@yielded/auth-persistence 0.1.0-beta.23 → 0.1.0-beta.24

package/dist/internal/password-credentials.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-credentials.mjs","names":[],"sources":["../../src/internal/password-credentials.ts"],"sourcesContent":["import { CurrentCommitJournal, hasCommitScope } from \"@yielded/auth/Hooks\";\nimport type { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport {\n  EncodedPasswordHash,\n  type PasswordPersistence,\n  PasswordUnavailable,\n  snapshotPasswordCredential,\n  type PasswordCredentialSnapshot,\n} from \"@yielded/auth/Password\";\nimport { reportPersistenceFailure } from \"@yielded/auth/Persistence\";\nimport { Effect, Option, Redacted, Schema } from \"effect\";\n\nimport type { PersistenceMappingError } from \"./mapping-error\";\nimport type { AnyPasswordPersistenceMapping } from \"./models/password-model\";\nimport { sqlMapping, type SqlTable } from \"./native-sql-table\";\nimport type { PasswordSqlConfiguration } from \"./password-kernel\";\nimport { NativeDatabase } from \"./transaction-kernel\";\n\ntype Row = Readonly<Record<string, unknown>>;\nconst unavailable = () => PasswordUnavailable.make({});\n\nconst failure = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n  reportPersistenceFailure(effect, Schema.is(PasswordUnavailable)).pipe(\n    Effect.mapError(unavailable),\n  );\n\nexport const samePasswordCredentialSnapshot = (\n  a: PasswordCredentialSnapshot,\n  b: PasswordCredentialSnapshot,\n) =>\n  a.moduleId === b.moduleId &&\n  a.revision.subjectId === b.revision.subjectId &&\n  a.revision.securityRevision === b.revision.securityRevision &&\n  a.revision.credentials.length === b.revision.credentials.length &&\n  new Set(a.revision.credentials.map((entry) => entry.credentialId)).size ===\n    a.revision.credentials.length &&\n  new Set(b.revision.credentials.map((entry) => entry.credentialId)).size ===\n    b.revision.credentials.length &&\n  a.revision.credentials.every((entry) =>\n    b.revision.credentials.some(\n      (other) => entry.credentialId === other.credentialId && entry.revision === other.revision,\n    ),\n  ) &&\n  a.credentialId === b.credentialId &&\n  a.credentialRevision === b.credentialRevision &&\n  a.verifierVersion === b.verifierVersion &&\n  Redacted.value(a.verifier) === Redacted.value(b.verifier) &&\n  a.normalization === b.normalization &&\n  a.identifier.namespace === b.identifier.namespace &&\n  a.identifier.value === b.identifier.value &&\n  a.identifierBindingRevision === b.identifierBindingRevision &&\n  a.identifierVerifiedAtMillis === b.identifierVerifiedAtMillis;\n\n/** Lookup is read-only; rehash is one conditional maintenance write, never authentication. */\nexport const makePasswordCredentials = Effect.fnUntraced(function* (\n  table: (table: object) => SqlTable,\n  mapping: AnyPasswordPersistenceMapping,\n  options: PasswordSqlConfiguration,\n): Effect.fn.Return<\n  Pick<PasswordPersistence[\"Service\"], \"findCredential\" | \"rehashIfCurrent\">,\n  PasswordUnavailable,\n  NativeDatabase\n> {\n  const sql = (yield* NativeDatabase).$client.withoutTransforms();\n  const parent = yield* Effect.serviceOption(CurrentCommitJournal);\n\n  const [s, i, c] = yield* sqlMapping(\n    () =>\n      [\n        table(mapping.subject.table),\n        table(mapping.identifier.table),\n        table(mapping.credential.table),\n      ] as const,\n  ).pipe(failure);\n\n  const standalone = Effect.gen(function* () {\n    if (options.coordinated) {\n      const current = yield* Effect.serviceOption(CurrentCommitJournal);\n\n      if (Option.isNone(parent) || Option.isNone(current) || parent.value !== current.value)\n        return yield* unavailable();\n    } else {\n      if (yield* hasCommitScope) return yield* unavailable();\n      yield* options.standaloneGuard;\n    }\n  });\n\n  const allocate = <A>(\n    asynchronous: Effect.Effect<A, PersistenceMappingError> | undefined,\n    sync: (() => A) | undefined,\n  ) => {\n    if (options.mode !== \"synchronous\" && asynchronous !== undefined) return asynchronous;\n\n    return sync === undefined\n      ? Effect.fail(unavailable())\n      : Effect.try({ try: sync, catch: unavailable });\n  };\n\n  // Bind each native ID through its own column codec. Physical encodings of the\n  // same application ID need not match across subject, identifier and password.\n  const snapshot = Effect.fnUntraced(function* (\n    nativeId: unknown,\n    moduleId: string,\n    identifier: LoginIdentifier,\n  ) {\n    const subjectTable = s.as(\"password_subject\");\n    const identifierTable = i.as(\"password_identifier\");\n    const credentialTable = c.as(\"password_credential\");\n\n    const rows = yield* sqlMapping(\n      () =>\n        sql<Row>`select ${subjectTable.fields(\"subject_\")}, ${identifierTable.fields(\"identifier_\")}, ${credentialTable.fields(\"credential_\")}\n      from ${subjectTable.name}\n      inner join ${identifierTable.name} on ${identifierTable.column(mapping.identifier.namespace)} = ${identifierTable.value(mapping.identifier.namespace, identifier.namespace)}\n        and ${identifierTable.column(mapping.identifier.value)} = ${identifierTable.value(mapping.identifier.value, identifier.value)}\n        and ${identifierTable.column(mapping.identifier.subjectId)} = ${identifierTable.value(mapping.identifier.subjectId, nativeId)}\n      inner join ${credentialTable.name} on ${credentialTable.column(mapping.credential.moduleId)} = ${credentialTable.value(mapping.credential.moduleId, moduleId)}\n        and ${credentialTable.column(mapping.credential.subjectId)} = ${credentialTable.value(mapping.credential.subjectId, nativeId)}\n      where ${subjectTable.column(mapping.subject.id)} = ${subjectTable.value(mapping.subject.id, nativeId)}\n      `,\n    ).pipe(Effect.flatten);\n\n    if (rows.length !== 1) return undefined;\n\n    const [subject, identifierRow, credential] = yield* sqlMapping(\n      () =>\n        [\n          s.decode(rows[0]!, \"subject_\"),\n          i.decode(rows[0]!, \"identifier_\"),\n          c.decode(rows[0]!, \"credential_\"),\n        ] as const,\n    );\n\n    if (\n      yield* sqlMapping(\n        () =>\n          !mapping.subject.isActiveStatus(subject[mapping.subject.status]) ||\n          !mapping.identifier.isCurrent(identifierRow) ||\n          !mapping.subjectId.equals(nativeId, identifierRow[mapping.identifier.subjectId]) ||\n          !mapping.subjectId.equals(nativeId, subject[mapping.subject.id]) ||\n          !mapping.subjectId.equals(nativeId, credential[mapping.credential.subjectId]),\n      )\n    )\n      return undefined;\n\n    const captured = yield* sqlMapping(() =>\n      mapping.credential.decode({ moduleId, subject, identifier: identifierRow, credential }),\n    ).pipe(Effect.flatten, Effect.flatMap(snapshotPasswordCredential));\n\n    return captured;\n  });\n\n  return {\n    findCredential: (uncaptured) =>\n      Effect.gen(function* () {\n        const input = { ...uncaptured, identifier: { ...uncaptured.identifier } };\n\n        yield* standalone;\n\n        const identifiers = yield* sqlMapping(\n          () => sql<Row>`select ${i.fields(\"i_\")} from ${i.name}\n          where ${i.column(mapping.identifier.namespace)} = ${i.value(mapping.identifier.namespace, input.identifier.namespace)}\n            and ${i.column(mapping.identifier.value)} = ${i.value(mapping.identifier.value, input.identifier.value)}`,\n        ).pipe(Effect.flatten);\n\n        const identifier =\n          identifiers.length === 1\n            ? yield* sqlMapping(() => i.decode(identifiers[0]!, \"i_\"))\n            : undefined;\n\n        if (\n          identifier === undefined ||\n          !(yield* sqlMapping(() => mapping.identifier.isCurrent(identifier)))\n        )\n          return Option.none();\n\n        const credential = yield* snapshot(\n          identifier[mapping.identifier.subjectId],\n          input.moduleId,\n          input.identifier,\n        );\n\n        return credential === undefined ||\n          (input.subjectId !== undefined && credential.revision.subjectId !== input.subjectId)\n          ? Option.none()\n          : Option.some(credential);\n      }).pipe(failure),\n    rehashIfCurrent: (input) =>\n      Effect.gen(function* () {\n        const nextVerifier = Redacted.make(\n          yield* Schema.decodeEffect(EncodedPasswordHash)(Redacted.value(input.nextVerifier)),\n        );\n\n        const credential = yield* snapshotPasswordCredential(input.credential);\n\n        yield* standalone;\n        const nativeId = yield* mapping.subjectId.toNative(credential.revision.subjectId);\n        const version = yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync);\n\n        if (version === credential.verifierVersion) return yield* unavailable();\n        yield* sqlMapping(() => {\n          const encoded = mapping.credential.encodeVerifier(nextVerifier, version);\n\n          // A custom encoder cannot turn maintenance into a semantic credential change.\n          const values = {\n            [mapping.credential.verifier]: encoded[mapping.credential.verifier],\n            [mapping.credential.verifierVersion]: encoded[mapping.credential.verifierVersion],\n          };\n\n          if (Object.values(values).some((value) => value === undefined)) throw unavailable();\n\n          // Ordinary identity predicates retain index use; the full CAS ignores text collation.\n          const exact = sql.and(\n            Object.entries({\n              [mapping.credential.moduleId]: credential.moduleId,\n              [mapping.credential.subjectId]: nativeId,\n              [mapping.credential.credentialId]: credential.credentialId,\n              [mapping.credential.credentialRevision]: credential.credentialRevision,\n              [mapping.credential.verifierVersion]: credential.verifierVersion,\n              [mapping.credential.verifier]: Redacted.value(credential.verifier),\n              [mapping.credential.normalization]: credential.normalization,\n            }).map(([key, value]) => {\n              const column = c.column(key),\n                bound = c.value(key, value);\n\n              if (typeof value !== \"string\") return sql`${column} = ${bound}`;\n\n              return sql.onDialectOrElse({\n                mysql: () => sql`binary ${column} = binary ${bound}`,\n                pg: () =>\n                  sql`convert_to(cast(${column} as text), 'UTF8') = convert_to(cast(${bound} as text), 'UTF8')`,\n                orElse: () => sql`cast(${column} as blob) = cast(${bound} as blob)`,\n              });\n            }),\n          );\n\n          return sql`${c.update(values)}\n          where ${c.column(mapping.credential.moduleId)} = ${c.value(mapping.credential.moduleId, credential.moduleId)}\n            and ${c.column(mapping.credential.subjectId)} = ${c.value(mapping.credential.subjectId, nativeId)}\n            and ${c.column(mapping.credential.credentialId)} = ${c.value(mapping.credential.credentialId, credential.credentialId)}\n            and ${exact}`;\n        }).pipe(Effect.flatten);\n      }).pipe(failure),\n  } satisfies Pick<PasswordPersistence[\"Service\"], \"findCredential\" | \"rehashIfCurrent\">;\n});\n"],"mappings":";;;;;;;AAmBA,MAAM,oBAAoB,oBAAoB,KAAK,CAAC,CAAC;AAErD,MAAM,WAAoB,WACxB,yBAAyB,QAAQ,OAAO,GAAG,mBAAmB,CAAC,CAAC,CAAC,KAC/D,OAAO,SAAS,WAAW,CAC7B;AAEF,MAAa,kCACX,GACA,MAEA,EAAE,aAAa,EAAE,YACjB,EAAE,SAAS,cAAc,EAAE,SAAS,aACpC,EAAE,SAAS,qBAAqB,EAAE,SAAS,oBAC3C,EAAE,SAAS,YAAY,WAAW,EAAE,SAAS,YAAY,UACzD,IAAI,IAAI,EAAE,SAAS,YAAY,KAAK,UAAU,MAAM,YAAY,CAAC,CAAC,CAAC,SACjE,EAAE,SAAS,YAAY,UACzB,IAAI,IAAI,EAAE,SAAS,YAAY,KAAK,UAAU,MAAM,YAAY,CAAC,CAAC,CAAC,SACjE,EAAE,SAAS,YAAY,UACzB,EAAE,SAAS,YAAY,OAAO,UAC5B,EAAE,SAAS,YAAY,MACpB,UAAU,MAAM,iBAAiB,MAAM,gBAAgB,MAAM,aAAa,MAAM,QACnF,CACF,KACA,EAAE,iBAAiB,EAAE,gBACrB,EAAE,uBAAuB,EAAE,sBAC3B,EAAE,oBAAoB,EAAE,mBACxB,SAAS,MAAM,EAAE,QAAQ,MAAM,SAAS,MAAM,EAAE,QAAQ,KACxD,EAAE,kBAAkB,EAAE,iBACtB,EAAE,WAAW,cAAc,EAAE,WAAW,aACxC,EAAE,WAAW,UAAU,EAAE,WAAW,SACpC,EAAE,8BAA8B,EAAE,6BAClC,EAAE,+BAA+B,EAAE;;AAGrC,MAAa,0BAA0B,OAAO,WAAW,WACvD,OACA,SACA,SAKA;CACA,MAAM,OAAO,OAAO,eAAA,CAAgB,QAAQ,kBAAkB;CAC9D,MAAM,SAAS,OAAO,OAAO,cAAc,oBAAoB;CAE/D,MAAM,CAAC,GAAG,GAAG,KAAK,OAAO,iBAErB;EACE,MAAM,QAAQ,QAAQ,KAAK;EAC3B,MAAM,QAAQ,WAAW,KAAK;EAC9B,MAAM,QAAQ,WAAW,KAAK;CAChC,CACJ,CAAC,CAAC,KAAK,OAAO;CAEd,MAAM,aAAa,OAAO,IAAI,aAAa;EACzC,IAAI,QAAQ,aAAa;GACvB,MAAM,UAAU,OAAO,OAAO,cAAc,oBAAoB;GAEhE,IAAI,OAAO,OAAO,MAAM,KAAK,OAAO,OAAO,OAAO,KAAK,OAAO,UAAU,QAAQ,OAC9E,OAAO,OAAO,YAAY;EAC9B,OAAO;GACL,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;GACrD,OAAO,QAAQ;EACjB;CACF,CAAC;CAED,MAAM,YACJ,cACA,SACG;EACH,IAAI,QAAQ,SAAS,iBAAiB,iBAAiB,KAAA,GAAW,OAAO;EAEzE,OAAO,SAAS,KAAA,IACZ,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;GAAE,KAAK;GAAM,OAAO;EAAY,CAAC;CAClD;CAIA,MAAM,WAAW,OAAO,WAAW,WACjC,UACA,UACA,YACA;EACA,MAAM,eAAe,EAAE,GAAG,kBAAkB;EAC5C,MAAM,kBAAkB,EAAE,GAAG,qBAAqB;EAClD,MAAM,kBAAkB,EAAE,GAAG,qBAAqB;EAElD,MAAM,OAAO,OAAO,iBAEhB,GAAQ,UAAU,aAAa,OAAO,UAAU,EAAE,IAAI,gBAAgB,OAAO,aAAa,EAAE,IAAI,gBAAgB,OAAO,aAAa,EAAE;aACjI,aAAa,KAAK;mBACZ,gBAAgB,KAAK,MAAM,gBAAgB,OAAO,QAAQ,WAAW,SAAS,EAAE,KAAK,gBAAgB,MAAM,QAAQ,WAAW,WAAW,WAAW,SAAS,EAAE;cACpK,gBAAgB,OAAO,QAAQ,WAAW,KAAK,EAAE,KAAK,gBAAgB,MAAM,QAAQ,WAAW,OAAO,WAAW,KAAK,EAAE;cACxH,gBAAgB,OAAO,QAAQ,WAAW,SAAS,EAAE,KAAK,gBAAgB,MAAM,QAAQ,WAAW,WAAW,QAAQ,EAAE;mBACnH,gBAAgB,KAAK,MAAM,gBAAgB,OAAO,QAAQ,WAAW,QAAQ,EAAE,KAAK,gBAAgB,MAAM,QAAQ,WAAW,UAAU,QAAQ,EAAE;cACtJ,gBAAgB,OAAO,QAAQ,WAAW,SAAS,EAAE,KAAK,gBAAgB,MAAM,QAAQ,WAAW,WAAW,QAAQ,EAAE;cACxH,aAAa,OAAO,QAAQ,QAAQ,EAAE,EAAE,KAAK,aAAa,MAAM,QAAQ,QAAQ,IAAI,QAAQ,EAAE;OAExG,CAAC,CAAC,KAAK,OAAO,OAAO;EAErB,IAAI,KAAK,WAAW,GAAG,OAAO,KAAA;EAE9B,MAAM,CAAC,SAAS,eAAe,cAAc,OAAO,iBAEhD;GACE,EAAE,OAAO,KAAK,IAAK,UAAU;GAC7B,EAAE,OAAO,KAAK,IAAK,aAAa;GAChC,EAAE,OAAO,KAAK,IAAK,aAAa;EAClC,CACJ;EAEA,IACE,OAAO,iBAEH,CAAC,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,KAC/D,CAAC,QAAQ,WAAW,UAAU,aAAa,KAC3C,CAAC,QAAQ,UAAU,OAAO,UAAU,cAAc,QAAQ,WAAW,UAAU,KAC/E,CAAC,QAAQ,UAAU,OAAO,UAAU,QAAQ,QAAQ,QAAQ,GAAG,KAC/D,CAAC,QAAQ,UAAU,OAAO,UAAU,WAAW,QAAQ,WAAW,UAAU,CAChF,GAEA,OAAO,KAAA;EAMT,OAAO,OAJiB,iBACtB,QAAQ,WAAW,OAAO;GAAE;GAAU;GAAS,YAAY;GAAe;EAAW,CAAC,CACxF,CAAC,CAAC,KAAK,OAAO,SAAS,OAAO,QAAQ,0BAA0B,CAAC;CAGnE,CAAC;CAED,OAAO;EACL,iBAAiB,eACf,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ;IAAE,GAAG;IAAY,YAAY,EAAE,GAAG,WAAW,WAAW;GAAE;GAExE,OAAO;GAEP,MAAM,cAAc,OAAO,iBACnB,GAAQ,UAAU,EAAE,OAAO,IAAI,EAAE,QAAQ,EAAE,KAAK;kBAC9C,EAAE,OAAO,QAAQ,WAAW,SAAS,EAAE,KAAK,EAAE,MAAM,QAAQ,WAAW,WAAW,MAAM,WAAW,SAAS,EAAE;kBAC9G,EAAE,OAAO,QAAQ,WAAW,KAAK,EAAE,KAAK,EAAE,MAAM,QAAQ,WAAW,OAAO,MAAM,WAAW,KAAK,GAC1G,CAAC,CAAC,KAAK,OAAO,OAAO;GAErB,MAAM,aACJ,YAAY,WAAW,IACnB,OAAO,iBAAiB,EAAE,OAAO,YAAY,IAAK,IAAI,CAAC,IACvD,KAAA;GAEN,IACE,eAAe,KAAA,KACf,EAAE,OAAO,iBAAiB,QAAQ,WAAW,UAAU,UAAU,CAAC,IAElE,OAAO,OAAO,KAAK;GAErB,MAAM,aAAa,OAAO,SACxB,WAAW,QAAQ,WAAW,YAC9B,MAAM,UACN,MAAM,UACR;GAEA,OAAO,eAAe,KAAA,KACnB,MAAM,cAAc,KAAA,KAAa,WAAW,SAAS,cAAc,MAAM,YACxE,OAAO,KAAK,IACZ,OAAO,KAAK,UAAU;EAC5B,CAAC,CAAC,CAAC,KAAK,OAAO;EACjB,kBAAkB,UAChB,OAAO,IAAI,aAAa;GACtB,MAAM,eAAe,SAAS,KAC5B,OAAO,OAAO,aAAa,mBAAmB,CAAC,CAAC,SAAS,MAAM,MAAM,YAAY,CAAC,CACpF;GAEA,MAAM,aAAa,OAAO,2BAA2B,MAAM,UAAU;GAErE,OAAO;GACP,MAAM,WAAW,OAAO,QAAQ,UAAU,SAAS,WAAW,SAAS,SAAS;GAChF,MAAM,UAAU,OAAO,SAAS,QAAQ,kBAAkB,QAAQ,oBAAoB;GAEtF,IAAI,YAAY,WAAW,iBAAiB,OAAO,OAAO,YAAY;GACtE,OAAO,iBAAiB;IACtB,MAAM,UAAU,QAAQ,WAAW,eAAe,cAAc,OAAO;IAGvE,MAAM,SAAS;MACZ,QAAQ,WAAW,WAAW,QAAQ,QAAQ,WAAW;MACzD,QAAQ,WAAW,kBAAkB,QAAQ,QAAQ,WAAW;IACnE;IAEA,IAAI,OAAO,OAAO,MAAM,CAAC,CAAC,MAAM,UAAU,UAAU,KAAA,CAAS,GAAG,MAAM,YAAY;IAGlF,MAAM,QAAQ,IAAI,IAChB,OAAO,QAAQ;MACZ,QAAQ,WAAW,WAAW,WAAW;MACzC,QAAQ,WAAW,YAAY;MAC/B,QAAQ,WAAW,eAAe,WAAW;MAC7C,QAAQ,WAAW,qBAAqB,WAAW;MACnD,QAAQ,WAAW,kBAAkB,WAAW;MAChD,QAAQ,WAAW,WAAW,SAAS,MAAM,WAAW,QAAQ;MAChE,QAAQ,WAAW,gBAAgB,WAAW;IACjD,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW;KACvB,MAAM,SAAS,EAAE,OAAO,GAAG,GACzB,QAAQ,EAAE,MAAM,KAAK,KAAK;KAE5B,IAAI,OAAO,UAAU,UAAU,OAAO,GAAG,GAAG,OAAO,KAAK;KAExD,OAAO,IAAI,gBAAgB;MACzB,aAAa,GAAG,UAAU,OAAO,YAAY;MAC7C,UACE,GAAG,mBAAmB,OAAO,uCAAuC,MAAM;MAC5E,cAAc,GAAG,QAAQ,OAAO,mBAAmB,MAAM;KAC3D,CAAC;IACH,CAAC,CACH;IAEA,OAAO,GAAG,GAAG,EAAE,OAAO,MAAM,EAAE;kBACtB,EAAE,OAAO,QAAQ,WAAW,QAAQ,EAAE,KAAK,EAAE,MAAM,QAAQ,WAAW,UAAU,WAAW,QAAQ,EAAE;kBACrG,EAAE,OAAO,QAAQ,WAAW,SAAS,EAAE,KAAK,EAAE,MAAM,QAAQ,WAAW,WAAW,QAAQ,EAAE;kBAC5F,EAAE,OAAO,QAAQ,WAAW,YAAY,EAAE,KAAK,EAAE,MAAM,QAAQ,WAAW,cAAc,WAAW,YAAY,EAAE;kBACjH;GACV,CAAC,CAAC,CAAC,KAAK,OAAO,OAAO;EACxB,CAAC,CAAC,CAAC,KAAK,OAAO;CACnB;AACF,CAAC"}

package/dist/internal/password-kernel.d.mts

@@ -4,7 +4,7 @@ import { QueryFailure, QueryOperations, SqlColumn, SqlFragment } from "./query-o
 import { AnyPasswordPersistenceMapping } from "./models/password-model.mjs";
 import { CurrentProofSql, ProofSqlConfiguration, makeProofKernel } from "./proof-kernel.mjs";
 import { NativeSqlTables } from "./native-sql-table.mjs";
-import { samePasswordCredentialSnapshot } from "./password-attempts.mjs";
+import { samePasswordCredentialSnapshot } from "./password-credentials.mjs";
 import { Context, DateTime, Effect, Option, Redacted } from "effect";
 import { CurrentCommitJournal, HookConfigurationError, LifecycleHooks, PreparedCommit } from "@yielded/auth/Hooks";
 import { AuthenticationEvidence, AuthenticationRequirement, SecurityRevision } from "@yielded/auth/Sessions";
@@ -52,24 +52,15 @@ export interface PasswordSqlConfiguration {
 type Database = PasswordSqlDatabase;
 export declare const makePasswordKernel: <Fragment extends SqlFragment = SqlFragment, Column extends SqlColumn = SqlColumn>(operations: QueryOperations<Fragment, Column>, proofs: Pick<ReturnType<typeof makeProofKernel>, "completeProofPlanIn">, nativeTables?: (client: SqlClient, database: object) => NativeSqlTables) => {
   makeSqlPasswordPersistence: (mapping: AnyPasswordPersistenceMapping<Fragment>, configuration: PasswordSqlConfiguration) => Effect.Effect<{
-    readonly prepareAttempt: (input: {
+    readonly findCredential: (input: {
       readonly moduleId: string;
-      readonly action: "sign-in" | "change";
       readonly identifier: LoginIdentifier;
       readonly subjectId?: import("@yielded/auth/Schema").SubjectId;
-      readonly attemptLifetimeMillis: number;
-    }) => Effect.Effect<import("@yielded/auth/Password").PasswordAttemptPreparation, PasswordUnavailable>;
-    readonly settleAttempt: <A>(input: {
-      readonly moduleId: string;
-      readonly attemptId: import("@yielded/auth/Password").PasswordAttemptId;
-      readonly captured?: import("@yielded/auth/Password").PasswordCredentialSnapshot;
-      readonly outcome: import("@yielded/auth/Password").PasswordAttemptDecision;
-      readonly rehash?: {
-        readonly expectedVersion: SecurityRevision;
-        readonly expectedVerifier: Redacted.Redacted<import("@yielded/auth/Password").EncodedPasswordHash>;
-        readonly nextVerifier: Redacted.Redacted<import("@yielded/auth/Password").EncodedPasswordHash>;
-      };
-    }, prepare: import("@yielded/auth/Password").PreparePasswordCommit<import("@yielded/auth/Password").PasswordAttemptDecision, A>) => Effect.Effect<PreparedCommit<A>, PasswordUnavailable>;
+    }) => Effect.Effect<Option.Option<import("@yielded/auth/Password").PasswordCredentialSnapshot>, PasswordUnavailable>;
+    readonly rehashIfCurrent: (input: {
+      readonly credential: import("@yielded/auth/Password").PasswordCredentialSnapshot;
+      readonly nextVerifier: Redacted.Redacted<import("@yielded/auth/Password").EncodedPasswordHash>;
+    }) => Effect.Effect<void, PasswordUnavailable>;
     readonly readForSubject: (input: {
       readonly moduleId: string;
       readonly subjectId: import("@yielded/auth/Schema").SubjectId;
@@ -84,13 +75,6 @@ export declare const makePasswordKernel: <Fragment extends SqlFragment = SqlFrag
     readonly resetWithProof: <A>(input: PasswordMutationInput & {
       readonly completion: ProofCompletionPlan;
     }, prepare: import("@yielded/auth/Password").PreparePasswordCommit<PasswordMutationDecision, A>) => Effect.Effect<PreparedCommit<A>, PasswordUnavailable>;
-    readonly cleanupAttempts: <A>(input: {
-      readonly moduleId: string;
-      readonly limit: number;
-    }, prepare: import("@yielded/auth/Password").PreparePasswordCommit<{
-      readonly removed: number;
-      readonly hasMore: boolean;
-    }, A>) => Effect.Effect<PreparedCommit<A>, PasswordUnavailable>;
   }, PasswordUnavailable, CurrentPasswordSql | LifecycleHooks | NativeDatabase>;
   passwordSqlKernel: {
     allocate: <A>(mode: PasswordSqlConfiguration["mode"], asyncValue: Effect.Effect<A, PersistenceMappingError> | undefined, syncValue: (() => A) | undefined) => Effect.Effect<A, PasswordUnavailable | PersistenceMappingError>;
@@ -206,8 +190,8 @@ export declare const makePasswordKernel: <Fragment extends SqlFragment = SqlFrag
       nativeSubjectId: any;
       subject: any;
       identifier: any;
+      credential?: never;
       snapshot?: never;
-      readonly credential?: never;
     } | {
       nativeSubjectId: any;
       subject: any;

package/dist/internal/password-kernel.mjs

@@ -4,7 +4,7 @@ import { NativeDatabase } from "./transaction-kernel.mjs";
 import { CurrentPasswordPreparedTransaction, PasswordPreparedPostconditions } from "./PasswordPreparedPostconditions.mjs";
 import { CurrentProofSql } from "./proof-kernel.mjs";
 import { requiredPasswordConstraints } from "./models/password-model.mjs";
-import { makePasswordAttempts, samePasswordCredentialSnapshot } from "./password-attempts.mjs";
+import { makePasswordCredentials, samePasswordCredentialSnapshot } from "./password-credentials.mjs";
 import { Cause, Context, DateTime, Effect, Option, Redacted, Schema } from "effect";
 import { CurrentCommitJournal, HookConfigurationError, LifecycleHooks, coordinateCommit, hasCommitScope } from "@yielded/auth/Hooks";
 import { snapshotAuthenticationEvidence } from "@yielded/auth/Sessions";
@@ -14,7 +14,7 @@ import { PasswordPersistence, PasswordUnavailable, snapshotPasswordCredential, s
 //#region src/internal/password-kernel.ts
 var CurrentPasswordSql = class extends Context.Service()("effect-auth/CurrentPasswordSql") {};
 const makePasswordKernel = (operations, proofs, nativeTables = (client) => makeNativeSqlTables(client)) => {
-	const { and, eq, inArray, lte, column, updateValues } = operations;
+	const { and, eq, inArray, column, updateValues } = operations;
 	const { completeProofPlanIn } = proofs;
 	const unavailable = () => PasswordUnavailable.make({});
 	const translateFailure = (effect) => reportPersistenceFailure(effect, (error) => Schema.is(PasswordUnavailable)(error) || Schema.is(ProofUnavailable)(error) || Schema.is(HookConfigurationError)(error)).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));
@@ -47,23 +47,6 @@ const makePasswordKernel = (operations, proofs, nativeTables = (client) => makeN
 		credentialId: column(mapping.authorityCredential.table, mapping.authorityCredential.credentialId),
 		revision: column(mapping.authorityCredential.table, mapping.authorityCredential.revision)
 	});
-	const attemptColumns = (mapping) => ({
-		moduleId: column(mapping.attempt.table, mapping.attempt.moduleId),
-		action: column(mapping.attempt.table, mapping.attempt.action),
-		attemptId: column(mapping.attempt.table, mapping.attempt.attemptId),
-		identifierNamespace: column(mapping.attempt.table, mapping.attempt.identifierNamespace),
-		identifierValue: column(mapping.attempt.table, mapping.attempt.identifierValue),
-		subjectId: column(mapping.attempt.table, mapping.attempt.subjectId),
-		credentialId: column(mapping.attempt.table, mapping.attempt.credentialId),
-		securityRevision: column(mapping.attempt.table, mapping.attempt.securityRevision),
-		credentialRevision: column(mapping.attempt.table, mapping.attempt.credentialRevision),
-		verifierVersion: column(mapping.attempt.table, mapping.attempt.verifierVersion),
-		identifierBindingRevision: column(mapping.attempt.table, mapping.attempt.identifierBindingRevision),
-		admittedAt: column(mapping.attempt.table, mapping.attempt.admittedAt),
-		deadline: column(mapping.attempt.table, mapping.attempt.deadline),
-		retentionUntil: column(mapping.attempt.table, mapping.attempt.retentionUntil),
-		state: column(mapping.attempt.table, mapping.attempt.state)
-	});
 	const commandColumns = (mapping) => ({
 		moduleId: column(mapping.command.table, mapping.command.moduleId),
 		commandId: column(mapping.command.table, mapping.command.commandId),
@@ -346,9 +329,9 @@ const makePasswordKernel = (operations, proofs, nativeTables = (client) => makeN
 		const hooks = yield* LifecycleHooks;
 		if (!validConstraints(mapping)) return yield* unavailable();
 		const root = yield* NativeDatabase;
-		const attempts = yield* makePasswordAttempts(yield* sqlMapping(() => nativeTables(root.$client.withoutTransforms(), root)).pipe(translateFailure), mapping, configuration);
+		const credentials = yield* makePasswordCredentials(yield* sqlMapping(() => nativeTables(root.$client.withoutTransforms(), root)).pipe(translateFailure), mapping, configuration);
 		return PasswordPersistence.of({
-			...attempts,
+			...credentials,
 			readForSubject: (input) => safeRead(database, configuration, Effect.gen(function* () {
 				const transaction = yield* CurrentPasswordSql;
 				const locked = yield* lockSubject(mapping, input.subjectId, false);
@@ -442,27 +425,6 @@ const makePasswordKernel = (operations, proofs, nativeTables = (client) => makeN
 					});
 					return passwordReceipt ?? prepare("rejected", journal);
 				}));
-			})).pipe(Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
-			cleanupAttempts: (input, prepare) => owned(database, mapping, configuration, Effect.gen(function* () {
-				const transaction = yield* CurrentPasswordSql;
-				const journal = yield* CurrentCommitJournal;
-				const now = yield* nowMillis;
-				const nativeNow = mapping.encodeInstant(now);
-				const a = attemptColumns(mapping);
-				const attempts = yield* selectRows(transaction.select({ attemptId: a.attemptId }).from(mapping.attempt.table).where(and(eq(a.moduleId, input.moduleId), lte(a.retentionUntil, nativeNow))).limit(input.limit + 1), false);
-				const hasMore = attempts.length > input.limit;
-				const attemptCandidates = attempts.slice(0, input.limit);
-				const selectedAttempts = [];
-				for (const candidate of attemptCandidates) {
-					const locked = yield* selectRows(transaction.select({ attemptId: a.attemptId }).from(mapping.attempt.table).where(and(eq(a.moduleId, input.moduleId), eq(a.attemptId, candidate.attemptId), lte(a.retentionUntil, nativeNow))).limit(1), configuration.locking);
-					if (locked[0] !== void 0) selectedAttempts.push(locked[0]);
-				}
-				const prepared = prepare({
-					removed: selectedAttempts.length,
-					hasMore
-				}, journal);
-				if (selectedAttempts.length > 0) yield* transaction.delete(mapping.attempt.table).where(and(eq(a.moduleId, input.moduleId), inArray(a.attemptId, selectedAttempts.map((row) => row.attemptId)), lte(a.retentionUntil, nativeNow)));
-				return prepared;
 			})).pipe(Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure)
 		});
 	});

package/dist/internal/password-kernel.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"password-kernel.mjs","names":["sameCredentialSnapshot"],"sources":["../../src/internal/password-kernel.ts"],"sourcesContent":["import {\n  coordinateCommit,\n  CurrentCommitJournal,\n  hasCommitScope,\n  type CommitJournal,\n  type PreparedCommit,\n  LifecycleHooks,\n  HookConfigurationError,\n} from \"@yielded/auth/Hooks\";\nimport type { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport {\n  PasswordUnavailable,\n  PasswordPersistence,\n  type PasswordMutationInput,\n  snapshotPasswordCredential,\n  snapshotPasswordRequirement,\n  snapshotPasswordRevision,\n  type PasswordAction,\n  type PasswordMutationDecision,\n} from \"@yielded/auth/Password\";\nimport { reportPersistenceFailure } from \"@yielded/auth/Persistence\";\nimport {\n  type ProofCompletionPlan,\n  type ProofCompletionInput,\n  ProofUnavailable,\n} from \"@yielded/auth/Proofs\";\nimport {\n  snapshotAuthenticationEvidence,\n  type AuthenticationEvidence,\n  type AuthenticationRequirement,\n  type SecurityRevision,\n} from \"@yielded/auth/Sessions\";\nimport { Cause, Context, DateTime, Effect, Option, Redacted, Schema } from \"effect\";\nimport type { SqlClient } from \"effect/sql/SqlClient\";\nimport type * as SqlError from \"effect/sql/SqlError\";\n\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport {\n  type AnyPasswordPersistenceMapping,\n  requiredPasswordConstraints,\n} from \"./models/password-model\";\nimport { makeNativeSqlTables, sqlMapping, type NativeSqlTables } from \"./native-sql-table\";\nimport {\n  makePasswordAttempts,\n  samePasswordCredentialSnapshot as sameCredentialSnapshot,\n} from \"./password-attempts\";\nimport {\n  CurrentPasswordPreparedTransaction,\n  PasswordPreparedPostconditions,\n} from \"./PasswordPreparedPostconditions\";\nimport {\n  CurrentProofSql,\n  type ProofSqlConfiguration,\n  type ProofSqlDatabase,\n  type makeProofKernel,\n} from \"./proof-kernel\";\n/* oxlint-disable no-explicit-any -- existing storage kernels erase foreign table shapes; domain errors remain typed. */\nimport type { QueryFailure } from \"./query-operations\";\nimport type { QueryOperations, SqlFragment, SqlColumn } from \"./query-operations\";\nimport { NativeDatabase } from \"./transaction-kernel\";\n\ntype AdapterFailure = QueryFailure | PersistenceMappingError | SqlError.SqlError;\n\nexport interface PasswordSqlQuery<A = ReadonlyArray<any>> extends Effect.Effect<A, AdapterFailure> {\n  readonly getSQL: () => ReturnType<QueryOperations[\"sql\"]>;\n  readonly from: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly where: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly limit: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly orderBy: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly for: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly set: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly values: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly returning: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly $returningId: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly onConflictDoNothing: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly onDuplicateKeyUpdate: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n}\n\nexport interface PasswordSqlDatabase {\n  readonly select: (...args: ReadonlyArray<any>) => PasswordSqlQuery;\n  readonly insert: (...args: ReadonlyArray<any>) => PasswordSqlQuery;\n  readonly update: (...args: ReadonlyArray<any>) => PasswordSqlQuery;\n  readonly delete: (...args: ReadonlyArray<any>) => PasswordSqlQuery;\n  readonly transaction: <A, E, R>(\n    body: (transaction: PasswordSqlDatabase) => Effect.Effect<A, E, R>,\n  ) => Effect.Effect<A, E | SqlError.SqlError, R>;\n}\n\nexport class CurrentPasswordSql extends Context.Service<CurrentPasswordSql, PasswordSqlDatabase>()(\n  \"effect-auth/CurrentPasswordSql\",\n) {}\n\nexport interface PasswordSqlConfiguration {\n  readonly mode: \"interactive\" | \"synchronous\";\n  readonly locking: boolean;\n  readonly standaloneGuard: Effect.Effect<void, PasswordUnavailable>;\n  readonly coordinated?: boolean;\n  readonly insertIfAbsent: (\n    query: PasswordSqlQuery,\n    selfKey: string,\n    selfValue: unknown,\n  ) => PasswordSqlQuery;\n  readonly proof?: {\n    readonly mapping: any;\n    readonly configuration: ProofSqlConfiguration;\n  };\n}\n\ntype Database = PasswordSqlDatabase;\n\nexport const makePasswordKernel = <\n  Fragment extends SqlFragment = SqlFragment,\n  Column extends SqlColumn = SqlColumn,\n>(\n  operations: QueryOperations<Fragment, Column>,\n  proofs: Pick<ReturnType<typeof makeProofKernel>, \"completeProofPlanIn\">,\n  nativeTables: (client: SqlClient, database: object) => NativeSqlTables = (client) =>\n    makeNativeSqlTables(client),\n) => {\n  type Mapping = AnyPasswordPersistenceMapping<Fragment>;\n\n  const { and, eq, inArray, lte, column, updateValues } = operations;\n  const { completeProofPlanIn } = proofs;\n  const unavailable = () => PasswordUnavailable.make({});\n\n  const translateFailure = <A, E, R>(\n    effect: Effect.Effect<A, E, R>,\n  ): Effect.Effect<A, PasswordUnavailable, R> =>\n    reportPersistenceFailure(\n      effect,\n      (error) =>\n        Schema.is(PasswordUnavailable)(error) ||\n        Schema.is(ProofUnavailable)(error) ||\n        Schema.is(HookConfigurationError)(error),\n    ).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));\n\n  const nowMillis = DateTime.now.pipe(Effect.map(DateTime.toEpochMillis));\n\n  const validConstraints = (mapping: Mapping) =>\n    Object.entries(requiredPasswordConstraints).every(\n      ([key, value]) =>\n        mapping.constraints[key as keyof typeof requiredPasswordConstraints] === value,\n    );\n\n  const selectRows = (query: PasswordSqlQuery, locking: boolean) =>\n    locking && typeof query.for === \"function\" ? query.for(\"update\") : query;\n\n  const subjectColumns = (mapping: Mapping) => ({\n    id: column(mapping.subject.table, mapping.subject.id),\n    status: column(mapping.subject.table, mapping.subject.status),\n    securityRevision: column(mapping.subject.table, mapping.subject.securityRevision),\n  });\n\n  const identifierColumns = (mapping: Mapping) => ({\n    namespace: column(mapping.identifier.table, mapping.identifier.namespace),\n    value: column(mapping.identifier.table, mapping.identifier.value),\n    subjectId: column(mapping.identifier.table, mapping.identifier.subjectId),\n    verifiedAt: column(mapping.identifier.table, mapping.identifier.verifiedAt),\n    bindingRevision: column(mapping.identifier.table, mapping.identifier.bindingRevision),\n  });\n\n  const credentialColumns = (mapping: Mapping) => ({\n    moduleId: column(mapping.credential.table, mapping.credential.moduleId),\n    subjectId: column(mapping.credential.table, mapping.credential.subjectId),\n    credentialId: column(mapping.credential.table, mapping.credential.credentialId),\n    credentialRevision: column(mapping.credential.table, mapping.credential.credentialRevision),\n    verifierVersion: column(mapping.credential.table, mapping.credential.verifierVersion),\n    verifier: column(mapping.credential.table, mapping.credential.verifier),\n    normalization: column(mapping.credential.table, mapping.credential.normalization),\n  });\n\n  const authorityCredentialColumns = (mapping: Mapping) => ({\n    subjectId: column(mapping.authorityCredential.table, mapping.authorityCredential.subjectId),\n    credentialId: column(\n      mapping.authorityCredential.table,\n      mapping.authorityCredential.credentialId,\n    ),\n    revision: column(mapping.authorityCredential.table, mapping.authorityCredential.revision),\n  });\n\n  const attemptColumns = (mapping: Mapping) => ({\n    moduleId: column(mapping.attempt.table, mapping.attempt.moduleId),\n    action: column(mapping.attempt.table, mapping.attempt.action),\n    attemptId: column(mapping.attempt.table, mapping.attempt.attemptId),\n    identifierNamespace: column(mapping.attempt.table, mapping.attempt.identifierNamespace),\n    identifierValue: column(mapping.attempt.table, mapping.attempt.identifierValue),\n    subjectId: column(mapping.attempt.table, mapping.attempt.subjectId),\n    credentialId: column(mapping.attempt.table, mapping.attempt.credentialId),\n    securityRevision: column(mapping.attempt.table, mapping.attempt.securityRevision),\n    credentialRevision: column(mapping.attempt.table, mapping.attempt.credentialRevision),\n    verifierVersion: column(mapping.attempt.table, mapping.attempt.verifierVersion),\n    identifierBindingRevision: column(\n      mapping.attempt.table,\n      mapping.attempt.identifierBindingRevision,\n    ),\n    admittedAt: column(mapping.attempt.table, mapping.attempt.admittedAt),\n    deadline: column(mapping.attempt.table, mapping.attempt.deadline),\n    retentionUntil: column(mapping.attempt.table, mapping.attempt.retentionUntil),\n    state: column(mapping.attempt.table, mapping.attempt.state),\n  });\n\n  const commandColumns = (mapping: Mapping) => ({\n    moduleId: column(mapping.command.table, mapping.command.moduleId),\n    commandId: column(mapping.command.table, mapping.command.commandId),\n    action: column(mapping.command.table, mapping.command.action),\n    bindingDigest: column(mapping.command.table, mapping.command.bindingDigest),\n    decision: column(mapping.command.table, mapping.command.decision),\n    retentionUntil: column(mapping.command.table, mapping.command.retentionUntil),\n  });\n\n  const allocate = <A>(\n    mode: PasswordSqlConfiguration[\"mode\"],\n    asyncValue: Effect.Effect<A, PersistenceMappingError> | undefined,\n    syncValue: (() => A) | undefined,\n  ): Effect.Effect<A, PasswordUnavailable | PersistenceMappingError> => {\n    if (mode === \"synchronous\")\n      return syncValue === undefined\n        ? Effect.fail(unavailable())\n        : Effect.try({\n            try: syncValue,\n            catch: (cause) => new PersistenceMappingError({ operation: \"mapping\", cause }),\n          });\n    if (asyncValue !== undefined) return asyncValue;\n\n    return syncValue === undefined\n      ? Effect.fail(unavailable())\n      : Effect.try({\n          try: syncValue,\n          catch: (cause) => new PersistenceMappingError({ operation: \"mapping\", cause }),\n        });\n  };\n\n  const allocateNextSecurityRevision = (\n    mapping: Mapping,\n    mode: PasswordSqlConfiguration[\"mode\"],\n    current: SecurityRevision,\n  ) => {\n    const asyncValue = mapping.subject.nextSecurityRevision?.(current);\n\n    const syncValue =\n      mapping.subject.nextSecurityRevisionSync === undefined\n        ? undefined\n        : () => mapping.subject.nextSecurityRevisionSync!(current);\n\n    return allocate(\n      mode,\n      asyncValue ?? mapping.allocateRevision,\n      syncValue ?? mapping.allocateRevisionSync,\n    );\n  };\n\n  const sameIdentifier = (left: LoginIdentifier, right: LoginIdentifier) =>\n    left.namespace === right.namespace && left.value === right.value;\n\n  const evidenceSatisfiedAt = (\n    evidence: AuthenticationEvidence,\n    requirement: AuthenticationRequirement,\n    now: number,\n  ): boolean => {\n    if (evidence.proofs.length > 64 || evidence.revision.credentials.length > 64) return false;\n    const revisions = new Map<string, string>();\n\n    for (const item of evidence.revision.credentials) {\n      if (revisions.has(item.credentialId)) return false;\n      revisions.set(item.credentialId, item.revision);\n    }\n    if (evidence.proofs.some((proof) => !revisions.has(proof.credentialId))) return false;\n    if (evidence.proofs.some((proof) => now < DateTime.toEpochMillis(proof.verifiedAt)))\n      return false;\n\n    const eligible = evidence.proofs.filter((proof) => {\n      const age = now - DateTime.toEpochMillis(proof.verifiedAt);\n\n      return age >= 0 && age < requirement.maximumAgeMillis;\n    });\n\n    const factors = new Set(eligible.flatMap((proof) => proof.factors));\n    const credentials = new Set(eligible.map((proof) => proof.credentialId));\n\n    return requirement.alternatives.some(\n      (alternative) =>\n        alternative.factors.every((factor) => factors.has(factor)) &&\n        credentials.size >= alternative.minimumCredentials &&\n        eligible.some(\n          (proof) =>\n            (!alternative.userVerified || proof.userVerified) &&\n            (!alternative.phishingResistant || proof.phishingResistant),\n        ),\n    );\n  };\n\n  const snapshotMutationInput = Effect.fn(\"DrizzlePassword.snapshotMutationInput\")(function* (\n    input: PasswordMutationInput,\n  ) {\n    const expectedRevision = snapshotPasswordRevision(input.expectedRevision);\n\n    const evidence = yield* snapshotAuthenticationEvidence(input.authorization.evidence).pipe(\n      Effect.mapError(unavailable),\n    );\n\n    const requirement = yield* snapshotPasswordRequirement(input.authorization.requirement);\n\n    const credential =\n      input.credential === undefined\n        ? undefined\n        : yield* snapshotPasswordCredential(input.credential);\n\n    return Object.freeze({\n      ...input,\n      expectedRevision,\n      replacement: Object.freeze({\n        verifier: Redacted.make(Redacted.value(input.replacement.verifier)),\n        normalization: input.replacement.normalization,\n      }),\n      invalidation: Object.freeze({ ...input.invalidation }),\n      ...(credential === undefined ? {} : { credential }),\n      authorization: Object.freeze({\n        challenge: Object.freeze({\n          ...input.authorization.challenge,\n          revision: snapshotPasswordRevision(input.authorization.challenge.revision),\n        }),\n        evidence,\n        requirement,\n      }),\n    });\n  });\n\n  const lockSubject = Effect.fn(\"DrizzlePassword.lockSubject\")(function* (\n    mapping: Mapping,\n    subjectId: string,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    const nativeSubjectId = yield* mapping.subjectId.toNative(subjectId as any);\n    const c = subjectColumns(mapping);\n\n    const rows = yield* selectRows(\n      database.select().from(mapping.subject.table).where(eq(c.id, nativeSubjectId)).limit(1),\n      locking,\n    );\n\n    return { nativeSubjectId, row: rows[0] };\n  });\n\n  const lockIdentifier = Effect.fn(\"Drizzle.lockIdentifier\")(function* (\n    mapping: Mapping,\n    identifier: LoginIdentifier,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    const c = identifierColumns(mapping);\n\n    return yield* selectRows(\n      database\n        .select()\n        .from(mapping.identifier.table)\n        .where(and(eq(c.namespace, identifier.namespace), eq(c.value, identifier.value)))\n        .limit(1),\n      locking,\n    );\n  });\n\n  const readPasswordCredential = Effect.fn(\"Drizzle.readPasswordCredential\")(function* (\n    mapping: Mapping,\n    moduleId: string,\n    nativeSubjectId: unknown,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    const c = credentialColumns(mapping);\n\n    return yield* selectRows(\n      database\n        .select()\n        .from(mapping.credential.table)\n        .where(and(eq(c.moduleId, moduleId), eq(c.subjectId, nativeSubjectId)))\n        .limit(1),\n      locking,\n    );\n  });\n\n  const resolveCredential = Effect.fn(\"DrizzlePassword.resolveCredential\")(function* (\n    mapping: Mapping,\n    moduleId: string,\n    identifier: LoginIdentifier,\n    requestedSubjectId: string | undefined,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    // The unlocked lookup only discovers the prospective subject. The canonical\n    // protected order starts with the subject and then rechecks the identifier.\n    const discovered = (yield* lockIdentifier(mapping, identifier, false))[0];\n\n    if (discovered === undefined || !mapping.identifier.isCurrent(discovered)) return undefined;\n    const discoveredNative = discovered[mapping.identifier.subjectId];\n\n    const subjectRows = yield* selectRows(\n      database\n        .select()\n        .from(mapping.subject.table)\n        .where(eq(subjectColumns(mapping).id, discoveredNative))\n        .limit(1),\n      locking,\n    );\n\n    const subject = subjectRows[0];\n\n    if (subject === undefined || !mapping.subject.isActiveStatus(subject[mapping.subject.status]))\n      return undefined;\n    const identifiers = yield* lockIdentifier(mapping, identifier, locking);\n    const identifierRow = identifiers[0];\n\n    if (\n      identifierRow === undefined ||\n      !mapping.identifier.isCurrent(identifierRow) ||\n      !mapping.subjectId.equals(discoveredNative, identifierRow[mapping.identifier.subjectId])\n    )\n      return undefined;\n    const subjectId = yield* mapping.subjectId.toSubject(discoveredNative);\n\n    if (requestedSubjectId !== undefined && requestedSubjectId !== subjectId) return undefined;\n    const credentials = yield* readPasswordCredential(mapping, moduleId, discoveredNative, locking);\n    const credential = credentials[0];\n\n    if (credential === undefined)\n      return { nativeSubjectId: discoveredNative, subject, identifier: identifierRow };\n\n    const snapshot = yield* mapping.credential\n      .decode({ moduleId, subject, identifier: identifierRow, credential })\n      .pipe(Effect.flatMap(snapshotPasswordCredential));\n\n    return {\n      nativeSubjectId: discoveredNative,\n      subject,\n      identifier: identifierRow,\n      credential,\n      snapshot,\n    };\n  });\n\n  const owned = <A, E, R>(\n    database: Database,\n    mapping: Mapping,\n    configuration: PasswordSqlConfiguration,\n    body: Effect.Effect<A, E, R>,\n  ) => {\n    if (!validConstraints(mapping)) return Effect.fail(unavailable());\n\n    const run = coordinateCommit(\n      () =>\n        database.transaction((transaction) =>\n          body.pipe(\n            Effect.provideService(CurrentPasswordSql, transaction),\n            Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),\n          ),\n        ),\n      { mode: configuration.mode },\n    ).pipe(Effect.map((result) => result.value));\n\n    return configuration.coordinated !== true\n      ? Effect.gen(function* () {\n          if (yield* hasCommitScope) return yield* unavailable();\n          yield* configuration.standaloneGuard;\n\n          return yield* run;\n        })\n      : run;\n  };\n\n  // A coordinator that accepts postconditions re-runs this check against its\n  // current transaction after application work, before commit.\n  const registerFinal = Effect.fnUntraced(function* <E>(\n    check: Effect.Effect<boolean, E, CurrentPasswordSql>,\n  ) {\n    const postconditions = yield* Effect.serviceOption(PasswordPreparedPostconditions);\n\n    if (Option.isNone(postconditions)) return;\n\n    const postcondition = Effect.gen(function* () {\n      const transaction = yield* CurrentPasswordPreparedTransaction;\n\n      if (!(yield* check.pipe(Effect.provideService(CurrentPasswordSql, transaction))))\n        return yield* unavailable();\n    }).pipe(translateFailure);\n\n    if (!postconditions.value.register(postcondition)) return yield* unavailable();\n  });\n\n  const safeRead = <A, E, R>(\n    database: Database,\n    configuration: PasswordSqlConfiguration,\n    body: Effect.Effect<A, E, R>,\n  ) =>\n    Effect.gen(function* () {\n      if (configuration.coordinated !== true) {\n        if (yield* hasCommitScope) return yield* unavailable();\n        yield* configuration.standaloneGuard;\n      }\n\n      return yield* database.transaction((transaction) =>\n        body.pipe(\n          Effect.provideService(CurrentPasswordSql, transaction),\n          Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),\n        ),\n      );\n    });\n\n  const proofCompletionMatchesPassword = (\n    input: PasswordMutationInput & { readonly completion: ProofCompletionPlan },\n  ) => {\n    const completion = input.completion.input;\n    const binding = completion.binding;\n\n    if (\n      completion.moduleId !== `${input.moduleId}/reset` ||\n      completion.purpose !== \"password-reset\" ||\n      binding._tag !== \"Subject\" ||\n      input.credential === undefined ||\n      binding.revision.subjectId !== input.expectedRevision.subjectId ||\n      binding.revision.securityRevision !== input.expectedRevision.securityRevision ||\n      !sameIdentifier(binding.identifier, input.credential.identifier)\n    )\n      return false;\n\n    const expected = [...input.expectedRevision.credentials].sort((left, right) =>\n      left.credentialId.localeCompare(right.credentialId),\n    );\n\n    const actual = [...binding.revision.credentials].sort((left, right) =>\n      left.credentialId.localeCompare(right.credentialId),\n    );\n\n    return (\n      expected.length === actual.length &&\n      expected.every(\n        (item, index) =>\n          item.credentialId === actual[index]!.credentialId &&\n          item.revision === actual[index]!.revision,\n      )\n    );\n  };\n\n  const probeProofCompletion = Effect.fn(\"Drizzle.probeProofCompletion\")(function* (\n    configuration: PasswordSqlConfiguration,\n    input: ProofCompletionInput,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    if (configuration.proof === undefined) return yield* Effect.fail(unavailable());\n    const validProbe = { _tag: \"PasswordProofCompletionValid\" } as const;\n\n    const plan: ProofCompletionPlan = {\n      input,\n      prepare: (decision, journal, project) => journal.prepare(project(decision)),\n    };\n\n    const probe = coordinateCommit(\n      () =>\n        database.transaction((transaction) =>\n          completeProofPlanIn(\n            configuration.proof!.mapping,\n            configuration.proof!.configuration,\n            plan,\n            Effect.fail(validProbe),\n            () => false,\n          ).pipe(\n            Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),\n          ),\n        ),\n      { mode: configuration.mode },\n    );\n\n    if (configuration.coordinated === true || (yield* hasCommitScope)) return yield* unavailable();\n    yield* configuration.standaloneGuard;\n\n    return yield* probe.pipe(\n      Effect.as(false),\n      Effect.catchCause((cause) => {\n        const reason = cause.reasons[0];\n\n        return cause.reasons.length === 1 &&\n          reason !== undefined &&\n          Cause.isFailReason(reason) &&\n          reason.error === validProbe\n          ? Effect.succeed(true)\n          : Effect.failCause(cause);\n      }),\n    );\n  });\n\n  const validateMutationAuthority = Effect.fn(\"DrizzlePassword.validateMutationAuthority\")(\n    function* (\n      mapping: Mapping,\n      configuration: PasswordSqlConfiguration,\n      input: PasswordMutationInput,\n      action: PasswordAction,\n    ) {\n      const database = yield* CurrentPasswordSql;\n\n      const locked = yield* lockSubject(\n        mapping,\n        input.expectedRevision.subjectId,\n        configuration.locking,\n      );\n\n      const row = locked.row;\n\n      if (\n        row === undefined ||\n        !mapping.subject.isActiveStatus(row[mapping.subject.status]) ||\n        row[mapping.subject.securityRevision] !== input.expectedRevision.securityRevision\n      )\n        return undefined;\n      if (\n        input.authorization.challenge.moduleId !== input.moduleId ||\n        input.authorization.challenge.action !== action ||\n        input.authorization.challenge.commandId !== input.commandId ||\n        input.authorization.challenge.revision.subjectId !== input.expectedRevision.subjectId ||\n        input.authorization.challenge.revision.securityRevision !==\n          input.expectedRevision.securityRevision ||\n        (input.authorization.evidence.flowId as string) !== (input.commandId as string) ||\n        input.authorization.evidence.bindingDigest !==\n          input.authorization.challenge.bindingDigest ||\n        input.authorization.evidence.revision.subjectId !== input.expectedRevision.subjectId ||\n        input.authorization.evidence.revision.securityRevision !==\n          input.expectedRevision.securityRevision ||\n        (action === \"add-password\" &&\n          (input.credential !== undefined ||\n            input.authorization.challenge.targetCredentialId !== undefined))\n      )\n        return undefined;\n      if (\n        input.expectedRevision.credentials.some(\n          (expected) =>\n            !input.authorization.evidence.revision.credentials.some(\n              (actual) =>\n                actual.credentialId === expected.credentialId &&\n                actual.revision === expected.revision,\n            ),\n        )\n      )\n        return undefined;\n      if (input.credential !== undefined) {\n        const identifier = (yield* lockIdentifier(\n          mapping,\n          input.credential.identifier,\n          configuration.locking,\n        ))[0];\n\n        if (\n          identifier === undefined ||\n          !mapping.identifier.isCurrent(identifier) ||\n          !mapping.subjectId.equals(\n            identifier[mapping.identifier.subjectId],\n            locked.nativeSubjectId,\n          ) ||\n          identifier[mapping.identifier.bindingRevision] !==\n            input.credential.identifierBindingRevision\n        )\n          return undefined;\n      }\n\n      const allExpected = [\n        ...input.expectedRevision.credentials,\n        ...input.authorization.evidence.revision.credentials,\n      ];\n\n      const expected = new Map(allExpected.map((item) => [item.credentialId, item]));\n\n      const ac = authorityCredentialColumns(mapping);\n\n      const credentialRows =\n        expected.size === 0\n          ? []\n          : yield* selectRows(\n              database\n                .select()\n                .from(mapping.authorityCredential.table)\n                .where(\n                  and(\n                    eq(ac.subjectId, locked.nativeSubjectId),\n                    inArray(ac.credentialId, [...expected.keys()]),\n                  ),\n                )\n                .orderBy(ac.credentialId),\n              configuration.locking,\n            );\n\n      if (credentialRows.length !== expected.size) return undefined;\n      // Database collation need not match JavaScript locale ordering.\n      for (const actual of credentialRows) {\n        const wanted = expected.get(actual[mapping.authorityCredential.credentialId]);\n\n        if (\n          wanted === undefined ||\n          actual[mapping.authorityCredential.revision] !== wanted.revision ||\n          (mapping.authorityCredential.status !== undefined &&\n            mapping.authorityCredential.isActiveStatus?.(\n              actual[mapping.authorityCredential.status],\n            ) !== true)\n        )\n          return undefined;\n        expected.delete(wanted.credentialId);\n      }\n      if (expected.size !== 0) return undefined;\n      if (input.credential !== undefined) {\n        const identifier = (yield* lockIdentifier(mapping, input.credential.identifier, false))[0];\n\n        const credential = (yield* readPasswordCredential(\n          mapping,\n          input.moduleId,\n          locked.nativeSubjectId,\n          configuration.locking,\n        ))[0];\n\n        if (identifier === undefined || credential === undefined) return undefined;\n\n        const snapshot = yield* mapping.credential.decode({\n          moduleId: input.moduleId,\n          subject: row,\n          identifier,\n          credential,\n        });\n\n        if (!sameCredentialSnapshot(snapshot, input.credential)) return undefined;\n      }\n      const currentRequirement = yield* mapping.subject.decodeActionRequirement(row, action);\n      const now = yield* nowMillis;\n\n      if (\n        !evidenceSatisfiedAt(input.authorization.evidence, input.authorization.requirement, now) ||\n        !evidenceSatisfiedAt(input.authorization.evidence, currentRequirement, now)\n      )\n        return undefined;\n      if (\n        input.invalidation.existingSessions === \"immediate\" &&\n        mapping.sessionInvalidation !== \"same-authority-immediate\"\n      )\n        return undefined;\n\n      return { ...locked, now };\n    },\n  );\n\n  const commandExists = Effect.fn(\"Drizzle.commandExists\")(function* (\n    mapping: Mapping,\n    moduleId: string,\n    commandId: string,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    const c = commandColumns(mapping);\n\n    return yield* selectRows(\n      database\n        .select()\n        .from(mapping.command.table)\n        .where(and(eq(c.moduleId, moduleId), eq(c.commandId, commandId)))\n        .limit(1),\n      locking,\n    );\n  });\n\n  const insertCommand = Effect.fn(\"Drizzle.insertCommand\")(function* (\n    mapping: Mapping,\n    input: PasswordMutationInput,\n    action: PasswordAction,\n    now: number,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    return yield* database.insert(mapping.command.table).values(\n      mapping.command.encodeInsert({\n        moduleId: input.moduleId,\n        commandId: input.commandId,\n        action,\n        bindingDigest: input.authorization.challenge.bindingDigest,\n        decision: \"changed\",\n        retentionUntilMillis: now + mapping.commandRetentionMillis,\n      }),\n    );\n  });\n\n  const mutationPostconditions = Effect.fn(\"DrizzlePassword.mutationPostconditions\")(function* (\n    mapping: Mapping,\n    input: PasswordMutationInput,\n    nativeSubjectId: unknown,\n    subject: any,\n    authorityCredential: any,\n    now: number,\n  ) {\n    if (\n      subject === undefined ||\n      !mapping.subject.isActiveStatus(subject[mapping.subject.status]) ||\n      authorityCredential === undefined ||\n      (mapping.authorityCredential.status !== undefined &&\n        mapping.authorityCredential.isActiveStatus?.(\n          authorityCredential[mapping.authorityCredential.status],\n        ) !== true)\n    )\n      return false;\n    if (input.credential !== undefined) {\n      const identifier = (yield* lockIdentifier(mapping, input.credential.identifier, false))[0];\n\n      if (\n        identifier === undefined ||\n        !mapping.identifier.isCurrent(identifier) ||\n        !mapping.subjectId.equals(identifier[mapping.identifier.subjectId], nativeSubjectId) ||\n        identifier[mapping.identifier.bindingRevision] !==\n          input.credential.identifierBindingRevision\n      )\n        return false;\n\n      const credential = (yield* readPasswordCredential(\n        mapping,\n        input.moduleId,\n        nativeSubjectId,\n        false,\n      ))[0];\n\n      if (credential === undefined) return false;\n\n      const decoded = yield* mapping.credential.decode({\n        moduleId: input.moduleId,\n        subject,\n        identifier,\n        credential,\n      });\n\n      if (decoded.identifierVerifiedAtMillis !== input.credential.identifierVerifiedAtMillis)\n        return false;\n    }\n    const rows = yield* commandExists(mapping, input.moduleId, input.commandId, false);\n    const row = rows[0];\n\n    return (\n      rows.length === 1 &&\n      row[mapping.command.action] === input.authorization.challenge.action &&\n      row[mapping.command.bindingDigest] === input.authorization.challenge.bindingDigest &&\n      row[mapping.command.decision] === \"changed\" &&\n      (yield* mapping.decodeInstant(row[mapping.command.retentionUntil])) ===\n        now + mapping.commandRetentionMillis\n    );\n  });\n\n  const addPasswordIn = Effect.fn(\"DrizzlePassword.addPasswordIn\")(function* (\n    mapping: Mapping,\n    configuration: PasswordSqlConfiguration,\n    input: PasswordMutationInput,\n    revisions: {\n      readonly credentialId: string;\n      readonly credentialRevision: SecurityRevision;\n      readonly verifierVersion: SecurityRevision;\n      readonly nextSecurityRevision: SecurityRevision;\n    },\n    commandNow?: number,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    const { credentialId, credentialRevision, verifierVersion, nextSecurityRevision } = revisions;\n\n    const authority = yield* validateMutationAuthority(\n      mapping,\n      configuration,\n      input,\n      \"add-password\",\n    );\n\n    if (authority === undefined) return false;\n    if ((yield* commandExists(mapping, input.moduleId, input.commandId, true)).length) return false;\n    if (\n      (yield* readPasswordCredential(mapping, input.moduleId, authority.nativeSubjectId, true))\n        .length\n    )\n      return false;\n\n    yield* database.insert(mapping.credential.table).values(\n      mapping.credential.encodeInsert({\n        moduleId: input.moduleId,\n        subjectId: authority.nativeSubjectId,\n        credentialId,\n        credentialRevision,\n        verifierVersion,\n        replacement: input.replacement,\n      }),\n    );\n    yield* database.insert(mapping.authorityCredential.table).values(\n      mapping.authorityCredential.encodeInsert({\n        subjectId: authority.nativeSubjectId,\n        credentialId,\n        revision: credentialRevision,\n      }),\n    );\n    yield* database\n      .update(mapping.subject.table)\n      .set(updateValues([[mapping.subject.securityRevision, nextSecurityRevision]]))\n      .where(\n        and(\n          eq(subjectColumns(mapping).id, authority.nativeSubjectId),\n          eq(subjectColumns(mapping).securityRevision, input.expectedRevision.securityRevision),\n        ),\n      );\n    yield* insertCommand(mapping, input, \"add-password\", commandNow ?? authority.now);\n\n    const applied = checkMutationApplied(\n      mapping,\n      input,\n      authority.nativeSubjectId,\n      revisions,\n      commandNow ?? authority.now,\n    );\n\n    if (!(yield* applied)) return yield* unavailable();\n    yield* registerFinal(applied);\n\n    return true;\n  });\n\n  const makeSqlPasswordPersistence = Effect.fn(\"makeSqlPasswordPersistence\")(function* (\n    mapping: Mapping,\n    configuration: PasswordSqlConfiguration,\n  ): Effect.fn.Return<\n    PasswordPersistence[\"Service\"],\n    PasswordUnavailable,\n    LifecycleHooks | CurrentPasswordSql | NativeDatabase\n  > {\n    const database = yield* CurrentPasswordSql;\n\n    if (!configuration.coordinated)\n      yield* (\n        operations.validateStorage?.({\n          ...mapping,\n          proof: configuration.proof?.mapping,\n        }) ?? Effect.void\n      ).pipe(Effect.mapError(unavailable));\n    const hooks = yield* LifecycleHooks;\n\n    if (!validConstraints(mapping)) return yield* unavailable();\n    const root = yield* NativeDatabase;\n\n    const attempts = yield* makePasswordAttempts(\n      yield* sqlMapping(() => nativeTables(root.$client.withoutTransforms(), root)).pipe(\n        translateFailure,\n      ),\n      mapping,\n      configuration,\n    );\n\n    return PasswordPersistence.of({\n      ...attempts,\n      readForSubject: (input) =>\n        safeRead(\n          database,\n          configuration,\n          Effect.gen(function* () {\n            const transaction = yield* CurrentPasswordSql;\n\n            const locked = yield* lockSubject(mapping, input.subjectId, false);\n\n            if (\n              locked.row === undefined ||\n              !mapping.subject.isActiveStatus(locked.row[mapping.subject.status])\n            )\n              return Option.none();\n\n            const credential = (yield* readPasswordCredential(\n              mapping,\n              input.moduleId,\n              locked.nativeSubjectId,\n              false,\n            ))[0];\n\n            if (credential === undefined) return Option.none();\n            const ic = identifierColumns(mapping);\n\n            const identifiers = yield* transaction\n              .select()\n              .from(mapping.identifier.table)\n              .where(eq(ic.subjectId, locked.nativeSubjectId));\n\n            const identifier = identifiers.find((row: any) => mapping.identifier.isCurrent(row));\n\n            if (identifier === undefined) return Option.none();\n\n            const snapshot = yield* mapping.credential\n              .decode({\n                moduleId: input.moduleId,\n                subject: locked.row,\n                identifier,\n                credential,\n              })\n              .pipe(Effect.flatMap(snapshotPasswordCredential));\n\n            return Option.some(snapshot);\n          }),\n        ).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      recoveryTarget: (input) =>\n        safeRead(\n          database,\n          configuration,\n          Effect.gen(function* () {\n            const resolved = yield* resolveCredential(\n              mapping,\n              input.moduleId,\n              input.identifier,\n              undefined,\n              false,\n            );\n\n            return resolved?.snapshot === undefined ||\n              resolved.snapshot.identifierVerifiedAtMillis === undefined\n              ? Option.none()\n              : Option.some(resolved.snapshot);\n          }),\n        ).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      addIfAbsent: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const input = yield* snapshotMutationInput(uncaptured);\n\n          const credentialId = yield* allocate(\n            configuration.mode,\n            mapping.allocateCredentialId,\n            mapping.allocateCredentialIdSync,\n          );\n\n          const credentialRevision = yield* allocate(\n            configuration.mode,\n            mapping.allocateRevision,\n            mapping.allocateRevisionSync,\n          );\n\n          const verifierVersion = yield* allocate(\n            configuration.mode,\n            mapping.allocateRevision,\n            mapping.allocateRevisionSync,\n          );\n\n          const nextSecurityRevision = yield* allocateNextSecurityRevision(\n            mapping,\n            configuration.mode,\n            input.expectedRevision.securityRevision,\n          );\n\n          if (nextSecurityRevision === input.expectedRevision.securityRevision)\n            return yield* unavailable();\n\n          return yield* owned(\n            database,\n            mapping,\n            configuration,\n            Effect.gen(function* () {\n              const journal = yield* CurrentCommitJournal;\n\n              const changed = yield* addPasswordIn(mapping, configuration, input, {\n                credentialId,\n                credentialRevision,\n                verifierVersion,\n                nextSecurityRevision,\n              });\n\n              return prepare(changed ? \"changed\" : \"rejected\", journal);\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      replaceIfCurrent: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const input = yield* snapshotMutationInput(uncaptured);\n\n          const credentialRevision = yield* allocate(\n            configuration.mode,\n            mapping.allocateRevision,\n            mapping.allocateRevisionSync,\n          );\n\n          const verifierVersion = yield* allocate(\n            configuration.mode,\n            mapping.allocateRevision,\n            mapping.allocateRevisionSync,\n          );\n\n          const nextSecurityRevision = yield* allocateNextSecurityRevision(\n            mapping,\n            configuration.mode,\n            input.expectedRevision.securityRevision,\n          );\n\n          if (\n            nextSecurityRevision === input.expectedRevision.securityRevision ||\n            (input.credential !== undefined &&\n              credentialRevision === input.credential.credentialRevision)\n          )\n            return yield* unavailable();\n\n          return yield* owned(\n            database,\n            mapping,\n            configuration,\n            Effect.gen(function* () {\n              return yield* replaceIn(\n                mapping,\n                configuration,\n                input,\n                \"change-password\",\n                { credentialRevision, verifierVersion, nextSecurityRevision },\n                prepare,\n              );\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      checkReset: (input) =>\n        (configuration.proof === undefined\n          ? Effect.fail(unavailable())\n          : Effect.gen(function* () {\n              if (\n                input.moduleId.length <= \"/reset\".length ||\n                !input.moduleId.endsWith(\"/reset\") ||\n                input.purpose !== \"password-reset\" ||\n                input.binding._tag !== \"Subject\"\n              )\n                return false;\n              const binding = input.binding;\n              const passwordModuleId = input.moduleId.slice(0, -\"/reset\".length);\n\n              const current = yield* safeRead(\n                database,\n                configuration,\n                Effect.gen(function* () {\n                  const resolved = yield* resolveCredential(\n                    mapping,\n                    passwordModuleId,\n                    binding.identifier,\n                    binding.revision.subjectId,\n                    false,\n                  );\n\n                  return (\n                    resolved?.snapshot !== undefined &&\n                    resolved.snapshot.revision.securityRevision ===\n                      binding.revision.securityRevision &&\n                    binding.revision.credentials.every((item) =>\n                      resolved.snapshot!.revision.credentials.some(\n                        (actual) =>\n                          actual.credentialId === item.credentialId &&\n                          actual.revision === item.revision,\n                      ),\n                    )\n                  );\n                }),\n              );\n\n              return current ? yield* probeProofCompletion(configuration, input) : false;\n            })\n        ).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      resetWithProof: (uncaptured, prepare) =>\n        (configuration.proof === undefined\n          ? Effect.fail(unavailable())\n          : Effect.gen(function* () {\n              const input = Object.freeze({\n                ...(yield* snapshotMutationInput(uncaptured)),\n                completion: uncaptured.completion,\n              });\n\n              const credentialRevision = yield* allocate(\n                configuration.mode,\n                mapping.allocateRevision,\n                mapping.allocateRevisionSync,\n              );\n\n              const verifierVersion = yield* allocate(\n                configuration.mode,\n                mapping.allocateRevision,\n                mapping.allocateRevisionSync,\n              );\n\n              const nextSecurityRevision = yield* allocateNextSecurityRevision(\n                mapping,\n                configuration.mode,\n                input.expectedRevision.securityRevision,\n              );\n\n              if (\n                nextSecurityRevision === input.expectedRevision.securityRevision ||\n                (input.credential !== undefined &&\n                  credentialRevision === input.credential.credentialRevision)\n              )\n                return yield* unavailable();\n\n              return yield* owned(\n                database,\n                mapping,\n                configuration,\n                Effect.gen(function* () {\n                  const journal = yield* CurrentCommitJournal;\n\n                  if (!proofCompletionMatchesPassword(input)) return prepare(\"rejected\", journal);\n\n                  const authority = yield* validateMutationAuthority(\n                    mapping,\n                    configuration,\n                    input,\n                    \"reset-password\",\n                  );\n\n                  if (authority === undefined) return prepare(\"rejected\", journal);\n                  if ((yield* commandExists(mapping, input.moduleId, input.commandId, true)).length)\n                    return prepare(\"rejected\", journal);\n\n                  const current = yield* currentExpectedCredential(\n                    mapping,\n                    input,\n                    authority.nativeSubjectId,\n                  );\n\n                  if (!current) return prepare(\"rejected\", journal);\n                  let passwordReceipt: PreparedCommit<any> | undefined;\n\n                  yield* completeProofPlanIn(\n                    configuration.proof!.mapping,\n                    configuration.proof!.configuration,\n                    input.completion,\n                    Effect.gen(function* () {\n                      const revisions = {\n                        credentialRevision,\n                        verifierVersion,\n                        nextSecurityRevision,\n                      };\n\n                      const applied = yield* writeReplacement(\n                        mapping,\n                        input,\n                        authority.nativeSubjectId,\n                        revisions,\n                        authority.now,\n                      );\n\n                      if (applied)\n                        yield* registerReplacement(\n                          mapping,\n                          input,\n                          authority.nativeSubjectId,\n                          revisions,\n                          authority.now,\n                        );\n\n                      return applied;\n                    }),\n                    (decision) => {\n                      passwordReceipt = prepare(\n                        decision === \"completed\" ? \"changed\" : \"rejected\",\n                        journal,\n                      );\n\n                      return decision;\n                    },\n                  );\n\n                  return passwordReceipt ?? prepare(\"rejected\", journal);\n                }),\n              );\n            })\n        ).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      cleanupAttempts: (input, prepare) =>\n        owned(\n          database,\n          mapping,\n          configuration,\n          Effect.gen(function* () {\n            const transaction = yield* CurrentPasswordSql;\n            const journal = yield* CurrentCommitJournal;\n\n            const now = yield* nowMillis;\n            const nativeNow = mapping.encodeInstant(now);\n            const a = attemptColumns(mapping);\n\n            const attempts = yield* selectRows(\n              transaction\n                .select({ attemptId: a.attemptId })\n                .from(mapping.attempt.table)\n                .where(and(eq(a.moduleId, input.moduleId), lte(a.retentionUntil, nativeNow)))\n                .limit(input.limit + 1),\n              false,\n            );\n\n            const hasMore = attempts.length > input.limit;\n            const attemptCandidates = attempts.slice(0, input.limit);\n            const selectedAttempts: typeof attemptCandidates = [];\n\n            for (const candidate of attemptCandidates) {\n              const locked = yield* selectRows(\n                transaction\n                  .select({ attemptId: a.attemptId })\n                  .from(mapping.attempt.table)\n                  .where(\n                    and(\n                      eq(a.moduleId, input.moduleId),\n                      eq(a.attemptId, candidate.attemptId),\n                      lte(a.retentionUntil, nativeNow),\n                    ),\n                  )\n                  .limit(1),\n                configuration.locking,\n              );\n\n              if (locked[0] !== undefined) selectedAttempts.push(locked[0] as any);\n            }\n\n            const prepared = prepare(\n              {\n                removed: selectedAttempts.length,\n                hasMore,\n              },\n              journal,\n            );\n\n            if (selectedAttempts.length > 0)\n              yield* transaction.delete(mapping.attempt.table).where(\n                and(\n                  eq(a.moduleId, input.moduleId),\n                  inArray(\n                    a.attemptId,\n                    selectedAttempts.map((row: any) => row.attemptId),\n                  ),\n                  lte(a.retentionUntil, nativeNow),\n                ),\n              );\n\n            return prepared;\n          }),\n        ).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n    });\n  });\n\n  const currentExpectedCredential = Effect.fn(\"DrizzlePassword.currentExpectedCredential\")(\n    function* (mapping: Mapping, input: PasswordMutationInput, nativeSubjectId: unknown) {\n      if (input.credential === undefined) return false;\n\n      const row = (yield* readPasswordCredential(\n        mapping,\n        input.moduleId,\n        nativeSubjectId,\n        true,\n      ))[0];\n\n      if (row === undefined) return false;\n\n      return (\n        row[mapping.credential.credentialId] === input.credential.credentialId &&\n        row[mapping.credential.credentialRevision] === input.credential.credentialRevision &&\n        row[mapping.credential.verifierVersion] === input.credential.verifierVersion &&\n        row[mapping.credential.verifier] === Redacted.value(input.credential.verifier) &&\n        row[mapping.credential.normalization] === input.credential.normalization &&\n        input.authorization.challenge.targetCredentialId === input.credential.credentialId\n      );\n    },\n  );\n\n  const checkMutationApplied = Effect.fn(\"DrizzlePassword.checkMutationApplied\")(function* (\n    mapping: Mapping,\n    input: PasswordMutationInput,\n    nativeSubjectId: unknown,\n    revisions: {\n      readonly credentialId: string;\n      readonly credentialRevision: SecurityRevision;\n      readonly verifierVersion: SecurityRevision;\n      readonly nextSecurityRevision: SecurityRevision;\n    },\n    now: number,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    const c = credentialColumns(mapping),\n      s = subjectColumns(mapping);\n\n    const credential = (yield* database\n      .select()\n      .from(mapping.credential.table)\n      .where(\n        and(\n          eq(c.moduleId, input.moduleId),\n          eq(c.subjectId, nativeSubjectId),\n          eq(c.credentialId, revisions.credentialId),\n          eq(c.credentialRevision, revisions.credentialRevision),\n          eq(c.verifierVersion, revisions.verifierVersion),\n          eq(c.verifier, Redacted.value(input.replacement.verifier)),\n          eq(c.normalization, input.replacement.normalization),\n        ),\n      )\n      .limit(1))[0];\n\n    const subject = (yield* database\n      .select()\n      .from(mapping.subject.table)\n      .where(and(eq(s.id, nativeSubjectId), eq(s.securityRevision, revisions.nextSecurityRevision)))\n      .limit(1))[0];\n\n    const authorityCredential = (yield* database\n      .select()\n      .from(mapping.authorityCredential.table)\n      .where(\n        and(\n          eq(authorityCredentialColumns(mapping).subjectId, nativeSubjectId),\n          eq(authorityCredentialColumns(mapping).credentialId, revisions.credentialId),\n          eq(authorityCredentialColumns(mapping).revision, revisions.credentialRevision),\n        ),\n      )\n      .limit(1))[0];\n\n    // SQL equality follows column collation; compare the persisted values exactly.\n    return (\n      credential !== undefined &&\n      credential[mapping.credential.credentialId] === revisions.credentialId &&\n      credential[mapping.credential.credentialRevision] === revisions.credentialRevision &&\n      credential[mapping.credential.verifierVersion] === revisions.verifierVersion &&\n      credential[mapping.credential.verifier] === Redacted.value(input.replacement.verifier) &&\n      credential[mapping.credential.normalization] === input.replacement.normalization &&\n      (yield* mutationPostconditions(\n        mapping,\n        input,\n        nativeSubjectId,\n        subject,\n        authorityCredential,\n        now,\n      ))\n    );\n  });\n\n  const writeReplacement = Effect.fn(\"DrizzlePassword.writeReplacement\")(function* (\n    mapping: Mapping,\n    input: PasswordMutationInput,\n    nativeSubjectId: unknown,\n    revisions: {\n      readonly credentialRevision: SecurityRevision;\n      readonly verifierVersion: SecurityRevision;\n      readonly nextSecurityRevision: SecurityRevision;\n    },\n    now: number,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    const c = credentialColumns(mapping);\n    const s = subjectColumns(mapping);\n\n    yield* database\n      .update(mapping.credential.table)\n      .set(\n        mapping.credential.encodeReplacement({\n          replacement: input.replacement,\n          credentialRevision: revisions.credentialRevision,\n          verifierVersion: revisions.verifierVersion,\n        }),\n      )\n      .where(\n        and(\n          eq(c.moduleId, input.moduleId),\n          eq(c.subjectId, nativeSubjectId),\n          eq(c.credentialId, input.credential!.credentialId),\n          eq(c.credentialRevision, input.credential!.credentialRevision),\n          eq(c.verifierVersion, input.credential!.verifierVersion),\n          eq(c.verifier, Redacted.value(input.credential!.verifier)),\n          eq(c.normalization, input.credential!.normalization),\n        ),\n      );\n    yield* database\n      .update(mapping.subject.table)\n      .set(updateValues([[mapping.subject.securityRevision, revisions.nextSecurityRevision]]))\n      .where(\n        and(\n          eq(s.id, nativeSubjectId),\n          eq(s.securityRevision, input.expectedRevision.securityRevision),\n        ),\n      );\n    yield* database\n      .update(mapping.authorityCredential.table)\n      .set(mapping.authorityCredential.encodeRevision(revisions.credentialRevision))\n      .where(\n        and(\n          eq(authorityCredentialColumns(mapping).subjectId, nativeSubjectId),\n          eq(authorityCredentialColumns(mapping).credentialId, input.credential!.credentialId),\n          eq(authorityCredentialColumns(mapping).revision, input.credential!.credentialRevision),\n        ),\n      );\n    yield* insertCommand(mapping, input, input.authorization.challenge.action, now);\n\n    return yield* checkMutationApplied(\n      mapping,\n      input,\n      nativeSubjectId,\n      {\n        ...revisions,\n        credentialId: input.credential!.credentialId,\n      },\n      now,\n    );\n  });\n\n  const registerReplacement = (\n    mapping: Mapping,\n    input: PasswordMutationInput,\n    nativeSubjectId: unknown,\n    revisions: {\n      readonly credentialRevision: SecurityRevision;\n      readonly verifierVersion: SecurityRevision;\n      readonly nextSecurityRevision: SecurityRevision;\n    },\n    now: number,\n  ) =>\n    registerFinal(\n      checkMutationApplied(\n        mapping,\n        input,\n        nativeSubjectId,\n        { ...revisions, credentialId: input.credential!.credentialId },\n        now,\n      ),\n    );\n\n  const replaceIn = Effect.fn(\"Drizzle.replaceIn\")(function* <A>(\n    mapping: Mapping,\n    configuration: PasswordSqlConfiguration,\n    input: PasswordMutationInput,\n    action: PasswordAction,\n    revisions: {\n      readonly credentialRevision: SecurityRevision;\n      readonly verifierVersion: SecurityRevision;\n      readonly nextSecurityRevision: SecurityRevision;\n    },\n    prepare: (value: PasswordMutationDecision, journal: CommitJournal) => PreparedCommit<A>,\n  ) {\n    const journal = yield* CurrentCommitJournal;\n\n    const authority = yield* validateMutationAuthority(mapping, configuration, input, action);\n\n    if (authority === undefined) return prepare(\"rejected\", journal);\n    if ((yield* commandExists(mapping, input.moduleId, input.commandId, true)).length)\n      return prepare(\"rejected\", journal);\n    if (!(yield* currentExpectedCredential(mapping, input, authority.nativeSubjectId)))\n      return prepare(\"rejected\", journal);\n    const prepared = prepare(\"changed\", journal);\n\n    if (\n      !(yield* writeReplacement(\n        mapping,\n        input,\n        authority.nativeSubjectId,\n        revisions,\n        authority.now,\n      ))\n    )\n      return yield* unavailable();\n    yield* registerReplacement(mapping, input, authority.nativeSubjectId, revisions, authority.now);\n\n    return prepared;\n  });\n\n  /** Internal bound-owner primitives; deliberately not re-exported by driver modules. */\n  const passwordSqlKernel = {\n    allocate,\n    allocateNextSecurityRevision,\n    owned,\n    safeRead,\n    snapshotMutationInput,\n    lockSubject,\n    lockIdentifier,\n    readPasswordCredential,\n    resolveCredential,\n    validateMutationAuthority,\n    currentExpectedCredential,\n    commandExists,\n    addPasswordIn,\n    checkMutationApplied,\n    writeReplacement,\n    evidenceSatisfiedAt,\n    sameCredentialSnapshot,\n    subjectColumns,\n    identifierColumns,\n    credentialColumns,\n    authorityCredentialColumns,\n    proofCompletionMatchesPassword,\n  };\n\n  return { makeSqlPasswordPersistence, passwordSqlKernel };\n};\n"],"mappings":";;;;;;;;;;;;;;AAwFA,IAAa,qBAAb,cAAwC,QAAQ,QAAiD,CAAC,CAChG,gCACF,CAAC,CAAC,CAAC;AAoBH,MAAa,sBAIX,YACA,QACA,gBAA0E,WACxE,oBAAoB,MAAM,MACzB;CAGH,MAAM,EAAE,KAAK,IAAI,SAAS,KAAK,QAAQ,iBAAiB;CACxD,MAAM,EAAE,wBAAwB;CAChC,MAAM,oBAAoB,oBAAoB,KAAK,CAAC,CAAC;CAErD,MAAM,oBACJ,WAEA,yBACE,SACC,UACC,OAAO,GAAG,mBAAmB,CAAC,CAAC,KAAK,KACpC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,sBAAsB,CAAC,CAAC,KAAK,CAC3C,CAAC,CAAC,KAAK,OAAO,YAAY,UAAU,OAAO,UAAU,MAAM,IAAI,aAAa,YAAY,CAAC,CAAC,CAAC,CAAC;CAE9F,MAAM,YAAY,SAAS,IAAI,KAAK,OAAO,IAAI,SAAS,aAAa,CAAC;CAEtE,MAAM,oBAAoB,YACxB,OAAO,QAAQ,2BAA2B,CAAC,CAAC,OACzC,CAAC,KAAK,WACL,QAAQ,YAAY,SAAqD,KAC7E;CAEF,MAAM,cAAc,OAAyB,YAC3C,WAAW,OAAO,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,IAAI;CAErE,MAAM,kBAAkB,aAAsB;EAC5C,IAAI,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,EAAE;EACpD,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;EAC5D,kBAAkB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,gBAAgB;CAClF;CAEA,MAAM,qBAAqB,aAAsB;EAC/C,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;EACxE,OAAO,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,KAAK;EAChE,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;EACxE,YAAY,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,UAAU;EAC1E,iBAAiB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,eAAe;CACtF;CAEA,MAAM,qBAAqB,aAAsB;EAC/C,UAAU,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,QAAQ;EACtE,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;EACxE,cAAc,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,YAAY;EAC9E,oBAAoB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,kBAAkB;EAC1F,iBAAiB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,eAAe;EACpF,UAAU,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,QAAQ;EACtE,eAAe,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,aAAa;CAClF;CAEA,MAAM,8BAA8B,aAAsB;EACxD,WAAW,OAAO,QAAQ,oBAAoB,OAAO,QAAQ,oBAAoB,SAAS;EAC1F,cAAc,OACZ,QAAQ,oBAAoB,OAC5B,QAAQ,oBAAoB,YAC9B;EACA,UAAU,OAAO,QAAQ,oBAAoB,OAAO,QAAQ,oBAAoB,QAAQ;CAC1F;CAEA,MAAM,kBAAkB,aAAsB;EAC5C,UAAU,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,QAAQ;EAChE,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;EAC5D,WAAW,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,SAAS;EAClE,qBAAqB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,mBAAmB;EACtF,iBAAiB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,eAAe;EAC9E,WAAW,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,SAAS;EAClE,cAAc,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,YAAY;EACxE,kBAAkB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,gBAAgB;EAChF,oBAAoB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,kBAAkB;EACpF,iBAAiB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,eAAe;EAC9E,2BAA2B,OACzB,QAAQ,QAAQ,OAChB,QAAQ,QAAQ,yBAClB;EACA,YAAY,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,UAAU;EACpE,UAAU,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,QAAQ;EAChE,gBAAgB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,cAAc;EAC5E,OAAO,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,KAAK;CAC5D;CAEA,MAAM,kBAAkB,aAAsB;EAC5C,UAAU,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,QAAQ;EAChE,WAAW,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,SAAS;EAClE,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;EAC5D,eAAe,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,aAAa;EAC1E,UAAU,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,QAAQ;EAChE,gBAAgB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,cAAc;CAC9E;CAEA,MAAM,YACJ,MACA,YACA,cACoE;EACpE,IAAI,SAAS,eACX,OAAO,cAAc,KAAA,IACjB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;GACT,KAAK;GACL,QAAQ,UAAU,IAAI,wBAAwB;IAAE,WAAW;IAAW;GAAM,CAAC;EAC/E,CAAC;EACP,IAAI,eAAe,KAAA,GAAW,OAAO;EAErC,OAAO,cAAc,KAAA,IACjB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;GACT,KAAK;GACL,QAAQ,UAAU,IAAI,wBAAwB;IAAE,WAAW;IAAW;GAAM,CAAC;EAC/E,CAAC;CACP;CAEA,MAAM,gCACJ,SACA,MACA,YACG;EACH,MAAM,aAAa,QAAQ,QAAQ,uBAAuB,OAAO;EAEjE,MAAM,YACJ,QAAQ,QAAQ,6BAA6B,KAAA,IACzC,KAAA,UACM,QAAQ,QAAQ,yBAA0B,OAAO;EAE7D,OAAO,SACL,MACA,cAAc,QAAQ,kBACtB,aAAa,QAAQ,oBACvB;CACF;CAEA,MAAM,kBAAkB,MAAuB,UAC7C,KAAK,cAAc,MAAM,aAAa,KAAK,UAAU,MAAM;CAE7D,MAAM,uBACJ,UACA,aACA,QACY;EACZ,IAAI,SAAS,OAAO,SAAS,MAAM,SAAS,SAAS,YAAY,SAAS,IAAI,OAAO;EACrF,MAAM,4BAAY,IAAI,IAAoB;EAE1C,KAAK,MAAM,QAAQ,SAAS,SAAS,aAAa;GAChD,IAAI,UAAU,IAAI,KAAK,YAAY,GAAG,OAAO;GAC7C,UAAU,IAAI,KAAK,cAAc,KAAK,QAAQ;EAChD;EACA,IAAI,SAAS,OAAO,MAAM,UAAU,CAAC,UAAU,IAAI,MAAM,YAAY,CAAC,GAAG,OAAO;EAChF,IAAI,SAAS,OAAO,MAAM,UAAU,MAAM,SAAS,cAAc,MAAM,UAAU,CAAC,GAChF,OAAO;EAET,MAAM,WAAW,SAAS,OAAO,QAAQ,UAAU;GACjD,MAAM,MAAM,MAAM,SAAS,cAAc,MAAM,UAAU;GAEzD,OAAO,OAAO,KAAK,MAAM,YAAY;EACvC,CAAC;EAED,MAAM,UAAU,IAAI,IAAI,SAAS,SAAS,UAAU,MAAM,OAAO,CAAC;EAClE,MAAM,cAAc,IAAI,IAAI,SAAS,KAAK,UAAU,MAAM,YAAY,CAAC;EAEvE,OAAO,YAAY,aAAa,MAC7B,gBACC,YAAY,QAAQ,OAAO,WAAW,QAAQ,IAAI,MAAM,CAAC,KACzD,YAAY,QAAQ,YAAY,sBAChC,SAAS,MACN,WACE,CAAC,YAAY,gBAAgB,MAAM,kBACnC,CAAC,YAAY,qBAAqB,MAAM,kBAC7C,CACJ;CACF;CAEA,MAAM,wBAAwB,OAAO,GAAG,uCAAuC,CAAC,CAAC,WAC/E,OACA;EACA,MAAM,mBAAmB,yBAAyB,MAAM,gBAAgB;EAExE,MAAM,WAAW,OAAO,+BAA+B,MAAM,cAAc,QAAQ,CAAC,CAAC,KACnF,OAAO,SAAS,WAAW,CAC7B;EAEA,MAAM,cAAc,OAAO,4BAA4B,MAAM,cAAc,WAAW;EAEtF,MAAM,aACJ,MAAM,eAAe,KAAA,IACjB,KAAA,IACA,OAAO,2BAA2B,MAAM,UAAU;EAExD,OAAO,OAAO,OAAO;GACnB,GAAG;GACH;GACA,aAAa,OAAO,OAAO;IACzB,UAAU,SAAS,KAAK,SAAS,MAAM,MAAM,YAAY,QAAQ,CAAC;IAClE,eAAe,MAAM,YAAY;GACnC,CAAC;GACD,cAAc,OAAO,OAAO,EAAE,GAAG,MAAM,aAAa,CAAC;GACrD,GAAI,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW;GACjD,eAAe,OAAO,OAAO;IAC3B,WAAW,OAAO,OAAO;KACvB,GAAG,MAAM,cAAc;KACvB,UAAU,yBAAyB,MAAM,cAAc,UAAU,QAAQ;IAC3E,CAAC;IACD;IACA;GACF,CAAC;EACH,CAAC;CACH,CAAC;CAED,MAAM,cAAc,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAC3D,SACA,WACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,SAAgB;EAC1E,MAAM,IAAI,eAAe,OAAO;EAOhC,OAAO;GAAE;GAAiB,MAAK,OALX,WAClB,SAAS,OAAO,CAAC,CAAC,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAAC,MAAM,GAAG,EAAE,IAAI,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,GACtF,OACF,EAAA,CAEoC;EAAG;CACzC,CAAC;CAED,MAAM,iBAAiB,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,YACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EAEnC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,IAAI,GAAG,EAAE,WAAW,WAAW,SAAS,GAAG,GAAG,EAAE,OAAO,WAAW,KAAK,CAAC,CAAC,CAAC,CAChF,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,yBAAyB,OAAO,GAAG,gCAAgC,CAAC,CAAC,WACzE,SACA,UACA,iBACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EAEnC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,IAAI,GAAG,EAAE,UAAU,QAAQ,GAAG,GAAG,EAAE,WAAW,eAAe,CAAC,CAAC,CAAC,CACtE,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,oBAAoB,OAAO,GAAG,mCAAmC,CAAC,CAAC,WACvE,SACA,UACA,YACA,oBACA,SACA;EACA,MAAM,WAAW,OAAO;EAIxB,MAAM,cAAc,OAAO,eAAe,SAAS,YAAY,KAAK,EAAA,CAAG;EAEvE,IAAI,eAAe,KAAA,KAAa,CAAC,QAAQ,WAAW,UAAU,UAAU,GAAG,OAAO,KAAA;EAClF,MAAM,mBAAmB,WAAW,QAAQ,WAAW;EAWvD,MAAM,WAAU,OATW,WACzB,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,GAAG,eAAe,OAAO,CAAC,CAAC,IAAI,gBAAgB,CAAC,CAAC,CACvD,MAAM,CAAC,GACV,OACF,EAAA,CAE4B;EAE5B,IAAI,YAAY,KAAA,KAAa,CAAC,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,GAC1F,OAAO,KAAA;EAET,MAAM,iBAAgB,OADK,eAAe,SAAS,YAAY,OAAO,EAAA,CACpC;EAElC,IACE,kBAAkB,KAAA,KAClB,CAAC,QAAQ,WAAW,UAAU,aAAa,KAC3C,CAAC,QAAQ,UAAU,OAAO,kBAAkB,cAAc,QAAQ,WAAW,UAAU,GAEvF,OAAO,KAAA;EACT,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,gBAAgB;EAErE,IAAI,uBAAuB,KAAA,KAAa,uBAAuB,WAAW,OAAO,KAAA;EAEjF,MAAM,cAAa,OADQ,uBAAuB,SAAS,UAAU,kBAAkB,OAAO,EAAA,CAC/D;EAE/B,IAAI,eAAe,KAAA,GACjB,OAAO;GAAE,iBAAiB;GAAkB;GAAS,YAAY;EAAc;EAMjF,OAAO;GACL,iBAAiB;GACjB;GACA,YAAY;GACZ;GACA,UAAA,OATsB,QAAQ,WAC7B,OAAO;IAAE;IAAU;IAAS,YAAY;IAAe;GAAW,CAAC,CAAC,CACpE,KAAK,OAAO,QAAQ,0BAA0B,CAAC;EAQlD;CACF,CAAC;CAED,MAAM,SACJ,UACA,SACA,eACA,SACG;EACH,IAAI,CAAC,iBAAiB,OAAO,GAAG,OAAO,OAAO,KAAK,YAAY,CAAC;EAEhE,MAAM,MAAM,uBAER,SAAS,aAAa,gBACpB,KAAK,KACH,OAAO,eAAe,oBAAoB,WAAW,GACrD,OAAO,eAAe,iBAAiB,WAA0C,CACnF,CACF,GACF,EAAE,MAAM,cAAc,KAAK,CAC7B,CAAC,CAAC,KAAK,OAAO,KAAK,WAAW,OAAO,KAAK,CAAC;EAE3C,OAAO,cAAc,gBAAgB,OACjC,OAAO,IAAI,aAAa;GACtB,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;GACrD,OAAO,cAAc;GAErB,OAAO,OAAO;EAChB,CAAC,IACD;CACN;CAIA,MAAM,gBAAgB,OAAO,WAAW,WACtC,OACA;EACA,MAAM,iBAAiB,OAAO,OAAO,cAAc,8BAA8B;EAEjF,IAAI,OAAO,OAAO,cAAc,GAAG;EAEnC,MAAM,gBAAgB,OAAO,IAAI,aAAa;GAC5C,MAAM,cAAc,OAAO;GAE3B,IAAI,EAAE,OAAO,MAAM,KAAK,OAAO,eAAe,oBAAoB,WAAW,CAAC,IAC5E,OAAO,OAAO,YAAY;EAC9B,CAAC,CAAC,CAAC,KAAK,gBAAgB;EAExB,IAAI,CAAC,eAAe,MAAM,SAAS,aAAa,GAAG,OAAO,OAAO,YAAY;CAC/E,CAAC;CAED,MAAM,YACJ,UACA,eACA,SAEA,OAAO,IAAI,aAAa;EACtB,IAAI,cAAc,gBAAgB,MAAM;GACtC,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;GACrD,OAAO,cAAc;EACvB;EAEA,OAAO,OAAO,SAAS,aAAa,gBAClC,KAAK,KACH,OAAO,eAAe,oBAAoB,WAAW,GACrD,OAAO,eAAe,iBAAiB,WAA0C,CACnF,CACF;CACF,CAAC;CAEH,MAAM,kCACJ,UACG;EACH,MAAM,aAAa,MAAM,WAAW;EACpC,MAAM,UAAU,WAAW;EAE3B,IACE,WAAW,aAAa,GAAG,MAAM,SAAS,WAC1C,WAAW,YAAY,oBACvB,QAAQ,SAAS,aACjB,MAAM,eAAe,KAAA,KACrB,QAAQ,SAAS,cAAc,MAAM,iBAAiB,aACtD,QAAQ,SAAS,qBAAqB,MAAM,iBAAiB,oBAC7D,CAAC,eAAe,QAAQ,YAAY,MAAM,WAAW,UAAU,GAE/D,OAAO;EAET,MAAM,WAAW,CAAC,GAAG,MAAM,iBAAiB,WAAW,CAAC,CAAC,MAAM,MAAM,UACnE,KAAK,aAAa,cAAc,MAAM,YAAY,CACpD;EAEA,MAAM,SAAS,CAAC,GAAG,QAAQ,SAAS,WAAW,CAAC,CAAC,MAAM,MAAM,UAC3D,KAAK,aAAa,cAAc,MAAM,YAAY,CACpD;EAEA,OACE,SAAS,WAAW,OAAO,UAC3B,SAAS,OACN,MAAM,UACL,KAAK,iBAAiB,OAAO,MAAM,CAAE,gBACrC,KAAK,aAAa,OAAO,MAAM,CAAE,QACrC;CAEJ;CAEA,MAAM,uBAAuB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACrE,eACA,OACA;EACA,MAAM,WAAW,OAAO;EAExB,IAAI,cAAc,UAAU,KAAA,GAAW,OAAO,OAAO,OAAO,KAAK,YAAY,CAAC;EAC9E,MAAM,aAAa,EAAE,MAAM,+BAA+B;EAE1D,MAAM,OAA4B;GAChC;GACA,UAAU,UAAU,SAAS,YAAY,QAAQ,QAAQ,QAAQ,QAAQ,CAAC;EAC5E;EAEA,MAAM,QAAQ,uBAEV,SAAS,aAAa,gBACpB,oBACE,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MACA,OAAO,KAAK,UAAU,SAChB,KACR,CAAC,CAAC,KACA,OAAO,eAAe,iBAAiB,WAA0C,CACnF,CACF,GACF,EAAE,MAAM,cAAc,KAAK,CAC7B;EAEA,IAAI,cAAc,gBAAgB,SAAS,OAAO,iBAAiB,OAAO,OAAO,YAAY;EAC7F,OAAO,cAAc;EAErB,OAAO,OAAO,MAAM,KAClB,OAAO,GAAG,KAAK,GACf,OAAO,YAAY,UAAU;GAC3B,MAAM,SAAS,MAAM,QAAQ;GAE7B,OAAO,MAAM,QAAQ,WAAW,KAC9B,WAAW,KAAA,KACX,MAAM,aAAa,MAAM,KACzB,OAAO,UAAU,aACf,OAAO,QAAQ,IAAI,IACnB,OAAO,UAAU,KAAK;EAC5B,CAAC,CACH;CACF,CAAC;CAED,MAAM,4BAA4B,OAAO,GAAG,2CAA2C,CAAC,CACtF,WACE,SACA,eACA,OACA,QACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,SAAS,OAAO,YACpB,SACA,MAAM,iBAAiB,WACvB,cAAc,OAChB;EAEA,MAAM,MAAM,OAAO;EAEnB,IACE,QAAQ,KAAA,KACR,CAAC,QAAQ,QAAQ,eAAe,IAAI,QAAQ,QAAQ,OAAO,KAC3D,IAAI,QAAQ,QAAQ,sBAAsB,MAAM,iBAAiB,kBAEjE,OAAO,KAAA;EACT,IACE,MAAM,cAAc,UAAU,aAAa,MAAM,YACjD,MAAM,cAAc,UAAU,WAAW,UACzC,MAAM,cAAc,UAAU,cAAc,MAAM,aAClD,MAAM,cAAc,UAAU,SAAS,cAAc,MAAM,iBAAiB,aAC5E,MAAM,cAAc,UAAU,SAAS,qBACrC,MAAM,iBAAiB,oBACxB,MAAM,cAAc,SAAS,WAAuB,MAAM,aAC3D,MAAM,cAAc,SAAS,kBAC3B,MAAM,cAAc,UAAU,iBAChC,MAAM,cAAc,SAAS,SAAS,cAAc,MAAM,iBAAiB,aAC3E,MAAM,cAAc,SAAS,SAAS,qBACpC,MAAM,iBAAiB,oBACxB,WAAW,mBACT,MAAM,eAAe,KAAA,KACpB,MAAM,cAAc,UAAU,uBAAuB,KAAA,IAEzD,OAAO,KAAA;EACT,IACE,MAAM,iBAAiB,YAAY,MAChC,aACC,CAAC,MAAM,cAAc,SAAS,SAAS,YAAY,MAChD,WACC,OAAO,iBAAiB,SAAS,gBACjC,OAAO,aAAa,SAAS,QACjC,CACJ,GAEA,OAAO,KAAA;EACT,IAAI,MAAM,eAAe,KAAA,GAAW;GAClC,MAAM,cAAc,OAAO,eACzB,SACA,MAAM,WAAW,YACjB,cAAc,OAChB,EAAA,CAAG;GAEH,IACE,eAAe,KAAA,KACf,CAAC,QAAQ,WAAW,UAAU,UAAU,KACxC,CAAC,QAAQ,UAAU,OACjB,WAAW,QAAQ,WAAW,YAC9B,OAAO,eACT,KACA,WAAW,QAAQ,WAAW,qBAC5B,MAAM,WAAW,2BAEnB,OAAO,KAAA;EACX;EAEA,MAAM,cAAc,CAClB,GAAG,MAAM,iBAAiB,aAC1B,GAAG,MAAM,cAAc,SAAS,SAAS,WAC3C;EAEA,MAAM,WAAW,IAAI,IAAI,YAAY,KAAK,SAAS,CAAC,KAAK,cAAc,IAAI,CAAC,CAAC;EAE7E,MAAM,KAAK,2BAA2B,OAAO;EAE7C,MAAM,iBACJ,SAAS,SAAS,IACd,CAAC,IACD,OAAO,WACL,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,oBAAoB,KAAK,CAAC,CACvC,MACC,IACE,GAAG,GAAG,WAAW,OAAO,eAAe,GACvC,QAAQ,GAAG,cAAc,CAAC,GAAG,SAAS,KAAK,CAAC,CAAC,CAC/C,CACF,CAAC,CACA,QAAQ,GAAG,YAAY,GAC1B,cAAc,OAChB;EAEN,IAAI,eAAe,WAAW,SAAS,MAAM,OAAO,KAAA;EAEpD,KAAK,MAAM,UAAU,gBAAgB;GACnC,MAAM,SAAS,SAAS,IAAI,OAAO,QAAQ,oBAAoB,aAAa;GAE5E,IACE,WAAW,KAAA,KACX,OAAO,QAAQ,oBAAoB,cAAc,OAAO,YACvD,QAAQ,oBAAoB,WAAW,KAAA,KACtC,QAAQ,oBAAoB,iBAC1B,OAAO,QAAQ,oBAAoB,OACrC,MAAM,MAER,OAAO,KAAA;GACT,SAAS,OAAO,OAAO,YAAY;EACrC;EACA,IAAI,SAAS,SAAS,GAAG,OAAO,KAAA;EAChC,IAAI,MAAM,eAAe,KAAA,GAAW;GAClC,MAAM,cAAc,OAAO,eAAe,SAAS,MAAM,WAAW,YAAY,KAAK,EAAA,CAAG;GAExF,MAAM,cAAc,OAAO,uBACzB,SACA,MAAM,UACN,OAAO,iBACP,cAAc,OAChB,EAAA,CAAG;GAEH,IAAI,eAAe,KAAA,KAAa,eAAe,KAAA,GAAW,OAAO,KAAA;GAEjE,MAAM,WAAW,OAAO,QAAQ,WAAW,OAAO;IAChD,UAAU,MAAM;IAChB,SAAS;IACT;IACA;GACF,CAAC;GAED,IAAI,CAACA,+BAAuB,UAAU,MAAM,UAAU,GAAG,OAAO,KAAA;EAClE;EACA,MAAM,qBAAqB,OAAO,QAAQ,QAAQ,wBAAwB,KAAK,MAAM;EACrF,MAAM,MAAM,OAAO;EAEnB,IACE,CAAC,oBAAoB,MAAM,cAAc,UAAU,MAAM,cAAc,aAAa,GAAG,KACvF,CAAC,oBAAoB,MAAM,cAAc,UAAU,oBAAoB,GAAG,GAE1E,OAAO,KAAA;EACT,IACE,MAAM,aAAa,qBAAqB,eACxC,QAAQ,wBAAwB,4BAEhC,OAAO,KAAA;EAET,OAAO;GAAE,GAAG;GAAQ;EAAI;CAC1B,CACF;CAEA,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,UACA,WACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,eAAe,OAAO;EAEhC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,IAAI,GAAG,EAAE,UAAU,QAAQ,GAAG,GAAG,EAAE,WAAW,SAAS,CAAC,CAAC,CAAC,CAChE,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,OACA,QACA,KACA;EAGA,OAAO,QAAO,OAFU,mBAAA,CAED,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,OACnD,QAAQ,QAAQ,aAAa;GAC3B,UAAU,MAAM;GAChB,WAAW,MAAM;GACjB;GACA,eAAe,MAAM,cAAc,UAAU;GAC7C,UAAU;GACV,sBAAsB,MAAM,QAAQ;EACtC,CAAC,CACH;CACF,CAAC;CAED,MAAM,yBAAyB,OAAO,GAAG,wCAAwC,CAAC,CAAC,WACjF,SACA,OACA,iBACA,SACA,qBACA,KACA;EACA,IACE,YAAY,KAAA,KACZ,CAAC,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,KAC/D,wBAAwB,KAAA,KACvB,QAAQ,oBAAoB,WAAW,KAAA,KACtC,QAAQ,oBAAoB,iBAC1B,oBAAoB,QAAQ,oBAAoB,OAClD,MAAM,MAER,OAAO;EACT,IAAI,MAAM,eAAe,KAAA,GAAW;GAClC,MAAM,cAAc,OAAO,eAAe,SAAS,MAAM,WAAW,YAAY,KAAK,EAAA,CAAG;GAExF,IACE,eAAe,KAAA,KACf,CAAC,QAAQ,WAAW,UAAU,UAAU,KACxC,CAAC,QAAQ,UAAU,OAAO,WAAW,QAAQ,WAAW,YAAY,eAAe,KACnF,WAAW,QAAQ,WAAW,qBAC5B,MAAM,WAAW,2BAEnB,OAAO;GAET,MAAM,cAAc,OAAO,uBACzB,SACA,MAAM,UACN,iBACA,KACF,EAAA,CAAG;GAEH,IAAI,eAAe,KAAA,GAAW,OAAO;GASrC,KAAI,OAPmB,QAAQ,WAAW,OAAO;IAC/C,UAAU,MAAM;IAChB;IACA;IACA;GACF,CAAC,EAAA,CAEW,+BAA+B,MAAM,WAAW,4BAC1D,OAAO;EACX;EACA,MAAM,OAAO,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,WAAW,KAAK;EACjF,MAAM,MAAM,KAAK;EAEjB,OACE,KAAK,WAAW,KAChB,IAAI,QAAQ,QAAQ,YAAY,MAAM,cAAc,UAAU,UAC9D,IAAI,QAAQ,QAAQ,mBAAmB,MAAM,cAAc,UAAU,iBACrE,IAAI,QAAQ,QAAQ,cAAc,cACjC,OAAO,QAAQ,cAAc,IAAI,QAAQ,QAAQ,eAAe,OAC/D,MAAM,QAAQ;CAEpB,CAAC;CAED,MAAM,gBAAgB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAC/D,SACA,eACA,OACA,WAMA,YACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,EAAE,cAAc,oBAAoB,iBAAiB,yBAAyB;EAEpF,MAAM,YAAY,OAAO,0BACvB,SACA,eACA,OACA,cACF;EAEA,IAAI,cAAc,KAAA,GAAW,OAAO;EACpC,KAAK,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,WAAW,IAAI,EAAA,CAAG,QAAQ,OAAO;EAC1F,KACG,OAAO,uBAAuB,SAAS,MAAM,UAAU,UAAU,iBAAiB,IAAI,EAAA,CACpF,QAEH,OAAO;EAET,OAAO,SAAS,OAAO,QAAQ,WAAW,KAAK,CAAC,CAAC,OAC/C,QAAQ,WAAW,aAAa;GAC9B,UAAU,MAAM;GAChB,WAAW,UAAU;GACrB;GACA;GACA;GACA,aAAa,MAAM;EACrB,CAAC,CACH;EACA,OAAO,SAAS,OAAO,QAAQ,oBAAoB,KAAK,CAAC,CAAC,OACxD,QAAQ,oBAAoB,aAAa;GACvC,WAAW,UAAU;GACrB;GACA,UAAU;EACZ,CAAC,CACH;EACA,OAAO,SACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,IAAI,aAAa,CAAC,CAAC,QAAQ,QAAQ,kBAAkB,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAC7E,MACC,IACE,GAAG,eAAe,OAAO,CAAC,CAAC,IAAI,UAAU,eAAe,GACxD,GAAG,eAAe,OAAO,CAAC,CAAC,kBAAkB,MAAM,iBAAiB,gBAAgB,CACtF,CACF;EACF,OAAO,cAAc,SAAS,OAAO,gBAAgB,cAAc,UAAU,GAAG;EAEhF,MAAM,UAAU,qBACd,SACA,OACA,UAAU,iBACV,WACA,cAAc,UAAU,GAC1B;EAEA,IAAI,EAAE,OAAO,UAAU,OAAO,OAAO,YAAY;EACjD,OAAO,cAAc,OAAO;EAE5B,OAAO;CACT,CAAC;CAED,MAAM,6BAA6B,OAAO,GAAG,4BAA4B,CAAC,CAAC,WACzE,SACA,eAKA;EACA,MAAM,WAAW,OAAO;EAExB,IAAI,CAAC,cAAc,aACjB,QACE,WAAW,kBAAkB;GAC3B,GAAG;GACH,OAAO,cAAc,OAAO;EAC9B,CAAC,KAAK,OAAO,KAAA,CACb,KAAK,OAAO,SAAS,WAAW,CAAC;EACrC,MAAM,QAAQ,OAAO;EAErB,IAAI,CAAC,iBAAiB,OAAO,GAAG,OAAO,OAAO,YAAY;EAC1D,MAAM,OAAO,OAAO;EAEpB,MAAM,WAAW,OAAO,qBACtB,OAAO,iBAAiB,aAAa,KAAK,QAAQ,kBAAkB,GAAG,IAAI,CAAC,CAAC,CAAC,KAC5E,gBACF,GACA,SACA,aACF;EAEA,OAAO,oBAAoB,GAAG;GAC5B,GAAG;GACH,iBAAiB,UACf,SACE,UACA,eACA,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAE3B,MAAM,SAAS,OAAO,YAAY,SAAS,MAAM,WAAW,KAAK;IAEjE,IACE,OAAO,QAAQ,KAAA,KACf,CAAC,QAAQ,QAAQ,eAAe,OAAO,IAAI,QAAQ,QAAQ,OAAO,GAElE,OAAO,OAAO,KAAK;IAErB,MAAM,cAAc,OAAO,uBACzB,SACA,MAAM,UACN,OAAO,iBACP,KACF,EAAA,CAAG;IAEH,IAAI,eAAe,KAAA,GAAW,OAAO,OAAO,KAAK;IACjD,MAAM,KAAK,kBAAkB,OAAO;IAOpC,MAAM,cAAa,OALQ,YACxB,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,GAAG,GAAG,WAAW,OAAO,eAAe,CAAC,EAAA,CAElB,MAAM,QAAa,QAAQ,WAAW,UAAU,GAAG,CAAC;IAEnF,IAAI,eAAe,KAAA,GAAW,OAAO,OAAO,KAAK;IAEjD,MAAM,WAAW,OAAO,QAAQ,WAC7B,OAAO;KACN,UAAU,MAAM;KAChB,SAAS,OAAO;KAChB;KACA;IACF,CAAC,CAAC,CACD,KAAK,OAAO,QAAQ,0BAA0B,CAAC;IAElD,OAAO,OAAO,KAAK,QAAQ;GAC7B,CAAC,CACH,CAAC,CAAC,KACA,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,iBAAiB,UACf,SACE,UACA,eACA,OAAO,IAAI,aAAa;IACtB,MAAM,WAAW,OAAO,kBACtB,SACA,MAAM,UACN,MAAM,YACN,KAAA,GACA,KACF;IAEA,OAAO,UAAU,aAAa,KAAA,KAC5B,SAAS,SAAS,+BAA+B,KAAA,IAC/C,OAAO,KAAK,IACZ,OAAO,KAAK,SAAS,QAAQ;GACnC,CAAC,CACH,CAAC,CAAC,KACA,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,cAAc,YAAY,YACxB,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,OAAO,sBAAsB,UAAU;IAErD,MAAM,eAAe,OAAO,SAC1B,cAAc,MACd,QAAQ,sBACR,QAAQ,wBACV;IAEA,MAAM,qBAAqB,OAAO,SAChC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,kBAAkB,OAAO,SAC7B,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,uBAAuB,OAAO,6BAClC,SACA,cAAc,MACd,MAAM,iBAAiB,gBACzB;IAEA,IAAI,yBAAyB,MAAM,iBAAiB,kBAClD,OAAO,OAAO,YAAY;IAE5B,OAAO,OAAO,MACZ,UACA,SACA,eACA,OAAO,IAAI,aAAa;KACtB,MAAM,UAAU,OAAO;KASvB,OAAO,SAAQ,OAPQ,cAAc,SAAS,eAAe,OAAO;MAClE;MACA;MACA;MACA;KACF,CAAC,KAEwB,YAAY,YAAY,OAAO;IAC1D,CAAC,CACH;GACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,mBAAmB,YAAY,YAC7B,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,OAAO,sBAAsB,UAAU;IAErD,MAAM,qBAAqB,OAAO,SAChC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,kBAAkB,OAAO,SAC7B,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,uBAAuB,OAAO,6BAClC,SACA,cAAc,MACd,MAAM,iBAAiB,gBACzB;IAEA,IACE,yBAAyB,MAAM,iBAAiB,oBAC/C,MAAM,eAAe,KAAA,KACpB,uBAAuB,MAAM,WAAW,oBAE1C,OAAO,OAAO,YAAY;IAE5B,OAAO,OAAO,MACZ,UACA,SACA,eACA,OAAO,IAAI,aAAa;KACtB,OAAO,OAAO,UACZ,SACA,eACA,OACA,mBACA;MAAE;MAAoB;MAAiB;KAAqB,GAC5D,OACF;IACF,CAAC,CACH;GACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,aAAa,WACV,cAAc,UAAU,KAAA,IACrB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI,aAAa;IACtB,IACE,MAAM,SAAS,UAAU,KACzB,CAAC,MAAM,SAAS,SAAS,QAAQ,KACjC,MAAM,YAAY,oBAClB,MAAM,QAAQ,SAAS,WAEvB,OAAO;IACT,MAAM,UAAU,MAAM;IACtB,MAAM,mBAAmB,MAAM,SAAS,MAAM,GAAG,EAAgB;IA6BjE,QAAO,OA3BgB,SACrB,UACA,eACA,OAAO,IAAI,aAAa;KACtB,MAAM,WAAW,OAAO,kBACtB,SACA,kBACA,QAAQ,YACR,QAAQ,SAAS,WACjB,KACF;KAEA,OACE,UAAU,aAAa,KAAA,KACvB,SAAS,SAAS,SAAS,qBACzB,QAAQ,SAAS,oBACnB,QAAQ,SAAS,YAAY,OAAO,SAClC,SAAS,SAAU,SAAS,YAAY,MACrC,WACC,OAAO,iBAAiB,KAAK,gBAC7B,OAAO,aAAa,KAAK,QAC7B,CACF;IAEJ,CAAC,CACH,KAEiB,OAAO,qBAAqB,eAAe,KAAK,IAAI;GACvE,CAAC,EAAA,CACH,KACA,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,iBAAiB,YAAY,aAC1B,cAAc,UAAU,KAAA,IACrB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,OAAO,OAAO;KAC1B,GAAI,OAAO,sBAAsB,UAAU;KAC3C,YAAY,WAAW;IACzB,CAAC;IAED,MAAM,qBAAqB,OAAO,SAChC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,kBAAkB,OAAO,SAC7B,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,uBAAuB,OAAO,6BAClC,SACA,cAAc,MACd,MAAM,iBAAiB,gBACzB;IAEA,IACE,yBAAyB,MAAM,iBAAiB,oBAC/C,MAAM,eAAe,KAAA,KACpB,uBAAuB,MAAM,WAAW,oBAE1C,OAAO,OAAO,YAAY;IAE5B,OAAO,OAAO,MACZ,UACA,SACA,eACA,OAAO,IAAI,aAAa;KACtB,MAAM,UAAU,OAAO;KAEvB,IAAI,CAAC,+BAA+B,KAAK,GAAG,OAAO,QAAQ,YAAY,OAAO;KAE9E,MAAM,YAAY,OAAO,0BACvB,SACA,eACA,OACA,gBACF;KAEA,IAAI,cAAc,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;KAC/D,KAAK,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,WAAW,IAAI,EAAA,CAAG,QACzE,OAAO,QAAQ,YAAY,OAAO;KAQpC,IAAI,EAAC,OANkB,0BACrB,SACA,OACA,UAAU,eACZ,IAEc,OAAO,QAAQ,YAAY,OAAO;KAChD,IAAI;KAEJ,OAAO,oBACL,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MAAM,YACN,OAAO,IAAI,aAAa;MACtB,MAAM,YAAY;OAChB;OACA;OACA;MACF;MAEA,MAAM,UAAU,OAAO,iBACrB,SACA,OACA,UAAU,iBACV,WACA,UAAU,GACZ;MAEA,IAAI,SACF,OAAO,oBACL,SACA,OACA,UAAU,iBACV,WACA,UAAU,GACZ;MAEF,OAAO;KACT,CAAC,IACA,aAAa;MACZ,kBAAkB,QAChB,aAAa,cAAc,YAAY,YACvC,OACF;MAEA,OAAO;KACT,CACF;KAEA,OAAO,mBAAmB,QAAQ,YAAY,OAAO;IACvD,CAAC,CACH;GACF,CAAC,EAAA,CACH,KACA,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,kBAAkB,OAAO,YACvB,MACE,UACA,SACA,eACA,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IAEvB,MAAM,MAAM,OAAO;IACnB,MAAM,YAAY,QAAQ,cAAc,GAAG;IAC3C,MAAM,IAAI,eAAe,OAAO;IAEhC,MAAM,WAAW,OAAO,WACtB,YACG,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAClC,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,IAAI,EAAE,gBAAgB,SAAS,CAAC,CAAC,CAAC,CAC5E,MAAM,MAAM,QAAQ,CAAC,GACxB,KACF;IAEA,MAAM,UAAU,SAAS,SAAS,MAAM;IACxC,MAAM,oBAAoB,SAAS,MAAM,GAAG,MAAM,KAAK;IACvD,MAAM,mBAA6C,CAAC;IAEpD,KAAK,MAAM,aAAa,mBAAmB;KACzC,MAAM,SAAS,OAAO,WACpB,YACG,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAClC,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,WAAW,UAAU,SAAS,GACnC,IAAI,EAAE,gBAAgB,SAAS,CACjC,CACF,CAAC,CACA,MAAM,CAAC,GACV,cAAc,OAChB;KAEA,IAAI,OAAO,OAAO,KAAA,GAAW,iBAAiB,KAAK,OAAO,EAAS;IACrE;IAEA,MAAM,WAAW,QACf;KACE,SAAS,iBAAiB;KAC1B;IACF,GACA,OACF;IAEA,IAAI,iBAAiB,SAAS,GAC5B,OAAO,YAAY,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,MAC/C,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,QACE,EAAE,WACF,iBAAiB,KAAK,QAAa,IAAI,SAAS,CAClD,GACA,IAAI,EAAE,gBAAgB,SAAS,CACjC,CACF;IAEF,OAAO;GACT,CAAC,CACH,CAAC,CAAC,KACA,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACJ,CAAC;CACH,CAAC;CAED,MAAM,4BAA4B,OAAO,GAAG,2CAA2C,CAAC,CACtF,WAAW,SAAkB,OAA8B,iBAA0B;EACnF,IAAI,MAAM,eAAe,KAAA,GAAW,OAAO;EAE3C,MAAM,OAAO,OAAO,uBAClB,SACA,MAAM,UACN,iBACA,IACF,EAAA,CAAG;EAEH,IAAI,QAAQ,KAAA,GAAW,OAAO;EAE9B,OACE,IAAI,QAAQ,WAAW,kBAAkB,MAAM,WAAW,gBAC1D,IAAI,QAAQ,WAAW,wBAAwB,MAAM,WAAW,sBAChE,IAAI,QAAQ,WAAW,qBAAqB,MAAM,WAAW,mBAC7D,IAAI,QAAQ,WAAW,cAAc,SAAS,MAAM,MAAM,WAAW,QAAQ,KAC7E,IAAI,QAAQ,WAAW,mBAAmB,MAAM,WAAW,iBAC3D,MAAM,cAAc,UAAU,uBAAuB,MAAM,WAAW;CAE1E,CACF;CAEA,MAAM,uBAAuB,OAAO,GAAG,sCAAsC,CAAC,CAAC,WAC7E,SACA,OACA,iBACA,WAMA,KACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO,GACjC,IAAI,eAAe,OAAO;EAE5B,MAAM,cAAc,OAAO,SACxB,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,WAAW,eAAe,GAC/B,GAAG,EAAE,cAAc,UAAU,YAAY,GACzC,GAAG,EAAE,oBAAoB,UAAU,kBAAkB,GACrD,GAAG,EAAE,iBAAiB,UAAU,eAAe,GAC/C,GAAG,EAAE,UAAU,SAAS,MAAM,MAAM,YAAY,QAAQ,CAAC,GACzD,GAAG,EAAE,eAAe,MAAM,YAAY,aAAa,CACrD,CACF,CAAC,CACA,MAAM,CAAC,EAAA,CAAG;EAEb,MAAM,WAAW,OAAO,SACrB,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,IAAI,GAAG,EAAE,IAAI,eAAe,GAAG,GAAG,EAAE,kBAAkB,UAAU,oBAAoB,CAAC,CAAC,CAAC,CAC7F,MAAM,CAAC,EAAA,CAAG;EAEb,MAAM,uBAAuB,OAAO,SACjC,OAAO,CAAC,CACR,KAAK,QAAQ,oBAAoB,KAAK,CAAC,CACvC,MACC,IACE,GAAG,2BAA2B,OAAO,CAAC,CAAC,WAAW,eAAe,GACjE,GAAG,2BAA2B,OAAO,CAAC,CAAC,cAAc,UAAU,YAAY,GAC3E,GAAG,2BAA2B,OAAO,CAAC,CAAC,UAAU,UAAU,kBAAkB,CAC/E,CACF,CAAC,CACA,MAAM,CAAC,EAAA,CAAG;EAGb,OACE,eAAe,KAAA,KACf,WAAW,QAAQ,WAAW,kBAAkB,UAAU,gBAC1D,WAAW,QAAQ,WAAW,wBAAwB,UAAU,sBAChE,WAAW,QAAQ,WAAW,qBAAqB,UAAU,mBAC7D,WAAW,QAAQ,WAAW,cAAc,SAAS,MAAM,MAAM,YAAY,QAAQ,KACrF,WAAW,QAAQ,WAAW,mBAAmB,MAAM,YAAY,kBAClE,OAAO,uBACN,SACA,OACA,iBACA,SACA,qBACA,GACF;CAEJ,CAAC;CAED,MAAM,mBAAmB,OAAO,GAAG,kCAAkC,CAAC,CAAC,WACrE,SACA,OACA,iBACA,WAKA,KACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EACnC,MAAM,IAAI,eAAe,OAAO;EAEhC,OAAO,SACJ,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,IACC,QAAQ,WAAW,kBAAkB;GACnC,aAAa,MAAM;GACnB,oBAAoB,UAAU;GAC9B,iBAAiB,UAAU;EAC7B,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,WAAW,eAAe,GAC/B,GAAG,EAAE,cAAc,MAAM,WAAY,YAAY,GACjD,GAAG,EAAE,oBAAoB,MAAM,WAAY,kBAAkB,GAC7D,GAAG,EAAE,iBAAiB,MAAM,WAAY,eAAe,GACvD,GAAG,EAAE,UAAU,SAAS,MAAM,MAAM,WAAY,QAAQ,CAAC,GACzD,GAAG,EAAE,eAAe,MAAM,WAAY,aAAa,CACrD,CACF;EACF,OAAO,SACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,IAAI,aAAa,CAAC,CAAC,QAAQ,QAAQ,kBAAkB,UAAU,oBAAoB,CAAC,CAAC,CAAC,CAAC,CACvF,MACC,IACE,GAAG,EAAE,IAAI,eAAe,GACxB,GAAG,EAAE,kBAAkB,MAAM,iBAAiB,gBAAgB,CAChE,CACF;EACF,OAAO,SACJ,OAAO,QAAQ,oBAAoB,KAAK,CAAC,CACzC,IAAI,QAAQ,oBAAoB,eAAe,UAAU,kBAAkB,CAAC,CAAC,CAC7E,MACC,IACE,GAAG,2BAA2B,OAAO,CAAC,CAAC,WAAW,eAAe,GACjE,GAAG,2BAA2B,OAAO,CAAC,CAAC,cAAc,MAAM,WAAY,YAAY,GACnF,GAAG,2BAA2B,OAAO,CAAC,CAAC,UAAU,MAAM,WAAY,kBAAkB,CACvF,CACF;EACF,OAAO,cAAc,SAAS,OAAO,MAAM,cAAc,UAAU,QAAQ,GAAG;EAE9E,OAAO,OAAO,qBACZ,SACA,OACA,iBACA;GACE,GAAG;GACH,cAAc,MAAM,WAAY;EAClC,GACA,GACF;CACF,CAAC;CAED,MAAM,uBACJ,SACA,OACA,iBACA,WAKA,QAEA,cACE,qBACE,SACA,OACA,iBACA;EAAE,GAAG;EAAW,cAAc,MAAM,WAAY;CAAa,GAC7D,GACF,CACF;CAEF,MAAM,YAAY,OAAO,GAAG,mBAAmB,CAAC,CAAC,WAC/C,SACA,eACA,OACA,QACA,WAKA,SACA;EACA,MAAM,UAAU,OAAO;EAEvB,MAAM,YAAY,OAAO,0BAA0B,SAAS,eAAe,OAAO,MAAM;EAExF,IAAI,cAAc,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;EAC/D,KAAK,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,WAAW,IAAI,EAAA,CAAG,QACzE,OAAO,QAAQ,YAAY,OAAO;EACpC,IAAI,EAAE,OAAO,0BAA0B,SAAS,OAAO,UAAU,eAAe,IAC9E,OAAO,QAAQ,YAAY,OAAO;EACpC,MAAM,WAAW,QAAQ,WAAW,OAAO;EAE3C,IACE,EAAE,OAAO,iBACP,SACA,OACA,UAAU,iBACV,WACA,UAAU,GACZ,IAEA,OAAO,OAAO,YAAY;EAC5B,OAAO,oBAAoB,SAAS,OAAO,UAAU,iBAAiB,WAAW,UAAU,GAAG;EAE9F,OAAO;CACT,CAAC;CA4BD,OAAO;EAAE;EAA4B,mBAAA;GAxBnC;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA,wBAAA;GACA;GACA;GACA;GACA;GACA;EAGmD;CAAE;AACzD"}
+{"version":3,"file":"password-kernel.mjs","names":["sameCredentialSnapshot"],"sources":["../../src/internal/password-kernel.ts"],"sourcesContent":["import {\n  coordinateCommit,\n  CurrentCommitJournal,\n  hasCommitScope,\n  type CommitJournal,\n  type PreparedCommit,\n  LifecycleHooks,\n  HookConfigurationError,\n} from \"@yielded/auth/Hooks\";\nimport type { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport {\n  PasswordUnavailable,\n  PasswordPersistence,\n  type PasswordMutationInput,\n  snapshotPasswordCredential,\n  snapshotPasswordRequirement,\n  snapshotPasswordRevision,\n  type PasswordAction,\n  type PasswordMutationDecision,\n} from \"@yielded/auth/Password\";\nimport { reportPersistenceFailure } from \"@yielded/auth/Persistence\";\nimport {\n  type ProofCompletionPlan,\n  type ProofCompletionInput,\n  ProofUnavailable,\n} from \"@yielded/auth/Proofs\";\nimport {\n  snapshotAuthenticationEvidence,\n  type AuthenticationEvidence,\n  type AuthenticationRequirement,\n  type SecurityRevision,\n} from \"@yielded/auth/Sessions\";\nimport { Cause, Context, DateTime, Effect, Option, Redacted, Schema } from \"effect\";\nimport type { SqlClient } from \"effect/sql/SqlClient\";\nimport type * as SqlError from \"effect/sql/SqlError\";\n\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport {\n  type AnyPasswordPersistenceMapping,\n  requiredPasswordConstraints,\n} from \"./models/password-model\";\nimport { makeNativeSqlTables, sqlMapping, type NativeSqlTables } from \"./native-sql-table\";\nimport {\n  makePasswordCredentials,\n  samePasswordCredentialSnapshot as sameCredentialSnapshot,\n} from \"./password-credentials\";\nimport {\n  CurrentPasswordPreparedTransaction,\n  PasswordPreparedPostconditions,\n} from \"./PasswordPreparedPostconditions\";\nimport {\n  CurrentProofSql,\n  type ProofSqlConfiguration,\n  type ProofSqlDatabase,\n  type makeProofKernel,\n} from \"./proof-kernel\";\n/* oxlint-disable no-explicit-any -- existing storage kernels erase foreign table shapes; domain errors remain typed. */\nimport type { QueryFailure } from \"./query-operations\";\nimport type { QueryOperations, SqlFragment, SqlColumn } from \"./query-operations\";\nimport { NativeDatabase } from \"./transaction-kernel\";\n\ntype AdapterFailure = QueryFailure | PersistenceMappingError | SqlError.SqlError;\n\nexport interface PasswordSqlQuery<A = ReadonlyArray<any>> extends Effect.Effect<A, AdapterFailure> {\n  readonly getSQL: () => ReturnType<QueryOperations[\"sql\"]>;\n  readonly from: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly where: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly limit: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly orderBy: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly for: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly set: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly values: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly returning: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly $returningId: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly onConflictDoNothing: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly onDuplicateKeyUpdate: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n}\n\nexport interface PasswordSqlDatabase {\n  readonly select: (...args: ReadonlyArray<any>) => PasswordSqlQuery;\n  readonly insert: (...args: ReadonlyArray<any>) => PasswordSqlQuery;\n  readonly update: (...args: ReadonlyArray<any>) => PasswordSqlQuery;\n  readonly delete: (...args: ReadonlyArray<any>) => PasswordSqlQuery;\n  readonly transaction: <A, E, R>(\n    body: (transaction: PasswordSqlDatabase) => Effect.Effect<A, E, R>,\n  ) => Effect.Effect<A, E | SqlError.SqlError, R>;\n}\n\nexport class CurrentPasswordSql extends Context.Service<CurrentPasswordSql, PasswordSqlDatabase>()(\n  \"effect-auth/CurrentPasswordSql\",\n) {}\n\nexport interface PasswordSqlConfiguration {\n  readonly mode: \"interactive\" | \"synchronous\";\n  readonly locking: boolean;\n  readonly standaloneGuard: Effect.Effect<void, PasswordUnavailable>;\n  readonly coordinated?: boolean;\n  readonly insertIfAbsent: (\n    query: PasswordSqlQuery,\n    selfKey: string,\n    selfValue: unknown,\n  ) => PasswordSqlQuery;\n  readonly proof?: {\n    readonly mapping: any;\n    readonly configuration: ProofSqlConfiguration;\n  };\n}\n\ntype Database = PasswordSqlDatabase;\n\nexport const makePasswordKernel = <\n  Fragment extends SqlFragment = SqlFragment,\n  Column extends SqlColumn = SqlColumn,\n>(\n  operations: QueryOperations<Fragment, Column>,\n  proofs: Pick<ReturnType<typeof makeProofKernel>, \"completeProofPlanIn\">,\n  nativeTables: (client: SqlClient, database: object) => NativeSqlTables = (client) =>\n    makeNativeSqlTables(client),\n) => {\n  type Mapping = AnyPasswordPersistenceMapping<Fragment>;\n\n  const { and, eq, inArray, column, updateValues } = operations;\n  const { completeProofPlanIn } = proofs;\n  const unavailable = () => PasswordUnavailable.make({});\n\n  const translateFailure = <A, E, R>(\n    effect: Effect.Effect<A, E, R>,\n  ): Effect.Effect<A, PasswordUnavailable, R> =>\n    reportPersistenceFailure(\n      effect,\n      (error) =>\n        Schema.is(PasswordUnavailable)(error) ||\n        Schema.is(ProofUnavailable)(error) ||\n        Schema.is(HookConfigurationError)(error),\n    ).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));\n\n  const nowMillis = DateTime.now.pipe(Effect.map(DateTime.toEpochMillis));\n\n  const validConstraints = (mapping: Mapping) =>\n    Object.entries(requiredPasswordConstraints).every(\n      ([key, value]) =>\n        mapping.constraints[key as keyof typeof requiredPasswordConstraints] === value,\n    );\n\n  const selectRows = (query: PasswordSqlQuery, locking: boolean) =>\n    locking && typeof query.for === \"function\" ? query.for(\"update\") : query;\n\n  const subjectColumns = (mapping: Mapping) => ({\n    id: column(mapping.subject.table, mapping.subject.id),\n    status: column(mapping.subject.table, mapping.subject.status),\n    securityRevision: column(mapping.subject.table, mapping.subject.securityRevision),\n  });\n\n  const identifierColumns = (mapping: Mapping) => ({\n    namespace: column(mapping.identifier.table, mapping.identifier.namespace),\n    value: column(mapping.identifier.table, mapping.identifier.value),\n    subjectId: column(mapping.identifier.table, mapping.identifier.subjectId),\n    verifiedAt: column(mapping.identifier.table, mapping.identifier.verifiedAt),\n    bindingRevision: column(mapping.identifier.table, mapping.identifier.bindingRevision),\n  });\n\n  const credentialColumns = (mapping: Mapping) => ({\n    moduleId: column(mapping.credential.table, mapping.credential.moduleId),\n    subjectId: column(mapping.credential.table, mapping.credential.subjectId),\n    credentialId: column(mapping.credential.table, mapping.credential.credentialId),\n    credentialRevision: column(mapping.credential.table, mapping.credential.credentialRevision),\n    verifierVersion: column(mapping.credential.table, mapping.credential.verifierVersion),\n    verifier: column(mapping.credential.table, mapping.credential.verifier),\n    normalization: column(mapping.credential.table, mapping.credential.normalization),\n  });\n\n  const authorityCredentialColumns = (mapping: Mapping) => ({\n    subjectId: column(mapping.authorityCredential.table, mapping.authorityCredential.subjectId),\n    credentialId: column(\n      mapping.authorityCredential.table,\n      mapping.authorityCredential.credentialId,\n    ),\n    revision: column(mapping.authorityCredential.table, mapping.authorityCredential.revision),\n  });\n\n  const commandColumns = (mapping: Mapping) => ({\n    moduleId: column(mapping.command.table, mapping.command.moduleId),\n    commandId: column(mapping.command.table, mapping.command.commandId),\n    action: column(mapping.command.table, mapping.command.action),\n    bindingDigest: column(mapping.command.table, mapping.command.bindingDigest),\n    decision: column(mapping.command.table, mapping.command.decision),\n    retentionUntil: column(mapping.command.table, mapping.command.retentionUntil),\n  });\n\n  const allocate = <A>(\n    mode: PasswordSqlConfiguration[\"mode\"],\n    asyncValue: Effect.Effect<A, PersistenceMappingError> | undefined,\n    syncValue: (() => A) | undefined,\n  ): Effect.Effect<A, PasswordUnavailable | PersistenceMappingError> => {\n    if (mode === \"synchronous\")\n      return syncValue === undefined\n        ? Effect.fail(unavailable())\n        : Effect.try({\n            try: syncValue,\n            catch: (cause) => new PersistenceMappingError({ operation: \"mapping\", cause }),\n          });\n    if (asyncValue !== undefined) return asyncValue;\n\n    return syncValue === undefined\n      ? Effect.fail(unavailable())\n      : Effect.try({\n          try: syncValue,\n          catch: (cause) => new PersistenceMappingError({ operation: \"mapping\", cause }),\n        });\n  };\n\n  const allocateNextSecurityRevision = (\n    mapping: Mapping,\n    mode: PasswordSqlConfiguration[\"mode\"],\n    current: SecurityRevision,\n  ) => {\n    const asyncValue = mapping.subject.nextSecurityRevision?.(current);\n\n    const syncValue =\n      mapping.subject.nextSecurityRevisionSync === undefined\n        ? undefined\n        : () => mapping.subject.nextSecurityRevisionSync!(current);\n\n    return allocate(\n      mode,\n      asyncValue ?? mapping.allocateRevision,\n      syncValue ?? mapping.allocateRevisionSync,\n    );\n  };\n\n  const sameIdentifier = (left: LoginIdentifier, right: LoginIdentifier) =>\n    left.namespace === right.namespace && left.value === right.value;\n\n  const evidenceSatisfiedAt = (\n    evidence: AuthenticationEvidence,\n    requirement: AuthenticationRequirement,\n    now: number,\n  ): boolean => {\n    if (evidence.proofs.length > 64 || evidence.revision.credentials.length > 64) return false;\n    const revisions = new Map<string, string>();\n\n    for (const item of evidence.revision.credentials) {\n      if (revisions.has(item.credentialId)) return false;\n      revisions.set(item.credentialId, item.revision);\n    }\n    if (evidence.proofs.some((proof) => !revisions.has(proof.credentialId))) return false;\n    if (evidence.proofs.some((proof) => now < DateTime.toEpochMillis(proof.verifiedAt)))\n      return false;\n\n    const eligible = evidence.proofs.filter((proof) => {\n      const age = now - DateTime.toEpochMillis(proof.verifiedAt);\n\n      return age >= 0 && age < requirement.maximumAgeMillis;\n    });\n\n    const factors = new Set(eligible.flatMap((proof) => proof.factors));\n    const credentials = new Set(eligible.map((proof) => proof.credentialId));\n\n    return requirement.alternatives.some(\n      (alternative) =>\n        alternative.factors.every((factor) => factors.has(factor)) &&\n        credentials.size >= alternative.minimumCredentials &&\n        eligible.some(\n          (proof) =>\n            (!alternative.userVerified || proof.userVerified) &&\n            (!alternative.phishingResistant || proof.phishingResistant),\n        ),\n    );\n  };\n\n  const snapshotMutationInput = Effect.fn(\"DrizzlePassword.snapshotMutationInput\")(function* (\n    input: PasswordMutationInput,\n  ) {\n    const expectedRevision = snapshotPasswordRevision(input.expectedRevision);\n\n    const evidence = yield* snapshotAuthenticationEvidence(input.authorization.evidence).pipe(\n      Effect.mapError(unavailable),\n    );\n\n    const requirement = yield* snapshotPasswordRequirement(input.authorization.requirement);\n\n    const credential =\n      input.credential === undefined\n        ? undefined\n        : yield* snapshotPasswordCredential(input.credential);\n\n    return Object.freeze({\n      ...input,\n      expectedRevision,\n      replacement: Object.freeze({\n        verifier: Redacted.make(Redacted.value(input.replacement.verifier)),\n        normalization: input.replacement.normalization,\n      }),\n      invalidation: Object.freeze({ ...input.invalidation }),\n      ...(credential === undefined ? {} : { credential }),\n      authorization: Object.freeze({\n        challenge: Object.freeze({\n          ...input.authorization.challenge,\n          revision: snapshotPasswordRevision(input.authorization.challenge.revision),\n        }),\n        evidence,\n        requirement,\n      }),\n    });\n  });\n\n  const lockSubject = Effect.fn(\"DrizzlePassword.lockSubject\")(function* (\n    mapping: Mapping,\n    subjectId: string,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    const nativeSubjectId = yield* mapping.subjectId.toNative(subjectId as any);\n    const c = subjectColumns(mapping);\n\n    const rows = yield* selectRows(\n      database.select().from(mapping.subject.table).where(eq(c.id, nativeSubjectId)).limit(1),\n      locking,\n    );\n\n    return { nativeSubjectId, row: rows[0] };\n  });\n\n  const lockIdentifier = Effect.fn(\"Drizzle.lockIdentifier\")(function* (\n    mapping: Mapping,\n    identifier: LoginIdentifier,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    const c = identifierColumns(mapping);\n\n    return yield* selectRows(\n      database\n        .select()\n        .from(mapping.identifier.table)\n        .where(and(eq(c.namespace, identifier.namespace), eq(c.value, identifier.value)))\n        .limit(1),\n      locking,\n    );\n  });\n\n  const readPasswordCredential = Effect.fn(\"Drizzle.readPasswordCredential\")(function* (\n    mapping: Mapping,\n    moduleId: string,\n    nativeSubjectId: unknown,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    const c = credentialColumns(mapping);\n\n    return yield* selectRows(\n      database\n        .select()\n        .from(mapping.credential.table)\n        .where(and(eq(c.moduleId, moduleId), eq(c.subjectId, nativeSubjectId)))\n        .limit(1),\n      locking,\n    );\n  });\n\n  const resolveCredential = Effect.fn(\"DrizzlePassword.resolveCredential\")(function* (\n    mapping: Mapping,\n    moduleId: string,\n    identifier: LoginIdentifier,\n    requestedSubjectId: string | undefined,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    // The unlocked lookup only discovers the prospective subject. The canonical\n    // protected order starts with the subject and then rechecks the identifier.\n    const discovered = (yield* lockIdentifier(mapping, identifier, false))[0];\n\n    if (discovered === undefined || !mapping.identifier.isCurrent(discovered)) return undefined;\n    const discoveredNative = discovered[mapping.identifier.subjectId];\n\n    const subjectRows = yield* selectRows(\n      database\n        .select()\n        .from(mapping.subject.table)\n        .where(eq(subjectColumns(mapping).id, discoveredNative))\n        .limit(1),\n      locking,\n    );\n\n    const subject = subjectRows[0];\n\n    if (subject === undefined || !mapping.subject.isActiveStatus(subject[mapping.subject.status]))\n      return undefined;\n    const identifiers = yield* lockIdentifier(mapping, identifier, locking);\n    const identifierRow = identifiers[0];\n\n    if (\n      identifierRow === undefined ||\n      !mapping.identifier.isCurrent(identifierRow) ||\n      !mapping.subjectId.equals(discoveredNative, identifierRow[mapping.identifier.subjectId])\n    )\n      return undefined;\n    const subjectId = yield* mapping.subjectId.toSubject(discoveredNative);\n\n    if (requestedSubjectId !== undefined && requestedSubjectId !== subjectId) return undefined;\n    const credentials = yield* readPasswordCredential(mapping, moduleId, discoveredNative, locking);\n    const credential = credentials[0];\n\n    if (credential === undefined)\n      return { nativeSubjectId: discoveredNative, subject, identifier: identifierRow };\n\n    const snapshot = yield* mapping.credential\n      .decode({ moduleId, subject, identifier: identifierRow, credential })\n      .pipe(Effect.flatMap(snapshotPasswordCredential));\n\n    return {\n      nativeSubjectId: discoveredNative,\n      subject,\n      identifier: identifierRow,\n      credential,\n      snapshot,\n    };\n  });\n\n  const owned = <A, E, R>(\n    database: Database,\n    mapping: Mapping,\n    configuration: PasswordSqlConfiguration,\n    body: Effect.Effect<A, E, R>,\n  ) => {\n    if (!validConstraints(mapping)) return Effect.fail(unavailable());\n\n    const run = coordinateCommit(\n      () =>\n        database.transaction((transaction) =>\n          body.pipe(\n            Effect.provideService(CurrentPasswordSql, transaction),\n            Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),\n          ),\n        ),\n      { mode: configuration.mode },\n    ).pipe(Effect.map((result) => result.value));\n\n    return configuration.coordinated !== true\n      ? Effect.gen(function* () {\n          if (yield* hasCommitScope) return yield* unavailable();\n          yield* configuration.standaloneGuard;\n\n          return yield* run;\n        })\n      : run;\n  };\n\n  // A coordinator that accepts postconditions re-runs this check against its\n  // current transaction after application work, before commit.\n  const registerFinal = Effect.fnUntraced(function* <E>(\n    check: Effect.Effect<boolean, E, CurrentPasswordSql>,\n  ) {\n    const postconditions = yield* Effect.serviceOption(PasswordPreparedPostconditions);\n\n    if (Option.isNone(postconditions)) return;\n\n    const postcondition = Effect.gen(function* () {\n      const transaction = yield* CurrentPasswordPreparedTransaction;\n\n      if (!(yield* check.pipe(Effect.provideService(CurrentPasswordSql, transaction))))\n        return yield* unavailable();\n    }).pipe(translateFailure);\n\n    if (!postconditions.value.register(postcondition)) return yield* unavailable();\n  });\n\n  const safeRead = <A, E, R>(\n    database: Database,\n    configuration: PasswordSqlConfiguration,\n    body: Effect.Effect<A, E, R>,\n  ) =>\n    Effect.gen(function* () {\n      if (configuration.coordinated !== true) {\n        if (yield* hasCommitScope) return yield* unavailable();\n        yield* configuration.standaloneGuard;\n      }\n\n      return yield* database.transaction((transaction) =>\n        body.pipe(\n          Effect.provideService(CurrentPasswordSql, transaction),\n          Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),\n        ),\n      );\n    });\n\n  const proofCompletionMatchesPassword = (\n    input: PasswordMutationInput & { readonly completion: ProofCompletionPlan },\n  ) => {\n    const completion = input.completion.input;\n    const binding = completion.binding;\n\n    if (\n      completion.moduleId !== `${input.moduleId}/reset` ||\n      completion.purpose !== \"password-reset\" ||\n      binding._tag !== \"Subject\" ||\n      input.credential === undefined ||\n      binding.revision.subjectId !== input.expectedRevision.subjectId ||\n      binding.revision.securityRevision !== input.expectedRevision.securityRevision ||\n      !sameIdentifier(binding.identifier, input.credential.identifier)\n    )\n      return false;\n\n    const expected = [...input.expectedRevision.credentials].sort((left, right) =>\n      left.credentialId.localeCompare(right.credentialId),\n    );\n\n    const actual = [...binding.revision.credentials].sort((left, right) =>\n      left.credentialId.localeCompare(right.credentialId),\n    );\n\n    return (\n      expected.length === actual.length &&\n      expected.every(\n        (item, index) =>\n          item.credentialId === actual[index]!.credentialId &&\n          item.revision === actual[index]!.revision,\n      )\n    );\n  };\n\n  const probeProofCompletion = Effect.fn(\"Drizzle.probeProofCompletion\")(function* (\n    configuration: PasswordSqlConfiguration,\n    input: ProofCompletionInput,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    if (configuration.proof === undefined) return yield* Effect.fail(unavailable());\n    const validProbe = { _tag: \"PasswordProofCompletionValid\" } as const;\n\n    const plan: ProofCompletionPlan = {\n      input,\n      prepare: (decision, journal, project) => journal.prepare(project(decision)),\n    };\n\n    const probe = coordinateCommit(\n      () =>\n        database.transaction((transaction) =>\n          completeProofPlanIn(\n            configuration.proof!.mapping,\n            configuration.proof!.configuration,\n            plan,\n            Effect.fail(validProbe),\n            () => false,\n          ).pipe(\n            Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),\n          ),\n        ),\n      { mode: configuration.mode },\n    );\n\n    if (configuration.coordinated === true || (yield* hasCommitScope)) return yield* unavailable();\n    yield* configuration.standaloneGuard;\n\n    return yield* probe.pipe(\n      Effect.as(false),\n      Effect.catchCause((cause) => {\n        const reason = cause.reasons[0];\n\n        return cause.reasons.length === 1 &&\n          reason !== undefined &&\n          Cause.isFailReason(reason) &&\n          reason.error === validProbe\n          ? Effect.succeed(true)\n          : Effect.failCause(cause);\n      }),\n    );\n  });\n\n  const validateMutationAuthority = Effect.fn(\"DrizzlePassword.validateMutationAuthority\")(\n    function* (\n      mapping: Mapping,\n      configuration: PasswordSqlConfiguration,\n      input: PasswordMutationInput,\n      action: PasswordAction,\n    ) {\n      const database = yield* CurrentPasswordSql;\n\n      const locked = yield* lockSubject(\n        mapping,\n        input.expectedRevision.subjectId,\n        configuration.locking,\n      );\n\n      const row = locked.row;\n\n      if (\n        row === undefined ||\n        !mapping.subject.isActiveStatus(row[mapping.subject.status]) ||\n        row[mapping.subject.securityRevision] !== input.expectedRevision.securityRevision\n      )\n        return undefined;\n      if (\n        input.authorization.challenge.moduleId !== input.moduleId ||\n        input.authorization.challenge.action !== action ||\n        input.authorization.challenge.commandId !== input.commandId ||\n        input.authorization.challenge.revision.subjectId !== input.expectedRevision.subjectId ||\n        input.authorization.challenge.revision.securityRevision !==\n          input.expectedRevision.securityRevision ||\n        (input.authorization.evidence.flowId as string) !== (input.commandId as string) ||\n        input.authorization.evidence.bindingDigest !==\n          input.authorization.challenge.bindingDigest ||\n        input.authorization.evidence.revision.subjectId !== input.expectedRevision.subjectId ||\n        input.authorization.evidence.revision.securityRevision !==\n          input.expectedRevision.securityRevision ||\n        (action === \"add-password\" &&\n          (input.credential !== undefined ||\n            input.authorization.challenge.targetCredentialId !== undefined))\n      )\n        return undefined;\n      if (\n        input.expectedRevision.credentials.some(\n          (expected) =>\n            !input.authorization.evidence.revision.credentials.some(\n              (actual) =>\n                actual.credentialId === expected.credentialId &&\n                actual.revision === expected.revision,\n            ),\n        )\n      )\n        return undefined;\n      if (input.credential !== undefined) {\n        const identifier = (yield* lockIdentifier(\n          mapping,\n          input.credential.identifier,\n          configuration.locking,\n        ))[0];\n\n        if (\n          identifier === undefined ||\n          !mapping.identifier.isCurrent(identifier) ||\n          !mapping.subjectId.equals(\n            identifier[mapping.identifier.subjectId],\n            locked.nativeSubjectId,\n          ) ||\n          identifier[mapping.identifier.bindingRevision] !==\n            input.credential.identifierBindingRevision\n        )\n          return undefined;\n      }\n\n      const allExpected = [\n        ...input.expectedRevision.credentials,\n        ...input.authorization.evidence.revision.credentials,\n      ];\n\n      const expected = new Map(allExpected.map((item) => [item.credentialId, item]));\n\n      const ac = authorityCredentialColumns(mapping);\n\n      const credentialRows =\n        expected.size === 0\n          ? []\n          : yield* selectRows(\n              database\n                .select()\n                .from(mapping.authorityCredential.table)\n                .where(\n                  and(\n                    eq(ac.subjectId, locked.nativeSubjectId),\n                    inArray(ac.credentialId, [...expected.keys()]),\n                  ),\n                )\n                .orderBy(ac.credentialId),\n              configuration.locking,\n            );\n\n      if (credentialRows.length !== expected.size) return undefined;\n      // Database collation need not match JavaScript locale ordering.\n      for (const actual of credentialRows) {\n        const wanted = expected.get(actual[mapping.authorityCredential.credentialId]);\n\n        if (\n          wanted === undefined ||\n          actual[mapping.authorityCredential.revision] !== wanted.revision ||\n          (mapping.authorityCredential.status !== undefined &&\n            mapping.authorityCredential.isActiveStatus?.(\n              actual[mapping.authorityCredential.status],\n            ) !== true)\n        )\n          return undefined;\n        expected.delete(wanted.credentialId);\n      }\n      if (expected.size !== 0) return undefined;\n      if (input.credential !== undefined) {\n        const identifier = (yield* lockIdentifier(mapping, input.credential.identifier, false))[0];\n\n        const credential = (yield* readPasswordCredential(\n          mapping,\n          input.moduleId,\n          locked.nativeSubjectId,\n          configuration.locking,\n        ))[0];\n\n        if (identifier === undefined || credential === undefined) return undefined;\n\n        const snapshot = yield* mapping.credential.decode({\n          moduleId: input.moduleId,\n          subject: row,\n          identifier,\n          credential,\n        });\n\n        if (!sameCredentialSnapshot(snapshot, input.credential)) return undefined;\n      }\n      const currentRequirement = yield* mapping.subject.decodeActionRequirement(row, action);\n      const now = yield* nowMillis;\n\n      if (\n        !evidenceSatisfiedAt(input.authorization.evidence, input.authorization.requirement, now) ||\n        !evidenceSatisfiedAt(input.authorization.evidence, currentRequirement, now)\n      )\n        return undefined;\n      if (\n        input.invalidation.existingSessions === \"immediate\" &&\n        mapping.sessionInvalidation !== \"same-authority-immediate\"\n      )\n        return undefined;\n\n      return { ...locked, now };\n    },\n  );\n\n  const commandExists = Effect.fn(\"Drizzle.commandExists\")(function* (\n    mapping: Mapping,\n    moduleId: string,\n    commandId: string,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    const c = commandColumns(mapping);\n\n    return yield* selectRows(\n      database\n        .select()\n        .from(mapping.command.table)\n        .where(and(eq(c.moduleId, moduleId), eq(c.commandId, commandId)))\n        .limit(1),\n      locking,\n    );\n  });\n\n  const insertCommand = Effect.fn(\"Drizzle.insertCommand\")(function* (\n    mapping: Mapping,\n    input: PasswordMutationInput,\n    action: PasswordAction,\n    now: number,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    return yield* database.insert(mapping.command.table).values(\n      mapping.command.encodeInsert({\n        moduleId: input.moduleId,\n        commandId: input.commandId,\n        action,\n        bindingDigest: input.authorization.challenge.bindingDigest,\n        decision: \"changed\",\n        retentionUntilMillis: now + mapping.commandRetentionMillis,\n      }),\n    );\n  });\n\n  const mutationPostconditions = Effect.fn(\"DrizzlePassword.mutationPostconditions\")(function* (\n    mapping: Mapping,\n    input: PasswordMutationInput,\n    nativeSubjectId: unknown,\n    subject: any,\n    authorityCredential: any,\n    now: number,\n  ) {\n    if (\n      subject === undefined ||\n      !mapping.subject.isActiveStatus(subject[mapping.subject.status]) ||\n      authorityCredential === undefined ||\n      (mapping.authorityCredential.status !== undefined &&\n        mapping.authorityCredential.isActiveStatus?.(\n          authorityCredential[mapping.authorityCredential.status],\n        ) !== true)\n    )\n      return false;\n    if (input.credential !== undefined) {\n      const identifier = (yield* lockIdentifier(mapping, input.credential.identifier, false))[0];\n\n      if (\n        identifier === undefined ||\n        !mapping.identifier.isCurrent(identifier) ||\n        !mapping.subjectId.equals(identifier[mapping.identifier.subjectId], nativeSubjectId) ||\n        identifier[mapping.identifier.bindingRevision] !==\n          input.credential.identifierBindingRevision\n      )\n        return false;\n\n      const credential = (yield* readPasswordCredential(\n        mapping,\n        input.moduleId,\n        nativeSubjectId,\n        false,\n      ))[0];\n\n      if (credential === undefined) return false;\n\n      const decoded = yield* mapping.credential.decode({\n        moduleId: input.moduleId,\n        subject,\n        identifier,\n        credential,\n      });\n\n      if (decoded.identifierVerifiedAtMillis !== input.credential.identifierVerifiedAtMillis)\n        return false;\n    }\n    const rows = yield* commandExists(mapping, input.moduleId, input.commandId, false);\n    const row = rows[0];\n\n    return (\n      rows.length === 1 &&\n      row[mapping.command.action] === input.authorization.challenge.action &&\n      row[mapping.command.bindingDigest] === input.authorization.challenge.bindingDigest &&\n      row[mapping.command.decision] === \"changed\" &&\n      (yield* mapping.decodeInstant(row[mapping.command.retentionUntil])) ===\n        now + mapping.commandRetentionMillis\n    );\n  });\n\n  const addPasswordIn = Effect.fn(\"DrizzlePassword.addPasswordIn\")(function* (\n    mapping: Mapping,\n    configuration: PasswordSqlConfiguration,\n    input: PasswordMutationInput,\n    revisions: {\n      readonly credentialId: string;\n      readonly credentialRevision: SecurityRevision;\n      readonly verifierVersion: SecurityRevision;\n      readonly nextSecurityRevision: SecurityRevision;\n    },\n    commandNow?: number,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    const { credentialId, credentialRevision, verifierVersion, nextSecurityRevision } = revisions;\n\n    const authority = yield* validateMutationAuthority(\n      mapping,\n      configuration,\n      input,\n      \"add-password\",\n    );\n\n    if (authority === undefined) return false;\n    if ((yield* commandExists(mapping, input.moduleId, input.commandId, true)).length) return false;\n    if (\n      (yield* readPasswordCredential(mapping, input.moduleId, authority.nativeSubjectId, true))\n        .length\n    )\n      return false;\n\n    yield* database.insert(mapping.credential.table).values(\n      mapping.credential.encodeInsert({\n        moduleId: input.moduleId,\n        subjectId: authority.nativeSubjectId,\n        credentialId,\n        credentialRevision,\n        verifierVersion,\n        replacement: input.replacement,\n      }),\n    );\n    yield* database.insert(mapping.authorityCredential.table).values(\n      mapping.authorityCredential.encodeInsert({\n        subjectId: authority.nativeSubjectId,\n        credentialId,\n        revision: credentialRevision,\n      }),\n    );\n    yield* database\n      .update(mapping.subject.table)\n      .set(updateValues([[mapping.subject.securityRevision, nextSecurityRevision]]))\n      .where(\n        and(\n          eq(subjectColumns(mapping).id, authority.nativeSubjectId),\n          eq(subjectColumns(mapping).securityRevision, input.expectedRevision.securityRevision),\n        ),\n      );\n    yield* insertCommand(mapping, input, \"add-password\", commandNow ?? authority.now);\n\n    const applied = checkMutationApplied(\n      mapping,\n      input,\n      authority.nativeSubjectId,\n      revisions,\n      commandNow ?? authority.now,\n    );\n\n    if (!(yield* applied)) return yield* unavailable();\n    yield* registerFinal(applied);\n\n    return true;\n  });\n\n  const makeSqlPasswordPersistence = Effect.fn(\"makeSqlPasswordPersistence\")(function* (\n    mapping: Mapping,\n    configuration: PasswordSqlConfiguration,\n  ): Effect.fn.Return<\n    PasswordPersistence[\"Service\"],\n    PasswordUnavailable,\n    LifecycleHooks | CurrentPasswordSql | NativeDatabase\n  > {\n    const database = yield* CurrentPasswordSql;\n\n    if (!configuration.coordinated)\n      yield* (\n        operations.validateStorage?.({\n          ...mapping,\n          proof: configuration.proof?.mapping,\n        }) ?? Effect.void\n      ).pipe(Effect.mapError(unavailable));\n    const hooks = yield* LifecycleHooks;\n\n    if (!validConstraints(mapping)) return yield* unavailable();\n    const root = yield* NativeDatabase;\n\n    const credentials = yield* makePasswordCredentials(\n      yield* sqlMapping(() => nativeTables(root.$client.withoutTransforms(), root)).pipe(\n        translateFailure,\n      ),\n      mapping,\n      configuration,\n    );\n\n    return PasswordPersistence.of({\n      ...credentials,\n      readForSubject: (input) =>\n        safeRead(\n          database,\n          configuration,\n          Effect.gen(function* () {\n            const transaction = yield* CurrentPasswordSql;\n\n            const locked = yield* lockSubject(mapping, input.subjectId, false);\n\n            if (\n              locked.row === undefined ||\n              !mapping.subject.isActiveStatus(locked.row[mapping.subject.status])\n            )\n              return Option.none();\n\n            const credential = (yield* readPasswordCredential(\n              mapping,\n              input.moduleId,\n              locked.nativeSubjectId,\n              false,\n            ))[0];\n\n            if (credential === undefined) return Option.none();\n            const ic = identifierColumns(mapping);\n\n            const identifiers = yield* transaction\n              .select()\n              .from(mapping.identifier.table)\n              .where(eq(ic.subjectId, locked.nativeSubjectId));\n\n            const identifier = identifiers.find((row: any) => mapping.identifier.isCurrent(row));\n\n            if (identifier === undefined) return Option.none();\n\n            const snapshot = yield* mapping.credential\n              .decode({\n                moduleId: input.moduleId,\n                subject: locked.row,\n                identifier,\n                credential,\n              })\n              .pipe(Effect.flatMap(snapshotPasswordCredential));\n\n            return Option.some(snapshot);\n          }),\n        ).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      recoveryTarget: (input) =>\n        safeRead(\n          database,\n          configuration,\n          Effect.gen(function* () {\n            const resolved = yield* resolveCredential(\n              mapping,\n              input.moduleId,\n              input.identifier,\n              undefined,\n              false,\n            );\n\n            return resolved?.snapshot === undefined ||\n              resolved.snapshot.identifierVerifiedAtMillis === undefined\n              ? Option.none()\n              : Option.some(resolved.snapshot);\n          }),\n        ).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      addIfAbsent: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const input = yield* snapshotMutationInput(uncaptured);\n\n          const credentialId = yield* allocate(\n            configuration.mode,\n            mapping.allocateCredentialId,\n            mapping.allocateCredentialIdSync,\n          );\n\n          const credentialRevision = yield* allocate(\n            configuration.mode,\n            mapping.allocateRevision,\n            mapping.allocateRevisionSync,\n          );\n\n          const verifierVersion = yield* allocate(\n            configuration.mode,\n            mapping.allocateRevision,\n            mapping.allocateRevisionSync,\n          );\n\n          const nextSecurityRevision = yield* allocateNextSecurityRevision(\n            mapping,\n            configuration.mode,\n            input.expectedRevision.securityRevision,\n          );\n\n          if (nextSecurityRevision === input.expectedRevision.securityRevision)\n            return yield* unavailable();\n\n          return yield* owned(\n            database,\n            mapping,\n            configuration,\n            Effect.gen(function* () {\n              const journal = yield* CurrentCommitJournal;\n\n              const changed = yield* addPasswordIn(mapping, configuration, input, {\n                credentialId,\n                credentialRevision,\n                verifierVersion,\n                nextSecurityRevision,\n              });\n\n              return prepare(changed ? \"changed\" : \"rejected\", journal);\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      replaceIfCurrent: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const input = yield* snapshotMutationInput(uncaptured);\n\n          const credentialRevision = yield* allocate(\n            configuration.mode,\n            mapping.allocateRevision,\n            mapping.allocateRevisionSync,\n          );\n\n          const verifierVersion = yield* allocate(\n            configuration.mode,\n            mapping.allocateRevision,\n            mapping.allocateRevisionSync,\n          );\n\n          const nextSecurityRevision = yield* allocateNextSecurityRevision(\n            mapping,\n            configuration.mode,\n            input.expectedRevision.securityRevision,\n          );\n\n          if (\n            nextSecurityRevision === input.expectedRevision.securityRevision ||\n            (input.credential !== undefined &&\n              credentialRevision === input.credential.credentialRevision)\n          )\n            return yield* unavailable();\n\n          return yield* owned(\n            database,\n            mapping,\n            configuration,\n            Effect.gen(function* () {\n              return yield* replaceIn(\n                mapping,\n                configuration,\n                input,\n                \"change-password\",\n                { credentialRevision, verifierVersion, nextSecurityRevision },\n                prepare,\n              );\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      checkReset: (input) =>\n        (configuration.proof === undefined\n          ? Effect.fail(unavailable())\n          : Effect.gen(function* () {\n              if (\n                input.moduleId.length <= \"/reset\".length ||\n                !input.moduleId.endsWith(\"/reset\") ||\n                input.purpose !== \"password-reset\" ||\n                input.binding._tag !== \"Subject\"\n              )\n                return false;\n              const binding = input.binding;\n              const passwordModuleId = input.moduleId.slice(0, -\"/reset\".length);\n\n              const current = yield* safeRead(\n                database,\n                configuration,\n                Effect.gen(function* () {\n                  const resolved = yield* resolveCredential(\n                    mapping,\n                    passwordModuleId,\n                    binding.identifier,\n                    binding.revision.subjectId,\n                    false,\n                  );\n\n                  return (\n                    resolved?.snapshot !== undefined &&\n                    resolved.snapshot.revision.securityRevision ===\n                      binding.revision.securityRevision &&\n                    binding.revision.credentials.every((item) =>\n                      resolved.snapshot!.revision.credentials.some(\n                        (actual) =>\n                          actual.credentialId === item.credentialId &&\n                          actual.revision === item.revision,\n                      ),\n                    )\n                  );\n                }),\n              );\n\n              return current ? yield* probeProofCompletion(configuration, input) : false;\n            })\n        ).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      resetWithProof: (uncaptured, prepare) =>\n        (configuration.proof === undefined\n          ? Effect.fail(unavailable())\n          : Effect.gen(function* () {\n              const input = Object.freeze({\n                ...(yield* snapshotMutationInput(uncaptured)),\n                completion: uncaptured.completion,\n              });\n\n              const credentialRevision = yield* allocate(\n                configuration.mode,\n                mapping.allocateRevision,\n                mapping.allocateRevisionSync,\n              );\n\n              const verifierVersion = yield* allocate(\n                configuration.mode,\n                mapping.allocateRevision,\n                mapping.allocateRevisionSync,\n              );\n\n              const nextSecurityRevision = yield* allocateNextSecurityRevision(\n                mapping,\n                configuration.mode,\n                input.expectedRevision.securityRevision,\n              );\n\n              if (\n                nextSecurityRevision === input.expectedRevision.securityRevision ||\n                (input.credential !== undefined &&\n                  credentialRevision === input.credential.credentialRevision)\n              )\n                return yield* unavailable();\n\n              return yield* owned(\n                database,\n                mapping,\n                configuration,\n                Effect.gen(function* () {\n                  const journal = yield* CurrentCommitJournal;\n\n                  if (!proofCompletionMatchesPassword(input)) return prepare(\"rejected\", journal);\n\n                  const authority = yield* validateMutationAuthority(\n                    mapping,\n                    configuration,\n                    input,\n                    \"reset-password\",\n                  );\n\n                  if (authority === undefined) return prepare(\"rejected\", journal);\n                  if ((yield* commandExists(mapping, input.moduleId, input.commandId, true)).length)\n                    return prepare(\"rejected\", journal);\n\n                  const current = yield* currentExpectedCredential(\n                    mapping,\n                    input,\n                    authority.nativeSubjectId,\n                  );\n\n                  if (!current) return prepare(\"rejected\", journal);\n                  let passwordReceipt: PreparedCommit<any> | undefined;\n\n                  yield* completeProofPlanIn(\n                    configuration.proof!.mapping,\n                    configuration.proof!.configuration,\n                    input.completion,\n                    Effect.gen(function* () {\n                      const revisions = {\n                        credentialRevision,\n                        verifierVersion,\n                        nextSecurityRevision,\n                      };\n\n                      const applied = yield* writeReplacement(\n                        mapping,\n                        input,\n                        authority.nativeSubjectId,\n                        revisions,\n                        authority.now,\n                      );\n\n                      if (applied)\n                        yield* registerReplacement(\n                          mapping,\n                          input,\n                          authority.nativeSubjectId,\n                          revisions,\n                          authority.now,\n                        );\n\n                      return applied;\n                    }),\n                    (decision) => {\n                      passwordReceipt = prepare(\n                        decision === \"completed\" ? \"changed\" : \"rejected\",\n                        journal,\n                      );\n\n                      return decision;\n                    },\n                  );\n\n                  return passwordReceipt ?? prepare(\"rejected\", journal);\n                }),\n              );\n            })\n        ).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n    });\n  });\n\n  const currentExpectedCredential = Effect.fn(\"DrizzlePassword.currentExpectedCredential\")(\n    function* (mapping: Mapping, input: PasswordMutationInput, nativeSubjectId: unknown) {\n      if (input.credential === undefined) return false;\n\n      const row = (yield* readPasswordCredential(\n        mapping,\n        input.moduleId,\n        nativeSubjectId,\n        true,\n      ))[0];\n\n      if (row === undefined) return false;\n\n      return (\n        row[mapping.credential.credentialId] === input.credential.credentialId &&\n        row[mapping.credential.credentialRevision] === input.credential.credentialRevision &&\n        row[mapping.credential.verifierVersion] === input.credential.verifierVersion &&\n        row[mapping.credential.verifier] === Redacted.value(input.credential.verifier) &&\n        row[mapping.credential.normalization] === input.credential.normalization &&\n        input.authorization.challenge.targetCredentialId === input.credential.credentialId\n      );\n    },\n  );\n\n  const checkMutationApplied = Effect.fn(\"DrizzlePassword.checkMutationApplied\")(function* (\n    mapping: Mapping,\n    input: PasswordMutationInput,\n    nativeSubjectId: unknown,\n    revisions: {\n      readonly credentialId: string;\n      readonly credentialRevision: SecurityRevision;\n      readonly verifierVersion: SecurityRevision;\n      readonly nextSecurityRevision: SecurityRevision;\n    },\n    now: number,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    const c = credentialColumns(mapping),\n      s = subjectColumns(mapping);\n\n    const credential = (yield* database\n      .select()\n      .from(mapping.credential.table)\n      .where(\n        and(\n          eq(c.moduleId, input.moduleId),\n          eq(c.subjectId, nativeSubjectId),\n          eq(c.credentialId, revisions.credentialId),\n          eq(c.credentialRevision, revisions.credentialRevision),\n          eq(c.verifierVersion, revisions.verifierVersion),\n          eq(c.verifier, Redacted.value(input.replacement.verifier)),\n          eq(c.normalization, input.replacement.normalization),\n        ),\n      )\n      .limit(1))[0];\n\n    const subject = (yield* database\n      .select()\n      .from(mapping.subject.table)\n      .where(and(eq(s.id, nativeSubjectId), eq(s.securityRevision, revisions.nextSecurityRevision)))\n      .limit(1))[0];\n\n    const authorityCredential = (yield* database\n      .select()\n      .from(mapping.authorityCredential.table)\n      .where(\n        and(\n          eq(authorityCredentialColumns(mapping).subjectId, nativeSubjectId),\n          eq(authorityCredentialColumns(mapping).credentialId, revisions.credentialId),\n          eq(authorityCredentialColumns(mapping).revision, revisions.credentialRevision),\n        ),\n      )\n      .limit(1))[0];\n\n    // SQL equality follows column collation; compare the persisted values exactly.\n    return (\n      credential !== undefined &&\n      credential[mapping.credential.credentialId] === revisions.credentialId &&\n      credential[mapping.credential.credentialRevision] === revisions.credentialRevision &&\n      credential[mapping.credential.verifierVersion] === revisions.verifierVersion &&\n      credential[mapping.credential.verifier] === Redacted.value(input.replacement.verifier) &&\n      credential[mapping.credential.normalization] === input.replacement.normalization &&\n      (yield* mutationPostconditions(\n        mapping,\n        input,\n        nativeSubjectId,\n        subject,\n        authorityCredential,\n        now,\n      ))\n    );\n  });\n\n  const writeReplacement = Effect.fn(\"DrizzlePassword.writeReplacement\")(function* (\n    mapping: Mapping,\n    input: PasswordMutationInput,\n    nativeSubjectId: unknown,\n    revisions: {\n      readonly credentialRevision: SecurityRevision;\n      readonly verifierVersion: SecurityRevision;\n      readonly nextSecurityRevision: SecurityRevision;\n    },\n    now: number,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    const c = credentialColumns(mapping);\n    const s = subjectColumns(mapping);\n\n    yield* database\n      .update(mapping.credential.table)\n      .set(\n        mapping.credential.encodeReplacement({\n          replacement: input.replacement,\n          credentialRevision: revisions.credentialRevision,\n          verifierVersion: revisions.verifierVersion,\n        }),\n      )\n      .where(\n        and(\n          eq(c.moduleId, input.moduleId),\n          eq(c.subjectId, nativeSubjectId),\n          eq(c.credentialId, input.credential!.credentialId),\n          eq(c.credentialRevision, input.credential!.credentialRevision),\n          eq(c.verifierVersion, input.credential!.verifierVersion),\n          eq(c.verifier, Redacted.value(input.credential!.verifier)),\n          eq(c.normalization, input.credential!.normalization),\n        ),\n      );\n    yield* database\n      .update(mapping.subject.table)\n      .set(updateValues([[mapping.subject.securityRevision, revisions.nextSecurityRevision]]))\n      .where(\n        and(\n          eq(s.id, nativeSubjectId),\n          eq(s.securityRevision, input.expectedRevision.securityRevision),\n        ),\n      );\n    yield* database\n      .update(mapping.authorityCredential.table)\n      .set(mapping.authorityCredential.encodeRevision(revisions.credentialRevision))\n      .where(\n        and(\n          eq(authorityCredentialColumns(mapping).subjectId, nativeSubjectId),\n          eq(authorityCredentialColumns(mapping).credentialId, input.credential!.credentialId),\n          eq(authorityCredentialColumns(mapping).revision, input.credential!.credentialRevision),\n        ),\n      );\n    yield* insertCommand(mapping, input, input.authorization.challenge.action, now);\n\n    return yield* checkMutationApplied(\n      mapping,\n      input,\n      nativeSubjectId,\n      {\n        ...revisions,\n        credentialId: input.credential!.credentialId,\n      },\n      now,\n    );\n  });\n\n  const registerReplacement = (\n    mapping: Mapping,\n    input: PasswordMutationInput,\n    nativeSubjectId: unknown,\n    revisions: {\n      readonly credentialRevision: SecurityRevision;\n      readonly verifierVersion: SecurityRevision;\n      readonly nextSecurityRevision: SecurityRevision;\n    },\n    now: number,\n  ) =>\n    registerFinal(\n      checkMutationApplied(\n        mapping,\n        input,\n        nativeSubjectId,\n        { ...revisions, credentialId: input.credential!.credentialId },\n        now,\n      ),\n    );\n\n  const replaceIn = Effect.fn(\"Drizzle.replaceIn\")(function* <A>(\n    mapping: Mapping,\n    configuration: PasswordSqlConfiguration,\n    input: PasswordMutationInput,\n    action: PasswordAction,\n    revisions: {\n      readonly credentialRevision: SecurityRevision;\n      readonly verifierVersion: SecurityRevision;\n      readonly nextSecurityRevision: SecurityRevision;\n    },\n    prepare: (value: PasswordMutationDecision, journal: CommitJournal) => PreparedCommit<A>,\n  ) {\n    const journal = yield* CurrentCommitJournal;\n\n    const authority = yield* validateMutationAuthority(mapping, configuration, input, action);\n\n    if (authority === undefined) return prepare(\"rejected\", journal);\n    if ((yield* commandExists(mapping, input.moduleId, input.commandId, true)).length)\n      return prepare(\"rejected\", journal);\n    if (!(yield* currentExpectedCredential(mapping, input, authority.nativeSubjectId)))\n      return prepare(\"rejected\", journal);\n    const prepared = prepare(\"changed\", journal);\n\n    if (\n      !(yield* writeReplacement(\n        mapping,\n        input,\n        authority.nativeSubjectId,\n        revisions,\n        authority.now,\n      ))\n    )\n      return yield* unavailable();\n    yield* registerReplacement(mapping, input, authority.nativeSubjectId, revisions, authority.now);\n\n    return prepared;\n  });\n\n  /** Internal bound-owner primitives; deliberately not re-exported by driver modules. */\n  const passwordSqlKernel = {\n    allocate,\n    allocateNextSecurityRevision,\n    owned,\n    safeRead,\n    snapshotMutationInput,\n    lockSubject,\n    lockIdentifier,\n    readPasswordCredential,\n    resolveCredential,\n    validateMutationAuthority,\n    currentExpectedCredential,\n    commandExists,\n    addPasswordIn,\n    checkMutationApplied,\n    writeReplacement,\n    evidenceSatisfiedAt,\n    sameCredentialSnapshot,\n    subjectColumns,\n    identifierColumns,\n    credentialColumns,\n    authorityCredentialColumns,\n    proofCompletionMatchesPassword,\n  };\n\n  return { makeSqlPasswordPersistence, passwordSqlKernel };\n};\n"],"mappings":";;;;;;;;;;;;;;AAwFA,IAAa,qBAAb,cAAwC,QAAQ,QAAiD,CAAC,CAChG,gCACF,CAAC,CAAC,CAAC;AAoBH,MAAa,sBAIX,YACA,QACA,gBAA0E,WACxE,oBAAoB,MAAM,MACzB;CAGH,MAAM,EAAE,KAAK,IAAI,SAAS,QAAQ,iBAAiB;CACnD,MAAM,EAAE,wBAAwB;CAChC,MAAM,oBAAoB,oBAAoB,KAAK,CAAC,CAAC;CAErD,MAAM,oBACJ,WAEA,yBACE,SACC,UACC,OAAO,GAAG,mBAAmB,CAAC,CAAC,KAAK,KACpC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,sBAAsB,CAAC,CAAC,KAAK,CAC3C,CAAC,CAAC,KAAK,OAAO,YAAY,UAAU,OAAO,UAAU,MAAM,IAAI,aAAa,YAAY,CAAC,CAAC,CAAC,CAAC;CAE9F,MAAM,YAAY,SAAS,IAAI,KAAK,OAAO,IAAI,SAAS,aAAa,CAAC;CAEtE,MAAM,oBAAoB,YACxB,OAAO,QAAQ,2BAA2B,CAAC,CAAC,OACzC,CAAC,KAAK,WACL,QAAQ,YAAY,SAAqD,KAC7E;CAEF,MAAM,cAAc,OAAyB,YAC3C,WAAW,OAAO,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,IAAI;CAErE,MAAM,kBAAkB,aAAsB;EAC5C,IAAI,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,EAAE;EACpD,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;EAC5D,kBAAkB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,gBAAgB;CAClF;CAEA,MAAM,qBAAqB,aAAsB;EAC/C,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;EACxE,OAAO,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,KAAK;EAChE,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;EACxE,YAAY,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,UAAU;EAC1E,iBAAiB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,eAAe;CACtF;CAEA,MAAM,qBAAqB,aAAsB;EAC/C,UAAU,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,QAAQ;EACtE,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;EACxE,cAAc,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,YAAY;EAC9E,oBAAoB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,kBAAkB;EAC1F,iBAAiB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,eAAe;EACpF,UAAU,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,QAAQ;EACtE,eAAe,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,aAAa;CAClF;CAEA,MAAM,8BAA8B,aAAsB;EACxD,WAAW,OAAO,QAAQ,oBAAoB,OAAO,QAAQ,oBAAoB,SAAS;EAC1F,cAAc,OACZ,QAAQ,oBAAoB,OAC5B,QAAQ,oBAAoB,YAC9B;EACA,UAAU,OAAO,QAAQ,oBAAoB,OAAO,QAAQ,oBAAoB,QAAQ;CAC1F;CAEA,MAAM,kBAAkB,aAAsB;EAC5C,UAAU,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,QAAQ;EAChE,WAAW,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,SAAS;EAClE,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;EAC5D,eAAe,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,aAAa;EAC1E,UAAU,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,QAAQ;EAChE,gBAAgB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,cAAc;CAC9E;CAEA,MAAM,YACJ,MACA,YACA,cACoE;EACpE,IAAI,SAAS,eACX,OAAO,cAAc,KAAA,IACjB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;GACT,KAAK;GACL,QAAQ,UAAU,IAAI,wBAAwB;IAAE,WAAW;IAAW;GAAM,CAAC;EAC/E,CAAC;EACP,IAAI,eAAe,KAAA,GAAW,OAAO;EAErC,OAAO,cAAc,KAAA,IACjB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;GACT,KAAK;GACL,QAAQ,UAAU,IAAI,wBAAwB;IAAE,WAAW;IAAW;GAAM,CAAC;EAC/E,CAAC;CACP;CAEA,MAAM,gCACJ,SACA,MACA,YACG;EACH,MAAM,aAAa,QAAQ,QAAQ,uBAAuB,OAAO;EAEjE,MAAM,YACJ,QAAQ,QAAQ,6BAA6B,KAAA,IACzC,KAAA,UACM,QAAQ,QAAQ,yBAA0B,OAAO;EAE7D,OAAO,SACL,MACA,cAAc,QAAQ,kBACtB,aAAa,QAAQ,oBACvB;CACF;CAEA,MAAM,kBAAkB,MAAuB,UAC7C,KAAK,cAAc,MAAM,aAAa,KAAK,UAAU,MAAM;CAE7D,MAAM,uBACJ,UACA,aACA,QACY;EACZ,IAAI,SAAS,OAAO,SAAS,MAAM,SAAS,SAAS,YAAY,SAAS,IAAI,OAAO;EACrF,MAAM,4BAAY,IAAI,IAAoB;EAE1C,KAAK,MAAM,QAAQ,SAAS,SAAS,aAAa;GAChD,IAAI,UAAU,IAAI,KAAK,YAAY,GAAG,OAAO;GAC7C,UAAU,IAAI,KAAK,cAAc,KAAK,QAAQ;EAChD;EACA,IAAI,SAAS,OAAO,MAAM,UAAU,CAAC,UAAU,IAAI,MAAM,YAAY,CAAC,GAAG,OAAO;EAChF,IAAI,SAAS,OAAO,MAAM,UAAU,MAAM,SAAS,cAAc,MAAM,UAAU,CAAC,GAChF,OAAO;EAET,MAAM,WAAW,SAAS,OAAO,QAAQ,UAAU;GACjD,MAAM,MAAM,MAAM,SAAS,cAAc,MAAM,UAAU;GAEzD,OAAO,OAAO,KAAK,MAAM,YAAY;EACvC,CAAC;EAED,MAAM,UAAU,IAAI,IAAI,SAAS,SAAS,UAAU,MAAM,OAAO,CAAC;EAClE,MAAM,cAAc,IAAI,IAAI,SAAS,KAAK,UAAU,MAAM,YAAY,CAAC;EAEvE,OAAO,YAAY,aAAa,MAC7B,gBACC,YAAY,QAAQ,OAAO,WAAW,QAAQ,IAAI,MAAM,CAAC,KACzD,YAAY,QAAQ,YAAY,sBAChC,SAAS,MACN,WACE,CAAC,YAAY,gBAAgB,MAAM,kBACnC,CAAC,YAAY,qBAAqB,MAAM,kBAC7C,CACJ;CACF;CAEA,MAAM,wBAAwB,OAAO,GAAG,uCAAuC,CAAC,CAAC,WAC/E,OACA;EACA,MAAM,mBAAmB,yBAAyB,MAAM,gBAAgB;EAExE,MAAM,WAAW,OAAO,+BAA+B,MAAM,cAAc,QAAQ,CAAC,CAAC,KACnF,OAAO,SAAS,WAAW,CAC7B;EAEA,MAAM,cAAc,OAAO,4BAA4B,MAAM,cAAc,WAAW;EAEtF,MAAM,aACJ,MAAM,eAAe,KAAA,IACjB,KAAA,IACA,OAAO,2BAA2B,MAAM,UAAU;EAExD,OAAO,OAAO,OAAO;GACnB,GAAG;GACH;GACA,aAAa,OAAO,OAAO;IACzB,UAAU,SAAS,KAAK,SAAS,MAAM,MAAM,YAAY,QAAQ,CAAC;IAClE,eAAe,MAAM,YAAY;GACnC,CAAC;GACD,cAAc,OAAO,OAAO,EAAE,GAAG,MAAM,aAAa,CAAC;GACrD,GAAI,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW;GACjD,eAAe,OAAO,OAAO;IAC3B,WAAW,OAAO,OAAO;KACvB,GAAG,MAAM,cAAc;KACvB,UAAU,yBAAyB,MAAM,cAAc,UAAU,QAAQ;IAC3E,CAAC;IACD;IACA;GACF,CAAC;EACH,CAAC;CACH,CAAC;CAED,MAAM,cAAc,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAC3D,SACA,WACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,SAAgB;EAC1E,MAAM,IAAI,eAAe,OAAO;EAOhC,OAAO;GAAE;GAAiB,MAAK,OALX,WAClB,SAAS,OAAO,CAAC,CAAC,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAAC,MAAM,GAAG,EAAE,IAAI,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,GACtF,OACF,EAAA,CAEoC;EAAG;CACzC,CAAC;CAED,MAAM,iBAAiB,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,YACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EAEnC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,IAAI,GAAG,EAAE,WAAW,WAAW,SAAS,GAAG,GAAG,EAAE,OAAO,WAAW,KAAK,CAAC,CAAC,CAAC,CAChF,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,yBAAyB,OAAO,GAAG,gCAAgC,CAAC,CAAC,WACzE,SACA,UACA,iBACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EAEnC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,IAAI,GAAG,EAAE,UAAU,QAAQ,GAAG,GAAG,EAAE,WAAW,eAAe,CAAC,CAAC,CAAC,CACtE,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,oBAAoB,OAAO,GAAG,mCAAmC,CAAC,CAAC,WACvE,SACA,UACA,YACA,oBACA,SACA;EACA,MAAM,WAAW,OAAO;EAIxB,MAAM,cAAc,OAAO,eAAe,SAAS,YAAY,KAAK,EAAA,CAAG;EAEvE,IAAI,eAAe,KAAA,KAAa,CAAC,QAAQ,WAAW,UAAU,UAAU,GAAG,OAAO,KAAA;EAClF,MAAM,mBAAmB,WAAW,QAAQ,WAAW;EAWvD,MAAM,WAAU,OATW,WACzB,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,GAAG,eAAe,OAAO,CAAC,CAAC,IAAI,gBAAgB,CAAC,CAAC,CACvD,MAAM,CAAC,GACV,OACF,EAAA,CAE4B;EAE5B,IAAI,YAAY,KAAA,KAAa,CAAC,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,GAC1F,OAAO,KAAA;EAET,MAAM,iBAAgB,OADK,eAAe,SAAS,YAAY,OAAO,EAAA,CACpC;EAElC,IACE,kBAAkB,KAAA,KAClB,CAAC,QAAQ,WAAW,UAAU,aAAa,KAC3C,CAAC,QAAQ,UAAU,OAAO,kBAAkB,cAAc,QAAQ,WAAW,UAAU,GAEvF,OAAO,KAAA;EACT,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,gBAAgB;EAErE,IAAI,uBAAuB,KAAA,KAAa,uBAAuB,WAAW,OAAO,KAAA;EAEjF,MAAM,cAAa,OADQ,uBAAuB,SAAS,UAAU,kBAAkB,OAAO,EAAA,CAC/D;EAE/B,IAAI,eAAe,KAAA,GACjB,OAAO;GAAE,iBAAiB;GAAkB;GAAS,YAAY;EAAc;EAMjF,OAAO;GACL,iBAAiB;GACjB;GACA,YAAY;GACZ;GACA,UAAA,OATsB,QAAQ,WAC7B,OAAO;IAAE;IAAU;IAAS,YAAY;IAAe;GAAW,CAAC,CAAC,CACpE,KAAK,OAAO,QAAQ,0BAA0B,CAAC;EAQlD;CACF,CAAC;CAED,MAAM,SACJ,UACA,SACA,eACA,SACG;EACH,IAAI,CAAC,iBAAiB,OAAO,GAAG,OAAO,OAAO,KAAK,YAAY,CAAC;EAEhE,MAAM,MAAM,uBAER,SAAS,aAAa,gBACpB,KAAK,KACH,OAAO,eAAe,oBAAoB,WAAW,GACrD,OAAO,eAAe,iBAAiB,WAA0C,CACnF,CACF,GACF,EAAE,MAAM,cAAc,KAAK,CAC7B,CAAC,CAAC,KAAK,OAAO,KAAK,WAAW,OAAO,KAAK,CAAC;EAE3C,OAAO,cAAc,gBAAgB,OACjC,OAAO,IAAI,aAAa;GACtB,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;GACrD,OAAO,cAAc;GAErB,OAAO,OAAO;EAChB,CAAC,IACD;CACN;CAIA,MAAM,gBAAgB,OAAO,WAAW,WACtC,OACA;EACA,MAAM,iBAAiB,OAAO,OAAO,cAAc,8BAA8B;EAEjF,IAAI,OAAO,OAAO,cAAc,GAAG;EAEnC,MAAM,gBAAgB,OAAO,IAAI,aAAa;GAC5C,MAAM,cAAc,OAAO;GAE3B,IAAI,EAAE,OAAO,MAAM,KAAK,OAAO,eAAe,oBAAoB,WAAW,CAAC,IAC5E,OAAO,OAAO,YAAY;EAC9B,CAAC,CAAC,CAAC,KAAK,gBAAgB;EAExB,IAAI,CAAC,eAAe,MAAM,SAAS,aAAa,GAAG,OAAO,OAAO,YAAY;CAC/E,CAAC;CAED,MAAM,YACJ,UACA,eACA,SAEA,OAAO,IAAI,aAAa;EACtB,IAAI,cAAc,gBAAgB,MAAM;GACtC,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;GACrD,OAAO,cAAc;EACvB;EAEA,OAAO,OAAO,SAAS,aAAa,gBAClC,KAAK,KACH,OAAO,eAAe,oBAAoB,WAAW,GACrD,OAAO,eAAe,iBAAiB,WAA0C,CACnF,CACF;CACF,CAAC;CAEH,MAAM,kCACJ,UACG;EACH,MAAM,aAAa,MAAM,WAAW;EACpC,MAAM,UAAU,WAAW;EAE3B,IACE,WAAW,aAAa,GAAG,MAAM,SAAS,WAC1C,WAAW,YAAY,oBACvB,QAAQ,SAAS,aACjB,MAAM,eAAe,KAAA,KACrB,QAAQ,SAAS,cAAc,MAAM,iBAAiB,aACtD,QAAQ,SAAS,qBAAqB,MAAM,iBAAiB,oBAC7D,CAAC,eAAe,QAAQ,YAAY,MAAM,WAAW,UAAU,GAE/D,OAAO;EAET,MAAM,WAAW,CAAC,GAAG,MAAM,iBAAiB,WAAW,CAAC,CAAC,MAAM,MAAM,UACnE,KAAK,aAAa,cAAc,MAAM,YAAY,CACpD;EAEA,MAAM,SAAS,CAAC,GAAG,QAAQ,SAAS,WAAW,CAAC,CAAC,MAAM,MAAM,UAC3D,KAAK,aAAa,cAAc,MAAM,YAAY,CACpD;EAEA,OACE,SAAS,WAAW,OAAO,UAC3B,SAAS,OACN,MAAM,UACL,KAAK,iBAAiB,OAAO,MAAM,CAAE,gBACrC,KAAK,aAAa,OAAO,MAAM,CAAE,QACrC;CAEJ;CAEA,MAAM,uBAAuB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACrE,eACA,OACA;EACA,MAAM,WAAW,OAAO;EAExB,IAAI,cAAc,UAAU,KAAA,GAAW,OAAO,OAAO,OAAO,KAAK,YAAY,CAAC;EAC9E,MAAM,aAAa,EAAE,MAAM,+BAA+B;EAE1D,MAAM,OAA4B;GAChC;GACA,UAAU,UAAU,SAAS,YAAY,QAAQ,QAAQ,QAAQ,QAAQ,CAAC;EAC5E;EAEA,MAAM,QAAQ,uBAEV,SAAS,aAAa,gBACpB,oBACE,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MACA,OAAO,KAAK,UAAU,SAChB,KACR,CAAC,CAAC,KACA,OAAO,eAAe,iBAAiB,WAA0C,CACnF,CACF,GACF,EAAE,MAAM,cAAc,KAAK,CAC7B;EAEA,IAAI,cAAc,gBAAgB,SAAS,OAAO,iBAAiB,OAAO,OAAO,YAAY;EAC7F,OAAO,cAAc;EAErB,OAAO,OAAO,MAAM,KAClB,OAAO,GAAG,KAAK,GACf,OAAO,YAAY,UAAU;GAC3B,MAAM,SAAS,MAAM,QAAQ;GAE7B,OAAO,MAAM,QAAQ,WAAW,KAC9B,WAAW,KAAA,KACX,MAAM,aAAa,MAAM,KACzB,OAAO,UAAU,aACf,OAAO,QAAQ,IAAI,IACnB,OAAO,UAAU,KAAK;EAC5B,CAAC,CACH;CACF,CAAC;CAED,MAAM,4BAA4B,OAAO,GAAG,2CAA2C,CAAC,CACtF,WACE,SACA,eACA,OACA,QACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,SAAS,OAAO,YACpB,SACA,MAAM,iBAAiB,WACvB,cAAc,OAChB;EAEA,MAAM,MAAM,OAAO;EAEnB,IACE,QAAQ,KAAA,KACR,CAAC,QAAQ,QAAQ,eAAe,IAAI,QAAQ,QAAQ,OAAO,KAC3D,IAAI,QAAQ,QAAQ,sBAAsB,MAAM,iBAAiB,kBAEjE,OAAO,KAAA;EACT,IACE,MAAM,cAAc,UAAU,aAAa,MAAM,YACjD,MAAM,cAAc,UAAU,WAAW,UACzC,MAAM,cAAc,UAAU,cAAc,MAAM,aAClD,MAAM,cAAc,UAAU,SAAS,cAAc,MAAM,iBAAiB,aAC5E,MAAM,cAAc,UAAU,SAAS,qBACrC,MAAM,iBAAiB,oBACxB,MAAM,cAAc,SAAS,WAAuB,MAAM,aAC3D,MAAM,cAAc,SAAS,kBAC3B,MAAM,cAAc,UAAU,iBAChC,MAAM,cAAc,SAAS,SAAS,cAAc,MAAM,iBAAiB,aAC3E,MAAM,cAAc,SAAS,SAAS,qBACpC,MAAM,iBAAiB,oBACxB,WAAW,mBACT,MAAM,eAAe,KAAA,KACpB,MAAM,cAAc,UAAU,uBAAuB,KAAA,IAEzD,OAAO,KAAA;EACT,IACE,MAAM,iBAAiB,YAAY,MAChC,aACC,CAAC,MAAM,cAAc,SAAS,SAAS,YAAY,MAChD,WACC,OAAO,iBAAiB,SAAS,gBACjC,OAAO,aAAa,SAAS,QACjC,CACJ,GAEA,OAAO,KAAA;EACT,IAAI,MAAM,eAAe,KAAA,GAAW;GAClC,MAAM,cAAc,OAAO,eACzB,SACA,MAAM,WAAW,YACjB,cAAc,OAChB,EAAA,CAAG;GAEH,IACE,eAAe,KAAA,KACf,CAAC,QAAQ,WAAW,UAAU,UAAU,KACxC,CAAC,QAAQ,UAAU,OACjB,WAAW,QAAQ,WAAW,YAC9B,OAAO,eACT,KACA,WAAW,QAAQ,WAAW,qBAC5B,MAAM,WAAW,2BAEnB,OAAO,KAAA;EACX;EAEA,MAAM,cAAc,CAClB,GAAG,MAAM,iBAAiB,aAC1B,GAAG,MAAM,cAAc,SAAS,SAAS,WAC3C;EAEA,MAAM,WAAW,IAAI,IAAI,YAAY,KAAK,SAAS,CAAC,KAAK,cAAc,IAAI,CAAC,CAAC;EAE7E,MAAM,KAAK,2BAA2B,OAAO;EAE7C,MAAM,iBACJ,SAAS,SAAS,IACd,CAAC,IACD,OAAO,WACL,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,oBAAoB,KAAK,CAAC,CACvC,MACC,IACE,GAAG,GAAG,WAAW,OAAO,eAAe,GACvC,QAAQ,GAAG,cAAc,CAAC,GAAG,SAAS,KAAK,CAAC,CAAC,CAC/C,CACF,CAAC,CACA,QAAQ,GAAG,YAAY,GAC1B,cAAc,OAChB;EAEN,IAAI,eAAe,WAAW,SAAS,MAAM,OAAO,KAAA;EAEpD,KAAK,MAAM,UAAU,gBAAgB;GACnC,MAAM,SAAS,SAAS,IAAI,OAAO,QAAQ,oBAAoB,aAAa;GAE5E,IACE,WAAW,KAAA,KACX,OAAO,QAAQ,oBAAoB,cAAc,OAAO,YACvD,QAAQ,oBAAoB,WAAW,KAAA,KACtC,QAAQ,oBAAoB,iBAC1B,OAAO,QAAQ,oBAAoB,OACrC,MAAM,MAER,OAAO,KAAA;GACT,SAAS,OAAO,OAAO,YAAY;EACrC;EACA,IAAI,SAAS,SAAS,GAAG,OAAO,KAAA;EAChC,IAAI,MAAM,eAAe,KAAA,GAAW;GAClC,MAAM,cAAc,OAAO,eAAe,SAAS,MAAM,WAAW,YAAY,KAAK,EAAA,CAAG;GAExF,MAAM,cAAc,OAAO,uBACzB,SACA,MAAM,UACN,OAAO,iBACP,cAAc,OAChB,EAAA,CAAG;GAEH,IAAI,eAAe,KAAA,KAAa,eAAe,KAAA,GAAW,OAAO,KAAA;GAEjE,MAAM,WAAW,OAAO,QAAQ,WAAW,OAAO;IAChD,UAAU,MAAM;IAChB,SAAS;IACT;IACA;GACF,CAAC;GAED,IAAI,CAACA,+BAAuB,UAAU,MAAM,UAAU,GAAG,OAAO,KAAA;EAClE;EACA,MAAM,qBAAqB,OAAO,QAAQ,QAAQ,wBAAwB,KAAK,MAAM;EACrF,MAAM,MAAM,OAAO;EAEnB,IACE,CAAC,oBAAoB,MAAM,cAAc,UAAU,MAAM,cAAc,aAAa,GAAG,KACvF,CAAC,oBAAoB,MAAM,cAAc,UAAU,oBAAoB,GAAG,GAE1E,OAAO,KAAA;EACT,IACE,MAAM,aAAa,qBAAqB,eACxC,QAAQ,wBAAwB,4BAEhC,OAAO,KAAA;EAET,OAAO;GAAE,GAAG;GAAQ;EAAI;CAC1B,CACF;CAEA,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,UACA,WACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,eAAe,OAAO;EAEhC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,IAAI,GAAG,EAAE,UAAU,QAAQ,GAAG,GAAG,EAAE,WAAW,SAAS,CAAC,CAAC,CAAC,CAChE,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,OACA,QACA,KACA;EAGA,OAAO,QAAO,OAFU,mBAAA,CAED,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,OACnD,QAAQ,QAAQ,aAAa;GAC3B,UAAU,MAAM;GAChB,WAAW,MAAM;GACjB;GACA,eAAe,MAAM,cAAc,UAAU;GAC7C,UAAU;GACV,sBAAsB,MAAM,QAAQ;EACtC,CAAC,CACH;CACF,CAAC;CAED,MAAM,yBAAyB,OAAO,GAAG,wCAAwC,CAAC,CAAC,WACjF,SACA,OACA,iBACA,SACA,qBACA,KACA;EACA,IACE,YAAY,KAAA,KACZ,CAAC,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,KAC/D,wBAAwB,KAAA,KACvB,QAAQ,oBAAoB,WAAW,KAAA,KACtC,QAAQ,oBAAoB,iBAC1B,oBAAoB,QAAQ,oBAAoB,OAClD,MAAM,MAER,OAAO;EACT,IAAI,MAAM,eAAe,KAAA,GAAW;GAClC,MAAM,cAAc,OAAO,eAAe,SAAS,MAAM,WAAW,YAAY,KAAK,EAAA,CAAG;GAExF,IACE,eAAe,KAAA,KACf,CAAC,QAAQ,WAAW,UAAU,UAAU,KACxC,CAAC,QAAQ,UAAU,OAAO,WAAW,QAAQ,WAAW,YAAY,eAAe,KACnF,WAAW,QAAQ,WAAW,qBAC5B,MAAM,WAAW,2BAEnB,OAAO;GAET,MAAM,cAAc,OAAO,uBACzB,SACA,MAAM,UACN,iBACA,KACF,EAAA,CAAG;GAEH,IAAI,eAAe,KAAA,GAAW,OAAO;GASrC,KAAI,OAPmB,QAAQ,WAAW,OAAO;IAC/C,UAAU,MAAM;IAChB;IACA;IACA;GACF,CAAC,EAAA,CAEW,+BAA+B,MAAM,WAAW,4BAC1D,OAAO;EACX;EACA,MAAM,OAAO,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,WAAW,KAAK;EACjF,MAAM,MAAM,KAAK;EAEjB,OACE,KAAK,WAAW,KAChB,IAAI,QAAQ,QAAQ,YAAY,MAAM,cAAc,UAAU,UAC9D,IAAI,QAAQ,QAAQ,mBAAmB,MAAM,cAAc,UAAU,iBACrE,IAAI,QAAQ,QAAQ,cAAc,cACjC,OAAO,QAAQ,cAAc,IAAI,QAAQ,QAAQ,eAAe,OAC/D,MAAM,QAAQ;CAEpB,CAAC;CAED,MAAM,gBAAgB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAC/D,SACA,eACA,OACA,WAMA,YACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,EAAE,cAAc,oBAAoB,iBAAiB,yBAAyB;EAEpF,MAAM,YAAY,OAAO,0BACvB,SACA,eACA,OACA,cACF;EAEA,IAAI,cAAc,KAAA,GAAW,OAAO;EACpC,KAAK,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,WAAW,IAAI,EAAA,CAAG,QAAQ,OAAO;EAC1F,KACG,OAAO,uBAAuB,SAAS,MAAM,UAAU,UAAU,iBAAiB,IAAI,EAAA,CACpF,QAEH,OAAO;EAET,OAAO,SAAS,OAAO,QAAQ,WAAW,KAAK,CAAC,CAAC,OAC/C,QAAQ,WAAW,aAAa;GAC9B,UAAU,MAAM;GAChB,WAAW,UAAU;GACrB;GACA;GACA;GACA,aAAa,MAAM;EACrB,CAAC,CACH;EACA,OAAO,SAAS,OAAO,QAAQ,oBAAoB,KAAK,CAAC,CAAC,OACxD,QAAQ,oBAAoB,aAAa;GACvC,WAAW,UAAU;GACrB;GACA,UAAU;EACZ,CAAC,CACH;EACA,OAAO,SACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,IAAI,aAAa,CAAC,CAAC,QAAQ,QAAQ,kBAAkB,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAC7E,MACC,IACE,GAAG,eAAe,OAAO,CAAC,CAAC,IAAI,UAAU,eAAe,GACxD,GAAG,eAAe,OAAO,CAAC,CAAC,kBAAkB,MAAM,iBAAiB,gBAAgB,CACtF,CACF;EACF,OAAO,cAAc,SAAS,OAAO,gBAAgB,cAAc,UAAU,GAAG;EAEhF,MAAM,UAAU,qBACd,SACA,OACA,UAAU,iBACV,WACA,cAAc,UAAU,GAC1B;EAEA,IAAI,EAAE,OAAO,UAAU,OAAO,OAAO,YAAY;EACjD,OAAO,cAAc,OAAO;EAE5B,OAAO;CACT,CAAC;CAED,MAAM,6BAA6B,OAAO,GAAG,4BAA4B,CAAC,CAAC,WACzE,SACA,eAKA;EACA,MAAM,WAAW,OAAO;EAExB,IAAI,CAAC,cAAc,aACjB,QACE,WAAW,kBAAkB;GAC3B,GAAG;GACH,OAAO,cAAc,OAAO;EAC9B,CAAC,KAAK,OAAO,KAAA,CACb,KAAK,OAAO,SAAS,WAAW,CAAC;EACrC,MAAM,QAAQ,OAAO;EAErB,IAAI,CAAC,iBAAiB,OAAO,GAAG,OAAO,OAAO,YAAY;EAC1D,MAAM,OAAO,OAAO;EAEpB,MAAM,cAAc,OAAO,wBACzB,OAAO,iBAAiB,aAAa,KAAK,QAAQ,kBAAkB,GAAG,IAAI,CAAC,CAAC,CAAC,KAC5E,gBACF,GACA,SACA,aACF;EAEA,OAAO,oBAAoB,GAAG;GAC5B,GAAG;GACH,iBAAiB,UACf,SACE,UACA,eACA,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAE3B,MAAM,SAAS,OAAO,YAAY,SAAS,MAAM,WAAW,KAAK;IAEjE,IACE,OAAO,QAAQ,KAAA,KACf,CAAC,QAAQ,QAAQ,eAAe,OAAO,IAAI,QAAQ,QAAQ,OAAO,GAElE,OAAO,OAAO,KAAK;IAErB,MAAM,cAAc,OAAO,uBACzB,SACA,MAAM,UACN,OAAO,iBACP,KACF,EAAA,CAAG;IAEH,IAAI,eAAe,KAAA,GAAW,OAAO,OAAO,KAAK;IACjD,MAAM,KAAK,kBAAkB,OAAO;IAOpC,MAAM,cAAa,OALQ,YACxB,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,GAAG,GAAG,WAAW,OAAO,eAAe,CAAC,EAAA,CAElB,MAAM,QAAa,QAAQ,WAAW,UAAU,GAAG,CAAC;IAEnF,IAAI,eAAe,KAAA,GAAW,OAAO,OAAO,KAAK;IAEjD,MAAM,WAAW,OAAO,QAAQ,WAC7B,OAAO;KACN,UAAU,MAAM;KAChB,SAAS,OAAO;KAChB;KACA;IACF,CAAC,CAAC,CACD,KAAK,OAAO,QAAQ,0BAA0B,CAAC;IAElD,OAAO,OAAO,KAAK,QAAQ;GAC7B,CAAC,CACH,CAAC,CAAC,KACA,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,iBAAiB,UACf,SACE,UACA,eACA,OAAO,IAAI,aAAa;IACtB,MAAM,WAAW,OAAO,kBACtB,SACA,MAAM,UACN,MAAM,YACN,KAAA,GACA,KACF;IAEA,OAAO,UAAU,aAAa,KAAA,KAC5B,SAAS,SAAS,+BAA+B,KAAA,IAC/C,OAAO,KAAK,IACZ,OAAO,KAAK,SAAS,QAAQ;GACnC,CAAC,CACH,CAAC,CAAC,KACA,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,cAAc,YAAY,YACxB,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,OAAO,sBAAsB,UAAU;IAErD,MAAM,eAAe,OAAO,SAC1B,cAAc,MACd,QAAQ,sBACR,QAAQ,wBACV;IAEA,MAAM,qBAAqB,OAAO,SAChC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,kBAAkB,OAAO,SAC7B,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,uBAAuB,OAAO,6BAClC,SACA,cAAc,MACd,MAAM,iBAAiB,gBACzB;IAEA,IAAI,yBAAyB,MAAM,iBAAiB,kBAClD,OAAO,OAAO,YAAY;IAE5B,OAAO,OAAO,MACZ,UACA,SACA,eACA,OAAO,IAAI,aAAa;KACtB,MAAM,UAAU,OAAO;KASvB,OAAO,SAAQ,OAPQ,cAAc,SAAS,eAAe,OAAO;MAClE;MACA;MACA;MACA;KACF,CAAC,KAEwB,YAAY,YAAY,OAAO;IAC1D,CAAC,CACH;GACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,mBAAmB,YAAY,YAC7B,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,OAAO,sBAAsB,UAAU;IAErD,MAAM,qBAAqB,OAAO,SAChC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,kBAAkB,OAAO,SAC7B,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,uBAAuB,OAAO,6BAClC,SACA,cAAc,MACd,MAAM,iBAAiB,gBACzB;IAEA,IACE,yBAAyB,MAAM,iBAAiB,oBAC/C,MAAM,eAAe,KAAA,KACpB,uBAAuB,MAAM,WAAW,oBAE1C,OAAO,OAAO,YAAY;IAE5B,OAAO,OAAO,MACZ,UACA,SACA,eACA,OAAO,IAAI,aAAa;KACtB,OAAO,OAAO,UACZ,SACA,eACA,OACA,mBACA;MAAE;MAAoB;MAAiB;KAAqB,GAC5D,OACF;IACF,CAAC,CACH;GACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,aAAa,WACV,cAAc,UAAU,KAAA,IACrB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI,aAAa;IACtB,IACE,MAAM,SAAS,UAAU,KACzB,CAAC,MAAM,SAAS,SAAS,QAAQ,KACjC,MAAM,YAAY,oBAClB,MAAM,QAAQ,SAAS,WAEvB,OAAO;IACT,MAAM,UAAU,MAAM;IACtB,MAAM,mBAAmB,MAAM,SAAS,MAAM,GAAG,EAAgB;IA6BjE,QAAO,OA3BgB,SACrB,UACA,eACA,OAAO,IAAI,aAAa;KACtB,MAAM,WAAW,OAAO,kBACtB,SACA,kBACA,QAAQ,YACR,QAAQ,SAAS,WACjB,KACF;KAEA,OACE,UAAU,aAAa,KAAA,KACvB,SAAS,SAAS,SAAS,qBACzB,QAAQ,SAAS,oBACnB,QAAQ,SAAS,YAAY,OAAO,SAClC,SAAS,SAAU,SAAS,YAAY,MACrC,WACC,OAAO,iBAAiB,KAAK,gBAC7B,OAAO,aAAa,KAAK,QAC7B,CACF;IAEJ,CAAC,CACH,KAEiB,OAAO,qBAAqB,eAAe,KAAK,IAAI;GACvE,CAAC,EAAA,CACH,KACA,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,iBAAiB,YAAY,aAC1B,cAAc,UAAU,KAAA,IACrB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,OAAO,OAAO;KAC1B,GAAI,OAAO,sBAAsB,UAAU;KAC3C,YAAY,WAAW;IACzB,CAAC;IAED,MAAM,qBAAqB,OAAO,SAChC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,kBAAkB,OAAO,SAC7B,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,uBAAuB,OAAO,6BAClC,SACA,cAAc,MACd,MAAM,iBAAiB,gBACzB;IAEA,IACE,yBAAyB,MAAM,iBAAiB,oBAC/C,MAAM,eAAe,KAAA,KACpB,uBAAuB,MAAM,WAAW,oBAE1C,OAAO,OAAO,YAAY;IAE5B,OAAO,OAAO,MACZ,UACA,SACA,eACA,OAAO,IAAI,aAAa;KACtB,MAAM,UAAU,OAAO;KAEvB,IAAI,CAAC,+BAA+B,KAAK,GAAG,OAAO,QAAQ,YAAY,OAAO;KAE9E,MAAM,YAAY,OAAO,0BACvB,SACA,eACA,OACA,gBACF;KAEA,IAAI,cAAc,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;KAC/D,KAAK,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,WAAW,IAAI,EAAA,CAAG,QACzE,OAAO,QAAQ,YAAY,OAAO;KAQpC,IAAI,EAAC,OANkB,0BACrB,SACA,OACA,UAAU,eACZ,IAEc,OAAO,QAAQ,YAAY,OAAO;KAChD,IAAI;KAEJ,OAAO,oBACL,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MAAM,YACN,OAAO,IAAI,aAAa;MACtB,MAAM,YAAY;OAChB;OACA;OACA;MACF;MAEA,MAAM,UAAU,OAAO,iBACrB,SACA,OACA,UAAU,iBACV,WACA,UAAU,GACZ;MAEA,IAAI,SACF,OAAO,oBACL,SACA,OACA,UAAU,iBACV,WACA,UAAU,GACZ;MAEF,OAAO;KACT,CAAC,IACA,aAAa;MACZ,kBAAkB,QAChB,aAAa,cAAc,YAAY,YACvC,OACF;MAEA,OAAO;KACT,CACF;KAEA,OAAO,mBAAmB,QAAQ,YAAY,OAAO;IACvD,CAAC,CACH;GACF,CAAC,EAAA,CACH,KACA,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACJ,CAAC;CACH,CAAC;CAED,MAAM,4BAA4B,OAAO,GAAG,2CAA2C,CAAC,CACtF,WAAW,SAAkB,OAA8B,iBAA0B;EACnF,IAAI,MAAM,eAAe,KAAA,GAAW,OAAO;EAE3C,MAAM,OAAO,OAAO,uBAClB,SACA,MAAM,UACN,iBACA,IACF,EAAA,CAAG;EAEH,IAAI,QAAQ,KAAA,GAAW,OAAO;EAE9B,OACE,IAAI,QAAQ,WAAW,kBAAkB,MAAM,WAAW,gBAC1D,IAAI,QAAQ,WAAW,wBAAwB,MAAM,WAAW,sBAChE,IAAI,QAAQ,WAAW,qBAAqB,MAAM,WAAW,mBAC7D,IAAI,QAAQ,WAAW,cAAc,SAAS,MAAM,MAAM,WAAW,QAAQ,KAC7E,IAAI,QAAQ,WAAW,mBAAmB,MAAM,WAAW,iBAC3D,MAAM,cAAc,UAAU,uBAAuB,MAAM,WAAW;CAE1E,CACF;CAEA,MAAM,uBAAuB,OAAO,GAAG,sCAAsC,CAAC,CAAC,WAC7E,SACA,OACA,iBACA,WAMA,KACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO,GACjC,IAAI,eAAe,OAAO;EAE5B,MAAM,cAAc,OAAO,SACxB,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,WAAW,eAAe,GAC/B,GAAG,EAAE,cAAc,UAAU,YAAY,GACzC,GAAG,EAAE,oBAAoB,UAAU,kBAAkB,GACrD,GAAG,EAAE,iBAAiB,UAAU,eAAe,GAC/C,GAAG,EAAE,UAAU,SAAS,MAAM,MAAM,YAAY,QAAQ,CAAC,GACzD,GAAG,EAAE,eAAe,MAAM,YAAY,aAAa,CACrD,CACF,CAAC,CACA,MAAM,CAAC,EAAA,CAAG;EAEb,MAAM,WAAW,OAAO,SACrB,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,IAAI,GAAG,EAAE,IAAI,eAAe,GAAG,GAAG,EAAE,kBAAkB,UAAU,oBAAoB,CAAC,CAAC,CAAC,CAC7F,MAAM,CAAC,EAAA,CAAG;EAEb,MAAM,uBAAuB,OAAO,SACjC,OAAO,CAAC,CACR,KAAK,QAAQ,oBAAoB,KAAK,CAAC,CACvC,MACC,IACE,GAAG,2BAA2B,OAAO,CAAC,CAAC,WAAW,eAAe,GACjE,GAAG,2BAA2B,OAAO,CAAC,CAAC,cAAc,UAAU,YAAY,GAC3E,GAAG,2BAA2B,OAAO,CAAC,CAAC,UAAU,UAAU,kBAAkB,CAC/E,CACF,CAAC,CACA,MAAM,CAAC,EAAA,CAAG;EAGb,OACE,eAAe,KAAA,KACf,WAAW,QAAQ,WAAW,kBAAkB,UAAU,gBAC1D,WAAW,QAAQ,WAAW,wBAAwB,UAAU,sBAChE,WAAW,QAAQ,WAAW,qBAAqB,UAAU,mBAC7D,WAAW,QAAQ,WAAW,cAAc,SAAS,MAAM,MAAM,YAAY,QAAQ,KACrF,WAAW,QAAQ,WAAW,mBAAmB,MAAM,YAAY,kBAClE,OAAO,uBACN,SACA,OACA,iBACA,SACA,qBACA,GACF;CAEJ,CAAC;CAED,MAAM,mBAAmB,OAAO,GAAG,kCAAkC,CAAC,CAAC,WACrE,SACA,OACA,iBACA,WAKA,KACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EACnC,MAAM,IAAI,eAAe,OAAO;EAEhC,OAAO,SACJ,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,IACC,QAAQ,WAAW,kBAAkB;GACnC,aAAa,MAAM;GACnB,oBAAoB,UAAU;GAC9B,iBAAiB,UAAU;EAC7B,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,WAAW,eAAe,GAC/B,GAAG,EAAE,cAAc,MAAM,WAAY,YAAY,GACjD,GAAG,EAAE,oBAAoB,MAAM,WAAY,kBAAkB,GAC7D,GAAG,EAAE,iBAAiB,MAAM,WAAY,eAAe,GACvD,GAAG,EAAE,UAAU,SAAS,MAAM,MAAM,WAAY,QAAQ,CAAC,GACzD,GAAG,EAAE,eAAe,MAAM,WAAY,aAAa,CACrD,CACF;EACF,OAAO,SACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,IAAI,aAAa,CAAC,CAAC,QAAQ,QAAQ,kBAAkB,UAAU,oBAAoB,CAAC,CAAC,CAAC,CAAC,CACvF,MACC,IACE,GAAG,EAAE,IAAI,eAAe,GACxB,GAAG,EAAE,kBAAkB,MAAM,iBAAiB,gBAAgB,CAChE,CACF;EACF,OAAO,SACJ,OAAO,QAAQ,oBAAoB,KAAK,CAAC,CACzC,IAAI,QAAQ,oBAAoB,eAAe,UAAU,kBAAkB,CAAC,CAAC,CAC7E,MACC,IACE,GAAG,2BAA2B,OAAO,CAAC,CAAC,WAAW,eAAe,GACjE,GAAG,2BAA2B,OAAO,CAAC,CAAC,cAAc,MAAM,WAAY,YAAY,GACnF,GAAG,2BAA2B,OAAO,CAAC,CAAC,UAAU,MAAM,WAAY,kBAAkB,CACvF,CACF;EACF,OAAO,cAAc,SAAS,OAAO,MAAM,cAAc,UAAU,QAAQ,GAAG;EAE9E,OAAO,OAAO,qBACZ,SACA,OACA,iBACA;GACE,GAAG;GACH,cAAc,MAAM,WAAY;EAClC,GACA,GACF;CACF,CAAC;CAED,MAAM,uBACJ,SACA,OACA,iBACA,WAKA,QAEA,cACE,qBACE,SACA,OACA,iBACA;EAAE,GAAG;EAAW,cAAc,MAAM,WAAY;CAAa,GAC7D,GACF,CACF;CAEF,MAAM,YAAY,OAAO,GAAG,mBAAmB,CAAC,CAAC,WAC/C,SACA,eACA,OACA,QACA,WAKA,SACA;EACA,MAAM,UAAU,OAAO;EAEvB,MAAM,YAAY,OAAO,0BAA0B,SAAS,eAAe,OAAO,MAAM;EAExF,IAAI,cAAc,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;EAC/D,KAAK,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,WAAW,IAAI,EAAA,CAAG,QACzE,OAAO,QAAQ,YAAY,OAAO;EACpC,IAAI,EAAE,OAAO,0BAA0B,SAAS,OAAO,UAAU,eAAe,IAC9E,OAAO,QAAQ,YAAY,OAAO;EACpC,MAAM,WAAW,QAAQ,WAAW,OAAO;EAE3C,IACE,EAAE,OAAO,iBACP,SACA,OACA,UAAU,iBACV,WACA,UAAU,GACZ,IAEA,OAAO,OAAO,YAAY;EAC5B,OAAO,oBAAoB,SAAS,OAAO,UAAU,iBAAiB,WAAW,UAAU,GAAG;EAE9F,OAAO;CACT,CAAC;CA4BD,OAAO;EAAE;EAA4B,mBAAA;GAxBnC;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA,wBAAA;GACA;GACA;GACA;GACA;GACA;EAGmD;CAAE;AACzD"}

package/dist/internal/persistence.d.mts

@@ -1,9 +1,9 @@
 import { NativeDatabase } from "./transaction-kernel.mjs";
 import { QueryOperations } from "./query-operations.mjs";
 import { CurrentProofSql } from "./proof-kernel.mjs";
-import { NativeSqlTables } from "./native-sql-table.mjs";
 import { StorageTable } from "./storage-tables.mjs";
 import { MappingInput, PasskeyFeature, PersistenceApi, PersistenceConfigurationError } from "./configuration.mjs";
+import { NativeSqlTables } from "./native-sql-table.mjs";
 import { Context, Crypto, Effect } from "effect";
 import { SqlClient } from "effect/sql";
 import { PasskeyConfig } from "@yielded/auth/Passkey";

package/dist/internal/persistence.mjs

@@ -10,9 +10,9 @@ import { CurrentEmailSql, makeEmailKernel } from "./email-kernel.mjs";
 import { CurrentPasswordSql, makePasswordKernel } from "./password-kernel.mjs";
 import { CurrentPhoneTransaction, makePhoneKernel } from "./phone-kernel.mjs";
 import { makeRegistrationAuthority } from "./registration.mjs";
+import { validateStorageBatch, withStorageValidation } from "./storage-validation.mjs";
 import { CurrentSessionSql, makeSessionKernel } from "./session-kernel.mjs";
 import { makeMappings } from "./storage-mapping.mjs";
-import { validateStorageBatch, withStorageValidation } from "./storage-validation.mjs";
 import { Context, Effect, Layer, Schema } from "effect";
 import { SqlClient } from "effect/sql";
 import { LifecycleHooks } from "@yielded/auth/Hooks";
@@ -65,7 +65,7 @@ const createPersistence = (backend) => {
 			"sessions",
 			"sessionFlows"
 		];
-		if (password) roles.push("passwords", "passwordAttempts", "passwordCommands");
+		if (password) roles.push("passwords", "passwordCommands");
 		if (management) roles.push("passwordRegistrations");
 		if (email) roles.push("emailCredentials", "emailCommands");
 		if (phone) roles.push("phoneState");