@yielded/auth-persistence 0.1.0-beta.24 → 0.1.0-beta.26

package/dist/internal/persistence.mjs

@@ -1,27 +1,31 @@
 import { PersistenceConfigurationError } from "./configuration.mjs";
 import { PersistenceMappingError } from "./mapping-error.mjs";
-import { randomId } from "./crypto.mjs";
 import { requireStandalone } from "./standalone.mjs";
-import { NativeDatabase, makeTransactionKernel } from "./transaction-kernel.mjs";
-import { makeTransactionExecutionKernel } from "./transaction-execution-kernel.mjs";
-import { CurrentProofSql, makeProofKernel } from "./proof-kernel.mjs";
+import { SqlBatchCommit } from "./sql-commit.mjs";
+import { makeNativeProofServices } from "./proof-native.mjs";
+import { makeNativeEmailAddressServices } from "./email-native.mjs";
 import { storageTables, tableDefinition } from "./storage-tables.mjs";
-import { CurrentEmailSql, makeEmailKernel } from "./email-kernel.mjs";
-import { CurrentPasswordSql, makePasswordKernel } from "./password-kernel.mjs";
-import { CurrentPhoneTransaction, makePhoneKernel } from "./phone-kernel.mjs";
+import { makeManagedPasskeys } from "./passkey-managed.mjs";
+import { makeNativePasswordServices } from "./password-native.mjs";
+import { makeComposedPhoneTargets } from "./phone-composed.mjs";
 import { makeRegistrationAuthority } from "./registration.mjs";
-import { validateStorageBatch, withStorageValidation } from "./storage-validation.mjs";
-import { CurrentSessionSql, makeSessionKernel } from "./session-kernel.mjs";
+import { makeNativeAuthenticationAuthorityServices } from "./session-native-authority.mjs";
+import { makeNativeSessionCleanupServices } from "./session-native-cleanup.mjs";
+import { makeNativePendingAuthenticationServices } from "./session-native-login.mjs";
+import { makeNativeStatefulSessionServices } from "./session-native-stateful.mjs";
+import { makeNativeSessionStepUpServices } from "./session-native-step-up.mjs";
 import { makeMappings } from "./storage-mapping.mjs";
+import { validateStorageBatch, withStorageValidation } from "./storage-validation.mjs";
 import { Context, Effect, Layer, Schema } from "effect";
 import { SqlClient } from "effect/sql";
-import { LifecycleHooks } from "@yielded/auth/Hooks";
-import { AuthenticationAuthority, SessionUnavailable } from "@yielded/auth/Sessions";
-import { hooksLayer } from "@yielded/auth/Persistence";
-import { ProofPersistence, ProofUnavailable } from "@yielded/auth/Proofs";
 import { EmailAddressPersistence, EmailUnavailable } from "@yielded/auth/Email";
+import { hasCommitScope } from "@yielded/auth/Hooks";
+import { PasskeyCredentials, PasskeyManagementPersistence, PasskeyPersistence, PasskeyUnavailable } from "@yielded/auth/Passkey";
 import { PasswordPersistence, PasswordUnavailable } from "@yielded/auth/Password";
-import { PhoneAdmission, PhoneOtpUnavailable, PhoneSignInTargets } from "@yielded/auth/PhoneOtp";
+import { hooksLayer } from "@yielded/auth/Persistence";
+import { PhoneOtpUnavailable, PhoneSignInTargets } from "@yielded/auth/PhoneOtp";
+import { ProofPersistence, ProofUnavailable } from "@yielded/auth/Proofs";
+import { AuthenticationAuthority, SessionUnavailable } from "@yielded/auth/Sessions";
 //#region src/internal/persistence.ts
 const configError = (reason) => PersistenceConfigurationError.make({ reason });
 const mappingError = (cause) => PersistenceMappingError.make({
@@ -44,13 +48,6 @@ const timestampKeys = /* @__PURE__ */ new Set([
 	"dedupUntil"
 ]);
 const createPersistence = (backend) => {
-	const proofKernel = makeProofKernel(backend.operations);
-	const passwordKernel = makePasswordKernel(backend.operations, proofKernel, backend.nativeTables);
-	const emailKernel = makeEmailKernel(backend.operations, proofKernel);
-	const sessionKernel = makeSessionKernel(backend.operations, backend.nativeTables);
-	const transactionKernel = makeTransactionKernel(backend.operations);
-	const executionKernel = makeTransactionExecutionKernel(transactionKernel);
-	const phoneKernel = makePhoneKernel(backend.operations, transactionKernel);
 	const make = (auth) => {
 		const features = Object.values(auth.strategies).map((strategy) => strategy.persistence);
 		const phone = features.some((feature) => feature?.kind === "phone");
@@ -63,15 +60,12 @@ const createPersistence = (backend) => {
 			"identifiers",
 			"credentials",
 			"sessions",
-			"sessionFlows"
+			"pending"
 		];
-		if (password) roles.push("passwords", "passwordCommands");
-		if (management) roles.push("passwordRegistrations");
-		if (email) roles.push("emailCredentials", "emailCommands");
-		if (phone) roles.push("phoneState");
-		if (passkeys.length > 0) roles.push("passkeyCredentials", "passkeyOwnership", "passkeyHandles", "passkeyModules", "passkeyFlows", "passkeyAdmissions", "passkeyCharges");
-		if (passkeys.some((feature) => feature.management)) roles.push("passkeyCommands");
-		if (proofs) roles.push("proofRequests", "proofSeries", "proofGenerations", "proofContinuations", "proofScopes", "proofAbuse", "proofFailures", "proofCommands");
+		if (password) roles.push("passwords");
+		if (email) roles.push("emailCredentials");
+		if (passkeys.length > 0) roles.push("passkeyCredentials", "passkeyFlows");
+		if (proofs) roles.push("proofs");
 		const ConfigKey = Context.Service()(`@yielded/auth-persistence/${auth.namespace}/Config`);
 		const Config = Object.assign(ConfigKey, { layer: (value) => Layer.succeed(ConfigKey, value) });
 		const ProvisioningKey = Context.Service()(`@yielded/auth-persistence/${auth.namespace}/Provisioning`);
@@ -128,162 +122,201 @@ const createPersistence = (backend) => {
 				decodeInstantSync
 			});
 		};
+		const services = Layer.effectContext(Effect.gen(function* () {
+			const storage = yield* ConfigKey;
+			const client = yield* SqlClient.SqlClient;
+			const database = yield* backend.acquire;
+			const dialect = client.onDialectOrElse({
+				pg: () => "pg",
+				sqlite: () => "sqlite",
+				orElse: () => void 0
+			});
+			if (dialect === void 0) return yield* configError("Use an explicit adapter for this SQL dialect");
+			if (auth.sessionMode !== "stateful") return yield* configError("The composed layer currently requires stateful sessions");
+			if (features.some((feature) => feature === void 0 || "lifecycle" in feature && feature.lifecycle || feature.kind === "email" && !feature.addresses)) return yield* configError("Use explicit services for strategies without composed persistence support");
+			if (storage.namespace !== auth.namespace) return yield* configError("Persistence configuration belongs to a different Auth definition");
+			const validations = [];
+			for (const role of roles) {
+				const table = storage.schema[role];
+				if (table === void 0) return yield* configError(`Missing ${role} table`);
+				const description = backend.describe(table);
+				const columns = description.columns;
+				for (const name of Object.keys(storageTables[role].columns)) if (columns[name] === void 0) return yield* configError(`Missing ${role}.${name} column`);
+				validations.push({
+					table: description,
+					required: storageTables[role].unique
+				});
+			}
+			validations.push({
+				table: backend.describe(storage.subjects.table),
+				required: [[storage.subjects.id]]
+			});
+			yield* validateStorageBatch(dialect, validations);
+			const mappings = yield* makeMappings(storage);
+			const nativeTables = backend.nativeTables(database);
+			const sessionMapping = mappings.sessions(auth.claims, auth.sessions.moduleId);
+			const pendingMapping = mappings.pending(auth.claims, auth.sessions.moduleId);
+			const sessionServices = yield* makeNativeStatefulSessionServices(nativeTables, sessionMapping);
+			const { authenticationAuthority } = yield* makeNativeAuthenticationAuthorityServices(nativeTables, sessionMapping);
+			const { pendingAuthentication } = yield* makeNativePendingAuthenticationServices(nativeTables, pendingMapping);
+			const { sessionStepUpPersistence } = yield* makeNativeSessionStepUpServices(nativeTables, {
+				...pendingMapping,
+				source: {
+					kind: "Stateful",
+					session: sessionMapping.session,
+					sessionId: sessionMapping.sessionId,
+					constraints: { sessionDigest: "unique(session.digest)" }
+				}
+			});
+			const { sessionCleanup } = yield* makeNativeSessionCleanupServices(nativeTables, pendingMapping);
+			let context = Context.make(AuthenticationAuthority, authenticationAuthority).pipe(Context.add(auth.sessions.StatefulSessionPersistence, sessionServices.statefulSessionPersistence), Context.add(auth.sessions.SessionRepository, sessionServices.sessionRepository), Context.add(auth.sessions.PendingAuthentication, pendingAuthentication), Context.add(auth.sessions.SessionStepUpPersistence, sessionStepUpPersistence), Context.add(auth.sessions.SessionCleanup, sessionCleanup));
+			const proofMapping = proofs ? mappings.proofs() : void 0;
+			if (proofMapping !== void 0) {
+				const services = yield* makeNativeProofServices(backend.nativeTables(database), proofMapping);
+				context = Context.add(context, ProofPersistence, services.proofPersistence);
+			}
+			if (password) {
+				const mapping = mappings.passwords();
+				const services = yield* makeNativePasswordServices(backend.nativeTables(database), mapping, proofMapping);
+				context = Context.add(context, PasswordPersistence, services.passwordPersistence);
+			}
+			for (const [name, strategy] of Object.entries(auth.strategies)) {
+				if (strategy.persistence?.kind !== "password" || !strategy.persistence.management) continue;
+				const key = strategy.RegistrationAuthority;
+				if (key === void 0) return yield* configError(`Missing subject provisioning for ${name}`);
+				const registration = yield* makeRegistrationAuthority(backend.nativeTables(database), mappings.passwords(), ProvisioningKey, name);
+				context = Context.add(context, key, registration);
+			}
+			if (email) context = Context.add(context, EmailAddressPersistence, (yield* makeNativeEmailAddressServices(backend.nativeTables(database), mappings.emails(), proofMapping)).emailAddressPersistence);
+			if (phone) context = Context.add(context, PhoneSignInTargets, yield* makeComposedPhoneTargets(backend.nativeTables(database), storage, mappings.proofs(), features.flatMap((feature) => feature?.kind === "phone" ? [feature.moduleId] : [])));
+			if (passkeys.length > 0) {
+				const services = makeManagedPasskeys({
+					storage,
+					namespace: auth.namespace,
+					dialect,
+					features: passkeys,
+					passwordModules: features.flatMap((feature) => feature?.kind === "password" ? [feature.moduleId] : [])
+				}, backend.nativeTables(database));
+				context = Context.merge(context, yield* services);
+			}
+			return context;
+		}).pipe(Effect.provideService(SqlBatchCommit, void 0), withStorageValidation, Effect.mapError((error) => Schema.is(PersistenceConfigurationError)(error) ? error : configError("Cannot acquire SQL persistence")))).pipe(Layer.provide(hooksLayer));
 		return {
 			Config,
 			Provisioning: ProvisioningKey,
 			layer: Layer.effectContext(Effect.gen(function* () {
-				const storage = yield* ConfigKey;
-				const hooks = yield* LifecycleHooks;
-				const client = yield* SqlClient.SqlClient;
-				const database = yield* backend.acquire;
-				const dialect = client.onDialectOrElse({
-					pg: () => "pg",
-					sqlite: () => "sqlite",
-					orElse: () => void 0
+				const scope = yield* Effect.scope;
+				const captured = yield* Effect.context();
+				const client = Context.get(captured, SqlClient.SqlClient);
+				const initialize = yield* Effect.cached(Layer.buildWithScope(services, scope).pipe(Effect.setContext(captured)));
+				const service = Effect.fnUntraced(function* (key, unavailable, standalone = true) {
+					if (standalone) {
+						if (yield* hasCommitScope) return yield* Effect.fail(unavailable());
+						yield* requireStandalone(unavailable, client.transactionService);
+					}
+					const acquired = yield* initialize.pipe(Effect.mapError(unavailable));
+					const value = Context.getOrUndefined(acquired, key);
+					return value === void 0 ? yield* Effect.fail(unavailable()) : value;
 				});
-				if (dialect === void 0) return yield* configError("Use an explicit adapter for this SQL dialect");
-				if (auth.sessionMode !== "stateful") return yield* configError("The composed layer currently requires stateful sessions");
-				if (features.some((feature) => feature === void 0 || "lifecycle" in feature && feature.lifecycle || feature.kind === "email" && !feature.addresses)) return yield* configError("Use explicit services for strategies without composed persistence support");
-				if (storage.namespace !== auth.namespace) return yield* configError("Persistence configuration belongs to a different Auth definition");
-				const validations = [];
-				for (const role of roles) {
-					const table = storage.schema[role];
-					if (table === void 0) return yield* configError(`Missing ${role} table`);
-					const description = backend.describe(table);
-					const columns = description.columns;
-					for (const name of Object.keys(storageTables[role].columns)) if (columns[name] === void 0) return yield* configError(`Missing ${role}.${name} column`);
-					validations.push({
-						table: description,
-						required: storageTables[role].unique
+				const sessionUnavailable = () => SessionUnavailable.make({});
+				const authority = service(AuthenticationAuthority, sessionUnavailable, false);
+				const authorityMutation = service(AuthenticationAuthority, sessionUnavailable);
+				const sessions = service(auth.sessions.StatefulSessionPersistence, sessionUnavailable, false);
+				const sessionMutations = service(auth.sessions.StatefulSessionPersistence, sessionUnavailable);
+				const repository = service(auth.sessions.SessionRepository, sessionUnavailable, false);
+				const pendingRead = service(auth.sessions.PendingAuthentication, sessionUnavailable, false);
+				const pendingMutation = service(auth.sessions.PendingAuthentication, sessionUnavailable);
+				const stepUpRead = service(auth.sessions.SessionStepUpPersistence, sessionUnavailable, false);
+				const stepUpMutation = service(auth.sessions.SessionStepUpPersistence, sessionUnavailable);
+				const cleanup = service(auth.sessions.SessionCleanup, sessionUnavailable);
+				let context = Context.make(AuthenticationAuthority, {
+					capture: (subjectId, credentialIds) => Effect.flatMap(authority, (s) => s.capture(subjectId, credentialIds)),
+					requirements: (evidence) => Effect.flatMap(authority, (s) => s.requirements(evidence)),
+					approve: (input, prepare) => Effect.flatMap(authorityMutation, (s) => s.approve(input, prepare))
+				}).pipe(Context.add(auth.sessions.StatefulSessionPersistence, {
+					establish: (input, prepare) => Effect.flatMap(sessionMutations, (s) => s.establish(input, prepare)),
+					verify: (input) => Effect.flatMap(sessions, (s) => s.verify(input)),
+					rotate: (input, prepare) => Effect.flatMap(sessionMutations, (s) => s.rotate(input, prepare)),
+					revokeDigest: (digest, prepare) => Effect.flatMap(sessionMutations, (s) => s.revokeDigest(digest, prepare)),
+					revoke: (input, prepare) => Effect.flatMap(sessionMutations, (s) => s.revoke(input, prepare)),
+					revokeAll: (input, prepare) => Effect.flatMap(sessionMutations, (s) => s.revokeAll(input, prepare))
+				}), Context.add(auth.sessions.SessionRepository, { list: (input) => Effect.flatMap(repository, (s) => s.list(input)) }), Context.add(auth.sessions.PendingAuthentication, {
+					create: (input, now, prepare) => Effect.flatMap(pendingMutation, (s) => s.create(input, now, prepare)),
+					read: (input) => Effect.flatMap(pendingRead, (s) => s.read(input)),
+					reject: (input, prepare) => Effect.flatMap(pendingMutation, (s) => s.reject(input, prepare))
+				}), Context.add(auth.sessions.SessionStepUpPersistence, {
+					create: (input, now, prepare) => Effect.flatMap(stepUpMutation, (s) => s.create(input, now, prepare)),
+					read: (input) => Effect.flatMap(stepUpRead, (s) => s.read(input)),
+					reject: (input, prepare) => Effect.flatMap(stepUpMutation, (s) => s.reject(input, prepare)),
+					complete: (plan, prepare) => Effect.flatMap(stepUpMutation, (s) => s.complete(plan, prepare))
+				}), Context.add(auth.sessions.SessionCleanup, { cleanup: (input) => Effect.flatMap(cleanup, (s) => s.cleanup(input)) }));
+				if (proofs) {
+					const persistence = service(ProofPersistence, () => ProofUnavailable.make({}));
+					context = Context.add(context, ProofPersistence, {
+						issue: (input, prepare) => Effect.flatMap(persistence, (s) => s.issue(input, prepare)),
+						redeem: (input, prepare) => Effect.flatMap(persistence, (s) => s.redeem(input, prepare)),
+						cancel: (input, prepare) => Effect.flatMap(persistence, (s) => s.cancel(input, prepare)),
+						cleanup: (input, prepare) => Effect.flatMap(persistence, (s) => s.cleanup(input, prepare))
 					});
 				}
-				validations.push({
-					table: backend.describe(storage.subjects.table),
-					required: [[storage.subjects.id]]
-				});
-				yield* validateStorageBatch(dialect, validations);
-				const mappings = yield* makeMappings(storage);
-				const standalone = (error) => requireStandalone(error, client.transactionService);
-				const native = database;
-				const options = {
-					mode: "interactive",
-					locking: dialect === "pg",
-					standaloneGuard: standalone(() => SessionUnavailable.make({}))
-				};
-				const sessionMapping = mappings.sessions(auth.claims);
-				const sessionServices = yield* sessionKernel.makeSqlStatefulSessions(sessionMapping, options).pipe(Effect.provideService(CurrentSessionSql, native), Effect.provideService(NativeDatabase, native));
-				const authority = yield* sessionKernel.makeSqlAuthenticationAuthority({
-					...mappings.authority(),
-					isConstraintConflict: () => false
-				}, options).pipe(Effect.provideService(CurrentSessionSql, native), Effect.provideService(NativeDatabase, native));
-				let context = Context.make(AuthenticationAuthority, authority).pipe(Context.add(auth.sessions.StatefulSessionPersistence, sessionServices.statefulSessionPersistence), Context.add(auth.sessions.SessionRepository, sessionServices.sessionRepository));
-				const proofConfiguration = proofs ? {
-					mapping: mappings.proofs(),
-					configuration: {
-						mode: "interactive",
-						locking: dialect === "pg",
-						standaloneGuard: standalone(() => ProofUnavailable.make({})),
-						insertIfAbsent: (query) => query.onConflictDoNothing()
-					}
-				} : void 0;
-				if (proofConfiguration !== void 0) context = Context.add(context, ProofPersistence, yield* proofKernel.makeSqlProofPersistence(proofConfiguration.mapping, proofConfiguration.configuration).pipe(Effect.provideService(CurrentProofSql, native), Effect.provideService(NativeDatabase, native)));
 				if (password) {
-					const persistence = yield* passwordKernel.makeSqlPasswordPersistence(mappings.passwords(), {
-						mode: "interactive",
-						locking: dialect === "pg",
-						standaloneGuard: standalone(() => PasswordUnavailable.make({})),
-						insertIfAbsent: (query) => query.onConflictDoNothing(),
-						...proofConfiguration === void 0 ? {} : { proof: proofConfiguration }
-					}).pipe(Effect.provideService(CurrentPasswordSql, native), Effect.provideService(NativeDatabase, native));
-					context = Context.add(context, PasswordPersistence, persistence);
+					const persistence = service(PasswordPersistence, () => PasswordUnavailable.make({}));
+					context = Context.add(context, PasswordPersistence, {
+						findCredential: (input) => Effect.flatMap(persistence, (s) => s.findCredential(input)),
+						rehashIfCurrent: (input) => Effect.flatMap(persistence, (s) => s.rehashIfCurrent(input)),
+						readForSubject: (input) => Effect.flatMap(persistence, (s) => s.readForSubject(input)),
+						recoveryTarget: (input) => Effect.flatMap(persistence, (s) => s.recoveryTarget(input)),
+						addIfAbsent: (input, prepare) => Effect.flatMap(persistence, (s) => s.addIfAbsent(input, prepare)),
+						replaceIfCurrent: (input, prepare) => Effect.flatMap(persistence, (s) => s.replaceIfCurrent(input, prepare)),
+						resetWithProof: (input, prepare) => Effect.flatMap(persistence, (s) => s.resetWithProof(input, prepare))
+					});
 				}
 				for (const [name, strategy] of Object.entries(auth.strategies)) {
 					if (strategy.persistence?.kind !== "password" || !strategy.persistence.management) continue;
 					const key = strategy.RegistrationAuthority;
 					if (key === void 0) return yield* configError(`Missing subject provisioning for ${name}`);
-					const registration = yield* makeRegistrationAuthority(mappings, backend.operations, standalone(() => PasswordUnavailable.make({})), ProvisioningKey, name).pipe(Effect.provideService(CurrentPasswordSql, native));
-					context = Context.add(context, key, registration);
+					const registration = service(key, () => PasswordUnavailable.make({}));
+					context = Context.add(context, key, { register: (input, prepare) => Effect.flatMap(registration, (s) => s.register(input, prepare)) });
 				}
-				if (email) context = Context.add(context, EmailAddressPersistence, yield* emailKernel.makeSqlEmailAddressPersistence(mappings.emails(), {
-					mode: "interactive",
-					locking: dialect === "pg",
-					standaloneGuard: standalone(() => EmailUnavailable.make({})),
-					...proofConfiguration === void 0 ? {} : { proof: proofConfiguration }
-				}).pipe(Effect.provideService(CurrentEmailSql, native), Effect.provideService(NativeDatabase, native)));
-				if (phone) {
-					const { column, eq } = backend.operations;
-					const mapping = (moduleId) => ({
-						moduleId,
-						subject: {
-							table: storage.subjects.table,
-							id: storage.subjects.id,
-							securityRevision: storage.subjects.securityRevision,
-							activeCondition: eq(column(storage.subjects.table, storage.subjects.status), storage.subjects.activeValue)
-						},
-						subjectIds: {
-							toNative: storage.subjects.toNativeSync,
-							toSubject: storage.subjects.toSubjectSync
-						},
-						identifier: {
-							table: mappings.table("identifiers"),
-							namespace: "namespace",
-							value: "value",
-							subjectId: "subjectId",
-							revision: "revision",
-							verifiedAt: "verifiedAt",
-							activeCondition: eq(column(mappings.table("identifiers"), "active"), true)
-						},
-						credential: {
-							table: mappings.table("credentials"),
-							id: "credentialId",
-							subjectId: "subjectId",
-							revision: "revision",
-							activeCondition: eq(column(mappings.table("credentials"), "active"), true)
-						},
-						state: {
-							table: mappings.table("phoneState"),
-							scope: "scope",
-							state: "state",
-							version: "version",
-							encodeInsert: (row) => row
-						},
-						admission: {
-							windowMillis: 6e4,
-							networkRequests: 10,
-							networkAttempts: 100,
-							maximumMessages: 10,
-							requestRetentionMillis: 864e5
-						},
-						engineNowMillis: backend.operations.sql`${dialect === "pg" ? backend.operations.sql`cast(extract(epoch from clock_timestamp()) * 1000 as bigint)` : backend.operations.sql`cast(round((julianday('now') - 2440587.5) * 86400000) as integer)`}`,
-						encodeInstant: storage.encodeInstant
+				if (email) {
+					const persistence = service(EmailAddressPersistence, () => EmailUnavailable.make({}));
+					context = Context.add(context, EmailAddressPersistence, {
+						target: (input) => Effect.flatMap(persistence, (s) => s.target(input)),
+						verifyWithProof: (input, prepare) => Effect.flatMap(persistence, (s) => s.verifyWithProof(input, prepare)),
+						changeWithProof: (input, prepare) => Effect.flatMap(persistence, (s) => s.changeWithProof(input, prepare))
 					});
-					const execution = yield* executionKernel.makeTransactionExecution(CurrentPhoneTransaction, {
-						mode: "interactive",
-						dialect,
-						locking: dialect === "pg",
-						standaloneGuard: () => standalone(() => PhoneOtpUnavailable.make({}))
-					}, () => PhoneOtpUnavailable.make({}), randomId).pipe(Effect.provideService(NativeDatabase, native));
-					const run = (work, mutation = true) => execution.admit.pipe(Effect.andThen(execution.run(work, mutation)), Effect.provideService(LifecycleHooks, hooks));
-					const allowed = (moduleId) => features.some((feature) => feature?.kind === "phone" && feature.moduleId === moduleId);
-					const admission = PhoneAdmission.of({
-						admit: (request) => allowed(request.moduleId) ? run(phoneKernel.admitPhone(mapping(request.moduleId), request)) : Effect.fail(PhoneOtpUnavailable.make({})),
-						cleanup: (request) => allowed(request.moduleId) ? run(phoneKernel.cleanupPhoneAdmission(mapping(request.moduleId), request)) : Effect.fail(PhoneOtpUnavailable.make({}))
-					});
-					const targets = PhoneSignInTargets.of({ lookup: (request) => allowed(request.moduleId) ? run(phoneKernel.lookupPhone(mapping(request.moduleId), request), false) : Effect.fail(PhoneOtpUnavailable.make({})) });
-					context = context.pipe(Context.add(PhoneAdmission, admission), Context.add(PhoneSignInTargets, targets));
+				}
+				if (phone) {
+					const unavailable = () => PhoneOtpUnavailable.make({});
+					const targets = service(PhoneSignInTargets, unavailable);
+					context = context.pipe(Context.add(PhoneSignInTargets, { lookup: (input) => Effect.flatMap(targets, (s) => s.lookup(input)) }));
 				}
 				if (passkeys.length > 0) {
-					const services = backend.passkeys({
-						storage,
-						namespace: auth.namespace,
-						dialect,
-						features: passkeys,
-						passwordModules: features.flatMap((feature) => feature?.kind === "password" ? [feature.moduleId] : [])
-					});
-					context = Context.merge(context, yield* services.pipe(Effect.provideService(NativeDatabase, native), Effect.provideService(CurrentProofSql, native)));
+					const unavailable = () => PasskeyUnavailable.make({});
+					const credentials = service(PasskeyCredentials, unavailable);
+					const persistence = service(PasskeyPersistence, unavailable);
+					context = context.pipe(Context.add(PasskeyCredentials, {
+						lookup: (input) => Effect.flatMap(credentials, (s) => s.lookup(input)),
+						listForSubject: (input) => Effect.flatMap(credentials, (s) => s.listForSubject(input))
+					}), Context.add(PasskeyPersistence, {
+						issue: (input, prepare) => Effect.flatMap(persistence, (s) => s.issue(input, prepare)),
+						context: (input) => Effect.flatMap(persistence, (s) => s.context(input)),
+						consume: (input, prepare) => Effect.flatMap(persistence, (s) => s.consume(input, prepare)),
+						cleanup: (input, prepare) => Effect.flatMap(persistence, (s) => s.cleanup(input, prepare))
+					}));
+					if (passkeys.some((feature) => feature.management)) {
+						const manager = service(PasskeyManagementPersistence, unavailable);
+						context = context.pipe(Context.add(PasskeyManagementPersistence, {
+							list: (input) => Effect.flatMap(manager, (s) => s.list(input)),
+							completeEnrollment: (input, prepare) => Effect.flatMap(manager, (s) => s.completeEnrollment(input, prepare)),
+							inspectRemove: (input) => Effect.flatMap(manager, (s) => s.inspectRemove(input)),
+							remove: (input, prepare) => Effect.flatMap(manager, (s) => s.remove(input, prepare)),
+							rename: (input, prepare) => Effect.flatMap(manager, (s) => s.rename(input, prepare))
+						}));
+					}
 				}
 				return context;
-			}).pipe(withStorageValidation, Effect.mapError((error) => Schema.is(PersistenceConfigurationError)(error) ? error : configError("Cannot acquire SQL persistence")))).pipe(Layer.provide(hooksLayer)),
+			})),
 			managed: (options) => layout(options, true),
 			map: (options) => layout(options, false)
 		};

package/dist/internal/persistence.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"persistence.mjs","names":[],"sources":["../../src/internal/persistence.ts"],"sourcesContent":["import { EmailAddressPersistence, EmailUnavailable } from \"@yielded/auth/Email\";\nimport { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport type { PasskeyConfig } from \"@yielded/auth/Passkey\";\nimport { PasswordPersistence, PasswordUnavailable } from \"@yielded/auth/Password\";\nimport { hooksLayer } from \"@yielded/auth/Persistence\";\nimport { PhoneAdmission, PhoneSignInTargets, PhoneOtpUnavailable } from \"@yielded/auth/PhoneOtp\";\nimport { ProofPersistence, ProofUnavailable } from \"@yielded/auth/Proofs\";\nimport { AuthenticationAuthority, SessionUnavailable } from \"@yielded/auth/Sessions\";\nimport { Context, type Crypto, Effect, Layer, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\n\nimport {\n  PersistenceConfigurationError,\n  type ClaimsCodec,\n  type ConfigId,\n  type Definition,\n  type PersistenceApi,\n  type Ports,\n  type Roles,\n  type Provisioning,\n  type ProvisioningRequirement,\n  type StorageLayout,\n  type SubjectMapping,\n  type SubjectOptions,\n  type PasskeyFeature,\n  type PasskeyRequirement,\n  type MappingInput,\n} from \"./configuration\";\nimport { randomId } from \"./crypto\";\nimport { makeEmailKernel, CurrentEmailSql, type EmailSqlDatabase } from \"./email-kernel\";\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport type { NativeSqlTables } from \"./native-sql-table\";\nimport {\n  makePasswordKernel,\n  CurrentPasswordSql,\n  type PasswordSqlDatabase,\n} from \"./password-kernel\";\nimport { makePhoneKernel, CurrentPhoneTransaction } from \"./phone-kernel\";\nimport {\n  makeProofKernel,\n  CurrentProofSql,\n  type ProofSqlDatabase,\n  type ProofSqlQuery,\n} from \"./proof-kernel\";\nimport type { QueryOperations } from \"./query-operations\";\nimport { makeRegistrationAuthority } from \"./registration\";\nimport { makeSessionKernel, CurrentSessionSql, type SessionSqlDatabase } from \"./session-kernel\";\nimport { requireStandalone } from \"./standalone\";\nimport { makeMappings } from \"./storage-mapping\";\nimport {\n  tableDefinition,\n  storageTables,\n  type StorageRole,\n  type StorageTable,\n} from \"./storage-tables\";\nimport {\n  validateStorageBatch,\n  withStorageValidation,\n  type StorageValidation,\n} from \"./storage-validation\";\nimport { makeTransactionExecutionKernel } from \"./transaction-execution-kernel\";\nimport {\n  makeTransactionKernel,\n  NativeDatabase,\n  type TransactionNativeDatabase,\n} from \"./transaction-kernel\";\n\nexport interface Backend<T extends object, R> {\n  readonly makeTable: (definition: StorageTable) => T;\n  readonly describe: (table: T) => StorageTable;\n  readonly acquire: Effect.Effect<object, PersistenceConfigurationError, R | SqlClient.SqlClient>;\n  readonly operations: QueryOperations;\n  readonly nativeTables: (client: SqlClient.SqlClient, database: object) => NativeSqlTables;\n  readonly passkeys: (input: {\n    readonly storage: MappingInput;\n    readonly namespace: string;\n    readonly dialect: \"pg\" | \"sqlite\";\n    readonly features: ReadonlyArray<PasskeyFeature>;\n    readonly passwordModules: ReadonlyArray<string>;\n  }) => Effect.Effect<\n    Context.Context<never>,\n    PersistenceConfigurationError,\n    | PasskeyConfig\n    | LifecycleHooks\n    | SqlClient.SqlClient\n    | NativeDatabase\n    | CurrentProofSql\n    | Crypto.Crypto\n  >;\n}\n\nconst configError = (reason: string) => PersistenceConfigurationError.make({ reason });\n\nconst mappingError = (cause: unknown) =>\n  PersistenceMappingError.make({ operation: \"mapping\", cause });\n\nconst timestampKeys = new Set([\n  \"verifiedAt\",\n  \"createdAt\",\n  \"lastIssueAt\",\n  \"issuedAt\",\n  \"expiresAt\",\n  \"absoluteExpiresAt\",\n  \"retentionUntil\",\n  \"claimDeadline\",\n  \"retryAt\",\n  \"admittedAt\",\n  \"deadline\",\n  \"occurredAt\",\n  \"dedupUntil\",\n]);\n\nexport const createPersistence = <T extends object, R>(\n  backend: Backend<T, R>,\n): PersistenceApi<T, R> => {\n  const proofKernel = makeProofKernel(backend.operations);\n  const passwordKernel = makePasswordKernel(backend.operations, proofKernel, backend.nativeTables);\n  const emailKernel = makeEmailKernel(backend.operations, proofKernel);\n  const sessionKernel = makeSessionKernel(backend.operations, backend.nativeTables);\n  const transactionKernel = makeTransactionKernel(backend.operations);\n  const executionKernel = makeTransactionExecutionKernel(transactionKernel);\n  const phoneKernel = makePhoneKernel(backend.operations, transactionKernel);\n\n  const make = <C extends ClaimsCodec, const Id extends string, const A extends Definition<C, Id>>(\n    auth: A & Definition<C, Id>,\n  ) => {\n    const features = Object.values(auth.strategies).map((strategy) => strategy.persistence);\n    const phone = features.some((feature) => feature?.kind === \"phone\");\n    const password = features.some((feature) => feature?.kind === \"password\");\n\n    const passkeys = features.filter(\n      (feature): feature is PasskeyFeature => feature?.kind === \"passkey\",\n    );\n\n    const management = features.some(\n      (feature) => feature?.kind === \"password\" && feature.management,\n    );\n\n    const email = features.some((feature) => feature?.kind === \"email\" && feature.addresses);\n    const proofs = phone || management || email;\n\n    const roles: StorageRole[] = [\"identifiers\", \"credentials\", \"sessions\", \"sessionFlows\"];\n\n    if (password) roles.push(\"passwords\", \"passwordCommands\");\n    if (management) roles.push(\"passwordRegistrations\");\n    if (email) roles.push(\"emailCredentials\", \"emailCommands\");\n    if (phone) roles.push(\"phoneState\");\n    if (passkeys.length > 0)\n      roles.push(\n        \"passkeyCredentials\",\n        \"passkeyOwnership\",\n        \"passkeyHandles\",\n        \"passkeyModules\",\n        \"passkeyFlows\",\n        \"passkeyAdmissions\",\n        \"passkeyCharges\",\n      );\n    if (passkeys.some((feature) => feature.management)) roles.push(\"passkeyCommands\");\n    if (proofs)\n      roles.push(\n        \"proofRequests\",\n        \"proofSeries\",\n        \"proofGenerations\",\n        \"proofContinuations\",\n        \"proofScopes\",\n        \"proofAbuse\",\n        \"proofFailures\",\n        \"proofCommands\",\n      );\n\n    const ConfigKey = Context.Service<\n      ConfigId<A[\"namespace\"]>,\n      StorageLayout<T, Roles<C, Id, A>>\n    >()(`@yielded/auth-persistence/${auth.namespace}/Config`);\n\n    const Config = Object.assign(ConfigKey, {\n      layer: (value: StorageLayout<T, Roles<C, Id, A>>) => Layer.succeed(ConfigKey, value),\n    });\n\n    const ProvisioningKey = Context.Service<ProvisioningRequirement<A>, Provisioning<A>>()(\n      `@yielded/auth-persistence/${auth.namespace}/Provisioning`,\n    );\n\n    const layout = <N, Instant>(\n      options: {\n        readonly subjects: SubjectOptions<T, N>;\n        readonly tables?: Partial<Record<StorageRole, T>>;\n        readonly prefix?: string;\n        readonly timestamps?: {\n          readonly type: \"text\" | \"integer\";\n          readonly codec: Schema.Codec<number, Instant>;\n        };\n      },\n      managed: boolean,\n    ): StorageLayout<T, Roles<C, Id, A>> => {\n      const subject = options.subjects;\n\n      if (passkeys.length > 0 && options.timestamps !== undefined)\n        throw configError(\n          \"Composed passkey storage uses integer milliseconds; use an explicit passkey adapter for a custom timestamp representation\",\n        );\n      const description = backend.describe(subject.table);\n      const idColumn = description.columns[subject.id];\n\n      for (const key of [subject.id, subject.status, subject.securityRevision]) {\n        if (description.columns[key] === undefined)\n          throw configError(`Missing subject column ${key}`);\n      }\n      if (subject.activeValue === undefined)\n        throw configError(\"An explicit active subject value is required\");\n\n      if (idColumn === undefined || idColumn.type === \"boolean\")\n        throw configError(\"Subject ID must map a text or integer column\");\n\n      const prefix = options.prefix;\n\n      if (managed && (prefix === undefined || !/^[A-Za-z_][A-Za-z0-9_]{0,100}$/.test(prefix)))\n        throw configError(\"Managed persistence requires an explicit SQL table prefix\");\n\n      const schema: Partial<Record<StorageRole, T>> = { ...options.tables };\n\n      for (const role of roles) {\n        if (schema[role] === undefined && managed) {\n          const definition = tableDefinition(role, `${prefix}_${role}`, idColumn.type);\n\n          const adjusted =\n            options.timestamps === undefined\n              ? definition\n              : {\n                  ...definition,\n                  columns: Object.fromEntries(\n                    Object.entries(definition.columns).map(([key, column]) => [\n                      key,\n                      timestampKeys.has(key)\n                        ? { ...column, type: options.timestamps?.type ?? column.type }\n                        : column,\n                    ]),\n                  ),\n                };\n\n          schema[role] = backend.makeTable(adjusted);\n        }\n      }\n      for (const role of roles) {\n        if (schema[role] === undefined) throw configError(`Missing ${role} table`);\n      }\n      const instantCodec = options.timestamps?.codec;\n\n      const decodeInstant =\n        instantCodec === undefined\n          ? Schema.decodeUnknownEffect(Schema.Int)\n          : Schema.decodeUnknownEffect(instantCodec);\n\n      const decodeInstantSync =\n        instantCodec === undefined\n          ? Schema.decodeUnknownSync(Schema.Int)\n          : Schema.decodeUnknownSync(instantCodec);\n\n      const subjects: SubjectMapping = {\n        table: subject.table,\n        id: subject.id,\n        status: subject.status,\n        securityRevision: subject.securityRevision,\n        activeValue: subject.activeValue,\n        requirements: subject.requirements,\n        actionRequirements: subject.actionRequirements ?? subject.requirements,\n        toSubject: (id) =>\n          Schema.decodeUnknownEffect(subject.idCodec)(id).pipe(Effect.mapError(mappingError)),\n        toNative: (id) =>\n          Schema.encodeEffect(subject.idCodec)(id).pipe(Effect.mapError(mappingError)),\n        toSubjectSync: Schema.decodeUnknownSync(subject.idCodec),\n        toNativeSync: Schema.encodeSync(subject.idCodec),\n      };\n\n      return Object.freeze({\n        namespace: auth.namespace,\n        schema: Object.freeze(schema) as Readonly<Record<Roles<C, Id, A>, T>>,\n        tables: schema,\n        subjects,\n        encodeInstant:\n          instantCodec === undefined ? (millis: number) => millis : Schema.encodeSync(instantCodec),\n        decodeInstant: (value: unknown) => decodeInstant(value).pipe(Effect.mapError(mappingError)),\n        decodeInstantSync,\n      });\n    };\n\n    const services = Layer.effectContext(\n      Effect.gen(function* () {\n        const storage = yield* ConfigKey;\n        const hooks = yield* LifecycleHooks;\n        const client = yield* SqlClient.SqlClient;\n        const database = yield* backend.acquire;\n\n        const dialect = client.onDialectOrElse({\n          pg: () => \"pg\" as const,\n          sqlite: () => \"sqlite\" as const,\n          orElse: () => undefined,\n        });\n\n        if (dialect === undefined)\n          return yield* configError(\"Use an explicit adapter for this SQL dialect\");\n        if (auth.sessionMode !== \"stateful\")\n          return yield* configError(\"The composed layer currently requires stateful sessions\");\n        if (\n          features.some(\n            (feature) =>\n              feature === undefined ||\n              (\"lifecycle\" in feature && feature.lifecycle) ||\n              (feature.kind === \"email\" && !feature.addresses),\n          )\n        )\n          return yield* configError(\n            \"Use explicit services for strategies without composed persistence support\",\n          );\n        if (storage.namespace !== auth.namespace)\n          return yield* configError(\n            \"Persistence configuration belongs to a different Auth definition\",\n          );\n        const validations: StorageValidation[] = [];\n\n        for (const role of roles) {\n          const table = (storage.schema as Partial<Record<StorageRole, T>>)[role];\n\n          if (table === undefined) return yield* configError(`Missing ${role} table`);\n          const description = backend.describe(table);\n          const columns = description.columns;\n\n          for (const name of Object.keys(storageTables[role].columns)) {\n            if (columns[name] === undefined)\n              return yield* configError(`Missing ${role}.${name} column`);\n          }\n          validations.push({ table: description, required: storageTables[role].unique });\n        }\n        validations.push({\n          table: backend.describe(storage.subjects.table as T),\n          required: [[storage.subjects.id]],\n        });\n        yield* validateStorageBatch(dialect, validations);\n        const mappings = yield* makeMappings(storage);\n\n        const standalone = <E>(error: () => E) =>\n          requireStandalone(error, client.transactionService);\n\n        // Backend validation owns the foreign query-builder shape, never the decoded rows.\n        const native = database as ProofSqlDatabase &\n          PasswordSqlDatabase &\n          EmailSqlDatabase &\n          SessionSqlDatabase &\n          TransactionNativeDatabase;\n\n        const options = {\n          mode: \"interactive\" as const,\n          locking: dialect === \"pg\",\n          standaloneGuard: standalone(() => SessionUnavailable.make({})),\n        };\n\n        const sessionMapping = mappings.sessions(auth.claims);\n\n        const sessionServices = yield* sessionKernel\n          .makeSqlStatefulSessions(sessionMapping, options)\n          .pipe(\n            Effect.provideService(CurrentSessionSql, native),\n            Effect.provideService(NativeDatabase, native),\n          );\n\n        const authority = yield* sessionKernel\n          .makeSqlAuthenticationAuthority<C[\"Type\"]>(\n            { ...mappings.authority(), isConstraintConflict: () => false },\n            options,\n          )\n          .pipe(\n            Effect.provideService(CurrentSessionSql, native),\n            Effect.provideService(NativeDatabase, native),\n          );\n\n        let context: Context.Context<never> = Context.make(AuthenticationAuthority, authority).pipe(\n          Context.add(\n            auth.sessions.StatefulSessionPersistence,\n            sessionServices.statefulSessionPersistence,\n          ),\n          Context.add(auth.sessions.SessionRepository, sessionServices.sessionRepository),\n        );\n\n        const proofConfiguration = proofs\n          ? {\n              mapping: mappings.proofs(),\n              configuration: {\n                mode: \"interactive\" as const,\n                locking: dialect === \"pg\",\n                standaloneGuard: standalone(() => ProofUnavailable.make({})),\n                insertIfAbsent: (query: ProofSqlQuery) => query.onConflictDoNothing(),\n              },\n            }\n          : undefined;\n\n        if (proofConfiguration !== undefined) {\n          context = Context.add(\n            context,\n            ProofPersistence,\n            yield* proofKernel\n              .makeSqlProofPersistence(proofConfiguration.mapping, proofConfiguration.configuration)\n              .pipe(\n                Effect.provideService(CurrentProofSql, native),\n                Effect.provideService(NativeDatabase, native),\n              ),\n          );\n        }\n\n        if (password) {\n          const persistence = yield* passwordKernel\n            .makeSqlPasswordPersistence(mappings.passwords(), {\n              mode: \"interactive\",\n              locking: dialect === \"pg\",\n              standaloneGuard: standalone(() => PasswordUnavailable.make({})),\n              insertIfAbsent: (query) => query.onConflictDoNothing(),\n              ...(proofConfiguration === undefined ? {} : { proof: proofConfiguration }),\n            })\n            .pipe(\n              Effect.provideService(CurrentPasswordSql, native),\n              Effect.provideService(NativeDatabase, native),\n            );\n\n          context = Context.add(context, PasswordPersistence, persistence);\n        }\n        for (const [name, strategy] of Object.entries(auth.strategies)) {\n          if (strategy.persistence?.kind !== \"password\" || !strategy.persistence.management)\n            continue;\n          const key = strategy.RegistrationAuthority;\n\n          if (key === undefined)\n            return yield* configError(`Missing subject provisioning for ${name}`);\n\n          const registration = yield* makeRegistrationAuthority(\n            mappings,\n            backend.operations,\n            standalone(() => PasswordUnavailable.make({})),\n            ProvisioningKey,\n            name,\n          ).pipe(Effect.provideService(CurrentPasswordSql, native));\n\n          context = Context.add(context, key, registration);\n        }\n        if (email) {\n          context = Context.add(\n            context,\n            EmailAddressPersistence,\n            yield* emailKernel\n              .makeSqlEmailAddressPersistence(mappings.emails(), {\n                mode: \"interactive\",\n                locking: dialect === \"pg\",\n                standaloneGuard: standalone(() => EmailUnavailable.make({})),\n                ...(proofConfiguration === undefined ? {} : { proof: proofConfiguration }),\n              })\n              .pipe(\n                Effect.provideService(CurrentEmailSql, native),\n                Effect.provideService(NativeDatabase, native),\n              ),\n          );\n        }\n        if (phone) {\n          const { column, eq } = backend.operations;\n\n          const mapping = (moduleId: string) => ({\n            moduleId,\n            subject: {\n              table: storage.subjects.table,\n              id: storage.subjects.id,\n              securityRevision: storage.subjects.securityRevision,\n              activeCondition: eq(\n                column(storage.subjects.table, storage.subjects.status),\n                storage.subjects.activeValue,\n              ),\n            },\n            subjectIds: {\n              toNative: storage.subjects.toNativeSync,\n              toSubject: storage.subjects.toSubjectSync,\n            },\n            identifier: {\n              table: mappings.table(\"identifiers\"),\n              namespace: \"namespace\",\n              value: \"value\",\n              subjectId: \"subjectId\",\n              revision: \"revision\",\n              verifiedAt: \"verifiedAt\",\n              activeCondition: eq(column(mappings.table(\"identifiers\"), \"active\"), true),\n            },\n            credential: {\n              table: mappings.table(\"credentials\"),\n              id: \"credentialId\",\n              subjectId: \"subjectId\",\n              revision: \"revision\",\n              activeCondition: eq(column(mappings.table(\"credentials\"), \"active\"), true),\n            },\n            state: {\n              table: mappings.table(\"phoneState\"),\n              scope: \"scope\",\n              state: \"state\",\n              version: \"version\",\n              encodeInsert: (row: object) => row,\n            },\n            admission: {\n              windowMillis: 60_000,\n              networkRequests: 10,\n              networkAttempts: 100,\n              maximumMessages: 10,\n              requestRetentionMillis: 86_400_000,\n            },\n            engineNowMillis: backend.operations\n              .sql`${dialect === \"pg\" ? backend.operations.sql`cast(extract(epoch from clock_timestamp()) * 1000 as bigint)` : backend.operations.sql`cast(round((julianday('now') - 2440587.5) * 86400000) as integer)`}`,\n            encodeInstant: storage.encodeInstant,\n          });\n\n          const execution = yield* executionKernel\n            .makeTransactionExecution(\n              CurrentPhoneTransaction,\n              {\n                mode: \"interactive\",\n                dialect,\n                locking: dialect === \"pg\",\n                standaloneGuard: () => standalone(() => PhoneOtpUnavailable.make({})),\n              },\n              () => PhoneOtpUnavailable.make({}),\n              randomId,\n            )\n            .pipe(Effect.provideService(NativeDatabase, native));\n\n          const run = <Value, E, Requirements>(\n            work: Effect.Effect<Value, E, Requirements>,\n            mutation = true,\n          ) =>\n            execution.admit.pipe(\n              Effect.andThen(execution.run(work, mutation)),\n              Effect.provideService(LifecycleHooks, hooks),\n            );\n\n          const allowed = (moduleId: string) =>\n            features.some((feature) => feature?.kind === \"phone\" && feature.moduleId === moduleId);\n\n          const admission = PhoneAdmission.of({\n            admit: (request) =>\n              allowed(request.moduleId)\n                ? run(phoneKernel.admitPhone(mapping(request.moduleId), request))\n                : Effect.fail(PhoneOtpUnavailable.make({})),\n            cleanup: (request) =>\n              allowed(request.moduleId)\n                ? run(phoneKernel.cleanupPhoneAdmission(mapping(request.moduleId), request))\n                : Effect.fail(PhoneOtpUnavailable.make({})),\n          });\n\n          const targets = PhoneSignInTargets.of({\n            lookup: (request) =>\n              allowed(request.moduleId)\n                ? run(phoneKernel.lookupPhone(mapping(request.moduleId), request), false)\n                : Effect.fail(PhoneOtpUnavailable.make({})),\n          });\n\n          context = context.pipe(\n            Context.add(PhoneAdmission, admission),\n            Context.add(PhoneSignInTargets, targets),\n          );\n        }\n\n        if (passkeys.length > 0) {\n          // Auth capability metadata determines whether PasskeyConfig is required.\n          const services = backend.passkeys({\n            storage,\n            namespace: auth.namespace,\n            dialect,\n            features: passkeys,\n            passwordModules: features.flatMap((feature) =>\n              feature?.kind === \"password\" ? [feature.moduleId] : [],\n            ),\n          }) as Effect.Effect<\n            Context.Context<never>,\n            PersistenceConfigurationError,\n            | PasskeyRequirement<A>\n            | Crypto.Crypto\n            | LifecycleHooks\n            | SqlClient.SqlClient\n            | NativeDatabase\n            | CurrentProofSql\n          >;\n\n          context = Context.merge(\n            context,\n            yield* services.pipe(\n              Effect.provideService(NativeDatabase, native),\n              Effect.provideService(CurrentProofSql, native),\n            ),\n          );\n        }\n\n        // The checked capability metadata above determines exactly these service keys.\n        return context as Context.Context<Ports<C, Id, A>>;\n      }).pipe(\n        withStorageValidation,\n        Effect.mapError((error) =>\n          Schema.is(PersistenceConfigurationError)(error)\n            ? error\n            : configError(\"Cannot acquire SQL persistence\"),\n        ),\n      ),\n    ).pipe(Layer.provide(hooksLayer));\n\n    return {\n      Config,\n      Provisioning: ProvisioningKey,\n      layer: services,\n      managed: <N, Instant = number>(options: {\n        readonly subjects: SubjectOptions<T, N>;\n        readonly tables?: Partial<Record<Roles<C, Id, A>, T>>;\n        readonly prefix?: string;\n        readonly timestamps?: {\n          readonly type: \"text\" | \"integer\";\n          readonly codec: Schema.Codec<number, Instant>;\n        };\n      }) => layout(options, true),\n      map: <N, Instant = number>(options: {\n        readonly subjects: SubjectOptions<T, N>;\n        readonly tables: Partial<Record<StorageRole, T>>;\n        readonly timestamps?: {\n          readonly type: \"text\" | \"integer\";\n          readonly codec: Schema.Codec<number, Instant>;\n        };\n      }) => layout(options, false),\n    };\n  };\n\n  return { make };\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AA2FA,MAAM,eAAe,WAAmB,8BAA8B,KAAK,EAAE,OAAO,CAAC;AAErF,MAAM,gBAAgB,UACpB,wBAAwB,KAAK;CAAE,WAAW;CAAW;AAAM,CAAC;AAE9D,MAAM,gCAAgB,IAAI,IAAI;CAC5B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,MAAa,qBACX,YACyB;CACzB,MAAM,cAAc,gBAAgB,QAAQ,UAAU;CACtD,MAAM,iBAAiB,mBAAmB,QAAQ,YAAY,aAAa,QAAQ,YAAY;CAC/F,MAAM,cAAc,gBAAgB,QAAQ,YAAY,WAAW;CACnE,MAAM,gBAAgB,kBAAkB,QAAQ,YAAY,QAAQ,YAAY;CAChF,MAAM,oBAAoB,sBAAsB,QAAQ,UAAU;CAClE,MAAM,kBAAkB,+BAA+B,iBAAiB;CACxE,MAAM,cAAc,gBAAgB,QAAQ,YAAY,iBAAiB;CAEzE,MAAM,QACJ,SACG;EACH,MAAM,WAAW,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,KAAK,aAAa,SAAS,WAAW;EACtF,MAAM,QAAQ,SAAS,MAAM,YAAY,SAAS,SAAS,OAAO;EAClE,MAAM,WAAW,SAAS,MAAM,YAAY,SAAS,SAAS,UAAU;EAExE,MAAM,WAAW,SAAS,QACvB,YAAuC,SAAS,SAAS,SAC5D;EAEA,MAAM,aAAa,SAAS,MACzB,YAAY,SAAS,SAAS,cAAc,QAAQ,UACvD;EAEA,MAAM,QAAQ,SAAS,MAAM,YAAY,SAAS,SAAS,WAAW,QAAQ,SAAS;EACvF,MAAM,SAAS,SAAS,cAAc;EAEtC,MAAM,QAAuB;GAAC;GAAe;GAAe;GAAY;EAAc;EAEtF,IAAI,UAAU,MAAM,KAAK,aAAa,kBAAkB;EACxD,IAAI,YAAY,MAAM,KAAK,uBAAuB;EAClD,IAAI,OAAO,MAAM,KAAK,oBAAoB,eAAe;EACzD,IAAI,OAAO,MAAM,KAAK,YAAY;EAClC,IAAI,SAAS,SAAS,GACpB,MAAM,KACJ,sBACA,oBACA,kBACA,kBACA,gBACA,qBACA,gBACF;EACF,IAAI,SAAS,MAAM,YAAY,QAAQ,UAAU,GAAG,MAAM,KAAK,iBAAiB;EAChF,IAAI,QACF,MAAM,KACJ,iBACA,eACA,oBACA,sBACA,eACA,cACA,iBACA,eACF;EAEF,MAAM,YAAY,QAAQ,QAGxB,CAAC,CAAC,6BAA6B,KAAK,UAAU,QAAQ;EAExD,MAAM,SAAS,OAAO,OAAO,WAAW,EACtC,QAAQ,UAA6C,MAAM,QAAQ,WAAW,KAAK,EACrF,CAAC;EAED,MAAM,kBAAkB,QAAQ,QAAqD,CAAC,CACpF,6BAA6B,KAAK,UAAU,cAC9C;EAEA,MAAM,UACJ,SASA,YACsC;GACtC,MAAM,UAAU,QAAQ;GAExB,IAAI,SAAS,SAAS,KAAK,QAAQ,eAAe,KAAA,GAChD,MAAM,YACJ,2HACF;GACF,MAAM,cAAc,QAAQ,SAAS,QAAQ,KAAK;GAClD,MAAM,WAAW,YAAY,QAAQ,QAAQ;GAE7C,KAAK,MAAM,OAAO;IAAC,QAAQ;IAAI,QAAQ;IAAQ,QAAQ;GAAgB,GACrE,IAAI,YAAY,QAAQ,SAAS,KAAA,GAC/B,MAAM,YAAY,0BAA0B,KAAK;GAErD,IAAI,QAAQ,gBAAgB,KAAA,GAC1B,MAAM,YAAY,8CAA8C;GAElE,IAAI,aAAa,KAAA,KAAa,SAAS,SAAS,WAC9C,MAAM,YAAY,8CAA8C;GAElE,MAAM,SAAS,QAAQ;GAEvB,IAAI,YAAY,WAAW,KAAA,KAAa,CAAC,iCAAiC,KAAK,MAAM,IACnF,MAAM,YAAY,2DAA2D;GAE/E,MAAM,SAA0C,EAAE,GAAG,QAAQ,OAAO;GAEpE,KAAK,MAAM,QAAQ,OACjB,IAAI,OAAO,UAAU,KAAA,KAAa,SAAS;IACzC,MAAM,aAAa,gBAAgB,MAAM,GAAG,OAAO,GAAG,QAAQ,SAAS,IAAI;IAE3E,MAAM,WACJ,QAAQ,eAAe,KAAA,IACnB,aACA;KACE,GAAG;KACH,SAAS,OAAO,YACd,OAAO,QAAQ,WAAW,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,YAAY,CACxD,KACA,cAAc,IAAI,GAAG,IACjB;MAAE,GAAG;MAAQ,MAAM,QAAQ,YAAY,QAAQ,OAAO;KAAK,IAC3D,MACN,CAAC,CACH;IACF;IAEN,OAAO,QAAQ,QAAQ,UAAU,QAAQ;GAC3C;GAEF,KAAK,MAAM,QAAQ,OACjB,IAAI,OAAO,UAAU,KAAA,GAAW,MAAM,YAAY,WAAW,KAAK,OAAO;GAE3E,MAAM,eAAe,QAAQ,YAAY;GAEzC,MAAM,gBACJ,iBAAiB,KAAA,IACb,OAAO,oBAAoB,OAAO,GAAG,IACrC,OAAO,oBAAoB,YAAY;GAE7C,MAAM,oBACJ,iBAAiB,KAAA,IACb,OAAO,kBAAkB,OAAO,GAAG,IACnC,OAAO,kBAAkB,YAAY;GAE3C,MAAM,WAA2B;IAC/B,OAAO,QAAQ;IACf,IAAI,QAAQ;IACZ,QAAQ,QAAQ;IAChB,kBAAkB,QAAQ;IAC1B,aAAa,QAAQ;IACrB,cAAc,QAAQ;IACtB,oBAAoB,QAAQ,sBAAsB,QAAQ;IAC1D,YAAY,OACV,OAAO,oBAAoB,QAAQ,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,OAAO,SAAS,YAAY,CAAC;IACpF,WAAW,OACT,OAAO,aAAa,QAAQ,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,OAAO,SAAS,YAAY,CAAC;IAC7E,eAAe,OAAO,kBAAkB,QAAQ,OAAO;IACvD,cAAc,OAAO,WAAW,QAAQ,OAAO;GACjD;GAEA,OAAO,OAAO,OAAO;IACnB,WAAW,KAAK;IAChB,QAAQ,OAAO,OAAO,MAAM;IAC5B,QAAQ;IACR;IACA,eACE,iBAAiB,KAAA,KAAa,WAAmB,SAAS,OAAO,WAAW,YAAY;IAC1F,gBAAgB,UAAmB,cAAc,KAAK,CAAC,CAAC,KAAK,OAAO,SAAS,YAAY,CAAC;IAC1F;GACF,CAAC;EACH;EAgUA,OAAO;GACL;GACA,cAAc;GACd,OAjUe,MAAM,cACrB,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO;IACvB,MAAM,QAAQ,OAAO;IACrB,MAAM,SAAS,OAAO,UAAU;IAChC,MAAM,WAAW,OAAO,QAAQ;IAEhC,MAAM,UAAU,OAAO,gBAAgB;KACrC,UAAU;KACV,cAAc;KACd,cAAc,KAAA;IAChB,CAAC;IAED,IAAI,YAAY,KAAA,GACd,OAAO,OAAO,YAAY,8CAA8C;IAC1E,IAAI,KAAK,gBAAgB,YACvB,OAAO,OAAO,YAAY,yDAAyD;IACrF,IACE,SAAS,MACN,YACC,YAAY,KAAA,KACX,eAAe,WAAW,QAAQ,aAClC,QAAQ,SAAS,WAAW,CAAC,QAAQ,SAC1C,GAEA,OAAO,OAAO,YACZ,2EACF;IACF,IAAI,QAAQ,cAAc,KAAK,WAC7B,OAAO,OAAO,YACZ,kEACF;IACF,MAAM,cAAmC,CAAC;IAE1C,KAAK,MAAM,QAAQ,OAAO;KACxB,MAAM,QAAS,QAAQ,OAA2C;KAElE,IAAI,UAAU,KAAA,GAAW,OAAO,OAAO,YAAY,WAAW,KAAK,OAAO;KAC1E,MAAM,cAAc,QAAQ,SAAS,KAAK;KAC1C,MAAM,UAAU,YAAY;KAE5B,KAAK,MAAM,QAAQ,OAAO,KAAK,cAAc,KAAK,CAAC,OAAO,GACxD,IAAI,QAAQ,UAAU,KAAA,GACpB,OAAO,OAAO,YAAY,WAAW,KAAK,GAAG,KAAK,QAAQ;KAE9D,YAAY,KAAK;MAAE,OAAO;MAAa,UAAU,cAAc,KAAK,CAAC;KAAO,CAAC;IAC/E;IACA,YAAY,KAAK;KACf,OAAO,QAAQ,SAAS,QAAQ,SAAS,KAAU;KACnD,UAAU,CAAC,CAAC,QAAQ,SAAS,EAAE,CAAC;IAClC,CAAC;IACD,OAAO,qBAAqB,SAAS,WAAW;IAChD,MAAM,WAAW,OAAO,aAAa,OAAO;IAE5C,MAAM,cAAiB,UACrB,kBAAkB,OAAO,OAAO,kBAAkB;IAGpD,MAAM,SAAS;IAMf,MAAM,UAAU;KACd,MAAM;KACN,SAAS,YAAY;KACrB,iBAAiB,iBAAiB,mBAAmB,KAAK,CAAC,CAAC,CAAC;IAC/D;IAEA,MAAM,iBAAiB,SAAS,SAAS,KAAK,MAAM;IAEpD,MAAM,kBAAkB,OAAO,cAC5B,wBAAwB,gBAAgB,OAAO,CAAC,CAChD,KACC,OAAO,eAAe,mBAAmB,MAAM,GAC/C,OAAO,eAAe,gBAAgB,MAAM,CAC9C;IAEF,MAAM,YAAY,OAAO,cACtB,+BACC;KAAE,GAAG,SAAS,UAAU;KAAG,4BAA4B;IAAM,GAC7D,OACF,CAAC,CACA,KACC,OAAO,eAAe,mBAAmB,MAAM,GAC/C,OAAO,eAAe,gBAAgB,MAAM,CAC9C;IAEF,IAAI,UAAkC,QAAQ,KAAK,yBAAyB,SAAS,CAAC,CAAC,KACrF,QAAQ,IACN,KAAK,SAAS,4BACd,gBAAgB,0BAClB,GACA,QAAQ,IAAI,KAAK,SAAS,mBAAmB,gBAAgB,iBAAiB,CAChF;IAEA,MAAM,qBAAqB,SACvB;KACE,SAAS,SAAS,OAAO;KACzB,eAAe;MACb,MAAM;MACN,SAAS,YAAY;MACrB,iBAAiB,iBAAiB,iBAAiB,KAAK,CAAC,CAAC,CAAC;MAC3D,iBAAiB,UAAyB,MAAM,oBAAoB;KACtE;IACF,IACA,KAAA;IAEJ,IAAI,uBAAuB,KAAA,GACzB,UAAU,QAAQ,IAChB,SACA,kBACA,OAAO,YACJ,wBAAwB,mBAAmB,SAAS,mBAAmB,aAAa,CAAC,CACrF,KACC,OAAO,eAAe,iBAAiB,MAAM,GAC7C,OAAO,eAAe,gBAAgB,MAAM,CAC9C,CACJ;IAGF,IAAI,UAAU;KACZ,MAAM,cAAc,OAAO,eACxB,2BAA2B,SAAS,UAAU,GAAG;MAChD,MAAM;MACN,SAAS,YAAY;MACrB,iBAAiB,iBAAiB,oBAAoB,KAAK,CAAC,CAAC,CAAC;MAC9D,iBAAiB,UAAU,MAAM,oBAAoB;MACrD,GAAI,uBAAuB,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,mBAAmB;KAC1E,CAAC,CAAC,CACD,KACC,OAAO,eAAe,oBAAoB,MAAM,GAChD,OAAO,eAAe,gBAAgB,MAAM,CAC9C;KAEF,UAAU,QAAQ,IAAI,SAAS,qBAAqB,WAAW;IACjE;IACA,KAAK,MAAM,CAAC,MAAM,aAAa,OAAO,QAAQ,KAAK,UAAU,GAAG;KAC9D,IAAI,SAAS,aAAa,SAAS,cAAc,CAAC,SAAS,YAAY,YACrE;KACF,MAAM,MAAM,SAAS;KAErB,IAAI,QAAQ,KAAA,GACV,OAAO,OAAO,YAAY,oCAAoC,MAAM;KAEtE,MAAM,eAAe,OAAO,0BAC1B,UACA,QAAQ,YACR,iBAAiB,oBAAoB,KAAK,CAAC,CAAC,CAAC,GAC7C,iBACA,IACF,CAAC,CAAC,KAAK,OAAO,eAAe,oBAAoB,MAAM,CAAC;KAExD,UAAU,QAAQ,IAAI,SAAS,KAAK,YAAY;IAClD;IACA,IAAI,OACF,UAAU,QAAQ,IAChB,SACA,yBACA,OAAO,YACJ,+BAA+B,SAAS,OAAO,GAAG;KACjD,MAAM;KACN,SAAS,YAAY;KACrB,iBAAiB,iBAAiB,iBAAiB,KAAK,CAAC,CAAC,CAAC;KAC3D,GAAI,uBAAuB,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,mBAAmB;IAC1E,CAAC,CAAC,CACD,KACC,OAAO,eAAe,iBAAiB,MAAM,GAC7C,OAAO,eAAe,gBAAgB,MAAM,CAC9C,CACJ;IAEF,IAAI,OAAO;KACT,MAAM,EAAE,QAAQ,OAAO,QAAQ;KAE/B,MAAM,WAAW,cAAsB;MACrC;MACA,SAAS;OACP,OAAO,QAAQ,SAAS;OACxB,IAAI,QAAQ,SAAS;OACrB,kBAAkB,QAAQ,SAAS;OACnC,iBAAiB,GACf,OAAO,QAAQ,SAAS,OAAO,QAAQ,SAAS,MAAM,GACtD,QAAQ,SAAS,WACnB;MACF;MACA,YAAY;OACV,UAAU,QAAQ,SAAS;OAC3B,WAAW,QAAQ,SAAS;MAC9B;MACA,YAAY;OACV,OAAO,SAAS,MAAM,aAAa;OACnC,WAAW;OACX,OAAO;OACP,WAAW;OACX,UAAU;OACV,YAAY;OACZ,iBAAiB,GAAG,OAAO,SAAS,MAAM,aAAa,GAAG,QAAQ,GAAG,IAAI;MAC3E;MACA,YAAY;OACV,OAAO,SAAS,MAAM,aAAa;OACnC,IAAI;OACJ,WAAW;OACX,UAAU;OACV,iBAAiB,GAAG,OAAO,SAAS,MAAM,aAAa,GAAG,QAAQ,GAAG,IAAI;MAC3E;MACA,OAAO;OACL,OAAO,SAAS,MAAM,YAAY;OAClC,OAAO;OACP,OAAO;OACP,SAAS;OACT,eAAe,QAAgB;MACjC;MACA,WAAW;OACT,cAAc;OACd,iBAAiB;OACjB,iBAAiB;OACjB,iBAAiB;OACjB,wBAAwB;MAC1B;MACA,iBAAiB,QAAQ,WACtB,GAAG,GAAG,YAAY,OAAO,QAAQ,WAAW,GAAG,iEAAiE,QAAQ,WAAW,GAAG;MACzI,eAAe,QAAQ;KACzB;KAEA,MAAM,YAAY,OAAO,gBACtB,yBACC,yBACA;MACE,MAAM;MACN;MACA,SAAS,YAAY;MACrB,uBAAuB,iBAAiB,oBAAoB,KAAK,CAAC,CAAC,CAAC;KACtE,SACM,oBAAoB,KAAK,CAAC,CAAC,GACjC,QACF,CAAC,CACA,KAAK,OAAO,eAAe,gBAAgB,MAAM,CAAC;KAErD,MAAM,OACJ,MACA,WAAW,SAEX,UAAU,MAAM,KACd,OAAO,QAAQ,UAAU,IAAI,MAAM,QAAQ,CAAC,GAC5C,OAAO,eAAe,gBAAgB,KAAK,CAC7C;KAEF,MAAM,WAAW,aACf,SAAS,MAAM,YAAY,SAAS,SAAS,WAAW,QAAQ,aAAa,QAAQ;KAEvF,MAAM,YAAY,eAAe,GAAG;MAClC,QAAQ,YACN,QAAQ,QAAQ,QAAQ,IACpB,IAAI,YAAY,WAAW,QAAQ,QAAQ,QAAQ,GAAG,OAAO,CAAC,IAC9D,OAAO,KAAK,oBAAoB,KAAK,CAAC,CAAC,CAAC;MAC9C,UAAU,YACR,QAAQ,QAAQ,QAAQ,IACpB,IAAI,YAAY,sBAAsB,QAAQ,QAAQ,QAAQ,GAAG,OAAO,CAAC,IACzE,OAAO,KAAK,oBAAoB,KAAK,CAAC,CAAC,CAAC;KAChD,CAAC;KAED,MAAM,UAAU,mBAAmB,GAAG,EACpC,SAAS,YACP,QAAQ,QAAQ,QAAQ,IACpB,IAAI,YAAY,YAAY,QAAQ,QAAQ,QAAQ,GAAG,OAAO,GAAG,KAAK,IACtE,OAAO,KAAK,oBAAoB,KAAK,CAAC,CAAC,CAAC,EAChD,CAAC;KAED,UAAU,QAAQ,KAChB,QAAQ,IAAI,gBAAgB,SAAS,GACrC,QAAQ,IAAI,oBAAoB,OAAO,CACzC;IACF;IAEA,IAAI,SAAS,SAAS,GAAG;KAEvB,MAAM,WAAW,QAAQ,SAAS;MAChC;MACA,WAAW,KAAK;MAChB;MACA,UAAU;MACV,iBAAiB,SAAS,SAAS,YACjC,SAAS,SAAS,aAAa,CAAC,QAAQ,QAAQ,IAAI,CAAC,CACvD;KACF,CAAC;KAWD,UAAU,QAAQ,MAChB,SACA,OAAO,SAAS,KACd,OAAO,eAAe,gBAAgB,MAAM,GAC5C,OAAO,eAAe,iBAAiB,MAAM,CAC/C,CACF;IACF;IAGA,OAAO;GACT,CAAC,CAAC,CAAC,KACD,uBACA,OAAO,UAAU,UACf,OAAO,GAAG,6BAA6B,CAAC,CAAC,KAAK,IAC1C,QACA,YAAY,gCAAgC,CAClD,CACF,CACF,CAAC,CAAC,KAAK,MAAM,QAAQ,UAAU,CAKf;GACd,UAA+B,YAQzB,OAAO,SAAS,IAAI;GAC1B,MAA2B,YAOrB,OAAO,SAAS,KAAK;EAC7B;CACF;CAEA,OAAO,EAAE,KAAK;AAChB"}
+{"version":3,"file":"persistence.mjs","names":[],"sources":["../../src/internal/persistence.ts"],"sourcesContent":["import { EmailAddressPersistence, EmailUnavailable } from \"@yielded/auth/Email\";\nimport type { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport { hasCommitScope } from \"@yielded/auth/Hooks\";\nimport {\n  PasskeyCredentials,\n  PasskeyManagementPersistence,\n  PasskeyPersistence,\n  PasskeyUnavailable,\n} from \"@yielded/auth/Passkey\";\nimport { PasswordPersistence, PasswordUnavailable } from \"@yielded/auth/Password\";\nimport { hooksLayer } from \"@yielded/auth/Persistence\";\nimport { PhoneSignInTargets, PhoneOtpUnavailable } from \"@yielded/auth/PhoneOtp\";\nimport { ProofPersistence, ProofUnavailable } from \"@yielded/auth/Proofs\";\nimport { AuthenticationAuthority, SessionUnavailable } from \"@yielded/auth/Sessions\";\nimport { Context, type Crypto, Effect, Layer, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\n\nimport {\n  PersistenceConfigurationError,\n  type ClaimsCodec,\n  type ConfigId,\n  type Definition,\n  type PersistenceApi,\n  type Ports,\n  type Roles,\n  type Provisioning,\n  type ProvisioningRequirement,\n  type StorageLayout,\n  type SubjectMapping,\n  type SubjectOptions,\n  type PasskeyFeature,\n  type PasskeyRequirement,\n} from \"./configuration\";\nimport { makeNativeEmailAddressServices } from \"./email-native\";\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport type { NativeSqlTables } from \"./native-sql-table\";\nimport { makeManagedPasskeys } from \"./passkey-managed\";\nimport { makeNativePasswordServices } from \"./password-native\";\nimport { makeComposedPhoneTargets } from \"./phone-composed\";\nimport { makeNativeProofServices } from \"./proof-native\";\nimport { makeRegistrationAuthority } from \"./registration\";\nimport type { PasswordRegistrationAuthority } from \"./registration-contract\";\nimport { makeNativeAuthenticationAuthorityServices } from \"./session-native-authority\";\nimport { makeNativeSessionCleanupServices } from \"./session-native-cleanup\";\nimport { makeNativePendingAuthenticationServices } from \"./session-native-login\";\nimport { makeNativeStatefulSessionServices } from \"./session-native-stateful\";\nimport { makeNativeSessionStepUpServices } from \"./session-native-step-up\";\nimport { SqlBatchCommit } from \"./sql-commit\";\nimport { requireStandalone } from \"./standalone\";\nimport { makeMappings } from \"./storage-mapping\";\nimport {\n  tableDefinition,\n  storageTables,\n  type StorageRole,\n  type StorageTable,\n} from \"./storage-tables\";\nimport {\n  validateStorageBatch,\n  withStorageValidation,\n  type StorageValidation,\n} from \"./storage-validation\";\n\nexport interface Backend<T extends object, R, Database extends object = object> {\n  readonly makeTable: (definition: StorageTable) => T;\n  readonly describe: (table: T) => StorageTable;\n  readonly acquire: Effect.Effect<Database, PersistenceConfigurationError, R | SqlClient.SqlClient>;\n  readonly nativeTables: (database: Database) => NativeSqlTables;\n}\n\nconst configError = (reason: string) => PersistenceConfigurationError.make({ reason });\n\nconst mappingError = (cause: unknown) =>\n  PersistenceMappingError.make({ operation: \"mapping\", cause });\n\nconst timestampKeys = new Set([\n  \"verifiedAt\",\n  \"createdAt\",\n  \"lastIssueAt\",\n  \"issuedAt\",\n  \"expiresAt\",\n  \"absoluteExpiresAt\",\n  \"retentionUntil\",\n  \"claimDeadline\",\n  \"retryAt\",\n  \"admittedAt\",\n  \"deadline\",\n  \"occurredAt\",\n  \"dedupUntil\",\n]);\n\nexport const createPersistence = <T extends object, R, Database extends object = object>(\n  backend: Backend<T, R, Database>,\n): PersistenceApi<T, R> => {\n  const make = <C extends ClaimsCodec, const Id extends string, const A extends Definition<C, Id>>(\n    auth: A & Definition<C, Id>,\n  ) => {\n    const features = Object.values(auth.strategies).map((strategy) => strategy.persistence);\n    const phone = features.some((feature) => feature?.kind === \"phone\");\n    const password = features.some((feature) => feature?.kind === \"password\");\n\n    const passkeys = features.filter(\n      (feature): feature is PasskeyFeature => feature?.kind === \"passkey\",\n    );\n\n    const management = features.some(\n      (feature) => feature?.kind === \"password\" && feature.management,\n    );\n\n    const email = features.some((feature) => feature?.kind === \"email\" && feature.addresses);\n    const proofs = phone || management || email;\n\n    const roles: StorageRole[] = [\"identifiers\", \"credentials\", \"sessions\", \"pending\"];\n\n    if (password) roles.push(\"passwords\");\n    if (email) roles.push(\"emailCredentials\");\n    if (passkeys.length > 0) roles.push(\"passkeyCredentials\", \"passkeyFlows\");\n    if (proofs) roles.push(\"proofs\");\n\n    const ConfigKey = Context.Service<\n      ConfigId<A[\"namespace\"]>,\n      StorageLayout<T, Roles<C, Id, A>>\n    >()(`@yielded/auth-persistence/${auth.namespace}/Config`);\n\n    const Config = Object.assign(ConfigKey, {\n      layer: (value: StorageLayout<T, Roles<C, Id, A>>) => Layer.succeed(ConfigKey, value),\n    });\n\n    const ProvisioningKey = Context.Service<ProvisioningRequirement<A>, Provisioning<A>>()(\n      `@yielded/auth-persistence/${auth.namespace}/Provisioning`,\n    );\n\n    const layout = <N, Instant>(\n      options: {\n        readonly subjects: SubjectOptions<T, N>;\n        readonly tables?: Partial<Record<StorageRole, T>>;\n        readonly prefix?: string;\n        readonly timestamps?: {\n          readonly type: \"text\" | \"integer\";\n          readonly codec: Schema.Codec<number, Instant>;\n        };\n      },\n      managed: boolean,\n    ): StorageLayout<T, Roles<C, Id, A>> => {\n      const subject = options.subjects;\n\n      if (passkeys.length > 0 && options.timestamps !== undefined)\n        throw configError(\n          \"Composed passkey storage uses integer milliseconds; use an explicit passkey adapter for a custom timestamp representation\",\n        );\n      const description = backend.describe(subject.table);\n      const idColumn = description.columns[subject.id];\n\n      for (const key of [subject.id, subject.status, subject.securityRevision]) {\n        if (description.columns[key] === undefined)\n          throw configError(`Missing subject column ${key}`);\n      }\n      if (subject.activeValue === undefined)\n        throw configError(\"An explicit active subject value is required\");\n\n      if (idColumn === undefined || idColumn.type === \"boolean\")\n        throw configError(\"Subject ID must map a text or integer column\");\n\n      const prefix = options.prefix;\n\n      if (managed && (prefix === undefined || !/^[A-Za-z_][A-Za-z0-9_]{0,100}$/.test(prefix)))\n        throw configError(\"Managed persistence requires an explicit SQL table prefix\");\n\n      const schema: Partial<Record<StorageRole, T>> = { ...options.tables };\n\n      for (const role of roles) {\n        if (schema[role] === undefined && managed) {\n          const definition = tableDefinition(role, `${prefix}_${role}`, idColumn.type);\n\n          const adjusted =\n            options.timestamps === undefined\n              ? definition\n              : {\n                  ...definition,\n                  columns: Object.fromEntries(\n                    Object.entries(definition.columns).map(([key, column]) => [\n                      key,\n                      timestampKeys.has(key)\n                        ? { ...column, type: options.timestamps?.type ?? column.type }\n                        : column,\n                    ]),\n                  ),\n                };\n\n          schema[role] = backend.makeTable(adjusted);\n        }\n      }\n      for (const role of roles) {\n        if (schema[role] === undefined) throw configError(`Missing ${role} table`);\n      }\n      const instantCodec = options.timestamps?.codec;\n\n      const decodeInstant =\n        instantCodec === undefined\n          ? Schema.decodeUnknownEffect(Schema.Int)\n          : Schema.decodeUnknownEffect(instantCodec);\n\n      const decodeInstantSync =\n        instantCodec === undefined\n          ? Schema.decodeUnknownSync(Schema.Int)\n          : Schema.decodeUnknownSync(instantCodec);\n\n      const subjects: SubjectMapping = {\n        table: subject.table,\n        id: subject.id,\n        status: subject.status,\n        securityRevision: subject.securityRevision,\n        activeValue: subject.activeValue,\n        requirements: subject.requirements,\n        actionRequirements: subject.actionRequirements ?? subject.requirements,\n        toSubject: (id) =>\n          Schema.decodeUnknownEffect(subject.idCodec)(id).pipe(Effect.mapError(mappingError)),\n        toNative: (id) =>\n          Schema.encodeEffect(subject.idCodec)(id).pipe(Effect.mapError(mappingError)),\n        toSubjectSync: Schema.decodeUnknownSync(subject.idCodec),\n        toNativeSync: Schema.encodeSync(subject.idCodec),\n      };\n\n      return Object.freeze({\n        namespace: auth.namespace,\n        schema: Object.freeze(schema) as Readonly<Record<Roles<C, Id, A>, T>>,\n        tables: schema,\n        subjects,\n        encodeInstant:\n          instantCodec === undefined ? (millis: number) => millis : Schema.encodeSync(instantCodec),\n        decodeInstant: (value: unknown) => decodeInstant(value).pipe(Effect.mapError(mappingError)),\n        decodeInstantSync,\n      });\n    };\n\n    const services = Layer.effectContext(\n      Effect.gen(function* () {\n        const storage = yield* ConfigKey;\n        const client = yield* SqlClient.SqlClient;\n        const database = yield* backend.acquire;\n\n        const dialect = client.onDialectOrElse({\n          pg: () => \"pg\" as const,\n          sqlite: () => \"sqlite\" as const,\n          orElse: () => undefined,\n        });\n\n        if (dialect === undefined)\n          return yield* configError(\"Use an explicit adapter for this SQL dialect\");\n        if (auth.sessionMode !== \"stateful\")\n          return yield* configError(\"The composed layer currently requires stateful sessions\");\n        if (\n          features.some(\n            (feature) =>\n              feature === undefined ||\n              (\"lifecycle\" in feature && feature.lifecycle) ||\n              (feature.kind === \"email\" && !feature.addresses),\n          )\n        )\n          return yield* configError(\n            \"Use explicit services for strategies without composed persistence support\",\n          );\n        if (storage.namespace !== auth.namespace)\n          return yield* configError(\n            \"Persistence configuration belongs to a different Auth definition\",\n          );\n        const validations: StorageValidation[] = [];\n\n        for (const role of roles) {\n          const table = (storage.schema as Partial<Record<StorageRole, T>>)[role];\n\n          if (table === undefined) return yield* configError(`Missing ${role} table`);\n          const description = backend.describe(table);\n          const columns = description.columns;\n\n          for (const name of Object.keys(storageTables[role].columns)) {\n            if (columns[name] === undefined)\n              return yield* configError(`Missing ${role}.${name} column`);\n          }\n          validations.push({ table: description, required: storageTables[role].unique });\n        }\n        validations.push({\n          table: backend.describe(storage.subjects.table as T),\n          required: [[storage.subjects.id]],\n        });\n        yield* validateStorageBatch(dialect, validations);\n        const mappings = yield* makeMappings(storage);\n\n        const nativeTables = backend.nativeTables(database);\n        const sessionMapping = mappings.sessions(auth.claims, auth.sessions.moduleId);\n        const pendingMapping = mappings.pending(auth.claims, auth.sessions.moduleId);\n\n        const sessionServices = yield* makeNativeStatefulSessionServices(\n          nativeTables,\n          sessionMapping,\n        );\n\n        const { authenticationAuthority } = yield* makeNativeAuthenticationAuthorityServices(\n          nativeTables,\n          sessionMapping,\n        );\n\n        const { pendingAuthentication } = yield* makeNativePendingAuthenticationServices(\n          nativeTables,\n          pendingMapping,\n        );\n\n        const { sessionStepUpPersistence } = yield* makeNativeSessionStepUpServices(nativeTables, {\n          ...pendingMapping,\n          source: {\n            kind: \"Stateful\",\n            session: sessionMapping.session,\n            sessionId: sessionMapping.sessionId,\n            constraints: { sessionDigest: \"unique(session.digest)\" },\n          },\n        });\n\n        const { sessionCleanup } = yield* makeNativeSessionCleanupServices(\n          nativeTables,\n          pendingMapping,\n        );\n\n        let context: Context.Context<never> = Context.make(\n          AuthenticationAuthority,\n          authenticationAuthority,\n        ).pipe(\n          Context.add(\n            auth.sessions.StatefulSessionPersistence,\n            sessionServices.statefulSessionPersistence,\n          ),\n          Context.add(auth.sessions.SessionRepository, sessionServices.sessionRepository),\n          Context.add(auth.sessions.PendingAuthentication, pendingAuthentication),\n          Context.add(auth.sessions.SessionStepUpPersistence, sessionStepUpPersistence),\n          Context.add(auth.sessions.SessionCleanup, sessionCleanup),\n        );\n\n        const proofMapping = proofs ? mappings.proofs() : undefined;\n\n        if (proofMapping !== undefined) {\n          const services = yield* makeNativeProofServices(\n            backend.nativeTables(database),\n            proofMapping,\n          );\n\n          context = Context.add(context, ProofPersistence, services.proofPersistence);\n        }\n\n        if (password) {\n          const mapping = mappings.passwords();\n\n          const services = yield* makeNativePasswordServices(\n            backend.nativeTables(database),\n            mapping,\n            proofMapping,\n          );\n\n          context = Context.add(context, PasswordPersistence, services.passwordPersistence);\n        }\n        for (const [name, strategy] of Object.entries(auth.strategies)) {\n          if (strategy.persistence?.kind !== \"password\" || !strategy.persistence.management)\n            continue;\n          const key = strategy.RegistrationAuthority;\n\n          if (key === undefined)\n            return yield* configError(`Missing subject provisioning for ${name}`);\n\n          const registration = yield* makeRegistrationAuthority(\n            backend.nativeTables(database),\n            mappings.passwords(),\n            ProvisioningKey,\n            name,\n          );\n\n          context = Context.add(context, key, registration);\n        }\n        if (email)\n          context = Context.add(\n            context,\n            EmailAddressPersistence,\n            (yield* makeNativeEmailAddressServices(\n              backend.nativeTables(database),\n              mappings.emails(),\n              proofMapping,\n            )).emailAddressPersistence,\n          );\n\n        if (phone)\n          context = Context.add(\n            context,\n            PhoneSignInTargets,\n            yield* makeComposedPhoneTargets(\n              backend.nativeTables(database),\n              storage,\n              mappings.proofs(),\n              features.flatMap((feature) => (feature?.kind === \"phone\" ? [feature.moduleId] : [])),\n            ),\n          );\n\n        if (passkeys.length > 0) {\n          // Auth capability metadata determines whether PasskeyConfig is required.\n          const services = makeManagedPasskeys(\n            {\n              storage,\n              namespace: auth.namespace,\n              dialect,\n              features: passkeys,\n              passwordModules: features.flatMap((feature) =>\n                feature?.kind === \"password\" ? [feature.moduleId] : [],\n              ),\n            },\n            backend.nativeTables(database),\n          ) as Effect.Effect<\n            Context.Context<never>,\n            PersistenceConfigurationError,\n            PasskeyRequirement<A> | Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n          >;\n\n          context = Context.merge(context, yield* services);\n        }\n\n        // The checked capability metadata above determines exactly these service keys.\n        return context as Context.Context<Ports<C, Id, A>>;\n      }).pipe(\n        Effect.provideService(SqlBatchCommit, undefined),\n        withStorageValidation,\n        Effect.mapError((error) =>\n          Schema.is(PersistenceConfigurationError)(error)\n            ? error\n            : configError(\"Cannot acquire SQL persistence\"),\n        ),\n      ),\n    ).pipe(Layer.provide(hooksLayer));\n\n    const layer = Layer.effectContext(\n      Effect.gen(function* () {\n        const scope = yield* Effect.scope;\n        const captured = yield* Effect.context<Layer.Services<typeof services>>();\n        const client = Context.get(captured, SqlClient.SqlClient);\n\n        // Construction uses the layer's exact environment and lifetime, never the\n        // first operation's SQL transaction, service overrides, or request scope.\n        // Cache the full exit: concurrent callers share failures/interruption too,\n        // and cannot retry partially completed setup within this acquired layer.\n        const initialize = yield* Effect.cached(\n          Layer.buildWithScope(services, scope).pipe(Effect.setContext(captured)),\n        );\n\n        const service = Effect.fnUntraced(function* <I, S, Failure>(\n          key: Context.Key<I, S>,\n          unavailable: () => Failure,\n          standalone = true,\n        ): Effect.fn.Return<S, Failure> {\n          // Reject unsupported ownership before setup can perform any writes.\n          // Session/authority reads retain their existing ambient-read semantics.\n          if (standalone) {\n            if (yield* hasCommitScope) return yield* Effect.fail(unavailable());\n            yield* requireStandalone(unavailable, client.transactionService);\n          }\n          const acquired = yield* initialize.pipe(Effect.mapError(unavailable));\n          const value = Context.getOrUndefined(acquired, key);\n\n          return value === undefined ? yield* Effect.fail(unavailable()) : value;\n        });\n\n        const sessionUnavailable = () => SessionUnavailable.make({});\n        const authority = service(AuthenticationAuthority, sessionUnavailable, false);\n        const authorityMutation = service(AuthenticationAuthority, sessionUnavailable);\n\n        const sessions = service(\n          auth.sessions.StatefulSessionPersistence,\n          sessionUnavailable,\n          false,\n        );\n\n        const sessionMutations = service(\n          auth.sessions.StatefulSessionPersistence,\n          sessionUnavailable,\n        );\n\n        const repository = service(auth.sessions.SessionRepository, sessionUnavailable, false);\n        const pendingRead = service(auth.sessions.PendingAuthentication, sessionUnavailable, false);\n        const pendingMutation = service(auth.sessions.PendingAuthentication, sessionUnavailable);\n\n        const stepUpRead = service(\n          auth.sessions.SessionStepUpPersistence,\n          sessionUnavailable,\n          false,\n        );\n\n        const stepUpMutation = service(auth.sessions.SessionStepUpPersistence, sessionUnavailable);\n        const cleanup = service(auth.sessions.SessionCleanup, sessionUnavailable);\n\n        let context: Context.Context<never> = Context.make(AuthenticationAuthority, {\n          capture: (subjectId, credentialIds) =>\n            Effect.flatMap(authority, (s) => s.capture(subjectId, credentialIds)),\n          requirements: (evidence) => Effect.flatMap(authority, (s) => s.requirements(evidence)),\n          approve: (input, prepare) =>\n            Effect.flatMap(authorityMutation, (s) => s.approve(input, prepare)),\n        }).pipe(\n          Context.add(auth.sessions.StatefulSessionPersistence, {\n            establish: (input, prepare) =>\n              Effect.flatMap(sessionMutations, (s) => s.establish(input, prepare)),\n            verify: (input) => Effect.flatMap(sessions, (s) => s.verify(input)),\n            rotate: (input, prepare) =>\n              Effect.flatMap(sessionMutations, (s) => s.rotate(input, prepare)),\n            revokeDigest: (digest, prepare) =>\n              Effect.flatMap(sessionMutations, (s) => s.revokeDigest(digest, prepare)),\n            revoke: (input, prepare) =>\n              Effect.flatMap(sessionMutations, (s) => s.revoke(input, prepare)),\n            revokeAll: (input, prepare) =>\n              Effect.flatMap(sessionMutations, (s) => s.revokeAll(input, prepare)),\n          }),\n          Context.add(auth.sessions.SessionRepository, {\n            list: (input) => Effect.flatMap(repository, (s) => s.list(input)),\n          }),\n          Context.add(auth.sessions.PendingAuthentication, {\n            create: (input, now, prepare) =>\n              Effect.flatMap(pendingMutation, (s) => s.create(input, now, prepare)),\n            read: (input) => Effect.flatMap(pendingRead, (s) => s.read(input)),\n            reject: (input, prepare) =>\n              Effect.flatMap(pendingMutation, (s) => s.reject(input, prepare)),\n          }),\n          Context.add(auth.sessions.SessionStepUpPersistence, {\n            create: (input, now, prepare) =>\n              Effect.flatMap(stepUpMutation, (s) => s.create(input, now, prepare)),\n            read: (input) => Effect.flatMap(stepUpRead, (s) => s.read(input)),\n            reject: (input, prepare) =>\n              Effect.flatMap(stepUpMutation, (s) => s.reject(input, prepare)),\n            complete: (plan, prepare) =>\n              Effect.flatMap(stepUpMutation, (s) => s.complete(plan, prepare)),\n          }),\n          Context.add(auth.sessions.SessionCleanup, {\n            cleanup: (input) => Effect.flatMap(cleanup, (s) => s.cleanup(input)),\n          }),\n        );\n\n        if (proofs) {\n          const persistence = service(ProofPersistence, () => ProofUnavailable.make({}));\n\n          context = Context.add(context, ProofPersistence, {\n            issue: (input, prepare) => Effect.flatMap(persistence, (s) => s.issue(input, prepare)),\n            redeem: (input, prepare) =>\n              Effect.flatMap(persistence, (s) => s.redeem(input, prepare)),\n            cancel: (input, prepare) =>\n              Effect.flatMap(persistence, (s) => s.cancel(input, prepare)),\n            cleanup: (input, prepare) =>\n              Effect.flatMap(persistence, (s) => s.cleanup(input, prepare)),\n          });\n        }\n        if (password) {\n          const persistence = service(PasswordPersistence, () => PasswordUnavailable.make({}));\n\n          context = Context.add(context, PasswordPersistence, {\n            findCredential: (input) => Effect.flatMap(persistence, (s) => s.findCredential(input)),\n            rehashIfCurrent: (input) =>\n              Effect.flatMap(persistence, (s) => s.rehashIfCurrent(input)),\n            readForSubject: (input) => Effect.flatMap(persistence, (s) => s.readForSubject(input)),\n            recoveryTarget: (input) => Effect.flatMap(persistence, (s) => s.recoveryTarget(input)),\n            addIfAbsent: (input, prepare) =>\n              Effect.flatMap(persistence, (s) => s.addIfAbsent(input, prepare)),\n            replaceIfCurrent: (input, prepare) =>\n              Effect.flatMap(persistence, (s) => s.replaceIfCurrent(input, prepare)),\n            resetWithProof: (input, prepare) =>\n              Effect.flatMap(persistence, (s) => s.resetWithProof(input, prepare)),\n          });\n        }\n        for (const [name, strategy] of Object.entries(auth.strategies)) {\n          if (strategy.persistence?.kind !== \"password\" || !strategy.persistence.management)\n            continue;\n          const key = strategy.RegistrationAuthority;\n\n          if (key === undefined)\n            return yield* configError(`Missing subject provisioning for ${name}`);\n\n          // The heterogeneous strategy table erases the registration input type;\n          // its decoded value is forwarded unchanged to the same authority key.\n          const registration = service(\n            key as Context.Key<unknown, PasswordRegistrationAuthority<unknown>>,\n            () => PasswordUnavailable.make({}),\n          );\n\n          context = Context.add(context, key, {\n            register: (input, prepare) =>\n              Effect.flatMap(registration, (s) => s.register(input, prepare)),\n          } satisfies PasswordRegistrationAuthority<unknown>);\n        }\n        if (email) {\n          const persistence = service(EmailAddressPersistence, () => EmailUnavailable.make({}));\n\n          context = Context.add(context, EmailAddressPersistence, {\n            target: (input) => Effect.flatMap(persistence, (s) => s.target(input)),\n            verifyWithProof: (input, prepare) =>\n              Effect.flatMap(persistence, (s) => s.verifyWithProof(input, prepare)),\n            changeWithProof: (input, prepare) =>\n              Effect.flatMap(persistence, (s) => s.changeWithProof(input, prepare)),\n          });\n        }\n        if (phone) {\n          const unavailable = () => PhoneOtpUnavailable.make({});\n          const targets = service(PhoneSignInTargets, unavailable);\n\n          context = context.pipe(\n            Context.add(PhoneSignInTargets, {\n              lookup: (input) => Effect.flatMap(targets, (s) => s.lookup(input)),\n            }),\n          );\n        }\n        if (passkeys.length > 0) {\n          const unavailable = () => PasskeyUnavailable.make({});\n          const credentials = service(PasskeyCredentials, unavailable);\n          const persistence = service(PasskeyPersistence, unavailable);\n\n          context = context.pipe(\n            Context.add(PasskeyCredentials, {\n              lookup: (input) => Effect.flatMap(credentials, (s) => s.lookup(input)),\n              listForSubject: (input) =>\n                Effect.flatMap(credentials, (s) => s.listForSubject(input)),\n            }),\n            Context.add(PasskeyPersistence, {\n              issue: (input, prepare) =>\n                Effect.flatMap(persistence, (s) => s.issue(input, prepare)),\n              context: (input) => Effect.flatMap(persistence, (s) => s.context(input)),\n              consume: (input, prepare) =>\n                Effect.flatMap(persistence, (s) => s.consume(input, prepare)),\n              cleanup: (input, prepare) =>\n                Effect.flatMap(persistence, (s) => s.cleanup(input, prepare)),\n            }),\n          );\n          if (passkeys.some((feature) => feature.management)) {\n            const manager = service(PasskeyManagementPersistence, unavailable);\n\n            context = context.pipe(\n              Context.add(PasskeyManagementPersistence, {\n                list: (input) => Effect.flatMap(manager, (s) => s.list(input)),\n                completeEnrollment: (input, prepare) =>\n                  Effect.flatMap(manager, (s) => s.completeEnrollment(input, prepare)),\n                inspectRemove: (input) => Effect.flatMap(manager, (s) => s.inspectRemove(input)),\n                remove: (input, prepare) =>\n                  Effect.flatMap(manager, (s) => s.remove(input, prepare)),\n                rename: (input, prepare) =>\n                  Effect.flatMap(manager, (s) => s.rename(input, prepare)),\n              }),\n            );\n          }\n        }\n\n        // Match the same capability-selected service keys as the acquired graph.\n        return context as Context.Context<Ports<C, Id, A>>;\n      }),\n    );\n\n    return {\n      Config,\n      Provisioning: ProvisioningKey,\n      layer,\n      managed: <N, Instant = number>(options: {\n        readonly subjects: SubjectOptions<T, N>;\n        readonly tables?: Partial<Record<Roles<C, Id, A>, T>>;\n        readonly prefix?: string;\n        readonly timestamps?: {\n          readonly type: \"text\" | \"integer\";\n          readonly codec: Schema.Codec<number, Instant>;\n        };\n      }) => layout(options, true),\n      map: <N, Instant = number>(options: {\n        readonly subjects: SubjectOptions<T, N>;\n        readonly tables: Partial<Record<StorageRole, T>>;\n        readonly timestamps?: {\n          readonly type: \"text\" | \"integer\";\n          readonly codec: Schema.Codec<number, Instant>;\n        };\n      }) => layout(options, false),\n    };\n  };\n\n  return { make };\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqEA,MAAM,eAAe,WAAmB,8BAA8B,KAAK,EAAE,OAAO,CAAC;AAErF,MAAM,gBAAgB,UACpB,wBAAwB,KAAK;CAAE,WAAW;CAAW;AAAM,CAAC;AAE9D,MAAM,gCAAgB,IAAI,IAAI;CAC5B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,MAAa,qBACX,YACyB;CACzB,MAAM,QACJ,SACG;EACH,MAAM,WAAW,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,KAAK,aAAa,SAAS,WAAW;EACtF,MAAM,QAAQ,SAAS,MAAM,YAAY,SAAS,SAAS,OAAO;EAClE,MAAM,WAAW,SAAS,MAAM,YAAY,SAAS,SAAS,UAAU;EAExE,MAAM,WAAW,SAAS,QACvB,YAAuC,SAAS,SAAS,SAC5D;EAEA,MAAM,aAAa,SAAS,MACzB,YAAY,SAAS,SAAS,cAAc,QAAQ,UACvD;EAEA,MAAM,QAAQ,SAAS,MAAM,YAAY,SAAS,SAAS,WAAW,QAAQ,SAAS;EACvF,MAAM,SAAS,SAAS,cAAc;EAEtC,MAAM,QAAuB;GAAC;GAAe;GAAe;GAAY;EAAS;EAEjF,IAAI,UAAU,MAAM,KAAK,WAAW;EACpC,IAAI,OAAO,MAAM,KAAK,kBAAkB;EACxC,IAAI,SAAS,SAAS,GAAG,MAAM,KAAK,sBAAsB,cAAc;EACxE,IAAI,QAAQ,MAAM,KAAK,QAAQ;EAE/B,MAAM,YAAY,QAAQ,QAGxB,CAAC,CAAC,6BAA6B,KAAK,UAAU,QAAQ;EAExD,MAAM,SAAS,OAAO,OAAO,WAAW,EACtC,QAAQ,UAA6C,MAAM,QAAQ,WAAW,KAAK,EACrF,CAAC;EAED,MAAM,kBAAkB,QAAQ,QAAqD,CAAC,CACpF,6BAA6B,KAAK,UAAU,cAC9C;EAEA,MAAM,UACJ,SASA,YACsC;GACtC,MAAM,UAAU,QAAQ;GAExB,IAAI,SAAS,SAAS,KAAK,QAAQ,eAAe,KAAA,GAChD,MAAM,YACJ,2HACF;GACF,MAAM,cAAc,QAAQ,SAAS,QAAQ,KAAK;GAClD,MAAM,WAAW,YAAY,QAAQ,QAAQ;GAE7C,KAAK,MAAM,OAAO;IAAC,QAAQ;IAAI,QAAQ;IAAQ,QAAQ;GAAgB,GACrE,IAAI,YAAY,QAAQ,SAAS,KAAA,GAC/B,MAAM,YAAY,0BAA0B,KAAK;GAErD,IAAI,QAAQ,gBAAgB,KAAA,GAC1B,MAAM,YAAY,8CAA8C;GAElE,IAAI,aAAa,KAAA,KAAa,SAAS,SAAS,WAC9C,MAAM,YAAY,8CAA8C;GAElE,MAAM,SAAS,QAAQ;GAEvB,IAAI,YAAY,WAAW,KAAA,KAAa,CAAC,iCAAiC,KAAK,MAAM,IACnF,MAAM,YAAY,2DAA2D;GAE/E,MAAM,SAA0C,EAAE,GAAG,QAAQ,OAAO;GAEpE,KAAK,MAAM,QAAQ,OACjB,IAAI,OAAO,UAAU,KAAA,KAAa,SAAS;IACzC,MAAM,aAAa,gBAAgB,MAAM,GAAG,OAAO,GAAG,QAAQ,SAAS,IAAI;IAE3E,MAAM,WACJ,QAAQ,eAAe,KAAA,IACnB,aACA;KACE,GAAG;KACH,SAAS,OAAO,YACd,OAAO,QAAQ,WAAW,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,YAAY,CACxD,KACA,cAAc,IAAI,GAAG,IACjB;MAAE,GAAG;MAAQ,MAAM,QAAQ,YAAY,QAAQ,OAAO;KAAK,IAC3D,MACN,CAAC,CACH;IACF;IAEN,OAAO,QAAQ,QAAQ,UAAU,QAAQ;GAC3C;GAEF,KAAK,MAAM,QAAQ,OACjB,IAAI,OAAO,UAAU,KAAA,GAAW,MAAM,YAAY,WAAW,KAAK,OAAO;GAE3E,MAAM,eAAe,QAAQ,YAAY;GAEzC,MAAM,gBACJ,iBAAiB,KAAA,IACb,OAAO,oBAAoB,OAAO,GAAG,IACrC,OAAO,oBAAoB,YAAY;GAE7C,MAAM,oBACJ,iBAAiB,KAAA,IACb,OAAO,kBAAkB,OAAO,GAAG,IACnC,OAAO,kBAAkB,YAAY;GAE3C,MAAM,WAA2B;IAC/B,OAAO,QAAQ;IACf,IAAI,QAAQ;IACZ,QAAQ,QAAQ;IAChB,kBAAkB,QAAQ;IAC1B,aAAa,QAAQ;IACrB,cAAc,QAAQ;IACtB,oBAAoB,QAAQ,sBAAsB,QAAQ;IAC1D,YAAY,OACV,OAAO,oBAAoB,QAAQ,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,OAAO,SAAS,YAAY,CAAC;IACpF,WAAW,OACT,OAAO,aAAa,QAAQ,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,OAAO,SAAS,YAAY,CAAC;IAC7E,eAAe,OAAO,kBAAkB,QAAQ,OAAO;IACvD,cAAc,OAAO,WAAW,QAAQ,OAAO;GACjD;GAEA,OAAO,OAAO,OAAO;IACnB,WAAW,KAAK;IAChB,QAAQ,OAAO,OAAO,MAAM;IAC5B,QAAQ;IACR;IACA,eACE,iBAAiB,KAAA,KAAa,WAAmB,SAAS,OAAO,WAAW,YAAY;IAC1F,gBAAgB,UAAmB,cAAc,KAAK,CAAC,CAAC,KAAK,OAAO,SAAS,YAAY,CAAC;IAC1F;GACF,CAAC;EACH;EAEA,MAAM,WAAW,MAAM,cACrB,OAAO,IAAI,aAAa;GACtB,MAAM,UAAU,OAAO;GACvB,MAAM,SAAS,OAAO,UAAU;GAChC,MAAM,WAAW,OAAO,QAAQ;GAEhC,MAAM,UAAU,OAAO,gBAAgB;IACrC,UAAU;IACV,cAAc;IACd,cAAc,KAAA;GAChB,CAAC;GAED,IAAI,YAAY,KAAA,GACd,OAAO,OAAO,YAAY,8CAA8C;GAC1E,IAAI,KAAK,gBAAgB,YACvB,OAAO,OAAO,YAAY,yDAAyD;GACrF,IACE,SAAS,MACN,YACC,YAAY,KAAA,KACX,eAAe,WAAW,QAAQ,aAClC,QAAQ,SAAS,WAAW,CAAC,QAAQ,SAC1C,GAEA,OAAO,OAAO,YACZ,2EACF;GACF,IAAI,QAAQ,cAAc,KAAK,WAC7B,OAAO,OAAO,YACZ,kEACF;GACF,MAAM,cAAmC,CAAC;GAE1C,KAAK,MAAM,QAAQ,OAAO;IACxB,MAAM,QAAS,QAAQ,OAA2C;IAElE,IAAI,UAAU,KAAA,GAAW,OAAO,OAAO,YAAY,WAAW,KAAK,OAAO;IAC1E,MAAM,cAAc,QAAQ,SAAS,KAAK;IAC1C,MAAM,UAAU,YAAY;IAE5B,KAAK,MAAM,QAAQ,OAAO,KAAK,cAAc,KAAK,CAAC,OAAO,GACxD,IAAI,QAAQ,UAAU,KAAA,GACpB,OAAO,OAAO,YAAY,WAAW,KAAK,GAAG,KAAK,QAAQ;IAE9D,YAAY,KAAK;KAAE,OAAO;KAAa,UAAU,cAAc,KAAK,CAAC;IAAO,CAAC;GAC/E;GACA,YAAY,KAAK;IACf,OAAO,QAAQ,SAAS,QAAQ,SAAS,KAAU;IACnD,UAAU,CAAC,CAAC,QAAQ,SAAS,EAAE,CAAC;GAClC,CAAC;GACD,OAAO,qBAAqB,SAAS,WAAW;GAChD,MAAM,WAAW,OAAO,aAAa,OAAO;GAE5C,MAAM,eAAe,QAAQ,aAAa,QAAQ;GAClD,MAAM,iBAAiB,SAAS,SAAS,KAAK,QAAQ,KAAK,SAAS,QAAQ;GAC5E,MAAM,iBAAiB,SAAS,QAAQ,KAAK,QAAQ,KAAK,SAAS,QAAQ;GAE3E,MAAM,kBAAkB,OAAO,kCAC7B,cACA,cACF;GAEA,MAAM,EAAE,4BAA4B,OAAO,0CACzC,cACA,cACF;GAEA,MAAM,EAAE,0BAA0B,OAAO,wCACvC,cACA,cACF;GAEA,MAAM,EAAE,6BAA6B,OAAO,gCAAgC,cAAc;IACxF,GAAG;IACH,QAAQ;KACN,MAAM;KACN,SAAS,eAAe;KACxB,WAAW,eAAe;KAC1B,aAAa,EAAE,eAAe,yBAAyB;IACzD;GACF,CAAC;GAED,MAAM,EAAE,mBAAmB,OAAO,iCAChC,cACA,cACF;GAEA,IAAI,UAAkC,QAAQ,KAC5C,yBACA,uBACF,CAAC,CAAC,KACA,QAAQ,IACN,KAAK,SAAS,4BACd,gBAAgB,0BAClB,GACA,QAAQ,IAAI,KAAK,SAAS,mBAAmB,gBAAgB,iBAAiB,GAC9E,QAAQ,IAAI,KAAK,SAAS,uBAAuB,qBAAqB,GACtE,QAAQ,IAAI,KAAK,SAAS,0BAA0B,wBAAwB,GAC5E,QAAQ,IAAI,KAAK,SAAS,gBAAgB,cAAc,CAC1D;GAEA,MAAM,eAAe,SAAS,SAAS,OAAO,IAAI,KAAA;GAElD,IAAI,iBAAiB,KAAA,GAAW;IAC9B,MAAM,WAAW,OAAO,wBACtB,QAAQ,aAAa,QAAQ,GAC7B,YACF;IAEA,UAAU,QAAQ,IAAI,SAAS,kBAAkB,SAAS,gBAAgB;GAC5E;GAEA,IAAI,UAAU;IACZ,MAAM,UAAU,SAAS,UAAU;IAEnC,MAAM,WAAW,OAAO,2BACtB,QAAQ,aAAa,QAAQ,GAC7B,SACA,YACF;IAEA,UAAU,QAAQ,IAAI,SAAS,qBAAqB,SAAS,mBAAmB;GAClF;GACA,KAAK,MAAM,CAAC,MAAM,aAAa,OAAO,QAAQ,KAAK,UAAU,GAAG;IAC9D,IAAI,SAAS,aAAa,SAAS,cAAc,CAAC,SAAS,YAAY,YACrE;IACF,MAAM,MAAM,SAAS;IAErB,IAAI,QAAQ,KAAA,GACV,OAAO,OAAO,YAAY,oCAAoC,MAAM;IAEtE,MAAM,eAAe,OAAO,0BAC1B,QAAQ,aAAa,QAAQ,GAC7B,SAAS,UAAU,GACnB,iBACA,IACF;IAEA,UAAU,QAAQ,IAAI,SAAS,KAAK,YAAY;GAClD;GACA,IAAI,OACF,UAAU,QAAQ,IAChB,SACA,0BACC,OAAO,+BACN,QAAQ,aAAa,QAAQ,GAC7B,SAAS,OAAO,GAChB,YACF,EAAA,CAAG,uBACL;GAEF,IAAI,OACF,UAAU,QAAQ,IAChB,SACA,oBACA,OAAO,yBACL,QAAQ,aAAa,QAAQ,GAC7B,SACA,SAAS,OAAO,GAChB,SAAS,SAAS,YAAa,SAAS,SAAS,UAAU,CAAC,QAAQ,QAAQ,IAAI,CAAC,CAAE,CACrF,CACF;GAEF,IAAI,SAAS,SAAS,GAAG;IAEvB,MAAM,WAAW,oBACf;KACE;KACA,WAAW,KAAK;KAChB;KACA,UAAU;KACV,iBAAiB,SAAS,SAAS,YACjC,SAAS,SAAS,aAAa,CAAC,QAAQ,QAAQ,IAAI,CAAC,CACvD;IACF,GACA,QAAQ,aAAa,QAAQ,CAC/B;IAMA,UAAU,QAAQ,MAAM,SAAS,OAAO,QAAQ;GAClD;GAGA,OAAO;EACT,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,gBAAgB,KAAA,CAAS,GAC/C,uBACA,OAAO,UAAU,UACf,OAAO,GAAG,6BAA6B,CAAC,CAAC,KAAK,IAC1C,QACA,YAAY,gCAAgC,CAClD,CACF,CACF,CAAC,CAAC,KAAK,MAAM,QAAQ,UAAU,CAAC;EA4NhC,OAAO;GACL;GACA,cAAc;GACd,OA7NY,MAAM,cAClB,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,OAAO,OAAO;IAC5B,MAAM,WAAW,OAAO,OAAO,QAAyC;IACxE,MAAM,SAAS,QAAQ,IAAI,UAAU,UAAU,SAAS;IAMxD,MAAM,aAAa,OAAO,OAAO,OAC/B,MAAM,eAAe,UAAU,KAAK,CAAC,CAAC,KAAK,OAAO,WAAW,QAAQ,CAAC,CACxE;IAEA,MAAM,UAAU,OAAO,WAAW,WAChC,KACA,aACA,aAAa,MACiB;KAG9B,IAAI,YAAY;MACd,IAAI,OAAO,gBAAgB,OAAO,OAAO,OAAO,KAAK,YAAY,CAAC;MAClE,OAAO,kBAAkB,aAAa,OAAO,kBAAkB;KACjE;KACA,MAAM,WAAW,OAAO,WAAW,KAAK,OAAO,SAAS,WAAW,CAAC;KACpE,MAAM,QAAQ,QAAQ,eAAe,UAAU,GAAG;KAElD,OAAO,UAAU,KAAA,IAAY,OAAO,OAAO,KAAK,YAAY,CAAC,IAAI;IACnE,CAAC;IAED,MAAM,2BAA2B,mBAAmB,KAAK,CAAC,CAAC;IAC3D,MAAM,YAAY,QAAQ,yBAAyB,oBAAoB,KAAK;IAC5E,MAAM,oBAAoB,QAAQ,yBAAyB,kBAAkB;IAE7E,MAAM,WAAW,QACf,KAAK,SAAS,4BACd,oBACA,KACF;IAEA,MAAM,mBAAmB,QACvB,KAAK,SAAS,4BACd,kBACF;IAEA,MAAM,aAAa,QAAQ,KAAK,SAAS,mBAAmB,oBAAoB,KAAK;IACrF,MAAM,cAAc,QAAQ,KAAK,SAAS,uBAAuB,oBAAoB,KAAK;IAC1F,MAAM,kBAAkB,QAAQ,KAAK,SAAS,uBAAuB,kBAAkB;IAEvF,MAAM,aAAa,QACjB,KAAK,SAAS,0BACd,oBACA,KACF;IAEA,MAAM,iBAAiB,QAAQ,KAAK,SAAS,0BAA0B,kBAAkB;IACzF,MAAM,UAAU,QAAQ,KAAK,SAAS,gBAAgB,kBAAkB;IAExE,IAAI,UAAkC,QAAQ,KAAK,yBAAyB;KAC1E,UAAU,WAAW,kBACnB,OAAO,QAAQ,YAAY,MAAM,EAAE,QAAQ,WAAW,aAAa,CAAC;KACtE,eAAe,aAAa,OAAO,QAAQ,YAAY,MAAM,EAAE,aAAa,QAAQ,CAAC;KACrF,UAAU,OAAO,YACf,OAAO,QAAQ,oBAAoB,MAAM,EAAE,QAAQ,OAAO,OAAO,CAAC;IACtE,CAAC,CAAC,CAAC,KACD,QAAQ,IAAI,KAAK,SAAS,4BAA4B;KACpD,YAAY,OAAO,YACjB,OAAO,QAAQ,mBAAmB,MAAM,EAAE,UAAU,OAAO,OAAO,CAAC;KACrE,SAAS,UAAU,OAAO,QAAQ,WAAW,MAAM,EAAE,OAAO,KAAK,CAAC;KAClE,SAAS,OAAO,YACd,OAAO,QAAQ,mBAAmB,MAAM,EAAE,OAAO,OAAO,OAAO,CAAC;KAClE,eAAe,QAAQ,YACrB,OAAO,QAAQ,mBAAmB,MAAM,EAAE,aAAa,QAAQ,OAAO,CAAC;KACzE,SAAS,OAAO,YACd,OAAO,QAAQ,mBAAmB,MAAM,EAAE,OAAO,OAAO,OAAO,CAAC;KAClE,YAAY,OAAO,YACjB,OAAO,QAAQ,mBAAmB,MAAM,EAAE,UAAU,OAAO,OAAO,CAAC;IACvE,CAAC,GACD,QAAQ,IAAI,KAAK,SAAS,mBAAmB,EAC3C,OAAO,UAAU,OAAO,QAAQ,aAAa,MAAM,EAAE,KAAK,KAAK,CAAC,EAClE,CAAC,GACD,QAAQ,IAAI,KAAK,SAAS,uBAAuB;KAC/C,SAAS,OAAO,KAAK,YACnB,OAAO,QAAQ,kBAAkB,MAAM,EAAE,OAAO,OAAO,KAAK,OAAO,CAAC;KACtE,OAAO,UAAU,OAAO,QAAQ,cAAc,MAAM,EAAE,KAAK,KAAK,CAAC;KACjE,SAAS,OAAO,YACd,OAAO,QAAQ,kBAAkB,MAAM,EAAE,OAAO,OAAO,OAAO,CAAC;IACnE,CAAC,GACD,QAAQ,IAAI,KAAK,SAAS,0BAA0B;KAClD,SAAS,OAAO,KAAK,YACnB,OAAO,QAAQ,iBAAiB,MAAM,EAAE,OAAO,OAAO,KAAK,OAAO,CAAC;KACrE,OAAO,UAAU,OAAO,QAAQ,aAAa,MAAM,EAAE,KAAK,KAAK,CAAC;KAChE,SAAS,OAAO,YACd,OAAO,QAAQ,iBAAiB,MAAM,EAAE,OAAO,OAAO,OAAO,CAAC;KAChE,WAAW,MAAM,YACf,OAAO,QAAQ,iBAAiB,MAAM,EAAE,SAAS,MAAM,OAAO,CAAC;IACnE,CAAC,GACD,QAAQ,IAAI,KAAK,SAAS,gBAAgB,EACxC,UAAU,UAAU,OAAO,QAAQ,UAAU,MAAM,EAAE,QAAQ,KAAK,CAAC,EACrE,CAAC,CACH;IAEA,IAAI,QAAQ;KACV,MAAM,cAAc,QAAQ,wBAAwB,iBAAiB,KAAK,CAAC,CAAC,CAAC;KAE7E,UAAU,QAAQ,IAAI,SAAS,kBAAkB;MAC/C,QAAQ,OAAO,YAAY,OAAO,QAAQ,cAAc,MAAM,EAAE,MAAM,OAAO,OAAO,CAAC;MACrF,SAAS,OAAO,YACd,OAAO,QAAQ,cAAc,MAAM,EAAE,OAAO,OAAO,OAAO,CAAC;MAC7D,SAAS,OAAO,YACd,OAAO,QAAQ,cAAc,MAAM,EAAE,OAAO,OAAO,OAAO,CAAC;MAC7D,UAAU,OAAO,YACf,OAAO,QAAQ,cAAc,MAAM,EAAE,QAAQ,OAAO,OAAO,CAAC;KAChE,CAAC;IACH;IACA,IAAI,UAAU;KACZ,MAAM,cAAc,QAAQ,2BAA2B,oBAAoB,KAAK,CAAC,CAAC,CAAC;KAEnF,UAAU,QAAQ,IAAI,SAAS,qBAAqB;MAClD,iBAAiB,UAAU,OAAO,QAAQ,cAAc,MAAM,EAAE,eAAe,KAAK,CAAC;MACrF,kBAAkB,UAChB,OAAO,QAAQ,cAAc,MAAM,EAAE,gBAAgB,KAAK,CAAC;MAC7D,iBAAiB,UAAU,OAAO,QAAQ,cAAc,MAAM,EAAE,eAAe,KAAK,CAAC;MACrF,iBAAiB,UAAU,OAAO,QAAQ,cAAc,MAAM,EAAE,eAAe,KAAK,CAAC;MACrF,cAAc,OAAO,YACnB,OAAO,QAAQ,cAAc,MAAM,EAAE,YAAY,OAAO,OAAO,CAAC;MAClE,mBAAmB,OAAO,YACxB,OAAO,QAAQ,cAAc,MAAM,EAAE,iBAAiB,OAAO,OAAO,CAAC;MACvE,iBAAiB,OAAO,YACtB,OAAO,QAAQ,cAAc,MAAM,EAAE,eAAe,OAAO,OAAO,CAAC;KACvE,CAAC;IACH;IACA,KAAK,MAAM,CAAC,MAAM,aAAa,OAAO,QAAQ,KAAK,UAAU,GAAG;KAC9D,IAAI,SAAS,aAAa,SAAS,cAAc,CAAC,SAAS,YAAY,YACrE;KACF,MAAM,MAAM,SAAS;KAErB,IAAI,QAAQ,KAAA,GACV,OAAO,OAAO,YAAY,oCAAoC,MAAM;KAItE,MAAM,eAAe,QACnB,WACM,oBAAoB,KAAK,CAAC,CAAC,CACnC;KAEA,UAAU,QAAQ,IAAI,SAAS,KAAK,EAClC,WAAW,OAAO,YAChB,OAAO,QAAQ,eAAe,MAAM,EAAE,SAAS,OAAO,OAAO,CAAC,EAClE,CAAkD;IACpD;IACA,IAAI,OAAO;KACT,MAAM,cAAc,QAAQ,+BAA+B,iBAAiB,KAAK,CAAC,CAAC,CAAC;KAEpF,UAAU,QAAQ,IAAI,SAAS,yBAAyB;MACtD,SAAS,UAAU,OAAO,QAAQ,cAAc,MAAM,EAAE,OAAO,KAAK,CAAC;MACrE,kBAAkB,OAAO,YACvB,OAAO,QAAQ,cAAc,MAAM,EAAE,gBAAgB,OAAO,OAAO,CAAC;MACtE,kBAAkB,OAAO,YACvB,OAAO,QAAQ,cAAc,MAAM,EAAE,gBAAgB,OAAO,OAAO,CAAC;KACxE,CAAC;IACH;IACA,IAAI,OAAO;KACT,MAAM,oBAAoB,oBAAoB,KAAK,CAAC,CAAC;KACrD,MAAM,UAAU,QAAQ,oBAAoB,WAAW;KAEvD,UAAU,QAAQ,KAChB,QAAQ,IAAI,oBAAoB,EAC9B,SAAS,UAAU,OAAO,QAAQ,UAAU,MAAM,EAAE,OAAO,KAAK,CAAC,EACnE,CAAC,CACH;IACF;IACA,IAAI,SAAS,SAAS,GAAG;KACvB,MAAM,oBAAoB,mBAAmB,KAAK,CAAC,CAAC;KACpD,MAAM,cAAc,QAAQ,oBAAoB,WAAW;KAC3D,MAAM,cAAc,QAAQ,oBAAoB,WAAW;KAE3D,UAAU,QAAQ,KAChB,QAAQ,IAAI,oBAAoB;MAC9B,SAAS,UAAU,OAAO,QAAQ,cAAc,MAAM,EAAE,OAAO,KAAK,CAAC;MACrE,iBAAiB,UACf,OAAO,QAAQ,cAAc,MAAM,EAAE,eAAe,KAAK,CAAC;KAC9D,CAAC,GACD,QAAQ,IAAI,oBAAoB;MAC9B,QAAQ,OAAO,YACb,OAAO,QAAQ,cAAc,MAAM,EAAE,MAAM,OAAO,OAAO,CAAC;MAC5D,UAAU,UAAU,OAAO,QAAQ,cAAc,MAAM,EAAE,QAAQ,KAAK,CAAC;MACvE,UAAU,OAAO,YACf,OAAO,QAAQ,cAAc,MAAM,EAAE,QAAQ,OAAO,OAAO,CAAC;MAC9D,UAAU,OAAO,YACf,OAAO,QAAQ,cAAc,MAAM,EAAE,QAAQ,OAAO,OAAO,CAAC;KAChE,CAAC,CACH;KACA,IAAI,SAAS,MAAM,YAAY,QAAQ,UAAU,GAAG;MAClD,MAAM,UAAU,QAAQ,8BAA8B,WAAW;MAEjE,UAAU,QAAQ,KAChB,QAAQ,IAAI,8BAA8B;OACxC,OAAO,UAAU,OAAO,QAAQ,UAAU,MAAM,EAAE,KAAK,KAAK,CAAC;OAC7D,qBAAqB,OAAO,YAC1B,OAAO,QAAQ,UAAU,MAAM,EAAE,mBAAmB,OAAO,OAAO,CAAC;OACrE,gBAAgB,UAAU,OAAO,QAAQ,UAAU,MAAM,EAAE,cAAc,KAAK,CAAC;OAC/E,SAAS,OAAO,YACd,OAAO,QAAQ,UAAU,MAAM,EAAE,OAAO,OAAO,OAAO,CAAC;OACzD,SAAS,OAAO,YACd,OAAO,QAAQ,UAAU,MAAM,EAAE,OAAO,OAAO,OAAO,CAAC;MAC3D,CAAC,CACH;KACF;IACF;IAGA,OAAO;GACT,CAAC,CAMG;GACJ,UAA+B,YAQzB,OAAO,SAAS,IAAI;GAC1B,MAA2B,YAOrB,OAAO,SAAS,KAAK;EAC7B;CACF;CAEA,OAAO,EAAE,KAAK;AAChB"}