@yielded/auth-persistence 0.1.0-beta.10 → 0.1.0-beta.12

package/dist/internal/email-kernel.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"email-kernel.mjs","names":[],"sources":["../../src/internal/email-kernel.ts"],"sourcesContent":["import {\n  EmailAddressPersistence,\n  type EmailAddressMutation,\n  type EmailAction,\n  type EmailCredentialSnapshot,\n  EmailSignInTargets,\n  EmailUnavailable,\n  snapshotEmailCredential,\n  snapshotEmailRequirement,\n  snapshotEmailRevision,\n} from \"@yielded/auth/Email\";\nimport {\n  coordinateCommit,\n  CurrentCommitJournal,\n  hasCommitScope,\n  type CommitJournal,\n  type PreparedCommit,\n  LifecycleHooks,\n  HookConfigurationError,\n} from \"@yielded/auth/Hooks\";\nimport type { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport { reportPersistenceFailure } from \"@yielded/auth/Persistence\";\nimport {\n  ProofUnavailable,\n  type ProofCompletionDecision,\n  type ProofCompletionInput,\n} from \"@yielded/auth/Proofs\";\nimport {\n  assessAuthentication,\n  snapshotAuthenticationEvidence,\n  type AuthenticationRevision,\n  type SecurityRevision,\n} from \"@yielded/auth/Sessions\";\nimport { Cause, Context, DateTime, Effect, Option, Schema } from \"effect\";\nimport type * as SqlError from \"effect/unstable/sql/SqlError\";\n\nimport { isMappedConstraintConflict, PersistenceMappingError } from \"./mapping-error\";\nimport {\n  type AnyEmailAddressMapping,\n  type AnyEmailSignInMapping,\n  requiredEmailAddressConstraints,\n  requiredEmailSignInConstraints,\n} from \"./models/email-model\";\nimport {\n  CurrentProofSql,\n  type makeProofKernel,\n  type ProofSqlConfiguration,\n  type ProofSqlDatabase,\n} from \"./proof-kernel\";\n/* oxlint-disable no-explicit-any -- the shared dialect kernel erases consumer Drizzle table types internally. */\nimport type { QueryFailure } from \"./query-operations\";\nimport type { QueryOperations, SqlFragment, SqlColumn } from \"./query-operations\";\n\ntype AdapterFailure = QueryFailure | PersistenceMappingError | SqlError.SqlError;\ntype SignInMapping = AnyEmailSignInMapping;\n\nexport interface EmailSqlQuery<A = ReadonlyArray<any>> extends Effect.Effect<A, AdapterFailure> {\n  readonly getSQL: () => ReturnType<QueryOperations[\"sql\"]>;\n  readonly from: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly where: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly limit: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly orderBy: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly for: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly set: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly values: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly returning: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly innerJoin: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly onConflictDoNothing: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly onDuplicateKeyUpdate: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly $returningId: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n}\n\nexport interface EmailSqlDatabase {\n  readonly select: (...args: ReadonlyArray<any>) => EmailSqlQuery;\n  readonly insert: (...args: ReadonlyArray<any>) => EmailSqlQuery;\n  readonly update: (...args: ReadonlyArray<any>) => EmailSqlQuery;\n  readonly delete: (...args: ReadonlyArray<any>) => EmailSqlQuery;\n  readonly transaction: <A, E, R>(\n    body: (transaction: EmailSqlDatabase) => Effect.Effect<A, E, R>,\n  ) => Effect.Effect<A, E | SqlError.SqlError, R>;\n}\n\nexport class CurrentEmailSql extends Context.Service<CurrentEmailSql, EmailSqlDatabase>()(\n  \"effect-auth/CurrentEmailSql\",\n) {}\n\nexport interface EmailSqlConfiguration {\n  readonly mode: \"interactive\" | \"synchronous\";\n  readonly locking: boolean;\n  readonly standaloneGuard: Effect.Effect<void, EmailUnavailable>;\n  readonly coordinated?: boolean;\n  readonly proof?: {\n    readonly mapping: any;\n    readonly configuration: ProofSqlConfiguration;\n  };\n}\n\nexport interface CurrentAddress {\n  readonly nativeSubjectId: unknown;\n  readonly subject: any;\n  readonly revision: AuthenticationRevision;\n  readonly source?: {\n    readonly credential: any;\n    readonly identifier: any;\n    readonly snapshot: EmailCredentialSnapshot;\n  };\n  readonly targetIdentifier?: any;\n  readonly targetCredential?: any;\n  readonly targetIdentifierRevision?: SecurityRevision;\n  readonly eligible: boolean;\n}\n\nexport const makeEmailKernel = <\n  Fragment extends SqlFragment = SqlFragment,\n  Column extends SqlColumn = SqlColumn,\n>(\n  operations: QueryOperations<Fragment, Column>,\n  proofs: Pick<ReturnType<typeof makeProofKernel>, \"completeProofPlanIn\">,\n) => {\n  type AddressMapping = AnyEmailAddressMapping<Fragment>;\n\n  const { and, eq, inArray, lte, column, updateValues } = operations;\n  const { completeProofPlanIn } = proofs;\n  const unavailable = () => EmailUnavailable.make({});\n\n  const translateFailure = <A, E, R>(\n    effect: Effect.Effect<A, E, R>,\n  ): Effect.Effect<A, EmailUnavailable, R> =>\n    reportPersistenceFailure(\n      effect,\n      (error) =>\n        Schema.is(EmailUnavailable)(error) ||\n        Schema.is(ProofUnavailable)(error) ||\n        Schema.is(HookConfigurationError)(error),\n    ).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));\n\n  const nowMillis = Effect.map(DateTime.now, DateTime.toEpochMillis);\n\n  const selectRows = (query: EmailSqlQuery, locking: boolean) =>\n    locking && typeof query.for === \"function\" ? query.for(\"update\") : query;\n\n  const sameIdentifier = (left: LoginIdentifier, right: LoginIdentifier) =>\n    left.namespace === right.namespace && left.value === right.value;\n\n  const validEmailSignInConstraints = (mapping: SignInMapping) =>\n    Object.entries(requiredEmailSignInConstraints).every(\n      ([key, value]) =>\n        mapping.constraints[key as keyof typeof requiredEmailSignInConstraints] === value,\n    );\n\n  const validAddressConstraints = (mapping: AddressMapping) =>\n    Object.entries(requiredEmailAddressConstraints).every(\n      ([key, value]) =>\n        mapping.constraints[key as keyof typeof requiredEmailAddressConstraints] === value,\n    );\n\n  const subjectColumns = (mapping: SignInMapping) => ({\n    id: column(mapping.subject.table, mapping.subject.id),\n    status: column(mapping.subject.table, mapping.subject.status),\n    securityRevision: column(mapping.subject.table, mapping.subject.securityRevision),\n  });\n\n  const identifierColumns = (mapping: SignInMapping) => ({\n    namespace: column(mapping.identifier.table, mapping.identifier.namespace),\n    value: column(mapping.identifier.table, mapping.identifier.value),\n    subjectId: column(mapping.identifier.table, mapping.identifier.subjectId),\n    verifiedAt: column(mapping.identifier.table, mapping.identifier.verifiedAt),\n    bindingRevision: column(mapping.identifier.table, mapping.identifier.bindingRevision),\n  });\n\n  const credentialColumns = (mapping: SignInMapping) => ({\n    moduleId: column(mapping.credential.table, mapping.credential.moduleId),\n    subjectId: column(mapping.credential.table, mapping.credential.subjectId),\n    credentialId: column(mapping.credential.table, mapping.credential.credentialId),\n    identifierNamespace: column(mapping.credential.table, mapping.credential.identifierNamespace),\n    identifierValue: column(mapping.credential.table, mapping.credential.identifierValue),\n    credentialRevision: column(mapping.credential.table, mapping.credential.credentialRevision),\n    status: column(mapping.credential.table, mapping.credential.status),\n  });\n\n  const authorityColumns = (mapping: AddressMapping) => ({\n    subjectId: column(mapping.authorityCredential.table, mapping.authorityCredential.subjectId),\n    credentialId: column(\n      mapping.authorityCredential.table,\n      mapping.authorityCredential.credentialId,\n    ),\n    revision: column(mapping.authorityCredential.table, mapping.authorityCredential.revision),\n    status: column(mapping.authorityCredential.table, mapping.authorityCredential.status),\n  });\n\n  const commandColumns = (mapping: AddressMapping) => ({\n    moduleId: column(mapping.command.table, mapping.command.moduleId),\n    commandId: column(mapping.command.table, mapping.command.commandId),\n    action: column(mapping.command.table, mapping.command.action),\n    bindingDigest: column(mapping.command.table, mapping.command.bindingDigest),\n    retentionUntil: column(mapping.command.table, mapping.command.retentionUntil),\n  });\n\n  const allocate = <A>(\n    mode: EmailSqlConfiguration[\"mode\"],\n    asynchronous: Effect.Effect<A, PersistenceMappingError> | undefined,\n    synchronous: (() => A) | undefined,\n  ) => {\n    if (mode === \"synchronous\")\n      return synchronous === undefined\n        ? Effect.fail(unavailable())\n        : Effect.try({\n            try: synchronous,\n            catch: (cause) => new PersistenceMappingError({ operation: \"mapping\", cause }),\n          });\n    if (asynchronous !== undefined) return asynchronous;\n\n    return synchronous === undefined\n      ? Effect.fail(unavailable())\n      : Effect.try({\n          try: synchronous,\n          catch: (cause) => new PersistenceMappingError({ operation: \"mapping\", cause }),\n        });\n  };\n\n  const nextSecurityRevision = (\n    mapping: AddressMapping,\n    mode: EmailSqlConfiguration[\"mode\"],\n    current: SecurityRevision,\n  ) => {\n    if (mode === \"synchronous\")\n      return mapping.subject.nextSecurityRevisionSync === undefined\n        ? Effect.fail(unavailable())\n        : Effect.try({\n            try: () => mapping.subject.nextSecurityRevisionSync!(current),\n            catch: (cause) => new PersistenceMappingError({ operation: \"mapping\", cause }),\n          });\n    if (mapping.subject.nextSecurityRevision !== undefined)\n      return mapping.subject.nextSecurityRevision(current);\n    if (mapping.subject.nextSecurityRevisionSync !== undefined)\n      return Effect.try({\n        try: () => mapping.subject.nextSecurityRevisionSync!(current),\n        catch: (cause) => new PersistenceMappingError({ operation: \"mapping\", cause }),\n      });\n\n    return Effect.fail(unavailable());\n  };\n\n  const safeRead = <A, E, R>(\n    database: EmailSqlDatabase,\n    configuration: EmailSqlConfiguration,\n    body: Effect.Effect<A, E, R>,\n  ) =>\n    Effect.gen(function* () {\n      if (configuration.coordinated !== true) {\n        if (yield* hasCommitScope) return yield* unavailable();\n        yield* configuration.standaloneGuard;\n      }\n\n      return yield* database.transaction((transaction) =>\n        body.pipe(\n          Effect.provideService(CurrentEmailSql, transaction),\n          Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),\n        ),\n      );\n    });\n\n  const owned = <A, E, R>(\n    database: EmailSqlDatabase,\n    configuration: EmailSqlConfiguration,\n    body: Effect.Effect<A, E, R>,\n  ) => {\n    const run = coordinateCommit(\n      () =>\n        database.transaction((transaction) =>\n          body.pipe(\n            Effect.provideService(CurrentEmailSql, transaction),\n            Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),\n          ),\n        ),\n      { mode: configuration.mode },\n    ).pipe(Effect.map((result) => result.value));\n\n    return configuration.coordinated !== true\n      ? Effect.gen(function* () {\n          if (yield* hasCommitScope) return yield* unavailable();\n          yield* configuration.standaloneGuard;\n\n          return yield* run;\n        })\n      : run;\n  };\n\n  const emailLookupQuery = (\n    mapping: SignInMapping,\n    moduleId: string,\n    identifier: LoginIdentifier,\n  ) => {\n    const subject = subjectColumns(mapping),\n      binding = identifierColumns(mapping),\n      credential = credentialColumns(mapping);\n\n    return {\n      fields: {\n        subject: mapping.subject.table,\n        identifier: mapping.identifier.table,\n        credential: mapping.credential.table,\n      },\n      from: mapping.identifier.table,\n      subjectTable: mapping.subject.table,\n      subjectJoin: eq(subject.id, binding.subjectId),\n      credentialTable: mapping.credential.table,\n      credentialJoin: and(\n        eq(credential.moduleId, moduleId),\n        eq(credential.subjectId, binding.subjectId),\n        eq(credential.identifierNamespace, binding.namespace),\n        eq(credential.identifierValue, binding.value),\n      ),\n      predicate: and(\n        eq(binding.namespace, identifier.namespace),\n        eq(binding.value, identifier.value),\n      ),\n      limit: 1,\n    };\n  };\n\n  const emailLookupRows = Effect.fn(\"Drizzle.emailLookupRows\")(function* (\n    mapping: SignInMapping,\n    moduleId: string,\n    identifier: LoginIdentifier,\n  ) {\n    const database = yield* CurrentEmailSql;\n    const query = emailLookupQuery(mapping, moduleId, identifier);\n\n    return yield* database\n      .select(query.fields)\n      .from(query.from)\n      .innerJoin(query.subjectTable, query.subjectJoin)\n      .innerJoin(query.credentialTable, query.credentialJoin)\n      .where(query.predicate)\n      .limit(query.limit);\n  });\n\n  const decodeEmailSnapshot = Effect.fn(\"DrizzleEmail.decodeSnapshot\")(function* (\n    mapping: SignInMapping,\n    moduleId: string,\n    requested: LoginIdentifier,\n    row: any,\n  ) {\n    if (\n      !mapping.subject.isActiveStatus(row.subject[mapping.subject.status]) ||\n      !mapping.identifier.isCurrent(row.identifier) ||\n      !mapping.credential.isActiveStatus(row.credential[mapping.credential.status])\n    )\n      return undefined;\n\n    const snapshot = yield* mapping.credential\n      .decode({\n        moduleId,\n        subject: row.subject,\n        identifier: row.identifier,\n        credential: row.credential,\n      })\n      .pipe(Effect.flatMap(snapshotEmailCredential));\n\n    const subjectId = yield* mapping.subjectId.toSubject(row.subject[mapping.subject.id]);\n\n    const verifiedAtMillis = yield* mapping.decodeInstant(\n      row.identifier[mapping.identifier.verifiedAt],\n    );\n\n    if (\n      snapshot.moduleId !== moduleId ||\n      !sameIdentifier(snapshot.identifier, requested) ||\n      snapshot.revision.subjectId !== subjectId ||\n      snapshot.revision.securityRevision !== row.subject[mapping.subject.securityRevision] ||\n      snapshot.identifierRevision !== row.identifier[mapping.identifier.bindingRevision] ||\n      snapshot.verifiedAtMillis !== verifiedAtMillis ||\n      snapshot.credentialId !== row.credential[mapping.credential.credentialId] ||\n      snapshot.credentialRevision !== row.credential[mapping.credential.credentialRevision]\n    )\n      return undefined;\n\n    return snapshot;\n  });\n\n  const makeSqlEmailSignInTargets = Effect.fn(\"makeSqlEmailSignInTargets\")(function (\n    database: EmailSqlDatabase,\n    mapping: SignInMapping,\n    configuration: EmailSqlConfiguration,\n  ): Effect.Effect<EmailSignInTargets[\"Service\"]> {\n    return Effect.succeed(\n      EmailSignInTargets.of({\n        lookup: (input) =>\n          (validEmailSignInConstraints(mapping)\n            ? safeRead(\n                database,\n                configuration,\n                Effect.gen(function* () {\n                  const row = (yield* emailLookupRows(\n                    mapping,\n                    input.moduleId,\n                    input.identifier,\n                  ))[0];\n\n                  if (row === undefined) return Option.none();\n\n                  const snapshot = yield* decodeEmailSnapshot(\n                    mapping,\n                    input.moduleId,\n                    input.identifier,\n                    row,\n                  );\n\n                  return snapshot === undefined ? Option.none() : Option.some(snapshot);\n                }),\n              )\n            : Effect.fail(unavailable())\n          ).pipe(Effect.provideService(CurrentEmailSql, database), translateFailure),\n      }),\n    );\n  });\n\n  const readSubject = Effect.fn(\"DrizzleEmail.readSubject\")(function* (\n    mapping: AddressMapping,\n    subjectId: string,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentEmailSql;\n\n    const nativeSubjectId = yield* mapping.subjectId.toNative(subjectId as any);\n    const s = subjectColumns(mapping);\n\n    const subject = (yield* selectRows(\n      database.select().from(mapping.subject.table).where(eq(s.id, nativeSubjectId)).limit(1),\n      locking,\n    ))[0];\n\n    return { nativeSubjectId, subject };\n  });\n\n  const identifierRow = Effect.fn(\"Drizzle.identifierRow\")(function* (\n    mapping: SignInMapping,\n    identifier: LoginIdentifier,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentEmailSql;\n\n    const i = identifierColumns(mapping);\n\n    return yield* selectRows(\n      database\n        .select()\n        .from(mapping.identifier.table)\n        .where(and(eq(i.namespace, identifier.namespace), eq(i.value, identifier.value)))\n        .limit(1),\n      locking,\n    );\n  });\n\n  const credentialById = Effect.fn(\"Drizzle.credentialById\")(function* (\n    mapping: SignInMapping,\n    moduleId: string,\n    credentialId: string,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentEmailSql;\n\n    const c = credentialColumns(mapping);\n\n    return yield* selectRows(\n      database\n        .select()\n        .from(mapping.credential.table)\n        .where(and(eq(c.moduleId, moduleId), eq(c.credentialId, credentialId)))\n        .limit(1),\n      locking,\n    );\n  });\n\n  const credentialByIdentifier = Effect.fn(\"Drizzle.credentialByIdentifier\")(function* (\n    mapping: SignInMapping,\n    moduleId: string,\n    identifier: LoginIdentifier,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentEmailSql;\n\n    const c = credentialColumns(mapping);\n\n    return yield* selectRows(\n      database\n        .select()\n        .from(mapping.credential.table)\n        .where(\n          and(\n            eq(c.moduleId, moduleId),\n            eq(c.identifierNamespace, identifier.namespace),\n            eq(c.identifierValue, identifier.value),\n          ),\n        )\n        .limit(1),\n      locking,\n    );\n  });\n\n  const currentAddress = Effect.fn(\"DrizzleEmail.currentAddress\")(function* (\n    mapping: AddressMapping,\n    input: {\n      readonly moduleId: string;\n      readonly subjectId: string;\n      readonly target: LoginIdentifier;\n      readonly sourceCredentialId?: string;\n    },\n    locking: boolean,\n  ) {\n    const database = yield* CurrentEmailSql;\n\n    const locked = yield* readSubject(mapping, input.subjectId, locking);\n\n    if (\n      locked.subject === undefined ||\n      !mapping.subject.isActiveStatus(locked.subject[mapping.subject.status])\n    )\n      return undefined;\n\n    const discoveredSource =\n      input.sourceCredentialId === undefined\n        ? undefined\n        : (yield* credentialById(mapping, input.moduleId, input.sourceCredentialId, false))[0];\n\n    const sourceIdentifier: LoginIdentifier | undefined =\n      discoveredSource === undefined\n        ? undefined\n        : {\n            namespace: discoveredSource[mapping.credential.identifierNamespace],\n            value: discoveredSource[mapping.credential.identifierValue],\n          };\n\n    const identifiers = [\n      input.target,\n      ...(sourceIdentifier === undefined ? [] : [sourceIdentifier]),\n    ]\n      .filter(\n        (value, index, values) =>\n          values.findIndex((candidate) => sameIdentifier(candidate, value)) === index,\n      )\n      .sort((left, right) =>\n        `${left.namespace}\\u0000${left.value}`.localeCompare(\n          `${right.namespace}\\u0000${right.value}`,\n        ),\n      );\n\n    const lockedIdentifiers = new Map<string, any>();\n\n    for (const identifier of identifiers) {\n      const row = (yield* identifierRow(mapping, identifier, locking))[0];\n\n      if (row !== undefined)\n        lockedIdentifiers.set(`${identifier.namespace}\\u0000${identifier.value}`, row);\n    }\n\n    const sourceCredential =\n      input.sourceCredentialId === undefined\n        ? undefined\n        : (yield* credentialById(mapping, input.moduleId, input.sourceCredentialId, locking))[0];\n\n    const targetCredential = (yield* credentialByIdentifier(\n      mapping,\n      input.moduleId,\n      input.target,\n      locking,\n    ))[0];\n\n    const a = authorityColumns(mapping);\n\n    const authority = yield* selectRows(\n      database\n        .select()\n        .from(mapping.authorityCredential.table)\n        .where(eq(a.subjectId, locked.nativeSubjectId))\n        .orderBy(a.credentialId),\n      locking,\n    );\n\n    const activeAuthority = authority.filter((row: any) =>\n      mapping.authorityCredential.isActiveStatus(row[mapping.authorityCredential.status]),\n    );\n\n    const subjectId = yield* mapping.subjectId.toSubject(locked.nativeSubjectId);\n\n    const revision: AuthenticationRevision = Object.freeze({\n      subjectId,\n      securityRevision: locked.subject[mapping.subject.securityRevision],\n      credentials: Object.freeze(\n        activeAuthority.map((row: any) =>\n          Object.freeze({\n            credentialId: row[mapping.authorityCredential.credentialId],\n            revision: row[mapping.authorityCredential.revision],\n          }),\n        ),\n      ),\n    });\n\n    const targetIdentifier = lockedIdentifiers.get(\n      `${input.target.namespace}\\u0000${input.target.value}`,\n    );\n\n    const targetOwned =\n      targetIdentifier !== undefined &&\n      mapping.subjectId.equals(\n        targetIdentifier[mapping.identifier.subjectId],\n        locked.nativeSubjectId,\n      );\n\n    const targetMutable =\n      targetOwned &&\n      mapping.identifier.isMutableTarget(targetIdentifier) &&\n      (targetCredential === undefined ||\n        (!mapping.credential.isActiveStatus(targetCredential[mapping.credential.status]) &&\n          mapping.subjectId.equals(\n            targetCredential[mapping.credential.subjectId],\n            locked.nativeSubjectId,\n          )));\n\n    let source: CurrentAddress[\"source\"];\n\n    if (input.sourceCredentialId !== undefined) {\n      if (\n        sourceCredential === undefined ||\n        sourceIdentifier === undefined ||\n        !mapping.subjectId.equals(\n          sourceCredential[mapping.credential.subjectId],\n          locked.nativeSubjectId,\n        ) ||\n        !mapping.credential.isActiveStatus(sourceCredential[mapping.credential.status])\n      )\n        return undefined;\n\n      const sourceIdentifierRow = lockedIdentifiers.get(\n        `${sourceIdentifier.namespace}\\u0000${sourceIdentifier.value}`,\n      );\n\n      if (\n        sourceIdentifierRow === undefined ||\n        !mapping.identifier.isCurrent(sourceIdentifierRow) ||\n        !mapping.subjectId.equals(\n          sourceIdentifierRow[mapping.identifier.subjectId],\n          locked.nativeSubjectId,\n        )\n      )\n        return undefined;\n\n      const snapshot = yield* mapping.credential\n        .decode({\n          moduleId: input.moduleId,\n          subject: locked.subject,\n          identifier: sourceIdentifierRow,\n          credential: sourceCredential,\n        })\n        .pipe(Effect.flatMap(snapshotEmailCredential));\n\n      source = { credential: sourceCredential, identifier: sourceIdentifierRow, snapshot };\n    }\n    let eligible = targetIdentifier === undefined ? targetCredential === undefined : targetMutable;\n\n    if (input.sourceCredentialId !== undefined && source === undefined) eligible = false;\n    if (source !== undefined && sameIdentifier(source.snapshot.identifier, input.target))\n      eligible = false;\n    if (mapping.addressCardinality === \"single\" && input.sourceCredentialId === undefined) {\n      const c = credentialColumns(mapping);\n\n      const rows = yield* selectRows(\n        database\n          .select()\n          .from(mapping.credential.table)\n          .where(and(eq(c.moduleId, input.moduleId), eq(c.subjectId, locked.nativeSubjectId))),\n        locking,\n      );\n\n      if (\n        rows.some((row: any) => mapping.credential.isActiveStatus(row[mapping.credential.status]))\n      )\n        eligible = false;\n    }\n\n    return {\n      nativeSubjectId: locked.nativeSubjectId,\n      subject: locked.subject,\n      revision,\n      ...(source === undefined ? {} : { source }),\n      ...(targetIdentifier === undefined ? {} : { targetIdentifier }),\n      ...(targetCredential === undefined ? {} : { targetCredential }),\n      ...(targetMutable\n        ? { targetIdentifierRevision: targetIdentifier[mapping.identifier.bindingRevision] }\n        : {}),\n      eligible,\n    };\n  });\n\n  const sameEmailRevision = (left: AuthenticationRevision, right: AuthenticationRevision) => {\n    if (\n      left.subjectId !== right.subjectId ||\n      left.securityRevision !== right.securityRevision ||\n      left.credentials.length !== right.credentials.length\n    )\n      return false;\n\n    const expected = [...left.credentials].sort((a, b) =>\n      a.credentialId.localeCompare(b.credentialId),\n    );\n\n    const actual = [...right.credentials].sort((a, b) =>\n      a.credentialId.localeCompare(b.credentialId),\n    );\n\n    return expected.every(\n      (item, index) =>\n        item.credentialId === actual[index]!.credentialId &&\n        item.revision === actual[index]!.revision,\n    );\n  };\n\n  const actionModule = (moduleId: string, action: EmailAction) =>\n    `${moduleId}/${action === \"verify-address\" ? \"verify-address\" : \"change-address\"}`;\n\n  const actionPurpose = (action: EmailAction) =>\n    action === \"verify-address\" ? \"email-address-verification\" : \"email-address-change\";\n\n  const completionMatches = (input: EmailAddressMutation, action: EmailAction) => {\n    const completion = input.completion.input;\n    const binding = completion.binding;\n\n    return (\n      completion.moduleId === actionModule(input.moduleId, action) &&\n      completion.purpose === actionPurpose(action) &&\n      binding._tag === \"IdentifierChange\" &&\n      sameIdentifier(binding.identifier, input.target) &&\n      sameEmailRevision(binding.revision, input.captured.revision)\n    );\n  };\n\n  const snapshotEmailMutation = Effect.fn(\"DrizzleEmail.snapshotMutation\")(function* (\n    input: EmailAddressMutation,\n  ) {\n    const evidence = yield* snapshotAuthenticationEvidence(input.authorization.evidence).pipe(\n      Effect.mapError(unavailable),\n    );\n\n    const requirement = yield* snapshotEmailRequirement(input.authorization.requirement);\n\n    const source =\n      input.captured.source === undefined\n        ? undefined\n        : yield* snapshotEmailCredential(input.captured.source);\n\n    return Object.freeze({\n      ...input,\n      target: Object.freeze({ ...input.target }),\n      ...(input.invalidation === undefined\n        ? {}\n        : { invalidation: Object.freeze({ ...input.invalidation }) }),\n      captured: Object.freeze({\n        eligible: input.captured.eligible,\n        revision: snapshotEmailRevision(input.captured.revision),\n        ...(input.captured.targetIdentifierRevision === undefined\n          ? {}\n          : { targetIdentifierRevision: input.captured.targetIdentifierRevision }),\n        ...(source === undefined ? {} : { source }),\n      }),\n      authorization: Object.freeze({\n        challenge: Object.freeze({\n          ...input.authorization.challenge,\n          target: Object.freeze({ ...input.authorization.challenge.target }),\n          revision: snapshotEmailRevision(input.authorization.challenge.revision),\n        }),\n        evidence,\n        requirement,\n      }),\n    });\n  });\n\n  const validateEmailAuthority = Effect.fn(\"DrizzleEmail.validateAuthority\")(function* (\n    mapping: AddressMapping,\n    configuration: EmailSqlConfiguration,\n    input: EmailAddressMutation,\n    action: EmailAction,\n  ) {\n    const confirmsExisting =\n      action === \"verify-address\" && input.captured.targetIdentifierRevision !== undefined;\n\n    if (\n      !input.captured.eligible ||\n      !completionMatches(input, action) ||\n      input.authorization.challenge.moduleId !== input.moduleId ||\n      input.authorization.challenge.action !== action ||\n      input.authorization.challenge.commandId !== input.commandId ||\n      !sameIdentifier(input.authorization.challenge.target, input.target) ||\n      input.authorization.challenge.sourceCredentialId !== input.captured.source?.credentialId ||\n      !sameEmailRevision(input.authorization.challenge.revision, input.captured.revision) ||\n      input.authorization.challenge.targetIdentifierRevision !==\n        input.captured.targetIdentifierRevision ||\n      (input.authorization.evidence.flowId as string) !== (input.commandId as string) ||\n      input.authorization.evidence.bindingDigest !== input.authorization.challenge.bindingDigest ||\n      !sameEmailRevision(input.authorization.evidence.revision, input.captured.revision) ||\n      (action === \"verify-address\" && input.captured.source !== undefined) ||\n      (action === \"change-address\" && input.captured.source === undefined) ||\n      confirmsExisting !== (input.invalidation === undefined) ||\n      (input.invalidation?.existingSessions === \"immediate\" &&\n        mapping.sessionInvalidation !== \"same-authority-immediate\")\n    )\n      return undefined;\n\n    const current = yield* currentAddress(\n      mapping,\n      {\n        moduleId: input.moduleId,\n        subjectId: input.captured.revision.subjectId,\n        target: input.target,\n        ...(input.captured.source === undefined\n          ? {}\n          : { sourceCredentialId: input.captured.source.credentialId }),\n      },\n      configuration.locking,\n    );\n\n    if (\n      current === undefined ||\n      !current.eligible ||\n      !sameEmailRevision(current.revision, input.captured.revision) ||\n      current.targetIdentifierRevision !== input.captured.targetIdentifierRevision ||\n      (input.captured.source !== undefined &&\n        (current.source === undefined ||\n          current.source.snapshot.identifierRevision !== input.captured.source.identifierRevision ||\n          current.source.snapshot.credentialRevision !== input.captured.source.credentialRevision ||\n          !sameIdentifier(current.source.snapshot.identifier, input.captured.source.identifier)))\n    )\n      return undefined;\n\n    const currentRequirement = yield* mapping.subject.decodeActionRequirement(\n      current.subject,\n      action,\n    );\n\n    const original = yield* assessAuthentication(\n      input.authorization.evidence,\n      input.authorization.requirement,\n    ).pipe(Effect.mapError(unavailable));\n\n    const configured = yield* assessAuthentication(\n      input.authorization.evidence,\n      currentRequirement,\n    ).pipe(Effect.mapError(unavailable));\n\n    return original.satisfied && configured.satisfied ? current : undefined;\n  });\n\n  const commandExists = Effect.fn(\"Drizzle.commandExists\")(function* (\n    mapping: AddressMapping,\n    moduleId: string,\n    commandId: string,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentEmailSql;\n\n    const c = commandColumns(mapping);\n\n    return yield* selectRows(\n      database\n        .select()\n        .from(mapping.command.table)\n        .where(and(eq(c.moduleId, moduleId), eq(c.commandId, commandId)))\n        .limit(1),\n      locking,\n    );\n  });\n\n  const applyMutation = Effect.fn(\"DrizzleEmail.applyMutation\")(function* (\n    mapping: AddressMapping,\n    input: EmailAddressMutation,\n    action: EmailAction,\n    current: CurrentAddress,\n    allocated: {\n      readonly targetCredentialId: string;\n      readonly targetIdentifierRevision: SecurityRevision;\n      readonly targetCredentialRevision: SecurityRevision;\n      readonly sourceIdentifierRevision: SecurityRevision;\n      readonly sourceCredentialRevision: SecurityRevision;\n      readonly nextSecurityRevision: SecurityRevision;\n    },\n    now: number,\n  ) {\n    const database = yield* CurrentEmailSql;\n\n    const i = identifierColumns(mapping);\n    const c = credentialColumns(mapping);\n    const a = authorityColumns(mapping);\n    const s = subjectColumns(mapping);\n\n    const targetCredentialId =\n      current.targetCredential?.[mapping.credential.credentialId] ?? allocated.targetCredentialId;\n\n    if (action === \"change-address\") {\n      const source = current.source!;\n\n      yield* database\n        .update(mapping.identifier.table)\n        .set(\n          mapping.identifier.encodeRetirement({\n            source: source.snapshot.identifier,\n            bindingRevision: allocated.sourceIdentifierRevision,\n          }),\n        )\n        .where(\n          and(\n            eq(i.namespace, source.snapshot.identifier.namespace),\n            eq(i.value, source.snapshot.identifier.value),\n            eq(i.subjectId, current.nativeSubjectId),\n            eq(i.bindingRevision, source.snapshot.identifierRevision),\n          ),\n        );\n      yield* database\n        .update(mapping.credential.table)\n        .set(\n          mapping.credential.encodeRetirement({\n            source: source.snapshot.identifier,\n            credentialRevision: allocated.sourceCredentialRevision,\n          }),\n        )\n        .where(\n          and(\n            eq(c.moduleId, input.moduleId),\n            eq(c.credentialId, source.snapshot.credentialId),\n            eq(c.subjectId, current.nativeSubjectId),\n            eq(c.credentialRevision, source.snapshot.credentialRevision),\n          ),\n        );\n      yield* database\n        .update(mapping.authorityCredential.table)\n        .set(mapping.authorityCredential.encodeRetirement(allocated.sourceCredentialRevision))\n        .where(\n          and(\n            eq(a.subjectId, current.nativeSubjectId),\n            eq(a.credentialId, source.snapshot.credentialId),\n            eq(a.revision, source.snapshot.credentialRevision),\n          ),\n        );\n    }\n    if (current.targetIdentifier === undefined) {\n      yield* database.insert(mapping.identifier.table).values(\n        mapping.identifier.encodeVerifiedInsert({\n          identifier: input.target,\n          subjectId: current.nativeSubjectId,\n          verifiedAtMillis: now,\n          bindingRevision: allocated.targetIdentifierRevision,\n        }),\n      );\n    } else {\n      yield* database\n        .update(mapping.identifier.table)\n        .set(\n          mapping.identifier.encodeVerification({\n            verifiedAtMillis: now,\n            bindingRevision: allocated.targetIdentifierRevision,\n          }),\n        )\n        .where(\n          and(\n            eq(i.namespace, input.target.namespace),\n            eq(i.value, input.target.value),\n            eq(i.subjectId, current.nativeSubjectId),\n            eq(i.bindingRevision, current.targetIdentifier![mapping.identifier.bindingRevision]),\n          ),\n        );\n    }\n    if (current.targetCredential === undefined) {\n      yield* database.insert(mapping.credential.table).values(\n        mapping.credential.encodeVerifiedInsert({\n          moduleId: input.moduleId,\n          subjectId: current.nativeSubjectId,\n          credentialId: targetCredentialId,\n          identifier: input.target,\n          credentialRevision: allocated.targetCredentialRevision,\n        }),\n      );\n      yield* database.insert(mapping.authorityCredential.table).values(\n        mapping.authorityCredential.encodeInsert({\n          subjectId: current.nativeSubjectId,\n          credentialId: targetCredentialId,\n          revision: allocated.targetCredentialRevision,\n        }),\n      );\n    } else {\n      const oldRevision = current.targetCredential[mapping.credential.credentialRevision];\n\n      yield* database\n        .update(mapping.credential.table)\n        .set(\n          mapping.credential.encodeActivation({\n            identifier: input.target,\n            credentialRevision: allocated.targetCredentialRevision,\n          }),\n        )\n        .where(\n          and(\n            eq(c.moduleId, input.moduleId),\n            eq(c.credentialId, targetCredentialId),\n            eq(c.subjectId, current.nativeSubjectId),\n            eq(c.credentialRevision, oldRevision),\n          ),\n        );\n      yield* database\n        .update(mapping.authorityCredential.table)\n        .set(mapping.authorityCredential.encodeActivation(allocated.targetCredentialRevision))\n        .where(\n          and(\n            eq(a.subjectId, current.nativeSubjectId),\n            eq(a.credentialId, targetCredentialId),\n            eq(a.revision, oldRevision),\n          ),\n        );\n    }\n    yield* database\n      .update(mapping.subject.table)\n      .set(updateValues([[mapping.subject.securityRevision, allocated.nextSecurityRevision]]))\n      .where(\n        and(\n          eq(s.id, current.nativeSubjectId),\n          eq(s.securityRevision, input.captured.revision.securityRevision),\n        ),\n      );\n    yield* database.insert(mapping.command.table).values(\n      mapping.command.encodeInsert({\n        moduleId: input.moduleId,\n        commandId: input.commandId,\n        action,\n        bindingDigest: input.authorization.challenge.bindingDigest,\n        retentionUntilMillis: now + mapping.commandRetentionMillis,\n      }),\n    );\n\n    const sourceStillActive =\n      action === \"verify-address\"\n        ? []\n        : yield* selectRows(\n            database\n              .select()\n              .from(mapping.credential.table)\n              .where(\n                and(\n                  eq(c.moduleId, input.moduleId),\n                  eq(c.credentialId, current.source!.snapshot.credentialId),\n                  eq(c.subjectId, current.nativeSubjectId),\n                ),\n              ),\n            false,\n          );\n\n    const target = (yield* emailLookupRows(mapping, input.moduleId, input.target))[0];\n\n    const targetAuthority = yield* selectRows(\n      database\n        .select()\n        .from(mapping.authorityCredential.table)\n        .where(\n          and(eq(a.subjectId, current.nativeSubjectId), eq(a.credentialId, targetCredentialId)),\n        )\n        .limit(1),\n      false,\n    );\n\n    const command = yield* selectRows(\n      database\n        .select()\n        .from(mapping.command.table)\n        .where(\n          and(\n            eq(commandColumns(mapping).moduleId, input.moduleId),\n            eq(commandColumns(mapping).commandId, input.commandId),\n            eq(commandColumns(mapping).action, action),\n            eq(commandColumns(mapping).bindingDigest, input.authorization.challenge.bindingDigest),\n            eq(\n              commandColumns(mapping).retentionUntil,\n              mapping.encodeInstant(now + mapping.commandRetentionMillis),\n            ),\n          ),\n        )\n        .limit(1),\n      false,\n    );\n\n    const targetVerifiedAt =\n      target === undefined\n        ? undefined\n        : yield* mapping.decodeInstant(target.identifier[mapping.identifier.verifiedAt]);\n\n    const sourceIdentifier =\n      action === \"verify-address\"\n        ? []\n        : yield* identifierRow(mapping, current.source!.snapshot.identifier, false);\n\n    const sourceAuthority =\n      action === \"verify-address\"\n        ? []\n        : yield* selectRows(\n            database\n              .select()\n              .from(mapping.authorityCredential.table)\n              .where(\n                and(\n                  eq(a.subjectId, current.nativeSubjectId),\n                  eq(a.credentialId, current.source!.snapshot.credentialId),\n                ),\n              )\n              .limit(1),\n            false,\n          );\n\n    return (\n      target !== undefined &&\n      mapping.subjectId.equals(target.subject[mapping.subject.id], current.nativeSubjectId) &&\n      mapping.subject.isActiveStatus(target.subject[mapping.subject.status]) &&\n      target.subject[mapping.subject.securityRevision] === allocated.nextSecurityRevision &&\n      target.identifier[mapping.identifier.bindingRevision] ===\n        allocated.targetIdentifierRevision &&\n      targetVerifiedAt === now &&\n      target.credential[mapping.credential.credentialRevision] ===\n        allocated.targetCredentialRevision &&\n      target.credential[mapping.credential.credentialId] === targetCredentialId &&\n      mapping.subjectId.equals(\n        target.credential[mapping.credential.subjectId],\n        current.nativeSubjectId,\n      ) &&\n      mapping.identifier.isCurrent(target.identifier) &&\n      mapping.credential.isActiveStatus(target.credential[mapping.credential.status]) &&\n      targetAuthority.length === 1 &&\n      targetAuthority[0]![mapping.authorityCredential.revision] ===\n        allocated.targetCredentialRevision &&\n      mapping.authorityCredential.isActiveStatus(\n        targetAuthority[0]![mapping.authorityCredential.status],\n      ) &&\n      command.length === 1 &&\n      (action === \"verify-address\" ||\n        (sourceStillActive.length === 1 &&\n          sourceStillActive[0]![mapping.credential.credentialRevision] ===\n            allocated.sourceCredentialRevision &&\n          !mapping.credential.isActiveStatus(sourceStillActive[0]![mapping.credential.status]) &&\n          sourceIdentifier.length === 1 &&\n          mapping.subjectId.equals(\n            sourceIdentifier[0]![mapping.identifier.subjectId],\n            current.nativeSubjectId,\n          ) &&\n          sourceIdentifier[0]![mapping.identifier.bindingRevision] ===\n            allocated.sourceIdentifierRevision &&\n          !mapping.identifier.isCurrent(sourceIdentifier[0]!) &&\n          sourceAuthority.length === 1 &&\n          sourceAuthority[0]![mapping.authorityCredential.revision] ===\n            allocated.sourceCredentialRevision &&\n          !mapping.authorityCredential.isActiveStatus(\n            sourceAuthority[0]![mapping.authorityCredential.status],\n          )))\n    );\n  });\n\n  const probeProofCompletion = Effect.fn(\"Drizzle.probeProofCompletion\")(function* (\n    configuration: EmailSqlConfiguration,\n    input: ProofCompletionInput,\n  ) {\n    const database = yield* CurrentEmailSql;\n\n    if (configuration.proof === undefined) return yield* Effect.fail(unavailable());\n    const validProbe = { _tag: \"EmailProofCompletionValid\" } as const;\n\n    const plan = {\n      input,\n      prepare: <A>(\n        decision: ProofCompletionDecision,\n        journal: CommitJournal,\n        project: (decision: ProofCompletionDecision) => A,\n      ) => journal.prepare(project(decision)),\n    };\n\n    const probe = coordinateCommit(\n      () =>\n        database.transaction((transaction) =>\n          completeProofPlanIn(\n            configuration.proof!.mapping,\n            configuration.proof!.configuration,\n            plan,\n            Effect.fail(validProbe),\n            () => false,\n          ).pipe(\n            Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),\n          ),\n        ),\n      { mode: configuration.mode },\n    );\n\n    return yield* probe.pipe(\n      Effect.as(false),\n      Effect.catchCause((cause) => {\n        const reason = cause.reasons[0];\n\n        return cause.reasons.length === 1 &&\n          reason !== undefined &&\n          Cause.isFailReason(reason) &&\n          reason.error === validProbe\n          ? Effect.succeed(true)\n          : Effect.failCause(cause);\n      }),\n    );\n  });\n\n  const prepareRejected = Effect.fn(\"Drizzle.prepareRejected\")(function* <A>(\n    configuration: EmailSqlConfiguration,\n    prepare: (value: \"rejected\", journal: CommitJournal) => PreparedCommit<A>,\n  ) {\n    const database = yield* CurrentEmailSql;\n\n    return yield* owned(\n      database,\n      configuration,\n      Effect.gen(function* () {\n        const journal = yield* CurrentCommitJournal;\n\n        return yield* Effect.succeed(prepare(\"rejected\", journal));\n      }),\n    );\n  });\n\n  const makeSqlEmailAddressPersistence = Effect.fn(\"makeSqlEmailAddressPersistence\")(function* (\n    database: EmailSqlDatabase,\n    mapping: AddressMapping,\n    configuration: EmailSqlConfiguration,\n  ): Effect.fn.Return<EmailAddressPersistence[\"Service\"], never, LifecycleHooks> {\n    const hooks = yield* LifecycleHooks;\n\n    return EmailAddressPersistence.of({\n      target: (input) =>\n        (validAddressConstraints(mapping)\n          ? safeRead(\n              database,\n              configuration,\n              Effect.gen(function* () {\n                const current = yield* currentAddress(mapping, input, configuration.locking);\n\n                if (current === undefined) return yield* unavailable();\n\n                return Object.freeze({\n                  revision: snapshotEmailRevision(current.revision),\n                  eligible: current.eligible,\n                  ...(current.targetIdentifierRevision === undefined\n                    ? {}\n                    : { targetIdentifierRevision: current.targetIdentifierRevision }),\n                  ...(current.source === undefined\n                    ? {}\n                    : { source: yield* snapshotEmailCredential(current.source.snapshot) }),\n                });\n              }),\n            )\n          : Effect.fail(unavailable())\n        ).pipe(\n          Effect.provideService(CurrentEmailSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      checkCompletion: (input) => {\n        if (configuration.proof === undefined || input.binding._tag !== \"IdentifierChange\")\n          return Effect.succeed(false).pipe(\n            Effect.provideService(CurrentEmailSql, database),\n            Effect.provideService(LifecycleHooks, hooks),\n            translateFailure,\n          );\n        const binding = input.binding;\n\n        return safeRead(\n          database,\n          configuration,\n          Effect.gen(function* () {\n            const action: EmailAction | undefined =\n              input.moduleId.endsWith(\"/verify-address\") &&\n              input.purpose === \"email-address-verification\"\n                ? \"verify-address\"\n                : input.moduleId.endsWith(\"/change-address\") &&\n                    input.purpose === \"email-address-change\"\n                  ? \"change-address\"\n                  : undefined;\n\n            if (action === undefined) return false;\n            const moduleId = input.moduleId.slice(0, -`/${action}`.length);\n\n            const current = yield* currentAddress(\n              mapping,\n              {\n                moduleId,\n                subjectId: binding.revision.subjectId,\n                target: binding.identifier,\n              },\n              false,\n            );\n\n            return current !== undefined && sameEmailRevision(current.revision, binding.revision);\n          }),\n        )\n          .pipe(\n            Effect.flatMap((current) =>\n              current ? probeProofCompletion(configuration, input) : Effect.succeed(false),\n            ),\n          )\n          .pipe(\n            Effect.provideService(CurrentEmailSql, database),\n            Effect.provideService(LifecycleHooks, hooks),\n            translateFailure,\n          );\n      },\n      verifyWithProof: (uncaptured, prepare) =>\n        mutateAddress(mapping, configuration, uncaptured, \"verify-address\", prepare).pipe(\n          Effect.provideService(CurrentEmailSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      changeWithProof: (uncaptured, prepare) =>\n        mutateAddress(mapping, configuration, uncaptured, \"change-address\", prepare).pipe(\n          Effect.provideService(CurrentEmailSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      cleanup: (input, prepare) =>\n        owned(\n          database,\n          configuration,\n          Effect.gen(function* () {\n            const transaction = yield* CurrentEmailSql;\n            const journal = yield* CurrentCommitJournal;\n\n            const c = commandColumns(mapping);\n            const now = yield* nowMillis;\n\n            const rows = yield* selectRows(\n              transaction\n                .select({ commandId: c.commandId })\n                .from(mapping.command.table)\n                .where(\n                  and(\n                    eq(c.moduleId, input.moduleId),\n                    lte(c.retentionUntil, mapping.encodeInstant(now)),\n                  ),\n                )\n                .limit(input.limit + 1),\n              configuration.locking,\n            );\n\n            const selected = rows.slice(0, input.limit);\n\n            const receipt = prepare(\n              { removed: selected.length, hasMore: rows.length > input.limit },\n              journal,\n            );\n\n            if (selected.length > 0)\n              yield* transaction.delete(mapping.command.table).where(\n                and(\n                  eq(c.moduleId, input.moduleId),\n                  inArray(\n                    c.commandId,\n                    selected.map((row: any) => row.commandId),\n                  ),\n                  lte(c.retentionUntil, mapping.encodeInstant(now)),\n                ),\n              );\n\n            return receipt;\n          }),\n        ).pipe(\n          Effect.provideService(CurrentEmailSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n    });\n  });\n\n  const mutateAddress = Effect.fn(\"Drizzle.mutateAddress\")(function* <A>(\n    mapping: AddressMapping,\n    configuration: EmailSqlConfiguration,\n    uncaptured: EmailAddressMutation,\n    action: EmailAction,\n    prepare: (value: \"changed\" | \"rejected\", journal: CommitJournal) => PreparedCommit<A>,\n  ) {\n    const database = yield* CurrentEmailSql;\n\n    if (!validAddressConstraints(mapping) || configuration.proof === undefined)\n      return yield* unavailable();\n    const input = yield* snapshotEmailMutation(uncaptured);\n\n    const targetCredentialId = yield* allocate(\n      configuration.mode,\n      mapping.allocateCredentialId,\n      mapping.allocateCredentialIdSync,\n    );\n\n    const targetIdentifierRevision = yield* allocate(\n      configuration.mode,\n      mapping.allocateRevision,\n      mapping.allocateRevisionSync,\n    );\n\n    const targetCredentialRevision = yield* allocate(\n      configuration.mode,\n      mapping.allocateRevision,\n      mapping.allocateRevisionSync,\n    );\n\n    const sourceIdentifierRevision = yield* allocate(\n      configuration.mode,\n      mapping.allocateRevision,\n      mapping.allocateRevisionSync,\n    );\n\n    const sourceCredentialRevision = yield* allocate(\n      configuration.mode,\n      mapping.allocateRevision,\n      mapping.allocateRevisionSync,\n    );\n\n    const confirmsExisting =\n      action === \"verify-address\" && input.captured.targetIdentifierRevision !== undefined;\n\n    const nextRevision = confirmsExisting\n      ? input.captured.revision.securityRevision\n      : yield* nextSecurityRevision(\n          mapping,\n          configuration.mode,\n          input.captured.revision.securityRevision,\n        );\n\n    if (\n      (!confirmsExisting && nextRevision === input.captured.revision.securityRevision) ||\n      [\n        targetIdentifierRevision,\n        targetCredentialRevision,\n        sourceIdentifierRevision,\n        sourceCredentialRevision,\n      ].some((value) => input.captured.revision.credentials.some((item) => item.revision === value))\n    )\n      return yield* unavailable();\n\n    const run = owned(\n      database,\n      configuration,\n      Effect.gen(function* () {\n        const journal = yield* CurrentCommitJournal;\n\n        const current = yield* validateEmailAuthority(mapping, configuration, input, action);\n\n        if (current === undefined) return prepare(\"rejected\", journal);\n        if (\n          (yield* commandExists(mapping, input.moduleId, input.commandId, configuration.locking))\n            .length > 0\n        )\n          return prepare(\"rejected\", journal);\n        let receipt: PreparedCommit<A> | undefined;\n\n        yield* completeProofPlanIn(\n          configuration.proof!.mapping,\n          configuration.proof!.configuration,\n          input.completion,\n          Effect.gen(function* () {\n            // The proof helper may wait on continuation/series locks. Read the\n            // commit clock and reassess both policies only after those locks.\n            const currentRequirement = yield* mapping.subject.decodeActionRequirement(\n              current.subject,\n              action,\n            );\n\n            const original = yield* assessAuthentication(\n              input.authorization.evidence,\n              input.authorization.requirement,\n            ).pipe(Effect.mapError(unavailable));\n\n            const configured = yield* assessAuthentication(\n              input.authorization.evidence,\n              currentRequirement,\n            ).pipe(Effect.mapError(unavailable));\n\n            if (!original.satisfied || !configured.satisfied) return false;\n            const now = yield* nowMillis;\n\n            return yield* applyMutation(\n              mapping,\n              input,\n              action,\n              current,\n              {\n                targetCredentialId,\n                targetIdentifierRevision,\n                targetCredentialRevision,\n                sourceIdentifierRevision,\n                sourceCredentialRevision,\n                nextSecurityRevision: nextRevision,\n              },\n              now,\n            );\n          }),\n          (decision) => {\n            receipt = prepare(decision === \"completed\" ? \"changed\" : \"rejected\", journal);\n\n            return decision;\n          },\n        );\n\n        return receipt ?? prepare(\"rejected\", journal);\n      }),\n    );\n\n    return yield* run.pipe(\n      Effect.catchCause((cause) =>\n        (cause.reasons.every(Cause.isFailReason) &&\n          isMappedConstraintConflict(mapping.isCommandConflict, cause)) ||\n        (cause.reasons.every(Cause.isFailReason) &&\n          isMappedConstraintConflict(mapping.isIdentifierConflict, cause)) ||\n        (cause.reasons.every(Cause.isFailReason) &&\n          isMappedConstraintConflict(mapping.isCredentialConflict, cause))\n          ? prepareRejected(configuration, prepare)\n          : Effect.failCause(cause),\n      ),\n    );\n  });\n\n  return {\n    validEmailSignInConstraints,\n    emailLookupQuery,\n    decodeEmailSnapshot,\n    makeSqlEmailSignInTargets,\n    currentAddress,\n    sameEmailRevision,\n    snapshotEmailMutation,\n    validateEmailAuthority,\n    makeSqlEmailAddressPersistence,\n  };\n};\n"],"mappings":";;;;;;;;;;AAkFA,IAAa,kBAAb,cAAqC,QAAQ,QAA2C,CAAC,CACvF,6BACF,CAAC,CAAC,CAAC;AA4BH,MAAa,mBAIX,YACA,WACG;CAGH,MAAM,EAAE,KAAK,IAAI,SAAS,KAAK,QAAQ,iBAAiB;CACxD,MAAM,EAAE,wBAAwB;CAChC,MAAM,oBAAoB,iBAAiB,KAAK,CAAC,CAAC;CAElD,MAAM,oBACJ,WAEA,yBACE,SACC,UACC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,sBAAsB,CAAC,CAAC,KAAK,CAC3C,CAAC,CAAC,KAAK,OAAO,YAAY,UAAU,OAAO,UAAU,MAAM,IAAI,aAAa,YAAY,CAAC,CAAC,CAAC,CAAC;CAE9F,MAAM,YAAY,OAAO,IAAI,SAAS,KAAK,SAAS,aAAa;CAEjE,MAAM,cAAc,OAAsB,YACxC,WAAW,OAAO,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,IAAI;CAErE,MAAM,kBAAkB,MAAuB,UAC7C,KAAK,cAAc,MAAM,aAAa,KAAK,UAAU,MAAM;CAE7D,MAAM,+BAA+B,YACnC,OAAO,QAAQ,8BAA8B,CAAC,CAAC,OAC5C,CAAC,KAAK,WACL,QAAQ,YAAY,SAAwD,KAChF;CAEF,MAAM,2BAA2B,YAC/B,OAAO,QAAQ,+BAA+B,CAAC,CAAC,OAC7C,CAAC,KAAK,WACL,QAAQ,YAAY,SAAyD,KACjF;CAEF,MAAM,kBAAkB,aAA4B;EAClD,IAAI,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,EAAE;EACpD,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;EAC5D,kBAAkB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,gBAAgB;CAClF;CAEA,MAAM,qBAAqB,aAA4B;EACrD,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;EACxE,OAAO,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,KAAK;EAChE,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;EACxE,YAAY,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,UAAU;EAC1E,iBAAiB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,eAAe;CACtF;CAEA,MAAM,qBAAqB,aAA4B;EACrD,UAAU,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,QAAQ;EACtE,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;EACxE,cAAc,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,YAAY;EAC9E,qBAAqB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,mBAAmB;EAC5F,iBAAiB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,eAAe;EACpF,oBAAoB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,kBAAkB;EAC1F,QAAQ,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,MAAM;CACpE;CAEA,MAAM,oBAAoB,aAA6B;EACrD,WAAW,OAAO,QAAQ,oBAAoB,OAAO,QAAQ,oBAAoB,SAAS;EAC1F,cAAc,OACZ,QAAQ,oBAAoB,OAC5B,QAAQ,oBAAoB,YAC9B;EACA,UAAU,OAAO,QAAQ,oBAAoB,OAAO,QAAQ,oBAAoB,QAAQ;EACxF,QAAQ,OAAO,QAAQ,oBAAoB,OAAO,QAAQ,oBAAoB,MAAM;CACtF;CAEA,MAAM,kBAAkB,aAA6B;EACnD,UAAU,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,QAAQ;EAChE,WAAW,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,SAAS;EAClE,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;EAC5D,eAAe,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,aAAa;EAC1E,gBAAgB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,cAAc;CAC9E;CAEA,MAAM,YACJ,MACA,cACA,gBACG;EACH,IAAI,SAAS,eACX,OAAO,gBAAgB,KAAA,IACnB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;GACT,KAAK;GACL,QAAQ,UAAU,IAAI,wBAAwB;IAAE,WAAW;IAAW;GAAM,CAAC;EAC/E,CAAC;EACP,IAAI,iBAAiB,KAAA,GAAW,OAAO;EAEvC,OAAO,gBAAgB,KAAA,IACnB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;GACT,KAAK;GACL,QAAQ,UAAU,IAAI,wBAAwB;IAAE,WAAW;IAAW;GAAM,CAAC;EAC/E,CAAC;CACP;CAEA,MAAM,wBACJ,SACA,MACA,YACG;EACH,IAAI,SAAS,eACX,OAAO,QAAQ,QAAQ,6BAA6B,KAAA,IAChD,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;GACT,WAAW,QAAQ,QAAQ,yBAA0B,OAAO;GAC5D,QAAQ,UAAU,IAAI,wBAAwB;IAAE,WAAW;IAAW;GAAM,CAAC;EAC/E,CAAC;EACP,IAAI,QAAQ,QAAQ,yBAAyB,KAAA,GAC3C,OAAO,QAAQ,QAAQ,qBAAqB,OAAO;EACrD,IAAI,QAAQ,QAAQ,6BAA6B,KAAA,GAC/C,OAAO,OAAO,IAAI;GAChB,WAAW,QAAQ,QAAQ,yBAA0B,OAAO;GAC5D,QAAQ,UAAU,IAAI,wBAAwB;IAAE,WAAW;IAAW;GAAM,CAAC;EAC/E,CAAC;EAEH,OAAO,OAAO,KAAK,YAAY,CAAC;CAClC;CAEA,MAAM,YACJ,UACA,eACA,SAEA,OAAO,IAAI,aAAa;EACtB,IAAI,cAAc,gBAAgB,MAAM;GACtC,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;GACrD,OAAO,cAAc;EACvB;EAEA,OAAO,OAAO,SAAS,aAAa,gBAClC,KAAK,KACH,OAAO,eAAe,iBAAiB,WAAW,GAClD,OAAO,eAAe,iBAAiB,WAA0C,CACnF,CACF;CACF,CAAC;CAEH,MAAM,SACJ,UACA,eACA,SACG;EACH,MAAM,MAAM,uBAER,SAAS,aAAa,gBACpB,KAAK,KACH,OAAO,eAAe,iBAAiB,WAAW,GAClD,OAAO,eAAe,iBAAiB,WAA0C,CACnF,CACF,GACF,EAAE,MAAM,cAAc,KAAK,CAC7B,CAAC,CAAC,KAAK,OAAO,KAAK,WAAW,OAAO,KAAK,CAAC;EAE3C,OAAO,cAAc,gBAAgB,OACjC,OAAO,IAAI,aAAa;GACtB,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;GACrD,OAAO,cAAc;GAErB,OAAO,OAAO;EAChB,CAAC,IACD;CACN;CAEA,MAAM,oBACJ,SACA,UACA,eACG;EACH,MAAM,UAAU,eAAe,OAAO,GACpC,UAAU,kBAAkB,OAAO,GACnC,aAAa,kBAAkB,OAAO;EAExC,OAAO;GACL,QAAQ;IACN,SAAS,QAAQ,QAAQ;IACzB,YAAY,QAAQ,WAAW;IAC/B,YAAY,QAAQ,WAAW;GACjC;GACA,MAAM,QAAQ,WAAW;GACzB,cAAc,QAAQ,QAAQ;GAC9B,aAAa,GAAG,QAAQ,IAAI,QAAQ,SAAS;GAC7C,iBAAiB,QAAQ,WAAW;GACpC,gBAAgB,IACd,GAAG,WAAW,UAAU,QAAQ,GAChC,GAAG,WAAW,WAAW,QAAQ,SAAS,GAC1C,GAAG,WAAW,qBAAqB,QAAQ,SAAS,GACpD,GAAG,WAAW,iBAAiB,QAAQ,KAAK,CAC9C;GACA,WAAW,IACT,GAAG,QAAQ,WAAW,WAAW,SAAS,GAC1C,GAAG,QAAQ,OAAO,WAAW,KAAK,CACpC;GACA,OAAO;EACT;CACF;CAEA,MAAM,kBAAkB,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,SACA,UACA,YACA;EACA,MAAM,WAAW,OAAO;EACxB,MAAM,QAAQ,iBAAiB,SAAS,UAAU,UAAU;EAE5D,OAAO,OAAO,SACX,OAAO,MAAM,MAAM,CAAC,CACpB,KAAK,MAAM,IAAI,CAAC,CAChB,UAAU,MAAM,cAAc,MAAM,WAAW,CAAC,CAChD,UAAU,MAAM,iBAAiB,MAAM,cAAc,CAAC,CACtD,MAAM,MAAM,SAAS,CAAC,CACtB,MAAM,MAAM,KAAK;CACtB,CAAC;CAED,MAAM,sBAAsB,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACnE,SACA,UACA,WACA,KACA;EACA,IACE,CAAC,QAAQ,QAAQ,eAAe,IAAI,QAAQ,QAAQ,QAAQ,OAAO,KACnE,CAAC,QAAQ,WAAW,UAAU,IAAI,UAAU,KAC5C,CAAC,QAAQ,WAAW,eAAe,IAAI,WAAW,QAAQ,WAAW,OAAO,GAE5E,OAAO,KAAA;EAET,MAAM,WAAW,OAAO,QAAQ,WAC7B,OAAO;GACN;GACA,SAAS,IAAI;GACb,YAAY,IAAI;GAChB,YAAY,IAAI;EAClB,CAAC,CAAC,CACD,KAAK,OAAO,QAAQ,uBAAuB,CAAC;EAE/C,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,IAAI,QAAQ,QAAQ,QAAQ,GAAG;EAEpF,MAAM,mBAAmB,OAAO,QAAQ,cACtC,IAAI,WAAW,QAAQ,WAAW,WACpC;EAEA,IACE,SAAS,aAAa,YACtB,CAAC,eAAe,SAAS,YAAY,SAAS,KAC9C,SAAS,SAAS,cAAc,aAChC,SAAS,SAAS,qBAAqB,IAAI,QAAQ,QAAQ,QAAQ,qBACnE,SAAS,uBAAuB,IAAI,WAAW,QAAQ,WAAW,oBAClE,SAAS,qBAAqB,oBAC9B,SAAS,iBAAiB,IAAI,WAAW,QAAQ,WAAW,iBAC5D,SAAS,uBAAuB,IAAI,WAAW,QAAQ,WAAW,qBAElE,OAAO,KAAA;EAET,OAAO;CACT,CAAC;CAED,MAAM,4BAA4B,OAAO,GAAG,2BAA2B,CAAC,CAAC,SACvE,UACA,SACA,eAC8C;EAC9C,OAAO,OAAO,QACZ,mBAAmB,GAAG,EACpB,SAAS,WACN,4BAA4B,OAAO,IAChC,SACE,UACA,eACA,OAAO,IAAI,aAAa;GACtB,MAAM,OAAO,OAAO,gBAClB,SACA,MAAM,UACN,MAAM,UACR,EAAA,CAAG;GAEH,IAAI,QAAQ,KAAA,GAAW,OAAO,OAAO,KAAK;GAE1C,MAAM,WAAW,OAAO,oBACtB,SACA,MAAM,UACN,MAAM,YACN,GACF;GAEA,OAAO,aAAa,KAAA,IAAY,OAAO,KAAK,IAAI,OAAO,KAAK,QAAQ;EACtE,CAAC,CACH,IACA,OAAO,KAAK,YAAY,CAAC,EAAA,CAC3B,KAAK,OAAO,eAAe,iBAAiB,QAAQ,GAAG,gBAAgB,EAC7E,CAAC,CACH;CACF,CAAC;CAED,MAAM,cAAc,OAAO,GAAG,0BAA0B,CAAC,CAAC,WACxD,SACA,WACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,SAAgB;EAC1E,MAAM,IAAI,eAAe,OAAO;EAOhC,OAAO;GAAE;GAAiB,UALT,OAAO,WACtB,SAAS,OAAO,CAAC,CAAC,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAAC,MAAM,GAAG,EAAE,IAAI,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,GACtF,OACF,EAAA,CAAG;EAE+B;CACpC,CAAC;CAED,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,YACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EAEnC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,IAAI,GAAG,EAAE,WAAW,WAAW,SAAS,GAAG,GAAG,EAAE,OAAO,WAAW,KAAK,CAAC,CAAC,CAAC,CAChF,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,iBAAiB,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,UACA,cACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EAEnC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,IAAI,GAAG,EAAE,UAAU,QAAQ,GAAG,GAAG,EAAE,cAAc,YAAY,CAAC,CAAC,CAAC,CACtE,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,yBAAyB,OAAO,GAAG,gCAAgC,CAAC,CAAC,WACzE,SACA,UACA,YACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EAEnC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MACC,IACE,GAAG,EAAE,UAAU,QAAQ,GACvB,GAAG,EAAE,qBAAqB,WAAW,SAAS,GAC9C,GAAG,EAAE,iBAAiB,WAAW,KAAK,CACxC,CACF,CAAC,CACA,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,iBAAiB,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAC9D,SACA,OAMA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,SAAS,OAAO,YAAY,SAAS,MAAM,WAAW,OAAO;EAEnE,IACE,OAAO,YAAY,KAAA,KACnB,CAAC,QAAQ,QAAQ,eAAe,OAAO,QAAQ,QAAQ,QAAQ,OAAO,GAEtE,OAAO,KAAA;EAET,MAAM,mBACJ,MAAM,uBAAuB,KAAA,IACzB,KAAA,KACC,OAAO,eAAe,SAAS,MAAM,UAAU,MAAM,oBAAoB,KAAK,EAAA,CAAG;EAExF,MAAM,mBACJ,qBAAqB,KAAA,IACjB,KAAA,IACA;GACE,WAAW,iBAAiB,QAAQ,WAAW;GAC/C,OAAO,iBAAiB,QAAQ,WAAW;EAC7C;EAEN,MAAM,cAAc,CAClB,MAAM,QACN,GAAI,qBAAqB,KAAA,IAAY,CAAC,IAAI,CAAC,gBAAgB,CAC7D,CAAC,CACE,QACE,OAAO,OAAO,WACb,OAAO,WAAW,cAAc,eAAe,WAAW,KAAK,CAAC,MAAM,KAC1E,CAAC,CACA,MAAM,MAAM,UACX,GAAG,KAAK,UAAU,QAAQ,KAAK,QAAQ,cACrC,GAAG,MAAM,UAAU,QAAQ,MAAM,OACnC,CACF;EAEF,MAAM,oCAAoB,IAAI,IAAiB;EAE/C,KAAK,MAAM,cAAc,aAAa;GACpC,MAAM,OAAO,OAAO,cAAc,SAAS,YAAY,OAAO,EAAA,CAAG;GAEjE,IAAI,QAAQ,KAAA,GACV,kBAAkB,IAAI,GAAG,WAAW,UAAU,QAAQ,WAAW,SAAS,GAAG;EACjF;EAEA,MAAM,mBACJ,MAAM,uBAAuB,KAAA,IACzB,KAAA,KACC,OAAO,eAAe,SAAS,MAAM,UAAU,MAAM,oBAAoB,OAAO,EAAA,CAAG;EAE1F,MAAM,oBAAoB,OAAO,uBAC/B,SACA,MAAM,UACN,MAAM,QACN,OACF,EAAA,CAAG;EAEH,MAAM,IAAI,iBAAiB,OAAO;EAWlC,MAAM,mBAAkB,OATC,WACvB,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,oBAAoB,KAAK,CAAC,CACvC,MAAM,GAAG,EAAE,WAAW,OAAO,eAAe,CAAC,CAAC,CAC9C,QAAQ,EAAE,YAAY,GACzB,OACF,EAAA,CAEkC,QAAQ,QACxC,QAAQ,oBAAoB,eAAe,IAAI,QAAQ,oBAAoB,OAAO,CACpF;EAEA,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,OAAO,eAAe;EAE3E,MAAM,WAAmC,OAAO,OAAO;GACrD;GACA,kBAAkB,OAAO,QAAQ,QAAQ,QAAQ;GACjD,aAAa,OAAO,OAClB,gBAAgB,KAAK,QACnB,OAAO,OAAO;IACZ,cAAc,IAAI,QAAQ,oBAAoB;IAC9C,UAAU,IAAI,QAAQ,oBAAoB;GAC5C,CAAC,CACH,CACF;EACF,CAAC;EAED,MAAM,mBAAmB,kBAAkB,IACzC,GAAG,MAAM,OAAO,UAAU,QAAQ,MAAM,OAAO,OACjD;EASA,MAAM,gBANJ,qBAAqB,KAAA,KACrB,QAAQ,UAAU,OAChB,iBAAiB,QAAQ,WAAW,YACpC,OAAO,eACT,KAIA,QAAQ,WAAW,gBAAgB,gBAAgB,MAClD,qBAAqB,KAAA,KACnB,CAAC,QAAQ,WAAW,eAAe,iBAAiB,QAAQ,WAAW,OAAO,KAC7E,QAAQ,UAAU,OAChB,iBAAiB,QAAQ,WAAW,YACpC,OAAO,eACT;EAEN,IAAI;EAEJ,IAAI,MAAM,uBAAuB,KAAA,GAAW;GAC1C,IACE,qBAAqB,KAAA,KACrB,qBAAqB,KAAA,KACrB,CAAC,QAAQ,UAAU,OACjB,iBAAiB,QAAQ,WAAW,YACpC,OAAO,eACT,KACA,CAAC,QAAQ,WAAW,eAAe,iBAAiB,QAAQ,WAAW,OAAO,GAE9E,OAAO,KAAA;GAET,MAAM,sBAAsB,kBAAkB,IAC5C,GAAG,iBAAiB,UAAU,QAAQ,iBAAiB,OACzD;GAEA,IACE,wBAAwB,KAAA,KACxB,CAAC,QAAQ,WAAW,UAAU,mBAAmB,KACjD,CAAC,QAAQ,UAAU,OACjB,oBAAoB,QAAQ,WAAW,YACvC,OAAO,eACT,GAEA,OAAO,KAAA;GAWT,SAAS;IAAE,YAAY;IAAkB,YAAY;IAAqB,UAAA,OATlD,QAAQ,WAC7B,OAAO;KACN,UAAU,MAAM;KAChB,SAAS,OAAO;KAChB,YAAY;KACZ,YAAY;IACd,CAAC,CAAC,CACD,KAAK,OAAO,QAAQ,uBAAuB,CAAC;GAEoC;EACrF;EACA,IAAI,WAAW,qBAAqB,KAAA,IAAY,qBAAqB,KAAA,IAAY;EAEjF,IAAI,MAAM,uBAAuB,KAAA,KAAa,WAAW,KAAA,GAAW,WAAW;EAC/E,IAAI,WAAW,KAAA,KAAa,eAAe,OAAO,SAAS,YAAY,MAAM,MAAM,GACjF,WAAW;EACb,IAAI,QAAQ,uBAAuB,YAAY,MAAM,uBAAuB,KAAA,GAAW;GACrF,MAAM,IAAI,kBAAkB,OAAO;GAUnC,KACE,OATkB,WAClB,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,WAAW,OAAO,eAAe,CAAC,CAAC,GACrF,OACF,EAAA,CAGO,MAAM,QAAa,QAAQ,WAAW,eAAe,IAAI,QAAQ,WAAW,OAAO,CAAC,GAEzF,WAAW;EACf;EAEA,OAAO;GACL,iBAAiB,OAAO;GACxB,SAAS,OAAO;GAChB;GACA,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO;GACzC,GAAI,qBAAqB,KAAA,IAAY,CAAC,IAAI,EAAE,iBAAiB;GAC7D,GAAI,qBAAqB,KAAA,IAAY,CAAC,IAAI,EAAE,iBAAiB;GAC7D,GAAI,gBACA,EAAE,0BAA0B,iBAAiB,QAAQ,WAAW,iBAAiB,IACjF,CAAC;GACL;EACF;CACF,CAAC;CAED,MAAM,qBAAqB,MAA8B,UAAkC;EACzF,IACE,KAAK,cAAc,MAAM,aACzB,KAAK,qBAAqB,MAAM,oBAChC,KAAK,YAAY,WAAW,MAAM,YAAY,QAE9C,OAAO;EAET,MAAM,WAAW,CAAC,GAAG,KAAK,WAAW,CAAC,CAAC,MAAM,GAAG,MAC9C,EAAE,aAAa,cAAc,EAAE,YAAY,CAC7C;EAEA,MAAM,SAAS,CAAC,GAAG,MAAM,WAAW,CAAC,CAAC,MAAM,GAAG,MAC7C,EAAE,aAAa,cAAc,EAAE,YAAY,CAC7C;EAEA,OAAO,SAAS,OACb,MAAM,UACL,KAAK,iBAAiB,OAAO,MAAM,CAAE,gBACrC,KAAK,aAAa,OAAO,MAAM,CAAE,QACrC;CACF;CAEA,MAAM,gBAAgB,UAAkB,WACtC,GAAG,SAAS,GAAG,WAAW,mBAAmB,mBAAmB;CAElE,MAAM,iBAAiB,WACrB,WAAW,mBAAmB,+BAA+B;CAE/D,MAAM,qBAAqB,OAA6B,WAAwB;EAC9E,MAAM,aAAa,MAAM,WAAW;EACpC,MAAM,UAAU,WAAW;EAE3B,OACE,WAAW,aAAa,aAAa,MAAM,UAAU,MAAM,KAC3D,WAAW,YAAY,cAAc,MAAM,KAC3C,QAAQ,SAAS,sBACjB,eAAe,QAAQ,YAAY,MAAM,MAAM,KAC/C,kBAAkB,QAAQ,UAAU,MAAM,SAAS,QAAQ;CAE/D;CAEA,MAAM,wBAAwB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WACvE,OACA;EACA,MAAM,WAAW,OAAO,+BAA+B,MAAM,cAAc,QAAQ,CAAC,CAAC,KACnF,OAAO,SAAS,WAAW,CAC7B;EAEA,MAAM,cAAc,OAAO,yBAAyB,MAAM,cAAc,WAAW;EAEnF,MAAM,SACJ,MAAM,SAAS,WAAW,KAAA,IACtB,KAAA,IACA,OAAO,wBAAwB,MAAM,SAAS,MAAM;EAE1D,OAAO,OAAO,OAAO;GACnB,GAAG;GACH,QAAQ,OAAO,OAAO,EAAE,GAAG,MAAM,OAAO,CAAC;GACzC,GAAI,MAAM,iBAAiB,KAAA,IACvB,CAAC,IACD,EAAE,cAAc,OAAO,OAAO,EAAE,GAAG,MAAM,aAAa,CAAC,EAAE;GAC7D,UAAU,OAAO,OAAO;IACtB,UAAU,MAAM,SAAS;IACzB,UAAU,sBAAsB,MAAM,SAAS,QAAQ;IACvD,GAAI,MAAM,SAAS,6BAA6B,KAAA,IAC5C,CAAC,IACD,EAAE,0BAA0B,MAAM,SAAS,yBAAyB;IACxE,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO;GAC3C,CAAC;GACD,eAAe,OAAO,OAAO;IAC3B,WAAW,OAAO,OAAO;KACvB,GAAG,MAAM,cAAc;KACvB,QAAQ,OAAO,OAAO,EAAE,GAAG,MAAM,cAAc,UAAU,OAAO,CAAC;KACjE,UAAU,sBAAsB,MAAM,cAAc,UAAU,QAAQ;IACxE,CAAC;IACD;IACA;GACF,CAAC;EACH,CAAC;CACH,CAAC;CAED,MAAM,yBAAyB,OAAO,GAAG,gCAAgC,CAAC,CAAC,WACzE,SACA,eACA,OACA,QACA;EACA,MAAM,mBACJ,WAAW,oBAAoB,MAAM,SAAS,6BAA6B,KAAA;EAE7E,IACE,CAAC,MAAM,SAAS,YAChB,CAAC,kBAAkB,OAAO,MAAM,KAChC,MAAM,cAAc,UAAU,aAAa,MAAM,YACjD,MAAM,cAAc,UAAU,WAAW,UACzC,MAAM,cAAc,UAAU,cAAc,MAAM,aAClD,CAAC,eAAe,MAAM,cAAc,UAAU,QAAQ,MAAM,MAAM,KAClE,MAAM,cAAc,UAAU,uBAAuB,MAAM,SAAS,QAAQ,gBAC5E,CAAC,kBAAkB,MAAM,cAAc,UAAU,UAAU,MAAM,SAAS,QAAQ,KAClF,MAAM,cAAc,UAAU,6BAC5B,MAAM,SAAS,4BAChB,MAAM,cAAc,SAAS,WAAuB,MAAM,aAC3D,MAAM,cAAc,SAAS,kBAAkB,MAAM,cAAc,UAAU,iBAC7E,CAAC,kBAAkB,MAAM,cAAc,SAAS,UAAU,MAAM,SAAS,QAAQ,KAChF,WAAW,oBAAoB,MAAM,SAAS,WAAW,KAAA,KACzD,WAAW,oBAAoB,MAAM,SAAS,WAAW,KAAA,KAC1D,sBAAsB,MAAM,iBAAiB,KAAA,MAC5C,MAAM,cAAc,qBAAqB,eACxC,QAAQ,wBAAwB,4BAElC,OAAO,KAAA;EAET,MAAM,UAAU,OAAO,eACrB,SACA;GACE,UAAU,MAAM;GAChB,WAAW,MAAM,SAAS,SAAS;GACnC,QAAQ,MAAM;GACd,GAAI,MAAM,SAAS,WAAW,KAAA,IAC1B,CAAC,IACD,EAAE,oBAAoB,MAAM,SAAS,OAAO,aAAa;EAC/D,GACA,cAAc,OAChB;EAEA,IACE,YAAY,KAAA,KACZ,CAAC,QAAQ,YACT,CAAC,kBAAkB,QAAQ,UAAU,MAAM,SAAS,QAAQ,KAC5D,QAAQ,6BAA6B,MAAM,SAAS,4BACnD,MAAM,SAAS,WAAW,KAAA,MACxB,QAAQ,WAAW,KAAA,KAClB,QAAQ,OAAO,SAAS,uBAAuB,MAAM,SAAS,OAAO,sBACrE,QAAQ,OAAO,SAAS,uBAAuB,MAAM,SAAS,OAAO,sBACrE,CAAC,eAAe,QAAQ,OAAO,SAAS,YAAY,MAAM,SAAS,OAAO,UAAU,IAExF,OAAO,KAAA;EAET,MAAM,qBAAqB,OAAO,QAAQ,QAAQ,wBAChD,QAAQ,SACR,MACF;EAEA,MAAM,WAAW,OAAO,qBACtB,MAAM,cAAc,UACpB,MAAM,cAAc,WACtB,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;EAEnC,MAAM,aAAa,OAAO,qBACxB,MAAM,cAAc,UACpB,kBACF,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;EAEnC,OAAO,SAAS,aAAa,WAAW,YAAY,UAAU,KAAA;CAChE,CAAC;CAED,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,UACA,WACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,eAAe,OAAO;EAEhC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,IAAI,GAAG,EAAE,UAAU,QAAQ,GAAG,GAAG,EAAE,WAAW,SAAS,CAAC,CAAC,CAAC,CAChE,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,gBAAgB,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAC5D,SACA,OACA,QACA,SACA,WAQA,KACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EACnC,MAAM,IAAI,kBAAkB,OAAO;EACnC,MAAM,IAAI,iBAAiB,OAAO;EAClC,MAAM,IAAI,eAAe,OAAO;EAEhC,MAAM,qBACJ,QAAQ,mBAAmB,QAAQ,WAAW,iBAAiB,UAAU;EAE3E,IAAI,WAAW,kBAAkB;GAC/B,MAAM,SAAS,QAAQ;GAEvB,OAAO,SACJ,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,IACC,QAAQ,WAAW,iBAAiB;IAClC,QAAQ,OAAO,SAAS;IACxB,iBAAiB,UAAU;GAC7B,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,EAAE,WAAW,OAAO,SAAS,WAAW,SAAS,GACpD,GAAG,EAAE,OAAO,OAAO,SAAS,WAAW,KAAK,GAC5C,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,iBAAiB,OAAO,SAAS,kBAAkB,CAC1D,CACF;GACF,OAAO,SACJ,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,IACC,QAAQ,WAAW,iBAAiB;IAClC,QAAQ,OAAO,SAAS;IACxB,oBAAoB,UAAU;GAChC,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,cAAc,OAAO,SAAS,YAAY,GAC/C,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,oBAAoB,OAAO,SAAS,kBAAkB,CAC7D,CACF;GACF,OAAO,SACJ,OAAO,QAAQ,oBAAoB,KAAK,CAAC,CACzC,IAAI,QAAQ,oBAAoB,iBAAiB,UAAU,wBAAwB,CAAC,CAAC,CACrF,MACC,IACE,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,cAAc,OAAO,SAAS,YAAY,GAC/C,GAAG,EAAE,UAAU,OAAO,SAAS,kBAAkB,CACnD,CACF;EACJ;EACA,IAAI,QAAQ,qBAAqB,KAAA,GAC/B,OAAO,SAAS,OAAO,QAAQ,WAAW,KAAK,CAAC,CAAC,OAC/C,QAAQ,WAAW,qBAAqB;GACtC,YAAY,MAAM;GAClB,WAAW,QAAQ;GACnB,kBAAkB;GAClB,iBAAiB,UAAU;EAC7B,CAAC,CACH;OAEA,OAAO,SACJ,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,IACC,QAAQ,WAAW,mBAAmB;GACpC,kBAAkB;GAClB,iBAAiB,UAAU;EAC7B,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,EAAE,WAAW,MAAM,OAAO,SAAS,GACtC,GAAG,EAAE,OAAO,MAAM,OAAO,KAAK,GAC9B,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,iBAAiB,QAAQ,iBAAkB,QAAQ,WAAW,gBAAgB,CACrF,CACF;EAEJ,IAAI,QAAQ,qBAAqB,KAAA,GAAW;GAC1C,OAAO,SAAS,OAAO,QAAQ,WAAW,KAAK,CAAC,CAAC,OAC/C,QAAQ,WAAW,qBAAqB;IACtC,UAAU,MAAM;IAChB,WAAW,QAAQ;IACnB,cAAc;IACd,YAAY,MAAM;IAClB,oBAAoB,UAAU;GAChC,CAAC,CACH;GACA,OAAO,SAAS,OAAO,QAAQ,oBAAoB,KAAK,CAAC,CAAC,OACxD,QAAQ,oBAAoB,aAAa;IACvC,WAAW,QAAQ;IACnB,cAAc;IACd,UAAU,UAAU;GACtB,CAAC,CACH;EACF,OAAO;GACL,MAAM,cAAc,QAAQ,iBAAiB,QAAQ,WAAW;GAEhE,OAAO,SACJ,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,IACC,QAAQ,WAAW,iBAAiB;IAClC,YAAY,MAAM;IAClB,oBAAoB,UAAU;GAChC,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,cAAc,kBAAkB,GACrC,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,oBAAoB,WAAW,CACtC,CACF;GACF,OAAO,SACJ,OAAO,QAAQ,oBAAoB,KAAK,CAAC,CACzC,IAAI,QAAQ,oBAAoB,iBAAiB,UAAU,wBAAwB,CAAC,CAAC,CACrF,MACC,IACE,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,cAAc,kBAAkB,GACrC,GAAG,EAAE,UAAU,WAAW,CAC5B,CACF;EACJ;EACA,OAAO,SACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,IAAI,aAAa,CAAC,CAAC,QAAQ,QAAQ,kBAAkB,UAAU,oBAAoB,CAAC,CAAC,CAAC,CAAC,CACvF,MACC,IACE,GAAG,EAAE,IAAI,QAAQ,eAAe,GAChC,GAAG,EAAE,kBAAkB,MAAM,SAAS,SAAS,gBAAgB,CACjE,CACF;EACF,OAAO,SAAS,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,OAC5C,QAAQ,QAAQ,aAAa;GAC3B,UAAU,MAAM;GAChB,WAAW,MAAM;GACjB;GACA,eAAe,MAAM,cAAc,UAAU;GAC7C,sBAAsB,MAAM,QAAQ;EACtC,CAAC,CACH;EAEA,MAAM,oBACJ,WAAW,mBACP,CAAC,IACD,OAAO,WACL,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,cAAc,QAAQ,OAAQ,SAAS,YAAY,GACxD,GAAG,EAAE,WAAW,QAAQ,eAAe,CACzC,CACF,GACF,KACF;EAEN,MAAM,UAAU,OAAO,gBAAgB,SAAS,MAAM,UAAU,MAAM,MAAM,EAAA,CAAG;EAE/E,MAAM,kBAAkB,OAAO,WAC7B,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,oBAAoB,KAAK,CAAC,CACvC,MACC,IAAI,GAAG,EAAE,WAAW,QAAQ,eAAe,GAAG,GAAG,EAAE,cAAc,kBAAkB,CAAC,CACtF,CAAC,CACA,MAAM,CAAC,GACV,KACF;EAEA,MAAM,UAAU,OAAO,WACrB,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MACC,IACE,GAAG,eAAe,OAAO,CAAC,CAAC,UAAU,MAAM,QAAQ,GACnD,GAAG,eAAe,OAAO,CAAC,CAAC,WAAW,MAAM,SAAS,GACrD,GAAG,eAAe,OAAO,CAAC,CAAC,QAAQ,MAAM,GACzC,GAAG,eAAe,OAAO,CAAC,CAAC,eAAe,MAAM,cAAc,UAAU,aAAa,GACrF,GACE,eAAe,OAAO,CAAC,CAAC,gBACxB,QAAQ,cAAc,MAAM,QAAQ,sBAAsB,CAC5D,CACF,CACF,CAAC,CACA,MAAM,CAAC,GACV,KACF;EAEA,MAAM,mBACJ,WAAW,KAAA,IACP,KAAA,IACA,OAAO,QAAQ,cAAc,OAAO,WAAW,QAAQ,WAAW,WAAW;EAEnF,MAAM,mBACJ,WAAW,mBACP,CAAC,IACD,OAAO,cAAc,SAAS,QAAQ,OAAQ,SAAS,YAAY,KAAK;EAE9E,MAAM,kBACJ,WAAW,mBACP,CAAC,IACD,OAAO,WACL,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,oBAAoB,KAAK,CAAC,CACvC,MACC,IACE,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,cAAc,QAAQ,OAAQ,SAAS,YAAY,CAC1D,CACF,CAAC,CACA,MAAM,CAAC,GACV,KACF;EAEN,OACE,WAAW,KAAA,KACX,QAAQ,UAAU,OAAO,OAAO,QAAQ,QAAQ,QAAQ,KAAK,QAAQ,eAAe,KACpF,QAAQ,QAAQ,eAAe,OAAO,QAAQ,QAAQ,QAAQ,OAAO,KACrE,OAAO,QAAQ,QAAQ,QAAQ,sBAAsB,UAAU,wBAC/D,OAAO,WAAW,QAAQ,WAAW,qBACnC,UAAU,4BACZ,qBAAqB,OACrB,OAAO,WAAW,QAAQ,WAAW,wBACnC,UAAU,4BACZ,OAAO,WAAW,QAAQ,WAAW,kBAAkB,sBACvD,QAAQ,UAAU,OAChB,OAAO,WAAW,QAAQ,WAAW,YACrC,QAAQ,eACV,KACA,QAAQ,WAAW,UAAU,OAAO,UAAU,KAC9C,QAAQ,WAAW,eAAe,OAAO,WAAW,QAAQ,WAAW,OAAO,KAC9E,gBAAgB,WAAW,KAC3B,gBAAgB,EAAE,CAAE,QAAQ,oBAAoB,cAC9C,UAAU,4BACZ,QAAQ,oBAAoB,eAC1B,gBAAgB,EAAE,CAAE,QAAQ,oBAAoB,OAClD,KACA,QAAQ,WAAW,MAClB,WAAW,oBACT,kBAAkB,WAAW,KAC5B,kBAAkB,EAAE,CAAE,QAAQ,WAAW,wBACvC,UAAU,4BACZ,CAAC,QAAQ,WAAW,eAAe,kBAAkB,EAAE,CAAE,QAAQ,WAAW,OAAO,KACnF,iBAAiB,WAAW,KAC5B,QAAQ,UAAU,OAChB,iBAAiB,EAAE,CAAE,QAAQ,WAAW,YACxC,QAAQ,eACV,KACA,iBAAiB,EAAE,CAAE,QAAQ,WAAW,qBACtC,UAAU,4BACZ,CAAC,QAAQ,WAAW,UAAU,iBAAiB,EAAG,KAClD,gBAAgB,WAAW,KAC3B,gBAAgB,EAAE,CAAE,QAAQ,oBAAoB,cAC9C,UAAU,4BACZ,CAAC,QAAQ,oBAAoB,eAC3B,gBAAgB,EAAE,CAAE,QAAQ,oBAAoB,OAClD;CAER,CAAC;CAED,MAAM,uBAAuB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACrE,eACA,OACA;EACA,MAAM,WAAW,OAAO;EAExB,IAAI,cAAc,UAAU,KAAA,GAAW,OAAO,OAAO,OAAO,KAAK,YAAY,CAAC;EAC9E,MAAM,aAAa,EAAE,MAAM,4BAA4B;EAEvD,MAAM,OAAO;GACX;GACA,UACE,UACA,SACA,YACG,QAAQ,QAAQ,QAAQ,QAAQ,CAAC;EACxC;EAkBA,OAAO,OAhBO,uBAEV,SAAS,aAAa,gBACpB,oBACE,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MACA,OAAO,KAAK,UAAU,SAChB,KACR,CAAC,CAAC,KACA,OAAO,eAAe,iBAAiB,WAA0C,CACnF,CACF,GACF,EAAE,MAAM,cAAc,KAAK,CAGX,CAAC,CAAC,KAClB,OAAO,GAAG,KAAK,GACf,OAAO,YAAY,UAAU;GAC3B,MAAM,SAAS,MAAM,QAAQ;GAE7B,OAAO,MAAM,QAAQ,WAAW,KAC9B,WAAW,KAAA,KACX,MAAM,aAAa,MAAM,KACzB,OAAO,UAAU,aACf,OAAO,QAAQ,IAAI,IACnB,OAAO,UAAU,KAAK;EAC5B,CAAC,CACH;CACF,CAAC;CAED,MAAM,kBAAkB,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,eACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,OAAO,OAAO,MACZ,UACA,eACA,OAAO,IAAI,aAAa;GACtB,MAAM,UAAU,OAAO;GAEvB,OAAO,OAAO,OAAO,QAAQ,QAAQ,YAAY,OAAO,CAAC;EAC3D,CAAC,CACH;CACF,CAAC;CAED,MAAM,iCAAiC,OAAO,GAAG,gCAAgC,CAAC,CAAC,WACjF,UACA,SACA,eAC6E;EAC7E,MAAM,QAAQ,OAAO;EAErB,OAAO,wBAAwB,GAAG;GAChC,SAAS,WACN,wBAAwB,OAAO,IAC5B,SACE,UACA,eACA,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO,eAAe,SAAS,OAAO,cAAc,OAAO;IAE3E,IAAI,YAAY,KAAA,GAAW,OAAO,OAAO,YAAY;IAErD,OAAO,OAAO,OAAO;KACnB,UAAU,sBAAsB,QAAQ,QAAQ;KAChD,UAAU,QAAQ;KAClB,GAAI,QAAQ,6BAA6B,KAAA,IACrC,CAAC,IACD,EAAE,0BAA0B,QAAQ,yBAAyB;KACjE,GAAI,QAAQ,WAAW,KAAA,IACnB,CAAC,IACD,EAAE,QAAQ,OAAO,wBAAwB,QAAQ,OAAO,QAAQ,EAAE;IACxE,CAAC;GACH,CAAC,CACH,IACA,OAAO,KAAK,YAAY,CAAC,EAAA,CAC3B,KACA,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,kBAAkB,UAAU;IAC1B,IAAI,cAAc,UAAU,KAAA,KAAa,MAAM,QAAQ,SAAS,oBAC9D,OAAO,OAAO,QAAQ,KAAK,CAAC,CAAC,KAC3B,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;IACF,MAAM,UAAU,MAAM;IAEtB,OAAO,SACL,UACA,eACA,OAAO,IAAI,aAAa;KACtB,MAAM,SACJ,MAAM,SAAS,SAAS,iBAAiB,KACzC,MAAM,YAAY,+BACd,mBACA,MAAM,SAAS,SAAS,iBAAiB,KACvC,MAAM,YAAY,yBAClB,mBACA,KAAA;KAER,IAAI,WAAW,KAAA,GAAW,OAAO;KACjC,MAAM,WAAW,MAAM,SAAS,MAAM,GAAG,CAAC,IAAI,SAAS,MAAM;KAE7D,MAAM,UAAU,OAAO,eACrB,SACA;MACE;MACA,WAAW,QAAQ,SAAS;MAC5B,QAAQ,QAAQ;KAClB,GACA,KACF;KAEA,OAAO,YAAY,KAAA,KAAa,kBAAkB,QAAQ,UAAU,QAAQ,QAAQ;IACtF,CAAC,CACH,CAAC,CACE,KACC,OAAO,SAAS,YACd,UAAU,qBAAqB,eAAe,KAAK,IAAI,OAAO,QAAQ,KAAK,CAC7E,CACF,CAAC,CACA,KACC,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACJ;GACA,kBAAkB,YAAY,YAC5B,cAAc,SAAS,eAAe,YAAY,kBAAkB,OAAO,CAAC,CAAC,KAC3E,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,kBAAkB,YAAY,YAC5B,cAAc,SAAS,eAAe,YAAY,kBAAkB,OAAO,CAAC,CAAC,KAC3E,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,UAAU,OAAO,YACf,MACE,UACA,eACA,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IAEvB,MAAM,IAAI,eAAe,OAAO;IAChC,MAAM,MAAM,OAAO;IAEnB,MAAM,OAAO,OAAO,WAClB,YACG,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAClC,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,IAAI,EAAE,gBAAgB,QAAQ,cAAc,GAAG,CAAC,CAClD,CACF,CAAC,CACA,MAAM,MAAM,QAAQ,CAAC,GACxB,cAAc,OAChB;IAEA,MAAM,WAAW,KAAK,MAAM,GAAG,MAAM,KAAK;IAE1C,MAAM,UAAU,QACd;KAAE,SAAS,SAAS;KAAQ,SAAS,KAAK,SAAS,MAAM;IAAM,GAC/D,OACF;IAEA,IAAI,SAAS,SAAS,GACpB,OAAO,YAAY,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,MAC/C,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,QACE,EAAE,WACF,SAAS,KAAK,QAAa,IAAI,SAAS,CAC1C,GACA,IAAI,EAAE,gBAAgB,QAAQ,cAAc,GAAG,CAAC,CAClD,CACF;IAEF,OAAO;GACT,CAAC,CACH,CAAC,CAAC,KACA,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACJ,CAAC;CACH,CAAC;CAED,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,eACA,YACA,QACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,IAAI,CAAC,wBAAwB,OAAO,KAAK,cAAc,UAAU,KAAA,GAC/D,OAAO,OAAO,YAAY;EAC5B,MAAM,QAAQ,OAAO,sBAAsB,UAAU;EAErD,MAAM,qBAAqB,OAAO,SAChC,cAAc,MACd,QAAQ,sBACR,QAAQ,wBACV;EAEA,MAAM,2BAA2B,OAAO,SACtC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;EAEA,MAAM,2BAA2B,OAAO,SACtC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;EAEA,MAAM,2BAA2B,OAAO,SACtC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;EAEA,MAAM,2BAA2B,OAAO,SACtC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;EAEA,MAAM,mBACJ,WAAW,oBAAoB,MAAM,SAAS,6BAA6B,KAAA;EAE7E,MAAM,eAAe,mBACjB,MAAM,SAAS,SAAS,mBACxB,OAAO,qBACL,SACA,cAAc,MACd,MAAM,SAAS,SAAS,gBAC1B;EAEJ,IACG,CAAC,oBAAoB,iBAAiB,MAAM,SAAS,SAAS,oBAC/D;GACE;GACA;GACA;GACA;EACF,CAAC,CAAC,MAAM,UAAU,MAAM,SAAS,SAAS,YAAY,MAAM,SAAS,KAAK,aAAa,KAAK,CAAC,GAE7F,OAAO,OAAO,YAAY;EAsE5B,OAAO,OApEK,MACV,UACA,eACA,OAAO,IAAI,aAAa;GACtB,MAAM,UAAU,OAAO;GAEvB,MAAM,UAAU,OAAO,uBAAuB,SAAS,eAAe,OAAO,MAAM;GAEnF,IAAI,YAAY,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;GAC7D,KACG,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,WAAW,cAAc,OAAO,EAAA,CAClF,SAAS,GAEZ,OAAO,QAAQ,YAAY,OAAO;GACpC,IAAI;GAEJ,OAAO,oBACL,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MAAM,YACN,OAAO,IAAI,aAAa;IAGtB,MAAM,qBAAqB,OAAO,QAAQ,QAAQ,wBAChD,QAAQ,SACR,MACF;IAEA,MAAM,WAAW,OAAO,qBACtB,MAAM,cAAc,UACpB,MAAM,cAAc,WACtB,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;IAEnC,MAAM,aAAa,OAAO,qBACxB,MAAM,cAAc,UACpB,kBACF,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;IAEnC,IAAI,CAAC,SAAS,aAAa,CAAC,WAAW,WAAW,OAAO;IACzD,MAAM,MAAM,OAAO;IAEnB,OAAO,OAAO,cACZ,SACA,OACA,QACA,SACA;KACE;KACA;KACA;KACA;KACA;KACA,sBAAsB;IACxB,GACA,GACF;GACF,CAAC,IACA,aAAa;IACZ,UAAU,QAAQ,aAAa,cAAc,YAAY,YAAY,OAAO;IAE5E,OAAO;GACT,CACF;GAEA,OAAO,WAAW,QAAQ,YAAY,OAAO;EAC/C,CAAC,CAGa,CAAC,CAAC,KAChB,OAAO,YAAY,UAChB,MAAM,QAAQ,MAAM,MAAM,YAAY,KACrC,2BAA2B,QAAQ,mBAAmB,KAAK,KAC5D,MAAM,QAAQ,MAAM,MAAM,YAAY,KACrC,2BAA2B,QAAQ,sBAAsB,KAAK,KAC/D,MAAM,QAAQ,MAAM,MAAM,YAAY,KACrC,2BAA2B,QAAQ,sBAAsB,KAAK,IAC5D,gBAAgB,eAAe,OAAO,IACtC,OAAO,UAAU,KAAK,CAC5B,CACF;CACF,CAAC;CAED,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF"}
+{"version":3,"file":"email-kernel.mjs","names":[],"sources":["../../src/internal/email-kernel.ts"],"sourcesContent":["import {\n  EmailAddressPersistence,\n  type EmailAddressMutation,\n  type EmailAction,\n  type EmailCredentialSnapshot,\n  EmailSignInTargets,\n  EmailUnavailable,\n  snapshotEmailCredential,\n  snapshotEmailRequirement,\n  snapshotEmailRevision,\n} from \"@yielded/auth/Email\";\nimport {\n  coordinateCommit,\n  CurrentCommitJournal,\n  hasCommitScope,\n  type CommitJournal,\n  type PreparedCommit,\n  LifecycleHooks,\n  HookConfigurationError,\n} from \"@yielded/auth/Hooks\";\nimport type { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport { reportPersistenceFailure } from \"@yielded/auth/Persistence\";\nimport {\n  ProofUnavailable,\n  type ProofCompletionDecision,\n  type ProofCompletionInput,\n} from \"@yielded/auth/Proofs\";\nimport {\n  assessAuthentication,\n  snapshotAuthenticationEvidence,\n  type AuthenticationRevision,\n  type SecurityRevision,\n} from \"@yielded/auth/Sessions\";\nimport { Cause, Context, DateTime, Effect, Option, Schema } from \"effect\";\nimport type * as SqlError from \"effect/sql/SqlError\";\n\nimport { isMappedConstraintConflict, PersistenceMappingError } from \"./mapping-error\";\nimport {\n  type AnyEmailAddressMapping,\n  type AnyEmailSignInMapping,\n  requiredEmailAddressConstraints,\n  requiredEmailSignInConstraints,\n} from \"./models/email-model\";\nimport {\n  CurrentProofSql,\n  type makeProofKernel,\n  type ProofSqlConfiguration,\n  type ProofSqlDatabase,\n} from \"./proof-kernel\";\n/* oxlint-disable no-explicit-any -- the shared dialect kernel erases consumer Drizzle table types internally. */\nimport type { QueryFailure } from \"./query-operations\";\nimport type { QueryOperations, SqlFragment, SqlColumn } from \"./query-operations\";\n\ntype AdapterFailure = QueryFailure | PersistenceMappingError | SqlError.SqlError;\ntype SignInMapping = AnyEmailSignInMapping;\n\nexport interface EmailSqlQuery<A = ReadonlyArray<any>> extends Effect.Effect<A, AdapterFailure> {\n  readonly getSQL: () => ReturnType<QueryOperations[\"sql\"]>;\n  readonly from: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly where: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly limit: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly orderBy: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly for: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly set: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly values: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly returning: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly innerJoin: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly onConflictDoNothing: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly onDuplicateKeyUpdate: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly $returningId: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n}\n\nexport interface EmailSqlDatabase {\n  readonly select: (...args: ReadonlyArray<any>) => EmailSqlQuery;\n  readonly insert: (...args: ReadonlyArray<any>) => EmailSqlQuery;\n  readonly update: (...args: ReadonlyArray<any>) => EmailSqlQuery;\n  readonly delete: (...args: ReadonlyArray<any>) => EmailSqlQuery;\n  readonly transaction: <A, E, R>(\n    body: (transaction: EmailSqlDatabase) => Effect.Effect<A, E, R>,\n  ) => Effect.Effect<A, E | SqlError.SqlError, R>;\n}\n\nexport class CurrentEmailSql extends Context.Service<CurrentEmailSql, EmailSqlDatabase>()(\n  \"effect-auth/CurrentEmailSql\",\n) {}\n\nexport interface EmailSqlConfiguration {\n  readonly mode: \"interactive\" | \"synchronous\";\n  readonly locking: boolean;\n  readonly standaloneGuard: Effect.Effect<void, EmailUnavailable>;\n  readonly coordinated?: boolean;\n  readonly proof?: {\n    readonly mapping: any;\n    readonly configuration: ProofSqlConfiguration;\n  };\n}\n\nexport interface CurrentAddress {\n  readonly nativeSubjectId: unknown;\n  readonly subject: any;\n  readonly revision: AuthenticationRevision;\n  readonly source?: {\n    readonly credential: any;\n    readonly identifier: any;\n    readonly snapshot: EmailCredentialSnapshot;\n  };\n  readonly targetIdentifier?: any;\n  readonly targetCredential?: any;\n  readonly targetIdentifierRevision?: SecurityRevision;\n  readonly eligible: boolean;\n}\n\nexport const makeEmailKernel = <\n  Fragment extends SqlFragment = SqlFragment,\n  Column extends SqlColumn = SqlColumn,\n>(\n  operations: QueryOperations<Fragment, Column>,\n  proofs: Pick<ReturnType<typeof makeProofKernel>, \"completeProofPlanIn\">,\n) => {\n  type AddressMapping = AnyEmailAddressMapping<Fragment>;\n\n  const { and, eq, inArray, lte, column, updateValues } = operations;\n  const { completeProofPlanIn } = proofs;\n  const unavailable = () => EmailUnavailable.make({});\n\n  const translateFailure = <A, E, R>(\n    effect: Effect.Effect<A, E, R>,\n  ): Effect.Effect<A, EmailUnavailable, R> =>\n    reportPersistenceFailure(\n      effect,\n      (error) =>\n        Schema.is(EmailUnavailable)(error) ||\n        Schema.is(ProofUnavailable)(error) ||\n        Schema.is(HookConfigurationError)(error),\n    ).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));\n\n  const nowMillis = Effect.map(DateTime.now, DateTime.toEpochMillis);\n\n  const selectRows = (query: EmailSqlQuery, locking: boolean) =>\n    locking && typeof query.for === \"function\" ? query.for(\"update\") : query;\n\n  const sameIdentifier = (left: LoginIdentifier, right: LoginIdentifier) =>\n    left.namespace === right.namespace && left.value === right.value;\n\n  const validEmailSignInConstraints = (mapping: SignInMapping) =>\n    Object.entries(requiredEmailSignInConstraints).every(\n      ([key, value]) =>\n        mapping.constraints[key as keyof typeof requiredEmailSignInConstraints] === value,\n    );\n\n  const validAddressConstraints = (mapping: AddressMapping) =>\n    Object.entries(requiredEmailAddressConstraints).every(\n      ([key, value]) =>\n        mapping.constraints[key as keyof typeof requiredEmailAddressConstraints] === value,\n    );\n\n  const subjectColumns = (mapping: SignInMapping) => ({\n    id: column(mapping.subject.table, mapping.subject.id),\n    status: column(mapping.subject.table, mapping.subject.status),\n    securityRevision: column(mapping.subject.table, mapping.subject.securityRevision),\n  });\n\n  const identifierColumns = (mapping: SignInMapping) => ({\n    namespace: column(mapping.identifier.table, mapping.identifier.namespace),\n    value: column(mapping.identifier.table, mapping.identifier.value),\n    subjectId: column(mapping.identifier.table, mapping.identifier.subjectId),\n    verifiedAt: column(mapping.identifier.table, mapping.identifier.verifiedAt),\n    bindingRevision: column(mapping.identifier.table, mapping.identifier.bindingRevision),\n  });\n\n  const credentialColumns = (mapping: SignInMapping) => ({\n    moduleId: column(mapping.credential.table, mapping.credential.moduleId),\n    subjectId: column(mapping.credential.table, mapping.credential.subjectId),\n    credentialId: column(mapping.credential.table, mapping.credential.credentialId),\n    identifierNamespace: column(mapping.credential.table, mapping.credential.identifierNamespace),\n    identifierValue: column(mapping.credential.table, mapping.credential.identifierValue),\n    credentialRevision: column(mapping.credential.table, mapping.credential.credentialRevision),\n    status: column(mapping.credential.table, mapping.credential.status),\n  });\n\n  const authorityColumns = (mapping: AddressMapping) => ({\n    subjectId: column(mapping.authorityCredential.table, mapping.authorityCredential.subjectId),\n    credentialId: column(\n      mapping.authorityCredential.table,\n      mapping.authorityCredential.credentialId,\n    ),\n    revision: column(mapping.authorityCredential.table, mapping.authorityCredential.revision),\n    status: column(mapping.authorityCredential.table, mapping.authorityCredential.status),\n  });\n\n  const commandColumns = (mapping: AddressMapping) => ({\n    moduleId: column(mapping.command.table, mapping.command.moduleId),\n    commandId: column(mapping.command.table, mapping.command.commandId),\n    action: column(mapping.command.table, mapping.command.action),\n    bindingDigest: column(mapping.command.table, mapping.command.bindingDigest),\n    retentionUntil: column(mapping.command.table, mapping.command.retentionUntil),\n  });\n\n  const allocate = <A>(\n    mode: EmailSqlConfiguration[\"mode\"],\n    asynchronous: Effect.Effect<A, PersistenceMappingError> | undefined,\n    synchronous: (() => A) | undefined,\n  ) => {\n    if (mode === \"synchronous\")\n      return synchronous === undefined\n        ? Effect.fail(unavailable())\n        : Effect.try({\n            try: synchronous,\n            catch: (cause) => new PersistenceMappingError({ operation: \"mapping\", cause }),\n          });\n    if (asynchronous !== undefined) return asynchronous;\n\n    return synchronous === undefined\n      ? Effect.fail(unavailable())\n      : Effect.try({\n          try: synchronous,\n          catch: (cause) => new PersistenceMappingError({ operation: \"mapping\", cause }),\n        });\n  };\n\n  const nextSecurityRevision = (\n    mapping: AddressMapping,\n    mode: EmailSqlConfiguration[\"mode\"],\n    current: SecurityRevision,\n  ) => {\n    if (mode === \"synchronous\")\n      return mapping.subject.nextSecurityRevisionSync === undefined\n        ? Effect.fail(unavailable())\n        : Effect.try({\n            try: () => mapping.subject.nextSecurityRevisionSync!(current),\n            catch: (cause) => new PersistenceMappingError({ operation: \"mapping\", cause }),\n          });\n    if (mapping.subject.nextSecurityRevision !== undefined)\n      return mapping.subject.nextSecurityRevision(current);\n    if (mapping.subject.nextSecurityRevisionSync !== undefined)\n      return Effect.try({\n        try: () => mapping.subject.nextSecurityRevisionSync!(current),\n        catch: (cause) => new PersistenceMappingError({ operation: \"mapping\", cause }),\n      });\n\n    return Effect.fail(unavailable());\n  };\n\n  const safeRead = <A, E, R>(\n    database: EmailSqlDatabase,\n    configuration: EmailSqlConfiguration,\n    body: Effect.Effect<A, E, R>,\n  ) =>\n    Effect.gen(function* () {\n      if (configuration.coordinated !== true) {\n        if (yield* hasCommitScope) return yield* unavailable();\n        yield* configuration.standaloneGuard;\n      }\n\n      return yield* database.transaction((transaction) =>\n        body.pipe(\n          Effect.provideService(CurrentEmailSql, transaction),\n          Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),\n        ),\n      );\n    });\n\n  const owned = <A, E, R>(\n    database: EmailSqlDatabase,\n    configuration: EmailSqlConfiguration,\n    body: Effect.Effect<A, E, R>,\n  ) => {\n    const run = coordinateCommit(\n      () =>\n        database.transaction((transaction) =>\n          body.pipe(\n            Effect.provideService(CurrentEmailSql, transaction),\n            Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),\n          ),\n        ),\n      { mode: configuration.mode },\n    ).pipe(Effect.map((result) => result.value));\n\n    return configuration.coordinated !== true\n      ? Effect.gen(function* () {\n          if (yield* hasCommitScope) return yield* unavailable();\n          yield* configuration.standaloneGuard;\n\n          return yield* run;\n        })\n      : run;\n  };\n\n  const emailLookupQuery = (\n    mapping: SignInMapping,\n    moduleId: string,\n    identifier: LoginIdentifier,\n  ) => {\n    const subject = subjectColumns(mapping),\n      binding = identifierColumns(mapping),\n      credential = credentialColumns(mapping);\n\n    return {\n      fields: {\n        subject: mapping.subject.table,\n        identifier: mapping.identifier.table,\n        credential: mapping.credential.table,\n      },\n      from: mapping.identifier.table,\n      subjectTable: mapping.subject.table,\n      subjectJoin: eq(subject.id, binding.subjectId),\n      credentialTable: mapping.credential.table,\n      credentialJoin: and(\n        eq(credential.moduleId, moduleId),\n        eq(credential.subjectId, binding.subjectId),\n        eq(credential.identifierNamespace, binding.namespace),\n        eq(credential.identifierValue, binding.value),\n      ),\n      predicate: and(\n        eq(binding.namespace, identifier.namespace),\n        eq(binding.value, identifier.value),\n      ),\n      limit: 1,\n    };\n  };\n\n  const emailLookupRows = Effect.fn(\"Drizzle.emailLookupRows\")(function* (\n    mapping: SignInMapping,\n    moduleId: string,\n    identifier: LoginIdentifier,\n  ) {\n    const database = yield* CurrentEmailSql;\n    const query = emailLookupQuery(mapping, moduleId, identifier);\n\n    return yield* database\n      .select(query.fields)\n      .from(query.from)\n      .innerJoin(query.subjectTable, query.subjectJoin)\n      .innerJoin(query.credentialTable, query.credentialJoin)\n      .where(query.predicate)\n      .limit(query.limit);\n  });\n\n  const decodeEmailSnapshot = Effect.fn(\"DrizzleEmail.decodeSnapshot\")(function* (\n    mapping: SignInMapping,\n    moduleId: string,\n    requested: LoginIdentifier,\n    row: any,\n  ) {\n    if (\n      !mapping.subject.isActiveStatus(row.subject[mapping.subject.status]) ||\n      !mapping.identifier.isCurrent(row.identifier) ||\n      !mapping.credential.isActiveStatus(row.credential[mapping.credential.status])\n    )\n      return undefined;\n\n    const snapshot = yield* mapping.credential\n      .decode({\n        moduleId,\n        subject: row.subject,\n        identifier: row.identifier,\n        credential: row.credential,\n      })\n      .pipe(Effect.flatMap(snapshotEmailCredential));\n\n    const subjectId = yield* mapping.subjectId.toSubject(row.subject[mapping.subject.id]);\n\n    const verifiedAtMillis = yield* mapping.decodeInstant(\n      row.identifier[mapping.identifier.verifiedAt],\n    );\n\n    if (\n      snapshot.moduleId !== moduleId ||\n      !sameIdentifier(snapshot.identifier, requested) ||\n      snapshot.revision.subjectId !== subjectId ||\n      snapshot.revision.securityRevision !== row.subject[mapping.subject.securityRevision] ||\n      snapshot.identifierRevision !== row.identifier[mapping.identifier.bindingRevision] ||\n      snapshot.verifiedAtMillis !== verifiedAtMillis ||\n      snapshot.credentialId !== row.credential[mapping.credential.credentialId] ||\n      snapshot.credentialRevision !== row.credential[mapping.credential.credentialRevision]\n    )\n      return undefined;\n\n    return snapshot;\n  });\n\n  const makeSqlEmailSignInTargets = Effect.fn(\"makeSqlEmailSignInTargets\")(function* (\n    mapping: SignInMapping,\n    configuration: EmailSqlConfiguration,\n  ): Effect.fn.Return<EmailSignInTargets[\"Service\"], never, CurrentEmailSql> {\n    const database = yield* CurrentEmailSql;\n\n    return EmailSignInTargets.of({\n      lookup: (input) =>\n        (validEmailSignInConstraints(mapping)\n          ? safeRead(\n              database,\n              configuration,\n              Effect.gen(function* () {\n                const row = (yield* emailLookupRows(mapping, input.moduleId, input.identifier))[0];\n\n                if (row === undefined) return Option.none();\n\n                const snapshot = yield* decodeEmailSnapshot(\n                  mapping,\n                  input.moduleId,\n                  input.identifier,\n                  row,\n                );\n\n                return snapshot === undefined ? Option.none() : Option.some(snapshot);\n              }),\n            )\n          : Effect.fail(unavailable())\n        ).pipe(Effect.provideService(CurrentEmailSql, database), translateFailure),\n    });\n  });\n\n  const readSubject = Effect.fn(\"DrizzleEmail.readSubject\")(function* (\n    mapping: AddressMapping,\n    subjectId: string,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentEmailSql;\n\n    const nativeSubjectId = yield* mapping.subjectId.toNative(subjectId as any);\n    const s = subjectColumns(mapping);\n\n    const subject = (yield* selectRows(\n      database.select().from(mapping.subject.table).where(eq(s.id, nativeSubjectId)).limit(1),\n      locking,\n    ))[0];\n\n    return { nativeSubjectId, subject };\n  });\n\n  const identifierRow = Effect.fn(\"Drizzle.identifierRow\")(function* (\n    mapping: SignInMapping,\n    identifier: LoginIdentifier,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentEmailSql;\n\n    const i = identifierColumns(mapping);\n\n    return yield* selectRows(\n      database\n        .select()\n        .from(mapping.identifier.table)\n        .where(and(eq(i.namespace, identifier.namespace), eq(i.value, identifier.value)))\n        .limit(1),\n      locking,\n    );\n  });\n\n  const credentialById = Effect.fn(\"Drizzle.credentialById\")(function* (\n    mapping: SignInMapping,\n    moduleId: string,\n    credentialId: string,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentEmailSql;\n\n    const c = credentialColumns(mapping);\n\n    return yield* selectRows(\n      database\n        .select()\n        .from(mapping.credential.table)\n        .where(and(eq(c.moduleId, moduleId), eq(c.credentialId, credentialId)))\n        .limit(1),\n      locking,\n    );\n  });\n\n  const credentialByIdentifier = Effect.fn(\"Drizzle.credentialByIdentifier\")(function* (\n    mapping: SignInMapping,\n    moduleId: string,\n    identifier: LoginIdentifier,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentEmailSql;\n\n    const c = credentialColumns(mapping);\n\n    return yield* selectRows(\n      database\n        .select()\n        .from(mapping.credential.table)\n        .where(\n          and(\n            eq(c.moduleId, moduleId),\n            eq(c.identifierNamespace, identifier.namespace),\n            eq(c.identifierValue, identifier.value),\n          ),\n        )\n        .limit(1),\n      locking,\n    );\n  });\n\n  const currentAddress = Effect.fn(\"DrizzleEmail.currentAddress\")(function* (\n    mapping: AddressMapping,\n    input: {\n      readonly moduleId: string;\n      readonly subjectId: string;\n      readonly target: LoginIdentifier;\n      readonly sourceCredentialId?: string;\n    },\n    locking: boolean,\n  ) {\n    const database = yield* CurrentEmailSql;\n\n    const locked = yield* readSubject(mapping, input.subjectId, locking);\n\n    if (\n      locked.subject === undefined ||\n      !mapping.subject.isActiveStatus(locked.subject[mapping.subject.status])\n    )\n      return undefined;\n\n    const discoveredSource =\n      input.sourceCredentialId === undefined\n        ? undefined\n        : (yield* credentialById(mapping, input.moduleId, input.sourceCredentialId, false))[0];\n\n    const sourceIdentifier: LoginIdentifier | undefined =\n      discoveredSource === undefined\n        ? undefined\n        : {\n            namespace: discoveredSource[mapping.credential.identifierNamespace],\n            value: discoveredSource[mapping.credential.identifierValue],\n          };\n\n    const identifiers = [\n      input.target,\n      ...(sourceIdentifier === undefined ? [] : [sourceIdentifier]),\n    ]\n      .filter(\n        (value, index, values) =>\n          values.findIndex((candidate) => sameIdentifier(candidate, value)) === index,\n      )\n      .sort((left, right) =>\n        `${left.namespace}\\u0000${left.value}`.localeCompare(\n          `${right.namespace}\\u0000${right.value}`,\n        ),\n      );\n\n    const lockedIdentifiers = new Map<string, any>();\n\n    for (const identifier of identifiers) {\n      const row = (yield* identifierRow(mapping, identifier, locking))[0];\n\n      if (row !== undefined)\n        lockedIdentifiers.set(`${identifier.namespace}\\u0000${identifier.value}`, row);\n    }\n\n    const sourceCredential =\n      input.sourceCredentialId === undefined\n        ? undefined\n        : (yield* credentialById(mapping, input.moduleId, input.sourceCredentialId, locking))[0];\n\n    const targetCredential = (yield* credentialByIdentifier(\n      mapping,\n      input.moduleId,\n      input.target,\n      locking,\n    ))[0];\n\n    const a = authorityColumns(mapping);\n\n    const authority = yield* selectRows(\n      database\n        .select()\n        .from(mapping.authorityCredential.table)\n        .where(eq(a.subjectId, locked.nativeSubjectId))\n        .orderBy(a.credentialId),\n      locking,\n    );\n\n    const activeAuthority = authority.filter((row: any) =>\n      mapping.authorityCredential.isActiveStatus(row[mapping.authorityCredential.status]),\n    );\n\n    const subjectId = yield* mapping.subjectId.toSubject(locked.nativeSubjectId);\n\n    const revision: AuthenticationRevision = Object.freeze({\n      subjectId,\n      securityRevision: locked.subject[mapping.subject.securityRevision],\n      credentials: Object.freeze(\n        activeAuthority.map((row: any) =>\n          Object.freeze({\n            credentialId: row[mapping.authorityCredential.credentialId],\n            revision: row[mapping.authorityCredential.revision],\n          }),\n        ),\n      ),\n    });\n\n    const targetIdentifier = lockedIdentifiers.get(\n      `${input.target.namespace}\\u0000${input.target.value}`,\n    );\n\n    const targetOwned =\n      targetIdentifier !== undefined &&\n      mapping.subjectId.equals(\n        targetIdentifier[mapping.identifier.subjectId],\n        locked.nativeSubjectId,\n      );\n\n    const targetMutable =\n      targetOwned &&\n      mapping.identifier.isMutableTarget(targetIdentifier) &&\n      (targetCredential === undefined ||\n        (!mapping.credential.isActiveStatus(targetCredential[mapping.credential.status]) &&\n          mapping.subjectId.equals(\n            targetCredential[mapping.credential.subjectId],\n            locked.nativeSubjectId,\n          )));\n\n    let source: CurrentAddress[\"source\"];\n\n    if (input.sourceCredentialId !== undefined) {\n      if (\n        sourceCredential === undefined ||\n        sourceIdentifier === undefined ||\n        !mapping.subjectId.equals(\n          sourceCredential[mapping.credential.subjectId],\n          locked.nativeSubjectId,\n        ) ||\n        !mapping.credential.isActiveStatus(sourceCredential[mapping.credential.status])\n      )\n        return undefined;\n\n      const sourceIdentifierRow = lockedIdentifiers.get(\n        `${sourceIdentifier.namespace}\\u0000${sourceIdentifier.value}`,\n      );\n\n      if (\n        sourceIdentifierRow === undefined ||\n        !mapping.identifier.isCurrent(sourceIdentifierRow) ||\n        !mapping.subjectId.equals(\n          sourceIdentifierRow[mapping.identifier.subjectId],\n          locked.nativeSubjectId,\n        )\n      )\n        return undefined;\n\n      const snapshot = yield* mapping.credential\n        .decode({\n          moduleId: input.moduleId,\n          subject: locked.subject,\n          identifier: sourceIdentifierRow,\n          credential: sourceCredential,\n        })\n        .pipe(Effect.flatMap(snapshotEmailCredential));\n\n      source = { credential: sourceCredential, identifier: sourceIdentifierRow, snapshot };\n    }\n    let eligible = targetIdentifier === undefined ? targetCredential === undefined : targetMutable;\n\n    if (input.sourceCredentialId !== undefined && source === undefined) eligible = false;\n    if (source !== undefined && sameIdentifier(source.snapshot.identifier, input.target))\n      eligible = false;\n    if (mapping.addressCardinality === \"single\" && input.sourceCredentialId === undefined) {\n      const c = credentialColumns(mapping);\n\n      const rows = yield* selectRows(\n        database\n          .select()\n          .from(mapping.credential.table)\n          .where(and(eq(c.moduleId, input.moduleId), eq(c.subjectId, locked.nativeSubjectId))),\n        locking,\n      );\n\n      if (\n        rows.some((row: any) => mapping.credential.isActiveStatus(row[mapping.credential.status]))\n      )\n        eligible = false;\n    }\n\n    return {\n      nativeSubjectId: locked.nativeSubjectId,\n      subject: locked.subject,\n      revision,\n      ...(source === undefined ? {} : { source }),\n      ...(targetIdentifier === undefined ? {} : { targetIdentifier }),\n      ...(targetCredential === undefined ? {} : { targetCredential }),\n      ...(targetMutable\n        ? { targetIdentifierRevision: targetIdentifier[mapping.identifier.bindingRevision] }\n        : {}),\n      eligible,\n    };\n  });\n\n  const sameEmailRevision = (left: AuthenticationRevision, right: AuthenticationRevision) => {\n    if (\n      left.subjectId !== right.subjectId ||\n      left.securityRevision !== right.securityRevision ||\n      left.credentials.length !== right.credentials.length\n    )\n      return false;\n\n    const expected = [...left.credentials].sort((a, b) =>\n      a.credentialId.localeCompare(b.credentialId),\n    );\n\n    const actual = [...right.credentials].sort((a, b) =>\n      a.credentialId.localeCompare(b.credentialId),\n    );\n\n    return expected.every(\n      (item, index) =>\n        item.credentialId === actual[index]!.credentialId &&\n        item.revision === actual[index]!.revision,\n    );\n  };\n\n  const actionModule = (moduleId: string, action: EmailAction) =>\n    `${moduleId}/${action === \"verify-address\" ? \"verify-address\" : \"change-address\"}`;\n\n  const actionPurpose = (action: EmailAction) =>\n    action === \"verify-address\" ? \"email-address-verification\" : \"email-address-change\";\n\n  const completionMatches = (input: EmailAddressMutation, action: EmailAction) => {\n    const completion = input.completion.input;\n    const binding = completion.binding;\n\n    return (\n      completion.moduleId === actionModule(input.moduleId, action) &&\n      completion.purpose === actionPurpose(action) &&\n      binding._tag === \"IdentifierChange\" &&\n      sameIdentifier(binding.identifier, input.target) &&\n      sameEmailRevision(binding.revision, input.captured.revision)\n    );\n  };\n\n  const snapshotEmailMutation = Effect.fn(\"DrizzleEmail.snapshotMutation\")(function* (\n    input: EmailAddressMutation,\n  ) {\n    const evidence = yield* snapshotAuthenticationEvidence(input.authorization.evidence).pipe(\n      Effect.mapError(unavailable),\n    );\n\n    const requirement = yield* snapshotEmailRequirement(input.authorization.requirement);\n\n    const source =\n      input.captured.source === undefined\n        ? undefined\n        : yield* snapshotEmailCredential(input.captured.source);\n\n    return Object.freeze({\n      ...input,\n      target: Object.freeze({ ...input.target }),\n      ...(input.invalidation === undefined\n        ? {}\n        : { invalidation: Object.freeze({ ...input.invalidation }) }),\n      captured: Object.freeze({\n        eligible: input.captured.eligible,\n        revision: snapshotEmailRevision(input.captured.revision),\n        ...(input.captured.targetIdentifierRevision === undefined\n          ? {}\n          : { targetIdentifierRevision: input.captured.targetIdentifierRevision }),\n        ...(source === undefined ? {} : { source }),\n      }),\n      authorization: Object.freeze({\n        challenge: Object.freeze({\n          ...input.authorization.challenge,\n          target: Object.freeze({ ...input.authorization.challenge.target }),\n          revision: snapshotEmailRevision(input.authorization.challenge.revision),\n        }),\n        evidence,\n        requirement,\n      }),\n    });\n  });\n\n  const validateEmailAuthority = Effect.fn(\"DrizzleEmail.validateAuthority\")(function* (\n    mapping: AddressMapping,\n    configuration: EmailSqlConfiguration,\n    input: EmailAddressMutation,\n    action: EmailAction,\n  ) {\n    const confirmsExisting =\n      action === \"verify-address\" && input.captured.targetIdentifierRevision !== undefined;\n\n    if (\n      !input.captured.eligible ||\n      !completionMatches(input, action) ||\n      input.authorization.challenge.moduleId !== input.moduleId ||\n      input.authorization.challenge.action !== action ||\n      input.authorization.challenge.commandId !== input.commandId ||\n      !sameIdentifier(input.authorization.challenge.target, input.target) ||\n      input.authorization.challenge.sourceCredentialId !== input.captured.source?.credentialId ||\n      !sameEmailRevision(input.authorization.challenge.revision, input.captured.revision) ||\n      input.authorization.challenge.targetIdentifierRevision !==\n        input.captured.targetIdentifierRevision ||\n      (input.authorization.evidence.flowId as string) !== (input.commandId as string) ||\n      input.authorization.evidence.bindingDigest !== input.authorization.challenge.bindingDigest ||\n      !sameEmailRevision(input.authorization.evidence.revision, input.captured.revision) ||\n      (action === \"verify-address\" && input.captured.source !== undefined) ||\n      (action === \"change-address\" && input.captured.source === undefined) ||\n      confirmsExisting !== (input.invalidation === undefined) ||\n      (input.invalidation?.existingSessions === \"immediate\" &&\n        mapping.sessionInvalidation !== \"same-authority-immediate\")\n    )\n      return undefined;\n\n    const current = yield* currentAddress(\n      mapping,\n      {\n        moduleId: input.moduleId,\n        subjectId: input.captured.revision.subjectId,\n        target: input.target,\n        ...(input.captured.source === undefined\n          ? {}\n          : { sourceCredentialId: input.captured.source.credentialId }),\n      },\n      configuration.locking,\n    );\n\n    if (\n      current === undefined ||\n      !current.eligible ||\n      !sameEmailRevision(current.revision, input.captured.revision) ||\n      current.targetIdentifierRevision !== input.captured.targetIdentifierRevision ||\n      (input.captured.source !== undefined &&\n        (current.source === undefined ||\n          current.source.snapshot.identifierRevision !== input.captured.source.identifierRevision ||\n          current.source.snapshot.credentialRevision !== input.captured.source.credentialRevision ||\n          !sameIdentifier(current.source.snapshot.identifier, input.captured.source.identifier)))\n    )\n      return undefined;\n\n    const currentRequirement = yield* mapping.subject.decodeActionRequirement(\n      current.subject,\n      action,\n    );\n\n    const original = yield* assessAuthentication(\n      input.authorization.evidence,\n      input.authorization.requirement,\n    ).pipe(Effect.mapError(unavailable));\n\n    const configured = yield* assessAuthentication(\n      input.authorization.evidence,\n      currentRequirement,\n    ).pipe(Effect.mapError(unavailable));\n\n    return original.satisfied && configured.satisfied ? current : undefined;\n  });\n\n  const commandExists = Effect.fn(\"Drizzle.commandExists\")(function* (\n    mapping: AddressMapping,\n    moduleId: string,\n    commandId: string,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentEmailSql;\n\n    const c = commandColumns(mapping);\n\n    return yield* selectRows(\n      database\n        .select()\n        .from(mapping.command.table)\n        .where(and(eq(c.moduleId, moduleId), eq(c.commandId, commandId)))\n        .limit(1),\n      locking,\n    );\n  });\n\n  const applyMutation = Effect.fn(\"DrizzleEmail.applyMutation\")(function* (\n    mapping: AddressMapping,\n    input: EmailAddressMutation,\n    action: EmailAction,\n    current: CurrentAddress,\n    allocated: {\n      readonly targetCredentialId: string;\n      readonly targetIdentifierRevision: SecurityRevision;\n      readonly targetCredentialRevision: SecurityRevision;\n      readonly sourceIdentifierRevision: SecurityRevision;\n      readonly sourceCredentialRevision: SecurityRevision;\n      readonly nextSecurityRevision: SecurityRevision;\n    },\n    now: number,\n  ) {\n    const database = yield* CurrentEmailSql;\n\n    const i = identifierColumns(mapping);\n    const c = credentialColumns(mapping);\n    const a = authorityColumns(mapping);\n    const s = subjectColumns(mapping);\n\n    const targetCredentialId =\n      current.targetCredential?.[mapping.credential.credentialId] ?? allocated.targetCredentialId;\n\n    if (action === \"change-address\") {\n      const source = current.source!;\n\n      yield* database\n        .update(mapping.identifier.table)\n        .set(\n          mapping.identifier.encodeRetirement({\n            source: source.snapshot.identifier,\n            bindingRevision: allocated.sourceIdentifierRevision,\n          }),\n        )\n        .where(\n          and(\n            eq(i.namespace, source.snapshot.identifier.namespace),\n            eq(i.value, source.snapshot.identifier.value),\n            eq(i.subjectId, current.nativeSubjectId),\n            eq(i.bindingRevision, source.snapshot.identifierRevision),\n          ),\n        );\n      yield* database\n        .update(mapping.credential.table)\n        .set(\n          mapping.credential.encodeRetirement({\n            source: source.snapshot.identifier,\n            credentialRevision: allocated.sourceCredentialRevision,\n          }),\n        )\n        .where(\n          and(\n            eq(c.moduleId, input.moduleId),\n            eq(c.credentialId, source.snapshot.credentialId),\n            eq(c.subjectId, current.nativeSubjectId),\n            eq(c.credentialRevision, source.snapshot.credentialRevision),\n          ),\n        );\n      yield* database\n        .update(mapping.authorityCredential.table)\n        .set(mapping.authorityCredential.encodeRetirement(allocated.sourceCredentialRevision))\n        .where(\n          and(\n            eq(a.subjectId, current.nativeSubjectId),\n            eq(a.credentialId, source.snapshot.credentialId),\n            eq(a.revision, source.snapshot.credentialRevision),\n          ),\n        );\n    }\n    if (current.targetIdentifier === undefined) {\n      yield* database.insert(mapping.identifier.table).values(\n        mapping.identifier.encodeVerifiedInsert({\n          identifier: input.target,\n          subjectId: current.nativeSubjectId,\n          verifiedAtMillis: now,\n          bindingRevision: allocated.targetIdentifierRevision,\n        }),\n      );\n    } else {\n      yield* database\n        .update(mapping.identifier.table)\n        .set(\n          mapping.identifier.encodeVerification({\n            verifiedAtMillis: now,\n            bindingRevision: allocated.targetIdentifierRevision,\n          }),\n        )\n        .where(\n          and(\n            eq(i.namespace, input.target.namespace),\n            eq(i.value, input.target.value),\n            eq(i.subjectId, current.nativeSubjectId),\n            eq(i.bindingRevision, current.targetIdentifier![mapping.identifier.bindingRevision]),\n          ),\n        );\n    }\n    if (current.targetCredential === undefined) {\n      yield* database.insert(mapping.credential.table).values(\n        mapping.credential.encodeVerifiedInsert({\n          moduleId: input.moduleId,\n          subjectId: current.nativeSubjectId,\n          credentialId: targetCredentialId,\n          identifier: input.target,\n          credentialRevision: allocated.targetCredentialRevision,\n        }),\n      );\n      yield* database.insert(mapping.authorityCredential.table).values(\n        mapping.authorityCredential.encodeInsert({\n          subjectId: current.nativeSubjectId,\n          credentialId: targetCredentialId,\n          revision: allocated.targetCredentialRevision,\n        }),\n      );\n    } else {\n      const oldRevision = current.targetCredential[mapping.credential.credentialRevision];\n\n      yield* database\n        .update(mapping.credential.table)\n        .set(\n          mapping.credential.encodeActivation({\n            identifier: input.target,\n            credentialRevision: allocated.targetCredentialRevision,\n          }),\n        )\n        .where(\n          and(\n            eq(c.moduleId, input.moduleId),\n            eq(c.credentialId, targetCredentialId),\n            eq(c.subjectId, current.nativeSubjectId),\n            eq(c.credentialRevision, oldRevision),\n          ),\n        );\n      yield* database\n        .update(mapping.authorityCredential.table)\n        .set(mapping.authorityCredential.encodeActivation(allocated.targetCredentialRevision))\n        .where(\n          and(\n            eq(a.subjectId, current.nativeSubjectId),\n            eq(a.credentialId, targetCredentialId),\n            eq(a.revision, oldRevision),\n          ),\n        );\n    }\n    yield* database\n      .update(mapping.subject.table)\n      .set(updateValues([[mapping.subject.securityRevision, allocated.nextSecurityRevision]]))\n      .where(\n        and(\n          eq(s.id, current.nativeSubjectId),\n          eq(s.securityRevision, input.captured.revision.securityRevision),\n        ),\n      );\n    yield* database.insert(mapping.command.table).values(\n      mapping.command.encodeInsert({\n        moduleId: input.moduleId,\n        commandId: input.commandId,\n        action,\n        bindingDigest: input.authorization.challenge.bindingDigest,\n        retentionUntilMillis: now + mapping.commandRetentionMillis,\n      }),\n    );\n\n    const sourceStillActive =\n      action === \"verify-address\"\n        ? []\n        : yield* selectRows(\n            database\n              .select()\n              .from(mapping.credential.table)\n              .where(\n                and(\n                  eq(c.moduleId, input.moduleId),\n                  eq(c.credentialId, current.source!.snapshot.credentialId),\n                  eq(c.subjectId, current.nativeSubjectId),\n                ),\n              ),\n            false,\n          );\n\n    const target = (yield* emailLookupRows(mapping, input.moduleId, input.target))[0];\n\n    const targetAuthority = yield* selectRows(\n      database\n        .select()\n        .from(mapping.authorityCredential.table)\n        .where(\n          and(eq(a.subjectId, current.nativeSubjectId), eq(a.credentialId, targetCredentialId)),\n        )\n        .limit(1),\n      false,\n    );\n\n    const command = yield* selectRows(\n      database\n        .select()\n        .from(mapping.command.table)\n        .where(\n          and(\n            eq(commandColumns(mapping).moduleId, input.moduleId),\n            eq(commandColumns(mapping).commandId, input.commandId),\n            eq(commandColumns(mapping).action, action),\n            eq(commandColumns(mapping).bindingDigest, input.authorization.challenge.bindingDigest),\n            eq(\n              commandColumns(mapping).retentionUntil,\n              mapping.encodeInstant(now + mapping.commandRetentionMillis),\n            ),\n          ),\n        )\n        .limit(1),\n      false,\n    );\n\n    const targetVerifiedAt =\n      target === undefined\n        ? undefined\n        : yield* mapping.decodeInstant(target.identifier[mapping.identifier.verifiedAt]);\n\n    const sourceIdentifier =\n      action === \"verify-address\"\n        ? []\n        : yield* identifierRow(mapping, current.source!.snapshot.identifier, false);\n\n    const sourceAuthority =\n      action === \"verify-address\"\n        ? []\n        : yield* selectRows(\n            database\n              .select()\n              .from(mapping.authorityCredential.table)\n              .where(\n                and(\n                  eq(a.subjectId, current.nativeSubjectId),\n                  eq(a.credentialId, current.source!.snapshot.credentialId),\n                ),\n              )\n              .limit(1),\n            false,\n          );\n\n    return (\n      target !== undefined &&\n      mapping.subjectId.equals(target.subject[mapping.subject.id], current.nativeSubjectId) &&\n      mapping.subject.isActiveStatus(target.subject[mapping.subject.status]) &&\n      target.subject[mapping.subject.securityRevision] === allocated.nextSecurityRevision &&\n      target.identifier[mapping.identifier.bindingRevision] ===\n        allocated.targetIdentifierRevision &&\n      targetVerifiedAt === now &&\n      target.credential[mapping.credential.credentialRevision] ===\n        allocated.targetCredentialRevision &&\n      target.credential[mapping.credential.credentialId] === targetCredentialId &&\n      mapping.subjectId.equals(\n        target.credential[mapping.credential.subjectId],\n        current.nativeSubjectId,\n      ) &&\n      mapping.identifier.isCurrent(target.identifier) &&\n      mapping.credential.isActiveStatus(target.credential[mapping.credential.status]) &&\n      targetAuthority.length === 1 &&\n      targetAuthority[0]![mapping.authorityCredential.revision] ===\n        allocated.targetCredentialRevision &&\n      mapping.authorityCredential.isActiveStatus(\n        targetAuthority[0]![mapping.authorityCredential.status],\n      ) &&\n      command.length === 1 &&\n      (action === \"verify-address\" ||\n        (sourceStillActive.length === 1 &&\n          sourceStillActive[0]![mapping.credential.credentialRevision] ===\n            allocated.sourceCredentialRevision &&\n          !mapping.credential.isActiveStatus(sourceStillActive[0]![mapping.credential.status]) &&\n          sourceIdentifier.length === 1 &&\n          mapping.subjectId.equals(\n            sourceIdentifier[0]![mapping.identifier.subjectId],\n            current.nativeSubjectId,\n          ) &&\n          sourceIdentifier[0]![mapping.identifier.bindingRevision] ===\n            allocated.sourceIdentifierRevision &&\n          !mapping.identifier.isCurrent(sourceIdentifier[0]!) &&\n          sourceAuthority.length === 1 &&\n          sourceAuthority[0]![mapping.authorityCredential.revision] ===\n            allocated.sourceCredentialRevision &&\n          !mapping.authorityCredential.isActiveStatus(\n            sourceAuthority[0]![mapping.authorityCredential.status],\n          )))\n    );\n  });\n\n  const probeProofCompletion = Effect.fn(\"Drizzle.probeProofCompletion\")(function* (\n    configuration: EmailSqlConfiguration,\n    input: ProofCompletionInput,\n  ) {\n    const database = yield* CurrentEmailSql;\n\n    if (configuration.proof === undefined) return yield* Effect.fail(unavailable());\n    const validProbe = { _tag: \"EmailProofCompletionValid\" } as const;\n\n    const plan = {\n      input,\n      prepare: <A>(\n        decision: ProofCompletionDecision,\n        journal: CommitJournal,\n        project: (decision: ProofCompletionDecision) => A,\n      ) => journal.prepare(project(decision)),\n    };\n\n    const probe = coordinateCommit(\n      () =>\n        database.transaction((transaction) =>\n          completeProofPlanIn(\n            configuration.proof!.mapping,\n            configuration.proof!.configuration,\n            plan,\n            Effect.fail(validProbe),\n            () => false,\n          ).pipe(\n            Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),\n          ),\n        ),\n      { mode: configuration.mode },\n    );\n\n    return yield* probe.pipe(\n      Effect.as(false),\n      Effect.catchCause((cause) => {\n        const reason = cause.reasons[0];\n\n        return cause.reasons.length === 1 &&\n          reason !== undefined &&\n          Cause.isFailReason(reason) &&\n          reason.error === validProbe\n          ? Effect.succeed(true)\n          : Effect.failCause(cause);\n      }),\n    );\n  });\n\n  const prepareRejected = Effect.fn(\"Drizzle.prepareRejected\")(function* <A>(\n    configuration: EmailSqlConfiguration,\n    prepare: (value: \"rejected\", journal: CommitJournal) => PreparedCommit<A>,\n  ) {\n    const database = yield* CurrentEmailSql;\n\n    return yield* owned(\n      database,\n      configuration,\n      Effect.gen(function* () {\n        const journal = yield* CurrentCommitJournal;\n\n        return yield* Effect.succeed(prepare(\"rejected\", journal));\n      }),\n    );\n  });\n\n  const makeSqlEmailAddressPersistence = Effect.fn(\"makeSqlEmailAddressPersistence\")(function* (\n    mapping: AddressMapping,\n    configuration: EmailSqlConfiguration,\n  ): Effect.fn.Return<EmailAddressPersistence[\"Service\"], never, LifecycleHooks | CurrentEmailSql> {\n    const database = yield* CurrentEmailSql;\n    const hooks = yield* LifecycleHooks;\n\n    return EmailAddressPersistence.of({\n      target: (input) =>\n        (validAddressConstraints(mapping)\n          ? safeRead(\n              database,\n              configuration,\n              Effect.gen(function* () {\n                const current = yield* currentAddress(mapping, input, configuration.locking);\n\n                if (current === undefined) return yield* unavailable();\n\n                return Object.freeze({\n                  revision: snapshotEmailRevision(current.revision),\n                  eligible: current.eligible,\n                  ...(current.targetIdentifierRevision === undefined\n                    ? {}\n                    : { targetIdentifierRevision: current.targetIdentifierRevision }),\n                  ...(current.source === undefined\n                    ? {}\n                    : { source: yield* snapshotEmailCredential(current.source.snapshot) }),\n                });\n              }),\n            )\n          : Effect.fail(unavailable())\n        ).pipe(\n          Effect.provideService(CurrentEmailSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      checkCompletion: (input) => {\n        if (configuration.proof === undefined || input.binding._tag !== \"IdentifierChange\")\n          return Effect.succeed(false).pipe(\n            Effect.provideService(CurrentEmailSql, database),\n            Effect.provideService(LifecycleHooks, hooks),\n            translateFailure,\n          );\n        const binding = input.binding;\n\n        return safeRead(\n          database,\n          configuration,\n          Effect.gen(function* () {\n            const action: EmailAction | undefined =\n              input.moduleId.endsWith(\"/verify-address\") &&\n              input.purpose === \"email-address-verification\"\n                ? \"verify-address\"\n                : input.moduleId.endsWith(\"/change-address\") &&\n                    input.purpose === \"email-address-change\"\n                  ? \"change-address\"\n                  : undefined;\n\n            if (action === undefined) return false;\n            const moduleId = input.moduleId.slice(0, -`/${action}`.length);\n\n            const current = yield* currentAddress(\n              mapping,\n              {\n                moduleId,\n                subjectId: binding.revision.subjectId,\n                target: binding.identifier,\n              },\n              false,\n            );\n\n            return current !== undefined && sameEmailRevision(current.revision, binding.revision);\n          }),\n        )\n          .pipe(\n            Effect.flatMap((current) =>\n              current ? probeProofCompletion(configuration, input) : Effect.succeed(false),\n            ),\n          )\n          .pipe(\n            Effect.provideService(CurrentEmailSql, database),\n            Effect.provideService(LifecycleHooks, hooks),\n            translateFailure,\n          );\n      },\n      verifyWithProof: (uncaptured, prepare) =>\n        mutateAddress(mapping, configuration, uncaptured, \"verify-address\", prepare).pipe(\n          Effect.provideService(CurrentEmailSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      changeWithProof: (uncaptured, prepare) =>\n        mutateAddress(mapping, configuration, uncaptured, \"change-address\", prepare).pipe(\n          Effect.provideService(CurrentEmailSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      cleanup: (input, prepare) =>\n        owned(\n          database,\n          configuration,\n          Effect.gen(function* () {\n            const transaction = yield* CurrentEmailSql;\n            const journal = yield* CurrentCommitJournal;\n\n            const c = commandColumns(mapping);\n            const now = yield* nowMillis;\n\n            const rows = yield* selectRows(\n              transaction\n                .select({ commandId: c.commandId })\n                .from(mapping.command.table)\n                .where(\n                  and(\n                    eq(c.moduleId, input.moduleId),\n                    lte(c.retentionUntil, mapping.encodeInstant(now)),\n                  ),\n                )\n                .limit(input.limit + 1),\n              configuration.locking,\n            );\n\n            const selected = rows.slice(0, input.limit);\n\n            const receipt = prepare(\n              { removed: selected.length, hasMore: rows.length > input.limit },\n              journal,\n            );\n\n            if (selected.length > 0)\n              yield* transaction.delete(mapping.command.table).where(\n                and(\n                  eq(c.moduleId, input.moduleId),\n                  inArray(\n                    c.commandId,\n                    selected.map((row: any) => row.commandId),\n                  ),\n                  lte(c.retentionUntil, mapping.encodeInstant(now)),\n                ),\n              );\n\n            return receipt;\n          }),\n        ).pipe(\n          Effect.provideService(CurrentEmailSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n    });\n  });\n\n  const mutateAddress = Effect.fn(\"Drizzle.mutateAddress\")(function* <A>(\n    mapping: AddressMapping,\n    configuration: EmailSqlConfiguration,\n    uncaptured: EmailAddressMutation,\n    action: EmailAction,\n    prepare: (value: \"changed\" | \"rejected\", journal: CommitJournal) => PreparedCommit<A>,\n  ) {\n    const database = yield* CurrentEmailSql;\n\n    if (!validAddressConstraints(mapping) || configuration.proof === undefined)\n      return yield* unavailable();\n    const input = yield* snapshotEmailMutation(uncaptured);\n\n    const targetCredentialId = yield* allocate(\n      configuration.mode,\n      mapping.allocateCredentialId,\n      mapping.allocateCredentialIdSync,\n    );\n\n    const targetIdentifierRevision = yield* allocate(\n      configuration.mode,\n      mapping.allocateRevision,\n      mapping.allocateRevisionSync,\n    );\n\n    const targetCredentialRevision = yield* allocate(\n      configuration.mode,\n      mapping.allocateRevision,\n      mapping.allocateRevisionSync,\n    );\n\n    const sourceIdentifierRevision = yield* allocate(\n      configuration.mode,\n      mapping.allocateRevision,\n      mapping.allocateRevisionSync,\n    );\n\n    const sourceCredentialRevision = yield* allocate(\n      configuration.mode,\n      mapping.allocateRevision,\n      mapping.allocateRevisionSync,\n    );\n\n    const confirmsExisting =\n      action === \"verify-address\" && input.captured.targetIdentifierRevision !== undefined;\n\n    const nextRevision = confirmsExisting\n      ? input.captured.revision.securityRevision\n      : yield* nextSecurityRevision(\n          mapping,\n          configuration.mode,\n          input.captured.revision.securityRevision,\n        );\n\n    if (\n      (!confirmsExisting && nextRevision === input.captured.revision.securityRevision) ||\n      [\n        targetIdentifierRevision,\n        targetCredentialRevision,\n        sourceIdentifierRevision,\n        sourceCredentialRevision,\n      ].some((value) => input.captured.revision.credentials.some((item) => item.revision === value))\n    )\n      return yield* unavailable();\n\n    const run = owned(\n      database,\n      configuration,\n      Effect.gen(function* () {\n        const journal = yield* CurrentCommitJournal;\n\n        const current = yield* validateEmailAuthority(mapping, configuration, input, action);\n\n        if (current === undefined) return prepare(\"rejected\", journal);\n        if (\n          (yield* commandExists(mapping, input.moduleId, input.commandId, configuration.locking))\n            .length > 0\n        )\n          return prepare(\"rejected\", journal);\n        let receipt: PreparedCommit<A> | undefined;\n\n        yield* completeProofPlanIn(\n          configuration.proof!.mapping,\n          configuration.proof!.configuration,\n          input.completion,\n          Effect.gen(function* () {\n            // The proof helper may wait on continuation/series locks. Read the\n            // commit clock and reassess both policies only after those locks.\n            const currentRequirement = yield* mapping.subject.decodeActionRequirement(\n              current.subject,\n              action,\n            );\n\n            const original = yield* assessAuthentication(\n              input.authorization.evidence,\n              input.authorization.requirement,\n            ).pipe(Effect.mapError(unavailable));\n\n            const configured = yield* assessAuthentication(\n              input.authorization.evidence,\n              currentRequirement,\n            ).pipe(Effect.mapError(unavailable));\n\n            if (!original.satisfied || !configured.satisfied) return false;\n            const now = yield* nowMillis;\n\n            return yield* applyMutation(\n              mapping,\n              input,\n              action,\n              current,\n              {\n                targetCredentialId,\n                targetIdentifierRevision,\n                targetCredentialRevision,\n                sourceIdentifierRevision,\n                sourceCredentialRevision,\n                nextSecurityRevision: nextRevision,\n              },\n              now,\n            );\n          }),\n          (decision) => {\n            receipt = prepare(decision === \"completed\" ? \"changed\" : \"rejected\", journal);\n\n            return decision;\n          },\n        );\n\n        return receipt ?? prepare(\"rejected\", journal);\n      }),\n    );\n\n    return yield* run.pipe(\n      Effect.catchCause((cause) =>\n        (cause.reasons.every(Cause.isFailReason) &&\n          isMappedConstraintConflict(mapping.isCommandConflict, cause)) ||\n        (cause.reasons.every(Cause.isFailReason) &&\n          isMappedConstraintConflict(mapping.isIdentifierConflict, cause)) ||\n        (cause.reasons.every(Cause.isFailReason) &&\n          isMappedConstraintConflict(mapping.isCredentialConflict, cause))\n          ? prepareRejected(configuration, prepare)\n          : Effect.failCause(cause),\n      ),\n    );\n  });\n\n  return {\n    validEmailSignInConstraints,\n    emailLookupQuery,\n    decodeEmailSnapshot,\n    makeSqlEmailSignInTargets,\n    currentAddress,\n    sameEmailRevision,\n    snapshotEmailMutation,\n    validateEmailAuthority,\n    makeSqlEmailAddressPersistence,\n  };\n};\n"],"mappings":";;;;;;;;;;AAkFA,IAAa,kBAAb,cAAqC,QAAQ,QAA2C,CAAC,CACvF,6BACF,CAAC,CAAC,CAAC;AA4BH,MAAa,mBAIX,YACA,WACG;CAGH,MAAM,EAAE,KAAK,IAAI,SAAS,KAAK,QAAQ,iBAAiB;CACxD,MAAM,EAAE,wBAAwB;CAChC,MAAM,oBAAoB,iBAAiB,KAAK,CAAC,CAAC;CAElD,MAAM,oBACJ,WAEA,yBACE,SACC,UACC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,sBAAsB,CAAC,CAAC,KAAK,CAC3C,CAAC,CAAC,KAAK,OAAO,YAAY,UAAU,OAAO,UAAU,MAAM,IAAI,aAAa,YAAY,CAAC,CAAC,CAAC,CAAC;CAE9F,MAAM,YAAY,OAAO,IAAI,SAAS,KAAK,SAAS,aAAa;CAEjE,MAAM,cAAc,OAAsB,YACxC,WAAW,OAAO,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,IAAI;CAErE,MAAM,kBAAkB,MAAuB,UAC7C,KAAK,cAAc,MAAM,aAAa,KAAK,UAAU,MAAM;CAE7D,MAAM,+BAA+B,YACnC,OAAO,QAAQ,8BAA8B,CAAC,CAAC,OAC5C,CAAC,KAAK,WACL,QAAQ,YAAY,SAAwD,KAChF;CAEF,MAAM,2BAA2B,YAC/B,OAAO,QAAQ,+BAA+B,CAAC,CAAC,OAC7C,CAAC,KAAK,WACL,QAAQ,YAAY,SAAyD,KACjF;CAEF,MAAM,kBAAkB,aAA4B;EAClD,IAAI,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,EAAE;EACpD,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;EAC5D,kBAAkB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,gBAAgB;CAClF;CAEA,MAAM,qBAAqB,aAA4B;EACrD,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;EACxE,OAAO,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,KAAK;EAChE,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;EACxE,YAAY,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,UAAU;EAC1E,iBAAiB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,eAAe;CACtF;CAEA,MAAM,qBAAqB,aAA4B;EACrD,UAAU,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,QAAQ;EACtE,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;EACxE,cAAc,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,YAAY;EAC9E,qBAAqB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,mBAAmB;EAC5F,iBAAiB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,eAAe;EACpF,oBAAoB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,kBAAkB;EAC1F,QAAQ,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,MAAM;CACpE;CAEA,MAAM,oBAAoB,aAA6B;EACrD,WAAW,OAAO,QAAQ,oBAAoB,OAAO,QAAQ,oBAAoB,SAAS;EAC1F,cAAc,OACZ,QAAQ,oBAAoB,OAC5B,QAAQ,oBAAoB,YAC9B;EACA,UAAU,OAAO,QAAQ,oBAAoB,OAAO,QAAQ,oBAAoB,QAAQ;EACxF,QAAQ,OAAO,QAAQ,oBAAoB,OAAO,QAAQ,oBAAoB,MAAM;CACtF;CAEA,MAAM,kBAAkB,aAA6B;EACnD,UAAU,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,QAAQ;EAChE,WAAW,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,SAAS;EAClE,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;EAC5D,eAAe,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,aAAa;EAC1E,gBAAgB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,cAAc;CAC9E;CAEA,MAAM,YACJ,MACA,cACA,gBACG;EACH,IAAI,SAAS,eACX,OAAO,gBAAgB,KAAA,IACnB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;GACT,KAAK;GACL,QAAQ,UAAU,IAAI,wBAAwB;IAAE,WAAW;IAAW;GAAM,CAAC;EAC/E,CAAC;EACP,IAAI,iBAAiB,KAAA,GAAW,OAAO;EAEvC,OAAO,gBAAgB,KAAA,IACnB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;GACT,KAAK;GACL,QAAQ,UAAU,IAAI,wBAAwB;IAAE,WAAW;IAAW;GAAM,CAAC;EAC/E,CAAC;CACP;CAEA,MAAM,wBACJ,SACA,MACA,YACG;EACH,IAAI,SAAS,eACX,OAAO,QAAQ,QAAQ,6BAA6B,KAAA,IAChD,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;GACT,WAAW,QAAQ,QAAQ,yBAA0B,OAAO;GAC5D,QAAQ,UAAU,IAAI,wBAAwB;IAAE,WAAW;IAAW;GAAM,CAAC;EAC/E,CAAC;EACP,IAAI,QAAQ,QAAQ,yBAAyB,KAAA,GAC3C,OAAO,QAAQ,QAAQ,qBAAqB,OAAO;EACrD,IAAI,QAAQ,QAAQ,6BAA6B,KAAA,GAC/C,OAAO,OAAO,IAAI;GAChB,WAAW,QAAQ,QAAQ,yBAA0B,OAAO;GAC5D,QAAQ,UAAU,IAAI,wBAAwB;IAAE,WAAW;IAAW;GAAM,CAAC;EAC/E,CAAC;EAEH,OAAO,OAAO,KAAK,YAAY,CAAC;CAClC;CAEA,MAAM,YACJ,UACA,eACA,SAEA,OAAO,IAAI,aAAa;EACtB,IAAI,cAAc,gBAAgB,MAAM;GACtC,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;GACrD,OAAO,cAAc;EACvB;EAEA,OAAO,OAAO,SAAS,aAAa,gBAClC,KAAK,KACH,OAAO,eAAe,iBAAiB,WAAW,GAClD,OAAO,eAAe,iBAAiB,WAA0C,CACnF,CACF;CACF,CAAC;CAEH,MAAM,SACJ,UACA,eACA,SACG;EACH,MAAM,MAAM,uBAER,SAAS,aAAa,gBACpB,KAAK,KACH,OAAO,eAAe,iBAAiB,WAAW,GAClD,OAAO,eAAe,iBAAiB,WAA0C,CACnF,CACF,GACF,EAAE,MAAM,cAAc,KAAK,CAC7B,CAAC,CAAC,KAAK,OAAO,KAAK,WAAW,OAAO,KAAK,CAAC;EAE3C,OAAO,cAAc,gBAAgB,OACjC,OAAO,IAAI,aAAa;GACtB,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;GACrD,OAAO,cAAc;GAErB,OAAO,OAAO;EAChB,CAAC,IACD;CACN;CAEA,MAAM,oBACJ,SACA,UACA,eACG;EACH,MAAM,UAAU,eAAe,OAAO,GACpC,UAAU,kBAAkB,OAAO,GACnC,aAAa,kBAAkB,OAAO;EAExC,OAAO;GACL,QAAQ;IACN,SAAS,QAAQ,QAAQ;IACzB,YAAY,QAAQ,WAAW;IAC/B,YAAY,QAAQ,WAAW;GACjC;GACA,MAAM,QAAQ,WAAW;GACzB,cAAc,QAAQ,QAAQ;GAC9B,aAAa,GAAG,QAAQ,IAAI,QAAQ,SAAS;GAC7C,iBAAiB,QAAQ,WAAW;GACpC,gBAAgB,IACd,GAAG,WAAW,UAAU,QAAQ,GAChC,GAAG,WAAW,WAAW,QAAQ,SAAS,GAC1C,GAAG,WAAW,qBAAqB,QAAQ,SAAS,GACpD,GAAG,WAAW,iBAAiB,QAAQ,KAAK,CAC9C;GACA,WAAW,IACT,GAAG,QAAQ,WAAW,WAAW,SAAS,GAC1C,GAAG,QAAQ,OAAO,WAAW,KAAK,CACpC;GACA,OAAO;EACT;CACF;CAEA,MAAM,kBAAkB,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,SACA,UACA,YACA;EACA,MAAM,WAAW,OAAO;EACxB,MAAM,QAAQ,iBAAiB,SAAS,UAAU,UAAU;EAE5D,OAAO,OAAO,SACX,OAAO,MAAM,MAAM,CAAC,CACpB,KAAK,MAAM,IAAI,CAAC,CAChB,UAAU,MAAM,cAAc,MAAM,WAAW,CAAC,CAChD,UAAU,MAAM,iBAAiB,MAAM,cAAc,CAAC,CACtD,MAAM,MAAM,SAAS,CAAC,CACtB,MAAM,MAAM,KAAK;CACtB,CAAC;CAED,MAAM,sBAAsB,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACnE,SACA,UACA,WACA,KACA;EACA,IACE,CAAC,QAAQ,QAAQ,eAAe,IAAI,QAAQ,QAAQ,QAAQ,OAAO,KACnE,CAAC,QAAQ,WAAW,UAAU,IAAI,UAAU,KAC5C,CAAC,QAAQ,WAAW,eAAe,IAAI,WAAW,QAAQ,WAAW,OAAO,GAE5E,OAAO,KAAA;EAET,MAAM,WAAW,OAAO,QAAQ,WAC7B,OAAO;GACN;GACA,SAAS,IAAI;GACb,YAAY,IAAI;GAChB,YAAY,IAAI;EAClB,CAAC,CAAC,CACD,KAAK,OAAO,QAAQ,uBAAuB,CAAC;EAE/C,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,IAAI,QAAQ,QAAQ,QAAQ,GAAG;EAEpF,MAAM,mBAAmB,OAAO,QAAQ,cACtC,IAAI,WAAW,QAAQ,WAAW,WACpC;EAEA,IACE,SAAS,aAAa,YACtB,CAAC,eAAe,SAAS,YAAY,SAAS,KAC9C,SAAS,SAAS,cAAc,aAChC,SAAS,SAAS,qBAAqB,IAAI,QAAQ,QAAQ,QAAQ,qBACnE,SAAS,uBAAuB,IAAI,WAAW,QAAQ,WAAW,oBAClE,SAAS,qBAAqB,oBAC9B,SAAS,iBAAiB,IAAI,WAAW,QAAQ,WAAW,iBAC5D,SAAS,uBAAuB,IAAI,WAAW,QAAQ,WAAW,qBAElE,OAAO,KAAA;EAET,OAAO;CACT,CAAC;CAED,MAAM,4BAA4B,OAAO,GAAG,2BAA2B,CAAC,CAAC,WACvE,SACA,eACyE;EACzE,MAAM,WAAW,OAAO;EAExB,OAAO,mBAAmB,GAAG,EAC3B,SAAS,WACN,4BAA4B,OAAO,IAChC,SACE,UACA,eACA,OAAO,IAAI,aAAa;GACtB,MAAM,OAAO,OAAO,gBAAgB,SAAS,MAAM,UAAU,MAAM,UAAU,EAAA,CAAG;GAEhF,IAAI,QAAQ,KAAA,GAAW,OAAO,OAAO,KAAK;GAE1C,MAAM,WAAW,OAAO,oBACtB,SACA,MAAM,UACN,MAAM,YACN,GACF;GAEA,OAAO,aAAa,KAAA,IAAY,OAAO,KAAK,IAAI,OAAO,KAAK,QAAQ;EACtE,CAAC,CACH,IACA,OAAO,KAAK,YAAY,CAAC,EAAA,CAC3B,KAAK,OAAO,eAAe,iBAAiB,QAAQ,GAAG,gBAAgB,EAC7E,CAAC;CACH,CAAC;CAED,MAAM,cAAc,OAAO,GAAG,0BAA0B,CAAC,CAAC,WACxD,SACA,WACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,SAAgB;EAC1E,MAAM,IAAI,eAAe,OAAO;EAOhC,OAAO;GAAE;GAAiB,UALT,OAAO,WACtB,SAAS,OAAO,CAAC,CAAC,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAAC,MAAM,GAAG,EAAE,IAAI,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,GACtF,OACF,EAAA,CAAG;EAE+B;CACpC,CAAC;CAED,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,YACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EAEnC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,IAAI,GAAG,EAAE,WAAW,WAAW,SAAS,GAAG,GAAG,EAAE,OAAO,WAAW,KAAK,CAAC,CAAC,CAAC,CAChF,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,iBAAiB,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,UACA,cACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EAEnC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,IAAI,GAAG,EAAE,UAAU,QAAQ,GAAG,GAAG,EAAE,cAAc,YAAY,CAAC,CAAC,CAAC,CACtE,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,yBAAyB,OAAO,GAAG,gCAAgC,CAAC,CAAC,WACzE,SACA,UACA,YACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EAEnC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MACC,IACE,GAAG,EAAE,UAAU,QAAQ,GACvB,GAAG,EAAE,qBAAqB,WAAW,SAAS,GAC9C,GAAG,EAAE,iBAAiB,WAAW,KAAK,CACxC,CACF,CAAC,CACA,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,iBAAiB,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAC9D,SACA,OAMA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,SAAS,OAAO,YAAY,SAAS,MAAM,WAAW,OAAO;EAEnE,IACE,OAAO,YAAY,KAAA,KACnB,CAAC,QAAQ,QAAQ,eAAe,OAAO,QAAQ,QAAQ,QAAQ,OAAO,GAEtE,OAAO,KAAA;EAET,MAAM,mBACJ,MAAM,uBAAuB,KAAA,IACzB,KAAA,KACC,OAAO,eAAe,SAAS,MAAM,UAAU,MAAM,oBAAoB,KAAK,EAAA,CAAG;EAExF,MAAM,mBACJ,qBAAqB,KAAA,IACjB,KAAA,IACA;GACE,WAAW,iBAAiB,QAAQ,WAAW;GAC/C,OAAO,iBAAiB,QAAQ,WAAW;EAC7C;EAEN,MAAM,cAAc,CAClB,MAAM,QACN,GAAI,qBAAqB,KAAA,IAAY,CAAC,IAAI,CAAC,gBAAgB,CAC7D,CAAC,CACE,QACE,OAAO,OAAO,WACb,OAAO,WAAW,cAAc,eAAe,WAAW,KAAK,CAAC,MAAM,KAC1E,CAAC,CACA,MAAM,MAAM,UACX,GAAG,KAAK,UAAU,QAAQ,KAAK,QAAQ,cACrC,GAAG,MAAM,UAAU,QAAQ,MAAM,OACnC,CACF;EAEF,MAAM,oCAAoB,IAAI,IAAiB;EAE/C,KAAK,MAAM,cAAc,aAAa;GACpC,MAAM,OAAO,OAAO,cAAc,SAAS,YAAY,OAAO,EAAA,CAAG;GAEjE,IAAI,QAAQ,KAAA,GACV,kBAAkB,IAAI,GAAG,WAAW,UAAU,QAAQ,WAAW,SAAS,GAAG;EACjF;EAEA,MAAM,mBACJ,MAAM,uBAAuB,KAAA,IACzB,KAAA,KACC,OAAO,eAAe,SAAS,MAAM,UAAU,MAAM,oBAAoB,OAAO,EAAA,CAAG;EAE1F,MAAM,oBAAoB,OAAO,uBAC/B,SACA,MAAM,UACN,MAAM,QACN,OACF,EAAA,CAAG;EAEH,MAAM,IAAI,iBAAiB,OAAO;EAWlC,MAAM,mBAAkB,OATC,WACvB,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,oBAAoB,KAAK,CAAC,CACvC,MAAM,GAAG,EAAE,WAAW,OAAO,eAAe,CAAC,CAAC,CAC9C,QAAQ,EAAE,YAAY,GACzB,OACF,EAAA,CAEkC,QAAQ,QACxC,QAAQ,oBAAoB,eAAe,IAAI,QAAQ,oBAAoB,OAAO,CACpF;EAEA,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,OAAO,eAAe;EAE3E,MAAM,WAAmC,OAAO,OAAO;GACrD;GACA,kBAAkB,OAAO,QAAQ,QAAQ,QAAQ;GACjD,aAAa,OAAO,OAClB,gBAAgB,KAAK,QACnB,OAAO,OAAO;IACZ,cAAc,IAAI,QAAQ,oBAAoB;IAC9C,UAAU,IAAI,QAAQ,oBAAoB;GAC5C,CAAC,CACH,CACF;EACF,CAAC;EAED,MAAM,mBAAmB,kBAAkB,IACzC,GAAG,MAAM,OAAO,UAAU,QAAQ,MAAM,OAAO,OACjD;EASA,MAAM,gBANJ,qBAAqB,KAAA,KACrB,QAAQ,UAAU,OAChB,iBAAiB,QAAQ,WAAW,YACpC,OAAO,eACT,KAIA,QAAQ,WAAW,gBAAgB,gBAAgB,MAClD,qBAAqB,KAAA,KACnB,CAAC,QAAQ,WAAW,eAAe,iBAAiB,QAAQ,WAAW,OAAO,KAC7E,QAAQ,UAAU,OAChB,iBAAiB,QAAQ,WAAW,YACpC,OAAO,eACT;EAEN,IAAI;EAEJ,IAAI,MAAM,uBAAuB,KAAA,GAAW;GAC1C,IACE,qBAAqB,KAAA,KACrB,qBAAqB,KAAA,KACrB,CAAC,QAAQ,UAAU,OACjB,iBAAiB,QAAQ,WAAW,YACpC,OAAO,eACT,KACA,CAAC,QAAQ,WAAW,eAAe,iBAAiB,QAAQ,WAAW,OAAO,GAE9E,OAAO,KAAA;GAET,MAAM,sBAAsB,kBAAkB,IAC5C,GAAG,iBAAiB,UAAU,QAAQ,iBAAiB,OACzD;GAEA,IACE,wBAAwB,KAAA,KACxB,CAAC,QAAQ,WAAW,UAAU,mBAAmB,KACjD,CAAC,QAAQ,UAAU,OACjB,oBAAoB,QAAQ,WAAW,YACvC,OAAO,eACT,GAEA,OAAO,KAAA;GAWT,SAAS;IAAE,YAAY;IAAkB,YAAY;IAAqB,UAAA,OATlD,QAAQ,WAC7B,OAAO;KACN,UAAU,MAAM;KAChB,SAAS,OAAO;KAChB,YAAY;KACZ,YAAY;IACd,CAAC,CAAC,CACD,KAAK,OAAO,QAAQ,uBAAuB,CAAC;GAEoC;EACrF;EACA,IAAI,WAAW,qBAAqB,KAAA,IAAY,qBAAqB,KAAA,IAAY;EAEjF,IAAI,MAAM,uBAAuB,KAAA,KAAa,WAAW,KAAA,GAAW,WAAW;EAC/E,IAAI,WAAW,KAAA,KAAa,eAAe,OAAO,SAAS,YAAY,MAAM,MAAM,GACjF,WAAW;EACb,IAAI,QAAQ,uBAAuB,YAAY,MAAM,uBAAuB,KAAA,GAAW;GACrF,MAAM,IAAI,kBAAkB,OAAO;GAUnC,KACE,OATkB,WAClB,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,WAAW,OAAO,eAAe,CAAC,CAAC,GACrF,OACF,EAAA,CAGO,MAAM,QAAa,QAAQ,WAAW,eAAe,IAAI,QAAQ,WAAW,OAAO,CAAC,GAEzF,WAAW;EACf;EAEA,OAAO;GACL,iBAAiB,OAAO;GACxB,SAAS,OAAO;GAChB;GACA,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO;GACzC,GAAI,qBAAqB,KAAA,IAAY,CAAC,IAAI,EAAE,iBAAiB;GAC7D,GAAI,qBAAqB,KAAA,IAAY,CAAC,IAAI,EAAE,iBAAiB;GAC7D,GAAI,gBACA,EAAE,0BAA0B,iBAAiB,QAAQ,WAAW,iBAAiB,IACjF,CAAC;GACL;EACF;CACF,CAAC;CAED,MAAM,qBAAqB,MAA8B,UAAkC;EACzF,IACE,KAAK,cAAc,MAAM,aACzB,KAAK,qBAAqB,MAAM,oBAChC,KAAK,YAAY,WAAW,MAAM,YAAY,QAE9C,OAAO;EAET,MAAM,WAAW,CAAC,GAAG,KAAK,WAAW,CAAC,CAAC,MAAM,GAAG,MAC9C,EAAE,aAAa,cAAc,EAAE,YAAY,CAC7C;EAEA,MAAM,SAAS,CAAC,GAAG,MAAM,WAAW,CAAC,CAAC,MAAM,GAAG,MAC7C,EAAE,aAAa,cAAc,EAAE,YAAY,CAC7C;EAEA,OAAO,SAAS,OACb,MAAM,UACL,KAAK,iBAAiB,OAAO,MAAM,CAAE,gBACrC,KAAK,aAAa,OAAO,MAAM,CAAE,QACrC;CACF;CAEA,MAAM,gBAAgB,UAAkB,WACtC,GAAG,SAAS,GAAG,WAAW,mBAAmB,mBAAmB;CAElE,MAAM,iBAAiB,WACrB,WAAW,mBAAmB,+BAA+B;CAE/D,MAAM,qBAAqB,OAA6B,WAAwB;EAC9E,MAAM,aAAa,MAAM,WAAW;EACpC,MAAM,UAAU,WAAW;EAE3B,OACE,WAAW,aAAa,aAAa,MAAM,UAAU,MAAM,KAC3D,WAAW,YAAY,cAAc,MAAM,KAC3C,QAAQ,SAAS,sBACjB,eAAe,QAAQ,YAAY,MAAM,MAAM,KAC/C,kBAAkB,QAAQ,UAAU,MAAM,SAAS,QAAQ;CAE/D;CAEA,MAAM,wBAAwB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WACvE,OACA;EACA,MAAM,WAAW,OAAO,+BAA+B,MAAM,cAAc,QAAQ,CAAC,CAAC,KACnF,OAAO,SAAS,WAAW,CAC7B;EAEA,MAAM,cAAc,OAAO,yBAAyB,MAAM,cAAc,WAAW;EAEnF,MAAM,SACJ,MAAM,SAAS,WAAW,KAAA,IACtB,KAAA,IACA,OAAO,wBAAwB,MAAM,SAAS,MAAM;EAE1D,OAAO,OAAO,OAAO;GACnB,GAAG;GACH,QAAQ,OAAO,OAAO,EAAE,GAAG,MAAM,OAAO,CAAC;GACzC,GAAI,MAAM,iBAAiB,KAAA,IACvB,CAAC,IACD,EAAE,cAAc,OAAO,OAAO,EAAE,GAAG,MAAM,aAAa,CAAC,EAAE;GAC7D,UAAU,OAAO,OAAO;IACtB,UAAU,MAAM,SAAS;IACzB,UAAU,sBAAsB,MAAM,SAAS,QAAQ;IACvD,GAAI,MAAM,SAAS,6BAA6B,KAAA,IAC5C,CAAC,IACD,EAAE,0BAA0B,MAAM,SAAS,yBAAyB;IACxE,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO;GAC3C,CAAC;GACD,eAAe,OAAO,OAAO;IAC3B,WAAW,OAAO,OAAO;KACvB,GAAG,MAAM,cAAc;KACvB,QAAQ,OAAO,OAAO,EAAE,GAAG,MAAM,cAAc,UAAU,OAAO,CAAC;KACjE,UAAU,sBAAsB,MAAM,cAAc,UAAU,QAAQ;IACxE,CAAC;IACD;IACA;GACF,CAAC;EACH,CAAC;CACH,CAAC;CAED,MAAM,yBAAyB,OAAO,GAAG,gCAAgC,CAAC,CAAC,WACzE,SACA,eACA,OACA,QACA;EACA,MAAM,mBACJ,WAAW,oBAAoB,MAAM,SAAS,6BAA6B,KAAA;EAE7E,IACE,CAAC,MAAM,SAAS,YAChB,CAAC,kBAAkB,OAAO,MAAM,KAChC,MAAM,cAAc,UAAU,aAAa,MAAM,YACjD,MAAM,cAAc,UAAU,WAAW,UACzC,MAAM,cAAc,UAAU,cAAc,MAAM,aAClD,CAAC,eAAe,MAAM,cAAc,UAAU,QAAQ,MAAM,MAAM,KAClE,MAAM,cAAc,UAAU,uBAAuB,MAAM,SAAS,QAAQ,gBAC5E,CAAC,kBAAkB,MAAM,cAAc,UAAU,UAAU,MAAM,SAAS,QAAQ,KAClF,MAAM,cAAc,UAAU,6BAC5B,MAAM,SAAS,4BAChB,MAAM,cAAc,SAAS,WAAuB,MAAM,aAC3D,MAAM,cAAc,SAAS,kBAAkB,MAAM,cAAc,UAAU,iBAC7E,CAAC,kBAAkB,MAAM,cAAc,SAAS,UAAU,MAAM,SAAS,QAAQ,KAChF,WAAW,oBAAoB,MAAM,SAAS,WAAW,KAAA,KACzD,WAAW,oBAAoB,MAAM,SAAS,WAAW,KAAA,KAC1D,sBAAsB,MAAM,iBAAiB,KAAA,MAC5C,MAAM,cAAc,qBAAqB,eACxC,QAAQ,wBAAwB,4BAElC,OAAO,KAAA;EAET,MAAM,UAAU,OAAO,eACrB,SACA;GACE,UAAU,MAAM;GAChB,WAAW,MAAM,SAAS,SAAS;GACnC,QAAQ,MAAM;GACd,GAAI,MAAM,SAAS,WAAW,KAAA,IAC1B,CAAC,IACD,EAAE,oBAAoB,MAAM,SAAS,OAAO,aAAa;EAC/D,GACA,cAAc,OAChB;EAEA,IACE,YAAY,KAAA,KACZ,CAAC,QAAQ,YACT,CAAC,kBAAkB,QAAQ,UAAU,MAAM,SAAS,QAAQ,KAC5D,QAAQ,6BAA6B,MAAM,SAAS,4BACnD,MAAM,SAAS,WAAW,KAAA,MACxB,QAAQ,WAAW,KAAA,KAClB,QAAQ,OAAO,SAAS,uBAAuB,MAAM,SAAS,OAAO,sBACrE,QAAQ,OAAO,SAAS,uBAAuB,MAAM,SAAS,OAAO,sBACrE,CAAC,eAAe,QAAQ,OAAO,SAAS,YAAY,MAAM,SAAS,OAAO,UAAU,IAExF,OAAO,KAAA;EAET,MAAM,qBAAqB,OAAO,QAAQ,QAAQ,wBAChD,QAAQ,SACR,MACF;EAEA,MAAM,WAAW,OAAO,qBACtB,MAAM,cAAc,UACpB,MAAM,cAAc,WACtB,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;EAEnC,MAAM,aAAa,OAAO,qBACxB,MAAM,cAAc,UACpB,kBACF,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;EAEnC,OAAO,SAAS,aAAa,WAAW,YAAY,UAAU,KAAA;CAChE,CAAC;CAED,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,UACA,WACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,eAAe,OAAO;EAEhC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,IAAI,GAAG,EAAE,UAAU,QAAQ,GAAG,GAAG,EAAE,WAAW,SAAS,CAAC,CAAC,CAAC,CAChE,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,gBAAgB,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAC5D,SACA,OACA,QACA,SACA,WAQA,KACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EACnC,MAAM,IAAI,kBAAkB,OAAO;EACnC,MAAM,IAAI,iBAAiB,OAAO;EAClC,MAAM,IAAI,eAAe,OAAO;EAEhC,MAAM,qBACJ,QAAQ,mBAAmB,QAAQ,WAAW,iBAAiB,UAAU;EAE3E,IAAI,WAAW,kBAAkB;GAC/B,MAAM,SAAS,QAAQ;GAEvB,OAAO,SACJ,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,IACC,QAAQ,WAAW,iBAAiB;IAClC,QAAQ,OAAO,SAAS;IACxB,iBAAiB,UAAU;GAC7B,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,EAAE,WAAW,OAAO,SAAS,WAAW,SAAS,GACpD,GAAG,EAAE,OAAO,OAAO,SAAS,WAAW,KAAK,GAC5C,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,iBAAiB,OAAO,SAAS,kBAAkB,CAC1D,CACF;GACF,OAAO,SACJ,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,IACC,QAAQ,WAAW,iBAAiB;IAClC,QAAQ,OAAO,SAAS;IACxB,oBAAoB,UAAU;GAChC,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,cAAc,OAAO,SAAS,YAAY,GAC/C,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,oBAAoB,OAAO,SAAS,kBAAkB,CAC7D,CACF;GACF,OAAO,SACJ,OAAO,QAAQ,oBAAoB,KAAK,CAAC,CACzC,IAAI,QAAQ,oBAAoB,iBAAiB,UAAU,wBAAwB,CAAC,CAAC,CACrF,MACC,IACE,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,cAAc,OAAO,SAAS,YAAY,GAC/C,GAAG,EAAE,UAAU,OAAO,SAAS,kBAAkB,CACnD,CACF;EACJ;EACA,IAAI,QAAQ,qBAAqB,KAAA,GAC/B,OAAO,SAAS,OAAO,QAAQ,WAAW,KAAK,CAAC,CAAC,OAC/C,QAAQ,WAAW,qBAAqB;GACtC,YAAY,MAAM;GAClB,WAAW,QAAQ;GACnB,kBAAkB;GAClB,iBAAiB,UAAU;EAC7B,CAAC,CACH;OAEA,OAAO,SACJ,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,IACC,QAAQ,WAAW,mBAAmB;GACpC,kBAAkB;GAClB,iBAAiB,UAAU;EAC7B,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,EAAE,WAAW,MAAM,OAAO,SAAS,GACtC,GAAG,EAAE,OAAO,MAAM,OAAO,KAAK,GAC9B,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,iBAAiB,QAAQ,iBAAkB,QAAQ,WAAW,gBAAgB,CACrF,CACF;EAEJ,IAAI,QAAQ,qBAAqB,KAAA,GAAW;GAC1C,OAAO,SAAS,OAAO,QAAQ,WAAW,KAAK,CAAC,CAAC,OAC/C,QAAQ,WAAW,qBAAqB;IACtC,UAAU,MAAM;IAChB,WAAW,QAAQ;IACnB,cAAc;IACd,YAAY,MAAM;IAClB,oBAAoB,UAAU;GAChC,CAAC,CACH;GACA,OAAO,SAAS,OAAO,QAAQ,oBAAoB,KAAK,CAAC,CAAC,OACxD,QAAQ,oBAAoB,aAAa;IACvC,WAAW,QAAQ;IACnB,cAAc;IACd,UAAU,UAAU;GACtB,CAAC,CACH;EACF,OAAO;GACL,MAAM,cAAc,QAAQ,iBAAiB,QAAQ,WAAW;GAEhE,OAAO,SACJ,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,IACC,QAAQ,WAAW,iBAAiB;IAClC,YAAY,MAAM;IAClB,oBAAoB,UAAU;GAChC,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,cAAc,kBAAkB,GACrC,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,oBAAoB,WAAW,CACtC,CACF;GACF,OAAO,SACJ,OAAO,QAAQ,oBAAoB,KAAK,CAAC,CACzC,IAAI,QAAQ,oBAAoB,iBAAiB,UAAU,wBAAwB,CAAC,CAAC,CACrF,MACC,IACE,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,cAAc,kBAAkB,GACrC,GAAG,EAAE,UAAU,WAAW,CAC5B,CACF;EACJ;EACA,OAAO,SACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,IAAI,aAAa,CAAC,CAAC,QAAQ,QAAQ,kBAAkB,UAAU,oBAAoB,CAAC,CAAC,CAAC,CAAC,CACvF,MACC,IACE,GAAG,EAAE,IAAI,QAAQ,eAAe,GAChC,GAAG,EAAE,kBAAkB,MAAM,SAAS,SAAS,gBAAgB,CACjE,CACF;EACF,OAAO,SAAS,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,OAC5C,QAAQ,QAAQ,aAAa;GAC3B,UAAU,MAAM;GAChB,WAAW,MAAM;GACjB;GACA,eAAe,MAAM,cAAc,UAAU;GAC7C,sBAAsB,MAAM,QAAQ;EACtC,CAAC,CACH;EAEA,MAAM,oBACJ,WAAW,mBACP,CAAC,IACD,OAAO,WACL,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,cAAc,QAAQ,OAAQ,SAAS,YAAY,GACxD,GAAG,EAAE,WAAW,QAAQ,eAAe,CACzC,CACF,GACF,KACF;EAEN,MAAM,UAAU,OAAO,gBAAgB,SAAS,MAAM,UAAU,MAAM,MAAM,EAAA,CAAG;EAE/E,MAAM,kBAAkB,OAAO,WAC7B,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,oBAAoB,KAAK,CAAC,CACvC,MACC,IAAI,GAAG,EAAE,WAAW,QAAQ,eAAe,GAAG,GAAG,EAAE,cAAc,kBAAkB,CAAC,CACtF,CAAC,CACA,MAAM,CAAC,GACV,KACF;EAEA,MAAM,UAAU,OAAO,WACrB,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MACC,IACE,GAAG,eAAe,OAAO,CAAC,CAAC,UAAU,MAAM,QAAQ,GACnD,GAAG,eAAe,OAAO,CAAC,CAAC,WAAW,MAAM,SAAS,GACrD,GAAG,eAAe,OAAO,CAAC,CAAC,QAAQ,MAAM,GACzC,GAAG,eAAe,OAAO,CAAC,CAAC,eAAe,MAAM,cAAc,UAAU,aAAa,GACrF,GACE,eAAe,OAAO,CAAC,CAAC,gBACxB,QAAQ,cAAc,MAAM,QAAQ,sBAAsB,CAC5D,CACF,CACF,CAAC,CACA,MAAM,CAAC,GACV,KACF;EAEA,MAAM,mBACJ,WAAW,KAAA,IACP,KAAA,IACA,OAAO,QAAQ,cAAc,OAAO,WAAW,QAAQ,WAAW,WAAW;EAEnF,MAAM,mBACJ,WAAW,mBACP,CAAC,IACD,OAAO,cAAc,SAAS,QAAQ,OAAQ,SAAS,YAAY,KAAK;EAE9E,MAAM,kBACJ,WAAW,mBACP,CAAC,IACD,OAAO,WACL,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,oBAAoB,KAAK,CAAC,CACvC,MACC,IACE,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,cAAc,QAAQ,OAAQ,SAAS,YAAY,CAC1D,CACF,CAAC,CACA,MAAM,CAAC,GACV,KACF;EAEN,OACE,WAAW,KAAA,KACX,QAAQ,UAAU,OAAO,OAAO,QAAQ,QAAQ,QAAQ,KAAK,QAAQ,eAAe,KACpF,QAAQ,QAAQ,eAAe,OAAO,QAAQ,QAAQ,QAAQ,OAAO,KACrE,OAAO,QAAQ,QAAQ,QAAQ,sBAAsB,UAAU,wBAC/D,OAAO,WAAW,QAAQ,WAAW,qBACnC,UAAU,4BACZ,qBAAqB,OACrB,OAAO,WAAW,QAAQ,WAAW,wBACnC,UAAU,4BACZ,OAAO,WAAW,QAAQ,WAAW,kBAAkB,sBACvD,QAAQ,UAAU,OAChB,OAAO,WAAW,QAAQ,WAAW,YACrC,QAAQ,eACV,KACA,QAAQ,WAAW,UAAU,OAAO,UAAU,KAC9C,QAAQ,WAAW,eAAe,OAAO,WAAW,QAAQ,WAAW,OAAO,KAC9E,gBAAgB,WAAW,KAC3B,gBAAgB,EAAE,CAAE,QAAQ,oBAAoB,cAC9C,UAAU,4BACZ,QAAQ,oBAAoB,eAC1B,gBAAgB,EAAE,CAAE,QAAQ,oBAAoB,OAClD,KACA,QAAQ,WAAW,MAClB,WAAW,oBACT,kBAAkB,WAAW,KAC5B,kBAAkB,EAAE,CAAE,QAAQ,WAAW,wBACvC,UAAU,4BACZ,CAAC,QAAQ,WAAW,eAAe,kBAAkB,EAAE,CAAE,QAAQ,WAAW,OAAO,KACnF,iBAAiB,WAAW,KAC5B,QAAQ,UAAU,OAChB,iBAAiB,EAAE,CAAE,QAAQ,WAAW,YACxC,QAAQ,eACV,KACA,iBAAiB,EAAE,CAAE,QAAQ,WAAW,qBACtC,UAAU,4BACZ,CAAC,QAAQ,WAAW,UAAU,iBAAiB,EAAG,KAClD,gBAAgB,WAAW,KAC3B,gBAAgB,EAAE,CAAE,QAAQ,oBAAoB,cAC9C,UAAU,4BACZ,CAAC,QAAQ,oBAAoB,eAC3B,gBAAgB,EAAE,CAAE,QAAQ,oBAAoB,OAClD;CAER,CAAC;CAED,MAAM,uBAAuB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACrE,eACA,OACA;EACA,MAAM,WAAW,OAAO;EAExB,IAAI,cAAc,UAAU,KAAA,GAAW,OAAO,OAAO,OAAO,KAAK,YAAY,CAAC;EAC9E,MAAM,aAAa,EAAE,MAAM,4BAA4B;EAEvD,MAAM,OAAO;GACX;GACA,UACE,UACA,SACA,YACG,QAAQ,QAAQ,QAAQ,QAAQ,CAAC;EACxC;EAkBA,OAAO,OAhBO,uBAEV,SAAS,aAAa,gBACpB,oBACE,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MACA,OAAO,KAAK,UAAU,SAChB,KACR,CAAC,CAAC,KACA,OAAO,eAAe,iBAAiB,WAA0C,CACnF,CACF,GACF,EAAE,MAAM,cAAc,KAAK,CAGX,CAAC,CAAC,KAClB,OAAO,GAAG,KAAK,GACf,OAAO,YAAY,UAAU;GAC3B,MAAM,SAAS,MAAM,QAAQ;GAE7B,OAAO,MAAM,QAAQ,WAAW,KAC9B,WAAW,KAAA,KACX,MAAM,aAAa,MAAM,KACzB,OAAO,UAAU,aACf,OAAO,QAAQ,IAAI,IACnB,OAAO,UAAU,KAAK;EAC5B,CAAC,CACH;CACF,CAAC;CAED,MAAM,kBAAkB,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,eACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,OAAO,OAAO,MACZ,UACA,eACA,OAAO,IAAI,aAAa;GACtB,MAAM,UAAU,OAAO;GAEvB,OAAO,OAAO,OAAO,QAAQ,QAAQ,YAAY,OAAO,CAAC;EAC3D,CAAC,CACH;CACF,CAAC;CAED,MAAM,iCAAiC,OAAO,GAAG,gCAAgC,CAAC,CAAC,WACjF,SACA,eAC+F;EAC/F,MAAM,WAAW,OAAO;EACxB,MAAM,QAAQ,OAAO;EAErB,OAAO,wBAAwB,GAAG;GAChC,SAAS,WACN,wBAAwB,OAAO,IAC5B,SACE,UACA,eACA,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO,eAAe,SAAS,OAAO,cAAc,OAAO;IAE3E,IAAI,YAAY,KAAA,GAAW,OAAO,OAAO,YAAY;IAErD,OAAO,OAAO,OAAO;KACnB,UAAU,sBAAsB,QAAQ,QAAQ;KAChD,UAAU,QAAQ;KAClB,GAAI,QAAQ,6BAA6B,KAAA,IACrC,CAAC,IACD,EAAE,0BAA0B,QAAQ,yBAAyB;KACjE,GAAI,QAAQ,WAAW,KAAA,IACnB,CAAC,IACD,EAAE,QAAQ,OAAO,wBAAwB,QAAQ,OAAO,QAAQ,EAAE;IACxE,CAAC;GACH,CAAC,CACH,IACA,OAAO,KAAK,YAAY,CAAC,EAAA,CAC3B,KACA,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,kBAAkB,UAAU;IAC1B,IAAI,cAAc,UAAU,KAAA,KAAa,MAAM,QAAQ,SAAS,oBAC9D,OAAO,OAAO,QAAQ,KAAK,CAAC,CAAC,KAC3B,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;IACF,MAAM,UAAU,MAAM;IAEtB,OAAO,SACL,UACA,eACA,OAAO,IAAI,aAAa;KACtB,MAAM,SACJ,MAAM,SAAS,SAAS,iBAAiB,KACzC,MAAM,YAAY,+BACd,mBACA,MAAM,SAAS,SAAS,iBAAiB,KACvC,MAAM,YAAY,yBAClB,mBACA,KAAA;KAER,IAAI,WAAW,KAAA,GAAW,OAAO;KACjC,MAAM,WAAW,MAAM,SAAS,MAAM,GAAG,CAAC,IAAI,SAAS,MAAM;KAE7D,MAAM,UAAU,OAAO,eACrB,SACA;MACE;MACA,WAAW,QAAQ,SAAS;MAC5B,QAAQ,QAAQ;KAClB,GACA,KACF;KAEA,OAAO,YAAY,KAAA,KAAa,kBAAkB,QAAQ,UAAU,QAAQ,QAAQ;IACtF,CAAC,CACH,CAAC,CACE,KACC,OAAO,SAAS,YACd,UAAU,qBAAqB,eAAe,KAAK,IAAI,OAAO,QAAQ,KAAK,CAC7E,CACF,CAAC,CACA,KACC,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACJ;GACA,kBAAkB,YAAY,YAC5B,cAAc,SAAS,eAAe,YAAY,kBAAkB,OAAO,CAAC,CAAC,KAC3E,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,kBAAkB,YAAY,YAC5B,cAAc,SAAS,eAAe,YAAY,kBAAkB,OAAO,CAAC,CAAC,KAC3E,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,UAAU,OAAO,YACf,MACE,UACA,eACA,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IAEvB,MAAM,IAAI,eAAe,OAAO;IAChC,MAAM,MAAM,OAAO;IAEnB,MAAM,OAAO,OAAO,WAClB,YACG,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAClC,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,IAAI,EAAE,gBAAgB,QAAQ,cAAc,GAAG,CAAC,CAClD,CACF,CAAC,CACA,MAAM,MAAM,QAAQ,CAAC,GACxB,cAAc,OAChB;IAEA,MAAM,WAAW,KAAK,MAAM,GAAG,MAAM,KAAK;IAE1C,MAAM,UAAU,QACd;KAAE,SAAS,SAAS;KAAQ,SAAS,KAAK,SAAS,MAAM;IAAM,GAC/D,OACF;IAEA,IAAI,SAAS,SAAS,GACpB,OAAO,YAAY,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,MAC/C,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,QACE,EAAE,WACF,SAAS,KAAK,QAAa,IAAI,SAAS,CAC1C,GACA,IAAI,EAAE,gBAAgB,QAAQ,cAAc,GAAG,CAAC,CAClD,CACF;IAEF,OAAO;GACT,CAAC,CACH,CAAC,CAAC,KACA,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACJ,CAAC;CACH,CAAC;CAED,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,eACA,YACA,QACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,IAAI,CAAC,wBAAwB,OAAO,KAAK,cAAc,UAAU,KAAA,GAC/D,OAAO,OAAO,YAAY;EAC5B,MAAM,QAAQ,OAAO,sBAAsB,UAAU;EAErD,MAAM,qBAAqB,OAAO,SAChC,cAAc,MACd,QAAQ,sBACR,QAAQ,wBACV;EAEA,MAAM,2BAA2B,OAAO,SACtC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;EAEA,MAAM,2BAA2B,OAAO,SACtC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;EAEA,MAAM,2BAA2B,OAAO,SACtC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;EAEA,MAAM,2BAA2B,OAAO,SACtC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;EAEA,MAAM,mBACJ,WAAW,oBAAoB,MAAM,SAAS,6BAA6B,KAAA;EAE7E,MAAM,eAAe,mBACjB,MAAM,SAAS,SAAS,mBACxB,OAAO,qBACL,SACA,cAAc,MACd,MAAM,SAAS,SAAS,gBAC1B;EAEJ,IACG,CAAC,oBAAoB,iBAAiB,MAAM,SAAS,SAAS,oBAC/D;GACE;GACA;GACA;GACA;EACF,CAAC,CAAC,MAAM,UAAU,MAAM,SAAS,SAAS,YAAY,MAAM,SAAS,KAAK,aAAa,KAAK,CAAC,GAE7F,OAAO,OAAO,YAAY;EAsE5B,OAAO,OApEK,MACV,UACA,eACA,OAAO,IAAI,aAAa;GACtB,MAAM,UAAU,OAAO;GAEvB,MAAM,UAAU,OAAO,uBAAuB,SAAS,eAAe,OAAO,MAAM;GAEnF,IAAI,YAAY,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;GAC7D,KACG,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,WAAW,cAAc,OAAO,EAAA,CAClF,SAAS,GAEZ,OAAO,QAAQ,YAAY,OAAO;GACpC,IAAI;GAEJ,OAAO,oBACL,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MAAM,YACN,OAAO,IAAI,aAAa;IAGtB,MAAM,qBAAqB,OAAO,QAAQ,QAAQ,wBAChD,QAAQ,SACR,MACF;IAEA,MAAM,WAAW,OAAO,qBACtB,MAAM,cAAc,UACpB,MAAM,cAAc,WACtB,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;IAEnC,MAAM,aAAa,OAAO,qBACxB,MAAM,cAAc,UACpB,kBACF,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;IAEnC,IAAI,CAAC,SAAS,aAAa,CAAC,WAAW,WAAW,OAAO;IACzD,MAAM,MAAM,OAAO;IAEnB,OAAO,OAAO,cACZ,SACA,OACA,QACA,SACA;KACE;KACA;KACA;KACA;KACA;KACA,sBAAsB;IACxB,GACA,GACF;GACF,CAAC,IACA,aAAa;IACZ,UAAU,QAAQ,aAAa,cAAc,YAAY,YAAY,OAAO;IAE5E,OAAO;GACT,CACF;GAEA,OAAO,WAAW,QAAQ,YAAY,OAAO;EAC/C,CAAC,CAGa,CAAC,CAAC,KAChB,OAAO,YAAY,UAChB,MAAM,QAAQ,MAAM,MAAM,YAAY,KACrC,2BAA2B,QAAQ,mBAAmB,KAAK,KAC5D,MAAM,QAAQ,MAAM,MAAM,YAAY,KACrC,2BAA2B,QAAQ,sBAAsB,KAAK,KAC/D,MAAM,QAAQ,MAAM,MAAM,YAAY,KACrC,2BAA2B,QAAQ,sBAAsB,KAAK,IAC5D,gBAAgB,eAAe,OAAO,IACtC,OAAO,UAAU,KAAK,CAC5B,CACF;CACF,CAAC;CAED,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF"}

package/dist/internal/models/email-model.d.mts

@@ -4,8 +4,8 @@ import { SubjectIdCodec } from "./common.mjs";
 import { Effect } from "effect";
 import { TokenDigest } from "@yielded/auth/Schema";
 import { AuthenticationRequirement, SecurityRevision } from "@yielded/auth/Sessions";
-import { EmailAction, EmailRegistrationDecision } from "@yielded/auth/Email";
 import { ProofBinding, ProofContinuationId, ProofPurpose } from "@yielded/auth/Proofs";
+import { EmailAction, EmailRegistrationDecision } from "@yielded/auth/Email";
 import { LoginIdentifier } from "@yielded/auth/Identity";
 //#region src/internal/models/email-model.d.ts
 type ColumnKey<T extends TableModel> = T["column"];

package/dist/internal/oauth-server.d.mts

@@ -1,5 +1,5 @@
 import { Layer } from "effect";
-import { SqlClient } from "effect/unstable/sql";
+import { SqlClient } from "effect/sql";
 import { Persistence, Unavailable } from "@yielded/auth/OAuthServer";
 //#region src/internal/oauth-server.d.ts
 export declare const OAuthServerPersistence: {

package/dist/internal/oauth-server.mjs

@@ -1,6 +1,6 @@
 import { requireStandalone } from "./standalone.mjs";
 import { Effect, Layer, Schema } from "effect";
-import { SqlClient } from "effect/unstable/sql";
+import { SqlClient } from "effect/sql";
 import { Persistence, Record, Unavailable } from "@yielded/auth/OAuthServer";
 //#region src/internal/oauth-server.ts
 const codec = Schema.fromJsonString(Record);
@@ -26,7 +26,7 @@ const OAuthServerPersistence = {
 			pg: () => true,
 			orElse: () => false
 		})) return yield* Unavailable.make({});
-		const standalone = requireStandalone(() => Unavailable.make({}), sql);
+		const standalone = requireStandalone(() => Unavailable.make({}), sql.transactionService);
 		const failure = (effect) => effect.pipe(Effect.mapError(() => Unavailable.make({})));
 		return Persistence.of({
 			get: Effect.fn("OAuthServerPersistence.get")(function* (namespace, id) {

package/dist/internal/oauth-server.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-server.mjs","names":[],"sources":["../../src/internal/oauth-server.ts"],"sourcesContent":["import { Persistence, Record, Unavailable } from \"@yielded/auth/OAuthServer\";\nimport { Effect, Layer, Schema } from \"effect\";\nimport { SqlClient } from \"effect/unstable/sql\";\n\nimport { requireStandalone } from \"./standalone\";\n\nconst codec = Schema.fromJsonString(Record);\n\nconst Row = Schema.Struct({\n  payload: Schema.String,\n  version: Schema.String,\n  revoked: Schema.Literals([0, 1]),\n});\n\n/** SQLite (including D1) and PostgreSQL. Apply once through application migrations.\n * Expired records may be deleted when expires_at_millis <= the current time.\n * Revocation has its own monotonic column so it cannot lose a race with rotation.\n */\nconst migration = `CREATE TABLE yielded_oauth_server (\n  namespace TEXT NOT NULL,\n  grant_id TEXT NOT NULL,\n  version TEXT NOT NULL,\n  revoked INTEGER NOT NULL DEFAULT 0,\n  expires_at_millis BIGINT NOT NULL,\n  payload TEXT NOT NULL,\n  PRIMARY KEY (namespace, grant_id)\n)`;\n\nconst layer = Layer.effect(\n  Persistence,\n  Effect.gen(function* () {\n    const sql = yield* SqlClient.SqlClient;\n\n    if (!sql.onDialectOrElse({ sqlite: () => true, pg: () => true, orElse: () => false }))\n      return yield* Unavailable.make({});\n    const standalone = requireStandalone(() => Unavailable.make({}), sql);\n\n    const failure = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n      effect.pipe(Effect.mapError(() => Unavailable.make({})));\n\n    return Persistence.of({\n      get: Effect.fn(\"OAuthServerPersistence.get\")(function* (namespace, id) {\n        yield* standalone;\n\n        const rows =\n          yield* sql`SELECT payload, version, revoked FROM yielded_oauth_server WHERE namespace = ${namespace} AND grant_id = ${id}`;\n\n        if (rows.length === 0) return undefined;\n        if (rows.length !== 1) return yield* Unavailable.make({});\n        const row = yield* Schema.decodeUnknownEffect(Row)(rows[0]);\n        const record = yield* Schema.decodeEffect(codec)(row.payload);\n\n        if (record.version !== row.version) return yield* Unavailable.make({});\n\n        return row.revoked === 1 ? { ...record, status: \"Revoked\" as const } : record;\n      }, failure),\n      insert: Effect.fn(\"OAuthServerPersistence.insert\")(function* (namespace, id, record) {\n        yield* standalone;\n        const payload = yield* Schema.encodeEffect(codec)(record);\n\n        const rows =\n          yield* sql`INSERT INTO yielded_oauth_server (namespace, grant_id, version, revoked, expires_at_millis, payload) VALUES (${namespace}, ${id}, ${record.version}, ${record.status === \"Revoked\" ? 1 : 0}, ${record.expiresAtMillis}, ${payload}) ON CONFLICT (namespace, grant_id) DO NOTHING RETURNING version`;\n\n        return rows.length === 1;\n      }, failure),\n      compareAndSet: Effect.fn(\"OAuthServerPersistence.compareAndSet\")(function* (\n        namespace,\n        id,\n        version,\n        record,\n      ) {\n        yield* standalone;\n        if (version === record.version) return yield* Unavailable.make({});\n        const payload = yield* Schema.encodeEffect(codec)(record);\n\n        const rows =\n          yield* sql`UPDATE yielded_oauth_server SET version = ${record.version}, revoked = ${record.status === \"Revoked\" ? 1 : 0}, expires_at_millis = ${record.expiresAtMillis}, payload = ${payload} WHERE namespace = ${namespace} AND grant_id = ${id} AND version = ${version} AND revoked = 0 RETURNING version`;\n\n        return rows.length === 1;\n      }, failure),\n      revoke: Effect.fn(\"OAuthServerPersistence.revoke\")(function* (namespace, id) {\n        yield* standalone;\n        yield* sql`UPDATE yielded_oauth_server SET revoked = 1 WHERE namespace = ${namespace} AND grant_id = ${id}`;\n      }, failure),\n    });\n  }),\n);\n\nexport const OAuthServerPersistence = { migration, layer };\n"],"mappings":";;;;;AAMA,MAAM,QAAQ,OAAO,eAAe,MAAM;AAE1C,MAAM,MAAM,OAAO,OAAO;CACxB,SAAS,OAAO;CAChB,SAAS,OAAO;CAChB,SAAS,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AA4ED,MAAa,yBAAyB;CAAE;;;;;;;;;CAAW,OA5DrC,MAAM,OAClB,aACA,OAAO,IAAI,aAAa;EACtB,MAAM,MAAM,OAAO,UAAU;EAE7B,IAAI,CAAC,IAAI,gBAAgB;GAAE,cAAc;GAAM,UAAU;GAAM,cAAc;EAAM,CAAC,GAClF,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;EACnC,MAAM,aAAa,wBAAwB,YAAY,KAAK,CAAC,CAAC,GAAG,GAAG;EAEpE,MAAM,WAAoB,WACxB,OAAO,KAAK,OAAO,eAAe,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC;EAEzD,OAAO,YAAY,GAAG;GACpB,KAAK,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAAW,WAAW,IAAI;IACrE,OAAO;IAEP,MAAM,OACJ,OAAO,GAAG,gFAAgF,UAAU,kBAAkB;IAExH,IAAI,KAAK,WAAW,GAAG,OAAO,KAAA;IAC9B,IAAI,KAAK,WAAW,GAAG,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;IACxD,MAAM,MAAM,OAAO,OAAO,oBAAoB,GAAG,CAAC,CAAC,KAAK,EAAE;IAC1D,MAAM,SAAS,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC,IAAI,OAAO;IAE5D,IAAI,OAAO,YAAY,IAAI,SAAS,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;IAErE,OAAO,IAAI,YAAY,IAAI;KAAE,GAAG;KAAQ,QAAQ;IAAmB,IAAI;GACzE,GAAG,OAAO;GACV,QAAQ,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAAW,WAAW,IAAI,QAAQ;IACnF,OAAO;IACP,MAAM,UAAU,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC,MAAM;IAKxD,QAAO,OAFE,GAAG,gHAAgH,UAAU,IAAI,GAAG,IAAI,OAAO,QAAQ,IAAI,OAAO,WAAW,YAAY,IAAI,EAAE,IAAI,OAAO,gBAAgB,IAAI,QAAQ,kEAAA,CAEnO,WAAW;GACzB,GAAG,OAAO;GACV,eAAe,OAAO,GAAG,sCAAsC,CAAC,CAAC,WAC/D,WACA,IACA,SACA,QACA;IACA,OAAO;IACP,IAAI,YAAY,OAAO,SAAS,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;IACjE,MAAM,UAAU,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC,MAAM;IAKxD,QAAO,OAFE,GAAG,6CAA6C,OAAO,QAAQ,cAAc,OAAO,WAAW,YAAY,IAAI,EAAE,wBAAwB,OAAO,gBAAgB,cAAc,QAAQ,qBAAqB,UAAU,kBAAkB,GAAG,iBAAiB,QAAQ,oCAAA,CAEhQ,WAAW;GACzB,GAAG,OAAO;GACV,QAAQ,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAAW,WAAW,IAAI;IAC3E,OAAO;IACP,OAAO,GAAG,iEAAiE,UAAU,kBAAkB;GACzG,GAAG,OAAO;EACZ,CAAC;CACH,CAAC,CAGgD;AAAM"}
+{"version":3,"file":"oauth-server.mjs","names":[],"sources":["../../src/internal/oauth-server.ts"],"sourcesContent":["import { Persistence, Record, Unavailable } from \"@yielded/auth/OAuthServer\";\nimport { Effect, Layer, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\n\nimport { requireStandalone } from \"./standalone\";\n\nconst codec = Schema.fromJsonString(Record);\n\nconst Row = Schema.Struct({\n  payload: Schema.String,\n  version: Schema.String,\n  revoked: Schema.Literals([0, 1]),\n});\n\n/** SQLite (including D1) and PostgreSQL. Apply once through application migrations.\n * Expired records may be deleted when expires_at_millis <= the current time.\n * Revocation has its own monotonic column so it cannot lose a race with rotation.\n */\nconst migration = `CREATE TABLE yielded_oauth_server (\n  namespace TEXT NOT NULL,\n  grant_id TEXT NOT NULL,\n  version TEXT NOT NULL,\n  revoked INTEGER NOT NULL DEFAULT 0,\n  expires_at_millis BIGINT NOT NULL,\n  payload TEXT NOT NULL,\n  PRIMARY KEY (namespace, grant_id)\n)`;\n\nconst layer = Layer.effect(\n  Persistence,\n  Effect.gen(function* () {\n    const sql = yield* SqlClient.SqlClient;\n\n    if (!sql.onDialectOrElse({ sqlite: () => true, pg: () => true, orElse: () => false }))\n      return yield* Unavailable.make({});\n    const standalone = requireStandalone(() => Unavailable.make({}), sql.transactionService);\n\n    const failure = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n      effect.pipe(Effect.mapError(() => Unavailable.make({})));\n\n    return Persistence.of({\n      get: Effect.fn(\"OAuthServerPersistence.get\")(function* (namespace, id) {\n        yield* standalone;\n\n        const rows =\n          yield* sql`SELECT payload, version, revoked FROM yielded_oauth_server WHERE namespace = ${namespace} AND grant_id = ${id}`;\n\n        if (rows.length === 0) return undefined;\n        if (rows.length !== 1) return yield* Unavailable.make({});\n        const row = yield* Schema.decodeUnknownEffect(Row)(rows[0]);\n        const record = yield* Schema.decodeEffect(codec)(row.payload);\n\n        if (record.version !== row.version) return yield* Unavailable.make({});\n\n        return row.revoked === 1 ? { ...record, status: \"Revoked\" as const } : record;\n      }, failure),\n      insert: Effect.fn(\"OAuthServerPersistence.insert\")(function* (namespace, id, record) {\n        yield* standalone;\n        const payload = yield* Schema.encodeEffect(codec)(record);\n\n        const rows =\n          yield* sql`INSERT INTO yielded_oauth_server (namespace, grant_id, version, revoked, expires_at_millis, payload) VALUES (${namespace}, ${id}, ${record.version}, ${record.status === \"Revoked\" ? 1 : 0}, ${record.expiresAtMillis}, ${payload}) ON CONFLICT (namespace, grant_id) DO NOTHING RETURNING version`;\n\n        return rows.length === 1;\n      }, failure),\n      compareAndSet: Effect.fn(\"OAuthServerPersistence.compareAndSet\")(function* (\n        namespace,\n        id,\n        version,\n        record,\n      ) {\n        yield* standalone;\n        if (version === record.version) return yield* Unavailable.make({});\n        const payload = yield* Schema.encodeEffect(codec)(record);\n\n        const rows =\n          yield* sql`UPDATE yielded_oauth_server SET version = ${record.version}, revoked = ${record.status === \"Revoked\" ? 1 : 0}, expires_at_millis = ${record.expiresAtMillis}, payload = ${payload} WHERE namespace = ${namespace} AND grant_id = ${id} AND version = ${version} AND revoked = 0 RETURNING version`;\n\n        return rows.length === 1;\n      }, failure),\n      revoke: Effect.fn(\"OAuthServerPersistence.revoke\")(function* (namespace, id) {\n        yield* standalone;\n        yield* sql`UPDATE yielded_oauth_server SET revoked = 1 WHERE namespace = ${namespace} AND grant_id = ${id}`;\n      }, failure),\n    });\n  }),\n);\n\nexport const OAuthServerPersistence = { migration, layer };\n"],"mappings":";;;;;AAMA,MAAM,QAAQ,OAAO,eAAe,MAAM;AAE1C,MAAM,MAAM,OAAO,OAAO;CACxB,SAAS,OAAO;CAChB,SAAS,OAAO;CAChB,SAAS,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AA4ED,MAAa,yBAAyB;CAAE;;;;;;;;;CAAW,OA5DrC,MAAM,OAClB,aACA,OAAO,IAAI,aAAa;EACtB,MAAM,MAAM,OAAO,UAAU;EAE7B,IAAI,CAAC,IAAI,gBAAgB;GAAE,cAAc;GAAM,UAAU;GAAM,cAAc;EAAM,CAAC,GAClF,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;EACnC,MAAM,aAAa,wBAAwB,YAAY,KAAK,CAAC,CAAC,GAAG,IAAI,kBAAkB;EAEvF,MAAM,WAAoB,WACxB,OAAO,KAAK,OAAO,eAAe,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC;EAEzD,OAAO,YAAY,GAAG;GACpB,KAAK,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAAW,WAAW,IAAI;IACrE,OAAO;IAEP,MAAM,OACJ,OAAO,GAAG,gFAAgF,UAAU,kBAAkB;IAExH,IAAI,KAAK,WAAW,GAAG,OAAO,KAAA;IAC9B,IAAI,KAAK,WAAW,GAAG,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;IACxD,MAAM,MAAM,OAAO,OAAO,oBAAoB,GAAG,CAAC,CAAC,KAAK,EAAE;IAC1D,MAAM,SAAS,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC,IAAI,OAAO;IAE5D,IAAI,OAAO,YAAY,IAAI,SAAS,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;IAErE,OAAO,IAAI,YAAY,IAAI;KAAE,GAAG;KAAQ,QAAQ;IAAmB,IAAI;GACzE,GAAG,OAAO;GACV,QAAQ,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAAW,WAAW,IAAI,QAAQ;IACnF,OAAO;IACP,MAAM,UAAU,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC,MAAM;IAKxD,QAAO,OAFE,GAAG,gHAAgH,UAAU,IAAI,GAAG,IAAI,OAAO,QAAQ,IAAI,OAAO,WAAW,YAAY,IAAI,EAAE,IAAI,OAAO,gBAAgB,IAAI,QAAQ,kEAAA,CAEnO,WAAW;GACzB,GAAG,OAAO;GACV,eAAe,OAAO,GAAG,sCAAsC,CAAC,CAAC,WAC/D,WACA,IACA,SACA,QACA;IACA,OAAO;IACP,IAAI,YAAY,OAAO,SAAS,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;IACjE,MAAM,UAAU,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC,MAAM;IAKxD,QAAO,OAFE,GAAG,6CAA6C,OAAO,QAAQ,cAAc,OAAO,WAAW,YAAY,IAAI,EAAE,wBAAwB,OAAO,gBAAgB,cAAc,QAAQ,qBAAqB,UAAU,kBAAkB,GAAG,iBAAiB,QAAQ,oCAAA,CAEhQ,WAAW;GACzB,GAAG,OAAO;GACV,QAAQ,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAAW,WAAW,IAAI;IAC3E,OAAO;IACP,OAAO,GAAG,iEAAiE,UAAU,kBAAkB;GACzG,GAAG,OAAO;EACZ,CAAC;CACH,CAAC,CAGgD;AAAM"}

package/dist/internal/passkey/state.mjs

@@ -1,9 +1,10 @@
 import { requiredPasskeyCredentialConstraints, requiredPasskeyPersistenceConstraints } from "../models/passkey-model.mjs";
 import { requiredPasskeyRegistrationCeremonyConstraints } from "../models/passkey-registration-ceremony-model.mjs";
-import { Context, Effect, Encoding, Schema } from "effect";
+import { Context, Effect, Schema } from "effect";
 import { PasskeyCeremony, PasskeyConfigurationError, PasskeyCredential, PasskeyMethodPolicy, PasskeyModuleId, PasskeyProfile, PasskeyRevision, PasskeyUnavailable, snapshotPasskeySync } from "@yielded/auth/Passkey";
 import { sha256 } from "@noble/hashes/sha2.js";
 import { randomBytes } from "@noble/hashes/utils.js";
+import { Base64Url } from "effect/encoding";
 //#region src/internal/passkey/state.ts
 var CurrentPasskeyTransaction = class extends Context.Service()("effect-auth/drizzle/CurrentPasskeyTransaction") {};
 const makePasskeyStateKernel = (operations, transactions) => {
@@ -14,7 +15,7 @@ const makePasskeyStateKernel = (operations, transactions) => {
 		if (!value) throw unavailable();
 	};
 	const { col, equal, copiedRow, matchesNativeRow } = makeTransactionRows(unavailable);
-	const nonce = () => Encoding.encodeBase64Url(randomBytes(32));
+	const nonce = () => Base64Url.encode(randomBytes(32));
 	const encoder = new TextEncoder();
 	const decoder = new TextDecoder("utf-8", { fatal: true });
 	/** RP tuples and admission scopes have no collation-dependent string identity. */

package/dist/internal/passkey/state.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"state.mjs","names":[],"sources":["../../../src/internal/passkey/state.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- existing mapped-row bridge; public adapters preserve table, ID, and Effect types. */\n\n// oxlint-disable-next-line import/extensions -- Noble exposes its explicit .js subpaths.\nimport { sha256 } from \"@noble/hashes/sha2.js\";\n// oxlint-disable-next-line import/extensions -- Noble exposes its explicit .js subpaths.\nimport { randomBytes } from \"@noble/hashes/utils.js\";\nimport {\n  PasskeyConfigurationError,\n  PasskeyUnavailable,\n  PasskeyCeremony,\n  PasskeyCredential,\n  PasskeyModuleId,\n  PasskeyProfile,\n  PasskeyRevision,\n  PasskeyMethodPolicy,\n  snapshotPasskeySync,\n} from \"@yielded/auth/Passkey\";\nimport { Context, Effect, Encoding, Schema } from \"effect\";\n\nimport {\n  requiredPasskeyCredentialConstraints,\n  requiredPasskeyPersistenceConstraints,\n} from \"../models/passkey-model\";\nimport { requiredPasskeyRegistrationCeremonyConstraints } from \"../models/passkey-registration-ceremony-model\";\nimport type { SqlExpression as SQL, QueryOperations } from \"../query-operations\";\nimport type { TransactionOwner, makeTransactionKernel } from \"../transaction-kernel\";\n\nexport type PasskeyOwner = TransactionOwner<PasskeyUnavailable>;\n\nexport class CurrentPasskeyTransaction extends Context.Service<\n  CurrentPasskeyTransaction,\n  PasskeyOwner\n>()(\"effect-auth/drizzle/CurrentPasskeyTransaction\") {}\n\nexport const makePasskeyStateKernel = (\n  operations: QueryOperations,\n  transactions: Pick<ReturnType<typeof makeTransactionKernel>, \"both\" | \"makeTransactionRows\">,\n) => {\n  const { getTableColumns, sql } = operations;\n  const { both, makeTransactionRows } = transactions;\n\n  const unavailable = () => PasskeyUnavailable.make({});\n\n  const invariant: (value: unknown) => asserts value = (value) => {\n    if (!value) throw unavailable();\n  };\n\n  const { col, equal, copiedRow, matchesNativeRow } = makeTransactionRows(unavailable);\n\n  const nonce = () => Encoding.encodeBase64Url(randomBytes(32));\n\n  const encoder = new TextEncoder();\n\n  const decoder = new TextDecoder(\"utf-8\", { fatal: true });\n\n  /** RP tuples and admission scopes have no collation-dependent string identity. */\n  const key = (kind: string, fields: ReadonlyArray<string>) => {\n    const values = [\"effect-auth/passkey/\" + kind + \"/v1\", ...fields].map((field) => {\n      const bytes = encoder.encode(field);\n\n      invariant(decoder.decode(bytes) === field);\n\n      return bytes;\n    });\n\n    const packed = new Uint8Array(values.reduce((size, bytes) => size + 4 + bytes.length, 0));\n    const view = new DataView(packed.buffer);\n    let offset = 0;\n\n    for (const bytes of values) {\n      view.setUint32(offset, bytes.length, false);\n      packed.set(bytes, offset + 4);\n      offset += 4 + bytes.length;\n    }\n\n    return (\n      \"v1:\" + Array.from(sha256(packed), (value) => value.toString(16).padStart(2, \"0\")).join(\"\")\n    );\n  };\n\n  const credentialKey = (rpId: string, id: string) => key(\"credential\", [rpId, id]);\n\n  const handleKey = (rpId: string, handle: string) => key(\"handle\", [rpId, handle]);\n\n  const subjectScope = (subjectId: string) => key(\"subject\", [subjectId]);\n\n  const targetScope = (ceremony: PasskeyCeremony) => {\n    const context = ceremony.context;\n\n    if (!(\"target\" in context)) return null;\n    const target = context.target;\n\n    return key(\"target\", [\n      target.moduleId,\n      target.kind,\n      target.flowId,\n      target.commandId,\n      target.bindingDigest,\n      target.revision.subjectId,\n    ]);\n  };\n\n  /** Private storage is decoded Type data, never a consumer wire transform. */\n  const storage = <S extends Schema.Codec<unknown, unknown, never, never>>(\n    schema: S,\n    maximumBytes: number,\n  ) => {\n    const codec = Schema.fromJsonString(Schema.toCodecJson(Schema.toType(schema)));\n\n    const encode = (value: S[\"Type\"]) => {\n      const text = \"v1:\" + Schema.encodeSync(codec)(snapshotPasskeySync(schema, value));\n\n      invariant(encoder.encode(text).length <= maximumBytes);\n\n      return text;\n    };\n\n    return {\n      encode,\n      decode: (text: unknown): S[\"Type\"] => {\n        invariant(typeof text === \"string\" && text.startsWith(\"v1:\"));\n        invariant(encoder.encode(text).length <= maximumBytes);\n        const value = snapshotPasskeySync(schema, Schema.decodeSync(codec)(text.slice(3)));\n\n        invariant(encode(value) === text);\n\n        return value;\n      },\n    };\n  };\n\n  // Legal 32 x 16 x 2048 origins require more than one MiB before JSON escaping.\n  const policyStorage = storage(PasskeyMethodPolicy, 8 * 1024 * 1024);\n\n  const ceremonyStorage = storage(PasskeyCeremony, 512 * 1024);\n\n  const credentialStorage = storage(PasskeyCredential, 512 * 1024);\n\n  const profileStorage = storage(PasskeyProfile, 256 * 1024);\n\n  const revisionStorage = storage(PasskeyRevision, 256 * 1024);\n\n  const sameCredential = (left: PasskeyCredential, right: PasskeyCredential) => {\n    const semantic = (value: PasskeyCredential) => ({\n      ...value,\n      counter: 0,\n      maximumCounter: 0,\n      backupState: false,\n      revision: { ...value.revision, credentials: [] },\n    });\n\n    return credentialStorage.encode(semantic(left)) === credentialStorage.encode(semantic(right));\n  };\n\n  const sameRevision = (left: typeof PasskeyRevision.Type, right: typeof PasskeyRevision.Type) => {\n    const pairs = new Map(left.credentials.map((item) => [item.credentialId, item.revision]));\n\n    return (\n      left.subjectId === right.subjectId &&\n      left.securityRevision === right.securityRevision &&\n      pairs.size === left.credentials.length &&\n      new Set(right.credentials.map((item) => item.credentialId)).size ===\n        right.credentials.length &&\n      pairs.size === right.credentials.length &&\n      right.credentials.every((item) => pairs.get(item.credentialId) === item.revision)\n    );\n  };\n\n  const semanticCredentialColumns = (mapping: any): string[] =>\n    [\n      \"credentialId\",\n      \"subjectId\",\n      \"rpId\",\n      \"protocolCredentialId\",\n      \"credentialKey\",\n      \"handleKey\",\n      \"userHandle\",\n      \"publicKey\",\n      \"algorithm\",\n      \"profile\",\n      \"credentialRevision\",\n      \"status\",\n      \"primarySignIn\",\n      \"enrollmentUserVerified\",\n      \"backupEligible\",\n    ].map((name) => mapping[name]);\n\n  const mappedColumns = (mapping: any): string[] =>\n    Object.entries(mapping)\n      .filter(\n        ([name, value]) =>\n          ![\"table\", \"reservedState\", \"pendingState\", \"acceptedState\", \"rejectedState\"].includes(\n            name,\n          ) && typeof value === \"string\",\n      )\n      .map(([, value]) => value as string);\n\n  const observeSemantic = (mapping: any, where: SQL, row: any) =>\n    Effect.map(CurrentPasskeyTransaction, (owner) => {\n      owner.observations.push({\n        table: mapping.table,\n        where,\n        rows: [\n          Object.fromEntries(\n            semanticCredentialColumns(mapping).map((column) => [column, row[column]]),\n          ),\n        ],\n      });\n    });\n\n  /** Capture descriptor graphs, preserving native SQL expressions and table objects. */\n  const captureMapping = <A>(input: A): A => {\n    const seen = new Map<object, unknown>();\n\n    const copy = (value: unknown): unknown => {\n      if (value === null || typeof value !== \"object\" || Effect.isEffect(value)) return value;\n      if (!Array.isArray(value) && Object.getPrototypeOf(value) !== Object.prototype) return value;\n      const prior = seen.get(value);\n\n      if (prior !== undefined) return prior;\n      const result: any = Array.isArray(value) ? [] : {};\n\n      seen.set(value, result);\n      for (const [name, child] of Object.entries(value)) result[name] = copy(child);\n\n      return Object.freeze(result);\n    };\n\n    return copy(input) as A;\n  };\n\n  const constraints = (actual: any, expected: any) => {\n    for (const [name, columns] of Object.entries(expected))\n      // oxlint-disable-next-line no-restricted-properties -- exact configured constraint descriptor fingerprint.\n      invariant(JSON.stringify(actual?.[name]) === JSON.stringify(columns));\n  };\n\n  const descriptor = (value: any) => {\n    const columns = getTableColumns(value.table);\n\n    for (const name of mappedColumns(value)) invariant(columns[name] !== undefined);\n  };\n\n  const validateMapping = (\n    mapping: any,\n    kind: \"read\" | \"context\" | \"assertion\" | \"registration\",\n  ) => {\n    try {\n      const read = kind === \"read\" ? mapping : kind !== \"registration\" ? mapping.read : undefined;\n\n      if (read !== undefined) {\n        for (const name of [\n          \"subject\",\n          \"credential\",\n          \"authority\",\n          \"credentialOwnership\",\n          \"handleOwnership\",\n        ])\n          descriptor(read[name]);\n        constraints(read.constraints, requiredPasskeyCredentialConstraints);\n      }\n      if (kind === \"read\") return;\n      // oxlint-disable-next-line no-restricted-properties -- validate the untyped captured configuration boundary.\n      Schema.decodeUnknownSync(PasskeyModuleId)(mapping.moduleId);\n      descriptor(mapping.module);\n      invariant(mapping.module.policyColumns.length > 0);\n      for (const name of mapping.module.policyColumns) col(mapping.module.table, name);\n      const scopes = new Set<string>();\n\n      for (const guard of mapping.module.guards ?? []) {\n        invariant(\n          typeof guard.scope === \"string\" && guard.scope.length > 0 && guard.scope.length <= 256,\n        );\n        invariant(!scopes.has(guard.scope) && guard.columns.length > 0);\n        scopes.add(guard.scope);\n        for (const name of guard.columns) col(guard.table, name);\n      }\n      invariant(scopes.size <= 32);\n      if (kind === \"context\") return;\n      invariant(\n        typeof mapping.authorityScope === \"string\" &&\n          mapping.authorityScope.length > 0 &&\n          mapping.authorityScope.length <= 256,\n      );\n      for (const name of [\"flow\", \"admission\", \"charge\"]) descriptor(mapping[name]);\n      if (kind === \"registration\") {\n        descriptor(mapping.intent);\n        descriptor(mapping.handle);\n      } else col(mapping.read.credential.table, mapping.telemetry.lastUsedAt);\n      constraints(\n        mapping.constraints,\n        kind === \"registration\"\n          ? requiredPasskeyRegistrationCeremonyConstraints\n          : requiredPasskeyPersistenceConstraints,\n      );\n      const states = Object.values(mapping.flow.states);\n\n      // oxlint-disable-next-line no-restricted-properties -- configured native state identity fingerprints.\n      invariant(\n        // oxlint-disable-next-line no-restricted-properties -- configured native state identity fingerprints.\n        states.length === 7 && new Set(states.map((value) => JSON.stringify(value))).size === 7,\n      );\n      for (const value of [0, 1, 123456789, 8640000000000])\n        invariant(mapping.clock.decodeInstant(mapping.clock.encodeInstant(value)) === value);\n    } catch {\n      throw PasskeyConfigurationError.make({});\n    }\n  };\n\n  const assertNow = (condition: SQL) =>\n    Effect.flatMap(CurrentPasskeyTransaction, (owner) =>\n      Effect.gen(function* () {\n        invariant(yield* owner.check(condition));\n        owner.postconditions.push(condition);\n      }),\n    );\n\n  const existsExact = (table: any, values: any, condition?: SQL) =>\n    Effect.map(\n      CurrentPasskeyTransaction,\n      (owner) =>\n        sql`exists(select 1 from ${table} where ${both(owner.exact(table, values), condition)})`,\n    );\n\n  return {\n    unavailable,\n    invariant,\n    col,\n    equal,\n    copiedRow,\n    matchesNativeRow,\n    nonce,\n    key,\n    credentialKey,\n    handleKey,\n    subjectScope,\n    targetScope,\n    policyStorage,\n    ceremonyStorage,\n    credentialStorage,\n    profileStorage,\n    revisionStorage,\n    sameCredential,\n    sameRevision,\n    semanticCredentialColumns,\n    mappedColumns,\n    observeSemantic,\n    captureMapping,\n    validateMapping,\n    assertNow,\n    existsExact,\n  };\n};\n"],"mappings":";;;;;;;AA6BA,IAAa,4BAAb,cAA+C,QAAQ,QAGrD,CAAC,CAAC,+CAA+C,CAAC,CAAC,CAAC;AAEtD,MAAa,0BACX,YACA,iBACG;CACH,MAAM,EAAE,iBAAiB,QAAQ;CACjC,MAAM,EAAE,MAAM,wBAAwB;CAEtC,MAAM,oBAAoB,mBAAmB,KAAK,CAAC,CAAC;CAEpD,MAAM,aAAgD,UAAU;EAC9D,IAAI,CAAC,OAAO,MAAM,YAAY;CAChC;CAEA,MAAM,EAAE,KAAK,OAAO,WAAW,qBAAqB,oBAAoB,WAAW;CAEnF,MAAM,cAAc,SAAS,gBAAgB,YAAY,EAAE,CAAC;CAE5D,MAAM,UAAU,IAAI,YAAY;CAEhC,MAAM,UAAU,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC;;CAGxD,MAAM,OAAO,MAAc,WAAkC;EAC3D,MAAM,SAAS,CAAC,yBAAyB,OAAO,OAAO,GAAG,MAAM,CAAC,CAAC,KAAK,UAAU;GAC/E,MAAM,QAAQ,QAAQ,OAAO,KAAK;GAElC,UAAU,QAAQ,OAAO,KAAK,MAAM,KAAK;GAEzC,OAAO;EACT,CAAC;EAED,MAAM,SAAS,IAAI,WAAW,OAAO,QAAQ,MAAM,UAAU,OAAO,IAAI,MAAM,QAAQ,CAAC,CAAC;EACxF,MAAM,OAAO,IAAI,SAAS,OAAO,MAAM;EACvC,IAAI,SAAS;EAEb,KAAK,MAAM,SAAS,QAAQ;GAC1B,KAAK,UAAU,QAAQ,MAAM,QAAQ,KAAK;GAC1C,OAAO,IAAI,OAAO,SAAS,CAAC;GAC5B,UAAU,IAAI,MAAM;EACtB;EAEA,OACE,QAAQ,MAAM,KAAK,OAAO,MAAM,IAAI,UAAU,MAAM,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;CAE9F;CAEA,MAAM,iBAAiB,MAAc,OAAe,IAAI,cAAc,CAAC,MAAM,EAAE,CAAC;CAEhF,MAAM,aAAa,MAAc,WAAmB,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC;CAEhF,MAAM,gBAAgB,cAAsB,IAAI,WAAW,CAAC,SAAS,CAAC;CAEtE,MAAM,eAAe,aAA8B;EACjD,MAAM,UAAU,SAAS;EAEzB,IAAI,EAAE,YAAY,UAAU,OAAO;EACnC,MAAM,SAAS,QAAQ;EAEvB,OAAO,IAAI,UAAU;GACnB,OAAO;GACP,OAAO;GACP,OAAO;GACP,OAAO;GACP,OAAO;GACP,OAAO,SAAS;EAClB,CAAC;CACH;;CAGA,MAAM,WACJ,QACA,iBACG;EACH,MAAM,QAAQ,OAAO,eAAe,OAAO,YAAY,OAAO,OAAO,MAAM,CAAC,CAAC;EAE7E,MAAM,UAAU,UAAqB;GACnC,MAAM,OAAO,QAAQ,OAAO,WAAW,KAAK,CAAC,CAAC,oBAAoB,QAAQ,KAAK,CAAC;GAEhF,UAAU,QAAQ,OAAO,IAAI,CAAC,CAAC,UAAU,YAAY;GAErD,OAAO;EACT;EAEA,OAAO;GACL;GACA,SAAS,SAA6B;IACpC,UAAU,OAAO,SAAS,YAAY,KAAK,WAAW,KAAK,CAAC;IAC5D,UAAU,QAAQ,OAAO,IAAI,CAAC,CAAC,UAAU,YAAY;IACrD,MAAM,QAAQ,oBAAoB,QAAQ,OAAO,WAAW,KAAK,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC;IAEjF,UAAU,OAAO,KAAK,MAAM,IAAI;IAEhC,OAAO;GACT;EACF;CACF;CAGA,MAAM,gBAAgB,QAAQ,qBAAqB,OAAe;CAElE,MAAM,kBAAkB,QAAQ,iBAAiB,MAAU;CAE3D,MAAM,oBAAoB,QAAQ,mBAAmB,MAAU;CAE/D,MAAM,iBAAiB,QAAQ,gBAAgB,MAAU;CAEzD,MAAM,kBAAkB,QAAQ,iBAAiB,MAAU;CAE3D,MAAM,kBAAkB,MAAyB,UAA6B;EAC5E,MAAM,YAAY,WAA8B;GAC9C,GAAG;GACH,SAAS;GACT,gBAAgB;GAChB,aAAa;GACb,UAAU;IAAE,GAAG,MAAM;IAAU,aAAa,CAAC;GAAE;EACjD;EAEA,OAAO,kBAAkB,OAAO,SAAS,IAAI,CAAC,MAAM,kBAAkB,OAAO,SAAS,KAAK,CAAC;CAC9F;CAEA,MAAM,gBAAgB,MAAmC,UAAuC;EAC9F,MAAM,QAAQ,IAAI,IAAI,KAAK,YAAY,KAAK,SAAS,CAAC,KAAK,cAAc,KAAK,QAAQ,CAAC,CAAC;EAExF,OACE,KAAK,cAAc,MAAM,aACzB,KAAK,qBAAqB,MAAM,oBAChC,MAAM,SAAS,KAAK,YAAY,UAChC,IAAI,IAAI,MAAM,YAAY,KAAK,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,SAC1D,MAAM,YAAY,UACpB,MAAM,SAAS,MAAM,YAAY,UACjC,MAAM,YAAY,OAAO,SAAS,MAAM,IAAI,KAAK,YAAY,MAAM,KAAK,QAAQ;CAEpF;CAEA,MAAM,6BAA6B,YACjC;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC,CAAC,KAAK,SAAS,QAAQ,KAAK;CAE/B,MAAM,iBAAiB,YACrB,OAAO,QAAQ,OAAO,CAAC,CACpB,QACE,CAAC,MAAM,WACN,CAAC;EAAC;EAAS;EAAiB;EAAgB;EAAiB;CAAe,CAAC,CAAC,SAC5E,IACF,KAAK,OAAO,UAAU,QAC1B,CAAC,CACA,KAAK,GAAG,WAAW,KAAe;CAEvC,MAAM,mBAAmB,SAAc,OAAY,QACjD,OAAO,IAAI,4BAA4B,UAAU;EAC/C,MAAM,aAAa,KAAK;GACtB,OAAO,QAAQ;GACf;GACA,MAAM,CACJ,OAAO,YACL,0BAA0B,OAAO,CAAC,CAAC,KAAK,WAAW,CAAC,QAAQ,IAAI,OAAO,CAAC,CAC1E,CACF;EACF,CAAC;CACH,CAAC;;CAGH,MAAM,kBAAqB,UAAgB;EACzC,MAAM,uBAAO,IAAI,IAAqB;EAEtC,MAAM,QAAQ,UAA4B;GACxC,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,GAAG,OAAO;GAClF,IAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,OAAO,eAAe,KAAK,MAAM,OAAO,WAAW,OAAO;GACvF,MAAM,QAAQ,KAAK,IAAI,KAAK;GAE5B,IAAI,UAAU,KAAA,GAAW,OAAO;GAChC,MAAM,SAAc,MAAM,QAAQ,KAAK,IAAI,CAAC,IAAI,CAAC;GAEjD,KAAK,IAAI,OAAO,MAAM;GACtB,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,KAAK,GAAG,OAAO,QAAQ,KAAK,KAAK;GAE5E,OAAO,OAAO,OAAO,MAAM;EAC7B;EAEA,OAAO,KAAK,KAAK;CACnB;CAEA,MAAM,eAAe,QAAa,aAAkB;EAClD,KAAK,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,QAAQ,GAEnD,UAAU,KAAK,UAAU,SAAS,KAAK,MAAM,KAAK,UAAU,OAAO,CAAC;CACxE;CAEA,MAAM,cAAc,UAAe;EACjC,MAAM,UAAU,gBAAgB,MAAM,KAAK;EAE3C,KAAK,MAAM,QAAQ,cAAc,KAAK,GAAG,UAAU,QAAQ,UAAU,KAAA,CAAS;CAChF;CAEA,MAAM,mBACJ,SACA,SACG;EACH,IAAI;GACF,MAAM,OAAO,SAAS,SAAS,UAAU,SAAS,iBAAiB,QAAQ,OAAO,KAAA;GAElF,IAAI,SAAS,KAAA,GAAW;IACtB,KAAK,MAAM,QAAQ;KACjB;KACA;KACA;KACA;KACA;IACF,GACE,WAAW,KAAK,KAAK;IACvB,YAAY,KAAK,aAAa,oCAAoC;GACpE;GACA,IAAI,SAAS,QAAQ;GAErB,OAAO,kBAAkB,eAAe,CAAC,CAAC,QAAQ,QAAQ;GAC1D,WAAW,QAAQ,MAAM;GACzB,UAAU,QAAQ,OAAO,cAAc,SAAS,CAAC;GACjD,KAAK,MAAM,QAAQ,QAAQ,OAAO,eAAe,IAAI,QAAQ,OAAO,OAAO,IAAI;GAC/E,MAAM,yBAAS,IAAI,IAAY;GAE/B,KAAK,MAAM,SAAS,QAAQ,OAAO,UAAU,CAAC,GAAG;IAC/C,UACE,OAAO,MAAM,UAAU,YAAY,MAAM,MAAM,SAAS,KAAK,MAAM,MAAM,UAAU,GACrF;IACA,UAAU,CAAC,OAAO,IAAI,MAAM,KAAK,KAAK,MAAM,QAAQ,SAAS,CAAC;IAC9D,OAAO,IAAI,MAAM,KAAK;IACtB,KAAK,MAAM,QAAQ,MAAM,SAAS,IAAI,MAAM,OAAO,IAAI;GACzD;GACA,UAAU,OAAO,QAAQ,EAAE;GAC3B,IAAI,SAAS,WAAW;GACxB,UACE,OAAO,QAAQ,mBAAmB,YAChC,QAAQ,eAAe,SAAS,KAChC,QAAQ,eAAe,UAAU,GACrC;GACA,KAAK,MAAM,QAAQ;IAAC;IAAQ;IAAa;GAAQ,GAAG,WAAW,QAAQ,KAAK;GAC5E,IAAI,SAAS,gBAAgB;IAC3B,WAAW,QAAQ,MAAM;IACzB,WAAW,QAAQ,MAAM;GAC3B,OAAO,IAAI,QAAQ,KAAK,WAAW,OAAO,QAAQ,UAAU,UAAU;GACtE,YACE,QAAQ,aACR,SAAS,iBACL,iDACA,qCACN;GACA,MAAM,SAAS,OAAO,OAAO,QAAQ,KAAK,MAAM;GAGhD,UAEE,OAAO,WAAW,KAAK,IAAI,IAAI,OAAO,KAAK,UAAU,KAAK,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CACxF;GACA,KAAK,MAAM,SAAS;IAAC;IAAG;IAAG;IAAW;GAAa,GACjD,UAAU,QAAQ,MAAM,cAAc,QAAQ,MAAM,cAAc,KAAK,CAAC,MAAM,KAAK;EACvF,QAAQ;GACN,MAAM,0BAA0B,KAAK,CAAC,CAAC;EACzC;CACF;CAEA,MAAM,aAAa,cACjB,OAAO,QAAQ,4BAA4B,UACzC,OAAO,IAAI,aAAa;EACtB,UAAU,OAAO,MAAM,MAAM,SAAS,CAAC;EACvC,MAAM,eAAe,KAAK,SAAS;CACrC,CAAC,CACH;CAEF,MAAM,eAAe,OAAY,QAAa,cAC5C,OAAO,IACL,4BACC,UACC,GAAG,wBAAwB,MAAM,SAAS,KAAK,MAAM,MAAM,OAAO,MAAM,GAAG,SAAS,EAAE,EAC1F;CAEF,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF"}
+{"version":3,"file":"state.mjs","names":[],"sources":["../../../src/internal/passkey/state.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- existing mapped-row bridge; public adapters preserve table, ID, and Effect types. */\n\n// oxlint-disable-next-line import/extensions -- Noble exposes its explicit .js subpaths.\nimport { sha256 } from \"@noble/hashes/sha2.js\";\n// oxlint-disable-next-line import/extensions -- Noble exposes its explicit .js subpaths.\nimport { randomBytes } from \"@noble/hashes/utils.js\";\nimport {\n  PasskeyConfigurationError,\n  PasskeyUnavailable,\n  PasskeyCeremony,\n  PasskeyCredential,\n  PasskeyModuleId,\n  PasskeyProfile,\n  PasskeyRevision,\n  PasskeyMethodPolicy,\n  snapshotPasskeySync,\n} from \"@yielded/auth/Passkey\";\nimport { Context, Effect, Schema } from \"effect\";\nimport { Base64Url } from \"effect/encoding\";\n\nimport {\n  requiredPasskeyCredentialConstraints,\n  requiredPasskeyPersistenceConstraints,\n} from \"../models/passkey-model\";\nimport { requiredPasskeyRegistrationCeremonyConstraints } from \"../models/passkey-registration-ceremony-model\";\nimport type { SqlExpression as SQL, QueryOperations } from \"../query-operations\";\nimport type { TransactionOwner, makeTransactionKernel } from \"../transaction-kernel\";\n\nexport type PasskeyOwner = TransactionOwner<PasskeyUnavailable>;\n\nexport class CurrentPasskeyTransaction extends Context.Service<\n  CurrentPasskeyTransaction,\n  PasskeyOwner\n>()(\"effect-auth/drizzle/CurrentPasskeyTransaction\") {}\n\nexport const makePasskeyStateKernel = (\n  operations: QueryOperations,\n  transactions: Pick<ReturnType<typeof makeTransactionKernel>, \"both\" | \"makeTransactionRows\">,\n) => {\n  const { getTableColumns, sql } = operations;\n  const { both, makeTransactionRows } = transactions;\n\n  const unavailable = () => PasskeyUnavailable.make({});\n\n  const invariant: (value: unknown) => asserts value = (value) => {\n    if (!value) throw unavailable();\n  };\n\n  const { col, equal, copiedRow, matchesNativeRow } = makeTransactionRows(unavailable);\n\n  const nonce = () => Base64Url.encode(randomBytes(32));\n\n  const encoder = new TextEncoder();\n\n  const decoder = new TextDecoder(\"utf-8\", { fatal: true });\n\n  /** RP tuples and admission scopes have no collation-dependent string identity. */\n  const key = (kind: string, fields: ReadonlyArray<string>) => {\n    const values = [\"effect-auth/passkey/\" + kind + \"/v1\", ...fields].map((field) => {\n      const bytes = encoder.encode(field);\n\n      invariant(decoder.decode(bytes) === field);\n\n      return bytes;\n    });\n\n    const packed = new Uint8Array(values.reduce((size, bytes) => size + 4 + bytes.length, 0));\n    const view = new DataView(packed.buffer);\n    let offset = 0;\n\n    for (const bytes of values) {\n      view.setUint32(offset, bytes.length, false);\n      packed.set(bytes, offset + 4);\n      offset += 4 + bytes.length;\n    }\n\n    return (\n      \"v1:\" + Array.from(sha256(packed), (value) => value.toString(16).padStart(2, \"0\")).join(\"\")\n    );\n  };\n\n  const credentialKey = (rpId: string, id: string) => key(\"credential\", [rpId, id]);\n\n  const handleKey = (rpId: string, handle: string) => key(\"handle\", [rpId, handle]);\n\n  const subjectScope = (subjectId: string) => key(\"subject\", [subjectId]);\n\n  const targetScope = (ceremony: PasskeyCeremony) => {\n    const context = ceremony.context;\n\n    if (!(\"target\" in context)) return null;\n    const target = context.target;\n\n    return key(\"target\", [\n      target.moduleId,\n      target.kind,\n      target.flowId,\n      target.commandId,\n      target.bindingDigest,\n      target.revision.subjectId,\n    ]);\n  };\n\n  /** Private storage is decoded Type data, never a consumer wire transform. */\n  const storage = <S extends Schema.Codec<unknown, unknown, never, never>>(\n    schema: S,\n    maximumBytes: number,\n  ) => {\n    const codec = Schema.fromJsonString(Schema.toCodecJson(Schema.toType(schema)));\n\n    const encode = (value: S[\"Type\"]) => {\n      const text = \"v1:\" + Schema.encodeSync(codec)(snapshotPasskeySync(schema, value));\n\n      invariant(encoder.encode(text).length <= maximumBytes);\n\n      return text;\n    };\n\n    return {\n      encode,\n      decode: (text: unknown): S[\"Type\"] => {\n        invariant(typeof text === \"string\" && text.startsWith(\"v1:\"));\n        invariant(encoder.encode(text).length <= maximumBytes);\n        const value = snapshotPasskeySync(schema, Schema.decodeSync(codec)(text.slice(3)));\n\n        invariant(encode(value) === text);\n\n        return value;\n      },\n    };\n  };\n\n  // Legal 32 x 16 x 2048 origins require more than one MiB before JSON escaping.\n  const policyStorage = storage(PasskeyMethodPolicy, 8 * 1024 * 1024);\n\n  const ceremonyStorage = storage(PasskeyCeremony, 512 * 1024);\n\n  const credentialStorage = storage(PasskeyCredential, 512 * 1024);\n\n  const profileStorage = storage(PasskeyProfile, 256 * 1024);\n\n  const revisionStorage = storage(PasskeyRevision, 256 * 1024);\n\n  const sameCredential = (left: PasskeyCredential, right: PasskeyCredential) => {\n    const semantic = (value: PasskeyCredential) => ({\n      ...value,\n      counter: 0,\n      maximumCounter: 0,\n      backupState: false,\n      revision: { ...value.revision, credentials: [] },\n    });\n\n    return credentialStorage.encode(semantic(left)) === credentialStorage.encode(semantic(right));\n  };\n\n  const sameRevision = (left: typeof PasskeyRevision.Type, right: typeof PasskeyRevision.Type) => {\n    const pairs = new Map(left.credentials.map((item) => [item.credentialId, item.revision]));\n\n    return (\n      left.subjectId === right.subjectId &&\n      left.securityRevision === right.securityRevision &&\n      pairs.size === left.credentials.length &&\n      new Set(right.credentials.map((item) => item.credentialId)).size ===\n        right.credentials.length &&\n      pairs.size === right.credentials.length &&\n      right.credentials.every((item) => pairs.get(item.credentialId) === item.revision)\n    );\n  };\n\n  const semanticCredentialColumns = (mapping: any): string[] =>\n    [\n      \"credentialId\",\n      \"subjectId\",\n      \"rpId\",\n      \"protocolCredentialId\",\n      \"credentialKey\",\n      \"handleKey\",\n      \"userHandle\",\n      \"publicKey\",\n      \"algorithm\",\n      \"profile\",\n      \"credentialRevision\",\n      \"status\",\n      \"primarySignIn\",\n      \"enrollmentUserVerified\",\n      \"backupEligible\",\n    ].map((name) => mapping[name]);\n\n  const mappedColumns = (mapping: any): string[] =>\n    Object.entries(mapping)\n      .filter(\n        ([name, value]) =>\n          ![\"table\", \"reservedState\", \"pendingState\", \"acceptedState\", \"rejectedState\"].includes(\n            name,\n          ) && typeof value === \"string\",\n      )\n      .map(([, value]) => value as string);\n\n  const observeSemantic = (mapping: any, where: SQL, row: any) =>\n    Effect.map(CurrentPasskeyTransaction, (owner) => {\n      owner.observations.push({\n        table: mapping.table,\n        where,\n        rows: [\n          Object.fromEntries(\n            semanticCredentialColumns(mapping).map((column) => [column, row[column]]),\n          ),\n        ],\n      });\n    });\n\n  /** Capture descriptor graphs, preserving native SQL expressions and table objects. */\n  const captureMapping = <A>(input: A): A => {\n    const seen = new Map<object, unknown>();\n\n    const copy = (value: unknown): unknown => {\n      if (value === null || typeof value !== \"object\" || Effect.isEffect(value)) return value;\n      if (!Array.isArray(value) && Object.getPrototypeOf(value) !== Object.prototype) return value;\n      const prior = seen.get(value);\n\n      if (prior !== undefined) return prior;\n      const result: any = Array.isArray(value) ? [] : {};\n\n      seen.set(value, result);\n      for (const [name, child] of Object.entries(value)) result[name] = copy(child);\n\n      return Object.freeze(result);\n    };\n\n    return copy(input) as A;\n  };\n\n  const constraints = (actual: any, expected: any) => {\n    for (const [name, columns] of Object.entries(expected))\n      // oxlint-disable-next-line no-restricted-properties -- exact configured constraint descriptor fingerprint.\n      invariant(JSON.stringify(actual?.[name]) === JSON.stringify(columns));\n  };\n\n  const descriptor = (value: any) => {\n    const columns = getTableColumns(value.table);\n\n    for (const name of mappedColumns(value)) invariant(columns[name] !== undefined);\n  };\n\n  const validateMapping = (\n    mapping: any,\n    kind: \"read\" | \"context\" | \"assertion\" | \"registration\",\n  ) => {\n    try {\n      const read = kind === \"read\" ? mapping : kind !== \"registration\" ? mapping.read : undefined;\n\n      if (read !== undefined) {\n        for (const name of [\n          \"subject\",\n          \"credential\",\n          \"authority\",\n          \"credentialOwnership\",\n          \"handleOwnership\",\n        ])\n          descriptor(read[name]);\n        constraints(read.constraints, requiredPasskeyCredentialConstraints);\n      }\n      if (kind === \"read\") return;\n      // oxlint-disable-next-line no-restricted-properties -- validate the untyped captured configuration boundary.\n      Schema.decodeUnknownSync(PasskeyModuleId)(mapping.moduleId);\n      descriptor(mapping.module);\n      invariant(mapping.module.policyColumns.length > 0);\n      for (const name of mapping.module.policyColumns) col(mapping.module.table, name);\n      const scopes = new Set<string>();\n\n      for (const guard of mapping.module.guards ?? []) {\n        invariant(\n          typeof guard.scope === \"string\" && guard.scope.length > 0 && guard.scope.length <= 256,\n        );\n        invariant(!scopes.has(guard.scope) && guard.columns.length > 0);\n        scopes.add(guard.scope);\n        for (const name of guard.columns) col(guard.table, name);\n      }\n      invariant(scopes.size <= 32);\n      if (kind === \"context\") return;\n      invariant(\n        typeof mapping.authorityScope === \"string\" &&\n          mapping.authorityScope.length > 0 &&\n          mapping.authorityScope.length <= 256,\n      );\n      for (const name of [\"flow\", \"admission\", \"charge\"]) descriptor(mapping[name]);\n      if (kind === \"registration\") {\n        descriptor(mapping.intent);\n        descriptor(mapping.handle);\n      } else col(mapping.read.credential.table, mapping.telemetry.lastUsedAt);\n      constraints(\n        mapping.constraints,\n        kind === \"registration\"\n          ? requiredPasskeyRegistrationCeremonyConstraints\n          : requiredPasskeyPersistenceConstraints,\n      );\n      const states = Object.values(mapping.flow.states);\n\n      // oxlint-disable-next-line no-restricted-properties -- configured native state identity fingerprints.\n      invariant(\n        // oxlint-disable-next-line no-restricted-properties -- configured native state identity fingerprints.\n        states.length === 7 && new Set(states.map((value) => JSON.stringify(value))).size === 7,\n      );\n      for (const value of [0, 1, 123456789, 8640000000000])\n        invariant(mapping.clock.decodeInstant(mapping.clock.encodeInstant(value)) === value);\n    } catch {\n      throw PasskeyConfigurationError.make({});\n    }\n  };\n\n  const assertNow = (condition: SQL) =>\n    Effect.flatMap(CurrentPasskeyTransaction, (owner) =>\n      Effect.gen(function* () {\n        invariant(yield* owner.check(condition));\n        owner.postconditions.push(condition);\n      }),\n    );\n\n  const existsExact = (table: any, values: any, condition?: SQL) =>\n    Effect.map(\n      CurrentPasskeyTransaction,\n      (owner) =>\n        sql`exists(select 1 from ${table} where ${both(owner.exact(table, values), condition)})`,\n    );\n\n  return {\n    unavailable,\n    invariant,\n    col,\n    equal,\n    copiedRow,\n    matchesNativeRow,\n    nonce,\n    key,\n    credentialKey,\n    handleKey,\n    subjectScope,\n    targetScope,\n    policyStorage,\n    ceremonyStorage,\n    credentialStorage,\n    profileStorage,\n    revisionStorage,\n    sameCredential,\n    sameRevision,\n    semanticCredentialColumns,\n    mappedColumns,\n    observeSemantic,\n    captureMapping,\n    validateMapping,\n    assertNow,\n    existsExact,\n  };\n};\n"],"mappings":";;;;;;;;AA8BA,IAAa,4BAAb,cAA+C,QAAQ,QAGrD,CAAC,CAAC,+CAA+C,CAAC,CAAC,CAAC;AAEtD,MAAa,0BACX,YACA,iBACG;CACH,MAAM,EAAE,iBAAiB,QAAQ;CACjC,MAAM,EAAE,MAAM,wBAAwB;CAEtC,MAAM,oBAAoB,mBAAmB,KAAK,CAAC,CAAC;CAEpD,MAAM,aAAgD,UAAU;EAC9D,IAAI,CAAC,OAAO,MAAM,YAAY;CAChC;CAEA,MAAM,EAAE,KAAK,OAAO,WAAW,qBAAqB,oBAAoB,WAAW;CAEnF,MAAM,cAAc,UAAU,OAAO,YAAY,EAAE,CAAC;CAEpD,MAAM,UAAU,IAAI,YAAY;CAEhC,MAAM,UAAU,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC;;CAGxD,MAAM,OAAO,MAAc,WAAkC;EAC3D,MAAM,SAAS,CAAC,yBAAyB,OAAO,OAAO,GAAG,MAAM,CAAC,CAAC,KAAK,UAAU;GAC/E,MAAM,QAAQ,QAAQ,OAAO,KAAK;GAElC,UAAU,QAAQ,OAAO,KAAK,MAAM,KAAK;GAEzC,OAAO;EACT,CAAC;EAED,MAAM,SAAS,IAAI,WAAW,OAAO,QAAQ,MAAM,UAAU,OAAO,IAAI,MAAM,QAAQ,CAAC,CAAC;EACxF,MAAM,OAAO,IAAI,SAAS,OAAO,MAAM;EACvC,IAAI,SAAS;EAEb,KAAK,MAAM,SAAS,QAAQ;GAC1B,KAAK,UAAU,QAAQ,MAAM,QAAQ,KAAK;GAC1C,OAAO,IAAI,OAAO,SAAS,CAAC;GAC5B,UAAU,IAAI,MAAM;EACtB;EAEA,OACE,QAAQ,MAAM,KAAK,OAAO,MAAM,IAAI,UAAU,MAAM,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;CAE9F;CAEA,MAAM,iBAAiB,MAAc,OAAe,IAAI,cAAc,CAAC,MAAM,EAAE,CAAC;CAEhF,MAAM,aAAa,MAAc,WAAmB,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC;CAEhF,MAAM,gBAAgB,cAAsB,IAAI,WAAW,CAAC,SAAS,CAAC;CAEtE,MAAM,eAAe,aAA8B;EACjD,MAAM,UAAU,SAAS;EAEzB,IAAI,EAAE,YAAY,UAAU,OAAO;EACnC,MAAM,SAAS,QAAQ;EAEvB,OAAO,IAAI,UAAU;GACnB,OAAO;GACP,OAAO;GACP,OAAO;GACP,OAAO;GACP,OAAO;GACP,OAAO,SAAS;EAClB,CAAC;CACH;;CAGA,MAAM,WACJ,QACA,iBACG;EACH,MAAM,QAAQ,OAAO,eAAe,OAAO,YAAY,OAAO,OAAO,MAAM,CAAC,CAAC;EAE7E,MAAM,UAAU,UAAqB;GACnC,MAAM,OAAO,QAAQ,OAAO,WAAW,KAAK,CAAC,CAAC,oBAAoB,QAAQ,KAAK,CAAC;GAEhF,UAAU,QAAQ,OAAO,IAAI,CAAC,CAAC,UAAU,YAAY;GAErD,OAAO;EACT;EAEA,OAAO;GACL;GACA,SAAS,SAA6B;IACpC,UAAU,OAAO,SAAS,YAAY,KAAK,WAAW,KAAK,CAAC;IAC5D,UAAU,QAAQ,OAAO,IAAI,CAAC,CAAC,UAAU,YAAY;IACrD,MAAM,QAAQ,oBAAoB,QAAQ,OAAO,WAAW,KAAK,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC;IAEjF,UAAU,OAAO,KAAK,MAAM,IAAI;IAEhC,OAAO;GACT;EACF;CACF;CAGA,MAAM,gBAAgB,QAAQ,qBAAqB,OAAe;CAElE,MAAM,kBAAkB,QAAQ,iBAAiB,MAAU;CAE3D,MAAM,oBAAoB,QAAQ,mBAAmB,MAAU;CAE/D,MAAM,iBAAiB,QAAQ,gBAAgB,MAAU;CAEzD,MAAM,kBAAkB,QAAQ,iBAAiB,MAAU;CAE3D,MAAM,kBAAkB,MAAyB,UAA6B;EAC5E,MAAM,YAAY,WAA8B;GAC9C,GAAG;GACH,SAAS;GACT,gBAAgB;GAChB,aAAa;GACb,UAAU;IAAE,GAAG,MAAM;IAAU,aAAa,CAAC;GAAE;EACjD;EAEA,OAAO,kBAAkB,OAAO,SAAS,IAAI,CAAC,MAAM,kBAAkB,OAAO,SAAS,KAAK,CAAC;CAC9F;CAEA,MAAM,gBAAgB,MAAmC,UAAuC;EAC9F,MAAM,QAAQ,IAAI,IAAI,KAAK,YAAY,KAAK,SAAS,CAAC,KAAK,cAAc,KAAK,QAAQ,CAAC,CAAC;EAExF,OACE,KAAK,cAAc,MAAM,aACzB,KAAK,qBAAqB,MAAM,oBAChC,MAAM,SAAS,KAAK,YAAY,UAChC,IAAI,IAAI,MAAM,YAAY,KAAK,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,SAC1D,MAAM,YAAY,UACpB,MAAM,SAAS,MAAM,YAAY,UACjC,MAAM,YAAY,OAAO,SAAS,MAAM,IAAI,KAAK,YAAY,MAAM,KAAK,QAAQ;CAEpF;CAEA,MAAM,6BAA6B,YACjC;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC,CAAC,KAAK,SAAS,QAAQ,KAAK;CAE/B,MAAM,iBAAiB,YACrB,OAAO,QAAQ,OAAO,CAAC,CACpB,QACE,CAAC,MAAM,WACN,CAAC;EAAC;EAAS;EAAiB;EAAgB;EAAiB;CAAe,CAAC,CAAC,SAC5E,IACF,KAAK,OAAO,UAAU,QAC1B,CAAC,CACA,KAAK,GAAG,WAAW,KAAe;CAEvC,MAAM,mBAAmB,SAAc,OAAY,QACjD,OAAO,IAAI,4BAA4B,UAAU;EAC/C,MAAM,aAAa,KAAK;GACtB,OAAO,QAAQ;GACf;GACA,MAAM,CACJ,OAAO,YACL,0BAA0B,OAAO,CAAC,CAAC,KAAK,WAAW,CAAC,QAAQ,IAAI,OAAO,CAAC,CAC1E,CACF;EACF,CAAC;CACH,CAAC;;CAGH,MAAM,kBAAqB,UAAgB;EACzC,MAAM,uBAAO,IAAI,IAAqB;EAEtC,MAAM,QAAQ,UAA4B;GACxC,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,GAAG,OAAO;GAClF,IAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,OAAO,eAAe,KAAK,MAAM,OAAO,WAAW,OAAO;GACvF,MAAM,QAAQ,KAAK,IAAI,KAAK;GAE5B,IAAI,UAAU,KAAA,GAAW,OAAO;GAChC,MAAM,SAAc,MAAM,QAAQ,KAAK,IAAI,CAAC,IAAI,CAAC;GAEjD,KAAK,IAAI,OAAO,MAAM;GACtB,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,KAAK,GAAG,OAAO,QAAQ,KAAK,KAAK;GAE5E,OAAO,OAAO,OAAO,MAAM;EAC7B;EAEA,OAAO,KAAK,KAAK;CACnB;CAEA,MAAM,eAAe,QAAa,aAAkB;EAClD,KAAK,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,QAAQ,GAEnD,UAAU,KAAK,UAAU,SAAS,KAAK,MAAM,KAAK,UAAU,OAAO,CAAC;CACxE;CAEA,MAAM,cAAc,UAAe;EACjC,MAAM,UAAU,gBAAgB,MAAM,KAAK;EAE3C,KAAK,MAAM,QAAQ,cAAc,KAAK,GAAG,UAAU,QAAQ,UAAU,KAAA,CAAS;CAChF;CAEA,MAAM,mBACJ,SACA,SACG;EACH,IAAI;GACF,MAAM,OAAO,SAAS,SAAS,UAAU,SAAS,iBAAiB,QAAQ,OAAO,KAAA;GAElF,IAAI,SAAS,KAAA,GAAW;IACtB,KAAK,MAAM,QAAQ;KACjB;KACA;KACA;KACA;KACA;IACF,GACE,WAAW,KAAK,KAAK;IACvB,YAAY,KAAK,aAAa,oCAAoC;GACpE;GACA,IAAI,SAAS,QAAQ;GAErB,OAAO,kBAAkB,eAAe,CAAC,CAAC,QAAQ,QAAQ;GAC1D,WAAW,QAAQ,MAAM;GACzB,UAAU,QAAQ,OAAO,cAAc,SAAS,CAAC;GACjD,KAAK,MAAM,QAAQ,QAAQ,OAAO,eAAe,IAAI,QAAQ,OAAO,OAAO,IAAI;GAC/E,MAAM,yBAAS,IAAI,IAAY;GAE/B,KAAK,MAAM,SAAS,QAAQ,OAAO,UAAU,CAAC,GAAG;IAC/C,UACE,OAAO,MAAM,UAAU,YAAY,MAAM,MAAM,SAAS,KAAK,MAAM,MAAM,UAAU,GACrF;IACA,UAAU,CAAC,OAAO,IAAI,MAAM,KAAK,KAAK,MAAM,QAAQ,SAAS,CAAC;IAC9D,OAAO,IAAI,MAAM,KAAK;IACtB,KAAK,MAAM,QAAQ,MAAM,SAAS,IAAI,MAAM,OAAO,IAAI;GACzD;GACA,UAAU,OAAO,QAAQ,EAAE;GAC3B,IAAI,SAAS,WAAW;GACxB,UACE,OAAO,QAAQ,mBAAmB,YAChC,QAAQ,eAAe,SAAS,KAChC,QAAQ,eAAe,UAAU,GACrC;GACA,KAAK,MAAM,QAAQ;IAAC;IAAQ;IAAa;GAAQ,GAAG,WAAW,QAAQ,KAAK;GAC5E,IAAI,SAAS,gBAAgB;IAC3B,WAAW,QAAQ,MAAM;IACzB,WAAW,QAAQ,MAAM;GAC3B,OAAO,IAAI,QAAQ,KAAK,WAAW,OAAO,QAAQ,UAAU,UAAU;GACtE,YACE,QAAQ,aACR,SAAS,iBACL,iDACA,qCACN;GACA,MAAM,SAAS,OAAO,OAAO,QAAQ,KAAK,MAAM;GAGhD,UAEE,OAAO,WAAW,KAAK,IAAI,IAAI,OAAO,KAAK,UAAU,KAAK,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CACxF;GACA,KAAK,MAAM,SAAS;IAAC;IAAG;IAAG;IAAW;GAAa,GACjD,UAAU,QAAQ,MAAM,cAAc,QAAQ,MAAM,cAAc,KAAK,CAAC,MAAM,KAAK;EACvF,QAAQ;GACN,MAAM,0BAA0B,KAAK,CAAC,CAAC;EACzC;CACF;CAEA,MAAM,aAAa,cACjB,OAAO,QAAQ,4BAA4B,UACzC,OAAO,IAAI,aAAa;EACtB,UAAU,OAAO,MAAM,MAAM,SAAS,CAAC;EACvC,MAAM,eAAe,KAAK,SAAS;CACrC,CAAC,CACH;CAEF,MAAM,eAAe,OAAY,QAAa,cAC5C,OAAO,IACL,4BACC,UACC,GAAG,wBAAwB,MAAM,SAAS,KAAK,MAAM,MAAM,OAAO,MAAM,GAAG,SAAS,EAAE,EAC1F;CAEF,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF"}

package/dist/internal/passkey/target.d.mts

@@ -10,7 +10,7 @@ import "./registration-ceremony.mjs";
 import { Effect, Schema } from "effect";
 import { PasskeyConfigurationError, PasskeyPersistence, PasskeyUnavailable, PreparePasskeyCommit } from "@yielded/auth/Passkey";
 import { LifecycleHooks, PreparedCommit } from "@yielded/auth/Hooks";
-import { Statement } from "effect/unstable/sql/Statement";
+import { Statement } from "effect/sql/Statement";
 //#region src/internal/passkey/target.d.ts
 export type PasskeyTargetConfiguration = TransactionTargetConfiguration<PasskeyUnavailable>;
 export type PasskeyCoordinatorError<E> = TransactionCoordinatorError<E, PasskeyUnavailable> | PasskeyConfigurationError | PersistenceMappingError;