@yielded/auth-persistence-drizzle 0.1.0-beta.16 → 0.1.0-beta.18

package/dist/drizzle/password-prepared-sql.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"password-prepared-sql.mjs","names":["kernel"],"sources":["../../src/drizzle/password-prepared-sql.ts"],"sourcesContent":["import {\n  type NativeDatabase,\n  CurrentPasswordPreparedTransaction,\n  PasswordPreparedPostconditions,\n  PasswordPreparedJournalGuards,\n} from \"@yielded/auth-persistence/Adapter\";\nimport { CurrentCommitJournal, LifecycleHooks, HookConfigurationError } from \"@yielded/auth/Hooks\";\nimport {\n  PasswordUnavailable,\n  PasswordRejected,\n  PasswordPreparedVersion,\n  decodePasswordPreparedReady,\n  encodePasswordPreparedReady,\n  snapshotPasswordPreparedReady,\n  snapshotPasswordPreparedReservation,\n  type PasswordPreparedReady,\n  type PasswordPreparedReservation,\n  snapshotPasswordCredential,\n  snapshotPasswordRequirement,\n  type PasswordMutationDecision,\n  type PreparePasswordCommit,\n  type PasswordPreparedPersistence,\n  type PasswordPreparedMutation,\n} from \"@yielded/auth/Password\";\nimport { reportPersistenceFailure } from \"@yielded/auth/Persistence\";\nimport { type ProofCompletionPlan, ProofUnavailable, ProofBinding } from \"@yielded/auth/Proofs\";\nimport { AuthenticationRevision } from \"@yielded/auth/Sessions\";\n/* oxlint-disable no-explicit-any -- concrete driver makers retain consumer table types. */\nimport { and, count, eq, gt, isNotNull, isNull, lte, or, type SQL } from \"drizzle-orm\";\nimport { Cause, DateTime, Effect, Option, Predicate, Redacted, Schema } from \"effect\";\n\nimport { column } from \"./model\";\nimport {\n  requiredPasswordPreparedConstraints,\n  type AnyPasswordPreparedPersistenceMapping,\n  type PasswordPreparedState,\n} from \"./password-prepared-model\";\nimport {\n  ContextInput,\n  CompletionInput,\n  encodeReservation,\n  evidenceCurrent,\n  identifierScope,\n  reservationOf,\n  sameRevision,\n  snapshotMutation,\n  snapshotReserve,\n  unavailable,\n} from \"./password-prepared-state\";\nimport {\n  CurrentPasswordSql,\n  passwordSqlKernel as kernel,\n  type PasswordSqlConfiguration,\n  type PasswordSqlQuery,\n} from \"./password-sql\";\nimport { checkProofCompletionIn, completeProofPlanIn } from \"./proof-sql\";\nimport { validateDrizzleStorage } from \"./storage-validation\";\n\nconst translateFailure = <A, E, R>(\n  effect: Effect.Effect<A, E, R>,\n): Effect.Effect<A, PasswordUnavailable, R> =>\n  reportPersistenceFailure(\n    effect,\n    (error) =>\n      Schema.is(PasswordUnavailable)(error) ||\n      Schema.is(ProofUnavailable)(error) ||\n      Schema.is(HookConfigurationError)(error),\n  ).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));\n\nconst translateContextFailure = <A, E, R>(\n  effect: Effect.Effect<A, E, R>,\n): Effect.Effect<A, PasswordUnavailable | PasswordRejected, R> =>\n  reportPersistenceFailure(\n    effect,\n    (error) =>\n      Schema.is(PasswordUnavailable)(error) ||\n      Schema.is(PasswordRejected)(error) ||\n      Schema.is(ProofUnavailable)(error) ||\n      Schema.is(HookConfigurationError)(error),\n  ).pipe(\n    Effect.catchCause((cause) =>\n      Effect.failCause(\n        Cause.map(cause, (error) => (Schema.is(PasswordRejected)(error) ? error : unavailable())),\n      ),\n    ),\n  );\n\ntype Mapping = AnyPasswordPreparedPersistenceMapping;\nconst nowMillis = DateTime.now.pipe(Effect.map(DateTime.toEpochMillis));\n\nconst read = (query: PasswordSqlQuery, locking: boolean) =>\n  locking && typeof query.for === \"function\" ? query.for(\"update\") : query;\n\nconst columns = (mapping: Mapping) => {\n  const table = mapping.intent;\n\n  return {\n    moduleId: column(table.table, table.moduleId),\n    intentId: column(table.table, table.intentId),\n    commandId: column(table.table, table.commandId),\n    subjectId: column(table.table, table.subjectId),\n    action: column(table.table, table.action),\n    generation: column(table.table, table.generation),\n    version: column(table.table, table.version),\n    state: column(table.table, table.state),\n    digest: column(table.table, table.digest),\n    snapshot: column(table.table, table.snapshot),\n    identifierScope: column(table.table, table.identifierScope),\n    createdAt: column(table.table, table.createdAt),\n    admittedAt: column(table.table, table.admittedAt),\n    admissionRetainUntil: column(table.table, table.admissionRetainUntil),\n    preparationExpiresAt: column(table.table, table.preparationExpiresAt),\n    expiresAt: column(table.table, table.expiresAt),\n    retainUntil: column(table.table, table.retainUntil),\n  };\n};\n\nconst valid = (mapping: Mapping) =>\n  Object.entries(requiredPasswordPreparedConstraints).every(\n    ([key, value]) =>\n      mapping.constraints[key as keyof typeof requiredPasswordPreparedConstraints] === value,\n  );\n\nconst lockAnchor = Effect.fn(\"DrizzlePasswordPrepared.lockAnchor\")(function* (\n  mapping: Mapping,\n  configuration: PasswordSqlConfiguration,\n  moduleId: string,\n  create = true,\n) {\n  const database = yield* CurrentPasswordSql;\n\n  const a = mapping.admission,\n    key = column(a.table, a.moduleId);\n\n  if (create)\n    yield* configuration.insertIfAbsent(\n      database.insert(a.table).values(a.encodeInsert(moduleId)),\n      a.moduleId,\n      moduleId,\n    );\n\n  const rows = yield* read(\n    database.select().from(a.table).where(eq(key, moduleId)).limit(2),\n    configuration.locking,\n  );\n\n  if (rows.length > 1 || (create && rows.length !== 1)) return yield* unavailable();\n\n  return rows.length === 1;\n});\n\nconst bindingJson = Schema.encodeSync(Schema.fromJsonString(ProofBinding));\n\nconst captureAuthority = Effect.fn(\"DrizzlePasswordPrepared.captureAuthority\")(function* (\n  mapping: Mapping,\n  configuration: Pick<PasswordSqlConfiguration, \"locking\">,\n  input: {\n    readonly moduleId: string;\n    readonly action: PasswordPreparedReservation[\"action\"];\n    readonly subjectId: string;\n    readonly reset?: PasswordPreparedReservation[\"reset\"];\n  },\n) {\n  const database = yield* CurrentPasswordSql;\n\n  const p = mapping.password;\n  const locked = yield* kernel.lockSubject(p, input.subjectId, configuration.locking);\n\n  if (locked.row === undefined || !p.subject.isActiveStatus(locked.row[p.subject.status]))\n    return undefined;\n\n  const ic = kernel.identifierColumns(p),\n    ac = kernel.authorityCredentialColumns(p);\n\n  let identifier: any;\n\n  if (input.action !== \"add-password\") {\n    if (input.reset !== undefined)\n      identifier = (yield* kernel.lockIdentifier(\n        p,\n        input.reset.binding.identifier,\n        configuration.locking,\n      ))[0];\n    else {\n      const discovered = (yield* read(\n        database\n          .select()\n          .from(p.identifier.table)\n          .where(eq(ic.subjectId, locked.nativeSubjectId))\n          .orderBy(ic.namespace, ic.value),\n        false,\n      )).find((row: any) => p.identifier.isCurrent(row));\n\n      if (discovered !== undefined)\n        identifier = (yield* kernel.lockIdentifier(\n          p,\n          {\n            namespace: discovered[p.identifier.namespace],\n            value: discovered[p.identifier.value],\n          } as any,\n          configuration.locking,\n        ))[0];\n    }\n    if (\n      identifier === undefined ||\n      !p.identifier.isCurrent(identifier) ||\n      !p.subjectId.equals(identifier[p.identifier.subjectId], locked.nativeSubjectId)\n    )\n      return undefined;\n  }\n\n  const credential = (yield* kernel.readPasswordCredential(\n    p,\n    input.moduleId,\n    locked.nativeSubjectId,\n    configuration.locking,\n  ))[0];\n\n  if ((input.action === \"add-password\") !== (credential === undefined)) return undefined;\n\n  const snapshot =\n    credential === undefined\n      ? undefined\n      : yield* p.credential\n          .decode({ moduleId: input.moduleId, subject: locked.row, identifier, credential })\n          .pipe(Effect.flatMap(snapshotPasswordCredential));\n\n  if (\n    snapshot !== undefined &&\n    (snapshot.moduleId !== input.moduleId ||\n      snapshot.revision.subjectId !== input.subjectId ||\n      snapshot.revision.securityRevision !== locked.row[p.subject.securityRevision] ||\n      snapshot.credentialId !== credential[p.credential.credentialId] ||\n      snapshot.credentialRevision !== credential[p.credential.credentialRevision] ||\n      snapshot.verifierVersion !== credential[p.credential.verifierVersion] ||\n      Redacted.value(snapshot.verifier) !== credential[p.credential.verifier] ||\n      snapshot.normalization !== credential[p.credential.normalization] ||\n      snapshot.identifier.namespace !== identifier[p.identifier.namespace] ||\n      snapshot.identifier.value !== identifier[p.identifier.value] ||\n      snapshot.identifierBindingRevision !== identifier[p.identifier.bindingRevision])\n  )\n    return undefined;\n\n  const factors = yield* read(\n    database\n      .select()\n      .from(p.authorityCredential.table)\n      .where(eq(ac.subjectId, locked.nativeSubjectId))\n      .orderBy(ac.credentialId),\n    configuration.locking,\n  );\n\n  const active = factors.filter(\n    (row: any) =>\n      p.authorityCredential.status === undefined ||\n      p.authorityCredential.isActiveStatus?.(row[p.authorityCredential.status]) === true,\n  );\n\n  if (active.length > 64) return yield* unavailable();\n\n  const revision =\n    snapshot?.revision ??\n    AuthenticationRevision.make({\n      subjectId: input.subjectId as any,\n      securityRevision: locked.row[p.subject.securityRevision],\n      credentials: active.map((row: any) => ({\n        credentialId: row[p.authorityCredential.credentialId],\n        revision: row[p.authorityCredential.revision],\n      })),\n    });\n\n  if (\n    revision.credentials.some(\n      (expected) =>\n        !active.some(\n          (row: any) =>\n            row[p.authorityCredential.credentialId] === expected.credentialId &&\n            row[p.authorityCredential.revision] === expected.revision,\n        ),\n    )\n  )\n    return undefined;\n\n  const requirement = yield* p.subject\n    .decodeActionRequirement(locked.row, input.action)\n    .pipe(Effect.flatMap(snapshotPasswordRequirement));\n\n  return { ...locked, identifier, snapshot, revision, requirement };\n});\n\nconst currentAuthority = Effect.fn(\"DrizzlePasswordPrepared.currentAuthority\")(function* (\n  mapping: Mapping,\n  configuration: Pick<PasswordSqlConfiguration, \"locking\">,\n  record: PasswordPreparedReservation | PasswordPreparedReady,\n) {\n  const current = yield* captureAuthority(mapping, configuration, {\n    moduleId: record.moduleId,\n    action: record.action,\n    subjectId: record.revision.subjectId,\n    ...(record.reset === undefined ? {} : { reset: record.reset }),\n  });\n\n  if (\n    current === undefined ||\n    !sameRevision(current.revision, record.revision) ||\n    (current.snapshot === undefined\n      ? record.credential !== undefined\n      : record.credential === undefined ||\n        !kernel.sameCredentialSnapshot(current.snapshot, record.credential))\n  )\n    return undefined;\n\n  return current;\n});\n\nconst rowCondition = (mapping: Mapping, row: any) => {\n  const c = columns(mapping);\n\n  return and(\n    ...Object.entries(c).map(([key, value]) => {\n      const field = mapping.intent[key as keyof typeof c],\n        item = row[field];\n\n      return Predicate.isNullish(item) ? isNull(value) : eq(value, item);\n    }),\n  )!;\n};\n\nconst readIntent = Effect.fn(\"Drizzle.readIntent\")(function* (\n  mapping: Mapping,\n  condition: SQL,\n  locking: boolean,\n) {\n  const database = yield* CurrentPasswordSql;\n\n  return yield* read(\n    database.select().from(mapping.intent.table).where(condition).limit(2),\n    locking,\n  );\n});\n\nconst recordMatches = Effect.fn(\"DrizzlePasswordPrepared.recordMatches\")(function* (\n  mapping: Mapping,\n  row: any,\n  record: PasswordPreparedReservation | PasswordPreparedReady,\n  nativeSubjectId: unknown,\n  snapshot: string,\n) {\n  const t = mapping.intent,\n    p = mapping.password;\n\n  if (\n    row === undefined ||\n    row[t.moduleId] !== record.moduleId ||\n    row[t.intentId] !== record.intentId ||\n    row[t.commandId] !== record.commandId ||\n    !p.subjectId.equals(row[t.subjectId], nativeSubjectId) ||\n    row[t.action] !== record.action ||\n    row[t.generation] !== record.generation ||\n    row[t.version] !== record.version ||\n    row[t.state] !== t.states[record._tag] ||\n    row[t.snapshot] !== snapshot ||\n    row[t.identifierScope] !== identifierScope(record) ||\n    (record._tag === \"Ready\"\n      ? row[t.digest] !== record.digest\n      : !Predicate.isNullish(row[t.digest]))\n  )\n    return false;\n  for (const [key, instant] of [\n    [t.createdAt, record.createdAtMillis],\n    [t.preparationExpiresAt, record.preparationExpiresAtMillis],\n    [t.retainUntil, record.retainUntilMillis],\n  ] as const)\n    if ((yield* p.decodeInstant(row[key])) !== instant) return false;\n\n  return record._tag === \"Ready\"\n    ? (yield* p.decodeInstant(row[t.expiresAt])) === record.expiresAtMillis\n    : Predicate.isNullish(row[t.expiresAt]);\n});\n\nconst terminal = Effect.fn(\"DrizzlePasswordPrepared.terminal\")(function* (\n  mapping: Mapping,\n  row: any,\n  state: Exclude<PasswordPreparedState, \"Preparing\" | \"Ready\">,\n) {\n  const database = yield* CurrentPasswordSql;\n\n  yield* database\n    .update(mapping.intent.table)\n    .set(mapping.intent.encodeTerminal(state))\n    .where(rowCondition(mapping, row));\n\n  const c = columns(mapping),\n    t = mapping.intent;\n\n  const rows = yield* readIntent(\n    mapping,\n    and(eq(c.moduleId, row[t.moduleId]), eq(c.intentId, row[t.intentId]))!,\n    false,\n  );\n\n  const expected = { ...row, [t.state]: t.states[state], [t.snapshot]: null, [t.digest]: null };\n\n  if (\n    rows.length !== 1 ||\n    (yield* readIntent(mapping, rowCondition(mapping, expected), false)).length !== 1\n  )\n    return yield* unavailable();\n});\n\nexport const makeSqlPasswordPreparedPersistence = Effect.fn(\"makeSqlPasswordPreparedPersistence\")(\n  function* (\n    mapping: Mapping,\n    configuration: PasswordSqlConfiguration,\n  ): Effect.fn.Return<\n    PasswordPreparedPersistence,\n    PasswordUnavailable,\n    LifecycleHooks | CurrentPasswordSql | NativeDatabase\n  > {\n    const database = yield* CurrentPasswordSql;\n\n    if (!configuration.coordinated)\n      yield* validateDrizzleStorage({\n        ...mapping,\n        proof: configuration.proof?.mapping,\n      }).pipe(Effect.mapError(unavailable));\n    const hooks = yield* LifecycleHooks;\n\n    const p = mapping.password,\n      c = columns(mapping),\n      t = mapping.intent;\n\n    const owned = <A, E, R>(body: Effect.Effect<A, E, R>) =>\n      valid(mapping)\n        ? kernel.owned(\n            database,\n            p,\n            configuration,\n            Effect.gen(function* () {\n              const journal = yield* CurrentCommitJournal;\n              const guards = yield* Effect.serviceOption(PasswordPreparedJournalGuards);\n\n              if (Option.isSome(guards) && !guards.value.register(journal.prepare(undefined)))\n                return yield* unavailable();\n\n              return yield* body;\n            }),\n          )\n        : Effect.fail(unavailable());\n\n    const complete = <A>(\n      uncaptured: PasswordPreparedMutation & { readonly completion?: ProofCompletionPlan },\n      prepare: PreparePasswordCommit<PasswordMutationDecision, A>,\n    ) =>\n      Effect.gen(function* () {\n        const input = yield* snapshotMutation(uncaptured);\n\n        const completion =\n          uncaptured.completion === undefined\n            ? undefined\n            : {\n                prepare: uncaptured.completion.prepare,\n                input: yield* Schema.encodeEffect(Schema.fromJsonString(CompletionInput))(\n                  uncaptured.completion.input,\n                ).pipe(\n                  Effect.flatMap(Schema.decodeEffect(Schema.fromJsonString(CompletionInput))),\n                  Effect.mapError(unavailable),\n                ),\n              };\n\n        if (\n          (input.intent.action === \"reset-password\") !== (completion !== undefined) ||\n          (completion !== undefined && configuration.proof === undefined)\n        )\n          return yield* unavailable();\n\n        return yield* owned(\n          Effect.gen(function* () {\n            const transaction = yield* CurrentPasswordSql;\n            const journal = yield* CurrentCommitJournal;\n\n            yield* lockAnchor(mapping, configuration, input.intent.moduleId);\n\n            const authority = yield* kernel.validateMutationAuthority(\n              p,\n              configuration,\n              input.mutation,\n              input.intent.action,\n            );\n\n            if (authority === undefined) return prepare(\"rejected\", journal);\n            const current = yield* currentAuthority(mapping, configuration, input.intent);\n\n            if (current === undefined) return prepare(\"rejected\", journal);\n\n            const rows = yield* readIntent(\n              mapping,\n              and(eq(c.moduleId, input.intent.moduleId), eq(c.intentId, input.intent.intentId))!,\n              configuration.locking,\n            );\n\n            const row = rows[0],\n              encoded = yield* encodePasswordPreparedReady(input.intent);\n\n            if (\n              rows.length !== 1 ||\n              !(yield* recordMatches(\n                mapping,\n                row,\n                input.intent,\n                current.nativeSubjectId,\n                encoded,\n              )) ||\n              !evidenceCurrent(input, current.requirement, yield* nowMillis) ||\n              (yield* kernel.commandExists(\n                p,\n                input.intent.moduleId,\n                input.intent.commandId,\n                configuration.locking,\n              )).length !== 0\n            )\n              return prepare(\"rejected\", journal);\n            if (\n              completion !== undefined &&\n              (input.intent.reset === undefined ||\n                completion.input.continuationId !== input.intent.reset.continuationId ||\n                bindingJson(completion.input.binding) !== bindingJson(input.intent.reset.binding) ||\n                !kernel.proofCompletionMatchesPassword({ ...input.mutation, completion }))\n            )\n              return prepare(\"rejected\", journal);\n\n            const credentialRevision = yield* kernel.allocate(\n              configuration.mode,\n              p.allocateRevision,\n              p.allocateRevisionSync,\n            );\n\n            const verifierVersion = yield* kernel.allocate(\n              configuration.mode,\n              p.allocateRevision,\n              p.allocateRevisionSync,\n            );\n\n            const nextSecurityRevision = yield* kernel.allocateNextSecurityRevision(\n              p,\n              configuration.mode,\n              input.intent.revision.securityRevision,\n            );\n\n            if (\n              nextSecurityRevision === input.intent.revision.securityRevision ||\n              credentialRevision === input.intent.credential?.credentialRevision ||\n              verifierVersion === input.intent.credential?.verifierVersion\n            )\n              return yield* unavailable();\n\n            const credentialId =\n              input.intent.action === \"add-password\"\n                ? yield* kernel.allocate(\n                    configuration.mode,\n                    p.allocateCredentialId,\n                    p.allocateCredentialIdSync,\n                  )\n                : undefined;\n\n            let appliedAt: number | undefined;\n\n            const assertApplied = Effect.fn(\"DrizzlePasswordPrepared.assertApplied\")(() =>\n              Effect.flatMap(CurrentPasswordPreparedTransaction, (currentTransaction) =>\n                Effect.gen(function* () {\n                  if (appliedAt === undefined) return;\n\n                  if (\n                    !(yield* kernel.checkMutationApplied(\n                      p,\n                      input.mutation,\n                      current.nativeSubjectId,\n                      {\n                        credentialId: credentialId ?? input.intent.credential!.credentialId,\n                        credentialRevision,\n                        verifierVersion,\n                        nextSecurityRevision,\n                      },\n                      appliedAt,\n                    )) ||\n                    (yield* readIntent(\n                      mapping,\n                      rowCondition(mapping, {\n                        ...row,\n                        [t.state]: t.states.Consumed,\n                        [t.snapshot]: null,\n                        [t.digest]: null,\n                      }),\n                      false,\n                    )).length !== 1 ||\n                    !evidenceCurrent(input, current.requirement, yield* nowMillis)\n                  )\n                    return yield* unavailable();\n                }).pipe(Effect.provideService(CurrentPasswordSql, currentTransaction)),\n              ),\n            );\n\n            const validateApplied = Effect.gen(function* () {\n              yield* assertApplied().pipe(\n                Effect.provideService(CurrentPasswordPreparedTransaction, transaction),\n              );\n              if (appliedAt === undefined) return;\n              const postconditions = yield* Effect.serviceOption(PasswordPreparedPostconditions);\n\n              if (\n                Option.isSome(postconditions) &&\n                !postconditions.value.register(assertApplied().pipe(translateFailure))\n              )\n                return yield* unavailable();\n            });\n\n            const apply = Effect.fn(\"DrizzlePasswordPrepared.apply\")(function* () {\n              const finalNow = yield* nowMillis;\n\n              if (!evidenceCurrent(input, current.requirement, finalNow)) return false;\n\n              const changed =\n                input.intent.action === \"add-password\"\n                  ? yield* kernel.addPasswordIn(\n                      p,\n                      configuration,\n                      input.mutation,\n                      {\n                        credentialId: credentialId!,\n                        credentialRevision,\n                        verifierVersion,\n                        nextSecurityRevision,\n                      },\n                      finalNow,\n                    )\n                  : yield* kernel.writeReplacement(\n                      p,\n                      input.mutation,\n                      current.nativeSubjectId,\n                      { credentialRevision, verifierVersion, nextSecurityRevision },\n                      finalNow,\n                    );\n\n              if (!changed) return yield* unavailable();\n              appliedAt = finalNow;\n              yield* terminal(mapping, row, \"Consumed\");\n              if (!evidenceCurrent(input, current.requirement, yield* nowMillis))\n                return yield* unavailable();\n\n              return true;\n            });\n\n            if (completion !== undefined) {\n              let receipt: ReturnType<typeof prepare> | undefined;\n\n              yield* completeProofPlanIn(\n                configuration.proof!.mapping,\n                configuration.proof!.configuration,\n                completion,\n                Effect.gen(function* () {\n                  return yield* apply();\n                }),\n                (decision) => {\n                  receipt = prepare(decision === \"completed\" ? \"changed\" : \"rejected\", journal);\n\n                  return decision;\n                },\n              );\n\n              yield* validateApplied;\n\n              return receipt ?? prepare(\"rejected\", journal);\n            }\n\n            const changed = yield* apply();\n\n            yield* validateApplied;\n\n            return prepare(changed ? \"changed\" : \"rejected\", journal);\n          }),\n        );\n      });\n\n    const services: PasswordPreparedPersistence = {\n      reserve: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const input = yield* snapshotReserve(uncaptured);\n\n          if (\n            (input.action === \"reset-password\") !==\n              (input.reset !== undefined && input.completion !== undefined) ||\n            (input.action === \"reset-password\" && configuration.proof === undefined) ||\n            input.generation !== input.policy.generation ||\n            input.policy.retentionMillis <\n              Math.max(\n                input.policy.preparationLifetimeMillis + input.policy.lifetimeMillis,\n                input.policy.admission.action.windowMillis,\n                input.policy.admission.identifier.windowMillis,\n                input.policy.admission.subject.windowMillis,\n              ) ||\n            (input.invalidation.existingSessions === \"immediate\" &&\n              p.sessionInvalidation !== \"same-authority-immediate\")\n          )\n            return yield* unavailable();\n\n          return yield* owned(\n            Effect.gen(function* () {\n              const transaction = yield* CurrentPasswordSql;\n              const journal = yield* CurrentCommitJournal;\n\n              yield* lockAnchor(mapping, configuration, input.moduleId);\n\n              const version = PasswordPreparedVersion.make(\n                yield* kernel.allocate(\n                  configuration.mode,\n                  mapping.allocateVersion,\n                  mapping.allocateVersionSync,\n                ),\n              );\n\n              const authority = yield* captureAuthority(mapping, configuration, input);\n\n              if (authority === undefined) return yield* unavailable();\n              if (input.reset !== undefined) {\n                if (\n                  input.completion === undefined ||\n                  input.completion.moduleId !== `${input.moduleId}/reset` ||\n                  input.completion.purpose !== \"password-reset\" ||\n                  input.reset.continuationId !== input.completion.continuationId ||\n                  bindingJson(input.reset.binding) !== bindingJson(input.completion.binding) ||\n                  input.reset.binding._tag !== \"Subject\" ||\n                  !sameRevision(input.reset.binding.revision, authority.revision) ||\n                  authority.snapshot?.identifierVerifiedAtMillis === undefined ||\n                  !(yield* checkProofCompletionIn(\n                    configuration.proof!.mapping,\n                    configuration.proof!.configuration,\n                    input.completion,\n                  ))\n                )\n                  return yield* unavailable();\n              }\n              if (\n                (yield* readIntent(\n                  mapping,\n                  and(eq(c.moduleId, input.moduleId), eq(c.commandId, input.commandId))!,\n                  configuration.locking,\n                )).length\n              )\n                return prepare({ _tag: \"Existing\" }, journal);\n\n              const now = yield* nowMillis,\n                nativeNow = p.encodeInstant(now);\n\n              const scope = identifierScope({\n                credential: authority.snapshot,\n                revision: authority.revision,\n              });\n\n              const active =\n                (yield* read(\n                  transaction\n                    .select({ total: count() })\n                    .from(t.table)\n                    .where(\n                      and(\n                        eq(c.moduleId, input.moduleId),\n                        eq(c.subjectId, authority.nativeSubjectId),\n                        or(\n                          and(\n                            eq(c.state, t.states.Preparing),\n                            gt(c.preparationExpiresAt, nativeNow),\n                          ),\n                          and(eq(c.state, t.states.Ready), gt(c.expiresAt, nativeNow)),\n                        ),\n                      ),\n                    ),\n                  false,\n                ))[0]?.total ?? 0;\n\n              if (active >= input.policy.maximumPendingPerSubject) return yield* unavailable();\n              for (const [condition, budget] of [\n                [eq(c.action, input.action), input.policy.admission.action],\n                [eq(c.identifierScope, scope), input.policy.admission.identifier],\n                [eq(c.subjectId, authority.nativeSubjectId), input.policy.admission.subject],\n              ] as const) {\n                const total =\n                  (yield* read(\n                    transaction\n                      .select({ total: count() })\n                      .from(t.table)\n                      .where(\n                        and(\n                          eq(c.moduleId, input.moduleId),\n                          condition,\n                          gt(c.admittedAt, p.encodeInstant(now - budget.windowMillis)),\n                        ),\n                      ),\n                    false,\n                  ))[0]?.total ?? 0;\n\n                if (total >= budget.limit) return yield* unavailable();\n              }\n\n              const reservation = yield* snapshotPasswordPreparedReservation({\n                _tag: \"Preparing\",\n                moduleId: input.moduleId,\n                generation: input.generation,\n                intentId: input.intentId,\n                version,\n                commandId: input.commandId,\n                action: input.action,\n                revision: authority.revision,\n                ...(authority.snapshot === undefined ? {} : { credential: authority.snapshot }),\n                capturedRequirement: authority.requirement,\n                ...(input.reset === undefined ? {} : { reset: input.reset }),\n                invalidation: input.invalidation,\n                createdAtMillis: now,\n                preparationExpiresAtMillis: now + input.policy.preparationLifetimeMillis,\n                retainUntilMillis: now + input.policy.retentionMillis,\n              });\n\n              const snapshot = yield* encodeReservation(reservation);\n\n              yield* transaction.insert(t.table).values(\n                t.encodeInsert({\n                  reservation,\n                  nativeSubjectId: authority.nativeSubjectId,\n                  identifierScope: scope,\n                  snapshot,\n                  admittedAtMillis: now,\n                  admissionRetainUntilMillis:\n                    now +\n                    Math.max(\n                      input.policy.admission.action.windowMillis,\n                      input.policy.admission.identifier.windowMillis,\n                      input.policy.admission.subject.windowMillis,\n                    ),\n                }),\n              );\n\n              const rows = yield* readIntent(\n                mapping,\n                and(eq(c.moduleId, input.moduleId), eq(c.intentId, input.intentId))!,\n                false,\n              );\n\n              if (\n                rows.length !== 1 ||\n                !(yield* recordMatches(\n                  mapping,\n                  rows[0],\n                  reservation,\n                  authority.nativeSubjectId,\n                  snapshot,\n                ))\n              )\n                return yield* unavailable();\n\n              const admittedUntil =\n                now +\n                Math.max(\n                  input.policy.admission.action.windowMillis,\n                  input.policy.admission.identifier.windowMillis,\n                  input.policy.admission.subject.windowMillis,\n                );\n\n              if (\n                (yield* p.decodeInstant(rows[0][t.admittedAt])) !== now ||\n                (yield* p.decodeInstant(rows[0][t.admissionRetainUntil])) !== admittedUntil ||\n                (yield* nowMillis) >= reservation.preparationExpiresAtMillis ||\n                (input.completion !== undefined &&\n                  !(yield* checkProofCompletionIn(\n                    configuration.proof!.mapping,\n                    configuration.proof!.configuration,\n                    input.completion,\n                  )))\n              )\n                return yield* unavailable();\n\n              return prepare({ _tag: \"Reserved\", reservation }, journal);\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      publishReady: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const reservation = yield* snapshotPasswordPreparedReservation(uncaptured.reservation),\n            ready = yield* snapshotPasswordPreparedReady(uncaptured.ready);\n\n          const snapshot = yield* encodeReservation(reservation),\n            readySnapshot = yield* encodePasswordPreparedReady(ready);\n\n          if ((yield* encodeReservation(reservationOf(ready))) !== snapshot)\n            return yield* unavailable();\n\n          return yield* owned(\n            Effect.gen(function* () {\n              const transaction = yield* CurrentPasswordSql;\n              const journal = yield* CurrentCommitJournal;\n\n              yield* lockAnchor(mapping, configuration, reservation.moduleId);\n              const authority = yield* currentAuthority(mapping, configuration, reservation);\n\n              if (authority === undefined) return prepare(\"rejected\", journal);\n\n              const rows = yield* readIntent(\n                  mapping,\n                  and(eq(c.moduleId, reservation.moduleId), eq(c.intentId, reservation.intentId))!,\n                  configuration.locking,\n                ),\n                row = rows[0];\n\n              const now = yield* nowMillis;\n\n              if (\n                rows.length !== 1 ||\n                !(yield* recordMatches(\n                  mapping,\n                  row,\n                  reservation,\n                  authority.nativeSubjectId,\n                  snapshot,\n                )) ||\n                now < ready.issuedAtMillis ||\n                now >= reservation.preparationExpiresAtMillis ||\n                now >= ready.expiresAtMillis\n              )\n                return prepare(\"rejected\", journal);\n              yield* transaction\n                .update(t.table)\n                .set(t.encodeReady({ ready, snapshot: readySnapshot }))\n                .where(rowCondition(mapping, row));\n\n              const saved = yield* readIntent(\n                mapping,\n                and(eq(c.moduleId, ready.moduleId), eq(c.intentId, ready.intentId))!,\n                false,\n              );\n\n              if (\n                saved.length !== 1 ||\n                !(yield* recordMatches(\n                  mapping,\n                  saved[0],\n                  ready,\n                  authority.nativeSubjectId,\n                  readySnapshot,\n                )) ||\n                (yield* readIntent(\n                  mapping,\n                  and(\n                    eq(c.moduleId, ready.moduleId),\n                    eq(c.intentId, ready.intentId),\n                    eq(c.admittedAt, row[t.admittedAt]),\n                    eq(c.admissionRetainUntil, row[t.admissionRetainUntil]),\n                  )!,\n                  false,\n                )).length !== 1\n              )\n                return yield* unavailable();\n              if (\n                (yield* nowMillis) >= reservation.preparationExpiresAtMillis ||\n                (yield* nowMillis) >= ready.expiresAtMillis\n              )\n                return yield* unavailable();\n\n              return prepare(\"published\", journal);\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      context: (uncaptured) =>\n        Effect.gen(function* () {\n          const input = yield* Schema.decodeEffect(ContextInput)({ ...uncaptured }).pipe(\n            Effect.mapError(unavailable),\n          );\n\n          const record = yield* kernel.safeRead(\n            database,\n            configuration,\n            Effect.gen(function* () {\n              if (\n                !valid(mapping) ||\n                !(yield* lockAnchor(mapping, configuration, input.moduleId, false))\n              )\n                return undefined;\n\n              const rows = yield* readIntent(\n                mapping,\n                and(\n                  eq(c.moduleId, input.moduleId),\n                  eq(c.generation, input.generation),\n                  eq(c.digest, input.digest),\n                  eq(c.state, t.states.Ready),\n                )!,\n                false,\n              );\n\n              if (rows.length !== 1) return undefined;\n              const selected = yield* decodePasswordPreparedReady(rows[0][t.snapshot]);\n              const authority = yield* currentAuthority(mapping, configuration, selected);\n\n              if (authority === undefined) return undefined;\n\n              const locked = yield* readIntent(\n                mapping,\n                rowCondition(mapping, rows[0]),\n                configuration.locking,\n              );\n\n              const now = yield* nowMillis;\n\n              if (\n                locked.length !== 1 ||\n                now < selected.issuedAtMillis ||\n                now >= selected.expiresAtMillis ||\n                selected.moduleId !== input.moduleId ||\n                selected.generation !== input.generation ||\n                selected.digest !== input.digest ||\n                !(yield* recordMatches(\n                  mapping,\n                  locked[0],\n                  selected,\n                  authority.nativeSubjectId,\n                  yield* encodePasswordPreparedReady(selected),\n                ))\n              )\n                return undefined;\n\n              return { record: selected, currentRequirement: authority.requirement };\n            }),\n          );\n\n          return record ?? (yield* PasswordRejected.make({}));\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateContextFailure,\n        ),\n      complete: (input, prepare) =>\n        complete(input, prepare).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      resetWithProof: (input, prepare) =>\n        complete(input, prepare).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      cancel: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const record = yield* snapshotPasswordPreparedReady(uncaptured.record),\n            snapshot = yield* encodePasswordPreparedReady(record);\n\n          return yield* owned(\n            Effect.gen(function* () {\n              const journal = yield* CurrentCommitJournal;\n\n              yield* lockAnchor(mapping, configuration, record.moduleId);\n              const authority = yield* currentAuthority(mapping, configuration, record);\n\n              if (authority === undefined) return prepare(false, journal);\n\n              const rows = yield* readIntent(\n                mapping,\n                and(eq(c.moduleId, record.moduleId), eq(c.intentId, record.intentId))!,\n                configuration.locking,\n              );\n\n              const now = yield* nowMillis;\n\n              if (\n                rows.length !== 1 ||\n                now < record.issuedAtMillis ||\n                now >= record.expiresAtMillis ||\n                !(yield* recordMatches(\n                  mapping,\n                  rows[0],\n                  record,\n                  authority.nativeSubjectId,\n                  snapshot,\n                ))\n              )\n                return prepare(false, journal);\n              yield* terminal(mapping, rows[0], \"Cancelled\");\n\n              return prepare(true, journal);\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      cleanup: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const input = { ...uncaptured };\n\n          if (!Number.isSafeInteger(input.limit) || input.limit < 1 || input.limit > 1000)\n            return yield* unavailable();\n\n          return yield* owned(\n            Effect.gen(function* () {\n              const transaction = yield* CurrentPasswordSql;\n              const journal = yield* CurrentCommitJournal;\n\n              if (!(yield* lockAnchor(mapping, configuration, input.moduleId, false)))\n                return prepare({ removed: 0, hasMore: false }, journal);\n              const now = p.encodeInstant(yield* nowMillis);\n\n              const due = and(\n                eq(c.moduleId, input.moduleId),\n                or(\n                  and(lte(c.retainUntil, now), lte(c.admissionRetainUntil, now)),\n                  and(\n                    isNotNull(c.snapshot),\n                    or(\n                      and(eq(c.state, t.states.Preparing), lte(c.preparationExpiresAt, now)),\n                      and(eq(c.state, t.states.Ready), lte(c.expiresAt, now)),\n                    ),\n                  ),\n                ),\n              )!;\n\n              const rows = yield* read(\n                transaction\n                  .select()\n                  .from(t.table)\n                  .where(due)\n                  .orderBy(c.createdAt, c.intentId)\n                  .limit(input.limit + 1),\n                configuration.locking,\n              );\n\n              let removed = 0;\n\n              for (const row of rows.slice(0, input.limit)) {\n                const expired =\n                  (yield* readIntent(\n                    mapping,\n                    and(\n                      rowCondition(mapping, row),\n                      lte(c.retainUntil, now),\n                      lte(c.admissionRetainUntil, now),\n                    )!,\n                    false,\n                  )).length === 1;\n\n                if (expired) {\n                  yield* transaction.delete(t.table).where(rowCondition(mapping, row));\n                  if (\n                    (yield* readIntent(\n                      mapping,\n                      and(eq(c.moduleId, input.moduleId), eq(c.intentId, row[t.intentId]))!,\n                      false,\n                    )).length\n                  )\n                    return yield* unavailable();\n                  removed++;\n                } else yield* terminal(mapping, row, \"Expired\");\n              }\n\n              return prepare(\n                {\n                  removed,\n                  hasMore:\n                    (yield* read(transaction.select().from(t.table).where(due).limit(1), false))\n                      .length > 0,\n                },\n                journal,\n              );\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n    };\n\n    return services;\n  },\n);\n\nexport const passwordPreparedSqlKernel = {\n  columns,\n  recordMatches,\n  captureAuthority,\n  currentAuthority,\n  rowCondition,\n  valid,\n  identifierScope,\n};\n"],"mappings":";;;;;;;;;;;;;;;AA0DA,MAAM,oBACJ,WAEA,yBACE,SACC,UACC,OAAO,GAAG,mBAAmB,CAAC,CAAC,KAAK,KACpC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,sBAAsB,CAAC,CAAC,KAAK,CAC3C,CAAC,CAAC,KAAK,OAAO,YAAY,UAAU,OAAO,UAAU,MAAM,IAAI,aAAa,YAAY,CAAC,CAAC,CAAC,CAAC;AAE9F,MAAM,2BACJ,WAEA,yBACE,SACC,UACC,OAAO,GAAG,mBAAmB,CAAC,CAAC,KAAK,KACpC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,sBAAsB,CAAC,CAAC,KAAK,CAC3C,CAAC,CAAC,KACA,OAAO,YAAY,UACjB,OAAO,UACL,MAAM,IAAI,QAAQ,UAAW,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,IAAI,QAAQ,YAAY,CAAE,CAC1F,CACF,CACF;AAGF,MAAM,YAAY,SAAS,IAAI,KAAK,OAAO,IAAI,SAAS,aAAa,CAAC;AAEtE,MAAM,QAAQ,OAAyB,YACrC,WAAW,OAAO,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,IAAI;AAErE,MAAM,WAAW,YAAqB;CACpC,MAAM,QAAQ,QAAQ;CAEtB,OAAO;EACL,UAAU,OAAO,MAAM,OAAO,MAAM,QAAQ;EAC5C,UAAU,OAAO,MAAM,OAAO,MAAM,QAAQ;EAC5C,WAAW,OAAO,MAAM,OAAO,MAAM,SAAS;EAC9C,WAAW,OAAO,MAAM,OAAO,MAAM,SAAS;EAC9C,QAAQ,OAAO,MAAM,OAAO,MAAM,MAAM;EACxC,YAAY,OAAO,MAAM,OAAO,MAAM,UAAU;EAChD,SAAS,OAAO,MAAM,OAAO,MAAM,OAAO;EAC1C,OAAO,OAAO,MAAM,OAAO,MAAM,KAAK;EACtC,QAAQ,OAAO,MAAM,OAAO,MAAM,MAAM;EACxC,UAAU,OAAO,MAAM,OAAO,MAAM,QAAQ;EAC5C,iBAAiB,OAAO,MAAM,OAAO,MAAM,eAAe;EAC1D,WAAW,OAAO,MAAM,OAAO,MAAM,SAAS;EAC9C,YAAY,OAAO,MAAM,OAAO,MAAM,UAAU;EAChD,sBAAsB,OAAO,MAAM,OAAO,MAAM,oBAAoB;EACpE,sBAAsB,OAAO,MAAM,OAAO,MAAM,oBAAoB;EACpE,WAAW,OAAO,MAAM,OAAO,MAAM,SAAS;EAC9C,aAAa,OAAO,MAAM,OAAO,MAAM,WAAW;CACpD;AACF;AAEA,MAAM,SAAS,YACb,OAAO,QAAQ,mCAAmC,CAAC,CAAC,OACjD,CAAC,KAAK,WACL,QAAQ,YAAY,SAA6D,KACrF;AAEF,MAAM,aAAa,OAAO,GAAG,oCAAoC,CAAC,CAAC,WACjE,SACA,eACA,UACA,SAAS,MACT;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,IAAI,QAAQ,WAChB,MAAM,OAAO,EAAE,OAAO,EAAE,QAAQ;CAElC,IAAI,QACF,OAAO,cAAc,eACnB,SAAS,OAAO,EAAE,KAAK,CAAC,CAAC,OAAO,EAAE,aAAa,QAAQ,CAAC,GACxD,EAAE,UACF,QACF;CAEF,MAAM,OAAO,OAAO,KAClB,SAAS,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,MAAM,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAChE,cAAc,OAChB;CAEA,IAAI,KAAK,SAAS,KAAM,UAAU,KAAK,WAAW,GAAI,OAAO,OAAO,YAAY;CAEhF,OAAO,KAAK,WAAW;AACzB,CAAC;AAED,MAAM,cAAc,OAAO,WAAW,OAAO,eAAe,YAAY,CAAC;AAEzE,MAAM,mBAAmB,OAAO,GAAG,0CAA0C,CAAC,CAAC,WAC7E,SACA,eACA,OAMA;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,IAAI,QAAQ;CAClB,MAAM,SAAS,OAAOA,kBAAO,YAAY,GAAG,MAAM,WAAW,cAAc,OAAO;CAElF,IAAI,OAAO,QAAQ,KAAA,KAAa,CAAC,EAAE,QAAQ,eAAe,OAAO,IAAI,EAAE,QAAQ,OAAO,GACpF,OAAO,KAAA;CAET,MAAM,KAAKA,kBAAO,kBAAkB,CAAC,GACnC,KAAKA,kBAAO,2BAA2B,CAAC;CAE1C,IAAI;CAEJ,IAAI,MAAM,WAAW,gBAAgB;EACnC,IAAI,MAAM,UAAU,KAAA,GAClB,cAAc,OAAOA,kBAAO,eAC1B,GACA,MAAM,MAAM,QAAQ,YACpB,cAAc,OAChB,EAAA,CAAG;OACA;GACH,MAAM,cAAc,OAAO,KACzB,SACG,OAAO,CAAC,CACR,KAAK,EAAE,WAAW,KAAK,CAAC,CACxB,MAAM,GAAG,GAAG,WAAW,OAAO,eAAe,CAAC,CAAC,CAC/C,QAAQ,GAAG,WAAW,GAAG,KAAK,GACjC,KACF,EAAA,CAAG,MAAM,QAAa,EAAE,WAAW,UAAU,GAAG,CAAC;GAEjD,IAAI,eAAe,KAAA,GACjB,cAAc,OAAOA,kBAAO,eAC1B,GACA;IACE,WAAW,WAAW,EAAE,WAAW;IACnC,OAAO,WAAW,EAAE,WAAW;GACjC,GACA,cAAc,OAChB,EAAA,CAAG;EACP;EACA,IACE,eAAe,KAAA,KACf,CAAC,EAAE,WAAW,UAAU,UAAU,KAClC,CAAC,EAAE,UAAU,OAAO,WAAW,EAAE,WAAW,YAAY,OAAO,eAAe,GAE9E,OAAO,KAAA;CACX;CAEA,MAAM,cAAc,OAAOA,kBAAO,uBAChC,GACA,MAAM,UACN,OAAO,iBACP,cAAc,OAChB,EAAA,CAAG;CAEH,IAAK,MAAM,WAAW,oBAAqB,eAAe,KAAA,IAAY,OAAO,KAAA;CAE7E,MAAM,WACJ,eAAe,KAAA,IACX,KAAA,IACA,OAAO,EAAE,WACN,OAAO;EAAE,UAAU,MAAM;EAAU,SAAS,OAAO;EAAK;EAAY;CAAW,CAAC,CAAC,CACjF,KAAK,OAAO,QAAQ,0BAA0B,CAAC;CAExD,IACE,aAAa,KAAA,MACZ,SAAS,aAAa,MAAM,YAC3B,SAAS,SAAS,cAAc,MAAM,aACtC,SAAS,SAAS,qBAAqB,OAAO,IAAI,EAAE,QAAQ,qBAC5D,SAAS,iBAAiB,WAAW,EAAE,WAAW,iBAClD,SAAS,uBAAuB,WAAW,EAAE,WAAW,uBACxD,SAAS,oBAAoB,WAAW,EAAE,WAAW,oBACrD,SAAS,MAAM,SAAS,QAAQ,MAAM,WAAW,EAAE,WAAW,aAC9D,SAAS,kBAAkB,WAAW,EAAE,WAAW,kBACnD,SAAS,WAAW,cAAc,WAAW,EAAE,WAAW,cAC1D,SAAS,WAAW,UAAU,WAAW,EAAE,WAAW,UACtD,SAAS,8BAA8B,WAAW,EAAE,WAAW,mBAEjE,OAAO,KAAA;CAWT,MAAM,UAAS,OATQ,KACrB,SACG,OAAO,CAAC,CACR,KAAK,EAAE,oBAAoB,KAAK,CAAC,CACjC,MAAM,GAAG,GAAG,WAAW,OAAO,eAAe,CAAC,CAAC,CAC/C,QAAQ,GAAG,YAAY,GAC1B,cAAc,OAChB,EAAA,CAEuB,QACpB,QACC,EAAE,oBAAoB,WAAW,KAAA,KACjC,EAAE,oBAAoB,iBAAiB,IAAI,EAAE,oBAAoB,OAAO,MAAM,IAClF;CAEA,IAAI,OAAO,SAAS,IAAI,OAAO,OAAO,YAAY;CAElD,MAAM,WACJ,UAAU,YACV,uBAAuB,KAAK;EAC1B,WAAW,MAAM;EACjB,kBAAkB,OAAO,IAAI,EAAE,QAAQ;EACvC,aAAa,OAAO,KAAK,SAAc;GACrC,cAAc,IAAI,EAAE,oBAAoB;GACxC,UAAU,IAAI,EAAE,oBAAoB;EACtC,EAAE;CACJ,CAAC;CAEH,IACE,SAAS,YAAY,MAClB,aACC,CAAC,OAAO,MACL,QACC,IAAI,EAAE,oBAAoB,kBAAkB,SAAS,gBACrD,IAAI,EAAE,oBAAoB,cAAc,SAAS,QACrD,CACJ,GAEA,OAAO,KAAA;CAET,MAAM,cAAc,OAAO,EAAE,QAC1B,wBAAwB,OAAO,KAAK,MAAM,MAAM,CAAC,CACjD,KAAK,OAAO,QAAQ,2BAA2B,CAAC;CAEnD,OAAO;EAAE,GAAG;EAAQ;EAAY;EAAU;EAAU;CAAY;AAClE,CAAC;AAED,MAAM,mBAAmB,OAAO,GAAG,0CAA0C,CAAC,CAAC,WAC7E,SACA,eACA,QACA;CACA,MAAM,UAAU,OAAO,iBAAiB,SAAS,eAAe;EAC9D,UAAU,OAAO;EACjB,QAAQ,OAAO;EACf,WAAW,OAAO,SAAS;EAC3B,GAAI,OAAO,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,OAAO,MAAM;CAC9D,CAAC;CAED,IACE,YAAY,KAAA,KACZ,CAAC,aAAa,QAAQ,UAAU,OAAO,QAAQ,MAC9C,QAAQ,aAAa,KAAA,IAClB,OAAO,eAAe,KAAA,IACtB,OAAO,eAAe,KAAA,KACtB,CAACA,kBAAO,uBAAuB,QAAQ,UAAU,OAAO,UAAU,IAEtE,OAAO,KAAA;CAET,OAAO;AACT,CAAC;AAED,MAAM,gBAAgB,SAAkB,QAAa;CACnD,MAAM,IAAI,QAAQ,OAAO;CAEzB,OAAO,IACL,GAAG,OAAO,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW;EACzC,MACE,OAAO,IADK,QAAQ,OAAO;EAG7B,OAAO,UAAU,UAAU,IAAI,IAAI,OAAO,KAAK,IAAI,GAAG,OAAO,IAAI;CACnE,CAAC,CACH;AACF;AAEA,MAAM,aAAa,OAAO,GAAG,oBAAoB,CAAC,CAAC,WACjD,SACA,WACA,SACA;CACA,MAAM,WAAW,OAAO;CAExB,OAAO,OAAO,KACZ,SAAS,OAAO,CAAC,CAAC,KAAK,QAAQ,OAAO,KAAK,CAAC,CAAC,MAAM,SAAS,CAAC,CAAC,MAAM,CAAC,GACrE,OACF;AACF,CAAC;AAED,MAAM,gBAAgB,OAAO,GAAG,uCAAuC,CAAC,CAAC,WACvE,SACA,KACA,QACA,iBACA,UACA;CACA,MAAM,IAAI,QAAQ,QAChB,IAAI,QAAQ;CAEd,IACE,QAAQ,KAAA,KACR,IAAI,EAAE,cAAc,OAAO,YAC3B,IAAI,EAAE,cAAc,OAAO,YAC3B,IAAI,EAAE,eAAe,OAAO,aAC5B,CAAC,EAAE,UAAU,OAAO,IAAI,EAAE,YAAY,eAAe,KACrD,IAAI,EAAE,YAAY,OAAO,UACzB,IAAI,EAAE,gBAAgB,OAAO,cAC7B,IAAI,EAAE,aAAa,OAAO,WAC1B,IAAI,EAAE,WAAW,EAAE,OAAO,OAAO,SACjC,IAAI,EAAE,cAAc,YACpB,IAAI,EAAE,qBAAqB,gBAAgB,MAAM,MAChD,OAAO,SAAS,UACb,IAAI,EAAE,YAAY,OAAO,SACzB,CAAC,UAAU,UAAU,IAAI,EAAE,OAAO,IAEtC,OAAO;CACT,KAAK,MAAM,CAAC,KAAK,YAAY;EAC3B,CAAC,EAAE,WAAW,OAAO,eAAe;EACpC,CAAC,EAAE,sBAAsB,OAAO,0BAA0B;EAC1D,CAAC,EAAE,aAAa,OAAO,iBAAiB;CAC1C,GACE,KAAK,OAAO,EAAE,cAAc,IAAI,IAAI,OAAO,SAAS,OAAO;CAE7D,OAAO,OAAO,SAAS,WAClB,OAAO,EAAE,cAAc,IAAI,EAAE,UAAU,OAAO,OAAO,kBACtD,UAAU,UAAU,IAAI,EAAE,UAAU;AAC1C,CAAC;AAED,MAAM,WAAW,OAAO,GAAG,kCAAkC,CAAC,CAAC,WAC7D,SACA,KACA,OACA;CAGA,QAAO,OAFiB,mBAAA,CAGrB,OAAO,QAAQ,OAAO,KAAK,CAAC,CAC5B,IAAI,QAAQ,OAAO,eAAe,KAAK,CAAC,CAAC,CACzC,MAAM,aAAa,SAAS,GAAG,CAAC;CAEnC,MAAM,IAAI,QAAQ,OAAO,GACvB,IAAI,QAAQ;CAEd,MAAM,OAAO,OAAO,WAClB,SACA,IAAI,GAAG,EAAE,UAAU,IAAI,EAAE,SAAS,GAAG,GAAG,EAAE,UAAU,IAAI,EAAE,SAAS,CAAC,GACpE,KACF;CAEA,MAAM,WAAW;EAAE,GAAG;GAAM,EAAE,QAAQ,EAAE,OAAO;GAAS,EAAE,WAAW;GAAO,EAAE,SAAS;CAAK;CAE5F,IACE,KAAK,WAAW,MACf,OAAO,WAAW,SAAS,aAAa,SAAS,QAAQ,GAAG,KAAK,EAAA,CAAG,WAAW,GAEhF,OAAO,OAAO,YAAY;AAC9B,CAAC;AAED,MAAa,qCAAqC,OAAO,GAAG,oCAAoC,CAAC,CAC/F,WACE,SACA,eAKA;CACA,MAAM,WAAW,OAAO;CAExB,IAAI,CAAC,cAAc,aACjB,OAAO,uBAAuB;EAC5B,GAAG;EACH,OAAO,cAAc,OAAO;CAC9B,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;CACtC,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,UAChB,IAAI,QAAQ,OAAO,GACnB,IAAI,QAAQ;CAEd,MAAM,SAAkB,SACtB,MAAM,OAAO,IACTA,kBAAO,MACL,UACA,GACA,eACA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO;EACvB,MAAM,SAAS,OAAO,OAAO,cAAc,6BAA6B;EAExE,IAAI,OAAO,OAAO,MAAM,KAAK,CAAC,OAAO,MAAM,SAAS,QAAQ,QAAQ,KAAA,CAAS,CAAC,GAC5E,OAAO,OAAO,YAAY;EAE5B,OAAO,OAAO;CAChB,CAAC,CACH,IACA,OAAO,KAAK,YAAY,CAAC;CAE/B,MAAM,YACJ,YACA,YAEA,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO,iBAAiB,UAAU;EAEhD,MAAM,aACJ,WAAW,eAAe,KAAA,IACtB,KAAA,IACA;GACE,SAAS,WAAW,WAAW;GAC/B,OAAO,OAAO,OAAO,aAAa,OAAO,eAAe,eAAe,CAAC,CAAC,CACvE,WAAW,WAAW,KACxB,CAAC,CAAC,KACA,OAAO,QAAQ,OAAO,aAAa,OAAO,eAAe,eAAe,CAAC,CAAC,GAC1E,OAAO,SAAS,WAAW,CAC7B;EACF;EAEN,IACG,MAAM,OAAO,WAAW,sBAAuB,eAAe,KAAA,MAC9D,eAAe,KAAA,KAAa,cAAc,UAAU,KAAA,GAErD,OAAO,OAAO,YAAY;EAE5B,OAAO,OAAO,MACZ,OAAO,IAAI,aAAa;GACtB,MAAM,cAAc,OAAO;GAC3B,MAAM,UAAU,OAAO;GAEvB,OAAO,WAAW,SAAS,eAAe,MAAM,OAAO,QAAQ;GAS/D,KAAI,OAPqBA,kBAAO,0BAC9B,GACA,eACA,MAAM,UACN,MAAM,OAAO,MACf,OAEkB,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;GAC/D,MAAM,UAAU,OAAO,iBAAiB,SAAS,eAAe,MAAM,MAAM;GAE5E,IAAI,YAAY,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;GAE7D,MAAM,OAAO,OAAO,WAClB,SACA,IAAI,GAAG,EAAE,UAAU,MAAM,OAAO,QAAQ,GAAG,GAAG,EAAE,UAAU,MAAM,OAAO,QAAQ,CAAC,GAChF,cAAc,OAChB;GAEA,MAAM,MAAM,KAAK,IACf,UAAU,OAAO,4BAA4B,MAAM,MAAM;GAE3D,IACE,KAAK,WAAW,KAChB,EAAE,OAAO,cACP,SACA,KACA,MAAM,QACN,QAAQ,iBACR,OACF,MACA,CAAC,gBAAgB,OAAO,QAAQ,aAAa,OAAO,SAAS,MAC5D,OAAOA,kBAAO,cACb,GACA,MAAM,OAAO,UACb,MAAM,OAAO,WACb,cAAc,OAChB,EAAA,CAAG,WAAW,GAEd,OAAO,QAAQ,YAAY,OAAO;GACpC,IACE,eAAe,KAAA,MACd,MAAM,OAAO,UAAU,KAAA,KACtB,WAAW,MAAM,mBAAmB,MAAM,OAAO,MAAM,kBACvD,YAAY,WAAW,MAAM,OAAO,MAAM,YAAY,MAAM,OAAO,MAAM,OAAO,KAChF,CAACA,kBAAO,+BAA+B;IAAE,GAAG,MAAM;IAAU;GAAW,CAAC,IAE1E,OAAO,QAAQ,YAAY,OAAO;GAEpC,MAAM,qBAAqB,OAAOA,kBAAO,SACvC,cAAc,MACd,EAAE,kBACF,EAAE,oBACJ;GAEA,MAAM,kBAAkB,OAAOA,kBAAO,SACpC,cAAc,MACd,EAAE,kBACF,EAAE,oBACJ;GAEA,MAAM,uBAAuB,OAAOA,kBAAO,6BACzC,GACA,cAAc,MACd,MAAM,OAAO,SAAS,gBACxB;GAEA,IACE,yBAAyB,MAAM,OAAO,SAAS,oBAC/C,uBAAuB,MAAM,OAAO,YAAY,sBAChD,oBAAoB,MAAM,OAAO,YAAY,iBAE7C,OAAO,OAAO,YAAY;GAE5B,MAAM,eACJ,MAAM,OAAO,WAAW,iBACpB,OAAOA,kBAAO,SACZ,cAAc,MACd,EAAE,sBACF,EAAE,wBACJ,IACA,KAAA;GAEN,IAAI;GAEJ,MAAM,gBAAgB,OAAO,GAAG,uCAAuC,CAAC,OACtE,OAAO,QAAQ,qCAAqC,uBAClD,OAAO,IAAI,aAAa;IACtB,IAAI,cAAc,KAAA,GAAW;IAE7B,IACE,EAAE,OAAOA,kBAAO,qBACd,GACA,MAAM,UACN,QAAQ,iBACR;KACE,cAAc,gBAAgB,MAAM,OAAO,WAAY;KACvD;KACA;KACA;IACF,GACA,SACF,OACC,OAAO,WACN,SACA,aAAa,SAAS;KACpB,GAAG;MACF,EAAE,QAAQ,EAAE,OAAO;MACnB,EAAE,WAAW;MACb,EAAE,SAAS;IACd,CAAC,GACD,KACF,EAAA,CAAG,WAAW,KACd,CAAC,gBAAgB,OAAO,QAAQ,aAAa,OAAO,SAAS,GAE7D,OAAO,OAAO,YAAY;GAC9B,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,oBAAoB,kBAAkB,CAAC,CACvE,CACF;GAEA,MAAM,kBAAkB,OAAO,IAAI,aAAa;IAC9C,OAAO,cAAc,CAAC,CAAC,KACrB,OAAO,eAAe,oCAAoC,WAAW,CACvE;IACA,IAAI,cAAc,KAAA,GAAW;IAC7B,MAAM,iBAAiB,OAAO,OAAO,cAAc,8BAA8B;IAEjF,IACE,OAAO,OAAO,cAAc,KAC5B,CAAC,eAAe,MAAM,SAAS,cAAc,CAAC,CAAC,KAAK,gBAAgB,CAAC,GAErE,OAAO,OAAO,YAAY;GAC9B,CAAC;GAED,MAAM,QAAQ,OAAO,GAAG,+BAA+B,CAAC,CAAC,aAAa;IACpE,MAAM,WAAW,OAAO;IAExB,IAAI,CAAC,gBAAgB,OAAO,QAAQ,aAAa,QAAQ,GAAG,OAAO;IAwBnE,IAAI,EArBF,MAAM,OAAO,WAAW,iBACpB,OAAOA,kBAAO,cACZ,GACA,eACA,MAAM,UACN;KACgB;KACd;KACA;KACA;IACF,GACA,QACF,IACA,OAAOA,kBAAO,iBACZ,GACA,MAAM,UACN,QAAQ,iBACR;KAAE;KAAoB;KAAiB;IAAqB,GAC5D,QACF,IAEQ,OAAO,OAAO,YAAY;IACxC,YAAY;IACZ,OAAO,SAAS,SAAS,KAAK,UAAU;IACxC,IAAI,CAAC,gBAAgB,OAAO,QAAQ,aAAa,OAAO,SAAS,GAC/D,OAAO,OAAO,YAAY;IAE5B,OAAO;GACT,CAAC;GAED,IAAI,eAAe,KAAA,GAAW;IAC5B,IAAI;IAEJ,OAAO,oBACL,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,YACA,OAAO,IAAI,aAAa;KACtB,OAAO,OAAO,MAAM;IACtB,CAAC,IACA,aAAa;KACZ,UAAU,QAAQ,aAAa,cAAc,YAAY,YAAY,OAAO;KAE5E,OAAO;IACT,CACF;IAEA,OAAO;IAEP,OAAO,WAAW,QAAQ,YAAY,OAAO;GAC/C;GAEA,MAAM,UAAU,OAAO,MAAM;GAE7B,OAAO;GAEP,OAAO,QAAQ,UAAU,YAAY,YAAY,OAAO;EAC1D,CAAC,CACH;CACF,CAAC;CA2fH,OAAO;EAxfL,UAAU,YAAY,YACpB,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,gBAAgB,UAAU;GAE/C,IACG,MAAM,WAAW,sBACf,MAAM,UAAU,KAAA,KAAa,MAAM,eAAe,KAAA,MACpD,MAAM,WAAW,oBAAoB,cAAc,UAAU,KAAA,KAC9D,MAAM,eAAe,MAAM,OAAO,cAClC,MAAM,OAAO,kBACX,KAAK,IACH,MAAM,OAAO,4BAA4B,MAAM,OAAO,gBACtD,MAAM,OAAO,UAAU,OAAO,cAC9B,MAAM,OAAO,UAAU,WAAW,cAClC,MAAM,OAAO,UAAU,QAAQ,YACjC,KACD,MAAM,aAAa,qBAAqB,eACvC,EAAE,wBAAwB,4BAE5B,OAAO,OAAO,YAAY;GAE5B,OAAO,OAAO,MACZ,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IAEvB,OAAO,WAAW,SAAS,eAAe,MAAM,QAAQ;IAExD,MAAM,UAAU,wBAAwB,KACtC,OAAOA,kBAAO,SACZ,cAAc,MACd,QAAQ,iBACR,QAAQ,mBACV,CACF;IAEA,MAAM,YAAY,OAAO,iBAAiB,SAAS,eAAe,KAAK;IAEvE,IAAI,cAAc,KAAA,GAAW,OAAO,OAAO,YAAY;IACvD,IAAI,MAAM,UAAU,KAAA,GAEhB;SAAA,MAAM,eAAe,KAAA,KACrB,MAAM,WAAW,aAAa,GAAG,MAAM,SAAS,WAChD,MAAM,WAAW,YAAY,oBAC7B,MAAM,MAAM,mBAAmB,MAAM,WAAW,kBAChD,YAAY,MAAM,MAAM,OAAO,MAAM,YAAY,MAAM,WAAW,OAAO,KACzE,MAAM,MAAM,QAAQ,SAAS,aAC7B,CAAC,aAAa,MAAM,MAAM,QAAQ,UAAU,UAAU,QAAQ,KAC9D,UAAU,UAAU,+BAA+B,KAAA,KACnD,EAAE,OAAO,uBACP,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MAAM,UACR,IAEA,OAAO,OAAO,YAAY;IAAA;IAE9B,KACG,OAAO,WACN,SACA,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,WAAW,MAAM,SAAS,CAAC,GACpE,cAAc,OAChB,EAAA,CAAG,QAEH,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,OAAO;IAE9C,MAAM,MAAM,OAAO,WACjB,YAAY,EAAE,cAAc,GAAG;IAEjC,MAAM,QAAQ,gBAAgB;KAC5B,YAAY,UAAU;KACtB,UAAU,UAAU;IACtB,CAAC;IAuBD,MApBG,OAAO,KACN,YACG,OAAO,EAAE,OAAO,MAAM,EAAE,CAAC,CAAC,CAC1B,KAAK,EAAE,KAAK,CAAC,CACb,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,WAAW,UAAU,eAAe,GACzC,GACE,IACE,GAAG,EAAE,OAAO,EAAE,OAAO,SAAS,GAC9B,GAAG,EAAE,sBAAsB,SAAS,CACtC,GACA,IAAI,GAAG,EAAE,OAAO,EAAE,OAAO,KAAK,GAAG,GAAG,EAAE,WAAW,SAAS,CAAC,CAC7D,CACF,CACF,GACF,KACF,EAAA,CAAG,EAAE,EAAE,SAAS,MAEJ,MAAM,OAAO,0BAA0B,OAAO,OAAO,YAAY;IAC/E,KAAK,MAAM,CAAC,WAAW,WAAW;KAChC,CAAC,GAAG,EAAE,QAAQ,MAAM,MAAM,GAAG,MAAM,OAAO,UAAU,MAAM;KAC1D,CAAC,GAAG,EAAE,iBAAiB,KAAK,GAAG,MAAM,OAAO,UAAU,UAAU;KAChE,CAAC,GAAG,EAAE,WAAW,UAAU,eAAe,GAAG,MAAM,OAAO,UAAU,OAAO;IAC7E,GAgBE,MAdG,OAAO,KACN,YACG,OAAO,EAAE,OAAO,MAAM,EAAE,CAAC,CAAC,CAC1B,KAAK,EAAE,KAAK,CAAC,CACb,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,WACA,GAAG,EAAE,YAAY,EAAE,cAAc,MAAM,OAAO,YAAY,CAAC,CAC7D,CACF,GACF,KACF,EAAA,CAAG,EAAE,EAAE,SAAS,MAEL,OAAO,OAAO,OAAO,OAAO,YAAY;IAGvD,MAAM,cAAc,OAAO,oCAAoC;KAC7D,MAAM;KACN,UAAU,MAAM;KAChB,YAAY,MAAM;KAClB,UAAU,MAAM;KAChB;KACA,WAAW,MAAM;KACjB,QAAQ,MAAM;KACd,UAAU,UAAU;KACpB,GAAI,UAAU,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY,UAAU,SAAS;KAC7E,qBAAqB,UAAU;KAC/B,GAAI,MAAM,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;KAC1D,cAAc,MAAM;KACpB,iBAAiB;KACjB,4BAA4B,MAAM,MAAM,OAAO;KAC/C,mBAAmB,MAAM,MAAM,OAAO;IACxC,CAAC;IAED,MAAM,WAAW,OAAO,kBAAkB,WAAW;IAErD,OAAO,YAAY,OAAO,EAAE,KAAK,CAAC,CAAC,OACjC,EAAE,aAAa;KACb;KACA,iBAAiB,UAAU;KAC3B,iBAAiB;KACjB;KACA,kBAAkB;KAClB,4BACE,MACA,KAAK,IACH,MAAM,OAAO,UAAU,OAAO,cAC9B,MAAM,OAAO,UAAU,WAAW,cAClC,MAAM,OAAO,UAAU,QAAQ,YACjC;IACJ,CAAC,CACH;IAEA,MAAM,OAAO,OAAO,WAClB,SACA,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,UAAU,MAAM,QAAQ,CAAC,GAClE,KACF;IAEA,IACE,KAAK,WAAW,KAChB,EAAE,OAAO,cACP,SACA,KAAK,IACL,aACA,UAAU,iBACV,QACF,IAEA,OAAO,OAAO,YAAY;IAE5B,MAAM,gBACJ,MACA,KAAK,IACH,MAAM,OAAO,UAAU,OAAO,cAC9B,MAAM,OAAO,UAAU,WAAW,cAClC,MAAM,OAAO,UAAU,QAAQ,YACjC;IAEF,KACG,OAAO,EAAE,cAAc,KAAK,EAAE,CAAC,EAAE,WAAW,OAAO,QACnD,OAAO,EAAE,cAAc,KAAK,EAAE,CAAC,EAAE,qBAAqB,OAAO,kBAC7D,OAAO,cAAc,YAAY,8BACjC,MAAM,eAAe,KAAA,KACpB,EAAE,OAAO,uBACP,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MAAM,UACR,IAEF,OAAO,OAAO,YAAY;IAE5B,OAAO,QAAQ;KAAE,MAAM;KAAY;IAAY,GAAG,OAAO;GAC3D,CAAC,CACH;EACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,eAAe,YAAY,YACzB,OAAO,IAAI,aAAa;GACtB,MAAM,cAAc,OAAO,oCAAoC,WAAW,WAAW,GACnF,QAAQ,OAAO,8BAA8B,WAAW,KAAK;GAE/D,MAAM,WAAW,OAAO,kBAAkB,WAAW,GACnD,gBAAgB,OAAO,4BAA4B,KAAK;GAE1D,KAAK,OAAO,kBAAkB,cAAc,KAAK,CAAC,OAAO,UACvD,OAAO,OAAO,YAAY;GAE5B,OAAO,OAAO,MACZ,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IAEvB,OAAO,WAAW,SAAS,eAAe,YAAY,QAAQ;IAC9D,MAAM,YAAY,OAAO,iBAAiB,SAAS,eAAe,WAAW;IAE7E,IAAI,cAAc,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;IAE/D,MAAM,OAAO,OAAO,WAChB,SACA,IAAI,GAAG,EAAE,UAAU,YAAY,QAAQ,GAAG,GAAG,EAAE,UAAU,YAAY,QAAQ,CAAC,GAC9E,cAAc,OAChB,GACA,MAAM,KAAK;IAEb,MAAM,MAAM,OAAO;IAEnB,IACE,KAAK,WAAW,KAChB,EAAE,OAAO,cACP,SACA,KACA,aACA,UAAU,iBACV,QACF,MACA,MAAM,MAAM,kBACZ,OAAO,YAAY,8BACnB,OAAO,MAAM,iBAEb,OAAO,QAAQ,YAAY,OAAO;IACpC,OAAO,YACJ,OAAO,EAAE,KAAK,CAAC,CACf,IAAI,EAAE,YAAY;KAAE;KAAO,UAAU;IAAc,CAAC,CAAC,CAAC,CACtD,MAAM,aAAa,SAAS,GAAG,CAAC;IAEnC,MAAM,QAAQ,OAAO,WACnB,SACA,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,UAAU,MAAM,QAAQ,CAAC,GAClE,KACF;IAEA,IACE,MAAM,WAAW,KACjB,EAAE,OAAO,cACP,SACA,MAAM,IACN,OACA,UAAU,iBACV,aACF,OACC,OAAO,WACN,SACA,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,YAAY,IAAI,EAAE,WAAW,GAClC,GAAG,EAAE,sBAAsB,IAAI,EAAE,qBAAqB,CACxD,GACA,KACF,EAAA,CAAG,WAAW,GAEd,OAAO,OAAO,YAAY;IAC5B,KACG,OAAO,cAAc,YAAY,+BACjC,OAAO,cAAc,MAAM,iBAE5B,OAAO,OAAO,YAAY;IAE5B,OAAO,QAAQ,aAAa,OAAO;GACrC,CAAC,CACH;EACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,UAAU,eACR,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,OAAO,aAAa,YAAY,CAAC,CAAC,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,KACxE,OAAO,SAAS,WAAW,CAC7B;GA0DA,QAAO,OAxDeA,kBAAO,SAC3B,UACA,eACA,OAAO,IAAI,aAAa;IACtB,IACE,CAAC,MAAM,OAAO,KACd,EAAE,OAAO,WAAW,SAAS,eAAe,MAAM,UAAU,KAAK,IAEjE,OAAO,KAAA;IAET,MAAM,OAAO,OAAO,WAClB,SACA,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,YAAY,MAAM,UAAU,GACjC,GAAG,EAAE,QAAQ,MAAM,MAAM,GACzB,GAAG,EAAE,OAAO,EAAE,OAAO,KAAK,CAC5B,GACA,KACF;IAEA,IAAI,KAAK,WAAW,GAAG,OAAO,KAAA;IAC9B,MAAM,WAAW,OAAO,4BAA4B,KAAK,EAAE,CAAC,EAAE,SAAS;IACvE,MAAM,YAAY,OAAO,iBAAiB,SAAS,eAAe,QAAQ;IAE1E,IAAI,cAAc,KAAA,GAAW,OAAO,KAAA;IAEpC,MAAM,SAAS,OAAO,WACpB,SACA,aAAa,SAAS,KAAK,EAAE,GAC7B,cAAc,OAChB;IAEA,MAAM,MAAM,OAAO;IAEnB,IACE,OAAO,WAAW,KAClB,MAAM,SAAS,kBACf,OAAO,SAAS,mBAChB,SAAS,aAAa,MAAM,YAC5B,SAAS,eAAe,MAAM,cAC9B,SAAS,WAAW,MAAM,UAC1B,EAAE,OAAO,cACP,SACA,OAAO,IACP,UACA,UAAU,iBACV,OAAO,4BAA4B,QAAQ,CAC7C,IAEA,OAAO,KAAA;IAET,OAAO;KAAE,QAAQ;KAAU,oBAAoB,UAAU;IAAY;GACvE,CAAC,CACH,OAEkB,OAAO,iBAAiB,KAAK,CAAC,CAAC;EACnD,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,uBACF;EACF,WAAW,OAAO,YAChB,SAAS,OAAO,OAAO,CAAC,CAAC,KACvB,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,iBAAiB,OAAO,YACtB,SAAS,OAAO,OAAO,CAAC,CAAC,KACvB,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,SAAS,YAAY,YACnB,OAAO,IAAI,aAAa;GACtB,MAAM,SAAS,OAAO,8BAA8B,WAAW,MAAM,GACnE,WAAW,OAAO,4BAA4B,MAAM;GAEtD,OAAO,OAAO,MACZ,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO;IAEvB,OAAO,WAAW,SAAS,eAAe,OAAO,QAAQ;IACzD,MAAM,YAAY,OAAO,iBAAiB,SAAS,eAAe,MAAM;IAExE,IAAI,cAAc,KAAA,GAAW,OAAO,QAAQ,OAAO,OAAO;IAE1D,MAAM,OAAO,OAAO,WAClB,SACA,IAAI,GAAG,EAAE,UAAU,OAAO,QAAQ,GAAG,GAAG,EAAE,UAAU,OAAO,QAAQ,CAAC,GACpE,cAAc,OAChB;IAEA,MAAM,MAAM,OAAO;IAEnB,IACE,KAAK,WAAW,KAChB,MAAM,OAAO,kBACb,OAAO,OAAO,mBACd,EAAE,OAAO,cACP,SACA,KAAK,IACL,QACA,UAAU,iBACV,QACF,IAEA,OAAO,QAAQ,OAAO,OAAO;IAC/B,OAAO,SAAS,SAAS,KAAK,IAAI,WAAW;IAE7C,OAAO,QAAQ,MAAM,OAAO;GAC9B,CAAC,CACH;EACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,UAAU,YAAY,YACpB,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,GAAG,WAAW;GAE9B,IAAI,CAAC,OAAO,cAAc,MAAM,KAAK,KAAK,MAAM,QAAQ,KAAK,MAAM,QAAQ,KACzE,OAAO,OAAO,YAAY;GAE5B,OAAO,OAAO,MACZ,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IAEvB,IAAI,EAAE,OAAO,WAAW,SAAS,eAAe,MAAM,UAAU,KAAK,IACnE,OAAO,QAAQ;KAAE,SAAS;KAAG,SAAS;IAAM,GAAG,OAAO;IACxD,MAAM,MAAM,EAAE,cAAc,OAAO,SAAS;IAE5C,MAAM,MAAM,IACV,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GACE,IAAI,IAAI,EAAE,aAAa,GAAG,GAAG,IAAI,EAAE,sBAAsB,GAAG,CAAC,GAC7D,IACE,UAAU,EAAE,QAAQ,GACpB,GACE,IAAI,GAAG,EAAE,OAAO,EAAE,OAAO,SAAS,GAAG,IAAI,EAAE,sBAAsB,GAAG,CAAC,GACrE,IAAI,GAAG,EAAE,OAAO,EAAE,OAAO,KAAK,GAAG,IAAI,EAAE,WAAW,GAAG,CAAC,CACxD,CACF,CACF,CACF;IAEA,MAAM,OAAO,OAAO,KAClB,YACG,OAAO,CAAC,CACR,KAAK,EAAE,KAAK,CAAC,CACb,MAAM,GAAG,CAAC,CACV,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,CAChC,MAAM,MAAM,QAAQ,CAAC,GACxB,cAAc,OAChB;IAEA,IAAI,UAAU;IAEd,KAAK,MAAM,OAAO,KAAK,MAAM,GAAG,MAAM,KAAK,GAYzC,KAVG,OAAO,WACN,SACA,IACE,aAAa,SAAS,GAAG,GACzB,IAAI,EAAE,aAAa,GAAG,GACtB,IAAI,EAAE,sBAAsB,GAAG,CACjC,GACA,KACF,EAAA,CAAG,WAAW,GAEH;KACX,OAAO,YAAY,OAAO,EAAE,KAAK,CAAC,CAAC,MAAM,aAAa,SAAS,GAAG,CAAC;KACnE,KACG,OAAO,WACN,SACA,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,UAAU,IAAI,EAAE,SAAS,CAAC,GACnE,KACF,EAAA,CAAG,QAEH,OAAO,OAAO,YAAY;KAC5B;IACF,OAAO,OAAO,SAAS,SAAS,KAAK,SAAS;IAGhD,OAAO,QACL;KACE;KACA,UACG,OAAO,KAAK,YAAY,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,EAAA,CACvE,SAAS;IAChB,GACA,OACF;GACF,CAAC,CACH;EACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;CAGU;AAChB,CACF;AAEA,MAAa,4BAA4B;CACvC;CACA;CACA;CACA;CACA;CACA;CACA;AACF"}
+{"version":3,"file":"password-prepared-sql.mjs","names":["kernel"],"sources":["../../src/drizzle/password-prepared-sql.ts"],"sourcesContent":["import {\n  type NativeDatabase,\n  CurrentPasswordPreparedTransaction,\n  PasswordPreparedPostconditions,\n  PasswordPreparedJournalGuards,\n} from \"@yielded/auth-persistence/Adapter\";\nimport { CurrentCommitJournal, LifecycleHooks, HookConfigurationError } from \"@yielded/auth/Hooks\";\nimport {\n  PasswordUnavailable,\n  PasswordRejected,\n  PasswordPreparedVersion,\n  decodePasswordPreparedReady,\n  encodePasswordPreparedReady,\n  snapshotPasswordPreparedReady,\n  snapshotPasswordPreparedReservation,\n  type PasswordPreparedReady,\n  type PasswordPreparedReservation,\n  snapshotPasswordCredential,\n  snapshotPasswordRequirement,\n  type PasswordMutationDecision,\n  type PreparePasswordCommit,\n  type PasswordPreparedPersistence,\n  type PasswordPreparedMutation,\n} from \"@yielded/auth/Password\";\nimport { reportPersistenceFailure } from \"@yielded/auth/Persistence\";\nimport { type ProofCompletionPlan, ProofUnavailable, ProofBinding } from \"@yielded/auth/Proofs\";\nimport { AuthenticationRevision } from \"@yielded/auth/Sessions\";\n/* oxlint-disable no-explicit-any -- concrete driver makers retain consumer table types. */\nimport { and, count, eq, gt, isNotNull, isNull, lte, or, type SQL } from \"drizzle-orm\";\nimport { Cause, DateTime, Effect, Option, Predicate, Redacted, Schema } from \"effect\";\n\nimport { column } from \"./model\";\nimport {\n  requiredPasswordPreparedConstraints,\n  type AnyPasswordPreparedPersistenceMapping,\n  type PasswordPreparedState,\n} from \"./password-prepared-model\";\nimport {\n  ContextInput,\n  CompletionInput,\n  encodeReservation,\n  evidenceCurrent,\n  identifierScope,\n  reservationOf,\n  sameRevision,\n  snapshotMutation,\n  snapshotReserve,\n  unavailable,\n} from \"./password-prepared-state\";\nimport {\n  CurrentPasswordSql,\n  passwordSqlKernel as kernel,\n  type PasswordSqlConfiguration,\n  type PasswordSqlQuery,\n} from \"./password-sql\";\nimport { checkProofCompletionIn, completeProofPlanIn } from \"./proof-sql\";\nimport { validateDrizzleStorage } from \"./storage-validation\";\n\nconst translateFailure = <A, E, R>(\n  effect: Effect.Effect<A, E, R>,\n): Effect.Effect<A, PasswordUnavailable, R> =>\n  reportPersistenceFailure(\n    effect,\n    (error) =>\n      Schema.is(PasswordUnavailable)(error) ||\n      Schema.is(ProofUnavailable)(error) ||\n      Schema.is(HookConfigurationError)(error),\n  ).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));\n\nconst translateContextFailure = <A, E, R>(\n  effect: Effect.Effect<A, E, R>,\n): Effect.Effect<A, PasswordUnavailable | PasswordRejected, R> =>\n  reportPersistenceFailure(\n    effect,\n    (error) =>\n      Schema.is(PasswordUnavailable)(error) ||\n      Schema.is(PasswordRejected)(error) ||\n      Schema.is(ProofUnavailable)(error) ||\n      Schema.is(HookConfigurationError)(error),\n  ).pipe(\n    Effect.catchCause((cause) =>\n      Effect.failCause(\n        Cause.map(cause, (error) => (Schema.is(PasswordRejected)(error) ? error : unavailable())),\n      ),\n    ),\n  );\n\ntype Mapping = AnyPasswordPreparedPersistenceMapping;\nconst nowMillis = DateTime.now.pipe(Effect.map(DateTime.toEpochMillis));\n\nconst read = (query: PasswordSqlQuery, locking: boolean) =>\n  locking && typeof query.for === \"function\" ? query.for(\"update\") : query;\n\nconst columns = (mapping: Mapping) => {\n  const table = mapping.intent;\n\n  return {\n    moduleId: column(table.table, table.moduleId),\n    intentId: column(table.table, table.intentId),\n    commandId: column(table.table, table.commandId),\n    subjectId: column(table.table, table.subjectId),\n    action: column(table.table, table.action),\n    generation: column(table.table, table.generation),\n    version: column(table.table, table.version),\n    state: column(table.table, table.state),\n    digest: column(table.table, table.digest),\n    snapshot: column(table.table, table.snapshot),\n    identifierScope: column(table.table, table.identifierScope),\n    createdAt: column(table.table, table.createdAt),\n    admittedAt: column(table.table, table.admittedAt),\n    admissionRetainUntil: column(table.table, table.admissionRetainUntil),\n    preparationExpiresAt: column(table.table, table.preparationExpiresAt),\n    expiresAt: column(table.table, table.expiresAt),\n    retainUntil: column(table.table, table.retainUntil),\n  };\n};\n\nconst valid = (mapping: Mapping) =>\n  Object.entries(requiredPasswordPreparedConstraints).every(\n    ([key, value]) =>\n      mapping.constraints[key as keyof typeof requiredPasswordPreparedConstraints] === value,\n  );\n\nconst lockAnchor = Effect.fn(\"DrizzlePasswordPrepared.lockAnchor\")(function* (\n  mapping: Mapping,\n  configuration: PasswordSqlConfiguration,\n  moduleId: string,\n  create = true,\n) {\n  const database = yield* CurrentPasswordSql;\n\n  const a = mapping.admission,\n    key = column(a.table, a.moduleId);\n\n  if (create)\n    yield* configuration.insertIfAbsent(\n      database.insert(a.table).values(a.encodeInsert(moduleId)),\n      a.moduleId,\n      moduleId,\n    );\n\n  const rows = yield* read(\n    database.select().from(a.table).where(eq(key, moduleId)).limit(2),\n    configuration.locking,\n  );\n\n  if (rows.length > 1 || (create && rows.length !== 1)) return yield* unavailable();\n\n  return rows.length === 1;\n});\n\nconst bindingJson = Schema.encodeSync(Schema.fromJsonString(ProofBinding));\n\nconst captureAuthority = Effect.fn(\"DrizzlePasswordPrepared.captureAuthority\")(function* (\n  mapping: Mapping,\n  configuration: Pick<PasswordSqlConfiguration, \"locking\">,\n  input: {\n    readonly moduleId: string;\n    readonly action: PasswordPreparedReservation[\"action\"];\n    readonly subjectId: string;\n    readonly reset?: PasswordPreparedReservation[\"reset\"];\n  },\n) {\n  const database = yield* CurrentPasswordSql;\n\n  const p = mapping.password;\n  const locked = yield* kernel.lockSubject(p, input.subjectId, configuration.locking);\n\n  if (locked.row === undefined || !p.subject.isActiveStatus(locked.row[p.subject.status]))\n    return undefined;\n\n  const ic = kernel.identifierColumns(p),\n    ac = kernel.authorityCredentialColumns(p);\n\n  let identifier: any;\n\n  if (input.action !== \"add-password\") {\n    if (input.reset !== undefined)\n      identifier = (yield* kernel.lockIdentifier(\n        p,\n        input.reset.binding.identifier,\n        configuration.locking,\n      ))[0];\n    else {\n      const discovered = (yield* read(\n        database\n          .select()\n          .from(p.identifier.table)\n          .where(eq(ic.subjectId, locked.nativeSubjectId))\n          .orderBy(ic.namespace, ic.value),\n        false,\n      )).find((row: any) => p.identifier.isCurrent(row));\n\n      if (discovered !== undefined)\n        identifier = (yield* kernel.lockIdentifier(\n          p,\n          {\n            namespace: discovered[p.identifier.namespace],\n            value: discovered[p.identifier.value],\n          } as any,\n          configuration.locking,\n        ))[0];\n    }\n    if (\n      identifier === undefined ||\n      !p.identifier.isCurrent(identifier) ||\n      !p.subjectId.equals(identifier[p.identifier.subjectId], locked.nativeSubjectId)\n    )\n      return undefined;\n  }\n\n  const credential = (yield* kernel.readPasswordCredential(\n    p,\n    input.moduleId,\n    locked.nativeSubjectId,\n    configuration.locking,\n  ))[0];\n\n  if ((input.action === \"add-password\") !== (credential === undefined)) return undefined;\n\n  const snapshot =\n    credential === undefined\n      ? undefined\n      : yield* p.credential\n          .decode({ moduleId: input.moduleId, subject: locked.row, identifier, credential })\n          .pipe(Effect.flatMap(snapshotPasswordCredential));\n\n  if (\n    snapshot !== undefined &&\n    (snapshot.moduleId !== input.moduleId ||\n      snapshot.revision.subjectId !== input.subjectId ||\n      snapshot.revision.securityRevision !== locked.row[p.subject.securityRevision] ||\n      snapshot.credentialId !== credential[p.credential.credentialId] ||\n      snapshot.credentialRevision !== credential[p.credential.credentialRevision] ||\n      snapshot.verifierVersion !== credential[p.credential.verifierVersion] ||\n      Redacted.value(snapshot.verifier) !== credential[p.credential.verifier] ||\n      snapshot.normalization !== credential[p.credential.normalization] ||\n      snapshot.identifier.namespace !== identifier[p.identifier.namespace] ||\n      snapshot.identifier.value !== identifier[p.identifier.value] ||\n      snapshot.identifierBindingRevision !== identifier[p.identifier.bindingRevision])\n  )\n    return undefined;\n\n  const factors = yield* read(\n    database\n      .select()\n      .from(p.authorityCredential.table)\n      .where(eq(ac.subjectId, locked.nativeSubjectId))\n      .orderBy(ac.credentialId),\n    configuration.locking,\n  );\n\n  const active = factors.filter(\n    (row: any) =>\n      p.authorityCredential.status === undefined ||\n      p.authorityCredential.isActiveStatus?.(row[p.authorityCredential.status]) === true,\n  );\n\n  if (active.length > 64) return yield* unavailable();\n\n  const revision =\n    snapshot?.revision ??\n    AuthenticationRevision.make({\n      subjectId: input.subjectId as any,\n      securityRevision: locked.row[p.subject.securityRevision],\n      credentials: active.map((row: any) => ({\n        credentialId: row[p.authorityCredential.credentialId],\n        revision: row[p.authorityCredential.revision],\n      })),\n    });\n\n  if (\n    revision.credentials.some(\n      (expected) =>\n        !active.some(\n          (row: any) =>\n            row[p.authorityCredential.credentialId] === expected.credentialId &&\n            row[p.authorityCredential.revision] === expected.revision,\n        ),\n    )\n  )\n    return undefined;\n\n  const requirement = yield* p.subject\n    .decodeActionRequirement(locked.row, input.action)\n    .pipe(Effect.flatMap(snapshotPasswordRequirement));\n\n  return { ...locked, identifier, snapshot, revision, requirement };\n});\n\nconst currentAuthority = Effect.fn(\"DrizzlePasswordPrepared.currentAuthority\")(function* (\n  mapping: Mapping,\n  configuration: Pick<PasswordSqlConfiguration, \"locking\">,\n  record: PasswordPreparedReservation | PasswordPreparedReady,\n) {\n  const current = yield* captureAuthority(mapping, configuration, {\n    moduleId: record.moduleId,\n    action: record.action,\n    subjectId: record.revision.subjectId,\n    ...(record.reset === undefined ? {} : { reset: record.reset }),\n  });\n\n  if (\n    current === undefined ||\n    !sameRevision(current.revision, record.revision) ||\n    (current.snapshot === undefined\n      ? record.credential !== undefined\n      : record.credential === undefined ||\n        !kernel.sameCredentialSnapshot(current.snapshot, record.credential))\n  )\n    return undefined;\n\n  return current;\n});\n\nconst rowCondition = (mapping: Mapping, row: any) => {\n  const c = columns(mapping);\n\n  return and(\n    ...Object.entries(c).map(([key, value]) => {\n      const field = mapping.intent[key as keyof typeof c],\n        item = row[field];\n\n      return Predicate.isNullish(item) ? isNull(value) : eq(value, item);\n    }),\n  )!;\n};\n\nconst readIntent = Effect.fn(\"Drizzle.readIntent\")(function* (\n  mapping: Mapping,\n  condition: SQL,\n  locking: boolean,\n) {\n  const database = yield* CurrentPasswordSql;\n\n  return yield* read(\n    database.select().from(mapping.intent.table).where(condition).limit(2),\n    locking,\n  );\n});\n\nconst recordMatches = Effect.fn(\"DrizzlePasswordPrepared.recordMatches\")(function* (\n  mapping: Mapping,\n  row: any,\n  record: PasswordPreparedReservation | PasswordPreparedReady,\n  nativeSubjectId: unknown,\n  snapshot: string,\n) {\n  const t = mapping.intent,\n    p = mapping.password;\n\n  if (\n    row === undefined ||\n    row[t.moduleId] !== record.moduleId ||\n    row[t.intentId] !== record.intentId ||\n    row[t.commandId] !== record.commandId ||\n    !p.subjectId.equals(row[t.subjectId], nativeSubjectId) ||\n    row[t.action] !== record.action ||\n    row[t.generation] !== record.generation ||\n    row[t.version] !== record.version ||\n    row[t.state] !== t.states[record._tag] ||\n    row[t.snapshot] !== snapshot ||\n    row[t.identifierScope] !== identifierScope(record) ||\n    (record._tag === \"Ready\"\n      ? row[t.digest] !== record.digest\n      : !Predicate.isNullish(row[t.digest]))\n  )\n    return false;\n  for (const [key, instant] of [\n    [t.createdAt, record.createdAtMillis],\n    [t.preparationExpiresAt, record.preparationExpiresAtMillis],\n    [t.retainUntil, record.retainUntilMillis],\n  ] as const)\n    if ((yield* p.decodeInstant(row[key])) !== instant) return false;\n\n  return record._tag === \"Ready\"\n    ? (yield* p.decodeInstant(row[t.expiresAt])) === record.expiresAtMillis\n    : Predicate.isNullish(row[t.expiresAt]);\n});\n\nconst terminal = Effect.fn(\"DrizzlePasswordPrepared.terminal\")(function* (\n  mapping: Mapping,\n  row: any,\n  state: Exclude<PasswordPreparedState, \"Preparing\" | \"Ready\">,\n) {\n  const database = yield* CurrentPasswordSql;\n\n  yield* database\n    .update(mapping.intent.table)\n    .set(mapping.intent.encodeTerminal(state))\n    .where(rowCondition(mapping, row));\n\n  const c = columns(mapping),\n    t = mapping.intent;\n\n  const rows = yield* readIntent(\n    mapping,\n    and(eq(c.moduleId, row[t.moduleId]), eq(c.intentId, row[t.intentId]))!,\n    false,\n  );\n\n  const expected = { ...row, [t.state]: t.states[state], [t.snapshot]: null, [t.digest]: null };\n\n  if (\n    rows.length !== 1 ||\n    (yield* readIntent(mapping, rowCondition(mapping, expected), false)).length !== 1\n  )\n    return yield* unavailable();\n});\n\nexport const makeSqlPasswordPreparedPersistence = Effect.fn(\"makeSqlPasswordPreparedPersistence\")(\n  function* (\n    mapping: Mapping,\n    configuration: PasswordSqlConfiguration,\n  ): Effect.fn.Return<\n    PasswordPreparedPersistence,\n    PasswordUnavailable,\n    LifecycleHooks | CurrentPasswordSql | NativeDatabase\n  > {\n    const database = yield* CurrentPasswordSql;\n\n    if (!configuration.coordinated)\n      yield* validateDrizzleStorage({\n        ...mapping,\n        proof: configuration.proof?.mapping,\n      }).pipe(Effect.mapError(unavailable));\n    const hooks = yield* LifecycleHooks;\n\n    const p = mapping.password,\n      c = columns(mapping),\n      t = mapping.intent;\n\n    const owned = <A, E, R>(body: Effect.Effect<A, E, R>) =>\n      valid(mapping)\n        ? kernel.owned(\n            database,\n            p,\n            configuration,\n            Effect.gen(function* () {\n              const journal = yield* CurrentCommitJournal;\n              const guards = yield* Effect.serviceOption(PasswordPreparedJournalGuards);\n\n              if (Option.isSome(guards) && !guards.value.register(journal.prepare(undefined)))\n                return yield* unavailable();\n\n              return yield* body;\n            }),\n          )\n        : Effect.fail(unavailable());\n\n    const complete = <A>(\n      uncaptured: PasswordPreparedMutation & { readonly completion?: ProofCompletionPlan },\n      prepare: PreparePasswordCommit<PasswordMutationDecision, A>,\n    ) =>\n      Effect.gen(function* () {\n        const input = yield* snapshotMutation(uncaptured);\n\n        const completion =\n          uncaptured.completion === undefined\n            ? undefined\n            : {\n                prepare: uncaptured.completion.prepare,\n                input: yield* Schema.encodeEffect(Schema.fromJsonString(CompletionInput))(\n                  uncaptured.completion.input,\n                ).pipe(\n                  Effect.flatMap(Schema.decodeEffect(Schema.fromJsonString(CompletionInput))),\n                  Effect.mapError(unavailable),\n                ),\n              };\n\n        if (\n          (input.intent.action === \"reset-password\") !== (completion !== undefined) ||\n          (completion !== undefined && configuration.proof === undefined)\n        )\n          return yield* unavailable();\n\n        return yield* owned(\n          Effect.gen(function* () {\n            const transaction = yield* CurrentPasswordSql;\n            const journal = yield* CurrentCommitJournal;\n\n            yield* lockAnchor(mapping, configuration, input.intent.moduleId);\n\n            const authority = yield* kernel.validateMutationAuthority(\n              p,\n              configuration,\n              input.mutation,\n              input.intent.action,\n            );\n\n            if (authority === undefined) return prepare(\"rejected\", journal);\n            const current = yield* currentAuthority(mapping, configuration, input.intent);\n\n            if (current === undefined) return prepare(\"rejected\", journal);\n\n            const rows = yield* readIntent(\n              mapping,\n              and(eq(c.moduleId, input.intent.moduleId), eq(c.intentId, input.intent.intentId))!,\n              configuration.locking,\n            );\n\n            const row = rows[0],\n              encoded = yield* encodePasswordPreparedReady(input.intent);\n\n            if (\n              rows.length !== 1 ||\n              !(yield* recordMatches(\n                mapping,\n                row,\n                input.intent,\n                current.nativeSubjectId,\n                encoded,\n              )) ||\n              !evidenceCurrent(input, current.requirement, yield* nowMillis) ||\n              (yield* kernel.commandExists(\n                p,\n                input.intent.moduleId,\n                input.intent.commandId,\n                configuration.locking,\n              )).length !== 0\n            )\n              return prepare(\"rejected\", journal);\n            if (\n              completion !== undefined &&\n              (input.intent.reset === undefined ||\n                completion.input.continuationId !== input.intent.reset.continuationId ||\n                bindingJson(completion.input.binding) !== bindingJson(input.intent.reset.binding) ||\n                !kernel.proofCompletionMatchesPassword({ ...input.mutation, completion }))\n            )\n              return prepare(\"rejected\", journal);\n\n            const credentialRevision = yield* kernel.allocate(\n              configuration.mode,\n              p.allocateRevision,\n              p.allocateRevisionSync,\n            );\n\n            const verifierVersion = yield* kernel.allocate(\n              configuration.mode,\n              p.allocateRevision,\n              p.allocateRevisionSync,\n            );\n\n            const nextSecurityRevision = yield* kernel.allocateNextSecurityRevision(\n              p,\n              configuration.mode,\n              input.intent.revision.securityRevision,\n            );\n\n            if (\n              nextSecurityRevision === input.intent.revision.securityRevision ||\n              credentialRevision === input.intent.credential?.credentialRevision ||\n              verifierVersion === input.intent.credential?.verifierVersion\n            )\n              return yield* unavailable();\n\n            const credentialId =\n              input.intent.action === \"add-password\"\n                ? yield* kernel.allocate(\n                    configuration.mode,\n                    p.allocateCredentialId,\n                    p.allocateCredentialIdSync,\n                  )\n                : undefined;\n\n            let appliedAt: number | undefined;\n\n            const assertApplied = Effect.fn(\"DrizzlePasswordPrepared.assertApplied\")(() =>\n              Effect.flatMap(CurrentPasswordPreparedTransaction, (currentTransaction) =>\n                Effect.gen(function* () {\n                  if (appliedAt === undefined) return;\n\n                  if (\n                    !(yield* kernel.checkMutationApplied(\n                      p,\n                      input.mutation,\n                      current.nativeSubjectId,\n                      {\n                        credentialId: credentialId ?? input.intent.credential!.credentialId,\n                        credentialRevision,\n                        verifierVersion,\n                        nextSecurityRevision,\n                      },\n                      appliedAt,\n                    )) ||\n                    (yield* readIntent(\n                      mapping,\n                      rowCondition(mapping, {\n                        ...row,\n                        [t.state]: t.states.Consumed,\n                        [t.snapshot]: null,\n                        [t.digest]: null,\n                      }),\n                      false,\n                    )).length !== 1 ||\n                    !evidenceCurrent(input, current.requirement, yield* nowMillis)\n                  )\n                    return yield* unavailable();\n                }).pipe(Effect.provideService(CurrentPasswordSql, currentTransaction)),\n              ),\n            );\n\n            const validateApplied = Effect.gen(function* () {\n              yield* assertApplied().pipe(\n                Effect.provideService(CurrentPasswordPreparedTransaction, transaction),\n              );\n              if (appliedAt === undefined) return;\n              const postconditions = yield* Effect.serviceOption(PasswordPreparedPostconditions);\n\n              if (\n                Option.isSome(postconditions) &&\n                !postconditions.value.register(assertApplied().pipe(translateFailure))\n              )\n                return yield* unavailable();\n            });\n\n            const apply = Effect.fn(\"DrizzlePasswordPrepared.apply\")(function* () {\n              const finalNow = yield* nowMillis;\n\n              if (!evidenceCurrent(input, current.requirement, finalNow)) return false;\n\n              const changed =\n                input.intent.action === \"add-password\"\n                  ? yield* kernel.addPasswordIn(\n                      p,\n                      configuration,\n                      input.mutation,\n                      {\n                        credentialId: credentialId!,\n                        credentialRevision,\n                        verifierVersion,\n                        nextSecurityRevision,\n                      },\n                      finalNow,\n                    )\n                  : yield* kernel.writeReplacement(\n                      p,\n                      input.mutation,\n                      current.nativeSubjectId,\n                      { credentialRevision, verifierVersion, nextSecurityRevision },\n                      finalNow,\n                    );\n\n              if (!changed) return yield* unavailable();\n              appliedAt = finalNow;\n              yield* terminal(mapping, row, \"Consumed\");\n              if (!evidenceCurrent(input, current.requirement, yield* nowMillis))\n                return yield* unavailable();\n\n              return true;\n            });\n\n            if (completion !== undefined) {\n              let receipt: ReturnType<typeof prepare> | undefined;\n\n              yield* completeProofPlanIn(\n                configuration.proof!.mapping,\n                configuration.proof!.configuration,\n                completion,\n                Effect.gen(function* () {\n                  return yield* apply();\n                }),\n                (decision) => {\n                  receipt = prepare(decision === \"completed\" ? \"changed\" : \"rejected\", journal);\n\n                  return decision;\n                },\n              );\n\n              yield* validateApplied;\n\n              return receipt ?? prepare(\"rejected\", journal);\n            }\n\n            const changed = yield* apply();\n\n            yield* validateApplied;\n\n            return prepare(changed ? \"changed\" : \"rejected\", journal);\n          }),\n        );\n      });\n\n    const services: PasswordPreparedPersistence = {\n      reserve: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const input = yield* snapshotReserve(uncaptured);\n\n          if (\n            (input.action === \"reset-password\") !==\n              (input.reset !== undefined && input.completion !== undefined) ||\n            (input.action === \"reset-password\" && configuration.proof === undefined) ||\n            input.generation !== input.policy.generation ||\n            input.policy.retentionMillis <\n              Math.max(\n                input.policy.preparationLifetimeMillis + input.policy.lifetimeMillis,\n                input.policy.admission.action.windowMillis,\n                input.policy.admission.identifier.windowMillis,\n                input.policy.admission.subject.windowMillis,\n              ) ||\n            (input.invalidation.existingSessions === \"immediate\" &&\n              p.sessionInvalidation !== \"same-authority-immediate\")\n          )\n            return yield* unavailable();\n\n          return yield* owned(\n            Effect.gen(function* () {\n              const transaction = yield* CurrentPasswordSql;\n              const journal = yield* CurrentCommitJournal;\n\n              yield* lockAnchor(mapping, configuration, input.moduleId);\n\n              const version = PasswordPreparedVersion.make(\n                yield* kernel.allocate(\n                  configuration.mode,\n                  mapping.allocateVersion,\n                  mapping.allocateVersionSync,\n                ),\n              );\n\n              const authority = yield* captureAuthority(mapping, configuration, input);\n\n              if (authority === undefined) return yield* unavailable();\n              if (input.reset !== undefined) {\n                if (\n                  input.completion === undefined ||\n                  input.completion.moduleId !== `${input.moduleId}/reset` ||\n                  input.completion.purpose !== \"password-reset\" ||\n                  input.reset.continuationId !== input.completion.continuationId ||\n                  bindingJson(input.reset.binding) !== bindingJson(input.completion.binding) ||\n                  input.reset.binding._tag !== \"Subject\" ||\n                  !sameRevision(input.reset.binding.revision, authority.revision) ||\n                  authority.snapshot?.identifierVerifiedAtMillis === undefined ||\n                  !(yield* checkProofCompletionIn(\n                    configuration.proof!.mapping,\n                    configuration.proof!.configuration,\n                    input.completion,\n                  ))\n                )\n                  return yield* unavailable();\n              }\n              if (\n                (yield* readIntent(\n                  mapping,\n                  and(eq(c.moduleId, input.moduleId), eq(c.commandId, input.commandId))!,\n                  configuration.locking,\n                )).length\n              )\n                return prepare({ _tag: \"Existing\" }, journal);\n\n              const now = yield* nowMillis,\n                nativeNow = p.encodeInstant(now);\n\n              const scope = identifierScope({\n                ...(authority.snapshot === undefined ? {} : { credential: authority.snapshot }),\n                revision: authority.revision,\n              });\n\n              const active =\n                (yield* read(\n                  transaction\n                    .select({ total: count() })\n                    .from(t.table)\n                    .where(\n                      and(\n                        eq(c.moduleId, input.moduleId),\n                        eq(c.subjectId, authority.nativeSubjectId),\n                        or(\n                          and(\n                            eq(c.state, t.states.Preparing),\n                            gt(c.preparationExpiresAt, nativeNow),\n                          ),\n                          and(eq(c.state, t.states.Ready), gt(c.expiresAt, nativeNow)),\n                        ),\n                      ),\n                    ),\n                  false,\n                ))[0]?.total ?? 0;\n\n              if (active >= input.policy.maximumPendingPerSubject) return yield* unavailable();\n              for (const [condition, budget] of [\n                [eq(c.action, input.action), input.policy.admission.action],\n                [eq(c.identifierScope, scope), input.policy.admission.identifier],\n                [eq(c.subjectId, authority.nativeSubjectId), input.policy.admission.subject],\n              ] as const) {\n                const total =\n                  (yield* read(\n                    transaction\n                      .select({ total: count() })\n                      .from(t.table)\n                      .where(\n                        and(\n                          eq(c.moduleId, input.moduleId),\n                          condition,\n                          gt(c.admittedAt, p.encodeInstant(now - budget.windowMillis)),\n                        ),\n                      ),\n                    false,\n                  ))[0]?.total ?? 0;\n\n                if (total >= budget.limit) return yield* unavailable();\n              }\n\n              const reservation = yield* snapshotPasswordPreparedReservation({\n                _tag: \"Preparing\",\n                moduleId: input.moduleId,\n                generation: input.generation,\n                intentId: input.intentId,\n                version,\n                commandId: input.commandId,\n                action: input.action,\n                revision: authority.revision,\n                ...(authority.snapshot === undefined ? {} : { credential: authority.snapshot }),\n                capturedRequirement: authority.requirement,\n                ...(input.reset === undefined ? {} : { reset: input.reset }),\n                invalidation: input.invalidation,\n                createdAtMillis: now,\n                preparationExpiresAtMillis: now + input.policy.preparationLifetimeMillis,\n                retainUntilMillis: now + input.policy.retentionMillis,\n              });\n\n              const snapshot = yield* encodeReservation(reservation);\n\n              yield* transaction.insert(t.table).values(\n                t.encodeInsert({\n                  reservation,\n                  nativeSubjectId: authority.nativeSubjectId,\n                  identifierScope: scope,\n                  snapshot,\n                  admittedAtMillis: now,\n                  admissionRetainUntilMillis:\n                    now +\n                    Math.max(\n                      input.policy.admission.action.windowMillis,\n                      input.policy.admission.identifier.windowMillis,\n                      input.policy.admission.subject.windowMillis,\n                    ),\n                }),\n              );\n\n              const rows = yield* readIntent(\n                mapping,\n                and(eq(c.moduleId, input.moduleId), eq(c.intentId, input.intentId))!,\n                false,\n              );\n\n              if (\n                rows.length !== 1 ||\n                !(yield* recordMatches(\n                  mapping,\n                  rows[0],\n                  reservation,\n                  authority.nativeSubjectId,\n                  snapshot,\n                ))\n              )\n                return yield* unavailable();\n\n              const admittedUntil =\n                now +\n                Math.max(\n                  input.policy.admission.action.windowMillis,\n                  input.policy.admission.identifier.windowMillis,\n                  input.policy.admission.subject.windowMillis,\n                );\n\n              if (\n                (yield* p.decodeInstant(rows[0][t.admittedAt])) !== now ||\n                (yield* p.decodeInstant(rows[0][t.admissionRetainUntil])) !== admittedUntil ||\n                (yield* nowMillis) >= reservation.preparationExpiresAtMillis ||\n                (input.completion !== undefined &&\n                  !(yield* checkProofCompletionIn(\n                    configuration.proof!.mapping,\n                    configuration.proof!.configuration,\n                    input.completion,\n                  )))\n              )\n                return yield* unavailable();\n\n              return prepare({ _tag: \"Reserved\", reservation }, journal);\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      publishReady: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const reservation = yield* snapshotPasswordPreparedReservation(uncaptured.reservation),\n            ready = yield* snapshotPasswordPreparedReady(uncaptured.ready);\n\n          const snapshot = yield* encodeReservation(reservation),\n            readySnapshot = yield* encodePasswordPreparedReady(ready);\n\n          if ((yield* encodeReservation(reservationOf(ready))) !== snapshot)\n            return yield* unavailable();\n\n          return yield* owned(\n            Effect.gen(function* () {\n              const transaction = yield* CurrentPasswordSql;\n              const journal = yield* CurrentCommitJournal;\n\n              yield* lockAnchor(mapping, configuration, reservation.moduleId);\n              const authority = yield* currentAuthority(mapping, configuration, reservation);\n\n              if (authority === undefined) return prepare(\"rejected\", journal);\n\n              const rows = yield* readIntent(\n                  mapping,\n                  and(eq(c.moduleId, reservation.moduleId), eq(c.intentId, reservation.intentId))!,\n                  configuration.locking,\n                ),\n                row = rows[0];\n\n              const now = yield* nowMillis;\n\n              if (\n                rows.length !== 1 ||\n                !(yield* recordMatches(\n                  mapping,\n                  row,\n                  reservation,\n                  authority.nativeSubjectId,\n                  snapshot,\n                )) ||\n                now < ready.issuedAtMillis ||\n                now >= reservation.preparationExpiresAtMillis ||\n                now >= ready.expiresAtMillis\n              )\n                return prepare(\"rejected\", journal);\n              yield* transaction\n                .update(t.table)\n                .set(t.encodeReady({ ready, snapshot: readySnapshot }))\n                .where(rowCondition(mapping, row));\n\n              const saved = yield* readIntent(\n                mapping,\n                and(eq(c.moduleId, ready.moduleId), eq(c.intentId, ready.intentId))!,\n                false,\n              );\n\n              if (\n                saved.length !== 1 ||\n                !(yield* recordMatches(\n                  mapping,\n                  saved[0],\n                  ready,\n                  authority.nativeSubjectId,\n                  readySnapshot,\n                )) ||\n                (yield* readIntent(\n                  mapping,\n                  and(\n                    eq(c.moduleId, ready.moduleId),\n                    eq(c.intentId, ready.intentId),\n                    eq(c.admittedAt, row[t.admittedAt]),\n                    eq(c.admissionRetainUntil, row[t.admissionRetainUntil]),\n                  )!,\n                  false,\n                )).length !== 1\n              )\n                return yield* unavailable();\n              if (\n                (yield* nowMillis) >= reservation.preparationExpiresAtMillis ||\n                (yield* nowMillis) >= ready.expiresAtMillis\n              )\n                return yield* unavailable();\n\n              return prepare(\"published\", journal);\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      context: (uncaptured) =>\n        Effect.gen(function* () {\n          const input = yield* Schema.decodeEffect(ContextInput)({ ...uncaptured }).pipe(\n            Effect.mapError(unavailable),\n          );\n\n          const record = yield* kernel.safeRead(\n            database,\n            configuration,\n            Effect.gen(function* () {\n              if (\n                !valid(mapping) ||\n                !(yield* lockAnchor(mapping, configuration, input.moduleId, false))\n              )\n                return undefined;\n\n              const rows = yield* readIntent(\n                mapping,\n                and(\n                  eq(c.moduleId, input.moduleId),\n                  eq(c.generation, input.generation),\n                  eq(c.digest, input.digest),\n                  eq(c.state, t.states.Ready),\n                )!,\n                false,\n              );\n\n              if (rows.length !== 1) return undefined;\n              const selected = yield* decodePasswordPreparedReady(rows[0][t.snapshot]);\n              const authority = yield* currentAuthority(mapping, configuration, selected);\n\n              if (authority === undefined) return undefined;\n\n              const locked = yield* readIntent(\n                mapping,\n                rowCondition(mapping, rows[0]),\n                configuration.locking,\n              );\n\n              const now = yield* nowMillis;\n\n              if (\n                locked.length !== 1 ||\n                now < selected.issuedAtMillis ||\n                now >= selected.expiresAtMillis ||\n                selected.moduleId !== input.moduleId ||\n                selected.generation !== input.generation ||\n                selected.digest !== input.digest ||\n                !(yield* recordMatches(\n                  mapping,\n                  locked[0],\n                  selected,\n                  authority.nativeSubjectId,\n                  yield* encodePasswordPreparedReady(selected),\n                ))\n              )\n                return undefined;\n\n              return { record: selected, currentRequirement: authority.requirement };\n            }),\n          );\n\n          return record ?? (yield* PasswordRejected.make({}));\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateContextFailure,\n        ),\n      complete: (input, prepare) =>\n        complete(input, prepare).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      resetWithProof: (input, prepare) =>\n        complete(input, prepare).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      cancel: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const record = yield* snapshotPasswordPreparedReady(uncaptured.record),\n            snapshot = yield* encodePasswordPreparedReady(record);\n\n          return yield* owned(\n            Effect.gen(function* () {\n              const journal = yield* CurrentCommitJournal;\n\n              yield* lockAnchor(mapping, configuration, record.moduleId);\n              const authority = yield* currentAuthority(mapping, configuration, record);\n\n              if (authority === undefined) return prepare(false, journal);\n\n              const rows = yield* readIntent(\n                mapping,\n                and(eq(c.moduleId, record.moduleId), eq(c.intentId, record.intentId))!,\n                configuration.locking,\n              );\n\n              const now = yield* nowMillis;\n\n              if (\n                rows.length !== 1 ||\n                now < record.issuedAtMillis ||\n                now >= record.expiresAtMillis ||\n                !(yield* recordMatches(\n                  mapping,\n                  rows[0],\n                  record,\n                  authority.nativeSubjectId,\n                  snapshot,\n                ))\n              )\n                return prepare(false, journal);\n              yield* terminal(mapping, rows[0], \"Cancelled\");\n\n              return prepare(true, journal);\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      cleanup: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const input = { ...uncaptured };\n\n          if (!Number.isSafeInteger(input.limit) || input.limit < 1 || input.limit > 1000)\n            return yield* unavailable();\n\n          return yield* owned(\n            Effect.gen(function* () {\n              const transaction = yield* CurrentPasswordSql;\n              const journal = yield* CurrentCommitJournal;\n\n              if (!(yield* lockAnchor(mapping, configuration, input.moduleId, false)))\n                return prepare({ removed: 0, hasMore: false }, journal);\n              const now = p.encodeInstant(yield* nowMillis);\n\n              const due = and(\n                eq(c.moduleId, input.moduleId),\n                or(\n                  and(lte(c.retainUntil, now), lte(c.admissionRetainUntil, now)),\n                  and(\n                    isNotNull(c.snapshot),\n                    or(\n                      and(eq(c.state, t.states.Preparing), lte(c.preparationExpiresAt, now)),\n                      and(eq(c.state, t.states.Ready), lte(c.expiresAt, now)),\n                    ),\n                  ),\n                ),\n              )!;\n\n              const rows = yield* read(\n                transaction\n                  .select()\n                  .from(t.table)\n                  .where(due)\n                  .orderBy(c.createdAt, c.intentId)\n                  .limit(input.limit + 1),\n                configuration.locking,\n              );\n\n              let removed = 0;\n\n              for (const row of rows.slice(0, input.limit)) {\n                const expired =\n                  (yield* readIntent(\n                    mapping,\n                    and(\n                      rowCondition(mapping, row),\n                      lte(c.retainUntil, now),\n                      lte(c.admissionRetainUntil, now),\n                    )!,\n                    false,\n                  )).length === 1;\n\n                if (expired) {\n                  yield* transaction.delete(t.table).where(rowCondition(mapping, row));\n                  if (\n                    (yield* readIntent(\n                      mapping,\n                      and(eq(c.moduleId, input.moduleId), eq(c.intentId, row[t.intentId]))!,\n                      false,\n                    )).length\n                  )\n                    return yield* unavailable();\n                  removed++;\n                } else yield* terminal(mapping, row, \"Expired\");\n              }\n\n              return prepare(\n                {\n                  removed,\n                  hasMore:\n                    (yield* read(transaction.select().from(t.table).where(due).limit(1), false))\n                      .length > 0,\n                },\n                journal,\n              );\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n    };\n\n    return services;\n  },\n);\n\nexport const passwordPreparedSqlKernel = {\n  columns,\n  recordMatches,\n  captureAuthority,\n  currentAuthority,\n  rowCondition,\n  valid,\n  identifierScope,\n};\n"],"mappings":";;;;;;;;;;;;;;;AA0DA,MAAM,oBACJ,WAEA,yBACE,SACC,UACC,OAAO,GAAG,mBAAmB,CAAC,CAAC,KAAK,KACpC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,sBAAsB,CAAC,CAAC,KAAK,CAC3C,CAAC,CAAC,KAAK,OAAO,YAAY,UAAU,OAAO,UAAU,MAAM,IAAI,aAAa,YAAY,CAAC,CAAC,CAAC,CAAC;AAE9F,MAAM,2BACJ,WAEA,yBACE,SACC,UACC,OAAO,GAAG,mBAAmB,CAAC,CAAC,KAAK,KACpC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,sBAAsB,CAAC,CAAC,KAAK,CAC3C,CAAC,CAAC,KACA,OAAO,YAAY,UACjB,OAAO,UACL,MAAM,IAAI,QAAQ,UAAW,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,IAAI,QAAQ,YAAY,CAAE,CAC1F,CACF,CACF;AAGF,MAAM,YAAY,SAAS,IAAI,KAAK,OAAO,IAAI,SAAS,aAAa,CAAC;AAEtE,MAAM,QAAQ,OAAyB,YACrC,WAAW,OAAO,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,IAAI;AAErE,MAAM,WAAW,YAAqB;CACpC,MAAM,QAAQ,QAAQ;CAEtB,OAAO;EACL,UAAU,OAAO,MAAM,OAAO,MAAM,QAAQ;EAC5C,UAAU,OAAO,MAAM,OAAO,MAAM,QAAQ;EAC5C,WAAW,OAAO,MAAM,OAAO,MAAM,SAAS;EAC9C,WAAW,OAAO,MAAM,OAAO,MAAM,SAAS;EAC9C,QAAQ,OAAO,MAAM,OAAO,MAAM,MAAM;EACxC,YAAY,OAAO,MAAM,OAAO,MAAM,UAAU;EAChD,SAAS,OAAO,MAAM,OAAO,MAAM,OAAO;EAC1C,OAAO,OAAO,MAAM,OAAO,MAAM,KAAK;EACtC,QAAQ,OAAO,MAAM,OAAO,MAAM,MAAM;EACxC,UAAU,OAAO,MAAM,OAAO,MAAM,QAAQ;EAC5C,iBAAiB,OAAO,MAAM,OAAO,MAAM,eAAe;EAC1D,WAAW,OAAO,MAAM,OAAO,MAAM,SAAS;EAC9C,YAAY,OAAO,MAAM,OAAO,MAAM,UAAU;EAChD,sBAAsB,OAAO,MAAM,OAAO,MAAM,oBAAoB;EACpE,sBAAsB,OAAO,MAAM,OAAO,MAAM,oBAAoB;EACpE,WAAW,OAAO,MAAM,OAAO,MAAM,SAAS;EAC9C,aAAa,OAAO,MAAM,OAAO,MAAM,WAAW;CACpD;AACF;AAEA,MAAM,SAAS,YACb,OAAO,QAAQ,mCAAmC,CAAC,CAAC,OACjD,CAAC,KAAK,WACL,QAAQ,YAAY,SAA6D,KACrF;AAEF,MAAM,aAAa,OAAO,GAAG,oCAAoC,CAAC,CAAC,WACjE,SACA,eACA,UACA,SAAS,MACT;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,IAAI,QAAQ,WAChB,MAAM,OAAO,EAAE,OAAO,EAAE,QAAQ;CAElC,IAAI,QACF,OAAO,cAAc,eACnB,SAAS,OAAO,EAAE,KAAK,CAAC,CAAC,OAAO,EAAE,aAAa,QAAQ,CAAC,GACxD,EAAE,UACF,QACF;CAEF,MAAM,OAAO,OAAO,KAClB,SAAS,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,MAAM,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAChE,cAAc,OAChB;CAEA,IAAI,KAAK,SAAS,KAAM,UAAU,KAAK,WAAW,GAAI,OAAO,OAAO,YAAY;CAEhF,OAAO,KAAK,WAAW;AACzB,CAAC;AAED,MAAM,cAAc,OAAO,WAAW,OAAO,eAAe,YAAY,CAAC;AAEzE,MAAM,mBAAmB,OAAO,GAAG,0CAA0C,CAAC,CAAC,WAC7E,SACA,eACA,OAMA;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,IAAI,QAAQ;CAClB,MAAM,SAAS,OAAOA,kBAAO,YAAY,GAAG,MAAM,WAAW,cAAc,OAAO;CAElF,IAAI,OAAO,QAAQ,KAAA,KAAa,CAAC,EAAE,QAAQ,eAAe,OAAO,IAAI,EAAE,QAAQ,OAAO,GACpF,OAAO,KAAA;CAET,MAAM,KAAKA,kBAAO,kBAAkB,CAAC,GACnC,KAAKA,kBAAO,2BAA2B,CAAC;CAE1C,IAAI;CAEJ,IAAI,MAAM,WAAW,gBAAgB;EACnC,IAAI,MAAM,UAAU,KAAA,GAClB,cAAc,OAAOA,kBAAO,eAC1B,GACA,MAAM,MAAM,QAAQ,YACpB,cAAc,OAChB,EAAA,CAAG;OACA;GACH,MAAM,cAAc,OAAO,KACzB,SACG,OAAO,CAAC,CACR,KAAK,EAAE,WAAW,KAAK,CAAC,CACxB,MAAM,GAAG,GAAG,WAAW,OAAO,eAAe,CAAC,CAAC,CAC/C,QAAQ,GAAG,WAAW,GAAG,KAAK,GACjC,KACF,EAAA,CAAG,MAAM,QAAa,EAAE,WAAW,UAAU,GAAG,CAAC;GAEjD,IAAI,eAAe,KAAA,GACjB,cAAc,OAAOA,kBAAO,eAC1B,GACA;IACE,WAAW,WAAW,EAAE,WAAW;IACnC,OAAO,WAAW,EAAE,WAAW;GACjC,GACA,cAAc,OAChB,EAAA,CAAG;EACP;EACA,IACE,eAAe,KAAA,KACf,CAAC,EAAE,WAAW,UAAU,UAAU,KAClC,CAAC,EAAE,UAAU,OAAO,WAAW,EAAE,WAAW,YAAY,OAAO,eAAe,GAE9E,OAAO,KAAA;CACX;CAEA,MAAM,cAAc,OAAOA,kBAAO,uBAChC,GACA,MAAM,UACN,OAAO,iBACP,cAAc,OAChB,EAAA,CAAG;CAEH,IAAK,MAAM,WAAW,oBAAqB,eAAe,KAAA,IAAY,OAAO,KAAA;CAE7E,MAAM,WACJ,eAAe,KAAA,IACX,KAAA,IACA,OAAO,EAAE,WACN,OAAO;EAAE,UAAU,MAAM;EAAU,SAAS,OAAO;EAAK;EAAY;CAAW,CAAC,CAAC,CACjF,KAAK,OAAO,QAAQ,0BAA0B,CAAC;CAExD,IACE,aAAa,KAAA,MACZ,SAAS,aAAa,MAAM,YAC3B,SAAS,SAAS,cAAc,MAAM,aACtC,SAAS,SAAS,qBAAqB,OAAO,IAAI,EAAE,QAAQ,qBAC5D,SAAS,iBAAiB,WAAW,EAAE,WAAW,iBAClD,SAAS,uBAAuB,WAAW,EAAE,WAAW,uBACxD,SAAS,oBAAoB,WAAW,EAAE,WAAW,oBACrD,SAAS,MAAM,SAAS,QAAQ,MAAM,WAAW,EAAE,WAAW,aAC9D,SAAS,kBAAkB,WAAW,EAAE,WAAW,kBACnD,SAAS,WAAW,cAAc,WAAW,EAAE,WAAW,cAC1D,SAAS,WAAW,UAAU,WAAW,EAAE,WAAW,UACtD,SAAS,8BAA8B,WAAW,EAAE,WAAW,mBAEjE,OAAO,KAAA;CAWT,MAAM,UAAS,OATQ,KACrB,SACG,OAAO,CAAC,CACR,KAAK,EAAE,oBAAoB,KAAK,CAAC,CACjC,MAAM,GAAG,GAAG,WAAW,OAAO,eAAe,CAAC,CAAC,CAC/C,QAAQ,GAAG,YAAY,GAC1B,cAAc,OAChB,EAAA,CAEuB,QACpB,QACC,EAAE,oBAAoB,WAAW,KAAA,KACjC,EAAE,oBAAoB,iBAAiB,IAAI,EAAE,oBAAoB,OAAO,MAAM,IAClF;CAEA,IAAI,OAAO,SAAS,IAAI,OAAO,OAAO,YAAY;CAElD,MAAM,WACJ,UAAU,YACV,uBAAuB,KAAK;EAC1B,WAAW,MAAM;EACjB,kBAAkB,OAAO,IAAI,EAAE,QAAQ;EACvC,aAAa,OAAO,KAAK,SAAc;GACrC,cAAc,IAAI,EAAE,oBAAoB;GACxC,UAAU,IAAI,EAAE,oBAAoB;EACtC,EAAE;CACJ,CAAC;CAEH,IACE,SAAS,YAAY,MAClB,aACC,CAAC,OAAO,MACL,QACC,IAAI,EAAE,oBAAoB,kBAAkB,SAAS,gBACrD,IAAI,EAAE,oBAAoB,cAAc,SAAS,QACrD,CACJ,GAEA,OAAO,KAAA;CAET,MAAM,cAAc,OAAO,EAAE,QAC1B,wBAAwB,OAAO,KAAK,MAAM,MAAM,CAAC,CACjD,KAAK,OAAO,QAAQ,2BAA2B,CAAC;CAEnD,OAAO;EAAE,GAAG;EAAQ;EAAY;EAAU;EAAU;CAAY;AAClE,CAAC;AAED,MAAM,mBAAmB,OAAO,GAAG,0CAA0C,CAAC,CAAC,WAC7E,SACA,eACA,QACA;CACA,MAAM,UAAU,OAAO,iBAAiB,SAAS,eAAe;EAC9D,UAAU,OAAO;EACjB,QAAQ,OAAO;EACf,WAAW,OAAO,SAAS;EAC3B,GAAI,OAAO,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,OAAO,MAAM;CAC9D,CAAC;CAED,IACE,YAAY,KAAA,KACZ,CAAC,aAAa,QAAQ,UAAU,OAAO,QAAQ,MAC9C,QAAQ,aAAa,KAAA,IAClB,OAAO,eAAe,KAAA,IACtB,OAAO,eAAe,KAAA,KACtB,CAACA,kBAAO,uBAAuB,QAAQ,UAAU,OAAO,UAAU,IAEtE,OAAO,KAAA;CAET,OAAO;AACT,CAAC;AAED,MAAM,gBAAgB,SAAkB,QAAa;CACnD,MAAM,IAAI,QAAQ,OAAO;CAEzB,OAAO,IACL,GAAG,OAAO,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW;EACzC,MACE,OAAO,IADK,QAAQ,OAAO;EAG7B,OAAO,UAAU,UAAU,IAAI,IAAI,OAAO,KAAK,IAAI,GAAG,OAAO,IAAI;CACnE,CAAC,CACH;AACF;AAEA,MAAM,aAAa,OAAO,GAAG,oBAAoB,CAAC,CAAC,WACjD,SACA,WACA,SACA;CACA,MAAM,WAAW,OAAO;CAExB,OAAO,OAAO,KACZ,SAAS,OAAO,CAAC,CAAC,KAAK,QAAQ,OAAO,KAAK,CAAC,CAAC,MAAM,SAAS,CAAC,CAAC,MAAM,CAAC,GACrE,OACF;AACF,CAAC;AAED,MAAM,gBAAgB,OAAO,GAAG,uCAAuC,CAAC,CAAC,WACvE,SACA,KACA,QACA,iBACA,UACA;CACA,MAAM,IAAI,QAAQ,QAChB,IAAI,QAAQ;CAEd,IACE,QAAQ,KAAA,KACR,IAAI,EAAE,cAAc,OAAO,YAC3B,IAAI,EAAE,cAAc,OAAO,YAC3B,IAAI,EAAE,eAAe,OAAO,aAC5B,CAAC,EAAE,UAAU,OAAO,IAAI,EAAE,YAAY,eAAe,KACrD,IAAI,EAAE,YAAY,OAAO,UACzB,IAAI,EAAE,gBAAgB,OAAO,cAC7B,IAAI,EAAE,aAAa,OAAO,WAC1B,IAAI,EAAE,WAAW,EAAE,OAAO,OAAO,SACjC,IAAI,EAAE,cAAc,YACpB,IAAI,EAAE,qBAAqB,gBAAgB,MAAM,MAChD,OAAO,SAAS,UACb,IAAI,EAAE,YAAY,OAAO,SACzB,CAAC,UAAU,UAAU,IAAI,EAAE,OAAO,IAEtC,OAAO;CACT,KAAK,MAAM,CAAC,KAAK,YAAY;EAC3B,CAAC,EAAE,WAAW,OAAO,eAAe;EACpC,CAAC,EAAE,sBAAsB,OAAO,0BAA0B;EAC1D,CAAC,EAAE,aAAa,OAAO,iBAAiB;CAC1C,GACE,KAAK,OAAO,EAAE,cAAc,IAAI,IAAI,OAAO,SAAS,OAAO;CAE7D,OAAO,OAAO,SAAS,WAClB,OAAO,EAAE,cAAc,IAAI,EAAE,UAAU,OAAO,OAAO,kBACtD,UAAU,UAAU,IAAI,EAAE,UAAU;AAC1C,CAAC;AAED,MAAM,WAAW,OAAO,GAAG,kCAAkC,CAAC,CAAC,WAC7D,SACA,KACA,OACA;CAGA,QAAO,OAFiB,mBAAA,CAGrB,OAAO,QAAQ,OAAO,KAAK,CAAC,CAC5B,IAAI,QAAQ,OAAO,eAAe,KAAK,CAAC,CAAC,CACzC,MAAM,aAAa,SAAS,GAAG,CAAC;CAEnC,MAAM,IAAI,QAAQ,OAAO,GACvB,IAAI,QAAQ;CAEd,MAAM,OAAO,OAAO,WAClB,SACA,IAAI,GAAG,EAAE,UAAU,IAAI,EAAE,SAAS,GAAG,GAAG,EAAE,UAAU,IAAI,EAAE,SAAS,CAAC,GACpE,KACF;CAEA,MAAM,WAAW;EAAE,GAAG;GAAM,EAAE,QAAQ,EAAE,OAAO;GAAS,EAAE,WAAW;GAAO,EAAE,SAAS;CAAK;CAE5F,IACE,KAAK,WAAW,MACf,OAAO,WAAW,SAAS,aAAa,SAAS,QAAQ,GAAG,KAAK,EAAA,CAAG,WAAW,GAEhF,OAAO,OAAO,YAAY;AAC9B,CAAC;AAED,MAAa,qCAAqC,OAAO,GAAG,oCAAoC,CAAC,CAC/F,WACE,SACA,eAKA;CACA,MAAM,WAAW,OAAO;CAExB,IAAI,CAAC,cAAc,aACjB,OAAO,uBAAuB;EAC5B,GAAG;EACH,OAAO,cAAc,OAAO;CAC9B,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;CACtC,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,UAChB,IAAI,QAAQ,OAAO,GACnB,IAAI,QAAQ;CAEd,MAAM,SAAkB,SACtB,MAAM,OAAO,IACTA,kBAAO,MACL,UACA,GACA,eACA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO;EACvB,MAAM,SAAS,OAAO,OAAO,cAAc,6BAA6B;EAExE,IAAI,OAAO,OAAO,MAAM,KAAK,CAAC,OAAO,MAAM,SAAS,QAAQ,QAAQ,KAAA,CAAS,CAAC,GAC5E,OAAO,OAAO,YAAY;EAE5B,OAAO,OAAO;CAChB,CAAC,CACH,IACA,OAAO,KAAK,YAAY,CAAC;CAE/B,MAAM,YACJ,YACA,YAEA,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO,iBAAiB,UAAU;EAEhD,MAAM,aACJ,WAAW,eAAe,KAAA,IACtB,KAAA,IACA;GACE,SAAS,WAAW,WAAW;GAC/B,OAAO,OAAO,OAAO,aAAa,OAAO,eAAe,eAAe,CAAC,CAAC,CACvE,WAAW,WAAW,KACxB,CAAC,CAAC,KACA,OAAO,QAAQ,OAAO,aAAa,OAAO,eAAe,eAAe,CAAC,CAAC,GAC1E,OAAO,SAAS,WAAW,CAC7B;EACF;EAEN,IACG,MAAM,OAAO,WAAW,sBAAuB,eAAe,KAAA,MAC9D,eAAe,KAAA,KAAa,cAAc,UAAU,KAAA,GAErD,OAAO,OAAO,YAAY;EAE5B,OAAO,OAAO,MACZ,OAAO,IAAI,aAAa;GACtB,MAAM,cAAc,OAAO;GAC3B,MAAM,UAAU,OAAO;GAEvB,OAAO,WAAW,SAAS,eAAe,MAAM,OAAO,QAAQ;GAS/D,KAAI,OAPqBA,kBAAO,0BAC9B,GACA,eACA,MAAM,UACN,MAAM,OAAO,MACf,OAEkB,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;GAC/D,MAAM,UAAU,OAAO,iBAAiB,SAAS,eAAe,MAAM,MAAM;GAE5E,IAAI,YAAY,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;GAE7D,MAAM,OAAO,OAAO,WAClB,SACA,IAAI,GAAG,EAAE,UAAU,MAAM,OAAO,QAAQ,GAAG,GAAG,EAAE,UAAU,MAAM,OAAO,QAAQ,CAAC,GAChF,cAAc,OAChB;GAEA,MAAM,MAAM,KAAK,IACf,UAAU,OAAO,4BAA4B,MAAM,MAAM;GAE3D,IACE,KAAK,WAAW,KAChB,EAAE,OAAO,cACP,SACA,KACA,MAAM,QACN,QAAQ,iBACR,OACF,MACA,CAAC,gBAAgB,OAAO,QAAQ,aAAa,OAAO,SAAS,MAC5D,OAAOA,kBAAO,cACb,GACA,MAAM,OAAO,UACb,MAAM,OAAO,WACb,cAAc,OAChB,EAAA,CAAG,WAAW,GAEd,OAAO,QAAQ,YAAY,OAAO;GACpC,IACE,eAAe,KAAA,MACd,MAAM,OAAO,UAAU,KAAA,KACtB,WAAW,MAAM,mBAAmB,MAAM,OAAO,MAAM,kBACvD,YAAY,WAAW,MAAM,OAAO,MAAM,YAAY,MAAM,OAAO,MAAM,OAAO,KAChF,CAACA,kBAAO,+BAA+B;IAAE,GAAG,MAAM;IAAU;GAAW,CAAC,IAE1E,OAAO,QAAQ,YAAY,OAAO;GAEpC,MAAM,qBAAqB,OAAOA,kBAAO,SACvC,cAAc,MACd,EAAE,kBACF,EAAE,oBACJ;GAEA,MAAM,kBAAkB,OAAOA,kBAAO,SACpC,cAAc,MACd,EAAE,kBACF,EAAE,oBACJ;GAEA,MAAM,uBAAuB,OAAOA,kBAAO,6BACzC,GACA,cAAc,MACd,MAAM,OAAO,SAAS,gBACxB;GAEA,IACE,yBAAyB,MAAM,OAAO,SAAS,oBAC/C,uBAAuB,MAAM,OAAO,YAAY,sBAChD,oBAAoB,MAAM,OAAO,YAAY,iBAE7C,OAAO,OAAO,YAAY;GAE5B,MAAM,eACJ,MAAM,OAAO,WAAW,iBACpB,OAAOA,kBAAO,SACZ,cAAc,MACd,EAAE,sBACF,EAAE,wBACJ,IACA,KAAA;GAEN,IAAI;GAEJ,MAAM,gBAAgB,OAAO,GAAG,uCAAuC,CAAC,OACtE,OAAO,QAAQ,qCAAqC,uBAClD,OAAO,IAAI,aAAa;IACtB,IAAI,cAAc,KAAA,GAAW;IAE7B,IACE,EAAE,OAAOA,kBAAO,qBACd,GACA,MAAM,UACN,QAAQ,iBACR;KACE,cAAc,gBAAgB,MAAM,OAAO,WAAY;KACvD;KACA;KACA;IACF,GACA,SACF,OACC,OAAO,WACN,SACA,aAAa,SAAS;KACpB,GAAG;MACF,EAAE,QAAQ,EAAE,OAAO;MACnB,EAAE,WAAW;MACb,EAAE,SAAS;IACd,CAAC,GACD,KACF,EAAA,CAAG,WAAW,KACd,CAAC,gBAAgB,OAAO,QAAQ,aAAa,OAAO,SAAS,GAE7D,OAAO,OAAO,YAAY;GAC9B,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,oBAAoB,kBAAkB,CAAC,CACvE,CACF;GAEA,MAAM,kBAAkB,OAAO,IAAI,aAAa;IAC9C,OAAO,cAAc,CAAC,CAAC,KACrB,OAAO,eAAe,oCAAoC,WAAW,CACvE;IACA,IAAI,cAAc,KAAA,GAAW;IAC7B,MAAM,iBAAiB,OAAO,OAAO,cAAc,8BAA8B;IAEjF,IACE,OAAO,OAAO,cAAc,KAC5B,CAAC,eAAe,MAAM,SAAS,cAAc,CAAC,CAAC,KAAK,gBAAgB,CAAC,GAErE,OAAO,OAAO,YAAY;GAC9B,CAAC;GAED,MAAM,QAAQ,OAAO,GAAG,+BAA+B,CAAC,CAAC,aAAa;IACpE,MAAM,WAAW,OAAO;IAExB,IAAI,CAAC,gBAAgB,OAAO,QAAQ,aAAa,QAAQ,GAAG,OAAO;IAwBnE,IAAI,EArBF,MAAM,OAAO,WAAW,iBACpB,OAAOA,kBAAO,cACZ,GACA,eACA,MAAM,UACN;KACgB;KACd;KACA;KACA;IACF,GACA,QACF,IACA,OAAOA,kBAAO,iBACZ,GACA,MAAM,UACN,QAAQ,iBACR;KAAE;KAAoB;KAAiB;IAAqB,GAC5D,QACF,IAEQ,OAAO,OAAO,YAAY;IACxC,YAAY;IACZ,OAAO,SAAS,SAAS,KAAK,UAAU;IACxC,IAAI,CAAC,gBAAgB,OAAO,QAAQ,aAAa,OAAO,SAAS,GAC/D,OAAO,OAAO,YAAY;IAE5B,OAAO;GACT,CAAC;GAED,IAAI,eAAe,KAAA,GAAW;IAC5B,IAAI;IAEJ,OAAO,oBACL,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,YACA,OAAO,IAAI,aAAa;KACtB,OAAO,OAAO,MAAM;IACtB,CAAC,IACA,aAAa;KACZ,UAAU,QAAQ,aAAa,cAAc,YAAY,YAAY,OAAO;KAE5E,OAAO;IACT,CACF;IAEA,OAAO;IAEP,OAAO,WAAW,QAAQ,YAAY,OAAO;GAC/C;GAEA,MAAM,UAAU,OAAO,MAAM;GAE7B,OAAO;GAEP,OAAO,QAAQ,UAAU,YAAY,YAAY,OAAO;EAC1D,CAAC,CACH;CACF,CAAC;CA2fH,OAAO;EAxfL,UAAU,YAAY,YACpB,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,gBAAgB,UAAU;GAE/C,IACG,MAAM,WAAW,sBACf,MAAM,UAAU,KAAA,KAAa,MAAM,eAAe,KAAA,MACpD,MAAM,WAAW,oBAAoB,cAAc,UAAU,KAAA,KAC9D,MAAM,eAAe,MAAM,OAAO,cAClC,MAAM,OAAO,kBACX,KAAK,IACH,MAAM,OAAO,4BAA4B,MAAM,OAAO,gBACtD,MAAM,OAAO,UAAU,OAAO,cAC9B,MAAM,OAAO,UAAU,WAAW,cAClC,MAAM,OAAO,UAAU,QAAQ,YACjC,KACD,MAAM,aAAa,qBAAqB,eACvC,EAAE,wBAAwB,4BAE5B,OAAO,OAAO,YAAY;GAE5B,OAAO,OAAO,MACZ,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IAEvB,OAAO,WAAW,SAAS,eAAe,MAAM,QAAQ;IAExD,MAAM,UAAU,wBAAwB,KACtC,OAAOA,kBAAO,SACZ,cAAc,MACd,QAAQ,iBACR,QAAQ,mBACV,CACF;IAEA,MAAM,YAAY,OAAO,iBAAiB,SAAS,eAAe,KAAK;IAEvE,IAAI,cAAc,KAAA,GAAW,OAAO,OAAO,YAAY;IACvD,IAAI,MAAM,UAAU,KAAA,GAEhB;SAAA,MAAM,eAAe,KAAA,KACrB,MAAM,WAAW,aAAa,GAAG,MAAM,SAAS,WAChD,MAAM,WAAW,YAAY,oBAC7B,MAAM,MAAM,mBAAmB,MAAM,WAAW,kBAChD,YAAY,MAAM,MAAM,OAAO,MAAM,YAAY,MAAM,WAAW,OAAO,KACzE,MAAM,MAAM,QAAQ,SAAS,aAC7B,CAAC,aAAa,MAAM,MAAM,QAAQ,UAAU,UAAU,QAAQ,KAC9D,UAAU,UAAU,+BAA+B,KAAA,KACnD,EAAE,OAAO,uBACP,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MAAM,UACR,IAEA,OAAO,OAAO,YAAY;IAAA;IAE9B,KACG,OAAO,WACN,SACA,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,WAAW,MAAM,SAAS,CAAC,GACpE,cAAc,OAChB,EAAA,CAAG,QAEH,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,OAAO;IAE9C,MAAM,MAAM,OAAO,WACjB,YAAY,EAAE,cAAc,GAAG;IAEjC,MAAM,QAAQ,gBAAgB;KAC5B,GAAI,UAAU,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY,UAAU,SAAS;KAC7E,UAAU,UAAU;IACtB,CAAC;IAuBD,MApBG,OAAO,KACN,YACG,OAAO,EAAE,OAAO,MAAM,EAAE,CAAC,CAAC,CAC1B,KAAK,EAAE,KAAK,CAAC,CACb,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,WAAW,UAAU,eAAe,GACzC,GACE,IACE,GAAG,EAAE,OAAO,EAAE,OAAO,SAAS,GAC9B,GAAG,EAAE,sBAAsB,SAAS,CACtC,GACA,IAAI,GAAG,EAAE,OAAO,EAAE,OAAO,KAAK,GAAG,GAAG,EAAE,WAAW,SAAS,CAAC,CAC7D,CACF,CACF,GACF,KACF,EAAA,CAAG,EAAE,EAAE,SAAS,MAEJ,MAAM,OAAO,0BAA0B,OAAO,OAAO,YAAY;IAC/E,KAAK,MAAM,CAAC,WAAW,WAAW;KAChC,CAAC,GAAG,EAAE,QAAQ,MAAM,MAAM,GAAG,MAAM,OAAO,UAAU,MAAM;KAC1D,CAAC,GAAG,EAAE,iBAAiB,KAAK,GAAG,MAAM,OAAO,UAAU,UAAU;KAChE,CAAC,GAAG,EAAE,WAAW,UAAU,eAAe,GAAG,MAAM,OAAO,UAAU,OAAO;IAC7E,GAgBE,MAdG,OAAO,KACN,YACG,OAAO,EAAE,OAAO,MAAM,EAAE,CAAC,CAAC,CAC1B,KAAK,EAAE,KAAK,CAAC,CACb,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,WACA,GAAG,EAAE,YAAY,EAAE,cAAc,MAAM,OAAO,YAAY,CAAC,CAC7D,CACF,GACF,KACF,EAAA,CAAG,EAAE,EAAE,SAAS,MAEL,OAAO,OAAO,OAAO,OAAO,YAAY;IAGvD,MAAM,cAAc,OAAO,oCAAoC;KAC7D,MAAM;KACN,UAAU,MAAM;KAChB,YAAY,MAAM;KAClB,UAAU,MAAM;KAChB;KACA,WAAW,MAAM;KACjB,QAAQ,MAAM;KACd,UAAU,UAAU;KACpB,GAAI,UAAU,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY,UAAU,SAAS;KAC7E,qBAAqB,UAAU;KAC/B,GAAI,MAAM,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;KAC1D,cAAc,MAAM;KACpB,iBAAiB;KACjB,4BAA4B,MAAM,MAAM,OAAO;KAC/C,mBAAmB,MAAM,MAAM,OAAO;IACxC,CAAC;IAED,MAAM,WAAW,OAAO,kBAAkB,WAAW;IAErD,OAAO,YAAY,OAAO,EAAE,KAAK,CAAC,CAAC,OACjC,EAAE,aAAa;KACb;KACA,iBAAiB,UAAU;KAC3B,iBAAiB;KACjB;KACA,kBAAkB;KAClB,4BACE,MACA,KAAK,IACH,MAAM,OAAO,UAAU,OAAO,cAC9B,MAAM,OAAO,UAAU,WAAW,cAClC,MAAM,OAAO,UAAU,QAAQ,YACjC;IACJ,CAAC,CACH;IAEA,MAAM,OAAO,OAAO,WAClB,SACA,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,UAAU,MAAM,QAAQ,CAAC,GAClE,KACF;IAEA,IACE,KAAK,WAAW,KAChB,EAAE,OAAO,cACP,SACA,KAAK,IACL,aACA,UAAU,iBACV,QACF,IAEA,OAAO,OAAO,YAAY;IAE5B,MAAM,gBACJ,MACA,KAAK,IACH,MAAM,OAAO,UAAU,OAAO,cAC9B,MAAM,OAAO,UAAU,WAAW,cAClC,MAAM,OAAO,UAAU,QAAQ,YACjC;IAEF,KACG,OAAO,EAAE,cAAc,KAAK,EAAE,CAAC,EAAE,WAAW,OAAO,QACnD,OAAO,EAAE,cAAc,KAAK,EAAE,CAAC,EAAE,qBAAqB,OAAO,kBAC7D,OAAO,cAAc,YAAY,8BACjC,MAAM,eAAe,KAAA,KACpB,EAAE,OAAO,uBACP,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MAAM,UACR,IAEF,OAAO,OAAO,YAAY;IAE5B,OAAO,QAAQ;KAAE,MAAM;KAAY;IAAY,GAAG,OAAO;GAC3D,CAAC,CACH;EACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,eAAe,YAAY,YACzB,OAAO,IAAI,aAAa;GACtB,MAAM,cAAc,OAAO,oCAAoC,WAAW,WAAW,GACnF,QAAQ,OAAO,8BAA8B,WAAW,KAAK;GAE/D,MAAM,WAAW,OAAO,kBAAkB,WAAW,GACnD,gBAAgB,OAAO,4BAA4B,KAAK;GAE1D,KAAK,OAAO,kBAAkB,cAAc,KAAK,CAAC,OAAO,UACvD,OAAO,OAAO,YAAY;GAE5B,OAAO,OAAO,MACZ,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IAEvB,OAAO,WAAW,SAAS,eAAe,YAAY,QAAQ;IAC9D,MAAM,YAAY,OAAO,iBAAiB,SAAS,eAAe,WAAW;IAE7E,IAAI,cAAc,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;IAE/D,MAAM,OAAO,OAAO,WAChB,SACA,IAAI,GAAG,EAAE,UAAU,YAAY,QAAQ,GAAG,GAAG,EAAE,UAAU,YAAY,QAAQ,CAAC,GAC9E,cAAc,OAChB,GACA,MAAM,KAAK;IAEb,MAAM,MAAM,OAAO;IAEnB,IACE,KAAK,WAAW,KAChB,EAAE,OAAO,cACP,SACA,KACA,aACA,UAAU,iBACV,QACF,MACA,MAAM,MAAM,kBACZ,OAAO,YAAY,8BACnB,OAAO,MAAM,iBAEb,OAAO,QAAQ,YAAY,OAAO;IACpC,OAAO,YACJ,OAAO,EAAE,KAAK,CAAC,CACf,IAAI,EAAE,YAAY;KAAE;KAAO,UAAU;IAAc,CAAC,CAAC,CAAC,CACtD,MAAM,aAAa,SAAS,GAAG,CAAC;IAEnC,MAAM,QAAQ,OAAO,WACnB,SACA,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,UAAU,MAAM,QAAQ,CAAC,GAClE,KACF;IAEA,IACE,MAAM,WAAW,KACjB,EAAE,OAAO,cACP,SACA,MAAM,IACN,OACA,UAAU,iBACV,aACF,OACC,OAAO,WACN,SACA,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,YAAY,IAAI,EAAE,WAAW,GAClC,GAAG,EAAE,sBAAsB,IAAI,EAAE,qBAAqB,CACxD,GACA,KACF,EAAA,CAAG,WAAW,GAEd,OAAO,OAAO,YAAY;IAC5B,KACG,OAAO,cAAc,YAAY,+BACjC,OAAO,cAAc,MAAM,iBAE5B,OAAO,OAAO,YAAY;IAE5B,OAAO,QAAQ,aAAa,OAAO;GACrC,CAAC,CACH;EACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,UAAU,eACR,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,OAAO,aAAa,YAAY,CAAC,CAAC,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,KACxE,OAAO,SAAS,WAAW,CAC7B;GA0DA,QAAO,OAxDeA,kBAAO,SAC3B,UACA,eACA,OAAO,IAAI,aAAa;IACtB,IACE,CAAC,MAAM,OAAO,KACd,EAAE,OAAO,WAAW,SAAS,eAAe,MAAM,UAAU,KAAK,IAEjE,OAAO,KAAA;IAET,MAAM,OAAO,OAAO,WAClB,SACA,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,YAAY,MAAM,UAAU,GACjC,GAAG,EAAE,QAAQ,MAAM,MAAM,GACzB,GAAG,EAAE,OAAO,EAAE,OAAO,KAAK,CAC5B,GACA,KACF;IAEA,IAAI,KAAK,WAAW,GAAG,OAAO,KAAA;IAC9B,MAAM,WAAW,OAAO,4BAA4B,KAAK,EAAE,CAAC,EAAE,SAAS;IACvE,MAAM,YAAY,OAAO,iBAAiB,SAAS,eAAe,QAAQ;IAE1E,IAAI,cAAc,KAAA,GAAW,OAAO,KAAA;IAEpC,MAAM,SAAS,OAAO,WACpB,SACA,aAAa,SAAS,KAAK,EAAE,GAC7B,cAAc,OAChB;IAEA,MAAM,MAAM,OAAO;IAEnB,IACE,OAAO,WAAW,KAClB,MAAM,SAAS,kBACf,OAAO,SAAS,mBAChB,SAAS,aAAa,MAAM,YAC5B,SAAS,eAAe,MAAM,cAC9B,SAAS,WAAW,MAAM,UAC1B,EAAE,OAAO,cACP,SACA,OAAO,IACP,UACA,UAAU,iBACV,OAAO,4BAA4B,QAAQ,CAC7C,IAEA,OAAO,KAAA;IAET,OAAO;KAAE,QAAQ;KAAU,oBAAoB,UAAU;IAAY;GACvE,CAAC,CACH,OAEkB,OAAO,iBAAiB,KAAK,CAAC,CAAC;EACnD,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,uBACF;EACF,WAAW,OAAO,YAChB,SAAS,OAAO,OAAO,CAAC,CAAC,KACvB,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,iBAAiB,OAAO,YACtB,SAAS,OAAO,OAAO,CAAC,CAAC,KACvB,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,SAAS,YAAY,YACnB,OAAO,IAAI,aAAa;GACtB,MAAM,SAAS,OAAO,8BAA8B,WAAW,MAAM,GACnE,WAAW,OAAO,4BAA4B,MAAM;GAEtD,OAAO,OAAO,MACZ,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO;IAEvB,OAAO,WAAW,SAAS,eAAe,OAAO,QAAQ;IACzD,MAAM,YAAY,OAAO,iBAAiB,SAAS,eAAe,MAAM;IAExE,IAAI,cAAc,KAAA,GAAW,OAAO,QAAQ,OAAO,OAAO;IAE1D,MAAM,OAAO,OAAO,WAClB,SACA,IAAI,GAAG,EAAE,UAAU,OAAO,QAAQ,GAAG,GAAG,EAAE,UAAU,OAAO,QAAQ,CAAC,GACpE,cAAc,OAChB;IAEA,MAAM,MAAM,OAAO;IAEnB,IACE,KAAK,WAAW,KAChB,MAAM,OAAO,kBACb,OAAO,OAAO,mBACd,EAAE,OAAO,cACP,SACA,KAAK,IACL,QACA,UAAU,iBACV,QACF,IAEA,OAAO,QAAQ,OAAO,OAAO;IAC/B,OAAO,SAAS,SAAS,KAAK,IAAI,WAAW;IAE7C,OAAO,QAAQ,MAAM,OAAO;GAC9B,CAAC,CACH;EACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,UAAU,YAAY,YACpB,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,GAAG,WAAW;GAE9B,IAAI,CAAC,OAAO,cAAc,MAAM,KAAK,KAAK,MAAM,QAAQ,KAAK,MAAM,QAAQ,KACzE,OAAO,OAAO,YAAY;GAE5B,OAAO,OAAO,MACZ,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IAEvB,IAAI,EAAE,OAAO,WAAW,SAAS,eAAe,MAAM,UAAU,KAAK,IACnE,OAAO,QAAQ;KAAE,SAAS;KAAG,SAAS;IAAM,GAAG,OAAO;IACxD,MAAM,MAAM,EAAE,cAAc,OAAO,SAAS;IAE5C,MAAM,MAAM,IACV,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GACE,IAAI,IAAI,EAAE,aAAa,GAAG,GAAG,IAAI,EAAE,sBAAsB,GAAG,CAAC,GAC7D,IACE,UAAU,EAAE,QAAQ,GACpB,GACE,IAAI,GAAG,EAAE,OAAO,EAAE,OAAO,SAAS,GAAG,IAAI,EAAE,sBAAsB,GAAG,CAAC,GACrE,IAAI,GAAG,EAAE,OAAO,EAAE,OAAO,KAAK,GAAG,IAAI,EAAE,WAAW,GAAG,CAAC,CACxD,CACF,CACF,CACF;IAEA,MAAM,OAAO,OAAO,KAClB,YACG,OAAO,CAAC,CACR,KAAK,EAAE,KAAK,CAAC,CACb,MAAM,GAAG,CAAC,CACV,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,CAChC,MAAM,MAAM,QAAQ,CAAC,GACxB,cAAc,OAChB;IAEA,IAAI,UAAU;IAEd,KAAK,MAAM,OAAO,KAAK,MAAM,GAAG,MAAM,KAAK,GAYzC,KAVG,OAAO,WACN,SACA,IACE,aAAa,SAAS,GAAG,GACzB,IAAI,EAAE,aAAa,GAAG,GACtB,IAAI,EAAE,sBAAsB,GAAG,CACjC,GACA,KACF,EAAA,CAAG,WAAW,GAEH;KACX,OAAO,YAAY,OAAO,EAAE,KAAK,CAAC,CAAC,MAAM,aAAa,SAAS,GAAG,CAAC;KACnE,KACG,OAAO,WACN,SACA,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,UAAU,IAAI,EAAE,SAAS,CAAC,GACnE,KACF,EAAA,CAAG,QAEH,OAAO,OAAO,YAAY;KAC5B;IACF,OAAO,OAAO,SAAS,SAAS,KAAK,SAAS;IAGhD,OAAO,QACL;KACE;KACA,UACG,OAAO,KAAK,YAAY,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,EAAA,CACvE,SAAS;IAChB,GACA,OACF;GACF,CAAC,CACH;EACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;CAGU;AAChB,CACF;AAEA,MAAa,4BAA4B;CACvC;CACA;CACA;CACA;CACA;CACA;CACA;AACF"}

package/package.json

@@ -1 +1 @@
-{"name":"@yielded/auth-persistence-drizzle","version":"0.1.0-beta.16","dependencies":{"@noble/hashes":"2.3.0","@yielded/auth":"0.1.0-beta.16","@yielded/auth-crypto":"0.1.0-beta.16","@yielded/auth-persistence":"0.1.0-beta.16"},"devDependencies":{"@effect/platform-bun":"4.0.0","@effect/platform-node":"4.0.0","@effect/sql-d1":"4.0.0","@effect/sql-libsql":"4.0.0","@effect/sql-mysql2":"4.0.0","@effect/sql-pg":"4.0.0","@effect/sql-pglite":"4.0.0","@effect/sql-sqlite-bun":"4.0.0","@effect/sql-sqlite-do":"4.0.0","@effect/sql-sqlite-node":"4.0.0","@effect/sql-sqlite-wasm":"4.0.0","@effect/vitest":"4.0.0","drizzle-orm":"1.0.0-rc.4","effect":"4.0.0","typescript":"7.0.2","vite-plus":"0.3.3"},"peerDependencies":{"@effect/sql-d1":">=4.0.0","@effect/sql-libsql":">=4.0.0","@effect/sql-mysql2":">=4.0.0","@effect/sql-pg":">=4.0.0","@effect/sql-pglite":">=4.0.0","@effect/sql-sqlite-bun":">=4.0.0","@effect/sql-sqlite-do":">=4.0.0","@effect/sql-sqlite-node":">=4.0.0","@effect/sql-sqlite-wasm":">=4.0.0","drizzle-orm":">=1.0.0-rc.4","effect":"^4.0.0"},"exports":{".":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"./D1":{"types":"./dist/D1.d.mts","default":"./dist/D1.mjs"},"./Libsql":{"types":"./dist/Libsql.d.mts","default":"./dist/Libsql.mjs"},"./Mysql2":{"types":"./dist/Mysql2.d.mts","default":"./dist/Mysql2.mjs"},"./Pglite":{"types":"./dist/Pglite.d.mts","default":"./dist/Pglite.mjs"},"./Postgres":{"types":"./dist/Postgres.d.mts","default":"./dist/Postgres.mjs"},"./SqliteBun":{"types":"./dist/SqliteBun.d.mts","default":"./dist/SqliteBun.mjs"},"./SqliteDo":{"types":"./dist/SqliteDo.d.mts","default":"./dist/SqliteDo.mjs"},"./SqliteNode":{"types":"./dist/SqliteNode.d.mts","default":"./dist/SqliteNode.mjs"},"./SqliteWasm":{"types":"./dist/SqliteWasm.d.mts","default":"./dist/SqliteWasm.mjs"}},"description":"Drizzle persistence, table mappings, and migration adapters for Yielded Auth.","homepage":"https://yielded.dev/auth/","bugs":{"url":"https://github.com/yielded-dev/auth/issues"},"license":"MIT","repository":{"type":"git","url":"git+https://github.com/yielded-dev/auth.git","directory":"packages/auth-persistence-drizzle"},"files":["dist","src"],"type":"module","sideEffects":[],"publishConfig":{"access":"public"},"scripts":{"build":"vp pack","check":"tsc --noEmit -p tsconfig.json","test":"vp test --passWithNoTests","example:totp":"bun test/fixtures/totp-sqlite-bun.ts"},"peerDependenciesMeta":{"@effect/sql-d1":{"optional":true},"@effect/sql-libsql":{"optional":true},"@effect/sql-mysql2":{"optional":true},"@effect/sql-pg":{"optional":true},"@effect/sql-pglite":{"optional":true},"@effect/sql-sqlite-bun":{"optional":true},"@effect/sql-sqlite-do":{"optional":true},"@effect/sql-sqlite-node":{"optional":true},"@effect/sql-sqlite-wasm":{"optional":true}}}
+{"name":"@yielded/auth-persistence-drizzle","version":"0.1.0-beta.18","dependencies":{"@noble/hashes":"2.3.0","@yielded/auth":"0.1.0-beta.18","@yielded/auth-crypto":"0.1.0-beta.18","@yielded/auth-persistence":"0.1.0-beta.18"},"devDependencies":{"@effect/platform-bun":"4.0.0","@effect/platform-node":"4.0.0","@effect/sql-d1":"4.0.0","@effect/sql-libsql":"4.0.0","@effect/sql-mysql2":"4.0.0","@effect/sql-pg":"4.0.0","@effect/sql-pglite":"4.0.0","@effect/sql-sqlite-bun":"4.0.0","@effect/sql-sqlite-do":"4.0.0","@effect/sql-sqlite-node":"4.0.0","@effect/sql-sqlite-wasm":"4.0.0","@effect/vitest":"4.0.0","drizzle-orm":"1.0.0-rc.4","effect":"4.0.0","typescript":"7.0.2","vite-plus":"0.3.3"},"peerDependencies":{"@effect/sql-d1":">=4.0.0","@effect/sql-libsql":">=4.0.0","@effect/sql-mysql2":">=4.0.0","@effect/sql-pg":">=4.0.0","@effect/sql-pglite":">=4.0.0","@effect/sql-sqlite-bun":">=4.0.0","@effect/sql-sqlite-do":">=4.0.0","@effect/sql-sqlite-node":">=4.0.0","@effect/sql-sqlite-wasm":">=4.0.0","drizzle-orm":">=1.0.0-rc.4","effect":"^4.0.0"},"exports":{".":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"./D1":{"types":"./dist/D1.d.mts","default":"./dist/D1.mjs"},"./Libsql":{"types":"./dist/Libsql.d.mts","default":"./dist/Libsql.mjs"},"./Mysql2":{"types":"./dist/Mysql2.d.mts","default":"./dist/Mysql2.mjs"},"./Pglite":{"types":"./dist/Pglite.d.mts","default":"./dist/Pglite.mjs"},"./Postgres":{"types":"./dist/Postgres.d.mts","default":"./dist/Postgres.mjs"},"./SqliteBun":{"types":"./dist/SqliteBun.d.mts","default":"./dist/SqliteBun.mjs"},"./SqliteDo":{"types":"./dist/SqliteDo.d.mts","default":"./dist/SqliteDo.mjs"},"./SqliteNode":{"types":"./dist/SqliteNode.d.mts","default":"./dist/SqliteNode.mjs"},"./SqliteWasm":{"types":"./dist/SqliteWasm.d.mts","default":"./dist/SqliteWasm.mjs"}},"description":"Drizzle persistence, table mappings, and migration adapters for Yielded Auth.","homepage":"https://yielded.dev/auth/","bugs":{"url":"https://github.com/yielded-dev/auth/issues"},"license":"MIT","repository":{"type":"git","url":"git+https://github.com/yielded-dev/auth.git","directory":"packages/auth-persistence-drizzle"},"files":["dist","src"],"type":"module","sideEffects":[],"publishConfig":{"access":"public"},"scripts":{"build":"vp pack","check":"tsc --noEmit -p tsconfig.json","test":"vp test --passWithNoTests","example:totp":"bun test/fixtures/totp-sqlite-bun.ts"},"peerDependenciesMeta":{"@effect/sql-d1":{"optional":true},"@effect/sql-libsql":{"optional":true},"@effect/sql-mysql2":{"optional":true},"@effect/sql-pg":{"optional":true},"@effect/sql-pglite":{"optional":true},"@effect/sql-sqlite-bun":{"optional":true},"@effect/sql-sqlite-do":{"optional":true},"@effect/sql-sqlite-node":{"optional":true},"@effect/sql-sqlite-wasm":{"optional":true}}}

package/src/drizzle/d1-password-prepared.ts

@@ -209,9 +209,13 @@ const makePreparedPlans = (mapping: Mapping, proofMapping?: any) => {
                   statements: planned.statements.map((statement) =>
                     compactD1GeneratedStatement(database.$client, statement, unavailable),
                   ),
-                  postconditions: planned.postconditions?.map((statement) =>
-                    compactD1GeneratedStatement(database.$client, statement, unavailable),
-                  ),
+                  ...(planned.postconditions === undefined
+                    ? {}
+                    : {
+                        postconditions: planned.postconditions.map((statement) =>
+                          compactD1GeneratedStatement(database.$client, statement, unavailable),
+                        ),
+                      }),
                 }),
                 catch: (cause) =>
                   Schema.is(PasswordUnavailable)(cause)
@@ -418,7 +422,9 @@ const makePreparedPlans = (mapping: Mapping, proofMapping?: any) => {
                     ))),
               receipt: receipt ?? prepare("rejected", journal),
               statements: compiled.statements,
-              postconditions: compiled.postconditions,
+              ...(compiled.postconditions === undefined
+                ? {}
+                : { postconditions: compiled.postconditions }),
             };
           }
 
@@ -520,7 +526,7 @@ const makePreparedPlans = (mapping: Mapping, proofMapping?: any) => {
 
             const now = yield* kernel.readEngineNowMillis(p),
               scope = identifierScope({
-                credential: authority.snapshot,
+                ...(authority.snapshot === undefined ? {} : { credential: authority.snapshot }),
                 revision: authority.revision,
               });
 

package/src/drizzle/d1-passwords.ts

@@ -1622,7 +1622,7 @@ const makePasswordPlans = (
             return {
               receipt: prepare(compiled === undefined ? "rejected" : "changed", journal),
               statements: compiled?.statements ?? [],
-              retryable: compiled?.retryable,
+              ...(compiled?.retryable === undefined ? {} : { retryable: compiled.retryable }),
             };
           }),
         );

package/src/drizzle/d1-sessions.ts

@@ -341,7 +341,11 @@ function runPlanned<A, E, GuardE extends D1PlanError = never>(
   recoverGuard?: Effect.Effect<never, GuardE, CurrentD1PlanningDatabase>,
 ) {
   const planned = plan.pipe(
-    Effect.map((value) => ({ ...value, isConstraintConflict, recoverGuard })),
+    Effect.map((value) => ({
+      ...value,
+      ...(isConstraintConflict === undefined ? {} : { isConstraintConflict }),
+      ...(recoverGuard === undefined ? {} : { recoverGuard }),
+    })),
   );
 
   const execution = Effect.gen(function* () {
@@ -1498,9 +1502,11 @@ export const makeD1StatefulSessions = <Claims>(
           Schema.encodeEffect(codec)(record).pipe(Effect.flatMap(Schema.decodeEffect(codec))),
         );
 
+        const nextCursor = decoded.length <= input.limit ? undefined : sessions.at(-1)?.sessionId;
+
         return {
           sessions,
-          ...(decoded.length <= input.limit ? {} : { nextCursor: sessions.at(-1)?.sessionId }),
+          ...(nextCursor === undefined ? {} : { nextCursor }),
         };
       }).pipe(terminalD1),
   };

package/src/drizzle/password-prepared-sql.ts

@@ -752,7 +752,7 @@ export const makeSqlPasswordPreparedPersistence = Effect.fn("makeSqlPasswordPrep
                 nativeNow = p.encodeInstant(now);
 
               const scope = identifierScope({
-                credential: authority.snapshot,
+                ...(authority.snapshot === undefined ? {} : { credential: authority.snapshot }),
                 revision: authority.revision,
               });