@yielded/auth-persistence 0.1.0-beta.24 → 0.1.0-beta.25

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (20) hide show
  1. package/dist/internal/email-kernel.d.mts +1 -1
  2. package/dist/internal/email-kernel.mjs +1 -1
  3. package/dist/internal/email-kernel.mjs.map +1 -1
  4. package/dist/internal/models/password-model.d.mts +2 -1
  5. package/dist/internal/models/password-model.mjs.map +1 -1
  6. package/dist/internal/oauth/accounts.mjs +1 -1
  7. package/dist/internal/oauth/accounts.mjs.map +1 -1
  8. package/dist/internal/oauth-kernel.d.mts +8 -8
  9. package/dist/internal/passkey/write-state.mjs +9 -1
  10. package/dist/internal/passkey/write-state.mjs.map +1 -1
  11. package/dist/internal/passkey-kernel.d.mts +4 -4
  12. package/dist/internal/password-kernel.d.mts +2 -2
  13. package/dist/internal/password-kernel.mjs +1 -1
  14. package/dist/internal/password-kernel.mjs.map +1 -1
  15. package/package.json +1 -1
  16. package/src/internal/email-kernel.ts +2 -1
  17. package/src/internal/models/password-model.ts +2 -1
  18. package/src/internal/oauth/accounts.ts +2 -1
  19. package/src/internal/passkey/write-state.ts +18 -4
  20. package/src/internal/password-kernel.ts +2 -1
package/dist/internal/password-kernel.mjs.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"password-kernel.mjs","names":["sameCredentialSnapshot"],"sources":["../../src/internal/password-kernel.ts"],"sourcesContent":["import {\n coordinateCommit,\n CurrentCommitJournal,\n hasCommitScope,\n type CommitJournal,\n type PreparedCommit,\n LifecycleHooks,\n HookConfigurationError,\n} from \"@yielded/auth/Hooks\";\nimport type { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport {\n PasswordUnavailable,\n PasswordPersistence,\n type PasswordMutationInput,\n snapshotPasswordCredential,\n snapshotPasswordRequirement,\n snapshotPasswordRevision,\n type PasswordAction,\n type PasswordMutationDecision,\n} from \"@yielded/auth/Password\";\nimport { reportPersistenceFailure } from \"@yielded/auth/Persistence\";\nimport {\n type ProofCompletionPlan,\n type ProofCompletionInput,\n ProofUnavailable,\n} from \"@yielded/auth/Proofs\";\nimport {\n snapshotAuthenticationEvidence,\n type AuthenticationEvidence,\n type AuthenticationRequirement,\n type SecurityRevision,\n} from \"@yielded/auth/Sessions\";\nimport { Cause, Context, DateTime, Effect, Option, Redacted, Schema } from \"effect\";\nimport type { SqlClient } from \"effect/sql/SqlClient\";\nimport type * as SqlError from \"effect/sql/SqlError\";\n\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport {\n type AnyPasswordPersistenceMapping,\n requiredPasswordConstraints,\n} from \"./models/password-model\";\nimport { makeNativeSqlTables, sqlMapping, type NativeSqlTables } from \"./native-sql-table\";\nimport {\n makePasswordCredentials,\n samePasswordCredentialSnapshot as sameCredentialSnapshot,\n} from \"./password-credentials\";\nimport {\n CurrentPasswordPreparedTransaction,\n PasswordPreparedPostconditions,\n} from \"./PasswordPreparedPostconditions\";\nimport {\n CurrentProofSql,\n type ProofSqlConfiguration,\n type ProofSqlDatabase,\n type makeProofKernel,\n} from \"./proof-kernel\";\n/* oxlint-disable no-explicit-any -- existing storage kernels erase foreign table shapes; domain errors remain typed. */\nimport type { QueryFailure } from \"./query-operations\";\nimport type { QueryOperations, SqlFragment, SqlColumn } from \"./query-operations\";\nimport { NativeDatabase } from \"./transaction-kernel\";\n\ntype AdapterFailure = QueryFailure | PersistenceMappingError | SqlError.SqlError;\n\nexport interface PasswordSqlQuery<A = ReadonlyArray<any>> extends Effect.Effect<A, AdapterFailure> {\n readonly getSQL: () => ReturnType<QueryOperations[\"sql\"]>;\n readonly from: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n readonly where: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n readonly limit: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n readonly orderBy: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n readonly for: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n readonly set: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n readonly values: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n readonly returning: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n readonly $returningId: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n readonly onConflictDoNothing: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n readonly onDuplicateKeyUpdate: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n}\n\nexport interface PasswordSqlDatabase {\n readonly select: (...args: ReadonlyArray<any>) => PasswordSqlQuery;\n readonly insert: (...args: ReadonlyArray<any>) => PasswordSqlQuery;\n readonly update: (...args: ReadonlyArray<any>) => PasswordSqlQuery;\n readonly delete: (...args: ReadonlyArray<any>) => PasswordSqlQuery;\n readonly transaction: <A, E, R>(\n body: (transaction: PasswordSqlDatabase) => Effect.Effect<A, E, R>,\n ) => Effect.Effect<A, E | SqlError.SqlError, R>;\n}\n\nexport class CurrentPasswordSql extends Context.Service<CurrentPasswordSql, PasswordSqlDatabase>()(\n \"effect-auth/CurrentPasswordSql\",\n) {}\n\nexport interface PasswordSqlConfiguration {\n readonly mode: \"interactive\" | \"synchronous\";\n readonly locking: boolean;\n readonly standaloneGuard: Effect.Effect<void, PasswordUnavailable>;\n readonly coordinated?: boolean;\n readonly insertIfAbsent: (\n query: PasswordSqlQuery,\n selfKey: string,\n selfValue: unknown,\n ) => PasswordSqlQuery;\n readonly proof?: {\n readonly mapping: any;\n readonly configuration: ProofSqlConfiguration;\n };\n}\n\ntype Database = PasswordSqlDatabase;\n\nexport const makePasswordKernel = <\n Fragment extends SqlFragment = SqlFragment,\n Column extends SqlColumn = SqlColumn,\n>(\n operations: QueryOperations<Fragment, Column>,\n proofs: Pick<ReturnType<typeof makeProofKernel>, \"completeProofPlanIn\">,\n nativeTables: (client: SqlClient, database: object) => NativeSqlTables = (client) =>\n makeNativeSqlTables(client),\n) => {\n type Mapping = AnyPasswordPersistenceMapping<Fragment>;\n\n const { and, eq, inArray, column, updateValues } = operations;\n const { completeProofPlanIn } = proofs;\n const unavailable = () => PasswordUnavailable.make({});\n\n const translateFailure = <A, E, R>(\n effect: Effect.Effect<A, E, R>,\n ): Effect.Effect<A, PasswordUnavailable, R> =>\n reportPersistenceFailure(\n effect,\n (error) =>\n Schema.is(PasswordUnavailable)(error) ||\n Schema.is(ProofUnavailable)(error) ||\n Schema.is(HookConfigurationError)(error),\n ).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));\n\n const nowMillis = DateTime.now.pipe(Effect.map(DateTime.toEpochMillis));\n\n const validConstraints = (mapping: Mapping) =>\n Object.entries(requiredPasswordConstraints).every(\n ([key, value]) =>\n mapping.constraints[key as keyof typeof requiredPasswordConstraints] === value,\n );\n\n const selectRows = (query: PasswordSqlQuery, locking: boolean) =>\n locking && typeof query.for === \"function\" ? query.for(\"update\") : query;\n\n const subjectColumns = (mapping: Mapping) => ({\n id: column(mapping.subject.table, mapping.subject.id),\n status: column(mapping.subject.table, mapping.subject.status),\n securityRevision: column(mapping.subject.table, mapping.subject.securityRevision),\n });\n\n const identifierColumns = (mapping: Mapping) => ({\n namespace: column(mapping.identifier.table, mapping.identifier.namespace),\n value: column(mapping.identifier.table, mapping.identifier.value),\n subjectId: column(mapping.identifier.table, mapping.identifier.subjectId),\n verifiedAt: column(mapping.identifier.table, mapping.identifier.verifiedAt),\n bindingRevision: column(mapping.identifier.table, mapping.identifier.bindingRevision),\n });\n\n const credentialColumns = (mapping: Mapping) => ({\n moduleId: column(mapping.credential.table, mapping.credential.moduleId),\n subjectId: column(mapping.credential.table, mapping.credential.subjectId),\n credentialId: column(mapping.credential.table, mapping.credential.credentialId),\n credentialRevision: column(mapping.credential.table, mapping.credential.credentialRevision),\n verifierVersion: column(mapping.credential.table, mapping.credential.verifierVersion),\n verifier: column(mapping.credential.table, mapping.credential.verifier),\n normalization: column(mapping.credential.table, mapping.credential.normalization),\n });\n\n const authorityCredentialColumns = (mapping: Mapping) => ({\n subjectId: column(mapping.authorityCredential.table, mapping.authorityCredential.subjectId),\n credentialId: column(\n mapping.authorityCredential.table,\n mapping.authorityCredential.credentialId,\n ),\n revision: column(mapping.authorityCredential.table, mapping.authorityCredential.revision),\n });\n\n const commandColumns = (mapping: Mapping) => ({\n moduleId: column(mapping.command.table, mapping.command.moduleId),\n commandId: column(mapping.command.table, mapping.command.commandId),\n action: column(mapping.command.table, mapping.command.action),\n bindingDigest: column(mapping.command.table, mapping.command.bindingDigest),\n decision: column(mapping.command.table, mapping.command.decision),\n retentionUntil: column(mapping.command.table, mapping.command.retentionUntil),\n });\n\n const allocate = <A>(\n mode: PasswordSqlConfiguration[\"mode\"],\n asyncValue: Effect.Effect<A, PersistenceMappingError> | undefined,\n syncValue: (() => A) | undefined,\n ): Effect.Effect<A, PasswordUnavailable | PersistenceMappingError> => {\n if (mode === \"synchronous\")\n return syncValue === undefined\n ? Effect.fail(unavailable())\n : Effect.try({\n try: syncValue,\n catch: (cause) => new PersistenceMappingError({ operation: \"mapping\", cause }),\n });\n if (asyncValue !== undefined) return asyncValue;\n\n return syncValue === undefined\n ? Effect.fail(unavailable())\n : Effect.try({\n try: syncValue,\n catch: (cause) => new PersistenceMappingError({ operation: \"mapping\", cause }),\n });\n };\n\n const allocateNextSecurityRevision = (\n mapping: Mapping,\n mode: PasswordSqlConfiguration[\"mode\"],\n current: SecurityRevision,\n ) => {\n const asyncValue = mapping.subject.nextSecurityRevision?.(current);\n\n const syncValue =\n mapping.subject.nextSecurityRevisionSync === undefined\n ? undefined\n : () => mapping.subject.nextSecurityRevisionSync!(current);\n\n return allocate(\n mode,\n asyncValue ?? mapping.allocateRevision,\n syncValue ?? mapping.allocateRevisionSync,\n );\n };\n\n const sameIdentifier = (left: LoginIdentifier, right: LoginIdentifier) =>\n left.namespace === right.namespace && left.value === right.value;\n\n const evidenceSatisfiedAt = (\n evidence: AuthenticationEvidence,\n requirement: AuthenticationRequirement,\n now: number,\n ): boolean => {\n if (evidence.proofs.length > 64 || evidence.revision.credentials.length > 64) return false;\n const revisions = new Map<string, string>();\n\n for (const item of evidence.revision.credentials) {\n if (revisions.has(item.credentialId)) return false;\n revisions.set(item.credentialId, item.revision);\n }\n if (evidence.proofs.some((proof) => !revisions.has(proof.credentialId))) return false;\n if (evidence.proofs.some((proof) => now < DateTime.toEpochMillis(proof.verifiedAt)))\n return false;\n\n const eligible = evidence.proofs.filter((proof) => {\n const age = now - DateTime.toEpochMillis(proof.verifiedAt);\n\n return age >= 0 && age < requirement.maximumAgeMillis;\n });\n\n const factors = new Set(eligible.flatMap((proof) => proof.factors));\n const credentials = new Set(eligible.map((proof) => proof.credentialId));\n\n return requirement.alternatives.some(\n (alternative) =>\n alternative.factors.every((factor) => factors.has(factor)) &&\n credentials.size >= alternative.minimumCredentials &&\n eligible.some(\n (proof) =>\n (!alternative.userVerified || proof.userVerified) &&\n (!alternative.phishingResistant || proof.phishingResistant),\n ),\n );\n };\n\n const snapshotMutationInput = Effect.fn(\"DrizzlePassword.snapshotMutationInput\")(function* (\n input: PasswordMutationInput,\n ) {\n const expectedRevision = snapshotPasswordRevision(input.expectedRevision);\n\n const evidence = yield* snapshotAuthenticationEvidence(input.authorization.evidence).pipe(\n Effect.mapError(unavailable),\n );\n\n const requirement = yield* snapshotPasswordRequirement(input.authorization.requirement);\n\n const credential =\n input.credential === undefined\n ? undefined\n : yield* snapshotPasswordCredential(input.credential);\n\n return Object.freeze({\n ...input,\n expectedRevision,\n replacement: Object.freeze({\n verifier: Redacted.make(Redacted.value(input.replacement.verifier)),\n normalization: input.replacement.normalization,\n }),\n invalidation: Object.freeze({ ...input.invalidation }),\n ...(credential === undefined ? {} : { credential }),\n authorization: Object.freeze({\n challenge: Object.freeze({\n ...input.authorization.challenge,\n revision: snapshotPasswordRevision(input.authorization.challenge.revision),\n }),\n evidence,\n requirement,\n }),\n });\n });\n\n const lockSubject = Effect.fn(\"DrizzlePassword.lockSubject\")(function* (\n mapping: Mapping,\n subjectId: string,\n locking: boolean,\n ) {\n const database = yield* CurrentPasswordSql;\n\n const nativeSubjectId = yield* mapping.subjectId.toNative(subjectId as any);\n const c = subjectColumns(mapping);\n\n const rows = yield* selectRows(\n database.select().from(mapping.subject.table).where(eq(c.id, nativeSubjectId)).limit(1),\n locking,\n );\n\n return { nativeSubjectId, row: rows[0] };\n });\n\n const lockIdentifier = Effect.fn(\"Drizzle.lockIdentifier\")(function* (\n mapping: Mapping,\n identifier: LoginIdentifier,\n locking: boolean,\n ) {\n const database = yield* CurrentPasswordSql;\n\n const c = identifierColumns(mapping);\n\n return yield* selectRows(\n database\n .select()\n .from(mapping.identifier.table)\n .where(and(eq(c.namespace, identifier.namespace), eq(c.value, identifier.value)))\n .limit(1),\n locking,\n );\n });\n\n const readPasswordCredential = Effect.fn(\"Drizzle.readPasswordCredential\")(function* (\n mapping: Mapping,\n moduleId: string,\n nativeSubjectId: unknown,\n locking: boolean,\n ) {\n const database = yield* CurrentPasswordSql;\n\n const c = credentialColumns(mapping);\n\n return yield* selectRows(\n database\n .select()\n .from(mapping.credential.table)\n .where(and(eq(c.moduleId, moduleId), eq(c.subjectId, nativeSubjectId)))\n .limit(1),\n locking,\n );\n });\n\n const resolveCredential = Effect.fn(\"DrizzlePassword.resolveCredential\")(function* (\n mapping: Mapping,\n moduleId: string,\n identifier: LoginIdentifier,\n requestedSubjectId: string | undefined,\n locking: boolean,\n ) {\n const database = yield* CurrentPasswordSql;\n\n // The unlocked lookup only discovers the prospective subject. The canonical\n // protected order starts with the subject and then rechecks the identifier.\n const discovered = (yield* lockIdentifier(mapping, identifier, false))[0];\n\n if (discovered === undefined || !mapping.identifier.isCurrent(discovered)) return undefined;\n const discoveredNative = discovered[mapping.identifier.subjectId];\n\n const subjectRows = yield* selectRows(\n database\n .select()\n .from(mapping.subject.table)\n .where(eq(subjectColumns(mapping).id, discoveredNative))\n .limit(1),\n locking,\n );\n\n const subject = subjectRows[0];\n\n if (subject === undefined || !mapping.subject.isActiveStatus(subject[mapping.subject.status]))\n return undefined;\n const identifiers = yield* lockIdentifier(mapping, identifier, locking);\n const identifierRow = identifiers[0];\n\n if (\n identifierRow === undefined ||\n !mapping.identifier.isCurrent(identifierRow) ||\n !mapping.subjectId.equals(discoveredNative, identifierRow[mapping.identifier.subjectId])\n )\n return undefined;\n const subjectId = yield* mapping.subjectId.toSubject(discoveredNative);\n\n if (requestedSubjectId !== undefined && requestedSubjectId !== subjectId) return undefined;\n const credentials = yield* readPasswordCredential(mapping, moduleId, discoveredNative, locking);\n const credential = credentials[0];\n\n if (credential === undefined)\n return { nativeSubjectId: discoveredNative, subject, identifier: identifierRow };\n\n const snapshot = yield* mapping.credential\n .decode({ moduleId, subject, identifier: identifierRow, credential })\n .pipe(Effect.flatMap(snapshotPasswordCredential));\n\n return {\n nativeSubjectId: discoveredNative,\n subject,\n identifier: identifierRow,\n credential,\n snapshot,\n };\n });\n\n const owned = <A, E, R>(\n database: Database,\n mapping: Mapping,\n configuration: PasswordSqlConfiguration,\n body: Effect.Effect<A, E, R>,\n ) => {\n if (!validConstraints(mapping)) return Effect.fail(unavailable());\n\n const run = coordinateCommit(\n () =>\n database.transaction((transaction) =>\n body.pipe(\n Effect.provideService(CurrentPasswordSql, transaction),\n Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),\n ),\n ),\n { mode: configuration.mode },\n ).pipe(Effect.map((result) => result.value));\n\n return configuration.coordinated !== true\n ? Effect.gen(function* () {\n if (yield* hasCommitScope) return yield* unavailable();\n yield* configuration.standaloneGuard;\n\n return yield* run;\n })\n : run;\n };\n\n // A coordinator that accepts postconditions re-runs this check against its\n // current transaction after application work, before commit.\n const registerFinal = Effect.fnUntraced(function* <E>(\n check: Effect.Effect<boolean, E, CurrentPasswordSql>,\n ) {\n const postconditions = yield* Effect.serviceOption(PasswordPreparedPostconditions);\n\n if (Option.isNone(postconditions)) return;\n\n const postcondition = Effect.gen(function* () {\n const transaction = yield* CurrentPasswordPreparedTransaction;\n\n if (!(yield* check.pipe(Effect.provideService(CurrentPasswordSql, transaction))))\n return yield* unavailable();\n }).pipe(translateFailure);\n\n if (!postconditions.value.register(postcondition)) return yield* unavailable();\n });\n\n const safeRead = <A, E, R>(\n database: Database,\n configuration: PasswordSqlConfiguration,\n body: Effect.Effect<A, E, R>,\n ) =>\n Effect.gen(function* () {\n if (configuration.coordinated !== true) {\n if (yield* hasCommitScope) return yield* unavailable();\n yield* configuration.standaloneGuard;\n }\n\n return yield* database.transaction((transaction) =>\n body.pipe(\n Effect.provideService(CurrentPasswordSql, transaction),\n Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),\n ),\n );\n });\n\n const proofCompletionMatchesPassword = (\n input: PasswordMutationInput & { readonly completion: ProofCompletionPlan },\n ) => {\n const completion = input.completion.input;\n const binding = completion.binding;\n\n if (\n completion.moduleId !== `${input.moduleId}/reset` ||\n completion.purpose !== \"password-reset\" ||\n binding._tag !== \"Subject\" ||\n input.credential === undefined ||\n binding.revision.subjectId !== input.expectedRevision.subjectId ||\n binding.revision.securityRevision !== input.expectedRevision.securityRevision ||\n !sameIdentifier(binding.identifier, input.credential.identifier)\n )\n return false;\n\n const expected = [...input.expectedRevision.credentials].sort((left, right) =>\n left.credentialId.localeCompare(right.credentialId),\n );\n\n const actual = [...binding.revision.credentials].sort((left, right) =>\n left.credentialId.localeCompare(right.credentialId),\n );\n\n return (\n expected.length === actual.length &&\n expected.every(\n (item, index) =>\n item.credentialId === actual[index]!.credentialId &&\n item.revision === actual[index]!.revision,\n )\n );\n };\n\n const probeProofCompletion = Effect.fn(\"Drizzle.probeProofCompletion\")(function* (\n configuration: PasswordSqlConfiguration,\n input: ProofCompletionInput,\n ) {\n const database = yield* CurrentPasswordSql;\n\n if (configuration.proof === undefined) return yield* Effect.fail(unavailable());\n const validProbe = { _tag: \"PasswordProofCompletionValid\" } as const;\n\n const plan: ProofCompletionPlan = {\n input,\n prepare: (decision, journal, project) => journal.prepare(project(decision)),\n };\n\n const probe = coordinateCommit(\n () =>\n database.transaction((transaction) =>\n completeProofPlanIn(\n configuration.proof!.mapping,\n configuration.proof!.configuration,\n plan,\n Effect.fail(validProbe),\n () => false,\n ).pipe(\n Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),\n ),\n ),\n { mode: configuration.mode },\n );\n\n if (configuration.coordinated === true || (yield* hasCommitScope)) return yield* unavailable();\n yield* configuration.standaloneGuard;\n\n return yield* probe.pipe(\n Effect.as(false),\n Effect.catchCause((cause) => {\n const reason = cause.reasons[0];\n\n return cause.reasons.length === 1 &&\n reason !== undefined &&\n Cause.isFailReason(reason) &&\n reason.error === validProbe\n ? Effect.succeed(true)\n : Effect.failCause(cause);\n }),\n );\n });\n\n const validateMutationAuthority = Effect.fn(\"DrizzlePassword.validateMutationAuthority\")(\n function* (\n mapping: Mapping,\n configuration: PasswordSqlConfiguration,\n input: PasswordMutationInput,\n action: PasswordAction,\n ) {\n const database = yield* CurrentPasswordSql;\n\n const locked = yield* lockSubject(\n mapping,\n input.expectedRevision.subjectId,\n configuration.locking,\n );\n\n const row = locked.row;\n\n if (\n row === undefined ||\n !mapping.subject.isActiveStatus(row[mapping.subject.status]) ||\n row[mapping.subject.securityRevision] !== input.expectedRevision.securityRevision\n )\n return undefined;\n if (\n input.authorization.challenge.moduleId !== input.moduleId ||\n input.authorization.challenge.action !== action ||\n input.authorization.challenge.commandId !== input.commandId ||\n input.authorization.challenge.revision.subjectId !== input.expectedRevision.subjectId ||\n input.authorization.challenge.revision.securityRevision !==\n input.expectedRevision.securityRevision ||\n (input.authorization.evidence.flowId as string) !== (input.commandId as string) ||\n input.authorization.evidence.bindingDigest !==\n input.authorization.challenge.bindingDigest ||\n input.authorization.evidence.revision.subjectId !== input.expectedRevision.subjectId ||\n input.authorization.evidence.revision.securityRevision !==\n input.expectedRevision.securityRevision ||\n (action === \"add-password\" &&\n (input.credential !== undefined ||\n input.authorization.challenge.targetCredentialId !== undefined))\n )\n return undefined;\n if (\n input.expectedRevision.credentials.some(\n (expected) =>\n !input.authorization.evidence.revision.credentials.some(\n (actual) =>\n actual.credentialId === expected.credentialId &&\n actual.revision === expected.revision,\n ),\n )\n )\n return undefined;\n if (input.credential !== undefined) {\n const identifier = (yield* lockIdentifier(\n mapping,\n input.credential.identifier,\n configuration.locking,\n ))[0];\n\n if (\n identifier === undefined ||\n !mapping.identifier.isCurrent(identifier) ||\n !mapping.subjectId.equals(\n identifier[mapping.identifier.subjectId],\n locked.nativeSubjectId,\n ) ||\n identifier[mapping.identifier.bindingRevision] !==\n input.credential.identifierBindingRevision\n )\n return undefined;\n }\n\n const allExpected = [\n ...input.expectedRevision.credentials,\n ...input.authorization.evidence.revision.credentials,\n ];\n\n const expected = new Map(allExpected.map((item) => [item.credentialId, item]));\n\n const ac = authorityCredentialColumns(mapping);\n\n const credentialRows =\n expected.size === 0\n ? []\n : yield* selectRows(\n database\n .select()\n .from(mapping.authorityCredential.table)\n .where(\n and(\n eq(ac.subjectId, locked.nativeSubjectId),\n inArray(ac.credentialId, [...expected.keys()]),\n ),\n )\n .orderBy(ac.credentialId),\n configuration.locking,\n );\n\n if (credentialRows.length !== expected.size) return undefined;\n // Database collation need not match JavaScript locale ordering.\n for (const actual of credentialRows) {\n const wanted = expected.get(actual[mapping.authorityCredential.credentialId]);\n\n if (\n wanted === undefined ||\n actual[mapping.authorityCredential.revision] !== wanted.revision ||\n (mapping.authorityCredential.status !== undefined &&\n mapping.authorityCredential.isActiveStatus?.(\n actual[mapping.authorityCredential.status],\n ) !== true)\n )\n return undefined;\n expected.delete(wanted.credentialId);\n }\n if (expected.size !== 0) return undefined;\n if (input.credential !== undefined) {\n const identifier = (yield* lockIdentifier(mapping, input.credential.identifier, false))[0];\n\n const credential = (yield* readPasswordCredential(\n mapping,\n input.moduleId,\n locked.nativeSubjectId,\n configuration.locking,\n ))[0];\n\n if (identifier === undefined || credential === undefined) return undefined;\n\n const snapshot = yield* mapping.credential.decode({\n moduleId: input.moduleId,\n subject: row,\n identifier,\n credential,\n });\n\n if (!sameCredentialSnapshot(snapshot, input.credential)) return undefined;\n }\n const currentRequirement = yield* mapping.subject.decodeActionRequirement(row, action);\n const now = yield* nowMillis;\n\n if (\n !evidenceSatisfiedAt(input.authorization.evidence, input.authorization.requirement, now) ||\n !evidenceSatisfiedAt(input.authorization.evidence, currentRequirement, now)\n )\n return undefined;\n if (\n input.invalidation.existingSessions === \"immediate\" &&\n mapping.sessionInvalidation !== \"same-authority-immediate\"\n )\n return undefined;\n\n return { ...locked, now };\n },\n );\n\n const commandExists = Effect.fn(\"Drizzle.commandExists\")(function* (\n mapping: Mapping,\n moduleId: string,\n commandId: string,\n locking: boolean,\n ) {\n const database = yield* CurrentPasswordSql;\n\n const c = commandColumns(mapping);\n\n return yield* selectRows(\n database\n .select()\n .from(mapping.command.table)\n .where(and(eq(c.moduleId, moduleId), eq(c.commandId, commandId)))\n .limit(1),\n locking,\n );\n });\n\n const insertCommand = Effect.fn(\"Drizzle.insertCommand\")(function* (\n mapping: Mapping,\n input: PasswordMutationInput,\n action: PasswordAction,\n now: number,\n ) {\n const database = yield* CurrentPasswordSql;\n\n return yield* database.insert(mapping.command.table).values(\n mapping.command.encodeInsert({\n moduleId: input.moduleId,\n commandId: input.commandId,\n action,\n bindingDigest: input.authorization.challenge.bindingDigest,\n decision: \"changed\",\n retentionUntilMillis: now + mapping.commandRetentionMillis,\n }),\n );\n });\n\n const mutationPostconditions = Effect.fn(\"DrizzlePassword.mutationPostconditions\")(function* (\n mapping: Mapping,\n input: PasswordMutationInput,\n nativeSubjectId: unknown,\n subject: any,\n authorityCredential: any,\n now: number,\n ) {\n if (\n subject === undefined ||\n !mapping.subject.isActiveStatus(subject[mapping.subject.status]) ||\n authorityCredential === undefined ||\n (mapping.authorityCredential.status !== undefined &&\n mapping.authorityCredential.isActiveStatus?.(\n authorityCredential[mapping.authorityCredential.status],\n ) !== true)\n )\n return false;\n if (input.credential !== undefined) {\n const identifier = (yield* lockIdentifier(mapping, input.credential.identifier, false))[0];\n\n if (\n identifier === undefined ||\n !mapping.identifier.isCurrent(identifier) ||\n !mapping.subjectId.equals(identifier[mapping.identifier.subjectId], nativeSubjectId) ||\n identifier[mapping.identifier.bindingRevision] !==\n input.credential.identifierBindingRevision\n )\n return false;\n\n const credential = (yield* readPasswordCredential(\n mapping,\n input.moduleId,\n nativeSubjectId,\n false,\n ))[0];\n\n if (credential === undefined) return false;\n\n const decoded = yield* mapping.credential.decode({\n moduleId: input.moduleId,\n subject,\n identifier,\n credential,\n });\n\n if (decoded.identifierVerifiedAtMillis !== input.credential.identifierVerifiedAtMillis)\n return false;\n }\n const rows = yield* commandExists(mapping, input.moduleId, input.commandId, false);\n const row = rows[0];\n\n return (\n rows.length === 1 &&\n row[mapping.command.action] === input.authorization.challenge.action &&\n row[mapping.command.bindingDigest] === input.authorization.challenge.bindingDigest &&\n row[mapping.command.decision] === \"changed\" &&\n (yield* mapping.decodeInstant(row[mapping.command.retentionUntil])) ===\n now + mapping.commandRetentionMillis\n );\n });\n\n const addPasswordIn = Effect.fn(\"DrizzlePassword.addPasswordIn\")(function* (\n mapping: Mapping,\n configuration: PasswordSqlConfiguration,\n input: PasswordMutationInput,\n revisions: {\n readonly credentialId: string;\n readonly credentialRevision: SecurityRevision;\n readonly verifierVersion: SecurityRevision;\n readonly nextSecurityRevision: SecurityRevision;\n },\n commandNow?: number,\n ) {\n const database = yield* CurrentPasswordSql;\n\n const { credentialId, credentialRevision, verifierVersion, nextSecurityRevision } = revisions;\n\n const authority = yield* validateMutationAuthority(\n mapping,\n configuration,\n input,\n \"add-password\",\n );\n\n if (authority === undefined) return false;\n if ((yield* commandExists(mapping, input.moduleId, input.commandId, true)).length) return false;\n if (\n (yield* readPasswordCredential(mapping, input.moduleId, authority.nativeSubjectId, true))\n .length\n )\n return false;\n\n yield* database.insert(mapping.credential.table).values(\n mapping.credential.encodeInsert({\n moduleId: input.moduleId,\n subjectId: authority.nativeSubjectId,\n credentialId,\n credentialRevision,\n verifierVersion,\n replacement: input.replacement,\n }),\n );\n yield* database.insert(mapping.authorityCredential.table).values(\n mapping.authorityCredential.encodeInsert({\n subjectId: authority.nativeSubjectId,\n credentialId,\n revision: credentialRevision,\n }),\n );\n yield* database\n .update(mapping.subject.table)\n .set(updateValues([[mapping.subject.securityRevision, nextSecurityRevision]]))\n .where(\n and(\n eq(subjectColumns(mapping).id, authority.nativeSubjectId),\n eq(subjectColumns(mapping).securityRevision, input.expectedRevision.securityRevision),\n ),\n );\n yield* insertCommand(mapping, input, \"add-password\", commandNow ?? authority.now);\n\n const applied = checkMutationApplied(\n mapping,\n input,\n authority.nativeSubjectId,\n revisions,\n commandNow ?? authority.now,\n );\n\n if (!(yield* applied)) return yield* unavailable();\n yield* registerFinal(applied);\n\n return true;\n });\n\n const makeSqlPasswordPersistence = Effect.fn(\"makeSqlPasswordPersistence\")(function* (\n mapping: Mapping,\n configuration: PasswordSqlConfiguration,\n ): Effect.fn.Return<\n PasswordPersistence[\"Service\"],\n PasswordUnavailable,\n LifecycleHooks | CurrentPasswordSql | NativeDatabase\n > {\n const database = yield* CurrentPasswordSql;\n\n if (!configuration.coordinated)\n yield* (\n operations.validateStorage?.({\n ...mapping,\n proof: configuration.proof?.mapping,\n }) ?? Effect.void\n ).pipe(Effect.mapError(unavailable));\n const hooks = yield* LifecycleHooks;\n\n if (!validConstraints(mapping)) return yield* unavailable();\n const root = yield* NativeDatabase;\n\n const credentials = yield* makePasswordCredentials(\n yield* sqlMapping(() => nativeTables(root.$client.withoutTransforms(), root)).pipe(\n translateFailure,\n ),\n mapping,\n configuration,\n );\n\n return PasswordPersistence.of({\n ...credentials,\n readForSubject: (input) =>\n safeRead(\n database,\n configuration,\n Effect.gen(function* () {\n const transaction = yield* CurrentPasswordSql;\n\n const locked = yield* lockSubject(mapping, input.subjectId, false);\n\n if (\n locked.row === undefined ||\n !mapping.subject.isActiveStatus(locked.row[mapping.subject.status])\n )\n return Option.none();\n\n const credential = (yield* readPasswordCredential(\n mapping,\n input.moduleId,\n locked.nativeSubjectId,\n false,\n ))[0];\n\n if (credential === undefined) return Option.none();\n const ic = identifierColumns(mapping);\n\n const identifiers = yield* transaction\n .select()\n .from(mapping.identifier.table)\n .where(eq(ic.subjectId, locked.nativeSubjectId));\n\n const identifier = identifiers.find((row: any) => mapping.identifier.isCurrent(row));\n\n if (identifier === undefined) return Option.none();\n\n const snapshot = yield* mapping.credential\n .decode({\n moduleId: input.moduleId,\n subject: locked.row,\n identifier,\n credential,\n })\n .pipe(Effect.flatMap(snapshotPasswordCredential));\n\n return Option.some(snapshot);\n }),\n ).pipe(\n Effect.provideService(CurrentPasswordSql, database),\n Effect.provideService(LifecycleHooks, hooks),\n translateFailure,\n ),\n recoveryTarget: (input) =>\n safeRead(\n database,\n configuration,\n Effect.gen(function* () {\n const resolved = yield* resolveCredential(\n mapping,\n input.moduleId,\n input.identifier,\n undefined,\n false,\n );\n\n return resolved?.snapshot === undefined ||\n resolved.snapshot.identifierVerifiedAtMillis === undefined\n ? Option.none()\n : Option.some(resolved.snapshot);\n }),\n ).pipe(\n Effect.provideService(CurrentPasswordSql, database),\n Effect.provideService(LifecycleHooks, hooks),\n translateFailure,\n ),\n addIfAbsent: (uncaptured, prepare) =>\n Effect.gen(function* () {\n const input = yield* snapshotMutationInput(uncaptured);\n\n const credentialId = yield* allocate(\n configuration.mode,\n mapping.allocateCredentialId,\n mapping.allocateCredentialIdSync,\n );\n\n const credentialRevision = yield* allocate(\n configuration.mode,\n mapping.allocateRevision,\n mapping.allocateRevisionSync,\n );\n\n const verifierVersion = yield* allocate(\n configuration.mode,\n mapping.allocateRevision,\n mapping.allocateRevisionSync,\n );\n\n const nextSecurityRevision = yield* allocateNextSecurityRevision(\n mapping,\n configuration.mode,\n input.expectedRevision.securityRevision,\n );\n\n if (nextSecurityRevision === input.expectedRevision.securityRevision)\n return yield* unavailable();\n\n return yield* owned(\n database,\n mapping,\n configuration,\n Effect.gen(function* () {\n const journal = yield* CurrentCommitJournal;\n\n const changed = yield* addPasswordIn(mapping, configuration, input, {\n credentialId,\n credentialRevision,\n verifierVersion,\n nextSecurityRevision,\n });\n\n return prepare(changed ? \"changed\" : \"rejected\", journal);\n }),\n );\n }).pipe(\n Effect.provideService(CurrentPasswordSql, database),\n Effect.provideService(LifecycleHooks, hooks),\n translateFailure,\n ),\n replaceIfCurrent: (uncaptured, prepare) =>\n Effect.gen(function* () {\n const input = yield* snapshotMutationInput(uncaptured);\n\n const credentialRevision = yield* allocate(\n configuration.mode,\n mapping.allocateRevision,\n mapping.allocateRevisionSync,\n );\n\n const verifierVersion = yield* allocate(\n configuration.mode,\n mapping.allocateRevision,\n mapping.allocateRevisionSync,\n );\n\n const nextSecurityRevision = yield* allocateNextSecurityRevision(\n mapping,\n configuration.mode,\n input.expectedRevision.securityRevision,\n );\n\n if (\n nextSecurityRevision === input.expectedRevision.securityRevision ||\n (input.credential !== undefined &&\n credentialRevision === input.credential.credentialRevision)\n )\n return yield* unavailable();\n\n return yield* owned(\n database,\n mapping,\n configuration,\n Effect.gen(function* () {\n return yield* replaceIn(\n mapping,\n configuration,\n input,\n \"change-password\",\n { credentialRevision, verifierVersion, nextSecurityRevision },\n prepare,\n );\n }),\n );\n }).pipe(\n Effect.provideService(CurrentPasswordSql, database),\n Effect.provideService(LifecycleHooks, hooks),\n translateFailure,\n ),\n checkReset: (input) =>\n (configuration.proof === undefined\n ? Effect.fail(unavailable())\n : Effect.gen(function* () {\n if (\n input.moduleId.length <= \"/reset\".length ||\n !input.moduleId.endsWith(\"/reset\") ||\n input.purpose !== \"password-reset\" ||\n input.binding._tag !== \"Subject\"\n )\n return false;\n const binding = input.binding;\n const passwordModuleId = input.moduleId.slice(0, -\"/reset\".length);\n\n const current = yield* safeRead(\n database,\n configuration,\n Effect.gen(function* () {\n const resolved = yield* resolveCredential(\n mapping,\n passwordModuleId,\n binding.identifier,\n binding.revision.subjectId,\n false,\n );\n\n return (\n resolved?.snapshot !== undefined &&\n resolved.snapshot.revision.securityRevision ===\n binding.revision.securityRevision &&\n binding.revision.credentials.every((item) =>\n resolved.snapshot!.revision.credentials.some(\n (actual) =>\n actual.credentialId === item.credentialId &&\n actual.revision === item.revision,\n ),\n )\n );\n }),\n );\n\n return current ? yield* probeProofCompletion(configuration, input) : false;\n })\n ).pipe(\n Effect.provideService(CurrentPasswordSql, database),\n Effect.provideService(LifecycleHooks, hooks),\n translateFailure,\n ),\n resetWithProof: (uncaptured, prepare) =>\n (configuration.proof === undefined\n ? Effect.fail(unavailable())\n : Effect.gen(function* () {\n const input = Object.freeze({\n ...(yield* snapshotMutationInput(uncaptured)),\n completion: uncaptured.completion,\n });\n\n const credentialRevision = yield* allocate(\n configuration.mode,\n mapping.allocateRevision,\n mapping.allocateRevisionSync,\n );\n\n const verifierVersion = yield* allocate(\n configuration.mode,\n mapping.allocateRevision,\n mapping.allocateRevisionSync,\n );\n\n const nextSecurityRevision = yield* allocateNextSecurityRevision(\n mapping,\n configuration.mode,\n input.expectedRevision.securityRevision,\n );\n\n if (\n nextSecurityRevision === input.expectedRevision.securityRevision ||\n (input.credential !== undefined &&\n credentialRevision === input.credential.credentialRevision)\n )\n return yield* unavailable();\n\n return yield* owned(\n database,\n mapping,\n configuration,\n Effect.gen(function* () {\n const journal = yield* CurrentCommitJournal;\n\n if (!proofCompletionMatchesPassword(input)) return prepare(\"rejected\", journal);\n\n const authority = yield* validateMutationAuthority(\n mapping,\n configuration,\n input,\n \"reset-password\",\n );\n\n if (authority === undefined) return prepare(\"rejected\", journal);\n if ((yield* commandExists(mapping, input.moduleId, input.commandId, true)).length)\n return prepare(\"rejected\", journal);\n\n const current = yield* currentExpectedCredential(\n mapping,\n input,\n authority.nativeSubjectId,\n );\n\n if (!current) return prepare(\"rejected\", journal);\n let passwordReceipt: PreparedCommit<any> | undefined;\n\n yield* completeProofPlanIn(\n configuration.proof!.mapping,\n configuration.proof!.configuration,\n input.completion,\n Effect.gen(function* () {\n const revisions = {\n credentialRevision,\n verifierVersion,\n nextSecurityRevision,\n };\n\n const applied = yield* writeReplacement(\n mapping,\n input,\n authority.nativeSubjectId,\n revisions,\n authority.now,\n );\n\n if (applied)\n yield* registerReplacement(\n mapping,\n input,\n authority.nativeSubjectId,\n revisions,\n authority.now,\n );\n\n return applied;\n }),\n (decision) => {\n passwordReceipt = prepare(\n decision === \"completed\" ? \"changed\" : \"rejected\",\n journal,\n );\n\n return decision;\n },\n );\n\n return passwordReceipt ?? prepare(\"rejected\", journal);\n }),\n );\n })\n ).pipe(\n Effect.provideService(CurrentPasswordSql, database),\n Effect.provideService(LifecycleHooks, hooks),\n translateFailure,\n ),\n });\n });\n\n const currentExpectedCredential = Effect.fn(\"DrizzlePassword.currentExpectedCredential\")(\n function* (mapping: Mapping, input: PasswordMutationInput, nativeSubjectId: unknown) {\n if (input.credential === undefined) return false;\n\n const row = (yield* readPasswordCredential(\n mapping,\n input.moduleId,\n nativeSubjectId,\n true,\n ))[0];\n\n if (row === undefined) return false;\n\n return (\n row[mapping.credential.credentialId] === input.credential.credentialId &&\n row[mapping.credential.credentialRevision] === input.credential.credentialRevision &&\n row[mapping.credential.verifierVersion] === input.credential.verifierVersion &&\n row[mapping.credential.verifier] === Redacted.value(input.credential.verifier) &&\n row[mapping.credential.normalization] === input.credential.normalization &&\n input.authorization.challenge.targetCredentialId === input.credential.credentialId\n );\n },\n );\n\n const checkMutationApplied = Effect.fn(\"DrizzlePassword.checkMutationApplied\")(function* (\n mapping: Mapping,\n input: PasswordMutationInput,\n nativeSubjectId: unknown,\n revisions: {\n readonly credentialId: string;\n readonly credentialRevision: SecurityRevision;\n readonly verifierVersion: SecurityRevision;\n readonly nextSecurityRevision: SecurityRevision;\n },\n now: number,\n ) {\n const database = yield* CurrentPasswordSql;\n\n const c = credentialColumns(mapping),\n s = subjectColumns(mapping);\n\n const credential = (yield* database\n .select()\n .from(mapping.credential.table)\n .where(\n and(\n eq(c.moduleId, input.moduleId),\n eq(c.subjectId, nativeSubjectId),\n eq(c.credentialId, revisions.credentialId),\n eq(c.credentialRevision, revisions.credentialRevision),\n eq(c.verifierVersion, revisions.verifierVersion),\n eq(c.verifier, Redacted.value(input.replacement.verifier)),\n eq(c.normalization, input.replacement.normalization),\n ),\n )\n .limit(1))[0];\n\n const subject = (yield* database\n .select()\n .from(mapping.subject.table)\n .where(and(eq(s.id, nativeSubjectId), eq(s.securityRevision, revisions.nextSecurityRevision)))\n .limit(1))[0];\n\n const authorityCredential = (yield* database\n .select()\n .from(mapping.authorityCredential.table)\n .where(\n and(\n eq(authorityCredentialColumns(mapping).subjectId, nativeSubjectId),\n eq(authorityCredentialColumns(mapping).credentialId, revisions.credentialId),\n eq(authorityCredentialColumns(mapping).revision, revisions.credentialRevision),\n ),\n )\n .limit(1))[0];\n\n // SQL equality follows column collation; compare the persisted values exactly.\n return (\n credential !== undefined &&\n credential[mapping.credential.credentialId] === revisions.credentialId &&\n credential[mapping.credential.credentialRevision] === revisions.credentialRevision &&\n credential[mapping.credential.verifierVersion] === revisions.verifierVersion &&\n credential[mapping.credential.verifier] === Redacted.value(input.replacement.verifier) &&\n credential[mapping.credential.normalization] === input.replacement.normalization &&\n (yield* mutationPostconditions(\n mapping,\n input,\n nativeSubjectId,\n subject,\n authorityCredential,\n now,\n ))\n );\n });\n\n const writeReplacement = Effect.fn(\"DrizzlePassword.writeReplacement\")(function* (\n mapping: Mapping,\n input: PasswordMutationInput,\n nativeSubjectId: unknown,\n revisions: {\n readonly credentialRevision: SecurityRevision;\n readonly verifierVersion: SecurityRevision;\n readonly nextSecurityRevision: SecurityRevision;\n },\n now: number,\n ) {\n const database = yield* CurrentPasswordSql;\n\n const c = credentialColumns(mapping);\n const s = subjectColumns(mapping);\n\n yield* database\n .update(mapping.credential.table)\n .set(\n mapping.credential.encodeReplacement({\n replacement: input.replacement,\n credentialRevision: revisions.credentialRevision,\n verifierVersion: revisions.verifierVersion,\n }),\n )\n .where(\n and(\n eq(c.moduleId, input.moduleId),\n eq(c.subjectId, nativeSubjectId),\n eq(c.credentialId, input.credential!.credentialId),\n eq(c.credentialRevision, input.credential!.credentialRevision),\n eq(c.verifierVersion, input.credential!.verifierVersion),\n eq(c.verifier, Redacted.value(input.credential!.verifier)),\n eq(c.normalization, input.credential!.normalization),\n ),\n );\n yield* database\n .update(mapping.subject.table)\n .set(updateValues([[mapping.subject.securityRevision, revisions.nextSecurityRevision]]))\n .where(\n and(\n eq(s.id, nativeSubjectId),\n eq(s.securityRevision, input.expectedRevision.securityRevision),\n ),\n );\n yield* database\n .update(mapping.authorityCredential.table)\n .set(mapping.authorityCredential.encodeRevision(revisions.credentialRevision))\n .where(\n and(\n eq(authorityCredentialColumns(mapping).subjectId, nativeSubjectId),\n eq(authorityCredentialColumns(mapping).credentialId, input.credential!.credentialId),\n eq(authorityCredentialColumns(mapping).revision, input.credential!.credentialRevision),\n ),\n );\n yield* insertCommand(mapping, input, input.authorization.challenge.action, now);\n\n return yield* checkMutationApplied(\n mapping,\n input,\n nativeSubjectId,\n {\n ...revisions,\n credentialId: input.credential!.credentialId,\n },\n now,\n );\n });\n\n const registerReplacement = (\n mapping: Mapping,\n input: PasswordMutationInput,\n nativeSubjectId: unknown,\n revisions: {\n readonly credentialRevision: SecurityRevision;\n readonly verifierVersion: SecurityRevision;\n readonly nextSecurityRevision: SecurityRevision;\n },\n now: number,\n ) =>\n registerFinal(\n checkMutationApplied(\n mapping,\n input,\n nativeSubjectId,\n { ...revisions, credentialId: input.credential!.credentialId },\n now,\n ),\n );\n\n const replaceIn = Effect.fn(\"Drizzle.replaceIn\")(function* <A>(\n mapping: Mapping,\n configuration: PasswordSqlConfiguration,\n input: PasswordMutationInput,\n action: PasswordAction,\n revisions: {\n readonly credentialRevision: SecurityRevision;\n readonly verifierVersion: SecurityRevision;\n readonly nextSecurityRevision: SecurityRevision;\n },\n prepare: (value: PasswordMutationDecision, journal: CommitJournal) => PreparedCommit<A>,\n ) {\n const journal = yield* CurrentCommitJournal;\n\n const authority = yield* validateMutationAuthority(mapping, configuration, input, action);\n\n if (authority === undefined) return prepare(\"rejected\", journal);\n if ((yield* commandExists(mapping, input.moduleId, input.commandId, true)).length)\n return prepare(\"rejected\", journal);\n if (!(yield* currentExpectedCredential(mapping, input, authority.nativeSubjectId)))\n return prepare(\"rejected\", journal);\n const prepared = prepare(\"changed\", journal);\n\n if (\n !(yield* writeReplacement(\n mapping,\n input,\n authority.nativeSubjectId,\n revisions,\n authority.now,\n ))\n )\n return yield* unavailable();\n yield* registerReplacement(mapping, input, authority.nativeSubjectId, revisions, authority.now);\n\n return prepared;\n });\n\n /** Internal bound-owner primitives; deliberately not re-exported by driver modules. */\n const passwordSqlKernel = {\n allocate,\n allocateNextSecurityRevision,\n owned,\n safeRead,\n snapshotMutationInput,\n lockSubject,\n lockIdentifier,\n readPasswordCredential,\n resolveCredential,\n validateMutationAuthority,\n currentExpectedCredential,\n commandExists,\n addPasswordIn,\n checkMutationApplied,\n writeReplacement,\n evidenceSatisfiedAt,\n sameCredentialSnapshot,\n subjectColumns,\n identifierColumns,\n credentialColumns,\n authorityCredentialColumns,\n proofCompletionMatchesPassword,\n };\n\n return { makeSqlPasswordPersistence, passwordSqlKernel };\n};\n"],"mappings":";;;;;;;;;;;;;;AAwFA,IAAa,qBAAb,cAAwC,QAAQ,QAAiD,CAAC,CAChG,gCACF,CAAC,CAAC,CAAC;AAoBH,MAAa,sBAIX,YACA,QACA,gBAA0E,WACxE,oBAAoB,MAAM,MACzB;CAGH,MAAM,EAAE,KAAK,IAAI,SAAS,QAAQ,iBAAiB;CACnD,MAAM,EAAE,wBAAwB;CAChC,MAAM,oBAAoB,oBAAoB,KAAK,CAAC,CAAC;CAErD,MAAM,oBACJ,WAEA,yBACE,SACC,UACC,OAAO,GAAG,mBAAmB,CAAC,CAAC,KAAK,KACpC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,sBAAsB,CAAC,CAAC,KAAK,CAC3C,CAAC,CAAC,KAAK,OAAO,YAAY,UAAU,OAAO,UAAU,MAAM,IAAI,aAAa,YAAY,CAAC,CAAC,CAAC,CAAC;CAE9F,MAAM,YAAY,SAAS,IAAI,KAAK,OAAO,IAAI,SAAS,aAAa,CAAC;CAEtE,MAAM,oBAAoB,YACxB,OAAO,QAAQ,2BAA2B,CAAC,CAAC,OACzC,CAAC,KAAK,WACL,QAAQ,YAAY,SAAqD,KAC7E;CAEF,MAAM,cAAc,OAAyB,YAC3C,WAAW,OAAO,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,IAAI;CAErE,MAAM,kBAAkB,aAAsB;EAC5C,IAAI,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,EAAE;EACpD,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;EAC5D,kBAAkB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,gBAAgB;CAClF;CAEA,MAAM,qBAAqB,aAAsB;EAC/C,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;EACxE,OAAO,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,KAAK;EAChE,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;EACxE,YAAY,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,UAAU;EAC1E,iBAAiB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,eAAe;CACtF;CAEA,MAAM,qBAAqB,aAAsB;EAC/C,UAAU,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,QAAQ;EACtE,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;EACxE,cAAc,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,YAAY;EAC9E,oBAAoB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,kBAAkB;EAC1F,iBAAiB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,eAAe;EACpF,UAAU,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,QAAQ;EACtE,eAAe,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,aAAa;CAClF;CAEA,MAAM,8BAA8B,aAAsB;EACxD,WAAW,OAAO,QAAQ,oBAAoB,OAAO,QAAQ,oBAAoB,SAAS;EAC1F,cAAc,OACZ,QAAQ,oBAAoB,OAC5B,QAAQ,oBAAoB,YAC9B;EACA,UAAU,OAAO,QAAQ,oBAAoB,OAAO,QAAQ,oBAAoB,QAAQ;CAC1F;CAEA,MAAM,kBAAkB,aAAsB;EAC5C,UAAU,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,QAAQ;EAChE,WAAW,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,SAAS;EAClE,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;EAC5D,eAAe,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,aAAa;EAC1E,UAAU,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,QAAQ;EAChE,gBAAgB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,cAAc;CAC9E;CAEA,MAAM,YACJ,MACA,YACA,cACoE;EACpE,IAAI,SAAS,eACX,OAAO,cAAc,KAAA,IACjB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;GACT,KAAK;GACL,QAAQ,UAAU,IAAI,wBAAwB;IAAE,WAAW;IAAW;GAAM,CAAC;EAC/E,CAAC;EACP,IAAI,eAAe,KAAA,GAAW,OAAO;EAErC,OAAO,cAAc,KAAA,IACjB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;GACT,KAAK;GACL,QAAQ,UAAU,IAAI,wBAAwB;IAAE,WAAW;IAAW;GAAM,CAAC;EAC/E,CAAC;CACP;CAEA,MAAM,gCACJ,SACA,MACA,YACG;EACH,MAAM,aAAa,QAAQ,QAAQ,uBAAuB,OAAO;EAEjE,MAAM,YACJ,QAAQ,QAAQ,6BAA6B,KAAA,IACzC,KAAA,UACM,QAAQ,QAAQ,yBAA0B,OAAO;EAE7D,OAAO,SACL,MACA,cAAc,QAAQ,kBACtB,aAAa,QAAQ,oBACvB;CACF;CAEA,MAAM,kBAAkB,MAAuB,UAC7C,KAAK,cAAc,MAAM,aAAa,KAAK,UAAU,MAAM;CAE7D,MAAM,uBACJ,UACA,aACA,QACY;EACZ,IAAI,SAAS,OAAO,SAAS,MAAM,SAAS,SAAS,YAAY,SAAS,IAAI,OAAO;EACrF,MAAM,4BAAY,IAAI,IAAoB;EAE1C,KAAK,MAAM,QAAQ,SAAS,SAAS,aAAa;GAChD,IAAI,UAAU,IAAI,KAAK,YAAY,GAAG,OAAO;GAC7C,UAAU,IAAI,KAAK,cAAc,KAAK,QAAQ;EAChD;EACA,IAAI,SAAS,OAAO,MAAM,UAAU,CAAC,UAAU,IAAI,MAAM,YAAY,CAAC,GAAG,OAAO;EAChF,IAAI,SAAS,OAAO,MAAM,UAAU,MAAM,SAAS,cAAc,MAAM,UAAU,CAAC,GAChF,OAAO;EAET,MAAM,WAAW,SAAS,OAAO,QAAQ,UAAU;GACjD,MAAM,MAAM,MAAM,SAAS,cAAc,MAAM,UAAU;GAEzD,OAAO,OAAO,KAAK,MAAM,YAAY;EACvC,CAAC;EAED,MAAM,UAAU,IAAI,IAAI,SAAS,SAAS,UAAU,MAAM,OAAO,CAAC;EAClE,MAAM,cAAc,IAAI,IAAI,SAAS,KAAK,UAAU,MAAM,YAAY,CAAC;EAEvE,OAAO,YAAY,aAAa,MAC7B,gBACC,YAAY,QAAQ,OAAO,WAAW,QAAQ,IAAI,MAAM,CAAC,KACzD,YAAY,QAAQ,YAAY,sBAChC,SAAS,MACN,WACE,CAAC,YAAY,gBAAgB,MAAM,kBACnC,CAAC,YAAY,qBAAqB,MAAM,kBAC7C,CACJ;CACF;CAEA,MAAM,wBAAwB,OAAO,GAAG,uCAAuC,CAAC,CAAC,WAC/E,OACA;EACA,MAAM,mBAAmB,yBAAyB,MAAM,gBAAgB;EAExE,MAAM,WAAW,OAAO,+BAA+B,MAAM,cAAc,QAAQ,CAAC,CAAC,KACnF,OAAO,SAAS,WAAW,CAC7B;EAEA,MAAM,cAAc,OAAO,4BAA4B,MAAM,cAAc,WAAW;EAEtF,MAAM,aACJ,MAAM,eAAe,KAAA,IACjB,KAAA,IACA,OAAO,2BAA2B,MAAM,UAAU;EAExD,OAAO,OAAO,OAAO;GACnB,GAAG;GACH;GACA,aAAa,OAAO,OAAO;IACzB,UAAU,SAAS,KAAK,SAAS,MAAM,MAAM,YAAY,QAAQ,CAAC;IAClE,eAAe,MAAM,YAAY;GACnC,CAAC;GACD,cAAc,OAAO,OAAO,EAAE,GAAG,MAAM,aAAa,CAAC;GACrD,GAAI,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW;GACjD,eAAe,OAAO,OAAO;IAC3B,WAAW,OAAO,OAAO;KACvB,GAAG,MAAM,cAAc;KACvB,UAAU,yBAAyB,MAAM,cAAc,UAAU,QAAQ;IAC3E,CAAC;IACD;IACA;GACF,CAAC;EACH,CAAC;CACH,CAAC;CAED,MAAM,cAAc,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAC3D,SACA,WACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,SAAgB;EAC1E,MAAM,IAAI,eAAe,OAAO;EAOhC,OAAO;GAAE;GAAiB,MAAK,OALX,WAClB,SAAS,OAAO,CAAC,CAAC,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAAC,MAAM,GAAG,EAAE,IAAI,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,GACtF,OACF,EAAA,CAEoC;EAAG;CACzC,CAAC;CAED,MAAM,iBAAiB,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,YACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EAEnC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,IAAI,GAAG,EAAE,WAAW,WAAW,SAAS,GAAG,GAAG,EAAE,OAAO,WAAW,KAAK,CAAC,CAAC,CAAC,CAChF,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,yBAAyB,OAAO,GAAG,gCAAgC,CAAC,CAAC,WACzE,SACA,UACA,iBACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EAEnC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,IAAI,GAAG,EAAE,UAAU,QAAQ,GAAG,GAAG,EAAE,WAAW,eAAe,CAAC,CAAC,CAAC,CACtE,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,oBAAoB,OAAO,GAAG,mCAAmC,CAAC,CAAC,WACvE,SACA,UACA,YACA,oBACA,SACA;EACA,MAAM,WAAW,OAAO;EAIxB,MAAM,cAAc,OAAO,eAAe,SAAS,YAAY,KAAK,EAAA,CAAG;EAEvE,IAAI,eAAe,KAAA,KAAa,CAAC,QAAQ,WAAW,UAAU,UAAU,GAAG,OAAO,KAAA;EAClF,MAAM,mBAAmB,WAAW,QAAQ,WAAW;EAWvD,MAAM,WAAU,OATW,WACzB,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,GAAG,eAAe,OAAO,CAAC,CAAC,IAAI,gBAAgB,CAAC,CAAC,CACvD,MAAM,CAAC,GACV,OACF,EAAA,CAE4B;EAE5B,IAAI,YAAY,KAAA,KAAa,CAAC,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,GAC1F,OAAO,KAAA;EAET,MAAM,iBAAgB,OADK,eAAe,SAAS,YAAY,OAAO,EAAA,CACpC;EAElC,IACE,kBAAkB,KAAA,KAClB,CAAC,QAAQ,WAAW,UAAU,aAAa,KAC3C,CAAC,QAAQ,UAAU,OAAO,kBAAkB,cAAc,QAAQ,WAAW,UAAU,GAEvF,OAAO,KAAA;EACT,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,gBAAgB;EAErE,IAAI,uBAAuB,KAAA,KAAa,uBAAuB,WAAW,OAAO,KAAA;EAEjF,MAAM,cAAa,OADQ,uBAAuB,SAAS,UAAU,kBAAkB,OAAO,EAAA,CAC/D;EAE/B,IAAI,eAAe,KAAA,GACjB,OAAO;GAAE,iBAAiB;GAAkB;GAAS,YAAY;EAAc;EAMjF,OAAO;GACL,iBAAiB;GACjB;GACA,YAAY;GACZ;GACA,UAAA,OATsB,QAAQ,WAC7B,OAAO;IAAE;IAAU;IAAS,YAAY;IAAe;GAAW,CAAC,CAAC,CACpE,KAAK,OAAO,QAAQ,0BAA0B,CAAC;EAQlD;CACF,CAAC;CAED,MAAM,SACJ,UACA,SACA,eACA,SACG;EACH,IAAI,CAAC,iBAAiB,OAAO,GAAG,OAAO,OAAO,KAAK,YAAY,CAAC;EAEhE,MAAM,MAAM,uBAER,SAAS,aAAa,gBACpB,KAAK,KACH,OAAO,eAAe,oBAAoB,WAAW,GACrD,OAAO,eAAe,iBAAiB,WAA0C,CACnF,CACF,GACF,EAAE,MAAM,cAAc,KAAK,CAC7B,CAAC,CAAC,KAAK,OAAO,KAAK,WAAW,OAAO,KAAK,CAAC;EAE3C,OAAO,cAAc,gBAAgB,OACjC,OAAO,IAAI,aAAa;GACtB,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;GACrD,OAAO,cAAc;GAErB,OAAO,OAAO;EAChB,CAAC,IACD;CACN;CAIA,MAAM,gBAAgB,OAAO,WAAW,WACtC,OACA;EACA,MAAM,iBAAiB,OAAO,OAAO,cAAc,8BAA8B;EAEjF,IAAI,OAAO,OAAO,cAAc,GAAG;EAEnC,MAAM,gBAAgB,OAAO,IAAI,aAAa;GAC5C,MAAM,cAAc,OAAO;GAE3B,IAAI,EAAE,OAAO,MAAM,KAAK,OAAO,eAAe,oBAAoB,WAAW,CAAC,IAC5E,OAAO,OAAO,YAAY;EAC9B,CAAC,CAAC,CAAC,KAAK,gBAAgB;EAExB,IAAI,CAAC,eAAe,MAAM,SAAS,aAAa,GAAG,OAAO,OAAO,YAAY;CAC/E,CAAC;CAED,MAAM,YACJ,UACA,eACA,SAEA,OAAO,IAAI,aAAa;EACtB,IAAI,cAAc,gBAAgB,MAAM;GACtC,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;GACrD,OAAO,cAAc;EACvB;EAEA,OAAO,OAAO,SAAS,aAAa,gBAClC,KAAK,KACH,OAAO,eAAe,oBAAoB,WAAW,GACrD,OAAO,eAAe,iBAAiB,WAA0C,CACnF,CACF;CACF,CAAC;CAEH,MAAM,kCACJ,UACG;EACH,MAAM,aAAa,MAAM,WAAW;EACpC,MAAM,UAAU,WAAW;EAE3B,IACE,WAAW,aAAa,GAAG,MAAM,SAAS,WAC1C,WAAW,YAAY,oBACvB,QAAQ,SAAS,aACjB,MAAM,eAAe,KAAA,KACrB,QAAQ,SAAS,cAAc,MAAM,iBAAiB,aACtD,QAAQ,SAAS,qBAAqB,MAAM,iBAAiB,oBAC7D,CAAC,eAAe,QAAQ,YAAY,MAAM,WAAW,UAAU,GAE/D,OAAO;EAET,MAAM,WAAW,CAAC,GAAG,MAAM,iBAAiB,WAAW,CAAC,CAAC,MAAM,MAAM,UACnE,KAAK,aAAa,cAAc,MAAM,YAAY,CACpD;EAEA,MAAM,SAAS,CAAC,GAAG,QAAQ,SAAS,WAAW,CAAC,CAAC,MAAM,MAAM,UAC3D,KAAK,aAAa,cAAc,MAAM,YAAY,CACpD;EAEA,OACE,SAAS,WAAW,OAAO,UAC3B,SAAS,OACN,MAAM,UACL,KAAK,iBAAiB,OAAO,MAAM,CAAE,gBACrC,KAAK,aAAa,OAAO,MAAM,CAAE,QACrC;CAEJ;CAEA,MAAM,uBAAuB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACrE,eACA,OACA;EACA,MAAM,WAAW,OAAO;EAExB,IAAI,cAAc,UAAU,KAAA,GAAW,OAAO,OAAO,OAAO,KAAK,YAAY,CAAC;EAC9E,MAAM,aAAa,EAAE,MAAM,+BAA+B;EAE1D,MAAM,OAA4B;GAChC;GACA,UAAU,UAAU,SAAS,YAAY,QAAQ,QAAQ,QAAQ,QAAQ,CAAC;EAC5E;EAEA,MAAM,QAAQ,uBAEV,SAAS,aAAa,gBACpB,oBACE,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MACA,OAAO,KAAK,UAAU,SAChB,KACR,CAAC,CAAC,KACA,OAAO,eAAe,iBAAiB,WAA0C,CACnF,CACF,GACF,EAAE,MAAM,cAAc,KAAK,CAC7B;EAEA,IAAI,cAAc,gBAAgB,SAAS,OAAO,iBAAiB,OAAO,OAAO,YAAY;EAC7F,OAAO,cAAc;EAErB,OAAO,OAAO,MAAM,KAClB,OAAO,GAAG,KAAK,GACf,OAAO,YAAY,UAAU;GAC3B,MAAM,SAAS,MAAM,QAAQ;GAE7B,OAAO,MAAM,QAAQ,WAAW,KAC9B,WAAW,KAAA,KACX,MAAM,aAAa,MAAM,KACzB,OAAO,UAAU,aACf,OAAO,QAAQ,IAAI,IACnB,OAAO,UAAU,KAAK;EAC5B,CAAC,CACH;CACF,CAAC;CAED,MAAM,4BAA4B,OAAO,GAAG,2CAA2C,CAAC,CACtF,WACE,SACA,eACA,OACA,QACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,SAAS,OAAO,YACpB,SACA,MAAM,iBAAiB,WACvB,cAAc,OAChB;EAEA,MAAM,MAAM,OAAO;EAEnB,IACE,QAAQ,KAAA,KACR,CAAC,QAAQ,QAAQ,eAAe,IAAI,QAAQ,QAAQ,OAAO,KAC3D,IAAI,QAAQ,QAAQ,sBAAsB,MAAM,iBAAiB,kBAEjE,OAAO,KAAA;EACT,IACE,MAAM,cAAc,UAAU,aAAa,MAAM,YACjD,MAAM,cAAc,UAAU,WAAW,UACzC,MAAM,cAAc,UAAU,cAAc,MAAM,aAClD,MAAM,cAAc,UAAU,SAAS,cAAc,MAAM,iBAAiB,aAC5E,MAAM,cAAc,UAAU,SAAS,qBACrC,MAAM,iBAAiB,oBACxB,MAAM,cAAc,SAAS,WAAuB,MAAM,aAC3D,MAAM,cAAc,SAAS,kBAC3B,MAAM,cAAc,UAAU,iBAChC,MAAM,cAAc,SAAS,SAAS,cAAc,MAAM,iBAAiB,aAC3E,MAAM,cAAc,SAAS,SAAS,qBACpC,MAAM,iBAAiB,oBACxB,WAAW,mBACT,MAAM,eAAe,KAAA,KACpB,MAAM,cAAc,UAAU,uBAAuB,KAAA,IAEzD,OAAO,KAAA;EACT,IACE,MAAM,iBAAiB,YAAY,MAChC,aACC,CAAC,MAAM,cAAc,SAAS,SAAS,YAAY,MAChD,WACC,OAAO,iBAAiB,SAAS,gBACjC,OAAO,aAAa,SAAS,QACjC,CACJ,GAEA,OAAO,KAAA;EACT,IAAI,MAAM,eAAe,KAAA,GAAW;GAClC,MAAM,cAAc,OAAO,eACzB,SACA,MAAM,WAAW,YACjB,cAAc,OAChB,EAAA,CAAG;GAEH,IACE,eAAe,KAAA,KACf,CAAC,QAAQ,WAAW,UAAU,UAAU,KACxC,CAAC,QAAQ,UAAU,OACjB,WAAW,QAAQ,WAAW,YAC9B,OAAO,eACT,KACA,WAAW,QAAQ,WAAW,qBAC5B,MAAM,WAAW,2BAEnB,OAAO,KAAA;EACX;EAEA,MAAM,cAAc,CAClB,GAAG,MAAM,iBAAiB,aAC1B,GAAG,MAAM,cAAc,SAAS,SAAS,WAC3C;EAEA,MAAM,WAAW,IAAI,IAAI,YAAY,KAAK,SAAS,CAAC,KAAK,cAAc,IAAI,CAAC,CAAC;EAE7E,MAAM,KAAK,2BAA2B,OAAO;EAE7C,MAAM,iBACJ,SAAS,SAAS,IACd,CAAC,IACD,OAAO,WACL,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,oBAAoB,KAAK,CAAC,CACvC,MACC,IACE,GAAG,GAAG,WAAW,OAAO,eAAe,GACvC,QAAQ,GAAG,cAAc,CAAC,GAAG,SAAS,KAAK,CAAC,CAAC,CAC/C,CACF,CAAC,CACA,QAAQ,GAAG,YAAY,GAC1B,cAAc,OAChB;EAEN,IAAI,eAAe,WAAW,SAAS,MAAM,OAAO,KAAA;EAEpD,KAAK,MAAM,UAAU,gBAAgB;GACnC,MAAM,SAAS,SAAS,IAAI,OAAO,QAAQ,oBAAoB,aAAa;GAE5E,IACE,WAAW,KAAA,KACX,OAAO,QAAQ,oBAAoB,cAAc,OAAO,YACvD,QAAQ,oBAAoB,WAAW,KAAA,KACtC,QAAQ,oBAAoB,iBAC1B,OAAO,QAAQ,oBAAoB,OACrC,MAAM,MAER,OAAO,KAAA;GACT,SAAS,OAAO,OAAO,YAAY;EACrC;EACA,IAAI,SAAS,SAAS,GAAG,OAAO,KAAA;EAChC,IAAI,MAAM,eAAe,KAAA,GAAW;GAClC,MAAM,cAAc,OAAO,eAAe,SAAS,MAAM,WAAW,YAAY,KAAK,EAAA,CAAG;GAExF,MAAM,cAAc,OAAO,uBACzB,SACA,MAAM,UACN,OAAO,iBACP,cAAc,OAChB,EAAA,CAAG;GAEH,IAAI,eAAe,KAAA,KAAa,eAAe,KAAA,GAAW,OAAO,KAAA;GAEjE,MAAM,WAAW,OAAO,QAAQ,WAAW,OAAO;IAChD,UAAU,MAAM;IAChB,SAAS;IACT;IACA;GACF,CAAC;GAED,IAAI,CAACA,+BAAuB,UAAU,MAAM,UAAU,GAAG,OAAO,KAAA;EAClE;EACA,MAAM,qBAAqB,OAAO,QAAQ,QAAQ,wBAAwB,KAAK,MAAM;EACrF,MAAM,MAAM,OAAO;EAEnB,IACE,CAAC,oBAAoB,MAAM,cAAc,UAAU,MAAM,cAAc,aAAa,GAAG,KACvF,CAAC,oBAAoB,MAAM,cAAc,UAAU,oBAAoB,GAAG,GAE1E,OAAO,KAAA;EACT,IACE,MAAM,aAAa,qBAAqB,eACxC,QAAQ,wBAAwB,4BAEhC,OAAO,KAAA;EAET,OAAO;GAAE,GAAG;GAAQ;EAAI;CAC1B,CACF;CAEA,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,UACA,WACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,eAAe,OAAO;EAEhC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,IAAI,GAAG,EAAE,UAAU,QAAQ,GAAG,GAAG,EAAE,WAAW,SAAS,CAAC,CAAC,CAAC,CAChE,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,OACA,QACA,KACA;EAGA,OAAO,QAAO,OAFU,mBAAA,CAED,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,OACnD,QAAQ,QAAQ,aAAa;GAC3B,UAAU,MAAM;GAChB,WAAW,MAAM;GACjB;GACA,eAAe,MAAM,cAAc,UAAU;GAC7C,UAAU;GACV,sBAAsB,MAAM,QAAQ;EACtC,CAAC,CACH;CACF,CAAC;CAED,MAAM,yBAAyB,OAAO,GAAG,wCAAwC,CAAC,CAAC,WACjF,SACA,OACA,iBACA,SACA,qBACA,KACA;EACA,IACE,YAAY,KAAA,KACZ,CAAC,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,KAC/D,wBAAwB,KAAA,KACvB,QAAQ,oBAAoB,WAAW,KAAA,KACtC,QAAQ,oBAAoB,iBAC1B,oBAAoB,QAAQ,oBAAoB,OAClD,MAAM,MAER,OAAO;EACT,IAAI,MAAM,eAAe,KAAA,GAAW;GAClC,MAAM,cAAc,OAAO,eAAe,SAAS,MAAM,WAAW,YAAY,KAAK,EAAA,CAAG;GAExF,IACE,eAAe,KAAA,KACf,CAAC,QAAQ,WAAW,UAAU,UAAU,KACxC,CAAC,QAAQ,UAAU,OAAO,WAAW,QAAQ,WAAW,YAAY,eAAe,KACnF,WAAW,QAAQ,WAAW,qBAC5B,MAAM,WAAW,2BAEnB,OAAO;GAET,MAAM,cAAc,OAAO,uBACzB,SACA,MAAM,UACN,iBACA,KACF,EAAA,CAAG;GAEH,IAAI,eAAe,KAAA,GAAW,OAAO;GASrC,KAAI,OAPmB,QAAQ,WAAW,OAAO;IAC/C,UAAU,MAAM;IAChB;IACA;IACA;GACF,CAAC,EAAA,CAEW,+BAA+B,MAAM,WAAW,4BAC1D,OAAO;EACX;EACA,MAAM,OAAO,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,WAAW,KAAK;EACjF,MAAM,MAAM,KAAK;EAEjB,OACE,KAAK,WAAW,KAChB,IAAI,QAAQ,QAAQ,YAAY,MAAM,cAAc,UAAU,UAC9D,IAAI,QAAQ,QAAQ,mBAAmB,MAAM,cAAc,UAAU,iBACrE,IAAI,QAAQ,QAAQ,cAAc,cACjC,OAAO,QAAQ,cAAc,IAAI,QAAQ,QAAQ,eAAe,OAC/D,MAAM,QAAQ;CAEpB,CAAC;CAED,MAAM,gBAAgB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAC/D,SACA,eACA,OACA,WAMA,YACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,EAAE,cAAc,oBAAoB,iBAAiB,yBAAyB;EAEpF,MAAM,YAAY,OAAO,0BACvB,SACA,eACA,OACA,cACF;EAEA,IAAI,cAAc,KAAA,GAAW,OAAO;EACpC,KAAK,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,WAAW,IAAI,EAAA,CAAG,QAAQ,OAAO;EAC1F,KACG,OAAO,uBAAuB,SAAS,MAAM,UAAU,UAAU,iBAAiB,IAAI,EAAA,CACpF,QAEH,OAAO;EAET,OAAO,SAAS,OAAO,QAAQ,WAAW,KAAK,CAAC,CAAC,OAC/C,QAAQ,WAAW,aAAa;GAC9B,UAAU,MAAM;GAChB,WAAW,UAAU;GACrB;GACA;GACA;GACA,aAAa,MAAM;EACrB,CAAC,CACH;EACA,OAAO,SAAS,OAAO,QAAQ,oBAAoB,KAAK,CAAC,CAAC,OACxD,QAAQ,oBAAoB,aAAa;GACvC,WAAW,UAAU;GACrB;GACA,UAAU;EACZ,CAAC,CACH;EACA,OAAO,SACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,IAAI,aAAa,CAAC,CAAC,QAAQ,QAAQ,kBAAkB,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAC7E,MACC,IACE,GAAG,eAAe,OAAO,CAAC,CAAC,IAAI,UAAU,eAAe,GACxD,GAAG,eAAe,OAAO,CAAC,CAAC,kBAAkB,MAAM,iBAAiB,gBAAgB,CACtF,CACF;EACF,OAAO,cAAc,SAAS,OAAO,gBAAgB,cAAc,UAAU,GAAG;EAEhF,MAAM,UAAU,qBACd,SACA,OACA,UAAU,iBACV,WACA,cAAc,UAAU,GAC1B;EAEA,IAAI,EAAE,OAAO,UAAU,OAAO,OAAO,YAAY;EACjD,OAAO,cAAc,OAAO;EAE5B,OAAO;CACT,CAAC;CAED,MAAM,6BAA6B,OAAO,GAAG,4BAA4B,CAAC,CAAC,WACzE,SACA,eAKA;EACA,MAAM,WAAW,OAAO;EAExB,IAAI,CAAC,cAAc,aACjB,QACE,WAAW,kBAAkB;GAC3B,GAAG;GACH,OAAO,cAAc,OAAO;EAC9B,CAAC,KAAK,OAAO,KAAA,CACb,KAAK,OAAO,SAAS,WAAW,CAAC;EACrC,MAAM,QAAQ,OAAO;EAErB,IAAI,CAAC,iBAAiB,OAAO,GAAG,OAAO,OAAO,YAAY;EAC1D,MAAM,OAAO,OAAO;EAEpB,MAAM,cAAc,OAAO,wBACzB,OAAO,iBAAiB,aAAa,KAAK,QAAQ,kBAAkB,GAAG,IAAI,CAAC,CAAC,CAAC,KAC5E,gBACF,GACA,SACA,aACF;EAEA,OAAO,oBAAoB,GAAG;GAC5B,GAAG;GACH,iBAAiB,UACf,SACE,UACA,eACA,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAE3B,MAAM,SAAS,OAAO,YAAY,SAAS,MAAM,WAAW,KAAK;IAEjE,IACE,OAAO,QAAQ,KAAA,KACf,CAAC,QAAQ,QAAQ,eAAe,OAAO,IAAI,QAAQ,QAAQ,OAAO,GAElE,OAAO,OAAO,KAAK;IAErB,MAAM,cAAc,OAAO,uBACzB,SACA,MAAM,UACN,OAAO,iBACP,KACF,EAAA,CAAG;IAEH,IAAI,eAAe,KAAA,GAAW,OAAO,OAAO,KAAK;IACjD,MAAM,KAAK,kBAAkB,OAAO;IAOpC,MAAM,cAAa,OALQ,YACxB,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,GAAG,GAAG,WAAW,OAAO,eAAe,CAAC,EAAA,CAElB,MAAM,QAAa,QAAQ,WAAW,UAAU,GAAG,CAAC;IAEnF,IAAI,eAAe,KAAA,GAAW,OAAO,OAAO,KAAK;IAEjD,MAAM,WAAW,OAAO,QAAQ,WAC7B,OAAO;KACN,UAAU,MAAM;KAChB,SAAS,OAAO;KAChB;KACA;IACF,CAAC,CAAC,CACD,KAAK,OAAO,QAAQ,0BAA0B,CAAC;IAElD,OAAO,OAAO,KAAK,QAAQ;GAC7B,CAAC,CACH,CAAC,CAAC,KACA,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,iBAAiB,UACf,SACE,UACA,eACA,OAAO,IAAI,aAAa;IACtB,MAAM,WAAW,OAAO,kBACtB,SACA,MAAM,UACN,MAAM,YACN,KAAA,GACA,KACF;IAEA,OAAO,UAAU,aAAa,KAAA,KAC5B,SAAS,SAAS,+BAA+B,KAAA,IAC/C,OAAO,KAAK,IACZ,OAAO,KAAK,SAAS,QAAQ;GACnC,CAAC,CACH,CAAC,CAAC,KACA,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,cAAc,YAAY,YACxB,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,OAAO,sBAAsB,UAAU;IAErD,MAAM,eAAe,OAAO,SAC1B,cAAc,MACd,QAAQ,sBACR,QAAQ,wBACV;IAEA,MAAM,qBAAqB,OAAO,SAChC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,kBAAkB,OAAO,SAC7B,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,uBAAuB,OAAO,6BAClC,SACA,cAAc,MACd,MAAM,iBAAiB,gBACzB;IAEA,IAAI,yBAAyB,MAAM,iBAAiB,kBAClD,OAAO,OAAO,YAAY;IAE5B,OAAO,OAAO,MACZ,UACA,SACA,eACA,OAAO,IAAI,aAAa;KACtB,MAAM,UAAU,OAAO;KASvB,OAAO,SAAQ,OAPQ,cAAc,SAAS,eAAe,OAAO;MAClE;MACA;MACA;MACA;KACF,CAAC,KAEwB,YAAY,YAAY,OAAO;IAC1D,CAAC,CACH;GACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,mBAAmB,YAAY,YAC7B,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,OAAO,sBAAsB,UAAU;IAErD,MAAM,qBAAqB,OAAO,SAChC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,kBAAkB,OAAO,SAC7B,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,uBAAuB,OAAO,6BAClC,SACA,cAAc,MACd,MAAM,iBAAiB,gBACzB;IAEA,IACE,yBAAyB,MAAM,iBAAiB,oBAC/C,MAAM,eAAe,KAAA,KACpB,uBAAuB,MAAM,WAAW,oBAE1C,OAAO,OAAO,YAAY;IAE5B,OAAO,OAAO,MACZ,UACA,SACA,eACA,OAAO,IAAI,aAAa;KACtB,OAAO,OAAO,UACZ,SACA,eACA,OACA,mBACA;MAAE;MAAoB;MAAiB;KAAqB,GAC5D,OACF;IACF,CAAC,CACH;GACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,aAAa,WACV,cAAc,UAAU,KAAA,IACrB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI,aAAa;IACtB,IACE,MAAM,SAAS,UAAU,KACzB,CAAC,MAAM,SAAS,SAAS,QAAQ,KACjC,MAAM,YAAY,oBAClB,MAAM,QAAQ,SAAS,WAEvB,OAAO;IACT,MAAM,UAAU,MAAM;IACtB,MAAM,mBAAmB,MAAM,SAAS,MAAM,GAAG,EAAgB;IA6BjE,QAAO,OA3BgB,SACrB,UACA,eACA,OAAO,IAAI,aAAa;KACtB,MAAM,WAAW,OAAO,kBACtB,SACA,kBACA,QAAQ,YACR,QAAQ,SAAS,WACjB,KACF;KAEA,OACE,UAAU,aAAa,KAAA,KACvB,SAAS,SAAS,SAAS,qBACzB,QAAQ,SAAS,oBACnB,QAAQ,SAAS,YAAY,OAAO,SAClC,SAAS,SAAU,SAAS,YAAY,MACrC,WACC,OAAO,iBAAiB,KAAK,gBAC7B,OAAO,aAAa,KAAK,QAC7B,CACF;IAEJ,CAAC,CACH,KAEiB,OAAO,qBAAqB,eAAe,KAAK,IAAI;GACvE,CAAC,EAAA,CACH,KACA,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,iBAAiB,YAAY,aAC1B,cAAc,UAAU,KAAA,IACrB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,OAAO,OAAO;KAC1B,GAAI,OAAO,sBAAsB,UAAU;KAC3C,YAAY,WAAW;IACzB,CAAC;IAED,MAAM,qBAAqB,OAAO,SAChC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,kBAAkB,OAAO,SAC7B,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,uBAAuB,OAAO,6BAClC,SACA,cAAc,MACd,MAAM,iBAAiB,gBACzB;IAEA,IACE,yBAAyB,MAAM,iBAAiB,oBAC/C,MAAM,eAAe,KAAA,KACpB,uBAAuB,MAAM,WAAW,oBAE1C,OAAO,OAAO,YAAY;IAE5B,OAAO,OAAO,MACZ,UACA,SACA,eACA,OAAO,IAAI,aAAa;KACtB,MAAM,UAAU,OAAO;KAEvB,IAAI,CAAC,+BAA+B,KAAK,GAAG,OAAO,QAAQ,YAAY,OAAO;KAE9E,MAAM,YAAY,OAAO,0BACvB,SACA,eACA,OACA,gBACF;KAEA,IAAI,cAAc,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;KAC/D,KAAK,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,WAAW,IAAI,EAAA,CAAG,QACzE,OAAO,QAAQ,YAAY,OAAO;KAQpC,IAAI,EAAC,OANkB,0BACrB,SACA,OACA,UAAU,eACZ,IAEc,OAAO,QAAQ,YAAY,OAAO;KAChD,IAAI;KAEJ,OAAO,oBACL,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MAAM,YACN,OAAO,IAAI,aAAa;MACtB,MAAM,YAAY;OAChB;OACA;OACA;MACF;MAEA,MAAM,UAAU,OAAO,iBACrB,SACA,OACA,UAAU,iBACV,WACA,UAAU,GACZ;MAEA,IAAI,SACF,OAAO,oBACL,SACA,OACA,UAAU,iBACV,WACA,UAAU,GACZ;MAEF,OAAO;KACT,CAAC,IACA,aAAa;MACZ,kBAAkB,QAChB,aAAa,cAAc,YAAY,YACvC,OACF;MAEA,OAAO;KACT,CACF;KAEA,OAAO,mBAAmB,QAAQ,YAAY,OAAO;IACvD,CAAC,CACH;GACF,CAAC,EAAA,CACH,KACA,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACJ,CAAC;CACH,CAAC;CAED,MAAM,4BAA4B,OAAO,GAAG,2CAA2C,CAAC,CACtF,WAAW,SAAkB,OAA8B,iBAA0B;EACnF,IAAI,MAAM,eAAe,KAAA,GAAW,OAAO;EAE3C,MAAM,OAAO,OAAO,uBAClB,SACA,MAAM,UACN,iBACA,IACF,EAAA,CAAG;EAEH,IAAI,QAAQ,KAAA,GAAW,OAAO;EAE9B,OACE,IAAI,QAAQ,WAAW,kBAAkB,MAAM,WAAW,gBAC1D,IAAI,QAAQ,WAAW,wBAAwB,MAAM,WAAW,sBAChE,IAAI,QAAQ,WAAW,qBAAqB,MAAM,WAAW,mBAC7D,IAAI,QAAQ,WAAW,cAAc,SAAS,MAAM,MAAM,WAAW,QAAQ,KAC7E,IAAI,QAAQ,WAAW,mBAAmB,MAAM,WAAW,iBAC3D,MAAM,cAAc,UAAU,uBAAuB,MAAM,WAAW;CAE1E,CACF;CAEA,MAAM,uBAAuB,OAAO,GAAG,sCAAsC,CAAC,CAAC,WAC7E,SACA,OACA,iBACA,WAMA,KACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO,GACjC,IAAI,eAAe,OAAO;EAE5B,MAAM,cAAc,OAAO,SACxB,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,WAAW,eAAe,GAC/B,GAAG,EAAE,cAAc,UAAU,YAAY,GACzC,GAAG,EAAE,oBAAoB,UAAU,kBAAkB,GACrD,GAAG,EAAE,iBAAiB,UAAU,eAAe,GAC/C,GAAG,EAAE,UAAU,SAAS,MAAM,MAAM,YAAY,QAAQ,CAAC,GACzD,GAAG,EAAE,eAAe,MAAM,YAAY,aAAa,CACrD,CACF,CAAC,CACA,MAAM,CAAC,EAAA,CAAG;EAEb,MAAM,WAAW,OAAO,SACrB,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,IAAI,GAAG,EAAE,IAAI,eAAe,GAAG,GAAG,EAAE,kBAAkB,UAAU,oBAAoB,CAAC,CAAC,CAAC,CAC7F,MAAM,CAAC,EAAA,CAAG;EAEb,MAAM,uBAAuB,OAAO,SACjC,OAAO,CAAC,CACR,KAAK,QAAQ,oBAAoB,KAAK,CAAC,CACvC,MACC,IACE,GAAG,2BAA2B,OAAO,CAAC,CAAC,WAAW,eAAe,GACjE,GAAG,2BAA2B,OAAO,CAAC,CAAC,cAAc,UAAU,YAAY,GAC3E,GAAG,2BAA2B,OAAO,CAAC,CAAC,UAAU,UAAU,kBAAkB,CAC/E,CACF,CAAC,CACA,MAAM,CAAC,EAAA,CAAG;EAGb,OACE,eAAe,KAAA,KACf,WAAW,QAAQ,WAAW,kBAAkB,UAAU,gBAC1D,WAAW,QAAQ,WAAW,wBAAwB,UAAU,sBAChE,WAAW,QAAQ,WAAW,qBAAqB,UAAU,mBAC7D,WAAW,QAAQ,WAAW,cAAc,SAAS,MAAM,MAAM,YAAY,QAAQ,KACrF,WAAW,QAAQ,WAAW,mBAAmB,MAAM,YAAY,kBAClE,OAAO,uBACN,SACA,OACA,iBACA,SACA,qBACA,GACF;CAEJ,CAAC;CAED,MAAM,mBAAmB,OAAO,GAAG,kCAAkC,CAAC,CAAC,WACrE,SACA,OACA,iBACA,WAKA,KACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EACnC,MAAM,IAAI,eAAe,OAAO;EAEhC,OAAO,SACJ,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,IACC,QAAQ,WAAW,kBAAkB;GACnC,aAAa,MAAM;GACnB,oBAAoB,UAAU;GAC9B,iBAAiB,UAAU;EAC7B,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,WAAW,eAAe,GAC/B,GAAG,EAAE,cAAc,MAAM,WAAY,YAAY,GACjD,GAAG,EAAE,oBAAoB,MAAM,WAAY,kBAAkB,GAC7D,GAAG,EAAE,iBAAiB,MAAM,WAAY,eAAe,GACvD,GAAG,EAAE,UAAU,SAAS,MAAM,MAAM,WAAY,QAAQ,CAAC,GACzD,GAAG,EAAE,eAAe,MAAM,WAAY,aAAa,CACrD,CACF;EACF,OAAO,SACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,IAAI,aAAa,CAAC,CAAC,QAAQ,QAAQ,kBAAkB,UAAU,oBAAoB,CAAC,CAAC,CAAC,CAAC,CACvF,MACC,IACE,GAAG,EAAE,IAAI,eAAe,GACxB,GAAG,EAAE,kBAAkB,MAAM,iBAAiB,gBAAgB,CAChE,CACF;EACF,OAAO,SACJ,OAAO,QAAQ,oBAAoB,KAAK,CAAC,CACzC,IAAI,QAAQ,oBAAoB,eAAe,UAAU,kBAAkB,CAAC,CAAC,CAC7E,MACC,IACE,GAAG,2BAA2B,OAAO,CAAC,CAAC,WAAW,eAAe,GACjE,GAAG,2BAA2B,OAAO,CAAC,CAAC,cAAc,MAAM,WAAY,YAAY,GACnF,GAAG,2BAA2B,OAAO,CAAC,CAAC,UAAU,MAAM,WAAY,kBAAkB,CACvF,CACF;EACF,OAAO,cAAc,SAAS,OAAO,MAAM,cAAc,UAAU,QAAQ,GAAG;EAE9E,OAAO,OAAO,qBACZ,SACA,OACA,iBACA;GACE,GAAG;GACH,cAAc,MAAM,WAAY;EAClC,GACA,GACF;CACF,CAAC;CAED,MAAM,uBACJ,SACA,OACA,iBACA,WAKA,QAEA,cACE,qBACE,SACA,OACA,iBACA;EAAE,GAAG;EAAW,cAAc,MAAM,WAAY;CAAa,GAC7D,GACF,CACF;CAEF,MAAM,YAAY,OAAO,GAAG,mBAAmB,CAAC,CAAC,WAC/C,SACA,eACA,OACA,QACA,WAKA,SACA;EACA,MAAM,UAAU,OAAO;EAEvB,MAAM,YAAY,OAAO,0BAA0B,SAAS,eAAe,OAAO,MAAM;EAExF,IAAI,cAAc,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;EAC/D,KAAK,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,WAAW,IAAI,EAAA,CAAG,QACzE,OAAO,QAAQ,YAAY,OAAO;EACpC,IAAI,EAAE,OAAO,0BAA0B,SAAS,OAAO,UAAU,eAAe,IAC9E,OAAO,QAAQ,YAAY,OAAO;EACpC,MAAM,WAAW,QAAQ,WAAW,OAAO;EAE3C,IACE,EAAE,OAAO,iBACP,SACA,OACA,UAAU,iBACV,WACA,UAAU,GACZ,IAEA,OAAO,OAAO,YAAY;EAC5B,OAAO,oBAAoB,SAAS,OAAO,UAAU,iBAAiB,WAAW,UAAU,GAAG;EAE9F,OAAO;CACT,CAAC;CA4BD,OAAO;EAAE;EAA4B,mBAAA;GAxBnC;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA,wBAAA;GACA;GACA;GACA;GACA;GACA;EAGmD;CAAE;AACzD"}
1
+ {"version":3,"file":"password-kernel.mjs","names":["sameCredentialSnapshot"],"sources":["../../src/internal/password-kernel.ts"],"sourcesContent":["import {\n coordinateCommit,\n CurrentCommitJournal,\n hasCommitScope,\n type CommitJournal,\n type PreparedCommit,\n LifecycleHooks,\n HookConfigurationError,\n} from \"@yielded/auth/Hooks\";\nimport type { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport {\n PasswordUnavailable,\n PasswordPersistence,\n type PasswordMutationInput,\n snapshotPasswordCredential,\n snapshotPasswordRequirement,\n snapshotPasswordRevision,\n type PasswordAction,\n type PasswordMutationDecision,\n} from \"@yielded/auth/Password\";\nimport { reportPersistenceFailure } from \"@yielded/auth/Persistence\";\nimport {\n type ProofCompletionPlan,\n type ProofCompletionInput,\n ProofUnavailable,\n} from \"@yielded/auth/Proofs\";\nimport {\n snapshotAuthenticationEvidence,\n type AuthenticationEvidence,\n type AuthenticationRequirement,\n type SecurityRevision,\n} from \"@yielded/auth/Sessions\";\nimport { Cause, Context, DateTime, Effect, Option, Redacted, Schema } from \"effect\";\nimport type { SqlClient } from \"effect/sql/SqlClient\";\nimport type * as SqlError from \"effect/sql/SqlError\";\n\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport {\n type AnyPasswordPersistenceMapping,\n requiredPasswordConstraints,\n} from \"./models/password-model\";\nimport { makeNativeSqlTables, sqlMapping, type NativeSqlTables } from \"./native-sql-table\";\nimport {\n makePasswordCredentials,\n samePasswordCredentialSnapshot as sameCredentialSnapshot,\n} from \"./password-credentials\";\nimport {\n CurrentPasswordPreparedTransaction,\n PasswordPreparedPostconditions,\n} from \"./PasswordPreparedPostconditions\";\nimport {\n CurrentProofSql,\n type ProofSqlConfiguration,\n type ProofSqlDatabase,\n type makeProofKernel,\n} from \"./proof-kernel\";\n/* oxlint-disable no-explicit-any -- existing storage kernels erase foreign table shapes; domain errors remain typed. */\nimport type { QueryFailure } from \"./query-operations\";\nimport type { QueryOperations, SqlFragment, SqlColumn } from \"./query-operations\";\nimport { NativeDatabase } from \"./transaction-kernel\";\n\ntype AdapterFailure = QueryFailure | PersistenceMappingError | SqlError.SqlError;\n\nexport interface PasswordSqlQuery<A = ReadonlyArray<any>> extends Effect.Effect<A, AdapterFailure> {\n readonly getSQL: () => ReturnType<QueryOperations[\"sql\"]>;\n readonly from: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n readonly where: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n readonly limit: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n readonly orderBy: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n readonly for: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n readonly set: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n readonly values: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n readonly returning: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n readonly $returningId: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n readonly onConflictDoNothing: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n readonly onDuplicateKeyUpdate: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n}\n\nexport interface PasswordSqlDatabase {\n readonly select: (...args: ReadonlyArray<any>) => PasswordSqlQuery;\n readonly insert: (...args: ReadonlyArray<any>) => PasswordSqlQuery;\n readonly update: (...args: ReadonlyArray<any>) => PasswordSqlQuery;\n readonly delete: (...args: ReadonlyArray<any>) => PasswordSqlQuery;\n readonly transaction: <A, E, R>(\n body: (transaction: PasswordSqlDatabase) => Effect.Effect<A, E, R>,\n ) => Effect.Effect<A, E | SqlError.SqlError, R>;\n}\n\nexport class CurrentPasswordSql extends Context.Service<CurrentPasswordSql, PasswordSqlDatabase>()(\n \"effect-auth/CurrentPasswordSql\",\n) {}\n\nexport interface PasswordSqlConfiguration {\n readonly mode: \"interactive\" | \"synchronous\";\n readonly locking: boolean;\n readonly standaloneGuard: Effect.Effect<void, PasswordUnavailable>;\n readonly coordinated?: boolean;\n readonly insertIfAbsent: (\n query: PasswordSqlQuery,\n selfKey: string,\n selfValue: unknown,\n ) => PasswordSqlQuery;\n readonly proof?: {\n readonly mapping: any;\n readonly configuration: ProofSqlConfiguration;\n };\n}\n\ntype Database = PasswordSqlDatabase;\n\nexport const makePasswordKernel = <\n Fragment extends SqlFragment = SqlFragment,\n Column extends SqlColumn = SqlColumn,\n>(\n operations: QueryOperations<Fragment, Column>,\n proofs: Pick<ReturnType<typeof makeProofKernel>, \"completeProofPlanIn\">,\n nativeTables: (client: SqlClient, database: object) => NativeSqlTables = (client) =>\n makeNativeSqlTables(client),\n) => {\n type Mapping = AnyPasswordPersistenceMapping<Fragment>;\n\n const { and, eq, inArray, column, updateValues } = operations;\n const { completeProofPlanIn } = proofs;\n const unavailable = () => PasswordUnavailable.make({});\n\n const translateFailure = <A, E, R>(\n effect: Effect.Effect<A, E, R>,\n ): Effect.Effect<A, PasswordUnavailable, R> =>\n reportPersistenceFailure(\n effect,\n (error) =>\n Schema.is(PasswordUnavailable)(error) ||\n Schema.is(ProofUnavailable)(error) ||\n Schema.is(HookConfigurationError)(error),\n ).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));\n\n const nowMillis = DateTime.now.pipe(Effect.map(DateTime.toEpochMillis));\n\n const validConstraints = (mapping: Mapping) =>\n Object.entries(requiredPasswordConstraints).every(\n ([key, value]) =>\n mapping.constraints[key as keyof typeof requiredPasswordConstraints] === value,\n );\n\n const selectRows = (query: PasswordSqlQuery, locking: boolean) =>\n locking && typeof query.for === \"function\" ? query.for(\"update\") : query;\n\n const subjectColumns = (mapping: Mapping) => ({\n id: column(mapping.subject.table, mapping.subject.id),\n status: column(mapping.subject.table, mapping.subject.status),\n securityRevision: column(mapping.subject.table, mapping.subject.securityRevision),\n });\n\n const identifierColumns = (mapping: Mapping) => ({\n namespace: column(mapping.identifier.table, mapping.identifier.namespace),\n value: column(mapping.identifier.table, mapping.identifier.value),\n subjectId: column(mapping.identifier.table, mapping.identifier.subjectId),\n verifiedAt: column(mapping.identifier.table, mapping.identifier.verifiedAt),\n bindingRevision: column(mapping.identifier.table, mapping.identifier.bindingRevision),\n });\n\n const credentialColumns = (mapping: Mapping) => ({\n moduleId: column(mapping.credential.table, mapping.credential.moduleId),\n subjectId: column(mapping.credential.table, mapping.credential.subjectId),\n credentialId: column(mapping.credential.table, mapping.credential.credentialId),\n credentialRevision: column(mapping.credential.table, mapping.credential.credentialRevision),\n verifierVersion: column(mapping.credential.table, mapping.credential.verifierVersion),\n verifier: column(mapping.credential.table, mapping.credential.verifier),\n normalization: column(mapping.credential.table, mapping.credential.normalization),\n });\n\n const authorityCredentialColumns = (mapping: Mapping) => ({\n subjectId: column(mapping.authorityCredential.table, mapping.authorityCredential.subjectId),\n credentialId: column(\n mapping.authorityCredential.table,\n mapping.authorityCredential.credentialId,\n ),\n revision: column(mapping.authorityCredential.table, mapping.authorityCredential.revision),\n });\n\n const commandColumns = (mapping: Mapping) => ({\n moduleId: column(mapping.command.table, mapping.command.moduleId),\n commandId: column(mapping.command.table, mapping.command.commandId),\n action: column(mapping.command.table, mapping.command.action),\n bindingDigest: column(mapping.command.table, mapping.command.bindingDigest),\n decision: column(mapping.command.table, mapping.command.decision),\n retentionUntil: column(mapping.command.table, mapping.command.retentionUntil),\n });\n\n const allocate = <A>(\n mode: PasswordSqlConfiguration[\"mode\"],\n asyncValue: Effect.Effect<A, PersistenceMappingError> | undefined,\n syncValue: (() => A) | undefined,\n ): Effect.Effect<A, PasswordUnavailable | PersistenceMappingError> => {\n if (mode === \"synchronous\")\n return syncValue === undefined\n ? Effect.fail(unavailable())\n : Effect.try({\n try: syncValue,\n catch: (cause) => new PersistenceMappingError({ operation: \"mapping\", cause }),\n });\n if (asyncValue !== undefined) return asyncValue;\n\n return syncValue === undefined\n ? Effect.fail(unavailable())\n : Effect.try({\n try: syncValue,\n catch: (cause) => new PersistenceMappingError({ operation: \"mapping\", cause }),\n });\n };\n\n const allocateNextSecurityRevision = (\n mapping: Mapping,\n mode: PasswordSqlConfiguration[\"mode\"],\n current: SecurityRevision,\n ) => {\n const asyncValue = mapping.subject.nextSecurityRevision?.(current);\n\n const syncValue =\n mapping.subject.nextSecurityRevisionSync === undefined\n ? undefined\n : () => mapping.subject.nextSecurityRevisionSync!(current);\n\n return allocate(\n mode,\n asyncValue ?? mapping.allocateRevision,\n syncValue ?? mapping.allocateRevisionSync,\n );\n };\n\n const sameIdentifier = (left: LoginIdentifier, right: LoginIdentifier) =>\n left.namespace === right.namespace && left.value === right.value;\n\n const evidenceSatisfiedAt = (\n evidence: AuthenticationEvidence,\n requirement: AuthenticationRequirement,\n now: number,\n ): boolean => {\n if (evidence.proofs.length > 64 || evidence.revision.credentials.length > 64) return false;\n const revisions = new Map<string, string>();\n\n for (const item of evidence.revision.credentials) {\n if (revisions.has(item.credentialId)) return false;\n revisions.set(item.credentialId, item.revision);\n }\n if (evidence.proofs.some((proof) => !revisions.has(proof.credentialId))) return false;\n if (evidence.proofs.some((proof) => now < DateTime.toEpochMillis(proof.verifiedAt)))\n return false;\n\n const eligible = evidence.proofs.filter((proof) => {\n const age = now - DateTime.toEpochMillis(proof.verifiedAt);\n\n return age >= 0 && age < requirement.maximumAgeMillis;\n });\n\n const factors = new Set(eligible.flatMap((proof) => proof.factors));\n const credentials = new Set(eligible.map((proof) => proof.credentialId));\n\n return requirement.alternatives.some(\n (alternative) =>\n alternative.factors.every((factor) => factors.has(factor)) &&\n credentials.size >= alternative.minimumCredentials &&\n eligible.some(\n (proof) =>\n (!alternative.userVerified || proof.userVerified) &&\n (!alternative.phishingResistant || proof.phishingResistant),\n ),\n );\n };\n\n const snapshotMutationInput = Effect.fn(\"DrizzlePassword.snapshotMutationInput\")(function* (\n input: PasswordMutationInput,\n ) {\n const expectedRevision = snapshotPasswordRevision(input.expectedRevision);\n\n const evidence = yield* snapshotAuthenticationEvidence(input.authorization.evidence).pipe(\n Effect.mapError(unavailable),\n );\n\n const requirement = yield* snapshotPasswordRequirement(input.authorization.requirement);\n\n const credential =\n input.credential === undefined\n ? undefined\n : yield* snapshotPasswordCredential(input.credential);\n\n return Object.freeze({\n ...input,\n expectedRevision,\n replacement: Object.freeze({\n verifier: Redacted.make(Redacted.value(input.replacement.verifier)),\n normalization: input.replacement.normalization,\n }),\n invalidation: Object.freeze({ ...input.invalidation }),\n ...(credential === undefined ? {} : { credential }),\n authorization: Object.freeze({\n challenge: Object.freeze({\n ...input.authorization.challenge,\n revision: snapshotPasswordRevision(input.authorization.challenge.revision),\n }),\n evidence,\n requirement,\n }),\n });\n });\n\n const lockSubject = Effect.fn(\"DrizzlePassword.lockSubject\")(function* (\n mapping: Mapping,\n subjectId: string,\n locking: boolean,\n ) {\n const database = yield* CurrentPasswordSql;\n\n const nativeSubjectId = yield* mapping.subjectId.toNative(subjectId as any);\n const c = subjectColumns(mapping);\n\n const rows = yield* selectRows(\n database.select().from(mapping.subject.table).where(eq(c.id, nativeSubjectId)).limit(1),\n locking,\n );\n\n return { nativeSubjectId, row: rows[0] };\n });\n\n const lockIdentifier = Effect.fn(\"Drizzle.lockIdentifier\")(function* (\n mapping: Mapping,\n identifier: LoginIdentifier,\n locking: boolean,\n ) {\n const database = yield* CurrentPasswordSql;\n\n const c = identifierColumns(mapping);\n\n return yield* selectRows(\n database\n .select()\n .from(mapping.identifier.table)\n .where(and(eq(c.namespace, identifier.namespace), eq(c.value, identifier.value)))\n .limit(1),\n locking,\n );\n });\n\n const readPasswordCredential = Effect.fn(\"Drizzle.readPasswordCredential\")(function* (\n mapping: Mapping,\n moduleId: string,\n nativeSubjectId: unknown,\n locking: boolean,\n ) {\n const database = yield* CurrentPasswordSql;\n\n const c = credentialColumns(mapping);\n\n return yield* selectRows(\n database\n .select()\n .from(mapping.credential.table)\n .where(and(eq(c.moduleId, moduleId), eq(c.subjectId, nativeSubjectId)))\n .limit(1),\n locking,\n );\n });\n\n const resolveCredential = Effect.fn(\"DrizzlePassword.resolveCredential\")(function* (\n mapping: Mapping,\n moduleId: string,\n identifier: LoginIdentifier,\n requestedSubjectId: string | undefined,\n locking: boolean,\n ) {\n const database = yield* CurrentPasswordSql;\n\n // The unlocked lookup only discovers the prospective subject. The canonical\n // protected order starts with the subject and then rechecks the identifier.\n const discovered = (yield* lockIdentifier(mapping, identifier, false))[0];\n\n if (discovered === undefined || !mapping.identifier.isCurrent(discovered)) return undefined;\n const discoveredNative = discovered[mapping.identifier.subjectId];\n\n const subjectRows = yield* selectRows(\n database\n .select()\n .from(mapping.subject.table)\n .where(eq(subjectColumns(mapping).id, discoveredNative))\n .limit(1),\n locking,\n );\n\n const subject = subjectRows[0];\n\n if (subject === undefined || !mapping.subject.isActiveStatus(subject[mapping.subject.status]))\n return undefined;\n const identifiers = yield* lockIdentifier(mapping, identifier, locking);\n const identifierRow = identifiers[0];\n\n if (\n identifierRow === undefined ||\n !mapping.identifier.isCurrent(identifierRow) ||\n !mapping.subjectId.equals(discoveredNative, identifierRow[mapping.identifier.subjectId])\n )\n return undefined;\n const subjectId = yield* mapping.subjectId.toSubject(discoveredNative);\n\n if (requestedSubjectId !== undefined && requestedSubjectId !== subjectId) return undefined;\n const credentials = yield* readPasswordCredential(mapping, moduleId, discoveredNative, locking);\n const credential = credentials[0];\n\n if (credential === undefined)\n return { nativeSubjectId: discoveredNative, subject, identifier: identifierRow };\n\n const snapshot = yield* mapping.credential\n .decode({ moduleId, subject, identifier: identifierRow, credential })\n .pipe(Effect.flatMap(snapshotPasswordCredential));\n\n return {\n nativeSubjectId: discoveredNative,\n subject,\n identifier: identifierRow,\n credential,\n snapshot,\n };\n });\n\n const owned = <A, E, R>(\n database: Database,\n mapping: Mapping,\n configuration: PasswordSqlConfiguration,\n body: Effect.Effect<A, E, R>,\n ) => {\n if (!validConstraints(mapping)) return Effect.fail(unavailable());\n\n const run = coordinateCommit(\n () =>\n database.transaction((transaction) =>\n body.pipe(\n Effect.provideService(CurrentPasswordSql, transaction),\n Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),\n ),\n ),\n { mode: configuration.mode },\n ).pipe(Effect.map((result) => result.value));\n\n return configuration.coordinated !== true\n ? Effect.gen(function* () {\n if (yield* hasCommitScope) return yield* unavailable();\n yield* configuration.standaloneGuard;\n\n return yield* run;\n })\n : run;\n };\n\n // A coordinator that accepts postconditions re-runs this check against its\n // current transaction after application work, before commit.\n const registerFinal = Effect.fnUntraced(function* <E>(\n check: Effect.Effect<boolean, E, CurrentPasswordSql>,\n ) {\n const postconditions = yield* Effect.serviceOption(PasswordPreparedPostconditions);\n\n if (Option.isNone(postconditions)) return;\n\n const postcondition = Effect.gen(function* () {\n const transaction = yield* CurrentPasswordPreparedTransaction;\n\n if (!(yield* check.pipe(Effect.provideService(CurrentPasswordSql, transaction))))\n return yield* unavailable();\n }).pipe(translateFailure);\n\n if (!postconditions.value.register(postcondition)) return yield* unavailable();\n });\n\n const safeRead = <A, E, R>(\n database: Database,\n configuration: PasswordSqlConfiguration,\n body: Effect.Effect<A, E, R>,\n ) =>\n Effect.gen(function* () {\n if (configuration.coordinated !== true) {\n if (yield* hasCommitScope) return yield* unavailable();\n yield* configuration.standaloneGuard;\n }\n\n return yield* database.transaction((transaction) =>\n body.pipe(\n Effect.provideService(CurrentPasswordSql, transaction),\n Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),\n ),\n );\n });\n\n const proofCompletionMatchesPassword = (\n input: PasswordMutationInput & { readonly completion: ProofCompletionPlan },\n ) => {\n const completion = input.completion.input;\n const binding = completion.binding;\n\n if (\n completion.moduleId !== `${input.moduleId}/reset` ||\n completion.purpose !== \"password-reset\" ||\n binding._tag !== \"Subject\" ||\n input.credential === undefined ||\n binding.revision.subjectId !== input.expectedRevision.subjectId ||\n binding.revision.securityRevision !== input.expectedRevision.securityRevision ||\n !sameIdentifier(binding.identifier, input.credential.identifier)\n )\n return false;\n\n const expected = [...input.expectedRevision.credentials].sort((left, right) =>\n left.credentialId.localeCompare(right.credentialId),\n );\n\n const actual = [...binding.revision.credentials].sort((left, right) =>\n left.credentialId.localeCompare(right.credentialId),\n );\n\n return (\n expected.length === actual.length &&\n expected.every(\n (item, index) =>\n item.credentialId === actual[index]!.credentialId &&\n item.revision === actual[index]!.revision,\n )\n );\n };\n\n const probeProofCompletion = Effect.fn(\"Drizzle.probeProofCompletion\")(function* (\n configuration: PasswordSqlConfiguration,\n input: ProofCompletionInput,\n ) {\n const database = yield* CurrentPasswordSql;\n\n if (configuration.proof === undefined) return yield* Effect.fail(unavailable());\n const validProbe = { _tag: \"PasswordProofCompletionValid\" } as const;\n\n const plan: ProofCompletionPlan = {\n input,\n prepare: (decision, journal, project) => journal.prepare(project(decision)),\n };\n\n const probe = coordinateCommit(\n () =>\n database.transaction((transaction) =>\n completeProofPlanIn(\n configuration.proof!.mapping,\n configuration.proof!.configuration,\n plan,\n Effect.fail(validProbe),\n () => false,\n ).pipe(\n Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),\n ),\n ),\n { mode: configuration.mode },\n );\n\n if (configuration.coordinated === true || (yield* hasCommitScope)) return yield* unavailable();\n yield* configuration.standaloneGuard;\n\n return yield* probe.pipe(\n Effect.as(false),\n Effect.catchCause((cause) => {\n const reason = cause.reasons[0];\n\n return cause.reasons.length === 1 &&\n reason !== undefined &&\n Cause.isFailReason(reason) &&\n reason.error === validProbe\n ? Effect.succeed(true)\n : Effect.failCause(cause);\n }),\n );\n });\n\n const validateMutationAuthority = Effect.fn(\"DrizzlePassword.validateMutationAuthority\")(\n function* (\n mapping: Mapping,\n configuration: PasswordSqlConfiguration,\n input: PasswordMutationInput,\n action: PasswordAction,\n ) {\n const database = yield* CurrentPasswordSql;\n\n const locked = yield* lockSubject(\n mapping,\n input.expectedRevision.subjectId,\n configuration.locking,\n );\n\n const row = locked.row;\n\n if (\n row === undefined ||\n !mapping.subject.isActiveStatus(row[mapping.subject.status]) ||\n row[mapping.subject.securityRevision] !== input.expectedRevision.securityRevision\n )\n return undefined;\n if (\n input.authorization.challenge.moduleId !== input.moduleId ||\n input.authorization.challenge.action !== action ||\n input.authorization.challenge.commandId !== input.commandId ||\n input.authorization.challenge.revision.subjectId !== input.expectedRevision.subjectId ||\n input.authorization.challenge.revision.securityRevision !==\n input.expectedRevision.securityRevision ||\n (input.authorization.evidence.flowId as string) !== (input.commandId as string) ||\n input.authorization.evidence.bindingDigest !==\n input.authorization.challenge.bindingDigest ||\n input.authorization.evidence.revision.subjectId !== input.expectedRevision.subjectId ||\n input.authorization.evidence.revision.securityRevision !==\n input.expectedRevision.securityRevision ||\n (action === \"add-password\" &&\n (input.credential !== undefined ||\n input.authorization.challenge.targetCredentialId !== undefined))\n )\n return undefined;\n if (\n input.expectedRevision.credentials.some(\n (expected) =>\n !input.authorization.evidence.revision.credentials.some(\n (actual) =>\n actual.credentialId === expected.credentialId &&\n actual.revision === expected.revision,\n ),\n )\n )\n return undefined;\n if (input.credential !== undefined) {\n const identifier = (yield* lockIdentifier(\n mapping,\n input.credential.identifier,\n configuration.locking,\n ))[0];\n\n if (\n identifier === undefined ||\n !mapping.identifier.isCurrent(identifier) ||\n !mapping.subjectId.equals(\n identifier[mapping.identifier.subjectId],\n locked.nativeSubjectId,\n ) ||\n identifier[mapping.identifier.bindingRevision] !==\n input.credential.identifierBindingRevision\n )\n return undefined;\n }\n\n const allExpected = [\n ...input.expectedRevision.credentials,\n ...input.authorization.evidence.revision.credentials,\n ];\n\n const expected = new Map(allExpected.map((item) => [item.credentialId, item]));\n\n const ac = authorityCredentialColumns(mapping);\n\n const credentialRows =\n expected.size === 0\n ? []\n : yield* selectRows(\n database\n .select()\n .from(mapping.authorityCredential.table)\n .where(\n and(\n eq(ac.subjectId, locked.nativeSubjectId),\n inArray(ac.credentialId, [...expected.keys()]),\n ),\n )\n .orderBy(ac.credentialId),\n configuration.locking,\n );\n\n if (credentialRows.length !== expected.size) return undefined;\n // Database collation need not match JavaScript locale ordering.\n for (const actual of credentialRows) {\n const wanted = expected.get(actual[mapping.authorityCredential.credentialId]);\n\n if (\n wanted === undefined ||\n actual[mapping.authorityCredential.revision] !== wanted.revision ||\n (mapping.authorityCredential.status !== undefined &&\n mapping.authorityCredential.isActiveStatus?.(\n actual[mapping.authorityCredential.status],\n ) !== true)\n )\n return undefined;\n expected.delete(wanted.credentialId);\n }\n if (expected.size !== 0) return undefined;\n if (input.credential !== undefined) {\n const identifier = (yield* lockIdentifier(mapping, input.credential.identifier, false))[0];\n\n const credential = (yield* readPasswordCredential(\n mapping,\n input.moduleId,\n locked.nativeSubjectId,\n configuration.locking,\n ))[0];\n\n if (identifier === undefined || credential === undefined) return undefined;\n\n const snapshot = yield* mapping.credential.decode({\n moduleId: input.moduleId,\n subject: row,\n identifier,\n credential,\n });\n\n if (!sameCredentialSnapshot(snapshot, input.credential)) return undefined;\n }\n const currentRequirement = yield* mapping.subject.decodeActionRequirement(row, action);\n const now = yield* nowMillis;\n\n if (\n !evidenceSatisfiedAt(input.authorization.evidence, input.authorization.requirement, now) ||\n !evidenceSatisfiedAt(input.authorization.evidence, currentRequirement, now)\n )\n return undefined;\n if (\n (input.invalidation.existingSessions === \"immediate\" ||\n input.invalidation.existingSessions === \"cache-expiry\") &&\n mapping.sessionInvalidation !== \"same-authority-immediate\"\n )\n return undefined;\n\n return { ...locked, now };\n },\n );\n\n const commandExists = Effect.fn(\"Drizzle.commandExists\")(function* (\n mapping: Mapping,\n moduleId: string,\n commandId: string,\n locking: boolean,\n ) {\n const database = yield* CurrentPasswordSql;\n\n const c = commandColumns(mapping);\n\n return yield* selectRows(\n database\n .select()\n .from(mapping.command.table)\n .where(and(eq(c.moduleId, moduleId), eq(c.commandId, commandId)))\n .limit(1),\n locking,\n );\n });\n\n const insertCommand = Effect.fn(\"Drizzle.insertCommand\")(function* (\n mapping: Mapping,\n input: PasswordMutationInput,\n action: PasswordAction,\n now: number,\n ) {\n const database = yield* CurrentPasswordSql;\n\n return yield* database.insert(mapping.command.table).values(\n mapping.command.encodeInsert({\n moduleId: input.moduleId,\n commandId: input.commandId,\n action,\n bindingDigest: input.authorization.challenge.bindingDigest,\n decision: \"changed\",\n retentionUntilMillis: now + mapping.commandRetentionMillis,\n }),\n );\n });\n\n const mutationPostconditions = Effect.fn(\"DrizzlePassword.mutationPostconditions\")(function* (\n mapping: Mapping,\n input: PasswordMutationInput,\n nativeSubjectId: unknown,\n subject: any,\n authorityCredential: any,\n now: number,\n ) {\n if (\n subject === undefined ||\n !mapping.subject.isActiveStatus(subject[mapping.subject.status]) ||\n authorityCredential === undefined ||\n (mapping.authorityCredential.status !== undefined &&\n mapping.authorityCredential.isActiveStatus?.(\n authorityCredential[mapping.authorityCredential.status],\n ) !== true)\n )\n return false;\n if (input.credential !== undefined) {\n const identifier = (yield* lockIdentifier(mapping, input.credential.identifier, false))[0];\n\n if (\n identifier === undefined ||\n !mapping.identifier.isCurrent(identifier) ||\n !mapping.subjectId.equals(identifier[mapping.identifier.subjectId], nativeSubjectId) ||\n identifier[mapping.identifier.bindingRevision] !==\n input.credential.identifierBindingRevision\n )\n return false;\n\n const credential = (yield* readPasswordCredential(\n mapping,\n input.moduleId,\n nativeSubjectId,\n false,\n ))[0];\n\n if (credential === undefined) return false;\n\n const decoded = yield* mapping.credential.decode({\n moduleId: input.moduleId,\n subject,\n identifier,\n credential,\n });\n\n if (decoded.identifierVerifiedAtMillis !== input.credential.identifierVerifiedAtMillis)\n return false;\n }\n const rows = yield* commandExists(mapping, input.moduleId, input.commandId, false);\n const row = rows[0];\n\n return (\n rows.length === 1 &&\n row[mapping.command.action] === input.authorization.challenge.action &&\n row[mapping.command.bindingDigest] === input.authorization.challenge.bindingDigest &&\n row[mapping.command.decision] === \"changed\" &&\n (yield* mapping.decodeInstant(row[mapping.command.retentionUntil])) ===\n now + mapping.commandRetentionMillis\n );\n });\n\n const addPasswordIn = Effect.fn(\"DrizzlePassword.addPasswordIn\")(function* (\n mapping: Mapping,\n configuration: PasswordSqlConfiguration,\n input: PasswordMutationInput,\n revisions: {\n readonly credentialId: string;\n readonly credentialRevision: SecurityRevision;\n readonly verifierVersion: SecurityRevision;\n readonly nextSecurityRevision: SecurityRevision;\n },\n commandNow?: number,\n ) {\n const database = yield* CurrentPasswordSql;\n\n const { credentialId, credentialRevision, verifierVersion, nextSecurityRevision } = revisions;\n\n const authority = yield* validateMutationAuthority(\n mapping,\n configuration,\n input,\n \"add-password\",\n );\n\n if (authority === undefined) return false;\n if ((yield* commandExists(mapping, input.moduleId, input.commandId, true)).length) return false;\n if (\n (yield* readPasswordCredential(mapping, input.moduleId, authority.nativeSubjectId, true))\n .length\n )\n return false;\n\n yield* database.insert(mapping.credential.table).values(\n mapping.credential.encodeInsert({\n moduleId: input.moduleId,\n subjectId: authority.nativeSubjectId,\n credentialId,\n credentialRevision,\n verifierVersion,\n replacement: input.replacement,\n }),\n );\n yield* database.insert(mapping.authorityCredential.table).values(\n mapping.authorityCredential.encodeInsert({\n subjectId: authority.nativeSubjectId,\n credentialId,\n revision: credentialRevision,\n }),\n );\n yield* database\n .update(mapping.subject.table)\n .set(updateValues([[mapping.subject.securityRevision, nextSecurityRevision]]))\n .where(\n and(\n eq(subjectColumns(mapping).id, authority.nativeSubjectId),\n eq(subjectColumns(mapping).securityRevision, input.expectedRevision.securityRevision),\n ),\n );\n yield* insertCommand(mapping, input, \"add-password\", commandNow ?? authority.now);\n\n const applied = checkMutationApplied(\n mapping,\n input,\n authority.nativeSubjectId,\n revisions,\n commandNow ?? authority.now,\n );\n\n if (!(yield* applied)) return yield* unavailable();\n yield* registerFinal(applied);\n\n return true;\n });\n\n const makeSqlPasswordPersistence = Effect.fn(\"makeSqlPasswordPersistence\")(function* (\n mapping: Mapping,\n configuration: PasswordSqlConfiguration,\n ): Effect.fn.Return<\n PasswordPersistence[\"Service\"],\n PasswordUnavailable,\n LifecycleHooks | CurrentPasswordSql | NativeDatabase\n > {\n const database = yield* CurrentPasswordSql;\n\n if (!configuration.coordinated)\n yield* (\n operations.validateStorage?.({\n ...mapping,\n proof: configuration.proof?.mapping,\n }) ?? Effect.void\n ).pipe(Effect.mapError(unavailable));\n const hooks = yield* LifecycleHooks;\n\n if (!validConstraints(mapping)) return yield* unavailable();\n const root = yield* NativeDatabase;\n\n const credentials = yield* makePasswordCredentials(\n yield* sqlMapping(() => nativeTables(root.$client.withoutTransforms(), root)).pipe(\n translateFailure,\n ),\n mapping,\n configuration,\n );\n\n return PasswordPersistence.of({\n ...credentials,\n readForSubject: (input) =>\n safeRead(\n database,\n configuration,\n Effect.gen(function* () {\n const transaction = yield* CurrentPasswordSql;\n\n const locked = yield* lockSubject(mapping, input.subjectId, false);\n\n if (\n locked.row === undefined ||\n !mapping.subject.isActiveStatus(locked.row[mapping.subject.status])\n )\n return Option.none();\n\n const credential = (yield* readPasswordCredential(\n mapping,\n input.moduleId,\n locked.nativeSubjectId,\n false,\n ))[0];\n\n if (credential === undefined) return Option.none();\n const ic = identifierColumns(mapping);\n\n const identifiers = yield* transaction\n .select()\n .from(mapping.identifier.table)\n .where(eq(ic.subjectId, locked.nativeSubjectId));\n\n const identifier = identifiers.find((row: any) => mapping.identifier.isCurrent(row));\n\n if (identifier === undefined) return Option.none();\n\n const snapshot = yield* mapping.credential\n .decode({\n moduleId: input.moduleId,\n subject: locked.row,\n identifier,\n credential,\n })\n .pipe(Effect.flatMap(snapshotPasswordCredential));\n\n return Option.some(snapshot);\n }),\n ).pipe(\n Effect.provideService(CurrentPasswordSql, database),\n Effect.provideService(LifecycleHooks, hooks),\n translateFailure,\n ),\n recoveryTarget: (input) =>\n safeRead(\n database,\n configuration,\n Effect.gen(function* () {\n const resolved = yield* resolveCredential(\n mapping,\n input.moduleId,\n input.identifier,\n undefined,\n false,\n );\n\n return resolved?.snapshot === undefined ||\n resolved.snapshot.identifierVerifiedAtMillis === undefined\n ? Option.none()\n : Option.some(resolved.snapshot);\n }),\n ).pipe(\n Effect.provideService(CurrentPasswordSql, database),\n Effect.provideService(LifecycleHooks, hooks),\n translateFailure,\n ),\n addIfAbsent: (uncaptured, prepare) =>\n Effect.gen(function* () {\n const input = yield* snapshotMutationInput(uncaptured);\n\n const credentialId = yield* allocate(\n configuration.mode,\n mapping.allocateCredentialId,\n mapping.allocateCredentialIdSync,\n );\n\n const credentialRevision = yield* allocate(\n configuration.mode,\n mapping.allocateRevision,\n mapping.allocateRevisionSync,\n );\n\n const verifierVersion = yield* allocate(\n configuration.mode,\n mapping.allocateRevision,\n mapping.allocateRevisionSync,\n );\n\n const nextSecurityRevision = yield* allocateNextSecurityRevision(\n mapping,\n configuration.mode,\n input.expectedRevision.securityRevision,\n );\n\n if (nextSecurityRevision === input.expectedRevision.securityRevision)\n return yield* unavailable();\n\n return yield* owned(\n database,\n mapping,\n configuration,\n Effect.gen(function* () {\n const journal = yield* CurrentCommitJournal;\n\n const changed = yield* addPasswordIn(mapping, configuration, input, {\n credentialId,\n credentialRevision,\n verifierVersion,\n nextSecurityRevision,\n });\n\n return prepare(changed ? \"changed\" : \"rejected\", journal);\n }),\n );\n }).pipe(\n Effect.provideService(CurrentPasswordSql, database),\n Effect.provideService(LifecycleHooks, hooks),\n translateFailure,\n ),\n replaceIfCurrent: (uncaptured, prepare) =>\n Effect.gen(function* () {\n const input = yield* snapshotMutationInput(uncaptured);\n\n const credentialRevision = yield* allocate(\n configuration.mode,\n mapping.allocateRevision,\n mapping.allocateRevisionSync,\n );\n\n const verifierVersion = yield* allocate(\n configuration.mode,\n mapping.allocateRevision,\n mapping.allocateRevisionSync,\n );\n\n const nextSecurityRevision = yield* allocateNextSecurityRevision(\n mapping,\n configuration.mode,\n input.expectedRevision.securityRevision,\n );\n\n if (\n nextSecurityRevision === input.expectedRevision.securityRevision ||\n (input.credential !== undefined &&\n credentialRevision === input.credential.credentialRevision)\n )\n return yield* unavailable();\n\n return yield* owned(\n database,\n mapping,\n configuration,\n Effect.gen(function* () {\n return yield* replaceIn(\n mapping,\n configuration,\n input,\n \"change-password\",\n { credentialRevision, verifierVersion, nextSecurityRevision },\n prepare,\n );\n }),\n );\n }).pipe(\n Effect.provideService(CurrentPasswordSql, database),\n Effect.provideService(LifecycleHooks, hooks),\n translateFailure,\n ),\n checkReset: (input) =>\n (configuration.proof === undefined\n ? Effect.fail(unavailable())\n : Effect.gen(function* () {\n if (\n input.moduleId.length <= \"/reset\".length ||\n !input.moduleId.endsWith(\"/reset\") ||\n input.purpose !== \"password-reset\" ||\n input.binding._tag !== \"Subject\"\n )\n return false;\n const binding = input.binding;\n const passwordModuleId = input.moduleId.slice(0, -\"/reset\".length);\n\n const current = yield* safeRead(\n database,\n configuration,\n Effect.gen(function* () {\n const resolved = yield* resolveCredential(\n mapping,\n passwordModuleId,\n binding.identifier,\n binding.revision.subjectId,\n false,\n );\n\n return (\n resolved?.snapshot !== undefined &&\n resolved.snapshot.revision.securityRevision ===\n binding.revision.securityRevision &&\n binding.revision.credentials.every((item) =>\n resolved.snapshot!.revision.credentials.some(\n (actual) =>\n actual.credentialId === item.credentialId &&\n actual.revision === item.revision,\n ),\n )\n );\n }),\n );\n\n return current ? yield* probeProofCompletion(configuration, input) : false;\n })\n ).pipe(\n Effect.provideService(CurrentPasswordSql, database),\n Effect.provideService(LifecycleHooks, hooks),\n translateFailure,\n ),\n resetWithProof: (uncaptured, prepare) =>\n (configuration.proof === undefined\n ? Effect.fail(unavailable())\n : Effect.gen(function* () {\n const input = Object.freeze({\n ...(yield* snapshotMutationInput(uncaptured)),\n completion: uncaptured.completion,\n });\n\n const credentialRevision = yield* allocate(\n configuration.mode,\n mapping.allocateRevision,\n mapping.allocateRevisionSync,\n );\n\n const verifierVersion = yield* allocate(\n configuration.mode,\n mapping.allocateRevision,\n mapping.allocateRevisionSync,\n );\n\n const nextSecurityRevision = yield* allocateNextSecurityRevision(\n mapping,\n configuration.mode,\n input.expectedRevision.securityRevision,\n );\n\n if (\n nextSecurityRevision === input.expectedRevision.securityRevision ||\n (input.credential !== undefined &&\n credentialRevision === input.credential.credentialRevision)\n )\n return yield* unavailable();\n\n return yield* owned(\n database,\n mapping,\n configuration,\n Effect.gen(function* () {\n const journal = yield* CurrentCommitJournal;\n\n if (!proofCompletionMatchesPassword(input)) return prepare(\"rejected\", journal);\n\n const authority = yield* validateMutationAuthority(\n mapping,\n configuration,\n input,\n \"reset-password\",\n );\n\n if (authority === undefined) return prepare(\"rejected\", journal);\n if ((yield* commandExists(mapping, input.moduleId, input.commandId, true)).length)\n return prepare(\"rejected\", journal);\n\n const current = yield* currentExpectedCredential(\n mapping,\n input,\n authority.nativeSubjectId,\n );\n\n if (!current) return prepare(\"rejected\", journal);\n let passwordReceipt: PreparedCommit<any> | undefined;\n\n yield* completeProofPlanIn(\n configuration.proof!.mapping,\n configuration.proof!.configuration,\n input.completion,\n Effect.gen(function* () {\n const revisions = {\n credentialRevision,\n verifierVersion,\n nextSecurityRevision,\n };\n\n const applied = yield* writeReplacement(\n mapping,\n input,\n authority.nativeSubjectId,\n revisions,\n authority.now,\n );\n\n if (applied)\n yield* registerReplacement(\n mapping,\n input,\n authority.nativeSubjectId,\n revisions,\n authority.now,\n );\n\n return applied;\n }),\n (decision) => {\n passwordReceipt = prepare(\n decision === \"completed\" ? \"changed\" : \"rejected\",\n journal,\n );\n\n return decision;\n },\n );\n\n return passwordReceipt ?? prepare(\"rejected\", journal);\n }),\n );\n })\n ).pipe(\n Effect.provideService(CurrentPasswordSql, database),\n Effect.provideService(LifecycleHooks, hooks),\n translateFailure,\n ),\n });\n });\n\n const currentExpectedCredential = Effect.fn(\"DrizzlePassword.currentExpectedCredential\")(\n function* (mapping: Mapping, input: PasswordMutationInput, nativeSubjectId: unknown) {\n if (input.credential === undefined) return false;\n\n const row = (yield* readPasswordCredential(\n mapping,\n input.moduleId,\n nativeSubjectId,\n true,\n ))[0];\n\n if (row === undefined) return false;\n\n return (\n row[mapping.credential.credentialId] === input.credential.credentialId &&\n row[mapping.credential.credentialRevision] === input.credential.credentialRevision &&\n row[mapping.credential.verifierVersion] === input.credential.verifierVersion &&\n row[mapping.credential.verifier] === Redacted.value(input.credential.verifier) &&\n row[mapping.credential.normalization] === input.credential.normalization &&\n input.authorization.challenge.targetCredentialId === input.credential.credentialId\n );\n },\n );\n\n const checkMutationApplied = Effect.fn(\"DrizzlePassword.checkMutationApplied\")(function* (\n mapping: Mapping,\n input: PasswordMutationInput,\n nativeSubjectId: unknown,\n revisions: {\n readonly credentialId: string;\n readonly credentialRevision: SecurityRevision;\n readonly verifierVersion: SecurityRevision;\n readonly nextSecurityRevision: SecurityRevision;\n },\n now: number,\n ) {\n const database = yield* CurrentPasswordSql;\n\n const c = credentialColumns(mapping),\n s = subjectColumns(mapping);\n\n const credential = (yield* database\n .select()\n .from(mapping.credential.table)\n .where(\n and(\n eq(c.moduleId, input.moduleId),\n eq(c.subjectId, nativeSubjectId),\n eq(c.credentialId, revisions.credentialId),\n eq(c.credentialRevision, revisions.credentialRevision),\n eq(c.verifierVersion, revisions.verifierVersion),\n eq(c.verifier, Redacted.value(input.replacement.verifier)),\n eq(c.normalization, input.replacement.normalization),\n ),\n )\n .limit(1))[0];\n\n const subject = (yield* database\n .select()\n .from(mapping.subject.table)\n .where(and(eq(s.id, nativeSubjectId), eq(s.securityRevision, revisions.nextSecurityRevision)))\n .limit(1))[0];\n\n const authorityCredential = (yield* database\n .select()\n .from(mapping.authorityCredential.table)\n .where(\n and(\n eq(authorityCredentialColumns(mapping).subjectId, nativeSubjectId),\n eq(authorityCredentialColumns(mapping).credentialId, revisions.credentialId),\n eq(authorityCredentialColumns(mapping).revision, revisions.credentialRevision),\n ),\n )\n .limit(1))[0];\n\n // SQL equality follows column collation; compare the persisted values exactly.\n return (\n credential !== undefined &&\n credential[mapping.credential.credentialId] === revisions.credentialId &&\n credential[mapping.credential.credentialRevision] === revisions.credentialRevision &&\n credential[mapping.credential.verifierVersion] === revisions.verifierVersion &&\n credential[mapping.credential.verifier] === Redacted.value(input.replacement.verifier) &&\n credential[mapping.credential.normalization] === input.replacement.normalization &&\n (yield* mutationPostconditions(\n mapping,\n input,\n nativeSubjectId,\n subject,\n authorityCredential,\n now,\n ))\n );\n });\n\n const writeReplacement = Effect.fn(\"DrizzlePassword.writeReplacement\")(function* (\n mapping: Mapping,\n input: PasswordMutationInput,\n nativeSubjectId: unknown,\n revisions: {\n readonly credentialRevision: SecurityRevision;\n readonly verifierVersion: SecurityRevision;\n readonly nextSecurityRevision: SecurityRevision;\n },\n now: number,\n ) {\n const database = yield* CurrentPasswordSql;\n\n const c = credentialColumns(mapping);\n const s = subjectColumns(mapping);\n\n yield* database\n .update(mapping.credential.table)\n .set(\n mapping.credential.encodeReplacement({\n replacement: input.replacement,\n credentialRevision: revisions.credentialRevision,\n verifierVersion: revisions.verifierVersion,\n }),\n )\n .where(\n and(\n eq(c.moduleId, input.moduleId),\n eq(c.subjectId, nativeSubjectId),\n eq(c.credentialId, input.credential!.credentialId),\n eq(c.credentialRevision, input.credential!.credentialRevision),\n eq(c.verifierVersion, input.credential!.verifierVersion),\n eq(c.verifier, Redacted.value(input.credential!.verifier)),\n eq(c.normalization, input.credential!.normalization),\n ),\n );\n yield* database\n .update(mapping.subject.table)\n .set(updateValues([[mapping.subject.securityRevision, revisions.nextSecurityRevision]]))\n .where(\n and(\n eq(s.id, nativeSubjectId),\n eq(s.securityRevision, input.expectedRevision.securityRevision),\n ),\n );\n yield* database\n .update(mapping.authorityCredential.table)\n .set(mapping.authorityCredential.encodeRevision(revisions.credentialRevision))\n .where(\n and(\n eq(authorityCredentialColumns(mapping).subjectId, nativeSubjectId),\n eq(authorityCredentialColumns(mapping).credentialId, input.credential!.credentialId),\n eq(authorityCredentialColumns(mapping).revision, input.credential!.credentialRevision),\n ),\n );\n yield* insertCommand(mapping, input, input.authorization.challenge.action, now);\n\n return yield* checkMutationApplied(\n mapping,\n input,\n nativeSubjectId,\n {\n ...revisions,\n credentialId: input.credential!.credentialId,\n },\n now,\n );\n });\n\n const registerReplacement = (\n mapping: Mapping,\n input: PasswordMutationInput,\n nativeSubjectId: unknown,\n revisions: {\n readonly credentialRevision: SecurityRevision;\n readonly verifierVersion: SecurityRevision;\n readonly nextSecurityRevision: SecurityRevision;\n },\n now: number,\n ) =>\n registerFinal(\n checkMutationApplied(\n mapping,\n input,\n nativeSubjectId,\n { ...revisions, credentialId: input.credential!.credentialId },\n now,\n ),\n );\n\n const replaceIn = Effect.fn(\"Drizzle.replaceIn\")(function* <A>(\n mapping: Mapping,\n configuration: PasswordSqlConfiguration,\n input: PasswordMutationInput,\n action: PasswordAction,\n revisions: {\n readonly credentialRevision: SecurityRevision;\n readonly verifierVersion: SecurityRevision;\n readonly nextSecurityRevision: SecurityRevision;\n },\n prepare: (value: PasswordMutationDecision, journal: CommitJournal) => PreparedCommit<A>,\n ) {\n const journal = yield* CurrentCommitJournal;\n\n const authority = yield* validateMutationAuthority(mapping, configuration, input, action);\n\n if (authority === undefined) return prepare(\"rejected\", journal);\n if ((yield* commandExists(mapping, input.moduleId, input.commandId, true)).length)\n return prepare(\"rejected\", journal);\n if (!(yield* currentExpectedCredential(mapping, input, authority.nativeSubjectId)))\n return prepare(\"rejected\", journal);\n const prepared = prepare(\"changed\", journal);\n\n if (\n !(yield* writeReplacement(\n mapping,\n input,\n authority.nativeSubjectId,\n revisions,\n authority.now,\n ))\n )\n return yield* unavailable();\n yield* registerReplacement(mapping, input, authority.nativeSubjectId, revisions, authority.now);\n\n return prepared;\n });\n\n /** Internal bound-owner primitives; deliberately not re-exported by driver modules. */\n const passwordSqlKernel = {\n allocate,\n allocateNextSecurityRevision,\n owned,\n safeRead,\n snapshotMutationInput,\n lockSubject,\n lockIdentifier,\n readPasswordCredential,\n resolveCredential,\n validateMutationAuthority,\n currentExpectedCredential,\n commandExists,\n addPasswordIn,\n checkMutationApplied,\n writeReplacement,\n evidenceSatisfiedAt,\n sameCredentialSnapshot,\n subjectColumns,\n identifierColumns,\n credentialColumns,\n authorityCredentialColumns,\n proofCompletionMatchesPassword,\n };\n\n return { makeSqlPasswordPersistence, passwordSqlKernel };\n};\n"],"mappings":";;;;;;;;;;;;;;AAwFA,IAAa,qBAAb,cAAwC,QAAQ,QAAiD,CAAC,CAChG,gCACF,CAAC,CAAC,CAAC;AAoBH,MAAa,sBAIX,YACA,QACA,gBAA0E,WACxE,oBAAoB,MAAM,MACzB;CAGH,MAAM,EAAE,KAAK,IAAI,SAAS,QAAQ,iBAAiB;CACnD,MAAM,EAAE,wBAAwB;CAChC,MAAM,oBAAoB,oBAAoB,KAAK,CAAC,CAAC;CAErD,MAAM,oBACJ,WAEA,yBACE,SACC,UACC,OAAO,GAAG,mBAAmB,CAAC,CAAC,KAAK,KACpC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,sBAAsB,CAAC,CAAC,KAAK,CAC3C,CAAC,CAAC,KAAK,OAAO,YAAY,UAAU,OAAO,UAAU,MAAM,IAAI,aAAa,YAAY,CAAC,CAAC,CAAC,CAAC;CAE9F,MAAM,YAAY,SAAS,IAAI,KAAK,OAAO,IAAI,SAAS,aAAa,CAAC;CAEtE,MAAM,oBAAoB,YACxB,OAAO,QAAQ,2BAA2B,CAAC,CAAC,OACzC,CAAC,KAAK,WACL,QAAQ,YAAY,SAAqD,KAC7E;CAEF,MAAM,cAAc,OAAyB,YAC3C,WAAW,OAAO,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,IAAI;CAErE,MAAM,kBAAkB,aAAsB;EAC5C,IAAI,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,EAAE;EACpD,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;EAC5D,kBAAkB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,gBAAgB;CAClF;CAEA,MAAM,qBAAqB,aAAsB;EAC/C,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;EACxE,OAAO,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,KAAK;EAChE,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;EACxE,YAAY,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,UAAU;EAC1E,iBAAiB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,eAAe;CACtF;CAEA,MAAM,qBAAqB,aAAsB;EAC/C,UAAU,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,QAAQ;EACtE,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;EACxE,cAAc,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,YAAY;EAC9E,oBAAoB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,kBAAkB;EAC1F,iBAAiB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,eAAe;EACpF,UAAU,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,QAAQ;EACtE,eAAe,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,aAAa;CAClF;CAEA,MAAM,8BAA8B,aAAsB;EACxD,WAAW,OAAO,QAAQ,oBAAoB,OAAO,QAAQ,oBAAoB,SAAS;EAC1F,cAAc,OACZ,QAAQ,oBAAoB,OAC5B,QAAQ,oBAAoB,YAC9B;EACA,UAAU,OAAO,QAAQ,oBAAoB,OAAO,QAAQ,oBAAoB,QAAQ;CAC1F;CAEA,MAAM,kBAAkB,aAAsB;EAC5C,UAAU,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,QAAQ;EAChE,WAAW,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,SAAS;EAClE,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;EAC5D,eAAe,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,aAAa;EAC1E,UAAU,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,QAAQ;EAChE,gBAAgB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,cAAc;CAC9E;CAEA,MAAM,YACJ,MACA,YACA,cACoE;EACpE,IAAI,SAAS,eACX,OAAO,cAAc,KAAA,IACjB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;GACT,KAAK;GACL,QAAQ,UAAU,IAAI,wBAAwB;IAAE,WAAW;IAAW;GAAM,CAAC;EAC/E,CAAC;EACP,IAAI,eAAe,KAAA,GAAW,OAAO;EAErC,OAAO,cAAc,KAAA,IACjB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;GACT,KAAK;GACL,QAAQ,UAAU,IAAI,wBAAwB;IAAE,WAAW;IAAW;GAAM,CAAC;EAC/E,CAAC;CACP;CAEA,MAAM,gCACJ,SACA,MACA,YACG;EACH,MAAM,aAAa,QAAQ,QAAQ,uBAAuB,OAAO;EAEjE,MAAM,YACJ,QAAQ,QAAQ,6BAA6B,KAAA,IACzC,KAAA,UACM,QAAQ,QAAQ,yBAA0B,OAAO;EAE7D,OAAO,SACL,MACA,cAAc,QAAQ,kBACtB,aAAa,QAAQ,oBACvB;CACF;CAEA,MAAM,kBAAkB,MAAuB,UAC7C,KAAK,cAAc,MAAM,aAAa,KAAK,UAAU,MAAM;CAE7D,MAAM,uBACJ,UACA,aACA,QACY;EACZ,IAAI,SAAS,OAAO,SAAS,MAAM,SAAS,SAAS,YAAY,SAAS,IAAI,OAAO;EACrF,MAAM,4BAAY,IAAI,IAAoB;EAE1C,KAAK,MAAM,QAAQ,SAAS,SAAS,aAAa;GAChD,IAAI,UAAU,IAAI,KAAK,YAAY,GAAG,OAAO;GAC7C,UAAU,IAAI,KAAK,cAAc,KAAK,QAAQ;EAChD;EACA,IAAI,SAAS,OAAO,MAAM,UAAU,CAAC,UAAU,IAAI,MAAM,YAAY,CAAC,GAAG,OAAO;EAChF,IAAI,SAAS,OAAO,MAAM,UAAU,MAAM,SAAS,cAAc,MAAM,UAAU,CAAC,GAChF,OAAO;EAET,MAAM,WAAW,SAAS,OAAO,QAAQ,UAAU;GACjD,MAAM,MAAM,MAAM,SAAS,cAAc,MAAM,UAAU;GAEzD,OAAO,OAAO,KAAK,MAAM,YAAY;EACvC,CAAC;EAED,MAAM,UAAU,IAAI,IAAI,SAAS,SAAS,UAAU,MAAM,OAAO,CAAC;EAClE,MAAM,cAAc,IAAI,IAAI,SAAS,KAAK,UAAU,MAAM,YAAY,CAAC;EAEvE,OAAO,YAAY,aAAa,MAC7B,gBACC,YAAY,QAAQ,OAAO,WAAW,QAAQ,IAAI,MAAM,CAAC,KACzD,YAAY,QAAQ,YAAY,sBAChC,SAAS,MACN,WACE,CAAC,YAAY,gBAAgB,MAAM,kBACnC,CAAC,YAAY,qBAAqB,MAAM,kBAC7C,CACJ;CACF;CAEA,MAAM,wBAAwB,OAAO,GAAG,uCAAuC,CAAC,CAAC,WAC/E,OACA;EACA,MAAM,mBAAmB,yBAAyB,MAAM,gBAAgB;EAExE,MAAM,WAAW,OAAO,+BAA+B,MAAM,cAAc,QAAQ,CAAC,CAAC,KACnF,OAAO,SAAS,WAAW,CAC7B;EAEA,MAAM,cAAc,OAAO,4BAA4B,MAAM,cAAc,WAAW;EAEtF,MAAM,aACJ,MAAM,eAAe,KAAA,IACjB,KAAA,IACA,OAAO,2BAA2B,MAAM,UAAU;EAExD,OAAO,OAAO,OAAO;GACnB,GAAG;GACH;GACA,aAAa,OAAO,OAAO;IACzB,UAAU,SAAS,KAAK,SAAS,MAAM,MAAM,YAAY,QAAQ,CAAC;IAClE,eAAe,MAAM,YAAY;GACnC,CAAC;GACD,cAAc,OAAO,OAAO,EAAE,GAAG,MAAM,aAAa,CAAC;GACrD,GAAI,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW;GACjD,eAAe,OAAO,OAAO;IAC3B,WAAW,OAAO,OAAO;KACvB,GAAG,MAAM,cAAc;KACvB,UAAU,yBAAyB,MAAM,cAAc,UAAU,QAAQ;IAC3E,CAAC;IACD;IACA;GACF,CAAC;EACH,CAAC;CACH,CAAC;CAED,MAAM,cAAc,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAC3D,SACA,WACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,SAAgB;EAC1E,MAAM,IAAI,eAAe,OAAO;EAOhC,OAAO;GAAE;GAAiB,MAAK,OALX,WAClB,SAAS,OAAO,CAAC,CAAC,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAAC,MAAM,GAAG,EAAE,IAAI,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,GACtF,OACF,EAAA,CAEoC;EAAG;CACzC,CAAC;CAED,MAAM,iBAAiB,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,YACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EAEnC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,IAAI,GAAG,EAAE,WAAW,WAAW,SAAS,GAAG,GAAG,EAAE,OAAO,WAAW,KAAK,CAAC,CAAC,CAAC,CAChF,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,yBAAyB,OAAO,GAAG,gCAAgC,CAAC,CAAC,WACzE,SACA,UACA,iBACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EAEnC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,IAAI,GAAG,EAAE,UAAU,QAAQ,GAAG,GAAG,EAAE,WAAW,eAAe,CAAC,CAAC,CAAC,CACtE,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,oBAAoB,OAAO,GAAG,mCAAmC,CAAC,CAAC,WACvE,SACA,UACA,YACA,oBACA,SACA;EACA,MAAM,WAAW,OAAO;EAIxB,MAAM,cAAc,OAAO,eAAe,SAAS,YAAY,KAAK,EAAA,CAAG;EAEvE,IAAI,eAAe,KAAA,KAAa,CAAC,QAAQ,WAAW,UAAU,UAAU,GAAG,OAAO,KAAA;EAClF,MAAM,mBAAmB,WAAW,QAAQ,WAAW;EAWvD,MAAM,WAAU,OATW,WACzB,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,GAAG,eAAe,OAAO,CAAC,CAAC,IAAI,gBAAgB,CAAC,CAAC,CACvD,MAAM,CAAC,GACV,OACF,EAAA,CAE4B;EAE5B,IAAI,YAAY,KAAA,KAAa,CAAC,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,GAC1F,OAAO,KAAA;EAET,MAAM,iBAAgB,OADK,eAAe,SAAS,YAAY,OAAO,EAAA,CACpC;EAElC,IACE,kBAAkB,KAAA,KAClB,CAAC,QAAQ,WAAW,UAAU,aAAa,KAC3C,CAAC,QAAQ,UAAU,OAAO,kBAAkB,cAAc,QAAQ,WAAW,UAAU,GAEvF,OAAO,KAAA;EACT,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,gBAAgB;EAErE,IAAI,uBAAuB,KAAA,KAAa,uBAAuB,WAAW,OAAO,KAAA;EAEjF,MAAM,cAAa,OADQ,uBAAuB,SAAS,UAAU,kBAAkB,OAAO,EAAA,CAC/D;EAE/B,IAAI,eAAe,KAAA,GACjB,OAAO;GAAE,iBAAiB;GAAkB;GAAS,YAAY;EAAc;EAMjF,OAAO;GACL,iBAAiB;GACjB;GACA,YAAY;GACZ;GACA,UAAA,OATsB,QAAQ,WAC7B,OAAO;IAAE;IAAU;IAAS,YAAY;IAAe;GAAW,CAAC,CAAC,CACpE,KAAK,OAAO,QAAQ,0BAA0B,CAAC;EAQlD;CACF,CAAC;CAED,MAAM,SACJ,UACA,SACA,eACA,SACG;EACH,IAAI,CAAC,iBAAiB,OAAO,GAAG,OAAO,OAAO,KAAK,YAAY,CAAC;EAEhE,MAAM,MAAM,uBAER,SAAS,aAAa,gBACpB,KAAK,KACH,OAAO,eAAe,oBAAoB,WAAW,GACrD,OAAO,eAAe,iBAAiB,WAA0C,CACnF,CACF,GACF,EAAE,MAAM,cAAc,KAAK,CAC7B,CAAC,CAAC,KAAK,OAAO,KAAK,WAAW,OAAO,KAAK,CAAC;EAE3C,OAAO,cAAc,gBAAgB,OACjC,OAAO,IAAI,aAAa;GACtB,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;GACrD,OAAO,cAAc;GAErB,OAAO,OAAO;EAChB,CAAC,IACD;CACN;CAIA,MAAM,gBAAgB,OAAO,WAAW,WACtC,OACA;EACA,MAAM,iBAAiB,OAAO,OAAO,cAAc,8BAA8B;EAEjF,IAAI,OAAO,OAAO,cAAc,GAAG;EAEnC,MAAM,gBAAgB,OAAO,IAAI,aAAa;GAC5C,MAAM,cAAc,OAAO;GAE3B,IAAI,EAAE,OAAO,MAAM,KAAK,OAAO,eAAe,oBAAoB,WAAW,CAAC,IAC5E,OAAO,OAAO,YAAY;EAC9B,CAAC,CAAC,CAAC,KAAK,gBAAgB;EAExB,IAAI,CAAC,eAAe,MAAM,SAAS,aAAa,GAAG,OAAO,OAAO,YAAY;CAC/E,CAAC;CAED,MAAM,YACJ,UACA,eACA,SAEA,OAAO,IAAI,aAAa;EACtB,IAAI,cAAc,gBAAgB,MAAM;GACtC,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;GACrD,OAAO,cAAc;EACvB;EAEA,OAAO,OAAO,SAAS,aAAa,gBAClC,KAAK,KACH,OAAO,eAAe,oBAAoB,WAAW,GACrD,OAAO,eAAe,iBAAiB,WAA0C,CACnF,CACF;CACF,CAAC;CAEH,MAAM,kCACJ,UACG;EACH,MAAM,aAAa,MAAM,WAAW;EACpC,MAAM,UAAU,WAAW;EAE3B,IACE,WAAW,aAAa,GAAG,MAAM,SAAS,WAC1C,WAAW,YAAY,oBACvB,QAAQ,SAAS,aACjB,MAAM,eAAe,KAAA,KACrB,QAAQ,SAAS,cAAc,MAAM,iBAAiB,aACtD,QAAQ,SAAS,qBAAqB,MAAM,iBAAiB,oBAC7D,CAAC,eAAe,QAAQ,YAAY,MAAM,WAAW,UAAU,GAE/D,OAAO;EAET,MAAM,WAAW,CAAC,GAAG,MAAM,iBAAiB,WAAW,CAAC,CAAC,MAAM,MAAM,UACnE,KAAK,aAAa,cAAc,MAAM,YAAY,CACpD;EAEA,MAAM,SAAS,CAAC,GAAG,QAAQ,SAAS,WAAW,CAAC,CAAC,MAAM,MAAM,UAC3D,KAAK,aAAa,cAAc,MAAM,YAAY,CACpD;EAEA,OACE,SAAS,WAAW,OAAO,UAC3B,SAAS,OACN,MAAM,UACL,KAAK,iBAAiB,OAAO,MAAM,CAAE,gBACrC,KAAK,aAAa,OAAO,MAAM,CAAE,QACrC;CAEJ;CAEA,MAAM,uBAAuB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACrE,eACA,OACA;EACA,MAAM,WAAW,OAAO;EAExB,IAAI,cAAc,UAAU,KAAA,GAAW,OAAO,OAAO,OAAO,KAAK,YAAY,CAAC;EAC9E,MAAM,aAAa,EAAE,MAAM,+BAA+B;EAE1D,MAAM,OAA4B;GAChC;GACA,UAAU,UAAU,SAAS,YAAY,QAAQ,QAAQ,QAAQ,QAAQ,CAAC;EAC5E;EAEA,MAAM,QAAQ,uBAEV,SAAS,aAAa,gBACpB,oBACE,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MACA,OAAO,KAAK,UAAU,SAChB,KACR,CAAC,CAAC,KACA,OAAO,eAAe,iBAAiB,WAA0C,CACnF,CACF,GACF,EAAE,MAAM,cAAc,KAAK,CAC7B;EAEA,IAAI,cAAc,gBAAgB,SAAS,OAAO,iBAAiB,OAAO,OAAO,YAAY;EAC7F,OAAO,cAAc;EAErB,OAAO,OAAO,MAAM,KAClB,OAAO,GAAG,KAAK,GACf,OAAO,YAAY,UAAU;GAC3B,MAAM,SAAS,MAAM,QAAQ;GAE7B,OAAO,MAAM,QAAQ,WAAW,KAC9B,WAAW,KAAA,KACX,MAAM,aAAa,MAAM,KACzB,OAAO,UAAU,aACf,OAAO,QAAQ,IAAI,IACnB,OAAO,UAAU,KAAK;EAC5B,CAAC,CACH;CACF,CAAC;CAED,MAAM,4BAA4B,OAAO,GAAG,2CAA2C,CAAC,CACtF,WACE,SACA,eACA,OACA,QACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,SAAS,OAAO,YACpB,SACA,MAAM,iBAAiB,WACvB,cAAc,OAChB;EAEA,MAAM,MAAM,OAAO;EAEnB,IACE,QAAQ,KAAA,KACR,CAAC,QAAQ,QAAQ,eAAe,IAAI,QAAQ,QAAQ,OAAO,KAC3D,IAAI,QAAQ,QAAQ,sBAAsB,MAAM,iBAAiB,kBAEjE,OAAO,KAAA;EACT,IACE,MAAM,cAAc,UAAU,aAAa,MAAM,YACjD,MAAM,cAAc,UAAU,WAAW,UACzC,MAAM,cAAc,UAAU,cAAc,MAAM,aAClD,MAAM,cAAc,UAAU,SAAS,cAAc,MAAM,iBAAiB,aAC5E,MAAM,cAAc,UAAU,SAAS,qBACrC,MAAM,iBAAiB,oBACxB,MAAM,cAAc,SAAS,WAAuB,MAAM,aAC3D,MAAM,cAAc,SAAS,kBAC3B,MAAM,cAAc,UAAU,iBAChC,MAAM,cAAc,SAAS,SAAS,cAAc,MAAM,iBAAiB,aAC3E,MAAM,cAAc,SAAS,SAAS,qBACpC,MAAM,iBAAiB,oBACxB,WAAW,mBACT,MAAM,eAAe,KAAA,KACpB,MAAM,cAAc,UAAU,uBAAuB,KAAA,IAEzD,OAAO,KAAA;EACT,IACE,MAAM,iBAAiB,YAAY,MAChC,aACC,CAAC,MAAM,cAAc,SAAS,SAAS,YAAY,MAChD,WACC,OAAO,iBAAiB,SAAS,gBACjC,OAAO,aAAa,SAAS,QACjC,CACJ,GAEA,OAAO,KAAA;EACT,IAAI,MAAM,eAAe,KAAA,GAAW;GAClC,MAAM,cAAc,OAAO,eACzB,SACA,MAAM,WAAW,YACjB,cAAc,OAChB,EAAA,CAAG;GAEH,IACE,eAAe,KAAA,KACf,CAAC,QAAQ,WAAW,UAAU,UAAU,KACxC,CAAC,QAAQ,UAAU,OACjB,WAAW,QAAQ,WAAW,YAC9B,OAAO,eACT,KACA,WAAW,QAAQ,WAAW,qBAC5B,MAAM,WAAW,2BAEnB,OAAO,KAAA;EACX;EAEA,MAAM,cAAc,CAClB,GAAG,MAAM,iBAAiB,aAC1B,GAAG,MAAM,cAAc,SAAS,SAAS,WAC3C;EAEA,MAAM,WAAW,IAAI,IAAI,YAAY,KAAK,SAAS,CAAC,KAAK,cAAc,IAAI,CAAC,CAAC;EAE7E,MAAM,KAAK,2BAA2B,OAAO;EAE7C,MAAM,iBACJ,SAAS,SAAS,IACd,CAAC,IACD,OAAO,WACL,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,oBAAoB,KAAK,CAAC,CACvC,MACC,IACE,GAAG,GAAG,WAAW,OAAO,eAAe,GACvC,QAAQ,GAAG,cAAc,CAAC,GAAG,SAAS,KAAK,CAAC,CAAC,CAC/C,CACF,CAAC,CACA,QAAQ,GAAG,YAAY,GAC1B,cAAc,OAChB;EAEN,IAAI,eAAe,WAAW,SAAS,MAAM,OAAO,KAAA;EAEpD,KAAK,MAAM,UAAU,gBAAgB;GACnC,MAAM,SAAS,SAAS,IAAI,OAAO,QAAQ,oBAAoB,aAAa;GAE5E,IACE,WAAW,KAAA,KACX,OAAO,QAAQ,oBAAoB,cAAc,OAAO,YACvD,QAAQ,oBAAoB,WAAW,KAAA,KACtC,QAAQ,oBAAoB,iBAC1B,OAAO,QAAQ,oBAAoB,OACrC,MAAM,MAER,OAAO,KAAA;GACT,SAAS,OAAO,OAAO,YAAY;EACrC;EACA,IAAI,SAAS,SAAS,GAAG,OAAO,KAAA;EAChC,IAAI,MAAM,eAAe,KAAA,GAAW;GAClC,MAAM,cAAc,OAAO,eAAe,SAAS,MAAM,WAAW,YAAY,KAAK,EAAA,CAAG;GAExF,MAAM,cAAc,OAAO,uBACzB,SACA,MAAM,UACN,OAAO,iBACP,cAAc,OAChB,EAAA,CAAG;GAEH,IAAI,eAAe,KAAA,KAAa,eAAe,KAAA,GAAW,OAAO,KAAA;GAEjE,MAAM,WAAW,OAAO,QAAQ,WAAW,OAAO;IAChD,UAAU,MAAM;IAChB,SAAS;IACT;IACA;GACF,CAAC;GAED,IAAI,CAACA,+BAAuB,UAAU,MAAM,UAAU,GAAG,OAAO,KAAA;EAClE;EACA,MAAM,qBAAqB,OAAO,QAAQ,QAAQ,wBAAwB,KAAK,MAAM;EACrF,MAAM,MAAM,OAAO;EAEnB,IACE,CAAC,oBAAoB,MAAM,cAAc,UAAU,MAAM,cAAc,aAAa,GAAG,KACvF,CAAC,oBAAoB,MAAM,cAAc,UAAU,oBAAoB,GAAG,GAE1E,OAAO,KAAA;EACT,KACG,MAAM,aAAa,qBAAqB,eACvC,MAAM,aAAa,qBAAqB,mBAC1C,QAAQ,wBAAwB,4BAEhC,OAAO,KAAA;EAET,OAAO;GAAE,GAAG;GAAQ;EAAI;CAC1B,CACF;CAEA,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,UACA,WACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,eAAe,OAAO;EAEhC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,IAAI,GAAG,EAAE,UAAU,QAAQ,GAAG,GAAG,EAAE,WAAW,SAAS,CAAC,CAAC,CAAC,CAChE,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,OACA,QACA,KACA;EAGA,OAAO,QAAO,OAFU,mBAAA,CAED,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,OACnD,QAAQ,QAAQ,aAAa;GAC3B,UAAU,MAAM;GAChB,WAAW,MAAM;GACjB;GACA,eAAe,MAAM,cAAc,UAAU;GAC7C,UAAU;GACV,sBAAsB,MAAM,QAAQ;EACtC,CAAC,CACH;CACF,CAAC;CAED,MAAM,yBAAyB,OAAO,GAAG,wCAAwC,CAAC,CAAC,WACjF,SACA,OACA,iBACA,SACA,qBACA,KACA;EACA,IACE,YAAY,KAAA,KACZ,CAAC,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,KAC/D,wBAAwB,KAAA,KACvB,QAAQ,oBAAoB,WAAW,KAAA,KACtC,QAAQ,oBAAoB,iBAC1B,oBAAoB,QAAQ,oBAAoB,OAClD,MAAM,MAER,OAAO;EACT,IAAI,MAAM,eAAe,KAAA,GAAW;GAClC,MAAM,cAAc,OAAO,eAAe,SAAS,MAAM,WAAW,YAAY,KAAK,EAAA,CAAG;GAExF,IACE,eAAe,KAAA,KACf,CAAC,QAAQ,WAAW,UAAU,UAAU,KACxC,CAAC,QAAQ,UAAU,OAAO,WAAW,QAAQ,WAAW,YAAY,eAAe,KACnF,WAAW,QAAQ,WAAW,qBAC5B,MAAM,WAAW,2BAEnB,OAAO;GAET,MAAM,cAAc,OAAO,uBACzB,SACA,MAAM,UACN,iBACA,KACF,EAAA,CAAG;GAEH,IAAI,eAAe,KAAA,GAAW,OAAO;GASrC,KAAI,OAPmB,QAAQ,WAAW,OAAO;IAC/C,UAAU,MAAM;IAChB;IACA;IACA;GACF,CAAC,EAAA,CAEW,+BAA+B,MAAM,WAAW,4BAC1D,OAAO;EACX;EACA,MAAM,OAAO,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,WAAW,KAAK;EACjF,MAAM,MAAM,KAAK;EAEjB,OACE,KAAK,WAAW,KAChB,IAAI,QAAQ,QAAQ,YAAY,MAAM,cAAc,UAAU,UAC9D,IAAI,QAAQ,QAAQ,mBAAmB,MAAM,cAAc,UAAU,iBACrE,IAAI,QAAQ,QAAQ,cAAc,cACjC,OAAO,QAAQ,cAAc,IAAI,QAAQ,QAAQ,eAAe,OAC/D,MAAM,QAAQ;CAEpB,CAAC;CAED,MAAM,gBAAgB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAC/D,SACA,eACA,OACA,WAMA,YACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,EAAE,cAAc,oBAAoB,iBAAiB,yBAAyB;EAEpF,MAAM,YAAY,OAAO,0BACvB,SACA,eACA,OACA,cACF;EAEA,IAAI,cAAc,KAAA,GAAW,OAAO;EACpC,KAAK,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,WAAW,IAAI,EAAA,CAAG,QAAQ,OAAO;EAC1F,KACG,OAAO,uBAAuB,SAAS,MAAM,UAAU,UAAU,iBAAiB,IAAI,EAAA,CACpF,QAEH,OAAO;EAET,OAAO,SAAS,OAAO,QAAQ,WAAW,KAAK,CAAC,CAAC,OAC/C,QAAQ,WAAW,aAAa;GAC9B,UAAU,MAAM;GAChB,WAAW,UAAU;GACrB;GACA;GACA;GACA,aAAa,MAAM;EACrB,CAAC,CACH;EACA,OAAO,SAAS,OAAO,QAAQ,oBAAoB,KAAK,CAAC,CAAC,OACxD,QAAQ,oBAAoB,aAAa;GACvC,WAAW,UAAU;GACrB;GACA,UAAU;EACZ,CAAC,CACH;EACA,OAAO,SACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,IAAI,aAAa,CAAC,CAAC,QAAQ,QAAQ,kBAAkB,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAC7E,MACC,IACE,GAAG,eAAe,OAAO,CAAC,CAAC,IAAI,UAAU,eAAe,GACxD,GAAG,eAAe,OAAO,CAAC,CAAC,kBAAkB,MAAM,iBAAiB,gBAAgB,CACtF,CACF;EACF,OAAO,cAAc,SAAS,OAAO,gBAAgB,cAAc,UAAU,GAAG;EAEhF,MAAM,UAAU,qBACd,SACA,OACA,UAAU,iBACV,WACA,cAAc,UAAU,GAC1B;EAEA,IAAI,EAAE,OAAO,UAAU,OAAO,OAAO,YAAY;EACjD,OAAO,cAAc,OAAO;EAE5B,OAAO;CACT,CAAC;CAED,MAAM,6BAA6B,OAAO,GAAG,4BAA4B,CAAC,CAAC,WACzE,SACA,eAKA;EACA,MAAM,WAAW,OAAO;EAExB,IAAI,CAAC,cAAc,aACjB,QACE,WAAW,kBAAkB;GAC3B,GAAG;GACH,OAAO,cAAc,OAAO;EAC9B,CAAC,KAAK,OAAO,KAAA,CACb,KAAK,OAAO,SAAS,WAAW,CAAC;EACrC,MAAM,QAAQ,OAAO;EAErB,IAAI,CAAC,iBAAiB,OAAO,GAAG,OAAO,OAAO,YAAY;EAC1D,MAAM,OAAO,OAAO;EAEpB,MAAM,cAAc,OAAO,wBACzB,OAAO,iBAAiB,aAAa,KAAK,QAAQ,kBAAkB,GAAG,IAAI,CAAC,CAAC,CAAC,KAC5E,gBACF,GACA,SACA,aACF;EAEA,OAAO,oBAAoB,GAAG;GAC5B,GAAG;GACH,iBAAiB,UACf,SACE,UACA,eACA,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAE3B,MAAM,SAAS,OAAO,YAAY,SAAS,MAAM,WAAW,KAAK;IAEjE,IACE,OAAO,QAAQ,KAAA,KACf,CAAC,QAAQ,QAAQ,eAAe,OAAO,IAAI,QAAQ,QAAQ,OAAO,GAElE,OAAO,OAAO,KAAK;IAErB,MAAM,cAAc,OAAO,uBACzB,SACA,MAAM,UACN,OAAO,iBACP,KACF,EAAA,CAAG;IAEH,IAAI,eAAe,KAAA,GAAW,OAAO,OAAO,KAAK;IACjD,MAAM,KAAK,kBAAkB,OAAO;IAOpC,MAAM,cAAa,OALQ,YACxB,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,GAAG,GAAG,WAAW,OAAO,eAAe,CAAC,EAAA,CAElB,MAAM,QAAa,QAAQ,WAAW,UAAU,GAAG,CAAC;IAEnF,IAAI,eAAe,KAAA,GAAW,OAAO,OAAO,KAAK;IAEjD,MAAM,WAAW,OAAO,QAAQ,WAC7B,OAAO;KACN,UAAU,MAAM;KAChB,SAAS,OAAO;KAChB;KACA;IACF,CAAC,CAAC,CACD,KAAK,OAAO,QAAQ,0BAA0B,CAAC;IAElD,OAAO,OAAO,KAAK,QAAQ;GAC7B,CAAC,CACH,CAAC,CAAC,KACA,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,iBAAiB,UACf,SACE,UACA,eACA,OAAO,IAAI,aAAa;IACtB,MAAM,WAAW,OAAO,kBACtB,SACA,MAAM,UACN,MAAM,YACN,KAAA,GACA,KACF;IAEA,OAAO,UAAU,aAAa,KAAA,KAC5B,SAAS,SAAS,+BAA+B,KAAA,IAC/C,OAAO,KAAK,IACZ,OAAO,KAAK,SAAS,QAAQ;GACnC,CAAC,CACH,CAAC,CAAC,KACA,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,cAAc,YAAY,YACxB,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,OAAO,sBAAsB,UAAU;IAErD,MAAM,eAAe,OAAO,SAC1B,cAAc,MACd,QAAQ,sBACR,QAAQ,wBACV;IAEA,MAAM,qBAAqB,OAAO,SAChC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,kBAAkB,OAAO,SAC7B,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,uBAAuB,OAAO,6BAClC,SACA,cAAc,MACd,MAAM,iBAAiB,gBACzB;IAEA,IAAI,yBAAyB,MAAM,iBAAiB,kBAClD,OAAO,OAAO,YAAY;IAE5B,OAAO,OAAO,MACZ,UACA,SACA,eACA,OAAO,IAAI,aAAa;KACtB,MAAM,UAAU,OAAO;KASvB,OAAO,SAAQ,OAPQ,cAAc,SAAS,eAAe,OAAO;MAClE;MACA;MACA;MACA;KACF,CAAC,KAEwB,YAAY,YAAY,OAAO;IAC1D,CAAC,CACH;GACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,mBAAmB,YAAY,YAC7B,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,OAAO,sBAAsB,UAAU;IAErD,MAAM,qBAAqB,OAAO,SAChC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,kBAAkB,OAAO,SAC7B,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,uBAAuB,OAAO,6BAClC,SACA,cAAc,MACd,MAAM,iBAAiB,gBACzB;IAEA,IACE,yBAAyB,MAAM,iBAAiB,oBAC/C,MAAM,eAAe,KAAA,KACpB,uBAAuB,MAAM,WAAW,oBAE1C,OAAO,OAAO,YAAY;IAE5B,OAAO,OAAO,MACZ,UACA,SACA,eACA,OAAO,IAAI,aAAa;KACtB,OAAO,OAAO,UACZ,SACA,eACA,OACA,mBACA;MAAE;MAAoB;MAAiB;KAAqB,GAC5D,OACF;IACF,CAAC,CACH;GACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,aAAa,WACV,cAAc,UAAU,KAAA,IACrB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI,aAAa;IACtB,IACE,MAAM,SAAS,UAAU,KACzB,CAAC,MAAM,SAAS,SAAS,QAAQ,KACjC,MAAM,YAAY,oBAClB,MAAM,QAAQ,SAAS,WAEvB,OAAO;IACT,MAAM,UAAU,MAAM;IACtB,MAAM,mBAAmB,MAAM,SAAS,MAAM,GAAG,EAAgB;IA6BjE,QAAO,OA3BgB,SACrB,UACA,eACA,OAAO,IAAI,aAAa;KACtB,MAAM,WAAW,OAAO,kBACtB,SACA,kBACA,QAAQ,YACR,QAAQ,SAAS,WACjB,KACF;KAEA,OACE,UAAU,aAAa,KAAA,KACvB,SAAS,SAAS,SAAS,qBACzB,QAAQ,SAAS,oBACnB,QAAQ,SAAS,YAAY,OAAO,SAClC,SAAS,SAAU,SAAS,YAAY,MACrC,WACC,OAAO,iBAAiB,KAAK,gBAC7B,OAAO,aAAa,KAAK,QAC7B,CACF;IAEJ,CAAC,CACH,KAEiB,OAAO,qBAAqB,eAAe,KAAK,IAAI;GACvE,CAAC,EAAA,CACH,KACA,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,iBAAiB,YAAY,aAC1B,cAAc,UAAU,KAAA,IACrB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,OAAO,OAAO;KAC1B,GAAI,OAAO,sBAAsB,UAAU;KAC3C,YAAY,WAAW;IACzB,CAAC;IAED,MAAM,qBAAqB,OAAO,SAChC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,kBAAkB,OAAO,SAC7B,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,uBAAuB,OAAO,6BAClC,SACA,cAAc,MACd,MAAM,iBAAiB,gBACzB;IAEA,IACE,yBAAyB,MAAM,iBAAiB,oBAC/C,MAAM,eAAe,KAAA,KACpB,uBAAuB,MAAM,WAAW,oBAE1C,OAAO,OAAO,YAAY;IAE5B,OAAO,OAAO,MACZ,UACA,SACA,eACA,OAAO,IAAI,aAAa;KACtB,MAAM,UAAU,OAAO;KAEvB,IAAI,CAAC,+BAA+B,KAAK,GAAG,OAAO,QAAQ,YAAY,OAAO;KAE9E,MAAM,YAAY,OAAO,0BACvB,SACA,eACA,OACA,gBACF;KAEA,IAAI,cAAc,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;KAC/D,KAAK,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,WAAW,IAAI,EAAA,CAAG,QACzE,OAAO,QAAQ,YAAY,OAAO;KAQpC,IAAI,EAAC,OANkB,0BACrB,SACA,OACA,UAAU,eACZ,IAEc,OAAO,QAAQ,YAAY,OAAO;KAChD,IAAI;KAEJ,OAAO,oBACL,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MAAM,YACN,OAAO,IAAI,aAAa;MACtB,MAAM,YAAY;OAChB;OACA;OACA;MACF;MAEA,MAAM,UAAU,OAAO,iBACrB,SACA,OACA,UAAU,iBACV,WACA,UAAU,GACZ;MAEA,IAAI,SACF,OAAO,oBACL,SACA,OACA,UAAU,iBACV,WACA,UAAU,GACZ;MAEF,OAAO;KACT,CAAC,IACA,aAAa;MACZ,kBAAkB,QAChB,aAAa,cAAc,YAAY,YACvC,OACF;MAEA,OAAO;KACT,CACF;KAEA,OAAO,mBAAmB,QAAQ,YAAY,OAAO;IACvD,CAAC,CACH;GACF,CAAC,EAAA,CACH,KACA,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACJ,CAAC;CACH,CAAC;CAED,MAAM,4BAA4B,OAAO,GAAG,2CAA2C,CAAC,CACtF,WAAW,SAAkB,OAA8B,iBAA0B;EACnF,IAAI,MAAM,eAAe,KAAA,GAAW,OAAO;EAE3C,MAAM,OAAO,OAAO,uBAClB,SACA,MAAM,UACN,iBACA,IACF,EAAA,CAAG;EAEH,IAAI,QAAQ,KAAA,GAAW,OAAO;EAE9B,OACE,IAAI,QAAQ,WAAW,kBAAkB,MAAM,WAAW,gBAC1D,IAAI,QAAQ,WAAW,wBAAwB,MAAM,WAAW,sBAChE,IAAI,QAAQ,WAAW,qBAAqB,MAAM,WAAW,mBAC7D,IAAI,QAAQ,WAAW,cAAc,SAAS,MAAM,MAAM,WAAW,QAAQ,KAC7E,IAAI,QAAQ,WAAW,mBAAmB,MAAM,WAAW,iBAC3D,MAAM,cAAc,UAAU,uBAAuB,MAAM,WAAW;CAE1E,CACF;CAEA,MAAM,uBAAuB,OAAO,GAAG,sCAAsC,CAAC,CAAC,WAC7E,SACA,OACA,iBACA,WAMA,KACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO,GACjC,IAAI,eAAe,OAAO;EAE5B,MAAM,cAAc,OAAO,SACxB,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,WAAW,eAAe,GAC/B,GAAG,EAAE,cAAc,UAAU,YAAY,GACzC,GAAG,EAAE,oBAAoB,UAAU,kBAAkB,GACrD,GAAG,EAAE,iBAAiB,UAAU,eAAe,GAC/C,GAAG,EAAE,UAAU,SAAS,MAAM,MAAM,YAAY,QAAQ,CAAC,GACzD,GAAG,EAAE,eAAe,MAAM,YAAY,aAAa,CACrD,CACF,CAAC,CACA,MAAM,CAAC,EAAA,CAAG;EAEb,MAAM,WAAW,OAAO,SACrB,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,IAAI,GAAG,EAAE,IAAI,eAAe,GAAG,GAAG,EAAE,kBAAkB,UAAU,oBAAoB,CAAC,CAAC,CAAC,CAC7F,MAAM,CAAC,EAAA,CAAG;EAEb,MAAM,uBAAuB,OAAO,SACjC,OAAO,CAAC,CACR,KAAK,QAAQ,oBAAoB,KAAK,CAAC,CACvC,MACC,IACE,GAAG,2BAA2B,OAAO,CAAC,CAAC,WAAW,eAAe,GACjE,GAAG,2BAA2B,OAAO,CAAC,CAAC,cAAc,UAAU,YAAY,GAC3E,GAAG,2BAA2B,OAAO,CAAC,CAAC,UAAU,UAAU,kBAAkB,CAC/E,CACF,CAAC,CACA,MAAM,CAAC,EAAA,CAAG;EAGb,OACE,eAAe,KAAA,KACf,WAAW,QAAQ,WAAW,kBAAkB,UAAU,gBAC1D,WAAW,QAAQ,WAAW,wBAAwB,UAAU,sBAChE,WAAW,QAAQ,WAAW,qBAAqB,UAAU,mBAC7D,WAAW,QAAQ,WAAW,cAAc,SAAS,MAAM,MAAM,YAAY,QAAQ,KACrF,WAAW,QAAQ,WAAW,mBAAmB,MAAM,YAAY,kBAClE,OAAO,uBACN,SACA,OACA,iBACA,SACA,qBACA,GACF;CAEJ,CAAC;CAED,MAAM,mBAAmB,OAAO,GAAG,kCAAkC,CAAC,CAAC,WACrE,SACA,OACA,iBACA,WAKA,KACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EACnC,MAAM,IAAI,eAAe,OAAO;EAEhC,OAAO,SACJ,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,IACC,QAAQ,WAAW,kBAAkB;GACnC,aAAa,MAAM;GACnB,oBAAoB,UAAU;GAC9B,iBAAiB,UAAU;EAC7B,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,WAAW,eAAe,GAC/B,GAAG,EAAE,cAAc,MAAM,WAAY,YAAY,GACjD,GAAG,EAAE,oBAAoB,MAAM,WAAY,kBAAkB,GAC7D,GAAG,EAAE,iBAAiB,MAAM,WAAY,eAAe,GACvD,GAAG,EAAE,UAAU,SAAS,MAAM,MAAM,WAAY,QAAQ,CAAC,GACzD,GAAG,EAAE,eAAe,MAAM,WAAY,aAAa,CACrD,CACF;EACF,OAAO,SACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,IAAI,aAAa,CAAC,CAAC,QAAQ,QAAQ,kBAAkB,UAAU,oBAAoB,CAAC,CAAC,CAAC,CAAC,CACvF,MACC,IACE,GAAG,EAAE,IAAI,eAAe,GACxB,GAAG,EAAE,kBAAkB,MAAM,iBAAiB,gBAAgB,CAChE,CACF;EACF,OAAO,SACJ,OAAO,QAAQ,oBAAoB,KAAK,CAAC,CACzC,IAAI,QAAQ,oBAAoB,eAAe,UAAU,kBAAkB,CAAC,CAAC,CAC7E,MACC,IACE,GAAG,2BAA2B,OAAO,CAAC,CAAC,WAAW,eAAe,GACjE,GAAG,2BAA2B,OAAO,CAAC,CAAC,cAAc,MAAM,WAAY,YAAY,GACnF,GAAG,2BAA2B,OAAO,CAAC,CAAC,UAAU,MAAM,WAAY,kBAAkB,CACvF,CACF;EACF,OAAO,cAAc,SAAS,OAAO,MAAM,cAAc,UAAU,QAAQ,GAAG;EAE9E,OAAO,OAAO,qBACZ,SACA,OACA,iBACA;GACE,GAAG;GACH,cAAc,MAAM,WAAY;EAClC,GACA,GACF;CACF,CAAC;CAED,MAAM,uBACJ,SACA,OACA,iBACA,WAKA,QAEA,cACE,qBACE,SACA,OACA,iBACA;EAAE,GAAG;EAAW,cAAc,MAAM,WAAY;CAAa,GAC7D,GACF,CACF;CAEF,MAAM,YAAY,OAAO,GAAG,mBAAmB,CAAC,CAAC,WAC/C,SACA,eACA,OACA,QACA,WAKA,SACA;EACA,MAAM,UAAU,OAAO;EAEvB,MAAM,YAAY,OAAO,0BAA0B,SAAS,eAAe,OAAO,MAAM;EAExF,IAAI,cAAc,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;EAC/D,KAAK,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,WAAW,IAAI,EAAA,CAAG,QACzE,OAAO,QAAQ,YAAY,OAAO;EACpC,IAAI,EAAE,OAAO,0BAA0B,SAAS,OAAO,UAAU,eAAe,IAC9E,OAAO,QAAQ,YAAY,OAAO;EACpC,MAAM,WAAW,QAAQ,WAAW,OAAO;EAE3C,IACE,EAAE,OAAO,iBACP,SACA,OACA,UAAU,iBACV,WACA,UAAU,GACZ,IAEA,OAAO,OAAO,YAAY;EAC5B,OAAO,oBAAoB,SAAS,OAAO,UAAU,iBAAiB,WAAW,UAAU,GAAG;EAE9F,OAAO;CACT,CAAC;CA4BD,OAAO;EAAE;EAA4B,mBAAA;GAxBnC;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA,wBAAA;GACA;GACA;GACA;GACA;GACA;EAGmD;CAAE;AACzD"}
package/package.json CHANGED
@@ -1 +1 @@
1
- {"name":"@yielded/auth-persistence","version":"0.1.0-beta.24","dependencies":{"@yielded/auth":"0.1.0-beta.24"},"devDependencies":{"@effect/platform-node":"4.0.0","@effect/sql-libsql":"4.0.0","@effect/sql-sqlite-node":"4.0.0","@effect/vitest":"4.0.0","@yielded/crypto":"0.1.0-beta.24","@yielded/jose":"0.1.0-beta.24","effect":"4.0.0","typescript":"7.0.2","vite-plus":"0.3.3"},"peerDependencies":{"effect":"^4.0.0"},"exports":{".":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"./Adapter":{"types":"./dist/Adapter.d.mts","default":"./dist/Adapter.mjs"},"./OAuthPersistence":{"types":"./dist/OAuthPersistence.d.mts","default":"./dist/OAuthPersistence.mjs"}},"description":"Direct Effect SQL persistence and shared storage contracts for Yielded Auth.","homepage":"https://yielded.dev/auth/","bugs":{"url":"https://github.com/yielded-dev/auth/issues"},"license":"MIT","repository":{"type":"git","url":"git+https://github.com/yielded-dev/auth.git","directory":"packages/auth-persistence"},"files":["dist","src"],"type":"module","sideEffects":[],"publishConfig":{"access":"public"},"scripts":{"build":"vp pack","check":"tsc --noEmit -p tsconfig.json","test":"vp test --passWithNoTests"}}
1
+ {"name":"@yielded/auth-persistence","version":"0.1.0-beta.25","dependencies":{"@yielded/auth":"0.1.0-beta.25"},"devDependencies":{"@effect/platform-node":"4.0.0","@effect/sql-libsql":"4.0.0","@effect/sql-sqlite-node":"4.0.0","@effect/vitest":"4.0.0","@yielded/crypto":"0.1.0-beta.25","@yielded/jose":"0.1.0-beta.25","effect":"4.0.0","typescript":"7.0.2","vite-plus":"0.3.3"},"peerDependencies":{"effect":"^4.0.0"},"exports":{".":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"./Adapter":{"types":"./dist/Adapter.d.mts","default":"./dist/Adapter.mjs"},"./OAuthPersistence":{"types":"./dist/OAuthPersistence.d.mts","default":"./dist/OAuthPersistence.mjs"}},"description":"Direct Effect SQL persistence and shared storage contracts for Yielded Auth.","homepage":"https://yielded.dev/auth/","bugs":{"url":"https://github.com/yielded-dev/auth/issues"},"license":"MIT","repository":{"type":"git","url":"git+https://github.com/yielded-dev/auth.git","directory":"packages/auth-persistence"},"files":["dist","src"],"type":"module","sideEffects":[],"publishConfig":{"access":"public"},"scripts":{"build":"vp pack","check":"tsc --noEmit -p tsconfig.json","test":"vp test --passWithNoTests"}}
package/src/internal/email-kernel.ts CHANGED
@@ -809,7 +809,8 @@ export const makeEmailKernel = <
809
809
  (action === "verify-address" && input.captured.source !== undefined) ||
810
810
  (action === "change-address" && input.captured.source === undefined) ||
811
811
  confirmsExisting !== (input.invalidation === undefined) ||
812
- (input.invalidation?.existingSessions === "immediate" &&
812
+ ((input.invalidation?.existingSessions === "immediate" ||
813
+ input.invalidation?.existingSessions === "cache-expiry") &&
813
814
  mapping.sessionInvalidation !== "same-authority-immediate")
814
815
  )
815
816
  return undefined;
package/src/internal/models/password-model.ts CHANGED
@@ -189,7 +189,8 @@ export interface PasswordPersistenceMapping<
189
189
  readonly allocateRevision?: Effect.Effect<SecurityRevision, PersistenceMappingError>;
190
190
  readonly allocateRevisionSync?: () => SecurityRevision;
191
191
  readonly commandRetentionMillis: number;
192
- /** All semantic replacements still bump subject revision. This flag only declares bearer invalidation latency. */
192
+ /** All semantic replacements still bump subject revision. This flag declares
193
+ * authoritative verification's invalidation latency; cookie exposure is separate. */
193
194
  readonly sessionInvalidation: "same-authority-immediate" | "original-absolute-expiry";
194
195
  readonly d1?: PasswordD1Clock<Expression>;
195
196
  }
package/src/internal/oauth/accounts.ts CHANGED
@@ -234,7 +234,8 @@ const make = Effect.gen(function* () {
234
234
  value.trigger === "credential-change" &&
235
235
  value.oldAuthenticationEvidence === "rejected" &&
236
236
  (mapping.sessionInvalidation === "same-authority-immediate"
237
- ? value.existingSessions === "immediate" && value.maximumExposureMillis === 0
237
+ ? (value.existingSessions === "immediate" && value.maximumExposureMillis === 0) ||
238
+ (value.existingSessions === "cache-expiry" && value.maximumExposureMillis > 0)
238
239
  : value.existingSessions === "original-absolute-expiry"),
239
240
  );
240
241
 
package/src/internal/passkey/write-state.ts CHANGED
@@ -427,10 +427,24 @@ export const makePasskeyWriteStateKernel = (
427
427
  mapping: any,
428
428
  supplied: SessionInvalidationWindow,
429
429
  policy: PasskeyManagementPolicy,
430
- ) =>
431
- jsonStorage(SessionInvalidationWindow).encode(supplied) ===
432
- jsonStorage(SessionInvalidationWindow).encode(mapping.invalidation.window) &&
433
- (!policy.requireImmediateInvalidation || supplied.existingSessions === "immediate");
430
+ ) => {
431
+ if (supplied.existingSessions === "cache-expiry" && supplied.maximumExposureMillis === 0)
432
+ return false;
433
+
434
+ // Cookie-cache exposure does not weaken the mapping's authoritative
435
+ // revision bump. Compare that immediate guarantee independently of the TTL.
436
+ const authoritative: SessionInvalidationWindow =
437
+ supplied.existingSessions === "cache-expiry" &&
438
+ mapping.invalidation.window.existingSessions === "immediate"
439
+ ? { ...supplied, existingSessions: "immediate", maximumExposureMillis: 0 }
440
+ : supplied;
441
+
442
+ return (
443
+ jsonStorage(SessionInvalidationWindow).encode(authoritative) ===
444
+ jsonStorage(SessionInvalidationWindow).encode(mapping.invalidation.window) &&
445
+ (!policy.requireImmediateInvalidation || supplied.existingSessions === "immediate")
446
+ );
447
+ };
434
448
 
435
449
  const invalidate = Effect.fn("passkey.invalidateCredentialChange")(function* (
436
450
  mapping: any,
package/src/internal/password-kernel.ts CHANGED
@@ -716,7 +716,8 @@ export const makePasswordKernel = <
716
716
  )
717
717
  return undefined;
718
718
  if (
719
- input.invalidation.existingSessions === "immediate" &&
719
+ (input.invalidation.existingSessions === "immediate" ||
720
+ input.invalidation.existingSessions === "cache-expiry") &&
720
721
  mapping.sessionInvalidation !== "same-authority-immediate"
721
722
  )
722
723
  return undefined;