@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.26

package/dist/internal/password-kernel.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"password-kernel.mjs","names":["sameCredentialSnapshot"],"sources":["../../src/internal/password-kernel.ts"],"sourcesContent":["import {\n  coordinateCommit,\n  CurrentCommitJournal,\n  hasCommitScope,\n  type CommitJournal,\n  type PreparedCommit,\n  LifecycleHooks,\n  HookConfigurationError,\n} from \"@yielded/auth/Hooks\";\nimport type { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport {\n  PasswordUnavailable,\n  PasswordPersistence,\n  type PasswordMutationInput,\n  snapshotPasswordCredential,\n  snapshotPasswordRequirement,\n  snapshotPasswordRevision,\n  type PasswordAction,\n  type PasswordMutationDecision,\n} from \"@yielded/auth/Password\";\nimport { reportPersistenceFailure } from \"@yielded/auth/Persistence\";\nimport {\n  type ProofCompletionPlan,\n  type ProofCompletionInput,\n  ProofUnavailable,\n} from \"@yielded/auth/Proofs\";\nimport {\n  snapshotAuthenticationEvidence,\n  type AuthenticationEvidence,\n  type AuthenticationRequirement,\n  type SecurityRevision,\n} from \"@yielded/auth/Sessions\";\nimport { Cause, Context, DateTime, Effect, Option, Redacted, Schema } from \"effect\";\nimport type { SqlClient } from \"effect/sql/SqlClient\";\nimport type * as SqlError from \"effect/sql/SqlError\";\n\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport {\n  type AnyPasswordPersistenceMapping,\n  requiredPasswordConstraints,\n} from \"./models/password-model\";\nimport { makeNativeSqlTables, sqlMapping, type NativeSqlTables } from \"./native-sql-table\";\nimport {\n  makePasswordCredentials,\n  samePasswordCredentialSnapshot as sameCredentialSnapshot,\n} from \"./password-credentials\";\nimport {\n  CurrentPasswordPreparedTransaction,\n  PasswordPreparedPostconditions,\n} from \"./PasswordPreparedPostconditions\";\nimport {\n  CurrentProofSql,\n  type ProofSqlConfiguration,\n  type ProofSqlDatabase,\n  type makeProofKernel,\n} from \"./proof-kernel\";\n/* oxlint-disable no-explicit-any -- existing storage kernels erase foreign table shapes; domain errors remain typed. */\nimport type { QueryFailure } from \"./query-operations\";\nimport type { QueryOperations, SqlFragment, SqlColumn } from \"./query-operations\";\nimport { NativeDatabase } from \"./transaction-kernel\";\n\ntype AdapterFailure = QueryFailure | PersistenceMappingError | SqlError.SqlError;\n\nexport interface PasswordSqlQuery<A = ReadonlyArray<any>> extends Effect.Effect<A, AdapterFailure> {\n  readonly getSQL: () => ReturnType<QueryOperations[\"sql\"]>;\n  readonly from: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly where: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly limit: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly orderBy: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly for: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly set: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly values: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly returning: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly $returningId: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly onConflictDoNothing: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n  readonly onDuplicateKeyUpdate: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;\n}\n\nexport interface PasswordSqlDatabase {\n  readonly select: (...args: ReadonlyArray<any>) => PasswordSqlQuery;\n  readonly insert: (...args: ReadonlyArray<any>) => PasswordSqlQuery;\n  readonly update: (...args: ReadonlyArray<any>) => PasswordSqlQuery;\n  readonly delete: (...args: ReadonlyArray<any>) => PasswordSqlQuery;\n  readonly transaction: <A, E, R>(\n    body: (transaction: PasswordSqlDatabase) => Effect.Effect<A, E, R>,\n  ) => Effect.Effect<A, E | SqlError.SqlError, R>;\n}\n\nexport class CurrentPasswordSql extends Context.Service<CurrentPasswordSql, PasswordSqlDatabase>()(\n  \"effect-auth/CurrentPasswordSql\",\n) {}\n\nexport interface PasswordSqlConfiguration {\n  readonly mode: \"interactive\" | \"synchronous\";\n  readonly locking: boolean;\n  readonly standaloneGuard: Effect.Effect<void, PasswordUnavailable>;\n  readonly coordinated?: boolean;\n  readonly insertIfAbsent: (\n    query: PasswordSqlQuery,\n    selfKey: string,\n    selfValue: unknown,\n  ) => PasswordSqlQuery;\n  readonly proof?: {\n    readonly mapping: any;\n    readonly configuration: ProofSqlConfiguration;\n  };\n}\n\ntype Database = PasswordSqlDatabase;\n\nexport const makePasswordKernel = <\n  Fragment extends SqlFragment = SqlFragment,\n  Column extends SqlColumn = SqlColumn,\n>(\n  operations: QueryOperations<Fragment, Column>,\n  proofs: Pick<ReturnType<typeof makeProofKernel>, \"completeProofPlanIn\">,\n  nativeTables: (client: SqlClient, database: object) => NativeSqlTables = (client) =>\n    makeNativeSqlTables(client),\n) => {\n  type Mapping = AnyPasswordPersistenceMapping<Fragment>;\n\n  const { and, eq, inArray, column, updateValues } = operations;\n  const { completeProofPlanIn } = proofs;\n  const unavailable = () => PasswordUnavailable.make({});\n\n  const translateFailure = <A, E, R>(\n    effect: Effect.Effect<A, E, R>,\n  ): Effect.Effect<A, PasswordUnavailable, R> =>\n    reportPersistenceFailure(\n      effect,\n      (error) =>\n        Schema.is(PasswordUnavailable)(error) ||\n        Schema.is(ProofUnavailable)(error) ||\n        Schema.is(HookConfigurationError)(error),\n    ).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));\n\n  const nowMillis = DateTime.now.pipe(Effect.map(DateTime.toEpochMillis));\n\n  const validConstraints = (mapping: Mapping) =>\n    Object.entries(requiredPasswordConstraints).every(\n      ([key, value]) =>\n        mapping.constraints[key as keyof typeof requiredPasswordConstraints] === value,\n    );\n\n  const selectRows = (query: PasswordSqlQuery, locking: boolean) =>\n    locking && typeof query.for === \"function\" ? query.for(\"update\") : query;\n\n  const subjectColumns = (mapping: Mapping) => ({\n    id: column(mapping.subject.table, mapping.subject.id),\n    status: column(mapping.subject.table, mapping.subject.status),\n    securityRevision: column(mapping.subject.table, mapping.subject.securityRevision),\n  });\n\n  const identifierColumns = (mapping: Mapping) => ({\n    namespace: column(mapping.identifier.table, mapping.identifier.namespace),\n    value: column(mapping.identifier.table, mapping.identifier.value),\n    subjectId: column(mapping.identifier.table, mapping.identifier.subjectId),\n    verifiedAt: column(mapping.identifier.table, mapping.identifier.verifiedAt),\n    bindingRevision: column(mapping.identifier.table, mapping.identifier.bindingRevision),\n  });\n\n  const credentialColumns = (mapping: Mapping) => ({\n    moduleId: column(mapping.credential.table, mapping.credential.moduleId),\n    subjectId: column(mapping.credential.table, mapping.credential.subjectId),\n    credentialId: column(mapping.credential.table, mapping.credential.credentialId),\n    credentialRevision: column(mapping.credential.table, mapping.credential.credentialRevision),\n    verifierVersion: column(mapping.credential.table, mapping.credential.verifierVersion),\n    verifier: column(mapping.credential.table, mapping.credential.verifier),\n    normalization: column(mapping.credential.table, mapping.credential.normalization),\n  });\n\n  const authorityCredentialColumns = (mapping: Mapping) => ({\n    subjectId: column(mapping.authorityCredential.table, mapping.authorityCredential.subjectId),\n    credentialId: column(\n      mapping.authorityCredential.table,\n      mapping.authorityCredential.credentialId,\n    ),\n    revision: column(mapping.authorityCredential.table, mapping.authorityCredential.revision),\n  });\n\n  const commandColumns = (mapping: Mapping) => ({\n    moduleId: column(mapping.command.table, mapping.command.moduleId),\n    commandId: column(mapping.command.table, mapping.command.commandId),\n    action: column(mapping.command.table, mapping.command.action),\n    bindingDigest: column(mapping.command.table, mapping.command.bindingDigest),\n    decision: column(mapping.command.table, mapping.command.decision),\n    retentionUntil: column(mapping.command.table, mapping.command.retentionUntil),\n  });\n\n  const allocate = <A>(\n    mode: PasswordSqlConfiguration[\"mode\"],\n    asyncValue: Effect.Effect<A, PersistenceMappingError> | undefined,\n    syncValue: (() => A) | undefined,\n  ): Effect.Effect<A, PasswordUnavailable | PersistenceMappingError> => {\n    if (mode === \"synchronous\")\n      return syncValue === undefined\n        ? Effect.fail(unavailable())\n        : Effect.try({\n            try: syncValue,\n            catch: (cause) => new PersistenceMappingError({ operation: \"mapping\", cause }),\n          });\n    if (asyncValue !== undefined) return asyncValue;\n\n    return syncValue === undefined\n      ? Effect.fail(unavailable())\n      : Effect.try({\n          try: syncValue,\n          catch: (cause) => new PersistenceMappingError({ operation: \"mapping\", cause }),\n        });\n  };\n\n  const allocateNextSecurityRevision = (\n    mapping: Mapping,\n    mode: PasswordSqlConfiguration[\"mode\"],\n    current: SecurityRevision,\n  ) => {\n    const asyncValue = mapping.subject.nextSecurityRevision?.(current);\n\n    const syncValue =\n      mapping.subject.nextSecurityRevisionSync === undefined\n        ? undefined\n        : () => mapping.subject.nextSecurityRevisionSync!(current);\n\n    return allocate(\n      mode,\n      asyncValue ?? mapping.allocateRevision,\n      syncValue ?? mapping.allocateRevisionSync,\n    );\n  };\n\n  const sameIdentifier = (left: LoginIdentifier, right: LoginIdentifier) =>\n    left.namespace === right.namespace && left.value === right.value;\n\n  const evidenceSatisfiedAt = (\n    evidence: AuthenticationEvidence,\n    requirement: AuthenticationRequirement,\n    now: number,\n  ): boolean => {\n    if (evidence.proofs.length > 64 || evidence.revision.credentials.length > 64) return false;\n    const revisions = new Map<string, string>();\n\n    for (const item of evidence.revision.credentials) {\n      if (revisions.has(item.credentialId)) return false;\n      revisions.set(item.credentialId, item.revision);\n    }\n    if (evidence.proofs.some((proof) => !revisions.has(proof.credentialId))) return false;\n    if (evidence.proofs.some((proof) => now < DateTime.toEpochMillis(proof.verifiedAt)))\n      return false;\n\n    const eligible = evidence.proofs.filter((proof) => {\n      const age = now - DateTime.toEpochMillis(proof.verifiedAt);\n\n      return age >= 0 && age < requirement.maximumAgeMillis;\n    });\n\n    const factors = new Set(eligible.flatMap((proof) => proof.factors));\n    const credentials = new Set(eligible.map((proof) => proof.credentialId));\n\n    return requirement.alternatives.some(\n      (alternative) =>\n        alternative.factors.every((factor) => factors.has(factor)) &&\n        credentials.size >= alternative.minimumCredentials &&\n        eligible.some(\n          (proof) =>\n            (!alternative.userVerified || proof.userVerified) &&\n            (!alternative.phishingResistant || proof.phishingResistant),\n        ),\n    );\n  };\n\n  const snapshotMutationInput = Effect.fn(\"DrizzlePassword.snapshotMutationInput\")(function* (\n    input: PasswordMutationInput,\n  ) {\n    const expectedRevision = snapshotPasswordRevision(input.expectedRevision);\n\n    const evidence = yield* snapshotAuthenticationEvidence(input.authorization.evidence).pipe(\n      Effect.mapError(unavailable),\n    );\n\n    const requirement = yield* snapshotPasswordRequirement(input.authorization.requirement);\n\n    const credential =\n      input.credential === undefined\n        ? undefined\n        : yield* snapshotPasswordCredential(input.credential);\n\n    return Object.freeze({\n      ...input,\n      expectedRevision,\n      replacement: Object.freeze({\n        verifier: Redacted.make(Redacted.value(input.replacement.verifier)),\n        normalization: input.replacement.normalization,\n      }),\n      invalidation: Object.freeze({ ...input.invalidation }),\n      ...(credential === undefined ? {} : { credential }),\n      authorization: Object.freeze({\n        challenge: Object.freeze({\n          ...input.authorization.challenge,\n          revision: snapshotPasswordRevision(input.authorization.challenge.revision),\n        }),\n        evidence,\n        requirement,\n      }),\n    });\n  });\n\n  const lockSubject = Effect.fn(\"DrizzlePassword.lockSubject\")(function* (\n    mapping: Mapping,\n    subjectId: string,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    const nativeSubjectId = yield* mapping.subjectId.toNative(subjectId as any);\n    const c = subjectColumns(mapping);\n\n    const rows = yield* selectRows(\n      database.select().from(mapping.subject.table).where(eq(c.id, nativeSubjectId)).limit(1),\n      locking,\n    );\n\n    return { nativeSubjectId, row: rows[0] };\n  });\n\n  const lockIdentifier = Effect.fn(\"Drizzle.lockIdentifier\")(function* (\n    mapping: Mapping,\n    identifier: LoginIdentifier,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    const c = identifierColumns(mapping);\n\n    return yield* selectRows(\n      database\n        .select()\n        .from(mapping.identifier.table)\n        .where(and(eq(c.namespace, identifier.namespace), eq(c.value, identifier.value)))\n        .limit(1),\n      locking,\n    );\n  });\n\n  const readPasswordCredential = Effect.fn(\"Drizzle.readPasswordCredential\")(function* (\n    mapping: Mapping,\n    moduleId: string,\n    nativeSubjectId: unknown,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    const c = credentialColumns(mapping);\n\n    return yield* selectRows(\n      database\n        .select()\n        .from(mapping.credential.table)\n        .where(and(eq(c.moduleId, moduleId), eq(c.subjectId, nativeSubjectId)))\n        .limit(1),\n      locking,\n    );\n  });\n\n  const resolveCredential = Effect.fn(\"DrizzlePassword.resolveCredential\")(function* (\n    mapping: Mapping,\n    moduleId: string,\n    identifier: LoginIdentifier,\n    requestedSubjectId: string | undefined,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    // The unlocked lookup only discovers the prospective subject. The canonical\n    // protected order starts with the subject and then rechecks the identifier.\n    const discovered = (yield* lockIdentifier(mapping, identifier, false))[0];\n\n    if (discovered === undefined || !mapping.identifier.isCurrent(discovered)) return undefined;\n    const discoveredNative = discovered[mapping.identifier.subjectId];\n\n    const subjectRows = yield* selectRows(\n      database\n        .select()\n        .from(mapping.subject.table)\n        .where(eq(subjectColumns(mapping).id, discoveredNative))\n        .limit(1),\n      locking,\n    );\n\n    const subject = subjectRows[0];\n\n    if (subject === undefined || !mapping.subject.isActiveStatus(subject[mapping.subject.status]))\n      return undefined;\n    const identifiers = yield* lockIdentifier(mapping, identifier, locking);\n    const identifierRow = identifiers[0];\n\n    if (\n      identifierRow === undefined ||\n      !mapping.identifier.isCurrent(identifierRow) ||\n      !mapping.subjectId.equals(discoveredNative, identifierRow[mapping.identifier.subjectId])\n    )\n      return undefined;\n    const subjectId = yield* mapping.subjectId.toSubject(discoveredNative);\n\n    if (requestedSubjectId !== undefined && requestedSubjectId !== subjectId) return undefined;\n    const credentials = yield* readPasswordCredential(mapping, moduleId, discoveredNative, locking);\n    const credential = credentials[0];\n\n    if (credential === undefined)\n      return { nativeSubjectId: discoveredNative, subject, identifier: identifierRow };\n\n    const snapshot = yield* mapping.credential\n      .decode({ moduleId, subject, identifier: identifierRow, credential })\n      .pipe(Effect.flatMap(snapshotPasswordCredential));\n\n    return {\n      nativeSubjectId: discoveredNative,\n      subject,\n      identifier: identifierRow,\n      credential,\n      snapshot,\n    };\n  });\n\n  const owned = <A, E, R>(\n    database: Database,\n    mapping: Mapping,\n    configuration: PasswordSqlConfiguration,\n    body: Effect.Effect<A, E, R>,\n  ) => {\n    if (!validConstraints(mapping)) return Effect.fail(unavailable());\n\n    const run = coordinateCommit(\n      () =>\n        database.transaction((transaction) =>\n          body.pipe(\n            Effect.provideService(CurrentPasswordSql, transaction),\n            Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),\n          ),\n        ),\n      { mode: configuration.mode },\n    ).pipe(Effect.map((result) => result.value));\n\n    return configuration.coordinated !== true\n      ? Effect.gen(function* () {\n          if (yield* hasCommitScope) return yield* unavailable();\n          yield* configuration.standaloneGuard;\n\n          return yield* run;\n        })\n      : run;\n  };\n\n  // A coordinator that accepts postconditions re-runs this check against its\n  // current transaction after application work, before commit.\n  const registerFinal = Effect.fnUntraced(function* <E>(\n    check: Effect.Effect<boolean, E, CurrentPasswordSql>,\n  ) {\n    const postconditions = yield* Effect.serviceOption(PasswordPreparedPostconditions);\n\n    if (Option.isNone(postconditions)) return;\n\n    const postcondition = Effect.gen(function* () {\n      const transaction = yield* CurrentPasswordPreparedTransaction;\n\n      if (!(yield* check.pipe(Effect.provideService(CurrentPasswordSql, transaction))))\n        return yield* unavailable();\n    }).pipe(translateFailure);\n\n    if (!postconditions.value.register(postcondition)) return yield* unavailable();\n  });\n\n  const safeRead = <A, E, R>(\n    database: Database,\n    configuration: PasswordSqlConfiguration,\n    body: Effect.Effect<A, E, R>,\n  ) =>\n    Effect.gen(function* () {\n      if (configuration.coordinated !== true) {\n        if (yield* hasCommitScope) return yield* unavailable();\n        yield* configuration.standaloneGuard;\n      }\n\n      return yield* database.transaction((transaction) =>\n        body.pipe(\n          Effect.provideService(CurrentPasswordSql, transaction),\n          Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),\n        ),\n      );\n    });\n\n  const proofCompletionMatchesPassword = (\n    input: PasswordMutationInput & { readonly completion: ProofCompletionPlan },\n  ) => {\n    const completion = input.completion.input;\n    const binding = completion.binding;\n\n    if (\n      completion.moduleId !== `${input.moduleId}/reset` ||\n      completion.purpose !== \"password-reset\" ||\n      binding._tag !== \"Subject\" ||\n      input.credential === undefined ||\n      binding.revision.subjectId !== input.expectedRevision.subjectId ||\n      binding.revision.securityRevision !== input.expectedRevision.securityRevision ||\n      !sameIdentifier(binding.identifier, input.credential.identifier)\n    )\n      return false;\n\n    const expected = [...input.expectedRevision.credentials].sort((left, right) =>\n      left.credentialId.localeCompare(right.credentialId),\n    );\n\n    const actual = [...binding.revision.credentials].sort((left, right) =>\n      left.credentialId.localeCompare(right.credentialId),\n    );\n\n    return (\n      expected.length === actual.length &&\n      expected.every(\n        (item, index) =>\n          item.credentialId === actual[index]!.credentialId &&\n          item.revision === actual[index]!.revision,\n      )\n    );\n  };\n\n  const probeProofCompletion = Effect.fn(\"Drizzle.probeProofCompletion\")(function* (\n    configuration: PasswordSqlConfiguration,\n    input: ProofCompletionInput,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    if (configuration.proof === undefined) return yield* Effect.fail(unavailable());\n    const validProbe = { _tag: \"PasswordProofCompletionValid\" } as const;\n\n    const plan: ProofCompletionPlan = {\n      input,\n      prepare: (decision, journal, project) => journal.prepare(project(decision)),\n    };\n\n    const probe = coordinateCommit(\n      () =>\n        database.transaction((transaction) =>\n          completeProofPlanIn(\n            configuration.proof!.mapping,\n            configuration.proof!.configuration,\n            plan,\n            Effect.fail(validProbe),\n            () => false,\n          ).pipe(\n            Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),\n          ),\n        ),\n      { mode: configuration.mode },\n    );\n\n    if (configuration.coordinated === true || (yield* hasCommitScope)) return yield* unavailable();\n    yield* configuration.standaloneGuard;\n\n    return yield* probe.pipe(\n      Effect.as(false),\n      Effect.catchCause((cause) => {\n        const reason = cause.reasons[0];\n\n        return cause.reasons.length === 1 &&\n          reason !== undefined &&\n          Cause.isFailReason(reason) &&\n          reason.error === validProbe\n          ? Effect.succeed(true)\n          : Effect.failCause(cause);\n      }),\n    );\n  });\n\n  const validateMutationAuthority = Effect.fn(\"DrizzlePassword.validateMutationAuthority\")(\n    function* (\n      mapping: Mapping,\n      configuration: PasswordSqlConfiguration,\n      input: PasswordMutationInput,\n      action: PasswordAction,\n    ) {\n      const database = yield* CurrentPasswordSql;\n\n      const locked = yield* lockSubject(\n        mapping,\n        input.expectedRevision.subjectId,\n        configuration.locking,\n      );\n\n      const row = locked.row;\n\n      if (\n        row === undefined ||\n        !mapping.subject.isActiveStatus(row[mapping.subject.status]) ||\n        row[mapping.subject.securityRevision] !== input.expectedRevision.securityRevision\n      )\n        return undefined;\n      if (\n        input.authorization.challenge.moduleId !== input.moduleId ||\n        input.authorization.challenge.action !== action ||\n        input.authorization.challenge.commandId !== input.commandId ||\n        input.authorization.challenge.revision.subjectId !== input.expectedRevision.subjectId ||\n        input.authorization.challenge.revision.securityRevision !==\n          input.expectedRevision.securityRevision ||\n        (input.authorization.evidence.flowId as string) !== (input.commandId as string) ||\n        input.authorization.evidence.bindingDigest !==\n          input.authorization.challenge.bindingDigest ||\n        input.authorization.evidence.revision.subjectId !== input.expectedRevision.subjectId ||\n        input.authorization.evidence.revision.securityRevision !==\n          input.expectedRevision.securityRevision ||\n        (action === \"add-password\" &&\n          (input.credential !== undefined ||\n            input.authorization.challenge.targetCredentialId !== undefined))\n      )\n        return undefined;\n      if (\n        input.expectedRevision.credentials.some(\n          (expected) =>\n            !input.authorization.evidence.revision.credentials.some(\n              (actual) =>\n                actual.credentialId === expected.credentialId &&\n                actual.revision === expected.revision,\n            ),\n        )\n      )\n        return undefined;\n      if (input.credential !== undefined) {\n        const identifier = (yield* lockIdentifier(\n          mapping,\n          input.credential.identifier,\n          configuration.locking,\n        ))[0];\n\n        if (\n          identifier === undefined ||\n          !mapping.identifier.isCurrent(identifier) ||\n          !mapping.subjectId.equals(\n            identifier[mapping.identifier.subjectId],\n            locked.nativeSubjectId,\n          ) ||\n          identifier[mapping.identifier.bindingRevision] !==\n            input.credential.identifierBindingRevision\n        )\n          return undefined;\n      }\n\n      const allExpected = [\n        ...input.expectedRevision.credentials,\n        ...input.authorization.evidence.revision.credentials,\n      ];\n\n      const expected = new Map(allExpected.map((item) => [item.credentialId, item]));\n\n      const ac = authorityCredentialColumns(mapping);\n\n      const credentialRows =\n        expected.size === 0\n          ? []\n          : yield* selectRows(\n              database\n                .select()\n                .from(mapping.authorityCredential.table)\n                .where(\n                  and(\n                    eq(ac.subjectId, locked.nativeSubjectId),\n                    inArray(ac.credentialId, [...expected.keys()]),\n                  ),\n                )\n                .orderBy(ac.credentialId),\n              configuration.locking,\n            );\n\n      if (credentialRows.length !== expected.size) return undefined;\n      // Database collation need not match JavaScript locale ordering.\n      for (const actual of credentialRows) {\n        const wanted = expected.get(actual[mapping.authorityCredential.credentialId]);\n\n        if (\n          wanted === undefined ||\n          actual[mapping.authorityCredential.revision] !== wanted.revision ||\n          (mapping.authorityCredential.status !== undefined &&\n            mapping.authorityCredential.isActiveStatus?.(\n              actual[mapping.authorityCredential.status],\n            ) !== true)\n        )\n          return undefined;\n        expected.delete(wanted.credentialId);\n      }\n      if (expected.size !== 0) return undefined;\n      if (input.credential !== undefined) {\n        const identifier = (yield* lockIdentifier(mapping, input.credential.identifier, false))[0];\n\n        const credential = (yield* readPasswordCredential(\n          mapping,\n          input.moduleId,\n          locked.nativeSubjectId,\n          configuration.locking,\n        ))[0];\n\n        if (identifier === undefined || credential === undefined) return undefined;\n\n        const snapshot = yield* mapping.credential.decode({\n          moduleId: input.moduleId,\n          subject: row,\n          identifier,\n          credential,\n        });\n\n        if (!sameCredentialSnapshot(snapshot, input.credential)) return undefined;\n      }\n      const currentRequirement = yield* mapping.subject.decodeActionRequirement(row, action);\n      const now = yield* nowMillis;\n\n      if (\n        !evidenceSatisfiedAt(input.authorization.evidence, input.authorization.requirement, now) ||\n        !evidenceSatisfiedAt(input.authorization.evidence, currentRequirement, now)\n      )\n        return undefined;\n      if (\n        (input.invalidation.existingSessions === \"immediate\" ||\n          input.invalidation.existingSessions === \"cache-expiry\") &&\n        mapping.sessionInvalidation !== \"same-authority-immediate\"\n      )\n        return undefined;\n\n      return { ...locked, now };\n    },\n  );\n\n  const commandExists = Effect.fn(\"Drizzle.commandExists\")(function* (\n    mapping: Mapping,\n    moduleId: string,\n    commandId: string,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    const c = commandColumns(mapping);\n\n    return yield* selectRows(\n      database\n        .select()\n        .from(mapping.command.table)\n        .where(and(eq(c.moduleId, moduleId), eq(c.commandId, commandId)))\n        .limit(1),\n      locking,\n    );\n  });\n\n  const insertCommand = Effect.fn(\"Drizzle.insertCommand\")(function* (\n    mapping: Mapping,\n    input: PasswordMutationInput,\n    action: PasswordAction,\n    now: number,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    return yield* database.insert(mapping.command.table).values(\n      mapping.command.encodeInsert({\n        moduleId: input.moduleId,\n        commandId: input.commandId,\n        action,\n        bindingDigest: input.authorization.challenge.bindingDigest,\n        decision: \"changed\",\n        retentionUntilMillis: now + mapping.commandRetentionMillis,\n      }),\n    );\n  });\n\n  const mutationPostconditions = Effect.fn(\"DrizzlePassword.mutationPostconditions\")(function* (\n    mapping: Mapping,\n    input: PasswordMutationInput,\n    nativeSubjectId: unknown,\n    subject: any,\n    authorityCredential: any,\n    now: number,\n  ) {\n    if (\n      subject === undefined ||\n      !mapping.subject.isActiveStatus(subject[mapping.subject.status]) ||\n      authorityCredential === undefined ||\n      (mapping.authorityCredential.status !== undefined &&\n        mapping.authorityCredential.isActiveStatus?.(\n          authorityCredential[mapping.authorityCredential.status],\n        ) !== true)\n    )\n      return false;\n    if (input.credential !== undefined) {\n      const identifier = (yield* lockIdentifier(mapping, input.credential.identifier, false))[0];\n\n      if (\n        identifier === undefined ||\n        !mapping.identifier.isCurrent(identifier) ||\n        !mapping.subjectId.equals(identifier[mapping.identifier.subjectId], nativeSubjectId) ||\n        identifier[mapping.identifier.bindingRevision] !==\n          input.credential.identifierBindingRevision\n      )\n        return false;\n\n      const credential = (yield* readPasswordCredential(\n        mapping,\n        input.moduleId,\n        nativeSubjectId,\n        false,\n      ))[0];\n\n      if (credential === undefined) return false;\n\n      const decoded = yield* mapping.credential.decode({\n        moduleId: input.moduleId,\n        subject,\n        identifier,\n        credential,\n      });\n\n      if (decoded.identifierVerifiedAtMillis !== input.credential.identifierVerifiedAtMillis)\n        return false;\n    }\n    const rows = yield* commandExists(mapping, input.moduleId, input.commandId, false);\n    const row = rows[0];\n\n    return (\n      rows.length === 1 &&\n      row[mapping.command.action] === input.authorization.challenge.action &&\n      row[mapping.command.bindingDigest] === input.authorization.challenge.bindingDigest &&\n      row[mapping.command.decision] === \"changed\" &&\n      (yield* mapping.decodeInstant(row[mapping.command.retentionUntil])) ===\n        now + mapping.commandRetentionMillis\n    );\n  });\n\n  const addPasswordIn = Effect.fn(\"DrizzlePassword.addPasswordIn\")(function* (\n    mapping: Mapping,\n    configuration: PasswordSqlConfiguration,\n    input: PasswordMutationInput,\n    revisions: {\n      readonly credentialId: string;\n      readonly credentialRevision: SecurityRevision;\n      readonly verifierVersion: SecurityRevision;\n      readonly nextSecurityRevision: SecurityRevision;\n    },\n    commandNow?: number,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    const { credentialId, credentialRevision, verifierVersion, nextSecurityRevision } = revisions;\n\n    const authority = yield* validateMutationAuthority(\n      mapping,\n      configuration,\n      input,\n      \"add-password\",\n    );\n\n    if (authority === undefined) return false;\n    if ((yield* commandExists(mapping, input.moduleId, input.commandId, true)).length) return false;\n    if (\n      (yield* readPasswordCredential(mapping, input.moduleId, authority.nativeSubjectId, true))\n        .length\n    )\n      return false;\n\n    yield* database.insert(mapping.credential.table).values(\n      mapping.credential.encodeInsert({\n        moduleId: input.moduleId,\n        subjectId: authority.nativeSubjectId,\n        credentialId,\n        credentialRevision,\n        verifierVersion,\n        replacement: input.replacement,\n      }),\n    );\n    yield* database.insert(mapping.authorityCredential.table).values(\n      mapping.authorityCredential.encodeInsert({\n        subjectId: authority.nativeSubjectId,\n        credentialId,\n        revision: credentialRevision,\n      }),\n    );\n    yield* database\n      .update(mapping.subject.table)\n      .set(updateValues([[mapping.subject.securityRevision, nextSecurityRevision]]))\n      .where(\n        and(\n          eq(subjectColumns(mapping).id, authority.nativeSubjectId),\n          eq(subjectColumns(mapping).securityRevision, input.expectedRevision.securityRevision),\n        ),\n      );\n    yield* insertCommand(mapping, input, \"add-password\", commandNow ?? authority.now);\n\n    const applied = checkMutationApplied(\n      mapping,\n      input,\n      authority.nativeSubjectId,\n      revisions,\n      commandNow ?? authority.now,\n    );\n\n    if (!(yield* applied)) return yield* unavailable();\n    yield* registerFinal(applied);\n\n    return true;\n  });\n\n  const makeSqlPasswordPersistence = Effect.fn(\"makeSqlPasswordPersistence\")(function* (\n    mapping: Mapping,\n    configuration: PasswordSqlConfiguration,\n  ): Effect.fn.Return<\n    PasswordPersistence[\"Service\"],\n    PasswordUnavailable,\n    LifecycleHooks | CurrentPasswordSql | NativeDatabase\n  > {\n    const database = yield* CurrentPasswordSql;\n\n    if (!configuration.coordinated)\n      yield* (\n        operations.validateStorage?.({\n          ...mapping,\n          proof: configuration.proof?.mapping,\n        }) ?? Effect.void\n      ).pipe(Effect.mapError(unavailable));\n    const hooks = yield* LifecycleHooks;\n\n    if (!validConstraints(mapping)) return yield* unavailable();\n    const root = yield* NativeDatabase;\n\n    const credentials = yield* makePasswordCredentials(\n      yield* sqlMapping(() => nativeTables(root.$client.withoutTransforms(), root)).pipe(\n        translateFailure,\n      ),\n      mapping,\n      configuration,\n    );\n\n    return PasswordPersistence.of({\n      ...credentials,\n      readForSubject: (input) =>\n        safeRead(\n          database,\n          configuration,\n          Effect.gen(function* () {\n            const transaction = yield* CurrentPasswordSql;\n\n            const locked = yield* lockSubject(mapping, input.subjectId, false);\n\n            if (\n              locked.row === undefined ||\n              !mapping.subject.isActiveStatus(locked.row[mapping.subject.status])\n            )\n              return Option.none();\n\n            const credential = (yield* readPasswordCredential(\n              mapping,\n              input.moduleId,\n              locked.nativeSubjectId,\n              false,\n            ))[0];\n\n            if (credential === undefined) return Option.none();\n            const ic = identifierColumns(mapping);\n\n            const identifiers = yield* transaction\n              .select()\n              .from(mapping.identifier.table)\n              .where(eq(ic.subjectId, locked.nativeSubjectId));\n\n            const identifier = identifiers.find((row: any) => mapping.identifier.isCurrent(row));\n\n            if (identifier === undefined) return Option.none();\n\n            const snapshot = yield* mapping.credential\n              .decode({\n                moduleId: input.moduleId,\n                subject: locked.row,\n                identifier,\n                credential,\n              })\n              .pipe(Effect.flatMap(snapshotPasswordCredential));\n\n            return Option.some(snapshot);\n          }),\n        ).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      recoveryTarget: (input) =>\n        safeRead(\n          database,\n          configuration,\n          Effect.gen(function* () {\n            const resolved = yield* resolveCredential(\n              mapping,\n              input.moduleId,\n              input.identifier,\n              undefined,\n              false,\n            );\n\n            return resolved?.snapshot === undefined ||\n              resolved.snapshot.identifierVerifiedAtMillis === undefined\n              ? Option.none()\n              : Option.some(resolved.snapshot);\n          }),\n        ).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      addIfAbsent: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const input = yield* snapshotMutationInput(uncaptured);\n\n          const credentialId = yield* allocate(\n            configuration.mode,\n            mapping.allocateCredentialId,\n            mapping.allocateCredentialIdSync,\n          );\n\n          const credentialRevision = yield* allocate(\n            configuration.mode,\n            mapping.allocateRevision,\n            mapping.allocateRevisionSync,\n          );\n\n          const verifierVersion = yield* allocate(\n            configuration.mode,\n            mapping.allocateRevision,\n            mapping.allocateRevisionSync,\n          );\n\n          const nextSecurityRevision = yield* allocateNextSecurityRevision(\n            mapping,\n            configuration.mode,\n            input.expectedRevision.securityRevision,\n          );\n\n          if (nextSecurityRevision === input.expectedRevision.securityRevision)\n            return yield* unavailable();\n\n          return yield* owned(\n            database,\n            mapping,\n            configuration,\n            Effect.gen(function* () {\n              const journal = yield* CurrentCommitJournal;\n\n              const changed = yield* addPasswordIn(mapping, configuration, input, {\n                credentialId,\n                credentialRevision,\n                verifierVersion,\n                nextSecurityRevision,\n              });\n\n              return prepare(changed ? \"changed\" : \"rejected\", journal);\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      replaceIfCurrent: (uncaptured, prepare) =>\n        Effect.gen(function* () {\n          const input = yield* snapshotMutationInput(uncaptured);\n\n          const credentialRevision = yield* allocate(\n            configuration.mode,\n            mapping.allocateRevision,\n            mapping.allocateRevisionSync,\n          );\n\n          const verifierVersion = yield* allocate(\n            configuration.mode,\n            mapping.allocateRevision,\n            mapping.allocateRevisionSync,\n          );\n\n          const nextSecurityRevision = yield* allocateNextSecurityRevision(\n            mapping,\n            configuration.mode,\n            input.expectedRevision.securityRevision,\n          );\n\n          if (\n            nextSecurityRevision === input.expectedRevision.securityRevision ||\n            (input.credential !== undefined &&\n              credentialRevision === input.credential.credentialRevision)\n          )\n            return yield* unavailable();\n\n          return yield* owned(\n            database,\n            mapping,\n            configuration,\n            Effect.gen(function* () {\n              return yield* replaceIn(\n                mapping,\n                configuration,\n                input,\n                \"change-password\",\n                { credentialRevision, verifierVersion, nextSecurityRevision },\n                prepare,\n              );\n            }),\n          );\n        }).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      checkReset: (input) =>\n        (configuration.proof === undefined\n          ? Effect.fail(unavailable())\n          : Effect.gen(function* () {\n              if (\n                input.moduleId.length <= \"/reset\".length ||\n                !input.moduleId.endsWith(\"/reset\") ||\n                input.purpose !== \"password-reset\" ||\n                input.binding._tag !== \"Subject\"\n              )\n                return false;\n              const binding = input.binding;\n              const passwordModuleId = input.moduleId.slice(0, -\"/reset\".length);\n\n              const current = yield* safeRead(\n                database,\n                configuration,\n                Effect.gen(function* () {\n                  const resolved = yield* resolveCredential(\n                    mapping,\n                    passwordModuleId,\n                    binding.identifier,\n                    binding.revision.subjectId,\n                    false,\n                  );\n\n                  return (\n                    resolved?.snapshot !== undefined &&\n                    resolved.snapshot.revision.securityRevision ===\n                      binding.revision.securityRevision &&\n                    binding.revision.credentials.every((item) =>\n                      resolved.snapshot!.revision.credentials.some(\n                        (actual) =>\n                          actual.credentialId === item.credentialId &&\n                          actual.revision === item.revision,\n                      ),\n                    )\n                  );\n                }),\n              );\n\n              return current ? yield* probeProofCompletion(configuration, input) : false;\n            })\n        ).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      resetWithProof: (uncaptured, prepare) =>\n        (configuration.proof === undefined\n          ? Effect.fail(unavailable())\n          : Effect.gen(function* () {\n              const input = Object.freeze({\n                ...(yield* snapshotMutationInput(uncaptured)),\n                completion: uncaptured.completion,\n              });\n\n              const credentialRevision = yield* allocate(\n                configuration.mode,\n                mapping.allocateRevision,\n                mapping.allocateRevisionSync,\n              );\n\n              const verifierVersion = yield* allocate(\n                configuration.mode,\n                mapping.allocateRevision,\n                mapping.allocateRevisionSync,\n              );\n\n              const nextSecurityRevision = yield* allocateNextSecurityRevision(\n                mapping,\n                configuration.mode,\n                input.expectedRevision.securityRevision,\n              );\n\n              if (\n                nextSecurityRevision === input.expectedRevision.securityRevision ||\n                (input.credential !== undefined &&\n                  credentialRevision === input.credential.credentialRevision)\n              )\n                return yield* unavailable();\n\n              return yield* owned(\n                database,\n                mapping,\n                configuration,\n                Effect.gen(function* () {\n                  const journal = yield* CurrentCommitJournal;\n\n                  if (!proofCompletionMatchesPassword(input)) return prepare(\"rejected\", journal);\n\n                  const authority = yield* validateMutationAuthority(\n                    mapping,\n                    configuration,\n                    input,\n                    \"reset-password\",\n                  );\n\n                  if (authority === undefined) return prepare(\"rejected\", journal);\n                  if ((yield* commandExists(mapping, input.moduleId, input.commandId, true)).length)\n                    return prepare(\"rejected\", journal);\n\n                  const current = yield* currentExpectedCredential(\n                    mapping,\n                    input,\n                    authority.nativeSubjectId,\n                  );\n\n                  if (!current) return prepare(\"rejected\", journal);\n                  let passwordReceipt: PreparedCommit<any> | undefined;\n\n                  yield* completeProofPlanIn(\n                    configuration.proof!.mapping,\n                    configuration.proof!.configuration,\n                    input.completion,\n                    Effect.gen(function* () {\n                      const revisions = {\n                        credentialRevision,\n                        verifierVersion,\n                        nextSecurityRevision,\n                      };\n\n                      const applied = yield* writeReplacement(\n                        mapping,\n                        input,\n                        authority.nativeSubjectId,\n                        revisions,\n                        authority.now,\n                      );\n\n                      if (applied)\n                        yield* registerReplacement(\n                          mapping,\n                          input,\n                          authority.nativeSubjectId,\n                          revisions,\n                          authority.now,\n                        );\n\n                      return applied;\n                    }),\n                    (decision) => {\n                      passwordReceipt = prepare(\n                        decision === \"completed\" ? \"changed\" : \"rejected\",\n                        journal,\n                      );\n\n                      return decision;\n                    },\n                  );\n\n                  return passwordReceipt ?? prepare(\"rejected\", journal);\n                }),\n              );\n            })\n        ).pipe(\n          Effect.provideService(CurrentPasswordSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n    });\n  });\n\n  const currentExpectedCredential = Effect.fn(\"DrizzlePassword.currentExpectedCredential\")(\n    function* (mapping: Mapping, input: PasswordMutationInput, nativeSubjectId: unknown) {\n      if (input.credential === undefined) return false;\n\n      const row = (yield* readPasswordCredential(\n        mapping,\n        input.moduleId,\n        nativeSubjectId,\n        true,\n      ))[0];\n\n      if (row === undefined) return false;\n\n      return (\n        row[mapping.credential.credentialId] === input.credential.credentialId &&\n        row[mapping.credential.credentialRevision] === input.credential.credentialRevision &&\n        row[mapping.credential.verifierVersion] === input.credential.verifierVersion &&\n        row[mapping.credential.verifier] === Redacted.value(input.credential.verifier) &&\n        row[mapping.credential.normalization] === input.credential.normalization &&\n        input.authorization.challenge.targetCredentialId === input.credential.credentialId\n      );\n    },\n  );\n\n  const checkMutationApplied = Effect.fn(\"DrizzlePassword.checkMutationApplied\")(function* (\n    mapping: Mapping,\n    input: PasswordMutationInput,\n    nativeSubjectId: unknown,\n    revisions: {\n      readonly credentialId: string;\n      readonly credentialRevision: SecurityRevision;\n      readonly verifierVersion: SecurityRevision;\n      readonly nextSecurityRevision: SecurityRevision;\n    },\n    now: number,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    const c = credentialColumns(mapping),\n      s = subjectColumns(mapping);\n\n    const credential = (yield* database\n      .select()\n      .from(mapping.credential.table)\n      .where(\n        and(\n          eq(c.moduleId, input.moduleId),\n          eq(c.subjectId, nativeSubjectId),\n          eq(c.credentialId, revisions.credentialId),\n          eq(c.credentialRevision, revisions.credentialRevision),\n          eq(c.verifierVersion, revisions.verifierVersion),\n          eq(c.verifier, Redacted.value(input.replacement.verifier)),\n          eq(c.normalization, input.replacement.normalization),\n        ),\n      )\n      .limit(1))[0];\n\n    const subject = (yield* database\n      .select()\n      .from(mapping.subject.table)\n      .where(and(eq(s.id, nativeSubjectId), eq(s.securityRevision, revisions.nextSecurityRevision)))\n      .limit(1))[0];\n\n    const authorityCredential = (yield* database\n      .select()\n      .from(mapping.authorityCredential.table)\n      .where(\n        and(\n          eq(authorityCredentialColumns(mapping).subjectId, nativeSubjectId),\n          eq(authorityCredentialColumns(mapping).credentialId, revisions.credentialId),\n          eq(authorityCredentialColumns(mapping).revision, revisions.credentialRevision),\n        ),\n      )\n      .limit(1))[0];\n\n    // SQL equality follows column collation; compare the persisted values exactly.\n    return (\n      credential !== undefined &&\n      credential[mapping.credential.credentialId] === revisions.credentialId &&\n      credential[mapping.credential.credentialRevision] === revisions.credentialRevision &&\n      credential[mapping.credential.verifierVersion] === revisions.verifierVersion &&\n      credential[mapping.credential.verifier] === Redacted.value(input.replacement.verifier) &&\n      credential[mapping.credential.normalization] === input.replacement.normalization &&\n      (yield* mutationPostconditions(\n        mapping,\n        input,\n        nativeSubjectId,\n        subject,\n        authorityCredential,\n        now,\n      ))\n    );\n  });\n\n  const writeReplacement = Effect.fn(\"DrizzlePassword.writeReplacement\")(function* (\n    mapping: Mapping,\n    input: PasswordMutationInput,\n    nativeSubjectId: unknown,\n    revisions: {\n      readonly credentialRevision: SecurityRevision;\n      readonly verifierVersion: SecurityRevision;\n      readonly nextSecurityRevision: SecurityRevision;\n    },\n    now: number,\n  ) {\n    const database = yield* CurrentPasswordSql;\n\n    const c = credentialColumns(mapping);\n    const s = subjectColumns(mapping);\n\n    yield* database\n      .update(mapping.credential.table)\n      .set(\n        mapping.credential.encodeReplacement({\n          replacement: input.replacement,\n          credentialRevision: revisions.credentialRevision,\n          verifierVersion: revisions.verifierVersion,\n        }),\n      )\n      .where(\n        and(\n          eq(c.moduleId, input.moduleId),\n          eq(c.subjectId, nativeSubjectId),\n          eq(c.credentialId, input.credential!.credentialId),\n          eq(c.credentialRevision, input.credential!.credentialRevision),\n          eq(c.verifierVersion, input.credential!.verifierVersion),\n          eq(c.verifier, Redacted.value(input.credential!.verifier)),\n          eq(c.normalization, input.credential!.normalization),\n        ),\n      );\n    yield* database\n      .update(mapping.subject.table)\n      .set(updateValues([[mapping.subject.securityRevision, revisions.nextSecurityRevision]]))\n      .where(\n        and(\n          eq(s.id, nativeSubjectId),\n          eq(s.securityRevision, input.expectedRevision.securityRevision),\n        ),\n      );\n    yield* database\n      .update(mapping.authorityCredential.table)\n      .set(mapping.authorityCredential.encodeRevision(revisions.credentialRevision))\n      .where(\n        and(\n          eq(authorityCredentialColumns(mapping).subjectId, nativeSubjectId),\n          eq(authorityCredentialColumns(mapping).credentialId, input.credential!.credentialId),\n          eq(authorityCredentialColumns(mapping).revision, input.credential!.credentialRevision),\n        ),\n      );\n    yield* insertCommand(mapping, input, input.authorization.challenge.action, now);\n\n    return yield* checkMutationApplied(\n      mapping,\n      input,\n      nativeSubjectId,\n      {\n        ...revisions,\n        credentialId: input.credential!.credentialId,\n      },\n      now,\n    );\n  });\n\n  const registerReplacement = (\n    mapping: Mapping,\n    input: PasswordMutationInput,\n    nativeSubjectId: unknown,\n    revisions: {\n      readonly credentialRevision: SecurityRevision;\n      readonly verifierVersion: SecurityRevision;\n      readonly nextSecurityRevision: SecurityRevision;\n    },\n    now: number,\n  ) =>\n    registerFinal(\n      checkMutationApplied(\n        mapping,\n        input,\n        nativeSubjectId,\n        { ...revisions, credentialId: input.credential!.credentialId },\n        now,\n      ),\n    );\n\n  const replaceIn = Effect.fn(\"Drizzle.replaceIn\")(function* <A>(\n    mapping: Mapping,\n    configuration: PasswordSqlConfiguration,\n    input: PasswordMutationInput,\n    action: PasswordAction,\n    revisions: {\n      readonly credentialRevision: SecurityRevision;\n      readonly verifierVersion: SecurityRevision;\n      readonly nextSecurityRevision: SecurityRevision;\n    },\n    prepare: (value: PasswordMutationDecision, journal: CommitJournal) => PreparedCommit<A>,\n  ) {\n    const journal = yield* CurrentCommitJournal;\n\n    const authority = yield* validateMutationAuthority(mapping, configuration, input, action);\n\n    if (authority === undefined) return prepare(\"rejected\", journal);\n    if ((yield* commandExists(mapping, input.moduleId, input.commandId, true)).length)\n      return prepare(\"rejected\", journal);\n    if (!(yield* currentExpectedCredential(mapping, input, authority.nativeSubjectId)))\n      return prepare(\"rejected\", journal);\n    const prepared = prepare(\"changed\", journal);\n\n    if (\n      !(yield* writeReplacement(\n        mapping,\n        input,\n        authority.nativeSubjectId,\n        revisions,\n        authority.now,\n      ))\n    )\n      return yield* unavailable();\n    yield* registerReplacement(mapping, input, authority.nativeSubjectId, revisions, authority.now);\n\n    return prepared;\n  });\n\n  /** Internal bound-owner primitives; deliberately not re-exported by driver modules. */\n  const passwordSqlKernel = {\n    allocate,\n    allocateNextSecurityRevision,\n    owned,\n    safeRead,\n    snapshotMutationInput,\n    lockSubject,\n    lockIdentifier,\n    readPasswordCredential,\n    resolveCredential,\n    validateMutationAuthority,\n    currentExpectedCredential,\n    commandExists,\n    addPasswordIn,\n    checkMutationApplied,\n    writeReplacement,\n    evidenceSatisfiedAt,\n    sameCredentialSnapshot,\n    subjectColumns,\n    identifierColumns,\n    credentialColumns,\n    authorityCredentialColumns,\n    proofCompletionMatchesPassword,\n  };\n\n  return { makeSqlPasswordPersistence, passwordSqlKernel };\n};\n"],"mappings":";;;;;;;;;;;;;;AAwFA,IAAa,qBAAb,cAAwC,QAAQ,QAAiD,CAAC,CAChG,gCACF,CAAC,CAAC,CAAC;AAoBH,MAAa,sBAIX,YACA,QACA,gBAA0E,WACxE,oBAAoB,MAAM,MACzB;CAGH,MAAM,EAAE,KAAK,IAAI,SAAS,QAAQ,iBAAiB;CACnD,MAAM,EAAE,wBAAwB;CAChC,MAAM,oBAAoB,oBAAoB,KAAK,CAAC,CAAC;CAErD,MAAM,oBACJ,WAEA,yBACE,SACC,UACC,OAAO,GAAG,mBAAmB,CAAC,CAAC,KAAK,KACpC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,sBAAsB,CAAC,CAAC,KAAK,CAC3C,CAAC,CAAC,KAAK,OAAO,YAAY,UAAU,OAAO,UAAU,MAAM,IAAI,aAAa,YAAY,CAAC,CAAC,CAAC,CAAC;CAE9F,MAAM,YAAY,SAAS,IAAI,KAAK,OAAO,IAAI,SAAS,aAAa,CAAC;CAEtE,MAAM,oBAAoB,YACxB,OAAO,QAAQ,2BAA2B,CAAC,CAAC,OACzC,CAAC,KAAK,WACL,QAAQ,YAAY,SAAqD,KAC7E;CAEF,MAAM,cAAc,OAAyB,YAC3C,WAAW,OAAO,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,IAAI;CAErE,MAAM,kBAAkB,aAAsB;EAC5C,IAAI,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,EAAE;EACpD,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;EAC5D,kBAAkB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,gBAAgB;CAClF;CAEA,MAAM,qBAAqB,aAAsB;EAC/C,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;EACxE,OAAO,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,KAAK;EAChE,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;EACxE,YAAY,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,UAAU;EAC1E,iBAAiB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,eAAe;CACtF;CAEA,MAAM,qBAAqB,aAAsB;EAC/C,UAAU,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,QAAQ;EACtE,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;EACxE,cAAc,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,YAAY;EAC9E,oBAAoB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,kBAAkB;EAC1F,iBAAiB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,eAAe;EACpF,UAAU,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,QAAQ;EACtE,eAAe,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,aAAa;CAClF;CAEA,MAAM,8BAA8B,aAAsB;EACxD,WAAW,OAAO,QAAQ,oBAAoB,OAAO,QAAQ,oBAAoB,SAAS;EAC1F,cAAc,OACZ,QAAQ,oBAAoB,OAC5B,QAAQ,oBAAoB,YAC9B;EACA,UAAU,OAAO,QAAQ,oBAAoB,OAAO,QAAQ,oBAAoB,QAAQ;CAC1F;CAEA,MAAM,kBAAkB,aAAsB;EAC5C,UAAU,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,QAAQ;EAChE,WAAW,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,SAAS;EAClE,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;EAC5D,eAAe,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,aAAa;EAC1E,UAAU,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,QAAQ;EAChE,gBAAgB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,cAAc;CAC9E;CAEA,MAAM,YACJ,MACA,YACA,cACoE;EACpE,IAAI,SAAS,eACX,OAAO,cAAc,KAAA,IACjB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;GACT,KAAK;GACL,QAAQ,UAAU,IAAI,wBAAwB;IAAE,WAAW;IAAW;GAAM,CAAC;EAC/E,CAAC;EACP,IAAI,eAAe,KAAA,GAAW,OAAO;EAErC,OAAO,cAAc,KAAA,IACjB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;GACT,KAAK;GACL,QAAQ,UAAU,IAAI,wBAAwB;IAAE,WAAW;IAAW;GAAM,CAAC;EAC/E,CAAC;CACP;CAEA,MAAM,gCACJ,SACA,MACA,YACG;EACH,MAAM,aAAa,QAAQ,QAAQ,uBAAuB,OAAO;EAEjE,MAAM,YACJ,QAAQ,QAAQ,6BAA6B,KAAA,IACzC,KAAA,UACM,QAAQ,QAAQ,yBAA0B,OAAO;EAE7D,OAAO,SACL,MACA,cAAc,QAAQ,kBACtB,aAAa,QAAQ,oBACvB;CACF;CAEA,MAAM,kBAAkB,MAAuB,UAC7C,KAAK,cAAc,MAAM,aAAa,KAAK,UAAU,MAAM;CAE7D,MAAM,uBACJ,UACA,aACA,QACY;EACZ,IAAI,SAAS,OAAO,SAAS,MAAM,SAAS,SAAS,YAAY,SAAS,IAAI,OAAO;EACrF,MAAM,4BAAY,IAAI,IAAoB;EAE1C,KAAK,MAAM,QAAQ,SAAS,SAAS,aAAa;GAChD,IAAI,UAAU,IAAI,KAAK,YAAY,GAAG,OAAO;GAC7C,UAAU,IAAI,KAAK,cAAc,KAAK,QAAQ;EAChD;EACA,IAAI,SAAS,OAAO,MAAM,UAAU,CAAC,UAAU,IAAI,MAAM,YAAY,CAAC,GAAG,OAAO;EAChF,IAAI,SAAS,OAAO,MAAM,UAAU,MAAM,SAAS,cAAc,MAAM,UAAU,CAAC,GAChF,OAAO;EAET,MAAM,WAAW,SAAS,OAAO,QAAQ,UAAU;GACjD,MAAM,MAAM,MAAM,SAAS,cAAc,MAAM,UAAU;GAEzD,OAAO,OAAO,KAAK,MAAM,YAAY;EACvC,CAAC;EAED,MAAM,UAAU,IAAI,IAAI,SAAS,SAAS,UAAU,MAAM,OAAO,CAAC;EAClE,MAAM,cAAc,IAAI,IAAI,SAAS,KAAK,UAAU,MAAM,YAAY,CAAC;EAEvE,OAAO,YAAY,aAAa,MAC7B,gBACC,YAAY,QAAQ,OAAO,WAAW,QAAQ,IAAI,MAAM,CAAC,KACzD,YAAY,QAAQ,YAAY,sBAChC,SAAS,MACN,WACE,CAAC,YAAY,gBAAgB,MAAM,kBACnC,CAAC,YAAY,qBAAqB,MAAM,kBAC7C,CACJ;CACF;CAEA,MAAM,wBAAwB,OAAO,GAAG,uCAAuC,CAAC,CAAC,WAC/E,OACA;EACA,MAAM,mBAAmB,yBAAyB,MAAM,gBAAgB;EAExE,MAAM,WAAW,OAAO,+BAA+B,MAAM,cAAc,QAAQ,CAAC,CAAC,KACnF,OAAO,SAAS,WAAW,CAC7B;EAEA,MAAM,cAAc,OAAO,4BAA4B,MAAM,cAAc,WAAW;EAEtF,MAAM,aACJ,MAAM,eAAe,KAAA,IACjB,KAAA,IACA,OAAO,2BAA2B,MAAM,UAAU;EAExD,OAAO,OAAO,OAAO;GACnB,GAAG;GACH;GACA,aAAa,OAAO,OAAO;IACzB,UAAU,SAAS,KAAK,SAAS,MAAM,MAAM,YAAY,QAAQ,CAAC;IAClE,eAAe,MAAM,YAAY;GACnC,CAAC;GACD,cAAc,OAAO,OAAO,EAAE,GAAG,MAAM,aAAa,CAAC;GACrD,GAAI,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW;GACjD,eAAe,OAAO,OAAO;IAC3B,WAAW,OAAO,OAAO;KACvB,GAAG,MAAM,cAAc;KACvB,UAAU,yBAAyB,MAAM,cAAc,UAAU,QAAQ;IAC3E,CAAC;IACD;IACA;GACF,CAAC;EACH,CAAC;CACH,CAAC;CAED,MAAM,cAAc,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAC3D,SACA,WACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,SAAgB;EAC1E,MAAM,IAAI,eAAe,OAAO;EAOhC,OAAO;GAAE;GAAiB,MAAK,OALX,WAClB,SAAS,OAAO,CAAC,CAAC,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAAC,MAAM,GAAG,EAAE,IAAI,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,GACtF,OACF,EAAA,CAEoC;EAAG;CACzC,CAAC;CAED,MAAM,iBAAiB,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,YACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EAEnC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,IAAI,GAAG,EAAE,WAAW,WAAW,SAAS,GAAG,GAAG,EAAE,OAAO,WAAW,KAAK,CAAC,CAAC,CAAC,CAChF,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,yBAAyB,OAAO,GAAG,gCAAgC,CAAC,CAAC,WACzE,SACA,UACA,iBACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EAEnC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,IAAI,GAAG,EAAE,UAAU,QAAQ,GAAG,GAAG,EAAE,WAAW,eAAe,CAAC,CAAC,CAAC,CACtE,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,oBAAoB,OAAO,GAAG,mCAAmC,CAAC,CAAC,WACvE,SACA,UACA,YACA,oBACA,SACA;EACA,MAAM,WAAW,OAAO;EAIxB,MAAM,cAAc,OAAO,eAAe,SAAS,YAAY,KAAK,EAAA,CAAG;EAEvE,IAAI,eAAe,KAAA,KAAa,CAAC,QAAQ,WAAW,UAAU,UAAU,GAAG,OAAO,KAAA;EAClF,MAAM,mBAAmB,WAAW,QAAQ,WAAW;EAWvD,MAAM,WAAU,OATW,WACzB,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,GAAG,eAAe,OAAO,CAAC,CAAC,IAAI,gBAAgB,CAAC,CAAC,CACvD,MAAM,CAAC,GACV,OACF,EAAA,CAE4B;EAE5B,IAAI,YAAY,KAAA,KAAa,CAAC,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,GAC1F,OAAO,KAAA;EAET,MAAM,iBAAgB,OADK,eAAe,SAAS,YAAY,OAAO,EAAA,CACpC;EAElC,IACE,kBAAkB,KAAA,KAClB,CAAC,QAAQ,WAAW,UAAU,aAAa,KAC3C,CAAC,QAAQ,UAAU,OAAO,kBAAkB,cAAc,QAAQ,WAAW,UAAU,GAEvF,OAAO,KAAA;EACT,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,gBAAgB;EAErE,IAAI,uBAAuB,KAAA,KAAa,uBAAuB,WAAW,OAAO,KAAA;EAEjF,MAAM,cAAa,OADQ,uBAAuB,SAAS,UAAU,kBAAkB,OAAO,EAAA,CAC/D;EAE/B,IAAI,eAAe,KAAA,GACjB,OAAO;GAAE,iBAAiB;GAAkB;GAAS,YAAY;EAAc;EAMjF,OAAO;GACL,iBAAiB;GACjB;GACA,YAAY;GACZ;GACA,UAAA,OATsB,QAAQ,WAC7B,OAAO;IAAE;IAAU;IAAS,YAAY;IAAe;GAAW,CAAC,CAAC,CACpE,KAAK,OAAO,QAAQ,0BAA0B,CAAC;EAQlD;CACF,CAAC;CAED,MAAM,SACJ,UACA,SACA,eACA,SACG;EACH,IAAI,CAAC,iBAAiB,OAAO,GAAG,OAAO,OAAO,KAAK,YAAY,CAAC;EAEhE,MAAM,MAAM,uBAER,SAAS,aAAa,gBACpB,KAAK,KACH,OAAO,eAAe,oBAAoB,WAAW,GACrD,OAAO,eAAe,iBAAiB,WAA0C,CACnF,CACF,GACF,EAAE,MAAM,cAAc,KAAK,CAC7B,CAAC,CAAC,KAAK,OAAO,KAAK,WAAW,OAAO,KAAK,CAAC;EAE3C,OAAO,cAAc,gBAAgB,OACjC,OAAO,IAAI,aAAa;GACtB,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;GACrD,OAAO,cAAc;GAErB,OAAO,OAAO;EAChB,CAAC,IACD;CACN;CAIA,MAAM,gBAAgB,OAAO,WAAW,WACtC,OACA;EACA,MAAM,iBAAiB,OAAO,OAAO,cAAc,8BAA8B;EAEjF,IAAI,OAAO,OAAO,cAAc,GAAG;EAEnC,MAAM,gBAAgB,OAAO,IAAI,aAAa;GAC5C,MAAM,cAAc,OAAO;GAE3B,IAAI,EAAE,OAAO,MAAM,KAAK,OAAO,eAAe,oBAAoB,WAAW,CAAC,IAC5E,OAAO,OAAO,YAAY;EAC9B,CAAC,CAAC,CAAC,KAAK,gBAAgB;EAExB,IAAI,CAAC,eAAe,MAAM,SAAS,aAAa,GAAG,OAAO,OAAO,YAAY;CAC/E,CAAC;CAED,MAAM,YACJ,UACA,eACA,SAEA,OAAO,IAAI,aAAa;EACtB,IAAI,cAAc,gBAAgB,MAAM;GACtC,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;GACrD,OAAO,cAAc;EACvB;EAEA,OAAO,OAAO,SAAS,aAAa,gBAClC,KAAK,KACH,OAAO,eAAe,oBAAoB,WAAW,GACrD,OAAO,eAAe,iBAAiB,WAA0C,CACnF,CACF;CACF,CAAC;CAEH,MAAM,kCACJ,UACG;EACH,MAAM,aAAa,MAAM,WAAW;EACpC,MAAM,UAAU,WAAW;EAE3B,IACE,WAAW,aAAa,GAAG,MAAM,SAAS,WAC1C,WAAW,YAAY,oBACvB,QAAQ,SAAS,aACjB,MAAM,eAAe,KAAA,KACrB,QAAQ,SAAS,cAAc,MAAM,iBAAiB,aACtD,QAAQ,SAAS,qBAAqB,MAAM,iBAAiB,oBAC7D,CAAC,eAAe,QAAQ,YAAY,MAAM,WAAW,UAAU,GAE/D,OAAO;EAET,MAAM,WAAW,CAAC,GAAG,MAAM,iBAAiB,WAAW,CAAC,CAAC,MAAM,MAAM,UACnE,KAAK,aAAa,cAAc,MAAM,YAAY,CACpD;EAEA,MAAM,SAAS,CAAC,GAAG,QAAQ,SAAS,WAAW,CAAC,CAAC,MAAM,MAAM,UAC3D,KAAK,aAAa,cAAc,MAAM,YAAY,CACpD;EAEA,OACE,SAAS,WAAW,OAAO,UAC3B,SAAS,OACN,MAAM,UACL,KAAK,iBAAiB,OAAO,MAAM,CAAE,gBACrC,KAAK,aAAa,OAAO,MAAM,CAAE,QACrC;CAEJ;CAEA,MAAM,uBAAuB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACrE,eACA,OACA;EACA,MAAM,WAAW,OAAO;EAExB,IAAI,cAAc,UAAU,KAAA,GAAW,OAAO,OAAO,OAAO,KAAK,YAAY,CAAC;EAC9E,MAAM,aAAa,EAAE,MAAM,+BAA+B;EAE1D,MAAM,OAA4B;GAChC;GACA,UAAU,UAAU,SAAS,YAAY,QAAQ,QAAQ,QAAQ,QAAQ,CAAC;EAC5E;EAEA,MAAM,QAAQ,uBAEV,SAAS,aAAa,gBACpB,oBACE,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MACA,OAAO,KAAK,UAAU,SAChB,KACR,CAAC,CAAC,KACA,OAAO,eAAe,iBAAiB,WAA0C,CACnF,CACF,GACF,EAAE,MAAM,cAAc,KAAK,CAC7B;EAEA,IAAI,cAAc,gBAAgB,SAAS,OAAO,iBAAiB,OAAO,OAAO,YAAY;EAC7F,OAAO,cAAc;EAErB,OAAO,OAAO,MAAM,KAClB,OAAO,GAAG,KAAK,GACf,OAAO,YAAY,UAAU;GAC3B,MAAM,SAAS,MAAM,QAAQ;GAE7B,OAAO,MAAM,QAAQ,WAAW,KAC9B,WAAW,KAAA,KACX,MAAM,aAAa,MAAM,KACzB,OAAO,UAAU,aACf,OAAO,QAAQ,IAAI,IACnB,OAAO,UAAU,KAAK;EAC5B,CAAC,CACH;CACF,CAAC;CAED,MAAM,4BAA4B,OAAO,GAAG,2CAA2C,CAAC,CACtF,WACE,SACA,eACA,OACA,QACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,SAAS,OAAO,YACpB,SACA,MAAM,iBAAiB,WACvB,cAAc,OAChB;EAEA,MAAM,MAAM,OAAO;EAEnB,IACE,QAAQ,KAAA,KACR,CAAC,QAAQ,QAAQ,eAAe,IAAI,QAAQ,QAAQ,OAAO,KAC3D,IAAI,QAAQ,QAAQ,sBAAsB,MAAM,iBAAiB,kBAEjE,OAAO,KAAA;EACT,IACE,MAAM,cAAc,UAAU,aAAa,MAAM,YACjD,MAAM,cAAc,UAAU,WAAW,UACzC,MAAM,cAAc,UAAU,cAAc,MAAM,aAClD,MAAM,cAAc,UAAU,SAAS,cAAc,MAAM,iBAAiB,aAC5E,MAAM,cAAc,UAAU,SAAS,qBACrC,MAAM,iBAAiB,oBACxB,MAAM,cAAc,SAAS,WAAuB,MAAM,aAC3D,MAAM,cAAc,SAAS,kBAC3B,MAAM,cAAc,UAAU,iBAChC,MAAM,cAAc,SAAS,SAAS,cAAc,MAAM,iBAAiB,aAC3E,MAAM,cAAc,SAAS,SAAS,qBACpC,MAAM,iBAAiB,oBACxB,WAAW,mBACT,MAAM,eAAe,KAAA,KACpB,MAAM,cAAc,UAAU,uBAAuB,KAAA,IAEzD,OAAO,KAAA;EACT,IACE,MAAM,iBAAiB,YAAY,MAChC,aACC,CAAC,MAAM,cAAc,SAAS,SAAS,YAAY,MAChD,WACC,OAAO,iBAAiB,SAAS,gBACjC,OAAO,aAAa,SAAS,QACjC,CACJ,GAEA,OAAO,KAAA;EACT,IAAI,MAAM,eAAe,KAAA,GAAW;GAClC,MAAM,cAAc,OAAO,eACzB,SACA,MAAM,WAAW,YACjB,cAAc,OAChB,EAAA,CAAG;GAEH,IACE,eAAe,KAAA,KACf,CAAC,QAAQ,WAAW,UAAU,UAAU,KACxC,CAAC,QAAQ,UAAU,OACjB,WAAW,QAAQ,WAAW,YAC9B,OAAO,eACT,KACA,WAAW,QAAQ,WAAW,qBAC5B,MAAM,WAAW,2BAEnB,OAAO,KAAA;EACX;EAEA,MAAM,cAAc,CAClB,GAAG,MAAM,iBAAiB,aAC1B,GAAG,MAAM,cAAc,SAAS,SAAS,WAC3C;EAEA,MAAM,WAAW,IAAI,IAAI,YAAY,KAAK,SAAS,CAAC,KAAK,cAAc,IAAI,CAAC,CAAC;EAE7E,MAAM,KAAK,2BAA2B,OAAO;EAE7C,MAAM,iBACJ,SAAS,SAAS,IACd,CAAC,IACD,OAAO,WACL,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,oBAAoB,KAAK,CAAC,CACvC,MACC,IACE,GAAG,GAAG,WAAW,OAAO,eAAe,GACvC,QAAQ,GAAG,cAAc,CAAC,GAAG,SAAS,KAAK,CAAC,CAAC,CAC/C,CACF,CAAC,CACA,QAAQ,GAAG,YAAY,GAC1B,cAAc,OAChB;EAEN,IAAI,eAAe,WAAW,SAAS,MAAM,OAAO,KAAA;EAEpD,KAAK,MAAM,UAAU,gBAAgB;GACnC,MAAM,SAAS,SAAS,IAAI,OAAO,QAAQ,oBAAoB,aAAa;GAE5E,IACE,WAAW,KAAA,KACX,OAAO,QAAQ,oBAAoB,cAAc,OAAO,YACvD,QAAQ,oBAAoB,WAAW,KAAA,KACtC,QAAQ,oBAAoB,iBAC1B,OAAO,QAAQ,oBAAoB,OACrC,MAAM,MAER,OAAO,KAAA;GACT,SAAS,OAAO,OAAO,YAAY;EACrC;EACA,IAAI,SAAS,SAAS,GAAG,OAAO,KAAA;EAChC,IAAI,MAAM,eAAe,KAAA,GAAW;GAClC,MAAM,cAAc,OAAO,eAAe,SAAS,MAAM,WAAW,YAAY,KAAK,EAAA,CAAG;GAExF,MAAM,cAAc,OAAO,uBACzB,SACA,MAAM,UACN,OAAO,iBACP,cAAc,OAChB,EAAA,CAAG;GAEH,IAAI,eAAe,KAAA,KAAa,eAAe,KAAA,GAAW,OAAO,KAAA;GAEjE,MAAM,WAAW,OAAO,QAAQ,WAAW,OAAO;IAChD,UAAU,MAAM;IAChB,SAAS;IACT;IACA;GACF,CAAC;GAED,IAAI,CAACA,+BAAuB,UAAU,MAAM,UAAU,GAAG,OAAO,KAAA;EAClE;EACA,MAAM,qBAAqB,OAAO,QAAQ,QAAQ,wBAAwB,KAAK,MAAM;EACrF,MAAM,MAAM,OAAO;EAEnB,IACE,CAAC,oBAAoB,MAAM,cAAc,UAAU,MAAM,cAAc,aAAa,GAAG,KACvF,CAAC,oBAAoB,MAAM,cAAc,UAAU,oBAAoB,GAAG,GAE1E,OAAO,KAAA;EACT,KACG,MAAM,aAAa,qBAAqB,eACvC,MAAM,aAAa,qBAAqB,mBAC1C,QAAQ,wBAAwB,4BAEhC,OAAO,KAAA;EAET,OAAO;GAAE,GAAG;GAAQ;EAAI;CAC1B,CACF;CAEA,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,UACA,WACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,eAAe,OAAO;EAEhC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,IAAI,GAAG,EAAE,UAAU,QAAQ,GAAG,GAAG,EAAE,WAAW,SAAS,CAAC,CAAC,CAAC,CAChE,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,OACA,QACA,KACA;EAGA,OAAO,QAAO,OAFU,mBAAA,CAED,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,OACnD,QAAQ,QAAQ,aAAa;GAC3B,UAAU,MAAM;GAChB,WAAW,MAAM;GACjB;GACA,eAAe,MAAM,cAAc,UAAU;GAC7C,UAAU;GACV,sBAAsB,MAAM,QAAQ;EACtC,CAAC,CACH;CACF,CAAC;CAED,MAAM,yBAAyB,OAAO,GAAG,wCAAwC,CAAC,CAAC,WACjF,SACA,OACA,iBACA,SACA,qBACA,KACA;EACA,IACE,YAAY,KAAA,KACZ,CAAC,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,KAC/D,wBAAwB,KAAA,KACvB,QAAQ,oBAAoB,WAAW,KAAA,KACtC,QAAQ,oBAAoB,iBAC1B,oBAAoB,QAAQ,oBAAoB,OAClD,MAAM,MAER,OAAO;EACT,IAAI,MAAM,eAAe,KAAA,GAAW;GAClC,MAAM,cAAc,OAAO,eAAe,SAAS,MAAM,WAAW,YAAY,KAAK,EAAA,CAAG;GAExF,IACE,eAAe,KAAA,KACf,CAAC,QAAQ,WAAW,UAAU,UAAU,KACxC,CAAC,QAAQ,UAAU,OAAO,WAAW,QAAQ,WAAW,YAAY,eAAe,KACnF,WAAW,QAAQ,WAAW,qBAC5B,MAAM,WAAW,2BAEnB,OAAO;GAET,MAAM,cAAc,OAAO,uBACzB,SACA,MAAM,UACN,iBACA,KACF,EAAA,CAAG;GAEH,IAAI,eAAe,KAAA,GAAW,OAAO;GASrC,KAAI,OAPmB,QAAQ,WAAW,OAAO;IAC/C,UAAU,MAAM;IAChB;IACA;IACA;GACF,CAAC,EAAA,CAEW,+BAA+B,MAAM,WAAW,4BAC1D,OAAO;EACX;EACA,MAAM,OAAO,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,WAAW,KAAK;EACjF,MAAM,MAAM,KAAK;EAEjB,OACE,KAAK,WAAW,KAChB,IAAI,QAAQ,QAAQ,YAAY,MAAM,cAAc,UAAU,UAC9D,IAAI,QAAQ,QAAQ,mBAAmB,MAAM,cAAc,UAAU,iBACrE,IAAI,QAAQ,QAAQ,cAAc,cACjC,OAAO,QAAQ,cAAc,IAAI,QAAQ,QAAQ,eAAe,OAC/D,MAAM,QAAQ;CAEpB,CAAC;CAED,MAAM,gBAAgB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAC/D,SACA,eACA,OACA,WAMA,YACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,EAAE,cAAc,oBAAoB,iBAAiB,yBAAyB;EAEpF,MAAM,YAAY,OAAO,0BACvB,SACA,eACA,OACA,cACF;EAEA,IAAI,cAAc,KAAA,GAAW,OAAO;EACpC,KAAK,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,WAAW,IAAI,EAAA,CAAG,QAAQ,OAAO;EAC1F,KACG,OAAO,uBAAuB,SAAS,MAAM,UAAU,UAAU,iBAAiB,IAAI,EAAA,CACpF,QAEH,OAAO;EAET,OAAO,SAAS,OAAO,QAAQ,WAAW,KAAK,CAAC,CAAC,OAC/C,QAAQ,WAAW,aAAa;GAC9B,UAAU,MAAM;GAChB,WAAW,UAAU;GACrB;GACA;GACA;GACA,aAAa,MAAM;EACrB,CAAC,CACH;EACA,OAAO,SAAS,OAAO,QAAQ,oBAAoB,KAAK,CAAC,CAAC,OACxD,QAAQ,oBAAoB,aAAa;GACvC,WAAW,UAAU;GACrB;GACA,UAAU;EACZ,CAAC,CACH;EACA,OAAO,SACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,IAAI,aAAa,CAAC,CAAC,QAAQ,QAAQ,kBAAkB,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAC7E,MACC,IACE,GAAG,eAAe,OAAO,CAAC,CAAC,IAAI,UAAU,eAAe,GACxD,GAAG,eAAe,OAAO,CAAC,CAAC,kBAAkB,MAAM,iBAAiB,gBAAgB,CACtF,CACF;EACF,OAAO,cAAc,SAAS,OAAO,gBAAgB,cAAc,UAAU,GAAG;EAEhF,MAAM,UAAU,qBACd,SACA,OACA,UAAU,iBACV,WACA,cAAc,UAAU,GAC1B;EAEA,IAAI,EAAE,OAAO,UAAU,OAAO,OAAO,YAAY;EACjD,OAAO,cAAc,OAAO;EAE5B,OAAO;CACT,CAAC;CAED,MAAM,6BAA6B,OAAO,GAAG,4BAA4B,CAAC,CAAC,WACzE,SACA,eAKA;EACA,MAAM,WAAW,OAAO;EAExB,IAAI,CAAC,cAAc,aACjB,QACE,WAAW,kBAAkB;GAC3B,GAAG;GACH,OAAO,cAAc,OAAO;EAC9B,CAAC,KAAK,OAAO,KAAA,CACb,KAAK,OAAO,SAAS,WAAW,CAAC;EACrC,MAAM,QAAQ,OAAO;EAErB,IAAI,CAAC,iBAAiB,OAAO,GAAG,OAAO,OAAO,YAAY;EAC1D,MAAM,OAAO,OAAO;EAEpB,MAAM,cAAc,OAAO,wBACzB,OAAO,iBAAiB,aAAa,KAAK,QAAQ,kBAAkB,GAAG,IAAI,CAAC,CAAC,CAAC,KAC5E,gBACF,GACA,SACA,aACF;EAEA,OAAO,oBAAoB,GAAG;GAC5B,GAAG;GACH,iBAAiB,UACf,SACE,UACA,eACA,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAE3B,MAAM,SAAS,OAAO,YAAY,SAAS,MAAM,WAAW,KAAK;IAEjE,IACE,OAAO,QAAQ,KAAA,KACf,CAAC,QAAQ,QAAQ,eAAe,OAAO,IAAI,QAAQ,QAAQ,OAAO,GAElE,OAAO,OAAO,KAAK;IAErB,MAAM,cAAc,OAAO,uBACzB,SACA,MAAM,UACN,OAAO,iBACP,KACF,EAAA,CAAG;IAEH,IAAI,eAAe,KAAA,GAAW,OAAO,OAAO,KAAK;IACjD,MAAM,KAAK,kBAAkB,OAAO;IAOpC,MAAM,cAAa,OALQ,YACxB,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,GAAG,GAAG,WAAW,OAAO,eAAe,CAAC,EAAA,CAElB,MAAM,QAAa,QAAQ,WAAW,UAAU,GAAG,CAAC;IAEnF,IAAI,eAAe,KAAA,GAAW,OAAO,OAAO,KAAK;IAEjD,MAAM,WAAW,OAAO,QAAQ,WAC7B,OAAO;KACN,UAAU,MAAM;KAChB,SAAS,OAAO;KAChB;KACA;IACF,CAAC,CAAC,CACD,KAAK,OAAO,QAAQ,0BAA0B,CAAC;IAElD,OAAO,OAAO,KAAK,QAAQ;GAC7B,CAAC,CACH,CAAC,CAAC,KACA,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,iBAAiB,UACf,SACE,UACA,eACA,OAAO,IAAI,aAAa;IACtB,MAAM,WAAW,OAAO,kBACtB,SACA,MAAM,UACN,MAAM,YACN,KAAA,GACA,KACF;IAEA,OAAO,UAAU,aAAa,KAAA,KAC5B,SAAS,SAAS,+BAA+B,KAAA,IAC/C,OAAO,KAAK,IACZ,OAAO,KAAK,SAAS,QAAQ;GACnC,CAAC,CACH,CAAC,CAAC,KACA,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,cAAc,YAAY,YACxB,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,OAAO,sBAAsB,UAAU;IAErD,MAAM,eAAe,OAAO,SAC1B,cAAc,MACd,QAAQ,sBACR,QAAQ,wBACV;IAEA,MAAM,qBAAqB,OAAO,SAChC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,kBAAkB,OAAO,SAC7B,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,uBAAuB,OAAO,6BAClC,SACA,cAAc,MACd,MAAM,iBAAiB,gBACzB;IAEA,IAAI,yBAAyB,MAAM,iBAAiB,kBAClD,OAAO,OAAO,YAAY;IAE5B,OAAO,OAAO,MACZ,UACA,SACA,eACA,OAAO,IAAI,aAAa;KACtB,MAAM,UAAU,OAAO;KASvB,OAAO,SAAQ,OAPQ,cAAc,SAAS,eAAe,OAAO;MAClE;MACA;MACA;MACA;KACF,CAAC,KAEwB,YAAY,YAAY,OAAO;IAC1D,CAAC,CACH;GACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,mBAAmB,YAAY,YAC7B,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,OAAO,sBAAsB,UAAU;IAErD,MAAM,qBAAqB,OAAO,SAChC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,kBAAkB,OAAO,SAC7B,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,uBAAuB,OAAO,6BAClC,SACA,cAAc,MACd,MAAM,iBAAiB,gBACzB;IAEA,IACE,yBAAyB,MAAM,iBAAiB,oBAC/C,MAAM,eAAe,KAAA,KACpB,uBAAuB,MAAM,WAAW,oBAE1C,OAAO,OAAO,YAAY;IAE5B,OAAO,OAAO,MACZ,UACA,SACA,eACA,OAAO,IAAI,aAAa;KACtB,OAAO,OAAO,UACZ,SACA,eACA,OACA,mBACA;MAAE;MAAoB;MAAiB;KAAqB,GAC5D,OACF;IACF,CAAC,CACH;GACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,aAAa,WACV,cAAc,UAAU,KAAA,IACrB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI,aAAa;IACtB,IACE,MAAM,SAAS,UAAU,KACzB,CAAC,MAAM,SAAS,SAAS,QAAQ,KACjC,MAAM,YAAY,oBAClB,MAAM,QAAQ,SAAS,WAEvB,OAAO;IACT,MAAM,UAAU,MAAM;IACtB,MAAM,mBAAmB,MAAM,SAAS,MAAM,GAAG,EAAgB;IA6BjE,QAAO,OA3BgB,SACrB,UACA,eACA,OAAO,IAAI,aAAa;KACtB,MAAM,WAAW,OAAO,kBACtB,SACA,kBACA,QAAQ,YACR,QAAQ,SAAS,WACjB,KACF;KAEA,OACE,UAAU,aAAa,KAAA,KACvB,SAAS,SAAS,SAAS,qBACzB,QAAQ,SAAS,oBACnB,QAAQ,SAAS,YAAY,OAAO,SAClC,SAAS,SAAU,SAAS,YAAY,MACrC,WACC,OAAO,iBAAiB,KAAK,gBAC7B,OAAO,aAAa,KAAK,QAC7B,CACF;IAEJ,CAAC,CACH,KAEiB,OAAO,qBAAqB,eAAe,KAAK,IAAI;GACvE,CAAC,EAAA,CACH,KACA,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,iBAAiB,YAAY,aAC1B,cAAc,UAAU,KAAA,IACrB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,OAAO,OAAO;KAC1B,GAAI,OAAO,sBAAsB,UAAU;KAC3C,YAAY,WAAW;IACzB,CAAC;IAED,MAAM,qBAAqB,OAAO,SAChC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,kBAAkB,OAAO,SAC7B,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;IAEA,MAAM,uBAAuB,OAAO,6BAClC,SACA,cAAc,MACd,MAAM,iBAAiB,gBACzB;IAEA,IACE,yBAAyB,MAAM,iBAAiB,oBAC/C,MAAM,eAAe,KAAA,KACpB,uBAAuB,MAAM,WAAW,oBAE1C,OAAO,OAAO,YAAY;IAE5B,OAAO,OAAO,MACZ,UACA,SACA,eACA,OAAO,IAAI,aAAa;KACtB,MAAM,UAAU,OAAO;KAEvB,IAAI,CAAC,+BAA+B,KAAK,GAAG,OAAO,QAAQ,YAAY,OAAO;KAE9E,MAAM,YAAY,OAAO,0BACvB,SACA,eACA,OACA,gBACF;KAEA,IAAI,cAAc,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;KAC/D,KAAK,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,WAAW,IAAI,EAAA,CAAG,QACzE,OAAO,QAAQ,YAAY,OAAO;KAQpC,IAAI,EAAC,OANkB,0BACrB,SACA,OACA,UAAU,eACZ,IAEc,OAAO,QAAQ,YAAY,OAAO;KAChD,IAAI;KAEJ,OAAO,oBACL,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MAAM,YACN,OAAO,IAAI,aAAa;MACtB,MAAM,YAAY;OAChB;OACA;OACA;MACF;MAEA,MAAM,UAAU,OAAO,iBACrB,SACA,OACA,UAAU,iBACV,WACA,UAAU,GACZ;MAEA,IAAI,SACF,OAAO,oBACL,SACA,OACA,UAAU,iBACV,WACA,UAAU,GACZ;MAEF,OAAO;KACT,CAAC,IACA,aAAa;MACZ,kBAAkB,QAChB,aAAa,cAAc,YAAY,YACvC,OACF;MAEA,OAAO;KACT,CACF;KAEA,OAAO,mBAAmB,QAAQ,YAAY,OAAO;IACvD,CAAC,CACH;GACF,CAAC,EAAA,CACH,KACA,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACJ,CAAC;CACH,CAAC;CAED,MAAM,4BAA4B,OAAO,GAAG,2CAA2C,CAAC,CACtF,WAAW,SAAkB,OAA8B,iBAA0B;EACnF,IAAI,MAAM,eAAe,KAAA,GAAW,OAAO;EAE3C,MAAM,OAAO,OAAO,uBAClB,SACA,MAAM,UACN,iBACA,IACF,EAAA,CAAG;EAEH,IAAI,QAAQ,KAAA,GAAW,OAAO;EAE9B,OACE,IAAI,QAAQ,WAAW,kBAAkB,MAAM,WAAW,gBAC1D,IAAI,QAAQ,WAAW,wBAAwB,MAAM,WAAW,sBAChE,IAAI,QAAQ,WAAW,qBAAqB,MAAM,WAAW,mBAC7D,IAAI,QAAQ,WAAW,cAAc,SAAS,MAAM,MAAM,WAAW,QAAQ,KAC7E,IAAI,QAAQ,WAAW,mBAAmB,MAAM,WAAW,iBAC3D,MAAM,cAAc,UAAU,uBAAuB,MAAM,WAAW;CAE1E,CACF;CAEA,MAAM,uBAAuB,OAAO,GAAG,sCAAsC,CAAC,CAAC,WAC7E,SACA,OACA,iBACA,WAMA,KACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO,GACjC,IAAI,eAAe,OAAO;EAE5B,MAAM,cAAc,OAAO,SACxB,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,WAAW,eAAe,GAC/B,GAAG,EAAE,cAAc,UAAU,YAAY,GACzC,GAAG,EAAE,oBAAoB,UAAU,kBAAkB,GACrD,GAAG,EAAE,iBAAiB,UAAU,eAAe,GAC/C,GAAG,EAAE,UAAU,SAAS,MAAM,MAAM,YAAY,QAAQ,CAAC,GACzD,GAAG,EAAE,eAAe,MAAM,YAAY,aAAa,CACrD,CACF,CAAC,CACA,MAAM,CAAC,EAAA,CAAG;EAEb,MAAM,WAAW,OAAO,SACrB,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,IAAI,GAAG,EAAE,IAAI,eAAe,GAAG,GAAG,EAAE,kBAAkB,UAAU,oBAAoB,CAAC,CAAC,CAAC,CAC7F,MAAM,CAAC,EAAA,CAAG;EAEb,MAAM,uBAAuB,OAAO,SACjC,OAAO,CAAC,CACR,KAAK,QAAQ,oBAAoB,KAAK,CAAC,CACvC,MACC,IACE,GAAG,2BAA2B,OAAO,CAAC,CAAC,WAAW,eAAe,GACjE,GAAG,2BAA2B,OAAO,CAAC,CAAC,cAAc,UAAU,YAAY,GAC3E,GAAG,2BAA2B,OAAO,CAAC,CAAC,UAAU,UAAU,kBAAkB,CAC/E,CACF,CAAC,CACA,MAAM,CAAC,EAAA,CAAG;EAGb,OACE,eAAe,KAAA,KACf,WAAW,QAAQ,WAAW,kBAAkB,UAAU,gBAC1D,WAAW,QAAQ,WAAW,wBAAwB,UAAU,sBAChE,WAAW,QAAQ,WAAW,qBAAqB,UAAU,mBAC7D,WAAW,QAAQ,WAAW,cAAc,SAAS,MAAM,MAAM,YAAY,QAAQ,KACrF,WAAW,QAAQ,WAAW,mBAAmB,MAAM,YAAY,kBAClE,OAAO,uBACN,SACA,OACA,iBACA,SACA,qBACA,GACF;CAEJ,CAAC;CAED,MAAM,mBAAmB,OAAO,GAAG,kCAAkC,CAAC,CAAC,WACrE,SACA,OACA,iBACA,WAKA,KACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EACnC,MAAM,IAAI,eAAe,OAAO;EAEhC,OAAO,SACJ,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,IACC,QAAQ,WAAW,kBAAkB;GACnC,aAAa,MAAM;GACnB,oBAAoB,UAAU;GAC9B,iBAAiB,UAAU;EAC7B,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,WAAW,eAAe,GAC/B,GAAG,EAAE,cAAc,MAAM,WAAY,YAAY,GACjD,GAAG,EAAE,oBAAoB,MAAM,WAAY,kBAAkB,GAC7D,GAAG,EAAE,iBAAiB,MAAM,WAAY,eAAe,GACvD,GAAG,EAAE,UAAU,SAAS,MAAM,MAAM,WAAY,QAAQ,CAAC,GACzD,GAAG,EAAE,eAAe,MAAM,WAAY,aAAa,CACrD,CACF;EACF,OAAO,SACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,IAAI,aAAa,CAAC,CAAC,QAAQ,QAAQ,kBAAkB,UAAU,oBAAoB,CAAC,CAAC,CAAC,CAAC,CACvF,MACC,IACE,GAAG,EAAE,IAAI,eAAe,GACxB,GAAG,EAAE,kBAAkB,MAAM,iBAAiB,gBAAgB,CAChE,CACF;EACF,OAAO,SACJ,OAAO,QAAQ,oBAAoB,KAAK,CAAC,CACzC,IAAI,QAAQ,oBAAoB,eAAe,UAAU,kBAAkB,CAAC,CAAC,CAC7E,MACC,IACE,GAAG,2BAA2B,OAAO,CAAC,CAAC,WAAW,eAAe,GACjE,GAAG,2BAA2B,OAAO,CAAC,CAAC,cAAc,MAAM,WAAY,YAAY,GACnF,GAAG,2BAA2B,OAAO,CAAC,CAAC,UAAU,MAAM,WAAY,kBAAkB,CACvF,CACF;EACF,OAAO,cAAc,SAAS,OAAO,MAAM,cAAc,UAAU,QAAQ,GAAG;EAE9E,OAAO,OAAO,qBACZ,SACA,OACA,iBACA;GACE,GAAG;GACH,cAAc,MAAM,WAAY;EAClC,GACA,GACF;CACF,CAAC;CAED,MAAM,uBACJ,SACA,OACA,iBACA,WAKA,QAEA,cACE,qBACE,SACA,OACA,iBACA;EAAE,GAAG;EAAW,cAAc,MAAM,WAAY;CAAa,GAC7D,GACF,CACF;CAEF,MAAM,YAAY,OAAO,GAAG,mBAAmB,CAAC,CAAC,WAC/C,SACA,eACA,OACA,QACA,WAKA,SACA;EACA,MAAM,UAAU,OAAO;EAEvB,MAAM,YAAY,OAAO,0BAA0B,SAAS,eAAe,OAAO,MAAM;EAExF,IAAI,cAAc,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;EAC/D,KAAK,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,WAAW,IAAI,EAAA,CAAG,QACzE,OAAO,QAAQ,YAAY,OAAO;EACpC,IAAI,EAAE,OAAO,0BAA0B,SAAS,OAAO,UAAU,eAAe,IAC9E,OAAO,QAAQ,YAAY,OAAO;EACpC,MAAM,WAAW,QAAQ,WAAW,OAAO;EAE3C,IACE,EAAE,OAAO,iBACP,SACA,OACA,UAAU,iBACV,WACA,UAAU,GACZ,IAEA,OAAO,OAAO,YAAY;EAC5B,OAAO,oBAAoB,SAAS,OAAO,UAAU,iBAAiB,WAAW,UAAU,GAAG;EAE9F,OAAO;CACT,CAAC;CA4BD,OAAO;EAAE;EAA4B,mBAAA;GAxBnC;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA,wBAAA;GACA;GACA;GACA;GACA;GACA;EAGmD;CAAE;AACzD"}

package/dist/internal/phone-kernel.d.mts

@@ -1,162 +0,0 @@
-import { Observation, Row, TransactionOwner, makeTransactionKernel } from "./transaction-kernel.mjs";
-import { QueryOperations, SqlColumn, SqlFragment } from "./query-operations.mjs";
-import { Context, Effect, Option } from "effect";
-import { SubjectId } from "@yielded/auth/Schema";
-import { PhoneMutation, PhoneOtpUnavailable } from "@yielded/auth/PhoneOtp";
-//#region src/internal/phone-kernel.d.ts
-declare const CurrentPhoneTransaction_base: Context.ServiceClass<CurrentPhoneTransaction, "effect-auth/drizzle/CurrentPhoneTransaction", TransactionOwner<PhoneOtpUnavailable>>;
-export declare class CurrentPhoneTransaction extends CurrentPhoneTransaction_base {}
-export declare const makePhoneKernel: <Fragment extends SqlFragment = SqlFragment, Column extends SqlColumn = SqlColumn>(operations: QueryOperations<Fragment, Column>, transactions: Pick<ReturnType<typeof makeTransactionKernel>, "both" | "makeTransactionRows">) => {
-  unavailable: () => PhoneOtpUnavailable;
-  invariant: (value: unknown) => asserts value;
-  equal: (table: object, values: Row) => SqlFragment;
-  copiedRow: (row: Row) => Row;
-  col: (table: object, key: string) => SqlColumn;
-  capturePhone: (mapping: any, input: {
-    readonly action: "register" | "verify" | "change";
-    readonly phoneNumber: any;
-    readonly subjectId?: SubjectId;
-    readonly sourcePhoneNumber?: any;
-  }) => Effect.Effect<{
-    target: {
-      readonly phoneNumber: string;
-      readonly custody: {
-        readonly phoneNumber: string;
-        readonly custodyRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        readonly credentialRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        readonly verifiedAtMillis: number | null;
-        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-        readonly credentialId: string;
-        readonly state: "retired" | "unverified" | "verified";
-      } | null;
-      readonly revision: {
-        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        readonly credentials: readonly {
-          readonly credentialId: string;
-          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        }[];
-      } | null;
-      readonly source: {
-        readonly phoneNumber: string;
-        readonly custodyRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        readonly credentialRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        readonly verifiedAtMillis: number | null;
-        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-        readonly credentialId: string;
-        readonly state: "retired" | "unverified" | "verified";
-      } | null;
-      readonly eligible: boolean;
-    };
-    destination: {
-      key: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-      observation: Observation;
-      custody: {
-        readonly phoneNumber: string;
-        readonly custodyRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        readonly credentialRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        readonly verifiedAtMillis: number | null;
-        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-        readonly credentialId: string;
-        readonly state: "retired" | "unverified" | "verified";
-      } | null;
-    };
-    source: {
-      key: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-      observation: Observation;
-      custody: {
-        readonly phoneNumber: string;
-        readonly custodyRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        readonly credentialRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        readonly verifiedAtMillis: number | null;
-        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-        readonly credentialId: string;
-        readonly state: "retired" | "unverified" | "verified";
-      } | null;
-    } | null;
-    subject: Observation | null;
-    subjectRow: Row | undefined;
-    targetIdentifier: Observation;
-  }, PhoneOtpUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPhoneTransaction>;
-  lookupPhone: (mapping: any, input: {
-    readonly moduleId: string;
-    readonly phoneNumber: any;
-  }) => Effect.Effect<Option.None<{
-    readonly moduleId: string;
-    readonly phoneNumber: string;
-    readonly custodyRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-    readonly verifiedAtMillis: number;
-    readonly credentialId: string;
-    readonly credentialRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-    readonly revision: {
-      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      readonly credentials: readonly {
-        readonly credentialId: string;
-        readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      }[];
-    };
-  }> | Option.Some<{
-    readonly moduleId: string;
-    readonly phoneNumber: string;
-    readonly custodyRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-    readonly verifiedAtMillis: number;
-    readonly credentialId: string;
-    readonly credentialRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-    readonly revision: {
-      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      readonly credentials: readonly {
-        readonly credentialId: string;
-        readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      }[];
-    };
-  }>, PhoneOtpUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPhoneTransaction>;
-  admitPhone: (mapping: any, input: {
-    readonly moduleId: string;
-    readonly action: "request" | "attempt";
-    readonly requestId: string;
-    readonly fingerprint: string;
-    readonly networkKey: string;
-    readonly replayLifetimeMillis: number;
-  }) => Effect.Effect<boolean, PhoneOtpUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPhoneTransaction>;
-  preparePhoneMutation: (mapping: any, input: PhoneMutation) => Effect.Effect<{
-    decision: {
-      readonly _tag: "Rejected";
-    };
-    mutate?: never;
-    appliedCondition?: never;
-  } | {
-    decision: {
-      readonly _tag: "Accepted";
-      readonly credential: {
-        readonly moduleId: string;
-        readonly phoneNumber: string;
-        readonly custodyRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        readonly verifiedAtMillis: number;
-        readonly credentialId: string;
-        readonly credentialRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        readonly revision: {
-          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          readonly credentials: readonly {
-            readonly credentialId: string;
-            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          }[];
-        };
-      };
-    };
-    mutate: Effect.Effect<boolean, PhoneOtpUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPhoneTransaction>;
-    appliedCondition: Fragment;
-  }, PhoneOtpUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPhoneTransaction>;
-  cleanupPhoneAdmission: (mapping: any, input: {
-    readonly moduleId: string;
-    readonly limit: number;
-    readonly after?: string;
-  }) => Effect.Effect<{
-    deleted: number;
-    nextCursor: string | null;
-  }, PhoneOtpUnavailable, CurrentPhoneTransaction>;
-};
-//#endregion
-//# sourceMappingURL=phone-kernel.d.mts.map