: string | undefined,\n): Promise<number> {\n\tconst standing = and(\n\t\teq(tables.sessions.userId, userId),\n\t\tisNull(tables.sessions.revokedAt),\n\t);\n\tconst revoked = await db\n\t\t.update(tables.sessions)\n\t\t.set({ revokedAt: at })\n\t\t.where(\n\t\t\texcept === undefined\n\t\t\t\t? standing\n\t\t\t\t: and(standing, ne(tables.sessions.id, except)),\n\t\t)\n\t\t.returning({ id: tables.sessions.id });\n\treturn revoked.length;\n}\n",
+    "import type { PgDatabase } from '@nxgt/drizzle/pg';\nimport type { SessionRecord, SessionStore } from '@nxgt/janus';\nimport { and, eq, isNull, lte, ne, sql } from 'drizzle-orm';\nimport { run } from '../translate';\nimport { deleteAndCount } from './count-deleted';\nimport type { IdentityTables } from './identity-tables';\nimport { stamp, toSession } from './records';\n\nexport function sessionStore(\n\tdb: PgDatabase,\n\ttables: IdentityTables,\n): SessionStore {\n\tconst run$ = <T>(operation: string, body: () => Promise<T>) =>\n\t\trun('sessions', operation, body);\n\n\treturn {\n\t\tinsertSession: (record) =>\n\t\t\trun$('insertSession', async () => {\n\t\t\t\t// Idempotent under retry: a session with this id is already there.\n\t\t\t\t// A collision on the token hash is not a retry, and fails.\n\t\t\t\tawait db\n\t\t\t\t\t.insert(tables.sessions)\n\t\t\t\t\t.values(record)\n\t\t\t\t\t.onConflictDoNothing({ target: tables.sessions.id });\n\t\t\t}),\n\n\t\tfindSessionByTokenHash: (tokenHash) =>\n\t\t\trun$('findSessionByTokenHash', async () => {\n\t\t\t\tconst [row] = await db\n\t\t\t\t\t.select()\n\t\t\t\t\t.from(tables.sessions)\n\t\t\t\t\t.where(eq(tables.sessions.tokenHash, tokenHash));\n\t\t\t\treturn row === undefined ? null : toSession(row);\n\t\t\t}),\n\n\t\textendSession: (id, expiresAt) =>\n\t\t\trun$('extendSession', async () => {\n\t\t\t\t// `revoked_at is null` in the condition: an extension racing a\n\t\t\t\t// revocation matches nothing, and never brings the session back.\n\t\t\t\tconst [row] = await db\n\t\t\t\t\t.update(tables.sessions)\n\t\t\t\t\t.set({ expiresAt })\n\t\t\t\t\t.where(\n\t\t\t\t\t\tand(eq(tables.sessions.id, id), isNull(tables.sessions.revokedAt)),\n\t\t\t\t\t)\n\t\t\t\t\t.returning();\n\t\t\t\treturn row === undefined ? null : toSession(row);\n\t\t\t}),\n\n\t\treauthenticateSession: (id, at) =>\n\t\t\trun$('reauthenticateSession', () =>\n\t\t\t\treauthenticateSession(db, tables, id, at),\n\t\t\t),\n\n\t\trevokeSession: (id, at) =>\n\t\t\trun$('revokeSession', () => revokeSession(db, tables, id, at)),\n\n\t\trevokeUserSessions: (userId, at, except) =>\n\t\t\trun$('revokeUserSessions', () =>\n\t\t\t\trevokeUserSessions(db, tables, userId, at, except),\n\t\t\t),\n\n\t\tdeleteUserSessions: (userId) =>\n\t\t\trun$('deleteUserSessions', async () => {\n\t\t\t\tconst deleted = await db\n\t\t\t\t\t.delete(tables.sessions)\n\t\t\t\t\t.where(eq(tables.sessions.userId, userId))\n\t\t\t\t\t.returning({ id: tables.sessions.id });\n\t\t\t\treturn deleted.length;\n\t\t\t}),\n\n\t\tdeleteExpiredSessions: (before) =>\n\t\t\trun$('deleteExpiredSessions', async () => {\n\t\t\t\treturn deleteAndCount(\n\t\t\t\t\tdb,\n\t\t\t\t\ttables.sessions,\n\t\t\t\t\tlte(tables.sessions.expiresAt, before),\n\t\t\t\t);\n\t\t\t}),\n\t};\n}\n\nasync function reauthenticateSession(\n\tdb: PgDatabase,\n\ttables: IdentityTables,\n\tid: string,\n\tat: Date,\n): Promise<SessionRecord | null> {\n\t// The same condition as an extension's: a confirmation racing a\n\t// revocation matches nothing.\n\tconst [row] = await db\n\t\t.update(tables.sessions)\n\t\t.set({ authenticatedAt: at })\n\t\t.where(and(eq(tables.sessions.id, id), isNull(tables.sessions.revokedAt)))\n\t\t.returning();\n\treturn row === undefined ? null : toSession(row);\n}\n\nasync function revokeSession(\n\tdb: PgDatabase,\n\ttables: IdentityTables,\n\tid: string,\n\tat: Date,\n): Promise<boolean> {\n\t// `coalesce`, so a session already revoked keeps its first\n\t// `revokedAt` and still counts as matched.\n\tconst matched = await db\n\t\t.update(tables.sessions)\n\t\t.set({\n\t\t\trevokedAt: sql`coalesce(${tables.sessions.revokedAt}, ${stamp(at)})`,\n\t\t})\n\t\t.where(eq(tables.sessions.id, id))\n\t\t.returning({ id: tables.sessions.id });\n\treturn matched.length === 1;\n}\n\nasync function revokeUserSessions(\n\tdb: PgDatabase,\n\ttables: IdentityTables,\n\tuserId: string,\n\tat: Date,\n\texcept: string | undefined,\n): Promise<number> {\n\tconst standing = and(\n\t\teq(tables.sessions.userId, userId),\n\t\tisNull(tables.sessions.revokedAt),\n\t);\n\tconst revoked = await db\n\t\t.update(tables.sessions)\n\t\t.set({ revokedAt: at })\n\t\t.where(\n\t\t\texcept === undefined\n\t\t\t\t? standing\n\t\t\t\t: and(standing, ne(tables.sessions.id, except)),\n\t\t)\n\t\t.returning({ id: tables.sessions.id });\n\treturn revoked.length;\n}\n",
+    "import type { PgDatabase } from '@nxgt/drizzle/pg';\nimport { count, type SQL, sql } from 'drizzle-orm';\nimport type { PgTable } from 'drizzle-orm/pg-core';\n\n/**\n * Deletes the rows of `table` matching `where` and answers how many, counted\n * by the server: `with d as (delete … returning 1) select count(*) from d`.\n * A collection can delete millions of rows; none of them reaches the process.\n */\nexport async function deleteAndCount(\n\tdb: PgDatabase,\n\ttable: PgTable,\n\twhere: SQL | undefined,\n): Promise<number> {\n\tconst deleted = db.$with('deleted').as(\n\t\tdb\n\t\t\t.delete(table)\n\t\t\t.where(where)\n\t\t\t.returning({ one: sql<number>`1`.as('one') }),\n\t);\n\tconst [row] = await db.with(deleted).select({ n: count() }).from(deleted);\n\treturn row?.n ?? 0;\n}\n",
     "import type { Id, SessionRecord, UserPatch, UserRecord } from '@nxgt/janus';\nimport { type SQL, sql } from 'drizzle-orm';\nimport type { JanusTables } from '../tables';\n\n// ─── Rows and records ─────────────────────────────────────────────────────\n//\n// Each record is rebuilt field by field: the port's records are exactly what\n// it declares, and a row carries columns the record names differently.\n\ntype UserRow = JanusTables['users']['$inferSelect'];\ntype UserInsert = JanusTables['users']['$inferInsert'];\ntype SessionRow = JanusTables['sessions']['$inferSelect'];\n\nexport function toUserRow(record: UserRecord): UserInsert {\n\treturn {\n\t\tid: record.id,\n\t\ttype: record.type,\n\t\tschemaVersion: record.schemaVersion,\n\t\tactive: record.active,\n\t\tfields: record.fields,\n\t\tlogins: [...record.logins],\n\t\tpasswordHash: record.password?.hash ?? null,\n\t\tpasswordUpdatedAt: record.password?.updatedAt ?? null,\n\t\t...toSecondFactorColumns(record.secondFactor),\n\t\temailVerifiedAt: record.emailVerifiedAt,\n\t\tversion: record.version,\n\t\tcreatedAt: record.createdAt,\n\t\tupdatedAt: record.updatedAt,\n\t};\n}\n\n/**\n * The columns a patch names. A key present with `undefined` is absent, as the\n * port says — never an erasure. `password: null` is named, and removes the\n * password.\n */\nexport function toUserSet(patch: UserPatch): Partial<UserInsert> {\n\tconst set: Partial<UserInsert> = {\n\t\tupdatedAt: patch.updatedAt,\n\t};\n\tif (patch.schemaVersion !== undefined)\n\t\tset.schemaVersion = patch.schemaVersion;\n\tif (patch.active !== undefined) set.active = patch.active;\n\tif (patch.fields !== undefined) set.fields = patch.fields;\n\tif (patch.logins !== undefined) set.logins = [...patch.logins];\n\tif (patch.emailVerifiedAt !== undefined)\n\t\tset.emailVerifiedAt = patch.emailVerifiedAt;\n\tif (patch.password !== undefined) {\n\t\tset.passwordHash = patch.password?.hash ?? null;\n\t\tset.passwordUpdatedAt = patch.password?.updatedAt ?? null;\n\t}\n\tif (patch.secondFactor !== undefined) {\n\t\tObject.assign(set, toSecondFactorColumns(patch.secondFactor));\n\t}\n\treturn set;\n}\n\n/**\n * A second factor as its five columns, all `null` for none. No recovery\n * codes are written `null` too, never `{}`, and read back as `[]`: a row\n * then holds a code array only while it holds codes, so an instance of 0.3\n * — which knows four columns — can still remove a factor that has none.\n */\nfunction toSecondFactorColumns(secondFactor: UserRecord['secondFactor']) {\n\tconst codes = secondFactor?.recoveryCodes ?? [];\n\treturn {\n\t\tsecondFactorMethod: secondFactor?.method ?? null,\n\t\tsecondFactorSecret: secondFactor?.secret ?? null,\n\t\tsecondFactorConfirmedAt: secondFactor?.confirmedAt ?? null,\n\t\tsecondFactorLastStep: secondFactor?.lastStep ?? null,\n\t\tsecondFactorRecoveryCodes: codes.length === 0 ? null : [...codes],\n\t};\n}\n\nexport function toUser(row: UserRow): UserRecord {\n\treturn {\n\t\tid: row.id as Id,\n\t\ttype: row.type,\n\t\tschemaVersion: row.schemaVersion,\n\t\tactive: row.active,\n\t\tfields: row.fields as UserRecord['fields'],\n\t\tlogins: [...row.logins],\n\t\tpassword:\n\t\t\trow.passwordHash === null || row.passwordUpdatedAt === null\n\t\t\t\t? null\n\t\t\t\t: { hash: row.passwordHash, updatedAt: row.passwordUpdatedAt },\n\t\tsecondFactor:\n\t\t\trow.secondFactorMethod === null || row.secondFactorSecret === null\n\t\t\t\t? null\n\t\t\t\t: {\n\t\t\t\t\t\tmethod: row.secondFactorMethod,\n\t\t\t\t\t\tsecret: row.secondFactorSecret,\n\t\t\t\t\t\tconfirmedAt: row.secondFactorConfirmedAt,\n\t\t\t\t\t\tlastStep: row.secondFactorLastStep,\n\t\t\t\t\t\trecoveryCodes: [...(row.secondFactorRecoveryCodes ?? [])],\n\t\t\t\t\t},\n\t\temailVerifiedAt: row.emailVerifiedAt,\n\t\tversion: row.version,\n\t\tcreatedAt: row.createdAt,\n\t\tupdatedAt: row.updatedAt,\n\t};\n}\n\nexport function toSession(row: SessionRow): SessionRecord {\n\treturn {\n\t\tid: row.id,\n\t\ttokenHash: row.tokenHash,\n\t\tuserId: row.userId as Id,\n\t\tauthenticatedAt: row.authenticatedAt,\n\t\texpiresAt: row.expiresAt,\n\t\trevokedAt: row.revokedAt,\n\t\tcreatedAt: row.createdAt,\n\t};\n}\n\n/**\n * A `Date` inside a `sql` template, as every driver takes it: `timestamptz`\n * from its ISO string. Drizzle's column mapping does not reach a raw\n * template, and postgres.js refuses a `Date` object there.\n */\nexport function stamp(at: Date): SQL {\n\treturn sql`${at.toISOString()}::timestamptz`;\n}\n",
-    "import type { PgDatabase } from '@nxgt/drizzle/pg';\nimport type { Id, TokenKind, TokenRecord, TokenStore } from '@nxgt/janus';\nimport { and, eq, isNull, ne, sql } from 'drizzle-orm';\nimport { run } from '../translate';\nimport type { IdentityTables } from './identity-tables';\nimport { stamp } from './records';\n\nexport function tokenStore(db: PgDatabase, tables: IdentityTables): TokenStore {\n\tconst run$ = <T>(operation: string, body: () => Promise<T>) =>\n\t\trun('tokens', operation, body);\n\n\treturn {\n\t\tinsertToken: (record) =>\n\t\t\trun$('insertToken', async () => {\n\t\t\t\t// The hash is the key: a collision is a retry.\n\t\t\t\tawait db.insert(tables.tokens).values(record).onConflictDoNothing();\n\t\t\t}),\n\n\t\tconsumeToken: (tokenHash, kind, at) =>\n\t\t\trun$('consumeToken', () => consumeToken(db, tables, tokenHash, kind, at)),\n\n\t\tcountAttempt: (tokenHash, kind) =>\n\t\t\trun$('countAttempt', () => countAttempt(db, tables, tokenHash, kind)),\n\n\t\tspendUserTokens: (userId, kind, at, except) =>\n\t\t\trun$('spendUserTokens', async () => {\n\t\t\t\t// One statement: each row is written under its lock, and\n\t\t\t\t// re-checked after a concurrent `consumeToken` committed, so the\n\t\t\t\t// two never both spend it.\n\t\t\t\tconst spent = await db\n\t\t\t\t\t.update(tables.tokens)\n\t\t\t\t\t.set({ spentAt: at })\n\t\t\t\t\t.where(\n\t\t\t\t\t\tand(\n\t\t\t\t\t\t\teq(tables.tokens.userId, userId),\n\t\t\t\t\t\t\teq(tables.tokens.kind, kind),\n\t\t\t\t\t\t\tisNull(tables.tokens.spentAt),\n\t\t\t\t\t\t\texcept === undefined\n\t\t\t\t\t\t\t\t? undefined\n\t\t\t\t\t\t\t\t: ne(tables.tokens.tokenHash, except),\n\t\t\t\t\t\t),\n\t\t\t\t\t)\n\t\t\t\t\t.returning({ tokenHash: tables.tokens.tokenHash });\n\t\t\t\treturn spent.length;\n\t\t\t}),\n\n\t\tdeleteUserTokens: (userId) =>\n\t\t\trun$('deleteUserTokens', async () => {\n\t\t\t\tconst deleted = await db\n\t\t\t\t\t.delete(tables.tokens)\n\t\t\t\t\t.where(eq(tables.tokens.userId, userId))\n\t\t\t\t\t.returning({ tokenHash: tables.tokens.tokenHash });\n\t\t\t\treturn deleted.length;\n\t\t\t}),\n\t};\n}\n\nasync function consumeToken(\n\tdb: PgDatabase,\n\ttables: IdentityTables,\n\ttokenHash: string,\n\tkind: TokenKind,\n\tat: Date,\n): Promise<TokenRecord | null> {\n\t// **One conditional write**, answering the row as it was before\n\t// it. `for update` makes a concurrent call wait for this one and\n\t// then read the spent row, so exactly one caller ever reads\n\t// `spentAt: null`; `coalesce` keeps a first `spentAt`.\n\tconst before = db.$with('before').as(\n\t\tdb\n\t\t\t.select()\n\t\t\t.from(tables.tokens)\n\t\t\t.where(\n\t\t\t\tand(\n\t\t\t\t\teq(tables.tokens.tokenHash, tokenHash),\n\t\t\t\t\teq(tables.tokens.kind, kind),\n\t\t\t\t),\n\t\t\t)\n\t\t\t.for('update'),\n\t);\n\tconst [spent] = await db\n\t\t.with(before)\n\t\t.update(tables.tokens)\n\t\t.set({\n\t\t\tspentAt: sql`coalesce(${tables.tokens.spentAt}, ${stamp(at)})`,\n\t\t})\n\t\t.from(before)\n\t\t.where(eq(tables.tokens.tokenHash, before.tokenHash))\n\t\t.returning({\n\t\t\ttokenHash: before.tokenHash,\n\t\t\tkind: before.kind,\n\t\t\tuserId: before.userId,\n\t\t\taddress: before.address,\n\t\t\tcodeHash: before.codeHash,\n\t\t\tattempts: before.attempts,\n\t\t\texpiresAt: before.expiresAt,\n\t\t\tspentAt: before.spentAt,\n\t\t\tcreatedAt: before.createdAt,\n\t\t});\n\treturn spent === undefined ? null : { ...spent, userId: spent.userId as Id };\n}\n\nasync function countAttempt(\n\tdb: PgDatabase,\n\ttables: IdentityTables,\n\ttokenHash: string,\n\tkind: TokenKind,\n): Promise<TokenRecord | null> {\n\t// **One conditional write**: `attempts + 1` on the row, under the\n\t// row's lock, so twenty concurrent calls answer twenty counts. A\n\t// spent token matches nothing here, and is read as it is below.\n\tconst match = and(\n\t\teq(tables.tokens.tokenHash, tokenHash),\n\t\teq(tables.tokens.kind, kind),\n\t);\n\tconst [counted] = await db\n\t\t.update(tables.tokens)\n\t\t.set({ attempts: sql`${tables.tokens.attempts} + 1` })\n\t\t.where(and(match, isNull(tables.tokens.spentAt)))\n\t\t.returning();\n\tconst row =\n\t\tcounted ?? (await db.select().from(tables.tokens).where(match))[0];\n\treturn row === undefined ? null : { ...row, userId: row.userId as Id };\n}\n",
+    "import type { PgDatabase } from '@nxgt/drizzle/pg';\nimport type { Id, TokenKind, TokenRecord, TokenStore } from '@nxgt/janus';\nimport { and, eq, isNull, lte, ne, sql } from 'drizzle-orm';\nimport { run } from '../translate';\nimport { deleteAndCount } from './count-deleted';\nimport type { IdentityTables } from './identity-tables';\nimport { stamp } from './records';\n\nexport function tokenStore(db: PgDatabase, tables: IdentityTables): TokenStore {\n\tconst run$ = <T>(operation: string, body: () => Promise<T>) =>\n\t\trun('tokens', operation, body);\n\n\treturn {\n\t\tinsertToken: (record) =>\n\t\t\trun$('insertToken', async () => {\n\t\t\t\t// The hash is the key: a collision is a retry.\n\t\t\t\tawait db.insert(tables.tokens).values(record).onConflictDoNothing();\n\t\t\t}),\n\n\t\tconsumeToken: (tokenHash, kind, at) =>\n\t\t\trun$('consumeToken', () => consumeToken(db, tables, tokenHash, kind, at)),\n\n\t\tcountAttempt: (tokenHash, kind) =>\n\t\t\trun$('countAttempt', () => countAttempt(db, tables, tokenHash, kind)),\n\n\t\tspendUserTokens: (userId, kind, at, except) =>\n\t\t\trun$('spendUserTokens', async () => {\n\t\t\t\t// One statement: each row is written under its lock, and\n\t\t\t\t// re-checked after a concurrent `consumeToken` committed, so the\n\t\t\t\t// two never both spend it.\n\t\t\t\tconst spent = await db\n\t\t\t\t\t.update(tables.tokens)\n\t\t\t\t\t.set({ spentAt: at })\n\t\t\t\t\t.where(\n\t\t\t\t\t\tand(\n\t\t\t\t\t\t\teq(tables.tokens.userId, userId),\n\t\t\t\t\t\t\teq(tables.tokens.kind, kind),\n\t\t\t\t\t\t\tisNull(tables.tokens.spentAt),\n\t\t\t\t\t\t\texcept === undefined\n\t\t\t\t\t\t\t\t? undefined\n\t\t\t\t\t\t\t\t: ne(tables.tokens.tokenHash, except),\n\t\t\t\t\t\t),\n\t\t\t\t\t)\n\t\t\t\t\t.returning({ tokenHash: tables.tokens.tokenHash });\n\t\t\t\treturn spent.length;\n\t\t\t}),\n\n\t\tdeleteUserTokens: (userId) =>\n\t\t\trun$('deleteUserTokens', async () => {\n\t\t\t\tconst deleted = await db\n\t\t\t\t\t.delete(tables.tokens)\n\t\t\t\t\t.where(eq(tables.tokens.userId, userId))\n\t\t\t\t\t.returning({ tokenHash: tables.tokens.tokenHash });\n\t\t\t\treturn deleted.length;\n\t\t\t}),\n\n\t\tdeleteExpiredTokens: (before) =>\n\t\t\trun$('deleteExpiredTokens', async () => {\n\t\t\t\t// Spent or not, of any kind and any user: a throttle's count is a\n\t\t\t\t// token too. A row that lapses later is never touched.\n\t\t\t\treturn deleteAndCount(\n\t\t\t\t\tdb,\n\t\t\t\t\ttables.tokens,\n\t\t\t\t\tlte(tables.tokens.expiresAt, before),\n\t\t\t\t);\n\t\t\t}),\n\t};\n}\n\nasync function consumeToken(\n\tdb: PgDatabase,\n\ttables: IdentityTables,\n\ttokenHash: string,\n\tkind: TokenKind,\n\tat: Date,\n): Promise<TokenRecord | null> {\n\t// **One conditional write**, answering the row as it was before\n\t// it. `for update` makes a concurrent call wait for this one and\n\t// then read the spent row, so exactly one caller ever reads\n\t// `spentAt: null`; `coalesce` keeps a first `spentAt`.\n\tconst before = db.$with('before').as(\n\t\tdb\n\t\t\t.select()\n\t\t\t.from(tables.tokens)\n\t\t\t.where(\n\t\t\t\tand(\n\t\t\t\t\teq(tables.tokens.tokenHash, tokenHash),\n\t\t\t\t\teq(tables.tokens.kind, kind),\n\t\t\t\t),\n\t\t\t)\n\t\t\t.for('update'),\n\t);\n\tconst [spent] = await db\n\t\t.with(before)\n\t\t.update(tables.tokens)\n\t\t.set({\n\t\t\tspentAt: sql`coalesce(${tables.tokens.spentAt}, ${stamp(at)})`,\n\t\t})\n\t\t.from(before)\n\t\t.where(eq(tables.tokens.tokenHash, before.tokenHash))\n\t\t.returning({\n\t\t\ttokenHash: before.tokenHash,\n\t\t\tkind: before.kind,\n\t\t\tuserId: before.userId,\n\t\t\taddress: before.address,\n\t\t\tcodeHash: before.codeHash,\n\t\t\tattempts: before.attempts,\n\t\t\texpiresAt: before.expiresAt,\n\t\t\tspentAt: before.spentAt,\n\t\t\tcreatedAt: before.createdAt,\n\t\t});\n\treturn spent === undefined ? null : { ...spent, userId: spent.userId as Id };\n}\n\nasync function countAttempt(\n\tdb: PgDatabase,\n\ttables: IdentityTables,\n\ttokenHash: string,\n\tkind: TokenKind,\n): Promise<TokenRecord | null> {\n\t// **One conditional write**: `attempts + 1` on the row, under the\n\t// row's lock, so twenty concurrent calls answer twenty counts. A\n\t// spent token matches nothing here, and is read as it is below.\n\tconst match = and(\n\t\teq(tables.tokens.tokenHash, tokenHash),\n\t\teq(tables.tokens.kind, kind),\n\t);\n\tconst [counted] = await db\n\t\t.update(tables.tokens)\n\t\t.set({ attempts: sql`${tables.tokens.attempts} + 1` })\n\t\t.where(and(match, isNull(tables.tokens.spentAt)))\n\t\t.returning();\n\tconst row =\n\t\tcounted ?? (await db.select().from(tables.tokens).where(match))[0];\n\treturn row === undefined ? null : { ...row, userId: row.userId as Id };\n}\n",
     "import { type PgDatabase, withTransaction } from '@nxgt/drizzle/pg';\nimport type { UserPatch, UserRecord, UserStore } from '@nxgt/janus';\nimport { NotFoundError, StoreConflict } from '@nxgt/janus';\nimport { and, asc, eq, gt, inArray, sql } from 'drizzle-orm';\nimport { run } from '../translate';\nimport type { IdentityTables } from './identity-tables';\nimport { claimLogins } from './logins';\nimport { toUser, toUserRow, toUserSet } from './records';\n\nexport function userStore(db: PgDatabase, tables: IdentityTables): UserStore {\n\tconst run$ = <T>(operation: string, body: () => Promise<T>) =>\n\t\trun('users', operation, body);\n\n\treturn {\n\t\tinsertUser: (record) =>\n\t\t\trun$('insertUser', () => insertUser(db, tables, record)),\n\n\t\tfindUser: (id) => run$('findUser', () => findUser(db, tables, id)),\n\n\t\t// One statement, whatever the number of ids: the core sends at most\n\t\t// 100, distinct, and puts the answer back in its caller's order.\n\t\tfindUsers: (ids) =>\n\t\t\trun$('findUsers', async () => {\n\t\t\t\tconst found = await db\n\t\t\t\t\t.select()\n\t\t\t\t\t.from(tables.users)\n\t\t\t\t\t.where(inArray(tables.users.id, [...ids]));\n\t\t\t\treturn found.map(toUser);\n\t\t\t}),\n\n\t\tfindUserByLogin: (type, login) =>\n\t\t\trun$('findUserByLogin', async () => {\n\t\t\t\tconst [row] = await db\n\t\t\t\t\t.select({ user: tables.users })\n\t\t\t\t\t.from(tables.logins)\n\t\t\t\t\t.innerJoin(tables.users, eq(tables.users.id, tables.logins.userId))\n\t\t\t\t\t.where(\n\t\t\t\t\t\tand(eq(tables.logins.type, type), eq(tables.logins.login, login)),\n\t\t\t\t\t);\n\t\t\t\treturn row === undefined ? null : toUser(row.user);\n\t\t\t}),\n\n\t\tlistUsers: ({ type, after, limit }) =>\n\t\t\trun$('listUsers', async () => {\n\t\t\t\t// One more than the page, to know whether another follows.\n\t\t\t\tconst found = await db\n\t\t\t\t\t.select()\n\t\t\t\t\t.from(tables.users)\n\t\t\t\t\t.where(\n\t\t\t\t\t\tafter === null\n\t\t\t\t\t\t\t? eq(tables.users.type, type)\n\t\t\t\t\t\t\t: and(eq(tables.users.type, type), gt(tables.users.id, after)),\n\t\t\t\t\t)\n\t\t\t\t\t.orderBy(asc(tables.users.id))\n\t\t\t\t\t.limit(limit + 1);\n\t\t\t\tconst items = found.slice(0, limit).map(toUser);\n\t\t\t\tconst last = items.at(-1);\n\t\t\t\treturn {\n\t\t\t\t\titems,\n\t\t\t\t\tnextCursor:\n\t\t\t\t\t\tfound.length > limit && last !== undefined ? last.id : null,\n\t\t\t\t};\n\t\t\t}),\n\n\t\tupdateUser: (id, patch, ifVersion) =>\n\t\t\trun$('updateUser', () =>\n\t\t\t\twithTransaction(db, (tx) =>\n\t\t\t\t\tupdateUser(tx, tables, id, patch, ifVersion),\n\t\t\t\t),\n\t\t\t),\n\n\t\tdeleteUser: (id) =>\n\t\t\trun$('deleteUser', async () => {\n\t\t\t\t// The logins go with it: their foreign key cascades.\n\t\t\t\tconst deleted = await db\n\t\t\t\t\t.delete(tables.users)\n\t\t\t\t\t.where(eq(tables.users.id, id))\n\t\t\t\t\t.returning({ id: tables.users.id });\n\t\t\t\treturn deleted.length === 1;\n\t\t\t}),\n\t};\n}\n\nasync function findUser(\n\tdb: PgDatabase,\n\ttables: IdentityTables,\n\tid: string,\n): Promise<UserRecord | null> {\n\tconst [row] = await db\n\t\t.select()\n\t\t.from(tables.users)\n\t\t.where(eq(tables.users.id, id));\n\treturn row === undefined ? null : toUser(row);\n}\n\nasync function insertUser(\n\tdb: PgDatabase,\n\ttables: IdentityTables,\n\trecord: UserRecord,\n): Promise<UserRecord> {\n\tconst inserted = await withTransaction(db, async (tx) => {\n\t\tconst [row] = await tx\n\t\t\t.insert(tables.users)\n\t\t\t.values(toUserRow(record))\n\t\t\t.onConflictDoNothing({ target: tables.users.id })\n\t\t\t.returning();\n\t\tif (row === undefined) return null;\n\t\tawait claimLogins(tx, tables, 'insertUser', record, record.logins);\n\t\treturn toUser(row);\n\t});\n\tif (inserted !== null) return inserted;\n\n\t// A retry whose first attempt landed: the user with this id is\n\t// there, and is the answer — logins included, which are theirs.\n\tconst stored = await findUser(db, tables, record.id);\n\tif (stored !== null) return stored;\n\t// Deleted between the two statements: a retry of nothing.\n\tthrow new NotFoundError('insertUser: the user was deleted meanwhile', {\n\t\tuserId: record.id,\n\t\toperation: 'insertUser',\n\t});\n}\n\nasync function updateUser(\n\ttx: PgDatabase,\n\ttables: IdentityTables,\n\tid: string,\n\tpatch: UserPatch,\n\tifVersion: number,\n): Promise<UserRecord> {\n\tconst [row] = await tx\n\t\t.update(tables.users)\n\t\t.set({\n\t\t\t...toUserSet(patch),\n\t\t\tversion: sql`${tables.users.version} + 1`,\n\t\t})\n\t\t.where(and(eq(tables.users.id, id), eq(tables.users.version, ifVersion)))\n\t\t.returning();\n\n\tif (row === undefined) {\n\t\t// The write matched nothing, which alone cannot tell an unknown\n\t\t// id from a moved version: read again, and say which.\n\t\tconst [stored] = await tx\n\t\t\t.select({ version: tables.users.version })\n\t\t\t.from(tables.users)\n\t\t\t.where(eq(tables.users.id, id));\n\t\tif (stored === undefined) {\n\t\t\tthrow new NotFoundError('updateUser: no user has this id', {\n\t\t\t\tuserId: id,\n\t\t\t\toperation: 'updateUser',\n\t\t\t});\n\t\t}\n\t\tthrow new StoreConflict(\n\t\t\t'version',\n\t\t\t`updateUser: expected version ${ifVersion}, found ${stored.version}`,\n\t\t\t{\n\t\t\t\tuserId: id,\n\t\t\t\texpectedVersion: ifVersion,\n\t\t\t\tactualVersion: stored.version,\n\t\t\t\toperation: 'updateUser',\n\t\t\t},\n\t\t);\n\t}\n\n\tif (patch.logins !== undefined) {\n\t\tawait tx.delete(tables.logins).where(eq(tables.logins.userId, id));\n\t\tawait claimLogins(tx, tables, 'updateUser', row, patch.logins);\n\t}\n\treturn toUser(row);\n}\n",
     "import type { PgDatabase } from '@nxgt/drizzle/pg';\nimport { loginTaken } from '../translate';\nimport type { IdentityTables } from './identity-tables';\n\n/**\n * Writes the logins of one user, and throws the port's conflict for the\n * first one another user of the type holds. `on conflict do nothing`: a\n * login the statement did not write is one somebody else holds, and a\n * concurrent sign-up waits for the first to commit, then writes nothing.\n */\nexport async function claimLogins(\n\ttx: PgDatabase,\n\ttables: IdentityTables,\n\toperation: string,\n\tuser: { readonly id: string; readonly type: string },\n\tlogins: readonly string[],\n): Promise<void> {\n\t// Sorted: two transactions claiming the same logins take their locks in\n\t// one order, and never deadlock — the loser waits, then finds them taken.\n\tconst distinct = [...new Set(logins)].sort();\n\tif (distinct.length === 0) return;\n\tconst written = await tx\n\t\t.insert(tables.logins)\n\t\t.values(\n\t\t\tdistinct.map((login) => ({ type: user.type, login, userId: user.id })),\n\t\t)\n\t\t.onConflictDoNothing()\n\t\t.returning({ login: tables.logins.login });\n\tif (written.length === distinct.length) return;\n\tconst claimed = new Set(written.map((row) => row.login));\n\tconst taken = distinct.find((login) => !claimed.has(login)) ?? '';\n\tthrow loginTaken(operation, user.type, taken);\n}\n",
     "import type { PgDatabase } from '@nxgt/drizzle/pg';\nimport type { JanusStores } from '@nxgt/janus';\nimport { type DrizzleAdapterOptions, defineJanusTables } from '../tables';\nimport type { IdentityTable } from './identity-tables';\nimport { sessionStore } from './sessions';\nimport { tokenStore } from './tokens';\nimport { userStore } from './users';\n\n/**\n * The three stores `janus()` takes, over one PostgreSQL database through\n * Drizzle.\n *\n * ```ts\n * const db = drizzle(process.env.DATABASE_URL);\n * const auth = janus({ user, password: { login: 'email' }, store: createDrizzleStores(db), hasher });\n * ```\n *\n * **Every read is one statement**, whose absence is an empty result, turned\n * into `null` here; everything that arrives as a rejection is a failure. There\n * is no path on which an absence and an outage travel the same channel.\n *\n * **A user is written in one transaction** with its logins, whose table holds\n * their uniqueness — `@nxgt/drizzle`'s `withTransaction`, inside the method,\n * as rule 5 allows. Every other write is one statement.\n *\n * `sessions.deleteExpiredSessions` is implemented: PostgreSQL has no TTL, so\n * `auth.collectExpired()` is how lapsed sessions leave the table.\n *\n * `{ tables }` is what your schema file exports; absent, the tables in the\n * connection's `search_path`.\n */\nexport function createDrizzleStores(\n\tdb: PgDatabase,\n\toptions: DrizzleAdapterOptions<IdentityTable> = {},\n): JanusStores {\n\tconst tables = options.tables ?? defineJanusTables();\n\treturn {\n\t\tusers: userStore(db, tables),\n\t\tsessions: sessionStore(db, tables),\n\t\ttokens: tokenStore(db, tables),\n\t};\n}\n",
     "import type { PgDatabase } from '@nxgt/drizzle/pg';\nimport type { JanusStores } from '@nxgt/janus';\nimport type { RelationStore } from '@nxgt/janus/permissions';\nimport { createDrizzleRelations } from './relations';\nimport { createDrizzleStores } from './stores';\nimport type { DrizzleAdapterOptions } from './tables';\n\n/** The whole adapter over one database, keyed as `janus()` takes it. */\nexport interface DrizzleAdapter {\n\t/** The identity stores: `createDrizzleStores(db)`. */\n\treadonly store: JanusStores;\n\t/** The relation store: `createDrizzleRelations(db)`. */\n\treadonly relations: RelationStore;\n}\n\n/**\n * The identity stores and the relation store over one database, under the\n * names `janus()` takes them — so one spread wires both, and deleting a user\n * deletes every tuple naming them:\n *\n * ```ts\n * const postgres = createDrizzleAdapter(db);\n * const auth = janus({ user, password: { login: 'email' }, hasher, ...postgres });\n * const access = permissions({ model, store: postgres.relations });\n * ```\n *\n * It connects to nothing and creates nothing: `db` is your Drizzle instance,\n * and the tables are your migrations'. `{ tables }` is what your schema file\n * exports, needed when they are in a PostgreSQL schema of their own. An\n * application that only authenticates can take `createDrizzleStores(db)` alone.\n */\nexport function createDrizzleAdapter(\n\tdb: PgDatabase,\n\toptions: DrizzleAdapterOptions = {},\n): DrizzleAdapter {\n\treturn {\n\t\tstore: createDrizzleStores(db, options),\n\t\trelations: createDrizzleRelations(db, options),\n\t};\n}\n"
   ],
-  "mappings": ";AAAA;;;ACAA;;;ACEA;AAUO,IAAM,MAAM,WAAiD;AAAA,EACnE,UAAU,MAAM;AACjB,CAAC;AAKM,IAAM,KAAK,CAAC,SAClB,UAAU,MAAM,EAAE,cAAc,MAAM,WAAW,EAAE,CAAC;;;ADT9C,SAAS,WAAW,CAC1B,OACA,OACC;AAAA,EACD,OAAO,MACN,UACA;AAAA,IACC,MAAM,IAAI,MAAM,EAAE,QAAQ;AAAA,IAC1B,OAAO,IAAI,OAAO,EAAE,QAAQ;AAAA,IAC5B,QAAQ,IAAI,SAAS,EAAE,QAAQ;AAAA,EAChC,GACA,CAAC,MAAM;AAAA,IACN,WAAW,EAAE,MAAM,eAAe,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAAA,IAC9D,WAAW;AAAA,MACV,MAAM;AAAA,MACN,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAI;AAAA,MAC1B,gBAAgB,CAAC,MAAM,IAAI,MAAM,IAAI;AAAA,IACtC,CAAC,EAAE,SAAS,SAAS;AAAA,IACrB,MAAM,gBAAgB,EAAE,GAAG,EAAE,MAAM;AAAA,EACpC,CACD;AAAA;;;AE/BD,kBAAS;AAaF,SAAS,cAAc,CAAC,OAAqB;AAAA,EACnD,OAAO,MACN,aACA;AAAA,IACC,YAAY,IAAI,aAAa,EAAE,QAAQ;AAAA,IACvC,UAAU,IAAI,WAAW,EAAE,QAAQ;AAAA,IACnC,UAAU,IAAI,UAAU,EAAE,QAAQ;AAAA,IAClC,aAAa,IAAI,cAAc,EAAE,QAAQ;AAAA,IACzC,WAAW,IAAI,YAAY,EAAE,QAAQ;AAAA,IACrC,iBAAiB,IAAI,kBAAkB;AAAA,EACxC,GACA,CAAC,MAAM;AAAA,IACN,OAAO,wBAAwB,EAC7B,GACA,EAAE,aACF,EAAE,WACF,EAAE,iBACF,EAAE,UACF,EAAE,YACF,EAAE,QACH,EACC,iBAAiB;AAAA,IAEnB,OAAM,kBAAkB,EAAE,GAAG,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ;AAAA,EAClE,CACD;AAAA;;;ACtCD,kBAAS,kBAAO;AAQT,SAAS,aAAa,CAAC,OAAqB;AAAA,EAClD,OAAO,MACN,YACA;AAAA,IACC,IAAI,IAAI,IAAI,EAAE,WAAW;AAAA,IAEzB,WAAW,IAAI,YAAY,EAAE,QAAQ;AAAA,IACrC,QAAQ,IAAI,SAAS,EAAE,QAAQ;AAAA,IAC/B,iBAAiB,GAAG,kBAAkB,EAAE,QAAQ;AAAA,IAChD,WAAW,GAAG,YAAY,EAAE,QAAQ;AAAA,IACpC,WAAW,GAAG,YAAY;AAAA,IAC1B,WAAW,GAAG,YAAY,EAAE,QAAQ;AAAA,EACrC,GACA,CAAC,MAAM;AAAA,IACN,QAAO,4BAA4B,EAAE,GAAG,EAAE,SAAS;AAAA,IACnD,OAAM,kBAAkB,EAAE,GAAG,EAAE,MAAM;AAAA,IAErC,OAAM,qBAAqB,EAAE,GAAG,EAAE,SAAS;AAAA,EAC5C,CACD;AAAA;;;AC3BD;AACA,yBAAgB;AAIT,SAAS,WAAW,CAAC,OAAqB;AAAA,EAChD,OAAO,MACN,UACA;AAAA,IACC,WAAW,IAAI,YAAY,EAAE,WAAW;AAAA,IACxC,MAAM,KAAK,QAAQ;AAAA,MAClB,MAAM;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACD;AAAA,IACD,CAAC,EAAE,QAAQ;AAAA,IACX,QAAQ,IAAI,SAAS,EAAE,QAAQ;AAAA,IAC/B,SAAS,KAAK,SAAS,EAAE,QAAQ;AAAA,IAKjC,UAAU,KAAK,WAAW;AAAA,IAE1B,UAAU,QAAQ,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC;AAAA,IACjD,WAAW,GAAG,YAAY,EAAE,QAAQ;AAAA,IACpC,SAAS,GAAG,UAAU;AAAA,IACtB,WAAW,GAAG,YAAY,EAAE,QAAQ;AAAA,EACrC,GACA,CAAC,MAAM;AAAA,IACN,MACC,eACA,MAAM,EAAE,8GACT;AAAA,IACA,MAAM,mBAAmB,MAAM,EAAE,eAAe;AAAA,IAChD,OAAM,gBAAgB,EAAE,GAAG,EAAE,MAAM;AAAA,EACpC,CACD;AAAA;;;AC1CD,gBAAS;AACT;AAAA;AAAA,WAEC;AAAA,WACA;AAAA,aACA;AAAA;AAAA,UAEA;AAAA,YACA;AAAA;AAQM,SAAS,UAAU,CAAC,OAAqB;AAAA,EAC/C,OAAO,MACN,SACA;AAAA,IAEC,IAAI,IAAI,IAAI,EAAE,WAAW;AAAA,IACzB,MAAM,IAAI,MAAM,EAAE,QAAQ;AAAA,IAC1B,eAAe,MAAK,gBAAgB,EAAE,QAAQ;AAAA,IAC9C,QAAQ,QAAQ,QAAQ,EAAE,QAAQ;AAAA,IAElC,QAAQ,MAAM,QAAQ,EAAE,QAAQ;AAAA,IAChC,QAAQ,MAAK,QAAQ,EAAE,MAAM,EAAE,QAAQ;AAAA,IACvC,cAAc,MAAK,eAAe;AAAA,IAClC,mBAAmB,GAAG,qBAAqB;AAAA,IAE3C,oBAAoB,MAAK,wBAAwB,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;AAAA,IAEnE,oBAAoB,MAAK,sBAAsB;AAAA,IAC/C,yBAAyB,GAAG,4BAA4B;AAAA,IACxD,sBAAsB,SAAQ,yBAAyB;AAAA,IAMvD,2BAA2B,MAAK,8BAA8B,EAAE,MAAM;AAAA,IACtE,iBAAiB,GAAG,mBAAmB;AAAA,IACvC,SAAS,SAAQ,SAAS,EAAE,QAAQ;AAAA,IACpC,WAAW,GAAG,YAAY,EAAE,QAAQ;AAAA,IACpC,WAAW,GAAG,YAAY,EAAE,QAAQ;AAAA,EACrC,GACA,CAAC,MAAM;AAAA,IAEN,QAAO,sBAAsB,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI;AAAA,IAE9C,OAAM,eAAe,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;AAAA,IAEtC,OACC,wBACA,QAAO,EAAE,4BAA4B,EAAE,4BACxC;AAAA,IAKA,OACC,6BACA,QAAO,EAAE,kCAAkC,EAAE,oCAAoC,EAAE,sCAAsC,EAAE,uCAAuC,EAAE,oCAAoC,EAAE,qCAC3M;AAAA,IAEA,OACC,8BACA,OAAM,EAAE,sCAAsC,EAAE,2BACjD;AAAA,EACD,CACD;AAAA;;;ANfM,SAAS,iBAAiB,CAAC,UAA8B,CAAC,GAAG;AAAA,EACnE,QAAQ,WAAW;AAAA,EACnB,MAAM,QAAS,WAAW,YAAY,UAAU,OAAO;AAAA,EACvD,MAAM,QAAQ,WAAW,KAAK;AAAA,EAC9B,MAAM,SAAS,YAAY,OAAO,KAAK;AAAA,EACvC,MAAM,WAAW,cAAc,KAAK;AAAA,EACpC,MAAM,SAAS,YAAY,KAAK;AAAA,EAChC,MAAM,YAAY,eAAe,KAAK;AAAA,EACtC,OAAO,EAAE,OAAO,QAAQ,UAAU,QAAQ,UAAU;AAAA;;;AOhErD;AACA;AA8BA,eAAsB,GAAM,CAC3B,MACA,WACA,MACa;AAAA,EACb,IAAI;AAAA,IACH,OAAO,MAAM,KAAK;AAAA,IACjB,OAAO,OAAO;AAAA,IAEf,IAAI,iBAAiB;AAAA,MAAY,MAAM;AAAA,IACvC,MAAM,IAAI,aAAa,GAAG,QAAQ,yCAAyC;AAAA,MAC1E;AAAA,MACA;AAAA,MACA,OAAO,YAAY,KAAK;AAAA,IACzB,CAAC;AAAA;AAAA;AAKI,SAAS,UAAU,CACzB,WACA,MACA,OACgB;AAAA,EAChB,OAAO,IAAI,cACV,SACA,GAAG,4CAA4C,QAC/C,EAAE,OAAO,UAAU,MAAM,UAAU,CACpC;AAAA;;;ACpDD,gBAAS,iBAAU,8BAAmB;;;ACPtC;AACA;AAIO,SAAS,OAAO,CACtB,QAC2B;AAAA,EAC3B,MAAM,QAAQ,CAAC,UACd,KAAK,UAAU;AAAA,IACd,MAAM,OAAO;AAAA,IACb,MAAM,OAAO;AAAA,IACb,MAAM;AAAA,IACN,MAAM,QAAQ;AAAA,IACd,MAAM,QAAQ;AAAA,IACd,aAAa,MAAM,OAAO,IAAI,MAAM,QAAQ,WAAW;AAAA,EACxD,CAAC;AAAA,EACF,OAAO,CAAC,GAAG,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM;AAAA,IACjC,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC;AAAA,IAClC,OAAO,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI;AAAA,GAChC;AAAA;AAIK,SAAS,KAAK,CAAC,OAAiD;AAAA,EACtE,OAAO;AAAA,IACN,YAAY,MAAM,OAAO;AAAA,IACzB,UAAU,MAAM,OAAO;AAAA,IACvB,UAAU,MAAM;AAAA,IAChB,aAAa,MAAM,QAAQ;AAAA,IAC3B,WAAW,MAAM,QAAQ;AAAA,IACzB,iBAAiB,aAAa,MAAM,OAAO,IACxC,MAAM,QAAQ,WACd;AAAA,EACJ;AAAA;AAIM,SAAS,SAAS,CACxB,WACA,SACkB;AAAA,EAClB,OAAO,IACN,GAAG,UAAU,aAAa,QAAQ,IAAI,GACtC,GAAG,UAAU,WAAW,QAAQ,EAAE,GAClC,aAAa,OAAO,IACjB,GAAG,UAAU,iBAAiB,QAAQ,QAAQ,IAC9C,OAAO,UAAU,eAAe,CACpC;AAAA;AAIM,SAAS,QAAQ,CACvB,WACA,OACkB;AAAA,EAClB,OAAO,IACN,GAAG,UAAU,YAAY,MAAM,OAAO,IAAI,GAC1C,GAAG,UAAU,UAAU,MAAM,OAAO,EAAE,GACtC,GAAG,UAAU,UAAU,MAAM,QAAQ,GACrC,UAAU,WAAW,MAAM,OAAO,CACnC;AAAA;;;ADlDD,eAAsB,GAAG,GACtB,IAAI,aACN,OACmB;AAAA,EACnB,MAAM,QAAQ,MAAM,GAClB,OAAO,EAAE,UAAU,UAAU,SAAS,CAAC,EACvC,KAAK,SAAS,EACd,MAAM,SAAS,WAAW,KAAK,CAAC,EAChC,MAAM,CAAC;AAAA,EACT,OAAO,MAAM,WAAW;AAAA;AAGzB,eAAsB,eAAe,CACpC,SACA,QACA,UACwB;AAAA,EACxB,QAAQ,MAAM,QAAQ,SAAS,QAAQ,UAAU,IAAI,GAAG,IACvD,CAAC,SAAqB;AAAA,IACrB,MAAM,IAAI;AAAA,IACV,IAAI,IAAI;AAAA,IACR,UAAU,IAAI,YAAY;AAAA,EAC3B,EACD;AAAA;AAGD,eAAsB,YAAY,CACjC,SACA,QACA,UACoB;AAAA,EACpB,QAAQ,MAAM,QAAQ,SAAS,QAAQ,UAAU,KAAK,GAAG,IACxD,CAAC,SAAiB,EAAE,MAAM,IAAI,MAAM,IAAI,IAAI,GAAG,EAChD;AAAA;AAID,SAAS,OAAO,GACb,IAAI,aACN,QACA,UACA,MACC;AAAA,EACD,OAAO,GACL,OAAO;AAAA,IACP,MAAM,UAAU;AAAA,IAChB,IAAI,UAAU;AAAA,IACd,UAAU,UAAU;AAAA,EACrB,CAAC,EACA,KAAK,SAAS,EACd,MACA,KACC,IAAG,UAAU,YAAY,OAAO,IAAI,GACpC,IAAG,UAAU,UAAU,OAAO,EAAE,GAChC,IAAG,UAAU,UAAU,QAAQ,GAC/B,OACG,UAAU,UAAU,eAAe,IACnC,QAAO,UAAU,eAAe,CACpC,CACD;AAAA;AAIF,eAAsB,WAAW,GAC9B,IAAI,eACJ,MAAM,UAAU,SAAS,OAAO,SACJ;AAAA,EAC9B,MAAM,aAAa;AAAA,IAClB,UAAU,WAAW,OAAO;AAAA,IAC5B,IAAG,UAAU,UAAU,QAAQ;AAAA,IAC/B,IAAG,UAAU,YAAY,IAAI;AAAA,EAC9B;AAAA,EACA,IAAI,UAAU;AAAA,IAAM,WAAW,KAAK,GAAG,UAAU,UAAU,KAAK,CAAC;AAAA,EACjE,MAAM,QAAQ,MAAM,GAClB,OAAO,EAAE,IAAI,UAAU,SAAS,CAAC,EACjC,KAAK,SAAS,EACd,MAAM,KAAI,GAAG,UAAU,CAAC,EACxB,QAAQ,IAAI,UAAU,QAAQ,CAAC,EAC/B,MAAM,QAAQ,CAAC;AAAA,EACjB,MAAM,QAAQ,MAAM,MAAM,GAAG,KAAK,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE;AAAA,EACvD,MAAM,OAAO,MAAM,GAAG,EAAE;AAAA,EACxB,OAAO;AAAA,IACN;AAAA,IACA,YAAY,MAAM,SAAS,SAAS,SAAS,YAAY,OAAO;AAAA,EACjE;AAAA;;;AE/FD;AAEA,gBAAS,YAAK;AAKd,eAAsB,KAAK,GACxB,IAAI,aACN,KACA,QACgB;AAAA,EAChB,IAAI,IAAI,SAAS,OAAO,UAAU;AAAA,IAAG,OAAO,MAAM,IAAI,WAAW,KAAK,MAAM;AAAA,EAC5E,MAAM,gBAAgB,IAAI,CAAC,OAAO,MAAM,IAAI,WAAW,KAAK,MAAM,CAAC;AAAA;AAIpE,eAAe,KAAK,CACnB,IACA,WACA,KACA,QACgB;AAAA,EAGhB,WAAW,SAAS,QAAQ,MAAM,GAAG;AAAA,IACpC,MAAM,GAAG,OAAO,SAAS,EAAE,MAAM,SAAS,WAAW,KAAK,CAAC;AAAA,EAC5D;AAAA,EACA,IAAI,IAAI,SAAS,GAAG;AAAA,IAEnB,MAAM,GACJ,OAAO,SAAS,EAChB,OAAO,QAAQ,GAAG,EAAE,IAAI,KAAK,CAAC,EAC9B,oBAAoB;AAAA,EACvB;AAAA;AAID,eAAsB,YAAY,GAC/B,IAAI,aACN,QACkB;AAAA,EAClB,MAAM,UAAU,MAAM,GACpB,OAAO,SAAS,EAChB,MACA,GACC,KACC,IAAG,UAAU,YAAY,OAAO,IAAI,GACpC,IAAG,UAAU,UAAU,OAAO,EAAE,CACjC,GACA,KACC,IAAG,UAAU,aAAa,OAAO,IAAI,GACrC,IAAG,UAAU,WAAW,OAAO,EAAE,CAClC,CACD,CACD,EACC,UAAU,EAAE,UAAU,UAAU,SAAS,CAAC;AAAA,EAC5C,OAAO,QAAQ;AAAA;;;ACpCT,SAAS,sBAAsB,CACrC,IACA,UAA8C,CAAC,GAC/B;AAAA,EAChB,MAAM,SAAS,QAAQ,UAAU,kBAAkB;AAAA,EACnD,MAAM,UAA2B,EAAE,IAAI,WAAW,OAAO,UAAU;AAAA,EACnE,MAAM,OAAO,CAAI,WAAmB,SACnC,IAAI,aAAa,WAAW,IAAI;AAAA,EAEjC,OAAO;AAAA,IACN,OAAO,GAAG,MAAM,CAAC,GAAG,SAAS,CAAC,QAC7B,KAAK,SAAS,MAAM,MAAM,SAAS,KAAK,MAAM,CAAC;AAAA,IAChD,KAAK,CAAC,UAAU,KAAK,OAAO,MAAM,IAAI,SAAS,KAAK,CAAC;AAAA,IACrD,iBAAiB,CAAC,QAAQ,aACzB,KAAK,mBAAmB,MAAM,gBAAgB,SAAS,QAAQ,QAAQ,CAAC;AAAA,IACzE,cAAc,CAAC,QAAQ,aACtB,KAAK,gBAAgB,MAAM,aAAa,SAAS,QAAQ,QAAQ,CAAC;AAAA,IAInE,aAAa,GAAG,MAAM,UAAU,SAAS,OAAO,YAC/C,KAAK,eAAe,MACnB,YAAY,SAAS,EAAE,MAAM,UAAU,SAAS,OAAO,MAAM,CAAC,CAC/D;AAAA,IACD,cAAc,CAAC,WACd,KAAK,gBAAgB,MAAM,aAAa,SAAS,MAAM,CAAC;AAAA,EAC1D;AAAA;;;AC7CD,gBAAS,YAAK,eAAI,yBAAiB;;;ACDnC,gBAAmB;AAYZ,SAAS,SAAS,CAAC,QAAgC;AAAA,EACzD,OAAO;AAAA,IACN,IAAI,OAAO;AAAA,IACX,MAAM,OAAO;AAAA,IACb,eAAe,OAAO;AAAA,IACtB,QAAQ,OAAO;AAAA,IACf,QAAQ,OAAO;AAAA,IACf,QAAQ,CAAC,GAAG,OAAO,MAAM;AAAA,IACzB,cAAc,OAAO,UAAU,QAAQ;AAAA,IACvC,mBAAmB,OAAO,UAAU,aAAa;AAAA,OAC9C,sBAAsB,OAAO,YAAY;AAAA,IAC5C,iBAAiB,OAAO;AAAA,IACxB,SAAS,OAAO;AAAA,IAChB,WAAW,OAAO;AAAA,IAClB,WAAW,OAAO;AAAA,EACnB;AAAA;AAQM,SAAS,SAAS,CAAC,OAAuC;AAAA,EAChE,MAAM,MAA2B;AAAA,IAChC,WAAW,MAAM;AAAA,EAClB;AAAA,EACA,IAAI,MAAM,kBAAkB;AAAA,IAC3B,IAAI,gBAAgB,MAAM;AAAA,EAC3B,IAAI,MAAM,WAAW;AAAA,IAAW,IAAI,SAAS,MAAM;AAAA,EACnD,IAAI,MAAM,WAAW;AAAA,IAAW,IAAI,SAAS,MAAM;AAAA,EACnD,IAAI,MAAM,WAAW;AAAA,IAAW,IAAI,SAAS,CAAC,GAAG,MAAM,MAAM;AAAA,EAC7D,IAAI,MAAM,oBAAoB;AAAA,IAC7B,IAAI,kBAAkB,MAAM;AAAA,EAC7B,IAAI,MAAM,aAAa,WAAW;AAAA,IACjC,IAAI,eAAe,MAAM,UAAU,QAAQ;AAAA,IAC3C,IAAI,oBAAoB,MAAM,UAAU,aAAa;AAAA,EACtD;AAAA,EACA,IAAI,MAAM,iBAAiB,WAAW;AAAA,IACrC,OAAO,OAAO,KAAK,sBAAsB,MAAM,YAAY,CAAC;AAAA,EAC7D;AAAA,EACA,OAAO;AAAA;AASR,SAAS,qBAAqB,CAAC,cAA0C;AAAA,EACxE,MAAM,QAAQ,cAAc,iBAAiB,CAAC;AAAA,EAC9C,OAAO;AAAA,IACN,oBAAoB,cAAc,UAAU;AAAA,IAC5C,oBAAoB,cAAc,UAAU;AAAA,IAC5C,yBAAyB,cAAc,eAAe;AAAA,IACtD,sBAAsB,cAAc,YAAY;AAAA,IAChD,2BAA2B,MAAM,WAAW,IAAI,OAAO,CAAC,GAAG,KAAK;AAAA,EACjE;AAAA;AAGM,SAAS,MAAM,CAAC,KAA0B;AAAA,EAChD,OAAO;AAAA,IACN,IAAI,IAAI;AAAA,IACR,MAAM,IAAI;AAAA,IACV,eAAe,IAAI;AAAA,IACnB,QAAQ,IAAI;AAAA,IACZ,QAAQ,IAAI;AAAA,IACZ,QAAQ,CAAC,GAAG,IAAI,MAAM;AAAA,IACtB,UACC,IAAI,iBAAiB,QAAQ,IAAI,sBAAsB,OACpD,OACA,EAAE,MAAM,IAAI,cAAc,WAAW,IAAI,kBAAkB;AAAA,IAC/D,cACC,IAAI,uBAAuB,QAAQ,IAAI,uBAAuB,OAC3D,OACA;AAAA,MACA,QAAQ,IAAI;AAAA,MACZ,QAAQ,IAAI;AAAA,MACZ,aAAa,IAAI;AAAA,MACjB,UAAU,IAAI;AAAA,MACd,eAAe,CAAC,GAAI,IAAI,6BAA6B,CAAC,CAAE;AAAA,IACzD;AAAA,IACH,iBAAiB,IAAI;AAAA,IACrB,SAAS,IAAI;AAAA,IACb,WAAW,IAAI;AAAA,IACf,WAAW,IAAI;AAAA,EAChB;AAAA;AAGM,SAAS,SAAS,CAAC,KAAgC;AAAA,EACzD,OAAO;AAAA,IACN,IAAI,IAAI;AAAA,IACR,WAAW,IAAI;AAAA,IACf,QAAQ,IAAI;AAAA,IACZ,iBAAiB,IAAI;AAAA,IACrB,WAAW,IAAI;AAAA,IACf,WAAW,IAAI;AAAA,IACf,WAAW,IAAI;AAAA,EAChB;AAAA;AAQM,SAAS,KAAK,CAAC,IAAe;AAAA,EACpC,OAAO,OAAM,GAAG,YAAY;AAAA;;;ADlHtB,SAAS,YAAY,CAC3B,IACA,QACe;AAAA,EACf,MAAM,OAAO,CAAI,WAAmB,SACnC,IAAI,YAAY,WAAW,IAAI;AAAA,EAEhC,OAAO;AAAA,IACN,eAAe,CAAC,WACf,KAAK,iBAAiB,YAAY;AAAA,MAGjC,MAAM,GACJ,OAAO,OAAO,QAAQ,EACtB,OAAO,MAAM,EACb,oBAAoB,EAAE,QAAQ,OAAO,SAAS,GAAG,CAAC;AAAA,KACpD;AAAA,IAEF,wBAAwB,CAAC,cACxB,KAAK,0BAA0B,YAAY;AAAA,MAC1C,OAAO,OAAO,MAAM,GAClB,OAAO,EACP,KAAK,OAAO,QAAQ,EACpB,MAAM,IAAG,OAAO,SAAS,WAAW,SAAS,CAAC;AAAA,MAChD,OAAO,QAAQ,YAAY,OAAO,UAAU,GAAG;AAAA,KAC/C;AAAA,IAEF,eAAe,CAAC,IAAI,cACnB,KAAK,iBAAiB,YAAY;AAAA,MAGjC,OAAO,OAAO,MAAM,GAClB,OAAO,OAAO,QAAQ,EACtB,IAAI,EAAE,UAAU,CAAC,EACjB,MACA,KAAI,IAAG,OAAO,SAAS,IAAI,EAAE,GAAG,QAAO,OAAO,SAAS,SAAS,CAAC,CAClE,EACC,UAAU;AAAA,MACZ,OAAO,QAAQ,YAAY,OAAO,UAAU,GAAG;AAAA,KAC/C;AAAA,IAEF,uBAAuB,CAAC,IAAI,OAC3B,KAAK,yBAAyB,MAC7B,sBAAsB,IAAI,QAAQ,IAAI,EAAE,CACzC;AAAA,IAED,eAAe,CAAC,IAAI,OACnB,KAAK,iBAAiB,MAAM,cAAc,IAAI,QAAQ,IAAI,EAAE,CAAC;AAAA,IAE9D,oBAAoB,CAAC,QAAQ,IAAI,WAChC,KAAK,sBAAsB,MAC1B,mBAAmB,IAAI,QAAQ,QAAQ,IAAI,MAAM,CAClD;AAAA,IAED,oBAAoB,CAAC,WACpB,KAAK,sBAAsB,YAAY;AAAA,MACtC,MAAM,UAAU,MAAM,GACpB,OAAO,OAAO,QAAQ,EACtB,MAAM,IAAG,OAAO,SAAS,QAAQ,MAAM,CAAC,EACxC,UAAU,EAAE,IAAI,OAAO,SAAS,GAAG,CAAC;AAAA,MACtC,OAAO,QAAQ;AAAA,KACf;AAAA,IAEF,uBAAuB,CAAC,WACvB,KAAK,yBAAyB,YAAY;AAAA,MACzC,MAAM,UAAU,MAAM,GACpB,OAAO,OAAO,QAAQ,EACtB,MAAM,IAAI,OAAO,SAAS,WAAW,MAAM,CAAC,EAC5C,UAAU,EAAE,IAAI,OAAO,SAAS,GAAG,CAAC;AAAA,MACtC,OAAO,QAAQ;AAAA,KACf;AAAA,EACH;AAAA;AAGD,eAAe,qBAAqB,CACnC,IACA,QACA,IACA,IACgC;AAAA,EAGhC,OAAO,OAAO,MAAM,GAClB,OAAO,OAAO,QAAQ,EACtB,IAAI,EAAE,iBAAiB,GAAG,CAAC,EAC3B,MAAM,KAAI,IAAG,OAAO,SAAS,IAAI,EAAE,GAAG,QAAO,OAAO,SAAS,SAAS,CAAC,CAAC,EACxE,UAAU;AAAA,EACZ,OAAO,QAAQ,YAAY,OAAO,UAAU,GAAG;AAAA;AAGhD,eAAe,aAAa,CAC3B,IACA,QACA,IACA,IACmB;AAAA,EAGnB,MAAM,UAAU,MAAM,GACpB,OAAO,OAAO,QAAQ,EACtB,IAAI;AAAA,IACJ,WAAW,gBAAe,OAAO,SAAS,cAAc,MAAM,EAAE;AAAA,EACjE,CAAC,EACA,MAAM,IAAG,OAAO,SAAS,IAAI,EAAE,CAAC,EAChC,UAAU,EAAE,IAAI,OAAO,SAAS,GAAG,CAAC;AAAA,EACtC,OAAO,QAAQ,WAAW;AAAA;AAG3B,eAAe,kBAAkB,CAChC,IACA,QACA,QACA,IACA,QACkB;AAAA,EAClB,MAAM,WAAW,KAChB,IAAG,OAAO,SAAS,QAAQ,MAAM,GACjC,QAAO,OAAO,SAAS,SAAS,CACjC;AAAA,EACA,MAAM,UAAU,MAAM,GACpB,OAAO,OAAO,QAAQ,EACtB,IAAI,EAAE,WAAW,GAAG,CAAC,EACrB,MACA,WAAW,YACR,WACA,KAAI,UAAU,GAAG,OAAO,SAAS,IAAI,MAAM,CAAC,CAChD,EACC,UAAU,EAAE,IAAI,OAAO,SAAS,GAAG,CAAC;AAAA,EACtC,OAAO,QAAQ;AAAA;;;AErIhB,gBAAS,YAAK,eAAI,eAAQ,YAAI;AAKvB,SAAS,UAAU,CAAC,IAAgB,QAAoC;AAAA,EAC9E,MAAM,OAAO,CAAI,WAAmB,SACnC,IAAI,UAAU,WAAW,IAAI;AAAA,EAE9B,OAAO;AAAA,IACN,aAAa,CAAC,WACb,KAAK,eAAe,YAAY;AAAA,MAE/B,MAAM,GAAG,OAAO,OAAO,MAAM,EAAE,OAAO,MAAM,EAAE,oBAAoB;AAAA,KAClE;AAAA,IAEF,cAAc,CAAC,WAAW,MAAM,OAC/B,KAAK,gBAAgB,MAAM,aAAa,IAAI,QAAQ,WAAW,MAAM,EAAE,CAAC;AAAA,IAEzE,cAAc,CAAC,WAAW,SACzB,KAAK,gBAAgB,MAAM,aAAa,IAAI,QAAQ,WAAW,IAAI,CAAC;AAAA,IAErE,iBAAiB,CAAC,QAAQ,MAAM,IAAI,WACnC,KAAK,mBAAmB,YAAY;AAAA,MAInC,MAAM,QAAQ,MAAM,GAClB,OAAO,OAAO,MAAM,EACpB,IAAI,EAAE,SAAS,GAAG,CAAC,EACnB,MACA,KACC,IAAG,OAAO,OAAO,QAAQ,MAAM,GAC/B,IAAG,OAAO,OAAO,MAAM,IAAI,GAC3B,QAAO,OAAO,OAAO,OAAO,GAC5B,WAAW,YACR,YACA,IAAG,OAAO,OAAO,WAAW,MAAM,CACtC,CACD,EACC,UAAU,EAAE,WAAW,OAAO,OAAO,UAAU,CAAC;AAAA,MAClD,OAAO,MAAM;AAAA,KACb;AAAA,IAEF,kBAAkB,CAAC,WAClB,KAAK,oBAAoB,YAAY;AAAA,MACpC,MAAM,UAAU,MAAM,GACpB,OAAO,OAAO,MAAM,EACpB,MAAM,IAAG,OAAO,OAAO,QAAQ,MAAM,CAAC,EACtC,UAAU,EAAE,WAAW,OAAO,OAAO,UAAU,CAAC;AAAA,MAClD,OAAO,QAAQ;AAAA,KACf;AAAA,EACH;AAAA;AAGD,eAAe,YAAY,CAC1B,IACA,QACA,WACA,MACA,IAC8B;AAAA,EAK9B,MAAM,SAAS,GAAG,MAAM,QAAQ,EAAE,GACjC,GACE,OAAO,EACP,KAAK,OAAO,MAAM,EAClB,MACA,KACC,IAAG,OAAO,OAAO,WAAW,SAAS,GACrC,IAAG,OAAO,OAAO,MAAM,IAAI,CAC5B,CACD,EACC,IAAI,QAAQ,CACf;AAAA,EACA,OAAO,SAAS,MAAM,GACpB,KAAK,MAAM,EACX,OAAO,OAAO,MAAM,EACpB,IAAI;AAAA,IACJ,SAAS,gBAAe,OAAO,OAAO,YAAY,MAAM,EAAE;AAAA,EAC3D,CAAC,EACA,KAAK,MAAM,EACX,MAAM,IAAG,OAAO,OAAO,WAAW,OAAO,SAAS,CAAC,EACnD,UAAU;AAAA,IACV,WAAW,OAAO;AAAA,IAClB,MAAM,OAAO;AAAA,IACb,QAAQ,OAAO;AAAA,IACf,SAAS,OAAO;AAAA,IAChB,UAAU,OAAO;AAAA,IACjB,UAAU,OAAO;AAAA,IACjB,WAAW,OAAO;AAAA,IAClB,SAAS,OAAO;AAAA,IAChB,WAAW,OAAO;AAAA,EACnB,CAAC;AAAA,EACF,OAAO,UAAU,YAAY,OAAO,KAAK,OAAO,QAAQ,MAAM,OAAa;AAAA;AAG5E,eAAe,YAAY,CAC1B,IACA,QACA,WACA,MAC8B;AAAA,EAI9B,MAAM,QAAQ,KACb,IAAG,OAAO,OAAO,WAAW,SAAS,GACrC,IAAG,OAAO,OAAO,MAAM,IAAI,CAC5B;AAAA,EACA,OAAO,WAAW,MAAM,GACtB,OAAO,OAAO,MAAM,EACpB,IAAI,EAAE,UAAU,OAAM,OAAO,OAAO,eAAe,CAAC,EACpD,MAAM,KAAI,OAAO,QAAO,OAAO,OAAO,OAAO,CAAC,CAAC,EAC/C,UAAU;AAAA,EACZ,MAAM,MACL,YAAY,MAAM,GAAG,OAAO,EAAE,KAAK,OAAO,MAAM,EAAE,MAAM,KAAK,GAAG;AAAA,EACjE,OAAO,QAAQ,YAAY,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAa;AAAA;;;AC1HtE,4BAA0B;AAE1B,yCAAwB;AACxB,gBAAS,aAAK,YAAK,WAAI,qBAAa;;;ACOpC,eAAsB,WAAW,CAChC,IACA,QACA,WACA,MACA,QACgB;AAAA,EAGhB,MAAM,WAAW,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,EAAE,KAAK;AAAA,EAC3C,IAAI,SAAS,WAAW;AAAA,IAAG;AAAA,EAC3B,MAAM,UAAU,MAAM,GACpB,OAAO,OAAO,MAAM,EACpB,OACA,SAAS,IAAI,CAAC,WAAW,EAAE,MAAM,KAAK,MAAM,OAAO,QAAQ,KAAK,GAAG,EAAE,CACtE,EACC,oBAAoB,EACpB,UAAU,EAAE,OAAO,OAAO,OAAO,MAAM,CAAC;AAAA,EAC1C,IAAI,QAAQ,WAAW,SAAS;AAAA,IAAQ;AAAA,EACxC,MAAM,UAAU,IAAI,IAAI,QAAQ,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC;AAAA,EACvD,MAAM,QAAQ,SAAS,KAAK,CAAC,UAAU,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK;AAAA,EAC/D,MAAM,WAAW,WAAW,KAAK,MAAM,KAAK;AAAA;;;ADtBtC,SAAS,SAAS,CAAC,IAAgB,QAAmC;AAAA,EAC5E,MAAM,OAAO,CAAI,WAAmB,SACnC,IAAI,SAAS,WAAW,IAAI;AAAA,EAE7B,OAAO;AAAA,IACN,YAAY,CAAC,WACZ,KAAK,cAAc,MAAM,WAAW,IAAI,QAAQ,MAAM,CAAC;AAAA,IAExD,UAAU,CAAC,OAAO,KAAK,YAAY,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;AAAA,IAIjE,WAAW,CAAC,QACX,KAAK,aAAa,YAAY;AAAA,MAC7B,MAAM,QAAQ,MAAM,GAClB,OAAO,EACP,KAAK,OAAO,KAAK,EACjB,MAAM,QAAQ,OAAO,MAAM,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;AAAA,MAC1C,OAAO,MAAM,IAAI,MAAM;AAAA,KACvB;AAAA,IAEF,iBAAiB,CAAC,MAAM,UACvB,KAAK,mBAAmB,YAAY;AAAA,MACnC,OAAO,OAAO,MAAM,GAClB,OAAO,EAAE,MAAM,OAAO,MAAM,CAAC,EAC7B,KAAK,OAAO,MAAM,EAClB,UAAU,OAAO,OAAO,IAAG,OAAO,MAAM,IAAI,OAAO,OAAO,MAAM,CAAC,EACjE,MACA,KAAI,IAAG,OAAO,OAAO,MAAM,IAAI,GAAG,IAAG,OAAO,OAAO,OAAO,KAAK,CAAC,CACjE;AAAA,MACD,OAAO,QAAQ,YAAY,OAAO,OAAO,IAAI,IAAI;AAAA,KACjD;AAAA,IAEF,WAAW,GAAG,MAAM,OAAO,YAC1B,KAAK,aAAa,YAAY;AAAA,MAE7B,MAAM,QAAQ,MAAM,GAClB,OAAO,EACP,KAAK,OAAO,KAAK,EACjB,MACA,UAAU,OACP,IAAG,OAAO,MAAM,MAAM,IAAI,IAC1B,KAAI,IAAG,OAAO,MAAM,MAAM,IAAI,GAAG,IAAG,OAAO,MAAM,IAAI,KAAK,CAAC,CAC/D,EACC,QAAQ,KAAI,OAAO,MAAM,EAAE,CAAC,EAC5B,MAAM,QAAQ,CAAC;AAAA,MACjB,MAAM,QAAQ,MAAM,MAAM,GAAG,KAAK,EAAE,IAAI,MAAM;AAAA,MAC9C,MAAM,OAAO,MAAM,GAAG,EAAE;AAAA,MACxB,OAAO;AAAA,QACN;AAAA,QACA,YACC,MAAM,SAAS,SAAS,SAAS,YAAY,KAAK,KAAK;AAAA,MACzD;AAAA,KACA;AAAA,IAEF,YAAY,CAAC,IAAI,OAAO,cACvB,KAAK,cAAc,MAClB,iBAAgB,IAAI,CAAC,OACpB,WAAW,IAAI,QAAQ,IAAI,OAAO,SAAS,CAC5C,CACD;AAAA,IAED,YAAY,CAAC,OACZ,KAAK,cAAc,YAAY;AAAA,MAE9B,MAAM,UAAU,MAAM,GACpB,OAAO,OAAO,KAAK,EACnB,MAAM,IAAG,OAAO,MAAM,IAAI,EAAE,CAAC,EAC7B,UAAU,EAAE,IAAI,OAAO,MAAM,GAAG,CAAC;AAAA,MACnC,OAAO,QAAQ,WAAW;AAAA,KAC1B;AAAA,EACH;AAAA;AAGD,eAAe,QAAQ,CACtB,IACA,QACA,IAC6B;AAAA,EAC7B,OAAO,OAAO,MAAM,GAClB,OAAO,EACP,KAAK,OAAO,KAAK,EACjB,MAAM,IAAG,OAAO,MAAM,IAAI,EAAE,CAAC;AAAA,EAC/B,OAAO,QAAQ,YAAY,OAAO,OAAO,GAAG;AAAA;AAG7C,eAAe,UAAU,CACxB,IACA,QACA,QACsB;AAAA,EACtB,MAAM,WAAW,MAAM,iBAAgB,IAAI,OAAO,OAAO;AAAA,IACxD,OAAO,OAAO,MAAM,GAClB,OAAO,OAAO,KAAK,EACnB,OAAO,UAAU,MAAM,CAAC,EACxB,oBAAoB,EAAE,QAAQ,OAAO,MAAM,GAAG,CAAC,EAC/C,UAAU;AAAA,IACZ,IAAI,QAAQ;AAAA,MAAW,OAAO;AAAA,IAC9B,MAAM,YAAY,IAAI,QAAQ,cAAc,QAAQ,OAAO,MAAM;AAAA,IACjE,OAAO,OAAO,GAAG;AAAA,GACjB;AAAA,EACD,IAAI,aAAa;AAAA,IAAM,OAAO;AAAA,EAI9B,MAAM,SAAS,MAAM,SAAS,IAAI,QAAQ,OAAO,EAAE;AAAA,EACnD,IAAI,WAAW;AAAA,IAAM,OAAO;AAAA,EAE5B,MAAM,IAAI,cAAc,8CAA8C;AAAA,IACrE,QAAQ,OAAO;AAAA,IACf,WAAW;AAAA,EACZ,CAAC;AAAA;AAGF,eAAe,UAAU,CACxB,IACA,QACA,IACA,OACA,WACsB;AAAA,EACtB,OAAO,OAAO,MAAM,GAClB,OAAO,OAAO,KAAK,EACnB,IAAI;AAAA,OACD,UAAU,KAAK;AAAA,IAClB,SAAS,OAAM,OAAO,MAAM;AAAA,EAC7B,CAAC,EACA,MAAM,KAAI,IAAG,OAAO,MAAM,IAAI,EAAE,GAAG,IAAG,OAAO,MAAM,SAAS,SAAS,CAAC,CAAC,EACvE,UAAU;AAAA,EAEZ,IAAI,QAAQ,WAAW;AAAA,IAGtB,OAAO,UAAU,MAAM,GACrB,OAAO,EAAE,SAAS,OAAO,MAAM,QAAQ,CAAC,EACxC,KAAK,OAAO,KAAK,EACjB,MAAM,IAAG,OAAO,MAAM,IAAI,EAAE,CAAC;AAAA,IAC/B,IAAI,WAAW,WAAW;AAAA,MACzB,MAAM,IAAI,cAAc,mCAAmC;AAAA,QAC1D,QAAQ;AAAA,QACR,WAAW;AAAA,MACZ,CAAC;AAAA,IACF;AAAA,IACA,MAAM,IAAI,eACT,WACA,gCAAgC,oBAAoB,OAAO,WAC3D;AAAA,MACC,QAAQ;AAAA,MACR,iBAAiB;AAAA,MACjB,eAAe,OAAO;AAAA,MACtB,WAAW;AAAA,IACZ,CACD;AAAA,EACD;AAAA,EAEA,IAAI,MAAM,WAAW,WAAW;AAAA,IAC/B,MAAM,GAAG,OAAO,OAAO,MAAM,EAAE,MAAM,IAAG,OAAO,OAAO,QAAQ,EAAE,CAAC;AAAA,IACjE,MAAM,YAAY,IAAI,QAAQ,cAAc,KAAK,MAAM,MAAM;AAAA,EAC9D;AAAA,EACA,OAAO,OAAO,GAAG;AAAA;;;AEzIX,SAAS,mBAAmB,CAClC,IACA,UAAgD,CAAC,GACnC;AAAA,EACd,MAAM,SAAS,QAAQ,UAAU,kBAAkB;AAAA,EACnD,OAAO;AAAA,IACN,OAAO,UAAU,IAAI,MAAM;AAAA,IAC3B,UAAU,aAAa,IAAI,MAAM;AAAA,IACjC,QAAQ,WAAW,IAAI,MAAM;AAAA,EAC9B;AAAA;;;ACTM,SAAS,oBAAoB,CACnC,IACA,UAAiC,CAAC,GACjB;AAAA,EACjB,OAAO;AAAA,IACN,OAAO,oBAAoB,IAAI,OAAO;AAAA,IACtC,WAAW,uBAAuB,IAAI,OAAO;AAAA,EAC9C;AAAA;",
-  "debugId": "80BE8EFD8F44209964756E2164756E21",
+  "mappings": ";AAAA;;;ACAA;;;ACEA;AAUO,IAAM,MAAM,WAAiD;AAAA,EACnE,UAAU,MAAM;AACjB,CAAC;AAKM,IAAM,KAAK,CAAC,SAClB,UAAU,MAAM,EAAE,cAAc,MAAM,WAAW,EAAE,CAAC;;;ADT9C,SAAS,WAAW,CAC1B,OACA,OACC;AAAA,EACD,OAAO,MACN,UACA;AAAA,IACC,MAAM,IAAI,MAAM,EAAE,QAAQ;AAAA,IAC1B,OAAO,IAAI,OAAO,EAAE,QAAQ;AAAA,IAC5B,QAAQ,IAAI,SAAS,EAAE,QAAQ;AAAA,EAChC,GACA,CAAC,MAAM;AAAA,IACN,WAAW,EAAE,MAAM,eAAe,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAAA,IAC9D,WAAW;AAAA,MACV,MAAM;AAAA,MACN,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAI;AAAA,MAC1B,gBAAgB,CAAC,MAAM,IAAI,MAAM,IAAI;AAAA,IACtC,CAAC,EAAE,SAAS,SAAS;AAAA,IACrB,MAAM,gBAAgB,EAAE,GAAG,EAAE,MAAM;AAAA,EACpC,CACD;AAAA;;;AE/BD,kBAAS;AAaF,SAAS,cAAc,CAAC,OAAqB;AAAA,EACnD,OAAO,MACN,aACA;AAAA,IACC,YAAY,IAAI,aAAa,EAAE,QAAQ;AAAA,IACvC,UAAU,IAAI,WAAW,EAAE,QAAQ;AAAA,IACnC,UAAU,IAAI,UAAU,EAAE,QAAQ;AAAA,IAClC,aAAa,IAAI,cAAc,EAAE,QAAQ;AAAA,IACzC,WAAW,IAAI,YAAY,EAAE,QAAQ;AAAA,IACrC,iBAAiB,IAAI,kBAAkB;AAAA,EACxC,GACA,CAAC,MAAM;AAAA,IACN,OAAO,wBAAwB,EAC7B,GACA,EAAE,aACF,EAAE,WACF,EAAE,iBACF,EAAE,UACF,EAAE,YACF,EAAE,QACH,EACC,iBAAiB;AAAA,IAEnB,OAAM,kBAAkB,EAAE,GAAG,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ;AAAA,EAClE,CACD;AAAA;;;ACtCD,kBAAS,kBAAO;AAQT,SAAS,aAAa,CAAC,OAAqB;AAAA,EAClD,OAAO,MACN,YACA;AAAA,IACC,IAAI,IAAI,IAAI,EAAE,WAAW;AAAA,IAEzB,WAAW,IAAI,YAAY,EAAE,QAAQ;AAAA,IACrC,QAAQ,IAAI,SAAS,EAAE,QAAQ;AAAA,IAC/B,iBAAiB,GAAG,kBAAkB,EAAE,QAAQ;AAAA,IAChD,WAAW,GAAG,YAAY,EAAE,QAAQ;AAAA,IACpC,WAAW,GAAG,YAAY;AAAA,IAC1B,WAAW,GAAG,YAAY,EAAE,QAAQ;AAAA,EACrC,GACA,CAAC,MAAM;AAAA,IACN,QAAO,4BAA4B,EAAE,GAAG,EAAE,SAAS;AAAA,IACnD,OAAM,kBAAkB,EAAE,GAAG,EAAE,MAAM;AAAA,IAErC,OAAM,qBAAqB,EAAE,GAAG,EAAE,SAAS;AAAA,EAC5C,CACD;AAAA;;;AC3BD;AACA,yBAAgB;AAIT,SAAS,WAAW,CAAC,OAAqB;AAAA,EAChD,OAAO,MACN,UACA;AAAA,IACC,WAAW,IAAI,YAAY,EAAE,WAAW;AAAA,IACxC,MAAM,KAAK,QAAQ;AAAA,MAClB,MAAM;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACD;AAAA,IACD,CAAC,EAAE,QAAQ;AAAA,IACX,QAAQ,IAAI,SAAS,EAAE,QAAQ;AAAA,IAC/B,SAAS,KAAK,SAAS,EAAE,QAAQ;AAAA,IAKjC,UAAU,KAAK,WAAW;AAAA,IAE1B,UAAU,QAAQ,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC;AAAA,IACjD,WAAW,GAAG,YAAY,EAAE,QAAQ;AAAA,IACpC,SAAS,GAAG,UAAU;AAAA,IACtB,WAAW,GAAG,YAAY,EAAE,QAAQ;AAAA,EACrC,GACA,CAAC,MAAM;AAAA,IACN,MACC,eACA,MAAM,EAAE,8GACT;AAAA,IACA,MAAM,mBAAmB,MAAM,EAAE,eAAe;AAAA,IAChD,OAAM,gBAAgB,EAAE,GAAG,EAAE,MAAM;AAAA,IAEnC,OAAM,mBAAmB,EAAE,GAAG,EAAE,SAAS;AAAA,EAC1C,CACD;AAAA;;;AC5CD,gBAAS;AACT;AAAA;AAAA,WAEC;AAAA,WACA;AAAA,aACA;AAAA;AAAA,UAEA;AAAA,YACA;AAAA;AAQM,SAAS,UAAU,CAAC,OAAqB;AAAA,EAC/C,OAAO,MACN,SACA;AAAA,IAEC,IAAI,IAAI,IAAI,EAAE,WAAW;AAAA,IACzB,MAAM,IAAI,MAAM,EAAE,QAAQ;AAAA,IAC1B,eAAe,MAAK,gBAAgB,EAAE,QAAQ;AAAA,IAC9C,QAAQ,QAAQ,QAAQ,EAAE,QAAQ;AAAA,IAElC,QAAQ,MAAM,QAAQ,EAAE,QAAQ;AAAA,IAChC,QAAQ,MAAK,QAAQ,EAAE,MAAM,EAAE,QAAQ;AAAA,IACvC,cAAc,MAAK,eAAe;AAAA,IAClC,mBAAmB,GAAG,qBAAqB;AAAA,IAE3C,oBAAoB,MAAK,wBAAwB,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;AAAA,IAEnE,oBAAoB,MAAK,sBAAsB;AAAA,IAC/C,yBAAyB,GAAG,4BAA4B;AAAA,IACxD,sBAAsB,SAAQ,yBAAyB;AAAA,IAMvD,2BAA2B,MAAK,8BAA8B,EAAE,MAAM;AAAA,IACtE,iBAAiB,GAAG,mBAAmB;AAAA,IACvC,SAAS,SAAQ,SAAS,EAAE,QAAQ;AAAA,IACpC,WAAW,GAAG,YAAY,EAAE,QAAQ;AAAA,IACpC,WAAW,GAAG,YAAY,EAAE,QAAQ;AAAA,EACrC,GACA,CAAC,MAAM;AAAA,IAEN,QAAO,sBAAsB,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI;AAAA,IAE9C,OAAM,eAAe,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;AAAA,IAEtC,OACC,wBACA,QAAO,EAAE,4BAA4B,EAAE,4BACxC;AAAA,IAKA,OACC,6BACA,QAAO,EAAE,kCAAkC,EAAE,oCAAoC,EAAE,sCAAsC,EAAE,uCAAuC,EAAE,oCAAoC,EAAE,qCAC3M;AAAA,IAEA,OACC,8BACA,OAAM,EAAE,sCAAsC,EAAE,2BACjD;AAAA,EACD,CACD;AAAA;;;ANfM,SAAS,iBAAiB,CAAC,UAA8B,CAAC,GAAG;AAAA,EACnE,QAAQ,WAAW;AAAA,EACnB,MAAM,QAAS,WAAW,YAAY,UAAU,OAAO;AAAA,EACvD,MAAM,QAAQ,WAAW,KAAK;AAAA,EAC9B,MAAM,SAAS,YAAY,OAAO,KAAK;AAAA,EACvC,MAAM,WAAW,cAAc,KAAK;AAAA,EACpC,MAAM,SAAS,YAAY,KAAK;AAAA,EAChC,MAAM,YAAY,eAAe,KAAK;AAAA,EACtC,OAAO,EAAE,OAAO,QAAQ,UAAU,QAAQ,UAAU;AAAA;;;AOhErD;AACA;AA8BA,eAAsB,GAAM,CAC3B,MACA,WACA,MACa;AAAA,EACb,IAAI;AAAA,IACH,OAAO,MAAM,KAAK;AAAA,IACjB,OAAO,OAAO;AAAA,IAEf,IAAI,iBAAiB;AAAA,MAAY,MAAM;AAAA,IACvC,MAAM,IAAI,aAAa,GAAG,QAAQ,yCAAyC;AAAA,MAC1E;AAAA,MACA;AAAA,MACA,OAAO,YAAY,KAAK;AAAA,IACzB,CAAC;AAAA;AAAA;AAKI,SAAS,UAAU,CACzB,WACA,MACA,OACgB;AAAA,EAChB,OAAO,IAAI,cACV,SACA,GAAG,4CAA4C,QAC/C,EAAE,OAAO,UAAU,MAAM,UAAU,CACpC;AAAA;;;ACpDD,gBAAS,iBAAU,8BAAmB;;;ACPtC;AACA;AAIO,SAAS,OAAO,CACtB,QAC2B;AAAA,EAC3B,MAAM,QAAQ,CAAC,UACd,KAAK,UAAU;AAAA,IACd,MAAM,OAAO;AAAA,IACb,MAAM,OAAO;AAAA,IACb,MAAM;AAAA,IACN,MAAM,QAAQ;AAAA,IACd,MAAM,QAAQ;AAAA,IACd,aAAa,MAAM,OAAO,IAAI,MAAM,QAAQ,WAAW;AAAA,EACxD,CAAC;AAAA,EACF,OAAO,CAAC,GAAG,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM;AAAA,IACjC,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC;AAAA,IAClC,OAAO,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI;AAAA,GAChC;AAAA;AAIK,SAAS,KAAK,CAAC,OAAiD;AAAA,EACtE,OAAO;AAAA,IACN,YAAY,MAAM,OAAO;AAAA,IACzB,UAAU,MAAM,OAAO;AAAA,IACvB,UAAU,MAAM;AAAA,IAChB,aAAa,MAAM,QAAQ;AAAA,IAC3B,WAAW,MAAM,QAAQ;AAAA,IACzB,iBAAiB,aAAa,MAAM,OAAO,IACxC,MAAM,QAAQ,WACd;AAAA,EACJ;AAAA;AAIM,SAAS,SAAS,CACxB,WACA,SACkB;AAAA,EAClB,OAAO,IACN,GAAG,UAAU,aAAa,QAAQ,IAAI,GACtC,GAAG,UAAU,WAAW,QAAQ,EAAE,GAClC,aAAa,OAAO,IACjB,GAAG,UAAU,iBAAiB,QAAQ,QAAQ,IAC9C,OAAO,UAAU,eAAe,CACpC;AAAA;AAIM,SAAS,QAAQ,CACvB,WACA,OACkB;AAAA,EAClB,OAAO,IACN,GAAG,UAAU,YAAY,MAAM,OAAO,IAAI,GAC1C,GAAG,UAAU,UAAU,MAAM,OAAO,EAAE,GACtC,GAAG,UAAU,UAAU,MAAM,QAAQ,GACrC,UAAU,WAAW,MAAM,OAAO,CACnC;AAAA;;;ADlDD,eAAsB,GAAG,GACtB,IAAI,aACN,OACmB;AAAA,EACnB,MAAM,QAAQ,MAAM,GAClB,OAAO,EAAE,UAAU,UAAU,SAAS,CAAC,EACvC,KAAK,SAAS,EACd,MAAM,SAAS,WAAW,KAAK,CAAC,EAChC,MAAM,CAAC;AAAA,EACT,OAAO,MAAM,WAAW;AAAA;AAGzB,eAAsB,eAAe,CACpC,SACA,QACA,UACwB;AAAA,EACxB,QAAQ,MAAM,QAAQ,SAAS,QAAQ,UAAU,IAAI,GAAG,IACvD,CAAC,SAAqB;AAAA,IACrB,MAAM,IAAI;AAAA,IACV,IAAI,IAAI;AAAA,IACR,UAAU,IAAI,YAAY;AAAA,EAC3B,EACD;AAAA;AAGD,eAAsB,YAAY,CACjC,SACA,QACA,UACoB;AAAA,EACpB,QAAQ,MAAM,QAAQ,SAAS,QAAQ,UAAU,KAAK,GAAG,IACxD,CAAC,SAAiB,EAAE,MAAM,IAAI,MAAM,IAAI,IAAI,GAAG,EAChD;AAAA;AAID,SAAS,OAAO,GACb,IAAI,aACN,QACA,UACA,MACC;AAAA,EACD,OAAO,GACL,OAAO;AAAA,IACP,MAAM,UAAU;AAAA,IAChB,IAAI,UAAU;AAAA,IACd,UAAU,UAAU;AAAA,EACrB,CAAC,EACA,KAAK,SAAS,EACd,MACA,KACC,IAAG,UAAU,YAAY,OAAO,IAAI,GACpC,IAAG,UAAU,UAAU,OAAO,EAAE,GAChC,IAAG,UAAU,UAAU,QAAQ,GAC/B,OACG,UAAU,UAAU,eAAe,IACnC,QAAO,UAAU,eAAe,CACpC,CACD;AAAA;AAIF,eAAsB,WAAW,GAC9B,IAAI,eACJ,MAAM,UAAU,SAAS,OAAO,SACJ;AAAA,EAC9B,MAAM,aAAa;AAAA,IAClB,UAAU,WAAW,OAAO;AAAA,IAC5B,IAAG,UAAU,UAAU,QAAQ;AAAA,IAC/B,IAAG,UAAU,YAAY,IAAI;AAAA,EAC9B;AAAA,EACA,IAAI,UAAU;AAAA,IAAM,WAAW,KAAK,GAAG,UAAU,UAAU,KAAK,CAAC;AAAA,EACjE,MAAM,QAAQ,MAAM,GAClB,OAAO,EAAE,IAAI,UAAU,SAAS,CAAC,EACjC,KAAK,SAAS,EACd,MAAM,KAAI,GAAG,UAAU,CAAC,EACxB,QAAQ,IAAI,UAAU,QAAQ,CAAC,EAC/B,MAAM,QAAQ,CAAC;AAAA,EACjB,MAAM,QAAQ,MAAM,MAAM,GAAG,KAAK,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE;AAAA,EACvD,MAAM,OAAO,MAAM,GAAG,EAAE;AAAA,EACxB,OAAO;AAAA,IACN;AAAA,IACA,YAAY,MAAM,SAAS,SAAS,SAAS,YAAY,OAAO;AAAA,EACjE;AAAA;;;AE/FD;AAEA,gBAAS,YAAK;AAKd,eAAsB,KAAK,GACxB,IAAI,aACN,KACA,QACgB;AAAA,EAChB,IAAI,IAAI,SAAS,OAAO,UAAU;AAAA,IAAG,OAAO,MAAM,IAAI,WAAW,KAAK,MAAM;AAAA,EAC5E,MAAM,gBAAgB,IAAI,CAAC,OAAO,MAAM,IAAI,WAAW,KAAK,MAAM,CAAC;AAAA;AAIpE,eAAe,KAAK,CACnB,IACA,WACA,KACA,QACgB;AAAA,EAGhB,WAAW,SAAS,QAAQ,MAAM,GAAG;AAAA,IACpC,MAAM,GAAG,OAAO,SAAS,EAAE,MAAM,SAAS,WAAW,KAAK,CAAC;AAAA,EAC5D;AAAA,EACA,IAAI,IAAI,SAAS,GAAG;AAAA,IAEnB,MAAM,GACJ,OAAO,SAAS,EAChB,OAAO,QAAQ,GAAG,EAAE,IAAI,KAAK,CAAC,EAC9B,oBAAoB;AAAA,EACvB;AAAA;AAID,eAAsB,YAAY,GAC/B,IAAI,aACN,QACkB;AAAA,EAClB,MAAM,UAAU,MAAM,GACpB,OAAO,SAAS,EAChB,MACA,GACC,KACC,IAAG,UAAU,YAAY,OAAO,IAAI,GACpC,IAAG,UAAU,UAAU,OAAO,EAAE,CACjC,GACA,KACC,IAAG,UAAU,aAAa,OAAO,IAAI,GACrC,IAAG,UAAU,WAAW,OAAO,EAAE,CAClC,CACD,CACD,EACC,UAAU,EAAE,UAAU,UAAU,SAAS,CAAC;AAAA,EAC5C,OAAO,QAAQ;AAAA;;;ACpCT,SAAS,sBAAsB,CACrC,IACA,UAA8C,CAAC,GAC/B;AAAA,EAChB,MAAM,SAAS,QAAQ,UAAU,kBAAkB;AAAA,EACnD,MAAM,UAA2B,EAAE,IAAI,WAAW,OAAO,UAAU;AAAA,EACnE,MAAM,OAAO,CAAI,WAAmB,SACnC,IAAI,aAAa,WAAW,IAAI;AAAA,EAEjC,OAAO;AAAA,IACN,OAAO,GAAG,MAAM,CAAC,GAAG,SAAS,CAAC,QAC7B,KAAK,SAAS,MAAM,MAAM,SAAS,KAAK,MAAM,CAAC;AAAA,IAChD,KAAK,CAAC,UAAU,KAAK,OAAO,MAAM,IAAI,SAAS,KAAK,CAAC;AAAA,IACrD,iBAAiB,CAAC,QAAQ,aACzB,KAAK,mBAAmB,MAAM,gBAAgB,SAAS,QAAQ,QAAQ,CAAC;AAAA,IACzE,cAAc,CAAC,QAAQ,aACtB,KAAK,gBAAgB,MAAM,aAAa,SAAS,QAAQ,QAAQ,CAAC;AAAA,IAInE,aAAa,GAAG,MAAM,UAAU,SAAS,OAAO,YAC/C,KAAK,eAAe,MACnB,YAAY,SAAS,EAAE,MAAM,UAAU,SAAS,OAAO,MAAM,CAAC,CAC/D;AAAA,IACD,cAAc,CAAC,WACd,KAAK,gBAAgB,MAAM,aAAa,SAAS,MAAM,CAAC;AAAA,EAC1D;AAAA;;;AC7CD,gBAAS,YAAK,eAAI,yBAAiB;;;ACDnC,uBAA0B;AAQ1B,eAAsB,cAAc,CACnC,IACA,OACA,OACkB;AAAA,EAClB,MAAM,UAAU,GAAG,MAAM,SAAS,EAAE,GACnC,GACE,OAAO,KAAK,EACZ,MAAM,KAAK,EACX,UAAU,EAAE,KAAK,QAAe,GAAG,KAAK,EAAE,CAAC,CAC9C;AAAA,EACA,OAAO,OAAO,MAAM,GAAG,KAAK,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC,EAAE,KAAK,OAAO;AAAA,EACxE,OAAO,KAAK,KAAK;AAAA;;;ACpBlB,gBAAmB;AAYZ,SAAS,SAAS,CAAC,QAAgC;AAAA,EACzD,OAAO;AAAA,IACN,IAAI,OAAO;AAAA,IACX,MAAM,OAAO;AAAA,IACb,eAAe,OAAO;AAAA,IACtB,QAAQ,OAAO;AAAA,IACf,QAAQ,OAAO;AAAA,IACf,QAAQ,CAAC,GAAG,OAAO,MAAM;AAAA,IACzB,cAAc,OAAO,UAAU,QAAQ;AAAA,IACvC,mBAAmB,OAAO,UAAU,aAAa;AAAA,OAC9C,sBAAsB,OAAO,YAAY;AAAA,IAC5C,iBAAiB,OAAO;AAAA,IACxB,SAAS,OAAO;AAAA,IAChB,WAAW,OAAO;AAAA,IAClB,WAAW,OAAO;AAAA,EACnB;AAAA;AAQM,SAAS,SAAS,CAAC,OAAuC;AAAA,EAChE,MAAM,MAA2B;AAAA,IAChC,WAAW,MAAM;AAAA,EAClB;AAAA,EACA,IAAI,MAAM,kBAAkB;AAAA,IAC3B,IAAI,gBAAgB,MAAM;AAAA,EAC3B,IAAI,MAAM,WAAW;AAAA,IAAW,IAAI,SAAS,MAAM;AAAA,EACnD,IAAI,MAAM,WAAW;AAAA,IAAW,IAAI,SAAS,MAAM;AAAA,EACnD,IAAI,MAAM,WAAW;AAAA,IAAW,IAAI,SAAS,CAAC,GAAG,MAAM,MAAM;AAAA,EAC7D,IAAI,MAAM,oBAAoB;AAAA,IAC7B,IAAI,kBAAkB,MAAM;AAAA,EAC7B,IAAI,MAAM,aAAa,WAAW;AAAA,IACjC,IAAI,eAAe,MAAM,UAAU,QAAQ;AAAA,IAC3C,IAAI,oBAAoB,MAAM,UAAU,aAAa;AAAA,EACtD;AAAA,EACA,IAAI,MAAM,iBAAiB,WAAW;AAAA,IACrC,OAAO,OAAO,KAAK,sBAAsB,MAAM,YAAY,CAAC;AAAA,EAC7D;AAAA,EACA,OAAO;AAAA;AASR,SAAS,qBAAqB,CAAC,cAA0C;AAAA,EACxE,MAAM,QAAQ,cAAc,iBAAiB,CAAC;AAAA,EAC9C,OAAO;AAAA,IACN,oBAAoB,cAAc,UAAU;AAAA,IAC5C,oBAAoB,cAAc,UAAU;AAAA,IAC5C,yBAAyB,cAAc,eAAe;AAAA,IACtD,sBAAsB,cAAc,YAAY;AAAA,IAChD,2BAA2B,MAAM,WAAW,IAAI,OAAO,CAAC,GAAG,KAAK;AAAA,EACjE;AAAA;AAGM,SAAS,MAAM,CAAC,KAA0B;AAAA,EAChD,OAAO;AAAA,IACN,IAAI,IAAI;AAAA,IACR,MAAM,IAAI;AAAA,IACV,eAAe,IAAI;AAAA,IACnB,QAAQ,IAAI;AAAA,IACZ,QAAQ,IAAI;AAAA,IACZ,QAAQ,CAAC,GAAG,IAAI,MAAM;AAAA,IACtB,UACC,IAAI,iBAAiB,QAAQ,IAAI,sBAAsB,OACpD,OACA,EAAE,MAAM,IAAI,cAAc,WAAW,IAAI,kBAAkB;AAAA,IAC/D,cACC,IAAI,uBAAuB,QAAQ,IAAI,uBAAuB,OAC3D,OACA;AAAA,MACA,QAAQ,IAAI;AAAA,MACZ,QAAQ,IAAI;AAAA,MACZ,aAAa,IAAI;AAAA,MACjB,UAAU,IAAI;AAAA,MACd,eAAe,CAAC,GAAI,IAAI,6BAA6B,CAAC,CAAE;AAAA,IACzD;AAAA,IACH,iBAAiB,IAAI;AAAA,IACrB,SAAS,IAAI;AAAA,IACb,WAAW,IAAI;AAAA,IACf,WAAW,IAAI;AAAA,EAChB;AAAA;AAGM,SAAS,SAAS,CAAC,KAAgC;AAAA,EACzD,OAAO;AAAA,IACN,IAAI,IAAI;AAAA,IACR,WAAW,IAAI;AAAA,IACf,QAAQ,IAAI;AAAA,IACZ,iBAAiB,IAAI;AAAA,IACrB,WAAW,IAAI;AAAA,IACf,WAAW,IAAI;AAAA,IACf,WAAW,IAAI;AAAA,EAChB;AAAA;AAQM,SAAS,KAAK,CAAC,IAAe;AAAA,EACpC,OAAO,OAAM,GAAG,YAAY;AAAA;;;AFjHtB,SAAS,YAAY,CAC3B,IACA,QACe;AAAA,EACf,MAAM,OAAO,CAAI,WAAmB,SACnC,IAAI,YAAY,WAAW,IAAI;AAAA,EAEhC,OAAO;AAAA,IACN,eAAe,CAAC,WACf,KAAK,iBAAiB,YAAY;AAAA,MAGjC,MAAM,GACJ,OAAO,OAAO,QAAQ,EACtB,OAAO,MAAM,EACb,oBAAoB,EAAE,QAAQ,OAAO,SAAS,GAAG,CAAC;AAAA,KACpD;AAAA,IAEF,wBAAwB,CAAC,cACxB,KAAK,0BAA0B,YAAY;AAAA,MAC1C,OAAO,OAAO,MAAM,GAClB,OAAO,EACP,KAAK,OAAO,QAAQ,EACpB,MAAM,IAAG,OAAO,SAAS,WAAW,SAAS,CAAC;AAAA,MAChD,OAAO,QAAQ,YAAY,OAAO,UAAU,GAAG;AAAA,KAC/C;AAAA,IAEF,eAAe,CAAC,IAAI,cACnB,KAAK,iBAAiB,YAAY;AAAA,MAGjC,OAAO,OAAO,MAAM,GAClB,OAAO,OAAO,QAAQ,EACtB,IAAI,EAAE,UAAU,CAAC,EACjB,MACA,KAAI,IAAG,OAAO,SAAS,IAAI,EAAE,GAAG,QAAO,OAAO,SAAS,SAAS,CAAC,CAClE,EACC,UAAU;AAAA,MACZ,OAAO,QAAQ,YAAY,OAAO,UAAU,GAAG;AAAA,KAC/C;AAAA,IAEF,uBAAuB,CAAC,IAAI,OAC3B,KAAK,yBAAyB,MAC7B,sBAAsB,IAAI,QAAQ,IAAI,EAAE,CACzC;AAAA,IAED,eAAe,CAAC,IAAI,OACnB,KAAK,iBAAiB,MAAM,cAAc,IAAI,QAAQ,IAAI,EAAE,CAAC;AAAA,IAE9D,oBAAoB,CAAC,QAAQ,IAAI,WAChC,KAAK,sBAAsB,MAC1B,mBAAmB,IAAI,QAAQ,QAAQ,IAAI,MAAM,CAClD;AAAA,IAED,oBAAoB,CAAC,WACpB,KAAK,sBAAsB,YAAY;AAAA,MACtC,MAAM,UAAU,MAAM,GACpB,OAAO,OAAO,QAAQ,EACtB,MAAM,IAAG,OAAO,SAAS,QAAQ,MAAM,CAAC,EACxC,UAAU,EAAE,IAAI,OAAO,SAAS,GAAG,CAAC;AAAA,MACtC,OAAO,QAAQ;AAAA,KACf;AAAA,IAEF,uBAAuB,CAAC,WACvB,KAAK,yBAAyB,YAAY;AAAA,MACzC,OAAO,eACN,IACA,OAAO,UACP,IAAI,OAAO,SAAS,WAAW,MAAM,CACtC;AAAA,KACA;AAAA,EACH;AAAA;AAGD,eAAe,qBAAqB,CACnC,IACA,QACA,IACA,IACgC;AAAA,EAGhC,OAAO,OAAO,MAAM,GAClB,OAAO,OAAO,QAAQ,EACtB,IAAI,EAAE,iBAAiB,GAAG,CAAC,EAC3B,MAAM,KAAI,IAAG,OAAO,SAAS,IAAI,EAAE,GAAG,QAAO,OAAO,SAAS,SAAS,CAAC,CAAC,EACxE,UAAU;AAAA,EACZ,OAAO,QAAQ,YAAY,OAAO,UAAU,GAAG;AAAA;AAGhD,eAAe,aAAa,CAC3B,IACA,QACA,IACA,IACmB;AAAA,EAGnB,MAAM,UAAU,MAAM,GACpB,OAAO,OAAO,QAAQ,EACtB,IAAI;AAAA,IACJ,WAAW,gBAAe,OAAO,SAAS,cAAc,MAAM,EAAE;AAAA,EACjE,CAAC,EACA,MAAM,IAAG,OAAO,SAAS,IAAI,EAAE,CAAC,EAChC,UAAU,EAAE,IAAI,OAAO,SAAS,GAAG,CAAC;AAAA,EACtC,OAAO,QAAQ,WAAW;AAAA;AAG3B,eAAe,kBAAkB,CAChC,IACA,QACA,QACA,IACA,QACkB;AAAA,EAClB,MAAM,WAAW,KAChB,IAAG,OAAO,SAAS,QAAQ,MAAM,GACjC,QAAO,OAAO,SAAS,SAAS,CACjC;AAAA,EACA,MAAM,UAAU,MAAM,GACpB,OAAO,OAAO,QAAQ,EACtB,IAAI,EAAE,WAAW,GAAG,CAAC,EACrB,MACA,WAAW,YACR,WACA,KAAI,UAAU,GAAG,OAAO,SAAS,IAAI,MAAM,CAAC,CAChD,EACC,UAAU,EAAE,IAAI,OAAO,SAAS,GAAG,CAAC;AAAA,EACtC,OAAO,QAAQ;AAAA;;;AGtIhB,gBAAS,YAAK,eAAI,gBAAQ,YAAK,YAAI;AAM5B,SAAS,UAAU,CAAC,IAAgB,QAAoC;AAAA,EAC9E,MAAM,OAAO,CAAI,WAAmB,SACnC,IAAI,UAAU,WAAW,IAAI;AAAA,EAE9B,OAAO;AAAA,IACN,aAAa,CAAC,WACb,KAAK,eAAe,YAAY;AAAA,MAE/B,MAAM,GAAG,OAAO,OAAO,MAAM,EAAE,OAAO,MAAM,EAAE,oBAAoB;AAAA,KAClE;AAAA,IAEF,cAAc,CAAC,WAAW,MAAM,OAC/B,KAAK,gBAAgB,MAAM,aAAa,IAAI,QAAQ,WAAW,MAAM,EAAE,CAAC;AAAA,IAEzE,cAAc,CAAC,WAAW,SACzB,KAAK,gBAAgB,MAAM,aAAa,IAAI,QAAQ,WAAW,IAAI,CAAC;AAAA,IAErE,iBAAiB,CAAC,QAAQ,MAAM,IAAI,WACnC,KAAK,mBAAmB,YAAY;AAAA,MAInC,MAAM,QAAQ,MAAM,GAClB,OAAO,OAAO,MAAM,EACpB,IAAI,EAAE,SAAS,GAAG,CAAC,EACnB,MACA,KACC,IAAG,OAAO,OAAO,QAAQ,MAAM,GAC/B,IAAG,OAAO,OAAO,MAAM,IAAI,GAC3B,QAAO,OAAO,OAAO,OAAO,GAC5B,WAAW,YACR,YACA,IAAG,OAAO,OAAO,WAAW,MAAM,CACtC,CACD,EACC,UAAU,EAAE,WAAW,OAAO,OAAO,UAAU,CAAC;AAAA,MAClD,OAAO,MAAM;AAAA,KACb;AAAA,IAEF,kBAAkB,CAAC,WAClB,KAAK,oBAAoB,YAAY;AAAA,MACpC,MAAM,UAAU,MAAM,GACpB,OAAO,OAAO,MAAM,EACpB,MAAM,IAAG,OAAO,OAAO,QAAQ,MAAM,CAAC,EACtC,UAAU,EAAE,WAAW,OAAO,OAAO,UAAU,CAAC;AAAA,MAClD,OAAO,QAAQ;AAAA,KACf;AAAA,IAEF,qBAAqB,CAAC,WACrB,KAAK,uBAAuB,YAAY;AAAA,MAGvC,OAAO,eACN,IACA,OAAO,QACP,KAAI,OAAO,OAAO,WAAW,MAAM,CACpC;AAAA,KACA;AAAA,EACH;AAAA;AAGD,eAAe,YAAY,CAC1B,IACA,QACA,WACA,MACA,IAC8B;AAAA,EAK9B,MAAM,SAAS,GAAG,MAAM,QAAQ,EAAE,GACjC,GACE,OAAO,EACP,KAAK,OAAO,MAAM,EAClB,MACA,KACC,IAAG,OAAO,OAAO,WAAW,SAAS,GACrC,IAAG,OAAO,OAAO,MAAM,IAAI,CAC5B,CACD,EACC,IAAI,QAAQ,CACf;AAAA,EACA,OAAO,SAAS,MAAM,GACpB,KAAK,MAAM,EACX,OAAO,OAAO,MAAM,EACpB,IAAI;AAAA,IACJ,SAAS,gBAAe,OAAO,OAAO,YAAY,MAAM,EAAE;AAAA,EAC3D,CAAC,EACA,KAAK,MAAM,EACX,MAAM,IAAG,OAAO,OAAO,WAAW,OAAO,SAAS,CAAC,EACnD,UAAU;AAAA,IACV,WAAW,OAAO;AAAA,IAClB,MAAM,OAAO;AAAA,IACb,QAAQ,OAAO;AAAA,IACf,SAAS,OAAO;AAAA,IAChB,UAAU,OAAO;AAAA,IACjB,UAAU,OAAO;AAAA,IACjB,WAAW,OAAO;AAAA,IAClB,SAAS,OAAO;AAAA,IAChB,WAAW,OAAO;AAAA,EACnB,CAAC;AAAA,EACF,OAAO,UAAU,YAAY,OAAO,KAAK,OAAO,QAAQ,MAAM,OAAa;AAAA;AAG5E,eAAe,YAAY,CAC1B,IACA,QACA,WACA,MAC8B;AAAA,EAI9B,MAAM,QAAQ,KACb,IAAG,OAAO,OAAO,WAAW,SAAS,GACrC,IAAG,OAAO,OAAO,MAAM,IAAI,CAC5B;AAAA,EACA,OAAO,WAAW,MAAM,GACtB,OAAO,OAAO,MAAM,EACpB,IAAI,EAAE,UAAU,OAAM,OAAO,OAAO,eAAe,CAAC,EACpD,MAAM,KAAI,OAAO,QAAO,OAAO,OAAO,OAAO,CAAC,CAAC,EAC/C,UAAU;AAAA,EACZ,MAAM,MACL,YAAY,MAAM,GAAG,OAAO,EAAE,KAAK,OAAO,MAAM,EAAE,MAAM,KAAK,GAAG;AAAA,EACjE,OAAO,QAAQ,YAAY,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAa;AAAA;;;ACtItE,4BAA0B;AAE1B,yCAAwB;AACxB,gBAAS,aAAK,YAAK,WAAI,qBAAa;;;ACOpC,eAAsB,WAAW,CAChC,IACA,QACA,WACA,MACA,QACgB;AAAA,EAGhB,MAAM,WAAW,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,EAAE,KAAK;AAAA,EAC3C,IAAI,SAAS,WAAW;AAAA,IAAG;AAAA,EAC3B,MAAM,UAAU,MAAM,GACpB,OAAO,OAAO,MAAM,EACpB,OACA,SAAS,IAAI,CAAC,WAAW,EAAE,MAAM,KAAK,MAAM,OAAO,QAAQ,KAAK,GAAG,EAAE,CACtE,EACC,oBAAoB,EACpB,UAAU,EAAE,OAAO,OAAO,OAAO,MAAM,CAAC;AAAA,EAC1C,IAAI,QAAQ,WAAW,SAAS;AAAA,IAAQ;AAAA,EACxC,MAAM,UAAU,IAAI,IAAI,QAAQ,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC;AAAA,EACvD,MAAM,QAAQ,SAAS,KAAK,CAAC,UAAU,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK;AAAA,EAC/D,MAAM,WAAW,WAAW,KAAK,MAAM,KAAK;AAAA;;;ADtBtC,SAAS,SAAS,CAAC,IAAgB,QAAmC;AAAA,EAC5E,MAAM,OAAO,CAAI,WAAmB,SACnC,IAAI,SAAS,WAAW,IAAI;AAAA,EAE7B,OAAO;AAAA,IACN,YAAY,CAAC,WACZ,KAAK,cAAc,MAAM,WAAW,IAAI,QAAQ,MAAM,CAAC;AAAA,IAExD,UAAU,CAAC,OAAO,KAAK,YAAY,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;AAAA,IAIjE,WAAW,CAAC,QACX,KAAK,aAAa,YAAY;AAAA,MAC7B,MAAM,QAAQ,MAAM,GAClB,OAAO,EACP,KAAK,OAAO,KAAK,EACjB,MAAM,QAAQ,OAAO,MAAM,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;AAAA,MAC1C,OAAO,MAAM,IAAI,MAAM;AAAA,KACvB;AAAA,IAEF,iBAAiB,CAAC,MAAM,UACvB,KAAK,mBAAmB,YAAY;AAAA,MACnC,OAAO,OAAO,MAAM,GAClB,OAAO,EAAE,MAAM,OAAO,MAAM,CAAC,EAC7B,KAAK,OAAO,MAAM,EAClB,UAAU,OAAO,OAAO,IAAG,OAAO,MAAM,IAAI,OAAO,OAAO,MAAM,CAAC,EACjE,MACA,KAAI,IAAG,OAAO,OAAO,MAAM,IAAI,GAAG,IAAG,OAAO,OAAO,OAAO,KAAK,CAAC,CACjE;AAAA,MACD,OAAO,QAAQ,YAAY,OAAO,OAAO,IAAI,IAAI;AAAA,KACjD;AAAA,IAEF,WAAW,GAAG,MAAM,OAAO,YAC1B,KAAK,aAAa,YAAY;AAAA,MAE7B,MAAM,QAAQ,MAAM,GAClB,OAAO,EACP,KAAK,OAAO,KAAK,EACjB,MACA,UAAU,OACP,IAAG,OAAO,MAAM,MAAM,IAAI,IAC1B,KAAI,IAAG,OAAO,MAAM,MAAM,IAAI,GAAG,IAAG,OAAO,MAAM,IAAI,KAAK,CAAC,CAC/D,EACC,QAAQ,KAAI,OAAO,MAAM,EAAE,CAAC,EAC5B,MAAM,QAAQ,CAAC;AAAA,MACjB,MAAM,QAAQ,MAAM,MAAM,GAAG,KAAK,EAAE,IAAI,MAAM;AAAA,MAC9C,MAAM,OAAO,MAAM,GAAG,EAAE;AAAA,MACxB,OAAO;AAAA,QACN;AAAA,QACA,YACC,MAAM,SAAS,SAAS,SAAS,YAAY,KAAK,KAAK;AAAA,MACzD;AAAA,KACA;AAAA,IAEF,YAAY,CAAC,IAAI,OAAO,cACvB,KAAK,cAAc,MAClB,iBAAgB,IAAI,CAAC,OACpB,WAAW,IAAI,QAAQ,IAAI,OAAO,SAAS,CAC5C,CACD;AAAA,IAED,YAAY,CAAC,OACZ,KAAK,cAAc,YAAY;AAAA,MAE9B,MAAM,UAAU,MAAM,GACpB,OAAO,OAAO,KAAK,EACnB,MAAM,IAAG,OAAO,MAAM,IAAI,EAAE,CAAC,EAC7B,UAAU,EAAE,IAAI,OAAO,MAAM,GAAG,CAAC;AAAA,MACnC,OAAO,QAAQ,WAAW;AAAA,KAC1B;AAAA,EACH;AAAA;AAGD,eAAe,QAAQ,CACtB,IACA,QACA,IAC6B;AAAA,EAC7B,OAAO,OAAO,MAAM,GAClB,OAAO,EACP,KAAK,OAAO,KAAK,EACjB,MAAM,IAAG,OAAO,MAAM,IAAI,EAAE,CAAC;AAAA,EAC/B,OAAO,QAAQ,YAAY,OAAO,OAAO,GAAG;AAAA;AAG7C,eAAe,UAAU,CACxB,IACA,QACA,QACsB;AAAA,EACtB,MAAM,WAAW,MAAM,iBAAgB,IAAI,OAAO,OAAO;AAAA,IACxD,OAAO,OAAO,MAAM,GAClB,OAAO,OAAO,KAAK,EACnB,OAAO,UAAU,MAAM,CAAC,EACxB,oBAAoB,EAAE,QAAQ,OAAO,MAAM,GAAG,CAAC,EAC/C,UAAU;AAAA,IACZ,IAAI,QAAQ;AAAA,MAAW,OAAO;AAAA,IAC9B,MAAM,YAAY,IAAI,QAAQ,cAAc,QAAQ,OAAO,MAAM;AAAA,IACjE,OAAO,OAAO,GAAG;AAAA,GACjB;AAAA,EACD,IAAI,aAAa;AAAA,IAAM,OAAO;AAAA,EAI9B,MAAM,SAAS,MAAM,SAAS,IAAI,QAAQ,OAAO,EAAE;AAAA,EACnD,IAAI,WAAW;AAAA,IAAM,OAAO;AAAA,EAE5B,MAAM,IAAI,cAAc,8CAA8C;AAAA,IACrE,QAAQ,OAAO;AAAA,IACf,WAAW;AAAA,EACZ,CAAC;AAAA;AAGF,eAAe,UAAU,CACxB,IACA,QACA,IACA,OACA,WACsB;AAAA,EACtB,OAAO,OAAO,MAAM,GAClB,OAAO,OAAO,KAAK,EACnB,IAAI;AAAA,OACD,UAAU,KAAK;AAAA,IAClB,SAAS,OAAM,OAAO,MAAM;AAAA,EAC7B,CAAC,EACA,MAAM,KAAI,IAAG,OAAO,MAAM,IAAI,EAAE,GAAG,IAAG,OAAO,MAAM,SAAS,SAAS,CAAC,CAAC,EACvE,UAAU;AAAA,EAEZ,IAAI,QAAQ,WAAW;AAAA,IAGtB,OAAO,UAAU,MAAM,GACrB,OAAO,EAAE,SAAS,OAAO,MAAM,QAAQ,CAAC,EACxC,KAAK,OAAO,KAAK,EACjB,MAAM,IAAG,OAAO,MAAM,IAAI,EAAE,CAAC;AAAA,IAC/B,IAAI,WAAW,WAAW;AAAA,MACzB,MAAM,IAAI,cAAc,mCAAmC;AAAA,QAC1D,QAAQ;AAAA,QACR,WAAW;AAAA,MACZ,CAAC;AAAA,IACF;AAAA,IACA,MAAM,IAAI,eACT,WACA,gCAAgC,oBAAoB,OAAO,WAC3D;AAAA,MACC,QAAQ;AAAA,MACR,iBAAiB;AAAA,MACjB,eAAe,OAAO;AAAA,MACtB,WAAW;AAAA,IACZ,CACD;AAAA,EACD;AAAA,EAEA,IAAI,MAAM,WAAW,WAAW;AAAA,IAC/B,MAAM,GAAG,OAAO,OAAO,MAAM,EAAE,MAAM,IAAG,OAAO,OAAO,QAAQ,EAAE,CAAC;AAAA,IACjE,MAAM,YAAY,IAAI,QAAQ,cAAc,KAAK,MAAM,MAAM;AAAA,EAC9D;AAAA,EACA,OAAO,OAAO,GAAG;AAAA;;;AEzIX,SAAS,mBAAmB,CAClC,IACA,UAAgD,CAAC,GACnC;AAAA,EACd,MAAM,SAAS,QAAQ,UAAU,kBAAkB;AAAA,EACnD,OAAO;AAAA,IACN,OAAO,UAAU,IAAI,MAAM;AAAA,IAC3B,UAAU,aAAa,IAAI,MAAM;AAAA,IACjC,QAAQ,WAAW,IAAI,MAAM;AAAA,EAC9B;AAAA;;;ACTM,SAAS,oBAAoB,CACnC,IACA,UAAiC,CAAC,GACjB;AAAA,EACjB,OAAO;AAAA,IACN,OAAO,oBAAoB,IAAI,OAAO;AAAA,IACtC,WAAW,uBAAuB,IAAI,OAAO;AAAA,EAC9C;AAAA;",
+  "debugId": "4769BF1300BE303164756E2164756E21",
   "names": []
 }

package/dist/stores/count-deleted.d.ts

@@ -0,0 +1,10 @@
+import type { PgDatabase } from '@nxgt/drizzle/pg';
+import { type SQL } from 'drizzle-orm';
+import type { PgTable } from 'drizzle-orm/pg-core';
+/**
+ * Deletes the rows of `table` matching `where` and answers how many, counted
+ * by the server: `with d as (delete … returning 1) select count(*) from d`.
+ * A collection can delete millions of rows; none of them reaches the process.
+ */
+export declare function deleteAndCount(db: PgDatabase, table: PgTable, where: SQL | undefined): Promise<number>;
+//# sourceMappingURL=count-deleted.d.ts.map

package/dist/stores/count-deleted.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"count-deleted.d.ts","sourceRoot":"","sources":["../../src/stores/count-deleted.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAS,KAAK,GAAG,EAAO,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAEnD;;;;GAIG;AACH,wBAAsB,cAAc,CACnC,EAAE,EAAE,UAAU,EACd,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,GAAG,GAAG,SAAS,GACpB,OAAO,CAAC,MAAM,CAAC,CASjB"}

package/dist/stores/sessions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/stores/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAiB,YAAY,EAAE,MAAM,aAAa,CAAC;AAG/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGxD,wBAAgB,YAAY,CAC3B,EAAE,EAAE,UAAU,EACd,MAAM,EAAE,cAAc,GACpB,YAAY,CAqEd"}
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/stores/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAiB,YAAY,EAAE,MAAM,aAAa,CAAC;AAI/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGxD,wBAAgB,YAAY,CAC3B,EAAE,EAAE,UAAU,EACd,MAAM,EAAE,cAAc,GACpB,YAAY,CAqEd"}

package/dist/stores/tokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/stores/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAA8B,UAAU,EAAE,MAAM,aAAa,CAAC;AAG1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGxD,wBAAgB,UAAU,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,GAAG,UAAU,CAgD7E"}
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/stores/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAA8B,UAAU,EAAE,MAAM,aAAa,CAAC;AAI1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGxD,wBAAgB,UAAU,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,GAAG,UAAU,CA2D7E"}

package/dist/tables/tokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/tables/tokens.ts"],"names":[],"mappings":"AAEA,OAAO,EAAW,KAAK,YAAY,EAAE,MAAM,WAAW,CAAC;AAEvD,4CAA4C;AAC5C,wBAAgB,WAAW,CAAC,KAAK,EAAE,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsC9C"}
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/tables/tokens.ts"],"names":[],"mappings":"AAEA,OAAO,EAAW,KAAK,YAAY,EAAE,MAAM,WAAW,CAAC;AAEvD,4CAA4C;AAC5C,wBAAgB,WAAW,CAAC,KAAK,EAAE,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwC9C"}

package/docs/README.md

@@ -7,6 +7,6 @@ give the detail.
 | --- | --- |
 | [Wiring the stores and the relations](guide/wiring.md) | You are passing your Drizzle instance to `janus()` and `permissions()`, choosing a driver, or handling what a failure throws |
 | [Where the tables live](guide/database.md) | You are choosing between a database of Janus's own and a PostgreSQL schema in yours, or backing up and restoring Janus's tables |
-| [The tables in your migrations](guide/migrations.md) | You are adding the tables to your schema, generating the migration, upgrading to a version whose tables changed, collecting lapsed sessions, or want to know what the database holds |
+| [The tables in your migrations](guide/migrations.md) | You are adding the tables to your schema, generating the migration, upgrading to a version whose tables changed, collecting lapsed sessions and tokens, or want to know what the database holds |
 | [Troubleshooting](troubleshooting.md) | You have an error message and want its cause and its fix |
 | [Roadmap](roadmap.md) | You want to know what is coming, what shipped, and what is deliberately not planned |

package/docs/guide/migrations.md

@@ -4,7 +4,7 @@ This page covers:
 - adding the five tables to the schema drizzle-kit reads;
 - what the migration creates;
 - upgrading: the migration a new version of the tables needs;
-- collecting lapsed sessions;
+- collecting lapsed sessions and tokens;
 - what the database holds.
 
 The core never manages a schema, and the stores create nothing per request.
@@ -272,21 +272,63 @@ violates check constraint "tokens_kind"`. An instance still on 0.7 writes no
 token's `address` holds the new address and `code_hash` the address it
 replaces, keyed by the token's secret.
 
-## Collecting lapsed sessions
+### To 0.9: an index on `tokens.expires_at`
+
+0.9 implements `tokens.deleteExpiredTokens`, so `auth.collectExpired()` now
+deletes lapsed tokens too. The tables gain one index, and **the migration is
+recommended, not required**: the adapter runs without it, but then every
+collection scans the whole `tokens` table.
+
+```sql
+CREATE INDEX "tokens_expires_at" ON "tokens" ("expires_at");
+```
+
+That is the statement drizzle-kit writes from the 0.8 tables to the 0.9
+ones (`"janus"."tokens"` with a PostgreSQL schema). It rewrites no row, and
+deploys before or after the code: an instance still on 0.8 never deletes a
+token, so the two run side by side. Three things to know:
+
+- **Drop a hand-made index first.** The earlier advice was to run
+  `create index on tokens (expires_at)` yourself; PostgreSQL named it
+  `tokens_expires_at_idx`. drizzle-kit does not know it, so it writes
+  `tokens_expires_at` beside it and the table keeps two indexes on one column.
+  `drop index tokens_expires_at_idx;` in the same migration (`drop index
+  janus.tokens_expires_at_idx;` with a schema of their own).
+- **`CREATE INDEX` blocks writes while it builds**, and sign-ins write to
+  `tokens` (the throttles' counts). On a large table, build it off-peak, or
+  build it `CONCURRENTLY` yourself, outside the migration, under the exact
+  name `tokens_expires_at` (`create index concurrently tokens_expires_at on
+  "janus"."tokens" (expires_at);`, schema-qualified when the tables have a
+  schema of their own). It cannot run in the migrator's transaction
+  (PostgreSQL error 25001). drizzle-kit compares snapshots, not the database,
+  so it still writes the plain `CREATE INDEX`, which would fail with
+  `relation "tokens_expires_at" already exists`: edit the generated statement
+  to `CREATE INDEX IF NOT EXISTS "tokens_expires_at" …`.
+- **The first `collectExpired()` deletes the whole backlog** in one
+  statement, every lapsed throttle row since the table was created. Run it
+  off-peak the first time.
+
+## Collecting lapsed sessions and tokens
 
 PostgreSQL has no TTL. A lapsed session is refused on every read, but it stays
-in `sessions` until something deletes it. `auth.collectExpired()`
-deletes every session whose `expiresAt` has passed, and returns how many:
+in `sessions` until something deletes it, and so does a lapsed token.
+`auth.collectExpired()` deletes every session and every one-time token whose
+`expiresAt` has passed, and returns how many in all:
 
 ```ts
 // Hourly, from whatever runs your scheduled jobs.
 const collected = await auth.collectExpired();
-console.info(`janus: ${collected} lapsed sessions deleted`);
+console.info(`janus: ${collected} lapsed sessions and tokens deleted`);
 ```
 
-`expires_at` is indexed, so this is one indexed `delete`. Spent and lapsed
-one-time tokens stay until their user is deleted; there are few of them per
-user.
+`expires_at` is indexed on both tables (on `tokens` only once the [0.9
+migration](#to-09-an-index-on-tokensexpires_at) is applied), so each is one
+indexed `delete`. The
+tokens are not few: `@nxgt/janus`'s sign-in throttle adds a row per login
+tried and per 15-minute window, a login nobody holds included, and its mail
+throttle one per flow, address or user and window. A token is deleted spent
+or not, once its `expiresAt` has passed and never before; after that a link
+answers `TOKEN_UNKNOWN` rather than `TOKEN_EXPIRED`.
 
 ## Reading the tables yourself
 

package/docs/guide/wiring.md

@@ -108,8 +108,8 @@ All three are measured on PostgreSQL 17 and 15 on every CI run.
 
 Every method of the port is implemented, **including both optional ones**.
 `deleteExpiredSessions`: PostgreSQL has no TTL, so
-`auth.collectExpired()` is how lapsed sessions leave the table; schedule it.
-The [migrations page](migrations.md#collecting-lapsed-sessions) shows how.
+`auth.collectExpired()` is how lapsed sessions and tokens leave their tables; schedule it.
+The [migrations page](migrations.md#collecting-lapsed-sessions-and-tokens) shows how.
 `findUsers` (since 0.7): one `select … where id in (…)` on the primary key,
 so `auth.<type>.findMany(ids)` reads up to 100 users in one round trip.
 

package/docs/roadmap.md

@@ -36,6 +36,12 @@ Nothing yet.
 
 ## Shipped
 
+- **Lapsed tokens collected, v0.9.0** — for `@nxgt/janus` 0.25:
+  `tokens.deleteExpiredTokens` is one `delete … where expires_at <= …
+  returning`, so `auth.collectExpired()` deletes lapsed tokens, the
+  throttles' counts included, beside the sessions. A migration is
+  recommended: drizzle-kit writes one `CREATE INDEX` on `tokens.expires_at`,
+  and without it the delete scans the table.
 - **Several users in one statement, v0.7.0** — for `@nxgt/janus` 0.18:
   `users.findUsers` is one `select … where id in (…)`, so
   `auth.<type>.findMany(ids)` reads a list of up to 100 ids in one round

package/docs/troubleshooting.md

@@ -44,7 +44,7 @@ How PostgreSQL's errors become the port's:
 - [`STORE_FAILED`: `<slot>.<operation>: the store could not answer`](#store_failed-slotoperation-the-store-could-not-answer)
 - [`LOGIN_TAKEN`: `<operation>: the login is taken by another <type>`](#login_taken-operation-the-login-is-taken-by-another-type)
 - [`NOT_FOUND` / `VERSION_CONFLICT`: `updateUser: …`](#not_found--version_conflict-updateuser-)
-- [The `sessions` table keeps growing](#the-sessions-table-keeps-growing)
+- [The `sessions` or `tokens` table keeps growing](#the-sessions-or-tokens-table-keeps-growing)
 - [`NOT_FOUND`: `insertUser: the user was deleted meanwhile`](#not_found-insertuser-the-user-was-deleted-meanwhile)
 
 ---
@@ -364,14 +364,17 @@ written.
 
 **Fix:** read the user again and retry, or tell the user it changed meanwhile.
 
-### The `sessions` table keeps growing
+### The `sessions` or `tokens` table keeps growing
 
-**When:** rows whose `expires_at` has passed are never deleted.
+**When:** rows whose `expires_at` has passed are never deleted. In `tokens`
+they are mostly the throttles' counts: a row per login tried and per window.
 
 **Why:** PostgreSQL has no TTL. The core refuses a lapsed session on every
-read, but deleting it is `auth.collectExpired()`'s job.
+read, but deleting it, and deleting a lapsed token, is
+`auth.collectExpired()`'s job.
 
-**Fix:** schedule it.
+**Fix:** schedule it. If the delete is slow, `tokens` lacks its
+`tokens_expires_at` index: [To 0.9](guide/migrations.md#to-09-an-index-on-tokensexpires_at).
 
 ```ts
 const collected = await auth.collectExpired(); // hourly

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@nxgt/janus-drizzle",
-	"version": "0.8.1",
+	"version": "0.9.0",
 	"description": "The PostgreSQL adapter for @nxgt/janus on Drizzle and @nxgt/drizzle: users, sessions, one-time tokens and permission tuples",
 	"license": "MIT",
 	"type": "module",
@@ -51,7 +51,7 @@
 	"devDependencies": {
 		"@electric-sql/pglite": "0.5.8",
 		"@nxgt/drizzle": "0.6.5",
-		"@nxgt/janus": "^0.24.0",
+		"@nxgt/janus": "^0.25.0",
 		"@types/bun": "^1.4.2",
 		"@types/pg": "^8.23.1",
 		"drizzle-kit": "1.0.0-rc.4",
@@ -62,7 +62,7 @@
 	},
 	"peerDependencies": {
 		"@nxgt/drizzle": ">=0.6.1 <1",
-		"@nxgt/janus": "^0.24.0",
+		"@nxgt/janus": "^0.25.0",
 		"drizzle-orm": ">=1.0.0-rc.4 <2",
 		"typescript": "^6.0.3 || ^7.0.0"
 	}