@yielded/auth-persistence-drizzle 0.1.0-beta.0 → 0.1.0-beta.12

package/dist/drizzle/password-prepared-sql.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"password-prepared-sql.mjs","names":["kernel"],"sources":["../../src/drizzle/password-prepared-sql.ts"],"sourcesContent":["import {\n  CurrentPasswordPreparedTransaction,\n  PasswordPreparedPostconditions,\n  PasswordPreparedJournalGuards,\n} from \"@yielded/auth-persistence/Adapter\";\nimport { CurrentCommitJournal, LifecycleHooks, HookConfigurationError } from \"@yielded/auth/Hooks\";\nimport {\n  PasswordUnavailable,\n  PasswordRejected,\n  PasswordPreparedVersion,\n  decodePasswordPreparedReady,\n  encodePasswordPreparedReady,\n  snapshotPasswordPreparedReady,\n  snapshotPasswordPreparedReservation,\n  type PasswordPreparedReady,\n  type PasswordPreparedReservation,\n  snapshotPasswordCredential,\n  snapshotPasswordRequirement,\n  type PasswordMutationDecision,\n  type PreparePasswordCommit,\n  type PasswordPreparedPersistence,\n  type PasswordPreparedMutation,\n} from \"@yielded/auth/Password\";\nimport { reportPersistenceFailure } from \"@yielded/auth/Persistence\";\nimport { type ProofCompletionPlan, ProofUnavailable, ProofBinding } from \"@yielded/auth/Proofs\";\nimport { AuthenticationRevision } from \"@yielded/auth/Sessions\";\n/* oxlint-disable no-explicit-any -- concrete driver makers retain consumer table types. */\nimport { and, count, eq, gt, isNotNull, isNull, lte, or, type SQL } from \"drizzle-orm\";\nimport { Cause, DateTime, Effect, Option, Predicate, Redacted, Schema } from \"effect\";\n\nimport { column } from \"./model\";\nimport {\n  requiredPasswordPreparedConstraints,\n  type AnyPasswordPreparedPersistenceMapping,\n  type PasswordPreparedState,\n} from \"./password-prepared-model\";\nimport {\n  ContextInput,\n  CompletionInput,\n  encodeReservation,\n  evidenceCurrent,\n  identifierScope,\n  reservationOf,\n  sameRevision,\n  snapshotMutation,\n  snapshotReserve,\n  unavailable,\n} from \"./password-prepared-state\";\nimport {\n  CurrentPasswordSql,\n  passwordSqlKernel as kernel,\n  type PasswordSqlConfiguration,\n  type PasswordSqlDatabase,\n  type PasswordSqlQuery,\n} from \"./password-sql\";\nimport { checkProofCompletionIn, completeProofPlanIn } from \"./proof-sql\";\n\nconst translateFailure = <A, E, R>(\n  effect: Effect.Effect<A, E, R>,\n): Effect.Effect<A, PasswordUnavailable, R> =>\n  reportPersistenceFailure(\n    effect,\n    (error) =>\n      Schema.is(PasswordUnavailable)(error) ||\n      Schema.is(ProofUnavailable)(error) ||\n      Schema.is(HookConfigurationError)(error),\n  ).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));\n\nconst translateContextFailure = <A, E, R>(\n  effect: Effect.Effect<A, E, R>,\n): Effect.Effect<A, PasswordUnavailable | PasswordRejected, R> =>\n  reportPersistenceFailure(\n    effect,\n    (error) =>\n      Schema.is(PasswordUnavailable)(error) ||\n      Schema.is(PasswordRejected)(error) ||\n      Schema.is(ProofUnavailable)(error) ||\n      Schema.is(HookConfigurationError)(error),\n  ).pipe(\n    Effect.catchCause((cause) =>\n      Effect.failCause(\n        Cause.map(cause, (error) => (Schema.is(PasswordRejected)(error) ? error : unavailable())),\n      ),\n    ),\n  );\n\ntype Mapping = AnyPasswordPreparedPersistenceMapping;\ntype Database = PasswordSqlDatabase;\nconst nowMillis = DateTime.now.pipe(Effect.map(DateTime.toEpochMillis));\n\nconst read = (query: PasswordSqlQuery, locking: boolean) =>\n  locking && typeof query.for === \"function\" ? query.for(\"update\") : query;\n\nconst columns = (mapping: Mapping) => {\n  const table = mapping.intent;\n\n  return {\n    moduleId: column(table.table, table.moduleId),\n    intentId: column(table.table, table.intentId),\n    commandId: column(table.table, table.commandId),\n    subjectId: column(table.table, table.subjectId),\n    action: column(table.table, table.action),\n    generation: column(table.table, table.generation),\n    version: column(table.table, table.version),\n    state: column(table.table, table.state),\n    digest: column(table.table, table.digest),\n    snapshot: column(table.table, table.snapshot),\n    identifierScope: column(table.table, table.identifierScope),\n    createdAt: column(table.table, table.createdAt),\n    admittedAt: column(table.table, table.admittedAt),\n    admissionRetainUntil: column(table.table, table.admissionRetainUntil),\n    preparationExpiresAt: column(table.table, table.preparationExpiresAt),\n    expiresAt: column(table.table, table.expiresAt),\n    retainUntil: column(table.table, table.retainUntil),\n  };\n};\n\nconst valid = (mapping: Mapping) =>\n  Object.entries(requiredPasswordPreparedConstraints).every(\n    ([key, value]) =>\n      mapping.constraints[key as keyof typeof requiredPasswordPreparedConstraints] === value,\n  );\n\nconst lockAnchor = Effect.fn(\"DrizzlePasswordPrepared.lockAnchor\")(function* (\n  mapping: Mapping,\n  configuration: PasswordSqlConfiguration,\n  moduleId: string,\n  create = true,\n) {\n  const database = yield* CurrentPasswordSql;\n\n  const a = mapping.admission,\n    key = column(a.table, a.moduleId);\n\n  if (create)\n    yield* configuration.insertIfAbsent(\n      database.insert(a.table).values(a.encodeInsert(moduleId)),\n      a.moduleId,\n      moduleId,\n    );\n\n  const rows = yield* read(\n    database.select().from(a.table).where(eq(key, moduleId)).limit(2),\n    configuration.locking,\n  );\n\n  if (rows.length > 1 || (create && rows.length !== 1)) return yield* unavailable();\n\n  return rows.length === 1;\n});\n\nconst bindingJson = Schema.encodeSync(Schema.fromJsonString(ProofBinding));\n\nconst captureAuthority = Effect.fn(\"DrizzlePasswordPrepared.captureAuthority\")(function* (\n  mapping: Mapping,\n  configuration: Pick<PasswordSqlConfiguration, \"locking\">,\n  input: {\n    readonly moduleId: string;\n    readonly action: PasswordPreparedReservation[\"action\"];\n    readonly subjectId: string;\n    readonly reset?: PasswordPreparedReservation[\"reset\"];\n  },\n) {\n  const database = yield* CurrentPasswordSql;\n\n  const p = mapping.password;\n  const locked = yield* kernel.lockSubject(p, input.subjectId, configuration.locking);\n\n  if (locked.row === undefined || !p.subject.isActiveStatus(locked.row[p.subject.status]))\n    return undefined;\n\n  const ic = kernel.identifierColumns(p),\n    ac = kernel.authorityCredentialColumns(p);\n\n  let identifier: any;\n\n  if (input.action !== \"add-password\") {\n    if (input.reset !== undefined)\n      identifier = (yield* kernel.lockIdentifier(\n        p,\n        input.reset.binding.identifier,\n        configuration.locking,\n      ))[0];\n    else {\n      const discovered = (yield* read(\n        database\n          .select()\n          .from(p.identifier.table)\n          .where(eq(ic.subjectId, locked.nativeSubjectId))\n          .orderBy(ic.namespace, ic.value),\n        false,\n      )).find((row: any) => p.identifier.isCurrent(row));\n\n      if (discovered !== undefined)\n        identifier = (yield* kernel.lockIdentifier(\n          p,\n          {\n            namespace: discovered[p.identifier.namespace],\n            value: discovered[p.identifier.value],\n          } as any,\n          configuration.locking,\n        ))[0];\n    }\n    if (\n      identifier === undefined ||\n      !p.identifier.isCurrent(identifier) ||\n      !p.subjectId.equals(identifier[p.identifier.subjectId], locked.nativeSubjectId)\n    )\n      return undefined;\n  }\n\n  const credential = (yield* kernel.readPasswordCredential(\n    p,\n    input.moduleId,\n    locked.nativeSubjectId,\n    configuration.locking,\n  ))[0];\n\n  if ((input.action === \"add-password\") !== (credential === undefined)) return undefined;\n\n  const snapshot =\n    credential === undefined\n      ? undefined\n      : yield* p.credential\n          .decode({ moduleId: input.moduleId, subject: locked.row, identifier, credential })\n          .pipe(Effect.flatMap(snapshotPasswordCredential));\n\n  if (\n    snapshot !== undefined &&\n    (snapshot.moduleId !== input.moduleId ||\n      snapshot.revision.subjectId !== input.subjectId ||\n      snapshot.revision.securityRevision !== locked.row[p.subject.securityRevision] ||\n      snapshot.credentialId !== credential[p.credential.credentialId] ||\n      snapshot.credentialRevision !== credential[p.credential.credentialRevision] ||\n      snapshot.verifierVersion !== credential[p.credential.verifierVersion] ||\n      Redacted.value(snapshot.verifier) !== credential[p.credential.verifier] ||\n      snapshot.normalization !== credential[p.credential.normalization] ||\n      snapshot.identifier.namespace !== identifier[p.identifier.namespace] ||\n      snapshot.identifier.value !== identifier[p.identifier.value] ||\n      snapshot.identifierBindingRevision !== identifier[p.identifier.bindingRevision])\n  )\n    return undefined;\n\n  const factors = yield* read(\n    database\n      .select()\n      .from(p.authorityCredential.table)\n      .where(eq(ac.subjectId, locked.nativeSubjectId))\n      .orderBy(ac.credentialId),\n    configuration.locking,\n  );\n\n  const active = factors.filter(\n    (row: any) =>\n      p.authorityCredential.status === undefined ||\n      p.authorityCredential.isActiveStatus?.(row[p.authorityCredential.status]) === true,\n  );\n\n  if (active.length > 64) return yield* unavailable();\n\n  const revision =\n    snapshot?.revision ??\n    AuthenticationRevision.make({\n      subjectId: input.subjectId as any,\n      securityRevision: locked.row[p.subject.securityRevision],\n      credentials: active.map((row: any) => ({\n        credentialId: row[p.authorityCredential.credentialId],\n        revision: row[p.authorityCredential.revision],\n      })),\n    });\n\n  if (\n    revision.credentials.some(\n      (expected) =>\n        !active.some(\n          (row: any) =>\n            row[p.authorityCredential.credentialId] === expected.credentialId &&\n            row[p.authorityCredential.revision] === expected.revision,\n        ),\n    )\n  )\n    return undefined;\n\n  const requirement = yield* p.subject\n    .decodeActionRequirement(locked.row, input.action)\n    .pipe(Effect.flatMap(snapshotPasswordRequirement));\n\n  return { ...locked, identifier, snapshot, revision, requirement };\n});\n\nconst currentAuthority = Effect.fn(\"DrizzlePasswordPrepared.currentAuthority\")(function* (\n  mapping: Mapping,\n  configuration: Pick<PasswordSqlConfiguration, \"locking\">,\n  record: PasswordPreparedReservation | PasswordPreparedReady,\n) {\n  const current = yield* captureAuthority(mapping, configuration, {\n    moduleId: record.moduleId,\n    action: record.action,\n    subjectId: record.revision.subjectId,\n    ...(record.reset === undefined ? {} : { reset: record.reset }),\n  });\n\n  if (\n    current === undefined ||\n    !sameRevision(current.revision, record.revision) ||\n    (current.snapshot === undefined\n      ? record.credential !== undefined\n      : record.credential === undefined ||\n        !kernel.sameCredentialSnapshot(current.snapshot, record.credential))\n  )\n    return undefined;\n\n  return current;\n});\n\nconst rowCondition = (mapping: Mapping, row: any) => {\n  const c = columns(mapping);\n\n  return and(\n    ...Object.entries(c).map(([key, value]) => {\n      const field = mapping.intent[key as keyof typeof c],\n        item = row[field];\n\n      return Predicate.isNullish(item) ? isNull(value) : eq(value, item);\n    }),\n  )!;\n};\n\nconst readIntent = Effect.fn(\"Drizzle.readIntent\")(function* (\n  mapping: Mapping,\n  condition: SQL,\n  locking: boolean,\n) {\n  const database = yield* CurrentPasswordSql;\n\n  return yield* read(\n    database.select().from(mapping.intent.table).where(condition).limit(2),\n    locking,\n  );\n});\n\nconst recordMatches = Effect.fn(\"DrizzlePasswordPrepared.recordMatches\")(function* (\n  mapping: Mapping,\n  row: any,\n  record: PasswordPreparedReservation | PasswordPreparedReady,\n  nativeSubjectId: unknown,\n  snapshot: string,\n) {\n  const t = mapping.intent,\n    p = mapping.password;\n\n  if (\n    row === undefined ||\n    row[t.moduleId] !== record.moduleId ||\n    row[t.intentId] !== record.intentId ||\n    row[t.commandId] !== record.commandId ||\n    !p.subjectId.equals(row[t.subjectId], nativeSubjectId) ||\n    row[t.action] !== record.action ||\n    row[t.generation] !== record.generation ||\n    row[t.version] !== record.version ||\n    row[t.state] !== t.states[record._tag] ||\n    row[t.snapshot] !== snapshot ||\n    row[t.identifierScope] !== identifierScope(record) ||\n    (record._tag === \"Ready\"\n      ? row[t.digest] !== record.digest\n      : !Predicate.isNullish(row[t.digest]))\n  )\n    return false;\n  for (const [key, instant] of [\n    [t.createdAt, record.createdAtMillis],\n    [t.preparationExpiresAt, record.preparationExpiresAtMillis],\n    [t.retainUntil, record.retainUntilMillis],\n  ] as const)\n    if ((yield* p.decodeInstant(row[key])) !== instant) return false;\n\n  return record._tag === \"Ready\"\n    ? (yield* p.decodeInstant(row[t.expiresAt])) === record.expiresAtMillis\n    : Predicate.isNullish(row[t.expiresAt]);\n});\n\nconst terminal = Effect.fn(\"DrizzlePasswordPrepared.terminal\")(function* (\n  mapping: Mapping,\n  row: any,\n  state: Exclude<PasswordPreparedState, \"Preparing\" | \"Ready\">,\n) {\n  const database = yield* CurrentPasswordSql;\n\n  yield* database\n    .update(mapping.intent.table)\n    .set(mapping.intent.encodeTerminal(state))\n    .where(rowCondition(mapping, row));\n\n  const c = columns(mapping),\n    t = mapping.intent;\n\n  const rows = yield* readIntent(\n    mapping,\n    and(eq(c.moduleId, row[t.moduleId]), eq(c.intentId, row[t.intentId]))!,\n    false,\n  );\n\n  const expected = { ...row, [t.state]: t.states[state], [t.snapshot]: null, [t.digest]: null };\n\n  if (\n    rows.length !== 1 ||\n    (yield* readIntent(mapping, rowCondition(mapping, expected), false)).length !== 1\n  )\n    return yield* unavailable();\n});\n\nexport const makeSqlPasswordPreparedPersistence = Effect.fn(\"makeSqlPasswordPreparedPersistence\")(\n  function* (\n    database: Database,\n    mapping: Mapping,\n    configuration: PasswordSqlConfiguration,\n  ): Effect.fn.Return<PasswordPreparedPersistence, never, LifecycleHooks> {\n    const hooks = yield* LifecycleHooks;\n\n    const p = mapping.password,\n      c = columns(mapping),\n      t = mapping.intent;\n\n    const owned = <A, E, R>(body: Effect.Effect<A, E, R>) =>\n      valid(mapping)\n        ? kernel.owned(\n            database,\n            p,\n            configuration,\n            Effect.gen(function* () {\n              const journal = yield* CurrentCommitJournal;\n              const guards = yield* Effect.serviceOption(PasswordPreparedJournalGuards);\n\n              if (Option.isSome(guards) && !guards.value.register(journal.prepare(undefined)))\n                return yield* unavailable();\n\n              return yield* body;\n            }),\n          )\n        : Effect.fail(unavailable());\n\n    const complete = <A>(\n      uncaptured: PasswordPreparedMutation & { readonly completion?: ProofCompletionPlan },\n      prepare: PreparePasswordCommit<PasswordMutationDecision, A>,\n    ) =>\n      Effect.gen(function* () {\n        const input = yield* snapshotMutation(uncaptured);\n\n        const completion =\n          uncaptured.completion === undefined\n            ? undefined\n            : {\n                prepare: uncaptured.completion.prepare,\n                input: yield* Schema.encodeEffect(Schema.fromJsonString(CompletionInput))(\n                  uncaptured.completion.input,\n                ).pipe(\n                  Effect.flatMap(Schema.decodeEffect(Schema.fromJsonString(CompletionInput))),\n                  Effect.mapError(unavailable),\n                ),\n              };\n\n        if (\n          (input.intent.action === \"reset-password\") !== (completion !== undefined) ||\n          (completion !== undefined && configuration.proof === undefined)\n        )\n          return yield* unavailable();\n\n        return yield* owned(\n          Effect.gen(function* () {\n            const transaction = yield* CurrentPasswordSql;\n            const journal = yield* CurrentCommitJournal;\n\n            yield* lockAnchor(mapping, configuration, input.intent.moduleId);\n\n            const authority = yield* kernel.validateMutationAuthority(\n              p,\n              configuration,\n              input.mutation,\n              input.intent.action,\n            );\n\n            if (authority === undefined) return prepare(\"rejected\", journal);\n            const current = yield* currentAuthority(mapping, configuration, input.intent);\n\n            if (current === undefined) return prepare(\"rejected\", journal);\n\n            const rows = yield* readIntent(\n              mapping,\n              and(eq(c.moduleId, input.intent.moduleId), eq(c.intentId, input.intent.intentId))!,\n              configuration.locking,\n            );\n\n            const row = rows[0],\n              encoded = yield* encodePasswordPreparedReady(input.intent);\n\n            if (\n              rows.length !== 1 ||\n              !(yield* recordMatches(\n                mapping,\n                row,\n                input.intent,\n                current.nativeSubjectId,\n                encoded,\n              )) ||\n              !evidenceCurrent(input, current.requirement, yield* nowMillis) ||\n              (yield* kernel.commandExists(\n                p,\n                input.intent.moduleId,\n                input.intent.commandId,\n                configuration.locking,\n              )).length !== 0\n            )\n              return prepare(\"rejected\", journal);\n            if (\n              completion !== undefined &&\n              (input.intent.reset === undefined ||\n                completion.input.continuationId !== input.intent.reset.continuationId ||\n                bindingJson(completion.input.binding) !== bindingJson(input.intent.reset.binding) ||\n                !kernel.proofCompletionMatchesPassword({ ...input.mutation, completion }))\n            )\n              return prepare(\"rejected\", journal);\n\n            const credentialRevision = yield* kernel.allocate(\n              configuration.mode,\n              p.allocateRevision,\n              p.allocateRevisionSync,\n            );\n\n            const verifierVersion = yield* kernel.allocate(\n              configuration.mode,\n              p.allocateRevision,\n              p.allocateRevisionSync,\n            );\n\n            const nextSecurityRevision = yield* kernel.allocateNextSecurityRevision(\n              p,\n              configuration.mode,\n              input.intent.revision.securityRevision,\n            );\n\n            if (\n              nextSecurityRevision === input.intent.revision.securityRevision ||\n              credentialRevision === input.intent.credential?.credentialRevision ||\n              verifierVersion === input.intent.credential?.verifierVersion\n            )\n              return yield* unavailable();\n\n            const credentialId =\n              input.intent.action === \"add-password\"\n                ? yield* kernel.allocate(\n                    configuration.mode,\n                    p.allocateCredentialId,\n                    p.allocateCredentialIdSync,\n                  )\n                : undefined;\n\n            let appliedAt: number | undefined;\n\n            const assertApplied = Effect.fn(\"DrizzlePasswordPrepared.assertApplied\")(() =>\n              Effect.flatMap(CurrentPasswordPreparedTransaction, (currentTransaction) =>\n                Effect.gen(function* () {\n                  if (appliedAt === undefined) return;\n\n                  if (\n                    !(yield* kernel.checkMutationApplied(\n                      p,\n                      input.mutation,\n                      current.nativeSubjectId,\n                      {\n                        credentialId: credentialId ?? input.intent.credential!.credentialId,\n                        credentialRevision,\n                        verifierVersion,\n                        nextSecurityRevision,\n                      },\n                      appliedAt,\n                    )) ||\n                    (yield* readIntent(\n                      mapping,\n                      rowCondition(mapping, {\n                        ...row,\n                        [t.state]: t.states.Consumed,\n                        [t.snapshot]: null,\n                        [t.digest]: null,\n                      }),\n                      false,\n                    )).length !== 1 ||\n                    !evidenceCurrent(input, current.requirement, yield* nowMillis)\n                  )\n                    return yield* unavailable();\n                }).pipe(Effect.provideService(CurrentPasswordSql, currentTransaction)),\n              ),\n            );\n\n            const validateApplied = Effect.gen(function* () {\n              yield* assertApplied().pipe(\n                Effect.provideService(CurrentPasswordPreparedTransaction, transaction),\n              );\n              if (appliedAt === undefined) return;\n              const postconditions = yield* Effect.serviceOption(PasswordPreparedPostconditions);\n\n              if (\n                Option.isSome(postconditions) &&\n                !postconditions.value.register(assertApplied().pipe(translateFailure))\n              )\n                return yield* unavailable();\n            });\n\n            const apply = Effect.fn(\"DrizzlePasswordPrepared.apply\")(function* () {\n              const finalNow = yield* nowMillis;\n\n              if (!evidenceCurrent(input, current.requirement, finalNow)) return false;\n\n              const changed =\n                input.intent.action === \"add-password\"\n                  ? yield* kernel.addPasswordIn(\n                      p,\n                      configuration,\n                      input.mutation,\n                      {\n                        credentialId: credentialId!,\n                        credentialRevision,\n                        verifierVersion,\n                        nextSecurityRevision,\n                      },\n                      finalNow,\n                    )\n                  : yield* kernel.writeReplacement(\n                      p,\n                      input.mutation,\n                      current.nativeSubjectId,\n                      { credentialRevision, verifierVersion, nextSecurityRevision },\n                      finalNow,\n                    );\n\n              if (!changed) return yield* unavailable();\n              appliedAt = finalNow;\n              yield* terminal(mapping, row, \"Consumed\");\n              if (!evidenceCurrent(input, current.requirement, yield* nowMillis))\n                return yield* unavailable();\n\n              return true;\n            });\n\n            if (completion !== undefined) {\n              let receipt: ReturnType<typeof prepare> | undefined;\n\n              yield* completeProofPlanIn(\n                configuration.proof!.mapping,\n                configuration.proof!.configuration,\n                completion,\n                Effect.gen(function* () {\n                  return yield* apply();\n                }),\n                (decision) => {\n                  receipt = prepare(decision === \"completed\" ? \"changed\" : \"rejected\", journal);\n\n                  return decision;\n                },\n              );\n\n              yield* validateApplied;\n\n              return receipt ?? prepare(\"rejected\", journal);\n            }\n\n            const changed = yield* apply();\n\n            yield* validateApplied;\n\n            return prepare(changed ? \"changed\" : \"rejected\", journal);\n          }),\n        );\n      });\n\n    const services: PasswordPreparedPersistence = {\n      reserve: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const input = yield* snapshotReserve(uncaptured);\n\n          if (\n            (input.action === \"reset-password\") !==\n              (input.reset !== undefined && input.completion !== undefined) ||\n            (input.action === \"reset-password\" && configuration.proof === undefined) ||\n            input.generation !== input.policy.generation ||\n            input.policy.retentionMillis <\n              Math.max(\n                input.policy.preparationLifetimeMillis + input.policy.lifetimeMillis,\n                input.policy.admission.action.windowMillis,\n                input.policy.admission.identifier.windowMillis,\n                input.policy.admission.subject.windowMillis,\n              ) ||\n            (input.invalidation.existingSessions === \"immediate\" &&\n              p.sessionInvalidation !== \"same-authority-immediate\")\n          )\n            return yield* unavailable();\n\n          return yield* owned(\n            Effect.gen(function* () {\n              const transaction = yield* CurrentPasswordSql;\n              const journal = yield* CurrentCommitJournal;\n\n              yield* lockAnchor(mapping, configuration, input.moduleId);\n\n              const version = PasswordPreparedVersion.make(\n                yield* kernel.allocate(\n                  configuration.mode,\n                  mapping.allocateVersion,\n                  mapping.allocateVersionSync,\n                ),\n              );\n\n              const authority = yield* captureAuthority(mapping, configuration, input);\n\n              if (authority === undefined) return yield* unavailable();\n              if (input.reset !== undefined) {\n                if (\n                  input.completion === undefined ||\n                  input.completion.moduleId !== `${input.moduleId}/reset` ||\n                  input.completion.purpose !== \"password-reset\" ||\n                  input.reset.continuationId !== input.completion.continuationId ||\n                  bindingJson(input.reset.binding) !== bindingJson(input.completion.binding) ||\n                  input.reset.binding._tag !== \"Subject\" ||\n                  !sameRevision(input.reset.binding.revision, authority.revision) ||\n                  authority.snapshot?.identifierVerifiedAtMillis === undefined ||\n                  !(yield* checkProofCompletionIn(\n                    configuration.proof!.mapping,\n                    configuration.proof!.configuration,\n                    input.completion,\n                  ))\n                )\n                  return yield* unavailable();\n              }\n              if (\n                (yield* readIntent(\n                  mapping,\n                  and(eq(c.moduleId, input.moduleId), eq(c.commandId, input.commandId))!,\n                  configuration.locking,\n                )).length\n              )\n                return prepare({ _tag: \"Existing\" }, journal);\n\n              const now = yield* nowMillis,\n                nativeNow = p.encodeInstant(now);\n\n              const scope = identifierScope({\n                credential: authority.snapshot,\n                revision: authority.revision,\n              });\n\n              const active =\n                (yield* read(\n                  transaction\n                    .select({ total: count() })\n                    .from(t.table)\n                    .where(\n                      and(\n                        eq(c.moduleId, input.moduleId),\n                        eq(c.subjectId, authority.nativeSubjectId),\n                        or(\n                          and(\n                            eq(c.state, t.states.Preparing),\n                            gt(c.preparationExpiresAt, nativeNow),\n                          ),\n                          and(eq(c.state, t.states.Ready), gt(c.expiresAt, nativeNow)),\n                        ),\n                      ),\n                    ),\n                  false,\n                ))[0]?.total ?? 0;\n\n              if (active >= input.policy.maximumPendingPerSubject) return yield* unavailable();\n              for (const [condition, budget] of [\n                [eq(c.action, input.action), input.policy.admission.action],\n                [eq(c.identifierScope, scope), input.policy.admission.identifier],\n                [eq(c.subjectId, authority.nativeSubjectId), input.policy.admission.subject],\n              ] as const) {\n                const total =\n                  (yield* read(\n                    transaction\n                      .select({ total: count() })\n                      .from(t.table)\n                      .where(\n                        and(\n                          eq(c.moduleId, input.moduleId),\n                          condition,\n                          gt(c.admittedAt, p.encodeInstant(now - budget.windowMillis)),\n                        ),\n                      ),\n                    false,\n                  ))[0]?.total ?? 0;\n\n                if (total >= budget.limit) return yield* unavailable();\n              }\n\n              const reservation = yield* snapshotPasswordPreparedReservation({\n                _tag: \"Preparing\",\n                moduleId: input.moduleId,\n                generation: input.generation,\n                intentId: input.intentId,\n                version,\n                commandId: input.commandId,\n                action: input.action,\n                revision: authority.revision,\n                ...(authority.snapshot === undefined ? {} : { credential: authority.snapshot }),\n                capturedRequirement: authority.requirement,\n                ...(input.reset === undefined ? {} : { reset: input.reset }),\n                invalidation: input.invalidation,\n                createdAtMillis: now,\n                preparationExpiresAtMillis: now + input.policy.preparationLifetimeMillis,\n                retainUntilMillis: now + input.policy.retentionMillis,\n              });\n\n              const snapshot = yield* encodeReservation(reservation);\n\n              yield* transaction.insert(t.table).values(\n                t.encodeInsert({\n                  reservation,\n                  nativeSubjectId: authority.nativeSubjectId,\n                  identifierScope: scope,\n                  snapshot,\n                  admittedAtMillis: now,\n                  admissionRetainUntilMillis:\n                    now +\n                    Math.max(\n                      input.policy.admission.action.windowMillis,\n                      input.policy.admission.identifier.windowMillis,\n                      input.policy.admission.subject.windowMillis,\n                    ),\n                }),\n              );\n\n              const rows = yield* readIntent(\n                mapping,\n                and(eq(c.moduleId, input.moduleId), eq(c.intentId, input.intentId))!,\n                false,\n              );\n\n              if (\n                rows.length !== 1 ||\n                !(yield* recordMatches(\n                  mapping,\n                  rows[0],\n                  reservation,\n                  authority.nativeSubjectId,\n                  snapshot,\n                ))\n              )\n                return yield* unavailable();\n\n              const admittedUntil =\n                now +\n                Math.max(\n                  input.policy.admission.action.windowMillis,\n                  input.policy.admission.identifier.windowMillis,\n                  input.policy.admission.subject.windowMillis,\n                );\n\n              if (\n                (yield* p.decodeInstant(rows[0][t.admittedAt])) !== now ||\n                (yield* p.decodeInstant(rows[0][t.admissionRetainUntil])) !== admittedUntil ||\n                (yield* nowMillis) >= reservation.preparationExpiresAtMillis ||\n                (input.completion !== undefined &&\n                  !(yield* checkProofCompletionIn(\n                    configuration.proof!.mapping,\n                    configuration.proof!.configuration,\n                    input.completion,\n                  )))\n              )\n                return yield* unavailable();\n\n              return prepare({ _tag: \"Reserved\", reservation }, journal);\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      publishReady: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const reservation = yield* snapshotPasswordPreparedReservation(uncaptured.reservation),\n            ready = yield* snapshotPasswordPreparedReady(uncaptured.ready);\n\n          const snapshot = yield* encodeReservation(reservation),\n            readySnapshot = yield* encodePasswordPreparedReady(ready);\n\n          if ((yield* encodeReservation(reservationOf(ready))) !== snapshot)\n            return yield* unavailable();\n\n          return yield* owned(\n            Effect.gen(function* () {\n              const transaction = yield* CurrentPasswordSql;\n              const journal = yield* CurrentCommitJournal;\n\n              yield* lockAnchor(mapping, configuration, reservation.moduleId);\n              const authority = yield* currentAuthority(mapping, configuration, reservation);\n\n              if (authority === undefined) return prepare(\"rejected\", journal);\n\n              const rows = yield* readIntent(\n                  mapping,\n                  and(eq(c.moduleId, reservation.moduleId), eq(c.intentId, reservation.intentId))!,\n                  configuration.locking,\n                ),\n                row = rows[0];\n\n              const now = yield* nowMillis;\n\n              if (\n                rows.length !== 1 ||\n                !(yield* recordMatches(\n                  mapping,\n                  row,\n                  reservation,\n                  authority.nativeSubjectId,\n                  snapshot,\n                )) ||\n                now < ready.issuedAtMillis ||\n                now >= reservation.preparationExpiresAtMillis ||\n                now >= ready.expiresAtMillis\n              )\n                return prepare(\"rejected\", journal);\n              yield* transaction\n                .update(t.table)\n                .set(t.encodeReady({ ready, snapshot: readySnapshot }))\n                .where(rowCondition(mapping, row));\n\n              const saved = yield* readIntent(\n                mapping,\n                and(eq(c.moduleId, ready.moduleId), eq(c.intentId, ready.intentId))!,\n                false,\n              );\n\n              if (\n                saved.length !== 1 ||\n                !(yield* recordMatches(\n                  mapping,\n                  saved[0],\n                  ready,\n                  authority.nativeSubjectId,\n                  readySnapshot,\n                )) ||\n                (yield* readIntent(\n                  mapping,\n                  and(\n                    eq(c.moduleId, ready.moduleId),\n                    eq(c.intentId, ready.intentId),\n                    eq(c.admittedAt, row[t.admittedAt]),\n                    eq(c.admissionRetainUntil, row[t.admissionRetainUntil]),\n                  )!,\n                  false,\n                )).length !== 1\n              )\n                return yield* unavailable();\n              if (\n                (yield* nowMillis) >= reservation.preparationExpiresAtMillis ||\n                (yield* nowMillis) >= ready.expiresAtMillis\n              )\n                return yield* unavailable();\n\n              return prepare(\"published\", journal);\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      context: (uncaptured) =>\n        Effect.gen(function* () {\n          const input = yield* Schema.decodeEffect(ContextInput)({ ...uncaptured }).pipe(\n            Effect.mapError(unavailable),\n          );\n\n          const record = yield* kernel.safeRead(\n            database,\n            configuration,\n            Effect.gen(function* () {\n              if (\n                !valid(mapping) ||\n                !(yield* lockAnchor(mapping, configuration, input.moduleId, false))\n              )\n                return undefined;\n\n              const rows = yield* readIntent(\n                mapping,\n                and(\n                  eq(c.moduleId, input.moduleId),\n                  eq(c.generation, input.generation),\n                  eq(c.digest, input.digest),\n                  eq(c.state, t.states.Ready),\n                )!,\n                false,\n              );\n\n              if (rows.length !== 1) return undefined;\n              const selected = yield* decodePasswordPreparedReady(rows[0][t.snapshot]);\n              const authority = yield* currentAuthority(mapping, configuration, selected);\n\n              if (authority === undefined) return undefined;\n\n              const locked = yield* readIntent(\n                mapping,\n                rowCondition(mapping, rows[0]),\n                configuration.locking,\n              );\n\n              const now = yield* nowMillis;\n\n              if (\n                locked.length !== 1 ||\n                now < selected.issuedAtMillis ||\n                now >= selected.expiresAtMillis ||\n                selected.moduleId !== input.moduleId ||\n                selected.generation !== input.generation ||\n                selected.digest !== input.digest ||\n                !(yield* recordMatches(\n                  mapping,\n                  locked[0],\n                  selected,\n                  authority.nativeSubjectId,\n                  yield* encodePasswordPreparedReady(selected),\n                ))\n              )\n                return undefined;\n\n              return { record: selected, currentRequirement: authority.requirement };\n            }),\n          );\n\n          return record ?? (yield* PasswordRejected.make({}));\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateContextFailure,\n        ),\n      complete: (input, prepare) =>\n        complete(input, prepare).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      resetWithProof: (input, prepare) =>\n        complete(input, prepare).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      cancel: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const record = yield* snapshotPasswordPreparedReady(uncaptured.record),\n            snapshot = yield* encodePasswordPreparedReady(record);\n\n          return yield* owned(\n            Effect.gen(function* () {\n              const journal = yield* CurrentCommitJournal;\n\n              yield* lockAnchor(mapping, configuration, record.moduleId);\n              const authority = yield* currentAuthority(mapping, configuration, record);\n\n              if (authority === undefined) return prepare(false, journal);\n\n              const rows = yield* readIntent(\n                mapping,\n                and(eq(c.moduleId, record.moduleId), eq(c.intentId, record.intentId))!,\n                configuration.locking,\n              );\n\n              const now = yield* nowMillis;\n\n              if (\n                rows.length !== 1 ||\n                now < record.issuedAtMillis ||\n                now >= record.expiresAtMillis ||\n                !(yield* recordMatches(\n                  mapping,\n                  rows[0],\n                  record,\n                  authority.nativeSubjectId,\n                  snapshot,\n                ))\n              )\n                return prepare(false, journal);\n              yield* terminal(mapping, rows[0], \"Cancelled\");\n\n              return prepare(true, journal);\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      cleanup: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const input = { ...uncaptured };\n\n          if (!Number.isSafeInteger(input.limit) || input.limit < 1 || input.limit > 1000)\n            return yield* unavailable();\n\n          return yield* owned(\n            Effect.gen(function* () {\n              const transaction = yield* CurrentPasswordSql;\n              const journal = yield* CurrentCommitJournal;\n\n              if (!(yield* lockAnchor(mapping, configuration, input.moduleId, false)))\n                return prepare({ removed: 0, hasMore: false }, journal);\n              const now = p.encodeInstant(yield* nowMillis);\n\n              const due = and(\n                eq(c.moduleId, input.moduleId),\n                or(\n                  and(lte(c.retainUntil, now), lte(c.admissionRetainUntil, now)),\n                  and(\n                    isNotNull(c.snapshot),\n                    or(\n                      and(eq(c.state, t.states.Preparing), lte(c.preparationExpiresAt, now)),\n                      and(eq(c.state, t.states.Ready), lte(c.expiresAt, now)),\n                    ),\n                  ),\n                ),\n              )!;\n\n              const rows = yield* read(\n                transaction\n                  .select()\n                  .from(t.table)\n                  .where(due)\n                  .orderBy(c.createdAt, c.intentId)\n                  .limit(input.limit + 1),\n                configuration.locking,\n              );\n\n              let removed = 0;\n\n              for (const row of rows.slice(0, input.limit)) {\n                const expired =\n                  (yield* readIntent(\n                    mapping,\n                    and(\n                      rowCondition(mapping, row),\n                      lte(c.retainUntil, now),\n                      lte(c.admissionRetainUntil, now),\n                    )!,\n                    false,\n                  )).length === 1;\n\n                if (expired) {\n                  yield* transaction.delete(t.table).where(rowCondition(mapping, row));\n                  if (\n                    (yield* readIntent(\n                      mapping,\n                      and(eq(c.moduleId, input.moduleId), eq(c.intentId, row[t.intentId]))!,\n                      false,\n                    )).length\n                  )\n                    return yield* unavailable();\n                  removed++;\n                } else yield* terminal(mapping, row, \"Expired\");\n              }\n\n              return prepare(\n                {\n                  removed,\n                  hasMore:\n                    (yield* read(transaction.select().from(t.table).where(due).limit(1), false))\n                      .length > 0,\n                },\n                journal,\n              );\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n    };\n\n    return services;\n  },\n);\n\nexport const passwordPreparedSqlKernel = {\n  columns,\n  recordMatches,\n  captureAuthority,\n  currentAuthority,\n  rowCondition,\n  valid,\n  identifierScope,\n};\n"],"mappings":";;;;;;;;;;;;;;AAyDA,MAAM,oBACJ,WAEA,yBACE,SACC,UACC,OAAO,GAAG,mBAAmB,CAAC,CAAC,KAAK,KACpC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,sBAAsB,CAAC,CAAC,KAAK,CAC3C,CAAC,CAAC,KAAK,OAAO,YAAY,UAAU,OAAO,UAAU,MAAM,IAAI,aAAa,YAAY,CAAC,CAAC,CAAC,CAAC;AAE9F,MAAM,2BACJ,WAEA,yBACE,SACC,UACC,OAAO,GAAG,mBAAmB,CAAC,CAAC,KAAK,KACpC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,sBAAsB,CAAC,CAAC,KAAK,CAC3C,CAAC,CAAC,KACA,OAAO,YAAY,UACjB,OAAO,UACL,MAAM,IAAI,QAAQ,UAAW,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,IAAI,QAAQ,YAAY,CAAE,CAC1F,CACF,CACF;AAIF,MAAM,YAAY,SAAS,IAAI,KAAK,OAAO,IAAI,SAAS,aAAa,CAAC;AAEtE,MAAM,QAAQ,OAAyB,YACrC,WAAW,OAAO,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,IAAI;AAErE,MAAM,WAAW,YAAqB;CACpC,MAAM,QAAQ,QAAQ;CAEtB,OAAO;EACL,UAAU,OAAO,MAAM,OAAO,MAAM,QAAQ;EAC5C,UAAU,OAAO,MAAM,OAAO,MAAM,QAAQ;EAC5C,WAAW,OAAO,MAAM,OAAO,MAAM,SAAS;EAC9C,WAAW,OAAO,MAAM,OAAO,MAAM,SAAS;EAC9C,QAAQ,OAAO,MAAM,OAAO,MAAM,MAAM;EACxC,YAAY,OAAO,MAAM,OAAO,MAAM,UAAU;EAChD,SAAS,OAAO,MAAM,OAAO,MAAM,OAAO;EAC1C,OAAO,OAAO,MAAM,OAAO,MAAM,KAAK;EACtC,QAAQ,OAAO,MAAM,OAAO,MAAM,MAAM;EACxC,UAAU,OAAO,MAAM,OAAO,MAAM,QAAQ;EAC5C,iBAAiB,OAAO,MAAM,OAAO,MAAM,eAAe;EAC1D,WAAW,OAAO,MAAM,OAAO,MAAM,SAAS;EAC9C,YAAY,OAAO,MAAM,OAAO,MAAM,UAAU;EAChD,sBAAsB,OAAO,MAAM,OAAO,MAAM,oBAAoB;EACpE,sBAAsB,OAAO,MAAM,OAAO,MAAM,oBAAoB;EACpE,WAAW,OAAO,MAAM,OAAO,MAAM,SAAS;EAC9C,aAAa,OAAO,MAAM,OAAO,MAAM,WAAW;CACpD;AACF;AAEA,MAAM,SAAS,YACb,OAAO,QAAQ,mCAAmC,CAAC,CAAC,OACjD,CAAC,KAAK,WACL,QAAQ,YAAY,SAA6D,KACrF;AAEF,MAAM,aAAa,OAAO,GAAG,oCAAoC,CAAC,CAAC,WACjE,SACA,eACA,UACA,SAAS,MACT;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,IAAI,QAAQ,WAChB,MAAM,OAAO,EAAE,OAAO,EAAE,QAAQ;CAElC,IAAI,QACF,OAAO,cAAc,eACnB,SAAS,OAAO,EAAE,KAAK,CAAC,CAAC,OAAO,EAAE,aAAa,QAAQ,CAAC,GACxD,EAAE,UACF,QACF;CAEF,MAAM,OAAO,OAAO,KAClB,SAAS,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,MAAM,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAChE,cAAc,OAChB;CAEA,IAAI,KAAK,SAAS,KAAM,UAAU,KAAK,WAAW,GAAI,OAAO,OAAO,YAAY;CAEhF,OAAO,KAAK,WAAW;AACzB,CAAC;AAED,MAAM,cAAc,OAAO,WAAW,OAAO,eAAe,YAAY,CAAC;AAEzE,MAAM,mBAAmB,OAAO,GAAG,0CAA0C,CAAC,CAAC,WAC7E,SACA,eACA,OAMA;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,IAAI,QAAQ;CAClB,MAAM,SAAS,OAAOA,kBAAO,YAAY,GAAG,MAAM,WAAW,cAAc,OAAO;CAElF,IAAI,OAAO,QAAQ,KAAA,KAAa,CAAC,EAAE,QAAQ,eAAe,OAAO,IAAI,EAAE,QAAQ,OAAO,GACpF,OAAO,KAAA;CAET,MAAM,KAAKA,kBAAO,kBAAkB,CAAC,GACnC,KAAKA,kBAAO,2BAA2B,CAAC;CAE1C,IAAI;CAEJ,IAAI,MAAM,WAAW,gBAAgB;EACnC,IAAI,MAAM,UAAU,KAAA,GAClB,cAAc,OAAOA,kBAAO,eAC1B,GACA,MAAM,MAAM,QAAQ,YACpB,cAAc,OAChB,EAAA,CAAG;OACA;GACH,MAAM,cAAc,OAAO,KACzB,SACG,OAAO,CAAC,CACR,KAAK,EAAE,WAAW,KAAK,CAAC,CACxB,MAAM,GAAG,GAAG,WAAW,OAAO,eAAe,CAAC,CAAC,CAC/C,QAAQ,GAAG,WAAW,GAAG,KAAK,GACjC,KACF,EAAA,CAAG,MAAM,QAAa,EAAE,WAAW,UAAU,GAAG,CAAC;GAEjD,IAAI,eAAe,KAAA,GACjB,cAAc,OAAOA,kBAAO,eAC1B,GACA;IACE,WAAW,WAAW,EAAE,WAAW;IACnC,OAAO,WAAW,EAAE,WAAW;GACjC,GACA,cAAc,OAChB,EAAA,CAAG;EACP;EACA,IACE,eAAe,KAAA,KACf,CAAC,EAAE,WAAW,UAAU,UAAU,KAClC,CAAC,EAAE,UAAU,OAAO,WAAW,EAAE,WAAW,YAAY,OAAO,eAAe,GAE9E,OAAO,KAAA;CACX;CAEA,MAAM,cAAc,OAAOA,kBAAO,uBAChC,GACA,MAAM,UACN,OAAO,iBACP,cAAc,OAChB,EAAA,CAAG;CAEH,IAAK,MAAM,WAAW,oBAAqB,eAAe,KAAA,IAAY,OAAO,KAAA;CAE7E,MAAM,WACJ,eAAe,KAAA,IACX,KAAA,IACA,OAAO,EAAE,WACN,OAAO;EAAE,UAAU,MAAM;EAAU,SAAS,OAAO;EAAK;EAAY;CAAW,CAAC,CAAC,CACjF,KAAK,OAAO,QAAQ,0BAA0B,CAAC;CAExD,IACE,aAAa,KAAA,MACZ,SAAS,aAAa,MAAM,YAC3B,SAAS,SAAS,cAAc,MAAM,aACtC,SAAS,SAAS,qBAAqB,OAAO,IAAI,EAAE,QAAQ,qBAC5D,SAAS,iBAAiB,WAAW,EAAE,WAAW,iBAClD,SAAS,uBAAuB,WAAW,EAAE,WAAW,uBACxD,SAAS,oBAAoB,WAAW,EAAE,WAAW,oBACrD,SAAS,MAAM,SAAS,QAAQ,MAAM,WAAW,EAAE,WAAW,aAC9D,SAAS,kBAAkB,WAAW,EAAE,WAAW,kBACnD,SAAS,WAAW,cAAc,WAAW,EAAE,WAAW,cAC1D,SAAS,WAAW,UAAU,WAAW,EAAE,WAAW,UACtD,SAAS,8BAA8B,WAAW,EAAE,WAAW,mBAEjE,OAAO,KAAA;CAWT,MAAM,UAAS,OATQ,KACrB,SACG,OAAO,CAAC,CACR,KAAK,EAAE,oBAAoB,KAAK,CAAC,CACjC,MAAM,GAAG,GAAG,WAAW,OAAO,eAAe,CAAC,CAAC,CAC/C,QAAQ,GAAG,YAAY,GAC1B,cAAc,OAChB,EAAA,CAEuB,QACpB,QACC,EAAE,oBAAoB,WAAW,KAAA,KACjC,EAAE,oBAAoB,iBAAiB,IAAI,EAAE,oBAAoB,OAAO,MAAM,IAClF;CAEA,IAAI,OAAO,SAAS,IAAI,OAAO,OAAO,YAAY;CAElD,MAAM,WACJ,UAAU,YACV,uBAAuB,KAAK;EAC1B,WAAW,MAAM;EACjB,kBAAkB,OAAO,IAAI,EAAE,QAAQ;EACvC,aAAa,OAAO,KAAK,SAAc;GACrC,cAAc,IAAI,EAAE,oBAAoB;GACxC,UAAU,IAAI,EAAE,oBAAoB;EACtC,EAAE;CACJ,CAAC;CAEH,IACE,SAAS,YAAY,MAClB,aACC,CAAC,OAAO,MACL,QACC,IAAI,EAAE,oBAAoB,kBAAkB,SAAS,gBACrD,IAAI,EAAE,oBAAoB,cAAc,SAAS,QACrD,CACJ,GAEA,OAAO,KAAA;CAET,MAAM,cAAc,OAAO,EAAE,QAC1B,wBAAwB,OAAO,KAAK,MAAM,MAAM,CAAC,CACjD,KAAK,OAAO,QAAQ,2BAA2B,CAAC;CAEnD,OAAO;EAAE,GAAG;EAAQ;EAAY;EAAU;EAAU;CAAY;AAClE,CAAC;AAED,MAAM,mBAAmB,OAAO,GAAG,0CAA0C,CAAC,CAAC,WAC7E,SACA,eACA,QACA;CACA,MAAM,UAAU,OAAO,iBAAiB,SAAS,eAAe;EAC9D,UAAU,OAAO;EACjB,QAAQ,OAAO;EACf,WAAW,OAAO,SAAS;EAC3B,GAAI,OAAO,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,OAAO,MAAM;CAC9D,CAAC;CAED,IACE,YAAY,KAAA,KACZ,CAAC,aAAa,QAAQ,UAAU,OAAO,QAAQ,MAC9C,QAAQ,aAAa,KAAA,IAClB,OAAO,eAAe,KAAA,IACtB,OAAO,eAAe,KAAA,KACtB,CAACA,kBAAO,uBAAuB,QAAQ,UAAU,OAAO,UAAU,IAEtE,OAAO,KAAA;CAET,OAAO;AACT,CAAC;AAED,MAAM,gBAAgB,SAAkB,QAAa;CACnD,MAAM,IAAI,QAAQ,OAAO;CAEzB,OAAO,IACL,GAAG,OAAO,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW;EACzC,MACE,OAAO,IADK,QAAQ,OAAO;EAG7B,OAAO,UAAU,UAAU,IAAI,IAAI,OAAO,KAAK,IAAI,GAAG,OAAO,IAAI;CACnE,CAAC,CACH;AACF;AAEA,MAAM,aAAa,OAAO,GAAG,oBAAoB,CAAC,CAAC,WACjD,SACA,WACA,SACA;CACA,MAAM,WAAW,OAAO;CAExB,OAAO,OAAO,KACZ,SAAS,OAAO,CAAC,CAAC,KAAK,QAAQ,OAAO,KAAK,CAAC,CAAC,MAAM,SAAS,CAAC,CAAC,MAAM,CAAC,GACrE,OACF;AACF,CAAC;AAED,MAAM,gBAAgB,OAAO,GAAG,uCAAuC,CAAC,CAAC,WACvE,SACA,KACA,QACA,iBACA,UACA;CACA,MAAM,IAAI,QAAQ,QAChB,IAAI,QAAQ;CAEd,IACE,QAAQ,KAAA,KACR,IAAI,EAAE,cAAc,OAAO,YAC3B,IAAI,EAAE,cAAc,OAAO,YAC3B,IAAI,EAAE,eAAe,OAAO,aAC5B,CAAC,EAAE,UAAU,OAAO,IAAI,EAAE,YAAY,eAAe,KACrD,IAAI,EAAE,YAAY,OAAO,UACzB,IAAI,EAAE,gBAAgB,OAAO,cAC7B,IAAI,EAAE,aAAa,OAAO,WAC1B,IAAI,EAAE,WAAW,EAAE,OAAO,OAAO,SACjC,IAAI,EAAE,cAAc,YACpB,IAAI,EAAE,qBAAqB,gBAAgB,MAAM,MAChD,OAAO,SAAS,UACb,IAAI,EAAE,YAAY,OAAO,SACzB,CAAC,UAAU,UAAU,IAAI,EAAE,OAAO,IAEtC,OAAO;CACT,KAAK,MAAM,CAAC,KAAK,YAAY;EAC3B,CAAC,EAAE,WAAW,OAAO,eAAe;EACpC,CAAC,EAAE,sBAAsB,OAAO,0BAA0B;EAC1D,CAAC,EAAE,aAAa,OAAO,iBAAiB;CAC1C,GACE,KAAK,OAAO,EAAE,cAAc,IAAI,IAAI,OAAO,SAAS,OAAO;CAE7D,OAAO,OAAO,SAAS,WAClB,OAAO,EAAE,cAAc,IAAI,EAAE,UAAU,OAAO,OAAO,kBACtD,UAAU,UAAU,IAAI,EAAE,UAAU;AAC1C,CAAC;AAED,MAAM,WAAW,OAAO,GAAG,kCAAkC,CAAC,CAAC,WAC7D,SACA,KACA,OACA;CAGA,QAAO,OAFiB,mBAAA,CAGrB,OAAO,QAAQ,OAAO,KAAK,CAAC,CAC5B,IAAI,QAAQ,OAAO,eAAe,KAAK,CAAC,CAAC,CACzC,MAAM,aAAa,SAAS,GAAG,CAAC;CAEnC,MAAM,IAAI,QAAQ,OAAO,GACvB,IAAI,QAAQ;CAEd,MAAM,OAAO,OAAO,WAClB,SACA,IAAI,GAAG,EAAE,UAAU,IAAI,EAAE,SAAS,GAAG,GAAG,EAAE,UAAU,IAAI,EAAE,SAAS,CAAC,GACpE,KACF;CAEA,MAAM,WAAW;EAAE,GAAG;GAAM,EAAE,QAAQ,EAAE,OAAO;GAAS,EAAE,WAAW;GAAO,EAAE,SAAS;CAAK;CAE5F,IACE,KAAK,WAAW,MACf,OAAO,WAAW,SAAS,aAAa,SAAS,QAAQ,GAAG,KAAK,EAAA,CAAG,WAAW,GAEhF,OAAO,OAAO,YAAY;AAC9B,CAAC;AAED,MAAa,qCAAqC,OAAO,GAAG,oCAAoC,CAAC,CAC/F,WACE,UACA,SACA,eACsE;CACtE,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,UAChB,IAAI,QAAQ,OAAO,GACnB,IAAI,QAAQ;CAEd,MAAM,SAAkB,SACtB,MAAM,OAAO,IACTA,kBAAO,MACL,UACA,GACA,eACA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO;EACvB,MAAM,SAAS,OAAO,OAAO,cAAc,6BAA6B;EAExE,IAAI,OAAO,OAAO,MAAM,KAAK,CAAC,OAAO,MAAM,SAAS,QAAQ,QAAQ,KAAA,CAAS,CAAC,GAC5E,OAAO,OAAO,YAAY;EAE5B,OAAO,OAAO;CAChB,CAAC,CACH,IACA,OAAO,KAAK,YAAY,CAAC;CAE/B,MAAM,YACJ,YACA,YAEA,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO,iBAAiB,UAAU;EAEhD,MAAM,aACJ,WAAW,eAAe,KAAA,IACtB,KAAA,IACA;GACE,SAAS,WAAW,WAAW;GAC/B,OAAO,OAAO,OAAO,aAAa,OAAO,eAAe,eAAe,CAAC,CAAC,CACvE,WAAW,WAAW,KACxB,CAAC,CAAC,KACA,OAAO,QAAQ,OAAO,aAAa,OAAO,eAAe,eAAe,CAAC,CAAC,GAC1E,OAAO,SAAS,WAAW,CAC7B;EACF;EAEN,IACG,MAAM,OAAO,WAAW,sBAAuB,eAAe,KAAA,MAC9D,eAAe,KAAA,KAAa,cAAc,UAAU,KAAA,GAErD,OAAO,OAAO,YAAY;EAE5B,OAAO,OAAO,MACZ,OAAO,IAAI,aAAa;GACtB,MAAM,cAAc,OAAO;GAC3B,MAAM,UAAU,OAAO;GAEvB,OAAO,WAAW,SAAS,eAAe,MAAM,OAAO,QAAQ;GAS/D,KAAI,OAPqBA,kBAAO,0BAC9B,GACA,eACA,MAAM,UACN,MAAM,OAAO,MACf,OAEkB,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;GAC/D,MAAM,UAAU,OAAO,iBAAiB,SAAS,eAAe,MAAM,MAAM;GAE5E,IAAI,YAAY,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;GAE7D,MAAM,OAAO,OAAO,WAClB,SACA,IAAI,GAAG,EAAE,UAAU,MAAM,OAAO,QAAQ,GAAG,GAAG,EAAE,UAAU,MAAM,OAAO,QAAQ,CAAC,GAChF,cAAc,OAChB;GAEA,MAAM,MAAM,KAAK,IACf,UAAU,OAAO,4BAA4B,MAAM,MAAM;GAE3D,IACE,KAAK,WAAW,KAChB,EAAE,OAAO,cACP,SACA,KACA,MAAM,QACN,QAAQ,iBACR,OACF,MACA,CAAC,gBAAgB,OAAO,QAAQ,aAAa,OAAO,SAAS,MAC5D,OAAOA,kBAAO,cACb,GACA,MAAM,OAAO,UACb,MAAM,OAAO,WACb,cAAc,OAChB,EAAA,CAAG,WAAW,GAEd,OAAO,QAAQ,YAAY,OAAO;GACpC,IACE,eAAe,KAAA,MACd,MAAM,OAAO,UAAU,KAAA,KACtB,WAAW,MAAM,mBAAmB,MAAM,OAAO,MAAM,kBACvD,YAAY,WAAW,MAAM,OAAO,MAAM,YAAY,MAAM,OAAO,MAAM,OAAO,KAChF,CAACA,kBAAO,+BAA+B;IAAE,GAAG,MAAM;IAAU;GAAW,CAAC,IAE1E,OAAO,QAAQ,YAAY,OAAO;GAEpC,MAAM,qBAAqB,OAAOA,kBAAO,SACvC,cAAc,MACd,EAAE,kBACF,EAAE,oBACJ;GAEA,MAAM,kBAAkB,OAAOA,kBAAO,SACpC,cAAc,MACd,EAAE,kBACF,EAAE,oBACJ;GAEA,MAAM,uBAAuB,OAAOA,kBAAO,6BACzC,GACA,cAAc,MACd,MAAM,OAAO,SAAS,gBACxB;GAEA,IACE,yBAAyB,MAAM,OAAO,SAAS,oBAC/C,uBAAuB,MAAM,OAAO,YAAY,sBAChD,oBAAoB,MAAM,OAAO,YAAY,iBAE7C,OAAO,OAAO,YAAY;GAE5B,MAAM,eACJ,MAAM,OAAO,WAAW,iBACpB,OAAOA,kBAAO,SACZ,cAAc,MACd,EAAE,sBACF,EAAE,wBACJ,IACA,KAAA;GAEN,IAAI;GAEJ,MAAM,gBAAgB,OAAO,GAAG,uCAAuC,CAAC,OACtE,OAAO,QAAQ,qCAAqC,uBAClD,OAAO,IAAI,aAAa;IACtB,IAAI,cAAc,KAAA,GAAW;IAE7B,IACE,EAAE,OAAOA,kBAAO,qBACd,GACA,MAAM,UACN,QAAQ,iBACR;KACE,cAAc,gBAAgB,MAAM,OAAO,WAAY;KACvD;KACA;KACA;IACF,GACA,SACF,OACC,OAAO,WACN,SACA,aAAa,SAAS;KACpB,GAAG;MACF,EAAE,QAAQ,EAAE,OAAO;MACnB,EAAE,WAAW;MACb,EAAE,SAAS;IACd,CAAC,GACD,KACF,EAAA,CAAG,WAAW,KACd,CAAC,gBAAgB,OAAO,QAAQ,aAAa,OAAO,SAAS,GAE7D,OAAO,OAAO,YAAY;GAC9B,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,oBAAoB,kBAAkB,CAAC,CACvE,CACF;GAEA,MAAM,kBAAkB,OAAO,IAAI,aAAa;IAC9C,OAAO,cAAc,CAAC,CAAC,KACrB,OAAO,eAAe,oCAAoC,WAAW,CACvE;IACA,IAAI,cAAc,KAAA,GAAW;IAC7B,MAAM,iBAAiB,OAAO,OAAO,cAAc,8BAA8B;IAEjF,IACE,OAAO,OAAO,cAAc,KAC5B,CAAC,eAAe,MAAM,SAAS,cAAc,CAAC,CAAC,KAAK,gBAAgB,CAAC,GAErE,OAAO,OAAO,YAAY;GAC9B,CAAC;GAED,MAAM,QAAQ,OAAO,GAAG,+BAA+B,CAAC,CAAC,aAAa;IACpE,MAAM,WAAW,OAAO;IAExB,IAAI,CAAC,gBAAgB,OAAO,QAAQ,aAAa,QAAQ,GAAG,OAAO;IAwBnE,IAAI,EArBF,MAAM,OAAO,WAAW,iBACpB,OAAOA,kBAAO,cACZ,GACA,eACA,MAAM,UACN;KACgB;KACd;KACA;KACA;IACF,GACA,QACF,IACA,OAAOA,kBAAO,iBACZ,GACA,MAAM,UACN,QAAQ,iBACR;KAAE;KAAoB;KAAiB;IAAqB,GAC5D,QACF,IAEQ,OAAO,OAAO,YAAY;IACxC,YAAY;IACZ,OAAO,SAAS,SAAS,KAAK,UAAU;IACxC,IAAI,CAAC,gBAAgB,OAAO,QAAQ,aAAa,OAAO,SAAS,GAC/D,OAAO,OAAO,YAAY;IAE5B,OAAO;GACT,CAAC;GAED,IAAI,eAAe,KAAA,GAAW;IAC5B,IAAI;IAEJ,OAAO,oBACL,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,YACA,OAAO,IAAI,aAAa;KACtB,OAAO,OAAO,MAAM;IACtB,CAAC,IACA,aAAa;KACZ,UAAU,QAAQ,aAAa,cAAc,YAAY,YAAY,OAAO;KAE5E,OAAO;IACT,CACF;IAEA,OAAO;IAEP,OAAO,WAAW,QAAQ,YAAY,OAAO;GAC/C;GAEA,MAAM,UAAU,OAAO,MAAM;GAE7B,OAAO;GAEP,OAAO,QAAQ,UAAU,YAAY,YAAY,OAAO;EAC1D,CAAC,CACH;CACF,CAAC;CA2fH,OAAO;EAxfL,UAAU,YAAY,YACpB,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,gBAAgB,UAAU;GAE/C,IACG,MAAM,WAAW,sBACf,MAAM,UAAU,KAAA,KAAa,MAAM,eAAe,KAAA,MACpD,MAAM,WAAW,oBAAoB,cAAc,UAAU,KAAA,KAC9D,MAAM,eAAe,MAAM,OAAO,cAClC,MAAM,OAAO,kBACX,KAAK,IACH,MAAM,OAAO,4BAA4B,MAAM,OAAO,gBACtD,MAAM,OAAO,UAAU,OAAO,cAC9B,MAAM,OAAO,UAAU,WAAW,cAClC,MAAM,OAAO,UAAU,QAAQ,YACjC,KACD,MAAM,aAAa,qBAAqB,eACvC,EAAE,wBAAwB,4BAE5B,OAAO,OAAO,YAAY;GAE5B,OAAO,OAAO,MACZ,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IAEvB,OAAO,WAAW,SAAS,eAAe,MAAM,QAAQ;IAExD,MAAM,UAAU,wBAAwB,KACtC,OAAOA,kBAAO,SACZ,cAAc,MACd,QAAQ,iBACR,QAAQ,mBACV,CACF;IAEA,MAAM,YAAY,OAAO,iBAAiB,SAAS,eAAe,KAAK;IAEvE,IAAI,cAAc,KAAA,GAAW,OAAO,OAAO,YAAY;IACvD,IAAI,MAAM,UAAU,KAAA,GAEhB;SAAA,MAAM,eAAe,KAAA,KACrB,MAAM,WAAW,aAAa,GAAG,MAAM,SAAS,WAChD,MAAM,WAAW,YAAY,oBAC7B,MAAM,MAAM,mBAAmB,MAAM,WAAW,kBAChD,YAAY,MAAM,MAAM,OAAO,MAAM,YAAY,MAAM,WAAW,OAAO,KACzE,MAAM,MAAM,QAAQ,SAAS,aAC7B,CAAC,aAAa,MAAM,MAAM,QAAQ,UAAU,UAAU,QAAQ,KAC9D,UAAU,UAAU,+BAA+B,KAAA,KACnD,EAAE,OAAO,uBACP,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MAAM,UACR,IAEA,OAAO,OAAO,YAAY;IAAA;IAE9B,KACG,OAAO,WACN,SACA,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,WAAW,MAAM,SAAS,CAAC,GACpE,cAAc,OAChB,EAAA,CAAG,QAEH,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,OAAO;IAE9C,MAAM,MAAM,OAAO,WACjB,YAAY,EAAE,cAAc,GAAG;IAEjC,MAAM,QAAQ,gBAAgB;KAC5B,YAAY,UAAU;KACtB,UAAU,UAAU;IACtB,CAAC;IAuBD,MApBG,OAAO,KACN,YACG,OAAO,EAAE,OAAO,MAAM,EAAE,CAAC,CAAC,CAC1B,KAAK,EAAE,KAAK,CAAC,CACb,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,WAAW,UAAU,eAAe,GACzC,GACE,IACE,GAAG,EAAE,OAAO,EAAE,OAAO,SAAS,GAC9B,GAAG,EAAE,sBAAsB,SAAS,CACtC,GACA,IAAI,GAAG,EAAE,OAAO,EAAE,OAAO,KAAK,GAAG,GAAG,EAAE,WAAW,SAAS,CAAC,CAC7D,CACF,CACF,GACF,KACF,EAAA,CAAG,EAAE,EAAE,SAAS,MAEJ,MAAM,OAAO,0BAA0B,OAAO,OAAO,YAAY;IAC/E,KAAK,MAAM,CAAC,WAAW,WAAW;KAChC,CAAC,GAAG,EAAE,QAAQ,MAAM,MAAM,GAAG,MAAM,OAAO,UAAU,MAAM;KAC1D,CAAC,GAAG,EAAE,iBAAiB,KAAK,GAAG,MAAM,OAAO,UAAU,UAAU;KAChE,CAAC,GAAG,EAAE,WAAW,UAAU,eAAe,GAAG,MAAM,OAAO,UAAU,OAAO;IAC7E,GAgBE,MAdG,OAAO,KACN,YACG,OAAO,EAAE,OAAO,MAAM,EAAE,CAAC,CAAC,CAC1B,KAAK,EAAE,KAAK,CAAC,CACb,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,WACA,GAAG,EAAE,YAAY,EAAE,cAAc,MAAM,OAAO,YAAY,CAAC,CAC7D,CACF,GACF,KACF,EAAA,CAAG,EAAE,EAAE,SAAS,MAEL,OAAO,OAAO,OAAO,OAAO,YAAY;IAGvD,MAAM,cAAc,OAAO,oCAAoC;KAC7D,MAAM;KACN,UAAU,MAAM;KAChB,YAAY,MAAM;KAClB,UAAU,MAAM;KAChB;KACA,WAAW,MAAM;KACjB,QAAQ,MAAM;KACd,UAAU,UAAU;KACpB,GAAI,UAAU,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY,UAAU,SAAS;KAC7E,qBAAqB,UAAU;KAC/B,GAAI,MAAM,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;KAC1D,cAAc,MAAM;KACpB,iBAAiB;KACjB,4BAA4B,MAAM,MAAM,OAAO;KAC/C,mBAAmB,MAAM,MAAM,OAAO;IACxC,CAAC;IAED,MAAM,WAAW,OAAO,kBAAkB,WAAW;IAErD,OAAO,YAAY,OAAO,EAAE,KAAK,CAAC,CAAC,OACjC,EAAE,aAAa;KACb;KACA,iBAAiB,UAAU;KAC3B,iBAAiB;KACjB;KACA,kBAAkB;KAClB,4BACE,MACA,KAAK,IACH,MAAM,OAAO,UAAU,OAAO,cAC9B,MAAM,OAAO,UAAU,WAAW,cAClC,MAAM,OAAO,UAAU,QAAQ,YACjC;IACJ,CAAC,CACH;IAEA,MAAM,OAAO,OAAO,WAClB,SACA,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,UAAU,MAAM,QAAQ,CAAC,GAClE,KACF;IAEA,IACE,KAAK,WAAW,KAChB,EAAE,OAAO,cACP,SACA,KAAK,IACL,aACA,UAAU,iBACV,QACF,IAEA,OAAO,OAAO,YAAY;IAE5B,MAAM,gBACJ,MACA,KAAK,IACH,MAAM,OAAO,UAAU,OAAO,cAC9B,MAAM,OAAO,UAAU,WAAW,cAClC,MAAM,OAAO,UAAU,QAAQ,YACjC;IAEF,KACG,OAAO,EAAE,cAAc,KAAK,EAAE,CAAC,EAAE,WAAW,OAAO,QACnD,OAAO,EAAE,cAAc,KAAK,EAAE,CAAC,EAAE,qBAAqB,OAAO,kBAC7D,OAAO,cAAc,YAAY,8BACjC,MAAM,eAAe,KAAA,KACpB,EAAE,OAAO,uBACP,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MAAM,UACR,IAEF,OAAO,OAAO,YAAY;IAE5B,OAAO,QAAQ;KAAE,MAAM;KAAY;IAAY,GAAG,OAAO;GAC3D,CAAC,CACH;EACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,eAAe,YAAY,YACzB,OAAO,IAAI,aAAa;GACtB,MAAM,cAAc,OAAO,oCAAoC,WAAW,WAAW,GACnF,QAAQ,OAAO,8BAA8B,WAAW,KAAK;GAE/D,MAAM,WAAW,OAAO,kBAAkB,WAAW,GACnD,gBAAgB,OAAO,4BAA4B,KAAK;GAE1D,KAAK,OAAO,kBAAkB,cAAc,KAAK,CAAC,OAAO,UACvD,OAAO,OAAO,YAAY;GAE5B,OAAO,OAAO,MACZ,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IAEvB,OAAO,WAAW,SAAS,eAAe,YAAY,QAAQ;IAC9D,MAAM,YAAY,OAAO,iBAAiB,SAAS,eAAe,WAAW;IAE7E,IAAI,cAAc,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;IAE/D,MAAM,OAAO,OAAO,WAChB,SACA,IAAI,GAAG,EAAE,UAAU,YAAY,QAAQ,GAAG,GAAG,EAAE,UAAU,YAAY,QAAQ,CAAC,GAC9E,cAAc,OAChB,GACA,MAAM,KAAK;IAEb,MAAM,MAAM,OAAO;IAEnB,IACE,KAAK,WAAW,KAChB,EAAE,OAAO,cACP,SACA,KACA,aACA,UAAU,iBACV,QACF,MACA,MAAM,MAAM,kBACZ,OAAO,YAAY,8BACnB,OAAO,MAAM,iBAEb,OAAO,QAAQ,YAAY,OAAO;IACpC,OAAO,YACJ,OAAO,EAAE,KAAK,CAAC,CACf,IAAI,EAAE,YAAY;KAAE;KAAO,UAAU;IAAc,CAAC,CAAC,CAAC,CACtD,MAAM,aAAa,SAAS,GAAG,CAAC;IAEnC,MAAM,QAAQ,OAAO,WACnB,SACA,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,UAAU,MAAM,QAAQ,CAAC,GAClE,KACF;IAEA,IACE,MAAM,WAAW,KACjB,EAAE,OAAO,cACP,SACA,MAAM,IACN,OACA,UAAU,iBACV,aACF,OACC,OAAO,WACN,SACA,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,YAAY,IAAI,EAAE,WAAW,GAClC,GAAG,EAAE,sBAAsB,IAAI,EAAE,qBAAqB,CACxD,GACA,KACF,EAAA,CAAG,WAAW,GAEd,OAAO,OAAO,YAAY;IAC5B,KACG,OAAO,cAAc,YAAY,+BACjC,OAAO,cAAc,MAAM,iBAE5B,OAAO,OAAO,YAAY;IAE5B,OAAO,QAAQ,aAAa,OAAO;GACrC,CAAC,CACH;EACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,UAAU,eACR,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,OAAO,aAAa,YAAY,CAAC,CAAC,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,KACxE,OAAO,SAAS,WAAW,CAC7B;GA0DA,QAAO,OAxDeA,kBAAO,SAC3B,UACA,eACA,OAAO,IAAI,aAAa;IACtB,IACE,CAAC,MAAM,OAAO,KACd,EAAE,OAAO,WAAW,SAAS,eAAe,MAAM,UAAU,KAAK,IAEjE,OAAO,KAAA;IAET,MAAM,OAAO,OAAO,WAClB,SACA,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,YAAY,MAAM,UAAU,GACjC,GAAG,EAAE,QAAQ,MAAM,MAAM,GACzB,GAAG,EAAE,OAAO,EAAE,OAAO,KAAK,CAC5B,GACA,KACF;IAEA,IAAI,KAAK,WAAW,GAAG,OAAO,KAAA;IAC9B,MAAM,WAAW,OAAO,4BAA4B,KAAK,EAAE,CAAC,EAAE,SAAS;IACvE,MAAM,YAAY,OAAO,iBAAiB,SAAS,eAAe,QAAQ;IAE1E,IAAI,cAAc,KAAA,GAAW,OAAO,KAAA;IAEpC,MAAM,SAAS,OAAO,WACpB,SACA,aAAa,SAAS,KAAK,EAAE,GAC7B,cAAc,OAChB;IAEA,MAAM,MAAM,OAAO;IAEnB,IACE,OAAO,WAAW,KAClB,MAAM,SAAS,kBACf,OAAO,SAAS,mBAChB,SAAS,aAAa,MAAM,YAC5B,SAAS,eAAe,MAAM,cAC9B,SAAS,WAAW,MAAM,UAC1B,EAAE,OAAO,cACP,SACA,OAAO,IACP,UACA,UAAU,iBACV,OAAO,4BAA4B,QAAQ,CAC7C,IAEA,OAAO,KAAA;IAET,OAAO;KAAE,QAAQ;KAAU,oBAAoB,UAAU;IAAY;GACvE,CAAC,CACH,OAEkB,OAAO,iBAAiB,KAAK,CAAC,CAAC;EACnD,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,uBACF;EACF,WAAW,OAAO,YAChB,SAAS,OAAO,OAAO,CAAC,CAAC,KACvB,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,iBAAiB,OAAO,YACtB,SAAS,OAAO,OAAO,CAAC,CAAC,KACvB,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,SAAS,YAAY,YACnB,OAAO,IAAI,aAAa;GACtB,MAAM,SAAS,OAAO,8BAA8B,WAAW,MAAM,GACnE,WAAW,OAAO,4BAA4B,MAAM;GAEtD,OAAO,OAAO,MACZ,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO;IAEvB,OAAO,WAAW,SAAS,eAAe,OAAO,QAAQ;IACzD,MAAM,YAAY,OAAO,iBAAiB,SAAS,eAAe,MAAM;IAExE,IAAI,cAAc,KAAA,GAAW,OAAO,QAAQ,OAAO,OAAO;IAE1D,MAAM,OAAO,OAAO,WAClB,SACA,IAAI,GAAG,EAAE,UAAU,OAAO,QAAQ,GAAG,GAAG,EAAE,UAAU,OAAO,QAAQ,CAAC,GACpE,cAAc,OAChB;IAEA,MAAM,MAAM,OAAO;IAEnB,IACE,KAAK,WAAW,KAChB,MAAM,OAAO,kBACb,OAAO,OAAO,mBACd,EAAE,OAAO,cACP,SACA,KAAK,IACL,QACA,UAAU,iBACV,QACF,IAEA,OAAO,QAAQ,OAAO,OAAO;IAC/B,OAAO,SAAS,SAAS,KAAK,IAAI,WAAW;IAE7C,OAAO,QAAQ,MAAM,OAAO;GAC9B,CAAC,CACH;EACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,UAAU,YAAY,YACpB,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,GAAG,WAAW;GAE9B,IAAI,CAAC,OAAO,cAAc,MAAM,KAAK,KAAK,MAAM,QAAQ,KAAK,MAAM,QAAQ,KACzE,OAAO,OAAO,YAAY;GAE5B,OAAO,OAAO,MACZ,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IAEvB,IAAI,EAAE,OAAO,WAAW,SAAS,eAAe,MAAM,UAAU,KAAK,IACnE,OAAO,QAAQ;KAAE,SAAS;KAAG,SAAS;IAAM,GAAG,OAAO;IACxD,MAAM,MAAM,EAAE,cAAc,OAAO,SAAS;IAE5C,MAAM,MAAM,IACV,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GACE,IAAI,IAAI,EAAE,aAAa,GAAG,GAAG,IAAI,EAAE,sBAAsB,GAAG,CAAC,GAC7D,IACE,UAAU,EAAE,QAAQ,GACpB,GACE,IAAI,GAAG,EAAE,OAAO,EAAE,OAAO,SAAS,GAAG,IAAI,EAAE,sBAAsB,GAAG,CAAC,GACrE,IAAI,GAAG,EAAE,OAAO,EAAE,OAAO,KAAK,GAAG,IAAI,EAAE,WAAW,GAAG,CAAC,CACxD,CACF,CACF,CACF;IAEA,MAAM,OAAO,OAAO,KAClB,YACG,OAAO,CAAC,CACR,KAAK,EAAE,KAAK,CAAC,CACb,MAAM,GAAG,CAAC,CACV,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,CAChC,MAAM,MAAM,QAAQ,CAAC,GACxB,cAAc,OAChB;IAEA,IAAI,UAAU;IAEd,KAAK,MAAM,OAAO,KAAK,MAAM,GAAG,MAAM,KAAK,GAYzC,KAVG,OAAO,WACN,SACA,IACE,aAAa,SAAS,GAAG,GACzB,IAAI,EAAE,aAAa,GAAG,GACtB,IAAI,EAAE,sBAAsB,GAAG,CACjC,GACA,KACF,EAAA,CAAG,WAAW,GAEH;KACX,OAAO,YAAY,OAAO,EAAE,KAAK,CAAC,CAAC,MAAM,aAAa,SAAS,GAAG,CAAC;KACnE,KACG,OAAO,WACN,SACA,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,UAAU,IAAI,EAAE,SAAS,CAAC,GACnE,KACF,EAAA,CAAG,QAEH,OAAO,OAAO,YAAY;KAC5B;IACF,OAAO,OAAO,SAAS,SAAS,KAAK,SAAS;IAGhD,OAAO,QACL;KACE;KACA,UACG,OAAO,KAAK,YAAY,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,EAAA,CACvE,SAAS;IAChB,GACA,OACF;GACF,CAAC,CACH;EACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;CAGU;AAChB,CACF;AAEA,MAAa,4BAA4B;CACvC;CACA;CACA;CACA;CACA;CACA;CACA;AACF"}
+{"version":3,"file":"password-prepared-sql.mjs","names":["kernel"],"sources":["../../src/drizzle/password-prepared-sql.ts"],"sourcesContent":["import {\n  CurrentPasswordPreparedTransaction,\n  PasswordPreparedPostconditions,\n  PasswordPreparedJournalGuards,\n} from \"@yielded/auth-persistence/Adapter\";\nimport { CurrentCommitJournal, LifecycleHooks, HookConfigurationError } from \"@yielded/auth/Hooks\";\nimport {\n  PasswordUnavailable,\n  PasswordRejected,\n  PasswordPreparedVersion,\n  decodePasswordPreparedReady,\n  encodePasswordPreparedReady,\n  snapshotPasswordPreparedReady,\n  snapshotPasswordPreparedReservation,\n  type PasswordPreparedReady,\n  type PasswordPreparedReservation,\n  snapshotPasswordCredential,\n  snapshotPasswordRequirement,\n  type PasswordMutationDecision,\n  type PreparePasswordCommit,\n  type PasswordPreparedPersistence,\n  type PasswordPreparedMutation,\n} from \"@yielded/auth/Password\";\nimport { reportPersistenceFailure } from \"@yielded/auth/Persistence\";\nimport { type ProofCompletionPlan, ProofUnavailable, ProofBinding } from \"@yielded/auth/Proofs\";\nimport { AuthenticationRevision } from \"@yielded/auth/Sessions\";\n/* oxlint-disable no-explicit-any -- concrete driver makers retain consumer table types. */\nimport { and, count, eq, gt, isNotNull, isNull, lte, or, type SQL } from \"drizzle-orm\";\nimport { Cause, DateTime, Effect, Option, Predicate, Redacted, Schema } from \"effect\";\n\nimport { column } from \"./model\";\nimport {\n  requiredPasswordPreparedConstraints,\n  type AnyPasswordPreparedPersistenceMapping,\n  type PasswordPreparedState,\n} from \"./password-prepared-model\";\nimport {\n  ContextInput,\n  CompletionInput,\n  encodeReservation,\n  evidenceCurrent,\n  identifierScope,\n  reservationOf,\n  sameRevision,\n  snapshotMutation,\n  snapshotReserve,\n  unavailable,\n} from \"./password-prepared-state\";\nimport {\n  CurrentPasswordSql,\n  passwordSqlKernel as kernel,\n  type PasswordSqlConfiguration,\n  type PasswordSqlQuery,\n} from \"./password-sql\";\nimport { checkProofCompletionIn, completeProofPlanIn } from \"./proof-sql\";\n\nconst translateFailure = <A, E, R>(\n  effect: Effect.Effect<A, E, R>,\n): Effect.Effect<A, PasswordUnavailable, R> =>\n  reportPersistenceFailure(\n    effect,\n    (error) =>\n      Schema.is(PasswordUnavailable)(error) ||\n      Schema.is(ProofUnavailable)(error) ||\n      Schema.is(HookConfigurationError)(error),\n  ).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));\n\nconst translateContextFailure = <A, E, R>(\n  effect: Effect.Effect<A, E, R>,\n): Effect.Effect<A, PasswordUnavailable | PasswordRejected, R> =>\n  reportPersistenceFailure(\n    effect,\n    (error) =>\n      Schema.is(PasswordUnavailable)(error) ||\n      Schema.is(PasswordRejected)(error) ||\n      Schema.is(ProofUnavailable)(error) ||\n      Schema.is(HookConfigurationError)(error),\n  ).pipe(\n    Effect.catchCause((cause) =>\n      Effect.failCause(\n        Cause.map(cause, (error) => (Schema.is(PasswordRejected)(error) ? error : unavailable())),\n      ),\n    ),\n  );\n\ntype Mapping = AnyPasswordPreparedPersistenceMapping;\nconst nowMillis = DateTime.now.pipe(Effect.map(DateTime.toEpochMillis));\n\nconst read = (query: PasswordSqlQuery, locking: boolean) =>\n  locking && typeof query.for === \"function\" ? query.for(\"update\") : query;\n\nconst columns = (mapping: Mapping) => {\n  const table = mapping.intent;\n\n  return {\n    moduleId: column(table.table, table.moduleId),\n    intentId: column(table.table, table.intentId),\n    commandId: column(table.table, table.commandId),\n    subjectId: column(table.table, table.subjectId),\n    action: column(table.table, table.action),\n    generation: column(table.table, table.generation),\n    version: column(table.table, table.version),\n    state: column(table.table, table.state),\n    digest: column(table.table, table.digest),\n    snapshot: column(table.table, table.snapshot),\n    identifierScope: column(table.table, table.identifierScope),\n    createdAt: column(table.table, table.createdAt),\n    admittedAt: column(table.table, table.admittedAt),\n    admissionRetainUntil: column(table.table, table.admissionRetainUntil),\n    preparationExpiresAt: column(table.table, table.preparationExpiresAt),\n    expiresAt: column(table.table, table.expiresAt),\n    retainUntil: column(table.table, table.retainUntil),\n  };\n};\n\nconst valid = (mapping: Mapping) =>\n  Object.entries(requiredPasswordPreparedConstraints).every(\n    ([key, value]) =>\n      mapping.constraints[key as keyof typeof requiredPasswordPreparedConstraints] === value,\n  );\n\nconst lockAnchor = Effect.fn(\"DrizzlePasswordPrepared.lockAnchor\")(function* (\n  mapping: Mapping,\n  configuration: PasswordSqlConfiguration,\n  moduleId: string,\n  create = true,\n) {\n  const database = yield* CurrentPasswordSql;\n\n  const a = mapping.admission,\n    key = column(a.table, a.moduleId);\n\n  if (create)\n    yield* configuration.insertIfAbsent(\n      database.insert(a.table).values(a.encodeInsert(moduleId)),\n      a.moduleId,\n      moduleId,\n    );\n\n  const rows = yield* read(\n    database.select().from(a.table).where(eq(key, moduleId)).limit(2),\n    configuration.locking,\n  );\n\n  if (rows.length > 1 || (create && rows.length !== 1)) return yield* unavailable();\n\n  return rows.length === 1;\n});\n\nconst bindingJson = Schema.encodeSync(Schema.fromJsonString(ProofBinding));\n\nconst captureAuthority = Effect.fn(\"DrizzlePasswordPrepared.captureAuthority\")(function* (\n  mapping: Mapping,\n  configuration: Pick<PasswordSqlConfiguration, \"locking\">,\n  input: {\n    readonly moduleId: string;\n    readonly action: PasswordPreparedReservation[\"action\"];\n    readonly subjectId: string;\n    readonly reset?: PasswordPreparedReservation[\"reset\"];\n  },\n) {\n  const database = yield* CurrentPasswordSql;\n\n  const p = mapping.password;\n  const locked = yield* kernel.lockSubject(p, input.subjectId, configuration.locking);\n\n  if (locked.row === undefined || !p.subject.isActiveStatus(locked.row[p.subject.status]))\n    return undefined;\n\n  const ic = kernel.identifierColumns(p),\n    ac = kernel.authorityCredentialColumns(p);\n\n  let identifier: any;\n\n  if (input.action !== \"add-password\") {\n    if (input.reset !== undefined)\n      identifier = (yield* kernel.lockIdentifier(\n        p,\n        input.reset.binding.identifier,\n        configuration.locking,\n      ))[0];\n    else {\n      const discovered = (yield* read(\n        database\n          .select()\n          .from(p.identifier.table)\n          .where(eq(ic.subjectId, locked.nativeSubjectId))\n          .orderBy(ic.namespace, ic.value),\n        false,\n      )).find((row: any) => p.identifier.isCurrent(row));\n\n      if (discovered !== undefined)\n        identifier = (yield* kernel.lockIdentifier(\n          p,\n          {\n            namespace: discovered[p.identifier.namespace],\n            value: discovered[p.identifier.value],\n          } as any,\n          configuration.locking,\n        ))[0];\n    }\n    if (\n      identifier === undefined ||\n      !p.identifier.isCurrent(identifier) ||\n      !p.subjectId.equals(identifier[p.identifier.subjectId], locked.nativeSubjectId)\n    )\n      return undefined;\n  }\n\n  const credential = (yield* kernel.readPasswordCredential(\n    p,\n    input.moduleId,\n    locked.nativeSubjectId,\n    configuration.locking,\n  ))[0];\n\n  if ((input.action === \"add-password\") !== (credential === undefined)) return undefined;\n\n  const snapshot =\n    credential === undefined\n      ? undefined\n      : yield* p.credential\n          .decode({ moduleId: input.moduleId, subject: locked.row, identifier, credential })\n          .pipe(Effect.flatMap(snapshotPasswordCredential));\n\n  if (\n    snapshot !== undefined &&\n    (snapshot.moduleId !== input.moduleId ||\n      snapshot.revision.subjectId !== input.subjectId ||\n      snapshot.revision.securityRevision !== locked.row[p.subject.securityRevision] ||\n      snapshot.credentialId !== credential[p.credential.credentialId] ||\n      snapshot.credentialRevision !== credential[p.credential.credentialRevision] ||\n      snapshot.verifierVersion !== credential[p.credential.verifierVersion] ||\n      Redacted.value(snapshot.verifier) !== credential[p.credential.verifier] ||\n      snapshot.normalization !== credential[p.credential.normalization] ||\n      snapshot.identifier.namespace !== identifier[p.identifier.namespace] ||\n      snapshot.identifier.value !== identifier[p.identifier.value] ||\n      snapshot.identifierBindingRevision !== identifier[p.identifier.bindingRevision])\n  )\n    return undefined;\n\n  const factors = yield* read(\n    database\n      .select()\n      .from(p.authorityCredential.table)\n      .where(eq(ac.subjectId, locked.nativeSubjectId))\n      .orderBy(ac.credentialId),\n    configuration.locking,\n  );\n\n  const active = factors.filter(\n    (row: any) =>\n      p.authorityCredential.status === undefined ||\n      p.authorityCredential.isActiveStatus?.(row[p.authorityCredential.status]) === true,\n  );\n\n  if (active.length > 64) return yield* unavailable();\n\n  const revision =\n    snapshot?.revision ??\n    AuthenticationRevision.make({\n      subjectId: input.subjectId as any,\n      securityRevision: locked.row[p.subject.securityRevision],\n      credentials: active.map((row: any) => ({\n        credentialId: row[p.authorityCredential.credentialId],\n        revision: row[p.authorityCredential.revision],\n      })),\n    });\n\n  if (\n    revision.credentials.some(\n      (expected) =>\n        !active.some(\n          (row: any) =>\n            row[p.authorityCredential.credentialId] === expected.credentialId &&\n            row[p.authorityCredential.revision] === expected.revision,\n        ),\n    )\n  )\n    return undefined;\n\n  const requirement = yield* p.subject\n    .decodeActionRequirement(locked.row, input.action)\n    .pipe(Effect.flatMap(snapshotPasswordRequirement));\n\n  return { ...locked, identifier, snapshot, revision, requirement };\n});\n\nconst currentAuthority = Effect.fn(\"DrizzlePasswordPrepared.currentAuthority\")(function* (\n  mapping: Mapping,\n  configuration: Pick<PasswordSqlConfiguration, \"locking\">,\n  record: PasswordPreparedReservation | PasswordPreparedReady,\n) {\n  const current = yield* captureAuthority(mapping, configuration, {\n    moduleId: record.moduleId,\n    action: record.action,\n    subjectId: record.revision.subjectId,\n    ...(record.reset === undefined ? {} : { reset: record.reset }),\n  });\n\n  if (\n    current === undefined ||\n    !sameRevision(current.revision, record.revision) ||\n    (current.snapshot === undefined\n      ? record.credential !== undefined\n      : record.credential === undefined ||\n        !kernel.sameCredentialSnapshot(current.snapshot, record.credential))\n  )\n    return undefined;\n\n  return current;\n});\n\nconst rowCondition = (mapping: Mapping, row: any) => {\n  const c = columns(mapping);\n\n  return and(\n    ...Object.entries(c).map(([key, value]) => {\n      const field = mapping.intent[key as keyof typeof c],\n        item = row[field];\n\n      return Predicate.isNullish(item) ? isNull(value) : eq(value, item);\n    }),\n  )!;\n};\n\nconst readIntent = Effect.fn(\"Drizzle.readIntent\")(function* (\n  mapping: Mapping,\n  condition: SQL,\n  locking: boolean,\n) {\n  const database = yield* CurrentPasswordSql;\n\n  return yield* read(\n    database.select().from(mapping.intent.table).where(condition).limit(2),\n    locking,\n  );\n});\n\nconst recordMatches = Effect.fn(\"DrizzlePasswordPrepared.recordMatches\")(function* (\n  mapping: Mapping,\n  row: any,\n  record: PasswordPreparedReservation | PasswordPreparedReady,\n  nativeSubjectId: unknown,\n  snapshot: string,\n) {\n  const t = mapping.intent,\n    p = mapping.password;\n\n  if (\n    row === undefined ||\n    row[t.moduleId] !== record.moduleId ||\n    row[t.intentId] !== record.intentId ||\n    row[t.commandId] !== record.commandId ||\n    !p.subjectId.equals(row[t.subjectId], nativeSubjectId) ||\n    row[t.action] !== record.action ||\n    row[t.generation] !== record.generation ||\n    row[t.version] !== record.version ||\n    row[t.state] !== t.states[record._tag] ||\n    row[t.snapshot] !== snapshot ||\n    row[t.identifierScope] !== identifierScope(record) ||\n    (record._tag === \"Ready\"\n      ? row[t.digest] !== record.digest\n      : !Predicate.isNullish(row[t.digest]))\n  )\n    return false;\n  for (const [key, instant] of [\n    [t.createdAt, record.createdAtMillis],\n    [t.preparationExpiresAt, record.preparationExpiresAtMillis],\n    [t.retainUntil, record.retainUntilMillis],\n  ] as const)\n    if ((yield* p.decodeInstant(row[key])) !== instant) return false;\n\n  return record._tag === \"Ready\"\n    ? (yield* p.decodeInstant(row[t.expiresAt])) === record.expiresAtMillis\n    : Predicate.isNullish(row[t.expiresAt]);\n});\n\nconst terminal = Effect.fn(\"DrizzlePasswordPrepared.terminal\")(function* (\n  mapping: Mapping,\n  row: any,\n  state: Exclude<PasswordPreparedState, \"Preparing\" | \"Ready\">,\n) {\n  const database = yield* CurrentPasswordSql;\n\n  yield* database\n    .update(mapping.intent.table)\n    .set(mapping.intent.encodeTerminal(state))\n    .where(rowCondition(mapping, row));\n\n  const c = columns(mapping),\n    t = mapping.intent;\n\n  const rows = yield* readIntent(\n    mapping,\n    and(eq(c.moduleId, row[t.moduleId]), eq(c.intentId, row[t.intentId]))!,\n    false,\n  );\n\n  const expected = { ...row, [t.state]: t.states[state], [t.snapshot]: null, [t.digest]: null };\n\n  if (\n    rows.length !== 1 ||\n    (yield* readIntent(mapping, rowCondition(mapping, expected), false)).length !== 1\n  )\n    return yield* unavailable();\n});\n\nexport const makeSqlPasswordPreparedPersistence = Effect.fn(\"makeSqlPasswordPreparedPersistence\")(\n  function* (\n    mapping: Mapping,\n    configuration: PasswordSqlConfiguration,\n  ): Effect.fn.Return<PasswordPreparedPersistence, never, LifecycleHooks | CurrentPasswordSql> {\n    const database = yield* CurrentPasswordSql;\n    const hooks = yield* LifecycleHooks;\n\n    const p = mapping.password,\n      c = columns(mapping),\n      t = mapping.intent;\n\n    const owned = <A, E, R>(body: Effect.Effect<A, E, R>) =>\n      valid(mapping)\n        ? kernel.owned(\n            database,\n            p,\n            configuration,\n            Effect.gen(function* () {\n              const journal = yield* CurrentCommitJournal;\n              const guards = yield* Effect.serviceOption(PasswordPreparedJournalGuards);\n\n              if (Option.isSome(guards) && !guards.value.register(journal.prepare(undefined)))\n                return yield* unavailable();\n\n              return yield* body;\n            }),\n          )\n        : Effect.fail(unavailable());\n\n    const complete = <A>(\n      uncaptured: PasswordPreparedMutation & { readonly completion?: ProofCompletionPlan },\n      prepare: PreparePasswordCommit<PasswordMutationDecision, A>,\n    ) =>\n      Effect.gen(function* () {\n        const input = yield* snapshotMutation(uncaptured);\n\n        const completion =\n          uncaptured.completion === undefined\n            ? undefined\n            : {\n                prepare: uncaptured.completion.prepare,\n                input: yield* Schema.encodeEffect(Schema.fromJsonString(CompletionInput))(\n                  uncaptured.completion.input,\n                ).pipe(\n                  Effect.flatMap(Schema.decodeEffect(Schema.fromJsonString(CompletionInput))),\n                  Effect.mapError(unavailable),\n                ),\n              };\n\n        if (\n          (input.intent.action === \"reset-password\") !== (completion !== undefined) ||\n          (completion !== undefined && configuration.proof === undefined)\n        )\n          return yield* unavailable();\n\n        return yield* owned(\n          Effect.gen(function* () {\n            const transaction = yield* CurrentPasswordSql;\n            const journal = yield* CurrentCommitJournal;\n\n            yield* lockAnchor(mapping, configuration, input.intent.moduleId);\n\n            const authority = yield* kernel.validateMutationAuthority(\n              p,\n              configuration,\n              input.mutation,\n              input.intent.action,\n            );\n\n            if (authority === undefined) return prepare(\"rejected\", journal);\n            const current = yield* currentAuthority(mapping, configuration, input.intent);\n\n            if (current === undefined) return prepare(\"rejected\", journal);\n\n            const rows = yield* readIntent(\n              mapping,\n              and(eq(c.moduleId, input.intent.moduleId), eq(c.intentId, input.intent.intentId))!,\n              configuration.locking,\n            );\n\n            const row = rows[0],\n              encoded = yield* encodePasswordPreparedReady(input.intent);\n\n            if (\n              rows.length !== 1 ||\n              !(yield* recordMatches(\n                mapping,\n                row,\n                input.intent,\n                current.nativeSubjectId,\n                encoded,\n              )) ||\n              !evidenceCurrent(input, current.requirement, yield* nowMillis) ||\n              (yield* kernel.commandExists(\n                p,\n                input.intent.moduleId,\n                input.intent.commandId,\n                configuration.locking,\n              )).length !== 0\n            )\n              return prepare(\"rejected\", journal);\n            if (\n              completion !== undefined &&\n              (input.intent.reset === undefined ||\n                completion.input.continuationId !== input.intent.reset.continuationId ||\n                bindingJson(completion.input.binding) !== bindingJson(input.intent.reset.binding) ||\n                !kernel.proofCompletionMatchesPassword({ ...input.mutation, completion }))\n            )\n              return prepare(\"rejected\", journal);\n\n            const credentialRevision = yield* kernel.allocate(\n              configuration.mode,\n              p.allocateRevision,\n              p.allocateRevisionSync,\n            );\n\n            const verifierVersion = yield* kernel.allocate(\n              configuration.mode,\n              p.allocateRevision,\n              p.allocateRevisionSync,\n            );\n\n            const nextSecurityRevision = yield* kernel.allocateNextSecurityRevision(\n              p,\n              configuration.mode,\n              input.intent.revision.securityRevision,\n            );\n\n            if (\n              nextSecurityRevision === input.intent.revision.securityRevision ||\n              credentialRevision === input.intent.credential?.credentialRevision ||\n              verifierVersion === input.intent.credential?.verifierVersion\n            )\n              return yield* unavailable();\n\n            const credentialId =\n              input.intent.action === \"add-password\"\n                ? yield* kernel.allocate(\n                    configuration.mode,\n                    p.allocateCredentialId,\n                    p.allocateCredentialIdSync,\n                  )\n                : undefined;\n\n            let appliedAt: number | undefined;\n\n            const assertApplied = Effect.fn(\"DrizzlePasswordPrepared.assertApplied\")(() =>\n              Effect.flatMap(CurrentPasswordPreparedTransaction, (currentTransaction) =>\n                Effect.gen(function* () {\n                  if (appliedAt === undefined) return;\n\n                  if (\n                    !(yield* kernel.checkMutationApplied(\n                      p,\n                      input.mutation,\n                      current.nativeSubjectId,\n                      {\n                        credentialId: credentialId ?? input.intent.credential!.credentialId,\n                        credentialRevision,\n                        verifierVersion,\n                        nextSecurityRevision,\n                      },\n                      appliedAt,\n                    )) ||\n                    (yield* readIntent(\n                      mapping,\n                      rowCondition(mapping, {\n                        ...row,\n                        [t.state]: t.states.Consumed,\n                        [t.snapshot]: null,\n                        [t.digest]: null,\n                      }),\n                      false,\n                    )).length !== 1 ||\n                    !evidenceCurrent(input, current.requirement, yield* nowMillis)\n                  )\n                    return yield* unavailable();\n                }).pipe(Effect.provideService(CurrentPasswordSql, currentTransaction)),\n              ),\n            );\n\n            const validateApplied = Effect.gen(function* () {\n              yield* assertApplied().pipe(\n                Effect.provideService(CurrentPasswordPreparedTransaction, transaction),\n              );\n              if (appliedAt === undefined) return;\n              const postconditions = yield* Effect.serviceOption(PasswordPreparedPostconditions);\n\n              if (\n                Option.isSome(postconditions) &&\n                !postconditions.value.register(assertApplied().pipe(translateFailure))\n              )\n                return yield* unavailable();\n            });\n\n            const apply = Effect.fn(\"DrizzlePasswordPrepared.apply\")(function* () {\n              const finalNow = yield* nowMillis;\n\n              if (!evidenceCurrent(input, current.requirement, finalNow)) return false;\n\n              const changed =\n                input.intent.action === \"add-password\"\n                  ? yield* kernel.addPasswordIn(\n                      p,\n                      configuration,\n                      input.mutation,\n                      {\n                        credentialId: credentialId!,\n                        credentialRevision,\n                        verifierVersion,\n                        nextSecurityRevision,\n                      },\n                      finalNow,\n                    )\n                  : yield* kernel.writeReplacement(\n                      p,\n                      input.mutation,\n                      current.nativeSubjectId,\n                      { credentialRevision, verifierVersion, nextSecurityRevision },\n                      finalNow,\n                    );\n\n              if (!changed) return yield* unavailable();\n              appliedAt = finalNow;\n              yield* terminal(mapping, row, \"Consumed\");\n              if (!evidenceCurrent(input, current.requirement, yield* nowMillis))\n                return yield* unavailable();\n\n              return true;\n            });\n\n            if (completion !== undefined) {\n              let receipt: ReturnType<typeof prepare> | undefined;\n\n              yield* completeProofPlanIn(\n                configuration.proof!.mapping,\n                configuration.proof!.configuration,\n                completion,\n                Effect.gen(function* () {\n                  return yield* apply();\n                }),\n                (decision) => {\n                  receipt = prepare(decision === \"completed\" ? \"changed\" : \"rejected\", journal);\n\n                  return decision;\n                },\n              );\n\n              yield* validateApplied;\n\n              return receipt ?? prepare(\"rejected\", journal);\n            }\n\n            const changed = yield* apply();\n\n            yield* validateApplied;\n\n            return prepare(changed ? \"changed\" : \"rejected\", journal);\n          }),\n        );\n      });\n\n    const services: PasswordPreparedPersistence = {\n      reserve: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const input = yield* snapshotReserve(uncaptured);\n\n          if (\n            (input.action === \"reset-password\") !==\n              (input.reset !== undefined && input.completion !== undefined) ||\n            (input.action === \"reset-password\" && configuration.proof === undefined) ||\n            input.generation !== input.policy.generation ||\n            input.policy.retentionMillis <\n              Math.max(\n                input.policy.preparationLifetimeMillis + input.policy.lifetimeMillis,\n                input.policy.admission.action.windowMillis,\n                input.policy.admission.identifier.windowMillis,\n                input.policy.admission.subject.windowMillis,\n              ) ||\n            (input.invalidation.existingSessions === \"immediate\" &&\n              p.sessionInvalidation !== \"same-authority-immediate\")\n          )\n            return yield* unavailable();\n\n          return yield* owned(\n            Effect.gen(function* () {\n              const transaction = yield* CurrentPasswordSql;\n              const journal = yield* CurrentCommitJournal;\n\n              yield* lockAnchor(mapping, configuration, input.moduleId);\n\n              const version = PasswordPreparedVersion.make(\n                yield* kernel.allocate(\n                  configuration.mode,\n                  mapping.allocateVersion,\n                  mapping.allocateVersionSync,\n                ),\n              );\n\n              const authority = yield* captureAuthority(mapping, configuration, input);\n\n              if (authority === undefined) return yield* unavailable();\n              if (input.reset !== undefined) {\n                if (\n                  input.completion === undefined ||\n                  input.completion.moduleId !== `${input.moduleId}/reset` ||\n                  input.completion.purpose !== \"password-reset\" ||\n                  input.reset.continuationId !== input.completion.continuationId ||\n                  bindingJson(input.reset.binding) !== bindingJson(input.completion.binding) ||\n                  input.reset.binding._tag !== \"Subject\" ||\n                  !sameRevision(input.reset.binding.revision, authority.revision) ||\n                  authority.snapshot?.identifierVerifiedAtMillis === undefined ||\n                  !(yield* checkProofCompletionIn(\n                    configuration.proof!.mapping,\n                    configuration.proof!.configuration,\n                    input.completion,\n                  ))\n                )\n                  return yield* unavailable();\n              }\n              if (\n                (yield* readIntent(\n                  mapping,\n                  and(eq(c.moduleId, input.moduleId), eq(c.commandId, input.commandId))!,\n                  configuration.locking,\n                )).length\n              )\n                return prepare({ _tag: \"Existing\" }, journal);\n\n              const now = yield* nowMillis,\n                nativeNow = p.encodeInstant(now);\n\n              const scope = identifierScope({\n                credential: authority.snapshot,\n                revision: authority.revision,\n              });\n\n              const active =\n                (yield* read(\n                  transaction\n                    .select({ total: count() })\n                    .from(t.table)\n                    .where(\n                      and(\n                        eq(c.moduleId, input.moduleId),\n                        eq(c.subjectId, authority.nativeSubjectId),\n                        or(\n                          and(\n                            eq(c.state, t.states.Preparing),\n                            gt(c.preparationExpiresAt, nativeNow),\n                          ),\n                          and(eq(c.state, t.states.Ready), gt(c.expiresAt, nativeNow)),\n                        ),\n                      ),\n                    ),\n                  false,\n                ))[0]?.total ?? 0;\n\n              if (active >= input.policy.maximumPendingPerSubject) return yield* unavailable();\n              for (const [condition, budget] of [\n                [eq(c.action, input.action), input.policy.admission.action],\n                [eq(c.identifierScope, scope), input.policy.admission.identifier],\n                [eq(c.subjectId, authority.nativeSubjectId), input.policy.admission.subject],\n              ] as const) {\n                const total =\n                  (yield* read(\n                    transaction\n                      .select({ total: count() })\n                      .from(t.table)\n                      .where(\n                        and(\n                          eq(c.moduleId, input.moduleId),\n                          condition,\n                          gt(c.admittedAt, p.encodeInstant(now - budget.windowMillis)),\n                        ),\n                      ),\n                    false,\n                  ))[0]?.total ?? 0;\n\n                if (total >= budget.limit) return yield* unavailable();\n              }\n\n              const reservation = yield* snapshotPasswordPreparedReservation({\n                _tag: \"Preparing\",\n                moduleId: input.moduleId,\n                generation: input.generation,\n                intentId: input.intentId,\n                version,\n                commandId: input.commandId,\n                action: input.action,\n                revision: authority.revision,\n                ...(authority.snapshot === undefined ? {} : { credential: authority.snapshot }),\n                capturedRequirement: authority.requirement,\n                ...(input.reset === undefined ? {} : { reset: input.reset }),\n                invalidation: input.invalidation,\n                createdAtMillis: now,\n                preparationExpiresAtMillis: now + input.policy.preparationLifetimeMillis,\n                retainUntilMillis: now + input.policy.retentionMillis,\n              });\n\n              const snapshot = yield* encodeReservation(reservation);\n\n              yield* transaction.insert(t.table).values(\n                t.encodeInsert({\n                  reservation,\n                  nativeSubjectId: authority.nativeSubjectId,\n                  identifierScope: scope,\n                  snapshot,\n                  admittedAtMillis: now,\n                  admissionRetainUntilMillis:\n                    now +\n                    Math.max(\n                      input.policy.admission.action.windowMillis,\n                      input.policy.admission.identifier.windowMillis,\n                      input.policy.admission.subject.windowMillis,\n                    ),\n                }),\n              );\n\n              const rows = yield* readIntent(\n                mapping,\n                and(eq(c.moduleId, input.moduleId), eq(c.intentId, input.intentId))!,\n                false,\n              );\n\n              if (\n                rows.length !== 1 ||\n                !(yield* recordMatches(\n                  mapping,\n                  rows[0],\n                  reservation,\n                  authority.nativeSubjectId,\n                  snapshot,\n                ))\n              )\n                return yield* unavailable();\n\n              const admittedUntil =\n                now +\n                Math.max(\n                  input.policy.admission.action.windowMillis,\n                  input.policy.admission.identifier.windowMillis,\n                  input.policy.admission.subject.windowMillis,\n                );\n\n              if (\n                (yield* p.decodeInstant(rows[0][t.admittedAt])) !== now ||\n                (yield* p.decodeInstant(rows[0][t.admissionRetainUntil])) !== admittedUntil ||\n                (yield* nowMillis) >= reservation.preparationExpiresAtMillis ||\n                (input.completion !== undefined &&\n                  !(yield* checkProofCompletionIn(\n                    configuration.proof!.mapping,\n                    configuration.proof!.configuration,\n                    input.completion,\n                  )))\n              )\n                return yield* unavailable();\n\n              return prepare({ _tag: \"Reserved\", reservation }, journal);\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      publishReady: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const reservation = yield* snapshotPasswordPreparedReservation(uncaptured.reservation),\n            ready = yield* snapshotPasswordPreparedReady(uncaptured.ready);\n\n          const snapshot = yield* encodeReservation(reservation),\n            readySnapshot = yield* encodePasswordPreparedReady(ready);\n\n          if ((yield* encodeReservation(reservationOf(ready))) !== snapshot)\n            return yield* unavailable();\n\n          return yield* owned(\n            Effect.gen(function* () {\n              const transaction = yield* CurrentPasswordSql;\n              const journal = yield* CurrentCommitJournal;\n\n              yield* lockAnchor(mapping, configuration, reservation.moduleId);\n              const authority = yield* currentAuthority(mapping, configuration, reservation);\n\n              if (authority === undefined) return prepare(\"rejected\", journal);\n\n              const rows = yield* readIntent(\n                  mapping,\n                  and(eq(c.moduleId, reservation.moduleId), eq(c.intentId, reservation.intentId))!,\n                  configuration.locking,\n                ),\n                row = rows[0];\n\n              const now = yield* nowMillis;\n\n              if (\n                rows.length !== 1 ||\n                !(yield* recordMatches(\n                  mapping,\n                  row,\n                  reservation,\n                  authority.nativeSubjectId,\n                  snapshot,\n                )) ||\n                now < ready.issuedAtMillis ||\n                now >= reservation.preparationExpiresAtMillis ||\n                now >= ready.expiresAtMillis\n              )\n                return prepare(\"rejected\", journal);\n              yield* transaction\n                .update(t.table)\n                .set(t.encodeReady({ ready, snapshot: readySnapshot }))\n                .where(rowCondition(mapping, row));\n\n              const saved = yield* readIntent(\n                mapping,\n                and(eq(c.moduleId, ready.moduleId), eq(c.intentId, ready.intentId))!,\n                false,\n              );\n\n              if (\n                saved.length !== 1 ||\n                !(yield* recordMatches(\n                  mapping,\n                  saved[0],\n                  ready,\n                  authority.nativeSubjectId,\n                  readySnapshot,\n                )) ||\n                (yield* readIntent(\n                  mapping,\n                  and(\n                    eq(c.moduleId, ready.moduleId),\n                    eq(c.intentId, ready.intentId),\n                    eq(c.admittedAt, row[t.admittedAt]),\n                    eq(c.admissionRetainUntil, row[t.admissionRetainUntil]),\n                  )!,\n                  false,\n                )).length !== 1\n              )\n                return yield* unavailable();\n              if (\n                (yield* nowMillis) >= reservation.preparationExpiresAtMillis ||\n                (yield* nowMillis) >= ready.expiresAtMillis\n              )\n                return yield* unavailable();\n\n              return prepare(\"published\", journal);\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      context: (uncaptured) =>\n        Effect.gen(function* () {\n          const input = yield* Schema.decodeEffect(ContextInput)({ ...uncaptured }).pipe(\n            Effect.mapError(unavailable),\n          );\n\n          const record = yield* kernel.safeRead(\n            database,\n            configuration,\n            Effect.gen(function* () {\n              if (\n                !valid(mapping) ||\n                !(yield* lockAnchor(mapping, configuration, input.moduleId, false))\n              )\n                return undefined;\n\n              const rows = yield* readIntent(\n                mapping,\n                and(\n                  eq(c.moduleId, input.moduleId),\n                  eq(c.generation, input.generation),\n                  eq(c.digest, input.digest),\n                  eq(c.state, t.states.Ready),\n                )!,\n                false,\n              );\n\n              if (rows.length !== 1) return undefined;\n              const selected = yield* decodePasswordPreparedReady(rows[0][t.snapshot]);\n              const authority = yield* currentAuthority(mapping, configuration, selected);\n\n              if (authority === undefined) return undefined;\n\n              const locked = yield* readIntent(\n                mapping,\n                rowCondition(mapping, rows[0]),\n                configuration.locking,\n              );\n\n              const now = yield* nowMillis;\n\n              if (\n                locked.length !== 1 ||\n                now < selected.issuedAtMillis ||\n                now >= selected.expiresAtMillis ||\n                selected.moduleId !== input.moduleId ||\n                selected.generation !== input.generation ||\n                selected.digest !== input.digest ||\n                !(yield* recordMatches(\n                  mapping,\n                  locked[0],\n                  selected,\n                  authority.nativeSubjectId,\n                  yield* encodePasswordPreparedReady(selected),\n                ))\n              )\n                return undefined;\n\n              return { record: selected, currentRequirement: authority.requirement };\n            }),\n          );\n\n          return record ?? (yield* PasswordRejected.make({}));\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateContextFailure,\n        ),\n      complete: (input, prepare) =>\n        complete(input, prepare).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      resetWithProof: (input, prepare) =>\n        complete(input, prepare).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      cancel: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const record = yield* snapshotPasswordPreparedReady(uncaptured.record),\n            snapshot = yield* encodePasswordPreparedReady(record);\n\n          return yield* owned(\n            Effect.gen(function* () {\n              const journal = yield* CurrentCommitJournal;\n\n              yield* lockAnchor(mapping, configuration, record.moduleId);\n              const authority = yield* currentAuthority(mapping, configuration, record);\n\n              if (authority === undefined) return prepare(false, journal);\n\n              const rows = yield* readIntent(\n                mapping,\n                and(eq(c.moduleId, record.moduleId), eq(c.intentId, record.intentId))!,\n                configuration.locking,\n              );\n\n              const now = yield* nowMillis;\n\n              if (\n                rows.length !== 1 ||\n                now < record.issuedAtMillis ||\n                now >= record.expiresAtMillis ||\n                !(yield* recordMatches(\n                  mapping,\n                  rows[0],\n                  record,\n                  authority.nativeSubjectId,\n                  snapshot,\n                ))\n              )\n                return prepare(false, journal);\n              yield* terminal(mapping, rows[0], \"Cancelled\");\n\n              return prepare(true, journal);\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      cleanup: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const input = { ...uncaptured };\n\n          if (!Number.isSafeInteger(input.limit) || input.limit < 1 || input.limit > 1000)\n            return yield* unavailable();\n\n          return yield* owned(\n            Effect.gen(function* () {\n              const transaction = yield* CurrentPasswordSql;\n              const journal = yield* CurrentCommitJournal;\n\n              if (!(yield* lockAnchor(mapping, configuration, input.moduleId, false)))\n                return prepare({ removed: 0, hasMore: false }, journal);\n              const now = p.encodeInstant(yield* nowMillis);\n\n              const due = and(\n                eq(c.moduleId, input.moduleId),\n                or(\n                  and(lte(c.retainUntil, now), lte(c.admissionRetainUntil, now)),\n                  and(\n                    isNotNull(c.snapshot),\n                    or(\n                      and(eq(c.state, t.states.Preparing), lte(c.preparationExpiresAt, now)),\n                      and(eq(c.state, t.states.Ready), lte(c.expiresAt, now)),\n                    ),\n                  ),\n                ),\n              )!;\n\n              const rows = yield* read(\n                transaction\n                  .select()\n                  .from(t.table)\n                  .where(due)\n                  .orderBy(c.createdAt, c.intentId)\n                  .limit(input.limit + 1),\n                configuration.locking,\n              );\n\n              let removed = 0;\n\n              for (const row of rows.slice(0, input.limit)) {\n                const expired =\n                  (yield* readIntent(\n                    mapping,\n                    and(\n                      rowCondition(mapping, row),\n                      lte(c.retainUntil, now),\n                      lte(c.admissionRetainUntil, now),\n                    )!,\n                    false,\n                  )).length === 1;\n\n                if (expired) {\n                  yield* transaction.delete(t.table).where(rowCondition(mapping, row));\n                  if (\n                    (yield* readIntent(\n                      mapping,\n                      and(eq(c.moduleId, input.moduleId), eq(c.intentId, row[t.intentId]))!,\n                      false,\n                    )).length\n                  )\n                    return yield* unavailable();\n                  removed++;\n                } else yield* terminal(mapping, row, \"Expired\");\n              }\n\n              return prepare(\n                {\n                  removed,\n                  hasMore:\n                    (yield* read(transaction.select().from(t.table).where(due).limit(1), false))\n                      .length > 0,\n                },\n                journal,\n              );\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n    };\n\n    return services;\n  },\n);\n\nexport const passwordPreparedSqlKernel = {\n  columns,\n  recordMatches,\n  captureAuthority,\n  currentAuthority,\n  rowCondition,\n  valid,\n  identifierScope,\n};\n"],"mappings":";;;;;;;;;;;;;;AAwDA,MAAM,oBACJ,WAEA,yBACE,SACC,UACC,OAAO,GAAG,mBAAmB,CAAC,CAAC,KAAK,KACpC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,sBAAsB,CAAC,CAAC,KAAK,CAC3C,CAAC,CAAC,KAAK,OAAO,YAAY,UAAU,OAAO,UAAU,MAAM,IAAI,aAAa,YAAY,CAAC,CAAC,CAAC,CAAC;AAE9F,MAAM,2BACJ,WAEA,yBACE,SACC,UACC,OAAO,GAAG,mBAAmB,CAAC,CAAC,KAAK,KACpC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,sBAAsB,CAAC,CAAC,KAAK,CAC3C,CAAC,CAAC,KACA,OAAO,YAAY,UACjB,OAAO,UACL,MAAM,IAAI,QAAQ,UAAW,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,IAAI,QAAQ,YAAY,CAAE,CAC1F,CACF,CACF;AAGF,MAAM,YAAY,SAAS,IAAI,KAAK,OAAO,IAAI,SAAS,aAAa,CAAC;AAEtE,MAAM,QAAQ,OAAyB,YACrC,WAAW,OAAO,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,IAAI;AAErE,MAAM,WAAW,YAAqB;CACpC,MAAM,QAAQ,QAAQ;CAEtB,OAAO;EACL,UAAU,OAAO,MAAM,OAAO,MAAM,QAAQ;EAC5C,UAAU,OAAO,MAAM,OAAO,MAAM,QAAQ;EAC5C,WAAW,OAAO,MAAM,OAAO,MAAM,SAAS;EAC9C,WAAW,OAAO,MAAM,OAAO,MAAM,SAAS;EAC9C,QAAQ,OAAO,MAAM,OAAO,MAAM,MAAM;EACxC,YAAY,OAAO,MAAM,OAAO,MAAM,UAAU;EAChD,SAAS,OAAO,MAAM,OAAO,MAAM,OAAO;EAC1C,OAAO,OAAO,MAAM,OAAO,MAAM,KAAK;EACtC,QAAQ,OAAO,MAAM,OAAO,MAAM,MAAM;EACxC,UAAU,OAAO,MAAM,OAAO,MAAM,QAAQ;EAC5C,iBAAiB,OAAO,MAAM,OAAO,MAAM,eAAe;EAC1D,WAAW,OAAO,MAAM,OAAO,MAAM,SAAS;EAC9C,YAAY,OAAO,MAAM,OAAO,MAAM,UAAU;EAChD,sBAAsB,OAAO,MAAM,OAAO,MAAM,oBAAoB;EACpE,sBAAsB,OAAO,MAAM,OAAO,MAAM,oBAAoB;EACpE,WAAW,OAAO,MAAM,OAAO,MAAM,SAAS;EAC9C,aAAa,OAAO,MAAM,OAAO,MAAM,WAAW;CACpD;AACF;AAEA,MAAM,SAAS,YACb,OAAO,QAAQ,mCAAmC,CAAC,CAAC,OACjD,CAAC,KAAK,WACL,QAAQ,YAAY,SAA6D,KACrF;AAEF,MAAM,aAAa,OAAO,GAAG,oCAAoC,CAAC,CAAC,WACjE,SACA,eACA,UACA,SAAS,MACT;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,IAAI,QAAQ,WAChB,MAAM,OAAO,EAAE,OAAO,EAAE,QAAQ;CAElC,IAAI,QACF,OAAO,cAAc,eACnB,SAAS,OAAO,EAAE,KAAK,CAAC,CAAC,OAAO,EAAE,aAAa,QAAQ,CAAC,GACxD,EAAE,UACF,QACF;CAEF,MAAM,OAAO,OAAO,KAClB,SAAS,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,MAAM,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAChE,cAAc,OAChB;CAEA,IAAI,KAAK,SAAS,KAAM,UAAU,KAAK,WAAW,GAAI,OAAO,OAAO,YAAY;CAEhF,OAAO,KAAK,WAAW;AACzB,CAAC;AAED,MAAM,cAAc,OAAO,WAAW,OAAO,eAAe,YAAY,CAAC;AAEzE,MAAM,mBAAmB,OAAO,GAAG,0CAA0C,CAAC,CAAC,WAC7E,SACA,eACA,OAMA;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,IAAI,QAAQ;CAClB,MAAM,SAAS,OAAOA,kBAAO,YAAY,GAAG,MAAM,WAAW,cAAc,OAAO;CAElF,IAAI,OAAO,QAAQ,KAAA,KAAa,CAAC,EAAE,QAAQ,eAAe,OAAO,IAAI,EAAE,QAAQ,OAAO,GACpF,OAAO,KAAA;CAET,MAAM,KAAKA,kBAAO,kBAAkB,CAAC,GACnC,KAAKA,kBAAO,2BAA2B,CAAC;CAE1C,IAAI;CAEJ,IAAI,MAAM,WAAW,gBAAgB;EACnC,IAAI,MAAM,UAAU,KAAA,GAClB,cAAc,OAAOA,kBAAO,eAC1B,GACA,MAAM,MAAM,QAAQ,YACpB,cAAc,OAChB,EAAA,CAAG;OACA;GACH,MAAM,cAAc,OAAO,KACzB,SACG,OAAO,CAAC,CACR,KAAK,EAAE,WAAW,KAAK,CAAC,CACxB,MAAM,GAAG,GAAG,WAAW,OAAO,eAAe,CAAC,CAAC,CAC/C,QAAQ,GAAG,WAAW,GAAG,KAAK,GACjC,KACF,EAAA,CAAG,MAAM,QAAa,EAAE,WAAW,UAAU,GAAG,CAAC;GAEjD,IAAI,eAAe,KAAA,GACjB,cAAc,OAAOA,kBAAO,eAC1B,GACA;IACE,WAAW,WAAW,EAAE,WAAW;IACnC,OAAO,WAAW,EAAE,WAAW;GACjC,GACA,cAAc,OAChB,EAAA,CAAG;EACP;EACA,IACE,eAAe,KAAA,KACf,CAAC,EAAE,WAAW,UAAU,UAAU,KAClC,CAAC,EAAE,UAAU,OAAO,WAAW,EAAE,WAAW,YAAY,OAAO,eAAe,GAE9E,OAAO,KAAA;CACX;CAEA,MAAM,cAAc,OAAOA,kBAAO,uBAChC,GACA,MAAM,UACN,OAAO,iBACP,cAAc,OAChB,EAAA,CAAG;CAEH,IAAK,MAAM,WAAW,oBAAqB,eAAe,KAAA,IAAY,OAAO,KAAA;CAE7E,MAAM,WACJ,eAAe,KAAA,IACX,KAAA,IACA,OAAO,EAAE,WACN,OAAO;EAAE,UAAU,MAAM;EAAU,SAAS,OAAO;EAAK;EAAY;CAAW,CAAC,CAAC,CACjF,KAAK,OAAO,QAAQ,0BAA0B,CAAC;CAExD,IACE,aAAa,KAAA,MACZ,SAAS,aAAa,MAAM,YAC3B,SAAS,SAAS,cAAc,MAAM,aACtC,SAAS,SAAS,qBAAqB,OAAO,IAAI,EAAE,QAAQ,qBAC5D,SAAS,iBAAiB,WAAW,EAAE,WAAW,iBAClD,SAAS,uBAAuB,WAAW,EAAE,WAAW,uBACxD,SAAS,oBAAoB,WAAW,EAAE,WAAW,oBACrD,SAAS,MAAM,SAAS,QAAQ,MAAM,WAAW,EAAE,WAAW,aAC9D,SAAS,kBAAkB,WAAW,EAAE,WAAW,kBACnD,SAAS,WAAW,cAAc,WAAW,EAAE,WAAW,cAC1D,SAAS,WAAW,UAAU,WAAW,EAAE,WAAW,UACtD,SAAS,8BAA8B,WAAW,EAAE,WAAW,mBAEjE,OAAO,KAAA;CAWT,MAAM,UAAS,OATQ,KACrB,SACG,OAAO,CAAC,CACR,KAAK,EAAE,oBAAoB,KAAK,CAAC,CACjC,MAAM,GAAG,GAAG,WAAW,OAAO,eAAe,CAAC,CAAC,CAC/C,QAAQ,GAAG,YAAY,GAC1B,cAAc,OAChB,EAAA,CAEuB,QACpB,QACC,EAAE,oBAAoB,WAAW,KAAA,KACjC,EAAE,oBAAoB,iBAAiB,IAAI,EAAE,oBAAoB,OAAO,MAAM,IAClF;CAEA,IAAI,OAAO,SAAS,IAAI,OAAO,OAAO,YAAY;CAElD,MAAM,WACJ,UAAU,YACV,uBAAuB,KAAK;EAC1B,WAAW,MAAM;EACjB,kBAAkB,OAAO,IAAI,EAAE,QAAQ;EACvC,aAAa,OAAO,KAAK,SAAc;GACrC,cAAc,IAAI,EAAE,oBAAoB;GACxC,UAAU,IAAI,EAAE,oBAAoB;EACtC,EAAE;CACJ,CAAC;CAEH,IACE,SAAS,YAAY,MAClB,aACC,CAAC,OAAO,MACL,QACC,IAAI,EAAE,oBAAoB,kBAAkB,SAAS,gBACrD,IAAI,EAAE,oBAAoB,cAAc,SAAS,QACrD,CACJ,GAEA,OAAO,KAAA;CAET,MAAM,cAAc,OAAO,EAAE,QAC1B,wBAAwB,OAAO,KAAK,MAAM,MAAM,CAAC,CACjD,KAAK,OAAO,QAAQ,2BAA2B,CAAC;CAEnD,OAAO;EAAE,GAAG;EAAQ;EAAY;EAAU;EAAU;CAAY;AAClE,CAAC;AAED,MAAM,mBAAmB,OAAO,GAAG,0CAA0C,CAAC,CAAC,WAC7E,SACA,eACA,QACA;CACA,MAAM,UAAU,OAAO,iBAAiB,SAAS,eAAe;EAC9D,UAAU,OAAO;EACjB,QAAQ,OAAO;EACf,WAAW,OAAO,SAAS;EAC3B,GAAI,OAAO,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,OAAO,MAAM;CAC9D,CAAC;CAED,IACE,YAAY,KAAA,KACZ,CAAC,aAAa,QAAQ,UAAU,OAAO,QAAQ,MAC9C,QAAQ,aAAa,KAAA,IAClB,OAAO,eAAe,KAAA,IACtB,OAAO,eAAe,KAAA,KACtB,CAACA,kBAAO,uBAAuB,QAAQ,UAAU,OAAO,UAAU,IAEtE,OAAO,KAAA;CAET,OAAO;AACT,CAAC;AAED,MAAM,gBAAgB,SAAkB,QAAa;CACnD,MAAM,IAAI,QAAQ,OAAO;CAEzB,OAAO,IACL,GAAG,OAAO,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW;EACzC,MACE,OAAO,IADK,QAAQ,OAAO;EAG7B,OAAO,UAAU,UAAU,IAAI,IAAI,OAAO,KAAK,IAAI,GAAG,OAAO,IAAI;CACnE,CAAC,CACH;AACF;AAEA,MAAM,aAAa,OAAO,GAAG,oBAAoB,CAAC,CAAC,WACjD,SACA,WACA,SACA;CACA,MAAM,WAAW,OAAO;CAExB,OAAO,OAAO,KACZ,SAAS,OAAO,CAAC,CAAC,KAAK,QAAQ,OAAO,KAAK,CAAC,CAAC,MAAM,SAAS,CAAC,CAAC,MAAM,CAAC,GACrE,OACF;AACF,CAAC;AAED,MAAM,gBAAgB,OAAO,GAAG,uCAAuC,CAAC,CAAC,WACvE,SACA,KACA,QACA,iBACA,UACA;CACA,MAAM,IAAI,QAAQ,QAChB,IAAI,QAAQ;CAEd,IACE,QAAQ,KAAA,KACR,IAAI,EAAE,cAAc,OAAO,YAC3B,IAAI,EAAE,cAAc,OAAO,YAC3B,IAAI,EAAE,eAAe,OAAO,aAC5B,CAAC,EAAE,UAAU,OAAO,IAAI,EAAE,YAAY,eAAe,KACrD,IAAI,EAAE,YAAY,OAAO,UACzB,IAAI,EAAE,gBAAgB,OAAO,cAC7B,IAAI,EAAE,aAAa,OAAO,WAC1B,IAAI,EAAE,WAAW,EAAE,OAAO,OAAO,SACjC,IAAI,EAAE,cAAc,YACpB,IAAI,EAAE,qBAAqB,gBAAgB,MAAM,MAChD,OAAO,SAAS,UACb,IAAI,EAAE,YAAY,OAAO,SACzB,CAAC,UAAU,UAAU,IAAI,EAAE,OAAO,IAEtC,OAAO;CACT,KAAK,MAAM,CAAC,KAAK,YAAY;EAC3B,CAAC,EAAE,WAAW,OAAO,eAAe;EACpC,CAAC,EAAE,sBAAsB,OAAO,0BAA0B;EAC1D,CAAC,EAAE,aAAa,OAAO,iBAAiB;CAC1C,GACE,KAAK,OAAO,EAAE,cAAc,IAAI,IAAI,OAAO,SAAS,OAAO;CAE7D,OAAO,OAAO,SAAS,WAClB,OAAO,EAAE,cAAc,IAAI,EAAE,UAAU,OAAO,OAAO,kBACtD,UAAU,UAAU,IAAI,EAAE,UAAU;AAC1C,CAAC;AAED,MAAM,WAAW,OAAO,GAAG,kCAAkC,CAAC,CAAC,WAC7D,SACA,KACA,OACA;CAGA,QAAO,OAFiB,mBAAA,CAGrB,OAAO,QAAQ,OAAO,KAAK,CAAC,CAC5B,IAAI,QAAQ,OAAO,eAAe,KAAK,CAAC,CAAC,CACzC,MAAM,aAAa,SAAS,GAAG,CAAC;CAEnC,MAAM,IAAI,QAAQ,OAAO,GACvB,IAAI,QAAQ;CAEd,MAAM,OAAO,OAAO,WAClB,SACA,IAAI,GAAG,EAAE,UAAU,IAAI,EAAE,SAAS,GAAG,GAAG,EAAE,UAAU,IAAI,EAAE,SAAS,CAAC,GACpE,KACF;CAEA,MAAM,WAAW;EAAE,GAAG;GAAM,EAAE,QAAQ,EAAE,OAAO;GAAS,EAAE,WAAW;GAAO,EAAE,SAAS;CAAK;CAE5F,IACE,KAAK,WAAW,MACf,OAAO,WAAW,SAAS,aAAa,SAAS,QAAQ,GAAG,KAAK,EAAA,CAAG,WAAW,GAEhF,OAAO,OAAO,YAAY;AAC9B,CAAC;AAED,MAAa,qCAAqC,OAAO,GAAG,oCAAoC,CAAC,CAC/F,WACE,SACA,eAC2F;CAC3F,MAAM,WAAW,OAAO;CACxB,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,UAChB,IAAI,QAAQ,OAAO,GACnB,IAAI,QAAQ;CAEd,MAAM,SAAkB,SACtB,MAAM,OAAO,IACTA,kBAAO,MACL,UACA,GACA,eACA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO;EACvB,MAAM,SAAS,OAAO,OAAO,cAAc,6BAA6B;EAExE,IAAI,OAAO,OAAO,MAAM,KAAK,CAAC,OAAO,MAAM,SAAS,QAAQ,QAAQ,KAAA,CAAS,CAAC,GAC5E,OAAO,OAAO,YAAY;EAE5B,OAAO,OAAO;CAChB,CAAC,CACH,IACA,OAAO,KAAK,YAAY,CAAC;CAE/B,MAAM,YACJ,YACA,YAEA,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO,iBAAiB,UAAU;EAEhD,MAAM,aACJ,WAAW,eAAe,KAAA,IACtB,KAAA,IACA;GACE,SAAS,WAAW,WAAW;GAC/B,OAAO,OAAO,OAAO,aAAa,OAAO,eAAe,eAAe,CAAC,CAAC,CACvE,WAAW,WAAW,KACxB,CAAC,CAAC,KACA,OAAO,QAAQ,OAAO,aAAa,OAAO,eAAe,eAAe,CAAC,CAAC,GAC1E,OAAO,SAAS,WAAW,CAC7B;EACF;EAEN,IACG,MAAM,OAAO,WAAW,sBAAuB,eAAe,KAAA,MAC9D,eAAe,KAAA,KAAa,cAAc,UAAU,KAAA,GAErD,OAAO,OAAO,YAAY;EAE5B,OAAO,OAAO,MACZ,OAAO,IAAI,aAAa;GACtB,MAAM,cAAc,OAAO;GAC3B,MAAM,UAAU,OAAO;GAEvB,OAAO,WAAW,SAAS,eAAe,MAAM,OAAO,QAAQ;GAS/D,KAAI,OAPqBA,kBAAO,0BAC9B,GACA,eACA,MAAM,UACN,MAAM,OAAO,MACf,OAEkB,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;GAC/D,MAAM,UAAU,OAAO,iBAAiB,SAAS,eAAe,MAAM,MAAM;GAE5E,IAAI,YAAY,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;GAE7D,MAAM,OAAO,OAAO,WAClB,SACA,IAAI,GAAG,EAAE,UAAU,MAAM,OAAO,QAAQ,GAAG,GAAG,EAAE,UAAU,MAAM,OAAO,QAAQ,CAAC,GAChF,cAAc,OAChB;GAEA,MAAM,MAAM,KAAK,IACf,UAAU,OAAO,4BAA4B,MAAM,MAAM;GAE3D,IACE,KAAK,WAAW,KAChB,EAAE,OAAO,cACP,SACA,KACA,MAAM,QACN,QAAQ,iBACR,OACF,MACA,CAAC,gBAAgB,OAAO,QAAQ,aAAa,OAAO,SAAS,MAC5D,OAAOA,kBAAO,cACb,GACA,MAAM,OAAO,UACb,MAAM,OAAO,WACb,cAAc,OAChB,EAAA,CAAG,WAAW,GAEd,OAAO,QAAQ,YAAY,OAAO;GACpC,IACE,eAAe,KAAA,MACd,MAAM,OAAO,UAAU,KAAA,KACtB,WAAW,MAAM,mBAAmB,MAAM,OAAO,MAAM,kBACvD,YAAY,WAAW,MAAM,OAAO,MAAM,YAAY,MAAM,OAAO,MAAM,OAAO,KAChF,CAACA,kBAAO,+BAA+B;IAAE,GAAG,MAAM;IAAU;GAAW,CAAC,IAE1E,OAAO,QAAQ,YAAY,OAAO;GAEpC,MAAM,qBAAqB,OAAOA,kBAAO,SACvC,cAAc,MACd,EAAE,kBACF,EAAE,oBACJ;GAEA,MAAM,kBAAkB,OAAOA,kBAAO,SACpC,cAAc,MACd,EAAE,kBACF,EAAE,oBACJ;GAEA,MAAM,uBAAuB,OAAOA,kBAAO,6BACzC,GACA,cAAc,MACd,MAAM,OAAO,SAAS,gBACxB;GAEA,IACE,yBAAyB,MAAM,OAAO,SAAS,oBAC/C,uBAAuB,MAAM,OAAO,YAAY,sBAChD,oBAAoB,MAAM,OAAO,YAAY,iBAE7C,OAAO,OAAO,YAAY;GAE5B,MAAM,eACJ,MAAM,OAAO,WAAW,iBACpB,OAAOA,kBAAO,SACZ,cAAc,MACd,EAAE,sBACF,EAAE,wBACJ,IACA,KAAA;GAEN,IAAI;GAEJ,MAAM,gBAAgB,OAAO,GAAG,uCAAuC,CAAC,OACtE,OAAO,QAAQ,qCAAqC,uBAClD,OAAO,IAAI,aAAa;IACtB,IAAI,cAAc,KAAA,GAAW;IAE7B,IACE,EAAE,OAAOA,kBAAO,qBACd,GACA,MAAM,UACN,QAAQ,iBACR;KACE,cAAc,gBAAgB,MAAM,OAAO,WAAY;KACvD;KACA;KACA;IACF,GACA,SACF,OACC,OAAO,WACN,SACA,aAAa,SAAS;KACpB,GAAG;MACF,EAAE,QAAQ,EAAE,OAAO;MACnB,EAAE,WAAW;MACb,EAAE,SAAS;IACd,CAAC,GACD,KACF,EAAA,CAAG,WAAW,KACd,CAAC,gBAAgB,OAAO,QAAQ,aAAa,OAAO,SAAS,GAE7D,OAAO,OAAO,YAAY;GAC9B,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,oBAAoB,kBAAkB,CAAC,CACvE,CACF;GAEA,MAAM,kBAAkB,OAAO,IAAI,aAAa;IAC9C,OAAO,cAAc,CAAC,CAAC,KACrB,OAAO,eAAe,oCAAoC,WAAW,CACvE;IACA,IAAI,cAAc,KAAA,GAAW;IAC7B,MAAM,iBAAiB,OAAO,OAAO,cAAc,8BAA8B;IAEjF,IACE,OAAO,OAAO,cAAc,KAC5B,CAAC,eAAe,MAAM,SAAS,cAAc,CAAC,CAAC,KAAK,gBAAgB,CAAC,GAErE,OAAO,OAAO,YAAY;GAC9B,CAAC;GAED,MAAM,QAAQ,OAAO,GAAG,+BAA+B,CAAC,CAAC,aAAa;IACpE,MAAM,WAAW,OAAO;IAExB,IAAI,CAAC,gBAAgB,OAAO,QAAQ,aAAa,QAAQ,GAAG,OAAO;IAwBnE,IAAI,EArBF,MAAM,OAAO,WAAW,iBACpB,OAAOA,kBAAO,cACZ,GACA,eACA,MAAM,UACN;KACgB;KACd;KACA;KACA;IACF,GACA,QACF,IACA,OAAOA,kBAAO,iBACZ,GACA,MAAM,UACN,QAAQ,iBACR;KAAE;KAAoB;KAAiB;IAAqB,GAC5D,QACF,IAEQ,OAAO,OAAO,YAAY;IACxC,YAAY;IACZ,OAAO,SAAS,SAAS,KAAK,UAAU;IACxC,IAAI,CAAC,gBAAgB,OAAO,QAAQ,aAAa,OAAO,SAAS,GAC/D,OAAO,OAAO,YAAY;IAE5B,OAAO;GACT,CAAC;GAED,IAAI,eAAe,KAAA,GAAW;IAC5B,IAAI;IAEJ,OAAO,oBACL,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,YACA,OAAO,IAAI,aAAa;KACtB,OAAO,OAAO,MAAM;IACtB,CAAC,IACA,aAAa;KACZ,UAAU,QAAQ,aAAa,cAAc,YAAY,YAAY,OAAO;KAE5E,OAAO;IACT,CACF;IAEA,OAAO;IAEP,OAAO,WAAW,QAAQ,YAAY,OAAO;GAC/C;GAEA,MAAM,UAAU,OAAO,MAAM;GAE7B,OAAO;GAEP,OAAO,QAAQ,UAAU,YAAY,YAAY,OAAO;EAC1D,CAAC,CACH;CACF,CAAC;CA2fH,OAAO;EAxfL,UAAU,YAAY,YACpB,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,gBAAgB,UAAU;GAE/C,IACG,MAAM,WAAW,sBACf,MAAM,UAAU,KAAA,KAAa,MAAM,eAAe,KAAA,MACpD,MAAM,WAAW,oBAAoB,cAAc,UAAU,KAAA,KAC9D,MAAM,eAAe,MAAM,OAAO,cAClC,MAAM,OAAO,kBACX,KAAK,IACH,MAAM,OAAO,4BAA4B,MAAM,OAAO,gBACtD,MAAM,OAAO,UAAU,OAAO,cAC9B,MAAM,OAAO,UAAU,WAAW,cAClC,MAAM,OAAO,UAAU,QAAQ,YACjC,KACD,MAAM,aAAa,qBAAqB,eACvC,EAAE,wBAAwB,4BAE5B,OAAO,OAAO,YAAY;GAE5B,OAAO,OAAO,MACZ,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IAEvB,OAAO,WAAW,SAAS,eAAe,MAAM,QAAQ;IAExD,MAAM,UAAU,wBAAwB,KACtC,OAAOA,kBAAO,SACZ,cAAc,MACd,QAAQ,iBACR,QAAQ,mBACV,CACF;IAEA,MAAM,YAAY,OAAO,iBAAiB,SAAS,eAAe,KAAK;IAEvE,IAAI,cAAc,KAAA,GAAW,OAAO,OAAO,YAAY;IACvD,IAAI,MAAM,UAAU,KAAA,GAEhB;SAAA,MAAM,eAAe,KAAA,KACrB,MAAM,WAAW,aAAa,GAAG,MAAM,SAAS,WAChD,MAAM,WAAW,YAAY,oBAC7B,MAAM,MAAM,mBAAmB,MAAM,WAAW,kBAChD,YAAY,MAAM,MAAM,OAAO,MAAM,YAAY,MAAM,WAAW,OAAO,KACzE,MAAM,MAAM,QAAQ,SAAS,aAC7B,CAAC,aAAa,MAAM,MAAM,QAAQ,UAAU,UAAU,QAAQ,KAC9D,UAAU,UAAU,+BAA+B,KAAA,KACnD,EAAE,OAAO,uBACP,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MAAM,UACR,IAEA,OAAO,OAAO,YAAY;IAAA;IAE9B,KACG,OAAO,WACN,SACA,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,WAAW,MAAM,SAAS,CAAC,GACpE,cAAc,OAChB,EAAA,CAAG,QAEH,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,OAAO;IAE9C,MAAM,MAAM,OAAO,WACjB,YAAY,EAAE,cAAc,GAAG;IAEjC,MAAM,QAAQ,gBAAgB;KAC5B,YAAY,UAAU;KACtB,UAAU,UAAU;IACtB,CAAC;IAuBD,MApBG,OAAO,KACN,YACG,OAAO,EAAE,OAAO,MAAM,EAAE,CAAC,CAAC,CAC1B,KAAK,EAAE,KAAK,CAAC,CACb,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,WAAW,UAAU,eAAe,GACzC,GACE,IACE,GAAG,EAAE,OAAO,EAAE,OAAO,SAAS,GAC9B,GAAG,EAAE,sBAAsB,SAAS,CACtC,GACA,IAAI,GAAG,EAAE,OAAO,EAAE,OAAO,KAAK,GAAG,GAAG,EAAE,WAAW,SAAS,CAAC,CAC7D,CACF,CACF,GACF,KACF,EAAA,CAAG,EAAE,EAAE,SAAS,MAEJ,MAAM,OAAO,0BAA0B,OAAO,OAAO,YAAY;IAC/E,KAAK,MAAM,CAAC,WAAW,WAAW;KAChC,CAAC,GAAG,EAAE,QAAQ,MAAM,MAAM,GAAG,MAAM,OAAO,UAAU,MAAM;KAC1D,CAAC,GAAG,EAAE,iBAAiB,KAAK,GAAG,MAAM,OAAO,UAAU,UAAU;KAChE,CAAC,GAAG,EAAE,WAAW,UAAU,eAAe,GAAG,MAAM,OAAO,UAAU,OAAO;IAC7E,GAgBE,MAdG,OAAO,KACN,YACG,OAAO,EAAE,OAAO,MAAM,EAAE,CAAC,CAAC,CAC1B,KAAK,EAAE,KAAK,CAAC,CACb,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,WACA,GAAG,EAAE,YAAY,EAAE,cAAc,MAAM,OAAO,YAAY,CAAC,CAC7D,CACF,GACF,KACF,EAAA,CAAG,EAAE,EAAE,SAAS,MAEL,OAAO,OAAO,OAAO,OAAO,YAAY;IAGvD,MAAM,cAAc,OAAO,oCAAoC;KAC7D,MAAM;KACN,UAAU,MAAM;KAChB,YAAY,MAAM;KAClB,UAAU,MAAM;KAChB;KACA,WAAW,MAAM;KACjB,QAAQ,MAAM;KACd,UAAU,UAAU;KACpB,GAAI,UAAU,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY,UAAU,SAAS;KAC7E,qBAAqB,UAAU;KAC/B,GAAI,MAAM,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;KAC1D,cAAc,MAAM;KACpB,iBAAiB;KACjB,4BAA4B,MAAM,MAAM,OAAO;KAC/C,mBAAmB,MAAM,MAAM,OAAO;IACxC,CAAC;IAED,MAAM,WAAW,OAAO,kBAAkB,WAAW;IAErD,OAAO,YAAY,OAAO,EAAE,KAAK,CAAC,CAAC,OACjC,EAAE,aAAa;KACb;KACA,iBAAiB,UAAU;KAC3B,iBAAiB;KACjB;KACA,kBAAkB;KAClB,4BACE,MACA,KAAK,IACH,MAAM,OAAO,UAAU,OAAO,cAC9B,MAAM,OAAO,UAAU,WAAW,cAClC,MAAM,OAAO,UAAU,QAAQ,YACjC;IACJ,CAAC,CACH;IAEA,MAAM,OAAO,OAAO,WAClB,SACA,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,UAAU,MAAM,QAAQ,CAAC,GAClE,KACF;IAEA,IACE,KAAK,WAAW,KAChB,EAAE,OAAO,cACP,SACA,KAAK,IACL,aACA,UAAU,iBACV,QACF,IAEA,OAAO,OAAO,YAAY;IAE5B,MAAM,gBACJ,MACA,KAAK,IACH,MAAM,OAAO,UAAU,OAAO,cAC9B,MAAM,OAAO,UAAU,WAAW,cAClC,MAAM,OAAO,UAAU,QAAQ,YACjC;IAEF,KACG,OAAO,EAAE,cAAc,KAAK,EAAE,CAAC,EAAE,WAAW,OAAO,QACnD,OAAO,EAAE,cAAc,KAAK,EAAE,CAAC,EAAE,qBAAqB,OAAO,kBAC7D,OAAO,cAAc,YAAY,8BACjC,MAAM,eAAe,KAAA,KACpB,EAAE,OAAO,uBACP,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MAAM,UACR,IAEF,OAAO,OAAO,YAAY;IAE5B,OAAO,QAAQ;KAAE,MAAM;KAAY;IAAY,GAAG,OAAO;GAC3D,CAAC,CACH;EACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,eAAe,YAAY,YACzB,OAAO,IAAI,aAAa;GACtB,MAAM,cAAc,OAAO,oCAAoC,WAAW,WAAW,GACnF,QAAQ,OAAO,8BAA8B,WAAW,KAAK;GAE/D,MAAM,WAAW,OAAO,kBAAkB,WAAW,GACnD,gBAAgB,OAAO,4BAA4B,KAAK;GAE1D,KAAK,OAAO,kBAAkB,cAAc,KAAK,CAAC,OAAO,UACvD,OAAO,OAAO,YAAY;GAE5B,OAAO,OAAO,MACZ,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IAEvB,OAAO,WAAW,SAAS,eAAe,YAAY,QAAQ;IAC9D,MAAM,YAAY,OAAO,iBAAiB,SAAS,eAAe,WAAW;IAE7E,IAAI,cAAc,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;IAE/D,MAAM,OAAO,OAAO,WAChB,SACA,IAAI,GAAG,EAAE,UAAU,YAAY,QAAQ,GAAG,GAAG,EAAE,UAAU,YAAY,QAAQ,CAAC,GAC9E,cAAc,OAChB,GACA,MAAM,KAAK;IAEb,MAAM,MAAM,OAAO;IAEnB,IACE,KAAK,WAAW,KAChB,EAAE,OAAO,cACP,SACA,KACA,aACA,UAAU,iBACV,QACF,MACA,MAAM,MAAM,kBACZ,OAAO,YAAY,8BACnB,OAAO,MAAM,iBAEb,OAAO,QAAQ,YAAY,OAAO;IACpC,OAAO,YACJ,OAAO,EAAE,KAAK,CAAC,CACf,IAAI,EAAE,YAAY;KAAE;KAAO,UAAU;IAAc,CAAC,CAAC,CAAC,CACtD,MAAM,aAAa,SAAS,GAAG,CAAC;IAEnC,MAAM,QAAQ,OAAO,WACnB,SACA,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,UAAU,MAAM,QAAQ,CAAC,GAClE,KACF;IAEA,IACE,MAAM,WAAW,KACjB,EAAE,OAAO,cACP,SACA,MAAM,IACN,OACA,UAAU,iBACV,aACF,OACC,OAAO,WACN,SACA,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,YAAY,IAAI,EAAE,WAAW,GAClC,GAAG,EAAE,sBAAsB,IAAI,EAAE,qBAAqB,CACxD,GACA,KACF,EAAA,CAAG,WAAW,GAEd,OAAO,OAAO,YAAY;IAC5B,KACG,OAAO,cAAc,YAAY,+BACjC,OAAO,cAAc,MAAM,iBAE5B,OAAO,OAAO,YAAY;IAE5B,OAAO,QAAQ,aAAa,OAAO;GACrC,CAAC,CACH;EACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,UAAU,eACR,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,OAAO,aAAa,YAAY,CAAC,CAAC,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,KACxE,OAAO,SAAS,WAAW,CAC7B;GA0DA,QAAO,OAxDeA,kBAAO,SAC3B,UACA,eACA,OAAO,IAAI,aAAa;IACtB,IACE,CAAC,MAAM,OAAO,KACd,EAAE,OAAO,WAAW,SAAS,eAAe,MAAM,UAAU,KAAK,IAEjE,OAAO,KAAA;IAET,MAAM,OAAO,OAAO,WAClB,SACA,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,YAAY,MAAM,UAAU,GACjC,GAAG,EAAE,QAAQ,MAAM,MAAM,GACzB,GAAG,EAAE,OAAO,EAAE,OAAO,KAAK,CAC5B,GACA,KACF;IAEA,IAAI,KAAK,WAAW,GAAG,OAAO,KAAA;IAC9B,MAAM,WAAW,OAAO,4BAA4B,KAAK,EAAE,CAAC,EAAE,SAAS;IACvE,MAAM,YAAY,OAAO,iBAAiB,SAAS,eAAe,QAAQ;IAE1E,IAAI,cAAc,KAAA,GAAW,OAAO,KAAA;IAEpC,MAAM,SAAS,OAAO,WACpB,SACA,aAAa,SAAS,KAAK,EAAE,GAC7B,cAAc,OAChB;IAEA,MAAM,MAAM,OAAO;IAEnB,IACE,OAAO,WAAW,KAClB,MAAM,SAAS,kBACf,OAAO,SAAS,mBAChB,SAAS,aAAa,MAAM,YAC5B,SAAS,eAAe,MAAM,cAC9B,SAAS,WAAW,MAAM,UAC1B,EAAE,OAAO,cACP,SACA,OAAO,IACP,UACA,UAAU,iBACV,OAAO,4BAA4B,QAAQ,CAC7C,IAEA,OAAO,KAAA;IAET,OAAO;KAAE,QAAQ;KAAU,oBAAoB,UAAU;IAAY;GACvE,CAAC,CACH,OAEkB,OAAO,iBAAiB,KAAK,CAAC,CAAC;EACnD,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,uBACF;EACF,WAAW,OAAO,YAChB,SAAS,OAAO,OAAO,CAAC,CAAC,KACvB,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,iBAAiB,OAAO,YACtB,SAAS,OAAO,OAAO,CAAC,CAAC,KACvB,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,SAAS,YAAY,YACnB,OAAO,IAAI,aAAa;GACtB,MAAM,SAAS,OAAO,8BAA8B,WAAW,MAAM,GACnE,WAAW,OAAO,4BAA4B,MAAM;GAEtD,OAAO,OAAO,MACZ,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO;IAEvB,OAAO,WAAW,SAAS,eAAe,OAAO,QAAQ;IACzD,MAAM,YAAY,OAAO,iBAAiB,SAAS,eAAe,MAAM;IAExE,IAAI,cAAc,KAAA,GAAW,OAAO,QAAQ,OAAO,OAAO;IAE1D,MAAM,OAAO,OAAO,WAClB,SACA,IAAI,GAAG,EAAE,UAAU,OAAO,QAAQ,GAAG,GAAG,EAAE,UAAU,OAAO,QAAQ,CAAC,GACpE,cAAc,OAChB;IAEA,MAAM,MAAM,OAAO;IAEnB,IACE,KAAK,WAAW,KAChB,MAAM,OAAO,kBACb,OAAO,OAAO,mBACd,EAAE,OAAO,cACP,SACA,KAAK,IACL,QACA,UAAU,iBACV,QACF,IAEA,OAAO,QAAQ,OAAO,OAAO;IAC/B,OAAO,SAAS,SAAS,KAAK,IAAI,WAAW;IAE7C,OAAO,QAAQ,MAAM,OAAO;GAC9B,CAAC,CACH;EACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,UAAU,YAAY,YACpB,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,GAAG,WAAW;GAE9B,IAAI,CAAC,OAAO,cAAc,MAAM,KAAK,KAAK,MAAM,QAAQ,KAAK,MAAM,QAAQ,KACzE,OAAO,OAAO,YAAY;GAE5B,OAAO,OAAO,MACZ,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IAEvB,IAAI,EAAE,OAAO,WAAW,SAAS,eAAe,MAAM,UAAU,KAAK,IACnE,OAAO,QAAQ;KAAE,SAAS;KAAG,SAAS;IAAM,GAAG,OAAO;IACxD,MAAM,MAAM,EAAE,cAAc,OAAO,SAAS;IAE5C,MAAM,MAAM,IACV,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GACE,IAAI,IAAI,EAAE,aAAa,GAAG,GAAG,IAAI,EAAE,sBAAsB,GAAG,CAAC,GAC7D,IACE,UAAU,EAAE,QAAQ,GACpB,GACE,IAAI,GAAG,EAAE,OAAO,EAAE,OAAO,SAAS,GAAG,IAAI,EAAE,sBAAsB,GAAG,CAAC,GACrE,IAAI,GAAG,EAAE,OAAO,EAAE,OAAO,KAAK,GAAG,IAAI,EAAE,WAAW,GAAG,CAAC,CACxD,CACF,CACF,CACF;IAEA,MAAM,OAAO,OAAO,KAClB,YACG,OAAO,CAAC,CACR,KAAK,EAAE,KAAK,CAAC,CACb,MAAM,GAAG,CAAC,CACV,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,CAChC,MAAM,MAAM,QAAQ,CAAC,GACxB,cAAc,OAChB;IAEA,IAAI,UAAU;IAEd,KAAK,MAAM,OAAO,KAAK,MAAM,GAAG,MAAM,KAAK,GAYzC,KAVG,OAAO,WACN,SACA,IACE,aAAa,SAAS,GAAG,GACzB,IAAI,EAAE,aAAa,GAAG,GACtB,IAAI,EAAE,sBAAsB,GAAG,CACjC,GACA,KACF,EAAA,CAAG,WAAW,GAEH;KACX,OAAO,YAAY,OAAO,EAAE,KAAK,CAAC,CAAC,MAAM,aAAa,SAAS,GAAG,CAAC;KACnE,KACG,OAAO,WACN,SACA,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,UAAU,IAAI,EAAE,SAAS,CAAC,GACnE,KACF,EAAA,CAAG,QAEH,OAAO,OAAO,YAAY;KAC5B;IACF,OAAO,OAAO,SAAS,SAAS,KAAK,SAAS;IAGhD,OAAO,QACL;KACE;KACA,UACG,OAAO,KAAK,YAAY,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,EAAA,CACvE,SAAS;IAChB,GACA,OACF;GACF,CAAC,CACH;EACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;CAGU;AAChB,CACF;AAEA,MAAa,4BAA4B;CACvC;CACA;CACA;CACA;CACA;CACA;CACA;AACF"}

package/dist/drizzle/password-prepared-state.mjs

@@ -1,9 +1,9 @@
 import { passwordSqlKernel } from "./password-sql.mjs";
-import { SubjectId, TokenDigest } from "@yielded/auth/Schema";
 import { DateTime, Effect, Redacted, Schema } from "effect";
 import { AuthenticationProof, AuthenticationRequirement, SessionInvalidationWindow } from "@yielded/auth/Sessions";
 import { ProofBinding, ProofContinuationId, ProofPurpose } from "@yielded/auth/Proofs";
 import { PasswordAction, PasswordCommandId, PasswordCredentialSnapshot, PasswordPreparedConfiguration, PasswordPreparedIntentId, PasswordPreparedRequirement, PasswordPreparedReservation, PasswordPreparedReset, PasswordUnavailable, encodePasswordPreparedReady, snapshotPasswordPreparedReady, snapshotPasswordPreparedReservation } from "@yielded/auth/Password";
+import { SubjectId, TokenDigest } from "@yielded/auth/Schema";
 //#region src/drizzle/password-prepared-state.ts
 const unavailable = () => PasswordUnavailable.make({});
 const Instant = Schema.Int.check(Schema.isBetween({

package/dist/drizzle/password-prepared-target.d.mts

@@ -1,11 +1,12 @@
+import "./password-sql.mjs";
 import "./password-target.mjs";
 import { Context, Effect, Layer } from "effect";
 import { LifecycleHooks } from "@yielded/auth/Hooks";
 import { PasswordPreparedPersistence } from "@yielded/auth/Password";
-import "effect/unstable/sql/SqlError";
+import "effect/sql/SqlError";
 //#region src/drizzle/password-prepared-target.d.ts
-export declare const passwordPreparedPersistenceLayer: <Id>(tag: Context.Key<Id, PasswordPreparedPersistence>, services: Effect.Effect<{
+export declare const passwordPreparedPersistenceLayer: <Id, E, R>(tag: Context.Key<Id, PasswordPreparedPersistence>, services: Effect.Effect<{
   readonly passwordPreparedPersistence: PasswordPreparedPersistence;
-}, never, LifecycleHooks>) => Layer.Layer<Id, never, LifecycleHooks>;
+}, E, R>) => Layer.Layer<Id, E, Exclude<R, import("effect/Scope").Scope>>;
 //#endregion
 //# sourceMappingURL=password-prepared-target.d.mts.map

package/dist/drizzle/password-prepared-target.mjs

@@ -1,3 +1,4 @@
+import { CurrentPasswordSql } from "./password-sql.mjs";
 import { passwordOptions } from "./password-target.mjs";
 import { makeSqlPasswordPreparedPersistence } from "./password-prepared-sql.mjs";
 import { CurrentPasswordPreparedTransaction, PasswordPreparedJournalGuards, PasswordPreparedPostconditions } from "@yielded/auth-persistence/Adapter";
@@ -5,8 +6,8 @@ import { Cause, Effect, Layer } from "effect";
 import { LifecycleHooks, coordinateCommit, hasCommitScope } from "@yielded/auth/Hooks";
 import { PasswordUnavailable } from "@yielded/auth/Password";
 //#region src/drizzle/password-prepared-target.ts
-const makeTargetPasswordPreparedPersistenceServices = (database, mapping, configuration, proofMapping) => Effect.gen(function* () {
-	return { passwordPreparedPersistence: yield* makeSqlPasswordPreparedPersistence(database, mapping, passwordOptions(configuration, proofMapping)) };
+const makeTargetPasswordPreparedPersistenceServices = (mapping, configuration, proofMapping) => Effect.gen(function* () {
+	return { passwordPreparedPersistence: yield* makeSqlPasswordPreparedPersistence(mapping, passwordOptions(configuration, proofMapping)) };
 });
 const coordinateTargetPasswordPreparedPersistence = (database, mapping, configuration, proofMapping, owner) => Effect.gen(function* () {
 	const hooks = yield* LifecycleHooks;
@@ -17,7 +18,7 @@ const coordinateTargetPasswordPreparedPersistence = (database, mapping, configur
 		const postconditions = [];
 		let poisoned = false;
 		let acceptingPostconditions = true;
-		const services = yield* makeSqlPasswordPreparedPersistence(transaction, mapping, passwordOptions(configuration, proofMapping, true));
+		const services = yield* makeSqlPasswordPreparedPersistence(mapping, passwordOptions(configuration, proofMapping, true)).pipe(Effect.provideService(CurrentPasswordSql, transaction));
 		const protect = (effect) => effect.pipe(Effect.onError(() => Effect.sync(() => {
 			poisoned = true;
 		})));

package/dist/drizzle/password-prepared-target.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"password-prepared-target.mjs","names":[],"sources":["../../src/drizzle/password-prepared-target.ts"],"sourcesContent":["import {\n  CurrentPasswordPreparedTransaction,\n  PasswordPreparedPostconditions,\n  PasswordPreparedJournalGuards,\n  type PasswordPreparedPostcondition,\n} from \"@yielded/auth-persistence/Adapter\";\nimport {\n  coordinateCommit,\n  hasCommitScope,\n  type PreparedCommit,\n  LifecycleHooks,\n} from \"@yielded/auth/Hooks\";\nimport { PasswordUnavailable, type PasswordPreparedPersistence } from \"@yielded/auth/Password\";\n/* oxlint-disable no-explicit-any -- concrete driver modules restore native table/database types. */\nimport { type Context, Cause, Effect, Layer } from \"effect\";\nimport type * as SqlError from \"effect/unstable/sql/SqlError\";\n\nimport { makeSqlPasswordPreparedPersistence } from \"./password-prepared-sql\";\nimport type { PasswordSqlDatabase } from \"./password-sql\";\nimport {\n  passwordOptions,\n  type PasswordTargetConfiguration,\n  type PasswordCoordinatorError,\n} from \"./password-target\";\n\nexport const makeTargetPasswordPreparedPersistenceServices = (\n  database: any,\n  mapping: any,\n  configuration: PasswordTargetConfiguration,\n  proofMapping?: any,\n) =>\n  Effect.gen(function* () {\n    return {\n      passwordPreparedPersistence: yield* makeSqlPasswordPreparedPersistence(\n        database,\n        mapping,\n        passwordOptions(configuration, proofMapping),\n      ),\n    };\n  });\n\nexport const coordinateTargetPasswordPreparedPersistence = <Transaction, A, E, R>(\n  database: {\n    readonly transaction: <Out, Err, Env>(\n      body: (transaction: Transaction) => Effect.Effect<Out, Err, Env>,\n    ) => Effect.Effect<Out, Err | SqlError.SqlError, Env>;\n  },\n  mapping: any,\n  configuration: PasswordTargetConfiguration,\n  proofMapping: any | undefined,\n  owner: (\n    transaction: Transaction,\n    services: { readonly passwordPreparedPersistence: PasswordPreparedPersistence },\n  ) => Effect.Effect<A, E, R>,\n): Effect.Effect<A, PasswordCoordinatorError<E>, R | LifecycleHooks> =>\n  Effect.gen(function* () {\n    const hooks = yield* LifecycleHooks;\n\n    if (yield* hasCommitScope) return yield* PasswordUnavailable.make({});\n    yield* configuration.coordinatorGuard ?? configuration.standaloneGuard;\n\n    const result = yield* coordinateCommit(\n      () =>\n        database.transaction((transaction) =>\n          Effect.gen(function* () {\n            const guards: Array<PreparedCommit<void>> = [];\n            const postconditions: Array<PasswordPreparedPostcondition> = [];\n            let poisoned = false;\n            let acceptingPostconditions = true;\n\n            const services = yield* makeSqlPasswordPreparedPersistence(\n              transaction as unknown as PasswordSqlDatabase,\n              mapping,\n              passwordOptions(configuration, proofMapping, true),\n            );\n\n            const protect = <Out, Err, Env>(effect: Effect.Effect<Out, Err, Env>) =>\n              effect.pipe(\n                Effect.onError(() =>\n                  Effect.sync(() => {\n                    poisoned = true;\n                  }),\n                ),\n              );\n\n            const value = yield* owner(transaction, {\n              passwordPreparedPersistence: {\n                reserve: (input, prepare) => protect(services.reserve(input, prepare)),\n                publishReady: (input, prepare) => protect(services.publishReady(input, prepare)),\n                context: (input) => protect(services.context(input)),\n                complete: (input, prepare) => protect(services.complete(input, prepare)),\n                resetWithProof: (input, prepare) =>\n                  protect(services.resetWithProof(input, prepare)),\n                cancel: (input, prepare) => protect(services.cancel(input, prepare)),\n                cleanup: (input, prepare) => protect(services.cleanup(input, prepare)),\n              },\n            }).pipe(\n              Effect.provideService(PasswordPreparedJournalGuards, {\n                register: (guard) => {\n                  if (!acceptingPostconditions) return false;\n                  guards.push(guard);\n\n                  return true;\n                },\n              }),\n              Effect.provideService(PasswordPreparedPostconditions, {\n                register: (check) => {\n                  if (!acceptingPostconditions) return false;\n                  postconditions.push(check);\n\n                  return true;\n                },\n              }),\n              Effect.ensuring(\n                Effect.sync(() => {\n                  acceptingPostconditions = false;\n                }),\n              ),\n            );\n\n            if (poisoned) return yield* PasswordUnavailable.make({});\n            for (const guard of guards) {\n              const status = yield* Effect.result(guard.read);\n\n              if (status._tag === \"Success\" || status.failure._tag !== \"CommitPending\")\n                return yield* PasswordUnavailable.make({});\n            }\n\n            for (const check of postconditions)\n              yield* check.pipe(\n                Effect.provideService(\n                  CurrentPasswordPreparedTransaction,\n                  transaction as unknown as PasswordSqlDatabase,\n                ),\n                Effect.catchCause((cause) =>\n                  Effect.failCause(Cause.map(cause, () => PasswordUnavailable.make({}))),\n                ),\n              );\n\n            return value;\n          }),\n        ),\n      { mode: configuration.mode },\n    ).pipe(Effect.provideService(LifecycleHooks, hooks));\n\n    return result.value;\n  });\n\nexport const passwordPreparedPersistenceLayer = <Id>(\n  tag: Context.Key<Id, PasswordPreparedPersistence>,\n  services: Effect.Effect<\n    { readonly passwordPreparedPersistence: PasswordPreparedPersistence },\n    never,\n    LifecycleHooks\n  >,\n) =>\n  Layer.effect(\n    tag,\n    Effect.map(services, (value) => value.passwordPreparedPersistence),\n  );\n"],"mappings":";;;;;;;AAyBA,MAAa,iDACX,UACA,SACA,eACA,iBAEA,OAAO,IAAI,aAAa;CACtB,OAAO,EACL,6BAA6B,OAAO,mCAClC,UACA,SACA,gBAAgB,eAAe,YAAY,CAC7C,EACF;AACF,CAAC;AAEH,MAAa,+CACX,UAKA,SACA,eACA,cACA,UAKA,OAAO,IAAI,aAAa;CACtB,MAAM,QAAQ,OAAO;CAErB,IAAI,OAAO,gBAAgB,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;CACpE,OAAO,cAAc,oBAAoB,cAAc;CAsFvD,QAAO,OApFe,uBAElB,SAAS,aAAa,gBACpB,OAAO,IAAI,aAAa;EACtB,MAAM,SAAsC,CAAC;EAC7C,MAAM,iBAAuD,CAAC;EAC9D,IAAI,WAAW;EACf,IAAI,0BAA0B;EAE9B,MAAM,WAAW,OAAO,mCACtB,aACA,SACA,gBAAgB,eAAe,cAAc,IAAI,CACnD;EAEA,MAAM,WAA0B,WAC9B,OAAO,KACL,OAAO,cACL,OAAO,WAAW;GAChB,WAAW;EACb,CAAC,CACH,CACF;EAEF,MAAM,QAAQ,OAAO,MAAM,aAAa,EACtC,6BAA6B;GAC3B,UAAU,OAAO,YAAY,QAAQ,SAAS,QAAQ,OAAO,OAAO,CAAC;GACrE,eAAe,OAAO,YAAY,QAAQ,SAAS,aAAa,OAAO,OAAO,CAAC;GAC/E,UAAU,UAAU,QAAQ,SAAS,QAAQ,KAAK,CAAC;GACnD,WAAW,OAAO,YAAY,QAAQ,SAAS,SAAS,OAAO,OAAO,CAAC;GACvE,iBAAiB,OAAO,YACtB,QAAQ,SAAS,eAAe,OAAO,OAAO,CAAC;GACjD,SAAS,OAAO,YAAY,QAAQ,SAAS,OAAO,OAAO,OAAO,CAAC;GACnE,UAAU,OAAO,YAAY,QAAQ,SAAS,QAAQ,OAAO,OAAO,CAAC;EACvE,EACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,+BAA+B,EACnD,WAAW,UAAU;GACnB,IAAI,CAAC,yBAAyB,OAAO;GACrC,OAAO,KAAK,KAAK;GAEjB,OAAO;EACT,EACF,CAAC,GACD,OAAO,eAAe,gCAAgC,EACpD,WAAW,UAAU;GACnB,IAAI,CAAC,yBAAyB,OAAO;GACrC,eAAe,KAAK,KAAK;GAEzB,OAAO;EACT,EACF,CAAC,GACD,OAAO,SACL,OAAO,WAAW;GAChB,0BAA0B;EAC5B,CAAC,CACH,CACF;EAEA,IAAI,UAAU,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;EACvD,KAAK,MAAM,SAAS,QAAQ;GAC1B,MAAM,SAAS,OAAO,OAAO,OAAO,MAAM,IAAI;GAE9C,IAAI,OAAO,SAAS,aAAa,OAAO,QAAQ,SAAS,iBACvD,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;EAC7C;EAEA,KAAK,MAAM,SAAS,gBAClB,OAAO,MAAM,KACX,OAAO,eACL,oCACA,WACF,GACA,OAAO,YAAY,UACjB,OAAO,UAAU,MAAM,IAAI,aAAa,oBAAoB,KAAK,CAAC,CAAC,CAAC,CAAC,CACvE,CACF;EAEF,OAAO;CACT,CAAC,CACH,GACF,EAAE,MAAM,cAAc,KAAK,CAC7B,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC,EAAA,CAErC;AAChB,CAAC;AAEH,MAAa,oCACX,KACA,aAMA,MAAM,OACJ,KACA,OAAO,IAAI,WAAW,UAAU,MAAM,2BAA2B,CACnE"}
+{"version":3,"file":"password-prepared-target.mjs","names":[],"sources":["../../src/drizzle/password-prepared-target.ts"],"sourcesContent":["import {\n  CurrentPasswordPreparedTransaction,\n  PasswordPreparedPostconditions,\n  PasswordPreparedJournalGuards,\n  type PasswordPreparedPostcondition,\n} from \"@yielded/auth-persistence/Adapter\";\nimport {\n  coordinateCommit,\n  hasCommitScope,\n  type PreparedCommit,\n  LifecycleHooks,\n} from \"@yielded/auth/Hooks\";\nimport { PasswordUnavailable, type PasswordPreparedPersistence } from \"@yielded/auth/Password\";\n/* oxlint-disable no-explicit-any -- concrete driver modules restore native table/database types. */\nimport { type Context, Cause, Effect, Layer } from \"effect\";\nimport type * as SqlError from \"effect/sql/SqlError\";\n\nimport { makeSqlPasswordPreparedPersistence } from \"./password-prepared-sql\";\nimport { CurrentPasswordSql } from \"./password-sql\";\nimport type { PasswordSqlDatabase } from \"./password-sql\";\nimport {\n  passwordOptions,\n  type PasswordTargetConfiguration,\n  type PasswordCoordinatorError,\n} from \"./password-target\";\n\nexport const makeTargetPasswordPreparedPersistenceServices = (\n  mapping: any,\n  configuration: PasswordTargetConfiguration,\n  proofMapping?: any,\n) =>\n  Effect.gen(function* () {\n    return {\n      passwordPreparedPersistence: yield* makeSqlPasswordPreparedPersistence(\n        mapping,\n        passwordOptions(configuration, proofMapping),\n      ),\n    };\n  });\n\nexport const coordinateTargetPasswordPreparedPersistence = <Transaction, A, E, R>(\n  database: {\n    readonly transaction: <Out, Err, Env>(\n      body: (transaction: Transaction) => Effect.Effect<Out, Err, Env>,\n    ) => Effect.Effect<Out, Err | SqlError.SqlError, Env>;\n  },\n  mapping: any,\n  configuration: PasswordTargetConfiguration,\n  proofMapping: any | undefined,\n  owner: (\n    transaction: Transaction,\n    services: { readonly passwordPreparedPersistence: PasswordPreparedPersistence },\n  ) => Effect.Effect<A, E, R>,\n): Effect.Effect<A, PasswordCoordinatorError<E>, R | LifecycleHooks> =>\n  Effect.gen(function* () {\n    const hooks = yield* LifecycleHooks;\n\n    if (yield* hasCommitScope) return yield* PasswordUnavailable.make({});\n    yield* configuration.coordinatorGuard ?? configuration.standaloneGuard;\n\n    const result = yield* coordinateCommit(\n      () =>\n        database.transaction((transaction) =>\n          Effect.gen(function* () {\n            const guards: Array<PreparedCommit<void>> = [];\n            const postconditions: Array<PasswordPreparedPostcondition> = [];\n            let poisoned = false;\n            let acceptingPostconditions = true;\n\n            const services = yield* makeSqlPasswordPreparedPersistence(\n              mapping,\n              passwordOptions(configuration, proofMapping, true),\n            ).pipe(\n              Effect.provideService(\n                CurrentPasswordSql,\n                transaction as unknown as PasswordSqlDatabase,\n              ),\n            );\n\n            const protect = <Out, Err, Env>(effect: Effect.Effect<Out, Err, Env>) =>\n              effect.pipe(\n                Effect.onError(() =>\n                  Effect.sync(() => {\n                    poisoned = true;\n                  }),\n                ),\n              );\n\n            const value = yield* owner(transaction, {\n              passwordPreparedPersistence: {\n                reserve: (input, prepare) => protect(services.reserve(input, prepare)),\n                publishReady: (input, prepare) => protect(services.publishReady(input, prepare)),\n                context: (input) => protect(services.context(input)),\n                complete: (input, prepare) => protect(services.complete(input, prepare)),\n                resetWithProof: (input, prepare) =>\n                  protect(services.resetWithProof(input, prepare)),\n                cancel: (input, prepare) => protect(services.cancel(input, prepare)),\n                cleanup: (input, prepare) => protect(services.cleanup(input, prepare)),\n              },\n            }).pipe(\n              Effect.provideService(PasswordPreparedJournalGuards, {\n                register: (guard) => {\n                  if (!acceptingPostconditions) return false;\n                  guards.push(guard);\n\n                  return true;\n                },\n              }),\n              Effect.provideService(PasswordPreparedPostconditions, {\n                register: (check) => {\n                  if (!acceptingPostconditions) return false;\n                  postconditions.push(check);\n\n                  return true;\n                },\n              }),\n              Effect.ensuring(\n                Effect.sync(() => {\n                  acceptingPostconditions = false;\n                }),\n              ),\n            );\n\n            if (poisoned) return yield* PasswordUnavailable.make({});\n            for (const guard of guards) {\n              const status = yield* Effect.result(guard.read);\n\n              if (status._tag === \"Success\" || status.failure._tag !== \"CommitPending\")\n                return yield* PasswordUnavailable.make({});\n            }\n\n            for (const check of postconditions)\n              yield* check.pipe(\n                Effect.provideService(\n                  CurrentPasswordPreparedTransaction,\n                  transaction as unknown as PasswordSqlDatabase,\n                ),\n                Effect.catchCause((cause) =>\n                  Effect.failCause(Cause.map(cause, () => PasswordUnavailable.make({}))),\n                ),\n              );\n\n            return value;\n          }),\n        ),\n      { mode: configuration.mode },\n    ).pipe(Effect.provideService(LifecycleHooks, hooks));\n\n    return result.value;\n  });\n\nexport const passwordPreparedPersistenceLayer = <Id, E, R>(\n  tag: Context.Key<Id, PasswordPreparedPersistence>,\n  services: Effect.Effect<\n    { readonly passwordPreparedPersistence: PasswordPreparedPersistence },\n    E,\n    R\n  >,\n) =>\n  Layer.effect(\n    tag,\n    Effect.map(services, (value) => value.passwordPreparedPersistence),\n  );\n"],"mappings":";;;;;;;;AA0BA,MAAa,iDACX,SACA,eACA,iBAEA,OAAO,IAAI,aAAa;CACtB,OAAO,EACL,6BAA6B,OAAO,mCAClC,SACA,gBAAgB,eAAe,YAAY,CAC7C,EACF;AACF,CAAC;AAEH,MAAa,+CACX,UAKA,SACA,eACA,cACA,UAKA,OAAO,IAAI,aAAa;CACtB,MAAM,QAAQ,OAAO;CAErB,IAAI,OAAO,gBAAgB,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;CACpE,OAAO,cAAc,oBAAoB,cAAc;CA0FvD,QAAO,OAxFe,uBAElB,SAAS,aAAa,gBACpB,OAAO,IAAI,aAAa;EACtB,MAAM,SAAsC,CAAC;EAC7C,MAAM,iBAAuD,CAAC;EAC9D,IAAI,WAAW;EACf,IAAI,0BAA0B;EAE9B,MAAM,WAAW,OAAO,mCACtB,SACA,gBAAgB,eAAe,cAAc,IAAI,CACnD,CAAC,CAAC,KACA,OAAO,eACL,oBACA,WACF,CACF;EAEA,MAAM,WAA0B,WAC9B,OAAO,KACL,OAAO,cACL,OAAO,WAAW;GAChB,WAAW;EACb,CAAC,CACH,CACF;EAEF,MAAM,QAAQ,OAAO,MAAM,aAAa,EACtC,6BAA6B;GAC3B,UAAU,OAAO,YAAY,QAAQ,SAAS,QAAQ,OAAO,OAAO,CAAC;GACrE,eAAe,OAAO,YAAY,QAAQ,SAAS,aAAa,OAAO,OAAO,CAAC;GAC/E,UAAU,UAAU,QAAQ,SAAS,QAAQ,KAAK,CAAC;GACnD,WAAW,OAAO,YAAY,QAAQ,SAAS,SAAS,OAAO,OAAO,CAAC;GACvE,iBAAiB,OAAO,YACtB,QAAQ,SAAS,eAAe,OAAO,OAAO,CAAC;GACjD,SAAS,OAAO,YAAY,QAAQ,SAAS,OAAO,OAAO,OAAO,CAAC;GACnE,UAAU,OAAO,YAAY,QAAQ,SAAS,QAAQ,OAAO,OAAO,CAAC;EACvE,EACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,+BAA+B,EACnD,WAAW,UAAU;GACnB,IAAI,CAAC,yBAAyB,OAAO;GACrC,OAAO,KAAK,KAAK;GAEjB,OAAO;EACT,EACF,CAAC,GACD,OAAO,eAAe,gCAAgC,EACpD,WAAW,UAAU;GACnB,IAAI,CAAC,yBAAyB,OAAO;GACrC,eAAe,KAAK,KAAK;GAEzB,OAAO;EACT,EACF,CAAC,GACD,OAAO,SACL,OAAO,WAAW;GAChB,0BAA0B;EAC5B,CAAC,CACH,CACF;EAEA,IAAI,UAAU,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;EACvD,KAAK,MAAM,SAAS,QAAQ;GAC1B,MAAM,SAAS,OAAO,OAAO,OAAO,MAAM,IAAI;GAE9C,IAAI,OAAO,SAAS,aAAa,OAAO,QAAQ,SAAS,iBACvD,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;EAC7C;EAEA,KAAK,MAAM,SAAS,gBAClB,OAAO,MAAM,KACX,OAAO,eACL,oCACA,WACF,GACA,OAAO,YAAY,UACjB,OAAO,UAAU,MAAM,IAAI,aAAa,oBAAoB,KAAK,CAAC,CAAC,CAAC,CAAC,CACvE,CACF;EAEF,OAAO;CACT,CAAC,CACH,GACF,EAAE,MAAM,cAAc,KAAK,CAC7B,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC,EAAA,CAErC;AAChB,CAAC;AAEH,MAAa,oCACX,KACA,aAMA,MAAM,OACJ,KACA,OAAO,IAAI,WAAW,UAAU,MAAM,2BAA2B,CACnE"}

package/dist/drizzle/password-registration.mjs

@@ -95,7 +95,8 @@ const registerIn = Effect.fn("DrizzlePasswordRegistration.registerIn")(function*
 	}));
 	return receipt;
 });
-const makeSqlPasswordRegistrationAuthority = Effect.fn("makeSqlPasswordRegistrationAuthority")(function* (database, mapping, configuration) {
+const makeSqlPasswordRegistrationAuthority = Effect.fn("makeSqlPasswordRegistrationAuthority")(function* (mapping, configuration) {
+	const database = yield* CurrentPasswordSql;
 	const hooks = yield* LifecycleHooks;
 	return { register: (input, prepare) => Effect.gen(function* () {
 		if (!validConstraints(mapping)) return yield* unavailable();

package/dist/drizzle/password-registration.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"password-registration.mjs","names":[],"sources":["../../src/drizzle/password-registration.ts"],"sourcesContent":["import {\n  coordinateCommit,\n  CurrentCommitJournal,\n  hasCommitScope,\n  LifecycleHooks,\n  HookConfigurationError,\n} from \"@yielded/auth/Hooks\";\nimport type { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport {\n  PasswordUnavailable,\n  type PasswordReplacement,\n  type PasswordRegistrationDecision,\n  type PreparePasswordCommit,\n} from \"@yielded/auth/Password\";\nimport { reportPersistenceFailure } from \"@yielded/auth/Persistence\";\nimport { ProofUnavailable } from \"@yielded/auth/Proofs\";\n/* oxlint-disable no-explicit-any -- registration plans bridge consumer-owned Drizzle rows. */\nimport { and, eq } from \"drizzle-orm\";\nimport { Cause, Effect, Schema } from \"effect\";\n\nimport { column, isMappedConstraintConflict, PersistenceMappingError } from \"./model\";\nimport {\n  type AnyPasswordRegistrationMapping,\n  requiredPasswordRegistrationConstraints,\n} from \"./password-model\";\nimport {\n  CurrentPasswordSql,\n  type PasswordSqlDatabase,\n  type PasswordSqlQuery,\n} from \"./password-sql\";\nimport { CurrentProofSql, type ProofSqlDatabase } from \"./proof-sql\";\n\ntype Database = PasswordSqlDatabase;\ntype Mapping<Registration> = AnyPasswordRegistrationMapping<Registration>;\nconst unavailable = () => PasswordUnavailable.make({});\n\nconst translateFailure = <A, E, R>(\n  effect: Effect.Effect<A, E, R>,\n): Effect.Effect<A, PasswordUnavailable, R> =>\n  reportPersistenceFailure(\n    effect,\n    (error) =>\n      Schema.is(PasswordUnavailable)(error) ||\n      Schema.is(ProofUnavailable)(error) ||\n      Schema.is(HookConfigurationError)(error),\n  ).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));\n\nimport type { PasswordRegistrationAuthority } from \"@yielded/auth-persistence/Adapter\";\nexport type { PasswordRegistrationAuthority } from \"@yielded/auth-persistence/Adapter\";\n\nexport interface PasswordRegistrationConfiguration {\n  readonly mode: \"interactive\" | \"synchronous\";\n  readonly locking: boolean;\n  readonly standaloneGuard: Effect.Effect<void, PasswordUnavailable>;\n  readonly coordinated?: boolean;\n  readonly generatedSubjectRows: (query: PasswordSqlQuery) => PasswordSqlQuery;\n}\n\nconst validConstraints = <Registration>(mapping: Mapping<Registration>) =>\n  Object.entries(requiredPasswordRegistrationConstraints).every(\n    ([key, value]) =>\n      mapping.constraints[key as keyof typeof requiredPasswordRegistrationConstraints] === value,\n  );\n\nconst selectRows = (query: PasswordSqlQuery, locking: boolean) =>\n  locking && typeof query.for === \"function\" ? query.for(\"update\") : query;\n\nconst allocate = <A>(\n  mode: PasswordRegistrationConfiguration[\"mode\"],\n  asyncValue: Effect.Effect<A, PersistenceMappingError> | undefined,\n  syncValue: (() => A) | undefined,\n) => {\n  if (mode === \"synchronous\")\n    return syncValue === undefined\n      ? Effect.fail(unavailable())\n      : Effect.try({\n          try: syncValue,\n          catch: (cause) => new PersistenceMappingError({ operation: \"mapping\", cause }),\n        });\n  if (asyncValue !== undefined) return asyncValue;\n\n  return syncValue === undefined\n    ? Effect.fail(unavailable())\n    : Effect.try({\n        try: syncValue,\n        catch: (cause) => new PersistenceMappingError({ operation: \"mapping\", cause }),\n      });\n};\n\nconst registrationRows = Effect.fn(\"Drizzle.registrationRows\")(function* <Registration>(\n  mapping: Mapping<Registration>,\n  moduleId: string,\n  requestId: string,\n  locking: boolean,\n) {\n  const database = yield* CurrentPasswordSql;\n\n  const module = column(mapping.registration.table, mapping.registration.moduleId);\n  const request = column(mapping.registration.table, mapping.registration.requestId);\n\n  const query = database\n    .select()\n    .from(mapping.registration.table)\n    .where(and(eq(module, moduleId), eq(request, requestId)))\n    .limit(1);\n\n  return yield* selectRows(query, locking);\n});\n\nconst registerIn = Effect.fn(\"DrizzlePasswordRegistration.registerIn\")(function* <Registration, A>(\n  mapping: Mapping<Registration>,\n  configuration: PasswordRegistrationConfiguration,\n  input: {\n    readonly moduleId: string;\n    readonly requestId: string;\n    readonly identifier: LoginIdentifier;\n    readonly registration: Registration;\n    readonly replacement: PasswordReplacement;\n  },\n  allocated: {\n    readonly credentialId: string;\n    readonly securityRevision: any;\n    readonly identifierRevision: any;\n    readonly credentialRevision: any;\n    readonly verifierVersion: any;\n    readonly nativeSubjectId?: unknown;\n    readonly recoveryReference?: any;\n  },\n  prepare: PreparePasswordCommit<PasswordRegistrationDecision, A>,\n) {\n  const database = yield* CurrentPasswordSql;\n  const journal = yield* CurrentCommitJournal;\n\n  const existing = (yield* registrationRows(\n    mapping,\n    input.moduleId,\n    input.requestId,\n    configuration.locking,\n  ))[0];\n\n  if (existing !== undefined)\n    return prepare(yield* mapping.registration.decodeReplay(existing), journal);\n\n  const intent = {\n    moduleId: input.moduleId,\n    requestId: input.requestId,\n    identifier: input.identifier,\n    registration: input.registration,\n    replacement: input.replacement,\n  };\n\n  if (mapping.mode === \"pending\") {\n    if (allocated.recoveryReference === undefined) return yield* unavailable();\n    const receipt = prepare({ _tag: \"Pending\", reference: allocated.recoveryReference }, journal);\n\n    yield* database.insert(mapping.registration.table).values(\n      mapping.registration.encodeInsert(intent, {\n        state: \"pending\",\n        recoveryReference: allocated.recoveryReference,\n      }),\n    );\n\n    return receipt;\n  }\n  let nativeSubjectId = allocated.nativeSubjectId;\n\n  const subjectInsert = database.insert(mapping.subject.table).values(\n    mapping.provisioning.encodeSubjectInsert(intent, {\n      nativeSubjectId,\n      securityRevision: allocated.securityRevision,\n    }),\n  );\n\n  if (mapping.provisioning.idMode === \"generated\") {\n    const rows = yield* configuration.generatedSubjectRows(subjectInsert);\n\n    nativeSubjectId = yield* mapping.provisioning.decodeGeneratedId(rows);\n  } else yield* subjectInsert;\n  if (nativeSubjectId === undefined) return yield* unavailable();\n  const subjectId = yield* mapping.subjectId.toSubject(nativeSubjectId);\n  const receipt = prepare({ _tag: \"Created\", subjectId }, journal);\n\n  yield* database\n    .insert(mapping.identifier.table)\n    .values(\n      mapping.identifier.encodeInitialInsert(\n        input.identifier,\n        nativeSubjectId,\n        allocated.identifierRevision,\n      ),\n    );\n  yield* database.insert(mapping.credential.table).values(\n    mapping.credential.encodeInsert({\n      moduleId: input.moduleId,\n      subjectId: nativeSubjectId,\n      credentialId: allocated.credentialId,\n      credentialRevision: allocated.credentialRevision,\n      verifierVersion: allocated.verifierVersion,\n      replacement: input.replacement,\n    }),\n  );\n  yield* database.insert(mapping.authorityCredential.table).values(\n    mapping.authorityCredential.encodeInsert({\n      subjectId: nativeSubjectId,\n      credentialId: allocated.credentialId,\n      revision: allocated.credentialRevision,\n    }),\n  );\n  yield* database.insert(mapping.registration.table).values(\n    mapping.registration.encodeInsert(intent, {\n      state: \"created\",\n      nativeSubjectId,\n    }),\n  );\n\n  return receipt;\n});\n\nexport const makeSqlPasswordRegistrationAuthority = Effect.fn(\n  \"makeSqlPasswordRegistrationAuthority\",\n)(function* <Registration>(\n  database: Database,\n  mapping: Mapping<Registration>,\n  configuration: PasswordRegistrationConfiguration,\n): Effect.fn.Return<PasswordRegistrationAuthority<Registration>, never, LifecycleHooks> {\n  const hooks = yield* LifecycleHooks;\n\n  return {\n    register: (input, prepare) =>\n      Effect.gen(function* () {\n        if (!validConstraints(mapping)) return yield* unavailable();\n\n        const credentialId = yield* allocate(\n          configuration.mode,\n          mapping.allocateCredentialId,\n          mapping.allocateCredentialIdSync,\n        );\n\n        const securityRevision = yield* allocate(\n          configuration.mode,\n          mapping.allocateRevision,\n          mapping.allocateRevisionSync,\n        );\n\n        const credentialRevision = yield* allocate(\n          configuration.mode,\n          mapping.allocateRevision,\n          mapping.allocateRevisionSync,\n        );\n\n        const identifierRevision = yield* allocate(\n          configuration.mode,\n          mapping.allocateRevision,\n          mapping.allocateRevisionSync,\n        );\n\n        const verifierVersion = yield* allocate(\n          configuration.mode,\n          mapping.allocateRevision,\n          mapping.allocateRevisionSync,\n        );\n\n        const nativeSubjectId =\n          mapping.mode !== \"atomic\" || mapping.provisioning.idMode === \"generated\"\n            ? undefined\n            : yield* allocate(\n                configuration.mode,\n                mapping.provisioning.allocateSubjectId,\n                mapping.provisioning.allocateSubjectIdSync,\n              );\n\n        const recoveryReference =\n          mapping.mode === \"pending\"\n            ? yield* allocate(\n                configuration.mode,\n                mapping.allocateRecoveryReference,\n                mapping.allocateRecoveryReferenceSync,\n              )\n            : undefined;\n\n        const run = coordinateCommit(\n          () =>\n            database.transaction((transaction) =>\n              registerIn(\n                mapping,\n                configuration,\n                input,\n                {\n                  credentialId,\n                  securityRevision,\n                  identifierRevision,\n                  credentialRevision,\n                  verifierVersion,\n                  ...(nativeSubjectId === undefined ? {} : { nativeSubjectId }),\n                  ...(recoveryReference === undefined ? {} : { recoveryReference }),\n                },\n                prepare,\n              ).pipe(\n                Effect.provideService(CurrentPasswordSql, transaction),\n                Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),\n              ),\n            ),\n          { mode: configuration.mode },\n        ).pipe(Effect.map((result) => result.value));\n\n        const guarded =\n          configuration.coordinated !== true\n            ? Effect.gen(function* () {\n                if (yield* hasCommitScope) return yield* unavailable();\n                yield* configuration.standaloneGuard;\n\n                return yield* run;\n              })\n            : run;\n\n        return yield* guarded.pipe(\n          Effect.catchCause((cause) => {\n            if (\n              (cause.reasons.every(Cause.isFailReason) &&\n                isMappedConstraintConflict(mapping.isRequestConflict, cause)) ||\n              (cause.reasons.every(Cause.isFailReason) &&\n                isMappedConstraintConflict(mapping.isIdentifierConflict, cause)) ||\n              (cause.reasons.every(Cause.isFailReason) &&\n                isMappedConstraintConflict(mapping.isCredentialConflict, cause))\n            )\n              return coordinateCommit(\n                (journal) =>\n                  database.transaction((transaction) =>\n                    Effect.gen(function* () {\n                      const row = (yield* registrationRows(\n                        mapping,\n                        input.moduleId,\n                        input.requestId,\n                        configuration.locking,\n                      ))[0];\n\n                      const decision =\n                        row === undefined\n                          ? ({ _tag: \"Suppressed\" } as const)\n                          : yield* mapping.registration.decodeReplay(row);\n\n                      return prepare(decision, journal);\n                    }).pipe(\n                      Effect.provideService(CurrentPasswordSql, transaction),\n                      Effect.provideService(\n                        CurrentProofSql,\n                        transaction as unknown as ProofSqlDatabase,\n                      ),\n                    ),\n                  ),\n                { mode: configuration.mode },\n              ).pipe(Effect.map((result) => result.value));\n\n            return Effect.failCause(cause);\n          }),\n        );\n      }).pipe(\n        Effect.provideService(CurrentPasswordSql, database),\n        Effect.provideService(LifecycleHooks, hooks),\n        translateFailure,\n      ),\n  };\n});\n"],"mappings":";;;;;;;;;;;AAkCA,MAAM,oBAAoB,oBAAoB,KAAK,CAAC,CAAC;AAErD,MAAM,oBACJ,WAEA,yBACE,SACC,UACC,OAAO,GAAG,mBAAmB,CAAC,CAAC,KAAK,KACpC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,sBAAsB,CAAC,CAAC,KAAK,CAC3C,CAAC,CAAC,KAAK,OAAO,YAAY,UAAU,OAAO,UAAU,MAAM,IAAI,aAAa,YAAY,CAAC,CAAC,CAAC,CAAC;AAa9F,MAAM,oBAAkC,YACtC,OAAO,QAAQ,uCAAuC,CAAC,CAAC,OACrD,CAAC,KAAK,WACL,QAAQ,YAAY,SAAiE,KACzF;AAEF,MAAM,cAAc,OAAyB,YAC3C,WAAW,OAAO,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,IAAI;AAErE,MAAM,YACJ,MACA,YACA,cACG;CACH,IAAI,SAAS,eACX,OAAO,cAAc,KAAA,IACjB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;EACT,KAAK;EACL,QAAQ,UAAU,IAAI,wBAAwB;GAAE,WAAW;GAAW;EAAM,CAAC;CAC/E,CAAC;CACP,IAAI,eAAe,KAAA,GAAW,OAAO;CAErC,OAAO,cAAc,KAAA,IACjB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;EACT,KAAK;EACL,QAAQ,UAAU,IAAI,wBAAwB;GAAE,WAAW;GAAW;EAAM,CAAC;CAC/E,CAAC;AACP;AAEA,MAAM,mBAAmB,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,UACA,WACA,SACA;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,SAAS,OAAO,QAAQ,aAAa,OAAO,QAAQ,aAAa,QAAQ;CAC/E,MAAM,UAAU,OAAO,QAAQ,aAAa,OAAO,QAAQ,aAAa,SAAS;CAEjF,MAAM,QAAQ,SACX,OAAO,CAAC,CACR,KAAK,QAAQ,aAAa,KAAK,CAAC,CAChC,MAAM,IAAI,GAAG,QAAQ,QAAQ,GAAG,GAAG,SAAS,SAAS,CAAC,CAAC,CAAC,CACxD,MAAM,CAAC;CAEV,OAAO,OAAO,WAAW,OAAO,OAAO;AACzC,CAAC;AAED,MAAM,aAAa,OAAO,GAAG,wCAAwC,CAAC,CAAC,WACrE,SACA,eACA,OAOA,WASA,SACA;CACA,MAAM,WAAW,OAAO;CACxB,MAAM,UAAU,OAAO;CAEvB,MAAM,YAAY,OAAO,iBACvB,SACA,MAAM,UACN,MAAM,WACN,cAAc,OAChB,EAAA,CAAG;CAEH,IAAI,aAAa,KAAA,GACf,OAAO,QAAQ,OAAO,QAAQ,aAAa,aAAa,QAAQ,GAAG,OAAO;CAE5E,MAAM,SAAS;EACb,UAAU,MAAM;EAChB,WAAW,MAAM;EACjB,YAAY,MAAM;EAClB,cAAc,MAAM;EACpB,aAAa,MAAM;CACrB;CAEA,IAAI,QAAQ,SAAS,WAAW;EAC9B,IAAI,UAAU,sBAAsB,KAAA,GAAW,OAAO,OAAO,YAAY;EACzE,MAAM,UAAU,QAAQ;GAAE,MAAM;GAAW,WAAW,UAAU;EAAkB,GAAG,OAAO;EAE5F,OAAO,SAAS,OAAO,QAAQ,aAAa,KAAK,CAAC,CAAC,OACjD,QAAQ,aAAa,aAAa,QAAQ;GACxC,OAAO;GACP,mBAAmB,UAAU;EAC/B,CAAC,CACH;EAEA,OAAO;CACT;CACA,IAAI,kBAAkB,UAAU;CAEhC,MAAM,gBAAgB,SAAS,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,OAC3D,QAAQ,aAAa,oBAAoB,QAAQ;EAC/C;EACA,kBAAkB,UAAU;CAC9B,CAAC,CACH;CAEA,IAAI,QAAQ,aAAa,WAAW,aAAa;EAC/C,MAAM,OAAO,OAAO,cAAc,qBAAqB,aAAa;EAEpE,kBAAkB,OAAO,QAAQ,aAAa,kBAAkB,IAAI;CACtE,OAAO,OAAO;CACd,IAAI,oBAAoB,KAAA,GAAW,OAAO,OAAO,YAAY;CAE7D,MAAM,UAAU,QAAQ;EAAE,MAAM;EAAW,WAAA,OADlB,QAAQ,UAAU,UAAU,eAAe;CACf,GAAG,OAAO;CAE/D,OAAO,SACJ,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,OACC,QAAQ,WAAW,oBACjB,MAAM,YACN,iBACA,UAAU,kBACZ,CACF;CACF,OAAO,SAAS,OAAO,QAAQ,WAAW,KAAK,CAAC,CAAC,OAC/C,QAAQ,WAAW,aAAa;EAC9B,UAAU,MAAM;EAChB,WAAW;EACX,cAAc,UAAU;EACxB,oBAAoB,UAAU;EAC9B,iBAAiB,UAAU;EAC3B,aAAa,MAAM;CACrB,CAAC,CACH;CACA,OAAO,SAAS,OAAO,QAAQ,oBAAoB,KAAK,CAAC,CAAC,OACxD,QAAQ,oBAAoB,aAAa;EACvC,WAAW;EACX,cAAc,UAAU;EACxB,UAAU,UAAU;CACtB,CAAC,CACH;CACA,OAAO,SAAS,OAAO,QAAQ,aAAa,KAAK,CAAC,CAAC,OACjD,QAAQ,aAAa,aAAa,QAAQ;EACxC,OAAO;EACP;CACF,CAAC,CACH;CAEA,OAAO;AACT,CAAC;AAED,MAAa,uCAAuC,OAAO,GACzD,sCACF,CAAC,CAAC,WACA,UACA,SACA,eACsF;CACtF,MAAM,QAAQ,OAAO;CAErB,OAAO,EACL,WAAW,OAAO,YAChB,OAAO,IAAI,aAAa;EACtB,IAAI,CAAC,iBAAiB,OAAO,GAAG,OAAO,OAAO,YAAY;EAE1D,MAAM,eAAe,OAAO,SAC1B,cAAc,MACd,QAAQ,sBACR,QAAQ,wBACV;EAEA,MAAM,mBAAmB,OAAO,SAC9B,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;EAEA,MAAM,qBAAqB,OAAO,SAChC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;EAEA,MAAM,qBAAqB,OAAO,SAChC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;EAEA,MAAM,kBAAkB,OAAO,SAC7B,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;EAEA,MAAM,kBACJ,QAAQ,SAAS,YAAY,QAAQ,aAAa,WAAW,cACzD,KAAA,IACA,OAAO,SACL,cAAc,MACd,QAAQ,aAAa,mBACrB,QAAQ,aAAa,qBACvB;EAEN,MAAM,oBACJ,QAAQ,SAAS,YACb,OAAO,SACL,cAAc,MACd,QAAQ,2BACR,QAAQ,6BACV,IACA,KAAA;EAEN,MAAM,MAAM,uBAER,SAAS,aAAa,gBACpB,WACE,SACA,eACA,OACA;GACE;GACA;GACA;GACA;GACA;GACA,GAAI,oBAAoB,KAAA,IAAY,CAAC,IAAI,EAAE,gBAAgB;GAC3D,GAAI,sBAAsB,KAAA,IAAY,CAAC,IAAI,EAAE,kBAAkB;EACjE,GACA,OACF,CAAC,CAAC,KACA,OAAO,eAAe,oBAAoB,WAAW,GACrD,OAAO,eAAe,iBAAiB,WAA0C,CACnF,CACF,GACF,EAAE,MAAM,cAAc,KAAK,CAC7B,CAAC,CAAC,KAAK,OAAO,KAAK,WAAW,OAAO,KAAK,CAAC;EAY3C,OAAO,QATL,cAAc,gBAAgB,OAC1B,OAAO,IAAI,aAAa;GACtB,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;GACrD,OAAO,cAAc;GAErB,OAAO,OAAO;EAChB,CAAC,IACD,IAAA,CAEgB,KACpB,OAAO,YAAY,UAAU;GAC3B,IACG,MAAM,QAAQ,MAAM,MAAM,YAAY,KACrC,2BAA2B,QAAQ,mBAAmB,KAAK,KAC5D,MAAM,QAAQ,MAAM,MAAM,YAAY,KACrC,2BAA2B,QAAQ,sBAAsB,KAAK,KAC/D,MAAM,QAAQ,MAAM,MAAM,YAAY,KACrC,2BAA2B,QAAQ,sBAAsB,KAAK,GAEhE,OAAO,kBACJ,YACC,SAAS,aAAa,gBACpB,OAAO,IAAI,aAAa;IACtB,MAAM,OAAO,OAAO,iBAClB,SACA,MAAM,UACN,MAAM,WACN,cAAc,OAChB,EAAA,CAAG;IAOH,OAAO,QAJL,QAAQ,KAAA,IACH,EAAE,MAAM,aAAa,IACtB,OAAO,QAAQ,aAAa,aAAa,GAAG,GAEzB,OAAO;GAClC,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,WAAW,GACrD,OAAO,eACL,iBACA,WACF,CACF,CACF,GACF,EAAE,MAAM,cAAc,KAAK,CAC7B,CAAC,CAAC,KAAK,OAAO,KAAK,WAAW,OAAO,KAAK,CAAC;GAE7C,OAAO,OAAO,UAAU,KAAK;EAC/B,CAAC,CACH;CACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF,EACJ;AACF,CAAC"}
+{"version":3,"file":"password-registration.mjs","names":[],"sources":["../../src/drizzle/password-registration.ts"],"sourcesContent":["import {\n  coordinateCommit,\n  CurrentCommitJournal,\n  hasCommitScope,\n  LifecycleHooks,\n  HookConfigurationError,\n} from \"@yielded/auth/Hooks\";\nimport type { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport {\n  PasswordUnavailable,\n  type PasswordReplacement,\n  type PasswordRegistrationDecision,\n  type PreparePasswordCommit,\n} from \"@yielded/auth/Password\";\nimport { reportPersistenceFailure } from \"@yielded/auth/Persistence\";\nimport { ProofUnavailable } from \"@yielded/auth/Proofs\";\n/* oxlint-disable no-explicit-any -- registration plans bridge consumer-owned Drizzle rows. */\nimport { and, eq } from \"drizzle-orm\";\nimport { Cause, Effect, Schema } from \"effect\";\n\nimport { column, isMappedConstraintConflict, PersistenceMappingError } from \"./model\";\nimport {\n  type AnyPasswordRegistrationMapping,\n  requiredPasswordRegistrationConstraints,\n} from \"./password-model\";\nimport { CurrentPasswordSql, type PasswordSqlQuery } from \"./password-sql\";\nimport { CurrentProofSql, type ProofSqlDatabase } from \"./proof-sql\";\n\ntype Mapping<Registration> = AnyPasswordRegistrationMapping<Registration>;\nconst unavailable = () => PasswordUnavailable.make({});\n\nconst translateFailure = <A, E, R>(\n  effect: Effect.Effect<A, E, R>,\n): Effect.Effect<A, PasswordUnavailable, R> =>\n  reportPersistenceFailure(\n    effect,\n    (error) =>\n      Schema.is(PasswordUnavailable)(error) ||\n      Schema.is(ProofUnavailable)(error) ||\n      Schema.is(HookConfigurationError)(error),\n  ).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));\n\nimport type { PasswordRegistrationAuthority } from \"@yielded/auth-persistence/Adapter\";\nexport type { PasswordRegistrationAuthority } from \"@yielded/auth-persistence/Adapter\";\n\nexport interface PasswordRegistrationConfiguration {\n  readonly mode: \"interactive\" | \"synchronous\";\n  readonly locking: boolean;\n  readonly standaloneGuard: Effect.Effect<void, PasswordUnavailable>;\n  readonly coordinated?: boolean;\n  readonly generatedSubjectRows: (query: PasswordSqlQuery) => PasswordSqlQuery;\n}\n\nconst validConstraints = <Registration>(mapping: Mapping<Registration>) =>\n  Object.entries(requiredPasswordRegistrationConstraints).every(\n    ([key, value]) =>\n      mapping.constraints[key as keyof typeof requiredPasswordRegistrationConstraints] === value,\n  );\n\nconst selectRows = (query: PasswordSqlQuery, locking: boolean) =>\n  locking && typeof query.for === \"function\" ? query.for(\"update\") : query;\n\nconst allocate = <A>(\n  mode: PasswordRegistrationConfiguration[\"mode\"],\n  asyncValue: Effect.Effect<A, PersistenceMappingError> | undefined,\n  syncValue: (() => A) | undefined,\n) => {\n  if (mode === \"synchronous\")\n    return syncValue === undefined\n      ? Effect.fail(unavailable())\n      : Effect.try({\n          try: syncValue,\n          catch: (cause) => new PersistenceMappingError({ operation: \"mapping\", cause }),\n        });\n  if (asyncValue !== undefined) return asyncValue;\n\n  return syncValue === undefined\n    ? Effect.fail(unavailable())\n    : Effect.try({\n        try: syncValue,\n        catch: (cause) => new PersistenceMappingError({ operation: \"mapping\", cause }),\n      });\n};\n\nconst registrationRows = Effect.fn(\"Drizzle.registrationRows\")(function* <Registration>(\n  mapping: Mapping<Registration>,\n  moduleId: string,\n  requestId: string,\n  locking: boolean,\n) {\n  const database = yield* CurrentPasswordSql;\n\n  const module = column(mapping.registration.table, mapping.registration.moduleId);\n  const request = column(mapping.registration.table, mapping.registration.requestId);\n\n  const query = database\n    .select()\n    .from(mapping.registration.table)\n    .where(and(eq(module, moduleId), eq(request, requestId)))\n    .limit(1);\n\n  return yield* selectRows(query, locking);\n});\n\nconst registerIn = Effect.fn(\"DrizzlePasswordRegistration.registerIn\")(function* <Registration, A>(\n  mapping: Mapping<Registration>,\n  configuration: PasswordRegistrationConfiguration,\n  input: {\n    readonly moduleId: string;\n    readonly requestId: string;\n    readonly identifier: LoginIdentifier;\n    readonly registration: Registration;\n    readonly replacement: PasswordReplacement;\n  },\n  allocated: {\n    readonly credentialId: string;\n    readonly securityRevision: any;\n    readonly identifierRevision: any;\n    readonly credentialRevision: any;\n    readonly verifierVersion: any;\n    readonly nativeSubjectId?: unknown;\n    readonly recoveryReference?: any;\n  },\n  prepare: PreparePasswordCommit<PasswordRegistrationDecision, A>,\n) {\n  const database = yield* CurrentPasswordSql;\n  const journal = yield* CurrentCommitJournal;\n\n  const existing = (yield* registrationRows(\n    mapping,\n    input.moduleId,\n    input.requestId,\n    configuration.locking,\n  ))[0];\n\n  if (existing !== undefined)\n    return prepare(yield* mapping.registration.decodeReplay(existing), journal);\n\n  const intent = {\n    moduleId: input.moduleId,\n    requestId: input.requestId,\n    identifier: input.identifier,\n    registration: input.registration,\n    replacement: input.replacement,\n  };\n\n  if (mapping.mode === \"pending\") {\n    if (allocated.recoveryReference === undefined) return yield* unavailable();\n    const receipt = prepare({ _tag: \"Pending\", reference: allocated.recoveryReference }, journal);\n\n    yield* database.insert(mapping.registration.table).values(\n      mapping.registration.encodeInsert(intent, {\n        state: \"pending\",\n        recoveryReference: allocated.recoveryReference,\n      }),\n    );\n\n    return receipt;\n  }\n  let nativeSubjectId = allocated.nativeSubjectId;\n\n  const subjectInsert = database.insert(mapping.subject.table).values(\n    mapping.provisioning.encodeSubjectInsert(intent, {\n      nativeSubjectId,\n      securityRevision: allocated.securityRevision,\n    }),\n  );\n\n  if (mapping.provisioning.idMode === \"generated\") {\n    const rows = yield* configuration.generatedSubjectRows(subjectInsert);\n\n    nativeSubjectId = yield* mapping.provisioning.decodeGeneratedId(rows);\n  } else yield* subjectInsert;\n  if (nativeSubjectId === undefined) return yield* unavailable();\n  const subjectId = yield* mapping.subjectId.toSubject(nativeSubjectId);\n  const receipt = prepare({ _tag: \"Created\", subjectId }, journal);\n\n  yield* database\n    .insert(mapping.identifier.table)\n    .values(\n      mapping.identifier.encodeInitialInsert(\n        input.identifier,\n        nativeSubjectId,\n        allocated.identifierRevision,\n      ),\n    );\n  yield* database.insert(mapping.credential.table).values(\n    mapping.credential.encodeInsert({\n      moduleId: input.moduleId,\n      subjectId: nativeSubjectId,\n      credentialId: allocated.credentialId,\n      credentialRevision: allocated.credentialRevision,\n      verifierVersion: allocated.verifierVersion,\n      replacement: input.replacement,\n    }),\n  );\n  yield* database.insert(mapping.authorityCredential.table).values(\n    mapping.authorityCredential.encodeInsert({\n      subjectId: nativeSubjectId,\n      credentialId: allocated.credentialId,\n      revision: allocated.credentialRevision,\n    }),\n  );\n  yield* database.insert(mapping.registration.table).values(\n    mapping.registration.encodeInsert(intent, {\n      state: \"created\",\n      nativeSubjectId,\n    }),\n  );\n\n  return receipt;\n});\n\nexport const makeSqlPasswordRegistrationAuthority = Effect.fn(\n  \"makeSqlPasswordRegistrationAuthority\",\n)(function* <Registration>(\n  mapping: Mapping<Registration>,\n  configuration: PasswordRegistrationConfiguration,\n): Effect.fn.Return<\n  PasswordRegistrationAuthority<Registration>,\n  never,\n  LifecycleHooks | CurrentPasswordSql\n> {\n  const database = yield* CurrentPasswordSql;\n  const hooks = yield* LifecycleHooks;\n\n  return {\n    register: (input, prepare) =>\n      Effect.gen(function* () {\n        if (!validConstraints(mapping)) return yield* unavailable();\n\n        const credentialId = yield* allocate(\n          configuration.mode,\n          mapping.allocateCredentialId,\n          mapping.allocateCredentialIdSync,\n        );\n\n        const securityRevision = yield* allocate(\n          configuration.mode,\n          mapping.allocateRevision,\n          mapping.allocateRevisionSync,\n        );\n\n        const credentialRevision = yield* allocate(\n          configuration.mode,\n          mapping.allocateRevision,\n          mapping.allocateRevisionSync,\n        );\n\n        const identifierRevision = yield* allocate(\n          configuration.mode,\n          mapping.allocateRevision,\n          mapping.allocateRevisionSync,\n        );\n\n        const verifierVersion = yield* allocate(\n          configuration.mode,\n          mapping.allocateRevision,\n          mapping.allocateRevisionSync,\n        );\n\n        const nativeSubjectId =\n          mapping.mode !== \"atomic\" || mapping.provisioning.idMode === \"generated\"\n            ? undefined\n            : yield* allocate(\n                configuration.mode,\n                mapping.provisioning.allocateSubjectId,\n                mapping.provisioning.allocateSubjectIdSync,\n              );\n\n        const recoveryReference =\n          mapping.mode === \"pending\"\n            ? yield* allocate(\n                configuration.mode,\n                mapping.allocateRecoveryReference,\n                mapping.allocateRecoveryReferenceSync,\n              )\n            : undefined;\n\n        const run = coordinateCommit(\n          () =>\n            database.transaction((transaction) =>\n              registerIn(\n                mapping,\n                configuration,\n                input,\n                {\n                  credentialId,\n                  securityRevision,\n                  identifierRevision,\n                  credentialRevision,\n                  verifierVersion,\n                  ...(nativeSubjectId === undefined ? {} : { nativeSubjectId }),\n                  ...(recoveryReference === undefined ? {} : { recoveryReference }),\n                },\n                prepare,\n              ).pipe(\n                Effect.provideService(CurrentPasswordSql, transaction),\n                Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),\n              ),\n            ),\n          { mode: configuration.mode },\n        ).pipe(Effect.map((result) => result.value));\n\n        const guarded =\n          configuration.coordinated !== true\n            ? Effect.gen(function* () {\n                if (yield* hasCommitScope) return yield* unavailable();\n                yield* configuration.standaloneGuard;\n\n                return yield* run;\n              })\n            : run;\n\n        return yield* guarded.pipe(\n          Effect.catchCause((cause) => {\n            if (\n              (cause.reasons.every(Cause.isFailReason) &&\n                isMappedConstraintConflict(mapping.isRequestConflict, cause)) ||\n              (cause.reasons.every(Cause.isFailReason) &&\n                isMappedConstraintConflict(mapping.isIdentifierConflict, cause)) ||\n              (cause.reasons.every(Cause.isFailReason) &&\n                isMappedConstraintConflict(mapping.isCredentialConflict, cause))\n            )\n              return coordinateCommit(\n                (journal) =>\n                  database.transaction((transaction) =>\n                    Effect.gen(function* () {\n                      const row = (yield* registrationRows(\n                        mapping,\n                        input.moduleId,\n                        input.requestId,\n                        configuration.locking,\n                      ))[0];\n\n                      const decision =\n                        row === undefined\n                          ? ({ _tag: \"Suppressed\" } as const)\n                          : yield* mapping.registration.decodeReplay(row);\n\n                      return prepare(decision, journal);\n                    }).pipe(\n                      Effect.provideService(CurrentPasswordSql, transaction),\n                      Effect.provideService(\n                        CurrentProofSql,\n                        transaction as unknown as ProofSqlDatabase,\n                      ),\n                    ),\n                  ),\n                { mode: configuration.mode },\n              ).pipe(Effect.map((result) => result.value));\n\n            return Effect.failCause(cause);\n          }),\n        );\n      }).pipe(\n        Effect.provideService(CurrentPasswordSql, database),\n        Effect.provideService(LifecycleHooks, hooks),\n        translateFailure,\n      ),\n  };\n});\n"],"mappings":";;;;;;;;;;;AA6BA,MAAM,oBAAoB,oBAAoB,KAAK,CAAC,CAAC;AAErD,MAAM,oBACJ,WAEA,yBACE,SACC,UACC,OAAO,GAAG,mBAAmB,CAAC,CAAC,KAAK,KACpC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,sBAAsB,CAAC,CAAC,KAAK,CAC3C,CAAC,CAAC,KAAK,OAAO,YAAY,UAAU,OAAO,UAAU,MAAM,IAAI,aAAa,YAAY,CAAC,CAAC,CAAC,CAAC;AAa9F,MAAM,oBAAkC,YACtC,OAAO,QAAQ,uCAAuC,CAAC,CAAC,OACrD,CAAC,KAAK,WACL,QAAQ,YAAY,SAAiE,KACzF;AAEF,MAAM,cAAc,OAAyB,YAC3C,WAAW,OAAO,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,IAAI;AAErE,MAAM,YACJ,MACA,YACA,cACG;CACH,IAAI,SAAS,eACX,OAAO,cAAc,KAAA,IACjB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;EACT,KAAK;EACL,QAAQ,UAAU,IAAI,wBAAwB;GAAE,WAAW;GAAW;EAAM,CAAC;CAC/E,CAAC;CACP,IAAI,eAAe,KAAA,GAAW,OAAO;CAErC,OAAO,cAAc,KAAA,IACjB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;EACT,KAAK;EACL,QAAQ,UAAU,IAAI,wBAAwB;GAAE,WAAW;GAAW;EAAM,CAAC;CAC/E,CAAC;AACP;AAEA,MAAM,mBAAmB,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,UACA,WACA,SACA;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,SAAS,OAAO,QAAQ,aAAa,OAAO,QAAQ,aAAa,QAAQ;CAC/E,MAAM,UAAU,OAAO,QAAQ,aAAa,OAAO,QAAQ,aAAa,SAAS;CAEjF,MAAM,QAAQ,SACX,OAAO,CAAC,CACR,KAAK,QAAQ,aAAa,KAAK,CAAC,CAChC,MAAM,IAAI,GAAG,QAAQ,QAAQ,GAAG,GAAG,SAAS,SAAS,CAAC,CAAC,CAAC,CACxD,MAAM,CAAC;CAEV,OAAO,OAAO,WAAW,OAAO,OAAO;AACzC,CAAC;AAED,MAAM,aAAa,OAAO,GAAG,wCAAwC,CAAC,CAAC,WACrE,SACA,eACA,OAOA,WASA,SACA;CACA,MAAM,WAAW,OAAO;CACxB,MAAM,UAAU,OAAO;CAEvB,MAAM,YAAY,OAAO,iBACvB,SACA,MAAM,UACN,MAAM,WACN,cAAc,OAChB,EAAA,CAAG;CAEH,IAAI,aAAa,KAAA,GACf,OAAO,QAAQ,OAAO,QAAQ,aAAa,aAAa,QAAQ,GAAG,OAAO;CAE5E,MAAM,SAAS;EACb,UAAU,MAAM;EAChB,WAAW,MAAM;EACjB,YAAY,MAAM;EAClB,cAAc,MAAM;EACpB,aAAa,MAAM;CACrB;CAEA,IAAI,QAAQ,SAAS,WAAW;EAC9B,IAAI,UAAU,sBAAsB,KAAA,GAAW,OAAO,OAAO,YAAY;EACzE,MAAM,UAAU,QAAQ;GAAE,MAAM;GAAW,WAAW,UAAU;EAAkB,GAAG,OAAO;EAE5F,OAAO,SAAS,OAAO,QAAQ,aAAa,KAAK,CAAC,CAAC,OACjD,QAAQ,aAAa,aAAa,QAAQ;GACxC,OAAO;GACP,mBAAmB,UAAU;EAC/B,CAAC,CACH;EAEA,OAAO;CACT;CACA,IAAI,kBAAkB,UAAU;CAEhC,MAAM,gBAAgB,SAAS,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,OAC3D,QAAQ,aAAa,oBAAoB,QAAQ;EAC/C;EACA,kBAAkB,UAAU;CAC9B,CAAC,CACH;CAEA,IAAI,QAAQ,aAAa,WAAW,aAAa;EAC/C,MAAM,OAAO,OAAO,cAAc,qBAAqB,aAAa;EAEpE,kBAAkB,OAAO,QAAQ,aAAa,kBAAkB,IAAI;CACtE,OAAO,OAAO;CACd,IAAI,oBAAoB,KAAA,GAAW,OAAO,OAAO,YAAY;CAE7D,MAAM,UAAU,QAAQ;EAAE,MAAM;EAAW,WAAA,OADlB,QAAQ,UAAU,UAAU,eAAe;CACf,GAAG,OAAO;CAE/D,OAAO,SACJ,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,OACC,QAAQ,WAAW,oBACjB,MAAM,YACN,iBACA,UAAU,kBACZ,CACF;CACF,OAAO,SAAS,OAAO,QAAQ,WAAW,KAAK,CAAC,CAAC,OAC/C,QAAQ,WAAW,aAAa;EAC9B,UAAU,MAAM;EAChB,WAAW;EACX,cAAc,UAAU;EACxB,oBAAoB,UAAU;EAC9B,iBAAiB,UAAU;EAC3B,aAAa,MAAM;CACrB,CAAC,CACH;CACA,OAAO,SAAS,OAAO,QAAQ,oBAAoB,KAAK,CAAC,CAAC,OACxD,QAAQ,oBAAoB,aAAa;EACvC,WAAW;EACX,cAAc,UAAU;EACxB,UAAU,UAAU;CACtB,CAAC,CACH;CACA,OAAO,SAAS,OAAO,QAAQ,aAAa,KAAK,CAAC,CAAC,OACjD,QAAQ,aAAa,aAAa,QAAQ;EACxC,OAAO;EACP;CACF,CAAC,CACH;CAEA,OAAO;AACT,CAAC;AAED,MAAa,uCAAuC,OAAO,GACzD,sCACF,CAAC,CAAC,WACA,SACA,eAKA;CACA,MAAM,WAAW,OAAO;CACxB,MAAM,QAAQ,OAAO;CAErB,OAAO,EACL,WAAW,OAAO,YAChB,OAAO,IAAI,aAAa;EACtB,IAAI,CAAC,iBAAiB,OAAO,GAAG,OAAO,OAAO,YAAY;EAE1D,MAAM,eAAe,OAAO,SAC1B,cAAc,MACd,QAAQ,sBACR,QAAQ,wBACV;EAEA,MAAM,mBAAmB,OAAO,SAC9B,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;EAEA,MAAM,qBAAqB,OAAO,SAChC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;EAEA,MAAM,qBAAqB,OAAO,SAChC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;EAEA,MAAM,kBAAkB,OAAO,SAC7B,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;EAEA,MAAM,kBACJ,QAAQ,SAAS,YAAY,QAAQ,aAAa,WAAW,cACzD,KAAA,IACA,OAAO,SACL,cAAc,MACd,QAAQ,aAAa,mBACrB,QAAQ,aAAa,qBACvB;EAEN,MAAM,oBACJ,QAAQ,SAAS,YACb,OAAO,SACL,cAAc,MACd,QAAQ,2BACR,QAAQ,6BACV,IACA,KAAA;EAEN,MAAM,MAAM,uBAER,SAAS,aAAa,gBACpB,WACE,SACA,eACA,OACA;GACE;GACA;GACA;GACA;GACA;GACA,GAAI,oBAAoB,KAAA,IAAY,CAAC,IAAI,EAAE,gBAAgB;GAC3D,GAAI,sBAAsB,KAAA,IAAY,CAAC,IAAI,EAAE,kBAAkB;EACjE,GACA,OACF,CAAC,CAAC,KACA,OAAO,eAAe,oBAAoB,WAAW,GACrD,OAAO,eAAe,iBAAiB,WAA0C,CACnF,CACF,GACF,EAAE,MAAM,cAAc,KAAK,CAC7B,CAAC,CAAC,KAAK,OAAO,KAAK,WAAW,OAAO,KAAK,CAAC;EAY3C,OAAO,QATL,cAAc,gBAAgB,OAC1B,OAAO,IAAI,aAAa;GACtB,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;GACrD,OAAO,cAAc;GAErB,OAAO,OAAO;EAChB,CAAC,IACD,IAAA,CAEgB,KACpB,OAAO,YAAY,UAAU;GAC3B,IACG,MAAM,QAAQ,MAAM,MAAM,YAAY,KACrC,2BAA2B,QAAQ,mBAAmB,KAAK,KAC5D,MAAM,QAAQ,MAAM,MAAM,YAAY,KACrC,2BAA2B,QAAQ,sBAAsB,KAAK,KAC/D,MAAM,QAAQ,MAAM,MAAM,YAAY,KACrC,2BAA2B,QAAQ,sBAAsB,KAAK,GAEhE,OAAO,kBACJ,YACC,SAAS,aAAa,gBACpB,OAAO,IAAI,aAAa;IACtB,MAAM,OAAO,OAAO,iBAClB,SACA,MAAM,UACN,MAAM,WACN,cAAc,OAChB,EAAA,CAAG;IAOH,OAAO,QAJL,QAAQ,KAAA,IACH,EAAE,MAAM,aAAa,IACtB,OAAO,QAAQ,aAAa,aAAa,GAAG,GAEzB,OAAO;GAClC,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,WAAW,GACrD,OAAO,eACL,iBACA,WACF,CACF,CACF,GACF,EAAE,MAAM,cAAc,KAAK,CAC7B,CAAC,CAAC,KAAK,OAAO,KAAK,WAAW,OAAO,KAAK,CAAC;GAE7C,OAAO,OAAO,UAAU,KAAK;EAC/B,CAAC,CACH;CACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF,EACJ;AACF,CAAC"}

package/dist/drizzle/password-target.d.mts

@@ -1,16 +1,17 @@
+import "./standalone-guard.mjs";
 import "./proof-target.mjs";
 import "./password-sql.mjs";
 import { PasswordRegistrationAuthority } from "./password-registration.mjs";
 import { Context, Effect, Layer } from "effect";
 import { HookConfigurationError, LifecycleHooks } from "@yielded/auth/Hooks";
 import { PasswordPersistence, PasswordUnavailable } from "@yielded/auth/Password";
-import "effect/unstable/sql/SqlError";
+import "effect/sql/SqlError";
 //#region src/drizzle/password-target.d.ts
-export declare const passwordPersistenceLayer: (services: Effect.Effect<{
+export declare const passwordPersistenceLayer: <E, R>(services: Effect.Effect<{
   readonly passwordPersistence: PasswordPersistence["Service"];
-}, never, LifecycleHooks>) => Layer.Layer<PasswordPersistence, never, LifecycleHooks>;
-export declare const passwordRegistrationLayer: <Id, Registration>(tag: Context.Key<Id, PasswordRegistrationAuthority<Registration>>, services: Effect.Effect<{
+}, E, R>) => Layer.Layer<PasswordPersistence, E, Exclude<R, import("effect/Scope").Scope>>;
+export declare const passwordRegistrationLayer: <Id, Registration, E, R>(tag: Context.Key<Id, PasswordRegistrationAuthority<Registration>>, services: Effect.Effect<{
   readonly registrationAuthority: PasswordRegistrationAuthority<Registration>;
-}, never, LifecycleHooks>) => Layer.Layer<Id, never, LifecycleHooks>;
+}, E, R>) => Layer.Layer<Id, E, Exclude<R, import("effect/Scope").Scope>>;
 //#endregion
 //# sourceMappingURL=password-target.d.mts.map

package/dist/drizzle/password-target.mjs

@@ -1,11 +1,11 @@
 import { sqlClientStandaloneGuard } from "./standalone-guard.mjs";
-import { makeSqlPasswordPersistence } from "./password-sql.mjs";
+import { CurrentPasswordSql, makeSqlPasswordPersistence } from "./password-sql.mjs";
 import { makeSqlPasswordRegistrationAuthority } from "./password-registration.mjs";
 import { Effect, Layer } from "effect";
 import { LifecycleHooks, coordinateCommit, hasCommitScope } from "@yielded/auth/Hooks";
 import { PasswordPersistence, PasswordUnavailable } from "@yielded/auth/Password";
 //#region src/drizzle/password-target.ts
-const sqlClientPasswordStandaloneGuard = (database) => sqlClientStandaloneGuard(database, () => PasswordUnavailable.make({}));
+const sqlClientPasswordStandaloneGuard = (service) => sqlClientStandaloneGuard(service, () => PasswordUnavailable.make({}));
 const passwordOptions = (configuration, proofMapping, coordinated = false) => ({
 	mode: configuration.mode,
 	locking: configuration.locking,
@@ -30,11 +30,11 @@ const registrationOptions = (configuration, coordinated = false) => ({
 	generatedSubjectRows: configuration.generatedSubjectRows,
 	coordinated
 });
-const makeTargetPasswordPersistenceServices = (database, mapping, configuration, proofMapping) => Effect.gen(function* () {
-	return { passwordPersistence: yield* makeSqlPasswordPersistence(database, mapping, passwordOptions(configuration, proofMapping)) };
+const makeTargetPasswordPersistenceServices = (mapping, configuration, proofMapping) => Effect.gen(function* () {
+	return { passwordPersistence: yield* makeSqlPasswordPersistence(mapping, passwordOptions(configuration, proofMapping)) };
 });
-const makeTargetPasswordRegistrationServices = (database, mapping, configuration) => Effect.gen(function* () {
-	return { registrationAuthority: yield* makeSqlPasswordRegistrationAuthority(database, mapping, registrationOptions(configuration)) };
+const makeTargetPasswordRegistrationServices = (mapping, configuration) => Effect.gen(function* () {
+	return { registrationAuthority: yield* makeSqlPasswordRegistrationAuthority(mapping, registrationOptions(configuration)) };
 });
 /** Native transaction acquisition exposes SqlError; caller errors propagate unchanged. */
 const coordinateTargetPasswordPersistence = (database, mapping, configuration, proofMapping, owner) => Effect.gen(function* () {
@@ -42,7 +42,7 @@ const coordinateTargetPasswordPersistence = (database, mapping, configuration, p
 	if (yield* hasCommitScope) return yield* PasswordUnavailable.make({});
 	yield* configuration.coordinatorGuard ?? configuration.standaloneGuard;
 	return (yield* coordinateCommit(() => database.transaction((transaction) => Effect.gen(function* () {
-		return yield* owner(transaction, { passwordPersistence: yield* makeSqlPasswordPersistence(transaction, mapping, passwordOptions(configuration, proofMapping, true)) });
+		return yield* owner(transaction, { passwordPersistence: yield* makeSqlPasswordPersistence(mapping, passwordOptions(configuration, proofMapping, true)).pipe(Effect.provideService(CurrentPasswordSql, transaction)) });
 	})), { mode: configuration.mode }).pipe(Effect.provideService(LifecycleHooks, hooks))).value;
 });
 const coordinateTargetPasswordRegistration = (database, mapping, configuration, owner) => Effect.gen(function* () {
@@ -50,7 +50,7 @@ const coordinateTargetPasswordRegistration = (database, mapping, configuration,
 	if (yield* hasCommitScope) return yield* PasswordUnavailable.make({});
 	yield* configuration.coordinatorGuard ?? configuration.standaloneGuard;
 	return (yield* coordinateCommit(() => database.transaction((transaction) => Effect.gen(function* () {
-		return yield* owner(transaction, { registrationAuthority: yield* makeSqlPasswordRegistrationAuthority(transaction, mapping, registrationOptions(configuration, true)) });
+		return yield* owner(transaction, { registrationAuthority: yield* makeSqlPasswordRegistrationAuthority(mapping, registrationOptions(configuration, true)).pipe(Effect.provideService(CurrentPasswordSql, transaction)) });
 	})), { mode: configuration.mode }).pipe(Effect.provideService(LifecycleHooks, hooks))).value;
 });
 const passwordPersistenceLayer = (services) => Layer.effect(PasswordPersistence, Effect.map(services, (value) => value.passwordPersistence));