@yielded/auth-persistence-drizzle 0.1.0-beta.23 → 0.1.0-beta.25

package/dist/drizzle/password-prepared-model.d.mts

@@ -63,8 +63,8 @@ export declare const requiredPasswordPreparedConstraints: {
   readonly digest: "unique(intent.digest)";
 };
 export type RequiredPasswordPreparedConstraints = typeof requiredPasswordPreparedConstraints;
-export interface PasswordPreparedPersistenceMapping<Subject extends Table, Identifier extends Table, Credential extends Table, AuthorityCredential extends Table, Attempt extends Table, Command extends Table, Intent extends Table, Admission extends Table, NativeSubjectId> {
-  readonly password: PasswordPersistenceMapping<Subject, Identifier, Credential, AuthorityCredential, Attempt, Command, NativeSubjectId>;
+export interface PasswordPreparedPersistenceMapping<Subject extends Table, Identifier extends Table, Credential extends Table, AuthorityCredential extends Table, Command extends Table, Intent extends Table, Admission extends Table, NativeSubjectId> {
+  readonly password: PasswordPersistenceMapping<Subject, Identifier, Credential, AuthorityCredential, Command, NativeSubjectId>;
   readonly intent: PasswordPreparedIntentTable<Intent, NativeSubjectId>;
   readonly admission: PasswordPreparedAdmissionTable<Admission>;
   readonly constraints: RequiredPasswordPreparedConstraints;
@@ -72,12 +72,12 @@ export interface PasswordPreparedPersistenceMapping<Subject extends Table, Ident
   /** Required by synchronous owners, invoked inside their actual transactionSync. */
   readonly allocateVersionSync?: () => PasswordPreparedVersion;
 }
-export type D1PasswordPreparedPersistenceMapping<Subject extends Table, Identifier extends Table, Credential extends Table, AuthorityCredential extends Table, Attempt extends Table, Command extends Table, Intent extends Table, Admission extends Table, NativeSubjectId> = PasswordPreparedPersistenceMapping<Subject, Identifier, Credential, AuthorityCredential, Attempt, Command, Intent, Admission, NativeSubjectId> & {
+export type D1PasswordPreparedPersistenceMapping<Subject extends Table, Identifier extends Table, Credential extends Table, AuthorityCredential extends Table, Command extends Table, Intent extends Table, Admission extends Table, NativeSubjectId> = PasswordPreparedPersistenceMapping<Subject, Identifier, Credential, AuthorityCredential, Command, Intent, Admission, NativeSubjectId> & {
   /** Convert a stored native instant to epoch milliseconds in the same SQL engine. */
   readonly admissionClock: {
     readonly toMillis: (instant: SQL) => SQL;
   };
-  readonly password: D1PasswordPersistenceMapping<Subject, Identifier, Credential, AuthorityCredential, Attempt, Command, NativeSubjectId>;
+  readonly password: D1PasswordPersistenceMapping<Subject, Identifier, Credential, AuthorityCredential, Command, NativeSubjectId>;
 };
 /** Optional real proof completion authority. Request/delivery/abuse capabilities
  * are not required to complete the original continuation. */
@@ -87,6 +87,6 @@ export type PasswordPreparedProofMapping<Series extends Table, Continuation exte
 export type D1PasswordPreparedProofMapping<Series extends Table, Continuation extends Table, Command extends Table, Subject extends Table, Identifier extends Table, Credential extends Table, NativeSubjectId> = Pick<D1ProofPersistenceMapping<Table, Series, Table, Continuation, Table, Table, Table, Command, Subject, Identifier, Credential, NativeSubjectId>, Exclude<keyof PasswordPreparedProofMapping<Series, Continuation, Command, Subject, Identifier, Credential, NativeSubjectId>, "constraints">> & {
   readonly constraints: PasswordPreparedProofMapping<Series, Continuation, Command, Subject, Identifier, Credential, NativeSubjectId>["constraints"];
 };
-export type AnyPasswordPreparedPersistenceMapping = PasswordPreparedPersistenceMapping<Table, Table, Table, Table, Table, Table, Table, Table, unknown>;
+export type AnyPasswordPreparedPersistenceMapping = PasswordPreparedPersistenceMapping<Table, Table, Table, Table, Table, Table, Table, unknown>;
 //#endregion
 //# sourceMappingURL=password-prepared-model.d.mts.map

package/dist/drizzle/password-prepared-model.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"password-prepared-model.mjs","names":[],"sources":["../../src/drizzle/password-prepared-model.ts"],"sourcesContent":["import type {\n  PasswordPreparedReady,\n  PasswordPreparedReservation,\n  PasswordPreparedVersion,\n} from \"@yielded/auth/Password\";\nimport type { InferInsertModel, InferSelectModel, SQL, Table } from \"drizzle-orm\";\nimport type { Effect } from \"effect\";\n\nimport type { PersistenceMappingError } from \"./model\";\nimport type { D1PasswordPersistenceMapping, PasswordPersistenceMapping } from \"./password-model\";\nimport type {\n  D1ProofPersistenceMapping,\n  ProofPersistenceMapping,\n  RequiredProofConstraints,\n} from \"./proof-model\";\n\ntype ColumnKey<T extends Table> = Extract<keyof T[\"_\"][\"columns\"], string>;\nexport type PasswordPreparedState = \"Preparing\" | \"Ready\" | \"Consumed\" | \"Cancelled\" | \"Expired\";\n\n/** The retained intent is also its nonrefundable admission charge. Scalar identity,\n * scope and timing columns survive sensitive snapshot/digest erasure. */\nexport interface PasswordPreparedIntentTable<Intent extends Table, NativeSubjectId> {\n  readonly table: Intent;\n  readonly moduleId: ColumnKey<Intent>;\n  readonly intentId: ColumnKey<Intent>;\n  readonly commandId: ColumnKey<Intent>;\n  readonly subjectId: ColumnKey<Intent>;\n  readonly action: ColumnKey<Intent>;\n  readonly generation: ColumnKey<Intent>;\n  readonly version: ColumnKey<Intent>;\n  readonly state: ColumnKey<Intent>;\n  readonly digest: ColumnKey<Intent>;\n  readonly snapshot: ColumnKey<Intent>;\n  readonly identifierScope: ColumnKey<Intent>;\n  readonly createdAt: ColumnKey<Intent>;\n  readonly admittedAt: ColumnKey<Intent>;\n  readonly admissionRetainUntil: ColumnKey<Intent>;\n  readonly preparationExpiresAt: ColumnKey<Intent>;\n  readonly expiresAt: ColumnKey<Intent>;\n  readonly retainUntil: ColumnKey<Intent>;\n  readonly states: Readonly<\n    Record<PasswordPreparedState, InferSelectModel<Intent>[ColumnKey<Intent>]>\n  >;\n  readonly encodeInsert: (input: {\n    readonly reservation: PasswordPreparedReservation;\n    readonly nativeSubjectId: NativeSubjectId;\n    readonly identifierScope: string;\n    readonly admittedAtMillis: number;\n    readonly admissionRetainUntilMillis: number;\n    /** Bounded private core codec output; contains a salted verifier for Change/Reset. */\n    readonly snapshot: string;\n  }) => InferInsertModel<Intent>;\n  readonly encodeReady: (input: {\n    readonly ready: PasswordPreparedReady;\n    readonly snapshot: string;\n  }) => Partial<InferInsertModel<Intent>>;\n  /** Erase snapshot and digest, preserving every identity/scope/time column. */\n  readonly encodeTerminal: (\n    state: Exclude<PasswordPreparedState, \"Preparing\" | \"Ready\">,\n  ) => Partial<InferInsertModel<Intent>>;\n}\n\n/** One permanent row per configured module; never one row per attacker input.\n * Native owners lock this before subject → identifier → sorted credentials → intent.\n * It serializes admission and maintenance without process-local locks. */\nexport interface PasswordPreparedAdmissionTable<Admission extends Table> {\n  readonly table: Admission;\n  readonly moduleId: ColumnKey<Admission>;\n  readonly intentId: ColumnKey<Admission>;\n  readonly admittedAt: ColumnKey<Admission>;\n  readonly admissionRetainUntil: ColumnKey<Admission>;\n  readonly encodeInsert: (moduleId: string) => InferInsertModel<Admission>;\n}\n\nexport const requiredPasswordPreparedConstraints = {\n  admission: \"unique(admission.moduleId)\",\n  intent: \"unique(intent.moduleId,intent.intentId)\",\n  command: \"unique(intent.moduleId,intent.commandId)\",\n  digest: \"unique(intent.digest)\",\n} as const;\n\nexport type RequiredPasswordPreparedConstraints = typeof requiredPasswordPreparedConstraints;\n\nexport interface PasswordPreparedPersistenceMapping<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Attempt extends Table,\n  Command extends Table,\n  Intent extends Table,\n  Admission extends Table,\n  NativeSubjectId,\n> {\n  readonly password: PasswordPersistenceMapping<\n    Subject,\n    Identifier,\n    Credential,\n    AuthorityCredential,\n    Attempt,\n    Command,\n    NativeSubjectId\n  >;\n  readonly intent: PasswordPreparedIntentTable<Intent, NativeSubjectId>;\n  readonly admission: PasswordPreparedAdmissionTable<Admission>;\n  readonly constraints: RequiredPasswordPreparedConstraints;\n  readonly allocateVersion?: Effect.Effect<PasswordPreparedVersion, PersistenceMappingError>;\n  /** Required by synchronous owners, invoked inside their actual transactionSync. */\n  readonly allocateVersionSync?: () => PasswordPreparedVersion;\n}\n\nexport type D1PasswordPreparedPersistenceMapping<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Attempt extends Table,\n  Command extends Table,\n  Intent extends Table,\n  Admission extends Table,\n  NativeSubjectId,\n> = PasswordPreparedPersistenceMapping<\n  Subject,\n  Identifier,\n  Credential,\n  AuthorityCredential,\n  Attempt,\n  Command,\n  Intent,\n  Admission,\n  NativeSubjectId\n> & {\n  /** Convert a stored native instant to epoch milliseconds in the same SQL engine. */\n  readonly admissionClock: { readonly toMillis: (instant: SQL) => SQL };\n  readonly password: D1PasswordPersistenceMapping<\n    Subject,\n    Identifier,\n    Credential,\n    AuthorityCredential,\n    Attempt,\n    Command,\n    NativeSubjectId\n  >;\n};\n\n/** Optional real proof completion authority. Request/delivery/abuse capabilities\n * are not required to complete the original continuation. */\nexport type PasswordPreparedProofMapping<\n  Series extends Table,\n  Continuation extends Table,\n  Command extends Table,\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  NativeSubjectId,\n> = Pick<\n  ProofPersistenceMapping<\n    Table,\n    Series,\n    Table,\n    Continuation,\n    Table,\n    Table,\n    Table,\n    Command,\n    Subject,\n    Identifier,\n    Credential,\n    NativeSubjectId\n  >,\n  | \"series\"\n  | \"continuation\"\n  | \"command\"\n  | \"authority\"\n  | \"scopeKeys\"\n  | \"encodeInstant\"\n  | \"decodeInstant\"\n  | \"allocateVersion\"\n  | \"allocateVersionSync\"\n  | \"isSeriesConflict\"\n  | \"isCommandConflict\"\n  | \"d1\"\n> & {\n  readonly constraints: Pick<\n    RequiredProofConstraints,\n    \"series\" | \"continuationId\" | \"continuationDigest\" | \"command\"\n  >;\n};\n\nexport type D1PasswordPreparedProofMapping<\n  Series extends Table,\n  Continuation extends Table,\n  Command extends Table,\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  NativeSubjectId,\n> = Pick<\n  D1ProofPersistenceMapping<\n    Table,\n    Series,\n    Table,\n    Continuation,\n    Table,\n    Table,\n    Table,\n    Command,\n    Subject,\n    Identifier,\n    Credential,\n    NativeSubjectId\n  >,\n  Exclude<\n    keyof PasswordPreparedProofMapping<\n      Series,\n      Continuation,\n      Command,\n      Subject,\n      Identifier,\n      Credential,\n      NativeSubjectId\n    >,\n    \"constraints\"\n  >\n> & {\n  readonly constraints: PasswordPreparedProofMapping<\n    Series,\n    Continuation,\n    Command,\n    Subject,\n    Identifier,\n    Credential,\n    NativeSubjectId\n  >[\"constraints\"];\n};\n\nexport type AnyPasswordPreparedPersistenceMapping = PasswordPreparedPersistenceMapping<\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  unknown\n>;\n"],"mappings":";AA0EA,MAAa,sCAAsC;CACjD,WAAW;CACX,QAAQ;CACR,SAAS;CACT,QAAQ;AACV"}
+{"version":3,"file":"password-prepared-model.mjs","names":[],"sources":["../../src/drizzle/password-prepared-model.ts"],"sourcesContent":["import type {\n  PasswordPreparedReady,\n  PasswordPreparedReservation,\n  PasswordPreparedVersion,\n} from \"@yielded/auth/Password\";\nimport type { InferInsertModel, InferSelectModel, SQL, Table } from \"drizzle-orm\";\nimport type { Effect } from \"effect\";\n\nimport type { PersistenceMappingError } from \"./model\";\nimport type { D1PasswordPersistenceMapping, PasswordPersistenceMapping } from \"./password-model\";\nimport type {\n  D1ProofPersistenceMapping,\n  ProofPersistenceMapping,\n  RequiredProofConstraints,\n} from \"./proof-model\";\n\ntype ColumnKey<T extends Table> = Extract<keyof T[\"_\"][\"columns\"], string>;\nexport type PasswordPreparedState = \"Preparing\" | \"Ready\" | \"Consumed\" | \"Cancelled\" | \"Expired\";\n\n/** The retained intent is also its nonrefundable admission charge. Scalar identity,\n * scope and timing columns survive sensitive snapshot/digest erasure. */\nexport interface PasswordPreparedIntentTable<Intent extends Table, NativeSubjectId> {\n  readonly table: Intent;\n  readonly moduleId: ColumnKey<Intent>;\n  readonly intentId: ColumnKey<Intent>;\n  readonly commandId: ColumnKey<Intent>;\n  readonly subjectId: ColumnKey<Intent>;\n  readonly action: ColumnKey<Intent>;\n  readonly generation: ColumnKey<Intent>;\n  readonly version: ColumnKey<Intent>;\n  readonly state: ColumnKey<Intent>;\n  readonly digest: ColumnKey<Intent>;\n  readonly snapshot: ColumnKey<Intent>;\n  readonly identifierScope: ColumnKey<Intent>;\n  readonly createdAt: ColumnKey<Intent>;\n  readonly admittedAt: ColumnKey<Intent>;\n  readonly admissionRetainUntil: ColumnKey<Intent>;\n  readonly preparationExpiresAt: ColumnKey<Intent>;\n  readonly expiresAt: ColumnKey<Intent>;\n  readonly retainUntil: ColumnKey<Intent>;\n  readonly states: Readonly<\n    Record<PasswordPreparedState, InferSelectModel<Intent>[ColumnKey<Intent>]>\n  >;\n  readonly encodeInsert: (input: {\n    readonly reservation: PasswordPreparedReservation;\n    readonly nativeSubjectId: NativeSubjectId;\n    readonly identifierScope: string;\n    readonly admittedAtMillis: number;\n    readonly admissionRetainUntilMillis: number;\n    /** Bounded private core codec output; contains a salted verifier for Change/Reset. */\n    readonly snapshot: string;\n  }) => InferInsertModel<Intent>;\n  readonly encodeReady: (input: {\n    readonly ready: PasswordPreparedReady;\n    readonly snapshot: string;\n  }) => Partial<InferInsertModel<Intent>>;\n  /** Erase snapshot and digest, preserving every identity/scope/time column. */\n  readonly encodeTerminal: (\n    state: Exclude<PasswordPreparedState, \"Preparing\" | \"Ready\">,\n  ) => Partial<InferInsertModel<Intent>>;\n}\n\n/** One permanent row per configured module; never one row per attacker input.\n * Native owners lock this before subject → identifier → sorted credentials → intent.\n * It serializes admission and maintenance without process-local locks. */\nexport interface PasswordPreparedAdmissionTable<Admission extends Table> {\n  readonly table: Admission;\n  readonly moduleId: ColumnKey<Admission>;\n  readonly intentId: ColumnKey<Admission>;\n  readonly admittedAt: ColumnKey<Admission>;\n  readonly admissionRetainUntil: ColumnKey<Admission>;\n  readonly encodeInsert: (moduleId: string) => InferInsertModel<Admission>;\n}\n\nexport const requiredPasswordPreparedConstraints = {\n  admission: \"unique(admission.moduleId)\",\n  intent: \"unique(intent.moduleId,intent.intentId)\",\n  command: \"unique(intent.moduleId,intent.commandId)\",\n  digest: \"unique(intent.digest)\",\n} as const;\n\nexport type RequiredPasswordPreparedConstraints = typeof requiredPasswordPreparedConstraints;\n\nexport interface PasswordPreparedPersistenceMapping<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Command extends Table,\n  Intent extends Table,\n  Admission extends Table,\n  NativeSubjectId,\n> {\n  readonly password: PasswordPersistenceMapping<\n    Subject,\n    Identifier,\n    Credential,\n    AuthorityCredential,\n    Command,\n    NativeSubjectId\n  >;\n  readonly intent: PasswordPreparedIntentTable<Intent, NativeSubjectId>;\n  readonly admission: PasswordPreparedAdmissionTable<Admission>;\n  readonly constraints: RequiredPasswordPreparedConstraints;\n  readonly allocateVersion?: Effect.Effect<PasswordPreparedVersion, PersistenceMappingError>;\n  /** Required by synchronous owners, invoked inside their actual transactionSync. */\n  readonly allocateVersionSync?: () => PasswordPreparedVersion;\n}\n\nexport type D1PasswordPreparedPersistenceMapping<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Command extends Table,\n  Intent extends Table,\n  Admission extends Table,\n  NativeSubjectId,\n> = PasswordPreparedPersistenceMapping<\n  Subject,\n  Identifier,\n  Credential,\n  AuthorityCredential,\n  Command,\n  Intent,\n  Admission,\n  NativeSubjectId\n> & {\n  /** Convert a stored native instant to epoch milliseconds in the same SQL engine. */\n  readonly admissionClock: { readonly toMillis: (instant: SQL) => SQL };\n  readonly password: D1PasswordPersistenceMapping<\n    Subject,\n    Identifier,\n    Credential,\n    AuthorityCredential,\n    Command,\n    NativeSubjectId\n  >;\n};\n\n/** Optional real proof completion authority. Request/delivery/abuse capabilities\n * are not required to complete the original continuation. */\nexport type PasswordPreparedProofMapping<\n  Series extends Table,\n  Continuation extends Table,\n  Command extends Table,\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  NativeSubjectId,\n> = Pick<\n  ProofPersistenceMapping<\n    Table,\n    Series,\n    Table,\n    Continuation,\n    Table,\n    Table,\n    Table,\n    Command,\n    Subject,\n    Identifier,\n    Credential,\n    NativeSubjectId\n  >,\n  | \"series\"\n  | \"continuation\"\n  | \"command\"\n  | \"authority\"\n  | \"scopeKeys\"\n  | \"encodeInstant\"\n  | \"decodeInstant\"\n  | \"allocateVersion\"\n  | \"allocateVersionSync\"\n  | \"isSeriesConflict\"\n  | \"isCommandConflict\"\n  | \"d1\"\n> & {\n  readonly constraints: Pick<\n    RequiredProofConstraints,\n    \"series\" | \"continuationId\" | \"continuationDigest\" | \"command\"\n  >;\n};\n\nexport type D1PasswordPreparedProofMapping<\n  Series extends Table,\n  Continuation extends Table,\n  Command extends Table,\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  NativeSubjectId,\n> = Pick<\n  D1ProofPersistenceMapping<\n    Table,\n    Series,\n    Table,\n    Continuation,\n    Table,\n    Table,\n    Table,\n    Command,\n    Subject,\n    Identifier,\n    Credential,\n    NativeSubjectId\n  >,\n  Exclude<\n    keyof PasswordPreparedProofMapping<\n      Series,\n      Continuation,\n      Command,\n      Subject,\n      Identifier,\n      Credential,\n      NativeSubjectId\n    >,\n    \"constraints\"\n  >\n> & {\n  readonly constraints: PasswordPreparedProofMapping<\n    Series,\n    Continuation,\n    Command,\n    Subject,\n    Identifier,\n    Credential,\n    NativeSubjectId\n  >[\"constraints\"];\n};\n\nexport type AnyPasswordPreparedPersistenceMapping = PasswordPreparedPersistenceMapping<\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  unknown\n>;\n"],"mappings":";AA0EA,MAAa,sCAAsC;CACjD,WAAW;CACX,QAAQ;CACR,SAAS;CACT,QAAQ;AACV"}

package/dist/drizzle/password-prepared-sql.mjs

@@ -237,7 +237,7 @@ const makeSqlPasswordPreparedPersistence = Effect.fn("makeSqlPasswordPreparedPer
 	return {
 		reserve: (uncaptured, prepare) => Effect.gen(function* () {
 			const input = yield* snapshotReserve(uncaptured);
-			if (input.action === "reset-password" !== (input.reset !== void 0 && input.completion !== void 0) || input.action === "reset-password" && configuration.proof === void 0 || input.generation !== input.policy.generation || input.policy.retentionMillis < Math.max(input.policy.preparationLifetimeMillis + input.policy.lifetimeMillis, input.policy.admission.action.windowMillis, input.policy.admission.identifier.windowMillis, input.policy.admission.subject.windowMillis) || input.invalidation.existingSessions === "immediate" && p.sessionInvalidation !== "same-authority-immediate") return yield* unavailable();
+			if (input.action === "reset-password" !== (input.reset !== void 0 && input.completion !== void 0) || input.action === "reset-password" && configuration.proof === void 0 || input.generation !== input.policy.generation || input.policy.retentionMillis < Math.max(input.policy.preparationLifetimeMillis + input.policy.lifetimeMillis, input.policy.admission.action.windowMillis, input.policy.admission.identifier.windowMillis, input.policy.admission.subject.windowMillis) || (input.invalidation.existingSessions === "immediate" || input.invalidation.existingSessions === "cache-expiry") && p.sessionInvalidation !== "same-authority-immediate") return yield* unavailable();
 			return yield* owned(Effect.gen(function* () {
 				const transaction = yield* CurrentPasswordSql;
 				const journal = yield* CurrentCommitJournal;

package/dist/drizzle/password-prepared-sql.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"password-prepared-sql.mjs","names":["kernel"],"sources":["../../src/drizzle/password-prepared-sql.ts"],"sourcesContent":["import {\n  type NativeDatabase,\n  CurrentPasswordPreparedTransaction,\n  PasswordPreparedPostconditions,\n  PasswordPreparedJournalGuards,\n} from \"@yielded/auth-persistence/Adapter\";\nimport { CurrentCommitJournal, LifecycleHooks, HookConfigurationError } from \"@yielded/auth/Hooks\";\nimport {\n  PasswordUnavailable,\n  PasswordRejected,\n  PasswordPreparedVersion,\n  decodePasswordPreparedReady,\n  encodePasswordPreparedReady,\n  snapshotPasswordPreparedReady,\n  snapshotPasswordPreparedReservation,\n  type PasswordPreparedReady,\n  type PasswordPreparedReservation,\n  snapshotPasswordCredential,\n  snapshotPasswordRequirement,\n  type PasswordMutationDecision,\n  type PreparePasswordCommit,\n  type PasswordPreparedPersistence,\n  type PasswordPreparedMutation,\n} from \"@yielded/auth/Password\";\nimport { reportPersistenceFailure } from \"@yielded/auth/Persistence\";\nimport { type ProofCompletionPlan, ProofUnavailable, ProofBinding } from \"@yielded/auth/Proofs\";\nimport { AuthenticationRevision } from \"@yielded/auth/Sessions\";\n/* oxlint-disable no-explicit-any -- concrete driver makers retain consumer table types. */\nimport { and, count, eq, gt, isNotNull, isNull, lte, or, type SQL } from \"drizzle-orm\";\nimport { Cause, DateTime, Effect, Option, Predicate, Redacted, Schema } from \"effect\";\n\nimport { column } from \"./model\";\nimport {\n  requiredPasswordPreparedConstraints,\n  type AnyPasswordPreparedPersistenceMapping,\n  type PasswordPreparedState,\n} from \"./password-prepared-model\";\nimport {\n  ContextInput,\n  CompletionInput,\n  encodeReservation,\n  evidenceCurrent,\n  identifierScope,\n  reservationOf,\n  sameRevision,\n  snapshotMutation,\n  snapshotReserve,\n  unavailable,\n} from \"./password-prepared-state\";\nimport {\n  CurrentPasswordSql,\n  passwordSqlKernel as kernel,\n  type PasswordSqlConfiguration,\n  type PasswordSqlQuery,\n} from \"./password-sql\";\nimport { checkProofCompletionIn, completeProofPlanIn } from \"./proof-sql\";\nimport { validateDrizzleStorage } from \"./storage-validation\";\n\nconst translateFailure = <A, E, R>(\n  effect: Effect.Effect<A, E, R>,\n): Effect.Effect<A, PasswordUnavailable, R> =>\n  reportPersistenceFailure(\n    effect,\n    (error) =>\n      Schema.is(PasswordUnavailable)(error) ||\n      Schema.is(ProofUnavailable)(error) ||\n      Schema.is(HookConfigurationError)(error),\n  ).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));\n\nconst translateContextFailure = <A, E, R>(\n  effect: Effect.Effect<A, E, R>,\n): Effect.Effect<A, PasswordUnavailable | PasswordRejected, R> =>\n  reportPersistenceFailure(\n    effect,\n    (error) =>\n      Schema.is(PasswordUnavailable)(error) ||\n      Schema.is(PasswordRejected)(error) ||\n      Schema.is(ProofUnavailable)(error) ||\n      Schema.is(HookConfigurationError)(error),\n  ).pipe(\n    Effect.catchCause((cause) =>\n      Effect.failCause(\n        Cause.map(cause, (error) => (Schema.is(PasswordRejected)(error) ? error : unavailable())),\n      ),\n    ),\n  );\n\ntype Mapping = AnyPasswordPreparedPersistenceMapping;\nconst nowMillis = DateTime.now.pipe(Effect.map(DateTime.toEpochMillis));\n\nconst read = (query: PasswordSqlQuery, locking: boolean) =>\n  locking && typeof query.for === \"function\" ? query.for(\"update\") : query;\n\nconst columns = (mapping: Mapping) => {\n  const table = mapping.intent;\n\n  return {\n    moduleId: column(table.table, table.moduleId),\n    intentId: column(table.table, table.intentId),\n    commandId: column(table.table, table.commandId),\n    subjectId: column(table.table, table.subjectId),\n    action: column(table.table, table.action),\n    generation: column(table.table, table.generation),\n    version: column(table.table, table.version),\n    state: column(table.table, table.state),\n    digest: column(table.table, table.digest),\n    snapshot: column(table.table, table.snapshot),\n    identifierScope: column(table.table, table.identifierScope),\n    createdAt: column(table.table, table.createdAt),\n    admittedAt: column(table.table, table.admittedAt),\n    admissionRetainUntil: column(table.table, table.admissionRetainUntil),\n    preparationExpiresAt: column(table.table, table.preparationExpiresAt),\n    expiresAt: column(table.table, table.expiresAt),\n    retainUntil: column(table.table, table.retainUntil),\n  };\n};\n\nconst valid = (mapping: Mapping) =>\n  Object.entries(requiredPasswordPreparedConstraints).every(\n    ([key, value]) =>\n      mapping.constraints[key as keyof typeof requiredPasswordPreparedConstraints] === value,\n  );\n\nconst lockAnchor = Effect.fn(\"DrizzlePasswordPrepared.lockAnchor\")(function* (\n  mapping: Mapping,\n  configuration: PasswordSqlConfiguration,\n  moduleId: string,\n  create = true,\n) {\n  const database = yield* CurrentPasswordSql;\n\n  const a = mapping.admission,\n    key = column(a.table, a.moduleId);\n\n  if (create)\n    yield* configuration.insertIfAbsent(\n      database.insert(a.table).values(a.encodeInsert(moduleId)),\n      a.moduleId,\n      moduleId,\n    );\n\n  const rows = yield* read(\n    database.select().from(a.table).where(eq(key, moduleId)).limit(2),\n    configuration.locking,\n  );\n\n  if (rows.length > 1 || (create && rows.length !== 1)) return yield* unavailable();\n\n  return rows.length === 1;\n});\n\nconst bindingJson = Schema.encodeSync(Schema.fromJsonString(ProofBinding));\n\nconst captureAuthority = Effect.fn(\"DrizzlePasswordPrepared.captureAuthority\")(function* (\n  mapping: Mapping,\n  configuration: Pick<PasswordSqlConfiguration, \"locking\">,\n  input: {\n    readonly moduleId: string;\n    readonly action: PasswordPreparedReservation[\"action\"];\n    readonly subjectId: string;\n    readonly reset?: PasswordPreparedReservation[\"reset\"];\n  },\n) {\n  const database = yield* CurrentPasswordSql;\n\n  const p = mapping.password;\n  const locked = yield* kernel.lockSubject(p, input.subjectId, configuration.locking);\n\n  if (locked.row === undefined || !p.subject.isActiveStatus(locked.row[p.subject.status]))\n    return undefined;\n\n  const ic = kernel.identifierColumns(p),\n    ac = kernel.authorityCredentialColumns(p);\n\n  let identifier: any;\n\n  if (input.action !== \"add-password\") {\n    if (input.reset !== undefined)\n      identifier = (yield* kernel.lockIdentifier(\n        p,\n        input.reset.binding.identifier,\n        configuration.locking,\n      ))[0];\n    else {\n      const discovered = (yield* read(\n        database\n          .select()\n          .from(p.identifier.table)\n          .where(eq(ic.subjectId, locked.nativeSubjectId))\n          .orderBy(ic.namespace, ic.value),\n        false,\n      )).find((row: any) => p.identifier.isCurrent(row));\n\n      if (discovered !== undefined)\n        identifier = (yield* kernel.lockIdentifier(\n          p,\n          {\n            namespace: discovered[p.identifier.namespace],\n            value: discovered[p.identifier.value],\n          } as any,\n          configuration.locking,\n        ))[0];\n    }\n    if (\n      identifier === undefined ||\n      !p.identifier.isCurrent(identifier) ||\n      !p.subjectId.equals(identifier[p.identifier.subjectId], locked.nativeSubjectId)\n    )\n      return undefined;\n  }\n\n  const credential = (yield* kernel.readPasswordCredential(\n    p,\n    input.moduleId,\n    locked.nativeSubjectId,\n    configuration.locking,\n  ))[0];\n\n  if ((input.action === \"add-password\") !== (credential === undefined)) return undefined;\n\n  const snapshot =\n    credential === undefined\n      ? undefined\n      : yield* p.credential\n          .decode({ moduleId: input.moduleId, subject: locked.row, identifier, credential })\n          .pipe(Effect.flatMap(snapshotPasswordCredential));\n\n  if (\n    snapshot !== undefined &&\n    (snapshot.moduleId !== input.moduleId ||\n      snapshot.revision.subjectId !== input.subjectId ||\n      snapshot.revision.securityRevision !== locked.row[p.subject.securityRevision] ||\n      snapshot.credentialId !== credential[p.credential.credentialId] ||\n      snapshot.credentialRevision !== credential[p.credential.credentialRevision] ||\n      snapshot.verifierVersion !== credential[p.credential.verifierVersion] ||\n      Redacted.value(snapshot.verifier) !== credential[p.credential.verifier] ||\n      snapshot.normalization !== credential[p.credential.normalization] ||\n      snapshot.identifier.namespace !== identifier[p.identifier.namespace] ||\n      snapshot.identifier.value !== identifier[p.identifier.value] ||\n      snapshot.identifierBindingRevision !== identifier[p.identifier.bindingRevision])\n  )\n    return undefined;\n\n  const factors = yield* read(\n    database\n      .select()\n      .from(p.authorityCredential.table)\n      .where(eq(ac.subjectId, locked.nativeSubjectId))\n      .orderBy(ac.credentialId),\n    configuration.locking,\n  );\n\n  const active = factors.filter(\n    (row: any) =>\n      p.authorityCredential.status === undefined ||\n      p.authorityCredential.isActiveStatus?.(row[p.authorityCredential.status]) === true,\n  );\n\n  if (active.length > 64) return yield* unavailable();\n\n  const revision =\n    snapshot?.revision ??\n    AuthenticationRevision.make({\n      subjectId: input.subjectId as any,\n      securityRevision: locked.row[p.subject.securityRevision],\n      credentials: active.map((row: any) => ({\n        credentialId: row[p.authorityCredential.credentialId],\n        revision: row[p.authorityCredential.revision],\n      })),\n    });\n\n  if (\n    revision.credentials.some(\n      (expected) =>\n        !active.some(\n          (row: any) =>\n            row[p.authorityCredential.credentialId] === expected.credentialId &&\n            row[p.authorityCredential.revision] === expected.revision,\n        ),\n    )\n  )\n    return undefined;\n\n  const requirement = yield* p.subject\n    .decodeActionRequirement(locked.row, input.action)\n    .pipe(Effect.flatMap(snapshotPasswordRequirement));\n\n  return { ...locked, identifier, snapshot, revision, requirement };\n});\n\nconst currentAuthority = Effect.fn(\"DrizzlePasswordPrepared.currentAuthority\")(function* (\n  mapping: Mapping,\n  configuration: Pick<PasswordSqlConfiguration, \"locking\">,\n  record: PasswordPreparedReservation | PasswordPreparedReady,\n) {\n  const current = yield* captureAuthority(mapping, configuration, {\n    moduleId: record.moduleId,\n    action: record.action,\n    subjectId: record.revision.subjectId,\n    ...(record.reset === undefined ? {} : { reset: record.reset }),\n  });\n\n  if (\n    current === undefined ||\n    !sameRevision(current.revision, record.revision) ||\n    (current.snapshot === undefined\n      ? record.credential !== undefined\n      : record.credential === undefined ||\n        !kernel.sameCredentialSnapshot(current.snapshot, record.credential))\n  )\n    return undefined;\n\n  return current;\n});\n\nconst rowCondition = (mapping: Mapping, row: any) => {\n  const c = columns(mapping);\n\n  return and(\n    ...Object.entries(c).map(([key, value]) => {\n      const field = mapping.intent[key as keyof typeof c],\n        item = row[field];\n\n      return Predicate.isNullish(item) ? isNull(value) : eq(value, item);\n    }),\n  )!;\n};\n\nconst readIntent = Effect.fn(\"Drizzle.readIntent\")(function* (\n  mapping: Mapping,\n  condition: SQL,\n  locking: boolean,\n) {\n  const database = yield* CurrentPasswordSql;\n\n  return yield* read(\n    database.select().from(mapping.intent.table).where(condition).limit(2),\n    locking,\n  );\n});\n\nconst recordMatches = Effect.fn(\"DrizzlePasswordPrepared.recordMatches\")(function* (\n  mapping: Mapping,\n  row: any,\n  record: PasswordPreparedReservation | PasswordPreparedReady,\n  nativeSubjectId: unknown,\n  snapshot: string,\n) {\n  const t = mapping.intent,\n    p = mapping.password;\n\n  if (\n    row === undefined ||\n    row[t.moduleId] !== record.moduleId ||\n    row[t.intentId] !== record.intentId ||\n    row[t.commandId] !== record.commandId ||\n    !p.subjectId.equals(row[t.subjectId], nativeSubjectId) ||\n    row[t.action] !== record.action ||\n    row[t.generation] !== record.generation ||\n    row[t.version] !== record.version ||\n    row[t.state] !== t.states[record._tag] ||\n    row[t.snapshot] !== snapshot ||\n    row[t.identifierScope] !== identifierScope(record) ||\n    (record._tag === \"Ready\"\n      ? row[t.digest] !== record.digest\n      : !Predicate.isNullish(row[t.digest]))\n  )\n    return false;\n  for (const [key, instant] of [\n    [t.createdAt, record.createdAtMillis],\n    [t.preparationExpiresAt, record.preparationExpiresAtMillis],\n    [t.retainUntil, record.retainUntilMillis],\n  ] as const)\n    if ((yield* p.decodeInstant(row[key])) !== instant) return false;\n\n  return record._tag === \"Ready\"\n    ? (yield* p.decodeInstant(row[t.expiresAt])) === record.expiresAtMillis\n    : Predicate.isNullish(row[t.expiresAt]);\n});\n\nconst terminal = Effect.fn(\"DrizzlePasswordPrepared.terminal\")(function* (\n  mapping: Mapping,\n  row: any,\n  state: Exclude<PasswordPreparedState, \"Preparing\" | \"Ready\">,\n) {\n  const database = yield* CurrentPasswordSql;\n\n  yield* database\n    .update(mapping.intent.table)\n    .set(mapping.intent.encodeTerminal(state))\n    .where(rowCondition(mapping, row));\n\n  const c = columns(mapping),\n    t = mapping.intent;\n\n  const rows = yield* readIntent(\n    mapping,\n    and(eq(c.moduleId, row[t.moduleId]), eq(c.intentId, row[t.intentId]))!,\n    false,\n  );\n\n  const expected = { ...row, [t.state]: t.states[state], [t.snapshot]: null, [t.digest]: null };\n\n  if (\n    rows.length !== 1 ||\n    (yield* readIntent(mapping, rowCondition(mapping, expected), false)).length !== 1\n  )\n    return yield* unavailable();\n});\n\nexport const makeSqlPasswordPreparedPersistence = Effect.fn(\"makeSqlPasswordPreparedPersistence\")(\n  function* (\n    mapping: Mapping,\n    configuration: PasswordSqlConfiguration,\n  ): Effect.fn.Return<\n    PasswordPreparedPersistence,\n    PasswordUnavailable,\n    LifecycleHooks | CurrentPasswordSql | NativeDatabase\n  > {\n    const database = yield* CurrentPasswordSql;\n\n    if (!configuration.coordinated)\n      yield* validateDrizzleStorage({\n        ...mapping,\n        proof: configuration.proof?.mapping,\n      }).pipe(Effect.mapError(unavailable));\n    const hooks = yield* LifecycleHooks;\n\n    const p = mapping.password,\n      c = columns(mapping),\n      t = mapping.intent;\n\n    const owned = <A, E, R>(body: Effect.Effect<A, E, R>) =>\n      valid(mapping)\n        ? kernel.owned(\n            database,\n            p,\n            configuration,\n            Effect.gen(function* () {\n              const journal = yield* CurrentCommitJournal;\n              const guards = yield* Effect.serviceOption(PasswordPreparedJournalGuards);\n\n              if (Option.isSome(guards) && !guards.value.register(journal.prepare(undefined)))\n                return yield* unavailable();\n\n              return yield* body;\n            }),\n          )\n        : Effect.fail(unavailable());\n\n    const complete = <A>(\n      uncaptured: PasswordPreparedMutation & { readonly completion?: ProofCompletionPlan },\n      prepare: PreparePasswordCommit<PasswordMutationDecision, A>,\n    ) =>\n      Effect.gen(function* () {\n        const input = yield* snapshotMutation(uncaptured);\n\n        const completion =\n          uncaptured.completion === undefined\n            ? undefined\n            : {\n                prepare: uncaptured.completion.prepare,\n                input: yield* Schema.encodeEffect(Schema.fromJsonString(CompletionInput))(\n                  uncaptured.completion.input,\n                ).pipe(\n                  Effect.flatMap(Schema.decodeEffect(Schema.fromJsonString(CompletionInput))),\n                  Effect.mapError(unavailable),\n                ),\n              };\n\n        if (\n          (input.intent.action === \"reset-password\") !== (completion !== undefined) ||\n          (completion !== undefined && configuration.proof === undefined)\n        )\n          return yield* unavailable();\n\n        return yield* owned(\n          Effect.gen(function* () {\n            const transaction = yield* CurrentPasswordSql;\n            const journal = yield* CurrentCommitJournal;\n\n            yield* lockAnchor(mapping, configuration, input.intent.moduleId);\n\n            const authority = yield* kernel.validateMutationAuthority(\n              p,\n              configuration,\n              input.mutation,\n              input.intent.action,\n            );\n\n            if (authority === undefined) return prepare(\"rejected\", journal);\n            const current = yield* currentAuthority(mapping, configuration, input.intent);\n\n            if (current === undefined) return prepare(\"rejected\", journal);\n\n            const rows = yield* readIntent(\n              mapping,\n              and(eq(c.moduleId, input.intent.moduleId), eq(c.intentId, input.intent.intentId))!,\n              configuration.locking,\n            );\n\n            const row = rows[0],\n              encoded = yield* encodePasswordPreparedReady(input.intent);\n\n            if (\n              rows.length !== 1 ||\n              !(yield* recordMatches(\n                mapping,\n                row,\n                input.intent,\n                current.nativeSubjectId,\n                encoded,\n              )) ||\n              !evidenceCurrent(input, current.requirement, yield* nowMillis) ||\n              (yield* kernel.commandExists(\n                p,\n                input.intent.moduleId,\n                input.intent.commandId,\n                configuration.locking,\n              )).length !== 0\n            )\n              return prepare(\"rejected\", journal);\n            if (\n              completion !== undefined &&\n              (input.intent.reset === undefined ||\n                completion.input.continuationId !== input.intent.reset.continuationId ||\n                bindingJson(completion.input.binding) !== bindingJson(input.intent.reset.binding) ||\n                !kernel.proofCompletionMatchesPassword({ ...input.mutation, completion }))\n            )\n              return prepare(\"rejected\", journal);\n\n            const credentialRevision = yield* kernel.allocate(\n              configuration.mode,\n              p.allocateRevision,\n              p.allocateRevisionSync,\n            );\n\n            const verifierVersion = yield* kernel.allocate(\n              configuration.mode,\n              p.allocateRevision,\n              p.allocateRevisionSync,\n            );\n\n            const nextSecurityRevision = yield* kernel.allocateNextSecurityRevision(\n              p,\n              configuration.mode,\n              input.intent.revision.securityRevision,\n            );\n\n            if (\n              nextSecurityRevision === input.intent.revision.securityRevision ||\n              credentialRevision === input.intent.credential?.credentialRevision ||\n              verifierVersion === input.intent.credential?.verifierVersion\n            )\n              return yield* unavailable();\n\n            const credentialId =\n              input.intent.action === \"add-password\"\n                ? yield* kernel.allocate(\n                    configuration.mode,\n                    p.allocateCredentialId,\n                    p.allocateCredentialIdSync,\n                  )\n                : undefined;\n\n            let appliedAt: number | undefined;\n\n            const assertApplied = Effect.fn(\"DrizzlePasswordPrepared.assertApplied\")(() =>\n              Effect.flatMap(CurrentPasswordPreparedTransaction, (currentTransaction) =>\n                Effect.gen(function* () {\n                  if (appliedAt === undefined) return;\n\n                  if (\n                    !(yield* kernel.checkMutationApplied(\n                      p,\n                      input.mutation,\n                      current.nativeSubjectId,\n                      {\n                        credentialId: credentialId ?? input.intent.credential!.credentialId,\n                        credentialRevision,\n                        verifierVersion,\n                        nextSecurityRevision,\n                      },\n                      appliedAt,\n                    )) ||\n                    (yield* readIntent(\n                      mapping,\n                      rowCondition(mapping, {\n                        ...row,\n                        [t.state]: t.states.Consumed,\n                        [t.snapshot]: null,\n                        [t.digest]: null,\n                      }),\n                      false,\n                    )).length !== 1 ||\n                    !evidenceCurrent(input, current.requirement, yield* nowMillis)\n                  )\n                    return yield* unavailable();\n                }).pipe(Effect.provideService(CurrentPasswordSql, currentTransaction)),\n              ),\n            );\n\n            const validateApplied = Effect.gen(function* () {\n              yield* assertApplied().pipe(\n                Effect.provideService(CurrentPasswordPreparedTransaction, transaction),\n              );\n              if (appliedAt === undefined) return;\n              const postconditions = yield* Effect.serviceOption(PasswordPreparedPostconditions);\n\n              if (\n                Option.isSome(postconditions) &&\n                !postconditions.value.register(assertApplied().pipe(translateFailure))\n              )\n                return yield* unavailable();\n            });\n\n            const apply = Effect.fn(\"DrizzlePasswordPrepared.apply\")(function* () {\n              const finalNow = yield* nowMillis;\n\n              if (!evidenceCurrent(input, current.requirement, finalNow)) return false;\n\n              const changed =\n                input.intent.action === \"add-password\"\n                  ? yield* kernel.addPasswordIn(\n                      p,\n                      configuration,\n                      input.mutation,\n                      {\n                        credentialId: credentialId!,\n                        credentialRevision,\n                        verifierVersion,\n                        nextSecurityRevision,\n                      },\n                      finalNow,\n                    )\n                  : yield* kernel.writeReplacement(\n                      p,\n                      input.mutation,\n                      current.nativeSubjectId,\n                      { credentialRevision, verifierVersion, nextSecurityRevision },\n                      finalNow,\n                    );\n\n              if (!changed) return yield* unavailable();\n              appliedAt = finalNow;\n              yield* terminal(mapping, row, \"Consumed\");\n              if (!evidenceCurrent(input, current.requirement, yield* nowMillis))\n                return yield* unavailable();\n\n              return true;\n            });\n\n            if (completion !== undefined) {\n              let receipt: ReturnType<typeof prepare> | undefined;\n\n              yield* completeProofPlanIn(\n                configuration.proof!.mapping,\n                configuration.proof!.configuration,\n                completion,\n                Effect.gen(function* () {\n                  return yield* apply();\n                }),\n                (decision) => {\n                  receipt = prepare(decision === \"completed\" ? \"changed\" : \"rejected\", journal);\n\n                  return decision;\n                },\n              );\n\n              yield* validateApplied;\n\n              return receipt ?? prepare(\"rejected\", journal);\n            }\n\n            const changed = yield* apply();\n\n            yield* validateApplied;\n\n            return prepare(changed ? \"changed\" : \"rejected\", journal);\n          }),\n        );\n      });\n\n    const services: PasswordPreparedPersistence = {\n      reserve: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const input = yield* snapshotReserve(uncaptured);\n\n          if (\n            (input.action === \"reset-password\") !==\n              (input.reset !== undefined && input.completion !== undefined) ||\n            (input.action === \"reset-password\" && configuration.proof === undefined) ||\n            input.generation !== input.policy.generation ||\n            input.policy.retentionMillis <\n              Math.max(\n                input.policy.preparationLifetimeMillis + input.policy.lifetimeMillis,\n                input.policy.admission.action.windowMillis,\n                input.policy.admission.identifier.windowMillis,\n                input.policy.admission.subject.windowMillis,\n              ) ||\n            (input.invalidation.existingSessions === \"immediate\" &&\n              p.sessionInvalidation !== \"same-authority-immediate\")\n          )\n            return yield* unavailable();\n\n          return yield* owned(\n            Effect.gen(function* () {\n              const transaction = yield* CurrentPasswordSql;\n              const journal = yield* CurrentCommitJournal;\n\n              yield* lockAnchor(mapping, configuration, input.moduleId);\n\n              const version = PasswordPreparedVersion.make(\n                yield* kernel.allocate(\n                  configuration.mode,\n                  mapping.allocateVersion,\n                  mapping.allocateVersionSync,\n                ),\n              );\n\n              const authority = yield* captureAuthority(mapping, configuration, input);\n\n              if (authority === undefined) return yield* unavailable();\n              if (input.reset !== undefined) {\n                if (\n                  input.completion === undefined ||\n                  input.completion.moduleId !== `${input.moduleId}/reset` ||\n                  input.completion.purpose !== \"password-reset\" ||\n                  input.reset.continuationId !== input.completion.continuationId ||\n                  bindingJson(input.reset.binding) !== bindingJson(input.completion.binding) ||\n                  input.reset.binding._tag !== \"Subject\" ||\n                  !sameRevision(input.reset.binding.revision, authority.revision) ||\n                  authority.snapshot?.identifierVerifiedAtMillis === undefined ||\n                  !(yield* checkProofCompletionIn(\n                    configuration.proof!.mapping,\n                    configuration.proof!.configuration,\n                    input.completion,\n                  ))\n                )\n                  return yield* unavailable();\n              }\n              if (\n                (yield* readIntent(\n                  mapping,\n                  and(eq(c.moduleId, input.moduleId), eq(c.commandId, input.commandId))!,\n                  configuration.locking,\n                )).length\n              )\n                return prepare({ _tag: \"Existing\" }, journal);\n\n              const now = yield* nowMillis,\n                nativeNow = p.encodeInstant(now);\n\n              const scope = identifierScope({\n                ...(authority.snapshot === undefined ? {} : { credential: authority.snapshot }),\n                revision: authority.revision,\n              });\n\n              const active =\n                (yield* read(\n                  transaction\n                    .select({ total: count() })\n                    .from(t.table)\n                    .where(\n                      and(\n                        eq(c.moduleId, input.moduleId),\n                        eq(c.subjectId, authority.nativeSubjectId),\n                        or(\n                          and(\n                            eq(c.state, t.states.Preparing),\n                            gt(c.preparationExpiresAt, nativeNow),\n                          ),\n                          and(eq(c.state, t.states.Ready), gt(c.expiresAt, nativeNow)),\n                        ),\n                      ),\n                    ),\n                  false,\n                ))[0]?.total ?? 0;\n\n              if (active >= input.policy.maximumPendingPerSubject) return yield* unavailable();\n              for (const [condition, budget] of [\n                [eq(c.action, input.action), input.policy.admission.action],\n                [eq(c.identifierScope, scope), input.policy.admission.identifier],\n                [eq(c.subjectId, authority.nativeSubjectId), input.policy.admission.subject],\n              ] as const) {\n                const total =\n                  (yield* read(\n                    transaction\n                      .select({ total: count() })\n                      .from(t.table)\n                      .where(\n                        and(\n                          eq(c.moduleId, input.moduleId),\n                          condition,\n                          gt(c.admittedAt, p.encodeInstant(now - budget.windowMillis)),\n                        ),\n                      ),\n                    false,\n                  ))[0]?.total ?? 0;\n\n                if (total >= budget.limit) return yield* unavailable();\n              }\n\n              const reservation = yield* snapshotPasswordPreparedReservation({\n                _tag: \"Preparing\",\n                moduleId: input.moduleId,\n                generation: input.generation,\n                intentId: input.intentId,\n                version,\n                commandId: input.commandId,\n                action: input.action,\n                revision: authority.revision,\n                ...(authority.snapshot === undefined ? {} : { credential: authority.snapshot }),\n                capturedRequirement: authority.requirement,\n                ...(input.reset === undefined ? {} : { reset: input.reset }),\n                invalidation: input.invalidation,\n                createdAtMillis: now,\n                preparationExpiresAtMillis: now + input.policy.preparationLifetimeMillis,\n                retainUntilMillis: now + input.policy.retentionMillis,\n              });\n\n              const snapshot = yield* encodeReservation(reservation);\n\n              yield* transaction.insert(t.table).values(\n                t.encodeInsert({\n                  reservation,\n                  nativeSubjectId: authority.nativeSubjectId,\n                  identifierScope: scope,\n                  snapshot,\n                  admittedAtMillis: now,\n                  admissionRetainUntilMillis:\n                    now +\n                    Math.max(\n                      input.policy.admission.action.windowMillis,\n                      input.policy.admission.identifier.windowMillis,\n                      input.policy.admission.subject.windowMillis,\n                    ),\n                }),\n              );\n\n              const rows = yield* readIntent(\n                mapping,\n                and(eq(c.moduleId, input.moduleId), eq(c.intentId, input.intentId))!,\n                false,\n              );\n\n              if (\n                rows.length !== 1 ||\n                !(yield* recordMatches(\n                  mapping,\n                  rows[0],\n                  reservation,\n                  authority.nativeSubjectId,\n                  snapshot,\n                ))\n              )\n                return yield* unavailable();\n\n              const admittedUntil =\n                now +\n                Math.max(\n                  input.policy.admission.action.windowMillis,\n                  input.policy.admission.identifier.windowMillis,\n                  input.policy.admission.subject.windowMillis,\n                );\n\n              if (\n                (yield* p.decodeInstant(rows[0][t.admittedAt])) !== now ||\n                (yield* p.decodeInstant(rows[0][t.admissionRetainUntil])) !== admittedUntil ||\n                (yield* nowMillis) >= reservation.preparationExpiresAtMillis ||\n                (input.completion !== undefined &&\n                  !(yield* checkProofCompletionIn(\n                    configuration.proof!.mapping,\n                    configuration.proof!.configuration,\n                    input.completion,\n                  )))\n              )\n                return yield* unavailable();\n\n              return prepare({ _tag: \"Reserved\", reservation }, journal);\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      publishReady: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const reservation = yield* snapshotPasswordPreparedReservation(uncaptured.reservation),\n            ready = yield* snapshotPasswordPreparedReady(uncaptured.ready);\n\n          const snapshot = yield* encodeReservation(reservation),\n            readySnapshot = yield* encodePasswordPreparedReady(ready);\n\n          if ((yield* encodeReservation(reservationOf(ready))) !== snapshot)\n            return yield* unavailable();\n\n          return yield* owned(\n            Effect.gen(function* () {\n              const transaction = yield* CurrentPasswordSql;\n              const journal = yield* CurrentCommitJournal;\n\n              yield* lockAnchor(mapping, configuration, reservation.moduleId);\n              const authority = yield* currentAuthority(mapping, configuration, reservation);\n\n              if (authority === undefined) return prepare(\"rejected\", journal);\n\n              const rows = yield* readIntent(\n                  mapping,\n                  and(eq(c.moduleId, reservation.moduleId), eq(c.intentId, reservation.intentId))!,\n                  configuration.locking,\n                ),\n                row = rows[0];\n\n              const now = yield* nowMillis;\n\n              if (\n                rows.length !== 1 ||\n                !(yield* recordMatches(\n                  mapping,\n                  row,\n                  reservation,\n                  authority.nativeSubjectId,\n                  snapshot,\n                )) ||\n                now < ready.issuedAtMillis ||\n                now >= reservation.preparationExpiresAtMillis ||\n                now >= ready.expiresAtMillis\n              )\n                return prepare(\"rejected\", journal);\n              yield* transaction\n                .update(t.table)\n                .set(t.encodeReady({ ready, snapshot: readySnapshot }))\n                .where(rowCondition(mapping, row));\n\n              const saved = yield* readIntent(\n                mapping,\n                and(eq(c.moduleId, ready.moduleId), eq(c.intentId, ready.intentId))!,\n                false,\n              );\n\n              if (\n                saved.length !== 1 ||\n                !(yield* recordMatches(\n                  mapping,\n                  saved[0],\n                  ready,\n                  authority.nativeSubjectId,\n                  readySnapshot,\n                )) ||\n                (yield* readIntent(\n                  mapping,\n                  and(\n                    eq(c.moduleId, ready.moduleId),\n                    eq(c.intentId, ready.intentId),\n                    eq(c.admittedAt, row[t.admittedAt]),\n                    eq(c.admissionRetainUntil, row[t.admissionRetainUntil]),\n                  )!,\n                  false,\n                )).length !== 1\n              )\n                return yield* unavailable();\n              if (\n                (yield* nowMillis) >= reservation.preparationExpiresAtMillis ||\n                (yield* nowMillis) >= ready.expiresAtMillis\n              )\n                return yield* unavailable();\n\n              return prepare(\"published\", journal);\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      context: (uncaptured) =>\n        Effect.gen(function* () {\n          const input = yield* Schema.decodeEffect(ContextInput)({ ...uncaptured }).pipe(\n            Effect.mapError(unavailable),\n          );\n\n          const record = yield* kernel.safeRead(\n            database,\n            configuration,\n            Effect.gen(function* () {\n              if (\n                !valid(mapping) ||\n                !(yield* lockAnchor(mapping, configuration, input.moduleId, false))\n              )\n                return undefined;\n\n              const rows = yield* readIntent(\n                mapping,\n                and(\n                  eq(c.moduleId, input.moduleId),\n                  eq(c.generation, input.generation),\n                  eq(c.digest, input.digest),\n                  eq(c.state, t.states.Ready),\n                )!,\n                false,\n              );\n\n              if (rows.length !== 1) return undefined;\n              const selected = yield* decodePasswordPreparedReady(rows[0][t.snapshot]);\n              const authority = yield* currentAuthority(mapping, configuration, selected);\n\n              if (authority === undefined) return undefined;\n\n              const locked = yield* readIntent(\n                mapping,\n                rowCondition(mapping, rows[0]),\n                configuration.locking,\n              );\n\n              const now = yield* nowMillis;\n\n              if (\n                locked.length !== 1 ||\n                now < selected.issuedAtMillis ||\n                now >= selected.expiresAtMillis ||\n                selected.moduleId !== input.moduleId ||\n                selected.generation !== input.generation ||\n                selected.digest !== input.digest ||\n                !(yield* recordMatches(\n                  mapping,\n                  locked[0],\n                  selected,\n                  authority.nativeSubjectId,\n                  yield* encodePasswordPreparedReady(selected),\n                ))\n              )\n                return undefined;\n\n              return { record: selected, currentRequirement: authority.requirement };\n            }),\n          );\n\n          return record ?? (yield* PasswordRejected.make({}));\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateContextFailure,\n        ),\n      complete: (input, prepare) =>\n        complete(input, prepare).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      resetWithProof: (input, prepare) =>\n        complete(input, prepare).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      cancel: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const record = yield* snapshotPasswordPreparedReady(uncaptured.record),\n            snapshot = yield* encodePasswordPreparedReady(record);\n\n          return yield* owned(\n            Effect.gen(function* () {\n              const journal = yield* CurrentCommitJournal;\n\n              yield* lockAnchor(mapping, configuration, record.moduleId);\n              const authority = yield* currentAuthority(mapping, configuration, record);\n\n              if (authority === undefined) return prepare(false, journal);\n\n              const rows = yield* readIntent(\n                mapping,\n                and(eq(c.moduleId, record.moduleId), eq(c.intentId, record.intentId))!,\n                configuration.locking,\n              );\n\n              const now = yield* nowMillis;\n\n              if (\n                rows.length !== 1 ||\n                now < record.issuedAtMillis ||\n                now >= record.expiresAtMillis ||\n                !(yield* recordMatches(\n                  mapping,\n                  rows[0],\n                  record,\n                  authority.nativeSubjectId,\n                  snapshot,\n                ))\n              )\n                return prepare(false, journal);\n              yield* terminal(mapping, rows[0], \"Cancelled\");\n\n              return prepare(true, journal);\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      cleanup: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const input = { ...uncaptured };\n\n          if (!Number.isSafeInteger(input.limit) || input.limit < 1 || input.limit > 1000)\n            return yield* unavailable();\n\n          return yield* owned(\n            Effect.gen(function* () {\n              const transaction = yield* CurrentPasswordSql;\n              const journal = yield* CurrentCommitJournal;\n\n              if (!(yield* lockAnchor(mapping, configuration, input.moduleId, false)))\n                return prepare({ removed: 0, hasMore: false }, journal);\n              const now = p.encodeInstant(yield* nowMillis);\n\n              const due = and(\n                eq(c.moduleId, input.moduleId),\n                or(\n                  and(lte(c.retainUntil, now), lte(c.admissionRetainUntil, now)),\n                  and(\n                    isNotNull(c.snapshot),\n                    or(\n                      and(eq(c.state, t.states.Preparing), lte(c.preparationExpiresAt, now)),\n                      and(eq(c.state, t.states.Ready), lte(c.expiresAt, now)),\n                    ),\n                  ),\n                ),\n              )!;\n\n              const rows = yield* read(\n                transaction\n                  .select()\n                  .from(t.table)\n                  .where(due)\n                  .orderBy(c.createdAt, c.intentId)\n                  .limit(input.limit + 1),\n                configuration.locking,\n              );\n\n              let removed = 0;\n\n              for (const row of rows.slice(0, input.limit)) {\n                const expired =\n                  (yield* readIntent(\n                    mapping,\n                    and(\n                      rowCondition(mapping, row),\n                      lte(c.retainUntil, now),\n                      lte(c.admissionRetainUntil, now),\n                    )!,\n                    false,\n                  )).length === 1;\n\n                if (expired) {\n                  yield* transaction.delete(t.table).where(rowCondition(mapping, row));\n                  if (\n                    (yield* readIntent(\n                      mapping,\n                      and(eq(c.moduleId, input.moduleId), eq(c.intentId, row[t.intentId]))!,\n                      false,\n                    )).length\n                  )\n                    return yield* unavailable();\n                  removed++;\n                } else yield* terminal(mapping, row, \"Expired\");\n              }\n\n              return prepare(\n                {\n                  removed,\n                  hasMore:\n                    (yield* read(transaction.select().from(t.table).where(due).limit(1), false))\n                      .length > 0,\n                },\n                journal,\n              );\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n    };\n\n    return services;\n  },\n);\n\nexport const passwordPreparedSqlKernel = {\n  columns,\n  recordMatches,\n  captureAuthority,\n  currentAuthority,\n  rowCondition,\n  valid,\n  identifierScope,\n};\n"],"mappings":";;;;;;;;;;;;;;;AA0DA,MAAM,oBACJ,WAEA,yBACE,SACC,UACC,OAAO,GAAG,mBAAmB,CAAC,CAAC,KAAK,KACpC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,sBAAsB,CAAC,CAAC,KAAK,CAC3C,CAAC,CAAC,KAAK,OAAO,YAAY,UAAU,OAAO,UAAU,MAAM,IAAI,aAAa,YAAY,CAAC,CAAC,CAAC,CAAC;AAE9F,MAAM,2BACJ,WAEA,yBACE,SACC,UACC,OAAO,GAAG,mBAAmB,CAAC,CAAC,KAAK,KACpC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,sBAAsB,CAAC,CAAC,KAAK,CAC3C,CAAC,CAAC,KACA,OAAO,YAAY,UACjB,OAAO,UACL,MAAM,IAAI,QAAQ,UAAW,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,IAAI,QAAQ,YAAY,CAAE,CAC1F,CACF,CACF;AAGF,MAAM,YAAY,SAAS,IAAI,KAAK,OAAO,IAAI,SAAS,aAAa,CAAC;AAEtE,MAAM,QAAQ,OAAyB,YACrC,WAAW,OAAO,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,IAAI;AAErE,MAAM,WAAW,YAAqB;CACpC,MAAM,QAAQ,QAAQ;CAEtB,OAAO;EACL,UAAU,OAAO,MAAM,OAAO,MAAM,QAAQ;EAC5C,UAAU,OAAO,MAAM,OAAO,MAAM,QAAQ;EAC5C,WAAW,OAAO,MAAM,OAAO,MAAM,SAAS;EAC9C,WAAW,OAAO,MAAM,OAAO,MAAM,SAAS;EAC9C,QAAQ,OAAO,MAAM,OAAO,MAAM,MAAM;EACxC,YAAY,OAAO,MAAM,OAAO,MAAM,UAAU;EAChD,SAAS,OAAO,MAAM,OAAO,MAAM,OAAO;EAC1C,OAAO,OAAO,MAAM,OAAO,MAAM,KAAK;EACtC,QAAQ,OAAO,MAAM,OAAO,MAAM,MAAM;EACxC,UAAU,OAAO,MAAM,OAAO,MAAM,QAAQ;EAC5C,iBAAiB,OAAO,MAAM,OAAO,MAAM,eAAe;EAC1D,WAAW,OAAO,MAAM,OAAO,MAAM,SAAS;EAC9C,YAAY,OAAO,MAAM,OAAO,MAAM,UAAU;EAChD,sBAAsB,OAAO,MAAM,OAAO,MAAM,oBAAoB;EACpE,sBAAsB,OAAO,MAAM,OAAO,MAAM,oBAAoB;EACpE,WAAW,OAAO,MAAM,OAAO,MAAM,SAAS;EAC9C,aAAa,OAAO,MAAM,OAAO,MAAM,WAAW;CACpD;AACF;AAEA,MAAM,SAAS,YACb,OAAO,QAAQ,mCAAmC,CAAC,CAAC,OACjD,CAAC,KAAK,WACL,QAAQ,YAAY,SAA6D,KACrF;AAEF,MAAM,aAAa,OAAO,GAAG,oCAAoC,CAAC,CAAC,WACjE,SACA,eACA,UACA,SAAS,MACT;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,IAAI,QAAQ,WAChB,MAAM,OAAO,EAAE,OAAO,EAAE,QAAQ;CAElC,IAAI,QACF,OAAO,cAAc,eACnB,SAAS,OAAO,EAAE,KAAK,CAAC,CAAC,OAAO,EAAE,aAAa,QAAQ,CAAC,GACxD,EAAE,UACF,QACF;CAEF,MAAM,OAAO,OAAO,KAClB,SAAS,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,MAAM,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAChE,cAAc,OAChB;CAEA,IAAI,KAAK,SAAS,KAAM,UAAU,KAAK,WAAW,GAAI,OAAO,OAAO,YAAY;CAEhF,OAAO,KAAK,WAAW;AACzB,CAAC;AAED,MAAM,cAAc,OAAO,WAAW,OAAO,eAAe,YAAY,CAAC;AAEzE,MAAM,mBAAmB,OAAO,GAAG,0CAA0C,CAAC,CAAC,WAC7E,SACA,eACA,OAMA;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,IAAI,QAAQ;CAClB,MAAM,SAAS,OAAOA,kBAAO,YAAY,GAAG,MAAM,WAAW,cAAc,OAAO;CAElF,IAAI,OAAO,QAAQ,KAAA,KAAa,CAAC,EAAE,QAAQ,eAAe,OAAO,IAAI,EAAE,QAAQ,OAAO,GACpF,OAAO,KAAA;CAET,MAAM,KAAKA,kBAAO,kBAAkB,CAAC,GACnC,KAAKA,kBAAO,2BAA2B,CAAC;CAE1C,IAAI;CAEJ,IAAI,MAAM,WAAW,gBAAgB;EACnC,IAAI,MAAM,UAAU,KAAA,GAClB,cAAc,OAAOA,kBAAO,eAC1B,GACA,MAAM,MAAM,QAAQ,YACpB,cAAc,OAChB,EAAA,CAAG;OACA;GACH,MAAM,cAAc,OAAO,KACzB,SACG,OAAO,CAAC,CACR,KAAK,EAAE,WAAW,KAAK,CAAC,CACxB,MAAM,GAAG,GAAG,WAAW,OAAO,eAAe,CAAC,CAAC,CAC/C,QAAQ,GAAG,WAAW,GAAG,KAAK,GACjC,KACF,EAAA,CAAG,MAAM,QAAa,EAAE,WAAW,UAAU,GAAG,CAAC;GAEjD,IAAI,eAAe,KAAA,GACjB,cAAc,OAAOA,kBAAO,eAC1B,GACA;IACE,WAAW,WAAW,EAAE,WAAW;IACnC,OAAO,WAAW,EAAE,WAAW;GACjC,GACA,cAAc,OAChB,EAAA,CAAG;EACP;EACA,IACE,eAAe,KAAA,KACf,CAAC,EAAE,WAAW,UAAU,UAAU,KAClC,CAAC,EAAE,UAAU,OAAO,WAAW,EAAE,WAAW,YAAY,OAAO,eAAe,GAE9E,OAAO,KAAA;CACX;CAEA,MAAM,cAAc,OAAOA,kBAAO,uBAChC,GACA,MAAM,UACN,OAAO,iBACP,cAAc,OAChB,EAAA,CAAG;CAEH,IAAK,MAAM,WAAW,oBAAqB,eAAe,KAAA,IAAY,OAAO,KAAA;CAE7E,MAAM,WACJ,eAAe,KAAA,IACX,KAAA,IACA,OAAO,EAAE,WACN,OAAO;EAAE,UAAU,MAAM;EAAU,SAAS,OAAO;EAAK;EAAY;CAAW,CAAC,CAAC,CACjF,KAAK,OAAO,QAAQ,0BAA0B,CAAC;CAExD,IACE,aAAa,KAAA,MACZ,SAAS,aAAa,MAAM,YAC3B,SAAS,SAAS,cAAc,MAAM,aACtC,SAAS,SAAS,qBAAqB,OAAO,IAAI,EAAE,QAAQ,qBAC5D,SAAS,iBAAiB,WAAW,EAAE,WAAW,iBAClD,SAAS,uBAAuB,WAAW,EAAE,WAAW,uBACxD,SAAS,oBAAoB,WAAW,EAAE,WAAW,oBACrD,SAAS,MAAM,SAAS,QAAQ,MAAM,WAAW,EAAE,WAAW,aAC9D,SAAS,kBAAkB,WAAW,EAAE,WAAW,kBACnD,SAAS,WAAW,cAAc,WAAW,EAAE,WAAW,cAC1D,SAAS,WAAW,UAAU,WAAW,EAAE,WAAW,UACtD,SAAS,8BAA8B,WAAW,EAAE,WAAW,mBAEjE,OAAO,KAAA;CAWT,MAAM,UAAS,OATQ,KACrB,SACG,OAAO,CAAC,CACR,KAAK,EAAE,oBAAoB,KAAK,CAAC,CACjC,MAAM,GAAG,GAAG,WAAW,OAAO,eAAe,CAAC,CAAC,CAC/C,QAAQ,GAAG,YAAY,GAC1B,cAAc,OAChB,EAAA,CAEuB,QACpB,QACC,EAAE,oBAAoB,WAAW,KAAA,KACjC,EAAE,oBAAoB,iBAAiB,IAAI,EAAE,oBAAoB,OAAO,MAAM,IAClF;CAEA,IAAI,OAAO,SAAS,IAAI,OAAO,OAAO,YAAY;CAElD,MAAM,WACJ,UAAU,YACV,uBAAuB,KAAK;EAC1B,WAAW,MAAM;EACjB,kBAAkB,OAAO,IAAI,EAAE,QAAQ;EACvC,aAAa,OAAO,KAAK,SAAc;GACrC,cAAc,IAAI,EAAE,oBAAoB;GACxC,UAAU,IAAI,EAAE,oBAAoB;EACtC,EAAE;CACJ,CAAC;CAEH,IACE,SAAS,YAAY,MAClB,aACC,CAAC,OAAO,MACL,QACC,IAAI,EAAE,oBAAoB,kBAAkB,SAAS,gBACrD,IAAI,EAAE,oBAAoB,cAAc,SAAS,QACrD,CACJ,GAEA,OAAO,KAAA;CAET,MAAM,cAAc,OAAO,EAAE,QAC1B,wBAAwB,OAAO,KAAK,MAAM,MAAM,CAAC,CACjD,KAAK,OAAO,QAAQ,2BAA2B,CAAC;CAEnD,OAAO;EAAE,GAAG;EAAQ;EAAY;EAAU;EAAU;CAAY;AAClE,CAAC;AAED,MAAM,mBAAmB,OAAO,GAAG,0CAA0C,CAAC,CAAC,WAC7E,SACA,eACA,QACA;CACA,MAAM,UAAU,OAAO,iBAAiB,SAAS,eAAe;EAC9D,UAAU,OAAO;EACjB,QAAQ,OAAO;EACf,WAAW,OAAO,SAAS;EAC3B,GAAI,OAAO,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,OAAO,MAAM;CAC9D,CAAC;CAED,IACE,YAAY,KAAA,KACZ,CAAC,aAAa,QAAQ,UAAU,OAAO,QAAQ,MAC9C,QAAQ,aAAa,KAAA,IAClB,OAAO,eAAe,KAAA,IACtB,OAAO,eAAe,KAAA,KACtB,CAACA,kBAAO,uBAAuB,QAAQ,UAAU,OAAO,UAAU,IAEtE,OAAO,KAAA;CAET,OAAO;AACT,CAAC;AAED,MAAM,gBAAgB,SAAkB,QAAa;CACnD,MAAM,IAAI,QAAQ,OAAO;CAEzB,OAAO,IACL,GAAG,OAAO,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW;EACzC,MACE,OAAO,IADK,QAAQ,OAAO;EAG7B,OAAO,UAAU,UAAU,IAAI,IAAI,OAAO,KAAK,IAAI,GAAG,OAAO,IAAI;CACnE,CAAC,CACH;AACF;AAEA,MAAM,aAAa,OAAO,GAAG,oBAAoB,CAAC,CAAC,WACjD,SACA,WACA,SACA;CACA,MAAM,WAAW,OAAO;CAExB,OAAO,OAAO,KACZ,SAAS,OAAO,CAAC,CAAC,KAAK,QAAQ,OAAO,KAAK,CAAC,CAAC,MAAM,SAAS,CAAC,CAAC,MAAM,CAAC,GACrE,OACF;AACF,CAAC;AAED,MAAM,gBAAgB,OAAO,GAAG,uCAAuC,CAAC,CAAC,WACvE,SACA,KACA,QACA,iBACA,UACA;CACA,MAAM,IAAI,QAAQ,QAChB,IAAI,QAAQ;CAEd,IACE,QAAQ,KAAA,KACR,IAAI,EAAE,cAAc,OAAO,YAC3B,IAAI,EAAE,cAAc,OAAO,YAC3B,IAAI,EAAE,eAAe,OAAO,aAC5B,CAAC,EAAE,UAAU,OAAO,IAAI,EAAE,YAAY,eAAe,KACrD,IAAI,EAAE,YAAY,OAAO,UACzB,IAAI,EAAE,gBAAgB,OAAO,cAC7B,IAAI,EAAE,aAAa,OAAO,WAC1B,IAAI,EAAE,WAAW,EAAE,OAAO,OAAO,SACjC,IAAI,EAAE,cAAc,YACpB,IAAI,EAAE,qBAAqB,gBAAgB,MAAM,MAChD,OAAO,SAAS,UACb,IAAI,EAAE,YAAY,OAAO,SACzB,CAAC,UAAU,UAAU,IAAI,EAAE,OAAO,IAEtC,OAAO;CACT,KAAK,MAAM,CAAC,KAAK,YAAY;EAC3B,CAAC,EAAE,WAAW,OAAO,eAAe;EACpC,CAAC,EAAE,sBAAsB,OAAO,0BAA0B;EAC1D,CAAC,EAAE,aAAa,OAAO,iBAAiB;CAC1C,GACE,KAAK,OAAO,EAAE,cAAc,IAAI,IAAI,OAAO,SAAS,OAAO;CAE7D,OAAO,OAAO,SAAS,WAClB,OAAO,EAAE,cAAc,IAAI,EAAE,UAAU,OAAO,OAAO,kBACtD,UAAU,UAAU,IAAI,EAAE,UAAU;AAC1C,CAAC;AAED,MAAM,WAAW,OAAO,GAAG,kCAAkC,CAAC,CAAC,WAC7D,SACA,KACA,OACA;CAGA,QAAO,OAFiB,mBAAA,CAGrB,OAAO,QAAQ,OAAO,KAAK,CAAC,CAC5B,IAAI,QAAQ,OAAO,eAAe,KAAK,CAAC,CAAC,CACzC,MAAM,aAAa,SAAS,GAAG,CAAC;CAEnC,MAAM,IAAI,QAAQ,OAAO,GACvB,IAAI,QAAQ;CAEd,MAAM,OAAO,OAAO,WAClB,SACA,IAAI,GAAG,EAAE,UAAU,IAAI,EAAE,SAAS,GAAG,GAAG,EAAE,UAAU,IAAI,EAAE,SAAS,CAAC,GACpE,KACF;CAEA,MAAM,WAAW;EAAE,GAAG;GAAM,EAAE,QAAQ,EAAE,OAAO;GAAS,EAAE,WAAW;GAAO,EAAE,SAAS;CAAK;CAE5F,IACE,KAAK,WAAW,MACf,OAAO,WAAW,SAAS,aAAa,SAAS,QAAQ,GAAG,KAAK,EAAA,CAAG,WAAW,GAEhF,OAAO,OAAO,YAAY;AAC9B,CAAC;AAED,MAAa,qCAAqC,OAAO,GAAG,oCAAoC,CAAC,CAC/F,WACE,SACA,eAKA;CACA,MAAM,WAAW,OAAO;CAExB,IAAI,CAAC,cAAc,aACjB,OAAO,uBAAuB;EAC5B,GAAG;EACH,OAAO,cAAc,OAAO;CAC9B,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;CACtC,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,UAChB,IAAI,QAAQ,OAAO,GACnB,IAAI,QAAQ;CAEd,MAAM,SAAkB,SACtB,MAAM,OAAO,IACTA,kBAAO,MACL,UACA,GACA,eACA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO;EACvB,MAAM,SAAS,OAAO,OAAO,cAAc,6BAA6B;EAExE,IAAI,OAAO,OAAO,MAAM,KAAK,CAAC,OAAO,MAAM,SAAS,QAAQ,QAAQ,KAAA,CAAS,CAAC,GAC5E,OAAO,OAAO,YAAY;EAE5B,OAAO,OAAO;CAChB,CAAC,CACH,IACA,OAAO,KAAK,YAAY,CAAC;CAE/B,MAAM,YACJ,YACA,YAEA,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO,iBAAiB,UAAU;EAEhD,MAAM,aACJ,WAAW,eAAe,KAAA,IACtB,KAAA,IACA;GACE,SAAS,WAAW,WAAW;GAC/B,OAAO,OAAO,OAAO,aAAa,OAAO,eAAe,eAAe,CAAC,CAAC,CACvE,WAAW,WAAW,KACxB,CAAC,CAAC,KACA,OAAO,QAAQ,OAAO,aAAa,OAAO,eAAe,eAAe,CAAC,CAAC,GAC1E,OAAO,SAAS,WAAW,CAC7B;EACF;EAEN,IACG,MAAM,OAAO,WAAW,sBAAuB,eAAe,KAAA,MAC9D,eAAe,KAAA,KAAa,cAAc,UAAU,KAAA,GAErD,OAAO,OAAO,YAAY;EAE5B,OAAO,OAAO,MACZ,OAAO,IAAI,aAAa;GACtB,MAAM,cAAc,OAAO;GAC3B,MAAM,UAAU,OAAO;GAEvB,OAAO,WAAW,SAAS,eAAe,MAAM,OAAO,QAAQ;GAS/D,KAAI,OAPqBA,kBAAO,0BAC9B,GACA,eACA,MAAM,UACN,MAAM,OAAO,MACf,OAEkB,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;GAC/D,MAAM,UAAU,OAAO,iBAAiB,SAAS,eAAe,MAAM,MAAM;GAE5E,IAAI,YAAY,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;GAE7D,MAAM,OAAO,OAAO,WAClB,SACA,IAAI,GAAG,EAAE,UAAU,MAAM,OAAO,QAAQ,GAAG,GAAG,EAAE,UAAU,MAAM,OAAO,QAAQ,CAAC,GAChF,cAAc,OAChB;GAEA,MAAM,MAAM,KAAK,IACf,UAAU,OAAO,4BAA4B,MAAM,MAAM;GAE3D,IACE,KAAK,WAAW,KAChB,EAAE,OAAO,cACP,SACA,KACA,MAAM,QACN,QAAQ,iBACR,OACF,MACA,CAAC,gBAAgB,OAAO,QAAQ,aAAa,OAAO,SAAS,MAC5D,OAAOA,kBAAO,cACb,GACA,MAAM,OAAO,UACb,MAAM,OAAO,WACb,cAAc,OAChB,EAAA,CAAG,WAAW,GAEd,OAAO,QAAQ,YAAY,OAAO;GACpC,IACE,eAAe,KAAA,MACd,MAAM,OAAO,UAAU,KAAA,KACtB,WAAW,MAAM,mBAAmB,MAAM,OAAO,MAAM,kBACvD,YAAY,WAAW,MAAM,OAAO,MAAM,YAAY,MAAM,OAAO,MAAM,OAAO,KAChF,CAACA,kBAAO,+BAA+B;IAAE,GAAG,MAAM;IAAU;GAAW,CAAC,IAE1E,OAAO,QAAQ,YAAY,OAAO;GAEpC,MAAM,qBAAqB,OAAOA,kBAAO,SACvC,cAAc,MACd,EAAE,kBACF,EAAE,oBACJ;GAEA,MAAM,kBAAkB,OAAOA,kBAAO,SACpC,cAAc,MACd,EAAE,kBACF,EAAE,oBACJ;GAEA,MAAM,uBAAuB,OAAOA,kBAAO,6BACzC,GACA,cAAc,MACd,MAAM,OAAO,SAAS,gBACxB;GAEA,IACE,yBAAyB,MAAM,OAAO,SAAS,oBAC/C,uBAAuB,MAAM,OAAO,YAAY,sBAChD,oBAAoB,MAAM,OAAO,YAAY,iBAE7C,OAAO,OAAO,YAAY;GAE5B,MAAM,eACJ,MAAM,OAAO,WAAW,iBACpB,OAAOA,kBAAO,SACZ,cAAc,MACd,EAAE,sBACF,EAAE,wBACJ,IACA,KAAA;GAEN,IAAI;GAEJ,MAAM,gBAAgB,OAAO,GAAG,uCAAuC,CAAC,OACtE,OAAO,QAAQ,qCAAqC,uBAClD,OAAO,IAAI,aAAa;IACtB,IAAI,cAAc,KAAA,GAAW;IAE7B,IACE,EAAE,OAAOA,kBAAO,qBACd,GACA,MAAM,UACN,QAAQ,iBACR;KACE,cAAc,gBAAgB,MAAM,OAAO,WAAY;KACvD;KACA;KACA;IACF,GACA,SACF,OACC,OAAO,WACN,SACA,aAAa,SAAS;KACpB,GAAG;MACF,EAAE,QAAQ,EAAE,OAAO;MACnB,EAAE,WAAW;MACb,EAAE,SAAS;IACd,CAAC,GACD,KACF,EAAA,CAAG,WAAW,KACd,CAAC,gBAAgB,OAAO,QAAQ,aAAa,OAAO,SAAS,GAE7D,OAAO,OAAO,YAAY;GAC9B,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,oBAAoB,kBAAkB,CAAC,CACvE,CACF;GAEA,MAAM,kBAAkB,OAAO,IAAI,aAAa;IAC9C,OAAO,cAAc,CAAC,CAAC,KACrB,OAAO,eAAe,oCAAoC,WAAW,CACvE;IACA,IAAI,cAAc,KAAA,GAAW;IAC7B,MAAM,iBAAiB,OAAO,OAAO,cAAc,8BAA8B;IAEjF,IACE,OAAO,OAAO,cAAc,KAC5B,CAAC,eAAe,MAAM,SAAS,cAAc,CAAC,CAAC,KAAK,gBAAgB,CAAC,GAErE,OAAO,OAAO,YAAY;GAC9B,CAAC;GAED,MAAM,QAAQ,OAAO,GAAG,+BAA+B,CAAC,CAAC,aAAa;IACpE,MAAM,WAAW,OAAO;IAExB,IAAI,CAAC,gBAAgB,OAAO,QAAQ,aAAa,QAAQ,GAAG,OAAO;IAwBnE,IAAI,EArBF,MAAM,OAAO,WAAW,iBACpB,OAAOA,kBAAO,cACZ,GACA,eACA,MAAM,UACN;KACgB;KACd;KACA;KACA;IACF,GACA,QACF,IACA,OAAOA,kBAAO,iBACZ,GACA,MAAM,UACN,QAAQ,iBACR;KAAE;KAAoB;KAAiB;IAAqB,GAC5D,QACF,IAEQ,OAAO,OAAO,YAAY;IACxC,YAAY;IACZ,OAAO,SAAS,SAAS,KAAK,UAAU;IACxC,IAAI,CAAC,gBAAgB,OAAO,QAAQ,aAAa,OAAO,SAAS,GAC/D,OAAO,OAAO,YAAY;IAE5B,OAAO;GACT,CAAC;GAED,IAAI,eAAe,KAAA,GAAW;IAC5B,IAAI;IAEJ,OAAO,oBACL,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,YACA,OAAO,IAAI,aAAa;KACtB,OAAO,OAAO,MAAM;IACtB,CAAC,IACA,aAAa;KACZ,UAAU,QAAQ,aAAa,cAAc,YAAY,YAAY,OAAO;KAE5E,OAAO;IACT,CACF;IAEA,OAAO;IAEP,OAAO,WAAW,QAAQ,YAAY,OAAO;GAC/C;GAEA,MAAM,UAAU,OAAO,MAAM;GAE7B,OAAO;GAEP,OAAO,QAAQ,UAAU,YAAY,YAAY,OAAO;EAC1D,CAAC,CACH;CACF,CAAC;CA2fH,OAAO;EAxfL,UAAU,YAAY,YACpB,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,gBAAgB,UAAU;GAE/C,IACG,MAAM,WAAW,sBACf,MAAM,UAAU,KAAA,KAAa,MAAM,eAAe,KAAA,MACpD,MAAM,WAAW,oBAAoB,cAAc,UAAU,KAAA,KAC9D,MAAM,eAAe,MAAM,OAAO,cAClC,MAAM,OAAO,kBACX,KAAK,IACH,MAAM,OAAO,4BAA4B,MAAM,OAAO,gBACtD,MAAM,OAAO,UAAU,OAAO,cAC9B,MAAM,OAAO,UAAU,WAAW,cAClC,MAAM,OAAO,UAAU,QAAQ,YACjC,KACD,MAAM,aAAa,qBAAqB,eACvC,EAAE,wBAAwB,4BAE5B,OAAO,OAAO,YAAY;GAE5B,OAAO,OAAO,MACZ,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IAEvB,OAAO,WAAW,SAAS,eAAe,MAAM,QAAQ;IAExD,MAAM,UAAU,wBAAwB,KACtC,OAAOA,kBAAO,SACZ,cAAc,MACd,QAAQ,iBACR,QAAQ,mBACV,CACF;IAEA,MAAM,YAAY,OAAO,iBAAiB,SAAS,eAAe,KAAK;IAEvE,IAAI,cAAc,KAAA,GAAW,OAAO,OAAO,YAAY;IACvD,IAAI,MAAM,UAAU,KAAA,GAEhB;SAAA,MAAM,eAAe,KAAA,KACrB,MAAM,WAAW,aAAa,GAAG,MAAM,SAAS,WAChD,MAAM,WAAW,YAAY,oBAC7B,MAAM,MAAM,mBAAmB,MAAM,WAAW,kBAChD,YAAY,MAAM,MAAM,OAAO,MAAM,YAAY,MAAM,WAAW,OAAO,KACzE,MAAM,MAAM,QAAQ,SAAS,aAC7B,CAAC,aAAa,MAAM,MAAM,QAAQ,UAAU,UAAU,QAAQ,KAC9D,UAAU,UAAU,+BAA+B,KAAA,KACnD,EAAE,OAAO,uBACP,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MAAM,UACR,IAEA,OAAO,OAAO,YAAY;IAAA;IAE9B,KACG,OAAO,WACN,SACA,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,WAAW,MAAM,SAAS,CAAC,GACpE,cAAc,OAChB,EAAA,CAAG,QAEH,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,OAAO;IAE9C,MAAM,MAAM,OAAO,WACjB,YAAY,EAAE,cAAc,GAAG;IAEjC,MAAM,QAAQ,gBAAgB;KAC5B,GAAI,UAAU,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY,UAAU,SAAS;KAC7E,UAAU,UAAU;IACtB,CAAC;IAuBD,MApBG,OAAO,KACN,YACG,OAAO,EAAE,OAAO,MAAM,EAAE,CAAC,CAAC,CAC1B,KAAK,EAAE,KAAK,CAAC,CACb,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,WAAW,UAAU,eAAe,GACzC,GACE,IACE,GAAG,EAAE,OAAO,EAAE,OAAO,SAAS,GAC9B,GAAG,EAAE,sBAAsB,SAAS,CACtC,GACA,IAAI,GAAG,EAAE,OAAO,EAAE,OAAO,KAAK,GAAG,GAAG,EAAE,WAAW,SAAS,CAAC,CAC7D,CACF,CACF,GACF,KACF,EAAA,CAAG,EAAE,EAAE,SAAS,MAEJ,MAAM,OAAO,0BAA0B,OAAO,OAAO,YAAY;IAC/E,KAAK,MAAM,CAAC,WAAW,WAAW;KAChC,CAAC,GAAG,EAAE,QAAQ,MAAM,MAAM,GAAG,MAAM,OAAO,UAAU,MAAM;KAC1D,CAAC,GAAG,EAAE,iBAAiB,KAAK,GAAG,MAAM,OAAO,UAAU,UAAU;KAChE,CAAC,GAAG,EAAE,WAAW,UAAU,eAAe,GAAG,MAAM,OAAO,UAAU,OAAO;IAC7E,GAgBE,MAdG,OAAO,KACN,YACG,OAAO,EAAE,OAAO,MAAM,EAAE,CAAC,CAAC,CAC1B,KAAK,EAAE,KAAK,CAAC,CACb,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,WACA,GAAG,EAAE,YAAY,EAAE,cAAc,MAAM,OAAO,YAAY,CAAC,CAC7D,CACF,GACF,KACF,EAAA,CAAG,EAAE,EAAE,SAAS,MAEL,OAAO,OAAO,OAAO,OAAO,YAAY;IAGvD,MAAM,cAAc,OAAO,oCAAoC;KAC7D,MAAM;KACN,UAAU,MAAM;KAChB,YAAY,MAAM;KAClB,UAAU,MAAM;KAChB;KACA,WAAW,MAAM;KACjB,QAAQ,MAAM;KACd,UAAU,UAAU;KACpB,GAAI,UAAU,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY,UAAU,SAAS;KAC7E,qBAAqB,UAAU;KAC/B,GAAI,MAAM,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;KAC1D,cAAc,MAAM;KACpB,iBAAiB;KACjB,4BAA4B,MAAM,MAAM,OAAO;KAC/C,mBAAmB,MAAM,MAAM,OAAO;IACxC,CAAC;IAED,MAAM,WAAW,OAAO,kBAAkB,WAAW;IAErD,OAAO,YAAY,OAAO,EAAE,KAAK,CAAC,CAAC,OACjC,EAAE,aAAa;KACb;KACA,iBAAiB,UAAU;KAC3B,iBAAiB;KACjB;KACA,kBAAkB;KAClB,4BACE,MACA,KAAK,IACH,MAAM,OAAO,UAAU,OAAO,cAC9B,MAAM,OAAO,UAAU,WAAW,cAClC,MAAM,OAAO,UAAU,QAAQ,YACjC;IACJ,CAAC,CACH;IAEA,MAAM,OAAO,OAAO,WAClB,SACA,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,UAAU,MAAM,QAAQ,CAAC,GAClE,KACF;IAEA,IACE,KAAK,WAAW,KAChB,EAAE,OAAO,cACP,SACA,KAAK,IACL,aACA,UAAU,iBACV,QACF,IAEA,OAAO,OAAO,YAAY;IAE5B,MAAM,gBACJ,MACA,KAAK,IACH,MAAM,OAAO,UAAU,OAAO,cAC9B,MAAM,OAAO,UAAU,WAAW,cAClC,MAAM,OAAO,UAAU,QAAQ,YACjC;IAEF,KACG,OAAO,EAAE,cAAc,KAAK,EAAE,CAAC,EAAE,WAAW,OAAO,QACnD,OAAO,EAAE,cAAc,KAAK,EAAE,CAAC,EAAE,qBAAqB,OAAO,kBAC7D,OAAO,cAAc,YAAY,8BACjC,MAAM,eAAe,KAAA,KACpB,EAAE,OAAO,uBACP,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MAAM,UACR,IAEF,OAAO,OAAO,YAAY;IAE5B,OAAO,QAAQ;KAAE,MAAM;KAAY;IAAY,GAAG,OAAO;GAC3D,CAAC,CACH;EACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,eAAe,YAAY,YACzB,OAAO,IAAI,aAAa;GACtB,MAAM,cAAc,OAAO,oCAAoC,WAAW,WAAW,GACnF,QAAQ,OAAO,8BAA8B,WAAW,KAAK;GAE/D,MAAM,WAAW,OAAO,kBAAkB,WAAW,GACnD,gBAAgB,OAAO,4BAA4B,KAAK;GAE1D,KAAK,OAAO,kBAAkB,cAAc,KAAK,CAAC,OAAO,UACvD,OAAO,OAAO,YAAY;GAE5B,OAAO,OAAO,MACZ,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IAEvB,OAAO,WAAW,SAAS,eAAe,YAAY,QAAQ;IAC9D,MAAM,YAAY,OAAO,iBAAiB,SAAS,eAAe,WAAW;IAE7E,IAAI,cAAc,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;IAE/D,MAAM,OAAO,OAAO,WAChB,SACA,IAAI,GAAG,EAAE,UAAU,YAAY,QAAQ,GAAG,GAAG,EAAE,UAAU,YAAY,QAAQ,CAAC,GAC9E,cAAc,OAChB,GACA,MAAM,KAAK;IAEb,MAAM,MAAM,OAAO;IAEnB,IACE,KAAK,WAAW,KAChB,EAAE,OAAO,cACP,SACA,KACA,aACA,UAAU,iBACV,QACF,MACA,MAAM,MAAM,kBACZ,OAAO,YAAY,8BACnB,OAAO,MAAM,iBAEb,OAAO,QAAQ,YAAY,OAAO;IACpC,OAAO,YACJ,OAAO,EAAE,KAAK,CAAC,CACf,IAAI,EAAE,YAAY;KAAE;KAAO,UAAU;IAAc,CAAC,CAAC,CAAC,CACtD,MAAM,aAAa,SAAS,GAAG,CAAC;IAEnC,MAAM,QAAQ,OAAO,WACnB,SACA,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,UAAU,MAAM,QAAQ,CAAC,GAClE,KACF;IAEA,IACE,MAAM,WAAW,KACjB,EAAE,OAAO,cACP,SACA,MAAM,IACN,OACA,UAAU,iBACV,aACF,OACC,OAAO,WACN,SACA,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,YAAY,IAAI,EAAE,WAAW,GAClC,GAAG,EAAE,sBAAsB,IAAI,EAAE,qBAAqB,CACxD,GACA,KACF,EAAA,CAAG,WAAW,GAEd,OAAO,OAAO,YAAY;IAC5B,KACG,OAAO,cAAc,YAAY,+BACjC,OAAO,cAAc,MAAM,iBAE5B,OAAO,OAAO,YAAY;IAE5B,OAAO,QAAQ,aAAa,OAAO;GACrC,CAAC,CACH;EACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,UAAU,eACR,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,OAAO,aAAa,YAAY,CAAC,CAAC,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,KACxE,OAAO,SAAS,WAAW,CAC7B;GA0DA,QAAO,OAxDeA,kBAAO,SAC3B,UACA,eACA,OAAO,IAAI,aAAa;IACtB,IACE,CAAC,MAAM,OAAO,KACd,EAAE,OAAO,WAAW,SAAS,eAAe,MAAM,UAAU,KAAK,IAEjE,OAAO,KAAA;IAET,MAAM,OAAO,OAAO,WAClB,SACA,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,YAAY,MAAM,UAAU,GACjC,GAAG,EAAE,QAAQ,MAAM,MAAM,GACzB,GAAG,EAAE,OAAO,EAAE,OAAO,KAAK,CAC5B,GACA,KACF;IAEA,IAAI,KAAK,WAAW,GAAG,OAAO,KAAA;IAC9B,MAAM,WAAW,OAAO,4BAA4B,KAAK,EAAE,CAAC,EAAE,SAAS;IACvE,MAAM,YAAY,OAAO,iBAAiB,SAAS,eAAe,QAAQ;IAE1E,IAAI,cAAc,KAAA,GAAW,OAAO,KAAA;IAEpC,MAAM,SAAS,OAAO,WACpB,SACA,aAAa,SAAS,KAAK,EAAE,GAC7B,cAAc,OAChB;IAEA,MAAM,MAAM,OAAO;IAEnB,IACE,OAAO,WAAW,KAClB,MAAM,SAAS,kBACf,OAAO,SAAS,mBAChB,SAAS,aAAa,MAAM,YAC5B,SAAS,eAAe,MAAM,cAC9B,SAAS,WAAW,MAAM,UAC1B,EAAE,OAAO,cACP,SACA,OAAO,IACP,UACA,UAAU,iBACV,OAAO,4BAA4B,QAAQ,CAC7C,IAEA,OAAO,KAAA;IAET,OAAO;KAAE,QAAQ;KAAU,oBAAoB,UAAU;IAAY;GACvE,CAAC,CACH,OAEkB,OAAO,iBAAiB,KAAK,CAAC,CAAC;EACnD,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,uBACF;EACF,WAAW,OAAO,YAChB,SAAS,OAAO,OAAO,CAAC,CAAC,KACvB,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,iBAAiB,OAAO,YACtB,SAAS,OAAO,OAAO,CAAC,CAAC,KACvB,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,SAAS,YAAY,YACnB,OAAO,IAAI,aAAa;GACtB,MAAM,SAAS,OAAO,8BAA8B,WAAW,MAAM,GACnE,WAAW,OAAO,4BAA4B,MAAM;GAEtD,OAAO,OAAO,MACZ,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO;IAEvB,OAAO,WAAW,SAAS,eAAe,OAAO,QAAQ;IACzD,MAAM,YAAY,OAAO,iBAAiB,SAAS,eAAe,MAAM;IAExE,IAAI,cAAc,KAAA,GAAW,OAAO,QAAQ,OAAO,OAAO;IAE1D,MAAM,OAAO,OAAO,WAClB,SACA,IAAI,GAAG,EAAE,UAAU,OAAO,QAAQ,GAAG,GAAG,EAAE,UAAU,OAAO,QAAQ,CAAC,GACpE,cAAc,OAChB;IAEA,MAAM,MAAM,OAAO;IAEnB,IACE,KAAK,WAAW,KAChB,MAAM,OAAO,kBACb,OAAO,OAAO,mBACd,EAAE,OAAO,cACP,SACA,KAAK,IACL,QACA,UAAU,iBACV,QACF,IAEA,OAAO,QAAQ,OAAO,OAAO;IAC/B,OAAO,SAAS,SAAS,KAAK,IAAI,WAAW;IAE7C,OAAO,QAAQ,MAAM,OAAO;GAC9B,CAAC,CACH;EACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,UAAU,YAAY,YACpB,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,GAAG,WAAW;GAE9B,IAAI,CAAC,OAAO,cAAc,MAAM,KAAK,KAAK,MAAM,QAAQ,KAAK,MAAM,QAAQ,KACzE,OAAO,OAAO,YAAY;GAE5B,OAAO,OAAO,MACZ,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IAEvB,IAAI,EAAE,OAAO,WAAW,SAAS,eAAe,MAAM,UAAU,KAAK,IACnE,OAAO,QAAQ;KAAE,SAAS;KAAG,SAAS;IAAM,GAAG,OAAO;IACxD,MAAM,MAAM,EAAE,cAAc,OAAO,SAAS;IAE5C,MAAM,MAAM,IACV,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GACE,IAAI,IAAI,EAAE,aAAa,GAAG,GAAG,IAAI,EAAE,sBAAsB,GAAG,CAAC,GAC7D,IACE,UAAU,EAAE,QAAQ,GACpB,GACE,IAAI,GAAG,EAAE,OAAO,EAAE,OAAO,SAAS,GAAG,IAAI,EAAE,sBAAsB,GAAG,CAAC,GACrE,IAAI,GAAG,EAAE,OAAO,EAAE,OAAO,KAAK,GAAG,IAAI,EAAE,WAAW,GAAG,CAAC,CACxD,CACF,CACF,CACF;IAEA,MAAM,OAAO,OAAO,KAClB,YACG,OAAO,CAAC,CACR,KAAK,EAAE,KAAK,CAAC,CACb,MAAM,GAAG,CAAC,CACV,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,CAChC,MAAM,MAAM,QAAQ,CAAC,GACxB,cAAc,OAChB;IAEA,IAAI,UAAU;IAEd,KAAK,MAAM,OAAO,KAAK,MAAM,GAAG,MAAM,KAAK,GAYzC,KAVG,OAAO,WACN,SACA,IACE,aAAa,SAAS,GAAG,GACzB,IAAI,EAAE,aAAa,GAAG,GACtB,IAAI,EAAE,sBAAsB,GAAG,CACjC,GACA,KACF,EAAA,CAAG,WAAW,GAEH;KACX,OAAO,YAAY,OAAO,EAAE,KAAK,CAAC,CAAC,MAAM,aAAa,SAAS,GAAG,CAAC;KACnE,KACG,OAAO,WACN,SACA,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,UAAU,IAAI,EAAE,SAAS,CAAC,GACnE,KACF,EAAA,CAAG,QAEH,OAAO,OAAO,YAAY;KAC5B;IACF,OAAO,OAAO,SAAS,SAAS,KAAK,SAAS;IAGhD,OAAO,QACL;KACE;KACA,UACG,OAAO,KAAK,YAAY,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,EAAA,CACvE,SAAS;IAChB,GACA,OACF;GACF,CAAC,CACH;EACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;CAGU;AAChB,CACF;AAEA,MAAa,4BAA4B;CACvC;CACA;CACA;CACA;CACA;CACA;CACA;AACF"}
+{"version":3,"file":"password-prepared-sql.mjs","names":["kernel"],"sources":["../../src/drizzle/password-prepared-sql.ts"],"sourcesContent":["import {\n  type NativeDatabase,\n  CurrentPasswordPreparedTransaction,\n  PasswordPreparedPostconditions,\n  PasswordPreparedJournalGuards,\n} from \"@yielded/auth-persistence/Adapter\";\nimport { CurrentCommitJournal, LifecycleHooks, HookConfigurationError } from \"@yielded/auth/Hooks\";\nimport {\n  PasswordUnavailable,\n  PasswordRejected,\n  PasswordPreparedVersion,\n  decodePasswordPreparedReady,\n  encodePasswordPreparedReady,\n  snapshotPasswordPreparedReady,\n  snapshotPasswordPreparedReservation,\n  type PasswordPreparedReady,\n  type PasswordPreparedReservation,\n  snapshotPasswordCredential,\n  snapshotPasswordRequirement,\n  type PasswordMutationDecision,\n  type PreparePasswordCommit,\n  type PasswordPreparedPersistence,\n  type PasswordPreparedMutation,\n} from \"@yielded/auth/Password\";\nimport { reportPersistenceFailure } from \"@yielded/auth/Persistence\";\nimport { type ProofCompletionPlan, ProofUnavailable, ProofBinding } from \"@yielded/auth/Proofs\";\nimport { AuthenticationRevision } from \"@yielded/auth/Sessions\";\n/* oxlint-disable no-explicit-any -- concrete driver makers retain consumer table types. */\nimport { and, count, eq, gt, isNotNull, isNull, lte, or, type SQL } from \"drizzle-orm\";\nimport { Cause, DateTime, Effect, Option, Predicate, Redacted, Schema } from \"effect\";\n\nimport { column } from \"./model\";\nimport {\n  requiredPasswordPreparedConstraints,\n  type AnyPasswordPreparedPersistenceMapping,\n  type PasswordPreparedState,\n} from \"./password-prepared-model\";\nimport {\n  ContextInput,\n  CompletionInput,\n  encodeReservation,\n  evidenceCurrent,\n  identifierScope,\n  reservationOf,\n  sameRevision,\n  snapshotMutation,\n  snapshotReserve,\n  unavailable,\n} from \"./password-prepared-state\";\nimport {\n  CurrentPasswordSql,\n  passwordSqlKernel as kernel,\n  type PasswordSqlConfiguration,\n  type PasswordSqlQuery,\n} from \"./password-sql\";\nimport { checkProofCompletionIn, completeProofPlanIn } from \"./proof-sql\";\nimport { validateDrizzleStorage } from \"./storage-validation\";\n\nconst translateFailure = <A, E, R>(\n  effect: Effect.Effect<A, E, R>,\n): Effect.Effect<A, PasswordUnavailable, R> =>\n  reportPersistenceFailure(\n    effect,\n    (error) =>\n      Schema.is(PasswordUnavailable)(error) ||\n      Schema.is(ProofUnavailable)(error) ||\n      Schema.is(HookConfigurationError)(error),\n  ).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));\n\nconst translateContextFailure = <A, E, R>(\n  effect: Effect.Effect<A, E, R>,\n): Effect.Effect<A, PasswordUnavailable | PasswordRejected, R> =>\n  reportPersistenceFailure(\n    effect,\n    (error) =>\n      Schema.is(PasswordUnavailable)(error) ||\n      Schema.is(PasswordRejected)(error) ||\n      Schema.is(ProofUnavailable)(error) ||\n      Schema.is(HookConfigurationError)(error),\n  ).pipe(\n    Effect.catchCause((cause) =>\n      Effect.failCause(\n        Cause.map(cause, (error) => (Schema.is(PasswordRejected)(error) ? error : unavailable())),\n      ),\n    ),\n  );\n\ntype Mapping = AnyPasswordPreparedPersistenceMapping;\nconst nowMillis = DateTime.now.pipe(Effect.map(DateTime.toEpochMillis));\n\nconst read = (query: PasswordSqlQuery, locking: boolean) =>\n  locking && typeof query.for === \"function\" ? query.for(\"update\") : query;\n\nconst columns = (mapping: Mapping) => {\n  const table = mapping.intent;\n\n  return {\n    moduleId: column(table.table, table.moduleId),\n    intentId: column(table.table, table.intentId),\n    commandId: column(table.table, table.commandId),\n    subjectId: column(table.table, table.subjectId),\n    action: column(table.table, table.action),\n    generation: column(table.table, table.generation),\n    version: column(table.table, table.version),\n    state: column(table.table, table.state),\n    digest: column(table.table, table.digest),\n    snapshot: column(table.table, table.snapshot),\n    identifierScope: column(table.table, table.identifierScope),\n    createdAt: column(table.table, table.createdAt),\n    admittedAt: column(table.table, table.admittedAt),\n    admissionRetainUntil: column(table.table, table.admissionRetainUntil),\n    preparationExpiresAt: column(table.table, table.preparationExpiresAt),\n    expiresAt: column(table.table, table.expiresAt),\n    retainUntil: column(table.table, table.retainUntil),\n  };\n};\n\nconst valid = (mapping: Mapping) =>\n  Object.entries(requiredPasswordPreparedConstraints).every(\n    ([key, value]) =>\n      mapping.constraints[key as keyof typeof requiredPasswordPreparedConstraints] === value,\n  );\n\nconst lockAnchor = Effect.fn(\"DrizzlePasswordPrepared.lockAnchor\")(function* (\n  mapping: Mapping,\n  configuration: PasswordSqlConfiguration,\n  moduleId: string,\n  create = true,\n) {\n  const database = yield* CurrentPasswordSql;\n\n  const a = mapping.admission,\n    key = column(a.table, a.moduleId);\n\n  if (create)\n    yield* configuration.insertIfAbsent(\n      database.insert(a.table).values(a.encodeInsert(moduleId)),\n      a.moduleId,\n      moduleId,\n    );\n\n  const rows = yield* read(\n    database.select().from(a.table).where(eq(key, moduleId)).limit(2),\n    configuration.locking,\n  );\n\n  if (rows.length > 1 || (create && rows.length !== 1)) return yield* unavailable();\n\n  return rows.length === 1;\n});\n\nconst bindingJson = Schema.encodeSync(Schema.fromJsonString(ProofBinding));\n\nconst captureAuthority = Effect.fn(\"DrizzlePasswordPrepared.captureAuthority\")(function* (\n  mapping: Mapping,\n  configuration: Pick<PasswordSqlConfiguration, \"locking\">,\n  input: {\n    readonly moduleId: string;\n    readonly action: PasswordPreparedReservation[\"action\"];\n    readonly subjectId: string;\n    readonly reset?: PasswordPreparedReservation[\"reset\"];\n  },\n) {\n  const database = yield* CurrentPasswordSql;\n\n  const p = mapping.password;\n  const locked = yield* kernel.lockSubject(p, input.subjectId, configuration.locking);\n\n  if (locked.row === undefined || !p.subject.isActiveStatus(locked.row[p.subject.status]))\n    return undefined;\n\n  const ic = kernel.identifierColumns(p),\n    ac = kernel.authorityCredentialColumns(p);\n\n  let identifier: any;\n\n  if (input.action !== \"add-password\") {\n    if (input.reset !== undefined)\n      identifier = (yield* kernel.lockIdentifier(\n        p,\n        input.reset.binding.identifier,\n        configuration.locking,\n      ))[0];\n    else {\n      const discovered = (yield* read(\n        database\n          .select()\n          .from(p.identifier.table)\n          .where(eq(ic.subjectId, locked.nativeSubjectId))\n          .orderBy(ic.namespace, ic.value),\n        false,\n      )).find((row: any) => p.identifier.isCurrent(row));\n\n      if (discovered !== undefined)\n        identifier = (yield* kernel.lockIdentifier(\n          p,\n          {\n            namespace: discovered[p.identifier.namespace],\n            value: discovered[p.identifier.value],\n          } as any,\n          configuration.locking,\n        ))[0];\n    }\n    if (\n      identifier === undefined ||\n      !p.identifier.isCurrent(identifier) ||\n      !p.subjectId.equals(identifier[p.identifier.subjectId], locked.nativeSubjectId)\n    )\n      return undefined;\n  }\n\n  const credential = (yield* kernel.readPasswordCredential(\n    p,\n    input.moduleId,\n    locked.nativeSubjectId,\n    configuration.locking,\n  ))[0];\n\n  if ((input.action === \"add-password\") !== (credential === undefined)) return undefined;\n\n  const snapshot =\n    credential === undefined\n      ? undefined\n      : yield* p.credential\n          .decode({ moduleId: input.moduleId, subject: locked.row, identifier, credential })\n          .pipe(Effect.flatMap(snapshotPasswordCredential));\n\n  if (\n    snapshot !== undefined &&\n    (snapshot.moduleId !== input.moduleId ||\n      snapshot.revision.subjectId !== input.subjectId ||\n      snapshot.revision.securityRevision !== locked.row[p.subject.securityRevision] ||\n      snapshot.credentialId !== credential[p.credential.credentialId] ||\n      snapshot.credentialRevision !== credential[p.credential.credentialRevision] ||\n      snapshot.verifierVersion !== credential[p.credential.verifierVersion] ||\n      Redacted.value(snapshot.verifier) !== credential[p.credential.verifier] ||\n      snapshot.normalization !== credential[p.credential.normalization] ||\n      snapshot.identifier.namespace !== identifier[p.identifier.namespace] ||\n      snapshot.identifier.value !== identifier[p.identifier.value] ||\n      snapshot.identifierBindingRevision !== identifier[p.identifier.bindingRevision])\n  )\n    return undefined;\n\n  const factors = yield* read(\n    database\n      .select()\n      .from(p.authorityCredential.table)\n      .where(eq(ac.subjectId, locked.nativeSubjectId))\n      .orderBy(ac.credentialId),\n    configuration.locking,\n  );\n\n  const active = factors.filter(\n    (row: any) =>\n      p.authorityCredential.status === undefined ||\n      p.authorityCredential.isActiveStatus?.(row[p.authorityCredential.status]) === true,\n  );\n\n  if (active.length > 64) return yield* unavailable();\n\n  const revision =\n    snapshot?.revision ??\n    AuthenticationRevision.make({\n      subjectId: input.subjectId as any,\n      securityRevision: locked.row[p.subject.securityRevision],\n      credentials: active.map((row: any) => ({\n        credentialId: row[p.authorityCredential.credentialId],\n        revision: row[p.authorityCredential.revision],\n      })),\n    });\n\n  if (\n    revision.credentials.some(\n      (expected) =>\n        !active.some(\n          (row: any) =>\n            row[p.authorityCredential.credentialId] === expected.credentialId &&\n            row[p.authorityCredential.revision] === expected.revision,\n        ),\n    )\n  )\n    return undefined;\n\n  const requirement = yield* p.subject\n    .decodeActionRequirement(locked.row, input.action)\n    .pipe(Effect.flatMap(snapshotPasswordRequirement));\n\n  return { ...locked, identifier, snapshot, revision, requirement };\n});\n\nconst currentAuthority = Effect.fn(\"DrizzlePasswordPrepared.currentAuthority\")(function* (\n  mapping: Mapping,\n  configuration: Pick<PasswordSqlConfiguration, \"locking\">,\n  record: PasswordPreparedReservation | PasswordPreparedReady,\n) {\n  const current = yield* captureAuthority(mapping, configuration, {\n    moduleId: record.moduleId,\n    action: record.action,\n    subjectId: record.revision.subjectId,\n    ...(record.reset === undefined ? {} : { reset: record.reset }),\n  });\n\n  if (\n    current === undefined ||\n    !sameRevision(current.revision, record.revision) ||\n    (current.snapshot === undefined\n      ? record.credential !== undefined\n      : record.credential === undefined ||\n        !kernel.sameCredentialSnapshot(current.snapshot, record.credential))\n  )\n    return undefined;\n\n  return current;\n});\n\nconst rowCondition = (mapping: Mapping, row: any) => {\n  const c = columns(mapping);\n\n  return and(\n    ...Object.entries(c).map(([key, value]) => {\n      const field = mapping.intent[key as keyof typeof c],\n        item = row[field];\n\n      return Predicate.isNullish(item) ? isNull(value) : eq(value, item);\n    }),\n  )!;\n};\n\nconst readIntent = Effect.fn(\"Drizzle.readIntent\")(function* (\n  mapping: Mapping,\n  condition: SQL,\n  locking: boolean,\n) {\n  const database = yield* CurrentPasswordSql;\n\n  return yield* read(\n    database.select().from(mapping.intent.table).where(condition).limit(2),\n    locking,\n  );\n});\n\nconst recordMatches = Effect.fn(\"DrizzlePasswordPrepared.recordMatches\")(function* (\n  mapping: Mapping,\n  row: any,\n  record: PasswordPreparedReservation | PasswordPreparedReady,\n  nativeSubjectId: unknown,\n  snapshot: string,\n) {\n  const t = mapping.intent,\n    p = mapping.password;\n\n  if (\n    row === undefined ||\n    row[t.moduleId] !== record.moduleId ||\n    row[t.intentId] !== record.intentId ||\n    row[t.commandId] !== record.commandId ||\n    !p.subjectId.equals(row[t.subjectId], nativeSubjectId) ||\n    row[t.action] !== record.action ||\n    row[t.generation] !== record.generation ||\n    row[t.version] !== record.version ||\n    row[t.state] !== t.states[record._tag] ||\n    row[t.snapshot] !== snapshot ||\n    row[t.identifierScope] !== identifierScope(record) ||\n    (record._tag === \"Ready\"\n      ? row[t.digest] !== record.digest\n      : !Predicate.isNullish(row[t.digest]))\n  )\n    return false;\n  for (const [key, instant] of [\n    [t.createdAt, record.createdAtMillis],\n    [t.preparationExpiresAt, record.preparationExpiresAtMillis],\n    [t.retainUntil, record.retainUntilMillis],\n  ] as const)\n    if ((yield* p.decodeInstant(row[key])) !== instant) return false;\n\n  return record._tag === \"Ready\"\n    ? (yield* p.decodeInstant(row[t.expiresAt])) === record.expiresAtMillis\n    : Predicate.isNullish(row[t.expiresAt]);\n});\n\nconst terminal = Effect.fn(\"DrizzlePasswordPrepared.terminal\")(function* (\n  mapping: Mapping,\n  row: any,\n  state: Exclude<PasswordPreparedState, \"Preparing\" | \"Ready\">,\n) {\n  const database = yield* CurrentPasswordSql;\n\n  yield* database\n    .update(mapping.intent.table)\n    .set(mapping.intent.encodeTerminal(state))\n    .where(rowCondition(mapping, row));\n\n  const c = columns(mapping),\n    t = mapping.intent;\n\n  const rows = yield* readIntent(\n    mapping,\n    and(eq(c.moduleId, row[t.moduleId]), eq(c.intentId, row[t.intentId]))!,\n    false,\n  );\n\n  const expected = { ...row, [t.state]: t.states[state], [t.snapshot]: null, [t.digest]: null };\n\n  if (\n    rows.length !== 1 ||\n    (yield* readIntent(mapping, rowCondition(mapping, expected), false)).length !== 1\n  )\n    return yield* unavailable();\n});\n\nexport const makeSqlPasswordPreparedPersistence = Effect.fn(\"makeSqlPasswordPreparedPersistence\")(\n  function* (\n    mapping: Mapping,\n    configuration: PasswordSqlConfiguration,\n  ): Effect.fn.Return<\n    PasswordPreparedPersistence,\n    PasswordUnavailable,\n    LifecycleHooks | CurrentPasswordSql | NativeDatabase\n  > {\n    const database = yield* CurrentPasswordSql;\n\n    if (!configuration.coordinated)\n      yield* validateDrizzleStorage({\n        ...mapping,\n        proof: configuration.proof?.mapping,\n      }).pipe(Effect.mapError(unavailable));\n    const hooks = yield* LifecycleHooks;\n\n    const p = mapping.password,\n      c = columns(mapping),\n      t = mapping.intent;\n\n    const owned = <A, E, R>(body: Effect.Effect<A, E, R>) =>\n      valid(mapping)\n        ? kernel.owned(\n            database,\n            p,\n            configuration,\n            Effect.gen(function* () {\n              const journal = yield* CurrentCommitJournal;\n              const guards = yield* Effect.serviceOption(PasswordPreparedJournalGuards);\n\n              if (Option.isSome(guards) && !guards.value.register(journal.prepare(undefined)))\n                return yield* unavailable();\n\n              return yield* body;\n            }),\n          )\n        : Effect.fail(unavailable());\n\n    const complete = <A>(\n      uncaptured: PasswordPreparedMutation & { readonly completion?: ProofCompletionPlan },\n      prepare: PreparePasswordCommit<PasswordMutationDecision, A>,\n    ) =>\n      Effect.gen(function* () {\n        const input = yield* snapshotMutation(uncaptured);\n\n        const completion =\n          uncaptured.completion === undefined\n            ? undefined\n            : {\n                prepare: uncaptured.completion.prepare,\n                input: yield* Schema.encodeEffect(Schema.fromJsonString(CompletionInput))(\n                  uncaptured.completion.input,\n                ).pipe(\n                  Effect.flatMap(Schema.decodeEffect(Schema.fromJsonString(CompletionInput))),\n                  Effect.mapError(unavailable),\n                ),\n              };\n\n        if (\n          (input.intent.action === \"reset-password\") !== (completion !== undefined) ||\n          (completion !== undefined && configuration.proof === undefined)\n        )\n          return yield* unavailable();\n\n        return yield* owned(\n          Effect.gen(function* () {\n            const transaction = yield* CurrentPasswordSql;\n            const journal = yield* CurrentCommitJournal;\n\n            yield* lockAnchor(mapping, configuration, input.intent.moduleId);\n\n            const authority = yield* kernel.validateMutationAuthority(\n              p,\n              configuration,\n              input.mutation,\n              input.intent.action,\n            );\n\n            if (authority === undefined) return prepare(\"rejected\", journal);\n            const current = yield* currentAuthority(mapping, configuration, input.intent);\n\n            if (current === undefined) return prepare(\"rejected\", journal);\n\n            const rows = yield* readIntent(\n              mapping,\n              and(eq(c.moduleId, input.intent.moduleId), eq(c.intentId, input.intent.intentId))!,\n              configuration.locking,\n            );\n\n            const row = rows[0],\n              encoded = yield* encodePasswordPreparedReady(input.intent);\n\n            if (\n              rows.length !== 1 ||\n              !(yield* recordMatches(\n                mapping,\n                row,\n                input.intent,\n                current.nativeSubjectId,\n                encoded,\n              )) ||\n              !evidenceCurrent(input, current.requirement, yield* nowMillis) ||\n              (yield* kernel.commandExists(\n                p,\n                input.intent.moduleId,\n                input.intent.commandId,\n                configuration.locking,\n              )).length !== 0\n            )\n              return prepare(\"rejected\", journal);\n            if (\n              completion !== undefined &&\n              (input.intent.reset === undefined ||\n                completion.input.continuationId !== input.intent.reset.continuationId ||\n                bindingJson(completion.input.binding) !== bindingJson(input.intent.reset.binding) ||\n                !kernel.proofCompletionMatchesPassword({ ...input.mutation, completion }))\n            )\n              return prepare(\"rejected\", journal);\n\n            const credentialRevision = yield* kernel.allocate(\n              configuration.mode,\n              p.allocateRevision,\n              p.allocateRevisionSync,\n            );\n\n            const verifierVersion = yield* kernel.allocate(\n              configuration.mode,\n              p.allocateRevision,\n              p.allocateRevisionSync,\n            );\n\n            const nextSecurityRevision = yield* kernel.allocateNextSecurityRevision(\n              p,\n              configuration.mode,\n              input.intent.revision.securityRevision,\n            );\n\n            if (\n              nextSecurityRevision === input.intent.revision.securityRevision ||\n              credentialRevision === input.intent.credential?.credentialRevision ||\n              verifierVersion === input.intent.credential?.verifierVersion\n            )\n              return yield* unavailable();\n\n            const credentialId =\n              input.intent.action === \"add-password\"\n                ? yield* kernel.allocate(\n                    configuration.mode,\n                    p.allocateCredentialId,\n                    p.allocateCredentialIdSync,\n                  )\n                : undefined;\n\n            let appliedAt: number | undefined;\n\n            const assertApplied = Effect.fn(\"DrizzlePasswordPrepared.assertApplied\")(() =>\n              Effect.flatMap(CurrentPasswordPreparedTransaction, (currentTransaction) =>\n                Effect.gen(function* () {\n                  if (appliedAt === undefined) return;\n\n                  if (\n                    !(yield* kernel.checkMutationApplied(\n                      p,\n                      input.mutation,\n                      current.nativeSubjectId,\n                      {\n                        credentialId: credentialId ?? input.intent.credential!.credentialId,\n                        credentialRevision,\n                        verifierVersion,\n                        nextSecurityRevision,\n                      },\n                      appliedAt,\n                    )) ||\n                    (yield* readIntent(\n                      mapping,\n                      rowCondition(mapping, {\n                        ...row,\n                        [t.state]: t.states.Consumed,\n                        [t.snapshot]: null,\n                        [t.digest]: null,\n                      }),\n                      false,\n                    )).length !== 1 ||\n                    !evidenceCurrent(input, current.requirement, yield* nowMillis)\n                  )\n                    return yield* unavailable();\n                }).pipe(Effect.provideService(CurrentPasswordSql, currentTransaction)),\n              ),\n            );\n\n            const validateApplied = Effect.gen(function* () {\n              yield* assertApplied().pipe(\n                Effect.provideService(CurrentPasswordPreparedTransaction, transaction),\n              );\n              if (appliedAt === undefined) return;\n              const postconditions = yield* Effect.serviceOption(PasswordPreparedPostconditions);\n\n              if (\n                Option.isSome(postconditions) &&\n                !postconditions.value.register(assertApplied().pipe(translateFailure))\n              )\n                return yield* unavailable();\n            });\n\n            const apply = Effect.fn(\"DrizzlePasswordPrepared.apply\")(function* () {\n              const finalNow = yield* nowMillis;\n\n              if (!evidenceCurrent(input, current.requirement, finalNow)) return false;\n\n              const changed =\n                input.intent.action === \"add-password\"\n                  ? yield* kernel.addPasswordIn(\n                      p,\n                      configuration,\n                      input.mutation,\n                      {\n                        credentialId: credentialId!,\n                        credentialRevision,\n                        verifierVersion,\n                        nextSecurityRevision,\n                      },\n                      finalNow,\n                    )\n                  : yield* kernel.writeReplacement(\n                      p,\n                      input.mutation,\n                      current.nativeSubjectId,\n                      { credentialRevision, verifierVersion, nextSecurityRevision },\n                      finalNow,\n                    );\n\n              if (!changed) return yield* unavailable();\n              appliedAt = finalNow;\n              yield* terminal(mapping, row, \"Consumed\");\n              if (!evidenceCurrent(input, current.requirement, yield* nowMillis))\n                return yield* unavailable();\n\n              return true;\n            });\n\n            if (completion !== undefined) {\n              let receipt: ReturnType<typeof prepare> | undefined;\n\n              yield* completeProofPlanIn(\n                configuration.proof!.mapping,\n                configuration.proof!.configuration,\n                completion,\n                Effect.gen(function* () {\n                  return yield* apply();\n                }),\n                (decision) => {\n                  receipt = prepare(decision === \"completed\" ? \"changed\" : \"rejected\", journal);\n\n                  return decision;\n                },\n              );\n\n              yield* validateApplied;\n\n              return receipt ?? prepare(\"rejected\", journal);\n            }\n\n            const changed = yield* apply();\n\n            yield* validateApplied;\n\n            return prepare(changed ? \"changed\" : \"rejected\", journal);\n          }),\n        );\n      });\n\n    const services: PasswordPreparedPersistence = {\n      reserve: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const input = yield* snapshotReserve(uncaptured);\n\n          if (\n            (input.action === \"reset-password\") !==\n              (input.reset !== undefined && input.completion !== undefined) ||\n            (input.action === \"reset-password\" && configuration.proof === undefined) ||\n            input.generation !== input.policy.generation ||\n            input.policy.retentionMillis <\n              Math.max(\n                input.policy.preparationLifetimeMillis + input.policy.lifetimeMillis,\n                input.policy.admission.action.windowMillis,\n                input.policy.admission.identifier.windowMillis,\n                input.policy.admission.subject.windowMillis,\n              ) ||\n            ((input.invalidation.existingSessions === \"immediate\" ||\n              input.invalidation.existingSessions === \"cache-expiry\") &&\n              p.sessionInvalidation !== \"same-authority-immediate\")\n          )\n            return yield* unavailable();\n\n          return yield* owned(\n            Effect.gen(function* () {\n              const transaction = yield* CurrentPasswordSql;\n              const journal = yield* CurrentCommitJournal;\n\n              yield* lockAnchor(mapping, configuration, input.moduleId);\n\n              const version = PasswordPreparedVersion.make(\n                yield* kernel.allocate(\n                  configuration.mode,\n                  mapping.allocateVersion,\n                  mapping.allocateVersionSync,\n                ),\n              );\n\n              const authority = yield* captureAuthority(mapping, configuration, input);\n\n              if (authority === undefined) return yield* unavailable();\n              if (input.reset !== undefined) {\n                if (\n                  input.completion === undefined ||\n                  input.completion.moduleId !== `${input.moduleId}/reset` ||\n                  input.completion.purpose !== \"password-reset\" ||\n                  input.reset.continuationId !== input.completion.continuationId ||\n                  bindingJson(input.reset.binding) !== bindingJson(input.completion.binding) ||\n                  input.reset.binding._tag !== \"Subject\" ||\n                  !sameRevision(input.reset.binding.revision, authority.revision) ||\n                  authority.snapshot?.identifierVerifiedAtMillis === undefined ||\n                  !(yield* checkProofCompletionIn(\n                    configuration.proof!.mapping,\n                    configuration.proof!.configuration,\n                    input.completion,\n                  ))\n                )\n                  return yield* unavailable();\n              }\n              if (\n                (yield* readIntent(\n                  mapping,\n                  and(eq(c.moduleId, input.moduleId), eq(c.commandId, input.commandId))!,\n                  configuration.locking,\n                )).length\n              )\n                return prepare({ _tag: \"Existing\" }, journal);\n\n              const now = yield* nowMillis,\n                nativeNow = p.encodeInstant(now);\n\n              const scope = identifierScope({\n                ...(authority.snapshot === undefined ? {} : { credential: authority.snapshot }),\n                revision: authority.revision,\n              });\n\n              const active =\n                (yield* read(\n                  transaction\n                    .select({ total: count() })\n                    .from(t.table)\n                    .where(\n                      and(\n                        eq(c.moduleId, input.moduleId),\n                        eq(c.subjectId, authority.nativeSubjectId),\n                        or(\n                          and(\n                            eq(c.state, t.states.Preparing),\n                            gt(c.preparationExpiresAt, nativeNow),\n                          ),\n                          and(eq(c.state, t.states.Ready), gt(c.expiresAt, nativeNow)),\n                        ),\n                      ),\n                    ),\n                  false,\n                ))[0]?.total ?? 0;\n\n              if (active >= input.policy.maximumPendingPerSubject) return yield* unavailable();\n              for (const [condition, budget] of [\n                [eq(c.action, input.action), input.policy.admission.action],\n                [eq(c.identifierScope, scope), input.policy.admission.identifier],\n                [eq(c.subjectId, authority.nativeSubjectId), input.policy.admission.subject],\n              ] as const) {\n                const total =\n                  (yield* read(\n                    transaction\n                      .select({ total: count() })\n                      .from(t.table)\n                      .where(\n                        and(\n                          eq(c.moduleId, input.moduleId),\n                          condition,\n                          gt(c.admittedAt, p.encodeInstant(now - budget.windowMillis)),\n                        ),\n                      ),\n                    false,\n                  ))[0]?.total ?? 0;\n\n                if (total >= budget.limit) return yield* unavailable();\n              }\n\n              const reservation = yield* snapshotPasswordPreparedReservation({\n                _tag: \"Preparing\",\n                moduleId: input.moduleId,\n                generation: input.generation,\n                intentId: input.intentId,\n                version,\n                commandId: input.commandId,\n                action: input.action,\n                revision: authority.revision,\n                ...(authority.snapshot === undefined ? {} : { credential: authority.snapshot }),\n                capturedRequirement: authority.requirement,\n                ...(input.reset === undefined ? {} : { reset: input.reset }),\n                invalidation: input.invalidation,\n                createdAtMillis: now,\n                preparationExpiresAtMillis: now + input.policy.preparationLifetimeMillis,\n                retainUntilMillis: now + input.policy.retentionMillis,\n              });\n\n              const snapshot = yield* encodeReservation(reservation);\n\n              yield* transaction.insert(t.table).values(\n                t.encodeInsert({\n                  reservation,\n                  nativeSubjectId: authority.nativeSubjectId,\n                  identifierScope: scope,\n                  snapshot,\n                  admittedAtMillis: now,\n                  admissionRetainUntilMillis:\n                    now +\n                    Math.max(\n                      input.policy.admission.action.windowMillis,\n                      input.policy.admission.identifier.windowMillis,\n                      input.policy.admission.subject.windowMillis,\n                    ),\n                }),\n              );\n\n              const rows = yield* readIntent(\n                mapping,\n                and(eq(c.moduleId, input.moduleId), eq(c.intentId, input.intentId))!,\n                false,\n              );\n\n              if (\n                rows.length !== 1 ||\n                !(yield* recordMatches(\n                  mapping,\n                  rows[0],\n                  reservation,\n                  authority.nativeSubjectId,\n                  snapshot,\n                ))\n              )\n                return yield* unavailable();\n\n              const admittedUntil =\n                now +\n                Math.max(\n                  input.policy.admission.action.windowMillis,\n                  input.policy.admission.identifier.windowMillis,\n                  input.policy.admission.subject.windowMillis,\n                );\n\n              if (\n                (yield* p.decodeInstant(rows[0][t.admittedAt])) !== now ||\n                (yield* p.decodeInstant(rows[0][t.admissionRetainUntil])) !== admittedUntil ||\n                (yield* nowMillis) >= reservation.preparationExpiresAtMillis ||\n                (input.completion !== undefined &&\n                  !(yield* checkProofCompletionIn(\n                    configuration.proof!.mapping,\n                    configuration.proof!.configuration,\n                    input.completion,\n                  )))\n              )\n                return yield* unavailable();\n\n              return prepare({ _tag: \"Reserved\", reservation }, journal);\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      publishReady: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const reservation = yield* snapshotPasswordPreparedReservation(uncaptured.reservation),\n            ready = yield* snapshotPasswordPreparedReady(uncaptured.ready);\n\n          const snapshot = yield* encodeReservation(reservation),\n            readySnapshot = yield* encodePasswordPreparedReady(ready);\n\n          if ((yield* encodeReservation(reservationOf(ready))) !== snapshot)\n            return yield* unavailable();\n\n          return yield* owned(\n            Effect.gen(function* () {\n              const transaction = yield* CurrentPasswordSql;\n              const journal = yield* CurrentCommitJournal;\n\n              yield* lockAnchor(mapping, configuration, reservation.moduleId);\n              const authority = yield* currentAuthority(mapping, configuration, reservation);\n\n              if (authority === undefined) return prepare(\"rejected\", journal);\n\n              const rows = yield* readIntent(\n                  mapping,\n                  and(eq(c.moduleId, reservation.moduleId), eq(c.intentId, reservation.intentId))!,\n                  configuration.locking,\n                ),\n                row = rows[0];\n\n              const now = yield* nowMillis;\n\n              if (\n                rows.length !== 1 ||\n                !(yield* recordMatches(\n                  mapping,\n                  row,\n                  reservation,\n                  authority.nativeSubjectId,\n                  snapshot,\n                )) ||\n                now < ready.issuedAtMillis ||\n                now >= reservation.preparationExpiresAtMillis ||\n                now >= ready.expiresAtMillis\n              )\n                return prepare(\"rejected\", journal);\n              yield* transaction\n                .update(t.table)\n                .set(t.encodeReady({ ready, snapshot: readySnapshot }))\n                .where(rowCondition(mapping, row));\n\n              const saved = yield* readIntent(\n                mapping,\n                and(eq(c.moduleId, ready.moduleId), eq(c.intentId, ready.intentId))!,\n                false,\n              );\n\n              if (\n                saved.length !== 1 ||\n                !(yield* recordMatches(\n                  mapping,\n                  saved[0],\n                  ready,\n                  authority.nativeSubjectId,\n                  readySnapshot,\n                )) ||\n                (yield* readIntent(\n                  mapping,\n                  and(\n                    eq(c.moduleId, ready.moduleId),\n                    eq(c.intentId, ready.intentId),\n                    eq(c.admittedAt, row[t.admittedAt]),\n                    eq(c.admissionRetainUntil, row[t.admissionRetainUntil]),\n                  )!,\n                  false,\n                )).length !== 1\n              )\n                return yield* unavailable();\n              if (\n                (yield* nowMillis) >= reservation.preparationExpiresAtMillis ||\n                (yield* nowMillis) >= ready.expiresAtMillis\n              )\n                return yield* unavailable();\n\n              return prepare(\"published\", journal);\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      context: (uncaptured) =>\n        Effect.gen(function* () {\n          const input = yield* Schema.decodeEffect(ContextInput)({ ...uncaptured }).pipe(\n            Effect.mapError(unavailable),\n          );\n\n          const record = yield* kernel.safeRead(\n            database,\n            configuration,\n            Effect.gen(function* () {\n              if (\n                !valid(mapping) ||\n                !(yield* lockAnchor(mapping, configuration, input.moduleId, false))\n              )\n                return undefined;\n\n              const rows = yield* readIntent(\n                mapping,\n                and(\n                  eq(c.moduleId, input.moduleId),\n                  eq(c.generation, input.generation),\n                  eq(c.digest, input.digest),\n                  eq(c.state, t.states.Ready),\n                )!,\n                false,\n              );\n\n              if (rows.length !== 1) return undefined;\n              const selected = yield* decodePasswordPreparedReady(rows[0][t.snapshot]);\n              const authority = yield* currentAuthority(mapping, configuration, selected);\n\n              if (authority === undefined) return undefined;\n\n              const locked = yield* readIntent(\n                mapping,\n                rowCondition(mapping, rows[0]),\n                configuration.locking,\n              );\n\n              const now = yield* nowMillis;\n\n              if (\n                locked.length !== 1 ||\n                now < selected.issuedAtMillis ||\n                now >= selected.expiresAtMillis ||\n                selected.moduleId !== input.moduleId ||\n                selected.generation !== input.generation ||\n                selected.digest !== input.digest ||\n                !(yield* recordMatches(\n                  mapping,\n                  locked[0],\n                  selected,\n                  authority.nativeSubjectId,\n                  yield* encodePasswordPreparedReady(selected),\n                ))\n              )\n                return undefined;\n\n              return { record: selected, currentRequirement: authority.requirement };\n            }),\n          );\n\n          return record ?? (yield* PasswordRejected.make({}));\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateContextFailure,\n        ),\n      complete: (input, prepare) =>\n        complete(input, prepare).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      resetWithProof: (input, prepare) =>\n        complete(input, prepare).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      cancel: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const record = yield* snapshotPasswordPreparedReady(uncaptured.record),\n            snapshot = yield* encodePasswordPreparedReady(record);\n\n          return yield* owned(\n            Effect.gen(function* () {\n              const journal = yield* CurrentCommitJournal;\n\n              yield* lockAnchor(mapping, configuration, record.moduleId);\n              const authority = yield* currentAuthority(mapping, configuration, record);\n\n              if (authority === undefined) return prepare(false, journal);\n\n              const rows = yield* readIntent(\n                mapping,\n                and(eq(c.moduleId, record.moduleId), eq(c.intentId, record.intentId))!,\n                configuration.locking,\n              );\n\n              const now = yield* nowMillis;\n\n              if (\n                rows.length !== 1 ||\n                now < record.issuedAtMillis ||\n                now >= record.expiresAtMillis ||\n                !(yield* recordMatches(\n                  mapping,\n                  rows[0],\n                  record,\n                  authority.nativeSubjectId,\n                  snapshot,\n                ))\n              )\n                return prepare(false, journal);\n              yield* terminal(mapping, rows[0], \"Cancelled\");\n\n              return prepare(true, journal);\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      cleanup: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const input = { ...uncaptured };\n\n          if (!Number.isSafeInteger(input.limit) || input.limit < 1 || input.limit > 1000)\n            return yield* unavailable();\n\n          return yield* owned(\n            Effect.gen(function* () {\n              const transaction = yield* CurrentPasswordSql;\n              const journal = yield* CurrentCommitJournal;\n\n              if (!(yield* lockAnchor(mapping, configuration, input.moduleId, false)))\n                return prepare({ removed: 0, hasMore: false }, journal);\n              const now = p.encodeInstant(yield* nowMillis);\n\n              const due = and(\n                eq(c.moduleId, input.moduleId),\n                or(\n                  and(lte(c.retainUntil, now), lte(c.admissionRetainUntil, now)),\n                  and(\n                    isNotNull(c.snapshot),\n                    or(\n                      and(eq(c.state, t.states.Preparing), lte(c.preparationExpiresAt, now)),\n                      and(eq(c.state, t.states.Ready), lte(c.expiresAt, now)),\n                    ),\n                  ),\n                ),\n              )!;\n\n              const rows = yield* read(\n                transaction\n                  .select()\n                  .from(t.table)\n                  .where(due)\n                  .orderBy(c.createdAt, c.intentId)\n                  .limit(input.limit + 1),\n                configuration.locking,\n              );\n\n              let removed = 0;\n\n              for (const row of rows.slice(0, input.limit)) {\n                const expired =\n                  (yield* readIntent(\n                    mapping,\n                    and(\n                      rowCondition(mapping, row),\n                      lte(c.retainUntil, now),\n                      lte(c.admissionRetainUntil, now),\n                    )!,\n                    false,\n                  )).length === 1;\n\n                if (expired) {\n                  yield* transaction.delete(t.table).where(rowCondition(mapping, row));\n                  if (\n                    (yield* readIntent(\n                      mapping,\n                      and(eq(c.moduleId, input.moduleId), eq(c.intentId, row[t.intentId]))!,\n                      false,\n                    )).length\n                  )\n                    return yield* unavailable();\n                  removed++;\n                } else yield* terminal(mapping, row, \"Expired\");\n              }\n\n              return prepare(\n                {\n                  removed,\n                  hasMore:\n                    (yield* read(transaction.select().from(t.table).where(due).limit(1), false))\n                      .length > 0,\n                },\n                journal,\n              );\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n    };\n\n    return services;\n  },\n);\n\nexport const passwordPreparedSqlKernel = {\n  columns,\n  recordMatches,\n  captureAuthority,\n  currentAuthority,\n  rowCondition,\n  valid,\n  identifierScope,\n};\n"],"mappings":";;;;;;;;;;;;;;;AA0DA,MAAM,oBACJ,WAEA,yBACE,SACC,UACC,OAAO,GAAG,mBAAmB,CAAC,CAAC,KAAK,KACpC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,sBAAsB,CAAC,CAAC,KAAK,CAC3C,CAAC,CAAC,KAAK,OAAO,YAAY,UAAU,OAAO,UAAU,MAAM,IAAI,aAAa,YAAY,CAAC,CAAC,CAAC,CAAC;AAE9F,MAAM,2BACJ,WAEA,yBACE,SACC,UACC,OAAO,GAAG,mBAAmB,CAAC,CAAC,KAAK,KACpC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,sBAAsB,CAAC,CAAC,KAAK,CAC3C,CAAC,CAAC,KACA,OAAO,YAAY,UACjB,OAAO,UACL,MAAM,IAAI,QAAQ,UAAW,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,IAAI,QAAQ,YAAY,CAAE,CAC1F,CACF,CACF;AAGF,MAAM,YAAY,SAAS,IAAI,KAAK,OAAO,IAAI,SAAS,aAAa,CAAC;AAEtE,MAAM,QAAQ,OAAyB,YACrC,WAAW,OAAO,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,IAAI;AAErE,MAAM,WAAW,YAAqB;CACpC,MAAM,QAAQ,QAAQ;CAEtB,OAAO;EACL,UAAU,OAAO,MAAM,OAAO,MAAM,QAAQ;EAC5C,UAAU,OAAO,MAAM,OAAO,MAAM,QAAQ;EAC5C,WAAW,OAAO,MAAM,OAAO,MAAM,SAAS;EAC9C,WAAW,OAAO,MAAM,OAAO,MAAM,SAAS;EAC9C,QAAQ,OAAO,MAAM,OAAO,MAAM,MAAM;EACxC,YAAY,OAAO,MAAM,OAAO,MAAM,UAAU;EAChD,SAAS,OAAO,MAAM,OAAO,MAAM,OAAO;EAC1C,OAAO,OAAO,MAAM,OAAO,MAAM,KAAK;EACtC,QAAQ,OAAO,MAAM,OAAO,MAAM,MAAM;EACxC,UAAU,OAAO,MAAM,OAAO,MAAM,QAAQ;EAC5C,iBAAiB,OAAO,MAAM,OAAO,MAAM,eAAe;EAC1D,WAAW,OAAO,MAAM,OAAO,MAAM,SAAS;EAC9C,YAAY,OAAO,MAAM,OAAO,MAAM,UAAU;EAChD,sBAAsB,OAAO,MAAM,OAAO,MAAM,oBAAoB;EACpE,sBAAsB,OAAO,MAAM,OAAO,MAAM,oBAAoB;EACpE,WAAW,OAAO,MAAM,OAAO,MAAM,SAAS;EAC9C,aAAa,OAAO,MAAM,OAAO,MAAM,WAAW;CACpD;AACF;AAEA,MAAM,SAAS,YACb,OAAO,QAAQ,mCAAmC,CAAC,CAAC,OACjD,CAAC,KAAK,WACL,QAAQ,YAAY,SAA6D,KACrF;AAEF,MAAM,aAAa,OAAO,GAAG,oCAAoC,CAAC,CAAC,WACjE,SACA,eACA,UACA,SAAS,MACT;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,IAAI,QAAQ,WAChB,MAAM,OAAO,EAAE,OAAO,EAAE,QAAQ;CAElC,IAAI,QACF,OAAO,cAAc,eACnB,SAAS,OAAO,EAAE,KAAK,CAAC,CAAC,OAAO,EAAE,aAAa,QAAQ,CAAC,GACxD,EAAE,UACF,QACF;CAEF,MAAM,OAAO,OAAO,KAClB,SAAS,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,MAAM,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAChE,cAAc,OAChB;CAEA,IAAI,KAAK,SAAS,KAAM,UAAU,KAAK,WAAW,GAAI,OAAO,OAAO,YAAY;CAEhF,OAAO,KAAK,WAAW;AACzB,CAAC;AAED,MAAM,cAAc,OAAO,WAAW,OAAO,eAAe,YAAY,CAAC;AAEzE,MAAM,mBAAmB,OAAO,GAAG,0CAA0C,CAAC,CAAC,WAC7E,SACA,eACA,OAMA;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,IAAI,QAAQ;CAClB,MAAM,SAAS,OAAOA,kBAAO,YAAY,GAAG,MAAM,WAAW,cAAc,OAAO;CAElF,IAAI,OAAO,QAAQ,KAAA,KAAa,CAAC,EAAE,QAAQ,eAAe,OAAO,IAAI,EAAE,QAAQ,OAAO,GACpF,OAAO,KAAA;CAET,MAAM,KAAKA,kBAAO,kBAAkB,CAAC,GACnC,KAAKA,kBAAO,2BAA2B,CAAC;CAE1C,IAAI;CAEJ,IAAI,MAAM,WAAW,gBAAgB;EACnC,IAAI,MAAM,UAAU,KAAA,GAClB,cAAc,OAAOA,kBAAO,eAC1B,GACA,MAAM,MAAM,QAAQ,YACpB,cAAc,OAChB,EAAA,CAAG;OACA;GACH,MAAM,cAAc,OAAO,KACzB,SACG,OAAO,CAAC,CACR,KAAK,EAAE,WAAW,KAAK,CAAC,CACxB,MAAM,GAAG,GAAG,WAAW,OAAO,eAAe,CAAC,CAAC,CAC/C,QAAQ,GAAG,WAAW,GAAG,KAAK,GACjC,KACF,EAAA,CAAG,MAAM,QAAa,EAAE,WAAW,UAAU,GAAG,CAAC;GAEjD,IAAI,eAAe,KAAA,GACjB,cAAc,OAAOA,kBAAO,eAC1B,GACA;IACE,WAAW,WAAW,EAAE,WAAW;IACnC,OAAO,WAAW,EAAE,WAAW;GACjC,GACA,cAAc,OAChB,EAAA,CAAG;EACP;EACA,IACE,eAAe,KAAA,KACf,CAAC,EAAE,WAAW,UAAU,UAAU,KAClC,CAAC,EAAE,UAAU,OAAO,WAAW,EAAE,WAAW,YAAY,OAAO,eAAe,GAE9E,OAAO,KAAA;CACX;CAEA,MAAM,cAAc,OAAOA,kBAAO,uBAChC,GACA,MAAM,UACN,OAAO,iBACP,cAAc,OAChB,EAAA,CAAG;CAEH,IAAK,MAAM,WAAW,oBAAqB,eAAe,KAAA,IAAY,OAAO,KAAA;CAE7E,MAAM,WACJ,eAAe,KAAA,IACX,KAAA,IACA,OAAO,EAAE,WACN,OAAO;EAAE,UAAU,MAAM;EAAU,SAAS,OAAO;EAAK;EAAY;CAAW,CAAC,CAAC,CACjF,KAAK,OAAO,QAAQ,0BAA0B,CAAC;CAExD,IACE,aAAa,KAAA,MACZ,SAAS,aAAa,MAAM,YAC3B,SAAS,SAAS,cAAc,MAAM,aACtC,SAAS,SAAS,qBAAqB,OAAO,IAAI,EAAE,QAAQ,qBAC5D,SAAS,iBAAiB,WAAW,EAAE,WAAW,iBAClD,SAAS,uBAAuB,WAAW,EAAE,WAAW,uBACxD,SAAS,oBAAoB,WAAW,EAAE,WAAW,oBACrD,SAAS,MAAM,SAAS,QAAQ,MAAM,WAAW,EAAE,WAAW,aAC9D,SAAS,kBAAkB,WAAW,EAAE,WAAW,kBACnD,SAAS,WAAW,cAAc,WAAW,EAAE,WAAW,cAC1D,SAAS,WAAW,UAAU,WAAW,EAAE,WAAW,UACtD,SAAS,8BAA8B,WAAW,EAAE,WAAW,mBAEjE,OAAO,KAAA;CAWT,MAAM,UAAS,OATQ,KACrB,SACG,OAAO,CAAC,CACR,KAAK,EAAE,oBAAoB,KAAK,CAAC,CACjC,MAAM,GAAG,GAAG,WAAW,OAAO,eAAe,CAAC,CAAC,CAC/C,QAAQ,GAAG,YAAY,GAC1B,cAAc,OAChB,EAAA,CAEuB,QACpB,QACC,EAAE,oBAAoB,WAAW,KAAA,KACjC,EAAE,oBAAoB,iBAAiB,IAAI,EAAE,oBAAoB,OAAO,MAAM,IAClF;CAEA,IAAI,OAAO,SAAS,IAAI,OAAO,OAAO,YAAY;CAElD,MAAM,WACJ,UAAU,YACV,uBAAuB,KAAK;EAC1B,WAAW,MAAM;EACjB,kBAAkB,OAAO,IAAI,EAAE,QAAQ;EACvC,aAAa,OAAO,KAAK,SAAc;GACrC,cAAc,IAAI,EAAE,oBAAoB;GACxC,UAAU,IAAI,EAAE,oBAAoB;EACtC,EAAE;CACJ,CAAC;CAEH,IACE,SAAS,YAAY,MAClB,aACC,CAAC,OAAO,MACL,QACC,IAAI,EAAE,oBAAoB,kBAAkB,SAAS,gBACrD,IAAI,EAAE,oBAAoB,cAAc,SAAS,QACrD,CACJ,GAEA,OAAO,KAAA;CAET,MAAM,cAAc,OAAO,EAAE,QAC1B,wBAAwB,OAAO,KAAK,MAAM,MAAM,CAAC,CACjD,KAAK,OAAO,QAAQ,2BAA2B,CAAC;CAEnD,OAAO;EAAE,GAAG;EAAQ;EAAY;EAAU;EAAU;CAAY;AAClE,CAAC;AAED,MAAM,mBAAmB,OAAO,GAAG,0CAA0C,CAAC,CAAC,WAC7E,SACA,eACA,QACA;CACA,MAAM,UAAU,OAAO,iBAAiB,SAAS,eAAe;EAC9D,UAAU,OAAO;EACjB,QAAQ,OAAO;EACf,WAAW,OAAO,SAAS;EAC3B,GAAI,OAAO,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,OAAO,MAAM;CAC9D,CAAC;CAED,IACE,YAAY,KAAA,KACZ,CAAC,aAAa,QAAQ,UAAU,OAAO,QAAQ,MAC9C,QAAQ,aAAa,KAAA,IAClB,OAAO,eAAe,KAAA,IACtB,OAAO,eAAe,KAAA,KACtB,CAACA,kBAAO,uBAAuB,QAAQ,UAAU,OAAO,UAAU,IAEtE,OAAO,KAAA;CAET,OAAO;AACT,CAAC;AAED,MAAM,gBAAgB,SAAkB,QAAa;CACnD,MAAM,IAAI,QAAQ,OAAO;CAEzB,OAAO,IACL,GAAG,OAAO,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW;EACzC,MACE,OAAO,IADK,QAAQ,OAAO;EAG7B,OAAO,UAAU,UAAU,IAAI,IAAI,OAAO,KAAK,IAAI,GAAG,OAAO,IAAI;CACnE,CAAC,CACH;AACF;AAEA,MAAM,aAAa,OAAO,GAAG,oBAAoB,CAAC,CAAC,WACjD,SACA,WACA,SACA;CACA,MAAM,WAAW,OAAO;CAExB,OAAO,OAAO,KACZ,SAAS,OAAO,CAAC,CAAC,KAAK,QAAQ,OAAO,KAAK,CAAC,CAAC,MAAM,SAAS,CAAC,CAAC,MAAM,CAAC,GACrE,OACF;AACF,CAAC;AAED,MAAM,gBAAgB,OAAO,GAAG,uCAAuC,CAAC,CAAC,WACvE,SACA,KACA,QACA,iBACA,UACA;CACA,MAAM,IAAI,QAAQ,QAChB,IAAI,QAAQ;CAEd,IACE,QAAQ,KAAA,KACR,IAAI,EAAE,cAAc,OAAO,YAC3B,IAAI,EAAE,cAAc,OAAO,YAC3B,IAAI,EAAE,eAAe,OAAO,aAC5B,CAAC,EAAE,UAAU,OAAO,IAAI,EAAE,YAAY,eAAe,KACrD,IAAI,EAAE,YAAY,OAAO,UACzB,IAAI,EAAE,gBAAgB,OAAO,cAC7B,IAAI,EAAE,aAAa,OAAO,WAC1B,IAAI,EAAE,WAAW,EAAE,OAAO,OAAO,SACjC,IAAI,EAAE,cAAc,YACpB,IAAI,EAAE,qBAAqB,gBAAgB,MAAM,MAChD,OAAO,SAAS,UACb,IAAI,EAAE,YAAY,OAAO,SACzB,CAAC,UAAU,UAAU,IAAI,EAAE,OAAO,IAEtC,OAAO;CACT,KAAK,MAAM,CAAC,KAAK,YAAY;EAC3B,CAAC,EAAE,WAAW,OAAO,eAAe;EACpC,CAAC,EAAE,sBAAsB,OAAO,0BAA0B;EAC1D,CAAC,EAAE,aAAa,OAAO,iBAAiB;CAC1C,GACE,KAAK,OAAO,EAAE,cAAc,IAAI,IAAI,OAAO,SAAS,OAAO;CAE7D,OAAO,OAAO,SAAS,WAClB,OAAO,EAAE,cAAc,IAAI,EAAE,UAAU,OAAO,OAAO,kBACtD,UAAU,UAAU,IAAI,EAAE,UAAU;AAC1C,CAAC;AAED,MAAM,WAAW,OAAO,GAAG,kCAAkC,CAAC,CAAC,WAC7D,SACA,KACA,OACA;CAGA,QAAO,OAFiB,mBAAA,CAGrB,OAAO,QAAQ,OAAO,KAAK,CAAC,CAC5B,IAAI,QAAQ,OAAO,eAAe,KAAK,CAAC,CAAC,CACzC,MAAM,aAAa,SAAS,GAAG,CAAC;CAEnC,MAAM,IAAI,QAAQ,OAAO,GACvB,IAAI,QAAQ;CAEd,MAAM,OAAO,OAAO,WAClB,SACA,IAAI,GAAG,EAAE,UAAU,IAAI,EAAE,SAAS,GAAG,GAAG,EAAE,UAAU,IAAI,EAAE,SAAS,CAAC,GACpE,KACF;CAEA,MAAM,WAAW;EAAE,GAAG;GAAM,EAAE,QAAQ,EAAE,OAAO;GAAS,EAAE,WAAW;GAAO,EAAE,SAAS;CAAK;CAE5F,IACE,KAAK,WAAW,MACf,OAAO,WAAW,SAAS,aAAa,SAAS,QAAQ,GAAG,KAAK,EAAA,CAAG,WAAW,GAEhF,OAAO,OAAO,YAAY;AAC9B,CAAC;AAED,MAAa,qCAAqC,OAAO,GAAG,oCAAoC,CAAC,CAC/F,WACE,SACA,eAKA;CACA,MAAM,WAAW,OAAO;CAExB,IAAI,CAAC,cAAc,aACjB,OAAO,uBAAuB;EAC5B,GAAG;EACH,OAAO,cAAc,OAAO;CAC9B,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;CACtC,MAAM,QAAQ,OAAO;CAErB,MAAM,IAAI,QAAQ,UAChB,IAAI,QAAQ,OAAO,GACnB,IAAI,QAAQ;CAEd,MAAM,SAAkB,SACtB,MAAM,OAAO,IACTA,kBAAO,MACL,UACA,GACA,eACA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO;EACvB,MAAM,SAAS,OAAO,OAAO,cAAc,6BAA6B;EAExE,IAAI,OAAO,OAAO,MAAM,KAAK,CAAC,OAAO,MAAM,SAAS,QAAQ,QAAQ,KAAA,CAAS,CAAC,GAC5E,OAAO,OAAO,YAAY;EAE5B,OAAO,OAAO;CAChB,CAAC,CACH,IACA,OAAO,KAAK,YAAY,CAAC;CAE/B,MAAM,YACJ,YACA,YAEA,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO,iBAAiB,UAAU;EAEhD,MAAM,aACJ,WAAW,eAAe,KAAA,IACtB,KAAA,IACA;GACE,SAAS,WAAW,WAAW;GAC/B,OAAO,OAAO,OAAO,aAAa,OAAO,eAAe,eAAe,CAAC,CAAC,CACvE,WAAW,WAAW,KACxB,CAAC,CAAC,KACA,OAAO,QAAQ,OAAO,aAAa,OAAO,eAAe,eAAe,CAAC,CAAC,GAC1E,OAAO,SAAS,WAAW,CAC7B;EACF;EAEN,IACG,MAAM,OAAO,WAAW,sBAAuB,eAAe,KAAA,MAC9D,eAAe,KAAA,KAAa,cAAc,UAAU,KAAA,GAErD,OAAO,OAAO,YAAY;EAE5B,OAAO,OAAO,MACZ,OAAO,IAAI,aAAa;GACtB,MAAM,cAAc,OAAO;GAC3B,MAAM,UAAU,OAAO;GAEvB,OAAO,WAAW,SAAS,eAAe,MAAM,OAAO,QAAQ;GAS/D,KAAI,OAPqBA,kBAAO,0BAC9B,GACA,eACA,MAAM,UACN,MAAM,OAAO,MACf,OAEkB,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;GAC/D,MAAM,UAAU,OAAO,iBAAiB,SAAS,eAAe,MAAM,MAAM;GAE5E,IAAI,YAAY,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;GAE7D,MAAM,OAAO,OAAO,WAClB,SACA,IAAI,GAAG,EAAE,UAAU,MAAM,OAAO,QAAQ,GAAG,GAAG,EAAE,UAAU,MAAM,OAAO,QAAQ,CAAC,GAChF,cAAc,OAChB;GAEA,MAAM,MAAM,KAAK,IACf,UAAU,OAAO,4BAA4B,MAAM,MAAM;GAE3D,IACE,KAAK,WAAW,KAChB,EAAE,OAAO,cACP,SACA,KACA,MAAM,QACN,QAAQ,iBACR,OACF,MACA,CAAC,gBAAgB,OAAO,QAAQ,aAAa,OAAO,SAAS,MAC5D,OAAOA,kBAAO,cACb,GACA,MAAM,OAAO,UACb,MAAM,OAAO,WACb,cAAc,OAChB,EAAA,CAAG,WAAW,GAEd,OAAO,QAAQ,YAAY,OAAO;GACpC,IACE,eAAe,KAAA,MACd,MAAM,OAAO,UAAU,KAAA,KACtB,WAAW,MAAM,mBAAmB,MAAM,OAAO,MAAM,kBACvD,YAAY,WAAW,MAAM,OAAO,MAAM,YAAY,MAAM,OAAO,MAAM,OAAO,KAChF,CAACA,kBAAO,+BAA+B;IAAE,GAAG,MAAM;IAAU;GAAW,CAAC,IAE1E,OAAO,QAAQ,YAAY,OAAO;GAEpC,MAAM,qBAAqB,OAAOA,kBAAO,SACvC,cAAc,MACd,EAAE,kBACF,EAAE,oBACJ;GAEA,MAAM,kBAAkB,OAAOA,kBAAO,SACpC,cAAc,MACd,EAAE,kBACF,EAAE,oBACJ;GAEA,MAAM,uBAAuB,OAAOA,kBAAO,6BACzC,GACA,cAAc,MACd,MAAM,OAAO,SAAS,gBACxB;GAEA,IACE,yBAAyB,MAAM,OAAO,SAAS,oBAC/C,uBAAuB,MAAM,OAAO,YAAY,sBAChD,oBAAoB,MAAM,OAAO,YAAY,iBAE7C,OAAO,OAAO,YAAY;GAE5B,MAAM,eACJ,MAAM,OAAO,WAAW,iBACpB,OAAOA,kBAAO,SACZ,cAAc,MACd,EAAE,sBACF,EAAE,wBACJ,IACA,KAAA;GAEN,IAAI;GAEJ,MAAM,gBAAgB,OAAO,GAAG,uCAAuC,CAAC,OACtE,OAAO,QAAQ,qCAAqC,uBAClD,OAAO,IAAI,aAAa;IACtB,IAAI,cAAc,KAAA,GAAW;IAE7B,IACE,EAAE,OAAOA,kBAAO,qBACd,GACA,MAAM,UACN,QAAQ,iBACR;KACE,cAAc,gBAAgB,MAAM,OAAO,WAAY;KACvD;KACA;KACA;IACF,GACA,SACF,OACC,OAAO,WACN,SACA,aAAa,SAAS;KACpB,GAAG;MACF,EAAE,QAAQ,EAAE,OAAO;MACnB,EAAE,WAAW;MACb,EAAE,SAAS;IACd,CAAC,GACD,KACF,EAAA,CAAG,WAAW,KACd,CAAC,gBAAgB,OAAO,QAAQ,aAAa,OAAO,SAAS,GAE7D,OAAO,OAAO,YAAY;GAC9B,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,oBAAoB,kBAAkB,CAAC,CACvE,CACF;GAEA,MAAM,kBAAkB,OAAO,IAAI,aAAa;IAC9C,OAAO,cAAc,CAAC,CAAC,KACrB,OAAO,eAAe,oCAAoC,WAAW,CACvE;IACA,IAAI,cAAc,KAAA,GAAW;IAC7B,MAAM,iBAAiB,OAAO,OAAO,cAAc,8BAA8B;IAEjF,IACE,OAAO,OAAO,cAAc,KAC5B,CAAC,eAAe,MAAM,SAAS,cAAc,CAAC,CAAC,KAAK,gBAAgB,CAAC,GAErE,OAAO,OAAO,YAAY;GAC9B,CAAC;GAED,MAAM,QAAQ,OAAO,GAAG,+BAA+B,CAAC,CAAC,aAAa;IACpE,MAAM,WAAW,OAAO;IAExB,IAAI,CAAC,gBAAgB,OAAO,QAAQ,aAAa,QAAQ,GAAG,OAAO;IAwBnE,IAAI,EArBF,MAAM,OAAO,WAAW,iBACpB,OAAOA,kBAAO,cACZ,GACA,eACA,MAAM,UACN;KACgB;KACd;KACA;KACA;IACF,GACA,QACF,IACA,OAAOA,kBAAO,iBACZ,GACA,MAAM,UACN,QAAQ,iBACR;KAAE;KAAoB;KAAiB;IAAqB,GAC5D,QACF,IAEQ,OAAO,OAAO,YAAY;IACxC,YAAY;IACZ,OAAO,SAAS,SAAS,KAAK,UAAU;IACxC,IAAI,CAAC,gBAAgB,OAAO,QAAQ,aAAa,OAAO,SAAS,GAC/D,OAAO,OAAO,YAAY;IAE5B,OAAO;GACT,CAAC;GAED,IAAI,eAAe,KAAA,GAAW;IAC5B,IAAI;IAEJ,OAAO,oBACL,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,YACA,OAAO,IAAI,aAAa;KACtB,OAAO,OAAO,MAAM;IACtB,CAAC,IACA,aAAa;KACZ,UAAU,QAAQ,aAAa,cAAc,YAAY,YAAY,OAAO;KAE5E,OAAO;IACT,CACF;IAEA,OAAO;IAEP,OAAO,WAAW,QAAQ,YAAY,OAAO;GAC/C;GAEA,MAAM,UAAU,OAAO,MAAM;GAE7B,OAAO;GAEP,OAAO,QAAQ,UAAU,YAAY,YAAY,OAAO;EAC1D,CAAC,CACH;CACF,CAAC;CA4fH,OAAO;EAzfL,UAAU,YAAY,YACpB,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,gBAAgB,UAAU;GAE/C,IACG,MAAM,WAAW,sBACf,MAAM,UAAU,KAAA,KAAa,MAAM,eAAe,KAAA,MACpD,MAAM,WAAW,oBAAoB,cAAc,UAAU,KAAA,KAC9D,MAAM,eAAe,MAAM,OAAO,cAClC,MAAM,OAAO,kBACX,KAAK,IACH,MAAM,OAAO,4BAA4B,MAAM,OAAO,gBACtD,MAAM,OAAO,UAAU,OAAO,cAC9B,MAAM,OAAO,UAAU,WAAW,cAClC,MAAM,OAAO,UAAU,QAAQ,YACjC,MACA,MAAM,aAAa,qBAAqB,eACxC,MAAM,aAAa,qBAAqB,mBACxC,EAAE,wBAAwB,4BAE5B,OAAO,OAAO,YAAY;GAE5B,OAAO,OAAO,MACZ,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IAEvB,OAAO,WAAW,SAAS,eAAe,MAAM,QAAQ;IAExD,MAAM,UAAU,wBAAwB,KACtC,OAAOA,kBAAO,SACZ,cAAc,MACd,QAAQ,iBACR,QAAQ,mBACV,CACF;IAEA,MAAM,YAAY,OAAO,iBAAiB,SAAS,eAAe,KAAK;IAEvE,IAAI,cAAc,KAAA,GAAW,OAAO,OAAO,YAAY;IACvD,IAAI,MAAM,UAAU,KAAA,GAEhB;SAAA,MAAM,eAAe,KAAA,KACrB,MAAM,WAAW,aAAa,GAAG,MAAM,SAAS,WAChD,MAAM,WAAW,YAAY,oBAC7B,MAAM,MAAM,mBAAmB,MAAM,WAAW,kBAChD,YAAY,MAAM,MAAM,OAAO,MAAM,YAAY,MAAM,WAAW,OAAO,KACzE,MAAM,MAAM,QAAQ,SAAS,aAC7B,CAAC,aAAa,MAAM,MAAM,QAAQ,UAAU,UAAU,QAAQ,KAC9D,UAAU,UAAU,+BAA+B,KAAA,KACnD,EAAE,OAAO,uBACP,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MAAM,UACR,IAEA,OAAO,OAAO,YAAY;IAAA;IAE9B,KACG,OAAO,WACN,SACA,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,WAAW,MAAM,SAAS,CAAC,GACpE,cAAc,OAChB,EAAA,CAAG,QAEH,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,OAAO;IAE9C,MAAM,MAAM,OAAO,WACjB,YAAY,EAAE,cAAc,GAAG;IAEjC,MAAM,QAAQ,gBAAgB;KAC5B,GAAI,UAAU,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY,UAAU,SAAS;KAC7E,UAAU,UAAU;IACtB,CAAC;IAuBD,MApBG,OAAO,KACN,YACG,OAAO,EAAE,OAAO,MAAM,EAAE,CAAC,CAAC,CAC1B,KAAK,EAAE,KAAK,CAAC,CACb,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,WAAW,UAAU,eAAe,GACzC,GACE,IACE,GAAG,EAAE,OAAO,EAAE,OAAO,SAAS,GAC9B,GAAG,EAAE,sBAAsB,SAAS,CACtC,GACA,IAAI,GAAG,EAAE,OAAO,EAAE,OAAO,KAAK,GAAG,GAAG,EAAE,WAAW,SAAS,CAAC,CAC7D,CACF,CACF,GACF,KACF,EAAA,CAAG,EAAE,EAAE,SAAS,MAEJ,MAAM,OAAO,0BAA0B,OAAO,OAAO,YAAY;IAC/E,KAAK,MAAM,CAAC,WAAW,WAAW;KAChC,CAAC,GAAG,EAAE,QAAQ,MAAM,MAAM,GAAG,MAAM,OAAO,UAAU,MAAM;KAC1D,CAAC,GAAG,EAAE,iBAAiB,KAAK,GAAG,MAAM,OAAO,UAAU,UAAU;KAChE,CAAC,GAAG,EAAE,WAAW,UAAU,eAAe,GAAG,MAAM,OAAO,UAAU,OAAO;IAC7E,GAgBE,MAdG,OAAO,KACN,YACG,OAAO,EAAE,OAAO,MAAM,EAAE,CAAC,CAAC,CAC1B,KAAK,EAAE,KAAK,CAAC,CACb,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,WACA,GAAG,EAAE,YAAY,EAAE,cAAc,MAAM,OAAO,YAAY,CAAC,CAC7D,CACF,GACF,KACF,EAAA,CAAG,EAAE,EAAE,SAAS,MAEL,OAAO,OAAO,OAAO,OAAO,YAAY;IAGvD,MAAM,cAAc,OAAO,oCAAoC;KAC7D,MAAM;KACN,UAAU,MAAM;KAChB,YAAY,MAAM;KAClB,UAAU,MAAM;KAChB;KACA,WAAW,MAAM;KACjB,QAAQ,MAAM;KACd,UAAU,UAAU;KACpB,GAAI,UAAU,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY,UAAU,SAAS;KAC7E,qBAAqB,UAAU;KAC/B,GAAI,MAAM,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;KAC1D,cAAc,MAAM;KACpB,iBAAiB;KACjB,4BAA4B,MAAM,MAAM,OAAO;KAC/C,mBAAmB,MAAM,MAAM,OAAO;IACxC,CAAC;IAED,MAAM,WAAW,OAAO,kBAAkB,WAAW;IAErD,OAAO,YAAY,OAAO,EAAE,KAAK,CAAC,CAAC,OACjC,EAAE,aAAa;KACb;KACA,iBAAiB,UAAU;KAC3B,iBAAiB;KACjB;KACA,kBAAkB;KAClB,4BACE,MACA,KAAK,IACH,MAAM,OAAO,UAAU,OAAO,cAC9B,MAAM,OAAO,UAAU,WAAW,cAClC,MAAM,OAAO,UAAU,QAAQ,YACjC;IACJ,CAAC,CACH;IAEA,MAAM,OAAO,OAAO,WAClB,SACA,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,UAAU,MAAM,QAAQ,CAAC,GAClE,KACF;IAEA,IACE,KAAK,WAAW,KAChB,EAAE,OAAO,cACP,SACA,KAAK,IACL,aACA,UAAU,iBACV,QACF,IAEA,OAAO,OAAO,YAAY;IAE5B,MAAM,gBACJ,MACA,KAAK,IACH,MAAM,OAAO,UAAU,OAAO,cAC9B,MAAM,OAAO,UAAU,WAAW,cAClC,MAAM,OAAO,UAAU,QAAQ,YACjC;IAEF,KACG,OAAO,EAAE,cAAc,KAAK,EAAE,CAAC,EAAE,WAAW,OAAO,QACnD,OAAO,EAAE,cAAc,KAAK,EAAE,CAAC,EAAE,qBAAqB,OAAO,kBAC7D,OAAO,cAAc,YAAY,8BACjC,MAAM,eAAe,KAAA,KACpB,EAAE,OAAO,uBACP,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MAAM,UACR,IAEF,OAAO,OAAO,YAAY;IAE5B,OAAO,QAAQ;KAAE,MAAM;KAAY;IAAY,GAAG,OAAO;GAC3D,CAAC,CACH;EACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,eAAe,YAAY,YACzB,OAAO,IAAI,aAAa;GACtB,MAAM,cAAc,OAAO,oCAAoC,WAAW,WAAW,GACnF,QAAQ,OAAO,8BAA8B,WAAW,KAAK;GAE/D,MAAM,WAAW,OAAO,kBAAkB,WAAW,GACnD,gBAAgB,OAAO,4BAA4B,KAAK;GAE1D,KAAK,OAAO,kBAAkB,cAAc,KAAK,CAAC,OAAO,UACvD,OAAO,OAAO,YAAY;GAE5B,OAAO,OAAO,MACZ,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IAEvB,OAAO,WAAW,SAAS,eAAe,YAAY,QAAQ;IAC9D,MAAM,YAAY,OAAO,iBAAiB,SAAS,eAAe,WAAW;IAE7E,IAAI,cAAc,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;IAE/D,MAAM,OAAO,OAAO,WAChB,SACA,IAAI,GAAG,EAAE,UAAU,YAAY,QAAQ,GAAG,GAAG,EAAE,UAAU,YAAY,QAAQ,CAAC,GAC9E,cAAc,OAChB,GACA,MAAM,KAAK;IAEb,MAAM,MAAM,OAAO;IAEnB,IACE,KAAK,WAAW,KAChB,EAAE,OAAO,cACP,SACA,KACA,aACA,UAAU,iBACV,QACF,MACA,MAAM,MAAM,kBACZ,OAAO,YAAY,8BACnB,OAAO,MAAM,iBAEb,OAAO,QAAQ,YAAY,OAAO;IACpC,OAAO,YACJ,OAAO,EAAE,KAAK,CAAC,CACf,IAAI,EAAE,YAAY;KAAE;KAAO,UAAU;IAAc,CAAC,CAAC,CAAC,CACtD,MAAM,aAAa,SAAS,GAAG,CAAC;IAEnC,MAAM,QAAQ,OAAO,WACnB,SACA,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,UAAU,MAAM,QAAQ,CAAC,GAClE,KACF;IAEA,IACE,MAAM,WAAW,KACjB,EAAE,OAAO,cACP,SACA,MAAM,IACN,OACA,UAAU,iBACV,aACF,OACC,OAAO,WACN,SACA,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,YAAY,IAAI,EAAE,WAAW,GAClC,GAAG,EAAE,sBAAsB,IAAI,EAAE,qBAAqB,CACxD,GACA,KACF,EAAA,CAAG,WAAW,GAEd,OAAO,OAAO,YAAY;IAC5B,KACG,OAAO,cAAc,YAAY,+BACjC,OAAO,cAAc,MAAM,iBAE5B,OAAO,OAAO,YAAY;IAE5B,OAAO,QAAQ,aAAa,OAAO;GACrC,CAAC,CACH;EACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,UAAU,eACR,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,OAAO,aAAa,YAAY,CAAC,CAAC,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,KACxE,OAAO,SAAS,WAAW,CAC7B;GA0DA,QAAO,OAxDeA,kBAAO,SAC3B,UACA,eACA,OAAO,IAAI,aAAa;IACtB,IACE,CAAC,MAAM,OAAO,KACd,EAAE,OAAO,WAAW,SAAS,eAAe,MAAM,UAAU,KAAK,IAEjE,OAAO,KAAA;IAET,MAAM,OAAO,OAAO,WAClB,SACA,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,YAAY,MAAM,UAAU,GACjC,GAAG,EAAE,QAAQ,MAAM,MAAM,GACzB,GAAG,EAAE,OAAO,EAAE,OAAO,KAAK,CAC5B,GACA,KACF;IAEA,IAAI,KAAK,WAAW,GAAG,OAAO,KAAA;IAC9B,MAAM,WAAW,OAAO,4BAA4B,KAAK,EAAE,CAAC,EAAE,SAAS;IACvE,MAAM,YAAY,OAAO,iBAAiB,SAAS,eAAe,QAAQ;IAE1E,IAAI,cAAc,KAAA,GAAW,OAAO,KAAA;IAEpC,MAAM,SAAS,OAAO,WACpB,SACA,aAAa,SAAS,KAAK,EAAE,GAC7B,cAAc,OAChB;IAEA,MAAM,MAAM,OAAO;IAEnB,IACE,OAAO,WAAW,KAClB,MAAM,SAAS,kBACf,OAAO,SAAS,mBAChB,SAAS,aAAa,MAAM,YAC5B,SAAS,eAAe,MAAM,cAC9B,SAAS,WAAW,MAAM,UAC1B,EAAE,OAAO,cACP,SACA,OAAO,IACP,UACA,UAAU,iBACV,OAAO,4BAA4B,QAAQ,CAC7C,IAEA,OAAO,KAAA;IAET,OAAO;KAAE,QAAQ;KAAU,oBAAoB,UAAU;IAAY;GACvE,CAAC,CACH,OAEkB,OAAO,iBAAiB,KAAK,CAAC,CAAC;EACnD,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,uBACF;EACF,WAAW,OAAO,YAChB,SAAS,OAAO,OAAO,CAAC,CAAC,KACvB,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,iBAAiB,OAAO,YACtB,SAAS,OAAO,OAAO,CAAC,CAAC,KACvB,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,SAAS,YAAY,YACnB,OAAO,IAAI,aAAa;GACtB,MAAM,SAAS,OAAO,8BAA8B,WAAW,MAAM,GACnE,WAAW,OAAO,4BAA4B,MAAM;GAEtD,OAAO,OAAO,MACZ,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO;IAEvB,OAAO,WAAW,SAAS,eAAe,OAAO,QAAQ;IACzD,MAAM,YAAY,OAAO,iBAAiB,SAAS,eAAe,MAAM;IAExE,IAAI,cAAc,KAAA,GAAW,OAAO,QAAQ,OAAO,OAAO;IAE1D,MAAM,OAAO,OAAO,WAClB,SACA,IAAI,GAAG,EAAE,UAAU,OAAO,QAAQ,GAAG,GAAG,EAAE,UAAU,OAAO,QAAQ,CAAC,GACpE,cAAc,OAChB;IAEA,MAAM,MAAM,OAAO;IAEnB,IACE,KAAK,WAAW,KAChB,MAAM,OAAO,kBACb,OAAO,OAAO,mBACd,EAAE,OAAO,cACP,SACA,KAAK,IACL,QACA,UAAU,iBACV,QACF,IAEA,OAAO,QAAQ,OAAO,OAAO;IAC/B,OAAO,SAAS,SAAS,KAAK,IAAI,WAAW;IAE7C,OAAO,QAAQ,MAAM,OAAO;GAC9B,CAAC,CACH;EACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,UAAU,YAAY,YACpB,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,GAAG,WAAW;GAE9B,IAAI,CAAC,OAAO,cAAc,MAAM,KAAK,KAAK,MAAM,QAAQ,KAAK,MAAM,QAAQ,KACzE,OAAO,OAAO,YAAY;GAE5B,OAAO,OAAO,MACZ,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IAEvB,IAAI,EAAE,OAAO,WAAW,SAAS,eAAe,MAAM,UAAU,KAAK,IACnE,OAAO,QAAQ;KAAE,SAAS;KAAG,SAAS;IAAM,GAAG,OAAO;IACxD,MAAM,MAAM,EAAE,cAAc,OAAO,SAAS;IAE5C,MAAM,MAAM,IACV,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GACE,IAAI,IAAI,EAAE,aAAa,GAAG,GAAG,IAAI,EAAE,sBAAsB,GAAG,CAAC,GAC7D,IACE,UAAU,EAAE,QAAQ,GACpB,GACE,IAAI,GAAG,EAAE,OAAO,EAAE,OAAO,SAAS,GAAG,IAAI,EAAE,sBAAsB,GAAG,CAAC,GACrE,IAAI,GAAG,EAAE,OAAO,EAAE,OAAO,KAAK,GAAG,IAAI,EAAE,WAAW,GAAG,CAAC,CACxD,CACF,CACF,CACF;IAEA,MAAM,OAAO,OAAO,KAClB,YACG,OAAO,CAAC,CACR,KAAK,EAAE,KAAK,CAAC,CACb,MAAM,GAAG,CAAC,CACV,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,CAChC,MAAM,MAAM,QAAQ,CAAC,GACxB,cAAc,OAChB;IAEA,IAAI,UAAU;IAEd,KAAK,MAAM,OAAO,KAAK,MAAM,GAAG,MAAM,KAAK,GAYzC,KAVG,OAAO,WACN,SACA,IACE,aAAa,SAAS,GAAG,GACzB,IAAI,EAAE,aAAa,GAAG,GACtB,IAAI,EAAE,sBAAsB,GAAG,CACjC,GACA,KACF,EAAA,CAAG,WAAW,GAEH;KACX,OAAO,YAAY,OAAO,EAAE,KAAK,CAAC,CAAC,MAAM,aAAa,SAAS,GAAG,CAAC;KACnE,KACG,OAAO,WACN,SACA,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,UAAU,IAAI,EAAE,SAAS,CAAC,GACnE,KACF,EAAA,CAAG,QAEH,OAAO,OAAO,YAAY;KAC5B;IACF,OAAO,OAAO,SAAS,SAAS,KAAK,SAAS;IAGhD,OAAO,QACL;KACE;KACA,UACG,OAAO,KAAK,YAAY,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,EAAA,CACvE,SAAS;IAChB,GACA,OACF;GACF,CAAC,CACH;EACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;CAGU;AAChB,CACF;AAEA,MAAa,4BAA4B;CACvC;CACA;CACA;CACA;CACA;CACA;CACA;AACF"}

package/dist/drizzle/password-prepared-state.mjs

@@ -2,8 +2,8 @@ import { passwordSqlKernel } from "./password-sql.mjs";
 import { DateTime, Effect, Redacted, Schema } from "effect";
 import { AuthenticationProof, AuthenticationRequirement, SessionInvalidationWindow } from "@yielded/auth/Sessions";
 import { ProofBinding, ProofContinuationId, ProofPurpose } from "@yielded/auth/Proofs";
-import { SubjectId, TokenDigest } from "@yielded/auth/Schema";
 import { PasswordAction, PasswordCommandId, PasswordCredentialSnapshot, PasswordPreparedConfiguration, PasswordPreparedIntentId, PasswordPreparedRequirement, PasswordPreparedReservation, PasswordPreparedReset, PasswordUnavailable, encodePasswordPreparedReady, snapshotPasswordPreparedReady, snapshotPasswordPreparedReservation } from "@yielded/auth/Password";
+import { SubjectId, TokenDigest } from "@yielded/auth/Schema";
 //#region src/drizzle/password-prepared-state.ts
 const unavailable = () => PasswordUnavailable.make({});
 const Instant = Schema.Int.check(Schema.isBetween({

package/dist/drizzle/pg-password-prepared.d.mts

@@ -12,17 +12,17 @@ import { SqlError } from "effect/sql/SqlError";
 //#region src/drizzle/pg-password-prepared.d.ts
 type Database = EffectPgDatabase$1<AnyRelations> | EffectPgDatabase<AnyRelations>;
 type TransactionOf<D extends Database> = Parameters<Parameters<D["transaction"]>[0]>[0];
-export declare const makePgPasswordPreparedPersistenceServices: <S extends AnyPgTable, I extends AnyPgTable, C extends AnyPgTable, AC extends AnyPgTable, A extends AnyPgTable, M extends AnyPgTable, T extends AnyPgTable, B extends AnyPgTable, NativeId, PS extends AnyPgTable = AnyPgTable, PC extends AnyPgTable = AnyPgTable, PM extends AnyPgTable = AnyPgTable, PSub extends AnyPgTable = AnyPgTable, PI extends AnyPgTable = AnyPgTable, PCr extends AnyPgTable = AnyPgTable, PNativeId = unknown>(mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, A, M, T, B, NativeId>, proofMapping?: PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId>) => Effect.Effect<{
+export declare const makePgPasswordPreparedPersistenceServices: <S extends AnyPgTable, I extends AnyPgTable, C extends AnyPgTable, AC extends AnyPgTable, M extends AnyPgTable, T extends AnyPgTable, B extends AnyPgTable, NativeId, PS extends AnyPgTable = AnyPgTable, PC extends AnyPgTable = AnyPgTable, PM extends AnyPgTable = AnyPgTable, PSub extends AnyPgTable = AnyPgTable, PI extends AnyPgTable = AnyPgTable, PCr extends AnyPgTable = AnyPgTable, PNativeId = unknown>(mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, M, T, B, NativeId>, proofMapping?: PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId>) => Effect.Effect<{
   passwordPreparedPersistence: PasswordPreparedPersistence;
 }, PasswordUnavailable, Database$1 | LifecycleHooks>;
-export declare function coordinatePgPasswordPreparedPersistence<TargetId, D extends Database, S extends AnyPgTable, I extends AnyPgTable, C extends AnyPgTable, AC extends AnyPgTable, A extends AnyPgTable, M extends AnyPgTable, T extends AnyPgTable, B extends AnyPgTable, NativeId, PS extends AnyPgTable, PC extends AnyPgTable, PM extends AnyPgTable, PSub extends AnyPgTable, PI extends AnyPgTable, PCr extends AnyPgTable, PNativeId, Out, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
-  readonly mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, A, M, T, B, NativeId>;
+export declare function coordinatePgPasswordPreparedPersistence<TargetId, D extends Database, S extends AnyPgTable, I extends AnyPgTable, C extends AnyPgTable, AC extends AnyPgTable, M extends AnyPgTable, T extends AnyPgTable, B extends AnyPgTable, NativeId, PS extends AnyPgTable, PC extends AnyPgTable, PM extends AnyPgTable, PSub extends AnyPgTable, PI extends AnyPgTable, PCr extends AnyPgTable, PNativeId, Out, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
+  readonly mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, M, T, B, NativeId>;
   readonly proofMapping?: PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId> | undefined;
   readonly target: SuppliedService<TargetId, PasswordPreparedPersistence>;
   readonly transaction?: never;
 }, body: Effect.Effect<Out, E, R>): Effect.Effect<Out, E | PasswordUnavailable | HookConfigurationError | SqlError | DatabaseError, Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements>;
-export declare function coordinatePgPasswordPreparedPersistence<TargetId, D extends Database, S extends AnyPgTable, I extends AnyPgTable, C extends AnyPgTable, AC extends AnyPgTable, A extends AnyPgTable, M extends AnyPgTable, T extends AnyPgTable, B extends AnyPgTable, NativeId, PS extends AnyPgTable, PC extends AnyPgTable, PM extends AnyPgTable, PSub extends AnyPgTable, PI extends AnyPgTable, PCr extends AnyPgTable, PNativeId, Out, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
-  readonly mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, A, M, T, B, NativeId>;
+export declare function coordinatePgPasswordPreparedPersistence<TargetId, D extends Database, S extends AnyPgTable, I extends AnyPgTable, C extends AnyPgTable, AC extends AnyPgTable, M extends AnyPgTable, T extends AnyPgTable, B extends AnyPgTable, NativeId, PS extends AnyPgTable, PC extends AnyPgTable, PM extends AnyPgTable, PSub extends AnyPgTable, PI extends AnyPgTable, PCr extends AnyPgTable, PNativeId, Out, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
+  readonly mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, M, T, B, NativeId>;
   readonly proofMapping?: PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId> | undefined;
   readonly target: SuppliedService<TargetId, PasswordPreparedPersistence>;
   readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;

package/dist/drizzle/pg-password-prepared.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"pg-password-prepared.mjs","names":["DatabaseService"],"sources":["../../src/drizzle/pg-password-prepared.ts"],"sourcesContent":["import { NativeDatabase } from \"@yielded/auth-persistence/Adapter\";\nimport type { LifecycleHooks, HookConfigurationError } from \"@yielded/auth/Hooks\";\nimport type { PasswordUnavailable, PasswordPreparedPersistence } from \"@yielded/auth/Password\";\nimport type { AnyRelations } from \"drizzle-orm\";\nimport type { EffectPgDatabase as PgliteDatabase } from \"drizzle-orm/effect-pglite\";\nimport type { EffectPgDatabase as PostgresDatabase } from \"drizzle-orm/effect-postgres\";\nimport type { AnyPgTable } from \"drizzle-orm/pg-core\";\nimport { Effect, Context } from \"effect\";\nimport type { SqlError } from \"effect/sql/SqlError\";\n\nimport { nativeDatabase } from \"./native-database\";\nimport type {\n  PasswordPreparedPersistenceMapping,\n  PasswordPreparedProofMapping,\n} from \"./password-prepared-model\";\nimport {\n  makeTargetPasswordPreparedPersistenceServices,\n  coordinateTargetPasswordPreparedPersistence,\n} from \"./password-prepared-target\";\nimport { CurrentPasswordSql } from \"./password-sql\";\nimport { Database as DatabaseService } from \"./pg-database\";\nimport { pgPasswordConfiguration as configuration } from \"./pg-passwords\";\nimport { acquireTransactionService, transactionService } from \"./standalone-guard\";\nimport type { SuppliedService } from \"./SuppliedService\";\ntype Database = PostgresDatabase<AnyRelations> | PgliteDatabase<AnyRelations>;\ntype TransactionOf<D extends Database> = Parameters<Parameters<D[\"transaction\"]>[0]>[0];\n\nexport const makePgPasswordPreparedPersistenceServices = <\n  S extends AnyPgTable,\n  I extends AnyPgTable,\n  C extends AnyPgTable,\n  AC extends AnyPgTable,\n  A extends AnyPgTable,\n  M extends AnyPgTable,\n  T extends AnyPgTable,\n  B extends AnyPgTable,\n  NativeId,\n  PS extends AnyPgTable = AnyPgTable,\n  PC extends AnyPgTable = AnyPgTable,\n  PM extends AnyPgTable = AnyPgTable,\n  PSub extends AnyPgTable = AnyPgTable,\n  PI extends AnyPgTable = AnyPgTable,\n  PCr extends AnyPgTable = AnyPgTable,\n  PNativeId = unknown,\n>(\n  mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, A, M, T, B, NativeId>,\n  proofMapping?: PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId>,\n) =>\n  Effect.flatMap(\n    Effect.map(acquireTransactionService(DatabaseService), configuration),\n    (configuration) =>\n      makeTargetPasswordPreparedPersistenceServices(mapping, configuration, proofMapping),\n  ).pipe(\n    Effect.provideServiceEffect(CurrentPasswordSql, nativeDatabase(DatabaseService)),\n    Effect.provideServiceEffect(NativeDatabase, nativeDatabase(DatabaseService)),\n  );\n\nexport function coordinatePgPasswordPreparedPersistence<\n  TargetId,\n  D extends Database,\n  S extends AnyPgTable,\n  I extends AnyPgTable,\n  C extends AnyPgTable,\n  AC extends AnyPgTable,\n  A extends AnyPgTable,\n  M extends AnyPgTable,\n  T extends AnyPgTable,\n  B extends AnyPgTable,\n  NativeId,\n  PS extends AnyPgTable,\n  PC extends AnyPgTable,\n  PM extends AnyPgTable,\n  PSub extends AnyPgTable,\n  PI extends AnyPgTable,\n  PCr extends AnyPgTable,\n  PNativeId,\n  Out,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, A, M, T, B, NativeId>;\n    readonly proofMapping?:\n      | PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId>\n      | undefined;\n    readonly target: SuppliedService<TargetId, PasswordPreparedPersistence>;\n    readonly transaction?: never;\n  },\n  body: Effect.Effect<Out, E, R>,\n): Effect.Effect<\n  Out,\n  E | PasswordUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinatePgPasswordPreparedPersistence<\n  TargetId,\n  D extends Database,\n  S extends AnyPgTable,\n  I extends AnyPgTable,\n  C extends AnyPgTable,\n  AC extends AnyPgTable,\n  A extends AnyPgTable,\n  M extends AnyPgTable,\n  T extends AnyPgTable,\n  B extends AnyPgTable,\n  NativeId,\n  PS extends AnyPgTable,\n  PC extends AnyPgTable,\n  PM extends AnyPgTable,\n  PSub extends AnyPgTable,\n  PI extends AnyPgTable,\n  PCr extends AnyPgTable,\n  PNativeId,\n  Out,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, A, M, T, B, NativeId>;\n    readonly proofMapping?:\n      | PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId>\n      | undefined;\n    readonly target: SuppliedService<TargetId, PasswordPreparedPersistence>;\n    readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<Out, E, R>,\n): Effect.Effect<\n  Out,\n  E | PasswordUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId | TxId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinatePgPasswordPreparedPersistence<\n  TargetId,\n  D extends Database,\n  S extends AnyPgTable,\n  I extends AnyPgTable,\n  C extends AnyPgTable,\n  AC extends AnyPgTable,\n  A extends AnyPgTable,\n  M extends AnyPgTable,\n  T extends AnyPgTable,\n  B extends AnyPgTable,\n  NativeId,\n  PS extends AnyPgTable,\n  PC extends AnyPgTable,\n  PM extends AnyPgTable,\n  PSub extends AnyPgTable,\n  PI extends AnyPgTable,\n  PCr extends AnyPgTable,\n  PNativeId,\n  Out,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, A, M, T, B, NativeId>;\n    readonly proofMapping?:\n      | PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId>\n      | undefined;\n    readonly target: SuppliedService<TargetId, PasswordPreparedPersistence>;\n    readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<Out, E, R>,\n): Effect.Effect<\n  Out,\n  E | PasswordUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements\n> {\n  return Effect.flatMap(nativeDatabase(acquire), (database) =>\n    coordinateTargetPasswordPreparedPersistence<TransactionOf<D>, Out, E, Exclude<R, TargetId>>(\n      database,\n      options.mapping,\n      configuration(transactionService(database)),\n      options.proofMapping,\n      (\n        transaction: TransactionOf<D>,\n        services: { readonly passwordPreparedPersistence: PasswordPreparedPersistence },\n      ) => {\n        const provided = Context.make(options.target, services.passwordPreparedPersistence);\n        const work = Effect.provideContext(body, provided);\n\n        return options.transaction === undefined\n          ? work\n          : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n      },\n    ).pipe(Effect.provideService(NativeDatabase, database)),\n  );\n}\n"],"mappings":";;;;;;;;;AA2BA,MAAa,6CAkBX,SACA,iBAEA,OAAO,QACL,OAAO,IAAI,0BAA0BA,QAAe,GAAG,aAAa,IACnE,kBACC,8CAA8C,SAAS,eAAe,YAAY,CACtF,CAAC,CAAC,KACA,OAAO,qBAAqB,oBAAoB,eAAeA,QAAe,CAAC,GAC/E,OAAO,qBAAqB,gBAAgB,eAAeA,QAAe,CAAC,CAC7E;AAsFF,SAAgB,wCA2Bd,SACA,SAQA,MAKA;CACA,OAAO,OAAO,QAAQ,eAAe,OAAO,IAAI,aAC9C,4CACE,UACA,QAAQ,SACR,cAAc,mBAAmB,QAAQ,CAAC,GAC1C,QAAQ,eAEN,aACA,aACG;EACH,MAAM,WAAW,QAAQ,KAAK,QAAQ,QAAQ,SAAS,2BAA2B;EAClF,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;CAC1F,CACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,QAAQ,CAAC,CACxD;AACF"}
+{"version":3,"file":"pg-password-prepared.mjs","names":["DatabaseService"],"sources":["../../src/drizzle/pg-password-prepared.ts"],"sourcesContent":["import { NativeDatabase } from \"@yielded/auth-persistence/Adapter\";\nimport type { LifecycleHooks, HookConfigurationError } from \"@yielded/auth/Hooks\";\nimport type { PasswordUnavailable, PasswordPreparedPersistence } from \"@yielded/auth/Password\";\nimport type { AnyRelations } from \"drizzle-orm\";\nimport type { EffectPgDatabase as PgliteDatabase } from \"drizzle-orm/effect-pglite\";\nimport type { EffectPgDatabase as PostgresDatabase } from \"drizzle-orm/effect-postgres\";\nimport type { AnyPgTable } from \"drizzle-orm/pg-core\";\nimport { Effect, Context } from \"effect\";\nimport type { SqlError } from \"effect/sql/SqlError\";\n\nimport { nativeDatabase } from \"./native-database\";\nimport type {\n  PasswordPreparedPersistenceMapping,\n  PasswordPreparedProofMapping,\n} from \"./password-prepared-model\";\nimport {\n  makeTargetPasswordPreparedPersistenceServices,\n  coordinateTargetPasswordPreparedPersistence,\n} from \"./password-prepared-target\";\nimport { CurrentPasswordSql } from \"./password-sql\";\nimport { Database as DatabaseService } from \"./pg-database\";\nimport { pgPasswordConfiguration as configuration } from \"./pg-passwords\";\nimport { acquireTransactionService, transactionService } from \"./standalone-guard\";\nimport type { SuppliedService } from \"./SuppliedService\";\ntype Database = PostgresDatabase<AnyRelations> | PgliteDatabase<AnyRelations>;\ntype TransactionOf<D extends Database> = Parameters<Parameters<D[\"transaction\"]>[0]>[0];\n\nexport const makePgPasswordPreparedPersistenceServices = <\n  S extends AnyPgTable,\n  I extends AnyPgTable,\n  C extends AnyPgTable,\n  AC extends AnyPgTable,\n  M extends AnyPgTable,\n  T extends AnyPgTable,\n  B extends AnyPgTable,\n  NativeId,\n  PS extends AnyPgTable = AnyPgTable,\n  PC extends AnyPgTable = AnyPgTable,\n  PM extends AnyPgTable = AnyPgTable,\n  PSub extends AnyPgTable = AnyPgTable,\n  PI extends AnyPgTable = AnyPgTable,\n  PCr extends AnyPgTable = AnyPgTable,\n  PNativeId = unknown,\n>(\n  mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, M, T, B, NativeId>,\n  proofMapping?: PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId>,\n) =>\n  Effect.flatMap(\n    Effect.map(acquireTransactionService(DatabaseService), configuration),\n    (configuration) =>\n      makeTargetPasswordPreparedPersistenceServices(mapping, configuration, proofMapping),\n  ).pipe(\n    Effect.provideServiceEffect(CurrentPasswordSql, nativeDatabase(DatabaseService)),\n    Effect.provideServiceEffect(NativeDatabase, nativeDatabase(DatabaseService)),\n  );\n\nexport function coordinatePgPasswordPreparedPersistence<\n  TargetId,\n  D extends Database,\n  S extends AnyPgTable,\n  I extends AnyPgTable,\n  C extends AnyPgTable,\n  AC extends AnyPgTable,\n  M extends AnyPgTable,\n  T extends AnyPgTable,\n  B extends AnyPgTable,\n  NativeId,\n  PS extends AnyPgTable,\n  PC extends AnyPgTable,\n  PM extends AnyPgTable,\n  PSub extends AnyPgTable,\n  PI extends AnyPgTable,\n  PCr extends AnyPgTable,\n  PNativeId,\n  Out,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, M, T, B, NativeId>;\n    readonly proofMapping?:\n      | PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId>\n      | undefined;\n    readonly target: SuppliedService<TargetId, PasswordPreparedPersistence>;\n    readonly transaction?: never;\n  },\n  body: Effect.Effect<Out, E, R>,\n): Effect.Effect<\n  Out,\n  E | PasswordUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinatePgPasswordPreparedPersistence<\n  TargetId,\n  D extends Database,\n  S extends AnyPgTable,\n  I extends AnyPgTable,\n  C extends AnyPgTable,\n  AC extends AnyPgTable,\n  M extends AnyPgTable,\n  T extends AnyPgTable,\n  B extends AnyPgTable,\n  NativeId,\n  PS extends AnyPgTable,\n  PC extends AnyPgTable,\n  PM extends AnyPgTable,\n  PSub extends AnyPgTable,\n  PI extends AnyPgTable,\n  PCr extends AnyPgTable,\n  PNativeId,\n  Out,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, M, T, B, NativeId>;\n    readonly proofMapping?:\n      | PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId>\n      | undefined;\n    readonly target: SuppliedService<TargetId, PasswordPreparedPersistence>;\n    readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<Out, E, R>,\n): Effect.Effect<\n  Out,\n  E | PasswordUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId | TxId> | LifecycleHooks | DatabaseRequirements\n>;\n\nexport function coordinatePgPasswordPreparedPersistence<\n  TargetId,\n  D extends Database,\n  S extends AnyPgTable,\n  I extends AnyPgTable,\n  C extends AnyPgTable,\n  AC extends AnyPgTable,\n  M extends AnyPgTable,\n  T extends AnyPgTable,\n  B extends AnyPgTable,\n  NativeId,\n  PS extends AnyPgTable,\n  PC extends AnyPgTable,\n  PM extends AnyPgTable,\n  PSub extends AnyPgTable,\n  PI extends AnyPgTable,\n  PCr extends AnyPgTable,\n  PNativeId,\n  Out,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: PasswordPreparedPersistenceMapping<S, I, C, AC, M, T, B, NativeId>;\n    readonly proofMapping?:\n      | PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId>\n      | undefined;\n    readonly target: SuppliedService<TargetId, PasswordPreparedPersistence>;\n    readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<Out, E, R>,\n): Effect.Effect<\n  Out,\n  E | PasswordUnavailable | HookConfigurationError | SqlError | DatabaseError,\n  Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements\n> {\n  return Effect.flatMap(nativeDatabase(acquire), (database) =>\n    coordinateTargetPasswordPreparedPersistence<TransactionOf<D>, Out, E, Exclude<R, TargetId>>(\n      database,\n      options.mapping,\n      configuration(transactionService(database)),\n      options.proofMapping,\n      (\n        transaction: TransactionOf<D>,\n        services: { readonly passwordPreparedPersistence: PasswordPreparedPersistence },\n      ) => {\n        const provided = Context.make(options.target, services.passwordPreparedPersistence);\n        const work = Effect.provideContext(body, provided);\n\n        return options.transaction === undefined\n          ? work\n          : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n      },\n    ).pipe(Effect.provideService(NativeDatabase, database)),\n  );\n}\n"],"mappings":";;;;;;;;;AA2BA,MAAa,6CAiBX,SACA,iBAEA,OAAO,QACL,OAAO,IAAI,0BAA0BA,QAAe,GAAG,aAAa,IACnE,kBACC,8CAA8C,SAAS,eAAe,YAAY,CACtF,CAAC,CAAC,KACA,OAAO,qBAAqB,oBAAoB,eAAeA,QAAe,CAAC,GAC/E,OAAO,qBAAqB,gBAAgB,eAAeA,QAAe,CAAC,CAC7E;AAoFF,SAAgB,wCA0Bd,SACA,SAQA,MAKA;CACA,OAAO,OAAO,QAAQ,eAAe,OAAO,IAAI,aAC9C,4CACE,UACA,QAAQ,SACR,cAAc,mBAAmB,QAAQ,CAAC,GAC1C,QAAQ,eAEN,aACA,aACG;EACH,MAAM,WAAW,QAAQ,KAAK,QAAQ,QAAQ,SAAS,2BAA2B;EAClF,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;CAC1F,CACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,QAAQ,CAAC,CACxD;AACF"}

package/dist/drizzle/pg-passwords.d.mts

@@ -17,27 +17,18 @@ import { SqlError } from "effect/sql/SqlError";
 //#region src/drizzle/pg-passwords.d.ts
 type Database = EffectPgDatabase$1<AnyRelations> | EffectPgDatabase<AnyRelations>;
 type TransactionOf<D extends Database> = Parameters<Parameters<D["transaction"]>[0]>[0];
-type PasswordMapping<S extends AnyPgTable, I extends AnyPgTable, C extends AnyPgTable, AC extends AnyPgTable, A extends AnyPgTable, M extends AnyPgTable, NativeId> = PasswordPersistenceMapping<S, I, C, AC, A, M, NativeId>;
-export declare const makePgPasswordPersistenceServices: <S extends AnyPgTable, I extends AnyPgTable, C extends AnyPgTable, AC extends AnyPgTable, A extends AnyPgTable, M extends AnyPgTable, NativeId>(mapping: PasswordMapping<S, I, C, AC, A, M, NativeId>, proofMapping?: ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any>) => Effect.Effect<{
+type PasswordMapping<S extends AnyPgTable, I extends AnyPgTable, C extends AnyPgTable, AC extends AnyPgTable, M extends AnyPgTable, NativeId> = PasswordPersistenceMapping<S, I, C, AC, M, NativeId>;
+export declare const makePgPasswordPersistenceServices: <S extends AnyPgTable, I extends AnyPgTable, C extends AnyPgTable, AC extends AnyPgTable, M extends AnyPgTable, NativeId>(mapping: PasswordMapping<S, I, C, AC, M, NativeId>, proofMapping?: ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any>) => Effect.Effect<{
   passwordPersistence: {
-    readonly prepareAttempt: (input: {
+    readonly findCredential: (input: {
       readonly moduleId: string;
-      readonly action: "sign-in" | "change";
       readonly identifier: import("@yielded/auth/Identity").LoginIdentifier;
       readonly subjectId?: import("@yielded/auth/Schema").SubjectId;
-      readonly attemptLifetimeMillis: number;
-    }) => Effect.Effect<import("@yielded/auth/Password").PasswordAttemptPreparation, PasswordUnavailable>;
-    readonly settleAttempt: <A_1>(input: {
-      readonly moduleId: string;
-      readonly attemptId: import("@yielded/auth/Password").PasswordAttemptId;
-      readonly captured?: import("@yielded/auth/Password").PasswordCredentialSnapshot;
-      readonly outcome: import("@yielded/auth/Password").PasswordAttemptDecision;
-      readonly rehash?: {
-        readonly expectedVersion: import("@yielded/auth/Sessions").SecurityRevision;
-        readonly expectedVerifier: import("effect/Redacted").Redacted<import("@yielded/auth/Password").EncodedPasswordHash>;
-        readonly nextVerifier: import("effect/Redacted").Redacted<import("@yielded/auth/Password").EncodedPasswordHash>;
-      };
-    }, prepare: import("@yielded/auth/Password").PreparePasswordCommit<import("@yielded/auth/Password").PasswordAttemptDecision, A_1>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A_1>, PasswordUnavailable>;
+    }) => Effect.Effect<import("effect/Option").Option<import("@yielded/auth/Password").PasswordCredentialSnapshot>, PasswordUnavailable>;
+    readonly rehashIfCurrent: (input: {
+      readonly credential: import("@yielded/auth/Password").PasswordCredentialSnapshot;
+      readonly nextVerifier: import("effect/Redacted").Redacted<import("@yielded/auth/Password").EncodedPasswordHash>;
+    }) => Effect.Effect<void, PasswordUnavailable>;
     readonly readForSubject: (input: {
       readonly moduleId: string;
       readonly subjectId: import("@yielded/auth/Schema").SubjectId;
@@ -46,28 +37,21 @@ export declare const makePgPasswordPersistenceServices: <S extends AnyPgTable, I
       readonly moduleId: string;
       readonly identifier: import("@yielded/auth/Identity").LoginIdentifier;
     }) => Effect.Effect<import("effect/Option").Option<import("@yielded/auth/Password").PasswordCredentialSnapshot>, PasswordUnavailable>;
-    readonly addIfAbsent: <A_1>(input: import("@yielded/auth/Password").PasswordMutationInput, prepare: import("@yielded/auth/Password").PreparePasswordCommit<import("@yielded/auth/Password").PasswordMutationDecision, A_1>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A_1>, PasswordUnavailable>;
-    readonly replaceIfCurrent: <A_1>(input: import("@yielded/auth/Password").PasswordMutationInput, prepare: import("@yielded/auth/Password").PreparePasswordCommit<import("@yielded/auth/Password").PasswordMutationDecision, A_1>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A_1>, PasswordUnavailable>;
+    readonly addIfAbsent: <A>(input: import("@yielded/auth/Password").PasswordMutationInput, prepare: import("@yielded/auth/Password").PreparePasswordCommit<import("@yielded/auth/Password").PasswordMutationDecision, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, PasswordUnavailable>;
+    readonly replaceIfCurrent: <A>(input: import("@yielded/auth/Password").PasswordMutationInput, prepare: import("@yielded/auth/Password").PreparePasswordCommit<import("@yielded/auth/Password").PasswordMutationDecision, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, PasswordUnavailable>;
     readonly checkReset: (input: import("@yielded/auth/Proofs").ProofCompletionInput) => Effect.Effect<boolean, PasswordUnavailable>;
-    readonly resetWithProof: <A_1>(input: import("@yielded/auth/Password").PasswordMutationInput & {
+    readonly resetWithProof: <A>(input: import("@yielded/auth/Password").PasswordMutationInput & {
       readonly completion: import("@yielded/auth/Proofs").ProofCompletionPlan;
-    }, prepare: import("@yielded/auth/Password").PreparePasswordCommit<import("@yielded/auth/Password").PasswordMutationDecision, A_1>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A_1>, PasswordUnavailable>;
-    readonly cleanupAttempts: <A_1>(input: {
-      readonly moduleId: string;
-      readonly limit: number;
-    }, prepare: import("@yielded/auth/Password").PreparePasswordCommit<{
-      readonly removed: number;
-      readonly hasMore: boolean;
-    }, A_1>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A_1>, PasswordUnavailable>;
+    }, prepare: import("@yielded/auth/Password").PreparePasswordCommit<import("@yielded/auth/Password").PasswordMutationDecision, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, PasswordUnavailable>;
   };
 }, PasswordUnavailable, Database$1 | LifecycleHooks>;
-export declare function coordinatePgPasswordPersistence<D extends Database, S extends AnyPgTable, I extends AnyPgTable, C extends AnyPgTable, AC extends AnyPgTable, A extends AnyPgTable, M extends AnyPgTable, NativeId, PM extends ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any> | undefined, Out, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
-  readonly mapping: PasswordMapping<S, I, C, AC, A, M, NativeId>;
+export declare function coordinatePgPasswordPersistence<D extends Database, S extends AnyPgTable, I extends AnyPgTable, C extends AnyPgTable, AC extends AnyPgTable, M extends AnyPgTable, NativeId, PM extends ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any> | undefined, Out, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
+  readonly mapping: PasswordMapping<S, I, C, AC, M, NativeId>;
   readonly proofMapping?: PM;
   readonly transaction?: never;
 }, body: Effect.Effect<Out, E, R>): Effect.Effect<Out, E | PasswordUnavailable | HookConfigurationError | SqlError | DatabaseError, Exclude<R, PasswordPersistence> | LifecycleHooks | DatabaseRequirements>;
-export declare function coordinatePgPasswordPersistence<D extends Database, S extends AnyPgTable, I extends AnyPgTable, C extends AnyPgTable, AC extends AnyPgTable, A extends AnyPgTable, M extends AnyPgTable, NativeId, PM extends ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any> | undefined, Out, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
-  readonly mapping: PasswordMapping<S, I, C, AC, A, M, NativeId>;
+export declare function coordinatePgPasswordPersistence<D extends Database, S extends AnyPgTable, I extends AnyPgTable, C extends AnyPgTable, AC extends AnyPgTable, M extends AnyPgTable, NativeId, PM extends ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any> | undefined, Out, E, R, DatabaseError, DatabaseRequirements, TxId, TxShape>(acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>, options: {
+  readonly mapping: PasswordMapping<S, I, C, AC, M, NativeId>;
   readonly proofMapping?: PM;
   readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;
 }, body: Effect.Effect<Out, E, R>): Effect.Effect<Out, E | PasswordUnavailable | HookConfigurationError | SqlError | DatabaseError, Exclude<R, PasswordPersistence | TxId> | LifecycleHooks | DatabaseRequirements>;