npm - @yielded/auth-persistence - Versions diffs - 0.1.0-beta.24 → 0.1.0-beta.25 - Mend

@yielded/auth-persistence 0.1.0-beta.24 → 0.1.0-beta.25

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (20) hide show

package/dist/internal/email-kernel.d.mts +1 -1
package/dist/internal/email-kernel.mjs +1 -1
package/dist/internal/email-kernel.mjs.map +1 -1
package/dist/internal/models/password-model.d.mts +2 -1
package/dist/internal/models/password-model.mjs.map +1 -1
package/dist/internal/oauth/accounts.mjs +1 -1
package/dist/internal/oauth/accounts.mjs.map +1 -1
package/dist/internal/oauth-kernel.d.mts +8 -8
package/dist/internal/passkey/write-state.mjs +9 -1
package/dist/internal/passkey/write-state.mjs.map +1 -1
package/dist/internal/passkey-kernel.d.mts +4 -4
package/dist/internal/password-kernel.d.mts +2 -2
package/dist/internal/password-kernel.mjs +1 -1
package/dist/internal/password-kernel.mjs.map +1 -1
package/package.json +1 -1
package/src/internal/email-kernel.ts +2 -1
package/src/internal/models/password-model.ts +2 -1
package/src/internal/oauth/accounts.ts +2 -1
package/src/internal/passkey/write-state.ts +18 -4
package/src/internal/password-kernel.ts +2 -1

package/dist/internal/email-kernel.d.mts CHANGED Viewed

@@ -132,7 +132,7 @@ export declare const makeEmailKernel: <Fragment extends SqlFragment = SqlFragmen
     completion: import("@yielded/auth/Proofs").ProofCompletionPlan;
     invalidation?: Readonly<{
       trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
-      existingSessions: "immediate" | "original-absolute-expiry";
+      existingSessions: "cache-expiry" | "immediate" | "original-absolute-expiry";
       maximumExposureMillis: number;
       oldAuthenticationEvidence: "rejected";
     }>;

package/dist/internal/email-kernel.mjs CHANGED Viewed

@@ -279,7 +279,7 @@ const makeEmailKernel = (operations, proofs) => {
 	});
 	const validateEmailAuthority = Effect.fn("DrizzleEmail.validateAuthority")(function* (mapping, configuration, input, action) {
 		const confirmsExisting = action === "verify-address" && input.captured.targetIdentifierRevision !== void 0;
-		if (!input.captured.eligible || !completionMatches(input, action) || input.authorization.challenge.moduleId !== input.moduleId || input.authorization.challenge.action !== action || input.authorization.challenge.commandId !== input.commandId || !sameIdentifier(input.authorization.challenge.target, input.target) || input.authorization.challenge.sourceCredentialId !== input.captured.source?.credentialId || !sameEmailRevision(input.authorization.challenge.revision, input.captured.revision) || input.authorization.challenge.targetIdentifierRevision !== input.captured.targetIdentifierRevision || input.authorization.evidence.flowId !== input.commandId || input.authorization.evidence.bindingDigest !== input.authorization.challenge.bindingDigest || !sameEmailRevision(input.authorization.evidence.revision, input.captured.revision) || action === "verify-address" && input.captured.source !== void 0 || action === "change-address" && input.captured.source === void 0 || confirmsExisting !== (input.invalidation === void 0) || input.invalidation?.existingSessions === "immediate" && mapping.sessionInvalidation !== "same-authority-immediate") return void 0;
+		if (!input.captured.eligible || !completionMatches(input, action) || input.authorization.challenge.moduleId !== input.moduleId || input.authorization.challenge.action !== action || input.authorization.challenge.commandId !== input.commandId || !sameIdentifier(input.authorization.challenge.target, input.target) || input.authorization.challenge.sourceCredentialId !== input.captured.source?.credentialId || !sameEmailRevision(input.authorization.challenge.revision, input.captured.revision) || input.authorization.challenge.targetIdentifierRevision !== input.captured.targetIdentifierRevision || input.authorization.evidence.flowId !== input.commandId || input.authorization.evidence.bindingDigest !== input.authorization.challenge.bindingDigest || !sameEmailRevision(input.authorization.evidence.revision, input.captured.revision) || action === "verify-address" && input.captured.source !== void 0 || action === "change-address" && input.captured.source === void 0 || confirmsExisting !== (input.invalidation === void 0) || (input.invalidation?.existingSessions === "immediate" || input.invalidation?.existingSessions === "cache-expiry") && mapping.sessionInvalidation !== "same-authority-immediate") return void 0;
 		const current = yield* currentAddress(mapping, {
 			moduleId: input.moduleId,
 			subjectId: input.captured.revision.subjectId,

package/dist/internal/email-kernel.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"email-kernel.mjs","names":[],"sources":["../../src/internal/email-kernel.ts"],"sourcesContent":["import {\n EmailAddressPersistence,\n type EmailAddressMutation,\n type EmailAction,\n type EmailCredentialSnapshot,\n EmailSignInTargets,\n EmailUnavailable,\n snapshotEmailCredential,\n snapshotEmailRequirement,\n snapshotEmailRevision,\n} from \"@yielded/auth/Email\";\nimport {\n coordinateCommit,\n CurrentCommitJournal,\n hasCommitScope,\n type CommitJournal,\n type PreparedCommit,\n LifecycleHooks,\n HookConfigurationError,\n} from \"@yielded/auth/Hooks\";\nimport type { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport { reportPersistenceFailure } from \"@yielded/auth/Persistence\";\nimport {\n ProofUnavailable,\n type ProofCompletionDecision,\n type ProofCompletionInput,\n} from \"@yielded/auth/Proofs\";\nimport {\n assessAuthentication,\n snapshotAuthenticationEvidence,\n type AuthenticationRevision,\n type SecurityRevision,\n} from \"@yielded/auth/Sessions\";\nimport { Cause, Context, DateTime, Effect, Option, Schema } from \"effect\";\nimport type * as SqlError from \"effect/sql/SqlError\";\n\nimport { isMappedConstraintConflict, PersistenceMappingError } from \"./mapping-error\";\nimport {\n type AnyEmailAddressMapping,\n type AnyEmailSignInMapping,\n requiredEmailAddressConstraints,\n requiredEmailSignInConstraints,\n} from \"./models/email-model\";\nimport {\n CurrentProofSql,\n type makeProofKernel,\n type ProofSqlConfiguration,\n type ProofSqlDatabase,\n} from \"./proof-kernel\";\n/* oxlint-disable no-explicit-any -- the shared dialect kernel erases consumer Drizzle table types internally. /\nimport type { QueryFailure } from \"./query-operations\";\nimport type { QueryOperations, SqlFragment, SqlColumn } from \"./query-operations\";\nimport type { NativeDatabase } from \"./transaction-kernel\";\n\ntype AdapterFailure = QueryFailure \| PersistenceMappingError \| SqlError.SqlError;\ntype SignInMapping = AnyEmailSignInMapping;\n\nexport interface EmailSqlQuery<A = ReadonlyArray<any>> extends Effect.Effect<A, AdapterFailure> {\n readonly getSQL: () => ReturnType<QueryOperations[\"sql\"]>;\n readonly from: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n readonly where: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n readonly limit: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n readonly orderBy: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n readonly for: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n readonly set: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n readonly values: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n readonly returning: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n readonly innerJoin: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n readonly onConflictDoNothing: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n readonly onDuplicateKeyUpdate: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n readonly $returningId: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n}\n\nexport interface EmailSqlDatabase {\n readonly select: (...args: ReadonlyArray<any>) => EmailSqlQuery;\n readonly insert: (...args: ReadonlyArray<any>) => EmailSqlQuery;\n readonly update: (...args: ReadonlyArray<any>) => EmailSqlQuery;\n readonly delete: (...args: ReadonlyArray<any>) => EmailSqlQuery;\n readonly transaction: <A, E, R>(\n body: (transaction: EmailSqlDatabase) => Effect.Effect<A, E, R>,\n ) => Effect.Effect<A, E \| SqlError.SqlError, R>;\n}\n\nexport class CurrentEmailSql extends Context.Service<CurrentEmailSql, EmailSqlDatabase>()(\n \"effect-auth/CurrentEmailSql\",\n) {}\n\nexport interface EmailSqlConfiguration {\n readonly mode: \"interactive\" \| \"synchronous\";\n readonly locking: boolean;\n readonly standaloneGuard: Effect.Effect<void, EmailUnavailable>;\n readonly coordinated?: boolean;\n readonly proof?: {\n readonly mapping: any;\n readonly configuration: ProofSqlConfiguration;\n };\n}\n\nexport interface CurrentAddress {\n readonly nativeSubjectId: unknown;\n readonly subject: any;\n readonly revision: AuthenticationRevision;\n readonly source?: {\n readonly credential: any;\n readonly identifier: any;\n readonly snapshot: EmailCredentialSnapshot;\n };\n readonly targetIdentifier?: any;\n readonly targetCredential?: any;\n readonly targetIdentifierRevision?: SecurityRevision;\n readonly eligible: boolean;\n}\n\nexport const makeEmailKernel = <\n Fragment extends SqlFragment = SqlFragment,\n Column extends SqlColumn = SqlColumn,\n>(\n operations: QueryOperations<Fragment, Column>,\n proofs: Pick<ReturnType<typeof makeProofKernel>, \"completeProofPlanIn\">,\n) => {\n type AddressMapping = AnyEmailAddressMapping<Fragment>;\n\n const { and, eq, inArray, lte, column, updateValues } = operations;\n const { completeProofPlanIn } = proofs;\n const unavailable = () => EmailUnavailable.make({});\n\n const translateFailure = <A, E, R>(\n effect: Effect.Effect<A, E, R>,\n ): Effect.Effect<A, EmailUnavailable, R> =>\n reportPersistenceFailure(\n effect,\n (error) =>\n Schema.is(EmailUnavailable)(error) \|\|\n Schema.is(ProofUnavailable)(error) \|\|\n Schema.is(HookConfigurationError)(error),\n ).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));\n\n const nowMillis = Effect.map(DateTime.now, DateTime.toEpochMillis);\n\n const selectRows = (query: EmailSqlQuery, locking: boolean) =>\n locking && typeof query.for === \"function\" ? query.for(\"update\") : query;\n\n const sameIdentifier = (left: LoginIdentifier, right: LoginIdentifier) =>\n left.namespace === right.namespace && left.value === right.value;\n\n const validEmailSignInConstraints = (mapping: SignInMapping) =>\n Object.entries(requiredEmailSignInConstraints).every(\n ([key, value]) =>\n mapping.constraints[key as keyof typeof requiredEmailSignInConstraints] === value,\n );\n\n const validAddressConstraints = (mapping: AddressMapping) =>\n Object.entries(requiredEmailAddressConstraints).every(\n ([key, value]) =>\n mapping.constraints[key as keyof typeof requiredEmailAddressConstraints] === value,\n );\n\n const subjectColumns = (mapping: SignInMapping) => ({\n id: column(mapping.subject.table, mapping.subject.id),\n status: column(mapping.subject.table, mapping.subject.status),\n securityRevision: column(mapping.subject.table, mapping.subject.securityRevision),\n });\n\n const identifierColumns = (mapping: SignInMapping) => ({\n namespace: column(mapping.identifier.table, mapping.identifier.namespace),\n value: column(mapping.identifier.table, mapping.identifier.value),\n subjectId: column(mapping.identifier.table, mapping.identifier.subjectId),\n verifiedAt: column(mapping.identifier.table, mapping.identifier.verifiedAt),\n bindingRevision: column(mapping.identifier.table, mapping.identifier.bindingRevision),\n });\n\n const credentialColumns = (mapping: SignInMapping) => ({\n moduleId: column(mapping.credential.table, mapping.credential.moduleId),\n subjectId: column(mapping.credential.table, mapping.credential.subjectId),\n credentialId: column(mapping.credential.table, mapping.credential.credentialId),\n identifierNamespace: column(mapping.credential.table, mapping.credential.identifierNamespace),\n identifierValue: column(mapping.credential.table, mapping.credential.identifierValue),\n credentialRevision: column(mapping.credential.table, mapping.credential.credentialRevision),\n status: column(mapping.credential.table, mapping.credential.status),\n });\n\n const authorityColumns = (mapping: AddressMapping) => ({\n subjectId: column(mapping.authorityCredential.table, mapping.authorityCredential.subjectId),\n credentialId: column(\n mapping.authorityCredential.table,\n mapping.authorityCredential.credentialId,\n ),\n revision: column(mapping.authorityCredential.table, mapping.authorityCredential.revision),\n status: column(mapping.authorityCredential.table, mapping.authorityCredential.status),\n });\n\n const commandColumns = (mapping: AddressMapping) => ({\n moduleId: column(mapping.command.table, mapping.command.moduleId),\n commandId: column(mapping.command.table, mapping.command.commandId),\n action: column(mapping.command.table, mapping.command.action),\n bindingDigest: column(mapping.command.table, mapping.command.bindingDigest),\n retentionUntil: column(mapping.command.table, mapping.command.retentionUntil),\n });\n\n const allocate = <A>(\n mode: EmailSqlConfiguration[\"mode\"],\n asynchronous: Effect.Effect<A, PersistenceMappingError> \| undefined,\n synchronous: (() => A) \| undefined,\n ) => {\n if (mode === \"synchronous\")\n return synchronous === undefined\n ? Effect.fail(unavailable())\n : Effect.try({\n try: synchronous,\n catch: (cause) => new PersistenceMappingError({ operation: \"mapping\", cause }),\n });\n if (asynchronous !== undefined) return asynchronous;\n\n return synchronous === undefined\n ? Effect.fail(unavailable())\n : Effect.try({\n try: synchronous,\n catch: (cause) => new PersistenceMappingError({ operation: \"mapping\", cause }),\n });\n };\n\n const nextSecurityRevision = (\n mapping: AddressMapping,\n mode: EmailSqlConfiguration[\"mode\"],\n current: SecurityRevision,\n ) => {\n if (mode === \"synchronous\")\n return mapping.subject.nextSecurityRevisionSync === undefined\n ? Effect.fail(unavailable())\n : Effect.try({\n try: () => mapping.subject.nextSecurityRevisionSync!(current),\n catch: (cause) => new PersistenceMappingError({ operation: \"mapping\", cause }),\n });\n if (mapping.subject.nextSecurityRevision !== undefined)\n return mapping.subject.nextSecurityRevision(current);\n if (mapping.subject.nextSecurityRevisionSync !== undefined)\n return Effect.try({\n try: () => mapping.subject.nextSecurityRevisionSync!(current),\n catch: (cause) => new PersistenceMappingError({ operation: \"mapping\", cause }),\n });\n\n return Effect.fail(unavailable());\n };\n\n const safeRead = <A, E, R>(\n database: EmailSqlDatabase,\n configuration: EmailSqlConfiguration,\n body: Effect.Effect<A, E, R>,\n ) =>\n Effect.gen(function () {\n if (configuration.coordinated !== true) {\n if (yield* hasCommitScope) return yield* unavailable();\n yield* configuration.standaloneGuard;\n }\n\n return yield* database.transaction((transaction) =>\n body.pipe(\n Effect.provideService(CurrentEmailSql, transaction),\n Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),\n ),\n );\n });\n\n const owned = <A, E, R>(\n database: EmailSqlDatabase,\n configuration: EmailSqlConfiguration,\n body: Effect.Effect<A, E, R>,\n ) => {\n const run = coordinateCommit(\n () =>\n database.transaction((transaction) =>\n body.pipe(\n Effect.provideService(CurrentEmailSql, transaction),\n Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),\n ),\n ),\n { mode: configuration.mode },\n ).pipe(Effect.map((result) => result.value));\n\n return configuration.coordinated !== true\n ? Effect.gen(function* () {\n if (yield* hasCommitScope) return yield* unavailable();\n yield* configuration.standaloneGuard;\n\n return yield* run;\n })\n : run;\n };\n\n const emailLookupQuery = (\n mapping: SignInMapping,\n moduleId: string,\n identifier: LoginIdentifier,\n ) => {\n const subject = subjectColumns(mapping),\n binding = identifierColumns(mapping),\n credential = credentialColumns(mapping);\n\n return {\n fields: {\n subject: mapping.subject.table,\n identifier: mapping.identifier.table,\n credential: mapping.credential.table,\n },\n from: mapping.identifier.table,\n subjectTable: mapping.subject.table,\n subjectJoin: eq(subject.id, binding.subjectId),\n credentialTable: mapping.credential.table,\n credentialJoin: and(\n eq(credential.moduleId, moduleId),\n eq(credential.subjectId, binding.subjectId),\n eq(credential.identifierNamespace, binding.namespace),\n eq(credential.identifierValue, binding.value),\n ),\n predicate: and(\n eq(binding.namespace, identifier.namespace),\n eq(binding.value, identifier.value),\n ),\n limit: 1,\n };\n };\n\n const emailLookupRows = Effect.fn(\"Drizzle.emailLookupRows\")(function* (\n mapping: SignInMapping,\n moduleId: string,\n identifier: LoginIdentifier,\n ) {\n const database = yield* CurrentEmailSql;\n const query = emailLookupQuery(mapping, moduleId, identifier);\n\n return yield* database\n .select(query.fields)\n .from(query.from)\n .innerJoin(query.subjectTable, query.subjectJoin)\n .innerJoin(query.credentialTable, query.credentialJoin)\n .where(query.predicate)\n .limit(query.limit);\n });\n\n const decodeEmailSnapshot = Effect.fn(\"DrizzleEmail.decodeSnapshot\")(function* (\n mapping: SignInMapping,\n moduleId: string,\n requested: LoginIdentifier,\n row: any,\n ) {\n if (\n !mapping.subject.isActiveStatus(row.subject[mapping.subject.status]) \|\|\n !mapping.identifier.isCurrent(row.identifier) \|\|\n !mapping.credential.isActiveStatus(row.credential[mapping.credential.status])\n )\n return undefined;\n\n const snapshot = yield* mapping.credential\n .decode({\n moduleId,\n subject: row.subject,\n identifier: row.identifier,\n credential: row.credential,\n })\n .pipe(Effect.flatMap(snapshotEmailCredential));\n\n const subjectId = yield* mapping.subjectId.toSubject(row.subject[mapping.subject.id]);\n\n const verifiedAtMillis = yield* mapping.decodeInstant(\n row.identifier[mapping.identifier.verifiedAt],\n );\n\n if (\n snapshot.moduleId !== moduleId \|\|\n !sameIdentifier(snapshot.identifier, requested) \|\|\n snapshot.revision.subjectId !== subjectId \|\|\n snapshot.revision.securityRevision !== row.subject[mapping.subject.securityRevision] \|\|\n snapshot.identifierRevision !== row.identifier[mapping.identifier.bindingRevision] \|\|\n snapshot.verifiedAtMillis !== verifiedAtMillis \|\|\n snapshot.credentialId !== row.credential[mapping.credential.credentialId] \|\|\n snapshot.credentialRevision !== row.credential[mapping.credential.credentialRevision]\n )\n return undefined;\n\n return snapshot;\n });\n\n const makeSqlEmailSignInTargets = Effect.fn(\"makeSqlEmailSignInTargets\")(function* (\n mapping: SignInMapping,\n configuration: EmailSqlConfiguration,\n ): Effect.fn.Return<\n EmailSignInTargets[\"Service\"],\n EmailUnavailable,\n CurrentEmailSql \| NativeDatabase\n > {\n const database = yield* CurrentEmailSql;\n\n if (!configuration.coordinated)\n yield* (\n operations.validateStorage?.({\n ...mapping,\n proof: configuration.proof?.mapping,\n }) ?? Effect.void\n ).pipe(Effect.mapError(unavailable));\n\n return EmailSignInTargets.of({\n lookup: (input) =>\n (validEmailSignInConstraints(mapping)\n ? safeRead(\n database,\n configuration,\n Effect.gen(function* () {\n const row = (yield* emailLookupRows(mapping, input.moduleId, input.identifier))[0];\n\n if (row === undefined) return Option.none();\n\n const snapshot = yield* decodeEmailSnapshot(\n mapping,\n input.moduleId,\n input.identifier,\n row,\n );\n\n return snapshot === undefined ? Option.none() : Option.some(snapshot);\n }),\n )\n : Effect.fail(unavailable())\n ).pipe(Effect.provideService(CurrentEmailSql, database), translateFailure),\n });\n });\n\n const readSubject = Effect.fn(\"DrizzleEmail.readSubject\")(function* (\n mapping: AddressMapping,\n subjectId: string,\n locking: boolean,\n ) {\n const database = yield* CurrentEmailSql;\n\n const nativeSubjectId = yield* mapping.subjectId.toNative(subjectId as any);\n const s = subjectColumns(mapping);\n\n const subject = (yield* selectRows(\n database.select().from(mapping.subject.table).where(eq(s.id, nativeSubjectId)).limit(1),\n locking,\n ))[0];\n\n return { nativeSubjectId, subject };\n });\n\n const identifierRow = Effect.fn(\"Drizzle.identifierRow\")(function* (\n mapping: SignInMapping,\n identifier: LoginIdentifier,\n locking: boolean,\n ) {\n const database = yield* CurrentEmailSql;\n\n const i = identifierColumns(mapping);\n\n return yield* selectRows(\n database\n .select()\n .from(mapping.identifier.table)\n .where(and(eq(i.namespace, identifier.namespace), eq(i.value, identifier.value)))\n .limit(1),\n locking,\n );\n });\n\n const credentialById = Effect.fn(\"Drizzle.credentialById\")(function* (\n mapping: SignInMapping,\n moduleId: string,\n credentialId: string,\n locking: boolean,\n ) {\n const database = yield* CurrentEmailSql;\n\n const c = credentialColumns(mapping);\n\n return yield* selectRows(\n database\n .select()\n .from(mapping.credential.table)\n .where(and(eq(c.moduleId, moduleId), eq(c.credentialId, credentialId)))\n .limit(1),\n locking,\n );\n });\n\n const credentialByIdentifier = Effect.fn(\"Drizzle.credentialByIdentifier\")(function* (\n mapping: SignInMapping,\n moduleId: string,\n identifier: LoginIdentifier,\n locking: boolean,\n ) {\n const database = yield* CurrentEmailSql;\n\n const c = credentialColumns(mapping);\n\n return yield* selectRows(\n database\n .select()\n .from(mapping.credential.table)\n .where(\n and(\n eq(c.moduleId, moduleId),\n eq(c.identifierNamespace, identifier.namespace),\n eq(c.identifierValue, identifier.value),\n ),\n )\n .limit(1),\n locking,\n );\n });\n\n const currentAddress = Effect.fn(\"DrizzleEmail.currentAddress\")(function* (\n mapping: AddressMapping,\n input: {\n readonly moduleId: string;\n readonly subjectId: string;\n readonly target: LoginIdentifier;\n readonly sourceCredentialId?: string;\n },\n locking: boolean,\n ) {\n const database = yield* CurrentEmailSql;\n\n const locked = yield* readSubject(mapping, input.subjectId, locking);\n\n if (\n locked.subject === undefined \|\|\n !mapping.subject.isActiveStatus(locked.subject[mapping.subject.status])\n )\n return undefined;\n\n const discoveredSource =\n input.sourceCredentialId === undefined\n ? undefined\n : (yield* credentialById(mapping, input.moduleId, input.sourceCredentialId, false))[0];\n\n const sourceIdentifier: LoginIdentifier \| undefined =\n discoveredSource === undefined\n ? undefined\n : {\n namespace: discoveredSource[mapping.credential.identifierNamespace],\n value: discoveredSource[mapping.credential.identifierValue],\n };\n\n const identifiers = [\n input.target,\n ...(sourceIdentifier === undefined ? [] : [sourceIdentifier]),\n ]\n .filter(\n (value, index, values) =>\n values.findIndex((candidate) => sameIdentifier(candidate, value)) === index,\n )\n .sort((left, right) =>\n `${left.namespace}\\u0000${left.value}`.localeCompare(\n `${right.namespace}\\u0000${right.value}`,\n ),\n );\n\n const lockedIdentifiers = new Map<string, any>();\n\n for (const identifier of identifiers) {\n const row = (yield* identifierRow(mapping, identifier, locking))[0];\n\n if (row !== undefined)\n lockedIdentifiers.set(`${identifier.namespace}\\u0000${identifier.value}`, row);\n }\n\n const sourceCredential =\n input.sourceCredentialId === undefined\n ? undefined\n : (yield* credentialById(mapping, input.moduleId, input.sourceCredentialId, locking))[0];\n\n const targetCredential = (yield* credentialByIdentifier(\n mapping,\n input.moduleId,\n input.target,\n locking,\n ))[0];\n\n const a = authorityColumns(mapping);\n\n const authority = yield* selectRows(\n database\n .select()\n .from(mapping.authorityCredential.table)\n .where(eq(a.subjectId, locked.nativeSubjectId))\n .orderBy(a.credentialId),\n locking,\n );\n\n const activeAuthority = authority.filter((row: any) =>\n mapping.authorityCredential.isActiveStatus(row[mapping.authorityCredential.status]),\n );\n\n const subjectId = yield* mapping.subjectId.toSubject(locked.nativeSubjectId);\n\n const revision: AuthenticationRevision = Object.freeze({\n subjectId,\n securityRevision: locked.subject[mapping.subject.securityRevision],\n credentials: Object.freeze(\n activeAuthority.map((row: any) =>\n Object.freeze({\n credentialId: row[mapping.authorityCredential.credentialId],\n revision: row[mapping.authorityCredential.revision],\n }),\n ),\n ),\n });\n\n const targetIdentifier = lockedIdentifiers.get(\n `${input.target.namespace}\\u0000${input.target.value}`,\n );\n\n const targetOwned =\n targetIdentifier !== undefined &&\n mapping.subjectId.equals(\n targetIdentifier[mapping.identifier.subjectId],\n locked.nativeSubjectId,\n );\n\n const targetMutable =\n targetOwned &&\n mapping.identifier.isMutableTarget(targetIdentifier) &&\n (targetCredential === undefined \|\|\n (!mapping.credential.isActiveStatus(targetCredential[mapping.credential.status]) &&\n mapping.subjectId.equals(\n targetCredential[mapping.credential.subjectId],\n locked.nativeSubjectId,\n )));\n\n let source: CurrentAddress[\"source\"];\n\n if (input.sourceCredentialId !== undefined) {\n if (\n sourceCredential === undefined \|\|\n sourceIdentifier === undefined \|\|\n !mapping.subjectId.equals(\n sourceCredential[mapping.credential.subjectId],\n locked.nativeSubjectId,\n ) \|\|\n !mapping.credential.isActiveStatus(sourceCredential[mapping.credential.status])\n )\n return undefined;\n\n const sourceIdentifierRow = lockedIdentifiers.get(\n `${sourceIdentifier.namespace}\\u0000${sourceIdentifier.value}`,\n );\n\n if (\n sourceIdentifierRow === undefined \|\|\n !mapping.identifier.isCurrent(sourceIdentifierRow) \|\|\n !mapping.subjectId.equals(\n sourceIdentifierRow[mapping.identifier.subjectId],\n locked.nativeSubjectId,\n )\n )\n return undefined;\n\n const snapshot = yield* mapping.credential\n .decode({\n moduleId: input.moduleId,\n subject: locked.subject,\n identifier: sourceIdentifierRow,\n credential: sourceCredential,\n })\n .pipe(Effect.flatMap(snapshotEmailCredential));\n\n source = { credential: sourceCredential, identifier: sourceIdentifierRow, snapshot };\n }\n let eligible = targetIdentifier === undefined ? targetCredential === undefined : targetMutable;\n\n if (input.sourceCredentialId !== undefined && source === undefined) eligible = false;\n if (source !== undefined && sameIdentifier(source.snapshot.identifier, input.target))\n eligible = false;\n if (mapping.addressCardinality === \"single\" && input.sourceCredentialId === undefined) {\n const c = credentialColumns(mapping);\n\n const rows = yield* selectRows(\n database\n .select()\n .from(mapping.credential.table)\n .where(and(eq(c.moduleId, input.moduleId), eq(c.subjectId, locked.nativeSubjectId))),\n locking,\n );\n\n if (\n rows.some((row: any) => mapping.credential.isActiveStatus(row[mapping.credential.status]))\n )\n eligible = false;\n }\n\n return {\n nativeSubjectId: locked.nativeSubjectId,\n subject: locked.subject,\n revision,\n ...(source === undefined ? {} : { source }),\n ...(targetIdentifier === undefined ? {} : { targetIdentifier }),\n ...(targetCredential === undefined ? {} : { targetCredential }),\n ...(targetMutable\n ? { targetIdentifierRevision: targetIdentifier[mapping.identifier.bindingRevision] }\n : {}),\n eligible,\n };\n });\n\n const sameEmailRevision = (left: AuthenticationRevision, right: AuthenticationRevision) => {\n if (\n left.subjectId !== right.subjectId \|\|\n left.securityRevision !== right.securityRevision \|\|\n left.credentials.length !== right.credentials.length\n )\n return false;\n\n const expected = [...left.credentials].sort((a, b) =>\n a.credentialId.localeCompare(b.credentialId),\n );\n\n const actual = [...right.credentials].sort((a, b) =>\n a.credentialId.localeCompare(b.credentialId),\n );\n\n return expected.every(\n (item, index) =>\n item.credentialId === actual[index]!.credentialId &&\n item.revision === actual[index]!.revision,\n );\n };\n\n const actionModule = (moduleId: string, action: EmailAction) =>\n `${moduleId}/${action === \"verify-address\" ? \"verify-address\" : \"change-address\"}`;\n\n const actionPurpose = (action: EmailAction) =>\n action === \"verify-address\" ? \"email-address-verification\" : \"email-address-change\";\n\n const completionMatches = (input: EmailAddressMutation, action: EmailAction) => {\n const completion = input.completion.input;\n const binding = completion.binding;\n\n return (\n completion.moduleId === actionModule(input.moduleId, action) &&\n completion.purpose === actionPurpose(action) &&\n binding._tag === \"IdentifierChange\" &&\n sameIdentifier(binding.identifier, input.target) &&\n sameEmailRevision(binding.revision, input.captured.revision)\n );\n };\n\n const snapshotEmailMutation = Effect.fn(\"DrizzleEmail.snapshotMutation\")(function* (\n input: EmailAddressMutation,\n ) {\n const evidence = yield* snapshotAuthenticationEvidence(input.authorization.evidence).pipe(\n Effect.mapError(unavailable),\n );\n\n const requirement = yield* snapshotEmailRequirement(input.authorization.requirement);\n\n const source =\n input.captured.source === undefined\n ? undefined\n : yield* snapshotEmailCredential(input.captured.source);\n\n return Object.freeze({\n ...input,\n target: Object.freeze({ ...input.target }),\n ...(input.invalidation === undefined\n ? {}\n : { invalidation: Object.freeze({ ...input.invalidation }) }),\n captured: Object.freeze({\n eligible: input.captured.eligible,\n revision: snapshotEmailRevision(input.captured.revision),\n ...(input.captured.targetIdentifierRevision === undefined\n ? {}\n : { targetIdentifierRevision: input.captured.targetIdentifierRevision }),\n ...(source === undefined ? {} : { source }),\n }),\n authorization: Object.freeze({\n challenge: Object.freeze({\n ...input.authorization.challenge,\n target: Object.freeze({ ...input.authorization.challenge.target }),\n revision: snapshotEmailRevision(input.authorization.challenge.revision),\n }),\n evidence,\n requirement,\n }),\n });\n });\n\n const validateEmailAuthority = Effect.fn(\"DrizzleEmail.validateAuthority\")(function* (\n mapping: AddressMapping,\n configuration: EmailSqlConfiguration,\n input: EmailAddressMutation,\n action: EmailAction,\n ) {\n const confirmsExisting =\n action === \"verify-address\" && input.captured.targetIdentifierRevision !== undefined;\n\n if (\n !input.captured.eligible \|\|\n !completionMatches(input, action) \|\|\n input.authorization.challenge.moduleId !== input.moduleId \|\|\n input.authorization.challenge.action !== action \|\|\n input.authorization.challenge.commandId !== input.commandId \|\|\n !sameIdentifier(input.authorization.challenge.target, input.target) \|\|\n input.authorization.challenge.sourceCredentialId !== input.captured.source?.credentialId \|\|\n !sameEmailRevision(input.authorization.challenge.revision, input.captured.revision) \|\|\n input.authorization.challenge.targetIdentifierRevision !==\n input.captured.targetIdentifierRevision \|\|\n (input.authorization.evidence.flowId as string) !== (input.commandId as string) \|\|\n input.authorization.evidence.bindingDigest !== input.authorization.challenge.bindingDigest \|\|\n !sameEmailRevision(input.authorization.evidence.revision, input.captured.revision) \|\|\n (action === \"verify-address\" && input.captured.source !== undefined) \|\|\n (action === \"change-address\" && input.captured.source === undefined) \|\|\n confirmsExisting !== (input.invalidation === undefined) \|\|\n (input.invalidation?.existingSessions === \"immediate\" &&\n mapping.sessionInvalidation !== \"same-authority-immediate\")\n )\n return undefined;\n\n const current = yield* currentAddress(\n mapping,\n {\n moduleId: input.moduleId,\n subjectId: input.captured.revision.subjectId,\n target: input.target,\n ...(input.captured.source === undefined\n ? {}\n : { sourceCredentialId: input.captured.source.credentialId }),\n },\n configuration.locking,\n );\n\n if (\n current === undefined \|\|\n !current.eligible \|\|\n !sameEmailRevision(current.revision, input.captured.revision) \|\|\n current.targetIdentifierRevision !== input.captured.targetIdentifierRevision \|\|\n (input.captured.source !== undefined &&\n (current.source === undefined \|\|\n current.source.snapshot.identifierRevision !== input.captured.source.identifierRevision \|\|\n current.source.snapshot.credentialRevision !== input.captured.source.credentialRevision \|\|\n !sameIdentifier(current.source.snapshot.identifier, input.captured.source.identifier)))\n )\n return undefined;\n\n const currentRequirement = yield* mapping.subject.decodeActionRequirement(\n current.subject,\n action,\n );\n\n const original = yield* assessAuthentication(\n input.authorization.evidence,\n input.authorization.requirement,\n ).pipe(Effect.mapError(unavailable));\n\n const configured = yield* assessAuthentication(\n input.authorization.evidence,\n currentRequirement,\n ).pipe(Effect.mapError(unavailable));\n\n return original.satisfied && configured.satisfied ? current : undefined;\n });\n\n const commandExists = Effect.fn(\"Drizzle.commandExists\")(function* (\n mapping: AddressMapping,\n moduleId: string,\n commandId: string,\n locking: boolean,\n ) {\n const database = yield* CurrentEmailSql;\n\n const c = commandColumns(mapping);\n\n return yield* selectRows(\n database\n .select()\n .from(mapping.command.table)\n .where(and(eq(c.moduleId, moduleId), eq(c.commandId, commandId)))\n .limit(1),\n locking,\n );\n });\n\n const applyMutation = Effect.fn(\"DrizzleEmail.applyMutation\")(function* (\n mapping: AddressMapping,\n input: EmailAddressMutation,\n action: EmailAction,\n current: CurrentAddress,\n allocated: {\n readonly targetCredentialId: string;\n readonly targetIdentifierRevision: SecurityRevision;\n readonly targetCredentialRevision: SecurityRevision;\n readonly sourceIdentifierRevision: SecurityRevision;\n readonly sourceCredentialRevision: SecurityRevision;\n readonly nextSecurityRevision: SecurityRevision;\n },\n now: number,\n ) {\n const database = yield* CurrentEmailSql;\n\n const i = identifierColumns(mapping);\n const c = credentialColumns(mapping);\n const a = authorityColumns(mapping);\n const s = subjectColumns(mapping);\n\n const targetCredentialId =\n current.targetCredential?.[mapping.credential.credentialId] ?? allocated.targetCredentialId;\n\n if (action === \"change-address\") {\n const source = current.source!;\n\n yield* database\n .update(mapping.identifier.table)\n .set(\n mapping.identifier.encodeRetirement({\n source: source.snapshot.identifier,\n bindingRevision: allocated.sourceIdentifierRevision,\n }),\n )\n .where(\n and(\n eq(i.namespace, source.snapshot.identifier.namespace),\n eq(i.value, source.snapshot.identifier.value),\n eq(i.subjectId, current.nativeSubjectId),\n eq(i.bindingRevision, source.snapshot.identifierRevision),\n ),\n );\n yield* database\n .update(mapping.credential.table)\n .set(\n mapping.credential.encodeRetirement({\n source: source.snapshot.identifier,\n credentialRevision: allocated.sourceCredentialRevision,\n }),\n )\n .where(\n and(\n eq(c.moduleId, input.moduleId),\n eq(c.credentialId, source.snapshot.credentialId),\n eq(c.subjectId, current.nativeSubjectId),\n eq(c.credentialRevision, source.snapshot.credentialRevision),\n ),\n );\n yield* database\n .update(mapping.authorityCredential.table)\n .set(mapping.authorityCredential.encodeRetirement(allocated.sourceCredentialRevision))\n .where(\n and(\n eq(a.subjectId, current.nativeSubjectId),\n eq(a.credentialId, source.snapshot.credentialId),\n eq(a.revision, source.snapshot.credentialRevision),\n ),\n );\n }\n if (current.targetIdentifier === undefined) {\n yield* database.insert(mapping.identifier.table).values(\n mapping.identifier.encodeVerifiedInsert({\n identifier: input.target,\n subjectId: current.nativeSubjectId,\n verifiedAtMillis: now,\n bindingRevision: allocated.targetIdentifierRevision,\n }),\n );\n } else {\n yield* database\n .update(mapping.identifier.table)\n .set(\n mapping.identifier.encodeVerification({\n verifiedAtMillis: now,\n bindingRevision: allocated.targetIdentifierRevision,\n }),\n )\n .where(\n and(\n eq(i.namespace, input.target.namespace),\n eq(i.value, input.target.value),\n eq(i.subjectId, current.nativeSubjectId),\n eq(i.bindingRevision, current.targetIdentifier![mapping.identifier.bindingRevision]),\n ),\n );\n }\n if (current.targetCredential === undefined) {\n yield* database.insert(mapping.credential.table).values(\n mapping.credential.encodeVerifiedInsert({\n moduleId: input.moduleId,\n subjectId: current.nativeSubjectId,\n credentialId: targetCredentialId,\n identifier: input.target,\n credentialRevision: allocated.targetCredentialRevision,\n }),\n );\n yield* database.insert(mapping.authorityCredential.table).values(\n mapping.authorityCredential.encodeInsert({\n subjectId: current.nativeSubjectId,\n credentialId: targetCredentialId,\n revision: allocated.targetCredentialRevision,\n }),\n );\n } else {\n const oldRevision = current.targetCredential[mapping.credential.credentialRevision];\n\n yield* database\n .update(mapping.credential.table)\n .set(\n mapping.credential.encodeActivation({\n identifier: input.target,\n credentialRevision: allocated.targetCredentialRevision,\n }),\n )\n .where(\n and(\n eq(c.moduleId, input.moduleId),\n eq(c.credentialId, targetCredentialId),\n eq(c.subjectId, current.nativeSubjectId),\n eq(c.credentialRevision, oldRevision),\n ),\n );\n yield* database\n .update(mapping.authorityCredential.table)\n .set(mapping.authorityCredential.encodeActivation(allocated.targetCredentialRevision))\n .where(\n and(\n eq(a.subjectId, current.nativeSubjectId),\n eq(a.credentialId, targetCredentialId),\n eq(a.revision, oldRevision),\n ),\n );\n }\n yield* database\n .update(mapping.subject.table)\n .set(updateValues([[mapping.subject.securityRevision, allocated.nextSecurityRevision]]))\n .where(\n and(\n eq(s.id, current.nativeSubjectId),\n eq(s.securityRevision, input.captured.revision.securityRevision),\n ),\n );\n yield* database.insert(mapping.command.table).values(\n mapping.command.encodeInsert({\n moduleId: input.moduleId,\n commandId: input.commandId,\n action,\n bindingDigest: input.authorization.challenge.bindingDigest,\n retentionUntilMillis: now + mapping.commandRetentionMillis,\n }),\n );\n\n const sourceStillActive =\n action === \"verify-address\"\n ? []\n : yield* selectRows(\n database\n .select()\n .from(mapping.credential.table)\n .where(\n and(\n eq(c.moduleId, input.moduleId),\n eq(c.credentialId, current.source!.snapshot.credentialId),\n eq(c.subjectId, current.nativeSubjectId),\n ),\n ),\n false,\n );\n\n const target = (yield* emailLookupRows(mapping, input.moduleId, input.target))[0];\n\n const targetAuthority = yield* selectRows(\n database\n .select()\n .from(mapping.authorityCredential.table)\n .where(\n and(eq(a.subjectId, current.nativeSubjectId), eq(a.credentialId, targetCredentialId)),\n )\n .limit(1),\n false,\n );\n\n const command = yield* selectRows(\n database\n .select()\n .from(mapping.command.table)\n .where(\n and(\n eq(commandColumns(mapping).moduleId, input.moduleId),\n eq(commandColumns(mapping).commandId, input.commandId),\n eq(commandColumns(mapping).action, action),\n eq(commandColumns(mapping).bindingDigest, input.authorization.challenge.bindingDigest),\n eq(\n commandColumns(mapping).retentionUntil,\n mapping.encodeInstant(now + mapping.commandRetentionMillis),\n ),\n ),\n )\n .limit(1),\n false,\n );\n\n const targetVerifiedAt =\n target === undefined\n ? undefined\n : yield* mapping.decodeInstant(target.identifier[mapping.identifier.verifiedAt]);\n\n const sourceIdentifier =\n action === \"verify-address\"\n ? []\n : yield* identifierRow(mapping, current.source!.snapshot.identifier, false);\n\n const sourceAuthority =\n action === \"verify-address\"\n ? []\n : yield* selectRows(\n database\n .select()\n .from(mapping.authorityCredential.table)\n .where(\n and(\n eq(a.subjectId, current.nativeSubjectId),\n eq(a.credentialId, current.source!.snapshot.credentialId),\n ),\n )\n .limit(1),\n false,\n );\n\n return (\n target !== undefined &&\n mapping.subjectId.equals(target.subject[mapping.subject.id], current.nativeSubjectId) &&\n mapping.subject.isActiveStatus(target.subject[mapping.subject.status]) &&\n target.subject[mapping.subject.securityRevision] === allocated.nextSecurityRevision &&\n target.identifier[mapping.identifier.bindingRevision] ===\n allocated.targetIdentifierRevision &&\n targetVerifiedAt === now &&\n target.credential[mapping.credential.credentialRevision] ===\n allocated.targetCredentialRevision &&\n target.credential[mapping.credential.credentialId] === targetCredentialId &&\n mapping.subjectId.equals(\n target.credential[mapping.credential.subjectId],\n current.nativeSubjectId,\n ) &&\n mapping.identifier.isCurrent(target.identifier) &&\n mapping.credential.isActiveStatus(target.credential[mapping.credential.status]) &&\n targetAuthority.length === 1 &&\n targetAuthority[0]![mapping.authorityCredential.revision] ===\n allocated.targetCredentialRevision &&\n mapping.authorityCredential.isActiveStatus(\n targetAuthority[0]![mapping.authorityCredential.status],\n ) &&\n command.length === 1 &&\n (action === \"verify-address\" \|\|\n (sourceStillActive.length === 1 &&\n sourceStillActive[0]![mapping.credential.credentialRevision] ===\n allocated.sourceCredentialRevision &&\n !mapping.credential.isActiveStatus(sourceStillActive[0]![mapping.credential.status]) &&\n sourceIdentifier.length === 1 &&\n mapping.subjectId.equals(\n sourceIdentifier[0]![mapping.identifier.subjectId],\n current.nativeSubjectId,\n ) &&\n sourceIdentifier[0]![mapping.identifier.bindingRevision] ===\n allocated.sourceIdentifierRevision &&\n !mapping.identifier.isCurrent(sourceIdentifier[0]!) &&\n sourceAuthority.length === 1 &&\n sourceAuthority[0]![mapping.authorityCredential.revision] ===\n allocated.sourceCredentialRevision &&\n !mapping.authorityCredential.isActiveStatus(\n sourceAuthority[0]![mapping.authorityCredential.status],\n )))\n );\n });\n\n const probeProofCompletion = Effect.fn(\"Drizzle.probeProofCompletion\")(function* (\n configuration: EmailSqlConfiguration,\n input: ProofCompletionInput,\n ) {\n const database = yield* CurrentEmailSql;\n\n if (configuration.proof === undefined) return yield* Effect.fail(unavailable());\n const validProbe = { _tag: \"EmailProofCompletionValid\" } as const;\n\n const plan = {\n input,\n prepare: <A>(\n decision: ProofCompletionDecision,\n journal: CommitJournal,\n project: (decision: ProofCompletionDecision) => A,\n ) => journal.prepare(project(decision)),\n };\n\n const probe = coordinateCommit(\n () =>\n database.transaction((transaction) =>\n completeProofPlanIn(\n configuration.proof!.mapping,\n configuration.proof!.configuration,\n plan,\n Effect.fail(validProbe),\n () => false,\n ).pipe(\n Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),\n ),\n ),\n { mode: configuration.mode },\n );\n\n return yield* probe.pipe(\n Effect.as(false),\n Effect.catchCause((cause) => {\n const reason = cause.reasons[0];\n\n return cause.reasons.length === 1 &&\n reason !== undefined &&\n Cause.isFailReason(reason) &&\n reason.error === validProbe\n ? Effect.succeed(true)\n : Effect.failCause(cause);\n }),\n );\n });\n\n const prepareRejected = Effect.fn(\"Drizzle.prepareRejected\")(function* <A>(\n configuration: EmailSqlConfiguration,\n prepare: (value: \"rejected\", journal: CommitJournal) => PreparedCommit<A>,\n ) {\n const database = yield* CurrentEmailSql;\n\n return yield* owned(\n database,\n configuration,\n Effect.gen(function* () {\n const journal = yield* CurrentCommitJournal;\n\n return yield* Effect.succeed(prepare(\"rejected\", journal));\n }),\n );\n });\n\n const makeSqlEmailAddressPersistence = Effect.fn(\"makeSqlEmailAddressPersistence\")(function* (\n mapping: AddressMapping,\n configuration: EmailSqlConfiguration,\n ): Effect.fn.Return<\n EmailAddressPersistence[\"Service\"],\n EmailUnavailable,\n LifecycleHooks \| CurrentEmailSql \| NativeDatabase\n > {\n const database = yield* CurrentEmailSql;\n\n if (!configuration.coordinated)\n yield* (\n operations.validateStorage?.({\n ...mapping,\n proof: configuration.proof?.mapping,\n }) ?? Effect.void\n ).pipe(Effect.mapError(unavailable));\n const hooks = yield* LifecycleHooks;\n\n return EmailAddressPersistence.of({\n target: (input) =>\n (validAddressConstraints(mapping)\n ? safeRead(\n database,\n configuration,\n Effect.gen(function* () {\n const current = yield* currentAddress(mapping, input, configuration.locking);\n\n if (current === undefined) return yield* unavailable();\n\n return Object.freeze({\n revision: snapshotEmailRevision(current.revision),\n eligible: current.eligible,\n ...(current.targetIdentifierRevision === undefined\n ? {}\n : { targetIdentifierRevision: current.targetIdentifierRevision }),\n ...(current.source === undefined\n ? {}\n : { source: yield* snapshotEmailCredential(current.source.snapshot) }),\n });\n }),\n )\n : Effect.fail(unavailable())\n ).pipe(\n Effect.provideService(CurrentEmailSql, database),\n Effect.provideService(LifecycleHooks, hooks),\n translateFailure,\n ),\n checkCompletion: (input) => {\n if (configuration.proof === undefined \|\| input.binding._tag !== \"IdentifierChange\")\n return Effect.succeed(false).pipe(\n Effect.provideService(CurrentEmailSql, database),\n Effect.provideService(LifecycleHooks, hooks),\n translateFailure,\n );\n const binding = input.binding;\n\n return safeRead(\n database,\n configuration,\n Effect.gen(function* () {\n const action: EmailAction \| undefined =\n input.moduleId.endsWith(\"/verify-address\") &&\n input.purpose === \"email-address-verification\"\n ? \"verify-address\"\n : input.moduleId.endsWith(\"/change-address\") &&\n input.purpose === \"email-address-change\"\n ? \"change-address\"\n : undefined;\n\n if (action === undefined) return false;\n const moduleId = input.moduleId.slice(0, -`/${action}`.length);\n\n const current = yield* currentAddress(\n mapping,\n {\n moduleId,\n subjectId: binding.revision.subjectId,\n target: binding.identifier,\n },\n false,\n );\n\n return current !== undefined && sameEmailRevision(current.revision, binding.revision);\n }),\n )\n .pipe(\n Effect.flatMap((current) =>\n current ? probeProofCompletion(configuration, input) : Effect.succeed(false),\n ),\n )\n .pipe(\n Effect.provideService(CurrentEmailSql, database),\n Effect.provideService(LifecycleHooks, hooks),\n translateFailure,\n );\n },\n verifyWithProof: (uncaptured, prepare) =>\n mutateAddress(mapping, configuration, uncaptured, \"verify-address\", prepare).pipe(\n Effect.provideService(CurrentEmailSql, database),\n Effect.provideService(LifecycleHooks, hooks),\n translateFailure,\n ),\n changeWithProof: (uncaptured, prepare) =>\n mutateAddress(mapping, configuration, uncaptured, \"change-address\", prepare).pipe(\n Effect.provideService(CurrentEmailSql, database),\n Effect.provideService(LifecycleHooks, hooks),\n translateFailure,\n ),\n cleanup: (input, prepare) =>\n owned(\n database,\n configuration,\n Effect.gen(function* () {\n const transaction = yield* CurrentEmailSql;\n const journal = yield* CurrentCommitJournal;\n\n const c = commandColumns(mapping);\n const now = yield* nowMillis;\n\n const rows = yield* selectRows(\n transaction\n .select({ commandId: c.commandId })\n .from(mapping.command.table)\n .where(\n and(\n eq(c.moduleId, input.moduleId),\n lte(c.retentionUntil, mapping.encodeInstant(now)),\n ),\n )\n .limit(input.limit + 1),\n configuration.locking,\n );\n\n const selected = rows.slice(0, input.limit);\n\n const receipt = prepare(\n { removed: selected.length, hasMore: rows.length > input.limit },\n journal,\n );\n\n if (selected.length > 0)\n yield* transaction.delete(mapping.command.table).where(\n and(\n eq(c.moduleId, input.moduleId),\n inArray(\n c.commandId,\n selected.map((row: any) => row.commandId),\n ),\n lte(c.retentionUntil, mapping.encodeInstant(now)),\n ),\n );\n\n return receipt;\n }),\n ).pipe(\n Effect.provideService(CurrentEmailSql, database),\n Effect.provideService(LifecycleHooks, hooks),\n translateFailure,\n ),\n });\n });\n\n const mutateAddress = Effect.fn(\"Drizzle.mutateAddress\")(function* <A>(\n mapping: AddressMapping,\n configuration: EmailSqlConfiguration,\n uncaptured: EmailAddressMutation,\n action: EmailAction,\n prepare: (value: \"changed\" \| \"rejected\", journal: CommitJournal) => PreparedCommit<A>,\n ) {\n const database = yield* CurrentEmailSql;\n\n if (!validAddressConstraints(mapping) \|\| configuration.proof === undefined)\n return yield* unavailable();\n const input = yield* snapshotEmailMutation(uncaptured);\n\n const targetCredentialId = yield* allocate(\n configuration.mode,\n mapping.allocateCredentialId,\n mapping.allocateCredentialIdSync,\n );\n\n const targetIdentifierRevision = yield* allocate(\n configuration.mode,\n mapping.allocateRevision,\n mapping.allocateRevisionSync,\n );\n\n const targetCredentialRevision = yield* allocate(\n configuration.mode,\n mapping.allocateRevision,\n mapping.allocateRevisionSync,\n );\n\n const sourceIdentifierRevision = yield* allocate(\n configuration.mode,\n mapping.allocateRevision,\n mapping.allocateRevisionSync,\n );\n\n const sourceCredentialRevision = yield* allocate(\n configuration.mode,\n mapping.allocateRevision,\n mapping.allocateRevisionSync,\n );\n\n const confirmsExisting =\n action === \"verify-address\" && input.captured.targetIdentifierRevision !== undefined;\n\n const nextRevision = confirmsExisting\n ? input.captured.revision.securityRevision\n : yield* nextSecurityRevision(\n mapping,\n configuration.mode,\n input.captured.revision.securityRevision,\n );\n\n if (\n (!confirmsExisting && nextRevision === input.captured.revision.securityRevision) \|\|\n [\n targetIdentifierRevision,\n targetCredentialRevision,\n sourceIdentifierRevision,\n sourceCredentialRevision,\n ].some((value) => input.captured.revision.credentials.some((item) => item.revision === value))\n )\n return yield* unavailable();\n\n const run = owned(\n database,\n configuration,\n Effect.gen(function* () {\n const journal = yield* CurrentCommitJournal;\n\n const current = yield* validateEmailAuthority(mapping, configuration, input, action);\n\n if (current === undefined) return prepare(\"rejected\", journal);\n if (\n (yield* commandExists(mapping, input.moduleId, input.commandId, configuration.locking))\n .length > 0\n )\n return prepare(\"rejected\", journal);\n let receipt: PreparedCommit<A> \| undefined;\n\n yield* completeProofPlanIn(\n configuration.proof!.mapping,\n configuration.proof!.configuration,\n input.completion,\n Effect.gen(function* () {\n // The proof helper may wait on continuation/series locks. Read the\n // commit clock and reassess both policies only after those locks.\n const currentRequirement = yield* mapping.subject.decodeActionRequirement(\n current.subject,\n action,\n );\n\n const original = yield* assessAuthentication(\n input.authorization.evidence,\n input.authorization.requirement,\n ).pipe(Effect.mapError(unavailable));\n\n const configured = yield* assessAuthentication(\n input.authorization.evidence,\n currentRequirement,\n ).pipe(Effect.mapError(unavailable));\n\n if (!original.satisfied \|\| !configured.satisfied) return false;\n const now = yield* nowMillis;\n\n return yield* applyMutation(\n mapping,\n input,\n action,\n current,\n {\n targetCredentialId,\n targetIdentifierRevision,\n targetCredentialRevision,\n sourceIdentifierRevision,\n sourceCredentialRevision,\n nextSecurityRevision: nextRevision,\n },\n now,\n );\n }),\n (decision) => {\n receipt = prepare(decision === \"completed\" ? \"changed\" : \"rejected\", journal);\n\n return decision;\n },\n );\n\n return receipt ?? prepare(\"rejected\", journal);\n }),\n );\n\n return yield* run.pipe(\n Effect.catchCause((cause) =>\n (cause.reasons.every(Cause.isFailReason) &&\n isMappedConstraintConflict(mapping.isCommandConflict, cause)) \|\|\n (cause.reasons.every(Cause.isFailReason) &&\n isMappedConstraintConflict(mapping.isIdentifierConflict, cause)) \|\|\n (cause.reasons.every(Cause.isFailReason) &&\n isMappedConstraintConflict(mapping.isCredentialConflict, cause))\n ? prepareRejected(configuration, prepare)\n : Effect.failCause(cause),\n ),\n );\n });\n\n return {\n validEmailSignInConstraints,\n emailLookupQuery,\n decodeEmailSnapshot,\n makeSqlEmailSignInTargets,\n currentAddress,\n sameEmailRevision,\n snapshotEmailMutation,\n validateEmailAuthority,\n makeSqlEmailAddressPersistence,\n };\n};\n"],"mappings":";;;;;;;;;;AAmFA,IAAa,kBAAb,cAAqC,QAAQ,QAA2C,CAAC,CACvF,6BACF,CAAC,CAAC,CAAC;AA4BH,MAAa,mBAIX,YACA,WACG;CAGH,MAAM,EAAE,KAAK,IAAI,SAAS,KAAK,QAAQ,iBAAiB;CACxD,MAAM,EAAE,wBAAwB;CAChC,MAAM,oBAAoB,iBAAiB,KAAK,CAAC,CAAC;CAElD,MAAM,oBACJ,WAEA,yBACE,SACC,UACC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,sBAAsB,CAAC,CAAC,KAAK,CAC3C,CAAC,CAAC,KAAK,OAAO,YAAY,UAAU,OAAO,UAAU,MAAM,IAAI,aAAa,YAAY,CAAC,CAAC,CAAC,CAAC;CAE9F,MAAM,YAAY,OAAO,IAAI,SAAS,KAAK,SAAS,aAAa;CAEjE,MAAM,cAAc,OAAsB,YACxC,WAAW,OAAO,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,IAAI;CAErE,MAAM,kBAAkB,MAAuB,UAC7C,KAAK,cAAc,MAAM,aAAa,KAAK,UAAU,MAAM;CAE7D,MAAM,+BAA+B,YACnC,OAAO,QAAQ,8BAA8B,CAAC,CAAC,OAC5C,CAAC,KAAK,WACL,QAAQ,YAAY,SAAwD,KAChF;CAEF,MAAM,2BAA2B,YAC/B,OAAO,QAAQ,+BAA+B,CAAC,CAAC,OAC7C,CAAC,KAAK,WACL,QAAQ,YAAY,SAAyD,KACjF;CAEF,MAAM,kBAAkB,aAA4B;EAClD,IAAI,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,EAAE;EACpD,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;EAC5D,kBAAkB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,gBAAgB;CAClF;CAEA,MAAM,qBAAqB,aAA4B;EACrD,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;EACxE,OAAO,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,KAAK;EAChE,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;EACxE,YAAY,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,UAAU;EAC1E,iBAAiB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,eAAe;CACtF;CAEA,MAAM,qBAAqB,aAA4B;EACrD,UAAU,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,QAAQ;EACtE,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;EACxE,cAAc,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,YAAY;EAC9E,qBAAqB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,mBAAmB;EAC5F,iBAAiB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,eAAe;EACpF,oBAAoB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,kBAAkB;EAC1F,QAAQ,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,MAAM;CACpE;CAEA,MAAM,oBAAoB,aAA6B;EACrD,WAAW,OAAO,QAAQ,oBAAoB,OAAO,QAAQ,oBAAoB,SAAS;EAC1F,cAAc,OACZ,QAAQ,oBAAoB,OAC5B,QAAQ,oBAAoB,YAC9B;EACA,UAAU,OAAO,QAAQ,oBAAoB,OAAO,QAAQ,oBAAoB,QAAQ;EACxF,QAAQ,OAAO,QAAQ,oBAAoB,OAAO,QAAQ,oBAAoB,MAAM;CACtF;CAEA,MAAM,kBAAkB,aAA6B;EACnD,UAAU,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,QAAQ;EAChE,WAAW,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,SAAS;EAClE,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;EAC5D,eAAe,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,aAAa;EAC1E,gBAAgB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,cAAc;CAC9E;CAEA,MAAM,YACJ,MACA,cACA,gBACG;EACH,IAAI,SAAS,eACX,OAAO,gBAAgB,KAAA,IACnB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;GACT,KAAK;GACL,QAAQ,UAAU,IAAI,wBAAwB;IAAE,WAAW;IAAW;GAAM,CAAC;EAC/E,CAAC;EACP,IAAI,iBAAiB,KAAA,GAAW,OAAO;EAEvC,OAAO,gBAAgB,KAAA,IACnB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;GACT,KAAK;GACL,QAAQ,UAAU,IAAI,wBAAwB;IAAE,WAAW;IAAW;GAAM,CAAC;EAC/E,CAAC;CACP;CAEA,MAAM,wBACJ,SACA,MACA,YACG;EACH,IAAI,SAAS,eACX,OAAO,QAAQ,QAAQ,6BAA6B,KAAA,IAChD,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;GACT,WAAW,QAAQ,QAAQ,yBAA0B,OAAO;GAC5D,QAAQ,UAAU,IAAI,wBAAwB;IAAE,WAAW;IAAW;GAAM,CAAC;EAC/E,CAAC;EACP,IAAI,QAAQ,QAAQ,yBAAyB,KAAA,GAC3C,OAAO,QAAQ,QAAQ,qBAAqB,OAAO;EACrD,IAAI,QAAQ,QAAQ,6BAA6B,KAAA,GAC/C,OAAO,OAAO,IAAI;GAChB,WAAW,QAAQ,QAAQ,yBAA0B,OAAO;GAC5D,QAAQ,UAAU,IAAI,wBAAwB;IAAE,WAAW;IAAW;GAAM,CAAC;EAC/E,CAAC;EAEH,OAAO,OAAO,KAAK,YAAY,CAAC;CAClC;CAEA,MAAM,YACJ,UACA,eACA,SAEA,OAAO,IAAI,aAAa;EACtB,IAAI,cAAc,gBAAgB,MAAM;GACtC,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;GACrD,OAAO,cAAc;EACvB;EAEA,OAAO,OAAO,SAAS,aAAa,gBAClC,KAAK,KACH,OAAO,eAAe,iBAAiB,WAAW,GAClD,OAAO,eAAe,iBAAiB,WAA0C,CACnF,CACF;CACF,CAAC;CAEH,MAAM,SACJ,UACA,eACA,SACG;EACH,MAAM,MAAM,uBAER,SAAS,aAAa,gBACpB,KAAK,KACH,OAAO,eAAe,iBAAiB,WAAW,GAClD,OAAO,eAAe,iBAAiB,WAA0C,CACnF,CACF,GACF,EAAE,MAAM,cAAc,KAAK,CAC7B,CAAC,CAAC,KAAK,OAAO,KAAK,WAAW,OAAO,KAAK,CAAC;EAE3C,OAAO,cAAc,gBAAgB,OACjC,OAAO,IAAI,aAAa;GACtB,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;GACrD,OAAO,cAAc;GAErB,OAAO,OAAO;EAChB,CAAC,IACD;CACN;CAEA,MAAM,oBACJ,SACA,UACA,eACG;EACH,MAAM,UAAU,eAAe,OAAO,GACpC,UAAU,kBAAkB,OAAO,GACnC,aAAa,kBAAkB,OAAO;EAExC,OAAO;GACL,QAAQ;IACN,SAAS,QAAQ,QAAQ;IACzB,YAAY,QAAQ,WAAW;IAC/B,YAAY,QAAQ,WAAW;GACjC;GACA,MAAM,QAAQ,WAAW;GACzB,cAAc,QAAQ,QAAQ;GAC9B,aAAa,GAAG,QAAQ,IAAI,QAAQ,SAAS;GAC7C,iBAAiB,QAAQ,WAAW;GACpC,gBAAgB,IACd,GAAG,WAAW,UAAU,QAAQ,GAChC,GAAG,WAAW,WAAW,QAAQ,SAAS,GAC1C,GAAG,WAAW,qBAAqB,QAAQ,SAAS,GACpD,GAAG,WAAW,iBAAiB,QAAQ,KAAK,CAC9C;GACA,WAAW,IACT,GAAG,QAAQ,WAAW,WAAW,SAAS,GAC1C,GAAG,QAAQ,OAAO,WAAW,KAAK,CACpC;GACA,OAAO;EACT;CACF;CAEA,MAAM,kBAAkB,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,SACA,UACA,YACA;EACA,MAAM,WAAW,OAAO;EACxB,MAAM,QAAQ,iBAAiB,SAAS,UAAU,UAAU;EAE5D,OAAO,OAAO,SACX,OAAO,MAAM,MAAM,CAAC,CACpB,KAAK,MAAM,IAAI,CAAC,CAChB,UAAU,MAAM,cAAc,MAAM,WAAW,CAAC,CAChD,UAAU,MAAM,iBAAiB,MAAM,cAAc,CAAC,CACtD,MAAM,MAAM,SAAS,CAAC,CACtB,MAAM,MAAM,KAAK;CACtB,CAAC;CAED,MAAM,sBAAsB,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACnE,SACA,UACA,WACA,KACA;EACA,IACE,CAAC,QAAQ,QAAQ,eAAe,IAAI,QAAQ,QAAQ,QAAQ,OAAO,KACnE,CAAC,QAAQ,WAAW,UAAU,IAAI,UAAU,KAC5C,CAAC,QAAQ,WAAW,eAAe,IAAI,WAAW,QAAQ,WAAW,OAAO,GAE5E,OAAO,KAAA;EAET,MAAM,WAAW,OAAO,QAAQ,WAC7B,OAAO;GACN;GACA,SAAS,IAAI;GACb,YAAY,IAAI;GAChB,YAAY,IAAI;EAClB,CAAC,CAAC,CACD,KAAK,OAAO,QAAQ,uBAAuB,CAAC;EAE/C,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,IAAI,QAAQ,QAAQ,QAAQ,GAAG;EAEpF,MAAM,mBAAmB,OAAO,QAAQ,cACtC,IAAI,WAAW,QAAQ,WAAW,WACpC;EAEA,IACE,SAAS,aAAa,YACtB,CAAC,eAAe,SAAS,YAAY,SAAS,KAC9C,SAAS,SAAS,cAAc,aAChC,SAAS,SAAS,qBAAqB,IAAI,QAAQ,QAAQ,QAAQ,qBACnE,SAAS,uBAAuB,IAAI,WAAW,QAAQ,WAAW,oBAClE,SAAS,qBAAqB,oBAC9B,SAAS,iBAAiB,IAAI,WAAW,QAAQ,WAAW,iBAC5D,SAAS,uBAAuB,IAAI,WAAW,QAAQ,WAAW,qBAElE,OAAO,KAAA;EAET,OAAO;CACT,CAAC;CAED,MAAM,4BAA4B,OAAO,GAAG,2BAA2B,CAAC,CAAC,WACvE,SACA,eAKA;EACA,MAAM,WAAW,OAAO;EAExB,IAAI,CAAC,cAAc,aACjB,QACE,WAAW,kBAAkB;GAC3B,GAAG;GACH,OAAO,cAAc,OAAO;EAC9B,CAAC,KAAK,OAAO,KAAA,CACb,KAAK,OAAO,SAAS,WAAW,CAAC;EAErC,OAAO,mBAAmB,GAAG,EAC3B,SAAS,WACN,4BAA4B,OAAO,IAChC,SACE,UACA,eACA,OAAO,IAAI,aAAa;GACtB,MAAM,OAAO,OAAO,gBAAgB,SAAS,MAAM,UAAU,MAAM,UAAU,EAAA,CAAG;GAEhF,IAAI,QAAQ,KAAA,GAAW,OAAO,OAAO,KAAK;GAE1C,MAAM,WAAW,OAAO,oBACtB,SACA,MAAM,UACN,MAAM,YACN,GACF;GAEA,OAAO,aAAa,KAAA,IAAY,OAAO,KAAK,IAAI,OAAO,KAAK,QAAQ;EACtE,CAAC,CACH,IACA,OAAO,KAAK,YAAY,CAAC,EAAA,CAC3B,KAAK,OAAO,eAAe,iBAAiB,QAAQ,GAAG,gBAAgB,EAC7E,CAAC;CACH,CAAC;CAED,MAAM,cAAc,OAAO,GAAG,0BAA0B,CAAC,CAAC,WACxD,SACA,WACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,SAAgB;EAC1E,MAAM,IAAI,eAAe,OAAO;EAOhC,OAAO;GAAE;GAAiB,UALT,OAAO,WACtB,SAAS,OAAO,CAAC,CAAC,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAAC,MAAM,GAAG,EAAE,IAAI,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,GACtF,OACF,EAAA,CAAG;EAE+B;CACpC,CAAC;CAED,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,YACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EAEnC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,IAAI,GAAG,EAAE,WAAW,WAAW,SAAS,GAAG,GAAG,EAAE,OAAO,WAAW,KAAK,CAAC,CAAC,CAAC,CAChF,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,iBAAiB,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,UACA,cACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EAEnC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,IAAI,GAAG,EAAE,UAAU,QAAQ,GAAG,GAAG,EAAE,cAAc,YAAY,CAAC,CAAC,CAAC,CACtE,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,yBAAyB,OAAO,GAAG,gCAAgC,CAAC,CAAC,WACzE,SACA,UACA,YACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EAEnC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MACC,IACE,GAAG,EAAE,UAAU,QAAQ,GACvB,GAAG,EAAE,qBAAqB,WAAW,SAAS,GAC9C,GAAG,EAAE,iBAAiB,WAAW,KAAK,CACxC,CACF,CAAC,CACA,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,iBAAiB,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAC9D,SACA,OAMA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,SAAS,OAAO,YAAY,SAAS,MAAM,WAAW,OAAO;EAEnE,IACE,OAAO,YAAY,KAAA,KACnB,CAAC,QAAQ,QAAQ,eAAe,OAAO,QAAQ,QAAQ,QAAQ,OAAO,GAEtE,OAAO,KAAA;EAET,MAAM,mBACJ,MAAM,uBAAuB,KAAA,IACzB,KAAA,KACC,OAAO,eAAe,SAAS,MAAM,UAAU,MAAM,oBAAoB,KAAK,EAAA,CAAG;EAExF,MAAM,mBACJ,qBAAqB,KAAA,IACjB,KAAA,IACA;GACE,WAAW,iBAAiB,QAAQ,WAAW;GAC/C,OAAO,iBAAiB,QAAQ,WAAW;EAC7C;EAEN,MAAM,cAAc,CAClB,MAAM,QACN,GAAI,qBAAqB,KAAA,IAAY,CAAC,IAAI,CAAC,gBAAgB,CAC7D,CAAC,CACE,QACE,OAAO,OAAO,WACb,OAAO,WAAW,cAAc,eAAe,WAAW,KAAK,CAAC,MAAM,KAC1E,CAAC,CACA,MAAM,MAAM,UACX,GAAG,KAAK,UAAU,QAAQ,KAAK,QAAQ,cACrC,GAAG,MAAM,UAAU,QAAQ,MAAM,OACnC,CACF;EAEF,MAAM,oCAAoB,IAAI,IAAiB;EAE/C,KAAK,MAAM,cAAc,aAAa;GACpC,MAAM,OAAO,OAAO,cAAc,SAAS,YAAY,OAAO,EAAA,CAAG;GAEjE,IAAI,QAAQ,KAAA,GACV,kBAAkB,IAAI,GAAG,WAAW,UAAU,QAAQ,WAAW,SAAS,GAAG;EACjF;EAEA,MAAM,mBACJ,MAAM,uBAAuB,KAAA,IACzB,KAAA,KACC,OAAO,eAAe,SAAS,MAAM,UAAU,MAAM,oBAAoB,OAAO,EAAA,CAAG;EAE1F,MAAM,oBAAoB,OAAO,uBAC/B,SACA,MAAM,UACN,MAAM,QACN,OACF,EAAA,CAAG;EAEH,MAAM,IAAI,iBAAiB,OAAO;EAWlC,MAAM,mBAAkB,OATC,WACvB,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,oBAAoB,KAAK,CAAC,CACvC,MAAM,GAAG,EAAE,WAAW,OAAO,eAAe,CAAC,CAAC,CAC9C,QAAQ,EAAE,YAAY,GACzB,OACF,EAAA,CAEkC,QAAQ,QACxC,QAAQ,oBAAoB,eAAe,IAAI,QAAQ,oBAAoB,OAAO,CACpF;EAEA,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,OAAO,eAAe;EAE3E,MAAM,WAAmC,OAAO,OAAO;GACrD;GACA,kBAAkB,OAAO,QAAQ,QAAQ,QAAQ;GACjD,aAAa,OAAO,OAClB,gBAAgB,KAAK,QACnB,OAAO,OAAO;IACZ,cAAc,IAAI,QAAQ,oBAAoB;IAC9C,UAAU,IAAI,QAAQ,oBAAoB;GAC5C,CAAC,CACH,CACF;EACF,CAAC;EAED,MAAM,mBAAmB,kBAAkB,IACzC,GAAG,MAAM,OAAO,UAAU,QAAQ,MAAM,OAAO,OACjD;EASA,MAAM,gBANJ,qBAAqB,KAAA,KACrB,QAAQ,UAAU,OAChB,iBAAiB,QAAQ,WAAW,YACpC,OAAO,eACT,KAIA,QAAQ,WAAW,gBAAgB,gBAAgB,MAClD,qBAAqB,KAAA,KACnB,CAAC,QAAQ,WAAW,eAAe,iBAAiB,QAAQ,WAAW,OAAO,KAC7E,QAAQ,UAAU,OAChB,iBAAiB,QAAQ,WAAW,YACpC,OAAO,eACT;EAEN,IAAI;EAEJ,IAAI,MAAM,uBAAuB,KAAA,GAAW;GAC1C,IACE,qBAAqB,KAAA,KACrB,qBAAqB,KAAA,KACrB,CAAC,QAAQ,UAAU,OACjB,iBAAiB,QAAQ,WAAW,YACpC,OAAO,eACT,KACA,CAAC,QAAQ,WAAW,eAAe,iBAAiB,QAAQ,WAAW,OAAO,GAE9E,OAAO,KAAA;GAET,MAAM,sBAAsB,kBAAkB,IAC5C,GAAG,iBAAiB,UAAU,QAAQ,iBAAiB,OACzD;GAEA,IACE,wBAAwB,KAAA,KACxB,CAAC,QAAQ,WAAW,UAAU,mBAAmB,KACjD,CAAC,QAAQ,UAAU,OACjB,oBAAoB,QAAQ,WAAW,YACvC,OAAO,eACT,GAEA,OAAO,KAAA;GAWT,SAAS;IAAE,YAAY;IAAkB,YAAY;IAAqB,UAAA,OATlD,QAAQ,WAC7B,OAAO;KACN,UAAU,MAAM;KAChB,SAAS,OAAO;KAChB,YAAY;KACZ,YAAY;IACd,CAAC,CAAC,CACD,KAAK,OAAO,QAAQ,uBAAuB,CAAC;GAEoC;EACrF;EACA,IAAI,WAAW,qBAAqB,KAAA,IAAY,qBAAqB,KAAA,IAAY;EAEjF,IAAI,MAAM,uBAAuB,KAAA,KAAa,WAAW,KAAA,GAAW,WAAW;EAC/E,IAAI,WAAW,KAAA,KAAa,eAAe,OAAO,SAAS,YAAY,MAAM,MAAM,GACjF,WAAW;EACb,IAAI,QAAQ,uBAAuB,YAAY,MAAM,uBAAuB,KAAA,GAAW;GACrF,MAAM,IAAI,kBAAkB,OAAO;GAUnC,KACE,OATkB,WAClB,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,WAAW,OAAO,eAAe,CAAC,CAAC,GACrF,OACF,EAAA,CAGO,MAAM,QAAa,QAAQ,WAAW,eAAe,IAAI,QAAQ,WAAW,OAAO,CAAC,GAEzF,WAAW;EACf;EAEA,OAAO;GACL,iBAAiB,OAAO;GACxB,SAAS,OAAO;GAChB;GACA,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO;GACzC,GAAI,qBAAqB,KAAA,IAAY,CAAC,IAAI,EAAE,iBAAiB;GAC7D,GAAI,qBAAqB,KAAA,IAAY,CAAC,IAAI,EAAE,iBAAiB;GAC7D,GAAI,gBACA,EAAE,0BAA0B,iBAAiB,QAAQ,WAAW,iBAAiB,IACjF,CAAC;GACL;EACF;CACF,CAAC;CAED,MAAM,qBAAqB,MAA8B,UAAkC;EACzF,IACE,KAAK,cAAc,MAAM,aACzB,KAAK,qBAAqB,MAAM,oBAChC,KAAK,YAAY,WAAW,MAAM,YAAY,QAE9C,OAAO;EAET,MAAM,WAAW,CAAC,GAAG,KAAK,WAAW,CAAC,CAAC,MAAM,GAAG,MAC9C,EAAE,aAAa,cAAc,EAAE,YAAY,CAC7C;EAEA,MAAM,SAAS,CAAC,GAAG,MAAM,WAAW,CAAC,CAAC,MAAM,GAAG,MAC7C,EAAE,aAAa,cAAc,EAAE,YAAY,CAC7C;EAEA,OAAO,SAAS,OACb,MAAM,UACL,KAAK,iBAAiB,OAAO,MAAM,CAAE,gBACrC,KAAK,aAAa,OAAO,MAAM,CAAE,QACrC;CACF;CAEA,MAAM,gBAAgB,UAAkB,WACtC,GAAG,SAAS,GAAG,WAAW,mBAAmB,mBAAmB;CAElE,MAAM,iBAAiB,WACrB,WAAW,mBAAmB,+BAA+B;CAE/D,MAAM,qBAAqB,OAA6B,WAAwB;EAC9E,MAAM,aAAa,MAAM,WAAW;EACpC,MAAM,UAAU,WAAW;EAE3B,OACE,WAAW,aAAa,aAAa,MAAM,UAAU,MAAM,KAC3D,WAAW,YAAY,cAAc,MAAM,KAC3C,QAAQ,SAAS,sBACjB,eAAe,QAAQ,YAAY,MAAM,MAAM,KAC/C,kBAAkB,QAAQ,UAAU,MAAM,SAAS,QAAQ;CAE/D;CAEA,MAAM,wBAAwB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WACvE,OACA;EACA,MAAM,WAAW,OAAO,+BAA+B,MAAM,cAAc,QAAQ,CAAC,CAAC,KACnF,OAAO,SAAS,WAAW,CAC7B;EAEA,MAAM,cAAc,OAAO,yBAAyB,MAAM,cAAc,WAAW;EAEnF,MAAM,SACJ,MAAM,SAAS,WAAW,KAAA,IACtB,KAAA,IACA,OAAO,wBAAwB,MAAM,SAAS,MAAM;EAE1D,OAAO,OAAO,OAAO;GACnB,GAAG;GACH,QAAQ,OAAO,OAAO,EAAE,GAAG,MAAM,OAAO,CAAC;GACzC,GAAI,MAAM,iBAAiB,KAAA,IACvB,CAAC,IACD,EAAE,cAAc,OAAO,OAAO,EAAE,GAAG,MAAM,aAAa,CAAC,EAAE;GAC7D,UAAU,OAAO,OAAO;IACtB,UAAU,MAAM,SAAS;IACzB,UAAU,sBAAsB,MAAM,SAAS,QAAQ;IACvD,GAAI,MAAM,SAAS,6BAA6B,KAAA,IAC5C,CAAC,IACD,EAAE,0BAA0B,MAAM,SAAS,yBAAyB;IACxE,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO;GAC3C,CAAC;GACD,eAAe,OAAO,OAAO;IAC3B,WAAW,OAAO,OAAO;KACvB,GAAG,MAAM,cAAc;KACvB,QAAQ,OAAO,OAAO,EAAE,GAAG,MAAM,cAAc,UAAU,OAAO,CAAC;KACjE,UAAU,sBAAsB,MAAM,cAAc,UAAU,QAAQ;IACxE,CAAC;IACD;IACA;GACF,CAAC;EACH,CAAC;CACH,CAAC;CAED,MAAM,yBAAyB,OAAO,GAAG,gCAAgC,CAAC,CAAC,WACzE,SACA,eACA,OACA,QACA;EACA,MAAM,mBACJ,WAAW,oBAAoB,MAAM,SAAS,6BAA6B,KAAA;EAE7E,IACE,CAAC,MAAM,SAAS,YAChB,CAAC,kBAAkB,OAAO,MAAM,KAChC,MAAM,cAAc,UAAU,aAAa,MAAM,YACjD,MAAM,cAAc,UAAU,WAAW,UACzC,MAAM,cAAc,UAAU,cAAc,MAAM,aAClD,CAAC,eAAe,MAAM,cAAc,UAAU,QAAQ,MAAM,MAAM,KAClE,MAAM,cAAc,UAAU,uBAAuB,MAAM,SAAS,QAAQ,gBAC5E,CAAC,kBAAkB,MAAM,cAAc,UAAU,UAAU,MAAM,SAAS,QAAQ,KAClF,MAAM,cAAc,UAAU,6BAC5B,MAAM,SAAS,4BAChB,MAAM,cAAc,SAAS,WAAuB,MAAM,aAC3D,MAAM,cAAc,SAAS,kBAAkB,MAAM,cAAc,UAAU,iBAC7E,CAAC,kBAAkB,MAAM,cAAc,SAAS,UAAU,MAAM,SAAS,QAAQ,KAChF,WAAW,oBAAoB,MAAM,SAAS,WAAW,KAAA,KACzD,WAAW,oBAAoB,MAAM,SAAS,WAAW,KAAA,KAC1D,sBAAsB,MAAM,iBAAiB,KAAA,MAC5C,MAAM,cAAc,qBAAqB,eACxC,QAAQ,wBAAwB,4BAElC,OAAO,KAAA;EAET,MAAM,UAAU,OAAO,eACrB,SACA;GACE,UAAU,MAAM;GAChB,WAAW,MAAM,SAAS,SAAS;GACnC,QAAQ,MAAM;GACd,GAAI,MAAM,SAAS,WAAW,KAAA,IAC1B,CAAC,IACD,EAAE,oBAAoB,MAAM,SAAS,OAAO,aAAa;EAC/D,GACA,cAAc,OAChB;EAEA,IACE,YAAY,KAAA,KACZ,CAAC,QAAQ,YACT,CAAC,kBAAkB,QAAQ,UAAU,MAAM,SAAS,QAAQ,KAC5D,QAAQ,6BAA6B,MAAM,SAAS,4BACnD,MAAM,SAAS,WAAW,KAAA,MACxB,QAAQ,WAAW,KAAA,KAClB,QAAQ,OAAO,SAAS,uBAAuB,MAAM,SAAS,OAAO,sBACrE,QAAQ,OAAO,SAAS,uBAAuB,MAAM,SAAS,OAAO,sBACrE,CAAC,eAAe,QAAQ,OAAO,SAAS,YAAY,MAAM,SAAS,OAAO,UAAU,IAExF,OAAO,KAAA;EAET,MAAM,qBAAqB,OAAO,QAAQ,QAAQ,wBAChD,QAAQ,SACR,MACF;EAEA,MAAM,WAAW,OAAO,qBACtB,MAAM,cAAc,UACpB,MAAM,cAAc,WACtB,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;EAEnC,MAAM,aAAa,OAAO,qBACxB,MAAM,cAAc,UACpB,kBACF,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;EAEnC,OAAO,SAAS,aAAa,WAAW,YAAY,UAAU,KAAA;CAChE,CAAC;CAED,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,UACA,WACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,eAAe,OAAO;EAEhC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,IAAI,GAAG,EAAE,UAAU,QAAQ,GAAG,GAAG,EAAE,WAAW,SAAS,CAAC,CAAC,CAAC,CAChE,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,gBAAgB,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAC5D,SACA,OACA,QACA,SACA,WAQA,KACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EACnC,MAAM,IAAI,kBAAkB,OAAO;EACnC,MAAM,IAAI,iBAAiB,OAAO;EAClC,MAAM,IAAI,eAAe,OAAO;EAEhC,MAAM,qBACJ,QAAQ,mBAAmB,QAAQ,WAAW,iBAAiB,UAAU;EAE3E,IAAI,WAAW,kBAAkB;GAC/B,MAAM,SAAS,QAAQ;GAEvB,OAAO,SACJ,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,IACC,QAAQ,WAAW,iBAAiB;IAClC,QAAQ,OAAO,SAAS;IACxB,iBAAiB,UAAU;GAC7B,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,EAAE,WAAW,OAAO,SAAS,WAAW,SAAS,GACpD,GAAG,EAAE,OAAO,OAAO,SAAS,WAAW,KAAK,GAC5C,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,iBAAiB,OAAO,SAAS,kBAAkB,CAC1D,CACF;GACF,OAAO,SACJ,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,IACC,QAAQ,WAAW,iBAAiB;IAClC,QAAQ,OAAO,SAAS;IACxB,oBAAoB,UAAU;GAChC,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,cAAc,OAAO,SAAS,YAAY,GAC/C,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,oBAAoB,OAAO,SAAS,kBAAkB,CAC7D,CACF;GACF,OAAO,SACJ,OAAO,QAAQ,oBAAoB,KAAK,CAAC,CACzC,IAAI,QAAQ,oBAAoB,iBAAiB,UAAU,wBAAwB,CAAC,CAAC,CACrF,MACC,IACE,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,cAAc,OAAO,SAAS,YAAY,GAC/C,GAAG,EAAE,UAAU,OAAO,SAAS,kBAAkB,CACnD,CACF;EACJ;EACA,IAAI,QAAQ,qBAAqB,KAAA,GAC/B,OAAO,SAAS,OAAO,QAAQ,WAAW,KAAK,CAAC,CAAC,OAC/C,QAAQ,WAAW,qBAAqB;GACtC,YAAY,MAAM;GAClB,WAAW,QAAQ;GACnB,kBAAkB;GAClB,iBAAiB,UAAU;EAC7B,CAAC,CACH;OAEA,OAAO,SACJ,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,IACC,QAAQ,WAAW,mBAAmB;GACpC,kBAAkB;GAClB,iBAAiB,UAAU;EAC7B,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,EAAE,WAAW,MAAM,OAAO,SAAS,GACtC,GAAG,EAAE,OAAO,MAAM,OAAO,KAAK,GAC9B,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,iBAAiB,QAAQ,iBAAkB,QAAQ,WAAW,gBAAgB,CACrF,CACF;EAEJ,IAAI,QAAQ,qBAAqB,KAAA,GAAW;GAC1C,OAAO,SAAS,OAAO,QAAQ,WAAW,KAAK,CAAC,CAAC,OAC/C,QAAQ,WAAW,qBAAqB;IACtC,UAAU,MAAM;IAChB,WAAW,QAAQ;IACnB,cAAc;IACd,YAAY,MAAM;IAClB,oBAAoB,UAAU;GAChC,CAAC,CACH;GACA,OAAO,SAAS,OAAO,QAAQ,oBAAoB,KAAK,CAAC,CAAC,OACxD,QAAQ,oBAAoB,aAAa;IACvC,WAAW,QAAQ;IACnB,cAAc;IACd,UAAU,UAAU;GACtB,CAAC,CACH;EACF,OAAO;GACL,MAAM,cAAc,QAAQ,iBAAiB,QAAQ,WAAW;GAEhE,OAAO,SACJ,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,IACC,QAAQ,WAAW,iBAAiB;IAClC,YAAY,MAAM;IAClB,oBAAoB,UAAU;GAChC,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,cAAc,kBAAkB,GACrC,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,oBAAoB,WAAW,CACtC,CACF;GACF,OAAO,SACJ,OAAO,QAAQ,oBAAoB,KAAK,CAAC,CACzC,IAAI,QAAQ,oBAAoB,iBAAiB,UAAU,wBAAwB,CAAC,CAAC,CACrF,MACC,IACE,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,cAAc,kBAAkB,GACrC,GAAG,EAAE,UAAU,WAAW,CAC5B,CACF;EACJ;EACA,OAAO,SACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,IAAI,aAAa,CAAC,CAAC,QAAQ,QAAQ,kBAAkB,UAAU,oBAAoB,CAAC,CAAC,CAAC,CAAC,CACvF,MACC,IACE,GAAG,EAAE,IAAI,QAAQ,eAAe,GAChC,GAAG,EAAE,kBAAkB,MAAM,SAAS,SAAS,gBAAgB,CACjE,CACF;EACF,OAAO,SAAS,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,OAC5C,QAAQ,QAAQ,aAAa;GAC3B,UAAU,MAAM;GAChB,WAAW,MAAM;GACjB;GACA,eAAe,MAAM,cAAc,UAAU;GAC7C,sBAAsB,MAAM,QAAQ;EACtC,CAAC,CACH;EAEA,MAAM,oBACJ,WAAW,mBACP,CAAC,IACD,OAAO,WACL,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,cAAc,QAAQ,OAAQ,SAAS,YAAY,GACxD,GAAG,EAAE,WAAW,QAAQ,eAAe,CACzC,CACF,GACF,KACF;EAEN,MAAM,UAAU,OAAO,gBAAgB,SAAS,MAAM,UAAU,MAAM,MAAM,EAAA,CAAG;EAE/E,MAAM,kBAAkB,OAAO,WAC7B,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,oBAAoB,KAAK,CAAC,CACvC,MACC,IAAI,GAAG,EAAE,WAAW,QAAQ,eAAe,GAAG,GAAG,EAAE,cAAc,kBAAkB,CAAC,CACtF,CAAC,CACA,MAAM,CAAC,GACV,KACF;EAEA,MAAM,UAAU,OAAO,WACrB,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MACC,IACE,GAAG,eAAe,OAAO,CAAC,CAAC,UAAU,MAAM,QAAQ,GACnD,GAAG,eAAe,OAAO,CAAC,CAAC,WAAW,MAAM,SAAS,GACrD,GAAG,eAAe,OAAO,CAAC,CAAC,QAAQ,MAAM,GACzC,GAAG,eAAe,OAAO,CAAC,CAAC,eAAe,MAAM,cAAc,UAAU,aAAa,GACrF,GACE,eAAe,OAAO,CAAC,CAAC,gBACxB,QAAQ,cAAc,MAAM,QAAQ,sBAAsB,CAC5D,CACF,CACF,CAAC,CACA,MAAM,CAAC,GACV,KACF;EAEA,MAAM,mBACJ,WAAW,KAAA,IACP,KAAA,IACA,OAAO,QAAQ,cAAc,OAAO,WAAW,QAAQ,WAAW,WAAW;EAEnF,MAAM,mBACJ,WAAW,mBACP,CAAC,IACD,OAAO,cAAc,SAAS,QAAQ,OAAQ,SAAS,YAAY,KAAK;EAE9E,MAAM,kBACJ,WAAW,mBACP,CAAC,IACD,OAAO,WACL,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,oBAAoB,KAAK,CAAC,CACvC,MACC,IACE,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,cAAc,QAAQ,OAAQ,SAAS,YAAY,CAC1D,CACF,CAAC,CACA,MAAM,CAAC,GACV,KACF;EAEN,OACE,WAAW,KAAA,KACX,QAAQ,UAAU,OAAO,OAAO,QAAQ,QAAQ,QAAQ,KAAK,QAAQ,eAAe,KACpF,QAAQ,QAAQ,eAAe,OAAO,QAAQ,QAAQ,QAAQ,OAAO,KACrE,OAAO,QAAQ,QAAQ,QAAQ,sBAAsB,UAAU,wBAC/D,OAAO,WAAW,QAAQ,WAAW,qBACnC,UAAU,4BACZ,qBAAqB,OACrB,OAAO,WAAW,QAAQ,WAAW,wBACnC,UAAU,4BACZ,OAAO,WAAW,QAAQ,WAAW,kBAAkB,sBACvD,QAAQ,UAAU,OAChB,OAAO,WAAW,QAAQ,WAAW,YACrC,QAAQ,eACV,KACA,QAAQ,WAAW,UAAU,OAAO,UAAU,KAC9C,QAAQ,WAAW,eAAe,OAAO,WAAW,QAAQ,WAAW,OAAO,KAC9E,gBAAgB,WAAW,KAC3B,gBAAgB,EAAE,CAAE,QAAQ,oBAAoB,cAC9C,UAAU,4BACZ,QAAQ,oBAAoB,eAC1B,gBAAgB,EAAE,CAAE,QAAQ,oBAAoB,OAClD,KACA,QAAQ,WAAW,MAClB,WAAW,oBACT,kBAAkB,WAAW,KAC5B,kBAAkB,EAAE,CAAE,QAAQ,WAAW,wBACvC,UAAU,4BACZ,CAAC,QAAQ,WAAW,eAAe,kBAAkB,EAAE,CAAE,QAAQ,WAAW,OAAO,KACnF,iBAAiB,WAAW,KAC5B,QAAQ,UAAU,OAChB,iBAAiB,EAAE,CAAE,QAAQ,WAAW,YACxC,QAAQ,eACV,KACA,iBAAiB,EAAE,CAAE,QAAQ,WAAW,qBACtC,UAAU,4BACZ,CAAC,QAAQ,WAAW,UAAU,iBAAiB,EAAG,KAClD,gBAAgB,WAAW,KAC3B,gBAAgB,EAAE,CAAE,QAAQ,oBAAoB,cAC9C,UAAU,4BACZ,CAAC,QAAQ,oBAAoB,eAC3B,gBAAgB,EAAE,CAAE,QAAQ,oBAAoB,OAClD;CAER,CAAC;CAED,MAAM,uBAAuB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACrE,eACA,OACA;EACA,MAAM,WAAW,OAAO;EAExB,IAAI,cAAc,UAAU,KAAA,GAAW,OAAO,OAAO,OAAO,KAAK,YAAY,CAAC;EAC9E,MAAM,aAAa,EAAE,MAAM,4BAA4B;EAEvD,MAAM,OAAO;GACX;GACA,UACE,UACA,SACA,YACG,QAAQ,QAAQ,QAAQ,QAAQ,CAAC;EACxC;EAkBA,OAAO,OAhBO,uBAEV,SAAS,aAAa,gBACpB,oBACE,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MACA,OAAO,KAAK,UAAU,SAChB,KACR,CAAC,CAAC,KACA,OAAO,eAAe,iBAAiB,WAA0C,CACnF,CACF,GACF,EAAE,MAAM,cAAc,KAAK,CAGX,CAAC,CAAC,KAClB,OAAO,GAAG,KAAK,GACf,OAAO,YAAY,UAAU;GAC3B,MAAM,SAAS,MAAM,QAAQ;GAE7B,OAAO,MAAM,QAAQ,WAAW,KAC9B,WAAW,KAAA,KACX,MAAM,aAAa,MAAM,KACzB,OAAO,UAAU,aACf,OAAO,QAAQ,IAAI,IACnB,OAAO,UAAU,KAAK;EAC5B,CAAC,CACH;CACF,CAAC;CAED,MAAM,kBAAkB,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,eACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,OAAO,OAAO,MACZ,UACA,eACA,OAAO,IAAI,aAAa;GACtB,MAAM,UAAU,OAAO;GAEvB,OAAO,OAAO,OAAO,QAAQ,QAAQ,YAAY,OAAO,CAAC;EAC3D,CAAC,CACH;CACF,CAAC;CAED,MAAM,iCAAiC,OAAO,GAAG,gCAAgC,CAAC,CAAC,WACjF,SACA,eAKA;EACA,MAAM,WAAW,OAAO;EAExB,IAAI,CAAC,cAAc,aACjB,QACE,WAAW,kBAAkB;GAC3B,GAAG;GACH,OAAO,cAAc,OAAO;EAC9B,CAAC,KAAK,OAAO,KAAA,CACb,KAAK,OAAO,SAAS,WAAW,CAAC;EACrC,MAAM,QAAQ,OAAO;EAErB,OAAO,wBAAwB,GAAG;GAChC,SAAS,WACN,wBAAwB,OAAO,IAC5B,SACE,UACA,eACA,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO,eAAe,SAAS,OAAO,cAAc,OAAO;IAE3E,IAAI,YAAY,KAAA,GAAW,OAAO,OAAO,YAAY;IAErD,OAAO,OAAO,OAAO;KACnB,UAAU,sBAAsB,QAAQ,QAAQ;KAChD,UAAU,QAAQ;KAClB,GAAI,QAAQ,6BAA6B,KAAA,IACrC,CAAC,IACD,EAAE,0BAA0B,QAAQ,yBAAyB;KACjE,GAAI,QAAQ,WAAW,KAAA,IACnB,CAAC,IACD,EAAE,QAAQ,OAAO,wBAAwB,QAAQ,OAAO,QAAQ,EAAE;IACxE,CAAC;GACH,CAAC,CACH,IACA,OAAO,KAAK,YAAY,CAAC,EAAA,CAC3B,KACA,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,kBAAkB,UAAU;IAC1B,IAAI,cAAc,UAAU,KAAA,KAAa,MAAM,QAAQ,SAAS,oBAC9D,OAAO,OAAO,QAAQ,KAAK,CAAC,CAAC,KAC3B,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;IACF,MAAM,UAAU,MAAM;IAEtB,OAAO,SACL,UACA,eACA,OAAO,IAAI,aAAa;KACtB,MAAM,SACJ,MAAM,SAAS,SAAS,iBAAiB,KACzC,MAAM,YAAY,+BACd,mBACA,MAAM,SAAS,SAAS,iBAAiB,KACvC,MAAM,YAAY,yBAClB,mBACA,KAAA;KAER,IAAI,WAAW,KAAA,GAAW,OAAO;KACjC,MAAM,WAAW,MAAM,SAAS,MAAM,GAAG,CAAC,IAAI,SAAS,MAAM;KAE7D,MAAM,UAAU,OAAO,eACrB,SACA;MACE;MACA,WAAW,QAAQ,SAAS;MAC5B,QAAQ,QAAQ;KAClB,GACA,KACF;KAEA,OAAO,YAAY,KAAA,KAAa,kBAAkB,QAAQ,UAAU,QAAQ,QAAQ;IACtF,CAAC,CACH,CAAC,CACE,KACC,OAAO,SAAS,YACd,UAAU,qBAAqB,eAAe,KAAK,IAAI,OAAO,QAAQ,KAAK,CAC7E,CACF,CAAC,CACA,KACC,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACJ;GACA,kBAAkB,YAAY,YAC5B,cAAc,SAAS,eAAe,YAAY,kBAAkB,OAAO,CAAC,CAAC,KAC3E,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,kBAAkB,YAAY,YAC5B,cAAc,SAAS,eAAe,YAAY,kBAAkB,OAAO,CAAC,CAAC,KAC3E,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,UAAU,OAAO,YACf,MACE,UACA,eACA,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IAEvB,MAAM,IAAI,eAAe,OAAO;IAChC,MAAM,MAAM,OAAO;IAEnB,MAAM,OAAO,OAAO,WAClB,YACG,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAClC,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,IAAI,EAAE,gBAAgB,QAAQ,cAAc,GAAG,CAAC,CAClD,CACF,CAAC,CACA,MAAM,MAAM,QAAQ,CAAC,GACxB,cAAc,OAChB;IAEA,MAAM,WAAW,KAAK,MAAM,GAAG,MAAM,KAAK;IAE1C,MAAM,UAAU,QACd;KAAE,SAAS,SAAS;KAAQ,SAAS,KAAK,SAAS,MAAM;IAAM,GAC/D,OACF;IAEA,IAAI,SAAS,SAAS,GACpB,OAAO,YAAY,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,MAC/C,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,QACE,EAAE,WACF,SAAS,KAAK,QAAa,IAAI,SAAS,CAC1C,GACA,IAAI,EAAE,gBAAgB,QAAQ,cAAc,GAAG,CAAC,CAClD,CACF;IAEF,OAAO;GACT,CAAC,CACH,CAAC,CAAC,KACA,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACJ,CAAC;CACH,CAAC;CAED,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,eACA,YACA,QACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,IAAI,CAAC,wBAAwB,OAAO,KAAK,cAAc,UAAU,KAAA,GAC/D,OAAO,OAAO,YAAY;EAC5B,MAAM,QAAQ,OAAO,sBAAsB,UAAU;EAErD,MAAM,qBAAqB,OAAO,SAChC,cAAc,MACd,QAAQ,sBACR,QAAQ,wBACV;EAEA,MAAM,2BAA2B,OAAO,SACtC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;EAEA,MAAM,2BAA2B,OAAO,SACtC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;EAEA,MAAM,2BAA2B,OAAO,SACtC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;EAEA,MAAM,2BAA2B,OAAO,SACtC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;EAEA,MAAM,mBACJ,WAAW,oBAAoB,MAAM,SAAS,6BAA6B,KAAA;EAE7E,MAAM,eAAe,mBACjB,MAAM,SAAS,SAAS,mBACxB,OAAO,qBACL,SACA,cAAc,MACd,MAAM,SAAS,SAAS,gBAC1B;EAEJ,IACG,CAAC,oBAAoB,iBAAiB,MAAM,SAAS,SAAS,oBAC/D;GACE;GACA;GACA;GACA;EACF,CAAC,CAAC,MAAM,UAAU,MAAM,SAAS,SAAS,YAAY,MAAM,SAAS,KAAK,aAAa,KAAK,CAAC,GAE7F,OAAO,OAAO,YAAY;EAsE5B,OAAO,OApEK,MACV,UACA,eACA,OAAO,IAAI,aAAa;GACtB,MAAM,UAAU,OAAO;GAEvB,MAAM,UAAU,OAAO,uBAAuB,SAAS,eAAe,OAAO,MAAM;GAEnF,IAAI,YAAY,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;GAC7D,KACG,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,WAAW,cAAc,OAAO,EAAA,CAClF,SAAS,GAEZ,OAAO,QAAQ,YAAY,OAAO;GACpC,IAAI;GAEJ,OAAO,oBACL,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MAAM,YACN,OAAO,IAAI,aAAa;IAGtB,MAAM,qBAAqB,OAAO,QAAQ,QAAQ,wBAChD,QAAQ,SACR,MACF;IAEA,MAAM,WAAW,OAAO,qBACtB,MAAM,cAAc,UACpB,MAAM,cAAc,WACtB,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;IAEnC,MAAM,aAAa,OAAO,qBACxB,MAAM,cAAc,UACpB,kBACF,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;IAEnC,IAAI,CAAC,SAAS,aAAa,CAAC,WAAW,WAAW,OAAO;IACzD,MAAM,MAAM,OAAO;IAEnB,OAAO,OAAO,cACZ,SACA,OACA,QACA,SACA;KACE;KACA;KACA;KACA;KACA;KACA,sBAAsB;IACxB,GACA,GACF;GACF,CAAC,IACA,aAAa;IACZ,UAAU,QAAQ,aAAa,cAAc,YAAY,YAAY,OAAO;IAE5E,OAAO;GACT,CACF;GAEA,OAAO,WAAW,QAAQ,YAAY,OAAO;EAC/C,CAAC,CAGa,CAAC,CAAC,KAChB,OAAO,YAAY,UAChB,MAAM,QAAQ,MAAM,MAAM,YAAY,KACrC,2BAA2B,QAAQ,mBAAmB,KAAK,KAC5D,MAAM,QAAQ,MAAM,MAAM,YAAY,KACrC,2BAA2B,QAAQ,sBAAsB,KAAK,KAC/D,MAAM,QAAQ,MAAM,MAAM,YAAY,KACrC,2BAA2B,QAAQ,sBAAsB,KAAK,IAC5D,gBAAgB,eAAe,OAAO,IACtC,OAAO,UAAU,KAAK,CAC5B,CACF;CACF,CAAC;CAED,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF"}
1	+ {"version":3,"file":"email-kernel.mjs","names":[],"sources":["../../src/internal/email-kernel.ts"],"sourcesContent":["import {\n EmailAddressPersistence,\n type EmailAddressMutation,\n type EmailAction,\n type EmailCredentialSnapshot,\n EmailSignInTargets,\n EmailUnavailable,\n snapshotEmailCredential,\n snapshotEmailRequirement,\n snapshotEmailRevision,\n} from \"@yielded/auth/Email\";\nimport {\n coordinateCommit,\n CurrentCommitJournal,\n hasCommitScope,\n type CommitJournal,\n type PreparedCommit,\n LifecycleHooks,\n HookConfigurationError,\n} from \"@yielded/auth/Hooks\";\nimport type { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport { reportPersistenceFailure } from \"@yielded/auth/Persistence\";\nimport {\n ProofUnavailable,\n type ProofCompletionDecision,\n type ProofCompletionInput,\n} from \"@yielded/auth/Proofs\";\nimport {\n assessAuthentication,\n snapshotAuthenticationEvidence,\n type AuthenticationRevision,\n type SecurityRevision,\n} from \"@yielded/auth/Sessions\";\nimport { Cause, Context, DateTime, Effect, Option, Schema } from \"effect\";\nimport type * as SqlError from \"effect/sql/SqlError\";\n\nimport { isMappedConstraintConflict, PersistenceMappingError } from \"./mapping-error\";\nimport {\n type AnyEmailAddressMapping,\n type AnyEmailSignInMapping,\n requiredEmailAddressConstraints,\n requiredEmailSignInConstraints,\n} from \"./models/email-model\";\nimport {\n CurrentProofSql,\n type makeProofKernel,\n type ProofSqlConfiguration,\n type ProofSqlDatabase,\n} from \"./proof-kernel\";\n/* oxlint-disable no-explicit-any -- the shared dialect kernel erases consumer Drizzle table types internally. /\nimport type { QueryFailure } from \"./query-operations\";\nimport type { QueryOperations, SqlFragment, SqlColumn } from \"./query-operations\";\nimport type { NativeDatabase } from \"./transaction-kernel\";\n\ntype AdapterFailure = QueryFailure \| PersistenceMappingError \| SqlError.SqlError;\ntype SignInMapping = AnyEmailSignInMapping;\n\nexport interface EmailSqlQuery<A = ReadonlyArray<any>> extends Effect.Effect<A, AdapterFailure> {\n readonly getSQL: () => ReturnType<QueryOperations[\"sql\"]>;\n readonly from: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n readonly where: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n readonly limit: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n readonly orderBy: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n readonly for: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n readonly set: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n readonly values: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n readonly returning: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n readonly innerJoin: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n readonly onConflictDoNothing: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n readonly onDuplicateKeyUpdate: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n readonly $returningId: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n}\n\nexport interface EmailSqlDatabase {\n readonly select: (...args: ReadonlyArray<any>) => EmailSqlQuery;\n readonly insert: (...args: ReadonlyArray<any>) => EmailSqlQuery;\n readonly update: (...args: ReadonlyArray<any>) => EmailSqlQuery;\n readonly delete: (...args: ReadonlyArray<any>) => EmailSqlQuery;\n readonly transaction: <A, E, R>(\n body: (transaction: EmailSqlDatabase) => Effect.Effect<A, E, R>,\n ) => Effect.Effect<A, E \| SqlError.SqlError, R>;\n}\n\nexport class CurrentEmailSql extends Context.Service<CurrentEmailSql, EmailSqlDatabase>()(\n \"effect-auth/CurrentEmailSql\",\n) {}\n\nexport interface EmailSqlConfiguration {\n readonly mode: \"interactive\" \| \"synchronous\";\n readonly locking: boolean;\n readonly standaloneGuard: Effect.Effect<void, EmailUnavailable>;\n readonly coordinated?: boolean;\n readonly proof?: {\n readonly mapping: any;\n readonly configuration: ProofSqlConfiguration;\n };\n}\n\nexport interface CurrentAddress {\n readonly nativeSubjectId: unknown;\n readonly subject: any;\n readonly revision: AuthenticationRevision;\n readonly source?: {\n readonly credential: any;\n readonly identifier: any;\n readonly snapshot: EmailCredentialSnapshot;\n };\n readonly targetIdentifier?: any;\n readonly targetCredential?: any;\n readonly targetIdentifierRevision?: SecurityRevision;\n readonly eligible: boolean;\n}\n\nexport const makeEmailKernel = <\n Fragment extends SqlFragment = SqlFragment,\n Column extends SqlColumn = SqlColumn,\n>(\n operations: QueryOperations<Fragment, Column>,\n proofs: Pick<ReturnType<typeof makeProofKernel>, \"completeProofPlanIn\">,\n) => {\n type AddressMapping = AnyEmailAddressMapping<Fragment>;\n\n const { and, eq, inArray, lte, column, updateValues } = operations;\n const { completeProofPlanIn } = proofs;\n const unavailable = () => EmailUnavailable.make({});\n\n const translateFailure = <A, E, R>(\n effect: Effect.Effect<A, E, R>,\n ): Effect.Effect<A, EmailUnavailable, R> =>\n reportPersistenceFailure(\n effect,\n (error) =>\n Schema.is(EmailUnavailable)(error) \|\|\n Schema.is(ProofUnavailable)(error) \|\|\n Schema.is(HookConfigurationError)(error),\n ).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));\n\n const nowMillis = Effect.map(DateTime.now, DateTime.toEpochMillis);\n\n const selectRows = (query: EmailSqlQuery, locking: boolean) =>\n locking && typeof query.for === \"function\" ? query.for(\"update\") : query;\n\n const sameIdentifier = (left: LoginIdentifier, right: LoginIdentifier) =>\n left.namespace === right.namespace && left.value === right.value;\n\n const validEmailSignInConstraints = (mapping: SignInMapping) =>\n Object.entries(requiredEmailSignInConstraints).every(\n ([key, value]) =>\n mapping.constraints[key as keyof typeof requiredEmailSignInConstraints] === value,\n );\n\n const validAddressConstraints = (mapping: AddressMapping) =>\n Object.entries(requiredEmailAddressConstraints).every(\n ([key, value]) =>\n mapping.constraints[key as keyof typeof requiredEmailAddressConstraints] === value,\n );\n\n const subjectColumns = (mapping: SignInMapping) => ({\n id: column(mapping.subject.table, mapping.subject.id),\n status: column(mapping.subject.table, mapping.subject.status),\n securityRevision: column(mapping.subject.table, mapping.subject.securityRevision),\n });\n\n const identifierColumns = (mapping: SignInMapping) => ({\n namespace: column(mapping.identifier.table, mapping.identifier.namespace),\n value: column(mapping.identifier.table, mapping.identifier.value),\n subjectId: column(mapping.identifier.table, mapping.identifier.subjectId),\n verifiedAt: column(mapping.identifier.table, mapping.identifier.verifiedAt),\n bindingRevision: column(mapping.identifier.table, mapping.identifier.bindingRevision),\n });\n\n const credentialColumns = (mapping: SignInMapping) => ({\n moduleId: column(mapping.credential.table, mapping.credential.moduleId),\n subjectId: column(mapping.credential.table, mapping.credential.subjectId),\n credentialId: column(mapping.credential.table, mapping.credential.credentialId),\n identifierNamespace: column(mapping.credential.table, mapping.credential.identifierNamespace),\n identifierValue: column(mapping.credential.table, mapping.credential.identifierValue),\n credentialRevision: column(mapping.credential.table, mapping.credential.credentialRevision),\n status: column(mapping.credential.table, mapping.credential.status),\n });\n\n const authorityColumns = (mapping: AddressMapping) => ({\n subjectId: column(mapping.authorityCredential.table, mapping.authorityCredential.subjectId),\n credentialId: column(\n mapping.authorityCredential.table,\n mapping.authorityCredential.credentialId,\n ),\n revision: column(mapping.authorityCredential.table, mapping.authorityCredential.revision),\n status: column(mapping.authorityCredential.table, mapping.authorityCredential.status),\n });\n\n const commandColumns = (mapping: AddressMapping) => ({\n moduleId: column(mapping.command.table, mapping.command.moduleId),\n commandId: column(mapping.command.table, mapping.command.commandId),\n action: column(mapping.command.table, mapping.command.action),\n bindingDigest: column(mapping.command.table, mapping.command.bindingDigest),\n retentionUntil: column(mapping.command.table, mapping.command.retentionUntil),\n });\n\n const allocate = <A>(\n mode: EmailSqlConfiguration[\"mode\"],\n asynchronous: Effect.Effect<A, PersistenceMappingError> \| undefined,\n synchronous: (() => A) \| undefined,\n ) => {\n if (mode === \"synchronous\")\n return synchronous === undefined\n ? Effect.fail(unavailable())\n : Effect.try({\n try: synchronous,\n catch: (cause) => new PersistenceMappingError({ operation: \"mapping\", cause }),\n });\n if (asynchronous !== undefined) return asynchronous;\n\n return synchronous === undefined\n ? Effect.fail(unavailable())\n : Effect.try({\n try: synchronous,\n catch: (cause) => new PersistenceMappingError({ operation: \"mapping\", cause }),\n });\n };\n\n const nextSecurityRevision = (\n mapping: AddressMapping,\n mode: EmailSqlConfiguration[\"mode\"],\n current: SecurityRevision,\n ) => {\n if (mode === \"synchronous\")\n return mapping.subject.nextSecurityRevisionSync === undefined\n ? Effect.fail(unavailable())\n : Effect.try({\n try: () => mapping.subject.nextSecurityRevisionSync!(current),\n catch: (cause) => new PersistenceMappingError({ operation: \"mapping\", cause }),\n });\n if (mapping.subject.nextSecurityRevision !== undefined)\n return mapping.subject.nextSecurityRevision(current);\n if (mapping.subject.nextSecurityRevisionSync !== undefined)\n return Effect.try({\n try: () => mapping.subject.nextSecurityRevisionSync!(current),\n catch: (cause) => new PersistenceMappingError({ operation: \"mapping\", cause }),\n });\n\n return Effect.fail(unavailable());\n };\n\n const safeRead = <A, E, R>(\n database: EmailSqlDatabase,\n configuration: EmailSqlConfiguration,\n body: Effect.Effect<A, E, R>,\n ) =>\n Effect.gen(function () {\n if (configuration.coordinated !== true) {\n if (yield* hasCommitScope) return yield* unavailable();\n yield* configuration.standaloneGuard;\n }\n\n return yield* database.transaction((transaction) =>\n body.pipe(\n Effect.provideService(CurrentEmailSql, transaction),\n Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),\n ),\n );\n });\n\n const owned = <A, E, R>(\n database: EmailSqlDatabase,\n configuration: EmailSqlConfiguration,\n body: Effect.Effect<A, E, R>,\n ) => {\n const run = coordinateCommit(\n () =>\n database.transaction((transaction) =>\n body.pipe(\n Effect.provideService(CurrentEmailSql, transaction),\n Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),\n ),\n ),\n { mode: configuration.mode },\n ).pipe(Effect.map((result) => result.value));\n\n return configuration.coordinated !== true\n ? Effect.gen(function* () {\n if (yield* hasCommitScope) return yield* unavailable();\n yield* configuration.standaloneGuard;\n\n return yield* run;\n })\n : run;\n };\n\n const emailLookupQuery = (\n mapping: SignInMapping,\n moduleId: string,\n identifier: LoginIdentifier,\n ) => {\n const subject = subjectColumns(mapping),\n binding = identifierColumns(mapping),\n credential = credentialColumns(mapping);\n\n return {\n fields: {\n subject: mapping.subject.table,\n identifier: mapping.identifier.table,\n credential: mapping.credential.table,\n },\n from: mapping.identifier.table,\n subjectTable: mapping.subject.table,\n subjectJoin: eq(subject.id, binding.subjectId),\n credentialTable: mapping.credential.table,\n credentialJoin: and(\n eq(credential.moduleId, moduleId),\n eq(credential.subjectId, binding.subjectId),\n eq(credential.identifierNamespace, binding.namespace),\n eq(credential.identifierValue, binding.value),\n ),\n predicate: and(\n eq(binding.namespace, identifier.namespace),\n eq(binding.value, identifier.value),\n ),\n limit: 1,\n };\n };\n\n const emailLookupRows = Effect.fn(\"Drizzle.emailLookupRows\")(function* (\n mapping: SignInMapping,\n moduleId: string,\n identifier: LoginIdentifier,\n ) {\n const database = yield* CurrentEmailSql;\n const query = emailLookupQuery(mapping, moduleId, identifier);\n\n return yield* database\n .select(query.fields)\n .from(query.from)\n .innerJoin(query.subjectTable, query.subjectJoin)\n .innerJoin(query.credentialTable, query.credentialJoin)\n .where(query.predicate)\n .limit(query.limit);\n });\n\n const decodeEmailSnapshot = Effect.fn(\"DrizzleEmail.decodeSnapshot\")(function* (\n mapping: SignInMapping,\n moduleId: string,\n requested: LoginIdentifier,\n row: any,\n ) {\n if (\n !mapping.subject.isActiveStatus(row.subject[mapping.subject.status]) \|\|\n !mapping.identifier.isCurrent(row.identifier) \|\|\n !mapping.credential.isActiveStatus(row.credential[mapping.credential.status])\n )\n return undefined;\n\n const snapshot = yield* mapping.credential\n .decode({\n moduleId,\n subject: row.subject,\n identifier: row.identifier,\n credential: row.credential,\n })\n .pipe(Effect.flatMap(snapshotEmailCredential));\n\n const subjectId = yield* mapping.subjectId.toSubject(row.subject[mapping.subject.id]);\n\n const verifiedAtMillis = yield* mapping.decodeInstant(\n row.identifier[mapping.identifier.verifiedAt],\n );\n\n if (\n snapshot.moduleId !== moduleId \|\|\n !sameIdentifier(snapshot.identifier, requested) \|\|\n snapshot.revision.subjectId !== subjectId \|\|\n snapshot.revision.securityRevision !== row.subject[mapping.subject.securityRevision] \|\|\n snapshot.identifierRevision !== row.identifier[mapping.identifier.bindingRevision] \|\|\n snapshot.verifiedAtMillis !== verifiedAtMillis \|\|\n snapshot.credentialId !== row.credential[mapping.credential.credentialId] \|\|\n snapshot.credentialRevision !== row.credential[mapping.credential.credentialRevision]\n )\n return undefined;\n\n return snapshot;\n });\n\n const makeSqlEmailSignInTargets = Effect.fn(\"makeSqlEmailSignInTargets\")(function* (\n mapping: SignInMapping,\n configuration: EmailSqlConfiguration,\n ): Effect.fn.Return<\n EmailSignInTargets[\"Service\"],\n EmailUnavailable,\n CurrentEmailSql \| NativeDatabase\n > {\n const database = yield* CurrentEmailSql;\n\n if (!configuration.coordinated)\n yield* (\n operations.validateStorage?.({\n ...mapping,\n proof: configuration.proof?.mapping,\n }) ?? Effect.void\n ).pipe(Effect.mapError(unavailable));\n\n return EmailSignInTargets.of({\n lookup: (input) =>\n (validEmailSignInConstraints(mapping)\n ? safeRead(\n database,\n configuration,\n Effect.gen(function* () {\n const row = (yield* emailLookupRows(mapping, input.moduleId, input.identifier))[0];\n\n if (row === undefined) return Option.none();\n\n const snapshot = yield* decodeEmailSnapshot(\n mapping,\n input.moduleId,\n input.identifier,\n row,\n );\n\n return snapshot === undefined ? Option.none() : Option.some(snapshot);\n }),\n )\n : Effect.fail(unavailable())\n ).pipe(Effect.provideService(CurrentEmailSql, database), translateFailure),\n });\n });\n\n const readSubject = Effect.fn(\"DrizzleEmail.readSubject\")(function* (\n mapping: AddressMapping,\n subjectId: string,\n locking: boolean,\n ) {\n const database = yield* CurrentEmailSql;\n\n const nativeSubjectId = yield* mapping.subjectId.toNative(subjectId as any);\n const s = subjectColumns(mapping);\n\n const subject = (yield* selectRows(\n database.select().from(mapping.subject.table).where(eq(s.id, nativeSubjectId)).limit(1),\n locking,\n ))[0];\n\n return { nativeSubjectId, subject };\n });\n\n const identifierRow = Effect.fn(\"Drizzle.identifierRow\")(function* (\n mapping: SignInMapping,\n identifier: LoginIdentifier,\n locking: boolean,\n ) {\n const database = yield* CurrentEmailSql;\n\n const i = identifierColumns(mapping);\n\n return yield* selectRows(\n database\n .select()\n .from(mapping.identifier.table)\n .where(and(eq(i.namespace, identifier.namespace), eq(i.value, identifier.value)))\n .limit(1),\n locking,\n );\n });\n\n const credentialById = Effect.fn(\"Drizzle.credentialById\")(function* (\n mapping: SignInMapping,\n moduleId: string,\n credentialId: string,\n locking: boolean,\n ) {\n const database = yield* CurrentEmailSql;\n\n const c = credentialColumns(mapping);\n\n return yield* selectRows(\n database\n .select()\n .from(mapping.credential.table)\n .where(and(eq(c.moduleId, moduleId), eq(c.credentialId, credentialId)))\n .limit(1),\n locking,\n );\n });\n\n const credentialByIdentifier = Effect.fn(\"Drizzle.credentialByIdentifier\")(function* (\n mapping: SignInMapping,\n moduleId: string,\n identifier: LoginIdentifier,\n locking: boolean,\n ) {\n const database = yield* CurrentEmailSql;\n\n const c = credentialColumns(mapping);\n\n return yield* selectRows(\n database\n .select()\n .from(mapping.credential.table)\n .where(\n and(\n eq(c.moduleId, moduleId),\n eq(c.identifierNamespace, identifier.namespace),\n eq(c.identifierValue, identifier.value),\n ),\n )\n .limit(1),\n locking,\n );\n });\n\n const currentAddress = Effect.fn(\"DrizzleEmail.currentAddress\")(function* (\n mapping: AddressMapping,\n input: {\n readonly moduleId: string;\n readonly subjectId: string;\n readonly target: LoginIdentifier;\n readonly sourceCredentialId?: string;\n },\n locking: boolean,\n ) {\n const database = yield* CurrentEmailSql;\n\n const locked = yield* readSubject(mapping, input.subjectId, locking);\n\n if (\n locked.subject === undefined \|\|\n !mapping.subject.isActiveStatus(locked.subject[mapping.subject.status])\n )\n return undefined;\n\n const discoveredSource =\n input.sourceCredentialId === undefined\n ? undefined\n : (yield* credentialById(mapping, input.moduleId, input.sourceCredentialId, false))[0];\n\n const sourceIdentifier: LoginIdentifier \| undefined =\n discoveredSource === undefined\n ? undefined\n : {\n namespace: discoveredSource[mapping.credential.identifierNamespace],\n value: discoveredSource[mapping.credential.identifierValue],\n };\n\n const identifiers = [\n input.target,\n ...(sourceIdentifier === undefined ? [] : [sourceIdentifier]),\n ]\n .filter(\n (value, index, values) =>\n values.findIndex((candidate) => sameIdentifier(candidate, value)) === index,\n )\n .sort((left, right) =>\n `${left.namespace}\\u0000${left.value}`.localeCompare(\n `${right.namespace}\\u0000${right.value}`,\n ),\n );\n\n const lockedIdentifiers = new Map<string, any>();\n\n for (const identifier of identifiers) {\n const row = (yield* identifierRow(mapping, identifier, locking))[0];\n\n if (row !== undefined)\n lockedIdentifiers.set(`${identifier.namespace}\\u0000${identifier.value}`, row);\n }\n\n const sourceCredential =\n input.sourceCredentialId === undefined\n ? undefined\n : (yield* credentialById(mapping, input.moduleId, input.sourceCredentialId, locking))[0];\n\n const targetCredential = (yield* credentialByIdentifier(\n mapping,\n input.moduleId,\n input.target,\n locking,\n ))[0];\n\n const a = authorityColumns(mapping);\n\n const authority = yield* selectRows(\n database\n .select()\n .from(mapping.authorityCredential.table)\n .where(eq(a.subjectId, locked.nativeSubjectId))\n .orderBy(a.credentialId),\n locking,\n );\n\n const activeAuthority = authority.filter((row: any) =>\n mapping.authorityCredential.isActiveStatus(row[mapping.authorityCredential.status]),\n );\n\n const subjectId = yield* mapping.subjectId.toSubject(locked.nativeSubjectId);\n\n const revision: AuthenticationRevision = Object.freeze({\n subjectId,\n securityRevision: locked.subject[mapping.subject.securityRevision],\n credentials: Object.freeze(\n activeAuthority.map((row: any) =>\n Object.freeze({\n credentialId: row[mapping.authorityCredential.credentialId],\n revision: row[mapping.authorityCredential.revision],\n }),\n ),\n ),\n });\n\n const targetIdentifier = lockedIdentifiers.get(\n `${input.target.namespace}\\u0000${input.target.value}`,\n );\n\n const targetOwned =\n targetIdentifier !== undefined &&\n mapping.subjectId.equals(\n targetIdentifier[mapping.identifier.subjectId],\n locked.nativeSubjectId,\n );\n\n const targetMutable =\n targetOwned &&\n mapping.identifier.isMutableTarget(targetIdentifier) &&\n (targetCredential === undefined \|\|\n (!mapping.credential.isActiveStatus(targetCredential[mapping.credential.status]) &&\n mapping.subjectId.equals(\n targetCredential[mapping.credential.subjectId],\n locked.nativeSubjectId,\n )));\n\n let source: CurrentAddress[\"source\"];\n\n if (input.sourceCredentialId !== undefined) {\n if (\n sourceCredential === undefined \|\|\n sourceIdentifier === undefined \|\|\n !mapping.subjectId.equals(\n sourceCredential[mapping.credential.subjectId],\n locked.nativeSubjectId,\n ) \|\|\n !mapping.credential.isActiveStatus(sourceCredential[mapping.credential.status])\n )\n return undefined;\n\n const sourceIdentifierRow = lockedIdentifiers.get(\n `${sourceIdentifier.namespace}\\u0000${sourceIdentifier.value}`,\n );\n\n if (\n sourceIdentifierRow === undefined \|\|\n !mapping.identifier.isCurrent(sourceIdentifierRow) \|\|\n !mapping.subjectId.equals(\n sourceIdentifierRow[mapping.identifier.subjectId],\n locked.nativeSubjectId,\n )\n )\n return undefined;\n\n const snapshot = yield* mapping.credential\n .decode({\n moduleId: input.moduleId,\n subject: locked.subject,\n identifier: sourceIdentifierRow,\n credential: sourceCredential,\n })\n .pipe(Effect.flatMap(snapshotEmailCredential));\n\n source = { credential: sourceCredential, identifier: sourceIdentifierRow, snapshot };\n }\n let eligible = targetIdentifier === undefined ? targetCredential === undefined : targetMutable;\n\n if (input.sourceCredentialId !== undefined && source === undefined) eligible = false;\n if (source !== undefined && sameIdentifier(source.snapshot.identifier, input.target))\n eligible = false;\n if (mapping.addressCardinality === \"single\" && input.sourceCredentialId === undefined) {\n const c = credentialColumns(mapping);\n\n const rows = yield* selectRows(\n database\n .select()\n .from(mapping.credential.table)\n .where(and(eq(c.moduleId, input.moduleId), eq(c.subjectId, locked.nativeSubjectId))),\n locking,\n );\n\n if (\n rows.some((row: any) => mapping.credential.isActiveStatus(row[mapping.credential.status]))\n )\n eligible = false;\n }\n\n return {\n nativeSubjectId: locked.nativeSubjectId,\n subject: locked.subject,\n revision,\n ...(source === undefined ? {} : { source }),\n ...(targetIdentifier === undefined ? {} : { targetIdentifier }),\n ...(targetCredential === undefined ? {} : { targetCredential }),\n ...(targetMutable\n ? { targetIdentifierRevision: targetIdentifier[mapping.identifier.bindingRevision] }\n : {}),\n eligible,\n };\n });\n\n const sameEmailRevision = (left: AuthenticationRevision, right: AuthenticationRevision) => {\n if (\n left.subjectId !== right.subjectId \|\|\n left.securityRevision !== right.securityRevision \|\|\n left.credentials.length !== right.credentials.length\n )\n return false;\n\n const expected = [...left.credentials].sort((a, b) =>\n a.credentialId.localeCompare(b.credentialId),\n );\n\n const actual = [...right.credentials].sort((a, b) =>\n a.credentialId.localeCompare(b.credentialId),\n );\n\n return expected.every(\n (item, index) =>\n item.credentialId === actual[index]!.credentialId &&\n item.revision === actual[index]!.revision,\n );\n };\n\n const actionModule = (moduleId: string, action: EmailAction) =>\n `${moduleId}/${action === \"verify-address\" ? \"verify-address\" : \"change-address\"}`;\n\n const actionPurpose = (action: EmailAction) =>\n action === \"verify-address\" ? \"email-address-verification\" : \"email-address-change\";\n\n const completionMatches = (input: EmailAddressMutation, action: EmailAction) => {\n const completion = input.completion.input;\n const binding = completion.binding;\n\n return (\n completion.moduleId === actionModule(input.moduleId, action) &&\n completion.purpose === actionPurpose(action) &&\n binding._tag === \"IdentifierChange\" &&\n sameIdentifier(binding.identifier, input.target) &&\n sameEmailRevision(binding.revision, input.captured.revision)\n );\n };\n\n const snapshotEmailMutation = Effect.fn(\"DrizzleEmail.snapshotMutation\")(function* (\n input: EmailAddressMutation,\n ) {\n const evidence = yield* snapshotAuthenticationEvidence(input.authorization.evidence).pipe(\n Effect.mapError(unavailable),\n );\n\n const requirement = yield* snapshotEmailRequirement(input.authorization.requirement);\n\n const source =\n input.captured.source === undefined\n ? undefined\n : yield* snapshotEmailCredential(input.captured.source);\n\n return Object.freeze({\n ...input,\n target: Object.freeze({ ...input.target }),\n ...(input.invalidation === undefined\n ? {}\n : { invalidation: Object.freeze({ ...input.invalidation }) }),\n captured: Object.freeze({\n eligible: input.captured.eligible,\n revision: snapshotEmailRevision(input.captured.revision),\n ...(input.captured.targetIdentifierRevision === undefined\n ? {}\n : { targetIdentifierRevision: input.captured.targetIdentifierRevision }),\n ...(source === undefined ? {} : { source }),\n }),\n authorization: Object.freeze({\n challenge: Object.freeze({\n ...input.authorization.challenge,\n target: Object.freeze({ ...input.authorization.challenge.target }),\n revision: snapshotEmailRevision(input.authorization.challenge.revision),\n }),\n evidence,\n requirement,\n }),\n });\n });\n\n const validateEmailAuthority = Effect.fn(\"DrizzleEmail.validateAuthority\")(function* (\n mapping: AddressMapping,\n configuration: EmailSqlConfiguration,\n input: EmailAddressMutation,\n action: EmailAction,\n ) {\n const confirmsExisting =\n action === \"verify-address\" && input.captured.targetIdentifierRevision !== undefined;\n\n if (\n !input.captured.eligible \|\|\n !completionMatches(input, action) \|\|\n input.authorization.challenge.moduleId !== input.moduleId \|\|\n input.authorization.challenge.action !== action \|\|\n input.authorization.challenge.commandId !== input.commandId \|\|\n !sameIdentifier(input.authorization.challenge.target, input.target) \|\|\n input.authorization.challenge.sourceCredentialId !== input.captured.source?.credentialId \|\|\n !sameEmailRevision(input.authorization.challenge.revision, input.captured.revision) \|\|\n input.authorization.challenge.targetIdentifierRevision !==\n input.captured.targetIdentifierRevision \|\|\n (input.authorization.evidence.flowId as string) !== (input.commandId as string) \|\|\n input.authorization.evidence.bindingDigest !== input.authorization.challenge.bindingDigest \|\|\n !sameEmailRevision(input.authorization.evidence.revision, input.captured.revision) \|\|\n (action === \"verify-address\" && input.captured.source !== undefined) \|\|\n (action === \"change-address\" && input.captured.source === undefined) \|\|\n confirmsExisting !== (input.invalidation === undefined) \|\|\n ((input.invalidation?.existingSessions === \"immediate\" \|\|\n input.invalidation?.existingSessions === \"cache-expiry\") &&\n mapping.sessionInvalidation !== \"same-authority-immediate\")\n )\n return undefined;\n\n const current = yield* currentAddress(\n mapping,\n {\n moduleId: input.moduleId,\n subjectId: input.captured.revision.subjectId,\n target: input.target,\n ...(input.captured.source === undefined\n ? {}\n : { sourceCredentialId: input.captured.source.credentialId }),\n },\n configuration.locking,\n );\n\n if (\n current === undefined \|\|\n !current.eligible \|\|\n !sameEmailRevision(current.revision, input.captured.revision) \|\|\n current.targetIdentifierRevision !== input.captured.targetIdentifierRevision \|\|\n (input.captured.source !== undefined &&\n (current.source === undefined \|\|\n current.source.snapshot.identifierRevision !== input.captured.source.identifierRevision \|\|\n current.source.snapshot.credentialRevision !== input.captured.source.credentialRevision \|\|\n !sameIdentifier(current.source.snapshot.identifier, input.captured.source.identifier)))\n )\n return undefined;\n\n const currentRequirement = yield* mapping.subject.decodeActionRequirement(\n current.subject,\n action,\n );\n\n const original = yield* assessAuthentication(\n input.authorization.evidence,\n input.authorization.requirement,\n ).pipe(Effect.mapError(unavailable));\n\n const configured = yield* assessAuthentication(\n input.authorization.evidence,\n currentRequirement,\n ).pipe(Effect.mapError(unavailable));\n\n return original.satisfied && configured.satisfied ? current : undefined;\n });\n\n const commandExists = Effect.fn(\"Drizzle.commandExists\")(function* (\n mapping: AddressMapping,\n moduleId: string,\n commandId: string,\n locking: boolean,\n ) {\n const database = yield* CurrentEmailSql;\n\n const c = commandColumns(mapping);\n\n return yield* selectRows(\n database\n .select()\n .from(mapping.command.table)\n .where(and(eq(c.moduleId, moduleId), eq(c.commandId, commandId)))\n .limit(1),\n locking,\n );\n });\n\n const applyMutation = Effect.fn(\"DrizzleEmail.applyMutation\")(function* (\n mapping: AddressMapping,\n input: EmailAddressMutation,\n action: EmailAction,\n current: CurrentAddress,\n allocated: {\n readonly targetCredentialId: string;\n readonly targetIdentifierRevision: SecurityRevision;\n readonly targetCredentialRevision: SecurityRevision;\n readonly sourceIdentifierRevision: SecurityRevision;\n readonly sourceCredentialRevision: SecurityRevision;\n readonly nextSecurityRevision: SecurityRevision;\n },\n now: number,\n ) {\n const database = yield* CurrentEmailSql;\n\n const i = identifierColumns(mapping);\n const c = credentialColumns(mapping);\n const a = authorityColumns(mapping);\n const s = subjectColumns(mapping);\n\n const targetCredentialId =\n current.targetCredential?.[mapping.credential.credentialId] ?? allocated.targetCredentialId;\n\n if (action === \"change-address\") {\n const source = current.source!;\n\n yield* database\n .update(mapping.identifier.table)\n .set(\n mapping.identifier.encodeRetirement({\n source: source.snapshot.identifier,\n bindingRevision: allocated.sourceIdentifierRevision,\n }),\n )\n .where(\n and(\n eq(i.namespace, source.snapshot.identifier.namespace),\n eq(i.value, source.snapshot.identifier.value),\n eq(i.subjectId, current.nativeSubjectId),\n eq(i.bindingRevision, source.snapshot.identifierRevision),\n ),\n );\n yield* database\n .update(mapping.credential.table)\n .set(\n mapping.credential.encodeRetirement({\n source: source.snapshot.identifier,\n credentialRevision: allocated.sourceCredentialRevision,\n }),\n )\n .where(\n and(\n eq(c.moduleId, input.moduleId),\n eq(c.credentialId, source.snapshot.credentialId),\n eq(c.subjectId, current.nativeSubjectId),\n eq(c.credentialRevision, source.snapshot.credentialRevision),\n ),\n );\n yield* database\n .update(mapping.authorityCredential.table)\n .set(mapping.authorityCredential.encodeRetirement(allocated.sourceCredentialRevision))\n .where(\n and(\n eq(a.subjectId, current.nativeSubjectId),\n eq(a.credentialId, source.snapshot.credentialId),\n eq(a.revision, source.snapshot.credentialRevision),\n ),\n );\n }\n if (current.targetIdentifier === undefined) {\n yield* database.insert(mapping.identifier.table).values(\n mapping.identifier.encodeVerifiedInsert({\n identifier: input.target,\n subjectId: current.nativeSubjectId,\n verifiedAtMillis: now,\n bindingRevision: allocated.targetIdentifierRevision,\n }),\n );\n } else {\n yield* database\n .update(mapping.identifier.table)\n .set(\n mapping.identifier.encodeVerification({\n verifiedAtMillis: now,\n bindingRevision: allocated.targetIdentifierRevision,\n }),\n )\n .where(\n and(\n eq(i.namespace, input.target.namespace),\n eq(i.value, input.target.value),\n eq(i.subjectId, current.nativeSubjectId),\n eq(i.bindingRevision, current.targetIdentifier![mapping.identifier.bindingRevision]),\n ),\n );\n }\n if (current.targetCredential === undefined) {\n yield* database.insert(mapping.credential.table).values(\n mapping.credential.encodeVerifiedInsert({\n moduleId: input.moduleId,\n subjectId: current.nativeSubjectId,\n credentialId: targetCredentialId,\n identifier: input.target,\n credentialRevision: allocated.targetCredentialRevision,\n }),\n );\n yield* database.insert(mapping.authorityCredential.table).values(\n mapping.authorityCredential.encodeInsert({\n subjectId: current.nativeSubjectId,\n credentialId: targetCredentialId,\n revision: allocated.targetCredentialRevision,\n }),\n );\n } else {\n const oldRevision = current.targetCredential[mapping.credential.credentialRevision];\n\n yield* database\n .update(mapping.credential.table)\n .set(\n mapping.credential.encodeActivation({\n identifier: input.target,\n credentialRevision: allocated.targetCredentialRevision,\n }),\n )\n .where(\n and(\n eq(c.moduleId, input.moduleId),\n eq(c.credentialId, targetCredentialId),\n eq(c.subjectId, current.nativeSubjectId),\n eq(c.credentialRevision, oldRevision),\n ),\n );\n yield* database\n .update(mapping.authorityCredential.table)\n .set(mapping.authorityCredential.encodeActivation(allocated.targetCredentialRevision))\n .where(\n and(\n eq(a.subjectId, current.nativeSubjectId),\n eq(a.credentialId, targetCredentialId),\n eq(a.revision, oldRevision),\n ),\n );\n }\n yield* database\n .update(mapping.subject.table)\n .set(updateValues([[mapping.subject.securityRevision, allocated.nextSecurityRevision]]))\n .where(\n and(\n eq(s.id, current.nativeSubjectId),\n eq(s.securityRevision, input.captured.revision.securityRevision),\n ),\n );\n yield* database.insert(mapping.command.table).values(\n mapping.command.encodeInsert({\n moduleId: input.moduleId,\n commandId: input.commandId,\n action,\n bindingDigest: input.authorization.challenge.bindingDigest,\n retentionUntilMillis: now + mapping.commandRetentionMillis,\n }),\n );\n\n const sourceStillActive =\n action === \"verify-address\"\n ? []\n : yield* selectRows(\n database\n .select()\n .from(mapping.credential.table)\n .where(\n and(\n eq(c.moduleId, input.moduleId),\n eq(c.credentialId, current.source!.snapshot.credentialId),\n eq(c.subjectId, current.nativeSubjectId),\n ),\n ),\n false,\n );\n\n const target = (yield* emailLookupRows(mapping, input.moduleId, input.target))[0];\n\n const targetAuthority = yield* selectRows(\n database\n .select()\n .from(mapping.authorityCredential.table)\n .where(\n and(eq(a.subjectId, current.nativeSubjectId), eq(a.credentialId, targetCredentialId)),\n )\n .limit(1),\n false,\n );\n\n const command = yield* selectRows(\n database\n .select()\n .from(mapping.command.table)\n .where(\n and(\n eq(commandColumns(mapping).moduleId, input.moduleId),\n eq(commandColumns(mapping).commandId, input.commandId),\n eq(commandColumns(mapping).action, action),\n eq(commandColumns(mapping).bindingDigest, input.authorization.challenge.bindingDigest),\n eq(\n commandColumns(mapping).retentionUntil,\n mapping.encodeInstant(now + mapping.commandRetentionMillis),\n ),\n ),\n )\n .limit(1),\n false,\n );\n\n const targetVerifiedAt =\n target === undefined\n ? undefined\n : yield* mapping.decodeInstant(target.identifier[mapping.identifier.verifiedAt]);\n\n const sourceIdentifier =\n action === \"verify-address\"\n ? []\n : yield* identifierRow(mapping, current.source!.snapshot.identifier, false);\n\n const sourceAuthority =\n action === \"verify-address\"\n ? []\n : yield* selectRows(\n database\n .select()\n .from(mapping.authorityCredential.table)\n .where(\n and(\n eq(a.subjectId, current.nativeSubjectId),\n eq(a.credentialId, current.source!.snapshot.credentialId),\n ),\n )\n .limit(1),\n false,\n );\n\n return (\n target !== undefined &&\n mapping.subjectId.equals(target.subject[mapping.subject.id], current.nativeSubjectId) &&\n mapping.subject.isActiveStatus(target.subject[mapping.subject.status]) &&\n target.subject[mapping.subject.securityRevision] === allocated.nextSecurityRevision &&\n target.identifier[mapping.identifier.bindingRevision] ===\n allocated.targetIdentifierRevision &&\n targetVerifiedAt === now &&\n target.credential[mapping.credential.credentialRevision] ===\n allocated.targetCredentialRevision &&\n target.credential[mapping.credential.credentialId] === targetCredentialId &&\n mapping.subjectId.equals(\n target.credential[mapping.credential.subjectId],\n current.nativeSubjectId,\n ) &&\n mapping.identifier.isCurrent(target.identifier) &&\n mapping.credential.isActiveStatus(target.credential[mapping.credential.status]) &&\n targetAuthority.length === 1 &&\n targetAuthority[0]![mapping.authorityCredential.revision] ===\n allocated.targetCredentialRevision &&\n mapping.authorityCredential.isActiveStatus(\n targetAuthority[0]![mapping.authorityCredential.status],\n ) &&\n command.length === 1 &&\n (action === \"verify-address\" \|\|\n (sourceStillActive.length === 1 &&\n sourceStillActive[0]![mapping.credential.credentialRevision] ===\n allocated.sourceCredentialRevision &&\n !mapping.credential.isActiveStatus(sourceStillActive[0]![mapping.credential.status]) &&\n sourceIdentifier.length === 1 &&\n mapping.subjectId.equals(\n sourceIdentifier[0]![mapping.identifier.subjectId],\n current.nativeSubjectId,\n ) &&\n sourceIdentifier[0]![mapping.identifier.bindingRevision] ===\n allocated.sourceIdentifierRevision &&\n !mapping.identifier.isCurrent(sourceIdentifier[0]!) &&\n sourceAuthority.length === 1 &&\n sourceAuthority[0]![mapping.authorityCredential.revision] ===\n allocated.sourceCredentialRevision &&\n !mapping.authorityCredential.isActiveStatus(\n sourceAuthority[0]![mapping.authorityCredential.status],\n )))\n );\n });\n\n const probeProofCompletion = Effect.fn(\"Drizzle.probeProofCompletion\")(function* (\n configuration: EmailSqlConfiguration,\n input: ProofCompletionInput,\n ) {\n const database = yield* CurrentEmailSql;\n\n if (configuration.proof === undefined) return yield* Effect.fail(unavailable());\n const validProbe = { _tag: \"EmailProofCompletionValid\" } as const;\n\n const plan = {\n input,\n prepare: <A>(\n decision: ProofCompletionDecision,\n journal: CommitJournal,\n project: (decision: ProofCompletionDecision) => A,\n ) => journal.prepare(project(decision)),\n };\n\n const probe = coordinateCommit(\n () =>\n database.transaction((transaction) =>\n completeProofPlanIn(\n configuration.proof!.mapping,\n configuration.proof!.configuration,\n plan,\n Effect.fail(validProbe),\n () => false,\n ).pipe(\n Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),\n ),\n ),\n { mode: configuration.mode },\n );\n\n return yield* probe.pipe(\n Effect.as(false),\n Effect.catchCause((cause) => {\n const reason = cause.reasons[0];\n\n return cause.reasons.length === 1 &&\n reason !== undefined &&\n Cause.isFailReason(reason) &&\n reason.error === validProbe\n ? Effect.succeed(true)\n : Effect.failCause(cause);\n }),\n );\n });\n\n const prepareRejected = Effect.fn(\"Drizzle.prepareRejected\")(function* <A>(\n configuration: EmailSqlConfiguration,\n prepare: (value: \"rejected\", journal: CommitJournal) => PreparedCommit<A>,\n ) {\n const database = yield* CurrentEmailSql;\n\n return yield* owned(\n database,\n configuration,\n Effect.gen(function* () {\n const journal = yield* CurrentCommitJournal;\n\n return yield* Effect.succeed(prepare(\"rejected\", journal));\n }),\n );\n });\n\n const makeSqlEmailAddressPersistence = Effect.fn(\"makeSqlEmailAddressPersistence\")(function* (\n mapping: AddressMapping,\n configuration: EmailSqlConfiguration,\n ): Effect.fn.Return<\n EmailAddressPersistence[\"Service\"],\n EmailUnavailable,\n LifecycleHooks \| CurrentEmailSql \| NativeDatabase\n > {\n const database = yield* CurrentEmailSql;\n\n if (!configuration.coordinated)\n yield* (\n operations.validateStorage?.({\n ...mapping,\n proof: configuration.proof?.mapping,\n }) ?? Effect.void\n ).pipe(Effect.mapError(unavailable));\n const hooks = yield* LifecycleHooks;\n\n return EmailAddressPersistence.of({\n target: (input) =>\n (validAddressConstraints(mapping)\n ? safeRead(\n database,\n configuration,\n Effect.gen(function* () {\n const current = yield* currentAddress(mapping, input, configuration.locking);\n\n if (current === undefined) return yield* unavailable();\n\n return Object.freeze({\n revision: snapshotEmailRevision(current.revision),\n eligible: current.eligible,\n ...(current.targetIdentifierRevision === undefined\n ? {}\n : { targetIdentifierRevision: current.targetIdentifierRevision }),\n ...(current.source === undefined\n ? {}\n : { source: yield* snapshotEmailCredential(current.source.snapshot) }),\n });\n }),\n )\n : Effect.fail(unavailable())\n ).pipe(\n Effect.provideService(CurrentEmailSql, database),\n Effect.provideService(LifecycleHooks, hooks),\n translateFailure,\n ),\n checkCompletion: (input) => {\n if (configuration.proof === undefined \|\| input.binding._tag !== \"IdentifierChange\")\n return Effect.succeed(false).pipe(\n Effect.provideService(CurrentEmailSql, database),\n Effect.provideService(LifecycleHooks, hooks),\n translateFailure,\n );\n const binding = input.binding;\n\n return safeRead(\n database,\n configuration,\n Effect.gen(function* () {\n const action: EmailAction \| undefined =\n input.moduleId.endsWith(\"/verify-address\") &&\n input.purpose === \"email-address-verification\"\n ? \"verify-address\"\n : input.moduleId.endsWith(\"/change-address\") &&\n input.purpose === \"email-address-change\"\n ? \"change-address\"\n : undefined;\n\n if (action === undefined) return false;\n const moduleId = input.moduleId.slice(0, -`/${action}`.length);\n\n const current = yield* currentAddress(\n mapping,\n {\n moduleId,\n subjectId: binding.revision.subjectId,\n target: binding.identifier,\n },\n false,\n );\n\n return current !== undefined && sameEmailRevision(current.revision, binding.revision);\n }),\n )\n .pipe(\n Effect.flatMap((current) =>\n current ? probeProofCompletion(configuration, input) : Effect.succeed(false),\n ),\n )\n .pipe(\n Effect.provideService(CurrentEmailSql, database),\n Effect.provideService(LifecycleHooks, hooks),\n translateFailure,\n );\n },\n verifyWithProof: (uncaptured, prepare) =>\n mutateAddress(mapping, configuration, uncaptured, \"verify-address\", prepare).pipe(\n Effect.provideService(CurrentEmailSql, database),\n Effect.provideService(LifecycleHooks, hooks),\n translateFailure,\n ),\n changeWithProof: (uncaptured, prepare) =>\n mutateAddress(mapping, configuration, uncaptured, \"change-address\", prepare).pipe(\n Effect.provideService(CurrentEmailSql, database),\n Effect.provideService(LifecycleHooks, hooks),\n translateFailure,\n ),\n cleanup: (input, prepare) =>\n owned(\n database,\n configuration,\n Effect.gen(function* () {\n const transaction = yield* CurrentEmailSql;\n const journal = yield* CurrentCommitJournal;\n\n const c = commandColumns(mapping);\n const now = yield* nowMillis;\n\n const rows = yield* selectRows(\n transaction\n .select({ commandId: c.commandId })\n .from(mapping.command.table)\n .where(\n and(\n eq(c.moduleId, input.moduleId),\n lte(c.retentionUntil, mapping.encodeInstant(now)),\n ),\n )\n .limit(input.limit + 1),\n configuration.locking,\n );\n\n const selected = rows.slice(0, input.limit);\n\n const receipt = prepare(\n { removed: selected.length, hasMore: rows.length > input.limit },\n journal,\n );\n\n if (selected.length > 0)\n yield* transaction.delete(mapping.command.table).where(\n and(\n eq(c.moduleId, input.moduleId),\n inArray(\n c.commandId,\n selected.map((row: any) => row.commandId),\n ),\n lte(c.retentionUntil, mapping.encodeInstant(now)),\n ),\n );\n\n return receipt;\n }),\n ).pipe(\n Effect.provideService(CurrentEmailSql, database),\n Effect.provideService(LifecycleHooks, hooks),\n translateFailure,\n ),\n });\n });\n\n const mutateAddress = Effect.fn(\"Drizzle.mutateAddress\")(function* <A>(\n mapping: AddressMapping,\n configuration: EmailSqlConfiguration,\n uncaptured: EmailAddressMutation,\n action: EmailAction,\n prepare: (value: \"changed\" \| \"rejected\", journal: CommitJournal) => PreparedCommit<A>,\n ) {\n const database = yield* CurrentEmailSql;\n\n if (!validAddressConstraints(mapping) \|\| configuration.proof === undefined)\n return yield* unavailable();\n const input = yield* snapshotEmailMutation(uncaptured);\n\n const targetCredentialId = yield* allocate(\n configuration.mode,\n mapping.allocateCredentialId,\n mapping.allocateCredentialIdSync,\n );\n\n const targetIdentifierRevision = yield* allocate(\n configuration.mode,\n mapping.allocateRevision,\n mapping.allocateRevisionSync,\n );\n\n const targetCredentialRevision = yield* allocate(\n configuration.mode,\n mapping.allocateRevision,\n mapping.allocateRevisionSync,\n );\n\n const sourceIdentifierRevision = yield* allocate(\n configuration.mode,\n mapping.allocateRevision,\n mapping.allocateRevisionSync,\n );\n\n const sourceCredentialRevision = yield* allocate(\n configuration.mode,\n mapping.allocateRevision,\n mapping.allocateRevisionSync,\n );\n\n const confirmsExisting =\n action === \"verify-address\" && input.captured.targetIdentifierRevision !== undefined;\n\n const nextRevision = confirmsExisting\n ? input.captured.revision.securityRevision\n : yield* nextSecurityRevision(\n mapping,\n configuration.mode,\n input.captured.revision.securityRevision,\n );\n\n if (\n (!confirmsExisting && nextRevision === input.captured.revision.securityRevision) \|\|\n [\n targetIdentifierRevision,\n targetCredentialRevision,\n sourceIdentifierRevision,\n sourceCredentialRevision,\n ].some((value) => input.captured.revision.credentials.some((item) => item.revision === value))\n )\n return yield* unavailable();\n\n const run = owned(\n database,\n configuration,\n Effect.gen(function* () {\n const journal = yield* CurrentCommitJournal;\n\n const current = yield* validateEmailAuthority(mapping, configuration, input, action);\n\n if (current === undefined) return prepare(\"rejected\", journal);\n if (\n (yield* commandExists(mapping, input.moduleId, input.commandId, configuration.locking))\n .length > 0\n )\n return prepare(\"rejected\", journal);\n let receipt: PreparedCommit<A> \| undefined;\n\n yield* completeProofPlanIn(\n configuration.proof!.mapping,\n configuration.proof!.configuration,\n input.completion,\n Effect.gen(function* () {\n // The proof helper may wait on continuation/series locks. Read the\n // commit clock and reassess both policies only after those locks.\n const currentRequirement = yield* mapping.subject.decodeActionRequirement(\n current.subject,\n action,\n );\n\n const original = yield* assessAuthentication(\n input.authorization.evidence,\n input.authorization.requirement,\n ).pipe(Effect.mapError(unavailable));\n\n const configured = yield* assessAuthentication(\n input.authorization.evidence,\n currentRequirement,\n ).pipe(Effect.mapError(unavailable));\n\n if (!original.satisfied \|\| !configured.satisfied) return false;\n const now = yield* nowMillis;\n\n return yield* applyMutation(\n mapping,\n input,\n action,\n current,\n {\n targetCredentialId,\n targetIdentifierRevision,\n targetCredentialRevision,\n sourceIdentifierRevision,\n sourceCredentialRevision,\n nextSecurityRevision: nextRevision,\n },\n now,\n );\n }),\n (decision) => {\n receipt = prepare(decision === \"completed\" ? \"changed\" : \"rejected\", journal);\n\n return decision;\n },\n );\n\n return receipt ?? prepare(\"rejected\", journal);\n }),\n );\n\n return yield* run.pipe(\n Effect.catchCause((cause) =>\n (cause.reasons.every(Cause.isFailReason) &&\n isMappedConstraintConflict(mapping.isCommandConflict, cause)) \|\|\n (cause.reasons.every(Cause.isFailReason) &&\n isMappedConstraintConflict(mapping.isIdentifierConflict, cause)) \|\|\n (cause.reasons.every(Cause.isFailReason) &&\n isMappedConstraintConflict(mapping.isCredentialConflict, cause))\n ? prepareRejected(configuration, prepare)\n : Effect.failCause(cause),\n ),\n );\n });\n\n return {\n validEmailSignInConstraints,\n emailLookupQuery,\n decodeEmailSnapshot,\n makeSqlEmailSignInTargets,\n currentAddress,\n sameEmailRevision,\n snapshotEmailMutation,\n validateEmailAuthority,\n makeSqlEmailAddressPersistence,\n };\n};\n"],"mappings":";;;;;;;;;;AAmFA,IAAa,kBAAb,cAAqC,QAAQ,QAA2C,CAAC,CACvF,6BACF,CAAC,CAAC,CAAC;AA4BH,MAAa,mBAIX,YACA,WACG;CAGH,MAAM,EAAE,KAAK,IAAI,SAAS,KAAK,QAAQ,iBAAiB;CACxD,MAAM,EAAE,wBAAwB;CAChC,MAAM,oBAAoB,iBAAiB,KAAK,CAAC,CAAC;CAElD,MAAM,oBACJ,WAEA,yBACE,SACC,UACC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,sBAAsB,CAAC,CAAC,KAAK,CAC3C,CAAC,CAAC,KAAK,OAAO,YAAY,UAAU,OAAO,UAAU,MAAM,IAAI,aAAa,YAAY,CAAC,CAAC,CAAC,CAAC;CAE9F,MAAM,YAAY,OAAO,IAAI,SAAS,KAAK,SAAS,aAAa;CAEjE,MAAM,cAAc,OAAsB,YACxC,WAAW,OAAO,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,IAAI;CAErE,MAAM,kBAAkB,MAAuB,UAC7C,KAAK,cAAc,MAAM,aAAa,KAAK,UAAU,MAAM;CAE7D,MAAM,+BAA+B,YACnC,OAAO,QAAQ,8BAA8B,CAAC,CAAC,OAC5C,CAAC,KAAK,WACL,QAAQ,YAAY,SAAwD,KAChF;CAEF,MAAM,2BAA2B,YAC/B,OAAO,QAAQ,+BAA+B,CAAC,CAAC,OAC7C,CAAC,KAAK,WACL,QAAQ,YAAY,SAAyD,KACjF;CAEF,MAAM,kBAAkB,aAA4B;EAClD,IAAI,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,EAAE;EACpD,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;EAC5D,kBAAkB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,gBAAgB;CAClF;CAEA,MAAM,qBAAqB,aAA4B;EACrD,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;EACxE,OAAO,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,KAAK;EAChE,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;EACxE,YAAY,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,UAAU;EAC1E,iBAAiB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,eAAe;CACtF;CAEA,MAAM,qBAAqB,aAA4B;EACrD,UAAU,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,QAAQ;EACtE,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;EACxE,cAAc,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,YAAY;EAC9E,qBAAqB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,mBAAmB;EAC5F,iBAAiB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,eAAe;EACpF,oBAAoB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,kBAAkB;EAC1F,QAAQ,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,MAAM;CACpE;CAEA,MAAM,oBAAoB,aAA6B;EACrD,WAAW,OAAO,QAAQ,oBAAoB,OAAO,QAAQ,oBAAoB,SAAS;EAC1F,cAAc,OACZ,QAAQ,oBAAoB,OAC5B,QAAQ,oBAAoB,YAC9B;EACA,UAAU,OAAO,QAAQ,oBAAoB,OAAO,QAAQ,oBAAoB,QAAQ;EACxF,QAAQ,OAAO,QAAQ,oBAAoB,OAAO,QAAQ,oBAAoB,MAAM;CACtF;CAEA,MAAM,kBAAkB,aAA6B;EACnD,UAAU,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,QAAQ;EAChE,WAAW,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,SAAS;EAClE,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;EAC5D,eAAe,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,aAAa;EAC1E,gBAAgB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,cAAc;CAC9E;CAEA,MAAM,YACJ,MACA,cACA,gBACG;EACH,IAAI,SAAS,eACX,OAAO,gBAAgB,KAAA,IACnB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;GACT,KAAK;GACL,QAAQ,UAAU,IAAI,wBAAwB;IAAE,WAAW;IAAW;GAAM,CAAC;EAC/E,CAAC;EACP,IAAI,iBAAiB,KAAA,GAAW,OAAO;EAEvC,OAAO,gBAAgB,KAAA,IACnB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;GACT,KAAK;GACL,QAAQ,UAAU,IAAI,wBAAwB;IAAE,WAAW;IAAW;GAAM,CAAC;EAC/E,CAAC;CACP;CAEA,MAAM,wBACJ,SACA,MACA,YACG;EACH,IAAI,SAAS,eACX,OAAO,QAAQ,QAAQ,6BAA6B,KAAA,IAChD,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;GACT,WAAW,QAAQ,QAAQ,yBAA0B,OAAO;GAC5D,QAAQ,UAAU,IAAI,wBAAwB;IAAE,WAAW;IAAW;GAAM,CAAC;EAC/E,CAAC;EACP,IAAI,QAAQ,QAAQ,yBAAyB,KAAA,GAC3C,OAAO,QAAQ,QAAQ,qBAAqB,OAAO;EACrD,IAAI,QAAQ,QAAQ,6BAA6B,KAAA,GAC/C,OAAO,OAAO,IAAI;GAChB,WAAW,QAAQ,QAAQ,yBAA0B,OAAO;GAC5D,QAAQ,UAAU,IAAI,wBAAwB;IAAE,WAAW;IAAW;GAAM,CAAC;EAC/E,CAAC;EAEH,OAAO,OAAO,KAAK,YAAY,CAAC;CAClC;CAEA,MAAM,YACJ,UACA,eACA,SAEA,OAAO,IAAI,aAAa;EACtB,IAAI,cAAc,gBAAgB,MAAM;GACtC,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;GACrD,OAAO,cAAc;EACvB;EAEA,OAAO,OAAO,SAAS,aAAa,gBAClC,KAAK,KACH,OAAO,eAAe,iBAAiB,WAAW,GAClD,OAAO,eAAe,iBAAiB,WAA0C,CACnF,CACF;CACF,CAAC;CAEH,MAAM,SACJ,UACA,eACA,SACG;EACH,MAAM,MAAM,uBAER,SAAS,aAAa,gBACpB,KAAK,KACH,OAAO,eAAe,iBAAiB,WAAW,GAClD,OAAO,eAAe,iBAAiB,WAA0C,CACnF,CACF,GACF,EAAE,MAAM,cAAc,KAAK,CAC7B,CAAC,CAAC,KAAK,OAAO,KAAK,WAAW,OAAO,KAAK,CAAC;EAE3C,OAAO,cAAc,gBAAgB,OACjC,OAAO,IAAI,aAAa;GACtB,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;GACrD,OAAO,cAAc;GAErB,OAAO,OAAO;EAChB,CAAC,IACD;CACN;CAEA,MAAM,oBACJ,SACA,UACA,eACG;EACH,MAAM,UAAU,eAAe,OAAO,GACpC,UAAU,kBAAkB,OAAO,GACnC,aAAa,kBAAkB,OAAO;EAExC,OAAO;GACL,QAAQ;IACN,SAAS,QAAQ,QAAQ;IACzB,YAAY,QAAQ,WAAW;IAC/B,YAAY,QAAQ,WAAW;GACjC;GACA,MAAM,QAAQ,WAAW;GACzB,cAAc,QAAQ,QAAQ;GAC9B,aAAa,GAAG,QAAQ,IAAI,QAAQ,SAAS;GAC7C,iBAAiB,QAAQ,WAAW;GACpC,gBAAgB,IACd,GAAG,WAAW,UAAU,QAAQ,GAChC,GAAG,WAAW,WAAW,QAAQ,SAAS,GAC1C,GAAG,WAAW,qBAAqB,QAAQ,SAAS,GACpD,GAAG,WAAW,iBAAiB,QAAQ,KAAK,CAC9C;GACA,WAAW,IACT,GAAG,QAAQ,WAAW,WAAW,SAAS,GAC1C,GAAG,QAAQ,OAAO,WAAW,KAAK,CACpC;GACA,OAAO;EACT;CACF;CAEA,MAAM,kBAAkB,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,SACA,UACA,YACA;EACA,MAAM,WAAW,OAAO;EACxB,MAAM,QAAQ,iBAAiB,SAAS,UAAU,UAAU;EAE5D,OAAO,OAAO,SACX,OAAO,MAAM,MAAM,CAAC,CACpB,KAAK,MAAM,IAAI,CAAC,CAChB,UAAU,MAAM,cAAc,MAAM,WAAW,CAAC,CAChD,UAAU,MAAM,iBAAiB,MAAM,cAAc,CAAC,CACtD,MAAM,MAAM,SAAS,CAAC,CACtB,MAAM,MAAM,KAAK;CACtB,CAAC;CAED,MAAM,sBAAsB,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACnE,SACA,UACA,WACA,KACA;EACA,IACE,CAAC,QAAQ,QAAQ,eAAe,IAAI,QAAQ,QAAQ,QAAQ,OAAO,KACnE,CAAC,QAAQ,WAAW,UAAU,IAAI,UAAU,KAC5C,CAAC,QAAQ,WAAW,eAAe,IAAI,WAAW,QAAQ,WAAW,OAAO,GAE5E,OAAO,KAAA;EAET,MAAM,WAAW,OAAO,QAAQ,WAC7B,OAAO;GACN;GACA,SAAS,IAAI;GACb,YAAY,IAAI;GAChB,YAAY,IAAI;EAClB,CAAC,CAAC,CACD,KAAK,OAAO,QAAQ,uBAAuB,CAAC;EAE/C,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,IAAI,QAAQ,QAAQ,QAAQ,GAAG;EAEpF,MAAM,mBAAmB,OAAO,QAAQ,cACtC,IAAI,WAAW,QAAQ,WAAW,WACpC;EAEA,IACE,SAAS,aAAa,YACtB,CAAC,eAAe,SAAS,YAAY,SAAS,KAC9C,SAAS,SAAS,cAAc,aAChC,SAAS,SAAS,qBAAqB,IAAI,QAAQ,QAAQ,QAAQ,qBACnE,SAAS,uBAAuB,IAAI,WAAW,QAAQ,WAAW,oBAClE,SAAS,qBAAqB,oBAC9B,SAAS,iBAAiB,IAAI,WAAW,QAAQ,WAAW,iBAC5D,SAAS,uBAAuB,IAAI,WAAW,QAAQ,WAAW,qBAElE,OAAO,KAAA;EAET,OAAO;CACT,CAAC;CAED,MAAM,4BAA4B,OAAO,GAAG,2BAA2B,CAAC,CAAC,WACvE,SACA,eAKA;EACA,MAAM,WAAW,OAAO;EAExB,IAAI,CAAC,cAAc,aACjB,QACE,WAAW,kBAAkB;GAC3B,GAAG;GACH,OAAO,cAAc,OAAO;EAC9B,CAAC,KAAK,OAAO,KAAA,CACb,KAAK,OAAO,SAAS,WAAW,CAAC;EAErC,OAAO,mBAAmB,GAAG,EAC3B,SAAS,WACN,4BAA4B,OAAO,IAChC,SACE,UACA,eACA,OAAO,IAAI,aAAa;GACtB,MAAM,OAAO,OAAO,gBAAgB,SAAS,MAAM,UAAU,MAAM,UAAU,EAAA,CAAG;GAEhF,IAAI,QAAQ,KAAA,GAAW,OAAO,OAAO,KAAK;GAE1C,MAAM,WAAW,OAAO,oBACtB,SACA,MAAM,UACN,MAAM,YACN,GACF;GAEA,OAAO,aAAa,KAAA,IAAY,OAAO,KAAK,IAAI,OAAO,KAAK,QAAQ;EACtE,CAAC,CACH,IACA,OAAO,KAAK,YAAY,CAAC,EAAA,CAC3B,KAAK,OAAO,eAAe,iBAAiB,QAAQ,GAAG,gBAAgB,EAC7E,CAAC;CACH,CAAC;CAED,MAAM,cAAc,OAAO,GAAG,0BAA0B,CAAC,CAAC,WACxD,SACA,WACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,SAAgB;EAC1E,MAAM,IAAI,eAAe,OAAO;EAOhC,OAAO;GAAE;GAAiB,UALT,OAAO,WACtB,SAAS,OAAO,CAAC,CAAC,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAAC,MAAM,GAAG,EAAE,IAAI,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,GACtF,OACF,EAAA,CAAG;EAE+B;CACpC,CAAC;CAED,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,YACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EAEnC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,IAAI,GAAG,EAAE,WAAW,WAAW,SAAS,GAAG,GAAG,EAAE,OAAO,WAAW,KAAK,CAAC,CAAC,CAAC,CAChF,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,iBAAiB,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,UACA,cACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EAEnC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,IAAI,GAAG,EAAE,UAAU,QAAQ,GAAG,GAAG,EAAE,cAAc,YAAY,CAAC,CAAC,CAAC,CACtE,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,yBAAyB,OAAO,GAAG,gCAAgC,CAAC,CAAC,WACzE,SACA,UACA,YACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EAEnC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MACC,IACE,GAAG,EAAE,UAAU,QAAQ,GACvB,GAAG,EAAE,qBAAqB,WAAW,SAAS,GAC9C,GAAG,EAAE,iBAAiB,WAAW,KAAK,CACxC,CACF,CAAC,CACA,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,iBAAiB,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAC9D,SACA,OAMA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,SAAS,OAAO,YAAY,SAAS,MAAM,WAAW,OAAO;EAEnE,IACE,OAAO,YAAY,KAAA,KACnB,CAAC,QAAQ,QAAQ,eAAe,OAAO,QAAQ,QAAQ,QAAQ,OAAO,GAEtE,OAAO,KAAA;EAET,MAAM,mBACJ,MAAM,uBAAuB,KAAA,IACzB,KAAA,KACC,OAAO,eAAe,SAAS,MAAM,UAAU,MAAM,oBAAoB,KAAK,EAAA,CAAG;EAExF,MAAM,mBACJ,qBAAqB,KAAA,IACjB,KAAA,IACA;GACE,WAAW,iBAAiB,QAAQ,WAAW;GAC/C,OAAO,iBAAiB,QAAQ,WAAW;EAC7C;EAEN,MAAM,cAAc,CAClB,MAAM,QACN,GAAI,qBAAqB,KAAA,IAAY,CAAC,IAAI,CAAC,gBAAgB,CAC7D,CAAC,CACE,QACE,OAAO,OAAO,WACb,OAAO,WAAW,cAAc,eAAe,WAAW,KAAK,CAAC,MAAM,KAC1E,CAAC,CACA,MAAM,MAAM,UACX,GAAG,KAAK,UAAU,QAAQ,KAAK,QAAQ,cACrC,GAAG,MAAM,UAAU,QAAQ,MAAM,OACnC,CACF;EAEF,MAAM,oCAAoB,IAAI,IAAiB;EAE/C,KAAK,MAAM,cAAc,aAAa;GACpC,MAAM,OAAO,OAAO,cAAc,SAAS,YAAY,OAAO,EAAA,CAAG;GAEjE,IAAI,QAAQ,KAAA,GACV,kBAAkB,IAAI,GAAG,WAAW,UAAU,QAAQ,WAAW,SAAS,GAAG;EACjF;EAEA,MAAM,mBACJ,MAAM,uBAAuB,KAAA,IACzB,KAAA,KACC,OAAO,eAAe,SAAS,MAAM,UAAU,MAAM,oBAAoB,OAAO,EAAA,CAAG;EAE1F,MAAM,oBAAoB,OAAO,uBAC/B,SACA,MAAM,UACN,MAAM,QACN,OACF,EAAA,CAAG;EAEH,MAAM,IAAI,iBAAiB,OAAO;EAWlC,MAAM,mBAAkB,OATC,WACvB,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,oBAAoB,KAAK,CAAC,CACvC,MAAM,GAAG,EAAE,WAAW,OAAO,eAAe,CAAC,CAAC,CAC9C,QAAQ,EAAE,YAAY,GACzB,OACF,EAAA,CAEkC,QAAQ,QACxC,QAAQ,oBAAoB,eAAe,IAAI,QAAQ,oBAAoB,OAAO,CACpF;EAEA,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,OAAO,eAAe;EAE3E,MAAM,WAAmC,OAAO,OAAO;GACrD;GACA,kBAAkB,OAAO,QAAQ,QAAQ,QAAQ;GACjD,aAAa,OAAO,OAClB,gBAAgB,KAAK,QACnB,OAAO,OAAO;IACZ,cAAc,IAAI,QAAQ,oBAAoB;IAC9C,UAAU,IAAI,QAAQ,oBAAoB;GAC5C,CAAC,CACH,CACF;EACF,CAAC;EAED,MAAM,mBAAmB,kBAAkB,IACzC,GAAG,MAAM,OAAO,UAAU,QAAQ,MAAM,OAAO,OACjD;EASA,MAAM,gBANJ,qBAAqB,KAAA,KACrB,QAAQ,UAAU,OAChB,iBAAiB,QAAQ,WAAW,YACpC,OAAO,eACT,KAIA,QAAQ,WAAW,gBAAgB,gBAAgB,MAClD,qBAAqB,KAAA,KACnB,CAAC,QAAQ,WAAW,eAAe,iBAAiB,QAAQ,WAAW,OAAO,KAC7E,QAAQ,UAAU,OAChB,iBAAiB,QAAQ,WAAW,YACpC,OAAO,eACT;EAEN,IAAI;EAEJ,IAAI,MAAM,uBAAuB,KAAA,GAAW;GAC1C,IACE,qBAAqB,KAAA,KACrB,qBAAqB,KAAA,KACrB,CAAC,QAAQ,UAAU,OACjB,iBAAiB,QAAQ,WAAW,YACpC,OAAO,eACT,KACA,CAAC,QAAQ,WAAW,eAAe,iBAAiB,QAAQ,WAAW,OAAO,GAE9E,OAAO,KAAA;GAET,MAAM,sBAAsB,kBAAkB,IAC5C,GAAG,iBAAiB,UAAU,QAAQ,iBAAiB,OACzD;GAEA,IACE,wBAAwB,KAAA,KACxB,CAAC,QAAQ,WAAW,UAAU,mBAAmB,KACjD,CAAC,QAAQ,UAAU,OACjB,oBAAoB,QAAQ,WAAW,YACvC,OAAO,eACT,GAEA,OAAO,KAAA;GAWT,SAAS;IAAE,YAAY;IAAkB,YAAY;IAAqB,UAAA,OATlD,QAAQ,WAC7B,OAAO;KACN,UAAU,MAAM;KAChB,SAAS,OAAO;KAChB,YAAY;KACZ,YAAY;IACd,CAAC,CAAC,CACD,KAAK,OAAO,QAAQ,uBAAuB,CAAC;GAEoC;EACrF;EACA,IAAI,WAAW,qBAAqB,KAAA,IAAY,qBAAqB,KAAA,IAAY;EAEjF,IAAI,MAAM,uBAAuB,KAAA,KAAa,WAAW,KAAA,GAAW,WAAW;EAC/E,IAAI,WAAW,KAAA,KAAa,eAAe,OAAO,SAAS,YAAY,MAAM,MAAM,GACjF,WAAW;EACb,IAAI,QAAQ,uBAAuB,YAAY,MAAM,uBAAuB,KAAA,GAAW;GACrF,MAAM,IAAI,kBAAkB,OAAO;GAUnC,KACE,OATkB,WAClB,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,WAAW,OAAO,eAAe,CAAC,CAAC,GACrF,OACF,EAAA,CAGO,MAAM,QAAa,QAAQ,WAAW,eAAe,IAAI,QAAQ,WAAW,OAAO,CAAC,GAEzF,WAAW;EACf;EAEA,OAAO;GACL,iBAAiB,OAAO;GACxB,SAAS,OAAO;GAChB;GACA,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO;GACzC,GAAI,qBAAqB,KAAA,IAAY,CAAC,IAAI,EAAE,iBAAiB;GAC7D,GAAI,qBAAqB,KAAA,IAAY,CAAC,IAAI,EAAE,iBAAiB;GAC7D,GAAI,gBACA,EAAE,0BAA0B,iBAAiB,QAAQ,WAAW,iBAAiB,IACjF,CAAC;GACL;EACF;CACF,CAAC;CAED,MAAM,qBAAqB,MAA8B,UAAkC;EACzF,IACE,KAAK,cAAc,MAAM,aACzB,KAAK,qBAAqB,MAAM,oBAChC,KAAK,YAAY,WAAW,MAAM,YAAY,QAE9C,OAAO;EAET,MAAM,WAAW,CAAC,GAAG,KAAK,WAAW,CAAC,CAAC,MAAM,GAAG,MAC9C,EAAE,aAAa,cAAc,EAAE,YAAY,CAC7C;EAEA,MAAM,SAAS,CAAC,GAAG,MAAM,WAAW,CAAC,CAAC,MAAM,GAAG,MAC7C,EAAE,aAAa,cAAc,EAAE,YAAY,CAC7C;EAEA,OAAO,SAAS,OACb,MAAM,UACL,KAAK,iBAAiB,OAAO,MAAM,CAAE,gBACrC,KAAK,aAAa,OAAO,MAAM,CAAE,QACrC;CACF;CAEA,MAAM,gBAAgB,UAAkB,WACtC,GAAG,SAAS,GAAG,WAAW,mBAAmB,mBAAmB;CAElE,MAAM,iBAAiB,WACrB,WAAW,mBAAmB,+BAA+B;CAE/D,MAAM,qBAAqB,OAA6B,WAAwB;EAC9E,MAAM,aAAa,MAAM,WAAW;EACpC,MAAM,UAAU,WAAW;EAE3B,OACE,WAAW,aAAa,aAAa,MAAM,UAAU,MAAM,KAC3D,WAAW,YAAY,cAAc,MAAM,KAC3C,QAAQ,SAAS,sBACjB,eAAe,QAAQ,YAAY,MAAM,MAAM,KAC/C,kBAAkB,QAAQ,UAAU,MAAM,SAAS,QAAQ;CAE/D;CAEA,MAAM,wBAAwB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WACvE,OACA;EACA,MAAM,WAAW,OAAO,+BAA+B,MAAM,cAAc,QAAQ,CAAC,CAAC,KACnF,OAAO,SAAS,WAAW,CAC7B;EAEA,MAAM,cAAc,OAAO,yBAAyB,MAAM,cAAc,WAAW;EAEnF,MAAM,SACJ,MAAM,SAAS,WAAW,KAAA,IACtB,KAAA,IACA,OAAO,wBAAwB,MAAM,SAAS,MAAM;EAE1D,OAAO,OAAO,OAAO;GACnB,GAAG;GACH,QAAQ,OAAO,OAAO,EAAE,GAAG,MAAM,OAAO,CAAC;GACzC,GAAI,MAAM,iBAAiB,KAAA,IACvB,CAAC,IACD,EAAE,cAAc,OAAO,OAAO,EAAE,GAAG,MAAM,aAAa,CAAC,EAAE;GAC7D,UAAU,OAAO,OAAO;IACtB,UAAU,MAAM,SAAS;IACzB,UAAU,sBAAsB,MAAM,SAAS,QAAQ;IACvD,GAAI,MAAM,SAAS,6BAA6B,KAAA,IAC5C,CAAC,IACD,EAAE,0BAA0B,MAAM,SAAS,yBAAyB;IACxE,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO;GAC3C,CAAC;GACD,eAAe,OAAO,OAAO;IAC3B,WAAW,OAAO,OAAO;KACvB,GAAG,MAAM,cAAc;KACvB,QAAQ,OAAO,OAAO,EAAE,GAAG,MAAM,cAAc,UAAU,OAAO,CAAC;KACjE,UAAU,sBAAsB,MAAM,cAAc,UAAU,QAAQ;IACxE,CAAC;IACD;IACA;GACF,CAAC;EACH,CAAC;CACH,CAAC;CAED,MAAM,yBAAyB,OAAO,GAAG,gCAAgC,CAAC,CAAC,WACzE,SACA,eACA,OACA,QACA;EACA,MAAM,mBACJ,WAAW,oBAAoB,MAAM,SAAS,6BAA6B,KAAA;EAE7E,IACE,CAAC,MAAM,SAAS,YAChB,CAAC,kBAAkB,OAAO,MAAM,KAChC,MAAM,cAAc,UAAU,aAAa,MAAM,YACjD,MAAM,cAAc,UAAU,WAAW,UACzC,MAAM,cAAc,UAAU,cAAc,MAAM,aAClD,CAAC,eAAe,MAAM,cAAc,UAAU,QAAQ,MAAM,MAAM,KAClE,MAAM,cAAc,UAAU,uBAAuB,MAAM,SAAS,QAAQ,gBAC5E,CAAC,kBAAkB,MAAM,cAAc,UAAU,UAAU,MAAM,SAAS,QAAQ,KAClF,MAAM,cAAc,UAAU,6BAC5B,MAAM,SAAS,4BAChB,MAAM,cAAc,SAAS,WAAuB,MAAM,aAC3D,MAAM,cAAc,SAAS,kBAAkB,MAAM,cAAc,UAAU,iBAC7E,CAAC,kBAAkB,MAAM,cAAc,SAAS,UAAU,MAAM,SAAS,QAAQ,KAChF,WAAW,oBAAoB,MAAM,SAAS,WAAW,KAAA,KACzD,WAAW,oBAAoB,MAAM,SAAS,WAAW,KAAA,KAC1D,sBAAsB,MAAM,iBAAiB,KAAA,OAC3C,MAAM,cAAc,qBAAqB,eACzC,MAAM,cAAc,qBAAqB,mBACzC,QAAQ,wBAAwB,4BAElC,OAAO,KAAA;EAET,MAAM,UAAU,OAAO,eACrB,SACA;GACE,UAAU,MAAM;GAChB,WAAW,MAAM,SAAS,SAAS;GACnC,QAAQ,MAAM;GACd,GAAI,MAAM,SAAS,WAAW,KAAA,IAC1B,CAAC,IACD,EAAE,oBAAoB,MAAM,SAAS,OAAO,aAAa;EAC/D,GACA,cAAc,OAChB;EAEA,IACE,YAAY,KAAA,KACZ,CAAC,QAAQ,YACT,CAAC,kBAAkB,QAAQ,UAAU,MAAM,SAAS,QAAQ,KAC5D,QAAQ,6BAA6B,MAAM,SAAS,4BACnD,MAAM,SAAS,WAAW,KAAA,MACxB,QAAQ,WAAW,KAAA,KAClB,QAAQ,OAAO,SAAS,uBAAuB,MAAM,SAAS,OAAO,sBACrE,QAAQ,OAAO,SAAS,uBAAuB,MAAM,SAAS,OAAO,sBACrE,CAAC,eAAe,QAAQ,OAAO,SAAS,YAAY,MAAM,SAAS,OAAO,UAAU,IAExF,OAAO,KAAA;EAET,MAAM,qBAAqB,OAAO,QAAQ,QAAQ,wBAChD,QAAQ,SACR,MACF;EAEA,MAAM,WAAW,OAAO,qBACtB,MAAM,cAAc,UACpB,MAAM,cAAc,WACtB,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;EAEnC,MAAM,aAAa,OAAO,qBACxB,MAAM,cAAc,UACpB,kBACF,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;EAEnC,OAAO,SAAS,aAAa,WAAW,YAAY,UAAU,KAAA;CAChE,CAAC;CAED,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,UACA,WACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,eAAe,OAAO;EAEhC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,IAAI,GAAG,EAAE,UAAU,QAAQ,GAAG,GAAG,EAAE,WAAW,SAAS,CAAC,CAAC,CAAC,CAChE,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,gBAAgB,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAC5D,SACA,OACA,QACA,SACA,WAQA,KACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EACnC,MAAM,IAAI,kBAAkB,OAAO;EACnC,MAAM,IAAI,iBAAiB,OAAO;EAClC,MAAM,IAAI,eAAe,OAAO;EAEhC,MAAM,qBACJ,QAAQ,mBAAmB,QAAQ,WAAW,iBAAiB,UAAU;EAE3E,IAAI,WAAW,kBAAkB;GAC/B,MAAM,SAAS,QAAQ;GAEvB,OAAO,SACJ,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,IACC,QAAQ,WAAW,iBAAiB;IAClC,QAAQ,OAAO,SAAS;IACxB,iBAAiB,UAAU;GAC7B,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,EAAE,WAAW,OAAO,SAAS,WAAW,SAAS,GACpD,GAAG,EAAE,OAAO,OAAO,SAAS,WAAW,KAAK,GAC5C,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,iBAAiB,OAAO,SAAS,kBAAkB,CAC1D,CACF;GACF,OAAO,SACJ,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,IACC,QAAQ,WAAW,iBAAiB;IAClC,QAAQ,OAAO,SAAS;IACxB,oBAAoB,UAAU;GAChC,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,cAAc,OAAO,SAAS,YAAY,GAC/C,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,oBAAoB,OAAO,SAAS,kBAAkB,CAC7D,CACF;GACF,OAAO,SACJ,OAAO,QAAQ,oBAAoB,KAAK,CAAC,CACzC,IAAI,QAAQ,oBAAoB,iBAAiB,UAAU,wBAAwB,CAAC,CAAC,CACrF,MACC,IACE,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,cAAc,OAAO,SAAS,YAAY,GAC/C,GAAG,EAAE,UAAU,OAAO,SAAS,kBAAkB,CACnD,CACF;EACJ;EACA,IAAI,QAAQ,qBAAqB,KAAA,GAC/B,OAAO,SAAS,OAAO,QAAQ,WAAW,KAAK,CAAC,CAAC,OAC/C,QAAQ,WAAW,qBAAqB;GACtC,YAAY,MAAM;GAClB,WAAW,QAAQ;GACnB,kBAAkB;GAClB,iBAAiB,UAAU;EAC7B,CAAC,CACH;OAEA,OAAO,SACJ,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,IACC,QAAQ,WAAW,mBAAmB;GACpC,kBAAkB;GAClB,iBAAiB,UAAU;EAC7B,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,EAAE,WAAW,MAAM,OAAO,SAAS,GACtC,GAAG,EAAE,OAAO,MAAM,OAAO,KAAK,GAC9B,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,iBAAiB,QAAQ,iBAAkB,QAAQ,WAAW,gBAAgB,CACrF,CACF;EAEJ,IAAI,QAAQ,qBAAqB,KAAA,GAAW;GAC1C,OAAO,SAAS,OAAO,QAAQ,WAAW,KAAK,CAAC,CAAC,OAC/C,QAAQ,WAAW,qBAAqB;IACtC,UAAU,MAAM;IAChB,WAAW,QAAQ;IACnB,cAAc;IACd,YAAY,MAAM;IAClB,oBAAoB,UAAU;GAChC,CAAC,CACH;GACA,OAAO,SAAS,OAAO,QAAQ,oBAAoB,KAAK,CAAC,CAAC,OACxD,QAAQ,oBAAoB,aAAa;IACvC,WAAW,QAAQ;IACnB,cAAc;IACd,UAAU,UAAU;GACtB,CAAC,CACH;EACF,OAAO;GACL,MAAM,cAAc,QAAQ,iBAAiB,QAAQ,WAAW;GAEhE,OAAO,SACJ,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,IACC,QAAQ,WAAW,iBAAiB;IAClC,YAAY,MAAM;IAClB,oBAAoB,UAAU;GAChC,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,cAAc,kBAAkB,GACrC,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,oBAAoB,WAAW,CACtC,CACF;GACF,OAAO,SACJ,OAAO,QAAQ,oBAAoB,KAAK,CAAC,CACzC,IAAI,QAAQ,oBAAoB,iBAAiB,UAAU,wBAAwB,CAAC,CAAC,CACrF,MACC,IACE,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,cAAc,kBAAkB,GACrC,GAAG,EAAE,UAAU,WAAW,CAC5B,CACF;EACJ;EACA,OAAO,SACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,IAAI,aAAa,CAAC,CAAC,QAAQ,QAAQ,kBAAkB,UAAU,oBAAoB,CAAC,CAAC,CAAC,CAAC,CACvF,MACC,IACE,GAAG,EAAE,IAAI,QAAQ,eAAe,GAChC,GAAG,EAAE,kBAAkB,MAAM,SAAS,SAAS,gBAAgB,CACjE,CACF;EACF,OAAO,SAAS,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,OAC5C,QAAQ,QAAQ,aAAa;GAC3B,UAAU,MAAM;GAChB,WAAW,MAAM;GACjB;GACA,eAAe,MAAM,cAAc,UAAU;GAC7C,sBAAsB,MAAM,QAAQ;EACtC,CAAC,CACH;EAEA,MAAM,oBACJ,WAAW,mBACP,CAAC,IACD,OAAO,WACL,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,cAAc,QAAQ,OAAQ,SAAS,YAAY,GACxD,GAAG,EAAE,WAAW,QAAQ,eAAe,CACzC,CACF,GACF,KACF;EAEN,MAAM,UAAU,OAAO,gBAAgB,SAAS,MAAM,UAAU,MAAM,MAAM,EAAA,CAAG;EAE/E,MAAM,kBAAkB,OAAO,WAC7B,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,oBAAoB,KAAK,CAAC,CACvC,MACC,IAAI,GAAG,EAAE,WAAW,QAAQ,eAAe,GAAG,GAAG,EAAE,cAAc,kBAAkB,CAAC,CACtF,CAAC,CACA,MAAM,CAAC,GACV,KACF;EAEA,MAAM,UAAU,OAAO,WACrB,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MACC,IACE,GAAG,eAAe,OAAO,CAAC,CAAC,UAAU,MAAM,QAAQ,GACnD,GAAG,eAAe,OAAO,CAAC,CAAC,WAAW,MAAM,SAAS,GACrD,GAAG,eAAe,OAAO,CAAC,CAAC,QAAQ,MAAM,GACzC,GAAG,eAAe,OAAO,CAAC,CAAC,eAAe,MAAM,cAAc,UAAU,aAAa,GACrF,GACE,eAAe,OAAO,CAAC,CAAC,gBACxB,QAAQ,cAAc,MAAM,QAAQ,sBAAsB,CAC5D,CACF,CACF,CAAC,CACA,MAAM,CAAC,GACV,KACF;EAEA,MAAM,mBACJ,WAAW,KAAA,IACP,KAAA,IACA,OAAO,QAAQ,cAAc,OAAO,WAAW,QAAQ,WAAW,WAAW;EAEnF,MAAM,mBACJ,WAAW,mBACP,CAAC,IACD,OAAO,cAAc,SAAS,QAAQ,OAAQ,SAAS,YAAY,KAAK;EAE9E,MAAM,kBACJ,WAAW,mBACP,CAAC,IACD,OAAO,WACL,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,oBAAoB,KAAK,CAAC,CACvC,MACC,IACE,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,cAAc,QAAQ,OAAQ,SAAS,YAAY,CAC1D,CACF,CAAC,CACA,MAAM,CAAC,GACV,KACF;EAEN,OACE,WAAW,KAAA,KACX,QAAQ,UAAU,OAAO,OAAO,QAAQ,QAAQ,QAAQ,KAAK,QAAQ,eAAe,KACpF,QAAQ,QAAQ,eAAe,OAAO,QAAQ,QAAQ,QAAQ,OAAO,KACrE,OAAO,QAAQ,QAAQ,QAAQ,sBAAsB,UAAU,wBAC/D,OAAO,WAAW,QAAQ,WAAW,qBACnC,UAAU,4BACZ,qBAAqB,OACrB,OAAO,WAAW,QAAQ,WAAW,wBACnC,UAAU,4BACZ,OAAO,WAAW,QAAQ,WAAW,kBAAkB,sBACvD,QAAQ,UAAU,OAChB,OAAO,WAAW,QAAQ,WAAW,YACrC,QAAQ,eACV,KACA,QAAQ,WAAW,UAAU,OAAO,UAAU,KAC9C,QAAQ,WAAW,eAAe,OAAO,WAAW,QAAQ,WAAW,OAAO,KAC9E,gBAAgB,WAAW,KAC3B,gBAAgB,EAAE,CAAE,QAAQ,oBAAoB,cAC9C,UAAU,4BACZ,QAAQ,oBAAoB,eAC1B,gBAAgB,EAAE,CAAE,QAAQ,oBAAoB,OAClD,KACA,QAAQ,WAAW,MAClB,WAAW,oBACT,kBAAkB,WAAW,KAC5B,kBAAkB,EAAE,CAAE,QAAQ,WAAW,wBACvC,UAAU,4BACZ,CAAC,QAAQ,WAAW,eAAe,kBAAkB,EAAE,CAAE,QAAQ,WAAW,OAAO,KACnF,iBAAiB,WAAW,KAC5B,QAAQ,UAAU,OAChB,iBAAiB,EAAE,CAAE,QAAQ,WAAW,YACxC,QAAQ,eACV,KACA,iBAAiB,EAAE,CAAE,QAAQ,WAAW,qBACtC,UAAU,4BACZ,CAAC,QAAQ,WAAW,UAAU,iBAAiB,EAAG,KAClD,gBAAgB,WAAW,KAC3B,gBAAgB,EAAE,CAAE,QAAQ,oBAAoB,cAC9C,UAAU,4BACZ,CAAC,QAAQ,oBAAoB,eAC3B,gBAAgB,EAAE,CAAE,QAAQ,oBAAoB,OAClD;CAER,CAAC;CAED,MAAM,uBAAuB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACrE,eACA,OACA;EACA,MAAM,WAAW,OAAO;EAExB,IAAI,cAAc,UAAU,KAAA,GAAW,OAAO,OAAO,OAAO,KAAK,YAAY,CAAC;EAC9E,MAAM,aAAa,EAAE,MAAM,4BAA4B;EAEvD,MAAM,OAAO;GACX;GACA,UACE,UACA,SACA,YACG,QAAQ,QAAQ,QAAQ,QAAQ,CAAC;EACxC;EAkBA,OAAO,OAhBO,uBAEV,SAAS,aAAa,gBACpB,oBACE,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MACA,OAAO,KAAK,UAAU,SAChB,KACR,CAAC,CAAC,KACA,OAAO,eAAe,iBAAiB,WAA0C,CACnF,CACF,GACF,EAAE,MAAM,cAAc,KAAK,CAGX,CAAC,CAAC,KAClB,OAAO,GAAG,KAAK,GACf,OAAO,YAAY,UAAU;GAC3B,MAAM,SAAS,MAAM,QAAQ;GAE7B,OAAO,MAAM,QAAQ,WAAW,KAC9B,WAAW,KAAA,KACX,MAAM,aAAa,MAAM,KACzB,OAAO,UAAU,aACf,OAAO,QAAQ,IAAI,IACnB,OAAO,UAAU,KAAK;EAC5B,CAAC,CACH;CACF,CAAC;CAED,MAAM,kBAAkB,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,eACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,OAAO,OAAO,MACZ,UACA,eACA,OAAO,IAAI,aAAa;GACtB,MAAM,UAAU,OAAO;GAEvB,OAAO,OAAO,OAAO,QAAQ,QAAQ,YAAY,OAAO,CAAC;EAC3D,CAAC,CACH;CACF,CAAC;CAED,MAAM,iCAAiC,OAAO,GAAG,gCAAgC,CAAC,CAAC,WACjF,SACA,eAKA;EACA,MAAM,WAAW,OAAO;EAExB,IAAI,CAAC,cAAc,aACjB,QACE,WAAW,kBAAkB;GAC3B,GAAG;GACH,OAAO,cAAc,OAAO;EAC9B,CAAC,KAAK,OAAO,KAAA,CACb,KAAK,OAAO,SAAS,WAAW,CAAC;EACrC,MAAM,QAAQ,OAAO;EAErB,OAAO,wBAAwB,GAAG;GAChC,SAAS,WACN,wBAAwB,OAAO,IAC5B,SACE,UACA,eACA,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO,eAAe,SAAS,OAAO,cAAc,OAAO;IAE3E,IAAI,YAAY,KAAA,GAAW,OAAO,OAAO,YAAY;IAErD,OAAO,OAAO,OAAO;KACnB,UAAU,sBAAsB,QAAQ,QAAQ;KAChD,UAAU,QAAQ;KAClB,GAAI,QAAQ,6BAA6B,KAAA,IACrC,CAAC,IACD,EAAE,0BAA0B,QAAQ,yBAAyB;KACjE,GAAI,QAAQ,WAAW,KAAA,IACnB,CAAC,IACD,EAAE,QAAQ,OAAO,wBAAwB,QAAQ,OAAO,QAAQ,EAAE;IACxE,CAAC;GACH,CAAC,CACH,IACA,OAAO,KAAK,YAAY,CAAC,EAAA,CAC3B,KACA,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,kBAAkB,UAAU;IAC1B,IAAI,cAAc,UAAU,KAAA,KAAa,MAAM,QAAQ,SAAS,oBAC9D,OAAO,OAAO,QAAQ,KAAK,CAAC,CAAC,KAC3B,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;IACF,MAAM,UAAU,MAAM;IAEtB,OAAO,SACL,UACA,eACA,OAAO,IAAI,aAAa;KACtB,MAAM,SACJ,MAAM,SAAS,SAAS,iBAAiB,KACzC,MAAM,YAAY,+BACd,mBACA,MAAM,SAAS,SAAS,iBAAiB,KACvC,MAAM,YAAY,yBAClB,mBACA,KAAA;KAER,IAAI,WAAW,KAAA,GAAW,OAAO;KACjC,MAAM,WAAW,MAAM,SAAS,MAAM,GAAG,CAAC,IAAI,SAAS,MAAM;KAE7D,MAAM,UAAU,OAAO,eACrB,SACA;MACE;MACA,WAAW,QAAQ,SAAS;MAC5B,QAAQ,QAAQ;KAClB,GACA,KACF;KAEA,OAAO,YAAY,KAAA,KAAa,kBAAkB,QAAQ,UAAU,QAAQ,QAAQ;IACtF,CAAC,CACH,CAAC,CACE,KACC,OAAO,SAAS,YACd,UAAU,qBAAqB,eAAe,KAAK,IAAI,OAAO,QAAQ,KAAK,CAC7E,CACF,CAAC,CACA,KACC,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACJ;GACA,kBAAkB,YAAY,YAC5B,cAAc,SAAS,eAAe,YAAY,kBAAkB,OAAO,CAAC,CAAC,KAC3E,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,kBAAkB,YAAY,YAC5B,cAAc,SAAS,eAAe,YAAY,kBAAkB,OAAO,CAAC,CAAC,KAC3E,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,UAAU,OAAO,YACf,MACE,UACA,eACA,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IAEvB,MAAM,IAAI,eAAe,OAAO;IAChC,MAAM,MAAM,OAAO;IAEnB,MAAM,OAAO,OAAO,WAClB,YACG,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAClC,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,IAAI,EAAE,gBAAgB,QAAQ,cAAc,GAAG,CAAC,CAClD,CACF,CAAC,CACA,MAAM,MAAM,QAAQ,CAAC,GACxB,cAAc,OAChB;IAEA,MAAM,WAAW,KAAK,MAAM,GAAG,MAAM,KAAK;IAE1C,MAAM,UAAU,QACd;KAAE,SAAS,SAAS;KAAQ,SAAS,KAAK,SAAS,MAAM;IAAM,GAC/D,OACF;IAEA,IAAI,SAAS,SAAS,GACpB,OAAO,YAAY,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,MAC/C,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,QACE,EAAE,WACF,SAAS,KAAK,QAAa,IAAI,SAAS,CAC1C,GACA,IAAI,EAAE,gBAAgB,QAAQ,cAAc,GAAG,CAAC,CAClD,CACF;IAEF,OAAO;GACT,CAAC,CACH,CAAC,CAAC,KACA,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACJ,CAAC;CACH,CAAC;CAED,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,eACA,YACA,QACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,IAAI,CAAC,wBAAwB,OAAO,KAAK,cAAc,UAAU,KAAA,GAC/D,OAAO,OAAO,YAAY;EAC5B,MAAM,QAAQ,OAAO,sBAAsB,UAAU;EAErD,MAAM,qBAAqB,OAAO,SAChC,cAAc,MACd,QAAQ,sBACR,QAAQ,wBACV;EAEA,MAAM,2BAA2B,OAAO,SACtC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;EAEA,MAAM,2BAA2B,OAAO,SACtC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;EAEA,MAAM,2BAA2B,OAAO,SACtC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;EAEA,MAAM,2BAA2B,OAAO,SACtC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;EAEA,MAAM,mBACJ,WAAW,oBAAoB,MAAM,SAAS,6BAA6B,KAAA;EAE7E,MAAM,eAAe,mBACjB,MAAM,SAAS,SAAS,mBACxB,OAAO,qBACL,SACA,cAAc,MACd,MAAM,SAAS,SAAS,gBAC1B;EAEJ,IACG,CAAC,oBAAoB,iBAAiB,MAAM,SAAS,SAAS,oBAC/D;GACE;GACA;GACA;GACA;EACF,CAAC,CAAC,MAAM,UAAU,MAAM,SAAS,SAAS,YAAY,MAAM,SAAS,KAAK,aAAa,KAAK,CAAC,GAE7F,OAAO,OAAO,YAAY;EAsE5B,OAAO,OApEK,MACV,UACA,eACA,OAAO,IAAI,aAAa;GACtB,MAAM,UAAU,OAAO;GAEvB,MAAM,UAAU,OAAO,uBAAuB,SAAS,eAAe,OAAO,MAAM;GAEnF,IAAI,YAAY,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;GAC7D,KACG,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,WAAW,cAAc,OAAO,EAAA,CAClF,SAAS,GAEZ,OAAO,QAAQ,YAAY,OAAO;GACpC,IAAI;GAEJ,OAAO,oBACL,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MAAM,YACN,OAAO,IAAI,aAAa;IAGtB,MAAM,qBAAqB,OAAO,QAAQ,QAAQ,wBAChD,QAAQ,SACR,MACF;IAEA,MAAM,WAAW,OAAO,qBACtB,MAAM,cAAc,UACpB,MAAM,cAAc,WACtB,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;IAEnC,MAAM,aAAa,OAAO,qBACxB,MAAM,cAAc,UACpB,kBACF,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;IAEnC,IAAI,CAAC,SAAS,aAAa,CAAC,WAAW,WAAW,OAAO;IACzD,MAAM,MAAM,OAAO;IAEnB,OAAO,OAAO,cACZ,SACA,OACA,QACA,SACA;KACE;KACA;KACA;KACA;KACA;KACA,sBAAsB;IACxB,GACA,GACF;GACF,CAAC,IACA,aAAa;IACZ,UAAU,QAAQ,aAAa,cAAc,YAAY,YAAY,OAAO;IAE5E,OAAO;GACT,CACF;GAEA,OAAO,WAAW,QAAQ,YAAY,OAAO;EAC/C,CAAC,CAGa,CAAC,CAAC,KAChB,OAAO,YAAY,UAChB,MAAM,QAAQ,MAAM,MAAM,YAAY,KACrC,2BAA2B,QAAQ,mBAAmB,KAAK,KAC5D,MAAM,QAAQ,MAAM,MAAM,YAAY,KACrC,2BAA2B,QAAQ,sBAAsB,KAAK,KAC/D,MAAM,QAAQ,MAAM,MAAM,YAAY,KACrC,2BAA2B,QAAQ,sBAAsB,KAAK,IAC5D,gBAAgB,eAAe,OAAO,IACtC,OAAO,UAAU,KAAK,CAC5B,CACF;CACF,CAAC;CAED,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF"}

package/dist/internal/models/password-model.d.mts CHANGED Viewed

@@ -133,7 +133,8 @@ export interface PasswordPersistenceMapping<Subject extends TableModel, Identifi
   readonly allocateRevision?: Effect.Effect<SecurityRevision, PersistenceMappingError>;
   readonly allocateRevisionSync?: () => SecurityRevision;
   readonly commandRetentionMillis: number;
-  /** All semantic replacements still bump subject revision. This flag only declares bearer invalidation latency. */
+  /** All semantic replacements still bump subject revision. This flag declares
+   * authoritative verification's invalidation latency; cookie exposure is separate. */
   readonly sessionInvalidation: "same-authority-immediate" | "original-absolute-expiry";
   readonly d1?: PasswordD1Clock<Expression>;
 }

package/dist/internal/models/password-model.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"password-model.mjs","names":[],"sources":["../../../src/internal/models/password-model.ts"],"sourcesContent":["import { type RecoveryReference, type LoginIdentifier } from \"@yielded/auth/Identity\";\nimport type {\n PasswordAction,\n PasswordCredentialSnapshot,\n PasswordReplacement,\n PasswordRegistrationDecision,\n EncodedPasswordHash,\n} from \"@yielded/auth/Password\";\nimport type { AuthenticationRequirement, SecurityRevision } from \"@yielded/auth/Sessions\";\nimport type { Effect, Redacted } from \"effect\";\n\nimport type { AnyTableModel, TableModel as Table, SqlExpression } from \"../query-operations\";\nimport type { PersistenceMappingError, SubjectIdCodec } from \"./common\";\n\ntype ColumnKey<T extends Table> = T[\"column\"];\n\nexport interface PasswordSubjectTable<Subject extends Table, _NativeSubjectId> {\n readonly table: Subject[\"table\"];\n readonly id: ColumnKey<Subject>;\n readonly status: ColumnKey<Subject>;\n readonly securityRevision: ColumnKey<Subject>;\n readonly isActiveStatus: (value: unknown) => boolean;\n readonly decodeRequirement: (\n row: Subject[\"select\"],\n ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n /** Current policy for this exact credential mutation, decoded under the subject lock. /\n readonly decodeActionRequirement: (\n row: Subject[\"select\"],\n action: PasswordAction,\n ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n readonly nextSecurityRevision?: (\n current: SecurityRevision,\n ) => Effect.Effect<SecurityRevision, PersistenceMappingError>;\n readonly nextSecurityRevisionSync?: (current: SecurityRevision) => SecurityRevision;\n /* Required only by D1 conditional statements. /\n readonly d1ActiveStatusValue?: unknown;\n}\n\nexport interface PasswordIdentifierTable<\n Identifier extends Table,\n NativeSubjectId,\n Expression extends SqlExpression = SqlExpression,\n> {\n readonly table: Identifier[\"table\"];\n readonly namespace: ColumnKey<Identifier>;\n readonly value: ColumnKey<Identifier>;\n readonly subjectId: ColumnKey<Identifier>;\n readonly verifiedAt: ColumnKey<Identifier>;\n readonly bindingRevision: ColumnKey<Identifier>;\n /* Consumer-owned current login/recovery eligibility, including row status. /\n readonly isCurrent: (row: Identifier[\"select\"]) => boolean;\n /* Required by D1 so current ownership/eligibility is rechecked in the batch. /\n readonly d1CurrentCondition?: (input: {\n readonly identifier: LoginIdentifier;\n readonly nativeSubjectId: NativeSubjectId;\n }) => Expression;\n readonly encodeInitialInsert: (\n identifier: LoginIdentifier,\n subjectId: NativeSubjectId,\n bindingRevision: SecurityRevision,\n ) => Identifier[\"insert\"];\n}\n\nexport interface PasswordAuthorityCredentialTable<Credential extends Table, NativeSubjectId> {\n readonly table: Credential[\"table\"];\n readonly subjectId: ColumnKey<Credential>;\n readonly credentialId: ColumnKey<Credential>;\n readonly revision: ColumnKey<Credential>;\n readonly status?: ColumnKey<Credential>;\n readonly isActiveStatus?: (value: unknown) => boolean;\n readonly d1ActiveStatusValue?: unknown;\n readonly encodeInsert: (input: {\n readonly subjectId: NativeSubjectId;\n readonly credentialId: string;\n readonly revision: SecurityRevision;\n }) => Credential[\"insert\"];\n readonly encodeRevision: (revision: SecurityRevision) => Partial<Credential[\"insert\"]>;\n}\n\nexport interface PasswordCredentialTable<\n Subject extends Table,\n Identifier extends Table,\n Credential extends Table,\n NativeSubjectId,\n> {\n readonly table: Credential[\"table\"];\n readonly moduleId: ColumnKey<Credential>;\n readonly subjectId: ColumnKey<Credential>;\n readonly credentialId: ColumnKey<Credential>;\n readonly credentialRevision: ColumnKey<Credential>;\n readonly verifierVersion: ColumnKey<Credential>;\n readonly verifier: ColumnKey<Credential>;\n readonly normalization: ColumnKey<Credential>;\n readonly encodeInsert: (input: {\n readonly moduleId: string;\n readonly subjectId: NativeSubjectId;\n readonly credentialId: string;\n readonly credentialRevision: SecurityRevision;\n readonly verifierVersion: SecurityRevision;\n readonly replacement: PasswordReplacement;\n }) => Credential[\"insert\"];\n readonly encodeVerifier: (\n verifier: Redacted.Redacted<EncodedPasswordHash>,\n verifierVersion: SecurityRevision,\n ) => Partial<Credential[\"insert\"]>;\n readonly encodeReplacement: (input: {\n readonly replacement: PasswordReplacement;\n readonly credentialRevision: SecurityRevision;\n readonly verifierVersion: SecurityRevision;\n }) => Partial<Credential[\"insert\"]>;\n readonly decode: (input: {\n readonly moduleId: string;\n readonly subject: Subject[\"select\"];\n readonly identifier: Identifier[\"select\"];\n readonly credential: Credential[\"select\"];\n }) => Effect.Effect<PasswordCredentialSnapshot, PersistenceMappingError>;\n}\n\nexport interface PasswordCommandTable<Command extends Table> {\n readonly table: Command[\"table\"];\n readonly moduleId: ColumnKey<Command>;\n readonly commandId: ColumnKey<Command>;\n readonly action: ColumnKey<Command>;\n readonly bindingDigest: ColumnKey<Command>;\n readonly decision: ColumnKey<Command>;\n readonly retentionUntil: ColumnKey<Command>;\n readonly encodeInsert: (input: {\n readonly moduleId: string;\n readonly commandId: string;\n readonly action: string;\n readonly bindingDigest: string;\n readonly decision: \"changed\";\n readonly retentionUntilMillis: number;\n }) => Command[\"insert\"];\n}\n\nexport interface RequiredPasswordConstraints {\n readonly identifier: \"unique(identifier.namespace,identifier.value)\";\n readonly authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\";\n readonly credentialSubject: \"unique(credential.moduleId,credential.subjectId)\";\n readonly credentialId: \"unique(credential.moduleId,credential.credentialId)\";\n readonly command: \"unique(command.moduleId,command.commandId)\";\n}\n\nexport const requiredPasswordConstraints: RequiredPasswordConstraints = {\n identifier: \"unique(identifier.namespace,identifier.value)\",\n authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\",\n credentialSubject: \"unique(credential.moduleId,credential.subjectId)\",\n credentialId: \"unique(credential.moduleId,credential.credentialId)\",\n command: \"unique(command.moduleId,command.commandId)\",\n};\n\nexport interface PasswordConstraintClassifier {\n /* Match only the mapped command uniqueness constraint. /\n readonly isCommandConflict: (cause: unknown) => boolean;\n}\n\nexport interface PasswordD1Clock<Expression extends SqlExpression = SqlExpression> {\n readonly engineNow: Expression;\n readonly engineNowMillis: Expression;\n readonly engineInstantMinus: (millis: number) => Expression;\n readonly engineInstantPlus: (millis: number) => Expression;\n}\n\nexport interface PasswordPersistenceMapping<\n Subject extends Table,\n Identifier extends Table,\n Credential extends Table,\n AuthorityCredential extends Table,\n Command extends Table,\n NativeSubjectId,\n Expression extends SqlExpression = SqlExpression,\n> extends PasswordConstraintClassifier {\n readonly subject: PasswordSubjectTable<Subject, NativeSubjectId>;\n readonly identifier: PasswordIdentifierTable<Identifier, NativeSubjectId, Expression>;\n readonly credential: PasswordCredentialTable<Subject, Identifier, Credential, NativeSubjectId>;\n /* Every factor revision named by action evidence, including non-password factors. /\n readonly authorityCredential: PasswordAuthorityCredentialTable<\n AuthorityCredential,\n NativeSubjectId\n >;\n readonly command: PasswordCommandTable<Command>;\n readonly subjectId: SubjectIdCodec<NativeSubjectId>;\n readonly constraints: RequiredPasswordConstraints;\n readonly encodeInstant: (epochMillis: number) => unknown;\n readonly decodeInstant: (native: unknown) => Effect.Effect<number, PersistenceMappingError>;\n readonly allocateCredentialId?: Effect.Effect<string, PersistenceMappingError>;\n readonly allocateCredentialIdSync?: () => string;\n readonly allocateRevision?: Effect.Effect<SecurityRevision, PersistenceMappingError>;\n readonly allocateRevisionSync?: () => SecurityRevision;\n readonly commandRetentionMillis: number;\n /* All semantic replacements still bump subject revision. This flag only declares bearer invalidation latency. /\n readonly sessionInvalidation: \"same-authority-immediate\" \| \"original-absolute-expiry\";\n readonly d1?: PasswordD1Clock<Expression>;\n}\n\nexport type D1PasswordPersistenceMapping<\n Subject extends Table,\n Identifier extends Table,\n Credential extends Table,\n AuthorityCredential extends Table,\n Command extends Table,\n NativeSubjectId,\n Expression extends SqlExpression = SqlExpression,\n> = PasswordPersistenceMapping<\n Subject,\n Identifier,\n Credential,\n AuthorityCredential,\n Command,\n NativeSubjectId,\n Expression\n> & {\n readonly d1: PasswordD1Clock<Expression>;\n readonly subject: PasswordSubjectTable<Subject, NativeSubjectId> & {\n readonly d1ActiveStatusValue: unknown;\n };\n readonly identifier: PasswordIdentifierTable<Identifier, NativeSubjectId, Expression> & {\n readonly d1CurrentCondition: (input: {\n readonly identifier: LoginIdentifier;\n readonly nativeSubjectId: NativeSubjectId;\n }) => Expression;\n };\n readonly authorityCredential: PasswordAuthorityCredentialTable<\n AuthorityCredential,\n NativeSubjectId\n > & {\n readonly d1ActiveStatusValue: unknown;\n };\n};\n\nexport type PasswordRegistrationState = \"pending\" \| \"created\";\n\nexport interface PasswordRegistrationIntent<Registration> {\n readonly moduleId: string;\n readonly requestId: string;\n readonly identifier: LoginIdentifier;\n readonly registration: Registration;\n readonly replacement: PasswordReplacement;\n}\n\nexport interface PasswordRegistrationTable<Registration, Request extends Table, NativeSubjectId> {\n readonly table: Request[\"table\"];\n readonly moduleId: ColumnKey<Request>;\n readonly requestId: ColumnKey<Request>;\n readonly state: ColumnKey<Request>;\n readonly subjectId: ColumnKey<Request>;\n readonly recoveryReference: ColumnKey<Request>;\n readonly encodeInsert: (\n input: PasswordRegistrationIntent<Registration>,\n state: {\n readonly state: PasswordRegistrationState;\n readonly nativeSubjectId?: NativeSubjectId;\n readonly recoveryReference?: typeof RecoveryReference.Type;\n },\n ) => Request[\"insert\"];\n /* Replay projection must never expose a stored subject or decode protected intent. /\n readonly decodeReplay: (row: Request[\"select\"]) => Effect.Effect<\n Exclude<\n PasswordRegistrationDecision,\n {\n readonly _tag: \"Created\";\n }\n >,\n PersistenceMappingError\n >;\n}\n\nexport interface PasswordRegistrationProvisioning<\n Registration,\n Subject extends Table,\n NativeSubjectId,\n> {\n readonly encodeSubjectInsert: (\n input: PasswordRegistrationIntent<Registration>,\n values: {\n readonly nativeSubjectId: NativeSubjectId \| undefined;\n readonly securityRevision: SecurityRevision;\n },\n ) => Subject[\"insert\"];\n readonly allocateSubjectId?: Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n readonly allocateSubjectIdSync?: () => NativeSubjectId;\n /* Interactive targets use this for database-generated/autoincrement keys. */\n readonly decodeGeneratedId?: (\n rows: ReadonlyArray<unknown>,\n ) => Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n}\n\nexport interface RequiredPasswordRegistrationConstraints {\n readonly request: \"unique(registration.moduleId,registration.requestId)\";\n readonly recoveryReference: \"unique(registration.recoveryReference)\";\n readonly identifier: \"unique(identifier.namespace,identifier.value)\";\n readonly credentialSubject: \"unique(credential.moduleId,credential.subjectId)\";\n readonly authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\";\n}\n\nexport const requiredPasswordRegistrationConstraints: RequiredPasswordRegistrationConstraints = {\n request: \"unique(registration.moduleId,registration.requestId)\",\n recoveryReference: \"unique(registration.recoveryReference)\",\n identifier: \"unique(identifier.namespace,identifier.value)\",\n credentialSubject: \"unique(credential.moduleId,credential.subjectId)\",\n authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\",\n};\n\nexport interface PasswordRegistrationConstraintClassifier {\n readonly isRequestConflict: (cause: unknown) => boolean;\n readonly isIdentifierConflict: (cause: unknown) => boolean;\n readonly isCredentialConflict: (cause: unknown) => boolean;\n}\n\nexport type PasswordRegistrationMapping<\n Registration,\n Subject extends Table,\n Identifier extends Table,\n Credential extends Table,\n AuthorityCredential extends Table,\n Request extends Table,\n NativeSubjectId,\n Expression extends SqlExpression = SqlExpression,\n> = PasswordRegistrationConstraintClassifier & {\n readonly subject: PasswordSubjectTable<Subject, NativeSubjectId>;\n readonly identifier: PasswordIdentifierTable<Identifier, NativeSubjectId, Expression>;\n readonly credential: PasswordCredentialTable<Subject, Identifier, Credential, NativeSubjectId>;\n readonly authorityCredential: PasswordAuthorityCredentialTable<\n AuthorityCredential,\n NativeSubjectId\n >;\n readonly registration: PasswordRegistrationTable<Registration, Request, NativeSubjectId>;\n readonly subjectId: SubjectIdCodec<NativeSubjectId>;\n readonly constraints: RequiredPasswordRegistrationConstraints;\n readonly allocateCredentialId?: Effect.Effect<string, PersistenceMappingError>;\n readonly allocateCredentialIdSync?: () => string;\n readonly allocateRevision?: Effect.Effect<SecurityRevision, PersistenceMappingError>;\n readonly allocateRevisionSync?: () => SecurityRevision;\n} & (\n \| {\n readonly mode: \"atomic\";\n readonly provisioning: PasswordRegistrationProvisioning<\n Registration,\n Subject,\n NativeSubjectId\n > &\n (\n \| {\n readonly idMode: \"allocated\";\n readonly allocateSubjectId: Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n }\n \| {\n readonly idMode: \"synchronous\";\n readonly allocateSubjectIdSync: () => NativeSubjectId;\n }\n \| {\n readonly idMode: \"generated\";\n readonly decodeGeneratedId: (\n rows: ReadonlyArray<unknown>,\n ) => Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n }\n );\n }\n \| {\n readonly mode: \"pending\";\n readonly allocateRecoveryReference?: Effect.Effect<\n typeof RecoveryReference.Type,\n PersistenceMappingError\n >;\n readonly allocateRecoveryReferenceSync?: () => typeof RecoveryReference.Type;\n }\n );\n\nexport type AnyPasswordPersistenceMapping<Expression extends SqlExpression = SqlExpression> =\n PasswordPersistenceMapping<\n AnyTableModel,\n AnyTableModel,\n AnyTableModel,\n AnyTableModel,\n AnyTableModel,\n unknown,\n Expression\n >;\n\nexport type AnyPasswordRegistrationMapping<\n Registration = unknown,\n Expression extends SqlExpression = SqlExpression,\n> = PasswordRegistrationMapping<\n Registration,\n AnyTableModel,\n AnyTableModel,\n AnyTableModel,\n AnyTableModel,\n AnyTableModel,\n unknown,\n Expression\n>;\n"],"mappings":";;AAgJA,MAAa,8BAA2D;CACtE,YAAY;CACZ,qBAAqB;CACrB,mBAAmB;CACnB,cAAc;CACd,SAAS;AACX;AAkJA,MAAa,0CAAmF;CAC9F,SAAS;CACT,mBAAmB;CACnB,YAAY;CACZ,mBAAmB;CACnB,qBAAqB;AACvB"}
1	+ {"version":3,"file":"password-model.mjs","names":[],"sources":["../../../src/internal/models/password-model.ts"],"sourcesContent":["import { type RecoveryReference, type LoginIdentifier } from \"@yielded/auth/Identity\";\nimport type {\n PasswordAction,\n PasswordCredentialSnapshot,\n PasswordReplacement,\n PasswordRegistrationDecision,\n EncodedPasswordHash,\n} from \"@yielded/auth/Password\";\nimport type { AuthenticationRequirement, SecurityRevision } from \"@yielded/auth/Sessions\";\nimport type { Effect, Redacted } from \"effect\";\n\nimport type { AnyTableModel, TableModel as Table, SqlExpression } from \"../query-operations\";\nimport type { PersistenceMappingError, SubjectIdCodec } from \"./common\";\n\ntype ColumnKey<T extends Table> = T[\"column\"];\n\nexport interface PasswordSubjectTable<Subject extends Table, _NativeSubjectId> {\n readonly table: Subject[\"table\"];\n readonly id: ColumnKey<Subject>;\n readonly status: ColumnKey<Subject>;\n readonly securityRevision: ColumnKey<Subject>;\n readonly isActiveStatus: (value: unknown) => boolean;\n readonly decodeRequirement: (\n row: Subject[\"select\"],\n ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n /** Current policy for this exact credential mutation, decoded under the subject lock. /\n readonly decodeActionRequirement: (\n row: Subject[\"select\"],\n action: PasswordAction,\n ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n readonly nextSecurityRevision?: (\n current: SecurityRevision,\n ) => Effect.Effect<SecurityRevision, PersistenceMappingError>;\n readonly nextSecurityRevisionSync?: (current: SecurityRevision) => SecurityRevision;\n /* Required only by D1 conditional statements. /\n readonly d1ActiveStatusValue?: unknown;\n}\n\nexport interface PasswordIdentifierTable<\n Identifier extends Table,\n NativeSubjectId,\n Expression extends SqlExpression = SqlExpression,\n> {\n readonly table: Identifier[\"table\"];\n readonly namespace: ColumnKey<Identifier>;\n readonly value: ColumnKey<Identifier>;\n readonly subjectId: ColumnKey<Identifier>;\n readonly verifiedAt: ColumnKey<Identifier>;\n readonly bindingRevision: ColumnKey<Identifier>;\n /* Consumer-owned current login/recovery eligibility, including row status. /\n readonly isCurrent: (row: Identifier[\"select\"]) => boolean;\n /* Required by D1 so current ownership/eligibility is rechecked in the batch. /\n readonly d1CurrentCondition?: (input: {\n readonly identifier: LoginIdentifier;\n readonly nativeSubjectId: NativeSubjectId;\n }) => Expression;\n readonly encodeInitialInsert: (\n identifier: LoginIdentifier,\n subjectId: NativeSubjectId,\n bindingRevision: SecurityRevision,\n ) => Identifier[\"insert\"];\n}\n\nexport interface PasswordAuthorityCredentialTable<Credential extends Table, NativeSubjectId> {\n readonly table: Credential[\"table\"];\n readonly subjectId: ColumnKey<Credential>;\n readonly credentialId: ColumnKey<Credential>;\n readonly revision: ColumnKey<Credential>;\n readonly status?: ColumnKey<Credential>;\n readonly isActiveStatus?: (value: unknown) => boolean;\n readonly d1ActiveStatusValue?: unknown;\n readonly encodeInsert: (input: {\n readonly subjectId: NativeSubjectId;\n readonly credentialId: string;\n readonly revision: SecurityRevision;\n }) => Credential[\"insert\"];\n readonly encodeRevision: (revision: SecurityRevision) => Partial<Credential[\"insert\"]>;\n}\n\nexport interface PasswordCredentialTable<\n Subject extends Table,\n Identifier extends Table,\n Credential extends Table,\n NativeSubjectId,\n> {\n readonly table: Credential[\"table\"];\n readonly moduleId: ColumnKey<Credential>;\n readonly subjectId: ColumnKey<Credential>;\n readonly credentialId: ColumnKey<Credential>;\n readonly credentialRevision: ColumnKey<Credential>;\n readonly verifierVersion: ColumnKey<Credential>;\n readonly verifier: ColumnKey<Credential>;\n readonly normalization: ColumnKey<Credential>;\n readonly encodeInsert: (input: {\n readonly moduleId: string;\n readonly subjectId: NativeSubjectId;\n readonly credentialId: string;\n readonly credentialRevision: SecurityRevision;\n readonly verifierVersion: SecurityRevision;\n readonly replacement: PasswordReplacement;\n }) => Credential[\"insert\"];\n readonly encodeVerifier: (\n verifier: Redacted.Redacted<EncodedPasswordHash>,\n verifierVersion: SecurityRevision,\n ) => Partial<Credential[\"insert\"]>;\n readonly encodeReplacement: (input: {\n readonly replacement: PasswordReplacement;\n readonly credentialRevision: SecurityRevision;\n readonly verifierVersion: SecurityRevision;\n }) => Partial<Credential[\"insert\"]>;\n readonly decode: (input: {\n readonly moduleId: string;\n readonly subject: Subject[\"select\"];\n readonly identifier: Identifier[\"select\"];\n readonly credential: Credential[\"select\"];\n }) => Effect.Effect<PasswordCredentialSnapshot, PersistenceMappingError>;\n}\n\nexport interface PasswordCommandTable<Command extends Table> {\n readonly table: Command[\"table\"];\n readonly moduleId: ColumnKey<Command>;\n readonly commandId: ColumnKey<Command>;\n readonly action: ColumnKey<Command>;\n readonly bindingDigest: ColumnKey<Command>;\n readonly decision: ColumnKey<Command>;\n readonly retentionUntil: ColumnKey<Command>;\n readonly encodeInsert: (input: {\n readonly moduleId: string;\n readonly commandId: string;\n readonly action: string;\n readonly bindingDigest: string;\n readonly decision: \"changed\";\n readonly retentionUntilMillis: number;\n }) => Command[\"insert\"];\n}\n\nexport interface RequiredPasswordConstraints {\n readonly identifier: \"unique(identifier.namespace,identifier.value)\";\n readonly authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\";\n readonly credentialSubject: \"unique(credential.moduleId,credential.subjectId)\";\n readonly credentialId: \"unique(credential.moduleId,credential.credentialId)\";\n readonly command: \"unique(command.moduleId,command.commandId)\";\n}\n\nexport const requiredPasswordConstraints: RequiredPasswordConstraints = {\n identifier: \"unique(identifier.namespace,identifier.value)\",\n authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\",\n credentialSubject: \"unique(credential.moduleId,credential.subjectId)\",\n credentialId: \"unique(credential.moduleId,credential.credentialId)\",\n command: \"unique(command.moduleId,command.commandId)\",\n};\n\nexport interface PasswordConstraintClassifier {\n /* Match only the mapped command uniqueness constraint. /\n readonly isCommandConflict: (cause: unknown) => boolean;\n}\n\nexport interface PasswordD1Clock<Expression extends SqlExpression = SqlExpression> {\n readonly engineNow: Expression;\n readonly engineNowMillis: Expression;\n readonly engineInstantMinus: (millis: number) => Expression;\n readonly engineInstantPlus: (millis: number) => Expression;\n}\n\nexport interface PasswordPersistenceMapping<\n Subject extends Table,\n Identifier extends Table,\n Credential extends Table,\n AuthorityCredential extends Table,\n Command extends Table,\n NativeSubjectId,\n Expression extends SqlExpression = SqlExpression,\n> extends PasswordConstraintClassifier {\n readonly subject: PasswordSubjectTable<Subject, NativeSubjectId>;\n readonly identifier: PasswordIdentifierTable<Identifier, NativeSubjectId, Expression>;\n readonly credential: PasswordCredentialTable<Subject, Identifier, Credential, NativeSubjectId>;\n /* Every factor revision named by action evidence, including non-password factors. /\n readonly authorityCredential: PasswordAuthorityCredentialTable<\n AuthorityCredential,\n NativeSubjectId\n >;\n readonly command: PasswordCommandTable<Command>;\n readonly subjectId: SubjectIdCodec<NativeSubjectId>;\n readonly constraints: RequiredPasswordConstraints;\n readonly encodeInstant: (epochMillis: number) => unknown;\n readonly decodeInstant: (native: unknown) => Effect.Effect<number, PersistenceMappingError>;\n readonly allocateCredentialId?: Effect.Effect<string, PersistenceMappingError>;\n readonly allocateCredentialIdSync?: () => string;\n readonly allocateRevision?: Effect.Effect<SecurityRevision, PersistenceMappingError>;\n readonly allocateRevisionSync?: () => SecurityRevision;\n readonly commandRetentionMillis: number;\n /* All semantic replacements still bump subject revision. This flag declares\n * authoritative verification's invalidation latency; cookie exposure is separate. /\n readonly sessionInvalidation: \"same-authority-immediate\" \| \"original-absolute-expiry\";\n readonly d1?: PasswordD1Clock<Expression>;\n}\n\nexport type D1PasswordPersistenceMapping<\n Subject extends Table,\n Identifier extends Table,\n Credential extends Table,\n AuthorityCredential extends Table,\n Command extends Table,\n NativeSubjectId,\n Expression extends SqlExpression = SqlExpression,\n> = PasswordPersistenceMapping<\n Subject,\n Identifier,\n Credential,\n AuthorityCredential,\n Command,\n NativeSubjectId,\n Expression\n> & {\n readonly d1: PasswordD1Clock<Expression>;\n readonly subject: PasswordSubjectTable<Subject, NativeSubjectId> & {\n readonly d1ActiveStatusValue: unknown;\n };\n readonly identifier: PasswordIdentifierTable<Identifier, NativeSubjectId, Expression> & {\n readonly d1CurrentCondition: (input: {\n readonly identifier: LoginIdentifier;\n readonly nativeSubjectId: NativeSubjectId;\n }) => Expression;\n };\n readonly authorityCredential: PasswordAuthorityCredentialTable<\n AuthorityCredential,\n NativeSubjectId\n > & {\n readonly d1ActiveStatusValue: unknown;\n };\n};\n\nexport type PasswordRegistrationState = \"pending\" \| \"created\";\n\nexport interface PasswordRegistrationIntent<Registration> {\n readonly moduleId: string;\n readonly requestId: string;\n readonly identifier: LoginIdentifier;\n readonly registration: Registration;\n readonly replacement: PasswordReplacement;\n}\n\nexport interface PasswordRegistrationTable<Registration, Request extends Table, NativeSubjectId> {\n readonly table: Request[\"table\"];\n readonly moduleId: ColumnKey<Request>;\n readonly requestId: ColumnKey<Request>;\n readonly state: ColumnKey<Request>;\n readonly subjectId: ColumnKey<Request>;\n readonly recoveryReference: ColumnKey<Request>;\n readonly encodeInsert: (\n input: PasswordRegistrationIntent<Registration>,\n state: {\n readonly state: PasswordRegistrationState;\n readonly nativeSubjectId?: NativeSubjectId;\n readonly recoveryReference?: typeof RecoveryReference.Type;\n },\n ) => Request[\"insert\"];\n /* Replay projection must never expose a stored subject or decode protected intent. /\n readonly decodeReplay: (row: Request[\"select\"]) => Effect.Effect<\n Exclude<\n PasswordRegistrationDecision,\n {\n readonly _tag: \"Created\";\n }\n >,\n PersistenceMappingError\n >;\n}\n\nexport interface PasswordRegistrationProvisioning<\n Registration,\n Subject extends Table,\n NativeSubjectId,\n> {\n readonly encodeSubjectInsert: (\n input: PasswordRegistrationIntent<Registration>,\n values: {\n readonly nativeSubjectId: NativeSubjectId \| undefined;\n readonly securityRevision: SecurityRevision;\n },\n ) => Subject[\"insert\"];\n readonly allocateSubjectId?: Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n readonly allocateSubjectIdSync?: () => NativeSubjectId;\n /* Interactive targets use this for database-generated/autoincrement keys. */\n readonly decodeGeneratedId?: (\n rows: ReadonlyArray<unknown>,\n ) => Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n}\n\nexport interface RequiredPasswordRegistrationConstraints {\n readonly request: \"unique(registration.moduleId,registration.requestId)\";\n readonly recoveryReference: \"unique(registration.recoveryReference)\";\n readonly identifier: \"unique(identifier.namespace,identifier.value)\";\n readonly credentialSubject: \"unique(credential.moduleId,credential.subjectId)\";\n readonly authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\";\n}\n\nexport const requiredPasswordRegistrationConstraints: RequiredPasswordRegistrationConstraints = {\n request: \"unique(registration.moduleId,registration.requestId)\",\n recoveryReference: \"unique(registration.recoveryReference)\",\n identifier: \"unique(identifier.namespace,identifier.value)\",\n credentialSubject: \"unique(credential.moduleId,credential.subjectId)\",\n authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\",\n};\n\nexport interface PasswordRegistrationConstraintClassifier {\n readonly isRequestConflict: (cause: unknown) => boolean;\n readonly isIdentifierConflict: (cause: unknown) => boolean;\n readonly isCredentialConflict: (cause: unknown) => boolean;\n}\n\nexport type PasswordRegistrationMapping<\n Registration,\n Subject extends Table,\n Identifier extends Table,\n Credential extends Table,\n AuthorityCredential extends Table,\n Request extends Table,\n NativeSubjectId,\n Expression extends SqlExpression = SqlExpression,\n> = PasswordRegistrationConstraintClassifier & {\n readonly subject: PasswordSubjectTable<Subject, NativeSubjectId>;\n readonly identifier: PasswordIdentifierTable<Identifier, NativeSubjectId, Expression>;\n readonly credential: PasswordCredentialTable<Subject, Identifier, Credential, NativeSubjectId>;\n readonly authorityCredential: PasswordAuthorityCredentialTable<\n AuthorityCredential,\n NativeSubjectId\n >;\n readonly registration: PasswordRegistrationTable<Registration, Request, NativeSubjectId>;\n readonly subjectId: SubjectIdCodec<NativeSubjectId>;\n readonly constraints: RequiredPasswordRegistrationConstraints;\n readonly allocateCredentialId?: Effect.Effect<string, PersistenceMappingError>;\n readonly allocateCredentialIdSync?: () => string;\n readonly allocateRevision?: Effect.Effect<SecurityRevision, PersistenceMappingError>;\n readonly allocateRevisionSync?: () => SecurityRevision;\n} & (\n \| {\n readonly mode: \"atomic\";\n readonly provisioning: PasswordRegistrationProvisioning<\n Registration,\n Subject,\n NativeSubjectId\n > &\n (\n \| {\n readonly idMode: \"allocated\";\n readonly allocateSubjectId: Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n }\n \| {\n readonly idMode: \"synchronous\";\n readonly allocateSubjectIdSync: () => NativeSubjectId;\n }\n \| {\n readonly idMode: \"generated\";\n readonly decodeGeneratedId: (\n rows: ReadonlyArray<unknown>,\n ) => Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n }\n );\n }\n \| {\n readonly mode: \"pending\";\n readonly allocateRecoveryReference?: Effect.Effect<\n typeof RecoveryReference.Type,\n PersistenceMappingError\n >;\n readonly allocateRecoveryReferenceSync?: () => typeof RecoveryReference.Type;\n }\n );\n\nexport type AnyPasswordPersistenceMapping<Expression extends SqlExpression = SqlExpression> =\n PasswordPersistenceMapping<\n AnyTableModel,\n AnyTableModel,\n AnyTableModel,\n AnyTableModel,\n AnyTableModel,\n unknown,\n Expression\n >;\n\nexport type AnyPasswordRegistrationMapping<\n Registration = unknown,\n Expression extends SqlExpression = SqlExpression,\n> = PasswordRegistrationMapping<\n Registration,\n AnyTableModel,\n AnyTableModel,\n AnyTableModel,\n AnyTableModel,\n AnyTableModel,\n unknown,\n Expression\n>;\n"],"mappings":";;AAgJA,MAAa,8BAA2D;CACtE,YAAY;CACZ,qBAAqB;CACrB,mBAAmB;CACnB,cAAc;CACd,SAAS;AACX;AAmJA,MAAa,0CAAmF;CAC9F,SAAS;CACT,mBAAmB;CACnB,YAAY;CACZ,mBAAmB;CACnB,qBAAqB;AACvB"}

package/dist/internal/oauth/accounts.mjs CHANGED Viewed

@@ -81,7 +81,7 @@ const make$1 = Effect.gen(function* () {
 	});
 	const checkInvalidation = (mapping, original) => {
 		const value = snapshotOAuthSync(SessionInvalidationWindow, original);
-		invariant(value.trigger === "credential-change" && value.oldAuthenticationEvidence === "rejected" && (mapping.sessionInvalidation === "same-authority-immediate" ? value.existingSessions === "immediate" && value.maximumExposureMillis === 0 : value.existingSessions === "original-absolute-expiry"));
+		invariant(value.trigger === "credential-change" && value.oldAuthenticationEvidence === "rejected" && (mapping.sessionInvalidation === "same-authority-immediate" ? value.existingSessions === "immediate" && value.maximumExposureMillis === 0 || value.existingSessions === "cache-expiry" && value.maximumExposureMillis > 0 : value.existingSessions === "original-absolute-expiry"));
 		return value;
 	};
 	const advance = (mapping, current, removed) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {