@yielded/auth-persistence 0.1.0-beta.24 → 0.1.0-beta.26

package/dist/internal/storage-mapping.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"storage-mapping.mjs","names":["ProofRecord"],"sources":["../../src/internal/storage-mapping.ts"],"sourcesContent":["import { EmailCredentialSnapshot } from \"@yielded/auth/Email\";\nimport { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport {\n  PasswordCredentialSnapshot,\n  EncodedPasswordHash,\n  type PasswordReplacement,\n} from \"@yielded/auth/Password\";\nimport {\n  ProofBinding,\n  ProofContinuationId,\n  ProofDeliveryId,\n  ProofId,\n  ProofPurpose,\n  ProofRequestId,\n  ProofRequestReceipt,\n  ProofVersion,\n} from \"@yielded/auth/Proofs\";\nimport { TokenDigest } from \"@yielded/auth/Schema\";\nimport {\n  SecurityRevision,\n  SessionId,\n  SessionMetadata,\n  SessionAuthenticationProvenance,\n  SessionCredentialVersion,\n  type StatefulSessionRecord,\n} from \"@yielded/auth/Sessions\";\nimport { Crypto, DateTime, Effect, Redacted, Schema } from \"effect\";\n\nimport type { MappingInput } from \"./configuration\";\nimport { randomId } from \"./crypto\";\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport { requiredEmailAddressConstraints, type AnyEmailAddressMapping } from \"./models/email-model\";\nimport {\n  requiredPasswordConstraints,\n  type AnyPasswordPersistenceMapping,\n} from \"./models/password-model\";\nimport { requiredProofConstraints, type AnyProofPersistenceMapping } from \"./models/proof-model\";\nimport type { StatefulSessionMapping } from \"./models/session-model\";\nimport type { TableModel, SqlFragment } from \"./query-operations\";\nimport { storageTables, type StorageRole } from \"./storage-tables\";\n\nconst failure = (cause: unknown) => PersistenceMappingError.make({ operation: \"decode\", cause });\n\nconst decode = <S extends Schema.Codec<unknown, unknown>>(schema: S, value: unknown) =>\n  Schema.decodeUnknownEffect(schema)(value).pipe(Effect.mapError(failure));\n\nconst string = (value: unknown) => Schema.decodeUnknownSync(Schema.String)(value);\nconst tuple = Schema.encodeSync(Schema.fromJsonString(Schema.Array(Schema.String)));\nconst bindingJson = Schema.fromJsonString(ProofBinding);\nconst receiptJson = Schema.fromJsonString(ProofRequestReceipt);\n\nconst ProofRecord = Schema.Struct({\n  moduleId: Schema.String,\n  purpose: ProofPurpose,\n  proofId: ProofId,\n  requestId: ProofRequestId,\n  fingerprint: TokenDigest,\n  deliveryId: ProofDeliveryId,\n  binding: ProofBinding,\n  verifier: Schema.Struct({ keyId: Schema.String, digest: TokenDigest }),\n  issuedAtMillis: Schema.Int,\n  expiresAtMillis: Schema.Int,\n  version: ProofVersion,\n});\n\nconst ProofContinuation = Schema.Struct({\n  moduleId: Schema.String,\n  purpose: ProofPurpose,\n  continuationId: ProofContinuationId,\n  digest: TokenDigest,\n  proofId: ProofId,\n  seriesKey: Schema.String,\n  binding: ProofBinding,\n  expiresAtMillis: Schema.Int,\n  version: ProofVersion,\n});\n\n/** Derive shared row mappings from a managed or custom storage layout.\n * Acquire Effect Crypto once; the returned allocators retain that implementation.\n * Each factory requires its role tables to exist. Adapter authors supply typed\n * table handles and dialect-specific clocks/commit predicates, and may refine\n * authority policy for explicit services. This does not alter composed defaults.\n */\nexport const makeMappings = Effect.fnUntraced(function* (input: MappingInput) {\n  const crypto = yield* Crypto.Crypto;\n\n  const allocate = randomId.pipe(\n    Effect.provideService(Crypto.Crypto, crypto),\n    Effect.mapError(failure),\n  );\n\n  const table = (role: StorageRole) => {\n    const found = input.tables[role];\n\n    if (found === undefined) throw failure(`Missing ${role} mapping`);\n\n    return found;\n  };\n\n  const mapped = (role: StorageRole) => ({\n    table: table(role),\n    ...Object.fromEntries(Object.keys(storageTables[role].columns).map((key) => [key, key])),\n  });\n\n  const { subjects: s, encodeInstant: instant, decodeInstant: readInstant } = input;\n  const subjectId = { toNative: s.toNative, toSubject: s.toSubject, equals: Object.is };\n\n  const subject = {\n    table: s.table,\n    id: s.id,\n    status: s.status,\n    securityRevision: s.securityRevision,\n    isActiveStatus: (value: unknown) => Object.is(value, s.activeValue),\n    d1ActiveStatusValue: s.activeValue,\n    decodeRequirement: s.requirements,\n    decodeActionRequirement: s.actionRequirements,\n    nextSecurityRevision: () => allocate.pipe(Effect.map(SecurityRevision.make)),\n  };\n\n  const authorityCredential = () => ({\n    ...mapped(\"credentials\"),\n    subjectId: \"subjectId\",\n    credentialId: \"credentialId\",\n    revision: \"revision\",\n    status: \"active\",\n    isActiveStatus: (value: unknown) => value === true,\n    encodeInsert: (row: object) => ({ ...row, active: true }),\n    encodeRevision: (revision: SecurityRevision) => ({ revision }),\n  });\n\n  const authority = () => ({ subjectId, subject, credential: authorityCredential() });\n\n  const proofs = (): AnyProofPersistenceMapping<SqlFragment> => ({\n    constraints: requiredProofConstraints,\n    encodeInstant: instant,\n    decodeInstant: readInstant,\n    allocateVersion: allocate.pipe(Effect.map(ProofVersion.make)),\n    isRequestConflict: () => false,\n    isSeriesConflict: () => false,\n    isCommandConflict: () => false,\n    scopeKeys: ({ binding }) => ({\n      series: tuple([\n        binding.identifier.namespace,\n        binding.identifier.value,\n        binding._tag === \"Identifier\" ? \"anonymous\" : binding.revision.subjectId,\n      ]),\n      identifier: tuple([binding.identifier.namespace, binding.identifier.value]),\n      subject: binding._tag === \"Identifier\" ? \"anonymous\" : binding.revision.subjectId,\n    }),\n    authority: {\n      ...authority(),\n      identifier: {\n        table: table(\"identifiers\"),\n        namespace: \"namespace\",\n        value: \"value\",\n        isCurrent: (request, rows) =>\n          request.binding._tag === \"Identifier\"\n            ? rows.length === 0\n            : request.binding._tag === \"IdentifierChange\"\n              ? rows.length === 0 ||\n                (rows.length === 1 &&\n                  rows.every(\n                    (row) =>\n                      Object.is(row.subjectId, request.nativeSubjectId) &&\n                      row.active === true &&\n                      row.verifiedAt === null,\n                  ))\n              : rows.length === 1 &&\n                rows.every(\n                  (row) => Object.is(row.subjectId, request.nativeSubjectId) && row.active === true,\n                ),\n      },\n    },\n    request: {\n      ...mapped(\"proofRequests\"),\n      moduleId: \"moduleId\",\n      requestId: \"requestId\",\n      fingerprint: \"fingerprint\",\n      proofId: \"proofId\",\n      purpose: \"purpose\",\n      keyId: \"keyId\",\n      createdAt: \"createdAt\",\n      retentionUntil: \"retentionUntil\",\n      encodeInsert: ({ record, retentionUntilMillis }) => ({\n        moduleId: record.moduleId,\n        requestId: record.requestId,\n        fingerprint: record.fingerprint,\n        proofId: record.proofId,\n        purpose: record.purpose,\n        keyId: record.verifier.keyId,\n        createdAt: instant(record.issuedAtMillis),\n        retentionUntil: instant(retentionUntilMillis),\n        receipt: Schema.encodeSync(receiptJson)({\n          requestId: record.requestId,\n          reference: {\n            proofId: record.proofId,\n            purpose: record.purpose,\n            keyId: record.verifier.keyId,\n          },\n        }),\n      }),\n      decodeReceipt: (row) => decode(receiptJson, row.receipt),\n    },\n    series: {\n      ...mapped(\"proofSeries\"),\n      moduleId: \"moduleId\",\n      purpose: \"purpose\",\n      scopeKey: \"scopeKey\",\n      activeProofId: \"activeProofId\",\n      lastIssueAt: \"lastIssueAt\",\n      version: \"version\",\n      encodeInsert: (row) => ({ ...row, activeProofId: null, lastIssueAt: null }),\n    },\n    generation: {\n      ...mapped(\"proofGenerations\"),\n      moduleId: \"moduleId\",\n      purpose: \"purpose\",\n      proofId: \"proofId\",\n      requestId: \"requestId\",\n      seriesKey: \"seriesKey\",\n      deliveryId: \"deliveryId\",\n      binding: \"binding\",\n      verifierKeyId: \"verifierKeyId\",\n      verifierDigest: \"verifierDigest\",\n      issuedAt: \"issuedAt\",\n      expiresAt: \"expiresAt\",\n      version: \"version\",\n      state: \"state\",\n      sendCount: \"sendCount\",\n      deliveryState: \"deliveryState\",\n      claimVersion: \"claimVersion\",\n      claimDeadline: \"claimDeadline\",\n      retryAt: \"retryAt\",\n      deliveryRetryMillis: \"deliveryRetryMillis\",\n      retentionUntil: \"retentionUntil\",\n      encodeInsert: ({\n        record,\n        seriesKey,\n        retentionUntilMillis,\n        state,\n        deliveryState,\n        policy,\n      }) => ({\n        moduleId: record.moduleId,\n        purpose: record.purpose,\n        proofId: record.proofId,\n        requestId: record.requestId,\n        seriesKey,\n        deliveryId: record.deliveryId,\n        binding: Schema.encodeSync(bindingJson)(record.binding),\n        verifierKeyId: record.verifier.keyId,\n        verifierDigest: record.verifier.digest,\n        issuedAt: instant(record.issuedAtMillis),\n        expiresAt: instant(record.expiresAtMillis),\n        version: record.version,\n        state,\n        sendCount: 0,\n        deliveryState,\n        claimVersion: null,\n        claimDeadline: null,\n        retryAt: null,\n        deliveryRetryMillis: policy.deliveryRetryMillis,\n        retentionUntil: instant(retentionUntilMillis),\n        fingerprint: record.fingerprint,\n      }),\n      decodeBinding: (row) => decode(bindingJson, row.binding),\n      decodeRecord: (row) =>\n        Effect.gen(function* () {\n          return yield* decode(ProofRecord, {\n            moduleId: row.moduleId,\n            purpose: row.purpose,\n            proofId: row.proofId,\n            requestId: row.requestId,\n            fingerprint: row.fingerprint,\n            deliveryId: row.deliveryId,\n            binding: yield* decode(bindingJson, row.binding),\n            verifier: { keyId: row.verifierKeyId, digest: row.verifierDigest },\n            issuedAtMillis: yield* readInstant(row.issuedAt),\n            expiresAtMillis: yield* readInstant(row.expiresAt),\n            version: row.version,\n          });\n        }),\n    },\n    continuation: {\n      ...mapped(\"proofContinuations\"),\n      moduleId: \"moduleId\",\n      purpose: \"purpose\",\n      continuationId: \"continuationId\",\n      digest: \"digest\",\n      proofId: \"proofId\",\n      seriesKey: \"seriesKey\",\n      binding: \"binding\",\n      expiresAt: \"expiresAt\",\n      consumed: \"consumed\",\n      version: \"version\",\n      retentionUntil: \"retentionUntil\",\n      encodeInsert: (record) => ({\n        ...record,\n        binding: Schema.encodeSync(bindingJson)(record.binding),\n        expiresAt: instant(record.expiresAtMillis),\n        consumed: false,\n        retentionUntil: instant(record.retentionUntilMillis),\n      }),\n      decode: (row) =>\n        Effect.gen(function* () {\n          return yield* decode(ProofContinuation, {\n            ...row,\n            binding: yield* decode(bindingJson, row.binding),\n            expiresAtMillis: yield* readInstant(row.expiresAt),\n          });\n        }),\n    },\n    rateScope: {\n      ...mapped(\"proofScopes\"),\n      moduleId: \"moduleId\",\n      purpose: \"purpose\",\n      action: \"action\",\n      scopeKind: \"scopeKind\",\n      scopeKey: \"scopeKey\",\n      encodeInsert: (row) => ({ ...row }),\n    },\n    abuseEvent: {\n      ...mapped(\"proofAbuse\"),\n      moduleId: \"moduleId\",\n      purpose: \"purpose\",\n      action: \"action\",\n      scopeKind: \"scopeKind\",\n      scopeKey: \"scopeKey\",\n      commandId: \"commandId\",\n      occurredAt: \"occurredAt\",\n      retentionUntil: \"retentionUntil\",\n      encodeInsert: (row) => ({\n        ...row,\n        occurredAt: instant(row.occurredAtMillis),\n        retentionUntil: instant(row.retentionUntilMillis),\n      }),\n    },\n    failureEvent: {\n      ...mapped(\"proofFailures\"),\n      moduleId: \"moduleId\",\n      purpose: \"purpose\",\n      seriesKey: \"seriesKey\",\n      commandId: \"commandId\",\n      occurredAt: \"occurredAt\",\n      retentionUntil: \"retentionUntil\",\n      encodeInsert: (row) => ({\n        ...row,\n        occurredAt: instant(row.occurredAtMillis),\n        retentionUntil: instant(row.retentionUntilMillis),\n      }),\n    },\n    command: {\n      ...mapped(\"proofCommands\"),\n      moduleId: \"moduleId\",\n      commandId: \"commandId\",\n      kind: \"kind\",\n      decision: \"decision\",\n      retentionUntil: \"retentionUntil\",\n      encodeInsert: (row) => ({ ...row, retentionUntil: instant(row.retentionUntilMillis) }),\n    },\n  });\n\n  const passwords = (): AnyPasswordPersistenceMapping<SqlFragment> => {\n    const verifier = (replacement: PasswordReplacement) => ({\n      verifier: Redacted.value(replacement.verifier),\n      normalization: replacement.normalization,\n    });\n\n    return {\n      subjectId,\n      subject,\n      authorityCredential: authorityCredential(),\n      constraints: requiredPasswordConstraints,\n      isCommandConflict: () => false,\n      encodeInstant: instant,\n      decodeInstant: readInstant,\n      allocateCredentialId: allocate,\n      allocateRevision: allocate.pipe(Effect.map(SecurityRevision.make)),\n      commandRetentionMillis: 86_400_000,\n      sessionInvalidation: \"same-authority-immediate\",\n      identifier: {\n        table: table(\"identifiers\"),\n        namespace: \"namespace\",\n        value: \"value\",\n        subjectId: \"subjectId\",\n        verifiedAt: \"verifiedAt\",\n        bindingRevision: \"revision\",\n        isCurrent: (row) => row.active === true,\n        encodeInitialInsert: (identifier, subjectId, revision) => ({\n          ...identifier,\n          subjectId,\n          revision,\n          verifiedAt: null,\n          active: true,\n        }),\n      },\n      credential: {\n        ...mapped(\"passwords\"),\n        moduleId: \"moduleId\",\n        subjectId: \"subjectId\",\n        credentialId: \"credentialId\",\n        credentialRevision: \"credentialRevision\",\n        verifierVersion: \"verifierVersion\",\n        verifier: \"verifier\",\n        normalization: \"normalization\",\n        encodeInsert: ({ replacement, ...row }) => ({ ...row, ...verifier(replacement) }),\n        encodeVerifier: (hash, verifierVersion) => ({\n          verifier: Redacted.value(hash),\n          verifierVersion,\n        }),\n        encodeReplacement: ({ replacement, ...row }) => ({ ...row, ...verifier(replacement) }),\n        decode: ({ moduleId, subject: row, identifier, credential }) =>\n          Effect.gen(function* () {\n            const id = yield* s.toSubject(row[s.id]);\n            const hash = yield* decode(EncodedPasswordHash, credential.verifier);\n\n            return yield* decode(PasswordCredentialSnapshot, {\n              moduleId,\n              revision: {\n                subjectId: id,\n                securityRevision: row[s.securityRevision],\n                credentials: [\n                  {\n                    credentialId: credential.credentialId,\n                    revision: credential.credentialRevision,\n                  },\n                ],\n              },\n              credentialId: credential.credentialId,\n              credentialRevision: credential.credentialRevision,\n              verifierVersion: credential.verifierVersion,\n              verifier: hash,\n              normalization: credential.normalization,\n              identifier: yield* decode(LoginIdentifier, {\n                namespace: identifier.namespace,\n                value: identifier.value,\n              }),\n              identifierBindingRevision: identifier.revision,\n              ...(identifier.verifiedAt === null\n                ? {}\n                : { identifierVerifiedAtMillis: yield* readInstant(identifier.verifiedAt) }),\n            });\n          }),\n      },\n      command: {\n        ...mapped(\"passwordCommands\"),\n        moduleId: \"moduleId\",\n        commandId: \"commandId\",\n        action: \"action\",\n        bindingDigest: \"bindingDigest\",\n        decision: \"decision\",\n        retentionUntil: \"retentionUntil\",\n        encodeInsert: (row) => ({ ...row, retentionUntil: instant(row.retentionUntilMillis) }),\n      },\n    };\n  };\n\n  const emails = (): AnyEmailAddressMapping<SqlFragment> => ({\n    subjectId,\n    subject,\n    constraints: requiredEmailAddressConstraints,\n    addressCardinality: \"single\",\n    changeDisposition: \"retire-source\",\n    encodeInstant: instant,\n    decodeInstant: readInstant,\n    allocateCredentialId: allocate,\n    allocateRevision: allocate.pipe(Effect.map(SecurityRevision.make)),\n    commandRetentionMillis: 86_400_000,\n    sessionInvalidation: \"same-authority-immediate\",\n    isCommandConflict: () => false,\n    isIdentifierConflict: () => false,\n    isCredentialConflict: () => false,\n    authorityCredential: {\n      ...authorityCredential(),\n      encodeActivation: (revision) => ({ revision, active: true }),\n      encodeRetirement: (revision) => ({ revision, active: false }),\n    },\n    identifier: {\n      table: table(\"identifiers\"),\n      namespace: \"namespace\",\n      value: \"value\",\n      subjectId: \"subjectId\",\n      verifiedAt: \"verifiedAt\",\n      bindingRevision: \"revision\",\n      isCurrent: (row) => row.active === true && row.verifiedAt !== null,\n      isMutableTarget: (row) => row.active === true && row.verifiedAt === null,\n      encodeVerifiedInsert: ({ identifier, subjectId, verifiedAtMillis, bindingRevision }) => ({\n        ...identifier,\n        subjectId,\n        verifiedAt: instant(verifiedAtMillis),\n        revision: bindingRevision,\n        active: true,\n      }),\n      encodeVerification: ({ verifiedAtMillis, bindingRevision }) => ({\n        verifiedAt: instant(verifiedAtMillis),\n        revision: bindingRevision,\n        active: true,\n      }),\n      encodeRetirement: ({ bindingRevision }) => ({ revision: bindingRevision, active: false }),\n    },\n    credential: {\n      table: table(\"emailCredentials\"),\n      moduleId: \"moduleId\",\n      subjectId: \"subjectId\",\n      credentialId: \"credentialId\",\n      identifierNamespace: \"identifierNamespace\",\n      identifierValue: \"identifierValue\",\n      credentialRevision: \"credentialRevision\",\n      status: \"active\",\n      isActiveStatus: (value) => value === true,\n      encodeVerifiedInsert: ({ identifier, ...row }) => ({\n        ...row,\n        identifierNamespace: identifier.namespace,\n        identifierValue: identifier.value,\n        active: true,\n      }),\n      encodeActivation: ({ identifier, credentialRevision }) => ({\n        identifierNamespace: identifier.namespace,\n        identifierValue: identifier.value,\n        credentialRevision,\n        active: true,\n      }),\n      encodeRetirement: ({ credentialRevision }) => ({ credentialRevision, active: false }),\n      decode: ({ moduleId, subject: row, identifier, credential }) =>\n        Effect.gen(function* () {\n          return yield* decode(EmailCredentialSnapshot, {\n            moduleId,\n            identifier: { namespace: identifier.namespace, value: identifier.value },\n            identifierRevision: identifier.revision,\n            verifiedAtMillis: yield* readInstant(identifier.verifiedAt),\n            credentialId: credential.credentialId,\n            credentialRevision: credential.credentialRevision,\n            revision: {\n              subjectId: yield* s.toSubject(row[s.id]),\n              securityRevision: row[s.securityRevision],\n              credentials: [\n                { credentialId: credential.credentialId, revision: credential.credentialRevision },\n              ],\n            },\n          });\n        }),\n    },\n    command: {\n      table: table(\"emailCommands\"),\n      moduleId: \"moduleId\",\n      commandId: \"commandId\",\n      action: \"action\",\n      bindingDigest: \"bindingDigest\",\n      retentionUntil: \"retentionUntil\",\n      encodeInsert: ({ retentionUntilMillis, ...row }) => ({\n        ...row,\n        retentionUntil: instant(retentionUntilMillis),\n      }),\n    },\n  });\n\n  const sessions = <C extends Schema.Codec<unknown, unknown, never, never>>(\n    claims: C,\n  ): StatefulSessionMapping<\n    C[\"Type\"],\n    TableModel,\n    TableModel,\n    TableModel,\n    TableModel,\n    TableModel,\n    unknown,\n    string\n  > => {\n    const record = Schema.fromJsonString(\n      Schema.Struct({\n        ...SessionMetadata.fields,\n        claims: Schema.Unknown,\n        digest: TokenDigest,\n        version: SecurityRevision,\n        provenance: SessionAuthenticationProvenance,\n        credentialVersion: SessionCredentialVersion,\n      }),\n    );\n\n    const encodeRow = (value: StatefulSessionRecord<C[\"Type\"]>) => ({\n      digest: value.digest,\n      version: value.version,\n      securityRevision: value.securityRevision,\n      issuedAt: instant(DateTime.toEpochMillis(value.issuedAt)),\n      expiresAt: instant(DateTime.toEpochMillis(value.expiresAt)),\n      absoluteExpiresAt: instant(DateTime.toEpochMillis(value.absoluteExpiresAt)),\n      record: Schema.encodeSync(record)({\n        ...value,\n        claims: Schema.encodeSync(claims)(value.claims),\n      }),\n    });\n\n    return {\n      ...authority(),\n      isConstraintConflict: () => false,\n      constraints: { sessionDigest: \"unique(session.digest)\", flowId: \"unique(flow.flowId)\" },\n      sessionId: {\n        toNative: (id) => Effect.succeed(id),\n        toSession: (id) => decode(SessionId, id),\n        equals: Object.is,\n      },\n      flow: {\n        table: table(\"sessionFlows\"),\n        flowId: \"flowId\",\n        subjectId: \"subjectId\",\n        state: \"state\",\n        pendingDigest: \"pendingDigest\",\n        dedupUntil: \"dedupUntil\",\n        pendingStateValue: \"pending\",\n        establishedStateValue: \"established\",\n        encodeInstant: (date) => instant(DateTime.toEpochMillis(date)),\n        decodeInstant: (value) => readInstant(value).pipe(Effect.map(DateTime.makeUnsafe)),\n        encodePendingInsert: (row) => ({\n          flowId: row.evidence.flowId,\n          subjectId: row.subjectId,\n          state: \"pending\",\n          pendingDigest: row.pendingDigest,\n          dedupUntil: instant(DateTime.toEpochMillis(row.dedupUntil)),\n        }),\n        encodeEstablishedInsert: (row) => ({\n          flowId: row.evidence.flowId,\n          subjectId: row.subjectId,\n          state: \"established\",\n          pendingDigest: null,\n          dedupUntil: instant(DateTime.toEpochMillis(row.dedupUntil)),\n        }),\n      },\n      session: {\n        table: table(\"sessions\"),\n        sessionId: \"sessionId\",\n        subjectId: \"subjectId\",\n        digest: \"digest\",\n        version: \"version\",\n        securityRevision: \"securityRevision\",\n        issuedAt: \"issuedAt\",\n        expiresAt: \"expiresAt\",\n        absoluteExpiresAt: \"absoluteExpiresAt\",\n        encodeInstant: (date) => instant(DateTime.toEpochMillis(date)),\n        allocateId: allocate,\n        allocateVersion: allocate.pipe(Effect.map(SecurityRevision.make)),\n        encodeInsert: (value, ids) => ({ ...encodeRow(value), ...ids }),\n        encodeRotation: encodeRow,\n        decode: (row) =>\n          Effect.gen(function* () {\n            const saved = yield* decode(record, row.record);\n            const decodedClaims = yield* decode(claims, saved.claims);\n\n            return { ...saved, claims: decodedClaims };\n          }),\n      },\n    };\n  };\n\n  return { table, authority, proofs, passwords, emails, sessions, string };\n});\n"],"mappings":";;;;;;;;;;;;;;AAyCA,MAAM,WAAW,UAAmB,wBAAwB,KAAK;CAAE,WAAW;CAAU;AAAM,CAAC;AAE/F,MAAM,UAAoD,QAAW,UACnE,OAAO,oBAAoB,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,OAAO,SAAS,OAAO,CAAC;AAEzE,MAAM,UAAU,UAAmB,OAAO,kBAAkB,OAAO,MAAM,CAAC,CAAC,KAAK;AAChF,MAAM,QAAQ,OAAO,WAAW,OAAO,eAAe,OAAO,MAAM,OAAO,MAAM,CAAC,CAAC;AAClF,MAAM,cAAc,OAAO,eAAe,YAAY;AACtD,MAAM,cAAc,OAAO,eAAe,mBAAmB;AAE7D,MAAMA,gBAAc,OAAO,OAAO;CAChC,UAAU,OAAO;CACjB,SAAS;CACT,SAAS;CACT,WAAW;CACX,aAAa;CACb,YAAY;CACZ,SAAS;CACT,UAAU,OAAO,OAAO;EAAE,OAAO,OAAO;EAAQ,QAAQ;CAAY,CAAC;CACrE,gBAAgB,OAAO;CACvB,iBAAiB,OAAO;CACxB,SAAS;AACX,CAAC;AAED,MAAM,oBAAoB,OAAO,OAAO;CACtC,UAAU,OAAO;CACjB,SAAS;CACT,gBAAgB;CAChB,QAAQ;CACR,SAAS;CACT,WAAW,OAAO;CAClB,SAAS;CACT,iBAAiB,OAAO;CACxB,SAAS;AACX,CAAC;;;;;;;AAQD,MAAa,eAAe,OAAO,WAAW,WAAW,OAAqB;CAC5E,MAAM,SAAS,OAAO,OAAO;CAE7B,MAAM,WAAW,SAAS,KACxB,OAAO,eAAe,OAAO,QAAQ,MAAM,GAC3C,OAAO,SAAS,OAAO,CACzB;CAEA,MAAM,SAAS,SAAsB;EACnC,MAAM,QAAQ,MAAM,OAAO;EAE3B,IAAI,UAAU,KAAA,GAAW,MAAM,QAAQ,WAAW,KAAK,SAAS;EAEhE,OAAO;CACT;CAEA,MAAM,UAAU,UAAuB;EACrC,OAAO,MAAM,IAAI;EACjB,GAAG,OAAO,YAAY,OAAO,KAAK,cAAc,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC;CACzF;CAEA,MAAM,EAAE,UAAU,GAAG,eAAe,SAAS,eAAe,gBAAgB;CAC5E,MAAM,YAAY;EAAE,UAAU,EAAE;EAAU,WAAW,EAAE;EAAW,QAAQ,OAAO;CAAG;CAEpF,MAAM,UAAU;EACd,OAAO,EAAE;EACT,IAAI,EAAE;EACN,QAAQ,EAAE;EACV,kBAAkB,EAAE;EACpB,iBAAiB,UAAmB,OAAO,GAAG,OAAO,EAAE,WAAW;EAClE,qBAAqB,EAAE;EACvB,mBAAmB,EAAE;EACrB,yBAAyB,EAAE;EAC3B,4BAA4B,SAAS,KAAK,OAAO,IAAI,iBAAiB,IAAI,CAAC;CAC7E;CAEA,MAAM,6BAA6B;EACjC,GAAG,OAAO,aAAa;EACvB,WAAW;EACX,cAAc;EACd,UAAU;EACV,QAAQ;EACR,iBAAiB,UAAmB,UAAU;EAC9C,eAAe,SAAiB;GAAE,GAAG;GAAK,QAAQ;EAAK;EACvD,iBAAiB,cAAgC,EAAE,SAAS;CAC9D;CAEA,MAAM,mBAAmB;EAAE;EAAW;EAAS,YAAY,oBAAoB;CAAE;CAEjF,MAAM,gBAAyD;EAC7D,aAAa;EACb,eAAe;EACf,eAAe;EACf,iBAAiB,SAAS,KAAK,OAAO,IAAI,aAAa,IAAI,CAAC;EAC5D,yBAAyB;EACzB,wBAAwB;EACxB,yBAAyB;EACzB,YAAY,EAAE,eAAe;GAC3B,QAAQ,MAAM;IACZ,QAAQ,WAAW;IACnB,QAAQ,WAAW;IACnB,QAAQ,SAAS,eAAe,cAAc,QAAQ,SAAS;GACjE,CAAC;GACD,YAAY,MAAM,CAAC,QAAQ,WAAW,WAAW,QAAQ,WAAW,KAAK,CAAC;GAC1E,SAAS,QAAQ,SAAS,eAAe,cAAc,QAAQ,SAAS;EAC1E;EACA,WAAW;GACT,GAAG,UAAU;GACb,YAAY;IACV,OAAO,MAAM,aAAa;IAC1B,WAAW;IACX,OAAO;IACP,YAAY,SAAS,SACnB,QAAQ,QAAQ,SAAS,eACrB,KAAK,WAAW,IAChB,QAAQ,QAAQ,SAAS,qBACvB,KAAK,WAAW,KACf,KAAK,WAAW,KACf,KAAK,OACF,QACC,OAAO,GAAG,IAAI,WAAW,QAAQ,eAAe,KAChD,IAAI,WAAW,QACf,IAAI,eAAe,IACvB,IACF,KAAK,WAAW,KAChB,KAAK,OACF,QAAQ,OAAO,GAAG,IAAI,WAAW,QAAQ,eAAe,KAAK,IAAI,WAAW,IAC/E;GACV;EACF;EACA,SAAS;GACP,GAAG,OAAO,eAAe;GACzB,UAAU;GACV,WAAW;GACX,aAAa;GACb,SAAS;GACT,SAAS;GACT,OAAO;GACP,WAAW;GACX,gBAAgB;GAChB,eAAe,EAAE,QAAQ,4BAA4B;IACnD,UAAU,OAAO;IACjB,WAAW,OAAO;IAClB,aAAa,OAAO;IACpB,SAAS,OAAO;IAChB,SAAS,OAAO;IAChB,OAAO,OAAO,SAAS;IACvB,WAAW,QAAQ,OAAO,cAAc;IACxC,gBAAgB,QAAQ,oBAAoB;IAC5C,SAAS,OAAO,WAAW,WAAW,CAAC,CAAC;KACtC,WAAW,OAAO;KAClB,WAAW;MACT,SAAS,OAAO;MAChB,SAAS,OAAO;MAChB,OAAO,OAAO,SAAS;KACzB;IACF,CAAC;GACH;GACA,gBAAgB,QAAQ,OAAO,aAAa,IAAI,OAAO;EACzD;EACA,QAAQ;GACN,GAAG,OAAO,aAAa;GACvB,UAAU;GACV,SAAS;GACT,UAAU;GACV,eAAe;GACf,aAAa;GACb,SAAS;GACT,eAAe,SAAS;IAAE,GAAG;IAAK,eAAe;IAAM,aAAa;GAAK;EAC3E;EACA,YAAY;GACV,GAAG,OAAO,kBAAkB;GAC5B,UAAU;GACV,SAAS;GACT,SAAS;GACT,WAAW;GACX,WAAW;GACX,YAAY;GACZ,SAAS;GACT,eAAe;GACf,gBAAgB;GAChB,UAAU;GACV,WAAW;GACX,SAAS;GACT,OAAO;GACP,WAAW;GACX,eAAe;GACf,cAAc;GACd,eAAe;GACf,SAAS;GACT,qBAAqB;GACrB,gBAAgB;GAChB,eAAe,EACb,QACA,WACA,sBACA,OACA,eACA,cACK;IACL,UAAU,OAAO;IACjB,SAAS,OAAO;IAChB,SAAS,OAAO;IAChB,WAAW,OAAO;IAClB;IACA,YAAY,OAAO;IACnB,SAAS,OAAO,WAAW,WAAW,CAAC,CAAC,OAAO,OAAO;IACtD,eAAe,OAAO,SAAS;IAC/B,gBAAgB,OAAO,SAAS;IAChC,UAAU,QAAQ,OAAO,cAAc;IACvC,WAAW,QAAQ,OAAO,eAAe;IACzC,SAAS,OAAO;IAChB;IACA,WAAW;IACX;IACA,cAAc;IACd,eAAe;IACf,SAAS;IACT,qBAAqB,OAAO;IAC5B,gBAAgB,QAAQ,oBAAoB;IAC5C,aAAa,OAAO;GACtB;GACA,gBAAgB,QAAQ,OAAO,aAAa,IAAI,OAAO;GACvD,eAAe,QACb,OAAO,IAAI,aAAa;IACtB,OAAO,OAAO,OAAOA,eAAa;KAChC,UAAU,IAAI;KACd,SAAS,IAAI;KACb,SAAS,IAAI;KACb,WAAW,IAAI;KACf,aAAa,IAAI;KACjB,YAAY,IAAI;KAChB,SAAS,OAAO,OAAO,aAAa,IAAI,OAAO;KAC/C,UAAU;MAAE,OAAO,IAAI;MAAe,QAAQ,IAAI;KAAe;KACjE,gBAAgB,OAAO,YAAY,IAAI,QAAQ;KAC/C,iBAAiB,OAAO,YAAY,IAAI,SAAS;KACjD,SAAS,IAAI;IACf,CAAC;GACH,CAAC;EACL;EACA,cAAc;GACZ,GAAG,OAAO,oBAAoB;GAC9B,UAAU;GACV,SAAS;GACT,gBAAgB;GAChB,QAAQ;GACR,SAAS;GACT,WAAW;GACX,SAAS;GACT,WAAW;GACX,UAAU;GACV,SAAS;GACT,gBAAgB;GAChB,eAAe,YAAY;IACzB,GAAG;IACH,SAAS,OAAO,WAAW,WAAW,CAAC,CAAC,OAAO,OAAO;IACtD,WAAW,QAAQ,OAAO,eAAe;IACzC,UAAU;IACV,gBAAgB,QAAQ,OAAO,oBAAoB;GACrD;GACA,SAAS,QACP,OAAO,IAAI,aAAa;IACtB,OAAO,OAAO,OAAO,mBAAmB;KACtC,GAAG;KACH,SAAS,OAAO,OAAO,aAAa,IAAI,OAAO;KAC/C,iBAAiB,OAAO,YAAY,IAAI,SAAS;IACnD,CAAC;GACH,CAAC;EACL;EACA,WAAW;GACT,GAAG,OAAO,aAAa;GACvB,UAAU;GACV,SAAS;GACT,QAAQ;GACR,WAAW;GACX,UAAU;GACV,eAAe,SAAS,EAAE,GAAG,IAAI;EACnC;EACA,YAAY;GACV,GAAG,OAAO,YAAY;GACtB,UAAU;GACV,SAAS;GACT,QAAQ;GACR,WAAW;GACX,UAAU;GACV,WAAW;GACX,YAAY;GACZ,gBAAgB;GAChB,eAAe,SAAS;IACtB,GAAG;IACH,YAAY,QAAQ,IAAI,gBAAgB;IACxC,gBAAgB,QAAQ,IAAI,oBAAoB;GAClD;EACF;EACA,cAAc;GACZ,GAAG,OAAO,eAAe;GACzB,UAAU;GACV,SAAS;GACT,WAAW;GACX,WAAW;GACX,YAAY;GACZ,gBAAgB;GAChB,eAAe,SAAS;IACtB,GAAG;IACH,YAAY,QAAQ,IAAI,gBAAgB;IACxC,gBAAgB,QAAQ,IAAI,oBAAoB;GAClD;EACF;EACA,SAAS;GACP,GAAG,OAAO,eAAe;GACzB,UAAU;GACV,WAAW;GACX,MAAM;GACN,UAAU;GACV,gBAAgB;GAChB,eAAe,SAAS;IAAE,GAAG;IAAK,gBAAgB,QAAQ,IAAI,oBAAoB;GAAE;EACtF;CACF;CAEA,MAAM,kBAA8D;EAClE,MAAM,YAAY,iBAAsC;GACtD,UAAU,SAAS,MAAM,YAAY,QAAQ;GAC7C,eAAe,YAAY;EAC7B;EAEA,OAAO;GACL;GACA;GACA,qBAAqB,oBAAoB;GACzC,aAAa;GACb,yBAAyB;GACzB,eAAe;GACf,eAAe;GACf,sBAAsB;GACtB,kBAAkB,SAAS,KAAK,OAAO,IAAI,iBAAiB,IAAI,CAAC;GACjE,wBAAwB;GACxB,qBAAqB;GACrB,YAAY;IACV,OAAO,MAAM,aAAa;IAC1B,WAAW;IACX,OAAO;IACP,WAAW;IACX,YAAY;IACZ,iBAAiB;IACjB,YAAY,QAAQ,IAAI,WAAW;IACnC,sBAAsB,YAAY,WAAW,cAAc;KACzD,GAAG;KACH;KACA;KACA,YAAY;KACZ,QAAQ;IACV;GACF;GACA,YAAY;IACV,GAAG,OAAO,WAAW;IACrB,UAAU;IACV,WAAW;IACX,cAAc;IACd,oBAAoB;IACpB,iBAAiB;IACjB,UAAU;IACV,eAAe;IACf,eAAe,EAAE,aAAa,GAAG,WAAW;KAAE,GAAG;KAAK,GAAG,SAAS,WAAW;IAAE;IAC/E,iBAAiB,MAAM,qBAAqB;KAC1C,UAAU,SAAS,MAAM,IAAI;KAC7B;IACF;IACA,oBAAoB,EAAE,aAAa,GAAG,WAAW;KAAE,GAAG;KAAK,GAAG,SAAS,WAAW;IAAE;IACpF,SAAS,EAAE,UAAU,SAAS,KAAK,YAAY,iBAC7C,OAAO,IAAI,aAAa;KACtB,MAAM,KAAK,OAAO,EAAE,UAAU,IAAI,EAAE,GAAG;KACvC,MAAM,OAAO,OAAO,OAAO,qBAAqB,WAAW,QAAQ;KAEnE,OAAO,OAAO,OAAO,4BAA4B;MAC/C;MACA,UAAU;OACR,WAAW;OACX,kBAAkB,IAAI,EAAE;OACxB,aAAa,CACX;QACE,cAAc,WAAW;QACzB,UAAU,WAAW;OACvB,CACF;MACF;MACA,cAAc,WAAW;MACzB,oBAAoB,WAAW;MAC/B,iBAAiB,WAAW;MAC5B,UAAU;MACV,eAAe,WAAW;MAC1B,YAAY,OAAO,OAAO,iBAAiB;OACzC,WAAW,WAAW;OACtB,OAAO,WAAW;MACpB,CAAC;MACD,2BAA2B,WAAW;MACtC,GAAI,WAAW,eAAe,OAC1B,CAAC,IACD,EAAE,4BAA4B,OAAO,YAAY,WAAW,UAAU,EAAE;KAC9E,CAAC;IACH,CAAC;GACL;GACA,SAAS;IACP,GAAG,OAAO,kBAAkB;IAC5B,UAAU;IACV,WAAW;IACX,QAAQ;IACR,eAAe;IACf,UAAU;IACV,gBAAgB;IAChB,eAAe,SAAS;KAAE,GAAG;KAAK,gBAAgB,QAAQ,IAAI,oBAAoB;IAAE;GACtF;EACF;CACF;CAEA,MAAM,gBAAqD;EACzD;EACA;EACA,aAAa;EACb,oBAAoB;EACpB,mBAAmB;EACnB,eAAe;EACf,eAAe;EACf,sBAAsB;EACtB,kBAAkB,SAAS,KAAK,OAAO,IAAI,iBAAiB,IAAI,CAAC;EACjE,wBAAwB;EACxB,qBAAqB;EACrB,yBAAyB;EACzB,4BAA4B;EAC5B,4BAA4B;EAC5B,qBAAqB;GACnB,GAAG,oBAAoB;GACvB,mBAAmB,cAAc;IAAE;IAAU,QAAQ;GAAK;GAC1D,mBAAmB,cAAc;IAAE;IAAU,QAAQ;GAAM;EAC7D;EACA,YAAY;GACV,OAAO,MAAM,aAAa;GAC1B,WAAW;GACX,OAAO;GACP,WAAW;GACX,YAAY;GACZ,iBAAiB;GACjB,YAAY,QAAQ,IAAI,WAAW,QAAQ,IAAI,eAAe;GAC9D,kBAAkB,QAAQ,IAAI,WAAW,QAAQ,IAAI,eAAe;GACpE,uBAAuB,EAAE,YAAY,WAAW,kBAAkB,uBAAuB;IACvF,GAAG;IACH;IACA,YAAY,QAAQ,gBAAgB;IACpC,UAAU;IACV,QAAQ;GACV;GACA,qBAAqB,EAAE,kBAAkB,uBAAuB;IAC9D,YAAY,QAAQ,gBAAgB;IACpC,UAAU;IACV,QAAQ;GACV;GACA,mBAAmB,EAAE,uBAAuB;IAAE,UAAU;IAAiB,QAAQ;GAAM;EACzF;EACA,YAAY;GACV,OAAO,MAAM,kBAAkB;GAC/B,UAAU;GACV,WAAW;GACX,cAAc;GACd,qBAAqB;GACrB,iBAAiB;GACjB,oBAAoB;GACpB,QAAQ;GACR,iBAAiB,UAAU,UAAU;GACrC,uBAAuB,EAAE,YAAY,GAAG,WAAW;IACjD,GAAG;IACH,qBAAqB,WAAW;IAChC,iBAAiB,WAAW;IAC5B,QAAQ;GACV;GACA,mBAAmB,EAAE,YAAY,0BAA0B;IACzD,qBAAqB,WAAW;IAChC,iBAAiB,WAAW;IAC5B;IACA,QAAQ;GACV;GACA,mBAAmB,EAAE,0BAA0B;IAAE;IAAoB,QAAQ;GAAM;GACnF,SAAS,EAAE,UAAU,SAAS,KAAK,YAAY,iBAC7C,OAAO,IAAI,aAAa;IACtB,OAAO,OAAO,OAAO,yBAAyB;KAC5C;KACA,YAAY;MAAE,WAAW,WAAW;MAAW,OAAO,WAAW;KAAM;KACvE,oBAAoB,WAAW;KAC/B,kBAAkB,OAAO,YAAY,WAAW,UAAU;KAC1D,cAAc,WAAW;KACzB,oBAAoB,WAAW;KAC/B,UAAU;MACR,WAAW,OAAO,EAAE,UAAU,IAAI,EAAE,GAAG;MACvC,kBAAkB,IAAI,EAAE;MACxB,aAAa,CACX;OAAE,cAAc,WAAW;OAAc,UAAU,WAAW;MAAmB,CACnF;KACF;IACF,CAAC;GACH,CAAC;EACL;EACA,SAAS;GACP,OAAO,MAAM,eAAe;GAC5B,UAAU;GACV,WAAW;GACX,QAAQ;GACR,eAAe;GACf,gBAAgB;GAChB,eAAe,EAAE,sBAAsB,GAAG,WAAW;IACnD,GAAG;IACH,gBAAgB,QAAQ,oBAAoB;GAC9C;EACF;CACF;CAEA,MAAM,YACJ,WAUG;EACH,MAAM,SAAS,OAAO,eACpB,OAAO,OAAO;GACZ,GAAG,gBAAgB;GACnB,QAAQ,OAAO;GACf,QAAQ;GACR,SAAS;GACT,YAAY;GACZ,mBAAmB;EACrB,CAAC,CACH;EAEA,MAAM,aAAa,WAA6C;GAC9D,QAAQ,MAAM;GACd,SAAS,MAAM;GACf,kBAAkB,MAAM;GACxB,UAAU,QAAQ,SAAS,cAAc,MAAM,QAAQ,CAAC;GACxD,WAAW,QAAQ,SAAS,cAAc,MAAM,SAAS,CAAC;GAC1D,mBAAmB,QAAQ,SAAS,cAAc,MAAM,iBAAiB,CAAC;GAC1E,QAAQ,OAAO,WAAW,MAAM,CAAC,CAAC;IAChC,GAAG;IACH,QAAQ,OAAO,WAAW,MAAM,CAAC,CAAC,MAAM,MAAM;GAChD,CAAC;EACH;EAEA,OAAO;GACL,GAAG,UAAU;GACb,4BAA4B;GAC5B,aAAa;IAAE,eAAe;IAA0B,QAAQ;GAAsB;GACtF,WAAW;IACT,WAAW,OAAO,OAAO,QAAQ,EAAE;IACnC,YAAY,OAAO,OAAO,WAAW,EAAE;IACvC,QAAQ,OAAO;GACjB;GACA,MAAM;IACJ,OAAO,MAAM,cAAc;IAC3B,QAAQ;IACR,WAAW;IACX,OAAO;IACP,eAAe;IACf,YAAY;IACZ,mBAAmB;IACnB,uBAAuB;IACvB,gBAAgB,SAAS,QAAQ,SAAS,cAAc,IAAI,CAAC;IAC7D,gBAAgB,UAAU,YAAY,KAAK,CAAC,CAAC,KAAK,OAAO,IAAI,SAAS,UAAU,CAAC;IACjF,sBAAsB,SAAS;KAC7B,QAAQ,IAAI,SAAS;KACrB,WAAW,IAAI;KACf,OAAO;KACP,eAAe,IAAI;KACnB,YAAY,QAAQ,SAAS,cAAc,IAAI,UAAU,CAAC;IAC5D;IACA,0BAA0B,SAAS;KACjC,QAAQ,IAAI,SAAS;KACrB,WAAW,IAAI;KACf,OAAO;KACP,eAAe;KACf,YAAY,QAAQ,SAAS,cAAc,IAAI,UAAU,CAAC;IAC5D;GACF;GACA,SAAS;IACP,OAAO,MAAM,UAAU;IACvB,WAAW;IACX,WAAW;IACX,QAAQ;IACR,SAAS;IACT,kBAAkB;IAClB,UAAU;IACV,WAAW;IACX,mBAAmB;IACnB,gBAAgB,SAAS,QAAQ,SAAS,cAAc,IAAI,CAAC;IAC7D,YAAY;IACZ,iBAAiB,SAAS,KAAK,OAAO,IAAI,iBAAiB,IAAI,CAAC;IAChE,eAAe,OAAO,SAAS;KAAE,GAAG,UAAU,KAAK;KAAG,GAAG;IAAI;IAC7D,gBAAgB;IAChB,SAAS,QACP,OAAO,IAAI,aAAa;KACtB,MAAM,QAAQ,OAAO,OAAO,QAAQ,IAAI,MAAM;KAC9C,MAAM,gBAAgB,OAAO,OAAO,QAAQ,MAAM,MAAM;KAExD,OAAO;MAAE,GAAG;MAAO,QAAQ;KAAc;IAC3C,CAAC;GACL;EACF;CACF;CAEA,OAAO;EAAE;EAAO;EAAW;EAAQ;EAAW;EAAQ;EAAU;CAAO;AACzE,CAAC"}
+{"version":3,"file":"storage-mapping.mjs","names":[],"sources":["../../src/internal/storage-mapping.ts"],"sourcesContent":["import { EmailCredentialSnapshot } from \"@yielded/auth/Email\";\nimport { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport {\n  PasswordCredentialSnapshot,\n  EncodedPasswordHash,\n  type PasswordReplacement,\n} from \"@yielded/auth/Password\";\nimport { TokenDigest } from \"@yielded/auth/Schema\";\nimport {\n  SecurityRevision,\n  AuthenticationEvidence,\n  SessionId,\n  SessionMetadata,\n  SessionAuthenticationProvenance,\n  SessionCredentialVersion,\n  type StatefulSessionRecord,\n} from \"@yielded/auth/Sessions\";\nimport { Crypto, DateTime, Effect, Redacted, Schema, Struct } from \"effect\";\n\nimport type { MappingInput } from \"./configuration\";\nimport { randomId } from \"./crypto\";\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport { requiredEmailAddressConstraints, type AnyEmailAddressMapping } from \"./models/email-model\";\nimport {\n  requiredPasswordConstraints,\n  type AnyPasswordPersistenceMapping,\n} from \"./models/password-model\";\nimport { requiredProofConstraints, type AnyProofPersistenceMapping } from \"./models/proof-model\";\nimport type { StatefulSessionMapping, PendingAuthenticationMapping } from \"./models/session-model\";\nimport { makeStorageClock } from \"./storage-clock\";\nimport { storageTables, type StorageRole } from \"./storage-tables\";\nimport type { TableModel, SqlExpression } from \"./table-model\";\n\nconst failure = (cause: unknown) => PersistenceMappingError.make({ operation: \"decode\", cause });\n\nconst decode = <S extends Schema.Codec<unknown, unknown>>(schema: S, value: unknown) =>\n  Schema.decodeUnknownEffect(schema)(value).pipe(Effect.mapError(failure));\n\nconst string = (value: unknown) => Schema.decodeUnknownSync(Schema.String)(value);\n\n/** Derive shared row mappings from a managed or custom storage layout.\n * Acquire Effect Crypto once; the returned allocators retain that implementation.\n * Each factory requires its role tables to exist. Adapter authors supply typed\n * table handles and dialect-specific clocks/commit predicates, and may refine\n * authority policy for explicit services. This does not alter composed defaults.\n */\nexport const makeMappings = Effect.fnUntraced(function* (input: MappingInput) {\n  const crypto = yield* Crypto.Crypto;\n\n  const allocate = randomId.pipe(\n    Effect.provideService(Crypto.Crypto, crypto),\n    Effect.mapError(failure),\n  );\n\n  const table = (role: StorageRole) => {\n    const found = input.tables[role];\n\n    if (found === undefined) throw failure(`Missing ${role} mapping`);\n\n    return found;\n  };\n\n  const mapped = (role: StorageRole) => ({\n    table: table(role),\n    ...Object.fromEntries(Object.keys(storageTables[role].columns).map((key) => [key, key])),\n  });\n\n  const { subjects: s, encodeInstant: instant, decodeInstant: readInstant } = input;\n  const subjectId = { toNative: s.toNative, toSubject: s.toSubject, equals: Object.is };\n\n  const subject = {\n    table: s.table,\n    id: s.id,\n    status: s.status,\n    securityRevision: s.securityRevision,\n    isActiveStatus: (value: unknown) => Object.is(value, s.activeValue),\n    d1ActiveStatusValue: s.activeValue,\n    activeStatusValue: s.activeValue,\n    decodeRequirement: s.requirements,\n    decodeActionRequirement: s.actionRequirements,\n    nextSecurityRevision: () => allocate.pipe(Effect.map(SecurityRevision.make)),\n  };\n\n  const authorityCredential = () => ({\n    ...mapped(\"credentials\"),\n    subjectId: \"subjectId\",\n    credentialId: \"credentialId\",\n    revision: \"revision\",\n    status: \"active\",\n    activeStatusValue: true,\n    isActiveStatus: (value: unknown) => value === true,\n    encodeInsert: (row: object) => ({ ...row, active: true }),\n    encodeRevision: (revision: SecurityRevision) => ({ revision }),\n  });\n\n  const authority = () => ({ subjectId, subject, credential: authorityCredential() });\n\n  const clock = yield* makeStorageClock(input);\n\n  const proofs = (): AnyProofPersistenceMapping<SqlExpression> => ({\n    constraints: requiredProofConstraints,\n    subjectId,\n    subject: { table: s.table, id: s.id },\n    clock,\n    proof: {\n      ...mapped(\"proofs\"),\n      moduleId: \"moduleId\",\n      purpose: \"purpose\",\n      seriesKey: \"seriesKey\",\n      proofId: \"proofId\",\n      binding: \"binding\",\n      verifierKeyId: \"verifierKeyId\",\n      verifierDigest: \"verifierDigest\",\n      issuedAt: \"issuedAt\",\n      expiresAt: \"expiresAt\",\n      failedAttempts: \"failedAttempts\",\n      encodeInsert: () => ({}),\n    },\n  });\n\n  const passwords = (): AnyPasswordPersistenceMapping<SqlExpression> => {\n    const verifier = (replacement: PasswordReplacement) => ({\n      verifier: Redacted.value(replacement.verifier),\n      normalization: replacement.normalization,\n    });\n\n    return {\n      subjectId,\n      subject,\n      authorityCredential: authorityCredential(),\n      constraints: requiredPasswordConstraints,\n      encodeInstant: instant,\n      decodeInstant: readInstant,\n      allocateCredentialId: allocate,\n      allocateRevision: allocate.pipe(Effect.map(SecurityRevision.make)),\n      sessionInvalidation: \"same-authority-immediate\",\n      identifier: {\n        table: table(\"identifiers\"),\n        namespace: \"namespace\",\n        value: \"value\",\n        subjectId: \"subjectId\",\n        verifiedAt: \"verifiedAt\",\n        bindingRevision: \"revision\",\n        isCurrent: (row) => row.active === true,\n        encodeInitialInsert: (identifier, subjectId, revision) => ({\n          ...identifier,\n          subjectId,\n          revision,\n          verifiedAt: null,\n          active: true,\n        }),\n      },\n      credential: {\n        ...mapped(\"passwords\"),\n        moduleId: \"moduleId\",\n        subjectId: \"subjectId\",\n        credentialId: \"credentialId\",\n        credentialRevision: \"credentialRevision\",\n        verifierVersion: \"verifierVersion\",\n        verifier: \"verifier\",\n        normalization: \"normalization\",\n        encodeInsert: ({ replacement, ...row }) => ({ ...row, ...verifier(replacement) }),\n        encodeVerifier: (hash, verifierVersion) => ({\n          verifier: Redacted.value(hash),\n          verifierVersion,\n        }),\n        encodeReplacement: ({ replacement, ...row }) => ({ ...row, ...verifier(replacement) }),\n        decode: ({ moduleId, subject: row, identifier, credential }) =>\n          Effect.gen(function* () {\n            const id = yield* s.toSubject(row[s.id]);\n            const hash = yield* decode(EncodedPasswordHash, credential.verifier);\n\n            return yield* decode(PasswordCredentialSnapshot, {\n              moduleId,\n              revision: {\n                subjectId: id,\n                securityRevision: row[s.securityRevision],\n                credentials: [\n                  {\n                    credentialId: credential.credentialId,\n                    revision: credential.credentialRevision,\n                  },\n                ],\n              },\n              credentialId: credential.credentialId,\n              credentialRevision: credential.credentialRevision,\n              verifierVersion: credential.verifierVersion,\n              verifier: hash,\n              normalization: credential.normalization,\n              identifier: yield* decode(LoginIdentifier, {\n                namespace: identifier.namespace,\n                value: identifier.value,\n              }),\n              identifierBindingRevision: identifier.revision,\n              ...(identifier.verifiedAt === null\n                ? {}\n                : { identifierVerifiedAtMillis: yield* readInstant(identifier.verifiedAt) }),\n            });\n          }),\n      },\n      clock,\n    };\n  };\n\n  const emails = (): AnyEmailAddressMapping<SqlExpression> => ({\n    subjectId,\n    subject: { ...subject, activeStatusValue: s.activeValue },\n    constraints: requiredEmailAddressConstraints,\n    addressCardinality: \"single\",\n    changeDisposition: \"retire-source\",\n    clock,\n    encodeInstant: instant,\n    decodeInstant: readInstant,\n    allocateCredentialId: allocate,\n    allocateRevision: allocate.pipe(Effect.map(SecurityRevision.make)),\n    sessionInvalidation: \"same-authority-immediate\",\n    isIdentifierConflict: () => false,\n    isCredentialConflict: () => false,\n    authorityCredential: {\n      ...authorityCredential(),\n      encodeActivation: (revision) => ({ revision, active: true }),\n      encodeRetirement: (revision) => ({ revision, active: false }),\n    },\n    identifier: {\n      table: table(\"identifiers\"),\n      namespace: \"namespace\",\n      value: \"value\",\n      subjectId: \"subjectId\",\n      verifiedAt: \"verifiedAt\",\n      bindingRevision: \"revision\",\n      isCurrent: (row) => row.active === true && row.verifiedAt !== null,\n      isMutableTarget: (row) => row.active === true && row.verifiedAt === null,\n      encodeVerifiedInsert: ({ identifier, subjectId, verifiedAtMillis, bindingRevision }) => ({\n        ...identifier,\n        subjectId,\n        verifiedAt: instant(verifiedAtMillis),\n        revision: bindingRevision,\n        active: true,\n      }),\n      encodeVerification: ({ verifiedAtMillis, bindingRevision }) => ({\n        verifiedAt: instant(verifiedAtMillis),\n        revision: bindingRevision,\n        active: true,\n      }),\n      encodeRetirement: ({ bindingRevision }) => ({ revision: bindingRevision, active: false }),\n    },\n    credential: {\n      activeStatusValue: true,\n      table: table(\"emailCredentials\"),\n      moduleId: \"moduleId\",\n      subjectId: \"subjectId\",\n      credentialId: \"credentialId\",\n      identifierNamespace: \"identifierNamespace\",\n      identifierValue: \"identifierValue\",\n      credentialRevision: \"credentialRevision\",\n      status: \"active\",\n      isActiveStatus: (value) => value === true,\n      encodeVerifiedInsert: ({ identifier, ...row }) => ({\n        ...row,\n        identifierNamespace: identifier.namespace,\n        identifierValue: identifier.value,\n        active: true,\n      }),\n      encodeActivation: ({ identifier, credentialRevision }) => ({\n        identifierNamespace: identifier.namespace,\n        identifierValue: identifier.value,\n        credentialRevision,\n        active: true,\n      }),\n      encodeRetirement: ({ credentialRevision }) => ({ credentialRevision, active: false }),\n      decode: ({ moduleId, subject: row, identifier, credential }) =>\n        Effect.gen(function* () {\n          return yield* decode(\n            Schema.Struct(Struct.omit(EmailCredentialSnapshot.fields, [\"requirement\"])),\n            {\n              moduleId,\n              identifier: { namespace: identifier.namespace, value: identifier.value },\n              identifierRevision: identifier.revision,\n              verifiedAtMillis: yield* readInstant(identifier.verifiedAt),\n              credentialId: credential.credentialId,\n              credentialRevision: credential.credentialRevision,\n              revision: {\n                subjectId: yield* s.toSubject(row[s.id]),\n                securityRevision: row[s.securityRevision],\n                credentials: [\n                  {\n                    credentialId: credential.credentialId,\n                    revision: credential.credentialRevision,\n                  },\n                ],\n              },\n            },\n          );\n        }),\n    },\n  });\n\n  const pending = <C extends Schema.Codec<unknown, unknown, never, never>>(\n    claims: C,\n    moduleId: string,\n  ): PendingAuthenticationMapping<C[\"Type\"], TableModel, TableModel, TableModel, unknown> => {\n    const record = Schema.fromJsonString(\n      Schema.Struct({\n        digest: TokenDigest,\n        version: SecurityRevision,\n        evidence: AuthenticationEvidence,\n        expiresAt: Schema.DateTimeUtcFromMillis,\n        attemptLimit: Schema.Int.check(Schema.isGreaterThan(0)),\n        claims: Schema.Unknown,\n      }),\n    );\n\n    return {\n      ...authority(),\n      moduleId,\n      clock,\n      isConstraintConflict: () => false,\n      constraints: { pendingDigest: \"unique(pending.digest)\" },\n      pending: {\n        table: table(\"pending\"),\n        moduleId: \"moduleId\",\n        kind: \"kind\",\n        digest: \"digest\",\n        version: \"version\",\n        flowId: \"flowId\",\n        subjectId: \"subjectId\",\n        bindingDigest: \"bindingDigest\",\n        snapshot: \"snapshot\",\n        expiresAt: \"expiresAt\",\n        attemptLimit: \"attemptLimit\",\n        failedAttempts: \"failedAttempts\",\n        consumed: \"consumed\",\n        encodeInstant: (date) => instant(DateTime.toEpochMillis(date)),\n        allocateVersion: allocate.pipe(Effect.map(SecurityRevision.make)),\n        encodeInsert: (value) => ({\n          ...value,\n          expiresAt: instant(DateTime.toEpochMillis(value.expiresAt)),\n          failedAttempts: 0,\n          consumed: false,\n        }),\n      },\n      login: {\n        encode: (value) =>\n          Schema.encodeEffect(claims)(value.claims).pipe(\n            Effect.flatMap((saved) => Schema.encodeEffect(record)({ ...value, claims: saved })),\n            Effect.mapError(failure),\n          ),\n        decode: (value) =>\n          decode(record, value).pipe(\n            Effect.flatMap((saved) =>\n              decode(claims, saved.claims).pipe(\n                Effect.map((decoded) => ({ ...saved, claims: decoded })),\n              ),\n            ),\n          ),\n      },\n    };\n  };\n\n  const sessions = <C extends Schema.Codec<unknown, unknown, never, never>>(\n    claims: C,\n    moduleId: string,\n  ): StatefulSessionMapping<\n    C[\"Type\"],\n    TableModel,\n    TableModel,\n    TableModel,\n    TableModel,\n    unknown,\n    unknown\n  > => {\n    const record = Schema.fromJsonString(\n      Schema.Struct({\n        ...SessionMetadata.fields,\n        claims: Schema.Unknown,\n        digest: TokenDigest,\n        provenance: SessionAuthenticationProvenance,\n        credentialVersion: SessionCredentialVersion,\n      }),\n    );\n\n    const encodeRow = (value: StatefulSessionRecord<C[\"Type\"]>) => ({\n      digest: value.digest,\n      securityRevision: value.securityRevision,\n      issuedAt: instant(DateTime.toEpochMillis(value.issuedAt)),\n      expiresAt: instant(DateTime.toEpochMillis(value.expiresAt)),\n      absoluteExpiresAt: instant(DateTime.toEpochMillis(value.absoluteExpiresAt)),\n      record: Schema.encodeSync(record)({\n        ...value,\n        claims: Schema.encodeSync(claims)(value.claims),\n      }),\n    });\n\n    const login = pending(claims, moduleId);\n\n    return {\n      ...authority(),\n      moduleId,\n      clock,\n      isConstraintConflict: () => false,\n      pending: { pending: login.pending, login: login.login },\n      constraints: {\n        sessionDigest: \"unique(session.digest)\",\n        pendingDigest: \"unique(pending.digest)\",\n      },\n      sessionId: {\n        toNative: (id) => Effect.succeed(id),\n        toSession: (id) => decode(SessionId, id),\n        equals: Object.is,\n      },\n      session: {\n        table: table(\"sessions\"),\n        sessionId: \"sessionId\",\n        subjectId: \"subjectId\",\n        digest: \"digest\",\n        securityRevision: \"securityRevision\",\n        issuedAt: \"issuedAt\",\n        expiresAt: \"expiresAt\",\n        absoluteExpiresAt: \"absoluteExpiresAt\",\n        encodeInstant: (date) => instant(DateTime.toEpochMillis(date)),\n        allocateId: allocate,\n        encodeInsert: (value, ids) => ({ ...encodeRow(value), ...ids }),\n        encodeRotation: encodeRow,\n        decode: (row) =>\n          Effect.gen(function* () {\n            const saved = yield* decode(record, row.record),\n              decodedClaims = yield* decode(claims, saved.claims);\n\n            return {\n              ...saved,\n              issuedAt: DateTime.makeUnsafe(yield* readInstant(row.issuedAt)),\n              claims: decodedClaims,\n            };\n          }),\n      },\n    };\n  };\n\n  return { table, authority, proofs, passwords, emails, sessions, pending, string };\n});\n"],"mappings":";;;;;;;;;;;;;;AAiCA,MAAM,WAAW,UAAmB,wBAAwB,KAAK;CAAE,WAAW;CAAU;AAAM,CAAC;AAE/F,MAAM,UAAoD,QAAW,UACnE,OAAO,oBAAoB,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,OAAO,SAAS,OAAO,CAAC;AAEzE,MAAM,UAAU,UAAmB,OAAO,kBAAkB,OAAO,MAAM,CAAC,CAAC,KAAK;;;;;;;AAQhF,MAAa,eAAe,OAAO,WAAW,WAAW,OAAqB;CAC5E,MAAM,SAAS,OAAO,OAAO;CAE7B,MAAM,WAAW,SAAS,KACxB,OAAO,eAAe,OAAO,QAAQ,MAAM,GAC3C,OAAO,SAAS,OAAO,CACzB;CAEA,MAAM,SAAS,SAAsB;EACnC,MAAM,QAAQ,MAAM,OAAO;EAE3B,IAAI,UAAU,KAAA,GAAW,MAAM,QAAQ,WAAW,KAAK,SAAS;EAEhE,OAAO;CACT;CAEA,MAAM,UAAU,UAAuB;EACrC,OAAO,MAAM,IAAI;EACjB,GAAG,OAAO,YAAY,OAAO,KAAK,cAAc,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC;CACzF;CAEA,MAAM,EAAE,UAAU,GAAG,eAAe,SAAS,eAAe,gBAAgB;CAC5E,MAAM,YAAY;EAAE,UAAU,EAAE;EAAU,WAAW,EAAE;EAAW,QAAQ,OAAO;CAAG;CAEpF,MAAM,UAAU;EACd,OAAO,EAAE;EACT,IAAI,EAAE;EACN,QAAQ,EAAE;EACV,kBAAkB,EAAE;EACpB,iBAAiB,UAAmB,OAAO,GAAG,OAAO,EAAE,WAAW;EAClE,qBAAqB,EAAE;EACvB,mBAAmB,EAAE;EACrB,mBAAmB,EAAE;EACrB,yBAAyB,EAAE;EAC3B,4BAA4B,SAAS,KAAK,OAAO,IAAI,iBAAiB,IAAI,CAAC;CAC7E;CAEA,MAAM,6BAA6B;EACjC,GAAG,OAAO,aAAa;EACvB,WAAW;EACX,cAAc;EACd,UAAU;EACV,QAAQ;EACR,mBAAmB;EACnB,iBAAiB,UAAmB,UAAU;EAC9C,eAAe,SAAiB;GAAE,GAAG;GAAK,QAAQ;EAAK;EACvD,iBAAiB,cAAgC,EAAE,SAAS;CAC9D;CAEA,MAAM,mBAAmB;EAAE;EAAW;EAAS,YAAY,oBAAoB;CAAE;CAEjF,MAAM,QAAQ,OAAO,iBAAiB,KAAK;CAE3C,MAAM,gBAA2D;EAC/D,aAAa;EACb;EACA,SAAS;GAAE,OAAO,EAAE;GAAO,IAAI,EAAE;EAAG;EACpC;EACA,OAAO;GACL,GAAG,OAAO,QAAQ;GAClB,UAAU;GACV,SAAS;GACT,WAAW;GACX,SAAS;GACT,SAAS;GACT,eAAe;GACf,gBAAgB;GAChB,UAAU;GACV,WAAW;GACX,gBAAgB;GAChB,qBAAqB,CAAC;EACxB;CACF;CAEA,MAAM,kBAAgE;EACpE,MAAM,YAAY,iBAAsC;GACtD,UAAU,SAAS,MAAM,YAAY,QAAQ;GAC7C,eAAe,YAAY;EAC7B;EAEA,OAAO;GACL;GACA;GACA,qBAAqB,oBAAoB;GACzC,aAAa;GACb,eAAe;GACf,eAAe;GACf,sBAAsB;GACtB,kBAAkB,SAAS,KAAK,OAAO,IAAI,iBAAiB,IAAI,CAAC;GACjE,qBAAqB;GACrB,YAAY;IACV,OAAO,MAAM,aAAa;IAC1B,WAAW;IACX,OAAO;IACP,WAAW;IACX,YAAY;IACZ,iBAAiB;IACjB,YAAY,QAAQ,IAAI,WAAW;IACnC,sBAAsB,YAAY,WAAW,cAAc;KACzD,GAAG;KACH;KACA;KACA,YAAY;KACZ,QAAQ;IACV;GACF;GACA,YAAY;IACV,GAAG,OAAO,WAAW;IACrB,UAAU;IACV,WAAW;IACX,cAAc;IACd,oBAAoB;IACpB,iBAAiB;IACjB,UAAU;IACV,eAAe;IACf,eAAe,EAAE,aAAa,GAAG,WAAW;KAAE,GAAG;KAAK,GAAG,SAAS,WAAW;IAAE;IAC/E,iBAAiB,MAAM,qBAAqB;KAC1C,UAAU,SAAS,MAAM,IAAI;KAC7B;IACF;IACA,oBAAoB,EAAE,aAAa,GAAG,WAAW;KAAE,GAAG;KAAK,GAAG,SAAS,WAAW;IAAE;IACpF,SAAS,EAAE,UAAU,SAAS,KAAK,YAAY,iBAC7C,OAAO,IAAI,aAAa;KACtB,MAAM,KAAK,OAAO,EAAE,UAAU,IAAI,EAAE,GAAG;KACvC,MAAM,OAAO,OAAO,OAAO,qBAAqB,WAAW,QAAQ;KAEnE,OAAO,OAAO,OAAO,4BAA4B;MAC/C;MACA,UAAU;OACR,WAAW;OACX,kBAAkB,IAAI,EAAE;OACxB,aAAa,CACX;QACE,cAAc,WAAW;QACzB,UAAU,WAAW;OACvB,CACF;MACF;MACA,cAAc,WAAW;MACzB,oBAAoB,WAAW;MAC/B,iBAAiB,WAAW;MAC5B,UAAU;MACV,eAAe,WAAW;MAC1B,YAAY,OAAO,OAAO,iBAAiB;OACzC,WAAW,WAAW;OACtB,OAAO,WAAW;MACpB,CAAC;MACD,2BAA2B,WAAW;MACtC,GAAI,WAAW,eAAe,OAC1B,CAAC,IACD,EAAE,4BAA4B,OAAO,YAAY,WAAW,UAAU,EAAE;KAC9E,CAAC;IACH,CAAC;GACL;GACA;EACF;CACF;CAEA,MAAM,gBAAuD;EAC3D;EACA,SAAS;GAAE,GAAG;GAAS,mBAAmB,EAAE;EAAY;EACxD,aAAa;EACb,oBAAoB;EACpB,mBAAmB;EACnB;EACA,eAAe;EACf,eAAe;EACf,sBAAsB;EACtB,kBAAkB,SAAS,KAAK,OAAO,IAAI,iBAAiB,IAAI,CAAC;EACjE,qBAAqB;EACrB,4BAA4B;EAC5B,4BAA4B;EAC5B,qBAAqB;GACnB,GAAG,oBAAoB;GACvB,mBAAmB,cAAc;IAAE;IAAU,QAAQ;GAAK;GAC1D,mBAAmB,cAAc;IAAE;IAAU,QAAQ;GAAM;EAC7D;EACA,YAAY;GACV,OAAO,MAAM,aAAa;GAC1B,WAAW;GACX,OAAO;GACP,WAAW;GACX,YAAY;GACZ,iBAAiB;GACjB,YAAY,QAAQ,IAAI,WAAW,QAAQ,IAAI,eAAe;GAC9D,kBAAkB,QAAQ,IAAI,WAAW,QAAQ,IAAI,eAAe;GACpE,uBAAuB,EAAE,YAAY,WAAW,kBAAkB,uBAAuB;IACvF,GAAG;IACH;IACA,YAAY,QAAQ,gBAAgB;IACpC,UAAU;IACV,QAAQ;GACV;GACA,qBAAqB,EAAE,kBAAkB,uBAAuB;IAC9D,YAAY,QAAQ,gBAAgB;IACpC,UAAU;IACV,QAAQ;GACV;GACA,mBAAmB,EAAE,uBAAuB;IAAE,UAAU;IAAiB,QAAQ;GAAM;EACzF;EACA,YAAY;GACV,mBAAmB;GACnB,OAAO,MAAM,kBAAkB;GAC/B,UAAU;GACV,WAAW;GACX,cAAc;GACd,qBAAqB;GACrB,iBAAiB;GACjB,oBAAoB;GACpB,QAAQ;GACR,iBAAiB,UAAU,UAAU;GACrC,uBAAuB,EAAE,YAAY,GAAG,WAAW;IACjD,GAAG;IACH,qBAAqB,WAAW;IAChC,iBAAiB,WAAW;IAC5B,QAAQ;GACV;GACA,mBAAmB,EAAE,YAAY,0BAA0B;IACzD,qBAAqB,WAAW;IAChC,iBAAiB,WAAW;IAC5B;IACA,QAAQ;GACV;GACA,mBAAmB,EAAE,0BAA0B;IAAE;IAAoB,QAAQ;GAAM;GACnF,SAAS,EAAE,UAAU,SAAS,KAAK,YAAY,iBAC7C,OAAO,IAAI,aAAa;IACtB,OAAO,OAAO,OACZ,OAAO,OAAO,OAAO,KAAK,wBAAwB,QAAQ,CAAC,aAAa,CAAC,CAAC,GAC1E;KACE;KACA,YAAY;MAAE,WAAW,WAAW;MAAW,OAAO,WAAW;KAAM;KACvE,oBAAoB,WAAW;KAC/B,kBAAkB,OAAO,YAAY,WAAW,UAAU;KAC1D,cAAc,WAAW;KACzB,oBAAoB,WAAW;KAC/B,UAAU;MACR,WAAW,OAAO,EAAE,UAAU,IAAI,EAAE,GAAG;MACvC,kBAAkB,IAAI,EAAE;MACxB,aAAa,CACX;OACE,cAAc,WAAW;OACzB,UAAU,WAAW;MACvB,CACF;KACF;IACF,CACF;GACF,CAAC;EACL;CACF;CAEA,MAAM,WACJ,QACA,aACyF;EACzF,MAAM,SAAS,OAAO,eACpB,OAAO,OAAO;GACZ,QAAQ;GACR,SAAS;GACT,UAAU;GACV,WAAW,OAAO;GAClB,cAAc,OAAO,IAAI,MAAM,OAAO,cAAc,CAAC,CAAC;GACtD,QAAQ,OAAO;EACjB,CAAC,CACH;EAEA,OAAO;GACL,GAAG,UAAU;GACb;GACA;GACA,4BAA4B;GAC5B,aAAa,EAAE,eAAe,yBAAyB;GACvD,SAAS;IACP,OAAO,MAAM,SAAS;IACtB,UAAU;IACV,MAAM;IACN,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,WAAW;IACX,eAAe;IACf,UAAU;IACV,WAAW;IACX,cAAc;IACd,gBAAgB;IAChB,UAAU;IACV,gBAAgB,SAAS,QAAQ,SAAS,cAAc,IAAI,CAAC;IAC7D,iBAAiB,SAAS,KAAK,OAAO,IAAI,iBAAiB,IAAI,CAAC;IAChE,eAAe,WAAW;KACxB,GAAG;KACH,WAAW,QAAQ,SAAS,cAAc,MAAM,SAAS,CAAC;KAC1D,gBAAgB;KAChB,UAAU;IACZ;GACF;GACA,OAAO;IACL,SAAS,UACP,OAAO,aAAa,MAAM,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,KACxC,OAAO,SAAS,UAAU,OAAO,aAAa,MAAM,CAAC,CAAC;KAAE,GAAG;KAAO,QAAQ;IAAM,CAAC,CAAC,GAClF,OAAO,SAAS,OAAO,CACzB;IACF,SAAS,UACP,OAAO,QAAQ,KAAK,CAAC,CAAC,KACpB,OAAO,SAAS,UACd,OAAO,QAAQ,MAAM,MAAM,CAAC,CAAC,KAC3B,OAAO,KAAK,aAAa;KAAE,GAAG;KAAO,QAAQ;IAAQ,EAAE,CACzD,CACF,CACF;GACJ;EACF;CACF;CAEA,MAAM,YACJ,QACA,aASG;EACH,MAAM,SAAS,OAAO,eACpB,OAAO,OAAO;GACZ,GAAG,gBAAgB;GACnB,QAAQ,OAAO;GACf,QAAQ;GACR,YAAY;GACZ,mBAAmB;EACrB,CAAC,CACH;EAEA,MAAM,aAAa,WAA6C;GAC9D,QAAQ,MAAM;GACd,kBAAkB,MAAM;GACxB,UAAU,QAAQ,SAAS,cAAc,MAAM,QAAQ,CAAC;GACxD,WAAW,QAAQ,SAAS,cAAc,MAAM,SAAS,CAAC;GAC1D,mBAAmB,QAAQ,SAAS,cAAc,MAAM,iBAAiB,CAAC;GAC1E,QAAQ,OAAO,WAAW,MAAM,CAAC,CAAC;IAChC,GAAG;IACH,QAAQ,OAAO,WAAW,MAAM,CAAC,CAAC,MAAM,MAAM;GAChD,CAAC;EACH;EAEA,MAAM,QAAQ,QAAQ,QAAQ,QAAQ;EAEtC,OAAO;GACL,GAAG,UAAU;GACb;GACA;GACA,4BAA4B;GAC5B,SAAS;IAAE,SAAS,MAAM;IAAS,OAAO,MAAM;GAAM;GACtD,aAAa;IACX,eAAe;IACf,eAAe;GACjB;GACA,WAAW;IACT,WAAW,OAAO,OAAO,QAAQ,EAAE;IACnC,YAAY,OAAO,OAAO,WAAW,EAAE;IACvC,QAAQ,OAAO;GACjB;GACA,SAAS;IACP,OAAO,MAAM,UAAU;IACvB,WAAW;IACX,WAAW;IACX,QAAQ;IACR,kBAAkB;IAClB,UAAU;IACV,WAAW;IACX,mBAAmB;IACnB,gBAAgB,SAAS,QAAQ,SAAS,cAAc,IAAI,CAAC;IAC7D,YAAY;IACZ,eAAe,OAAO,SAAS;KAAE,GAAG,UAAU,KAAK;KAAG,GAAG;IAAI;IAC7D,gBAAgB;IAChB,SAAS,QACP,OAAO,IAAI,aAAa;KACtB,MAAM,QAAQ,OAAO,OAAO,QAAQ,IAAI,MAAM,GAC5C,gBAAgB,OAAO,OAAO,QAAQ,MAAM,MAAM;KAEpD,OAAO;MACL,GAAG;MACH,UAAU,SAAS,WAAW,OAAO,YAAY,IAAI,QAAQ,CAAC;MAC9D,QAAQ;KACV;IACF,CAAC;GACL;EACF;CACF;CAEA,OAAO;EAAE;EAAO;EAAW;EAAQ;EAAW;EAAQ;EAAU;EAAS;CAAO;AAClF,CAAC"}

package/dist/internal/storage-plans.mjs

@@ -1,103 +1,51 @@
 import { Predicate, Schema } from "effect";
 //#region src/internal/storage-plans.ts
 const uniquePlans = {
-	"unique(abuseEvent.moduleId,abuseEvent.action,abuseEvent.scopeKind,abuseEvent.scopeKey,abuseEvent.commandId)": ["abuseEvent", [
-		"moduleId",
-		"action",
-		"scopeKind",
-		"scopeKey",
-		"commandId"
-	]],
-	"unique(admission.moduleId)": ["admission", ["moduleId"]],
-	"unique(attempt.moduleId,attempt.attemptId)": ["attempt", ["moduleId", "attemptId"]],
 	"unique(authority.subjectId,authority.credentialId)": ["authority", ["subjectId", "credentialId"]],
 	"unique(authorityCredential.subjectId,authorityCredential.credentialId)": ["authorityCredential", ["subjectId", "credentialId"]],
-	"unique(command.moduleId,command.commandId)": ["command", ["moduleId", "commandId"]],
-	"unique(connectedAdmission.admissionId)": ["admission", ["admissionId"]],
-	"unique(connectedClient.clientKey)": ["client", ["clientKey"]],
-	"unique(connectedCohort.cohortKey)": ["cohort", ["cohortKey"]],
-	"unique(connectedCommand.moduleId,connectedCommand.commandId)": ["command", ["moduleId", "commandId"]],
-	"unique(connectedFlow.moduleId,connectedFlow.commandId)": ["flow", ["moduleId", "commandId"]],
-	"unique(connectedFlow.moduleId,connectedFlow.flowId)": ["flow", ["moduleId", "flowId"]],
-	"unique(connectedFlow.stateDigest)": ["flow", ["stateDigest"]],
 	"unique(connectedGrant.moduleId,connectedGrant.grantId)": ["grant", ["moduleId", "grantId"]],
-	"unique(connectedGrant.moduleId,connectedGrant.subjectId,connectedGrant.profileKey,connectedGrant.activeIdentityKey)": ["grant", [
+	"unique(connectedGrant.moduleId,connectedGrant.subjectId,connectedGrant.profileKey,connectedGrant.identityKey)": ["grant", [
 		"moduleId",
 		"subjectId",
 		"profileKey",
-		"activeIdentityKey"
+		"identityKey"
 	]],
 	"unique(connectedRevocation.jobId)": ["job", ["jobId"]],
-	"unique(continuation.moduleId,continuation.continuationId)": ["continuation", ["moduleId", "continuationId"]],
-	"unique(continuation.moduleId,continuation.digest)": ["continuation", ["moduleId", "digest"]],
 	"unique(credential.credentialId)": ["credential", ["credentialId"]],
 	"unique(credential.identityKey)": ["credential", ["identityKey"]],
 	"unique(credential.moduleId,credential.credentialId)": ["credential", ["moduleId", "credentialId"]],
 	"unique(credential.moduleId,credential.subjectId)": ["credential", ["moduleId", "subjectId"]],
-	"unique(emailCommand.moduleId,emailCommand.commandId)": ["command", ["moduleId", "commandId"]],
 	"unique(emailCredential.moduleId,emailCredential.credentialId)": ["credential", ["moduleId", "credentialId"]],
 	"unique(emailCredential.moduleId,emailCredential.identifierNamespace,emailCredential.identifierValue)": ["credential", [
 		"moduleId",
 		"identifierNamespace",
 		"identifierValue"
 	]],
-	"unique(emailRegistration.moduleId,emailRegistration.commandId)": ["registration", ["moduleId", "commandId"]],
-	"unique(emailRegistration.pendingReference)": ["registration", ["pendingReference"]],
-	"unique(failureEvent.moduleId,failureEvent.seriesKey,failureEvent.commandId)": ["failureEvent", [
-		"moduleId",
-		"seriesKey",
-		"commandId"
-	]],
-	"unique(flow.flowId)": ["flow", ["flowId"]],
-	"unique(flow.moduleId,flow.commandId)": ["flow", ["moduleId", "commandId"]],
 	"unique(flow.moduleId,flow.flowId)": ["flow", ["moduleId", "flowId"]],
 	"unique(flow.stateDigest)": ["flow", ["stateDigest"]],
-	"unique(generation.moduleId,generation.deliveryId)": ["generation", ["moduleId", "deliveryId"]],
-	"unique(generation.moduleId,generation.proofId)": ["generation", ["moduleId", "proofId"]],
 	"unique(identifier.namespace,identifier.value)": ["identifier", ["namespace", "value"]],
-	"unique(intent.digest)": ["intent", ["digest"]],
-	"unique(intent.flowId)": ["intent", ["flowId"]],
-	"unique(intent.moduleId,intent.commandId)": ["intent", ["moduleId", "commandId"]],
 	"unique(intent.moduleId,intent.flowId)": ["intent", ["moduleId", "flowId"]],
-	"unique(intent.moduleId,intent.intentId)": ["intent", ["moduleId", "intentId"]],
 	"unique(intent.moduleId,intent.reference)": ["intent", ["moduleId", "reference"]],
 	"unique(ownership.identityKey)": ["ownership", ["identityKey"]],
-	"unique(pending.digest)": ["pending", ["digest"]],
-	"unique(pending.flowId)": ["pending", ["flowId"]],
-	"unique(rateScope.moduleId,rateScope.purpose,rateScope.action,rateScope.scopeKind,rateScope.scopeKey)": ["rateScope", [
-		"moduleId",
-		"purpose",
-		"action",
-		"scopeKind",
-		"scopeKey"
-	]],
-	"unique(registration.moduleId,registration.requestId)": ["registration", ["moduleId", "requestId"]],
-	"unique(registration.recoveryReference)": ["registration", ["recoveryReference"]],
-	"unique(registrationCommand.moduleId,registrationCommand.commandId)": ["command", ["moduleId", "commandId"]],
-	"unique(request.moduleId,request.requestId)": ["request", ["moduleId", "requestId"]],
-	"unique(series.moduleId,series.purpose,series.scopeKey)": ["series", [
+	"unique(proof.moduleId,proof.purpose,proof.seriesKey)": ["proof", [
 		"moduleId",
 		"purpose",
-		"scopeKey"
+		"seriesKey"
 	]],
+	"unique(proof.moduleId,proof.proofId)": ["proof", ["moduleId", "proofId"]],
+	"unique(pending.digest)": ["pending", ["digest"]],
 	"unique(session.digest)": ["session", ["digest"]],
-	"unique(tombstone.subjectId,tombstone.sessionId)": ["tombstone", ["subjectId", "sessionId"]],
-	"unique(tuple.identityKey)": ["ownership.tuple", ["identityKey"]],
-	"unique(unlinkCommand.moduleId,unlinkCommand.commandId)": ["command", ["moduleId", "commandId"]]
+	"unique(tombstone.moduleId,tombstone.subjectId,tombstone.sessionId)": ["tombstone", [
+		"moduleId",
+		"subjectId",
+		"sessionId"
+	]]
 };
 const arrayRoles = {
 	credentialId: "credential",
+	credentialKey: "credential",
 	factor: "authority",
-	credentialOwnership: "credentialOwnership",
-	handleOwnership: "handleOwnership",
-	boundSubjectHandle: "handleOwnership",
-	flow: "flow",
-	command: "flow",
-	admission: "admission",
-	charge: "charge",
-	intentFlow: "intent",
-	intentCommand: "intent",
-	handle: "handle"
+	flow: "flow"
 };
 const nestedMappings = [
 	"read",
@@ -110,12 +58,7 @@ const nestedMappings = [
 	"session",
 	"source"
 ];
-const constraintGroups = [
-	"constraints",
-	"tupleConstraints",
-	"registrationConstraints",
-	"managementConstraints"
-];
+const constraintGroups = ["constraints"];
 const MappingRecord = Schema.Record(Schema.String, Schema.Unknown);
 const record = Schema.decodeUnknownSync(MappingRecord);
 const storageKeyPlans = (input, columnsFor) => {
@@ -154,7 +97,7 @@ const storageKeyPlans = (input, columnsFor) => {
 					keys = ["requestId"];
 				} else throw new Error("Unknown storage constraint");
 			} else if (Array.isArray(declaration) && declaration.every(Predicate.isString)) {
-				const mappedRole = group === "managementConstraints" && name === "command" ? "command" : arrayRoles[name];
+				const mappedRole = arrayRoles[name];
 				if (mappedRole === void 0) throw new Error("Unknown storage constraint");
 				role = mappedRole;
 				keys = declaration;
@@ -164,7 +107,6 @@ const storageKeyPlans = (input, columnsFor) => {
 			if (target === void 0 && Schema.is(MappingRecord)(mapping.pending)) target = mapping.pending[role];
 			let mapped = record(target);
 			if (role === "pending" && mapped.table === void 0) mapped = record(mapped.pending);
-			if (role === "ownership" && mapped.table === void 0) mapped = record(mapped.external ?? mapped.tuple);
 			if (!Predicate.isObject(mapped.table)) throw new Error("Missing storage table");
 			const columns = columnsFor(mapped.table);
 			result.push({

package/dist/internal/storage-plans.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"storage-plans.mjs","names":[],"sources":["../../src/internal/storage-plans.ts"],"sourcesContent":["import { Predicate, Schema } from \"effect\";\n\n// These are mapping contracts, not a parser for arbitrary constraint declarations.\n// Role aliases are explicit because their documentation names differ from mapping fields.\nconst uniquePlans: Readonly<Record<string, readonly [string, ReadonlyArray<string>]>> = {\n  \"unique(abuseEvent.moduleId,abuseEvent.action,abuseEvent.scopeKind,abuseEvent.scopeKey,abuseEvent.commandId)\":\n    [\"abuseEvent\", [\"moduleId\", \"action\", \"scopeKind\", \"scopeKey\", \"commandId\"]],\n  \"unique(admission.moduleId)\": [\"admission\", [\"moduleId\"]],\n  \"unique(attempt.moduleId,attempt.attemptId)\": [\"attempt\", [\"moduleId\", \"attemptId\"]],\n  \"unique(authority.subjectId,authority.credentialId)\": [\n    \"authority\",\n    [\"subjectId\", \"credentialId\"],\n  ],\n  \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\": [\n    \"authorityCredential\",\n    [\"subjectId\", \"credentialId\"],\n  ],\n  \"unique(command.moduleId,command.commandId)\": [\"command\", [\"moduleId\", \"commandId\"]],\n  \"unique(connectedAdmission.admissionId)\": [\"admission\", [\"admissionId\"]],\n  \"unique(connectedClient.clientKey)\": [\"client\", [\"clientKey\"]],\n  \"unique(connectedCohort.cohortKey)\": [\"cohort\", [\"cohortKey\"]],\n  \"unique(connectedCommand.moduleId,connectedCommand.commandId)\": [\n    \"command\",\n    [\"moduleId\", \"commandId\"],\n  ],\n  \"unique(connectedFlow.moduleId,connectedFlow.commandId)\": [\"flow\", [\"moduleId\", \"commandId\"]],\n  \"unique(connectedFlow.moduleId,connectedFlow.flowId)\": [\"flow\", [\"moduleId\", \"flowId\"]],\n  \"unique(connectedFlow.stateDigest)\": [\"flow\", [\"stateDigest\"]],\n  \"unique(connectedGrant.moduleId,connectedGrant.grantId)\": [\"grant\", [\"moduleId\", \"grantId\"]],\n  \"unique(connectedGrant.moduleId,connectedGrant.subjectId,connectedGrant.profileKey,connectedGrant.activeIdentityKey)\":\n    [\"grant\", [\"moduleId\", \"subjectId\", \"profileKey\", \"activeIdentityKey\"]],\n  \"unique(connectedRevocation.jobId)\": [\"job\", [\"jobId\"]],\n  \"unique(continuation.moduleId,continuation.continuationId)\": [\n    \"continuation\",\n    [\"moduleId\", \"continuationId\"],\n  ],\n  \"unique(continuation.moduleId,continuation.digest)\": [\"continuation\", [\"moduleId\", \"digest\"]],\n  \"unique(credential.credentialId)\": [\"credential\", [\"credentialId\"]],\n  \"unique(credential.identityKey)\": [\"credential\", [\"identityKey\"]],\n  \"unique(credential.moduleId,credential.credentialId)\": [\n    \"credential\",\n    [\"moduleId\", \"credentialId\"],\n  ],\n  \"unique(credential.moduleId,credential.subjectId)\": [\"credential\", [\"moduleId\", \"subjectId\"]],\n  \"unique(emailCommand.moduleId,emailCommand.commandId)\": [\"command\", [\"moduleId\", \"commandId\"]],\n  \"unique(emailCredential.moduleId,emailCredential.credentialId)\": [\n    \"credential\",\n    [\"moduleId\", \"credentialId\"],\n  ],\n  \"unique(emailCredential.moduleId,emailCredential.identifierNamespace,emailCredential.identifierValue)\":\n    [\"credential\", [\"moduleId\", \"identifierNamespace\", \"identifierValue\"]],\n  \"unique(emailRegistration.moduleId,emailRegistration.commandId)\": [\n    \"registration\",\n    [\"moduleId\", \"commandId\"],\n  ],\n  \"unique(emailRegistration.pendingReference)\": [\"registration\", [\"pendingReference\"]],\n  \"unique(failureEvent.moduleId,failureEvent.seriesKey,failureEvent.commandId)\": [\n    \"failureEvent\",\n    [\"moduleId\", \"seriesKey\", \"commandId\"],\n  ],\n  \"unique(flow.flowId)\": [\"flow\", [\"flowId\"]],\n  \"unique(flow.moduleId,flow.commandId)\": [\"flow\", [\"moduleId\", \"commandId\"]],\n  \"unique(flow.moduleId,flow.flowId)\": [\"flow\", [\"moduleId\", \"flowId\"]],\n  \"unique(flow.stateDigest)\": [\"flow\", [\"stateDigest\"]],\n  \"unique(generation.moduleId,generation.deliveryId)\": [\"generation\", [\"moduleId\", \"deliveryId\"]],\n  \"unique(generation.moduleId,generation.proofId)\": [\"generation\", [\"moduleId\", \"proofId\"]],\n  \"unique(identifier.namespace,identifier.value)\": [\"identifier\", [\"namespace\", \"value\"]],\n  \"unique(intent.digest)\": [\"intent\", [\"digest\"]],\n  \"unique(intent.flowId)\": [\"intent\", [\"flowId\"]],\n  \"unique(intent.moduleId,intent.commandId)\": [\"intent\", [\"moduleId\", \"commandId\"]],\n  \"unique(intent.moduleId,intent.flowId)\": [\"intent\", [\"moduleId\", \"flowId\"]],\n  \"unique(intent.moduleId,intent.intentId)\": [\"intent\", [\"moduleId\", \"intentId\"]],\n  \"unique(intent.moduleId,intent.reference)\": [\"intent\", [\"moduleId\", \"reference\"]],\n  \"unique(ownership.identityKey)\": [\"ownership\", [\"identityKey\"]],\n  \"unique(pending.digest)\": [\"pending\", [\"digest\"]],\n  \"unique(pending.flowId)\": [\"pending\", [\"flowId\"]],\n  \"unique(rateScope.moduleId,rateScope.purpose,rateScope.action,rateScope.scopeKind,rateScope.scopeKey)\":\n    [\"rateScope\", [\"moduleId\", \"purpose\", \"action\", \"scopeKind\", \"scopeKey\"]],\n  \"unique(registration.moduleId,registration.requestId)\": [\n    \"registration\",\n    [\"moduleId\", \"requestId\"],\n  ],\n  \"unique(registration.recoveryReference)\": [\"registration\", [\"recoveryReference\"]],\n  \"unique(registrationCommand.moduleId,registrationCommand.commandId)\": [\n    \"command\",\n    [\"moduleId\", \"commandId\"],\n  ],\n  \"unique(request.moduleId,request.requestId)\": [\"request\", [\"moduleId\", \"requestId\"]],\n  \"unique(series.moduleId,series.purpose,series.scopeKey)\": [\n    \"series\",\n    [\"moduleId\", \"purpose\", \"scopeKey\"],\n  ],\n  \"unique(session.digest)\": [\"session\", [\"digest\"]],\n  \"unique(tombstone.subjectId,tombstone.sessionId)\": [\"tombstone\", [\"subjectId\", \"sessionId\"]],\n  \"unique(tuple.identityKey)\": [\"ownership.tuple\", [\"identityKey\"]],\n  \"unique(unlinkCommand.moduleId,unlinkCommand.commandId)\": [\"command\", [\"moduleId\", \"commandId\"]],\n};\n\nconst arrayRoles: Readonly<Record<string, string>> = {\n  credentialId: \"credential\",\n  factor: \"authority\",\n  credentialOwnership: \"credentialOwnership\",\n  handleOwnership: \"handleOwnership\",\n  boundSubjectHandle: \"handleOwnership\",\n  flow: \"flow\",\n  command: \"flow\",\n  admission: \"admission\",\n  charge: \"charge\",\n  intentFlow: \"intent\",\n  intentCommand: \"intent\",\n  handle: \"handle\",\n};\n\nconst nestedMappings = [\n  \"read\",\n  \"signIn\",\n  \"password\",\n  \"proof\",\n  \"proofs\",\n  \"revocation\",\n  \"pending\",\n  \"session\",\n  \"source\",\n];\n\nconst constraintGroups = [\n  \"constraints\",\n  \"tupleConstraints\",\n  \"registrationConstraints\",\n  \"managementConstraints\",\n];\n\nconst MappingRecord = Schema.Record(Schema.String, Schema.Unknown);\nconst record = Schema.decodeUnknownSync(MappingRecord);\n\nexport const storageKeyPlans = (\n  input: unknown,\n  columnsFor: (table: object) => Readonly<Record<string, unknown>>,\n) => {\n  const mapping = record(input);\n  const result: Array<{ readonly table: object; readonly keys: ReadonlyArray<string> }> = [];\n\n  for (const group of constraintGroups) {\n    if (mapping[group] === undefined) continue;\n    for (const [name, declaration] of Object.entries(record(mapping[group]))) {\n      if (declaration === \"notNull(provisioningRequest.subjectId)\") continue;\n      let role: string;\n      let keys: ReadonlyArray<string>;\n\n      if (typeof declaration === \"string\") {\n        const plan = uniquePlans[declaration];\n\n        if (plan !== undefined) [role, keys] = plan;\n        else if (declaration === \"unique(id)\") {\n          role = \"subject\";\n          keys = [\"id\"];\n        } else if (declaration === \"unique(scope)\") {\n          role = name;\n          keys = [\"scope\"];\n        } else if (declaration === \"unique(credentialId)\") {\n          role = \"credential\";\n          keys = [\"id\"];\n        } else if (declaration === \"unique(namespace,value)\") {\n          role = \"identifier\";\n          keys = [\"namespace\", \"value\"];\n        } else if (declaration === \"unique(provider,issuer,subject)\") {\n          role = \"externalIdentity\";\n          keys = [\"provider\", \"issuer\", \"subject\"];\n        } else if (declaration === \"unique(requestId)\") {\n          role = \"provisioningRequest\";\n          keys = [\"requestId\"];\n        } else throw new Error(\"Unknown storage constraint\");\n      } else if (Array.isArray(declaration) && declaration.every(Predicate.isString)) {\n        const mappedRole =\n          group === \"managementConstraints\" && name === \"command\" ? \"command\" : arrayRoles[name];\n\n        if (mappedRole === undefined) throw new Error(\"Unknown storage constraint\");\n        role = mappedRole;\n        keys = declaration;\n      } else throw new Error(\"Invalid storage constraint\");\n\n      let target: unknown = mapping;\n\n      for (const segment of role.split(\".\")) target = record(target)[segment];\n      // Session authority places its pending tables in one nested mapping.\n      if (target === undefined && Schema.is(MappingRecord)(mapping.pending))\n        target = mapping.pending[role];\n      let mapped = record(target);\n\n      if (role === \"pending\" && mapped.table === undefined) mapped = record(mapped.pending);\n      // OAuth ownership can be integrated into its tuple authority or separate.\n      if (role === \"ownership\" && mapped.table === undefined)\n        mapped = record(mapped.external ?? mapped.tuple);\n      if (!Predicate.isObject(mapped.table)) throw new Error(\"Missing storage table\");\n      const columns = columnsFor(mapped.table);\n\n      result.push({\n        table: mapped.table,\n        keys: keys.map((key) => {\n          const value = mapped[key];\n\n          if (typeof value !== \"string\" || columns[value] === undefined)\n            throw new Error(\"Missing mapped key\");\n\n          return value;\n        }),\n      });\n    }\n  }\n  for (const nested of nestedMappings) {\n    const value = mapping[nested];\n\n    if (Schema.is(MappingRecord)(value) && value.table === undefined)\n      result.push(...storageKeyPlans(value, columnsFor));\n  }\n\n  return result;\n};\n"],"mappings":";;AAIA,MAAM,cAAkF;CACtF,+GACE,CAAC,cAAc;EAAC;EAAY;EAAU;EAAa;EAAY;CAAW,CAAC;CAC7E,8BAA8B,CAAC,aAAa,CAAC,UAAU,CAAC;CACxD,8CAA8C,CAAC,WAAW,CAAC,YAAY,WAAW,CAAC;CACnF,sDAAsD,CACpD,aACA,CAAC,aAAa,cAAc,CAC9B;CACA,0EAA0E,CACxE,uBACA,CAAC,aAAa,cAAc,CAC9B;CACA,8CAA8C,CAAC,WAAW,CAAC,YAAY,WAAW,CAAC;CACnF,0CAA0C,CAAC,aAAa,CAAC,aAAa,CAAC;CACvE,qCAAqC,CAAC,UAAU,CAAC,WAAW,CAAC;CAC7D,qCAAqC,CAAC,UAAU,CAAC,WAAW,CAAC;CAC7D,gEAAgE,CAC9D,WACA,CAAC,YAAY,WAAW,CAC1B;CACA,0DAA0D,CAAC,QAAQ,CAAC,YAAY,WAAW,CAAC;CAC5F,uDAAuD,CAAC,QAAQ,CAAC,YAAY,QAAQ,CAAC;CACtF,qCAAqC,CAAC,QAAQ,CAAC,aAAa,CAAC;CAC7D,0DAA0D,CAAC,SAAS,CAAC,YAAY,SAAS,CAAC;CAC3F,uHACE,CAAC,SAAS;EAAC;EAAY;EAAa;EAAc;CAAmB,CAAC;CACxE,qCAAqC,CAAC,OAAO,CAAC,OAAO,CAAC;CACtD,6DAA6D,CAC3D,gBACA,CAAC,YAAY,gBAAgB,CAC/B;CACA,qDAAqD,CAAC,gBAAgB,CAAC,YAAY,QAAQ,CAAC;CAC5F,mCAAmC,CAAC,cAAc,CAAC,cAAc,CAAC;CAClE,kCAAkC,CAAC,cAAc,CAAC,aAAa,CAAC;CAChE,uDAAuD,CACrD,cACA,CAAC,YAAY,cAAc,CAC7B;CACA,oDAAoD,CAAC,cAAc,CAAC,YAAY,WAAW,CAAC;CAC5F,wDAAwD,CAAC,WAAW,CAAC,YAAY,WAAW,CAAC;CAC7F,iEAAiE,CAC/D,cACA,CAAC,YAAY,cAAc,CAC7B;CACA,wGACE,CAAC,cAAc;EAAC;EAAY;EAAuB;CAAiB,CAAC;CACvE,kEAAkE,CAChE,gBACA,CAAC,YAAY,WAAW,CAC1B;CACA,8CAA8C,CAAC,gBAAgB,CAAC,kBAAkB,CAAC;CACnF,+EAA+E,CAC7E,gBACA;EAAC;EAAY;EAAa;CAAW,CACvC;CACA,uBAAuB,CAAC,QAAQ,CAAC,QAAQ,CAAC;CAC1C,wCAAwC,CAAC,QAAQ,CAAC,YAAY,WAAW,CAAC;CAC1E,qCAAqC,CAAC,QAAQ,CAAC,YAAY,QAAQ,CAAC;CACpE,4BAA4B,CAAC,QAAQ,CAAC,aAAa,CAAC;CACpD,qDAAqD,CAAC,cAAc,CAAC,YAAY,YAAY,CAAC;CAC9F,kDAAkD,CAAC,cAAc,CAAC,YAAY,SAAS,CAAC;CACxF,iDAAiD,CAAC,cAAc,CAAC,aAAa,OAAO,CAAC;CACtF,yBAAyB,CAAC,UAAU,CAAC,QAAQ,CAAC;CAC9C,yBAAyB,CAAC,UAAU,CAAC,QAAQ,CAAC;CAC9C,4CAA4C,CAAC,UAAU,CAAC,YAAY,WAAW,CAAC;CAChF,yCAAyC,CAAC,UAAU,CAAC,YAAY,QAAQ,CAAC;CAC1E,2CAA2C,CAAC,UAAU,CAAC,YAAY,UAAU,CAAC;CAC9E,4CAA4C,CAAC,UAAU,CAAC,YAAY,WAAW,CAAC;CAChF,iCAAiC,CAAC,aAAa,CAAC,aAAa,CAAC;CAC9D,0BAA0B,CAAC,WAAW,CAAC,QAAQ,CAAC;CAChD,0BAA0B,CAAC,WAAW,CAAC,QAAQ,CAAC;CAChD,wGACE,CAAC,aAAa;EAAC;EAAY;EAAW;EAAU;EAAa;CAAU,CAAC;CAC1E,wDAAwD,CACtD,gBACA,CAAC,YAAY,WAAW,CAC1B;CACA,0CAA0C,CAAC,gBAAgB,CAAC,mBAAmB,CAAC;CAChF,sEAAsE,CACpE,WACA,CAAC,YAAY,WAAW,CAC1B;CACA,8CAA8C,CAAC,WAAW,CAAC,YAAY,WAAW,CAAC;CACnF,0DAA0D,CACxD,UACA;EAAC;EAAY;EAAW;CAAU,CACpC;CACA,0BAA0B,CAAC,WAAW,CAAC,QAAQ,CAAC;CAChD,mDAAmD,CAAC,aAAa,CAAC,aAAa,WAAW,CAAC;CAC3F,6BAA6B,CAAC,mBAAmB,CAAC,aAAa,CAAC;CAChE,0DAA0D,CAAC,WAAW,CAAC,YAAY,WAAW,CAAC;AACjG;AAEA,MAAM,aAA+C;CACnD,cAAc;CACd,QAAQ;CACR,qBAAqB;CACrB,iBAAiB;CACjB,oBAAoB;CACpB,MAAM;CACN,SAAS;CACT,WAAW;CACX,QAAQ;CACR,YAAY;CACZ,eAAe;CACf,QAAQ;AACV;AAEA,MAAM,iBAAiB;CACrB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAEA,MAAM,mBAAmB;CACvB;CACA;CACA;CACA;AACF;AAEA,MAAM,gBAAgB,OAAO,OAAO,OAAO,QAAQ,OAAO,OAAO;AACjE,MAAM,SAAS,OAAO,kBAAkB,aAAa;AAErD,MAAa,mBACX,OACA,eACG;CACH,MAAM,UAAU,OAAO,KAAK;CAC5B,MAAM,SAAkF,CAAC;CAEzF,KAAK,MAAM,SAAS,kBAAkB;EACpC,IAAI,QAAQ,WAAW,KAAA,GAAW;EAClC,KAAK,MAAM,CAAC,MAAM,gBAAgB,OAAO,QAAQ,OAAO,QAAQ,MAAM,CAAC,GAAG;GACxE,IAAI,gBAAgB,0CAA0C;GAC9D,IAAI;GACJ,IAAI;GAEJ,IAAI,OAAO,gBAAgB,UAAU;IACnC,MAAM,OAAO,YAAY;IAEzB,IAAI,SAAS,KAAA,GAAW,CAAC,MAAM,QAAQ;SAClC,IAAI,gBAAgB,cAAc;KACrC,OAAO;KACP,OAAO,CAAC,IAAI;IACd,OAAO,IAAI,gBAAgB,iBAAiB;KAC1C,OAAO;KACP,OAAO,CAAC,OAAO;IACjB,OAAO,IAAI,gBAAgB,wBAAwB;KACjD,OAAO;KACP,OAAO,CAAC,IAAI;IACd,OAAO,IAAI,gBAAgB,2BAA2B;KACpD,OAAO;KACP,OAAO,CAAC,aAAa,OAAO;IAC9B,OAAO,IAAI,gBAAgB,mCAAmC;KAC5D,OAAO;KACP,OAAO;MAAC;MAAY;MAAU;KAAS;IACzC,OAAO,IAAI,gBAAgB,qBAAqB;KAC9C,OAAO;KACP,OAAO,CAAC,WAAW;IACrB,OAAO,MAAM,IAAI,MAAM,4BAA4B;GACrD,OAAO,IAAI,MAAM,QAAQ,WAAW,KAAK,YAAY,MAAM,UAAU,QAAQ,GAAG;IAC9E,MAAM,aACJ,UAAU,2BAA2B,SAAS,YAAY,YAAY,WAAW;IAEnF,IAAI,eAAe,KAAA,GAAW,MAAM,IAAI,MAAM,4BAA4B;IAC1E,OAAO;IACP,OAAO;GACT,OAAO,MAAM,IAAI,MAAM,4BAA4B;GAEnD,IAAI,SAAkB;GAEtB,KAAK,MAAM,WAAW,KAAK,MAAM,GAAG,GAAG,SAAS,OAAO,MAAM,CAAC,CAAC;GAE/D,IAAI,WAAW,KAAA,KAAa,OAAO,GAAG,aAAa,CAAC,CAAC,QAAQ,OAAO,GAClE,SAAS,QAAQ,QAAQ;GAC3B,IAAI,SAAS,OAAO,MAAM;GAE1B,IAAI,SAAS,aAAa,OAAO,UAAU,KAAA,GAAW,SAAS,OAAO,OAAO,OAAO;GAEpF,IAAI,SAAS,eAAe,OAAO,UAAU,KAAA,GAC3C,SAAS,OAAO,OAAO,YAAY,OAAO,KAAK;GACjD,IAAI,CAAC,UAAU,SAAS,OAAO,KAAK,GAAG,MAAM,IAAI,MAAM,uBAAuB;GAC9E,MAAM,UAAU,WAAW,OAAO,KAAK;GAEvC,OAAO,KAAK;IACV,OAAO,OAAO;IACd,MAAM,KAAK,KAAK,QAAQ;KACtB,MAAM,QAAQ,OAAO;KAErB,IAAI,OAAO,UAAU,YAAY,QAAQ,WAAW,KAAA,GAClD,MAAM,IAAI,MAAM,oBAAoB;KAEtC,OAAO;IACT,CAAC;GACH,CAAC;EACH;CACF;CACA,KAAK,MAAM,UAAU,gBAAgB;EACnC,MAAM,QAAQ,QAAQ;EAEtB,IAAI,OAAO,GAAG,aAAa,CAAC,CAAC,KAAK,KAAK,MAAM,UAAU,KAAA,GACrD,OAAO,KAAK,GAAG,gBAAgB,OAAO,UAAU,CAAC;CACrD;CAEA,OAAO;AACT"}
+{"version":3,"file":"storage-plans.mjs","names":[],"sources":["../../src/internal/storage-plans.ts"],"sourcesContent":["import { Predicate, Schema } from \"effect\";\n\n// These are mapping contracts, not a parser for arbitrary constraint declarations.\n// Role aliases are explicit because their documentation names differ from mapping fields.\nconst uniquePlans: Readonly<Record<string, readonly [string, ReadonlyArray<string>]>> = {\n  \"unique(authority.subjectId,authority.credentialId)\": [\n    \"authority\",\n    [\"subjectId\", \"credentialId\"],\n  ],\n  \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\": [\n    \"authorityCredential\",\n    [\"subjectId\", \"credentialId\"],\n  ],\n  \"unique(connectedGrant.moduleId,connectedGrant.grantId)\": [\"grant\", [\"moduleId\", \"grantId\"]],\n  \"unique(connectedGrant.moduleId,connectedGrant.subjectId,connectedGrant.profileKey,connectedGrant.identityKey)\":\n    [\"grant\", [\"moduleId\", \"subjectId\", \"profileKey\", \"identityKey\"]],\n  \"unique(connectedRevocation.jobId)\": [\"job\", [\"jobId\"]],\n  \"unique(credential.credentialId)\": [\"credential\", [\"credentialId\"]],\n  \"unique(credential.identityKey)\": [\"credential\", [\"identityKey\"]],\n  \"unique(credential.moduleId,credential.credentialId)\": [\n    \"credential\",\n    [\"moduleId\", \"credentialId\"],\n  ],\n  \"unique(credential.moduleId,credential.subjectId)\": [\"credential\", [\"moduleId\", \"subjectId\"]],\n  \"unique(emailCredential.moduleId,emailCredential.credentialId)\": [\n    \"credential\",\n    [\"moduleId\", \"credentialId\"],\n  ],\n  \"unique(emailCredential.moduleId,emailCredential.identifierNamespace,emailCredential.identifierValue)\":\n    [\"credential\", [\"moduleId\", \"identifierNamespace\", \"identifierValue\"]],\n  \"unique(flow.moduleId,flow.flowId)\": [\"flow\", [\"moduleId\", \"flowId\"]],\n  \"unique(flow.stateDigest)\": [\"flow\", [\"stateDigest\"]],\n  \"unique(identifier.namespace,identifier.value)\": [\"identifier\", [\"namespace\", \"value\"]],\n  \"unique(intent.moduleId,intent.flowId)\": [\"intent\", [\"moduleId\", \"flowId\"]],\n  \"unique(intent.moduleId,intent.reference)\": [\"intent\", [\"moduleId\", \"reference\"]],\n  \"unique(ownership.identityKey)\": [\"ownership\", [\"identityKey\"]],\n  \"unique(proof.moduleId,proof.purpose,proof.seriesKey)\": [\n    \"proof\",\n    [\"moduleId\", \"purpose\", \"seriesKey\"],\n  ],\n  \"unique(proof.moduleId,proof.proofId)\": [\"proof\", [\"moduleId\", \"proofId\"]],\n  \"unique(pending.digest)\": [\"pending\", [\"digest\"]],\n  \"unique(session.digest)\": [\"session\", [\"digest\"]],\n  \"unique(tombstone.moduleId,tombstone.subjectId,tombstone.sessionId)\": [\n    \"tombstone\",\n    [\"moduleId\", \"subjectId\", \"sessionId\"],\n  ],\n};\n\nconst arrayRoles: Readonly<Record<string, string>> = {\n  credentialId: \"credential\",\n  credentialKey: \"credential\",\n  factor: \"authority\",\n  flow: \"flow\",\n};\n\nconst nestedMappings = [\n  \"read\",\n  \"signIn\",\n  \"password\",\n  \"proof\",\n  \"proofs\",\n  \"revocation\",\n  \"pending\",\n  \"session\",\n  \"source\",\n];\n\nconst constraintGroups = [\"constraints\"];\n\nconst MappingRecord = Schema.Record(Schema.String, Schema.Unknown);\nconst record = Schema.decodeUnknownSync(MappingRecord);\n\nexport const storageKeyPlans = (\n  input: unknown,\n  columnsFor: (table: object) => Readonly<Record<string, unknown>>,\n) => {\n  const mapping = record(input);\n  const result: Array<{ readonly table: object; readonly keys: ReadonlyArray<string> }> = [];\n\n  for (const group of constraintGroups) {\n    if (mapping[group] === undefined) continue;\n    for (const [name, declaration] of Object.entries(record(mapping[group]))) {\n      if (declaration === \"notNull(provisioningRequest.subjectId)\") continue;\n      let role: string;\n      let keys: ReadonlyArray<string>;\n\n      if (typeof declaration === \"string\") {\n        const plan = uniquePlans[declaration];\n\n        if (plan !== undefined) [role, keys] = plan;\n        else if (declaration === \"unique(id)\") {\n          role = \"subject\";\n          keys = [\"id\"];\n        } else if (declaration === \"unique(scope)\") {\n          role = name;\n          keys = [\"scope\"];\n        } else if (declaration === \"unique(credentialId)\") {\n          role = \"credential\";\n          keys = [\"id\"];\n        } else if (declaration === \"unique(namespace,value)\") {\n          role = \"identifier\";\n          keys = [\"namespace\", \"value\"];\n        } else if (declaration === \"unique(provider,issuer,subject)\") {\n          role = \"externalIdentity\";\n          keys = [\"provider\", \"issuer\", \"subject\"];\n        } else if (declaration === \"unique(requestId)\") {\n          role = \"provisioningRequest\";\n          keys = [\"requestId\"];\n        } else throw new Error(\"Unknown storage constraint\");\n      } else if (Array.isArray(declaration) && declaration.every(Predicate.isString)) {\n        const mappedRole = arrayRoles[name];\n\n        if (mappedRole === undefined) throw new Error(\"Unknown storage constraint\");\n        role = mappedRole;\n        keys = declaration;\n      } else throw new Error(\"Invalid storage constraint\");\n\n      let target: unknown = mapping;\n\n      for (const segment of role.split(\".\")) target = record(target)[segment];\n      // Session authority places its pending tables in one nested mapping.\n      if (target === undefined && Schema.is(MappingRecord)(mapping.pending))\n        target = mapping.pending[role];\n      let mapped = record(target);\n\n      if (role === \"pending\" && mapped.table === undefined) mapped = record(mapped.pending);\n      if (!Predicate.isObject(mapped.table)) throw new Error(\"Missing storage table\");\n      const columns = columnsFor(mapped.table);\n\n      result.push({\n        table: mapped.table,\n        keys: keys.map((key) => {\n          const value = mapped[key];\n\n          if (typeof value !== \"string\" || columns[value] === undefined)\n            throw new Error(\"Missing mapped key\");\n\n          return value;\n        }),\n      });\n    }\n  }\n  for (const nested of nestedMappings) {\n    const value = mapping[nested];\n\n    if (Schema.is(MappingRecord)(value) && value.table === undefined)\n      result.push(...storageKeyPlans(value, columnsFor));\n  }\n\n  return result;\n};\n"],"mappings":";;AAIA,MAAM,cAAkF;CACtF,sDAAsD,CACpD,aACA,CAAC,aAAa,cAAc,CAC9B;CACA,0EAA0E,CACxE,uBACA,CAAC,aAAa,cAAc,CAC9B;CACA,0DAA0D,CAAC,SAAS,CAAC,YAAY,SAAS,CAAC;CAC3F,iHACE,CAAC,SAAS;EAAC;EAAY;EAAa;EAAc;CAAa,CAAC;CAClE,qCAAqC,CAAC,OAAO,CAAC,OAAO,CAAC;CACtD,mCAAmC,CAAC,cAAc,CAAC,cAAc,CAAC;CAClE,kCAAkC,CAAC,cAAc,CAAC,aAAa,CAAC;CAChE,uDAAuD,CACrD,cACA,CAAC,YAAY,cAAc,CAC7B;CACA,oDAAoD,CAAC,cAAc,CAAC,YAAY,WAAW,CAAC;CAC5F,iEAAiE,CAC/D,cACA,CAAC,YAAY,cAAc,CAC7B;CACA,wGACE,CAAC,cAAc;EAAC;EAAY;EAAuB;CAAiB,CAAC;CACvE,qCAAqC,CAAC,QAAQ,CAAC,YAAY,QAAQ,CAAC;CACpE,4BAA4B,CAAC,QAAQ,CAAC,aAAa,CAAC;CACpD,iDAAiD,CAAC,cAAc,CAAC,aAAa,OAAO,CAAC;CACtF,yCAAyC,CAAC,UAAU,CAAC,YAAY,QAAQ,CAAC;CAC1E,4CAA4C,CAAC,UAAU,CAAC,YAAY,WAAW,CAAC;CAChF,iCAAiC,CAAC,aAAa,CAAC,aAAa,CAAC;CAC9D,wDAAwD,CACtD,SACA;EAAC;EAAY;EAAW;CAAW,CACrC;CACA,wCAAwC,CAAC,SAAS,CAAC,YAAY,SAAS,CAAC;CACzE,0BAA0B,CAAC,WAAW,CAAC,QAAQ,CAAC;CAChD,0BAA0B,CAAC,WAAW,CAAC,QAAQ,CAAC;CAChD,sEAAsE,CACpE,aACA;EAAC;EAAY;EAAa;CAAW,CACvC;AACF;AAEA,MAAM,aAA+C;CACnD,cAAc;CACd,eAAe;CACf,QAAQ;CACR,MAAM;AACR;AAEA,MAAM,iBAAiB;CACrB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAEA,MAAM,mBAAmB,CAAC,aAAa;AAEvC,MAAM,gBAAgB,OAAO,OAAO,OAAO,QAAQ,OAAO,OAAO;AACjE,MAAM,SAAS,OAAO,kBAAkB,aAAa;AAErD,MAAa,mBACX,OACA,eACG;CACH,MAAM,UAAU,OAAO,KAAK;CAC5B,MAAM,SAAkF,CAAC;CAEzF,KAAK,MAAM,SAAS,kBAAkB;EACpC,IAAI,QAAQ,WAAW,KAAA,GAAW;EAClC,KAAK,MAAM,CAAC,MAAM,gBAAgB,OAAO,QAAQ,OAAO,QAAQ,MAAM,CAAC,GAAG;GACxE,IAAI,gBAAgB,0CAA0C;GAC9D,IAAI;GACJ,IAAI;GAEJ,IAAI,OAAO,gBAAgB,UAAU;IACnC,MAAM,OAAO,YAAY;IAEzB,IAAI,SAAS,KAAA,GAAW,CAAC,MAAM,QAAQ;SAClC,IAAI,gBAAgB,cAAc;KACrC,OAAO;KACP,OAAO,CAAC,IAAI;IACd,OAAO,IAAI,gBAAgB,iBAAiB;KAC1C,OAAO;KACP,OAAO,CAAC,OAAO;IACjB,OAAO,IAAI,gBAAgB,wBAAwB;KACjD,OAAO;KACP,OAAO,CAAC,IAAI;IACd,OAAO,IAAI,gBAAgB,2BAA2B;KACpD,OAAO;KACP,OAAO,CAAC,aAAa,OAAO;IAC9B,OAAO,IAAI,gBAAgB,mCAAmC;KAC5D,OAAO;KACP,OAAO;MAAC;MAAY;MAAU;KAAS;IACzC,OAAO,IAAI,gBAAgB,qBAAqB;KAC9C,OAAO;KACP,OAAO,CAAC,WAAW;IACrB,OAAO,MAAM,IAAI,MAAM,4BAA4B;GACrD,OAAO,IAAI,MAAM,QAAQ,WAAW,KAAK,YAAY,MAAM,UAAU,QAAQ,GAAG;IAC9E,MAAM,aAAa,WAAW;IAE9B,IAAI,eAAe,KAAA,GAAW,MAAM,IAAI,MAAM,4BAA4B;IAC1E,OAAO;IACP,OAAO;GACT,OAAO,MAAM,IAAI,MAAM,4BAA4B;GAEnD,IAAI,SAAkB;GAEtB,KAAK,MAAM,WAAW,KAAK,MAAM,GAAG,GAAG,SAAS,OAAO,MAAM,CAAC,CAAC;GAE/D,IAAI,WAAW,KAAA,KAAa,OAAO,GAAG,aAAa,CAAC,CAAC,QAAQ,OAAO,GAClE,SAAS,QAAQ,QAAQ;GAC3B,IAAI,SAAS,OAAO,MAAM;GAE1B,IAAI,SAAS,aAAa,OAAO,UAAU,KAAA,GAAW,SAAS,OAAO,OAAO,OAAO;GACpF,IAAI,CAAC,UAAU,SAAS,OAAO,KAAK,GAAG,MAAM,IAAI,MAAM,uBAAuB;GAC9E,MAAM,UAAU,WAAW,OAAO,KAAK;GAEvC,OAAO,KAAK;IACV,OAAO,OAAO;IACd,MAAM,KAAK,KAAK,QAAQ;KACtB,MAAM,QAAQ,OAAO;KAErB,IAAI,OAAO,UAAU,YAAY,QAAQ,WAAW,KAAA,GAClD,MAAM,IAAI,MAAM,oBAAoB;KAEtC,OAAO;IACT,CAAC;GACH,CAAC;EACH;CACF;CACA,KAAK,MAAM,UAAU,gBAAgB;EACnC,MAAM,QAAQ,QAAQ;EAEtB,IAAI,OAAO,GAAG,aAAa,CAAC,CAAC,KAAK,KAAK,MAAM,UAAU,KAAA,GACrD,OAAO,KAAK,GAAG,gBAAgB,OAAO,UAAU,CAAC;CACrD;CAEA,OAAO;AACT"}