@yielded/auth-persistence-drizzle 0.1.0-beta.17 → 0.1.0-beta.19

package/dist/drizzle/password-prepared-sql.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"password-prepared-sql.mjs","names":["kernel"],"sources":["../../src/drizzle/password-prepared-sql.ts"],"sourcesContent":["import {\n  type NativeDatabase,\n  CurrentPasswordPreparedTransaction,\n  PasswordPreparedPostconditions,\n  PasswordPreparedJournalGuards,\n} from \"@yielded/auth-persistence/Adapter\";\nimport { CurrentCommitJournal, LifecycleHooks, HookConfigurationError } from \"@yielded/auth/Hooks\";\nimport {\n  PasswordUnavailable,\n  PasswordRejected,\n  PasswordPreparedVersion,\n  decodePasswordPreparedReady,\n  encodePasswordPreparedReady,\n  snapshotPasswordPreparedReady,\n  snapshotPasswordPreparedReservation,\n  type PasswordPreparedReady,\n  type PasswordPreparedReservation,\n  snapshotPasswordCredential,\n  snapshotPasswordRequirement,\n  type PasswordMutationDecision,\n  type PreparePasswordCommit,\n  type PasswordPreparedPersistence,\n  type PasswordPreparedMutation,\n} from \"@yielded/auth/Password\";\nimport { reportPersistenceFailure } from \"@yielded/auth/Persistence\";\nimport { type ProofCompletionPlan, ProofUnavailable, ProofBinding } from \"@yielded/auth/Proofs\";\nimport { AuthenticationRevision } from \"@yielded/auth/Sessions\";\n/* oxlint-disable no-explicit-any -- concrete driver makers retain consumer table types. */\nimport { and, count, eq, gt, isNotNull, isNull, lte, or, type SQL } from \"drizzle-orm\";\nimport { Cause, DateTime, Effect, Option, Predicate, Redacted, Schema } from \"effect\";\n\nimport { column } from \"./model\";\nimport {\n  requiredPasswordPreparedConstraints,\n  type AnyPasswordPreparedPersistenceMapping,\n  type PasswordPreparedState,\n} from \"./password-prepared-model\";\nimport {\n  ContextInput,\n  CompletionInput,\n  encodeReservation,\n  evidenceCurrent,\n  identifierScope,\n  reservationOf,\n  sameRevision,\n  snapshotMutation,\n  snapshotReserve,\n  unavailable,\n} from \"./password-prepared-state\";\nimport {\n  CurrentPasswordSql,\n  passwordSqlKernel as kernel,\n  type PasswordSqlConfiguration,\n  type PasswordSqlQuery,\n} from \"./password-sql\";\nimport { checkProofCompletionIn, completeProofPlanIn } from \"./proof-sql\";\nimport { validateDrizzleStorage } from \"./storage-validation\";\n\nconst translateFailure = <A, E, R>(\n  effect: Effect.Effect<A, E, R>,\n): Effect.Effect<A, PasswordUnavailable, R> =>\n  reportPersistenceFailure(\n    effect,\n    (error) =>\n      Schema.is(PasswordUnavailable)(error) ||\n      Schema.is(ProofUnavailable)(error) ||\n      Schema.is(HookConfigurationError)(error),\n  ).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));\n\nconst translateContextFailure = <A, E, R>(\n  effect: Effect.Effect<A, E, R>,\n): Effect.Effect<A, PasswordUnavailable | PasswordRejected, R> =>\n  reportPersistenceFailure(\n    effect,\n    (error) =>\n      Schema.is(PasswordUnavailable)(error) ||\n      Schema.is(PasswordRejected)(error) ||\n      Schema.is(ProofUnavailable)(error) ||\n      Schema.is(HookConfigurationError)(error),\n  ).pipe(\n    Effect.catchCause((cause) =>\n      Effect.failCause(\n        Cause.map(cause, (error) => (Schema.is(PasswordRejected)(error) ? error : unavailable())),\n      ),\n    ),\n  );\n\ntype Mapping = AnyPasswordPreparedPersistenceMapping;\nconst nowMillis = DateTime.now.pipe(Effect.map(DateTime.toEpochMillis));\n\nconst read = (query: PasswordSqlQuery, locking: boolean) =>\n  locking && typeof query.for === \"function\" ? query.for(\"update\") : query;\n\nconst columns = (mapping: Mapping) => {\n  const table = mapping.intent;\n\n  return {\n    moduleId: column(table.table, table.moduleId),\n    intentId: column(table.table, table.intentId),\n    commandId: column(table.table, table.commandId),\n    subjectId: column(table.table, table.subjectId),\n    action: column(table.table, table.action),\n    generation: column(table.table, table.generation),\n    version: column(table.table, table.version),\n    state: column(table.table, table.state),\n    digest: column(table.table, table.digest),\n    snapshot: column(table.table, table.snapshot),\n    identifierScope: column(table.table, table.identifierScope),\n    createdAt: column(table.table, table.createdAt),\n    admittedAt: column(table.table, table.admittedAt),\n    admissionRetainUntil: column(table.table, table.admissionRetainUntil),\n    preparationExpiresAt: column(table.table, table.preparationExpiresAt),\n    expiresAt: column(table.table, table.expiresAt),\n    retainUntil: column(table.table, table.retainUntil),\n  };\n};\n\nconst valid = (mapping: Mapping) =>\n  Object.entries(requiredPasswordPreparedConstraints).every(\n    ([key, value]) =>\n      mapping.constraints[key as keyof typeof requiredPasswordPreparedConstraints] === value,\n  );\n\nconst lockAnchor = Effect.fn(\"DrizzlePasswordPrepared.lockAnchor\")(function* (\n  mapping: Mapping,\n  configuration: PasswordSqlConfiguration,\n  moduleId: string,\n  create = true,\n) {\n  const database = yield* CurrentPasswordSql;\n\n  const a = mapping.admission,\n    key = column(a.table, a.moduleId);\n\n  if (create)\n    yield* configuration.insertIfAbsent(\n      database.insert(a.table).values(a.encodeInsert(moduleId)),\n      a.moduleId,\n      moduleId,\n    );\n\n  const rows = yield* read(\n    database.select().from(a.table).where(eq(key, moduleId)).limit(2),\n    configuration.locking,\n  );\n\n  if (rows.length > 1 || (create && rows.length !== 1)) return yield* unavailable();\n\n  return rows.length === 1;\n});\n\nconst bindingJson = Schema.encodeSync(Schema.fromJsonString(ProofBinding));\n\nconst captureAuthority = Effect.fn(\"DrizzlePasswordPrepared.captureAuthority\")(function* (\n  mapping: Mapping,\n  configuration: Pick<PasswordSqlConfiguration, \"locking\">,\n  input: {\n    readonly moduleId: string;\n    readonly action: PasswordPreparedReservation[\"action\"];\n    readonly subjectId: string;\n    readonly reset?: PasswordPreparedReservation[\"reset\"];\n  },\n) {\n  const database = yield* CurrentPasswordSql;\n\n  const p = mapping.password;\n  const locked = yield* kernel.lockSubject(p, input.subjectId, configuration.locking);\n\n  if (locked.row === undefined || !p.subject.isActiveStatus(locked.row[p.subject.status]))\n    return undefined;\n\n  const ic = kernel.identifierColumns(p),\n    ac = kernel.authorityCredentialColumns(p);\n\n  let identifier: any;\n\n  if (input.action !== \"add-password\") {\n    if (input.reset !== undefined)\n      identifier = (yield* kernel.lockIdentifier(\n        p,\n        input.reset.binding.identifier,\n        configuration.locking,\n      ))[0];\n    else {\n      const discovered = (yield* read(\n        database\n          .select()\n          .from(p.identifier.table)\n          .where(eq(ic.subjectId, locked.nativeSubjectId))\n          .orderBy(ic.namespace, ic.value),\n        false,\n      )).find((row: any) => p.identifier.isCurrent(row));\n\n      if (discovered !== undefined)\n        identifier = (yield* kernel.lockIdentifier(\n          p,\n          {\n            namespace: discovered[p.identifier.namespace],\n            value: discovered[p.identifier.value],\n          } as any,\n          configuration.locking,\n        ))[0];\n    }\n    if (\n      identifier === undefined ||\n      !p.identifier.isCurrent(identifier) ||\n      !p.subjectId.equals(identifier[p.identifier.subjectId], locked.nativeSubjectId)\n    )\n      return undefined;\n  }\n\n  const credential = (yield* kernel.readPasswordCredential(\n    p,\n    input.moduleId,\n    locked.nativeSubjectId,\n    configuration.locking,\n  ))[0];\n\n  if ((input.action === \"add-password\") !== (credential === undefined)) return undefined;\n\n  const snapshot =\n    credential === undefined\n      ? undefined\n      : yield* p.credential\n          .decode({ moduleId: input.moduleId, subject: locked.row, identifier, credential })\n          .pipe(Effect.flatMap(snapshotPasswordCredential));\n\n  if (\n    snapshot !== undefined &&\n    (snapshot.moduleId !== input.moduleId ||\n      snapshot.revision.subjectId !== input.subjectId ||\n      snapshot.revision.securityRevision !== locked.row[p.subject.securityRevision] ||\n      snapshot.credentialId !== credential[p.credential.credentialId] ||\n      snapshot.credentialRevision !== credential[p.credential.credentialRevision] ||\n      snapshot.verifierVersion !== credential[p.credential.verifierVersion] ||\n      Redacted.value(snapshot.verifier) !== credential[p.credential.verifier] ||\n      snapshot.normalization !== credential[p.credential.normalization] ||\n      snapshot.identifier.namespace !== identifier[p.identifier.namespace] ||\n      snapshot.identifier.value !== identifier[p.identifier.value] ||\n      snapshot.identifierBindingRevision !== identifier[p.identifier.bindingRevision])\n  )\n    return undefined;\n\n  const factors = yield* read(\n    database\n      .select()\n      .from(p.authorityCredential.table)\n      .where(eq(ac.subjectId, locked.nativeSubjectId))\n      .orderBy(ac.credentialId),\n    configuration.locking,\n  );\n\n  const active = factors.filter(\n    (row: any) =>\n      p.authorityCredential.status === undefined ||\n      p.authorityCredential.isActiveStatus?.(row[p.authorityCredential.status]) === true,\n  );\n\n  if (active.length > 64) return yield* unavailable();\n\n  const revision =\n    snapshot?.revision ??\n    AuthenticationRevision.make({\n      subjectId: input.subjectId as any,\n      securityRevision: locked.row[p.subject.securityRevision],\n      credentials: active.map((row: any) => ({\n        credentialId: row[p.authorityCredential.credentialId],\n        revision: row[p.authorityCredential.revision],\n      })),\n    });\n\n  if (\n    revision.credentials.some(\n      (expected) =>\n        !active.some(\n          (row: any) =>\n            row[p.authorityCredential.credentialId] === expected.credentialId &&\n            row[p.authorityCredential.revision] === expected.revision,\n        ),\n    )\n  )\n    return undefined;\n\n  const requirement = yield* p.subject\n    .decodeActionRequirement(locked.row, input.action)\n    .pipe(Effect.flatMap(snapshotPasswordRequirement));\n\n  return { ...locked, identifier, snapshot, revision, requirement };\n});\n\nconst currentAuthority = Effect.fn(\"DrizzlePasswordPrepared.currentAuthority\")(function* (\n  mapping: Mapping,\n  configuration: Pick<PasswordSqlConfiguration, \"locking\">,\n  record: PasswordPreparedReservation | PasswordPreparedReady,\n) {\n  const current = yield* captureAuthority(mapping, configuration, {\n    moduleId: record.moduleId,\n    action: record.action,\n    subjectId: record.revision.subjectId,\n    ...(record.reset === undefined ? {} : { reset: record.reset }),\n  });\n\n  if (\n    current === undefined ||\n    !sameRevision(current.revision, record.revision) ||\n    (current.snapshot === undefined\n      ? record.credential !== undefined\n      : record.credential === undefined ||\n        !kernel.sameCredentialSnapshot(current.snapshot, record.credential))\n  )\n    return undefined;\n\n  return current;\n});\n\nconst rowCondition = (mapping: Mapping, row: any) => {\n  const c = columns(mapping);\n\n  return and(\n    ...Object.entries(c).map(([key, value]) => {\n      const field = mapping.intent[key as keyof typeof c],\n        item = row[field];\n\n      return Predicate.isNullish(item) ? isNull(value) : eq(value, item);\n    }),\n  )!;\n};\n\nconst readIntent = Effect.fn(\"Drizzle.readIntent\")(function* (\n  mapping: Mapping,\n  condition: SQL,\n  locking: boolean,\n) {\n  const database = yield* CurrentPasswordSql;\n\n  return yield* read(\n    database.select().from(mapping.intent.table).where(condition).limit(2),\n    locking,\n  );\n});\n\nconst recordMatches = Effect.fn(\"DrizzlePasswordPrepared.recordMatches\")(function* (\n  mapping: Mapping,\n  row: any,\n  record: PasswordPreparedReservation | PasswordPreparedReady,\n  nativeSubjectId: unknown,\n  snapshot: string,\n) {\n  const t = mapping.intent,\n    p = mapping.password;\n\n  if (\n    row === undefined ||\n    row[t.moduleId] !== record.moduleId ||\n    row[t.intentId] !== record.intentId ||\n    row[t.commandId] !== record.commandId ||\n    !p.subjectId.equals(row[t.subjectId], nativeSubjectId) ||\n    row[t.action] !== record.action ||\n    row[t.generation] !== record.generation ||\n    row[t.version] !== record.version ||\n    row[t.state] !== t.states[record._tag] ||\n    row[t.snapshot] !== snapshot ||\n    row[t.identifierScope] !== identifierScope(record) ||\n    (record._tag === \"Ready\"\n      ? row[t.digest] !== record.digest\n      : !Predicate.isNullish(row[t.digest]))\n  )\n    return false;\n  for (const [key, instant] of [\n    [t.createdAt, record.createdAtMillis],\n    [t.preparationExpiresAt, record.preparationExpiresAtMillis],\n    [t.retainUntil, record.retainUntilMillis],\n  ] as const)\n    if ((yield* p.decodeInstant(row[key])) !== instant) return false;\n\n  return record._tag === \"Ready\"\n    ? (yield* p.decodeInstant(row[t.expiresAt])) === record.expiresAtMillis\n    : Predicate.isNullish(row[t.expiresAt]);\n});\n\nconst terminal = Effect.fn(\"DrizzlePasswordPrepared.terminal\")(function* (\n  mapping: Mapping,\n  row: any,\n  state: Exclude<PasswordPreparedState, \"Preparing\" | \"Ready\">,\n) {\n  const database = yield* CurrentPasswordSql;\n\n  yield* database\n    .update(mapping.intent.table)\n    .set(mapping.intent.encodeTerminal(state))\n    .where(rowCondition(mapping, row));\n\n  const c = columns(mapping),\n    t = mapping.intent;\n\n  const rows = yield* readIntent(\n    mapping,\n    and(eq(c.moduleId, row[t.moduleId]), eq(c.intentId, row[t.intentId]))!,\n    false,\n  );\n\n  const expected = { ...row, [t.state]: t.states[state], [t.snapshot]: null, [t.digest]: null };\n\n  if (\n    rows.length !== 1 ||\n    (yield* readIntent(mapping, rowCondition(mapping, expected), false)).length !== 1\n  )\n    return yield* unavailable();\n});\n\nexport const makeSqlPasswordPreparedPersistence = Effect.fn(\"makeSqlPasswordPreparedPersistence\")(\n  function* (\n    mapping: Mapping,\n    configuration: PasswordSqlConfiguration,\n  ): Effect.fn.Return<\n    PasswordPreparedPersistence,\n    PasswordUnavailable,\n    LifecycleHooks | CurrentPasswordSql | NativeDatabase\n  > {\n    const database = yield* CurrentPasswordSql;\n\n    if (!configuration.coordinated)\n      yield* validateDrizzleStorage({\n        ...mapping,\n        proof: configuration.proof?.mapping,\n      }).pipe(Effect.mapError(unavailable));\n    const hooks = yield* LifecycleHooks;\n\n    const p = mapping.password,\n      c = columns(mapping),\n      t = mapping.intent;\n\n    const owned = <A, E, R>(body: Effect.Effect<A, E, R>) =>\n      valid(mapping)\n        ? kernel.owned(\n            database,\n            p,\n            configuration,\n            Effect.gen(function* () {\n              const journal = yield* CurrentCommitJournal;\n              const guards = yield* Effect.serviceOption(PasswordPreparedJournalGuards);\n\n              if (Option.isSome(guards) && !guards.value.register(journal.prepare(undefined)))\n                return yield* unavailable();\n\n              return yield* body;\n            }),\n          )\n        : Effect.fail(unavailable());\n\n    const complete = <A>(\n      uncaptured: PasswordPreparedMutation & { readonly completion?: ProofCompletionPlan },\n      prepare: PreparePasswordCommit<PasswordMutationDecision, A>,\n    ) =>\n      Effect.gen(function* () {\n        const input = yield* snapshotMutation(uncaptured);\n\n        const completion =\n          uncaptured.completion === undefined\n            ? undefined\n            : {\n                prepare: uncaptured.completion.prepare,\n                input: yield* Schema.encodeEffect(Schema.fromJsonString(CompletionInput))(\n                  uncaptured.completion.input,\n                ).pipe(\n                  Effect.flatMap(Schema.decodeEffect(Schema.fromJsonString(CompletionInput))),\n                  Effect.mapError(unavailable),\n                ),\n              };\n\n        if (\n          (input.intent.action === \"reset-password\") !== (completion !== undefined) ||\n          (completion !== undefined && configuration.proof === undefined)\n        )\n          return yield* unavailable();\n\n        return yield* owned(\n          Effect.gen(function* () {\n            const transaction = yield* CurrentPasswordSql;\n            const journal = yield* CurrentCommitJournal;\n\n            yield* lockAnchor(mapping, configuration, input.intent.moduleId);\n\n            const authority = yield* kernel.validateMutationAuthority(\n              p,\n              configuration,\n              input.mutation,\n              input.intent.action,\n            );\n\n            if (authority === undefined) return prepare(\"rejected\", journal);\n            const current = yield* currentAuthority(mapping, configuration, input.intent);\n\n            if (current === undefined) return prepare(\"rejected\", journal);\n\n            const rows = yield* readIntent(\n              mapping,\n              and(eq(c.moduleId, input.intent.moduleId), eq(c.intentId, input.intent.intentId))!,\n              configuration.locking,\n            );\n\n            const row = rows[0],\n              encoded = yield* encodePasswordPreparedReady(input.intent);\n\n            if (\n              rows.length !== 1 ||\n              !(yield* recordMatches(\n                mapping,\n                row,\n                input.intent,\n                current.nativeSubjectId,\n                encoded,\n              )) ||\n              !evidenceCurrent(input, current.requirement, yield* nowMillis) ||\n              (yield* kernel.commandExists(\n                p,\n                input.intent.moduleId,\n                input.intent.commandId,\n                configuration.locking,\n              )).length !== 0\n            )\n              return prepare(\"rejected\", journal);\n            if (\n              completion !== undefined &&\n              (input.intent.reset === undefined ||\n                completion.input.continuationId !== input.intent.reset.continuationId ||\n                bindingJson(completion.input.binding) !== bindingJson(input.intent.reset.binding) ||\n                !kernel.proofCompletionMatchesPassword({ ...input.mutation, completion }))\n            )\n              return prepare(\"rejected\", journal);\n\n            const credentialRevision = yield* kernel.allocate(\n              configuration.mode,\n              p.allocateRevision,\n              p.allocateRevisionSync,\n            );\n\n            const verifierVersion = yield* kernel.allocate(\n              configuration.mode,\n              p.allocateRevision,\n              p.allocateRevisionSync,\n            );\n\n            const nextSecurityRevision = yield* kernel.allocateNextSecurityRevision(\n              p,\n              configuration.mode,\n              input.intent.revision.securityRevision,\n            );\n\n            if (\n              nextSecurityRevision === input.intent.revision.securityRevision ||\n              credentialRevision === input.intent.credential?.credentialRevision ||\n              verifierVersion === input.intent.credential?.verifierVersion\n            )\n              return yield* unavailable();\n\n            const credentialId =\n              input.intent.action === \"add-password\"\n                ? yield* kernel.allocate(\n                    configuration.mode,\n                    p.allocateCredentialId,\n                    p.allocateCredentialIdSync,\n                  )\n                : undefined;\n\n            let appliedAt: number | undefined;\n\n            const assertApplied = Effect.fn(\"DrizzlePasswordPrepared.assertApplied\")(() =>\n              Effect.flatMap(CurrentPasswordPreparedTransaction, (currentTransaction) =>\n                Effect.gen(function* () {\n                  if (appliedAt === undefined) return;\n\n                  if (\n                    !(yield* kernel.checkMutationApplied(\n                      p,\n                      input.mutation,\n                      current.nativeSubjectId,\n                      {\n                        credentialId: credentialId ?? input.intent.credential!.credentialId,\n                        credentialRevision,\n                        verifierVersion,\n                        nextSecurityRevision,\n                      },\n                      appliedAt,\n                    )) ||\n                    (yield* readIntent(\n                      mapping,\n                      rowCondition(mapping, {\n                        ...row,\n                        [t.state]: t.states.Consumed,\n                        [t.snapshot]: null,\n                        [t.digest]: null,\n                      }),\n                      false,\n                    )).length !== 1 ||\n                    !evidenceCurrent(input, current.requirement, yield* nowMillis)\n                  )\n                    return yield* unavailable();\n                }).pipe(Effect.provideService(CurrentPasswordSql, currentTransaction)),\n              ),\n            );\n\n            const validateApplied = Effect.gen(function* () {\n              yield* assertApplied().pipe(\n                Effect.provideService(CurrentPasswordPreparedTransaction, transaction),\n              );\n              if (appliedAt === undefined) return;\n              const postconditions = yield* Effect.serviceOption(PasswordPreparedPostconditions);\n\n              if (\n                Option.isSome(postconditions) &&\n                !postconditions.value.register(assertApplied().pipe(translateFailure))\n              )\n                return yield* unavailable();\n            });\n\n            const apply = Effect.fn(\"DrizzlePasswordPrepared.apply\")(function* () {\n              const finalNow = yield* nowMillis;\n\n              if (!evidenceCurrent(input, current.requirement, finalNow)) return false;\n\n              const changed =\n                input.intent.action === \"add-password\"\n                  ? yield* kernel.addPasswordIn(\n                      p,\n                      configuration,\n                      input.mutation,\n                      {\n                        credentialId: credentialId!,\n                        credentialRevision,\n                        verifierVersion,\n                        nextSecurityRevision,\n                      },\n                      finalNow,\n                    )\n                  : yield* kernel.writeReplacement(\n                      p,\n                      input.mutation,\n                      current.nativeSubjectId,\n                      { credentialRevision, verifierVersion, nextSecurityRevision },\n                      finalNow,\n                    );\n\n              if (!changed) return yield* unavailable();\n              appliedAt = finalNow;\n              yield* terminal(mapping, row, \"Consumed\");\n              if (!evidenceCurrent(input, current.requirement, yield* nowMillis))\n                return yield* unavailable();\n\n              return true;\n            });\n\n            if (completion !== undefined) {\n              let receipt: ReturnType<typeof prepare> | undefined;\n\n              yield* completeProofPlanIn(\n                configuration.proof!.mapping,\n                configuration.proof!.configuration,\n                completion,\n                Effect.gen(function* () {\n                  return yield* apply();\n                }),\n                (decision) => {\n                  receipt = prepare(decision === \"completed\" ? \"changed\" : \"rejected\", journal);\n\n                  return decision;\n                },\n              );\n\n              yield* validateApplied;\n\n              return receipt ?? prepare(\"rejected\", journal);\n            }\n\n            const changed = yield* apply();\n\n            yield* validateApplied;\n\n            return prepare(changed ? \"changed\" : \"rejected\", journal);\n          }),\n        );\n      });\n\n    const services: PasswordPreparedPersistence = {\n      reserve: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const input = yield* snapshotReserve(uncaptured);\n\n          if (\n            (input.action === \"reset-password\") !==\n              (input.reset !== undefined && input.completion !== undefined) ||\n            (input.action === \"reset-password\" && configuration.proof === undefined) ||\n            input.generation !== input.policy.generation ||\n            input.policy.retentionMillis <\n              Math.max(\n                input.policy.preparationLifetimeMillis + input.policy.lifetimeMillis,\n                input.policy.admission.action.windowMillis,\n                input.policy.admission.identifier.windowMillis,\n                input.policy.admission.subject.windowMillis,\n              ) ||\n            (input.invalidation.existingSessions === \"immediate\" &&\n              p.sessionInvalidation !== \"same-authority-immediate\")\n          )\n            return yield* unavailable();\n\n          return yield* owned(\n            Effect.gen(function* () {\n              const transaction = yield* CurrentPasswordSql;\n              const journal = yield* CurrentCommitJournal;\n\n              yield* lockAnchor(mapping, configuration, input.moduleId);\n\n              const version = PasswordPreparedVersion.make(\n                yield* kernel.allocate(\n                  configuration.mode,\n                  mapping.allocateVersion,\n                  mapping.allocateVersionSync,\n                ),\n              );\n\n              const authority = yield* captureAuthority(mapping, configuration, input);\n\n              if (authority === undefined) return yield* unavailable();\n              if (input.reset !== undefined) {\n                if (\n                  input.completion === undefined ||\n                  input.completion.moduleId !== `${input.moduleId}/reset` ||\n                  input.completion.purpose !== \"password-reset\" ||\n                  input.reset.continuationId !== input.completion.continuationId ||\n                  bindingJson(input.reset.binding) !== bindingJson(input.completion.binding) ||\n                  input.reset.binding._tag !== \"Subject\" ||\n                  !sameRevision(input.reset.binding.revision, authority.revision) ||\n                  authority.snapshot?.identifierVerifiedAtMillis === undefined ||\n                  !(yield* checkProofCompletionIn(\n                    configuration.proof!.mapping,\n                    configuration.proof!.configuration,\n                    input.completion,\n                  ))\n                )\n                  return yield* unavailable();\n              }\n              if (\n                (yield* readIntent(\n                  mapping,\n                  and(eq(c.moduleId, input.moduleId), eq(c.commandId, input.commandId))!,\n                  configuration.locking,\n                )).length\n              )\n                return prepare({ _tag: \"Existing\" }, journal);\n\n              const now = yield* nowMillis,\n                nativeNow = p.encodeInstant(now);\n\n              const scope = identifierScope({\n                credential: authority.snapshot,\n                revision: authority.revision,\n              });\n\n              const active =\n                (yield* read(\n                  transaction\n                    .select({ total: count() })\n                    .from(t.table)\n                    .where(\n                      and(\n                        eq(c.moduleId, input.moduleId),\n                        eq(c.subjectId, authority.nativeSubjectId),\n                        or(\n                          and(\n                            eq(c.state, t.states.Preparing),\n                            gt(c.preparationExpiresAt, nativeNow),\n                          ),\n                          and(eq(c.state, t.states.Ready), gt(c.expiresAt, nativeNow)),\n                        ),\n                      ),\n                    ),\n                  false,\n                ))[0]?.total ?? 0;\n\n              if (active >= input.policy.maximumPendingPerSubject) return yield* unavailable();\n              for (const [condition, budget] of [\n                [eq(c.action, input.action), input.policy.admission.action],\n                [eq(c.identifierScope, scope), input.policy.admission.identifier],\n                [eq(c.subjectId, authority.nativeSubjectId), input.policy.admission.subject],\n              ] as const) {\n                const total =\n                  (yield* read(\n                    transaction\n                      .select({ total: count() })\n                      .from(t.table)\n                      .where(\n                        and(\n                          eq(c.moduleId, input.moduleId),\n                          condition,\n                          gt(c.admittedAt, p.encodeInstant(now - budget.windowMillis)),\n                        ),\n                      ),\n                    false,\n                  ))[0]?.total ?? 0;\n\n                if (total >= budget.limit) return yield* unavailable();\n              }\n\n              const reservation = yield* snapshotPasswordPreparedReservation({\n                _tag: \"Preparing\",\n                moduleId: input.moduleId,\n                generation: input.generation,\n                intentId: input.intentId,\n                version,\n                commandId: input.commandId,\n                action: input.action,\n                revision: authority.revision,\n                ...(authority.snapshot === undefined ? {} : { credential: authority.snapshot }),\n                capturedRequirement: authority.requirement,\n                ...(input.reset === undefined ? {} : { reset: input.reset }),\n                invalidation: input.invalidation,\n                createdAtMillis: now,\n                preparationExpiresAtMillis: now + input.policy.preparationLifetimeMillis,\n                retainUntilMillis: now + input.policy.retentionMillis,\n              });\n\n              const snapshot = yield* encodeReservation(reservation);\n\n              yield* transaction.insert(t.table).values(\n                t.encodeInsert({\n                  reservation,\n                  nativeSubjectId: authority.nativeSubjectId,\n                  identifierScope: scope,\n                  snapshot,\n                  admittedAtMillis: now,\n                  admissionRetainUntilMillis:\n                    now +\n                    Math.max(\n                      input.policy.admission.action.windowMillis,\n                      input.policy.admission.identifier.windowMillis,\n                      input.policy.admission.subject.windowMillis,\n                    ),\n                }),\n              );\n\n              const rows = yield* readIntent(\n                mapping,\n                and(eq(c.moduleId, input.moduleId), eq(c.intentId, input.intentId))!,\n                false,\n              );\n\n              if (\n                rows.length !== 1 ||\n                !(yield* recordMatches(\n                  mapping,\n                  rows[0],\n                  reservation,\n                  authority.nativeSubjectId,\n                  snapshot,\n                ))\n              )\n                return yield* unavailable();\n\n              const admittedUntil =\n                now +\n                Math.max(\n                  input.policy.admission.action.windowMillis,\n                  input.policy.admission.identifier.windowMillis,\n                  input.policy.admission.subject.windowMillis,\n                );\n\n              if (\n                (yield* p.decodeInstant(rows[0][t.admittedAt])) !== now ||\n                (yield* p.decodeInstant(rows[0][t.admissionRetainUntil])) !== admittedUntil ||\n                (yield* nowMillis) >= reservation.preparationExpiresAtMillis ||\n                (input.completion !== undefined &&\n                  !(yield* checkProofCompletionIn(\n                    configuration.proof!.mapping,\n                    configuration.proof!.configuration,\n                    input.completion,\n                  )))\n              )\n                return yield* unavailable();\n\n              return prepare({ _tag: \"Reserved\", reservation }, journal);\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      publishReady: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const reservation = yield* snapshotPasswordPreparedReservation(uncaptured.reservation),\n            ready = yield* snapshotPasswordPreparedReady(uncaptured.ready);\n\n          const snapshot = yield* encodeReservation(reservation),\n            readySnapshot = yield* encodePasswordPreparedReady(ready);\n\n          if ((yield* encodeReservation(reservationOf(ready))) !== snapshot)\n            return yield* unavailable();\n\n          return yield* owned(\n            Effect.gen(function* () {\n              const transaction = yield* CurrentPasswordSql;\n              const journal = yield* CurrentCommitJournal;\n\n              yield* lockAnchor(mapping, configuration, reservation.moduleId);\n              const authority = yield* currentAuthority(mapping, configuration, reservation);\n\n              if (authority === undefined) return prepare(\"rejected\", journal);\n\n              const rows = yield* readIntent(\n                  mapping,\n                  and(eq(c.moduleId, reservation.moduleId), eq(c.intentId, reservation.intentId))!,\n                  configuration.locking,\n                ),\n                row = rows[0];\n\n              const now = yield* nowMillis;\n\n              if (\n                rows.length !== 1 ||\n                !(yield* recordMatches(\n                  mapping,\n                  row,\n                  reservation,\n                  authority.nativeSubjectId,\n                  snapshot,\n                )) ||\n                now < ready.issuedAtMillis ||\n                now >= reservation.preparationExpiresAtMillis ||\n                now >= ready.expiresAtMillis\n              )\n                return prepare(\"rejected\", journal);\n              yield* transaction\n                .update(t.table)\n                .set(t.encodeReady({ ready, snapshot: readySnapshot }))\n                .where(rowCondition(mapping, row));\n\n              const saved = yield* readIntent(\n                mapping,\n                and(eq(c.moduleId, ready.moduleId), eq(c.intentId, ready.intentId))!,\n                false,\n              );\n\n              if (\n                saved.length !== 1 ||\n                !(yield* recordMatches(\n                  mapping,\n                  saved[0],\n                  ready,\n                  authority.nativeSubjectId,\n                  readySnapshot,\n                )) ||\n                (yield* readIntent(\n                  mapping,\n                  and(\n                    eq(c.moduleId, ready.moduleId),\n                    eq(c.intentId, ready.intentId),\n                    eq(c.admittedAt, row[t.admittedAt]),\n                    eq(c.admissionRetainUntil, row[t.admissionRetainUntil]),\n                  )!,\n                  false,\n                )).length !== 1\n              )\n                return yield* unavailable();\n              if (\n                (yield* nowMillis) >= reservation.preparationExpiresAtMillis ||\n                (yield* nowMillis) >= ready.expiresAtMillis\n              )\n                return yield* unavailable();\n\n              return prepare(\"published\", journal);\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      context: (uncaptured) =>\n        Effect.gen(function* () {\n          const input = yield* Schema.decodeEffect(ContextInput)({ ...uncaptured }).pipe(\n            Effect.mapError(unavailable),\n          );\n\n          const record = yield* kernel.safeRead(\n            database,\n            configuration,\n            Effect.gen(function* () {\n              if (\n                !valid(mapping) ||\n                !(yield* lockAnchor(mapping, configuration, input.moduleId, false))\n              )\n                return undefined;\n\n              const rows = yield* readIntent(\n                mapping,\n                and(\n                  eq(c.moduleId, input.moduleId),\n                  eq(c.generation, input.generation),\n                  eq(c.digest, input.digest),\n                  eq(c.state, t.states.Ready),\n                )!,\n                false,\n              );\n\n              if (rows.length !== 1) return undefined;\n              const selected = yield* decodePasswordPreparedReady(rows[0][t.snapshot]);\n              const authority = yield* currentAuthority(mapping, configuration, selected);\n\n              if (authority === undefined) return undefined;\n\n              const locked = yield* readIntent(\n                mapping,\n                rowCondition(mapping, rows[0]),\n                configuration.locking,\n              );\n\n              const now = yield* nowMillis;\n\n              if (\n                locked.length !== 1 ||\n                now < selected.issuedAtMillis ||\n                now >= selected.expiresAtMillis ||\n                selected.moduleId !== input.moduleId ||\n                selected.generation !== input.generation ||\n                selected.digest !== input.digest ||\n                !(yield* recordMatches(\n                  mapping,\n                  locked[0],\n                  selected,\n                  authority.nativeSubjectId,\n                  yield* encodePasswordPreparedReady(selected),\n                ))\n              )\n                return undefined;\n\n              return { record: selected, currentRequirement: authority.requirement };\n            }),\n          );\n\n          return record ?? (yield* PasswordRejected.make({}));\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateContextFailure,\n        ),\n      complete: (input, prepare) =>\n        complete(input, prepare).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      resetWithProof: (input, prepare) =>\n        complete(input, prepare).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      cancel: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const record = yield* snapshotPasswordPreparedReady(uncaptured.record),\n            snapshot = yield* encodePasswordPreparedReady(record);\n\n          return yield* owned(\n            Effect.gen(function* () {\n              const journal = yield* CurrentCommitJournal;\n\n              yield* lockAnchor(mapping, configuration, record.moduleId);\n              const authority = yield* currentAuthority(mapping, configuration, record);\n\n              if (authority === undefined) return prepare(false, journal);\n\n              const rows = yield* readIntent(\n                mapping,\n                and(eq(c.moduleId, record.moduleId), eq(c.intentId, record.intentId))!,\n                configuration.locking,\n              );\n\n              const now = yield* nowMillis;\n\n              if (\n                rows.length !== 1 ||\n                now < record.issuedAtMillis ||\n                now >= record.expiresAtMillis ||\n                !(yield* recordMatches(\n                  mapping,\n                  rows[0],\n                  record,\n                  authority.nativeSubjectId,\n                  snapshot,\n                ))\n              )\n                return prepare(false, journal);\n              yield* terminal(mapping, rows[0], \"Cancelled\");\n\n              return prepare(true, journal);\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      cleanup: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const input = { ...uncaptured };\n\n          if (!Number.isSafeInteger(input.limit) || input.limit < 1 || input.limit > 1000)\n            return yield* unavailable();\n\n          return yield* owned(\n            Effect.gen(function* () {\n              const transaction = yield* CurrentPasswordSql;\n              const journal = yield* CurrentCommitJournal;\n\n              if (!(yield* lockAnchor(mapping, configuration, input.moduleId, false)))\n                return prepare({ removed: 0, hasMore: false }, journal);\n              const now = p.encodeInstant(yield* nowMillis);\n\n              const due = and(\n                eq(c.moduleId, input.moduleId),\n                or(\n                  and(lte(c.retainUntil, now), lte(c.admissionRetainUntil, now)),\n                  and(\n                    isNotNull(c.snapshot),\n                    or(\n                      and(eq(c.state, t.states.Preparing), lte(c.preparationExpiresAt, now)),\n                      and(eq(c.state, t.states.Ready), lte(c.expiresAt, now)),\n                    ),\n                  ),\n                ),\n              )!;\n\n              const rows = yield* read(\n                transaction\n                  .select()\n                  .from(t.table)\n                  .where(due)\n                  .orderBy(c.createdAt, c.intentId)\n                  .limit(input.limit + 1),\n                configuration.locking,\n              );\n\n              let removed = 0;\n\n              for (const row of rows.slice(0, input.limit)) {\n                const expired =\n                  (yield* readIntent(\n                    mapping,\n                    and(\n                      rowCondition(mapping, row),\n                      lte(c.retainUntil, now),\n                      lte(c.admissionRetainUntil, now),\n                    )!,\n                    false,\n                  )).length === 1;\n\n                if (expired) {\n                  yield* transaction.delete(t.table).where(rowCondition(mapping, row));\n                  if (\n                    (yield* readIntent(\n                      mapping,\n                      and(eq(c.moduleId, input.moduleId), eq(c.intentId, row[t.intentId]))!,\n                      false,\n                    )).length\n                  )\n                    return yield* unavailable();\n                  removed++;\n                } else yield* terminal(mapping, row, \"Expired\");\n              }\n\n              return prepare(\n                {\n                  removed,\n                  hasMore:\n                    (yield* read(transaction.select().from(t.table).where(due).limit(1), false))\n                      .length > 0,\n                },\n                journal,\n              );\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n    };\n\n    return services;\n  },\n);\n\nexport const passwordPreparedSqlKernel = {\n  columns,\n  recordMatches,\n  captureAuthority,\n  currentAuthority,\n  rowCondition,\n  valid,\n  identifierScope,\n};\n"],"mappings":";;;;;;;;;;;;;;;AA0DA,MAAM,oBACJ,WAEA,yBACE,SACC,UACC,OAAO,GAAG,mBAAmB,CAAC,CAAC,KAAK,KACpC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,sBAAsB,CAAC,CAAC,KAAK,CAC3C,CAAC,CAAC,KAAK,OAAO,YAAY,UAAU,OAAO,UAAU,MAAM,IAAI,aAAa,YAAY,CAAC,CAAC,CAAC,CAAC;AAE9F,MAAM,2BACJ,WAEA,yBACE,SACC,UACC,OAAO,GAAG,mBAAmB,CAAC,CAAC,KAAK,KACpC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,sBAAsB,CAAC,CAAC,KAAK,CAC3C,CAAC,CAAC,KACA,OAAO,YAAY,UACjB,OAAO,UACL,MAAM,IAAI,QAAQ,UAAW,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,IAAI,QAAQ,YAAY,CAAE,CAC1F,CACF,CACF;AAGF,MAAM,YAAY,SAAS,IAAI,KAAK,OAAO,IAAI,SAAS,aAAa,CAAC;AAEtE,MAAM,QAAQ,OAAyB,YACrC,WAAW,OAAO,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,IAAI;AAErE,MAAM,WAAW,YAAqB;CACpC,MAAM,QAAQ,QAAQ;CAEtB,OAAO;EACL,UAAU,OAAO,MAAM,OAAO,MAAM,QAAQ;EAC5C,UAAU,OAAO,MAAM,OAAO,MAAM,QAAQ;EAC5C,WAAW,OAAO,MAAM,OAAO,MAAM,SAAS;EAC9C,WAAW,OAAO,MAAM,OAAO,MAAM,SAAS;EAC9C,QAAQ,OAAO,MAAM,OAAO,MAAM,MAAM;EACxC,YAAY,OAAO,MAAM,OAAO,MAAM,UAAU;EAChD,SAAS,OAAO,MAAM,OAAO,MAAM,OAAO;EAC1C,OAAO,OAAO,MAAM,OAAO,MAAM,KAAK;EACtC,QAAQ,OAAO,MAAM,OAAO,MAAM,MAAM;EACxC,UAAU,OAAO,MAAM,OAAO,MAAM,QAAQ;EAC5C,iBAAiB,OAAO,MAAM,OAAO,MAAM,eAAe;EAC1D,WAAW,OAAO,MAAM,OAAO,MAAM,SAAS;EAC9C,YAAY,OAAO,MAAM,OAAO,MAAM,UAAU;EAChD,sBAAsB,OAAO,MAAM,OAAO,MAAM,oBAAoB;EACpE,sBAAsB,OAAO,MAAM,OAAO,MAAM,oBAAoB;EACpE,WAAW,OAAO,MAAM,OAAO,MAAM,SAAS;EAC9C,aAAa,OAAO,MAAM,OAAO,MAAM,WAAW;CACpD;AACF;AAEA,MAAM,SAAS,YACb,OAAO,QAAQ,mCAAmC,CAAC,CAAC,OACjD,CAAC,KAAK,WACL,QAAQ,YAAY,SAA6D,KACrF;AAEF,MAAM,aAAa,OAAO,GAAG,oCAAoC,CAAC,CAAC,WACjE,SACA,eACA,UACA,SAAS,MACT;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,IAAI,QAAQ,WAChB,MAAM,OAAO,EAAE,OAAO,EAAE,QAAQ;CAElC,IAAI,QACF,OAAO,cAAc,eACnB,SAAS,OAAO,EAAE,KAAK,CAAC,CAAC,OAAO,EAAE,aAAa,QAAQ,CAAC,GACxD,EAAE,UACF,QACF;CAEF,MAAM,OAAO,OAAO,KAClB,SAAS,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,MAAM,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAChE,cAAc,OAChB;CAEA,IAAI,KAAK,SAAS,KAAM,UAAU,KAAK,WAAW,GAAI,OAAO,OAAO,YAAY;CAEhF,OAAO,KAAK,WAAW;AACzB,CAAC;AAED,MAAM,cAAc,OAAO,WAAW,OAAO,eAAe,YAAY,CAAC;AAEzE,MAAM,mBAAmB,OAAO,GAAG,0CAA0C,CAAC,CAAC,WAC7E,SACA,eACA,OAMA;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,IAAI,QAAQ;CAClB,MAAM,SAAS,OAAOA,kBAAO,YAAY,GAAG,MAAM,WAAW,cAAc,OAAO;CAElF,IAAI,OAAO,QAAQ,KAAA,KAAa,CAAC,EAAE,QAAQ,eAAe,OAAO,IAAI,EAAE,QAAQ,OAAO,GACpF,OAAO,KAAA;CAET,MAAM,KAAKA,kBAAO,kBAAkB,CAAC,GACnC,KAAKA,kBAAO,2BAA2B,CAAC;CAE1C,IAAI;CAEJ,IAAI,MAAM,WAAW,gBAAgB;EACnC,IAAI,MAAM,UAAU,KAAA,GAClB,cAAc,OAAOA,kBAAO,eAC1B,GACA,MAAM,MAAM,QAAQ,YACpB,cAAc,OAChB,EAAA,CAAG;OACA;GACH,MAAM,cAAc,OAAO,KACzB,SACG,OAAO,CAAC,CACR,KAAK,EAAE,WAAW,KAAK,CAAC,CACxB,MAAM,GAAG,GAAG,WAAW,OAAO,eAAe,CAAC,CAAC,CAC/C,QAAQ,GAAG,WAAW,GAAG,KAAK,GACjC,KACF,EAAA,CAAG,MAAM,QAAa,EAAE,WAAW,UAAU,GAAG,CAAC;GAEjD,IAAI,eAAe,KAAA,GACjB,cAAc,OAAOA,kBAAO,eAC1B,GACA;IACE,WAAW,WAAW,EAAE,WAAW;IACnC,OAAO,WAAW,EAAE,WAAW;GACjC,GACA,cAAc,OAChB,EAAA,CAAG;EACP;EACA,IACE,eAAe,KAAA,KACf,CAAC,EAAE,WAAW,UAAU,UAAU,KAClC,CAAC,EAAE,UAAU,OAAO,WAAW,EAAE,WAAW,YAAY,OAAO,eAAe,GAE9E,OAAO,KAAA;CACX;CAEA,MAAM,cAAc,OAAOA,kBAAO,uBAChC,GACA,MAAM,UACN,OAAO,iBACP,cAAc,OAChB,EAAA,CAAG;CAEH,IAAK,MAAM,WAAW,oBAAqB,eAAe,KAAA,IAAY,OAAO,KAAA;CAE7E,MAAM,WACJ,eAAe,KAAA,IACX,KAAA,IACA,OAAO,EAAE,WACN,OAAO;EAAE,UAAU,MAAM;EAAU,SAAS,OAAO;EAAK;EAAY;CAAW,CAAC,CAAC,CACjF,KAAK,OAAO,QAAQ,0BAA0B,CAAC;CAExD,IACE,aAAa,KAAA,MACZ,SAAS,aAAa,MAAM,YAC3B,SAAS,SAAS,cAAc,MAAM,aACtC,SAAS,SAAS,qBAAqB,OAAO,IAAI,EAAE,QAAQ,qBAC5D,SAAS,iBAAiB,WAAW,EAAE,WAAW,iBAClD,SAAS,uBAAuB,WAAW,EAAE,WAAW,uBACxD,SAAS,oBAAoB,WAAW,EAAE,WAAW,oBACrD,SAAS,MAAM,SAAS,QAAQ,MAAM,WAAW,EAAE,WAAW,aAC9D,SAAS,kBAAkB,WAAW,EAAE,WAAW,kBACnD,SAAS,WAAW,cAAc,WAAW,EAAE,WAAW,cAC1D,SAAS,WAAW,UAAU,WAAW,EAAE,WAAW,UACtD,SAAS,8BAA8B,WAAW,EAAE,WAAW,mBAEjE,OAAO,KAAA;CAWT,MAAM,UAAS,OATQ,KACrB,SACG,OAAO,CAAC,CACR,KAAK,EAAE,oBAAoB,KAAK,CAAC,CACjC,MAAM,GAAG,GAAG,WAAW,OAAO,eAAe,CAAC,CAAC,CAC/C,QAAQ,GAAG,YAAY,GAC1B,cAAc,OAChB,EAAA,CAEuB,QACpB,QACC,EAAE,oBAAoB,WAAW,KAAA,KACjC,EAAE,oBAAoB,iBAAiB,IAAI,EAAE,oBAAoB,OAAO,MAAM,IAClF;CAEA,IAAI,OAAO,SAAS,IAAI,OAAO,OAAO,YAAY;CAElD,MAAM,WACJ,UAAU,YACV,uBAAuB,KAAK;EAC1B,WAAW,MAAM;EACjB,kBAAkB,OAAO,IAAI,EAAE,QAAQ;EACvC,aAAa,OAAO,KAAK,SAAc;GACrC,cAAc,IAAI,EAAE,oBAAoB;GACxC,UAAU,IAAI,EAAE,oBAAoB;EACtC,EAAE;CACJ,CAAC;CAEH,IACE,SAAS,YAAY,MAClB,aACC,CAAC,OAAO,MACL,QACC,IAAI,EAAE,oBAAoB,kBAAkB,SAAS,gBACrD,IAAI,EAAE,oBAAoB,cAAc,SAAS,QACrD,CACJ,GAEA,OAAO,KAAA;CAET,MAAM,cAAc,OAAO,EAAE,QAC1B,wBAAwB,OAAO,KAAK,MAAM,MAAM,CAAC,CACjD,KAAK,OAAO,QAAQ,2BAA2B,CAAC;CAEnD,OAAO;EAAE,GAAG;EAAQ;EAAY;EAAU;EAAU;CAAY;AAClE,CAAC;AAED,MAAM,mBAAmB,OAAO,GAAG,0CAA0C,CAAC,CAAC,WAC7E,SACA,eACA,QACA;CACA,MAAM,UAAU,OAAO,iBAAiB,SAAS,eAAe;EAC9D,UAAU,OAAO;EACjB,QAAQ,OAAO;EACf,WAAW,OAAO,SAAS;EAC3B,GAAI,OAAO,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,OAAO,MAAM;CAC9D,CAAC;CAED,IACE,YAAY,KAAA,KACZ,CAAC,aAAa,QAAQ,UAAU,OAAO,QAAQ,MAC9C,QAAQ,aAAa,KAAA,IAClB,OAAO,eAAe,KAAA,IACtB,OAAO,eAAe,KAAA,KACtB,CAACA,kBAAO,uBAAuB,QAAQ,UAAU,OAAO,UAAU,IAEtE,OAAO,KAAA;CAET,OAAO;AACT,CAAC;AAED,MAAM,gBAAgB,SAAkB,QAAa;CACnD,MAAM,IAAI,QAAQ,OAAO;CAEzB,OAAO,IACL,GAAG,OAAO,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW;EACzC,MACE,OAAO,IADK,QAAQ,OAAO;EAG7B,OAAO,UAAU,UAAU,IAAI,IAAI,OAAO,KAAK,IAAI,GAAG,OAAO,IAAI;CACnE,CAAC,CACH;AACF;AAEA,MAAM,aAAa,OAAO,GAAG,oBAAoB,CAAC,CAAC,WACjD,SACA,WACA,SACA;CACA,MAAM,WAAW,OAAO;CAExB,OAAO,OAAO,KACZ,SAAS,OAAO,CAAC,CAAC,KAAK,QAAQ,OAAO,KAAK,CAAC,CAAC,MAAM,SAAS,CAAC,CAAC,MAAM,CAAC,GACrE,OACF;AACF,CAAC;AAED,MAAM,gBAAgB,OAAO,GAAG,uCAAuC,CAAC,CAAC,WACvE,SACA,KACA,QACA,iBACA,UACA;CACA,MAAM,IAAI,QAAQ,QAChB,IAAI,QAAQ;CAEd,IACE,QAAQ,KAAA,KACR,IAAI,EAAE,cAAc,OAAO,YAC3B,IAAI,EAAE,cAAc,OAAO,YAC3B,IAAI,EAAE,eAAe,OAAO,aAC5B,CAAC,EAAE,UAAU,OAAO,IAAI,EAAE,YAAY,eAAe,KACrD,IAAI,EAAE,YAAY,OAAO,UACzB,IAAI,EAAE,gBAAgB,OAAO,cAC7B,IAAI,EAAE,aAAa,OAAO,WAC1B,IAAI,EAAE,WAAW,EAAE,OAAO,OAAO,SACjC,IAAI,EAAE,cAAc,YACpB,IAAI,EAAE,qBAAqB,gBAAgB,MAAM,MAChD,OAAO,SAAS,UACb,IAAI,EAAE,YAAY,OAAO,SACzB,CAAC,UAAU,UAAU,IAAI,EAAE,OAAO,IAEtC,OAAO;CACT,KAAK,MAAM,CAAC,KAAK,YAAY;EAC3B,CAAC,EAAE,WAAW,OAAO,eAAe;EACpC,CAAC,EAAE,sBAAsB,OAAO,0BAA0B;EAC1D,CAAC,EAAE,aAAa,OAAO,iBAAiB;CAC1C,GACE,KAAK,OAAO,EAAE,cAAc,IAAI,IAAI,OAAO,SAAS,OAAO;CAE7D,OAAO,OAAO,SAAS,WAClB,OAAO,EAAE,cAAc,IAAI,EAAE,UAAU,OAAO,OAAO,kBACtD,UAAU,UAAU,IAAI,EAAE,UAAU;AAC1C,CAAC;AAED,MAAM,WAAW,OAAO,GAAG,kCAAkC,CAAC,CAAC,WAC7D,SACA,KACA,OACA;CAGA,QAAO,OAFiB,mBAAA,CAGrB,OAAO,QAAQ,OAAO,KAAK,CAAC,CAC5B,IAAI,QAAQ,OAAO,eAAe,KAAK,CAAC,CAAC,CACzC,MAAM,aAAa,SAAS,GAAG,CAAC;CAEnC,MAAM,IAAI,QAAQ,OAAO,GACvB,IAAI,QAAQ;CAEd,MAAM,OAAO,OAAO,WAClB,SACA,IAAI,GAAG,EAAE,UAAU,IAAI,EAAE,SAAS,GAAG,GAAG,EAAE,UAAU,IAAI,EAAE,SAAS,CAAC,GACpE,KACF;CAEA,MAAM,WAAW;EAAE,GAAG;GAAM,EAAE,QAAQ,EAAE,OAAO;GAAS,EAAE,WAAW;GAAO,EAAE,SAAS;CAAK;CAE5F,IACE,KAAK,WAAW,MACf,OAAO,WAAW,SAAS,aAAa,SAAS,QAAQ,GAAG,KAAK,EAAA,CAAG,WAAW,GAEhF,OAAO,OAAO,YAAY;AAC9B,CAAC;AAED,MAAa,qCAAqC,OAAO,GAAG,oCAAoC,CAAC,CAC/F,WACE,SACA,eAKA;CACA,MAAM,WAAW,OAAO;CAExB,IAAI,CAAC,cAAc,aACjB,OAAO,uBAAuB;EAC5B,GAAG;EACH,OAAO,cAAc,OAAO;CAC9B,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;CACtC,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,UAChB,IAAI,QAAQ,OAAO,GACnB,IAAI,QAAQ;CAEd,MAAM,SAAkB,SACtB,MAAM,OAAO,IACTA,kBAAO,MACL,UACA,GACA,eACA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO;EACvB,MAAM,SAAS,OAAO,OAAO,cAAc,6BAA6B;EAExE,IAAI,OAAO,OAAO,MAAM,KAAK,CAAC,OAAO,MAAM,SAAS,QAAQ,QAAQ,KAAA,CAAS,CAAC,GAC5E,OAAO,OAAO,YAAY;EAE5B,OAAO,OAAO;CAChB,CAAC,CACH,IACA,OAAO,KAAK,YAAY,CAAC;CAE/B,MAAM,YACJ,YACA,YAEA,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO,iBAAiB,UAAU;EAEhD,MAAM,aACJ,WAAW,eAAe,KAAA,IACtB,KAAA,IACA;GACE,SAAS,WAAW,WAAW;GAC/B,OAAO,OAAO,OAAO,aAAa,OAAO,eAAe,eAAe,CAAC,CAAC,CACvE,WAAW,WAAW,KACxB,CAAC,CAAC,KACA,OAAO,QAAQ,OAAO,aAAa,OAAO,eAAe,eAAe,CAAC,CAAC,GAC1E,OAAO,SAAS,WAAW,CAC7B;EACF;EAEN,IACG,MAAM,OAAO,WAAW,sBAAuB,eAAe,KAAA,MAC9D,eAAe,KAAA,KAAa,cAAc,UAAU,KAAA,GAErD,OAAO,OAAO,YAAY;EAE5B,OAAO,OAAO,MACZ,OAAO,IAAI,aAAa;GACtB,MAAM,cAAc,OAAO;GAC3B,MAAM,UAAU,OAAO;GAEvB,OAAO,WAAW,SAAS,eAAe,MAAM,OAAO,QAAQ;GAS/D,KAAI,OAPqBA,kBAAO,0BAC9B,GACA,eACA,MAAM,UACN,MAAM,OAAO,MACf,OAEkB,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;GAC/D,MAAM,UAAU,OAAO,iBAAiB,SAAS,eAAe,MAAM,MAAM;GAE5E,IAAI,YAAY,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;GAE7D,MAAM,OAAO,OAAO,WAClB,SACA,IAAI,GAAG,EAAE,UAAU,MAAM,OAAO,QAAQ,GAAG,GAAG,EAAE,UAAU,MAAM,OAAO,QAAQ,CAAC,GAChF,cAAc,OAChB;GAEA,MAAM,MAAM,KAAK,IACf,UAAU,OAAO,4BAA4B,MAAM,MAAM;GAE3D,IACE,KAAK,WAAW,KAChB,EAAE,OAAO,cACP,SACA,KACA,MAAM,QACN,QAAQ,iBACR,OACF,MACA,CAAC,gBAAgB,OAAO,QAAQ,aAAa,OAAO,SAAS,MAC5D,OAAOA,kBAAO,cACb,GACA,MAAM,OAAO,UACb,MAAM,OAAO,WACb,cAAc,OAChB,EAAA,CAAG,WAAW,GAEd,OAAO,QAAQ,YAAY,OAAO;GACpC,IACE,eAAe,KAAA,MACd,MAAM,OAAO,UAAU,KAAA,KACtB,WAAW,MAAM,mBAAmB,MAAM,OAAO,MAAM,kBACvD,YAAY,WAAW,MAAM,OAAO,MAAM,YAAY,MAAM,OAAO,MAAM,OAAO,KAChF,CAACA,kBAAO,+BAA+B;IAAE,GAAG,MAAM;IAAU;GAAW,CAAC,IAE1E,OAAO,QAAQ,YAAY,OAAO;GAEpC,MAAM,qBAAqB,OAAOA,kBAAO,SACvC,cAAc,MACd,EAAE,kBACF,EAAE,oBACJ;GAEA,MAAM,kBAAkB,OAAOA,kBAAO,SACpC,cAAc,MACd,EAAE,kBACF,EAAE,oBACJ;GAEA,MAAM,uBAAuB,OAAOA,kBAAO,6BACzC,GACA,cAAc,MACd,MAAM,OAAO,SAAS,gBACxB;GAEA,IACE,yBAAyB,MAAM,OAAO,SAAS,oBAC/C,uBAAuB,MAAM,OAAO,YAAY,sBAChD,oBAAoB,MAAM,OAAO,YAAY,iBAE7C,OAAO,OAAO,YAAY;GAE5B,MAAM,eACJ,MAAM,OAAO,WAAW,iBACpB,OAAOA,kBAAO,SACZ,cAAc,MACd,EAAE,sBACF,EAAE,wBACJ,IACA,KAAA;GAEN,IAAI;GAEJ,MAAM,gBAAgB,OAAO,GAAG,uCAAuC,CAAC,OACtE,OAAO,QAAQ,qCAAqC,uBAClD,OAAO,IAAI,aAAa;IACtB,IAAI,cAAc,KAAA,GAAW;IAE7B,IACE,EAAE,OAAOA,kBAAO,qBACd,GACA,MAAM,UACN,QAAQ,iBACR;KACE,cAAc,gBAAgB,MAAM,OAAO,WAAY;KACvD;KACA;KACA;IACF,GACA,SACF,OACC,OAAO,WACN,SACA,aAAa,SAAS;KACpB,GAAG;MACF,EAAE,QAAQ,EAAE,OAAO;MACnB,EAAE,WAAW;MACb,EAAE,SAAS;IACd,CAAC,GACD,KACF,EAAA,CAAG,WAAW,KACd,CAAC,gBAAgB,OAAO,QAAQ,aAAa,OAAO,SAAS,GAE7D,OAAO,OAAO,YAAY;GAC9B,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,oBAAoB,kBAAkB,CAAC,CACvE,CACF;GAEA,MAAM,kBAAkB,OAAO,IAAI,aAAa;IAC9C,OAAO,cAAc,CAAC,CAAC,KACrB,OAAO,eAAe,oCAAoC,WAAW,CACvE;IACA,IAAI,cAAc,KAAA,GAAW;IAC7B,MAAM,iBAAiB,OAAO,OAAO,cAAc,8BAA8B;IAEjF,IACE,OAAO,OAAO,cAAc,KAC5B,CAAC,eAAe,MAAM,SAAS,cAAc,CAAC,CAAC,KAAK,gBAAgB,CAAC,GAErE,OAAO,OAAO,YAAY;GAC9B,CAAC;GAED,MAAM,QAAQ,OAAO,GAAG,+BAA+B,CAAC,CAAC,aAAa;IACpE,MAAM,WAAW,OAAO;IAExB,IAAI,CAAC,gBAAgB,OAAO,QAAQ,aAAa,QAAQ,GAAG,OAAO;IAwBnE,IAAI,EArBF,MAAM,OAAO,WAAW,iBACpB,OAAOA,kBAAO,cACZ,GACA,eACA,MAAM,UACN;KACgB;KACd;KACA;KACA;IACF,GACA,QACF,IACA,OAAOA,kBAAO,iBACZ,GACA,MAAM,UACN,QAAQ,iBACR;KAAE;KAAoB;KAAiB;IAAqB,GAC5D,QACF,IAEQ,OAAO,OAAO,YAAY;IACxC,YAAY;IACZ,OAAO,SAAS,SAAS,KAAK,UAAU;IACxC,IAAI,CAAC,gBAAgB,OAAO,QAAQ,aAAa,OAAO,SAAS,GAC/D,OAAO,OAAO,YAAY;IAE5B,OAAO;GACT,CAAC;GAED,IAAI,eAAe,KAAA,GAAW;IAC5B,IAAI;IAEJ,OAAO,oBACL,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,YACA,OAAO,IAAI,aAAa;KACtB,OAAO,OAAO,MAAM;IACtB,CAAC,IACA,aAAa;KACZ,UAAU,QAAQ,aAAa,cAAc,YAAY,YAAY,OAAO;KAE5E,OAAO;IACT,CACF;IAEA,OAAO;IAEP,OAAO,WAAW,QAAQ,YAAY,OAAO;GAC/C;GAEA,MAAM,UAAU,OAAO,MAAM;GAE7B,OAAO;GAEP,OAAO,QAAQ,UAAU,YAAY,YAAY,OAAO;EAC1D,CAAC,CACH;CACF,CAAC;CA2fH,OAAO;EAxfL,UAAU,YAAY,YACpB,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,gBAAgB,UAAU;GAE/C,IACG,MAAM,WAAW,sBACf,MAAM,UAAU,KAAA,KAAa,MAAM,eAAe,KAAA,MACpD,MAAM,WAAW,oBAAoB,cAAc,UAAU,KAAA,KAC9D,MAAM,eAAe,MAAM,OAAO,cAClC,MAAM,OAAO,kBACX,KAAK,IACH,MAAM,OAAO,4BAA4B,MAAM,OAAO,gBACtD,MAAM,OAAO,UAAU,OAAO,cAC9B,MAAM,OAAO,UAAU,WAAW,cAClC,MAAM,OAAO,UAAU,QAAQ,YACjC,KACD,MAAM,aAAa,qBAAqB,eACvC,EAAE,wBAAwB,4BAE5B,OAAO,OAAO,YAAY;GAE5B,OAAO,OAAO,MACZ,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IAEvB,OAAO,WAAW,SAAS,eAAe,MAAM,QAAQ;IAExD,MAAM,UAAU,wBAAwB,KACtC,OAAOA,kBAAO,SACZ,cAAc,MACd,QAAQ,iBACR,QAAQ,mBACV,CACF;IAEA,MAAM,YAAY,OAAO,iBAAiB,SAAS,eAAe,KAAK;IAEvE,IAAI,cAAc,KAAA,GAAW,OAAO,OAAO,YAAY;IACvD,IAAI,MAAM,UAAU,KAAA,GAEhB;SAAA,MAAM,eAAe,KAAA,KACrB,MAAM,WAAW,aAAa,GAAG,MAAM,SAAS,WAChD,MAAM,WAAW,YAAY,oBAC7B,MAAM,MAAM,mBAAmB,MAAM,WAAW,kBAChD,YAAY,MAAM,MAAM,OAAO,MAAM,YAAY,MAAM,WAAW,OAAO,KACzE,MAAM,MAAM,QAAQ,SAAS,aAC7B,CAAC,aAAa,MAAM,MAAM,QAAQ,UAAU,UAAU,QAAQ,KAC9D,UAAU,UAAU,+BAA+B,KAAA,KACnD,EAAE,OAAO,uBACP,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MAAM,UACR,IAEA,OAAO,OAAO,YAAY;IAAA;IAE9B,KACG,OAAO,WACN,SACA,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,WAAW,MAAM,SAAS,CAAC,GACpE,cAAc,OAChB,EAAA,CAAG,QAEH,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,OAAO;IAE9C,MAAM,MAAM,OAAO,WACjB,YAAY,EAAE,cAAc,GAAG;IAEjC,MAAM,QAAQ,gBAAgB;KAC5B,YAAY,UAAU;KACtB,UAAU,UAAU;IACtB,CAAC;IAuBD,MApBG,OAAO,KACN,YACG,OAAO,EAAE,OAAO,MAAM,EAAE,CAAC,CAAC,CAC1B,KAAK,EAAE,KAAK,CAAC,CACb,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,WAAW,UAAU,eAAe,GACzC,GACE,IACE,GAAG,EAAE,OAAO,EAAE,OAAO,SAAS,GAC9B,GAAG,EAAE,sBAAsB,SAAS,CACtC,GACA,IAAI,GAAG,EAAE,OAAO,EAAE,OAAO,KAAK,GAAG,GAAG,EAAE,WAAW,SAAS,CAAC,CAC7D,CACF,CACF,GACF,KACF,EAAA,CAAG,EAAE,EAAE,SAAS,MAEJ,MAAM,OAAO,0BAA0B,OAAO,OAAO,YAAY;IAC/E,KAAK,MAAM,CAAC,WAAW,WAAW;KAChC,CAAC,GAAG,EAAE,QAAQ,MAAM,MAAM,GAAG,MAAM,OAAO,UAAU,MAAM;KAC1D,CAAC,GAAG,EAAE,iBAAiB,KAAK,GAAG,MAAM,OAAO,UAAU,UAAU;KAChE,CAAC,GAAG,EAAE,WAAW,UAAU,eAAe,GAAG,MAAM,OAAO,UAAU,OAAO;IAC7E,GAgBE,MAdG,OAAO,KACN,YACG,OAAO,EAAE,OAAO,MAAM,EAAE,CAAC,CAAC,CAC1B,KAAK,EAAE,KAAK,CAAC,CACb,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,WACA,GAAG,EAAE,YAAY,EAAE,cAAc,MAAM,OAAO,YAAY,CAAC,CAC7D,CACF,GACF,KACF,EAAA,CAAG,EAAE,EAAE,SAAS,MAEL,OAAO,OAAO,OAAO,OAAO,YAAY;IAGvD,MAAM,cAAc,OAAO,oCAAoC;KAC7D,MAAM;KACN,UAAU,MAAM;KAChB,YAAY,MAAM;KAClB,UAAU,MAAM;KAChB;KACA,WAAW,MAAM;KACjB,QAAQ,MAAM;KACd,UAAU,UAAU;KACpB,GAAI,UAAU,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY,UAAU,SAAS;KAC7E,qBAAqB,UAAU;KAC/B,GAAI,MAAM,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;KAC1D,cAAc,MAAM;KACpB,iBAAiB;KACjB,4BAA4B,MAAM,MAAM,OAAO;KAC/C,mBAAmB,MAAM,MAAM,OAAO;IACxC,CAAC;IAED,MAAM,WAAW,OAAO,kBAAkB,WAAW;IAErD,OAAO,YAAY,OAAO,EAAE,KAAK,CAAC,CAAC,OACjC,EAAE,aAAa;KACb;KACA,iBAAiB,UAAU;KAC3B,iBAAiB;KACjB;KACA,kBAAkB;KAClB,4BACE,MACA,KAAK,IACH,MAAM,OAAO,UAAU,OAAO,cAC9B,MAAM,OAAO,UAAU,WAAW,cAClC,MAAM,OAAO,UAAU,QAAQ,YACjC;IACJ,CAAC,CACH;IAEA,MAAM,OAAO,OAAO,WAClB,SACA,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,UAAU,MAAM,QAAQ,CAAC,GAClE,KACF;IAEA,IACE,KAAK,WAAW,KAChB,EAAE,OAAO,cACP,SACA,KAAK,IACL,aACA,UAAU,iBACV,QACF,IAEA,OAAO,OAAO,YAAY;IAE5B,MAAM,gBACJ,MACA,KAAK,IACH,MAAM,OAAO,UAAU,OAAO,cAC9B,MAAM,OAAO,UAAU,WAAW,cAClC,MAAM,OAAO,UAAU,QAAQ,YACjC;IAEF,KACG,OAAO,EAAE,cAAc,KAAK,EAAE,CAAC,EAAE,WAAW,OAAO,QACnD,OAAO,EAAE,cAAc,KAAK,EAAE,CAAC,EAAE,qBAAqB,OAAO,kBAC7D,OAAO,cAAc,YAAY,8BACjC,MAAM,eAAe,KAAA,KACpB,EAAE,OAAO,uBACP,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MAAM,UACR,IAEF,OAAO,OAAO,YAAY;IAE5B,OAAO,QAAQ;KAAE,MAAM;KAAY;IAAY,GAAG,OAAO;GAC3D,CAAC,CACH;EACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,eAAe,YAAY,YACzB,OAAO,IAAI,aAAa;GACtB,MAAM,cAAc,OAAO,oCAAoC,WAAW,WAAW,GACnF,QAAQ,OAAO,8BAA8B,WAAW,KAAK;GAE/D,MAAM,WAAW,OAAO,kBAAkB,WAAW,GACnD,gBAAgB,OAAO,4BAA4B,KAAK;GAE1D,KAAK,OAAO,kBAAkB,cAAc,KAAK,CAAC,OAAO,UACvD,OAAO,OAAO,YAAY;GAE5B,OAAO,OAAO,MACZ,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IAEvB,OAAO,WAAW,SAAS,eAAe,YAAY,QAAQ;IAC9D,MAAM,YAAY,OAAO,iBAAiB,SAAS,eAAe,WAAW;IAE7E,IAAI,cAAc,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;IAE/D,MAAM,OAAO,OAAO,WAChB,SACA,IAAI,GAAG,EAAE,UAAU,YAAY,QAAQ,GAAG,GAAG,EAAE,UAAU,YAAY,QAAQ,CAAC,GAC9E,cAAc,OAChB,GACA,MAAM,KAAK;IAEb,MAAM,MAAM,OAAO;IAEnB,IACE,KAAK,WAAW,KAChB,EAAE,OAAO,cACP,SACA,KACA,aACA,UAAU,iBACV,QACF,MACA,MAAM,MAAM,kBACZ,OAAO,YAAY,8BACnB,OAAO,MAAM,iBAEb,OAAO,QAAQ,YAAY,OAAO;IACpC,OAAO,YACJ,OAAO,EAAE,KAAK,CAAC,CACf,IAAI,EAAE,YAAY;KAAE;KAAO,UAAU;IAAc,CAAC,CAAC,CAAC,CACtD,MAAM,aAAa,SAAS,GAAG,CAAC;IAEnC,MAAM,QAAQ,OAAO,WACnB,SACA,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,UAAU,MAAM,QAAQ,CAAC,GAClE,KACF;IAEA,IACE,MAAM,WAAW,KACjB,EAAE,OAAO,cACP,SACA,MAAM,IACN,OACA,UAAU,iBACV,aACF,OACC,OAAO,WACN,SACA,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,YAAY,IAAI,EAAE,WAAW,GAClC,GAAG,EAAE,sBAAsB,IAAI,EAAE,qBAAqB,CACxD,GACA,KACF,EAAA,CAAG,WAAW,GAEd,OAAO,OAAO,YAAY;IAC5B,KACG,OAAO,cAAc,YAAY,+BACjC,OAAO,cAAc,MAAM,iBAE5B,OAAO,OAAO,YAAY;IAE5B,OAAO,QAAQ,aAAa,OAAO;GACrC,CAAC,CACH;EACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,UAAU,eACR,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,OAAO,aAAa,YAAY,CAAC,CAAC,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,KACxE,OAAO,SAAS,WAAW,CAC7B;GA0DA,QAAO,OAxDeA,kBAAO,SAC3B,UACA,eACA,OAAO,IAAI,aAAa;IACtB,IACE,CAAC,MAAM,OAAO,KACd,EAAE,OAAO,WAAW,SAAS,eAAe,MAAM,UAAU,KAAK,IAEjE,OAAO,KAAA;IAET,MAAM,OAAO,OAAO,WAClB,SACA,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,YAAY,MAAM,UAAU,GACjC,GAAG,EAAE,QAAQ,MAAM,MAAM,GACzB,GAAG,EAAE,OAAO,EAAE,OAAO,KAAK,CAC5B,GACA,KACF;IAEA,IAAI,KAAK,WAAW,GAAG,OAAO,KAAA;IAC9B,MAAM,WAAW,OAAO,4BAA4B,KAAK,EAAE,CAAC,EAAE,SAAS;IACvE,MAAM,YAAY,OAAO,iBAAiB,SAAS,eAAe,QAAQ;IAE1E,IAAI,cAAc,KAAA,GAAW,OAAO,KAAA;IAEpC,MAAM,SAAS,OAAO,WACpB,SACA,aAAa,SAAS,KAAK,EAAE,GAC7B,cAAc,OAChB;IAEA,MAAM,MAAM,OAAO;IAEnB,IACE,OAAO,WAAW,KAClB,MAAM,SAAS,kBACf,OAAO,SAAS,mBAChB,SAAS,aAAa,MAAM,YAC5B,SAAS,eAAe,MAAM,cAC9B,SAAS,WAAW,MAAM,UAC1B,EAAE,OAAO,cACP,SACA,OAAO,IACP,UACA,UAAU,iBACV,OAAO,4BAA4B,QAAQ,CAC7C,IAEA,OAAO,KAAA;IAET,OAAO;KAAE,QAAQ;KAAU,oBAAoB,UAAU;IAAY;GACvE,CAAC,CACH,OAEkB,OAAO,iBAAiB,KAAK,CAAC,CAAC;EACnD,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,uBACF;EACF,WAAW,OAAO,YAChB,SAAS,OAAO,OAAO,CAAC,CAAC,KACvB,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,iBAAiB,OAAO,YACtB,SAAS,OAAO,OAAO,CAAC,CAAC,KACvB,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,SAAS,YAAY,YACnB,OAAO,IAAI,aAAa;GACtB,MAAM,SAAS,OAAO,8BAA8B,WAAW,MAAM,GACnE,WAAW,OAAO,4BAA4B,MAAM;GAEtD,OAAO,OAAO,MACZ,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO;IAEvB,OAAO,WAAW,SAAS,eAAe,OAAO,QAAQ;IACzD,MAAM,YAAY,OAAO,iBAAiB,SAAS,eAAe,MAAM;IAExE,IAAI,cAAc,KAAA,GAAW,OAAO,QAAQ,OAAO,OAAO;IAE1D,MAAM,OAAO,OAAO,WAClB,SACA,IAAI,GAAG,EAAE,UAAU,OAAO,QAAQ,GAAG,GAAG,EAAE,UAAU,OAAO,QAAQ,CAAC,GACpE,cAAc,OAChB;IAEA,MAAM,MAAM,OAAO;IAEnB,IACE,KAAK,WAAW,KAChB,MAAM,OAAO,kBACb,OAAO,OAAO,mBACd,EAAE,OAAO,cACP,SACA,KAAK,IACL,QACA,UAAU,iBACV,QACF,IAEA,OAAO,QAAQ,OAAO,OAAO;IAC/B,OAAO,SAAS,SAAS,KAAK,IAAI,WAAW;IAE7C,OAAO,QAAQ,MAAM,OAAO;GAC9B,CAAC,CACH;EACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,UAAU,YAAY,YACpB,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,GAAG,WAAW;GAE9B,IAAI,CAAC,OAAO,cAAc,MAAM,KAAK,KAAK,MAAM,QAAQ,KAAK,MAAM,QAAQ,KACzE,OAAO,OAAO,YAAY;GAE5B,OAAO,OAAO,MACZ,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IAEvB,IAAI,EAAE,OAAO,WAAW,SAAS,eAAe,MAAM,UAAU,KAAK,IACnE,OAAO,QAAQ;KAAE,SAAS;KAAG,SAAS;IAAM,GAAG,OAAO;IACxD,MAAM,MAAM,EAAE,cAAc,OAAO,SAAS;IAE5C,MAAM,MAAM,IACV,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GACE,IAAI,IAAI,EAAE,aAAa,GAAG,GAAG,IAAI,EAAE,sBAAsB,GAAG,CAAC,GAC7D,IACE,UAAU,EAAE,QAAQ,GACpB,GACE,IAAI,GAAG,EAAE,OAAO,EAAE,OAAO,SAAS,GAAG,IAAI,EAAE,sBAAsB,GAAG,CAAC,GACrE,IAAI,GAAG,EAAE,OAAO,EAAE,OAAO,KAAK,GAAG,IAAI,EAAE,WAAW,GAAG,CAAC,CACxD,CACF,CACF,CACF;IAEA,MAAM,OAAO,OAAO,KAClB,YACG,OAAO,CAAC,CACR,KAAK,EAAE,KAAK,CAAC,CACb,MAAM,GAAG,CAAC,CACV,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,CAChC,MAAM,MAAM,QAAQ,CAAC,GACxB,cAAc,OAChB;IAEA,IAAI,UAAU;IAEd,KAAK,MAAM,OAAO,KAAK,MAAM,GAAG,MAAM,KAAK,GAYzC,KAVG,OAAO,WACN,SACA,IACE,aAAa,SAAS,GAAG,GACzB,IAAI,EAAE,aAAa,GAAG,GACtB,IAAI,EAAE,sBAAsB,GAAG,CACjC,GACA,KACF,EAAA,CAAG,WAAW,GAEH;KACX,OAAO,YAAY,OAAO,EAAE,KAAK,CAAC,CAAC,MAAM,aAAa,SAAS,GAAG,CAAC;KACnE,KACG,OAAO,WACN,SACA,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,UAAU,IAAI,EAAE,SAAS,CAAC,GACnE,KACF,EAAA,CAAG,QAEH,OAAO,OAAO,YAAY;KAC5B;IACF,OAAO,OAAO,SAAS,SAAS,KAAK,SAAS;IAGhD,OAAO,QACL;KACE;KACA,UACG,OAAO,KAAK,YAAY,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,EAAA,CACvE,SAAS;IAChB,GACA,OACF;GACF,CAAC,CACH;EACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;CAGU;AAChB,CACF;AAEA,MAAa,4BAA4B;CACvC;CACA;CACA;CACA;CACA;CACA;CACA;AACF"}
+{"version":3,"file":"password-prepared-sql.mjs","names":["kernel"],"sources":["../../src/drizzle/password-prepared-sql.ts"],"sourcesContent":["import {\n  type NativeDatabase,\n  CurrentPasswordPreparedTransaction,\n  PasswordPreparedPostconditions,\n  PasswordPreparedJournalGuards,\n} from \"@yielded/auth-persistence/Adapter\";\nimport { CurrentCommitJournal, LifecycleHooks, HookConfigurationError } from \"@yielded/auth/Hooks\";\nimport {\n  PasswordUnavailable,\n  PasswordRejected,\n  PasswordPreparedVersion,\n  decodePasswordPreparedReady,\n  encodePasswordPreparedReady,\n  snapshotPasswordPreparedReady,\n  snapshotPasswordPreparedReservation,\n  type PasswordPreparedReady,\n  type PasswordPreparedReservation,\n  snapshotPasswordCredential,\n  snapshotPasswordRequirement,\n  type PasswordMutationDecision,\n  type PreparePasswordCommit,\n  type PasswordPreparedPersistence,\n  type PasswordPreparedMutation,\n} from \"@yielded/auth/Password\";\nimport { reportPersistenceFailure } from \"@yielded/auth/Persistence\";\nimport { type ProofCompletionPlan, ProofUnavailable, ProofBinding } from \"@yielded/auth/Proofs\";\nimport { AuthenticationRevision } from \"@yielded/auth/Sessions\";\n/* oxlint-disable no-explicit-any -- concrete driver makers retain consumer table types. */\nimport { and, count, eq, gt, isNotNull, isNull, lte, or, type SQL } from \"drizzle-orm\";\nimport { Cause, DateTime, Effect, Option, Predicate, Redacted, Schema } from \"effect\";\n\nimport { column } from \"./model\";\nimport {\n  requiredPasswordPreparedConstraints,\n  type AnyPasswordPreparedPersistenceMapping,\n  type PasswordPreparedState,\n} from \"./password-prepared-model\";\nimport {\n  ContextInput,\n  CompletionInput,\n  encodeReservation,\n  evidenceCurrent,\n  identifierScope,\n  reservationOf,\n  sameRevision,\n  snapshotMutation,\n  snapshotReserve,\n  unavailable,\n} from \"./password-prepared-state\";\nimport {\n  CurrentPasswordSql,\n  passwordSqlKernel as kernel,\n  type PasswordSqlConfiguration,\n  type PasswordSqlQuery,\n} from \"./password-sql\";\nimport { checkProofCompletionIn, completeProofPlanIn } from \"./proof-sql\";\nimport { validateDrizzleStorage } from \"./storage-validation\";\n\nconst translateFailure = <A, E, R>(\n  effect: Effect.Effect<A, E, R>,\n): Effect.Effect<A, PasswordUnavailable, R> =>\n  reportPersistenceFailure(\n    effect,\n    (error) =>\n      Schema.is(PasswordUnavailable)(error) ||\n      Schema.is(ProofUnavailable)(error) ||\n      Schema.is(HookConfigurationError)(error),\n  ).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));\n\nconst translateContextFailure = <A, E, R>(\n  effect: Effect.Effect<A, E, R>,\n): Effect.Effect<A, PasswordUnavailable | PasswordRejected, R> =>\n  reportPersistenceFailure(\n    effect,\n    (error) =>\n      Schema.is(PasswordUnavailable)(error) ||\n      Schema.is(PasswordRejected)(error) ||\n      Schema.is(ProofUnavailable)(error) ||\n      Schema.is(HookConfigurationError)(error),\n  ).pipe(\n    Effect.catchCause((cause) =>\n      Effect.failCause(\n        Cause.map(cause, (error) => (Schema.is(PasswordRejected)(error) ? error : unavailable())),\n      ),\n    ),\n  );\n\ntype Mapping = AnyPasswordPreparedPersistenceMapping;\nconst nowMillis = DateTime.now.pipe(Effect.map(DateTime.toEpochMillis));\n\nconst read = (query: PasswordSqlQuery, locking: boolean) =>\n  locking && typeof query.for === \"function\" ? query.for(\"update\") : query;\n\nconst columns = (mapping: Mapping) => {\n  const table = mapping.intent;\n\n  return {\n    moduleId: column(table.table, table.moduleId),\n    intentId: column(table.table, table.intentId),\n    commandId: column(table.table, table.commandId),\n    subjectId: column(table.table, table.subjectId),\n    action: column(table.table, table.action),\n    generation: column(table.table, table.generation),\n    version: column(table.table, table.version),\n    state: column(table.table, table.state),\n    digest: column(table.table, table.digest),\n    snapshot: column(table.table, table.snapshot),\n    identifierScope: column(table.table, table.identifierScope),\n    createdAt: column(table.table, table.createdAt),\n    admittedAt: column(table.table, table.admittedAt),\n    admissionRetainUntil: column(table.table, table.admissionRetainUntil),\n    preparationExpiresAt: column(table.table, table.preparationExpiresAt),\n    expiresAt: column(table.table, table.expiresAt),\n    retainUntil: column(table.table, table.retainUntil),\n  };\n};\n\nconst valid = (mapping: Mapping) =>\n  Object.entries(requiredPasswordPreparedConstraints).every(\n    ([key, value]) =>\n      mapping.constraints[key as keyof typeof requiredPasswordPreparedConstraints] === value,\n  );\n\nconst lockAnchor = Effect.fn(\"DrizzlePasswordPrepared.lockAnchor\")(function* (\n  mapping: Mapping,\n  configuration: PasswordSqlConfiguration,\n  moduleId: string,\n  create = true,\n) {\n  const database = yield* CurrentPasswordSql;\n\n  const a = mapping.admission,\n    key = column(a.table, a.moduleId);\n\n  if (create)\n    yield* configuration.insertIfAbsent(\n      database.insert(a.table).values(a.encodeInsert(moduleId)),\n      a.moduleId,\n      moduleId,\n    );\n\n  const rows = yield* read(\n    database.select().from(a.table).where(eq(key, moduleId)).limit(2),\n    configuration.locking,\n  );\n\n  if (rows.length > 1 || (create && rows.length !== 1)) return yield* unavailable();\n\n  return rows.length === 1;\n});\n\nconst bindingJson = Schema.encodeSync(Schema.fromJsonString(ProofBinding));\n\nconst captureAuthority = Effect.fn(\"DrizzlePasswordPrepared.captureAuthority\")(function* (\n  mapping: Mapping,\n  configuration: Pick<PasswordSqlConfiguration, \"locking\">,\n  input: {\n    readonly moduleId: string;\n    readonly action: PasswordPreparedReservation[\"action\"];\n    readonly subjectId: string;\n    readonly reset?: PasswordPreparedReservation[\"reset\"];\n  },\n) {\n  const database = yield* CurrentPasswordSql;\n\n  const p = mapping.password;\n  const locked = yield* kernel.lockSubject(p, input.subjectId, configuration.locking);\n\n  if (locked.row === undefined || !p.subject.isActiveStatus(locked.row[p.subject.status]))\n    return undefined;\n\n  const ic = kernel.identifierColumns(p),\n    ac = kernel.authorityCredentialColumns(p);\n\n  let identifier: any;\n\n  if (input.action !== \"add-password\") {\n    if (input.reset !== undefined)\n      identifier = (yield* kernel.lockIdentifier(\n        p,\n        input.reset.binding.identifier,\n        configuration.locking,\n      ))[0];\n    else {\n      const discovered = (yield* read(\n        database\n          .select()\n          .from(p.identifier.table)\n          .where(eq(ic.subjectId, locked.nativeSubjectId))\n          .orderBy(ic.namespace, ic.value),\n        false,\n      )).find((row: any) => p.identifier.isCurrent(row));\n\n      if (discovered !== undefined)\n        identifier = (yield* kernel.lockIdentifier(\n          p,\n          {\n            namespace: discovered[p.identifier.namespace],\n            value: discovered[p.identifier.value],\n          } as any,\n          configuration.locking,\n        ))[0];\n    }\n    if (\n      identifier === undefined ||\n      !p.identifier.isCurrent(identifier) ||\n      !p.subjectId.equals(identifier[p.identifier.subjectId], locked.nativeSubjectId)\n    )\n      return undefined;\n  }\n\n  const credential = (yield* kernel.readPasswordCredential(\n    p,\n    input.moduleId,\n    locked.nativeSubjectId,\n    configuration.locking,\n  ))[0];\n\n  if ((input.action === \"add-password\") !== (credential === undefined)) return undefined;\n\n  const snapshot =\n    credential === undefined\n      ? undefined\n      : yield* p.credential\n          .decode({ moduleId: input.moduleId, subject: locked.row, identifier, credential })\n          .pipe(Effect.flatMap(snapshotPasswordCredential));\n\n  if (\n    snapshot !== undefined &&\n    (snapshot.moduleId !== input.moduleId ||\n      snapshot.revision.subjectId !== input.subjectId ||\n      snapshot.revision.securityRevision !== locked.row[p.subject.securityRevision] ||\n      snapshot.credentialId !== credential[p.credential.credentialId] ||\n      snapshot.credentialRevision !== credential[p.credential.credentialRevision] ||\n      snapshot.verifierVersion !== credential[p.credential.verifierVersion] ||\n      Redacted.value(snapshot.verifier) !== credential[p.credential.verifier] ||\n      snapshot.normalization !== credential[p.credential.normalization] ||\n      snapshot.identifier.namespace !== identifier[p.identifier.namespace] ||\n      snapshot.identifier.value !== identifier[p.identifier.value] ||\n      snapshot.identifierBindingRevision !== identifier[p.identifier.bindingRevision])\n  )\n    return undefined;\n\n  const factors = yield* read(\n    database\n      .select()\n      .from(p.authorityCredential.table)\n      .where(eq(ac.subjectId, locked.nativeSubjectId))\n      .orderBy(ac.credentialId),\n    configuration.locking,\n  );\n\n  const active = factors.filter(\n    (row: any) =>\n      p.authorityCredential.status === undefined ||\n      p.authorityCredential.isActiveStatus?.(row[p.authorityCredential.status]) === true,\n  );\n\n  if (active.length > 64) return yield* unavailable();\n\n  const revision =\n    snapshot?.revision ??\n    AuthenticationRevision.make({\n      subjectId: input.subjectId as any,\n      securityRevision: locked.row[p.subject.securityRevision],\n      credentials: active.map((row: any) => ({\n        credentialId: row[p.authorityCredential.credentialId],\n        revision: row[p.authorityCredential.revision],\n      })),\n    });\n\n  if (\n    revision.credentials.some(\n      (expected) =>\n        !active.some(\n          (row: any) =>\n            row[p.authorityCredential.credentialId] === expected.credentialId &&\n            row[p.authorityCredential.revision] === expected.revision,\n        ),\n    )\n  )\n    return undefined;\n\n  const requirement = yield* p.subject\n    .decodeActionRequirement(locked.row, input.action)\n    .pipe(Effect.flatMap(snapshotPasswordRequirement));\n\n  return { ...locked, identifier, snapshot, revision, requirement };\n});\n\nconst currentAuthority = Effect.fn(\"DrizzlePasswordPrepared.currentAuthority\")(function* (\n  mapping: Mapping,\n  configuration: Pick<PasswordSqlConfiguration, \"locking\">,\n  record: PasswordPreparedReservation | PasswordPreparedReady,\n) {\n  const current = yield* captureAuthority(mapping, configuration, {\n    moduleId: record.moduleId,\n    action: record.action,\n    subjectId: record.revision.subjectId,\n    ...(record.reset === undefined ? {} : { reset: record.reset }),\n  });\n\n  if (\n    current === undefined ||\n    !sameRevision(current.revision, record.revision) ||\n    (current.snapshot === undefined\n      ? record.credential !== undefined\n      : record.credential === undefined ||\n        !kernel.sameCredentialSnapshot(current.snapshot, record.credential))\n  )\n    return undefined;\n\n  return current;\n});\n\nconst rowCondition = (mapping: Mapping, row: any) => {\n  const c = columns(mapping);\n\n  return and(\n    ...Object.entries(c).map(([key, value]) => {\n      const field = mapping.intent[key as keyof typeof c],\n        item = row[field];\n\n      return Predicate.isNullish(item) ? isNull(value) : eq(value, item);\n    }),\n  )!;\n};\n\nconst readIntent = Effect.fn(\"Drizzle.readIntent\")(function* (\n  mapping: Mapping,\n  condition: SQL,\n  locking: boolean,\n) {\n  const database = yield* CurrentPasswordSql;\n\n  return yield* read(\n    database.select().from(mapping.intent.table).where(condition).limit(2),\n    locking,\n  );\n});\n\nconst recordMatches = Effect.fn(\"DrizzlePasswordPrepared.recordMatches\")(function* (\n  mapping: Mapping,\n  row: any,\n  record: PasswordPreparedReservation | PasswordPreparedReady,\n  nativeSubjectId: unknown,\n  snapshot: string,\n) {\n  const t = mapping.intent,\n    p = mapping.password;\n\n  if (\n    row === undefined ||\n    row[t.moduleId] !== record.moduleId ||\n    row[t.intentId] !== record.intentId ||\n    row[t.commandId] !== record.commandId ||\n    !p.subjectId.equals(row[t.subjectId], nativeSubjectId) ||\n    row[t.action] !== record.action ||\n    row[t.generation] !== record.generation ||\n    row[t.version] !== record.version ||\n    row[t.state] !== t.states[record._tag] ||\n    row[t.snapshot] !== snapshot ||\n    row[t.identifierScope] !== identifierScope(record) ||\n    (record._tag === \"Ready\"\n      ? row[t.digest] !== record.digest\n      : !Predicate.isNullish(row[t.digest]))\n  )\n    return false;\n  for (const [key, instant] of [\n    [t.createdAt, record.createdAtMillis],\n    [t.preparationExpiresAt, record.preparationExpiresAtMillis],\n    [t.retainUntil, record.retainUntilMillis],\n  ] as const)\n    if ((yield* p.decodeInstant(row[key])) !== instant) return false;\n\n  return record._tag === \"Ready\"\n    ? (yield* p.decodeInstant(row[t.expiresAt])) === record.expiresAtMillis\n    : Predicate.isNullish(row[t.expiresAt]);\n});\n\nconst terminal = Effect.fn(\"DrizzlePasswordPrepared.terminal\")(function* (\n  mapping: Mapping,\n  row: any,\n  state: Exclude<PasswordPreparedState, \"Preparing\" | \"Ready\">,\n) {\n  const database = yield* CurrentPasswordSql;\n\n  yield* database\n    .update(mapping.intent.table)\n    .set(mapping.intent.encodeTerminal(state))\n    .where(rowCondition(mapping, row));\n\n  const c = columns(mapping),\n    t = mapping.intent;\n\n  const rows = yield* readIntent(\n    mapping,\n    and(eq(c.moduleId, row[t.moduleId]), eq(c.intentId, row[t.intentId]))!,\n    false,\n  );\n\n  const expected = { ...row, [t.state]: t.states[state], [t.snapshot]: null, [t.digest]: null };\n\n  if (\n    rows.length !== 1 ||\n    (yield* readIntent(mapping, rowCondition(mapping, expected), false)).length !== 1\n  )\n    return yield* unavailable();\n});\n\nexport const makeSqlPasswordPreparedPersistence = Effect.fn(\"makeSqlPasswordPreparedPersistence\")(\n  function* (\n    mapping: Mapping,\n    configuration: PasswordSqlConfiguration,\n  ): Effect.fn.Return<\n    PasswordPreparedPersistence,\n    PasswordUnavailable,\n    LifecycleHooks | CurrentPasswordSql | NativeDatabase\n  > {\n    const database = yield* CurrentPasswordSql;\n\n    if (!configuration.coordinated)\n      yield* validateDrizzleStorage({\n        ...mapping,\n        proof: configuration.proof?.mapping,\n      }).pipe(Effect.mapError(unavailable));\n    const hooks = yield* LifecycleHooks;\n\n    const p = mapping.password,\n      c = columns(mapping),\n      t = mapping.intent;\n\n    const owned = <A, E, R>(body: Effect.Effect<A, E, R>) =>\n      valid(mapping)\n        ? kernel.owned(\n            database,\n            p,\n            configuration,\n            Effect.gen(function* () {\n              const journal = yield* CurrentCommitJournal;\n              const guards = yield* Effect.serviceOption(PasswordPreparedJournalGuards);\n\n              if (Option.isSome(guards) && !guards.value.register(journal.prepare(undefined)))\n                return yield* unavailable();\n\n              return yield* body;\n            }),\n          )\n        : Effect.fail(unavailable());\n\n    const complete = <A>(\n      uncaptured: PasswordPreparedMutation & { readonly completion?: ProofCompletionPlan },\n      prepare: PreparePasswordCommit<PasswordMutationDecision, A>,\n    ) =>\n      Effect.gen(function* () {\n        const input = yield* snapshotMutation(uncaptured);\n\n        const completion =\n          uncaptured.completion === undefined\n            ? undefined\n            : {\n                prepare: uncaptured.completion.prepare,\n                input: yield* Schema.encodeEffect(Schema.fromJsonString(CompletionInput))(\n                  uncaptured.completion.input,\n                ).pipe(\n                  Effect.flatMap(Schema.decodeEffect(Schema.fromJsonString(CompletionInput))),\n                  Effect.mapError(unavailable),\n                ),\n              };\n\n        if (\n          (input.intent.action === \"reset-password\") !== (completion !== undefined) ||\n          (completion !== undefined && configuration.proof === undefined)\n        )\n          return yield* unavailable();\n\n        return yield* owned(\n          Effect.gen(function* () {\n            const transaction = yield* CurrentPasswordSql;\n            const journal = yield* CurrentCommitJournal;\n\n            yield* lockAnchor(mapping, configuration, input.intent.moduleId);\n\n            const authority = yield* kernel.validateMutationAuthority(\n              p,\n              configuration,\n              input.mutation,\n              input.intent.action,\n            );\n\n            if (authority === undefined) return prepare(\"rejected\", journal);\n            const current = yield* currentAuthority(mapping, configuration, input.intent);\n\n            if (current === undefined) return prepare(\"rejected\", journal);\n\n            const rows = yield* readIntent(\n              mapping,\n              and(eq(c.moduleId, input.intent.moduleId), eq(c.intentId, input.intent.intentId))!,\n              configuration.locking,\n            );\n\n            const row = rows[0],\n              encoded = yield* encodePasswordPreparedReady(input.intent);\n\n            if (\n              rows.length !== 1 ||\n              !(yield* recordMatches(\n                mapping,\n                row,\n                input.intent,\n                current.nativeSubjectId,\n                encoded,\n              )) ||\n              !evidenceCurrent(input, current.requirement, yield* nowMillis) ||\n              (yield* kernel.commandExists(\n                p,\n                input.intent.moduleId,\n                input.intent.commandId,\n                configuration.locking,\n              )).length !== 0\n            )\n              return prepare(\"rejected\", journal);\n            if (\n              completion !== undefined &&\n              (input.intent.reset === undefined ||\n                completion.input.continuationId !== input.intent.reset.continuationId ||\n                bindingJson(completion.input.binding) !== bindingJson(input.intent.reset.binding) ||\n                !kernel.proofCompletionMatchesPassword({ ...input.mutation, completion }))\n            )\n              return prepare(\"rejected\", journal);\n\n            const credentialRevision = yield* kernel.allocate(\n              configuration.mode,\n              p.allocateRevision,\n              p.allocateRevisionSync,\n            );\n\n            const verifierVersion = yield* kernel.allocate(\n              configuration.mode,\n              p.allocateRevision,\n              p.allocateRevisionSync,\n            );\n\n            const nextSecurityRevision = yield* kernel.allocateNextSecurityRevision(\n              p,\n              configuration.mode,\n              input.intent.revision.securityRevision,\n            );\n\n            if (\n              nextSecurityRevision === input.intent.revision.securityRevision ||\n              credentialRevision === input.intent.credential?.credentialRevision ||\n              verifierVersion === input.intent.credential?.verifierVersion\n            )\n              return yield* unavailable();\n\n            const credentialId =\n              input.intent.action === \"add-password\"\n                ? yield* kernel.allocate(\n                    configuration.mode,\n                    p.allocateCredentialId,\n                    p.allocateCredentialIdSync,\n                  )\n                : undefined;\n\n            let appliedAt: number | undefined;\n\n            const assertApplied = Effect.fn(\"DrizzlePasswordPrepared.assertApplied\")(() =>\n              Effect.flatMap(CurrentPasswordPreparedTransaction, (currentTransaction) =>\n                Effect.gen(function* () {\n                  if (appliedAt === undefined) return;\n\n                  if (\n                    !(yield* kernel.checkMutationApplied(\n                      p,\n                      input.mutation,\n                      current.nativeSubjectId,\n                      {\n                        credentialId: credentialId ?? input.intent.credential!.credentialId,\n                        credentialRevision,\n                        verifierVersion,\n                        nextSecurityRevision,\n                      },\n                      appliedAt,\n                    )) ||\n                    (yield* readIntent(\n                      mapping,\n                      rowCondition(mapping, {\n                        ...row,\n                        [t.state]: t.states.Consumed,\n                        [t.snapshot]: null,\n                        [t.digest]: null,\n                      }),\n                      false,\n                    )).length !== 1 ||\n                    !evidenceCurrent(input, current.requirement, yield* nowMillis)\n                  )\n                    return yield* unavailable();\n                }).pipe(Effect.provideService(CurrentPasswordSql, currentTransaction)),\n              ),\n            );\n\n            const validateApplied = Effect.gen(function* () {\n              yield* assertApplied().pipe(\n                Effect.provideService(CurrentPasswordPreparedTransaction, transaction),\n              );\n              if (appliedAt === undefined) return;\n              const postconditions = yield* Effect.serviceOption(PasswordPreparedPostconditions);\n\n              if (\n                Option.isSome(postconditions) &&\n                !postconditions.value.register(assertApplied().pipe(translateFailure))\n              )\n                return yield* unavailable();\n            });\n\n            const apply = Effect.fn(\"DrizzlePasswordPrepared.apply\")(function* () {\n              const finalNow = yield* nowMillis;\n\n              if (!evidenceCurrent(input, current.requirement, finalNow)) return false;\n\n              const changed =\n                input.intent.action === \"add-password\"\n                  ? yield* kernel.addPasswordIn(\n                      p,\n                      configuration,\n                      input.mutation,\n                      {\n                        credentialId: credentialId!,\n                        credentialRevision,\n                        verifierVersion,\n                        nextSecurityRevision,\n                      },\n                      finalNow,\n                    )\n                  : yield* kernel.writeReplacement(\n                      p,\n                      input.mutation,\n                      current.nativeSubjectId,\n                      { credentialRevision, verifierVersion, nextSecurityRevision },\n                      finalNow,\n                    );\n\n              if (!changed) return yield* unavailable();\n              appliedAt = finalNow;\n              yield* terminal(mapping, row, \"Consumed\");\n              if (!evidenceCurrent(input, current.requirement, yield* nowMillis))\n                return yield* unavailable();\n\n              return true;\n            });\n\n            if (completion !== undefined) {\n              let receipt: ReturnType<typeof prepare> | undefined;\n\n              yield* completeProofPlanIn(\n                configuration.proof!.mapping,\n                configuration.proof!.configuration,\n                completion,\n                Effect.gen(function* () {\n                  return yield* apply();\n                }),\n                (decision) => {\n                  receipt = prepare(decision === \"completed\" ? \"changed\" : \"rejected\", journal);\n\n                  return decision;\n                },\n              );\n\n              yield* validateApplied;\n\n              return receipt ?? prepare(\"rejected\", journal);\n            }\n\n            const changed = yield* apply();\n\n            yield* validateApplied;\n\n            return prepare(changed ? \"changed\" : \"rejected\", journal);\n          }),\n        );\n      });\n\n    const services: PasswordPreparedPersistence = {\n      reserve: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const input = yield* snapshotReserve(uncaptured);\n\n          if (\n            (input.action === \"reset-password\") !==\n              (input.reset !== undefined && input.completion !== undefined) ||\n            (input.action === \"reset-password\" && configuration.proof === undefined) ||\n            input.generation !== input.policy.generation ||\n            input.policy.retentionMillis <\n              Math.max(\n                input.policy.preparationLifetimeMillis + input.policy.lifetimeMillis,\n                input.policy.admission.action.windowMillis,\n                input.policy.admission.identifier.windowMillis,\n                input.policy.admission.subject.windowMillis,\n              ) ||\n            (input.invalidation.existingSessions === \"immediate\" &&\n              p.sessionInvalidation !== \"same-authority-immediate\")\n          )\n            return yield* unavailable();\n\n          return yield* owned(\n            Effect.gen(function* () {\n              const transaction = yield* CurrentPasswordSql;\n              const journal = yield* CurrentCommitJournal;\n\n              yield* lockAnchor(mapping, configuration, input.moduleId);\n\n              const version = PasswordPreparedVersion.make(\n                yield* kernel.allocate(\n                  configuration.mode,\n                  mapping.allocateVersion,\n                  mapping.allocateVersionSync,\n                ),\n              );\n\n              const authority = yield* captureAuthority(mapping, configuration, input);\n\n              if (authority === undefined) return yield* unavailable();\n              if (input.reset !== undefined) {\n                if (\n                  input.completion === undefined ||\n                  input.completion.moduleId !== `${input.moduleId}/reset` ||\n                  input.completion.purpose !== \"password-reset\" ||\n                  input.reset.continuationId !== input.completion.continuationId ||\n                  bindingJson(input.reset.binding) !== bindingJson(input.completion.binding) ||\n                  input.reset.binding._tag !== \"Subject\" ||\n                  !sameRevision(input.reset.binding.revision, authority.revision) ||\n                  authority.snapshot?.identifierVerifiedAtMillis === undefined ||\n                  !(yield* checkProofCompletionIn(\n                    configuration.proof!.mapping,\n                    configuration.proof!.configuration,\n                    input.completion,\n                  ))\n                )\n                  return yield* unavailable();\n              }\n              if (\n                (yield* readIntent(\n                  mapping,\n                  and(eq(c.moduleId, input.moduleId), eq(c.commandId, input.commandId))!,\n                  configuration.locking,\n                )).length\n              )\n                return prepare({ _tag: \"Existing\" }, journal);\n\n              const now = yield* nowMillis,\n                nativeNow = p.encodeInstant(now);\n\n              const scope = identifierScope({\n                ...(authority.snapshot === undefined ? {} : { credential: authority.snapshot }),\n                revision: authority.revision,\n              });\n\n              const active =\n                (yield* read(\n                  transaction\n                    .select({ total: count() })\n                    .from(t.table)\n                    .where(\n                      and(\n                        eq(c.moduleId, input.moduleId),\n                        eq(c.subjectId, authority.nativeSubjectId),\n                        or(\n                          and(\n                            eq(c.state, t.states.Preparing),\n                            gt(c.preparationExpiresAt, nativeNow),\n                          ),\n                          and(eq(c.state, t.states.Ready), gt(c.expiresAt, nativeNow)),\n                        ),\n                      ),\n                    ),\n                  false,\n                ))[0]?.total ?? 0;\n\n              if (active >= input.policy.maximumPendingPerSubject) return yield* unavailable();\n              for (const [condition, budget] of [\n                [eq(c.action, input.action), input.policy.admission.action],\n                [eq(c.identifierScope, scope), input.policy.admission.identifier],\n                [eq(c.subjectId, authority.nativeSubjectId), input.policy.admission.subject],\n              ] as const) {\n                const total =\n                  (yield* read(\n                    transaction\n                      .select({ total: count() })\n                      .from(t.table)\n                      .where(\n                        and(\n                          eq(c.moduleId, input.moduleId),\n                          condition,\n                          gt(c.admittedAt, p.encodeInstant(now - budget.windowMillis)),\n                        ),\n                      ),\n                    false,\n                  ))[0]?.total ?? 0;\n\n                if (total >= budget.limit) return yield* unavailable();\n              }\n\n              const reservation = yield* snapshotPasswordPreparedReservation({\n                _tag: \"Preparing\",\n                moduleId: input.moduleId,\n                generation: input.generation,\n                intentId: input.intentId,\n                version,\n                commandId: input.commandId,\n                action: input.action,\n                revision: authority.revision,\n                ...(authority.snapshot === undefined ? {} : { credential: authority.snapshot }),\n                capturedRequirement: authority.requirement,\n                ...(input.reset === undefined ? {} : { reset: input.reset }),\n                invalidation: input.invalidation,\n                createdAtMillis: now,\n                preparationExpiresAtMillis: now + input.policy.preparationLifetimeMillis,\n                retainUntilMillis: now + input.policy.retentionMillis,\n              });\n\n              const snapshot = yield* encodeReservation(reservation);\n\n              yield* transaction.insert(t.table).values(\n                t.encodeInsert({\n                  reservation,\n                  nativeSubjectId: authority.nativeSubjectId,\n                  identifierScope: scope,\n                  snapshot,\n                  admittedAtMillis: now,\n                  admissionRetainUntilMillis:\n                    now +\n                    Math.max(\n                      input.policy.admission.action.windowMillis,\n                      input.policy.admission.identifier.windowMillis,\n                      input.policy.admission.subject.windowMillis,\n                    ),\n                }),\n              );\n\n              const rows = yield* readIntent(\n                mapping,\n                and(eq(c.moduleId, input.moduleId), eq(c.intentId, input.intentId))!,\n                false,\n              );\n\n              if (\n                rows.length !== 1 ||\n                !(yield* recordMatches(\n                  mapping,\n                  rows[0],\n                  reservation,\n                  authority.nativeSubjectId,\n                  snapshot,\n                ))\n              )\n                return yield* unavailable();\n\n              const admittedUntil =\n                now +\n                Math.max(\n                  input.policy.admission.action.windowMillis,\n                  input.policy.admission.identifier.windowMillis,\n                  input.policy.admission.subject.windowMillis,\n                );\n\n              if (\n                (yield* p.decodeInstant(rows[0][t.admittedAt])) !== now ||\n                (yield* p.decodeInstant(rows[0][t.admissionRetainUntil])) !== admittedUntil ||\n                (yield* nowMillis) >= reservation.preparationExpiresAtMillis ||\n                (input.completion !== undefined &&\n                  !(yield* checkProofCompletionIn(\n                    configuration.proof!.mapping,\n                    configuration.proof!.configuration,\n                    input.completion,\n                  )))\n              )\n                return yield* unavailable();\n\n              return prepare({ _tag: \"Reserved\", reservation }, journal);\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      publishReady: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const reservation = yield* snapshotPasswordPreparedReservation(uncaptured.reservation),\n            ready = yield* snapshotPasswordPreparedReady(uncaptured.ready);\n\n          const snapshot = yield* encodeReservation(reservation),\n            readySnapshot = yield* encodePasswordPreparedReady(ready);\n\n          if ((yield* encodeReservation(reservationOf(ready))) !== snapshot)\n            return yield* unavailable();\n\n          return yield* owned(\n            Effect.gen(function* () {\n              const transaction = yield* CurrentPasswordSql;\n              const journal = yield* CurrentCommitJournal;\n\n              yield* lockAnchor(mapping, configuration, reservation.moduleId);\n              const authority = yield* currentAuthority(mapping, configuration, reservation);\n\n              if (authority === undefined) return prepare(\"rejected\", journal);\n\n              const rows = yield* readIntent(\n                  mapping,\n                  and(eq(c.moduleId, reservation.moduleId), eq(c.intentId, reservation.intentId))!,\n                  configuration.locking,\n                ),\n                row = rows[0];\n\n              const now = yield* nowMillis;\n\n              if (\n                rows.length !== 1 ||\n                !(yield* recordMatches(\n                  mapping,\n                  row,\n                  reservation,\n                  authority.nativeSubjectId,\n                  snapshot,\n                )) ||\n                now < ready.issuedAtMillis ||\n                now >= reservation.preparationExpiresAtMillis ||\n                now >= ready.expiresAtMillis\n              )\n                return prepare(\"rejected\", journal);\n              yield* transaction\n                .update(t.table)\n                .set(t.encodeReady({ ready, snapshot: readySnapshot }))\n                .where(rowCondition(mapping, row));\n\n              const saved = yield* readIntent(\n                mapping,\n                and(eq(c.moduleId, ready.moduleId), eq(c.intentId, ready.intentId))!,\n                false,\n              );\n\n              if (\n                saved.length !== 1 ||\n                !(yield* recordMatches(\n                  mapping,\n                  saved[0],\n                  ready,\n                  authority.nativeSubjectId,\n                  readySnapshot,\n                )) ||\n                (yield* readIntent(\n                  mapping,\n                  and(\n                    eq(c.moduleId, ready.moduleId),\n                    eq(c.intentId, ready.intentId),\n                    eq(c.admittedAt, row[t.admittedAt]),\n                    eq(c.admissionRetainUntil, row[t.admissionRetainUntil]),\n                  )!,\n                  false,\n                )).length !== 1\n              )\n                return yield* unavailable();\n              if (\n                (yield* nowMillis) >= reservation.preparationExpiresAtMillis ||\n                (yield* nowMillis) >= ready.expiresAtMillis\n              )\n                return yield* unavailable();\n\n              return prepare(\"published\", journal);\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      context: (uncaptured) =>\n        Effect.gen(function* () {\n          const input = yield* Schema.decodeEffect(ContextInput)({ ...uncaptured }).pipe(\n            Effect.mapError(unavailable),\n          );\n\n          const record = yield* kernel.safeRead(\n            database,\n            configuration,\n            Effect.gen(function* () {\n              if (\n                !valid(mapping) ||\n                !(yield* lockAnchor(mapping, configuration, input.moduleId, false))\n              )\n                return undefined;\n\n              const rows = yield* readIntent(\n                mapping,\n                and(\n                  eq(c.moduleId, input.moduleId),\n                  eq(c.generation, input.generation),\n                  eq(c.digest, input.digest),\n                  eq(c.state, t.states.Ready),\n                )!,\n                false,\n              );\n\n              if (rows.length !== 1) return undefined;\n              const selected = yield* decodePasswordPreparedReady(rows[0][t.snapshot]);\n              const authority = yield* currentAuthority(mapping, configuration, selected);\n\n              if (authority === undefined) return undefined;\n\n              const locked = yield* readIntent(\n                mapping,\n                rowCondition(mapping, rows[0]),\n                configuration.locking,\n              );\n\n              const now = yield* nowMillis;\n\n              if (\n                locked.length !== 1 ||\n                now < selected.issuedAtMillis ||\n                now >= selected.expiresAtMillis ||\n                selected.moduleId !== input.moduleId ||\n                selected.generation !== input.generation ||\n                selected.digest !== input.digest ||\n                !(yield* recordMatches(\n                  mapping,\n                  locked[0],\n                  selected,\n                  authority.nativeSubjectId,\n                  yield* encodePasswordPreparedReady(selected),\n                ))\n              )\n                return undefined;\n\n              return { record: selected, currentRequirement: authority.requirement };\n            }),\n          );\n\n          return record ?? (yield* PasswordRejected.make({}));\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateContextFailure,\n        ),\n      complete: (input, prepare) =>\n        complete(input, prepare).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      resetWithProof: (input, prepare) =>\n        complete(input, prepare).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      cancel: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const record = yield* snapshotPasswordPreparedReady(uncaptured.record),\n            snapshot = yield* encodePasswordPreparedReady(record);\n\n          return yield* owned(\n            Effect.gen(function* () {\n              const journal = yield* CurrentCommitJournal;\n\n              yield* lockAnchor(mapping, configuration, record.moduleId);\n              const authority = yield* currentAuthority(mapping, configuration, record);\n\n              if (authority === undefined) return prepare(false, journal);\n\n              const rows = yield* readIntent(\n                mapping,\n                and(eq(c.moduleId, record.moduleId), eq(c.intentId, record.intentId))!,\n                configuration.locking,\n              );\n\n              const now = yield* nowMillis;\n\n              if (\n                rows.length !== 1 ||\n                now < record.issuedAtMillis ||\n                now >= record.expiresAtMillis ||\n                !(yield* recordMatches(\n                  mapping,\n                  rows[0],\n                  record,\n                  authority.nativeSubjectId,\n                  snapshot,\n                ))\n              )\n                return prepare(false, journal);\n              yield* terminal(mapping, rows[0], \"Cancelled\");\n\n              return prepare(true, journal);\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      cleanup: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const input = { ...uncaptured };\n\n          if (!Number.isSafeInteger(input.limit) || input.limit < 1 || input.limit > 1000)\n            return yield* unavailable();\n\n          return yield* owned(\n            Effect.gen(function* () {\n              const transaction = yield* CurrentPasswordSql;\n              const journal = yield* CurrentCommitJournal;\n\n              if (!(yield* lockAnchor(mapping, configuration, input.moduleId, false)))\n                return prepare({ removed: 0, hasMore: false }, journal);\n              const now = p.encodeInstant(yield* nowMillis);\n\n              const due = and(\n                eq(c.moduleId, input.moduleId),\n                or(\n                  and(lte(c.retainUntil, now), lte(c.admissionRetainUntil, now)),\n                  and(\n                    isNotNull(c.snapshot),\n                    or(\n                      and(eq(c.state, t.states.Preparing), lte(c.preparationExpiresAt, now)),\n                      and(eq(c.state, t.states.Ready), lte(c.expiresAt, now)),\n                    ),\n                  ),\n                ),\n              )!;\n\n              const rows = yield* read(\n                transaction\n                  .select()\n                  .from(t.table)\n                  .where(due)\n                  .orderBy(c.createdAt, c.intentId)\n                  .limit(input.limit + 1),\n                configuration.locking,\n              );\n\n              let removed = 0;\n\n              for (const row of rows.slice(0, input.limit)) {\n                const expired =\n                  (yield* readIntent(\n                    mapping,\n                    and(\n                      rowCondition(mapping, row),\n                      lte(c.retainUntil, now),\n                      lte(c.admissionRetainUntil, now),\n                    )!,\n                    false,\n                  )).length === 1;\n\n                if (expired) {\n                  yield* transaction.delete(t.table).where(rowCondition(mapping, row));\n                  if (\n                    (yield* readIntent(\n                      mapping,\n                      and(eq(c.moduleId, input.moduleId), eq(c.intentId, row[t.intentId]))!,\n                      false,\n                    )).length\n                  )\n                    return yield* unavailable();\n                  removed++;\n                } else yield* terminal(mapping, row, \"Expired\");\n              }\n\n              return prepare(\n                {\n                  removed,\n                  hasMore:\n                    (yield* read(transaction.select().from(t.table).where(due).limit(1), false))\n                      .length > 0,\n                },\n                journal,\n              );\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n    };\n\n    return services;\n  },\n);\n\nexport const passwordPreparedSqlKernel = {\n  columns,\n  recordMatches,\n  captureAuthority,\n  currentAuthority,\n  rowCondition,\n  valid,\n  identifierScope,\n};\n"],"mappings":";;;;;;;;;;;;;;;AA0DA,MAAM,oBACJ,WAEA,yBACE,SACC,UACC,OAAO,GAAG,mBAAmB,CAAC,CAAC,KAAK,KACpC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,sBAAsB,CAAC,CAAC,KAAK,CAC3C,CAAC,CAAC,KAAK,OAAO,YAAY,UAAU,OAAO,UAAU,MAAM,IAAI,aAAa,YAAY,CAAC,CAAC,CAAC,CAAC;AAE9F,MAAM,2BACJ,WAEA,yBACE,SACC,UACC,OAAO,GAAG,mBAAmB,CAAC,CAAC,KAAK,KACpC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,sBAAsB,CAAC,CAAC,KAAK,CAC3C,CAAC,CAAC,KACA,OAAO,YAAY,UACjB,OAAO,UACL,MAAM,IAAI,QAAQ,UAAW,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,IAAI,QAAQ,YAAY,CAAE,CAC1F,CACF,CACF;AAGF,MAAM,YAAY,SAAS,IAAI,KAAK,OAAO,IAAI,SAAS,aAAa,CAAC;AAEtE,MAAM,QAAQ,OAAyB,YACrC,WAAW,OAAO,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,IAAI;AAErE,MAAM,WAAW,YAAqB;CACpC,MAAM,QAAQ,QAAQ;CAEtB,OAAO;EACL,UAAU,OAAO,MAAM,OAAO,MAAM,QAAQ;EAC5C,UAAU,OAAO,MAAM,OAAO,MAAM,QAAQ;EAC5C,WAAW,OAAO,MAAM,OAAO,MAAM,SAAS;EAC9C,WAAW,OAAO,MAAM,OAAO,MAAM,SAAS;EAC9C,QAAQ,OAAO,MAAM,OAAO,MAAM,MAAM;EACxC,YAAY,OAAO,MAAM,OAAO,MAAM,UAAU;EAChD,SAAS,OAAO,MAAM,OAAO,MAAM,OAAO;EAC1C,OAAO,OAAO,MAAM,OAAO,MAAM,KAAK;EACtC,QAAQ,OAAO,MAAM,OAAO,MAAM,MAAM;EACxC,UAAU,OAAO,MAAM,OAAO,MAAM,QAAQ;EAC5C,iBAAiB,OAAO,MAAM,OAAO,MAAM,eAAe;EAC1D,WAAW,OAAO,MAAM,OAAO,MAAM,SAAS;EAC9C,YAAY,OAAO,MAAM,OAAO,MAAM,UAAU;EAChD,sBAAsB,OAAO,MAAM,OAAO,MAAM,oBAAoB;EACpE,sBAAsB,OAAO,MAAM,OAAO,MAAM,oBAAoB;EACpE,WAAW,OAAO,MAAM,OAAO,MAAM,SAAS;EAC9C,aAAa,OAAO,MAAM,OAAO,MAAM,WAAW;CACpD;AACF;AAEA,MAAM,SAAS,YACb,OAAO,QAAQ,mCAAmC,CAAC,CAAC,OACjD,CAAC,KAAK,WACL,QAAQ,YAAY,SAA6D,KACrF;AAEF,MAAM,aAAa,OAAO,GAAG,oCAAoC,CAAC,CAAC,WACjE,SACA,eACA,UACA,SAAS,MACT;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,IAAI,QAAQ,WAChB,MAAM,OAAO,EAAE,OAAO,EAAE,QAAQ;CAElC,IAAI,QACF,OAAO,cAAc,eACnB,SAAS,OAAO,EAAE,KAAK,CAAC,CAAC,OAAO,EAAE,aAAa,QAAQ,CAAC,GACxD,EAAE,UACF,QACF;CAEF,MAAM,OAAO,OAAO,KAClB,SAAS,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,MAAM,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAChE,cAAc,OAChB;CAEA,IAAI,KAAK,SAAS,KAAM,UAAU,KAAK,WAAW,GAAI,OAAO,OAAO,YAAY;CAEhF,OAAO,KAAK,WAAW;AACzB,CAAC;AAED,MAAM,cAAc,OAAO,WAAW,OAAO,eAAe,YAAY,CAAC;AAEzE,MAAM,mBAAmB,OAAO,GAAG,0CAA0C,CAAC,CAAC,WAC7E,SACA,eACA,OAMA;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,IAAI,QAAQ;CAClB,MAAM,SAAS,OAAOA,kBAAO,YAAY,GAAG,MAAM,WAAW,cAAc,OAAO;CAElF,IAAI,OAAO,QAAQ,KAAA,KAAa,CAAC,EAAE,QAAQ,eAAe,OAAO,IAAI,EAAE,QAAQ,OAAO,GACpF,OAAO,KAAA;CAET,MAAM,KAAKA,kBAAO,kBAAkB,CAAC,GACnC,KAAKA,kBAAO,2BAA2B,CAAC;CAE1C,IAAI;CAEJ,IAAI,MAAM,WAAW,gBAAgB;EACnC,IAAI,MAAM,UAAU,KAAA,GAClB,cAAc,OAAOA,kBAAO,eAC1B,GACA,MAAM,MAAM,QAAQ,YACpB,cAAc,OAChB,EAAA,CAAG;OACA;GACH,MAAM,cAAc,OAAO,KACzB,SACG,OAAO,CAAC,CACR,KAAK,EAAE,WAAW,KAAK,CAAC,CACxB,MAAM,GAAG,GAAG,WAAW,OAAO,eAAe,CAAC,CAAC,CAC/C,QAAQ,GAAG,WAAW,GAAG,KAAK,GACjC,KACF,EAAA,CAAG,MAAM,QAAa,EAAE,WAAW,UAAU,GAAG,CAAC;GAEjD,IAAI,eAAe,KAAA,GACjB,cAAc,OAAOA,kBAAO,eAC1B,GACA;IACE,WAAW,WAAW,EAAE,WAAW;IACnC,OAAO,WAAW,EAAE,WAAW;GACjC,GACA,cAAc,OAChB,EAAA,CAAG;EACP;EACA,IACE,eAAe,KAAA,KACf,CAAC,EAAE,WAAW,UAAU,UAAU,KAClC,CAAC,EAAE,UAAU,OAAO,WAAW,EAAE,WAAW,YAAY,OAAO,eAAe,GAE9E,OAAO,KAAA;CACX;CAEA,MAAM,cAAc,OAAOA,kBAAO,uBAChC,GACA,MAAM,UACN,OAAO,iBACP,cAAc,OAChB,EAAA,CAAG;CAEH,IAAK,MAAM,WAAW,oBAAqB,eAAe,KAAA,IAAY,OAAO,KAAA;CAE7E,MAAM,WACJ,eAAe,KAAA,IACX,KAAA,IACA,OAAO,EAAE,WACN,OAAO;EAAE,UAAU,MAAM;EAAU,SAAS,OAAO;EAAK;EAAY;CAAW,CAAC,CAAC,CACjF,KAAK,OAAO,QAAQ,0BAA0B,CAAC;CAExD,IACE,aAAa,KAAA,MACZ,SAAS,aAAa,MAAM,YAC3B,SAAS,SAAS,cAAc,MAAM,aACtC,SAAS,SAAS,qBAAqB,OAAO,IAAI,EAAE,QAAQ,qBAC5D,SAAS,iBAAiB,WAAW,EAAE,WAAW,iBAClD,SAAS,uBAAuB,WAAW,EAAE,WAAW,uBACxD,SAAS,oBAAoB,WAAW,EAAE,WAAW,oBACrD,SAAS,MAAM,SAAS,QAAQ,MAAM,WAAW,EAAE,WAAW,aAC9D,SAAS,kBAAkB,WAAW,EAAE,WAAW,kBACnD,SAAS,WAAW,cAAc,WAAW,EAAE,WAAW,cAC1D,SAAS,WAAW,UAAU,WAAW,EAAE,WAAW,UACtD,SAAS,8BAA8B,WAAW,EAAE,WAAW,mBAEjE,OAAO,KAAA;CAWT,MAAM,UAAS,OATQ,KACrB,SACG,OAAO,CAAC,CACR,KAAK,EAAE,oBAAoB,KAAK,CAAC,CACjC,MAAM,GAAG,GAAG,WAAW,OAAO,eAAe,CAAC,CAAC,CAC/C,QAAQ,GAAG,YAAY,GAC1B,cAAc,OAChB,EAAA,CAEuB,QACpB,QACC,EAAE,oBAAoB,WAAW,KAAA,KACjC,EAAE,oBAAoB,iBAAiB,IAAI,EAAE,oBAAoB,OAAO,MAAM,IAClF;CAEA,IAAI,OAAO,SAAS,IAAI,OAAO,OAAO,YAAY;CAElD,MAAM,WACJ,UAAU,YACV,uBAAuB,KAAK;EAC1B,WAAW,MAAM;EACjB,kBAAkB,OAAO,IAAI,EAAE,QAAQ;EACvC,aAAa,OAAO,KAAK,SAAc;GACrC,cAAc,IAAI,EAAE,oBAAoB;GACxC,UAAU,IAAI,EAAE,oBAAoB;EACtC,EAAE;CACJ,CAAC;CAEH,IACE,SAAS,YAAY,MAClB,aACC,CAAC,OAAO,MACL,QACC,IAAI,EAAE,oBAAoB,kBAAkB,SAAS,gBACrD,IAAI,EAAE,oBAAoB,cAAc,SAAS,QACrD,CACJ,GAEA,OAAO,KAAA;CAET,MAAM,cAAc,OAAO,EAAE,QAC1B,wBAAwB,OAAO,KAAK,MAAM,MAAM,CAAC,CACjD,KAAK,OAAO,QAAQ,2BAA2B,CAAC;CAEnD,OAAO;EAAE,GAAG;EAAQ;EAAY;EAAU;EAAU;CAAY;AAClE,CAAC;AAED,MAAM,mBAAmB,OAAO,GAAG,0CAA0C,CAAC,CAAC,WAC7E,SACA,eACA,QACA;CACA,MAAM,UAAU,OAAO,iBAAiB,SAAS,eAAe;EAC9D,UAAU,OAAO;EACjB,QAAQ,OAAO;EACf,WAAW,OAAO,SAAS;EAC3B,GAAI,OAAO,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,OAAO,MAAM;CAC9D,CAAC;CAED,IACE,YAAY,KAAA,KACZ,CAAC,aAAa,QAAQ,UAAU,OAAO,QAAQ,MAC9C,QAAQ,aAAa,KAAA,IAClB,OAAO,eAAe,KAAA,IACtB,OAAO,eAAe,KAAA,KACtB,CAACA,kBAAO,uBAAuB,QAAQ,UAAU,OAAO,UAAU,IAEtE,OAAO,KAAA;CAET,OAAO;AACT,CAAC;AAED,MAAM,gBAAgB,SAAkB,QAAa;CACnD,MAAM,IAAI,QAAQ,OAAO;CAEzB,OAAO,IACL,GAAG,OAAO,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW;EACzC,MACE,OAAO,IADK,QAAQ,OAAO;EAG7B,OAAO,UAAU,UAAU,IAAI,IAAI,OAAO,KAAK,IAAI,GAAG,OAAO,IAAI;CACnE,CAAC,CACH;AACF;AAEA,MAAM,aAAa,OAAO,GAAG,oBAAoB,CAAC,CAAC,WACjD,SACA,WACA,SACA;CACA,MAAM,WAAW,OAAO;CAExB,OAAO,OAAO,KACZ,SAAS,OAAO,CAAC,CAAC,KAAK,QAAQ,OAAO,KAAK,CAAC,CAAC,MAAM,SAAS,CAAC,CAAC,MAAM,CAAC,GACrE,OACF;AACF,CAAC;AAED,MAAM,gBAAgB,OAAO,GAAG,uCAAuC,CAAC,CAAC,WACvE,SACA,KACA,QACA,iBACA,UACA;CACA,MAAM,IAAI,QAAQ,QAChB,IAAI,QAAQ;CAEd,IACE,QAAQ,KAAA,KACR,IAAI,EAAE,cAAc,OAAO,YAC3B,IAAI,EAAE,cAAc,OAAO,YAC3B,IAAI,EAAE,eAAe,OAAO,aAC5B,CAAC,EAAE,UAAU,OAAO,IAAI,EAAE,YAAY,eAAe,KACrD,IAAI,EAAE,YAAY,OAAO,UACzB,IAAI,EAAE,gBAAgB,OAAO,cAC7B,IAAI,EAAE,aAAa,OAAO,WAC1B,IAAI,EAAE,WAAW,EAAE,OAAO,OAAO,SACjC,IAAI,EAAE,cAAc,YACpB,IAAI,EAAE,qBAAqB,gBAAgB,MAAM,MAChD,OAAO,SAAS,UACb,IAAI,EAAE,YAAY,OAAO,SACzB,CAAC,UAAU,UAAU,IAAI,EAAE,OAAO,IAEtC,OAAO;CACT,KAAK,MAAM,CAAC,KAAK,YAAY;EAC3B,CAAC,EAAE,WAAW,OAAO,eAAe;EACpC,CAAC,EAAE,sBAAsB,OAAO,0BAA0B;EAC1D,CAAC,EAAE,aAAa,OAAO,iBAAiB;CAC1C,GACE,KAAK,OAAO,EAAE,cAAc,IAAI,IAAI,OAAO,SAAS,OAAO;CAE7D,OAAO,OAAO,SAAS,WAClB,OAAO,EAAE,cAAc,IAAI,EAAE,UAAU,OAAO,OAAO,kBACtD,UAAU,UAAU,IAAI,EAAE,UAAU;AAC1C,CAAC;AAED,MAAM,WAAW,OAAO,GAAG,kCAAkC,CAAC,CAAC,WAC7D,SACA,KACA,OACA;CAGA,QAAO,OAFiB,mBAAA,CAGrB,OAAO,QAAQ,OAAO,KAAK,CAAC,CAC5B,IAAI,QAAQ,OAAO,eAAe,KAAK,CAAC,CAAC,CACzC,MAAM,aAAa,SAAS,GAAG,CAAC;CAEnC,MAAM,IAAI,QAAQ,OAAO,GACvB,IAAI,QAAQ;CAEd,MAAM,OAAO,OAAO,WAClB,SACA,IAAI,GAAG,EAAE,UAAU,IAAI,EAAE,SAAS,GAAG,GAAG,EAAE,UAAU,IAAI,EAAE,SAAS,CAAC,GACpE,KACF;CAEA,MAAM,WAAW;EAAE,GAAG;GAAM,EAAE,QAAQ,EAAE,OAAO;GAAS,EAAE,WAAW;GAAO,EAAE,SAAS;CAAK;CAE5F,IACE,KAAK,WAAW,MACf,OAAO,WAAW,SAAS,aAAa,SAAS,QAAQ,GAAG,KAAK,EAAA,CAAG,WAAW,GAEhF,OAAO,OAAO,YAAY;AAC9B,CAAC;AAED,MAAa,qCAAqC,OAAO,GAAG,oCAAoC,CAAC,CAC/F,WACE,SACA,eAKA;CACA,MAAM,WAAW,OAAO;CAExB,IAAI,CAAC,cAAc,aACjB,OAAO,uBAAuB;EAC5B,GAAG;EACH,OAAO,cAAc,OAAO;CAC9B,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;CACtC,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,UAChB,IAAI,QAAQ,OAAO,GACnB,IAAI,QAAQ;CAEd,MAAM,SAAkB,SACtB,MAAM,OAAO,IACTA,kBAAO,MACL,UACA,GACA,eACA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO;EACvB,MAAM,SAAS,OAAO,OAAO,cAAc,6BAA6B;EAExE,IAAI,OAAO,OAAO,MAAM,KAAK,CAAC,OAAO,MAAM,SAAS,QAAQ,QAAQ,KAAA,CAAS,CAAC,GAC5E,OAAO,OAAO,YAAY;EAE5B,OAAO,OAAO;CAChB,CAAC,CACH,IACA,OAAO,KAAK,YAAY,CAAC;CAE/B,MAAM,YACJ,YACA,YAEA,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO,iBAAiB,UAAU;EAEhD,MAAM,aACJ,WAAW,eAAe,KAAA,IACtB,KAAA,IACA;GACE,SAAS,WAAW,WAAW;GAC/B,OAAO,OAAO,OAAO,aAAa,OAAO,eAAe,eAAe,CAAC,CAAC,CACvE,WAAW,WAAW,KACxB,CAAC,CAAC,KACA,OAAO,QAAQ,OAAO,aAAa,OAAO,eAAe,eAAe,CAAC,CAAC,GAC1E,OAAO,SAAS,WAAW,CAC7B;EACF;EAEN,IACG,MAAM,OAAO,WAAW,sBAAuB,eAAe,KAAA,MAC9D,eAAe,KAAA,KAAa,cAAc,UAAU,KAAA,GAErD,OAAO,OAAO,YAAY;EAE5B,OAAO,OAAO,MACZ,OAAO,IAAI,aAAa;GACtB,MAAM,cAAc,OAAO;GAC3B,MAAM,UAAU,OAAO;GAEvB,OAAO,WAAW,SAAS,eAAe,MAAM,OAAO,QAAQ;GAS/D,KAAI,OAPqBA,kBAAO,0BAC9B,GACA,eACA,MAAM,UACN,MAAM,OAAO,MACf,OAEkB,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;GAC/D,MAAM,UAAU,OAAO,iBAAiB,SAAS,eAAe,MAAM,MAAM;GAE5E,IAAI,YAAY,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;GAE7D,MAAM,OAAO,OAAO,WAClB,SACA,IAAI,GAAG,EAAE,UAAU,MAAM,OAAO,QAAQ,GAAG,GAAG,EAAE,UAAU,MAAM,OAAO,QAAQ,CAAC,GAChF,cAAc,OAChB;GAEA,MAAM,MAAM,KAAK,IACf,UAAU,OAAO,4BAA4B,MAAM,MAAM;GAE3D,IACE,KAAK,WAAW,KAChB,EAAE,OAAO,cACP,SACA,KACA,MAAM,QACN,QAAQ,iBACR,OACF,MACA,CAAC,gBAAgB,OAAO,QAAQ,aAAa,OAAO,SAAS,MAC5D,OAAOA,kBAAO,cACb,GACA,MAAM,OAAO,UACb,MAAM,OAAO,WACb,cAAc,OAChB,EAAA,CAAG,WAAW,GAEd,OAAO,QAAQ,YAAY,OAAO;GACpC,IACE,eAAe,KAAA,MACd,MAAM,OAAO,UAAU,KAAA,KACtB,WAAW,MAAM,mBAAmB,MAAM,OAAO,MAAM,kBACvD,YAAY,WAAW,MAAM,OAAO,MAAM,YAAY,MAAM,OAAO,MAAM,OAAO,KAChF,CAACA,kBAAO,+BAA+B;IAAE,GAAG,MAAM;IAAU;GAAW,CAAC,IAE1E,OAAO,QAAQ,YAAY,OAAO;GAEpC,MAAM,qBAAqB,OAAOA,kBAAO,SACvC,cAAc,MACd,EAAE,kBACF,EAAE,oBACJ;GAEA,MAAM,kBAAkB,OAAOA,kBAAO,SACpC,cAAc,MACd,EAAE,kBACF,EAAE,oBACJ;GAEA,MAAM,uBAAuB,OAAOA,kBAAO,6BACzC,GACA,cAAc,MACd,MAAM,OAAO,SAAS,gBACxB;GAEA,IACE,yBAAyB,MAAM,OAAO,SAAS,oBAC/C,uBAAuB,MAAM,OAAO,YAAY,sBAChD,oBAAoB,MAAM,OAAO,YAAY,iBAE7C,OAAO,OAAO,YAAY;GAE5B,MAAM,eACJ,MAAM,OAAO,WAAW,iBACpB,OAAOA,kBAAO,SACZ,cAAc,MACd,EAAE,sBACF,EAAE,wBACJ,IACA,KAAA;GAEN,IAAI;GAEJ,MAAM,gBAAgB,OAAO,GAAG,uCAAuC,CAAC,OACtE,OAAO,QAAQ,qCAAqC,uBAClD,OAAO,IAAI,aAAa;IACtB,IAAI,cAAc,KAAA,GAAW;IAE7B,IACE,EAAE,OAAOA,kBAAO,qBACd,GACA,MAAM,UACN,QAAQ,iBACR;KACE,cAAc,gBAAgB,MAAM,OAAO,WAAY;KACvD;KACA;KACA;IACF,GACA,SACF,OACC,OAAO,WACN,SACA,aAAa,SAAS;KACpB,GAAG;MACF,EAAE,QAAQ,EAAE,OAAO;MACnB,EAAE,WAAW;MACb,EAAE,SAAS;IACd,CAAC,GACD,KACF,EAAA,CAAG,WAAW,KACd,CAAC,gBAAgB,OAAO,QAAQ,aAAa,OAAO,SAAS,GAE7D,OAAO,OAAO,YAAY;GAC9B,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,oBAAoB,kBAAkB,CAAC,CACvE,CACF;GAEA,MAAM,kBAAkB,OAAO,IAAI,aAAa;IAC9C,OAAO,cAAc,CAAC,CAAC,KACrB,OAAO,eAAe,oCAAoC,WAAW,CACvE;IACA,IAAI,cAAc,KAAA,GAAW;IAC7B,MAAM,iBAAiB,OAAO,OAAO,cAAc,8BAA8B;IAEjF,IACE,OAAO,OAAO,cAAc,KAC5B,CAAC,eAAe,MAAM,SAAS,cAAc,CAAC,CAAC,KAAK,gBAAgB,CAAC,GAErE,OAAO,OAAO,YAAY;GAC9B,CAAC;GAED,MAAM,QAAQ,OAAO,GAAG,+BAA+B,CAAC,CAAC,aAAa;IACpE,MAAM,WAAW,OAAO;IAExB,IAAI,CAAC,gBAAgB,OAAO,QAAQ,aAAa,QAAQ,GAAG,OAAO;IAwBnE,IAAI,EArBF,MAAM,OAAO,WAAW,iBACpB,OAAOA,kBAAO,cACZ,GACA,eACA,MAAM,UACN;KACgB;KACd;KACA;KACA;IACF,GACA,QACF,IACA,OAAOA,kBAAO,iBACZ,GACA,MAAM,UACN,QAAQ,iBACR;KAAE;KAAoB;KAAiB;IAAqB,GAC5D,QACF,IAEQ,OAAO,OAAO,YAAY;IACxC,YAAY;IACZ,OAAO,SAAS,SAAS,KAAK,UAAU;IACxC,IAAI,CAAC,gBAAgB,OAAO,QAAQ,aAAa,OAAO,SAAS,GAC/D,OAAO,OAAO,YAAY;IAE5B,OAAO;GACT,CAAC;GAED,IAAI,eAAe,KAAA,GAAW;IAC5B,IAAI;IAEJ,OAAO,oBACL,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,YACA,OAAO,IAAI,aAAa;KACtB,OAAO,OAAO,MAAM;IACtB,CAAC,IACA,aAAa;KACZ,UAAU,QAAQ,aAAa,cAAc,YAAY,YAAY,OAAO;KAE5E,OAAO;IACT,CACF;IAEA,OAAO;IAEP,OAAO,WAAW,QAAQ,YAAY,OAAO;GAC/C;GAEA,MAAM,UAAU,OAAO,MAAM;GAE7B,OAAO;GAEP,OAAO,QAAQ,UAAU,YAAY,YAAY,OAAO;EAC1D,CAAC,CACH;CACF,CAAC;CA2fH,OAAO;EAxfL,UAAU,YAAY,YACpB,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,gBAAgB,UAAU;GAE/C,IACG,MAAM,WAAW,sBACf,MAAM,UAAU,KAAA,KAAa,MAAM,eAAe,KAAA,MACpD,MAAM,WAAW,oBAAoB,cAAc,UAAU,KAAA,KAC9D,MAAM,eAAe,MAAM,OAAO,cAClC,MAAM,OAAO,kBACX,KAAK,IACH,MAAM,OAAO,4BAA4B,MAAM,OAAO,gBACtD,MAAM,OAAO,UAAU,OAAO,cAC9B,MAAM,OAAO,UAAU,WAAW,cAClC,MAAM,OAAO,UAAU,QAAQ,YACjC,KACD,MAAM,aAAa,qBAAqB,eACvC,EAAE,wBAAwB,4BAE5B,OAAO,OAAO,YAAY;GAE5B,OAAO,OAAO,MACZ,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IAEvB,OAAO,WAAW,SAAS,eAAe,MAAM,QAAQ;IAExD,MAAM,UAAU,wBAAwB,KACtC,OAAOA,kBAAO,SACZ,cAAc,MACd,QAAQ,iBACR,QAAQ,mBACV,CACF;IAEA,MAAM,YAAY,OAAO,iBAAiB,SAAS,eAAe,KAAK;IAEvE,IAAI,cAAc,KAAA,GAAW,OAAO,OAAO,YAAY;IACvD,IAAI,MAAM,UAAU,KAAA,GAEhB;SAAA,MAAM,eAAe,KAAA,KACrB,MAAM,WAAW,aAAa,GAAG,MAAM,SAAS,WAChD,MAAM,WAAW,YAAY,oBAC7B,MAAM,MAAM,mBAAmB,MAAM,WAAW,kBAChD,YAAY,MAAM,MAAM,OAAO,MAAM,YAAY,MAAM,WAAW,OAAO,KACzE,MAAM,MAAM,QAAQ,SAAS,aAC7B,CAAC,aAAa,MAAM,MAAM,QAAQ,UAAU,UAAU,QAAQ,KAC9D,UAAU,UAAU,+BAA+B,KAAA,KACnD,EAAE,OAAO,uBACP,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MAAM,UACR,IAEA,OAAO,OAAO,YAAY;IAAA;IAE9B,KACG,OAAO,WACN,SACA,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,WAAW,MAAM,SAAS,CAAC,GACpE,cAAc,OAChB,EAAA,CAAG,QAEH,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,OAAO;IAE9C,MAAM,MAAM,OAAO,WACjB,YAAY,EAAE,cAAc,GAAG;IAEjC,MAAM,QAAQ,gBAAgB;KAC5B,GAAI,UAAU,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY,UAAU,SAAS;KAC7E,UAAU,UAAU;IACtB,CAAC;IAuBD,MApBG,OAAO,KACN,YACG,OAAO,EAAE,OAAO,MAAM,EAAE,CAAC,CAAC,CAC1B,KAAK,EAAE,KAAK,CAAC,CACb,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,WAAW,UAAU,eAAe,GACzC,GACE,IACE,GAAG,EAAE,OAAO,EAAE,OAAO,SAAS,GAC9B,GAAG,EAAE,sBAAsB,SAAS,CACtC,GACA,IAAI,GAAG,EAAE,OAAO,EAAE,OAAO,KAAK,GAAG,GAAG,EAAE,WAAW,SAAS,CAAC,CAC7D,CACF,CACF,GACF,KACF,EAAA,CAAG,EAAE,EAAE,SAAS,MAEJ,MAAM,OAAO,0BAA0B,OAAO,OAAO,YAAY;IAC/E,KAAK,MAAM,CAAC,WAAW,WAAW;KAChC,CAAC,GAAG,EAAE,QAAQ,MAAM,MAAM,GAAG,MAAM,OAAO,UAAU,MAAM;KAC1D,CAAC,GAAG,EAAE,iBAAiB,KAAK,GAAG,MAAM,OAAO,UAAU,UAAU;KAChE,CAAC,GAAG,EAAE,WAAW,UAAU,eAAe,GAAG,MAAM,OAAO,UAAU,OAAO;IAC7E,GAgBE,MAdG,OAAO,KACN,YACG,OAAO,EAAE,OAAO,MAAM,EAAE,CAAC,CAAC,CAC1B,KAAK,EAAE,KAAK,CAAC,CACb,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,WACA,GAAG,EAAE,YAAY,EAAE,cAAc,MAAM,OAAO,YAAY,CAAC,CAC7D,CACF,GACF,KACF,EAAA,CAAG,EAAE,EAAE,SAAS,MAEL,OAAO,OAAO,OAAO,OAAO,YAAY;IAGvD,MAAM,cAAc,OAAO,oCAAoC;KAC7D,MAAM;KACN,UAAU,MAAM;KAChB,YAAY,MAAM;KAClB,UAAU,MAAM;KAChB;KACA,WAAW,MAAM;KACjB,QAAQ,MAAM;KACd,UAAU,UAAU;KACpB,GAAI,UAAU,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY,UAAU,SAAS;KAC7E,qBAAqB,UAAU;KAC/B,GAAI,MAAM,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;KAC1D,cAAc,MAAM;KACpB,iBAAiB;KACjB,4BAA4B,MAAM,MAAM,OAAO;KAC/C,mBAAmB,MAAM,MAAM,OAAO;IACxC,CAAC;IAED,MAAM,WAAW,OAAO,kBAAkB,WAAW;IAErD,OAAO,YAAY,OAAO,EAAE,KAAK,CAAC,CAAC,OACjC,EAAE,aAAa;KACb;KACA,iBAAiB,UAAU;KAC3B,iBAAiB;KACjB;KACA,kBAAkB;KAClB,4BACE,MACA,KAAK,IACH,MAAM,OAAO,UAAU,OAAO,cAC9B,MAAM,OAAO,UAAU,WAAW,cAClC,MAAM,OAAO,UAAU,QAAQ,YACjC;IACJ,CAAC,CACH;IAEA,MAAM,OAAO,OAAO,WAClB,SACA,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,UAAU,MAAM,QAAQ,CAAC,GAClE,KACF;IAEA,IACE,KAAK,WAAW,KAChB,EAAE,OAAO,cACP,SACA,KAAK,IACL,aACA,UAAU,iBACV,QACF,IAEA,OAAO,OAAO,YAAY;IAE5B,MAAM,gBACJ,MACA,KAAK,IACH,MAAM,OAAO,UAAU,OAAO,cAC9B,MAAM,OAAO,UAAU,WAAW,cAClC,MAAM,OAAO,UAAU,QAAQ,YACjC;IAEF,KACG,OAAO,EAAE,cAAc,KAAK,EAAE,CAAC,EAAE,WAAW,OAAO,QACnD,OAAO,EAAE,cAAc,KAAK,EAAE,CAAC,EAAE,qBAAqB,OAAO,kBAC7D,OAAO,cAAc,YAAY,8BACjC,MAAM,eAAe,KAAA,KACpB,EAAE,OAAO,uBACP,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MAAM,UACR,IAEF,OAAO,OAAO,YAAY;IAE5B,OAAO,QAAQ;KAAE,MAAM;KAAY;IAAY,GAAG,OAAO;GAC3D,CAAC,CACH;EACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,eAAe,YAAY,YACzB,OAAO,IAAI,aAAa;GACtB,MAAM,cAAc,OAAO,oCAAoC,WAAW,WAAW,GACnF,QAAQ,OAAO,8BAA8B,WAAW,KAAK;GAE/D,MAAM,WAAW,OAAO,kBAAkB,WAAW,GACnD,gBAAgB,OAAO,4BAA4B,KAAK;GAE1D,KAAK,OAAO,kBAAkB,cAAc,KAAK,CAAC,OAAO,UACvD,OAAO,OAAO,YAAY;GAE5B,OAAO,OAAO,MACZ,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IAEvB,OAAO,WAAW,SAAS,eAAe,YAAY,QAAQ;IAC9D,MAAM,YAAY,OAAO,iBAAiB,SAAS,eAAe,WAAW;IAE7E,IAAI,cAAc,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;IAE/D,MAAM,OAAO,OAAO,WAChB,SACA,IAAI,GAAG,EAAE,UAAU,YAAY,QAAQ,GAAG,GAAG,EAAE,UAAU,YAAY,QAAQ,CAAC,GAC9E,cAAc,OAChB,GACA,MAAM,KAAK;IAEb,MAAM,MAAM,OAAO;IAEnB,IACE,KAAK,WAAW,KAChB,EAAE,OAAO,cACP,SACA,KACA,aACA,UAAU,iBACV,QACF,MACA,MAAM,MAAM,kBACZ,OAAO,YAAY,8BACnB,OAAO,MAAM,iBAEb,OAAO,QAAQ,YAAY,OAAO;IACpC,OAAO,YACJ,OAAO,EAAE,KAAK,CAAC,CACf,IAAI,EAAE,YAAY;KAAE;KAAO,UAAU;IAAc,CAAC,CAAC,CAAC,CACtD,MAAM,aAAa,SAAS,GAAG,CAAC;IAEnC,MAAM,QAAQ,OAAO,WACnB,SACA,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,UAAU,MAAM,QAAQ,CAAC,GAClE,KACF;IAEA,IACE,MAAM,WAAW,KACjB,EAAE,OAAO,cACP,SACA,MAAM,IACN,OACA,UAAU,iBACV,aACF,OACC,OAAO,WACN,SACA,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,YAAY,IAAI,EAAE,WAAW,GAClC,GAAG,EAAE,sBAAsB,IAAI,EAAE,qBAAqB,CACxD,GACA,KACF,EAAA,CAAG,WAAW,GAEd,OAAO,OAAO,YAAY;IAC5B,KACG,OAAO,cAAc,YAAY,+BACjC,OAAO,cAAc,MAAM,iBAE5B,OAAO,OAAO,YAAY;IAE5B,OAAO,QAAQ,aAAa,OAAO;GACrC,CAAC,CACH;EACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,UAAU,eACR,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,OAAO,aAAa,YAAY,CAAC,CAAC,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,KACxE,OAAO,SAAS,WAAW,CAC7B;GA0DA,QAAO,OAxDeA,kBAAO,SAC3B,UACA,eACA,OAAO,IAAI,aAAa;IACtB,IACE,CAAC,MAAM,OAAO,KACd,EAAE,OAAO,WAAW,SAAS,eAAe,MAAM,UAAU,KAAK,IAEjE,OAAO,KAAA;IAET,MAAM,OAAO,OAAO,WAClB,SACA,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,YAAY,MAAM,UAAU,GACjC,GAAG,EAAE,QAAQ,MAAM,MAAM,GACzB,GAAG,EAAE,OAAO,EAAE,OAAO,KAAK,CAC5B,GACA,KACF;IAEA,IAAI,KAAK,WAAW,GAAG,OAAO,KAAA;IAC9B,MAAM,WAAW,OAAO,4BAA4B,KAAK,EAAE,CAAC,EAAE,SAAS;IACvE,MAAM,YAAY,OAAO,iBAAiB,SAAS,eAAe,QAAQ;IAE1E,IAAI,cAAc,KAAA,GAAW,OAAO,KAAA;IAEpC,MAAM,SAAS,OAAO,WACpB,SACA,aAAa,SAAS,KAAK,EAAE,GAC7B,cAAc,OAChB;IAEA,MAAM,MAAM,OAAO;IAEnB,IACE,OAAO,WAAW,KAClB,MAAM,SAAS,kBACf,OAAO,SAAS,mBAChB,SAAS,aAAa,MAAM,YAC5B,SAAS,eAAe,MAAM,cAC9B,SAAS,WAAW,MAAM,UAC1B,EAAE,OAAO,cACP,SACA,OAAO,IACP,UACA,UAAU,iBACV,OAAO,4BAA4B,QAAQ,CAC7C,IAEA,OAAO,KAAA;IAET,OAAO;KAAE,QAAQ;KAAU,oBAAoB,UAAU;IAAY;GACvE,CAAC,CACH,OAEkB,OAAO,iBAAiB,KAAK,CAAC,CAAC;EACnD,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,uBACF;EACF,WAAW,OAAO,YAChB,SAAS,OAAO,OAAO,CAAC,CAAC,KACvB,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,iBAAiB,OAAO,YACtB,SAAS,OAAO,OAAO,CAAC,CAAC,KACvB,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,SAAS,YAAY,YACnB,OAAO,IAAI,aAAa;GACtB,MAAM,SAAS,OAAO,8BAA8B,WAAW,MAAM,GACnE,WAAW,OAAO,4BAA4B,MAAM;GAEtD,OAAO,OAAO,MACZ,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO;IAEvB,OAAO,WAAW,SAAS,eAAe,OAAO,QAAQ;IACzD,MAAM,YAAY,OAAO,iBAAiB,SAAS,eAAe,MAAM;IAExE,IAAI,cAAc,KAAA,GAAW,OAAO,QAAQ,OAAO,OAAO;IAE1D,MAAM,OAAO,OAAO,WAClB,SACA,IAAI,GAAG,EAAE,UAAU,OAAO,QAAQ,GAAG,GAAG,EAAE,UAAU,OAAO,QAAQ,CAAC,GACpE,cAAc,OAChB;IAEA,MAAM,MAAM,OAAO;IAEnB,IACE,KAAK,WAAW,KAChB,MAAM,OAAO,kBACb,OAAO,OAAO,mBACd,EAAE,OAAO,cACP,SACA,KAAK,IACL,QACA,UAAU,iBACV,QACF,IAEA,OAAO,QAAQ,OAAO,OAAO;IAC/B,OAAO,SAAS,SAAS,KAAK,IAAI,WAAW;IAE7C,OAAO,QAAQ,MAAM,OAAO;GAC9B,CAAC,CACH;EACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,UAAU,YAAY,YACpB,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,GAAG,WAAW;GAE9B,IAAI,CAAC,OAAO,cAAc,MAAM,KAAK,KAAK,MAAM,QAAQ,KAAK,MAAM,QAAQ,KACzE,OAAO,OAAO,YAAY;GAE5B,OAAO,OAAO,MACZ,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IAEvB,IAAI,EAAE,OAAO,WAAW,SAAS,eAAe,MAAM,UAAU,KAAK,IACnE,OAAO,QAAQ;KAAE,SAAS;KAAG,SAAS;IAAM,GAAG,OAAO;IACxD,MAAM,MAAM,EAAE,cAAc,OAAO,SAAS;IAE5C,MAAM,MAAM,IACV,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GACE,IAAI,IAAI,EAAE,aAAa,GAAG,GAAG,IAAI,EAAE,sBAAsB,GAAG,CAAC,GAC7D,IACE,UAAU,EAAE,QAAQ,GACpB,GACE,IAAI,GAAG,EAAE,OAAO,EAAE,OAAO,SAAS,GAAG,IAAI,EAAE,sBAAsB,GAAG,CAAC,GACrE,IAAI,GAAG,EAAE,OAAO,EAAE,OAAO,KAAK,GAAG,IAAI,EAAE,WAAW,GAAG,CAAC,CACxD,CACF,CACF,CACF;IAEA,MAAM,OAAO,OAAO,KAClB,YACG,OAAO,CAAC,CACR,KAAK,EAAE,KAAK,CAAC,CACb,MAAM,GAAG,CAAC,CACV,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,CAChC,MAAM,MAAM,QAAQ,CAAC,GACxB,cAAc,OAChB;IAEA,IAAI,UAAU;IAEd,KAAK,MAAM,OAAO,KAAK,MAAM,GAAG,MAAM,KAAK,GAYzC,KAVG,OAAO,WACN,SACA,IACE,aAAa,SAAS,GAAG,GACzB,IAAI,EAAE,aAAa,GAAG,GACtB,IAAI,EAAE,sBAAsB,GAAG,CACjC,GACA,KACF,EAAA,CAAG,WAAW,GAEH;KACX,OAAO,YAAY,OAAO,EAAE,KAAK,CAAC,CAAC,MAAM,aAAa,SAAS,GAAG,CAAC;KACnE,KACG,OAAO,WACN,SACA,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,UAAU,IAAI,EAAE,SAAS,CAAC,GACnE,KACF,EAAA,CAAG,QAEH,OAAO,OAAO,YAAY;KAC5B;IACF,OAAO,OAAO,SAAS,SAAS,KAAK,SAAS;IAGhD,OAAO,QACL;KACE;KACA,UACG,OAAO,KAAK,YAAY,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,EAAA,CACvE,SAAS;IAChB,GACA,OACF;GACF,CAAC,CACH;EACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;CAGU;AAChB,CACF;AAEA,MAAa,4BAA4B;CACvC;CACA;CACA;CACA;CACA;CACA;CACA;AACF"}

package/dist/drizzle/password-prepared-state.mjs

@@ -2,8 +2,8 @@ import { passwordSqlKernel } from "./password-sql.mjs";
 import { DateTime, Effect, Redacted, Schema } from "effect";
 import { AuthenticationProof, AuthenticationRequirement, SessionInvalidationWindow } from "@yielded/auth/Sessions";
 import { ProofBinding, ProofContinuationId, ProofPurpose } from "@yielded/auth/Proofs";
-import { PasswordAction, PasswordCommandId, PasswordCredentialSnapshot, PasswordPreparedConfiguration, PasswordPreparedIntentId, PasswordPreparedRequirement, PasswordPreparedReservation, PasswordPreparedReset, PasswordUnavailable, encodePasswordPreparedReady, snapshotPasswordPreparedReady, snapshotPasswordPreparedReservation } from "@yielded/auth/Password";
 import { SubjectId, TokenDigest } from "@yielded/auth/Schema";
+import { PasswordAction, PasswordCommandId, PasswordCredentialSnapshot, PasswordPreparedConfiguration, PasswordPreparedIntentId, PasswordPreparedRequirement, PasswordPreparedReservation, PasswordPreparedReset, PasswordUnavailable, encodePasswordPreparedReady, snapshotPasswordPreparedReady, snapshotPasswordPreparedReservation } from "@yielded/auth/Password";
 //#region src/drizzle/password-prepared-state.ts
 const unavailable = () => PasswordUnavailable.make({});
 const Instant = Schema.Int.check(Schema.isBetween({

package/dist/drizzle/pg-identity.mjs

@@ -2,7 +2,7 @@ import { PersistenceMappingError as PersistenceMappingError$1, column, isMappedC
 import { validateDrizzleStorage } from "./storage-validation.mjs";
 import { nativeDatabase } from "./native-database.mjs";
 import { Database } from "./pg-database.mjs";
-import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
+import { NativeDatabase, withStorageValidation } from "@yielded/auth-persistence/Adapter";
 import { ExternalIdentityMutation, IdentityConflict, IdentityUnavailable, SubjectProvisioned, SubjectProvisioner } from "@yielded/auth/Identity";
 import { and, eq } from "drizzle-orm";
 import { Cause, Effect, Schema } from "effect";
@@ -92,7 +92,7 @@ const makePgIdentityServices = Effect.fnUntraced(function* (mapping) {
 		...yield* makePgSubjectProvisioningServices(mapping),
 		...yield* makePgExternalIdentityServices(mapping)
 	};
-});
+}, withStorageValidation);
 //#endregion
 export { makePgExternalIdentityServices, makePgIdentityServices, makePgSubjectProvisioningServices };
 

package/dist/drizzle/pg-identity.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"pg-identity.mjs","names":["DatabaseService","PersistenceMappingError"],"sources":["../../src/drizzle/pg-identity.ts"],"sourcesContent":["import { NativeDatabase } from \"@yielded/auth-persistence/Adapter\";\nimport {\n  ExternalIdentityMutation,\n  IdentityConflict,\n  IdentityUnavailable,\n  SubjectProvisioned,\n  type ExternalIdentity,\n  SubjectProvisioner,\n  type SubjectProvisioningInput,\n} from \"@yielded/auth/Identity\";\nimport { reportPersistenceFailure } from \"@yielded/auth/Persistence\";\nimport type { SubjectId } from \"@yielded/auth/Schema\";\n/* oxlint-disable no-explicit-any -- Drizzle's generic query builders lose the concrete consumer table through a runtime column map. Assertions stay in this adapter. */\nimport { and, eq } from \"drizzle-orm\";\nimport type { EffectPgDatabase as PgDatabase } from \"drizzle-orm/effect-postgres\";\nimport { type AnyPgTable, type PgColumn } from \"drizzle-orm/pg-core\";\nimport { Cause, Effect, Schema } from \"effect\";\n\nimport {\n  column,\n  PersistenceMappingError,\n  isMappedConstraintConflict,\n  provisioningFingerprint,\n  type ExternalIdentityTables,\n  type IdentityTables,\n  type SubjectProvisioningTables,\n} from \"./model\";\nimport { nativeDatabase } from \"./native-database\";\nimport { Database as DatabaseService } from \"./pg-database\";\nimport { validateDrizzleStorage } from \"./storage-validation\";\n\ntype RuntimeDatabase = PgDatabase<any>;\n\nconst identityUnavailable = () => IdentityUnavailable.make();\nconst isIdentityFailure = Schema.is(Schema.Union([IdentityConflict, IdentityUnavailable]));\n\nconst mapIdentityFailure = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n  reportPersistenceFailure(effect, isIdentityFailure).pipe(\n    Effect.catchCause((cause) =>\n      Effect.failCause(\n        Cause.map(cause, (error) => (isIdentityFailure(error) ? error : identityUnavailable())),\n      ),\n    ),\n  );\n\nexport const makePgSubjectProvisioningServices = Effect.fnUntraced(function* <\n  Subject extends AnyPgTable,\n  Identifier extends AnyPgTable,\n  Request extends AnyPgTable,\n  NativeId,\n>(mapping: SubjectProvisioningTables<Subject, Identifier, Request, NativeId>) {\n  const database = yield* DatabaseService;\n\n  yield* validateDrizzleStorage(mapping).pipe(\n    Effect.provideServiceEffect(NativeDatabase, nativeDatabase(DatabaseService)),\n    Effect.mapError(() => IdentityUnavailable.make()),\n  );\n\n  const db = database as RuntimeDatabase;\n  const requestTable = mapping.provisioningRequest.table;\n  const requestIdColumn = column(requestTable, mapping.provisioningRequest.requestId);\n  const requestFingerprintColumn = column(requestTable, mapping.provisioningRequest.fingerprint);\n  const requestSubjectColumn = column(requestTable, mapping.provisioningRequest.subjectId);\n  const identifierTable = mapping.identifier.table;\n  const identifierNamespaceColumn = column(identifierTable, mapping.identifier.namespace);\n  const identifierValueColumn = column(identifierTable, mapping.identifier.value);\n\n  const findReceipt = Effect.fn(\"DrizzlePgIdentity.findReceipt\")(function* (requestId: string) {\n    const rows = yield* db\n      .select({\n        fingerprint: requestFingerprintColumn as PgColumn,\n        subjectId: requestSubjectColumn as PgColumn,\n      })\n      .from(requestTable as any)\n      .where(eq(requestIdColumn, requestId))\n      .limit(1);\n\n    return rows[0];\n  });\n\n  const provision = Effect.fn(\"DrizzlePgIdentity.provision\")(function* (\n    input: SubjectProvisioningInput,\n  ) {\n    const fingerprint = provisioningFingerprint(input);\n    const existing = yield* findReceipt(input.requestId);\n\n    if (existing !== undefined) {\n      if (existing.fingerprint !== fingerprint) return yield* IdentityConflict.make();\n      const id = yield* mapping.subjectId.toSubject(existing.subjectId as NativeId);\n\n      return SubjectProvisioned.make({ subjectId: id });\n    }\n\n    const attempt = db.transaction((tx) =>\n      Effect.gen(function* () {\n        const allocated =\n          mapping.subject.allocateId === undefined ? undefined : yield* mapping.subject.allocateId;\n\n        const inserted = yield* tx\n          .insert(mapping.subject.table as any)\n          .values(mapping.subject.encodeInsert(input, allocated) as any)\n          .returning({ id: column(mapping.subject.table, mapping.subject.id) as PgColumn });\n\n        const nativeId = (inserted[0]?.id ?? allocated) as NativeId | undefined;\n\n        if (nativeId === undefined) {\n          return yield* PersistenceMappingError.make({\n            operation: \"provisionSubject.generatedId\",\n            cause: new Error(\"subject insert did not return its native id\"),\n          });\n        }\n        if (input.identifier !== undefined) {\n          yield* tx\n            .insert(identifierTable as any)\n            .values(\n              mapping.identifier.encodeInsert(input.identifier, nativeId, input.verifiedAt) as any,\n            );\n        }\n        yield* tx\n          .insert(requestTable as any)\n          .values(\n            mapping.provisioningRequest.encodeInsert(input.requestId, fingerprint, nativeId) as any,\n          );\n\n        return nativeId;\n      }),\n    );\n\n    const nativeId = yield* attempt.pipe(\n      Effect.catchCause(\n        (\n          cause,\n        ): Effect.Effect<\n          NativeId,\n          | Effect.Error<typeof attempt>\n          | Effect.Error<ReturnType<typeof findReceipt>>\n          | IdentityConflict\n        > => {\n          if (\n            cause.reasons.length === 0 ||\n            !cause.reasons.every(\n              (reason) =>\n                Cause.isFailReason(reason) &&\n                isMappedConstraintConflict(mapping.isConstraintConflict, reason.error),\n            )\n          )\n            return Effect.failCause(cause);\n\n          return findReceipt(input.requestId).pipe(\n            Effect.flatMap((receipt) => {\n              if (receipt !== undefined && receipt.fingerprint === fingerprint) {\n                return Effect.succeed(receipt.subjectId as NativeId);\n              }\n              if (input.identifier === undefined) return IdentityConflict.make();\n\n              return db\n                .select({\n                  subjectId: column(identifierTable, mapping.identifier.subjectId) as PgColumn,\n                })\n                .from(identifierTable as any)\n                .where(\n                  and(\n                    eq(identifierNamespaceColumn, input.identifier.namespace),\n                    eq(identifierValueColumn, input.identifier.value),\n                  ),\n                )\n                .limit(1)\n                .pipe(Effect.flatMap(() => IdentityConflict.make()));\n            }),\n          );\n        },\n      ),\n    );\n\n    const subjectId = yield* mapping.subjectId.toSubject(nativeId);\n\n    return SubjectProvisioned.make({ subjectId });\n  }, mapIdentityFailure);\n\n  return {\n    subjectProvisioner: SubjectProvisioner.of({ provision }),\n  } as const;\n});\n\nexport const makePgExternalIdentityServices = Effect.fnUntraced(function* <\n  Subject extends AnyPgTable,\n  External extends AnyPgTable,\n  NativeId,\n>(mapping: ExternalIdentityTables<Subject, External, NativeId>) {\n  const database = yield* DatabaseService;\n\n  yield* validateDrizzleStorage(mapping).pipe(\n    Effect.provideServiceEffect(NativeDatabase, nativeDatabase(DatabaseService)),\n    Effect.mapError(() => IdentityUnavailable.make()),\n  );\n\n  const db = database as RuntimeDatabase;\n  const externalTable = mapping.externalIdentity.table;\n\n  const externalProviderColumn = column(\n    externalTable,\n    mapping.externalIdentity.provider,\n  ) as PgColumn;\n\n  const externalIssuerColumn = column(externalTable, mapping.externalIdentity.issuer) as PgColumn;\n  const externalSubjectColumn = column(externalTable, mapping.externalIdentity.subject) as PgColumn;\n\n  const externalSubjectIdColumn = column(\n    externalTable,\n    mapping.externalIdentity.subjectId,\n  ) as PgColumn;\n\n  const subjectIdColumn = column(mapping.subject.table, mapping.subject.id) as PgColumn;\n  const subjectStatusColumn = column(mapping.subject.table, mapping.subject.status) as PgColumn;\n\n  const bind = Effect.fn(\"DrizzlePgIdentity.bindExternalIdentity\")(function* (\n    subjectId: SubjectId,\n    identity: ExternalIdentity,\n  ) {\n    const nativeId = yield* mapping.subjectId.toNative(subjectId);\n\n    const decision = yield* db\n      .transaction((tx) =>\n        Effect.gen(function* () {\n          const subjects = yield* tx\n            .select({ status: subjectStatusColumn })\n            .from(mapping.subject.table as any)\n            .where(eq(subjectIdColumn, nativeId))\n            .for(\"update\")\n            .limit(1);\n\n          if (subjects[0] === undefined || !mapping.subject.isActiveStatus(subjects[0].status))\n            return { _tag: \"conflict\" } as const;\n\n          const links = yield* tx\n            .select({ subjectId: externalSubjectIdColumn })\n            .from(externalTable as any)\n            .where(\n              and(\n                eq(externalProviderColumn, identity.provider),\n                eq(externalIssuerColumn, identity.issuer),\n                eq(externalSubjectColumn, identity.subject),\n              ),\n            )\n            .for(\"update\")\n            .limit(1);\n\n          if (links[0] !== undefined)\n            return mapping.subjectId.equals(links[0].subjectId as NativeId, nativeId)\n              ? ({ _tag: \"bound\" } as const)\n              : ({ _tag: \"conflict\" } as const);\n          yield* tx\n            .insert(externalTable as any)\n            .values(mapping.externalIdentity.encodeInsert(identity, nativeId) as any);\n\n          return { _tag: \"bound\" } as const;\n        }),\n      )\n      .pipe(\n        Effect.catchCause((cause) => {\n          if (\n            cause.reasons.length === 0 ||\n            !cause.reasons.every(\n              (reason) =>\n                Cause.isFailReason(reason) &&\n                isMappedConstraintConflict(mapping.isConstraintConflict, reason.error),\n            )\n          )\n            return Effect.failCause(cause);\n\n          return db\n            .select({ subjectId: externalSubjectIdColumn })\n            .from(externalTable as any)\n            .where(\n              and(\n                eq(externalProviderColumn, identity.provider),\n                eq(externalIssuerColumn, identity.issuer),\n                eq(externalSubjectColumn, identity.subject),\n              ),\n            )\n            .limit(1)\n            .pipe(\n              Effect.map((rows) =>\n                rows[0] !== undefined &&\n                mapping.subjectId.equals(rows[0].subjectId as NativeId, nativeId)\n                  ? ({ _tag: \"bound\" } as const)\n                  : ({ _tag: \"conflict\" } as const),\n              ),\n            );\n        }),\n      );\n\n    if (decision._tag === \"conflict\") return yield* IdentityConflict.make();\n  }, mapIdentityFailure);\n\n  return { externalIdentityMutation: ExternalIdentityMutation.of({ bind }) } as const;\n});\n\nexport const makePgIdentityServices = Effect.fnUntraced(function* <\n  Subject extends AnyPgTable,\n  Identifier extends AnyPgTable,\n  External extends AnyPgTable,\n  Request extends AnyPgTable,\n  NativeId,\n>(mapping: IdentityTables<Subject, Identifier, External, Request, NativeId>) {\n  return {\n    ...(yield* makePgSubjectProvisioningServices(mapping)),\n    ...(yield* makePgExternalIdentityServices(mapping)),\n  };\n});\n"],"mappings":";;;;;;;;;;;AAiCA,MAAM,4BAA4B,oBAAoB,KAAK;AAC3D,MAAM,oBAAoB,OAAO,GAAG,OAAO,MAAM,CAAC,kBAAkB,mBAAmB,CAAC,CAAC;AAEzF,MAAM,sBAA+B,WACnC,yBAAyB,QAAQ,iBAAiB,CAAC,CAAC,KAClD,OAAO,YAAY,UACjB,OAAO,UACL,MAAM,IAAI,QAAQ,UAAW,kBAAkB,KAAK,IAAI,QAAQ,oBAAoB,CAAE,CACxF,CACF,CACF;AAEF,MAAa,oCAAoC,OAAO,WAAW,WAKjE,SAA4E;CAC5E,MAAM,WAAW,OAAOA;CAExB,OAAO,uBAAuB,OAAO,CAAC,CAAC,KACrC,OAAO,qBAAqB,gBAAgB,eAAeA,QAAe,CAAC,GAC3E,OAAO,eAAe,oBAAoB,KAAK,CAAC,CAClD;CAEA,MAAM,KAAK;CACX,MAAM,eAAe,QAAQ,oBAAoB;CACjD,MAAM,kBAAkB,OAAO,cAAc,QAAQ,oBAAoB,SAAS;CAClF,MAAM,2BAA2B,OAAO,cAAc,QAAQ,oBAAoB,WAAW;CAC7F,MAAM,uBAAuB,OAAO,cAAc,QAAQ,oBAAoB,SAAS;CACvF,MAAM,kBAAkB,QAAQ,WAAW;CAC3C,MAAM,4BAA4B,OAAO,iBAAiB,QAAQ,WAAW,SAAS;CACtF,MAAM,wBAAwB,OAAO,iBAAiB,QAAQ,WAAW,KAAK;CAE9E,MAAM,cAAc,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAAW,WAAmB;EAU3F,QAAO,OATa,GACjB,OAAO;GACN,aAAa;GACb,WAAW;EACb,CAAC,CAAC,CACD,KAAK,YAAmB,CAAC,CACzB,MAAM,GAAG,iBAAiB,SAAS,CAAC,CAAC,CACrC,MAAM,CAAC,EAAA,CAEE;CACd,CAAC;CAED,MAAM,YAAY,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACzD,OACA;EACA,MAAM,cAAc,wBAAwB,KAAK;EACjD,MAAM,WAAW,OAAO,YAAY,MAAM,SAAS;EAEnD,IAAI,aAAa,KAAA,GAAW;GAC1B,IAAI,SAAS,gBAAgB,aAAa,OAAO,OAAO,iBAAiB,KAAK;GAC9E,MAAM,KAAK,OAAO,QAAQ,UAAU,UAAU,SAAS,SAAqB;GAE5E,OAAO,mBAAmB,KAAK,EAAE,WAAW,GAAG,CAAC;EAClD;EAqCA,MAAM,WAAW,OAnCD,GAAG,aAAa,OAC9B,OAAO,IAAI,aAAa;GACtB,MAAM,YACJ,QAAQ,QAAQ,eAAe,KAAA,IAAY,KAAA,IAAY,OAAO,QAAQ,QAAQ;GAOhF,MAAM,YAAY,OALM,GACrB,OAAO,QAAQ,QAAQ,KAAY,CAAC,CACpC,OAAO,QAAQ,QAAQ,aAAa,OAAO,SAAS,CAAQ,CAAC,CAC7D,UAAU,EAAE,IAAI,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,EAAE,EAAc,CAAC,EAAA,CAEvD,EAAE,EAAE,MAAM;GAErC,IAAI,aAAa,KAAA,GACf,OAAO,OAAOC,0BAAwB,KAAK;IACzC,WAAW;IACX,uBAAO,IAAI,MAAM,6CAA6C;GAChE,CAAC;GAEH,IAAI,MAAM,eAAe,KAAA,GACvB,OAAO,GACJ,OAAO,eAAsB,CAAC,CAC9B,OACC,QAAQ,WAAW,aAAa,MAAM,YAAY,UAAU,MAAM,UAAU,CAC9E;GAEJ,OAAO,GACJ,OAAO,YAAmB,CAAC,CAC3B,OACC,QAAQ,oBAAoB,aAAa,MAAM,WAAW,aAAa,QAAQ,CACjF;GAEF,OAAO;EACT,CAAC,CAG2B,CAAC,CAAC,KAC9B,OAAO,YAEH,UAMG;GACH,IACE,MAAM,QAAQ,WAAW,KACzB,CAAC,MAAM,QAAQ,OACZ,WACC,MAAM,aAAa,MAAM,KACzB,2BAA2B,QAAQ,sBAAsB,OAAO,KAAK,CACzE,GAEA,OAAO,OAAO,UAAU,KAAK;GAE/B,OAAO,YAAY,MAAM,SAAS,CAAC,CAAC,KAClC,OAAO,SAAS,YAAY;IAC1B,IAAI,YAAY,KAAA,KAAa,QAAQ,gBAAgB,aACnD,OAAO,OAAO,QAAQ,QAAQ,SAAqB;IAErD,IAAI,MAAM,eAAe,KAAA,GAAW,OAAO,iBAAiB,KAAK;IAEjE,OAAO,GACJ,OAAO,EACN,WAAW,OAAO,iBAAiB,QAAQ,WAAW,SAAS,EACjE,CAAC,CAAC,CACD,KAAK,eAAsB,CAAC,CAC5B,MACC,IACE,GAAG,2BAA2B,MAAM,WAAW,SAAS,GACxD,GAAG,uBAAuB,MAAM,WAAW,KAAK,CAClD,CACF,CAAC,CACA,MAAM,CAAC,CAAC,CACR,KAAK,OAAO,cAAc,iBAAiB,KAAK,CAAC,CAAC;GACvD,CAAC,CACH;EACF,CACF,CACF;EAEA,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,QAAQ;EAE7D,OAAO,mBAAmB,KAAK,EAAE,UAAU,CAAC;CAC9C,GAAG,kBAAkB;CAErB,OAAO,EACL,oBAAoB,mBAAmB,GAAG,EAAE,UAAU,CAAC,EACzD;AACF,CAAC;AAED,MAAa,iCAAiC,OAAO,WAAW,WAI9D,SAA8D;CAC9D,MAAM,WAAW,OAAOD;CAExB,OAAO,uBAAuB,OAAO,CAAC,CAAC,KACrC,OAAO,qBAAqB,gBAAgB,eAAeA,QAAe,CAAC,GAC3E,OAAO,eAAe,oBAAoB,KAAK,CAAC,CAClD;CAEA,MAAM,KAAK;CACX,MAAM,gBAAgB,QAAQ,iBAAiB;CAE/C,MAAM,yBAAyB,OAC7B,eACA,QAAQ,iBAAiB,QAC3B;CAEA,MAAM,uBAAuB,OAAO,eAAe,QAAQ,iBAAiB,MAAM;CAClF,MAAM,wBAAwB,OAAO,eAAe,QAAQ,iBAAiB,OAAO;CAEpF,MAAM,0BAA0B,OAC9B,eACA,QAAQ,iBAAiB,SAC3B;CAEA,MAAM,kBAAkB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,EAAE;CACxE,MAAM,sBAAsB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;CAEhF,MAAM,OAAO,OAAO,GAAG,wCAAwC,CAAC,CAAC,WAC/D,WACA,UACA;EACA,MAAM,WAAW,OAAO,QAAQ,UAAU,SAAS,SAAS;EAyE5D,KAAI,OAvEoB,GACrB,aAAa,OACZ,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,OAAO,GACrB,OAAO,EAAE,QAAQ,oBAAoB,CAAC,CAAC,CACvC,KAAK,QAAQ,QAAQ,KAAY,CAAC,CAClC,MAAM,GAAG,iBAAiB,QAAQ,CAAC,CAAC,CACpC,IAAI,QAAQ,CAAC,CACb,MAAM,CAAC;GAEV,IAAI,SAAS,OAAO,KAAA,KAAa,CAAC,QAAQ,QAAQ,eAAe,SAAS,EAAE,CAAC,MAAM,GACjF,OAAO,EAAE,MAAM,WAAW;GAE5B,MAAM,QAAQ,OAAO,GAClB,OAAO,EAAE,WAAW,wBAAwB,CAAC,CAAC,CAC9C,KAAK,aAAoB,CAAC,CAC1B,MACC,IACE,GAAG,wBAAwB,SAAS,QAAQ,GAC5C,GAAG,sBAAsB,SAAS,MAAM,GACxC,GAAG,uBAAuB,SAAS,OAAO,CAC5C,CACF,CAAC,CACA,IAAI,QAAQ,CAAC,CACb,MAAM,CAAC;GAEV,IAAI,MAAM,OAAO,KAAA,GACf,OAAO,QAAQ,UAAU,OAAO,MAAM,EAAE,CAAC,WAAuB,QAAQ,IACnE,EAAE,MAAM,QAAQ,IAChB,EAAE,MAAM,WAAW;GAC1B,OAAO,GACJ,OAAO,aAAoB,CAAC,CAC5B,OAAO,QAAQ,iBAAiB,aAAa,UAAU,QAAQ,CAAQ;GAE1E,OAAO,EAAE,MAAM,QAAQ;EACzB,CAAC,CACH,CAAC,CACA,KACC,OAAO,YAAY,UAAU;GAC3B,IACE,MAAM,QAAQ,WAAW,KACzB,CAAC,MAAM,QAAQ,OACZ,WACC,MAAM,aAAa,MAAM,KACzB,2BAA2B,QAAQ,sBAAsB,OAAO,KAAK,CACzE,GAEA,OAAO,OAAO,UAAU,KAAK;GAE/B,OAAO,GACJ,OAAO,EAAE,WAAW,wBAAwB,CAAC,CAAC,CAC9C,KAAK,aAAoB,CAAC,CAC1B,MACC,IACE,GAAG,wBAAwB,SAAS,QAAQ,GAC5C,GAAG,sBAAsB,SAAS,MAAM,GACxC,GAAG,uBAAuB,SAAS,OAAO,CAC5C,CACF,CAAC,CACA,MAAM,CAAC,CAAC,CACR,KACC,OAAO,KAAK,SACV,KAAK,OAAO,KAAA,KACZ,QAAQ,UAAU,OAAO,KAAK,EAAE,CAAC,WAAuB,QAAQ,IAC3D,EAAE,MAAM,QAAQ,IAChB,EAAE,MAAM,WAAW,CAC1B,CACF;EACJ,CAAC,CACH,EAAA,CAEW,SAAS,YAAY,OAAO,OAAO,iBAAiB,KAAK;CACxE,GAAG,kBAAkB;CAErB,OAAO,EAAE,0BAA0B,yBAAyB,GAAG,EAAE,KAAK,CAAC,EAAE;AAC3E,CAAC;AAED,MAAa,yBAAyB,OAAO,WAAW,WAMtD,SAA2E;CAC3E,OAAO;EACL,GAAI,OAAO,kCAAkC,OAAO;EACpD,GAAI,OAAO,+BAA+B,OAAO;CACnD;AACF,CAAC"}
+{"version":3,"file":"pg-identity.mjs","names":["DatabaseService","PersistenceMappingError"],"sources":["../../src/drizzle/pg-identity.ts"],"sourcesContent":["import { withStorageValidation, NativeDatabase } from \"@yielded/auth-persistence/Adapter\";\nimport {\n  ExternalIdentityMutation,\n  IdentityConflict,\n  IdentityUnavailable,\n  SubjectProvisioned,\n  type ExternalIdentity,\n  SubjectProvisioner,\n  type SubjectProvisioningInput,\n} from \"@yielded/auth/Identity\";\nimport { reportPersistenceFailure } from \"@yielded/auth/Persistence\";\nimport type { SubjectId } from \"@yielded/auth/Schema\";\n/* oxlint-disable no-explicit-any -- Drizzle's generic query builders lose the concrete consumer table through a runtime column map. Assertions stay in this adapter. */\nimport { and, eq } from \"drizzle-orm\";\nimport type { EffectPgDatabase as PgDatabase } from \"drizzle-orm/effect-postgres\";\nimport { type AnyPgTable, type PgColumn } from \"drizzle-orm/pg-core\";\nimport { Cause, Effect, Schema } from \"effect\";\n\nimport {\n  column,\n  PersistenceMappingError,\n  isMappedConstraintConflict,\n  provisioningFingerprint,\n  type ExternalIdentityTables,\n  type IdentityTables,\n  type SubjectProvisioningTables,\n} from \"./model\";\nimport { nativeDatabase } from \"./native-database\";\nimport { Database as DatabaseService } from \"./pg-database\";\nimport { validateDrizzleStorage } from \"./storage-validation\";\n\ntype RuntimeDatabase = PgDatabase<any>;\n\nconst identityUnavailable = () => IdentityUnavailable.make();\nconst isIdentityFailure = Schema.is(Schema.Union([IdentityConflict, IdentityUnavailable]));\n\nconst mapIdentityFailure = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n  reportPersistenceFailure(effect, isIdentityFailure).pipe(\n    Effect.catchCause((cause) =>\n      Effect.failCause(\n        Cause.map(cause, (error) => (isIdentityFailure(error) ? error : identityUnavailable())),\n      ),\n    ),\n  );\n\nexport const makePgSubjectProvisioningServices = Effect.fnUntraced(function* <\n  Subject extends AnyPgTable,\n  Identifier extends AnyPgTable,\n  Request extends AnyPgTable,\n  NativeId,\n>(mapping: SubjectProvisioningTables<Subject, Identifier, Request, NativeId>) {\n  const database = yield* DatabaseService;\n\n  yield* validateDrizzleStorage(mapping).pipe(\n    Effect.provideServiceEffect(NativeDatabase, nativeDatabase(DatabaseService)),\n    Effect.mapError(() => IdentityUnavailable.make()),\n  );\n\n  const db = database as RuntimeDatabase;\n  const requestTable = mapping.provisioningRequest.table;\n  const requestIdColumn = column(requestTable, mapping.provisioningRequest.requestId);\n  const requestFingerprintColumn = column(requestTable, mapping.provisioningRequest.fingerprint);\n  const requestSubjectColumn = column(requestTable, mapping.provisioningRequest.subjectId);\n  const identifierTable = mapping.identifier.table;\n  const identifierNamespaceColumn = column(identifierTable, mapping.identifier.namespace);\n  const identifierValueColumn = column(identifierTable, mapping.identifier.value);\n\n  const findReceipt = Effect.fn(\"DrizzlePgIdentity.findReceipt\")(function* (requestId: string) {\n    const rows = yield* db\n      .select({\n        fingerprint: requestFingerprintColumn as PgColumn,\n        subjectId: requestSubjectColumn as PgColumn,\n      })\n      .from(requestTable as any)\n      .where(eq(requestIdColumn, requestId))\n      .limit(1);\n\n    return rows[0];\n  });\n\n  const provision = Effect.fn(\"DrizzlePgIdentity.provision\")(function* (\n    input: SubjectProvisioningInput,\n  ) {\n    const fingerprint = provisioningFingerprint(input);\n    const existing = yield* findReceipt(input.requestId);\n\n    if (existing !== undefined) {\n      if (existing.fingerprint !== fingerprint) return yield* IdentityConflict.make();\n      const id = yield* mapping.subjectId.toSubject(existing.subjectId as NativeId);\n\n      return SubjectProvisioned.make({ subjectId: id });\n    }\n\n    const attempt = db.transaction((tx) =>\n      Effect.gen(function* () {\n        const allocated =\n          mapping.subject.allocateId === undefined ? undefined : yield* mapping.subject.allocateId;\n\n        const inserted = yield* tx\n          .insert(mapping.subject.table as any)\n          .values(mapping.subject.encodeInsert(input, allocated) as any)\n          .returning({ id: column(mapping.subject.table, mapping.subject.id) as PgColumn });\n\n        const nativeId = (inserted[0]?.id ?? allocated) as NativeId | undefined;\n\n        if (nativeId === undefined) {\n          return yield* PersistenceMappingError.make({\n            operation: \"provisionSubject.generatedId\",\n            cause: new Error(\"subject insert did not return its native id\"),\n          });\n        }\n        if (input.identifier !== undefined) {\n          yield* tx\n            .insert(identifierTable as any)\n            .values(\n              mapping.identifier.encodeInsert(input.identifier, nativeId, input.verifiedAt) as any,\n            );\n        }\n        yield* tx\n          .insert(requestTable as any)\n          .values(\n            mapping.provisioningRequest.encodeInsert(input.requestId, fingerprint, nativeId) as any,\n          );\n\n        return nativeId;\n      }),\n    );\n\n    const nativeId = yield* attempt.pipe(\n      Effect.catchCause(\n        (\n          cause,\n        ): Effect.Effect<\n          NativeId,\n          | Effect.Error<typeof attempt>\n          | Effect.Error<ReturnType<typeof findReceipt>>\n          | IdentityConflict\n        > => {\n          if (\n            cause.reasons.length === 0 ||\n            !cause.reasons.every(\n              (reason) =>\n                Cause.isFailReason(reason) &&\n                isMappedConstraintConflict(mapping.isConstraintConflict, reason.error),\n            )\n          )\n            return Effect.failCause(cause);\n\n          return findReceipt(input.requestId).pipe(\n            Effect.flatMap((receipt) => {\n              if (receipt !== undefined && receipt.fingerprint === fingerprint) {\n                return Effect.succeed(receipt.subjectId as NativeId);\n              }\n              if (input.identifier === undefined) return IdentityConflict.make();\n\n              return db\n                .select({\n                  subjectId: column(identifierTable, mapping.identifier.subjectId) as PgColumn,\n                })\n                .from(identifierTable as any)\n                .where(\n                  and(\n                    eq(identifierNamespaceColumn, input.identifier.namespace),\n                    eq(identifierValueColumn, input.identifier.value),\n                  ),\n                )\n                .limit(1)\n                .pipe(Effect.flatMap(() => IdentityConflict.make()));\n            }),\n          );\n        },\n      ),\n    );\n\n    const subjectId = yield* mapping.subjectId.toSubject(nativeId);\n\n    return SubjectProvisioned.make({ subjectId });\n  }, mapIdentityFailure);\n\n  return {\n    subjectProvisioner: SubjectProvisioner.of({ provision }),\n  } as const;\n});\n\nexport const makePgExternalIdentityServices = Effect.fnUntraced(function* <\n  Subject extends AnyPgTable,\n  External extends AnyPgTable,\n  NativeId,\n>(mapping: ExternalIdentityTables<Subject, External, NativeId>) {\n  const database = yield* DatabaseService;\n\n  yield* validateDrizzleStorage(mapping).pipe(\n    Effect.provideServiceEffect(NativeDatabase, nativeDatabase(DatabaseService)),\n    Effect.mapError(() => IdentityUnavailable.make()),\n  );\n\n  const db = database as RuntimeDatabase;\n  const externalTable = mapping.externalIdentity.table;\n\n  const externalProviderColumn = column(\n    externalTable,\n    mapping.externalIdentity.provider,\n  ) as PgColumn;\n\n  const externalIssuerColumn = column(externalTable, mapping.externalIdentity.issuer) as PgColumn;\n  const externalSubjectColumn = column(externalTable, mapping.externalIdentity.subject) as PgColumn;\n\n  const externalSubjectIdColumn = column(\n    externalTable,\n    mapping.externalIdentity.subjectId,\n  ) as PgColumn;\n\n  const subjectIdColumn = column(mapping.subject.table, mapping.subject.id) as PgColumn;\n  const subjectStatusColumn = column(mapping.subject.table, mapping.subject.status) as PgColumn;\n\n  const bind = Effect.fn(\"DrizzlePgIdentity.bindExternalIdentity\")(function* (\n    subjectId: SubjectId,\n    identity: ExternalIdentity,\n  ) {\n    const nativeId = yield* mapping.subjectId.toNative(subjectId);\n\n    const decision = yield* db\n      .transaction((tx) =>\n        Effect.gen(function* () {\n          const subjects = yield* tx\n            .select({ status: subjectStatusColumn })\n            .from(mapping.subject.table as any)\n            .where(eq(subjectIdColumn, nativeId))\n            .for(\"update\")\n            .limit(1);\n\n          if (subjects[0] === undefined || !mapping.subject.isActiveStatus(subjects[0].status))\n            return { _tag: \"conflict\" } as const;\n\n          const links = yield* tx\n            .select({ subjectId: externalSubjectIdColumn })\n            .from(externalTable as any)\n            .where(\n              and(\n                eq(externalProviderColumn, identity.provider),\n                eq(externalIssuerColumn, identity.issuer),\n                eq(externalSubjectColumn, identity.subject),\n              ),\n            )\n            .for(\"update\")\n            .limit(1);\n\n          if (links[0] !== undefined)\n            return mapping.subjectId.equals(links[0].subjectId as NativeId, nativeId)\n              ? ({ _tag: \"bound\" } as const)\n              : ({ _tag: \"conflict\" } as const);\n          yield* tx\n            .insert(externalTable as any)\n            .values(mapping.externalIdentity.encodeInsert(identity, nativeId) as any);\n\n          return { _tag: \"bound\" } as const;\n        }),\n      )\n      .pipe(\n        Effect.catchCause((cause) => {\n          if (\n            cause.reasons.length === 0 ||\n            !cause.reasons.every(\n              (reason) =>\n                Cause.isFailReason(reason) &&\n                isMappedConstraintConflict(mapping.isConstraintConflict, reason.error),\n            )\n          )\n            return Effect.failCause(cause);\n\n          return db\n            .select({ subjectId: externalSubjectIdColumn })\n            .from(externalTable as any)\n            .where(\n              and(\n                eq(externalProviderColumn, identity.provider),\n                eq(externalIssuerColumn, identity.issuer),\n                eq(externalSubjectColumn, identity.subject),\n              ),\n            )\n            .limit(1)\n            .pipe(\n              Effect.map((rows) =>\n                rows[0] !== undefined &&\n                mapping.subjectId.equals(rows[0].subjectId as NativeId, nativeId)\n                  ? ({ _tag: \"bound\" } as const)\n                  : ({ _tag: \"conflict\" } as const),\n              ),\n            );\n        }),\n      );\n\n    if (decision._tag === \"conflict\") return yield* IdentityConflict.make();\n  }, mapIdentityFailure);\n\n  return { externalIdentityMutation: ExternalIdentityMutation.of({ bind }) } as const;\n});\n\nexport const makePgIdentityServices = Effect.fnUntraced(function* <\n  Subject extends AnyPgTable,\n  Identifier extends AnyPgTable,\n  External extends AnyPgTable,\n  Request extends AnyPgTable,\n  NativeId,\n>(mapping: IdentityTables<Subject, Identifier, External, Request, NativeId>) {\n  return {\n    ...(yield* makePgSubjectProvisioningServices(mapping)),\n    ...(yield* makePgExternalIdentityServices(mapping)),\n  };\n}, withStorageValidation);\n"],"mappings":";;;;;;;;;;;AAiCA,MAAM,4BAA4B,oBAAoB,KAAK;AAC3D,MAAM,oBAAoB,OAAO,GAAG,OAAO,MAAM,CAAC,kBAAkB,mBAAmB,CAAC,CAAC;AAEzF,MAAM,sBAA+B,WACnC,yBAAyB,QAAQ,iBAAiB,CAAC,CAAC,KAClD,OAAO,YAAY,UACjB,OAAO,UACL,MAAM,IAAI,QAAQ,UAAW,kBAAkB,KAAK,IAAI,QAAQ,oBAAoB,CAAE,CACxF,CACF,CACF;AAEF,MAAa,oCAAoC,OAAO,WAAW,WAKjE,SAA4E;CAC5E,MAAM,WAAW,OAAOA;CAExB,OAAO,uBAAuB,OAAO,CAAC,CAAC,KACrC,OAAO,qBAAqB,gBAAgB,eAAeA,QAAe,CAAC,GAC3E,OAAO,eAAe,oBAAoB,KAAK,CAAC,CAClD;CAEA,MAAM,KAAK;CACX,MAAM,eAAe,QAAQ,oBAAoB;CACjD,MAAM,kBAAkB,OAAO,cAAc,QAAQ,oBAAoB,SAAS;CAClF,MAAM,2BAA2B,OAAO,cAAc,QAAQ,oBAAoB,WAAW;CAC7F,MAAM,uBAAuB,OAAO,cAAc,QAAQ,oBAAoB,SAAS;CACvF,MAAM,kBAAkB,QAAQ,WAAW;CAC3C,MAAM,4BAA4B,OAAO,iBAAiB,QAAQ,WAAW,SAAS;CACtF,MAAM,wBAAwB,OAAO,iBAAiB,QAAQ,WAAW,KAAK;CAE9E,MAAM,cAAc,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAAW,WAAmB;EAU3F,QAAO,OATa,GACjB,OAAO;GACN,aAAa;GACb,WAAW;EACb,CAAC,CAAC,CACD,KAAK,YAAmB,CAAC,CACzB,MAAM,GAAG,iBAAiB,SAAS,CAAC,CAAC,CACrC,MAAM,CAAC,EAAA,CAEE;CACd,CAAC;CAED,MAAM,YAAY,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACzD,OACA;EACA,MAAM,cAAc,wBAAwB,KAAK;EACjD,MAAM,WAAW,OAAO,YAAY,MAAM,SAAS;EAEnD,IAAI,aAAa,KAAA,GAAW;GAC1B,IAAI,SAAS,gBAAgB,aAAa,OAAO,OAAO,iBAAiB,KAAK;GAC9E,MAAM,KAAK,OAAO,QAAQ,UAAU,UAAU,SAAS,SAAqB;GAE5E,OAAO,mBAAmB,KAAK,EAAE,WAAW,GAAG,CAAC;EAClD;EAqCA,MAAM,WAAW,OAnCD,GAAG,aAAa,OAC9B,OAAO,IAAI,aAAa;GACtB,MAAM,YACJ,QAAQ,QAAQ,eAAe,KAAA,IAAY,KAAA,IAAY,OAAO,QAAQ,QAAQ;GAOhF,MAAM,YAAY,OALM,GACrB,OAAO,QAAQ,QAAQ,KAAY,CAAC,CACpC,OAAO,QAAQ,QAAQ,aAAa,OAAO,SAAS,CAAQ,CAAC,CAC7D,UAAU,EAAE,IAAI,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,EAAE,EAAc,CAAC,EAAA,CAEvD,EAAE,EAAE,MAAM;GAErC,IAAI,aAAa,KAAA,GACf,OAAO,OAAOC,0BAAwB,KAAK;IACzC,WAAW;IACX,uBAAO,IAAI,MAAM,6CAA6C;GAChE,CAAC;GAEH,IAAI,MAAM,eAAe,KAAA,GACvB,OAAO,GACJ,OAAO,eAAsB,CAAC,CAC9B,OACC,QAAQ,WAAW,aAAa,MAAM,YAAY,UAAU,MAAM,UAAU,CAC9E;GAEJ,OAAO,GACJ,OAAO,YAAmB,CAAC,CAC3B,OACC,QAAQ,oBAAoB,aAAa,MAAM,WAAW,aAAa,QAAQ,CACjF;GAEF,OAAO;EACT,CAAC,CAG2B,CAAC,CAAC,KAC9B,OAAO,YAEH,UAMG;GACH,IACE,MAAM,QAAQ,WAAW,KACzB,CAAC,MAAM,QAAQ,OACZ,WACC,MAAM,aAAa,MAAM,KACzB,2BAA2B,QAAQ,sBAAsB,OAAO,KAAK,CACzE,GAEA,OAAO,OAAO,UAAU,KAAK;GAE/B,OAAO,YAAY,MAAM,SAAS,CAAC,CAAC,KAClC,OAAO,SAAS,YAAY;IAC1B,IAAI,YAAY,KAAA,KAAa,QAAQ,gBAAgB,aACnD,OAAO,OAAO,QAAQ,QAAQ,SAAqB;IAErD,IAAI,MAAM,eAAe,KAAA,GAAW,OAAO,iBAAiB,KAAK;IAEjE,OAAO,GACJ,OAAO,EACN,WAAW,OAAO,iBAAiB,QAAQ,WAAW,SAAS,EACjE,CAAC,CAAC,CACD,KAAK,eAAsB,CAAC,CAC5B,MACC,IACE,GAAG,2BAA2B,MAAM,WAAW,SAAS,GACxD,GAAG,uBAAuB,MAAM,WAAW,KAAK,CAClD,CACF,CAAC,CACA,MAAM,CAAC,CAAC,CACR,KAAK,OAAO,cAAc,iBAAiB,KAAK,CAAC,CAAC;GACvD,CAAC,CACH;EACF,CACF,CACF;EAEA,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,QAAQ;EAE7D,OAAO,mBAAmB,KAAK,EAAE,UAAU,CAAC;CAC9C,GAAG,kBAAkB;CAErB,OAAO,EACL,oBAAoB,mBAAmB,GAAG,EAAE,UAAU,CAAC,EACzD;AACF,CAAC;AAED,MAAa,iCAAiC,OAAO,WAAW,WAI9D,SAA8D;CAC9D,MAAM,WAAW,OAAOD;CAExB,OAAO,uBAAuB,OAAO,CAAC,CAAC,KACrC,OAAO,qBAAqB,gBAAgB,eAAeA,QAAe,CAAC,GAC3E,OAAO,eAAe,oBAAoB,KAAK,CAAC,CAClD;CAEA,MAAM,KAAK;CACX,MAAM,gBAAgB,QAAQ,iBAAiB;CAE/C,MAAM,yBAAyB,OAC7B,eACA,QAAQ,iBAAiB,QAC3B;CAEA,MAAM,uBAAuB,OAAO,eAAe,QAAQ,iBAAiB,MAAM;CAClF,MAAM,wBAAwB,OAAO,eAAe,QAAQ,iBAAiB,OAAO;CAEpF,MAAM,0BAA0B,OAC9B,eACA,QAAQ,iBAAiB,SAC3B;CAEA,MAAM,kBAAkB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,EAAE;CACxE,MAAM,sBAAsB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;CAEhF,MAAM,OAAO,OAAO,GAAG,wCAAwC,CAAC,CAAC,WAC/D,WACA,UACA;EACA,MAAM,WAAW,OAAO,QAAQ,UAAU,SAAS,SAAS;EAyE5D,KAAI,OAvEoB,GACrB,aAAa,OACZ,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,OAAO,GACrB,OAAO,EAAE,QAAQ,oBAAoB,CAAC,CAAC,CACvC,KAAK,QAAQ,QAAQ,KAAY,CAAC,CAClC,MAAM,GAAG,iBAAiB,QAAQ,CAAC,CAAC,CACpC,IAAI,QAAQ,CAAC,CACb,MAAM,CAAC;GAEV,IAAI,SAAS,OAAO,KAAA,KAAa,CAAC,QAAQ,QAAQ,eAAe,SAAS,EAAE,CAAC,MAAM,GACjF,OAAO,EAAE,MAAM,WAAW;GAE5B,MAAM,QAAQ,OAAO,GAClB,OAAO,EAAE,WAAW,wBAAwB,CAAC,CAAC,CAC9C,KAAK,aAAoB,CAAC,CAC1B,MACC,IACE,GAAG,wBAAwB,SAAS,QAAQ,GAC5C,GAAG,sBAAsB,SAAS,MAAM,GACxC,GAAG,uBAAuB,SAAS,OAAO,CAC5C,CACF,CAAC,CACA,IAAI,QAAQ,CAAC,CACb,MAAM,CAAC;GAEV,IAAI,MAAM,OAAO,KAAA,GACf,OAAO,QAAQ,UAAU,OAAO,MAAM,EAAE,CAAC,WAAuB,QAAQ,IACnE,EAAE,MAAM,QAAQ,IAChB,EAAE,MAAM,WAAW;GAC1B,OAAO,GACJ,OAAO,aAAoB,CAAC,CAC5B,OAAO,QAAQ,iBAAiB,aAAa,UAAU,QAAQ,CAAQ;GAE1E,OAAO,EAAE,MAAM,QAAQ;EACzB,CAAC,CACH,CAAC,CACA,KACC,OAAO,YAAY,UAAU;GAC3B,IACE,MAAM,QAAQ,WAAW,KACzB,CAAC,MAAM,QAAQ,OACZ,WACC,MAAM,aAAa,MAAM,KACzB,2BAA2B,QAAQ,sBAAsB,OAAO,KAAK,CACzE,GAEA,OAAO,OAAO,UAAU,KAAK;GAE/B,OAAO,GACJ,OAAO,EAAE,WAAW,wBAAwB,CAAC,CAAC,CAC9C,KAAK,aAAoB,CAAC,CAC1B,MACC,IACE,GAAG,wBAAwB,SAAS,QAAQ,GAC5C,GAAG,sBAAsB,SAAS,MAAM,GACxC,GAAG,uBAAuB,SAAS,OAAO,CAC5C,CACF,CAAC,CACA,MAAM,CAAC,CAAC,CACR,KACC,OAAO,KAAK,SACV,KAAK,OAAO,KAAA,KACZ,QAAQ,UAAU,OAAO,KAAK,EAAE,CAAC,WAAuB,QAAQ,IAC3D,EAAE,MAAM,QAAQ,IAChB,EAAE,MAAM,WAAW,CAC1B,CACF;EACJ,CAAC,CACH,EAAA,CAEW,SAAS,YAAY,OAAO,OAAO,iBAAiB,KAAK;CACxE,GAAG,kBAAkB;CAErB,OAAO,EAAE,0BAA0B,yBAAyB,GAAG,EAAE,KAAK,CAAC,EAAE;AAC3E,CAAC;AAED,MAAa,yBAAyB,OAAO,WAAW,WAMtD,SAA2E;CAC3E,OAAO;EACL,GAAI,OAAO,kCAAkC,OAAO;EACpD,GAAI,OAAO,+BAA+B,OAAO;CACnD;AACF,GAAG,qBAAqB"}

package/dist/drizzle/phone-model.d.mts

@@ -107,7 +107,7 @@ export interface PhonePersistenceServices {
   readonly phoneAdmission: PhoneAdmission["Service"];
   readonly phoneSignInTargets: PhoneSignInTargets["Service"];
 }
-/** Bundle phone storage, admission, and lookup with overridable crypto and hook defaults. */
-export declare const phonePersistenceLayer: <E, R>(services: Effect.Effect<PhonePersistenceServices, E, R>) => Layer.Layer<PhoneAdmission | PhonePersistence | PhoneSignInTargets, E, Exclude<Exclude<R, import("effect/Scope").Scope>, import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | import("@yielded/auth/WebCrypto").SubtleCrypto>>;
+/** Bundle phone storage, admission, and lookup with empty hook defaults. */
+export declare const phonePersistenceLayer: <E, R>(services: Effect.Effect<PhonePersistenceServices, E, R>) => Layer.Layer<PhoneAdmission | PhonePersistence | PhoneSignInTargets, E, Exclude<Exclude<R, import("effect/Scope").Scope>, import("@yielded/auth/Hooks").LifecycleHooks>>;
 //#endregion
 //# sourceMappingURL=phone-model.d.mts.map

package/dist/drizzle/phone-model.mjs

@@ -1,5 +1,5 @@
 import { Effect, Layer } from "effect";
-import { cryptoLayer, hooksLayer } from "@yielded/auth/Persistence";
+import { hooksLayer } from "@yielded/auth/Persistence";
 import { PhoneAdmission, PhonePersistence, PhoneSignInTargets } from "@yielded/auth/PhoneOtp";
 //#region src/drizzle/phone-model.ts
 const proofMapping = Symbol("effect-auth/phone/proofs");
@@ -31,8 +31,8 @@ const requiredPhoneConstraints = {
 	credential: "unique(credentialId)",
 	state: "unique(scope)"
 };
-/** Bundle phone storage, admission, and lookup with overridable crypto and hook defaults. */
-const phonePersistenceLayer = (services) => Layer.unwrap(Effect.map(services, (value) => Layer.mergeAll(Layer.succeed(PhonePersistence, value.phonePersistence), Layer.succeed(PhoneAdmission, value.phoneAdmission), Layer.succeed(PhoneSignInTargets, value.phoneSignInTargets)))).pipe(Layer.provide([cryptoLayer, hooksLayer]));
+/** Bundle phone storage, admission, and lookup with empty hook defaults. */
+const phonePersistenceLayer = (services) => Layer.unwrap(Effect.map(services, (value) => Layer.mergeAll(Layer.succeed(PhonePersistence, value.phonePersistence), Layer.succeed(PhoneAdmission, value.phoneAdmission), Layer.succeed(PhoneSignInTargets, value.phoneSignInTargets)))).pipe(Layer.provide(hooksLayer));
 //#endregion
 export { phonePersistenceLayer, phoneProofCompletionMapping, phoneProofs, requiredPhoneConstraints };
 

package/dist/drizzle/phone-model.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"phone-model.mjs","names":[],"sources":["../../src/drizzle/phone-model.ts"],"sourcesContent":["import { cryptoLayer, hooksLayer } from \"@yielded/auth/Persistence\";\nimport {\n  type PhoneAdmissionPolicy,\n  type PhoneLifecyclePolicy,\n  type PhoneNumber,\n  PhoneAdmission,\n  PhonePersistence,\n  PhoneSignInTargets,\n} from \"@yielded/auth/PhoneOtp\";\nimport type { SubjectId } from \"@yielded/auth/Schema\";\nimport type { AuthenticationRequirement } from \"@yielded/auth/Sessions\";\nimport type { InferInsertModel, InferSelectModel, SQL, Table } from \"drizzle-orm\";\nimport { Effect, Layer } from \"effect\";\n\nimport type { PersistenceMappingError } from \"./model\";\nimport type { AnyProofPersistenceMapping, ProofPersistenceMapping } from \"./proof-model\";\nconst proofMapping = Symbol(\"effect-auth/phone/proofs\");\n\n/** Opaque same-owner proof mapping. The builder preserves the consumer's table codecs. */\nexport interface PhoneProofCompletionMapping {\n  readonly [proofMapping]: AnyProofPersistenceMapping;\n}\n\nexport const phoneProofCompletionMapping = <\n  Rq extends Table,\n  S extends Table,\n  G extends Table,\n  Cn extends Table,\n  Rs extends Table,\n  A extends Table,\n  F extends Table,\n  C extends Table,\n  Sub extends Table,\n  I extends Table,\n  Cr extends Table,\n  N,\n>(\n  mapping: ProofPersistenceMapping<Rq, S, G, Cn, Rs, A, F, C, Sub, I, Cr, N>,\n): PhoneProofCompletionMapping =>\n  Object.freeze({\n    [proofMapping]: Object.freeze({\n      ...mapping,\n      request: Object.freeze({ ...mapping.request }),\n      series: Object.freeze({ ...mapping.series }),\n      generation: Object.freeze({ ...mapping.generation }),\n      continuation: Object.freeze({ ...mapping.continuation }),\n      rateScope: Object.freeze({ ...mapping.rateScope }),\n      abuseEvent: Object.freeze({ ...mapping.abuseEvent }),\n      failureEvent: Object.freeze({ ...mapping.failureEvent }),\n      command: Object.freeze({ ...mapping.command }),\n      constraints: Object.freeze({ ...mapping.constraints }),\n      authority: Object.freeze({\n        ...mapping.authority,\n        identifier: Object.freeze({ ...mapping.authority.identifier }),\n        ...(mapping.authority.subject === undefined\n          ? {}\n          : { subject: Object.freeze({ ...mapping.authority.subject }) }),\n        ...(mapping.authority.credential === undefined\n          ? {}\n          : { credential: Object.freeze({ ...mapping.authority.credential }) }),\n        ...(mapping.authority.subjectId === undefined\n          ? {}\n          : { subjectId: Object.freeze({ ...mapping.authority.subjectId }) }),\n      }),\n      ...(mapping.d1 === undefined ? {} : { d1: Object.freeze({ ...mapping.d1 }) }),\n    }) as unknown as AnyProofPersistenceMapping,\n  });\n\n/** @internal */\nexport const phoneProofs = (mapping: PhoneProofCompletionMapping) => mapping[proofMapping];\nexport type PhoneColumn<T extends Table> = Extract<keyof T[\"_\"][\"columns\"], string>;\nexport type PhoneMappingSource<M, R = never> = M | Effect.Effect<M, PersistenceMappingError, R>;\n\nexport const requiredPhoneConstraints = {\n  subject: \"unique(id)\",\n  identifier: \"unique(namespace,value)\",\n  credential: \"unique(credentialId)\",\n  state: \"unique(scope)\",\n} as const;\n\n/** Consumer-owned schema; encoders and allocators are synchronous and side-effect free.\n * State stores permanent number custody and command tombstones, plus bounded admission\n * counters. Never delete custody rows to make a recycled number eligible. A consumer's\n * explicit recovery workflow may resolve custody only after independent authentication.\n * Subject defaults own account provisioning; no email/profile schema is prescribed. */\nexport interface PhoneMapping<\n  S extends Table,\n  I extends Table,\n  C extends Table,\n  T extends Table,\n  N,\n> {\n  readonly moduleId: string;\n  readonly policy: PhoneLifecyclePolicy;\n  readonly admission: PhoneAdmissionPolicy;\n  readonly constraints: typeof requiredPhoneConstraints;\n  readonly proofs: PhoneProofCompletionMapping;\n  readonly subjectIds: {\n    readonly toNative: (id: SubjectId) => N;\n    readonly toSubject: (id: N) => SubjectId;\n    readonly allocate: () => N;\n  };\n  readonly subject: {\n    readonly table: S;\n    readonly id: PhoneColumn<S>;\n    readonly securityRevision: PhoneColumn<S>;\n    readonly activeCondition: SQL;\n    readonly decodeRequirement: (row: InferSelectModel<S>) => AuthenticationRequirement;\n    /** Current action policy, independently from primary sign-in assurance. */\n    readonly decodeActionRequirement?: (\n      row: InferSelectModel<S>,\n      action: \"verify\" | \"change\",\n    ) => AuthenticationRequirement;\n    readonly encodeInsert: (input: {\n      readonly id: N;\n      readonly securityRevision: string;\n      readonly phoneNumber: PhoneNumber;\n    }) => InferInsertModel<S>;\n  };\n  readonly identifier: {\n    readonly table: I;\n    readonly namespace: PhoneColumn<I>;\n    readonly value: PhoneColumn<I>;\n    readonly subjectId: PhoneColumn<I>;\n    readonly revision: PhoneColumn<I>;\n    readonly verifiedAt: PhoneColumn<I>;\n    readonly status: PhoneColumn<I>;\n    readonly activeCondition: SQL;\n    readonly encodeStatus: (active: boolean) => unknown;\n    readonly encodeInsert: (input: {\n      readonly phoneNumber: PhoneNumber;\n      readonly subjectId: N;\n      readonly revision: string;\n      readonly verifiedAtMillis: number;\n      readonly active: boolean;\n    }) => InferInsertModel<I>;\n  };\n  readonly credential: {\n    readonly table: C;\n    readonly id: PhoneColumn<C>;\n    readonly subjectId: PhoneColumn<C>;\n    readonly revision: PhoneColumn<C>;\n    readonly status: PhoneColumn<C>;\n    readonly activeCondition: SQL;\n    readonly encodeStatus: (active: boolean) => unknown;\n    readonly encodeInsert: (input: {\n      readonly credentialId: string;\n      readonly subjectId: N;\n      readonly revision: string;\n      readonly active: boolean;\n    }) => InferInsertModel<C>;\n  };\n  readonly state: {\n    readonly table: T;\n    readonly scope: PhoneColumn<T>;\n    readonly state: PhoneColumn<T>;\n    readonly version: PhoneColumn<T>;\n    readonly encodeInsert: (input: {\n      readonly scope: string;\n      readonly state: string;\n      readonly version: string;\n    }) => InferInsertModel<T>;\n  };\n  readonly encodeInstant: (millis: number) => unknown;\n  readonly engineNowMillis: SQL;\n}\n\nexport interface D1PhoneMapping {\n  readonly d1: { readonly primary: true };\n}\n\nexport interface PhonePersistenceServices {\n  readonly phonePersistence: PhonePersistence[\"Service\"];\n  readonly phoneAdmission: PhoneAdmission[\"Service\"];\n  readonly phoneSignInTargets: PhoneSignInTargets[\"Service\"];\n}\n\n/** Bundle phone storage, admission, and lookup with overridable crypto and hook defaults. */\nexport const phonePersistenceLayer = <E, R>(\n  services: Effect.Effect<PhonePersistenceServices, E, R>,\n) =>\n  Layer.unwrap(\n    Effect.map(services, (value) =>\n      Layer.mergeAll(\n        Layer.succeed(PhonePersistence, value.phonePersistence),\n        Layer.succeed(PhoneAdmission, value.phoneAdmission),\n        Layer.succeed(PhoneSignInTargets, value.phoneSignInTargets),\n      ),\n    ),\n  ).pipe(Layer.provide([cryptoLayer, hooksLayer]));\n"],"mappings":";;;;AAgBA,MAAM,eAAe,OAAO,0BAA0B;AAOtD,MAAa,+BAcX,YAEA,OAAO,OAAO,GACX,eAAe,OAAO,OAAO;CAC5B,GAAG;CACH,SAAS,OAAO,OAAO,EAAE,GAAG,QAAQ,QAAQ,CAAC;CAC7C,QAAQ,OAAO,OAAO,EAAE,GAAG,QAAQ,OAAO,CAAC;CAC3C,YAAY,OAAO,OAAO,EAAE,GAAG,QAAQ,WAAW,CAAC;CACnD,cAAc,OAAO,OAAO,EAAE,GAAG,QAAQ,aAAa,CAAC;CACvD,WAAW,OAAO,OAAO,EAAE,GAAG,QAAQ,UAAU,CAAC;CACjD,YAAY,OAAO,OAAO,EAAE,GAAG,QAAQ,WAAW,CAAC;CACnD,cAAc,OAAO,OAAO,EAAE,GAAG,QAAQ,aAAa,CAAC;CACvD,SAAS,OAAO,OAAO,EAAE,GAAG,QAAQ,QAAQ,CAAC;CAC7C,aAAa,OAAO,OAAO,EAAE,GAAG,QAAQ,YAAY,CAAC;CACrD,WAAW,OAAO,OAAO;EACvB,GAAG,QAAQ;EACX,YAAY,OAAO,OAAO,EAAE,GAAG,QAAQ,UAAU,WAAW,CAAC;EAC7D,GAAI,QAAQ,UAAU,YAAY,KAAA,IAC9B,CAAC,IACD,EAAE,SAAS,OAAO,OAAO,EAAE,GAAG,QAAQ,UAAU,QAAQ,CAAC,EAAE;EAC/D,GAAI,QAAQ,UAAU,eAAe,KAAA,IACjC,CAAC,IACD,EAAE,YAAY,OAAO,OAAO,EAAE,GAAG,QAAQ,UAAU,WAAW,CAAC,EAAE;EACrE,GAAI,QAAQ,UAAU,cAAc,KAAA,IAChC,CAAC,IACD,EAAE,WAAW,OAAO,OAAO,EAAE,GAAG,QAAQ,UAAU,UAAU,CAAC,EAAE;CACrE,CAAC;CACD,GAAI,QAAQ,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI,OAAO,OAAO,EAAE,GAAG,QAAQ,GAAG,CAAC,EAAE;AAC7E,CAAC,EACH,CAAC;;AAGH,MAAa,eAAe,YAAyC,QAAQ;AAI7E,MAAa,2BAA2B;CACtC,SAAS;CACT,YAAY;CACZ,YAAY;CACZ,OAAO;AACT;;AAoGA,MAAa,yBACX,aAEA,MAAM,OACJ,OAAO,IAAI,WAAW,UACpB,MAAM,SACJ,MAAM,QAAQ,kBAAkB,MAAM,gBAAgB,GACtD,MAAM,QAAQ,gBAAgB,MAAM,cAAc,GAClD,MAAM,QAAQ,oBAAoB,MAAM,kBAAkB,CAC5D,CACF,CACF,CAAC,CAAC,KAAK,MAAM,QAAQ,CAAC,aAAa,UAAU,CAAC,CAAC"}
+{"version":3,"file":"phone-model.mjs","names":[],"sources":["../../src/drizzle/phone-model.ts"],"sourcesContent":["import { hooksLayer } from \"@yielded/auth/Persistence\";\nimport {\n  type PhoneAdmissionPolicy,\n  type PhoneLifecyclePolicy,\n  type PhoneNumber,\n  PhoneAdmission,\n  PhonePersistence,\n  PhoneSignInTargets,\n} from \"@yielded/auth/PhoneOtp\";\nimport type { SubjectId } from \"@yielded/auth/Schema\";\nimport type { AuthenticationRequirement } from \"@yielded/auth/Sessions\";\nimport type { InferInsertModel, InferSelectModel, SQL, Table } from \"drizzle-orm\";\nimport { Effect, Layer } from \"effect\";\n\nimport type { PersistenceMappingError } from \"./model\";\nimport type { AnyProofPersistenceMapping, ProofPersistenceMapping } from \"./proof-model\";\nconst proofMapping = Symbol(\"effect-auth/phone/proofs\");\n\n/** Opaque same-owner proof mapping. The builder preserves the consumer's table codecs. */\nexport interface PhoneProofCompletionMapping {\n  readonly [proofMapping]: AnyProofPersistenceMapping;\n}\n\nexport const phoneProofCompletionMapping = <\n  Rq extends Table,\n  S extends Table,\n  G extends Table,\n  Cn extends Table,\n  Rs extends Table,\n  A extends Table,\n  F extends Table,\n  C extends Table,\n  Sub extends Table,\n  I extends Table,\n  Cr extends Table,\n  N,\n>(\n  mapping: ProofPersistenceMapping<Rq, S, G, Cn, Rs, A, F, C, Sub, I, Cr, N>,\n): PhoneProofCompletionMapping =>\n  Object.freeze({\n    [proofMapping]: Object.freeze({\n      ...mapping,\n      request: Object.freeze({ ...mapping.request }),\n      series: Object.freeze({ ...mapping.series }),\n      generation: Object.freeze({ ...mapping.generation }),\n      continuation: Object.freeze({ ...mapping.continuation }),\n      rateScope: Object.freeze({ ...mapping.rateScope }),\n      abuseEvent: Object.freeze({ ...mapping.abuseEvent }),\n      failureEvent: Object.freeze({ ...mapping.failureEvent }),\n      command: Object.freeze({ ...mapping.command }),\n      constraints: Object.freeze({ ...mapping.constraints }),\n      authority: Object.freeze({\n        ...mapping.authority,\n        identifier: Object.freeze({ ...mapping.authority.identifier }),\n        ...(mapping.authority.subject === undefined\n          ? {}\n          : { subject: Object.freeze({ ...mapping.authority.subject }) }),\n        ...(mapping.authority.credential === undefined\n          ? {}\n          : { credential: Object.freeze({ ...mapping.authority.credential }) }),\n        ...(mapping.authority.subjectId === undefined\n          ? {}\n          : { subjectId: Object.freeze({ ...mapping.authority.subjectId }) }),\n      }),\n      ...(mapping.d1 === undefined ? {} : { d1: Object.freeze({ ...mapping.d1 }) }),\n    }) as unknown as AnyProofPersistenceMapping,\n  });\n\n/** @internal */\nexport const phoneProofs = (mapping: PhoneProofCompletionMapping) => mapping[proofMapping];\nexport type PhoneColumn<T extends Table> = Extract<keyof T[\"_\"][\"columns\"], string>;\nexport type PhoneMappingSource<M, R = never> = M | Effect.Effect<M, PersistenceMappingError, R>;\n\nexport const requiredPhoneConstraints = {\n  subject: \"unique(id)\",\n  identifier: \"unique(namespace,value)\",\n  credential: \"unique(credentialId)\",\n  state: \"unique(scope)\",\n} as const;\n\n/** Consumer-owned schema; encoders and allocators are synchronous and side-effect free.\n * State stores permanent number custody and command tombstones, plus bounded admission\n * counters. Never delete custody rows to make a recycled number eligible. A consumer's\n * explicit recovery workflow may resolve custody only after independent authentication.\n * Subject defaults own account provisioning; no email/profile schema is prescribed. */\nexport interface PhoneMapping<\n  S extends Table,\n  I extends Table,\n  C extends Table,\n  T extends Table,\n  N,\n> {\n  readonly moduleId: string;\n  readonly policy: PhoneLifecyclePolicy;\n  readonly admission: PhoneAdmissionPolicy;\n  readonly constraints: typeof requiredPhoneConstraints;\n  readonly proofs: PhoneProofCompletionMapping;\n  readonly subjectIds: {\n    readonly toNative: (id: SubjectId) => N;\n    readonly toSubject: (id: N) => SubjectId;\n    readonly allocate: () => N;\n  };\n  readonly subject: {\n    readonly table: S;\n    readonly id: PhoneColumn<S>;\n    readonly securityRevision: PhoneColumn<S>;\n    readonly activeCondition: SQL;\n    readonly decodeRequirement: (row: InferSelectModel<S>) => AuthenticationRequirement;\n    /** Current action policy, independently from primary sign-in assurance. */\n    readonly decodeActionRequirement?: (\n      row: InferSelectModel<S>,\n      action: \"verify\" | \"change\",\n    ) => AuthenticationRequirement;\n    readonly encodeInsert: (input: {\n      readonly id: N;\n      readonly securityRevision: string;\n      readonly phoneNumber: PhoneNumber;\n    }) => InferInsertModel<S>;\n  };\n  readonly identifier: {\n    readonly table: I;\n    readonly namespace: PhoneColumn<I>;\n    readonly value: PhoneColumn<I>;\n    readonly subjectId: PhoneColumn<I>;\n    readonly revision: PhoneColumn<I>;\n    readonly verifiedAt: PhoneColumn<I>;\n    readonly status: PhoneColumn<I>;\n    readonly activeCondition: SQL;\n    readonly encodeStatus: (active: boolean) => unknown;\n    readonly encodeInsert: (input: {\n      readonly phoneNumber: PhoneNumber;\n      readonly subjectId: N;\n      readonly revision: string;\n      readonly verifiedAtMillis: number;\n      readonly active: boolean;\n    }) => InferInsertModel<I>;\n  };\n  readonly credential: {\n    readonly table: C;\n    readonly id: PhoneColumn<C>;\n    readonly subjectId: PhoneColumn<C>;\n    readonly revision: PhoneColumn<C>;\n    readonly status: PhoneColumn<C>;\n    readonly activeCondition: SQL;\n    readonly encodeStatus: (active: boolean) => unknown;\n    readonly encodeInsert: (input: {\n      readonly credentialId: string;\n      readonly subjectId: N;\n      readonly revision: string;\n      readonly active: boolean;\n    }) => InferInsertModel<C>;\n  };\n  readonly state: {\n    readonly table: T;\n    readonly scope: PhoneColumn<T>;\n    readonly state: PhoneColumn<T>;\n    readonly version: PhoneColumn<T>;\n    readonly encodeInsert: (input: {\n      readonly scope: string;\n      readonly state: string;\n      readonly version: string;\n    }) => InferInsertModel<T>;\n  };\n  readonly encodeInstant: (millis: number) => unknown;\n  readonly engineNowMillis: SQL;\n}\n\nexport interface D1PhoneMapping {\n  readonly d1: { readonly primary: true };\n}\n\nexport interface PhonePersistenceServices {\n  readonly phonePersistence: PhonePersistence[\"Service\"];\n  readonly phoneAdmission: PhoneAdmission[\"Service\"];\n  readonly phoneSignInTargets: PhoneSignInTargets[\"Service\"];\n}\n\n/** Bundle phone storage, admission, and lookup with empty hook defaults. */\nexport const phonePersistenceLayer = <E, R>(\n  services: Effect.Effect<PhonePersistenceServices, E, R>,\n) =>\n  Layer.unwrap(\n    Effect.map(services, (value) =>\n      Layer.mergeAll(\n        Layer.succeed(PhonePersistence, value.phonePersistence),\n        Layer.succeed(PhoneAdmission, value.phoneAdmission),\n        Layer.succeed(PhoneSignInTargets, value.phoneSignInTargets),\n      ),\n    ),\n  ).pipe(Layer.provide(hooksLayer));\n"],"mappings":";;;;AAgBA,MAAM,eAAe,OAAO,0BAA0B;AAOtD,MAAa,+BAcX,YAEA,OAAO,OAAO,GACX,eAAe,OAAO,OAAO;CAC5B,GAAG;CACH,SAAS,OAAO,OAAO,EAAE,GAAG,QAAQ,QAAQ,CAAC;CAC7C,QAAQ,OAAO,OAAO,EAAE,GAAG,QAAQ,OAAO,CAAC;CAC3C,YAAY,OAAO,OAAO,EAAE,GAAG,QAAQ,WAAW,CAAC;CACnD,cAAc,OAAO,OAAO,EAAE,GAAG,QAAQ,aAAa,CAAC;CACvD,WAAW,OAAO,OAAO,EAAE,GAAG,QAAQ,UAAU,CAAC;CACjD,YAAY,OAAO,OAAO,EAAE,GAAG,QAAQ,WAAW,CAAC;CACnD,cAAc,OAAO,OAAO,EAAE,GAAG,QAAQ,aAAa,CAAC;CACvD,SAAS,OAAO,OAAO,EAAE,GAAG,QAAQ,QAAQ,CAAC;CAC7C,aAAa,OAAO,OAAO,EAAE,GAAG,QAAQ,YAAY,CAAC;CACrD,WAAW,OAAO,OAAO;EACvB,GAAG,QAAQ;EACX,YAAY,OAAO,OAAO,EAAE,GAAG,QAAQ,UAAU,WAAW,CAAC;EAC7D,GAAI,QAAQ,UAAU,YAAY,KAAA,IAC9B,CAAC,IACD,EAAE,SAAS,OAAO,OAAO,EAAE,GAAG,QAAQ,UAAU,QAAQ,CAAC,EAAE;EAC/D,GAAI,QAAQ,UAAU,eAAe,KAAA,IACjC,CAAC,IACD,EAAE,YAAY,OAAO,OAAO,EAAE,GAAG,QAAQ,UAAU,WAAW,CAAC,EAAE;EACrE,GAAI,QAAQ,UAAU,cAAc,KAAA,IAChC,CAAC,IACD,EAAE,WAAW,OAAO,OAAO,EAAE,GAAG,QAAQ,UAAU,UAAU,CAAC,EAAE;CACrE,CAAC;CACD,GAAI,QAAQ,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI,OAAO,OAAO,EAAE,GAAG,QAAQ,GAAG,CAAC,EAAE;AAC7E,CAAC,EACH,CAAC;;AAGH,MAAa,eAAe,YAAyC,QAAQ;AAI7E,MAAa,2BAA2B;CACtC,SAAS;CACT,YAAY;CACZ,YAAY;CACZ,OAAO;AACT;;AAoGA,MAAa,yBACX,aAEA,MAAM,OACJ,OAAO,IAAI,WAAW,UACpB,MAAM,SACJ,MAAM,QAAQ,kBAAkB,MAAM,gBAAgB,GACtD,MAAM,QAAQ,gBAAgB,MAAM,cAAc,GAClD,MAAM,QAAQ,oBAAoB,MAAM,kBAAkB,CAC5D,CACF,CACF,CAAC,CAAC,KAAK,MAAM,QAAQ,UAAU,CAAC"}

package/dist/drizzle/phone-target.d.mts

@@ -5,7 +5,7 @@ import "./phone-model.mjs";
 import "./SuppliedService.mjs";
 import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import { Table } from "drizzle-orm";
-import { Context, Effect } from "effect";
+import { Context, Crypto, Effect } from "effect";
 import { LifecycleHooks } from "@yielded/auth/Hooks";
 import { PhoneAdmission, PhoneConfigurationError, PhoneOtpUnavailable, PhonePersistence, PhoneSignInTargets } from "@yielded/auth/PhoneOtp";
 import { Statement } from "effect/sql/Statement";

package/dist/drizzle/phone-target.mjs

@@ -1,6 +1,7 @@
 import { requiredProofConstraints } from "./proof-model.mjs";
 import { validateDrizzleStorage } from "./storage-validation.mjs";
 import { CurrentProofSql, completeProofPlanIn } from "./proof-sql.mjs";
+import { randomId } from "./crypto.mjs";
 import { coordinateTransactionOwner, makeTransactionExecution, sqlClientTransactionStandaloneGuard } from "./transaction-execution.mjs";
 import { phoneProofs, requiredPhoneConstraints } from "./phone-model.mjs";
 import { CurrentD1PlanningDatabase } from "./d1-planning.mjs";
@@ -12,7 +13,6 @@ import { sql } from "drizzle-orm";
 import { Context, Effect, Schema } from "effect";
 import { LifecycleHooks } from "@yielded/auth/Hooks";
 import { ProofBinding } from "@yielded/auth/Proofs";
-import { randomId } from "@yielded/auth-crypto";
 import { PhoneActionAuthorization, PhoneAdmission, PhoneAdmissionPolicy, PhoneConfigurationError, PhoneLifecyclePolicy, PhoneLifecycleTarget, PhonePersistence, PhoneSignInTargets } from "@yielded/auth/PhoneOtp";
 //#region src/drizzle/phone-target.ts
 const sqlClientPhoneStandaloneGuard = (service) => sqlClientTransactionStandaloneGuard(unavailable, service);
@@ -158,7 +158,7 @@ const coordinateTargetPhone = (database, source, configuration, body) => Effect.
 	}).pipe(Effect.mapError(() => PhoneConfigurationError.make({})));
 	return yield* coordinateTransactionOwner(database, CurrentPhoneTransaction, configuration, Effect.void, unavailable, randomId, (execution) => services(mapping, execution, configuration), (transaction, acquireServices, append) => Effect.flatMap(acquireServices, (boundServices) => body(transaction, boundServices, append)));
 });
-/** Concrete driver wrappers select transaction mode; cryptography always precedes these owners. */
+/** Concrete driver wrappers select transaction mode. */
 const makePhoneTarget = (databaseService, configuration) => {
 	function coordinatePhonePersistence(acquire, options, body) {
 		return Effect.flatMap(nativeDatabase(acquire), (database) => coordinateTargetPhone(database, options.mapping, configuration, (transaction, services) => {