@yielded/auth-persistence 0.1.0-beta.11 → 0.1.0-beta.13

package/dist/internal/persistence.mjs

@@ -1,15 +1,15 @@
 import { PersistenceConfigurationError } from "./configuration.mjs";
 import { PersistenceMappingError } from "./mapping-error.mjs";
 import { requireStandalone } from "./standalone.mjs";
-import { makeTransactionKernel } from "./transaction-kernel.mjs";
+import { NativeDatabase, makeTransactionKernel } from "./transaction-kernel.mjs";
 import { makeTransactionExecutionKernel } from "./transaction-execution-kernel.mjs";
+import { CurrentProofSql, makeProofKernel } from "./proof-kernel.mjs";
 import { storageTables, tableDefinition } from "./storage-tables.mjs";
-import { makeProofKernel } from "./proof-kernel.mjs";
-import { makeEmailKernel } from "./email-kernel.mjs";
-import { makePasswordKernel } from "./password-kernel.mjs";
+import { CurrentEmailSql, makeEmailKernel } from "./email-kernel.mjs";
+import { CurrentPasswordSql, makePasswordKernel } from "./password-kernel.mjs";
 import { CurrentPhoneTransaction, makePhoneKernel } from "./phone-kernel.mjs";
 import { makeRegistrationAuthority } from "./registration.mjs";
-import { makeSessionKernel } from "./session-kernel.mjs";
+import { CurrentSessionSql, makeSessionKernel } from "./session-kernel.mjs";
 import { makeMappings } from "./storage-mapping.mjs";
 import { validateStorage } from "./storage-validation.mjs";
 import { Context, Effect, Layer, Schema } from "effect";
@@ -18,10 +18,10 @@ import { digest, randomId } from "@yielded/auth-crypto";
 import { LifecycleHooks } from "@yielded/auth/Hooks";
 import { AuthenticationAuthority, SessionUnavailable } from "@yielded/auth/Sessions";
 import { hooksLayer } from "@yielded/auth/Persistence";
+import { ProofPersistence, ProofUnavailable } from "@yielded/auth/Proofs";
 import { EmailAddressPersistence, EmailUnavailable } from "@yielded/auth/Email";
 import { PasswordPersistence, PasswordUnavailable } from "@yielded/auth/Password";
 import { PhoneAdmission, PhoneOtpUnavailable, PhoneSignInTargets } from "@yielded/auth/PhoneOtp";
-import { ProofPersistence, ProofUnavailable } from "@yielded/auth/Proofs";
 //#region src/internal/persistence.ts
 const configError = (reason) => PersistenceConfigurationError.make({ reason });
 const mappingError = (cause) => PersistenceMappingError.make({
@@ -75,7 +75,6 @@ const createPersistence = (backend) => {
 		const ConfigKey = Context.Service()(`@yielded/auth-persistence/${auth.namespace}/Config`);
 		const Config = Object.assign(ConfigKey, { layer: (value) => Layer.succeed(ConfigKey, value) });
 		const ProvisioningKey = Context.Service()(`@yielded/auth-persistence/${auth.namespace}/Provisioning`);
-		const provisioners = management ? ProvisioningKey.pipe(Effect.map((value) => value)) : Effect.succeed({});
 		const layout = (options, managed) => {
 			const subject = options.subjects;
 			if (passkeys.length > 0 && options.timestamps !== void 0) throw configError("Composed passkey storage uses integer milliseconds; use an explicit passkey adapter for a custom timestamp representation");
@@ -151,11 +150,11 @@ const createPersistence = (backend) => {
 					const description = backend.describe(table);
 					const columns = description.columns;
 					for (const name of Object.keys(storageTables[role].columns)) if (columns[name] === void 0) return yield* configError(`Missing ${role}.${name} column`);
-					yield* validateStorage(client, dialect, description, storageTables[role].unique);
+					yield* validateStorage(dialect, description, storageTables[role].unique);
 				}
-				yield* validateStorage(client, dialect, backend.describe(storage.subjects.table), [[storage.subjects.id]]);
+				yield* validateStorage(dialect, backend.describe(storage.subjects.table), [[storage.subjects.id]]);
 				const mappings = makeMappings(storage);
-				const standalone = (error) => requireStandalone(error, client);
+				const standalone = (error) => requireStandalone(error, client.transactionService);
 				const native = database;
 				const options = {
 					mode: "interactive",
@@ -163,11 +162,11 @@ const createPersistence = (backend) => {
 					standaloneGuard: standalone(() => SessionUnavailable.make({}))
 				};
 				const sessionMapping = mappings.sessions(auth.claims);
-				const sessionServices = yield* sessionKernel.makeSqlStatefulSessions(native, sessionMapping, options);
-				const authority = yield* sessionKernel.makeSqlAuthenticationAuthority(native, {
+				const sessionServices = yield* sessionKernel.makeSqlStatefulSessions(sessionMapping, options).pipe(Effect.provideService(CurrentSessionSql, native));
+				const authority = yield* sessionKernel.makeSqlAuthenticationAuthority({
 					...mappings.authority(),
 					isConstraintConflict: () => false
-				}, options);
+				}, options).pipe(Effect.provideService(CurrentSessionSql, native));
 				let context = Context.make(AuthenticationAuthority, authority).pipe(Context.add(auth.sessions.StatefulSessionPersistence, sessionServices.statefulSessionPersistence), Context.add(auth.sessions.SessionRepository, sessionServices.sessionRepository));
 				const proofConfiguration = proofs ? {
 					mapping: mappings.proofs(),
@@ -178,32 +177,30 @@ const createPersistence = (backend) => {
 						insertIfAbsent: (query) => query.onConflictDoNothing()
 					}
 				} : void 0;
-				if (proofConfiguration !== void 0) context = Context.add(context, ProofPersistence, yield* proofKernel.makeSqlProofPersistence(native, proofConfiguration.mapping, proofConfiguration.configuration));
+				if (proofConfiguration !== void 0) context = Context.add(context, ProofPersistence, yield* proofKernel.makeSqlProofPersistence(proofConfiguration.mapping, proofConfiguration.configuration).pipe(Effect.provideService(CurrentProofSql, native)));
 				if (password) {
-					const persistence = yield* passwordKernel.makeSqlPasswordPersistence(native, mappings.passwords(), {
+					const persistence = yield* passwordKernel.makeSqlPasswordPersistence(mappings.passwords(), {
 						mode: "interactive",
 						locking: dialect === "pg",
 						standaloneGuard: standalone(() => PasswordUnavailable.make({})),
 						insertIfAbsent: (query) => query.onConflictDoNothing(),
 						proof: proofConfiguration
-					});
+					}).pipe(Effect.provideService(CurrentPasswordSql, native));
 					context = Context.add(context, PasswordPersistence, persistence);
 				}
-				const creators = yield* provisioners;
 				for (const [name, strategy] of Object.entries(auth.strategies)) {
 					if (strategy.persistence?.kind !== "password" || !strategy.persistence.management) continue;
 					const key = strategy.RegistrationAuthority;
-					const create = creators[name];
-					if (key === void 0 || create === void 0) return yield* configError(`Missing subject provisioning for ${name}`);
-					const registration = yield* makeRegistrationAuthority(native, mappings, backend.operations, standalone(() => PasswordUnavailable.make({})), create);
+					if (key === void 0) return yield* configError(`Missing subject provisioning for ${name}`);
+					const registration = yield* makeRegistrationAuthority(mappings, backend.operations, standalone(() => PasswordUnavailable.make({})), ProvisioningKey, name).pipe(Effect.provideService(CurrentPasswordSql, native));
 					context = Context.add(context, key, registration);
 				}
-				if (email) context = Context.add(context, EmailAddressPersistence, yield* emailKernel.makeSqlEmailAddressPersistence(native, mappings.emails(), {
+				if (email) context = Context.add(context, EmailAddressPersistence, yield* emailKernel.makeSqlEmailAddressPersistence(mappings.emails(), {
 					mode: "interactive",
 					locking: dialect === "pg",
 					standaloneGuard: standalone(() => EmailUnavailable.make({})),
 					proof: proofConfiguration
-				}));
+				}).pipe(Effect.provideService(CurrentEmailSql, native)));
 				if (phone) {
 					const { column, eq } = backend.operations;
 					const mapping = (moduleId) => ({
@@ -251,12 +248,12 @@ const createPersistence = (backend) => {
 						engineNowMillis: backend.operations.sql`${dialect === "pg" ? backend.operations.sql`cast(extract(epoch from clock_timestamp()) * 1000 as bigint)` : backend.operations.sql`cast(round((julianday('now') - 2440587.5) * 86400000) as integer)`}`,
 						encodeInstant: storage.encodeInstant
 					});
-					const execution = executionKernel.makeTransactionExecution(CurrentPhoneTransaction, native, {
+					const execution = yield* executionKernel.makeTransactionExecution(CurrentPhoneTransaction, {
 						mode: "interactive",
 						dialect,
 						locking: dialect === "pg",
 						standaloneGuard: () => standalone(() => PhoneOtpUnavailable.make({}))
-					}, () => PhoneOtpUnavailable.make({}), randomId);
+					}, () => PhoneOtpUnavailable.make({}), randomId).pipe(Effect.provideService(NativeDatabase, native));
 					const run = (work, mutation = true) => execution.admit.pipe(Effect.andThen(execution.run(work, mutation)), Effect.provideService(LifecycleHooks, hooks));
 					const allowed = (moduleId) => features.some((feature) => feature?.kind === "phone" && feature.moduleId === moduleId);
 					const admission = PhoneAdmission.of({
@@ -268,14 +265,13 @@ const createPersistence = (backend) => {
 				}
 				if (passkeys.length > 0) {
 					const services = backend.passkeys({
-						database,
 						storage,
 						namespace: auth.namespace,
 						dialect,
 						features: passkeys,
 						passwordModules: features.flatMap((feature) => feature?.kind === "password" ? [feature.moduleId] : [])
 					});
-					context = Context.merge(context, yield* services);
+					context = Context.merge(context, yield* services.pipe(Effect.provideService(NativeDatabase, native), Effect.provideService(CurrentProofSql, native)));
 				}
 				return context;
 			})).pipe(Layer.provide(hooksLayer)),

package/dist/internal/persistence.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"persistence.mjs","names":[],"sources":["../../src/internal/persistence.ts"],"sourcesContent":["import { digest, randomId } from \"@yielded/auth-crypto\";\nimport { EmailAddressPersistence, EmailUnavailable } from \"@yielded/auth/Email\";\nimport { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport type { PasskeyConfig } from \"@yielded/auth/Passkey\";\nimport { PasswordPersistence, PasswordUnavailable } from \"@yielded/auth/Password\";\nimport { hooksLayer } from \"@yielded/auth/Persistence\";\nimport { PhoneAdmission, PhoneSignInTargets, PhoneOtpUnavailable } from \"@yielded/auth/PhoneOtp\";\nimport { ProofPersistence, ProofUnavailable } from \"@yielded/auth/Proofs\";\nimport { AuthenticationAuthority, SessionUnavailable } from \"@yielded/auth/Sessions\";\nimport { Context, Effect, Layer, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\n\nimport {\n  PersistenceConfigurationError,\n  type ClaimsCodec,\n  type ConfigId,\n  type Definition,\n  type PersistenceApi,\n  type Ports,\n  type Roles,\n  type Provisioning,\n  type ProvisioningRequirement,\n  type StorageLayout,\n  type SubjectMapping,\n  type SubjectOptions,\n  type PasskeyFeature,\n  type PasskeyRequirement,\n  type MappingInput,\n} from \"./configuration\";\nimport { makeEmailKernel, type EmailSqlDatabase } from \"./email-kernel\";\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport { makePasswordKernel, type PasswordSqlDatabase } from \"./password-kernel\";\nimport { makePhoneKernel, CurrentPhoneTransaction } from \"./phone-kernel\";\nimport { makeProofKernel, type ProofSqlDatabase, type ProofSqlQuery } from \"./proof-kernel\";\nimport type { QueryOperations } from \"./query-operations\";\nimport { makeRegistrationAuthority, type CreateSubject } from \"./registration\";\nimport { makeSessionKernel, type SessionSqlDatabase } from \"./session-kernel\";\nimport { requireStandalone } from \"./standalone\";\nimport { makeMappings } from \"./storage-mapping\";\nimport {\n  tableDefinition,\n  storageTables,\n  type StorageRole,\n  type StorageTable,\n} from \"./storage-tables\";\nimport { validateStorage } from \"./storage-validation\";\nimport { makeTransactionExecutionKernel } from \"./transaction-execution-kernel\";\nimport { makeTransactionKernel, type TransactionNativeDatabase } from \"./transaction-kernel\";\n\nexport interface Backend<T extends object, R> {\n  readonly makeTable: (definition: StorageTable) => T;\n  readonly describe: (table: T) => StorageTable;\n  readonly acquire: Effect.Effect<object, PersistenceConfigurationError, R | SqlClient.SqlClient>;\n  readonly operations: QueryOperations;\n  readonly passkeys: (input: {\n    readonly database: object;\n    readonly storage: MappingInput;\n    readonly namespace: string;\n    readonly dialect: \"pg\" | \"sqlite\";\n    readonly features: ReadonlyArray<PasskeyFeature>;\n    readonly passwordModules: ReadonlyArray<string>;\n  }) => Effect.Effect<\n    Context.Context<never>,\n    PersistenceConfigurationError,\n    PasskeyConfig | LifecycleHooks | SqlClient.SqlClient\n  >;\n}\n\nconst configError = (reason: string) => PersistenceConfigurationError.make({ reason });\n\nconst mappingError = (cause: unknown) =>\n  PersistenceMappingError.make({ operation: \"mapping\", cause });\n\nconst timestampKeys = new Set([\n  \"verifiedAt\",\n  \"createdAt\",\n  \"lastIssueAt\",\n  \"issuedAt\",\n  \"expiresAt\",\n  \"absoluteExpiresAt\",\n  \"retentionUntil\",\n  \"claimDeadline\",\n  \"retryAt\",\n  \"admittedAt\",\n  \"deadline\",\n  \"occurredAt\",\n  \"dedupUntil\",\n]);\n\nexport const createPersistence = <T extends object, R>(\n  backend: Backend<T, R>,\n): PersistenceApi<T, R> => {\n  const proofKernel = makeProofKernel(backend.operations);\n  const passwordKernel = makePasswordKernel(backend.operations, proofKernel);\n  const emailKernel = makeEmailKernel(backend.operations, proofKernel);\n  const sessionKernel = makeSessionKernel(backend.operations);\n  const transactionKernel = makeTransactionKernel(backend.operations);\n  const executionKernel = makeTransactionExecutionKernel(transactionKernel);\n  const phoneKernel = makePhoneKernel(backend.operations, transactionKernel);\n\n  const make = <C extends ClaimsCodec, const Id extends string, const A extends Definition<C, Id>>(\n    auth: A & Definition<C, Id>,\n  ) => {\n    const features = Object.values(auth.strategies).map((strategy) => strategy.persistence);\n    const phone = features.some((feature) => feature?.kind === \"phone\");\n    const password = features.some((feature) => feature?.kind === \"password\");\n\n    const passkeys = features.filter(\n      (feature): feature is PasskeyFeature => feature?.kind === \"passkey\",\n    );\n\n    const management = features.some(\n      (feature) => feature?.kind === \"password\" && feature.management,\n    );\n\n    const email = features.some((feature) => feature?.kind === \"email\" && feature.addresses);\n    const proofs = phone || management || email;\n\n    const roles: StorageRole[] = [\"identifiers\", \"credentials\", \"sessions\", \"sessionFlows\"];\n\n    if (password)\n      roles.push(\n        \"passwords\",\n        \"passwordAttempts\",\n        \"passwordScopes\",\n        \"passwordCharges\",\n        \"passwordCommands\",\n      );\n    if (management) roles.push(\"passwordRegistrations\");\n    if (email) roles.push(\"emailCredentials\", \"emailCommands\");\n    if (phone) roles.push(\"phoneState\");\n    if (passkeys.length > 0)\n      roles.push(\n        \"passkeyCredentials\",\n        \"passkeyOwnership\",\n        \"passkeyHandles\",\n        \"passkeyModules\",\n        \"passkeyFlows\",\n        \"passkeyAdmissions\",\n        \"passkeyCharges\",\n      );\n    if (passkeys.some((feature) => feature.management)) roles.push(\"passkeyCommands\");\n    if (proofs)\n      roles.push(\n        \"proofRequests\",\n        \"proofSeries\",\n        \"proofGenerations\",\n        \"proofContinuations\",\n        \"proofScopes\",\n        \"proofAbuse\",\n        \"proofFailures\",\n        \"proofCommands\",\n      );\n\n    const ConfigKey = Context.Service<\n      ConfigId<A[\"namespace\"]>,\n      StorageLayout<T, Roles<C, Id, A>>\n    >()(`@yielded/auth-persistence/${auth.namespace}/Config`);\n\n    const Config = Object.assign(ConfigKey, {\n      layer: (value: StorageLayout<T, Roles<C, Id, A>>) => Layer.succeed(ConfigKey, value),\n    });\n\n    const ProvisioningKey = Context.Service<ProvisioningRequirement<A>, Provisioning<A>>()(\n      `@yielded/auth-persistence/${auth.namespace}/Provisioning`,\n    );\n\n    // Capability metadata controls the conditional requirement, and core has\n    // already decoded each registration with its strategy's Schema.\n    const provisioners = management\n      ? ProvisioningKey.pipe(\n          Effect.map((value) => value as Readonly<Record<string, CreateSubject>>),\n        )\n      : Effect.succeed<Readonly<Record<string, CreateSubject>>>({});\n\n    const layout = <N, Instant>(\n      options: {\n        readonly subjects: SubjectOptions<T, N>;\n        readonly tables?: Partial<Record<StorageRole, T>>;\n        readonly prefix?: string;\n        readonly timestamps?: {\n          readonly type: \"text\" | \"integer\";\n          readonly codec: Schema.Codec<number, Instant>;\n        };\n      },\n      managed: boolean,\n    ): StorageLayout<T, Roles<C, Id, A>> => {\n      const subject = options.subjects;\n\n      if (passkeys.length > 0 && options.timestamps !== undefined)\n        throw configError(\n          \"Composed passkey storage uses integer milliseconds; use an explicit passkey adapter for a custom timestamp representation\",\n        );\n      const description = backend.describe(subject.table);\n      const idColumn = description.columns[subject.id];\n\n      for (const key of [subject.id, subject.status, subject.securityRevision]) {\n        if (description.columns[key] === undefined)\n          throw configError(`Missing subject column ${key}`);\n      }\n      if (subject.activeValue === undefined)\n        throw configError(\"An explicit active subject value is required\");\n\n      if (idColumn === undefined || idColumn.type === \"boolean\")\n        throw configError(\"Subject ID must map a text or integer column\");\n\n      const prefix =\n        options.prefix ?? `auth_${digest(auth.namespace).slice(0, 12).replaceAll(\"-\", \"_\")}`;\n\n      const schema: Partial<Record<StorageRole, T>> = { ...options.tables };\n\n      for (const role of roles) {\n        if (schema[role] === undefined && managed) {\n          const definition = tableDefinition(role, `${prefix}_${role}`, idColumn.type);\n\n          const adjusted =\n            options.timestamps === undefined\n              ? definition\n              : {\n                  ...definition,\n                  columns: Object.fromEntries(\n                    Object.entries(definition.columns).map(([key, column]) => [\n                      key,\n                      timestampKeys.has(key)\n                        ? { ...column, type: options.timestamps?.type ?? column.type }\n                        : column,\n                    ]),\n                  ),\n                };\n\n          schema[role] = backend.makeTable(adjusted);\n        }\n      }\n      for (const role of roles) {\n        if (schema[role] === undefined) throw configError(`Missing ${role} table`);\n      }\n      const instantCodec = options.timestamps?.codec;\n\n      const decodeInstant =\n        instantCodec === undefined\n          ? Schema.decodeUnknownEffect(Schema.Int)\n          : Schema.decodeUnknownEffect(instantCodec);\n\n      const decodeInstantSync =\n        instantCodec === undefined\n          ? Schema.decodeUnknownSync(Schema.Int)\n          : Schema.decodeUnknownSync(instantCodec);\n\n      const subjects: SubjectMapping = {\n        table: subject.table,\n        id: subject.id,\n        status: subject.status,\n        securityRevision: subject.securityRevision,\n        activeValue: subject.activeValue,\n        requirements: subject.requirements,\n        actionRequirements: subject.actionRequirements ?? subject.requirements,\n        toSubject: (id) =>\n          Schema.decodeUnknownEffect(subject.idCodec)(id).pipe(Effect.mapError(mappingError)),\n        toNative: (id) =>\n          Schema.encodeEffect(subject.idCodec)(id).pipe(Effect.mapError(mappingError)),\n        toSubjectSync: Schema.decodeUnknownSync(subject.idCodec),\n        toNativeSync: Schema.encodeSync(subject.idCodec),\n      };\n\n      return Object.freeze({\n        namespace: auth.namespace,\n        schema: Object.freeze(schema) as Readonly<Record<Roles<C, Id, A>, T>>,\n        tables: schema,\n        subjects,\n        encodeInstant:\n          instantCodec === undefined ? (millis: number) => millis : Schema.encodeSync(instantCodec),\n        decodeInstant: (value: unknown) => decodeInstant(value).pipe(Effect.mapError(mappingError)),\n        decodeInstantSync,\n      });\n    };\n\n    const services = Layer.effectContext(\n      Effect.gen(function* () {\n        const storage = yield* ConfigKey;\n        const hooks = yield* LifecycleHooks;\n        const client = yield* SqlClient.SqlClient;\n        const database = yield* backend.acquire;\n\n        const dialect = client.onDialectOrElse({\n          pg: () => \"pg\" as const,\n          sqlite: () => \"sqlite\" as const,\n          orElse: () => undefined,\n        });\n\n        if (dialect === undefined)\n          return yield* configError(\"Use an explicit adapter for this SQL dialect\");\n        if (auth.sessionMode !== \"stateful\")\n          return yield* configError(\"The composed layer currently requires stateful sessions\");\n        if (\n          features.some(\n            (feature) =>\n              feature === undefined ||\n              (\"lifecycle\" in feature && feature.lifecycle) ||\n              (feature.kind === \"email\" && !feature.addresses),\n          )\n        )\n          return yield* configError(\n            \"Use explicit services for strategies without composed persistence support\",\n          );\n        if (storage.namespace !== auth.namespace)\n          return yield* configError(\n            \"Persistence configuration belongs to a different Auth definition\",\n          );\n        for (const role of roles) {\n          const table = (storage.schema as Partial<Record<StorageRole, T>>)[role];\n\n          if (table === undefined) return yield* configError(`Missing ${role} table`);\n          const description = backend.describe(table);\n          const columns = description.columns;\n\n          for (const name of Object.keys(storageTables[role].columns)) {\n            if (columns[name] === undefined)\n              return yield* configError(`Missing ${role}.${name} column`);\n          }\n          yield* validateStorage(client, dialect, description, storageTables[role].unique);\n        }\n        yield* validateStorage(client, dialect, backend.describe(storage.subjects.table as T), [\n          [storage.subjects.id],\n        ]);\n        const mappings = makeMappings(storage);\n\n        const standalone = <E>(error: () => E) => requireStandalone(error, client);\n\n        // Backend validation owns the foreign query-builder shape, never the decoded rows.\n        const native = database as ProofSqlDatabase &\n          PasswordSqlDatabase &\n          EmailSqlDatabase &\n          SessionSqlDatabase &\n          TransactionNativeDatabase;\n\n        const options = {\n          mode: \"interactive\" as const,\n          locking: dialect === \"pg\",\n          standaloneGuard: standalone(() => SessionUnavailable.make({})),\n        };\n\n        const sessionMapping = mappings.sessions(auth.claims);\n\n        const sessionServices = yield* sessionKernel.makeSqlStatefulSessions(\n          native,\n          sessionMapping,\n          options,\n        );\n\n        const authority = yield* sessionKernel.makeSqlAuthenticationAuthority<C[\"Type\"]>(\n          native,\n          { ...mappings.authority(), isConstraintConflict: () => false },\n          options,\n        );\n\n        let context: Context.Context<never> = Context.make(AuthenticationAuthority, authority).pipe(\n          Context.add(\n            auth.sessions.StatefulSessionPersistence,\n            sessionServices.statefulSessionPersistence,\n          ),\n          Context.add(auth.sessions.SessionRepository, sessionServices.sessionRepository),\n        );\n\n        const proofConfiguration = proofs\n          ? {\n              mapping: mappings.proofs(),\n              configuration: {\n                mode: \"interactive\" as const,\n                locking: dialect === \"pg\",\n                standaloneGuard: standalone(() => ProofUnavailable.make({})),\n                insertIfAbsent: (query: ProofSqlQuery) => query.onConflictDoNothing(),\n              },\n            }\n          : undefined;\n\n        if (proofConfiguration !== undefined) {\n          context = Context.add(\n            context,\n            ProofPersistence,\n            yield* proofKernel.makeSqlProofPersistence(\n              native,\n              proofConfiguration.mapping,\n              proofConfiguration.configuration,\n            ),\n          );\n        }\n\n        if (password) {\n          const persistence = yield* passwordKernel.makeSqlPasswordPersistence(\n            native,\n            mappings.passwords(),\n            {\n              mode: \"interactive\",\n              locking: dialect === \"pg\",\n              standaloneGuard: standalone(() => PasswordUnavailable.make({})),\n              insertIfAbsent: (query) => query.onConflictDoNothing(),\n              proof: proofConfiguration,\n            },\n          );\n\n          context = Context.add(context, PasswordPersistence, persistence);\n        }\n        const creators = yield* provisioners;\n\n        for (const [name, strategy] of Object.entries(auth.strategies)) {\n          if (strategy.persistence?.kind !== \"password\" || !strategy.persistence.management)\n            continue;\n          const key = strategy.RegistrationAuthority;\n          const create = creators[name];\n\n          if (key === undefined || create === undefined)\n            return yield* configError(`Missing subject provisioning for ${name}`);\n\n          const registration = yield* makeRegistrationAuthority(\n            native,\n            mappings,\n            backend.operations,\n            standalone(() => PasswordUnavailable.make({})),\n            create,\n          );\n\n          context = Context.add(context, key, registration);\n        }\n        if (email) {\n          context = Context.add(\n            context,\n            EmailAddressPersistence,\n            yield* emailKernel.makeSqlEmailAddressPersistence(native, mappings.emails(), {\n              mode: \"interactive\",\n              locking: dialect === \"pg\",\n              standaloneGuard: standalone(() => EmailUnavailable.make({})),\n              proof: proofConfiguration,\n            }),\n          );\n        }\n        if (phone) {\n          const { column, eq } = backend.operations;\n\n          const mapping = (moduleId: string) => ({\n            moduleId,\n            subject: {\n              table: storage.subjects.table,\n              id: storage.subjects.id,\n              securityRevision: storage.subjects.securityRevision,\n              activeCondition: eq(\n                column(storage.subjects.table, storage.subjects.status),\n                storage.subjects.activeValue,\n              ),\n            },\n            subjectIds: {\n              toNative: storage.subjects.toNativeSync,\n              toSubject: storage.subjects.toSubjectSync,\n            },\n            identifier: {\n              table: mappings.table(\"identifiers\"),\n              namespace: \"namespace\",\n              value: \"value\",\n              subjectId: \"subjectId\",\n              revision: \"revision\",\n              verifiedAt: \"verifiedAt\",\n              activeCondition: eq(column(mappings.table(\"identifiers\"), \"active\"), true),\n            },\n            credential: {\n              table: mappings.table(\"credentials\"),\n              id: \"credentialId\",\n              subjectId: \"subjectId\",\n              revision: \"revision\",\n              activeCondition: eq(column(mappings.table(\"credentials\"), \"active\"), true),\n            },\n            state: {\n              table: mappings.table(\"phoneState\"),\n              scope: \"scope\",\n              state: \"state\",\n              version: \"version\",\n              encodeInsert: (row: object) => row,\n            },\n            admission: {\n              windowMillis: 60_000,\n              networkRequests: 10,\n              networkAttempts: 100,\n              maximumMessages: 10,\n              requestRetentionMillis: 86_400_000,\n            },\n            engineNowMillis: backend.operations\n              .sql`${dialect === \"pg\" ? backend.operations.sql`cast(extract(epoch from clock_timestamp()) * 1000 as bigint)` : backend.operations.sql`cast(round((julianday('now') - 2440587.5) * 86400000) as integer)`}`,\n            encodeInstant: storage.encodeInstant,\n          });\n\n          const execution = executionKernel.makeTransactionExecution(\n            CurrentPhoneTransaction,\n            native,\n            {\n              mode: \"interactive\",\n              dialect,\n              locking: dialect === \"pg\",\n              standaloneGuard: () => standalone(() => PhoneOtpUnavailable.make({})),\n            },\n            () => PhoneOtpUnavailable.make({}),\n            randomId,\n          );\n\n          const run = <Value, E, Requirements>(\n            work: Effect.Effect<Value, E, Requirements>,\n            mutation = true,\n          ) =>\n            execution.admit.pipe(\n              Effect.andThen(execution.run(work, mutation)),\n              Effect.provideService(LifecycleHooks, hooks),\n            );\n\n          const allowed = (moduleId: string) =>\n            features.some((feature) => feature?.kind === \"phone\" && feature.moduleId === moduleId);\n\n          const admission = PhoneAdmission.of({\n            admit: (request) =>\n              allowed(request.moduleId)\n                ? run(phoneKernel.admitPhone(mapping(request.moduleId), request))\n                : Effect.fail(PhoneOtpUnavailable.make({})),\n            cleanup: (request) =>\n              allowed(request.moduleId)\n                ? run(phoneKernel.cleanupPhoneAdmission(mapping(request.moduleId), request))\n                : Effect.fail(PhoneOtpUnavailable.make({})),\n          });\n\n          const targets = PhoneSignInTargets.of({\n            lookup: (request) =>\n              allowed(request.moduleId)\n                ? run(phoneKernel.lookupPhone(mapping(request.moduleId), request), false)\n                : Effect.fail(PhoneOtpUnavailable.make({})),\n          });\n\n          context = context.pipe(\n            Context.add(PhoneAdmission, admission),\n            Context.add(PhoneSignInTargets, targets),\n          );\n        }\n\n        if (passkeys.length > 0) {\n          // Auth capability metadata determines whether PasskeyConfig is required.\n          const services = backend.passkeys({\n            database,\n            storage,\n            namespace: auth.namespace,\n            dialect,\n            features: passkeys,\n            passwordModules: features.flatMap((feature) =>\n              feature?.kind === \"password\" ? [feature.moduleId] : [],\n            ),\n          }) as Effect.Effect<\n            Context.Context<never>,\n            PersistenceConfigurationError,\n            PasskeyRequirement<A> | LifecycleHooks | SqlClient.SqlClient\n          >;\n\n          context = Context.merge(context, yield* services);\n        }\n\n        // The checked capability metadata above determines exactly these service keys.\n        return context as Context.Context<Ports<C, Id, A>>;\n      }),\n    ).pipe(Layer.provide(hooksLayer));\n\n    return {\n      Config,\n      Provisioning: ProvisioningKey,\n      layer: services,\n      managed: <N, Instant = number>(options: {\n        readonly subjects: SubjectOptions<T, N>;\n        readonly tables?: Partial<Record<Roles<C, Id, A>, T>>;\n        readonly prefix?: string;\n        readonly timestamps?: {\n          readonly type: \"text\" | \"integer\";\n          readonly codec: Schema.Codec<number, Instant>;\n        };\n      }) => layout(options, true),\n      map: <N, Instant = number>(options: {\n        readonly subjects: SubjectOptions<T, N>;\n        readonly tables: Partial<Record<StorageRole, T>>;\n        readonly timestamps?: {\n          readonly type: \"text\" | \"integer\";\n          readonly codec: Schema.Codec<number, Instant>;\n        };\n      }) => layout(options, false),\n    };\n  };\n\n  return { make };\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAoEA,MAAM,eAAe,WAAmB,8BAA8B,KAAK,EAAE,OAAO,CAAC;AAErF,MAAM,gBAAgB,UACpB,wBAAwB,KAAK;CAAE,WAAW;CAAW;AAAM,CAAC;AAE9D,MAAM,gCAAgB,IAAI,IAAI;CAC5B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,MAAa,qBACX,YACyB;CACzB,MAAM,cAAc,gBAAgB,QAAQ,UAAU;CACtD,MAAM,iBAAiB,mBAAmB,QAAQ,YAAY,WAAW;CACzE,MAAM,cAAc,gBAAgB,QAAQ,YAAY,WAAW;CACnE,MAAM,gBAAgB,kBAAkB,QAAQ,UAAU;CAC1D,MAAM,oBAAoB,sBAAsB,QAAQ,UAAU;CAClE,MAAM,kBAAkB,+BAA+B,iBAAiB;CACxE,MAAM,cAAc,gBAAgB,QAAQ,YAAY,iBAAiB;CAEzE,MAAM,QACJ,SACG;EACH,MAAM,WAAW,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,KAAK,aAAa,SAAS,WAAW;EACtF,MAAM,QAAQ,SAAS,MAAM,YAAY,SAAS,SAAS,OAAO;EAClE,MAAM,WAAW,SAAS,MAAM,YAAY,SAAS,SAAS,UAAU;EAExE,MAAM,WAAW,SAAS,QACvB,YAAuC,SAAS,SAAS,SAC5D;EAEA,MAAM,aAAa,SAAS,MACzB,YAAY,SAAS,SAAS,cAAc,QAAQ,UACvD;EAEA,MAAM,QAAQ,SAAS,MAAM,YAAY,SAAS,SAAS,WAAW,QAAQ,SAAS;EACvF,MAAM,SAAS,SAAS,cAAc;EAEtC,MAAM,QAAuB;GAAC;GAAe;GAAe;GAAY;EAAc;EAEtF,IAAI,UACF,MAAM,KACJ,aACA,oBACA,kBACA,mBACA,kBACF;EACF,IAAI,YAAY,MAAM,KAAK,uBAAuB;EAClD,IAAI,OAAO,MAAM,KAAK,oBAAoB,eAAe;EACzD,IAAI,OAAO,MAAM,KAAK,YAAY;EAClC,IAAI,SAAS,SAAS,GACpB,MAAM,KACJ,sBACA,oBACA,kBACA,kBACA,gBACA,qBACA,gBACF;EACF,IAAI,SAAS,MAAM,YAAY,QAAQ,UAAU,GAAG,MAAM,KAAK,iBAAiB;EAChF,IAAI,QACF,MAAM,KACJ,iBACA,eACA,oBACA,sBACA,eACA,cACA,iBACA,eACF;EAEF,MAAM,YAAY,QAAQ,QAGxB,CAAC,CAAC,6BAA6B,KAAK,UAAU,QAAQ;EAExD,MAAM,SAAS,OAAO,OAAO,WAAW,EACtC,QAAQ,UAA6C,MAAM,QAAQ,WAAW,KAAK,EACrF,CAAC;EAED,MAAM,kBAAkB,QAAQ,QAAqD,CAAC,CACpF,6BAA6B,KAAK,UAAU,cAC9C;EAIA,MAAM,eAAe,aACjB,gBAAgB,KACd,OAAO,KAAK,UAAU,KAAgD,CACxE,IACA,OAAO,QAAiD,CAAC,CAAC;EAE9D,MAAM,UACJ,SASA,YACsC;GACtC,MAAM,UAAU,QAAQ;GAExB,IAAI,SAAS,SAAS,KAAK,QAAQ,eAAe,KAAA,GAChD,MAAM,YACJ,2HACF;GACF,MAAM,cAAc,QAAQ,SAAS,QAAQ,KAAK;GAClD,MAAM,WAAW,YAAY,QAAQ,QAAQ;GAE7C,KAAK,MAAM,OAAO;IAAC,QAAQ;IAAI,QAAQ;IAAQ,QAAQ;GAAgB,GACrE,IAAI,YAAY,QAAQ,SAAS,KAAA,GAC/B,MAAM,YAAY,0BAA0B,KAAK;GAErD,IAAI,QAAQ,gBAAgB,KAAA,GAC1B,MAAM,YAAY,8CAA8C;GAElE,IAAI,aAAa,KAAA,KAAa,SAAS,SAAS,WAC9C,MAAM,YAAY,8CAA8C;GAElE,MAAM,SACJ,QAAQ,UAAU,QAAQ,OAAO,KAAK,SAAS,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,WAAW,KAAK,GAAG;GAEnF,MAAM,SAA0C,EAAE,GAAG,QAAQ,OAAO;GAEpE,KAAK,MAAM,QAAQ,OACjB,IAAI,OAAO,UAAU,KAAA,KAAa,SAAS;IACzC,MAAM,aAAa,gBAAgB,MAAM,GAAG,OAAO,GAAG,QAAQ,SAAS,IAAI;IAE3E,MAAM,WACJ,QAAQ,eAAe,KAAA,IACnB,aACA;KACE,GAAG;KACH,SAAS,OAAO,YACd,OAAO,QAAQ,WAAW,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,YAAY,CACxD,KACA,cAAc,IAAI,GAAG,IACjB;MAAE,GAAG;MAAQ,MAAM,QAAQ,YAAY,QAAQ,OAAO;KAAK,IAC3D,MACN,CAAC,CACH;IACF;IAEN,OAAO,QAAQ,QAAQ,UAAU,QAAQ;GAC3C;GAEF,KAAK,MAAM,QAAQ,OACjB,IAAI,OAAO,UAAU,KAAA,GAAW,MAAM,YAAY,WAAW,KAAK,OAAO;GAE3E,MAAM,eAAe,QAAQ,YAAY;GAEzC,MAAM,gBACJ,iBAAiB,KAAA,IACb,OAAO,oBAAoB,OAAO,GAAG,IACrC,OAAO,oBAAoB,YAAY;GAE7C,MAAM,oBACJ,iBAAiB,KAAA,IACb,OAAO,kBAAkB,OAAO,GAAG,IACnC,OAAO,kBAAkB,YAAY;GAE3C,MAAM,WAA2B;IAC/B,OAAO,QAAQ;IACf,IAAI,QAAQ;IACZ,QAAQ,QAAQ;IAChB,kBAAkB,QAAQ;IAC1B,aAAa,QAAQ;IACrB,cAAc,QAAQ;IACtB,oBAAoB,QAAQ,sBAAsB,QAAQ;IAC1D,YAAY,OACV,OAAO,oBAAoB,QAAQ,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,OAAO,SAAS,YAAY,CAAC;IACpF,WAAW,OACT,OAAO,aAAa,QAAQ,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,OAAO,SAAS,YAAY,CAAC;IAC7E,eAAe,OAAO,kBAAkB,QAAQ,OAAO;IACvD,cAAc,OAAO,WAAW,QAAQ,OAAO;GACjD;GAEA,OAAO,OAAO,OAAO;IACnB,WAAW,KAAK;IAChB,QAAQ,OAAO,OAAO,MAAM;IAC5B,QAAQ;IACR;IACA,eACE,iBAAiB,KAAA,KAAa,WAAmB,SAAS,OAAO,WAAW,YAAY;IAC1F,gBAAgB,UAAmB,cAAc,KAAK,CAAC,CAAC,KAAK,OAAO,SAAS,YAAY,CAAC;IAC1F;GACF,CAAC;EACH;EAgSA,OAAO;GACL;GACA,cAAc;GACd,OAjSe,MAAM,cACrB,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO;IACvB,MAAM,QAAQ,OAAO;IACrB,MAAM,SAAS,OAAO,UAAU;IAChC,MAAM,WAAW,OAAO,QAAQ;IAEhC,MAAM,UAAU,OAAO,gBAAgB;KACrC,UAAU;KACV,cAAc;KACd,cAAc,KAAA;IAChB,CAAC;IAED,IAAI,YAAY,KAAA,GACd,OAAO,OAAO,YAAY,8CAA8C;IAC1E,IAAI,KAAK,gBAAgB,YACvB,OAAO,OAAO,YAAY,yDAAyD;IACrF,IACE,SAAS,MACN,YACC,YAAY,KAAA,KACX,eAAe,WAAW,QAAQ,aAClC,QAAQ,SAAS,WAAW,CAAC,QAAQ,SAC1C,GAEA,OAAO,OAAO,YACZ,2EACF;IACF,IAAI,QAAQ,cAAc,KAAK,WAC7B,OAAO,OAAO,YACZ,kEACF;IACF,KAAK,MAAM,QAAQ,OAAO;KACxB,MAAM,QAAS,QAAQ,OAA2C;KAElE,IAAI,UAAU,KAAA,GAAW,OAAO,OAAO,YAAY,WAAW,KAAK,OAAO;KAC1E,MAAM,cAAc,QAAQ,SAAS,KAAK;KAC1C,MAAM,UAAU,YAAY;KAE5B,KAAK,MAAM,QAAQ,OAAO,KAAK,cAAc,KAAK,CAAC,OAAO,GACxD,IAAI,QAAQ,UAAU,KAAA,GACpB,OAAO,OAAO,YAAY,WAAW,KAAK,GAAG,KAAK,QAAQ;KAE9D,OAAO,gBAAgB,QAAQ,SAAS,aAAa,cAAc,KAAK,CAAC,MAAM;IACjF;IACA,OAAO,gBAAgB,QAAQ,SAAS,QAAQ,SAAS,QAAQ,SAAS,KAAU,GAAG,CACrF,CAAC,QAAQ,SAAS,EAAE,CACtB,CAAC;IACD,MAAM,WAAW,aAAa,OAAO;IAErC,MAAM,cAAiB,UAAmB,kBAAkB,OAAO,MAAM;IAGzE,MAAM,SAAS;IAMf,MAAM,UAAU;KACd,MAAM;KACN,SAAS,YAAY;KACrB,iBAAiB,iBAAiB,mBAAmB,KAAK,CAAC,CAAC,CAAC;IAC/D;IAEA,MAAM,iBAAiB,SAAS,SAAS,KAAK,MAAM;IAEpD,MAAM,kBAAkB,OAAO,cAAc,wBAC3C,QACA,gBACA,OACF;IAEA,MAAM,YAAY,OAAO,cAAc,+BACrC,QACA;KAAE,GAAG,SAAS,UAAU;KAAG,4BAA4B;IAAM,GAC7D,OACF;IAEA,IAAI,UAAkC,QAAQ,KAAK,yBAAyB,SAAS,CAAC,CAAC,KACrF,QAAQ,IACN,KAAK,SAAS,4BACd,gBAAgB,0BAClB,GACA,QAAQ,IAAI,KAAK,SAAS,mBAAmB,gBAAgB,iBAAiB,CAChF;IAEA,MAAM,qBAAqB,SACvB;KACE,SAAS,SAAS,OAAO;KACzB,eAAe;MACb,MAAM;MACN,SAAS,YAAY;MACrB,iBAAiB,iBAAiB,iBAAiB,KAAK,CAAC,CAAC,CAAC;MAC3D,iBAAiB,UAAyB,MAAM,oBAAoB;KACtE;IACF,IACA,KAAA;IAEJ,IAAI,uBAAuB,KAAA,GACzB,UAAU,QAAQ,IAChB,SACA,kBACA,OAAO,YAAY,wBACjB,QACA,mBAAmB,SACnB,mBAAmB,aACrB,CACF;IAGF,IAAI,UAAU;KACZ,MAAM,cAAc,OAAO,eAAe,2BACxC,QACA,SAAS,UAAU,GACnB;MACE,MAAM;MACN,SAAS,YAAY;MACrB,iBAAiB,iBAAiB,oBAAoB,KAAK,CAAC,CAAC,CAAC;MAC9D,iBAAiB,UAAU,MAAM,oBAAoB;MACrD,OAAO;KACT,CACF;KAEA,UAAU,QAAQ,IAAI,SAAS,qBAAqB,WAAW;IACjE;IACA,MAAM,WAAW,OAAO;IAExB,KAAK,MAAM,CAAC,MAAM,aAAa,OAAO,QAAQ,KAAK,UAAU,GAAG;KAC9D,IAAI,SAAS,aAAa,SAAS,cAAc,CAAC,SAAS,YAAY,YACrE;KACF,MAAM,MAAM,SAAS;KACrB,MAAM,SAAS,SAAS;KAExB,IAAI,QAAQ,KAAA,KAAa,WAAW,KAAA,GAClC,OAAO,OAAO,YAAY,oCAAoC,MAAM;KAEtE,MAAM,eAAe,OAAO,0BAC1B,QACA,UACA,QAAQ,YACR,iBAAiB,oBAAoB,KAAK,CAAC,CAAC,CAAC,GAC7C,MACF;KAEA,UAAU,QAAQ,IAAI,SAAS,KAAK,YAAY;IAClD;IACA,IAAI,OACF,UAAU,QAAQ,IAChB,SACA,yBACA,OAAO,YAAY,+BAA+B,QAAQ,SAAS,OAAO,GAAG;KAC3E,MAAM;KACN,SAAS,YAAY;KACrB,iBAAiB,iBAAiB,iBAAiB,KAAK,CAAC,CAAC,CAAC;KAC3D,OAAO;IACT,CAAC,CACH;IAEF,IAAI,OAAO;KACT,MAAM,EAAE,QAAQ,OAAO,QAAQ;KAE/B,MAAM,WAAW,cAAsB;MACrC;MACA,SAAS;OACP,OAAO,QAAQ,SAAS;OACxB,IAAI,QAAQ,SAAS;OACrB,kBAAkB,QAAQ,SAAS;OACnC,iBAAiB,GACf,OAAO,QAAQ,SAAS,OAAO,QAAQ,SAAS,MAAM,GACtD,QAAQ,SAAS,WACnB;MACF;MACA,YAAY;OACV,UAAU,QAAQ,SAAS;OAC3B,WAAW,QAAQ,SAAS;MAC9B;MACA,YAAY;OACV,OAAO,SAAS,MAAM,aAAa;OACnC,WAAW;OACX,OAAO;OACP,WAAW;OACX,UAAU;OACV,YAAY;OACZ,iBAAiB,GAAG,OAAO,SAAS,MAAM,aAAa,GAAG,QAAQ,GAAG,IAAI;MAC3E;MACA,YAAY;OACV,OAAO,SAAS,MAAM,aAAa;OACnC,IAAI;OACJ,WAAW;OACX,UAAU;OACV,iBAAiB,GAAG,OAAO,SAAS,MAAM,aAAa,GAAG,QAAQ,GAAG,IAAI;MAC3E;MACA,OAAO;OACL,OAAO,SAAS,MAAM,YAAY;OAClC,OAAO;OACP,OAAO;OACP,SAAS;OACT,eAAe,QAAgB;MACjC;MACA,WAAW;OACT,cAAc;OACd,iBAAiB;OACjB,iBAAiB;OACjB,iBAAiB;OACjB,wBAAwB;MAC1B;MACA,iBAAiB,QAAQ,WACtB,GAAG,GAAG,YAAY,OAAO,QAAQ,WAAW,GAAG,iEAAiE,QAAQ,WAAW,GAAG;MACzI,eAAe,QAAQ;KACzB;KAEA,MAAM,YAAY,gBAAgB,yBAChC,yBACA,QACA;MACE,MAAM;MACN;MACA,SAAS,YAAY;MACrB,uBAAuB,iBAAiB,oBAAoB,KAAK,CAAC,CAAC,CAAC;KACtE,SACM,oBAAoB,KAAK,CAAC,CAAC,GACjC,QACF;KAEA,MAAM,OACJ,MACA,WAAW,SAEX,UAAU,MAAM,KACd,OAAO,QAAQ,UAAU,IAAI,MAAM,QAAQ,CAAC,GAC5C,OAAO,eAAe,gBAAgB,KAAK,CAC7C;KAEF,MAAM,WAAW,aACf,SAAS,MAAM,YAAY,SAAS,SAAS,WAAW,QAAQ,aAAa,QAAQ;KAEvF,MAAM,YAAY,eAAe,GAAG;MAClC,QAAQ,YACN,QAAQ,QAAQ,QAAQ,IACpB,IAAI,YAAY,WAAW,QAAQ,QAAQ,QAAQ,GAAG,OAAO,CAAC,IAC9D,OAAO,KAAK,oBAAoB,KAAK,CAAC,CAAC,CAAC;MAC9C,UAAU,YACR,QAAQ,QAAQ,QAAQ,IACpB,IAAI,YAAY,sBAAsB,QAAQ,QAAQ,QAAQ,GAAG,OAAO,CAAC,IACzE,OAAO,KAAK,oBAAoB,KAAK,CAAC,CAAC,CAAC;KAChD,CAAC;KAED,MAAM,UAAU,mBAAmB,GAAG,EACpC,SAAS,YACP,QAAQ,QAAQ,QAAQ,IACpB,IAAI,YAAY,YAAY,QAAQ,QAAQ,QAAQ,GAAG,OAAO,GAAG,KAAK,IACtE,OAAO,KAAK,oBAAoB,KAAK,CAAC,CAAC,CAAC,EAChD,CAAC;KAED,UAAU,QAAQ,KAChB,QAAQ,IAAI,gBAAgB,SAAS,GACrC,QAAQ,IAAI,oBAAoB,OAAO,CACzC;IACF;IAEA,IAAI,SAAS,SAAS,GAAG;KAEvB,MAAM,WAAW,QAAQ,SAAS;MAChC;MACA;MACA,WAAW,KAAK;MAChB;MACA,UAAU;MACV,iBAAiB,SAAS,SAAS,YACjC,SAAS,SAAS,aAAa,CAAC,QAAQ,QAAQ,IAAI,CAAC,CACvD;KACF,CAAC;KAMD,UAAU,QAAQ,MAAM,SAAS,OAAO,QAAQ;IAClD;IAGA,OAAO;GACT,CAAC,CACH,CAAC,CAAC,KAAK,MAAM,QAAQ,UAAU,CAKf;GACd,UAA+B,YAQzB,OAAO,SAAS,IAAI;GAC1B,MAA2B,YAOrB,OAAO,SAAS,KAAK;EAC7B;CACF;CAEA,OAAO,EAAE,KAAK;AAChB"}
+{"version":3,"file":"persistence.mjs","names":[],"sources":["../../src/internal/persistence.ts"],"sourcesContent":["import { digest, randomId } from \"@yielded/auth-crypto\";\nimport { EmailAddressPersistence, EmailUnavailable } from \"@yielded/auth/Email\";\nimport { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport type { PasskeyConfig } from \"@yielded/auth/Passkey\";\nimport { PasswordPersistence, PasswordUnavailable } from \"@yielded/auth/Password\";\nimport { hooksLayer } from \"@yielded/auth/Persistence\";\nimport { PhoneAdmission, PhoneSignInTargets, PhoneOtpUnavailable } from \"@yielded/auth/PhoneOtp\";\nimport { ProofPersistence, ProofUnavailable } from \"@yielded/auth/Proofs\";\nimport { AuthenticationAuthority, SessionUnavailable } from \"@yielded/auth/Sessions\";\nimport { Context, Effect, Layer, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\n\nimport {\n  PersistenceConfigurationError,\n  type ClaimsCodec,\n  type ConfigId,\n  type Definition,\n  type PersistenceApi,\n  type Ports,\n  type Roles,\n  type Provisioning,\n  type ProvisioningRequirement,\n  type StorageLayout,\n  type SubjectMapping,\n  type SubjectOptions,\n  type PasskeyFeature,\n  type PasskeyRequirement,\n  type MappingInput,\n} from \"./configuration\";\nimport { makeEmailKernel, CurrentEmailSql, type EmailSqlDatabase } from \"./email-kernel\";\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport {\n  makePasswordKernel,\n  CurrentPasswordSql,\n  type PasswordSqlDatabase,\n} from \"./password-kernel\";\nimport { makePhoneKernel, CurrentPhoneTransaction } from \"./phone-kernel\";\nimport {\n  makeProofKernel,\n  CurrentProofSql,\n  type ProofSqlDatabase,\n  type ProofSqlQuery,\n} from \"./proof-kernel\";\nimport type { QueryOperations } from \"./query-operations\";\nimport { makeRegistrationAuthority } from \"./registration\";\nimport { makeSessionKernel, CurrentSessionSql, type SessionSqlDatabase } from \"./session-kernel\";\nimport { requireStandalone } from \"./standalone\";\nimport { makeMappings } from \"./storage-mapping\";\nimport {\n  tableDefinition,\n  storageTables,\n  type StorageRole,\n  type StorageTable,\n} from \"./storage-tables\";\nimport { validateStorage } from \"./storage-validation\";\nimport { makeTransactionExecutionKernel } from \"./transaction-execution-kernel\";\nimport {\n  makeTransactionKernel,\n  NativeDatabase,\n  type TransactionNativeDatabase,\n} from \"./transaction-kernel\";\n\nexport interface Backend<T extends object, R> {\n  readonly makeTable: (definition: StorageTable) => T;\n  readonly describe: (table: T) => StorageTable;\n  readonly acquire: Effect.Effect<object, PersistenceConfigurationError, R | SqlClient.SqlClient>;\n  readonly operations: QueryOperations;\n  readonly passkeys: (input: {\n    readonly storage: MappingInput;\n    readonly namespace: string;\n    readonly dialect: \"pg\" | \"sqlite\";\n    readonly features: ReadonlyArray<PasskeyFeature>;\n    readonly passwordModules: ReadonlyArray<string>;\n  }) => Effect.Effect<\n    Context.Context<never>,\n    PersistenceConfigurationError,\n    PasskeyConfig | LifecycleHooks | SqlClient.SqlClient | NativeDatabase | CurrentProofSql\n  >;\n}\n\nconst configError = (reason: string) => PersistenceConfigurationError.make({ reason });\n\nconst mappingError = (cause: unknown) =>\n  PersistenceMappingError.make({ operation: \"mapping\", cause });\n\nconst timestampKeys = new Set([\n  \"verifiedAt\",\n  \"createdAt\",\n  \"lastIssueAt\",\n  \"issuedAt\",\n  \"expiresAt\",\n  \"absoluteExpiresAt\",\n  \"retentionUntil\",\n  \"claimDeadline\",\n  \"retryAt\",\n  \"admittedAt\",\n  \"deadline\",\n  \"occurredAt\",\n  \"dedupUntil\",\n]);\n\nexport const createPersistence = <T extends object, R>(\n  backend: Backend<T, R>,\n): PersistenceApi<T, R> => {\n  const proofKernel = makeProofKernel(backend.operations);\n  const passwordKernel = makePasswordKernel(backend.operations, proofKernel);\n  const emailKernel = makeEmailKernel(backend.operations, proofKernel);\n  const sessionKernel = makeSessionKernel(backend.operations);\n  const transactionKernel = makeTransactionKernel(backend.operations);\n  const executionKernel = makeTransactionExecutionKernel(transactionKernel);\n  const phoneKernel = makePhoneKernel(backend.operations, transactionKernel);\n\n  const make = <C extends ClaimsCodec, const Id extends string, const A extends Definition<C, Id>>(\n    auth: A & Definition<C, Id>,\n  ) => {\n    const features = Object.values(auth.strategies).map((strategy) => strategy.persistence);\n    const phone = features.some((feature) => feature?.kind === \"phone\");\n    const password = features.some((feature) => feature?.kind === \"password\");\n\n    const passkeys = features.filter(\n      (feature): feature is PasskeyFeature => feature?.kind === \"passkey\",\n    );\n\n    const management = features.some(\n      (feature) => feature?.kind === \"password\" && feature.management,\n    );\n\n    const email = features.some((feature) => feature?.kind === \"email\" && feature.addresses);\n    const proofs = phone || management || email;\n\n    const roles: StorageRole[] = [\"identifiers\", \"credentials\", \"sessions\", \"sessionFlows\"];\n\n    if (password)\n      roles.push(\n        \"passwords\",\n        \"passwordAttempts\",\n        \"passwordScopes\",\n        \"passwordCharges\",\n        \"passwordCommands\",\n      );\n    if (management) roles.push(\"passwordRegistrations\");\n    if (email) roles.push(\"emailCredentials\", \"emailCommands\");\n    if (phone) roles.push(\"phoneState\");\n    if (passkeys.length > 0)\n      roles.push(\n        \"passkeyCredentials\",\n        \"passkeyOwnership\",\n        \"passkeyHandles\",\n        \"passkeyModules\",\n        \"passkeyFlows\",\n        \"passkeyAdmissions\",\n        \"passkeyCharges\",\n      );\n    if (passkeys.some((feature) => feature.management)) roles.push(\"passkeyCommands\");\n    if (proofs)\n      roles.push(\n        \"proofRequests\",\n        \"proofSeries\",\n        \"proofGenerations\",\n        \"proofContinuations\",\n        \"proofScopes\",\n        \"proofAbuse\",\n        \"proofFailures\",\n        \"proofCommands\",\n      );\n\n    const ConfigKey = Context.Service<\n      ConfigId<A[\"namespace\"]>,\n      StorageLayout<T, Roles<C, Id, A>>\n    >()(`@yielded/auth-persistence/${auth.namespace}/Config`);\n\n    const Config = Object.assign(ConfigKey, {\n      layer: (value: StorageLayout<T, Roles<C, Id, A>>) => Layer.succeed(ConfigKey, value),\n    });\n\n    const ProvisioningKey = Context.Service<ProvisioningRequirement<A>, Provisioning<A>>()(\n      `@yielded/auth-persistence/${auth.namespace}/Provisioning`,\n    );\n\n    const layout = <N, Instant>(\n      options: {\n        readonly subjects: SubjectOptions<T, N>;\n        readonly tables?: Partial<Record<StorageRole, T>>;\n        readonly prefix?: string;\n        readonly timestamps?: {\n          readonly type: \"text\" | \"integer\";\n          readonly codec: Schema.Codec<number, Instant>;\n        };\n      },\n      managed: boolean,\n    ): StorageLayout<T, Roles<C, Id, A>> => {\n      const subject = options.subjects;\n\n      if (passkeys.length > 0 && options.timestamps !== undefined)\n        throw configError(\n          \"Composed passkey storage uses integer milliseconds; use an explicit passkey adapter for a custom timestamp representation\",\n        );\n      const description = backend.describe(subject.table);\n      const idColumn = description.columns[subject.id];\n\n      for (const key of [subject.id, subject.status, subject.securityRevision]) {\n        if (description.columns[key] === undefined)\n          throw configError(`Missing subject column ${key}`);\n      }\n      if (subject.activeValue === undefined)\n        throw configError(\"An explicit active subject value is required\");\n\n      if (idColumn === undefined || idColumn.type === \"boolean\")\n        throw configError(\"Subject ID must map a text or integer column\");\n\n      const prefix =\n        options.prefix ?? `auth_${digest(auth.namespace).slice(0, 12).replaceAll(\"-\", \"_\")}`;\n\n      const schema: Partial<Record<StorageRole, T>> = { ...options.tables };\n\n      for (const role of roles) {\n        if (schema[role] === undefined && managed) {\n          const definition = tableDefinition(role, `${prefix}_${role}`, idColumn.type);\n\n          const adjusted =\n            options.timestamps === undefined\n              ? definition\n              : {\n                  ...definition,\n                  columns: Object.fromEntries(\n                    Object.entries(definition.columns).map(([key, column]) => [\n                      key,\n                      timestampKeys.has(key)\n                        ? { ...column, type: options.timestamps?.type ?? column.type }\n                        : column,\n                    ]),\n                  ),\n                };\n\n          schema[role] = backend.makeTable(adjusted);\n        }\n      }\n      for (const role of roles) {\n        if (schema[role] === undefined) throw configError(`Missing ${role} table`);\n      }\n      const instantCodec = options.timestamps?.codec;\n\n      const decodeInstant =\n        instantCodec === undefined\n          ? Schema.decodeUnknownEffect(Schema.Int)\n          : Schema.decodeUnknownEffect(instantCodec);\n\n      const decodeInstantSync =\n        instantCodec === undefined\n          ? Schema.decodeUnknownSync(Schema.Int)\n          : Schema.decodeUnknownSync(instantCodec);\n\n      const subjects: SubjectMapping = {\n        table: subject.table,\n        id: subject.id,\n        status: subject.status,\n        securityRevision: subject.securityRevision,\n        activeValue: subject.activeValue,\n        requirements: subject.requirements,\n        actionRequirements: subject.actionRequirements ?? subject.requirements,\n        toSubject: (id) =>\n          Schema.decodeUnknownEffect(subject.idCodec)(id).pipe(Effect.mapError(mappingError)),\n        toNative: (id) =>\n          Schema.encodeEffect(subject.idCodec)(id).pipe(Effect.mapError(mappingError)),\n        toSubjectSync: Schema.decodeUnknownSync(subject.idCodec),\n        toNativeSync: Schema.encodeSync(subject.idCodec),\n      };\n\n      return Object.freeze({\n        namespace: auth.namespace,\n        schema: Object.freeze(schema) as Readonly<Record<Roles<C, Id, A>, T>>,\n        tables: schema,\n        subjects,\n        encodeInstant:\n          instantCodec === undefined ? (millis: number) => millis : Schema.encodeSync(instantCodec),\n        decodeInstant: (value: unknown) => decodeInstant(value).pipe(Effect.mapError(mappingError)),\n        decodeInstantSync,\n      });\n    };\n\n    const services = Layer.effectContext(\n      Effect.gen(function* () {\n        const storage = yield* ConfigKey;\n        const hooks = yield* LifecycleHooks;\n        const client = yield* SqlClient.SqlClient;\n        const database = yield* backend.acquire;\n\n        const dialect = client.onDialectOrElse({\n          pg: () => \"pg\" as const,\n          sqlite: () => \"sqlite\" as const,\n          orElse: () => undefined,\n        });\n\n        if (dialect === undefined)\n          return yield* configError(\"Use an explicit adapter for this SQL dialect\");\n        if (auth.sessionMode !== \"stateful\")\n          return yield* configError(\"The composed layer currently requires stateful sessions\");\n        if (\n          features.some(\n            (feature) =>\n              feature === undefined ||\n              (\"lifecycle\" in feature && feature.lifecycle) ||\n              (feature.kind === \"email\" && !feature.addresses),\n          )\n        )\n          return yield* configError(\n            \"Use explicit services for strategies without composed persistence support\",\n          );\n        if (storage.namespace !== auth.namespace)\n          return yield* configError(\n            \"Persistence configuration belongs to a different Auth definition\",\n          );\n        for (const role of roles) {\n          const table = (storage.schema as Partial<Record<StorageRole, T>>)[role];\n\n          if (table === undefined) return yield* configError(`Missing ${role} table`);\n          const description = backend.describe(table);\n          const columns = description.columns;\n\n          for (const name of Object.keys(storageTables[role].columns)) {\n            if (columns[name] === undefined)\n              return yield* configError(`Missing ${role}.${name} column`);\n          }\n          yield* validateStorage(dialect, description, storageTables[role].unique);\n        }\n        yield* validateStorage(dialect, backend.describe(storage.subjects.table as T), [\n          [storage.subjects.id],\n        ]);\n        const mappings = makeMappings(storage);\n\n        const standalone = <E>(error: () => E) =>\n          requireStandalone(error, client.transactionService);\n\n        // Backend validation owns the foreign query-builder shape, never the decoded rows.\n        const native = database as ProofSqlDatabase &\n          PasswordSqlDatabase &\n          EmailSqlDatabase &\n          SessionSqlDatabase &\n          TransactionNativeDatabase;\n\n        const options = {\n          mode: \"interactive\" as const,\n          locking: dialect === \"pg\",\n          standaloneGuard: standalone(() => SessionUnavailable.make({})),\n        };\n\n        const sessionMapping = mappings.sessions(auth.claims);\n\n        const sessionServices = yield* sessionKernel\n          .makeSqlStatefulSessions(sessionMapping, options)\n          .pipe(Effect.provideService(CurrentSessionSql, native));\n\n        const authority = yield* sessionKernel\n          .makeSqlAuthenticationAuthority<C[\"Type\"]>(\n            { ...mappings.authority(), isConstraintConflict: () => false },\n            options,\n          )\n          .pipe(Effect.provideService(CurrentSessionSql, native));\n\n        let context: Context.Context<never> = Context.make(AuthenticationAuthority, authority).pipe(\n          Context.add(\n            auth.sessions.StatefulSessionPersistence,\n            sessionServices.statefulSessionPersistence,\n          ),\n          Context.add(auth.sessions.SessionRepository, sessionServices.sessionRepository),\n        );\n\n        const proofConfiguration = proofs\n          ? {\n              mapping: mappings.proofs(),\n              configuration: {\n                mode: \"interactive\" as const,\n                locking: dialect === \"pg\",\n                standaloneGuard: standalone(() => ProofUnavailable.make({})),\n                insertIfAbsent: (query: ProofSqlQuery) => query.onConflictDoNothing(),\n              },\n            }\n          : undefined;\n\n        if (proofConfiguration !== undefined) {\n          context = Context.add(\n            context,\n            ProofPersistence,\n            yield* proofKernel\n              .makeSqlProofPersistence(proofConfiguration.mapping, proofConfiguration.configuration)\n              .pipe(Effect.provideService(CurrentProofSql, native)),\n          );\n        }\n\n        if (password) {\n          const persistence = yield* passwordKernel\n            .makeSqlPasswordPersistence(mappings.passwords(), {\n              mode: \"interactive\",\n              locking: dialect === \"pg\",\n              standaloneGuard: standalone(() => PasswordUnavailable.make({})),\n              insertIfAbsent: (query) => query.onConflictDoNothing(),\n              proof: proofConfiguration,\n            })\n            .pipe(Effect.provideService(CurrentPasswordSql, native));\n\n          context = Context.add(context, PasswordPersistence, persistence);\n        }\n        for (const [name, strategy] of Object.entries(auth.strategies)) {\n          if (strategy.persistence?.kind !== \"password\" || !strategy.persistence.management)\n            continue;\n          const key = strategy.RegistrationAuthority;\n\n          if (key === undefined)\n            return yield* configError(`Missing subject provisioning for ${name}`);\n\n          const registration = yield* makeRegistrationAuthority(\n            mappings,\n            backend.operations,\n            standalone(() => PasswordUnavailable.make({})),\n            ProvisioningKey,\n            name,\n          ).pipe(Effect.provideService(CurrentPasswordSql, native));\n\n          context = Context.add(context, key, registration);\n        }\n        if (email) {\n          context = Context.add(\n            context,\n            EmailAddressPersistence,\n            yield* emailKernel\n              .makeSqlEmailAddressPersistence(mappings.emails(), {\n                mode: \"interactive\",\n                locking: dialect === \"pg\",\n                standaloneGuard: standalone(() => EmailUnavailable.make({})),\n                proof: proofConfiguration,\n              })\n              .pipe(Effect.provideService(CurrentEmailSql, native)),\n          );\n        }\n        if (phone) {\n          const { column, eq } = backend.operations;\n\n          const mapping = (moduleId: string) => ({\n            moduleId,\n            subject: {\n              table: storage.subjects.table,\n              id: storage.subjects.id,\n              securityRevision: storage.subjects.securityRevision,\n              activeCondition: eq(\n                column(storage.subjects.table, storage.subjects.status),\n                storage.subjects.activeValue,\n              ),\n            },\n            subjectIds: {\n              toNative: storage.subjects.toNativeSync,\n              toSubject: storage.subjects.toSubjectSync,\n            },\n            identifier: {\n              table: mappings.table(\"identifiers\"),\n              namespace: \"namespace\",\n              value: \"value\",\n              subjectId: \"subjectId\",\n              revision: \"revision\",\n              verifiedAt: \"verifiedAt\",\n              activeCondition: eq(column(mappings.table(\"identifiers\"), \"active\"), true),\n            },\n            credential: {\n              table: mappings.table(\"credentials\"),\n              id: \"credentialId\",\n              subjectId: \"subjectId\",\n              revision: \"revision\",\n              activeCondition: eq(column(mappings.table(\"credentials\"), \"active\"), true),\n            },\n            state: {\n              table: mappings.table(\"phoneState\"),\n              scope: \"scope\",\n              state: \"state\",\n              version: \"version\",\n              encodeInsert: (row: object) => row,\n            },\n            admission: {\n              windowMillis: 60_000,\n              networkRequests: 10,\n              networkAttempts: 100,\n              maximumMessages: 10,\n              requestRetentionMillis: 86_400_000,\n            },\n            engineNowMillis: backend.operations\n              .sql`${dialect === \"pg\" ? backend.operations.sql`cast(extract(epoch from clock_timestamp()) * 1000 as bigint)` : backend.operations.sql`cast(round((julianday('now') - 2440587.5) * 86400000) as integer)`}`,\n            encodeInstant: storage.encodeInstant,\n          });\n\n          const execution = yield* executionKernel\n            .makeTransactionExecution(\n              CurrentPhoneTransaction,\n              {\n                mode: \"interactive\",\n                dialect,\n                locking: dialect === \"pg\",\n                standaloneGuard: () => standalone(() => PhoneOtpUnavailable.make({})),\n              },\n              () => PhoneOtpUnavailable.make({}),\n              randomId,\n            )\n            .pipe(Effect.provideService(NativeDatabase, native));\n\n          const run = <Value, E, Requirements>(\n            work: Effect.Effect<Value, E, Requirements>,\n            mutation = true,\n          ) =>\n            execution.admit.pipe(\n              Effect.andThen(execution.run(work, mutation)),\n              Effect.provideService(LifecycleHooks, hooks),\n            );\n\n          const allowed = (moduleId: string) =>\n            features.some((feature) => feature?.kind === \"phone\" && feature.moduleId === moduleId);\n\n          const admission = PhoneAdmission.of({\n            admit: (request) =>\n              allowed(request.moduleId)\n                ? run(phoneKernel.admitPhone(mapping(request.moduleId), request))\n                : Effect.fail(PhoneOtpUnavailable.make({})),\n            cleanup: (request) =>\n              allowed(request.moduleId)\n                ? run(phoneKernel.cleanupPhoneAdmission(mapping(request.moduleId), request))\n                : Effect.fail(PhoneOtpUnavailable.make({})),\n          });\n\n          const targets = PhoneSignInTargets.of({\n            lookup: (request) =>\n              allowed(request.moduleId)\n                ? run(phoneKernel.lookupPhone(mapping(request.moduleId), request), false)\n                : Effect.fail(PhoneOtpUnavailable.make({})),\n          });\n\n          context = context.pipe(\n            Context.add(PhoneAdmission, admission),\n            Context.add(PhoneSignInTargets, targets),\n          );\n        }\n\n        if (passkeys.length > 0) {\n          // Auth capability metadata determines whether PasskeyConfig is required.\n          const services = backend.passkeys({\n            storage,\n            namespace: auth.namespace,\n            dialect,\n            features: passkeys,\n            passwordModules: features.flatMap((feature) =>\n              feature?.kind === \"password\" ? [feature.moduleId] : [],\n            ),\n          }) as Effect.Effect<\n            Context.Context<never>,\n            PersistenceConfigurationError,\n            | PasskeyRequirement<A>\n            | LifecycleHooks\n            | SqlClient.SqlClient\n            | NativeDatabase\n            | CurrentProofSql\n          >;\n\n          context = Context.merge(\n            context,\n            yield* services.pipe(\n              Effect.provideService(NativeDatabase, native),\n              Effect.provideService(CurrentProofSql, native),\n            ),\n          );\n        }\n\n        // The checked capability metadata above determines exactly these service keys.\n        return context as Context.Context<Ports<C, Id, A>>;\n      }),\n    ).pipe(Layer.provide(hooksLayer));\n\n    return {\n      Config,\n      Provisioning: ProvisioningKey,\n      layer: services,\n      managed: <N, Instant = number>(options: {\n        readonly subjects: SubjectOptions<T, N>;\n        readonly tables?: Partial<Record<Roles<C, Id, A>, T>>;\n        readonly prefix?: string;\n        readonly timestamps?: {\n          readonly type: \"text\" | \"integer\";\n          readonly codec: Schema.Codec<number, Instant>;\n        };\n      }) => layout(options, true),\n      map: <N, Instant = number>(options: {\n        readonly subjects: SubjectOptions<T, N>;\n        readonly tables: Partial<Record<StorageRole, T>>;\n        readonly timestamps?: {\n          readonly type: \"text\" | \"integer\";\n          readonly codec: Schema.Codec<number, Instant>;\n        };\n      }) => layout(options, false),\n    };\n  };\n\n  return { make };\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAgFA,MAAM,eAAe,WAAmB,8BAA8B,KAAK,EAAE,OAAO,CAAC;AAErF,MAAM,gBAAgB,UACpB,wBAAwB,KAAK;CAAE,WAAW;CAAW;AAAM,CAAC;AAE9D,MAAM,gCAAgB,IAAI,IAAI;CAC5B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,MAAa,qBACX,YACyB;CACzB,MAAM,cAAc,gBAAgB,QAAQ,UAAU;CACtD,MAAM,iBAAiB,mBAAmB,QAAQ,YAAY,WAAW;CACzE,MAAM,cAAc,gBAAgB,QAAQ,YAAY,WAAW;CACnE,MAAM,gBAAgB,kBAAkB,QAAQ,UAAU;CAC1D,MAAM,oBAAoB,sBAAsB,QAAQ,UAAU;CAClE,MAAM,kBAAkB,+BAA+B,iBAAiB;CACxE,MAAM,cAAc,gBAAgB,QAAQ,YAAY,iBAAiB;CAEzE,MAAM,QACJ,SACG;EACH,MAAM,WAAW,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,KAAK,aAAa,SAAS,WAAW;EACtF,MAAM,QAAQ,SAAS,MAAM,YAAY,SAAS,SAAS,OAAO;EAClE,MAAM,WAAW,SAAS,MAAM,YAAY,SAAS,SAAS,UAAU;EAExE,MAAM,WAAW,SAAS,QACvB,YAAuC,SAAS,SAAS,SAC5D;EAEA,MAAM,aAAa,SAAS,MACzB,YAAY,SAAS,SAAS,cAAc,QAAQ,UACvD;EAEA,MAAM,QAAQ,SAAS,MAAM,YAAY,SAAS,SAAS,WAAW,QAAQ,SAAS;EACvF,MAAM,SAAS,SAAS,cAAc;EAEtC,MAAM,QAAuB;GAAC;GAAe;GAAe;GAAY;EAAc;EAEtF,IAAI,UACF,MAAM,KACJ,aACA,oBACA,kBACA,mBACA,kBACF;EACF,IAAI,YAAY,MAAM,KAAK,uBAAuB;EAClD,IAAI,OAAO,MAAM,KAAK,oBAAoB,eAAe;EACzD,IAAI,OAAO,MAAM,KAAK,YAAY;EAClC,IAAI,SAAS,SAAS,GACpB,MAAM,KACJ,sBACA,oBACA,kBACA,kBACA,gBACA,qBACA,gBACF;EACF,IAAI,SAAS,MAAM,YAAY,QAAQ,UAAU,GAAG,MAAM,KAAK,iBAAiB;EAChF,IAAI,QACF,MAAM,KACJ,iBACA,eACA,oBACA,sBACA,eACA,cACA,iBACA,eACF;EAEF,MAAM,YAAY,QAAQ,QAGxB,CAAC,CAAC,6BAA6B,KAAK,UAAU,QAAQ;EAExD,MAAM,SAAS,OAAO,OAAO,WAAW,EACtC,QAAQ,UAA6C,MAAM,QAAQ,WAAW,KAAK,EACrF,CAAC;EAED,MAAM,kBAAkB,QAAQ,QAAqD,CAAC,CACpF,6BAA6B,KAAK,UAAU,cAC9C;EAEA,MAAM,UACJ,SASA,YACsC;GACtC,MAAM,UAAU,QAAQ;GAExB,IAAI,SAAS,SAAS,KAAK,QAAQ,eAAe,KAAA,GAChD,MAAM,YACJ,2HACF;GACF,MAAM,cAAc,QAAQ,SAAS,QAAQ,KAAK;GAClD,MAAM,WAAW,YAAY,QAAQ,QAAQ;GAE7C,KAAK,MAAM,OAAO;IAAC,QAAQ;IAAI,QAAQ;IAAQ,QAAQ;GAAgB,GACrE,IAAI,YAAY,QAAQ,SAAS,KAAA,GAC/B,MAAM,YAAY,0BAA0B,KAAK;GAErD,IAAI,QAAQ,gBAAgB,KAAA,GAC1B,MAAM,YAAY,8CAA8C;GAElE,IAAI,aAAa,KAAA,KAAa,SAAS,SAAS,WAC9C,MAAM,YAAY,8CAA8C;GAElE,MAAM,SACJ,QAAQ,UAAU,QAAQ,OAAO,KAAK,SAAS,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,WAAW,KAAK,GAAG;GAEnF,MAAM,SAA0C,EAAE,GAAG,QAAQ,OAAO;GAEpE,KAAK,MAAM,QAAQ,OACjB,IAAI,OAAO,UAAU,KAAA,KAAa,SAAS;IACzC,MAAM,aAAa,gBAAgB,MAAM,GAAG,OAAO,GAAG,QAAQ,SAAS,IAAI;IAE3E,MAAM,WACJ,QAAQ,eAAe,KAAA,IACnB,aACA;KACE,GAAG;KACH,SAAS,OAAO,YACd,OAAO,QAAQ,WAAW,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,YAAY,CACxD,KACA,cAAc,IAAI,GAAG,IACjB;MAAE,GAAG;MAAQ,MAAM,QAAQ,YAAY,QAAQ,OAAO;KAAK,IAC3D,MACN,CAAC,CACH;IACF;IAEN,OAAO,QAAQ,QAAQ,UAAU,QAAQ;GAC3C;GAEF,KAAK,MAAM,QAAQ,OACjB,IAAI,OAAO,UAAU,KAAA,GAAW,MAAM,YAAY,WAAW,KAAK,OAAO;GAE3E,MAAM,eAAe,QAAQ,YAAY;GAEzC,MAAM,gBACJ,iBAAiB,KAAA,IACb,OAAO,oBAAoB,OAAO,GAAG,IACrC,OAAO,oBAAoB,YAAY;GAE7C,MAAM,oBACJ,iBAAiB,KAAA,IACb,OAAO,kBAAkB,OAAO,GAAG,IACnC,OAAO,kBAAkB,YAAY;GAE3C,MAAM,WAA2B;IAC/B,OAAO,QAAQ;IACf,IAAI,QAAQ;IACZ,QAAQ,QAAQ;IAChB,kBAAkB,QAAQ;IAC1B,aAAa,QAAQ;IACrB,cAAc,QAAQ;IACtB,oBAAoB,QAAQ,sBAAsB,QAAQ;IAC1D,YAAY,OACV,OAAO,oBAAoB,QAAQ,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,OAAO,SAAS,YAAY,CAAC;IACpF,WAAW,OACT,OAAO,aAAa,QAAQ,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,OAAO,SAAS,YAAY,CAAC;IAC7E,eAAe,OAAO,kBAAkB,QAAQ,OAAO;IACvD,cAAc,OAAO,WAAW,QAAQ,OAAO;GACjD;GAEA,OAAO,OAAO,OAAO;IACnB,WAAW,KAAK;IAChB,QAAQ,OAAO,OAAO,MAAM;IAC5B,QAAQ;IACR;IACA,eACE,iBAAiB,KAAA,KAAa,WAAmB,SAAS,OAAO,WAAW,YAAY;IAC1F,gBAAgB,UAAmB,cAAc,KAAK,CAAC,CAAC,KAAK,OAAO,SAAS,YAAY,CAAC;IAC1F;GACF,CAAC;EACH;EAqSA,OAAO;GACL;GACA,cAAc;GACd,OAtSe,MAAM,cACrB,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO;IACvB,MAAM,QAAQ,OAAO;IACrB,MAAM,SAAS,OAAO,UAAU;IAChC,MAAM,WAAW,OAAO,QAAQ;IAEhC,MAAM,UAAU,OAAO,gBAAgB;KACrC,UAAU;KACV,cAAc;KACd,cAAc,KAAA;IAChB,CAAC;IAED,IAAI,YAAY,KAAA,GACd,OAAO,OAAO,YAAY,8CAA8C;IAC1E,IAAI,KAAK,gBAAgB,YACvB,OAAO,OAAO,YAAY,yDAAyD;IACrF,IACE,SAAS,MACN,YACC,YAAY,KAAA,KACX,eAAe,WAAW,QAAQ,aAClC,QAAQ,SAAS,WAAW,CAAC,QAAQ,SAC1C,GAEA,OAAO,OAAO,YACZ,2EACF;IACF,IAAI,QAAQ,cAAc,KAAK,WAC7B,OAAO,OAAO,YACZ,kEACF;IACF,KAAK,MAAM,QAAQ,OAAO;KACxB,MAAM,QAAS,QAAQ,OAA2C;KAElE,IAAI,UAAU,KAAA,GAAW,OAAO,OAAO,YAAY,WAAW,KAAK,OAAO;KAC1E,MAAM,cAAc,QAAQ,SAAS,KAAK;KAC1C,MAAM,UAAU,YAAY;KAE5B,KAAK,MAAM,QAAQ,OAAO,KAAK,cAAc,KAAK,CAAC,OAAO,GACxD,IAAI,QAAQ,UAAU,KAAA,GACpB,OAAO,OAAO,YAAY,WAAW,KAAK,GAAG,KAAK,QAAQ;KAE9D,OAAO,gBAAgB,SAAS,aAAa,cAAc,KAAK,CAAC,MAAM;IACzE;IACA,OAAO,gBAAgB,SAAS,QAAQ,SAAS,QAAQ,SAAS,KAAU,GAAG,CAC7E,CAAC,QAAQ,SAAS,EAAE,CACtB,CAAC;IACD,MAAM,WAAW,aAAa,OAAO;IAErC,MAAM,cAAiB,UACrB,kBAAkB,OAAO,OAAO,kBAAkB;IAGpD,MAAM,SAAS;IAMf,MAAM,UAAU;KACd,MAAM;KACN,SAAS,YAAY;KACrB,iBAAiB,iBAAiB,mBAAmB,KAAK,CAAC,CAAC,CAAC;IAC/D;IAEA,MAAM,iBAAiB,SAAS,SAAS,KAAK,MAAM;IAEpD,MAAM,kBAAkB,OAAO,cAC5B,wBAAwB,gBAAgB,OAAO,CAAC,CAChD,KAAK,OAAO,eAAe,mBAAmB,MAAM,CAAC;IAExD,MAAM,YAAY,OAAO,cACtB,+BACC;KAAE,GAAG,SAAS,UAAU;KAAG,4BAA4B;IAAM,GAC7D,OACF,CAAC,CACA,KAAK,OAAO,eAAe,mBAAmB,MAAM,CAAC;IAExD,IAAI,UAAkC,QAAQ,KAAK,yBAAyB,SAAS,CAAC,CAAC,KACrF,QAAQ,IACN,KAAK,SAAS,4BACd,gBAAgB,0BAClB,GACA,QAAQ,IAAI,KAAK,SAAS,mBAAmB,gBAAgB,iBAAiB,CAChF;IAEA,MAAM,qBAAqB,SACvB;KACE,SAAS,SAAS,OAAO;KACzB,eAAe;MACb,MAAM;MACN,SAAS,YAAY;MACrB,iBAAiB,iBAAiB,iBAAiB,KAAK,CAAC,CAAC,CAAC;MAC3D,iBAAiB,UAAyB,MAAM,oBAAoB;KACtE;IACF,IACA,KAAA;IAEJ,IAAI,uBAAuB,KAAA,GACzB,UAAU,QAAQ,IAChB,SACA,kBACA,OAAO,YACJ,wBAAwB,mBAAmB,SAAS,mBAAmB,aAAa,CAAC,CACrF,KAAK,OAAO,eAAe,iBAAiB,MAAM,CAAC,CACxD;IAGF,IAAI,UAAU;KACZ,MAAM,cAAc,OAAO,eACxB,2BAA2B,SAAS,UAAU,GAAG;MAChD,MAAM;MACN,SAAS,YAAY;MACrB,iBAAiB,iBAAiB,oBAAoB,KAAK,CAAC,CAAC,CAAC;MAC9D,iBAAiB,UAAU,MAAM,oBAAoB;MACrD,OAAO;KACT,CAAC,CAAC,CACD,KAAK,OAAO,eAAe,oBAAoB,MAAM,CAAC;KAEzD,UAAU,QAAQ,IAAI,SAAS,qBAAqB,WAAW;IACjE;IACA,KAAK,MAAM,CAAC,MAAM,aAAa,OAAO,QAAQ,KAAK,UAAU,GAAG;KAC9D,IAAI,SAAS,aAAa,SAAS,cAAc,CAAC,SAAS,YAAY,YACrE;KACF,MAAM,MAAM,SAAS;KAErB,IAAI,QAAQ,KAAA,GACV,OAAO,OAAO,YAAY,oCAAoC,MAAM;KAEtE,MAAM,eAAe,OAAO,0BAC1B,UACA,QAAQ,YACR,iBAAiB,oBAAoB,KAAK,CAAC,CAAC,CAAC,GAC7C,iBACA,IACF,CAAC,CAAC,KAAK,OAAO,eAAe,oBAAoB,MAAM,CAAC;KAExD,UAAU,QAAQ,IAAI,SAAS,KAAK,YAAY;IAClD;IACA,IAAI,OACF,UAAU,QAAQ,IAChB,SACA,yBACA,OAAO,YACJ,+BAA+B,SAAS,OAAO,GAAG;KACjD,MAAM;KACN,SAAS,YAAY;KACrB,iBAAiB,iBAAiB,iBAAiB,KAAK,CAAC,CAAC,CAAC;KAC3D,OAAO;IACT,CAAC,CAAC,CACD,KAAK,OAAO,eAAe,iBAAiB,MAAM,CAAC,CACxD;IAEF,IAAI,OAAO;KACT,MAAM,EAAE,QAAQ,OAAO,QAAQ;KAE/B,MAAM,WAAW,cAAsB;MACrC;MACA,SAAS;OACP,OAAO,QAAQ,SAAS;OACxB,IAAI,QAAQ,SAAS;OACrB,kBAAkB,QAAQ,SAAS;OACnC,iBAAiB,GACf,OAAO,QAAQ,SAAS,OAAO,QAAQ,SAAS,MAAM,GACtD,QAAQ,SAAS,WACnB;MACF;MACA,YAAY;OACV,UAAU,QAAQ,SAAS;OAC3B,WAAW,QAAQ,SAAS;MAC9B;MACA,YAAY;OACV,OAAO,SAAS,MAAM,aAAa;OACnC,WAAW;OACX,OAAO;OACP,WAAW;OACX,UAAU;OACV,YAAY;OACZ,iBAAiB,GAAG,OAAO,SAAS,MAAM,aAAa,GAAG,QAAQ,GAAG,IAAI;MAC3E;MACA,YAAY;OACV,OAAO,SAAS,MAAM,aAAa;OACnC,IAAI;OACJ,WAAW;OACX,UAAU;OACV,iBAAiB,GAAG,OAAO,SAAS,MAAM,aAAa,GAAG,QAAQ,GAAG,IAAI;MAC3E;MACA,OAAO;OACL,OAAO,SAAS,MAAM,YAAY;OAClC,OAAO;OACP,OAAO;OACP,SAAS;OACT,eAAe,QAAgB;MACjC;MACA,WAAW;OACT,cAAc;OACd,iBAAiB;OACjB,iBAAiB;OACjB,iBAAiB;OACjB,wBAAwB;MAC1B;MACA,iBAAiB,QAAQ,WACtB,GAAG,GAAG,YAAY,OAAO,QAAQ,WAAW,GAAG,iEAAiE,QAAQ,WAAW,GAAG;MACzI,eAAe,QAAQ;KACzB;KAEA,MAAM,YAAY,OAAO,gBACtB,yBACC,yBACA;MACE,MAAM;MACN;MACA,SAAS,YAAY;MACrB,uBAAuB,iBAAiB,oBAAoB,KAAK,CAAC,CAAC,CAAC;KACtE,SACM,oBAAoB,KAAK,CAAC,CAAC,GACjC,QACF,CAAC,CACA,KAAK,OAAO,eAAe,gBAAgB,MAAM,CAAC;KAErD,MAAM,OACJ,MACA,WAAW,SAEX,UAAU,MAAM,KACd,OAAO,QAAQ,UAAU,IAAI,MAAM,QAAQ,CAAC,GAC5C,OAAO,eAAe,gBAAgB,KAAK,CAC7C;KAEF,MAAM,WAAW,aACf,SAAS,MAAM,YAAY,SAAS,SAAS,WAAW,QAAQ,aAAa,QAAQ;KAEvF,MAAM,YAAY,eAAe,GAAG;MAClC,QAAQ,YACN,QAAQ,QAAQ,QAAQ,IACpB,IAAI,YAAY,WAAW,QAAQ,QAAQ,QAAQ,GAAG,OAAO,CAAC,IAC9D,OAAO,KAAK,oBAAoB,KAAK,CAAC,CAAC,CAAC;MAC9C,UAAU,YACR,QAAQ,QAAQ,QAAQ,IACpB,IAAI,YAAY,sBAAsB,QAAQ,QAAQ,QAAQ,GAAG,OAAO,CAAC,IACzE,OAAO,KAAK,oBAAoB,KAAK,CAAC,CAAC,CAAC;KAChD,CAAC;KAED,MAAM,UAAU,mBAAmB,GAAG,EACpC,SAAS,YACP,QAAQ,QAAQ,QAAQ,IACpB,IAAI,YAAY,YAAY,QAAQ,QAAQ,QAAQ,GAAG,OAAO,GAAG,KAAK,IACtE,OAAO,KAAK,oBAAoB,KAAK,CAAC,CAAC,CAAC,EAChD,CAAC;KAED,UAAU,QAAQ,KAChB,QAAQ,IAAI,gBAAgB,SAAS,GACrC,QAAQ,IAAI,oBAAoB,OAAO,CACzC;IACF;IAEA,IAAI,SAAS,SAAS,GAAG;KAEvB,MAAM,WAAW,QAAQ,SAAS;MAChC;MACA,WAAW,KAAK;MAChB;MACA,UAAU;MACV,iBAAiB,SAAS,SAAS,YACjC,SAAS,SAAS,aAAa,CAAC,QAAQ,QAAQ,IAAI,CAAC,CACvD;KACF,CAAC;KAUD,UAAU,QAAQ,MAChB,SACA,OAAO,SAAS,KACd,OAAO,eAAe,gBAAgB,MAAM,GAC5C,OAAO,eAAe,iBAAiB,MAAM,CAC/C,CACF;IACF;IAGA,OAAO;GACT,CAAC,CACH,CAAC,CAAC,KAAK,MAAM,QAAQ,UAAU,CAKf;GACd,UAA+B,YAQzB,OAAO,SAAS,IAAI;GAC1B,MAA2B,YAOrB,OAAO,SAAS,KAAK;EAC7B;CACF;CAEA,OAAO,EAAE,KAAK;AAChB"}

package/dist/internal/phone-kernel.mjs

@@ -405,14 +405,17 @@ const makePhoneKernel = (operations, transactions) => {
 		cleanupPhoneAdmission: Effect.fn("PhoneNative.cleanupAdmission")(function* (mapping, input) {
 			invariant(input.moduleId === mapping.moduleId && Number.isSafeInteger(input.limit) && input.limit >= 1 && input.limit <= 1e3);
 			const owner = yield* CurrentPhoneTransaction, now = yield* owner.now(mapping), state = mapping.state;
-			const observed = yield* owner.read(state.table, input.after === void 0 ? sql`1=1` : sql`${col(state.table, state.scope)} > ${input.after}`, {
+			const page = yield* owner.read(state.table, input.after === void 0 ? sql`1=1` : sql`${col(state.table, state.scope)} > ${input.after}`, {
 				limit: input.limit,
 				takeOnly: true,
+				observe: false,
 				orderBy: col(state.table, state.scope)
 			});
 			let deleted = 0;
-			const rows = [...observed.rows];
-			for (const row of rows) {
+			const rows = [...page.rows];
+			for (const candidate of rows) {
+				const row = (yield* owner.read(state.table, equal(state.table, { [state.scope]: candidate[state.scope] }), { limit: 1 })).rows[0];
+				if (row === void 0) continue;
 				const stored = Schema.decodeSync(storageCodec)(row[state.state]);
 				if (stored.moduleId !== mapping.moduleId) continue;
 				const record = stored.record;

package/dist/internal/phone-kernel.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"phone-kernel.mjs","names":[],"sources":["../../src/internal/phone-kernel.ts"],"sourcesContent":["import { digest, randomId } from \"@yielded/auth-crypto\";\nimport {\n  PhoneCustody,\n  PhoneCommandId,\n  PhoneLifecycleAction,\n  PhoneLifecycleTarget,\n  PhoneLifecyclePolicy,\n  type PhoneMutationDecision,\n  PhoneOtpUnavailable,\n  PhoneCredentialSnapshot,\n  type PhoneMutation,\n} from \"@yielded/auth/PhoneOtp\";\nimport type { SubjectId } from \"@yielded/auth/Schema\";\nimport { AuthenticationRequirement, SecurityRevision } from \"@yielded/auth/Sessions\";\nimport { Context, Effect, Option, Schema } from \"effect\";\n\n/* oxlint-disable no-explicit-any -- existing storage kernels erase foreign table shapes; domain errors remain typed. */\nimport type { SqlExpression as SQL } from \"./query-operations\";\nimport type { QueryOperations, SqlFragment, SqlColumn } from \"./query-operations\";\nimport { type TransactionOwner, type makeTransactionKernel } from \"./transaction-kernel\";\n\nexport class CurrentPhoneTransaction extends Context.Service<\n  CurrentPhoneTransaction,\n  TransactionOwner<PhoneOtpUnavailable>\n>()(\"effect-auth/drizzle/CurrentPhoneTransaction\") {}\n\nexport const makePhoneKernel = <\n  Fragment extends SqlFragment = SqlFragment,\n  Column extends SqlColumn = SqlColumn,\n>(\n  operations: QueryOperations<Fragment, Column>,\n  transactions: Pick<ReturnType<typeof makeTransactionKernel>, \"both\" | \"makeTransactionRows\">,\n) => {\n  const { sql } = operations;\n  const { both, makeTransactionRows } = transactions;\n  const unavailable = () => PhoneOtpUnavailable.make({});\n\n  const invariant: (value: unknown) => asserts value = (value) => {\n    if (!value) throw unavailable();\n  };\n\n  const { equal, copiedRow, col } = makeTransactionRows(unavailable);\n\n  const AdmissionReceipt = Schema.Struct({\n    fingerprint: Schema.NonEmptyString,\n    network: Schema.NonEmptyString,\n    accepted: Schema.Boolean,\n    expiresAtMillis: Schema.Natural,\n  });\n\n  const AdmissionCounter = Schema.Struct({ window: Schema.Natural, count: Schema.Natural });\n\n  const CommandRecord = Schema.Struct({ commandId: PhoneCommandId, action: PhoneLifecycleAction });\n\n  const State = Schema.Union([PhoneCustody, AdmissionReceipt, AdmissionCounter, CommandRecord]);\n\n  const storageCodec = Schema.fromJsonString(\n    Schema.Struct({ moduleId: Schema.NonEmptyString, record: State }),\n  );\n\n  const readStored = <A extends Schema.Top>(\n    mapping: any,\n    payload: string,\n    schema: A,\n  ): A[\"Type\"] => {\n    const stored = Schema.decodeSync(storageCodec)(payload);\n\n    invariant(stored.moduleId === mapping.moduleId && Schema.is(schema)(stored.record));\n\n    return stored.record;\n  };\n\n  const stringTuple = Schema.fromJsonString(Schema.Array(Schema.String));\n\n  const scope = (moduleId: string, kind: string, key: string) =>\n    digest(Schema.encodeSync(stringTuple)([\"effect-auth/phone/v1\", moduleId, kind, key]));\n\n  const rejected: PhoneMutationDecision = { _tag: \"Rejected\" };\n\n  const stateRead = Effect.fn(\"PhoneNative.stateRead\")(function* (mapping: any, key: string) {\n    const owner = yield* CurrentPhoneTransaction;\n\n    return yield* owner.read(\n      mapping.state.table,\n      equal(mapping.state.table, { [mapping.state.scope]: key }),\n      { limit: 1 },\n    );\n  });\n\n  const stateWrite = Effect.fn(\"PhoneNative.stateWrite\")(function* (\n    mapping: any,\n    key: string,\n    value: typeof State.Type,\n    observed: any,\n  ) {\n    const owner = yield* CurrentPhoneTransaction;\n\n    const values = {\n      [mapping.state.state]: Schema.encodeSync(storageCodec)({\n        moduleId: mapping.moduleId,\n        record: value,\n      }),\n      [mapping.state.version]: randomId(),\n    };\n\n    if (observed.rows.length === 0) {\n      const inserted = yield* owner.insert(\n        mapping.state.table,\n        {\n          ...copiedRow(\n            mapping.state.encodeInsert({\n              scope: key,\n              state: values[mapping.state.state],\n              version: values[mapping.state.version],\n            }),\n          ),\n          [mapping.state.scope]: key,\n          ...values,\n        },\n        { [mapping.state.scope]: key },\n      );\n\n      observed.rows = inserted.rows;\n    } else yield* owner.update(mapping.state.table, { [mapping.state.scope]: key }, values);\n  });\n\n  const custodyRead = Effect.fn(\"PhoneNative.custodyRead\")(function* (\n    mapping: any,\n    phoneNumber: string,\n  ) {\n    const key = scope(mapping.moduleId, \"custody\", phoneNumber),\n      observation = yield* stateRead(mapping, key);\n\n    const custody =\n      observation.rows.length === 0\n        ? null\n        : readStored(mapping, observation.rows[0]![mapping.state.state], PhoneCustody);\n\n    invariant(custody === null || custody.phoneNumber === phoneNumber);\n\n    return { key, observation, custody };\n  });\n\n  const capturePhone = Effect.fn(\"PhoneNative.capture\")(function* (\n    mapping: any,\n    input: {\n      readonly action: \"register\" | \"verify\" | \"change\";\n      readonly phoneNumber: any;\n      readonly subjectId?: SubjectId;\n      readonly sourcePhoneNumber?: any;\n    },\n  ) {\n    const owner = yield* CurrentPhoneTransaction;\n    const destination = yield* custodyRead(mapping, input.phoneNumber);\n\n    const source =\n      input.sourcePhoneNumber === undefined\n        ? null\n        : yield* custodyRead(mapping, input.sourcePhoneNumber);\n\n    const id = input.subjectId ?? destination.custody?.subjectId;\n\n    const subject =\n      id === undefined\n        ? null\n        : yield* owner.read(\n            mapping.subject.table,\n            equal(mapping.subject.table, { [mapping.subject.id]: mapping.subjectIds.toNative(id) }),\n            { limit: 1 },\n          );\n\n    const row = subject?.rows[0];\n\n    const active =\n      row !== undefined &&\n      (yield* owner.check(\n        sql`exists(select 1 from ${mapping.subject.table} where ${both(owner.exact(mapping.subject.table, row), mapping.subject.activeCondition)})`,\n      ));\n\n    const targetIdentifier = yield* owner.read(\n      mapping.identifier.table,\n      equal(mapping.identifier.table, {\n        [mapping.identifier.namespace]: \"phone\",\n        [mapping.identifier.value]: input.phoneNumber,\n      }),\n      { limit: 1 },\n    );\n\n    let eligible =\n      input.action === \"register\"\n        ? destination.custody === null && targetIdentifier.rows.length === 0\n        : active &&\n          input.subjectId === id &&\n          ((destination.custody === null && targetIdentifier.rows.length === 0) ||\n            (destination.custody?.subjectId === id && destination.custody?.state === \"unverified\"));\n\n    if (input.action === \"change\")\n      eligible =\n        eligible &&\n        input.sourcePhoneNumber !== input.phoneNumber &&\n        source?.custody?.subjectId === id &&\n        source?.custody?.state === \"verified\";\n    const credentials = [];\n\n    for (const custody of [destination.custody, source?.custody])\n      if (\n        custody !== null &&\n        custody !== undefined &&\n        custody.state === \"verified\" &&\n        custody.subjectId === id\n      ) {\n        const c = mapping.credential;\n\n        const found = yield* owner.read(\n          c.table,\n          equal(c.table, {\n            [c.id]: custody.credentialId,\n            [c.subjectId]: mapping.subjectIds.toNative(id),\n          }),\n          { limit: 1 },\n        );\n\n        const cr = found.rows[0];\n\n        if (\n          cr === undefined ||\n          cr[c.revision] !== custody.credentialRevision ||\n          !(yield* owner.check(\n            sql`exists(select 1 from ${c.table} where ${both(owner.exact(c.table, cr), c.activeCondition)})`,\n          ))\n        )\n          eligible = false;\n        else\n          credentials.push({\n            credentialId: custody.credentialId,\n            revision: custody.credentialRevision,\n          });\n      }\n\n    const target: PhoneLifecycleTarget = {\n      phoneNumber: input.phoneNumber,\n      custody: destination.custody,\n      source: source?.custody ?? null,\n      revision: active\n        ? {\n            subjectId: id!,\n            securityRevision: SecurityRevision.make(row![mapping.subject.securityRevision]),\n            credentials,\n          }\n        : null,\n      eligible,\n    };\n\n    return { target, destination, source, subject, subjectRow: row, targetIdentifier };\n  });\n\n  const lookupPhone = Effect.fn(\"PhoneNative.lookup\")(function* (\n    mapping: any,\n    input: { readonly moduleId: string; readonly phoneNumber: any },\n  ) {\n    invariant(input.moduleId === mapping.moduleId);\n\n    const captured = yield* capturePhone(mapping, {\n      action: \"verify\",\n      phoneNumber: input.phoneNumber,\n    });\n\n    const { custody, revision } = captured.target;\n\n    if (\n      custody === null ||\n      custody.state !== \"verified\" ||\n      custody.verifiedAtMillis === null ||\n      revision === null ||\n      !revision.credentials.some((c) => c.credentialId === custody.credentialId)\n    )\n      return Option.none();\n\n    const owner = yield* CurrentPhoneTransaction,\n      i = mapping.identifier,\n      row = captured.targetIdentifier.rows[0];\n\n    if (\n      row === undefined ||\n      row[i.revision] !== custody.custodyRevision ||\n      !(yield* owner.check(\n        sql`exists(select 1 from ${i.table} where ${both(owner.exact(i.table, row), equal(i.table, { [i.subjectId]: mapping.subjectIds.toNative(custody.subjectId) }), i.activeCondition)})`,\n      ))\n    )\n      return Option.none();\n\n    return Option.some(\n      Schema.decodeSync(PhoneCredentialSnapshot)({\n        moduleId: mapping.moduleId,\n        phoneNumber: input.phoneNumber,\n        custodyRevision: custody.custodyRevision,\n        verifiedAtMillis: custody.verifiedAtMillis,\n        credentialId: custody.credentialId,\n        credentialRevision: custody.credentialRevision,\n        revision,\n      }),\n    );\n  });\n\n  const admitPhone = Effect.fn(\"PhoneNative.admit\")(function* (\n    mapping: any,\n    input: {\n      readonly moduleId: string;\n      readonly action: \"request\" | \"attempt\";\n      readonly requestId: string;\n      readonly fingerprint: string;\n      readonly networkKey: string;\n      readonly replayLifetimeMillis: number;\n    },\n  ) {\n    invariant(\n      input.moduleId === mapping.moduleId &&\n        Number.isSafeInteger(input.replayLifetimeMillis) &&\n        input.replayLifetimeMillis >= 0 &&\n        input.networkKey.length > 0 &&\n        input.networkKey.length <= 1024 &&\n        input.requestId.length > 0 &&\n        input.requestId.length <= 256,\n    );\n\n    const owner = yield* CurrentPhoneTransaction,\n      now = yield* owner.now(mapping),\n      policy = mapping.admission;\n\n    const key = scope(mapping.moduleId, \"admission\", input.action + \"/\" + input.requestId),\n      receipt = yield* stateRead(mapping, key);\n\n    if (receipt.rows.length !== 0) {\n      const saved = readStored(mapping, receipt.rows[0]![mapping.state.state], AdmissionReceipt);\n\n      if (saved.expiresAtMillis > now)\n        owner.postconditions.push(sql`${mapping.engineNowMillis} < ${saved.expiresAtMillis}`);\n\n      return (\n        saved.fingerprint === input.fingerprint &&\n        saved.network === digest(input.networkKey) &&\n        saved.accepted === true &&\n        saved.expiresAtMillis > now\n      );\n    }\n\n    const window = Math.floor(now / policy.windowMillis),\n      entries = [\n        {\n          key: scope(mapping.moduleId, \"network\", input.action + \"/\" + digest(input.networkKey)),\n          limit: input.action === \"request\" ? policy.networkRequests : policy.networkAttempts,\n        },\n        ...(input.action === \"request\"\n          ? [{ key: scope(mapping.moduleId, \"messages\", \"global\"), limit: policy.maximumMessages }]\n          : []),\n      ].sort((a, b) => a.key.localeCompare(b.key));\n\n    const updates = [];\n    let accepted = true;\n\n    for (const entry of entries) {\n      const observed = yield* stateRead(mapping, entry.key),\n        previous =\n          observed.rows.length === 0\n            ? undefined\n            : readStored(mapping, observed.rows[0]![mapping.state.state], AdmissionCounter);\n\n      const count = previous?.window === window ? previous.count : 0;\n\n      if (count >= entry.limit) accepted = false;\n      updates.push({ ...entry, observed, count });\n    }\n    if (accepted)\n      for (const update of updates)\n        yield* stateWrite(\n          mapping,\n          update.key,\n          { window, count: update.count + 1 },\n          update.observed,\n        );\n    yield* stateWrite(\n      mapping,\n      key,\n      {\n        fingerprint: input.fingerprint,\n        network: digest(input.networkKey),\n        accepted,\n        expiresAtMillis: now + Math.min(policy.requestRetentionMillis, input.replayLifetimeMillis),\n      },\n      receipt,\n    );\n    owner.postconditions.push(\n      sql`${mapping.engineNowMillis} >= ${window * policy.windowMillis} and ${mapping.engineNowMillis} < ${(window + 1) * policy.windowMillis}`,\n    );\n\n    return accepted;\n  });\n\n  const preparePhoneMutation = Effect.fn(\"PhoneNative.prepareMutation\")(function* (\n    mapping: any,\n    input: PhoneMutation,\n  ) {\n    const owner = yield* CurrentPhoneTransaction;\n\n    invariant(\n      input.moduleId === mapping.moduleId &&\n        Schema.encodeSync(Schema.fromJsonString(PhoneLifecyclePolicy))(input.policy) ===\n          Schema.encodeSync(Schema.fromJsonString(PhoneLifecyclePolicy))(mapping.policy),\n    );\n\n    const captured = yield* capturePhone(mapping, {\n      action: input.action,\n      phoneNumber: input.target.phoneNumber,\n      ...(input.target.revision === null ? {} : { subjectId: input.target.revision.subjectId }),\n      ...(input.target.source === null\n        ? {}\n        : { sourcePhoneNumber: input.target.source.phoneNumber }),\n    });\n\n    if (\n      !captured.target.eligible ||\n      Schema.encodeSync(Schema.fromJsonString(PhoneLifecycleTarget))(captured.target) !==\n        Schema.encodeSync(Schema.fromJsonString(PhoneLifecycleTarget))(input.target)\n    )\n      return { decision: rejected };\n    const binding = input.completion.input.binding;\n\n    if (\n      input.completion.input.moduleId !== `${mapping.moduleId}/lifecycle` ||\n      input.completion.input.purpose !== \"phone-lifecycle\" ||\n      binding.identifier.namespace !== \"phone\" ||\n      binding.identifier.value !== input.target.phoneNumber\n    )\n      return { decision: rejected };\n    if (\n      input.action === \"register\"\n        ? binding._tag !== \"Identifier\"\n        : binding._tag === \"Identifier\" ||\n          binding.revision.subjectId !== input.target.revision?.subjectId ||\n          binding.revision.securityRevision !== input.target.revision?.securityRevision\n    )\n      return { decision: rejected };\n    if (\n      (input.action === \"verify\" && binding._tag !== \"Subject\") ||\n      (input.action === \"change\" && binding._tag !== \"IdentifierChange\")\n    )\n      return { decision: rejected };\n\n    const commandKey = scope(mapping.moduleId, \"command\", input.commandId),\n      command = yield* stateRead(mapping, commandKey);\n\n    if (command.rows.length !== 0) return { decision: rejected };\n\n    const now = yield* owner.now(mapping),\n      guards: SQL[] = [];\n\n    const credentialGuards: { id: string; condition: SQL }[] = [];\n\n    if (input.action !== \"register\") {\n      const authorization = input.authorization;\n\n      if (authorization === undefined) return { decision: rejected };\n      const { challenge, evidence } = authorization;\n      const revision = captured.target.revision!;\n\n      if (\n        challenge.moduleId !== mapping.moduleId ||\n        challenge.action !== input.action ||\n        challenge.commandId !== input.commandId ||\n        challenge.phoneNumber !== input.target.phoneNumber ||\n        challenge.sourcePhoneNumber !== input.target.source?.phoneNumber ||\n        challenge.flowId !== binding.flowId ||\n        challenge.bindingDigest !== binding.contextDigest ||\n        challenge.flowId !== evidence.flowId ||\n        challenge.bindingDigest !== evidence.bindingDigest ||\n        challenge.revision.subjectId !== revision.subjectId ||\n        challenge.revision.securityRevision !== revision.securityRevision ||\n        evidence.revision.subjectId !== revision.subjectId ||\n        evidence.revision.securityRevision !== revision.securityRevision\n      )\n        return { decision: rejected };\n      const c = mapping.credential;\n\n      for (const item of [...evidence.revision.credentials].sort((a, b) =>\n        a.credentialId.localeCompare(b.credentialId),\n      )) {\n        const found = yield* owner.read(\n            c.table,\n            equal(c.table, {\n              [c.id]: item.credentialId,\n              [c.subjectId]: mapping.subjectIds.toNative(revision.subjectId),\n            }),\n            { limit: 1 },\n          ),\n          row = found.rows[0];\n\n        if (row === undefined || row[c.revision] !== item.revision) return { decision: rejected };\n        const condition = sql`exists(select 1 from ${c.table} where ${both(owner.exact(c.table, row), c.activeCondition)})`;\n\n        if (!(yield* owner.check(condition))) return { decision: rejected };\n        credentialGuards.push({ id: item.credentialId, condition });\n      }\n      const proofs = evidence.proofs;\n\n      if (\n        proofs.length === 0 ||\n        proofs.some(\n          (p) => !evidence.revision.credentials.some((c) => c.credentialId === p.credentialId),\n        )\n      )\n        return { decision: rejected };\n\n      const requirements = [\n        authorization.requirement,\n        authorization.actionRequirement,\n        ...(mapping.subject.decodeActionRequirement === undefined\n          ? []\n          : [\n              Schema.decodeSync(AuthenticationRequirement)(\n                mapping.subject.decodeActionRequirement(\n                  copiedRow(captured.subjectRow!),\n                  input.action,\n                ),\n              ),\n            ]),\n        Schema.decodeSync(AuthenticationRequirement)(\n          mapping.subject.decodeRequirement(copiedRow(captured.subjectRow!)),\n        ),\n      ];\n\n      const age = Math.min(\n          input.policy.maximumEvidenceAgeMillis,\n          ...requirements.map((r) => r.maximumAgeMillis),\n        ),\n        factors = new Set(proofs.flatMap((p) => p.factors)),\n        credentials = new Set(proofs.map((p) => p.credentialId));\n\n      for (const requirement of requirements)\n        if (\n          !requirement.alternatives.some(\n            (a) =>\n              a.factors.every((f) => factors.has(f)) &&\n              credentials.size >= a.minimumCredentials &&\n              proofs.some(\n                (p) =>\n                  (!a.userVerified || p.userVerified) &&\n                  (!a.phishingResistant || p.phishingResistant),\n              ),\n          )\n        )\n          return { decision: rejected };\n      for (const proof of proofs) {\n        const at = proof.verifiedAt.epochMilliseconds;\n\n        if (at > now || now - at >= age) return { decision: rejected };\n        guards.push(\n          sql`${mapping.engineNowMillis} >= ${at} and ${mapping.engineNowMillis} < ${at + age}`,\n        );\n      }\n    }\n\n    const subjectId =\n        input.action === \"register\"\n          ? mapping.subjectIds.toSubject(mapping.subjectIds.allocate())\n          : captured.target.revision!.subjectId,\n      nativeId = mapping.subjectIds.toNative(subjectId),\n      securityRevision = SecurityRevision.make(randomId()),\n      credentialRevision = SecurityRevision.make(randomId()),\n      custodyRevision = SecurityRevision.make(randomId()),\n      credentialId = captured.target.custody?.credentialId ?? randomId();\n\n    invariant(mapping.subjectIds.toSubject(nativeId) === subjectId);\n\n    const custody: PhoneCustody = {\n      phoneNumber: input.target.phoneNumber,\n      subjectId,\n      credentialId,\n      credentialRevision,\n      custodyRevision,\n      verifiedAtMillis: now,\n      state: \"verified\",\n    };\n\n    const decision: PhoneMutationDecision = {\n      _tag: \"Accepted\",\n      credential: {\n        moduleId: mapping.moduleId,\n        phoneNumber: input.target.phoneNumber,\n        custodyRevision,\n        verifiedAtMillis: now,\n        credentialId,\n        credentialRevision,\n        revision: {\n          subjectId,\n          securityRevision,\n          credentials: [{ credentialId, revision: credentialRevision }],\n        },\n      },\n    };\n\n    const mutate = Effect.gen(function* () {\n      if (input.action === \"register\")\n        yield* owner.insert(\n          mapping.subject.table,\n          {\n            ...copiedRow(\n              mapping.subject.encodeInsert({\n                id: nativeId,\n                securityRevision,\n                phoneNumber: input.target.phoneNumber,\n              }),\n            ),\n            [mapping.subject.id]: nativeId,\n            [mapping.subject.securityRevision]: securityRevision,\n          },\n          { [mapping.subject.id]: nativeId },\n        );\n      else\n        yield* owner.update(\n          mapping.subject.table,\n          { [mapping.subject.id]: nativeId },\n          { [mapping.subject.securityRevision]: securityRevision },\n        );\n\n      const i = mapping.identifier,\n        c = mapping.credential;\n\n      if (captured.source?.custody) {\n        const old = captured.source.custody;\n\n        const ir = yield* owner.read(\n          i.table,\n          equal(i.table, {\n            [i.namespace]: \"phone\",\n            [i.value]: old.phoneNumber,\n            [i.subjectId]: nativeId,\n          }),\n          { limit: 1 },\n        );\n\n        invariant(ir.rows.length === 1 && ir.rows[0]![i.revision] === old.custodyRevision);\n        invariant(\n          yield* owner.check(\n            sql`exists(select 1 from ${i.table} where ${both(owner.exact(i.table, ir.rows[0]!), i.activeCondition)})`,\n          ),\n        );\n        yield* owner.update(\n          i.table,\n          { [i.namespace]: \"phone\", [i.value]: old.phoneNumber },\n          { [i.status]: i.encodeStatus(false), [i.revision]: randomId() },\n        );\n        yield* owner.update(\n          c.table,\n          { [c.id]: old.credentialId, [c.subjectId]: nativeId },\n          { [c.status]: c.encodeStatus(false), [c.revision]: randomId() },\n        );\n        yield* stateWrite(\n          mapping,\n          captured.source.key,\n          {\n            ...old,\n            state: \"retired\",\n            custodyRevision: SecurityRevision.make(randomId()),\n            credentialRevision: SecurityRevision.make(randomId()),\n          },\n          captured.source.observation,\n        );\n      }\n      if (captured.targetIdentifier.rows.length === 0) {\n        const inserted = yield* owner.insert(\n          i.table,\n          {\n            ...copiedRow(\n              i.encodeInsert({\n                phoneNumber: input.target.phoneNumber,\n                subjectId: nativeId,\n                revision: custodyRevision,\n                verifiedAtMillis: now,\n                active: true,\n              }),\n            ),\n            [i.namespace]: \"phone\",\n            [i.value]: input.target.phoneNumber,\n            [i.subjectId]: nativeId,\n            [i.revision]: custodyRevision,\n            [i.verifiedAt]: mapping.encodeInstant(now),\n            [i.status]: i.encodeStatus(true),\n          },\n          { [i.namespace]: \"phone\", [i.value]: input.target.phoneNumber },\n        );\n\n        captured.targetIdentifier.rows = inserted.rows;\n      } else {\n        const row = captured.targetIdentifier.rows[0]!;\n\n        invariant(\n          yield* owner.check(\n            sql`exists(select 1 from ${i.table} where ${both(owner.exact(i.table, row), equal(i.table, { [i.subjectId]: nativeId }))})`,\n          ),\n        );\n        yield* owner.update(\n          i.table,\n          { [i.namespace]: \"phone\", [i.value]: input.target.phoneNumber },\n          {\n            [i.revision]: custodyRevision,\n            [i.verifiedAt]: mapping.encodeInstant(now),\n            [i.status]: i.encodeStatus(true),\n          },\n        );\n      }\n\n      const credential = yield* owner.read(c.table, equal(c.table, { [c.id]: credentialId }), {\n        limit: 1,\n      });\n\n      if (credential.rows.length === 0) {\n        const inserted = yield* owner.insert(\n          c.table,\n          {\n            ...copiedRow(\n              c.encodeInsert({\n                credentialId,\n                subjectId: nativeId,\n                revision: credentialRevision,\n                active: true,\n              }),\n            ),\n            [c.id]: credentialId,\n            [c.subjectId]: nativeId,\n            [c.revision]: credentialRevision,\n            [c.status]: c.encodeStatus(true),\n          },\n          { [c.id]: credentialId },\n        );\n\n        credential.rows = inserted.rows;\n      } else {\n        invariant(\n          yield* owner.check(\n            sql`exists(select 1 from ${c.table} where ${both(owner.exact(c.table, credential.rows[0]!), equal(c.table, { [c.subjectId]: nativeId }))})`,\n          ),\n        );\n        yield* owner.update(\n          c.table,\n          { [c.id]: credentialId },\n          { [c.revision]: credentialRevision, [c.status]: c.encodeStatus(true) },\n        );\n      }\n      yield* stateWrite(\n        mapping,\n        captured.destination.key,\n        custody,\n        captured.destination.observation,\n      );\n      yield* stateWrite(\n        mapping,\n        commandKey,\n        { commandId: input.commandId, action: input.action },\n        command,\n      );\n      owner.postconditions.push(\n        ...guards,\n        sql`exists(select 1 from ${i.table} where ${both(equal(i.table, { [i.namespace]: \"phone\", [i.value]: input.target.phoneNumber, [i.subjectId]: nativeId, [i.revision]: custodyRevision, [i.verifiedAt]: mapping.encodeInstant(now) }), i.activeCondition)})`,\n        ...(captured.source?.custody === null || captured.source?.custody === undefined\n          ? []\n          : [\n              sql`not exists(select 1 from ${i.table} where ${both(equal(i.table, { [i.namespace]: \"phone\", [i.value]: captured.source.custody.phoneNumber }), i.activeCondition)})`,\n              sql`not exists(select 1 from ${c.table} where ${both(equal(c.table, { [c.id]: captured.source.custody.credentialId }), c.activeCondition)})`,\n            ]),\n        ...credentialGuards\n          .filter((g) => g.id !== captured.source?.custody?.credentialId && g.id !== credentialId)\n          .map((g) => g.condition),\n        sql`exists(select 1 from ${c.table} where ${both(equal(c.table, { [c.id]: credentialId, [c.subjectId]: nativeId, [c.revision]: credentialRevision }), c.activeCondition)})`,\n        sql`exists(select 1 from ${mapping.subject.table} where ${both(equal(mapping.subject.table, { [mapping.subject.id]: nativeId, [mapping.subject.securityRevision]: securityRevision }), mapping.subject.activeCondition)})`,\n      );\n\n      return true;\n    });\n\n    return {\n      decision,\n      mutate,\n      appliedCondition: sql`exists(select 1 from ${mapping.state.table} where ${equal(mapping.state.table, { [mapping.state.scope]: commandKey })})`,\n    };\n  });\n\n  /** Bounded cursor cleanup never removes custody or semantic-command tombstones. */\n  const cleanupPhoneAdmission = Effect.fn(\"PhoneNative.cleanupAdmission\")(function* (\n    mapping: any,\n    input: { readonly moduleId: string; readonly limit: number; readonly after?: string },\n  ) {\n    invariant(\n      input.moduleId === mapping.moduleId &&\n        Number.isSafeInteger(input.limit) &&\n        input.limit >= 1 &&\n        input.limit <= 1000,\n    );\n\n    const owner = yield* CurrentPhoneTransaction,\n      now = yield* owner.now(mapping),\n      state = mapping.state;\n\n    const observed = yield* owner.read(\n      state.table,\n      input.after === undefined ? sql`1=1` : sql`${col(state.table, state.scope)} > ${input.after}`,\n      { limit: input.limit, takeOnly: true, orderBy: col(state.table, state.scope) },\n    );\n\n    let deleted = 0;\n    const rows = [...observed.rows];\n\n    for (const row of rows) {\n      const stored = Schema.decodeSync(storageCodec)(row[state.state]);\n\n      if (stored.moduleId !== mapping.moduleId) continue;\n      const record = stored.record;\n\n      if (\n        (Schema.is(AdmissionReceipt)(record) && record.expiresAtMillis <= now) ||\n        (Schema.is(AdmissionCounter)(record) &&\n          (record.window + 1) * mapping.admission.windowMillis <= now)\n      ) {\n        yield* owner.remove(state.table, { [state.scope]: row[state.scope] });\n        deleted++;\n      }\n    }\n\n    return {\n      deleted,\n      nextCursor: rows.length === input.limit ? String(rows[rows.length - 1]![state.scope]) : null,\n    };\n  });\n\n  return {\n    unavailable,\n    invariant,\n    equal,\n    copiedRow,\n    col,\n    capturePhone,\n    lookupPhone,\n    admitPhone,\n    preparePhoneMutation,\n    cleanupPhoneAdmission,\n  };\n};\n"],"mappings":";;;;;AAqBA,IAAa,0BAAb,cAA6C,QAAQ,QAGnD,CAAC,CAAC,6CAA6C,CAAC,CAAC,CAAC;AAEpD,MAAa,mBAIX,YACA,iBACG;CACH,MAAM,EAAE,QAAQ;CAChB,MAAM,EAAE,MAAM,wBAAwB;CACtC,MAAM,oBAAoB,oBAAoB,KAAK,CAAC,CAAC;CAErD,MAAM,aAAgD,UAAU;EAC9D,IAAI,CAAC,OAAO,MAAM,YAAY;CAChC;CAEA,MAAM,EAAE,OAAO,WAAW,QAAQ,oBAAoB,WAAW;CAEjE,MAAM,mBAAmB,OAAO,OAAO;EACrC,aAAa,OAAO;EACpB,SAAS,OAAO;EAChB,UAAU,OAAO;EACjB,iBAAiB,OAAO;CAC1B,CAAC;CAED,MAAM,mBAAmB,OAAO,OAAO;EAAE,QAAQ,OAAO;EAAS,OAAO,OAAO;CAAQ,CAAC;CAExF,MAAM,gBAAgB,OAAO,OAAO;EAAE,WAAW;EAAgB,QAAQ;CAAqB,CAAC;CAE/F,MAAM,QAAQ,OAAO,MAAM;EAAC;EAAc;EAAkB;EAAkB;CAAa,CAAC;CAE5F,MAAM,eAAe,OAAO,eAC1B,OAAO,OAAO;EAAE,UAAU,OAAO;EAAgB,QAAQ;CAAM,CAAC,CAClE;CAEA,MAAM,cACJ,SACA,SACA,WACc;EACd,MAAM,SAAS,OAAO,WAAW,YAAY,CAAC,CAAC,OAAO;EAEtD,UAAU,OAAO,aAAa,QAAQ,YAAY,OAAO,GAAG,MAAM,CAAC,CAAC,OAAO,MAAM,CAAC;EAElF,OAAO,OAAO;CAChB;CAEA,MAAM,cAAc,OAAO,eAAe,OAAO,MAAM,OAAO,MAAM,CAAC;CAErE,MAAM,SAAS,UAAkB,MAAc,QAC7C,OAAO,OAAO,WAAW,WAAW,CAAC,CAAC;EAAC;EAAwB;EAAU;EAAM;CAAG,CAAC,CAAC;CAEtF,MAAM,WAAkC,EAAE,MAAM,WAAW;CAE3D,MAAM,YAAY,OAAO,GAAG,uBAAuB,CAAC,CAAC,WAAW,SAAc,KAAa;EAGzF,OAAO,QAAO,OAFO,wBAAA,CAED,KAClB,QAAQ,MAAM,OACd,MAAM,QAAQ,MAAM,OAAO,GAAG,QAAQ,MAAM,QAAQ,IAAI,CAAC,GACzD,EAAE,OAAO,EAAE,CACb;CACF,CAAC;CAED,MAAM,aAAa,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACrD,SACA,KACA,OACA,UACA;EACA,MAAM,QAAQ,OAAO;EAErB,MAAM,SAAS;IACZ,QAAQ,MAAM,QAAQ,OAAO,WAAW,YAAY,CAAC,CAAC;IACrD,UAAU,QAAQ;IAClB,QAAQ;GACV,CAAC;IACA,QAAQ,MAAM,UAAU,SAAS;EACpC;EAEA,IAAI,SAAS,KAAK,WAAW,GAiB3B,SAAS,QAAO,OAhBQ,MAAM,OAC5B,QAAQ,MAAM,OACd;GACE,GAAG,UACD,QAAQ,MAAM,aAAa;IACzB,OAAO;IACP,OAAO,OAAO,QAAQ,MAAM;IAC5B,SAAS,OAAO,QAAQ,MAAM;GAChC,CAAC,CACH;IACC,QAAQ,MAAM,QAAQ;GACvB,GAAG;EACL,GACA,GAAG,QAAQ,MAAM,QAAQ,IAAI,CAC/B,EAAA,CAEyB;OACpB,OAAO,MAAM,OAAO,QAAQ,MAAM,OAAO,GAAG,QAAQ,MAAM,QAAQ,IAAI,GAAG,MAAM;CACxF,CAAC;CAED,MAAM,cAAc,OAAO,GAAG,yBAAyB,CAAC,CAAC,WACvD,SACA,aACA;EACA,MAAM,MAAM,MAAM,QAAQ,UAAU,WAAW,WAAW,GACxD,cAAc,OAAO,UAAU,SAAS,GAAG;EAE7C,MAAM,UACJ,YAAY,KAAK,WAAW,IACxB,OACA,WAAW,SAAS,YAAY,KAAK,EAAE,CAAE,QAAQ,MAAM,QAAQ,YAAY;EAEjF,UAAU,YAAY,QAAQ,QAAQ,gBAAgB,WAAW;EAEjE,OAAO;GAAE;GAAK;GAAa;EAAQ;CACrC,CAAC;CAED,MAAM,eAAe,OAAO,GAAG,qBAAqB,CAAC,CAAC,WACpD,SACA,OAMA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,cAAc,OAAO,YAAY,SAAS,MAAM,WAAW;EAEjE,MAAM,SACJ,MAAM,sBAAsB,KAAA,IACxB,OACA,OAAO,YAAY,SAAS,MAAM,iBAAiB;EAEzD,MAAM,KAAK,MAAM,aAAa,YAAY,SAAS;EAEnD,MAAM,UACJ,OAAO,KAAA,IACH,OACA,OAAO,MAAM,KACX,QAAQ,QAAQ,OAChB,MAAM,QAAQ,QAAQ,OAAO,GAAG,QAAQ,QAAQ,KAAK,QAAQ,WAAW,SAAS,EAAE,EAAE,CAAC,GACtF,EAAE,OAAO,EAAE,CACb;EAEN,MAAM,MAAM,SAAS,KAAK;EAE1B,MAAM,SACJ,QAAQ,KAAA,MACP,OAAO,MAAM,MACZ,GAAG,wBAAwB,QAAQ,QAAQ,MAAM,SAAS,KAAK,MAAM,MAAM,QAAQ,QAAQ,OAAO,GAAG,GAAG,QAAQ,QAAQ,eAAe,EAAE,EAC3I;EAEF,MAAM,mBAAmB,OAAO,MAAM,KACpC,QAAQ,WAAW,OACnB,MAAM,QAAQ,WAAW,OAAO;IAC7B,QAAQ,WAAW,YAAY;IAC/B,QAAQ,WAAW,QAAQ,MAAM;EACpC,CAAC,GACD,EAAE,OAAO,EAAE,CACb;EAEA,IAAI,WACF,MAAM,WAAW,aACb,YAAY,YAAY,QAAQ,iBAAiB,KAAK,WAAW,IACjE,UACA,MAAM,cAAc,OAClB,YAAY,YAAY,QAAQ,iBAAiB,KAAK,WAAW,KAChE,YAAY,SAAS,cAAc,MAAM,YAAY,SAAS,UAAU;EAEjF,IAAI,MAAM,WAAW,UACnB,WACE,YACA,MAAM,sBAAsB,MAAM,eAClC,QAAQ,SAAS,cAAc,MAC/B,QAAQ,SAAS,UAAU;EAC/B,MAAM,cAAc,CAAC;EAErB,KAAK,MAAM,WAAW,CAAC,YAAY,SAAS,QAAQ,OAAO,GACzD,IACE,YAAY,QACZ,YAAY,KAAA,KACZ,QAAQ,UAAU,cAClB,QAAQ,cAAc,IACtB;GACA,MAAM,IAAI,QAAQ;GAWlB,MAAM,MAAK,OATU,MAAM,KACzB,EAAE,OACF,MAAM,EAAE,OAAO;KACZ,EAAE,KAAK,QAAQ;KACf,EAAE,YAAY,QAAQ,WAAW,SAAS,EAAE;GAC/C,CAAC,GACD,EAAE,OAAO,EAAE,CACb,EAAA,CAEiB,KAAK;GAEtB,IACE,OAAO,KAAA,KACP,GAAG,EAAE,cAAc,QAAQ,sBAC3B,EAAE,OAAO,MAAM,MACb,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAAK,MAAM,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,EAChG,IAEA,WAAW;QAEX,YAAY,KAAK;IACf,cAAc,QAAQ;IACtB,UAAU,QAAQ;GACpB,CAAC;EACL;EAgBF,OAAO;GAAE,QAAA;IAbP,aAAa,MAAM;IACnB,SAAS,YAAY;IACrB,QAAQ,QAAQ,WAAW;IAC3B,UAAU,SACN;KACE,WAAW;KACX,kBAAkB,iBAAiB,KAAK,IAAK,QAAQ,QAAQ,iBAAiB;KAC9E;IACF,IACA;IACJ;GAGY;GAAG;GAAa;GAAQ;GAAS,YAAY;GAAK;EAAiB;CACnF,CAAC;CAmkBD,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA,aAxkBkB,OAAO,GAAG,oBAAoB,CAAC,CAAC,WAClD,SACA,OACA;GACA,UAAU,MAAM,aAAa,QAAQ,QAAQ;GAE7C,MAAM,WAAW,OAAO,aAAa,SAAS;IAC5C,QAAQ;IACR,aAAa,MAAM;GACrB,CAAC;GAED,MAAM,EAAE,SAAS,aAAa,SAAS;GAEvC,IACE,YAAY,QACZ,QAAQ,UAAU,cAClB,QAAQ,qBAAqB,QAC7B,aAAa,QACb,CAAC,SAAS,YAAY,MAAM,MAAM,EAAE,iBAAiB,QAAQ,YAAY,GAEzE,OAAO,OAAO,KAAK;GAErB,MAAM,QAAQ,OAAO,yBACnB,IAAI,QAAQ,YACZ,MAAM,SAAS,iBAAiB,KAAK;GAEvC,IACE,QAAQ,KAAA,KACR,IAAI,EAAE,cAAc,QAAQ,mBAC5B,EAAE,OAAO,MAAM,MACb,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAAK,MAAM,MAAM,EAAE,OAAO,GAAG,GAAG,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,QAAQ,WAAW,SAAS,QAAQ,SAAS,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,EACpL,IAEA,OAAO,OAAO,KAAK;GAErB,OAAO,OAAO,KACZ,OAAO,WAAW,uBAAuB,CAAC,CAAC;IACzC,UAAU,QAAQ;IAClB,aAAa,MAAM;IACnB,iBAAiB,QAAQ;IACzB,kBAAkB,QAAQ;IAC1B,cAAc,QAAQ;IACtB,oBAAoB,QAAQ;IAC5B;GACF,CAAC,CACH;EACF,CA0hBY;EACV,YAzhBiB,OAAO,GAAG,mBAAmB,CAAC,CAAC,WAChD,SACA,OAQA;GACA,UACE,MAAM,aAAa,QAAQ,YACzB,OAAO,cAAc,MAAM,oBAAoB,KAC/C,MAAM,wBAAwB,KAC9B,MAAM,WAAW,SAAS,KAC1B,MAAM,WAAW,UAAU,QAC3B,MAAM,UAAU,SAAS,KACzB,MAAM,UAAU,UAAU,GAC9B;GAEA,MAAM,QAAQ,OAAO,yBACnB,MAAM,OAAO,MAAM,IAAI,OAAO,GAC9B,SAAS,QAAQ;GAEnB,MAAM,MAAM,MAAM,QAAQ,UAAU,aAAa,MAAM,SAAS,MAAM,MAAM,SAAS,GACnF,UAAU,OAAO,UAAU,SAAS,GAAG;GAEzC,IAAI,QAAQ,KAAK,WAAW,GAAG;IAC7B,MAAM,QAAQ,WAAW,SAAS,QAAQ,KAAK,EAAE,CAAE,QAAQ,MAAM,QAAQ,gBAAgB;IAEzF,IAAI,MAAM,kBAAkB,KAC1B,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,gBAAgB,KAAK,MAAM,iBAAiB;IAEtF,OACE,MAAM,gBAAgB,MAAM,eAC5B,MAAM,YAAY,OAAO,MAAM,UAAU,KACzC,MAAM,aAAa,QACnB,MAAM,kBAAkB;GAE5B;GAEA,MAAM,SAAS,KAAK,MAAM,MAAM,OAAO,YAAY,GACjD,UAAU,CACR;IACE,KAAK,MAAM,QAAQ,UAAU,WAAW,MAAM,SAAS,MAAM,OAAO,MAAM,UAAU,CAAC;IACrF,OAAO,MAAM,WAAW,YAAY,OAAO,kBAAkB,OAAO;GACtE,GACA,GAAI,MAAM,WAAW,YACjB,CAAC;IAAE,KAAK,MAAM,QAAQ,UAAU,YAAY,QAAQ;IAAG,OAAO,OAAO;GAAgB,CAAC,IACtF,CAAC,CACP,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,IAAI,cAAc,EAAE,GAAG,CAAC;GAE7C,MAAM,UAAU,CAAC;GACjB,IAAI,WAAW;GAEf,KAAK,MAAM,SAAS,SAAS;IAC3B,MAAM,WAAW,OAAO,UAAU,SAAS,MAAM,GAAG,GAClD,WACE,SAAS,KAAK,WAAW,IACrB,KAAA,IACA,WAAW,SAAS,SAAS,KAAK,EAAE,CAAE,QAAQ,MAAM,QAAQ,gBAAgB;IAEpF,MAAM,QAAQ,UAAU,WAAW,SAAS,SAAS,QAAQ;IAE7D,IAAI,SAAS,MAAM,OAAO,WAAW;IACrC,QAAQ,KAAK;KAAE,GAAG;KAAO;KAAU;IAAM,CAAC;GAC5C;GACA,IAAI,UACF,KAAK,MAAM,UAAU,SACnB,OAAO,WACL,SACA,OAAO,KACP;IAAE;IAAQ,OAAO,OAAO,QAAQ;GAAE,GAClC,OAAO,QACT;GACJ,OAAO,WACL,SACA,KACA;IACE,aAAa,MAAM;IACnB,SAAS,OAAO,MAAM,UAAU;IAChC;IACA,iBAAiB,MAAM,KAAK,IAAI,OAAO,wBAAwB,MAAM,oBAAoB;GAC3F,GACA,OACF;GACA,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,gBAAgB,MAAM,SAAS,OAAO,aAAa,OAAO,QAAQ,gBAAgB,MAAM,SAAS,KAAK,OAAO,cAC7H;GAEA,OAAO;EACT,CA6bW;EACT,sBA5b2B,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACpE,SACA,OACA;GACA,MAAM,QAAQ,OAAO;GAErB,UACE,MAAM,aAAa,QAAQ,YACzB,OAAO,WAAW,OAAO,eAAe,oBAAoB,CAAC,CAAC,CAAC,MAAM,MAAM,MACzE,OAAO,WAAW,OAAO,eAAe,oBAAoB,CAAC,CAAC,CAAC,QAAQ,MAAM,CACnF;GAEA,MAAM,WAAW,OAAO,aAAa,SAAS;IAC5C,QAAQ,MAAM;IACd,aAAa,MAAM,OAAO;IAC1B,GAAI,MAAM,OAAO,aAAa,OAAO,CAAC,IAAI,EAAE,WAAW,MAAM,OAAO,SAAS,UAAU;IACvF,GAAI,MAAM,OAAO,WAAW,OACxB,CAAC,IACD,EAAE,mBAAmB,MAAM,OAAO,OAAO,YAAY;GAC3D,CAAC;GAED,IACE,CAAC,SAAS,OAAO,YACjB,OAAO,WAAW,OAAO,eAAe,oBAAoB,CAAC,CAAC,CAAC,SAAS,MAAM,MAC5E,OAAO,WAAW,OAAO,eAAe,oBAAoB,CAAC,CAAC,CAAC,MAAM,MAAM,GAE7E,OAAO,EAAE,UAAU,SAAS;GAC9B,MAAM,UAAU,MAAM,WAAW,MAAM;GAEvC,IACE,MAAM,WAAW,MAAM,aAAa,GAAG,QAAQ,SAAS,eACxD,MAAM,WAAW,MAAM,YAAY,qBACnC,QAAQ,WAAW,cAAc,WACjC,QAAQ,WAAW,UAAU,MAAM,OAAO,aAE1C,OAAO,EAAE,UAAU,SAAS;GAC9B,IACE,MAAM,WAAW,aACb,QAAQ,SAAS,eACjB,QAAQ,SAAS,gBACjB,QAAQ,SAAS,cAAc,MAAM,OAAO,UAAU,aACtD,QAAQ,SAAS,qBAAqB,MAAM,OAAO,UAAU,kBAEjE,OAAO,EAAE,UAAU,SAAS;GAC9B,IACG,MAAM,WAAW,YAAY,QAAQ,SAAS,aAC9C,MAAM,WAAW,YAAY,QAAQ,SAAS,oBAE/C,OAAO,EAAE,UAAU,SAAS;GAE9B,MAAM,aAAa,MAAM,QAAQ,UAAU,WAAW,MAAM,SAAS,GACnE,UAAU,OAAO,UAAU,SAAS,UAAU;GAEhD,IAAI,QAAQ,KAAK,WAAW,GAAG,OAAO,EAAE,UAAU,SAAS;GAE3D,MAAM,MAAM,OAAO,MAAM,IAAI,OAAO,GAClC,SAAgB,CAAC;GAEnB,MAAM,mBAAqD,CAAC;GAE5D,IAAI,MAAM,WAAW,YAAY;IAC/B,MAAM,gBAAgB,MAAM;IAE5B,IAAI,kBAAkB,KAAA,GAAW,OAAO,EAAE,UAAU,SAAS;IAC7D,MAAM,EAAE,WAAW,aAAa;IAChC,MAAM,WAAW,SAAS,OAAO;IAEjC,IACE,UAAU,aAAa,QAAQ,YAC/B,UAAU,WAAW,MAAM,UAC3B,UAAU,cAAc,MAAM,aAC9B,UAAU,gBAAgB,MAAM,OAAO,eACvC,UAAU,sBAAsB,MAAM,OAAO,QAAQ,eACrD,UAAU,WAAW,QAAQ,UAC7B,UAAU,kBAAkB,QAAQ,iBACpC,UAAU,WAAW,SAAS,UAC9B,UAAU,kBAAkB,SAAS,iBACrC,UAAU,SAAS,cAAc,SAAS,aAC1C,UAAU,SAAS,qBAAqB,SAAS,oBACjD,SAAS,SAAS,cAAc,SAAS,aACzC,SAAS,SAAS,qBAAqB,SAAS,kBAEhD,OAAO,EAAE,UAAU,SAAS;IAC9B,MAAM,IAAI,QAAQ;IAElB,KAAK,MAAM,QAAQ,CAAC,GAAG,SAAS,SAAS,WAAW,CAAC,CAAC,MAAM,GAAG,MAC7D,EAAE,aAAa,cAAc,EAAE,YAAY,CAC7C,GAAG;KACD,MAQE,OAAM,OARa,MAAM,KACvB,EAAE,OACF,MAAM,EAAE,OAAO;OACZ,EAAE,KAAK,KAAK;OACZ,EAAE,YAAY,QAAQ,WAAW,SAAS,SAAS,SAAS;KAC/D,CAAC,GACD,EAAE,OAAO,EAAE,CACb,EAAA,CACY,KAAK;KAEnB,IAAI,QAAQ,KAAA,KAAa,IAAI,EAAE,cAAc,KAAK,UAAU,OAAO,EAAE,UAAU,SAAS;KACxF,MAAM,YAAY,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAAK,MAAM,MAAM,EAAE,OAAO,GAAG,GAAG,EAAE,eAAe,EAAE;KAEjH,IAAI,EAAE,OAAO,MAAM,MAAM,SAAS,IAAI,OAAO,EAAE,UAAU,SAAS;KAClE,iBAAiB,KAAK;MAAE,IAAI,KAAK;MAAc;KAAU,CAAC;IAC5D;IACA,MAAM,SAAS,SAAS;IAExB,IACE,OAAO,WAAW,KAClB,OAAO,MACJ,MAAM,CAAC,SAAS,SAAS,YAAY,MAAM,MAAM,EAAE,iBAAiB,EAAE,YAAY,CACrF,GAEA,OAAO,EAAE,UAAU,SAAS;IAE9B,MAAM,eAAe;KACnB,cAAc;KACd,cAAc;KACd,GAAI,QAAQ,QAAQ,4BAA4B,KAAA,IAC5C,CAAC,IACD,CACE,OAAO,WAAW,yBAAyB,CAAC,CAC1C,QAAQ,QAAQ,wBACd,UAAU,SAAS,UAAW,GAC9B,MAAM,MACR,CACF,CACF;KACJ,OAAO,WAAW,yBAAyB,CAAC,CAC1C,QAAQ,QAAQ,kBAAkB,UAAU,SAAS,UAAW,CAAC,CACnE;IACF;IAEA,MAAM,MAAM,KAAK,IACb,MAAM,OAAO,0BACb,GAAG,aAAa,KAAK,MAAM,EAAE,gBAAgB,CAC/C,GACA,UAAU,IAAI,IAAI,OAAO,SAAS,MAAM,EAAE,OAAO,CAAC,GAClD,cAAc,IAAI,IAAI,OAAO,KAAK,MAAM,EAAE,YAAY,CAAC;IAEzD,KAAK,MAAM,eAAe,cACxB,IACE,CAAC,YAAY,aAAa,MACvB,MACC,EAAE,QAAQ,OAAO,MAAM,QAAQ,IAAI,CAAC,CAAC,KACrC,YAAY,QAAQ,EAAE,sBACtB,OAAO,MACJ,OACE,CAAC,EAAE,gBAAgB,EAAE,kBACrB,CAAC,EAAE,qBAAqB,EAAE,kBAC/B,CACJ,GAEA,OAAO,EAAE,UAAU,SAAS;IAChC,KAAK,MAAM,SAAS,QAAQ;KAC1B,MAAM,KAAK,MAAM,WAAW;KAE5B,IAAI,KAAK,OAAO,MAAM,MAAM,KAAK,OAAO,EAAE,UAAU,SAAS;KAC7D,OAAO,KACL,GAAG,GAAG,QAAQ,gBAAgB,MAAM,GAAG,OAAO,QAAQ,gBAAgB,KAAK,KAAK,KAClF;IACF;GACF;GAEA,MAAM,YACF,MAAM,WAAW,aACb,QAAQ,WAAW,UAAU,QAAQ,WAAW,SAAS,CAAC,IAC1D,SAAS,OAAO,SAAU,WAChC,WAAW,QAAQ,WAAW,SAAS,SAAS,GAChD,mBAAmB,iBAAiB,KAAK,SAAS,CAAC,GACnD,qBAAqB,iBAAiB,KAAK,SAAS,CAAC,GACrD,kBAAkB,iBAAiB,KAAK,SAAS,CAAC,GAClD,eAAe,SAAS,OAAO,SAAS,gBAAgB,SAAS;GAEnE,UAAU,QAAQ,WAAW,UAAU,QAAQ,MAAM,SAAS;GAE9D,MAAM,UAAwB;IAC5B,aAAa,MAAM,OAAO;IAC1B;IACA;IACA;IACA;IACA,kBAAkB;IAClB,OAAO;GACT;GAsMA,OAAO;IACL,UAAA;KApMA,MAAM;KACN,YAAY;MACV,UAAU,QAAQ;MAClB,aAAa,MAAM,OAAO;MAC1B;MACA,kBAAkB;MAClB;MACA;MACA,UAAU;OACR;OACA;OACA,aAAa,CAAC;QAAE;QAAc,UAAU;OAAmB,CAAC;MAC9D;KACF;IAuLO;IACP,QArLa,OAAO,IAAI,aAAa;KACrC,IAAI,MAAM,WAAW,YACnB,OAAO,MAAM,OACX,QAAQ,QAAQ,OAChB;MACE,GAAG,UACD,QAAQ,QAAQ,aAAa;OAC3B,IAAI;OACJ;OACA,aAAa,MAAM,OAAO;MAC5B,CAAC,CACH;OACC,QAAQ,QAAQ,KAAK;OACrB,QAAQ,QAAQ,mBAAmB;KACtC,GACA,GAAG,QAAQ,QAAQ,KAAK,SAAS,CACnC;UAEA,OAAO,MAAM,OACX,QAAQ,QAAQ,OAChB,GAAG,QAAQ,QAAQ,KAAK,SAAS,GACjC,GAAG,QAAQ,QAAQ,mBAAmB,iBAAiB,CACzD;KAEF,MAAM,IAAI,QAAQ,YAChB,IAAI,QAAQ;KAEd,IAAI,SAAS,QAAQ,SAAS;MAC5B,MAAM,MAAM,SAAS,OAAO;MAE5B,MAAM,KAAK,OAAO,MAAM,KACtB,EAAE,OACF,MAAM,EAAE,OAAO;QACZ,EAAE,YAAY;QACd,EAAE,QAAQ,IAAI;QACd,EAAE,YAAY;MACjB,CAAC,GACD,EAAE,OAAO,EAAE,CACb;MAEA,UAAU,GAAG,KAAK,WAAW,KAAK,GAAG,KAAK,EAAE,CAAE,EAAE,cAAc,IAAI,eAAe;MACjF,UACE,OAAO,MAAM,MACX,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAAK,MAAM,MAAM,EAAE,OAAO,GAAG,KAAK,EAAG,GAAG,EAAE,eAAe,EAAE,EACzG,CACF;MACA,OAAO,MAAM,OACX,EAAE,OACF;QAAG,EAAE,YAAY;QAAU,EAAE,QAAQ,IAAI;MAAY,GACrD;QAAG,EAAE,SAAS,EAAE,aAAa,KAAK;QAAI,EAAE,WAAW,SAAS;MAAE,CAChE;MACA,OAAO,MAAM,OACX,EAAE,OACF;QAAG,EAAE,KAAK,IAAI;QAAe,EAAE,YAAY;MAAS,GACpD;QAAG,EAAE,SAAS,EAAE,aAAa,KAAK;QAAI,EAAE,WAAW,SAAS;MAAE,CAChE;MACA,OAAO,WACL,SACA,SAAS,OAAO,KAChB;OACE,GAAG;OACH,OAAO;OACP,iBAAiB,iBAAiB,KAAK,SAAS,CAAC;OACjD,oBAAoB,iBAAiB,KAAK,SAAS,CAAC;MACtD,GACA,SAAS,OAAO,WAClB;KACF;KACA,IAAI,SAAS,iBAAiB,KAAK,WAAW,GAAG;MAC/C,MAAM,WAAW,OAAO,MAAM,OAC5B,EAAE,OACF;OACE,GAAG,UACD,EAAE,aAAa;QACb,aAAa,MAAM,OAAO;QAC1B,WAAW;QACX,UAAU;QACV,kBAAkB;QAClB,QAAQ;OACV,CAAC,CACH;QACC,EAAE,YAAY;QACd,EAAE,QAAQ,MAAM,OAAO;QACvB,EAAE,YAAY;QACd,EAAE,WAAW;QACb,EAAE,aAAa,QAAQ,cAAc,GAAG;QACxC,EAAE,SAAS,EAAE,aAAa,IAAI;MACjC,GACA;QAAG,EAAE,YAAY;QAAU,EAAE,QAAQ,MAAM,OAAO;MAAY,CAChE;MAEA,SAAS,iBAAiB,OAAO,SAAS;KAC5C,OAAO;MACL,MAAM,MAAM,SAAS,iBAAiB,KAAK;MAE3C,UACE,OAAO,MAAM,MACX,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAAK,MAAM,MAAM,EAAE,OAAO,GAAG,GAAG,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,SAAS,CAAC,CAAC,EAAE,EAC3H,CACF;MACA,OAAO,MAAM,OACX,EAAE,OACF;QAAG,EAAE,YAAY;QAAU,EAAE,QAAQ,MAAM,OAAO;MAAY,GAC9D;QACG,EAAE,WAAW;QACb,EAAE,aAAa,QAAQ,cAAc,GAAG;QACxC,EAAE,SAAS,EAAE,aAAa,IAAI;MACjC,CACF;KACF;KAEA,MAAM,aAAa,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,KAAK,aAAa,CAAC,GAAG,EACtF,OAAO,EACT,CAAC;KAED,IAAI,WAAW,KAAK,WAAW,GAoB7B,WAAW,QAAO,OAnBM,MAAM,OAC5B,EAAE,OACF;MACE,GAAG,UACD,EAAE,aAAa;OACb;OACA,WAAW;OACX,UAAU;OACV,QAAQ;MACV,CAAC,CACH;OACC,EAAE,KAAK;OACP,EAAE,YAAY;OACd,EAAE,WAAW;OACb,EAAE,SAAS,EAAE,aAAa,IAAI;KACjC,GACA,GAAG,EAAE,KAAK,aAAa,CACzB,EAAA,CAE2B;UACtB;MACL,UACE,OAAO,MAAM,MACX,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAAK,MAAM,MAAM,EAAE,OAAO,WAAW,KAAK,EAAG,GAAG,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,SAAS,CAAC,CAAC,EAAE,EAC3I,CACF;MACA,OAAO,MAAM,OACX,EAAE,OACF,GAAG,EAAE,KAAK,aAAa,GACvB;QAAG,EAAE,WAAW;QAAqB,EAAE,SAAS,EAAE,aAAa,IAAI;MAAE,CACvE;KACF;KACA,OAAO,WACL,SACA,SAAS,YAAY,KACrB,SACA,SAAS,YAAY,WACvB;KACA,OAAO,WACL,SACA,YACA;MAAE,WAAW,MAAM;MAAW,QAAQ,MAAM;KAAO,GACnD,OACF;KACA,MAAM,eAAe,KACnB,GAAG,QACH,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAAK,MAAM,EAAE,OAAO;OAAG,EAAE,YAAY;OAAU,EAAE,QAAQ,MAAM,OAAO;OAAc,EAAE,YAAY;OAAW,EAAE,WAAW;OAAkB,EAAE,aAAa,QAAQ,cAAc,GAAG;KAAE,CAAC,GAAG,EAAE,eAAe,EAAE,IACzP,GAAI,SAAS,QAAQ,YAAY,QAAQ,SAAS,QAAQ,YAAY,KAAA,IAClE,CAAC,IACD,CACE,GAAG,4BAA4B,EAAE,MAAM,SAAS,KAAK,MAAM,EAAE,OAAO;OAAG,EAAE,YAAY;OAAU,EAAE,QAAQ,SAAS,OAAO,QAAQ;KAAY,CAAC,GAAG,EAAE,eAAe,EAAE,IACpK,GAAG,4BAA4B,EAAE,MAAM,SAAS,KAAK,MAAM,EAAE,OAAO,GAAG,EAAE,KAAK,SAAS,OAAO,QAAQ,aAAa,CAAC,GAAG,EAAE,eAAe,EAAE,EAC5I,GACJ,GAAG,iBACA,QAAQ,MAAM,EAAE,OAAO,SAAS,QAAQ,SAAS,gBAAgB,EAAE,OAAO,YAAY,CAAC,CACvF,KAAK,MAAM,EAAE,SAAS,GACzB,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAAK,MAAM,EAAE,OAAO;OAAG,EAAE,KAAK;OAAe,EAAE,YAAY;OAAW,EAAE,WAAW;KAAmB,CAAC,GAAG,EAAE,eAAe,EAAE,IACzK,GAAG,wBAAwB,QAAQ,QAAQ,MAAM,SAAS,KAAK,MAAM,QAAQ,QAAQ,OAAO;OAAG,QAAQ,QAAQ,KAAK;OAAW,QAAQ,QAAQ,mBAAmB;KAAiB,CAAC,GAAG,QAAQ,QAAQ,eAAe,EAAE,EAC1N;KAEA,OAAO;IACT,CAIO;IACL,kBAAkB,GAAG,wBAAwB,QAAQ,MAAM,MAAM,SAAS,MAAM,QAAQ,MAAM,OAAO,GAAG,QAAQ,MAAM,QAAQ,WAAW,CAAC,EAAE;GAC9I;EACF,CA0DqB;EACnB,uBAxD4B,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACtE,SACA,OACA;GACA,UACE,MAAM,aAAa,QAAQ,YACzB,OAAO,cAAc,MAAM,KAAK,KAChC,MAAM,SAAS,KACf,MAAM,SAAS,GACnB;GAEA,MAAM,QAAQ,OAAO,yBACnB,MAAM,OAAO,MAAM,IAAI,OAAO,GAC9B,QAAQ,QAAQ;GAElB,MAAM,WAAW,OAAO,MAAM,KAC5B,MAAM,OACN,MAAM,UAAU,KAAA,IAAY,GAAG,QAAQ,GAAG,GAAG,IAAI,MAAM,OAAO,MAAM,KAAK,EAAE,KAAK,MAAM,SACtF;IAAE,OAAO,MAAM;IAAO,UAAU;IAAM,SAAS,IAAI,MAAM,OAAO,MAAM,KAAK;GAAE,CAC/E;GAEA,IAAI,UAAU;GACd,MAAM,OAAO,CAAC,GAAG,SAAS,IAAI;GAE9B,KAAK,MAAM,OAAO,MAAM;IACtB,MAAM,SAAS,OAAO,WAAW,YAAY,CAAC,CAAC,IAAI,MAAM,MAAM;IAE/D,IAAI,OAAO,aAAa,QAAQ,UAAU;IAC1C,MAAM,SAAS,OAAO;IAEtB,IACG,OAAO,GAAG,gBAAgB,CAAC,CAAC,MAAM,KAAK,OAAO,mBAAmB,OACjE,OAAO,GAAG,gBAAgB,CAAC,CAAC,MAAM,MAChC,OAAO,SAAS,KAAK,QAAQ,UAAU,gBAAgB,KAC1D;KACA,OAAO,MAAM,OAAO,MAAM,OAAO,GAAG,MAAM,QAAQ,IAAI,MAAM,OAAO,CAAC;KACpE;IACF;GACF;GAEA,OAAO;IACL;IACA,YAAY,KAAK,WAAW,MAAM,QAAQ,OAAO,KAAK,KAAK,SAAS,EAAE,CAAE,MAAM,MAAM,IAAI;GAC1F;EACF,CAYsB;CACtB;AACF"}
+{"version":3,"file":"phone-kernel.mjs","names":[],"sources":["../../src/internal/phone-kernel.ts"],"sourcesContent":["import { digest, randomId } from \"@yielded/auth-crypto\";\nimport {\n  PhoneCustody,\n  PhoneCommandId,\n  PhoneLifecycleAction,\n  PhoneLifecycleTarget,\n  PhoneLifecyclePolicy,\n  type PhoneMutationDecision,\n  PhoneOtpUnavailable,\n  PhoneCredentialSnapshot,\n  type PhoneMutation,\n} from \"@yielded/auth/PhoneOtp\";\nimport type { SubjectId } from \"@yielded/auth/Schema\";\nimport { AuthenticationRequirement, SecurityRevision } from \"@yielded/auth/Sessions\";\nimport { Context, Effect, Option, Schema } from \"effect\";\n\n/* oxlint-disable no-explicit-any -- existing storage kernels erase foreign table shapes; domain errors remain typed. */\nimport type { SqlExpression as SQL } from \"./query-operations\";\nimport type { QueryOperations, SqlFragment, SqlColumn } from \"./query-operations\";\nimport { type TransactionOwner, type makeTransactionKernel } from \"./transaction-kernel\";\n\nexport class CurrentPhoneTransaction extends Context.Service<\n  CurrentPhoneTransaction,\n  TransactionOwner<PhoneOtpUnavailable>\n>()(\"effect-auth/drizzle/CurrentPhoneTransaction\") {}\n\nexport const makePhoneKernel = <\n  Fragment extends SqlFragment = SqlFragment,\n  Column extends SqlColumn = SqlColumn,\n>(\n  operations: QueryOperations<Fragment, Column>,\n  transactions: Pick<ReturnType<typeof makeTransactionKernel>, \"both\" | \"makeTransactionRows\">,\n) => {\n  const { sql } = operations;\n  const { both, makeTransactionRows } = transactions;\n  const unavailable = () => PhoneOtpUnavailable.make({});\n\n  const invariant: (value: unknown) => asserts value = (value) => {\n    if (!value) throw unavailable();\n  };\n\n  const { equal, copiedRow, col } = makeTransactionRows(unavailable);\n\n  const AdmissionReceipt = Schema.Struct({\n    fingerprint: Schema.NonEmptyString,\n    network: Schema.NonEmptyString,\n    accepted: Schema.Boolean,\n    expiresAtMillis: Schema.Natural,\n  });\n\n  const AdmissionCounter = Schema.Struct({ window: Schema.Natural, count: Schema.Natural });\n\n  const CommandRecord = Schema.Struct({ commandId: PhoneCommandId, action: PhoneLifecycleAction });\n\n  const State = Schema.Union([PhoneCustody, AdmissionReceipt, AdmissionCounter, CommandRecord]);\n\n  const storageCodec = Schema.fromJsonString(\n    Schema.Struct({ moduleId: Schema.NonEmptyString, record: State }),\n  );\n\n  const readStored = <A extends Schema.Top>(\n    mapping: any,\n    payload: string,\n    schema: A,\n  ): A[\"Type\"] => {\n    const stored = Schema.decodeSync(storageCodec)(payload);\n\n    invariant(stored.moduleId === mapping.moduleId && Schema.is(schema)(stored.record));\n\n    return stored.record;\n  };\n\n  const stringTuple = Schema.fromJsonString(Schema.Array(Schema.String));\n\n  const scope = (moduleId: string, kind: string, key: string) =>\n    digest(Schema.encodeSync(stringTuple)([\"effect-auth/phone/v1\", moduleId, kind, key]));\n\n  const rejected: PhoneMutationDecision = { _tag: \"Rejected\" };\n\n  const stateRead = Effect.fn(\"PhoneNative.stateRead\")(function* (mapping: any, key: string) {\n    const owner = yield* CurrentPhoneTransaction;\n\n    return yield* owner.read(\n      mapping.state.table,\n      equal(mapping.state.table, { [mapping.state.scope]: key }),\n      { limit: 1 },\n    );\n  });\n\n  const stateWrite = Effect.fn(\"PhoneNative.stateWrite\")(function* (\n    mapping: any,\n    key: string,\n    value: typeof State.Type,\n    observed: any,\n  ) {\n    const owner = yield* CurrentPhoneTransaction;\n\n    const values = {\n      [mapping.state.state]: Schema.encodeSync(storageCodec)({\n        moduleId: mapping.moduleId,\n        record: value,\n      }),\n      [mapping.state.version]: randomId(),\n    };\n\n    if (observed.rows.length === 0) {\n      const inserted = yield* owner.insert(\n        mapping.state.table,\n        {\n          ...copiedRow(\n            mapping.state.encodeInsert({\n              scope: key,\n              state: values[mapping.state.state],\n              version: values[mapping.state.version],\n            }),\n          ),\n          [mapping.state.scope]: key,\n          ...values,\n        },\n        { [mapping.state.scope]: key },\n      );\n\n      observed.rows = inserted.rows;\n    } else yield* owner.update(mapping.state.table, { [mapping.state.scope]: key }, values);\n  });\n\n  const custodyRead = Effect.fn(\"PhoneNative.custodyRead\")(function* (\n    mapping: any,\n    phoneNumber: string,\n  ) {\n    const key = scope(mapping.moduleId, \"custody\", phoneNumber),\n      observation = yield* stateRead(mapping, key);\n\n    const custody =\n      observation.rows.length === 0\n        ? null\n        : readStored(mapping, observation.rows[0]![mapping.state.state], PhoneCustody);\n\n    invariant(custody === null || custody.phoneNumber === phoneNumber);\n\n    return { key, observation, custody };\n  });\n\n  const capturePhone = Effect.fn(\"PhoneNative.capture\")(function* (\n    mapping: any,\n    input: {\n      readonly action: \"register\" | \"verify\" | \"change\";\n      readonly phoneNumber: any;\n      readonly subjectId?: SubjectId;\n      readonly sourcePhoneNumber?: any;\n    },\n  ) {\n    const owner = yield* CurrentPhoneTransaction;\n    const destination = yield* custodyRead(mapping, input.phoneNumber);\n\n    const source =\n      input.sourcePhoneNumber === undefined\n        ? null\n        : yield* custodyRead(mapping, input.sourcePhoneNumber);\n\n    const id = input.subjectId ?? destination.custody?.subjectId;\n\n    const subject =\n      id === undefined\n        ? null\n        : yield* owner.read(\n            mapping.subject.table,\n            equal(mapping.subject.table, { [mapping.subject.id]: mapping.subjectIds.toNative(id) }),\n            { limit: 1 },\n          );\n\n    const row = subject?.rows[0];\n\n    const active =\n      row !== undefined &&\n      (yield* owner.check(\n        sql`exists(select 1 from ${mapping.subject.table} where ${both(owner.exact(mapping.subject.table, row), mapping.subject.activeCondition)})`,\n      ));\n\n    const targetIdentifier = yield* owner.read(\n      mapping.identifier.table,\n      equal(mapping.identifier.table, {\n        [mapping.identifier.namespace]: \"phone\",\n        [mapping.identifier.value]: input.phoneNumber,\n      }),\n      { limit: 1 },\n    );\n\n    let eligible =\n      input.action === \"register\"\n        ? destination.custody === null && targetIdentifier.rows.length === 0\n        : active &&\n          input.subjectId === id &&\n          ((destination.custody === null && targetIdentifier.rows.length === 0) ||\n            (destination.custody?.subjectId === id && destination.custody?.state === \"unverified\"));\n\n    if (input.action === \"change\")\n      eligible =\n        eligible &&\n        input.sourcePhoneNumber !== input.phoneNumber &&\n        source?.custody?.subjectId === id &&\n        source?.custody?.state === \"verified\";\n    const credentials = [];\n\n    for (const custody of [destination.custody, source?.custody])\n      if (\n        custody !== null &&\n        custody !== undefined &&\n        custody.state === \"verified\" &&\n        custody.subjectId === id\n      ) {\n        const c = mapping.credential;\n\n        const found = yield* owner.read(\n          c.table,\n          equal(c.table, {\n            [c.id]: custody.credentialId,\n            [c.subjectId]: mapping.subjectIds.toNative(id),\n          }),\n          { limit: 1 },\n        );\n\n        const cr = found.rows[0];\n\n        if (\n          cr === undefined ||\n          cr[c.revision] !== custody.credentialRevision ||\n          !(yield* owner.check(\n            sql`exists(select 1 from ${c.table} where ${both(owner.exact(c.table, cr), c.activeCondition)})`,\n          ))\n        )\n          eligible = false;\n        else\n          credentials.push({\n            credentialId: custody.credentialId,\n            revision: custody.credentialRevision,\n          });\n      }\n\n    const target: PhoneLifecycleTarget = {\n      phoneNumber: input.phoneNumber,\n      custody: destination.custody,\n      source: source?.custody ?? null,\n      revision: active\n        ? {\n            subjectId: id!,\n            securityRevision: SecurityRevision.make(row![mapping.subject.securityRevision]),\n            credentials,\n          }\n        : null,\n      eligible,\n    };\n\n    return { target, destination, source, subject, subjectRow: row, targetIdentifier };\n  });\n\n  const lookupPhone = Effect.fn(\"PhoneNative.lookup\")(function* (\n    mapping: any,\n    input: { readonly moduleId: string; readonly phoneNumber: any },\n  ) {\n    invariant(input.moduleId === mapping.moduleId);\n\n    const captured = yield* capturePhone(mapping, {\n      action: \"verify\",\n      phoneNumber: input.phoneNumber,\n    });\n\n    const { custody, revision } = captured.target;\n\n    if (\n      custody === null ||\n      custody.state !== \"verified\" ||\n      custody.verifiedAtMillis === null ||\n      revision === null ||\n      !revision.credentials.some((c) => c.credentialId === custody.credentialId)\n    )\n      return Option.none();\n\n    const owner = yield* CurrentPhoneTransaction,\n      i = mapping.identifier,\n      row = captured.targetIdentifier.rows[0];\n\n    if (\n      row === undefined ||\n      row[i.revision] !== custody.custodyRevision ||\n      !(yield* owner.check(\n        sql`exists(select 1 from ${i.table} where ${both(owner.exact(i.table, row), equal(i.table, { [i.subjectId]: mapping.subjectIds.toNative(custody.subjectId) }), i.activeCondition)})`,\n      ))\n    )\n      return Option.none();\n\n    return Option.some(\n      Schema.decodeSync(PhoneCredentialSnapshot)({\n        moduleId: mapping.moduleId,\n        phoneNumber: input.phoneNumber,\n        custodyRevision: custody.custodyRevision,\n        verifiedAtMillis: custody.verifiedAtMillis,\n        credentialId: custody.credentialId,\n        credentialRevision: custody.credentialRevision,\n        revision,\n      }),\n    );\n  });\n\n  const admitPhone = Effect.fn(\"PhoneNative.admit\")(function* (\n    mapping: any,\n    input: {\n      readonly moduleId: string;\n      readonly action: \"request\" | \"attempt\";\n      readonly requestId: string;\n      readonly fingerprint: string;\n      readonly networkKey: string;\n      readonly replayLifetimeMillis: number;\n    },\n  ) {\n    invariant(\n      input.moduleId === mapping.moduleId &&\n        Number.isSafeInteger(input.replayLifetimeMillis) &&\n        input.replayLifetimeMillis >= 0 &&\n        input.networkKey.length > 0 &&\n        input.networkKey.length <= 1024 &&\n        input.requestId.length > 0 &&\n        input.requestId.length <= 256,\n    );\n\n    const owner = yield* CurrentPhoneTransaction,\n      now = yield* owner.now(mapping),\n      policy = mapping.admission;\n\n    const key = scope(mapping.moduleId, \"admission\", input.action + \"/\" + input.requestId),\n      receipt = yield* stateRead(mapping, key);\n\n    if (receipt.rows.length !== 0) {\n      const saved = readStored(mapping, receipt.rows[0]![mapping.state.state], AdmissionReceipt);\n\n      if (saved.expiresAtMillis > now)\n        owner.postconditions.push(sql`${mapping.engineNowMillis} < ${saved.expiresAtMillis}`);\n\n      return (\n        saved.fingerprint === input.fingerprint &&\n        saved.network === digest(input.networkKey) &&\n        saved.accepted === true &&\n        saved.expiresAtMillis > now\n      );\n    }\n\n    const window = Math.floor(now / policy.windowMillis),\n      entries = [\n        {\n          key: scope(mapping.moduleId, \"network\", input.action + \"/\" + digest(input.networkKey)),\n          limit: input.action === \"request\" ? policy.networkRequests : policy.networkAttempts,\n        },\n        ...(input.action === \"request\"\n          ? [{ key: scope(mapping.moduleId, \"messages\", \"global\"), limit: policy.maximumMessages }]\n          : []),\n      ].sort((a, b) => a.key.localeCompare(b.key));\n\n    const updates = [];\n    let accepted = true;\n\n    for (const entry of entries) {\n      const observed = yield* stateRead(mapping, entry.key),\n        previous =\n          observed.rows.length === 0\n            ? undefined\n            : readStored(mapping, observed.rows[0]![mapping.state.state], AdmissionCounter);\n\n      const count = previous?.window === window ? previous.count : 0;\n\n      if (count >= entry.limit) accepted = false;\n      updates.push({ ...entry, observed, count });\n    }\n    if (accepted)\n      for (const update of updates)\n        yield* stateWrite(\n          mapping,\n          update.key,\n          { window, count: update.count + 1 },\n          update.observed,\n        );\n    yield* stateWrite(\n      mapping,\n      key,\n      {\n        fingerprint: input.fingerprint,\n        network: digest(input.networkKey),\n        accepted,\n        expiresAtMillis: now + Math.min(policy.requestRetentionMillis, input.replayLifetimeMillis),\n      },\n      receipt,\n    );\n    owner.postconditions.push(\n      sql`${mapping.engineNowMillis} >= ${window * policy.windowMillis} and ${mapping.engineNowMillis} < ${(window + 1) * policy.windowMillis}`,\n    );\n\n    return accepted;\n  });\n\n  const preparePhoneMutation = Effect.fn(\"PhoneNative.prepareMutation\")(function* (\n    mapping: any,\n    input: PhoneMutation,\n  ) {\n    const owner = yield* CurrentPhoneTransaction;\n\n    invariant(\n      input.moduleId === mapping.moduleId &&\n        Schema.encodeSync(Schema.fromJsonString(PhoneLifecyclePolicy))(input.policy) ===\n          Schema.encodeSync(Schema.fromJsonString(PhoneLifecyclePolicy))(mapping.policy),\n    );\n\n    const captured = yield* capturePhone(mapping, {\n      action: input.action,\n      phoneNumber: input.target.phoneNumber,\n      ...(input.target.revision === null ? {} : { subjectId: input.target.revision.subjectId }),\n      ...(input.target.source === null\n        ? {}\n        : { sourcePhoneNumber: input.target.source.phoneNumber }),\n    });\n\n    if (\n      !captured.target.eligible ||\n      Schema.encodeSync(Schema.fromJsonString(PhoneLifecycleTarget))(captured.target) !==\n        Schema.encodeSync(Schema.fromJsonString(PhoneLifecycleTarget))(input.target)\n    )\n      return { decision: rejected };\n    const binding = input.completion.input.binding;\n\n    if (\n      input.completion.input.moduleId !== `${mapping.moduleId}/lifecycle` ||\n      input.completion.input.purpose !== \"phone-lifecycle\" ||\n      binding.identifier.namespace !== \"phone\" ||\n      binding.identifier.value !== input.target.phoneNumber\n    )\n      return { decision: rejected };\n    if (\n      input.action === \"register\"\n        ? binding._tag !== \"Identifier\"\n        : binding._tag === \"Identifier\" ||\n          binding.revision.subjectId !== input.target.revision?.subjectId ||\n          binding.revision.securityRevision !== input.target.revision?.securityRevision\n    )\n      return { decision: rejected };\n    if (\n      (input.action === \"verify\" && binding._tag !== \"Subject\") ||\n      (input.action === \"change\" && binding._tag !== \"IdentifierChange\")\n    )\n      return { decision: rejected };\n\n    const commandKey = scope(mapping.moduleId, \"command\", input.commandId),\n      command = yield* stateRead(mapping, commandKey);\n\n    if (command.rows.length !== 0) return { decision: rejected };\n\n    const now = yield* owner.now(mapping),\n      guards: SQL[] = [];\n\n    const credentialGuards: { id: string; condition: SQL }[] = [];\n\n    if (input.action !== \"register\") {\n      const authorization = input.authorization;\n\n      if (authorization === undefined) return { decision: rejected };\n      const { challenge, evidence } = authorization;\n      const revision = captured.target.revision!;\n\n      if (\n        challenge.moduleId !== mapping.moduleId ||\n        challenge.action !== input.action ||\n        challenge.commandId !== input.commandId ||\n        challenge.phoneNumber !== input.target.phoneNumber ||\n        challenge.sourcePhoneNumber !== input.target.source?.phoneNumber ||\n        challenge.flowId !== binding.flowId ||\n        challenge.bindingDigest !== binding.contextDigest ||\n        challenge.flowId !== evidence.flowId ||\n        challenge.bindingDigest !== evidence.bindingDigest ||\n        challenge.revision.subjectId !== revision.subjectId ||\n        challenge.revision.securityRevision !== revision.securityRevision ||\n        evidence.revision.subjectId !== revision.subjectId ||\n        evidence.revision.securityRevision !== revision.securityRevision\n      )\n        return { decision: rejected };\n      const c = mapping.credential;\n\n      for (const item of [...evidence.revision.credentials].sort((a, b) =>\n        a.credentialId.localeCompare(b.credentialId),\n      )) {\n        const found = yield* owner.read(\n            c.table,\n            equal(c.table, {\n              [c.id]: item.credentialId,\n              [c.subjectId]: mapping.subjectIds.toNative(revision.subjectId),\n            }),\n            { limit: 1 },\n          ),\n          row = found.rows[0];\n\n        if (row === undefined || row[c.revision] !== item.revision) return { decision: rejected };\n        const condition = sql`exists(select 1 from ${c.table} where ${both(owner.exact(c.table, row), c.activeCondition)})`;\n\n        if (!(yield* owner.check(condition))) return { decision: rejected };\n        credentialGuards.push({ id: item.credentialId, condition });\n      }\n      const proofs = evidence.proofs;\n\n      if (\n        proofs.length === 0 ||\n        proofs.some(\n          (p) => !evidence.revision.credentials.some((c) => c.credentialId === p.credentialId),\n        )\n      )\n        return { decision: rejected };\n\n      const requirements = [\n        authorization.requirement,\n        authorization.actionRequirement,\n        ...(mapping.subject.decodeActionRequirement === undefined\n          ? []\n          : [\n              Schema.decodeSync(AuthenticationRequirement)(\n                mapping.subject.decodeActionRequirement(\n                  copiedRow(captured.subjectRow!),\n                  input.action,\n                ),\n              ),\n            ]),\n        Schema.decodeSync(AuthenticationRequirement)(\n          mapping.subject.decodeRequirement(copiedRow(captured.subjectRow!)),\n        ),\n      ];\n\n      const age = Math.min(\n          input.policy.maximumEvidenceAgeMillis,\n          ...requirements.map((r) => r.maximumAgeMillis),\n        ),\n        factors = new Set(proofs.flatMap((p) => p.factors)),\n        credentials = new Set(proofs.map((p) => p.credentialId));\n\n      for (const requirement of requirements)\n        if (\n          !requirement.alternatives.some(\n            (a) =>\n              a.factors.every((f) => factors.has(f)) &&\n              credentials.size >= a.minimumCredentials &&\n              proofs.some(\n                (p) =>\n                  (!a.userVerified || p.userVerified) &&\n                  (!a.phishingResistant || p.phishingResistant),\n              ),\n          )\n        )\n          return { decision: rejected };\n      for (const proof of proofs) {\n        const at = proof.verifiedAt.epochMilliseconds;\n\n        if (at > now || now - at >= age) return { decision: rejected };\n        guards.push(\n          sql`${mapping.engineNowMillis} >= ${at} and ${mapping.engineNowMillis} < ${at + age}`,\n        );\n      }\n    }\n\n    const subjectId =\n        input.action === \"register\"\n          ? mapping.subjectIds.toSubject(mapping.subjectIds.allocate())\n          : captured.target.revision!.subjectId,\n      nativeId = mapping.subjectIds.toNative(subjectId),\n      securityRevision = SecurityRevision.make(randomId()),\n      credentialRevision = SecurityRevision.make(randomId()),\n      custodyRevision = SecurityRevision.make(randomId()),\n      credentialId = captured.target.custody?.credentialId ?? randomId();\n\n    invariant(mapping.subjectIds.toSubject(nativeId) === subjectId);\n\n    const custody: PhoneCustody = {\n      phoneNumber: input.target.phoneNumber,\n      subjectId,\n      credentialId,\n      credentialRevision,\n      custodyRevision,\n      verifiedAtMillis: now,\n      state: \"verified\",\n    };\n\n    const decision: PhoneMutationDecision = {\n      _tag: \"Accepted\",\n      credential: {\n        moduleId: mapping.moduleId,\n        phoneNumber: input.target.phoneNumber,\n        custodyRevision,\n        verifiedAtMillis: now,\n        credentialId,\n        credentialRevision,\n        revision: {\n          subjectId,\n          securityRevision,\n          credentials: [{ credentialId, revision: credentialRevision }],\n        },\n      },\n    };\n\n    const mutate = Effect.gen(function* () {\n      if (input.action === \"register\")\n        yield* owner.insert(\n          mapping.subject.table,\n          {\n            ...copiedRow(\n              mapping.subject.encodeInsert({\n                id: nativeId,\n                securityRevision,\n                phoneNumber: input.target.phoneNumber,\n              }),\n            ),\n            [mapping.subject.id]: nativeId,\n            [mapping.subject.securityRevision]: securityRevision,\n          },\n          { [mapping.subject.id]: nativeId },\n        );\n      else\n        yield* owner.update(\n          mapping.subject.table,\n          { [mapping.subject.id]: nativeId },\n          { [mapping.subject.securityRevision]: securityRevision },\n        );\n\n      const i = mapping.identifier,\n        c = mapping.credential;\n\n      if (captured.source?.custody) {\n        const old = captured.source.custody;\n\n        const ir = yield* owner.read(\n          i.table,\n          equal(i.table, {\n            [i.namespace]: \"phone\",\n            [i.value]: old.phoneNumber,\n            [i.subjectId]: nativeId,\n          }),\n          { limit: 1 },\n        );\n\n        invariant(ir.rows.length === 1 && ir.rows[0]![i.revision] === old.custodyRevision);\n        invariant(\n          yield* owner.check(\n            sql`exists(select 1 from ${i.table} where ${both(owner.exact(i.table, ir.rows[0]!), i.activeCondition)})`,\n          ),\n        );\n        yield* owner.update(\n          i.table,\n          { [i.namespace]: \"phone\", [i.value]: old.phoneNumber },\n          { [i.status]: i.encodeStatus(false), [i.revision]: randomId() },\n        );\n        yield* owner.update(\n          c.table,\n          { [c.id]: old.credentialId, [c.subjectId]: nativeId },\n          { [c.status]: c.encodeStatus(false), [c.revision]: randomId() },\n        );\n        yield* stateWrite(\n          mapping,\n          captured.source.key,\n          {\n            ...old,\n            state: \"retired\",\n            custodyRevision: SecurityRevision.make(randomId()),\n            credentialRevision: SecurityRevision.make(randomId()),\n          },\n          captured.source.observation,\n        );\n      }\n      if (captured.targetIdentifier.rows.length === 0) {\n        const inserted = yield* owner.insert(\n          i.table,\n          {\n            ...copiedRow(\n              i.encodeInsert({\n                phoneNumber: input.target.phoneNumber,\n                subjectId: nativeId,\n                revision: custodyRevision,\n                verifiedAtMillis: now,\n                active: true,\n              }),\n            ),\n            [i.namespace]: \"phone\",\n            [i.value]: input.target.phoneNumber,\n            [i.subjectId]: nativeId,\n            [i.revision]: custodyRevision,\n            [i.verifiedAt]: mapping.encodeInstant(now),\n            [i.status]: i.encodeStatus(true),\n          },\n          { [i.namespace]: \"phone\", [i.value]: input.target.phoneNumber },\n        );\n\n        captured.targetIdentifier.rows = inserted.rows;\n      } else {\n        const row = captured.targetIdentifier.rows[0]!;\n\n        invariant(\n          yield* owner.check(\n            sql`exists(select 1 from ${i.table} where ${both(owner.exact(i.table, row), equal(i.table, { [i.subjectId]: nativeId }))})`,\n          ),\n        );\n        yield* owner.update(\n          i.table,\n          { [i.namespace]: \"phone\", [i.value]: input.target.phoneNumber },\n          {\n            [i.revision]: custodyRevision,\n            [i.verifiedAt]: mapping.encodeInstant(now),\n            [i.status]: i.encodeStatus(true),\n          },\n        );\n      }\n\n      const credential = yield* owner.read(c.table, equal(c.table, { [c.id]: credentialId }), {\n        limit: 1,\n      });\n\n      if (credential.rows.length === 0) {\n        const inserted = yield* owner.insert(\n          c.table,\n          {\n            ...copiedRow(\n              c.encodeInsert({\n                credentialId,\n                subjectId: nativeId,\n                revision: credentialRevision,\n                active: true,\n              }),\n            ),\n            [c.id]: credentialId,\n            [c.subjectId]: nativeId,\n            [c.revision]: credentialRevision,\n            [c.status]: c.encodeStatus(true),\n          },\n          { [c.id]: credentialId },\n        );\n\n        credential.rows = inserted.rows;\n      } else {\n        invariant(\n          yield* owner.check(\n            sql`exists(select 1 from ${c.table} where ${both(owner.exact(c.table, credential.rows[0]!), equal(c.table, { [c.subjectId]: nativeId }))})`,\n          ),\n        );\n        yield* owner.update(\n          c.table,\n          { [c.id]: credentialId },\n          { [c.revision]: credentialRevision, [c.status]: c.encodeStatus(true) },\n        );\n      }\n      yield* stateWrite(\n        mapping,\n        captured.destination.key,\n        custody,\n        captured.destination.observation,\n      );\n      yield* stateWrite(\n        mapping,\n        commandKey,\n        { commandId: input.commandId, action: input.action },\n        command,\n      );\n      owner.postconditions.push(\n        ...guards,\n        sql`exists(select 1 from ${i.table} where ${both(equal(i.table, { [i.namespace]: \"phone\", [i.value]: input.target.phoneNumber, [i.subjectId]: nativeId, [i.revision]: custodyRevision, [i.verifiedAt]: mapping.encodeInstant(now) }), i.activeCondition)})`,\n        ...(captured.source?.custody === null || captured.source?.custody === undefined\n          ? []\n          : [\n              sql`not exists(select 1 from ${i.table} where ${both(equal(i.table, { [i.namespace]: \"phone\", [i.value]: captured.source.custody.phoneNumber }), i.activeCondition)})`,\n              sql`not exists(select 1 from ${c.table} where ${both(equal(c.table, { [c.id]: captured.source.custody.credentialId }), c.activeCondition)})`,\n            ]),\n        ...credentialGuards\n          .filter((g) => g.id !== captured.source?.custody?.credentialId && g.id !== credentialId)\n          .map((g) => g.condition),\n        sql`exists(select 1 from ${c.table} where ${both(equal(c.table, { [c.id]: credentialId, [c.subjectId]: nativeId, [c.revision]: credentialRevision }), c.activeCondition)})`,\n        sql`exists(select 1 from ${mapping.subject.table} where ${both(equal(mapping.subject.table, { [mapping.subject.id]: nativeId, [mapping.subject.securityRevision]: securityRevision }), mapping.subject.activeCondition)})`,\n      );\n\n      return true;\n    });\n\n    return {\n      decision,\n      mutate,\n      appliedCondition: sql`exists(select 1 from ${mapping.state.table} where ${equal(mapping.state.table, { [mapping.state.scope]: commandKey })})`,\n    };\n  });\n\n  /** Bounded cursor cleanup never removes custody or semantic-command tombstones. */\n  const cleanupPhoneAdmission = Effect.fn(\"PhoneNative.cleanupAdmission\")(function* (\n    mapping: any,\n    input: { readonly moduleId: string; readonly limit: number; readonly after?: string },\n  ) {\n    invariant(\n      input.moduleId === mapping.moduleId &&\n        Number.isSafeInteger(input.limit) &&\n        input.limit >= 1 &&\n        input.limit <= 1000,\n    );\n\n    const owner = yield* CurrentPhoneTransaction,\n      now = yield* owner.now(mapping),\n      state = mapping.state;\n\n    // The page predicate matches every later row. Observing it would require the\n    // page to be the whole table, so cleanup could not advance. Discover without\n    // an observation, then guard each candidate by its scope.\n    const page = yield* owner.read(\n      state.table,\n      input.after === undefined ? sql`1=1` : sql`${col(state.table, state.scope)} > ${input.after}`,\n      {\n        limit: input.limit,\n        takeOnly: true,\n        observe: false,\n        orderBy: col(state.table, state.scope),\n      },\n    );\n\n    let deleted = 0;\n    const rows = [...page.rows];\n\n    for (const candidate of rows) {\n      const current = yield* owner.read(\n        state.table,\n        equal(state.table, { [state.scope]: candidate[state.scope] }),\n        { limit: 1 },\n      );\n\n      const row = current.rows[0];\n\n      if (row === undefined) continue;\n      const stored = Schema.decodeSync(storageCodec)(row[state.state]);\n\n      if (stored.moduleId !== mapping.moduleId) continue;\n      const record = stored.record;\n\n      if (\n        (Schema.is(AdmissionReceipt)(record) && record.expiresAtMillis <= now) ||\n        (Schema.is(AdmissionCounter)(record) &&\n          (record.window + 1) * mapping.admission.windowMillis <= now)\n      ) {\n        yield* owner.remove(state.table, { [state.scope]: row[state.scope] });\n        deleted++;\n      }\n    }\n\n    return {\n      deleted,\n      nextCursor: rows.length === input.limit ? String(rows[rows.length - 1]![state.scope]) : null,\n    };\n  });\n\n  return {\n    unavailable,\n    invariant,\n    equal,\n    copiedRow,\n    col,\n    capturePhone,\n    lookupPhone,\n    admitPhone,\n    preparePhoneMutation,\n    cleanupPhoneAdmission,\n  };\n};\n"],"mappings":";;;;;AAqBA,IAAa,0BAAb,cAA6C,QAAQ,QAGnD,CAAC,CAAC,6CAA6C,CAAC,CAAC,CAAC;AAEpD,MAAa,mBAIX,YACA,iBACG;CACH,MAAM,EAAE,QAAQ;CAChB,MAAM,EAAE,MAAM,wBAAwB;CACtC,MAAM,oBAAoB,oBAAoB,KAAK,CAAC,CAAC;CAErD,MAAM,aAAgD,UAAU;EAC9D,IAAI,CAAC,OAAO,MAAM,YAAY;CAChC;CAEA,MAAM,EAAE,OAAO,WAAW,QAAQ,oBAAoB,WAAW;CAEjE,MAAM,mBAAmB,OAAO,OAAO;EACrC,aAAa,OAAO;EACpB,SAAS,OAAO;EAChB,UAAU,OAAO;EACjB,iBAAiB,OAAO;CAC1B,CAAC;CAED,MAAM,mBAAmB,OAAO,OAAO;EAAE,QAAQ,OAAO;EAAS,OAAO,OAAO;CAAQ,CAAC;CAExF,MAAM,gBAAgB,OAAO,OAAO;EAAE,WAAW;EAAgB,QAAQ;CAAqB,CAAC;CAE/F,MAAM,QAAQ,OAAO,MAAM;EAAC;EAAc;EAAkB;EAAkB;CAAa,CAAC;CAE5F,MAAM,eAAe,OAAO,eAC1B,OAAO,OAAO;EAAE,UAAU,OAAO;EAAgB,QAAQ;CAAM,CAAC,CAClE;CAEA,MAAM,cACJ,SACA,SACA,WACc;EACd,MAAM,SAAS,OAAO,WAAW,YAAY,CAAC,CAAC,OAAO;EAEtD,UAAU,OAAO,aAAa,QAAQ,YAAY,OAAO,GAAG,MAAM,CAAC,CAAC,OAAO,MAAM,CAAC;EAElF,OAAO,OAAO;CAChB;CAEA,MAAM,cAAc,OAAO,eAAe,OAAO,MAAM,OAAO,MAAM,CAAC;CAErE,MAAM,SAAS,UAAkB,MAAc,QAC7C,OAAO,OAAO,WAAW,WAAW,CAAC,CAAC;EAAC;EAAwB;EAAU;EAAM;CAAG,CAAC,CAAC;CAEtF,MAAM,WAAkC,EAAE,MAAM,WAAW;CAE3D,MAAM,YAAY,OAAO,GAAG,uBAAuB,CAAC,CAAC,WAAW,SAAc,KAAa;EAGzF,OAAO,QAAO,OAFO,wBAAA,CAED,KAClB,QAAQ,MAAM,OACd,MAAM,QAAQ,MAAM,OAAO,GAAG,QAAQ,MAAM,QAAQ,IAAI,CAAC,GACzD,EAAE,OAAO,EAAE,CACb;CACF,CAAC;CAED,MAAM,aAAa,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACrD,SACA,KACA,OACA,UACA;EACA,MAAM,QAAQ,OAAO;EAErB,MAAM,SAAS;IACZ,QAAQ,MAAM,QAAQ,OAAO,WAAW,YAAY,CAAC,CAAC;IACrD,UAAU,QAAQ;IAClB,QAAQ;GACV,CAAC;IACA,QAAQ,MAAM,UAAU,SAAS;EACpC;EAEA,IAAI,SAAS,KAAK,WAAW,GAiB3B,SAAS,QAAO,OAhBQ,MAAM,OAC5B,QAAQ,MAAM,OACd;GACE,GAAG,UACD,QAAQ,MAAM,aAAa;IACzB,OAAO;IACP,OAAO,OAAO,QAAQ,MAAM;IAC5B,SAAS,OAAO,QAAQ,MAAM;GAChC,CAAC,CACH;IACC,QAAQ,MAAM,QAAQ;GACvB,GAAG;EACL,GACA,GAAG,QAAQ,MAAM,QAAQ,IAAI,CAC/B,EAAA,CAEyB;OACpB,OAAO,MAAM,OAAO,QAAQ,MAAM,OAAO,GAAG,QAAQ,MAAM,QAAQ,IAAI,GAAG,MAAM;CACxF,CAAC;CAED,MAAM,cAAc,OAAO,GAAG,yBAAyB,CAAC,CAAC,WACvD,SACA,aACA;EACA,MAAM,MAAM,MAAM,QAAQ,UAAU,WAAW,WAAW,GACxD,cAAc,OAAO,UAAU,SAAS,GAAG;EAE7C,MAAM,UACJ,YAAY,KAAK,WAAW,IACxB,OACA,WAAW,SAAS,YAAY,KAAK,EAAE,CAAE,QAAQ,MAAM,QAAQ,YAAY;EAEjF,UAAU,YAAY,QAAQ,QAAQ,gBAAgB,WAAW;EAEjE,OAAO;GAAE;GAAK;GAAa;EAAQ;CACrC,CAAC;CAED,MAAM,eAAe,OAAO,GAAG,qBAAqB,CAAC,CAAC,WACpD,SACA,OAMA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,cAAc,OAAO,YAAY,SAAS,MAAM,WAAW;EAEjE,MAAM,SACJ,MAAM,sBAAsB,KAAA,IACxB,OACA,OAAO,YAAY,SAAS,MAAM,iBAAiB;EAEzD,MAAM,KAAK,MAAM,aAAa,YAAY,SAAS;EAEnD,MAAM,UACJ,OAAO,KAAA,IACH,OACA,OAAO,MAAM,KACX,QAAQ,QAAQ,OAChB,MAAM,QAAQ,QAAQ,OAAO,GAAG,QAAQ,QAAQ,KAAK,QAAQ,WAAW,SAAS,EAAE,EAAE,CAAC,GACtF,EAAE,OAAO,EAAE,CACb;EAEN,MAAM,MAAM,SAAS,KAAK;EAE1B,MAAM,SACJ,QAAQ,KAAA,MACP,OAAO,MAAM,MACZ,GAAG,wBAAwB,QAAQ,QAAQ,MAAM,SAAS,KAAK,MAAM,MAAM,QAAQ,QAAQ,OAAO,GAAG,GAAG,QAAQ,QAAQ,eAAe,EAAE,EAC3I;EAEF,MAAM,mBAAmB,OAAO,MAAM,KACpC,QAAQ,WAAW,OACnB,MAAM,QAAQ,WAAW,OAAO;IAC7B,QAAQ,WAAW,YAAY;IAC/B,QAAQ,WAAW,QAAQ,MAAM;EACpC,CAAC,GACD,EAAE,OAAO,EAAE,CACb;EAEA,IAAI,WACF,MAAM,WAAW,aACb,YAAY,YAAY,QAAQ,iBAAiB,KAAK,WAAW,IACjE,UACA,MAAM,cAAc,OAClB,YAAY,YAAY,QAAQ,iBAAiB,KAAK,WAAW,KAChE,YAAY,SAAS,cAAc,MAAM,YAAY,SAAS,UAAU;EAEjF,IAAI,MAAM,WAAW,UACnB,WACE,YACA,MAAM,sBAAsB,MAAM,eAClC,QAAQ,SAAS,cAAc,MAC/B,QAAQ,SAAS,UAAU;EAC/B,MAAM,cAAc,CAAC;EAErB,KAAK,MAAM,WAAW,CAAC,YAAY,SAAS,QAAQ,OAAO,GACzD,IACE,YAAY,QACZ,YAAY,KAAA,KACZ,QAAQ,UAAU,cAClB,QAAQ,cAAc,IACtB;GACA,MAAM,IAAI,QAAQ;GAWlB,MAAM,MAAK,OATU,MAAM,KACzB,EAAE,OACF,MAAM,EAAE,OAAO;KACZ,EAAE,KAAK,QAAQ;KACf,EAAE,YAAY,QAAQ,WAAW,SAAS,EAAE;GAC/C,CAAC,GACD,EAAE,OAAO,EAAE,CACb,EAAA,CAEiB,KAAK;GAEtB,IACE,OAAO,KAAA,KACP,GAAG,EAAE,cAAc,QAAQ,sBAC3B,EAAE,OAAO,MAAM,MACb,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAAK,MAAM,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,EAChG,IAEA,WAAW;QAEX,YAAY,KAAK;IACf,cAAc,QAAQ;IACtB,UAAU,QAAQ;GACpB,CAAC;EACL;EAgBF,OAAO;GAAE,QAAA;IAbP,aAAa,MAAM;IACnB,SAAS,YAAY;IACrB,QAAQ,QAAQ,WAAW;IAC3B,UAAU,SACN;KACE,WAAW;KACX,kBAAkB,iBAAiB,KAAK,IAAK,QAAQ,QAAQ,iBAAiB;KAC9E;IACF,IACA;IACJ;GAGY;GAAG;GAAa;GAAQ;GAAS,YAAY;GAAK;EAAiB;CACnF,CAAC;CAolBD,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA,aAzlBkB,OAAO,GAAG,oBAAoB,CAAC,CAAC,WAClD,SACA,OACA;GACA,UAAU,MAAM,aAAa,QAAQ,QAAQ;GAE7C,MAAM,WAAW,OAAO,aAAa,SAAS;IAC5C,QAAQ;IACR,aAAa,MAAM;GACrB,CAAC;GAED,MAAM,EAAE,SAAS,aAAa,SAAS;GAEvC,IACE,YAAY,QACZ,QAAQ,UAAU,cAClB,QAAQ,qBAAqB,QAC7B,aAAa,QACb,CAAC,SAAS,YAAY,MAAM,MAAM,EAAE,iBAAiB,QAAQ,YAAY,GAEzE,OAAO,OAAO,KAAK;GAErB,MAAM,QAAQ,OAAO,yBACnB,IAAI,QAAQ,YACZ,MAAM,SAAS,iBAAiB,KAAK;GAEvC,IACE,QAAQ,KAAA,KACR,IAAI,EAAE,cAAc,QAAQ,mBAC5B,EAAE,OAAO,MAAM,MACb,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAAK,MAAM,MAAM,EAAE,OAAO,GAAG,GAAG,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,QAAQ,WAAW,SAAS,QAAQ,SAAS,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,EACpL,IAEA,OAAO,OAAO,KAAK;GAErB,OAAO,OAAO,KACZ,OAAO,WAAW,uBAAuB,CAAC,CAAC;IACzC,UAAU,QAAQ;IAClB,aAAa,MAAM;IACnB,iBAAiB,QAAQ;IACzB,kBAAkB,QAAQ;IAC1B,cAAc,QAAQ;IACtB,oBAAoB,QAAQ;IAC5B;GACF,CAAC,CACH;EACF,CA2iBY;EACV,YA1iBiB,OAAO,GAAG,mBAAmB,CAAC,CAAC,WAChD,SACA,OAQA;GACA,UACE,MAAM,aAAa,QAAQ,YACzB,OAAO,cAAc,MAAM,oBAAoB,KAC/C,MAAM,wBAAwB,KAC9B,MAAM,WAAW,SAAS,KAC1B,MAAM,WAAW,UAAU,QAC3B,MAAM,UAAU,SAAS,KACzB,MAAM,UAAU,UAAU,GAC9B;GAEA,MAAM,QAAQ,OAAO,yBACnB,MAAM,OAAO,MAAM,IAAI,OAAO,GAC9B,SAAS,QAAQ;GAEnB,MAAM,MAAM,MAAM,QAAQ,UAAU,aAAa,MAAM,SAAS,MAAM,MAAM,SAAS,GACnF,UAAU,OAAO,UAAU,SAAS,GAAG;GAEzC,IAAI,QAAQ,KAAK,WAAW,GAAG;IAC7B,MAAM,QAAQ,WAAW,SAAS,QAAQ,KAAK,EAAE,CAAE,QAAQ,MAAM,QAAQ,gBAAgB;IAEzF,IAAI,MAAM,kBAAkB,KAC1B,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,gBAAgB,KAAK,MAAM,iBAAiB;IAEtF,OACE,MAAM,gBAAgB,MAAM,eAC5B,MAAM,YAAY,OAAO,MAAM,UAAU,KACzC,MAAM,aAAa,QACnB,MAAM,kBAAkB;GAE5B;GAEA,MAAM,SAAS,KAAK,MAAM,MAAM,OAAO,YAAY,GACjD,UAAU,CACR;IACE,KAAK,MAAM,QAAQ,UAAU,WAAW,MAAM,SAAS,MAAM,OAAO,MAAM,UAAU,CAAC;IACrF,OAAO,MAAM,WAAW,YAAY,OAAO,kBAAkB,OAAO;GACtE,GACA,GAAI,MAAM,WAAW,YACjB,CAAC;IAAE,KAAK,MAAM,QAAQ,UAAU,YAAY,QAAQ;IAAG,OAAO,OAAO;GAAgB,CAAC,IACtF,CAAC,CACP,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,IAAI,cAAc,EAAE,GAAG,CAAC;GAE7C,MAAM,UAAU,CAAC;GACjB,IAAI,WAAW;GAEf,KAAK,MAAM,SAAS,SAAS;IAC3B,MAAM,WAAW,OAAO,UAAU,SAAS,MAAM,GAAG,GAClD,WACE,SAAS,KAAK,WAAW,IACrB,KAAA,IACA,WAAW,SAAS,SAAS,KAAK,EAAE,CAAE,QAAQ,MAAM,QAAQ,gBAAgB;IAEpF,MAAM,QAAQ,UAAU,WAAW,SAAS,SAAS,QAAQ;IAE7D,IAAI,SAAS,MAAM,OAAO,WAAW;IACrC,QAAQ,KAAK;KAAE,GAAG;KAAO;KAAU;IAAM,CAAC;GAC5C;GACA,IAAI,UACF,KAAK,MAAM,UAAU,SACnB,OAAO,WACL,SACA,OAAO,KACP;IAAE;IAAQ,OAAO,OAAO,QAAQ;GAAE,GAClC,OAAO,QACT;GACJ,OAAO,WACL,SACA,KACA;IACE,aAAa,MAAM;IACnB,SAAS,OAAO,MAAM,UAAU;IAChC;IACA,iBAAiB,MAAM,KAAK,IAAI,OAAO,wBAAwB,MAAM,oBAAoB;GAC3F,GACA,OACF;GACA,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,gBAAgB,MAAM,SAAS,OAAO,aAAa,OAAO,QAAQ,gBAAgB,MAAM,SAAS,KAAK,OAAO,cAC7H;GAEA,OAAO;EACT,CA8cW;EACT,sBA7c2B,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACpE,SACA,OACA;GACA,MAAM,QAAQ,OAAO;GAErB,UACE,MAAM,aAAa,QAAQ,YACzB,OAAO,WAAW,OAAO,eAAe,oBAAoB,CAAC,CAAC,CAAC,MAAM,MAAM,MACzE,OAAO,WAAW,OAAO,eAAe,oBAAoB,CAAC,CAAC,CAAC,QAAQ,MAAM,CACnF;GAEA,MAAM,WAAW,OAAO,aAAa,SAAS;IAC5C,QAAQ,MAAM;IACd,aAAa,MAAM,OAAO;IAC1B,GAAI,MAAM,OAAO,aAAa,OAAO,CAAC,IAAI,EAAE,WAAW,MAAM,OAAO,SAAS,UAAU;IACvF,GAAI,MAAM,OAAO,WAAW,OACxB,CAAC,IACD,EAAE,mBAAmB,MAAM,OAAO,OAAO,YAAY;GAC3D,CAAC;GAED,IACE,CAAC,SAAS,OAAO,YACjB,OAAO,WAAW,OAAO,eAAe,oBAAoB,CAAC,CAAC,CAAC,SAAS,MAAM,MAC5E,OAAO,WAAW,OAAO,eAAe,oBAAoB,CAAC,CAAC,CAAC,MAAM,MAAM,GAE7E,OAAO,EAAE,UAAU,SAAS;GAC9B,MAAM,UAAU,MAAM,WAAW,MAAM;GAEvC,IACE,MAAM,WAAW,MAAM,aAAa,GAAG,QAAQ,SAAS,eACxD,MAAM,WAAW,MAAM,YAAY,qBACnC,QAAQ,WAAW,cAAc,WACjC,QAAQ,WAAW,UAAU,MAAM,OAAO,aAE1C,OAAO,EAAE,UAAU,SAAS;GAC9B,IACE,MAAM,WAAW,aACb,QAAQ,SAAS,eACjB,QAAQ,SAAS,gBACjB,QAAQ,SAAS,cAAc,MAAM,OAAO,UAAU,aACtD,QAAQ,SAAS,qBAAqB,MAAM,OAAO,UAAU,kBAEjE,OAAO,EAAE,UAAU,SAAS;GAC9B,IACG,MAAM,WAAW,YAAY,QAAQ,SAAS,aAC9C,MAAM,WAAW,YAAY,QAAQ,SAAS,oBAE/C,OAAO,EAAE,UAAU,SAAS;GAE9B,MAAM,aAAa,MAAM,QAAQ,UAAU,WAAW,MAAM,SAAS,GACnE,UAAU,OAAO,UAAU,SAAS,UAAU;GAEhD,IAAI,QAAQ,KAAK,WAAW,GAAG,OAAO,EAAE,UAAU,SAAS;GAE3D,MAAM,MAAM,OAAO,MAAM,IAAI,OAAO,GAClC,SAAgB,CAAC;GAEnB,MAAM,mBAAqD,CAAC;GAE5D,IAAI,MAAM,WAAW,YAAY;IAC/B,MAAM,gBAAgB,MAAM;IAE5B,IAAI,kBAAkB,KAAA,GAAW,OAAO,EAAE,UAAU,SAAS;IAC7D,MAAM,EAAE,WAAW,aAAa;IAChC,MAAM,WAAW,SAAS,OAAO;IAEjC,IACE,UAAU,aAAa,QAAQ,YAC/B,UAAU,WAAW,MAAM,UAC3B,UAAU,cAAc,MAAM,aAC9B,UAAU,gBAAgB,MAAM,OAAO,eACvC,UAAU,sBAAsB,MAAM,OAAO,QAAQ,eACrD,UAAU,WAAW,QAAQ,UAC7B,UAAU,kBAAkB,QAAQ,iBACpC,UAAU,WAAW,SAAS,UAC9B,UAAU,kBAAkB,SAAS,iBACrC,UAAU,SAAS,cAAc,SAAS,aAC1C,UAAU,SAAS,qBAAqB,SAAS,oBACjD,SAAS,SAAS,cAAc,SAAS,aACzC,SAAS,SAAS,qBAAqB,SAAS,kBAEhD,OAAO,EAAE,UAAU,SAAS;IAC9B,MAAM,IAAI,QAAQ;IAElB,KAAK,MAAM,QAAQ,CAAC,GAAG,SAAS,SAAS,WAAW,CAAC,CAAC,MAAM,GAAG,MAC7D,EAAE,aAAa,cAAc,EAAE,YAAY,CAC7C,GAAG;KACD,MAQE,OAAM,OARa,MAAM,KACvB,EAAE,OACF,MAAM,EAAE,OAAO;OACZ,EAAE,KAAK,KAAK;OACZ,EAAE,YAAY,QAAQ,WAAW,SAAS,SAAS,SAAS;KAC/D,CAAC,GACD,EAAE,OAAO,EAAE,CACb,EAAA,CACY,KAAK;KAEnB,IAAI,QAAQ,KAAA,KAAa,IAAI,EAAE,cAAc,KAAK,UAAU,OAAO,EAAE,UAAU,SAAS;KACxF,MAAM,YAAY,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAAK,MAAM,MAAM,EAAE,OAAO,GAAG,GAAG,EAAE,eAAe,EAAE;KAEjH,IAAI,EAAE,OAAO,MAAM,MAAM,SAAS,IAAI,OAAO,EAAE,UAAU,SAAS;KAClE,iBAAiB,KAAK;MAAE,IAAI,KAAK;MAAc;KAAU,CAAC;IAC5D;IACA,MAAM,SAAS,SAAS;IAExB,IACE,OAAO,WAAW,KAClB,OAAO,MACJ,MAAM,CAAC,SAAS,SAAS,YAAY,MAAM,MAAM,EAAE,iBAAiB,EAAE,YAAY,CACrF,GAEA,OAAO,EAAE,UAAU,SAAS;IAE9B,MAAM,eAAe;KACnB,cAAc;KACd,cAAc;KACd,GAAI,QAAQ,QAAQ,4BAA4B,KAAA,IAC5C,CAAC,IACD,CACE,OAAO,WAAW,yBAAyB,CAAC,CAC1C,QAAQ,QAAQ,wBACd,UAAU,SAAS,UAAW,GAC9B,MAAM,MACR,CACF,CACF;KACJ,OAAO,WAAW,yBAAyB,CAAC,CAC1C,QAAQ,QAAQ,kBAAkB,UAAU,SAAS,UAAW,CAAC,CACnE;IACF;IAEA,MAAM,MAAM,KAAK,IACb,MAAM,OAAO,0BACb,GAAG,aAAa,KAAK,MAAM,EAAE,gBAAgB,CAC/C,GACA,UAAU,IAAI,IAAI,OAAO,SAAS,MAAM,EAAE,OAAO,CAAC,GAClD,cAAc,IAAI,IAAI,OAAO,KAAK,MAAM,EAAE,YAAY,CAAC;IAEzD,KAAK,MAAM,eAAe,cACxB,IACE,CAAC,YAAY,aAAa,MACvB,MACC,EAAE,QAAQ,OAAO,MAAM,QAAQ,IAAI,CAAC,CAAC,KACrC,YAAY,QAAQ,EAAE,sBACtB,OAAO,MACJ,OACE,CAAC,EAAE,gBAAgB,EAAE,kBACrB,CAAC,EAAE,qBAAqB,EAAE,kBAC/B,CACJ,GAEA,OAAO,EAAE,UAAU,SAAS;IAChC,KAAK,MAAM,SAAS,QAAQ;KAC1B,MAAM,KAAK,MAAM,WAAW;KAE5B,IAAI,KAAK,OAAO,MAAM,MAAM,KAAK,OAAO,EAAE,UAAU,SAAS;KAC7D,OAAO,KACL,GAAG,GAAG,QAAQ,gBAAgB,MAAM,GAAG,OAAO,QAAQ,gBAAgB,KAAK,KAAK,KAClF;IACF;GACF;GAEA,MAAM,YACF,MAAM,WAAW,aACb,QAAQ,WAAW,UAAU,QAAQ,WAAW,SAAS,CAAC,IAC1D,SAAS,OAAO,SAAU,WAChC,WAAW,QAAQ,WAAW,SAAS,SAAS,GAChD,mBAAmB,iBAAiB,KAAK,SAAS,CAAC,GACnD,qBAAqB,iBAAiB,KAAK,SAAS,CAAC,GACrD,kBAAkB,iBAAiB,KAAK,SAAS,CAAC,GAClD,eAAe,SAAS,OAAO,SAAS,gBAAgB,SAAS;GAEnE,UAAU,QAAQ,WAAW,UAAU,QAAQ,MAAM,SAAS;GAE9D,MAAM,UAAwB;IAC5B,aAAa,MAAM,OAAO;IAC1B;IACA;IACA;IACA;IACA,kBAAkB;IAClB,OAAO;GACT;GAsMA,OAAO;IACL,UAAA;KApMA,MAAM;KACN,YAAY;MACV,UAAU,QAAQ;MAClB,aAAa,MAAM,OAAO;MAC1B;MACA,kBAAkB;MAClB;MACA;MACA,UAAU;OACR;OACA;OACA,aAAa,CAAC;QAAE;QAAc,UAAU;OAAmB,CAAC;MAC9D;KACF;IAuLO;IACP,QArLa,OAAO,IAAI,aAAa;KACrC,IAAI,MAAM,WAAW,YACnB,OAAO,MAAM,OACX,QAAQ,QAAQ,OAChB;MACE,GAAG,UACD,QAAQ,QAAQ,aAAa;OAC3B,IAAI;OACJ;OACA,aAAa,MAAM,OAAO;MAC5B,CAAC,CACH;OACC,QAAQ,QAAQ,KAAK;OACrB,QAAQ,QAAQ,mBAAmB;KACtC,GACA,GAAG,QAAQ,QAAQ,KAAK,SAAS,CACnC;UAEA,OAAO,MAAM,OACX,QAAQ,QAAQ,OAChB,GAAG,QAAQ,QAAQ,KAAK,SAAS,GACjC,GAAG,QAAQ,QAAQ,mBAAmB,iBAAiB,CACzD;KAEF,MAAM,IAAI,QAAQ,YAChB,IAAI,QAAQ;KAEd,IAAI,SAAS,QAAQ,SAAS;MAC5B,MAAM,MAAM,SAAS,OAAO;MAE5B,MAAM,KAAK,OAAO,MAAM,KACtB,EAAE,OACF,MAAM,EAAE,OAAO;QACZ,EAAE,YAAY;QACd,EAAE,QAAQ,IAAI;QACd,EAAE,YAAY;MACjB,CAAC,GACD,EAAE,OAAO,EAAE,CACb;MAEA,UAAU,GAAG,KAAK,WAAW,KAAK,GAAG,KAAK,EAAE,CAAE,EAAE,cAAc,IAAI,eAAe;MACjF,UACE,OAAO,MAAM,MACX,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAAK,MAAM,MAAM,EAAE,OAAO,GAAG,KAAK,EAAG,GAAG,EAAE,eAAe,EAAE,EACzG,CACF;MACA,OAAO,MAAM,OACX,EAAE,OACF;QAAG,EAAE,YAAY;QAAU,EAAE,QAAQ,IAAI;MAAY,GACrD;QAAG,EAAE,SAAS,EAAE,aAAa,KAAK;QAAI,EAAE,WAAW,SAAS;MAAE,CAChE;MACA,OAAO,MAAM,OACX,EAAE,OACF;QAAG,EAAE,KAAK,IAAI;QAAe,EAAE,YAAY;MAAS,GACpD;QAAG,EAAE,SAAS,EAAE,aAAa,KAAK;QAAI,EAAE,WAAW,SAAS;MAAE,CAChE;MACA,OAAO,WACL,SACA,SAAS,OAAO,KAChB;OACE,GAAG;OACH,OAAO;OACP,iBAAiB,iBAAiB,KAAK,SAAS,CAAC;OACjD,oBAAoB,iBAAiB,KAAK,SAAS,CAAC;MACtD,GACA,SAAS,OAAO,WAClB;KACF;KACA,IAAI,SAAS,iBAAiB,KAAK,WAAW,GAAG;MAC/C,MAAM,WAAW,OAAO,MAAM,OAC5B,EAAE,OACF;OACE,GAAG,UACD,EAAE,aAAa;QACb,aAAa,MAAM,OAAO;QAC1B,WAAW;QACX,UAAU;QACV,kBAAkB;QAClB,QAAQ;OACV,CAAC,CACH;QACC,EAAE,YAAY;QACd,EAAE,QAAQ,MAAM,OAAO;QACvB,EAAE,YAAY;QACd,EAAE,WAAW;QACb,EAAE,aAAa,QAAQ,cAAc,GAAG;QACxC,EAAE,SAAS,EAAE,aAAa,IAAI;MACjC,GACA;QAAG,EAAE,YAAY;QAAU,EAAE,QAAQ,MAAM,OAAO;MAAY,CAChE;MAEA,SAAS,iBAAiB,OAAO,SAAS;KAC5C,OAAO;MACL,MAAM,MAAM,SAAS,iBAAiB,KAAK;MAE3C,UACE,OAAO,MAAM,MACX,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAAK,MAAM,MAAM,EAAE,OAAO,GAAG,GAAG,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,SAAS,CAAC,CAAC,EAAE,EAC3H,CACF;MACA,OAAO,MAAM,OACX,EAAE,OACF;QAAG,EAAE,YAAY;QAAU,EAAE,QAAQ,MAAM,OAAO;MAAY,GAC9D;QACG,EAAE,WAAW;QACb,EAAE,aAAa,QAAQ,cAAc,GAAG;QACxC,EAAE,SAAS,EAAE,aAAa,IAAI;MACjC,CACF;KACF;KAEA,MAAM,aAAa,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,EAAE,KAAK,aAAa,CAAC,GAAG,EACtF,OAAO,EACT,CAAC;KAED,IAAI,WAAW,KAAK,WAAW,GAoB7B,WAAW,QAAO,OAnBM,MAAM,OAC5B,EAAE,OACF;MACE,GAAG,UACD,EAAE,aAAa;OACb;OACA,WAAW;OACX,UAAU;OACV,QAAQ;MACV,CAAC,CACH;OACC,EAAE,KAAK;OACP,EAAE,YAAY;OACd,EAAE,WAAW;OACb,EAAE,SAAS,EAAE,aAAa,IAAI;KACjC,GACA,GAAG,EAAE,KAAK,aAAa,CACzB,EAAA,CAE2B;UACtB;MACL,UACE,OAAO,MAAM,MACX,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAAK,MAAM,MAAM,EAAE,OAAO,WAAW,KAAK,EAAG,GAAG,MAAM,EAAE,OAAO,GAAG,EAAE,YAAY,SAAS,CAAC,CAAC,EAAE,EAC3I,CACF;MACA,OAAO,MAAM,OACX,EAAE,OACF,GAAG,EAAE,KAAK,aAAa,GACvB;QAAG,EAAE,WAAW;QAAqB,EAAE,SAAS,EAAE,aAAa,IAAI;MAAE,CACvE;KACF;KACA,OAAO,WACL,SACA,SAAS,YAAY,KACrB,SACA,SAAS,YAAY,WACvB;KACA,OAAO,WACL,SACA,YACA;MAAE,WAAW,MAAM;MAAW,QAAQ,MAAM;KAAO,GACnD,OACF;KACA,MAAM,eAAe,KACnB,GAAG,QACH,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAAK,MAAM,EAAE,OAAO;OAAG,EAAE,YAAY;OAAU,EAAE,QAAQ,MAAM,OAAO;OAAc,EAAE,YAAY;OAAW,EAAE,WAAW;OAAkB,EAAE,aAAa,QAAQ,cAAc,GAAG;KAAE,CAAC,GAAG,EAAE,eAAe,EAAE,IACzP,GAAI,SAAS,QAAQ,YAAY,QAAQ,SAAS,QAAQ,YAAY,KAAA,IAClE,CAAC,IACD,CACE,GAAG,4BAA4B,EAAE,MAAM,SAAS,KAAK,MAAM,EAAE,OAAO;OAAG,EAAE,YAAY;OAAU,EAAE,QAAQ,SAAS,OAAO,QAAQ;KAAY,CAAC,GAAG,EAAE,eAAe,EAAE,IACpK,GAAG,4BAA4B,EAAE,MAAM,SAAS,KAAK,MAAM,EAAE,OAAO,GAAG,EAAE,KAAK,SAAS,OAAO,QAAQ,aAAa,CAAC,GAAG,EAAE,eAAe,EAAE,EAC5I,GACJ,GAAG,iBACA,QAAQ,MAAM,EAAE,OAAO,SAAS,QAAQ,SAAS,gBAAgB,EAAE,OAAO,YAAY,CAAC,CACvF,KAAK,MAAM,EAAE,SAAS,GACzB,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAAK,MAAM,EAAE,OAAO;OAAG,EAAE,KAAK;OAAe,EAAE,YAAY;OAAW,EAAE,WAAW;KAAmB,CAAC,GAAG,EAAE,eAAe,EAAE,IACzK,GAAG,wBAAwB,QAAQ,QAAQ,MAAM,SAAS,KAAK,MAAM,QAAQ,QAAQ,OAAO;OAAG,QAAQ,QAAQ,KAAK;OAAW,QAAQ,QAAQ,mBAAmB;KAAiB,CAAC,GAAG,QAAQ,QAAQ,eAAe,EAAE,EAC1N;KAEA,OAAO;IACT,CAIO;IACL,kBAAkB,GAAG,wBAAwB,QAAQ,MAAM,MAAM,SAAS,MAAM,QAAQ,MAAM,OAAO,GAAG,QAAQ,MAAM,QAAQ,WAAW,CAAC,EAAE;GAC9I;EACF,CA2EqB;EACnB,uBAzE4B,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACtE,SACA,OACA;GACA,UACE,MAAM,aAAa,QAAQ,YACzB,OAAO,cAAc,MAAM,KAAK,KAChC,MAAM,SAAS,KACf,MAAM,SAAS,GACnB;GAEA,MAAM,QAAQ,OAAO,yBACnB,MAAM,OAAO,MAAM,IAAI,OAAO,GAC9B,QAAQ,QAAQ;GAKlB,MAAM,OAAO,OAAO,MAAM,KACxB,MAAM,OACN,MAAM,UAAU,KAAA,IAAY,GAAG,QAAQ,GAAG,GAAG,IAAI,MAAM,OAAO,MAAM,KAAK,EAAE,KAAK,MAAM,SACtF;IACE,OAAO,MAAM;IACb,UAAU;IACV,SAAS;IACT,SAAS,IAAI,MAAM,OAAO,MAAM,KAAK;GACvC,CACF;GAEA,IAAI,UAAU;GACd,MAAM,OAAO,CAAC,GAAG,KAAK,IAAI;GAE1B,KAAK,MAAM,aAAa,MAAM;IAO5B,MAAM,OAAM,OANW,MAAM,KAC3B,MAAM,OACN,MAAM,MAAM,OAAO,GAAG,MAAM,QAAQ,UAAU,MAAM,OAAO,CAAC,GAC5D,EAAE,OAAO,EAAE,CACb,EAAA,CAEoB,KAAK;IAEzB,IAAI,QAAQ,KAAA,GAAW;IACvB,MAAM,SAAS,OAAO,WAAW,YAAY,CAAC,CAAC,IAAI,MAAM,MAAM;IAE/D,IAAI,OAAO,aAAa,QAAQ,UAAU;IAC1C,MAAM,SAAS,OAAO;IAEtB,IACG,OAAO,GAAG,gBAAgB,CAAC,CAAC,MAAM,KAAK,OAAO,mBAAmB,OACjE,OAAO,GAAG,gBAAgB,CAAC,CAAC,MAAM,MAChC,OAAO,SAAS,KAAK,QAAQ,UAAU,gBAAgB,KAC1D;KACA,OAAO,MAAM,OAAO,MAAM,OAAO,GAAG,MAAM,QAAQ,IAAI,MAAM,OAAO,CAAC;KACpE;IACF;GACF;GAEA,OAAO;IACL;IACA,YAAY,KAAK,WAAW,MAAM,QAAQ,OAAO,KAAK,KAAK,SAAS,EAAE,CAAE,MAAM,MAAM,IAAI;GAC1F;EACF,CAYsB;CACtB;AACF"}

package/dist/internal/proof-kernel.d.mts

@@ -37,7 +37,7 @@ export interface ProofSqlConfiguration {
   readonly insertIfAbsent: (query: ProofSqlQuery, selfKey: string, selfValue: unknown) => ProofSqlQuery;
 }
 export declare const makeProofKernel: <Fragment extends SqlFragment = SqlFragment, Column extends SqlColumn = SqlColumn>(operations: QueryOperations<Fragment, Column>) => {
-  makeSqlProofPersistence: (database: ProofSqlDatabase, mapping: AnyProofPersistenceMapping<Fragment>, configuration: ProofSqlConfiguration) => Effect.Effect<{
+  makeSqlProofPersistence: (mapping: AnyProofPersistenceMapping<Fragment>, configuration: ProofSqlConfiguration) => Effect.Effect<{
     readonly issue: <A>(input: {
       readonly record: import("@yielded/auth/Proofs").ProofRecord;
       readonly policy: ProofPolicy;
@@ -85,7 +85,7 @@ export declare const makeProofKernel: <Fragment extends SqlFragment = SqlFragmen
       readonly nowMillis: number;
       readonly limit: number;
     }, prepare: import("@yielded/auth/Proofs").PrepareProofCommit<ProofCleanupResult, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, ProofUnavailable>;
-  }, never, LifecycleHooks>;
+  }, never, CurrentProofSql | LifecycleHooks>;
   checkProofCompletionIn: (mapping: AnyProofPersistenceMapping<Fragment>, configuration: ProofSqlConfiguration, input: import("@yielded/auth/Proofs").ProofCompletionInput) => Effect.Effect<boolean, ProofUnavailable | QueryFailure, CurrentProofSql>;
   completeProofPlanIn: <Rq extends TableModel, S extends TableModel, G extends TableModel, Cn extends TableModel, Rs extends TableModel, Aev extends TableModel, F extends TableModel, C extends TableModel, Sub extends TableModel, I extends TableModel, Cr extends TableModel, NativeId, A, E, R>(mapping: ProofPersistenceMapping<Rq, S, G, Cn, Rs, Aev, F, C, Sub, I, Cr, NativeId, SqlExpression>, configuration: ProofSqlConfiguration, plan: ProofCompletionPlan, protectedMutation: Effect.Effect<boolean, E, R>, project: (decision: ProofCompletionDecision) => A) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, E | ProofUnavailable | QueryFailure, R | CurrentCommitJournal | CurrentProofSql>;
 };

package/dist/internal/proof-kernel.mjs

@@ -246,7 +246,8 @@ const makeProofKernel = (operations) => {
 			return yield* run;
 		}) : run;
 	};
-	const makeSqlProofPersistence = Effect.fn("makeSqlProofPersistence")(function* (database, mapping, configuration) {
+	const makeSqlProofPersistence = Effect.fn("makeSqlProofPersistence")(function* (mapping, configuration) {
+		const database = yield* CurrentProofSql;
 		const hooks = yield* LifecycleHooks;
 		return ProofPersistence.of({
 			issue: (input, prepare) => owned(database, mapping, configuration, Effect.gen(function* () {