@yielded/auth-persistence-drizzle 0.1.0-beta.1 → 0.1.0-beta.13

package/dist/drizzle/d1-password-prepared.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"d1-password-prepared.mjs","names":["kernel","and","shared"],"sources":["../../src/drizzle/d1-password-prepared.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- driver exports preserve concrete consumer mappings. */\nimport type { D1Client } from \"@effect/sql-d1/D1Client\";\nimport {\n  coordinateCommit,\n  CurrentCommitJournal,\n  hasCommitScope,\n  type CommitJournal,\n  type PreparedCommit,\n  LifecycleHooks,\n  HookConfigurationError,\n} from \"@yielded/auth/Hooks\";\nimport {\n  PasswordRejected,\n  PasswordUnavailable,\n  PasswordPreparedVersion,\n  decodePasswordPreparedReady,\n  encodePasswordPreparedReady,\n  snapshotPasswordPreparedReady,\n  snapshotPasswordPreparedReservation,\n  type PasswordPreparedReady,\n  type PasswordPreparedReservation,\n  type PasswordMutationDecision,\n  type PreparePasswordCommit,\n  type PasswordPreparedMutation,\n  type PasswordPreparedPersistence,\n} from \"@yielded/auth/Password\";\nimport { reportPersistenceFailure } from \"@yielded/auth/Persistence\";\nimport { type ProofCompletionPlan, ProofUnavailable, ProofBinding } from \"@yielded/auth/Proofs\";\nimport { eq, is, isNotNull, lte, or, SQL, sql, type AnyRelations, type Table } from \"drizzle-orm\";\nimport type { EffectSQLiteD1Database } from \"drizzle-orm/effect-d1\";\nimport type { AnySQLiteTable } from \"drizzle-orm/sqlite-core\";\nimport { Cause, DateTime, Effect, Predicate, Redacted, Schema, Context } from \"effect\";\nimport type { Statement } from \"effect/sql/Statement\";\n\nimport { balancedD1And as and, compactD1GeneratedStatement } from \"./d1-generated-statement\";\nimport { passwordD1Kernel as kernel } from \"./d1-passwords\";\nimport { CurrentD1PlanningDatabase, makeD1Owner } from \"./d1-planning\";\nimport { checkD1ProofCompletion, compileD1ProofCompletionPlan } from \"./d1-proofs\";\nimport { D1BatchStatements } from \"./D1BatchStatements\";\nimport { PersistenceMappingError, column, updateValues } from \"./model\";\nimport type {\n  D1PasswordPreparedPersistenceMapping,\n  D1PasswordPreparedProofMapping,\n} from \"./password-prepared-model\";\nimport { passwordPreparedSqlKernel as shared } from \"./password-prepared-sql\";\nimport {\n  ContextInput,\n  CompletionInput,\n  encodeReservation,\n  evidenceCurrent,\n  identifierScope,\n  reservationOf,\n  sameRevision,\n  snapshotMutation,\n  snapshotReserve,\n  unavailable,\n} from \"./password-prepared-state\";\nimport { CurrentPasswordSql, type PasswordSqlDatabase } from \"./password-sql\";\nimport type { SuppliedService } from \"./SuppliedService\";\n\ntype PlanPrepare<Method extends (...args: any[]) => any, A> = (\n  value: Parameters<Parameters<Method>[1]>[0],\n  journal: CommitJournal,\n) => PreparedCommit<A>;\n\ntype Database = EffectSQLiteD1Database<AnyRelations> & { readonly $client: D1Client };\ntype Mapping = D1PasswordPreparedPersistenceMapping<\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  unknown\n>;\ninterface Planned<A> {\n  readonly retryable?: (cause: unknown) => boolean;\n  readonly receipt: PreparedCommit<A>;\n  readonly statements: ReadonlyArray<Statement<any>>;\n  readonly postconditions?: ReadonlyArray<Statement<any>>;\n  readonly journalGuard?: PreparedCommit<void>;\n}\n\nconst everyFailureMatches = (\n  cause: Cause.Cause<unknown>,\n  classify: ((cause: unknown) => boolean) | undefined,\n): boolean =>\n  classify !== undefined &&\n  cause.reasons.length > 0 &&\n  cause.reasons.every((reason) => Cause.isFailReason(reason) && classify(Cause.fail(reason.error)));\n\nconst bindingJson = Schema.encodeSync(Schema.fromJsonString(ProofBinding));\n\nconst authorityCondition = (mapping: Mapping, current: any, moduleId: string) => {\n  const p = mapping.password,\n    s = kernel.subjectColumns(p),\n    i = kernel.identifierColumns(p),\n    c = kernel.credentialColumns(p),\n    ac = kernel.authorityColumns(p);\n\n  const snapshot = current.snapshot,\n    native = current.nativeSubjectId;\n\n  const identifier =\n    snapshot === undefined\n      ? sql`true`\n      : and(\n          p.identifier.d1CurrentCondition({\n            identifier: snapshot.identifier,\n            nativeSubjectId: native,\n          }),\n          sql`exists(select 1 from ${p.identifier.table} where ${i.namespace} = ${sql.param(snapshot.identifier.namespace, i.namespace)} and ${i.value} = ${sql.param(snapshot.identifier.value, i.value)} and ${i.subjectId} = ${sql.param(native, i.subjectId)} and ${i.bindingRevision} = ${sql.param(snapshot.identifierBindingRevision, i.bindingRevision)} and ${Predicate.isNullish(current.identifier[p.identifier.verifiedAt]) ? sql`${i.verifiedAt} is null` : sql`${i.verifiedAt} = ${sql.param(current.identifier[p.identifier.verifiedAt], i.verifiedAt)}`})`,\n        )!;\n\n  return and(\n    sql`exists(select 1 from ${p.subject.table} where ${s.id} = ${sql.param(native, s.id)} and ${s.status} = ${sql.param(p.subject.d1ActiveStatusValue, s.status)} and ${s.securityRevision} = ${sql.param(current.revision.securityRevision, s.securityRevision)})`,\n    identifier,\n    snapshot === undefined\n      ? sql`not exists(select 1 from ${p.credential.table} where ${c.moduleId} = ${sql.param(moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(native, c.subjectId)})`\n      : sql`exists(select 1 from ${p.credential.table} where ${c.moduleId} = ${sql.param(moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(native, c.subjectId)} and ${c.credentialId} = ${sql.param(snapshot.credentialId, c.credentialId)} and ${c.credentialRevision} = ${sql.param(snapshot.credentialRevision, c.credentialRevision)} and ${c.verifierVersion} = ${sql.param(snapshot.verifierVersion, c.verifierVersion)} and ${c.verifier} = ${sql.param(Redacted.value(snapshot.verifier), c.verifier)} and ${c.normalization} = ${sql.param(snapshot.normalization, c.normalization)})`,\n    ...current.revision.credentials.map(\n      (entry: any) =>\n        sql`exists(select 1 from ${p.authorityCredential.table} where ${ac.subjectId} = ${sql.param(native, ac.subjectId)} and ${ac.credentialId} = ${sql.param(entry.credentialId, ac.credentialId)} and ${ac.revision} = ${sql.param(entry.revision, ac.revision)}${ac.status === undefined ? sql`` : sql` and ${ac.status} = ${sql.param(p.authorityCredential.d1ActiveStatusValue, ac.status)}`})`,\n    ),\n  )!;\n};\n\nconst existsRow = (mapping: Mapping, row: any) =>\n  sql`exists(select 1 from ${mapping.intent.table} where ${shared.rowCondition(mapping, row)})`;\n\nconst terminalStatements = Effect.fn(function* (\n  mapping: Mapping,\n  row: any,\n  state: \"Consumed\" | \"Cancelled\" | \"Expired\",\n  marker: string,\n) {\n  const database = yield* CurrentD1PlanningDatabase;\n  const t = mapping.intent;\n\n  return [\n    yield* kernel.statement(\n      database\n        .update(t.table)\n        .set(t.encodeTerminal(state))\n        .where(shared.rowCondition(mapping, row)),\n    ),\n    yield* kernel.assertion(\n      existsRow(mapping, {\n        ...row,\n        [t.state]: t.states[state],\n        [t.snapshot]: null,\n        [t.digest]: null,\n      }),\n      marker,\n    ),\n  ];\n});\n\nconst selectInsert = Effect.fn(function* (table: Table, values: object, condition: SQL) {\n  const database = yield* CurrentD1PlanningDatabase;\n\n  const selected = Object.fromEntries(\n    Object.entries(values)\n      .filter(([, value]) => value !== undefined)\n      .map(([key, value]) => [\n        key,\n        (is(value, SQL) ? value : sql`${sql.param(value, column(table, key as never))}`).as(key),\n      ]),\n  );\n\n  return database.insert(table as any).select(\n    database\n      .select(selected)\n      .from(sql`(select 1)`)\n      .where(condition),\n  );\n});\n\nconst makePreparedPlans = (mapping: Mapping, proofMapping?: any) => {\n  const p = mapping.password,\n    t = mapping.intent,\n    c = shared.columns(mapping),\n    config = { locking: false };\n\n  const readRows = Effect.fn(function* (condition: SQL) {\n    const database = yield* CurrentD1PlanningDatabase;\n\n    return yield* database.select().from(t.table).where(condition).limit(2);\n  });\n\n  const run = <A, E, R>(plan: Effect.Effect<Planned<A>, E, R>) =>\n    Effect.gen(function* () {\n      const database = yield* CurrentD1PlanningDatabase;\n\n      return yield* shared.valid(mapping)\n        ? plan.pipe(\n            Effect.flatMap((planned) =>\n              Effect.try({\n                try: () => ({\n                  ...planned,\n                  statements: planned.statements.map((statement) =>\n                    compactD1GeneratedStatement(database.$client, statement, unavailable),\n                  ),\n                  postconditions: planned.postconditions?.map((statement) =>\n                    compactD1GeneratedStatement(database.$client, statement, unavailable),\n                  ),\n                }),\n                catch: (cause) =>\n                  Schema.is(PasswordUnavailable)(cause)\n                    ? cause\n                    : PersistenceMappingError.make({ operation: \"mapping\", cause }),\n              }),\n            ),\n          )\n        : Effect.fail(unavailable());\n    });\n\n  const current = (record: PasswordPreparedReservation | PasswordPreparedReady) =>\n    shared.currentAuthority(mapping, config, record);\n\n  const complete = <A>(\n    uncaptured: PasswordPreparedMutation & { readonly completion?: ProofCompletionPlan },\n    prepare: PreparePasswordCommit<PasswordMutationDecision, A>,\n  ) =>\n    Effect.gen(function* () {\n      const input = yield* snapshotMutation(uncaptured);\n\n      const completion =\n        uncaptured.completion === undefined\n          ? undefined\n          : {\n              prepare: uncaptured.completion.prepare,\n              input: yield* Schema.encodeEffect(Schema.fromJsonString(CompletionInput))(\n                uncaptured.completion.input,\n              ).pipe(\n                Effect.flatMap(Schema.decodeEffect(Schema.fromJsonString(CompletionInput))),\n                Effect.mapError(unavailable),\n              ),\n            };\n\n      if (\n        (input.intent.action === \"reset-password\") !== (completion !== undefined) ||\n        (completion !== undefined && proofMapping === undefined)\n      )\n        return yield* unavailable();\n\n      const credentialRevision = yield* kernel.allocate(p.allocateRevision, p.allocateRevisionSync),\n        verifierVersion = yield* kernel.allocate(p.allocateRevision, p.allocateRevisionSync),\n        nextSecurityRevision = yield* kernel.allocateNextSecurityRevision(\n          p,\n          input.intent.revision.securityRevision,\n        );\n\n      if (\n        nextSecurityRevision === input.intent.revision.securityRevision ||\n        credentialRevision === input.intent.credential?.credentialRevision ||\n        verifierVersion === input.intent.credential?.verifierVersion\n      )\n        return yield* unavailable();\n\n      const credentialId =\n        input.intent.action === \"add-password\"\n          ? yield* kernel.allocate(p.allocateCredentialId, p.allocateCredentialIdSync)\n          : undefined;\n\n      return yield* run(\n        Effect.gen(function* () {\n          const journal = yield* CurrentCommitJournal;\n\n          const authority = yield* current(input.intent),\n            rows = yield* readRows(\n              and(eq(c.moduleId, input.intent.moduleId), eq(c.intentId, input.intent.intentId))!,\n            ),\n            row = rows[0],\n            now = yield* kernel.readEngineNowMillis(p);\n\n          if (\n            authority === undefined ||\n            rows.length !== 1 ||\n            !(yield* shared.recordMatches(\n              mapping,\n              row,\n              input.intent,\n              authority.nativeSubjectId,\n              yield* encodePasswordPreparedReady(input.intent),\n            )) ||\n            !evidenceCurrent(input, authority.requirement, now)\n          )\n            return { receipt: prepare(\"rejected\", journal), statements: [] };\n          const marker = `effect-auth-password-prepared:complete:${input.intent.intentId}`;\n\n          const requirements = [\n            input.mutation.authorization.requirement,\n            input.intent.capturedRequirement,\n            input.capturedRequirement,\n            authority.requirement,\n            input.currentRequirement,\n          ];\n\n          const age = Math.min(...requirements.map((value) => value.maximumAgeMillis));\n\n          const live = and(\n            existsRow(mapping, row),\n            authorityCondition(mapping, authority, input.intent.moduleId),\n            sql`${p.d1.engineNowMillis} >= ${input.intent.issuedAtMillis} and ${p.d1.engineNowMillis} < ${input.intent.expiresAtMillis}`,\n            ...requirements.map((requirement) =>\n              kernel.assuranceCondition(p, input.mutation.authorization.evidence, requirement),\n            ),\n            ...(input.intent.baseEvidence?.proofs ?? []).map(\n              (proof) =>\n                sql`${p.d1.engineNowMillis} >= ${DateTime.toEpochMillis(proof.verifiedAt)} and ${p.d1.engineNowMillis} < ${DateTime.toEpochMillis(proof.verifiedAt) + age}`,\n            ),\n          )!;\n\n          let mutation: ReadonlyArray<Statement<any>>;\n          let passwordApplied: SQL;\n          let mutationGuard: ((cause: unknown) => boolean) | undefined;\n\n          if (input.intent.action === \"add-password\") {\n            const compiled = yield* kernel.compileAddMutation(p, input.mutation, {\n              credentialId: credentialId!,\n              credentialRevision,\n              verifierVersion,\n              nextSecurityRevision,\n            });\n\n            if (compiled === undefined)\n              return { receipt: prepare(\"rejected\", journal), statements: [] };\n            mutation = compiled.statements;\n            mutationGuard = compiled.retryable;\n            passwordApplied = compiled.appliedCondition;\n          } else {\n            const compiled = yield* kernel.compileReplacementMutation(\n              p,\n              input.mutation,\n              input.intent.action,\n              { credentialRevision, verifierVersion, nextSecurityRevision },\n            );\n\n            if (compiled === undefined)\n              return { receipt: prepare(\"rejected\", journal), statements: [] };\n            passwordApplied = compiled.protectedMutation.appliedCondition;\n            mutationGuard = (cause) => kernel.isGuardFailure(cause, compiled.marker);\n            mutation = [\n              ...compiled.protectedMutation.statements,\n              yield* kernel.assertion(compiled.protectedMutation.appliedCondition, marker),\n            ];\n          }\n\n          const terminal = {\n            ...row,\n            [t.state]: t.states.Consumed,\n            [t.snapshot]: null,\n            [t.digest]: null,\n          };\n\n          const protectedMutation = {\n            statements: [\n              yield* kernel.assertion(live, marker),\n              ...mutation,\n              ...(yield* terminalStatements(mapping, row, \"Consumed\", marker)),\n            ],\n            appliedCondition: and(\n              passwordApplied,\n              existsRow(mapping, terminal),\n              sql`${p.d1.engineNowMillis} >= ${input.intent.issuedAtMillis} and ${p.d1.engineNowMillis} < ${input.intent.expiresAtMillis}`,\n              ...(input.intent.baseEvidence?.proofs ?? []).map(\n                (proof) =>\n                  sql`${p.d1.engineNowMillis} >= ${DateTime.toEpochMillis(proof.verifiedAt)} and ${p.d1.engineNowMillis} < ${DateTime.toEpochMillis(proof.verifiedAt) + age}`,\n              ),\n              ...requirements.map((requirement) =>\n                kernel.assuranceCondition(p, input.mutation.authorization.evidence, requirement),\n              ),\n            )!,\n          };\n\n          if (completion !== undefined) {\n            if (\n              input.intent.reset === undefined ||\n              completion.input.continuationId !== input.intent.reset.continuationId ||\n              bindingJson(completion.input.binding) !== bindingJson(input.intent.reset.binding) ||\n              !kernel.completionMatchesPassword({ ...input.mutation, completion })\n            )\n              return { receipt: prepare(\"rejected\", journal), statements: [] };\n            let receipt: PreparedCommit<A> | undefined;\n\n            const compiled = yield* compileD1ProofCompletionPlan(\n              proofMapping,\n              completion,\n              protectedMutation,\n              (decision) => {\n                receipt = prepare(decision === \"completed\" ? \"changed\" : \"rejected\", journal);\n\n                return decision;\n              },\n            );\n\n            return {\n              retryable: (cause: unknown) =>\n                kernel.isGuardFailure(cause, marker) ||\n                mutationGuard?.(cause) === true ||\n                (completion !== undefined &&\n                  (kernel.isGuardFailure(\n                    cause,\n                    `effect-auth-proof-guard:complete:${completion.input.continuationId}`,\n                  ) ||\n                    kernel.isGuardFailure(\n                      cause,\n                      `effect-auth-proof-guard:protected:${completion.input.continuationId}`,\n                    ))),\n              receipt: receipt ?? prepare(\"rejected\", journal),\n              statements: compiled.statements,\n              postconditions: compiled.postconditions,\n            };\n          }\n\n          const postconditions = [\n            yield* kernel.assertion(protectedMutation.appliedCondition, marker),\n          ];\n\n          return {\n            retryable: (cause: unknown) =>\n              kernel.isGuardFailure(cause, marker) || mutationGuard?.(cause) === true,\n            receipt: prepare(\"changed\", journal),\n            statements: [...protectedMutation.statements, ...postconditions],\n            postconditions,\n          };\n        }),\n      );\n    });\n\n  const services = {\n    reserve: <A>(\n      uncaptured: Parameters<PasswordPreparedPersistence[\"reserve\"]>[0],\n      prepare: PlanPrepare<PasswordPreparedPersistence[\"reserve\"], A>,\n    ) =>\n      Effect.gen(function* () {\n        const database = yield* CurrentD1PlanningDatabase;\n\n        const input = yield* snapshotReserve(uncaptured);\n\n        if (\n          (input.action === \"reset-password\") !==\n            (input.reset !== undefined && input.completion !== undefined) ||\n          (input.action === \"reset-password\" && proofMapping === undefined) ||\n          input.generation !== input.policy.generation ||\n          input.policy.retentionMillis <\n            Math.max(\n              input.policy.preparationLifetimeMillis + input.policy.lifetimeMillis,\n              input.policy.admission.action.windowMillis,\n              input.policy.admission.subject.windowMillis,\n              input.policy.admission.identifier.windowMillis,\n            ) ||\n          (input.invalidation.existingSessions === \"immediate\" &&\n            p.sessionInvalidation !== \"same-authority-immediate\")\n        )\n          return yield* unavailable();\n\n        const version = PasswordPreparedVersion.make(\n          yield* kernel.allocate(mapping.allocateVersion, mapping.allocateVersionSync),\n        );\n\n        return yield* run(\n          Effect.gen(function* () {\n            const journal = yield* CurrentCommitJournal;\n\n            const authority = yield* shared.captureAuthority(mapping, config, input);\n\n            if (authority === undefined) return yield* unavailable();\n            let proofCondition: SQL = sql`true`;\n\n            if (input.reset !== undefined) {\n              if (\n                input.completion === undefined ||\n                input.completion.moduleId !== `${input.moduleId}/reset` ||\n                input.completion.purpose !== \"password-reset\" ||\n                input.reset.continuationId !== input.completion.continuationId ||\n                bindingJson(input.reset.binding) !== bindingJson(input.completion.binding) ||\n                input.reset.binding._tag !== \"Subject\" ||\n                !sameRevision(input.reset.binding.revision, authority.revision) ||\n                authority.snapshot?.identifierVerifiedAtMillis === undefined\n              )\n                return yield* unavailable();\n              const inspected = yield* checkD1ProofCompletion(proofMapping, input.completion);\n\n              if (!inspected.accepted) return yield* unavailable();\n              proofCondition = inspected.condition;\n            }\n\n            const ownerCurrent = and(\n              authorityCondition(mapping, authority, input.moduleId),\n              proofCondition,\n            )!;\n\n            const marker = `effect-auth-password-prepared:reserve:${input.intentId}`;\n\n            const existing = yield* readRows(\n              and(eq(c.moduleId, input.moduleId), eq(c.commandId, input.commandId))!,\n            );\n\n            if (existing.length)\n              return {\n                retryable: (cause: unknown) => kernel.isGuardFailure(cause, marker),\n                receipt: prepare({ _tag: \"Existing\" }, journal),\n                statements: [\n                  yield* kernel.assertion(\n                    and(ownerCurrent, existsRow(mapping, existing[0]))!,\n                    marker,\n                  ),\n                ],\n              };\n\n            const now = yield* kernel.readEngineNowMillis(p),\n              scope = identifierScope({\n                credential: authority.snapshot,\n                revision: authority.revision,\n              });\n\n            const reservation = yield* snapshotPasswordPreparedReservation({\n              _tag: \"Preparing\",\n              moduleId: input.moduleId,\n              generation: input.generation,\n              intentId: input.intentId,\n              version,\n              commandId: input.commandId,\n              action: input.action,\n              revision: authority.revision,\n              ...(authority.snapshot === undefined ? {} : { credential: authority.snapshot }),\n              capturedRequirement: authority.requirement,\n              ...(input.reset === undefined ? {} : { reset: input.reset }),\n              invalidation: input.invalidation,\n              createdAtMillis: now,\n              preparationExpiresAtMillis: now + input.policy.preparationLifetimeMillis,\n              retainUntilMillis: now + input.policy.retentionMillis,\n            });\n\n            const snapshot = yield* encodeReservation(reservation),\n              window = Math.max(\n                input.policy.admission.action.windowMillis,\n                input.policy.admission.identifier.windowMillis,\n                input.policy.admission.subject.windowMillis,\n              );\n\n            const a = mapping.admission,\n              am = column(a.table, a.moduleId),\n              ai = column(a.table, a.intentId),\n              at = column(a.table, a.admittedAt),\n              ar = column(a.table, a.admissionRetainUntil);\n\n            const stamp = sql`(select ${at} from ${a.table} where ${am} = ${sql.param(input.moduleId, am)})`,\n              retention = sql`(select ${ar} from ${a.table} where ${am} = ${sql.param(input.moduleId, am)})`;\n\n            const active = sql`(select count(*) from ${t.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(authority.nativeSubjectId, c.subjectId)} and ((${c.state} = ${sql.param(t.states.Preparing, c.state)} and ${c.preparationExpiresAt} > ${p.d1.engineNow}) or (${c.state} = ${sql.param(t.states.Ready, c.state)} and ${c.expiresAt} > ${p.d1.engineNow}))) < ${input.policy.maximumPendingPerSubject}`;\n\n            const budgets = [\n              [eq(c.action, input.action), input.policy.admission.action],\n              [eq(c.identifierScope, scope), input.policy.admission.identifier],\n              [eq(c.subjectId, authority.nativeSubjectId), input.policy.admission.subject],\n            ] as const;\n\n            const admissionDecision = and(\n              ownerCurrent,\n              active,\n              ...budgets.map(\n                ([condition, budget]) =>\n                  sql`(select count(*) from ${t.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${condition} and ${c.admittedAt} > ${p.d1.engineInstantMinus(budget.windowMillis)}) < ${budget.limit}`,\n              ),\n              sql`not exists(select 1 from ${t.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${c.commandId} = ${sql.param(input.commandId, c.commandId)})`,\n              sql`${p.d1.engineNowMillis} >= ${now} and ${p.d1.engineNowMillis} < ${reservation.preparationExpiresAtMillis}`,\n            )!;\n\n            const admittedMillis = mapping.admissionClock.toMillis(stamp),\n              retainedMillis = mapping.admissionClock.toMillis(retention);\n\n            const clockGuard = and(\n              sql`exists(select 1 from ${a.table} where ${am} = ${sql.param(input.moduleId, am)} and ${ai} = ${sql.param(input.intentId, ai)})`,\n              sql`${admittedMillis} >= ${now} and ${admittedMillis} <= ${p.d1.engineNowMillis}`,\n              sql`${retainedMillis} = ${admittedMillis} + ${window}`,\n            )!;\n\n            const guard = and(sql`changes() = 1`, clockGuard)!;\n\n            const values = {\n              ...t.encodeInsert({\n                reservation,\n                nativeSubjectId: authority.nativeSubjectId,\n                identifierScope: scope,\n                snapshot,\n                admittedAtMillis: now,\n                admissionRetainUntilMillis: now + window,\n              }),\n              [t.admittedAt]: stamp,\n              [t.admissionRetainUntil]: retention,\n            };\n\n            const expected = {\n              [t.moduleId]: input.moduleId,\n              [t.intentId]: input.intentId,\n              [t.commandId]: input.commandId,\n              [t.subjectId]: authority.nativeSubjectId,\n              [t.action]: input.action,\n              [t.generation]: input.generation,\n              [t.version]: version,\n              [t.state]: t.states.Preparing,\n              [t.digest]: null,\n              [t.snapshot]: snapshot,\n              [t.identifierScope]: scope,\n              [t.createdAt]: p.encodeInstant(now),\n              [t.preparationExpiresAt]: p.encodeInstant(reservation.preparationExpiresAtMillis),\n              [t.expiresAt]: null,\n              [t.retainUntil]: p.encodeInstant(reservation.retainUntilMillis),\n              [t.admittedAt]: stamp,\n              [t.admissionRetainUntil]: retention,\n            };\n\n            return {\n              retryable: (cause: unknown) => kernel.isGuardFailure(cause, marker),\n              receipt: prepare({ _tag: \"Reserved\", reservation }, journal),\n              statements: [\n                yield* kernel.statement(\n                  database\n                    .insert(a.table)\n                    .values(a.encodeInsert(input.moduleId))\n                    .onConflictDoNothing(),\n                ),\n                yield* kernel.statement(\n                  database\n                    .update(a.table)\n                    .set(\n                      updateValues([\n                        [a.intentId, input.intentId],\n                        [a.admittedAt, p.d1.engineNow],\n                        [a.admissionRetainUntil, p.d1.engineInstantPlus(window)],\n                      ]),\n                    )\n                    .where(and(eq(am, input.moduleId), admissionDecision)),\n                ),\n                yield* kernel.statement(yield* selectInsert(t.table, values, guard)),\n                yield* kernel.assertion(existsRow(mapping, expected), marker),\n                yield* kernel.assertion(\n                  and(\n                    ownerCurrent,\n                    clockGuard,\n                    sql`${p.d1.engineNowMillis} < ${reservation.preparationExpiresAtMillis}`,\n                    sql`(select count(*) from ${t.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(authority.nativeSubjectId, c.subjectId)} and ((${c.state} = ${sql.param(t.states.Preparing, c.state)} and ${c.preparationExpiresAt} > ${p.d1.engineNow}) or (${c.state} = ${sql.param(t.states.Ready, c.state)} and ${c.expiresAt} > ${p.d1.engineNow}))) <= ${input.policy.maximumPendingPerSubject}`,\n                    ...budgets.map(\n                      ([condition, budget]) =>\n                        sql`(select count(*) from ${t.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${condition} and ${c.admittedAt} > ${p.d1.engineInstantMinus(budget.windowMillis)}) <= ${budget.limit}`,\n                    ),\n                  )!,\n                  marker,\n                ),\n              ],\n            };\n          }),\n        );\n      }),\n    publishReady: <A>(\n      uncaptured: Parameters<PasswordPreparedPersistence[\"publishReady\"]>[0],\n      prepare: PlanPrepare<PasswordPreparedPersistence[\"publishReady\"], A>,\n    ) =>\n      Effect.gen(function* () {\n        const database = yield* CurrentD1PlanningDatabase;\n\n        const reservation = yield* snapshotPasswordPreparedReservation(uncaptured.reservation),\n          ready = yield* snapshotPasswordPreparedReady(uncaptured.ready),\n          snapshot = yield* encodeReservation(reservation),\n          readySnapshot = yield* encodePasswordPreparedReady(ready);\n\n        if ((yield* encodeReservation(reservationOf(ready))) !== snapshot)\n          return yield* unavailable();\n\n        return yield* run(\n          Effect.gen(function* () {\n            const journal = yield* CurrentCommitJournal;\n\n            const authority = yield* current(reservation),\n              rows = yield* readRows(\n                and(eq(c.moduleId, reservation.moduleId), eq(c.intentId, reservation.intentId))!,\n              ),\n              row = rows[0];\n\n            if (\n              authority === undefined ||\n              rows.length !== 1 ||\n              !(yield* shared.recordMatches(\n                mapping,\n                row,\n                reservation,\n                authority.nativeSubjectId,\n                snapshot,\n              ))\n            )\n              return { receipt: prepare(\"rejected\", journal), statements: [] };\n\n            const marker = `effect-auth-password-prepared:ready:${ready.intentId}`,\n              live = and(\n                authorityCondition(mapping, authority, ready.moduleId),\n                sql`${p.d1.engineNowMillis} >= ${ready.issuedAtMillis} and ${p.d1.engineNowMillis} < ${reservation.preparationExpiresAtMillis} and ${p.d1.engineNowMillis} < ${ready.expiresAtMillis}`,\n              )!;\n\n            const expected = {\n              ...row,\n              [t.state]: t.states.Ready,\n              [t.snapshot]: readySnapshot,\n              [t.digest]: ready.digest,\n              [t.expiresAt]: p.encodeInstant(ready.expiresAtMillis),\n            };\n\n            return {\n              retryable: (cause: unknown) => kernel.isGuardFailure(cause, marker),\n              receipt: prepare(\"published\", journal),\n              statements: [\n                yield* kernel.assertion(and(live, existsRow(mapping, row))!, marker),\n                yield* kernel.statement(\n                  database\n                    .update(t.table)\n                    .set(t.encodeReady({ ready, snapshot: readySnapshot }))\n                    .where(shared.rowCondition(mapping, row)),\n                ),\n                yield* kernel.assertion(and(live, existsRow(mapping, expected))!, marker),\n              ],\n            };\n          }),\n        );\n      }),\n    context: (uncaptured: Parameters<PasswordPreparedPersistence[\"context\"]>[0]) =>\n      Effect.gen(function* () {\n        const database = yield* CurrentD1PlanningDatabase;\n\n        if (yield* hasCommitScope) return yield* unavailable();\n\n        const input = yield* Schema.decodeEffect(ContextInput)({ ...uncaptured }).pipe(\n            Effect.mapError(unavailable),\n          ),\n          rows = yield* readRows(\n            and(\n              eq(c.moduleId, input.moduleId),\n              eq(c.generation, input.generation),\n              eq(c.digest, input.digest),\n              eq(c.state, t.states.Ready),\n            )!,\n          );\n\n        if (rows.length !== 1) return yield* PasswordRejected.make({});\n\n        const record = yield* decodePasswordPreparedReady(rows[0][t.snapshot]),\n          authority = yield* current(record);\n\n        if (\n          authority === undefined ||\n          record.moduleId !== input.moduleId ||\n          record.generation !== input.generation ||\n          record.digest !== input.digest ||\n          !(yield* shared.recordMatches(\n            mapping,\n            rows[0],\n            record,\n            authority.nativeSubjectId,\n            yield* encodePasswordPreparedReady(record),\n          ))\n        )\n          return yield* PasswordRejected.make({});\n\n        const condition = and(\n          shared.rowCondition(mapping, rows[0]),\n          authorityCondition(mapping, authority, record.moduleId),\n          sql`${p.d1.engineNowMillis} >= ${record.issuedAtMillis} and ${p.d1.engineNowMillis} < ${record.expiresAtMillis}`,\n        )!;\n\n        const guardStatement = yield* kernel.assertion(\n          sql`exists(select 1 from ${t.table} where ${condition})`,\n          `effect-auth-password-prepared:context:${record.intentId}`,\n        );\n\n        const guard = yield* Effect.try({\n          try: () => compactD1GeneratedStatement(database.$client, guardStatement, unavailable),\n          catch: (cause) =>\n            Schema.is(PasswordUnavailable)(cause)\n              ? cause\n              : PersistenceMappingError.make({ operation: \"mapping\", cause }),\n        });\n\n        yield* database.$client\n          .batch([guard])\n          .pipe(\n            Effect.catchCause(\n              (\n                cause,\n              ): Effect.Effect<never, PasswordRejected | import(\"effect/sql/SqlError\").SqlError> =>\n                everyFailureMatches(cause, (failure) =>\n                  kernel.isGuardFailure(\n                    failure,\n                    `effect-auth-password-prepared:context:${record.intentId}`,\n                  ),\n                )\n                  ? Effect.fail(PasswordRejected.make({}))\n                  : Effect.failCause(cause),\n            ),\n          );\n\n        return { record, currentRequirement: authority.requirement };\n      }),\n    complete,\n    resetWithProof: complete,\n    cancel: <A>(\n      uncaptured: Parameters<PasswordPreparedPersistence[\"cancel\"]>[0],\n      prepare: PlanPrepare<PasswordPreparedPersistence[\"cancel\"], A>,\n    ) =>\n      Effect.gen(function* () {\n        const record = yield* snapshotPasswordPreparedReady(uncaptured.record);\n\n        return yield* run(\n          Effect.gen(function* () {\n            const journal = yield* CurrentCommitJournal;\n\n            const authority = yield* current(record),\n              rows = yield* readRows(\n                and(eq(c.moduleId, record.moduleId), eq(c.intentId, record.intentId))!,\n              ),\n              row = rows[0];\n\n            if (\n              authority === undefined ||\n              rows.length !== 1 ||\n              !(yield* shared.recordMatches(\n                mapping,\n                row,\n                record,\n                authority.nativeSubjectId,\n                yield* encodePasswordPreparedReady(record),\n              ))\n            )\n              return { receipt: prepare(false, journal), statements: [] };\n            const marker = `effect-auth-password-prepared:cancel:${record.intentId}`;\n\n            return {\n              retryable: (cause: unknown) => kernel.isGuardFailure(cause, marker),\n              receipt: prepare(true, journal),\n              statements: [\n                yield* kernel.assertion(\n                  and(\n                    existsRow(mapping, row),\n                    authorityCondition(mapping, authority, record.moduleId),\n                    sql`${p.d1.engineNowMillis} >= ${record.issuedAtMillis} and ${p.d1.engineNowMillis} < ${record.expiresAtMillis}`,\n                  )!,\n                  marker,\n                ),\n                ...(yield* terminalStatements(mapping, row, \"Cancelled\", marker)),\n              ],\n            };\n          }),\n        );\n      }),\n    cleanup: <A>(\n      uncaptured: Parameters<PasswordPreparedPersistence[\"cleanup\"]>[0],\n      prepare: PlanPrepare<PasswordPreparedPersistence[\"cleanup\"], A>,\n    ) =>\n      Effect.gen(function* () {\n        const database = yield* CurrentD1PlanningDatabase;\n\n        const input = { ...uncaptured };\n\n        if (!Number.isSafeInteger(input.limit) || input.limit < 1 || input.limit > 1000)\n          return yield* unavailable();\n\n        return yield* run(\n          Effect.gen(function* () {\n            const journal = yield* CurrentCommitJournal;\n\n            const due = and(\n              eq(c.moduleId, input.moduleId),\n              or(\n                and(\n                  lte(c.retainUntil, p.d1.engineNow),\n                  lte(c.admissionRetainUntil, p.d1.engineNow),\n                ),\n                and(\n                  isNotNull(c.snapshot),\n                  or(\n                    and(\n                      eq(c.state, t.states.Preparing),\n                      lte(c.preparationExpiresAt, p.d1.engineNow),\n                    ),\n                    and(eq(c.state, t.states.Ready), lte(c.expiresAt, p.d1.engineNow)),\n                  ),\n                ),\n              ),\n            )!;\n\n            const rows = yield* database\n              .select()\n              .from(t.table)\n              .where(due)\n              .orderBy(c.createdAt, c.intentId)\n              .limit(input.limit + 1);\n\n            const now = yield* kernel.readEngineNowMillis(p),\n              statements: Statement<any>[] = [],\n              marker = `effect-auth-password-prepared:cleanup:${input.moduleId}`;\n\n            let removed = 0;\n\n            for (const row of rows.slice(0, input.limit)) {\n              const retained = yield* p.decodeInstant(row[t.retainUntil]),\n                charge = yield* p.decodeInstant(row[t.admissionRetainUntil]);\n\n              statements.push(\n                yield* kernel.assertion(\n                  and(\n                    existsRow(mapping, row),\n                    sql`exists(select 1 from ${t.table} where ${shared.rowCondition(mapping, row)} and ${due})`,\n                  )!,\n                  marker,\n                ),\n              );\n              if (retained <= now && charge <= now) {\n                statements.push(\n                  yield* kernel.statement(\n                    database\n                      .delete(t.table)\n                      .where(\n                        and(\n                          shared.rowCondition(mapping, row),\n                          lte(c.retainUntil, p.d1.engineNow),\n                          lte(c.admissionRetainUntil, p.d1.engineNow),\n                        ),\n                      ),\n                  ),\n                  yield* kernel.assertion(\n                    sql`not exists(select 1 from ${t.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${c.intentId} = ${sql.param(row[t.intentId], c.intentId)})`,\n                    marker,\n                  ),\n                );\n                removed++;\n              } else\n                statements.push(...(yield* terminalStatements(mapping, row, \"Expired\", marker)));\n            }\n            const hasMore = rows.length > input.limit;\n\n            statements.push(\n              yield* kernel.assertion(\n                hasMore\n                  ? sql`exists(select 1 from ${t.table} where ${due})`\n                  : sql`not exists(select 1 from ${t.table} where ${due})`,\n                marker,\n              ),\n            );\n\n            return {\n              retryable: (cause: unknown) => kernel.isGuardFailure(cause, marker),\n              receipt: prepare({ removed, hasMore }, journal),\n              statements,\n            };\n          }),\n        );\n      }),\n  };\n\n  return services;\n};\n\nexport const makeD1PasswordPreparedPersistenceServices = <\n  S extends AnySQLiteTable,\n  I extends AnySQLiteTable,\n  C extends AnySQLiteTable,\n  AC extends AnySQLiteTable,\n  At extends AnySQLiteTable,\n  RS extends AnySQLiteTable,\n  CE extends AnySQLiteTable,\n  M extends AnySQLiteTable,\n  T extends AnySQLiteTable,\n  B extends AnySQLiteTable,\n  NativeId,\n  PS extends AnySQLiteTable = AnySQLiteTable,\n  PC extends AnySQLiteTable = AnySQLiteTable,\n  PM extends AnySQLiteTable = AnySQLiteTable,\n  PSub extends AnySQLiteTable = AnySQLiteTable,\n  PI extends AnySQLiteTable = AnySQLiteTable,\n  PCr extends AnySQLiteTable = AnySQLiteTable,\n  PNativeId = unknown,\n>(\n  database: Database,\n  mapping: D1PasswordPreparedPersistenceMapping<S, I, C, AC, At, RS, CE, M, T, B, NativeId>,\n  proofMapping?: D1PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId>,\n) =>\n  Effect.gen(function* () {\n    const hooks = yield* LifecycleHooks;\n    const plans = makePreparedPlans(mapping as unknown as Mapping, proofMapping);\n\n    const run = <Out, Err, Env>(plan: Effect.Effect<Planned<Out>, Err, Env>) =>\n      Effect.gen(function* () {\n        if (yield* hasCommitScope) return yield* unavailable();\n\n        return yield* executeStandalone(plan);\n      }).pipe(\n        Effect.provideService(CurrentD1PlanningDatabase, database),\n        Effect.provideService(CurrentPasswordSql, database as unknown as PasswordSqlDatabase),\n        Effect.provideService(LifecycleHooks, hooks),\n      );\n\n    const service: PasswordPreparedPersistence = {\n      reserve: (input, prepare) => run(plans.reserve(input, prepare)).pipe(translateFailure),\n      publishReady: (input, prepare) =>\n        run(plans.publishReady(input, prepare)).pipe(translateFailure),\n      context: (input) =>\n        plans\n          .context(input)\n          .pipe(\n            Effect.provideService(CurrentD1PlanningDatabase, database),\n            Effect.provideService(CurrentPasswordSql, database as unknown as PasswordSqlDatabase),\n            Effect.provideService(LifecycleHooks, hooks),\n            translateContextFailure,\n          ),\n      complete: (input, prepare) => run(plans.complete(input, prepare)).pipe(translateFailure),\n      resetWithProof: (input, prepare) =>\n        run(plans.resetWithProof(input, prepare)).pipe(translateFailure),\n      cancel: (input, prepare) => run(plans.cancel(input, prepare)).pipe(translateFailure),\n      cleanup: (input, prepare) => run(plans.cleanup(input, prepare)).pipe(translateFailure),\n    };\n\n    return { passwordPreparedPersistence: service };\n  });\n\nexport function coordinateD1PasswordPreparedPersistence<\n  TargetId,\n  S extends AnySQLiteTable,\n  I extends AnySQLiteTable,\n  C extends AnySQLiteTable,\n  AC extends AnySQLiteTable,\n  At extends AnySQLiteTable,\n  RS extends AnySQLiteTable,\n  CE extends AnySQLiteTable,\n  M extends AnySQLiteTable,\n  T extends AnySQLiteTable,\n  B extends AnySQLiteTable,\n  NativeId,\n  PS extends AnySQLiteTable,\n  PC extends AnySQLiteTable,\n  PM extends AnySQLiteTable,\n  PSub extends AnySQLiteTable,\n  PI extends AnySQLiteTable,\n  PCr extends AnySQLiteTable,\n  PNativeId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: D1PasswordPreparedPersistenceMapping<\n      S,\n      I,\n      C,\n      AC,\n      At,\n      RS,\n      CE,\n      M,\n      T,\n      B,\n      NativeId\n    >;\n    readonly proofMapping?:\n      | D1PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId>\n      | undefined;\n    readonly target: SuppliedService<TargetId, PasswordPreparedPersistence>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | PasswordUnavailable | HookConfigurationError | DatabaseError,\n  Exclude<R, TargetId | D1BatchStatements> | LifecycleHooks | DatabaseRequirements\n> {\n  return Effect.flatMap(acquire, (database) =>\n    Effect.gen(function* () {\n      const hooks = yield* LifecycleHooks;\n\n      if (yield* hasCommitScope) return yield* unavailable();\n\n      const result = yield* coordinateCommit(\n        () =>\n          Effect.gen(function* () {\n            const statements: Statement<any>[] = [];\n            let mutation: Planned<any> | undefined;\n            let poisoned = false;\n\n            const nativeCollector = D1BatchStatements.of({\n              append: (statement) => Effect.sync(() => statements.push(statement)),\n            });\n\n            const owner = yield* makeD1Owner(unavailable()).pipe(\n              Effect.provideService(D1BatchStatements, nativeCollector),\n            );\n\n            const protect = <Out, Err, Env>(effect: Effect.Effect<Out, Err, Env>) =>\n              effect.pipe(\n                Effect.onError(() =>\n                  Effect.sync(() => {\n                    poisoned = true;\n                  }),\n                ),\n              );\n\n            const plans = makePreparedPlans(\n              options.mapping as unknown as Mapping,\n              options.proofMapping,\n            );\n\n            const run = <Out, Err, Env>(plan: Effect.Effect<Planned<Out>, Err, Env>) =>\n              coordinateCommit(\n                () =>\n                  Effect.gen(function* () {\n                    const journal = yield* CurrentCommitJournal;\n                    const planned = yield* plan;\n\n                    yield* owner.check;\n                    if (mutation !== undefined) return yield* unavailable();\n                    const guarded = { ...planned, journalGuard: journal.prepare(undefined) };\n\n                    mutation = guarded;\n                    statements.push(...guarded.statements);\n\n                    return guarded.receipt;\n                  }),\n                { mode: \"batch\" },\n              ).pipe(\n                Effect.map((result) => result.value),\n                Effect.provideService(CurrentD1PlanningDatabase, database),\n                Effect.provideService(\n                  CurrentPasswordSql,\n                  database as unknown as PasswordSqlDatabase,\n                ),\n                Effect.provideService(LifecycleHooks, hooks),\n              );\n\n            const service: PasswordPreparedPersistence = {\n              reserve: (input, prepare) =>\n                owner.run(protect(run(plans.reserve(input, prepare)).pipe(translateFailure))),\n              publishReady: (input, prepare) =>\n                owner.run(protect(run(plans.publishReady(input, prepare)).pipe(translateFailure))),\n              context: (input) =>\n                owner.run(\n                  protect(\n                    plans\n                      .context(input)\n                      .pipe(\n                        Effect.provideService(CurrentD1PlanningDatabase, database),\n                        Effect.provideService(\n                          CurrentPasswordSql,\n                          database as unknown as PasswordSqlDatabase,\n                        ),\n                        Effect.provideService(LifecycleHooks, hooks),\n                        translateContextFailure,\n                      ),\n                  ),\n                ),\n              complete: (input, prepare) =>\n                owner.run(protect(run(plans.complete(input, prepare)).pipe(translateFailure))),\n              resetWithProof: (input, prepare) =>\n                owner.run(\n                  protect(run(plans.resetWithProof(input, prepare)).pipe(translateFailure)),\n                ),\n              cancel: (input, prepare) =>\n                owner.run(protect(run(plans.cancel(input, prepare)).pipe(translateFailure))),\n              cleanup: (input, prepare) =>\n                owner.run(protect(run(plans.cleanup(input, prepare)).pipe(translateFailure))),\n            };\n\n            const provided = Context.make(options.target, service).pipe(\n              Context.add(D1BatchStatements, owner.collector),\n            );\n\n            const value = yield* owner.close(Effect.provideContext(body, provided));\n\n            if (poisoned) return yield* unavailable();\n            if (mutation?.journalGuard !== undefined) {\n              const status = yield* Effect.result(mutation.journalGuard.read);\n\n              if (status._tag === \"Success\" || status.failure._tag !== \"CommitPending\")\n                return yield* unavailable();\n            }\n            yield* database.$client\n              .batch([...statements, ...(mutation?.postconditions ?? [])])\n              .pipe(\n                Effect.catchCause((cause) =>\n                  Effect.failCause(\n                    Cause.map(cause, (error) =>\n                      everyFailureMatches(cause, mutation?.retryable) ? unavailable() : error,\n                    ),\n                  ),\n                ),\n                translateFailure,\n              );\n\n            return value;\n          }),\n        { mode: \"batch\" },\n      ).pipe(Effect.provideService(LifecycleHooks, hooks));\n\n      return result.value;\n    }),\n  );\n}\n\nconst translateFailure = <A, E, R>(\n  effect: Effect.Effect<A, E, R>,\n): Effect.Effect<A, PasswordUnavailable, R> =>\n  reportPersistenceFailure(\n    effect,\n    (error) =>\n      Schema.is(PasswordUnavailable)(error) ||\n      Schema.is(ProofUnavailable)(error) ||\n      Schema.is(HookConfigurationError)(error),\n  ).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));\n\nconst translateContextFailure = <A, E, R>(\n  effect: Effect.Effect<A, E, R>,\n): Effect.Effect<A, PasswordUnavailable | PasswordRejected, R> =>\n  reportPersistenceFailure(\n    effect,\n    (error) =>\n      Schema.is(PasswordUnavailable)(error) ||\n      Schema.is(PasswordRejected)(error) ||\n      Schema.is(ProofUnavailable)(error) ||\n      Schema.is(HookConfigurationError)(error),\n  ).pipe(\n    Effect.catchCause((cause) =>\n      Effect.failCause(\n        Cause.map(cause, (error) => (Schema.is(PasswordRejected)(error) ? error : unavailable())),\n      ),\n    ),\n  );\n\nconst executeStandalone = <A, E, R>(plan: Effect.Effect<Planned<A>, E, R>) =>\n  Effect.suspend(() => {\n    let retryable: ((cause: unknown) => boolean) | undefined;\n\n    return coordinateCommit(\n      () =>\n        Effect.gen(function* () {\n          const database = yield* CurrentD1PlanningDatabase;\n          const planned = yield* plan;\n\n          retryable = planned.retryable;\n          yield* database.$client.batch([...planned.statements, ...(planned.postconditions ?? [])]);\n\n          return planned.receipt;\n        }),\n      { mode: \"batch\" },\n    ).pipe(\n      Effect.map((result) => result.value),\n      Effect.catchCause((cause) =>\n        Effect.failCause(\n          Cause.map(cause, (error) =>\n            everyFailureMatches(cause, retryable) ? unavailable() : error,\n          ),\n        ),\n      ),\n    );\n  });\n"],"mappings":";;;;;;;;;;;;;;;;AAuFA,MAAM,uBACJ,OACA,aAEA,aAAa,KAAA,KACb,MAAM,QAAQ,SAAS,KACvB,MAAM,QAAQ,OAAO,WAAW,MAAM,aAAa,MAAM,KAAK,SAAS,MAAM,KAAK,OAAO,KAAK,CAAC,CAAC;AAElG,MAAM,cAAc,OAAO,WAAW,OAAO,eAAe,YAAY,CAAC;AAEzE,MAAM,sBAAsB,SAAkB,SAAc,aAAqB;CAC/E,MAAM,IAAI,QAAQ,UAChB,IAAIA,iBAAO,eAAe,CAAC,GAC3B,IAAIA,iBAAO,kBAAkB,CAAC,GAC9B,IAAIA,iBAAO,kBAAkB,CAAC,GAC9B,KAAKA,iBAAO,iBAAiB,CAAC;CAEhC,MAAM,WAAW,QAAQ,UACvB,SAAS,QAAQ;CAEnB,MAAM,aACJ,aAAa,KAAA,IACT,GAAG,SACHC,cACE,EAAE,WAAW,mBAAmB;EAC9B,YAAY,SAAS;EACrB,iBAAiB;CACnB,CAAC,GACD,GAAG,wBAAwB,EAAE,WAAW,MAAM,SAAS,EAAE,UAAU,KAAK,IAAI,MAAM,SAAS,WAAW,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,MAAM,SAAS,WAAW,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,KAAK,IAAI,MAAM,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,KAAK,IAAI,MAAM,SAAS,2BAA2B,EAAE,eAAe,EAAE,OAAO,UAAU,UAAU,QAAQ,WAAW,EAAE,WAAW,WAAW,IAAI,GAAG,GAAG,EAAE,WAAW,YAAY,GAAG,GAAG,EAAE,WAAW,KAAK,IAAI,MAAM,QAAQ,WAAW,EAAE,WAAW,aAAa,EAAE,UAAU,IAAI,EAChiB;CAEN,OAAOA,cACL,GAAG,wBAAwB,EAAE,QAAQ,MAAM,SAAS,EAAE,GAAG,KAAK,IAAI,MAAM,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI,MAAM,EAAE,QAAQ,qBAAqB,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,KAAK,IAAI,MAAM,QAAQ,SAAS,kBAAkB,EAAE,gBAAgB,EAAE,IAC9P,YACA,aAAa,KAAA,IACT,GAAG,4BAA4B,EAAE,WAAW,MAAM,SAAS,EAAE,SAAS,KAAK,IAAI,MAAM,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,KAAK,IAAI,MAAM,QAAQ,EAAE,SAAS,EAAE,KAClK,GAAG,wBAAwB,EAAE,WAAW,MAAM,SAAS,EAAE,SAAS,KAAK,IAAI,MAAM,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,KAAK,IAAI,MAAM,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,KAAK,IAAI,MAAM,SAAS,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,mBAAmB,KAAK,IAAI,MAAM,SAAS,oBAAoB,EAAE,kBAAkB,EAAE,OAAO,EAAE,gBAAgB,KAAK,IAAI,MAAM,SAAS,iBAAiB,EAAE,eAAe,EAAE,OAAO,EAAE,SAAS,KAAK,IAAI,MAAM,SAAS,MAAM,SAAS,QAAQ,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,KAAK,IAAI,MAAM,SAAS,eAAe,EAAE,aAAa,EAAE,IAChkB,GAAG,QAAQ,SAAS,YAAY,KAC7B,UACC,GAAG,wBAAwB,EAAE,oBAAoB,MAAM,SAAS,GAAG,UAAU,KAAK,IAAI,MAAM,QAAQ,GAAG,SAAS,EAAE,OAAO,GAAG,aAAa,KAAK,IAAI,MAAM,MAAM,cAAc,GAAG,YAAY,EAAE,OAAO,GAAG,SAAS,KAAK,IAAI,MAAM,MAAM,UAAU,GAAG,QAAQ,IAAI,GAAG,WAAW,KAAA,IAAY,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,KAAK,IAAI,MAAM,EAAE,oBAAoB,qBAAqB,GAAG,MAAM,IAAI,EAChY,CACF;AACF;AAEA,MAAM,aAAa,SAAkB,QACnC,GAAG,wBAAwB,QAAQ,OAAO,MAAM,SAASC,0BAAO,aAAa,SAAS,GAAG,EAAE;AAE7F,MAAM,qBAAqB,OAAO,GAAG,WACnC,SACA,KACA,OACA,QACA;CACA,MAAM,WAAW,OAAO;CACxB,MAAM,IAAI,QAAQ;CAElB,OAAO,CACL,OAAOF,iBAAO,UACZ,SACG,OAAO,EAAE,KAAK,CAAC,CACf,IAAI,EAAE,eAAe,KAAK,CAAC,CAAC,CAC5B,MAAME,0BAAO,aAAa,SAAS,GAAG,CAAC,CAC5C,GACA,OAAOF,iBAAO,UACZ,UAAU,SAAS;EACjB,GAAG;GACF,EAAE,QAAQ,EAAE,OAAO;GACnB,EAAE,WAAW;GACb,EAAE,SAAS;CACd,CAAC,GACD,MACF,CACF;AACF,CAAC;AAED,MAAM,eAAe,OAAO,GAAG,WAAW,OAAc,QAAgB,WAAgB;CACtF,MAAM,WAAW,OAAO;CAExB,MAAM,WAAW,OAAO,YACtB,OAAO,QAAQ,MAAM,CAAC,CACnB,QAAQ,GAAG,WAAW,UAAU,KAAA,CAAS,CAAC,CAC1C,KAAK,CAAC,KAAK,WAAW,CACrB,MACC,GAAG,OAAO,GAAG,IAAI,QAAQ,GAAG,GAAG,IAAI,MAAM,OAAO,OAAO,OAAO,GAAY,CAAC,IAAA,CAAK,GAAG,GAAG,CACzF,CAAC,CACL;CAEA,OAAO,SAAS,OAAO,KAAY,CAAC,CAAC,OACnC,SACG,OAAO,QAAQ,CAAC,CAChB,KAAK,GAAG,YAAY,CAAC,CACrB,MAAM,SAAS,CACpB;AACF,CAAC;AAED,MAAM,qBAAqB,SAAkB,iBAAuB;CAClE,MAAM,IAAI,QAAQ,UAChB,IAAI,QAAQ,QACZ,IAAIE,0BAAO,QAAQ,OAAO,GAC1B,SAAS,EAAE,SAAS,MAAM;CAE5B,MAAM,WAAW,OAAO,GAAG,WAAW,WAAgB;EAGpD,OAAO,QAAO,OAFU,0BAAA,CAED,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,MAAM,SAAS,CAAC,CAAC,MAAM,CAAC;CACxE,CAAC;CAED,MAAM,OAAgB,SACpB,OAAO,IAAI,aAAa;EACtB,MAAM,WAAW,OAAO;EAExB,OAAO,OAAOA,0BAAO,MAAM,OAAO,IAC9B,KAAK,KACH,OAAO,SAAS,YACd,OAAO,IAAI;GACT,YAAY;IACV,GAAG;IACH,YAAY,QAAQ,WAAW,KAAK,cAClC,4BAA4B,SAAS,SAAS,WAAW,WAAW,CACtE;IACA,gBAAgB,QAAQ,gBAAgB,KAAK,cAC3C,4BAA4B,SAAS,SAAS,WAAW,WAAW,CACtE;GACF;GACA,QAAQ,UACN,OAAO,GAAG,mBAAmB,CAAC,CAAC,KAAK,IAChC,QACA,wBAAwB,KAAK;IAAE,WAAW;IAAW;GAAM,CAAC;EACpE,CAAC,CACH,CACF,IACA,OAAO,KAAK,YAAY,CAAC;CAC/B,CAAC;CAEH,MAAM,WAAW,WACfA,0BAAO,iBAAiB,SAAS,QAAQ,MAAM;CAEjD,MAAM,YACJ,YACA,YAEA,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO,iBAAiB,UAAU;EAEhD,MAAM,aACJ,WAAW,eAAe,KAAA,IACtB,KAAA,IACA;GACE,SAAS,WAAW,WAAW;GAC/B,OAAO,OAAO,OAAO,aAAa,OAAO,eAAe,eAAe,CAAC,CAAC,CACvE,WAAW,WAAW,KACxB,CAAC,CAAC,KACA,OAAO,QAAQ,OAAO,aAAa,OAAO,eAAe,eAAe,CAAC,CAAC,GAC1E,OAAO,SAAS,WAAW,CAC7B;EACF;EAEN,IACG,MAAM,OAAO,WAAW,sBAAuB,eAAe,KAAA,MAC9D,eAAe,KAAA,KAAa,iBAAiB,KAAA,GAE9C,OAAO,OAAO,YAAY;EAE5B,MAAM,qBAAqB,OAAOF,iBAAO,SAAS,EAAE,kBAAkB,EAAE,oBAAoB,GAC1F,kBAAkB,OAAOA,iBAAO,SAAS,EAAE,kBAAkB,EAAE,oBAAoB,GACnF,uBAAuB,OAAOA,iBAAO,6BACnC,GACA,MAAM,OAAO,SAAS,gBACxB;EAEF,IACE,yBAAyB,MAAM,OAAO,SAAS,oBAC/C,uBAAuB,MAAM,OAAO,YAAY,sBAChD,oBAAoB,MAAM,OAAO,YAAY,iBAE7C,OAAO,OAAO,YAAY;EAE5B,MAAM,eACJ,MAAM,OAAO,WAAW,iBACpB,OAAOA,iBAAO,SAAS,EAAE,sBAAsB,EAAE,wBAAwB,IACzE,KAAA;EAEN,OAAO,OAAO,IACZ,OAAO,IAAI,aAAa;GACtB,MAAM,UAAU,OAAO;GAEvB,MAAM,YAAY,OAAO,QAAQ,MAAM,MAAM,GAC3C,OAAO,OAAO,SACZC,cAAI,GAAG,EAAE,UAAU,MAAM,OAAO,QAAQ,GAAG,GAAG,EAAE,UAAU,MAAM,OAAO,QAAQ,CAAC,CAClF,GACA,MAAM,KAAK,IACX,MAAM,OAAOD,iBAAO,oBAAoB,CAAC;GAE3C,IACE,cAAc,KAAA,KACd,KAAK,WAAW,KAChB,EAAE,OAAOE,0BAAO,cACd,SACA,KACA,MAAM,QACN,UAAU,iBACV,OAAO,4BAA4B,MAAM,MAAM,CACjD,MACA,CAAC,gBAAgB,OAAO,UAAU,aAAa,GAAG,GAElD,OAAO;IAAE,SAAS,QAAQ,YAAY,OAAO;IAAG,YAAY,CAAC;GAAE;GACjE,MAAM,SAAS,0CAA0C,MAAM,OAAO;GAEtE,MAAM,eAAe;IACnB,MAAM,SAAS,cAAc;IAC7B,MAAM,OAAO;IACb,MAAM;IACN,UAAU;IACV,MAAM;GACR;GAEA,MAAM,MAAM,KAAK,IAAI,GAAG,aAAa,KAAK,UAAU,MAAM,gBAAgB,CAAC;GAE3E,MAAM,OAAOD,cACX,UAAU,SAAS,GAAG,GACtB,mBAAmB,SAAS,WAAW,MAAM,OAAO,QAAQ,GAC5D,GAAG,GAAG,EAAE,GAAG,gBAAgB,MAAM,MAAM,OAAO,eAAe,OAAO,EAAE,GAAG,gBAAgB,KAAK,MAAM,OAAO,mBAC3G,GAAG,aAAa,KAAK,gBACnBD,iBAAO,mBAAmB,GAAG,MAAM,SAAS,cAAc,UAAU,WAAW,CACjF,GACA,IAAI,MAAM,OAAO,cAAc,UAAU,CAAC,EAAA,CAAG,KAC1C,UACC,GAAG,GAAG,EAAE,GAAG,gBAAgB,MAAM,SAAS,cAAc,MAAM,UAAU,EAAE,OAAO,EAAE,GAAG,gBAAgB,KAAK,SAAS,cAAc,MAAM,UAAU,IAAI,KAC1J,CACF;GAEA,IAAI;GACJ,IAAI;GACJ,IAAI;GAEJ,IAAI,MAAM,OAAO,WAAW,gBAAgB;IAC1C,MAAM,WAAW,OAAOA,iBAAO,mBAAmB,GAAG,MAAM,UAAU;KACrD;KACd;KACA;KACA;IACF,CAAC;IAED,IAAI,aAAa,KAAA,GACf,OAAO;KAAE,SAAS,QAAQ,YAAY,OAAO;KAAG,YAAY,CAAC;IAAE;IACjE,WAAW,SAAS;IACpB,gBAAgB,SAAS;IACzB,kBAAkB,SAAS;GAC7B,OAAO;IACL,MAAM,WAAW,OAAOA,iBAAO,2BAC7B,GACA,MAAM,UACN,MAAM,OAAO,QACb;KAAE;KAAoB;KAAiB;IAAqB,CAC9D;IAEA,IAAI,aAAa,KAAA,GACf,OAAO;KAAE,SAAS,QAAQ,YAAY,OAAO;KAAG,YAAY,CAAC;IAAE;IACjE,kBAAkB,SAAS,kBAAkB;IAC7C,iBAAiB,UAAUA,iBAAO,eAAe,OAAO,SAAS,MAAM;IACvE,WAAW,CACT,GAAG,SAAS,kBAAkB,YAC9B,OAAOA,iBAAO,UAAU,SAAS,kBAAkB,kBAAkB,MAAM,CAC7E;GACF;GAEA,MAAM,WAAW;IACf,GAAG;KACF,EAAE,QAAQ,EAAE,OAAO;KACnB,EAAE,WAAW;KACb,EAAE,SAAS;GACd;GAEA,MAAM,oBAAoB;IACxB,YAAY;KACV,OAAOA,iBAAO,UAAU,MAAM,MAAM;KACpC,GAAG;KACH,GAAI,OAAO,mBAAmB,SAAS,KAAK,YAAY,MAAM;IAChE;IACA,kBAAkBC,cAChB,iBACA,UAAU,SAAS,QAAQ,GAC3B,GAAG,GAAG,EAAE,GAAG,gBAAgB,MAAM,MAAM,OAAO,eAAe,OAAO,EAAE,GAAG,gBAAgB,KAAK,MAAM,OAAO,mBAC3G,IAAI,MAAM,OAAO,cAAc,UAAU,CAAC,EAAA,CAAG,KAC1C,UACC,GAAG,GAAG,EAAE,GAAG,gBAAgB,MAAM,SAAS,cAAc,MAAM,UAAU,EAAE,OAAO,EAAE,GAAG,gBAAgB,KAAK,SAAS,cAAc,MAAM,UAAU,IAAI,KAC1J,GACA,GAAG,aAAa,KAAK,gBACnBD,iBAAO,mBAAmB,GAAG,MAAM,SAAS,cAAc,UAAU,WAAW,CACjF,CACF;GACF;GAEA,IAAI,eAAe,KAAA,GAAW;IAC5B,IACE,MAAM,OAAO,UAAU,KAAA,KACvB,WAAW,MAAM,mBAAmB,MAAM,OAAO,MAAM,kBACvD,YAAY,WAAW,MAAM,OAAO,MAAM,YAAY,MAAM,OAAO,MAAM,OAAO,KAChF,CAACA,iBAAO,0BAA0B;KAAE,GAAG,MAAM;KAAU;IAAW,CAAC,GAEnE,OAAO;KAAE,SAAS,QAAQ,YAAY,OAAO;KAAG,YAAY,CAAC;IAAE;IACjE,IAAI;IAEJ,MAAM,WAAW,OAAO,6BACtB,cACA,YACA,oBACC,aAAa;KACZ,UAAU,QAAQ,aAAa,cAAc,YAAY,YAAY,OAAO;KAE5E,OAAO;IACT,CACF;IAEA,OAAO;KACL,YAAY,UACVA,iBAAO,eAAe,OAAO,MAAM,KACnC,gBAAgB,KAAK,MAAM,QAC1B,eAAe,KAAA,MACbA,iBAAO,eACN,OACA,oCAAoC,WAAW,MAAM,gBACvD,KACEA,iBAAO,eACL,OACA,qCAAqC,WAAW,MAAM,gBACxD;KACN,SAAS,WAAW,QAAQ,YAAY,OAAO;KAC/C,YAAY,SAAS;KACrB,gBAAgB,SAAS;IAC3B;GACF;GAEA,MAAM,iBAAiB,CACrB,OAAOA,iBAAO,UAAU,kBAAkB,kBAAkB,MAAM,CACpE;GAEA,OAAO;IACL,YAAY,UACVA,iBAAO,eAAe,OAAO,MAAM,KAAK,gBAAgB,KAAK,MAAM;IACrE,SAAS,QAAQ,WAAW,OAAO;IACnC,YAAY,CAAC,GAAG,kBAAkB,YAAY,GAAG,cAAc;IAC/D;GACF;EACF,CAAC,CACH;CACF,CAAC;CAkhBH,OAAO;EA/gBL,UACE,YACA,YAEA,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,OAAO;GAExB,MAAM,QAAQ,OAAO,gBAAgB,UAAU;GAE/C,IACG,MAAM,WAAW,sBACf,MAAM,UAAU,KAAA,KAAa,MAAM,eAAe,KAAA,MACpD,MAAM,WAAW,oBAAoB,iBAAiB,KAAA,KACvD,MAAM,eAAe,MAAM,OAAO,cAClC,MAAM,OAAO,kBACX,KAAK,IACH,MAAM,OAAO,4BAA4B,MAAM,OAAO,gBACtD,MAAM,OAAO,UAAU,OAAO,cAC9B,MAAM,OAAO,UAAU,QAAQ,cAC/B,MAAM,OAAO,UAAU,WAAW,YACpC,KACD,MAAM,aAAa,qBAAqB,eACvC,EAAE,wBAAwB,4BAE5B,OAAO,OAAO,YAAY;GAE5B,MAAM,UAAU,wBAAwB,KACtC,OAAOA,iBAAO,SAAS,QAAQ,iBAAiB,QAAQ,mBAAmB,CAC7E;GAEA,OAAO,OAAO,IACZ,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO;IAEvB,MAAM,YAAY,OAAOE,0BAAO,iBAAiB,SAAS,QAAQ,KAAK;IAEvE,IAAI,cAAc,KAAA,GAAW,OAAO,OAAO,YAAY;IACvD,IAAI,iBAAsB,GAAG;IAE7B,IAAI,MAAM,UAAU,KAAA,GAAW;KAC7B,IACE,MAAM,eAAe,KAAA,KACrB,MAAM,WAAW,aAAa,GAAG,MAAM,SAAS,WAChD,MAAM,WAAW,YAAY,oBAC7B,MAAM,MAAM,mBAAmB,MAAM,WAAW,kBAChD,YAAY,MAAM,MAAM,OAAO,MAAM,YAAY,MAAM,WAAW,OAAO,KACzE,MAAM,MAAM,QAAQ,SAAS,aAC7B,CAAC,aAAa,MAAM,MAAM,QAAQ,UAAU,UAAU,QAAQ,KAC9D,UAAU,UAAU,+BAA+B,KAAA,GAEnD,OAAO,OAAO,YAAY;KAC5B,MAAM,YAAY,OAAO,uBAAuB,cAAc,MAAM,UAAU;KAE9E,IAAI,CAAC,UAAU,UAAU,OAAO,OAAO,YAAY;KACnD,iBAAiB,UAAU;IAC7B;IAEA,MAAM,eAAeD,cACnB,mBAAmB,SAAS,WAAW,MAAM,QAAQ,GACrD,cACF;IAEA,MAAM,SAAS,yCAAyC,MAAM;IAE9D,MAAM,WAAW,OAAO,SACtBA,cAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,WAAW,MAAM,SAAS,CAAC,CACtE;IAEA,IAAI,SAAS,QACX,OAAO;KACL,YAAY,UAAmBD,iBAAO,eAAe,OAAO,MAAM;KAClE,SAAS,QAAQ,EAAE,MAAM,WAAW,GAAG,OAAO;KAC9C,YAAY,CACV,OAAOA,iBAAO,UACZC,cAAI,cAAc,UAAU,SAAS,SAAS,EAAE,CAAC,GACjD,MACF,CACF;IACF;IAEF,MAAM,MAAM,OAAOD,iBAAO,oBAAoB,CAAC,GAC7C,QAAQ,gBAAgB;KACtB,YAAY,UAAU;KACtB,UAAU,UAAU;IACtB,CAAC;IAEH,MAAM,cAAc,OAAO,oCAAoC;KAC7D,MAAM;KACN,UAAU,MAAM;KAChB,YAAY,MAAM;KAClB,UAAU,MAAM;KAChB;KACA,WAAW,MAAM;KACjB,QAAQ,MAAM;KACd,UAAU,UAAU;KACpB,GAAI,UAAU,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY,UAAU,SAAS;KAC7E,qBAAqB,UAAU;KAC/B,GAAI,MAAM,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;KAC1D,cAAc,MAAM;KACpB,iBAAiB;KACjB,4BAA4B,MAAM,MAAM,OAAO;KAC/C,mBAAmB,MAAM,MAAM,OAAO;IACxC,CAAC;IAED,MAAM,WAAW,OAAO,kBAAkB,WAAW,GACnD,SAAS,KAAK,IACZ,MAAM,OAAO,UAAU,OAAO,cAC9B,MAAM,OAAO,UAAU,WAAW,cAClC,MAAM,OAAO,UAAU,QAAQ,YACjC;IAEF,MAAM,IAAI,QAAQ,WAChB,KAAK,OAAO,EAAE,OAAO,EAAE,QAAQ,GAC/B,KAAK,OAAO,EAAE,OAAO,EAAE,QAAQ,GAC/B,KAAK,OAAO,EAAE,OAAO,EAAE,UAAU,GACjC,KAAK,OAAO,EAAE,OAAO,EAAE,oBAAoB;IAE7C,MAAM,QAAQ,GAAG,WAAW,GAAG,QAAQ,EAAE,MAAM,SAAS,GAAG,KAAK,IAAI,MAAM,MAAM,UAAU,EAAE,EAAE,IAC5F,YAAY,GAAG,WAAW,GAAG,QAAQ,EAAE,MAAM,SAAS,GAAG,KAAK,IAAI,MAAM,MAAM,UAAU,EAAE,EAAE;IAE9F,MAAM,SAAS,GAAG,yBAAyB,EAAE,MAAM,SAAS,EAAE,SAAS,KAAK,IAAI,MAAM,MAAM,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,KAAK,IAAI,MAAM,UAAU,iBAAiB,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,OAAO,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,qBAAqB,KAAK,EAAE,GAAG,UAAU,QAAQ,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,OAAO,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,KAAK,EAAE,GAAG,UAAU,QAAQ,MAAM,OAAO;IAE/Z,MAAM,UAAU;KACd,CAAC,GAAG,EAAE,QAAQ,MAAM,MAAM,GAAG,MAAM,OAAO,UAAU,MAAM;KAC1D,CAAC,GAAG,EAAE,iBAAiB,KAAK,GAAG,MAAM,OAAO,UAAU,UAAU;KAChE,CAAC,GAAG,EAAE,WAAW,UAAU,eAAe,GAAG,MAAM,OAAO,UAAU,OAAO;IAC7E;IAEA,MAAM,oBAAoBC,cACxB,cACA,QACA,GAAG,QAAQ,KACR,CAAC,WAAW,YACX,GAAG,yBAAyB,EAAE,MAAM,SAAS,EAAE,SAAS,KAAK,IAAI,MAAM,MAAM,UAAU,EAAE,QAAQ,EAAE,OAAO,UAAU,OAAO,EAAE,WAAW,KAAK,EAAE,GAAG,mBAAmB,OAAO,YAAY,EAAE,MAAM,OAAO,OAC3M,GACA,GAAG,4BAA4B,EAAE,MAAM,SAAS,EAAE,SAAS,KAAK,IAAI,MAAM,MAAM,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,KAAK,IAAI,MAAM,MAAM,WAAW,EAAE,SAAS,EAAE,IACtK,GAAG,GAAG,EAAE,GAAG,gBAAgB,MAAM,IAAI,OAAO,EAAE,GAAG,gBAAgB,KAAK,YAAY,4BACpF;IAEA,MAAM,iBAAiB,QAAQ,eAAe,SAAS,KAAK,GAC1D,iBAAiB,QAAQ,eAAe,SAAS,SAAS;IAE5D,MAAM,aAAaA,cACjB,GAAG,wBAAwB,EAAE,MAAM,SAAS,GAAG,KAAK,IAAI,MAAM,MAAM,UAAU,EAAE,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,MAAM,UAAU,EAAE,EAAE,IAC/H,GAAG,GAAG,eAAe,MAAM,IAAI,OAAO,eAAe,MAAM,EAAE,GAAG,mBAChE,GAAG,GAAG,eAAe,KAAK,eAAe,KAAK,QAChD;IAEA,MAAM,QAAQA,cAAI,GAAG,iBAAiB,UAAU;IAEhD,MAAM,SAAS;KACb,GAAG,EAAE,aAAa;MAChB;MACA,iBAAiB,UAAU;MAC3B,iBAAiB;MACjB;MACA,kBAAkB;MAClB,4BAA4B,MAAM;KACpC,CAAC;MACA,EAAE,aAAa;MACf,EAAE,uBAAuB;IAC5B;IAEA,MAAM,WAAW;MACd,EAAE,WAAW,MAAM;MACnB,EAAE,WAAW,MAAM;MACnB,EAAE,YAAY,MAAM;MACpB,EAAE,YAAY,UAAU;MACxB,EAAE,SAAS,MAAM;MACjB,EAAE,aAAa,MAAM;MACrB,EAAE,UAAU;MACZ,EAAE,QAAQ,EAAE,OAAO;MACnB,EAAE,SAAS;MACX,EAAE,WAAW;MACb,EAAE,kBAAkB;MACpB,EAAE,YAAY,EAAE,cAAc,GAAG;MACjC,EAAE,uBAAuB,EAAE,cAAc,YAAY,0BAA0B;MAC/E,EAAE,YAAY;MACd,EAAE,cAAc,EAAE,cAAc,YAAY,iBAAiB;MAC7D,EAAE,aAAa;MACf,EAAE,uBAAuB;IAC5B;IAEA,OAAO;KACL,YAAY,UAAmBD,iBAAO,eAAe,OAAO,MAAM;KAClE,SAAS,QAAQ;MAAE,MAAM;MAAY;KAAY,GAAG,OAAO;KAC3D,YAAY;MACV,OAAOA,iBAAO,UACZ,SACG,OAAO,EAAE,KAAK,CAAC,CACf,OAAO,EAAE,aAAa,MAAM,QAAQ,CAAC,CAAC,CACtC,oBAAoB,CACzB;MACA,OAAOA,iBAAO,UACZ,SACG,OAAO,EAAE,KAAK,CAAC,CACf,IACC,aAAa;OACX,CAAC,EAAE,UAAU,MAAM,QAAQ;OAC3B,CAAC,EAAE,YAAY,EAAE,GAAG,SAAS;OAC7B,CAAC,EAAE,sBAAsB,EAAE,GAAG,kBAAkB,MAAM,CAAC;MACzD,CAAC,CACH,CAAC,CACA,MAAMC,cAAI,GAAG,IAAI,MAAM,QAAQ,GAAG,iBAAiB,CAAC,CACzD;MACA,OAAOD,iBAAO,UAAU,OAAO,aAAa,EAAE,OAAO,QAAQ,KAAK,CAAC;MACnE,OAAOA,iBAAO,UAAU,UAAU,SAAS,QAAQ,GAAG,MAAM;MAC5D,OAAOA,iBAAO,UACZC,cACE,cACA,YACA,GAAG,GAAG,EAAE,GAAG,gBAAgB,KAAK,YAAY,8BAC5C,GAAG,yBAAyB,EAAE,MAAM,SAAS,EAAE,SAAS,KAAK,IAAI,MAAM,MAAM,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,KAAK,IAAI,MAAM,UAAU,iBAAiB,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,OAAO,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,qBAAqB,KAAK,EAAE,GAAG,UAAU,QAAQ,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,OAAO,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,KAAK,EAAE,GAAG,UAAU,SAAS,MAAM,OAAO,4BACjZ,GAAG,QAAQ,KACR,CAAC,WAAW,YACX,GAAG,yBAAyB,EAAE,MAAM,SAAS,EAAE,SAAS,KAAK,IAAI,MAAM,MAAM,UAAU,EAAE,QAAQ,EAAE,OAAO,UAAU,OAAO,EAAE,WAAW,KAAK,EAAE,GAAG,mBAAmB,OAAO,YAAY,EAAE,OAAO,OAAO,OAC5M,CACF,GACA,MACF;KACF;IACF;GACF,CAAC,CACH;EACF,CAAC;EACH,eACE,YACA,YAEA,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,OAAO;GAExB,MAAM,cAAc,OAAO,oCAAoC,WAAW,WAAW,GACnF,QAAQ,OAAO,8BAA8B,WAAW,KAAK,GAC7D,WAAW,OAAO,kBAAkB,WAAW,GAC/C,gBAAgB,OAAO,4BAA4B,KAAK;GAE1D,KAAK,OAAO,kBAAkB,cAAc,KAAK,CAAC,OAAO,UACvD,OAAO,OAAO,YAAY;GAE5B,OAAO,OAAO,IACZ,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO;IAEvB,MAAM,YAAY,OAAO,QAAQ,WAAW,GAC1C,OAAO,OAAO,SACZA,cAAI,GAAG,EAAE,UAAU,YAAY,QAAQ,GAAG,GAAG,EAAE,UAAU,YAAY,QAAQ,CAAC,CAChF,GACA,MAAM,KAAK;IAEb,IACE,cAAc,KAAA,KACd,KAAK,WAAW,KAChB,EAAE,OAAOC,0BAAO,cACd,SACA,KACA,aACA,UAAU,iBACV,QACF,IAEA,OAAO;KAAE,SAAS,QAAQ,YAAY,OAAO;KAAG,YAAY,CAAC;IAAE;IAEjE,MAAM,SAAS,uCAAuC,MAAM,YAC1D,OAAOD,cACL,mBAAmB,SAAS,WAAW,MAAM,QAAQ,GACrD,GAAG,GAAG,EAAE,GAAG,gBAAgB,MAAM,MAAM,eAAe,OAAO,EAAE,GAAG,gBAAgB,KAAK,YAAY,2BAA2B,OAAO,EAAE,GAAG,gBAAgB,KAAK,MAAM,iBACvK;IAEF,MAAM,WAAW;KACf,GAAG;MACF,EAAE,QAAQ,EAAE,OAAO;MACnB,EAAE,WAAW;MACb,EAAE,SAAS,MAAM;MACjB,EAAE,YAAY,EAAE,cAAc,MAAM,eAAe;IACtD;IAEA,OAAO;KACL,YAAY,UAAmBD,iBAAO,eAAe,OAAO,MAAM;KAClE,SAAS,QAAQ,aAAa,OAAO;KACrC,YAAY;MACV,OAAOA,iBAAO,UAAUC,cAAI,MAAM,UAAU,SAAS,GAAG,CAAC,GAAI,MAAM;MACnE,OAAOD,iBAAO,UACZ,SACG,OAAO,EAAE,KAAK,CAAC,CACf,IAAI,EAAE,YAAY;OAAE;OAAO,UAAU;MAAc,CAAC,CAAC,CAAC,CACtD,MAAME,0BAAO,aAAa,SAAS,GAAG,CAAC,CAC5C;MACA,OAAOF,iBAAO,UAAUC,cAAI,MAAM,UAAU,SAAS,QAAQ,CAAC,GAAI,MAAM;KAC1E;IACF;GACF,CAAC,CACH;EACF,CAAC;EACH,UAAU,eACR,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,OAAO;GAExB,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;GAErD,MAAM,QAAQ,OAAO,OAAO,aAAa,YAAY,CAAC,CAAC,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,KACtE,OAAO,SAAS,WAAW,CAC7B,GACA,OAAO,OAAO,SACZA,cACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,YAAY,MAAM,UAAU,GACjC,GAAG,EAAE,QAAQ,MAAM,MAAM,GACzB,GAAG,EAAE,OAAO,EAAE,OAAO,KAAK,CAC5B,CACF;GAEF,IAAI,KAAK,WAAW,GAAG,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;GAE7D,MAAM,SAAS,OAAO,4BAA4B,KAAK,EAAE,CAAC,EAAE,SAAS,GACnE,YAAY,OAAO,QAAQ,MAAM;GAEnC,IACE,cAAc,KAAA,KACd,OAAO,aAAa,MAAM,YAC1B,OAAO,eAAe,MAAM,cAC5B,OAAO,WAAW,MAAM,UACxB,EAAE,OAAOC,0BAAO,cACd,SACA,KAAK,IACL,QACA,UAAU,iBACV,OAAO,4BAA4B,MAAM,CAC3C,IAEA,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;GAExC,MAAM,YAAYD,cAChBC,0BAAO,aAAa,SAAS,KAAK,EAAE,GACpC,mBAAmB,SAAS,WAAW,OAAO,QAAQ,GACtD,GAAG,GAAG,EAAE,GAAG,gBAAgB,MAAM,OAAO,eAAe,OAAO,EAAE,GAAG,gBAAgB,KAAK,OAAO,iBACjG;GAEA,MAAM,iBAAiB,OAAOF,iBAAO,UACnC,GAAG,wBAAwB,EAAE,MAAM,SAAS,UAAU,IACtD,yCAAyC,OAAO,UAClD;GAEA,MAAM,QAAQ,OAAO,OAAO,IAAI;IAC9B,WAAW,4BAA4B,SAAS,SAAS,gBAAgB,WAAW;IACpF,QAAQ,UACN,OAAO,GAAG,mBAAmB,CAAC,CAAC,KAAK,IAChC,QACA,wBAAwB,KAAK;KAAE,WAAW;KAAW;IAAM,CAAC;GACpE,CAAC;GAED,OAAO,SAAS,QACb,MAAM,CAAC,KAAK,CAAC,CAAC,CACd,KACC,OAAO,YAEH,UAEA,oBAAoB,QAAQ,YAC1BA,iBAAO,eACL,SACA,yCAAyC,OAAO,UAClD,CACF,IACI,OAAO,KAAK,iBAAiB,KAAK,CAAC,CAAC,CAAC,IACrC,OAAO,UAAU,KAAK,CAC9B,CACF;GAEF,OAAO;IAAE;IAAQ,oBAAoB,UAAU;GAAY;EAC7D,CAAC;EACH;EACA,gBAAgB;EAChB,SACE,YACA,YAEA,OAAO,IAAI,aAAa;GACtB,MAAM,SAAS,OAAO,8BAA8B,WAAW,MAAM;GAErE,OAAO,OAAO,IACZ,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO;IAEvB,MAAM,YAAY,OAAO,QAAQ,MAAM,GACrC,OAAO,OAAO,SACZC,cAAI,GAAG,EAAE,UAAU,OAAO,QAAQ,GAAG,GAAG,EAAE,UAAU,OAAO,QAAQ,CAAC,CACtE,GACA,MAAM,KAAK;IAEb,IACE,cAAc,KAAA,KACd,KAAK,WAAW,KAChB,EAAE,OAAOC,0BAAO,cACd,SACA,KACA,QACA,UAAU,iBACV,OAAO,4BAA4B,MAAM,CAC3C,IAEA,OAAO;KAAE,SAAS,QAAQ,OAAO,OAAO;KAAG,YAAY,CAAC;IAAE;IAC5D,MAAM,SAAS,wCAAwC,OAAO;IAE9D,OAAO;KACL,YAAY,UAAmBF,iBAAO,eAAe,OAAO,MAAM;KAClE,SAAS,QAAQ,MAAM,OAAO;KAC9B,YAAY,CACV,OAAOA,iBAAO,UACZC,cACE,UAAU,SAAS,GAAG,GACtB,mBAAmB,SAAS,WAAW,OAAO,QAAQ,GACtD,GAAG,GAAG,EAAE,GAAG,gBAAgB,MAAM,OAAO,eAAe,OAAO,EAAE,GAAG,gBAAgB,KAAK,OAAO,iBACjG,GACA,MACF,GACA,GAAI,OAAO,mBAAmB,SAAS,KAAK,aAAa,MAAM,CACjE;IACF;GACF,CAAC,CACH;EACF,CAAC;EACH,UACE,YACA,YAEA,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,OAAO;GAExB,MAAM,QAAQ,EAAE,GAAG,WAAW;GAE9B,IAAI,CAAC,OAAO,cAAc,MAAM,KAAK,KAAK,MAAM,QAAQ,KAAK,MAAM,QAAQ,KACzE,OAAO,OAAO,YAAY;GAE5B,OAAO,OAAO,IACZ,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO;IAEvB,MAAM,MAAMA,cACV,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GACEA,cACE,IAAI,EAAE,aAAa,EAAE,GAAG,SAAS,GACjC,IAAI,EAAE,sBAAsB,EAAE,GAAG,SAAS,CAC5C,GACAA,cACE,UAAU,EAAE,QAAQ,GACpB,GACEA,cACE,GAAG,EAAE,OAAO,EAAE,OAAO,SAAS,GAC9B,IAAI,EAAE,sBAAsB,EAAE,GAAG,SAAS,CAC5C,GACAA,cAAI,GAAG,EAAE,OAAO,EAAE,OAAO,KAAK,GAAG,IAAI,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC,CACnE,CACF,CACF,CACF;IAEA,MAAM,OAAO,OAAO,SACjB,OAAO,CAAC,CACR,KAAK,EAAE,KAAK,CAAC,CACb,MAAM,GAAG,CAAC,CACV,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,CAChC,MAAM,MAAM,QAAQ,CAAC;IAExB,MAAM,MAAM,OAAOD,iBAAO,oBAAoB,CAAC,GAC7C,aAA+B,CAAC,GAChC,SAAS,yCAAyC,MAAM;IAE1D,IAAI,UAAU;IAEd,KAAK,MAAM,OAAO,KAAK,MAAM,GAAG,MAAM,KAAK,GAAG;KAC5C,MAAM,WAAW,OAAO,EAAE,cAAc,IAAI,EAAE,YAAY,GACxD,SAAS,OAAO,EAAE,cAAc,IAAI,EAAE,qBAAqB;KAE7D,WAAW,KACT,OAAOA,iBAAO,UACZC,cACE,UAAU,SAAS,GAAG,GACtB,GAAG,wBAAwB,EAAE,MAAM,SAASC,0BAAO,aAAa,SAAS,GAAG,EAAE,OAAO,IAAI,EAC3F,GACA,MACF,CACF;KACA,IAAI,YAAY,OAAO,UAAU,KAAK;MACpC,WAAW,KACT,OAAOF,iBAAO,UACZ,SACG,OAAO,EAAE,KAAK,CAAC,CACf,MACCC,cACEC,0BAAO,aAAa,SAAS,GAAG,GAChC,IAAI,EAAE,aAAa,EAAE,GAAG,SAAS,GACjC,IAAI,EAAE,sBAAsB,EAAE,GAAG,SAAS,CAC5C,CACF,CACJ,GACA,OAAOF,iBAAO,UACZ,GAAG,4BAA4B,EAAE,MAAM,SAAS,EAAE,SAAS,KAAK,IAAI,MAAM,MAAM,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,KAAK,IAAI,MAAM,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,IACpK,MACF,CACF;MACA;KACF,OACE,WAAW,KAAK,GAAI,OAAO,mBAAmB,SAAS,KAAK,WAAW,MAAM,CAAE;IACnF;IACA,MAAM,UAAU,KAAK,SAAS,MAAM;IAEpC,WAAW,KACT,OAAOA,iBAAO,UACZ,UACI,GAAG,wBAAwB,EAAE,MAAM,SAAS,IAAI,KAChD,GAAG,4BAA4B,EAAE,MAAM,SAAS,IAAI,IACxD,MACF,CACF;IAEA,OAAO;KACL,YAAY,UAAmBA,iBAAO,eAAe,OAAO,MAAM;KAClE,SAAS,QAAQ;MAAE;MAAS;KAAQ,GAAG,OAAO;KAC9C;IACF;GACF,CAAC,CACH;EACF,CAAC;CAGS;AAChB;AAEA,MAAa,6CAoBX,UACA,SACA,iBAEA,OAAO,IAAI,aAAa;CACtB,MAAM,QAAQ,OAAO;CACrB,MAAM,QAAQ,kBAAkB,SAA+B,YAAY;CAE3E,MAAM,OAAsB,SAC1B,OAAO,IAAI,aAAa;EACtB,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;EAErD,OAAO,OAAO,kBAAkB,IAAI;CACtC,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,2BAA2B,QAAQ,GACzD,OAAO,eAAe,oBAAoB,QAA0C,GACpF,OAAO,eAAe,gBAAgB,KAAK,CAC7C;CAsBF,OAAO,EAAE,6BAA6B;EAnBpC,UAAU,OAAO,YAAY,IAAI,MAAM,QAAQ,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,gBAAgB;EACrF,eAAe,OAAO,YACpB,IAAI,MAAM,aAAa,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,gBAAgB;EAC/D,UAAU,UACR,MACG,QAAQ,KAAK,CAAC,CACd,KACC,OAAO,eAAe,2BAA2B,QAAQ,GACzD,OAAO,eAAe,oBAAoB,QAA0C,GACpF,OAAO,eAAe,gBAAgB,KAAK,GAC3C,uBACF;EACJ,WAAW,OAAO,YAAY,IAAI,MAAM,SAAS,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,gBAAgB;EACvF,iBAAiB,OAAO,YACtB,IAAI,MAAM,eAAe,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,gBAAgB;EACjE,SAAS,OAAO,YAAY,IAAI,MAAM,OAAO,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,gBAAgB;EACnF,UAAU,OAAO,YAAY,IAAI,MAAM,QAAQ,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,gBAAgB;CAG3C,EAAE;AAChD,CAAC;AAEH,SAAgB,wCA0Bd,SACA,SAmBA,MAKA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO;EAErB,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;EA0HrD,QAAO,OAxHe,uBAElB,OAAO,IAAI,aAAa;GACtB,MAAM,aAA+B,CAAC;GACtC,IAAI;GACJ,IAAI,WAAW;GAEf,MAAM,kBAAkB,kBAAkB,GAAG,EAC3C,SAAS,cAAc,OAAO,WAAW,WAAW,KAAK,SAAS,CAAC,EACrE,CAAC;GAED,MAAM,QAAQ,OAAO,YAAY,YAAY,CAAC,CAAC,CAAC,KAC9C,OAAO,eAAe,mBAAmB,eAAe,CAC1D;GAEA,MAAM,WAA0B,WAC9B,OAAO,KACL,OAAO,cACL,OAAO,WAAW;IAChB,WAAW;GACb,CAAC,CACH,CACF;GAEF,MAAM,QAAQ,kBACZ,QAAQ,SACR,QAAQ,YACV;GAEA,MAAM,OAAsB,SAC1B,uBAEI,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO;IACvB,MAAM,UAAU,OAAO;IAEvB,OAAO,MAAM;IACb,IAAI,aAAa,KAAA,GAAW,OAAO,OAAO,YAAY;IACtD,MAAM,UAAU;KAAE,GAAG;KAAS,cAAc,QAAQ,QAAQ,KAAA,CAAS;IAAE;IAEvE,WAAW;IACX,WAAW,KAAK,GAAG,QAAQ,UAAU;IAErC,OAAO,QAAQ;GACjB,CAAC,GACH,EAAE,MAAM,QAAQ,CAClB,CAAC,CAAC,KACA,OAAO,KAAK,WAAW,OAAO,KAAK,GACnC,OAAO,eAAe,2BAA2B,QAAQ,GACzD,OAAO,eACL,oBACA,QACF,GACA,OAAO,eAAe,gBAAgB,KAAK,CAC7C;GAmCF,MAAM,WAAW,QAAQ,KAAK,QAAQ,QAAQ;IAhC5C,UAAU,OAAO,YACf,MAAM,IAAI,QAAQ,IAAI,MAAM,QAAQ,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,gBAAgB,CAAC,CAAC;IAC9E,eAAe,OAAO,YACpB,MAAM,IAAI,QAAQ,IAAI,MAAM,aAAa,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,gBAAgB,CAAC,CAAC;IACnF,UAAU,UACR,MAAM,IACJ,QACE,MACG,QAAQ,KAAK,CAAC,CACd,KACC,OAAO,eAAe,2BAA2B,QAAQ,GACzD,OAAO,eACL,oBACA,QACF,GACA,OAAO,eAAe,gBAAgB,KAAK,GAC3C,uBACF,CACJ,CACF;IACF,WAAW,OAAO,YAChB,MAAM,IAAI,QAAQ,IAAI,MAAM,SAAS,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,gBAAgB,CAAC,CAAC;IAC/E,iBAAiB,OAAO,YACtB,MAAM,IACJ,QAAQ,IAAI,MAAM,eAAe,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,gBAAgB,CAAC,CAC1E;IACF,SAAS,OAAO,YACd,MAAM,IAAI,QAAQ,IAAI,MAAM,OAAO,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,gBAAgB,CAAC,CAAC;IAC7E,UAAU,OAAO,YACf,MAAM,IAAI,QAAQ,IAAI,MAAM,QAAQ,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,gBAAgB,CAAC,CAAC;GAG5B,CAAC,CAAC,CAAC,KACrD,QAAQ,IAAI,mBAAmB,MAAM,SAAS,CAChD;GAEA,MAAM,QAAQ,OAAO,MAAM,MAAM,OAAO,eAAe,MAAM,QAAQ,CAAC;GAEtE,IAAI,UAAU,OAAO,OAAO,YAAY;GACxC,IAAI,UAAU,iBAAiB,KAAA,GAAW;IACxC,MAAM,SAAS,OAAO,OAAO,OAAO,SAAS,aAAa,IAAI;IAE9D,IAAI,OAAO,SAAS,aAAa,OAAO,QAAQ,SAAS,iBACvD,OAAO,OAAO,YAAY;GAC9B;GACA,OAAO,SAAS,QACb,MAAM,CAAC,GAAG,YAAY,GAAI,UAAU,kBAAkB,CAAC,CAAE,CAAC,CAAC,CAC3D,KACC,OAAO,YAAY,UACjB,OAAO,UACL,MAAM,IAAI,QAAQ,UAChB,oBAAoB,OAAO,UAAU,SAAS,IAAI,YAAY,IAAI,KACpE,CACF,CACF,GACA,gBACF;GAEF,OAAO;EACT,CAAC,GACH,EAAE,MAAM,QAAQ,CAClB,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC,EAAA,CAErC;CAChB,CAAC,CACH;AACF;AAEA,MAAM,oBACJ,WAEA,yBACE,SACC,UACC,OAAO,GAAG,mBAAmB,CAAC,CAAC,KAAK,KACpC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,sBAAsB,CAAC,CAAC,KAAK,CAC3C,CAAC,CAAC,KAAK,OAAO,YAAY,UAAU,OAAO,UAAU,MAAM,IAAI,aAAa,YAAY,CAAC,CAAC,CAAC,CAAC;AAE9F,MAAM,2BACJ,WAEA,yBACE,SACC,UACC,OAAO,GAAG,mBAAmB,CAAC,CAAC,KAAK,KACpC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,sBAAsB,CAAC,CAAC,KAAK,CAC3C,CAAC,CAAC,KACA,OAAO,YAAY,UACjB,OAAO,UACL,MAAM,IAAI,QAAQ,UAAW,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,IAAI,QAAQ,YAAY,CAAE,CAC1F,CACF,CACF;AAEF,MAAM,qBAA8B,SAClC,OAAO,cAAc;CACnB,IAAI;CAEJ,OAAO,uBAEH,OAAO,IAAI,aAAa;EACtB,MAAM,WAAW,OAAO;EACxB,MAAM,UAAU,OAAO;EAEvB,YAAY,QAAQ;EACpB,OAAO,SAAS,QAAQ,MAAM,CAAC,GAAG,QAAQ,YAAY,GAAI,QAAQ,kBAAkB,CAAC,CAAE,CAAC;EAExF,OAAO,QAAQ;CACjB,CAAC,GACH,EAAE,MAAM,QAAQ,CAClB,CAAC,CAAC,KACA,OAAO,KAAK,WAAW,OAAO,KAAK,GACnC,OAAO,YAAY,UACjB,OAAO,UACL,MAAM,IAAI,QAAQ,UAChB,oBAAoB,OAAO,SAAS,IAAI,YAAY,IAAI,KAC1D,CACF,CACF,CACF;AACF,CAAC"}
+{"version":3,"file":"d1-password-prepared.mjs","names":["kernel","and","shared","DatabaseService"],"sources":["../../src/drizzle/d1-password-prepared.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- driver exports preserve concrete consumer mappings. */\nimport type { D1Client } from \"@effect/sql-d1/D1Client\";\nimport {\n  coordinateCommit,\n  CurrentCommitJournal,\n  hasCommitScope,\n  type CommitJournal,\n  type PreparedCommit,\n  LifecycleHooks,\n  HookConfigurationError,\n} from \"@yielded/auth/Hooks\";\nimport {\n  PasswordRejected,\n  PasswordUnavailable,\n  PasswordPreparedVersion,\n  decodePasswordPreparedReady,\n  encodePasswordPreparedReady,\n  snapshotPasswordPreparedReady,\n  snapshotPasswordPreparedReservation,\n  type PasswordPreparedReady,\n  type PasswordPreparedReservation,\n  type PasswordMutationDecision,\n  type PreparePasswordCommit,\n  type PasswordPreparedMutation,\n  type PasswordPreparedPersistence,\n} from \"@yielded/auth/Password\";\nimport { reportPersistenceFailure } from \"@yielded/auth/Persistence\";\nimport { type ProofCompletionPlan, ProofUnavailable, ProofBinding } from \"@yielded/auth/Proofs\";\nimport { eq, is, isNotNull, lte, or, SQL, sql, type AnyRelations, type Table } from \"drizzle-orm\";\nimport type { EffectSQLiteD1Database } from \"drizzle-orm/effect-d1\";\nimport type { AnySQLiteTable } from \"drizzle-orm/sqlite-core\";\nimport { Cause, DateTime, Effect, Predicate, Redacted, Schema, Context } from \"effect\";\nimport type { Statement } from \"effect/sql/Statement\";\n\nimport { Database as DatabaseService } from \"./d1-database\";\nimport { balancedD1And as and, compactD1GeneratedStatement } from \"./d1-generated-statement\";\nimport { passwordD1Kernel as kernel } from \"./d1-passwords\";\nimport { CurrentD1PlanningDatabase, makeD1Owner } from \"./d1-planning\";\nimport { checkD1ProofCompletion, compileD1ProofCompletionPlan } from \"./d1-proofs\";\nimport { D1BatchStatements } from \"./D1BatchStatements\";\nimport { PersistenceMappingError, column, updateValues } from \"./model\";\nimport type {\n  D1PasswordPreparedPersistenceMapping,\n  D1PasswordPreparedProofMapping,\n} from \"./password-prepared-model\";\nimport { passwordPreparedSqlKernel as shared } from \"./password-prepared-sql\";\nimport {\n  ContextInput,\n  CompletionInput,\n  encodeReservation,\n  evidenceCurrent,\n  identifierScope,\n  reservationOf,\n  sameRevision,\n  snapshotMutation,\n  snapshotReserve,\n  unavailable,\n} from \"./password-prepared-state\";\nimport { CurrentPasswordSql, type PasswordSqlDatabase } from \"./password-sql\";\nimport type { SuppliedService } from \"./SuppliedService\";\n\ntype PlanPrepare<Method extends (...args: any[]) => any, A> = (\n  value: Parameters<Parameters<Method>[1]>[0],\n  journal: CommitJournal,\n) => PreparedCommit<A>;\n\ntype Database = EffectSQLiteD1Database<AnyRelations> & { readonly $client: D1Client };\ntype Mapping = D1PasswordPreparedPersistenceMapping<\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  unknown\n>;\ninterface Planned<A> {\n  readonly retryable?: (cause: unknown) => boolean;\n  readonly receipt: PreparedCommit<A>;\n  readonly statements: ReadonlyArray<Statement<any>>;\n  readonly postconditions?: ReadonlyArray<Statement<any>>;\n  readonly journalGuard?: PreparedCommit<void>;\n}\n\nconst everyFailureMatches = (\n  cause: Cause.Cause<unknown>,\n  classify: ((cause: unknown) => boolean) | undefined,\n): boolean =>\n  classify !== undefined &&\n  cause.reasons.length > 0 &&\n  cause.reasons.every((reason) => Cause.isFailReason(reason) && classify(Cause.fail(reason.error)));\n\nconst bindingJson = Schema.encodeSync(Schema.fromJsonString(ProofBinding));\n\nconst authorityCondition = (mapping: Mapping, current: any, moduleId: string) => {\n  const p = mapping.password,\n    s = kernel.subjectColumns(p),\n    i = kernel.identifierColumns(p),\n    c = kernel.credentialColumns(p),\n    ac = kernel.authorityColumns(p);\n\n  const snapshot = current.snapshot,\n    native = current.nativeSubjectId;\n\n  const identifier =\n    snapshot === undefined\n      ? sql`true`\n      : and(\n          p.identifier.d1CurrentCondition({\n            identifier: snapshot.identifier,\n            nativeSubjectId: native,\n          }),\n          sql`exists(select 1 from ${p.identifier.table} where ${i.namespace} = ${sql.param(snapshot.identifier.namespace, i.namespace)} and ${i.value} = ${sql.param(snapshot.identifier.value, i.value)} and ${i.subjectId} = ${sql.param(native, i.subjectId)} and ${i.bindingRevision} = ${sql.param(snapshot.identifierBindingRevision, i.bindingRevision)} and ${Predicate.isNullish(current.identifier[p.identifier.verifiedAt]) ? sql`${i.verifiedAt} is null` : sql`${i.verifiedAt} = ${sql.param(current.identifier[p.identifier.verifiedAt], i.verifiedAt)}`})`,\n        )!;\n\n  return and(\n    sql`exists(select 1 from ${p.subject.table} where ${s.id} = ${sql.param(native, s.id)} and ${s.status} = ${sql.param(p.subject.d1ActiveStatusValue, s.status)} and ${s.securityRevision} = ${sql.param(current.revision.securityRevision, s.securityRevision)})`,\n    identifier,\n    snapshot === undefined\n      ? sql`not exists(select 1 from ${p.credential.table} where ${c.moduleId} = ${sql.param(moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(native, c.subjectId)})`\n      : sql`exists(select 1 from ${p.credential.table} where ${c.moduleId} = ${sql.param(moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(native, c.subjectId)} and ${c.credentialId} = ${sql.param(snapshot.credentialId, c.credentialId)} and ${c.credentialRevision} = ${sql.param(snapshot.credentialRevision, c.credentialRevision)} and ${c.verifierVersion} = ${sql.param(snapshot.verifierVersion, c.verifierVersion)} and ${c.verifier} = ${sql.param(Redacted.value(snapshot.verifier), c.verifier)} and ${c.normalization} = ${sql.param(snapshot.normalization, c.normalization)})`,\n    ...current.revision.credentials.map(\n      (entry: any) =>\n        sql`exists(select 1 from ${p.authorityCredential.table} where ${ac.subjectId} = ${sql.param(native, ac.subjectId)} and ${ac.credentialId} = ${sql.param(entry.credentialId, ac.credentialId)} and ${ac.revision} = ${sql.param(entry.revision, ac.revision)}${ac.status === undefined ? sql`` : sql` and ${ac.status} = ${sql.param(p.authorityCredential.d1ActiveStatusValue, ac.status)}`})`,\n    ),\n  )!;\n};\n\nconst existsRow = (mapping: Mapping, row: any) =>\n  sql`exists(select 1 from ${mapping.intent.table} where ${shared.rowCondition(mapping, row)})`;\n\nconst terminalStatements = Effect.fn(function* (\n  mapping: Mapping,\n  row: any,\n  state: \"Consumed\" | \"Cancelled\" | \"Expired\",\n  marker: string,\n) {\n  const database = yield* CurrentD1PlanningDatabase;\n  const t = mapping.intent;\n\n  return [\n    yield* kernel.statement(\n      database\n        .update(t.table)\n        .set(t.encodeTerminal(state))\n        .where(shared.rowCondition(mapping, row)),\n    ),\n    yield* kernel.assertion(\n      existsRow(mapping, {\n        ...row,\n        [t.state]: t.states[state],\n        [t.snapshot]: null,\n        [t.digest]: null,\n      }),\n      marker,\n    ),\n  ];\n});\n\nconst selectInsert = Effect.fn(function* (table: Table, values: object, condition: SQL) {\n  const database = yield* CurrentD1PlanningDatabase;\n\n  const selected = Object.fromEntries(\n    Object.entries(values)\n      .filter(([, value]) => value !== undefined)\n      .map(([key, value]) => [\n        key,\n        (is(value, SQL) ? value : sql`${sql.param(value, column(table, key as never))}`).as(key),\n      ]),\n  );\n\n  return database.insert(table as any).select(\n    database\n      .select(selected)\n      .from(sql`(select 1)`)\n      .where(condition),\n  );\n});\n\nconst makePreparedPlans = (mapping: Mapping, proofMapping?: any) => {\n  const p = mapping.password,\n    t = mapping.intent,\n    c = shared.columns(mapping),\n    config = { locking: false };\n\n  const readRows = Effect.fn(function* (condition: SQL) {\n    const database = yield* CurrentD1PlanningDatabase;\n\n    return yield* database.select().from(t.table).where(condition).limit(2);\n  });\n\n  const run = <A, E, R>(plan: Effect.Effect<Planned<A>, E, R>) =>\n    Effect.gen(function* () {\n      const database = yield* CurrentD1PlanningDatabase;\n\n      return yield* shared.valid(mapping)\n        ? plan.pipe(\n            Effect.flatMap((planned) =>\n              Effect.try({\n                try: () => ({\n                  ...planned,\n                  statements: planned.statements.map((statement) =>\n                    compactD1GeneratedStatement(database.$client, statement, unavailable),\n                  ),\n                  postconditions: planned.postconditions?.map((statement) =>\n                    compactD1GeneratedStatement(database.$client, statement, unavailable),\n                  ),\n                }),\n                catch: (cause) =>\n                  Schema.is(PasswordUnavailable)(cause)\n                    ? cause\n                    : PersistenceMappingError.make({ operation: \"mapping\", cause }),\n              }),\n            ),\n          )\n        : Effect.fail(unavailable());\n    });\n\n  const current = (record: PasswordPreparedReservation | PasswordPreparedReady) =>\n    shared.currentAuthority(mapping, config, record);\n\n  const complete = <A>(\n    uncaptured: PasswordPreparedMutation & { readonly completion?: ProofCompletionPlan },\n    prepare: PreparePasswordCommit<PasswordMutationDecision, A>,\n  ) =>\n    Effect.gen(function* () {\n      const input = yield* snapshotMutation(uncaptured);\n\n      const completion =\n        uncaptured.completion === undefined\n          ? undefined\n          : {\n              prepare: uncaptured.completion.prepare,\n              input: yield* Schema.encodeEffect(Schema.fromJsonString(CompletionInput))(\n                uncaptured.completion.input,\n              ).pipe(\n                Effect.flatMap(Schema.decodeEffect(Schema.fromJsonString(CompletionInput))),\n                Effect.mapError(unavailable),\n              ),\n            };\n\n      if (\n        (input.intent.action === \"reset-password\") !== (completion !== undefined) ||\n        (completion !== undefined && proofMapping === undefined)\n      )\n        return yield* unavailable();\n\n      const credentialRevision = yield* kernel.allocate(p.allocateRevision, p.allocateRevisionSync),\n        verifierVersion = yield* kernel.allocate(p.allocateRevision, p.allocateRevisionSync),\n        nextSecurityRevision = yield* kernel.allocateNextSecurityRevision(\n          p,\n          input.intent.revision.securityRevision,\n        );\n\n      if (\n        nextSecurityRevision === input.intent.revision.securityRevision ||\n        credentialRevision === input.intent.credential?.credentialRevision ||\n        verifierVersion === input.intent.credential?.verifierVersion\n      )\n        return yield* unavailable();\n\n      const credentialId =\n        input.intent.action === \"add-password\"\n          ? yield* kernel.allocate(p.allocateCredentialId, p.allocateCredentialIdSync)\n          : undefined;\n\n      return yield* run(\n        Effect.gen(function* () {\n          const journal = yield* CurrentCommitJournal;\n\n          const authority = yield* current(input.intent),\n            rows = yield* readRows(\n              and(eq(c.moduleId, input.intent.moduleId), eq(c.intentId, input.intent.intentId))!,\n            ),\n            row = rows[0],\n            now = yield* kernel.readEngineNowMillis(p);\n\n          if (\n            authority === undefined ||\n            rows.length !== 1 ||\n            !(yield* shared.recordMatches(\n              mapping,\n              row,\n              input.intent,\n              authority.nativeSubjectId,\n              yield* encodePasswordPreparedReady(input.intent),\n            )) ||\n            !evidenceCurrent(input, authority.requirement, now)\n          )\n            return { receipt: prepare(\"rejected\", journal), statements: [] };\n          const marker = `effect-auth-password-prepared:complete:${input.intent.intentId}`;\n\n          const requirements = [\n            input.mutation.authorization.requirement,\n            input.intent.capturedRequirement,\n            input.capturedRequirement,\n            authority.requirement,\n            input.currentRequirement,\n          ];\n\n          const age = Math.min(...requirements.map((value) => value.maximumAgeMillis));\n\n          const live = and(\n            existsRow(mapping, row),\n            authorityCondition(mapping, authority, input.intent.moduleId),\n            sql`${p.d1.engineNowMillis} >= ${input.intent.issuedAtMillis} and ${p.d1.engineNowMillis} < ${input.intent.expiresAtMillis}`,\n            ...requirements.map((requirement) =>\n              kernel.assuranceCondition(p, input.mutation.authorization.evidence, requirement),\n            ),\n            ...(input.intent.baseEvidence?.proofs ?? []).map(\n              (proof) =>\n                sql`${p.d1.engineNowMillis} >= ${DateTime.toEpochMillis(proof.verifiedAt)} and ${p.d1.engineNowMillis} < ${DateTime.toEpochMillis(proof.verifiedAt) + age}`,\n            ),\n          )!;\n\n          let mutation: ReadonlyArray<Statement<any>>;\n          let passwordApplied: SQL;\n          let mutationGuard: ((cause: unknown) => boolean) | undefined;\n\n          if (input.intent.action === \"add-password\") {\n            const compiled = yield* kernel.compileAddMutation(p, input.mutation, {\n              credentialId: credentialId!,\n              credentialRevision,\n              verifierVersion,\n              nextSecurityRevision,\n            });\n\n            if (compiled === undefined)\n              return { receipt: prepare(\"rejected\", journal), statements: [] };\n            mutation = compiled.statements;\n            mutationGuard = compiled.retryable;\n            passwordApplied = compiled.appliedCondition;\n          } else {\n            const compiled = yield* kernel.compileReplacementMutation(\n              p,\n              input.mutation,\n              input.intent.action,\n              { credentialRevision, verifierVersion, nextSecurityRevision },\n            );\n\n            if (compiled === undefined)\n              return { receipt: prepare(\"rejected\", journal), statements: [] };\n            passwordApplied = compiled.protectedMutation.appliedCondition;\n            mutationGuard = (cause) => kernel.isGuardFailure(cause, compiled.marker);\n            mutation = [\n              ...compiled.protectedMutation.statements,\n              yield* kernel.assertion(compiled.protectedMutation.appliedCondition, marker),\n            ];\n          }\n\n          const terminal = {\n            ...row,\n            [t.state]: t.states.Consumed,\n            [t.snapshot]: null,\n            [t.digest]: null,\n          };\n\n          const protectedMutation = {\n            statements: [\n              yield* kernel.assertion(live, marker),\n              ...mutation,\n              ...(yield* terminalStatements(mapping, row, \"Consumed\", marker)),\n            ],\n            appliedCondition: and(\n              passwordApplied,\n              existsRow(mapping, terminal),\n              sql`${p.d1.engineNowMillis} >= ${input.intent.issuedAtMillis} and ${p.d1.engineNowMillis} < ${input.intent.expiresAtMillis}`,\n              ...(input.intent.baseEvidence?.proofs ?? []).map(\n                (proof) =>\n                  sql`${p.d1.engineNowMillis} >= ${DateTime.toEpochMillis(proof.verifiedAt)} and ${p.d1.engineNowMillis} < ${DateTime.toEpochMillis(proof.verifiedAt) + age}`,\n              ),\n              ...requirements.map((requirement) =>\n                kernel.assuranceCondition(p, input.mutation.authorization.evidence, requirement),\n              ),\n            )!,\n          };\n\n          if (completion !== undefined) {\n            if (\n              input.intent.reset === undefined ||\n              completion.input.continuationId !== input.intent.reset.continuationId ||\n              bindingJson(completion.input.binding) !== bindingJson(input.intent.reset.binding) ||\n              !kernel.completionMatchesPassword({ ...input.mutation, completion })\n            )\n              return { receipt: prepare(\"rejected\", journal), statements: [] };\n            let receipt: PreparedCommit<A> | undefined;\n\n            const compiled = yield* compileD1ProofCompletionPlan(\n              proofMapping,\n              completion,\n              protectedMutation,\n              (decision) => {\n                receipt = prepare(decision === \"completed\" ? \"changed\" : \"rejected\", journal);\n\n                return decision;\n              },\n            );\n\n            return {\n              retryable: (cause: unknown) =>\n                kernel.isGuardFailure(cause, marker) ||\n                mutationGuard?.(cause) === true ||\n                (completion !== undefined &&\n                  (kernel.isGuardFailure(\n                    cause,\n                    `effect-auth-proof-guard:complete:${completion.input.continuationId}`,\n                  ) ||\n                    kernel.isGuardFailure(\n                      cause,\n                      `effect-auth-proof-guard:protected:${completion.input.continuationId}`,\n                    ))),\n              receipt: receipt ?? prepare(\"rejected\", journal),\n              statements: compiled.statements,\n              postconditions: compiled.postconditions,\n            };\n          }\n\n          const postconditions = [\n            yield* kernel.assertion(protectedMutation.appliedCondition, marker),\n          ];\n\n          return {\n            retryable: (cause: unknown) =>\n              kernel.isGuardFailure(cause, marker) || mutationGuard?.(cause) === true,\n            receipt: prepare(\"changed\", journal),\n            statements: [...protectedMutation.statements, ...postconditions],\n            postconditions,\n          };\n        }),\n      );\n    });\n\n  const services = {\n    reserve: <A>(\n      uncaptured: Parameters<PasswordPreparedPersistence[\"reserve\"]>[0],\n      prepare: PlanPrepare<PasswordPreparedPersistence[\"reserve\"], A>,\n    ) =>\n      Effect.gen(function* () {\n        const database = yield* CurrentD1PlanningDatabase;\n\n        const input = yield* snapshotReserve(uncaptured);\n\n        if (\n          (input.action === \"reset-password\") !==\n            (input.reset !== undefined && input.completion !== undefined) ||\n          (input.action === \"reset-password\" && proofMapping === undefined) ||\n          input.generation !== input.policy.generation ||\n          input.policy.retentionMillis <\n            Math.max(\n              input.policy.preparationLifetimeMillis + input.policy.lifetimeMillis,\n              input.policy.admission.action.windowMillis,\n              input.policy.admission.subject.windowMillis,\n              input.policy.admission.identifier.windowMillis,\n            ) ||\n          (input.invalidation.existingSessions === \"immediate\" &&\n            p.sessionInvalidation !== \"same-authority-immediate\")\n        )\n          return yield* unavailable();\n\n        const version = PasswordPreparedVersion.make(\n          yield* kernel.allocate(mapping.allocateVersion, mapping.allocateVersionSync),\n        );\n\n        return yield* run(\n          Effect.gen(function* () {\n            const journal = yield* CurrentCommitJournal;\n\n            const authority = yield* shared.captureAuthority(mapping, config, input);\n\n            if (authority === undefined) return yield* unavailable();\n            let proofCondition: SQL = sql`true`;\n\n            if (input.reset !== undefined) {\n              if (\n                input.completion === undefined ||\n                input.completion.moduleId !== `${input.moduleId}/reset` ||\n                input.completion.purpose !== \"password-reset\" ||\n                input.reset.continuationId !== input.completion.continuationId ||\n                bindingJson(input.reset.binding) !== bindingJson(input.completion.binding) ||\n                input.reset.binding._tag !== \"Subject\" ||\n                !sameRevision(input.reset.binding.revision, authority.revision) ||\n                authority.snapshot?.identifierVerifiedAtMillis === undefined\n              )\n                return yield* unavailable();\n              const inspected = yield* checkD1ProofCompletion(proofMapping, input.completion);\n\n              if (!inspected.accepted) return yield* unavailable();\n              proofCondition = inspected.condition;\n            }\n\n            const ownerCurrent = and(\n              authorityCondition(mapping, authority, input.moduleId),\n              proofCondition,\n            )!;\n\n            const marker = `effect-auth-password-prepared:reserve:${input.intentId}`;\n\n            const existing = yield* readRows(\n              and(eq(c.moduleId, input.moduleId), eq(c.commandId, input.commandId))!,\n            );\n\n            if (existing.length)\n              return {\n                retryable: (cause: unknown) => kernel.isGuardFailure(cause, marker),\n                receipt: prepare({ _tag: \"Existing\" }, journal),\n                statements: [\n                  yield* kernel.assertion(\n                    and(ownerCurrent, existsRow(mapping, existing[0]))!,\n                    marker,\n                  ),\n                ],\n              };\n\n            const now = yield* kernel.readEngineNowMillis(p),\n              scope = identifierScope({\n                credential: authority.snapshot,\n                revision: authority.revision,\n              });\n\n            const reservation = yield* snapshotPasswordPreparedReservation({\n              _tag: \"Preparing\",\n              moduleId: input.moduleId,\n              generation: input.generation,\n              intentId: input.intentId,\n              version,\n              commandId: input.commandId,\n              action: input.action,\n              revision: authority.revision,\n              ...(authority.snapshot === undefined ? {} : { credential: authority.snapshot }),\n              capturedRequirement: authority.requirement,\n              ...(input.reset === undefined ? {} : { reset: input.reset }),\n              invalidation: input.invalidation,\n              createdAtMillis: now,\n              preparationExpiresAtMillis: now + input.policy.preparationLifetimeMillis,\n              retainUntilMillis: now + input.policy.retentionMillis,\n            });\n\n            const snapshot = yield* encodeReservation(reservation),\n              window = Math.max(\n                input.policy.admission.action.windowMillis,\n                input.policy.admission.identifier.windowMillis,\n                input.policy.admission.subject.windowMillis,\n              );\n\n            const a = mapping.admission,\n              am = column(a.table, a.moduleId),\n              ai = column(a.table, a.intentId),\n              at = column(a.table, a.admittedAt),\n              ar = column(a.table, a.admissionRetainUntil);\n\n            const stamp = sql`(select ${at} from ${a.table} where ${am} = ${sql.param(input.moduleId, am)})`,\n              retention = sql`(select ${ar} from ${a.table} where ${am} = ${sql.param(input.moduleId, am)})`;\n\n            const active = sql`(select count(*) from ${t.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(authority.nativeSubjectId, c.subjectId)} and ((${c.state} = ${sql.param(t.states.Preparing, c.state)} and ${c.preparationExpiresAt} > ${p.d1.engineNow}) or (${c.state} = ${sql.param(t.states.Ready, c.state)} and ${c.expiresAt} > ${p.d1.engineNow}))) < ${input.policy.maximumPendingPerSubject}`;\n\n            const budgets = [\n              [eq(c.action, input.action), input.policy.admission.action],\n              [eq(c.identifierScope, scope), input.policy.admission.identifier],\n              [eq(c.subjectId, authority.nativeSubjectId), input.policy.admission.subject],\n            ] as const;\n\n            const admissionDecision = and(\n              ownerCurrent,\n              active,\n              ...budgets.map(\n                ([condition, budget]) =>\n                  sql`(select count(*) from ${t.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${condition} and ${c.admittedAt} > ${p.d1.engineInstantMinus(budget.windowMillis)}) < ${budget.limit}`,\n              ),\n              sql`not exists(select 1 from ${t.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${c.commandId} = ${sql.param(input.commandId, c.commandId)})`,\n              sql`${p.d1.engineNowMillis} >= ${now} and ${p.d1.engineNowMillis} < ${reservation.preparationExpiresAtMillis}`,\n            )!;\n\n            const admittedMillis = mapping.admissionClock.toMillis(stamp),\n              retainedMillis = mapping.admissionClock.toMillis(retention);\n\n            const clockGuard = and(\n              sql`exists(select 1 from ${a.table} where ${am} = ${sql.param(input.moduleId, am)} and ${ai} = ${sql.param(input.intentId, ai)})`,\n              sql`${admittedMillis} >= ${now} and ${admittedMillis} <= ${p.d1.engineNowMillis}`,\n              sql`${retainedMillis} = ${admittedMillis} + ${window}`,\n            )!;\n\n            const guard = and(sql`changes() = 1`, clockGuard)!;\n\n            const values = {\n              ...t.encodeInsert({\n                reservation,\n                nativeSubjectId: authority.nativeSubjectId,\n                identifierScope: scope,\n                snapshot,\n                admittedAtMillis: now,\n                admissionRetainUntilMillis: now + window,\n              }),\n              [t.admittedAt]: stamp,\n              [t.admissionRetainUntil]: retention,\n            };\n\n            const expected = {\n              [t.moduleId]: input.moduleId,\n              [t.intentId]: input.intentId,\n              [t.commandId]: input.commandId,\n              [t.subjectId]: authority.nativeSubjectId,\n              [t.action]: input.action,\n              [t.generation]: input.generation,\n              [t.version]: version,\n              [t.state]: t.states.Preparing,\n              [t.digest]: null,\n              [t.snapshot]: snapshot,\n              [t.identifierScope]: scope,\n              [t.createdAt]: p.encodeInstant(now),\n              [t.preparationExpiresAt]: p.encodeInstant(reservation.preparationExpiresAtMillis),\n              [t.expiresAt]: null,\n              [t.retainUntil]: p.encodeInstant(reservation.retainUntilMillis),\n              [t.admittedAt]: stamp,\n              [t.admissionRetainUntil]: retention,\n            };\n\n            return {\n              retryable: (cause: unknown) => kernel.isGuardFailure(cause, marker),\n              receipt: prepare({ _tag: \"Reserved\", reservation }, journal),\n              statements: [\n                yield* kernel.statement(\n                  database\n                    .insert(a.table)\n                    .values(a.encodeInsert(input.moduleId))\n                    .onConflictDoNothing(),\n                ),\n                yield* kernel.statement(\n                  database\n                    .update(a.table)\n                    .set(\n                      updateValues([\n                        [a.intentId, input.intentId],\n                        [a.admittedAt, p.d1.engineNow],\n                        [a.admissionRetainUntil, p.d1.engineInstantPlus(window)],\n                      ]),\n                    )\n                    .where(and(eq(am, input.moduleId), admissionDecision)),\n                ),\n                yield* kernel.statement(yield* selectInsert(t.table, values, guard)),\n                yield* kernel.assertion(existsRow(mapping, expected), marker),\n                yield* kernel.assertion(\n                  and(\n                    ownerCurrent,\n                    clockGuard,\n                    sql`${p.d1.engineNowMillis} < ${reservation.preparationExpiresAtMillis}`,\n                    sql`(select count(*) from ${t.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(authority.nativeSubjectId, c.subjectId)} and ((${c.state} = ${sql.param(t.states.Preparing, c.state)} and ${c.preparationExpiresAt} > ${p.d1.engineNow}) or (${c.state} = ${sql.param(t.states.Ready, c.state)} and ${c.expiresAt} > ${p.d1.engineNow}))) <= ${input.policy.maximumPendingPerSubject}`,\n                    ...budgets.map(\n                      ([condition, budget]) =>\n                        sql`(select count(*) from ${t.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${condition} and ${c.admittedAt} > ${p.d1.engineInstantMinus(budget.windowMillis)}) <= ${budget.limit}`,\n                    ),\n                  )!,\n                  marker,\n                ),\n              ],\n            };\n          }),\n        );\n      }),\n    publishReady: <A>(\n      uncaptured: Parameters<PasswordPreparedPersistence[\"publishReady\"]>[0],\n      prepare: PlanPrepare<PasswordPreparedPersistence[\"publishReady\"], A>,\n    ) =>\n      Effect.gen(function* () {\n        const database = yield* CurrentD1PlanningDatabase;\n\n        const reservation = yield* snapshotPasswordPreparedReservation(uncaptured.reservation),\n          ready = yield* snapshotPasswordPreparedReady(uncaptured.ready),\n          snapshot = yield* encodeReservation(reservation),\n          readySnapshot = yield* encodePasswordPreparedReady(ready);\n\n        if ((yield* encodeReservation(reservationOf(ready))) !== snapshot)\n          return yield* unavailable();\n\n        return yield* run(\n          Effect.gen(function* () {\n            const journal = yield* CurrentCommitJournal;\n\n            const authority = yield* current(reservation),\n              rows = yield* readRows(\n                and(eq(c.moduleId, reservation.moduleId), eq(c.intentId, reservation.intentId))!,\n              ),\n              row = rows[0];\n\n            if (\n              authority === undefined ||\n              rows.length !== 1 ||\n              !(yield* shared.recordMatches(\n                mapping,\n                row,\n                reservation,\n                authority.nativeSubjectId,\n                snapshot,\n              ))\n            )\n              return { receipt: prepare(\"rejected\", journal), statements: [] };\n\n            const marker = `effect-auth-password-prepared:ready:${ready.intentId}`,\n              live = and(\n                authorityCondition(mapping, authority, ready.moduleId),\n                sql`${p.d1.engineNowMillis} >= ${ready.issuedAtMillis} and ${p.d1.engineNowMillis} < ${reservation.preparationExpiresAtMillis} and ${p.d1.engineNowMillis} < ${ready.expiresAtMillis}`,\n              )!;\n\n            const expected = {\n              ...row,\n              [t.state]: t.states.Ready,\n              [t.snapshot]: readySnapshot,\n              [t.digest]: ready.digest,\n              [t.expiresAt]: p.encodeInstant(ready.expiresAtMillis),\n            };\n\n            return {\n              retryable: (cause: unknown) => kernel.isGuardFailure(cause, marker),\n              receipt: prepare(\"published\", journal),\n              statements: [\n                yield* kernel.assertion(and(live, existsRow(mapping, row))!, marker),\n                yield* kernel.statement(\n                  database\n                    .update(t.table)\n                    .set(t.encodeReady({ ready, snapshot: readySnapshot }))\n                    .where(shared.rowCondition(mapping, row)),\n                ),\n                yield* kernel.assertion(and(live, existsRow(mapping, expected))!, marker),\n              ],\n            };\n          }),\n        );\n      }),\n    context: (uncaptured: Parameters<PasswordPreparedPersistence[\"context\"]>[0]) =>\n      Effect.gen(function* () {\n        const database = yield* CurrentD1PlanningDatabase;\n\n        if (yield* hasCommitScope) return yield* unavailable();\n\n        const input = yield* Schema.decodeEffect(ContextInput)({ ...uncaptured }).pipe(\n            Effect.mapError(unavailable),\n          ),\n          rows = yield* readRows(\n            and(\n              eq(c.moduleId, input.moduleId),\n              eq(c.generation, input.generation),\n              eq(c.digest, input.digest),\n              eq(c.state, t.states.Ready),\n            )!,\n          );\n\n        if (rows.length !== 1) return yield* PasswordRejected.make({});\n\n        const record = yield* decodePasswordPreparedReady(rows[0][t.snapshot]),\n          authority = yield* current(record);\n\n        if (\n          authority === undefined ||\n          record.moduleId !== input.moduleId ||\n          record.generation !== input.generation ||\n          record.digest !== input.digest ||\n          !(yield* shared.recordMatches(\n            mapping,\n            rows[0],\n            record,\n            authority.nativeSubjectId,\n            yield* encodePasswordPreparedReady(record),\n          ))\n        )\n          return yield* PasswordRejected.make({});\n\n        const condition = and(\n          shared.rowCondition(mapping, rows[0]),\n          authorityCondition(mapping, authority, record.moduleId),\n          sql`${p.d1.engineNowMillis} >= ${record.issuedAtMillis} and ${p.d1.engineNowMillis} < ${record.expiresAtMillis}`,\n        )!;\n\n        const guardStatement = yield* kernel.assertion(\n          sql`exists(select 1 from ${t.table} where ${condition})`,\n          `effect-auth-password-prepared:context:${record.intentId}`,\n        );\n\n        const guard = yield* Effect.try({\n          try: () => compactD1GeneratedStatement(database.$client, guardStatement, unavailable),\n          catch: (cause) =>\n            Schema.is(PasswordUnavailable)(cause)\n              ? cause\n              : PersistenceMappingError.make({ operation: \"mapping\", cause }),\n        });\n\n        yield* database.$client\n          .batch([guard])\n          .pipe(\n            Effect.catchCause(\n              (\n                cause,\n              ): Effect.Effect<never, PasswordRejected | import(\"effect/sql/SqlError\").SqlError> =>\n                everyFailureMatches(cause, (failure) =>\n                  kernel.isGuardFailure(\n                    failure,\n                    `effect-auth-password-prepared:context:${record.intentId}`,\n                  ),\n                )\n                  ? Effect.fail(PasswordRejected.make({}))\n                  : Effect.failCause(cause),\n            ),\n          );\n\n        return { record, currentRequirement: authority.requirement };\n      }),\n    complete,\n    resetWithProof: complete,\n    cancel: <A>(\n      uncaptured: Parameters<PasswordPreparedPersistence[\"cancel\"]>[0],\n      prepare: PlanPrepare<PasswordPreparedPersistence[\"cancel\"], A>,\n    ) =>\n      Effect.gen(function* () {\n        const record = yield* snapshotPasswordPreparedReady(uncaptured.record);\n\n        return yield* run(\n          Effect.gen(function* () {\n            const journal = yield* CurrentCommitJournal;\n\n            const authority = yield* current(record),\n              rows = yield* readRows(\n                and(eq(c.moduleId, record.moduleId), eq(c.intentId, record.intentId))!,\n              ),\n              row = rows[0];\n\n            if (\n              authority === undefined ||\n              rows.length !== 1 ||\n              !(yield* shared.recordMatches(\n                mapping,\n                row,\n                record,\n                authority.nativeSubjectId,\n                yield* encodePasswordPreparedReady(record),\n              ))\n            )\n              return { receipt: prepare(false, journal), statements: [] };\n            const marker = `effect-auth-password-prepared:cancel:${record.intentId}`;\n\n            return {\n              retryable: (cause: unknown) => kernel.isGuardFailure(cause, marker),\n              receipt: prepare(true, journal),\n              statements: [\n                yield* kernel.assertion(\n                  and(\n                    existsRow(mapping, row),\n                    authorityCondition(mapping, authority, record.moduleId),\n                    sql`${p.d1.engineNowMillis} >= ${record.issuedAtMillis} and ${p.d1.engineNowMillis} < ${record.expiresAtMillis}`,\n                  )!,\n                  marker,\n                ),\n                ...(yield* terminalStatements(mapping, row, \"Cancelled\", marker)),\n              ],\n            };\n          }),\n        );\n      }),\n    cleanup: <A>(\n      uncaptured: Parameters<PasswordPreparedPersistence[\"cleanup\"]>[0],\n      prepare: PlanPrepare<PasswordPreparedPersistence[\"cleanup\"], A>,\n    ) =>\n      Effect.gen(function* () {\n        const database = yield* CurrentD1PlanningDatabase;\n\n        const input = { ...uncaptured };\n\n        if (!Number.isSafeInteger(input.limit) || input.limit < 1 || input.limit > 1000)\n          return yield* unavailable();\n\n        return yield* run(\n          Effect.gen(function* () {\n            const journal = yield* CurrentCommitJournal;\n\n            const due = and(\n              eq(c.moduleId, input.moduleId),\n              or(\n                and(\n                  lte(c.retainUntil, p.d1.engineNow),\n                  lte(c.admissionRetainUntil, p.d1.engineNow),\n                ),\n                and(\n                  isNotNull(c.snapshot),\n                  or(\n                    and(\n                      eq(c.state, t.states.Preparing),\n                      lte(c.preparationExpiresAt, p.d1.engineNow),\n                    ),\n                    and(eq(c.state, t.states.Ready), lte(c.expiresAt, p.d1.engineNow)),\n                  ),\n                ),\n              ),\n            )!;\n\n            const rows = yield* database\n              .select()\n              .from(t.table)\n              .where(due)\n              .orderBy(c.createdAt, c.intentId)\n              .limit(input.limit + 1);\n\n            const now = yield* kernel.readEngineNowMillis(p),\n              statements: Statement<any>[] = [],\n              marker = `effect-auth-password-prepared:cleanup:${input.moduleId}`;\n\n            let removed = 0;\n\n            for (const row of rows.slice(0, input.limit)) {\n              const retained = yield* p.decodeInstant(row[t.retainUntil]),\n                charge = yield* p.decodeInstant(row[t.admissionRetainUntil]);\n\n              statements.push(\n                yield* kernel.assertion(\n                  and(\n                    existsRow(mapping, row),\n                    sql`exists(select 1 from ${t.table} where ${shared.rowCondition(mapping, row)} and ${due})`,\n                  )!,\n                  marker,\n                ),\n              );\n              if (retained <= now && charge <= now) {\n                statements.push(\n                  yield* kernel.statement(\n                    database\n                      .delete(t.table)\n                      .where(\n                        and(\n                          shared.rowCondition(mapping, row),\n                          lte(c.retainUntil, p.d1.engineNow),\n                          lte(c.admissionRetainUntil, p.d1.engineNow),\n                        ),\n                      ),\n                  ),\n                  yield* kernel.assertion(\n                    sql`not exists(select 1 from ${t.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${c.intentId} = ${sql.param(row[t.intentId], c.intentId)})`,\n                    marker,\n                  ),\n                );\n                removed++;\n              } else\n                statements.push(...(yield* terminalStatements(mapping, row, \"Expired\", marker)));\n            }\n            const hasMore = rows.length > input.limit;\n\n            statements.push(\n              yield* kernel.assertion(\n                hasMore\n                  ? sql`exists(select 1 from ${t.table} where ${due})`\n                  : sql`not exists(select 1 from ${t.table} where ${due})`,\n                marker,\n              ),\n            );\n\n            return {\n              retryable: (cause: unknown) => kernel.isGuardFailure(cause, marker),\n              receipt: prepare({ removed, hasMore }, journal),\n              statements,\n            };\n          }),\n        );\n      }),\n  };\n\n  return services;\n};\n\nexport const makeD1PasswordPreparedPersistenceServices = Effect.fnUntraced(function* <\n  S extends AnySQLiteTable,\n  I extends AnySQLiteTable,\n  C extends AnySQLiteTable,\n  AC extends AnySQLiteTable,\n  At extends AnySQLiteTable,\n  RS extends AnySQLiteTable,\n  CE extends AnySQLiteTable,\n  M extends AnySQLiteTable,\n  T extends AnySQLiteTable,\n  B extends AnySQLiteTable,\n  NativeId,\n  PS extends AnySQLiteTable = AnySQLiteTable,\n  PC extends AnySQLiteTable = AnySQLiteTable,\n  PM extends AnySQLiteTable = AnySQLiteTable,\n  PSub extends AnySQLiteTable = AnySQLiteTable,\n  PI extends AnySQLiteTable = AnySQLiteTable,\n  PCr extends AnySQLiteTable = AnySQLiteTable,\n  PNativeId = unknown,\n>(\n  mapping: D1PasswordPreparedPersistenceMapping<S, I, C, AC, At, RS, CE, M, T, B, NativeId>,\n  proofMapping?: D1PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId>,\n) {\n  const database = yield* DatabaseService;\n\n  const hooks = yield* LifecycleHooks;\n  const plans = makePreparedPlans(mapping as unknown as Mapping, proofMapping);\n\n  const run = <Out, Err, Env>(plan: Effect.Effect<Planned<Out>, Err, Env>) =>\n    Effect.gen(function* () {\n      if (yield* hasCommitScope) return yield* unavailable();\n\n      return yield* executeStandalone(plan);\n    }).pipe(\n      Effect.provideService(CurrentD1PlanningDatabase, database),\n      Effect.provideService(CurrentPasswordSql, database as unknown as PasswordSqlDatabase),\n      Effect.provideService(LifecycleHooks, hooks),\n    );\n\n  const service: PasswordPreparedPersistence = {\n    reserve: (input, prepare) => run(plans.reserve(input, prepare)).pipe(translateFailure),\n    publishReady: (input, prepare) =>\n      run(plans.publishReady(input, prepare)).pipe(translateFailure),\n    context: (input) =>\n      plans\n        .context(input)\n        .pipe(\n          Effect.provideService(CurrentD1PlanningDatabase, database),\n          Effect.provideService(CurrentPasswordSql, database as unknown as PasswordSqlDatabase),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateContextFailure,\n        ),\n    complete: (input, prepare) => run(plans.complete(input, prepare)).pipe(translateFailure),\n    resetWithProof: (input, prepare) =>\n      run(plans.resetWithProof(input, prepare)).pipe(translateFailure),\n    cancel: (input, prepare) => run(plans.cancel(input, prepare)).pipe(translateFailure),\n    cleanup: (input, prepare) => run(plans.cleanup(input, prepare)).pipe(translateFailure),\n  };\n\n  return { passwordPreparedPersistence: service };\n});\n\nexport function coordinateD1PasswordPreparedPersistence<\n  TargetId,\n  S extends AnySQLiteTable,\n  I extends AnySQLiteTable,\n  C extends AnySQLiteTable,\n  AC extends AnySQLiteTable,\n  At extends AnySQLiteTable,\n  RS extends AnySQLiteTable,\n  CE extends AnySQLiteTable,\n  M extends AnySQLiteTable,\n  T extends AnySQLiteTable,\n  B extends AnySQLiteTable,\n  NativeId,\n  PS extends AnySQLiteTable,\n  PC extends AnySQLiteTable,\n  PM extends AnySQLiteTable,\n  PSub extends AnySQLiteTable,\n  PI extends AnySQLiteTable,\n  PCr extends AnySQLiteTable,\n  PNativeId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: D1PasswordPreparedPersistenceMapping<\n      S,\n      I,\n      C,\n      AC,\n      At,\n      RS,\n      CE,\n      M,\n      T,\n      B,\n      NativeId\n    >;\n    readonly proofMapping?:\n      | D1PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId>\n      | undefined;\n    readonly target: SuppliedService<TargetId, PasswordPreparedPersistence>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | PasswordUnavailable | HookConfigurationError | DatabaseError,\n  Exclude<R, TargetId | D1BatchStatements> | LifecycleHooks | DatabaseRequirements\n> {\n  return Effect.flatMap(acquire, (database) =>\n    Effect.gen(function* () {\n      const hooks = yield* LifecycleHooks;\n\n      if (yield* hasCommitScope) return yield* unavailable();\n\n      const result = yield* coordinateCommit(\n        () =>\n          Effect.gen(function* () {\n            const statements: Statement<any>[] = [];\n            let mutation: Planned<any> | undefined;\n            let poisoned = false;\n\n            const nativeCollector = D1BatchStatements.of({\n              append: (statement) => Effect.sync(() => statements.push(statement)),\n            });\n\n            const owner = yield* makeD1Owner(unavailable()).pipe(\n              Effect.provideService(D1BatchStatements, nativeCollector),\n            );\n\n            const protect = <Out, Err, Env>(effect: Effect.Effect<Out, Err, Env>) =>\n              effect.pipe(\n                Effect.onError(() =>\n                  Effect.sync(() => {\n                    poisoned = true;\n                  }),\n                ),\n              );\n\n            const plans = makePreparedPlans(\n              options.mapping as unknown as Mapping,\n              options.proofMapping,\n            );\n\n            const run = <Out, Err, Env>(plan: Effect.Effect<Planned<Out>, Err, Env>) =>\n              coordinateCommit(\n                () =>\n                  Effect.gen(function* () {\n                    const journal = yield* CurrentCommitJournal;\n                    const planned = yield* plan;\n\n                    yield* owner.check;\n                    if (mutation !== undefined) return yield* unavailable();\n                    const guarded = { ...planned, journalGuard: journal.prepare(undefined) };\n\n                    mutation = guarded;\n                    statements.push(...guarded.statements);\n\n                    return guarded.receipt;\n                  }),\n                { mode: \"batch\" },\n              ).pipe(\n                Effect.map((result) => result.value),\n                Effect.provideService(CurrentD1PlanningDatabase, database),\n                Effect.provideService(\n                  CurrentPasswordSql,\n                  database as unknown as PasswordSqlDatabase,\n                ),\n                Effect.provideService(LifecycleHooks, hooks),\n              );\n\n            const service: PasswordPreparedPersistence = {\n              reserve: (input, prepare) =>\n                owner.run(protect(run(plans.reserve(input, prepare)).pipe(translateFailure))),\n              publishReady: (input, prepare) =>\n                owner.run(protect(run(plans.publishReady(input, prepare)).pipe(translateFailure))),\n              context: (input) =>\n                owner.run(\n                  protect(\n                    plans\n                      .context(input)\n                      .pipe(\n                        Effect.provideService(CurrentD1PlanningDatabase, database),\n                        Effect.provideService(\n                          CurrentPasswordSql,\n                          database as unknown as PasswordSqlDatabase,\n                        ),\n                        Effect.provideService(LifecycleHooks, hooks),\n                        translateContextFailure,\n                      ),\n                  ),\n                ),\n              complete: (input, prepare) =>\n                owner.run(protect(run(plans.complete(input, prepare)).pipe(translateFailure))),\n              resetWithProof: (input, prepare) =>\n                owner.run(\n                  protect(run(plans.resetWithProof(input, prepare)).pipe(translateFailure)),\n                ),\n              cancel: (input, prepare) =>\n                owner.run(protect(run(plans.cancel(input, prepare)).pipe(translateFailure))),\n              cleanup: (input, prepare) =>\n                owner.run(protect(run(plans.cleanup(input, prepare)).pipe(translateFailure))),\n            };\n\n            const provided = Context.make(options.target, service).pipe(\n              Context.add(D1BatchStatements, owner.collector),\n            );\n\n            const value = yield* owner.close(Effect.provideContext(body, provided));\n\n            if (poisoned) return yield* unavailable();\n            if (mutation?.journalGuard !== undefined) {\n              const status = yield* Effect.result(mutation.journalGuard.read);\n\n              if (status._tag === \"Success\" || status.failure._tag !== \"CommitPending\")\n                return yield* unavailable();\n            }\n            yield* database.$client\n              .batch([...statements, ...(mutation?.postconditions ?? [])])\n              .pipe(\n                Effect.catchCause((cause) =>\n                  Effect.failCause(\n                    Cause.map(cause, (error) =>\n                      everyFailureMatches(cause, mutation?.retryable) ? unavailable() : error,\n                    ),\n                  ),\n                ),\n                translateFailure,\n              );\n\n            return value;\n          }),\n        { mode: \"batch\" },\n      ).pipe(Effect.provideService(LifecycleHooks, hooks));\n\n      return result.value;\n    }),\n  );\n}\n\nconst translateFailure = <A, E, R>(\n  effect: Effect.Effect<A, E, R>,\n): Effect.Effect<A, PasswordUnavailable, R> =>\n  reportPersistenceFailure(\n    effect,\n    (error) =>\n      Schema.is(PasswordUnavailable)(error) ||\n      Schema.is(ProofUnavailable)(error) ||\n      Schema.is(HookConfigurationError)(error),\n  ).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));\n\nconst translateContextFailure = <A, E, R>(\n  effect: Effect.Effect<A, E, R>,\n): Effect.Effect<A, PasswordUnavailable | PasswordRejected, R> =>\n  reportPersistenceFailure(\n    effect,\n    (error) =>\n      Schema.is(PasswordUnavailable)(error) ||\n      Schema.is(PasswordRejected)(error) ||\n      Schema.is(ProofUnavailable)(error) ||\n      Schema.is(HookConfigurationError)(error),\n  ).pipe(\n    Effect.catchCause((cause) =>\n      Effect.failCause(\n        Cause.map(cause, (error) => (Schema.is(PasswordRejected)(error) ? error : unavailable())),\n      ),\n    ),\n  );\n\nconst executeStandalone = <A, E, R>(plan: Effect.Effect<Planned<A>, E, R>) =>\n  Effect.suspend(() => {\n    let retryable: ((cause: unknown) => boolean) | undefined;\n\n    return coordinateCommit(\n      () =>\n        Effect.gen(function* () {\n          const database = yield* CurrentD1PlanningDatabase;\n          const planned = yield* plan;\n\n          retryable = planned.retryable;\n          yield* database.$client.batch([...planned.statements, ...(planned.postconditions ?? [])]);\n\n          return planned.receipt;\n        }),\n      { mode: \"batch\" },\n    ).pipe(\n      Effect.map((result) => result.value),\n      Effect.catchCause((cause) =>\n        Effect.failCause(\n          Cause.map(cause, (error) =>\n            everyFailureMatches(cause, retryable) ? unavailable() : error,\n          ),\n        ),\n      ),\n    );\n  });\n"],"mappings":";;;;;;;;;;;;;;;;;AAwFA,MAAM,uBACJ,OACA,aAEA,aAAa,KAAA,KACb,MAAM,QAAQ,SAAS,KACvB,MAAM,QAAQ,OAAO,WAAW,MAAM,aAAa,MAAM,KAAK,SAAS,MAAM,KAAK,OAAO,KAAK,CAAC,CAAC;AAElG,MAAM,cAAc,OAAO,WAAW,OAAO,eAAe,YAAY,CAAC;AAEzE,MAAM,sBAAsB,SAAkB,SAAc,aAAqB;CAC/E,MAAM,IAAI,QAAQ,UAChB,IAAIA,iBAAO,eAAe,CAAC,GAC3B,IAAIA,iBAAO,kBAAkB,CAAC,GAC9B,IAAIA,iBAAO,kBAAkB,CAAC,GAC9B,KAAKA,iBAAO,iBAAiB,CAAC;CAEhC,MAAM,WAAW,QAAQ,UACvB,SAAS,QAAQ;CAEnB,MAAM,aACJ,aAAa,KAAA,IACT,GAAG,SACHC,cACE,EAAE,WAAW,mBAAmB;EAC9B,YAAY,SAAS;EACrB,iBAAiB;CACnB,CAAC,GACD,GAAG,wBAAwB,EAAE,WAAW,MAAM,SAAS,EAAE,UAAU,KAAK,IAAI,MAAM,SAAS,WAAW,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,MAAM,SAAS,WAAW,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,KAAK,IAAI,MAAM,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,KAAK,IAAI,MAAM,SAAS,2BAA2B,EAAE,eAAe,EAAE,OAAO,UAAU,UAAU,QAAQ,WAAW,EAAE,WAAW,WAAW,IAAI,GAAG,GAAG,EAAE,WAAW,YAAY,GAAG,GAAG,EAAE,WAAW,KAAK,IAAI,MAAM,QAAQ,WAAW,EAAE,WAAW,aAAa,EAAE,UAAU,IAAI,EAChiB;CAEN,OAAOA,cACL,GAAG,wBAAwB,EAAE,QAAQ,MAAM,SAAS,EAAE,GAAG,KAAK,IAAI,MAAM,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI,MAAM,EAAE,QAAQ,qBAAqB,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,KAAK,IAAI,MAAM,QAAQ,SAAS,kBAAkB,EAAE,gBAAgB,EAAE,IAC9P,YACA,aAAa,KAAA,IACT,GAAG,4BAA4B,EAAE,WAAW,MAAM,SAAS,EAAE,SAAS,KAAK,IAAI,MAAM,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,KAAK,IAAI,MAAM,QAAQ,EAAE,SAAS,EAAE,KAClK,GAAG,wBAAwB,EAAE,WAAW,MAAM,SAAS,EAAE,SAAS,KAAK,IAAI,MAAM,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,KAAK,IAAI,MAAM,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,KAAK,IAAI,MAAM,SAAS,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,mBAAmB,KAAK,IAAI,MAAM,SAAS,oBAAoB,EAAE,kBAAkB,EAAE,OAAO,EAAE,gBAAgB,KAAK,IAAI,MAAM,SAAS,iBAAiB,EAAE,eAAe,EAAE,OAAO,EAAE,SAAS,KAAK,IAAI,MAAM,SAAS,MAAM,SAAS,QAAQ,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,KAAK,IAAI,MAAM,SAAS,eAAe,EAAE,aAAa,EAAE,IAChkB,GAAG,QAAQ,SAAS,YAAY,KAC7B,UACC,GAAG,wBAAwB,EAAE,oBAAoB,MAAM,SAAS,GAAG,UAAU,KAAK,IAAI,MAAM,QAAQ,GAAG,SAAS,EAAE,OAAO,GAAG,aAAa,KAAK,IAAI,MAAM,MAAM,cAAc,GAAG,YAAY,EAAE,OAAO,GAAG,SAAS,KAAK,IAAI,MAAM,MAAM,UAAU,GAAG,QAAQ,IAAI,GAAG,WAAW,KAAA,IAAY,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,KAAK,IAAI,MAAM,EAAE,oBAAoB,qBAAqB,GAAG,MAAM,IAAI,EAChY,CACF;AACF;AAEA,MAAM,aAAa,SAAkB,QACnC,GAAG,wBAAwB,QAAQ,OAAO,MAAM,SAASC,0BAAO,aAAa,SAAS,GAAG,EAAE;AAE7F,MAAM,qBAAqB,OAAO,GAAG,WACnC,SACA,KACA,OACA,QACA;CACA,MAAM,WAAW,OAAO;CACxB,MAAM,IAAI,QAAQ;CAElB,OAAO,CACL,OAAOF,iBAAO,UACZ,SACG,OAAO,EAAE,KAAK,CAAC,CACf,IAAI,EAAE,eAAe,KAAK,CAAC,CAAC,CAC5B,MAAME,0BAAO,aAAa,SAAS,GAAG,CAAC,CAC5C,GACA,OAAOF,iBAAO,UACZ,UAAU,SAAS;EACjB,GAAG;GACF,EAAE,QAAQ,EAAE,OAAO;GACnB,EAAE,WAAW;GACb,EAAE,SAAS;CACd,CAAC,GACD,MACF,CACF;AACF,CAAC;AAED,MAAM,eAAe,OAAO,GAAG,WAAW,OAAc,QAAgB,WAAgB;CACtF,MAAM,WAAW,OAAO;CAExB,MAAM,WAAW,OAAO,YACtB,OAAO,QAAQ,MAAM,CAAC,CACnB,QAAQ,GAAG,WAAW,UAAU,KAAA,CAAS,CAAC,CAC1C,KAAK,CAAC,KAAK,WAAW,CACrB,MACC,GAAG,OAAO,GAAG,IAAI,QAAQ,GAAG,GAAG,IAAI,MAAM,OAAO,OAAO,OAAO,GAAY,CAAC,IAAA,CAAK,GAAG,GAAG,CACzF,CAAC,CACL;CAEA,OAAO,SAAS,OAAO,KAAY,CAAC,CAAC,OACnC,SACG,OAAO,QAAQ,CAAC,CAChB,KAAK,GAAG,YAAY,CAAC,CACrB,MAAM,SAAS,CACpB;AACF,CAAC;AAED,MAAM,qBAAqB,SAAkB,iBAAuB;CAClE,MAAM,IAAI,QAAQ,UAChB,IAAI,QAAQ,QACZ,IAAIE,0BAAO,QAAQ,OAAO,GAC1B,SAAS,EAAE,SAAS,MAAM;CAE5B,MAAM,WAAW,OAAO,GAAG,WAAW,WAAgB;EAGpD,OAAO,QAAO,OAFU,0BAAA,CAED,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,MAAM,SAAS,CAAC,CAAC,MAAM,CAAC;CACxE,CAAC;CAED,MAAM,OAAgB,SACpB,OAAO,IAAI,aAAa;EACtB,MAAM,WAAW,OAAO;EAExB,OAAO,OAAOA,0BAAO,MAAM,OAAO,IAC9B,KAAK,KACH,OAAO,SAAS,YACd,OAAO,IAAI;GACT,YAAY;IACV,GAAG;IACH,YAAY,QAAQ,WAAW,KAAK,cAClC,4BAA4B,SAAS,SAAS,WAAW,WAAW,CACtE;IACA,gBAAgB,QAAQ,gBAAgB,KAAK,cAC3C,4BAA4B,SAAS,SAAS,WAAW,WAAW,CACtE;GACF;GACA,QAAQ,UACN,OAAO,GAAG,mBAAmB,CAAC,CAAC,KAAK,IAChC,QACA,wBAAwB,KAAK;IAAE,WAAW;IAAW;GAAM,CAAC;EACpE,CAAC,CACH,CACF,IACA,OAAO,KAAK,YAAY,CAAC;CAC/B,CAAC;CAEH,MAAM,WAAW,WACfA,0BAAO,iBAAiB,SAAS,QAAQ,MAAM;CAEjD,MAAM,YACJ,YACA,YAEA,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO,iBAAiB,UAAU;EAEhD,MAAM,aACJ,WAAW,eAAe,KAAA,IACtB,KAAA,IACA;GACE,SAAS,WAAW,WAAW;GAC/B,OAAO,OAAO,OAAO,aAAa,OAAO,eAAe,eAAe,CAAC,CAAC,CACvE,WAAW,WAAW,KACxB,CAAC,CAAC,KACA,OAAO,QAAQ,OAAO,aAAa,OAAO,eAAe,eAAe,CAAC,CAAC,GAC1E,OAAO,SAAS,WAAW,CAC7B;EACF;EAEN,IACG,MAAM,OAAO,WAAW,sBAAuB,eAAe,KAAA,MAC9D,eAAe,KAAA,KAAa,iBAAiB,KAAA,GAE9C,OAAO,OAAO,YAAY;EAE5B,MAAM,qBAAqB,OAAOF,iBAAO,SAAS,EAAE,kBAAkB,EAAE,oBAAoB,GAC1F,kBAAkB,OAAOA,iBAAO,SAAS,EAAE,kBAAkB,EAAE,oBAAoB,GACnF,uBAAuB,OAAOA,iBAAO,6BACnC,GACA,MAAM,OAAO,SAAS,gBACxB;EAEF,IACE,yBAAyB,MAAM,OAAO,SAAS,oBAC/C,uBAAuB,MAAM,OAAO,YAAY,sBAChD,oBAAoB,MAAM,OAAO,YAAY,iBAE7C,OAAO,OAAO,YAAY;EAE5B,MAAM,eACJ,MAAM,OAAO,WAAW,iBACpB,OAAOA,iBAAO,SAAS,EAAE,sBAAsB,EAAE,wBAAwB,IACzE,KAAA;EAEN,OAAO,OAAO,IACZ,OAAO,IAAI,aAAa;GACtB,MAAM,UAAU,OAAO;GAEvB,MAAM,YAAY,OAAO,QAAQ,MAAM,MAAM,GAC3C,OAAO,OAAO,SACZC,cAAI,GAAG,EAAE,UAAU,MAAM,OAAO,QAAQ,GAAG,GAAG,EAAE,UAAU,MAAM,OAAO,QAAQ,CAAC,CAClF,GACA,MAAM,KAAK,IACX,MAAM,OAAOD,iBAAO,oBAAoB,CAAC;GAE3C,IACE,cAAc,KAAA,KACd,KAAK,WAAW,KAChB,EAAE,OAAOE,0BAAO,cACd,SACA,KACA,MAAM,QACN,UAAU,iBACV,OAAO,4BAA4B,MAAM,MAAM,CACjD,MACA,CAAC,gBAAgB,OAAO,UAAU,aAAa,GAAG,GAElD,OAAO;IAAE,SAAS,QAAQ,YAAY,OAAO;IAAG,YAAY,CAAC;GAAE;GACjE,MAAM,SAAS,0CAA0C,MAAM,OAAO;GAEtE,MAAM,eAAe;IACnB,MAAM,SAAS,cAAc;IAC7B,MAAM,OAAO;IACb,MAAM;IACN,UAAU;IACV,MAAM;GACR;GAEA,MAAM,MAAM,KAAK,IAAI,GAAG,aAAa,KAAK,UAAU,MAAM,gBAAgB,CAAC;GAE3E,MAAM,OAAOD,cACX,UAAU,SAAS,GAAG,GACtB,mBAAmB,SAAS,WAAW,MAAM,OAAO,QAAQ,GAC5D,GAAG,GAAG,EAAE,GAAG,gBAAgB,MAAM,MAAM,OAAO,eAAe,OAAO,EAAE,GAAG,gBAAgB,KAAK,MAAM,OAAO,mBAC3G,GAAG,aAAa,KAAK,gBACnBD,iBAAO,mBAAmB,GAAG,MAAM,SAAS,cAAc,UAAU,WAAW,CACjF,GACA,IAAI,MAAM,OAAO,cAAc,UAAU,CAAC,EAAA,CAAG,KAC1C,UACC,GAAG,GAAG,EAAE,GAAG,gBAAgB,MAAM,SAAS,cAAc,MAAM,UAAU,EAAE,OAAO,EAAE,GAAG,gBAAgB,KAAK,SAAS,cAAc,MAAM,UAAU,IAAI,KAC1J,CACF;GAEA,IAAI;GACJ,IAAI;GACJ,IAAI;GAEJ,IAAI,MAAM,OAAO,WAAW,gBAAgB;IAC1C,MAAM,WAAW,OAAOA,iBAAO,mBAAmB,GAAG,MAAM,UAAU;KACrD;KACd;KACA;KACA;IACF,CAAC;IAED,IAAI,aAAa,KAAA,GACf,OAAO;KAAE,SAAS,QAAQ,YAAY,OAAO;KAAG,YAAY,CAAC;IAAE;IACjE,WAAW,SAAS;IACpB,gBAAgB,SAAS;IACzB,kBAAkB,SAAS;GAC7B,OAAO;IACL,MAAM,WAAW,OAAOA,iBAAO,2BAC7B,GACA,MAAM,UACN,MAAM,OAAO,QACb;KAAE;KAAoB;KAAiB;IAAqB,CAC9D;IAEA,IAAI,aAAa,KAAA,GACf,OAAO;KAAE,SAAS,QAAQ,YAAY,OAAO;KAAG,YAAY,CAAC;IAAE;IACjE,kBAAkB,SAAS,kBAAkB;IAC7C,iBAAiB,UAAUA,iBAAO,eAAe,OAAO,SAAS,MAAM;IACvE,WAAW,CACT,GAAG,SAAS,kBAAkB,YAC9B,OAAOA,iBAAO,UAAU,SAAS,kBAAkB,kBAAkB,MAAM,CAC7E;GACF;GAEA,MAAM,WAAW;IACf,GAAG;KACF,EAAE,QAAQ,EAAE,OAAO;KACnB,EAAE,WAAW;KACb,EAAE,SAAS;GACd;GAEA,MAAM,oBAAoB;IACxB,YAAY;KACV,OAAOA,iBAAO,UAAU,MAAM,MAAM;KACpC,GAAG;KACH,GAAI,OAAO,mBAAmB,SAAS,KAAK,YAAY,MAAM;IAChE;IACA,kBAAkBC,cAChB,iBACA,UAAU,SAAS,QAAQ,GAC3B,GAAG,GAAG,EAAE,GAAG,gBAAgB,MAAM,MAAM,OAAO,eAAe,OAAO,EAAE,GAAG,gBAAgB,KAAK,MAAM,OAAO,mBAC3G,IAAI,MAAM,OAAO,cAAc,UAAU,CAAC,EAAA,CAAG,KAC1C,UACC,GAAG,GAAG,EAAE,GAAG,gBAAgB,MAAM,SAAS,cAAc,MAAM,UAAU,EAAE,OAAO,EAAE,GAAG,gBAAgB,KAAK,SAAS,cAAc,MAAM,UAAU,IAAI,KAC1J,GACA,GAAG,aAAa,KAAK,gBACnBD,iBAAO,mBAAmB,GAAG,MAAM,SAAS,cAAc,UAAU,WAAW,CACjF,CACF;GACF;GAEA,IAAI,eAAe,KAAA,GAAW;IAC5B,IACE,MAAM,OAAO,UAAU,KAAA,KACvB,WAAW,MAAM,mBAAmB,MAAM,OAAO,MAAM,kBACvD,YAAY,WAAW,MAAM,OAAO,MAAM,YAAY,MAAM,OAAO,MAAM,OAAO,KAChF,CAACA,iBAAO,0BAA0B;KAAE,GAAG,MAAM;KAAU;IAAW,CAAC,GAEnE,OAAO;KAAE,SAAS,QAAQ,YAAY,OAAO;KAAG,YAAY,CAAC;IAAE;IACjE,IAAI;IAEJ,MAAM,WAAW,OAAO,6BACtB,cACA,YACA,oBACC,aAAa;KACZ,UAAU,QAAQ,aAAa,cAAc,YAAY,YAAY,OAAO;KAE5E,OAAO;IACT,CACF;IAEA,OAAO;KACL,YAAY,UACVA,iBAAO,eAAe,OAAO,MAAM,KACnC,gBAAgB,KAAK,MAAM,QAC1B,eAAe,KAAA,MACbA,iBAAO,eACN,OACA,oCAAoC,WAAW,MAAM,gBACvD,KACEA,iBAAO,eACL,OACA,qCAAqC,WAAW,MAAM,gBACxD;KACN,SAAS,WAAW,QAAQ,YAAY,OAAO;KAC/C,YAAY,SAAS;KACrB,gBAAgB,SAAS;IAC3B;GACF;GAEA,MAAM,iBAAiB,CACrB,OAAOA,iBAAO,UAAU,kBAAkB,kBAAkB,MAAM,CACpE;GAEA,OAAO;IACL,YAAY,UACVA,iBAAO,eAAe,OAAO,MAAM,KAAK,gBAAgB,KAAK,MAAM;IACrE,SAAS,QAAQ,WAAW,OAAO;IACnC,YAAY,CAAC,GAAG,kBAAkB,YAAY,GAAG,cAAc;IAC/D;GACF;EACF,CAAC,CACH;CACF,CAAC;CAkhBH,OAAO;EA/gBL,UACE,YACA,YAEA,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,OAAO;GAExB,MAAM,QAAQ,OAAO,gBAAgB,UAAU;GAE/C,IACG,MAAM,WAAW,sBACf,MAAM,UAAU,KAAA,KAAa,MAAM,eAAe,KAAA,MACpD,MAAM,WAAW,oBAAoB,iBAAiB,KAAA,KACvD,MAAM,eAAe,MAAM,OAAO,cAClC,MAAM,OAAO,kBACX,KAAK,IACH,MAAM,OAAO,4BAA4B,MAAM,OAAO,gBACtD,MAAM,OAAO,UAAU,OAAO,cAC9B,MAAM,OAAO,UAAU,QAAQ,cAC/B,MAAM,OAAO,UAAU,WAAW,YACpC,KACD,MAAM,aAAa,qBAAqB,eACvC,EAAE,wBAAwB,4BAE5B,OAAO,OAAO,YAAY;GAE5B,MAAM,UAAU,wBAAwB,KACtC,OAAOA,iBAAO,SAAS,QAAQ,iBAAiB,QAAQ,mBAAmB,CAC7E;GAEA,OAAO,OAAO,IACZ,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO;IAEvB,MAAM,YAAY,OAAOE,0BAAO,iBAAiB,SAAS,QAAQ,KAAK;IAEvE,IAAI,cAAc,KAAA,GAAW,OAAO,OAAO,YAAY;IACvD,IAAI,iBAAsB,GAAG;IAE7B,IAAI,MAAM,UAAU,KAAA,GAAW;KAC7B,IACE,MAAM,eAAe,KAAA,KACrB,MAAM,WAAW,aAAa,GAAG,MAAM,SAAS,WAChD,MAAM,WAAW,YAAY,oBAC7B,MAAM,MAAM,mBAAmB,MAAM,WAAW,kBAChD,YAAY,MAAM,MAAM,OAAO,MAAM,YAAY,MAAM,WAAW,OAAO,KACzE,MAAM,MAAM,QAAQ,SAAS,aAC7B,CAAC,aAAa,MAAM,MAAM,QAAQ,UAAU,UAAU,QAAQ,KAC9D,UAAU,UAAU,+BAA+B,KAAA,GAEnD,OAAO,OAAO,YAAY;KAC5B,MAAM,YAAY,OAAO,uBAAuB,cAAc,MAAM,UAAU;KAE9E,IAAI,CAAC,UAAU,UAAU,OAAO,OAAO,YAAY;KACnD,iBAAiB,UAAU;IAC7B;IAEA,MAAM,eAAeD,cACnB,mBAAmB,SAAS,WAAW,MAAM,QAAQ,GACrD,cACF;IAEA,MAAM,SAAS,yCAAyC,MAAM;IAE9D,MAAM,WAAW,OAAO,SACtBA,cAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,WAAW,MAAM,SAAS,CAAC,CACtE;IAEA,IAAI,SAAS,QACX,OAAO;KACL,YAAY,UAAmBD,iBAAO,eAAe,OAAO,MAAM;KAClE,SAAS,QAAQ,EAAE,MAAM,WAAW,GAAG,OAAO;KAC9C,YAAY,CACV,OAAOA,iBAAO,UACZC,cAAI,cAAc,UAAU,SAAS,SAAS,EAAE,CAAC,GACjD,MACF,CACF;IACF;IAEF,MAAM,MAAM,OAAOD,iBAAO,oBAAoB,CAAC,GAC7C,QAAQ,gBAAgB;KACtB,YAAY,UAAU;KACtB,UAAU,UAAU;IACtB,CAAC;IAEH,MAAM,cAAc,OAAO,oCAAoC;KAC7D,MAAM;KACN,UAAU,MAAM;KAChB,YAAY,MAAM;KAClB,UAAU,MAAM;KAChB;KACA,WAAW,MAAM;KACjB,QAAQ,MAAM;KACd,UAAU,UAAU;KACpB,GAAI,UAAU,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY,UAAU,SAAS;KAC7E,qBAAqB,UAAU;KAC/B,GAAI,MAAM,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;KAC1D,cAAc,MAAM;KACpB,iBAAiB;KACjB,4BAA4B,MAAM,MAAM,OAAO;KAC/C,mBAAmB,MAAM,MAAM,OAAO;IACxC,CAAC;IAED,MAAM,WAAW,OAAO,kBAAkB,WAAW,GACnD,SAAS,KAAK,IACZ,MAAM,OAAO,UAAU,OAAO,cAC9B,MAAM,OAAO,UAAU,WAAW,cAClC,MAAM,OAAO,UAAU,QAAQ,YACjC;IAEF,MAAM,IAAI,QAAQ,WAChB,KAAK,OAAO,EAAE,OAAO,EAAE,QAAQ,GAC/B,KAAK,OAAO,EAAE,OAAO,EAAE,QAAQ,GAC/B,KAAK,OAAO,EAAE,OAAO,EAAE,UAAU,GACjC,KAAK,OAAO,EAAE,OAAO,EAAE,oBAAoB;IAE7C,MAAM,QAAQ,GAAG,WAAW,GAAG,QAAQ,EAAE,MAAM,SAAS,GAAG,KAAK,IAAI,MAAM,MAAM,UAAU,EAAE,EAAE,IAC5F,YAAY,GAAG,WAAW,GAAG,QAAQ,EAAE,MAAM,SAAS,GAAG,KAAK,IAAI,MAAM,MAAM,UAAU,EAAE,EAAE;IAE9F,MAAM,SAAS,GAAG,yBAAyB,EAAE,MAAM,SAAS,EAAE,SAAS,KAAK,IAAI,MAAM,MAAM,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,KAAK,IAAI,MAAM,UAAU,iBAAiB,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,OAAO,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,qBAAqB,KAAK,EAAE,GAAG,UAAU,QAAQ,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,OAAO,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,KAAK,EAAE,GAAG,UAAU,QAAQ,MAAM,OAAO;IAE/Z,MAAM,UAAU;KACd,CAAC,GAAG,EAAE,QAAQ,MAAM,MAAM,GAAG,MAAM,OAAO,UAAU,MAAM;KAC1D,CAAC,GAAG,EAAE,iBAAiB,KAAK,GAAG,MAAM,OAAO,UAAU,UAAU;KAChE,CAAC,GAAG,EAAE,WAAW,UAAU,eAAe,GAAG,MAAM,OAAO,UAAU,OAAO;IAC7E;IAEA,MAAM,oBAAoBC,cACxB,cACA,QACA,GAAG,QAAQ,KACR,CAAC,WAAW,YACX,GAAG,yBAAyB,EAAE,MAAM,SAAS,EAAE,SAAS,KAAK,IAAI,MAAM,MAAM,UAAU,EAAE,QAAQ,EAAE,OAAO,UAAU,OAAO,EAAE,WAAW,KAAK,EAAE,GAAG,mBAAmB,OAAO,YAAY,EAAE,MAAM,OAAO,OAC3M,GACA,GAAG,4BAA4B,EAAE,MAAM,SAAS,EAAE,SAAS,KAAK,IAAI,MAAM,MAAM,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,KAAK,IAAI,MAAM,MAAM,WAAW,EAAE,SAAS,EAAE,IACtK,GAAG,GAAG,EAAE,GAAG,gBAAgB,MAAM,IAAI,OAAO,EAAE,GAAG,gBAAgB,KAAK,YAAY,4BACpF;IAEA,MAAM,iBAAiB,QAAQ,eAAe,SAAS,KAAK,GAC1D,iBAAiB,QAAQ,eAAe,SAAS,SAAS;IAE5D,MAAM,aAAaA,cACjB,GAAG,wBAAwB,EAAE,MAAM,SAAS,GAAG,KAAK,IAAI,MAAM,MAAM,UAAU,EAAE,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,MAAM,UAAU,EAAE,EAAE,IAC/H,GAAG,GAAG,eAAe,MAAM,IAAI,OAAO,eAAe,MAAM,EAAE,GAAG,mBAChE,GAAG,GAAG,eAAe,KAAK,eAAe,KAAK,QAChD;IAEA,MAAM,QAAQA,cAAI,GAAG,iBAAiB,UAAU;IAEhD,MAAM,SAAS;KACb,GAAG,EAAE,aAAa;MAChB;MACA,iBAAiB,UAAU;MAC3B,iBAAiB;MACjB;MACA,kBAAkB;MAClB,4BAA4B,MAAM;KACpC,CAAC;MACA,EAAE,aAAa;MACf,EAAE,uBAAuB;IAC5B;IAEA,MAAM,WAAW;MACd,EAAE,WAAW,MAAM;MACnB,EAAE,WAAW,MAAM;MACnB,EAAE,YAAY,MAAM;MACpB,EAAE,YAAY,UAAU;MACxB,EAAE,SAAS,MAAM;MACjB,EAAE,aAAa,MAAM;MACrB,EAAE,UAAU;MACZ,EAAE,QAAQ,EAAE,OAAO;MACnB,EAAE,SAAS;MACX,EAAE,WAAW;MACb,EAAE,kBAAkB;MACpB,EAAE,YAAY,EAAE,cAAc,GAAG;MACjC,EAAE,uBAAuB,EAAE,cAAc,YAAY,0BAA0B;MAC/E,EAAE,YAAY;MACd,EAAE,cAAc,EAAE,cAAc,YAAY,iBAAiB;MAC7D,EAAE,aAAa;MACf,EAAE,uBAAuB;IAC5B;IAEA,OAAO;KACL,YAAY,UAAmBD,iBAAO,eAAe,OAAO,MAAM;KAClE,SAAS,QAAQ;MAAE,MAAM;MAAY;KAAY,GAAG,OAAO;KAC3D,YAAY;MACV,OAAOA,iBAAO,UACZ,SACG,OAAO,EAAE,KAAK,CAAC,CACf,OAAO,EAAE,aAAa,MAAM,QAAQ,CAAC,CAAC,CACtC,oBAAoB,CACzB;MACA,OAAOA,iBAAO,UACZ,SACG,OAAO,EAAE,KAAK,CAAC,CACf,IACC,aAAa;OACX,CAAC,EAAE,UAAU,MAAM,QAAQ;OAC3B,CAAC,EAAE,YAAY,EAAE,GAAG,SAAS;OAC7B,CAAC,EAAE,sBAAsB,EAAE,GAAG,kBAAkB,MAAM,CAAC;MACzD,CAAC,CACH,CAAC,CACA,MAAMC,cAAI,GAAG,IAAI,MAAM,QAAQ,GAAG,iBAAiB,CAAC,CACzD;MACA,OAAOD,iBAAO,UAAU,OAAO,aAAa,EAAE,OAAO,QAAQ,KAAK,CAAC;MACnE,OAAOA,iBAAO,UAAU,UAAU,SAAS,QAAQ,GAAG,MAAM;MAC5D,OAAOA,iBAAO,UACZC,cACE,cACA,YACA,GAAG,GAAG,EAAE,GAAG,gBAAgB,KAAK,YAAY,8BAC5C,GAAG,yBAAyB,EAAE,MAAM,SAAS,EAAE,SAAS,KAAK,IAAI,MAAM,MAAM,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,KAAK,IAAI,MAAM,UAAU,iBAAiB,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,OAAO,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,qBAAqB,KAAK,EAAE,GAAG,UAAU,QAAQ,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,OAAO,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,KAAK,EAAE,GAAG,UAAU,SAAS,MAAM,OAAO,4BACjZ,GAAG,QAAQ,KACR,CAAC,WAAW,YACX,GAAG,yBAAyB,EAAE,MAAM,SAAS,EAAE,SAAS,KAAK,IAAI,MAAM,MAAM,UAAU,EAAE,QAAQ,EAAE,OAAO,UAAU,OAAO,EAAE,WAAW,KAAK,EAAE,GAAG,mBAAmB,OAAO,YAAY,EAAE,OAAO,OAAO,OAC5M,CACF,GACA,MACF;KACF;IACF;GACF,CAAC,CACH;EACF,CAAC;EACH,eACE,YACA,YAEA,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,OAAO;GAExB,MAAM,cAAc,OAAO,oCAAoC,WAAW,WAAW,GACnF,QAAQ,OAAO,8BAA8B,WAAW,KAAK,GAC7D,WAAW,OAAO,kBAAkB,WAAW,GAC/C,gBAAgB,OAAO,4BAA4B,KAAK;GAE1D,KAAK,OAAO,kBAAkB,cAAc,KAAK,CAAC,OAAO,UACvD,OAAO,OAAO,YAAY;GAE5B,OAAO,OAAO,IACZ,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO;IAEvB,MAAM,YAAY,OAAO,QAAQ,WAAW,GAC1C,OAAO,OAAO,SACZA,cAAI,GAAG,EAAE,UAAU,YAAY,QAAQ,GAAG,GAAG,EAAE,UAAU,YAAY,QAAQ,CAAC,CAChF,GACA,MAAM,KAAK;IAEb,IACE,cAAc,KAAA,KACd,KAAK,WAAW,KAChB,EAAE,OAAOC,0BAAO,cACd,SACA,KACA,aACA,UAAU,iBACV,QACF,IAEA,OAAO;KAAE,SAAS,QAAQ,YAAY,OAAO;KAAG,YAAY,CAAC;IAAE;IAEjE,MAAM,SAAS,uCAAuC,MAAM,YAC1D,OAAOD,cACL,mBAAmB,SAAS,WAAW,MAAM,QAAQ,GACrD,GAAG,GAAG,EAAE,GAAG,gBAAgB,MAAM,MAAM,eAAe,OAAO,EAAE,GAAG,gBAAgB,KAAK,YAAY,2BAA2B,OAAO,EAAE,GAAG,gBAAgB,KAAK,MAAM,iBACvK;IAEF,MAAM,WAAW;KACf,GAAG;MACF,EAAE,QAAQ,EAAE,OAAO;MACnB,EAAE,WAAW;MACb,EAAE,SAAS,MAAM;MACjB,EAAE,YAAY,EAAE,cAAc,MAAM,eAAe;IACtD;IAEA,OAAO;KACL,YAAY,UAAmBD,iBAAO,eAAe,OAAO,MAAM;KAClE,SAAS,QAAQ,aAAa,OAAO;KACrC,YAAY;MACV,OAAOA,iBAAO,UAAUC,cAAI,MAAM,UAAU,SAAS,GAAG,CAAC,GAAI,MAAM;MACnE,OAAOD,iBAAO,UACZ,SACG,OAAO,EAAE,KAAK,CAAC,CACf,IAAI,EAAE,YAAY;OAAE;OAAO,UAAU;MAAc,CAAC,CAAC,CAAC,CACtD,MAAME,0BAAO,aAAa,SAAS,GAAG,CAAC,CAC5C;MACA,OAAOF,iBAAO,UAAUC,cAAI,MAAM,UAAU,SAAS,QAAQ,CAAC,GAAI,MAAM;KAC1E;IACF;GACF,CAAC,CACH;EACF,CAAC;EACH,UAAU,eACR,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,OAAO;GAExB,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;GAErD,MAAM,QAAQ,OAAO,OAAO,aAAa,YAAY,CAAC,CAAC,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,KACtE,OAAO,SAAS,WAAW,CAC7B,GACA,OAAO,OAAO,SACZA,cACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,YAAY,MAAM,UAAU,GACjC,GAAG,EAAE,QAAQ,MAAM,MAAM,GACzB,GAAG,EAAE,OAAO,EAAE,OAAO,KAAK,CAC5B,CACF;GAEF,IAAI,KAAK,WAAW,GAAG,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;GAE7D,MAAM,SAAS,OAAO,4BAA4B,KAAK,EAAE,CAAC,EAAE,SAAS,GACnE,YAAY,OAAO,QAAQ,MAAM;GAEnC,IACE,cAAc,KAAA,KACd,OAAO,aAAa,MAAM,YAC1B,OAAO,eAAe,MAAM,cAC5B,OAAO,WAAW,MAAM,UACxB,EAAE,OAAOC,0BAAO,cACd,SACA,KAAK,IACL,QACA,UAAU,iBACV,OAAO,4BAA4B,MAAM,CAC3C,IAEA,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;GAExC,MAAM,YAAYD,cAChBC,0BAAO,aAAa,SAAS,KAAK,EAAE,GACpC,mBAAmB,SAAS,WAAW,OAAO,QAAQ,GACtD,GAAG,GAAG,EAAE,GAAG,gBAAgB,MAAM,OAAO,eAAe,OAAO,EAAE,GAAG,gBAAgB,KAAK,OAAO,iBACjG;GAEA,MAAM,iBAAiB,OAAOF,iBAAO,UACnC,GAAG,wBAAwB,EAAE,MAAM,SAAS,UAAU,IACtD,yCAAyC,OAAO,UAClD;GAEA,MAAM,QAAQ,OAAO,OAAO,IAAI;IAC9B,WAAW,4BAA4B,SAAS,SAAS,gBAAgB,WAAW;IACpF,QAAQ,UACN,OAAO,GAAG,mBAAmB,CAAC,CAAC,KAAK,IAChC,QACA,wBAAwB,KAAK;KAAE,WAAW;KAAW;IAAM,CAAC;GACpE,CAAC;GAED,OAAO,SAAS,QACb,MAAM,CAAC,KAAK,CAAC,CAAC,CACd,KACC,OAAO,YAEH,UAEA,oBAAoB,QAAQ,YAC1BA,iBAAO,eACL,SACA,yCAAyC,OAAO,UAClD,CACF,IACI,OAAO,KAAK,iBAAiB,KAAK,CAAC,CAAC,CAAC,IACrC,OAAO,UAAU,KAAK,CAC9B,CACF;GAEF,OAAO;IAAE;IAAQ,oBAAoB,UAAU;GAAY;EAC7D,CAAC;EACH;EACA,gBAAgB;EAChB,SACE,YACA,YAEA,OAAO,IAAI,aAAa;GACtB,MAAM,SAAS,OAAO,8BAA8B,WAAW,MAAM;GAErE,OAAO,OAAO,IACZ,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO;IAEvB,MAAM,YAAY,OAAO,QAAQ,MAAM,GACrC,OAAO,OAAO,SACZC,cAAI,GAAG,EAAE,UAAU,OAAO,QAAQ,GAAG,GAAG,EAAE,UAAU,OAAO,QAAQ,CAAC,CACtE,GACA,MAAM,KAAK;IAEb,IACE,cAAc,KAAA,KACd,KAAK,WAAW,KAChB,EAAE,OAAOC,0BAAO,cACd,SACA,KACA,QACA,UAAU,iBACV,OAAO,4BAA4B,MAAM,CAC3C,IAEA,OAAO;KAAE,SAAS,QAAQ,OAAO,OAAO;KAAG,YAAY,CAAC;IAAE;IAC5D,MAAM,SAAS,wCAAwC,OAAO;IAE9D,OAAO;KACL,YAAY,UAAmBF,iBAAO,eAAe,OAAO,MAAM;KAClE,SAAS,QAAQ,MAAM,OAAO;KAC9B,YAAY,CACV,OAAOA,iBAAO,UACZC,cACE,UAAU,SAAS,GAAG,GACtB,mBAAmB,SAAS,WAAW,OAAO,QAAQ,GACtD,GAAG,GAAG,EAAE,GAAG,gBAAgB,MAAM,OAAO,eAAe,OAAO,EAAE,GAAG,gBAAgB,KAAK,OAAO,iBACjG,GACA,MACF,GACA,GAAI,OAAO,mBAAmB,SAAS,KAAK,aAAa,MAAM,CACjE;IACF;GACF,CAAC,CACH;EACF,CAAC;EACH,UACE,YACA,YAEA,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,OAAO;GAExB,MAAM,QAAQ,EAAE,GAAG,WAAW;GAE9B,IAAI,CAAC,OAAO,cAAc,MAAM,KAAK,KAAK,MAAM,QAAQ,KAAK,MAAM,QAAQ,KACzE,OAAO,OAAO,YAAY;GAE5B,OAAO,OAAO,IACZ,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO;IAEvB,MAAM,MAAMA,cACV,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GACEA,cACE,IAAI,EAAE,aAAa,EAAE,GAAG,SAAS,GACjC,IAAI,EAAE,sBAAsB,EAAE,GAAG,SAAS,CAC5C,GACAA,cACE,UAAU,EAAE,QAAQ,GACpB,GACEA,cACE,GAAG,EAAE,OAAO,EAAE,OAAO,SAAS,GAC9B,IAAI,EAAE,sBAAsB,EAAE,GAAG,SAAS,CAC5C,GACAA,cAAI,GAAG,EAAE,OAAO,EAAE,OAAO,KAAK,GAAG,IAAI,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC,CACnE,CACF,CACF,CACF;IAEA,MAAM,OAAO,OAAO,SACjB,OAAO,CAAC,CACR,KAAK,EAAE,KAAK,CAAC,CACb,MAAM,GAAG,CAAC,CACV,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,CAChC,MAAM,MAAM,QAAQ,CAAC;IAExB,MAAM,MAAM,OAAOD,iBAAO,oBAAoB,CAAC,GAC7C,aAA+B,CAAC,GAChC,SAAS,yCAAyC,MAAM;IAE1D,IAAI,UAAU;IAEd,KAAK,MAAM,OAAO,KAAK,MAAM,GAAG,MAAM,KAAK,GAAG;KAC5C,MAAM,WAAW,OAAO,EAAE,cAAc,IAAI,EAAE,YAAY,GACxD,SAAS,OAAO,EAAE,cAAc,IAAI,EAAE,qBAAqB;KAE7D,WAAW,KACT,OAAOA,iBAAO,UACZC,cACE,UAAU,SAAS,GAAG,GACtB,GAAG,wBAAwB,EAAE,MAAM,SAASC,0BAAO,aAAa,SAAS,GAAG,EAAE,OAAO,IAAI,EAC3F,GACA,MACF,CACF;KACA,IAAI,YAAY,OAAO,UAAU,KAAK;MACpC,WAAW,KACT,OAAOF,iBAAO,UACZ,SACG,OAAO,EAAE,KAAK,CAAC,CACf,MACCC,cACEC,0BAAO,aAAa,SAAS,GAAG,GAChC,IAAI,EAAE,aAAa,EAAE,GAAG,SAAS,GACjC,IAAI,EAAE,sBAAsB,EAAE,GAAG,SAAS,CAC5C,CACF,CACJ,GACA,OAAOF,iBAAO,UACZ,GAAG,4BAA4B,EAAE,MAAM,SAAS,EAAE,SAAS,KAAK,IAAI,MAAM,MAAM,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,KAAK,IAAI,MAAM,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,IACpK,MACF,CACF;MACA;KACF,OACE,WAAW,KAAK,GAAI,OAAO,mBAAmB,SAAS,KAAK,WAAW,MAAM,CAAE;IACnF;IACA,MAAM,UAAU,KAAK,SAAS,MAAM;IAEpC,WAAW,KACT,OAAOA,iBAAO,UACZ,UACI,GAAG,wBAAwB,EAAE,MAAM,SAAS,IAAI,KAChD,GAAG,4BAA4B,EAAE,MAAM,SAAS,IAAI,IACxD,MACF,CACF;IAEA,OAAO;KACL,YAAY,UAAmBA,iBAAO,eAAe,OAAO,MAAM;KAClE,SAAS,QAAQ;MAAE;MAAS;KAAQ,GAAG,OAAO;KAC9C;IACF;GACF,CAAC,CACH;EACF,CAAC;CAGS;AAChB;AAEA,MAAa,4CAA4C,OAAO,WAAW,WAoBzE,SACA,cACA;CACA,MAAM,WAAW,OAAOG;CAExB,MAAM,QAAQ,OAAO;CACrB,MAAM,QAAQ,kBAAkB,SAA+B,YAAY;CAE3E,MAAM,OAAsB,SAC1B,OAAO,IAAI,aAAa;EACtB,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;EAErD,OAAO,OAAO,kBAAkB,IAAI;CACtC,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,2BAA2B,QAAQ,GACzD,OAAO,eAAe,oBAAoB,QAA0C,GACpF,OAAO,eAAe,gBAAgB,KAAK,CAC7C;CAsBF,OAAO,EAAE,6BAA6B;EAnBpC,UAAU,OAAO,YAAY,IAAI,MAAM,QAAQ,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,gBAAgB;EACrF,eAAe,OAAO,YACpB,IAAI,MAAM,aAAa,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,gBAAgB;EAC/D,UAAU,UACR,MACG,QAAQ,KAAK,CAAC,CACd,KACC,OAAO,eAAe,2BAA2B,QAAQ,GACzD,OAAO,eAAe,oBAAoB,QAA0C,GACpF,OAAO,eAAe,gBAAgB,KAAK,GAC3C,uBACF;EACJ,WAAW,OAAO,YAAY,IAAI,MAAM,SAAS,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,gBAAgB;EACvF,iBAAiB,OAAO,YACtB,IAAI,MAAM,eAAe,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,gBAAgB;EACjE,SAAS,OAAO,YAAY,IAAI,MAAM,OAAO,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,gBAAgB;EACnF,UAAU,OAAO,YAAY,IAAI,MAAM,QAAQ,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,gBAAgB;CAG3C,EAAE;AAChD,CAAC;AAED,SAAgB,wCA0Bd,SACA,SAmBA,MAKA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO;EAErB,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;EA0HrD,QAAO,OAxHe,uBAElB,OAAO,IAAI,aAAa;GACtB,MAAM,aAA+B,CAAC;GACtC,IAAI;GACJ,IAAI,WAAW;GAEf,MAAM,kBAAkB,kBAAkB,GAAG,EAC3C,SAAS,cAAc,OAAO,WAAW,WAAW,KAAK,SAAS,CAAC,EACrE,CAAC;GAED,MAAM,QAAQ,OAAO,YAAY,YAAY,CAAC,CAAC,CAAC,KAC9C,OAAO,eAAe,mBAAmB,eAAe,CAC1D;GAEA,MAAM,WAA0B,WAC9B,OAAO,KACL,OAAO,cACL,OAAO,WAAW;IAChB,WAAW;GACb,CAAC,CACH,CACF;GAEF,MAAM,QAAQ,kBACZ,QAAQ,SACR,QAAQ,YACV;GAEA,MAAM,OAAsB,SAC1B,uBAEI,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO;IACvB,MAAM,UAAU,OAAO;IAEvB,OAAO,MAAM;IACb,IAAI,aAAa,KAAA,GAAW,OAAO,OAAO,YAAY;IACtD,MAAM,UAAU;KAAE,GAAG;KAAS,cAAc,QAAQ,QAAQ,KAAA,CAAS;IAAE;IAEvE,WAAW;IACX,WAAW,KAAK,GAAG,QAAQ,UAAU;IAErC,OAAO,QAAQ;GACjB,CAAC,GACH,EAAE,MAAM,QAAQ,CAClB,CAAC,CAAC,KACA,OAAO,KAAK,WAAW,OAAO,KAAK,GACnC,OAAO,eAAe,2BAA2B,QAAQ,GACzD,OAAO,eACL,oBACA,QACF,GACA,OAAO,eAAe,gBAAgB,KAAK,CAC7C;GAmCF,MAAM,WAAW,QAAQ,KAAK,QAAQ,QAAQ;IAhC5C,UAAU,OAAO,YACf,MAAM,IAAI,QAAQ,IAAI,MAAM,QAAQ,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,gBAAgB,CAAC,CAAC;IAC9E,eAAe,OAAO,YACpB,MAAM,IAAI,QAAQ,IAAI,MAAM,aAAa,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,gBAAgB,CAAC,CAAC;IACnF,UAAU,UACR,MAAM,IACJ,QACE,MACG,QAAQ,KAAK,CAAC,CACd,KACC,OAAO,eAAe,2BAA2B,QAAQ,GACzD,OAAO,eACL,oBACA,QACF,GACA,OAAO,eAAe,gBAAgB,KAAK,GAC3C,uBACF,CACJ,CACF;IACF,WAAW,OAAO,YAChB,MAAM,IAAI,QAAQ,IAAI,MAAM,SAAS,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,gBAAgB,CAAC,CAAC;IAC/E,iBAAiB,OAAO,YACtB,MAAM,IACJ,QAAQ,IAAI,MAAM,eAAe,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,gBAAgB,CAAC,CAC1E;IACF,SAAS,OAAO,YACd,MAAM,IAAI,QAAQ,IAAI,MAAM,OAAO,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,gBAAgB,CAAC,CAAC;IAC7E,UAAU,OAAO,YACf,MAAM,IAAI,QAAQ,IAAI,MAAM,QAAQ,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,gBAAgB,CAAC,CAAC;GAG5B,CAAC,CAAC,CAAC,KACrD,QAAQ,IAAI,mBAAmB,MAAM,SAAS,CAChD;GAEA,MAAM,QAAQ,OAAO,MAAM,MAAM,OAAO,eAAe,MAAM,QAAQ,CAAC;GAEtE,IAAI,UAAU,OAAO,OAAO,YAAY;GACxC,IAAI,UAAU,iBAAiB,KAAA,GAAW;IACxC,MAAM,SAAS,OAAO,OAAO,OAAO,SAAS,aAAa,IAAI;IAE9D,IAAI,OAAO,SAAS,aAAa,OAAO,QAAQ,SAAS,iBACvD,OAAO,OAAO,YAAY;GAC9B;GACA,OAAO,SAAS,QACb,MAAM,CAAC,GAAG,YAAY,GAAI,UAAU,kBAAkB,CAAC,CAAE,CAAC,CAAC,CAC3D,KACC,OAAO,YAAY,UACjB,OAAO,UACL,MAAM,IAAI,QAAQ,UAChB,oBAAoB,OAAO,UAAU,SAAS,IAAI,YAAY,IAAI,KACpE,CACF,CACF,GACA,gBACF;GAEF,OAAO;EACT,CAAC,GACH,EAAE,MAAM,QAAQ,CAClB,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC,EAAA,CAErC;CAChB,CAAC,CACH;AACF;AAEA,MAAM,oBACJ,WAEA,yBACE,SACC,UACC,OAAO,GAAG,mBAAmB,CAAC,CAAC,KAAK,KACpC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,sBAAsB,CAAC,CAAC,KAAK,CAC3C,CAAC,CAAC,KAAK,OAAO,YAAY,UAAU,OAAO,UAAU,MAAM,IAAI,aAAa,YAAY,CAAC,CAAC,CAAC,CAAC;AAE9F,MAAM,2BACJ,WAEA,yBACE,SACC,UACC,OAAO,GAAG,mBAAmB,CAAC,CAAC,KAAK,KACpC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,sBAAsB,CAAC,CAAC,KAAK,CAC3C,CAAC,CAAC,KACA,OAAO,YAAY,UACjB,OAAO,UACL,MAAM,IAAI,QAAQ,UAAW,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,IAAI,QAAQ,YAAY,CAAE,CAC1F,CACF,CACF;AAEF,MAAM,qBAA8B,SAClC,OAAO,cAAc;CACnB,IAAI;CAEJ,OAAO,uBAEH,OAAO,IAAI,aAAa;EACtB,MAAM,WAAW,OAAO;EACxB,MAAM,UAAU,OAAO;EAEvB,YAAY,QAAQ;EACpB,OAAO,SAAS,QAAQ,MAAM,CAAC,GAAG,QAAQ,YAAY,GAAI,QAAQ,kBAAkB,CAAC,CAAE,CAAC;EAExF,OAAO,QAAQ;CACjB,CAAC,GACH,EAAE,MAAM,QAAQ,CAClB,CAAC,CAAC,KACA,OAAO,KAAK,WAAW,OAAO,KAAK,GACnC,OAAO,YAAY,UACjB,OAAO,UACL,MAAM,IAAI,QAAQ,UAChB,oBAAoB,OAAO,SAAS,IAAI,YAAY,IAAI,KAC1D,CACF,CACF,CACF;AACF,CAAC"}

package/dist/drizzle/d1-passwords.d.mts

@@ -2,6 +2,7 @@ import { D1PasswordPersistenceMapping, PasswordRegistrationMapping } from "./pas
 import "./model.mjs";
 import { D1ProofPersistenceMapping } from "./proof-model.mjs";
 import { PasswordRegistrationAuthority } from "./password-registration.mjs";
+import { Database as Database$1 } from "./d1-database.mjs";
 import { D1BatchStatements } from "./D1BatchStatements.mjs";
 import { SuppliedService } from "./SuppliedService.mjs";
 import "./d1-planning.mjs";
@@ -13,16 +14,16 @@ import { HookConfigurationError, LifecycleHooks, PreparedCommit } from "@yielded
 import { SecurityRevision } from "@yielded/auth/Sessions";
 import { ProofCompletionInput, ProofCompletionPlan } from "@yielded/auth/Proofs";
 import { PasswordAttemptDecision, PasswordAttemptPolicy, PasswordCredentialSnapshot, PasswordMutationDecision, PasswordMutationInput, PasswordPersistence, PasswordUnavailable, PreparePasswordCommit } from "@yielded/auth/Password";
+import { EffectSQLiteD1Database } from "drizzle-orm/effect-d1";
 import { AnySQLiteTable } from "drizzle-orm/sqlite-core";
 import { Statement } from "effect/sql/Statement";
 import { D1Client } from "@effect/sql-d1/D1Client";
-import { EffectSQLiteD1Database } from "drizzle-orm/effect-d1";
 import "drizzle-orm/effect-core";
 //#region src/drizzle/d1-passwords.d.ts
 type Database = EffectSQLiteD1Database<AnyRelations> & {
   readonly $client: D1Client;
 };
-export declare const makeD1PasswordPersistenceServices: <S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, A extends AnySQLiteTable, RS extends AnySQLiteTable, CE extends AnySQLiteTable, M extends AnySQLiteTable, NativeId>(database: Database, mapping: D1PasswordPersistenceMapping<S, I, C, AC, A, RS, CE, M, NativeId>, proofMapping?: D1ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any>) => Effect.Effect<{
+export declare const makeD1PasswordPersistenceServices: <S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, A extends AnySQLiteTable, RS extends AnySQLiteTable, CE extends AnySQLiteTable, M extends AnySQLiteTable, NativeId>(mapping: D1PasswordPersistenceMapping<S, I, C, AC, A, RS, CE, M, NativeId>, proofMapping?: D1ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any> | undefined) => Effect.Effect<{
   passwordPersistence: {
     readonly admitAttempt: <A_1>(input: {
       readonly moduleId: string;
@@ -64,7 +65,7 @@ export declare const makeD1PasswordPersistenceServices: <S extends AnySQLiteTabl
       readonly hasMore: boolean;
     }, A_1>) => Effect.Effect<PreparedCommit<A_1>, PasswordUnavailable>;
   };
-}, never, LifecycleHooks>;
+}, never, Database$1 | LifecycleHooks>;
 type CoordinatorError<E> = E | PasswordUnavailable | HookConfigurationError;
 /**
  * Owns one password transition plus application statements in one D1 batch.
@@ -75,9 +76,9 @@ export declare function coordinateD1PasswordPersistence<S extends AnySQLiteTable
   readonly mapping: D1PasswordPersistenceMapping<S, I, C, AC, At, RS, CE, M, NativeId>;
   readonly proofMapping?: D1ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any> | undefined;
 }, body: Effect.Effect<A, E, R>): Effect.Effect<A, CoordinatorError<E> | DatabaseError, Exclude<R, PasswordPersistence | D1BatchStatements> | LifecycleHooks | DatabaseRequirements>;
-export declare const makeD1PasswordRegistrationServices: <Registration, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, Rq extends AnySQLiteTable, NativeId>(database: Database, mapping: PasswordRegistrationMapping<Registration, S, I, C, AC, Rq, NativeId>) => Effect.Effect<{
+export declare const makeD1PasswordRegistrationServices: <Registration, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, Rq extends AnySQLiteTable, NativeId>(mapping: PasswordRegistrationMapping<Registration, S, I, C, AC, Rq, NativeId>) => Effect.Effect<{
   registrationAuthority: PasswordRegistrationAuthority<Registration>;
-}, never, LifecycleHooks>;
+}, never, Database$1 | LifecycleHooks>;
 export declare function coordinateD1PasswordRegistration<TargetId, Registration, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, Rq extends AnySQLiteTable, NativeId, A, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
   readonly mapping: PasswordRegistrationMapping<NoInfer<Registration>, S, I, C, AC, Rq, NativeId>;
   readonly target: SuppliedService<TargetId, PasswordRegistrationAuthority<Registration>>;

package/dist/drizzle/d1-passwords.mjs

@@ -1,6 +1,7 @@
 import { requiredPasswordConstraints, requiredPasswordRegistrationConstraints } from "./password-model.mjs";
 import { PersistenceMappingError, column, isMappedConstraintConflict, updateValues } from "./model.mjs";
 import { balancedD1And } from "./d1-generated-statement.mjs";
+import { Database } from "./d1-database.mjs";
 import { D1BatchStatements } from "./D1BatchStatements.mjs";
 import { CurrentD1PlanningDatabase, makeD1Owner } from "./d1-planning.mjs";
 import { compileD1ProofCompletionPlan } from "./d1-proofs.mjs";
@@ -193,22 +194,23 @@ const scopeEntries = (keys, policy) => {
 	});
 	return entries;
 };
+const livePendingAttempts = (mapping, moduleId, action, entry, identifier, nativeSubjectId, activeAt) => {
+	const a = attemptColumns(mapping);
+	return and(entry.kind === "action" ? and(eq(a.moduleId, moduleId), eq(a.action, action)) : entry.kind === "identifier" ? and(eq(a.moduleId, moduleId), eq(a.action, action), eq(a.identifierNamespace, identifier.namespace), eq(a.identifierValue, identifier.value)) : and(eq(a.moduleId, moduleId), eq(a.action, action), eq(a.subjectId, nativeSubjectId)), eq(a.state, "pending"), sql`${a.retentionUntil} > ${activeAt}`);
+};
 const scopeAdmissionCondition = (mapping, moduleId, action, entry, policy, identifier, nativeSubjectId) => {
 	const c = chargeColumns(mapping);
-	const a = attemptColumns(mapping);
-	const pending = entry.kind === "action" ? and(eq(a.moduleId, moduleId), eq(a.action, action), eq(a.state, "pending")) : entry.kind === "identifier" ? and(eq(a.moduleId, moduleId), eq(a.action, action), eq(a.identifierNamespace, identifier.namespace), eq(a.identifierValue, identifier.value), eq(a.state, "pending")) : and(eq(a.moduleId, moduleId), eq(a.action, action), eq(a.subjectId, nativeSubjectId), eq(a.state, "pending"));
+	const pending = livePendingAttempts(mapping, moduleId, action, entry, identifier, nativeSubjectId, mapping.d1.engineNow);
 	return sql`(select count(*) from ${mapping.charge.table} where ${c.moduleId} = ${sql.param(moduleId, c.moduleId)} and ${c.action} = ${sql.param(action, c.action)} and ${c.scopeKind} = ${sql.param(entry.kind, c.scopeKind)} and ${c.scopeKey} = ${sql.param(entry.key, c.scopeKey)} and ${c.occurredAt} >= ${mapping.d1.engineInstantMinus(entry.windowMillis)}) < ${entry.limit} and (select count(*) from ${mapping.attempt.table} where ${pending}) < ${policy.maximumPending}`;
 };
 const readScopeAdmission = Effect.fn("DrizzleD1Password.readScopeAdmission")(function* (mapping, moduleId, action, entries, policy, identifier, nativeSubjectId, now) {
 	const database = yield* CurrentD1PlanningDatabase;
 	const c = chargeColumns(mapping);
-	const a = attemptColumns(mapping);
 	const admitted = [];
 	for (let index = 0; index < entries.length; index++) {
 		const entry = entries[index];
 		const chargeRows = yield* mapAdapter(database.select({ total: count() }).from(mapping.charge.table).where(and(eq(c.moduleId, moduleId), eq(c.action, action), eq(c.scopeKind, entry.kind), eq(c.scopeKey, entry.key), gte(c.occurredAt, mapping.encodeInstant(now - entry.windowMillis)))));
-		const pendingWhere = entry.kind === "action" ? and(eq(a.moduleId, moduleId), eq(a.action, action), eq(a.state, "pending")) : entry.kind === "identifier" ? and(eq(a.moduleId, moduleId), eq(a.action, action), eq(a.identifierNamespace, identifier.namespace), eq(a.identifierValue, identifier.value), eq(a.state, "pending")) : and(eq(a.moduleId, moduleId), eq(a.action, action), eq(a.subjectId, nativeSubjectId), eq(a.state, "pending"));
-		const pendingRows = yield* mapAdapter(database.select({ total: count() }).from(mapping.attempt.table).where(pendingWhere));
+		const pendingRows = yield* mapAdapter(database.select({ total: count() }).from(mapping.attempt.table).where(livePendingAttempts(mapping, moduleId, action, entry, identifier, nativeSubjectId, mapping.encodeInstant(now))));
 		if (Number(chargeRows[0]?.total ?? 0) < entry.limit && Number(pendingRows[0]?.total ?? 0) < policy.maximumPending) admitted.push(entry);
 		else if (index === 0) break;
 	}
@@ -752,7 +754,8 @@ const cleanupPlan = Effect.fn("Drizzle.cleanupPlan")(function* (mapping, input,
 		retryable: (cause) => isGuardFailure(cause, marker)
 	};
 });
-const makeD1PasswordPersistenceServices = (database, mapping, proofMapping) => Effect.gen(function* () {
+const makeD1PasswordPersistenceServices = Effect.fnUntraced(function* (mapping, proofMapping) {
+	const database = yield* Database;
 	const hooks = yield* LifecycleHooks;
 	const plans = makePasswordPlans(mapping, proofMapping);
 	const run = (plan) => Effect.gen(function* () {
@@ -923,7 +926,8 @@ const makeRegistrationPlans = (mapping) => ({ register: (input, prepare) => Effe
 	const allocated = yield* allocateRegistration(mapping);
 	return yield* planRegistration(mapping, input, allocated, prepare);
 }) });
-const makeD1PasswordRegistrationServices = (database, mapping) => Effect.gen(function* () {
+const makeD1PasswordRegistrationServices = Effect.fnUntraced(function* (mapping) {
+	const database = yield* Database;
 	const hooks = yield* LifecycleHooks;
 	const plans = makeRegistrationPlans(mapping);
 	const run = (plan) => Effect.gen(function* () {