@yielded/auth-persistence 0.1.0-beta.24 → 0.1.0-beta.26

package/dist/internal/email-kernel.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"email-kernel.mjs","names":[],"sources":["../../src/internal/email-kernel.ts"],"sourcesContent":["import {\n  EmailAddressPersistence,\n  type EmailAddressMutation,\n  type EmailAction,\n  type EmailCredentialSnapshot,\n  EmailSignInTargets,\n  EmailUnavailable,\n  snapshotEmailCredential,\n  snapshotEmailRequirement,\n  snapshotEmailRevision,\n} from \"@yielded/auth/Email\";\nimport {\n  coordinateCommit,\n  CurrentCommitJournal,\n  hasCommitScope,\n  type CommitJournal,\n  type PreparedCommit,\n  LifecycleHooks,\n  HookConfigurationError,\n} from \"@yielded/auth/Hooks\";\nimport type { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport { reportPersistenceFailure } from \"@yielded/auth/Persistence\";\nimport {\n  ProofUnavailable,\n  type ProofCompletionDecision,\n  type ProofCompletionInput,\n} from \"@yielded/auth/Proofs\";\nimport {\n  assessAuthentication,\n  snapshotAuthenticationEvidence,\n  type AuthenticationRevision,\n  type SecurityRevision,\n} from \"@yielded/auth/Sessions\";\nimport { Cause, Context, DateTime, Effect, Option, Schema } from \"effect\";\nimport type * as SqlError from \"effect/sql/SqlError\";\n\nimport { isMappedConstraintConflict, PersistenceMappingError } from \"./mapping-error\";\nimport {\n  type AnyEmailAddressMapping,\n  type AnyEmailSignInMapping,\n  requiredEmailAddressConstraints,\n  requiredEmailSignInConstraints,\n} from \"./models/email-model\";\nimport {\n  CurrentProofSql,\n  type makeProofKernel,\n  type ProofSqlConfiguration,\n  type ProofSqlDatabase,\n} from \"./proof-kernel\";\n/* oxlint-disable no-explicit-any -- the shared dialect kernel erases consumer Drizzle table types internally. */\nimport type { QueryFailure } from \"./query-operations\";\nimport type { QueryOperations, SqlFragment, SqlColumn } from \"./query-operations\";\nimport type { NativeDatabase } from \"./transaction-kernel\";\n\ntype AdapterFailure = QueryFailure | PersistenceMappingError | SqlError.SqlError;\ntype SignInMapping = AnyEmailSignInMapping;\n\nexport interface EmailSqlQuery<A = ReadonlyArray<any>> extends Effect.Effect<A, AdapterFailure> {\n  readonly getSQL: () => ReturnType<QueryOperations[\"sql\"]>;\n  readonly from: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly where: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly limit: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly orderBy: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly for: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly set: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly values: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly returning: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly innerJoin: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly onConflictDoNothing: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly onDuplicateKeyUpdate: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly $returningId: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n}\n\nexport interface EmailSqlDatabase {\n  readonly select: (...args: ReadonlyArray<any>) => EmailSqlQuery;\n  readonly insert: (...args: ReadonlyArray<any>) => EmailSqlQuery;\n  readonly update: (...args: ReadonlyArray<any>) => EmailSqlQuery;\n  readonly delete: (...args: ReadonlyArray<any>) => EmailSqlQuery;\n  readonly transaction: <A, E, R>(\n    body: (transaction: EmailSqlDatabase) => Effect.Effect<A, E, R>,\n  ) => Effect.Effect<A, E | SqlError.SqlError, R>;\n}\n\nexport class CurrentEmailSql extends Context.Service<CurrentEmailSql, EmailSqlDatabase>()(\n  \"effect-auth/CurrentEmailSql\",\n) {}\n\nexport interface EmailSqlConfiguration {\n  readonly mode: \"interactive\" | \"synchronous\";\n  readonly locking: boolean;\n  readonly standaloneGuard: Effect.Effect<void, EmailUnavailable>;\n  readonly coordinated?: boolean;\n  readonly proof?: {\n    readonly mapping: any;\n    readonly configuration: ProofSqlConfiguration;\n  };\n}\n\nexport interface CurrentAddress {\n  readonly nativeSubjectId: unknown;\n  readonly subject: any;\n  readonly revision: AuthenticationRevision;\n  readonly source?: {\n    readonly credential: any;\n    readonly identifier: any;\n    readonly snapshot: EmailCredentialSnapshot;\n  };\n  readonly targetIdentifier?: any;\n  readonly targetCredential?: any;\n  readonly targetIdentifierRevision?: SecurityRevision;\n  readonly eligible: boolean;\n}\n\nexport const makeEmailKernel = <\n  Fragment extends SqlFragment = SqlFragment,\n  Column extends SqlColumn = SqlColumn,\n>(\n  operations: QueryOperations<Fragment, Column>,\n  proofs: Pick<ReturnType<typeof makeProofKernel>, \"completeProofPlanIn\">,\n) => {\n  type AddressMapping = AnyEmailAddressMapping<Fragment>;\n\n  const { and, eq, inArray, lte, column, updateValues } = operations;\n  const { completeProofPlanIn } = proofs;\n  const unavailable = () => EmailUnavailable.make({});\n\n  const translateFailure = <A, E, R>(\n    effect: Effect.Effect<A, E, R>,\n  ): Effect.Effect<A, EmailUnavailable, R> =>\n    reportPersistenceFailure(\n      effect,\n      (error) =>\n        Schema.is(EmailUnavailable)(error) ||\n        Schema.is(ProofUnavailable)(error) ||\n        Schema.is(HookConfigurationError)(error),\n    ).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));\n\n  const nowMillis = Effect.map(DateTime.now, DateTime.toEpochMillis);\n\n  const selectRows = (query: EmailSqlQuery, locking: boolean) =>\n    locking && typeof query.for === \"function\" ? query.for(\"update\") : query;\n\n  const sameIdentifier = (left: LoginIdentifier, right: LoginIdentifier) =>\n    left.namespace === right.namespace && left.value === right.value;\n\n  const validEmailSignInConstraints = (mapping: SignInMapping) =>\n    Object.entries(requiredEmailSignInConstraints).every(\n      ([key, value]) =>\n        mapping.constraints[key as keyof typeof requiredEmailSignInConstraints] === value,\n    );\n\n  const validAddressConstraints = (mapping: AddressMapping) =>\n    Object.entries(requiredEmailAddressConstraints).every(\n      ([key, value]) =>\n        mapping.constraints[key as keyof typeof requiredEmailAddressConstraints] === value,\n    );\n\n  const subjectColumns = (mapping: SignInMapping) => ({\n    id: column(mapping.subject.table, mapping.subject.id),\n    status: column(mapping.subject.table, mapping.subject.status),\n    securityRevision: column(mapping.subject.table, mapping.subject.securityRevision),\n  });\n\n  const identifierColumns = (mapping: SignInMapping) => ({\n    namespace: column(mapping.identifier.table, mapping.identifier.namespace),\n    value: column(mapping.identifier.table, mapping.identifier.value),\n    subjectId: column(mapping.identifier.table, mapping.identifier.subjectId),\n    verifiedAt: column(mapping.identifier.table, mapping.identifier.verifiedAt),\n    bindingRevision: column(mapping.identifier.table, mapping.identifier.bindingRevision),\n  });\n\n  const credentialColumns = (mapping: SignInMapping) => ({\n    moduleId: column(mapping.credential.table, mapping.credential.moduleId),\n    subjectId: column(mapping.credential.table, mapping.credential.subjectId),\n    credentialId: column(mapping.credential.table, mapping.credential.credentialId),\n    identifierNamespace: column(mapping.credential.table, mapping.credential.identifierNamespace),\n    identifierValue: column(mapping.credential.table, mapping.credential.identifierValue),\n    credentialRevision: column(mapping.credential.table, mapping.credential.credentialRevision),\n    status: column(mapping.credential.table, mapping.credential.status),\n  });\n\n  const authorityColumns = (mapping: AddressMapping) => ({\n    subjectId: column(mapping.authorityCredential.table, mapping.authorityCredential.subjectId),\n    credentialId: column(\n      mapping.authorityCredential.table,\n      mapping.authorityCredential.credentialId,\n    ),\n    revision: column(mapping.authorityCredential.table, mapping.authorityCredential.revision),\n    status: column(mapping.authorityCredential.table, mapping.authorityCredential.status),\n  });\n\n  const commandColumns = (mapping: AddressMapping) => ({\n    moduleId: column(mapping.command.table, mapping.command.moduleId),\n    commandId: column(mapping.command.table, mapping.command.commandId),\n    action: column(mapping.command.table, mapping.command.action),\n    bindingDigest: column(mapping.command.table, mapping.command.bindingDigest),\n    retentionUntil: column(mapping.command.table, mapping.command.retentionUntil),\n  });\n\n  const allocate = <A>(\n    mode: EmailSqlConfiguration[\"mode\"],\n    asynchronous: Effect.Effect<A, PersistenceMappingError> | undefined,\n    synchronous: (() => A) | undefined,\n  ) => {\n    if (mode === \"synchronous\")\n      return synchronous === undefined\n        ? Effect.fail(unavailable())\n        : Effect.try({\n            try: synchronous,\n            catch: (cause) => new PersistenceMappingError({ operation: \"mapping\", cause }),\n          });\n    if (asynchronous !== undefined) return asynchronous;\n\n    return synchronous === undefined\n      ? Effect.fail(unavailable())\n      : Effect.try({\n          try: synchronous,\n          catch: (cause) => new PersistenceMappingError({ operation: \"mapping\", cause }),\n        });\n  };\n\n  const nextSecurityRevision = (\n    mapping: AddressMapping,\n    mode: EmailSqlConfiguration[\"mode\"],\n    current: SecurityRevision,\n  ) => {\n    if (mode === \"synchronous\")\n      return mapping.subject.nextSecurityRevisionSync === undefined\n        ? Effect.fail(unavailable())\n        : Effect.try({\n            try: () => mapping.subject.nextSecurityRevisionSync!(current),\n            catch: (cause) => new PersistenceMappingError({ operation: \"mapping\", cause }),\n          });\n    if (mapping.subject.nextSecurityRevision !== undefined)\n      return mapping.subject.nextSecurityRevision(current);\n    if (mapping.subject.nextSecurityRevisionSync !== undefined)\n      return Effect.try({\n        try: () => mapping.subject.nextSecurityRevisionSync!(current),\n        catch: (cause) => new PersistenceMappingError({ operation: \"mapping\", cause }),\n      });\n\n    return Effect.fail(unavailable());\n  };\n\n  const safeRead = <A, E, R>(\n    database: EmailSqlDatabase,\n    configuration: EmailSqlConfiguration,\n    body: Effect.Effect<A, E, R>,\n  ) =>\n    Effect.gen(function* () {\n      if (configuration.coordinated !== true) {\n        if (yield* hasCommitScope) return yield* unavailable();\n        yield* configuration.standaloneGuard;\n      }\n\n      return yield* database.transaction((transaction) =>\n        body.pipe(\n          Effect.provideService(CurrentEmailSql, transaction),\n          Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),\n        ),\n      );\n    });\n\n  const owned = <A, E, R>(\n    database: EmailSqlDatabase,\n    configuration: EmailSqlConfiguration,\n    body: Effect.Effect<A, E, R>,\n  ) => {\n    const run = coordinateCommit(\n      () =>\n        database.transaction((transaction) =>\n          body.pipe(\n            Effect.provideService(CurrentEmailSql, transaction),\n            Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),\n          ),\n        ),\n      { mode: configuration.mode },\n    ).pipe(Effect.map((result) => result.value));\n\n    return configuration.coordinated !== true\n      ? Effect.gen(function* () {\n          if (yield* hasCommitScope) return yield* unavailable();\n          yield* configuration.standaloneGuard;\n\n          return yield* run;\n        })\n      : run;\n  };\n\n  const emailLookupQuery = (\n    mapping: SignInMapping,\n    moduleId: string,\n    identifier: LoginIdentifier,\n  ) => {\n    const subject = subjectColumns(mapping),\n      binding = identifierColumns(mapping),\n      credential = credentialColumns(mapping);\n\n    return {\n      fields: {\n        subject: mapping.subject.table,\n        identifier: mapping.identifier.table,\n        credential: mapping.credential.table,\n      },\n      from: mapping.identifier.table,\n      subjectTable: mapping.subject.table,\n      subjectJoin: eq(subject.id, binding.subjectId),\n      credentialTable: mapping.credential.table,\n      credentialJoin: and(\n        eq(credential.moduleId, moduleId),\n        eq(credential.subjectId, binding.subjectId),\n        eq(credential.identifierNamespace, binding.namespace),\n        eq(credential.identifierValue, binding.value),\n      ),\n      predicate: and(\n        eq(binding.namespace, identifier.namespace),\n        eq(binding.value, identifier.value),\n      ),\n      limit: 1,\n    };\n  };\n\n  const emailLookupRows = Effect.fn(\"Drizzle.emailLookupRows\")(function* (\n    mapping: SignInMapping,\n    moduleId: string,\n    identifier: LoginIdentifier,\n  ) {\n    const database = yield* CurrentEmailSql;\n    const query = emailLookupQuery(mapping, moduleId, identifier);\n\n    return yield* database\n      .select(query.fields)\n      .from(query.from)\n      .innerJoin(query.subjectTable, query.subjectJoin)\n      .innerJoin(query.credentialTable, query.credentialJoin)\n      .where(query.predicate)\n      .limit(query.limit);\n  });\n\n  const decodeEmailSnapshot = Effect.fn(\"DrizzleEmail.decodeSnapshot\")(function* (\n    mapping: SignInMapping,\n    moduleId: string,\n    requested: LoginIdentifier,\n    row: any,\n  ) {\n    if (\n      !mapping.subject.isActiveStatus(row.subject[mapping.subject.status]) ||\n      !mapping.identifier.isCurrent(row.identifier) ||\n      !mapping.credential.isActiveStatus(row.credential[mapping.credential.status])\n    )\n      return undefined;\n\n    const snapshot = yield* mapping.credential\n      .decode({\n        moduleId,\n        subject: row.subject,\n        identifier: row.identifier,\n        credential: row.credential,\n      })\n      .pipe(Effect.flatMap(snapshotEmailCredential));\n\n    const subjectId = yield* mapping.subjectId.toSubject(row.subject[mapping.subject.id]);\n\n    const verifiedAtMillis = yield* mapping.decodeInstant(\n      row.identifier[mapping.identifier.verifiedAt],\n    );\n\n    if (\n      snapshot.moduleId !== moduleId ||\n      !sameIdentifier(snapshot.identifier, requested) ||\n      snapshot.revision.subjectId !== subjectId ||\n      snapshot.revision.securityRevision !== row.subject[mapping.subject.securityRevision] ||\n      snapshot.identifierRevision !== row.identifier[mapping.identifier.bindingRevision] ||\n      snapshot.verifiedAtMillis !== verifiedAtMillis ||\n      snapshot.credentialId !== row.credential[mapping.credential.credentialId] ||\n      snapshot.credentialRevision !== row.credential[mapping.credential.credentialRevision]\n    )\n      return undefined;\n\n    return snapshot;\n  });\n\n  const makeSqlEmailSignInTargets = Effect.fn(\"makeSqlEmailSignInTargets\")(function* (\n    mapping: SignInMapping,\n    configuration: EmailSqlConfiguration,\n  ): Effect.fn.Return<\n    EmailSignInTargets[\"Service\"],\n    EmailUnavailable,\n    CurrentEmailSql | NativeDatabase\n  > {\n    const database = yield* CurrentEmailSql;\n\n    if (!configuration.coordinated)\n      yield* (\n        operations.validateStorage?.({\n          ...mapping,\n          proof: configuration.proof?.mapping,\n        }) ?? Effect.void\n      ).pipe(Effect.mapError(unavailable));\n\n    return EmailSignInTargets.of({\n      lookup: (input) =>\n        (validEmailSignInConstraints(mapping)\n          ? safeRead(\n              database,\n              configuration,\n              Effect.gen(function* () {\n                const row = (yield* emailLookupRows(mapping, input.moduleId, input.identifier))[0];\n\n                if (row === undefined) return Option.none();\n\n                const snapshot = yield* decodeEmailSnapshot(\n                  mapping,\n                  input.moduleId,\n                  input.identifier,\n                  row,\n                );\n\n                return snapshot === undefined ? Option.none() : Option.some(snapshot);\n              }),\n            )\n          : Effect.fail(unavailable())\n        ).pipe(Effect.provideService(CurrentEmailSql, database), translateFailure),\n    });\n  });\n\n  const readSubject = Effect.fn(\"DrizzleEmail.readSubject\")(function* (\n    mapping: AddressMapping,\n    subjectId: string,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentEmailSql;\n\n    const nativeSubjectId = yield* mapping.subjectId.toNative(subjectId as any);\n    const s = subjectColumns(mapping);\n\n    const subject = (yield* selectRows(\n      database.select().from(mapping.subject.table).where(eq(s.id, nativeSubjectId)).limit(1),\n      locking,\n    ))[0];\n\n    return { nativeSubjectId, subject };\n  });\n\n  const identifierRow = Effect.fn(\"Drizzle.identifierRow\")(function* (\n    mapping: SignInMapping,\n    identifier: LoginIdentifier,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentEmailSql;\n\n    const i = identifierColumns(mapping);\n\n    return yield* selectRows(\n      database\n        .select()\n        .from(mapping.identifier.table)\n        .where(and(eq(i.namespace, identifier.namespace), eq(i.value, identifier.value)))\n        .limit(1),\n      locking,\n    );\n  });\n\n  const credentialById = Effect.fn(\"Drizzle.credentialById\")(function* (\n    mapping: SignInMapping,\n    moduleId: string,\n    credentialId: string,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentEmailSql;\n\n    const c = credentialColumns(mapping);\n\n    return yield* selectRows(\n      database\n        .select()\n        .from(mapping.credential.table)\n        .where(and(eq(c.moduleId, moduleId), eq(c.credentialId, credentialId)))\n        .limit(1),\n      locking,\n    );\n  });\n\n  const credentialByIdentifier = Effect.fn(\"Drizzle.credentialByIdentifier\")(function* (\n    mapping: SignInMapping,\n    moduleId: string,\n    identifier: LoginIdentifier,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentEmailSql;\n\n    const c = credentialColumns(mapping);\n\n    return yield* selectRows(\n      database\n        .select()\n        .from(mapping.credential.table)\n        .where(\n          and(\n            eq(c.moduleId, moduleId),\n            eq(c.identifierNamespace, identifier.namespace),\n            eq(c.identifierValue, identifier.value),\n          ),\n        )\n        .limit(1),\n      locking,\n    );\n  });\n\n  const currentAddress = Effect.fn(\"DrizzleEmail.currentAddress\")(function* (\n    mapping: AddressMapping,\n    input: {\n      readonly moduleId: string;\n      readonly subjectId: string;\n      readonly target: LoginIdentifier;\n      readonly sourceCredentialId?: string;\n    },\n    locking: boolean,\n  ) {\n    const database = yield* CurrentEmailSql;\n\n    const locked = yield* readSubject(mapping, input.subjectId, locking);\n\n    if (\n      locked.subject === undefined ||\n      !mapping.subject.isActiveStatus(locked.subject[mapping.subject.status])\n    )\n      return undefined;\n\n    const discoveredSource =\n      input.sourceCredentialId === undefined\n        ? undefined\n        : (yield* credentialById(mapping, input.moduleId, input.sourceCredentialId, false))[0];\n\n    const sourceIdentifier: LoginIdentifier | undefined =\n      discoveredSource === undefined\n        ? undefined\n        : {\n            namespace: discoveredSource[mapping.credential.identifierNamespace],\n            value: discoveredSource[mapping.credential.identifierValue],\n          };\n\n    const identifiers = [\n      input.target,\n      ...(sourceIdentifier === undefined ? [] : [sourceIdentifier]),\n    ]\n      .filter(\n        (value, index, values) =>\n          values.findIndex((candidate) => sameIdentifier(candidate, value)) === index,\n      )\n      .sort((left, right) =>\n        `${left.namespace}\\u0000${left.value}`.localeCompare(\n          `${right.namespace}\\u0000${right.value}`,\n        ),\n      );\n\n    const lockedIdentifiers = new Map<string, any>();\n\n    for (const identifier of identifiers) {\n      const row = (yield* identifierRow(mapping, identifier, locking))[0];\n\n      if (row !== undefined)\n        lockedIdentifiers.set(`${identifier.namespace}\\u0000${identifier.value}`, row);\n    }\n\n    const sourceCredential =\n      input.sourceCredentialId === undefined\n        ? undefined\n        : (yield* credentialById(mapping, input.moduleId, input.sourceCredentialId, locking))[0];\n\n    const targetCredential = (yield* credentialByIdentifier(\n      mapping,\n      input.moduleId,\n      input.target,\n      locking,\n    ))[0];\n\n    const a = authorityColumns(mapping);\n\n    const authority = yield* selectRows(\n      database\n        .select()\n        .from(mapping.authorityCredential.table)\n        .where(eq(a.subjectId, locked.nativeSubjectId))\n        .orderBy(a.credentialId),\n      locking,\n    );\n\n    const activeAuthority = authority.filter((row: any) =>\n      mapping.authorityCredential.isActiveStatus(row[mapping.authorityCredential.status]),\n    );\n\n    const subjectId = yield* mapping.subjectId.toSubject(locked.nativeSubjectId);\n\n    const revision: AuthenticationRevision = Object.freeze({\n      subjectId,\n      securityRevision: locked.subject[mapping.subject.securityRevision],\n      credentials: Object.freeze(\n        activeAuthority.map((row: any) =>\n          Object.freeze({\n            credentialId: row[mapping.authorityCredential.credentialId],\n            revision: row[mapping.authorityCredential.revision],\n          }),\n        ),\n      ),\n    });\n\n    const targetIdentifier = lockedIdentifiers.get(\n      `${input.target.namespace}\\u0000${input.target.value}`,\n    );\n\n    const targetOwned =\n      targetIdentifier !== undefined &&\n      mapping.subjectId.equals(\n        targetIdentifier[mapping.identifier.subjectId],\n        locked.nativeSubjectId,\n      );\n\n    const targetMutable =\n      targetOwned &&\n      mapping.identifier.isMutableTarget(targetIdentifier) &&\n      (targetCredential === undefined ||\n        (!mapping.credential.isActiveStatus(targetCredential[mapping.credential.status]) &&\n          mapping.subjectId.equals(\n            targetCredential[mapping.credential.subjectId],\n            locked.nativeSubjectId,\n          )));\n\n    let source: CurrentAddress[\"source\"];\n\n    if (input.sourceCredentialId !== undefined) {\n      if (\n        sourceCredential === undefined ||\n        sourceIdentifier === undefined ||\n        !mapping.subjectId.equals(\n          sourceCredential[mapping.credential.subjectId],\n          locked.nativeSubjectId,\n        ) ||\n        !mapping.credential.isActiveStatus(sourceCredential[mapping.credential.status])\n      )\n        return undefined;\n\n      const sourceIdentifierRow = lockedIdentifiers.get(\n        `${sourceIdentifier.namespace}\\u0000${sourceIdentifier.value}`,\n      );\n\n      if (\n        sourceIdentifierRow === undefined ||\n        !mapping.identifier.isCurrent(sourceIdentifierRow) ||\n        !mapping.subjectId.equals(\n          sourceIdentifierRow[mapping.identifier.subjectId],\n          locked.nativeSubjectId,\n        )\n      )\n        return undefined;\n\n      const snapshot = yield* mapping.credential\n        .decode({\n          moduleId: input.moduleId,\n          subject: locked.subject,\n          identifier: sourceIdentifierRow,\n          credential: sourceCredential,\n        })\n        .pipe(Effect.flatMap(snapshotEmailCredential));\n\n      source = { credential: sourceCredential, identifier: sourceIdentifierRow, snapshot };\n    }\n    let eligible = targetIdentifier === undefined ? targetCredential === undefined : targetMutable;\n\n    if (input.sourceCredentialId !== undefined && source === undefined) eligible = false;\n    if (source !== undefined && sameIdentifier(source.snapshot.identifier, input.target))\n      eligible = false;\n    if (mapping.addressCardinality === \"single\" && input.sourceCredentialId === undefined) {\n      const c = credentialColumns(mapping);\n\n      const rows = yield* selectRows(\n        database\n          .select()\n          .from(mapping.credential.table)\n          .where(and(eq(c.moduleId, input.moduleId), eq(c.subjectId, locked.nativeSubjectId))),\n        locking,\n      );\n\n      if (\n        rows.some((row: any) => mapping.credential.isActiveStatus(row[mapping.credential.status]))\n      )\n        eligible = false;\n    }\n\n    return {\n      nativeSubjectId: locked.nativeSubjectId,\n      subject: locked.subject,\n      revision,\n      ...(source === undefined ? {} : { source }),\n      ...(targetIdentifier === undefined ? {} : { targetIdentifier }),\n      ...(targetCredential === undefined ? {} : { targetCredential }),\n      ...(targetMutable\n        ? { targetIdentifierRevision: targetIdentifier[mapping.identifier.bindingRevision] }\n        : {}),\n      eligible,\n    };\n  });\n\n  const sameEmailRevision = (left: AuthenticationRevision, right: AuthenticationRevision) => {\n    if (\n      left.subjectId !== right.subjectId ||\n      left.securityRevision !== right.securityRevision ||\n      left.credentials.length !== right.credentials.length\n    )\n      return false;\n\n    const expected = [...left.credentials].sort((a, b) =>\n      a.credentialId.localeCompare(b.credentialId),\n    );\n\n    const actual = [...right.credentials].sort((a, b) =>\n      a.credentialId.localeCompare(b.credentialId),\n    );\n\n    return expected.every(\n      (item, index) =>\n        item.credentialId === actual[index]!.credentialId &&\n        item.revision === actual[index]!.revision,\n    );\n  };\n\n  const actionModule = (moduleId: string, action: EmailAction) =>\n    `${moduleId}/${action === \"verify-address\" ? \"verify-address\" : \"change-address\"}`;\n\n  const actionPurpose = (action: EmailAction) =>\n    action === \"verify-address\" ? \"email-address-verification\" : \"email-address-change\";\n\n  const completionMatches = (input: EmailAddressMutation, action: EmailAction) => {\n    const completion = input.completion.input;\n    const binding = completion.binding;\n\n    return (\n      completion.moduleId === actionModule(input.moduleId, action) &&\n      completion.purpose === actionPurpose(action) &&\n      binding._tag === \"IdentifierChange\" &&\n      sameIdentifier(binding.identifier, input.target) &&\n      sameEmailRevision(binding.revision, input.captured.revision)\n    );\n  };\n\n  const snapshotEmailMutation = Effect.fn(\"DrizzleEmail.snapshotMutation\")(function* (\n    input: EmailAddressMutation,\n  ) {\n    const evidence = yield* snapshotAuthenticationEvidence(input.authorization.evidence).pipe(\n      Effect.mapError(unavailable),\n    );\n\n    const requirement = yield* snapshotEmailRequirement(input.authorization.requirement);\n\n    const source =\n      input.captured.source === undefined\n        ? undefined\n        : yield* snapshotEmailCredential(input.captured.source);\n\n    return Object.freeze({\n      ...input,\n      target: Object.freeze({ ...input.target }),\n      ...(input.invalidation === undefined\n        ? {}\n        : { invalidation: Object.freeze({ ...input.invalidation }) }),\n      captured: Object.freeze({\n        eligible: input.captured.eligible,\n        revision: snapshotEmailRevision(input.captured.revision),\n        ...(input.captured.targetIdentifierRevision === undefined\n          ? {}\n          : { targetIdentifierRevision: input.captured.targetIdentifierRevision }),\n        ...(source === undefined ? {} : { source }),\n      }),\n      authorization: Object.freeze({\n        challenge: Object.freeze({\n          ...input.authorization.challenge,\n          target: Object.freeze({ ...input.authorization.challenge.target }),\n          revision: snapshotEmailRevision(input.authorization.challenge.revision),\n        }),\n        evidence,\n        requirement,\n      }),\n    });\n  });\n\n  const validateEmailAuthority = Effect.fn(\"DrizzleEmail.validateAuthority\")(function* (\n    mapping: AddressMapping,\n    configuration: EmailSqlConfiguration,\n    input: EmailAddressMutation,\n    action: EmailAction,\n  ) {\n    const confirmsExisting =\n      action === \"verify-address\" && input.captured.targetIdentifierRevision !== undefined;\n\n    if (\n      !input.captured.eligible ||\n      !completionMatches(input, action) ||\n      input.authorization.challenge.moduleId !== input.moduleId ||\n      input.authorization.challenge.action !== action ||\n      input.authorization.challenge.commandId !== input.commandId ||\n      !sameIdentifier(input.authorization.challenge.target, input.target) ||\n      input.authorization.challenge.sourceCredentialId !== input.captured.source?.credentialId ||\n      !sameEmailRevision(input.authorization.challenge.revision, input.captured.revision) ||\n      input.authorization.challenge.targetIdentifierRevision !==\n        input.captured.targetIdentifierRevision ||\n      (input.authorization.evidence.flowId as string) !== (input.commandId as string) ||\n      input.authorization.evidence.bindingDigest !== input.authorization.challenge.bindingDigest ||\n      !sameEmailRevision(input.authorization.evidence.revision, input.captured.revision) ||\n      (action === \"verify-address\" && input.captured.source !== undefined) ||\n      (action === \"change-address\" && input.captured.source === undefined) ||\n      confirmsExisting !== (input.invalidation === undefined) ||\n      (input.invalidation?.existingSessions === \"immediate\" &&\n        mapping.sessionInvalidation !== \"same-authority-immediate\")\n    )\n      return undefined;\n\n    const current = yield* currentAddress(\n      mapping,\n      {\n        moduleId: input.moduleId,\n        subjectId: input.captured.revision.subjectId,\n        target: input.target,\n        ...(input.captured.source === undefined\n          ? {}\n          : { sourceCredentialId: input.captured.source.credentialId }),\n      },\n      configuration.locking,\n    );\n\n    if (\n      current === undefined ||\n      !current.eligible ||\n      !sameEmailRevision(current.revision, input.captured.revision) ||\n      current.targetIdentifierRevision !== input.captured.targetIdentifierRevision ||\n      (input.captured.source !== undefined &&\n        (current.source === undefined ||\n          current.source.snapshot.identifierRevision !== input.captured.source.identifierRevision ||\n          current.source.snapshot.credentialRevision !== input.captured.source.credentialRevision ||\n          !sameIdentifier(current.source.snapshot.identifier, input.captured.source.identifier)))\n    )\n      return undefined;\n\n    const currentRequirement = yield* mapping.subject.decodeActionRequirement(\n      current.subject,\n      action,\n    );\n\n    const original = yield* assessAuthentication(\n      input.authorization.evidence,\n      input.authorization.requirement,\n    ).pipe(Effect.mapError(unavailable));\n\n    const configured = yield* assessAuthentication(\n      input.authorization.evidence,\n      currentRequirement,\n    ).pipe(Effect.mapError(unavailable));\n\n    return original.satisfied && configured.satisfied ? current : undefined;\n  });\n\n  const commandExists = Effect.fn(\"Drizzle.commandExists\")(function* (\n    mapping: AddressMapping,\n    moduleId: string,\n    commandId: string,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentEmailSql;\n\n    const c = commandColumns(mapping);\n\n    return yield* selectRows(\n      database\n        .select()\n        .from(mapping.command.table)\n        .where(and(eq(c.moduleId, moduleId), eq(c.commandId, commandId)))\n        .limit(1),\n      locking,\n    );\n  });\n\n  const applyMutation = Effect.fn(\"DrizzleEmail.applyMutation\")(function* (\n    mapping: AddressMapping,\n    input: EmailAddressMutation,\n    action: EmailAction,\n    current: CurrentAddress,\n    allocated: {\n      readonly targetCredentialId: string;\n      readonly targetIdentifierRevision: SecurityRevision;\n      readonly targetCredentialRevision: SecurityRevision;\n      readonly sourceIdentifierRevision: SecurityRevision;\n      readonly sourceCredentialRevision: SecurityRevision;\n      readonly nextSecurityRevision: SecurityRevision;\n    },\n    now: number,\n  ) {\n    const database = yield* CurrentEmailSql;\n\n    const i = identifierColumns(mapping);\n    const c = credentialColumns(mapping);\n    const a = authorityColumns(mapping);\n    const s = subjectColumns(mapping);\n\n    const targetCredentialId =\n      current.targetCredential?.[mapping.credential.credentialId] ?? allocated.targetCredentialId;\n\n    if (action === \"change-address\") {\n      const source = current.source!;\n\n      yield* database\n        .update(mapping.identifier.table)\n        .set(\n          mapping.identifier.encodeRetirement({\n            source: source.snapshot.identifier,\n            bindingRevision: allocated.sourceIdentifierRevision,\n          }),\n        )\n        .where(\n          and(\n            eq(i.namespace, source.snapshot.identifier.namespace),\n            eq(i.value, source.snapshot.identifier.value),\n            eq(i.subjectId, current.nativeSubjectId),\n            eq(i.bindingRevision, source.snapshot.identifierRevision),\n          ),\n        );\n      yield* database\n        .update(mapping.credential.table)\n        .set(\n          mapping.credential.encodeRetirement({\n            source: source.snapshot.identifier,\n            credentialRevision: allocated.sourceCredentialRevision,\n          }),\n        )\n        .where(\n          and(\n            eq(c.moduleId, input.moduleId),\n            eq(c.credentialId, source.snapshot.credentialId),\n            eq(c.subjectId, current.nativeSubjectId),\n            eq(c.credentialRevision, source.snapshot.credentialRevision),\n          ),\n        );\n      yield* database\n        .update(mapping.authorityCredential.table)\n        .set(mapping.authorityCredential.encodeRetirement(allocated.sourceCredentialRevision))\n        .where(\n          and(\n            eq(a.subjectId, current.nativeSubjectId),\n            eq(a.credentialId, source.snapshot.credentialId),\n            eq(a.revision, source.snapshot.credentialRevision),\n          ),\n        );\n    }\n    if (current.targetIdentifier === undefined) {\n      yield* database.insert(mapping.identifier.table).values(\n        mapping.identifier.encodeVerifiedInsert({\n          identifier: input.target,\n          subjectId: current.nativeSubjectId,\n          verifiedAtMillis: now,\n          bindingRevision: allocated.targetIdentifierRevision,\n        }),\n      );\n    } else {\n      yield* database\n        .update(mapping.identifier.table)\n        .set(\n          mapping.identifier.encodeVerification({\n            verifiedAtMillis: now,\n            bindingRevision: allocated.targetIdentifierRevision,\n          }),\n        )\n        .where(\n          and(\n            eq(i.namespace, input.target.namespace),\n            eq(i.value, input.target.value),\n            eq(i.subjectId, current.nativeSubjectId),\n            eq(i.bindingRevision, current.targetIdentifier![mapping.identifier.bindingRevision]),\n          ),\n        );\n    }\n    if (current.targetCredential === undefined) {\n      yield* database.insert(mapping.credential.table).values(\n        mapping.credential.encodeVerifiedInsert({\n          moduleId: input.moduleId,\n          subjectId: current.nativeSubjectId,\n          credentialId: targetCredentialId,\n          identifier: input.target,\n          credentialRevision: allocated.targetCredentialRevision,\n        }),\n      );\n      yield* database.insert(mapping.authorityCredential.table).values(\n        mapping.authorityCredential.encodeInsert({\n          subjectId: current.nativeSubjectId,\n          credentialId: targetCredentialId,\n          revision: allocated.targetCredentialRevision,\n        }),\n      );\n    } else {\n      const oldRevision = current.targetCredential[mapping.credential.credentialRevision];\n\n      yield* database\n        .update(mapping.credential.table)\n        .set(\n          mapping.credential.encodeActivation({\n            identifier: input.target,\n            credentialRevision: allocated.targetCredentialRevision,\n          }),\n        )\n        .where(\n          and(\n            eq(c.moduleId, input.moduleId),\n            eq(c.credentialId, targetCredentialId),\n            eq(c.subjectId, current.nativeSubjectId),\n            eq(c.credentialRevision, oldRevision),\n          ),\n        );\n      yield* database\n        .update(mapping.authorityCredential.table)\n        .set(mapping.authorityCredential.encodeActivation(allocated.targetCredentialRevision))\n        .where(\n          and(\n            eq(a.subjectId, current.nativeSubjectId),\n            eq(a.credentialId, targetCredentialId),\n            eq(a.revision, oldRevision),\n          ),\n        );\n    }\n    yield* database\n      .update(mapping.subject.table)\n      .set(updateValues([[mapping.subject.securityRevision, allocated.nextSecurityRevision]]))\n      .where(\n        and(\n          eq(s.id, current.nativeSubjectId),\n          eq(s.securityRevision, input.captured.revision.securityRevision),\n        ),\n      );\n    yield* database.insert(mapping.command.table).values(\n      mapping.command.encodeInsert({\n        moduleId: input.moduleId,\n        commandId: input.commandId,\n        action,\n        bindingDigest: input.authorization.challenge.bindingDigest,\n        retentionUntilMillis: now + mapping.commandRetentionMillis,\n      }),\n    );\n\n    const sourceStillActive =\n      action === \"verify-address\"\n        ? []\n        : yield* selectRows(\n            database\n              .select()\n              .from(mapping.credential.table)\n              .where(\n                and(\n                  eq(c.moduleId, input.moduleId),\n                  eq(c.credentialId, current.source!.snapshot.credentialId),\n                  eq(c.subjectId, current.nativeSubjectId),\n                ),\n              ),\n            false,\n          );\n\n    const target = (yield* emailLookupRows(mapping, input.moduleId, input.target))[0];\n\n    const targetAuthority = yield* selectRows(\n      database\n        .select()\n        .from(mapping.authorityCredential.table)\n        .where(\n          and(eq(a.subjectId, current.nativeSubjectId), eq(a.credentialId, targetCredentialId)),\n        )\n        .limit(1),\n      false,\n    );\n\n    const command = yield* selectRows(\n      database\n        .select()\n        .from(mapping.command.table)\n        .where(\n          and(\n            eq(commandColumns(mapping).moduleId, input.moduleId),\n            eq(commandColumns(mapping).commandId, input.commandId),\n            eq(commandColumns(mapping).action, action),\n            eq(commandColumns(mapping).bindingDigest, input.authorization.challenge.bindingDigest),\n            eq(\n              commandColumns(mapping).retentionUntil,\n              mapping.encodeInstant(now + mapping.commandRetentionMillis),\n            ),\n          ),\n        )\n        .limit(1),\n      false,\n    );\n\n    const targetVerifiedAt =\n      target === undefined\n        ? undefined\n        : yield* mapping.decodeInstant(target.identifier[mapping.identifier.verifiedAt]);\n\n    const sourceIdentifier =\n      action === \"verify-address\"\n        ? []\n        : yield* identifierRow(mapping, current.source!.snapshot.identifier, false);\n\n    const sourceAuthority =\n      action === \"verify-address\"\n        ? []\n        : yield* selectRows(\n            database\n              .select()\n              .from(mapping.authorityCredential.table)\n              .where(\n                and(\n                  eq(a.subjectId, current.nativeSubjectId),\n                  eq(a.credentialId, current.source!.snapshot.credentialId),\n                ),\n              )\n              .limit(1),\n            false,\n          );\n\n    return (\n      target !== undefined &&\n      mapping.subjectId.equals(target.subject[mapping.subject.id], current.nativeSubjectId) &&\n      mapping.subject.isActiveStatus(target.subject[mapping.subject.status]) &&\n      target.subject[mapping.subject.securityRevision] === allocated.nextSecurityRevision &&\n      target.identifier[mapping.identifier.bindingRevision] ===\n        allocated.targetIdentifierRevision &&\n      targetVerifiedAt === now &&\n      target.credential[mapping.credential.credentialRevision] ===\n        allocated.targetCredentialRevision &&\n      target.credential[mapping.credential.credentialId] === targetCredentialId &&\n      mapping.subjectId.equals(\n        target.credential[mapping.credential.subjectId],\n        current.nativeSubjectId,\n      ) &&\n      mapping.identifier.isCurrent(target.identifier) &&\n      mapping.credential.isActiveStatus(target.credential[mapping.credential.status]) &&\n      targetAuthority.length === 1 &&\n      targetAuthority[0]![mapping.authorityCredential.revision] ===\n        allocated.targetCredentialRevision &&\n      mapping.authorityCredential.isActiveStatus(\n        targetAuthority[0]![mapping.authorityCredential.status],\n      ) &&\n      command.length === 1 &&\n      (action === \"verify-address\" ||\n        (sourceStillActive.length === 1 &&\n          sourceStillActive[0]![mapping.credential.credentialRevision] ===\n            allocated.sourceCredentialRevision &&\n          !mapping.credential.isActiveStatus(sourceStillActive[0]![mapping.credential.status]) &&\n          sourceIdentifier.length === 1 &&\n          mapping.subjectId.equals(\n            sourceIdentifier[0]![mapping.identifier.subjectId],\n            current.nativeSubjectId,\n          ) &&\n          sourceIdentifier[0]![mapping.identifier.bindingRevision] ===\n            allocated.sourceIdentifierRevision &&\n          !mapping.identifier.isCurrent(sourceIdentifier[0]!) &&\n          sourceAuthority.length === 1 &&\n          sourceAuthority[0]![mapping.authorityCredential.revision] ===\n            allocated.sourceCredentialRevision &&\n          !mapping.authorityCredential.isActiveStatus(\n            sourceAuthority[0]![mapping.authorityCredential.status],\n          )))\n    );\n  });\n\n  const probeProofCompletion = Effect.fn(\"Drizzle.probeProofCompletion\")(function* (\n    configuration: EmailSqlConfiguration,\n    input: ProofCompletionInput,\n  ) {\n    const database = yield* CurrentEmailSql;\n\n    if (configuration.proof === undefined) return yield* Effect.fail(unavailable());\n    const validProbe = { _tag: \"EmailProofCompletionValid\" } as const;\n\n    const plan = {\n      input,\n      prepare: <A>(\n        decision: ProofCompletionDecision,\n        journal: CommitJournal,\n        project: (decision: ProofCompletionDecision) => A,\n      ) => journal.prepare(project(decision)),\n    };\n\n    const probe = coordinateCommit(\n      () =>\n        database.transaction((transaction) =>\n          completeProofPlanIn(\n            configuration.proof!.mapping,\n            configuration.proof!.configuration,\n            plan,\n            Effect.fail(validProbe),\n            () => false,\n          ).pipe(\n            Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),\n          ),\n        ),\n      { mode: configuration.mode },\n    );\n\n    return yield* probe.pipe(\n      Effect.as(false),\n      Effect.catchCause((cause) => {\n        const reason = cause.reasons[0];\n\n        return cause.reasons.length === 1 &&\n          reason !== undefined &&\n          Cause.isFailReason(reason) &&\n          reason.error === validProbe\n          ? Effect.succeed(true)\n          : Effect.failCause(cause);\n      }),\n    );\n  });\n\n  const prepareRejected = Effect.fn(\"Drizzle.prepareRejected\")(function* <A>(\n    configuration: EmailSqlConfiguration,\n    prepare: (value: \"rejected\", journal: CommitJournal) => PreparedCommit<A>,\n  ) {\n    const database = yield* CurrentEmailSql;\n\n    return yield* owned(\n      database,\n      configuration,\n      Effect.gen(function* () {\n        const journal = yield* CurrentCommitJournal;\n\n        return yield* Effect.succeed(prepare(\"rejected\", journal));\n      }),\n    );\n  });\n\n  const makeSqlEmailAddressPersistence = Effect.fn(\"makeSqlEmailAddressPersistence\")(function* (\n    mapping: AddressMapping,\n    configuration: EmailSqlConfiguration,\n  ): Effect.fn.Return<\n    EmailAddressPersistence[\"Service\"],\n    EmailUnavailable,\n    LifecycleHooks | CurrentEmailSql | NativeDatabase\n  > {\n    const database = yield* CurrentEmailSql;\n\n    if (!configuration.coordinated)\n      yield* (\n        operations.validateStorage?.({\n          ...mapping,\n          proof: configuration.proof?.mapping,\n        }) ?? Effect.void\n      ).pipe(Effect.mapError(unavailable));\n    const hooks = yield* LifecycleHooks;\n\n    return EmailAddressPersistence.of({\n      target: (input) =>\n        (validAddressConstraints(mapping)\n          ? safeRead(\n              database,\n              configuration,\n              Effect.gen(function* () {\n                const current = yield* currentAddress(mapping, input, configuration.locking);\n\n                if (current === undefined) return yield* unavailable();\n\n                return Object.freeze({\n                  revision: snapshotEmailRevision(current.revision),\n                  eligible: current.eligible,\n                  ...(current.targetIdentifierRevision === undefined\n                    ? {}\n                    : { targetIdentifierRevision: current.targetIdentifierRevision }),\n                  ...(current.source === undefined\n                    ? {}\n                    : { source: yield* snapshotEmailCredential(current.source.snapshot) }),\n                });\n              }),\n            )\n          : Effect.fail(unavailable())\n        ).pipe(\n          Effect.provideService(CurrentEmailSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      checkCompletion: (input) => {\n        if (configuration.proof === undefined || input.binding._tag !== \"IdentifierChange\")\n          return Effect.succeed(false).pipe(\n            Effect.provideService(CurrentEmailSql, database),\n            Effect.provideService(LifecycleHooks, hooks),\n            translateFailure,\n          );\n        const binding = input.binding;\n\n        return safeRead(\n          database,\n          configuration,\n          Effect.gen(function* () {\n            const action: EmailAction | undefined =\n              input.moduleId.endsWith(\"/verify-address\") &&\n              input.purpose === \"email-address-verification\"\n                ? \"verify-address\"\n                : input.moduleId.endsWith(\"/change-address\") &&\n                    input.purpose === \"email-address-change\"\n                  ? \"change-address\"\n                  : undefined;\n\n            if (action === undefined) return false;\n            const moduleId = input.moduleId.slice(0, -`/${action}`.length);\n\n            const current = yield* currentAddress(\n              mapping,\n              {\n                moduleId,\n                subjectId: binding.revision.subjectId,\n                target: binding.identifier,\n              },\n              false,\n            );\n\n            return current !== undefined && sameEmailRevision(current.revision, binding.revision);\n          }),\n        )\n          .pipe(\n            Effect.flatMap((current) =>\n              current ? probeProofCompletion(configuration, input) : Effect.succeed(false),\n            ),\n          )\n          .pipe(\n            Effect.provideService(CurrentEmailSql, database),\n            Effect.provideService(LifecycleHooks, hooks),\n            translateFailure,\n          );\n      },\n      verifyWithProof: (uncaptured, prepare) =>\n        mutateAddress(mapping, configuration, uncaptured, \"verify-address\", prepare).pipe(\n          Effect.provideService(CurrentEmailSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      changeWithProof: (uncaptured, prepare) =>\n        mutateAddress(mapping, configuration, uncaptured, \"change-address\", prepare).pipe(\n          Effect.provideService(CurrentEmailSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      cleanup: (input, prepare) =>\n        owned(\n          database,\n          configuration,\n          Effect.gen(function* () {\n            const transaction = yield* CurrentEmailSql;\n            const journal = yield* CurrentCommitJournal;\n\n            const c = commandColumns(mapping);\n            const now = yield* nowMillis;\n\n            const rows = yield* selectRows(\n              transaction\n                .select({ commandId: c.commandId })\n                .from(mapping.command.table)\n                .where(\n                  and(\n                    eq(c.moduleId, input.moduleId),\n                    lte(c.retentionUntil, mapping.encodeInstant(now)),\n                  ),\n                )\n                .limit(input.limit + 1),\n              configuration.locking,\n            );\n\n            const selected = rows.slice(0, input.limit);\n\n            const receipt = prepare(\n              { removed: selected.length, hasMore: rows.length > input.limit },\n              journal,\n            );\n\n            if (selected.length > 0)\n              yield* transaction.delete(mapping.command.table).where(\n                and(\n                  eq(c.moduleId, input.moduleId),\n                  inArray(\n                    c.commandId,\n                    selected.map((row: any) => row.commandId),\n                  ),\n                  lte(c.retentionUntil, mapping.encodeInstant(now)),\n                ),\n              );\n\n            return receipt;\n          }),\n        ).pipe(\n          Effect.provideService(CurrentEmailSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n    });\n  });\n\n  const mutateAddress = Effect.fn(\"Drizzle.mutateAddress\")(function* <A>(\n    mapping: AddressMapping,\n    configuration: EmailSqlConfiguration,\n    uncaptured: EmailAddressMutation,\n    action: EmailAction,\n    prepare: (value: \"changed\" | \"rejected\", journal: CommitJournal) => PreparedCommit<A>,\n  ) {\n    const database = yield* CurrentEmailSql;\n\n    if (!validAddressConstraints(mapping) || configuration.proof === undefined)\n      return yield* unavailable();\n    const input = yield* snapshotEmailMutation(uncaptured);\n\n    const targetCredentialId = yield* allocate(\n      configuration.mode,\n      mapping.allocateCredentialId,\n      mapping.allocateCredentialIdSync,\n    );\n\n    const targetIdentifierRevision = yield* allocate(\n      configuration.mode,\n      mapping.allocateRevision,\n      mapping.allocateRevisionSync,\n    );\n\n    const targetCredentialRevision = yield* allocate(\n      configuration.mode,\n      mapping.allocateRevision,\n      mapping.allocateRevisionSync,\n    );\n\n    const sourceIdentifierRevision = yield* allocate(\n      configuration.mode,\n      mapping.allocateRevision,\n      mapping.allocateRevisionSync,\n    );\n\n    const sourceCredentialRevision = yield* allocate(\n      configuration.mode,\n      mapping.allocateRevision,\n      mapping.allocateRevisionSync,\n    );\n\n    const confirmsExisting =\n      action === \"verify-address\" && input.captured.targetIdentifierRevision !== undefined;\n\n    const nextRevision = confirmsExisting\n      ? input.captured.revision.securityRevision\n      : yield* nextSecurityRevision(\n          mapping,\n          configuration.mode,\n          input.captured.revision.securityRevision,\n        );\n\n    if (\n      (!confirmsExisting && nextRevision === input.captured.revision.securityRevision) ||\n      [\n        targetIdentifierRevision,\n        targetCredentialRevision,\n        sourceIdentifierRevision,\n        sourceCredentialRevision,\n      ].some((value) => input.captured.revision.credentials.some((item) => item.revision === value))\n    )\n      return yield* unavailable();\n\n    const run = owned(\n      database,\n      configuration,\n      Effect.gen(function* () {\n        const journal = yield* CurrentCommitJournal;\n\n        const current = yield* validateEmailAuthority(mapping, configuration, input, action);\n\n        if (current === undefined) return prepare(\"rejected\", journal);\n        if (\n          (yield* commandExists(mapping, input.moduleId, input.commandId, configuration.locking))\n            .length > 0\n        )\n          return prepare(\"rejected\", journal);\n        let receipt: PreparedCommit<A> | undefined;\n\n        yield* completeProofPlanIn(\n          configuration.proof!.mapping,\n          configuration.proof!.configuration,\n          input.completion,\n          Effect.gen(function* () {\n            // The proof helper may wait on continuation/series locks. Read the\n            // commit clock and reassess both policies only after those locks.\n            const currentRequirement = yield* mapping.subject.decodeActionRequirement(\n              current.subject,\n              action,\n            );\n\n            const original = yield* assessAuthentication(\n              input.authorization.evidence,\n              input.authorization.requirement,\n            ).pipe(Effect.mapError(unavailable));\n\n            const configured = yield* assessAuthentication(\n              input.authorization.evidence,\n              currentRequirement,\n            ).pipe(Effect.mapError(unavailable));\n\n            if (!original.satisfied || !configured.satisfied) return false;\n            const now = yield* nowMillis;\n\n            return yield* applyMutation(\n              mapping,\n              input,\n              action,\n              current,\n              {\n                targetCredentialId,\n                targetIdentifierRevision,\n                targetCredentialRevision,\n                sourceIdentifierRevision,\n                sourceCredentialRevision,\n                nextSecurityRevision: nextRevision,\n              },\n              now,\n            );\n          }),\n          (decision) => {\n            receipt = prepare(decision === \"completed\" ? \"changed\" : \"rejected\", journal);\n\n            return decision;\n          },\n        );\n\n        return receipt ?? prepare(\"rejected\", journal);\n      }),\n    );\n\n    return yield* run.pipe(\n      Effect.catchCause((cause) =>\n        (cause.reasons.every(Cause.isFailReason) &&\n          isMappedConstraintConflict(mapping.isCommandConflict, cause)) ||\n        (cause.reasons.every(Cause.isFailReason) &&\n          isMappedConstraintConflict(mapping.isIdentifierConflict, cause)) ||\n        (cause.reasons.every(Cause.isFailReason) &&\n          isMappedConstraintConflict(mapping.isCredentialConflict, cause))\n          ? prepareRejected(configuration, prepare)\n          : Effect.failCause(cause),\n      ),\n    );\n  });\n\n  return {\n    validEmailSignInConstraints,\n    emailLookupQuery,\n    decodeEmailSnapshot,\n    makeSqlEmailSignInTargets,\n    currentAddress,\n    sameEmailRevision,\n    snapshotEmailMutation,\n    validateEmailAuthority,\n    makeSqlEmailAddressPersistence,\n  };\n};\n"],"mappings":";;;;;;;;;;AAmFA,IAAa,kBAAb,cAAqC,QAAQ,QAA2C,CAAC,CACvF,6BACF,CAAC,CAAC,CAAC;AA4BH,MAAa,mBAIX,YACA,WACG;CAGH,MAAM,EAAE,KAAK,IAAI,SAAS,KAAK,QAAQ,iBAAiB;CACxD,MAAM,EAAE,wBAAwB;CAChC,MAAM,oBAAoB,iBAAiB,KAAK,CAAC,CAAC;CAElD,MAAM,oBACJ,WAEA,yBACE,SACC,UACC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,sBAAsB,CAAC,CAAC,KAAK,CAC3C,CAAC,CAAC,KAAK,OAAO,YAAY,UAAU,OAAO,UAAU,MAAM,IAAI,aAAa,YAAY,CAAC,CAAC,CAAC,CAAC;CAE9F,MAAM,YAAY,OAAO,IAAI,SAAS,KAAK,SAAS,aAAa;CAEjE,MAAM,cAAc,OAAsB,YACxC,WAAW,OAAO,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,IAAI;CAErE,MAAM,kBAAkB,MAAuB,UAC7C,KAAK,cAAc,MAAM,aAAa,KAAK,UAAU,MAAM;CAE7D,MAAM,+BAA+B,YACnC,OAAO,QAAQ,8BAA8B,CAAC,CAAC,OAC5C,CAAC,KAAK,WACL,QAAQ,YAAY,SAAwD,KAChF;CAEF,MAAM,2BAA2B,YAC/B,OAAO,QAAQ,+BAA+B,CAAC,CAAC,OAC7C,CAAC,KAAK,WACL,QAAQ,YAAY,SAAyD,KACjF;CAEF,MAAM,kBAAkB,aAA4B;EAClD,IAAI,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,EAAE;EACpD,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;EAC5D,kBAAkB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,gBAAgB;CAClF;CAEA,MAAM,qBAAqB,aAA4B;EACrD,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;EACxE,OAAO,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,KAAK;EAChE,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;EACxE,YAAY,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,UAAU;EAC1E,iBAAiB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,eAAe;CACtF;CAEA,MAAM,qBAAqB,aAA4B;EACrD,UAAU,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,QAAQ;EACtE,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;EACxE,cAAc,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,YAAY;EAC9E,qBAAqB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,mBAAmB;EAC5F,iBAAiB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,eAAe;EACpF,oBAAoB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,kBAAkB;EAC1F,QAAQ,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,MAAM;CACpE;CAEA,MAAM,oBAAoB,aAA6B;EACrD,WAAW,OAAO,QAAQ,oBAAoB,OAAO,QAAQ,oBAAoB,SAAS;EAC1F,cAAc,OACZ,QAAQ,oBAAoB,OAC5B,QAAQ,oBAAoB,YAC9B;EACA,UAAU,OAAO,QAAQ,oBAAoB,OAAO,QAAQ,oBAAoB,QAAQ;EACxF,QAAQ,OAAO,QAAQ,oBAAoB,OAAO,QAAQ,oBAAoB,MAAM;CACtF;CAEA,MAAM,kBAAkB,aAA6B;EACnD,UAAU,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,QAAQ;EAChE,WAAW,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,SAAS;EAClE,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;EAC5D,eAAe,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,aAAa;EAC1E,gBAAgB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,cAAc;CAC9E;CAEA,MAAM,YACJ,MACA,cACA,gBACG;EACH,IAAI,SAAS,eACX,OAAO,gBAAgB,KAAA,IACnB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;GACT,KAAK;GACL,QAAQ,UAAU,IAAI,wBAAwB;IAAE,WAAW;IAAW;GAAM,CAAC;EAC/E,CAAC;EACP,IAAI,iBAAiB,KAAA,GAAW,OAAO;EAEvC,OAAO,gBAAgB,KAAA,IACnB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;GACT,KAAK;GACL,QAAQ,UAAU,IAAI,wBAAwB;IAAE,WAAW;IAAW;GAAM,CAAC;EAC/E,CAAC;CACP;CAEA,MAAM,wBACJ,SACA,MACA,YACG;EACH,IAAI,SAAS,eACX,OAAO,QAAQ,QAAQ,6BAA6B,KAAA,IAChD,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;GACT,WAAW,QAAQ,QAAQ,yBAA0B,OAAO;GAC5D,QAAQ,UAAU,IAAI,wBAAwB;IAAE,WAAW;IAAW;GAAM,CAAC;EAC/E,CAAC;EACP,IAAI,QAAQ,QAAQ,yBAAyB,KAAA,GAC3C,OAAO,QAAQ,QAAQ,qBAAqB,OAAO;EACrD,IAAI,QAAQ,QAAQ,6BAA6B,KAAA,GAC/C,OAAO,OAAO,IAAI;GAChB,WAAW,QAAQ,QAAQ,yBAA0B,OAAO;GAC5D,QAAQ,UAAU,IAAI,wBAAwB;IAAE,WAAW;IAAW;GAAM,CAAC;EAC/E,CAAC;EAEH,OAAO,OAAO,KAAK,YAAY,CAAC;CAClC;CAEA,MAAM,YACJ,UACA,eACA,SAEA,OAAO,IAAI,aAAa;EACtB,IAAI,cAAc,gBAAgB,MAAM;GACtC,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;GACrD,OAAO,cAAc;EACvB;EAEA,OAAO,OAAO,SAAS,aAAa,gBAClC,KAAK,KACH,OAAO,eAAe,iBAAiB,WAAW,GAClD,OAAO,eAAe,iBAAiB,WAA0C,CACnF,CACF;CACF,CAAC;CAEH,MAAM,SACJ,UACA,eACA,SACG;EACH,MAAM,MAAM,uBAER,SAAS,aAAa,gBACpB,KAAK,KACH,OAAO,eAAe,iBAAiB,WAAW,GAClD,OAAO,eAAe,iBAAiB,WAA0C,CACnF,CACF,GACF,EAAE,MAAM,cAAc,KAAK,CAC7B,CAAC,CAAC,KAAK,OAAO,KAAK,WAAW,OAAO,KAAK,CAAC;EAE3C,OAAO,cAAc,gBAAgB,OACjC,OAAO,IAAI,aAAa;GACtB,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;GACrD,OAAO,cAAc;GAErB,OAAO,OAAO;EAChB,CAAC,IACD;CACN;CAEA,MAAM,oBACJ,SACA,UACA,eACG;EACH,MAAM,UAAU,eAAe,OAAO,GACpC,UAAU,kBAAkB,OAAO,GACnC,aAAa,kBAAkB,OAAO;EAExC,OAAO;GACL,QAAQ;IACN,SAAS,QAAQ,QAAQ;IACzB,YAAY,QAAQ,WAAW;IAC/B,YAAY,QAAQ,WAAW;GACjC;GACA,MAAM,QAAQ,WAAW;GACzB,cAAc,QAAQ,QAAQ;GAC9B,aAAa,GAAG,QAAQ,IAAI,QAAQ,SAAS;GAC7C,iBAAiB,QAAQ,WAAW;GACpC,gBAAgB,IACd,GAAG,WAAW,UAAU,QAAQ,GAChC,GAAG,WAAW,WAAW,QAAQ,SAAS,GAC1C,GAAG,WAAW,qBAAqB,QAAQ,SAAS,GACpD,GAAG,WAAW,iBAAiB,QAAQ,KAAK,CAC9C;GACA,WAAW,IACT,GAAG,QAAQ,WAAW,WAAW,SAAS,GAC1C,GAAG,QAAQ,OAAO,WAAW,KAAK,CACpC;GACA,OAAO;EACT;CACF;CAEA,MAAM,kBAAkB,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,SACA,UACA,YACA;EACA,MAAM,WAAW,OAAO;EACxB,MAAM,QAAQ,iBAAiB,SAAS,UAAU,UAAU;EAE5D,OAAO,OAAO,SACX,OAAO,MAAM,MAAM,CAAC,CACpB,KAAK,MAAM,IAAI,CAAC,CAChB,UAAU,MAAM,cAAc,MAAM,WAAW,CAAC,CAChD,UAAU,MAAM,iBAAiB,MAAM,cAAc,CAAC,CACtD,MAAM,MAAM,SAAS,CAAC,CACtB,MAAM,MAAM,KAAK;CACtB,CAAC;CAED,MAAM,sBAAsB,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACnE,SACA,UACA,WACA,KACA;EACA,IACE,CAAC,QAAQ,QAAQ,eAAe,IAAI,QAAQ,QAAQ,QAAQ,OAAO,KACnE,CAAC,QAAQ,WAAW,UAAU,IAAI,UAAU,KAC5C,CAAC,QAAQ,WAAW,eAAe,IAAI,WAAW,QAAQ,WAAW,OAAO,GAE5E,OAAO,KAAA;EAET,MAAM,WAAW,OAAO,QAAQ,WAC7B,OAAO;GACN;GACA,SAAS,IAAI;GACb,YAAY,IAAI;GAChB,YAAY,IAAI;EAClB,CAAC,CAAC,CACD,KAAK,OAAO,QAAQ,uBAAuB,CAAC;EAE/C,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,IAAI,QAAQ,QAAQ,QAAQ,GAAG;EAEpF,MAAM,mBAAmB,OAAO,QAAQ,cACtC,IAAI,WAAW,QAAQ,WAAW,WACpC;EAEA,IACE,SAAS,aAAa,YACtB,CAAC,eAAe,SAAS,YAAY,SAAS,KAC9C,SAAS,SAAS,cAAc,aAChC,SAAS,SAAS,qBAAqB,IAAI,QAAQ,QAAQ,QAAQ,qBACnE,SAAS,uBAAuB,IAAI,WAAW,QAAQ,WAAW,oBAClE,SAAS,qBAAqB,oBAC9B,SAAS,iBAAiB,IAAI,WAAW,QAAQ,WAAW,iBAC5D,SAAS,uBAAuB,IAAI,WAAW,QAAQ,WAAW,qBAElE,OAAO,KAAA;EAET,OAAO;CACT,CAAC;CAED,MAAM,4BAA4B,OAAO,GAAG,2BAA2B,CAAC,CAAC,WACvE,SACA,eAKA;EACA,MAAM,WAAW,OAAO;EAExB,IAAI,CAAC,cAAc,aACjB,QACE,WAAW,kBAAkB;GAC3B,GAAG;GACH,OAAO,cAAc,OAAO;EAC9B,CAAC,KAAK,OAAO,KAAA,CACb,KAAK,OAAO,SAAS,WAAW,CAAC;EAErC,OAAO,mBAAmB,GAAG,EAC3B,SAAS,WACN,4BAA4B,OAAO,IAChC,SACE,UACA,eACA,OAAO,IAAI,aAAa;GACtB,MAAM,OAAO,OAAO,gBAAgB,SAAS,MAAM,UAAU,MAAM,UAAU,EAAA,CAAG;GAEhF,IAAI,QAAQ,KAAA,GAAW,OAAO,OAAO,KAAK;GAE1C,MAAM,WAAW,OAAO,oBACtB,SACA,MAAM,UACN,MAAM,YACN,GACF;GAEA,OAAO,aAAa,KAAA,IAAY,OAAO,KAAK,IAAI,OAAO,KAAK,QAAQ;EACtE,CAAC,CACH,IACA,OAAO,KAAK,YAAY,CAAC,EAAA,CAC3B,KAAK,OAAO,eAAe,iBAAiB,QAAQ,GAAG,gBAAgB,EAC7E,CAAC;CACH,CAAC;CAED,MAAM,cAAc,OAAO,GAAG,0BAA0B,CAAC,CAAC,WACxD,SACA,WACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,SAAgB;EAC1E,MAAM,IAAI,eAAe,OAAO;EAOhC,OAAO;GAAE;GAAiB,UALT,OAAO,WACtB,SAAS,OAAO,CAAC,CAAC,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAAC,MAAM,GAAG,EAAE,IAAI,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,GACtF,OACF,EAAA,CAAG;EAE+B;CACpC,CAAC;CAED,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,YACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EAEnC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,IAAI,GAAG,EAAE,WAAW,WAAW,SAAS,GAAG,GAAG,EAAE,OAAO,WAAW,KAAK,CAAC,CAAC,CAAC,CAChF,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,iBAAiB,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,UACA,cACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EAEnC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,IAAI,GAAG,EAAE,UAAU,QAAQ,GAAG,GAAG,EAAE,cAAc,YAAY,CAAC,CAAC,CAAC,CACtE,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,yBAAyB,OAAO,GAAG,gCAAgC,CAAC,CAAC,WACzE,SACA,UACA,YACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EAEnC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MACC,IACE,GAAG,EAAE,UAAU,QAAQ,GACvB,GAAG,EAAE,qBAAqB,WAAW,SAAS,GAC9C,GAAG,EAAE,iBAAiB,WAAW,KAAK,CACxC,CACF,CAAC,CACA,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,iBAAiB,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAC9D,SACA,OAMA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,SAAS,OAAO,YAAY,SAAS,MAAM,WAAW,OAAO;EAEnE,IACE,OAAO,YAAY,KAAA,KACnB,CAAC,QAAQ,QAAQ,eAAe,OAAO,QAAQ,QAAQ,QAAQ,OAAO,GAEtE,OAAO,KAAA;EAET,MAAM,mBACJ,MAAM,uBAAuB,KAAA,IACzB,KAAA,KACC,OAAO,eAAe,SAAS,MAAM,UAAU,MAAM,oBAAoB,KAAK,EAAA,CAAG;EAExF,MAAM,mBACJ,qBAAqB,KAAA,IACjB,KAAA,IACA;GACE,WAAW,iBAAiB,QAAQ,WAAW;GAC/C,OAAO,iBAAiB,QAAQ,WAAW;EAC7C;EAEN,MAAM,cAAc,CAClB,MAAM,QACN,GAAI,qBAAqB,KAAA,IAAY,CAAC,IAAI,CAAC,gBAAgB,CAC7D,CAAC,CACE,QACE,OAAO,OAAO,WACb,OAAO,WAAW,cAAc,eAAe,WAAW,KAAK,CAAC,MAAM,KAC1E,CAAC,CACA,MAAM,MAAM,UACX,GAAG,KAAK,UAAU,QAAQ,KAAK,QAAQ,cACrC,GAAG,MAAM,UAAU,QAAQ,MAAM,OACnC,CACF;EAEF,MAAM,oCAAoB,IAAI,IAAiB;EAE/C,KAAK,MAAM,cAAc,aAAa;GACpC,MAAM,OAAO,OAAO,cAAc,SAAS,YAAY,OAAO,EAAA,CAAG;GAEjE,IAAI,QAAQ,KAAA,GACV,kBAAkB,IAAI,GAAG,WAAW,UAAU,QAAQ,WAAW,SAAS,GAAG;EACjF;EAEA,MAAM,mBACJ,MAAM,uBAAuB,KAAA,IACzB,KAAA,KACC,OAAO,eAAe,SAAS,MAAM,UAAU,MAAM,oBAAoB,OAAO,EAAA,CAAG;EAE1F,MAAM,oBAAoB,OAAO,uBAC/B,SACA,MAAM,UACN,MAAM,QACN,OACF,EAAA,CAAG;EAEH,MAAM,IAAI,iBAAiB,OAAO;EAWlC,MAAM,mBAAkB,OATC,WACvB,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,oBAAoB,KAAK,CAAC,CACvC,MAAM,GAAG,EAAE,WAAW,OAAO,eAAe,CAAC,CAAC,CAC9C,QAAQ,EAAE,YAAY,GACzB,OACF,EAAA,CAEkC,QAAQ,QACxC,QAAQ,oBAAoB,eAAe,IAAI,QAAQ,oBAAoB,OAAO,CACpF;EAEA,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,OAAO,eAAe;EAE3E,MAAM,WAAmC,OAAO,OAAO;GACrD;GACA,kBAAkB,OAAO,QAAQ,QAAQ,QAAQ;GACjD,aAAa,OAAO,OAClB,gBAAgB,KAAK,QACnB,OAAO,OAAO;IACZ,cAAc,IAAI,QAAQ,oBAAoB;IAC9C,UAAU,IAAI,QAAQ,oBAAoB;GAC5C,CAAC,CACH,CACF;EACF,CAAC;EAED,MAAM,mBAAmB,kBAAkB,IACzC,GAAG,MAAM,OAAO,UAAU,QAAQ,MAAM,OAAO,OACjD;EASA,MAAM,gBANJ,qBAAqB,KAAA,KACrB,QAAQ,UAAU,OAChB,iBAAiB,QAAQ,WAAW,YACpC,OAAO,eACT,KAIA,QAAQ,WAAW,gBAAgB,gBAAgB,MAClD,qBAAqB,KAAA,KACnB,CAAC,QAAQ,WAAW,eAAe,iBAAiB,QAAQ,WAAW,OAAO,KAC7E,QAAQ,UAAU,OAChB,iBAAiB,QAAQ,WAAW,YACpC,OAAO,eACT;EAEN,IAAI;EAEJ,IAAI,MAAM,uBAAuB,KAAA,GAAW;GAC1C,IACE,qBAAqB,KAAA,KACrB,qBAAqB,KAAA,KACrB,CAAC,QAAQ,UAAU,OACjB,iBAAiB,QAAQ,WAAW,YACpC,OAAO,eACT,KACA,CAAC,QAAQ,WAAW,eAAe,iBAAiB,QAAQ,WAAW,OAAO,GAE9E,OAAO,KAAA;GAET,MAAM,sBAAsB,kBAAkB,IAC5C,GAAG,iBAAiB,UAAU,QAAQ,iBAAiB,OACzD;GAEA,IACE,wBAAwB,KAAA,KACxB,CAAC,QAAQ,WAAW,UAAU,mBAAmB,KACjD,CAAC,QAAQ,UAAU,OACjB,oBAAoB,QAAQ,WAAW,YACvC,OAAO,eACT,GAEA,OAAO,KAAA;GAWT,SAAS;IAAE,YAAY;IAAkB,YAAY;IAAqB,UAAA,OATlD,QAAQ,WAC7B,OAAO;KACN,UAAU,MAAM;KAChB,SAAS,OAAO;KAChB,YAAY;KACZ,YAAY;IACd,CAAC,CAAC,CACD,KAAK,OAAO,QAAQ,uBAAuB,CAAC;GAEoC;EACrF;EACA,IAAI,WAAW,qBAAqB,KAAA,IAAY,qBAAqB,KAAA,IAAY;EAEjF,IAAI,MAAM,uBAAuB,KAAA,KAAa,WAAW,KAAA,GAAW,WAAW;EAC/E,IAAI,WAAW,KAAA,KAAa,eAAe,OAAO,SAAS,YAAY,MAAM,MAAM,GACjF,WAAW;EACb,IAAI,QAAQ,uBAAuB,YAAY,MAAM,uBAAuB,KAAA,GAAW;GACrF,MAAM,IAAI,kBAAkB,OAAO;GAUnC,KACE,OATkB,WAClB,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,WAAW,OAAO,eAAe,CAAC,CAAC,GACrF,OACF,EAAA,CAGO,MAAM,QAAa,QAAQ,WAAW,eAAe,IAAI,QAAQ,WAAW,OAAO,CAAC,GAEzF,WAAW;EACf;EAEA,OAAO;GACL,iBAAiB,OAAO;GACxB,SAAS,OAAO;GAChB;GACA,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO;GACzC,GAAI,qBAAqB,KAAA,IAAY,CAAC,IAAI,EAAE,iBAAiB;GAC7D,GAAI,qBAAqB,KAAA,IAAY,CAAC,IAAI,EAAE,iBAAiB;GAC7D,GAAI,gBACA,EAAE,0BAA0B,iBAAiB,QAAQ,WAAW,iBAAiB,IACjF,CAAC;GACL;EACF;CACF,CAAC;CAED,MAAM,qBAAqB,MAA8B,UAAkC;EACzF,IACE,KAAK,cAAc,MAAM,aACzB,KAAK,qBAAqB,MAAM,oBAChC,KAAK,YAAY,WAAW,MAAM,YAAY,QAE9C,OAAO;EAET,MAAM,WAAW,CAAC,GAAG,KAAK,WAAW,CAAC,CAAC,MAAM,GAAG,MAC9C,EAAE,aAAa,cAAc,EAAE,YAAY,CAC7C;EAEA,MAAM,SAAS,CAAC,GAAG,MAAM,WAAW,CAAC,CAAC,MAAM,GAAG,MAC7C,EAAE,aAAa,cAAc,EAAE,YAAY,CAC7C;EAEA,OAAO,SAAS,OACb,MAAM,UACL,KAAK,iBAAiB,OAAO,MAAM,CAAE,gBACrC,KAAK,aAAa,OAAO,MAAM,CAAE,QACrC;CACF;CAEA,MAAM,gBAAgB,UAAkB,WACtC,GAAG,SAAS,GAAG,WAAW,mBAAmB,mBAAmB;CAElE,MAAM,iBAAiB,WACrB,WAAW,mBAAmB,+BAA+B;CAE/D,MAAM,qBAAqB,OAA6B,WAAwB;EAC9E,MAAM,aAAa,MAAM,WAAW;EACpC,MAAM,UAAU,WAAW;EAE3B,OACE,WAAW,aAAa,aAAa,MAAM,UAAU,MAAM,KAC3D,WAAW,YAAY,cAAc,MAAM,KAC3C,QAAQ,SAAS,sBACjB,eAAe,QAAQ,YAAY,MAAM,MAAM,KAC/C,kBAAkB,QAAQ,UAAU,MAAM,SAAS,QAAQ;CAE/D;CAEA,MAAM,wBAAwB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WACvE,OACA;EACA,MAAM,WAAW,OAAO,+BAA+B,MAAM,cAAc,QAAQ,CAAC,CAAC,KACnF,OAAO,SAAS,WAAW,CAC7B;EAEA,MAAM,cAAc,OAAO,yBAAyB,MAAM,cAAc,WAAW;EAEnF,MAAM,SACJ,MAAM,SAAS,WAAW,KAAA,IACtB,KAAA,IACA,OAAO,wBAAwB,MAAM,SAAS,MAAM;EAE1D,OAAO,OAAO,OAAO;GACnB,GAAG;GACH,QAAQ,OAAO,OAAO,EAAE,GAAG,MAAM,OAAO,CAAC;GACzC,GAAI,MAAM,iBAAiB,KAAA,IACvB,CAAC,IACD,EAAE,cAAc,OAAO,OAAO,EAAE,GAAG,MAAM,aAAa,CAAC,EAAE;GAC7D,UAAU,OAAO,OAAO;IACtB,UAAU,MAAM,SAAS;IACzB,UAAU,sBAAsB,MAAM,SAAS,QAAQ;IACvD,GAAI,MAAM,SAAS,6BAA6B,KAAA,IAC5C,CAAC,IACD,EAAE,0BAA0B,MAAM,SAAS,yBAAyB;IACxE,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO;GAC3C,CAAC;GACD,eAAe,OAAO,OAAO;IAC3B,WAAW,OAAO,OAAO;KACvB,GAAG,MAAM,cAAc;KACvB,QAAQ,OAAO,OAAO,EAAE,GAAG,MAAM,cAAc,UAAU,OAAO,CAAC;KACjE,UAAU,sBAAsB,MAAM,cAAc,UAAU,QAAQ;IACxE,CAAC;IACD;IACA;GACF,CAAC;EACH,CAAC;CACH,CAAC;CAED,MAAM,yBAAyB,OAAO,GAAG,gCAAgC,CAAC,CAAC,WACzE,SACA,eACA,OACA,QACA;EACA,MAAM,mBACJ,WAAW,oBAAoB,MAAM,SAAS,6BAA6B,KAAA;EAE7E,IACE,CAAC,MAAM,SAAS,YAChB,CAAC,kBAAkB,OAAO,MAAM,KAChC,MAAM,cAAc,UAAU,aAAa,MAAM,YACjD,MAAM,cAAc,UAAU,WAAW,UACzC,MAAM,cAAc,UAAU,cAAc,MAAM,aAClD,CAAC,eAAe,MAAM,cAAc,UAAU,QAAQ,MAAM,MAAM,KAClE,MAAM,cAAc,UAAU,uBAAuB,MAAM,SAAS,QAAQ,gBAC5E,CAAC,kBAAkB,MAAM,cAAc,UAAU,UAAU,MAAM,SAAS,QAAQ,KAClF,MAAM,cAAc,UAAU,6BAC5B,MAAM,SAAS,4BAChB,MAAM,cAAc,SAAS,WAAuB,MAAM,aAC3D,MAAM,cAAc,SAAS,kBAAkB,MAAM,cAAc,UAAU,iBAC7E,CAAC,kBAAkB,MAAM,cAAc,SAAS,UAAU,MAAM,SAAS,QAAQ,KAChF,WAAW,oBAAoB,MAAM,SAAS,WAAW,KAAA,KACzD,WAAW,oBAAoB,MAAM,SAAS,WAAW,KAAA,KAC1D,sBAAsB,MAAM,iBAAiB,KAAA,MAC5C,MAAM,cAAc,qBAAqB,eACxC,QAAQ,wBAAwB,4BAElC,OAAO,KAAA;EAET,MAAM,UAAU,OAAO,eACrB,SACA;GACE,UAAU,MAAM;GAChB,WAAW,MAAM,SAAS,SAAS;GACnC,QAAQ,MAAM;GACd,GAAI,MAAM,SAAS,WAAW,KAAA,IAC1B,CAAC,IACD,EAAE,oBAAoB,MAAM,SAAS,OAAO,aAAa;EAC/D,GACA,cAAc,OAChB;EAEA,IACE,YAAY,KAAA,KACZ,CAAC,QAAQ,YACT,CAAC,kBAAkB,QAAQ,UAAU,MAAM,SAAS,QAAQ,KAC5D,QAAQ,6BAA6B,MAAM,SAAS,4BACnD,MAAM,SAAS,WAAW,KAAA,MACxB,QAAQ,WAAW,KAAA,KAClB,QAAQ,OAAO,SAAS,uBAAuB,MAAM,SAAS,OAAO,sBACrE,QAAQ,OAAO,SAAS,uBAAuB,MAAM,SAAS,OAAO,sBACrE,CAAC,eAAe,QAAQ,OAAO,SAAS,YAAY,MAAM,SAAS,OAAO,UAAU,IAExF,OAAO,KAAA;EAET,MAAM,qBAAqB,OAAO,QAAQ,QAAQ,wBAChD,QAAQ,SACR,MACF;EAEA,MAAM,WAAW,OAAO,qBACtB,MAAM,cAAc,UACpB,MAAM,cAAc,WACtB,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;EAEnC,MAAM,aAAa,OAAO,qBACxB,MAAM,cAAc,UACpB,kBACF,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;EAEnC,OAAO,SAAS,aAAa,WAAW,YAAY,UAAU,KAAA;CAChE,CAAC;CAED,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,UACA,WACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,eAAe,OAAO;EAEhC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,IAAI,GAAG,EAAE,UAAU,QAAQ,GAAG,GAAG,EAAE,WAAW,SAAS,CAAC,CAAC,CAAC,CAChE,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,gBAAgB,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAC5D,SACA,OACA,QACA,SACA,WAQA,KACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EACnC,MAAM,IAAI,kBAAkB,OAAO;EACnC,MAAM,IAAI,iBAAiB,OAAO;EAClC,MAAM,IAAI,eAAe,OAAO;EAEhC,MAAM,qBACJ,QAAQ,mBAAmB,QAAQ,WAAW,iBAAiB,UAAU;EAE3E,IAAI,WAAW,kBAAkB;GAC/B,MAAM,SAAS,QAAQ;GAEvB,OAAO,SACJ,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,IACC,QAAQ,WAAW,iBAAiB;IAClC,QAAQ,OAAO,SAAS;IACxB,iBAAiB,UAAU;GAC7B,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,EAAE,WAAW,OAAO,SAAS,WAAW,SAAS,GACpD,GAAG,EAAE,OAAO,OAAO,SAAS,WAAW,KAAK,GAC5C,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,iBAAiB,OAAO,SAAS,kBAAkB,CAC1D,CACF;GACF,OAAO,SACJ,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,IACC,QAAQ,WAAW,iBAAiB;IAClC,QAAQ,OAAO,SAAS;IACxB,oBAAoB,UAAU;GAChC,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,cAAc,OAAO,SAAS,YAAY,GAC/C,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,oBAAoB,OAAO,SAAS,kBAAkB,CAC7D,CACF;GACF,OAAO,SACJ,OAAO,QAAQ,oBAAoB,KAAK,CAAC,CACzC,IAAI,QAAQ,oBAAoB,iBAAiB,UAAU,wBAAwB,CAAC,CAAC,CACrF,MACC,IACE,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,cAAc,OAAO,SAAS,YAAY,GAC/C,GAAG,EAAE,UAAU,OAAO,SAAS,kBAAkB,CACnD,CACF;EACJ;EACA,IAAI,QAAQ,qBAAqB,KAAA,GAC/B,OAAO,SAAS,OAAO,QAAQ,WAAW,KAAK,CAAC,CAAC,OAC/C,QAAQ,WAAW,qBAAqB;GACtC,YAAY,MAAM;GAClB,WAAW,QAAQ;GACnB,kBAAkB;GAClB,iBAAiB,UAAU;EAC7B,CAAC,CACH;OAEA,OAAO,SACJ,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,IACC,QAAQ,WAAW,mBAAmB;GACpC,kBAAkB;GAClB,iBAAiB,UAAU;EAC7B,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,EAAE,WAAW,MAAM,OAAO,SAAS,GACtC,GAAG,EAAE,OAAO,MAAM,OAAO,KAAK,GAC9B,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,iBAAiB,QAAQ,iBAAkB,QAAQ,WAAW,gBAAgB,CACrF,CACF;EAEJ,IAAI,QAAQ,qBAAqB,KAAA,GAAW;GAC1C,OAAO,SAAS,OAAO,QAAQ,WAAW,KAAK,CAAC,CAAC,OAC/C,QAAQ,WAAW,qBAAqB;IACtC,UAAU,MAAM;IAChB,WAAW,QAAQ;IACnB,cAAc;IACd,YAAY,MAAM;IAClB,oBAAoB,UAAU;GAChC,CAAC,CACH;GACA,OAAO,SAAS,OAAO,QAAQ,oBAAoB,KAAK,CAAC,CAAC,OACxD,QAAQ,oBAAoB,aAAa;IACvC,WAAW,QAAQ;IACnB,cAAc;IACd,UAAU,UAAU;GACtB,CAAC,CACH;EACF,OAAO;GACL,MAAM,cAAc,QAAQ,iBAAiB,QAAQ,WAAW;GAEhE,OAAO,SACJ,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,IACC,QAAQ,WAAW,iBAAiB;IAClC,YAAY,MAAM;IAClB,oBAAoB,UAAU;GAChC,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,cAAc,kBAAkB,GACrC,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,oBAAoB,WAAW,CACtC,CACF;GACF,OAAO,SACJ,OAAO,QAAQ,oBAAoB,KAAK,CAAC,CACzC,IAAI,QAAQ,oBAAoB,iBAAiB,UAAU,wBAAwB,CAAC,CAAC,CACrF,MACC,IACE,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,cAAc,kBAAkB,GACrC,GAAG,EAAE,UAAU,WAAW,CAC5B,CACF;EACJ;EACA,OAAO,SACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,IAAI,aAAa,CAAC,CAAC,QAAQ,QAAQ,kBAAkB,UAAU,oBAAoB,CAAC,CAAC,CAAC,CAAC,CACvF,MACC,IACE,GAAG,EAAE,IAAI,QAAQ,eAAe,GAChC,GAAG,EAAE,kBAAkB,MAAM,SAAS,SAAS,gBAAgB,CACjE,CACF;EACF,OAAO,SAAS,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,OAC5C,QAAQ,QAAQ,aAAa;GAC3B,UAAU,MAAM;GAChB,WAAW,MAAM;GACjB;GACA,eAAe,MAAM,cAAc,UAAU;GAC7C,sBAAsB,MAAM,QAAQ;EACtC,CAAC,CACH;EAEA,MAAM,oBACJ,WAAW,mBACP,CAAC,IACD,OAAO,WACL,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,cAAc,QAAQ,OAAQ,SAAS,YAAY,GACxD,GAAG,EAAE,WAAW,QAAQ,eAAe,CACzC,CACF,GACF,KACF;EAEN,MAAM,UAAU,OAAO,gBAAgB,SAAS,MAAM,UAAU,MAAM,MAAM,EAAA,CAAG;EAE/E,MAAM,kBAAkB,OAAO,WAC7B,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,oBAAoB,KAAK,CAAC,CACvC,MACC,IAAI,GAAG,EAAE,WAAW,QAAQ,eAAe,GAAG,GAAG,EAAE,cAAc,kBAAkB,CAAC,CACtF,CAAC,CACA,MAAM,CAAC,GACV,KACF;EAEA,MAAM,UAAU,OAAO,WACrB,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MACC,IACE,GAAG,eAAe,OAAO,CAAC,CAAC,UAAU,MAAM,QAAQ,GACnD,GAAG,eAAe,OAAO,CAAC,CAAC,WAAW,MAAM,SAAS,GACrD,GAAG,eAAe,OAAO,CAAC,CAAC,QAAQ,MAAM,GACzC,GAAG,eAAe,OAAO,CAAC,CAAC,eAAe,MAAM,cAAc,UAAU,aAAa,GACrF,GACE,eAAe,OAAO,CAAC,CAAC,gBACxB,QAAQ,cAAc,MAAM,QAAQ,sBAAsB,CAC5D,CACF,CACF,CAAC,CACA,MAAM,CAAC,GACV,KACF;EAEA,MAAM,mBACJ,WAAW,KAAA,IACP,KAAA,IACA,OAAO,QAAQ,cAAc,OAAO,WAAW,QAAQ,WAAW,WAAW;EAEnF,MAAM,mBACJ,WAAW,mBACP,CAAC,IACD,OAAO,cAAc,SAAS,QAAQ,OAAQ,SAAS,YAAY,KAAK;EAE9E,MAAM,kBACJ,WAAW,mBACP,CAAC,IACD,OAAO,WACL,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,oBAAoB,KAAK,CAAC,CACvC,MACC,IACE,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,cAAc,QAAQ,OAAQ,SAAS,YAAY,CAC1D,CACF,CAAC,CACA,MAAM,CAAC,GACV,KACF;EAEN,OACE,WAAW,KAAA,KACX,QAAQ,UAAU,OAAO,OAAO,QAAQ,QAAQ,QAAQ,KAAK,QAAQ,eAAe,KACpF,QAAQ,QAAQ,eAAe,OAAO,QAAQ,QAAQ,QAAQ,OAAO,KACrE,OAAO,QAAQ,QAAQ,QAAQ,sBAAsB,UAAU,wBAC/D,OAAO,WAAW,QAAQ,WAAW,qBACnC,UAAU,4BACZ,qBAAqB,OACrB,OAAO,WAAW,QAAQ,WAAW,wBACnC,UAAU,4BACZ,OAAO,WAAW,QAAQ,WAAW,kBAAkB,sBACvD,QAAQ,UAAU,OAChB,OAAO,WAAW,QAAQ,WAAW,YACrC,QAAQ,eACV,KACA,QAAQ,WAAW,UAAU,OAAO,UAAU,KAC9C,QAAQ,WAAW,eAAe,OAAO,WAAW,QAAQ,WAAW,OAAO,KAC9E,gBAAgB,WAAW,KAC3B,gBAAgB,EAAE,CAAE,QAAQ,oBAAoB,cAC9C,UAAU,4BACZ,QAAQ,oBAAoB,eAC1B,gBAAgB,EAAE,CAAE,QAAQ,oBAAoB,OAClD,KACA,QAAQ,WAAW,MAClB,WAAW,oBACT,kBAAkB,WAAW,KAC5B,kBAAkB,EAAE,CAAE,QAAQ,WAAW,wBACvC,UAAU,4BACZ,CAAC,QAAQ,WAAW,eAAe,kBAAkB,EAAE,CAAE,QAAQ,WAAW,OAAO,KACnF,iBAAiB,WAAW,KAC5B,QAAQ,UAAU,OAChB,iBAAiB,EAAE,CAAE,QAAQ,WAAW,YACxC,QAAQ,eACV,KACA,iBAAiB,EAAE,CAAE,QAAQ,WAAW,qBACtC,UAAU,4BACZ,CAAC,QAAQ,WAAW,UAAU,iBAAiB,EAAG,KAClD,gBAAgB,WAAW,KAC3B,gBAAgB,EAAE,CAAE,QAAQ,oBAAoB,cAC9C,UAAU,4BACZ,CAAC,QAAQ,oBAAoB,eAC3B,gBAAgB,EAAE,CAAE,QAAQ,oBAAoB,OAClD;CAER,CAAC;CAED,MAAM,uBAAuB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACrE,eACA,OACA;EACA,MAAM,WAAW,OAAO;EAExB,IAAI,cAAc,UAAU,KAAA,GAAW,OAAO,OAAO,OAAO,KAAK,YAAY,CAAC;EAC9E,MAAM,aAAa,EAAE,MAAM,4BAA4B;EAEvD,MAAM,OAAO;GACX;GACA,UACE,UACA,SACA,YACG,QAAQ,QAAQ,QAAQ,QAAQ,CAAC;EACxC;EAkBA,OAAO,OAhBO,uBAEV,SAAS,aAAa,gBACpB,oBACE,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MACA,OAAO,KAAK,UAAU,SAChB,KACR,CAAC,CAAC,KACA,OAAO,eAAe,iBAAiB,WAA0C,CACnF,CACF,GACF,EAAE,MAAM,cAAc,KAAK,CAGX,CAAC,CAAC,KAClB,OAAO,GAAG,KAAK,GACf,OAAO,YAAY,UAAU;GAC3B,MAAM,SAAS,MAAM,QAAQ;GAE7B,OAAO,MAAM,QAAQ,WAAW,KAC9B,WAAW,KAAA,KACX,MAAM,aAAa,MAAM,KACzB,OAAO,UAAU,aACf,OAAO,QAAQ,IAAI,IACnB,OAAO,UAAU,KAAK;EAC5B,CAAC,CACH;CACF,CAAC;CAED,MAAM,kBAAkB,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,eACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,OAAO,OAAO,MACZ,UACA,eACA,OAAO,IAAI,aAAa;GACtB,MAAM,UAAU,OAAO;GAEvB,OAAO,OAAO,OAAO,QAAQ,QAAQ,YAAY,OAAO,CAAC;EAC3D,CAAC,CACH;CACF,CAAC;CAED,MAAM,iCAAiC,OAAO,GAAG,gCAAgC,CAAC,CAAC,WACjF,SACA,eAKA;EACA,MAAM,WAAW,OAAO;EAExB,IAAI,CAAC,cAAc,aACjB,QACE,WAAW,kBAAkB;GAC3B,GAAG;GACH,OAAO,cAAc,OAAO;EAC9B,CAAC,KAAK,OAAO,KAAA,CACb,KAAK,OAAO,SAAS,WAAW,CAAC;EACrC,MAAM,QAAQ,OAAO;EAErB,OAAO,wBAAwB,GAAG;GAChC,SAAS,WACN,wBAAwB,OAAO,IAC5B,SACE,UACA,eACA,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO,eAAe,SAAS,OAAO,cAAc,OAAO;IAE3E,IAAI,YAAY,KAAA,GAAW,OAAO,OAAO,YAAY;IAErD,OAAO,OAAO,OAAO;KACnB,UAAU,sBAAsB,QAAQ,QAAQ;KAChD,UAAU,QAAQ;KAClB,GAAI,QAAQ,6BAA6B,KAAA,IACrC,CAAC,IACD,EAAE,0BAA0B,QAAQ,yBAAyB;KACjE,GAAI,QAAQ,WAAW,KAAA,IACnB,CAAC,IACD,EAAE,QAAQ,OAAO,wBAAwB,QAAQ,OAAO,QAAQ,EAAE;IACxE,CAAC;GACH,CAAC,CACH,IACA,OAAO,KAAK,YAAY,CAAC,EAAA,CAC3B,KACA,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,kBAAkB,UAAU;IAC1B,IAAI,cAAc,UAAU,KAAA,KAAa,MAAM,QAAQ,SAAS,oBAC9D,OAAO,OAAO,QAAQ,KAAK,CAAC,CAAC,KAC3B,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;IACF,MAAM,UAAU,MAAM;IAEtB,OAAO,SACL,UACA,eACA,OAAO,IAAI,aAAa;KACtB,MAAM,SACJ,MAAM,SAAS,SAAS,iBAAiB,KACzC,MAAM,YAAY,+BACd,mBACA,MAAM,SAAS,SAAS,iBAAiB,KACvC,MAAM,YAAY,yBAClB,mBACA,KAAA;KAER,IAAI,WAAW,KAAA,GAAW,OAAO;KACjC,MAAM,WAAW,MAAM,SAAS,MAAM,GAAG,CAAC,IAAI,SAAS,MAAM;KAE7D,MAAM,UAAU,OAAO,eACrB,SACA;MACE;MACA,WAAW,QAAQ,SAAS;MAC5B,QAAQ,QAAQ;KAClB,GACA,KACF;KAEA,OAAO,YAAY,KAAA,KAAa,kBAAkB,QAAQ,UAAU,QAAQ,QAAQ;IACtF,CAAC,CACH,CAAC,CACE,KACC,OAAO,SAAS,YACd,UAAU,qBAAqB,eAAe,KAAK,IAAI,OAAO,QAAQ,KAAK,CAC7E,CACF,CAAC,CACA,KACC,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACJ;GACA,kBAAkB,YAAY,YAC5B,cAAc,SAAS,eAAe,YAAY,kBAAkB,OAAO,CAAC,CAAC,KAC3E,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,kBAAkB,YAAY,YAC5B,cAAc,SAAS,eAAe,YAAY,kBAAkB,OAAO,CAAC,CAAC,KAC3E,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,UAAU,OAAO,YACf,MACE,UACA,eACA,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IAEvB,MAAM,IAAI,eAAe,OAAO;IAChC,MAAM,MAAM,OAAO;IAEnB,MAAM,OAAO,OAAO,WAClB,YACG,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAClC,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,IAAI,EAAE,gBAAgB,QAAQ,cAAc,GAAG,CAAC,CAClD,CACF,CAAC,CACA,MAAM,MAAM,QAAQ,CAAC,GACxB,cAAc,OAChB;IAEA,MAAM,WAAW,KAAK,MAAM,GAAG,MAAM,KAAK;IAE1C,MAAM,UAAU,QACd;KAAE,SAAS,SAAS;KAAQ,SAAS,KAAK,SAAS,MAAM;IAAM,GAC/D,OACF;IAEA,IAAI,SAAS,SAAS,GACpB,OAAO,YAAY,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,MAC/C,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,QACE,EAAE,WACF,SAAS,KAAK,QAAa,IAAI,SAAS,CAC1C,GACA,IAAI,EAAE,gBAAgB,QAAQ,cAAc,GAAG,CAAC,CAClD,CACF;IAEF,OAAO;GACT,CAAC,CACH,CAAC,CAAC,KACA,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACJ,CAAC;CACH,CAAC;CAED,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,eACA,YACA,QACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,IAAI,CAAC,wBAAwB,OAAO,KAAK,cAAc,UAAU,KAAA,GAC/D,OAAO,OAAO,YAAY;EAC5B,MAAM,QAAQ,OAAO,sBAAsB,UAAU;EAErD,MAAM,qBAAqB,OAAO,SAChC,cAAc,MACd,QAAQ,sBACR,QAAQ,wBACV;EAEA,MAAM,2BAA2B,OAAO,SACtC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;EAEA,MAAM,2BAA2B,OAAO,SACtC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;EAEA,MAAM,2BAA2B,OAAO,SACtC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;EAEA,MAAM,2BAA2B,OAAO,SACtC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;EAEA,MAAM,mBACJ,WAAW,oBAAoB,MAAM,SAAS,6BAA6B,KAAA;EAE7E,MAAM,eAAe,mBACjB,MAAM,SAAS,SAAS,mBACxB,OAAO,qBACL,SACA,cAAc,MACd,MAAM,SAAS,SAAS,gBAC1B;EAEJ,IACG,CAAC,oBAAoB,iBAAiB,MAAM,SAAS,SAAS,oBAC/D;GACE;GACA;GACA;GACA;EACF,CAAC,CAAC,MAAM,UAAU,MAAM,SAAS,SAAS,YAAY,MAAM,SAAS,KAAK,aAAa,KAAK,CAAC,GAE7F,OAAO,OAAO,YAAY;EAsE5B,OAAO,OApEK,MACV,UACA,eACA,OAAO,IAAI,aAAa;GACtB,MAAM,UAAU,OAAO;GAEvB,MAAM,UAAU,OAAO,uBAAuB,SAAS,eAAe,OAAO,MAAM;GAEnF,IAAI,YAAY,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;GAC7D,KACG,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,WAAW,cAAc,OAAO,EAAA,CAClF,SAAS,GAEZ,OAAO,QAAQ,YAAY,OAAO;GACpC,IAAI;GAEJ,OAAO,oBACL,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MAAM,YACN,OAAO,IAAI,aAAa;IAGtB,MAAM,qBAAqB,OAAO,QAAQ,QAAQ,wBAChD,QAAQ,SACR,MACF;IAEA,MAAM,WAAW,OAAO,qBACtB,MAAM,cAAc,UACpB,MAAM,cAAc,WACtB,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;IAEnC,MAAM,aAAa,OAAO,qBACxB,MAAM,cAAc,UACpB,kBACF,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;IAEnC,IAAI,CAAC,SAAS,aAAa,CAAC,WAAW,WAAW,OAAO;IACzD,MAAM,MAAM,OAAO;IAEnB,OAAO,OAAO,cACZ,SACA,OACA,QACA,SACA;KACE;KACA;KACA;KACA;KACA;KACA,sBAAsB;IACxB,GACA,GACF;GACF,CAAC,IACA,aAAa;IACZ,UAAU,QAAQ,aAAa,cAAc,YAAY,YAAY,OAAO;IAE5E,OAAO;GACT,CACF;GAEA,OAAO,WAAW,QAAQ,YAAY,OAAO;EAC/C,CAAC,CAGa,CAAC,CAAC,KAChB,OAAO,YAAY,UAChB,MAAM,QAAQ,MAAM,MAAM,YAAY,KACrC,2BAA2B,QAAQ,mBAAmB,KAAK,KAC5D,MAAM,QAAQ,MAAM,MAAM,YAAY,KACrC,2BAA2B,QAAQ,sBAAsB,KAAK,KAC/D,MAAM,QAAQ,MAAM,MAAM,YAAY,KACrC,2BAA2B,QAAQ,sBAAsB,KAAK,IAC5D,gBAAgB,eAAe,OAAO,IACtC,OAAO,UAAU,KAAK,CAC5B,CACF;CACF,CAAC;CAED,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF"}

package/dist/internal/models/passkey-registration-ceremony-model.mjs

@@ -1,18 +0,0 @@
-//#region src/internal/models/passkey-registration-ceremony-model.ts
-const requiredPasskeyRegistrationCeremonyConstraints = {
-	flow: ["moduleId", "flowId"],
-	command: ["moduleId", "commandId"],
-	admission: ["authorityScope", "moduleId"],
-	charge: [
-		"moduleId",
-		"flowId",
-		"kind"
-	],
-	intentFlow: ["moduleId", "flowId"],
-	intentCommand: ["moduleId", "commandId"],
-	handle: ["handleKey"]
-};
-//#endregion
-export { requiredPasskeyRegistrationCeremonyConstraints };
-
-//# sourceMappingURL=passkey-registration-ceremony-model.mjs.map

package/dist/internal/models/passkey-registration-ceremony-model.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"passkey-registration-ceremony-model.mjs","names":[],"sources":["../../../src/internal/models/passkey-registration-ceremony-model.ts"],"sourcesContent":["import type { TableModel as Table, SqlExpression } from \"../query-operations\";\nimport type {\n  PasskeyCeremonyMapping,\n  PasskeyChargeTable,\n  PasskeyColumn,\n  PasskeyFlowTable,\n  PasskeyHandleReservationTable,\n  PasskeyPersistenceServices,\n} from \"./passkey-model\";\n\nexport interface PasskeyRegistrationCeremonyCapabilities {\n  readonly purposes: readonly [\"registration\"];\n  readonly issue: \"registration-authority\";\n  readonly assertionSettlement: false;\n}\n\nexport interface PasskeyRegistrationCeremonyServices extends PasskeyPersistenceServices {\n  readonly capabilities: PasskeyRegistrationCeremonyCapabilities;\n}\n\n/** Read-only custody supplied by a separate registration issuance authority.\n * No application payload codec, subject codec or provisioning callback runs here. */\nexport interface PasskeyRegistrationIntentReadTable<\n  T extends Table,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: T[\"table\"];\n  readonly moduleId: PasskeyColumn<T>;\n  readonly flowId: PasskeyColumn<T>;\n  readonly commandId: PasskeyColumn<T>;\n  readonly state: PasskeyColumn<T>;\n  readonly version: PasskeyColumn<T>;\n  readonly fingerprint: PasskeyColumn<T>;\n  readonly handleKey: PasskeyColumn<T>;\n  readonly reservationId: PasskeyColumn<T>;\n  readonly ceremonySnapshot: PasskeyColumn<T>;\n  /** Already validated by the issuing authority; compare opaque bytes only. */\n  readonly applicationSnapshot: PasskeyColumn<T>;\n  readonly pendingCondition: Expression;\n  readonly isPendingState: (value: unknown) => boolean;\n  /** Any unresolved initial intent or provisioning job; cleanup never releases it. */\n  readonly custodyCondition: Expression;\n}\n\nexport const requiredPasskeyRegistrationCeremonyConstraints = {\n  flow: [\"moduleId\", \"flowId\"],\n  command: [\"moduleId\", \"commandId\"],\n  admission: [\"authorityScope\", \"moduleId\"],\n  charge: [\"moduleId\", \"flowId\", \"kind\"],\n  intentFlow: [\"moduleId\", \"flowId\"],\n  intentCommand: [\"moduleId\", \"commandId\"],\n  handle: [\"handleKey\"],\n} as const;\n\nexport interface PasskeyRegistrationCeremonyMapping<\n  Module extends Table,\n  Flow extends Table,\n  Admission extends Table,\n  Charge extends Table,\n  Intent extends Table,\n  Handle extends Table,\n  Expression extends SqlExpression = SqlExpression,\n> extends Omit<\n  PasskeyCeremonyMapping<Module, Flow, Admission, Charge, Expression>,\n  \"constraints\" | \"flow\" | \"charge\"\n> {\n  readonly flow: Omit<PasskeyFlowTable<Flow>, \"encodeInsert\">;\n  readonly charge: Omit<PasskeyChargeTable<Charge>, \"encodeInsert\">;\n  readonly intent: PasskeyRegistrationIntentReadTable<Intent, Expression>;\n  readonly handle: PasskeyHandleReservationTable<Handle, Expression>;\n  readonly constraints: typeof requiredPasskeyRegistrationCeremonyConstraints;\n}\n"],"mappings":";AA4CA,MAAa,iDAAiD;CAC5D,MAAM,CAAC,YAAY,QAAQ;CAC3B,SAAS,CAAC,YAAY,WAAW;CACjC,WAAW,CAAC,kBAAkB,UAAU;CACxC,QAAQ;EAAC;EAAY;EAAU;CAAM;CACrC,YAAY,CAAC,YAAY,QAAQ;CACjC,eAAe,CAAC,YAAY,WAAW;CACvC,QAAQ,CAAC,WAAW;AACtB"}

package/dist/internal/oauth/accounts.d.mts

@@ -1,8 +0,0 @@
-import "../mapping-error.mjs";
-import "./owner.mjs";
-import "./query-compiler.mjs";
-import "./flow.mjs";
-import "./registration.mjs";
-import { Context, Effect, Layer } from "effect";
-import { SecurityRevision } from "@yielded/auth/Sessions";
-import { OAuthAccountRevision, OAuthLinkAccess } from "@yielded/auth/OAuth";

package/dist/internal/oauth/accounts.mjs

@@ -1,379 +0,0 @@
-import { CurrentOAuthTransaction } from "./owner.mjs";
-import { OAuthQueryCompiler } from "./query-compiler.mjs";
-import { invariant, oauthIdentityKey, sameRevision, satisfies, storage, validAction } from "./state.mjs";
-import { OAuthFlow } from "./flow.mjs";
-import { OAuthRegistration } from "./registration.mjs";
-import { Context, DateTime, Effect, Layer } from "effect";
-import { AuthenticationRequirement, SecurityRevision, SessionInvalidationWindow } from "@yielded/auth/Sessions";
-import { OAuthAccountRevision, OAuthActionAuthorization, OAuthCredentialSnapshot, OAuthLinkAccess, OAuthLinkClaim, OAuthLinkPendingFlow, OAuthLinkTransactionContext, OAuthUnlinked, snapshotOAuthSync } from "@yielded/auth/OAuth";
-//#region src/internal/oauth/accounts.ts
-const make$1 = Effect.gen(function* () {
-	const operations = yield* OAuthQueryCompiler;
-	const flow = yield* OAuthFlow;
-	const registration = yield* OAuthRegistration;
-	const { eq, sql } = operations;
-	const { claimFlow, credentialStorage, currentSubject, exactClaim, issueFlow, linkStorage, matchesAccess, readFlow, terminalFlow } = flow;
-	const { both, col, copiedRow, equal } = operations;
-	const { acquireTuple, readTuple } = registration;
-	const contextStorage = storage(OAuthLinkTransactionContext);
-	const unlinkedStorage = storage(OAuthUnlinked);
-	const accountCurrent = (mapping, subjectId) => Effect.gen(function* () {
-		const native = yield* mapping.subjectId.toNative(subjectId);
-		return yield* currentSubject(mapping, native);
-	});
-	const authorization = (mapping, current, auth, action, flowId, commandId, intent, maximumAge) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
-		const now = yield* owner.now(mapping.clock);
-		const currentRequirement = snapshotOAuthSync(AuthenticationRequirement, mapping.subject.decodeActionRequirement(copiedRow(current.row), action));
-		if (!(yield* validAction(auth, {
-			moduleId: auth.challenge.moduleId,
-			action,
-			flowId,
-			commandId,
-			revision: current.revision,
-			intent
-		}, currentRequirement, now, maximumAge))) return false;
-		const age = Math.min(maximumAge, auth.requirement.maximumAgeMillis, currentRequirement.maximumAgeMillis);
-		const fresh = auth.evidence.proofs.filter((proof) => now - DateTime.toEpochMillis(proof.verifiedAt) < age);
-		invariant(fresh.length > 0);
-		const deadline = Math.min(...fresh.map((proof) => DateTime.toEpochMillis(proof.verifiedAt) + age));
-		owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${deadline}`);
-		return true;
-	}));
-	const currentLink = (mapping, flow) => Effect.gen(function* () {
-		const current = yield* accountCurrent(mapping, flow.context.revision.subjectId);
-		return current !== void 0 && sameRevision(current.revision, flow.context.revision) ? current : void 0;
-	});
-	const issueLink = (mapping, input) => Effect.gen(function* () {
-		const flow = snapshotOAuthSync(OAuthLinkPendingFlow, input.flow), c = flow.context;
-		const current = yield* currentLink(mapping, flow);
-		const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization);
-		if (current === void 0 || auth.challenge.moduleId !== c.moduleId || !(yield* authorization(mapping, current, auth, "link-begin", c.flowId, c.commandId, contextStorage.encode(c), c.maximumEvidenceAgeMillis))) return { _tag: "Rejected" };
-		return yield* issueFlow(mapping, flow, "link");
-	});
-	const preflightLink = (mapping, original) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
-		const input = snapshotOAuthSync(OAuthLinkAccess, original);
-		const current = yield* accountCurrent(mapping, input.subjectId);
-		const found = yield* readFlow(mapping, input, "link");
-		const now = yield* owner.now(mapping.clock);
-		if (current === void 0 || found.flow === void 0 || found.row?.[mapping.flow.state] !== "Pending" || !matchesAccess(found.flow, input)) return void 0;
-		const flow = snapshotOAuthSync(OAuthLinkPendingFlow, found.flow), c = flow.context;
-		if (c.revision.subjectId !== input.subjectId || !sameRevision(current.revision, c.revision) || now < c.issuedAtMillis || now >= c.expiresAtMillis) return void 0;
-		owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${c.issuedAtMillis} and ${mapping.clock.engineNowMillis} < ${c.expiresAtMillis}`);
-		return {
-			current,
-			flow,
-			row: found.row
-		};
-	}));
-	const claimLink = (mapping, input) => Effect.gen(function* () {
-		const found = yield* preflightLink(mapping, input.access);
-		const flow = snapshotOAuthSync(OAuthLinkPendingFlow, input.flow);
-		const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization), c = flow.context;
-		if (found === void 0 || linkStorage.encode(found.flow) !== linkStorage.encode(flow) || auth.challenge.moduleId !== c.moduleId || !(yield* authorization(mapping, found.current, auth, "link-complete", c.flowId, c.commandId, contextStorage.encode(c), c.maximumEvidenceAgeMillis))) return { _tag: "Rejected" };
-		const claim = yield* claimFlow(mapping, {
-			row: found.row,
-			flow
-		}, input.claimId);
-		return claim === void 0 ? { _tag: "Rejected" } : {
-			_tag: "Claimed",
-			claim
-		};
-	});
-	const checkInvalidation = (mapping, original) => {
-		const value = snapshotOAuthSync(SessionInvalidationWindow, original);
-		invariant(value.trigger === "credential-change" && value.oldAuthenticationEvidence === "rejected" && (mapping.sessionInvalidation === "same-authority-immediate" ? value.existingSessions === "immediate" && value.maximumExposureMillis === 0 : value.existingSessions === "original-absolute-expiry"));
-		return value;
-	};
-	const advance = (mapping, current, removed) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
-		const revision = mapping.subject.nextSecurityRevision(current.revision.securityRevision);
-		invariant(typeof revision === "string" && revision.length > 0 && revision.length <= 256 && revision !== current.revision.securityRevision);
-		const subject = mapping.subject;
-		yield* owner.update(subject.table, { [subject.id]: current.nativeId }, { [subject.securityRevision]: revision });
-		for (const cleanup of mapping.cleanup) {
-			const condition = both(eq(col(cleanup.table, cleanup.subjectId), current.nativeId), cleanup.condition({
-				subjectId: current.nativeId,
-				revision: snapshotOAuthSync(OAuthAccountRevision, current.revision),
-				...removed === void 0 ? {} : { removedCredentialId: removed }
-			}));
-			yield* owner.write(owner.database.delete(cleanup.table).where(condition));
-			owner.postconditions.push(sql`not exists(select 1 from ${cleanup.table} where ${condition})`);
-		}
-		return SecurityRevision.make(revision);
-	}));
-	const settleLink = (mapping, input, allocated) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
-		const claim = snapshotOAuthSync(OAuthLinkClaim, input.claim), flow = claim.flow, c = flow.context;
-		const current = yield* currentLink(mapping, flow);
-		const identity = input.outcome._tag === "Verified" ? input.outcome.identity.identity : void 0;
-		if (identity !== void 0) invariant(identity.provider === c.provider && identity.issuer === c.issuer);
-		const tuple = identity !== void 0 && current !== void 0 ? yield* readTuple(mapping.ownership, identity) : void 0;
-		if ((yield* exactClaim(mapping, claim, "link")) === void 0) return { _tag: "Rejected" };
-		let decision = { _tag: input.outcome._tag };
-		if (input.outcome._tag === "Verified") {
-			decision = { _tag: "Rejected" };
-			const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization);
-			if (current !== void 0 && tuple !== void 0 && auth.challenge.moduleId === c.moduleId && (yield* authorization(mapping, current, auth, "link-complete", c.flowId, c.commandId, contextStorage.encode(c), c.maximumEvidenceAgeMillis))) {
-				const t = mapping.ownership.tuple, cr = mapping.credential, a = mapping.authority;
-				const login = yield* owner.read(cr.table, eq(col(cr.table, cr.identityKey), tuple.key), { limit: 1 });
-				const previous = login.rows[0];
-				if (tuple.row[t.state] === "Reserved" || tuple.row[t.state] === "Owned" && !mapping.subjectId.equals(tuple.row[t.subjectId], current.nativeId) || previous !== void 0 && (previous[cr.moduleId] !== c.moduleId || !mapping.subjectId.equals(previous[cr.subjectId], current.nativeId) || !cr.isActiveStatus(previous[cr.status]))) decision = { _tag: "Conflict" };
-				else if (previous !== void 0) {
-					const shared = current.revision.credentials.find((item) => item.credentialId === previous[cr.credentialId]);
-					if (tuple.row[t.state] !== "Owned" || shared?.revision !== previous[cr.credentialRevision] || !(yield* owner.check(sql`exists(select 1 from ${cr.table} where ${both(eq(col(cr.table, cr.identityKey), tuple.key), cr.activeCondition)})`))) decision = { _tag: "Conflict" };
-					else decision = {
-						_tag: "Linked",
-						changed: false,
-						credential: snapshotOAuthSync(OAuthCredentialSnapshot, {
-							moduleId: c.moduleId,
-							identity,
-							credentialId: previous[cr.credentialId],
-							credentialRevision: previous[cr.credentialRevision],
-							revision: current.revision
-						})
-					};
-				} else {
-					checkInvalidation(mapping, input.invalidation);
-					const values = {
-						...cr.encodeInsert({
-							moduleId: c.moduleId,
-							subjectId: current.nativeId,
-							identityKey: tuple.key,
-							credentialId: allocated.credentialId,
-							credentialRevision: allocated.revision
-						}),
-						[cr.moduleId]: c.moduleId,
-						[cr.subjectId]: current.nativeId,
-						[cr.identityKey]: tuple.key,
-						[cr.credentialId]: allocated.credentialId,
-						[cr.credentialRevision]: allocated.revision
-					};
-					invariant(cr.isActiveStatus(values[cr.status]));
-					login.rows = (yield* owner.insert(cr.table, values, { [cr.credentialId]: allocated.credentialId })).rows;
-					const sharedValues = {
-						...a.encodeInsert({
-							subjectId: current.nativeId,
-							credentialId: allocated.credentialId,
-							revision: allocated.revision
-						}),
-						[a.subjectId]: current.nativeId,
-						[a.credentialId]: allocated.credentialId,
-						[a.revision]: allocated.revision
-					};
-					invariant(a.isActiveStatus(sharedValues[a.status]));
-					const shared = yield* owner.insert(a.table, sharedValues, {
-						[a.subjectId]: current.nativeId,
-						[a.credentialId]: allocated.credentialId
-					});
-					current.authorities.rows = [...current.authorities.rows, ...shared.rows];
-					owner.postconditions.push(sql`exists(select 1 from ${cr.table} where ${both(eq(col(cr.table, cr.credentialId), allocated.credentialId), cr.activeCondition)})`, sql`exists(select 1 from ${a.table} where ${both(eq(col(a.table, a.subjectId), current.nativeId), eq(col(a.table, a.credentialId), allocated.credentialId), a.activeCondition)})`);
-					if (tuple.row[t.state] === "Unowned") yield* acquireTuple(mapping.ownership, identity, tuple.key, current.nativeId);
-					const next = yield* advance(mapping, current);
-					const revision = snapshotOAuthSync(OAuthAccountRevision, {
-						...current.revision,
-						securityRevision: next,
-						credentials: [...current.revision.credentials, {
-							credentialId: allocated.credentialId,
-							revision: allocated.revision
-						}]
-					});
-					decision = {
-						_tag: "Linked",
-						changed: true,
-						credential: snapshotOAuthSync(OAuthCredentialSnapshot, {
-							moduleId: c.moduleId,
-							identity,
-							credentialId: allocated.credentialId,
-							credentialRevision: allocated.revision,
-							revision
-						})
-					};
-				}
-			}
-		}
-		yield* terminalFlow(mapping, flow, decision._tag);
-		return decision;
-	}));
-	const targetCredential = (mapping, moduleId, credentialId, current) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
-		const cr = mapping.credential;
-		const row = (yield* owner.read(cr.table, eq(col(cr.table, cr.credentialId), credentialId), { limit: 1 })).rows[0];
-		if (row === void 0 || row[cr.moduleId] !== moduleId || !mapping.subjectId.equals(row[cr.subjectId], current.nativeId) || !cr.isActiveStatus(row[cr.status])) return void 0;
-		const t = mapping.ownership.tuple;
-		const ownership = (yield* owner.read(t.table, eq(col(t.table, t.identityKey), row[cr.identityKey]), { limit: 1 })).rows[0];
-		if (ownership === void 0 || ownership[t.state] !== "Owned" || !mapping.subjectId.equals(ownership[t.subjectId], current.nativeId)) return void 0;
-		const identity = {
-			provider: ownership[t.provider],
-			issuer: ownership[t.issuer],
-			subject: ownership[t.externalSubject]
-		};
-		invariant((yield* oauthIdentityKey(identity)) === row[cr.identityKey]);
-		if (current.revision.credentials.find((item) => item.credentialId === credentialId)?.revision !== row[cr.credentialRevision] || !(yield* owner.check(sql`exists(select 1 from ${cr.table} where ${both(eq(col(cr.table, cr.credentialId), credentialId), cr.activeCondition)})`))) return void 0;
-		return snapshotOAuthSync(OAuthCredentialSnapshot, {
-			moduleId,
-			identity,
-			credentialId,
-			credentialRevision: row[cr.credentialRevision],
-			revision: current.revision
-		});
-	}));
-	const unlinkCommand = (mapping, moduleId, commandId) => Effect.flatMap(CurrentOAuthTransaction, (owner) => owner.read(mapping.command.table, equal(mapping.command.table, {
-		[mapping.command.moduleId]: moduleId,
-		[mapping.command.commandId]: commandId
-	}), { limit: 1 }));
-	const inspectUnlink = (mapping, input) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
-		const current = yield* accountCurrent(mapping, input.subjectId);
-		if (current === void 0) return { _tag: "Rejected" };
-		const command = yield* unlinkCommand(mapping, input.moduleId, input.commandId), r = mapping.command;
-		const old = command.rows[0];
-		if (old !== void 0) {
-			const intent = credentialStorage.decode(old[r.intentSnapshot]);
-			if (intent.moduleId !== input.moduleId || intent.revision.subjectId !== input.subjectId || intent.credentialId !== input.credentialId || !mapping.subjectId.equals(old[r.subjectId], current.nativeId) || old[r.credentialId] !== input.credentialId) return { _tag: "Conflict" };
-			const metadata = mapping.metadata.condition(current.nativeId);
-			if (!(yield* owner.check(metadata))) return { _tag: "Rejected" };
-			owner.postconditions.push(metadata);
-			return {
-				_tag: "Replay",
-				result: unlinkedStorage.decode(old[r.decision])
-			};
-		}
-		const credential = yield* targetCredential(mapping, input.moduleId, input.credentialId, current);
-		return credential === void 0 ? { _tag: "Rejected" } : {
-			_tag: "Target",
-			credential
-		};
-	}));
-	const remainingEligibility = (mapping, current, removed) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
-		invariant(mapping.eligibility.length > 0 && mapping.eligibility.length <= 32);
-		const facts = /* @__PURE__ */ new Map();
-		const revisions = new Map(current.revision.credentials.map((item) => [item.credentialId, item.revision]));
-		for (const descriptor of mapping.eligibility) {
-			const observed = yield* owner.read(descriptor.table, both(eq(col(descriptor.table, descriptor.subjectId), current.nativeId), descriptor.condition(current.nativeId)), { orderBy: col(descriptor.table, descriptor.credentialId) });
-			for (const row of observed.rows) {
-				const fact = descriptor.decode(copiedRow(row));
-				if (fact === void 0 || fact.credentialId === removed) continue;
-				invariant(fact.credentialId === row[descriptor.credentialId] && fact.revision === row[descriptor.revision] && revisions.get(fact.credentialId) === fact.revision && fact.factors.length <= 8 && fact.factors.every((factor) => [
-					"knowledge",
-					"possession",
-					"inherence"
-				].includes(factor)));
-				invariant(typeof fact.usablePrimary === "boolean" && typeof fact.userVerified === "boolean" && typeof fact.phishingResistant === "boolean");
-				const normalized = {
-					credentialId: fact.credentialId,
-					revision: fact.revision,
-					usablePrimary: fact.usablePrimary,
-					factors: [...new Set(fact.factors)].sort(),
-					userVerified: fact.userVerified,
-					phishingResistant: fact.phishingResistant
-				};
-				const prior = facts.get(fact.credentialId);
-				invariant(prior === void 0 || JSON.stringify(prior) === JSON.stringify(normalized));
-				facts.set(fact.credentialId, normalized);
-			}
-		}
-		const available = [...facts.values()];
-		const requirement = snapshotOAuthSync(AuthenticationRequirement, mapping.subject.decodeAuthenticationRequirement(copiedRow(current.row)));
-		return available.some((fact) => fact.usablePrimary) && satisfies(available, requirement);
-	}));
-	const unlink = (mapping, input) => Effect.flatMap(CurrentOAuthTransaction, (owner) => Effect.gen(function* () {
-		const expected = snapshotOAuthSync(OAuthCredentialSnapshot, input.credential);
-		invariant(expected.moduleId === input.moduleId);
-		const current = yield* accountCurrent(mapping, expected.revision.subjectId);
-		if (current === void 0) return { _tag: "Rejected" };
-		const guards = mapping.connectedReferenceGuards ?? [];
-		invariant(guards.length <= 32);
-		let referencesGuarded = mapping.connectedReference !== void 0 && guards.length > 0;
-		if (mapping.connectedReference !== void 0) for (const guard of guards) {
-			const condition = guard.condition({
-				identity: snapshotOAuthSync(OAuthCredentialSnapshot.fields.identity, expected.identity),
-				identityKey: yield* oauthIdentityKey(expected.identity),
-				subjectId: copiedRow({ value: current.nativeId }).value
-			});
-			if ((yield* owner.read(guard.table, Effect.isEffect(condition) ? yield* condition : condition, { orderBy: col(guard.table, guard.orderBy) })).rows.length === 0) referencesGuarded = false;
-		}
-		const command = yield* unlinkCommand(mapping, input.moduleId, input.commandId), r = mapping.command;
-		const previous = command.rows[0];
-		if (previous !== void 0) {
-			if (previous[r.intentSnapshot] !== credentialStorage.encode(expected) || previous[r.credentialId] !== expected.credentialId || !mapping.subjectId.equals(previous[r.subjectId], current.nativeId)) return { _tag: "Conflict" };
-			const metadata = mapping.metadata.condition(current.nativeId);
-			if (!(yield* owner.check(metadata))) return { _tag: "Rejected" };
-			owner.postconditions.push(metadata);
-			return {
-				_tag: "Unlinked",
-				replayed: true,
-				result: unlinkedStorage.decode(previous[r.decision])
-			};
-		}
-		const actual = yield* targetCredential(mapping, input.moduleId, expected.credentialId, current);
-		if (actual === void 0 || credentialStorage.encode(actual) !== credentialStorage.encode(expected)) return { _tag: "Rejected" };
-		const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization);
-		if (auth.challenge.moduleId !== input.moduleId || !(yield* authorization(mapping, current, auth, "unlink", input.commandId, input.commandId, credentialStorage.encode(expected), auth.requirement.maximumAgeMillis))) return { _tag: "Rejected" };
-		if (!(yield* remainingEligibility(mapping, current, expected.credentialId))) return { _tag: "LastSignInMethod" };
-		const invalidation = checkInvalidation(mapping, input.invalidation), cr = mapping.credential, a = mapping.authority;
-		const key = yield* oauthIdentityKey(expected.identity), t = mapping.ownership.tuple;
-		const connected = mapping.connectedReference?.({
-			identityKey: key,
-			subjectId: copiedRow({ value: current.nativeId }).value
-		});
-		const retain = connected !== void 0 && (!referencesGuarded || (yield* owner.check(connected)));
-		if (connected !== void 0 && referencesGuarded) owner.postconditions.push(retain ? connected : sql`not (${connected})`);
-		yield* owner.remove(cr.table, { [cr.credentialId]: expected.credentialId });
-		yield* owner.remove(a.table, {
-			[a.subjectId]: current.nativeId,
-			[a.credentialId]: expected.credentialId
-		});
-		if (!retain) {
-			yield* owner.update(t.table, { [t.identityKey]: key }, {
-				[t.state]: "Unowned",
-				[t.subjectId]: null,
-				[t.reservation]: null,
-				[t.version]: owner.marker
-			});
-			if (mapping.ownership.mode === "separate") yield* owner.remove(mapping.ownership.external.table, { [mapping.ownership.external.identityKey]: key });
-		}
-		yield* advance(mapping, current, expected.credentialId);
-		const result = snapshotOAuthSync(OAuthUnlinked, {
-			_tag: "Unlinked",
-			credentialId: expected.credentialId,
-			invalidation
-		});
-		const now = yield* owner.now(mapping.clock);
-		invariant(Number.isSafeInteger(input.retentionUntilMillis) && input.retentionUntilMillis > now && input.retentionUntilMillis >= input.nowMillis + 12e4);
-		const commandKey = {
-			[r.moduleId]: input.moduleId,
-			[r.commandId]: input.commandId
-		};
-		const values = {
-			...r.encodeInsert({
-				moduleId: input.moduleId,
-				commandId: input.commandId,
-				credential: snapshotOAuthSync(OAuthCredentialSnapshot, expected)
-			}),
-			...commandKey,
-			[r.subjectId]: current.nativeId,
-			[r.credentialId]: expected.credentialId,
-			[r.intentSnapshot]: credentialStorage.encode(expected),
-			[r.decision]: unlinkedStorage.encode(result),
-			[r.retentionUntil]: mapping.clock.encodeInstant(input.retentionUntilMillis)
-		};
-		command.rows = (yield* owner.insert(r.table, values, commandKey)).rows;
-		return {
-			_tag: "Unlinked",
-			result,
-			replayed: false
-		};
-	}));
-	return {
-		accountCurrent,
-		issueLink,
-		preflightLink,
-		claimLink,
-		settleLink,
-		inspectUnlink,
-		unlink
-	};
-});
-var OAuthAccounts = class OAuthAccounts extends Context.Service()("effect-auth/persistence/OAuthAccounts") {
-	static layer = Layer.effect(OAuthAccounts, make$1);
-};
-//#endregion
-export { OAuthAccounts };
-
-//# sourceMappingURL=accounts.mjs.map