@yielded/auth-persistence-drizzle 0.1.0-beta.24 → 0.1.0-beta.25

package/dist/drizzle/d1-passwords.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"d1-passwords.mjs","names":["PersistenceMappingError","sameSnapshot","DatabaseService"],"sources":["../../src/drizzle/d1-passwords.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- D1 plans bridge consumer-owned Drizzle rows and SQL statements. */\nimport type { D1Client } from \"@effect/sql-d1/D1Client\";\nimport {\n  NativeDatabase,\n  requireStandalone,\n  samePasswordCredentialSnapshot as sameSnapshot,\n} from \"@yielded/auth-persistence/Adapter\";\nimport {\n  coordinateCommit,\n  CurrentCommitJournal,\n  hasCommitScope,\n  type CommitJournal,\n  type PreparedCommit,\n  LifecycleHooks,\n  HookConfigurationError,\n} from \"@yielded/auth/Hooks\";\nimport type { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport {\n  EncodedPasswordHash,\n  PasswordUnavailable,\n  PasswordPersistence,\n  type PasswordMutationInput,\n  type PreparePasswordCommit,\n  snapshotPasswordCredential,\n  snapshotPasswordRequirement,\n  snapshotPasswordRevision,\n  type PasswordAction,\n  type PasswordMutationDecision,\n} from \"@yielded/auth/Password\";\nimport { reportPersistenceFailure } from \"@yielded/auth/Persistence\";\nimport {\n  type ProofCompletionPlan,\n  type ProofCompletionDecision,\n  type ProofCompletionInput,\n  ProofUnavailable,\n} from \"@yielded/auth/Proofs\";\nimport {\n  snapshotAuthenticationEvidence,\n  AuthenticationEvidence,\n  AuthenticationRequirement,\n  type SecurityRevision,\n} from \"@yielded/auth/Sessions\";\nimport {\n  and,\n  eq,\n  getTableColumns,\n  inArray,\n  sql,\n  type AnyRelations,\n  type SQL,\n  type Table,\n} from \"drizzle-orm\";\nimport type { EffectSQLiteD1Database } from \"drizzle-orm/effect-d1\";\nimport type { AnySQLiteTable } from \"drizzle-orm/sqlite-core\";\nimport { Cause, DateTime, Effect, Option, Predicate, Redacted, Schema, Context } from \"effect\";\nimport type { Statement } from \"effect/sql/Statement\";\n\nimport { Database as DatabaseService } from \"./d1-database\";\nimport { balancedD1And } from \"./d1-generated-statement\";\nimport { CurrentD1PlanningDatabase, makeD1Owner } from \"./d1-planning\";\nimport { compileD1ProofCompletionPlan, type D1ProtectedProofMutation } from \"./d1-proofs\";\nimport { D1BatchStatements } from \"./D1BatchStatements\";\nimport { column, isMappedConstraintConflict, PersistenceMappingError, updateValues } from \"./model\";\nimport { nativeDatabase } from \"./native-database\";\nimport {\n  type AnyPasswordRegistrationMapping,\n  type D1PasswordPersistenceMapping,\n  type PasswordRegistrationMapping,\n  requiredPasswordConstraints,\n  requiredPasswordRegistrationConstraints,\n} from \"./password-model\";\nimport type { PasswordRegistrationAuthority } from \"./password-registration\";\nimport type { D1ProofPersistenceMapping } from \"./proof-model\";\nimport { validateDrizzleStorage } from \"./storage-validation\";\nimport type { SuppliedService } from \"./SuppliedService\";\n\ntype PlanPrepare<Method extends (...args: any[]) => any, A> = (\n  value: Parameters<Parameters<Method>[1]>[0],\n  journal: CommitJournal,\n) => PreparedCommit<A>;\n\ntype Database = EffectSQLiteD1Database<AnyRelations> & { readonly $client: D1Client };\ntype Mapping = D1PasswordPersistenceMapping<Table, Table, Table, Table, Table, unknown>;\ntype RegistrationMapping<Registration> = AnyPasswordRegistrationMapping<Registration>;\n\ninterface Planned<A> {\n  readonly receipt: A;\n  readonly statements: ReadonlyArray<Statement<any>>;\n  /** Final-state guards without `changes()`, repeated after coordinated statements. */\n  readonly postconditions?: ReadonlyArray<Statement<any>>;\n  readonly retryable?: (cause: unknown) => boolean;\n  readonly journalGuard?: PreparedCommit<void>;\n}\n\nconst unavailable = () => PasswordUnavailable.make({});\n\nconst everyFailureMatches = (\n  cause: Cause.Cause<unknown>,\n  classify: ((cause: unknown) => boolean) | undefined,\n): boolean =>\n  classify !== undefined &&\n  cause.reasons.length > 0 &&\n  cause.reasons.every((reason) => Cause.isFailReason(reason) && classify(Cause.fail(reason.error)));\n\nconst validConstraints = (mapping: Mapping) =>\n  Object.entries(requiredPasswordConstraints).every(\n    ([key, value]) =>\n      mapping.constraints[key as keyof typeof requiredPasswordConstraints] === value,\n  );\n\nconst validRegistrationConstraints = <Registration>(mapping: RegistrationMapping<Registration>) =>\n  Object.entries(requiredPasswordRegistrationConstraints).every(\n    ([key, value]) =>\n      mapping.constraints[key as keyof typeof requiredPasswordRegistrationConstraints] === value,\n  );\n\nconst containsFailure = (failure: unknown, predicate: (value: unknown) => boolean): boolean => {\n  const seen = new Set<unknown>();\n  const pending: Array<unknown> = [failure];\n\n  for (let inspected = 0; inspected < 32 && pending.length > 0; inspected++) {\n    const current = pending.shift();\n\n    if (current === undefined || current === null || seen.has(current)) continue;\n    seen.add(current);\n    if (predicate(current)) return true;\n    if (Cause.isCause(current)) {\n      for (const reason of current.reasons) {\n        if (Cause.isFailReason(reason)) pending.push(reason.error);\n        else if (Cause.isDieReason(reason)) pending.push(reason.defect);\n      }\n      continue;\n    }\n    if (typeof current !== \"object\") continue;\n\n    const wrapped = current as {\n      readonly cause?: unknown;\n      readonly reason?: unknown;\n      readonly message?: unknown;\n    };\n\n    if (wrapped.cause !== undefined) pending.push(wrapped.cause);\n    if (wrapped.reason !== undefined) pending.push(wrapped.reason);\n    if (wrapped.message !== undefined) pending.push(wrapped.message);\n  }\n\n  return false;\n};\n\n// Match only workerd's native SQLite diagnostic. A wrapper that merely echoes\n// the bound marker is not evidence that the guard ran and rolled back the batch.\nconst isGuardFailure = (cause: unknown, marker: string) => {\n  const path = `$[${marker.replaceAll(\"'\", \"''\")}]`;\n  const native = `bad JSON path: '${path}': SQLITE_ERROR`;\n\n  return containsFailure(cause, (value) => value === native || value === `D1_ERROR: ${native}`);\n};\n\nconst statement = Effect.fn(function* (query: {\n  readonly toSQL: () => { readonly sql: string; readonly params: unknown[] };\n}) {\n  const database = yield* CurrentD1PlanningDatabase;\n  const rendered = query.toSQL();\n\n  return database.$client.unsafe(rendered.sql, rendered.params);\n});\n\nconst assertion = Effect.fn(function* (condition: SQL, marker: string) {\n  const database = yield* CurrentD1PlanningDatabase;\n\n  return yield* statement(\n    database\n      .select({\n        ok: sql`case when ${condition} then 1 else json_extract('[]', ${`$[${marker}]`}) end`.as(\n          \"ok\",\n        ),\n      })\n      .from(sql`(select 1)`),\n  );\n});\n\nconst readEngineNowMillis = Effect.fn(\"Drizzle.readEngineNowMillis\")(function* (mapping: Mapping) {\n  const database = yield* CurrentD1PlanningDatabase;\n\n  return yield* database\n    .select({ value: mapping.d1.engineNowMillis.as(\"engine_now_millis\") })\n    .from(sql`(select 1)`)\n    .pipe(\n      Effect.flatMap((rows) => {\n        const value = Number(rows[0]?.value);\n\n        return Number.isFinite(value) ? Effect.succeed(value) : Effect.fail(unavailable());\n      }),\n    );\n});\n\nconst allocate = <A>(\n  asyncValue: Effect.Effect<A, PersistenceMappingError> | undefined,\n  syncValue: (() => A) | undefined,\n) =>\n  asyncValue !== undefined\n    ? asyncValue\n    : syncValue === undefined\n      ? Effect.fail(unavailable())\n      : Effect.try({\n          try: syncValue,\n          catch: (cause) => new PersistenceMappingError({ operation: \"mapping\", cause }),\n        });\n\nconst allocateNextSecurityRevision = (mapping: Mapping, current: SecurityRevision) =>\n  allocate(\n    mapping.subject.nextSecurityRevision?.(current) ?? mapping.allocateRevision,\n    mapping.subject.nextSecurityRevisionSync === undefined\n      ? mapping.allocateRevisionSync\n      : () => mapping.subject.nextSecurityRevisionSync!(current),\n  );\n\nconst subjectColumns = (mapping: Mapping) => ({\n  id: column(mapping.subject.table, mapping.subject.id),\n  status: column(mapping.subject.table, mapping.subject.status),\n  securityRevision: column(mapping.subject.table, mapping.subject.securityRevision),\n});\n\nconst identifierColumns = (mapping: Mapping) => ({\n  namespace: column(mapping.identifier.table, mapping.identifier.namespace),\n  value: column(mapping.identifier.table, mapping.identifier.value),\n  subjectId: column(mapping.identifier.table, mapping.identifier.subjectId),\n  verifiedAt: column(mapping.identifier.table, mapping.identifier.verifiedAt),\n  bindingRevision: column(mapping.identifier.table, mapping.identifier.bindingRevision),\n});\n\nconst credentialColumns = (mapping: Mapping) => ({\n  moduleId: column(mapping.credential.table, mapping.credential.moduleId),\n  subjectId: column(mapping.credential.table, mapping.credential.subjectId),\n  credentialId: column(mapping.credential.table, mapping.credential.credentialId),\n  credentialRevision: column(mapping.credential.table, mapping.credential.credentialRevision),\n  verifierVersion: column(mapping.credential.table, mapping.credential.verifierVersion),\n  verifier: column(mapping.credential.table, mapping.credential.verifier),\n  normalization: column(mapping.credential.table, mapping.credential.normalization),\n});\n\nconst authorityColumns = (mapping: Mapping) => ({\n  subjectId: column(mapping.authorityCredential.table, mapping.authorityCredential.subjectId),\n  credentialId: column(mapping.authorityCredential.table, mapping.authorityCredential.credentialId),\n  revision: column(mapping.authorityCredential.table, mapping.authorityCredential.revision),\n  status:\n    mapping.authorityCredential.status === undefined\n      ? undefined\n      : column(mapping.authorityCredential.table, mapping.authorityCredential.status),\n});\n\nconst commandColumns = (mapping: Mapping) => ({\n  moduleId: column(mapping.command.table, mapping.command.moduleId),\n  commandId: column(mapping.command.table, mapping.command.commandId),\n  action: column(mapping.command.table, mapping.command.action),\n  bindingDigest: column(mapping.command.table, mapping.command.bindingDigest),\n  decision: column(mapping.command.table, mapping.command.decision),\n  retentionUntil: column(mapping.command.table, mapping.command.retentionUntil),\n});\n\nconst readIdentifier = Effect.fn(\"Drizzle.readIdentifier\")(function* (\n  mapping: Mapping,\n  identifier: LoginIdentifier,\n) {\n  const database = yield* CurrentD1PlanningDatabase;\n\n  const c = identifierColumns(mapping);\n\n  return yield* database\n    .select()\n    .from(mapping.identifier.table)\n    .where(and(eq(c.namespace, identifier.namespace), eq(c.value, identifier.value)))\n    .limit(1);\n});\n\nconst readSubjectNative = Effect.fn(\"Drizzle.readSubjectNative\")(function* (\n  mapping: Mapping,\n  nativeSubjectId: unknown,\n) {\n  const database = yield* CurrentD1PlanningDatabase;\n\n  return yield* database\n    .select()\n    .from(mapping.subject.table)\n    .where(eq(subjectColumns(mapping).id, nativeSubjectId))\n    .limit(1);\n});\n\nconst readCredentialNative = Effect.fn(\"Drizzle.readCredentialNative\")(function* (\n  mapping: Mapping,\n  moduleId: string,\n  nativeSubjectId: unknown,\n) {\n  const database = yield* CurrentD1PlanningDatabase;\n\n  const c = credentialColumns(mapping);\n\n  return yield* database\n    .select()\n    .from(mapping.credential.table)\n    .where(and(eq(c.moduleId, moduleId), eq(c.subjectId, nativeSubjectId)))\n    .limit(1);\n});\n\nconst resolveCredential = Effect.fn(\"DrizzleD1Password.resolveCredential\")(function* (\n  mapping: Mapping,\n  moduleId: string,\n  identifier: LoginIdentifier,\n  requestedSubjectId?: string,\n) {\n  const identifierRow = (yield* readIdentifier(mapping, identifier))[0];\n\n  if (identifierRow === undefined || !mapping.identifier.isCurrent(identifierRow)) return undefined;\n  const nativeSubjectId = identifierRow[mapping.identifier.subjectId];\n  const subject = (yield* readSubjectNative(mapping, nativeSubjectId))[0];\n\n  if (subject === undefined || !mapping.subject.isActiveStatus(subject[mapping.subject.status]))\n    return undefined;\n  const subjectId = yield* mapping.subjectId.toSubject(nativeSubjectId);\n\n  if (requestedSubjectId !== undefined && subjectId !== requestedSubjectId) return undefined;\n  const credential = (yield* readCredentialNative(mapping, moduleId, nativeSubjectId))[0];\n\n  if (credential === undefined) return { nativeSubjectId, subject, identifier: identifierRow };\n\n  const snapshot = yield* mapping.credential\n    .decode({ moduleId, subject, identifier: identifierRow, credential })\n    .pipe(Effect.flatMap(snapshotPasswordCredential));\n\n  return { nativeSubjectId, subject, identifier: identifierRow, credential, snapshot };\n});\n\nconst evidenceProofsJson = Schema.encodeSync(\n  Schema.fromJsonString(AuthenticationEvidence.fields.proofs),\n);\n\nconst alternativesJson = Schema.encodeSync(\n  Schema.fromJsonString(AuthenticationRequirement.fields.alternatives),\n);\n\nconst assuranceCondition = (\n  mapping: Mapping,\n  evidence: PasswordMutationInput[\"authorization\"][\"evidence\"],\n  requirement: PasswordMutationInput[\"authorization\"][\"requirement\"],\n) => {\n  const proofs = evidenceProofsJson(evidence.proofs);\n  const fresh = sql`json_extract(proof.value, '$.verifiedAt') <= ${mapping.d1.engineNowMillis} and ${mapping.d1.engineNowMillis} - json_extract(proof.value, '$.verifiedAt') < ${requirement.maximumAgeMillis}`;\n\n  return sql`exists(\n    select 1 from json_each(${alternativesJson(requirement.alternatives)}) as alternative\n    where not exists(select 1 from json_each(${proofs}) as proof where json_extract(proof.value, '$.verifiedAt') > ${mapping.d1.engineNowMillis})\n    and not exists(select 1 from json_each(alternative.value, '$.factors') as factor where not exists(select 1 from json_each(${proofs}) as proof, json_each(proof.value, '$.factors') as held where ${fresh} and held.value = factor.value))\n    and (select count(distinct json_extract(proof.value, '$.credentialId')) from json_each(${proofs}) as proof where ${fresh}) >= json_extract(alternative.value, '$.minimumCredentials')\n    and exists(select 1 from json_each(${proofs}) as proof where ${fresh} and (json_extract(alternative.value, '$.userVerified') = 0 or json_extract(proof.value, '$.userVerified') = 1) and (json_extract(alternative.value, '$.phishingResistant') = 0 or json_extract(proof.value, '$.phishingResistant') = 1))\n  )`;\n};\n\nconst sameIdentifier = (left: LoginIdentifier, right: LoginIdentifier) =>\n  left.namespace === right.namespace && left.value === right.value;\n\nconst evidenceSatisfiedAt = (\n  evidence: PasswordMutationInput[\"authorization\"][\"evidence\"],\n  requirement: PasswordMutationInput[\"authorization\"][\"requirement\"],\n  now: number,\n) => {\n  if (evidence.proofs.length > 64 || evidence.revision.credentials.length > 64) return false;\n  const revisions = new Map<string, string>();\n\n  for (const revision of evidence.revision.credentials) {\n    if (revisions.has(revision.credentialId)) return false;\n    revisions.set(revision.credentialId, revision.revision);\n  }\n  if (evidence.proofs.some((proof) => !revisions.has(proof.credentialId))) return false;\n  if (evidence.proofs.some((proof) => now < DateTime.toEpochMillis(proof.verifiedAt))) return false;\n\n  const fresh = evidence.proofs.filter(\n    (proof) => now - DateTime.toEpochMillis(proof.verifiedAt) < requirement.maximumAgeMillis,\n  );\n\n  const factors = new Set(fresh.flatMap((proof) => proof.factors));\n  const credentials = new Set(fresh.map((proof) => proof.credentialId));\n\n  return requirement.alternatives.some(\n    (alternative) =>\n      alternative.factors.every((factor) => factors.has(factor)) &&\n      credentials.size >= alternative.minimumCredentials &&\n      fresh.some(\n        (proof) =>\n          (!alternative.userVerified || proof.userVerified) &&\n          (!alternative.phishingResistant || proof.phishingResistant),\n      ),\n  );\n};\n\nconst snapshotMutationInput = Effect.fn(\"DrizzleD1Password.snapshotMutationInput\")(function* (\n  input: PasswordMutationInput,\n) {\n  const expectedRevision = snapshotPasswordRevision(input.expectedRevision);\n\n  const evidence = yield* snapshotAuthenticationEvidence(input.authorization.evidence).pipe(\n    Effect.mapError(unavailable),\n  );\n\n  const requirement = yield* snapshotPasswordRequirement(input.authorization.requirement);\n\n  const credential =\n    input.credential === undefined\n      ? undefined\n      : yield* snapshotPasswordCredential(input.credential);\n\n  return Object.freeze({\n    ...input,\n    expectedRevision,\n    replacement: Object.freeze({\n      verifier: Redacted.make(Redacted.value(input.replacement.verifier)),\n      normalization: input.replacement.normalization,\n    }),\n    invalidation: Object.freeze({ ...input.invalidation }),\n    ...(credential === undefined ? {} : { credential }),\n    authorization: Object.freeze({\n      challenge: Object.freeze({\n        ...input.authorization.challenge,\n        revision: snapshotPasswordRevision(input.authorization.challenge.revision),\n      }),\n      evidence,\n      requirement,\n    }),\n  });\n});\n\nconst completionMatchesPassword = (\n  input: PasswordMutationInput & { readonly completion: ProofCompletionPlan },\n) => {\n  const completion = input.completion.input;\n  const binding = completion.binding;\n\n  if (\n    completion.moduleId !== `${input.moduleId}/reset` ||\n    completion.purpose !== \"password-reset\" ||\n    binding._tag !== \"Subject\" ||\n    input.credential === undefined ||\n    binding.revision.subjectId !== input.expectedRevision.subjectId ||\n    binding.revision.securityRevision !== input.expectedRevision.securityRevision ||\n    !sameIdentifier(binding.identifier, input.credential.identifier)\n  )\n    return false;\n\n  const expected = [...input.expectedRevision.credentials].sort((left, right) =>\n    left.credentialId.localeCompare(right.credentialId),\n  );\n\n  const actual = [...binding.revision.credentials].sort((left, right) =>\n    left.credentialId.localeCompare(right.credentialId),\n  );\n\n  return (\n    expected.length === actual.length &&\n    expected.every(\n      (item, index) =>\n        item.credentialId === actual[index]!.credentialId &&\n        item.revision === actual[index]!.revision,\n    )\n  );\n};\n\nconst probeProofCompletion = Effect.fn(\"DrizzleD1.probeProofCompletion\")(function* (\n  mapping: D1ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any>,\n  input: ProofCompletionInput,\n) {\n  const database = yield* CurrentD1PlanningDatabase;\n\n  const plan: ProofCompletionPlan = {\n    input,\n    prepare: (decision, journal, project) => journal.prepare(project(decision)),\n  };\n\n  const marker = `effect-auth-proof-guard:protected:${input.continuationId}`;\n\n  const once = coordinateCommit(\n    () =>\n      Effect.gen(function* () {\n        const compiled = yield* compileD1ProofCompletionPlan(\n          mapping,\n          plan,\n          { statements: [], appliedCondition: sql`false` },\n          () => false,\n        );\n\n        if (compiled.statements.length === 0) return false;\n        yield* database.$client.batch(compiled.statements);\n\n        return false;\n      }),\n    { mode: \"batch\" },\n  );\n\n  return yield* once.pipe(\n    Effect.as(false),\n    Effect.catchCause((cause) =>\n      isGuardFailure(cause, marker) ? Effect.succeed(true) : Effect.failCause(cause),\n    ),\n  );\n});\n\nconst identifierCurrentCondition = (\n  mapping: Mapping,\n  input: PasswordMutationInput,\n  nativeSubjectId: unknown,\n  nativeVerifiedAt: unknown,\n) => {\n  if (input.credential === undefined) return sql`true`;\n\n  const ic = identifierColumns(mapping),\n    snapshot = input.credential;\n\n  return and(\n    mapping.identifier.d1CurrentCondition({ identifier: snapshot.identifier, nativeSubjectId }),\n    sql`exists(select 1 from ${mapping.identifier.table} where ${ic.namespace} = ${sql.param(snapshot.identifier.namespace, ic.namespace)} and ${ic.value} = ${sql.param(snapshot.identifier.value, ic.value)} and ${ic.subjectId} = ${sql.param(nativeSubjectId, ic.subjectId)} and ${ic.bindingRevision} = ${sql.param(snapshot.identifierBindingRevision, ic.bindingRevision)} and ${Predicate.isNullish(nativeVerifiedAt) ? sql`${ic.verifiedAt} is null` : sql`${ic.verifiedAt} = ${sql.param(nativeVerifiedAt, ic.verifiedAt)}`})`,\n  )!;\n};\n\nconst readAuthority = Effect.fn(\"DrizzleD1Password.readAuthority\")(function* (\n  mapping: Mapping,\n  input: PasswordMutationInput,\n  action: PasswordAction,\n) {\n  const database = yield* CurrentD1PlanningDatabase;\n\n  if (\n    input.authorization.evidence.proofs.length > 64 ||\n    input.authorization.evidence.revision.credentials.length > 64\n  )\n    return undefined;\n\n  const revisionIds = new Set(\n    input.authorization.evidence.revision.credentials.map((item) => item.credentialId),\n  );\n\n  if (\n    revisionIds.size !== input.authorization.evidence.revision.credentials.length ||\n    input.authorization.evidence.proofs.some((proof) => !revisionIds.has(proof.credentialId))\n  )\n    return undefined;\n  const nativeSubjectId = yield* mapping.subjectId.toNative(input.expectedRevision.subjectId);\n  const subject = (yield* readSubjectNative(mapping, nativeSubjectId))[0];\n\n  if (\n    subject === undefined ||\n    !mapping.subject.isActiveStatus(subject[mapping.subject.status]) ||\n    subject[mapping.subject.securityRevision] !== input.expectedRevision.securityRevision ||\n    input.authorization.challenge.moduleId !== input.moduleId ||\n    input.authorization.challenge.action !== action ||\n    input.authorization.challenge.commandId !== input.commandId ||\n    input.authorization.challenge.revision.subjectId !== input.expectedRevision.subjectId ||\n    input.authorization.challenge.revision.securityRevision !==\n      input.expectedRevision.securityRevision ||\n    input.authorization.evidence.revision.subjectId !== input.expectedRevision.subjectId ||\n    input.authorization.evidence.revision.securityRevision !==\n      input.expectedRevision.securityRevision ||\n    (input.authorization.evidence.flowId as string) !== (input.commandId as string) ||\n    input.authorization.evidence.bindingDigest !== input.authorization.challenge.bindingDigest ||\n    (action === \"add-password\" &&\n      (input.credential !== undefined ||\n        input.authorization.challenge.targetCredentialId !== undefined)) ||\n    input.expectedRevision.credentials.some(\n      (expected) =>\n        !input.authorization.evidence.revision.credentials.some(\n          (actual) =>\n            actual.credentialId === expected.credentialId && actual.revision === expected.revision,\n        ),\n    )\n  )\n    return undefined;\n  let identifierCondition: SQL = sql`true`;\n\n  if (input.credential !== undefined) {\n    const identifier = (yield* readIdentifier(mapping, input.credential.identifier))[0];\n\n    if (\n      identifier === undefined ||\n      input.authorization.challenge.targetCredentialId !== input.credential.credentialId ||\n      !mapping.identifier.isCurrent(identifier) ||\n      !mapping.subjectId.equals(identifier[mapping.identifier.subjectId], nativeSubjectId) ||\n      identifier[mapping.identifier.bindingRevision] !== input.credential.identifierBindingRevision\n    )\n      return undefined;\n    const credential = (yield* readCredentialNative(mapping, input.moduleId, nativeSubjectId))[0];\n\n    if (credential === undefined) return undefined;\n\n    const snapshot = yield* mapping.credential.decode({\n      moduleId: input.moduleId,\n      subject,\n      identifier,\n      credential,\n    });\n\n    if (!sameSnapshot(snapshot, input.credential)) return undefined;\n    identifierCondition = identifierCurrentCondition(\n      mapping,\n      input,\n      nativeSubjectId,\n      identifier[mapping.identifier.verifiedAt],\n    );\n    const ic = identifierColumns(mapping);\n\n    identifierCondition = and(\n      identifierCondition,\n      sql`exists(select 1 from ${mapping.identifier.table} where ${ic.namespace} = ${sql.param(input.credential.identifier.namespace, ic.namespace)} and ${ic.value} = ${sql.param(input.credential.identifier.value, ic.value)} and ${ic.subjectId} = ${sql.param(nativeSubjectId, ic.subjectId)} and ${ic.bindingRevision} = ${sql.param(input.credential.identifierBindingRevision, ic.bindingRevision)})`,\n    )!;\n  }\n\n  const expected = [\n    ...new Map(\n      [\n        ...input.expectedRevision.credentials,\n        ...input.authorization.evidence.revision.credentials,\n      ].map((item) => [item.credentialId, item]),\n    ).values(),\n  ].sort((left, right) => left.credentialId.localeCompare(right.credentialId));\n\n  const ac = authorityColumns(mapping);\n\n  const rows =\n    expected.length === 0\n      ? []\n      : yield* database\n          .select()\n          .from(mapping.authorityCredential.table)\n          .where(\n            and(\n              eq(ac.subjectId, nativeSubjectId),\n              inArray(\n                ac.credentialId,\n                expected.map((item) => item.credentialId),\n              ),\n            ),\n          );\n\n  const sortedRows = [...rows].sort((left: any, right: any) =>\n    String(left[mapping.authorityCredential.credentialId]).localeCompare(\n      String(right[mapping.authorityCredential.credentialId]),\n    ),\n  );\n\n  if (\n    sortedRows.length !== expected.length ||\n    sortedRows.some(\n      (row: any, index) =>\n        row[mapping.authorityCredential.credentialId] !== expected[index]!.credentialId ||\n        row[mapping.authorityCredential.revision] !== expected[index]!.revision ||\n        (mapping.authorityCredential.status !== undefined &&\n          mapping.authorityCredential.isActiveStatus?.(row[mapping.authorityCredential.status]) !==\n            true),\n    )\n  )\n    return undefined;\n  const requirement = yield* mapping.subject.decodeActionRequirement(subject, action);\n  const engineNow = yield* readEngineNowMillis(mapping);\n\n  if (\n    !evidenceSatisfiedAt(\n      input.authorization.evidence,\n      input.authorization.requirement,\n      engineNow,\n    ) ||\n    !evidenceSatisfiedAt(input.authorization.evidence, requirement, engineNow)\n  )\n    return undefined;\n  if (\n    input.invalidation.existingSessions === \"immediate\" &&\n    mapping.sessionInvalidation !== \"same-authority-immediate\"\n  )\n    return undefined;\n  const s = subjectColumns(mapping);\n\n  const credentialConditions = expected.map(\n    (item) =>\n      sql`exists(select 1 from ${mapping.authorityCredential.table} where ${ac.subjectId} = ${sql.param(nativeSubjectId, ac.subjectId)} and ${ac.credentialId} = ${sql.param(item.credentialId, ac.credentialId)} and ${ac.revision} = ${sql.param(item.revision, ac.revision)}${ac.status === undefined ? sql`` : sql` and ${ac.status} = ${sql.param(mapping.authorityCredential.d1ActiveStatusValue, ac.status)}`})`,\n  );\n\n  return {\n    nativeSubjectId,\n    subject,\n    requirement,\n    identifierCondition,\n    condition: balancedD1And(\n      sql`exists(select 1 from ${mapping.subject.table} where ${s.id} = ${sql.param(nativeSubjectId, s.id)} and ${s.status} = ${sql.param(mapping.subject.d1ActiveStatusValue, s.status)} and ${s.securityRevision} = ${sql.param(input.expectedRevision.securityRevision, s.securityRevision)})`,\n      identifierCondition,\n      ...credentialConditions,\n      assuranceCondition(mapping, input.authorization.evidence, input.authorization.requirement),\n      assuranceCondition(mapping, input.authorization.evidence, requirement),\n    )!,\n  };\n});\n\nconst commandAbsentCondition = (mapping: Mapping, moduleId: string, commandId: string) => {\n  const c = commandColumns(mapping);\n\n  return sql`not exists(select 1 from ${mapping.command.table} where ${c.moduleId} = ${sql.param(moduleId, c.moduleId)} and ${c.commandId} = ${sql.param(commandId, c.commandId)})`;\n};\n\nconst credentialCurrentCondition = (\n  mapping: Mapping,\n  input: PasswordMutationInput,\n  nativeSubjectId: unknown,\n) => {\n  const c = credentialColumns(mapping);\n\n  return input.credential === undefined\n    ? sql`false`\n    : sql`exists(select 1 from ${mapping.credential.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(nativeSubjectId, c.subjectId)} and ${c.credentialId} = ${sql.param(input.credential.credentialId, c.credentialId)} and ${c.credentialRevision} = ${sql.param(input.credential.credentialRevision, c.credentialRevision)} and ${c.verifierVersion} = ${sql.param(input.credential.verifierVersion, c.verifierVersion)} and ${c.verifier} = ${sql.param(Redacted.value(input.credential.verifier), c.verifier)} and ${c.normalization} = ${sql.param(input.credential.normalization, c.normalization)})`;\n};\n\nconst mutationStatements = Effect.fn(function* (\n  mapping: Mapping,\n  input: PasswordMutationInput,\n  nativeSubjectId: unknown,\n  revisions: {\n    readonly credentialRevision: SecurityRevision;\n    readonly verifierVersion: SecurityRevision;\n    readonly nextSecurityRevision: SecurityRevision;\n  },\n  now: number,\n) {\n  const database = yield* CurrentD1PlanningDatabase;\n  const c = credentialColumns(mapping);\n  const s = subjectColumns(mapping);\n  const ac = authorityColumns(mapping);\n\n  return [\n    yield* statement(\n      database\n        .update(mapping.credential.table)\n        .set(\n          mapping.credential.encodeReplacement({\n            replacement: input.replacement,\n            credentialRevision: revisions.credentialRevision,\n            verifierVersion: revisions.verifierVersion,\n          }),\n        )\n        .where(\n          and(\n            eq(c.moduleId, input.moduleId),\n            eq(c.subjectId, nativeSubjectId),\n            eq(c.credentialId, input.credential!.credentialId),\n            eq(c.credentialRevision, input.credential!.credentialRevision),\n            eq(c.verifierVersion, input.credential!.verifierVersion),\n            eq(c.verifier, Redacted.value(input.credential!.verifier)),\n            eq(c.normalization, input.credential!.normalization),\n          ),\n        ),\n    ),\n    yield* statement(\n      database\n        .update(mapping.subject.table)\n        .set(updateValues([[mapping.subject.securityRevision, revisions.nextSecurityRevision]]))\n        .where(\n          and(\n            eq(s.id, nativeSubjectId),\n            eq(s.securityRevision, input.expectedRevision.securityRevision),\n          ),\n        ),\n    ),\n    yield* statement(\n      database\n        .update(mapping.authorityCredential.table)\n        .set(mapping.authorityCredential.encodeRevision(revisions.credentialRevision))\n        .where(\n          and(\n            eq(ac.subjectId, nativeSubjectId),\n            eq(ac.credentialId, input.credential!.credentialId),\n            eq(ac.revision, input.credential!.credentialRevision),\n          ),\n        ),\n    ),\n    yield* statement(\n      database.insert(mapping.command.table).values(\n        mapping.command.encodeInsert({\n          moduleId: input.moduleId,\n          commandId: input.commandId,\n          action: input.authorization.challenge.action,\n          bindingDigest: input.authorization.challenge.bindingDigest,\n          decision: \"changed\",\n          retentionUntilMillis: now + mapping.commandRetentionMillis,\n        }),\n      ),\n    ),\n  ];\n});\n\nconst replacementApplied = (\n  mapping: Mapping,\n  input: PasswordMutationInput,\n  nativeSubjectId: unknown,\n  revisions: {\n    readonly credentialRevision: SecurityRevision;\n    readonly verifierVersion: SecurityRevision;\n    readonly nextSecurityRevision: SecurityRevision;\n  },\n  now: number,\n  identifierCondition: SQL,\n) => {\n  const c = credentialColumns(mapping);\n  const s = subjectColumns(mapping);\n  const ac = authorityColumns(mapping);\n  const mc = commandColumns(mapping);\n\n  return and(\n    sql`exists(select 1 from ${mapping.credential.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(nativeSubjectId, c.subjectId)} and ${c.credentialId} = ${sql.param(input.credential!.credentialId, c.credentialId)} and ${c.credentialRevision} = ${sql.param(revisions.credentialRevision, c.credentialRevision)} and ${c.verifierVersion} = ${sql.param(revisions.verifierVersion, c.verifierVersion)} and ${c.verifier} = ${sql.param(Redacted.value(input.replacement.verifier), c.verifier)} and ${c.normalization} = ${sql.param(input.replacement.normalization, c.normalization)})`,\n    sql`exists(select 1 from ${mapping.subject.table} where ${s.id} = ${sql.param(nativeSubjectId, s.id)} and ${s.securityRevision} = ${sql.param(revisions.nextSecurityRevision, s.securityRevision)} and ${s.status} = ${sql.param(mapping.subject.d1ActiveStatusValue, s.status)})`,\n    sql`exists(select 1 from ${mapping.authorityCredential.table} where ${ac.subjectId} = ${sql.param(nativeSubjectId, ac.subjectId)} and ${ac.credentialId} = ${sql.param(input.credential!.credentialId, ac.credentialId)} and ${ac.revision} = ${sql.param(revisions.credentialRevision, ac.revision)}${ac.status === undefined ? sql`` : sql` and ${ac.status} = ${sql.param(mapping.authorityCredential.d1ActiveStatusValue, ac.status)}`})`,\n    sql`exists(select 1 from ${mapping.command.table} where ${mc.moduleId} = ${sql.param(input.moduleId, mc.moduleId)} and ${mc.commandId} = ${sql.param(input.commandId, mc.commandId)} and ${mc.bindingDigest} = ${sql.param(input.authorization.challenge.bindingDigest, mc.bindingDigest)} and ${mc.action} = ${sql.param(input.authorization.challenge.action, mc.action)} and ${mc.decision} = ${sql.param(\"changed\", mc.decision)} and ${mc.retentionUntil} = ${sql.param(mapping.encodeInstant(now + mapping.commandRetentionMillis), mc.retentionUntil)})`,\n    identifierCondition,\n    sql`true`,\n  )!;\n};\n\nconst compileAddMutation = Effect.fn(\"DrizzleD1Password.compileAddMutation\")(function* (\n  mapping: Mapping,\n  input: PasswordMutationInput,\n  revisions: {\n    readonly credentialId: string;\n    readonly credentialRevision: SecurityRevision;\n    readonly verifierVersion: SecurityRevision;\n    readonly nextSecurityRevision: SecurityRevision;\n  },\n) {\n  const database = yield* CurrentD1PlanningDatabase;\n\n  const { credentialId, credentialRevision, verifierVersion, nextSecurityRevision } = revisions;\n\n  const authority = yield* readAuthority(mapping, input, \"add-password\");\n\n  if (authority === undefined) return undefined;\n  const now = yield* readEngineNowMillis(mapping);\n  const c = credentialColumns(mapping);\n  const s = subjectColumns(mapping);\n  const ac = authorityColumns(mapping);\n  const mc = commandColumns(mapping);\n  const marker = `effect-auth-password-guard:add:${input.commandId}`;\n  const absent = sql`not exists(select 1 from ${mapping.credential.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(authority.nativeSubjectId, c.subjectId)})`;\n\n  const guard = and(\n    authority.condition,\n    absent,\n    commandAbsentCondition(mapping, input.moduleId, input.commandId),\n  )!;\n\n  const appliedCondition = and(\n    sql`exists(select 1 from ${mapping.credential.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(authority.nativeSubjectId, c.subjectId)} and ${c.credentialId} = ${sql.param(credentialId, c.credentialId)} and ${c.credentialRevision} = ${sql.param(credentialRevision, c.credentialRevision)} and ${c.verifierVersion} = ${sql.param(verifierVersion, c.verifierVersion)} and ${c.verifier} = ${sql.param(Redacted.value(input.replacement.verifier), c.verifier)} and ${c.normalization} = ${sql.param(input.replacement.normalization, c.normalization)})`,\n    sql`exists(select 1 from ${mapping.authorityCredential.table} where ${ac.subjectId} = ${sql.param(authority.nativeSubjectId, ac.subjectId)} and ${ac.credentialId} = ${sql.param(credentialId, ac.credentialId)} and ${ac.revision} = ${sql.param(credentialRevision, ac.revision)}${ac.status === undefined ? sql`` : sql` and ${ac.status} = ${sql.param(mapping.authorityCredential.d1ActiveStatusValue, ac.status)}`})`,\n    sql`exists(select 1 from ${mapping.subject.table} where ${s.id} = ${sql.param(authority.nativeSubjectId, s.id)} and ${s.securityRevision} = ${sql.param(nextSecurityRevision, s.securityRevision)} and ${s.status} = ${sql.param(mapping.subject.d1ActiveStatusValue, s.status)})`,\n    sql`exists(select 1 from ${mapping.command.table} where ${mc.moduleId} = ${sql.param(input.moduleId, mc.moduleId)} and ${mc.commandId} = ${sql.param(input.commandId, mc.commandId)} and ${mc.bindingDigest} = ${sql.param(input.authorization.challenge.bindingDigest, mc.bindingDigest)} and ${mc.action} = ${sql.param(\"add-password\", mc.action)} and ${mc.decision} = ${sql.param(\"changed\", mc.decision)} and ${mc.retentionUntil} = ${sql.param(mapping.encodeInstant(now + mapping.commandRetentionMillis), mc.retentionUntil)})`,\n  )!;\n\n  const statements: Statement<any>[] = [\n    yield* assertion(guard, marker),\n    yield* statement(\n      database.insert(mapping.credential.table).values(\n        mapping.credential.encodeInsert({\n          moduleId: input.moduleId,\n          subjectId: authority.nativeSubjectId,\n          credentialId,\n          credentialRevision,\n          verifierVersion,\n          replacement: input.replacement,\n        }),\n      ),\n    ),\n    yield* statement(\n      database.insert(mapping.authorityCredential.table).values(\n        mapping.authorityCredential.encodeInsert({\n          subjectId: authority.nativeSubjectId,\n          credentialId,\n          revision: credentialRevision,\n        }),\n      ),\n    ),\n    yield* statement(\n      database\n        .update(mapping.subject.table)\n        .set(updateValues([[mapping.subject.securityRevision, nextSecurityRevision]]))\n        .where(\n          and(\n            eq(s.id, authority.nativeSubjectId),\n            eq(s.securityRevision, input.expectedRevision.securityRevision),\n          ),\n        ),\n    ),\n    yield* statement(\n      database.insert(mapping.command.table).values(\n        mapping.command.encodeInsert({\n          moduleId: input.moduleId,\n          commandId: input.commandId,\n          action: \"add-password\",\n          bindingDigest: input.authorization.challenge.bindingDigest,\n          decision: \"changed\",\n          retentionUntilMillis: now + mapping.commandRetentionMillis,\n        }),\n      ),\n    ),\n    yield* assertion(appliedCondition, marker),\n  ];\n\n  return {\n    statements,\n    appliedCondition,\n    marker,\n    retryable: (cause: unknown) => isGuardFailure(cause, marker),\n  };\n});\n\nconst makePasswordPlans = (\n  mapping: Mapping,\n  proofMapping?: D1ProofPersistenceMapping<\n    any,\n    any,\n    any,\n    any,\n    any,\n    any,\n    any,\n    any,\n    any,\n    any,\n    any,\n    any\n  >,\n) => {\n  const run = <A, E, R>(plan: Effect.Effect<Planned<A>, E, R>) =>\n    Effect.gen(function* () {\n      if (!validConstraints(mapping)) return yield* unavailable();\n\n      return yield* plan;\n    });\n\n  return {\n    findCredential: (uncaptured: Parameters<PasswordPersistence[\"Service\"][\"findCredential\"]>[0]) =>\n      Effect.gen(function* () {\n        if (!validConstraints(mapping)) return yield* unavailable();\n        const input = { ...uncaptured, identifier: { ...uncaptured.identifier } };\n        const database = yield* CurrentD1PlanningDatabase;\n        const identifierRow = (yield* readIdentifier(mapping, input.identifier))[0];\n\n        if (identifierRow === undefined || !mapping.identifier.isCurrent(identifierRow))\n          return Option.none();\n        const nativeId = identifierRow[mapping.identifier.subjectId];\n\n        const sc = subjectColumns(mapping),\n          ic = identifierColumns(mapping),\n          cc = credentialColumns(mapping);\n\n        // Bind the same native ID through each column's codec, then inspect one coherent snapshot.\n        const rows = yield* database\n          .select({\n            subject: getTableColumns(mapping.subject.table),\n            identifier: getTableColumns(mapping.identifier.table),\n            credential: getTableColumns(mapping.credential.table),\n          })\n          .from(mapping.subject.table)\n          .innerJoin(\n            mapping.identifier.table,\n            and(\n              eq(ic.namespace, input.identifier.namespace),\n              eq(ic.value, input.identifier.value),\n              eq(ic.subjectId, nativeId),\n            ),\n          )\n          .innerJoin(\n            mapping.credential.table,\n            and(eq(cc.moduleId, input.moduleId), eq(cc.subjectId, nativeId)),\n          )\n          .where(eq(sc.id, nativeId));\n\n        if (rows.length !== 1) return Option.none();\n        const row = rows[0]!;\n\n        if (\n          !mapping.subject.isActiveStatus(row.subject[mapping.subject.status]) ||\n          !mapping.identifier.isCurrent(row.identifier) ||\n          !mapping.subjectId.equals(nativeId, row.subject[mapping.subject.id]) ||\n          !mapping.subjectId.equals(nativeId, row.identifier[mapping.identifier.subjectId]) ||\n          !mapping.subjectId.equals(nativeId, row.credential[mapping.credential.subjectId])\n        )\n          return Option.none();\n\n        const credential = yield* mapping.credential\n          .decode({ moduleId: input.moduleId, ...row })\n          .pipe(Effect.flatMap(snapshotPasswordCredential));\n\n        return input.subjectId !== undefined && credential.revision.subjectId !== input.subjectId\n          ? Option.none()\n          : Option.some(credential);\n      }),\n    rehashIfCurrent: (input: Parameters<PasswordPersistence[\"Service\"][\"rehashIfCurrent\"]>[0]) =>\n      run(\n        Effect.gen(function* () {\n          const nextVerifier = Redacted.make(\n            yield* Schema.decodeEffect(EncodedPasswordHash)(Redacted.value(input.nextVerifier)),\n          );\n\n          const credential = yield* snapshotPasswordCredential(input.credential);\n          const database = yield* CurrentD1PlanningDatabase;\n          const nativeId = yield* mapping.subjectId.toNative(credential.revision.subjectId);\n          const version = yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync);\n\n          if (version === credential.verifierVersion) return yield* unavailable();\n          const encoded = mapping.credential.encodeVerifier(nextVerifier, version);\n\n          const values = {\n            [mapping.credential.verifier]: encoded[mapping.credential.verifier],\n            [mapping.credential.verifierVersion]: encoded[mapping.credential.verifierVersion],\n          };\n\n          if (Object.values(values).some((value) => value === undefined))\n            return yield* unavailable();\n          const c = credentialColumns(mapping);\n\n          return {\n            receipt: undefined,\n            statements: [\n              yield* statement(\n                database\n                  .update(mapping.credential.table)\n                  .set(values)\n                  .where(\n                    and(\n                      eq(c.moduleId, credential.moduleId),\n                      eq(c.subjectId, nativeId),\n                      eq(c.credentialId, credential.credentialId),\n                      ...(\n                        [\n                          [c.moduleId, credential.moduleId],\n                          [c.subjectId, nativeId],\n                          [c.credentialId, credential.credentialId],\n                          [c.credentialRevision, credential.credentialRevision],\n                          [c.verifierVersion, credential.verifierVersion],\n                          [c.verifier, Redacted.value(credential.verifier)],\n                          [c.normalization, credential.normalization],\n                        ] as const\n                      ).map(([column, value]) =>\n                        typeof value === \"string\"\n                          ? sql`cast(${column} as blob) = cast(${sql.param(value, column)} as blob)`\n                          : eq(column, value),\n                      ),\n                    ),\n                  ),\n              ),\n            ],\n          };\n        }),\n      ),\n    readForSubject: (input: Parameters<PasswordPersistence[\"Service\"][\"readForSubject\"]>[0]) =>\n      Effect.gen(function* () {\n        const database = yield* CurrentD1PlanningDatabase;\n\n        if (yield* hasCommitScope) return yield* unavailable();\n        const nativeSubjectId = yield* mapping.subjectId.toNative(input.subjectId);\n        const subject = (yield* readSubjectNative(mapping, nativeSubjectId))[0];\n\n        if (\n          subject === undefined ||\n          !mapping.subject.isActiveStatus(subject[mapping.subject.status])\n        )\n          return Option.none();\n\n        const credential = (yield* readCredentialNative(\n          mapping,\n          input.moduleId,\n          nativeSubjectId,\n        ))[0];\n\n        if (credential === undefined) return Option.none();\n        const ic = identifierColumns(mapping);\n\n        const identifiers = yield* database\n          .select()\n          .from(mapping.identifier.table)\n          .where(eq(ic.subjectId, nativeSubjectId));\n\n        const identifier = identifiers.find((row: any) => mapping.identifier.isCurrent(row));\n\n        if (identifier === undefined) return Option.none();\n\n        return Option.some(\n          yield* mapping.credential\n            .decode({ moduleId: input.moduleId, subject, identifier, credential })\n            .pipe(Effect.flatMap(snapshotPasswordCredential)),\n        );\n      }),\n    recoveryTarget: (input: Parameters<PasswordPersistence[\"Service\"][\"recoveryTarget\"]>[0]) =>\n      Effect.gen(function* () {\n        if (yield* hasCommitScope) return yield* unavailable();\n        const resolved = yield* resolveCredential(mapping, input.moduleId, input.identifier);\n\n        return resolved?.snapshot === undefined ||\n          resolved.snapshot.identifierVerifiedAtMillis === undefined\n          ? Option.none()\n          : Option.some(resolved.snapshot);\n      }),\n    addIfAbsent: <A>(\n      uncaptured: Parameters<PasswordPersistence[\"Service\"][\"addIfAbsent\"]>[0],\n      prepare: PlanPrepare<PasswordPersistence[\"Service\"][\"addIfAbsent\"], A>,\n    ) =>\n      Effect.gen(function* () {\n        const input = yield* snapshotMutationInput(uncaptured);\n\n        const credentialId = yield* allocate(\n          mapping.allocateCredentialId,\n          mapping.allocateCredentialIdSync,\n        );\n\n        const credentialRevision = yield* allocate(\n          mapping.allocateRevision,\n          mapping.allocateRevisionSync,\n        );\n\n        const verifierVersion = yield* allocate(\n          mapping.allocateRevision,\n          mapping.allocateRevisionSync,\n        );\n\n        const nextSecurityRevision = yield* allocateNextSecurityRevision(\n          mapping,\n          input.expectedRevision.securityRevision,\n        );\n\n        if (nextSecurityRevision === input.expectedRevision.securityRevision)\n          return yield* unavailable();\n\n        return yield* run(\n          Effect.gen(function* () {\n            const journal = yield* CurrentCommitJournal;\n\n            const compiled = yield* compileAddMutation(mapping, input, {\n              credentialId,\n              credentialRevision,\n              verifierVersion,\n              nextSecurityRevision,\n            });\n\n            if (compiled === undefined)\n              return { receipt: prepare(\"rejected\", journal), statements: [] };\n\n            return {\n              receipt: prepare(\"changed\", journal),\n              statements: compiled.statements,\n              postconditions: [yield* assertion(compiled.appliedCondition, compiled.marker)],\n              retryable: compiled.retryable,\n            };\n          }),\n        );\n      }),\n    replaceIfCurrent: <A>(\n      uncaptured: Parameters<PasswordPersistence[\"Service\"][\"replaceIfCurrent\"]>[0],\n      prepare: PlanPrepare<PasswordPersistence[\"Service\"][\"replaceIfCurrent\"], A>,\n    ) =>\n      Effect.flatMap(snapshotMutationInput(uncaptured), (input) =>\n        replacementPlan(mapping, proofMapping, input, prepare, \"change-password\"),\n      ),\n    checkReset: (input: Parameters<PasswordPersistence[\"Service\"][\"checkReset\"]>[0]) =>\n      proofMapping === undefined\n        ? Effect.fail(unavailable())\n        : Effect.gen(function* () {\n            if (yield* hasCommitScope) return yield* unavailable();\n            if (\n              input.moduleId.length <= \"/reset\".length ||\n              !input.moduleId.endsWith(\"/reset\") ||\n              input.purpose !== \"password-reset\" ||\n              input.binding._tag !== \"Subject\"\n            )\n              return false;\n            const binding = input.binding;\n\n            const resolved = yield* resolveCredential(\n              mapping,\n              input.moduleId.slice(0, -\"/reset\".length),\n              binding.identifier,\n              binding.revision.subjectId,\n            );\n\n            const current =\n              resolved?.snapshot !== undefined &&\n              resolved.snapshot.revision.securityRevision === binding.revision.securityRevision &&\n              binding.revision.credentials.every((item) =>\n                resolved.snapshot!.revision.credentials.some(\n                  (current) =>\n                    current.credentialId === item.credentialId &&\n                    current.revision === item.revision,\n                ),\n              );\n\n            return current ? yield* probeProofCompletion(proofMapping, input) : false;\n          }),\n    resetWithProof: <A>(\n      uncaptured: Parameters<PasswordPersistence[\"Service\"][\"resetWithProof\"]>[0],\n      prepare: PlanPrepare<PasswordPersistence[\"Service\"][\"resetWithProof\"], A>,\n    ) =>\n      proofMapping === undefined\n        ? Effect.fail(unavailable())\n        : Effect.flatMap(snapshotMutationInput(uncaptured), (captured) =>\n            replacementPlan(\n              mapping,\n              proofMapping,\n              Object.freeze({ ...captured, completion: uncaptured.completion }),\n              prepare,\n              \"reset-password\",\n            ),\n          ),\n  };\n};\n\nconst compileReplacementMutation = Effect.fn(\"DrizzleD1Password.compileReplacementMutation\")(\n  function* (\n    mapping: Mapping,\n    input: PasswordMutationInput,\n    action: \"change-password\" | \"reset-password\",\n    revisions: {\n      readonly credentialRevision: SecurityRevision;\n      readonly verifierVersion: SecurityRevision;\n      readonly nextSecurityRevision: SecurityRevision;\n    },\n  ) {\n    const { credentialRevision, verifierVersion, nextSecurityRevision } = revisions;\n    const authority = yield* readAuthority(mapping, input, action);\n\n    const current =\n      authority === undefined || input.credential === undefined\n        ? undefined\n        : (yield* readCredentialNative(mapping, input.moduleId, authority.nativeSubjectId))[0];\n\n    const currentMatches =\n      current !== undefined &&\n      current[mapping.credential.credentialId] === input.credential!.credentialId &&\n      current[mapping.credential.credentialRevision] === input.credential!.credentialRevision &&\n      current[mapping.credential.verifierVersion] === input.credential!.verifierVersion &&\n      current[mapping.credential.verifier] === Redacted.value(input.credential!.verifier) &&\n      current[mapping.credential.normalization] === input.credential!.normalization;\n\n    if (authority === undefined || !currentMatches) return undefined;\n    const now = yield* readEngineNowMillis(mapping);\n\n    const guard = and(\n      authority.condition,\n      credentialCurrentCondition(mapping, input, authority.nativeSubjectId),\n      commandAbsentCondition(mapping, input.moduleId, input.commandId),\n    )!;\n\n    const marker = `effect-auth-password-guard:${action}:${input.commandId}`;\n\n    const protectedMutation: D1ProtectedProofMutation = {\n      statements: [\n        yield* assertion(guard, marker),\n        ...(yield* mutationStatements(\n          mapping,\n          input,\n          authority.nativeSubjectId,\n          { credentialRevision, verifierVersion, nextSecurityRevision },\n          now,\n        )),\n      ],\n      appliedCondition: replacementApplied(\n        mapping,\n        input,\n        authority.nativeSubjectId,\n        {\n          credentialRevision,\n          verifierVersion,\n          nextSecurityRevision,\n        },\n        now,\n        authority.identifierCondition,\n      ),\n    };\n\n    return { protectedMutation, marker };\n  },\n);\n\nconst replacementPlan = Effect.fn(\"Drizzle.replacementPlan\")(function* <A>(\n  mapping: Mapping,\n  proofMapping:\n    | D1ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any>\n    | undefined,\n  input: PasswordMutationInput & { readonly completion?: any },\n  prepare: PreparePasswordCommit<PasswordMutationDecision, A>,\n  action: \"change-password\" | \"reset-password\",\n) {\n  const credentialRevision = yield* allocate(\n    mapping.allocateRevision,\n    mapping.allocateRevisionSync,\n  );\n\n  const verifierVersion = yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync);\n\n  const nextSecurityRevision = yield* allocateNextSecurityRevision(\n    mapping,\n    input.expectedRevision.securityRevision,\n  );\n\n  if (\n    nextSecurityRevision === input.expectedRevision.securityRevision ||\n    (input.credential !== undefined && credentialRevision === input.credential.credentialRevision)\n  )\n    return yield* unavailable();\n\n  const journal = yield* CurrentCommitJournal;\n\n  const compiledMutation = yield* compileReplacementMutation(mapping, input, action, {\n    credentialRevision,\n    verifierVersion,\n    nextSecurityRevision,\n  });\n\n  if (compiledMutation === undefined)\n    return { receipt: prepare(\"rejected\", journal), statements: [] };\n  const { protectedMutation, marker } = compiledMutation;\n\n  if (action === \"reset-password\") {\n    if (\n      proofMapping === undefined ||\n      input.completion === undefined ||\n      !completionMatchesPassword(\n        input as PasswordMutationInput & { readonly completion: ProofCompletionPlan },\n      )\n    )\n      return { receipt: prepare(\"rejected\", journal), statements: [] };\n    let passwordReceipt: PreparedCommit<A> | undefined;\n\n    const compiled = yield* compileD1ProofCompletionPlan(\n      proofMapping,\n      input.completion,\n      protectedMutation,\n      (decision: ProofCompletionDecision) => {\n        passwordReceipt = prepare(decision === \"completed\" ? \"changed\" : \"rejected\", journal);\n\n        return decision;\n      },\n    );\n\n    return {\n      receipt: passwordReceipt ?? prepare(\"rejected\", journal),\n      statements: compiled.statements,\n      ...(compiled.postconditions === undefined ? {} : { postconditions: compiled.postconditions }),\n      retryable: (cause: unknown) =>\n        isGuardFailure(cause, marker) ||\n        isGuardFailure(\n          cause,\n          `effect-auth-proof-guard:complete:${input.completion.input.continuationId}`,\n        ) ||\n        isGuardFailure(\n          cause,\n          `effect-auth-proof-guard:protected:${input.completion.input.continuationId}`,\n        ),\n    };\n  }\n\n  const applied = yield* assertion(protectedMutation.appliedCondition, marker);\n\n  return {\n    receipt: prepare(\"changed\", journal),\n    statements: [...protectedMutation.statements, applied],\n    postconditions: [applied],\n    retryable: (cause: unknown) => isGuardFailure(cause, marker),\n  };\n});\n\nexport const makeD1PasswordPersistenceServices = Effect.fnUntraced(function* <\n  S extends AnySQLiteTable,\n  I extends AnySQLiteTable,\n  C extends AnySQLiteTable,\n  AC extends AnySQLiteTable,\n  M extends AnySQLiteTable,\n  NativeId,\n>(\n  mapping: D1PasswordPersistenceMapping<S, I, C, AC, M, NativeId>,\n  proofMapping?: D1ProofPersistenceMapping<\n    any,\n    any,\n    any,\n    any,\n    any,\n    any,\n    any,\n    any,\n    any,\n    any,\n    any,\n    any\n  >,\n) {\n  const database = yield* DatabaseService;\n\n  yield* validateDrizzleStorage({ ...mapping, proof: proofMapping }).pipe(\n    Effect.provideServiceEffect(NativeDatabase, nativeDatabase(DatabaseService)),\n    Effect.mapError(unavailable),\n  );\n\n  const hooks = yield* LifecycleHooks;\n  const plans = makePasswordPlans(mapping as unknown as Mapping, proofMapping);\n\n  const standalone = Effect.gen(function* () {\n    if (yield* hasCommitScope) return yield* unavailable();\n    yield* requireStandalone(unavailable, database.$client.transactionService);\n  });\n\n  const run = <Out, Err, Env>(plan: Effect.Effect<Planned<Out>, Err, Env>) =>\n    Effect.gen(function* () {\n      yield* standalone;\n\n      return yield* executeStandalone(plan, 2);\n    }).pipe(\n      Effect.provideService(CurrentD1PlanningDatabase, database),\n      Effect.provideService(LifecycleHooks, hooks),\n    );\n\n  const service: PasswordPersistence[\"Service\"] = {\n    findCredential: (input) =>\n      standalone.pipe(\n        Effect.andThen(plans.findCredential(input)),\n        Effect.provideService(CurrentD1PlanningDatabase, database),\n        translateFailure,\n      ),\n    rehashIfCurrent: (input) => run(plans.rehashIfCurrent(input)).pipe(translateFailure),\n    readForSubject: (input) =>\n      plans\n        .readForSubject(input)\n        .pipe(\n          Effect.provideService(CurrentD1PlanningDatabase, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n    recoveryTarget: (input) =>\n      plans\n        .recoveryTarget(input)\n        .pipe(\n          Effect.provideService(CurrentD1PlanningDatabase, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n    addIfAbsent: (input, prepare) => run(plans.addIfAbsent(input, prepare)).pipe(translateFailure),\n    replaceIfCurrent: (input, prepare) =>\n      run(plans.replaceIfCurrent(input, prepare)).pipe(translateFailure),\n    checkReset: (input) =>\n      plans\n        .checkReset(input)\n        .pipe(\n          Effect.provideService(CurrentD1PlanningDatabase, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n    resetWithProof: (input, prepare) =>\n      run(plans.resetWithProof(input, prepare)).pipe(translateFailure),\n  };\n\n  return { passwordPersistence: service };\n});\n\ntype CoordinatorError<E> = E | PasswordUnavailable | HookConfigurationError;\n\n/**\n * Owns one password transition plus application statements in one D1 batch.\n * The owner Effect is invoked once and is never replayed after an ambiguous or\n * guarded batch failure. Standalone adapter-owned commands may replan boundedly.\n */\nexport function coordinateD1PasswordPersistence<\n  S extends AnySQLiteTable,\n  I extends AnySQLiteTable,\n  C extends AnySQLiteTable,\n  AC extends AnySQLiteTable,\n  M extends AnySQLiteTable,\n  NativeId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: D1PasswordPersistenceMapping<S, I, C, AC, M, NativeId>;\n    readonly proofMapping?:\n      | D1ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any>\n      | undefined;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  CoordinatorError<E> | DatabaseError,\n  Exclude<R, PasswordPersistence | D1BatchStatements> | LifecycleHooks | DatabaseRequirements\n> {\n  return Effect.flatMap(nativeDatabase(acquire), (database) =>\n    Effect.gen(function* () {\n      yield* validateDrizzleStorage({\n        ...options.mapping,\n        proof: options.proofMapping,\n      }).pipe(Effect.mapError(unavailable));\n      const hooks = yield* LifecycleHooks;\n\n      if (yield* hasCommitScope) return yield* unavailable();\n\n      const result = yield* coordinateCommit(\n        () =>\n          Effect.gen(function* () {\n            const statements: Statement<any>[] = [];\n            let mutation: Planned<any> | undefined;\n\n            const nativeCollector = D1BatchStatements.of({\n              append: (statement) => Effect.sync(() => statements.push(statement)),\n            });\n\n            const owner = yield* makeD1Owner(unavailable()).pipe(\n              Effect.provideService(D1BatchStatements, nativeCollector),\n            );\n\n            const plans = makePasswordPlans(\n              options.mapping as unknown as Mapping,\n              options.proofMapping,\n            );\n\n            const run = <Out, Err, Env>(plan: Effect.Effect<Planned<Out>, Err, Env>) =>\n              coordinateCommit(\n                () =>\n                  Effect.gen(function* () {\n                    const journal = yield* CurrentCommitJournal;\n                    const planned = yield* plan;\n\n                    yield* owner.check;\n                    if (mutation !== undefined) return yield* unavailable();\n                    const guarded = { ...planned, journalGuard: journal.prepare(undefined) };\n\n                    mutation = guarded;\n                    statements.push(...guarded.statements);\n\n                    return guarded.receipt;\n                  }),\n                { mode: \"batch\" },\n              ).pipe(\n                Effect.map((result) => result.value),\n                Effect.provideService(CurrentD1PlanningDatabase, database),\n                Effect.provideService(LifecycleHooks, hooks),\n              );\n\n            const service: PasswordPersistence[\"Service\"] = {\n              findCredential: (input) =>\n                owner.run(\n                  plans\n                    .findCredential(input)\n                    .pipe(\n                      Effect.provideService(CurrentD1PlanningDatabase, database),\n                      translateFailure,\n                    ),\n                ),\n              rehashIfCurrent: (input) =>\n                owner.run(run(plans.rehashIfCurrent(input)).pipe(translateFailure)),\n              readForSubject: (input) =>\n                owner.run(\n                  plans\n                    .readForSubject(input)\n                    .pipe(\n                      Effect.provideService(CurrentD1PlanningDatabase, database),\n                      Effect.provideService(LifecycleHooks, hooks),\n                      translateFailure,\n                    ),\n                ),\n              recoveryTarget: (input) =>\n                owner.run(\n                  plans\n                    .recoveryTarget(input)\n                    .pipe(\n                      Effect.provideService(CurrentD1PlanningDatabase, database),\n                      Effect.provideService(LifecycleHooks, hooks),\n                      translateFailure,\n                    ),\n                ),\n              addIfAbsent: (input, prepare) =>\n                owner.run(run(plans.addIfAbsent(input, prepare)).pipe(translateFailure)),\n              replaceIfCurrent: (input, prepare) =>\n                owner.run(run(plans.replaceIfCurrent(input, prepare)).pipe(translateFailure)),\n              checkReset: (input) =>\n                owner.run(\n                  plans\n                    .checkReset(input)\n                    .pipe(\n                      Effect.provideService(CurrentD1PlanningDatabase, database),\n                      Effect.provideService(LifecycleHooks, hooks),\n                      translateFailure,\n                    ),\n                ),\n              resetWithProof: (input, prepare) =>\n                owner.run(run(plans.resetWithProof(input, prepare)).pipe(translateFailure)),\n            };\n\n            const provided = Context.make(PasswordPersistence, service).pipe(\n              Context.add(D1BatchStatements, owner.collector),\n            );\n\n            const value = yield* owner.close(Effect.provideContext(body, provided));\n\n            if (mutation?.journalGuard !== undefined) {\n              const status = yield* Effect.result(mutation.journalGuard.read);\n\n              if (status._tag === \"Success\" || status.failure._tag !== \"CommitPending\")\n                return yield* unavailable();\n            }\n            // Re-assert the password's final state after application statements.\n            yield* database.$client\n              .batch([...statements, ...(mutation?.postconditions ?? [])])\n              .pipe(\n                Effect.catchCause((cause) =>\n                  Effect.failCause(\n                    Cause.map(cause, (error) =>\n                      everyFailureMatches(cause, mutation?.retryable) ? unavailable() : error,\n                    ),\n                  ),\n                ),\n                translateFailure,\n              );\n\n            return value;\n          }),\n        { mode: \"batch\" },\n      ).pipe(Effect.provideService(LifecycleHooks, hooks));\n\n      return result.value;\n    }).pipe(Effect.provideService(NativeDatabase, database)),\n  );\n}\n\nconst registrationRows = Effect.fn(\"Drizzle.registrationRows\")(function* <Registration>(\n  mapping: RegistrationMapping<Registration>,\n  moduleId: string,\n  requestId: string,\n) {\n  const database = yield* CurrentD1PlanningDatabase;\n\n  const module = column(mapping.registration.table, mapping.registration.moduleId);\n  const request = column(mapping.registration.table, mapping.registration.requestId);\n\n  return yield* database\n    .select()\n    .from(mapping.registration.table)\n    .where(and(eq(module, moduleId), eq(request, requestId)))\n    .limit(1);\n});\n\nconst registrationIdentifierRows = Effect.fn(\"Drizzle.registrationIdentifierRows\")(function* <\n  Registration,\n>(mapping: RegistrationMapping<Registration>, identifier: LoginIdentifier) {\n  const database = yield* CurrentD1PlanningDatabase;\n\n  const namespace = column(mapping.identifier.table, mapping.identifier.namespace);\n  const value = column(mapping.identifier.table, mapping.identifier.value);\n\n  return yield* database\n    .select()\n    .from(mapping.identifier.table)\n    .where(and(eq(namespace, identifier.namespace), eq(value, identifier.value)))\n    .limit(1);\n});\n\nconst planRegistration = Effect.fn(\"Drizzle.planRegistration\")(function* <Registration, A>(\n  mapping: RegistrationMapping<Registration>,\n  input: {\n    readonly moduleId: string;\n    readonly requestId: string;\n    readonly identifier: LoginIdentifier;\n    readonly registration: Registration;\n    readonly replacement: PasswordMutationInput[\"replacement\"];\n  },\n  allocated: {\n    readonly credentialId: string;\n    readonly securityRevision: SecurityRevision;\n    readonly identifierRevision: SecurityRevision;\n    readonly credentialRevision: SecurityRevision;\n    readonly verifierVersion: SecurityRevision;\n    readonly nativeSubjectId?: unknown;\n    readonly recoveryReference?: any;\n  },\n  prepare: PreparePasswordCommit<import(\"@yielded/auth/Password\").PasswordRegistrationDecision, A>,\n) {\n  const database = yield* CurrentD1PlanningDatabase;\n  const journal = yield* CurrentCommitJournal;\n\n  const existing = (yield* registrationRows(mapping, input.moduleId, input.requestId))[0];\n\n  if (existing !== undefined)\n    return {\n      receipt: prepare(yield* mapping.registration.decodeReplay(existing), journal),\n      statements: [],\n    };\n\n  const intent = {\n    moduleId: input.moduleId,\n    requestId: input.requestId,\n    identifier: input.identifier,\n    registration: input.registration,\n    replacement: input.replacement,\n  };\n\n  if (mapping.mode === \"pending\") {\n    if (allocated.recoveryReference === undefined) return yield* unavailable();\n\n    return {\n      receipt: prepare({ _tag: \"Pending\", reference: allocated.recoveryReference }, journal),\n      statements: [\n        yield* statement(\n          database.insert(mapping.registration.table).values(\n            mapping.registration.encodeInsert(intent, {\n              state: \"pending\",\n              recoveryReference: allocated.recoveryReference,\n            }),\n          ),\n        ),\n      ],\n      retryable: (cause: unknown) => isMappedConstraintConflict(mapping.isRequestConflict, cause),\n    };\n  }\n  if (mapping.provisioning.idMode === \"generated\" || allocated.nativeSubjectId === undefined)\n    return yield* unavailable();\n  if ((yield* registrationIdentifierRows(mapping, input.identifier)).length > 0)\n    return { receipt: prepare({ _tag: \"Suppressed\" }, journal), statements: [] };\n  const nativeSubjectId = allocated.nativeSubjectId;\n  const subjectId = yield* mapping.subjectId.toSubject(nativeSubjectId);\n\n  return {\n    receipt: prepare({ _tag: \"Created\", subjectId }, journal),\n    statements: [\n      yield* statement(\n        database.insert(mapping.subject.table).values(\n          mapping.provisioning.encodeSubjectInsert(intent, {\n            nativeSubjectId,\n            securityRevision: allocated.securityRevision,\n          }),\n        ),\n      ),\n      yield* statement(\n        database\n          .insert(mapping.identifier.table)\n          .values(\n            mapping.identifier.encodeInitialInsert(\n              input.identifier,\n              nativeSubjectId,\n              allocated.identifierRevision,\n            ),\n          ),\n      ),\n      yield* statement(\n        database.insert(mapping.credential.table).values(\n          mapping.credential.encodeInsert({\n            moduleId: input.moduleId,\n            subjectId: nativeSubjectId,\n            credentialId: allocated.credentialId,\n            credentialRevision: allocated.credentialRevision,\n            verifierVersion: allocated.verifierVersion,\n            replacement: input.replacement,\n          }),\n        ),\n      ),\n      yield* statement(\n        database.insert(mapping.authorityCredential.table).values(\n          mapping.authorityCredential.encodeInsert({\n            subjectId: nativeSubjectId,\n            credentialId: allocated.credentialId,\n            revision: allocated.credentialRevision,\n          }),\n        ),\n      ),\n      yield* statement(\n        database.insert(mapping.registration.table).values(\n          mapping.registration.encodeInsert(intent, {\n            state: \"created\",\n            nativeSubjectId,\n          }),\n        ),\n      ),\n    ],\n    retryable: (cause: unknown) =>\n      isMappedConstraintConflict(mapping.isRequestConflict, cause) ||\n      isMappedConstraintConflict(mapping.isIdentifierConflict, cause),\n  };\n});\n\nconst allocateRegistration = <Registration>(mapping: RegistrationMapping<Registration>) =>\n  Effect.gen(function* () {\n    const credentialId = yield* allocate(\n      mapping.allocateCredentialId,\n      mapping.allocateCredentialIdSync,\n    );\n\n    const securityRevision = yield* allocate(\n      mapping.allocateRevision,\n      mapping.allocateRevisionSync,\n    );\n\n    const identifierRevision = yield* allocate(\n      mapping.allocateRevision,\n      mapping.allocateRevisionSync,\n    );\n\n    const credentialRevision = yield* allocate(\n      mapping.allocateRevision,\n      mapping.allocateRevisionSync,\n    );\n\n    const verifierVersion = yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync);\n\n    const nativeSubjectId =\n      mapping.mode !== \"atomic\" || mapping.provisioning.idMode === \"generated\"\n        ? undefined\n        : yield* allocate(\n            mapping.provisioning.allocateSubjectId,\n            mapping.provisioning.allocateSubjectIdSync,\n          );\n\n    const recoveryReference =\n      mapping.mode === \"pending\"\n        ? yield* allocate(mapping.allocateRecoveryReference, mapping.allocateRecoveryReferenceSync)\n        : undefined;\n\n    return {\n      credentialId,\n      securityRevision,\n      identifierRevision,\n      credentialRevision,\n      verifierVersion,\n      ...(nativeSubjectId === undefined ? {} : { nativeSubjectId }),\n      ...(recoveryReference === undefined ? {} : { recoveryReference }),\n    };\n  });\n\nconst makeRegistrationPlans = <Registration>(mapping: RegistrationMapping<Registration>) => ({\n  register: <A>(\n    input: Parameters<PasswordRegistrationAuthority<Registration>[\"register\"]>[0],\n    prepare: PlanPrepare<PasswordRegistrationAuthority<Registration>[\"register\"], A>,\n  ) =>\n    Effect.gen(function* () {\n      if (!validRegistrationConstraints(mapping)) return yield* unavailable();\n      if (mapping.mode === \"atomic\" && mapping.provisioning.idMode === \"generated\")\n        return yield* unavailable();\n      const allocated = yield* allocateRegistration(mapping);\n\n      return yield* planRegistration(mapping, input, allocated, prepare);\n    }),\n});\n\nexport const makeD1PasswordRegistrationServices = Effect.fnUntraced(function* <\n  Registration,\n  S extends AnySQLiteTable,\n  I extends AnySQLiteTable,\n  C extends AnySQLiteTable,\n  AC extends AnySQLiteTable,\n  Rq extends AnySQLiteTable,\n  NativeId,\n>(mapping: PasswordRegistrationMapping<Registration, S, I, C, AC, Rq, NativeId>) {\n  const database = yield* DatabaseService;\n\n  yield* validateDrizzleStorage(mapping).pipe(\n    Effect.provideServiceEffect(NativeDatabase, nativeDatabase(DatabaseService)),\n    Effect.mapError(unavailable),\n  );\n\n  const hooks = yield* LifecycleHooks;\n  const plans = makeRegistrationPlans(mapping as unknown as RegistrationMapping<Registration>);\n\n  const run = <Out, Err, Env>(plan: Effect.Effect<Planned<Out>, Err, Env>) =>\n    Effect.gen(function* () {\n      if (yield* hasCommitScope) return yield* unavailable();\n\n      return yield* executeStandalone(plan, 2);\n    }).pipe(\n      Effect.provideService(CurrentD1PlanningDatabase, database),\n      Effect.provideService(LifecycleHooks, hooks),\n    );\n\n  const service: PasswordRegistrationAuthority<Registration> = {\n    register: (input, prepare) => run(plans.register(input, prepare)).pipe(translateFailure),\n  };\n\n  return { registrationAuthority: service };\n});\n\nexport function coordinateD1PasswordRegistration<\n  TargetId,\n  Registration,\n  S extends AnySQLiteTable,\n  I extends AnySQLiteTable,\n  C extends AnySQLiteTable,\n  AC extends AnySQLiteTable,\n  Rq extends AnySQLiteTable,\n  NativeId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: PasswordRegistrationMapping<NoInfer<Registration>, S, I, C, AC, Rq, NativeId>;\n    readonly target: SuppliedService<TargetId, PasswordRegistrationAuthority<Registration>>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  CoordinatorError<E> | DatabaseError,\n  Exclude<R, TargetId | D1BatchStatements> | LifecycleHooks | DatabaseRequirements\n> {\n  return Effect.flatMap(nativeDatabase(acquire), (database) =>\n    Effect.gen(function* () {\n      yield* validateDrizzleStorage(options.mapping).pipe(Effect.mapError(unavailable));\n      const hooks = yield* LifecycleHooks;\n\n      if (yield* hasCommitScope) return yield* unavailable();\n\n      const result = yield* coordinateCommit(\n        () =>\n          Effect.gen(function* () {\n            const statements: Statement<any>[] = [];\n            let mutation: Planned<any> | undefined;\n\n            const nativeCollector = D1BatchStatements.of({\n              append: (statement) => Effect.sync(() => statements.push(statement)),\n            });\n\n            const owner = yield* makeD1Owner(unavailable()).pipe(\n              Effect.provideService(D1BatchStatements, nativeCollector),\n            );\n\n            const plans = makeRegistrationPlans(\n              options.mapping as unknown as RegistrationMapping<Registration>,\n            );\n\n            const run = <Out, Err, Env>(plan: Effect.Effect<Planned<Out>, Err, Env>) =>\n              coordinateCommit(\n                () =>\n                  Effect.gen(function* () {\n                    const journal = yield* CurrentCommitJournal;\n                    const planned = yield* plan;\n\n                    yield* owner.check;\n                    if (mutation !== undefined) return yield* unavailable();\n                    const guarded = { ...planned, journalGuard: journal.prepare(undefined) };\n\n                    mutation = guarded;\n                    statements.push(...guarded.statements);\n\n                    return guarded.receipt;\n                  }),\n                { mode: \"batch\" },\n              ).pipe(\n                Effect.map((result) => result.value),\n                Effect.provideService(CurrentD1PlanningDatabase, database),\n                Effect.provideService(LifecycleHooks, hooks),\n              );\n\n            const service: PasswordRegistrationAuthority<Registration> = {\n              register: (input, prepare) =>\n                owner.run(run(plans.register(input, prepare)).pipe(translateFailure)),\n            };\n\n            const provided = Context.make(options.target, service).pipe(\n              Context.add(D1BatchStatements, owner.collector),\n            );\n\n            const value = yield* owner.close(Effect.provideContext(body, provided));\n\n            if (mutation?.journalGuard !== undefined) {\n              const status = yield* Effect.result(mutation.journalGuard.read);\n\n              if (status._tag === \"Success\" || status.failure._tag !== \"CommitPending\")\n                return yield* unavailable();\n            }\n            yield* database.$client.batch(statements).pipe(\n              Effect.catchCause((cause) =>\n                Effect.failCause(\n                  Cause.map(cause, (error) =>\n                    everyFailureMatches(cause, mutation?.retryable) ? unavailable() : error,\n                  ),\n                ),\n              ),\n              translateFailure,\n            );\n\n            return value;\n          }),\n        { mode: \"batch\" },\n      ).pipe(Effect.provideService(LifecycleHooks, hooks));\n\n      return result.value;\n    }).pipe(Effect.provideService(NativeDatabase, database)),\n  );\n}\n\n/** Private prepared compiler seam: it never replays a caller or prepared callback. */\nexport const passwordD1Kernel = {\n  statement,\n  assertion,\n  readEngineNowMillis,\n  allocate,\n  allocateNextSecurityRevision,\n  subjectColumns,\n  identifierColumns,\n  credentialColumns,\n  authorityColumns,\n  readAuthority,\n  assuranceCondition,\n  credentialCurrentCondition,\n  commandAbsentCondition,\n  compileAddMutation,\n  compileReplacementMutation,\n  completionMatchesPassword,\n  isGuardFailure,\n};\n\nconst translateFailure = <A, E, R>(\n  effect: Effect.Effect<A, E, R>,\n): Effect.Effect<A, PasswordUnavailable, R> =>\n  reportPersistenceFailure(\n    effect,\n    (error) =>\n      Schema.is(PasswordUnavailable)(error) ||\n      Schema.is(ProofUnavailable)(error) ||\n      Schema.is(HookConfigurationError)(error),\n  ).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));\n\nconst executeStandalone = <A, E, R>(\n  plan: Effect.Effect<Planned<A>, E, R>,\n  retries = 2,\n): Effect.Effect<\n  A,\n  E | import(\"@yielded/auth/Hooks\").HookConfigurationError | import(\"effect/sql/SqlError\").SqlError,\n  Exclude<R, CurrentCommitJournal> | CurrentD1PlanningDatabase | LifecycleHooks\n> =>\n  Effect.suspend(() => {\n    let retryable: ((cause: unknown) => boolean) | undefined;\n\n    const once = coordinateCommit(\n      () =>\n        Effect.gen(function* () {\n          const database = yield* CurrentD1PlanningDatabase;\n          const planned = yield* plan;\n\n          retryable = planned.retryable;\n          yield* database.$client.batch(planned.statements);\n\n          return planned.receipt;\n        }),\n      { mode: \"batch\" },\n    ).pipe(Effect.map((result) => result.value));\n\n    return once.pipe(\n      Effect.catchCause((cause) =>\n        retries > 0 && everyFailureMatches(cause, retryable)\n          ? executeStandalone(plan, retries - 1)\n          : Effect.failCause(cause),\n      ),\n    );\n  });\n"],"mappings":";;;;;;;;;;;;;;;;;;AA8FA,MAAM,oBAAoB,oBAAoB,KAAK,CAAC,CAAC;AAErD,MAAM,uBACJ,OACA,aAEA,aAAa,KAAA,KACb,MAAM,QAAQ,SAAS,KACvB,MAAM,QAAQ,OAAO,WAAW,MAAM,aAAa,MAAM,KAAK,SAAS,MAAM,KAAK,OAAO,KAAK,CAAC,CAAC;AAElG,MAAM,oBAAoB,YACxB,OAAO,QAAQ,2BAA2B,CAAC,CAAC,OACzC,CAAC,KAAK,WACL,QAAQ,YAAY,SAAqD,KAC7E;AAEF,MAAM,gCAA8C,YAClD,OAAO,QAAQ,uCAAuC,CAAC,CAAC,OACrD,CAAC,KAAK,WACL,QAAQ,YAAY,SAAiE,KACzF;AAEF,MAAM,mBAAmB,SAAkB,cAAoD;CAC7F,MAAM,uBAAO,IAAI,IAAa;CAC9B,MAAM,UAA0B,CAAC,OAAO;CAExC,KAAK,IAAI,YAAY,GAAG,YAAY,MAAM,QAAQ,SAAS,GAAG,aAAa;EACzE,MAAM,UAAU,QAAQ,MAAM;EAE9B,IAAI,YAAY,KAAA,KAAa,YAAY,QAAQ,KAAK,IAAI,OAAO,GAAG;EACpE,KAAK,IAAI,OAAO;EAChB,IAAI,UAAU,OAAO,GAAG,OAAO;EAC/B,IAAI,MAAM,QAAQ,OAAO,GAAG;GAC1B,KAAK,MAAM,UAAU,QAAQ,SAC3B,IAAI,MAAM,aAAa,MAAM,GAAG,QAAQ,KAAK,OAAO,KAAK;QACpD,IAAI,MAAM,YAAY,MAAM,GAAG,QAAQ,KAAK,OAAO,MAAM;GAEhE;EACF;EACA,IAAI,OAAO,YAAY,UAAU;EAEjC,MAAM,UAAU;EAMhB,IAAI,QAAQ,UAAU,KAAA,GAAW,QAAQ,KAAK,QAAQ,KAAK;EAC3D,IAAI,QAAQ,WAAW,KAAA,GAAW,QAAQ,KAAK,QAAQ,MAAM;EAC7D,IAAI,QAAQ,YAAY,KAAA,GAAW,QAAQ,KAAK,QAAQ,OAAO;CACjE;CAEA,OAAO;AACT;AAIA,MAAM,kBAAkB,OAAgB,WAAmB;CAEzD,MAAM,SAAS,mBAAmB,KADhB,OAAO,WAAW,KAAK,IAAI,EAAE,GACR;CAEvC,OAAO,gBAAgB,QAAQ,UAAU,UAAU,UAAU,UAAU,aAAa,QAAQ;AAC9F;AAEA,MAAM,YAAY,OAAO,GAAG,WAAW,OAEpC;CACD,MAAM,WAAW,OAAO;CACxB,MAAM,WAAW,MAAM,MAAM;CAE7B,OAAO,SAAS,QAAQ,OAAO,SAAS,KAAK,SAAS,MAAM;AAC9D,CAAC;AAED,MAAM,YAAY,OAAO,GAAG,WAAW,WAAgB,QAAgB;CACrE,MAAM,WAAW,OAAO;CAExB,OAAO,OAAO,UACZ,SACG,OAAO,EACN,IAAI,GAAG,aAAa,UAAU,kCAAkC,KAAK,OAAO,GAAG,OAAO,GACpF,IACF,EACF,CAAC,CAAC,CACD,KAAK,GAAG,YAAY,CACzB;AACF,CAAC;AAED,MAAM,sBAAsB,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAAW,SAAkB;CAGhG,OAAO,QAAO,OAFU,0BAAA,CAGrB,OAAO,EAAE,OAAO,QAAQ,GAAG,gBAAgB,GAAG,mBAAmB,EAAE,CAAC,CAAC,CACrE,KAAK,GAAG,YAAY,CAAC,CACrB,KACC,OAAO,SAAS,SAAS;EACvB,MAAM,QAAQ,OAAO,KAAK,EAAE,EAAE,KAAK;EAEnC,OAAO,OAAO,SAAS,KAAK,IAAI,OAAO,QAAQ,KAAK,IAAI,OAAO,KAAK,YAAY,CAAC;CACnF,CAAC,CACH;AACJ,CAAC;AAED,MAAM,YACJ,YACA,cAEA,eAAe,KAAA,IACX,aACA,cAAc,KAAA,IACZ,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;CACT,KAAK;CACL,QAAQ,UAAU,IAAIA,0BAAwB;EAAE,WAAW;EAAW;CAAM,CAAC;AAC/E,CAAC;AAET,MAAM,gCAAgC,SAAkB,YACtD,SACE,QAAQ,QAAQ,uBAAuB,OAAO,KAAK,QAAQ,kBAC3D,QAAQ,QAAQ,6BAA6B,KAAA,IACzC,QAAQ,6BACF,QAAQ,QAAQ,yBAA0B,OAAO,CAC7D;AAEF,MAAM,kBAAkB,aAAsB;CAC5C,IAAI,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,EAAE;CACpD,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;CAC5D,kBAAkB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,gBAAgB;AAClF;AAEA,MAAM,qBAAqB,aAAsB;CAC/C,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;CACxE,OAAO,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,KAAK;CAChE,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;CACxE,YAAY,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,UAAU;CAC1E,iBAAiB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,eAAe;AACtF;AAEA,MAAM,qBAAqB,aAAsB;CAC/C,UAAU,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,QAAQ;CACtE,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;CACxE,cAAc,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,YAAY;CAC9E,oBAAoB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,kBAAkB;CAC1F,iBAAiB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,eAAe;CACpF,UAAU,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,QAAQ;CACtE,eAAe,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,aAAa;AAClF;AAEA,MAAM,oBAAoB,aAAsB;CAC9C,WAAW,OAAO,QAAQ,oBAAoB,OAAO,QAAQ,oBAAoB,SAAS;CAC1F,cAAc,OAAO,QAAQ,oBAAoB,OAAO,QAAQ,oBAAoB,YAAY;CAChG,UAAU,OAAO,QAAQ,oBAAoB,OAAO,QAAQ,oBAAoB,QAAQ;CACxF,QACE,QAAQ,oBAAoB,WAAW,KAAA,IACnC,KAAA,IACA,OAAO,QAAQ,oBAAoB,OAAO,QAAQ,oBAAoB,MAAM;AACpF;AAEA,MAAM,kBAAkB,aAAsB;CAC5C,UAAU,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,QAAQ;CAChE,WAAW,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,SAAS;CAClE,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;CAC5D,eAAe,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,aAAa;CAC1E,UAAU,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,QAAQ;CAChE,gBAAgB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,cAAc;AAC9E;AAEA,MAAM,iBAAiB,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,YACA;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,IAAI,kBAAkB,OAAO;CAEnC,OAAO,OAAO,SACX,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,IAAI,GAAG,EAAE,WAAW,WAAW,SAAS,GAAG,GAAG,EAAE,OAAO,WAAW,KAAK,CAAC,CAAC,CAAC,CAChF,MAAM,CAAC;AACZ,CAAC;AAED,MAAM,oBAAoB,OAAO,GAAG,2BAA2B,CAAC,CAAC,WAC/D,SACA,iBACA;CAGA,OAAO,QAAO,OAFU,0BAAA,CAGrB,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,GAAG,eAAe,OAAO,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,CACtD,MAAM,CAAC;AACZ,CAAC;AAED,MAAM,uBAAuB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACrE,SACA,UACA,iBACA;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,IAAI,kBAAkB,OAAO;CAEnC,OAAO,OAAO,SACX,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,IAAI,GAAG,EAAE,UAAU,QAAQ,GAAG,GAAG,EAAE,WAAW,eAAe,CAAC,CAAC,CAAC,CACtE,MAAM,CAAC;AACZ,CAAC;AAED,MAAM,oBAAoB,OAAO,GAAG,qCAAqC,CAAC,CAAC,WACzE,SACA,UACA,YACA,oBACA;CACA,MAAM,iBAAiB,OAAO,eAAe,SAAS,UAAU,EAAA,CAAG;CAEnE,IAAI,kBAAkB,KAAA,KAAa,CAAC,QAAQ,WAAW,UAAU,aAAa,GAAG,OAAO,KAAA;CACxF,MAAM,kBAAkB,cAAc,QAAQ,WAAW;CACzD,MAAM,WAAW,OAAO,kBAAkB,SAAS,eAAe,EAAA,CAAG;CAErE,IAAI,YAAY,KAAA,KAAa,CAAC,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,GAC1F,OAAO,KAAA;CACT,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,eAAe;CAEpE,IAAI,uBAAuB,KAAA,KAAa,cAAc,oBAAoB,OAAO,KAAA;CACjF,MAAM,cAAc,OAAO,qBAAqB,SAAS,UAAU,eAAe,EAAA,CAAG;CAErF,IAAI,eAAe,KAAA,GAAW,OAAO;EAAE;EAAiB;EAAS,YAAY;CAAc;CAM3F,OAAO;EAAE;EAAiB;EAAS,YAAY;EAAe;EAAY,UAAA,OAJlD,QAAQ,WAC7B,OAAO;GAAE;GAAU;GAAS,YAAY;GAAe;EAAW,CAAC,CAAC,CACpE,KAAK,OAAO,QAAQ,0BAA0B,CAAC;CAEiC;AACrF,CAAC;AAED,MAAM,qBAAqB,OAAO,WAChC,OAAO,eAAe,uBAAuB,OAAO,MAAM,CAC5D;AAEA,MAAM,mBAAmB,OAAO,WAC9B,OAAO,eAAe,0BAA0B,OAAO,YAAY,CACrE;AAEA,MAAM,sBACJ,SACA,UACA,gBACG;CACH,MAAM,SAAS,mBAAmB,SAAS,MAAM;CACjD,MAAM,QAAQ,GAAG,gDAAgD,QAAQ,GAAG,gBAAgB,OAAO,QAAQ,GAAG,gBAAgB,iDAAiD,YAAY;CAE3L,OAAO,GAAG;8BACkB,iBAAiB,YAAY,YAAY,EAAE;+CAC1B,OAAO,+DAA+D,QAAQ,GAAG,gBAAgB;gIAChB,OAAO,gEAAgE,MAAM;6FAChH,OAAO,mBAAmB,MAAM;yCACpF,OAAO,mBAAmB,MAAM;;AAEzE;AAEA,MAAM,kBAAkB,MAAuB,UAC7C,KAAK,cAAc,MAAM,aAAa,KAAK,UAAU,MAAM;AAE7D,MAAM,uBACJ,UACA,aACA,QACG;CACH,IAAI,SAAS,OAAO,SAAS,MAAM,SAAS,SAAS,YAAY,SAAS,IAAI,OAAO;CACrF,MAAM,4BAAY,IAAI,IAAoB;CAE1C,KAAK,MAAM,YAAY,SAAS,SAAS,aAAa;EACpD,IAAI,UAAU,IAAI,SAAS,YAAY,GAAG,OAAO;EACjD,UAAU,IAAI,SAAS,cAAc,SAAS,QAAQ;CACxD;CACA,IAAI,SAAS,OAAO,MAAM,UAAU,CAAC,UAAU,IAAI,MAAM,YAAY,CAAC,GAAG,OAAO;CAChF,IAAI,SAAS,OAAO,MAAM,UAAU,MAAM,SAAS,cAAc,MAAM,UAAU,CAAC,GAAG,OAAO;CAE5F,MAAM,QAAQ,SAAS,OAAO,QAC3B,UAAU,MAAM,SAAS,cAAc,MAAM,UAAU,IAAI,YAAY,gBAC1E;CAEA,MAAM,UAAU,IAAI,IAAI,MAAM,SAAS,UAAU,MAAM,OAAO,CAAC;CAC/D,MAAM,cAAc,IAAI,IAAI,MAAM,KAAK,UAAU,MAAM,YAAY,CAAC;CAEpE,OAAO,YAAY,aAAa,MAC7B,gBACC,YAAY,QAAQ,OAAO,WAAW,QAAQ,IAAI,MAAM,CAAC,KACzD,YAAY,QAAQ,YAAY,sBAChC,MAAM,MACH,WACE,CAAC,YAAY,gBAAgB,MAAM,kBACnC,CAAC,YAAY,qBAAqB,MAAM,kBAC7C,CACJ;AACF;AAEA,MAAM,wBAAwB,OAAO,GAAG,yCAAyC,CAAC,CAAC,WACjF,OACA;CACA,MAAM,mBAAmB,yBAAyB,MAAM,gBAAgB;CAExE,MAAM,WAAW,OAAO,+BAA+B,MAAM,cAAc,QAAQ,CAAC,CAAC,KACnF,OAAO,SAAS,WAAW,CAC7B;CAEA,MAAM,cAAc,OAAO,4BAA4B,MAAM,cAAc,WAAW;CAEtF,MAAM,aACJ,MAAM,eAAe,KAAA,IACjB,KAAA,IACA,OAAO,2BAA2B,MAAM,UAAU;CAExD,OAAO,OAAO,OAAO;EACnB,GAAG;EACH;EACA,aAAa,OAAO,OAAO;GACzB,UAAU,SAAS,KAAK,SAAS,MAAM,MAAM,YAAY,QAAQ,CAAC;GAClE,eAAe,MAAM,YAAY;EACnC,CAAC;EACD,cAAc,OAAO,OAAO,EAAE,GAAG,MAAM,aAAa,CAAC;EACrD,GAAI,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW;EACjD,eAAe,OAAO,OAAO;GAC3B,WAAW,OAAO,OAAO;IACvB,GAAG,MAAM,cAAc;IACvB,UAAU,yBAAyB,MAAM,cAAc,UAAU,QAAQ;GAC3E,CAAC;GACD;GACA;EACF,CAAC;CACH,CAAC;AACH,CAAC;AAED,MAAM,6BACJ,UACG;CACH,MAAM,aAAa,MAAM,WAAW;CACpC,MAAM,UAAU,WAAW;CAE3B,IACE,WAAW,aAAa,GAAG,MAAM,SAAS,WAC1C,WAAW,YAAY,oBACvB,QAAQ,SAAS,aACjB,MAAM,eAAe,KAAA,KACrB,QAAQ,SAAS,cAAc,MAAM,iBAAiB,aACtD,QAAQ,SAAS,qBAAqB,MAAM,iBAAiB,oBAC7D,CAAC,eAAe,QAAQ,YAAY,MAAM,WAAW,UAAU,GAE/D,OAAO;CAET,MAAM,WAAW,CAAC,GAAG,MAAM,iBAAiB,WAAW,CAAC,CAAC,MAAM,MAAM,UACnE,KAAK,aAAa,cAAc,MAAM,YAAY,CACpD;CAEA,MAAM,SAAS,CAAC,GAAG,QAAQ,SAAS,WAAW,CAAC,CAAC,MAAM,MAAM,UAC3D,KAAK,aAAa,cAAc,MAAM,YAAY,CACpD;CAEA,OACE,SAAS,WAAW,OAAO,UAC3B,SAAS,OACN,MAAM,UACL,KAAK,iBAAiB,OAAO,MAAM,CAAE,gBACrC,KAAK,aAAa,OAAO,MAAM,CAAE,QACrC;AAEJ;AAEA,MAAM,uBAAuB,OAAO,GAAG,gCAAgC,CAAC,CAAC,WACvE,SACA,OACA;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,OAA4B;EAChC;EACA,UAAU,UAAU,SAAS,YAAY,QAAQ,QAAQ,QAAQ,QAAQ,CAAC;CAC5E;CAEA,MAAM,SAAS,qCAAqC,MAAM;CAoB1D,OAAO,OAlBM,uBAET,OAAO,IAAI,aAAa;EACtB,MAAM,WAAW,OAAO,6BACtB,SACA,MACA;GAAE,YAAY,CAAC;GAAG,kBAAkB,GAAG;EAAQ,SACzC,KACR;EAEA,IAAI,SAAS,WAAW,WAAW,GAAG,OAAO;EAC7C,OAAO,SAAS,QAAQ,MAAM,SAAS,UAAU;EAEjD,OAAO;CACT,CAAC,GACH,EAAE,MAAM,QAAQ,CAGD,CAAC,CAAC,KACjB,OAAO,GAAG,KAAK,GACf,OAAO,YAAY,UACjB,eAAe,OAAO,MAAM,IAAI,OAAO,QAAQ,IAAI,IAAI,OAAO,UAAU,KAAK,CAC/E,CACF;AACF,CAAC;AAED,MAAM,8BACJ,SACA,OACA,iBACA,qBACG;CACH,IAAI,MAAM,eAAe,KAAA,GAAW,OAAO,GAAG;CAE9C,MAAM,KAAK,kBAAkB,OAAO,GAClC,WAAW,MAAM;CAEnB,OAAO,IACL,QAAQ,WAAW,mBAAmB;EAAE,YAAY,SAAS;EAAY;CAAgB,CAAC,GAC1F,GAAG,wBAAwB,QAAQ,WAAW,MAAM,SAAS,GAAG,UAAU,KAAK,IAAI,MAAM,SAAS,WAAW,WAAW,GAAG,SAAS,EAAE,OAAO,GAAG,MAAM,KAAK,IAAI,MAAM,SAAS,WAAW,OAAO,GAAG,KAAK,EAAE,OAAO,GAAG,UAAU,KAAK,IAAI,MAAM,iBAAiB,GAAG,SAAS,EAAE,OAAO,GAAG,gBAAgB,KAAK,IAAI,MAAM,SAAS,2BAA2B,GAAG,eAAe,EAAE,OAAO,UAAU,UAAU,gBAAgB,IAAI,GAAG,GAAG,GAAG,WAAW,YAAY,GAAG,GAAG,GAAG,WAAW,KAAK,IAAI,MAAM,kBAAkB,GAAG,UAAU,IAAI,EACpgB;AACF;AAEA,MAAM,gBAAgB,OAAO,GAAG,iCAAiC,CAAC,CAAC,WACjE,SACA,OACA,QACA;CACA,MAAM,WAAW,OAAO;CAExB,IACE,MAAM,cAAc,SAAS,OAAO,SAAS,MAC7C,MAAM,cAAc,SAAS,SAAS,YAAY,SAAS,IAE3D,OAAO,KAAA;CAET,MAAM,cAAc,IAAI,IACtB,MAAM,cAAc,SAAS,SAAS,YAAY,KAAK,SAAS,KAAK,YAAY,CACnF;CAEA,IACE,YAAY,SAAS,MAAM,cAAc,SAAS,SAAS,YAAY,UACvE,MAAM,cAAc,SAAS,OAAO,MAAM,UAAU,CAAC,YAAY,IAAI,MAAM,YAAY,CAAC,GAExF,OAAO,KAAA;CACT,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,MAAM,iBAAiB,SAAS;CAC1F,MAAM,WAAW,OAAO,kBAAkB,SAAS,eAAe,EAAA,CAAG;CAErE,IACE,YAAY,KAAA,KACZ,CAAC,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,KAC/D,QAAQ,QAAQ,QAAQ,sBAAsB,MAAM,iBAAiB,oBACrE,MAAM,cAAc,UAAU,aAAa,MAAM,YACjD,MAAM,cAAc,UAAU,WAAW,UACzC,MAAM,cAAc,UAAU,cAAc,MAAM,aAClD,MAAM,cAAc,UAAU,SAAS,cAAc,MAAM,iBAAiB,aAC5E,MAAM,cAAc,UAAU,SAAS,qBACrC,MAAM,iBAAiB,oBACzB,MAAM,cAAc,SAAS,SAAS,cAAc,MAAM,iBAAiB,aAC3E,MAAM,cAAc,SAAS,SAAS,qBACpC,MAAM,iBAAiB,oBACxB,MAAM,cAAc,SAAS,WAAuB,MAAM,aAC3D,MAAM,cAAc,SAAS,kBAAkB,MAAM,cAAc,UAAU,iBAC5E,WAAW,mBACT,MAAM,eAAe,KAAA,KACpB,MAAM,cAAc,UAAU,uBAAuB,KAAA,MACzD,MAAM,iBAAiB,YAAY,MAChC,aACC,CAAC,MAAM,cAAc,SAAS,SAAS,YAAY,MAChD,WACC,OAAO,iBAAiB,SAAS,gBAAgB,OAAO,aAAa,SAAS,QAClF,CACJ,GAEA,OAAO,KAAA;CACT,IAAI,sBAA2B,GAAG;CAElC,IAAI,MAAM,eAAe,KAAA,GAAW;EAClC,MAAM,cAAc,OAAO,eAAe,SAAS,MAAM,WAAW,UAAU,EAAA,CAAG;EAEjF,IACE,eAAe,KAAA,KACf,MAAM,cAAc,UAAU,uBAAuB,MAAM,WAAW,gBACtE,CAAC,QAAQ,WAAW,UAAU,UAAU,KACxC,CAAC,QAAQ,UAAU,OAAO,WAAW,QAAQ,WAAW,YAAY,eAAe,KACnF,WAAW,QAAQ,WAAW,qBAAqB,MAAM,WAAW,2BAEpE,OAAO,KAAA;EACT,MAAM,cAAc,OAAO,qBAAqB,SAAS,MAAM,UAAU,eAAe,EAAA,CAAG;EAE3F,IAAI,eAAe,KAAA,GAAW,OAAO,KAAA;EAErC,MAAM,WAAW,OAAO,QAAQ,WAAW,OAAO;GAChD,UAAU,MAAM;GAChB;GACA;GACA;EACF,CAAC;EAED,IAAI,CAACC,+BAAa,UAAU,MAAM,UAAU,GAAG,OAAO,KAAA;EACtD,sBAAsB,2BACpB,SACA,OACA,iBACA,WAAW,QAAQ,WAAW,WAChC;EACA,MAAM,KAAK,kBAAkB,OAAO;EAEpC,sBAAsB,IACpB,qBACA,GAAG,wBAAwB,QAAQ,WAAW,MAAM,SAAS,GAAG,UAAU,KAAK,IAAI,MAAM,MAAM,WAAW,WAAW,WAAW,GAAG,SAAS,EAAE,OAAO,GAAG,MAAM,KAAK,IAAI,MAAM,MAAM,WAAW,WAAW,OAAO,GAAG,KAAK,EAAE,OAAO,GAAG,UAAU,KAAK,IAAI,MAAM,iBAAiB,GAAG,SAAS,EAAE,OAAO,GAAG,gBAAgB,KAAK,IAAI,MAAM,MAAM,WAAW,2BAA2B,GAAG,eAAe,EAAE,EACvY;CACF;CAEA,MAAM,WAAW,CACf,GAAG,IAAI,IACL,CACE,GAAG,MAAM,iBAAiB,aAC1B,GAAG,MAAM,cAAc,SAAS,SAAS,WAC3C,CAAC,CAAC,KAAK,SAAS,CAAC,KAAK,cAAc,IAAI,CAAC,CAC3C,CAAC,CAAC,OAAO,CACX,CAAC,CAAC,MAAM,MAAM,UAAU,KAAK,aAAa,cAAc,MAAM,YAAY,CAAC;CAE3E,MAAM,KAAK,iBAAiB,OAAO;CAkBnC,MAAM,aAAa,CAAC,GAflB,SAAS,WAAW,IAChB,CAAC,IACD,OAAO,SACJ,OAAO,CAAC,CACR,KAAK,QAAQ,oBAAoB,KAAK,CAAC,CACvC,MACC,IACE,GAAG,GAAG,WAAW,eAAe,GAChC,QACE,GAAG,cACH,SAAS,KAAK,SAAS,KAAK,YAAY,CAC1C,CACF,CACF,CAEmB,CAAC,CAAC,MAAM,MAAW,UAC5C,OAAO,KAAK,QAAQ,oBAAoB,aAAa,CAAC,CAAC,cACrD,OAAO,MAAM,QAAQ,oBAAoB,aAAa,CACxD,CACF;CAEA,IACE,WAAW,WAAW,SAAS,UAC/B,WAAW,MACR,KAAU,UACT,IAAI,QAAQ,oBAAoB,kBAAkB,SAAS,MAAM,CAAE,gBACnE,IAAI,QAAQ,oBAAoB,cAAc,SAAS,MAAM,CAAE,YAC9D,QAAQ,oBAAoB,WAAW,KAAA,KACtC,QAAQ,oBAAoB,iBAAiB,IAAI,QAAQ,oBAAoB,OAAO,MAClF,IACR,GAEA,OAAO,KAAA;CACT,MAAM,cAAc,OAAO,QAAQ,QAAQ,wBAAwB,SAAS,MAAM;CAClF,MAAM,YAAY,OAAO,oBAAoB,OAAO;CAEpD,IACE,CAAC,oBACC,MAAM,cAAc,UACpB,MAAM,cAAc,aACpB,SACF,KACA,CAAC,oBAAoB,MAAM,cAAc,UAAU,aAAa,SAAS,GAEzE,OAAO,KAAA;CACT,IACE,MAAM,aAAa,qBAAqB,eACxC,QAAQ,wBAAwB,4BAEhC,OAAO,KAAA;CACT,MAAM,IAAI,eAAe,OAAO;CAEhC,MAAM,uBAAuB,SAAS,KACnC,SACC,GAAG,wBAAwB,QAAQ,oBAAoB,MAAM,SAAS,GAAG,UAAU,KAAK,IAAI,MAAM,iBAAiB,GAAG,SAAS,EAAE,OAAO,GAAG,aAAa,KAAK,IAAI,MAAM,KAAK,cAAc,GAAG,YAAY,EAAE,OAAO,GAAG,SAAS,KAAK,IAAI,MAAM,KAAK,UAAU,GAAG,QAAQ,IAAI,GAAG,WAAW,KAAA,IAAY,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,KAAK,IAAI,MAAM,QAAQ,oBAAoB,qBAAqB,GAAG,MAAM,IAAI,EACnZ;CAEA,OAAO;EACL;EACA;EACA;EACA;EACA,WAAW,cACT,GAAG,wBAAwB,QAAQ,QAAQ,MAAM,SAAS,EAAE,GAAG,KAAK,IAAI,MAAM,iBAAiB,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI,MAAM,QAAQ,QAAQ,qBAAqB,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,KAAK,IAAI,MAAM,MAAM,iBAAiB,kBAAkB,EAAE,gBAAgB,EAAE,IACzR,qBACA,GAAG,sBACH,mBAAmB,SAAS,MAAM,cAAc,UAAU,MAAM,cAAc,WAAW,GACzF,mBAAmB,SAAS,MAAM,cAAc,UAAU,WAAW,CACvE;CACF;AACF,CAAC;AAED,MAAM,0BAA0B,SAAkB,UAAkB,cAAsB;CACxF,MAAM,IAAI,eAAe,OAAO;CAEhC,OAAO,GAAG,4BAA4B,QAAQ,QAAQ,MAAM,SAAS,EAAE,SAAS,KAAK,IAAI,MAAM,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,KAAK,IAAI,MAAM,WAAW,EAAE,SAAS,EAAE;AACjL;AAEA,MAAM,8BACJ,SACA,OACA,oBACG;CACH,MAAM,IAAI,kBAAkB,OAAO;CAEnC,OAAO,MAAM,eAAe,KAAA,IACxB,GAAG,UACH,GAAG,wBAAwB,QAAQ,WAAW,MAAM,SAAS,EAAE,SAAS,KAAK,IAAI,MAAM,MAAM,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,KAAK,IAAI,MAAM,iBAAiB,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,KAAK,IAAI,MAAM,MAAM,WAAW,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,mBAAmB,KAAK,IAAI,MAAM,MAAM,WAAW,oBAAoB,EAAE,kBAAkB,EAAE,OAAO,EAAE,gBAAgB,KAAK,IAAI,MAAM,MAAM,WAAW,iBAAiB,EAAE,eAAe,EAAE,OAAO,EAAE,SAAS,KAAK,IAAI,MAAM,SAAS,MAAM,MAAM,WAAW,QAAQ,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,KAAK,IAAI,MAAM,MAAM,WAAW,eAAe,EAAE,aAAa,EAAE;AAC/nB;AAEA,MAAM,qBAAqB,OAAO,GAAG,WACnC,SACA,OACA,iBACA,WAKA,KACA;CACA,MAAM,WAAW,OAAO;CACxB,MAAM,IAAI,kBAAkB,OAAO;CACnC,MAAM,IAAI,eAAe,OAAO;CAChC,MAAM,KAAK,iBAAiB,OAAO;CAEnC,OAAO;EACL,OAAO,UACL,SACG,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,IACC,QAAQ,WAAW,kBAAkB;GACnC,aAAa,MAAM;GACnB,oBAAoB,UAAU;GAC9B,iBAAiB,UAAU;EAC7B,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,WAAW,eAAe,GAC/B,GAAG,EAAE,cAAc,MAAM,WAAY,YAAY,GACjD,GAAG,EAAE,oBAAoB,MAAM,WAAY,kBAAkB,GAC7D,GAAG,EAAE,iBAAiB,MAAM,WAAY,eAAe,GACvD,GAAG,EAAE,UAAU,SAAS,MAAM,MAAM,WAAY,QAAQ,CAAC,GACzD,GAAG,EAAE,eAAe,MAAM,WAAY,aAAa,CACrD,CACF,CACJ;EACA,OAAO,UACL,SACG,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,IAAI,aAAa,CAAC,CAAC,QAAQ,QAAQ,kBAAkB,UAAU,oBAAoB,CAAC,CAAC,CAAC,CAAC,CACvF,MACC,IACE,GAAG,EAAE,IAAI,eAAe,GACxB,GAAG,EAAE,kBAAkB,MAAM,iBAAiB,gBAAgB,CAChE,CACF,CACJ;EACA,OAAO,UACL,SACG,OAAO,QAAQ,oBAAoB,KAAK,CAAC,CACzC,IAAI,QAAQ,oBAAoB,eAAe,UAAU,kBAAkB,CAAC,CAAC,CAC7E,MACC,IACE,GAAG,GAAG,WAAW,eAAe,GAChC,GAAG,GAAG,cAAc,MAAM,WAAY,YAAY,GAClD,GAAG,GAAG,UAAU,MAAM,WAAY,kBAAkB,CACtD,CACF,CACJ;EACA,OAAO,UACL,SAAS,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,OACrC,QAAQ,QAAQ,aAAa;GAC3B,UAAU,MAAM;GAChB,WAAW,MAAM;GACjB,QAAQ,MAAM,cAAc,UAAU;GACtC,eAAe,MAAM,cAAc,UAAU;GAC7C,UAAU;GACV,sBAAsB,MAAM,QAAQ;EACtC,CAAC,CACH,CACF;CACF;AACF,CAAC;AAED,MAAM,sBACJ,SACA,OACA,iBACA,WAKA,KACA,wBACG;CACH,MAAM,IAAI,kBAAkB,OAAO;CACnC,MAAM,IAAI,eAAe,OAAO;CAChC,MAAM,KAAK,iBAAiB,OAAO;CACnC,MAAM,KAAK,eAAe,OAAO;CAEjC,OAAO,IACL,GAAG,wBAAwB,QAAQ,WAAW,MAAM,SAAS,EAAE,SAAS,KAAK,IAAI,MAAM,MAAM,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,KAAK,IAAI,MAAM,iBAAiB,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,KAAK,IAAI,MAAM,MAAM,WAAY,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,mBAAmB,KAAK,IAAI,MAAM,UAAU,oBAAoB,EAAE,kBAAkB,EAAE,OAAO,EAAE,gBAAgB,KAAK,IAAI,MAAM,UAAU,iBAAiB,EAAE,eAAe,EAAE,OAAO,EAAE,SAAS,KAAK,IAAI,MAAM,SAAS,MAAM,MAAM,YAAY,QAAQ,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,KAAK,IAAI,MAAM,MAAM,YAAY,eAAe,EAAE,aAAa,EAAE,IAC9mB,GAAG,wBAAwB,QAAQ,QAAQ,MAAM,SAAS,EAAE,GAAG,KAAK,IAAI,MAAM,iBAAiB,EAAE,EAAE,EAAE,OAAO,EAAE,iBAAiB,KAAK,IAAI,MAAM,UAAU,sBAAsB,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI,MAAM,QAAQ,QAAQ,qBAAqB,EAAE,MAAM,EAAE,IAChR,GAAG,wBAAwB,QAAQ,oBAAoB,MAAM,SAAS,GAAG,UAAU,KAAK,IAAI,MAAM,iBAAiB,GAAG,SAAS,EAAE,OAAO,GAAG,aAAa,KAAK,IAAI,MAAM,MAAM,WAAY,cAAc,GAAG,YAAY,EAAE,OAAO,GAAG,SAAS,KAAK,IAAI,MAAM,UAAU,oBAAoB,GAAG,QAAQ,IAAI,GAAG,WAAW,KAAA,IAAY,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,KAAK,IAAI,MAAM,QAAQ,oBAAoB,qBAAqB,GAAG,MAAM,IAAI,IAC3a,GAAG,wBAAwB,QAAQ,QAAQ,MAAM,SAAS,GAAG,SAAS,KAAK,IAAI,MAAM,MAAM,UAAU,GAAG,QAAQ,EAAE,OAAO,GAAG,UAAU,KAAK,IAAI,MAAM,MAAM,WAAW,GAAG,SAAS,EAAE,OAAO,GAAG,cAAc,KAAK,IAAI,MAAM,MAAM,cAAc,UAAU,eAAe,GAAG,aAAa,EAAE,OAAO,GAAG,OAAO,KAAK,IAAI,MAAM,MAAM,cAAc,UAAU,QAAQ,GAAG,MAAM,EAAE,OAAO,GAAG,SAAS,KAAK,IAAI,MAAM,WAAW,GAAG,QAAQ,EAAE,OAAO,GAAG,eAAe,KAAK,IAAI,MAAM,QAAQ,cAAc,MAAM,QAAQ,sBAAsB,GAAG,GAAG,cAAc,EAAE,IAC7hB,qBACA,GAAG,MACL;AACF;AAEA,MAAM,qBAAqB,OAAO,GAAG,sCAAsC,CAAC,CAAC,WAC3E,SACA,OACA,WAMA;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,EAAE,cAAc,oBAAoB,iBAAiB,yBAAyB;CAEpF,MAAM,YAAY,OAAO,cAAc,SAAS,OAAO,cAAc;CAErE,IAAI,cAAc,KAAA,GAAW,OAAO,KAAA;CACpC,MAAM,MAAM,OAAO,oBAAoB,OAAO;CAC9C,MAAM,IAAI,kBAAkB,OAAO;CACnC,MAAM,IAAI,eAAe,OAAO;CAChC,MAAM,KAAK,iBAAiB,OAAO;CACnC,MAAM,KAAK,eAAe,OAAO;CACjC,MAAM,SAAS,kCAAkC,MAAM;CACvD,MAAM,SAAS,GAAG,4BAA4B,QAAQ,WAAW,MAAM,SAAS,EAAE,SAAS,KAAK,IAAI,MAAM,MAAM,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,KAAK,IAAI,MAAM,UAAU,iBAAiB,EAAE,SAAS,EAAE;CAEhN,MAAM,QAAQ,IACZ,UAAU,WACV,QACA,uBAAuB,SAAS,MAAM,UAAU,MAAM,SAAS,CACjE;CAEA,MAAM,mBAAmB,IACvB,GAAG,wBAAwB,QAAQ,WAAW,MAAM,SAAS,EAAE,SAAS,KAAK,IAAI,MAAM,MAAM,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,KAAK,IAAI,MAAM,UAAU,iBAAiB,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,KAAK,IAAI,MAAM,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,mBAAmB,KAAK,IAAI,MAAM,oBAAoB,EAAE,kBAAkB,EAAE,OAAO,EAAE,gBAAgB,KAAK,IAAI,MAAM,iBAAiB,EAAE,eAAe,EAAE,OAAO,EAAE,SAAS,KAAK,IAAI,MAAM,SAAS,MAAM,MAAM,YAAY,QAAQ,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,KAAK,IAAI,MAAM,MAAM,YAAY,eAAe,EAAE,aAAa,EAAE,IACllB,GAAG,wBAAwB,QAAQ,oBAAoB,MAAM,SAAS,GAAG,UAAU,KAAK,IAAI,MAAM,UAAU,iBAAiB,GAAG,SAAS,EAAE,OAAO,GAAG,aAAa,KAAK,IAAI,MAAM,cAAc,GAAG,YAAY,EAAE,OAAO,GAAG,SAAS,KAAK,IAAI,MAAM,oBAAoB,GAAG,QAAQ,IAAI,GAAG,WAAW,KAAA,IAAY,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,KAAK,IAAI,MAAM,QAAQ,oBAAoB,qBAAqB,GAAG,MAAM,IAAI,IACzZ,GAAG,wBAAwB,QAAQ,QAAQ,MAAM,SAAS,EAAE,GAAG,KAAK,IAAI,MAAM,UAAU,iBAAiB,EAAE,EAAE,EAAE,OAAO,EAAE,iBAAiB,KAAK,IAAI,MAAM,sBAAsB,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI,MAAM,QAAQ,QAAQ,qBAAqB,EAAE,MAAM,EAAE,IAChR,GAAG,wBAAwB,QAAQ,QAAQ,MAAM,SAAS,GAAG,SAAS,KAAK,IAAI,MAAM,MAAM,UAAU,GAAG,QAAQ,EAAE,OAAO,GAAG,UAAU,KAAK,IAAI,MAAM,MAAM,WAAW,GAAG,SAAS,EAAE,OAAO,GAAG,cAAc,KAAK,IAAI,MAAM,MAAM,cAAc,UAAU,eAAe,GAAG,aAAa,EAAE,OAAO,GAAG,OAAO,KAAK,IAAI,MAAM,gBAAgB,GAAG,MAAM,EAAE,OAAO,GAAG,SAAS,KAAK,IAAI,MAAM,WAAW,GAAG,QAAQ,EAAE,OAAO,GAAG,eAAe,KAAK,IAAI,MAAM,QAAQ,cAAc,MAAM,QAAQ,sBAAsB,GAAG,GAAG,cAAc,EAAE,EACzgB;CAmDA,OAAO;EACL,YAAA;GAjDA,OAAO,UAAU,OAAO,MAAM;GAC9B,OAAO,UACL,SAAS,OAAO,QAAQ,WAAW,KAAK,CAAC,CAAC,OACxC,QAAQ,WAAW,aAAa;IAC9B,UAAU,MAAM;IAChB,WAAW,UAAU;IACrB;IACA;IACA;IACA,aAAa,MAAM;GACrB,CAAC,CACH,CACF;GACA,OAAO,UACL,SAAS,OAAO,QAAQ,oBAAoB,KAAK,CAAC,CAAC,OACjD,QAAQ,oBAAoB,aAAa;IACvC,WAAW,UAAU;IACrB;IACA,UAAU;GACZ,CAAC,CACH,CACF;GACA,OAAO,UACL,SACG,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,IAAI,aAAa,CAAC,CAAC,QAAQ,QAAQ,kBAAkB,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAC7E,MACC,IACE,GAAG,EAAE,IAAI,UAAU,eAAe,GAClC,GAAG,EAAE,kBAAkB,MAAM,iBAAiB,gBAAgB,CAChE,CACF,CACJ;GACA,OAAO,UACL,SAAS,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,OACrC,QAAQ,QAAQ,aAAa;IAC3B,UAAU,MAAM;IAChB,WAAW,MAAM;IACjB,QAAQ;IACR,eAAe,MAAM,cAAc,UAAU;IAC7C,UAAU;IACV,sBAAsB,MAAM,QAAQ;GACtC,CAAC,CACH,CACF;GACA,OAAO,UAAU,kBAAkB,MAAM;EAIhC;EACT;EACA;EACA,YAAY,UAAmB,eAAe,OAAO,MAAM;CAC7D;AACF,CAAC;AAED,MAAM,qBACJ,SACA,iBAcG;CACH,MAAM,OAAgB,SACpB,OAAO,IAAI,aAAa;EACtB,IAAI,CAAC,iBAAiB,OAAO,GAAG,OAAO,OAAO,YAAY;EAE1D,OAAO,OAAO;CAChB,CAAC;CAEH,OAAO;EACL,iBAAiB,eACf,OAAO,IAAI,aAAa;GACtB,IAAI,CAAC,iBAAiB,OAAO,GAAG,OAAO,OAAO,YAAY;GAC1D,MAAM,QAAQ;IAAE,GAAG;IAAY,YAAY,EAAE,GAAG,WAAW,WAAW;GAAE;GACxE,MAAM,WAAW,OAAO;GACxB,MAAM,iBAAiB,OAAO,eAAe,SAAS,MAAM,UAAU,EAAA,CAAG;GAEzE,IAAI,kBAAkB,KAAA,KAAa,CAAC,QAAQ,WAAW,UAAU,aAAa,GAC5E,OAAO,OAAO,KAAK;GACrB,MAAM,WAAW,cAAc,QAAQ,WAAW;GAElD,MAAM,KAAK,eAAe,OAAO,GAC/B,KAAK,kBAAkB,OAAO,GAC9B,KAAK,kBAAkB,OAAO;GAGhC,MAAM,OAAO,OAAO,SACjB,OAAO;IACN,SAAS,gBAAgB,QAAQ,QAAQ,KAAK;IAC9C,YAAY,gBAAgB,QAAQ,WAAW,KAAK;IACpD,YAAY,gBAAgB,QAAQ,WAAW,KAAK;GACtD,CAAC,CAAC,CACD,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,UACC,QAAQ,WAAW,OACnB,IACE,GAAG,GAAG,WAAW,MAAM,WAAW,SAAS,GAC3C,GAAG,GAAG,OAAO,MAAM,WAAW,KAAK,GACnC,GAAG,GAAG,WAAW,QAAQ,CAC3B,CACF,CAAC,CACA,UACC,QAAQ,WAAW,OACnB,IAAI,GAAG,GAAG,UAAU,MAAM,QAAQ,GAAG,GAAG,GAAG,WAAW,QAAQ,CAAC,CACjE,CAAC,CACA,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC;GAE5B,IAAI,KAAK,WAAW,GAAG,OAAO,OAAO,KAAK;GAC1C,MAAM,MAAM,KAAK;GAEjB,IACE,CAAC,QAAQ,QAAQ,eAAe,IAAI,QAAQ,QAAQ,QAAQ,OAAO,KACnE,CAAC,QAAQ,WAAW,UAAU,IAAI,UAAU,KAC5C,CAAC,QAAQ,UAAU,OAAO,UAAU,IAAI,QAAQ,QAAQ,QAAQ,GAAG,KACnE,CAAC,QAAQ,UAAU,OAAO,UAAU,IAAI,WAAW,QAAQ,WAAW,UAAU,KAChF,CAAC,QAAQ,UAAU,OAAO,UAAU,IAAI,WAAW,QAAQ,WAAW,UAAU,GAEhF,OAAO,OAAO,KAAK;GAErB,MAAM,aAAa,OAAO,QAAQ,WAC/B,OAAO;IAAE,UAAU,MAAM;IAAU,GAAG;GAAI,CAAC,CAAC,CAC5C,KAAK,OAAO,QAAQ,0BAA0B,CAAC;GAElD,OAAO,MAAM,cAAc,KAAA,KAAa,WAAW,SAAS,cAAc,MAAM,YAC5E,OAAO,KAAK,IACZ,OAAO,KAAK,UAAU;EAC5B,CAAC;EACH,kBAAkB,UAChB,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,eAAe,SAAS,KAC5B,OAAO,OAAO,aAAa,mBAAmB,CAAC,CAAC,SAAS,MAAM,MAAM,YAAY,CAAC,CACpF;GAEA,MAAM,aAAa,OAAO,2BAA2B,MAAM,UAAU;GACrE,MAAM,WAAW,OAAO;GACxB,MAAM,WAAW,OAAO,QAAQ,UAAU,SAAS,WAAW,SAAS,SAAS;GAChF,MAAM,UAAU,OAAO,SAAS,QAAQ,kBAAkB,QAAQ,oBAAoB;GAEtF,IAAI,YAAY,WAAW,iBAAiB,OAAO,OAAO,YAAY;GACtE,MAAM,UAAU,QAAQ,WAAW,eAAe,cAAc,OAAO;GAEvE,MAAM,SAAS;KACZ,QAAQ,WAAW,WAAW,QAAQ,QAAQ,WAAW;KACzD,QAAQ,WAAW,kBAAkB,QAAQ,QAAQ,WAAW;GACnE;GAEA,IAAI,OAAO,OAAO,MAAM,CAAC,CAAC,MAAM,UAAU,UAAU,KAAA,CAAS,GAC3D,OAAO,OAAO,YAAY;GAC5B,MAAM,IAAI,kBAAkB,OAAO;GAEnC,OAAO;IACL,SAAS,KAAA;IACT,YAAY,CACV,OAAO,UACL,SACG,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,IAAI,MAAM,CAAC,CACX,MACC,IACE,GAAG,EAAE,UAAU,WAAW,QAAQ,GAClC,GAAG,EAAE,WAAW,QAAQ,GACxB,GAAG,EAAE,cAAc,WAAW,YAAY,GAC1C,GACE;KACE,CAAC,EAAE,UAAU,WAAW,QAAQ;KAChC,CAAC,EAAE,WAAW,QAAQ;KACtB,CAAC,EAAE,cAAc,WAAW,YAAY;KACxC,CAAC,EAAE,oBAAoB,WAAW,kBAAkB;KACpD,CAAC,EAAE,iBAAiB,WAAW,eAAe;KAC9C,CAAC,EAAE,UAAU,SAAS,MAAM,WAAW,QAAQ,CAAC;KAChD,CAAC,EAAE,eAAe,WAAW,aAAa;IAC5C,CAAC,CACD,KAAK,CAAC,QAAQ,WACd,OAAO,UAAU,WACb,GAAG,QAAQ,OAAO,mBAAmB,IAAI,MAAM,OAAO,MAAM,EAAE,aAC9D,GAAG,QAAQ,KAAK,CACtB,CACF,CACF,CACJ,CACF;GACF;EACF,CAAC,CACH;EACF,iBAAiB,UACf,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,OAAO;GAExB,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;GACrD,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;GACzE,MAAM,WAAW,OAAO,kBAAkB,SAAS,eAAe,EAAA,CAAG;GAErE,IACE,YAAY,KAAA,KACZ,CAAC,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,GAE/D,OAAO,OAAO,KAAK;GAErB,MAAM,cAAc,OAAO,qBACzB,SACA,MAAM,UACN,eACF,EAAA,CAAG;GAEH,IAAI,eAAe,KAAA,GAAW,OAAO,OAAO,KAAK;GACjD,MAAM,KAAK,kBAAkB,OAAO;GAOpC,MAAM,cAAa,OALQ,SACxB,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,GAAG,GAAG,WAAW,eAAe,CAAC,EAAA,CAEX,MAAM,QAAa,QAAQ,WAAW,UAAU,GAAG,CAAC;GAEnF,IAAI,eAAe,KAAA,GAAW,OAAO,OAAO,KAAK;GAEjD,OAAO,OAAO,KACZ,OAAO,QAAQ,WACZ,OAAO;IAAE,UAAU,MAAM;IAAU;IAAS;IAAY;GAAW,CAAC,CAAC,CACrE,KAAK,OAAO,QAAQ,0BAA0B,CAAC,CACpD;EACF,CAAC;EACH,iBAAiB,UACf,OAAO,IAAI,aAAa;GACtB,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;GACrD,MAAM,WAAW,OAAO,kBAAkB,SAAS,MAAM,UAAU,MAAM,UAAU;GAEnF,OAAO,UAAU,aAAa,KAAA,KAC5B,SAAS,SAAS,+BAA+B,KAAA,IAC/C,OAAO,KAAK,IACZ,OAAO,KAAK,SAAS,QAAQ;EACnC,CAAC;EACH,cACE,YACA,YAEA,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,sBAAsB,UAAU;GAErD,MAAM,eAAe,OAAO,SAC1B,QAAQ,sBACR,QAAQ,wBACV;GAEA,MAAM,qBAAqB,OAAO,SAChC,QAAQ,kBACR,QAAQ,oBACV;GAEA,MAAM,kBAAkB,OAAO,SAC7B,QAAQ,kBACR,QAAQ,oBACV;GAEA,MAAM,uBAAuB,OAAO,6BAClC,SACA,MAAM,iBAAiB,gBACzB;GAEA,IAAI,yBAAyB,MAAM,iBAAiB,kBAClD,OAAO,OAAO,YAAY;GAE5B,OAAO,OAAO,IACZ,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO;IAEvB,MAAM,WAAW,OAAO,mBAAmB,SAAS,OAAO;KACzD;KACA;KACA;KACA;IACF,CAAC;IAED,IAAI,aAAa,KAAA,GACf,OAAO;KAAE,SAAS,QAAQ,YAAY,OAAO;KAAG,YAAY,CAAC;IAAE;IAEjE,OAAO;KACL,SAAS,QAAQ,WAAW,OAAO;KACnC,YAAY,SAAS;KACrB,gBAAgB,CAAC,OAAO,UAAU,SAAS,kBAAkB,SAAS,MAAM,CAAC;KAC7E,WAAW,SAAS;IACtB;GACF,CAAC,CACH;EACF,CAAC;EACH,mBACE,YACA,YAEA,OAAO,QAAQ,sBAAsB,UAAU,IAAI,UACjD,gBAAgB,SAAS,cAAc,OAAO,SAAS,iBAAiB,CAC1E;EACF,aAAa,UACX,iBAAiB,KAAA,IACb,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI,aAAa;GACtB,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;GACrD,IACE,MAAM,SAAS,UAAU,KACzB,CAAC,MAAM,SAAS,SAAS,QAAQ,KACjC,MAAM,YAAY,oBAClB,MAAM,QAAQ,SAAS,WAEvB,OAAO;GACT,MAAM,UAAU,MAAM;GAEtB,MAAM,WAAW,OAAO,kBACtB,SACA,MAAM,SAAS,MAAM,GAAG,EAAgB,GACxC,QAAQ,YACR,QAAQ,SAAS,SACnB;GAaA,OAVE,UAAU,aAAa,KAAA,KACvB,SAAS,SAAS,SAAS,qBAAqB,QAAQ,SAAS,oBACjE,QAAQ,SAAS,YAAY,OAAO,SAClC,SAAS,SAAU,SAAS,YAAY,MACrC,YACC,QAAQ,iBAAiB,KAAK,gBAC9B,QAAQ,aAAa,KAAK,QAC9B,CACF,IAEe,OAAO,qBAAqB,cAAc,KAAK,IAAI;EACtE,CAAC;EACP,iBACE,YACA,YAEA,iBAAiB,KAAA,IACb,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,QAAQ,sBAAsB,UAAU,IAAI,aACjD,gBACE,SACA,cACA,OAAO,OAAO;GAAE,GAAG;GAAU,YAAY,WAAW;EAAW,CAAC,GAChE,SACA,gBACF,CACF;CACR;AACF;AAEA,MAAM,6BAA6B,OAAO,GAAG,8CAA8C,CAAC,CAC1F,WACE,SACA,OACA,QACA,WAKA;CACA,MAAM,EAAE,oBAAoB,iBAAiB,yBAAyB;CACtE,MAAM,YAAY,OAAO,cAAc,SAAS,OAAO,MAAM;CAE7D,MAAM,UACJ,cAAc,KAAA,KAAa,MAAM,eAAe,KAAA,IAC5C,KAAA,KACC,OAAO,qBAAqB,SAAS,MAAM,UAAU,UAAU,eAAe,EAAA,CAAG;CAExF,MAAM,iBACJ,YAAY,KAAA,KACZ,QAAQ,QAAQ,WAAW,kBAAkB,MAAM,WAAY,gBAC/D,QAAQ,QAAQ,WAAW,wBAAwB,MAAM,WAAY,sBACrE,QAAQ,QAAQ,WAAW,qBAAqB,MAAM,WAAY,mBAClE,QAAQ,QAAQ,WAAW,cAAc,SAAS,MAAM,MAAM,WAAY,QAAQ,KAClF,QAAQ,QAAQ,WAAW,mBAAmB,MAAM,WAAY;CAElE,IAAI,cAAc,KAAA,KAAa,CAAC,gBAAgB,OAAO,KAAA;CACvD,MAAM,MAAM,OAAO,oBAAoB,OAAO;CAE9C,MAAM,QAAQ,IACZ,UAAU,WACV,2BAA2B,SAAS,OAAO,UAAU,eAAe,GACpE,uBAAuB,SAAS,MAAM,UAAU,MAAM,SAAS,CACjE;CAEA,MAAM,SAAS,8BAA8B,OAAO,GAAG,MAAM;CA2B7D,OAAO;EAAE,mBAAA;GAxBP,YAAY,CACV,OAAO,UAAU,OAAO,MAAM,GAC9B,GAAI,OAAO,mBACT,SACA,OACA,UAAU,iBACV;IAAE;IAAoB;IAAiB;GAAqB,GAC5D,GACF,CACF;GACA,kBAAkB,mBAChB,SACA,OACA,UAAU,iBACV;IACE;IACA;IACA;GACF,GACA,KACA,UAAU,mBACZ;EAGuB;EAAG;CAAO;AACrC,CACF;AAEA,MAAM,kBAAkB,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,SACA,cAGA,OACA,SACA,QACA;CACA,MAAM,qBAAqB,OAAO,SAChC,QAAQ,kBACR,QAAQ,oBACV;CAEA,MAAM,kBAAkB,OAAO,SAAS,QAAQ,kBAAkB,QAAQ,oBAAoB;CAE9F,MAAM,uBAAuB,OAAO,6BAClC,SACA,MAAM,iBAAiB,gBACzB;CAEA,IACE,yBAAyB,MAAM,iBAAiB,oBAC/C,MAAM,eAAe,KAAA,KAAa,uBAAuB,MAAM,WAAW,oBAE3E,OAAO,OAAO,YAAY;CAE5B,MAAM,UAAU,OAAO;CAEvB,MAAM,mBAAmB,OAAO,2BAA2B,SAAS,OAAO,QAAQ;EACjF;EACA;EACA;CACF,CAAC;CAED,IAAI,qBAAqB,KAAA,GACvB,OAAO;EAAE,SAAS,QAAQ,YAAY,OAAO;EAAG,YAAY,CAAC;CAAE;CACjE,MAAM,EAAE,mBAAmB,WAAW;CAEtC,IAAI,WAAW,kBAAkB;EAC/B,IACE,iBAAiB,KAAA,KACjB,MAAM,eAAe,KAAA,KACrB,CAAC,0BACC,KACF,GAEA,OAAO;GAAE,SAAS,QAAQ,YAAY,OAAO;GAAG,YAAY,CAAC;EAAE;EACjE,IAAI;EAEJ,MAAM,WAAW,OAAO,6BACtB,cACA,MAAM,YACN,oBACC,aAAsC;GACrC,kBAAkB,QAAQ,aAAa,cAAc,YAAY,YAAY,OAAO;GAEpF,OAAO;EACT,CACF;EAEA,OAAO;GACL,SAAS,mBAAmB,QAAQ,YAAY,OAAO;GACvD,YAAY,SAAS;GACrB,GAAI,SAAS,mBAAmB,KAAA,IAAY,CAAC,IAAI,EAAE,gBAAgB,SAAS,eAAe;GAC3F,YAAY,UACV,eAAe,OAAO,MAAM,KAC5B,eACE,OACA,oCAAoC,MAAM,WAAW,MAAM,gBAC7D,KACA,eACE,OACA,qCAAqC,MAAM,WAAW,MAAM,gBAC9D;EACJ;CACF;CAEA,MAAM,UAAU,OAAO,UAAU,kBAAkB,kBAAkB,MAAM;CAE3E,OAAO;EACL,SAAS,QAAQ,WAAW,OAAO;EACnC,YAAY,CAAC,GAAG,kBAAkB,YAAY,OAAO;EACrD,gBAAgB,CAAC,OAAO;EACxB,YAAY,UAAmB,eAAe,OAAO,MAAM;CAC7D;AACF,CAAC;AAED,MAAa,oCAAoC,OAAO,WAAW,WAQjE,SACA,cAcA;CACA,MAAM,WAAW,OAAOC;CAExB,OAAO,uBAAuB;EAAE,GAAG;EAAS,OAAO;CAAa,CAAC,CAAC,CAAC,KACjE,OAAO,qBAAqB,gBAAgB,eAAeA,QAAe,CAAC,GAC3E,OAAO,SAAS,WAAW,CAC7B;CAEA,MAAM,QAAQ,OAAO;CACrB,MAAM,QAAQ,kBAAkB,SAA+B,YAAY;CAE3E,MAAM,aAAa,OAAO,IAAI,aAAa;EACzC,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;EACrD,OAAO,kBAAkB,aAAa,SAAS,QAAQ,kBAAkB;CAC3E,CAAC;CAED,MAAM,OAAsB,SAC1B,OAAO,IAAI,aAAa;EACtB,OAAO;EAEP,OAAO,OAAO,kBAAkB,MAAM,CAAC;CACzC,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,2BAA2B,QAAQ,GACzD,OAAO,eAAe,gBAAgB,KAAK,CAC7C;CAyCF,OAAO,EAAE,qBAAqB;EAtC5B,iBAAiB,UACf,WAAW,KACT,OAAO,QAAQ,MAAM,eAAe,KAAK,CAAC,GAC1C,OAAO,eAAe,2BAA2B,QAAQ,GACzD,gBACF;EACF,kBAAkB,UAAU,IAAI,MAAM,gBAAgB,KAAK,CAAC,CAAC,CAAC,KAAK,gBAAgB;EACnF,iBAAiB,UACf,MACG,eAAe,KAAK,CAAC,CACrB,KACC,OAAO,eAAe,2BAA2B,QAAQ,GACzD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACJ,iBAAiB,UACf,MACG,eAAe,KAAK,CAAC,CACrB,KACC,OAAO,eAAe,2BAA2B,QAAQ,GACzD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACJ,cAAc,OAAO,YAAY,IAAI,MAAM,YAAY,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,gBAAgB;EAC7F,mBAAmB,OAAO,YACxB,IAAI,MAAM,iBAAiB,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,gBAAgB;EACnE,aAAa,UACX,MACG,WAAW,KAAK,CAAC,CACjB,KACC,OAAO,eAAe,2BAA2B,QAAQ,GACzD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACJ,iBAAiB,OAAO,YACtB,IAAI,MAAM,eAAe,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,gBAAgB;CAG/B,EAAE;AACxC,CAAC;;;;;;AASD,SAAgB,gCAad,SACA,SAMA,MAKA;CACA,OAAO,OAAO,QAAQ,eAAe,OAAO,IAAI,aAC9C,OAAO,IAAI,aAAa;EACtB,OAAO,uBAAuB;GAC5B,GAAG,QAAQ;GACX,OAAO,QAAQ;EACjB,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;EACpC,MAAM,QAAQ,OAAO;EAErB,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;EA6HrD,QAAO,OA3He,uBAElB,OAAO,IAAI,aAAa;GACtB,MAAM,aAA+B,CAAC;GACtC,IAAI;GAEJ,MAAM,kBAAkB,kBAAkB,GAAG,EAC3C,SAAS,cAAc,OAAO,WAAW,WAAW,KAAK,SAAS,CAAC,EACrE,CAAC;GAED,MAAM,QAAQ,OAAO,YAAY,YAAY,CAAC,CAAC,CAAC,KAC9C,OAAO,eAAe,mBAAmB,eAAe,CAC1D;GAEA,MAAM,QAAQ,kBACZ,QAAQ,SACR,QAAQ,YACV;GAEA,MAAM,OAAsB,SAC1B,uBAEI,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO;IACvB,MAAM,UAAU,OAAO;IAEvB,OAAO,MAAM;IACb,IAAI,aAAa,KAAA,GAAW,OAAO,OAAO,YAAY;IACtD,MAAM,UAAU;KAAE,GAAG;KAAS,cAAc,QAAQ,QAAQ,KAAA,CAAS;IAAE;IAEvE,WAAW;IACX,WAAW,KAAK,GAAG,QAAQ,UAAU;IAErC,OAAO,QAAQ;GACjB,CAAC,GACH,EAAE,MAAM,QAAQ,CAClB,CAAC,CAAC,KACA,OAAO,KAAK,WAAW,OAAO,KAAK,GACnC,OAAO,eAAe,2BAA2B,QAAQ,GACzD,OAAO,eAAe,gBAAgB,KAAK,CAC7C;GAoDF,MAAM,WAAW,QAAQ,KAAK,qBAAqB;IAjDjD,iBAAiB,UACf,MAAM,IACJ,MACG,eAAe,KAAK,CAAC,CACrB,KACC,OAAO,eAAe,2BAA2B,QAAQ,GACzD,gBACF,CACJ;IACF,kBAAkB,UAChB,MAAM,IAAI,IAAI,MAAM,gBAAgB,KAAK,CAAC,CAAC,CAAC,KAAK,gBAAgB,CAAC;IACpE,iBAAiB,UACf,MAAM,IACJ,MACG,eAAe,KAAK,CAAC,CACrB,KACC,OAAO,eAAe,2BAA2B,QAAQ,GACzD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF,CACJ;IACF,iBAAiB,UACf,MAAM,IACJ,MACG,eAAe,KAAK,CAAC,CACrB,KACC,OAAO,eAAe,2BAA2B,QAAQ,GACzD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF,CACJ;IACF,cAAc,OAAO,YACnB,MAAM,IAAI,IAAI,MAAM,YAAY,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,gBAAgB,CAAC;IACzE,mBAAmB,OAAO,YACxB,MAAM,IAAI,IAAI,MAAM,iBAAiB,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,gBAAgB,CAAC;IAC9E,aAAa,UACX,MAAM,IACJ,MACG,WAAW,KAAK,CAAC,CACjB,KACC,OAAO,eAAe,2BAA2B,QAAQ,GACzD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF,CACJ;IACF,iBAAiB,OAAO,YACtB,MAAM,IAAI,IAAI,MAAM,eAAe,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,gBAAgB,CAAC;GAGrB,CAAC,CAAC,CAAC,KAC1D,QAAQ,IAAI,mBAAmB,MAAM,SAAS,CAChD;GAEA,MAAM,QAAQ,OAAO,MAAM,MAAM,OAAO,eAAe,MAAM,QAAQ,CAAC;GAEtE,IAAI,UAAU,iBAAiB,KAAA,GAAW;IACxC,MAAM,SAAS,OAAO,OAAO,OAAO,SAAS,aAAa,IAAI;IAE9D,IAAI,OAAO,SAAS,aAAa,OAAO,QAAQ,SAAS,iBACvD,OAAO,OAAO,YAAY;GAC9B;GAEA,OAAO,SAAS,QACb,MAAM,CAAC,GAAG,YAAY,GAAI,UAAU,kBAAkB,CAAC,CAAE,CAAC,CAAC,CAC3D,KACC,OAAO,YAAY,UACjB,OAAO,UACL,MAAM,IAAI,QAAQ,UAChB,oBAAoB,OAAO,UAAU,SAAS,IAAI,YAAY,IAAI,KACpE,CACF,CACF,GACA,gBACF;GAEF,OAAO;EACT,CAAC,GACH,EAAE,MAAM,QAAQ,CAClB,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC,EAAA,CAErC;CAChB,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,QAAQ,CAAC,CACzD;AACF;AAEA,MAAM,mBAAmB,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,UACA,WACA;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,SAAS,OAAO,QAAQ,aAAa,OAAO,QAAQ,aAAa,QAAQ;CAC/E,MAAM,UAAU,OAAO,QAAQ,aAAa,OAAO,QAAQ,aAAa,SAAS;CAEjF,OAAO,OAAO,SACX,OAAO,CAAC,CACR,KAAK,QAAQ,aAAa,KAAK,CAAC,CAChC,MAAM,IAAI,GAAG,QAAQ,QAAQ,GAAG,GAAG,SAAS,SAAS,CAAC,CAAC,CAAC,CACxD,MAAM,CAAC;AACZ,CAAC;AAED,MAAM,6BAA6B,OAAO,GAAG,oCAAoC,CAAC,CAAC,WAEjF,SAA4C,YAA6B;CACzE,MAAM,WAAW,OAAO;CAExB,MAAM,YAAY,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;CAC/E,MAAM,QAAQ,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,KAAK;CAEvE,OAAO,OAAO,SACX,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,IAAI,GAAG,WAAW,WAAW,SAAS,GAAG,GAAG,OAAO,WAAW,KAAK,CAAC,CAAC,CAAC,CAC5E,MAAM,CAAC;AACZ,CAAC;AAED,MAAM,mBAAmB,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,OAOA,WASA,SACA;CACA,MAAM,WAAW,OAAO;CACxB,MAAM,UAAU,OAAO;CAEvB,MAAM,YAAY,OAAO,iBAAiB,SAAS,MAAM,UAAU,MAAM,SAAS,EAAA,CAAG;CAErF,IAAI,aAAa,KAAA,GACf,OAAO;EACL,SAAS,QAAQ,OAAO,QAAQ,aAAa,aAAa,QAAQ,GAAG,OAAO;EAC5E,YAAY,CAAC;CACf;CAEF,MAAM,SAAS;EACb,UAAU,MAAM;EAChB,WAAW,MAAM;EACjB,YAAY,MAAM;EAClB,cAAc,MAAM;EACpB,aAAa,MAAM;CACrB;CAEA,IAAI,QAAQ,SAAS,WAAW;EAC9B,IAAI,UAAU,sBAAsB,KAAA,GAAW,OAAO,OAAO,YAAY;EAEzE,OAAO;GACL,SAAS,QAAQ;IAAE,MAAM;IAAW,WAAW,UAAU;GAAkB,GAAG,OAAO;GACrF,YAAY,CACV,OAAO,UACL,SAAS,OAAO,QAAQ,aAAa,KAAK,CAAC,CAAC,OAC1C,QAAQ,aAAa,aAAa,QAAQ;IACxC,OAAO;IACP,mBAAmB,UAAU;GAC/B,CAAC,CACH,CACF,CACF;GACA,YAAY,UAAmB,2BAA2B,QAAQ,mBAAmB,KAAK;EAC5F;CACF;CACA,IAAI,QAAQ,aAAa,WAAW,eAAe,UAAU,oBAAoB,KAAA,GAC/E,OAAO,OAAO,YAAY;CAC5B,KAAK,OAAO,2BAA2B,SAAS,MAAM,UAAU,EAAA,CAAG,SAAS,GAC1E,OAAO;EAAE,SAAS,QAAQ,EAAE,MAAM,aAAa,GAAG,OAAO;EAAG,YAAY,CAAC;CAAE;CAC7E,MAAM,kBAAkB,UAAU;CAGlC,OAAO;EACL,SAAS,QAAQ;GAAE,MAAM;GAAW,WAAA,OAHb,QAAQ,UAAU,UAAU,eAAe;EAGpB,GAAG,OAAO;EACxD,YAAY;GACV,OAAO,UACL,SAAS,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,OACrC,QAAQ,aAAa,oBAAoB,QAAQ;IAC/C;IACA,kBAAkB,UAAU;GAC9B,CAAC,CACH,CACF;GACA,OAAO,UACL,SACG,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,OACC,QAAQ,WAAW,oBACjB,MAAM,YACN,iBACA,UAAU,kBACZ,CACF,CACJ;GACA,OAAO,UACL,SAAS,OAAO,QAAQ,WAAW,KAAK,CAAC,CAAC,OACxC,QAAQ,WAAW,aAAa;IAC9B,UAAU,MAAM;IAChB,WAAW;IACX,cAAc,UAAU;IACxB,oBAAoB,UAAU;IAC9B,iBAAiB,UAAU;IAC3B,aAAa,MAAM;GACrB,CAAC,CACH,CACF;GACA,OAAO,UACL,SAAS,OAAO,QAAQ,oBAAoB,KAAK,CAAC,CAAC,OACjD,QAAQ,oBAAoB,aAAa;IACvC,WAAW;IACX,cAAc,UAAU;IACxB,UAAU,UAAU;GACtB,CAAC,CACH,CACF;GACA,OAAO,UACL,SAAS,OAAO,QAAQ,aAAa,KAAK,CAAC,CAAC,OAC1C,QAAQ,aAAa,aAAa,QAAQ;IACxC,OAAO;IACP;GACF,CAAC,CACH,CACF;EACF;EACA,YAAY,UACV,2BAA2B,QAAQ,mBAAmB,KAAK,KAC3D,2BAA2B,QAAQ,sBAAsB,KAAK;CAClE;AACF,CAAC;AAED,MAAM,wBAAsC,YAC1C,OAAO,IAAI,aAAa;CACtB,MAAM,eAAe,OAAO,SAC1B,QAAQ,sBACR,QAAQ,wBACV;CAEA,MAAM,mBAAmB,OAAO,SAC9B,QAAQ,kBACR,QAAQ,oBACV;CAEA,MAAM,qBAAqB,OAAO,SAChC,QAAQ,kBACR,QAAQ,oBACV;CAEA,MAAM,qBAAqB,OAAO,SAChC,QAAQ,kBACR,QAAQ,oBACV;CAEA,MAAM,kBAAkB,OAAO,SAAS,QAAQ,kBAAkB,QAAQ,oBAAoB;CAE9F,MAAM,kBACJ,QAAQ,SAAS,YAAY,QAAQ,aAAa,WAAW,cACzD,KAAA,IACA,OAAO,SACL,QAAQ,aAAa,mBACrB,QAAQ,aAAa,qBACvB;CAEN,MAAM,oBACJ,QAAQ,SAAS,YACb,OAAO,SAAS,QAAQ,2BAA2B,QAAQ,6BAA6B,IACxF,KAAA;CAEN,OAAO;EACL;EACA;EACA;EACA;EACA;EACA,GAAI,oBAAoB,KAAA,IAAY,CAAC,IAAI,EAAE,gBAAgB;EAC3D,GAAI,sBAAsB,KAAA,IAAY,CAAC,IAAI,EAAE,kBAAkB;CACjE;AACF,CAAC;AAEH,MAAM,yBAAuC,aAAgD,EAC3F,WACE,OACA,YAEA,OAAO,IAAI,aAAa;CACtB,IAAI,CAAC,6BAA6B,OAAO,GAAG,OAAO,OAAO,YAAY;CACtE,IAAI,QAAQ,SAAS,YAAY,QAAQ,aAAa,WAAW,aAC/D,OAAO,OAAO,YAAY;CAC5B,MAAM,YAAY,OAAO,qBAAqB,OAAO;CAErD,OAAO,OAAO,iBAAiB,SAAS,OAAO,WAAW,OAAO;AACnE,CAAC,EACL;AAEA,MAAa,qCAAqC,OAAO,WAAW,WAQlE,SAA+E;CAC/E,MAAM,WAAW,OAAOA;CAExB,OAAO,uBAAuB,OAAO,CAAC,CAAC,KACrC,OAAO,qBAAqB,gBAAgB,eAAeA,QAAe,CAAC,GAC3E,OAAO,SAAS,WAAW,CAC7B;CAEA,MAAM,QAAQ,OAAO;CACrB,MAAM,QAAQ,sBAAsB,OAAuD;CAE3F,MAAM,OAAsB,SAC1B,OAAO,IAAI,aAAa;EACtB,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;EAErD,OAAO,OAAO,kBAAkB,MAAM,CAAC;CACzC,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,2BAA2B,QAAQ,GACzD,OAAO,eAAe,gBAAgB,KAAK,CAC7C;CAMF,OAAO,EAAE,uBAAuB,EAH9B,WAAW,OAAO,YAAY,IAAI,MAAM,SAAS,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,gBAAgB,EAGnD,EAAE;AAC1C,CAAC;AAED,SAAgB,iCAed,SACA,SAIA,MAKA;CACA,OAAO,OAAO,QAAQ,eAAe,OAAO,IAAI,aAC9C,OAAO,IAAI,aAAa;EACtB,OAAO,uBAAuB,QAAQ,OAAO,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;EAChF,MAAM,QAAQ,OAAO;EAErB,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;EA4ErD,QAAO,OA1Ee,uBAElB,OAAO,IAAI,aAAa;GACtB,MAAM,aAA+B,CAAC;GACtC,IAAI;GAEJ,MAAM,kBAAkB,kBAAkB,GAAG,EAC3C,SAAS,cAAc,OAAO,WAAW,WAAW,KAAK,SAAS,CAAC,EACrE,CAAC;GAED,MAAM,QAAQ,OAAO,YAAY,YAAY,CAAC,CAAC,CAAC,KAC9C,OAAO,eAAe,mBAAmB,eAAe,CAC1D;GAEA,MAAM,QAAQ,sBACZ,QAAQ,OACV;GAEA,MAAM,OAAsB,SAC1B,uBAEI,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO;IACvB,MAAM,UAAU,OAAO;IAEvB,OAAO,MAAM;IACb,IAAI,aAAa,KAAA,GAAW,OAAO,OAAO,YAAY;IACtD,MAAM,UAAU;KAAE,GAAG;KAAS,cAAc,QAAQ,QAAQ,KAAA,CAAS;IAAE;IAEvE,WAAW;IACX,WAAW,KAAK,GAAG,QAAQ,UAAU;IAErC,OAAO,QAAQ;GACjB,CAAC,GACH,EAAE,MAAM,QAAQ,CAClB,CAAC,CAAC,KACA,OAAO,KAAK,WAAW,OAAO,KAAK,GACnC,OAAO,eAAe,2BAA2B,QAAQ,GACzD,OAAO,eAAe,gBAAgB,KAAK,CAC7C;GAOF,MAAM,WAAW,QAAQ,KAAK,QAAQ,QAAQ,EAJ5C,WAAW,OAAO,YAChB,MAAM,IAAI,IAAI,MAAM,SAAS,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,gBAAgB,CAAC,EAGpB,CAAC,CAAC,CAAC,KACrD,QAAQ,IAAI,mBAAmB,MAAM,SAAS,CAChD;GAEA,MAAM,QAAQ,OAAO,MAAM,MAAM,OAAO,eAAe,MAAM,QAAQ,CAAC;GAEtE,IAAI,UAAU,iBAAiB,KAAA,GAAW;IACxC,MAAM,SAAS,OAAO,OAAO,OAAO,SAAS,aAAa,IAAI;IAE9D,IAAI,OAAO,SAAS,aAAa,OAAO,QAAQ,SAAS,iBACvD,OAAO,OAAO,YAAY;GAC9B;GACA,OAAO,SAAS,QAAQ,MAAM,UAAU,CAAC,CAAC,KACxC,OAAO,YAAY,UACjB,OAAO,UACL,MAAM,IAAI,QAAQ,UAChB,oBAAoB,OAAO,UAAU,SAAS,IAAI,YAAY,IAAI,KACpE,CACF,CACF,GACA,gBACF;GAEA,OAAO;EACT,CAAC,GACH,EAAE,MAAM,QAAQ,CAClB,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC,EAAA,CAErC;CAChB,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,QAAQ,CAAC,CACzD;AACF;;AAGA,MAAa,mBAAmB;CAC9B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAEA,MAAM,oBACJ,WAEA,yBACE,SACC,UACC,OAAO,GAAG,mBAAmB,CAAC,CAAC,KAAK,KACpC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,sBAAsB,CAAC,CAAC,KAAK,CAC3C,CAAC,CAAC,KAAK,OAAO,YAAY,UAAU,OAAO,UAAU,MAAM,IAAI,aAAa,YAAY,CAAC,CAAC,CAAC,CAAC;AAE9F,MAAM,qBACJ,MACA,UAAU,MAMV,OAAO,cAAc;CACnB,IAAI;CAgBJ,OAda,uBAET,OAAO,IAAI,aAAa;EACtB,MAAM,WAAW,OAAO;EACxB,MAAM,UAAU,OAAO;EAEvB,YAAY,QAAQ;EACpB,OAAO,SAAS,QAAQ,MAAM,QAAQ,UAAU;EAEhD,OAAO,QAAQ;CACjB,CAAC,GACH,EAAE,MAAM,QAAQ,CAClB,CAAC,CAAC,KAAK,OAAO,KAAK,WAAW,OAAO,KAAK,CAEhC,CAAC,CAAC,KACV,OAAO,YAAY,UACjB,UAAU,KAAK,oBAAoB,OAAO,SAAS,IAC/C,kBAAkB,MAAM,UAAU,CAAC,IACnC,OAAO,UAAU,KAAK,CAC5B,CACF;AACF,CAAC"}
+{"version":3,"file":"d1-passwords.mjs","names":["PersistenceMappingError","sameSnapshot","DatabaseService"],"sources":["../../src/drizzle/d1-passwords.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- D1 plans bridge consumer-owned Drizzle rows and SQL statements. */\nimport type { D1Client } from \"@effect/sql-d1/D1Client\";\nimport {\n  NativeDatabase,\n  requireStandalone,\n  samePasswordCredentialSnapshot as sameSnapshot,\n} from \"@yielded/auth-persistence/Adapter\";\nimport {\n  coordinateCommit,\n  CurrentCommitJournal,\n  hasCommitScope,\n  type CommitJournal,\n  type PreparedCommit,\n  LifecycleHooks,\n  HookConfigurationError,\n} from \"@yielded/auth/Hooks\";\nimport type { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport {\n  EncodedPasswordHash,\n  PasswordUnavailable,\n  PasswordPersistence,\n  type PasswordMutationInput,\n  type PreparePasswordCommit,\n  snapshotPasswordCredential,\n  snapshotPasswordRequirement,\n  snapshotPasswordRevision,\n  type PasswordAction,\n  type PasswordMutationDecision,\n} from \"@yielded/auth/Password\";\nimport { reportPersistenceFailure } from \"@yielded/auth/Persistence\";\nimport {\n  type ProofCompletionPlan,\n  type ProofCompletionDecision,\n  type ProofCompletionInput,\n  ProofUnavailable,\n} from \"@yielded/auth/Proofs\";\nimport {\n  snapshotAuthenticationEvidence,\n  AuthenticationEvidence,\n  AuthenticationRequirement,\n  type SecurityRevision,\n} from \"@yielded/auth/Sessions\";\nimport {\n  and,\n  eq,\n  getTableColumns,\n  inArray,\n  sql,\n  type AnyRelations,\n  type SQL,\n  type Table,\n} from \"drizzle-orm\";\nimport type { EffectSQLiteD1Database } from \"drizzle-orm/effect-d1\";\nimport type { AnySQLiteTable } from \"drizzle-orm/sqlite-core\";\nimport { Cause, DateTime, Effect, Option, Predicate, Redacted, Schema, Context } from \"effect\";\nimport type { Statement } from \"effect/sql/Statement\";\n\nimport { Database as DatabaseService } from \"./d1-database\";\nimport { balancedD1And } from \"./d1-generated-statement\";\nimport { CurrentD1PlanningDatabase, makeD1Owner } from \"./d1-planning\";\nimport { compileD1ProofCompletionPlan, type D1ProtectedProofMutation } from \"./d1-proofs\";\nimport { D1BatchStatements } from \"./D1BatchStatements\";\nimport { column, isMappedConstraintConflict, PersistenceMappingError, updateValues } from \"./model\";\nimport { nativeDatabase } from \"./native-database\";\nimport {\n  type AnyPasswordRegistrationMapping,\n  type D1PasswordPersistenceMapping,\n  type PasswordRegistrationMapping,\n  requiredPasswordConstraints,\n  requiredPasswordRegistrationConstraints,\n} from \"./password-model\";\nimport type { PasswordRegistrationAuthority } from \"./password-registration\";\nimport type { D1ProofPersistenceMapping } from \"./proof-model\";\nimport { validateDrizzleStorage } from \"./storage-validation\";\nimport type { SuppliedService } from \"./SuppliedService\";\n\ntype PlanPrepare<Method extends (...args: any[]) => any, A> = (\n  value: Parameters<Parameters<Method>[1]>[0],\n  journal: CommitJournal,\n) => PreparedCommit<A>;\n\ntype Database = EffectSQLiteD1Database<AnyRelations> & { readonly $client: D1Client };\ntype Mapping = D1PasswordPersistenceMapping<Table, Table, Table, Table, Table, unknown>;\ntype RegistrationMapping<Registration> = AnyPasswordRegistrationMapping<Registration>;\n\ninterface Planned<A> {\n  readonly receipt: A;\n  readonly statements: ReadonlyArray<Statement<any>>;\n  /** Final-state guards without `changes()`, repeated after coordinated statements. */\n  readonly postconditions?: ReadonlyArray<Statement<any>>;\n  readonly retryable?: (cause: unknown) => boolean;\n  readonly journalGuard?: PreparedCommit<void>;\n}\n\nconst unavailable = () => PasswordUnavailable.make({});\n\nconst everyFailureMatches = (\n  cause: Cause.Cause<unknown>,\n  classify: ((cause: unknown) => boolean) | undefined,\n): boolean =>\n  classify !== undefined &&\n  cause.reasons.length > 0 &&\n  cause.reasons.every((reason) => Cause.isFailReason(reason) && classify(Cause.fail(reason.error)));\n\nconst validConstraints = (mapping: Mapping) =>\n  Object.entries(requiredPasswordConstraints).every(\n    ([key, value]) =>\n      mapping.constraints[key as keyof typeof requiredPasswordConstraints] === value,\n  );\n\nconst validRegistrationConstraints = <Registration>(mapping: RegistrationMapping<Registration>) =>\n  Object.entries(requiredPasswordRegistrationConstraints).every(\n    ([key, value]) =>\n      mapping.constraints[key as keyof typeof requiredPasswordRegistrationConstraints] === value,\n  );\n\nconst containsFailure = (failure: unknown, predicate: (value: unknown) => boolean): boolean => {\n  const seen = new Set<unknown>();\n  const pending: Array<unknown> = [failure];\n\n  for (let inspected = 0; inspected < 32 && pending.length > 0; inspected++) {\n    const current = pending.shift();\n\n    if (current === undefined || current === null || seen.has(current)) continue;\n    seen.add(current);\n    if (predicate(current)) return true;\n    if (Cause.isCause(current)) {\n      for (const reason of current.reasons) {\n        if (Cause.isFailReason(reason)) pending.push(reason.error);\n        else if (Cause.isDieReason(reason)) pending.push(reason.defect);\n      }\n      continue;\n    }\n    if (typeof current !== \"object\") continue;\n\n    const wrapped = current as {\n      readonly cause?: unknown;\n      readonly reason?: unknown;\n      readonly message?: unknown;\n    };\n\n    if (wrapped.cause !== undefined) pending.push(wrapped.cause);\n    if (wrapped.reason !== undefined) pending.push(wrapped.reason);\n    if (wrapped.message !== undefined) pending.push(wrapped.message);\n  }\n\n  return false;\n};\n\n// Match only workerd's native SQLite diagnostic. A wrapper that merely echoes\n// the bound marker is not evidence that the guard ran and rolled back the batch.\nconst isGuardFailure = (cause: unknown, marker: string) => {\n  const path = `$[${marker.replaceAll(\"'\", \"''\")}]`;\n  const native = `bad JSON path: '${path}': SQLITE_ERROR`;\n\n  return containsFailure(cause, (value) => value === native || value === `D1_ERROR: ${native}`);\n};\n\nconst statement = Effect.fn(function* (query: {\n  readonly toSQL: () => { readonly sql: string; readonly params: unknown[] };\n}) {\n  const database = yield* CurrentD1PlanningDatabase;\n  const rendered = query.toSQL();\n\n  return database.$client.unsafe(rendered.sql, rendered.params);\n});\n\nconst assertion = Effect.fn(function* (condition: SQL, marker: string) {\n  const database = yield* CurrentD1PlanningDatabase;\n\n  return yield* statement(\n    database\n      .select({\n        ok: sql`case when ${condition} then 1 else json_extract('[]', ${`$[${marker}]`}) end`.as(\n          \"ok\",\n        ),\n      })\n      .from(sql`(select 1)`),\n  );\n});\n\nconst readEngineNowMillis = Effect.fn(\"Drizzle.readEngineNowMillis\")(function* (mapping: Mapping) {\n  const database = yield* CurrentD1PlanningDatabase;\n\n  return yield* database\n    .select({ value: mapping.d1.engineNowMillis.as(\"engine_now_millis\") })\n    .from(sql`(select 1)`)\n    .pipe(\n      Effect.flatMap((rows) => {\n        const value = Number(rows[0]?.value);\n\n        return Number.isFinite(value) ? Effect.succeed(value) : Effect.fail(unavailable());\n      }),\n    );\n});\n\nconst allocate = <A>(\n  asyncValue: Effect.Effect<A, PersistenceMappingError> | undefined,\n  syncValue: (() => A) | undefined,\n) =>\n  asyncValue !== undefined\n    ? asyncValue\n    : syncValue === undefined\n      ? Effect.fail(unavailable())\n      : Effect.try({\n          try: syncValue,\n          catch: (cause) => new PersistenceMappingError({ operation: \"mapping\", cause }),\n        });\n\nconst allocateNextSecurityRevision = (mapping: Mapping, current: SecurityRevision) =>\n  allocate(\n    mapping.subject.nextSecurityRevision?.(current) ?? mapping.allocateRevision,\n    mapping.subject.nextSecurityRevisionSync === undefined\n      ? mapping.allocateRevisionSync\n      : () => mapping.subject.nextSecurityRevisionSync!(current),\n  );\n\nconst subjectColumns = (mapping: Mapping) => ({\n  id: column(mapping.subject.table, mapping.subject.id),\n  status: column(mapping.subject.table, mapping.subject.status),\n  securityRevision: column(mapping.subject.table, mapping.subject.securityRevision),\n});\n\nconst identifierColumns = (mapping: Mapping) => ({\n  namespace: column(mapping.identifier.table, mapping.identifier.namespace),\n  value: column(mapping.identifier.table, mapping.identifier.value),\n  subjectId: column(mapping.identifier.table, mapping.identifier.subjectId),\n  verifiedAt: column(mapping.identifier.table, mapping.identifier.verifiedAt),\n  bindingRevision: column(mapping.identifier.table, mapping.identifier.bindingRevision),\n});\n\nconst credentialColumns = (mapping: Mapping) => ({\n  moduleId: column(mapping.credential.table, mapping.credential.moduleId),\n  subjectId: column(mapping.credential.table, mapping.credential.subjectId),\n  credentialId: column(mapping.credential.table, mapping.credential.credentialId),\n  credentialRevision: column(mapping.credential.table, mapping.credential.credentialRevision),\n  verifierVersion: column(mapping.credential.table, mapping.credential.verifierVersion),\n  verifier: column(mapping.credential.table, mapping.credential.verifier),\n  normalization: column(mapping.credential.table, mapping.credential.normalization),\n});\n\nconst authorityColumns = (mapping: Mapping) => ({\n  subjectId: column(mapping.authorityCredential.table, mapping.authorityCredential.subjectId),\n  credentialId: column(mapping.authorityCredential.table, mapping.authorityCredential.credentialId),\n  revision: column(mapping.authorityCredential.table, mapping.authorityCredential.revision),\n  status:\n    mapping.authorityCredential.status === undefined\n      ? undefined\n      : column(mapping.authorityCredential.table, mapping.authorityCredential.status),\n});\n\nconst commandColumns = (mapping: Mapping) => ({\n  moduleId: column(mapping.command.table, mapping.command.moduleId),\n  commandId: column(mapping.command.table, mapping.command.commandId),\n  action: column(mapping.command.table, mapping.command.action),\n  bindingDigest: column(mapping.command.table, mapping.command.bindingDigest),\n  decision: column(mapping.command.table, mapping.command.decision),\n  retentionUntil: column(mapping.command.table, mapping.command.retentionUntil),\n});\n\nconst readIdentifier = Effect.fn(\"Drizzle.readIdentifier\")(function* (\n  mapping: Mapping,\n  identifier: LoginIdentifier,\n) {\n  const database = yield* CurrentD1PlanningDatabase;\n\n  const c = identifierColumns(mapping);\n\n  return yield* database\n    .select()\n    .from(mapping.identifier.table)\n    .where(and(eq(c.namespace, identifier.namespace), eq(c.value, identifier.value)))\n    .limit(1);\n});\n\nconst readSubjectNative = Effect.fn(\"Drizzle.readSubjectNative\")(function* (\n  mapping: Mapping,\n  nativeSubjectId: unknown,\n) {\n  const database = yield* CurrentD1PlanningDatabase;\n\n  return yield* database\n    .select()\n    .from(mapping.subject.table)\n    .where(eq(subjectColumns(mapping).id, nativeSubjectId))\n    .limit(1);\n});\n\nconst readCredentialNative = Effect.fn(\"Drizzle.readCredentialNative\")(function* (\n  mapping: Mapping,\n  moduleId: string,\n  nativeSubjectId: unknown,\n) {\n  const database = yield* CurrentD1PlanningDatabase;\n\n  const c = credentialColumns(mapping);\n\n  return yield* database\n    .select()\n    .from(mapping.credential.table)\n    .where(and(eq(c.moduleId, moduleId), eq(c.subjectId, nativeSubjectId)))\n    .limit(1);\n});\n\nconst resolveCredential = Effect.fn(\"DrizzleD1Password.resolveCredential\")(function* (\n  mapping: Mapping,\n  moduleId: string,\n  identifier: LoginIdentifier,\n  requestedSubjectId?: string,\n) {\n  const identifierRow = (yield* readIdentifier(mapping, identifier))[0];\n\n  if (identifierRow === undefined || !mapping.identifier.isCurrent(identifierRow)) return undefined;\n  const nativeSubjectId = identifierRow[mapping.identifier.subjectId];\n  const subject = (yield* readSubjectNative(mapping, nativeSubjectId))[0];\n\n  if (subject === undefined || !mapping.subject.isActiveStatus(subject[mapping.subject.status]))\n    return undefined;\n  const subjectId = yield* mapping.subjectId.toSubject(nativeSubjectId);\n\n  if (requestedSubjectId !== undefined && subjectId !== requestedSubjectId) return undefined;\n  const credential = (yield* readCredentialNative(mapping, moduleId, nativeSubjectId))[0];\n\n  if (credential === undefined) return { nativeSubjectId, subject, identifier: identifierRow };\n\n  const snapshot = yield* mapping.credential\n    .decode({ moduleId, subject, identifier: identifierRow, credential })\n    .pipe(Effect.flatMap(snapshotPasswordCredential));\n\n  return { nativeSubjectId, subject, identifier: identifierRow, credential, snapshot };\n});\n\nconst evidenceProofsJson = Schema.encodeSync(\n  Schema.fromJsonString(AuthenticationEvidence.fields.proofs),\n);\n\nconst alternativesJson = Schema.encodeSync(\n  Schema.fromJsonString(AuthenticationRequirement.fields.alternatives),\n);\n\nconst assuranceCondition = (\n  mapping: Mapping,\n  evidence: PasswordMutationInput[\"authorization\"][\"evidence\"],\n  requirement: PasswordMutationInput[\"authorization\"][\"requirement\"],\n) => {\n  const proofs = evidenceProofsJson(evidence.proofs);\n  const fresh = sql`json_extract(proof.value, '$.verifiedAt') <= ${mapping.d1.engineNowMillis} and ${mapping.d1.engineNowMillis} - json_extract(proof.value, '$.verifiedAt') < ${requirement.maximumAgeMillis}`;\n\n  return sql`exists(\n    select 1 from json_each(${alternativesJson(requirement.alternatives)}) as alternative\n    where not exists(select 1 from json_each(${proofs}) as proof where json_extract(proof.value, '$.verifiedAt') > ${mapping.d1.engineNowMillis})\n    and not exists(select 1 from json_each(alternative.value, '$.factors') as factor where not exists(select 1 from json_each(${proofs}) as proof, json_each(proof.value, '$.factors') as held where ${fresh} and held.value = factor.value))\n    and (select count(distinct json_extract(proof.value, '$.credentialId')) from json_each(${proofs}) as proof where ${fresh}) >= json_extract(alternative.value, '$.minimumCredentials')\n    and exists(select 1 from json_each(${proofs}) as proof where ${fresh} and (json_extract(alternative.value, '$.userVerified') = 0 or json_extract(proof.value, '$.userVerified') = 1) and (json_extract(alternative.value, '$.phishingResistant') = 0 or json_extract(proof.value, '$.phishingResistant') = 1))\n  )`;\n};\n\nconst sameIdentifier = (left: LoginIdentifier, right: LoginIdentifier) =>\n  left.namespace === right.namespace && left.value === right.value;\n\nconst evidenceSatisfiedAt = (\n  evidence: PasswordMutationInput[\"authorization\"][\"evidence\"],\n  requirement: PasswordMutationInput[\"authorization\"][\"requirement\"],\n  now: number,\n) => {\n  if (evidence.proofs.length > 64 || evidence.revision.credentials.length > 64) return false;\n  const revisions = new Map<string, string>();\n\n  for (const revision of evidence.revision.credentials) {\n    if (revisions.has(revision.credentialId)) return false;\n    revisions.set(revision.credentialId, revision.revision);\n  }\n  if (evidence.proofs.some((proof) => !revisions.has(proof.credentialId))) return false;\n  if (evidence.proofs.some((proof) => now < DateTime.toEpochMillis(proof.verifiedAt))) return false;\n\n  const fresh = evidence.proofs.filter(\n    (proof) => now - DateTime.toEpochMillis(proof.verifiedAt) < requirement.maximumAgeMillis,\n  );\n\n  const factors = new Set(fresh.flatMap((proof) => proof.factors));\n  const credentials = new Set(fresh.map((proof) => proof.credentialId));\n\n  return requirement.alternatives.some(\n    (alternative) =>\n      alternative.factors.every((factor) => factors.has(factor)) &&\n      credentials.size >= alternative.minimumCredentials &&\n      fresh.some(\n        (proof) =>\n          (!alternative.userVerified || proof.userVerified) &&\n          (!alternative.phishingResistant || proof.phishingResistant),\n      ),\n  );\n};\n\nconst snapshotMutationInput = Effect.fn(\"DrizzleD1Password.snapshotMutationInput\")(function* (\n  input: PasswordMutationInput,\n) {\n  const expectedRevision = snapshotPasswordRevision(input.expectedRevision);\n\n  const evidence = yield* snapshotAuthenticationEvidence(input.authorization.evidence).pipe(\n    Effect.mapError(unavailable),\n  );\n\n  const requirement = yield* snapshotPasswordRequirement(input.authorization.requirement);\n\n  const credential =\n    input.credential === undefined\n      ? undefined\n      : yield* snapshotPasswordCredential(input.credential);\n\n  return Object.freeze({\n    ...input,\n    expectedRevision,\n    replacement: Object.freeze({\n      verifier: Redacted.make(Redacted.value(input.replacement.verifier)),\n      normalization: input.replacement.normalization,\n    }),\n    invalidation: Object.freeze({ ...input.invalidation }),\n    ...(credential === undefined ? {} : { credential }),\n    authorization: Object.freeze({\n      challenge: Object.freeze({\n        ...input.authorization.challenge,\n        revision: snapshotPasswordRevision(input.authorization.challenge.revision),\n      }),\n      evidence,\n      requirement,\n    }),\n  });\n});\n\nconst completionMatchesPassword = (\n  input: PasswordMutationInput & { readonly completion: ProofCompletionPlan },\n) => {\n  const completion = input.completion.input;\n  const binding = completion.binding;\n\n  if (\n    completion.moduleId !== `${input.moduleId}/reset` ||\n    completion.purpose !== \"password-reset\" ||\n    binding._tag !== \"Subject\" ||\n    input.credential === undefined ||\n    binding.revision.subjectId !== input.expectedRevision.subjectId ||\n    binding.revision.securityRevision !== input.expectedRevision.securityRevision ||\n    !sameIdentifier(binding.identifier, input.credential.identifier)\n  )\n    return false;\n\n  const expected = [...input.expectedRevision.credentials].sort((left, right) =>\n    left.credentialId.localeCompare(right.credentialId),\n  );\n\n  const actual = [...binding.revision.credentials].sort((left, right) =>\n    left.credentialId.localeCompare(right.credentialId),\n  );\n\n  return (\n    expected.length === actual.length &&\n    expected.every(\n      (item, index) =>\n        item.credentialId === actual[index]!.credentialId &&\n        item.revision === actual[index]!.revision,\n    )\n  );\n};\n\nconst probeProofCompletion = Effect.fn(\"DrizzleD1.probeProofCompletion\")(function* (\n  mapping: D1ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any>,\n  input: ProofCompletionInput,\n) {\n  const database = yield* CurrentD1PlanningDatabase;\n\n  const plan: ProofCompletionPlan = {\n    input,\n    prepare: (decision, journal, project) => journal.prepare(project(decision)),\n  };\n\n  const marker = `effect-auth-proof-guard:protected:${input.continuationId}`;\n\n  const once = coordinateCommit(\n    () =>\n      Effect.gen(function* () {\n        const compiled = yield* compileD1ProofCompletionPlan(\n          mapping,\n          plan,\n          { statements: [], appliedCondition: sql`false` },\n          () => false,\n        );\n\n        if (compiled.statements.length === 0) return false;\n        yield* database.$client.batch(compiled.statements);\n\n        return false;\n      }),\n    { mode: \"batch\" },\n  );\n\n  return yield* once.pipe(\n    Effect.as(false),\n    Effect.catchCause((cause) =>\n      isGuardFailure(cause, marker) ? Effect.succeed(true) : Effect.failCause(cause),\n    ),\n  );\n});\n\nconst identifierCurrentCondition = (\n  mapping: Mapping,\n  input: PasswordMutationInput,\n  nativeSubjectId: unknown,\n  nativeVerifiedAt: unknown,\n) => {\n  if (input.credential === undefined) return sql`true`;\n\n  const ic = identifierColumns(mapping),\n    snapshot = input.credential;\n\n  return and(\n    mapping.identifier.d1CurrentCondition({ identifier: snapshot.identifier, nativeSubjectId }),\n    sql`exists(select 1 from ${mapping.identifier.table} where ${ic.namespace} = ${sql.param(snapshot.identifier.namespace, ic.namespace)} and ${ic.value} = ${sql.param(snapshot.identifier.value, ic.value)} and ${ic.subjectId} = ${sql.param(nativeSubjectId, ic.subjectId)} and ${ic.bindingRevision} = ${sql.param(snapshot.identifierBindingRevision, ic.bindingRevision)} and ${Predicate.isNullish(nativeVerifiedAt) ? sql`${ic.verifiedAt} is null` : sql`${ic.verifiedAt} = ${sql.param(nativeVerifiedAt, ic.verifiedAt)}`})`,\n  )!;\n};\n\nconst readAuthority = Effect.fn(\"DrizzleD1Password.readAuthority\")(function* (\n  mapping: Mapping,\n  input: PasswordMutationInput,\n  action: PasswordAction,\n) {\n  const database = yield* CurrentD1PlanningDatabase;\n\n  if (\n    input.authorization.evidence.proofs.length > 64 ||\n    input.authorization.evidence.revision.credentials.length > 64\n  )\n    return undefined;\n\n  const revisionIds = new Set(\n    input.authorization.evidence.revision.credentials.map((item) => item.credentialId),\n  );\n\n  if (\n    revisionIds.size !== input.authorization.evidence.revision.credentials.length ||\n    input.authorization.evidence.proofs.some((proof) => !revisionIds.has(proof.credentialId))\n  )\n    return undefined;\n  const nativeSubjectId = yield* mapping.subjectId.toNative(input.expectedRevision.subjectId);\n  const subject = (yield* readSubjectNative(mapping, nativeSubjectId))[0];\n\n  if (\n    subject === undefined ||\n    !mapping.subject.isActiveStatus(subject[mapping.subject.status]) ||\n    subject[mapping.subject.securityRevision] !== input.expectedRevision.securityRevision ||\n    input.authorization.challenge.moduleId !== input.moduleId ||\n    input.authorization.challenge.action !== action ||\n    input.authorization.challenge.commandId !== input.commandId ||\n    input.authorization.challenge.revision.subjectId !== input.expectedRevision.subjectId ||\n    input.authorization.challenge.revision.securityRevision !==\n      input.expectedRevision.securityRevision ||\n    input.authorization.evidence.revision.subjectId !== input.expectedRevision.subjectId ||\n    input.authorization.evidence.revision.securityRevision !==\n      input.expectedRevision.securityRevision ||\n    (input.authorization.evidence.flowId as string) !== (input.commandId as string) ||\n    input.authorization.evidence.bindingDigest !== input.authorization.challenge.bindingDigest ||\n    (action === \"add-password\" &&\n      (input.credential !== undefined ||\n        input.authorization.challenge.targetCredentialId !== undefined)) ||\n    input.expectedRevision.credentials.some(\n      (expected) =>\n        !input.authorization.evidence.revision.credentials.some(\n          (actual) =>\n            actual.credentialId === expected.credentialId && actual.revision === expected.revision,\n        ),\n    )\n  )\n    return undefined;\n  let identifierCondition: SQL = sql`true`;\n\n  if (input.credential !== undefined) {\n    const identifier = (yield* readIdentifier(mapping, input.credential.identifier))[0];\n\n    if (\n      identifier === undefined ||\n      input.authorization.challenge.targetCredentialId !== input.credential.credentialId ||\n      !mapping.identifier.isCurrent(identifier) ||\n      !mapping.subjectId.equals(identifier[mapping.identifier.subjectId], nativeSubjectId) ||\n      identifier[mapping.identifier.bindingRevision] !== input.credential.identifierBindingRevision\n    )\n      return undefined;\n    const credential = (yield* readCredentialNative(mapping, input.moduleId, nativeSubjectId))[0];\n\n    if (credential === undefined) return undefined;\n\n    const snapshot = yield* mapping.credential.decode({\n      moduleId: input.moduleId,\n      subject,\n      identifier,\n      credential,\n    });\n\n    if (!sameSnapshot(snapshot, input.credential)) return undefined;\n    identifierCondition = identifierCurrentCondition(\n      mapping,\n      input,\n      nativeSubjectId,\n      identifier[mapping.identifier.verifiedAt],\n    );\n    const ic = identifierColumns(mapping);\n\n    identifierCondition = and(\n      identifierCondition,\n      sql`exists(select 1 from ${mapping.identifier.table} where ${ic.namespace} = ${sql.param(input.credential.identifier.namespace, ic.namespace)} and ${ic.value} = ${sql.param(input.credential.identifier.value, ic.value)} and ${ic.subjectId} = ${sql.param(nativeSubjectId, ic.subjectId)} and ${ic.bindingRevision} = ${sql.param(input.credential.identifierBindingRevision, ic.bindingRevision)})`,\n    )!;\n  }\n\n  const expected = [\n    ...new Map(\n      [\n        ...input.expectedRevision.credentials,\n        ...input.authorization.evidence.revision.credentials,\n      ].map((item) => [item.credentialId, item]),\n    ).values(),\n  ].sort((left, right) => left.credentialId.localeCompare(right.credentialId));\n\n  const ac = authorityColumns(mapping);\n\n  const rows =\n    expected.length === 0\n      ? []\n      : yield* database\n          .select()\n          .from(mapping.authorityCredential.table)\n          .where(\n            and(\n              eq(ac.subjectId, nativeSubjectId),\n              inArray(\n                ac.credentialId,\n                expected.map((item) => item.credentialId),\n              ),\n            ),\n          );\n\n  const sortedRows = [...rows].sort((left: any, right: any) =>\n    String(left[mapping.authorityCredential.credentialId]).localeCompare(\n      String(right[mapping.authorityCredential.credentialId]),\n    ),\n  );\n\n  if (\n    sortedRows.length !== expected.length ||\n    sortedRows.some(\n      (row: any, index) =>\n        row[mapping.authorityCredential.credentialId] !== expected[index]!.credentialId ||\n        row[mapping.authorityCredential.revision] !== expected[index]!.revision ||\n        (mapping.authorityCredential.status !== undefined &&\n          mapping.authorityCredential.isActiveStatus?.(row[mapping.authorityCredential.status]) !==\n            true),\n    )\n  )\n    return undefined;\n  const requirement = yield* mapping.subject.decodeActionRequirement(subject, action);\n  const engineNow = yield* readEngineNowMillis(mapping);\n\n  if (\n    !evidenceSatisfiedAt(\n      input.authorization.evidence,\n      input.authorization.requirement,\n      engineNow,\n    ) ||\n    !evidenceSatisfiedAt(input.authorization.evidence, requirement, engineNow)\n  )\n    return undefined;\n  if (\n    (input.invalidation.existingSessions === \"immediate\" ||\n      input.invalidation.existingSessions === \"cache-expiry\") &&\n    mapping.sessionInvalidation !== \"same-authority-immediate\"\n  )\n    return undefined;\n  const s = subjectColumns(mapping);\n\n  const credentialConditions = expected.map(\n    (item) =>\n      sql`exists(select 1 from ${mapping.authorityCredential.table} where ${ac.subjectId} = ${sql.param(nativeSubjectId, ac.subjectId)} and ${ac.credentialId} = ${sql.param(item.credentialId, ac.credentialId)} and ${ac.revision} = ${sql.param(item.revision, ac.revision)}${ac.status === undefined ? sql`` : sql` and ${ac.status} = ${sql.param(mapping.authorityCredential.d1ActiveStatusValue, ac.status)}`})`,\n  );\n\n  return {\n    nativeSubjectId,\n    subject,\n    requirement,\n    identifierCondition,\n    condition: balancedD1And(\n      sql`exists(select 1 from ${mapping.subject.table} where ${s.id} = ${sql.param(nativeSubjectId, s.id)} and ${s.status} = ${sql.param(mapping.subject.d1ActiveStatusValue, s.status)} and ${s.securityRevision} = ${sql.param(input.expectedRevision.securityRevision, s.securityRevision)})`,\n      identifierCondition,\n      ...credentialConditions,\n      assuranceCondition(mapping, input.authorization.evidence, input.authorization.requirement),\n      assuranceCondition(mapping, input.authorization.evidence, requirement),\n    )!,\n  };\n});\n\nconst commandAbsentCondition = (mapping: Mapping, moduleId: string, commandId: string) => {\n  const c = commandColumns(mapping);\n\n  return sql`not exists(select 1 from ${mapping.command.table} where ${c.moduleId} = ${sql.param(moduleId, c.moduleId)} and ${c.commandId} = ${sql.param(commandId, c.commandId)})`;\n};\n\nconst credentialCurrentCondition = (\n  mapping: Mapping,\n  input: PasswordMutationInput,\n  nativeSubjectId: unknown,\n) => {\n  const c = credentialColumns(mapping);\n\n  return input.credential === undefined\n    ? sql`false`\n    : sql`exists(select 1 from ${mapping.credential.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(nativeSubjectId, c.subjectId)} and ${c.credentialId} = ${sql.param(input.credential.credentialId, c.credentialId)} and ${c.credentialRevision} = ${sql.param(input.credential.credentialRevision, c.credentialRevision)} and ${c.verifierVersion} = ${sql.param(input.credential.verifierVersion, c.verifierVersion)} and ${c.verifier} = ${sql.param(Redacted.value(input.credential.verifier), c.verifier)} and ${c.normalization} = ${sql.param(input.credential.normalization, c.normalization)})`;\n};\n\nconst mutationStatements = Effect.fn(function* (\n  mapping: Mapping,\n  input: PasswordMutationInput,\n  nativeSubjectId: unknown,\n  revisions: {\n    readonly credentialRevision: SecurityRevision;\n    readonly verifierVersion: SecurityRevision;\n    readonly nextSecurityRevision: SecurityRevision;\n  },\n  now: number,\n) {\n  const database = yield* CurrentD1PlanningDatabase;\n  const c = credentialColumns(mapping);\n  const s = subjectColumns(mapping);\n  const ac = authorityColumns(mapping);\n\n  return [\n    yield* statement(\n      database\n        .update(mapping.credential.table)\n        .set(\n          mapping.credential.encodeReplacement({\n            replacement: input.replacement,\n            credentialRevision: revisions.credentialRevision,\n            verifierVersion: revisions.verifierVersion,\n          }),\n        )\n        .where(\n          and(\n            eq(c.moduleId, input.moduleId),\n            eq(c.subjectId, nativeSubjectId),\n            eq(c.credentialId, input.credential!.credentialId),\n            eq(c.credentialRevision, input.credential!.credentialRevision),\n            eq(c.verifierVersion, input.credential!.verifierVersion),\n            eq(c.verifier, Redacted.value(input.credential!.verifier)),\n            eq(c.normalization, input.credential!.normalization),\n          ),\n        ),\n    ),\n    yield* statement(\n      database\n        .update(mapping.subject.table)\n        .set(updateValues([[mapping.subject.securityRevision, revisions.nextSecurityRevision]]))\n        .where(\n          and(\n            eq(s.id, nativeSubjectId),\n            eq(s.securityRevision, input.expectedRevision.securityRevision),\n          ),\n        ),\n    ),\n    yield* statement(\n      database\n        .update(mapping.authorityCredential.table)\n        .set(mapping.authorityCredential.encodeRevision(revisions.credentialRevision))\n        .where(\n          and(\n            eq(ac.subjectId, nativeSubjectId),\n            eq(ac.credentialId, input.credential!.credentialId),\n            eq(ac.revision, input.credential!.credentialRevision),\n          ),\n        ),\n    ),\n    yield* statement(\n      database.insert(mapping.command.table).values(\n        mapping.command.encodeInsert({\n          moduleId: input.moduleId,\n          commandId: input.commandId,\n          action: input.authorization.challenge.action,\n          bindingDigest: input.authorization.challenge.bindingDigest,\n          decision: \"changed\",\n          retentionUntilMillis: now + mapping.commandRetentionMillis,\n        }),\n      ),\n    ),\n  ];\n});\n\nconst replacementApplied = (\n  mapping: Mapping,\n  input: PasswordMutationInput,\n  nativeSubjectId: unknown,\n  revisions: {\n    readonly credentialRevision: SecurityRevision;\n    readonly verifierVersion: SecurityRevision;\n    readonly nextSecurityRevision: SecurityRevision;\n  },\n  now: number,\n  identifierCondition: SQL,\n) => {\n  const c = credentialColumns(mapping);\n  const s = subjectColumns(mapping);\n  const ac = authorityColumns(mapping);\n  const mc = commandColumns(mapping);\n\n  return and(\n    sql`exists(select 1 from ${mapping.credential.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(nativeSubjectId, c.subjectId)} and ${c.credentialId} = ${sql.param(input.credential!.credentialId, c.credentialId)} and ${c.credentialRevision} = ${sql.param(revisions.credentialRevision, c.credentialRevision)} and ${c.verifierVersion} = ${sql.param(revisions.verifierVersion, c.verifierVersion)} and ${c.verifier} = ${sql.param(Redacted.value(input.replacement.verifier), c.verifier)} and ${c.normalization} = ${sql.param(input.replacement.normalization, c.normalization)})`,\n    sql`exists(select 1 from ${mapping.subject.table} where ${s.id} = ${sql.param(nativeSubjectId, s.id)} and ${s.securityRevision} = ${sql.param(revisions.nextSecurityRevision, s.securityRevision)} and ${s.status} = ${sql.param(mapping.subject.d1ActiveStatusValue, s.status)})`,\n    sql`exists(select 1 from ${mapping.authorityCredential.table} where ${ac.subjectId} = ${sql.param(nativeSubjectId, ac.subjectId)} and ${ac.credentialId} = ${sql.param(input.credential!.credentialId, ac.credentialId)} and ${ac.revision} = ${sql.param(revisions.credentialRevision, ac.revision)}${ac.status === undefined ? sql`` : sql` and ${ac.status} = ${sql.param(mapping.authorityCredential.d1ActiveStatusValue, ac.status)}`})`,\n    sql`exists(select 1 from ${mapping.command.table} where ${mc.moduleId} = ${sql.param(input.moduleId, mc.moduleId)} and ${mc.commandId} = ${sql.param(input.commandId, mc.commandId)} and ${mc.bindingDigest} = ${sql.param(input.authorization.challenge.bindingDigest, mc.bindingDigest)} and ${mc.action} = ${sql.param(input.authorization.challenge.action, mc.action)} and ${mc.decision} = ${sql.param(\"changed\", mc.decision)} and ${mc.retentionUntil} = ${sql.param(mapping.encodeInstant(now + mapping.commandRetentionMillis), mc.retentionUntil)})`,\n    identifierCondition,\n    sql`true`,\n  )!;\n};\n\nconst compileAddMutation = Effect.fn(\"DrizzleD1Password.compileAddMutation\")(function* (\n  mapping: Mapping,\n  input: PasswordMutationInput,\n  revisions: {\n    readonly credentialId: string;\n    readonly credentialRevision: SecurityRevision;\n    readonly verifierVersion: SecurityRevision;\n    readonly nextSecurityRevision: SecurityRevision;\n  },\n) {\n  const database = yield* CurrentD1PlanningDatabase;\n\n  const { credentialId, credentialRevision, verifierVersion, nextSecurityRevision } = revisions;\n\n  const authority = yield* readAuthority(mapping, input, \"add-password\");\n\n  if (authority === undefined) return undefined;\n  const now = yield* readEngineNowMillis(mapping);\n  const c = credentialColumns(mapping);\n  const s = subjectColumns(mapping);\n  const ac = authorityColumns(mapping);\n  const mc = commandColumns(mapping);\n  const marker = `effect-auth-password-guard:add:${input.commandId}`;\n  const absent = sql`not exists(select 1 from ${mapping.credential.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(authority.nativeSubjectId, c.subjectId)})`;\n\n  const guard = and(\n    authority.condition,\n    absent,\n    commandAbsentCondition(mapping, input.moduleId, input.commandId),\n  )!;\n\n  const appliedCondition = and(\n    sql`exists(select 1 from ${mapping.credential.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(authority.nativeSubjectId, c.subjectId)} and ${c.credentialId} = ${sql.param(credentialId, c.credentialId)} and ${c.credentialRevision} = ${sql.param(credentialRevision, c.credentialRevision)} and ${c.verifierVersion} = ${sql.param(verifierVersion, c.verifierVersion)} and ${c.verifier} = ${sql.param(Redacted.value(input.replacement.verifier), c.verifier)} and ${c.normalization} = ${sql.param(input.replacement.normalization, c.normalization)})`,\n    sql`exists(select 1 from ${mapping.authorityCredential.table} where ${ac.subjectId} = ${sql.param(authority.nativeSubjectId, ac.subjectId)} and ${ac.credentialId} = ${sql.param(credentialId, ac.credentialId)} and ${ac.revision} = ${sql.param(credentialRevision, ac.revision)}${ac.status === undefined ? sql`` : sql` and ${ac.status} = ${sql.param(mapping.authorityCredential.d1ActiveStatusValue, ac.status)}`})`,\n    sql`exists(select 1 from ${mapping.subject.table} where ${s.id} = ${sql.param(authority.nativeSubjectId, s.id)} and ${s.securityRevision} = ${sql.param(nextSecurityRevision, s.securityRevision)} and ${s.status} = ${sql.param(mapping.subject.d1ActiveStatusValue, s.status)})`,\n    sql`exists(select 1 from ${mapping.command.table} where ${mc.moduleId} = ${sql.param(input.moduleId, mc.moduleId)} and ${mc.commandId} = ${sql.param(input.commandId, mc.commandId)} and ${mc.bindingDigest} = ${sql.param(input.authorization.challenge.bindingDigest, mc.bindingDigest)} and ${mc.action} = ${sql.param(\"add-password\", mc.action)} and ${mc.decision} = ${sql.param(\"changed\", mc.decision)} and ${mc.retentionUntil} = ${sql.param(mapping.encodeInstant(now + mapping.commandRetentionMillis), mc.retentionUntil)})`,\n  )!;\n\n  const statements: Statement<any>[] = [\n    yield* assertion(guard, marker),\n    yield* statement(\n      database.insert(mapping.credential.table).values(\n        mapping.credential.encodeInsert({\n          moduleId: input.moduleId,\n          subjectId: authority.nativeSubjectId,\n          credentialId,\n          credentialRevision,\n          verifierVersion,\n          replacement: input.replacement,\n        }),\n      ),\n    ),\n    yield* statement(\n      database.insert(mapping.authorityCredential.table).values(\n        mapping.authorityCredential.encodeInsert({\n          subjectId: authority.nativeSubjectId,\n          credentialId,\n          revision: credentialRevision,\n        }),\n      ),\n    ),\n    yield* statement(\n      database\n        .update(mapping.subject.table)\n        .set(updateValues([[mapping.subject.securityRevision, nextSecurityRevision]]))\n        .where(\n          and(\n            eq(s.id, authority.nativeSubjectId),\n            eq(s.securityRevision, input.expectedRevision.securityRevision),\n          ),\n        ),\n    ),\n    yield* statement(\n      database.insert(mapping.command.table).values(\n        mapping.command.encodeInsert({\n          moduleId: input.moduleId,\n          commandId: input.commandId,\n          action: \"add-password\",\n          bindingDigest: input.authorization.challenge.bindingDigest,\n          decision: \"changed\",\n          retentionUntilMillis: now + mapping.commandRetentionMillis,\n        }),\n      ),\n    ),\n    yield* assertion(appliedCondition, marker),\n  ];\n\n  return {\n    statements,\n    appliedCondition,\n    marker,\n    retryable: (cause: unknown) => isGuardFailure(cause, marker),\n  };\n});\n\nconst makePasswordPlans = (\n  mapping: Mapping,\n  proofMapping?: D1ProofPersistenceMapping<\n    any,\n    any,\n    any,\n    any,\n    any,\n    any,\n    any,\n    any,\n    any,\n    any,\n    any,\n    any\n  >,\n) => {\n  const run = <A, E, R>(plan: Effect.Effect<Planned<A>, E, R>) =>\n    Effect.gen(function* () {\n      if (!validConstraints(mapping)) return yield* unavailable();\n\n      return yield* plan;\n    });\n\n  return {\n    findCredential: (uncaptured: Parameters<PasswordPersistence[\"Service\"][\"findCredential\"]>[0]) =>\n      Effect.gen(function* () {\n        if (!validConstraints(mapping)) return yield* unavailable();\n        const input = { ...uncaptured, identifier: { ...uncaptured.identifier } };\n        const database = yield* CurrentD1PlanningDatabase;\n        const identifierRow = (yield* readIdentifier(mapping, input.identifier))[0];\n\n        if (identifierRow === undefined || !mapping.identifier.isCurrent(identifierRow))\n          return Option.none();\n        const nativeId = identifierRow[mapping.identifier.subjectId];\n\n        const sc = subjectColumns(mapping),\n          ic = identifierColumns(mapping),\n          cc = credentialColumns(mapping);\n\n        // Bind the same native ID through each column's codec, then inspect one coherent snapshot.\n        const rows = yield* database\n          .select({\n            subject: getTableColumns(mapping.subject.table),\n            identifier: getTableColumns(mapping.identifier.table),\n            credential: getTableColumns(mapping.credential.table),\n          })\n          .from(mapping.subject.table)\n          .innerJoin(\n            mapping.identifier.table,\n            and(\n              eq(ic.namespace, input.identifier.namespace),\n              eq(ic.value, input.identifier.value),\n              eq(ic.subjectId, nativeId),\n            ),\n          )\n          .innerJoin(\n            mapping.credential.table,\n            and(eq(cc.moduleId, input.moduleId), eq(cc.subjectId, nativeId)),\n          )\n          .where(eq(sc.id, nativeId));\n\n        if (rows.length !== 1) return Option.none();\n        const row = rows[0]!;\n\n        if (\n          !mapping.subject.isActiveStatus(row.subject[mapping.subject.status]) ||\n          !mapping.identifier.isCurrent(row.identifier) ||\n          !mapping.subjectId.equals(nativeId, row.subject[mapping.subject.id]) ||\n          !mapping.subjectId.equals(nativeId, row.identifier[mapping.identifier.subjectId]) ||\n          !mapping.subjectId.equals(nativeId, row.credential[mapping.credential.subjectId])\n        )\n          return Option.none();\n\n        const credential = yield* mapping.credential\n          .decode({ moduleId: input.moduleId, ...row })\n          .pipe(Effect.flatMap(snapshotPasswordCredential));\n\n        return input.subjectId !== undefined && credential.revision.subjectId !== input.subjectId\n          ? Option.none()\n          : Option.some(credential);\n      }),\n    rehashIfCurrent: (input: Parameters<PasswordPersistence[\"Service\"][\"rehashIfCurrent\"]>[0]) =>\n      run(\n        Effect.gen(function* () {\n          const nextVerifier = Redacted.make(\n            yield* Schema.decodeEffect(EncodedPasswordHash)(Redacted.value(input.nextVerifier)),\n          );\n\n          const credential = yield* snapshotPasswordCredential(input.credential);\n          const database = yield* CurrentD1PlanningDatabase;\n          const nativeId = yield* mapping.subjectId.toNative(credential.revision.subjectId);\n          const version = yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync);\n\n          if (version === credential.verifierVersion) return yield* unavailable();\n          const encoded = mapping.credential.encodeVerifier(nextVerifier, version);\n\n          const values = {\n            [mapping.credential.verifier]: encoded[mapping.credential.verifier],\n            [mapping.credential.verifierVersion]: encoded[mapping.credential.verifierVersion],\n          };\n\n          if (Object.values(values).some((value) => value === undefined))\n            return yield* unavailable();\n          const c = credentialColumns(mapping);\n\n          return {\n            receipt: undefined,\n            statements: [\n              yield* statement(\n                database\n                  .update(mapping.credential.table)\n                  .set(values)\n                  .where(\n                    and(\n                      eq(c.moduleId, credential.moduleId),\n                      eq(c.subjectId, nativeId),\n                      eq(c.credentialId, credential.credentialId),\n                      ...(\n                        [\n                          [c.moduleId, credential.moduleId],\n                          [c.subjectId, nativeId],\n                          [c.credentialId, credential.credentialId],\n                          [c.credentialRevision, credential.credentialRevision],\n                          [c.verifierVersion, credential.verifierVersion],\n                          [c.verifier, Redacted.value(credential.verifier)],\n                          [c.normalization, credential.normalization],\n                        ] as const\n                      ).map(([column, value]) =>\n                        typeof value === \"string\"\n                          ? sql`cast(${column} as blob) = cast(${sql.param(value, column)} as blob)`\n                          : eq(column, value),\n                      ),\n                    ),\n                  ),\n              ),\n            ],\n          };\n        }),\n      ),\n    readForSubject: (input: Parameters<PasswordPersistence[\"Service\"][\"readForSubject\"]>[0]) =>\n      Effect.gen(function* () {\n        const database = yield* CurrentD1PlanningDatabase;\n\n        if (yield* hasCommitScope) return yield* unavailable();\n        const nativeSubjectId = yield* mapping.subjectId.toNative(input.subjectId);\n        const subject = (yield* readSubjectNative(mapping, nativeSubjectId))[0];\n\n        if (\n          subject === undefined ||\n          !mapping.subject.isActiveStatus(subject[mapping.subject.status])\n        )\n          return Option.none();\n\n        const credential = (yield* readCredentialNative(\n          mapping,\n          input.moduleId,\n          nativeSubjectId,\n        ))[0];\n\n        if (credential === undefined) return Option.none();\n        const ic = identifierColumns(mapping);\n\n        const identifiers = yield* database\n          .select()\n          .from(mapping.identifier.table)\n          .where(eq(ic.subjectId, nativeSubjectId));\n\n        const identifier = identifiers.find((row: any) => mapping.identifier.isCurrent(row));\n\n        if (identifier === undefined) return Option.none();\n\n        return Option.some(\n          yield* mapping.credential\n            .decode({ moduleId: input.moduleId, subject, identifier, credential })\n            .pipe(Effect.flatMap(snapshotPasswordCredential)),\n        );\n      }),\n    recoveryTarget: (input: Parameters<PasswordPersistence[\"Service\"][\"recoveryTarget\"]>[0]) =>\n      Effect.gen(function* () {\n        if (yield* hasCommitScope) return yield* unavailable();\n        const resolved = yield* resolveCredential(mapping, input.moduleId, input.identifier);\n\n        return resolved?.snapshot === undefined ||\n          resolved.snapshot.identifierVerifiedAtMillis === undefined\n          ? Option.none()\n          : Option.some(resolved.snapshot);\n      }),\n    addIfAbsent: <A>(\n      uncaptured: Parameters<PasswordPersistence[\"Service\"][\"addIfAbsent\"]>[0],\n      prepare: PlanPrepare<PasswordPersistence[\"Service\"][\"addIfAbsent\"], A>,\n    ) =>\n      Effect.gen(function* () {\n        const input = yield* snapshotMutationInput(uncaptured);\n\n        const credentialId = yield* allocate(\n          mapping.allocateCredentialId,\n          mapping.allocateCredentialIdSync,\n        );\n\n        const credentialRevision = yield* allocate(\n          mapping.allocateRevision,\n          mapping.allocateRevisionSync,\n        );\n\n        const verifierVersion = yield* allocate(\n          mapping.allocateRevision,\n          mapping.allocateRevisionSync,\n        );\n\n        const nextSecurityRevision = yield* allocateNextSecurityRevision(\n          mapping,\n          input.expectedRevision.securityRevision,\n        );\n\n        if (nextSecurityRevision === input.expectedRevision.securityRevision)\n          return yield* unavailable();\n\n        return yield* run(\n          Effect.gen(function* () {\n            const journal = yield* CurrentCommitJournal;\n\n            const compiled = yield* compileAddMutation(mapping, input, {\n              credentialId,\n              credentialRevision,\n              verifierVersion,\n              nextSecurityRevision,\n            });\n\n            if (compiled === undefined)\n              return { receipt: prepare(\"rejected\", journal), statements: [] };\n\n            return {\n              receipt: prepare(\"changed\", journal),\n              statements: compiled.statements,\n              postconditions: [yield* assertion(compiled.appliedCondition, compiled.marker)],\n              retryable: compiled.retryable,\n            };\n          }),\n        );\n      }),\n    replaceIfCurrent: <A>(\n      uncaptured: Parameters<PasswordPersistence[\"Service\"][\"replaceIfCurrent\"]>[0],\n      prepare: PlanPrepare<PasswordPersistence[\"Service\"][\"replaceIfCurrent\"], A>,\n    ) =>\n      Effect.flatMap(snapshotMutationInput(uncaptured), (input) =>\n        replacementPlan(mapping, proofMapping, input, prepare, \"change-password\"),\n      ),\n    checkReset: (input: Parameters<PasswordPersistence[\"Service\"][\"checkReset\"]>[0]) =>\n      proofMapping === undefined\n        ? Effect.fail(unavailable())\n        : Effect.gen(function* () {\n            if (yield* hasCommitScope) return yield* unavailable();\n            if (\n              input.moduleId.length <= \"/reset\".length ||\n              !input.moduleId.endsWith(\"/reset\") ||\n              input.purpose !== \"password-reset\" ||\n              input.binding._tag !== \"Subject\"\n            )\n              return false;\n            const binding = input.binding;\n\n            const resolved = yield* resolveCredential(\n              mapping,\n              input.moduleId.slice(0, -\"/reset\".length),\n              binding.identifier,\n              binding.revision.subjectId,\n            );\n\n            const current =\n              resolved?.snapshot !== undefined &&\n              resolved.snapshot.revision.securityRevision === binding.revision.securityRevision &&\n              binding.revision.credentials.every((item) =>\n                resolved.snapshot!.revision.credentials.some(\n                  (current) =>\n                    current.credentialId === item.credentialId &&\n                    current.revision === item.revision,\n                ),\n              );\n\n            return current ? yield* probeProofCompletion(proofMapping, input) : false;\n          }),\n    resetWithProof: <A>(\n      uncaptured: Parameters<PasswordPersistence[\"Service\"][\"resetWithProof\"]>[0],\n      prepare: PlanPrepare<PasswordPersistence[\"Service\"][\"resetWithProof\"], A>,\n    ) =>\n      proofMapping === undefined\n        ? Effect.fail(unavailable())\n        : Effect.flatMap(snapshotMutationInput(uncaptured), (captured) =>\n            replacementPlan(\n              mapping,\n              proofMapping,\n              Object.freeze({ ...captured, completion: uncaptured.completion }),\n              prepare,\n              \"reset-password\",\n            ),\n          ),\n  };\n};\n\nconst compileReplacementMutation = Effect.fn(\"DrizzleD1Password.compileReplacementMutation\")(\n  function* (\n    mapping: Mapping,\n    input: PasswordMutationInput,\n    action: \"change-password\" | \"reset-password\",\n    revisions: {\n      readonly credentialRevision: SecurityRevision;\n      readonly verifierVersion: SecurityRevision;\n      readonly nextSecurityRevision: SecurityRevision;\n    },\n  ) {\n    const { credentialRevision, verifierVersion, nextSecurityRevision } = revisions;\n    const authority = yield* readAuthority(mapping, input, action);\n\n    const current =\n      authority === undefined || input.credential === undefined\n        ? undefined\n        : (yield* readCredentialNative(mapping, input.moduleId, authority.nativeSubjectId))[0];\n\n    const currentMatches =\n      current !== undefined &&\n      current[mapping.credential.credentialId] === input.credential!.credentialId &&\n      current[mapping.credential.credentialRevision] === input.credential!.credentialRevision &&\n      current[mapping.credential.verifierVersion] === input.credential!.verifierVersion &&\n      current[mapping.credential.verifier] === Redacted.value(input.credential!.verifier) &&\n      current[mapping.credential.normalization] === input.credential!.normalization;\n\n    if (authority === undefined || !currentMatches) return undefined;\n    const now = yield* readEngineNowMillis(mapping);\n\n    const guard = and(\n      authority.condition,\n      credentialCurrentCondition(mapping, input, authority.nativeSubjectId),\n      commandAbsentCondition(mapping, input.moduleId, input.commandId),\n    )!;\n\n    const marker = `effect-auth-password-guard:${action}:${input.commandId}`;\n\n    const protectedMutation: D1ProtectedProofMutation = {\n      statements: [\n        yield* assertion(guard, marker),\n        ...(yield* mutationStatements(\n          mapping,\n          input,\n          authority.nativeSubjectId,\n          { credentialRevision, verifierVersion, nextSecurityRevision },\n          now,\n        )),\n      ],\n      appliedCondition: replacementApplied(\n        mapping,\n        input,\n        authority.nativeSubjectId,\n        {\n          credentialRevision,\n          verifierVersion,\n          nextSecurityRevision,\n        },\n        now,\n        authority.identifierCondition,\n      ),\n    };\n\n    return { protectedMutation, marker };\n  },\n);\n\nconst replacementPlan = Effect.fn(\"Drizzle.replacementPlan\")(function* <A>(\n  mapping: Mapping,\n  proofMapping:\n    | D1ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any>\n    | undefined,\n  input: PasswordMutationInput & { readonly completion?: any },\n  prepare: PreparePasswordCommit<PasswordMutationDecision, A>,\n  action: \"change-password\" | \"reset-password\",\n) {\n  const credentialRevision = yield* allocate(\n    mapping.allocateRevision,\n    mapping.allocateRevisionSync,\n  );\n\n  const verifierVersion = yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync);\n\n  const nextSecurityRevision = yield* allocateNextSecurityRevision(\n    mapping,\n    input.expectedRevision.securityRevision,\n  );\n\n  if (\n    nextSecurityRevision === input.expectedRevision.securityRevision ||\n    (input.credential !== undefined && credentialRevision === input.credential.credentialRevision)\n  )\n    return yield* unavailable();\n\n  const journal = yield* CurrentCommitJournal;\n\n  const compiledMutation = yield* compileReplacementMutation(mapping, input, action, {\n    credentialRevision,\n    verifierVersion,\n    nextSecurityRevision,\n  });\n\n  if (compiledMutation === undefined)\n    return { receipt: prepare(\"rejected\", journal), statements: [] };\n  const { protectedMutation, marker } = compiledMutation;\n\n  if (action === \"reset-password\") {\n    if (\n      proofMapping === undefined ||\n      input.completion === undefined ||\n      !completionMatchesPassword(\n        input as PasswordMutationInput & { readonly completion: ProofCompletionPlan },\n      )\n    )\n      return { receipt: prepare(\"rejected\", journal), statements: [] };\n    let passwordReceipt: PreparedCommit<A> | undefined;\n\n    const compiled = yield* compileD1ProofCompletionPlan(\n      proofMapping,\n      input.completion,\n      protectedMutation,\n      (decision: ProofCompletionDecision) => {\n        passwordReceipt = prepare(decision === \"completed\" ? \"changed\" : \"rejected\", journal);\n\n        return decision;\n      },\n    );\n\n    return {\n      receipt: passwordReceipt ?? prepare(\"rejected\", journal),\n      statements: compiled.statements,\n      ...(compiled.postconditions === undefined ? {} : { postconditions: compiled.postconditions }),\n      retryable: (cause: unknown) =>\n        isGuardFailure(cause, marker) ||\n        isGuardFailure(\n          cause,\n          `effect-auth-proof-guard:complete:${input.completion.input.continuationId}`,\n        ) ||\n        isGuardFailure(\n          cause,\n          `effect-auth-proof-guard:protected:${input.completion.input.continuationId}`,\n        ),\n    };\n  }\n\n  const applied = yield* assertion(protectedMutation.appliedCondition, marker);\n\n  return {\n    receipt: prepare(\"changed\", journal),\n    statements: [...protectedMutation.statements, applied],\n    postconditions: [applied],\n    retryable: (cause: unknown) => isGuardFailure(cause, marker),\n  };\n});\n\nexport const makeD1PasswordPersistenceServices = Effect.fnUntraced(function* <\n  S extends AnySQLiteTable,\n  I extends AnySQLiteTable,\n  C extends AnySQLiteTable,\n  AC extends AnySQLiteTable,\n  M extends AnySQLiteTable,\n  NativeId,\n>(\n  mapping: D1PasswordPersistenceMapping<S, I, C, AC, M, NativeId>,\n  proofMapping?: D1ProofPersistenceMapping<\n    any,\n    any,\n    any,\n    any,\n    any,\n    any,\n    any,\n    any,\n    any,\n    any,\n    any,\n    any\n  >,\n) {\n  const database = yield* DatabaseService;\n\n  yield* validateDrizzleStorage({ ...mapping, proof: proofMapping }).pipe(\n    Effect.provideServiceEffect(NativeDatabase, nativeDatabase(DatabaseService)),\n    Effect.mapError(unavailable),\n  );\n\n  const hooks = yield* LifecycleHooks;\n  const plans = makePasswordPlans(mapping as unknown as Mapping, proofMapping);\n\n  const standalone = Effect.gen(function* () {\n    if (yield* hasCommitScope) return yield* unavailable();\n    yield* requireStandalone(unavailable, database.$client.transactionService);\n  });\n\n  const run = <Out, Err, Env>(plan: Effect.Effect<Planned<Out>, Err, Env>) =>\n    Effect.gen(function* () {\n      yield* standalone;\n\n      return yield* executeStandalone(plan, 2);\n    }).pipe(\n      Effect.provideService(CurrentD1PlanningDatabase, database),\n      Effect.provideService(LifecycleHooks, hooks),\n    );\n\n  const service: PasswordPersistence[\"Service\"] = {\n    findCredential: (input) =>\n      standalone.pipe(\n        Effect.andThen(plans.findCredential(input)),\n        Effect.provideService(CurrentD1PlanningDatabase, database),\n        translateFailure,\n      ),\n    rehashIfCurrent: (input) => run(plans.rehashIfCurrent(input)).pipe(translateFailure),\n    readForSubject: (input) =>\n      plans\n        .readForSubject(input)\n        .pipe(\n          Effect.provideService(CurrentD1PlanningDatabase, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n    recoveryTarget: (input) =>\n      plans\n        .recoveryTarget(input)\n        .pipe(\n          Effect.provideService(CurrentD1PlanningDatabase, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n    addIfAbsent: (input, prepare) => run(plans.addIfAbsent(input, prepare)).pipe(translateFailure),\n    replaceIfCurrent: (input, prepare) =>\n      run(plans.replaceIfCurrent(input, prepare)).pipe(translateFailure),\n    checkReset: (input) =>\n      plans\n        .checkReset(input)\n        .pipe(\n          Effect.provideService(CurrentD1PlanningDatabase, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n    resetWithProof: (input, prepare) =>\n      run(plans.resetWithProof(input, prepare)).pipe(translateFailure),\n  };\n\n  return { passwordPersistence: service };\n});\n\ntype CoordinatorError<E> = E | PasswordUnavailable | HookConfigurationError;\n\n/**\n * Owns one password transition plus application statements in one D1 batch.\n * The owner Effect is invoked once and is never replayed after an ambiguous or\n * guarded batch failure. Standalone adapter-owned commands may replan boundedly.\n */\nexport function coordinateD1PasswordPersistence<\n  S extends AnySQLiteTable,\n  I extends AnySQLiteTable,\n  C extends AnySQLiteTable,\n  AC extends AnySQLiteTable,\n  M extends AnySQLiteTable,\n  NativeId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: D1PasswordPersistenceMapping<S, I, C, AC, M, NativeId>;\n    readonly proofMapping?:\n      | D1ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any>\n      | undefined;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  CoordinatorError<E> | DatabaseError,\n  Exclude<R, PasswordPersistence | D1BatchStatements> | LifecycleHooks | DatabaseRequirements\n> {\n  return Effect.flatMap(nativeDatabase(acquire), (database) =>\n    Effect.gen(function* () {\n      yield* validateDrizzleStorage({\n        ...options.mapping,\n        proof: options.proofMapping,\n      }).pipe(Effect.mapError(unavailable));\n      const hooks = yield* LifecycleHooks;\n\n      if (yield* hasCommitScope) return yield* unavailable();\n\n      const result = yield* coordinateCommit(\n        () =>\n          Effect.gen(function* () {\n            const statements: Statement<any>[] = [];\n            let mutation: Planned<any> | undefined;\n\n            const nativeCollector = D1BatchStatements.of({\n              append: (statement) => Effect.sync(() => statements.push(statement)),\n            });\n\n            const owner = yield* makeD1Owner(unavailable()).pipe(\n              Effect.provideService(D1BatchStatements, nativeCollector),\n            );\n\n            const plans = makePasswordPlans(\n              options.mapping as unknown as Mapping,\n              options.proofMapping,\n            );\n\n            const run = <Out, Err, Env>(plan: Effect.Effect<Planned<Out>, Err, Env>) =>\n              coordinateCommit(\n                () =>\n                  Effect.gen(function* () {\n                    const journal = yield* CurrentCommitJournal;\n                    const planned = yield* plan;\n\n                    yield* owner.check;\n                    if (mutation !== undefined) return yield* unavailable();\n                    const guarded = { ...planned, journalGuard: journal.prepare(undefined) };\n\n                    mutation = guarded;\n                    statements.push(...guarded.statements);\n\n                    return guarded.receipt;\n                  }),\n                { mode: \"batch\" },\n              ).pipe(\n                Effect.map((result) => result.value),\n                Effect.provideService(CurrentD1PlanningDatabase, database),\n                Effect.provideService(LifecycleHooks, hooks),\n              );\n\n            const service: PasswordPersistence[\"Service\"] = {\n              findCredential: (input) =>\n                owner.run(\n                  plans\n                    .findCredential(input)\n                    .pipe(\n                      Effect.provideService(CurrentD1PlanningDatabase, database),\n                      translateFailure,\n                    ),\n                ),\n              rehashIfCurrent: (input) =>\n                owner.run(run(plans.rehashIfCurrent(input)).pipe(translateFailure)),\n              readForSubject: (input) =>\n                owner.run(\n                  plans\n                    .readForSubject(input)\n                    .pipe(\n                      Effect.provideService(CurrentD1PlanningDatabase, database),\n                      Effect.provideService(LifecycleHooks, hooks),\n                      translateFailure,\n                    ),\n                ),\n              recoveryTarget: (input) =>\n                owner.run(\n                  plans\n                    .recoveryTarget(input)\n                    .pipe(\n                      Effect.provideService(CurrentD1PlanningDatabase, database),\n                      Effect.provideService(LifecycleHooks, hooks),\n                      translateFailure,\n                    ),\n                ),\n              addIfAbsent: (input, prepare) =>\n                owner.run(run(plans.addIfAbsent(input, prepare)).pipe(translateFailure)),\n              replaceIfCurrent: (input, prepare) =>\n                owner.run(run(plans.replaceIfCurrent(input, prepare)).pipe(translateFailure)),\n              checkReset: (input) =>\n                owner.run(\n                  plans\n                    .checkReset(input)\n                    .pipe(\n                      Effect.provideService(CurrentD1PlanningDatabase, database),\n                      Effect.provideService(LifecycleHooks, hooks),\n                      translateFailure,\n                    ),\n                ),\n              resetWithProof: (input, prepare) =>\n                owner.run(run(plans.resetWithProof(input, prepare)).pipe(translateFailure)),\n            };\n\n            const provided = Context.make(PasswordPersistence, service).pipe(\n              Context.add(D1BatchStatements, owner.collector),\n            );\n\n            const value = yield* owner.close(Effect.provideContext(body, provided));\n\n            if (mutation?.journalGuard !== undefined) {\n              const status = yield* Effect.result(mutation.journalGuard.read);\n\n              if (status._tag === \"Success\" || status.failure._tag !== \"CommitPending\")\n                return yield* unavailable();\n            }\n            // Re-assert the password's final state after application statements.\n            yield* database.$client\n              .batch([...statements, ...(mutation?.postconditions ?? [])])\n              .pipe(\n                Effect.catchCause((cause) =>\n                  Effect.failCause(\n                    Cause.map(cause, (error) =>\n                      everyFailureMatches(cause, mutation?.retryable) ? unavailable() : error,\n                    ),\n                  ),\n                ),\n                translateFailure,\n              );\n\n            return value;\n          }),\n        { mode: \"batch\" },\n      ).pipe(Effect.provideService(LifecycleHooks, hooks));\n\n      return result.value;\n    }).pipe(Effect.provideService(NativeDatabase, database)),\n  );\n}\n\nconst registrationRows = Effect.fn(\"Drizzle.registrationRows\")(function* <Registration>(\n  mapping: RegistrationMapping<Registration>,\n  moduleId: string,\n  requestId: string,\n) {\n  const database = yield* CurrentD1PlanningDatabase;\n\n  const module = column(mapping.registration.table, mapping.registration.moduleId);\n  const request = column(mapping.registration.table, mapping.registration.requestId);\n\n  return yield* database\n    .select()\n    .from(mapping.registration.table)\n    .where(and(eq(module, moduleId), eq(request, requestId)))\n    .limit(1);\n});\n\nconst registrationIdentifierRows = Effect.fn(\"Drizzle.registrationIdentifierRows\")(function* <\n  Registration,\n>(mapping: RegistrationMapping<Registration>, identifier: LoginIdentifier) {\n  const database = yield* CurrentD1PlanningDatabase;\n\n  const namespace = column(mapping.identifier.table, mapping.identifier.namespace);\n  const value = column(mapping.identifier.table, mapping.identifier.value);\n\n  return yield* database\n    .select()\n    .from(mapping.identifier.table)\n    .where(and(eq(namespace, identifier.namespace), eq(value, identifier.value)))\n    .limit(1);\n});\n\nconst planRegistration = Effect.fn(\"Drizzle.planRegistration\")(function* <Registration, A>(\n  mapping: RegistrationMapping<Registration>,\n  input: {\n    readonly moduleId: string;\n    readonly requestId: string;\n    readonly identifier: LoginIdentifier;\n    readonly registration: Registration;\n    readonly replacement: PasswordMutationInput[\"replacement\"];\n  },\n  allocated: {\n    readonly credentialId: string;\n    readonly securityRevision: SecurityRevision;\n    readonly identifierRevision: SecurityRevision;\n    readonly credentialRevision: SecurityRevision;\n    readonly verifierVersion: SecurityRevision;\n    readonly nativeSubjectId?: unknown;\n    readonly recoveryReference?: any;\n  },\n  prepare: PreparePasswordCommit<import(\"@yielded/auth/Password\").PasswordRegistrationDecision, A>,\n) {\n  const database = yield* CurrentD1PlanningDatabase;\n  const journal = yield* CurrentCommitJournal;\n\n  const existing = (yield* registrationRows(mapping, input.moduleId, input.requestId))[0];\n\n  if (existing !== undefined)\n    return {\n      receipt: prepare(yield* mapping.registration.decodeReplay(existing), journal),\n      statements: [],\n    };\n\n  const intent = {\n    moduleId: input.moduleId,\n    requestId: input.requestId,\n    identifier: input.identifier,\n    registration: input.registration,\n    replacement: input.replacement,\n  };\n\n  if (mapping.mode === \"pending\") {\n    if (allocated.recoveryReference === undefined) return yield* unavailable();\n\n    return {\n      receipt: prepare({ _tag: \"Pending\", reference: allocated.recoveryReference }, journal),\n      statements: [\n        yield* statement(\n          database.insert(mapping.registration.table).values(\n            mapping.registration.encodeInsert(intent, {\n              state: \"pending\",\n              recoveryReference: allocated.recoveryReference,\n            }),\n          ),\n        ),\n      ],\n      retryable: (cause: unknown) => isMappedConstraintConflict(mapping.isRequestConflict, cause),\n    };\n  }\n  if (mapping.provisioning.idMode === \"generated\" || allocated.nativeSubjectId === undefined)\n    return yield* unavailable();\n  if ((yield* registrationIdentifierRows(mapping, input.identifier)).length > 0)\n    return { receipt: prepare({ _tag: \"Suppressed\" }, journal), statements: [] };\n  const nativeSubjectId = allocated.nativeSubjectId;\n  const subjectId = yield* mapping.subjectId.toSubject(nativeSubjectId);\n\n  return {\n    receipt: prepare({ _tag: \"Created\", subjectId }, journal),\n    statements: [\n      yield* statement(\n        database.insert(mapping.subject.table).values(\n          mapping.provisioning.encodeSubjectInsert(intent, {\n            nativeSubjectId,\n            securityRevision: allocated.securityRevision,\n          }),\n        ),\n      ),\n      yield* statement(\n        database\n          .insert(mapping.identifier.table)\n          .values(\n            mapping.identifier.encodeInitialInsert(\n              input.identifier,\n              nativeSubjectId,\n              allocated.identifierRevision,\n            ),\n          ),\n      ),\n      yield* statement(\n        database.insert(mapping.credential.table).values(\n          mapping.credential.encodeInsert({\n            moduleId: input.moduleId,\n            subjectId: nativeSubjectId,\n            credentialId: allocated.credentialId,\n            credentialRevision: allocated.credentialRevision,\n            verifierVersion: allocated.verifierVersion,\n            replacement: input.replacement,\n          }),\n        ),\n      ),\n      yield* statement(\n        database.insert(mapping.authorityCredential.table).values(\n          mapping.authorityCredential.encodeInsert({\n            subjectId: nativeSubjectId,\n            credentialId: allocated.credentialId,\n            revision: allocated.credentialRevision,\n          }),\n        ),\n      ),\n      yield* statement(\n        database.insert(mapping.registration.table).values(\n          mapping.registration.encodeInsert(intent, {\n            state: \"created\",\n            nativeSubjectId,\n          }),\n        ),\n      ),\n    ],\n    retryable: (cause: unknown) =>\n      isMappedConstraintConflict(mapping.isRequestConflict, cause) ||\n      isMappedConstraintConflict(mapping.isIdentifierConflict, cause),\n  };\n});\n\nconst allocateRegistration = <Registration>(mapping: RegistrationMapping<Registration>) =>\n  Effect.gen(function* () {\n    const credentialId = yield* allocate(\n      mapping.allocateCredentialId,\n      mapping.allocateCredentialIdSync,\n    );\n\n    const securityRevision = yield* allocate(\n      mapping.allocateRevision,\n      mapping.allocateRevisionSync,\n    );\n\n    const identifierRevision = yield* allocate(\n      mapping.allocateRevision,\n      mapping.allocateRevisionSync,\n    );\n\n    const credentialRevision = yield* allocate(\n      mapping.allocateRevision,\n      mapping.allocateRevisionSync,\n    );\n\n    const verifierVersion = yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync);\n\n    const nativeSubjectId =\n      mapping.mode !== \"atomic\" || mapping.provisioning.idMode === \"generated\"\n        ? undefined\n        : yield* allocate(\n            mapping.provisioning.allocateSubjectId,\n            mapping.provisioning.allocateSubjectIdSync,\n          );\n\n    const recoveryReference =\n      mapping.mode === \"pending\"\n        ? yield* allocate(mapping.allocateRecoveryReference, mapping.allocateRecoveryReferenceSync)\n        : undefined;\n\n    return {\n      credentialId,\n      securityRevision,\n      identifierRevision,\n      credentialRevision,\n      verifierVersion,\n      ...(nativeSubjectId === undefined ? {} : { nativeSubjectId }),\n      ...(recoveryReference === undefined ? {} : { recoveryReference }),\n    };\n  });\n\nconst makeRegistrationPlans = <Registration>(mapping: RegistrationMapping<Registration>) => ({\n  register: <A>(\n    input: Parameters<PasswordRegistrationAuthority<Registration>[\"register\"]>[0],\n    prepare: PlanPrepare<PasswordRegistrationAuthority<Registration>[\"register\"], A>,\n  ) =>\n    Effect.gen(function* () {\n      if (!validRegistrationConstraints(mapping)) return yield* unavailable();\n      if (mapping.mode === \"atomic\" && mapping.provisioning.idMode === \"generated\")\n        return yield* unavailable();\n      const allocated = yield* allocateRegistration(mapping);\n\n      return yield* planRegistration(mapping, input, allocated, prepare);\n    }),\n});\n\nexport const makeD1PasswordRegistrationServices = Effect.fnUntraced(function* <\n  Registration,\n  S extends AnySQLiteTable,\n  I extends AnySQLiteTable,\n  C extends AnySQLiteTable,\n  AC extends AnySQLiteTable,\n  Rq extends AnySQLiteTable,\n  NativeId,\n>(mapping: PasswordRegistrationMapping<Registration, S, I, C, AC, Rq, NativeId>) {\n  const database = yield* DatabaseService;\n\n  yield* validateDrizzleStorage(mapping).pipe(\n    Effect.provideServiceEffect(NativeDatabase, nativeDatabase(DatabaseService)),\n    Effect.mapError(unavailable),\n  );\n\n  const hooks = yield* LifecycleHooks;\n  const plans = makeRegistrationPlans(mapping as unknown as RegistrationMapping<Registration>);\n\n  const run = <Out, Err, Env>(plan: Effect.Effect<Planned<Out>, Err, Env>) =>\n    Effect.gen(function* () {\n      if (yield* hasCommitScope) return yield* unavailable();\n\n      return yield* executeStandalone(plan, 2);\n    }).pipe(\n      Effect.provideService(CurrentD1PlanningDatabase, database),\n      Effect.provideService(LifecycleHooks, hooks),\n    );\n\n  const service: PasswordRegistrationAuthority<Registration> = {\n    register: (input, prepare) => run(plans.register(input, prepare)).pipe(translateFailure),\n  };\n\n  return { registrationAuthority: service };\n});\n\nexport function coordinateD1PasswordRegistration<\n  TargetId,\n  Registration,\n  S extends AnySQLiteTable,\n  I extends AnySQLiteTable,\n  C extends AnySQLiteTable,\n  AC extends AnySQLiteTable,\n  Rq extends AnySQLiteTable,\n  NativeId,\n  A,\n  E,\n  R,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: PasswordRegistrationMapping<NoInfer<Registration>, S, I, C, AC, Rq, NativeId>;\n    readonly target: SuppliedService<TargetId, PasswordRegistrationAuthority<Registration>>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  CoordinatorError<E> | DatabaseError,\n  Exclude<R, TargetId | D1BatchStatements> | LifecycleHooks | DatabaseRequirements\n> {\n  return Effect.flatMap(nativeDatabase(acquire), (database) =>\n    Effect.gen(function* () {\n      yield* validateDrizzleStorage(options.mapping).pipe(Effect.mapError(unavailable));\n      const hooks = yield* LifecycleHooks;\n\n      if (yield* hasCommitScope) return yield* unavailable();\n\n      const result = yield* coordinateCommit(\n        () =>\n          Effect.gen(function* () {\n            const statements: Statement<any>[] = [];\n            let mutation: Planned<any> | undefined;\n\n            const nativeCollector = D1BatchStatements.of({\n              append: (statement) => Effect.sync(() => statements.push(statement)),\n            });\n\n            const owner = yield* makeD1Owner(unavailable()).pipe(\n              Effect.provideService(D1BatchStatements, nativeCollector),\n            );\n\n            const plans = makeRegistrationPlans(\n              options.mapping as unknown as RegistrationMapping<Registration>,\n            );\n\n            const run = <Out, Err, Env>(plan: Effect.Effect<Planned<Out>, Err, Env>) =>\n              coordinateCommit(\n                () =>\n                  Effect.gen(function* () {\n                    const journal = yield* CurrentCommitJournal;\n                    const planned = yield* plan;\n\n                    yield* owner.check;\n                    if (mutation !== undefined) return yield* unavailable();\n                    const guarded = { ...planned, journalGuard: journal.prepare(undefined) };\n\n                    mutation = guarded;\n                    statements.push(...guarded.statements);\n\n                    return guarded.receipt;\n                  }),\n                { mode: \"batch\" },\n              ).pipe(\n                Effect.map((result) => result.value),\n                Effect.provideService(CurrentD1PlanningDatabase, database),\n                Effect.provideService(LifecycleHooks, hooks),\n              );\n\n            const service: PasswordRegistrationAuthority<Registration> = {\n              register: (input, prepare) =>\n                owner.run(run(plans.register(input, prepare)).pipe(translateFailure)),\n            };\n\n            const provided = Context.make(options.target, service).pipe(\n              Context.add(D1BatchStatements, owner.collector),\n            );\n\n            const value = yield* owner.close(Effect.provideContext(body, provided));\n\n            if (mutation?.journalGuard !== undefined) {\n              const status = yield* Effect.result(mutation.journalGuard.read);\n\n              if (status._tag === \"Success\" || status.failure._tag !== \"CommitPending\")\n                return yield* unavailable();\n            }\n            yield* database.$client.batch(statements).pipe(\n              Effect.catchCause((cause) =>\n                Effect.failCause(\n                  Cause.map(cause, (error) =>\n                    everyFailureMatches(cause, mutation?.retryable) ? unavailable() : error,\n                  ),\n                ),\n              ),\n              translateFailure,\n            );\n\n            return value;\n          }),\n        { mode: \"batch\" },\n      ).pipe(Effect.provideService(LifecycleHooks, hooks));\n\n      return result.value;\n    }).pipe(Effect.provideService(NativeDatabase, database)),\n  );\n}\n\n/** Private prepared compiler seam: it never replays a caller or prepared callback. */\nexport const passwordD1Kernel = {\n  statement,\n  assertion,\n  readEngineNowMillis,\n  allocate,\n  allocateNextSecurityRevision,\n  subjectColumns,\n  identifierColumns,\n  credentialColumns,\n  authorityColumns,\n  readAuthority,\n  assuranceCondition,\n  credentialCurrentCondition,\n  commandAbsentCondition,\n  compileAddMutation,\n  compileReplacementMutation,\n  completionMatchesPassword,\n  isGuardFailure,\n};\n\nconst translateFailure = <A, E, R>(\n  effect: Effect.Effect<A, E, R>,\n): Effect.Effect<A, PasswordUnavailable, R> =>\n  reportPersistenceFailure(\n    effect,\n    (error) =>\n      Schema.is(PasswordUnavailable)(error) ||\n      Schema.is(ProofUnavailable)(error) ||\n      Schema.is(HookConfigurationError)(error),\n  ).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));\n\nconst executeStandalone = <A, E, R>(\n  plan: Effect.Effect<Planned<A>, E, R>,\n  retries = 2,\n): Effect.Effect<\n  A,\n  E | import(\"@yielded/auth/Hooks\").HookConfigurationError | import(\"effect/sql/SqlError\").SqlError,\n  Exclude<R, CurrentCommitJournal> | CurrentD1PlanningDatabase | LifecycleHooks\n> =>\n  Effect.suspend(() => {\n    let retryable: ((cause: unknown) => boolean) | undefined;\n\n    const once = coordinateCommit(\n      () =>\n        Effect.gen(function* () {\n          const database = yield* CurrentD1PlanningDatabase;\n          const planned = yield* plan;\n\n          retryable = planned.retryable;\n          yield* database.$client.batch(planned.statements);\n\n          return planned.receipt;\n        }),\n      { mode: \"batch\" },\n    ).pipe(Effect.map((result) => result.value));\n\n    return once.pipe(\n      Effect.catchCause((cause) =>\n        retries > 0 && everyFailureMatches(cause, retryable)\n          ? executeStandalone(plan, retries - 1)\n          : Effect.failCause(cause),\n      ),\n    );\n  });\n"],"mappings":";;;;;;;;;;;;;;;;;;AA8FA,MAAM,oBAAoB,oBAAoB,KAAK,CAAC,CAAC;AAErD,MAAM,uBACJ,OACA,aAEA,aAAa,KAAA,KACb,MAAM,QAAQ,SAAS,KACvB,MAAM,QAAQ,OAAO,WAAW,MAAM,aAAa,MAAM,KAAK,SAAS,MAAM,KAAK,OAAO,KAAK,CAAC,CAAC;AAElG,MAAM,oBAAoB,YACxB,OAAO,QAAQ,2BAA2B,CAAC,CAAC,OACzC,CAAC,KAAK,WACL,QAAQ,YAAY,SAAqD,KAC7E;AAEF,MAAM,gCAA8C,YAClD,OAAO,QAAQ,uCAAuC,CAAC,CAAC,OACrD,CAAC,KAAK,WACL,QAAQ,YAAY,SAAiE,KACzF;AAEF,MAAM,mBAAmB,SAAkB,cAAoD;CAC7F,MAAM,uBAAO,IAAI,IAAa;CAC9B,MAAM,UAA0B,CAAC,OAAO;CAExC,KAAK,IAAI,YAAY,GAAG,YAAY,MAAM,QAAQ,SAAS,GAAG,aAAa;EACzE,MAAM,UAAU,QAAQ,MAAM;EAE9B,IAAI,YAAY,KAAA,KAAa,YAAY,QAAQ,KAAK,IAAI,OAAO,GAAG;EACpE,KAAK,IAAI,OAAO;EAChB,IAAI,UAAU,OAAO,GAAG,OAAO;EAC/B,IAAI,MAAM,QAAQ,OAAO,GAAG;GAC1B,KAAK,MAAM,UAAU,QAAQ,SAC3B,IAAI,MAAM,aAAa,MAAM,GAAG,QAAQ,KAAK,OAAO,KAAK;QACpD,IAAI,MAAM,YAAY,MAAM,GAAG,QAAQ,KAAK,OAAO,MAAM;GAEhE;EACF;EACA,IAAI,OAAO,YAAY,UAAU;EAEjC,MAAM,UAAU;EAMhB,IAAI,QAAQ,UAAU,KAAA,GAAW,QAAQ,KAAK,QAAQ,KAAK;EAC3D,IAAI,QAAQ,WAAW,KAAA,GAAW,QAAQ,KAAK,QAAQ,MAAM;EAC7D,IAAI,QAAQ,YAAY,KAAA,GAAW,QAAQ,KAAK,QAAQ,OAAO;CACjE;CAEA,OAAO;AACT;AAIA,MAAM,kBAAkB,OAAgB,WAAmB;CAEzD,MAAM,SAAS,mBAAmB,KADhB,OAAO,WAAW,KAAK,IAAI,EAAE,GACR;CAEvC,OAAO,gBAAgB,QAAQ,UAAU,UAAU,UAAU,UAAU,aAAa,QAAQ;AAC9F;AAEA,MAAM,YAAY,OAAO,GAAG,WAAW,OAEpC;CACD,MAAM,WAAW,OAAO;CACxB,MAAM,WAAW,MAAM,MAAM;CAE7B,OAAO,SAAS,QAAQ,OAAO,SAAS,KAAK,SAAS,MAAM;AAC9D,CAAC;AAED,MAAM,YAAY,OAAO,GAAG,WAAW,WAAgB,QAAgB;CACrE,MAAM,WAAW,OAAO;CAExB,OAAO,OAAO,UACZ,SACG,OAAO,EACN,IAAI,GAAG,aAAa,UAAU,kCAAkC,KAAK,OAAO,GAAG,OAAO,GACpF,IACF,EACF,CAAC,CAAC,CACD,KAAK,GAAG,YAAY,CACzB;AACF,CAAC;AAED,MAAM,sBAAsB,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAAW,SAAkB;CAGhG,OAAO,QAAO,OAFU,0BAAA,CAGrB,OAAO,EAAE,OAAO,QAAQ,GAAG,gBAAgB,GAAG,mBAAmB,EAAE,CAAC,CAAC,CACrE,KAAK,GAAG,YAAY,CAAC,CACrB,KACC,OAAO,SAAS,SAAS;EACvB,MAAM,QAAQ,OAAO,KAAK,EAAE,EAAE,KAAK;EAEnC,OAAO,OAAO,SAAS,KAAK,IAAI,OAAO,QAAQ,KAAK,IAAI,OAAO,KAAK,YAAY,CAAC;CACnF,CAAC,CACH;AACJ,CAAC;AAED,MAAM,YACJ,YACA,cAEA,eAAe,KAAA,IACX,aACA,cAAc,KAAA,IACZ,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;CACT,KAAK;CACL,QAAQ,UAAU,IAAIA,0BAAwB;EAAE,WAAW;EAAW;CAAM,CAAC;AAC/E,CAAC;AAET,MAAM,gCAAgC,SAAkB,YACtD,SACE,QAAQ,QAAQ,uBAAuB,OAAO,KAAK,QAAQ,kBAC3D,QAAQ,QAAQ,6BAA6B,KAAA,IACzC,QAAQ,6BACF,QAAQ,QAAQ,yBAA0B,OAAO,CAC7D;AAEF,MAAM,kBAAkB,aAAsB;CAC5C,IAAI,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,EAAE;CACpD,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;CAC5D,kBAAkB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,gBAAgB;AAClF;AAEA,MAAM,qBAAqB,aAAsB;CAC/C,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;CACxE,OAAO,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,KAAK;CAChE,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;CACxE,YAAY,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,UAAU;CAC1E,iBAAiB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,eAAe;AACtF;AAEA,MAAM,qBAAqB,aAAsB;CAC/C,UAAU,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,QAAQ;CACtE,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;CACxE,cAAc,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,YAAY;CAC9E,oBAAoB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,kBAAkB;CAC1F,iBAAiB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,eAAe;CACpF,UAAU,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,QAAQ;CACtE,eAAe,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,aAAa;AAClF;AAEA,MAAM,oBAAoB,aAAsB;CAC9C,WAAW,OAAO,QAAQ,oBAAoB,OAAO,QAAQ,oBAAoB,SAAS;CAC1F,cAAc,OAAO,QAAQ,oBAAoB,OAAO,QAAQ,oBAAoB,YAAY;CAChG,UAAU,OAAO,QAAQ,oBAAoB,OAAO,QAAQ,oBAAoB,QAAQ;CACxF,QACE,QAAQ,oBAAoB,WAAW,KAAA,IACnC,KAAA,IACA,OAAO,QAAQ,oBAAoB,OAAO,QAAQ,oBAAoB,MAAM;AACpF;AAEA,MAAM,kBAAkB,aAAsB;CAC5C,UAAU,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,QAAQ;CAChE,WAAW,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,SAAS;CAClE,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;CAC5D,eAAe,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,aAAa;CAC1E,UAAU,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,QAAQ;CAChE,gBAAgB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,cAAc;AAC9E;AAEA,MAAM,iBAAiB,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,YACA;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,IAAI,kBAAkB,OAAO;CAEnC,OAAO,OAAO,SACX,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,IAAI,GAAG,EAAE,WAAW,WAAW,SAAS,GAAG,GAAG,EAAE,OAAO,WAAW,KAAK,CAAC,CAAC,CAAC,CAChF,MAAM,CAAC;AACZ,CAAC;AAED,MAAM,oBAAoB,OAAO,GAAG,2BAA2B,CAAC,CAAC,WAC/D,SACA,iBACA;CAGA,OAAO,QAAO,OAFU,0BAAA,CAGrB,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,GAAG,eAAe,OAAO,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,CACtD,MAAM,CAAC;AACZ,CAAC;AAED,MAAM,uBAAuB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACrE,SACA,UACA,iBACA;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,IAAI,kBAAkB,OAAO;CAEnC,OAAO,OAAO,SACX,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,IAAI,GAAG,EAAE,UAAU,QAAQ,GAAG,GAAG,EAAE,WAAW,eAAe,CAAC,CAAC,CAAC,CACtE,MAAM,CAAC;AACZ,CAAC;AAED,MAAM,oBAAoB,OAAO,GAAG,qCAAqC,CAAC,CAAC,WACzE,SACA,UACA,YACA,oBACA;CACA,MAAM,iBAAiB,OAAO,eAAe,SAAS,UAAU,EAAA,CAAG;CAEnE,IAAI,kBAAkB,KAAA,KAAa,CAAC,QAAQ,WAAW,UAAU,aAAa,GAAG,OAAO,KAAA;CACxF,MAAM,kBAAkB,cAAc,QAAQ,WAAW;CACzD,MAAM,WAAW,OAAO,kBAAkB,SAAS,eAAe,EAAA,CAAG;CAErE,IAAI,YAAY,KAAA,KAAa,CAAC,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,GAC1F,OAAO,KAAA;CACT,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,eAAe;CAEpE,IAAI,uBAAuB,KAAA,KAAa,cAAc,oBAAoB,OAAO,KAAA;CACjF,MAAM,cAAc,OAAO,qBAAqB,SAAS,UAAU,eAAe,EAAA,CAAG;CAErF,IAAI,eAAe,KAAA,GAAW,OAAO;EAAE;EAAiB;EAAS,YAAY;CAAc;CAM3F,OAAO;EAAE;EAAiB;EAAS,YAAY;EAAe;EAAY,UAAA,OAJlD,QAAQ,WAC7B,OAAO;GAAE;GAAU;GAAS,YAAY;GAAe;EAAW,CAAC,CAAC,CACpE,KAAK,OAAO,QAAQ,0BAA0B,CAAC;CAEiC;AACrF,CAAC;AAED,MAAM,qBAAqB,OAAO,WAChC,OAAO,eAAe,uBAAuB,OAAO,MAAM,CAC5D;AAEA,MAAM,mBAAmB,OAAO,WAC9B,OAAO,eAAe,0BAA0B,OAAO,YAAY,CACrE;AAEA,MAAM,sBACJ,SACA,UACA,gBACG;CACH,MAAM,SAAS,mBAAmB,SAAS,MAAM;CACjD,MAAM,QAAQ,GAAG,gDAAgD,QAAQ,GAAG,gBAAgB,OAAO,QAAQ,GAAG,gBAAgB,iDAAiD,YAAY;CAE3L,OAAO,GAAG;8BACkB,iBAAiB,YAAY,YAAY,EAAE;+CAC1B,OAAO,+DAA+D,QAAQ,GAAG,gBAAgB;gIAChB,OAAO,gEAAgE,MAAM;6FAChH,OAAO,mBAAmB,MAAM;yCACpF,OAAO,mBAAmB,MAAM;;AAEzE;AAEA,MAAM,kBAAkB,MAAuB,UAC7C,KAAK,cAAc,MAAM,aAAa,KAAK,UAAU,MAAM;AAE7D,MAAM,uBACJ,UACA,aACA,QACG;CACH,IAAI,SAAS,OAAO,SAAS,MAAM,SAAS,SAAS,YAAY,SAAS,IAAI,OAAO;CACrF,MAAM,4BAAY,IAAI,IAAoB;CAE1C,KAAK,MAAM,YAAY,SAAS,SAAS,aAAa;EACpD,IAAI,UAAU,IAAI,SAAS,YAAY,GAAG,OAAO;EACjD,UAAU,IAAI,SAAS,cAAc,SAAS,QAAQ;CACxD;CACA,IAAI,SAAS,OAAO,MAAM,UAAU,CAAC,UAAU,IAAI,MAAM,YAAY,CAAC,GAAG,OAAO;CAChF,IAAI,SAAS,OAAO,MAAM,UAAU,MAAM,SAAS,cAAc,MAAM,UAAU,CAAC,GAAG,OAAO;CAE5F,MAAM,QAAQ,SAAS,OAAO,QAC3B,UAAU,MAAM,SAAS,cAAc,MAAM,UAAU,IAAI,YAAY,gBAC1E;CAEA,MAAM,UAAU,IAAI,IAAI,MAAM,SAAS,UAAU,MAAM,OAAO,CAAC;CAC/D,MAAM,cAAc,IAAI,IAAI,MAAM,KAAK,UAAU,MAAM,YAAY,CAAC;CAEpE,OAAO,YAAY,aAAa,MAC7B,gBACC,YAAY,QAAQ,OAAO,WAAW,QAAQ,IAAI,MAAM,CAAC,KACzD,YAAY,QAAQ,YAAY,sBAChC,MAAM,MACH,WACE,CAAC,YAAY,gBAAgB,MAAM,kBACnC,CAAC,YAAY,qBAAqB,MAAM,kBAC7C,CACJ;AACF;AAEA,MAAM,wBAAwB,OAAO,GAAG,yCAAyC,CAAC,CAAC,WACjF,OACA;CACA,MAAM,mBAAmB,yBAAyB,MAAM,gBAAgB;CAExE,MAAM,WAAW,OAAO,+BAA+B,MAAM,cAAc,QAAQ,CAAC,CAAC,KACnF,OAAO,SAAS,WAAW,CAC7B;CAEA,MAAM,cAAc,OAAO,4BAA4B,MAAM,cAAc,WAAW;CAEtF,MAAM,aACJ,MAAM,eAAe,KAAA,IACjB,KAAA,IACA,OAAO,2BAA2B,MAAM,UAAU;CAExD,OAAO,OAAO,OAAO;EACnB,GAAG;EACH;EACA,aAAa,OAAO,OAAO;GACzB,UAAU,SAAS,KAAK,SAAS,MAAM,MAAM,YAAY,QAAQ,CAAC;GAClE,eAAe,MAAM,YAAY;EACnC,CAAC;EACD,cAAc,OAAO,OAAO,EAAE,GAAG,MAAM,aAAa,CAAC;EACrD,GAAI,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW;EACjD,eAAe,OAAO,OAAO;GAC3B,WAAW,OAAO,OAAO;IACvB,GAAG,MAAM,cAAc;IACvB,UAAU,yBAAyB,MAAM,cAAc,UAAU,QAAQ;GAC3E,CAAC;GACD;GACA;EACF,CAAC;CACH,CAAC;AACH,CAAC;AAED,MAAM,6BACJ,UACG;CACH,MAAM,aAAa,MAAM,WAAW;CACpC,MAAM,UAAU,WAAW;CAE3B,IACE,WAAW,aAAa,GAAG,MAAM,SAAS,WAC1C,WAAW,YAAY,oBACvB,QAAQ,SAAS,aACjB,MAAM,eAAe,KAAA,KACrB,QAAQ,SAAS,cAAc,MAAM,iBAAiB,aACtD,QAAQ,SAAS,qBAAqB,MAAM,iBAAiB,oBAC7D,CAAC,eAAe,QAAQ,YAAY,MAAM,WAAW,UAAU,GAE/D,OAAO;CAET,MAAM,WAAW,CAAC,GAAG,MAAM,iBAAiB,WAAW,CAAC,CAAC,MAAM,MAAM,UACnE,KAAK,aAAa,cAAc,MAAM,YAAY,CACpD;CAEA,MAAM,SAAS,CAAC,GAAG,QAAQ,SAAS,WAAW,CAAC,CAAC,MAAM,MAAM,UAC3D,KAAK,aAAa,cAAc,MAAM,YAAY,CACpD;CAEA,OACE,SAAS,WAAW,OAAO,UAC3B,SAAS,OACN,MAAM,UACL,KAAK,iBAAiB,OAAO,MAAM,CAAE,gBACrC,KAAK,aAAa,OAAO,MAAM,CAAE,QACrC;AAEJ;AAEA,MAAM,uBAAuB,OAAO,GAAG,gCAAgC,CAAC,CAAC,WACvE,SACA,OACA;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,OAA4B;EAChC;EACA,UAAU,UAAU,SAAS,YAAY,QAAQ,QAAQ,QAAQ,QAAQ,CAAC;CAC5E;CAEA,MAAM,SAAS,qCAAqC,MAAM;CAoB1D,OAAO,OAlBM,uBAET,OAAO,IAAI,aAAa;EACtB,MAAM,WAAW,OAAO,6BACtB,SACA,MACA;GAAE,YAAY,CAAC;GAAG,kBAAkB,GAAG;EAAQ,SACzC,KACR;EAEA,IAAI,SAAS,WAAW,WAAW,GAAG,OAAO;EAC7C,OAAO,SAAS,QAAQ,MAAM,SAAS,UAAU;EAEjD,OAAO;CACT,CAAC,GACH,EAAE,MAAM,QAAQ,CAGD,CAAC,CAAC,KACjB,OAAO,GAAG,KAAK,GACf,OAAO,YAAY,UACjB,eAAe,OAAO,MAAM,IAAI,OAAO,QAAQ,IAAI,IAAI,OAAO,UAAU,KAAK,CAC/E,CACF;AACF,CAAC;AAED,MAAM,8BACJ,SACA,OACA,iBACA,qBACG;CACH,IAAI,MAAM,eAAe,KAAA,GAAW,OAAO,GAAG;CAE9C,MAAM,KAAK,kBAAkB,OAAO,GAClC,WAAW,MAAM;CAEnB,OAAO,IACL,QAAQ,WAAW,mBAAmB;EAAE,YAAY,SAAS;EAAY;CAAgB,CAAC,GAC1F,GAAG,wBAAwB,QAAQ,WAAW,MAAM,SAAS,GAAG,UAAU,KAAK,IAAI,MAAM,SAAS,WAAW,WAAW,GAAG,SAAS,EAAE,OAAO,GAAG,MAAM,KAAK,IAAI,MAAM,SAAS,WAAW,OAAO,GAAG,KAAK,EAAE,OAAO,GAAG,UAAU,KAAK,IAAI,MAAM,iBAAiB,GAAG,SAAS,EAAE,OAAO,GAAG,gBAAgB,KAAK,IAAI,MAAM,SAAS,2BAA2B,GAAG,eAAe,EAAE,OAAO,UAAU,UAAU,gBAAgB,IAAI,GAAG,GAAG,GAAG,WAAW,YAAY,GAAG,GAAG,GAAG,WAAW,KAAK,IAAI,MAAM,kBAAkB,GAAG,UAAU,IAAI,EACpgB;AACF;AAEA,MAAM,gBAAgB,OAAO,GAAG,iCAAiC,CAAC,CAAC,WACjE,SACA,OACA,QACA;CACA,MAAM,WAAW,OAAO;CAExB,IACE,MAAM,cAAc,SAAS,OAAO,SAAS,MAC7C,MAAM,cAAc,SAAS,SAAS,YAAY,SAAS,IAE3D,OAAO,KAAA;CAET,MAAM,cAAc,IAAI,IACtB,MAAM,cAAc,SAAS,SAAS,YAAY,KAAK,SAAS,KAAK,YAAY,CACnF;CAEA,IACE,YAAY,SAAS,MAAM,cAAc,SAAS,SAAS,YAAY,UACvE,MAAM,cAAc,SAAS,OAAO,MAAM,UAAU,CAAC,YAAY,IAAI,MAAM,YAAY,CAAC,GAExF,OAAO,KAAA;CACT,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,MAAM,iBAAiB,SAAS;CAC1F,MAAM,WAAW,OAAO,kBAAkB,SAAS,eAAe,EAAA,CAAG;CAErE,IACE,YAAY,KAAA,KACZ,CAAC,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,KAC/D,QAAQ,QAAQ,QAAQ,sBAAsB,MAAM,iBAAiB,oBACrE,MAAM,cAAc,UAAU,aAAa,MAAM,YACjD,MAAM,cAAc,UAAU,WAAW,UACzC,MAAM,cAAc,UAAU,cAAc,MAAM,aAClD,MAAM,cAAc,UAAU,SAAS,cAAc,MAAM,iBAAiB,aAC5E,MAAM,cAAc,UAAU,SAAS,qBACrC,MAAM,iBAAiB,oBACzB,MAAM,cAAc,SAAS,SAAS,cAAc,MAAM,iBAAiB,aAC3E,MAAM,cAAc,SAAS,SAAS,qBACpC,MAAM,iBAAiB,oBACxB,MAAM,cAAc,SAAS,WAAuB,MAAM,aAC3D,MAAM,cAAc,SAAS,kBAAkB,MAAM,cAAc,UAAU,iBAC5E,WAAW,mBACT,MAAM,eAAe,KAAA,KACpB,MAAM,cAAc,UAAU,uBAAuB,KAAA,MACzD,MAAM,iBAAiB,YAAY,MAChC,aACC,CAAC,MAAM,cAAc,SAAS,SAAS,YAAY,MAChD,WACC,OAAO,iBAAiB,SAAS,gBAAgB,OAAO,aAAa,SAAS,QAClF,CACJ,GAEA,OAAO,KAAA;CACT,IAAI,sBAA2B,GAAG;CAElC,IAAI,MAAM,eAAe,KAAA,GAAW;EAClC,MAAM,cAAc,OAAO,eAAe,SAAS,MAAM,WAAW,UAAU,EAAA,CAAG;EAEjF,IACE,eAAe,KAAA,KACf,MAAM,cAAc,UAAU,uBAAuB,MAAM,WAAW,gBACtE,CAAC,QAAQ,WAAW,UAAU,UAAU,KACxC,CAAC,QAAQ,UAAU,OAAO,WAAW,QAAQ,WAAW,YAAY,eAAe,KACnF,WAAW,QAAQ,WAAW,qBAAqB,MAAM,WAAW,2BAEpE,OAAO,KAAA;EACT,MAAM,cAAc,OAAO,qBAAqB,SAAS,MAAM,UAAU,eAAe,EAAA,CAAG;EAE3F,IAAI,eAAe,KAAA,GAAW,OAAO,KAAA;EAErC,MAAM,WAAW,OAAO,QAAQ,WAAW,OAAO;GAChD,UAAU,MAAM;GAChB;GACA;GACA;EACF,CAAC;EAED,IAAI,CAACC,+BAAa,UAAU,MAAM,UAAU,GAAG,OAAO,KAAA;EACtD,sBAAsB,2BACpB,SACA,OACA,iBACA,WAAW,QAAQ,WAAW,WAChC;EACA,MAAM,KAAK,kBAAkB,OAAO;EAEpC,sBAAsB,IACpB,qBACA,GAAG,wBAAwB,QAAQ,WAAW,MAAM,SAAS,GAAG,UAAU,KAAK,IAAI,MAAM,MAAM,WAAW,WAAW,WAAW,GAAG,SAAS,EAAE,OAAO,GAAG,MAAM,KAAK,IAAI,MAAM,MAAM,WAAW,WAAW,OAAO,GAAG,KAAK,EAAE,OAAO,GAAG,UAAU,KAAK,IAAI,MAAM,iBAAiB,GAAG,SAAS,EAAE,OAAO,GAAG,gBAAgB,KAAK,IAAI,MAAM,MAAM,WAAW,2BAA2B,GAAG,eAAe,EAAE,EACvY;CACF;CAEA,MAAM,WAAW,CACf,GAAG,IAAI,IACL,CACE,GAAG,MAAM,iBAAiB,aAC1B,GAAG,MAAM,cAAc,SAAS,SAAS,WAC3C,CAAC,CAAC,KAAK,SAAS,CAAC,KAAK,cAAc,IAAI,CAAC,CAC3C,CAAC,CAAC,OAAO,CACX,CAAC,CAAC,MAAM,MAAM,UAAU,KAAK,aAAa,cAAc,MAAM,YAAY,CAAC;CAE3E,MAAM,KAAK,iBAAiB,OAAO;CAkBnC,MAAM,aAAa,CAAC,GAflB,SAAS,WAAW,IAChB,CAAC,IACD,OAAO,SACJ,OAAO,CAAC,CACR,KAAK,QAAQ,oBAAoB,KAAK,CAAC,CACvC,MACC,IACE,GAAG,GAAG,WAAW,eAAe,GAChC,QACE,GAAG,cACH,SAAS,KAAK,SAAS,KAAK,YAAY,CAC1C,CACF,CACF,CAEmB,CAAC,CAAC,MAAM,MAAW,UAC5C,OAAO,KAAK,QAAQ,oBAAoB,aAAa,CAAC,CAAC,cACrD,OAAO,MAAM,QAAQ,oBAAoB,aAAa,CACxD,CACF;CAEA,IACE,WAAW,WAAW,SAAS,UAC/B,WAAW,MACR,KAAU,UACT,IAAI,QAAQ,oBAAoB,kBAAkB,SAAS,MAAM,CAAE,gBACnE,IAAI,QAAQ,oBAAoB,cAAc,SAAS,MAAM,CAAE,YAC9D,QAAQ,oBAAoB,WAAW,KAAA,KACtC,QAAQ,oBAAoB,iBAAiB,IAAI,QAAQ,oBAAoB,OAAO,MAClF,IACR,GAEA,OAAO,KAAA;CACT,MAAM,cAAc,OAAO,QAAQ,QAAQ,wBAAwB,SAAS,MAAM;CAClF,MAAM,YAAY,OAAO,oBAAoB,OAAO;CAEpD,IACE,CAAC,oBACC,MAAM,cAAc,UACpB,MAAM,cAAc,aACpB,SACF,KACA,CAAC,oBAAoB,MAAM,cAAc,UAAU,aAAa,SAAS,GAEzE,OAAO,KAAA;CACT,KACG,MAAM,aAAa,qBAAqB,eACvC,MAAM,aAAa,qBAAqB,mBAC1C,QAAQ,wBAAwB,4BAEhC,OAAO,KAAA;CACT,MAAM,IAAI,eAAe,OAAO;CAEhC,MAAM,uBAAuB,SAAS,KACnC,SACC,GAAG,wBAAwB,QAAQ,oBAAoB,MAAM,SAAS,GAAG,UAAU,KAAK,IAAI,MAAM,iBAAiB,GAAG,SAAS,EAAE,OAAO,GAAG,aAAa,KAAK,IAAI,MAAM,KAAK,cAAc,GAAG,YAAY,EAAE,OAAO,GAAG,SAAS,KAAK,IAAI,MAAM,KAAK,UAAU,GAAG,QAAQ,IAAI,GAAG,WAAW,KAAA,IAAY,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,KAAK,IAAI,MAAM,QAAQ,oBAAoB,qBAAqB,GAAG,MAAM,IAAI,EACnZ;CAEA,OAAO;EACL;EACA;EACA;EACA;EACA,WAAW,cACT,GAAG,wBAAwB,QAAQ,QAAQ,MAAM,SAAS,EAAE,GAAG,KAAK,IAAI,MAAM,iBAAiB,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI,MAAM,QAAQ,QAAQ,qBAAqB,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,KAAK,IAAI,MAAM,MAAM,iBAAiB,kBAAkB,EAAE,gBAAgB,EAAE,IACzR,qBACA,GAAG,sBACH,mBAAmB,SAAS,MAAM,cAAc,UAAU,MAAM,cAAc,WAAW,GACzF,mBAAmB,SAAS,MAAM,cAAc,UAAU,WAAW,CACvE;CACF;AACF,CAAC;AAED,MAAM,0BAA0B,SAAkB,UAAkB,cAAsB;CACxF,MAAM,IAAI,eAAe,OAAO;CAEhC,OAAO,GAAG,4BAA4B,QAAQ,QAAQ,MAAM,SAAS,EAAE,SAAS,KAAK,IAAI,MAAM,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,KAAK,IAAI,MAAM,WAAW,EAAE,SAAS,EAAE;AACjL;AAEA,MAAM,8BACJ,SACA,OACA,oBACG;CACH,MAAM,IAAI,kBAAkB,OAAO;CAEnC,OAAO,MAAM,eAAe,KAAA,IACxB,GAAG,UACH,GAAG,wBAAwB,QAAQ,WAAW,MAAM,SAAS,EAAE,SAAS,KAAK,IAAI,MAAM,MAAM,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,KAAK,IAAI,MAAM,iBAAiB,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,KAAK,IAAI,MAAM,MAAM,WAAW,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,mBAAmB,KAAK,IAAI,MAAM,MAAM,WAAW,oBAAoB,EAAE,kBAAkB,EAAE,OAAO,EAAE,gBAAgB,KAAK,IAAI,MAAM,MAAM,WAAW,iBAAiB,EAAE,eAAe,EAAE,OAAO,EAAE,SAAS,KAAK,IAAI,MAAM,SAAS,MAAM,MAAM,WAAW,QAAQ,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,KAAK,IAAI,MAAM,MAAM,WAAW,eAAe,EAAE,aAAa,EAAE;AAC/nB;AAEA,MAAM,qBAAqB,OAAO,GAAG,WACnC,SACA,OACA,iBACA,WAKA,KACA;CACA,MAAM,WAAW,OAAO;CACxB,MAAM,IAAI,kBAAkB,OAAO;CACnC,MAAM,IAAI,eAAe,OAAO;CAChC,MAAM,KAAK,iBAAiB,OAAO;CAEnC,OAAO;EACL,OAAO,UACL,SACG,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,IACC,QAAQ,WAAW,kBAAkB;GACnC,aAAa,MAAM;GACnB,oBAAoB,UAAU;GAC9B,iBAAiB,UAAU;EAC7B,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,WAAW,eAAe,GAC/B,GAAG,EAAE,cAAc,MAAM,WAAY,YAAY,GACjD,GAAG,EAAE,oBAAoB,MAAM,WAAY,kBAAkB,GAC7D,GAAG,EAAE,iBAAiB,MAAM,WAAY,eAAe,GACvD,GAAG,EAAE,UAAU,SAAS,MAAM,MAAM,WAAY,QAAQ,CAAC,GACzD,GAAG,EAAE,eAAe,MAAM,WAAY,aAAa,CACrD,CACF,CACJ;EACA,OAAO,UACL,SACG,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,IAAI,aAAa,CAAC,CAAC,QAAQ,QAAQ,kBAAkB,UAAU,oBAAoB,CAAC,CAAC,CAAC,CAAC,CACvF,MACC,IACE,GAAG,EAAE,IAAI,eAAe,GACxB,GAAG,EAAE,kBAAkB,MAAM,iBAAiB,gBAAgB,CAChE,CACF,CACJ;EACA,OAAO,UACL,SACG,OAAO,QAAQ,oBAAoB,KAAK,CAAC,CACzC,IAAI,QAAQ,oBAAoB,eAAe,UAAU,kBAAkB,CAAC,CAAC,CAC7E,MACC,IACE,GAAG,GAAG,WAAW,eAAe,GAChC,GAAG,GAAG,cAAc,MAAM,WAAY,YAAY,GAClD,GAAG,GAAG,UAAU,MAAM,WAAY,kBAAkB,CACtD,CACF,CACJ;EACA,OAAO,UACL,SAAS,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,OACrC,QAAQ,QAAQ,aAAa;GAC3B,UAAU,MAAM;GAChB,WAAW,MAAM;GACjB,QAAQ,MAAM,cAAc,UAAU;GACtC,eAAe,MAAM,cAAc,UAAU;GAC7C,UAAU;GACV,sBAAsB,MAAM,QAAQ;EACtC,CAAC,CACH,CACF;CACF;AACF,CAAC;AAED,MAAM,sBACJ,SACA,OACA,iBACA,WAKA,KACA,wBACG;CACH,MAAM,IAAI,kBAAkB,OAAO;CACnC,MAAM,IAAI,eAAe,OAAO;CAChC,MAAM,KAAK,iBAAiB,OAAO;CACnC,MAAM,KAAK,eAAe,OAAO;CAEjC,OAAO,IACL,GAAG,wBAAwB,QAAQ,WAAW,MAAM,SAAS,EAAE,SAAS,KAAK,IAAI,MAAM,MAAM,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,KAAK,IAAI,MAAM,iBAAiB,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,KAAK,IAAI,MAAM,MAAM,WAAY,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,mBAAmB,KAAK,IAAI,MAAM,UAAU,oBAAoB,EAAE,kBAAkB,EAAE,OAAO,EAAE,gBAAgB,KAAK,IAAI,MAAM,UAAU,iBAAiB,EAAE,eAAe,EAAE,OAAO,EAAE,SAAS,KAAK,IAAI,MAAM,SAAS,MAAM,MAAM,YAAY,QAAQ,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,KAAK,IAAI,MAAM,MAAM,YAAY,eAAe,EAAE,aAAa,EAAE,IAC9mB,GAAG,wBAAwB,QAAQ,QAAQ,MAAM,SAAS,EAAE,GAAG,KAAK,IAAI,MAAM,iBAAiB,EAAE,EAAE,EAAE,OAAO,EAAE,iBAAiB,KAAK,IAAI,MAAM,UAAU,sBAAsB,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI,MAAM,QAAQ,QAAQ,qBAAqB,EAAE,MAAM,EAAE,IAChR,GAAG,wBAAwB,QAAQ,oBAAoB,MAAM,SAAS,GAAG,UAAU,KAAK,IAAI,MAAM,iBAAiB,GAAG,SAAS,EAAE,OAAO,GAAG,aAAa,KAAK,IAAI,MAAM,MAAM,WAAY,cAAc,GAAG,YAAY,EAAE,OAAO,GAAG,SAAS,KAAK,IAAI,MAAM,UAAU,oBAAoB,GAAG,QAAQ,IAAI,GAAG,WAAW,KAAA,IAAY,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,KAAK,IAAI,MAAM,QAAQ,oBAAoB,qBAAqB,GAAG,MAAM,IAAI,IAC3a,GAAG,wBAAwB,QAAQ,QAAQ,MAAM,SAAS,GAAG,SAAS,KAAK,IAAI,MAAM,MAAM,UAAU,GAAG,QAAQ,EAAE,OAAO,GAAG,UAAU,KAAK,IAAI,MAAM,MAAM,WAAW,GAAG,SAAS,EAAE,OAAO,GAAG,cAAc,KAAK,IAAI,MAAM,MAAM,cAAc,UAAU,eAAe,GAAG,aAAa,EAAE,OAAO,GAAG,OAAO,KAAK,IAAI,MAAM,MAAM,cAAc,UAAU,QAAQ,GAAG,MAAM,EAAE,OAAO,GAAG,SAAS,KAAK,IAAI,MAAM,WAAW,GAAG,QAAQ,EAAE,OAAO,GAAG,eAAe,KAAK,IAAI,MAAM,QAAQ,cAAc,MAAM,QAAQ,sBAAsB,GAAG,GAAG,cAAc,EAAE,IAC7hB,qBACA,GAAG,MACL;AACF;AAEA,MAAM,qBAAqB,OAAO,GAAG,sCAAsC,CAAC,CAAC,WAC3E,SACA,OACA,WAMA;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,EAAE,cAAc,oBAAoB,iBAAiB,yBAAyB;CAEpF,MAAM,YAAY,OAAO,cAAc,SAAS,OAAO,cAAc;CAErE,IAAI,cAAc,KAAA,GAAW,OAAO,KAAA;CACpC,MAAM,MAAM,OAAO,oBAAoB,OAAO;CAC9C,MAAM,IAAI,kBAAkB,OAAO;CACnC,MAAM,IAAI,eAAe,OAAO;CAChC,MAAM,KAAK,iBAAiB,OAAO;CACnC,MAAM,KAAK,eAAe,OAAO;CACjC,MAAM,SAAS,kCAAkC,MAAM;CACvD,MAAM,SAAS,GAAG,4BAA4B,QAAQ,WAAW,MAAM,SAAS,EAAE,SAAS,KAAK,IAAI,MAAM,MAAM,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,KAAK,IAAI,MAAM,UAAU,iBAAiB,EAAE,SAAS,EAAE;CAEhN,MAAM,QAAQ,IACZ,UAAU,WACV,QACA,uBAAuB,SAAS,MAAM,UAAU,MAAM,SAAS,CACjE;CAEA,MAAM,mBAAmB,IACvB,GAAG,wBAAwB,QAAQ,WAAW,MAAM,SAAS,EAAE,SAAS,KAAK,IAAI,MAAM,MAAM,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,KAAK,IAAI,MAAM,UAAU,iBAAiB,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,KAAK,IAAI,MAAM,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,mBAAmB,KAAK,IAAI,MAAM,oBAAoB,EAAE,kBAAkB,EAAE,OAAO,EAAE,gBAAgB,KAAK,IAAI,MAAM,iBAAiB,EAAE,eAAe,EAAE,OAAO,EAAE,SAAS,KAAK,IAAI,MAAM,SAAS,MAAM,MAAM,YAAY,QAAQ,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,KAAK,IAAI,MAAM,MAAM,YAAY,eAAe,EAAE,aAAa,EAAE,IACllB,GAAG,wBAAwB,QAAQ,oBAAoB,MAAM,SAAS,GAAG,UAAU,KAAK,IAAI,MAAM,UAAU,iBAAiB,GAAG,SAAS,EAAE,OAAO,GAAG,aAAa,KAAK,IAAI,MAAM,cAAc,GAAG,YAAY,EAAE,OAAO,GAAG,SAAS,KAAK,IAAI,MAAM,oBAAoB,GAAG,QAAQ,IAAI,GAAG,WAAW,KAAA,IAAY,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,KAAK,IAAI,MAAM,QAAQ,oBAAoB,qBAAqB,GAAG,MAAM,IAAI,IACzZ,GAAG,wBAAwB,QAAQ,QAAQ,MAAM,SAAS,EAAE,GAAG,KAAK,IAAI,MAAM,UAAU,iBAAiB,EAAE,EAAE,EAAE,OAAO,EAAE,iBAAiB,KAAK,IAAI,MAAM,sBAAsB,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI,MAAM,QAAQ,QAAQ,qBAAqB,EAAE,MAAM,EAAE,IAChR,GAAG,wBAAwB,QAAQ,QAAQ,MAAM,SAAS,GAAG,SAAS,KAAK,IAAI,MAAM,MAAM,UAAU,GAAG,QAAQ,EAAE,OAAO,GAAG,UAAU,KAAK,IAAI,MAAM,MAAM,WAAW,GAAG,SAAS,EAAE,OAAO,GAAG,cAAc,KAAK,IAAI,MAAM,MAAM,cAAc,UAAU,eAAe,GAAG,aAAa,EAAE,OAAO,GAAG,OAAO,KAAK,IAAI,MAAM,gBAAgB,GAAG,MAAM,EAAE,OAAO,GAAG,SAAS,KAAK,IAAI,MAAM,WAAW,GAAG,QAAQ,EAAE,OAAO,GAAG,eAAe,KAAK,IAAI,MAAM,QAAQ,cAAc,MAAM,QAAQ,sBAAsB,GAAG,GAAG,cAAc,EAAE,EACzgB;CAmDA,OAAO;EACL,YAAA;GAjDA,OAAO,UAAU,OAAO,MAAM;GAC9B,OAAO,UACL,SAAS,OAAO,QAAQ,WAAW,KAAK,CAAC,CAAC,OACxC,QAAQ,WAAW,aAAa;IAC9B,UAAU,MAAM;IAChB,WAAW,UAAU;IACrB;IACA;IACA;IACA,aAAa,MAAM;GACrB,CAAC,CACH,CACF;GACA,OAAO,UACL,SAAS,OAAO,QAAQ,oBAAoB,KAAK,CAAC,CAAC,OACjD,QAAQ,oBAAoB,aAAa;IACvC,WAAW,UAAU;IACrB;IACA,UAAU;GACZ,CAAC,CACH,CACF;GACA,OAAO,UACL,SACG,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,IAAI,aAAa,CAAC,CAAC,QAAQ,QAAQ,kBAAkB,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAC7E,MACC,IACE,GAAG,EAAE,IAAI,UAAU,eAAe,GAClC,GAAG,EAAE,kBAAkB,MAAM,iBAAiB,gBAAgB,CAChE,CACF,CACJ;GACA,OAAO,UACL,SAAS,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,OACrC,QAAQ,QAAQ,aAAa;IAC3B,UAAU,MAAM;IAChB,WAAW,MAAM;IACjB,QAAQ;IACR,eAAe,MAAM,cAAc,UAAU;IAC7C,UAAU;IACV,sBAAsB,MAAM,QAAQ;GACtC,CAAC,CACH,CACF;GACA,OAAO,UAAU,kBAAkB,MAAM;EAIhC;EACT;EACA;EACA,YAAY,UAAmB,eAAe,OAAO,MAAM;CAC7D;AACF,CAAC;AAED,MAAM,qBACJ,SACA,iBAcG;CACH,MAAM,OAAgB,SACpB,OAAO,IAAI,aAAa;EACtB,IAAI,CAAC,iBAAiB,OAAO,GAAG,OAAO,OAAO,YAAY;EAE1D,OAAO,OAAO;CAChB,CAAC;CAEH,OAAO;EACL,iBAAiB,eACf,OAAO,IAAI,aAAa;GACtB,IAAI,CAAC,iBAAiB,OAAO,GAAG,OAAO,OAAO,YAAY;GAC1D,MAAM,QAAQ;IAAE,GAAG;IAAY,YAAY,EAAE,GAAG,WAAW,WAAW;GAAE;GACxE,MAAM,WAAW,OAAO;GACxB,MAAM,iBAAiB,OAAO,eAAe,SAAS,MAAM,UAAU,EAAA,CAAG;GAEzE,IAAI,kBAAkB,KAAA,KAAa,CAAC,QAAQ,WAAW,UAAU,aAAa,GAC5E,OAAO,OAAO,KAAK;GACrB,MAAM,WAAW,cAAc,QAAQ,WAAW;GAElD,MAAM,KAAK,eAAe,OAAO,GAC/B,KAAK,kBAAkB,OAAO,GAC9B,KAAK,kBAAkB,OAAO;GAGhC,MAAM,OAAO,OAAO,SACjB,OAAO;IACN,SAAS,gBAAgB,QAAQ,QAAQ,KAAK;IAC9C,YAAY,gBAAgB,QAAQ,WAAW,KAAK;IACpD,YAAY,gBAAgB,QAAQ,WAAW,KAAK;GACtD,CAAC,CAAC,CACD,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,UACC,QAAQ,WAAW,OACnB,IACE,GAAG,GAAG,WAAW,MAAM,WAAW,SAAS,GAC3C,GAAG,GAAG,OAAO,MAAM,WAAW,KAAK,GACnC,GAAG,GAAG,WAAW,QAAQ,CAC3B,CACF,CAAC,CACA,UACC,QAAQ,WAAW,OACnB,IAAI,GAAG,GAAG,UAAU,MAAM,QAAQ,GAAG,GAAG,GAAG,WAAW,QAAQ,CAAC,CACjE,CAAC,CACA,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC;GAE5B,IAAI,KAAK,WAAW,GAAG,OAAO,OAAO,KAAK;GAC1C,MAAM,MAAM,KAAK;GAEjB,IACE,CAAC,QAAQ,QAAQ,eAAe,IAAI,QAAQ,QAAQ,QAAQ,OAAO,KACnE,CAAC,QAAQ,WAAW,UAAU,IAAI,UAAU,KAC5C,CAAC,QAAQ,UAAU,OAAO,UAAU,IAAI,QAAQ,QAAQ,QAAQ,GAAG,KACnE,CAAC,QAAQ,UAAU,OAAO,UAAU,IAAI,WAAW,QAAQ,WAAW,UAAU,KAChF,CAAC,QAAQ,UAAU,OAAO,UAAU,IAAI,WAAW,QAAQ,WAAW,UAAU,GAEhF,OAAO,OAAO,KAAK;GAErB,MAAM,aAAa,OAAO,QAAQ,WAC/B,OAAO;IAAE,UAAU,MAAM;IAAU,GAAG;GAAI,CAAC,CAAC,CAC5C,KAAK,OAAO,QAAQ,0BAA0B,CAAC;GAElD,OAAO,MAAM,cAAc,KAAA,KAAa,WAAW,SAAS,cAAc,MAAM,YAC5E,OAAO,KAAK,IACZ,OAAO,KAAK,UAAU;EAC5B,CAAC;EACH,kBAAkB,UAChB,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,eAAe,SAAS,KAC5B,OAAO,OAAO,aAAa,mBAAmB,CAAC,CAAC,SAAS,MAAM,MAAM,YAAY,CAAC,CACpF;GAEA,MAAM,aAAa,OAAO,2BAA2B,MAAM,UAAU;GACrE,MAAM,WAAW,OAAO;GACxB,MAAM,WAAW,OAAO,QAAQ,UAAU,SAAS,WAAW,SAAS,SAAS;GAChF,MAAM,UAAU,OAAO,SAAS,QAAQ,kBAAkB,QAAQ,oBAAoB;GAEtF,IAAI,YAAY,WAAW,iBAAiB,OAAO,OAAO,YAAY;GACtE,MAAM,UAAU,QAAQ,WAAW,eAAe,cAAc,OAAO;GAEvE,MAAM,SAAS;KACZ,QAAQ,WAAW,WAAW,QAAQ,QAAQ,WAAW;KACzD,QAAQ,WAAW,kBAAkB,QAAQ,QAAQ,WAAW;GACnE;GAEA,IAAI,OAAO,OAAO,MAAM,CAAC,CAAC,MAAM,UAAU,UAAU,KAAA,CAAS,GAC3D,OAAO,OAAO,YAAY;GAC5B,MAAM,IAAI,kBAAkB,OAAO;GAEnC,OAAO;IACL,SAAS,KAAA;IACT,YAAY,CACV,OAAO,UACL,SACG,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,IAAI,MAAM,CAAC,CACX,MACC,IACE,GAAG,EAAE,UAAU,WAAW,QAAQ,GAClC,GAAG,EAAE,WAAW,QAAQ,GACxB,GAAG,EAAE,cAAc,WAAW,YAAY,GAC1C,GACE;KACE,CAAC,EAAE,UAAU,WAAW,QAAQ;KAChC,CAAC,EAAE,WAAW,QAAQ;KACtB,CAAC,EAAE,cAAc,WAAW,YAAY;KACxC,CAAC,EAAE,oBAAoB,WAAW,kBAAkB;KACpD,CAAC,EAAE,iBAAiB,WAAW,eAAe;KAC9C,CAAC,EAAE,UAAU,SAAS,MAAM,WAAW,QAAQ,CAAC;KAChD,CAAC,EAAE,eAAe,WAAW,aAAa;IAC5C,CAAC,CACD,KAAK,CAAC,QAAQ,WACd,OAAO,UAAU,WACb,GAAG,QAAQ,OAAO,mBAAmB,IAAI,MAAM,OAAO,MAAM,EAAE,aAC9D,GAAG,QAAQ,KAAK,CACtB,CACF,CACF,CACJ,CACF;GACF;EACF,CAAC,CACH;EACF,iBAAiB,UACf,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,OAAO;GAExB,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;GACrD,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;GACzE,MAAM,WAAW,OAAO,kBAAkB,SAAS,eAAe,EAAA,CAAG;GAErE,IACE,YAAY,KAAA,KACZ,CAAC,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,GAE/D,OAAO,OAAO,KAAK;GAErB,MAAM,cAAc,OAAO,qBACzB,SACA,MAAM,UACN,eACF,EAAA,CAAG;GAEH,IAAI,eAAe,KAAA,GAAW,OAAO,OAAO,KAAK;GACjD,MAAM,KAAK,kBAAkB,OAAO;GAOpC,MAAM,cAAa,OALQ,SACxB,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,GAAG,GAAG,WAAW,eAAe,CAAC,EAAA,CAEX,MAAM,QAAa,QAAQ,WAAW,UAAU,GAAG,CAAC;GAEnF,IAAI,eAAe,KAAA,GAAW,OAAO,OAAO,KAAK;GAEjD,OAAO,OAAO,KACZ,OAAO,QAAQ,WACZ,OAAO;IAAE,UAAU,MAAM;IAAU;IAAS;IAAY;GAAW,CAAC,CAAC,CACrE,KAAK,OAAO,QAAQ,0BAA0B,CAAC,CACpD;EACF,CAAC;EACH,iBAAiB,UACf,OAAO,IAAI,aAAa;GACtB,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;GACrD,MAAM,WAAW,OAAO,kBAAkB,SAAS,MAAM,UAAU,MAAM,UAAU;GAEnF,OAAO,UAAU,aAAa,KAAA,KAC5B,SAAS,SAAS,+BAA+B,KAAA,IAC/C,OAAO,KAAK,IACZ,OAAO,KAAK,SAAS,QAAQ;EACnC,CAAC;EACH,cACE,YACA,YAEA,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,sBAAsB,UAAU;GAErD,MAAM,eAAe,OAAO,SAC1B,QAAQ,sBACR,QAAQ,wBACV;GAEA,MAAM,qBAAqB,OAAO,SAChC,QAAQ,kBACR,QAAQ,oBACV;GAEA,MAAM,kBAAkB,OAAO,SAC7B,QAAQ,kBACR,QAAQ,oBACV;GAEA,MAAM,uBAAuB,OAAO,6BAClC,SACA,MAAM,iBAAiB,gBACzB;GAEA,IAAI,yBAAyB,MAAM,iBAAiB,kBAClD,OAAO,OAAO,YAAY;GAE5B,OAAO,OAAO,IACZ,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO;IAEvB,MAAM,WAAW,OAAO,mBAAmB,SAAS,OAAO;KACzD;KACA;KACA;KACA;IACF,CAAC;IAED,IAAI,aAAa,KAAA,GACf,OAAO;KAAE,SAAS,QAAQ,YAAY,OAAO;KAAG,YAAY,CAAC;IAAE;IAEjE,OAAO;KACL,SAAS,QAAQ,WAAW,OAAO;KACnC,YAAY,SAAS;KACrB,gBAAgB,CAAC,OAAO,UAAU,SAAS,kBAAkB,SAAS,MAAM,CAAC;KAC7E,WAAW,SAAS;IACtB;GACF,CAAC,CACH;EACF,CAAC;EACH,mBACE,YACA,YAEA,OAAO,QAAQ,sBAAsB,UAAU,IAAI,UACjD,gBAAgB,SAAS,cAAc,OAAO,SAAS,iBAAiB,CAC1E;EACF,aAAa,UACX,iBAAiB,KAAA,IACb,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI,aAAa;GACtB,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;GACrD,IACE,MAAM,SAAS,UAAU,KACzB,CAAC,MAAM,SAAS,SAAS,QAAQ,KACjC,MAAM,YAAY,oBAClB,MAAM,QAAQ,SAAS,WAEvB,OAAO;GACT,MAAM,UAAU,MAAM;GAEtB,MAAM,WAAW,OAAO,kBACtB,SACA,MAAM,SAAS,MAAM,GAAG,EAAgB,GACxC,QAAQ,YACR,QAAQ,SAAS,SACnB;GAaA,OAVE,UAAU,aAAa,KAAA,KACvB,SAAS,SAAS,SAAS,qBAAqB,QAAQ,SAAS,oBACjE,QAAQ,SAAS,YAAY,OAAO,SAClC,SAAS,SAAU,SAAS,YAAY,MACrC,YACC,QAAQ,iBAAiB,KAAK,gBAC9B,QAAQ,aAAa,KAAK,QAC9B,CACF,IAEe,OAAO,qBAAqB,cAAc,KAAK,IAAI;EACtE,CAAC;EACP,iBACE,YACA,YAEA,iBAAiB,KAAA,IACb,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,QAAQ,sBAAsB,UAAU,IAAI,aACjD,gBACE,SACA,cACA,OAAO,OAAO;GAAE,GAAG;GAAU,YAAY,WAAW;EAAW,CAAC,GAChE,SACA,gBACF,CACF;CACR;AACF;AAEA,MAAM,6BAA6B,OAAO,GAAG,8CAA8C,CAAC,CAC1F,WACE,SACA,OACA,QACA,WAKA;CACA,MAAM,EAAE,oBAAoB,iBAAiB,yBAAyB;CACtE,MAAM,YAAY,OAAO,cAAc,SAAS,OAAO,MAAM;CAE7D,MAAM,UACJ,cAAc,KAAA,KAAa,MAAM,eAAe,KAAA,IAC5C,KAAA,KACC,OAAO,qBAAqB,SAAS,MAAM,UAAU,UAAU,eAAe,EAAA,CAAG;CAExF,MAAM,iBACJ,YAAY,KAAA,KACZ,QAAQ,QAAQ,WAAW,kBAAkB,MAAM,WAAY,gBAC/D,QAAQ,QAAQ,WAAW,wBAAwB,MAAM,WAAY,sBACrE,QAAQ,QAAQ,WAAW,qBAAqB,MAAM,WAAY,mBAClE,QAAQ,QAAQ,WAAW,cAAc,SAAS,MAAM,MAAM,WAAY,QAAQ,KAClF,QAAQ,QAAQ,WAAW,mBAAmB,MAAM,WAAY;CAElE,IAAI,cAAc,KAAA,KAAa,CAAC,gBAAgB,OAAO,KAAA;CACvD,MAAM,MAAM,OAAO,oBAAoB,OAAO;CAE9C,MAAM,QAAQ,IACZ,UAAU,WACV,2BAA2B,SAAS,OAAO,UAAU,eAAe,GACpE,uBAAuB,SAAS,MAAM,UAAU,MAAM,SAAS,CACjE;CAEA,MAAM,SAAS,8BAA8B,OAAO,GAAG,MAAM;CA2B7D,OAAO;EAAE,mBAAA;GAxBP,YAAY,CACV,OAAO,UAAU,OAAO,MAAM,GAC9B,GAAI,OAAO,mBACT,SACA,OACA,UAAU,iBACV;IAAE;IAAoB;IAAiB;GAAqB,GAC5D,GACF,CACF;GACA,kBAAkB,mBAChB,SACA,OACA,UAAU,iBACV;IACE;IACA;IACA;GACF,GACA,KACA,UAAU,mBACZ;EAGuB;EAAG;CAAO;AACrC,CACF;AAEA,MAAM,kBAAkB,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,SACA,cAGA,OACA,SACA,QACA;CACA,MAAM,qBAAqB,OAAO,SAChC,QAAQ,kBACR,QAAQ,oBACV;CAEA,MAAM,kBAAkB,OAAO,SAAS,QAAQ,kBAAkB,QAAQ,oBAAoB;CAE9F,MAAM,uBAAuB,OAAO,6BAClC,SACA,MAAM,iBAAiB,gBACzB;CAEA,IACE,yBAAyB,MAAM,iBAAiB,oBAC/C,MAAM,eAAe,KAAA,KAAa,uBAAuB,MAAM,WAAW,oBAE3E,OAAO,OAAO,YAAY;CAE5B,MAAM,UAAU,OAAO;CAEvB,MAAM,mBAAmB,OAAO,2BAA2B,SAAS,OAAO,QAAQ;EACjF;EACA;EACA;CACF,CAAC;CAED,IAAI,qBAAqB,KAAA,GACvB,OAAO;EAAE,SAAS,QAAQ,YAAY,OAAO;EAAG,YAAY,CAAC;CAAE;CACjE,MAAM,EAAE,mBAAmB,WAAW;CAEtC,IAAI,WAAW,kBAAkB;EAC/B,IACE,iBAAiB,KAAA,KACjB,MAAM,eAAe,KAAA,KACrB,CAAC,0BACC,KACF,GAEA,OAAO;GAAE,SAAS,QAAQ,YAAY,OAAO;GAAG,YAAY,CAAC;EAAE;EACjE,IAAI;EAEJ,MAAM,WAAW,OAAO,6BACtB,cACA,MAAM,YACN,oBACC,aAAsC;GACrC,kBAAkB,QAAQ,aAAa,cAAc,YAAY,YAAY,OAAO;GAEpF,OAAO;EACT,CACF;EAEA,OAAO;GACL,SAAS,mBAAmB,QAAQ,YAAY,OAAO;GACvD,YAAY,SAAS;GACrB,GAAI,SAAS,mBAAmB,KAAA,IAAY,CAAC,IAAI,EAAE,gBAAgB,SAAS,eAAe;GAC3F,YAAY,UACV,eAAe,OAAO,MAAM,KAC5B,eACE,OACA,oCAAoC,MAAM,WAAW,MAAM,gBAC7D,KACA,eACE,OACA,qCAAqC,MAAM,WAAW,MAAM,gBAC9D;EACJ;CACF;CAEA,MAAM,UAAU,OAAO,UAAU,kBAAkB,kBAAkB,MAAM;CAE3E,OAAO;EACL,SAAS,QAAQ,WAAW,OAAO;EACnC,YAAY,CAAC,GAAG,kBAAkB,YAAY,OAAO;EACrD,gBAAgB,CAAC,OAAO;EACxB,YAAY,UAAmB,eAAe,OAAO,MAAM;CAC7D;AACF,CAAC;AAED,MAAa,oCAAoC,OAAO,WAAW,WAQjE,SACA,cAcA;CACA,MAAM,WAAW,OAAOC;CAExB,OAAO,uBAAuB;EAAE,GAAG;EAAS,OAAO;CAAa,CAAC,CAAC,CAAC,KACjE,OAAO,qBAAqB,gBAAgB,eAAeA,QAAe,CAAC,GAC3E,OAAO,SAAS,WAAW,CAC7B;CAEA,MAAM,QAAQ,OAAO;CACrB,MAAM,QAAQ,kBAAkB,SAA+B,YAAY;CAE3E,MAAM,aAAa,OAAO,IAAI,aAAa;EACzC,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;EACrD,OAAO,kBAAkB,aAAa,SAAS,QAAQ,kBAAkB;CAC3E,CAAC;CAED,MAAM,OAAsB,SAC1B,OAAO,IAAI,aAAa;EACtB,OAAO;EAEP,OAAO,OAAO,kBAAkB,MAAM,CAAC;CACzC,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,2BAA2B,QAAQ,GACzD,OAAO,eAAe,gBAAgB,KAAK,CAC7C;CAyCF,OAAO,EAAE,qBAAqB;EAtC5B,iBAAiB,UACf,WAAW,KACT,OAAO,QAAQ,MAAM,eAAe,KAAK,CAAC,GAC1C,OAAO,eAAe,2BAA2B,QAAQ,GACzD,gBACF;EACF,kBAAkB,UAAU,IAAI,MAAM,gBAAgB,KAAK,CAAC,CAAC,CAAC,KAAK,gBAAgB;EACnF,iBAAiB,UACf,MACG,eAAe,KAAK,CAAC,CACrB,KACC,OAAO,eAAe,2BAA2B,QAAQ,GACzD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACJ,iBAAiB,UACf,MACG,eAAe,KAAK,CAAC,CACrB,KACC,OAAO,eAAe,2BAA2B,QAAQ,GACzD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACJ,cAAc,OAAO,YAAY,IAAI,MAAM,YAAY,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,gBAAgB;EAC7F,mBAAmB,OAAO,YACxB,IAAI,MAAM,iBAAiB,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,gBAAgB;EACnE,aAAa,UACX,MACG,WAAW,KAAK,CAAC,CACjB,KACC,OAAO,eAAe,2BAA2B,QAAQ,GACzD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACJ,iBAAiB,OAAO,YACtB,IAAI,MAAM,eAAe,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,gBAAgB;CAG/B,EAAE;AACxC,CAAC;;;;;;AASD,SAAgB,gCAad,SACA,SAMA,MAKA;CACA,OAAO,OAAO,QAAQ,eAAe,OAAO,IAAI,aAC9C,OAAO,IAAI,aAAa;EACtB,OAAO,uBAAuB;GAC5B,GAAG,QAAQ;GACX,OAAO,QAAQ;EACjB,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;EACpC,MAAM,QAAQ,OAAO;EAErB,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;EA6HrD,QAAO,OA3He,uBAElB,OAAO,IAAI,aAAa;GACtB,MAAM,aAA+B,CAAC;GACtC,IAAI;GAEJ,MAAM,kBAAkB,kBAAkB,GAAG,EAC3C,SAAS,cAAc,OAAO,WAAW,WAAW,KAAK,SAAS,CAAC,EACrE,CAAC;GAED,MAAM,QAAQ,OAAO,YAAY,YAAY,CAAC,CAAC,CAAC,KAC9C,OAAO,eAAe,mBAAmB,eAAe,CAC1D;GAEA,MAAM,QAAQ,kBACZ,QAAQ,SACR,QAAQ,YACV;GAEA,MAAM,OAAsB,SAC1B,uBAEI,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO;IACvB,MAAM,UAAU,OAAO;IAEvB,OAAO,MAAM;IACb,IAAI,aAAa,KAAA,GAAW,OAAO,OAAO,YAAY;IACtD,MAAM,UAAU;KAAE,GAAG;KAAS,cAAc,QAAQ,QAAQ,KAAA,CAAS;IAAE;IAEvE,WAAW;IACX,WAAW,KAAK,GAAG,QAAQ,UAAU;IAErC,OAAO,QAAQ;GACjB,CAAC,GACH,EAAE,MAAM,QAAQ,CAClB,CAAC,CAAC,KACA,OAAO,KAAK,WAAW,OAAO,KAAK,GACnC,OAAO,eAAe,2BAA2B,QAAQ,GACzD,OAAO,eAAe,gBAAgB,KAAK,CAC7C;GAoDF,MAAM,WAAW,QAAQ,KAAK,qBAAqB;IAjDjD,iBAAiB,UACf,MAAM,IACJ,MACG,eAAe,KAAK,CAAC,CACrB,KACC,OAAO,eAAe,2BAA2B,QAAQ,GACzD,gBACF,CACJ;IACF,kBAAkB,UAChB,MAAM,IAAI,IAAI,MAAM,gBAAgB,KAAK,CAAC,CAAC,CAAC,KAAK,gBAAgB,CAAC;IACpE,iBAAiB,UACf,MAAM,IACJ,MACG,eAAe,KAAK,CAAC,CACrB,KACC,OAAO,eAAe,2BAA2B,QAAQ,GACzD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF,CACJ;IACF,iBAAiB,UACf,MAAM,IACJ,MACG,eAAe,KAAK,CAAC,CACrB,KACC,OAAO,eAAe,2BAA2B,QAAQ,GACzD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF,CACJ;IACF,cAAc,OAAO,YACnB,MAAM,IAAI,IAAI,MAAM,YAAY,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,gBAAgB,CAAC;IACzE,mBAAmB,OAAO,YACxB,MAAM,IAAI,IAAI,MAAM,iBAAiB,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,gBAAgB,CAAC;IAC9E,aAAa,UACX,MAAM,IACJ,MACG,WAAW,KAAK,CAAC,CACjB,KACC,OAAO,eAAe,2BAA2B,QAAQ,GACzD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF,CACJ;IACF,iBAAiB,OAAO,YACtB,MAAM,IAAI,IAAI,MAAM,eAAe,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,gBAAgB,CAAC;GAGrB,CAAC,CAAC,CAAC,KAC1D,QAAQ,IAAI,mBAAmB,MAAM,SAAS,CAChD;GAEA,MAAM,QAAQ,OAAO,MAAM,MAAM,OAAO,eAAe,MAAM,QAAQ,CAAC;GAEtE,IAAI,UAAU,iBAAiB,KAAA,GAAW;IACxC,MAAM,SAAS,OAAO,OAAO,OAAO,SAAS,aAAa,IAAI;IAE9D,IAAI,OAAO,SAAS,aAAa,OAAO,QAAQ,SAAS,iBACvD,OAAO,OAAO,YAAY;GAC9B;GAEA,OAAO,SAAS,QACb,MAAM,CAAC,GAAG,YAAY,GAAI,UAAU,kBAAkB,CAAC,CAAE,CAAC,CAAC,CAC3D,KACC,OAAO,YAAY,UACjB,OAAO,UACL,MAAM,IAAI,QAAQ,UAChB,oBAAoB,OAAO,UAAU,SAAS,IAAI,YAAY,IAAI,KACpE,CACF,CACF,GACA,gBACF;GAEF,OAAO;EACT,CAAC,GACH,EAAE,MAAM,QAAQ,CAClB,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC,EAAA,CAErC;CAChB,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,QAAQ,CAAC,CACzD;AACF;AAEA,MAAM,mBAAmB,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,UACA,WACA;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,SAAS,OAAO,QAAQ,aAAa,OAAO,QAAQ,aAAa,QAAQ;CAC/E,MAAM,UAAU,OAAO,QAAQ,aAAa,OAAO,QAAQ,aAAa,SAAS;CAEjF,OAAO,OAAO,SACX,OAAO,CAAC,CACR,KAAK,QAAQ,aAAa,KAAK,CAAC,CAChC,MAAM,IAAI,GAAG,QAAQ,QAAQ,GAAG,GAAG,SAAS,SAAS,CAAC,CAAC,CAAC,CACxD,MAAM,CAAC;AACZ,CAAC;AAED,MAAM,6BAA6B,OAAO,GAAG,oCAAoC,CAAC,CAAC,WAEjF,SAA4C,YAA6B;CACzE,MAAM,WAAW,OAAO;CAExB,MAAM,YAAY,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;CAC/E,MAAM,QAAQ,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,KAAK;CAEvE,OAAO,OAAO,SACX,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,IAAI,GAAG,WAAW,WAAW,SAAS,GAAG,GAAG,OAAO,WAAW,KAAK,CAAC,CAAC,CAAC,CAC5E,MAAM,CAAC;AACZ,CAAC;AAED,MAAM,mBAAmB,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,OAOA,WASA,SACA;CACA,MAAM,WAAW,OAAO;CACxB,MAAM,UAAU,OAAO;CAEvB,MAAM,YAAY,OAAO,iBAAiB,SAAS,MAAM,UAAU,MAAM,SAAS,EAAA,CAAG;CAErF,IAAI,aAAa,KAAA,GACf,OAAO;EACL,SAAS,QAAQ,OAAO,QAAQ,aAAa,aAAa,QAAQ,GAAG,OAAO;EAC5E,YAAY,CAAC;CACf;CAEF,MAAM,SAAS;EACb,UAAU,MAAM;EAChB,WAAW,MAAM;EACjB,YAAY,MAAM;EAClB,cAAc,MAAM;EACpB,aAAa,MAAM;CACrB;CAEA,IAAI,QAAQ,SAAS,WAAW;EAC9B,IAAI,UAAU,sBAAsB,KAAA,GAAW,OAAO,OAAO,YAAY;EAEzE,OAAO;GACL,SAAS,QAAQ;IAAE,MAAM;IAAW,WAAW,UAAU;GAAkB,GAAG,OAAO;GACrF,YAAY,CACV,OAAO,UACL,SAAS,OAAO,QAAQ,aAAa,KAAK,CAAC,CAAC,OAC1C,QAAQ,aAAa,aAAa,QAAQ;IACxC,OAAO;IACP,mBAAmB,UAAU;GAC/B,CAAC,CACH,CACF,CACF;GACA,YAAY,UAAmB,2BAA2B,QAAQ,mBAAmB,KAAK;EAC5F;CACF;CACA,IAAI,QAAQ,aAAa,WAAW,eAAe,UAAU,oBAAoB,KAAA,GAC/E,OAAO,OAAO,YAAY;CAC5B,KAAK,OAAO,2BAA2B,SAAS,MAAM,UAAU,EAAA,CAAG,SAAS,GAC1E,OAAO;EAAE,SAAS,QAAQ,EAAE,MAAM,aAAa,GAAG,OAAO;EAAG,YAAY,CAAC;CAAE;CAC7E,MAAM,kBAAkB,UAAU;CAGlC,OAAO;EACL,SAAS,QAAQ;GAAE,MAAM;GAAW,WAAA,OAHb,QAAQ,UAAU,UAAU,eAAe;EAGpB,GAAG,OAAO;EACxD,YAAY;GACV,OAAO,UACL,SAAS,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,OACrC,QAAQ,aAAa,oBAAoB,QAAQ;IAC/C;IACA,kBAAkB,UAAU;GAC9B,CAAC,CACH,CACF;GACA,OAAO,UACL,SACG,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,OACC,QAAQ,WAAW,oBACjB,MAAM,YACN,iBACA,UAAU,kBACZ,CACF,CACJ;GACA,OAAO,UACL,SAAS,OAAO,QAAQ,WAAW,KAAK,CAAC,CAAC,OACxC,QAAQ,WAAW,aAAa;IAC9B,UAAU,MAAM;IAChB,WAAW;IACX,cAAc,UAAU;IACxB,oBAAoB,UAAU;IAC9B,iBAAiB,UAAU;IAC3B,aAAa,MAAM;GACrB,CAAC,CACH,CACF;GACA,OAAO,UACL,SAAS,OAAO,QAAQ,oBAAoB,KAAK,CAAC,CAAC,OACjD,QAAQ,oBAAoB,aAAa;IACvC,WAAW;IACX,cAAc,UAAU;IACxB,UAAU,UAAU;GACtB,CAAC,CACH,CACF;GACA,OAAO,UACL,SAAS,OAAO,QAAQ,aAAa,KAAK,CAAC,CAAC,OAC1C,QAAQ,aAAa,aAAa,QAAQ;IACxC,OAAO;IACP;GACF,CAAC,CACH,CACF;EACF;EACA,YAAY,UACV,2BAA2B,QAAQ,mBAAmB,KAAK,KAC3D,2BAA2B,QAAQ,sBAAsB,KAAK;CAClE;AACF,CAAC;AAED,MAAM,wBAAsC,YAC1C,OAAO,IAAI,aAAa;CACtB,MAAM,eAAe,OAAO,SAC1B,QAAQ,sBACR,QAAQ,wBACV;CAEA,MAAM,mBAAmB,OAAO,SAC9B,QAAQ,kBACR,QAAQ,oBACV;CAEA,MAAM,qBAAqB,OAAO,SAChC,QAAQ,kBACR,QAAQ,oBACV;CAEA,MAAM,qBAAqB,OAAO,SAChC,QAAQ,kBACR,QAAQ,oBACV;CAEA,MAAM,kBAAkB,OAAO,SAAS,QAAQ,kBAAkB,QAAQ,oBAAoB;CAE9F,MAAM,kBACJ,QAAQ,SAAS,YAAY,QAAQ,aAAa,WAAW,cACzD,KAAA,IACA,OAAO,SACL,QAAQ,aAAa,mBACrB,QAAQ,aAAa,qBACvB;CAEN,MAAM,oBACJ,QAAQ,SAAS,YACb,OAAO,SAAS,QAAQ,2BAA2B,QAAQ,6BAA6B,IACxF,KAAA;CAEN,OAAO;EACL;EACA;EACA;EACA;EACA;EACA,GAAI,oBAAoB,KAAA,IAAY,CAAC,IAAI,EAAE,gBAAgB;EAC3D,GAAI,sBAAsB,KAAA,IAAY,CAAC,IAAI,EAAE,kBAAkB;CACjE;AACF,CAAC;AAEH,MAAM,yBAAuC,aAAgD,EAC3F,WACE,OACA,YAEA,OAAO,IAAI,aAAa;CACtB,IAAI,CAAC,6BAA6B,OAAO,GAAG,OAAO,OAAO,YAAY;CACtE,IAAI,QAAQ,SAAS,YAAY,QAAQ,aAAa,WAAW,aAC/D,OAAO,OAAO,YAAY;CAC5B,MAAM,YAAY,OAAO,qBAAqB,OAAO;CAErD,OAAO,OAAO,iBAAiB,SAAS,OAAO,WAAW,OAAO;AACnE,CAAC,EACL;AAEA,MAAa,qCAAqC,OAAO,WAAW,WAQlE,SAA+E;CAC/E,MAAM,WAAW,OAAOA;CAExB,OAAO,uBAAuB,OAAO,CAAC,CAAC,KACrC,OAAO,qBAAqB,gBAAgB,eAAeA,QAAe,CAAC,GAC3E,OAAO,SAAS,WAAW,CAC7B;CAEA,MAAM,QAAQ,OAAO;CACrB,MAAM,QAAQ,sBAAsB,OAAuD;CAE3F,MAAM,OAAsB,SAC1B,OAAO,IAAI,aAAa;EACtB,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;EAErD,OAAO,OAAO,kBAAkB,MAAM,CAAC;CACzC,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,2BAA2B,QAAQ,GACzD,OAAO,eAAe,gBAAgB,KAAK,CAC7C;CAMF,OAAO,EAAE,uBAAuB,EAH9B,WAAW,OAAO,YAAY,IAAI,MAAM,SAAS,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,gBAAgB,EAGnD,EAAE;AAC1C,CAAC;AAED,SAAgB,iCAed,SACA,SAIA,MAKA;CACA,OAAO,OAAO,QAAQ,eAAe,OAAO,IAAI,aAC9C,OAAO,IAAI,aAAa;EACtB,OAAO,uBAAuB,QAAQ,OAAO,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;EAChF,MAAM,QAAQ,OAAO;EAErB,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;EA4ErD,QAAO,OA1Ee,uBAElB,OAAO,IAAI,aAAa;GACtB,MAAM,aAA+B,CAAC;GACtC,IAAI;GAEJ,MAAM,kBAAkB,kBAAkB,GAAG,EAC3C,SAAS,cAAc,OAAO,WAAW,WAAW,KAAK,SAAS,CAAC,EACrE,CAAC;GAED,MAAM,QAAQ,OAAO,YAAY,YAAY,CAAC,CAAC,CAAC,KAC9C,OAAO,eAAe,mBAAmB,eAAe,CAC1D;GAEA,MAAM,QAAQ,sBACZ,QAAQ,OACV;GAEA,MAAM,OAAsB,SAC1B,uBAEI,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO;IACvB,MAAM,UAAU,OAAO;IAEvB,OAAO,MAAM;IACb,IAAI,aAAa,KAAA,GAAW,OAAO,OAAO,YAAY;IACtD,MAAM,UAAU;KAAE,GAAG;KAAS,cAAc,QAAQ,QAAQ,KAAA,CAAS;IAAE;IAEvE,WAAW;IACX,WAAW,KAAK,GAAG,QAAQ,UAAU;IAErC,OAAO,QAAQ;GACjB,CAAC,GACH,EAAE,MAAM,QAAQ,CAClB,CAAC,CAAC,KACA,OAAO,KAAK,WAAW,OAAO,KAAK,GACnC,OAAO,eAAe,2BAA2B,QAAQ,GACzD,OAAO,eAAe,gBAAgB,KAAK,CAC7C;GAOF,MAAM,WAAW,QAAQ,KAAK,QAAQ,QAAQ,EAJ5C,WAAW,OAAO,YAChB,MAAM,IAAI,IAAI,MAAM,SAAS,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,gBAAgB,CAAC,EAGpB,CAAC,CAAC,CAAC,KACrD,QAAQ,IAAI,mBAAmB,MAAM,SAAS,CAChD;GAEA,MAAM,QAAQ,OAAO,MAAM,MAAM,OAAO,eAAe,MAAM,QAAQ,CAAC;GAEtE,IAAI,UAAU,iBAAiB,KAAA,GAAW;IACxC,MAAM,SAAS,OAAO,OAAO,OAAO,SAAS,aAAa,IAAI;IAE9D,IAAI,OAAO,SAAS,aAAa,OAAO,QAAQ,SAAS,iBACvD,OAAO,OAAO,YAAY;GAC9B;GACA,OAAO,SAAS,QAAQ,MAAM,UAAU,CAAC,CAAC,KACxC,OAAO,YAAY,UACjB,OAAO,UACL,MAAM,IAAI,QAAQ,UAChB,oBAAoB,OAAO,UAAU,SAAS,IAAI,YAAY,IAAI,KACpE,CACF,CACF,GACA,gBACF;GAEA,OAAO;EACT,CAAC,GACH,EAAE,MAAM,QAAQ,CAClB,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC,EAAA,CAErC;CAChB,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,QAAQ,CAAC,CACzD;AACF;;AAGA,MAAa,mBAAmB;CAC9B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAEA,MAAM,oBACJ,WAEA,yBACE,SACC,UACC,OAAO,GAAG,mBAAmB,CAAC,CAAC,KAAK,KACpC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,sBAAsB,CAAC,CAAC,KAAK,CAC3C,CAAC,CAAC,KAAK,OAAO,YAAY,UAAU,OAAO,UAAU,MAAM,IAAI,aAAa,YAAY,CAAC,CAAC,CAAC,CAAC;AAE9F,MAAM,qBACJ,MACA,UAAU,MAMV,OAAO,cAAc;CACnB,IAAI;CAgBJ,OAda,uBAET,OAAO,IAAI,aAAa;EACtB,MAAM,WAAW,OAAO;EACxB,MAAM,UAAU,OAAO;EAEvB,YAAY,QAAQ;EACpB,OAAO,SAAS,QAAQ,MAAM,QAAQ,UAAU;EAEhD,OAAO,QAAQ;CACjB,CAAC,GACH,EAAE,MAAM,QAAQ,CAClB,CAAC,CAAC,KAAK,OAAO,KAAK,WAAW,OAAO,KAAK,CAEhC,CAAC,CAAC,KACV,OAAO,YAAY,UACjB,UAAU,KAAK,oBAAoB,OAAO,SAAS,IAC/C,kBAAkB,MAAM,UAAU,CAAC,IACnC,OAAO,UAAU,KAAK,CAC5B,CACF;AACF,CAAC"}

package/dist/drizzle/password-prepared-sql.mjs

@@ -237,7 +237,7 @@ const makeSqlPasswordPreparedPersistence = Effect.fn("makeSqlPasswordPreparedPer
 	return {
 		reserve: (uncaptured, prepare) => Effect.gen(function* () {
 			const input = yield* snapshotReserve(uncaptured);
-			if (input.action === "reset-password" !== (input.reset !== void 0 && input.completion !== void 0) || input.action === "reset-password" && configuration.proof === void 0 || input.generation !== input.policy.generation || input.policy.retentionMillis < Math.max(input.policy.preparationLifetimeMillis + input.policy.lifetimeMillis, input.policy.admission.action.windowMillis, input.policy.admission.identifier.windowMillis, input.policy.admission.subject.windowMillis) || input.invalidation.existingSessions === "immediate" && p.sessionInvalidation !== "same-authority-immediate") return yield* unavailable();
+			if (input.action === "reset-password" !== (input.reset !== void 0 && input.completion !== void 0) || input.action === "reset-password" && configuration.proof === void 0 || input.generation !== input.policy.generation || input.policy.retentionMillis < Math.max(input.policy.preparationLifetimeMillis + input.policy.lifetimeMillis, input.policy.admission.action.windowMillis, input.policy.admission.identifier.windowMillis, input.policy.admission.subject.windowMillis) || (input.invalidation.existingSessions === "immediate" || input.invalidation.existingSessions === "cache-expiry") && p.sessionInvalidation !== "same-authority-immediate") return yield* unavailable();
 			return yield* owned(Effect.gen(function* () {
 				const transaction = yield* CurrentPasswordSql;
 				const journal = yield* CurrentCommitJournal;