@yielded/auth-persistence 0.1.0-beta.23 → 0.1.0-beta.25

package/dist/internal/password-kernel.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"password-kernel.mjs","names":["sameCredentialSnapshot"],"sources":["../../src/internal/password-kernel.ts"],"sourcesContent":["import {\n  coordinateCommit,\n  CurrentCommitJournal,\n  hasCommitScope,\n  type CommitJournal,\n  type PreparedCommit,\n  LifecycleHooks,\n  HookConfigurationError,\n} from \"@yielded/auth/Hooks\";\nimport type { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport {\n  PasswordUnavailable,\n  PasswordPersistence,\n  type PasswordMutationInput,\n  snapshotPasswordCredential,\n  snapshotPasswordRequirement,\n  snapshotPasswordRevision,\n  type PasswordAction,\n  type PasswordMutationDecision,\n} from \"@yielded/auth/Password\";\nimport { reportPersistenceFailure } from \"@yielded/auth/Persistence\";\nimport {\n  type ProofCompletionPlan,\n  type ProofCompletionInput,\n  ProofUnavailable,\n} from \"@yielded/auth/Proofs\";\nimport {\n  snapshotAuthenticationEvidence,\n  type AuthenticationEvidence,\n  type AuthenticationRequirement,\n  type SecurityRevision,\n} from \"@yielded/auth/Sessions\";\nimport { Cause, Context, DateTime, Effect, Option, Redacted, Schema } from \"effect\";\nimport type { SqlClient } from \"effect/sql/SqlClient\";\nimport type * as SqlError from \"effect/sql/SqlError\";\n\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport {\n  type AnyPasswordPersistenceMapping,\n  requiredPasswordConstraints,\n} from \"./models/password-model\";\nimport { makeNativeSqlTables, sqlMapping, type NativeSqlTables } from \"./native-sql-table\";\nimport {\n  makePasswordAttempts,\n  samePasswordCredentialSnapshot as sameCredentialSnapshot,\n} from \"./password-attempts\";\nimport {\n  CurrentPasswordPreparedTransaction,\n  PasswordPreparedPostconditions,\n} from \"./PasswordPreparedPostconditions\";\nimport {\n  CurrentProofSql,\n  type ProofSqlConfiguration,\n  type ProofSqlDatabase,\n  type makeProofKernel,\n} from \"./proof-kernel\";\n/* oxlint-disable no-explicit-any -- existing storage kernels erase foreign table shapes; domain errors remain typed. */\nimport type { QueryFailure } from \"./query-operations\";\nimport type { QueryOperations, SqlFragment, SqlColumn } from \"./query-operations\";\nimport { NativeDatabase } from \"./transaction-kernel\";\n\ntype AdapterFailure = QueryFailure | PersistenceMappingError | SqlError.SqlError;\n\nexport interface PasswordSqlQuery<A = ReadonlyArray<any>> extends Effect.Effect<A, AdapterFailure> {\n  readonly getSQL: () => ReturnType<QueryOperations[\"sql\"]>;\n  readonly from: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly where: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly limit: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly orderBy: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly for: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly set: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly values: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly returning: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly $returningId: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly onConflictDoNothing: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly onDuplicateKeyUpdate: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n}\n\nexport interface PasswordSqlDatabase {\n  readonly select: (...args: ReadonlyArray<any>) => PasswordSqlQuery;\n  readonly insert: (...args: ReadonlyArray<any>) => PasswordSqlQuery;\n  readonly update: (...args: ReadonlyArray<any>) => PasswordSqlQuery;\n  readonly delete: (...args: ReadonlyArray<any>) => PasswordSqlQuery;\n  readonly transaction: <A, E, R>(\n    body: (transaction: PasswordSqlDatabase) => Effect.Effect<A, E, R>,\n  ) => Effect.Effect<A, E | SqlError.SqlError, R>;\n}\n\nexport class CurrentPasswordSql extends Context.Service<CurrentPasswordSql, PasswordSqlDatabase>()(\n  \"effect-auth/CurrentPasswordSql\",\n) {}\n\nexport interface PasswordSqlConfiguration {\n  readonly mode: \"interactive\" | \"synchronous\";\n  readonly locking: boolean;\n  readonly standaloneGuard: Effect.Effect<void, PasswordUnavailable>;\n  readonly coordinated?: boolean;\n  readonly insertIfAbsent: (\n    query: PasswordSqlQuery,\n    selfKey: string,\n    selfValue: unknown,\n  ) => PasswordSqlQuery;\n  readonly proof?: {\n    readonly mapping: any;\n    readonly configuration: ProofSqlConfiguration;\n  };\n}\n\ntype Database = PasswordSqlDatabase;\n\nexport const makePasswordKernel = <\n  Fragment extends SqlFragment = SqlFragment,\n  Column extends SqlColumn = SqlColumn,\n>(\n  operations: QueryOperations<Fragment, Column>,\n  proofs: Pick<ReturnType<typeof makeProofKernel>, \"completeProofPlanIn\">,\n  nativeTables: (client: SqlClient, database: object) => NativeSqlTables = (client) =>\n    makeNativeSqlTables(client),\n) => {\n  type Mapping = AnyPasswordPersistenceMapping<Fragment>;\n\n  const { and, eq, inArray, lte, column, updateValues } = operations;\n  const { completeProofPlanIn } = proofs;\n  const unavailable = () => PasswordUnavailable.make({});\n\n  const translateFailure = <A, E, R>(\n    effect: Effect.Effect<A, E, R>,\n  ): Effect.Effect<A, PasswordUnavailable, R> =>\n    reportPersistenceFailure(\n      effect,\n      (error) =>\n        Schema.is(PasswordUnavailable)(error) ||\n        Schema.is(ProofUnavailable)(error) ||\n        Schema.is(HookConfigurationError)(error),\n    ).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));\n\n  const nowMillis = DateTime.now.pipe(Effect.map(DateTime.toEpochMillis));\n\n  const validConstraints = (mapping: Mapping) =>\n    Object.entries(requiredPasswordConstraints).every(\n      ([key, value]) =>\n        mapping.constraints[key as keyof typeof requiredPasswordConstraints] === value,\n    );\n\n  const selectRows = (query: PasswordSqlQuery, locking: boolean) =>\n    locking && typeof query.for === \"function\" ? query.for(\"update\") : query;\n\n  const subjectColumns = (mapping: Mapping) => ({\n    id: column(mapping.subject.table, mapping.subject.id),\n    status: column(mapping.subject.table, mapping.subject.status),\n    securityRevision: column(mapping.subject.table, mapping.subject.securityRevision),\n  });\n\n  const identifierColumns = (mapping: Mapping) => ({\n    namespace: column(mapping.identifier.table, mapping.identifier.namespace),\n    value: column(mapping.identifier.table, mapping.identifier.value),\n    subjectId: column(mapping.identifier.table, mapping.identifier.subjectId),\n    verifiedAt: column(mapping.identifier.table, mapping.identifier.verifiedAt),\n    bindingRevision: column(mapping.identifier.table, mapping.identifier.bindingRevision),\n  });\n\n  const credentialColumns = (mapping: Mapping) => ({\n    moduleId: column(mapping.credential.table, mapping.credential.moduleId),\n    subjectId: column(mapping.credential.table, mapping.credential.subjectId),\n    credentialId: column(mapping.credential.table, mapping.credential.credentialId),\n    credentialRevision: column(mapping.credential.table, mapping.credential.credentialRevision),\n    verifierVersion: column(mapping.credential.table, mapping.credential.verifierVersion),\n    verifier: column(mapping.credential.table, mapping.credential.verifier),\n    normalization: column(mapping.credential.table, mapping.credential.normalization),\n  });\n\n  const authorityCredentialColumns = (mapping: Mapping) => ({\n    subjectId: column(mapping.authorityCredential.table, mapping.authorityCredential.subjectId),\n    credentialId: column(\n      mapping.authorityCredential.table,\n      mapping.authorityCredential.credentialId,\n    ),\n    revision: column(mapping.authorityCredential.table, mapping.authorityCredential.revision),\n  });\n\n  const attemptColumns = (mapping: Mapping) => ({\n    moduleId: column(mapping.attempt.table, mapping.attempt.moduleId),\n    action: column(mapping.attempt.table, mapping.attempt.action),\n    attemptId: column(mapping.attempt.table, mapping.attempt.attemptId),\n    identifierNamespace: column(mapping.attempt.table, mapping.attempt.identifierNamespace),\n    identifierValue: column(mapping.attempt.table, mapping.attempt.identifierValue),\n    subjectId: column(mapping.attempt.table, mapping.attempt.subjectId),\n    credentialId: column(mapping.attempt.table, mapping.attempt.credentialId),\n    securityRevision: column(mapping.attempt.table, mapping.attempt.securityRevision),\n    credentialRevision: column(mapping.attempt.table, mapping.attempt.credentialRevision),\n    verifierVersion: column(mapping.attempt.table, mapping.attempt.verifierVersion),\n    identifierBindingRevision: column(\n      mapping.attempt.table,\n      mapping.attempt.identifierBindingRevision,\n    ),\n    admittedAt: column(mapping.attempt.table, mapping.attempt.admittedAt),\n    deadline: column(mapping.attempt.table, mapping.attempt.deadline),\n    retentionUntil: column(mapping.attempt.table, mapping.attempt.retentionUntil),\n    state: column(mapping.attempt.table, mapping.attempt.state),\n  });\n\n  const commandColumns = (mapping: Mapping) => ({\n    moduleId: column(mapping.command.table, mapping.command.moduleId),\n    commandId: column(mapping.command.table, mapping.command.commandId),\n    action: column(mapping.command.table, mapping.command.action),\n    bindingDigest: column(mapping.command.table, mapping.command.bindingDigest),\n    decision: column(mapping.command.table, mapping.command.decision),\n    retentionUntil: column(mapping.command.table, mapping.command.retentionUntil),\n  });\n\n  const allocate = <A>(\n    mode: PasswordSqlConfiguration[\"mode\"],\n    asyncValue: Effect.Effect<A, PersistenceMappingError> | undefined,\n    syncValue: (() => A) | undefined,\n  ): Effect.Effect<A, PasswordUnavailable | PersistenceMappingError> => {\n    if (mode === \"synchronous\")\n      return syncValue === undefined\n        ? Effect.fail(unavailable())\n        : Effect.try({\n            try: syncValue,\n            catch: (cause) => new PersistenceMappingError({ operation: \"mapping\", cause }),\n          });\n    if (asyncValue !== undefined) return asyncValue;\n\n    return syncValue === undefined\n      ? Effect.fail(unavailable())\n      : Effect.try({\n          try: syncValue,\n          catch: (cause) => new PersistenceMappingError({ operation: \"mapping\", cause }),\n        });\n  };\n\n  const allocateNextSecurityRevision = (\n    mapping: Mapping,\n    mode: PasswordSqlConfiguration[\"mode\"],\n    current: SecurityRevision,\n  ) => {\n    const asyncValue = mapping.subject.nextSecurityRevision?.(current);\n\n    const syncValue =\n      mapping.subject.nextSecurityRevisionSync === undefined\n        ? undefined\n        : () => mapping.subject.nextSecurityRevisionSync!(current);\n\n    return allocate(\n      mode,\n      asyncValue ?? mapping.allocateRevision,\n      syncValue ?? mapping.allocateRevisionSync,\n    );\n  };\n\n  const sameIdentifier = (left: LoginIdentifier, right: LoginIdentifier) =>\n    left.namespace === right.namespace && left.value === right.value;\n\n  const evidenceSatisfiedAt = (\n    evidence: AuthenticationEvidence,\n    requirement: AuthenticationRequirement,\n    now: number,\n  ): boolean => {\n    if (evidence.proofs.length > 64 || evidence.revision.credentials.length > 64) return false;\n    const revisions = new Map<string, string>();\n\n    for (const item of evidence.revision.credentials) {\n      if (revisions.has(item.credentialId)) return false;\n      revisions.set(item.credentialId, item.revision);\n    }\n    if (evidence.proofs.some((proof) => !revisions.has(proof.credentialId))) return false;\n    if (evidence.proofs.some((proof) => now < DateTime.toEpochMillis(proof.verifiedAt)))\n      return false;\n\n    const eligible = evidence.proofs.filter((proof) => {\n      const age = now - DateTime.toEpochMillis(proof.verifiedAt);\n\n      return age >= 0 && age < requirement.maximumAgeMillis;\n    });\n\n    const factors = new Set(eligible.flatMap((proof) => proof.factors));\n    const credentials = new Set(eligible.map((proof) => proof.credentialId));\n\n    return requirement.alternatives.some(\n      (alternative) =>\n        alternative.factors.every((factor) => factors.has(factor)) &&\n        credentials.size >= alternative.minimumCredentials &&\n        eligible.some(\n          (proof) =>\n            (!alternative.userVerified || proof.userVerified) &&\n            (!alternative.phishingResistant || proof.phishingResistant),\n        ),\n    );\n  };\n\n  const snapshotMutationInput = Effect.fn(\"DrizzlePassword.snapshotMutationInput\")(function* (\n    input: PasswordMutationInput,\n  ) {\n    const expectedRevision = snapshotPasswordRevision(input.expectedRevision);\n\n    const evidence = yield* snapshotAuthenticationEvidence(input.authorization.evidence).pipe(\n      Effect.mapError(unavailable),\n    );\n\n    const requirement = yield* snapshotPasswordRequirement(input.authorization.requirement);\n\n    const credential =\n      input.credential === undefined\n        ? undefined\n        : yield* snapshotPasswordCredential(input.credential);\n\n    return Object.freeze({\n      ...input,\n      expectedRevision,\n      replacement: Object.freeze({\n        verifier: Redacted.make(Redacted.value(input.replacement.verifier)),\n        normalization: input.replacement.normalization,\n      }),\n      invalidation: Object.freeze({ ...input.invalidation }),\n      ...(credential === undefined ? {} : { credential }),\n      authorization: Object.freeze({\n        challenge: Object.freeze({\n          ...input.authorization.challenge,\n          revision: snapshotPasswordRevision(input.authorization.challenge.revision),\n        }),\n        evidence,\n        requirement,\n      }),\n    });\n  });\n\n  const lockSubject = Effect.fn(\"DrizzlePassword.lockSubject\")(function* (\n    mapping: Mapping,\n    subjectId: string,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    const nativeSubjectId = yield* mapping.subjectId.toNative(subjectId as any);\n    const c = subjectColumns(mapping);\n\n    const rows = yield* selectRows(\n      database.select().from(mapping.subject.table).where(eq(c.id, nativeSubjectId)).limit(1),\n      locking,\n    );\n\n    return { nativeSubjectId, row: rows[0] };\n  });\n\n  const lockIdentifier = Effect.fn(\"Drizzle.lockIdentifier\")(function* (\n    mapping: Mapping,\n    identifier: LoginIdentifier,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    const c = identifierColumns(mapping);\n\n    return yield* selectRows(\n      database\n        .select()\n        .from(mapping.identifier.table)\n        .where(and(eq(c.namespace, identifier.namespace), eq(c.value, identifier.value)))\n        .limit(1),\n      locking,\n    );\n  });\n\n  const readPasswordCredential = Effect.fn(\"Drizzle.readPasswordCredential\")(function* (\n    mapping: Mapping,\n    moduleId: string,\n    nativeSubjectId: unknown,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    const c = credentialColumns(mapping);\n\n    return yield* selectRows(\n      database\n        .select()\n        .from(mapping.credential.table)\n        .where(and(eq(c.moduleId, moduleId), eq(c.subjectId, nativeSubjectId)))\n        .limit(1),\n      locking,\n    );\n  });\n\n  const resolveCredential = Effect.fn(\"DrizzlePassword.resolveCredential\")(function* (\n    mapping: Mapping,\n    moduleId: string,\n    identifier: LoginIdentifier,\n    requestedSubjectId: string | undefined,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    // The unlocked lookup only discovers the prospective subject. The canonical\n    // protected order starts with the subject and then rechecks the identifier.\n    const discovered = (yield* lockIdentifier(mapping, identifier, false))[0];\n\n    if (discovered === undefined || !mapping.identifier.isCurrent(discovered)) return undefined;\n    const discoveredNative = discovered[mapping.identifier.subjectId];\n\n    const subjectRows = yield* selectRows(\n      database\n        .select()\n        .from(mapping.subject.table)\n        .where(eq(subjectColumns(mapping).id, discoveredNative))\n        .limit(1),\n      locking,\n    );\n\n    const subject = subjectRows[0];\n\n    if (subject === undefined || !mapping.subject.isActiveStatus(subject[mapping.subject.status]))\n      return undefined;\n    const identifiers = yield* lockIdentifier(mapping, identifier, locking);\n    const identifierRow = identifiers[0];\n\n    if (\n      identifierRow === undefined ||\n      !mapping.identifier.isCurrent(identifierRow) ||\n      !mapping.subjectId.equals(discoveredNative, identifierRow[mapping.identifier.subjectId])\n    )\n      return undefined;\n    const subjectId = yield* mapping.subjectId.toSubject(discoveredNative);\n\n    if (requestedSubjectId !== undefined && requestedSubjectId !== subjectId) return undefined;\n    const credentials = yield* readPasswordCredential(mapping, moduleId, discoveredNative, locking);\n    const credential = credentials[0];\n\n    if (credential === undefined)\n      return { nativeSubjectId: discoveredNative, subject, identifier: identifierRow };\n\n    const snapshot = yield* mapping.credential\n      .decode({ moduleId, subject, identifier: identifierRow, credential })\n      .pipe(Effect.flatMap(snapshotPasswordCredential));\n\n    return {\n      nativeSubjectId: discoveredNative,\n      subject,\n      identifier: identifierRow,\n      credential,\n      snapshot,\n    };\n  });\n\n  const owned = <A, E, R>(\n    database: Database,\n    mapping: Mapping,\n    configuration: PasswordSqlConfiguration,\n    body: Effect.Effect<A, E, R>,\n  ) => {\n    if (!validConstraints(mapping)) return Effect.fail(unavailable());\n\n    const run = coordinateCommit(\n      () =>\n        database.transaction((transaction) =>\n          body.pipe(\n            Effect.provideService(CurrentPasswordSql, transaction),\n            Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),\n          ),\n        ),\n      { mode: configuration.mode },\n    ).pipe(Effect.map((result) => result.value));\n\n    return configuration.coordinated !== true\n      ? Effect.gen(function* () {\n          if (yield* hasCommitScope) return yield* unavailable();\n          yield* configuration.standaloneGuard;\n\n          return yield* run;\n        })\n      : run;\n  };\n\n  // A coordinator that accepts postconditions re-runs this check against its\n  // current transaction after application work, before commit.\n  const registerFinal = Effect.fnUntraced(function* <E>(\n    check: Effect.Effect<boolean, E, CurrentPasswordSql>,\n  ) {\n    const postconditions = yield* Effect.serviceOption(PasswordPreparedPostconditions);\n\n    if (Option.isNone(postconditions)) return;\n\n    const postcondition = Effect.gen(function* () {\n      const transaction = yield* CurrentPasswordPreparedTransaction;\n\n      if (!(yield* check.pipe(Effect.provideService(CurrentPasswordSql, transaction))))\n        return yield* unavailable();\n    }).pipe(translateFailure);\n\n    if (!postconditions.value.register(postcondition)) return yield* unavailable();\n  });\n\n  const safeRead = <A, E, R>(\n    database: Database,\n    configuration: PasswordSqlConfiguration,\n    body: Effect.Effect<A, E, R>,\n  ) =>\n    Effect.gen(function* () {\n      if (configuration.coordinated !== true) {\n        if (yield* hasCommitScope) return yield* unavailable();\n        yield* configuration.standaloneGuard;\n      }\n\n      return yield* database.transaction((transaction) =>\n        body.pipe(\n          Effect.provideService(CurrentPasswordSql, transaction),\n          Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),\n        ),\n      );\n    });\n\n  const proofCompletionMatchesPassword = (\n    input: PasswordMutationInput & { readonly completion: ProofCompletionPlan },\n  ) => {\n    const completion = input.completion.input;\n    const binding = completion.binding;\n\n    if (\n      completion.moduleId !== `${input.moduleId}/reset` ||\n      completion.purpose !== \"password-reset\" ||\n      binding._tag !== \"Subject\" ||\n      input.credential === undefined ||\n      binding.revision.subjectId !== input.expectedRevision.subjectId ||\n      binding.revision.securityRevision !== input.expectedRevision.securityRevision ||\n      !sameIdentifier(binding.identifier, input.credential.identifier)\n    )\n      return false;\n\n    const expected = [...input.expectedRevision.credentials].sort((left, right) =>\n      left.credentialId.localeCompare(right.credentialId),\n    );\n\n    const actual = [...binding.revision.credentials].sort((left, right) =>\n      left.credentialId.localeCompare(right.credentialId),\n    );\n\n    return (\n      expected.length === actual.length &&\n      expected.every(\n        (item, index) =>\n          item.credentialId === actual[index]!.credentialId &&\n          item.revision === actual[index]!.revision,\n      )\n    );\n  };\n\n  const probeProofCompletion = Effect.fn(\"Drizzle.probeProofCompletion\")(function* (\n    configuration: PasswordSqlConfiguration,\n    input: ProofCompletionInput,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    if (configuration.proof === undefined) return yield* Effect.fail(unavailable());\n    const validProbe = { _tag: \"PasswordProofCompletionValid\" } as const;\n\n    const plan: ProofCompletionPlan = {\n      input,\n      prepare: (decision, journal, project) => journal.prepare(project(decision)),\n    };\n\n    const probe = coordinateCommit(\n      () =>\n        database.transaction((transaction) =>\n          completeProofPlanIn(\n            configuration.proof!.mapping,\n            configuration.proof!.configuration,\n            plan,\n            Effect.fail(validProbe),\n            () => false,\n          ).pipe(\n            Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),\n          ),\n        ),\n      { mode: configuration.mode },\n    );\n\n    if (configuration.coordinated === true || (yield* hasCommitScope)) return yield* unavailable();\n    yield* configuration.standaloneGuard;\n\n    return yield* probe.pipe(\n      Effect.as(false),\n      Effect.catchCause((cause) => {\n        const reason = cause.reasons[0];\n\n        return cause.reasons.length === 1 &&\n          reason !== undefined &&\n          Cause.isFailReason(reason) &&\n          reason.error === validProbe\n          ? Effect.succeed(true)\n          : Effect.failCause(cause);\n      }),\n    );\n  });\n\n  const validateMutationAuthority = Effect.fn(\"DrizzlePassword.validateMutationAuthority\")(\n    function* (\n      mapping: Mapping,\n      configuration: PasswordSqlConfiguration,\n      input: PasswordMutationInput,\n      action: PasswordAction,\n    ) {\n      const database = yield* CurrentPasswordSql;\n\n      const locked = yield* lockSubject(\n        mapping,\n        input.expectedRevision.subjectId,\n        configuration.locking,\n      );\n\n      const row = locked.row;\n\n      if (\n        row === undefined ||\n        !mapping.subject.isActiveStatus(row[mapping.subject.status]) ||\n        row[mapping.subject.securityRevision] !== input.expectedRevision.securityRevision\n      )\n        return undefined;\n      if (\n        input.authorization.challenge.moduleId !== input.moduleId ||\n        input.authorization.challenge.action !== action ||\n        input.authorization.challenge.commandId !== input.commandId ||\n        input.authorization.challenge.revision.subjectId !== input.expectedRevision.subjectId ||\n        input.authorization.challenge.revision.securityRevision !==\n          input.expectedRevision.securityRevision ||\n        (input.authorization.evidence.flowId as string) !== (input.commandId as string) ||\n        input.authorization.evidence.bindingDigest !==\n          input.authorization.challenge.bindingDigest ||\n        input.authorization.evidence.revision.subjectId !== input.expectedRevision.subjectId ||\n        input.authorization.evidence.revision.securityRevision !==\n          input.expectedRevision.securityRevision ||\n        (action === \"add-password\" &&\n          (input.credential !== undefined ||\n            input.authorization.challenge.targetCredentialId !== undefined))\n      )\n        return undefined;\n      if (\n        input.expectedRevision.credentials.some(\n          (expected) =>\n            !input.authorization.evidence.revision.credentials.some(\n              (actual) =>\n                actual.credentialId === expected.credentialId &&\n                actual.revision === expected.revision,\n            ),\n        )\n      )\n        return undefined;\n      if (input.credential !== undefined) {\n        const identifier = (yield* lockIdentifier(\n          mapping,\n          input.credential.identifier,\n          configuration.locking,\n        ))[0];\n\n        if (\n          identifier === undefined ||\n          !mapping.identifier.isCurrent(identifier) ||\n          !mapping.subjectId.equals(\n            identifier[mapping.identifier.subjectId],\n            locked.nativeSubjectId,\n          ) ||\n          identifier[mapping.identifier.bindingRevision] !==\n            input.credential.identifierBindingRevision\n        )\n          return undefined;\n      }\n\n      const allExpected = [\n        ...input.expectedRevision.credentials,\n        ...input.authorization.evidence.revision.credentials,\n      ];\n\n      const expected = new Map(allExpected.map((item) => [item.credentialId, item]));\n\n      const ac = authorityCredentialColumns(mapping);\n\n      const credentialRows =\n        expected.size === 0\n          ? []\n          : yield* selectRows(\n              database\n                .select()\n                .from(mapping.authorityCredential.table)\n                .where(\n                  and(\n                    eq(ac.subjectId, locked.nativeSubjectId),\n                    inArray(ac.credentialId, [...expected.keys()]),\n                  ),\n                )\n                .orderBy(ac.credentialId),\n              configuration.locking,\n            );\n\n      if (credentialRows.length !== expected.size) return undefined;\n      // Database collation need not match JavaScript locale ordering.\n      for (const actual of credentialRows) {\n        const wanted = expected.get(actual[mapping.authorityCredential.credentialId]);\n\n        if (\n          wanted === undefined ||\n          actual[mapping.authorityCredential.revision] !== wanted.revision ||\n          (mapping.authorityCredential.status !== undefined &&\n            mapping.authorityCredential.isActiveStatus?.(\n              actual[mapping.authorityCredential.status],\n            ) !== true)\n        )\n          return undefined;\n        expected.delete(wanted.credentialId);\n      }\n      if (expected.size !== 0) return undefined;\n      if (input.credential !== undefined) {\n        const identifier = (yield* lockIdentifier(mapping, input.credential.identifier, false))[0];\n\n        const credential = (yield* readPasswordCredential(\n          mapping,\n          input.moduleId,\n          locked.nativeSubjectId,\n          configuration.locking,\n        ))[0];\n\n        if (identifier === undefined || credential === undefined) return undefined;\n\n        const snapshot = yield* mapping.credential.decode({\n          moduleId: input.moduleId,\n          subject: row,\n          identifier,\n          credential,\n        });\n\n        if (!sameCredentialSnapshot(snapshot, input.credential)) return undefined;\n      }\n      const currentRequirement = yield* mapping.subject.decodeActionRequirement(row, action);\n      const now = yield* nowMillis;\n\n      if (\n        !evidenceSatisfiedAt(input.authorization.evidence, input.authorization.requirement, now) ||\n        !evidenceSatisfiedAt(input.authorization.evidence, currentRequirement, now)\n      )\n        return undefined;\n      if (\n        input.invalidation.existingSessions === \"immediate\" &&\n        mapping.sessionInvalidation !== \"same-authority-immediate\"\n      )\n        return undefined;\n\n      return { ...locked, now };\n    },\n  );\n\n  const commandExists = Effect.fn(\"Drizzle.commandExists\")(function* (\n    mapping: Mapping,\n    moduleId: string,\n    commandId: string,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    const c = commandColumns(mapping);\n\n    return yield* selectRows(\n      database\n        .select()\n        .from(mapping.command.table)\n        .where(and(eq(c.moduleId, moduleId), eq(c.commandId, commandId)))\n        .limit(1),\n      locking,\n    );\n  });\n\n  const insertCommand = Effect.fn(\"Drizzle.insertCommand\")(function* (\n    mapping: Mapping,\n    input: PasswordMutationInput,\n    action: PasswordAction,\n    now: number,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    return yield* database.insert(mapping.command.table).values(\n      mapping.command.encodeInsert({\n        moduleId: input.moduleId,\n        commandId: input.commandId,\n        action,\n        bindingDigest: input.authorization.challenge.bindingDigest,\n        decision: \"changed\",\n        retentionUntilMillis: now + mapping.commandRetentionMillis,\n      }),\n    );\n  });\n\n  const mutationPostconditions = Effect.fn(\"DrizzlePassword.mutationPostconditions\")(function* (\n    mapping: Mapping,\n    input: PasswordMutationInput,\n    nativeSubjectId: unknown,\n    subject: any,\n    authorityCredential: any,\n    now: number,\n  ) {\n    if (\n      subject === undefined ||\n      !mapping.subject.isActiveStatus(subject[mapping.subject.status]) ||\n      authorityCredential === undefined ||\n      (mapping.authorityCredential.status !== undefined &&\n        mapping.authorityCredential.isActiveStatus?.(\n          authorityCredential[mapping.authorityCredential.status],\n        ) !== true)\n    )\n      return false;\n    if (input.credential !== undefined) {\n      const identifier = (yield* lockIdentifier(mapping, input.credential.identifier, false))[0];\n\n      if (\n        identifier === undefined ||\n        !mapping.identifier.isCurrent(identifier) ||\n        !mapping.subjectId.equals(identifier[mapping.identifier.subjectId], nativeSubjectId) ||\n        identifier[mapping.identifier.bindingRevision] !==\n          input.credential.identifierBindingRevision\n      )\n        return false;\n\n      const credential = (yield* readPasswordCredential(\n        mapping,\n        input.moduleId,\n        nativeSubjectId,\n        false,\n      ))[0];\n\n      if (credential === undefined) return false;\n\n      const decoded = yield* mapping.credential.decode({\n        moduleId: input.moduleId,\n        subject,\n        identifier,\n        credential,\n      });\n\n      if (decoded.identifierVerifiedAtMillis !== input.credential.identifierVerifiedAtMillis)\n        return false;\n    }\n    const rows = yield* commandExists(mapping, input.moduleId, input.commandId, false);\n    const row = rows[0];\n\n    return (\n      rows.length === 1 &&\n      row[mapping.command.action] === input.authorization.challenge.action &&\n      row[mapping.command.bindingDigest] === input.authorization.challenge.bindingDigest &&\n      row[mapping.command.decision] === \"changed\" &&\n      (yield* mapping.decodeInstant(row[mapping.command.retentionUntil])) ===\n        now + mapping.commandRetentionMillis\n    );\n  });\n\n  const addPasswordIn = Effect.fn(\"DrizzlePassword.addPasswordIn\")(function* (\n    mapping: Mapping,\n    configuration: PasswordSqlConfiguration,\n    input: PasswordMutationInput,\n    revisions: {\n      readonly credentialId: string;\n      readonly credentialRevision: SecurityRevision;\n      readonly verifierVersion: SecurityRevision;\n      readonly nextSecurityRevision: SecurityRevision;\n    },\n    commandNow?: number,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    const { credentialId, credentialRevision, verifierVersion, nextSecurityRevision } = revisions;\n\n    const authority = yield* validateMutationAuthority(\n      mapping,\n      configuration,\n      input,\n      \"add-password\",\n    );\n\n    if (authority === undefined) return false;\n    if ((yield* commandExists(mapping, input.moduleId, input.commandId, true)).length) return false;\n    if (\n      (yield* readPasswordCredential(mapping, input.moduleId, authority.nativeSubjectId, true))\n        .length\n    )\n      return false;\n\n    yield* database.insert(mapping.credential.table).values(\n      mapping.credential.encodeInsert({\n        moduleId: input.moduleId,\n        subjectId: authority.nativeSubjectId,\n        credentialId,\n        credentialRevision,\n        verifierVersion,\n        replacement: input.replacement,\n      }),\n    );\n    yield* database.insert(mapping.authorityCredential.table).values(\n      mapping.authorityCredential.encodeInsert({\n        subjectId: authority.nativeSubjectId,\n        credentialId,\n        revision: credentialRevision,\n      }),\n    );\n    yield* database\n      .update(mapping.subject.table)\n      .set(updateValues([[mapping.subject.securityRevision, nextSecurityRevision]]))\n      .where(\n        and(\n          eq(subjectColumns(mapping).id, authority.nativeSubjectId),\n          eq(subjectColumns(mapping).securityRevision, input.expectedRevision.securityRevision),\n        ),\n      );\n    yield* insertCommand(mapping, input, \"add-password\", commandNow ?? authority.now);\n\n    const applied = checkMutationApplied(\n      mapping,\n      input,\n      authority.nativeSubjectId,\n      revisions,\n      commandNow ?? authority.now,\n    );\n\n    if (!(yield* applied)) return yield* unavailable();\n    yield* registerFinal(applied);\n\n    return true;\n  });\n\n  const makeSqlPasswordPersistence = Effect.fn(\"makeSqlPasswordPersistence\")(function* (\n    mapping: Mapping,\n    configuration: PasswordSqlConfiguration,\n  ): Effect.fn.Return<\n    PasswordPersistence[\"Service\"],\n    PasswordUnavailable,\n    LifecycleHooks | CurrentPasswordSql | NativeDatabase\n  > {\n    const database = yield* CurrentPasswordSql;\n\n    if (!configuration.coordinated)\n      yield* (\n        operations.validateStorage?.({\n          ...mapping,\n          proof: configuration.proof?.mapping,\n        }) ?? Effect.void\n      ).pipe(Effect.mapError(unavailable));\n    const hooks = yield* LifecycleHooks;\n\n    if (!validConstraints(mapping)) return yield* unavailable();\n    const root = yield* NativeDatabase;\n\n    const attempts = yield* makePasswordAttempts(\n      yield* sqlMapping(() => nativeTables(root.$client.withoutTransforms(), root)).pipe(\n        translateFailure,\n      ),\n      mapping,\n      configuration,\n    );\n\n    return PasswordPersistence.of({\n      ...attempts,\n      readForSubject: (input) =>\n        safeRead(\n          database,\n          configuration,\n          Effect.gen(function* () {\n            const transaction = yield* CurrentPasswordSql;\n\n            const locked = yield* lockSubject(mapping, input.subjectId, false);\n\n            if (\n              locked.row === undefined ||\n              !mapping.subject.isActiveStatus(locked.row[mapping.subject.status])\n            )\n              return Option.none();\n\n            const credential = (yield* readPasswordCredential(\n              mapping,\n              input.moduleId,\n              locked.nativeSubjectId,\n              false,\n            ))[0];\n\n            if (credential === undefined) return Option.none();\n            const ic = identifierColumns(mapping);\n\n            const identifiers = yield* transaction\n              .select()\n              .from(mapping.identifier.table)\n              .where(eq(ic.subjectId, locked.nativeSubjectId));\n\n            const identifier = identifiers.find((row: any) => mapping.identifier.isCurrent(row));\n\n            if (identifier === undefined) return Option.none();\n\n            const snapshot = yield* mapping.credential\n              .decode({\n                moduleId: input.moduleId,\n                subject: locked.row,\n                identifier,\n                credential,\n              })\n              .pipe(Effect.flatMap(snapshotPasswordCredential));\n\n            return Option.some(snapshot);\n          }),\n        ).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      recoveryTarget: (input) =>\n        safeRead(\n          database,\n          configuration,\n          Effect.gen(function* () {\n            const resolved = yield* resolveCredential(\n              mapping,\n              input.moduleId,\n              input.identifier,\n              undefined,\n              false,\n            );\n\n            return resolved?.snapshot === undefined ||\n              resolved.snapshot.identifierVerifiedAtMillis === undefined\n              ? Option.none()\n              : Option.some(resolved.snapshot);\n          }),\n        ).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      addIfAbsent: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const input = yield* snapshotMutationInput(uncaptured);\n\n          const credentialId = yield* allocate(\n            configuration.mode,\n            mapping.allocateCredentialId,\n            mapping.allocateCredentialIdSync,\n          );\n\n          const credentialRevision = yield* allocate(\n            configuration.mode,\n            mapping.allocateRevision,\n            mapping.allocateRevisionSync,\n          );\n\n          const verifierVersion = yield* allocate(\n            configuration.mode,\n            mapping.allocateRevision,\n            mapping.allocateRevisionSync,\n          );\n\n          const nextSecurityRevision = yield* allocateNextSecurityRevision(\n            mapping,\n            configuration.mode,\n            input.expectedRevision.securityRevision,\n          );\n\n          if (nextSecurityRevision === input.expectedRevision.securityRevision)\n            return yield* unavailable();\n\n          return yield* owned(\n            database,\n            mapping,\n            configuration,\n            Effect.gen(function* () {\n              const journal = yield* CurrentCommitJournal;\n\n              const changed = yield* addPasswordIn(mapping, configuration, input, {\n                credentialId,\n                credentialRevision,\n                verifierVersion,\n                nextSecurityRevision,\n              });\n\n              return prepare(changed ? \"changed\" : \"rejected\", journal);\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      replaceIfCurrent: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const input = yield* snapshotMutationInput(uncaptured);\n\n          const credentialRevision = yield* allocate(\n            configuration.mode,\n            mapping.allocateRevision,\n            mapping.allocateRevisionSync,\n          );\n\n          const verifierVersion = yield* allocate(\n            configuration.mode,\n            mapping.allocateRevision,\n            mapping.allocateRevisionSync,\n          );\n\n          const nextSecurityRevision = yield* allocateNextSecurityRevision(\n            mapping,\n            configuration.mode,\n            input.expectedRevision.securityRevision,\n          );\n\n          if (\n            nextSecurityRevision === input.expectedRevision.securityRevision ||\n            (input.credential !== undefined &&\n              credentialRevision === input.credential.credentialRevision)\n          )\n            return yield* unavailable();\n\n          return yield* owned(\n            database,\n            mapping,\n            configuration,\n            Effect.gen(function* () {\n              return yield* replaceIn(\n                mapping,\n                configuration,\n                input,\n                \"change-password\",\n                { credentialRevision, verifierVersion, nextSecurityRevision },\n                prepare,\n              );\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      checkReset: (input) =>\n        (configuration.proof === undefined\n          ? Effect.fail(unavailable())\n          : Effect.gen(function* () {\n              if (\n                input.moduleId.length <= \"/reset\".length ||\n                !input.moduleId.endsWith(\"/reset\") ||\n                input.purpose !== \"password-reset\" ||\n                input.binding._tag !== \"Subject\"\n              )\n                return false;\n              const binding = input.binding;\n              const passwordModuleId = input.moduleId.slice(0, -\"/reset\".length);\n\n              const current = yield* safeRead(\n                database,\n                configuration,\n                Effect.gen(function* () {\n                  const resolved = yield* resolveCredential(\n                    mapping,\n                    passwordModuleId,\n                    binding.identifier,\n                    binding.revision.subjectId,\n                    false,\n                  );\n\n                  return (\n                    resolved?.snapshot !== undefined &&\n                    resolved.snapshot.revision.securityRevision ===\n                      binding.revision.securityRevision &&\n                    binding.revision.credentials.every((item) =>\n                      resolved.snapshot!.revision.credentials.some(\n                        (actual) =>\n                          actual.credentialId === item.credentialId &&\n                          actual.revision === item.revision,\n                      ),\n                    )\n                  );\n                }),\n              );\n\n              return current ? yield* probeProofCompletion(configuration, input) : false;\n            })\n        ).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      resetWithProof: (uncaptured, prepare) =>\n        (configuration.proof === undefined\n          ? Effect.fail(unavailable())\n          : Effect.gen(function* () {\n              const input = Object.freeze({\n                ...(yield* snapshotMutationInput(uncaptured)),\n                completion: uncaptured.completion,\n              });\n\n              const credentialRevision = yield* allocate(\n                configuration.mode,\n                mapping.allocateRevision,\n                mapping.allocateRevisionSync,\n              );\n\n              const verifierVersion = yield* allocate(\n                configuration.mode,\n                mapping.allocateRevision,\n                mapping.allocateRevisionSync,\n              );\n\n              const nextSecurityRevision = yield* allocateNextSecurityRevision(\n                mapping,\n                configuration.mode,\n                input.expectedRevision.securityRevision,\n              );\n\n              if (\n                nextSecurityRevision === input.expectedRevision.securityRevision ||\n                (input.credential !== undefined &&\n                  credentialRevision === input.credential.credentialRevision)\n              )\n                return yield* unavailable();\n\n              return yield* owned(\n                database,\n                mapping,\n                configuration,\n                Effect.gen(function* () {\n                  const journal = yield* CurrentCommitJournal;\n\n                  if (!proofCompletionMatchesPassword(input)) return prepare(\"rejected\", journal);\n\n                  const authority = yield* validateMutationAuthority(\n                    mapping,\n                    configuration,\n                    input,\n                    \"reset-password\",\n                  );\n\n                  if (authority === undefined) return prepare(\"rejected\", journal);\n                  if ((yield* commandExists(mapping, input.moduleId, input.commandId, true)).length)\n                    return prepare(\"rejected\", journal);\n\n                  const current = yield* currentExpectedCredential(\n                    mapping,\n                    input,\n                    authority.nativeSubjectId,\n                  );\n\n                  if (!current) return prepare(\"rejected\", journal);\n                  let passwordReceipt: PreparedCommit<any> | undefined;\n\n                  yield* completeProofPlanIn(\n                    configuration.proof!.mapping,\n                    configuration.proof!.configuration,\n                    input.completion,\n                    Effect.gen(function* () {\n                      const revisions = {\n                        credentialRevision,\n                        verifierVersion,\n                        nextSecurityRevision,\n                      };\n\n                      const applied = yield* writeReplacement(\n                        mapping,\n                        input,\n                        authority.nativeSubjectId,\n                        revisions,\n                        authority.now,\n                      );\n\n                      if (applied)\n                        yield* registerReplacement(\n                          mapping,\n                          input,\n                          authority.nativeSubjectId,\n                          revisions,\n                          authority.now,\n                        );\n\n                      return applied;\n                    }),\n                    (decision) => {\n                      passwordReceipt = prepare(\n                        decision === \"completed\" ? \"changed\" : \"rejected\",\n                        journal,\n                      );\n\n                      return decision;\n                    },\n                  );\n\n                  return passwordReceipt ?? prepare(\"rejected\", journal);\n                }),\n              );\n            })\n        ).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      cleanupAttempts: (input, prepare) =>\n        owned(\n          database,\n          mapping,\n          configuration,\n          Effect.gen(function* () {\n            const transaction = yield* CurrentPasswordSql;\n            const journal = yield* CurrentCommitJournal;\n\n            const now = yield* nowMillis;\n            const nativeNow = mapping.encodeInstant(now);\n            const a = attemptColumns(mapping);\n\n            const attempts = yield* selectRows(\n              transaction\n                .select({ attemptId: a.attemptId })\n                .from(mapping.attempt.table)\n                .where(and(eq(a.moduleId, input.moduleId), lte(a.retentionUntil, nativeNow)))\n                .limit(input.limit + 1),\n              false,\n            );\n\n            const hasMore = attempts.length > input.limit;\n            const attemptCandidates = attempts.slice(0, input.limit);\n            const selectedAttempts: typeof attemptCandidates = [];\n\n            for (const candidate of attemptCandidates) {\n              const locked = yield* selectRows(\n                transaction\n                  .select({ attemptId: a.attemptId })\n                  .from(mapping.attempt.table)\n                  .where(\n                    and(\n                      eq(a.moduleId, input.moduleId),\n                      eq(a.attemptId, candidate.attemptId),\n                      lte(a.retentionUntil, nativeNow),\n                    ),\n                  )\n                  .limit(1),\n                configuration.locking,\n              );\n\n              if (locked[0] !== undefined) selectedAttempts.push(locked[0] as any);\n            }\n\n            const prepared = prepare(\n              {\n                removed: selectedAttempts.length,\n                hasMore,\n              },\n              journal,\n            );\n\n            if (selectedAttempts.length > 0)\n              yield* transaction.delete(mapping.attempt.table).where(\n                and(\n                  eq(a.moduleId, input.moduleId),\n                  inArray(\n                    a.attemptId,\n                    selectedAttempts.map((row: any) => row.attemptId),\n                  ),\n                  lte(a.retentionUntil, nativeNow),\n                ),\n              );\n\n            return prepared;\n          }),\n        ).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n    });\n  });\n\n  const currentExpectedCredential = Effect.fn(\"DrizzlePassword.currentExpectedCredential\")(\n    function* (mapping: Mapping, input: PasswordMutationInput, nativeSubjectId: unknown) {\n      if (input.credential === undefined) return false;\n\n      const row = (yield* readPasswordCredential(\n        mapping,\n        input.moduleId,\n        nativeSubjectId,\n        true,\n      ))[0];\n\n      if (row === undefined) return false;\n\n      return (\n        row[mapping.credential.credentialId] === input.credential.credentialId &&\n        row[mapping.credential.credentialRevision] === input.credential.credentialRevision &&\n        row[mapping.credential.verifierVersion] === input.credential.verifierVersion &&\n        row[mapping.credential.verifier] === Redacted.value(input.credential.verifier) &&\n        row[mapping.credential.normalization] === input.credential.normalization &&\n        input.authorization.challenge.targetCredentialId === input.credential.credentialId\n      );\n    },\n  );\n\n  const checkMutationApplied = Effect.fn(\"DrizzlePassword.checkMutationApplied\")(function* (\n    mapping: Mapping,\n    input: PasswordMutationInput,\n    nativeSubjectId: unknown,\n    revisions: {\n      readonly credentialId: string;\n      readonly credentialRevision: SecurityRevision;\n      readonly verifierVersion: SecurityRevision;\n      readonly nextSecurityRevision: SecurityRevision;\n    },\n    now: number,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    const c = credentialColumns(mapping),\n      s = subjectColumns(mapping);\n\n    const credential = (yield* database\n      .select()\n      .from(mapping.credential.table)\n      .where(\n        and(\n          eq(c.moduleId, input.moduleId),\n          eq(c.subjectId, nativeSubjectId),\n          eq(c.credentialId, revisions.credentialId),\n          eq(c.credentialRevision, revisions.credentialRevision),\n          eq(c.verifierVersion, revisions.verifierVersion),\n          eq(c.verifier, Redacted.value(input.replacement.verifier)),\n          eq(c.normalization, input.replacement.normalization),\n        ),\n      )\n      .limit(1))[0];\n\n    const subject = (yield* database\n      .select()\n      .from(mapping.subject.table)\n      .where(and(eq(s.id, nativeSubjectId), eq(s.securityRevision, revisions.nextSecurityRevision)))\n      .limit(1))[0];\n\n    const authorityCredential = (yield* database\n      .select()\n      .from(mapping.authorityCredential.table)\n      .where(\n        and(\n          eq(authorityCredentialColumns(mapping).subjectId, nativeSubjectId),\n          eq(authorityCredentialColumns(mapping).credentialId, revisions.credentialId),\n          eq(authorityCredentialColumns(mapping).revision, revisions.credentialRevision),\n        ),\n      )\n      .limit(1))[0];\n\n    // SQL equality follows column collation; compare the persisted values exactly.\n    return (\n      credential !== undefined &&\n      credential[mapping.credential.credentialId] === revisions.credentialId &&\n      credential[mapping.credential.credentialRevision] === revisions.credentialRevision &&\n      credential[mapping.credential.verifierVersion] === revisions.verifierVersion &&\n      credential[mapping.credential.verifier] === Redacted.value(input.replacement.verifier) &&\n      credential[mapping.credential.normalization] === input.replacement.normalization &&\n      (yield* mutationPostconditions(\n        mapping,\n        input,\n        nativeSubjectId,\n        subject,\n        authorityCredential,\n        now,\n      ))\n    );\n  });\n\n  const writeReplacement = Effect.fn(\"DrizzlePassword.writeReplacement\")(function* (\n    mapping: Mapping,\n    input: PasswordMutationInput,\n    nativeSubjectId: unknown,\n    revisions: {\n      readonly credentialRevision: SecurityRevision;\n      readonly verifierVersion: SecurityRevision;\n      readonly nextSecurityRevision: SecurityRevision;\n    },\n    now: number,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    const c = credentialColumns(mapping);\n    const s = subjectColumns(mapping);\n\n    yield* database\n      .update(mapping.credential.table)\n      .set(\n        mapping.credential.encodeReplacement({\n          replacement: input.replacement,\n          credentialRevision: revisions.credentialRevision,\n          verifierVersion: revisions.verifierVersion,\n        }),\n      )\n      .where(\n        and(\n          eq(c.moduleId, input.moduleId),\n          eq(c.subjectId, nativeSubjectId),\n          eq(c.credentialId, input.credential!.credentialId),\n          eq(c.credentialRevision, input.credential!.credentialRevision),\n          eq(c.verifierVersion, input.credential!.verifierVersion),\n          eq(c.verifier, Redacted.value(input.credential!.verifier)),\n          eq(c.normalization, input.credential!.normalization),\n        ),\n      );\n    yield* database\n      .update(mapping.subject.table)\n      .set(updateValues([[mapping.subject.securityRevision, revisions.nextSecurityRevision]]))\n      .where(\n        and(\n          eq(s.id, nativeSubjectId),\n          eq(s.securityRevision, input.expectedRevision.securityRevision),\n        ),\n      );\n    yield* database\n      .update(mapping.authorityCredential.table)\n      .set(mapping.authorityCredential.encodeRevision(revisions.credentialRevision))\n      .where(\n        and(\n          eq(authorityCredentialColumns(mapping).subjectId, nativeSubjectId),\n          eq(authorityCredentialColumns(mapping).credentialId, input.credential!.credentialId),\n          eq(authorityCredentialColumns(mapping).revision, input.credential!.credentialRevision),\n        ),\n      );\n    yield* insertCommand(mapping, input, input.authorization.challenge.action, now);\n\n    return yield* checkMutationApplied(\n      mapping,\n      input,\n      nativeSubjectId,\n      {\n        ...revisions,\n        credentialId: input.credential!.credentialId,\n      },\n      now,\n    );\n  });\n\n  const registerReplacement = (\n    mapping: Mapping,\n    input: PasswordMutationInput,\n    nativeSubjectId: unknown,\n    revisions: {\n      readonly credentialRevision: SecurityRevision;\n      readonly verifierVersion: SecurityRevision;\n      readonly nextSecurityRevision: SecurityRevision;\n    },\n    now: number,\n  ) =>\n    registerFinal(\n      checkMutationApplied(\n        mapping,\n        input,\n        nativeSubjectId,\n        { ...revisions, credentialId: input.credential!.credentialId },\n        now,\n      ),\n    );\n\n  const replaceIn = Effect.fn(\"Drizzle.replaceIn\")(function* <A>(\n    mapping: Mapping,\n    configuration: PasswordSqlConfiguration,\n    input: PasswordMutationInput,\n    action: PasswordAction,\n    revisions: {\n      readonly credentialRevision: SecurityRevision;\n      readonly verifierVersion: SecurityRevision;\n      readonly nextSecurityRevision: SecurityRevision;\n    },\n    prepare: (value: PasswordMutationDecision, journal: CommitJournal) => PreparedCommit<A>,\n  ) {\n    const journal = yield* CurrentCommitJournal;\n\n    const authority = yield* validateMutationAuthority(mapping, configuration, input, action);\n\n    if (authority === undefined) return prepare(\"rejected\", journal);\n    if ((yield* commandExists(mapping, input.moduleId, input.commandId, true)).length)\n      return prepare(\"rejected\", journal);\n    if (!(yield* currentExpectedCredential(mapping, input, authority.nativeSubjectId)))\n      return prepare(\"rejected\", journal);\n    const prepared = prepare(\"changed\", journal);\n\n    if (\n      !(yield* writeReplacement(\n        mapping,\n        input,\n        authority.nativeSubjectId,\n        revisions,\n        authority.now,\n      ))\n    )\n      return yield* unavailable();\n    yield* registerReplacement(mapping, input, authority.nativeSubjectId, revisions, authority.now);\n\n    return prepared;\n  });\n\n  /** Internal bound-owner primitives; deliberately not re-exported by driver modules. */\n  const passwordSqlKernel = {\n    allocate,\n    allocateNextSecurityRevision,\n    owned,\n    safeRead,\n    snapshotMutationInput,\n    lockSubject,\n    lockIdentifier,\n    readPasswordCredential,\n    resolveCredential,\n    validateMutationAuthority,\n    currentExpectedCredential,\n    commandExists,\n    addPasswordIn,\n    checkMutationApplied,\n    writeReplacement,\n    evidenceSatisfiedAt,\n    sameCredentialSnapshot,\n    subjectColumns,\n    identifierColumns,\n    credentialColumns,\n    authorityCredentialColumns,\n    proofCompletionMatchesPassword,\n  };\n\n  return { makeSqlPasswordPersistence, passwordSqlKernel };\n};\n"],"mappings":";;;;;;;;;;;;;;AAwFA,IAAa,qBAAb,cAAwC,QAAQ,QAAiD,CAAC,CAChG,gCACF,CAAC,CAAC,CAAC;AAoBH,MAAa,sBAIX,YACA,QACA,gBAA0E,WACxE,oBAAoB,MAAM,MACzB;CAGH,MAAM,EAAE,KAAK,IAAI,SAAS,KAAK,QAAQ,iBAAiB;CACxD,MAAM,EAAE,wBAAwB;CAChC,MAAM,oBAAoB,oBAAoB,KAAK,CAAC,CAAC;CAErD,MAAM,oBACJ,WAEA,yBACE,SACC,UACC,OAAO,GAAG,mBAAmB,CAAC,CAAC,KAAK,KACpC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,sBAAsB,CAAC,CAAC,KAAK,CAC3C,CAAC,CAAC,KAAK,OAAO,YAAY,UAAU,OAAO,UAAU,MAAM,IAAI,aAAa,YAAY,CAAC,CAAC,CAAC,CAAC;CAE9F,MAAM,YAAY,SAAS,IAAI,KAAK,OAAO,IAAI,SAAS,aAAa,CAAC;CAEtE,MAAM,oBAAoB,YACxB,OAAO,QAAQ,2BAA2B,CAAC,CAAC,OACzC,CAAC,KAAK,WACL,QAAQ,YAAY,SAAqD,KAC7E;CAEF,MAAM,cAAc,OAAyB,YAC3C,WAAW,OAAO,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,IAAI;CAErE,MAAM,kBAAkB,aAAsB;EAC5C,IAAI,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,EAAE;EACpD,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;EAC5D,kBAAkB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,gBAAgB;CAClF;CAEA,MAAM,qBAAqB,aAAsB;EAC/C,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;EACxE,OAAO,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,KAAK;EAChE,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;EACxE,YAAY,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,UAAU;EAC1E,iBAAiB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,eAAe;CACtF;CAEA,MAAM,qBAAqB,aAAsB;EAC/C,UAAU,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,QAAQ;EACtE,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;EACxE,cAAc,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,YAAY;EAC9E,oBAAoB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,kBAAkB;EAC1F,iBAAiB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,eAAe;EACpF,UAAU,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,QAAQ;EACtE,eAAe,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,aAAa;CAClF;CAEA,MAAM,8BAA8B,aAAsB;EACxD,WAAW,OAAO,QAAQ,oBAAoB,OAAO,QAAQ,oBAAoB,SAAS;EAC1F,cAAc,OACZ,QAAQ,oBAAoB,OAC5B,QAAQ,oBAAoB,YAC9B;EACA,UAAU,OAAO,QAAQ,oBAAoB,OAAO,QAAQ,oBAAoB,QAAQ;CAC1F;CAEA,MAAM,kBAAkB,aAAsB;EAC5C,UAAU,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,QAAQ;EAChE,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;EAC5D,WAAW,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,SAAS;EAClE,qBAAqB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,mBAAmB;EACtF,iBAAiB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,eAAe;EAC9E,WAAW,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,SAAS;EAClE,cAAc,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,YAAY;EACxE,kBAAkB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,gBAAgB;EAChF,oBAAoB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,kBAAkB;EACpF,iBAAiB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,eAAe;EAC9E,2BAA2B,OACzB,QAAQ,QAAQ,OAChB,QAAQ,QAAQ,yBAClB;EACA,YAAY,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,UAAU;EACpE,UAAU,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,QAAQ;EAChE,gBAAgB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,cAAc;EAC5E,OAAO,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,KAAK;CAC5D;CAEA,MAAM,kBAAkB,aAAsB;EAC5C,UAAU,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,QAAQ;EAChE,WAAW,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,SAAS;EAClE,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;EAC5D,eAAe,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,aAAa;EAC1E,UAAU,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,QAAQ;EAChE,gBAAgB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,cAAc;CAC9E;CAEA,MAAM,YACJ,MACA,YACA,cACoE;EACpE,IAAI,SAAS,eACX,OAAO,cAAc,KAAA,IACjB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;GACT,KAAK;GACL,QAAQ,UAAU,IAAI,wBAAwB;IAAE,WAAW;IAAW;GAAM,CAAC;EAC/E,CAAC;EACP,IAAI,eAAe,KAAA,GAAW,OAAO;EAErC,OAAO,cAAc,KAAA,IACjB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;GACT,KAAK;GACL,QAAQ,UAAU,IAAI,wBAAwB;IAAE,WAAW;IAAW;GAAM,CAAC;EAC/E,CAAC;CACP;CAEA,MAAM,gCACJ,SACA,MACA,YACG;EACH,MAAM,aAAa,QAAQ,QAAQ,uBAAuB,OAAO;EAEjE,MAAM,YACJ,QAAQ,QAAQ,6BAA6B,KAAA,IACzC,KAAA,UACM,QAAQ,QAAQ,yBAA0B,OAAO;EAE7D,OAAO,SACL,MACA,cAAc,QAAQ,kBACtB,aAAa,QAAQ,oBACvB;CACF;CAEA,MAAM,kBAAkB,MAAuB,UAC7C,KAAK,cAAc,MAAM,aAAa,KAAK,UAAU,MAAM;CAE7D,MAAM,uBACJ,UACA,aACA,QACY;EACZ,IAAI,SAAS,OAAO,SAAS,MAAM,SAAS,SAAS,YAAY,SAAS,IAAI,OAAO;EACrF,MAAM,4BAAY,IAAI,IAAoB;EAE1C,KAAK,MAAM,QAAQ,SAAS,SAAS,aAAa;GAChD,IAAI,UAAU,IAAI,KAAK,YAAY,GAAG,OAAO;GAC7C,UAAU,IAAI,KAAK,cAAc,KAAK,QAAQ;EAChD;EACA,IAAI,SAAS,OAAO,MAAM,UAAU,CAAC,UAAU,IAAI,MAAM,YAAY,CAAC,GAAG,OAAO;EAChF,IAAI,SAAS,OAAO,MAAM,UAAU,MAAM,SAAS,cAAc,MAAM,UAAU,CAAC,GAChF,OAAO;EAET,MAAM,WAAW,SAAS,OAAO,QAAQ,UAAU;GACjD,MAAM,MAAM,MAAM,SAAS,cAAc,MAAM,UAAU;GAEzD,OAAO,OAAO,KAAK,MAAM,YAAY;EACvC,CAAC;EAED,MAAM,UAAU,IAAI,IAAI,SAAS,SAAS,UAAU,MAAM,OAAO,CAAC;EAClE,MAAM,cAAc,IAAI,IAAI,SAAS,KAAK,UAAU,MAAM,YAAY,CAAC;EAEvE,OAAO,YAAY,aAAa,MAC7B,gBACC,YAAY,QAAQ,OAAO,WAAW,QAAQ,IAAI,MAAM,CAAC,KACzD,YAAY,QAAQ,YAAY,sBAChC,SAAS,MACN,WACE,CAAC,YAAY,gBAAgB,MAAM,kBACnC,CAAC,YAAY,qBAAqB,MAAM,kBAC7C,CACJ;CACF;CAEA,MAAM,wBAAwB,OAAO,GAAG,uCAAuC,CAAC,CAAC,WAC/E,OACA;EACA,MAAM,mBAAmB,yBAAyB,MAAM,gBAAgB;EAExE,MAAM,WAAW,OAAO,+BAA+B,MAAM,cAAc,QAAQ,CAAC,CAAC,KACnF,OAAO,SAAS,WAAW,CAC7B;EAEA,MAAM,cAAc,OAAO,4BAA4B,MAAM,cAAc,WAAW;EAEtF,MAAM,aACJ,MAAM,eAAe,KAAA,IACjB,KAAA,IACA,OAAO,2BAA2B,MAAM,UAAU;EAExD,OAAO,OAAO,OAAO;GACnB,GAAG;GACH;GACA,aAAa,OAAO,OAAO;IACzB,UAAU,SAAS,KAAK,SAAS,MAAM,MAAM,YAAY,QAAQ,CAAC;IAClE,eAAe,MAAM,YAAY;GACnC,CAAC;GACD,cAAc,OAAO,OAAO,EAAE,GAAG,MAAM,aAAa,CAAC;GACrD,GAAI,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW;GACjD,eAAe,OAAO,OAAO;IAC3B,WAAW,OAAO,OAAO;KACvB,GAAG,MAAM,cAAc;KACvB,UAAU,yBAAyB,MAAM,cAAc,UAAU,QAAQ;IAC3E,CAAC;IACD;IACA;GACF,CAAC;EACH,CAAC;CACH,CAAC;CAED,MAAM,cAAc,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAC3D,SACA,WACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,SAAgB;EAC1E,MAAM,IAAI,eAAe,OAAO;EAOhC,OAAO;GAAE;GAAiB,MAAK,OALX,WAClB,SAAS,OAAO,CAAC,CAAC,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAAC,MAAM,GAAG,EAAE,IAAI,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,GACtF,OACF,EAAA,CAEoC;EAAG;CACzC,CAAC;CAED,MAAM,iBAAiB,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,YACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EAEnC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,IAAI,GAAG,EAAE,WAAW,WAAW,SAAS,GAAG,GAAG,EAAE,OAAO,WAAW,KAAK,CAAC,CAAC,CAAC,CAChF,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,yBAAyB,OAAO,GAAG,gCAAgC,CAAC,CAAC,WACzE,SACA,UACA,iBACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EAEnC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,IAAI,GAAG,EAAE,UAAU,QAAQ,GAAG,GAAG,EAAE,WAAW,eAAe,CAAC,CAAC,CAAC,CACtE,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,oBAAoB,OAAO,GAAG,mCAAmC,CAAC,CAAC,WACvE,SACA,UACA,YACA,oBACA,SACA;EACA,MAAM,WAAW,OAAO;EAIxB,MAAM,cAAc,OAAO,eAAe,SAAS,YAAY,KAAK,EAAA,CAAG;EAEvE,IAAI,eAAe,KAAA,KAAa,CAAC,QAAQ,WAAW,UAAU,UAAU,GAAG,OAAO,KAAA;EAClF,MAAM,mBAAmB,WAAW,QAAQ,WAAW;EAWvD,MAAM,WAAU,OATW,WACzB,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,GAAG,eAAe,OAAO,CAAC,CAAC,IAAI,gBAAgB,CAAC,CAAC,CACvD,MAAM,CAAC,GACV,OACF,EAAA,CAE4B;EAE5B,IAAI,YAAY,KAAA,KAAa,CAAC,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,GAC1F,OAAO,KAAA;EAET,MAAM,iBAAgB,OADK,eAAe,SAAS,YAAY,OAAO,EAAA,CACpC;EAElC,IACE,kBAAkB,KAAA,KAClB,CAAC,QAAQ,WAAW,UAAU,aAAa,KAC3C,CAAC,QAAQ,UAAU,OAAO,kBAAkB,cAAc,QAAQ,WAAW,UAAU,GAEvF,OAAO,KAAA;EACT,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,gBAAgB;EAErE,IAAI,uBAAuB,KAAA,KAAa,uBAAuB,WAAW,OAAO,KAAA;EAEjF,MAAM,cAAa,OADQ,uBAAuB,SAAS,UAAU,kBAAkB,OAAO,EAAA,CAC/D;EAE/B,IAAI,eAAe,KAAA,GACjB,OAAO;GAAE,iBAAiB;GAAkB;GAAS,YAAY;EAAc;EAMjF,OAAO;GACL,iBAAiB;GACjB;GACA,YAAY;GACZ;GACA,UAAA,OATsB,QAAQ,WAC7B,OAAO;IAAE;IAAU;IAAS,YAAY;IAAe;GAAW,CAAC,CAAC,CACpE,KAAK,OAAO,QAAQ,0BAA0B,CAAC;EAQlD;CACF,CAAC;CAED,MAAM,SACJ,UACA,SACA,eACA,SACG;EACH,IAAI,CAAC,iBAAiB,OAAO,GAAG,OAAO,OAAO,KAAK,YAAY,CAAC;EAEhE,MAAM,MAAM,uBAER,SAAS,aAAa,gBACpB,KAAK,KACH,OAAO,eAAe,oBAAoB,WAAW,GACrD,OAAO,eAAe,iBAAiB,WAA0C,CACnF,CACF,GACF,EAAE,MAAM,cAAc,KAAK,CAC7B,CAAC,CAAC,KAAK,OAAO,KAAK,WAAW,OAAO,KAAK,CAAC;EAE3C,OAAO,cAAc,gBAAgB,OACjC,OAAO,IAAI,aAAa;GACtB,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;GACrD,OAAO,cAAc;GAErB,OAAO,OAAO;EAChB,CAAC,IACD;CACN;CAIA,MAAM,gBAAgB,OAAO,WAAW,WACtC,OACA;EACA,MAAM,iBAAiB,OAAO,OAAO,cAAc,8BAA8B;EAEjF,IAAI,OAAO,OAAO,cAAc,GAAG;EAEnC,MAAM,gBAAgB,OAAO,IAAI,aAAa;GAC5C,MAAM,cAAc,OAAO;GAE3B,IAAI,EAAE,OAAO,MAAM,KAAK,OAAO,eAAe,oBAAoB,WAAW,CAAC,IAC5E,OAAO,OAAO,YAAY;EAC9B,CAAC,CAAC,CAAC,KAAK,gBAAgB;EAExB,IAAI,CAAC,eAAe,MAAM,SAAS,aAAa,GAAG,OAAO,OAAO,YAAY;CAC/E,CAAC;CAED,MAAM,YACJ,UACA,eACA,SAEA,OAAO,IAAI,aAAa;EACtB,IAAI,cAAc,gBAAgB,MAAM;GACtC,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;GACrD,OAAO,cAAc;EACvB;EAEA,OAAO,OAAO,SAAS,aAAa,gBAClC,KAAK,KACH,OAAO,eAAe,oBAAoB,WAAW,GACrD,OAAO,eAAe,iBAAiB,WAA0C,CACnF,CACF;CACF,CAAC;CAEH,MAAM,kCACJ,UACG;EACH,MAAM,aAAa,MAAM,WAAW;EACpC,MAAM,UAAU,WAAW;EAE3B,IACE,WAAW,aAAa,GAAG,MAAM,SAAS,WAC1C,WAAW,YAAY,oBACvB,QAAQ,SAAS,aACjB,MAAM,eAAe,KAAA,KACrB,QAAQ,SAAS,cAAc,MAAM,iBAAiB,aACtD,QAAQ,SAAS,qBAAqB,MAAM,iBAAiB,oBAC7D,CAAC,eAAe,QAAQ,YAAY,MAAM,WAAW,UAAU,GAE/D,OAAO;EAET,MAAM,WAAW,CAAC,GAAG,MAAM,iBAAiB,WAAW,CAAC,CAAC,MAAM,MAAM,UACnE,KAAK,aAAa,cAAc,MAAM,YAAY,CACpD;EAEA,MAAM,SAAS,CAAC,GAAG,QAAQ,SAAS,WAAW,CAAC,CAAC,MAAM,MAAM,UAC3D,KAAK,aAAa,cAAc,MAAM,YAAY,CACpD;EAEA,OACE,SAAS,WAAW,OAAO,UAC3B,SAAS,OACN,MAAM,UACL,KAAK,iBAAiB,OAAO,MAAM,CAAE,gBACrC,KAAK,aAAa,OAAO,MAAM,CAAE,QACrC;CAEJ;CAEA,MAAM,uBAAuB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACrE,eACA,OACA;EACA,MAAM,WAAW,OAAO;EAExB,IAAI,cAAc,UAAU,KAAA,GAAW,OAAO,OAAO,OAAO,KAAK,YAAY,CAAC;EAC9E,MAAM,aAAa,EAAE,MAAM,+BAA+B;EAE1D,MAAM,OAA4B;GAChC;GACA,UAAU,UAAU,SAAS,YAAY,QAAQ,QAAQ,QAAQ,QAAQ,CAAC;EAC5E;EAEA,MAAM,QAAQ,uBAEV,SAAS,aAAa,gBACpB,oBACE,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MACA,OAAO,KAAK,UAAU,SAChB,KACR,CAAC,CAAC,KACA,OAAO,eAAe,iBAAiB,WAA0C,CACnF,CACF,GACF,EAAE,MAAM,cAAc,KAAK,CAC7B;EAEA,IAAI,cAAc,gBAAgB,SAAS,OAAO,iBAAiB,OAAO,OAAO,YAAY;EAC7F,OAAO,cAAc;EAErB,OAAO,OAAO,MAAM,KAClB,OAAO,GAAG,KAAK,GACf,OAAO,YAAY,UAAU;GAC3B,MAAM,SAAS,MAAM,QAAQ;GAE7B,OAAO,MAAM,QAAQ,WAAW,KAC9B,WAAW,KAAA,KACX,MAAM,aAAa,MAAM,KACzB,OAAO,UAAU,aACf,OAAO,QAAQ,IAAI,IACnB,OAAO,UAAU,KAAK;EAC5B,CAAC,CACH;CACF,CAAC;CAED,MAAM,4BAA4B,OAAO,GAAG,2CAA2C,CAAC,CACtF,WACE,SACA,eACA,OACA,QACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,SAAS,OAAO,YACpB,SACA,MAAM,iBAAiB,WACvB,cAAc,OAChB;EAEA,MAAM,MAAM,OAAO;EAEnB,IACE,QAAQ,KAAA,KACR,CAAC,QAAQ,QAAQ,eAAe,IAAI,QAAQ,QAAQ,OAAO,KAC3D,IAAI,QAAQ,QAAQ,sBAAsB,MAAM,iBAAiB,kBAEjE,OAAO,KAAA;EACT,IACE,MAAM,cAAc,UAAU,aAAa,MAAM,YACjD,MAAM,cAAc,UAAU,WAAW,UACzC,MAAM,cAAc,UAAU,cAAc,MAAM,aAClD,MAAM,cAAc,UAAU,SAAS,cAAc,MAAM,iBAAiB,aAC5E,MAAM,cAAc,UAAU,SAAS,qBACrC,MAAM,iBAAiB,oBACxB,MAAM,cAAc,SAAS,WAAuB,MAAM,aAC3D,MAAM,cAAc,SAAS,kBAC3B,MAAM,cAAc,UAAU,iBAChC,MAAM,cAAc,SAAS,SAAS,cAAc,MAAM,iBAAiB,aAC3E,MAAM,cAAc,SAAS,SAAS,qBACpC,MAAM,iBAAiB,oBACxB,WAAW,mBACT,MAAM,eAAe,KAAA,KACpB,MAAM,cAAc,UAAU,uBAAuB,KAAA,IAEzD,OAAO,KAAA;EACT,IACE,MAAM,iBAAiB,YAAY,MAChC,aACC,CAAC,MAAM,cAAc,SAAS,SAAS,YAAY,MAChD,WACC,OAAO,iBAAiB,SAAS,gBACjC,OAAO,aAAa,SAAS,QACjC,CACJ,GAEA,OAAO,KAAA;EACT,IAAI,MAAM,eAAe,KAAA,GAAW;GAClC,MAAM,cAAc,OAAO,eACzB,SACA,MAAM,WAAW,YACjB,cAAc,OAChB,EAAA,CAAG;GAEH,IACE,eAAe,KAAA,KACf,CAAC,QAAQ,WAAW,UAAU,UAAU,KACxC,CAAC,QAAQ,UAAU,OACjB,WAAW,QAAQ,WAAW,YAC9B,OAAO,eACT,KACA,WAAW,QAAQ,WAAW,qBAC5B,MAAM,WAAW,2BAEnB,OAAO,KAAA;EACX;EAEA,MAAM,cAAc,CAClB,GAAG,MAAM,iBAAiB,aAC1B,GAAG,MAAM,cAAc,SAAS,SAAS,WAC3C;EAEA,MAAM,WAAW,IAAI,IAAI,YAAY,KAAK,SAAS,CAAC,KAAK,cAAc,IAAI,CAAC,CAAC;EAE7E,MAAM,KAAK,2BAA2B,OAAO;EAE7C,MAAM,iBACJ,SAAS,SAAS,IACd,CAAC,IACD,OAAO,WACL,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,oBAAoB,KAAK,CAAC,CACvC,MACC,IACE,GAAG,GAAG,WAAW,OAAO,eAAe,GACvC,QAAQ,GAAG,cAAc,CAAC,GAAG,SAAS,KAAK,CAAC,CAAC,CAC/C,CACF,CAAC,CACA,QAAQ,GAAG,YAAY,GAC1B,cAAc,OAChB;EAEN,IAAI,eAAe,WAAW,SAAS,MAAM,OAAO,KAAA;EAEpD,KAAK,MAAM,UAAU,gBAAgB;GACnC,MAAM,SAAS,SAAS,IAAI,OAAO,QAAQ,oBAAoB,aAAa;GAE5E,IACE,WAAW,KAAA,KACX,OAAO,QAAQ,oBAAoB,cAAc,OAAO,YACvD,QAAQ,oBAAoB,WAAW,KAAA,KACtC,QAAQ,oBAAoB,iBAC1B,OAAO,QAAQ,oBAAoB,OACrC,MAAM,MAER,OAAO,KAAA;GACT,SAAS,OAAO,OAAO,YAAY;EACrC;EACA,IAAI,SAAS,SAAS,GAAG,OAAO,KAAA;EAChC,IAAI,MAAM,eAAe,KAAA,GAAW;GAClC,MAAM,cAAc,OAAO,eAAe,SAAS,MAAM,WAAW,YAAY,KAAK,EAAA,CAAG;GAExF,MAAM,cAAc,OAAO,uBACzB,SACA,MAAM,UACN,OAAO,iBACP,cAAc,OAChB,EAAA,CAAG;GAEH,IAAI,eAAe,KAAA,KAAa,eAAe,KAAA,GAAW,OAAO,KAAA;GAEjE,MAAM,WAAW,OAAO,QAAQ,WAAW,OAAO;IAChD,UAAU,MAAM;IAChB,SAAS;IACT;IACA;GACF,CAAC;GAED,IAAI,CAACA,+BAAuB,UAAU,MAAM,UAAU,GAAG,OAAO,KAAA;EAClE;EACA,MAAM,qBAAqB,OAAO,QAAQ,QAAQ,wBAAwB,KAAK,MAAM;EACrF,MAAM,MAAM,OAAO;EAEnB,IACE,CAAC,oBAAoB,MAAM,cAAc,UAAU,MAAM,cAAc,aAAa,GAAG,KACvF,CAAC,oBAAoB,MAAM,cAAc,UAAU,oBAAoB,GAAG,GAE1E,OAAO,KAAA;EACT,IACE,MAAM,aAAa,qBAAqB,eACxC,QAAQ,wBAAwB,4BAEhC,OAAO,KAAA;EAET,OAAO;GAAE,GAAG;GAAQ;EAAI;CAC1B,CACF;CAEA,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,UACA,WACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,eAAe,OAAO;EAEhC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,IAAI,GAAG,EAAE,UAAU,QAAQ,GAAG,GAAG,EAAE,WAAW,SAAS,CAAC,CAAC,CAAC,CAChE,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,OACA,QACA,KACA;EAGA,OAAO,QAAO,OAFU,mBAAA,CAED,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,OACnD,QAAQ,QAAQ,aAAa;GAC3B,UAAU,MAAM;GAChB,WAAW,MAAM;GACjB;GACA,eAAe,MAAM,cAAc,UAAU;GAC7C,UAAU;GACV,sBAAsB,MAAM,QAAQ;EACtC,CAAC,CACH;CACF,CAAC;CAED,MAAM,yBAAyB,OAAO,GAAG,wCAAwC,CAAC,CAAC,WACjF,SACA,OACA,iBACA,SACA,qBACA,KACA;EACA,IACE,YAAY,KAAA,KACZ,CAAC,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,KAC/D,wBAAwB,KAAA,KACvB,QAAQ,oBAAoB,WAAW,KAAA,KACtC,QAAQ,oBAAoB,iBAC1B,oBAAoB,QAAQ,oBAAoB,OAClD,MAAM,MAER,OAAO;EACT,IAAI,MAAM,eAAe,KAAA,GAAW;GAClC,MAAM,cAAc,OAAO,eAAe,SAAS,MAAM,WAAW,YAAY,KAAK,EAAA,CAAG;GAExF,IACE,eAAe,KAAA,KACf,CAAC,QAAQ,WAAW,UAAU,UAAU,KACxC,CAAC,QAAQ,UAAU,OAAO,WAAW,QAAQ,WAAW,YAAY,eAAe,KACnF,WAAW,QAAQ,WAAW,qBAC5B,MAAM,WAAW,2BAEnB,OAAO;GAET,MAAM,cAAc,OAAO,uBACzB,SACA,MAAM,UACN,iBACA,KACF,EAAA,CAAG;GAEH,IAAI,eAAe,KAAA,GAAW,OAAO;GASrC,KAAI,OAPmB,QAAQ,WAAW,OAAO;IAC/C,UAAU,MAAM;IAChB;IACA;IACA;GACF,CAAC,EAAA,CAEW,+BAA+B,MAAM,WAAW,4BAC1D,OAAO;EACX;EACA,MAAM,OAAO,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,WAAW,KAAK;EACjF,MAAM,MAAM,KAAK;EAEjB,OACE,KAAK,WAAW,KAChB,IAAI,QAAQ,QAAQ,YAAY,MAAM,cAAc,UAAU,UAC9D,IAAI,QAAQ,QAAQ,mBAAmB,MAAM,cAAc,UAAU,iBACrE,IAAI,QAAQ,QAAQ,cAAc,cACjC,OAAO,QAAQ,cAAc,IAAI,QAAQ,QAAQ,eAAe,OAC/D,MAAM,QAAQ;CAEpB,CAAC;CAED,MAAM,gBAAgB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAC/D,SACA,eACA,OACA,WAMA,YACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,EAAE,cAAc,oBAAoB,iBAAiB,yBAAyB;EAEpF,MAAM,YAAY,OAAO,0BACvB,SACA,eACA,OACA,cACF;EAEA,IAAI,cAAc,KAAA,GAAW,OAAO;EACpC,KAAK,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,WAAW,IAAI,EAAA,CAAG,QAAQ,OAAO;EAC1F,KACG,OAAO,uBAAuB,SAAS,MAAM,UAAU,UAAU,iBAAiB,IAAI,EAAA,CACpF,QAEH,OAAO;EAET,OAAO,SAAS,OAAO,QAAQ,WAAW,KAAK,CAAC,CAAC,OAC/C,QAAQ,WAAW,aAAa;GAC9B,UAAU,MAAM;GAChB,WAAW,UAAU;GACrB;GACA;GACA;GACA,aAAa,MAAM;EACrB,CAAC,CACH;EACA,OAAO,SAAS,OAAO,QAAQ,oBAAoB,KAAK,CAAC,CAAC,OACxD,QAAQ,oBAAoB,aAAa;GACvC,WAAW,UAAU;GACrB;GACA,UAAU;EACZ,CAAC,CACH;EACA,OAAO,SACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,IAAI,aAAa,CAAC,CAAC,QAAQ,QAAQ,kBAAkB,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAC7E,MACC,IACE,GAAG,eAAe,OAAO,CAAC,CAAC,IAAI,UAAU,eAAe,GACxD,GAAG,eAAe,OAAO,CAAC,CAAC,kBAAkB,MAAM,iBAAiB,gBAAgB,CACtF,CACF;EACF,OAAO,cAAc,SAAS,OAAO,gBAAgB,cAAc,UAAU,GAAG;EAEhF,MAAM,UAAU,qBACd,SACA,OACA,UAAU,iBACV,WACA,cAAc,UAAU,GAC1B;EAEA,IAAI,EAAE,OAAO,UAAU,OAAO,OAAO,YAAY;EACjD,OAAO,cAAc,OAAO;EAE5B,OAAO;CACT,CAAC;CAED,MAAM,6BAA6B,OAAO,GAAG,4BAA4B,CAAC,CAAC,WACzE,SACA,eAKA;EACA,MAAM,WAAW,OAAO;EAExB,IAAI,CAAC,cAAc,aACjB,QACE,WAAW,kBAAkB;GAC3B,GAAG;GACH,OAAO,cAAc,OAAO;EAC9B,CAAC,KAAK,OAAO,KAAA,CACb,KAAK,OAAO,SAAS,WAAW,CAAC;EACrC,MAAM,QAAQ,OAAO;EAErB,IAAI,CAAC,iBAAiB,OAAO,GAAG,OAAO,OAAO,YAAY;EAC1D,MAAM,OAAO,OAAO;EAEpB,MAAM,WAAW,OAAO,qBACtB,OAAO,iBAAiB,aAAa,KAAK,QAAQ,kBAAkB,GAAG,IAAI,CAAC,CAAC,CAAC,KAC5E,gBACF,GACA,SACA,aACF;EAEA,OAAO,oBAAoB,GAAG;GAC5B,GAAG;GACH,iBAAiB,UACf,SACE,UACA,eACA,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAE3B,MAAM,SAAS,OAAO,YAAY,SAAS,MAAM,WAAW,KAAK;IAEjE,IACE,OAAO,QAAQ,KAAA,KACf,CAAC,QAAQ,QAAQ,eAAe,OAAO,IAAI,QAAQ,QAAQ,OAAO,GAElE,OAAO,OAAO,KAAK;IAErB,MAAM,cAAc,OAAO,uBACzB,SACA,MAAM,UACN,OAAO,iBACP,KACF,EAAA,CAAG;IAEH,IAAI,eAAe,KAAA,GAAW,OAAO,OAAO,KAAK;IACjD,MAAM,KAAK,kBAAkB,OAAO;IAOpC,MAAM,cAAa,OALQ,YACxB,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,GAAG,GAAG,WAAW,OAAO,eAAe,CAAC,EAAA,CAElB,MAAM,QAAa,QAAQ,WAAW,UAAU,GAAG,CAAC;IAEnF,IAAI,eAAe,KAAA,GAAW,OAAO,OAAO,KAAK;IAEjD,MAAM,WAAW,OAAO,QAAQ,WAC7B,OAAO;KACN,UAAU,MAAM;KAChB,SAAS,OAAO;KAChB;KACA;IACF,CAAC,CAAC,CACD,KAAK,OAAO,QAAQ,0BAA0B,CAAC;IAElD,OAAO,OAAO,KAAK,QAAQ;GAC7B,CAAC,CACH,CAAC,CAAC,KACA,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,iBAAiB,UACf,SACE,UACA,eACA,OAAO,IAAI,aAAa;IACtB,MAAM,WAAW,OAAO,kBACtB,SACA,MAAM,UACN,MAAM,YACN,KAAA,GACA,KACF;IAEA,OAAO,UAAU,aAAa,KAAA,KAC5B,SAAS,SAAS,+BAA+B,KAAA,IAC/C,OAAO,KAAK,IACZ,OAAO,KAAK,SAAS,QAAQ;GACnC,CAAC,CACH,CAAC,CAAC,KACA,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,cAAc,YAAY,YACxB,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,OAAO,sBAAsB,UAAU;IAErD,MAAM,eAAe,OAAO,SAC1B,cAAc,MACd,QAAQ,sBACR,QAAQ,wBACV;IAEA,MAAM,qBAAqB,OAAO,SAChC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,kBAAkB,OAAO,SAC7B,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,uBAAuB,OAAO,6BAClC,SACA,cAAc,MACd,MAAM,iBAAiB,gBACzB;IAEA,IAAI,yBAAyB,MAAM,iBAAiB,kBAClD,OAAO,OAAO,YAAY;IAE5B,OAAO,OAAO,MACZ,UACA,SACA,eACA,OAAO,IAAI,aAAa;KACtB,MAAM,UAAU,OAAO;KASvB,OAAO,SAAQ,OAPQ,cAAc,SAAS,eAAe,OAAO;MAClE;MACA;MACA;MACA;KACF,CAAC,KAEwB,YAAY,YAAY,OAAO;IAC1D,CAAC,CACH;GACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,mBAAmB,YAAY,YAC7B,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,OAAO,sBAAsB,UAAU;IAErD,MAAM,qBAAqB,OAAO,SAChC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,kBAAkB,OAAO,SAC7B,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,uBAAuB,OAAO,6BAClC,SACA,cAAc,MACd,MAAM,iBAAiB,gBACzB;IAEA,IACE,yBAAyB,MAAM,iBAAiB,oBAC/C,MAAM,eAAe,KAAA,KACpB,uBAAuB,MAAM,WAAW,oBAE1C,OAAO,OAAO,YAAY;IAE5B,OAAO,OAAO,MACZ,UACA,SACA,eACA,OAAO,IAAI,aAAa;KACtB,OAAO,OAAO,UACZ,SACA,eACA,OACA,mBACA;MAAE;MAAoB;MAAiB;KAAqB,GAC5D,OACF;IACF,CAAC,CACH;GACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,aAAa,WACV,cAAc,UAAU,KAAA,IACrB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI,aAAa;IACtB,IACE,MAAM,SAAS,UAAU,KACzB,CAAC,MAAM,SAAS,SAAS,QAAQ,KACjC,MAAM,YAAY,oBAClB,MAAM,QAAQ,SAAS,WAEvB,OAAO;IACT,MAAM,UAAU,MAAM;IACtB,MAAM,mBAAmB,MAAM,SAAS,MAAM,GAAG,EAAgB;IA6BjE,QAAO,OA3BgB,SACrB,UACA,eACA,OAAO,IAAI,aAAa;KACtB,MAAM,WAAW,OAAO,kBACtB,SACA,kBACA,QAAQ,YACR,QAAQ,SAAS,WACjB,KACF;KAEA,OACE,UAAU,aAAa,KAAA,KACvB,SAAS,SAAS,SAAS,qBACzB,QAAQ,SAAS,oBACnB,QAAQ,SAAS,YAAY,OAAO,SAClC,SAAS,SAAU,SAAS,YAAY,MACrC,WACC,OAAO,iBAAiB,KAAK,gBAC7B,OAAO,aAAa,KAAK,QAC7B,CACF;IAEJ,CAAC,CACH,KAEiB,OAAO,qBAAqB,eAAe,KAAK,IAAI;GACvE,CAAC,EAAA,CACH,KACA,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,iBAAiB,YAAY,aAC1B,cAAc,UAAU,KAAA,IACrB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,OAAO,OAAO;KAC1B,GAAI,OAAO,sBAAsB,UAAU;KAC3C,YAAY,WAAW;IACzB,CAAC;IAED,MAAM,qBAAqB,OAAO,SAChC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,kBAAkB,OAAO,SAC7B,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,uBAAuB,OAAO,6BAClC,SACA,cAAc,MACd,MAAM,iBAAiB,gBACzB;IAEA,IACE,yBAAyB,MAAM,iBAAiB,oBAC/C,MAAM,eAAe,KAAA,KACpB,uBAAuB,MAAM,WAAW,oBAE1C,OAAO,OAAO,YAAY;IAE5B,OAAO,OAAO,MACZ,UACA,SACA,eACA,OAAO,IAAI,aAAa;KACtB,MAAM,UAAU,OAAO;KAEvB,IAAI,CAAC,+BAA+B,KAAK,GAAG,OAAO,QAAQ,YAAY,OAAO;KAE9E,MAAM,YAAY,OAAO,0BACvB,SACA,eACA,OACA,gBACF;KAEA,IAAI,cAAc,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;KAC/D,KAAK,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,WAAW,IAAI,EAAA,CAAG,QACzE,OAAO,QAAQ,YAAY,OAAO;KAQpC,IAAI,EAAC,OANkB,0BACrB,SACA,OACA,UAAU,eACZ,IAEc,OAAO,QAAQ,YAAY,OAAO;KAChD,IAAI;KAEJ,OAAO,oBACL,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MAAM,YACN,OAAO,IAAI,aAAa;MACtB,MAAM,YAAY;OAChB;OACA;OACA;MACF;MAEA,MAAM,UAAU,OAAO,iBACrB,SACA,OACA,UAAU,iBACV,WACA,UAAU,GACZ;MAEA,IAAI,SACF,OAAO,oBACL,SACA,OACA,UAAU,iBACV,WACA,UAAU,GACZ;MAEF,OAAO;KACT,CAAC,IACA,aAAa;MACZ,kBAAkB,QAChB,aAAa,cAAc,YAAY,YACvC,OACF;MAEA,OAAO;KACT,CACF;KAEA,OAAO,mBAAmB,QAAQ,YAAY,OAAO;IACvD,CAAC,CACH;GACF,CAAC,EAAA,CACH,KACA,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,kBAAkB,OAAO,YACvB,MACE,UACA,SACA,eACA,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IAEvB,MAAM,MAAM,OAAO;IACnB,MAAM,YAAY,QAAQ,cAAc,GAAG;IAC3C,MAAM,IAAI,eAAe,OAAO;IAEhC,MAAM,WAAW,OAAO,WACtB,YACG,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAClC,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,IAAI,EAAE,gBAAgB,SAAS,CAAC,CAAC,CAAC,CAC5E,MAAM,MAAM,QAAQ,CAAC,GACxB,KACF;IAEA,MAAM,UAAU,SAAS,SAAS,MAAM;IACxC,MAAM,oBAAoB,SAAS,MAAM,GAAG,MAAM,KAAK;IACvD,MAAM,mBAA6C,CAAC;IAEpD,KAAK,MAAM,aAAa,mBAAmB;KACzC,MAAM,SAAS,OAAO,WACpB,YACG,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAClC,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,WAAW,UAAU,SAAS,GACnC,IAAI,EAAE,gBAAgB,SAAS,CACjC,CACF,CAAC,CACA,MAAM,CAAC,GACV,cAAc,OAChB;KAEA,IAAI,OAAO,OAAO,KAAA,GAAW,iBAAiB,KAAK,OAAO,EAAS;IACrE;IAEA,MAAM,WAAW,QACf;KACE,SAAS,iBAAiB;KAC1B;IACF,GACA,OACF;IAEA,IAAI,iBAAiB,SAAS,GAC5B,OAAO,YAAY,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,MAC/C,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,QACE,EAAE,WACF,iBAAiB,KAAK,QAAa,IAAI,SAAS,CAClD,GACA,IAAI,EAAE,gBAAgB,SAAS,CACjC,CACF;IAEF,OAAO;GACT,CAAC,CACH,CAAC,CAAC,KACA,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACJ,CAAC;CACH,CAAC;CAED,MAAM,4BAA4B,OAAO,GAAG,2CAA2C,CAAC,CACtF,WAAW,SAAkB,OAA8B,iBAA0B;EACnF,IAAI,MAAM,eAAe,KAAA,GAAW,OAAO;EAE3C,MAAM,OAAO,OAAO,uBAClB,SACA,MAAM,UACN,iBACA,IACF,EAAA,CAAG;EAEH,IAAI,QAAQ,KAAA,GAAW,OAAO;EAE9B,OACE,IAAI,QAAQ,WAAW,kBAAkB,MAAM,WAAW,gBAC1D,IAAI,QAAQ,WAAW,wBAAwB,MAAM,WAAW,sBAChE,IAAI,QAAQ,WAAW,qBAAqB,MAAM,WAAW,mBAC7D,IAAI,QAAQ,WAAW,cAAc,SAAS,MAAM,MAAM,WAAW,QAAQ,KAC7E,IAAI,QAAQ,WAAW,mBAAmB,MAAM,WAAW,iBAC3D,MAAM,cAAc,UAAU,uBAAuB,MAAM,WAAW;CAE1E,CACF;CAEA,MAAM,uBAAuB,OAAO,GAAG,sCAAsC,CAAC,CAAC,WAC7E,SACA,OACA,iBACA,WAMA,KACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO,GACjC,IAAI,eAAe,OAAO;EAE5B,MAAM,cAAc,OAAO,SACxB,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,WAAW,eAAe,GAC/B,GAAG,EAAE,cAAc,UAAU,YAAY,GACzC,GAAG,EAAE,oBAAoB,UAAU,kBAAkB,GACrD,GAAG,EAAE,iBAAiB,UAAU,eAAe,GAC/C,GAAG,EAAE,UAAU,SAAS,MAAM,MAAM,YAAY,QAAQ,CAAC,GACzD,GAAG,EAAE,eAAe,MAAM,YAAY,aAAa,CACrD,CACF,CAAC,CACA,MAAM,CAAC,EAAA,CAAG;EAEb,MAAM,WAAW,OAAO,SACrB,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,IAAI,GAAG,EAAE,IAAI,eAAe,GAAG,GAAG,EAAE,kBAAkB,UAAU,oBAAoB,CAAC,CAAC,CAAC,CAC7F,MAAM,CAAC,EAAA,CAAG;EAEb,MAAM,uBAAuB,OAAO,SACjC,OAAO,CAAC,CACR,KAAK,QAAQ,oBAAoB,KAAK,CAAC,CACvC,MACC,IACE,GAAG,2BAA2B,OAAO,CAAC,CAAC,WAAW,eAAe,GACjE,GAAG,2BAA2B,OAAO,CAAC,CAAC,cAAc,UAAU,YAAY,GAC3E,GAAG,2BAA2B,OAAO,CAAC,CAAC,UAAU,UAAU,kBAAkB,CAC/E,CACF,CAAC,CACA,MAAM,CAAC,EAAA,CAAG;EAGb,OACE,eAAe,KAAA,KACf,WAAW,QAAQ,WAAW,kBAAkB,UAAU,gBAC1D,WAAW,QAAQ,WAAW,wBAAwB,UAAU,sBAChE,WAAW,QAAQ,WAAW,qBAAqB,UAAU,mBAC7D,WAAW,QAAQ,WAAW,cAAc,SAAS,MAAM,MAAM,YAAY,QAAQ,KACrF,WAAW,QAAQ,WAAW,mBAAmB,MAAM,YAAY,kBAClE,OAAO,uBACN,SACA,OACA,iBACA,SACA,qBACA,GACF;CAEJ,CAAC;CAED,MAAM,mBAAmB,OAAO,GAAG,kCAAkC,CAAC,CAAC,WACrE,SACA,OACA,iBACA,WAKA,KACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EACnC,MAAM,IAAI,eAAe,OAAO;EAEhC,OAAO,SACJ,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,IACC,QAAQ,WAAW,kBAAkB;GACnC,aAAa,MAAM;GACnB,oBAAoB,UAAU;GAC9B,iBAAiB,UAAU;EAC7B,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,WAAW,eAAe,GAC/B,GAAG,EAAE,cAAc,MAAM,WAAY,YAAY,GACjD,GAAG,EAAE,oBAAoB,MAAM,WAAY,kBAAkB,GAC7D,GAAG,EAAE,iBAAiB,MAAM,WAAY,eAAe,GACvD,GAAG,EAAE,UAAU,SAAS,MAAM,MAAM,WAAY,QAAQ,CAAC,GACzD,GAAG,EAAE,eAAe,MAAM,WAAY,aAAa,CACrD,CACF;EACF,OAAO,SACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,IAAI,aAAa,CAAC,CAAC,QAAQ,QAAQ,kBAAkB,UAAU,oBAAoB,CAAC,CAAC,CAAC,CAAC,CACvF,MACC,IACE,GAAG,EAAE,IAAI,eAAe,GACxB,GAAG,EAAE,kBAAkB,MAAM,iBAAiB,gBAAgB,CAChE,CACF;EACF,OAAO,SACJ,OAAO,QAAQ,oBAAoB,KAAK,CAAC,CACzC,IAAI,QAAQ,oBAAoB,eAAe,UAAU,kBAAkB,CAAC,CAAC,CAC7E,MACC,IACE,GAAG,2BAA2B,OAAO,CAAC,CAAC,WAAW,eAAe,GACjE,GAAG,2BAA2B,OAAO,CAAC,CAAC,cAAc,MAAM,WAAY,YAAY,GACnF,GAAG,2BAA2B,OAAO,CAAC,CAAC,UAAU,MAAM,WAAY,kBAAkB,CACvF,CACF;EACF,OAAO,cAAc,SAAS,OAAO,MAAM,cAAc,UAAU,QAAQ,GAAG;EAE9E,OAAO,OAAO,qBACZ,SACA,OACA,iBACA;GACE,GAAG;GACH,cAAc,MAAM,WAAY;EAClC,GACA,GACF;CACF,CAAC;CAED,MAAM,uBACJ,SACA,OACA,iBACA,WAKA,QAEA,cACE,qBACE,SACA,OACA,iBACA;EAAE,GAAG;EAAW,cAAc,MAAM,WAAY;CAAa,GAC7D,GACF,CACF;CAEF,MAAM,YAAY,OAAO,GAAG,mBAAmB,CAAC,CAAC,WAC/C,SACA,eACA,OACA,QACA,WAKA,SACA;EACA,MAAM,UAAU,OAAO;EAEvB,MAAM,YAAY,OAAO,0BAA0B,SAAS,eAAe,OAAO,MAAM;EAExF,IAAI,cAAc,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;EAC/D,KAAK,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,WAAW,IAAI,EAAA,CAAG,QACzE,OAAO,QAAQ,YAAY,OAAO;EACpC,IAAI,EAAE,OAAO,0BAA0B,SAAS,OAAO,UAAU,eAAe,IAC9E,OAAO,QAAQ,YAAY,OAAO;EACpC,MAAM,WAAW,QAAQ,WAAW,OAAO;EAE3C,IACE,EAAE,OAAO,iBACP,SACA,OACA,UAAU,iBACV,WACA,UAAU,GACZ,IAEA,OAAO,OAAO,YAAY;EAC5B,OAAO,oBAAoB,SAAS,OAAO,UAAU,iBAAiB,WAAW,UAAU,GAAG;EAE9F,OAAO;CACT,CAAC;CA4BD,OAAO;EAAE;EAA4B,mBAAA;GAxBnC;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA,wBAAA;GACA;GACA;GACA;GACA;GACA;EAGmD;CAAE;AACzD"}
+{"version":3,"file":"password-kernel.mjs","names":["sameCredentialSnapshot"],"sources":["../../src/internal/password-kernel.ts"],"sourcesContent":["import {\n  coordinateCommit,\n  CurrentCommitJournal,\n  hasCommitScope,\n  type CommitJournal,\n  type PreparedCommit,\n  LifecycleHooks,\n  HookConfigurationError,\n} from \"@yielded/auth/Hooks\";\nimport type { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport {\n  PasswordUnavailable,\n  PasswordPersistence,\n  type PasswordMutationInput,\n  snapshotPasswordCredential,\n  snapshotPasswordRequirement,\n  snapshotPasswordRevision,\n  type PasswordAction,\n  type PasswordMutationDecision,\n} from \"@yielded/auth/Password\";\nimport { reportPersistenceFailure } from \"@yielded/auth/Persistence\";\nimport {\n  type ProofCompletionPlan,\n  type ProofCompletionInput,\n  ProofUnavailable,\n} from \"@yielded/auth/Proofs\";\nimport {\n  snapshotAuthenticationEvidence,\n  type AuthenticationEvidence,\n  type AuthenticationRequirement,\n  type SecurityRevision,\n} from \"@yielded/auth/Sessions\";\nimport { Cause, Context, DateTime, Effect, Option, Redacted, Schema } from \"effect\";\nimport type { SqlClient } from \"effect/sql/SqlClient\";\nimport type * as SqlError from \"effect/sql/SqlError\";\n\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport {\n  type AnyPasswordPersistenceMapping,\n  requiredPasswordConstraints,\n} from \"./models/password-model\";\nimport { makeNativeSqlTables, sqlMapping, type NativeSqlTables } from \"./native-sql-table\";\nimport {\n  makePasswordCredentials,\n  samePasswordCredentialSnapshot as sameCredentialSnapshot,\n} from \"./password-credentials\";\nimport {\n  CurrentPasswordPreparedTransaction,\n  PasswordPreparedPostconditions,\n} from \"./PasswordPreparedPostconditions\";\nimport {\n  CurrentProofSql,\n  type ProofSqlConfiguration,\n  type ProofSqlDatabase,\n  type makeProofKernel,\n} from \"./proof-kernel\";\n/* oxlint-disable no-explicit-any -- existing storage kernels erase foreign table shapes; domain errors remain typed. */\nimport type { QueryFailure } from \"./query-operations\";\nimport type { QueryOperations, SqlFragment, SqlColumn } from \"./query-operations\";\nimport { NativeDatabase } from \"./transaction-kernel\";\n\ntype AdapterFailure = QueryFailure | PersistenceMappingError | SqlError.SqlError;\n\nexport interface PasswordSqlQuery<A = ReadonlyArray<any>> extends Effect.Effect<A, AdapterFailure> {\n  readonly getSQL: () => ReturnType<QueryOperations[\"sql\"]>;\n  readonly from: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly where: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly limit: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly orderBy: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly for: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly set: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly values: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly returning: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly $returningId: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly onConflictDoNothing: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly onDuplicateKeyUpdate: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n}\n\nexport interface PasswordSqlDatabase {\n  readonly select: (...args: ReadonlyArray<any>) => PasswordSqlQuery;\n  readonly insert: (...args: ReadonlyArray<any>) => PasswordSqlQuery;\n  readonly update: (...args: ReadonlyArray<any>) => PasswordSqlQuery;\n  readonly delete: (...args: ReadonlyArray<any>) => PasswordSqlQuery;\n  readonly transaction: <A, E, R>(\n    body: (transaction: PasswordSqlDatabase) => Effect.Effect<A, E, R>,\n  ) => Effect.Effect<A, E | SqlError.SqlError, R>;\n}\n\nexport class CurrentPasswordSql extends Context.Service<CurrentPasswordSql, PasswordSqlDatabase>()(\n  \"effect-auth/CurrentPasswordSql\",\n) {}\n\nexport interface PasswordSqlConfiguration {\n  readonly mode: \"interactive\" | \"synchronous\";\n  readonly locking: boolean;\n  readonly standaloneGuard: Effect.Effect<void, PasswordUnavailable>;\n  readonly coordinated?: boolean;\n  readonly insertIfAbsent: (\n    query: PasswordSqlQuery,\n    selfKey: string,\n    selfValue: unknown,\n  ) => PasswordSqlQuery;\n  readonly proof?: {\n    readonly mapping: any;\n    readonly configuration: ProofSqlConfiguration;\n  };\n}\n\ntype Database = PasswordSqlDatabase;\n\nexport const makePasswordKernel = <\n  Fragment extends SqlFragment = SqlFragment,\n  Column extends SqlColumn = SqlColumn,\n>(\n  operations: QueryOperations<Fragment, Column>,\n  proofs: Pick<ReturnType<typeof makeProofKernel>, \"completeProofPlanIn\">,\n  nativeTables: (client: SqlClient, database: object) => NativeSqlTables = (client) =>\n    makeNativeSqlTables(client),\n) => {\n  type Mapping = AnyPasswordPersistenceMapping<Fragment>;\n\n  const { and, eq, inArray, column, updateValues } = operations;\n  const { completeProofPlanIn } = proofs;\n  const unavailable = () => PasswordUnavailable.make({});\n\n  const translateFailure = <A, E, R>(\n    effect: Effect.Effect<A, E, R>,\n  ): Effect.Effect<A, PasswordUnavailable, R> =>\n    reportPersistenceFailure(\n      effect,\n      (error) =>\n        Schema.is(PasswordUnavailable)(error) ||\n        Schema.is(ProofUnavailable)(error) ||\n        Schema.is(HookConfigurationError)(error),\n    ).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));\n\n  const nowMillis = DateTime.now.pipe(Effect.map(DateTime.toEpochMillis));\n\n  const validConstraints = (mapping: Mapping) =>\n    Object.entries(requiredPasswordConstraints).every(\n      ([key, value]) =>\n        mapping.constraints[key as keyof typeof requiredPasswordConstraints] === value,\n    );\n\n  const selectRows = (query: PasswordSqlQuery, locking: boolean) =>\n    locking && typeof query.for === \"function\" ? query.for(\"update\") : query;\n\n  const subjectColumns = (mapping: Mapping) => ({\n    id: column(mapping.subject.table, mapping.subject.id),\n    status: column(mapping.subject.table, mapping.subject.status),\n    securityRevision: column(mapping.subject.table, mapping.subject.securityRevision),\n  });\n\n  const identifierColumns = (mapping: Mapping) => ({\n    namespace: column(mapping.identifier.table, mapping.identifier.namespace),\n    value: column(mapping.identifier.table, mapping.identifier.value),\n    subjectId: column(mapping.identifier.table, mapping.identifier.subjectId),\n    verifiedAt: column(mapping.identifier.table, mapping.identifier.verifiedAt),\n    bindingRevision: column(mapping.identifier.table, mapping.identifier.bindingRevision),\n  });\n\n  const credentialColumns = (mapping: Mapping) => ({\n    moduleId: column(mapping.credential.table, mapping.credential.moduleId),\n    subjectId: column(mapping.credential.table, mapping.credential.subjectId),\n    credentialId: column(mapping.credential.table, mapping.credential.credentialId),\n    credentialRevision: column(mapping.credential.table, mapping.credential.credentialRevision),\n    verifierVersion: column(mapping.credential.table, mapping.credential.verifierVersion),\n    verifier: column(mapping.credential.table, mapping.credential.verifier),\n    normalization: column(mapping.credential.table, mapping.credential.normalization),\n  });\n\n  const authorityCredentialColumns = (mapping: Mapping) => ({\n    subjectId: column(mapping.authorityCredential.table, mapping.authorityCredential.subjectId),\n    credentialId: column(\n      mapping.authorityCredential.table,\n      mapping.authorityCredential.credentialId,\n    ),\n    revision: column(mapping.authorityCredential.table, mapping.authorityCredential.revision),\n  });\n\n  const commandColumns = (mapping: Mapping) => ({\n    moduleId: column(mapping.command.table, mapping.command.moduleId),\n    commandId: column(mapping.command.table, mapping.command.commandId),\n    action: column(mapping.command.table, mapping.command.action),\n    bindingDigest: column(mapping.command.table, mapping.command.bindingDigest),\n    decision: column(mapping.command.table, mapping.command.decision),\n    retentionUntil: column(mapping.command.table, mapping.command.retentionUntil),\n  });\n\n  const allocate = <A>(\n    mode: PasswordSqlConfiguration[\"mode\"],\n    asyncValue: Effect.Effect<A, PersistenceMappingError> | undefined,\n    syncValue: (() => A) | undefined,\n  ): Effect.Effect<A, PasswordUnavailable | PersistenceMappingError> => {\n    if (mode === \"synchronous\")\n      return syncValue === undefined\n        ? Effect.fail(unavailable())\n        : Effect.try({\n            try: syncValue,\n            catch: (cause) => new PersistenceMappingError({ operation: \"mapping\", cause }),\n          });\n    if (asyncValue !== undefined) return asyncValue;\n\n    return syncValue === undefined\n      ? Effect.fail(unavailable())\n      : Effect.try({\n          try: syncValue,\n          catch: (cause) => new PersistenceMappingError({ operation: \"mapping\", cause }),\n        });\n  };\n\n  const allocateNextSecurityRevision = (\n    mapping: Mapping,\n    mode: PasswordSqlConfiguration[\"mode\"],\n    current: SecurityRevision,\n  ) => {\n    const asyncValue = mapping.subject.nextSecurityRevision?.(current);\n\n    const syncValue =\n      mapping.subject.nextSecurityRevisionSync === undefined\n        ? undefined\n        : () => mapping.subject.nextSecurityRevisionSync!(current);\n\n    return allocate(\n      mode,\n      asyncValue ?? mapping.allocateRevision,\n      syncValue ?? mapping.allocateRevisionSync,\n    );\n  };\n\n  const sameIdentifier = (left: LoginIdentifier, right: LoginIdentifier) =>\n    left.namespace === right.namespace && left.value === right.value;\n\n  const evidenceSatisfiedAt = (\n    evidence: AuthenticationEvidence,\n    requirement: AuthenticationRequirement,\n    now: number,\n  ): boolean => {\n    if (evidence.proofs.length > 64 || evidence.revision.credentials.length > 64) return false;\n    const revisions = new Map<string, string>();\n\n    for (const item of evidence.revision.credentials) {\n      if (revisions.has(item.credentialId)) return false;\n      revisions.set(item.credentialId, item.revision);\n    }\n    if (evidence.proofs.some((proof) => !revisions.has(proof.credentialId))) return false;\n    if (evidence.proofs.some((proof) => now < DateTime.toEpochMillis(proof.verifiedAt)))\n      return false;\n\n    const eligible = evidence.proofs.filter((proof) => {\n      const age = now - DateTime.toEpochMillis(proof.verifiedAt);\n\n      return age >= 0 && age < requirement.maximumAgeMillis;\n    });\n\n    const factors = new Set(eligible.flatMap((proof) => proof.factors));\n    const credentials = new Set(eligible.map((proof) => proof.credentialId));\n\n    return requirement.alternatives.some(\n      (alternative) =>\n        alternative.factors.every((factor) => factors.has(factor)) &&\n        credentials.size >= alternative.minimumCredentials &&\n        eligible.some(\n          (proof) =>\n            (!alternative.userVerified || proof.userVerified) &&\n            (!alternative.phishingResistant || proof.phishingResistant),\n        ),\n    );\n  };\n\n  const snapshotMutationInput = Effect.fn(\"DrizzlePassword.snapshotMutationInput\")(function* (\n    input: PasswordMutationInput,\n  ) {\n    const expectedRevision = snapshotPasswordRevision(input.expectedRevision);\n\n    const evidence = yield* snapshotAuthenticationEvidence(input.authorization.evidence).pipe(\n      Effect.mapError(unavailable),\n    );\n\n    const requirement = yield* snapshotPasswordRequirement(input.authorization.requirement);\n\n    const credential =\n      input.credential === undefined\n        ? undefined\n        : yield* snapshotPasswordCredential(input.credential);\n\n    return Object.freeze({\n      ...input,\n      expectedRevision,\n      replacement: Object.freeze({\n        verifier: Redacted.make(Redacted.value(input.replacement.verifier)),\n        normalization: input.replacement.normalization,\n      }),\n      invalidation: Object.freeze({ ...input.invalidation }),\n      ...(credential === undefined ? {} : { credential }),\n      authorization: Object.freeze({\n        challenge: Object.freeze({\n          ...input.authorization.challenge,\n          revision: snapshotPasswordRevision(input.authorization.challenge.revision),\n        }),\n        evidence,\n        requirement,\n      }),\n    });\n  });\n\n  const lockSubject = Effect.fn(\"DrizzlePassword.lockSubject\")(function* (\n    mapping: Mapping,\n    subjectId: string,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    const nativeSubjectId = yield* mapping.subjectId.toNative(subjectId as any);\n    const c = subjectColumns(mapping);\n\n    const rows = yield* selectRows(\n      database.select().from(mapping.subject.table).where(eq(c.id, nativeSubjectId)).limit(1),\n      locking,\n    );\n\n    return { nativeSubjectId, row: rows[0] };\n  });\n\n  const lockIdentifier = Effect.fn(\"Drizzle.lockIdentifier\")(function* (\n    mapping: Mapping,\n    identifier: LoginIdentifier,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    const c = identifierColumns(mapping);\n\n    return yield* selectRows(\n      database\n        .select()\n        .from(mapping.identifier.table)\n        .where(and(eq(c.namespace, identifier.namespace), eq(c.value, identifier.value)))\n        .limit(1),\n      locking,\n    );\n  });\n\n  const readPasswordCredential = Effect.fn(\"Drizzle.readPasswordCredential\")(function* (\n    mapping: Mapping,\n    moduleId: string,\n    nativeSubjectId: unknown,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    const c = credentialColumns(mapping);\n\n    return yield* selectRows(\n      database\n        .select()\n        .from(mapping.credential.table)\n        .where(and(eq(c.moduleId, moduleId), eq(c.subjectId, nativeSubjectId)))\n        .limit(1),\n      locking,\n    );\n  });\n\n  const resolveCredential = Effect.fn(\"DrizzlePassword.resolveCredential\")(function* (\n    mapping: Mapping,\n    moduleId: string,\n    identifier: LoginIdentifier,\n    requestedSubjectId: string | undefined,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    // The unlocked lookup only discovers the prospective subject. The canonical\n    // protected order starts with the subject and then rechecks the identifier.\n    const discovered = (yield* lockIdentifier(mapping, identifier, false))[0];\n\n    if (discovered === undefined || !mapping.identifier.isCurrent(discovered)) return undefined;\n    const discoveredNative = discovered[mapping.identifier.subjectId];\n\n    const subjectRows = yield* selectRows(\n      database\n        .select()\n        .from(mapping.subject.table)\n        .where(eq(subjectColumns(mapping).id, discoveredNative))\n        .limit(1),\n      locking,\n    );\n\n    const subject = subjectRows[0];\n\n    if (subject === undefined || !mapping.subject.isActiveStatus(subject[mapping.subject.status]))\n      return undefined;\n    const identifiers = yield* lockIdentifier(mapping, identifier, locking);\n    const identifierRow = identifiers[0];\n\n    if (\n      identifierRow === undefined ||\n      !mapping.identifier.isCurrent(identifierRow) ||\n      !mapping.subjectId.equals(discoveredNative, identifierRow[mapping.identifier.subjectId])\n    )\n      return undefined;\n    const subjectId = yield* mapping.subjectId.toSubject(discoveredNative);\n\n    if (requestedSubjectId !== undefined && requestedSubjectId !== subjectId) return undefined;\n    const credentials = yield* readPasswordCredential(mapping, moduleId, discoveredNative, locking);\n    const credential = credentials[0];\n\n    if (credential === undefined)\n      return { nativeSubjectId: discoveredNative, subject, identifier: identifierRow };\n\n    const snapshot = yield* mapping.credential\n      .decode({ moduleId, subject, identifier: identifierRow, credential })\n      .pipe(Effect.flatMap(snapshotPasswordCredential));\n\n    return {\n      nativeSubjectId: discoveredNative,\n      subject,\n      identifier: identifierRow,\n      credential,\n      snapshot,\n    };\n  });\n\n  const owned = <A, E, R>(\n    database: Database,\n    mapping: Mapping,\n    configuration: PasswordSqlConfiguration,\n    body: Effect.Effect<A, E, R>,\n  ) => {\n    if (!validConstraints(mapping)) return Effect.fail(unavailable());\n\n    const run = coordinateCommit(\n      () =>\n        database.transaction((transaction) =>\n          body.pipe(\n            Effect.provideService(CurrentPasswordSql, transaction),\n            Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),\n          ),\n        ),\n      { mode: configuration.mode },\n    ).pipe(Effect.map((result) => result.value));\n\n    return configuration.coordinated !== true\n      ? Effect.gen(function* () {\n          if (yield* hasCommitScope) return yield* unavailable();\n          yield* configuration.standaloneGuard;\n\n          return yield* run;\n        })\n      : run;\n  };\n\n  // A coordinator that accepts postconditions re-runs this check against its\n  // current transaction after application work, before commit.\n  const registerFinal = Effect.fnUntraced(function* <E>(\n    check: Effect.Effect<boolean, E, CurrentPasswordSql>,\n  ) {\n    const postconditions = yield* Effect.serviceOption(PasswordPreparedPostconditions);\n\n    if (Option.isNone(postconditions)) return;\n\n    const postcondition = Effect.gen(function* () {\n      const transaction = yield* CurrentPasswordPreparedTransaction;\n\n      if (!(yield* check.pipe(Effect.provideService(CurrentPasswordSql, transaction))))\n        return yield* unavailable();\n    }).pipe(translateFailure);\n\n    if (!postconditions.value.register(postcondition)) return yield* unavailable();\n  });\n\n  const safeRead = <A, E, R>(\n    database: Database,\n    configuration: PasswordSqlConfiguration,\n    body: Effect.Effect<A, E, R>,\n  ) =>\n    Effect.gen(function* () {\n      if (configuration.coordinated !== true) {\n        if (yield* hasCommitScope) return yield* unavailable();\n        yield* configuration.standaloneGuard;\n      }\n\n      return yield* database.transaction((transaction) =>\n        body.pipe(\n          Effect.provideService(CurrentPasswordSql, transaction),\n          Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),\n        ),\n      );\n    });\n\n  const proofCompletionMatchesPassword = (\n    input: PasswordMutationInput & { readonly completion: ProofCompletionPlan },\n  ) => {\n    const completion = input.completion.input;\n    const binding = completion.binding;\n\n    if (\n      completion.moduleId !== `${input.moduleId}/reset` ||\n      completion.purpose !== \"password-reset\" ||\n      binding._tag !== \"Subject\" ||\n      input.credential === undefined ||\n      binding.revision.subjectId !== input.expectedRevision.subjectId ||\n      binding.revision.securityRevision !== input.expectedRevision.securityRevision ||\n      !sameIdentifier(binding.identifier, input.credential.identifier)\n    )\n      return false;\n\n    const expected = [...input.expectedRevision.credentials].sort((left, right) =>\n      left.credentialId.localeCompare(right.credentialId),\n    );\n\n    const actual = [...binding.revision.credentials].sort((left, right) =>\n      left.credentialId.localeCompare(right.credentialId),\n    );\n\n    return (\n      expected.length === actual.length &&\n      expected.every(\n        (item, index) =>\n          item.credentialId === actual[index]!.credentialId &&\n          item.revision === actual[index]!.revision,\n      )\n    );\n  };\n\n  const probeProofCompletion = Effect.fn(\"Drizzle.probeProofCompletion\")(function* (\n    configuration: PasswordSqlConfiguration,\n    input: ProofCompletionInput,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    if (configuration.proof === undefined) return yield* Effect.fail(unavailable());\n    const validProbe = { _tag: \"PasswordProofCompletionValid\" } as const;\n\n    const plan: ProofCompletionPlan = {\n      input,\n      prepare: (decision, journal, project) => journal.prepare(project(decision)),\n    };\n\n    const probe = coordinateCommit(\n      () =>\n        database.transaction((transaction) =>\n          completeProofPlanIn(\n            configuration.proof!.mapping,\n            configuration.proof!.configuration,\n            plan,\n            Effect.fail(validProbe),\n            () => false,\n          ).pipe(\n            Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),\n          ),\n        ),\n      { mode: configuration.mode },\n    );\n\n    if (configuration.coordinated === true || (yield* hasCommitScope)) return yield* unavailable();\n    yield* configuration.standaloneGuard;\n\n    return yield* probe.pipe(\n      Effect.as(false),\n      Effect.catchCause((cause) => {\n        const reason = cause.reasons[0];\n\n        return cause.reasons.length === 1 &&\n          reason !== undefined &&\n          Cause.isFailReason(reason) &&\n          reason.error === validProbe\n          ? Effect.succeed(true)\n          : Effect.failCause(cause);\n      }),\n    );\n  });\n\n  const validateMutationAuthority = Effect.fn(\"DrizzlePassword.validateMutationAuthority\")(\n    function* (\n      mapping: Mapping,\n      configuration: PasswordSqlConfiguration,\n      input: PasswordMutationInput,\n      action: PasswordAction,\n    ) {\n      const database = yield* CurrentPasswordSql;\n\n      const locked = yield* lockSubject(\n        mapping,\n        input.expectedRevision.subjectId,\n        configuration.locking,\n      );\n\n      const row = locked.row;\n\n      if (\n        row === undefined ||\n        !mapping.subject.isActiveStatus(row[mapping.subject.status]) ||\n        row[mapping.subject.securityRevision] !== input.expectedRevision.securityRevision\n      )\n        return undefined;\n      if (\n        input.authorization.challenge.moduleId !== input.moduleId ||\n        input.authorization.challenge.action !== action ||\n        input.authorization.challenge.commandId !== input.commandId ||\n        input.authorization.challenge.revision.subjectId !== input.expectedRevision.subjectId ||\n        input.authorization.challenge.revision.securityRevision !==\n          input.expectedRevision.securityRevision ||\n        (input.authorization.evidence.flowId as string) !== (input.commandId as string) ||\n        input.authorization.evidence.bindingDigest !==\n          input.authorization.challenge.bindingDigest ||\n        input.authorization.evidence.revision.subjectId !== input.expectedRevision.subjectId ||\n        input.authorization.evidence.revision.securityRevision !==\n          input.expectedRevision.securityRevision ||\n        (action === \"add-password\" &&\n          (input.credential !== undefined ||\n            input.authorization.challenge.targetCredentialId !== undefined))\n      )\n        return undefined;\n      if (\n        input.expectedRevision.credentials.some(\n          (expected) =>\n            !input.authorization.evidence.revision.credentials.some(\n              (actual) =>\n                actual.credentialId === expected.credentialId &&\n                actual.revision === expected.revision,\n            ),\n        )\n      )\n        return undefined;\n      if (input.credential !== undefined) {\n        const identifier = (yield* lockIdentifier(\n          mapping,\n          input.credential.identifier,\n          configuration.locking,\n        ))[0];\n\n        if (\n          identifier === undefined ||\n          !mapping.identifier.isCurrent(identifier) ||\n          !mapping.subjectId.equals(\n            identifier[mapping.identifier.subjectId],\n            locked.nativeSubjectId,\n          ) ||\n          identifier[mapping.identifier.bindingRevision] !==\n            input.credential.identifierBindingRevision\n        )\n          return undefined;\n      }\n\n      const allExpected = [\n        ...input.expectedRevision.credentials,\n        ...input.authorization.evidence.revision.credentials,\n      ];\n\n      const expected = new Map(allExpected.map((item) => [item.credentialId, item]));\n\n      const ac = authorityCredentialColumns(mapping);\n\n      const credentialRows =\n        expected.size === 0\n          ? []\n          : yield* selectRows(\n              database\n                .select()\n                .from(mapping.authorityCredential.table)\n                .where(\n                  and(\n                    eq(ac.subjectId, locked.nativeSubjectId),\n                    inArray(ac.credentialId, [...expected.keys()]),\n                  ),\n                )\n                .orderBy(ac.credentialId),\n              configuration.locking,\n            );\n\n      if (credentialRows.length !== expected.size) return undefined;\n      // Database collation need not match JavaScript locale ordering.\n      for (const actual of credentialRows) {\n        const wanted = expected.get(actual[mapping.authorityCredential.credentialId]);\n\n        if (\n          wanted === undefined ||\n          actual[mapping.authorityCredential.revision] !== wanted.revision ||\n          (mapping.authorityCredential.status !== undefined &&\n            mapping.authorityCredential.isActiveStatus?.(\n              actual[mapping.authorityCredential.status],\n            ) !== true)\n        )\n          return undefined;\n        expected.delete(wanted.credentialId);\n      }\n      if (expected.size !== 0) return undefined;\n      if (input.credential !== undefined) {\n        const identifier = (yield* lockIdentifier(mapping, input.credential.identifier, false))[0];\n\n        const credential = (yield* readPasswordCredential(\n          mapping,\n          input.moduleId,\n          locked.nativeSubjectId,\n          configuration.locking,\n        ))[0];\n\n        if (identifier === undefined || credential === undefined) return undefined;\n\n        const snapshot = yield* mapping.credential.decode({\n          moduleId: input.moduleId,\n          subject: row,\n          identifier,\n          credential,\n        });\n\n        if (!sameCredentialSnapshot(snapshot, input.credential)) return undefined;\n      }\n      const currentRequirement = yield* mapping.subject.decodeActionRequirement(row, action);\n      const now = yield* nowMillis;\n\n      if (\n        !evidenceSatisfiedAt(input.authorization.evidence, input.authorization.requirement, now) ||\n        !evidenceSatisfiedAt(input.authorization.evidence, currentRequirement, now)\n      )\n        return undefined;\n      if (\n        (input.invalidation.existingSessions === \"immediate\" ||\n          input.invalidation.existingSessions === \"cache-expiry\") &&\n        mapping.sessionInvalidation !== \"same-authority-immediate\"\n      )\n        return undefined;\n\n      return { ...locked, now };\n    },\n  );\n\n  const commandExists = Effect.fn(\"Drizzle.commandExists\")(function* (\n    mapping: Mapping,\n    moduleId: string,\n    commandId: string,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    const c = commandColumns(mapping);\n\n    return yield* selectRows(\n      database\n        .select()\n        .from(mapping.command.table)\n        .where(and(eq(c.moduleId, moduleId), eq(c.commandId, commandId)))\n        .limit(1),\n      locking,\n    );\n  });\n\n  const insertCommand = Effect.fn(\"Drizzle.insertCommand\")(function* (\n    mapping: Mapping,\n    input: PasswordMutationInput,\n    action: PasswordAction,\n    now: number,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    return yield* database.insert(mapping.command.table).values(\n      mapping.command.encodeInsert({\n        moduleId: input.moduleId,\n        commandId: input.commandId,\n        action,\n        bindingDigest: input.authorization.challenge.bindingDigest,\n        decision: \"changed\",\n        retentionUntilMillis: now + mapping.commandRetentionMillis,\n      }),\n    );\n  });\n\n  const mutationPostconditions = Effect.fn(\"DrizzlePassword.mutationPostconditions\")(function* (\n    mapping: Mapping,\n    input: PasswordMutationInput,\n    nativeSubjectId: unknown,\n    subject: any,\n    authorityCredential: any,\n    now: number,\n  ) {\n    if (\n      subject === undefined ||\n      !mapping.subject.isActiveStatus(subject[mapping.subject.status]) ||\n      authorityCredential === undefined ||\n      (mapping.authorityCredential.status !== undefined &&\n        mapping.authorityCredential.isActiveStatus?.(\n          authorityCredential[mapping.authorityCredential.status],\n        ) !== true)\n    )\n      return false;\n    if (input.credential !== undefined) {\n      const identifier = (yield* lockIdentifier(mapping, input.credential.identifier, false))[0];\n\n      if (\n        identifier === undefined ||\n        !mapping.identifier.isCurrent(identifier) ||\n        !mapping.subjectId.equals(identifier[mapping.identifier.subjectId], nativeSubjectId) ||\n        identifier[mapping.identifier.bindingRevision] !==\n          input.credential.identifierBindingRevision\n      )\n        return false;\n\n      const credential = (yield* readPasswordCredential(\n        mapping,\n        input.moduleId,\n        nativeSubjectId,\n        false,\n      ))[0];\n\n      if (credential === undefined) return false;\n\n      const decoded = yield* mapping.credential.decode({\n        moduleId: input.moduleId,\n        subject,\n        identifier,\n        credential,\n      });\n\n      if (decoded.identifierVerifiedAtMillis !== input.credential.identifierVerifiedAtMillis)\n        return false;\n    }\n    const rows = yield* commandExists(mapping, input.moduleId, input.commandId, false);\n    const row = rows[0];\n\n    return (\n      rows.length === 1 &&\n      row[mapping.command.action] === input.authorization.challenge.action &&\n      row[mapping.command.bindingDigest] === input.authorization.challenge.bindingDigest &&\n      row[mapping.command.decision] === \"changed\" &&\n      (yield* mapping.decodeInstant(row[mapping.command.retentionUntil])) ===\n        now + mapping.commandRetentionMillis\n    );\n  });\n\n  const addPasswordIn = Effect.fn(\"DrizzlePassword.addPasswordIn\")(function* (\n    mapping: Mapping,\n    configuration: PasswordSqlConfiguration,\n    input: PasswordMutationInput,\n    revisions: {\n      readonly credentialId: string;\n      readonly credentialRevision: SecurityRevision;\n      readonly verifierVersion: SecurityRevision;\n      readonly nextSecurityRevision: SecurityRevision;\n    },\n    commandNow?: number,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    const { credentialId, credentialRevision, verifierVersion, nextSecurityRevision } = revisions;\n\n    const authority = yield* validateMutationAuthority(\n      mapping,\n      configuration,\n      input,\n      \"add-password\",\n    );\n\n    if (authority === undefined) return false;\n    if ((yield* commandExists(mapping, input.moduleId, input.commandId, true)).length) return false;\n    if (\n      (yield* readPasswordCredential(mapping, input.moduleId, authority.nativeSubjectId, true))\n        .length\n    )\n      return false;\n\n    yield* database.insert(mapping.credential.table).values(\n      mapping.credential.encodeInsert({\n        moduleId: input.moduleId,\n        subjectId: authority.nativeSubjectId,\n        credentialId,\n        credentialRevision,\n        verifierVersion,\n        replacement: input.replacement,\n      }),\n    );\n    yield* database.insert(mapping.authorityCredential.table).values(\n      mapping.authorityCredential.encodeInsert({\n        subjectId: authority.nativeSubjectId,\n        credentialId,\n        revision: credentialRevision,\n      }),\n    );\n    yield* database\n      .update(mapping.subject.table)\n      .set(updateValues([[mapping.subject.securityRevision, nextSecurityRevision]]))\n      .where(\n        and(\n          eq(subjectColumns(mapping).id, authority.nativeSubjectId),\n          eq(subjectColumns(mapping).securityRevision, input.expectedRevision.securityRevision),\n        ),\n      );\n    yield* insertCommand(mapping, input, \"add-password\", commandNow ?? authority.now);\n\n    const applied = checkMutationApplied(\n      mapping,\n      input,\n      authority.nativeSubjectId,\n      revisions,\n      commandNow ?? authority.now,\n    );\n\n    if (!(yield* applied)) return yield* unavailable();\n    yield* registerFinal(applied);\n\n    return true;\n  });\n\n  const makeSqlPasswordPersistence = Effect.fn(\"makeSqlPasswordPersistence\")(function* (\n    mapping: Mapping,\n    configuration: PasswordSqlConfiguration,\n  ): Effect.fn.Return<\n    PasswordPersistence[\"Service\"],\n    PasswordUnavailable,\n    LifecycleHooks | CurrentPasswordSql | NativeDatabase\n  > {\n    const database = yield* CurrentPasswordSql;\n\n    if (!configuration.coordinated)\n      yield* (\n        operations.validateStorage?.({\n          ...mapping,\n          proof: configuration.proof?.mapping,\n        }) ?? Effect.void\n      ).pipe(Effect.mapError(unavailable));\n    const hooks = yield* LifecycleHooks;\n\n    if (!validConstraints(mapping)) return yield* unavailable();\n    const root = yield* NativeDatabase;\n\n    const credentials = yield* makePasswordCredentials(\n      yield* sqlMapping(() => nativeTables(root.$client.withoutTransforms(), root)).pipe(\n        translateFailure,\n      ),\n      mapping,\n      configuration,\n    );\n\n    return PasswordPersistence.of({\n      ...credentials,\n      readForSubject: (input) =>\n        safeRead(\n          database,\n          configuration,\n          Effect.gen(function* () {\n            const transaction = yield* CurrentPasswordSql;\n\n            const locked = yield* lockSubject(mapping, input.subjectId, false);\n\n            if (\n              locked.row === undefined ||\n              !mapping.subject.isActiveStatus(locked.row[mapping.subject.status])\n            )\n              return Option.none();\n\n            const credential = (yield* readPasswordCredential(\n              mapping,\n              input.moduleId,\n              locked.nativeSubjectId,\n              false,\n            ))[0];\n\n            if (credential === undefined) return Option.none();\n            const ic = identifierColumns(mapping);\n\n            const identifiers = yield* transaction\n              .select()\n              .from(mapping.identifier.table)\n              .where(eq(ic.subjectId, locked.nativeSubjectId));\n\n            const identifier = identifiers.find((row: any) => mapping.identifier.isCurrent(row));\n\n            if (identifier === undefined) return Option.none();\n\n            const snapshot = yield* mapping.credential\n              .decode({\n                moduleId: input.moduleId,\n                subject: locked.row,\n                identifier,\n                credential,\n              })\n              .pipe(Effect.flatMap(snapshotPasswordCredential));\n\n            return Option.some(snapshot);\n          }),\n        ).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      recoveryTarget: (input) =>\n        safeRead(\n          database,\n          configuration,\n          Effect.gen(function* () {\n            const resolved = yield* resolveCredential(\n              mapping,\n              input.moduleId,\n              input.identifier,\n              undefined,\n              false,\n            );\n\n            return resolved?.snapshot === undefined ||\n              resolved.snapshot.identifierVerifiedAtMillis === undefined\n              ? Option.none()\n              : Option.some(resolved.snapshot);\n          }),\n        ).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      addIfAbsent: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const input = yield* snapshotMutationInput(uncaptured);\n\n          const credentialId = yield* allocate(\n            configuration.mode,\n            mapping.allocateCredentialId,\n            mapping.allocateCredentialIdSync,\n          );\n\n          const credentialRevision = yield* allocate(\n            configuration.mode,\n            mapping.allocateRevision,\n            mapping.allocateRevisionSync,\n          );\n\n          const verifierVersion = yield* allocate(\n            configuration.mode,\n            mapping.allocateRevision,\n            mapping.allocateRevisionSync,\n          );\n\n          const nextSecurityRevision = yield* allocateNextSecurityRevision(\n            mapping,\n            configuration.mode,\n            input.expectedRevision.securityRevision,\n          );\n\n          if (nextSecurityRevision === input.expectedRevision.securityRevision)\n            return yield* unavailable();\n\n          return yield* owned(\n            database,\n            mapping,\n            configuration,\n            Effect.gen(function* () {\n              const journal = yield* CurrentCommitJournal;\n\n              const changed = yield* addPasswordIn(mapping, configuration, input, {\n                credentialId,\n                credentialRevision,\n                verifierVersion,\n                nextSecurityRevision,\n              });\n\n              return prepare(changed ? \"changed\" : \"rejected\", journal);\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      replaceIfCurrent: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const input = yield* snapshotMutationInput(uncaptured);\n\n          const credentialRevision = yield* allocate(\n            configuration.mode,\n            mapping.allocateRevision,\n            mapping.allocateRevisionSync,\n          );\n\n          const verifierVersion = yield* allocate(\n            configuration.mode,\n            mapping.allocateRevision,\n            mapping.allocateRevisionSync,\n          );\n\n          const nextSecurityRevision = yield* allocateNextSecurityRevision(\n            mapping,\n            configuration.mode,\n            input.expectedRevision.securityRevision,\n          );\n\n          if (\n            nextSecurityRevision === input.expectedRevision.securityRevision ||\n            (input.credential !== undefined &&\n              credentialRevision === input.credential.credentialRevision)\n          )\n            return yield* unavailable();\n\n          return yield* owned(\n            database,\n            mapping,\n            configuration,\n            Effect.gen(function* () {\n              return yield* replaceIn(\n                mapping,\n                configuration,\n                input,\n                \"change-password\",\n                { credentialRevision, verifierVersion, nextSecurityRevision },\n                prepare,\n              );\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      checkReset: (input) =>\n        (configuration.proof === undefined\n          ? Effect.fail(unavailable())\n          : Effect.gen(function* () {\n              if (\n                input.moduleId.length <= \"/reset\".length ||\n                !input.moduleId.endsWith(\"/reset\") ||\n                input.purpose !== \"password-reset\" ||\n                input.binding._tag !== \"Subject\"\n              )\n                return false;\n              const binding = input.binding;\n              const passwordModuleId = input.moduleId.slice(0, -\"/reset\".length);\n\n              const current = yield* safeRead(\n                database,\n                configuration,\n                Effect.gen(function* () {\n                  const resolved = yield* resolveCredential(\n                    mapping,\n                    passwordModuleId,\n                    binding.identifier,\n                    binding.revision.subjectId,\n                    false,\n                  );\n\n                  return (\n                    resolved?.snapshot !== undefined &&\n                    resolved.snapshot.revision.securityRevision ===\n                      binding.revision.securityRevision &&\n                    binding.revision.credentials.every((item) =>\n                      resolved.snapshot!.revision.credentials.some(\n                        (actual) =>\n                          actual.credentialId === item.credentialId &&\n                          actual.revision === item.revision,\n                      ),\n                    )\n                  );\n                }),\n              );\n\n              return current ? yield* probeProofCompletion(configuration, input) : false;\n            })\n        ).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      resetWithProof: (uncaptured, prepare) =>\n        (configuration.proof === undefined\n          ? Effect.fail(unavailable())\n          : Effect.gen(function* () {\n              const input = Object.freeze({\n                ...(yield* snapshotMutationInput(uncaptured)),\n                completion: uncaptured.completion,\n              });\n\n              const credentialRevision = yield* allocate(\n                configuration.mode,\n                mapping.allocateRevision,\n                mapping.allocateRevisionSync,\n              );\n\n              const verifierVersion = yield* allocate(\n                configuration.mode,\n                mapping.allocateRevision,\n                mapping.allocateRevisionSync,\n              );\n\n              const nextSecurityRevision = yield* allocateNextSecurityRevision(\n                mapping,\n                configuration.mode,\n                input.expectedRevision.securityRevision,\n              );\n\n              if (\n                nextSecurityRevision === input.expectedRevision.securityRevision ||\n                (input.credential !== undefined &&\n                  credentialRevision === input.credential.credentialRevision)\n              )\n                return yield* unavailable();\n\n              return yield* owned(\n                database,\n                mapping,\n                configuration,\n                Effect.gen(function* () {\n                  const journal = yield* CurrentCommitJournal;\n\n                  if (!proofCompletionMatchesPassword(input)) return prepare(\"rejected\", journal);\n\n                  const authority = yield* validateMutationAuthority(\n                    mapping,\n                    configuration,\n                    input,\n                    \"reset-password\",\n                  );\n\n                  if (authority === undefined) return prepare(\"rejected\", journal);\n                  if ((yield* commandExists(mapping, input.moduleId, input.commandId, true)).length)\n                    return prepare(\"rejected\", journal);\n\n                  const current = yield* currentExpectedCredential(\n                    mapping,\n                    input,\n                    authority.nativeSubjectId,\n                  );\n\n                  if (!current) return prepare(\"rejected\", journal);\n                  let passwordReceipt: PreparedCommit<any> | undefined;\n\n                  yield* completeProofPlanIn(\n                    configuration.proof!.mapping,\n                    configuration.proof!.configuration,\n                    input.completion,\n                    Effect.gen(function* () {\n                      const revisions = {\n                        credentialRevision,\n                        verifierVersion,\n                        nextSecurityRevision,\n                      };\n\n                      const applied = yield* writeReplacement(\n                        mapping,\n                        input,\n                        authority.nativeSubjectId,\n                        revisions,\n                        authority.now,\n                      );\n\n                      if (applied)\n                        yield* registerReplacement(\n                          mapping,\n                          input,\n                          authority.nativeSubjectId,\n                          revisions,\n                          authority.now,\n                        );\n\n                      return applied;\n                    }),\n                    (decision) => {\n                      passwordReceipt = prepare(\n                        decision === \"completed\" ? \"changed\" : \"rejected\",\n                        journal,\n                      );\n\n                      return decision;\n                    },\n                  );\n\n                  return passwordReceipt ?? prepare(\"rejected\", journal);\n                }),\n              );\n            })\n        ).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n    });\n  });\n\n  const currentExpectedCredential = Effect.fn(\"DrizzlePassword.currentExpectedCredential\")(\n    function* (mapping: Mapping, input: PasswordMutationInput, nativeSubjectId: unknown) {\n      if (input.credential === undefined) return false;\n\n      const row = (yield* readPasswordCredential(\n        mapping,\n        input.moduleId,\n        nativeSubjectId,\n        true,\n      ))[0];\n\n      if (row === undefined) return false;\n\n      return (\n        row[mapping.credential.credentialId] === input.credential.credentialId &&\n        row[mapping.credential.credentialRevision] === input.credential.credentialRevision &&\n        row[mapping.credential.verifierVersion] === input.credential.verifierVersion &&\n        row[mapping.credential.verifier] === Redacted.value(input.credential.verifier) &&\n        row[mapping.credential.normalization] === input.credential.normalization &&\n        input.authorization.challenge.targetCredentialId === input.credential.credentialId\n      );\n    },\n  );\n\n  const checkMutationApplied = Effect.fn(\"DrizzlePassword.checkMutationApplied\")(function* (\n    mapping: Mapping,\n    input: PasswordMutationInput,\n    nativeSubjectId: unknown,\n    revisions: {\n      readonly credentialId: string;\n      readonly credentialRevision: SecurityRevision;\n      readonly verifierVersion: SecurityRevision;\n      readonly nextSecurityRevision: SecurityRevision;\n    },\n    now: number,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    const c = credentialColumns(mapping),\n      s = subjectColumns(mapping);\n\n    const credential = (yield* database\n      .select()\n      .from(mapping.credential.table)\n      .where(\n        and(\n          eq(c.moduleId, input.moduleId),\n          eq(c.subjectId, nativeSubjectId),\n          eq(c.credentialId, revisions.credentialId),\n          eq(c.credentialRevision, revisions.credentialRevision),\n          eq(c.verifierVersion, revisions.verifierVersion),\n          eq(c.verifier, Redacted.value(input.replacement.verifier)),\n          eq(c.normalization, input.replacement.normalization),\n        ),\n      )\n      .limit(1))[0];\n\n    const subject = (yield* database\n      .select()\n      .from(mapping.subject.table)\n      .where(and(eq(s.id, nativeSubjectId), eq(s.securityRevision, revisions.nextSecurityRevision)))\n      .limit(1))[0];\n\n    const authorityCredential = (yield* database\n      .select()\n      .from(mapping.authorityCredential.table)\n      .where(\n        and(\n          eq(authorityCredentialColumns(mapping).subjectId, nativeSubjectId),\n          eq(authorityCredentialColumns(mapping).credentialId, revisions.credentialId),\n          eq(authorityCredentialColumns(mapping).revision, revisions.credentialRevision),\n        ),\n      )\n      .limit(1))[0];\n\n    // SQL equality follows column collation; compare the persisted values exactly.\n    return (\n      credential !== undefined &&\n      credential[mapping.credential.credentialId] === revisions.credentialId &&\n      credential[mapping.credential.credentialRevision] === revisions.credentialRevision &&\n      credential[mapping.credential.verifierVersion] === revisions.verifierVersion &&\n      credential[mapping.credential.verifier] === Redacted.value(input.replacement.verifier) &&\n      credential[mapping.credential.normalization] === input.replacement.normalization &&\n      (yield* mutationPostconditions(\n        mapping,\n        input,\n        nativeSubjectId,\n        subject,\n        authorityCredential,\n        now,\n      ))\n    );\n  });\n\n  const writeReplacement = Effect.fn(\"DrizzlePassword.writeReplacement\")(function* (\n    mapping: Mapping,\n    input: PasswordMutationInput,\n    nativeSubjectId: unknown,\n    revisions: {\n      readonly credentialRevision: SecurityRevision;\n      readonly verifierVersion: SecurityRevision;\n      readonly nextSecurityRevision: SecurityRevision;\n    },\n    now: number,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    const c = credentialColumns(mapping);\n    const s = subjectColumns(mapping);\n\n    yield* database\n      .update(mapping.credential.table)\n      .set(\n        mapping.credential.encodeReplacement({\n          replacement: input.replacement,\n          credentialRevision: revisions.credentialRevision,\n          verifierVersion: revisions.verifierVersion,\n        }),\n      )\n      .where(\n        and(\n          eq(c.moduleId, input.moduleId),\n          eq(c.subjectId, nativeSubjectId),\n          eq(c.credentialId, input.credential!.credentialId),\n          eq(c.credentialRevision, input.credential!.credentialRevision),\n          eq(c.verifierVersion, input.credential!.verifierVersion),\n          eq(c.verifier, Redacted.value(input.credential!.verifier)),\n          eq(c.normalization, input.credential!.normalization),\n        ),\n      );\n    yield* database\n      .update(mapping.subject.table)\n      .set(updateValues([[mapping.subject.securityRevision, revisions.nextSecurityRevision]]))\n      .where(\n        and(\n          eq(s.id, nativeSubjectId),\n          eq(s.securityRevision, input.expectedRevision.securityRevision),\n        ),\n      );\n    yield* database\n      .update(mapping.authorityCredential.table)\n      .set(mapping.authorityCredential.encodeRevision(revisions.credentialRevision))\n      .where(\n        and(\n          eq(authorityCredentialColumns(mapping).subjectId, nativeSubjectId),\n          eq(authorityCredentialColumns(mapping).credentialId, input.credential!.credentialId),\n          eq(authorityCredentialColumns(mapping).revision, input.credential!.credentialRevision),\n        ),\n      );\n    yield* insertCommand(mapping, input, input.authorization.challenge.action, now);\n\n    return yield* checkMutationApplied(\n      mapping,\n      input,\n      nativeSubjectId,\n      {\n        ...revisions,\n        credentialId: input.credential!.credentialId,\n      },\n      now,\n    );\n  });\n\n  const registerReplacement = (\n    mapping: Mapping,\n    input: PasswordMutationInput,\n    nativeSubjectId: unknown,\n    revisions: {\n      readonly credentialRevision: SecurityRevision;\n      readonly verifierVersion: SecurityRevision;\n      readonly nextSecurityRevision: SecurityRevision;\n    },\n    now: number,\n  ) =>\n    registerFinal(\n      checkMutationApplied(\n        mapping,\n        input,\n        nativeSubjectId,\n        { ...revisions, credentialId: input.credential!.credentialId },\n        now,\n      ),\n    );\n\n  const replaceIn = Effect.fn(\"Drizzle.replaceIn\")(function* <A>(\n    mapping: Mapping,\n    configuration: PasswordSqlConfiguration,\n    input: PasswordMutationInput,\n    action: PasswordAction,\n    revisions: {\n      readonly credentialRevision: SecurityRevision;\n      readonly verifierVersion: SecurityRevision;\n      readonly nextSecurityRevision: SecurityRevision;\n    },\n    prepare: (value: PasswordMutationDecision, journal: CommitJournal) => PreparedCommit<A>,\n  ) {\n    const journal = yield* CurrentCommitJournal;\n\n    const authority = yield* validateMutationAuthority(mapping, configuration, input, action);\n\n    if (authority === undefined) return prepare(\"rejected\", journal);\n    if ((yield* commandExists(mapping, input.moduleId, input.commandId, true)).length)\n      return prepare(\"rejected\", journal);\n    if (!(yield* currentExpectedCredential(mapping, input, authority.nativeSubjectId)))\n      return prepare(\"rejected\", journal);\n    const prepared = prepare(\"changed\", journal);\n\n    if (\n      !(yield* writeReplacement(\n        mapping,\n        input,\n        authority.nativeSubjectId,\n        revisions,\n        authority.now,\n      ))\n    )\n      return yield* unavailable();\n    yield* registerReplacement(mapping, input, authority.nativeSubjectId, revisions, authority.now);\n\n    return prepared;\n  });\n\n  /** Internal bound-owner primitives; deliberately not re-exported by driver modules. */\n  const passwordSqlKernel = {\n    allocate,\n    allocateNextSecurityRevision,\n    owned,\n    safeRead,\n    snapshotMutationInput,\n    lockSubject,\n    lockIdentifier,\n    readPasswordCredential,\n    resolveCredential,\n    validateMutationAuthority,\n    currentExpectedCredential,\n    commandExists,\n    addPasswordIn,\n    checkMutationApplied,\n    writeReplacement,\n    evidenceSatisfiedAt,\n    sameCredentialSnapshot,\n    subjectColumns,\n    identifierColumns,\n    credentialColumns,\n    authorityCredentialColumns,\n    proofCompletionMatchesPassword,\n  };\n\n  return { makeSqlPasswordPersistence, passwordSqlKernel };\n};\n"],"mappings":";;;;;;;;;;;;;;AAwFA,IAAa,qBAAb,cAAwC,QAAQ,QAAiD,CAAC,CAChG,gCACF,CAAC,CAAC,CAAC;AAoBH,MAAa,sBAIX,YACA,QACA,gBAA0E,WACxE,oBAAoB,MAAM,MACzB;CAGH,MAAM,EAAE,KAAK,IAAI,SAAS,QAAQ,iBAAiB;CACnD,MAAM,EAAE,wBAAwB;CAChC,MAAM,oBAAoB,oBAAoB,KAAK,CAAC,CAAC;CAErD,MAAM,oBACJ,WAEA,yBACE,SACC,UACC,OAAO,GAAG,mBAAmB,CAAC,CAAC,KAAK,KACpC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,sBAAsB,CAAC,CAAC,KAAK,CAC3C,CAAC,CAAC,KAAK,OAAO,YAAY,UAAU,OAAO,UAAU,MAAM,IAAI,aAAa,YAAY,CAAC,CAAC,CAAC,CAAC;CAE9F,MAAM,YAAY,SAAS,IAAI,KAAK,OAAO,IAAI,SAAS,aAAa,CAAC;CAEtE,MAAM,oBAAoB,YACxB,OAAO,QAAQ,2BAA2B,CAAC,CAAC,OACzC,CAAC,KAAK,WACL,QAAQ,YAAY,SAAqD,KAC7E;CAEF,MAAM,cAAc,OAAyB,YAC3C,WAAW,OAAO,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,IAAI;CAErE,MAAM,kBAAkB,aAAsB;EAC5C,IAAI,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,EAAE;EACpD,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;EAC5D,kBAAkB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,gBAAgB;CAClF;CAEA,MAAM,qBAAqB,aAAsB;EAC/C,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;EACxE,OAAO,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,KAAK;EAChE,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;EACxE,YAAY,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,UAAU;EAC1E,iBAAiB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,eAAe;CACtF;CAEA,MAAM,qBAAqB,aAAsB;EAC/C,UAAU,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,QAAQ;EACtE,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;EACxE,cAAc,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,YAAY;EAC9E,oBAAoB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,kBAAkB;EAC1F,iBAAiB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,eAAe;EACpF,UAAU,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,QAAQ;EACtE,eAAe,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,aAAa;CAClF;CAEA,MAAM,8BAA8B,aAAsB;EACxD,WAAW,OAAO,QAAQ,oBAAoB,OAAO,QAAQ,oBAAoB,SAAS;EAC1F,cAAc,OACZ,QAAQ,oBAAoB,OAC5B,QAAQ,oBAAoB,YAC9B;EACA,UAAU,OAAO,QAAQ,oBAAoB,OAAO,QAAQ,oBAAoB,QAAQ;CAC1F;CAEA,MAAM,kBAAkB,aAAsB;EAC5C,UAAU,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,QAAQ;EAChE,WAAW,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,SAAS;EAClE,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;EAC5D,eAAe,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,aAAa;EAC1E,UAAU,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,QAAQ;EAChE,gBAAgB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,cAAc;CAC9E;CAEA,MAAM,YACJ,MACA,YACA,cACoE;EACpE,IAAI,SAAS,eACX,OAAO,cAAc,KAAA,IACjB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;GACT,KAAK;GACL,QAAQ,UAAU,IAAI,wBAAwB;IAAE,WAAW;IAAW;GAAM,CAAC;EAC/E,CAAC;EACP,IAAI,eAAe,KAAA,GAAW,OAAO;EAErC,OAAO,cAAc,KAAA,IACjB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;GACT,KAAK;GACL,QAAQ,UAAU,IAAI,wBAAwB;IAAE,WAAW;IAAW;GAAM,CAAC;EAC/E,CAAC;CACP;CAEA,MAAM,gCACJ,SACA,MACA,YACG;EACH,MAAM,aAAa,QAAQ,QAAQ,uBAAuB,OAAO;EAEjE,MAAM,YACJ,QAAQ,QAAQ,6BAA6B,KAAA,IACzC,KAAA,UACM,QAAQ,QAAQ,yBAA0B,OAAO;EAE7D,OAAO,SACL,MACA,cAAc,QAAQ,kBACtB,aAAa,QAAQ,oBACvB;CACF;CAEA,MAAM,kBAAkB,MAAuB,UAC7C,KAAK,cAAc,MAAM,aAAa,KAAK,UAAU,MAAM;CAE7D,MAAM,uBACJ,UACA,aACA,QACY;EACZ,IAAI,SAAS,OAAO,SAAS,MAAM,SAAS,SAAS,YAAY,SAAS,IAAI,OAAO;EACrF,MAAM,4BAAY,IAAI,IAAoB;EAE1C,KAAK,MAAM,QAAQ,SAAS,SAAS,aAAa;GAChD,IAAI,UAAU,IAAI,KAAK,YAAY,GAAG,OAAO;GAC7C,UAAU,IAAI,KAAK,cAAc,KAAK,QAAQ;EAChD;EACA,IAAI,SAAS,OAAO,MAAM,UAAU,CAAC,UAAU,IAAI,MAAM,YAAY,CAAC,GAAG,OAAO;EAChF,IAAI,SAAS,OAAO,MAAM,UAAU,MAAM,SAAS,cAAc,MAAM,UAAU,CAAC,GAChF,OAAO;EAET,MAAM,WAAW,SAAS,OAAO,QAAQ,UAAU;GACjD,MAAM,MAAM,MAAM,SAAS,cAAc,MAAM,UAAU;GAEzD,OAAO,OAAO,KAAK,MAAM,YAAY;EACvC,CAAC;EAED,MAAM,UAAU,IAAI,IAAI,SAAS,SAAS,UAAU,MAAM,OAAO,CAAC;EAClE,MAAM,cAAc,IAAI,IAAI,SAAS,KAAK,UAAU,MAAM,YAAY,CAAC;EAEvE,OAAO,YAAY,aAAa,MAC7B,gBACC,YAAY,QAAQ,OAAO,WAAW,QAAQ,IAAI,MAAM,CAAC,KACzD,YAAY,QAAQ,YAAY,sBAChC,SAAS,MACN,WACE,CAAC,YAAY,gBAAgB,MAAM,kBACnC,CAAC,YAAY,qBAAqB,MAAM,kBAC7C,CACJ;CACF;CAEA,MAAM,wBAAwB,OAAO,GAAG,uCAAuC,CAAC,CAAC,WAC/E,OACA;EACA,MAAM,mBAAmB,yBAAyB,MAAM,gBAAgB;EAExE,MAAM,WAAW,OAAO,+BAA+B,MAAM,cAAc,QAAQ,CAAC,CAAC,KACnF,OAAO,SAAS,WAAW,CAC7B;EAEA,MAAM,cAAc,OAAO,4BAA4B,MAAM,cAAc,WAAW;EAEtF,MAAM,aACJ,MAAM,eAAe,KAAA,IACjB,KAAA,IACA,OAAO,2BAA2B,MAAM,UAAU;EAExD,OAAO,OAAO,OAAO;GACnB,GAAG;GACH;GACA,aAAa,OAAO,OAAO;IACzB,UAAU,SAAS,KAAK,SAAS,MAAM,MAAM,YAAY,QAAQ,CAAC;IAClE,eAAe,MAAM,YAAY;GACnC,CAAC;GACD,cAAc,OAAO,OAAO,EAAE,GAAG,MAAM,aAAa,CAAC;GACrD,GAAI,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW;GACjD,eAAe,OAAO,OAAO;IAC3B,WAAW,OAAO,OAAO;KACvB,GAAG,MAAM,cAAc;KACvB,UAAU,yBAAyB,MAAM,cAAc,UAAU,QAAQ;IAC3E,CAAC;IACD;IACA;GACF,CAAC;EACH,CAAC;CACH,CAAC;CAED,MAAM,cAAc,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAC3D,SACA,WACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,SAAgB;EAC1E,MAAM,IAAI,eAAe,OAAO;EAOhC,OAAO;GAAE;GAAiB,MAAK,OALX,WAClB,SAAS,OAAO,CAAC,CAAC,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAAC,MAAM,GAAG,EAAE,IAAI,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,GACtF,OACF,EAAA,CAEoC;EAAG;CACzC,CAAC;CAED,MAAM,iBAAiB,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,YACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EAEnC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,IAAI,GAAG,EAAE,WAAW,WAAW,SAAS,GAAG,GAAG,EAAE,OAAO,WAAW,KAAK,CAAC,CAAC,CAAC,CAChF,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,yBAAyB,OAAO,GAAG,gCAAgC,CAAC,CAAC,WACzE,SACA,UACA,iBACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EAEnC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,IAAI,GAAG,EAAE,UAAU,QAAQ,GAAG,GAAG,EAAE,WAAW,eAAe,CAAC,CAAC,CAAC,CACtE,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,oBAAoB,OAAO,GAAG,mCAAmC,CAAC,CAAC,WACvE,SACA,UACA,YACA,oBACA,SACA;EACA,MAAM,WAAW,OAAO;EAIxB,MAAM,cAAc,OAAO,eAAe,SAAS,YAAY,KAAK,EAAA,CAAG;EAEvE,IAAI,eAAe,KAAA,KAAa,CAAC,QAAQ,WAAW,UAAU,UAAU,GAAG,OAAO,KAAA;EAClF,MAAM,mBAAmB,WAAW,QAAQ,WAAW;EAWvD,MAAM,WAAU,OATW,WACzB,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,GAAG,eAAe,OAAO,CAAC,CAAC,IAAI,gBAAgB,CAAC,CAAC,CACvD,MAAM,CAAC,GACV,OACF,EAAA,CAE4B;EAE5B,IAAI,YAAY,KAAA,KAAa,CAAC,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,GAC1F,OAAO,KAAA;EAET,MAAM,iBAAgB,OADK,eAAe,SAAS,YAAY,OAAO,EAAA,CACpC;EAElC,IACE,kBAAkB,KAAA,KAClB,CAAC,QAAQ,WAAW,UAAU,aAAa,KAC3C,CAAC,QAAQ,UAAU,OAAO,kBAAkB,cAAc,QAAQ,WAAW,UAAU,GAEvF,OAAO,KAAA;EACT,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,gBAAgB;EAErE,IAAI,uBAAuB,KAAA,KAAa,uBAAuB,WAAW,OAAO,KAAA;EAEjF,MAAM,cAAa,OADQ,uBAAuB,SAAS,UAAU,kBAAkB,OAAO,EAAA,CAC/D;EAE/B,IAAI,eAAe,KAAA,GACjB,OAAO;GAAE,iBAAiB;GAAkB;GAAS,YAAY;EAAc;EAMjF,OAAO;GACL,iBAAiB;GACjB;GACA,YAAY;GACZ;GACA,UAAA,OATsB,QAAQ,WAC7B,OAAO;IAAE;IAAU;IAAS,YAAY;IAAe;GAAW,CAAC,CAAC,CACpE,KAAK,OAAO,QAAQ,0BAA0B,CAAC;EAQlD;CACF,CAAC;CAED,MAAM,SACJ,UACA,SACA,eACA,SACG;EACH,IAAI,CAAC,iBAAiB,OAAO,GAAG,OAAO,OAAO,KAAK,YAAY,CAAC;EAEhE,MAAM,MAAM,uBAER,SAAS,aAAa,gBACpB,KAAK,KACH,OAAO,eAAe,oBAAoB,WAAW,GACrD,OAAO,eAAe,iBAAiB,WAA0C,CACnF,CACF,GACF,EAAE,MAAM,cAAc,KAAK,CAC7B,CAAC,CAAC,KAAK,OAAO,KAAK,WAAW,OAAO,KAAK,CAAC;EAE3C,OAAO,cAAc,gBAAgB,OACjC,OAAO,IAAI,aAAa;GACtB,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;GACrD,OAAO,cAAc;GAErB,OAAO,OAAO;EAChB,CAAC,IACD;CACN;CAIA,MAAM,gBAAgB,OAAO,WAAW,WACtC,OACA;EACA,MAAM,iBAAiB,OAAO,OAAO,cAAc,8BAA8B;EAEjF,IAAI,OAAO,OAAO,cAAc,GAAG;EAEnC,MAAM,gBAAgB,OAAO,IAAI,aAAa;GAC5C,MAAM,cAAc,OAAO;GAE3B,IAAI,EAAE,OAAO,MAAM,KAAK,OAAO,eAAe,oBAAoB,WAAW,CAAC,IAC5E,OAAO,OAAO,YAAY;EAC9B,CAAC,CAAC,CAAC,KAAK,gBAAgB;EAExB,IAAI,CAAC,eAAe,MAAM,SAAS,aAAa,GAAG,OAAO,OAAO,YAAY;CAC/E,CAAC;CAED,MAAM,YACJ,UACA,eACA,SAEA,OAAO,IAAI,aAAa;EACtB,IAAI,cAAc,gBAAgB,MAAM;GACtC,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;GACrD,OAAO,cAAc;EACvB;EAEA,OAAO,OAAO,SAAS,aAAa,gBAClC,KAAK,KACH,OAAO,eAAe,oBAAoB,WAAW,GACrD,OAAO,eAAe,iBAAiB,WAA0C,CACnF,CACF;CACF,CAAC;CAEH,MAAM,kCACJ,UACG;EACH,MAAM,aAAa,MAAM,WAAW;EACpC,MAAM,UAAU,WAAW;EAE3B,IACE,WAAW,aAAa,GAAG,MAAM,SAAS,WAC1C,WAAW,YAAY,oBACvB,QAAQ,SAAS,aACjB,MAAM,eAAe,KAAA,KACrB,QAAQ,SAAS,cAAc,MAAM,iBAAiB,aACtD,QAAQ,SAAS,qBAAqB,MAAM,iBAAiB,oBAC7D,CAAC,eAAe,QAAQ,YAAY,MAAM,WAAW,UAAU,GAE/D,OAAO;EAET,MAAM,WAAW,CAAC,GAAG,MAAM,iBAAiB,WAAW,CAAC,CAAC,MAAM,MAAM,UACnE,KAAK,aAAa,cAAc,MAAM,YAAY,CACpD;EAEA,MAAM,SAAS,CAAC,GAAG,QAAQ,SAAS,WAAW,CAAC,CAAC,MAAM,MAAM,UAC3D,KAAK,aAAa,cAAc,MAAM,YAAY,CACpD;EAEA,OACE,SAAS,WAAW,OAAO,UAC3B,SAAS,OACN,MAAM,UACL,KAAK,iBAAiB,OAAO,MAAM,CAAE,gBACrC,KAAK,aAAa,OAAO,MAAM,CAAE,QACrC;CAEJ;CAEA,MAAM,uBAAuB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACrE,eACA,OACA;EACA,MAAM,WAAW,OAAO;EAExB,IAAI,cAAc,UAAU,KAAA,GAAW,OAAO,OAAO,OAAO,KAAK,YAAY,CAAC;EAC9E,MAAM,aAAa,EAAE,MAAM,+BAA+B;EAE1D,MAAM,OAA4B;GAChC;GACA,UAAU,UAAU,SAAS,YAAY,QAAQ,QAAQ,QAAQ,QAAQ,CAAC;EAC5E;EAEA,MAAM,QAAQ,uBAEV,SAAS,aAAa,gBACpB,oBACE,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MACA,OAAO,KAAK,UAAU,SAChB,KACR,CAAC,CAAC,KACA,OAAO,eAAe,iBAAiB,WAA0C,CACnF,CACF,GACF,EAAE,MAAM,cAAc,KAAK,CAC7B;EAEA,IAAI,cAAc,gBAAgB,SAAS,OAAO,iBAAiB,OAAO,OAAO,YAAY;EAC7F,OAAO,cAAc;EAErB,OAAO,OAAO,MAAM,KAClB,OAAO,GAAG,KAAK,GACf,OAAO,YAAY,UAAU;GAC3B,MAAM,SAAS,MAAM,QAAQ;GAE7B,OAAO,MAAM,QAAQ,WAAW,KAC9B,WAAW,KAAA,KACX,MAAM,aAAa,MAAM,KACzB,OAAO,UAAU,aACf,OAAO,QAAQ,IAAI,IACnB,OAAO,UAAU,KAAK;EAC5B,CAAC,CACH;CACF,CAAC;CAED,MAAM,4BAA4B,OAAO,GAAG,2CAA2C,CAAC,CACtF,WACE,SACA,eACA,OACA,QACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,SAAS,OAAO,YACpB,SACA,MAAM,iBAAiB,WACvB,cAAc,OAChB;EAEA,MAAM,MAAM,OAAO;EAEnB,IACE,QAAQ,KAAA,KACR,CAAC,QAAQ,QAAQ,eAAe,IAAI,QAAQ,QAAQ,OAAO,KAC3D,IAAI,QAAQ,QAAQ,sBAAsB,MAAM,iBAAiB,kBAEjE,OAAO,KAAA;EACT,IACE,MAAM,cAAc,UAAU,aAAa,MAAM,YACjD,MAAM,cAAc,UAAU,WAAW,UACzC,MAAM,cAAc,UAAU,cAAc,MAAM,aAClD,MAAM,cAAc,UAAU,SAAS,cAAc,MAAM,iBAAiB,aAC5E,MAAM,cAAc,UAAU,SAAS,qBACrC,MAAM,iBAAiB,oBACxB,MAAM,cAAc,SAAS,WAAuB,MAAM,aAC3D,MAAM,cAAc,SAAS,kBAC3B,MAAM,cAAc,UAAU,iBAChC,MAAM,cAAc,SAAS,SAAS,cAAc,MAAM,iBAAiB,aAC3E,MAAM,cAAc,SAAS,SAAS,qBACpC,MAAM,iBAAiB,oBACxB,WAAW,mBACT,MAAM,eAAe,KAAA,KACpB,MAAM,cAAc,UAAU,uBAAuB,KAAA,IAEzD,OAAO,KAAA;EACT,IACE,MAAM,iBAAiB,YAAY,MAChC,aACC,CAAC,MAAM,cAAc,SAAS,SAAS,YAAY,MAChD,WACC,OAAO,iBAAiB,SAAS,gBACjC,OAAO,aAAa,SAAS,QACjC,CACJ,GAEA,OAAO,KAAA;EACT,IAAI,MAAM,eAAe,KAAA,GAAW;GAClC,MAAM,cAAc,OAAO,eACzB,SACA,MAAM,WAAW,YACjB,cAAc,OAChB,EAAA,CAAG;GAEH,IACE,eAAe,KAAA,KACf,CAAC,QAAQ,WAAW,UAAU,UAAU,KACxC,CAAC,QAAQ,UAAU,OACjB,WAAW,QAAQ,WAAW,YAC9B,OAAO,eACT,KACA,WAAW,QAAQ,WAAW,qBAC5B,MAAM,WAAW,2BAEnB,OAAO,KAAA;EACX;EAEA,MAAM,cAAc,CAClB,GAAG,MAAM,iBAAiB,aAC1B,GAAG,MAAM,cAAc,SAAS,SAAS,WAC3C;EAEA,MAAM,WAAW,IAAI,IAAI,YAAY,KAAK,SAAS,CAAC,KAAK,cAAc,IAAI,CAAC,CAAC;EAE7E,MAAM,KAAK,2BAA2B,OAAO;EAE7C,MAAM,iBACJ,SAAS,SAAS,IACd,CAAC,IACD,OAAO,WACL,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,oBAAoB,KAAK,CAAC,CACvC,MACC,IACE,GAAG,GAAG,WAAW,OAAO,eAAe,GACvC,QAAQ,GAAG,cAAc,CAAC,GAAG,SAAS,KAAK,CAAC,CAAC,CAC/C,CACF,CAAC,CACA,QAAQ,GAAG,YAAY,GAC1B,cAAc,OAChB;EAEN,IAAI,eAAe,WAAW,SAAS,MAAM,OAAO,KAAA;EAEpD,KAAK,MAAM,UAAU,gBAAgB;GACnC,MAAM,SAAS,SAAS,IAAI,OAAO,QAAQ,oBAAoB,aAAa;GAE5E,IACE,WAAW,KAAA,KACX,OAAO,QAAQ,oBAAoB,cAAc,OAAO,YACvD,QAAQ,oBAAoB,WAAW,KAAA,KACtC,QAAQ,oBAAoB,iBAC1B,OAAO,QAAQ,oBAAoB,OACrC,MAAM,MAER,OAAO,KAAA;GACT,SAAS,OAAO,OAAO,YAAY;EACrC;EACA,IAAI,SAAS,SAAS,GAAG,OAAO,KAAA;EAChC,IAAI,MAAM,eAAe,KAAA,GAAW;GAClC,MAAM,cAAc,OAAO,eAAe,SAAS,MAAM,WAAW,YAAY,KAAK,EAAA,CAAG;GAExF,MAAM,cAAc,OAAO,uBACzB,SACA,MAAM,UACN,OAAO,iBACP,cAAc,OAChB,EAAA,CAAG;GAEH,IAAI,eAAe,KAAA,KAAa,eAAe,KAAA,GAAW,OAAO,KAAA;GAEjE,MAAM,WAAW,OAAO,QAAQ,WAAW,OAAO;IAChD,UAAU,MAAM;IAChB,SAAS;IACT;IACA;GACF,CAAC;GAED,IAAI,CAACA,+BAAuB,UAAU,MAAM,UAAU,GAAG,OAAO,KAAA;EAClE;EACA,MAAM,qBAAqB,OAAO,QAAQ,QAAQ,wBAAwB,KAAK,MAAM;EACrF,MAAM,MAAM,OAAO;EAEnB,IACE,CAAC,oBAAoB,MAAM,cAAc,UAAU,MAAM,cAAc,aAAa,GAAG,KACvF,CAAC,oBAAoB,MAAM,cAAc,UAAU,oBAAoB,GAAG,GAE1E,OAAO,KAAA;EACT,KACG,MAAM,aAAa,qBAAqB,eACvC,MAAM,aAAa,qBAAqB,mBAC1C,QAAQ,wBAAwB,4BAEhC,OAAO,KAAA;EAET,OAAO;GAAE,GAAG;GAAQ;EAAI;CAC1B,CACF;CAEA,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,UACA,WACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,eAAe,OAAO;EAEhC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,IAAI,GAAG,EAAE,UAAU,QAAQ,GAAG,GAAG,EAAE,WAAW,SAAS,CAAC,CAAC,CAAC,CAChE,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,OACA,QACA,KACA;EAGA,OAAO,QAAO,OAFU,mBAAA,CAED,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,OACnD,QAAQ,QAAQ,aAAa;GAC3B,UAAU,MAAM;GAChB,WAAW,MAAM;GACjB;GACA,eAAe,MAAM,cAAc,UAAU;GAC7C,UAAU;GACV,sBAAsB,MAAM,QAAQ;EACtC,CAAC,CACH;CACF,CAAC;CAED,MAAM,yBAAyB,OAAO,GAAG,wCAAwC,CAAC,CAAC,WACjF,SACA,OACA,iBACA,SACA,qBACA,KACA;EACA,IACE,YAAY,KAAA,KACZ,CAAC,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,KAC/D,wBAAwB,KAAA,KACvB,QAAQ,oBAAoB,WAAW,KAAA,KACtC,QAAQ,oBAAoB,iBAC1B,oBAAoB,QAAQ,oBAAoB,OAClD,MAAM,MAER,OAAO;EACT,IAAI,MAAM,eAAe,KAAA,GAAW;GAClC,MAAM,cAAc,OAAO,eAAe,SAAS,MAAM,WAAW,YAAY,KAAK,EAAA,CAAG;GAExF,IACE,eAAe,KAAA,KACf,CAAC,QAAQ,WAAW,UAAU,UAAU,KACxC,CAAC,QAAQ,UAAU,OAAO,WAAW,QAAQ,WAAW,YAAY,eAAe,KACnF,WAAW,QAAQ,WAAW,qBAC5B,MAAM,WAAW,2BAEnB,OAAO;GAET,MAAM,cAAc,OAAO,uBACzB,SACA,MAAM,UACN,iBACA,KACF,EAAA,CAAG;GAEH,IAAI,eAAe,KAAA,GAAW,OAAO;GASrC,KAAI,OAPmB,QAAQ,WAAW,OAAO;IAC/C,UAAU,MAAM;IAChB;IACA;IACA;GACF,CAAC,EAAA,CAEW,+BAA+B,MAAM,WAAW,4BAC1D,OAAO;EACX;EACA,MAAM,OAAO,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,WAAW,KAAK;EACjF,MAAM,MAAM,KAAK;EAEjB,OACE,KAAK,WAAW,KAChB,IAAI,QAAQ,QAAQ,YAAY,MAAM,cAAc,UAAU,UAC9D,IAAI,QAAQ,QAAQ,mBAAmB,MAAM,cAAc,UAAU,iBACrE,IAAI,QAAQ,QAAQ,cAAc,cACjC,OAAO,QAAQ,cAAc,IAAI,QAAQ,QAAQ,eAAe,OAC/D,MAAM,QAAQ;CAEpB,CAAC;CAED,MAAM,gBAAgB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAC/D,SACA,eACA,OACA,WAMA,YACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,EAAE,cAAc,oBAAoB,iBAAiB,yBAAyB;EAEpF,MAAM,YAAY,OAAO,0BACvB,SACA,eACA,OACA,cACF;EAEA,IAAI,cAAc,KAAA,GAAW,OAAO;EACpC,KAAK,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,WAAW,IAAI,EAAA,CAAG,QAAQ,OAAO;EAC1F,KACG,OAAO,uBAAuB,SAAS,MAAM,UAAU,UAAU,iBAAiB,IAAI,EAAA,CACpF,QAEH,OAAO;EAET,OAAO,SAAS,OAAO,QAAQ,WAAW,KAAK,CAAC,CAAC,OAC/C,QAAQ,WAAW,aAAa;GAC9B,UAAU,MAAM;GAChB,WAAW,UAAU;GACrB;GACA;GACA;GACA,aAAa,MAAM;EACrB,CAAC,CACH;EACA,OAAO,SAAS,OAAO,QAAQ,oBAAoB,KAAK,CAAC,CAAC,OACxD,QAAQ,oBAAoB,aAAa;GACvC,WAAW,UAAU;GACrB;GACA,UAAU;EACZ,CAAC,CACH;EACA,OAAO,SACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,IAAI,aAAa,CAAC,CAAC,QAAQ,QAAQ,kBAAkB,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAC7E,MACC,IACE,GAAG,eAAe,OAAO,CAAC,CAAC,IAAI,UAAU,eAAe,GACxD,GAAG,eAAe,OAAO,CAAC,CAAC,kBAAkB,MAAM,iBAAiB,gBAAgB,CACtF,CACF;EACF,OAAO,cAAc,SAAS,OAAO,gBAAgB,cAAc,UAAU,GAAG;EAEhF,MAAM,UAAU,qBACd,SACA,OACA,UAAU,iBACV,WACA,cAAc,UAAU,GAC1B;EAEA,IAAI,EAAE,OAAO,UAAU,OAAO,OAAO,YAAY;EACjD,OAAO,cAAc,OAAO;EAE5B,OAAO;CACT,CAAC;CAED,MAAM,6BAA6B,OAAO,GAAG,4BAA4B,CAAC,CAAC,WACzE,SACA,eAKA;EACA,MAAM,WAAW,OAAO;EAExB,IAAI,CAAC,cAAc,aACjB,QACE,WAAW,kBAAkB;GAC3B,GAAG;GACH,OAAO,cAAc,OAAO;EAC9B,CAAC,KAAK,OAAO,KAAA,CACb,KAAK,OAAO,SAAS,WAAW,CAAC;EACrC,MAAM,QAAQ,OAAO;EAErB,IAAI,CAAC,iBAAiB,OAAO,GAAG,OAAO,OAAO,YAAY;EAC1D,MAAM,OAAO,OAAO;EAEpB,MAAM,cAAc,OAAO,wBACzB,OAAO,iBAAiB,aAAa,KAAK,QAAQ,kBAAkB,GAAG,IAAI,CAAC,CAAC,CAAC,KAC5E,gBACF,GACA,SACA,aACF;EAEA,OAAO,oBAAoB,GAAG;GAC5B,GAAG;GACH,iBAAiB,UACf,SACE,UACA,eACA,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAE3B,MAAM,SAAS,OAAO,YAAY,SAAS,MAAM,WAAW,KAAK;IAEjE,IACE,OAAO,QAAQ,KAAA,KACf,CAAC,QAAQ,QAAQ,eAAe,OAAO,IAAI,QAAQ,QAAQ,OAAO,GAElE,OAAO,OAAO,KAAK;IAErB,MAAM,cAAc,OAAO,uBACzB,SACA,MAAM,UACN,OAAO,iBACP,KACF,EAAA,CAAG;IAEH,IAAI,eAAe,KAAA,GAAW,OAAO,OAAO,KAAK;IACjD,MAAM,KAAK,kBAAkB,OAAO;IAOpC,MAAM,cAAa,OALQ,YACxB,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,GAAG,GAAG,WAAW,OAAO,eAAe,CAAC,EAAA,CAElB,MAAM,QAAa,QAAQ,WAAW,UAAU,GAAG,CAAC;IAEnF,IAAI,eAAe,KAAA,GAAW,OAAO,OAAO,KAAK;IAEjD,MAAM,WAAW,OAAO,QAAQ,WAC7B,OAAO;KACN,UAAU,MAAM;KAChB,SAAS,OAAO;KAChB;KACA;IACF,CAAC,CAAC,CACD,KAAK,OAAO,QAAQ,0BAA0B,CAAC;IAElD,OAAO,OAAO,KAAK,QAAQ;GAC7B,CAAC,CACH,CAAC,CAAC,KACA,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,iBAAiB,UACf,SACE,UACA,eACA,OAAO,IAAI,aAAa;IACtB,MAAM,WAAW,OAAO,kBACtB,SACA,MAAM,UACN,MAAM,YACN,KAAA,GACA,KACF;IAEA,OAAO,UAAU,aAAa,KAAA,KAC5B,SAAS,SAAS,+BAA+B,KAAA,IAC/C,OAAO,KAAK,IACZ,OAAO,KAAK,SAAS,QAAQ;GACnC,CAAC,CACH,CAAC,CAAC,KACA,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,cAAc,YAAY,YACxB,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,OAAO,sBAAsB,UAAU;IAErD,MAAM,eAAe,OAAO,SAC1B,cAAc,MACd,QAAQ,sBACR,QAAQ,wBACV;IAEA,MAAM,qBAAqB,OAAO,SAChC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,kBAAkB,OAAO,SAC7B,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,uBAAuB,OAAO,6BAClC,SACA,cAAc,MACd,MAAM,iBAAiB,gBACzB;IAEA,IAAI,yBAAyB,MAAM,iBAAiB,kBAClD,OAAO,OAAO,YAAY;IAE5B,OAAO,OAAO,MACZ,UACA,SACA,eACA,OAAO,IAAI,aAAa;KACtB,MAAM,UAAU,OAAO;KASvB,OAAO,SAAQ,OAPQ,cAAc,SAAS,eAAe,OAAO;MAClE;MACA;MACA;MACA;KACF,CAAC,KAEwB,YAAY,YAAY,OAAO;IAC1D,CAAC,CACH;GACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,mBAAmB,YAAY,YAC7B,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,OAAO,sBAAsB,UAAU;IAErD,MAAM,qBAAqB,OAAO,SAChC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,kBAAkB,OAAO,SAC7B,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,uBAAuB,OAAO,6BAClC,SACA,cAAc,MACd,MAAM,iBAAiB,gBACzB;IAEA,IACE,yBAAyB,MAAM,iBAAiB,oBAC/C,MAAM,eAAe,KAAA,KACpB,uBAAuB,MAAM,WAAW,oBAE1C,OAAO,OAAO,YAAY;IAE5B,OAAO,OAAO,MACZ,UACA,SACA,eACA,OAAO,IAAI,aAAa;KACtB,OAAO,OAAO,UACZ,SACA,eACA,OACA,mBACA;MAAE;MAAoB;MAAiB;KAAqB,GAC5D,OACF;IACF,CAAC,CACH;GACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,aAAa,WACV,cAAc,UAAU,KAAA,IACrB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI,aAAa;IACtB,IACE,MAAM,SAAS,UAAU,KACzB,CAAC,MAAM,SAAS,SAAS,QAAQ,KACjC,MAAM,YAAY,oBAClB,MAAM,QAAQ,SAAS,WAEvB,OAAO;IACT,MAAM,UAAU,MAAM;IACtB,MAAM,mBAAmB,MAAM,SAAS,MAAM,GAAG,EAAgB;IA6BjE,QAAO,OA3BgB,SACrB,UACA,eACA,OAAO,IAAI,aAAa;KACtB,MAAM,WAAW,OAAO,kBACtB,SACA,kBACA,QAAQ,YACR,QAAQ,SAAS,WACjB,KACF;KAEA,OACE,UAAU,aAAa,KAAA,KACvB,SAAS,SAAS,SAAS,qBACzB,QAAQ,SAAS,oBACnB,QAAQ,SAAS,YAAY,OAAO,SAClC,SAAS,SAAU,SAAS,YAAY,MACrC,WACC,OAAO,iBAAiB,KAAK,gBAC7B,OAAO,aAAa,KAAK,QAC7B,CACF;IAEJ,CAAC,CACH,KAEiB,OAAO,qBAAqB,eAAe,KAAK,IAAI;GACvE,CAAC,EAAA,CACH,KACA,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,iBAAiB,YAAY,aAC1B,cAAc,UAAU,KAAA,IACrB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,OAAO,OAAO;KAC1B,GAAI,OAAO,sBAAsB,UAAU;KAC3C,YAAY,WAAW;IACzB,CAAC;IAED,MAAM,qBAAqB,OAAO,SAChC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,kBAAkB,OAAO,SAC7B,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,uBAAuB,OAAO,6BAClC,SACA,cAAc,MACd,MAAM,iBAAiB,gBACzB;IAEA,IACE,yBAAyB,MAAM,iBAAiB,oBAC/C,MAAM,eAAe,KAAA,KACpB,uBAAuB,MAAM,WAAW,oBAE1C,OAAO,OAAO,YAAY;IAE5B,OAAO,OAAO,MACZ,UACA,SACA,eACA,OAAO,IAAI,aAAa;KACtB,MAAM,UAAU,OAAO;KAEvB,IAAI,CAAC,+BAA+B,KAAK,GAAG,OAAO,QAAQ,YAAY,OAAO;KAE9E,MAAM,YAAY,OAAO,0BACvB,SACA,eACA,OACA,gBACF;KAEA,IAAI,cAAc,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;KAC/D,KAAK,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,WAAW,IAAI,EAAA,CAAG,QACzE,OAAO,QAAQ,YAAY,OAAO;KAQpC,IAAI,EAAC,OANkB,0BACrB,SACA,OACA,UAAU,eACZ,IAEc,OAAO,QAAQ,YAAY,OAAO;KAChD,IAAI;KAEJ,OAAO,oBACL,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MAAM,YACN,OAAO,IAAI,aAAa;MACtB,MAAM,YAAY;OAChB;OACA;OACA;MACF;MAEA,MAAM,UAAU,OAAO,iBACrB,SACA,OACA,UAAU,iBACV,WACA,UAAU,GACZ;MAEA,IAAI,SACF,OAAO,oBACL,SACA,OACA,UAAU,iBACV,WACA,UAAU,GACZ;MAEF,OAAO;KACT,CAAC,IACA,aAAa;MACZ,kBAAkB,QAChB,aAAa,cAAc,YAAY,YACvC,OACF;MAEA,OAAO;KACT,CACF;KAEA,OAAO,mBAAmB,QAAQ,YAAY,OAAO;IACvD,CAAC,CACH;GACF,CAAC,EAAA,CACH,KACA,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACJ,CAAC;CACH,CAAC;CAED,MAAM,4BAA4B,OAAO,GAAG,2CAA2C,CAAC,CACtF,WAAW,SAAkB,OAA8B,iBAA0B;EACnF,IAAI,MAAM,eAAe,KAAA,GAAW,OAAO;EAE3C,MAAM,OAAO,OAAO,uBAClB,SACA,MAAM,UACN,iBACA,IACF,EAAA,CAAG;EAEH,IAAI,QAAQ,KAAA,GAAW,OAAO;EAE9B,OACE,IAAI,QAAQ,WAAW,kBAAkB,MAAM,WAAW,gBAC1D,IAAI,QAAQ,WAAW,wBAAwB,MAAM,WAAW,sBAChE,IAAI,QAAQ,WAAW,qBAAqB,MAAM,WAAW,mBAC7D,IAAI,QAAQ,WAAW,cAAc,SAAS,MAAM,MAAM,WAAW,QAAQ,KAC7E,IAAI,QAAQ,WAAW,mBAAmB,MAAM,WAAW,iBAC3D,MAAM,cAAc,UAAU,uBAAuB,MAAM,WAAW;CAE1E,CACF;CAEA,MAAM,uBAAuB,OAAO,GAAG,sCAAsC,CAAC,CAAC,WAC7E,SACA,OACA,iBACA,WAMA,KACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO,GACjC,IAAI,eAAe,OAAO;EAE5B,MAAM,cAAc,OAAO,SACxB,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,WAAW,eAAe,GAC/B,GAAG,EAAE,cAAc,UAAU,YAAY,GACzC,GAAG,EAAE,oBAAoB,UAAU,kBAAkB,GACrD,GAAG,EAAE,iBAAiB,UAAU,eAAe,GAC/C,GAAG,EAAE,UAAU,SAAS,MAAM,MAAM,YAAY,QAAQ,CAAC,GACzD,GAAG,EAAE,eAAe,MAAM,YAAY,aAAa,CACrD,CACF,CAAC,CACA,MAAM,CAAC,EAAA,CAAG;EAEb,MAAM,WAAW,OAAO,SACrB,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,IAAI,GAAG,EAAE,IAAI,eAAe,GAAG,GAAG,EAAE,kBAAkB,UAAU,oBAAoB,CAAC,CAAC,CAAC,CAC7F,MAAM,CAAC,EAAA,CAAG;EAEb,MAAM,uBAAuB,OAAO,SACjC,OAAO,CAAC,CACR,KAAK,QAAQ,oBAAoB,KAAK,CAAC,CACvC,MACC,IACE,GAAG,2BAA2B,OAAO,CAAC,CAAC,WAAW,eAAe,GACjE,GAAG,2BAA2B,OAAO,CAAC,CAAC,cAAc,UAAU,YAAY,GAC3E,GAAG,2BAA2B,OAAO,CAAC,CAAC,UAAU,UAAU,kBAAkB,CAC/E,CACF,CAAC,CACA,MAAM,CAAC,EAAA,CAAG;EAGb,OACE,eAAe,KAAA,KACf,WAAW,QAAQ,WAAW,kBAAkB,UAAU,gBAC1D,WAAW,QAAQ,WAAW,wBAAwB,UAAU,sBAChE,WAAW,QAAQ,WAAW,qBAAqB,UAAU,mBAC7D,WAAW,QAAQ,WAAW,cAAc,SAAS,MAAM,MAAM,YAAY,QAAQ,KACrF,WAAW,QAAQ,WAAW,mBAAmB,MAAM,YAAY,kBAClE,OAAO,uBACN,SACA,OACA,iBACA,SACA,qBACA,GACF;CAEJ,CAAC;CAED,MAAM,mBAAmB,OAAO,GAAG,kCAAkC,CAAC,CAAC,WACrE,SACA,OACA,iBACA,WAKA,KACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EACnC,MAAM,IAAI,eAAe,OAAO;EAEhC,OAAO,SACJ,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,IACC,QAAQ,WAAW,kBAAkB;GACnC,aAAa,MAAM;GACnB,oBAAoB,UAAU;GAC9B,iBAAiB,UAAU;EAC7B,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,WAAW,eAAe,GAC/B,GAAG,EAAE,cAAc,MAAM,WAAY,YAAY,GACjD,GAAG,EAAE,oBAAoB,MAAM,WAAY,kBAAkB,GAC7D,GAAG,EAAE,iBAAiB,MAAM,WAAY,eAAe,GACvD,GAAG,EAAE,UAAU,SAAS,MAAM,MAAM,WAAY,QAAQ,CAAC,GACzD,GAAG,EAAE,eAAe,MAAM,WAAY,aAAa,CACrD,CACF;EACF,OAAO,SACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,IAAI,aAAa,CAAC,CAAC,QAAQ,QAAQ,kBAAkB,UAAU,oBAAoB,CAAC,CAAC,CAAC,CAAC,CACvF,MACC,IACE,GAAG,EAAE,IAAI,eAAe,GACxB,GAAG,EAAE,kBAAkB,MAAM,iBAAiB,gBAAgB,CAChE,CACF;EACF,OAAO,SACJ,OAAO,QAAQ,oBAAoB,KAAK,CAAC,CACzC,IAAI,QAAQ,oBAAoB,eAAe,UAAU,kBAAkB,CAAC,CAAC,CAC7E,MACC,IACE,GAAG,2BAA2B,OAAO,CAAC,CAAC,WAAW,eAAe,GACjE,GAAG,2BAA2B,OAAO,CAAC,CAAC,cAAc,MAAM,WAAY,YAAY,GACnF,GAAG,2BAA2B,OAAO,CAAC,CAAC,UAAU,MAAM,WAAY,kBAAkB,CACvF,CACF;EACF,OAAO,cAAc,SAAS,OAAO,MAAM,cAAc,UAAU,QAAQ,GAAG;EAE9E,OAAO,OAAO,qBACZ,SACA,OACA,iBACA;GACE,GAAG;GACH,cAAc,MAAM,WAAY;EAClC,GACA,GACF;CACF,CAAC;CAED,MAAM,uBACJ,SACA,OACA,iBACA,WAKA,QAEA,cACE,qBACE,SACA,OACA,iBACA;EAAE,GAAG;EAAW,cAAc,MAAM,WAAY;CAAa,GAC7D,GACF,CACF;CAEF,MAAM,YAAY,OAAO,GAAG,mBAAmB,CAAC,CAAC,WAC/C,SACA,eACA,OACA,QACA,WAKA,SACA;EACA,MAAM,UAAU,OAAO;EAEvB,MAAM,YAAY,OAAO,0BAA0B,SAAS,eAAe,OAAO,MAAM;EAExF,IAAI,cAAc,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;EAC/D,KAAK,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,WAAW,IAAI,EAAA,CAAG,QACzE,OAAO,QAAQ,YAAY,OAAO;EACpC,IAAI,EAAE,OAAO,0BAA0B,SAAS,OAAO,UAAU,eAAe,IAC9E,OAAO,QAAQ,YAAY,OAAO;EACpC,MAAM,WAAW,QAAQ,WAAW,OAAO;EAE3C,IACE,EAAE,OAAO,iBACP,SACA,OACA,UAAU,iBACV,WACA,UAAU,GACZ,IAEA,OAAO,OAAO,YAAY;EAC5B,OAAO,oBAAoB,SAAS,OAAO,UAAU,iBAAiB,WAAW,UAAU,GAAG;EAE9F,OAAO;CACT,CAAC;CA4BD,OAAO;EAAE;EAA4B,mBAAA;GAxBnC;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA,wBAAA;GACA;GACA;GACA;GACA;GACA;EAGmD;CAAE;AACzD"}

package/dist/internal/persistence.d.mts

@@ -1,9 +1,9 @@
 import { NativeDatabase } from "./transaction-kernel.mjs";
 import { QueryOperations } from "./query-operations.mjs";
 import { CurrentProofSql } from "./proof-kernel.mjs";
-import { NativeSqlTables } from "./native-sql-table.mjs";
 import { StorageTable } from "./storage-tables.mjs";
 import { MappingInput, PasskeyFeature, PersistenceApi, PersistenceConfigurationError } from "./configuration.mjs";
+import { NativeSqlTables } from "./native-sql-table.mjs";
 import { Context, Crypto, Effect } from "effect";
 import { SqlClient } from "effect/sql";
 import { PasskeyConfig } from "@yielded/auth/Passkey";

package/dist/internal/persistence.mjs

@@ -10,9 +10,9 @@ import { CurrentEmailSql, makeEmailKernel } from "./email-kernel.mjs";
 import { CurrentPasswordSql, makePasswordKernel } from "./password-kernel.mjs";
 import { CurrentPhoneTransaction, makePhoneKernel } from "./phone-kernel.mjs";
 import { makeRegistrationAuthority } from "./registration.mjs";
+import { validateStorageBatch, withStorageValidation } from "./storage-validation.mjs";
 import { CurrentSessionSql, makeSessionKernel } from "./session-kernel.mjs";
 import { makeMappings } from "./storage-mapping.mjs";
-import { validateStorageBatch, withStorageValidation } from "./storage-validation.mjs";
 import { Context, Effect, Layer, Schema } from "effect";
 import { SqlClient } from "effect/sql";
 import { LifecycleHooks } from "@yielded/auth/Hooks";
@@ -65,7 +65,7 @@ const createPersistence = (backend) => {
 			"sessions",
 			"sessionFlows"
 		];
-		if (password) roles.push("passwords", "passwordAttempts", "passwordCommands");
+		if (password) roles.push("passwords", "passwordCommands");
 		if (management) roles.push("passwordRegistrations");
 		if (email) roles.push("emailCredentials", "emailCommands");
 		if (phone) roles.push("phoneState");

package/dist/internal/persistence.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"persistence.mjs","names":[],"sources":["../../src/internal/persistence.ts"],"sourcesContent":["import { EmailAddressPersistence, EmailUnavailable } from \"@yielded/auth/Email\";\nimport { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport type { PasskeyConfig } from \"@yielded/auth/Passkey\";\nimport { PasswordPersistence, PasswordUnavailable } from \"@yielded/auth/Password\";\nimport { hooksLayer } from \"@yielded/auth/Persistence\";\nimport { PhoneAdmission, PhoneSignInTargets, PhoneOtpUnavailable } from \"@yielded/auth/PhoneOtp\";\nimport { ProofPersistence, ProofUnavailable } from \"@yielded/auth/Proofs\";\nimport { AuthenticationAuthority, SessionUnavailable } from \"@yielded/auth/Sessions\";\nimport { Context, type Crypto, Effect, Layer, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\n\nimport {\n  PersistenceConfigurationError,\n  type ClaimsCodec,\n  type ConfigId,\n  type Definition,\n  type PersistenceApi,\n  type Ports,\n  type Roles,\n  type Provisioning,\n  type ProvisioningRequirement,\n  type StorageLayout,\n  type SubjectMapping,\n  type SubjectOptions,\n  type PasskeyFeature,\n  type PasskeyRequirement,\n  type MappingInput,\n} from \"./configuration\";\nimport { randomId } from \"./crypto\";\nimport { makeEmailKernel, CurrentEmailSql, type EmailSqlDatabase } from \"./email-kernel\";\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport type { NativeSqlTables } from \"./native-sql-table\";\nimport {\n  makePasswordKernel,\n  CurrentPasswordSql,\n  type PasswordSqlDatabase,\n} from \"./password-kernel\";\nimport { makePhoneKernel, CurrentPhoneTransaction } from \"./phone-kernel\";\nimport {\n  makeProofKernel,\n  CurrentProofSql,\n  type ProofSqlDatabase,\n  type ProofSqlQuery,\n} from \"./proof-kernel\";\nimport type { QueryOperations } from \"./query-operations\";\nimport { makeRegistrationAuthority } from \"./registration\";\nimport { makeSessionKernel, CurrentSessionSql, type SessionSqlDatabase } from \"./session-kernel\";\nimport { requireStandalone } from \"./standalone\";\nimport { makeMappings } from \"./storage-mapping\";\nimport {\n  tableDefinition,\n  storageTables,\n  type StorageRole,\n  type StorageTable,\n} from \"./storage-tables\";\nimport {\n  validateStorageBatch,\n  withStorageValidation,\n  type StorageValidation,\n} from \"./storage-validation\";\nimport { makeTransactionExecutionKernel } from \"./transaction-execution-kernel\";\nimport {\n  makeTransactionKernel,\n  NativeDatabase,\n  type TransactionNativeDatabase,\n} from \"./transaction-kernel\";\n\nexport interface Backend<T extends object, R> {\n  readonly makeTable: (definition: StorageTable) => T;\n  readonly describe: (table: T) => StorageTable;\n  readonly acquire: Effect.Effect<object, PersistenceConfigurationError, R | SqlClient.SqlClient>;\n  readonly operations: QueryOperations;\n  readonly nativeTables: (client: SqlClient.SqlClient, database: object) => NativeSqlTables;\n  readonly passkeys: (input: {\n    readonly storage: MappingInput;\n    readonly namespace: string;\n    readonly dialect: \"pg\" | \"sqlite\";\n    readonly features: ReadonlyArray<PasskeyFeature>;\n    readonly passwordModules: ReadonlyArray<string>;\n  }) => Effect.Effect<\n    Context.Context<never>,\n    PersistenceConfigurationError,\n    | PasskeyConfig\n    | LifecycleHooks\n    | SqlClient.SqlClient\n    | NativeDatabase\n    | CurrentProofSql\n    | Crypto.Crypto\n  >;\n}\n\nconst configError = (reason: string) => PersistenceConfigurationError.make({ reason });\n\nconst mappingError = (cause: unknown) =>\n  PersistenceMappingError.make({ operation: \"mapping\", cause });\n\nconst timestampKeys = new Set([\n  \"verifiedAt\",\n  \"createdAt\",\n  \"lastIssueAt\",\n  \"issuedAt\",\n  \"expiresAt\",\n  \"absoluteExpiresAt\",\n  \"retentionUntil\",\n  \"claimDeadline\",\n  \"retryAt\",\n  \"admittedAt\",\n  \"deadline\",\n  \"occurredAt\",\n  \"dedupUntil\",\n]);\n\nexport const createPersistence = <T extends object, R>(\n  backend: Backend<T, R>,\n): PersistenceApi<T, R> => {\n  const proofKernel = makeProofKernel(backend.operations);\n  const passwordKernel = makePasswordKernel(backend.operations, proofKernel, backend.nativeTables);\n  const emailKernel = makeEmailKernel(backend.operations, proofKernel);\n  const sessionKernel = makeSessionKernel(backend.operations, backend.nativeTables);\n  const transactionKernel = makeTransactionKernel(backend.operations);\n  const executionKernel = makeTransactionExecutionKernel(transactionKernel);\n  const phoneKernel = makePhoneKernel(backend.operations, transactionKernel);\n\n  const make = <C extends ClaimsCodec, const Id extends string, const A extends Definition<C, Id>>(\n    auth: A & Definition<C, Id>,\n  ) => {\n    const features = Object.values(auth.strategies).map((strategy) => strategy.persistence);\n    const phone = features.some((feature) => feature?.kind === \"phone\");\n    const password = features.some((feature) => feature?.kind === \"password\");\n\n    const passkeys = features.filter(\n      (feature): feature is PasskeyFeature => feature?.kind === \"passkey\",\n    );\n\n    const management = features.some(\n      (feature) => feature?.kind === \"password\" && feature.management,\n    );\n\n    const email = features.some((feature) => feature?.kind === \"email\" && feature.addresses);\n    const proofs = phone || management || email;\n\n    const roles: StorageRole[] = [\"identifiers\", \"credentials\", \"sessions\", \"sessionFlows\"];\n\n    if (password) roles.push(\"passwords\", \"passwordAttempts\", \"passwordCommands\");\n    if (management) roles.push(\"passwordRegistrations\");\n    if (email) roles.push(\"emailCredentials\", \"emailCommands\");\n    if (phone) roles.push(\"phoneState\");\n    if (passkeys.length > 0)\n      roles.push(\n        \"passkeyCredentials\",\n        \"passkeyOwnership\",\n        \"passkeyHandles\",\n        \"passkeyModules\",\n        \"passkeyFlows\",\n        \"passkeyAdmissions\",\n        \"passkeyCharges\",\n      );\n    if (passkeys.some((feature) => feature.management)) roles.push(\"passkeyCommands\");\n    if (proofs)\n      roles.push(\n        \"proofRequests\",\n        \"proofSeries\",\n        \"proofGenerations\",\n        \"proofContinuations\",\n        \"proofScopes\",\n        \"proofAbuse\",\n        \"proofFailures\",\n        \"proofCommands\",\n      );\n\n    const ConfigKey = Context.Service<\n      ConfigId<A[\"namespace\"]>,\n      StorageLayout<T, Roles<C, Id, A>>\n    >()(`@yielded/auth-persistence/${auth.namespace}/Config`);\n\n    const Config = Object.assign(ConfigKey, {\n      layer: (value: StorageLayout<T, Roles<C, Id, A>>) => Layer.succeed(ConfigKey, value),\n    });\n\n    const ProvisioningKey = Context.Service<ProvisioningRequirement<A>, Provisioning<A>>()(\n      `@yielded/auth-persistence/${auth.namespace}/Provisioning`,\n    );\n\n    const layout = <N, Instant>(\n      options: {\n        readonly subjects: SubjectOptions<T, N>;\n        readonly tables?: Partial<Record<StorageRole, T>>;\n        readonly prefix?: string;\n        readonly timestamps?: {\n          readonly type: \"text\" | \"integer\";\n          readonly codec: Schema.Codec<number, Instant>;\n        };\n      },\n      managed: boolean,\n    ): StorageLayout<T, Roles<C, Id, A>> => {\n      const subject = options.subjects;\n\n      if (passkeys.length > 0 && options.timestamps !== undefined)\n        throw configError(\n          \"Composed passkey storage uses integer milliseconds; use an explicit passkey adapter for a custom timestamp representation\",\n        );\n      const description = backend.describe(subject.table);\n      const idColumn = description.columns[subject.id];\n\n      for (const key of [subject.id, subject.status, subject.securityRevision]) {\n        if (description.columns[key] === undefined)\n          throw configError(`Missing subject column ${key}`);\n      }\n      if (subject.activeValue === undefined)\n        throw configError(\"An explicit active subject value is required\");\n\n      if (idColumn === undefined || idColumn.type === \"boolean\")\n        throw configError(\"Subject ID must map a text or integer column\");\n\n      const prefix = options.prefix;\n\n      if (managed && (prefix === undefined || !/^[A-Za-z_][A-Za-z0-9_]{0,100}$/.test(prefix)))\n        throw configError(\"Managed persistence requires an explicit SQL table prefix\");\n\n      const schema: Partial<Record<StorageRole, T>> = { ...options.tables };\n\n      for (const role of roles) {\n        if (schema[role] === undefined && managed) {\n          const definition = tableDefinition(role, `${prefix}_${role}`, idColumn.type);\n\n          const adjusted =\n            options.timestamps === undefined\n              ? definition\n              : {\n                  ...definition,\n                  columns: Object.fromEntries(\n                    Object.entries(definition.columns).map(([key, column]) => [\n                      key,\n                      timestampKeys.has(key)\n                        ? { ...column, type: options.timestamps?.type ?? column.type }\n                        : column,\n                    ]),\n                  ),\n                };\n\n          schema[role] = backend.makeTable(adjusted);\n        }\n      }\n      for (const role of roles) {\n        if (schema[role] === undefined) throw configError(`Missing ${role} table`);\n      }\n      const instantCodec = options.timestamps?.codec;\n\n      const decodeInstant =\n        instantCodec === undefined\n          ? Schema.decodeUnknownEffect(Schema.Int)\n          : Schema.decodeUnknownEffect(instantCodec);\n\n      const decodeInstantSync =\n        instantCodec === undefined\n          ? Schema.decodeUnknownSync(Schema.Int)\n          : Schema.decodeUnknownSync(instantCodec);\n\n      const subjects: SubjectMapping = {\n        table: subject.table,\n        id: subject.id,\n        status: subject.status,\n        securityRevision: subject.securityRevision,\n        activeValue: subject.activeValue,\n        requirements: subject.requirements,\n        actionRequirements: subject.actionRequirements ?? subject.requirements,\n        toSubject: (id) =>\n          Schema.decodeUnknownEffect(subject.idCodec)(id).pipe(Effect.mapError(mappingError)),\n        toNative: (id) =>\n          Schema.encodeEffect(subject.idCodec)(id).pipe(Effect.mapError(mappingError)),\n        toSubjectSync: Schema.decodeUnknownSync(subject.idCodec),\n        toNativeSync: Schema.encodeSync(subject.idCodec),\n      };\n\n      return Object.freeze({\n        namespace: auth.namespace,\n        schema: Object.freeze(schema) as Readonly<Record<Roles<C, Id, A>, T>>,\n        tables: schema,\n        subjects,\n        encodeInstant:\n          instantCodec === undefined ? (millis: number) => millis : Schema.encodeSync(instantCodec),\n        decodeInstant: (value: unknown) => decodeInstant(value).pipe(Effect.mapError(mappingError)),\n        decodeInstantSync,\n      });\n    };\n\n    const services = Layer.effectContext(\n      Effect.gen(function* () {\n        const storage = yield* ConfigKey;\n        const hooks = yield* LifecycleHooks;\n        const client = yield* SqlClient.SqlClient;\n        const database = yield* backend.acquire;\n\n        const dialect = client.onDialectOrElse({\n          pg: () => \"pg\" as const,\n          sqlite: () => \"sqlite\" as const,\n          orElse: () => undefined,\n        });\n\n        if (dialect === undefined)\n          return yield* configError(\"Use an explicit adapter for this SQL dialect\");\n        if (auth.sessionMode !== \"stateful\")\n          return yield* configError(\"The composed layer currently requires stateful sessions\");\n        if (\n          features.some(\n            (feature) =>\n              feature === undefined ||\n              (\"lifecycle\" in feature && feature.lifecycle) ||\n              (feature.kind === \"email\" && !feature.addresses),\n          )\n        )\n          return yield* configError(\n            \"Use explicit services for strategies without composed persistence support\",\n          );\n        if (storage.namespace !== auth.namespace)\n          return yield* configError(\n            \"Persistence configuration belongs to a different Auth definition\",\n          );\n        const validations: StorageValidation[] = [];\n\n        for (const role of roles) {\n          const table = (storage.schema as Partial<Record<StorageRole, T>>)[role];\n\n          if (table === undefined) return yield* configError(`Missing ${role} table`);\n          const description = backend.describe(table);\n          const columns = description.columns;\n\n          for (const name of Object.keys(storageTables[role].columns)) {\n            if (columns[name] === undefined)\n              return yield* configError(`Missing ${role}.${name} column`);\n          }\n          validations.push({ table: description, required: storageTables[role].unique });\n        }\n        validations.push({\n          table: backend.describe(storage.subjects.table as T),\n          required: [[storage.subjects.id]],\n        });\n        yield* validateStorageBatch(dialect, validations);\n        const mappings = yield* makeMappings(storage);\n\n        const standalone = <E>(error: () => E) =>\n          requireStandalone(error, client.transactionService);\n\n        // Backend validation owns the foreign query-builder shape, never the decoded rows.\n        const native = database as ProofSqlDatabase &\n          PasswordSqlDatabase &\n          EmailSqlDatabase &\n          SessionSqlDatabase &\n          TransactionNativeDatabase;\n\n        const options = {\n          mode: \"interactive\" as const,\n          locking: dialect === \"pg\",\n          standaloneGuard: standalone(() => SessionUnavailable.make({})),\n        };\n\n        const sessionMapping = mappings.sessions(auth.claims);\n\n        const sessionServices = yield* sessionKernel\n          .makeSqlStatefulSessions(sessionMapping, options)\n          .pipe(\n            Effect.provideService(CurrentSessionSql, native),\n            Effect.provideService(NativeDatabase, native),\n          );\n\n        const authority = yield* sessionKernel\n          .makeSqlAuthenticationAuthority<C[\"Type\"]>(\n            { ...mappings.authority(), isConstraintConflict: () => false },\n            options,\n          )\n          .pipe(\n            Effect.provideService(CurrentSessionSql, native),\n            Effect.provideService(NativeDatabase, native),\n          );\n\n        let context: Context.Context<never> = Context.make(AuthenticationAuthority, authority).pipe(\n          Context.add(\n            auth.sessions.StatefulSessionPersistence,\n            sessionServices.statefulSessionPersistence,\n          ),\n          Context.add(auth.sessions.SessionRepository, sessionServices.sessionRepository),\n        );\n\n        const proofConfiguration = proofs\n          ? {\n              mapping: mappings.proofs(),\n              configuration: {\n                mode: \"interactive\" as const,\n                locking: dialect === \"pg\",\n                standaloneGuard: standalone(() => ProofUnavailable.make({})),\n                insertIfAbsent: (query: ProofSqlQuery) => query.onConflictDoNothing(),\n              },\n            }\n          : undefined;\n\n        if (proofConfiguration !== undefined) {\n          context = Context.add(\n            context,\n            ProofPersistence,\n            yield* proofKernel\n              .makeSqlProofPersistence(proofConfiguration.mapping, proofConfiguration.configuration)\n              .pipe(\n                Effect.provideService(CurrentProofSql, native),\n                Effect.provideService(NativeDatabase, native),\n              ),\n          );\n        }\n\n        if (password) {\n          const persistence = yield* passwordKernel\n            .makeSqlPasswordPersistence(mappings.passwords(), {\n              mode: \"interactive\",\n              locking: dialect === \"pg\",\n              standaloneGuard: standalone(() => PasswordUnavailable.make({})),\n              insertIfAbsent: (query) => query.onConflictDoNothing(),\n              ...(proofConfiguration === undefined ? {} : { proof: proofConfiguration }),\n            })\n            .pipe(\n              Effect.provideService(CurrentPasswordSql, native),\n              Effect.provideService(NativeDatabase, native),\n            );\n\n          context = Context.add(context, PasswordPersistence, persistence);\n        }\n        for (const [name, strategy] of Object.entries(auth.strategies)) {\n          if (strategy.persistence?.kind !== \"password\" || !strategy.persistence.management)\n            continue;\n          const key = strategy.RegistrationAuthority;\n\n          if (key === undefined)\n            return yield* configError(`Missing subject provisioning for ${name}`);\n\n          const registration = yield* makeRegistrationAuthority(\n            mappings,\n            backend.operations,\n            standalone(() => PasswordUnavailable.make({})),\n            ProvisioningKey,\n            name,\n          ).pipe(Effect.provideService(CurrentPasswordSql, native));\n\n          context = Context.add(context, key, registration);\n        }\n        if (email) {\n          context = Context.add(\n            context,\n            EmailAddressPersistence,\n            yield* emailKernel\n              .makeSqlEmailAddressPersistence(mappings.emails(), {\n                mode: \"interactive\",\n                locking: dialect === \"pg\",\n                standaloneGuard: standalone(() => EmailUnavailable.make({})),\n                ...(proofConfiguration === undefined ? {} : { proof: proofConfiguration }),\n              })\n              .pipe(\n                Effect.provideService(CurrentEmailSql, native),\n                Effect.provideService(NativeDatabase, native),\n              ),\n          );\n        }\n        if (phone) {\n          const { column, eq } = backend.operations;\n\n          const mapping = (moduleId: string) => ({\n            moduleId,\n            subject: {\n              table: storage.subjects.table,\n              id: storage.subjects.id,\n              securityRevision: storage.subjects.securityRevision,\n              activeCondition: eq(\n                column(storage.subjects.table, storage.subjects.status),\n                storage.subjects.activeValue,\n              ),\n            },\n            subjectIds: {\n              toNative: storage.subjects.toNativeSync,\n              toSubject: storage.subjects.toSubjectSync,\n            },\n            identifier: {\n              table: mappings.table(\"identifiers\"),\n              namespace: \"namespace\",\n              value: \"value\",\n              subjectId: \"subjectId\",\n              revision: \"revision\",\n              verifiedAt: \"verifiedAt\",\n              activeCondition: eq(column(mappings.table(\"identifiers\"), \"active\"), true),\n            },\n            credential: {\n              table: mappings.table(\"credentials\"),\n              id: \"credentialId\",\n              subjectId: \"subjectId\",\n              revision: \"revision\",\n              activeCondition: eq(column(mappings.table(\"credentials\"), \"active\"), true),\n            },\n            state: {\n              table: mappings.table(\"phoneState\"),\n              scope: \"scope\",\n              state: \"state\",\n              version: \"version\",\n              encodeInsert: (row: object) => row,\n            },\n            admission: {\n              windowMillis: 60_000,\n              networkRequests: 10,\n              networkAttempts: 100,\n              maximumMessages: 10,\n              requestRetentionMillis: 86_400_000,\n            },\n            engineNowMillis: backend.operations\n              .sql`${dialect === \"pg\" ? backend.operations.sql`cast(extract(epoch from clock_timestamp()) * 1000 as bigint)` : backend.operations.sql`cast(round((julianday('now') - 2440587.5) * 86400000) as integer)`}`,\n            encodeInstant: storage.encodeInstant,\n          });\n\n          const execution = yield* executionKernel\n            .makeTransactionExecution(\n              CurrentPhoneTransaction,\n              {\n                mode: \"interactive\",\n                dialect,\n                locking: dialect === \"pg\",\n                standaloneGuard: () => standalone(() => PhoneOtpUnavailable.make({})),\n              },\n              () => PhoneOtpUnavailable.make({}),\n              randomId,\n            )\n            .pipe(Effect.provideService(NativeDatabase, native));\n\n          const run = <Value, E, Requirements>(\n            work: Effect.Effect<Value, E, Requirements>,\n            mutation = true,\n          ) =>\n            execution.admit.pipe(\n              Effect.andThen(execution.run(work, mutation)),\n              Effect.provideService(LifecycleHooks, hooks),\n            );\n\n          const allowed = (moduleId: string) =>\n            features.some((feature) => feature?.kind === \"phone\" && feature.moduleId === moduleId);\n\n          const admission = PhoneAdmission.of({\n            admit: (request) =>\n              allowed(request.moduleId)\n                ? run(phoneKernel.admitPhone(mapping(request.moduleId), request))\n                : Effect.fail(PhoneOtpUnavailable.make({})),\n            cleanup: (request) =>\n              allowed(request.moduleId)\n                ? run(phoneKernel.cleanupPhoneAdmission(mapping(request.moduleId), request))\n                : Effect.fail(PhoneOtpUnavailable.make({})),\n          });\n\n          const targets = PhoneSignInTargets.of({\n            lookup: (request) =>\n              allowed(request.moduleId)\n                ? run(phoneKernel.lookupPhone(mapping(request.moduleId), request), false)\n                : Effect.fail(PhoneOtpUnavailable.make({})),\n          });\n\n          context = context.pipe(\n            Context.add(PhoneAdmission, admission),\n            Context.add(PhoneSignInTargets, targets),\n          );\n        }\n\n        if (passkeys.length > 0) {\n          // Auth capability metadata determines whether PasskeyConfig is required.\n          const services = backend.passkeys({\n            storage,\n            namespace: auth.namespace,\n            dialect,\n            features: passkeys,\n            passwordModules: features.flatMap((feature) =>\n              feature?.kind === \"password\" ? [feature.moduleId] : [],\n            ),\n          }) as Effect.Effect<\n            Context.Context<never>,\n            PersistenceConfigurationError,\n            | PasskeyRequirement<A>\n            | Crypto.Crypto\n            | LifecycleHooks\n            | SqlClient.SqlClient\n            | NativeDatabase\n            | CurrentProofSql\n          >;\n\n          context = Context.merge(\n            context,\n            yield* services.pipe(\n              Effect.provideService(NativeDatabase, native),\n              Effect.provideService(CurrentProofSql, native),\n            ),\n          );\n        }\n\n        // The checked capability metadata above determines exactly these service keys.\n        return context as Context.Context<Ports<C, Id, A>>;\n      }).pipe(\n        withStorageValidation,\n        Effect.mapError((error) =>\n          Schema.is(PersistenceConfigurationError)(error)\n            ? error\n            : configError(\"Cannot acquire SQL persistence\"),\n        ),\n      ),\n    ).pipe(Layer.provide(hooksLayer));\n\n    return {\n      Config,\n      Provisioning: ProvisioningKey,\n      layer: services,\n      managed: <N, Instant = number>(options: {\n        readonly subjects: SubjectOptions<T, N>;\n        readonly tables?: Partial<Record<Roles<C, Id, A>, T>>;\n        readonly prefix?: string;\n        readonly timestamps?: {\n          readonly type: \"text\" | \"integer\";\n          readonly codec: Schema.Codec<number, Instant>;\n        };\n      }) => layout(options, true),\n      map: <N, Instant = number>(options: {\n        readonly subjects: SubjectOptions<T, N>;\n        readonly tables: Partial<Record<StorageRole, T>>;\n        readonly timestamps?: {\n          readonly type: \"text\" | \"integer\";\n          readonly codec: Schema.Codec<number, Instant>;\n        };\n      }) => layout(options, false),\n    };\n  };\n\n  return { make };\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AA2FA,MAAM,eAAe,WAAmB,8BAA8B,KAAK,EAAE,OAAO,CAAC;AAErF,MAAM,gBAAgB,UACpB,wBAAwB,KAAK;CAAE,WAAW;CAAW;AAAM,CAAC;AAE9D,MAAM,gCAAgB,IAAI,IAAI;CAC5B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,MAAa,qBACX,YACyB;CACzB,MAAM,cAAc,gBAAgB,QAAQ,UAAU;CACtD,MAAM,iBAAiB,mBAAmB,QAAQ,YAAY,aAAa,QAAQ,YAAY;CAC/F,MAAM,cAAc,gBAAgB,QAAQ,YAAY,WAAW;CACnE,MAAM,gBAAgB,kBAAkB,QAAQ,YAAY,QAAQ,YAAY;CAChF,MAAM,oBAAoB,sBAAsB,QAAQ,UAAU;CAClE,MAAM,kBAAkB,+BAA+B,iBAAiB;CACxE,MAAM,cAAc,gBAAgB,QAAQ,YAAY,iBAAiB;CAEzE,MAAM,QACJ,SACG;EACH,MAAM,WAAW,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,KAAK,aAAa,SAAS,WAAW;EACtF,MAAM,QAAQ,SAAS,MAAM,YAAY,SAAS,SAAS,OAAO;EAClE,MAAM,WAAW,SAAS,MAAM,YAAY,SAAS,SAAS,UAAU;EAExE,MAAM,WAAW,SAAS,QACvB,YAAuC,SAAS,SAAS,SAC5D;EAEA,MAAM,aAAa,SAAS,MACzB,YAAY,SAAS,SAAS,cAAc,QAAQ,UACvD;EAEA,MAAM,QAAQ,SAAS,MAAM,YAAY,SAAS,SAAS,WAAW,QAAQ,SAAS;EACvF,MAAM,SAAS,SAAS,cAAc;EAEtC,MAAM,QAAuB;GAAC;GAAe;GAAe;GAAY;EAAc;EAEtF,IAAI,UAAU,MAAM,KAAK,aAAa,oBAAoB,kBAAkB;EAC5E,IAAI,YAAY,MAAM,KAAK,uBAAuB;EAClD,IAAI,OAAO,MAAM,KAAK,oBAAoB,eAAe;EACzD,IAAI,OAAO,MAAM,KAAK,YAAY;EAClC,IAAI,SAAS,SAAS,GACpB,MAAM,KACJ,sBACA,oBACA,kBACA,kBACA,gBACA,qBACA,gBACF;EACF,IAAI,SAAS,MAAM,YAAY,QAAQ,UAAU,GAAG,MAAM,KAAK,iBAAiB;EAChF,IAAI,QACF,MAAM,KACJ,iBACA,eACA,oBACA,sBACA,eACA,cACA,iBACA,eACF;EAEF,MAAM,YAAY,QAAQ,QAGxB,CAAC,CAAC,6BAA6B,KAAK,UAAU,QAAQ;EAExD,MAAM,SAAS,OAAO,OAAO,WAAW,EACtC,QAAQ,UAA6C,MAAM,QAAQ,WAAW,KAAK,EACrF,CAAC;EAED,MAAM,kBAAkB,QAAQ,QAAqD,CAAC,CACpF,6BAA6B,KAAK,UAAU,cAC9C;EAEA,MAAM,UACJ,SASA,YACsC;GACtC,MAAM,UAAU,QAAQ;GAExB,IAAI,SAAS,SAAS,KAAK,QAAQ,eAAe,KAAA,GAChD,MAAM,YACJ,2HACF;GACF,MAAM,cAAc,QAAQ,SAAS,QAAQ,KAAK;GAClD,MAAM,WAAW,YAAY,QAAQ,QAAQ;GAE7C,KAAK,MAAM,OAAO;IAAC,QAAQ;IAAI,QAAQ;IAAQ,QAAQ;GAAgB,GACrE,IAAI,YAAY,QAAQ,SAAS,KAAA,GAC/B,MAAM,YAAY,0BAA0B,KAAK;GAErD,IAAI,QAAQ,gBAAgB,KAAA,GAC1B,MAAM,YAAY,8CAA8C;GAElE,IAAI,aAAa,KAAA,KAAa,SAAS,SAAS,WAC9C,MAAM,YAAY,8CAA8C;GAElE,MAAM,SAAS,QAAQ;GAEvB,IAAI,YAAY,WAAW,KAAA,KAAa,CAAC,iCAAiC,KAAK,MAAM,IACnF,MAAM,YAAY,2DAA2D;GAE/E,MAAM,SAA0C,EAAE,GAAG,QAAQ,OAAO;GAEpE,KAAK,MAAM,QAAQ,OACjB,IAAI,OAAO,UAAU,KAAA,KAAa,SAAS;IACzC,MAAM,aAAa,gBAAgB,MAAM,GAAG,OAAO,GAAG,QAAQ,SAAS,IAAI;IAE3E,MAAM,WACJ,QAAQ,eAAe,KAAA,IACnB,aACA;KACE,GAAG;KACH,SAAS,OAAO,YACd,OAAO,QAAQ,WAAW,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,YAAY,CACxD,KACA,cAAc,IAAI,GAAG,IACjB;MAAE,GAAG;MAAQ,MAAM,QAAQ,YAAY,QAAQ,OAAO;KAAK,IAC3D,MACN,CAAC,CACH;IACF;IAEN,OAAO,QAAQ,QAAQ,UAAU,QAAQ;GAC3C;GAEF,KAAK,MAAM,QAAQ,OACjB,IAAI,OAAO,UAAU,KAAA,GAAW,MAAM,YAAY,WAAW,KAAK,OAAO;GAE3E,MAAM,eAAe,QAAQ,YAAY;GAEzC,MAAM,gBACJ,iBAAiB,KAAA,IACb,OAAO,oBAAoB,OAAO,GAAG,IACrC,OAAO,oBAAoB,YAAY;GAE7C,MAAM,oBACJ,iBAAiB,KAAA,IACb,OAAO,kBAAkB,OAAO,GAAG,IACnC,OAAO,kBAAkB,YAAY;GAE3C,MAAM,WAA2B;IAC/B,OAAO,QAAQ;IACf,IAAI,QAAQ;IACZ,QAAQ,QAAQ;IAChB,kBAAkB,QAAQ;IAC1B,aAAa,QAAQ;IACrB,cAAc,QAAQ;IACtB,oBAAoB,QAAQ,sBAAsB,QAAQ;IAC1D,YAAY,OACV,OAAO,oBAAoB,QAAQ,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,OAAO,SAAS,YAAY,CAAC;IACpF,WAAW,OACT,OAAO,aAAa,QAAQ,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,OAAO,SAAS,YAAY,CAAC;IAC7E,eAAe,OAAO,kBAAkB,QAAQ,OAAO;IACvD,cAAc,OAAO,WAAW,QAAQ,OAAO;GACjD;GAEA,OAAO,OAAO,OAAO;IACnB,WAAW,KAAK;IAChB,QAAQ,OAAO,OAAO,MAAM;IAC5B,QAAQ;IACR;IACA,eACE,iBAAiB,KAAA,KAAa,WAAmB,SAAS,OAAO,WAAW,YAAY;IAC1F,gBAAgB,UAAmB,cAAc,KAAK,CAAC,CAAC,KAAK,OAAO,SAAS,YAAY,CAAC;IAC1F;GACF,CAAC;EACH;EAgUA,OAAO;GACL;GACA,cAAc;GACd,OAjUe,MAAM,cACrB,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO;IACvB,MAAM,QAAQ,OAAO;IACrB,MAAM,SAAS,OAAO,UAAU;IAChC,MAAM,WAAW,OAAO,QAAQ;IAEhC,MAAM,UAAU,OAAO,gBAAgB;KACrC,UAAU;KACV,cAAc;KACd,cAAc,KAAA;IAChB,CAAC;IAED,IAAI,YAAY,KAAA,GACd,OAAO,OAAO,YAAY,8CAA8C;IAC1E,IAAI,KAAK,gBAAgB,YACvB,OAAO,OAAO,YAAY,yDAAyD;IACrF,IACE,SAAS,MACN,YACC,YAAY,KAAA,KACX,eAAe,WAAW,QAAQ,aAClC,QAAQ,SAAS,WAAW,CAAC,QAAQ,SAC1C,GAEA,OAAO,OAAO,YACZ,2EACF;IACF,IAAI,QAAQ,cAAc,KAAK,WAC7B,OAAO,OAAO,YACZ,kEACF;IACF,MAAM,cAAmC,CAAC;IAE1C,KAAK,MAAM,QAAQ,OAAO;KACxB,MAAM,QAAS,QAAQ,OAA2C;KAElE,IAAI,UAAU,KAAA,GAAW,OAAO,OAAO,YAAY,WAAW,KAAK,OAAO;KAC1E,MAAM,cAAc,QAAQ,SAAS,KAAK;KAC1C,MAAM,UAAU,YAAY;KAE5B,KAAK,MAAM,QAAQ,OAAO,KAAK,cAAc,KAAK,CAAC,OAAO,GACxD,IAAI,QAAQ,UAAU,KAAA,GACpB,OAAO,OAAO,YAAY,WAAW,KAAK,GAAG,KAAK,QAAQ;KAE9D,YAAY,KAAK;MAAE,OAAO;MAAa,UAAU,cAAc,KAAK,CAAC;KAAO,CAAC;IAC/E;IACA,YAAY,KAAK;KACf,OAAO,QAAQ,SAAS,QAAQ,SAAS,KAAU;KACnD,UAAU,CAAC,CAAC,QAAQ,SAAS,EAAE,CAAC;IAClC,CAAC;IACD,OAAO,qBAAqB,SAAS,WAAW;IAChD,MAAM,WAAW,OAAO,aAAa,OAAO;IAE5C,MAAM,cAAiB,UACrB,kBAAkB,OAAO,OAAO,kBAAkB;IAGpD,MAAM,SAAS;IAMf,MAAM,UAAU;KACd,MAAM;KACN,SAAS,YAAY;KACrB,iBAAiB,iBAAiB,mBAAmB,KAAK,CAAC,CAAC,CAAC;IAC/D;IAEA,MAAM,iBAAiB,SAAS,SAAS,KAAK,MAAM;IAEpD,MAAM,kBAAkB,OAAO,cAC5B,wBAAwB,gBAAgB,OAAO,CAAC,CAChD,KACC,OAAO,eAAe,mBAAmB,MAAM,GAC/C,OAAO,eAAe,gBAAgB,MAAM,CAC9C;IAEF,MAAM,YAAY,OAAO,cACtB,+BACC;KAAE,GAAG,SAAS,UAAU;KAAG,4BAA4B;IAAM,GAC7D,OACF,CAAC,CACA,KACC,OAAO,eAAe,mBAAmB,MAAM,GAC/C,OAAO,eAAe,gBAAgB,MAAM,CAC9C;IAEF,IAAI,UAAkC,QAAQ,KAAK,yBAAyB,SAAS,CAAC,CAAC,KACrF,QAAQ,IACN,KAAK,SAAS,4BACd,gBAAgB,0BAClB,GACA,QAAQ,IAAI,KAAK,SAAS,mBAAmB,gBAAgB,iBAAiB,CAChF;IAEA,MAAM,qBAAqB,SACvB;KACE,SAAS,SAAS,OAAO;KACzB,eAAe;MACb,MAAM;MACN,SAAS,YAAY;MACrB,iBAAiB,iBAAiB,iBAAiB,KAAK,CAAC,CAAC,CAAC;MAC3D,iBAAiB,UAAyB,MAAM,oBAAoB;KACtE;IACF,IACA,KAAA;IAEJ,IAAI,uBAAuB,KAAA,GACzB,UAAU,QAAQ,IAChB,SACA,kBACA,OAAO,YACJ,wBAAwB,mBAAmB,SAAS,mBAAmB,aAAa,CAAC,CACrF,KACC,OAAO,eAAe,iBAAiB,MAAM,GAC7C,OAAO,eAAe,gBAAgB,MAAM,CAC9C,CACJ;IAGF,IAAI,UAAU;KACZ,MAAM,cAAc,OAAO,eACxB,2BAA2B,SAAS,UAAU,GAAG;MAChD,MAAM;MACN,SAAS,YAAY;MACrB,iBAAiB,iBAAiB,oBAAoB,KAAK,CAAC,CAAC,CAAC;MAC9D,iBAAiB,UAAU,MAAM,oBAAoB;MACrD,GAAI,uBAAuB,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,mBAAmB;KAC1E,CAAC,CAAC,CACD,KACC,OAAO,eAAe,oBAAoB,MAAM,GAChD,OAAO,eAAe,gBAAgB,MAAM,CAC9C;KAEF,UAAU,QAAQ,IAAI,SAAS,qBAAqB,WAAW;IACjE;IACA,KAAK,MAAM,CAAC,MAAM,aAAa,OAAO,QAAQ,KAAK,UAAU,GAAG;KAC9D,IAAI,SAAS,aAAa,SAAS,cAAc,CAAC,SAAS,YAAY,YACrE;KACF,MAAM,MAAM,SAAS;KAErB,IAAI,QAAQ,KAAA,GACV,OAAO,OAAO,YAAY,oCAAoC,MAAM;KAEtE,MAAM,eAAe,OAAO,0BAC1B,UACA,QAAQ,YACR,iBAAiB,oBAAoB,KAAK,CAAC,CAAC,CAAC,GAC7C,iBACA,IACF,CAAC,CAAC,KAAK,OAAO,eAAe,oBAAoB,MAAM,CAAC;KAExD,UAAU,QAAQ,IAAI,SAAS,KAAK,YAAY;IAClD;IACA,IAAI,OACF,UAAU,QAAQ,IAChB,SACA,yBACA,OAAO,YACJ,+BAA+B,SAAS,OAAO,GAAG;KACjD,MAAM;KACN,SAAS,YAAY;KACrB,iBAAiB,iBAAiB,iBAAiB,KAAK,CAAC,CAAC,CAAC;KAC3D,GAAI,uBAAuB,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,mBAAmB;IAC1E,CAAC,CAAC,CACD,KACC,OAAO,eAAe,iBAAiB,MAAM,GAC7C,OAAO,eAAe,gBAAgB,MAAM,CAC9C,CACJ;IAEF,IAAI,OAAO;KACT,MAAM,EAAE,QAAQ,OAAO,QAAQ;KAE/B,MAAM,WAAW,cAAsB;MACrC;MACA,SAAS;OACP,OAAO,QAAQ,SAAS;OACxB,IAAI,QAAQ,SAAS;OACrB,kBAAkB,QAAQ,SAAS;OACnC,iBAAiB,GACf,OAAO,QAAQ,SAAS,OAAO,QAAQ,SAAS,MAAM,GACtD,QAAQ,SAAS,WACnB;MACF;MACA,YAAY;OACV,UAAU,QAAQ,SAAS;OAC3B,WAAW,QAAQ,SAAS;MAC9B;MACA,YAAY;OACV,OAAO,SAAS,MAAM,aAAa;OACnC,WAAW;OACX,OAAO;OACP,WAAW;OACX,UAAU;OACV,YAAY;OACZ,iBAAiB,GAAG,OAAO,SAAS,MAAM,aAAa,GAAG,QAAQ,GAAG,IAAI;MAC3E;MACA,YAAY;OACV,OAAO,SAAS,MAAM,aAAa;OACnC,IAAI;OACJ,WAAW;OACX,UAAU;OACV,iBAAiB,GAAG,OAAO,SAAS,MAAM,aAAa,GAAG,QAAQ,GAAG,IAAI;MAC3E;MACA,OAAO;OACL,OAAO,SAAS,MAAM,YAAY;OAClC,OAAO;OACP,OAAO;OACP,SAAS;OACT,eAAe,QAAgB;MACjC;MACA,WAAW;OACT,cAAc;OACd,iBAAiB;OACjB,iBAAiB;OACjB,iBAAiB;OACjB,wBAAwB;MAC1B;MACA,iBAAiB,QAAQ,WACtB,GAAG,GAAG,YAAY,OAAO,QAAQ,WAAW,GAAG,iEAAiE,QAAQ,WAAW,GAAG;MACzI,eAAe,QAAQ;KACzB;KAEA,MAAM,YAAY,OAAO,gBACtB,yBACC,yBACA;MACE,MAAM;MACN;MACA,SAAS,YAAY;MACrB,uBAAuB,iBAAiB,oBAAoB,KAAK,CAAC,CAAC,CAAC;KACtE,SACM,oBAAoB,KAAK,CAAC,CAAC,GACjC,QACF,CAAC,CACA,KAAK,OAAO,eAAe,gBAAgB,MAAM,CAAC;KAErD,MAAM,OACJ,MACA,WAAW,SAEX,UAAU,MAAM,KACd,OAAO,QAAQ,UAAU,IAAI,MAAM,QAAQ,CAAC,GAC5C,OAAO,eAAe,gBAAgB,KAAK,CAC7C;KAEF,MAAM,WAAW,aACf,SAAS,MAAM,YAAY,SAAS,SAAS,WAAW,QAAQ,aAAa,QAAQ;KAEvF,MAAM,YAAY,eAAe,GAAG;MAClC,QAAQ,YACN,QAAQ,QAAQ,QAAQ,IACpB,IAAI,YAAY,WAAW,QAAQ,QAAQ,QAAQ,GAAG,OAAO,CAAC,IAC9D,OAAO,KAAK,oBAAoB,KAAK,CAAC,CAAC,CAAC;MAC9C,UAAU,YACR,QAAQ,QAAQ,QAAQ,IACpB,IAAI,YAAY,sBAAsB,QAAQ,QAAQ,QAAQ,GAAG,OAAO,CAAC,IACzE,OAAO,KAAK,oBAAoB,KAAK,CAAC,CAAC,CAAC;KAChD,CAAC;KAED,MAAM,UAAU,mBAAmB,GAAG,EACpC,SAAS,YACP,QAAQ,QAAQ,QAAQ,IACpB,IAAI,YAAY,YAAY,QAAQ,QAAQ,QAAQ,GAAG,OAAO,GAAG,KAAK,IACtE,OAAO,KAAK,oBAAoB,KAAK,CAAC,CAAC,CAAC,EAChD,CAAC;KAED,UAAU,QAAQ,KAChB,QAAQ,IAAI,gBAAgB,SAAS,GACrC,QAAQ,IAAI,oBAAoB,OAAO,CACzC;IACF;IAEA,IAAI,SAAS,SAAS,GAAG;KAEvB,MAAM,WAAW,QAAQ,SAAS;MAChC;MACA,WAAW,KAAK;MAChB;MACA,UAAU;MACV,iBAAiB,SAAS,SAAS,YACjC,SAAS,SAAS,aAAa,CAAC,QAAQ,QAAQ,IAAI,CAAC,CACvD;KACF,CAAC;KAWD,UAAU,QAAQ,MAChB,SACA,OAAO,SAAS,KACd,OAAO,eAAe,gBAAgB,MAAM,GAC5C,OAAO,eAAe,iBAAiB,MAAM,CAC/C,CACF;IACF;IAGA,OAAO;GACT,CAAC,CAAC,CAAC,KACD,uBACA,OAAO,UAAU,UACf,OAAO,GAAG,6BAA6B,CAAC,CAAC,KAAK,IAC1C,QACA,YAAY,gCAAgC,CAClD,CACF,CACF,CAAC,CAAC,KAAK,MAAM,QAAQ,UAAU,CAKf;GACd,UAA+B,YAQzB,OAAO,SAAS,IAAI;GAC1B,MAA2B,YAOrB,OAAO,SAAS,KAAK;EAC7B;CACF;CAEA,OAAO,EAAE,KAAK;AAChB"}
+{"version":3,"file":"persistence.mjs","names":[],"sources":["../../src/internal/persistence.ts"],"sourcesContent":["import { EmailAddressPersistence, EmailUnavailable } from \"@yielded/auth/Email\";\nimport { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport type { PasskeyConfig } from \"@yielded/auth/Passkey\";\nimport { PasswordPersistence, PasswordUnavailable } from \"@yielded/auth/Password\";\nimport { hooksLayer } from \"@yielded/auth/Persistence\";\nimport { PhoneAdmission, PhoneSignInTargets, PhoneOtpUnavailable } from \"@yielded/auth/PhoneOtp\";\nimport { ProofPersistence, ProofUnavailable } from \"@yielded/auth/Proofs\";\nimport { AuthenticationAuthority, SessionUnavailable } from \"@yielded/auth/Sessions\";\nimport { Context, type Crypto, Effect, Layer, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\n\nimport {\n  PersistenceConfigurationError,\n  type ClaimsCodec,\n  type ConfigId,\n  type Definition,\n  type PersistenceApi,\n  type Ports,\n  type Roles,\n  type Provisioning,\n  type ProvisioningRequirement,\n  type StorageLayout,\n  type SubjectMapping,\n  type SubjectOptions,\n  type PasskeyFeature,\n  type PasskeyRequirement,\n  type MappingInput,\n} from \"./configuration\";\nimport { randomId } from \"./crypto\";\nimport { makeEmailKernel, CurrentEmailSql, type EmailSqlDatabase } from \"./email-kernel\";\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport type { NativeSqlTables } from \"./native-sql-table\";\nimport {\n  makePasswordKernel,\n  CurrentPasswordSql,\n  type PasswordSqlDatabase,\n} from \"./password-kernel\";\nimport { makePhoneKernel, CurrentPhoneTransaction } from \"./phone-kernel\";\nimport {\n  makeProofKernel,\n  CurrentProofSql,\n  type ProofSqlDatabase,\n  type ProofSqlQuery,\n} from \"./proof-kernel\";\nimport type { QueryOperations } from \"./query-operations\";\nimport { makeRegistrationAuthority } from \"./registration\";\nimport { makeSessionKernel, CurrentSessionSql, type SessionSqlDatabase } from \"./session-kernel\";\nimport { requireStandalone } from \"./standalone\";\nimport { makeMappings } from \"./storage-mapping\";\nimport {\n  tableDefinition,\n  storageTables,\n  type StorageRole,\n  type StorageTable,\n} from \"./storage-tables\";\nimport {\n  validateStorageBatch,\n  withStorageValidation,\n  type StorageValidation,\n} from \"./storage-validation\";\nimport { makeTransactionExecutionKernel } from \"./transaction-execution-kernel\";\nimport {\n  makeTransactionKernel,\n  NativeDatabase,\n  type TransactionNativeDatabase,\n} from \"./transaction-kernel\";\n\nexport interface Backend<T extends object, R> {\n  readonly makeTable: (definition: StorageTable) => T;\n  readonly describe: (table: T) => StorageTable;\n  readonly acquire: Effect.Effect<object, PersistenceConfigurationError, R | SqlClient.SqlClient>;\n  readonly operations: QueryOperations;\n  readonly nativeTables: (client: SqlClient.SqlClient, database: object) => NativeSqlTables;\n  readonly passkeys: (input: {\n    readonly storage: MappingInput;\n    readonly namespace: string;\n    readonly dialect: \"pg\" | \"sqlite\";\n    readonly features: ReadonlyArray<PasskeyFeature>;\n    readonly passwordModules: ReadonlyArray<string>;\n  }) => Effect.Effect<\n    Context.Context<never>,\n    PersistenceConfigurationError,\n    | PasskeyConfig\n    | LifecycleHooks\n    | SqlClient.SqlClient\n    | NativeDatabase\n    | CurrentProofSql\n    | Crypto.Crypto\n  >;\n}\n\nconst configError = (reason: string) => PersistenceConfigurationError.make({ reason });\n\nconst mappingError = (cause: unknown) =>\n  PersistenceMappingError.make({ operation: \"mapping\", cause });\n\nconst timestampKeys = new Set([\n  \"verifiedAt\",\n  \"createdAt\",\n  \"lastIssueAt\",\n  \"issuedAt\",\n  \"expiresAt\",\n  \"absoluteExpiresAt\",\n  \"retentionUntil\",\n  \"claimDeadline\",\n  \"retryAt\",\n  \"admittedAt\",\n  \"deadline\",\n  \"occurredAt\",\n  \"dedupUntil\",\n]);\n\nexport const createPersistence = <T extends object, R>(\n  backend: Backend<T, R>,\n): PersistenceApi<T, R> => {\n  const proofKernel = makeProofKernel(backend.operations);\n  const passwordKernel = makePasswordKernel(backend.operations, proofKernel, backend.nativeTables);\n  const emailKernel = makeEmailKernel(backend.operations, proofKernel);\n  const sessionKernel = makeSessionKernel(backend.operations, backend.nativeTables);\n  const transactionKernel = makeTransactionKernel(backend.operations);\n  const executionKernel = makeTransactionExecutionKernel(transactionKernel);\n  const phoneKernel = makePhoneKernel(backend.operations, transactionKernel);\n\n  const make = <C extends ClaimsCodec, const Id extends string, const A extends Definition<C, Id>>(\n    auth: A & Definition<C, Id>,\n  ) => {\n    const features = Object.values(auth.strategies).map((strategy) => strategy.persistence);\n    const phone = features.some((feature) => feature?.kind === \"phone\");\n    const password = features.some((feature) => feature?.kind === \"password\");\n\n    const passkeys = features.filter(\n      (feature): feature is PasskeyFeature => feature?.kind === \"passkey\",\n    );\n\n    const management = features.some(\n      (feature) => feature?.kind === \"password\" && feature.management,\n    );\n\n    const email = features.some((feature) => feature?.kind === \"email\" && feature.addresses);\n    const proofs = phone || management || email;\n\n    const roles: StorageRole[] = [\"identifiers\", \"credentials\", \"sessions\", \"sessionFlows\"];\n\n    if (password) roles.push(\"passwords\", \"passwordCommands\");\n    if (management) roles.push(\"passwordRegistrations\");\n    if (email) roles.push(\"emailCredentials\", \"emailCommands\");\n    if (phone) roles.push(\"phoneState\");\n    if (passkeys.length > 0)\n      roles.push(\n        \"passkeyCredentials\",\n        \"passkeyOwnership\",\n        \"passkeyHandles\",\n        \"passkeyModules\",\n        \"passkeyFlows\",\n        \"passkeyAdmissions\",\n        \"passkeyCharges\",\n      );\n    if (passkeys.some((feature) => feature.management)) roles.push(\"passkeyCommands\");\n    if (proofs)\n      roles.push(\n        \"proofRequests\",\n        \"proofSeries\",\n        \"proofGenerations\",\n        \"proofContinuations\",\n        \"proofScopes\",\n        \"proofAbuse\",\n        \"proofFailures\",\n        \"proofCommands\",\n      );\n\n    const ConfigKey = Context.Service<\n      ConfigId<A[\"namespace\"]>,\n      StorageLayout<T, Roles<C, Id, A>>\n    >()(`@yielded/auth-persistence/${auth.namespace}/Config`);\n\n    const Config = Object.assign(ConfigKey, {\n      layer: (value: StorageLayout<T, Roles<C, Id, A>>) => Layer.succeed(ConfigKey, value),\n    });\n\n    const ProvisioningKey = Context.Service<ProvisioningRequirement<A>, Provisioning<A>>()(\n      `@yielded/auth-persistence/${auth.namespace}/Provisioning`,\n    );\n\n    const layout = <N, Instant>(\n      options: {\n        readonly subjects: SubjectOptions<T, N>;\n        readonly tables?: Partial<Record<StorageRole, T>>;\n        readonly prefix?: string;\n        readonly timestamps?: {\n          readonly type: \"text\" | \"integer\";\n          readonly codec: Schema.Codec<number, Instant>;\n        };\n      },\n      managed: boolean,\n    ): StorageLayout<T, Roles<C, Id, A>> => {\n      const subject = options.subjects;\n\n      if (passkeys.length > 0 && options.timestamps !== undefined)\n        throw configError(\n          \"Composed passkey storage uses integer milliseconds; use an explicit passkey adapter for a custom timestamp representation\",\n        );\n      const description = backend.describe(subject.table);\n      const idColumn = description.columns[subject.id];\n\n      for (const key of [subject.id, subject.status, subject.securityRevision]) {\n        if (description.columns[key] === undefined)\n          throw configError(`Missing subject column ${key}`);\n      }\n      if (subject.activeValue === undefined)\n        throw configError(\"An explicit active subject value is required\");\n\n      if (idColumn === undefined || idColumn.type === \"boolean\")\n        throw configError(\"Subject ID must map a text or integer column\");\n\n      const prefix = options.prefix;\n\n      if (managed && (prefix === undefined || !/^[A-Za-z_][A-Za-z0-9_]{0,100}$/.test(prefix)))\n        throw configError(\"Managed persistence requires an explicit SQL table prefix\");\n\n      const schema: Partial<Record<StorageRole, T>> = { ...options.tables };\n\n      for (const role of roles) {\n        if (schema[role] === undefined && managed) {\n          const definition = tableDefinition(role, `${prefix}_${role}`, idColumn.type);\n\n          const adjusted =\n            options.timestamps === undefined\n              ? definition\n              : {\n                  ...definition,\n                  columns: Object.fromEntries(\n                    Object.entries(definition.columns).map(([key, column]) => [\n                      key,\n                      timestampKeys.has(key)\n                        ? { ...column, type: options.timestamps?.type ?? column.type }\n                        : column,\n                    ]),\n                  ),\n                };\n\n          schema[role] = backend.makeTable(adjusted);\n        }\n      }\n      for (const role of roles) {\n        if (schema[role] === undefined) throw configError(`Missing ${role} table`);\n      }\n      const instantCodec = options.timestamps?.codec;\n\n      const decodeInstant =\n        instantCodec === undefined\n          ? Schema.decodeUnknownEffect(Schema.Int)\n          : Schema.decodeUnknownEffect(instantCodec);\n\n      const decodeInstantSync =\n        instantCodec === undefined\n          ? Schema.decodeUnknownSync(Schema.Int)\n          : Schema.decodeUnknownSync(instantCodec);\n\n      const subjects: SubjectMapping = {\n        table: subject.table,\n        id: subject.id,\n        status: subject.status,\n        securityRevision: subject.securityRevision,\n        activeValue: subject.activeValue,\n        requirements: subject.requirements,\n        actionRequirements: subject.actionRequirements ?? subject.requirements,\n        toSubject: (id) =>\n          Schema.decodeUnknownEffect(subject.idCodec)(id).pipe(Effect.mapError(mappingError)),\n        toNative: (id) =>\n          Schema.encodeEffect(subject.idCodec)(id).pipe(Effect.mapError(mappingError)),\n        toSubjectSync: Schema.decodeUnknownSync(subject.idCodec),\n        toNativeSync: Schema.encodeSync(subject.idCodec),\n      };\n\n      return Object.freeze({\n        namespace: auth.namespace,\n        schema: Object.freeze(schema) as Readonly<Record<Roles<C, Id, A>, T>>,\n        tables: schema,\n        subjects,\n        encodeInstant:\n          instantCodec === undefined ? (millis: number) => millis : Schema.encodeSync(instantCodec),\n        decodeInstant: (value: unknown) => decodeInstant(value).pipe(Effect.mapError(mappingError)),\n        decodeInstantSync,\n      });\n    };\n\n    const services = Layer.effectContext(\n      Effect.gen(function* () {\n        const storage = yield* ConfigKey;\n        const hooks = yield* LifecycleHooks;\n        const client = yield* SqlClient.SqlClient;\n        const database = yield* backend.acquire;\n\n        const dialect = client.onDialectOrElse({\n          pg: () => \"pg\" as const,\n          sqlite: () => \"sqlite\" as const,\n          orElse: () => undefined,\n        });\n\n        if (dialect === undefined)\n          return yield* configError(\"Use an explicit adapter for this SQL dialect\");\n        if (auth.sessionMode !== \"stateful\")\n          return yield* configError(\"The composed layer currently requires stateful sessions\");\n        if (\n          features.some(\n            (feature) =>\n              feature === undefined ||\n              (\"lifecycle\" in feature && feature.lifecycle) ||\n              (feature.kind === \"email\" && !feature.addresses),\n          )\n        )\n          return yield* configError(\n            \"Use explicit services for strategies without composed persistence support\",\n          );\n        if (storage.namespace !== auth.namespace)\n          return yield* configError(\n            \"Persistence configuration belongs to a different Auth definition\",\n          );\n        const validations: StorageValidation[] = [];\n\n        for (const role of roles) {\n          const table = (storage.schema as Partial<Record<StorageRole, T>>)[role];\n\n          if (table === undefined) return yield* configError(`Missing ${role} table`);\n          const description = backend.describe(table);\n          const columns = description.columns;\n\n          for (const name of Object.keys(storageTables[role].columns)) {\n            if (columns[name] === undefined)\n              return yield* configError(`Missing ${role}.${name} column`);\n          }\n          validations.push({ table: description, required: storageTables[role].unique });\n        }\n        validations.push({\n          table: backend.describe(storage.subjects.table as T),\n          required: [[storage.subjects.id]],\n        });\n        yield* validateStorageBatch(dialect, validations);\n        const mappings = yield* makeMappings(storage);\n\n        const standalone = <E>(error: () => E) =>\n          requireStandalone(error, client.transactionService);\n\n        // Backend validation owns the foreign query-builder shape, never the decoded rows.\n        const native = database as ProofSqlDatabase &\n          PasswordSqlDatabase &\n          EmailSqlDatabase &\n          SessionSqlDatabase &\n          TransactionNativeDatabase;\n\n        const options = {\n          mode: \"interactive\" as const,\n          locking: dialect === \"pg\",\n          standaloneGuard: standalone(() => SessionUnavailable.make({})),\n        };\n\n        const sessionMapping = mappings.sessions(auth.claims);\n\n        const sessionServices = yield* sessionKernel\n          .makeSqlStatefulSessions(sessionMapping, options)\n          .pipe(\n            Effect.provideService(CurrentSessionSql, native),\n            Effect.provideService(NativeDatabase, native),\n          );\n\n        const authority = yield* sessionKernel\n          .makeSqlAuthenticationAuthority<C[\"Type\"]>(\n            { ...mappings.authority(), isConstraintConflict: () => false },\n            options,\n          )\n          .pipe(\n            Effect.provideService(CurrentSessionSql, native),\n            Effect.provideService(NativeDatabase, native),\n          );\n\n        let context: Context.Context<never> = Context.make(AuthenticationAuthority, authority).pipe(\n          Context.add(\n            auth.sessions.StatefulSessionPersistence,\n            sessionServices.statefulSessionPersistence,\n          ),\n          Context.add(auth.sessions.SessionRepository, sessionServices.sessionRepository),\n        );\n\n        const proofConfiguration = proofs\n          ? {\n              mapping: mappings.proofs(),\n              configuration: {\n                mode: \"interactive\" as const,\n                locking: dialect === \"pg\",\n                standaloneGuard: standalone(() => ProofUnavailable.make({})),\n                insertIfAbsent: (query: ProofSqlQuery) => query.onConflictDoNothing(),\n              },\n            }\n          : undefined;\n\n        if (proofConfiguration !== undefined) {\n          context = Context.add(\n            context,\n            ProofPersistence,\n            yield* proofKernel\n              .makeSqlProofPersistence(proofConfiguration.mapping, proofConfiguration.configuration)\n              .pipe(\n                Effect.provideService(CurrentProofSql, native),\n                Effect.provideService(NativeDatabase, native),\n              ),\n          );\n        }\n\n        if (password) {\n          const persistence = yield* passwordKernel\n            .makeSqlPasswordPersistence(mappings.passwords(), {\n              mode: \"interactive\",\n              locking: dialect === \"pg\",\n              standaloneGuard: standalone(() => PasswordUnavailable.make({})),\n              insertIfAbsent: (query) => query.onConflictDoNothing(),\n              ...(proofConfiguration === undefined ? {} : { proof: proofConfiguration }),\n            })\n            .pipe(\n              Effect.provideService(CurrentPasswordSql, native),\n              Effect.provideService(NativeDatabase, native),\n            );\n\n          context = Context.add(context, PasswordPersistence, persistence);\n        }\n        for (const [name, strategy] of Object.entries(auth.strategies)) {\n          if (strategy.persistence?.kind !== \"password\" || !strategy.persistence.management)\n            continue;\n          const key = strategy.RegistrationAuthority;\n\n          if (key === undefined)\n            return yield* configError(`Missing subject provisioning for ${name}`);\n\n          const registration = yield* makeRegistrationAuthority(\n            mappings,\n            backend.operations,\n            standalone(() => PasswordUnavailable.make({})),\n            ProvisioningKey,\n            name,\n          ).pipe(Effect.provideService(CurrentPasswordSql, native));\n\n          context = Context.add(context, key, registration);\n        }\n        if (email) {\n          context = Context.add(\n            context,\n            EmailAddressPersistence,\n            yield* emailKernel\n              .makeSqlEmailAddressPersistence(mappings.emails(), {\n                mode: \"interactive\",\n                locking: dialect === \"pg\",\n                standaloneGuard: standalone(() => EmailUnavailable.make({})),\n                ...(proofConfiguration === undefined ? {} : { proof: proofConfiguration }),\n              })\n              .pipe(\n                Effect.provideService(CurrentEmailSql, native),\n                Effect.provideService(NativeDatabase, native),\n              ),\n          );\n        }\n        if (phone) {\n          const { column, eq } = backend.operations;\n\n          const mapping = (moduleId: string) => ({\n            moduleId,\n            subject: {\n              table: storage.subjects.table,\n              id: storage.subjects.id,\n              securityRevision: storage.subjects.securityRevision,\n              activeCondition: eq(\n                column(storage.subjects.table, storage.subjects.status),\n                storage.subjects.activeValue,\n              ),\n            },\n            subjectIds: {\n              toNative: storage.subjects.toNativeSync,\n              toSubject: storage.subjects.toSubjectSync,\n            },\n            identifier: {\n              table: mappings.table(\"identifiers\"),\n              namespace: \"namespace\",\n              value: \"value\",\n              subjectId: \"subjectId\",\n              revision: \"revision\",\n              verifiedAt: \"verifiedAt\",\n              activeCondition: eq(column(mappings.table(\"identifiers\"), \"active\"), true),\n            },\n            credential: {\n              table: mappings.table(\"credentials\"),\n              id: \"credentialId\",\n              subjectId: \"subjectId\",\n              revision: \"revision\",\n              activeCondition: eq(column(mappings.table(\"credentials\"), \"active\"), true),\n            },\n            state: {\n              table: mappings.table(\"phoneState\"),\n              scope: \"scope\",\n              state: \"state\",\n              version: \"version\",\n              encodeInsert: (row: object) => row,\n            },\n            admission: {\n              windowMillis: 60_000,\n              networkRequests: 10,\n              networkAttempts: 100,\n              maximumMessages: 10,\n              requestRetentionMillis: 86_400_000,\n            },\n            engineNowMillis: backend.operations\n              .sql`${dialect === \"pg\" ? backend.operations.sql`cast(extract(epoch from clock_timestamp()) * 1000 as bigint)` : backend.operations.sql`cast(round((julianday('now') - 2440587.5) * 86400000) as integer)`}`,\n            encodeInstant: storage.encodeInstant,\n          });\n\n          const execution = yield* executionKernel\n            .makeTransactionExecution(\n              CurrentPhoneTransaction,\n              {\n                mode: \"interactive\",\n                dialect,\n                locking: dialect === \"pg\",\n                standaloneGuard: () => standalone(() => PhoneOtpUnavailable.make({})),\n              },\n              () => PhoneOtpUnavailable.make({}),\n              randomId,\n            )\n            .pipe(Effect.provideService(NativeDatabase, native));\n\n          const run = <Value, E, Requirements>(\n            work: Effect.Effect<Value, E, Requirements>,\n            mutation = true,\n          ) =>\n            execution.admit.pipe(\n              Effect.andThen(execution.run(work, mutation)),\n              Effect.provideService(LifecycleHooks, hooks),\n            );\n\n          const allowed = (moduleId: string) =>\n            features.some((feature) => feature?.kind === \"phone\" && feature.moduleId === moduleId);\n\n          const admission = PhoneAdmission.of({\n            admit: (request) =>\n              allowed(request.moduleId)\n                ? run(phoneKernel.admitPhone(mapping(request.moduleId), request))\n                : Effect.fail(PhoneOtpUnavailable.make({})),\n            cleanup: (request) =>\n              allowed(request.moduleId)\n                ? run(phoneKernel.cleanupPhoneAdmission(mapping(request.moduleId), request))\n                : Effect.fail(PhoneOtpUnavailable.make({})),\n          });\n\n          const targets = PhoneSignInTargets.of({\n            lookup: (request) =>\n              allowed(request.moduleId)\n                ? run(phoneKernel.lookupPhone(mapping(request.moduleId), request), false)\n                : Effect.fail(PhoneOtpUnavailable.make({})),\n          });\n\n          context = context.pipe(\n            Context.add(PhoneAdmission, admission),\n            Context.add(PhoneSignInTargets, targets),\n          );\n        }\n\n        if (passkeys.length > 0) {\n          // Auth capability metadata determines whether PasskeyConfig is required.\n          const services = backend.passkeys({\n            storage,\n            namespace: auth.namespace,\n            dialect,\n            features: passkeys,\n            passwordModules: features.flatMap((feature) =>\n              feature?.kind === \"password\" ? [feature.moduleId] : [],\n            ),\n          }) as Effect.Effect<\n            Context.Context<never>,\n            PersistenceConfigurationError,\n            | PasskeyRequirement<A>\n            | Crypto.Crypto\n            | LifecycleHooks\n            | SqlClient.SqlClient\n            | NativeDatabase\n            | CurrentProofSql\n          >;\n\n          context = Context.merge(\n            context,\n            yield* services.pipe(\n              Effect.provideService(NativeDatabase, native),\n              Effect.provideService(CurrentProofSql, native),\n            ),\n          );\n        }\n\n        // The checked capability metadata above determines exactly these service keys.\n        return context as Context.Context<Ports<C, Id, A>>;\n      }).pipe(\n        withStorageValidation,\n        Effect.mapError((error) =>\n          Schema.is(PersistenceConfigurationError)(error)\n            ? error\n            : configError(\"Cannot acquire SQL persistence\"),\n        ),\n      ),\n    ).pipe(Layer.provide(hooksLayer));\n\n    return {\n      Config,\n      Provisioning: ProvisioningKey,\n      layer: services,\n      managed: <N, Instant = number>(options: {\n        readonly subjects: SubjectOptions<T, N>;\n        readonly tables?: Partial<Record<Roles<C, Id, A>, T>>;\n        readonly prefix?: string;\n        readonly timestamps?: {\n          readonly type: \"text\" | \"integer\";\n          readonly codec: Schema.Codec<number, Instant>;\n        };\n      }) => layout(options, true),\n      map: <N, Instant = number>(options: {\n        readonly subjects: SubjectOptions<T, N>;\n        readonly tables: Partial<Record<StorageRole, T>>;\n        readonly timestamps?: {\n          readonly type: \"text\" | \"integer\";\n          readonly codec: Schema.Codec<number, Instant>;\n        };\n      }) => layout(options, false),\n    };\n  };\n\n  return { make };\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AA2FA,MAAM,eAAe,WAAmB,8BAA8B,KAAK,EAAE,OAAO,CAAC;AAErF,MAAM,gBAAgB,UACpB,wBAAwB,KAAK;CAAE,WAAW;CAAW;AAAM,CAAC;AAE9D,MAAM,gCAAgB,IAAI,IAAI;CAC5B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,MAAa,qBACX,YACyB;CACzB,MAAM,cAAc,gBAAgB,QAAQ,UAAU;CACtD,MAAM,iBAAiB,mBAAmB,QAAQ,YAAY,aAAa,QAAQ,YAAY;CAC/F,MAAM,cAAc,gBAAgB,QAAQ,YAAY,WAAW;CACnE,MAAM,gBAAgB,kBAAkB,QAAQ,YAAY,QAAQ,YAAY;CAChF,MAAM,oBAAoB,sBAAsB,QAAQ,UAAU;CAClE,MAAM,kBAAkB,+BAA+B,iBAAiB;CACxE,MAAM,cAAc,gBAAgB,QAAQ,YAAY,iBAAiB;CAEzE,MAAM,QACJ,SACG;EACH,MAAM,WAAW,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,KAAK,aAAa,SAAS,WAAW;EACtF,MAAM,QAAQ,SAAS,MAAM,YAAY,SAAS,SAAS,OAAO;EAClE,MAAM,WAAW,SAAS,MAAM,YAAY,SAAS,SAAS,UAAU;EAExE,MAAM,WAAW,SAAS,QACvB,YAAuC,SAAS,SAAS,SAC5D;EAEA,MAAM,aAAa,SAAS,MACzB,YAAY,SAAS,SAAS,cAAc,QAAQ,UACvD;EAEA,MAAM,QAAQ,SAAS,MAAM,YAAY,SAAS,SAAS,WAAW,QAAQ,SAAS;EACvF,MAAM,SAAS,SAAS,cAAc;EAEtC,MAAM,QAAuB;GAAC;GAAe;GAAe;GAAY;EAAc;EAEtF,IAAI,UAAU,MAAM,KAAK,aAAa,kBAAkB;EACxD,IAAI,YAAY,MAAM,KAAK,uBAAuB;EAClD,IAAI,OAAO,MAAM,KAAK,oBAAoB,eAAe;EACzD,IAAI,OAAO,MAAM,KAAK,YAAY;EAClC,IAAI,SAAS,SAAS,GACpB,MAAM,KACJ,sBACA,oBACA,kBACA,kBACA,gBACA,qBACA,gBACF;EACF,IAAI,SAAS,MAAM,YAAY,QAAQ,UAAU,GAAG,MAAM,KAAK,iBAAiB;EAChF,IAAI,QACF,MAAM,KACJ,iBACA,eACA,oBACA,sBACA,eACA,cACA,iBACA,eACF;EAEF,MAAM,YAAY,QAAQ,QAGxB,CAAC,CAAC,6BAA6B,KAAK,UAAU,QAAQ;EAExD,MAAM,SAAS,OAAO,OAAO,WAAW,EACtC,QAAQ,UAA6C,MAAM,QAAQ,WAAW,KAAK,EACrF,CAAC;EAED,MAAM,kBAAkB,QAAQ,QAAqD,CAAC,CACpF,6BAA6B,KAAK,UAAU,cAC9C;EAEA,MAAM,UACJ,SASA,YACsC;GACtC,MAAM,UAAU,QAAQ;GAExB,IAAI,SAAS,SAAS,KAAK,QAAQ,eAAe,KAAA,GAChD,MAAM,YACJ,2HACF;GACF,MAAM,cAAc,QAAQ,SAAS,QAAQ,KAAK;GAClD,MAAM,WAAW,YAAY,QAAQ,QAAQ;GAE7C,KAAK,MAAM,OAAO;IAAC,QAAQ;IAAI,QAAQ;IAAQ,QAAQ;GAAgB,GACrE,IAAI,YAAY,QAAQ,SAAS,KAAA,GAC/B,MAAM,YAAY,0BAA0B,KAAK;GAErD,IAAI,QAAQ,gBAAgB,KAAA,GAC1B,MAAM,YAAY,8CAA8C;GAElE,IAAI,aAAa,KAAA,KAAa,SAAS,SAAS,WAC9C,MAAM,YAAY,8CAA8C;GAElE,MAAM,SAAS,QAAQ;GAEvB,IAAI,YAAY,WAAW,KAAA,KAAa,CAAC,iCAAiC,KAAK,MAAM,IACnF,MAAM,YAAY,2DAA2D;GAE/E,MAAM,SAA0C,EAAE,GAAG,QAAQ,OAAO;GAEpE,KAAK,MAAM,QAAQ,OACjB,IAAI,OAAO,UAAU,KAAA,KAAa,SAAS;IACzC,MAAM,aAAa,gBAAgB,MAAM,GAAG,OAAO,GAAG,QAAQ,SAAS,IAAI;IAE3E,MAAM,WACJ,QAAQ,eAAe,KAAA,IACnB,aACA;KACE,GAAG;KACH,SAAS,OAAO,YACd,OAAO,QAAQ,WAAW,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,YAAY,CACxD,KACA,cAAc,IAAI,GAAG,IACjB;MAAE,GAAG;MAAQ,MAAM,QAAQ,YAAY,QAAQ,OAAO;KAAK,IAC3D,MACN,CAAC,CACH;IACF;IAEN,OAAO,QAAQ,QAAQ,UAAU,QAAQ;GAC3C;GAEF,KAAK,MAAM,QAAQ,OACjB,IAAI,OAAO,UAAU,KAAA,GAAW,MAAM,YAAY,WAAW,KAAK,OAAO;GAE3E,MAAM,eAAe,QAAQ,YAAY;GAEzC,MAAM,gBACJ,iBAAiB,KAAA,IACb,OAAO,oBAAoB,OAAO,GAAG,IACrC,OAAO,oBAAoB,YAAY;GAE7C,MAAM,oBACJ,iBAAiB,KAAA,IACb,OAAO,kBAAkB,OAAO,GAAG,IACnC,OAAO,kBAAkB,YAAY;GAE3C,MAAM,WAA2B;IAC/B,OAAO,QAAQ;IACf,IAAI,QAAQ;IACZ,QAAQ,QAAQ;IAChB,kBAAkB,QAAQ;IAC1B,aAAa,QAAQ;IACrB,cAAc,QAAQ;IACtB,oBAAoB,QAAQ,sBAAsB,QAAQ;IAC1D,YAAY,OACV,OAAO,oBAAoB,QAAQ,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,OAAO,SAAS,YAAY,CAAC;IACpF,WAAW,OACT,OAAO,aAAa,QAAQ,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,OAAO,SAAS,YAAY,CAAC;IAC7E,eAAe,OAAO,kBAAkB,QAAQ,OAAO;IACvD,cAAc,OAAO,WAAW,QAAQ,OAAO;GACjD;GAEA,OAAO,OAAO,OAAO;IACnB,WAAW,KAAK;IAChB,QAAQ,OAAO,OAAO,MAAM;IAC5B,QAAQ;IACR;IACA,eACE,iBAAiB,KAAA,KAAa,WAAmB,SAAS,OAAO,WAAW,YAAY;IAC1F,gBAAgB,UAAmB,cAAc,KAAK,CAAC,CAAC,KAAK,OAAO,SAAS,YAAY,CAAC;IAC1F;GACF,CAAC;EACH;EAgUA,OAAO;GACL;GACA,cAAc;GACd,OAjUe,MAAM,cACrB,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO;IACvB,MAAM,QAAQ,OAAO;IACrB,MAAM,SAAS,OAAO,UAAU;IAChC,MAAM,WAAW,OAAO,QAAQ;IAEhC,MAAM,UAAU,OAAO,gBAAgB;KACrC,UAAU;KACV,cAAc;KACd,cAAc,KAAA;IAChB,CAAC;IAED,IAAI,YAAY,KAAA,GACd,OAAO,OAAO,YAAY,8CAA8C;IAC1E,IAAI,KAAK,gBAAgB,YACvB,OAAO,OAAO,YAAY,yDAAyD;IACrF,IACE,SAAS,MACN,YACC,YAAY,KAAA,KACX,eAAe,WAAW,QAAQ,aAClC,QAAQ,SAAS,WAAW,CAAC,QAAQ,SAC1C,GAEA,OAAO,OAAO,YACZ,2EACF;IACF,IAAI,QAAQ,cAAc,KAAK,WAC7B,OAAO,OAAO,YACZ,kEACF;IACF,MAAM,cAAmC,CAAC;IAE1C,KAAK,MAAM,QAAQ,OAAO;KACxB,MAAM,QAAS,QAAQ,OAA2C;KAElE,IAAI,UAAU,KAAA,GAAW,OAAO,OAAO,YAAY,WAAW,KAAK,OAAO;KAC1E,MAAM,cAAc,QAAQ,SAAS,KAAK;KAC1C,MAAM,UAAU,YAAY;KAE5B,KAAK,MAAM,QAAQ,OAAO,KAAK,cAAc,KAAK,CAAC,OAAO,GACxD,IAAI,QAAQ,UAAU,KAAA,GACpB,OAAO,OAAO,YAAY,WAAW,KAAK,GAAG,KAAK,QAAQ;KAE9D,YAAY,KAAK;MAAE,OAAO;MAAa,UAAU,cAAc,KAAK,CAAC;KAAO,CAAC;IAC/E;IACA,YAAY,KAAK;KACf,OAAO,QAAQ,SAAS,QAAQ,SAAS,KAAU;KACnD,UAAU,CAAC,CAAC,QAAQ,SAAS,EAAE,CAAC;IAClC,CAAC;IACD,OAAO,qBAAqB,SAAS,WAAW;IAChD,MAAM,WAAW,OAAO,aAAa,OAAO;IAE5C,MAAM,cAAiB,UACrB,kBAAkB,OAAO,OAAO,kBAAkB;IAGpD,MAAM,SAAS;IAMf,MAAM,UAAU;KACd,MAAM;KACN,SAAS,YAAY;KACrB,iBAAiB,iBAAiB,mBAAmB,KAAK,CAAC,CAAC,CAAC;IAC/D;IAEA,MAAM,iBAAiB,SAAS,SAAS,KAAK,MAAM;IAEpD,MAAM,kBAAkB,OAAO,cAC5B,wBAAwB,gBAAgB,OAAO,CAAC,CAChD,KACC,OAAO,eAAe,mBAAmB,MAAM,GAC/C,OAAO,eAAe,gBAAgB,MAAM,CAC9C;IAEF,MAAM,YAAY,OAAO,cACtB,+BACC;KAAE,GAAG,SAAS,UAAU;KAAG,4BAA4B;IAAM,GAC7D,OACF,CAAC,CACA,KACC,OAAO,eAAe,mBAAmB,MAAM,GAC/C,OAAO,eAAe,gBAAgB,MAAM,CAC9C;IAEF,IAAI,UAAkC,QAAQ,KAAK,yBAAyB,SAAS,CAAC,CAAC,KACrF,QAAQ,IACN,KAAK,SAAS,4BACd,gBAAgB,0BAClB,GACA,QAAQ,IAAI,KAAK,SAAS,mBAAmB,gBAAgB,iBAAiB,CAChF;IAEA,MAAM,qBAAqB,SACvB;KACE,SAAS,SAAS,OAAO;KACzB,eAAe;MACb,MAAM;MACN,SAAS,YAAY;MACrB,iBAAiB,iBAAiB,iBAAiB,KAAK,CAAC,CAAC,CAAC;MAC3D,iBAAiB,UAAyB,MAAM,oBAAoB;KACtE;IACF,IACA,KAAA;IAEJ,IAAI,uBAAuB,KAAA,GACzB,UAAU,QAAQ,IAChB,SACA,kBACA,OAAO,YACJ,wBAAwB,mBAAmB,SAAS,mBAAmB,aAAa,CAAC,CACrF,KACC,OAAO,eAAe,iBAAiB,MAAM,GAC7C,OAAO,eAAe,gBAAgB,MAAM,CAC9C,CACJ;IAGF,IAAI,UAAU;KACZ,MAAM,cAAc,OAAO,eACxB,2BAA2B,SAAS,UAAU,GAAG;MAChD,MAAM;MACN,SAAS,YAAY;MACrB,iBAAiB,iBAAiB,oBAAoB,KAAK,CAAC,CAAC,CAAC;MAC9D,iBAAiB,UAAU,MAAM,oBAAoB;MACrD,GAAI,uBAAuB,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,mBAAmB;KAC1E,CAAC,CAAC,CACD,KACC,OAAO,eAAe,oBAAoB,MAAM,GAChD,OAAO,eAAe,gBAAgB,MAAM,CAC9C;KAEF,UAAU,QAAQ,IAAI,SAAS,qBAAqB,WAAW;IACjE;IACA,KAAK,MAAM,CAAC,MAAM,aAAa,OAAO,QAAQ,KAAK,UAAU,GAAG;KAC9D,IAAI,SAAS,aAAa,SAAS,cAAc,CAAC,SAAS,YAAY,YACrE;KACF,MAAM,MAAM,SAAS;KAErB,IAAI,QAAQ,KAAA,GACV,OAAO,OAAO,YAAY,oCAAoC,MAAM;KAEtE,MAAM,eAAe,OAAO,0BAC1B,UACA,QAAQ,YACR,iBAAiB,oBAAoB,KAAK,CAAC,CAAC,CAAC,GAC7C,iBACA,IACF,CAAC,CAAC,KAAK,OAAO,eAAe,oBAAoB,MAAM,CAAC;KAExD,UAAU,QAAQ,IAAI,SAAS,KAAK,YAAY;IAClD;IACA,IAAI,OACF,UAAU,QAAQ,IAChB,SACA,yBACA,OAAO,YACJ,+BAA+B,SAAS,OAAO,GAAG;KACjD,MAAM;KACN,SAAS,YAAY;KACrB,iBAAiB,iBAAiB,iBAAiB,KAAK,CAAC,CAAC,CAAC;KAC3D,GAAI,uBAAuB,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,mBAAmB;IAC1E,CAAC,CAAC,CACD,KACC,OAAO,eAAe,iBAAiB,MAAM,GAC7C,OAAO,eAAe,gBAAgB,MAAM,CAC9C,CACJ;IAEF,IAAI,OAAO;KACT,MAAM,EAAE,QAAQ,OAAO,QAAQ;KAE/B,MAAM,WAAW,cAAsB;MACrC;MACA,SAAS;OACP,OAAO,QAAQ,SAAS;OACxB,IAAI,QAAQ,SAAS;OACrB,kBAAkB,QAAQ,SAAS;OACnC,iBAAiB,GACf,OAAO,QAAQ,SAAS,OAAO,QAAQ,SAAS,MAAM,GACtD,QAAQ,SAAS,WACnB;MACF;MACA,YAAY;OACV,UAAU,QAAQ,SAAS;OAC3B,WAAW,QAAQ,SAAS;MAC9B;MACA,YAAY;OACV,OAAO,SAAS,MAAM,aAAa;OACnC,WAAW;OACX,OAAO;OACP,WAAW;OACX,UAAU;OACV,YAAY;OACZ,iBAAiB,GAAG,OAAO,SAAS,MAAM,aAAa,GAAG,QAAQ,GAAG,IAAI;MAC3E;MACA,YAAY;OACV,OAAO,SAAS,MAAM,aAAa;OACnC,IAAI;OACJ,WAAW;OACX,UAAU;OACV,iBAAiB,GAAG,OAAO,SAAS,MAAM,aAAa,GAAG,QAAQ,GAAG,IAAI;MAC3E;MACA,OAAO;OACL,OAAO,SAAS,MAAM,YAAY;OAClC,OAAO;OACP,OAAO;OACP,SAAS;OACT,eAAe,QAAgB;MACjC;MACA,WAAW;OACT,cAAc;OACd,iBAAiB;OACjB,iBAAiB;OACjB,iBAAiB;OACjB,wBAAwB;MAC1B;MACA,iBAAiB,QAAQ,WACtB,GAAG,GAAG,YAAY,OAAO,QAAQ,WAAW,GAAG,iEAAiE,QAAQ,WAAW,GAAG;MACzI,eAAe,QAAQ;KACzB;KAEA,MAAM,YAAY,OAAO,gBACtB,yBACC,yBACA;MACE,MAAM;MACN;MACA,SAAS,YAAY;MACrB,uBAAuB,iBAAiB,oBAAoB,KAAK,CAAC,CAAC,CAAC;KACtE,SACM,oBAAoB,KAAK,CAAC,CAAC,GACjC,QACF,CAAC,CACA,KAAK,OAAO,eAAe,gBAAgB,MAAM,CAAC;KAErD,MAAM,OACJ,MACA,WAAW,SAEX,UAAU,MAAM,KACd,OAAO,QAAQ,UAAU,IAAI,MAAM,QAAQ,CAAC,GAC5C,OAAO,eAAe,gBAAgB,KAAK,CAC7C;KAEF,MAAM,WAAW,aACf,SAAS,MAAM,YAAY,SAAS,SAAS,WAAW,QAAQ,aAAa,QAAQ;KAEvF,MAAM,YAAY,eAAe,GAAG;MAClC,QAAQ,YACN,QAAQ,QAAQ,QAAQ,IACpB,IAAI,YAAY,WAAW,QAAQ,QAAQ,QAAQ,GAAG,OAAO,CAAC,IAC9D,OAAO,KAAK,oBAAoB,KAAK,CAAC,CAAC,CAAC;MAC9C,UAAU,YACR,QAAQ,QAAQ,QAAQ,IACpB,IAAI,YAAY,sBAAsB,QAAQ,QAAQ,QAAQ,GAAG,OAAO,CAAC,IACzE,OAAO,KAAK,oBAAoB,KAAK,CAAC,CAAC,CAAC;KAChD,CAAC;KAED,MAAM,UAAU,mBAAmB,GAAG,EACpC,SAAS,YACP,QAAQ,QAAQ,QAAQ,IACpB,IAAI,YAAY,YAAY,QAAQ,QAAQ,QAAQ,GAAG,OAAO,GAAG,KAAK,IACtE,OAAO,KAAK,oBAAoB,KAAK,CAAC,CAAC,CAAC,EAChD,CAAC;KAED,UAAU,QAAQ,KAChB,QAAQ,IAAI,gBAAgB,SAAS,GACrC,QAAQ,IAAI,oBAAoB,OAAO,CACzC;IACF;IAEA,IAAI,SAAS,SAAS,GAAG;KAEvB,MAAM,WAAW,QAAQ,SAAS;MAChC;MACA,WAAW,KAAK;MAChB;MACA,UAAU;MACV,iBAAiB,SAAS,SAAS,YACjC,SAAS,SAAS,aAAa,CAAC,QAAQ,QAAQ,IAAI,CAAC,CACvD;KACF,CAAC;KAWD,UAAU,QAAQ,MAChB,SACA,OAAO,SAAS,KACd,OAAO,eAAe,gBAAgB,MAAM,GAC5C,OAAO,eAAe,iBAAiB,MAAM,CAC/C,CACF;IACF;IAGA,OAAO;GACT,CAAC,CAAC,CAAC,KACD,uBACA,OAAO,UAAU,UACf,OAAO,GAAG,6BAA6B,CAAC,CAAC,KAAK,IAC1C,QACA,YAAY,gCAAgC,CAClD,CACF,CACF,CAAC,CAAC,KAAK,MAAM,QAAQ,UAAU,CAKf;GACd,UAA+B,YAQzB,OAAO,SAAS,IAAI;GAC1B,MAA2B,YAOrB,OAAO,SAAS,KAAK;EAC7B;CACF;CAEA,OAAO,EAAE,KAAK;AAChB"}

package/dist/internal/query-operations.d.mts

@@ -44,10 +44,12 @@ export interface QueryOperations<Fragment extends SqlFragment = SqlFragment, Col
   readonly balancedD1And: Predicate$1<Fragment>;
   readonly asc: (value: unknown) => Fragment;
   readonly eq: Comparison<Fragment>;
+  readonly ne: Comparison<Fragment>;
   readonly gt: Comparison<Fragment>;
   readonly gte: Comparison<Fragment>;
   readonly lte: Comparison<Fragment>;
   readonly inArray: (value: unknown, values: ReadonlyArray<unknown>) => Fragment;
+  readonly isNotNull: (value: unknown) => Fragment;
   readonly isNull: (value: unknown) => Fragment;
   readonly notExists: (value: SqlExpression) => Fragment;
   readonly sql: {