@yielded/auth-persistence 0.1.0-beta.7

package/dist/internal/email-kernel.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-kernel.mjs","names":[],"sources":["../../src/internal/email-kernel.ts"],"sourcesContent":["import {\n  EmailAddressPersistence,\n  type EmailAddressMutation,\n  type EmailAction,\n  type EmailCredentialSnapshot,\n  EmailSignInTargets,\n  EmailUnavailable,\n  snapshotEmailCredential,\n  snapshotEmailRequirement,\n  snapshotEmailRevision,\n} from \"@yielded/auth/Email\";\nimport {\n  coordinateCommit,\n  CurrentCommitJournal,\n  hasCommitScope,\n  type CommitJournal,\n  type PreparedCommit,\n  LifecycleHooks,\n  HookConfigurationError,\n} from \"@yielded/auth/Hooks\";\nimport type { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport { reportPersistenceFailure } from \"@yielded/auth/Persistence\";\nimport {\n  ProofUnavailable,\n  type ProofCompletionDecision,\n  type ProofCompletionInput,\n} from \"@yielded/auth/Proofs\";\nimport {\n  assessAuthentication,\n  snapshotAuthenticationEvidence,\n  type AuthenticationRevision,\n  type SecurityRevision,\n} from \"@yielded/auth/Sessions\";\n/* oxlint-disable no-explicit-any -- the shared dialect kernel erases consumer Drizzle table types internally. */\nimport type { sql } from \"drizzle-orm\";\nimport type { EffectDrizzleQueryError } from \"drizzle-orm/effect-core\";\nimport { Cause, Context, DateTime, Effect, Option, Schema } from \"effect\";\nimport type * as SqlError from \"effect/unstable/sql/SqlError\";\n\nimport {\n  type AnyEmailAddressMapping,\n  type AnyEmailSignInMapping,\n  requiredEmailAddressConstraints,\n  requiredEmailSignInConstraints,\n} from \"../drizzle/email-model\";\nimport { isMappedConstraintConflict, PersistenceMappingError } from \"./mapping-error\";\nimport {\n  CurrentProofSql,\n  type makeProofKernel,\n  type ProofSqlConfiguration,\n  type ProofSqlDatabase,\n} from \"./proof-kernel\";\nimport type { QueryOperations } from \"./query-operations\";\n\ntype AdapterFailure = EffectDrizzleQueryError | PersistenceMappingError | SqlError.SqlError;\ntype SignInMapping = AnyEmailSignInMapping;\ntype AddressMapping = AnyEmailAddressMapping;\n\nexport interface EmailSqlQuery<A = ReadonlyArray<any>> extends Effect.Effect<A, AdapterFailure> {\n  readonly getSQL: () => ReturnType<typeof sql>;\n  readonly from: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly where: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly limit: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly orderBy: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly for: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly set: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly values: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly returning: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly innerJoin: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly onConflictDoNothing: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly onDuplicateKeyUpdate: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly $returningId: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n}\n\nexport interface EmailSqlDatabase {\n  readonly select: (...args: ReadonlyArray<any>) => EmailSqlQuery;\n  readonly insert: (...args: ReadonlyArray<any>) => EmailSqlQuery;\n  readonly update: (...args: ReadonlyArray<any>) => EmailSqlQuery;\n  readonly delete: (...args: ReadonlyArray<any>) => EmailSqlQuery;\n  readonly transaction: <A, E, R>(\n    body: (transaction: EmailSqlDatabase) => Effect.Effect<A, E, R>,\n  ) => Effect.Effect<A, E | SqlError.SqlError, R>;\n}\n\nexport class CurrentEmailSql extends Context.Service<CurrentEmailSql, EmailSqlDatabase>()(\n  \"effect-auth/CurrentEmailSql\",\n) {}\n\nexport interface EmailSqlConfiguration {\n  readonly mode: \"interactive\" | \"synchronous\";\n  readonly locking: boolean;\n  readonly standaloneGuard: Effect.Effect<void, EmailUnavailable>;\n  readonly coordinated?: boolean;\n  readonly proof?: {\n    readonly mapping: any;\n    readonly configuration: ProofSqlConfiguration;\n  };\n}\n\nexport interface CurrentAddress {\n  readonly nativeSubjectId: unknown;\n  readonly subject: any;\n  readonly revision: AuthenticationRevision;\n  readonly source?: {\n    readonly credential: any;\n    readonly identifier: any;\n    readonly snapshot: EmailCredentialSnapshot;\n  };\n  readonly targetIdentifier?: any;\n  readonly targetCredential?: any;\n  readonly targetIdentifierRevision?: SecurityRevision;\n  readonly eligible: boolean;\n}\n\nexport const makeEmailKernel = (\n  operations: QueryOperations,\n  proofs: Pick<ReturnType<typeof makeProofKernel>, \"completeProofPlanIn\">,\n) => {\n  const { and, eq, inArray, lte, column, updateValues } = operations;\n  const { completeProofPlanIn } = proofs;\n  const unavailable = () => EmailUnavailable.make({});\n\n  const translateFailure = <A, E, R>(\n    effect: Effect.Effect<A, E, R>,\n  ): Effect.Effect<A, EmailUnavailable, R> =>\n    reportPersistenceFailure(\n      effect,\n      (error) =>\n        Schema.is(EmailUnavailable)(error) ||\n        Schema.is(ProofUnavailable)(error) ||\n        Schema.is(HookConfigurationError)(error),\n    ).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));\n\n  const nowMillis = Effect.map(DateTime.now, DateTime.toEpochMillis);\n\n  const selectRows = (query: EmailSqlQuery, locking: boolean) =>\n    locking && typeof query.for === \"function\" ? query.for(\"update\") : query;\n\n  const sameIdentifier = (left: LoginIdentifier, right: LoginIdentifier) =>\n    left.namespace === right.namespace && left.value === right.value;\n\n  const validEmailSignInConstraints = (mapping: SignInMapping) =>\n    Object.entries(requiredEmailSignInConstraints).every(\n      ([key, value]) =>\n        mapping.constraints[key as keyof typeof requiredEmailSignInConstraints] === value,\n    );\n\n  const validAddressConstraints = (mapping: AddressMapping) =>\n    Object.entries(requiredEmailAddressConstraints).every(\n      ([key, value]) =>\n        mapping.constraints[key as keyof typeof requiredEmailAddressConstraints] === value,\n    );\n\n  const subjectColumns = (mapping: SignInMapping) => ({\n    id: column(mapping.subject.table, mapping.subject.id),\n    status: column(mapping.subject.table, mapping.subject.status),\n    securityRevision: column(mapping.subject.table, mapping.subject.securityRevision),\n  });\n\n  const identifierColumns = (mapping: SignInMapping) => ({\n    namespace: column(mapping.identifier.table, mapping.identifier.namespace),\n    value: column(mapping.identifier.table, mapping.identifier.value),\n    subjectId: column(mapping.identifier.table, mapping.identifier.subjectId),\n    verifiedAt: column(mapping.identifier.table, mapping.identifier.verifiedAt),\n    bindingRevision: column(mapping.identifier.table, mapping.identifier.bindingRevision),\n  });\n\n  const credentialColumns = (mapping: SignInMapping) => ({\n    moduleId: column(mapping.credential.table, mapping.credential.moduleId),\n    subjectId: column(mapping.credential.table, mapping.credential.subjectId),\n    credentialId: column(mapping.credential.table, mapping.credential.credentialId),\n    identifierNamespace: column(mapping.credential.table, mapping.credential.identifierNamespace),\n    identifierValue: column(mapping.credential.table, mapping.credential.identifierValue),\n    credentialRevision: column(mapping.credential.table, mapping.credential.credentialRevision),\n    status: column(mapping.credential.table, mapping.credential.status),\n  });\n\n  const authorityColumns = (mapping: AddressMapping) => ({\n    subjectId: column(mapping.authorityCredential.table, mapping.authorityCredential.subjectId),\n    credentialId: column(\n      mapping.authorityCredential.table,\n      mapping.authorityCredential.credentialId,\n    ),\n    revision: column(mapping.authorityCredential.table, mapping.authorityCredential.revision),\n    status: column(mapping.authorityCredential.table, mapping.authorityCredential.status),\n  });\n\n  const commandColumns = (mapping: AddressMapping) => ({\n    moduleId: column(mapping.command.table, mapping.command.moduleId),\n    commandId: column(mapping.command.table, mapping.command.commandId),\n    action: column(mapping.command.table, mapping.command.action),\n    bindingDigest: column(mapping.command.table, mapping.command.bindingDigest),\n    retentionUntil: column(mapping.command.table, mapping.command.retentionUntil),\n  });\n\n  const allocate = <A>(\n    mode: EmailSqlConfiguration[\"mode\"],\n    asynchronous: Effect.Effect<A, PersistenceMappingError> | undefined,\n    synchronous: (() => A) | undefined,\n  ) => {\n    if (mode === \"synchronous\")\n      return synchronous === undefined\n        ? Effect.fail(unavailable())\n        : Effect.try({\n            try: synchronous,\n            catch: (cause) => new PersistenceMappingError({ operation: \"mapping\", cause }),\n          });\n    if (asynchronous !== undefined) return asynchronous;\n\n    return synchronous === undefined\n      ? Effect.fail(unavailable())\n      : Effect.try({\n          try: synchronous,\n          catch: (cause) => new PersistenceMappingError({ operation: \"mapping\", cause }),\n        });\n  };\n\n  const nextSecurityRevision = (\n    mapping: AddressMapping,\n    mode: EmailSqlConfiguration[\"mode\"],\n    current: SecurityRevision,\n  ) => {\n    if (mode === \"synchronous\")\n      return mapping.subject.nextSecurityRevisionSync === undefined\n        ? Effect.fail(unavailable())\n        : Effect.try({\n            try: () => mapping.subject.nextSecurityRevisionSync!(current),\n            catch: (cause) => new PersistenceMappingError({ operation: \"mapping\", cause }),\n          });\n    if (mapping.subject.nextSecurityRevision !== undefined)\n      return mapping.subject.nextSecurityRevision(current);\n    if (mapping.subject.nextSecurityRevisionSync !== undefined)\n      return Effect.try({\n        try: () => mapping.subject.nextSecurityRevisionSync!(current),\n        catch: (cause) => new PersistenceMappingError({ operation: \"mapping\", cause }),\n      });\n\n    return Effect.fail(unavailable());\n  };\n\n  const safeRead = <A, E, R>(\n    database: EmailSqlDatabase,\n    configuration: EmailSqlConfiguration,\n    body: Effect.Effect<A, E, R>,\n  ) =>\n    Effect.gen(function* () {\n      if (configuration.coordinated !== true) {\n        if (yield* hasCommitScope) return yield* unavailable();\n        yield* configuration.standaloneGuard;\n      }\n\n      return yield* database.transaction((transaction) =>\n        body.pipe(\n          Effect.provideService(CurrentEmailSql, transaction),\n          Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),\n        ),\n      );\n    });\n\n  const owned = <A, E, R>(\n    database: EmailSqlDatabase,\n    configuration: EmailSqlConfiguration,\n    body: Effect.Effect<A, E, R>,\n  ) => {\n    const run = coordinateCommit(\n      () =>\n        database.transaction((transaction) =>\n          body.pipe(\n            Effect.provideService(CurrentEmailSql, transaction),\n            Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),\n          ),\n        ),\n      { mode: configuration.mode },\n    ).pipe(Effect.map((result) => result.value));\n\n    return configuration.coordinated !== true\n      ? Effect.gen(function* () {\n          if (yield* hasCommitScope) return yield* unavailable();\n          yield* configuration.standaloneGuard;\n\n          return yield* run;\n        })\n      : run;\n  };\n\n  const emailLookupQuery = (\n    mapping: SignInMapping,\n    moduleId: string,\n    identifier: LoginIdentifier,\n  ) => {\n    const subject = subjectColumns(mapping),\n      binding = identifierColumns(mapping),\n      credential = credentialColumns(mapping);\n\n    return {\n      fields: {\n        subject: mapping.subject.table,\n        identifier: mapping.identifier.table,\n        credential: mapping.credential.table,\n      },\n      from: mapping.identifier.table,\n      subjectTable: mapping.subject.table,\n      subjectJoin: eq(subject.id, binding.subjectId),\n      credentialTable: mapping.credential.table,\n      credentialJoin: and(\n        eq(credential.moduleId, moduleId),\n        eq(credential.subjectId, binding.subjectId),\n        eq(credential.identifierNamespace, binding.namespace),\n        eq(credential.identifierValue, binding.value),\n      ),\n      predicate: and(\n        eq(binding.namespace, identifier.namespace),\n        eq(binding.value, identifier.value),\n      ),\n      limit: 1,\n    };\n  };\n\n  const emailLookupRows = Effect.fn(\"Drizzle.emailLookupRows\")(function* (\n    mapping: SignInMapping,\n    moduleId: string,\n    identifier: LoginIdentifier,\n  ) {\n    const database = yield* CurrentEmailSql;\n    const query = emailLookupQuery(mapping, moduleId, identifier);\n\n    return yield* database\n      .select(query.fields)\n      .from(query.from)\n      .innerJoin(query.subjectTable, query.subjectJoin)\n      .innerJoin(query.credentialTable, query.credentialJoin)\n      .where(query.predicate)\n      .limit(query.limit);\n  });\n\n  const decodeEmailSnapshot = Effect.fn(\"DrizzleEmail.decodeSnapshot\")(function* (\n    mapping: SignInMapping,\n    moduleId: string,\n    requested: LoginIdentifier,\n    row: any,\n  ) {\n    if (\n      !mapping.subject.isActiveStatus(row.subject[mapping.subject.status]) ||\n      !mapping.identifier.isCurrent(row.identifier) ||\n      !mapping.credential.isActiveStatus(row.credential[mapping.credential.status])\n    )\n      return undefined;\n\n    const snapshot = yield* mapping.credential\n      .decode({\n        moduleId,\n        subject: row.subject,\n        identifier: row.identifier,\n        credential: row.credential,\n      })\n      .pipe(Effect.flatMap(snapshotEmailCredential));\n\n    const subjectId = yield* mapping.subjectId.toSubject(row.subject[mapping.subject.id]);\n\n    const verifiedAtMillis = yield* mapping.decodeInstant(\n      row.identifier[mapping.identifier.verifiedAt],\n    );\n\n    if (\n      snapshot.moduleId !== moduleId ||\n      !sameIdentifier(snapshot.identifier, requested) ||\n      snapshot.revision.subjectId !== subjectId ||\n      snapshot.revision.securityRevision !== row.subject[mapping.subject.securityRevision] ||\n      snapshot.identifierRevision !== row.identifier[mapping.identifier.bindingRevision] ||\n      snapshot.verifiedAtMillis !== verifiedAtMillis ||\n      snapshot.credentialId !== row.credential[mapping.credential.credentialId] ||\n      snapshot.credentialRevision !== row.credential[mapping.credential.credentialRevision]\n    )\n      return undefined;\n\n    return snapshot;\n  });\n\n  const makeSqlEmailSignInTargets = Effect.fn(\"makeSqlEmailSignInTargets\")(function (\n    database: EmailSqlDatabase,\n    mapping: SignInMapping,\n    configuration: EmailSqlConfiguration,\n  ): Effect.Effect<EmailSignInTargets[\"Service\"]> {\n    return Effect.succeed(\n      EmailSignInTargets.of({\n        lookup: (input) =>\n          (validEmailSignInConstraints(mapping)\n            ? safeRead(\n                database,\n                configuration,\n                Effect.gen(function* () {\n                  const row = (yield* emailLookupRows(\n                    mapping,\n                    input.moduleId,\n                    input.identifier,\n                  ))[0];\n\n                  if (row === undefined) return Option.none();\n\n                  const snapshot = yield* decodeEmailSnapshot(\n                    mapping,\n                    input.moduleId,\n                    input.identifier,\n                    row,\n                  );\n\n                  return snapshot === undefined ? Option.none() : Option.some(snapshot);\n                }),\n              )\n            : Effect.fail(unavailable())\n          ).pipe(Effect.provideService(CurrentEmailSql, database), translateFailure),\n      }),\n    );\n  });\n\n  const readSubject = Effect.fn(\"DrizzleEmail.readSubject\")(function* (\n    mapping: AddressMapping,\n    subjectId: string,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentEmailSql;\n\n    const nativeSubjectId = yield* mapping.subjectId.toNative(subjectId as any);\n    const s = subjectColumns(mapping);\n\n    const subject = (yield* selectRows(\n      database.select().from(mapping.subject.table).where(eq(s.id, nativeSubjectId)).limit(1),\n      locking,\n    ))[0];\n\n    return { nativeSubjectId, subject };\n  });\n\n  const identifierRow = Effect.fn(\"Drizzle.identifierRow\")(function* (\n    mapping: SignInMapping,\n    identifier: LoginIdentifier,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentEmailSql;\n\n    const i = identifierColumns(mapping);\n\n    return yield* selectRows(\n      database\n        .select()\n        .from(mapping.identifier.table)\n        .where(and(eq(i.namespace, identifier.namespace), eq(i.value, identifier.value)))\n        .limit(1),\n      locking,\n    );\n  });\n\n  const credentialById = Effect.fn(\"Drizzle.credentialById\")(function* (\n    mapping: SignInMapping,\n    moduleId: string,\n    credentialId: string,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentEmailSql;\n\n    const c = credentialColumns(mapping);\n\n    return yield* selectRows(\n      database\n        .select()\n        .from(mapping.credential.table)\n        .where(and(eq(c.moduleId, moduleId), eq(c.credentialId, credentialId)))\n        .limit(1),\n      locking,\n    );\n  });\n\n  const credentialByIdentifier = Effect.fn(\"Drizzle.credentialByIdentifier\")(function* (\n    mapping: SignInMapping,\n    moduleId: string,\n    identifier: LoginIdentifier,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentEmailSql;\n\n    const c = credentialColumns(mapping);\n\n    return yield* selectRows(\n      database\n        .select()\n        .from(mapping.credential.table)\n        .where(\n          and(\n            eq(c.moduleId, moduleId),\n            eq(c.identifierNamespace, identifier.namespace),\n            eq(c.identifierValue, identifier.value),\n          ),\n        )\n        .limit(1),\n      locking,\n    );\n  });\n\n  const currentAddress = Effect.fn(\"DrizzleEmail.currentAddress\")(function* (\n    mapping: AddressMapping,\n    input: {\n      readonly moduleId: string;\n      readonly subjectId: string;\n      readonly target: LoginIdentifier;\n      readonly sourceCredentialId?: string;\n    },\n    locking: boolean,\n  ) {\n    const database = yield* CurrentEmailSql;\n\n    const locked = yield* readSubject(mapping, input.subjectId, locking);\n\n    if (\n      locked.subject === undefined ||\n      !mapping.subject.isActiveStatus(locked.subject[mapping.subject.status])\n    )\n      return undefined;\n\n    const discoveredSource =\n      input.sourceCredentialId === undefined\n        ? undefined\n        : (yield* credentialById(mapping, input.moduleId, input.sourceCredentialId, false))[0];\n\n    const sourceIdentifier: LoginIdentifier | undefined =\n      discoveredSource === undefined\n        ? undefined\n        : {\n            namespace: discoveredSource[mapping.credential.identifierNamespace],\n            value: discoveredSource[mapping.credential.identifierValue],\n          };\n\n    const identifiers = [\n      input.target,\n      ...(sourceIdentifier === undefined ? [] : [sourceIdentifier]),\n    ]\n      .filter(\n        (value, index, values) =>\n          values.findIndex((candidate) => sameIdentifier(candidate, value)) === index,\n      )\n      .sort((left, right) =>\n        `${left.namespace}\\u0000${left.value}`.localeCompare(\n          `${right.namespace}\\u0000${right.value}`,\n        ),\n      );\n\n    const lockedIdentifiers = new Map<string, any>();\n\n    for (const identifier of identifiers) {\n      const row = (yield* identifierRow(mapping, identifier, locking))[0];\n\n      if (row !== undefined)\n        lockedIdentifiers.set(`${identifier.namespace}\\u0000${identifier.value}`, row);\n    }\n\n    const sourceCredential =\n      input.sourceCredentialId === undefined\n        ? undefined\n        : (yield* credentialById(mapping, input.moduleId, input.sourceCredentialId, locking))[0];\n\n    const targetCredential = (yield* credentialByIdentifier(\n      mapping,\n      input.moduleId,\n      input.target,\n      locking,\n    ))[0];\n\n    const a = authorityColumns(mapping);\n\n    const authority = yield* selectRows(\n      database\n        .select()\n        .from(mapping.authorityCredential.table)\n        .where(eq(a.subjectId, locked.nativeSubjectId))\n        .orderBy(a.credentialId),\n      locking,\n    );\n\n    const activeAuthority = authority.filter((row: any) =>\n      mapping.authorityCredential.isActiveStatus(row[mapping.authorityCredential.status]),\n    );\n\n    const subjectId = yield* mapping.subjectId.toSubject(locked.nativeSubjectId);\n\n    const revision: AuthenticationRevision = Object.freeze({\n      subjectId,\n      securityRevision: locked.subject[mapping.subject.securityRevision],\n      credentials: Object.freeze(\n        activeAuthority.map((row: any) =>\n          Object.freeze({\n            credentialId: row[mapping.authorityCredential.credentialId],\n            revision: row[mapping.authorityCredential.revision],\n          }),\n        ),\n      ),\n    });\n\n    const targetIdentifier = lockedIdentifiers.get(\n      `${input.target.namespace}\\u0000${input.target.value}`,\n    );\n\n    const targetOwned =\n      targetIdentifier !== undefined &&\n      mapping.subjectId.equals(\n        targetIdentifier[mapping.identifier.subjectId],\n        locked.nativeSubjectId,\n      );\n\n    const targetMutable =\n      targetOwned &&\n      mapping.identifier.isMutableTarget(targetIdentifier) &&\n      (targetCredential === undefined ||\n        (!mapping.credential.isActiveStatus(targetCredential[mapping.credential.status]) &&\n          mapping.subjectId.equals(\n            targetCredential[mapping.credential.subjectId],\n            locked.nativeSubjectId,\n          )));\n\n    let source: CurrentAddress[\"source\"];\n\n    if (input.sourceCredentialId !== undefined) {\n      if (\n        sourceCredential === undefined ||\n        sourceIdentifier === undefined ||\n        !mapping.subjectId.equals(\n          sourceCredential[mapping.credential.subjectId],\n          locked.nativeSubjectId,\n        ) ||\n        !mapping.credential.isActiveStatus(sourceCredential[mapping.credential.status])\n      )\n        return undefined;\n\n      const sourceIdentifierRow = lockedIdentifiers.get(\n        `${sourceIdentifier.namespace}\\u0000${sourceIdentifier.value}`,\n      );\n\n      if (\n        sourceIdentifierRow === undefined ||\n        !mapping.identifier.isCurrent(sourceIdentifierRow) ||\n        !mapping.subjectId.equals(\n          sourceIdentifierRow[mapping.identifier.subjectId],\n          locked.nativeSubjectId,\n        )\n      )\n        return undefined;\n\n      const snapshot = yield* mapping.credential\n        .decode({\n          moduleId: input.moduleId,\n          subject: locked.subject,\n          identifier: sourceIdentifierRow,\n          credential: sourceCredential,\n        })\n        .pipe(Effect.flatMap(snapshotEmailCredential));\n\n      source = { credential: sourceCredential, identifier: sourceIdentifierRow, snapshot };\n    }\n    let eligible = targetIdentifier === undefined ? targetCredential === undefined : targetMutable;\n\n    if (input.sourceCredentialId !== undefined && source === undefined) eligible = false;\n    if (source !== undefined && sameIdentifier(source.snapshot.identifier, input.target))\n      eligible = false;\n    if (mapping.addressCardinality === \"single\" && input.sourceCredentialId === undefined) {\n      const c = credentialColumns(mapping);\n\n      const rows = yield* selectRows(\n        database\n          .select()\n          .from(mapping.credential.table)\n          .where(and(eq(c.moduleId, input.moduleId), eq(c.subjectId, locked.nativeSubjectId))),\n        locking,\n      );\n\n      if (\n        rows.some((row: any) => mapping.credential.isActiveStatus(row[mapping.credential.status]))\n      )\n        eligible = false;\n    }\n\n    return {\n      nativeSubjectId: locked.nativeSubjectId,\n      subject: locked.subject,\n      revision,\n      ...(source === undefined ? {} : { source }),\n      ...(targetIdentifier === undefined ? {} : { targetIdentifier }),\n      ...(targetCredential === undefined ? {} : { targetCredential }),\n      ...(targetMutable\n        ? { targetIdentifierRevision: targetIdentifier[mapping.identifier.bindingRevision] }\n        : {}),\n      eligible,\n    };\n  });\n\n  const sameEmailRevision = (left: AuthenticationRevision, right: AuthenticationRevision) => {\n    if (\n      left.subjectId !== right.subjectId ||\n      left.securityRevision !== right.securityRevision ||\n      left.credentials.length !== right.credentials.length\n    )\n      return false;\n\n    const expected = [...left.credentials].sort((a, b) =>\n      a.credentialId.localeCompare(b.credentialId),\n    );\n\n    const actual = [...right.credentials].sort((a, b) =>\n      a.credentialId.localeCompare(b.credentialId),\n    );\n\n    return expected.every(\n      (item, index) =>\n        item.credentialId === actual[index]!.credentialId &&\n        item.revision === actual[index]!.revision,\n    );\n  };\n\n  const actionModule = (moduleId: string, action: EmailAction) =>\n    `${moduleId}/${action === \"verify-address\" ? \"verify-address\" : \"change-address\"}`;\n\n  const actionPurpose = (action: EmailAction) =>\n    action === \"verify-address\" ? \"email-address-verification\" : \"email-address-change\";\n\n  const completionMatches = (input: EmailAddressMutation, action: EmailAction) => {\n    const completion = input.completion.input;\n    const binding = completion.binding;\n\n    return (\n      completion.moduleId === actionModule(input.moduleId, action) &&\n      completion.purpose === actionPurpose(action) &&\n      binding._tag === \"IdentifierChange\" &&\n      sameIdentifier(binding.identifier, input.target) &&\n      sameEmailRevision(binding.revision, input.captured.revision)\n    );\n  };\n\n  const snapshotEmailMutation = Effect.fn(\"DrizzleEmail.snapshotMutation\")(function* (\n    input: EmailAddressMutation,\n  ) {\n    const evidence = yield* snapshotAuthenticationEvidence(input.authorization.evidence).pipe(\n      Effect.mapError(unavailable),\n    );\n\n    const requirement = yield* snapshotEmailRequirement(input.authorization.requirement);\n\n    const source =\n      input.captured.source === undefined\n        ? undefined\n        : yield* snapshotEmailCredential(input.captured.source);\n\n    return Object.freeze({\n      ...input,\n      target: Object.freeze({ ...input.target }),\n      ...(input.invalidation === undefined\n        ? {}\n        : { invalidation: Object.freeze({ ...input.invalidation }) }),\n      captured: Object.freeze({\n        eligible: input.captured.eligible,\n        revision: snapshotEmailRevision(input.captured.revision),\n        ...(input.captured.targetIdentifierRevision === undefined\n          ? {}\n          : { targetIdentifierRevision: input.captured.targetIdentifierRevision }),\n        ...(source === undefined ? {} : { source }),\n      }),\n      authorization: Object.freeze({\n        challenge: Object.freeze({\n          ...input.authorization.challenge,\n          target: Object.freeze({ ...input.authorization.challenge.target }),\n          revision: snapshotEmailRevision(input.authorization.challenge.revision),\n        }),\n        evidence,\n        requirement,\n      }),\n    });\n  });\n\n  const validateEmailAuthority = Effect.fn(\"DrizzleEmail.validateAuthority\")(function* (\n    mapping: AddressMapping,\n    configuration: EmailSqlConfiguration,\n    input: EmailAddressMutation,\n    action: EmailAction,\n  ) {\n    const confirmsExisting =\n      action === \"verify-address\" && input.captured.targetIdentifierRevision !== undefined;\n\n    if (\n      !input.captured.eligible ||\n      !completionMatches(input, action) ||\n      input.authorization.challenge.moduleId !== input.moduleId ||\n      input.authorization.challenge.action !== action ||\n      input.authorization.challenge.commandId !== input.commandId ||\n      !sameIdentifier(input.authorization.challenge.target, input.target) ||\n      input.authorization.challenge.sourceCredentialId !== input.captured.source?.credentialId ||\n      !sameEmailRevision(input.authorization.challenge.revision, input.captured.revision) ||\n      input.authorization.challenge.targetIdentifierRevision !==\n        input.captured.targetIdentifierRevision ||\n      (input.authorization.evidence.flowId as string) !== (input.commandId as string) ||\n      input.authorization.evidence.bindingDigest !== input.authorization.challenge.bindingDigest ||\n      !sameEmailRevision(input.authorization.evidence.revision, input.captured.revision) ||\n      (action === \"verify-address\" && input.captured.source !== undefined) ||\n      (action === \"change-address\" && input.captured.source === undefined) ||\n      confirmsExisting !== (input.invalidation === undefined) ||\n      (input.invalidation?.existingSessions === \"immediate\" &&\n        mapping.sessionInvalidation !== \"same-authority-immediate\")\n    )\n      return undefined;\n\n    const current = yield* currentAddress(\n      mapping,\n      {\n        moduleId: input.moduleId,\n        subjectId: input.captured.revision.subjectId,\n        target: input.target,\n        ...(input.captured.source === undefined\n          ? {}\n          : { sourceCredentialId: input.captured.source.credentialId }),\n      },\n      configuration.locking,\n    );\n\n    if (\n      current === undefined ||\n      !current.eligible ||\n      !sameEmailRevision(current.revision, input.captured.revision) ||\n      current.targetIdentifierRevision !== input.captured.targetIdentifierRevision ||\n      (input.captured.source !== undefined &&\n        (current.source === undefined ||\n          current.source.snapshot.identifierRevision !== input.captured.source.identifierRevision ||\n          current.source.snapshot.credentialRevision !== input.captured.source.credentialRevision ||\n          !sameIdentifier(current.source.snapshot.identifier, input.captured.source.identifier)))\n    )\n      return undefined;\n\n    const currentRequirement = yield* mapping.subject.decodeActionRequirement(\n      current.subject,\n      action,\n    );\n\n    const original = yield* assessAuthentication(\n      input.authorization.evidence,\n      input.authorization.requirement,\n    ).pipe(Effect.mapError(unavailable));\n\n    const configured = yield* assessAuthentication(\n      input.authorization.evidence,\n      currentRequirement,\n    ).pipe(Effect.mapError(unavailable));\n\n    return original.satisfied && configured.satisfied ? current : undefined;\n  });\n\n  const commandExists = Effect.fn(\"Drizzle.commandExists\")(function* (\n    mapping: AddressMapping,\n    moduleId: string,\n    commandId: string,\n    locking: boolean,\n  ) {\n    const database = yield* CurrentEmailSql;\n\n    const c = commandColumns(mapping);\n\n    return yield* selectRows(\n      database\n        .select()\n        .from(mapping.command.table)\n        .where(and(eq(c.moduleId, moduleId), eq(c.commandId, commandId)))\n        .limit(1),\n      locking,\n    );\n  });\n\n  const applyMutation = Effect.fn(\"DrizzleEmail.applyMutation\")(function* (\n    mapping: AddressMapping,\n    input: EmailAddressMutation,\n    action: EmailAction,\n    current: CurrentAddress,\n    allocated: {\n      readonly targetCredentialId: string;\n      readonly targetIdentifierRevision: SecurityRevision;\n      readonly targetCredentialRevision: SecurityRevision;\n      readonly sourceIdentifierRevision: SecurityRevision;\n      readonly sourceCredentialRevision: SecurityRevision;\n      readonly nextSecurityRevision: SecurityRevision;\n    },\n    now: number,\n  ) {\n    const database = yield* CurrentEmailSql;\n\n    const i = identifierColumns(mapping);\n    const c = credentialColumns(mapping);\n    const a = authorityColumns(mapping);\n    const s = subjectColumns(mapping);\n\n    const targetCredentialId =\n      current.targetCredential?.[mapping.credential.credentialId] ?? allocated.targetCredentialId;\n\n    if (action === \"change-address\") {\n      const source = current.source!;\n\n      yield* database\n        .update(mapping.identifier.table)\n        .set(\n          mapping.identifier.encodeRetirement({\n            source: source.snapshot.identifier,\n            bindingRevision: allocated.sourceIdentifierRevision,\n          }),\n        )\n        .where(\n          and(\n            eq(i.namespace, source.snapshot.identifier.namespace),\n            eq(i.value, source.snapshot.identifier.value),\n            eq(i.subjectId, current.nativeSubjectId),\n            eq(i.bindingRevision, source.snapshot.identifierRevision),\n          ),\n        );\n      yield* database\n        .update(mapping.credential.table)\n        .set(\n          mapping.credential.encodeRetirement({\n            source: source.snapshot.identifier,\n            credentialRevision: allocated.sourceCredentialRevision,\n          }),\n        )\n        .where(\n          and(\n            eq(c.moduleId, input.moduleId),\n            eq(c.credentialId, source.snapshot.credentialId),\n            eq(c.subjectId, current.nativeSubjectId),\n            eq(c.credentialRevision, source.snapshot.credentialRevision),\n          ),\n        );\n      yield* database\n        .update(mapping.authorityCredential.table)\n        .set(mapping.authorityCredential.encodeRetirement(allocated.sourceCredentialRevision))\n        .where(\n          and(\n            eq(a.subjectId, current.nativeSubjectId),\n            eq(a.credentialId, source.snapshot.credentialId),\n            eq(a.revision, source.snapshot.credentialRevision),\n          ),\n        );\n    }\n    if (current.targetIdentifier === undefined) {\n      yield* database.insert(mapping.identifier.table).values(\n        mapping.identifier.encodeVerifiedInsert({\n          identifier: input.target,\n          subjectId: current.nativeSubjectId,\n          verifiedAtMillis: now,\n          bindingRevision: allocated.targetIdentifierRevision,\n        }),\n      );\n    } else {\n      yield* database\n        .update(mapping.identifier.table)\n        .set(\n          mapping.identifier.encodeVerification({\n            verifiedAtMillis: now,\n            bindingRevision: allocated.targetIdentifierRevision,\n          }),\n        )\n        .where(\n          and(\n            eq(i.namespace, input.target.namespace),\n            eq(i.value, input.target.value),\n            eq(i.subjectId, current.nativeSubjectId),\n            eq(i.bindingRevision, current.targetIdentifier![mapping.identifier.bindingRevision]),\n          ),\n        );\n    }\n    if (current.targetCredential === undefined) {\n      yield* database.insert(mapping.credential.table).values(\n        mapping.credential.encodeVerifiedInsert({\n          moduleId: input.moduleId,\n          subjectId: current.nativeSubjectId,\n          credentialId: targetCredentialId,\n          identifier: input.target,\n          credentialRevision: allocated.targetCredentialRevision,\n        }),\n      );\n      yield* database.insert(mapping.authorityCredential.table).values(\n        mapping.authorityCredential.encodeInsert({\n          subjectId: current.nativeSubjectId,\n          credentialId: targetCredentialId,\n          revision: allocated.targetCredentialRevision,\n        }),\n      );\n    } else {\n      const oldRevision = current.targetCredential[mapping.credential.credentialRevision];\n\n      yield* database\n        .update(mapping.credential.table)\n        .set(\n          mapping.credential.encodeActivation({\n            identifier: input.target,\n            credentialRevision: allocated.targetCredentialRevision,\n          }),\n        )\n        .where(\n          and(\n            eq(c.moduleId, input.moduleId),\n            eq(c.credentialId, targetCredentialId),\n            eq(c.subjectId, current.nativeSubjectId),\n            eq(c.credentialRevision, oldRevision),\n          ),\n        );\n      yield* database\n        .update(mapping.authorityCredential.table)\n        .set(mapping.authorityCredential.encodeActivation(allocated.targetCredentialRevision))\n        .where(\n          and(\n            eq(a.subjectId, current.nativeSubjectId),\n            eq(a.credentialId, targetCredentialId),\n            eq(a.revision, oldRevision),\n          ),\n        );\n    }\n    yield* database\n      .update(mapping.subject.table)\n      .set(updateValues<any>([[mapping.subject.securityRevision, allocated.nextSecurityRevision]]))\n      .where(\n        and(\n          eq(s.id, current.nativeSubjectId),\n          eq(s.securityRevision, input.captured.revision.securityRevision),\n        ),\n      );\n    yield* database.insert(mapping.command.table).values(\n      mapping.command.encodeInsert({\n        moduleId: input.moduleId,\n        commandId: input.commandId,\n        action,\n        bindingDigest: input.authorization.challenge.bindingDigest,\n        retentionUntilMillis: now + mapping.commandRetentionMillis,\n      }),\n    );\n\n    const sourceStillActive =\n      action === \"verify-address\"\n        ? []\n        : yield* selectRows(\n            database\n              .select()\n              .from(mapping.credential.table)\n              .where(\n                and(\n                  eq(c.moduleId, input.moduleId),\n                  eq(c.credentialId, current.source!.snapshot.credentialId),\n                  eq(c.subjectId, current.nativeSubjectId),\n                ),\n              ),\n            false,\n          );\n\n    const target = (yield* emailLookupRows(mapping, input.moduleId, input.target))[0];\n\n    const targetAuthority = yield* selectRows(\n      database\n        .select()\n        .from(mapping.authorityCredential.table)\n        .where(\n          and(eq(a.subjectId, current.nativeSubjectId), eq(a.credentialId, targetCredentialId)),\n        )\n        .limit(1),\n      false,\n    );\n\n    const command = yield* selectRows(\n      database\n        .select()\n        .from(mapping.command.table)\n        .where(\n          and(\n            eq(commandColumns(mapping).moduleId, input.moduleId),\n            eq(commandColumns(mapping).commandId, input.commandId),\n            eq(commandColumns(mapping).action, action),\n            eq(commandColumns(mapping).bindingDigest, input.authorization.challenge.bindingDigest),\n            eq(\n              commandColumns(mapping).retentionUntil,\n              mapping.encodeInstant(now + mapping.commandRetentionMillis),\n            ),\n          ),\n        )\n        .limit(1),\n      false,\n    );\n\n    const targetVerifiedAt =\n      target === undefined\n        ? undefined\n        : yield* mapping.decodeInstant(target.identifier[mapping.identifier.verifiedAt]);\n\n    const sourceIdentifier =\n      action === \"verify-address\"\n        ? []\n        : yield* identifierRow(mapping, current.source!.snapshot.identifier, false);\n\n    const sourceAuthority =\n      action === \"verify-address\"\n        ? []\n        : yield* selectRows(\n            database\n              .select()\n              .from(mapping.authorityCredential.table)\n              .where(\n                and(\n                  eq(a.subjectId, current.nativeSubjectId),\n                  eq(a.credentialId, current.source!.snapshot.credentialId),\n                ),\n              )\n              .limit(1),\n            false,\n          );\n\n    return (\n      target !== undefined &&\n      mapping.subjectId.equals(target.subject[mapping.subject.id], current.nativeSubjectId) &&\n      mapping.subject.isActiveStatus(target.subject[mapping.subject.status]) &&\n      target.subject[mapping.subject.securityRevision] === allocated.nextSecurityRevision &&\n      target.identifier[mapping.identifier.bindingRevision] ===\n        allocated.targetIdentifierRevision &&\n      targetVerifiedAt === now &&\n      target.credential[mapping.credential.credentialRevision] ===\n        allocated.targetCredentialRevision &&\n      target.credential[mapping.credential.credentialId] === targetCredentialId &&\n      mapping.subjectId.equals(\n        target.credential[mapping.credential.subjectId],\n        current.nativeSubjectId,\n      ) &&\n      mapping.identifier.isCurrent(target.identifier) &&\n      mapping.credential.isActiveStatus(target.credential[mapping.credential.status]) &&\n      targetAuthority.length === 1 &&\n      targetAuthority[0]![mapping.authorityCredential.revision] ===\n        allocated.targetCredentialRevision &&\n      mapping.authorityCredential.isActiveStatus(\n        targetAuthority[0]![mapping.authorityCredential.status],\n      ) &&\n      command.length === 1 &&\n      (action === \"verify-address\" ||\n        (sourceStillActive.length === 1 &&\n          sourceStillActive[0]![mapping.credential.credentialRevision] ===\n            allocated.sourceCredentialRevision &&\n          !mapping.credential.isActiveStatus(sourceStillActive[0]![mapping.credential.status]) &&\n          sourceIdentifier.length === 1 &&\n          mapping.subjectId.equals(\n            sourceIdentifier[0]![mapping.identifier.subjectId],\n            current.nativeSubjectId,\n          ) &&\n          sourceIdentifier[0]![mapping.identifier.bindingRevision] ===\n            allocated.sourceIdentifierRevision &&\n          !mapping.identifier.isCurrent(sourceIdentifier[0]!) &&\n          sourceAuthority.length === 1 &&\n          sourceAuthority[0]![mapping.authorityCredential.revision] ===\n            allocated.sourceCredentialRevision &&\n          !mapping.authorityCredential.isActiveStatus(\n            sourceAuthority[0]![mapping.authorityCredential.status],\n          )))\n    );\n  });\n\n  const probeProofCompletion = Effect.fn(\"Drizzle.probeProofCompletion\")(function* (\n    configuration: EmailSqlConfiguration,\n    input: ProofCompletionInput,\n  ) {\n    const database = yield* CurrentEmailSql;\n\n    if (configuration.proof === undefined) return yield* Effect.fail(unavailable());\n    const validProbe = { _tag: \"EmailProofCompletionValid\" } as const;\n\n    const plan = {\n      input,\n      prepare: <A>(\n        decision: ProofCompletionDecision,\n        journal: CommitJournal,\n        project: (decision: ProofCompletionDecision) => A,\n      ) => journal.prepare(project(decision)),\n    };\n\n    const probe = coordinateCommit(\n      () =>\n        database.transaction((transaction) =>\n          completeProofPlanIn(\n            configuration.proof!.mapping,\n            configuration.proof!.configuration,\n            plan,\n            Effect.fail(validProbe),\n            () => false,\n          ).pipe(\n            Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),\n          ),\n        ),\n      { mode: configuration.mode },\n    );\n\n    return yield* probe.pipe(\n      Effect.as(false),\n      Effect.catchCause((cause) => {\n        const reason = cause.reasons[0];\n\n        return cause.reasons.length === 1 &&\n          reason !== undefined &&\n          Cause.isFailReason(reason) &&\n          reason.error === validProbe\n          ? Effect.succeed(true)\n          : Effect.failCause(cause);\n      }),\n    );\n  });\n\n  const prepareRejected = Effect.fn(\"Drizzle.prepareRejected\")(function* <A>(\n    configuration: EmailSqlConfiguration,\n    prepare: (value: \"rejected\", journal: CommitJournal) => PreparedCommit<A>,\n  ) {\n    const database = yield* CurrentEmailSql;\n\n    return yield* owned(\n      database,\n      configuration,\n      Effect.gen(function* () {\n        const journal = yield* CurrentCommitJournal;\n\n        return yield* Effect.succeed(prepare(\"rejected\", journal));\n      }),\n    );\n  });\n\n  const makeSqlEmailAddressPersistence = Effect.fn(\"makeSqlEmailAddressPersistence\")(function* (\n    database: EmailSqlDatabase,\n    mapping: AddressMapping,\n    configuration: EmailSqlConfiguration,\n  ): Effect.fn.Return<EmailAddressPersistence[\"Service\"], never, LifecycleHooks> {\n    const hooks = yield* LifecycleHooks;\n\n    return EmailAddressPersistence.of({\n      target: (input) =>\n        (validAddressConstraints(mapping)\n          ? safeRead(\n              database,\n              configuration,\n              Effect.gen(function* () {\n                const current = yield* currentAddress(mapping, input, configuration.locking);\n\n                if (current === undefined) return yield* unavailable();\n\n                return Object.freeze({\n                  revision: snapshotEmailRevision(current.revision),\n                  eligible: current.eligible,\n                  ...(current.targetIdentifierRevision === undefined\n                    ? {}\n                    : { targetIdentifierRevision: current.targetIdentifierRevision }),\n                  ...(current.source === undefined\n                    ? {}\n                    : { source: yield* snapshotEmailCredential(current.source.snapshot) }),\n                });\n              }),\n            )\n          : Effect.fail(unavailable())\n        ).pipe(\n          Effect.provideService(CurrentEmailSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      checkCompletion: (input) => {\n        if (configuration.proof === undefined || input.binding._tag !== \"IdentifierChange\")\n          return Effect.succeed(false).pipe(\n            Effect.provideService(CurrentEmailSql, database),\n            Effect.provideService(LifecycleHooks, hooks),\n            translateFailure,\n          );\n        const binding = input.binding;\n\n        return safeRead(\n          database,\n          configuration,\n          Effect.gen(function* () {\n            const action: EmailAction | undefined =\n              input.moduleId.endsWith(\"/verify-address\") &&\n              input.purpose === \"email-address-verification\"\n                ? \"verify-address\"\n                : input.moduleId.endsWith(\"/change-address\") &&\n                    input.purpose === \"email-address-change\"\n                  ? \"change-address\"\n                  : undefined;\n\n            if (action === undefined) return false;\n            const moduleId = input.moduleId.slice(0, -`/${action}`.length);\n\n            const current = yield* currentAddress(\n              mapping,\n              {\n                moduleId,\n                subjectId: binding.revision.subjectId,\n                target: binding.identifier,\n              },\n              false,\n            );\n\n            return current !== undefined && sameEmailRevision(current.revision, binding.revision);\n          }),\n        )\n          .pipe(\n            Effect.flatMap((current) =>\n              current ? probeProofCompletion(configuration, input) : Effect.succeed(false),\n            ),\n          )\n          .pipe(\n            Effect.provideService(CurrentEmailSql, database),\n            Effect.provideService(LifecycleHooks, hooks),\n            translateFailure,\n          );\n      },\n      verifyWithProof: (uncaptured, prepare) =>\n        mutateAddress(mapping, configuration, uncaptured, \"verify-address\", prepare).pipe(\n          Effect.provideService(CurrentEmailSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      changeWithProof: (uncaptured, prepare) =>\n        mutateAddress(mapping, configuration, uncaptured, \"change-address\", prepare).pipe(\n          Effect.provideService(CurrentEmailSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      cleanup: (input, prepare) =>\n        owned(\n          database,\n          configuration,\n          Effect.gen(function* () {\n            const transaction = yield* CurrentEmailSql;\n            const journal = yield* CurrentCommitJournal;\n\n            const c = commandColumns(mapping);\n            const now = yield* nowMillis;\n\n            const rows = yield* selectRows(\n              transaction\n                .select({ commandId: c.commandId })\n                .from(mapping.command.table)\n                .where(\n                  and(\n                    eq(c.moduleId, input.moduleId),\n                    lte(c.retentionUntil, mapping.encodeInstant(now)),\n                  ),\n                )\n                .limit(input.limit + 1),\n              configuration.locking,\n            );\n\n            const selected = rows.slice(0, input.limit);\n\n            const receipt = prepare(\n              { removed: selected.length, hasMore: rows.length > input.limit },\n              journal,\n            );\n\n            if (selected.length > 0)\n              yield* transaction.delete(mapping.command.table).where(\n                and(\n                  eq(c.moduleId, input.moduleId),\n                  inArray(\n                    c.commandId,\n                    selected.map((row: any) => row.commandId),\n                  ),\n                  lte(c.retentionUntil, mapping.encodeInstant(now)),\n                ),\n              );\n\n            return receipt;\n          }),\n        ).pipe(\n          Effect.provideService(CurrentEmailSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n    });\n  });\n\n  const mutateAddress = Effect.fn(\"Drizzle.mutateAddress\")(function* <A>(\n    mapping: AddressMapping,\n    configuration: EmailSqlConfiguration,\n    uncaptured: EmailAddressMutation,\n    action: EmailAction,\n    prepare: (value: \"changed\" | \"rejected\", journal: CommitJournal) => PreparedCommit<A>,\n  ) {\n    const database = yield* CurrentEmailSql;\n\n    if (!validAddressConstraints(mapping) || configuration.proof === undefined)\n      return yield* unavailable();\n    const input = yield* snapshotEmailMutation(uncaptured);\n\n    const targetCredentialId = yield* allocate(\n      configuration.mode,\n      mapping.allocateCredentialId,\n      mapping.allocateCredentialIdSync,\n    );\n\n    const targetIdentifierRevision = yield* allocate(\n      configuration.mode,\n      mapping.allocateRevision,\n      mapping.allocateRevisionSync,\n    );\n\n    const targetCredentialRevision = yield* allocate(\n      configuration.mode,\n      mapping.allocateRevision,\n      mapping.allocateRevisionSync,\n    );\n\n    const sourceIdentifierRevision = yield* allocate(\n      configuration.mode,\n      mapping.allocateRevision,\n      mapping.allocateRevisionSync,\n    );\n\n    const sourceCredentialRevision = yield* allocate(\n      configuration.mode,\n      mapping.allocateRevision,\n      mapping.allocateRevisionSync,\n    );\n\n    const confirmsExisting =\n      action === \"verify-address\" && input.captured.targetIdentifierRevision !== undefined;\n\n    const nextRevision = confirmsExisting\n      ? input.captured.revision.securityRevision\n      : yield* nextSecurityRevision(\n          mapping,\n          configuration.mode,\n          input.captured.revision.securityRevision,\n        );\n\n    if (\n      (!confirmsExisting && nextRevision === input.captured.revision.securityRevision) ||\n      [\n        targetIdentifierRevision,\n        targetCredentialRevision,\n        sourceIdentifierRevision,\n        sourceCredentialRevision,\n      ].some((value) => input.captured.revision.credentials.some((item) => item.revision === value))\n    )\n      return yield* unavailable();\n\n    const run = owned(\n      database,\n      configuration,\n      Effect.gen(function* () {\n        const journal = yield* CurrentCommitJournal;\n\n        const current = yield* validateEmailAuthority(mapping, configuration, input, action);\n\n        if (current === undefined) return prepare(\"rejected\", journal);\n        if (\n          (yield* commandExists(mapping, input.moduleId, input.commandId, configuration.locking))\n            .length > 0\n        )\n          return prepare(\"rejected\", journal);\n        let receipt: PreparedCommit<A> | undefined;\n\n        yield* completeProofPlanIn(\n          configuration.proof!.mapping,\n          configuration.proof!.configuration,\n          input.completion,\n          Effect.gen(function* () {\n            // The proof helper may wait on continuation/series locks. Read the\n            // commit clock and reassess both policies only after those locks.\n            const currentRequirement = yield* mapping.subject.decodeActionRequirement(\n              current.subject,\n              action,\n            );\n\n            const original = yield* assessAuthentication(\n              input.authorization.evidence,\n              input.authorization.requirement,\n            ).pipe(Effect.mapError(unavailable));\n\n            const configured = yield* assessAuthentication(\n              input.authorization.evidence,\n              currentRequirement,\n            ).pipe(Effect.mapError(unavailable));\n\n            if (!original.satisfied || !configured.satisfied) return false;\n            const now = yield* nowMillis;\n\n            return yield* applyMutation(\n              mapping,\n              input,\n              action,\n              current,\n              {\n                targetCredentialId,\n                targetIdentifierRevision,\n                targetCredentialRevision,\n                sourceIdentifierRevision,\n                sourceCredentialRevision,\n                nextSecurityRevision: nextRevision,\n              },\n              now,\n            );\n          }),\n          (decision) => {\n            receipt = prepare(decision === \"completed\" ? \"changed\" : \"rejected\", journal);\n\n            return decision;\n          },\n        );\n\n        return receipt ?? prepare(\"rejected\", journal);\n      }),\n    );\n\n    return yield* run.pipe(\n      Effect.catchCause((cause) =>\n        (cause.reasons.every(Cause.isFailReason) &&\n          isMappedConstraintConflict(mapping.isCommandConflict, cause)) ||\n        (cause.reasons.every(Cause.isFailReason) &&\n          isMappedConstraintConflict(mapping.isIdentifierConflict, cause)) ||\n        (cause.reasons.every(Cause.isFailReason) &&\n          isMappedConstraintConflict(mapping.isCredentialConflict, cause))\n          ? prepareRejected(configuration, prepare)\n          : Effect.failCause(cause),\n      ),\n    );\n  });\n\n  return {\n    validEmailSignInConstraints,\n    emailLookupQuery,\n    decodeEmailSnapshot,\n    makeSqlEmailSignInTargets,\n    currentAddress,\n    sameEmailRevision,\n    snapshotEmailMutation,\n    validateEmailAuthority,\n    makeSqlEmailAddressPersistence,\n  };\n};\n"],"mappings":";;;;;;;;;;AAoFA,IAAa,kBAAb,cAAqC,QAAQ,QAA2C,CAAC,CACvF,6BACF,CAAC,CAAC,CAAC;AA4BH,MAAa,mBACX,YACA,WACG;CACH,MAAM,EAAE,KAAK,IAAI,SAAS,KAAK,QAAQ,iBAAiB;CACxD,MAAM,EAAE,wBAAwB;CAChC,MAAM,oBAAoB,iBAAiB,KAAK,CAAC,CAAC;CAElD,MAAM,oBACJ,WAEA,yBACE,SACC,UACC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,sBAAsB,CAAC,CAAC,KAAK,CAC3C,CAAC,CAAC,KAAK,OAAO,YAAY,UAAU,OAAO,UAAU,MAAM,IAAI,aAAa,YAAY,CAAC,CAAC,CAAC,CAAC;CAE9F,MAAM,YAAY,OAAO,IAAI,SAAS,KAAK,SAAS,aAAa;CAEjE,MAAM,cAAc,OAAsB,YACxC,WAAW,OAAO,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,IAAI;CAErE,MAAM,kBAAkB,MAAuB,UAC7C,KAAK,cAAc,MAAM,aAAa,KAAK,UAAU,MAAM;CAE7D,MAAM,+BAA+B,YACnC,OAAO,QAAQ,8BAA8B,CAAC,CAAC,OAC5C,CAAC,KAAK,WACL,QAAQ,YAAY,SAAwD,KAChF;CAEF,MAAM,2BAA2B,YAC/B,OAAO,QAAQ,+BAA+B,CAAC,CAAC,OAC7C,CAAC,KAAK,WACL,QAAQ,YAAY,SAAyD,KACjF;CAEF,MAAM,kBAAkB,aAA4B;EAClD,IAAI,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,EAAE;EACpD,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;EAC5D,kBAAkB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,gBAAgB;CAClF;CAEA,MAAM,qBAAqB,aAA4B;EACrD,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;EACxE,OAAO,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,KAAK;EAChE,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;EACxE,YAAY,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,UAAU;EAC1E,iBAAiB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,eAAe;CACtF;CAEA,MAAM,qBAAqB,aAA4B;EACrD,UAAU,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,QAAQ;EACtE,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;EACxE,cAAc,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,YAAY;EAC9E,qBAAqB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,mBAAmB;EAC5F,iBAAiB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,eAAe;EACpF,oBAAoB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,kBAAkB;EAC1F,QAAQ,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,MAAM;CACpE;CAEA,MAAM,oBAAoB,aAA6B;EACrD,WAAW,OAAO,QAAQ,oBAAoB,OAAO,QAAQ,oBAAoB,SAAS;EAC1F,cAAc,OACZ,QAAQ,oBAAoB,OAC5B,QAAQ,oBAAoB,YAC9B;EACA,UAAU,OAAO,QAAQ,oBAAoB,OAAO,QAAQ,oBAAoB,QAAQ;EACxF,QAAQ,OAAO,QAAQ,oBAAoB,OAAO,QAAQ,oBAAoB,MAAM;CACtF;CAEA,MAAM,kBAAkB,aAA6B;EACnD,UAAU,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,QAAQ;EAChE,WAAW,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,SAAS;EAClE,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;EAC5D,eAAe,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,aAAa;EAC1E,gBAAgB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,cAAc;CAC9E;CAEA,MAAM,YACJ,MACA,cACA,gBACG;EACH,IAAI,SAAS,eACX,OAAO,gBAAgB,KAAA,IACnB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;GACT,KAAK;GACL,QAAQ,UAAU,IAAI,wBAAwB;IAAE,WAAW;IAAW;GAAM,CAAC;EAC/E,CAAC;EACP,IAAI,iBAAiB,KAAA,GAAW,OAAO;EAEvC,OAAO,gBAAgB,KAAA,IACnB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;GACT,KAAK;GACL,QAAQ,UAAU,IAAI,wBAAwB;IAAE,WAAW;IAAW;GAAM,CAAC;EAC/E,CAAC;CACP;CAEA,MAAM,wBACJ,SACA,MACA,YACG;EACH,IAAI,SAAS,eACX,OAAO,QAAQ,QAAQ,6BAA6B,KAAA,IAChD,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;GACT,WAAW,QAAQ,QAAQ,yBAA0B,OAAO;GAC5D,QAAQ,UAAU,IAAI,wBAAwB;IAAE,WAAW;IAAW;GAAM,CAAC;EAC/E,CAAC;EACP,IAAI,QAAQ,QAAQ,yBAAyB,KAAA,GAC3C,OAAO,QAAQ,QAAQ,qBAAqB,OAAO;EACrD,IAAI,QAAQ,QAAQ,6BAA6B,KAAA,GAC/C,OAAO,OAAO,IAAI;GAChB,WAAW,QAAQ,QAAQ,yBAA0B,OAAO;GAC5D,QAAQ,UAAU,IAAI,wBAAwB;IAAE,WAAW;IAAW;GAAM,CAAC;EAC/E,CAAC;EAEH,OAAO,OAAO,KAAK,YAAY,CAAC;CAClC;CAEA,MAAM,YACJ,UACA,eACA,SAEA,OAAO,IAAI,aAAa;EACtB,IAAI,cAAc,gBAAgB,MAAM;GACtC,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;GACrD,OAAO,cAAc;EACvB;EAEA,OAAO,OAAO,SAAS,aAAa,gBAClC,KAAK,KACH,OAAO,eAAe,iBAAiB,WAAW,GAClD,OAAO,eAAe,iBAAiB,WAA0C,CACnF,CACF;CACF,CAAC;CAEH,MAAM,SACJ,UACA,eACA,SACG;EACH,MAAM,MAAM,uBAER,SAAS,aAAa,gBACpB,KAAK,KACH,OAAO,eAAe,iBAAiB,WAAW,GAClD,OAAO,eAAe,iBAAiB,WAA0C,CACnF,CACF,GACF,EAAE,MAAM,cAAc,KAAK,CAC7B,CAAC,CAAC,KAAK,OAAO,KAAK,WAAW,OAAO,KAAK,CAAC;EAE3C,OAAO,cAAc,gBAAgB,OACjC,OAAO,IAAI,aAAa;GACtB,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;GACrD,OAAO,cAAc;GAErB,OAAO,OAAO;EAChB,CAAC,IACD;CACN;CAEA,MAAM,oBACJ,SACA,UACA,eACG;EACH,MAAM,UAAU,eAAe,OAAO,GACpC,UAAU,kBAAkB,OAAO,GACnC,aAAa,kBAAkB,OAAO;EAExC,OAAO;GACL,QAAQ;IACN,SAAS,QAAQ,QAAQ;IACzB,YAAY,QAAQ,WAAW;IAC/B,YAAY,QAAQ,WAAW;GACjC;GACA,MAAM,QAAQ,WAAW;GACzB,cAAc,QAAQ,QAAQ;GAC9B,aAAa,GAAG,QAAQ,IAAI,QAAQ,SAAS;GAC7C,iBAAiB,QAAQ,WAAW;GACpC,gBAAgB,IACd,GAAG,WAAW,UAAU,QAAQ,GAChC,GAAG,WAAW,WAAW,QAAQ,SAAS,GAC1C,GAAG,WAAW,qBAAqB,QAAQ,SAAS,GACpD,GAAG,WAAW,iBAAiB,QAAQ,KAAK,CAC9C;GACA,WAAW,IACT,GAAG,QAAQ,WAAW,WAAW,SAAS,GAC1C,GAAG,QAAQ,OAAO,WAAW,KAAK,CACpC;GACA,OAAO;EACT;CACF;CAEA,MAAM,kBAAkB,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,SACA,UACA,YACA;EACA,MAAM,WAAW,OAAO;EACxB,MAAM,QAAQ,iBAAiB,SAAS,UAAU,UAAU;EAE5D,OAAO,OAAO,SACX,OAAO,MAAM,MAAM,CAAC,CACpB,KAAK,MAAM,IAAI,CAAC,CAChB,UAAU,MAAM,cAAc,MAAM,WAAW,CAAC,CAChD,UAAU,MAAM,iBAAiB,MAAM,cAAc,CAAC,CACtD,MAAM,MAAM,SAAS,CAAC,CACtB,MAAM,MAAM,KAAK;CACtB,CAAC;CAED,MAAM,sBAAsB,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACnE,SACA,UACA,WACA,KACA;EACA,IACE,CAAC,QAAQ,QAAQ,eAAe,IAAI,QAAQ,QAAQ,QAAQ,OAAO,KACnE,CAAC,QAAQ,WAAW,UAAU,IAAI,UAAU,KAC5C,CAAC,QAAQ,WAAW,eAAe,IAAI,WAAW,QAAQ,WAAW,OAAO,GAE5E,OAAO,KAAA;EAET,MAAM,WAAW,OAAO,QAAQ,WAC7B,OAAO;GACN;GACA,SAAS,IAAI;GACb,YAAY,IAAI;GAChB,YAAY,IAAI;EAClB,CAAC,CAAC,CACD,KAAK,OAAO,QAAQ,uBAAuB,CAAC;EAE/C,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,IAAI,QAAQ,QAAQ,QAAQ,GAAG;EAEpF,MAAM,mBAAmB,OAAO,QAAQ,cACtC,IAAI,WAAW,QAAQ,WAAW,WACpC;EAEA,IACE,SAAS,aAAa,YACtB,CAAC,eAAe,SAAS,YAAY,SAAS,KAC9C,SAAS,SAAS,cAAc,aAChC,SAAS,SAAS,qBAAqB,IAAI,QAAQ,QAAQ,QAAQ,qBACnE,SAAS,uBAAuB,IAAI,WAAW,QAAQ,WAAW,oBAClE,SAAS,qBAAqB,oBAC9B,SAAS,iBAAiB,IAAI,WAAW,QAAQ,WAAW,iBAC5D,SAAS,uBAAuB,IAAI,WAAW,QAAQ,WAAW,qBAElE,OAAO,KAAA;EAET,OAAO;CACT,CAAC;CAED,MAAM,4BAA4B,OAAO,GAAG,2BAA2B,CAAC,CAAC,SACvE,UACA,SACA,eAC8C;EAC9C,OAAO,OAAO,QACZ,mBAAmB,GAAG,EACpB,SAAS,WACN,4BAA4B,OAAO,IAChC,SACE,UACA,eACA,OAAO,IAAI,aAAa;GACtB,MAAM,OAAO,OAAO,gBAClB,SACA,MAAM,UACN,MAAM,UACR,EAAA,CAAG;GAEH,IAAI,QAAQ,KAAA,GAAW,OAAO,OAAO,KAAK;GAE1C,MAAM,WAAW,OAAO,oBACtB,SACA,MAAM,UACN,MAAM,YACN,GACF;GAEA,OAAO,aAAa,KAAA,IAAY,OAAO,KAAK,IAAI,OAAO,KAAK,QAAQ;EACtE,CAAC,CACH,IACA,OAAO,KAAK,YAAY,CAAC,EAAA,CAC3B,KAAK,OAAO,eAAe,iBAAiB,QAAQ,GAAG,gBAAgB,EAC7E,CAAC,CACH;CACF,CAAC;CAED,MAAM,cAAc,OAAO,GAAG,0BAA0B,CAAC,CAAC,WACxD,SACA,WACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,SAAgB;EAC1E,MAAM,IAAI,eAAe,OAAO;EAOhC,OAAO;GAAE;GAAiB,UALT,OAAO,WACtB,SAAS,OAAO,CAAC,CAAC,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAAC,MAAM,GAAG,EAAE,IAAI,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,GACtF,OACF,EAAA,CAAG;EAE+B;CACpC,CAAC;CAED,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,YACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EAEnC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,IAAI,GAAG,EAAE,WAAW,WAAW,SAAS,GAAG,GAAG,EAAE,OAAO,WAAW,KAAK,CAAC,CAAC,CAAC,CAChF,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,iBAAiB,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,UACA,cACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EAEnC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,IAAI,GAAG,EAAE,UAAU,QAAQ,GAAG,GAAG,EAAE,cAAc,YAAY,CAAC,CAAC,CAAC,CACtE,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,yBAAyB,OAAO,GAAG,gCAAgC,CAAC,CAAC,WACzE,SACA,UACA,YACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EAEnC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MACC,IACE,GAAG,EAAE,UAAU,QAAQ,GACvB,GAAG,EAAE,qBAAqB,WAAW,SAAS,GAC9C,GAAG,EAAE,iBAAiB,WAAW,KAAK,CACxC,CACF,CAAC,CACA,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,iBAAiB,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAC9D,SACA,OAMA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,SAAS,OAAO,YAAY,SAAS,MAAM,WAAW,OAAO;EAEnE,IACE,OAAO,YAAY,KAAA,KACnB,CAAC,QAAQ,QAAQ,eAAe,OAAO,QAAQ,QAAQ,QAAQ,OAAO,GAEtE,OAAO,KAAA;EAET,MAAM,mBACJ,MAAM,uBAAuB,KAAA,IACzB,KAAA,KACC,OAAO,eAAe,SAAS,MAAM,UAAU,MAAM,oBAAoB,KAAK,EAAA,CAAG;EAExF,MAAM,mBACJ,qBAAqB,KAAA,IACjB,KAAA,IACA;GACE,WAAW,iBAAiB,QAAQ,WAAW;GAC/C,OAAO,iBAAiB,QAAQ,WAAW;EAC7C;EAEN,MAAM,cAAc,CAClB,MAAM,QACN,GAAI,qBAAqB,KAAA,IAAY,CAAC,IAAI,CAAC,gBAAgB,CAC7D,CAAC,CACE,QACE,OAAO,OAAO,WACb,OAAO,WAAW,cAAc,eAAe,WAAW,KAAK,CAAC,MAAM,KAC1E,CAAC,CACA,MAAM,MAAM,UACX,GAAG,KAAK,UAAU,QAAQ,KAAK,QAAQ,cACrC,GAAG,MAAM,UAAU,QAAQ,MAAM,OACnC,CACF;EAEF,MAAM,oCAAoB,IAAI,IAAiB;EAE/C,KAAK,MAAM,cAAc,aAAa;GACpC,MAAM,OAAO,OAAO,cAAc,SAAS,YAAY,OAAO,EAAA,CAAG;GAEjE,IAAI,QAAQ,KAAA,GACV,kBAAkB,IAAI,GAAG,WAAW,UAAU,QAAQ,WAAW,SAAS,GAAG;EACjF;EAEA,MAAM,mBACJ,MAAM,uBAAuB,KAAA,IACzB,KAAA,KACC,OAAO,eAAe,SAAS,MAAM,UAAU,MAAM,oBAAoB,OAAO,EAAA,CAAG;EAE1F,MAAM,oBAAoB,OAAO,uBAC/B,SACA,MAAM,UACN,MAAM,QACN,OACF,EAAA,CAAG;EAEH,MAAM,IAAI,iBAAiB,OAAO;EAWlC,MAAM,mBAAkB,OATC,WACvB,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,oBAAoB,KAAK,CAAC,CACvC,MAAM,GAAG,EAAE,WAAW,OAAO,eAAe,CAAC,CAAC,CAC9C,QAAQ,EAAE,YAAY,GACzB,OACF,EAAA,CAEkC,QAAQ,QACxC,QAAQ,oBAAoB,eAAe,IAAI,QAAQ,oBAAoB,OAAO,CACpF;EAEA,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,OAAO,eAAe;EAE3E,MAAM,WAAmC,OAAO,OAAO;GACrD;GACA,kBAAkB,OAAO,QAAQ,QAAQ,QAAQ;GACjD,aAAa,OAAO,OAClB,gBAAgB,KAAK,QACnB,OAAO,OAAO;IACZ,cAAc,IAAI,QAAQ,oBAAoB;IAC9C,UAAU,IAAI,QAAQ,oBAAoB;GAC5C,CAAC,CACH,CACF;EACF,CAAC;EAED,MAAM,mBAAmB,kBAAkB,IACzC,GAAG,MAAM,OAAO,UAAU,QAAQ,MAAM,OAAO,OACjD;EASA,MAAM,gBANJ,qBAAqB,KAAA,KACrB,QAAQ,UAAU,OAChB,iBAAiB,QAAQ,WAAW,YACpC,OAAO,eACT,KAIA,QAAQ,WAAW,gBAAgB,gBAAgB,MAClD,qBAAqB,KAAA,KACnB,CAAC,QAAQ,WAAW,eAAe,iBAAiB,QAAQ,WAAW,OAAO,KAC7E,QAAQ,UAAU,OAChB,iBAAiB,QAAQ,WAAW,YACpC,OAAO,eACT;EAEN,IAAI;EAEJ,IAAI,MAAM,uBAAuB,KAAA,GAAW;GAC1C,IACE,qBAAqB,KAAA,KACrB,qBAAqB,KAAA,KACrB,CAAC,QAAQ,UAAU,OACjB,iBAAiB,QAAQ,WAAW,YACpC,OAAO,eACT,KACA,CAAC,QAAQ,WAAW,eAAe,iBAAiB,QAAQ,WAAW,OAAO,GAE9E,OAAO,KAAA;GAET,MAAM,sBAAsB,kBAAkB,IAC5C,GAAG,iBAAiB,UAAU,QAAQ,iBAAiB,OACzD;GAEA,IACE,wBAAwB,KAAA,KACxB,CAAC,QAAQ,WAAW,UAAU,mBAAmB,KACjD,CAAC,QAAQ,UAAU,OACjB,oBAAoB,QAAQ,WAAW,YACvC,OAAO,eACT,GAEA,OAAO,KAAA;GAWT,SAAS;IAAE,YAAY;IAAkB,YAAY;IAAqB,UAAA,OATlD,QAAQ,WAC7B,OAAO;KACN,UAAU,MAAM;KAChB,SAAS,OAAO;KAChB,YAAY;KACZ,YAAY;IACd,CAAC,CAAC,CACD,KAAK,OAAO,QAAQ,uBAAuB,CAAC;GAEoC;EACrF;EACA,IAAI,WAAW,qBAAqB,KAAA,IAAY,qBAAqB,KAAA,IAAY;EAEjF,IAAI,MAAM,uBAAuB,KAAA,KAAa,WAAW,KAAA,GAAW,WAAW;EAC/E,IAAI,WAAW,KAAA,KAAa,eAAe,OAAO,SAAS,YAAY,MAAM,MAAM,GACjF,WAAW;EACb,IAAI,QAAQ,uBAAuB,YAAY,MAAM,uBAAuB,KAAA,GAAW;GACrF,MAAM,IAAI,kBAAkB,OAAO;GAUnC,KACE,OATkB,WAClB,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,WAAW,OAAO,eAAe,CAAC,CAAC,GACrF,OACF,EAAA,CAGO,MAAM,QAAa,QAAQ,WAAW,eAAe,IAAI,QAAQ,WAAW,OAAO,CAAC,GAEzF,WAAW;EACf;EAEA,OAAO;GACL,iBAAiB,OAAO;GACxB,SAAS,OAAO;GAChB;GACA,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO;GACzC,GAAI,qBAAqB,KAAA,IAAY,CAAC,IAAI,EAAE,iBAAiB;GAC7D,GAAI,qBAAqB,KAAA,IAAY,CAAC,IAAI,EAAE,iBAAiB;GAC7D,GAAI,gBACA,EAAE,0BAA0B,iBAAiB,QAAQ,WAAW,iBAAiB,IACjF,CAAC;GACL;EACF;CACF,CAAC;CAED,MAAM,qBAAqB,MAA8B,UAAkC;EACzF,IACE,KAAK,cAAc,MAAM,aACzB,KAAK,qBAAqB,MAAM,oBAChC,KAAK,YAAY,WAAW,MAAM,YAAY,QAE9C,OAAO;EAET,MAAM,WAAW,CAAC,GAAG,KAAK,WAAW,CAAC,CAAC,MAAM,GAAG,MAC9C,EAAE,aAAa,cAAc,EAAE,YAAY,CAC7C;EAEA,MAAM,SAAS,CAAC,GAAG,MAAM,WAAW,CAAC,CAAC,MAAM,GAAG,MAC7C,EAAE,aAAa,cAAc,EAAE,YAAY,CAC7C;EAEA,OAAO,SAAS,OACb,MAAM,UACL,KAAK,iBAAiB,OAAO,MAAM,CAAE,gBACrC,KAAK,aAAa,OAAO,MAAM,CAAE,QACrC;CACF;CAEA,MAAM,gBAAgB,UAAkB,WACtC,GAAG,SAAS,GAAG,WAAW,mBAAmB,mBAAmB;CAElE,MAAM,iBAAiB,WACrB,WAAW,mBAAmB,+BAA+B;CAE/D,MAAM,qBAAqB,OAA6B,WAAwB;EAC9E,MAAM,aAAa,MAAM,WAAW;EACpC,MAAM,UAAU,WAAW;EAE3B,OACE,WAAW,aAAa,aAAa,MAAM,UAAU,MAAM,KAC3D,WAAW,YAAY,cAAc,MAAM,KAC3C,QAAQ,SAAS,sBACjB,eAAe,QAAQ,YAAY,MAAM,MAAM,KAC/C,kBAAkB,QAAQ,UAAU,MAAM,SAAS,QAAQ;CAE/D;CAEA,MAAM,wBAAwB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WACvE,OACA;EACA,MAAM,WAAW,OAAO,+BAA+B,MAAM,cAAc,QAAQ,CAAC,CAAC,KACnF,OAAO,SAAS,WAAW,CAC7B;EAEA,MAAM,cAAc,OAAO,yBAAyB,MAAM,cAAc,WAAW;EAEnF,MAAM,SACJ,MAAM,SAAS,WAAW,KAAA,IACtB,KAAA,IACA,OAAO,wBAAwB,MAAM,SAAS,MAAM;EAE1D,OAAO,OAAO,OAAO;GACnB,GAAG;GACH,QAAQ,OAAO,OAAO,EAAE,GAAG,MAAM,OAAO,CAAC;GACzC,GAAI,MAAM,iBAAiB,KAAA,IACvB,CAAC,IACD,EAAE,cAAc,OAAO,OAAO,EAAE,GAAG,MAAM,aAAa,CAAC,EAAE;GAC7D,UAAU,OAAO,OAAO;IACtB,UAAU,MAAM,SAAS;IACzB,UAAU,sBAAsB,MAAM,SAAS,QAAQ;IACvD,GAAI,MAAM,SAAS,6BAA6B,KAAA,IAC5C,CAAC,IACD,EAAE,0BAA0B,MAAM,SAAS,yBAAyB;IACxE,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO;GAC3C,CAAC;GACD,eAAe,OAAO,OAAO;IAC3B,WAAW,OAAO,OAAO;KACvB,GAAG,MAAM,cAAc;KACvB,QAAQ,OAAO,OAAO,EAAE,GAAG,MAAM,cAAc,UAAU,OAAO,CAAC;KACjE,UAAU,sBAAsB,MAAM,cAAc,UAAU,QAAQ;IACxE,CAAC;IACD;IACA;GACF,CAAC;EACH,CAAC;CACH,CAAC;CAED,MAAM,yBAAyB,OAAO,GAAG,gCAAgC,CAAC,CAAC,WACzE,SACA,eACA,OACA,QACA;EACA,MAAM,mBACJ,WAAW,oBAAoB,MAAM,SAAS,6BAA6B,KAAA;EAE7E,IACE,CAAC,MAAM,SAAS,YAChB,CAAC,kBAAkB,OAAO,MAAM,KAChC,MAAM,cAAc,UAAU,aAAa,MAAM,YACjD,MAAM,cAAc,UAAU,WAAW,UACzC,MAAM,cAAc,UAAU,cAAc,MAAM,aAClD,CAAC,eAAe,MAAM,cAAc,UAAU,QAAQ,MAAM,MAAM,KAClE,MAAM,cAAc,UAAU,uBAAuB,MAAM,SAAS,QAAQ,gBAC5E,CAAC,kBAAkB,MAAM,cAAc,UAAU,UAAU,MAAM,SAAS,QAAQ,KAClF,MAAM,cAAc,UAAU,6BAC5B,MAAM,SAAS,4BAChB,MAAM,cAAc,SAAS,WAAuB,MAAM,aAC3D,MAAM,cAAc,SAAS,kBAAkB,MAAM,cAAc,UAAU,iBAC7E,CAAC,kBAAkB,MAAM,cAAc,SAAS,UAAU,MAAM,SAAS,QAAQ,KAChF,WAAW,oBAAoB,MAAM,SAAS,WAAW,KAAA,KACzD,WAAW,oBAAoB,MAAM,SAAS,WAAW,KAAA,KAC1D,sBAAsB,MAAM,iBAAiB,KAAA,MAC5C,MAAM,cAAc,qBAAqB,eACxC,QAAQ,wBAAwB,4BAElC,OAAO,KAAA;EAET,MAAM,UAAU,OAAO,eACrB,SACA;GACE,UAAU,MAAM;GAChB,WAAW,MAAM,SAAS,SAAS;GACnC,QAAQ,MAAM;GACd,GAAI,MAAM,SAAS,WAAW,KAAA,IAC1B,CAAC,IACD,EAAE,oBAAoB,MAAM,SAAS,OAAO,aAAa;EAC/D,GACA,cAAc,OAChB;EAEA,IACE,YAAY,KAAA,KACZ,CAAC,QAAQ,YACT,CAAC,kBAAkB,QAAQ,UAAU,MAAM,SAAS,QAAQ,KAC5D,QAAQ,6BAA6B,MAAM,SAAS,4BACnD,MAAM,SAAS,WAAW,KAAA,MACxB,QAAQ,WAAW,KAAA,KAClB,QAAQ,OAAO,SAAS,uBAAuB,MAAM,SAAS,OAAO,sBACrE,QAAQ,OAAO,SAAS,uBAAuB,MAAM,SAAS,OAAO,sBACrE,CAAC,eAAe,QAAQ,OAAO,SAAS,YAAY,MAAM,SAAS,OAAO,UAAU,IAExF,OAAO,KAAA;EAET,MAAM,qBAAqB,OAAO,QAAQ,QAAQ,wBAChD,QAAQ,SACR,MACF;EAEA,MAAM,WAAW,OAAO,qBACtB,MAAM,cAAc,UACpB,MAAM,cAAc,WACtB,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;EAEnC,MAAM,aAAa,OAAO,qBACxB,MAAM,cAAc,UACpB,kBACF,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;EAEnC,OAAO,SAAS,aAAa,WAAW,YAAY,UAAU,KAAA;CAChE,CAAC;CAED,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,UACA,WACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,eAAe,OAAO;EAEhC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,IAAI,GAAG,EAAE,UAAU,QAAQ,GAAG,GAAG,EAAE,WAAW,SAAS,CAAC,CAAC,CAAC,CAChE,MAAM,CAAC,GACV,OACF;CACF,CAAC;CAED,MAAM,gBAAgB,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAC5D,SACA,OACA,QACA,SACA,WAQA,KACA;EACA,MAAM,WAAW,OAAO;EAExB,MAAM,IAAI,kBAAkB,OAAO;EACnC,MAAM,IAAI,kBAAkB,OAAO;EACnC,MAAM,IAAI,iBAAiB,OAAO;EAClC,MAAM,IAAI,eAAe,OAAO;EAEhC,MAAM,qBACJ,QAAQ,mBAAmB,QAAQ,WAAW,iBAAiB,UAAU;EAE3E,IAAI,WAAW,kBAAkB;GAC/B,MAAM,SAAS,QAAQ;GAEvB,OAAO,SACJ,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,IACC,QAAQ,WAAW,iBAAiB;IAClC,QAAQ,OAAO,SAAS;IACxB,iBAAiB,UAAU;GAC7B,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,EAAE,WAAW,OAAO,SAAS,WAAW,SAAS,GACpD,GAAG,EAAE,OAAO,OAAO,SAAS,WAAW,KAAK,GAC5C,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,iBAAiB,OAAO,SAAS,kBAAkB,CAC1D,CACF;GACF,OAAO,SACJ,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,IACC,QAAQ,WAAW,iBAAiB;IAClC,QAAQ,OAAO,SAAS;IACxB,oBAAoB,UAAU;GAChC,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,cAAc,OAAO,SAAS,YAAY,GAC/C,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,oBAAoB,OAAO,SAAS,kBAAkB,CAC7D,CACF;GACF,OAAO,SACJ,OAAO,QAAQ,oBAAoB,KAAK,CAAC,CACzC,IAAI,QAAQ,oBAAoB,iBAAiB,UAAU,wBAAwB,CAAC,CAAC,CACrF,MACC,IACE,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,cAAc,OAAO,SAAS,YAAY,GAC/C,GAAG,EAAE,UAAU,OAAO,SAAS,kBAAkB,CACnD,CACF;EACJ;EACA,IAAI,QAAQ,qBAAqB,KAAA,GAC/B,OAAO,SAAS,OAAO,QAAQ,WAAW,KAAK,CAAC,CAAC,OAC/C,QAAQ,WAAW,qBAAqB;GACtC,YAAY,MAAM;GAClB,WAAW,QAAQ;GACnB,kBAAkB;GAClB,iBAAiB,UAAU;EAC7B,CAAC,CACH;OAEA,OAAO,SACJ,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,IACC,QAAQ,WAAW,mBAAmB;GACpC,kBAAkB;GAClB,iBAAiB,UAAU;EAC7B,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,EAAE,WAAW,MAAM,OAAO,SAAS,GACtC,GAAG,EAAE,OAAO,MAAM,OAAO,KAAK,GAC9B,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,iBAAiB,QAAQ,iBAAkB,QAAQ,WAAW,gBAAgB,CACrF,CACF;EAEJ,IAAI,QAAQ,qBAAqB,KAAA,GAAW;GAC1C,OAAO,SAAS,OAAO,QAAQ,WAAW,KAAK,CAAC,CAAC,OAC/C,QAAQ,WAAW,qBAAqB;IACtC,UAAU,MAAM;IAChB,WAAW,QAAQ;IACnB,cAAc;IACd,YAAY,MAAM;IAClB,oBAAoB,UAAU;GAChC,CAAC,CACH;GACA,OAAO,SAAS,OAAO,QAAQ,oBAAoB,KAAK,CAAC,CAAC,OACxD,QAAQ,oBAAoB,aAAa;IACvC,WAAW,QAAQ;IACnB,cAAc;IACd,UAAU,UAAU;GACtB,CAAC,CACH;EACF,OAAO;GACL,MAAM,cAAc,QAAQ,iBAAiB,QAAQ,WAAW;GAEhE,OAAO,SACJ,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,IACC,QAAQ,WAAW,iBAAiB;IAClC,YAAY,MAAM;IAClB,oBAAoB,UAAU;GAChC,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,cAAc,kBAAkB,GACrC,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,oBAAoB,WAAW,CACtC,CACF;GACF,OAAO,SACJ,OAAO,QAAQ,oBAAoB,KAAK,CAAC,CACzC,IAAI,QAAQ,oBAAoB,iBAAiB,UAAU,wBAAwB,CAAC,CAAC,CACrF,MACC,IACE,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,cAAc,kBAAkB,GACrC,GAAG,EAAE,UAAU,WAAW,CAC5B,CACF;EACJ;EACA,OAAO,SACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,IAAI,aAAkB,CAAC,CAAC,QAAQ,QAAQ,kBAAkB,UAAU,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAC5F,MACC,IACE,GAAG,EAAE,IAAI,QAAQ,eAAe,GAChC,GAAG,EAAE,kBAAkB,MAAM,SAAS,SAAS,gBAAgB,CACjE,CACF;EACF,OAAO,SAAS,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,OAC5C,QAAQ,QAAQ,aAAa;GAC3B,UAAU,MAAM;GAChB,WAAW,MAAM;GACjB;GACA,eAAe,MAAM,cAAc,UAAU;GAC7C,sBAAsB,MAAM,QAAQ;EACtC,CAAC,CACH;EAEA,MAAM,oBACJ,WAAW,mBACP,CAAC,IACD,OAAO,WACL,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,cAAc,QAAQ,OAAQ,SAAS,YAAY,GACxD,GAAG,EAAE,WAAW,QAAQ,eAAe,CACzC,CACF,GACF,KACF;EAEN,MAAM,UAAU,OAAO,gBAAgB,SAAS,MAAM,UAAU,MAAM,MAAM,EAAA,CAAG;EAE/E,MAAM,kBAAkB,OAAO,WAC7B,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,oBAAoB,KAAK,CAAC,CACvC,MACC,IAAI,GAAG,EAAE,WAAW,QAAQ,eAAe,GAAG,GAAG,EAAE,cAAc,kBAAkB,CAAC,CACtF,CAAC,CACA,MAAM,CAAC,GACV,KACF;EAEA,MAAM,UAAU,OAAO,WACrB,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MACC,IACE,GAAG,eAAe,OAAO,CAAC,CAAC,UAAU,MAAM,QAAQ,GACnD,GAAG,eAAe,OAAO,CAAC,CAAC,WAAW,MAAM,SAAS,GACrD,GAAG,eAAe,OAAO,CAAC,CAAC,QAAQ,MAAM,GACzC,GAAG,eAAe,OAAO,CAAC,CAAC,eAAe,MAAM,cAAc,UAAU,aAAa,GACrF,GACE,eAAe,OAAO,CAAC,CAAC,gBACxB,QAAQ,cAAc,MAAM,QAAQ,sBAAsB,CAC5D,CACF,CACF,CAAC,CACA,MAAM,CAAC,GACV,KACF;EAEA,MAAM,mBACJ,WAAW,KAAA,IACP,KAAA,IACA,OAAO,QAAQ,cAAc,OAAO,WAAW,QAAQ,WAAW,WAAW;EAEnF,MAAM,mBACJ,WAAW,mBACP,CAAC,IACD,OAAO,cAAc,SAAS,QAAQ,OAAQ,SAAS,YAAY,KAAK;EAE9E,MAAM,kBACJ,WAAW,mBACP,CAAC,IACD,OAAO,WACL,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,oBAAoB,KAAK,CAAC,CACvC,MACC,IACE,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,cAAc,QAAQ,OAAQ,SAAS,YAAY,CAC1D,CACF,CAAC,CACA,MAAM,CAAC,GACV,KACF;EAEN,OACE,WAAW,KAAA,KACX,QAAQ,UAAU,OAAO,OAAO,QAAQ,QAAQ,QAAQ,KAAK,QAAQ,eAAe,KACpF,QAAQ,QAAQ,eAAe,OAAO,QAAQ,QAAQ,QAAQ,OAAO,KACrE,OAAO,QAAQ,QAAQ,QAAQ,sBAAsB,UAAU,wBAC/D,OAAO,WAAW,QAAQ,WAAW,qBACnC,UAAU,4BACZ,qBAAqB,OACrB,OAAO,WAAW,QAAQ,WAAW,wBACnC,UAAU,4BACZ,OAAO,WAAW,QAAQ,WAAW,kBAAkB,sBACvD,QAAQ,UAAU,OAChB,OAAO,WAAW,QAAQ,WAAW,YACrC,QAAQ,eACV,KACA,QAAQ,WAAW,UAAU,OAAO,UAAU,KAC9C,QAAQ,WAAW,eAAe,OAAO,WAAW,QAAQ,WAAW,OAAO,KAC9E,gBAAgB,WAAW,KAC3B,gBAAgB,EAAE,CAAE,QAAQ,oBAAoB,cAC9C,UAAU,4BACZ,QAAQ,oBAAoB,eAC1B,gBAAgB,EAAE,CAAE,QAAQ,oBAAoB,OAClD,KACA,QAAQ,WAAW,MAClB,WAAW,oBACT,kBAAkB,WAAW,KAC5B,kBAAkB,EAAE,CAAE,QAAQ,WAAW,wBACvC,UAAU,4BACZ,CAAC,QAAQ,WAAW,eAAe,kBAAkB,EAAE,CAAE,QAAQ,WAAW,OAAO,KACnF,iBAAiB,WAAW,KAC5B,QAAQ,UAAU,OAChB,iBAAiB,EAAE,CAAE,QAAQ,WAAW,YACxC,QAAQ,eACV,KACA,iBAAiB,EAAE,CAAE,QAAQ,WAAW,qBACtC,UAAU,4BACZ,CAAC,QAAQ,WAAW,UAAU,iBAAiB,EAAG,KAClD,gBAAgB,WAAW,KAC3B,gBAAgB,EAAE,CAAE,QAAQ,oBAAoB,cAC9C,UAAU,4BACZ,CAAC,QAAQ,oBAAoB,eAC3B,gBAAgB,EAAE,CAAE,QAAQ,oBAAoB,OAClD;CAER,CAAC;CAED,MAAM,uBAAuB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACrE,eACA,OACA;EACA,MAAM,WAAW,OAAO;EAExB,IAAI,cAAc,UAAU,KAAA,GAAW,OAAO,OAAO,OAAO,KAAK,YAAY,CAAC;EAC9E,MAAM,aAAa,EAAE,MAAM,4BAA4B;EAEvD,MAAM,OAAO;GACX;GACA,UACE,UACA,SACA,YACG,QAAQ,QAAQ,QAAQ,QAAQ,CAAC;EACxC;EAkBA,OAAO,OAhBO,uBAEV,SAAS,aAAa,gBACpB,oBACE,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MACA,OAAO,KAAK,UAAU,SAChB,KACR,CAAC,CAAC,KACA,OAAO,eAAe,iBAAiB,WAA0C,CACnF,CACF,GACF,EAAE,MAAM,cAAc,KAAK,CAGX,CAAC,CAAC,KAClB,OAAO,GAAG,KAAK,GACf,OAAO,YAAY,UAAU;GAC3B,MAAM,SAAS,MAAM,QAAQ;GAE7B,OAAO,MAAM,QAAQ,WAAW,KAC9B,WAAW,KAAA,KACX,MAAM,aAAa,MAAM,KACzB,OAAO,UAAU,aACf,OAAO,QAAQ,IAAI,IACnB,OAAO,UAAU,KAAK;EAC5B,CAAC,CACH;CACF,CAAC;CAED,MAAM,kBAAkB,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,eACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,OAAO,OAAO,MACZ,UACA,eACA,OAAO,IAAI,aAAa;GACtB,MAAM,UAAU,OAAO;GAEvB,OAAO,OAAO,OAAO,QAAQ,QAAQ,YAAY,OAAO,CAAC;EAC3D,CAAC,CACH;CACF,CAAC;CAED,MAAM,iCAAiC,OAAO,GAAG,gCAAgC,CAAC,CAAC,WACjF,UACA,SACA,eAC6E;EAC7E,MAAM,QAAQ,OAAO;EAErB,OAAO,wBAAwB,GAAG;GAChC,SAAS,WACN,wBAAwB,OAAO,IAC5B,SACE,UACA,eACA,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO,eAAe,SAAS,OAAO,cAAc,OAAO;IAE3E,IAAI,YAAY,KAAA,GAAW,OAAO,OAAO,YAAY;IAErD,OAAO,OAAO,OAAO;KACnB,UAAU,sBAAsB,QAAQ,QAAQ;KAChD,UAAU,QAAQ;KAClB,GAAI,QAAQ,6BAA6B,KAAA,IACrC,CAAC,IACD,EAAE,0BAA0B,QAAQ,yBAAyB;KACjE,GAAI,QAAQ,WAAW,KAAA,IACnB,CAAC,IACD,EAAE,QAAQ,OAAO,wBAAwB,QAAQ,OAAO,QAAQ,EAAE;IACxE,CAAC;GACH,CAAC,CACH,IACA,OAAO,KAAK,YAAY,CAAC,EAAA,CAC3B,KACA,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,kBAAkB,UAAU;IAC1B,IAAI,cAAc,UAAU,KAAA,KAAa,MAAM,QAAQ,SAAS,oBAC9D,OAAO,OAAO,QAAQ,KAAK,CAAC,CAAC,KAC3B,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;IACF,MAAM,UAAU,MAAM;IAEtB,OAAO,SACL,UACA,eACA,OAAO,IAAI,aAAa;KACtB,MAAM,SACJ,MAAM,SAAS,SAAS,iBAAiB,KACzC,MAAM,YAAY,+BACd,mBACA,MAAM,SAAS,SAAS,iBAAiB,KACvC,MAAM,YAAY,yBAClB,mBACA,KAAA;KAER,IAAI,WAAW,KAAA,GAAW,OAAO;KACjC,MAAM,WAAW,MAAM,SAAS,MAAM,GAAG,CAAC,IAAI,SAAS,MAAM;KAE7D,MAAM,UAAU,OAAO,eACrB,SACA;MACE;MACA,WAAW,QAAQ,SAAS;MAC5B,QAAQ,QAAQ;KAClB,GACA,KACF;KAEA,OAAO,YAAY,KAAA,KAAa,kBAAkB,QAAQ,UAAU,QAAQ,QAAQ;IACtF,CAAC,CACH,CAAC,CACE,KACC,OAAO,SAAS,YACd,UAAU,qBAAqB,eAAe,KAAK,IAAI,OAAO,QAAQ,KAAK,CAC7E,CACF,CAAC,CACA,KACC,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACJ;GACA,kBAAkB,YAAY,YAC5B,cAAc,SAAS,eAAe,YAAY,kBAAkB,OAAO,CAAC,CAAC,KAC3E,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,kBAAkB,YAAY,YAC5B,cAAc,SAAS,eAAe,YAAY,kBAAkB,OAAO,CAAC,CAAC,KAC3E,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,UAAU,OAAO,YACf,MACE,UACA,eACA,OAAO,IAAI,aAAa;IACtB,MAAM,cAAc,OAAO;IAC3B,MAAM,UAAU,OAAO;IAEvB,MAAM,IAAI,eAAe,OAAO;IAChC,MAAM,MAAM,OAAO;IAEnB,MAAM,OAAO,OAAO,WAClB,YACG,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAClC,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,IAAI,EAAE,gBAAgB,QAAQ,cAAc,GAAG,CAAC,CAClD,CACF,CAAC,CACA,MAAM,MAAM,QAAQ,CAAC,GACxB,cAAc,OAChB;IAEA,MAAM,WAAW,KAAK,MAAM,GAAG,MAAM,KAAK;IAE1C,MAAM,UAAU,QACd;KAAE,SAAS,SAAS;KAAQ,SAAS,KAAK,SAAS,MAAM;IAAM,GAC/D,OACF;IAEA,IAAI,SAAS,SAAS,GACpB,OAAO,YAAY,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,MAC/C,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,QACE,EAAE,WACF,SAAS,KAAK,QAAa,IAAI,SAAS,CAC1C,GACA,IAAI,EAAE,gBAAgB,QAAQ,cAAc,GAAG,CAAC,CAClD,CACF;IAEF,OAAO;GACT,CAAC,CACH,CAAC,CAAC,KACA,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACJ,CAAC;CACH,CAAC;CAED,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,eACA,YACA,QACA,SACA;EACA,MAAM,WAAW,OAAO;EAExB,IAAI,CAAC,wBAAwB,OAAO,KAAK,cAAc,UAAU,KAAA,GAC/D,OAAO,OAAO,YAAY;EAC5B,MAAM,QAAQ,OAAO,sBAAsB,UAAU;EAErD,MAAM,qBAAqB,OAAO,SAChC,cAAc,MACd,QAAQ,sBACR,QAAQ,wBACV;EAEA,MAAM,2BAA2B,OAAO,SACtC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;EAEA,MAAM,2BAA2B,OAAO,SACtC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;EAEA,MAAM,2BAA2B,OAAO,SACtC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;EAEA,MAAM,2BAA2B,OAAO,SACtC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;EAEA,MAAM,mBACJ,WAAW,oBAAoB,MAAM,SAAS,6BAA6B,KAAA;EAE7E,MAAM,eAAe,mBACjB,MAAM,SAAS,SAAS,mBACxB,OAAO,qBACL,SACA,cAAc,MACd,MAAM,SAAS,SAAS,gBAC1B;EAEJ,IACG,CAAC,oBAAoB,iBAAiB,MAAM,SAAS,SAAS,oBAC/D;GACE;GACA;GACA;GACA;EACF,CAAC,CAAC,MAAM,UAAU,MAAM,SAAS,SAAS,YAAY,MAAM,SAAS,KAAK,aAAa,KAAK,CAAC,GAE7F,OAAO,OAAO,YAAY;EAsE5B,OAAO,OApEK,MACV,UACA,eACA,OAAO,IAAI,aAAa;GACtB,MAAM,UAAU,OAAO;GAEvB,MAAM,UAAU,OAAO,uBAAuB,SAAS,eAAe,OAAO,MAAM;GAEnF,IAAI,YAAY,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;GAC7D,KACG,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,WAAW,cAAc,OAAO,EAAA,CAClF,SAAS,GAEZ,OAAO,QAAQ,YAAY,OAAO;GACpC,IAAI;GAEJ,OAAO,oBACL,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MAAM,YACN,OAAO,IAAI,aAAa;IAGtB,MAAM,qBAAqB,OAAO,QAAQ,QAAQ,wBAChD,QAAQ,SACR,MACF;IAEA,MAAM,WAAW,OAAO,qBACtB,MAAM,cAAc,UACpB,MAAM,cAAc,WACtB,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;IAEnC,MAAM,aAAa,OAAO,qBACxB,MAAM,cAAc,UACpB,kBACF,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;IAEnC,IAAI,CAAC,SAAS,aAAa,CAAC,WAAW,WAAW,OAAO;IACzD,MAAM,MAAM,OAAO;IAEnB,OAAO,OAAO,cACZ,SACA,OACA,QACA,SACA;KACE;KACA;KACA;KACA;KACA;KACA,sBAAsB;IACxB,GACA,GACF;GACF,CAAC,IACA,aAAa;IACZ,UAAU,QAAQ,aAAa,cAAc,YAAY,YAAY,OAAO;IAE5E,OAAO;GACT,CACF;GAEA,OAAO,WAAW,QAAQ,YAAY,OAAO;EAC/C,CAAC,CAGa,CAAC,CAAC,KAChB,OAAO,YAAY,UAChB,MAAM,QAAQ,MAAM,MAAM,YAAY,KACrC,2BAA2B,QAAQ,mBAAmB,KAAK,KAC5D,MAAM,QAAQ,MAAM,MAAM,YAAY,KACrC,2BAA2B,QAAQ,sBAAsB,KAAK,KAC/D,MAAM,QAAQ,MAAM,MAAM,YAAY,KACrC,2BAA2B,QAAQ,sBAAsB,KAAK,IAC5D,gBAAgB,eAAe,OAAO,IACtC,OAAO,UAAU,KAAK,CAC5B,CACF;CACF,CAAC;CAED,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF"}

package/dist/internal/mapping-error.d.mts

@@ -0,0 +1,11 @@
+import { Cause, Schema } from "effect";
+//#region src/internal/mapping-error.d.ts
+declare const PersistenceMappingError_base: Schema.Class<PersistenceMappingError, Schema.TaggedStruct<"PersistenceMappingError", {
+  readonly operation: Schema.NonEmptyString;
+  readonly cause: Schema.Defect;
+}>, Cause.YieldableError>;
+declare class PersistenceMappingError extends PersistenceMappingError_base {}
+declare const isMappedConstraintConflict: (classify: (cause: unknown) => boolean, failure: unknown) => boolean;
+//#endregion
+export { PersistenceMappingError, isMappedConstraintConflict };
+//# sourceMappingURL=mapping-error.d.mts.map

package/dist/internal/mapping-error.mjs

@@ -0,0 +1,30 @@
+import { Cause, Schema } from "effect";
+//#region src/internal/mapping-error.ts
+var PersistenceMappingError = class extends Schema.TaggedError()("PersistenceMappingError", {
+	operation: Schema.NonEmptyString,
+	cause: Schema.Defect()
+}) {};
+const isMappedConstraintConflict = (classify, failure) => {
+	const seen = /* @__PURE__ */ new Set();
+	const pending = [failure];
+	for (let inspected = 0; inspected < 24 && pending.length > 0; inspected++) {
+		const current = pending.shift();
+		if (current === void 0 || current === null || seen.has(current)) continue;
+		seen.add(current);
+		if (classify(current)) return true;
+		if (Cause.isCause(current)) {
+			for (const reason of current.reasons) if (Cause.isFailReason(reason)) pending.push(reason.error);
+			else if (Cause.isDieReason(reason)) pending.push(reason.defect);
+			continue;
+		}
+		if (typeof current !== "object") continue;
+		const wrapped = current;
+		if (wrapped.cause !== void 0) pending.push(wrapped.cause);
+		if (wrapped.reason !== void 0) pending.push(wrapped.reason);
+	}
+	return false;
+};
+//#endregion
+export { PersistenceMappingError, isMappedConstraintConflict };
+
+//# sourceMappingURL=mapping-error.mjs.map

package/dist/internal/mapping-error.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"mapping-error.mjs","names":[],"sources":["../../src/internal/mapping-error.ts"],"sourcesContent":["import { Cause, Schema } from \"effect\";\n\nexport class PersistenceMappingError extends Schema.TaggedError<PersistenceMappingError>()(\n  \"PersistenceMappingError\",\n  { operation: Schema.NonEmptyString, cause: Schema.Defect() },\n) {}\n\nexport const isMappedConstraintConflict = (\n  classify: (cause: unknown) => boolean,\n  failure: unknown,\n): boolean => {\n  const seen = new Set<unknown>();\n  const pending: Array<unknown> = [failure];\n\n  for (let inspected = 0; inspected < 24 && pending.length > 0; inspected++) {\n    const current = pending.shift();\n\n    if (current === undefined || current === null || seen.has(current)) continue;\n    seen.add(current);\n    if (classify(current)) return true;\n    if (Cause.isCause(current)) {\n      for (const reason of current.reasons) {\n        if (Cause.isFailReason(reason)) pending.push(reason.error);\n        else if (Cause.isDieReason(reason)) pending.push(reason.defect);\n      }\n      continue;\n    }\n    if (typeof current !== \"object\") continue;\n    const wrapped = current as { readonly cause?: unknown; readonly reason?: unknown };\n\n    if (wrapped.cause !== undefined) pending.push(wrapped.cause);\n    if (wrapped.reason !== undefined) pending.push(wrapped.reason);\n  }\n\n  return false;\n};\n"],"mappings":";;AAEA,IAAa,0BAAb,cAA6C,OAAO,YAAqC,CAAC,CACxF,2BACA;CAAE,WAAW,OAAO;CAAgB,OAAO,OAAO,OAAO;AAAE,CAC7D,CAAC,CAAC,CAAC;AAEH,MAAa,8BACX,UACA,YACY;CACZ,MAAM,uBAAO,IAAI,IAAa;CAC9B,MAAM,UAA0B,CAAC,OAAO;CAExC,KAAK,IAAI,YAAY,GAAG,YAAY,MAAM,QAAQ,SAAS,GAAG,aAAa;EACzE,MAAM,UAAU,QAAQ,MAAM;EAE9B,IAAI,YAAY,KAAA,KAAa,YAAY,QAAQ,KAAK,IAAI,OAAO,GAAG;EACpE,KAAK,IAAI,OAAO;EAChB,IAAI,SAAS,OAAO,GAAG,OAAO;EAC9B,IAAI,MAAM,QAAQ,OAAO,GAAG;GAC1B,KAAK,MAAM,UAAU,QAAQ,SAC3B,IAAI,MAAM,aAAa,MAAM,GAAG,QAAQ,KAAK,OAAO,KAAK;QACpD,IAAI,MAAM,YAAY,MAAM,GAAG,QAAQ,KAAK,OAAO,MAAM;GAEhE;EACF;EACA,IAAI,OAAO,YAAY,UAAU;EACjC,MAAM,UAAU;EAEhB,IAAI,QAAQ,UAAU,KAAA,GAAW,QAAQ,KAAK,QAAQ,KAAK;EAC3D,IAAI,QAAQ,WAAW,KAAA,GAAW,QAAQ,KAAK,QAAQ,MAAM;CAC/D;CAEA,OAAO;AACT"}

package/dist/internal/passkey/admission.d.mts

@@ -0,0 +1,7 @@
+import "../../drizzle/passkey-model.mjs";
+import "../query-operations.mjs";
+import "../transaction-kernel.mjs";
+import "./state.mjs";
+import { Effect } from "effect";
+import { PasskeyCeremony, PasskeyMethodPolicy } from "@yielded/auth/Passkey";
+import { SQL } from "drizzle-orm";

package/dist/internal/passkey/admission.mjs

@@ -0,0 +1,216 @@
+import { CurrentPasskeyTransaction } from "./state.mjs";
+import { Effect } from "effect";
+//#region src/internal/passkey/admission.ts
+const makePasskeyAdmissionKernel = (operations, state, transactions) => {
+	const { sql } = operations;
+	const { col, equal, existsExact, key, mappedColumns, subjectScope, targetScope } = state;
+	const invariant = state.invariant;
+	const { both } = transactions;
+	const chargeRetentionMillis = 864e5;
+	const chargeScopes = (ceremony, subjectId) => {
+		const scopes = [{
+			kind: "global",
+			scope: key("global", [ceremony.moduleId])
+		}];
+		if (subjectId !== void 0) scopes.push({
+			kind: "subject",
+			scope: subjectScope(subjectId)
+		});
+		const target = targetScope(ceremony);
+		if (target !== null) scopes.push({
+			kind: "target",
+			scope: target
+		});
+		return scopes;
+	};
+	const lockAdmission = Effect.fn("passkey.lockAdmission")(function* (mapping) {
+		const owner = yield* CurrentPasskeyTransaction;
+		const table = mapping.admission;
+		const identity = {
+			[table.authorityScope]: mapping.authorityScope,
+			[table.moduleId]: mapping.moduleId
+		};
+		const found = yield* owner.read(table.table, equal(table.table, identity), {
+			limit: 1,
+			observe: false,
+			columns: [table.authorityScope, table.moduleId]
+		});
+		invariant(found.rows.length === 1);
+		invariant(found.rows[0][table.authorityScope] === mapping.authorityScope && found.rows[0][table.moduleId] === mapping.moduleId);
+		const marked = {
+			...identity,
+			[table.version]: owner.marker,
+			[table.ownerMarker]: owner.marker
+		};
+		yield* owner.updateGuarded(table.table, owner.exact(table.table, identity), {
+			[table.version]: owner.marker,
+			[table.ownerMarker]: owner.marker,
+			[table.admittedAt]: null
+		}, {
+			rows: 1,
+			postcondition: yield* existsExact(table.table, marked)
+		});
+	});
+	const pendingCount = (mapping, scope) => {
+		const table = mapping.flow;
+		return sql`(select count(*) from ${table.table} where ${both(equal(table.table, { [table.moduleId]: mapping.moduleId }), sql`${col(table.table, table.state)} in (${table.states.Pending}, ${table.states.Claimed})`, scope === void 0 ? void 0 : equal(table.table, { [table.subjectScope]: scope }))})`;
+	};
+	const chargedCount = (mapping, kind, scope, window) => {
+		const table = mapping.charge;
+		const clock = mapping.clock;
+		return sql`(select count(*) from ${table.table} where ${both(equal(table.table, {
+			[table.moduleId]: mapping.moduleId,
+			[table.kind]: kind
+		}), kind === "global" ? void 0 : equal(table.table, { [table.scope]: scope }), sql`${col(table.table, table.admittedAt)} is not null`, sql`${clock.toMillis(sql`${col(table.table, table.admittedAt)}`)} > ${clock.engineNowMillis} - ${window}`)})`;
+	};
+	const admissionCondition = (mapping, policies, ceremony, subjectId, added, newFlow, resolvedSubject) => both(...policies.flatMap((policy) => [
+		sql`${pendingCount(mapping)} + ${newFlow ? 1 : 0} <= ${policy.maximumPending}`,
+		subjectId === void 0 ? void 0 : sql`${pendingCount(mapping, subjectScope(subjectId))} + ${newFlow || resolvedSubject ? 1 : 0} <= ${policy.maximumPendingPerSubject}`,
+		...chargeScopes(ceremony, subjectId).map(({ kind, scope }) => sql`${chargedCount(mapping, kind, scope, policy.admission[kind].windowMillis)} + ${added.includes(kind) ? 1 : 0} <= ${policy.admission[kind].limit}`)
+	]));
+	const guardAdmission = (mapping, policies, ceremony, subjectId) => Effect.map(CurrentPasskeyTransaction, (owner) => {
+		owner.postconditions.push(admissionCondition(mapping, policies, ceremony, subjectId, [], false, false));
+	});
+	const readCharges = Effect.fn("passkey.readCharges")(function* (mapping, ceremony, policy, subjectId) {
+		const owner = yield* CurrentPasskeyTransaction;
+		const table = mapping.charge;
+		const where = equal(table.table, {
+			[table.moduleId]: ceremony.moduleId,
+			[table.flowId]: ceremony.flowId
+		});
+		const found = yield* owner.read(table.table, where, {
+			limit: 3,
+			observe: false,
+			columns: mappedColumns(table)
+		});
+		const scopes = chargeScopes(ceremony, subjectId);
+		invariant(found.rows.length === scopes.length);
+		for (const { kind, scope } of scopes) {
+			const rows = found.rows.filter((row) => row[table.kind] === kind);
+			invariant(rows.length === 1);
+			const row = rows[0];
+			const admitted = mapping.clock.decodeInstant(row[table.admittedAt]);
+			const retained = mapping.clock.decodeInstant(row[table.retainUntil]);
+			invariant(Number.isSafeInteger(admitted) && admitted >= 0 && retained === admitted + chargeRetentionMillis);
+			invariant(row[table.moduleId] === ceremony.moduleId && row[table.flowId] === ceremony.flowId && row[table.purpose] === ceremony.purpose);
+			invariant(row[table.scope] === scope && row[table.originalWindowMillis] === policy.admission[kind].windowMillis);
+			owner.observations.push({
+				table: table.table,
+				where: equal(table.table, {
+					[table.moduleId]: ceremony.moduleId,
+					[table.flowId]: ceremony.flowId,
+					[table.kind]: kind
+				}),
+				rows: [row]
+			});
+		}
+	});
+	const guardChargeSet = (mapping, ceremony, subjectId) => Effect.flatMap(CurrentPasskeyTransaction, (owner) => Effect.gen(function* () {
+		const table = mapping.charge;
+		const scopes = chargeScopes(ceremony, subjectId);
+		const where = equal(table.table, {
+			[table.moduleId]: ceremony.moduleId,
+			[table.flowId]: ceremony.flowId
+		});
+		owner.postconditions.push(sql`(select count(*) from ${table.table} where ${where}) = ${scopes.length}`);
+		for (const { kind, scope } of scopes) owner.postconditions.push(yield* existsExact(table.table, {
+			[table.moduleId]: ceremony.moduleId,
+			[table.flowId]: ceremony.flowId,
+			[table.purpose]: ceremony.purpose,
+			[table.kind]: kind,
+			[table.scope]: scope
+		}));
+	}));
+	return {
+		chargeRetentionMillis,
+		chargeScopes,
+		lockAdmission,
+		admissionCondition,
+		guardAdmission,
+		readCharges,
+		guardChargeSet,
+		insertCharges: Effect.fn("passkey.insertCharges")(function* (mapping, ceremony, policy, kinds, subjectId) {
+			const owner = yield* CurrentPasskeyTransaction;
+			if (kinds.length === 0) return;
+			const table = mapping.charge;
+			const anchor = mapping.admission;
+			const clock = mapping.clock;
+			const earliest = yield* owner.now(clock);
+			const identities = [];
+			for (const { kind, scope } of chargeScopes(ceremony, subjectId).filter((item) => kinds.includes(item.kind))) {
+				const identity = {
+					[table.moduleId]: ceremony.moduleId,
+					[table.flowId]: ceremony.flowId,
+					[table.kind]: kind
+				};
+				const values = {
+					...table.encodeInsert({
+						moduleId: ceremony.moduleId,
+						flowId: ceremony.flowId,
+						purpose: ceremony.purpose,
+						kind,
+						scope,
+						originalWindowMillis: policy.admission[kind].windowMillis,
+						marker: owner.marker
+					}),
+					...identity,
+					[table.purpose]: ceremony.purpose,
+					[table.scope]: scope,
+					[table.originalWindowMillis]: policy.admission[kind].windowMillis,
+					[table.admittedAt]: null,
+					[table.retainUntil]: null,
+					[table.version]: owner.marker,
+					[table.ownerMarker]: owner.marker
+				};
+				const observation = yield* owner.insert(table.table, values, identity);
+				observation.rows = observation.rows.map((row) => Object.fromEntries(Object.entries(row).filter(([name]) => name !== table.admittedAt && name !== table.retainUntil)));
+				identities.push(identity);
+			}
+			invariant(identities.length === kinds.length);
+			const anchorIdentity = {
+				[anchor.authorityScope]: mapping.authorityScope,
+				[anchor.moduleId]: mapping.moduleId,
+				[anchor.version]: owner.marker,
+				[anchor.ownerMarker]: owner.marker
+			};
+			const stamp = sql`(select ${col(anchor.table, anchor.admittedAt)} from ${anchor.table} where ${owner.exact(anchor.table, anchorIdentity)})`;
+			const stampMillis = clock.toMillis(stamp);
+			const validStamp = both(yield* existsExact(anchor.table, anchorIdentity), sql`${stamp} is not null`, sql`${stampMillis} >= ${earliest}`, sql`${stampMillis} <= ${clock.engineNowMillis}`, sql`${stampMillis} <= ${86399999136e5}`);
+			yield* owner.finalUpdate(anchor.table, owner.exact(anchor.table, {
+				...anchorIdentity,
+				[anchor.admittedAt]: null
+			}), { [anchor.admittedAt]: clock.fromMillis(clock.engineNowMillis) }, {
+				rows: 1,
+				postcondition: validStamp
+			});
+			for (const identity of identities) {
+				const expected = {
+					...identity,
+					[table.version]: owner.marker,
+					[table.ownerMarker]: owner.marker
+				};
+				const postcondition = yield* existsExact(table.table, expected, both(sql`${clock.toMillis(sql`${col(table.table, table.admittedAt)}`)} = ${stampMillis}`, sql`${clock.toMillis(sql`${col(table.table, table.retainUntil)}`)} = ${stampMillis} + ${chargeRetentionMillis}`));
+				yield* owner.finalUpdate(table.table, owner.exact(table.table, {
+					...expected,
+					[table.admittedAt]: null,
+					[table.retainUntil]: null
+				}), {
+					[table.admittedAt]: stamp,
+					[table.retainUntil]: clock.fromMillis(sql`${stampMillis} + ${chargeRetentionMillis}`)
+				}, {
+					rows: 1,
+					postcondition
+				});
+			}
+			owner.postconditions.push(sql`(select count(*) from ${table.table} where ${owner.exact(table.table, {
+				[table.moduleId]: ceremony.moduleId,
+				[table.flowId]: ceremony.flowId,
+				[table.ownerMarker]: owner.marker
+			})}) = ${identities.length}`);
+		})
+	};
+};
+//#endregion
+export { makePasskeyAdmissionKernel };
+
+//# sourceMappingURL=admission.mjs.map

package/dist/internal/passkey/admission.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"admission.mjs","names":[],"sources":["../../../src/internal/passkey/admission.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- existing mapped-row bridge; public adapters preserve table, ID, and Effect types. */\n\nimport type { PasskeyCeremony, PasskeyMethodPolicy } from \"@yielded/auth/Passkey\";\nimport type { SQL } from \"drizzle-orm\";\nimport { Effect } from \"effect\";\n\nimport type { PasskeyChargeKind } from \"../../drizzle/passkey-model\";\nimport type { QueryOperations } from \"../query-operations\";\nimport type { makeTransactionKernel } from \"../transaction-kernel\";\nimport { CurrentPasskeyTransaction } from \"./state\";\nimport type { makePasskeyStateKernel } from \"./state\";\n\nexport const makePasskeyAdmissionKernel = (\n  operations: QueryOperations,\n  state: Pick<\n    ReturnType<typeof makePasskeyStateKernel>,\n    | \"col\"\n    | \"equal\"\n    | \"existsExact\"\n    | \"invariant\"\n    | \"key\"\n    | \"mappedColumns\"\n    | \"subjectScope\"\n    | \"targetScope\"\n  >,\n  transactions: Pick<ReturnType<typeof makeTransactionKernel>, \"both\">,\n) => {\n  const { sql } = operations;\n  const { col, equal, existsExact, key, mappedColumns, subjectScope, targetScope } = state;\n  const invariant: (value: unknown) => asserts value = state.invariant;\n  const { both } = transactions;\n\n  const chargeRetentionMillis = 86_400_000;\n\n  const chargeScopes = (ceremony: PasskeyCeremony, subjectId?: string) => {\n    const scopes: { kind: PasskeyChargeKind; scope: string }[] = [\n      { kind: \"global\", scope: key(\"global\", [ceremony.moduleId]) },\n    ];\n\n    if (subjectId !== undefined) scopes.push({ kind: \"subject\", scope: subjectScope(subjectId) });\n    const target = targetScope(ceremony);\n\n    if (target !== null) scopes.push({ kind: \"target\", scope: target });\n\n    return scopes;\n  };\n\n  const lockAdmission = Effect.fn(\"passkey.lockAdmission\")(function* (mapping: any) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const table = mapping.admission;\n\n    const identity = {\n      [table.authorityScope]: mapping.authorityScope,\n      [table.moduleId]: mapping.moduleId,\n    };\n\n    // The previous marker/time is telemetry, not an authentication CAS. Actual\n    // engine predicates serialize admission, including separately planned D1 batches.\n    const found = yield* owner.read(table.table, equal(table.table, identity), {\n      limit: 1,\n      observe: false,\n      columns: [table.authorityScope, table.moduleId],\n    });\n\n    invariant(found.rows.length === 1);\n    invariant(\n      found.rows[0]![table.authorityScope] === mapping.authorityScope &&\n        found.rows[0]![table.moduleId] === mapping.moduleId,\n    );\n\n    const marked = {\n      ...identity,\n      [table.version]: owner.marker,\n      [table.ownerMarker]: owner.marker,\n    };\n\n    yield* owner.updateGuarded(\n      table.table,\n      owner.exact(table.table, identity),\n      {\n        [table.version]: owner.marker,\n        [table.ownerMarker]: owner.marker,\n        [table.admittedAt]: null,\n      },\n      { rows: 1, postcondition: yield* existsExact(table.table, marked) },\n    );\n  });\n\n  const pendingCount = (mapping: any, scope?: string) => {\n    const table = mapping.flow;\n\n    return sql`(select count(*) from ${table.table} where ${both(\n      equal(table.table, { [table.moduleId]: mapping.moduleId }),\n      sql`${col(table.table, table.state)} in (${table.states.Pending}, ${table.states.Claimed})`,\n      scope === undefined ? undefined : equal(table.table, { [table.subjectScope]: scope }),\n    )})`;\n  };\n\n  const chargedCount = (mapping: any, kind: PasskeyChargeKind, scope: string, window: number) => {\n    const table = mapping.charge;\n    const clock = mapping.clock;\n\n    return sql`(select count(*) from ${table.table} where ${both(\n      equal(table.table, { [table.moduleId]: mapping.moduleId, [table.kind]: kind }),\n      kind === \"global\" ? undefined : equal(table.table, { [table.scope]: scope }),\n      sql`${col(table.table, table.admittedAt)} is not null`,\n      sql`${clock.toMillis(sql`${col(table.table, table.admittedAt)}`)} > ${clock.engineNowMillis} - ${window}`,\n    )})`;\n  };\n\n  const admissionCondition = (\n    mapping: any,\n    policies: ReadonlyArray<PasskeyMethodPolicy>,\n    ceremony: PasskeyCeremony,\n    subjectId: string | undefined,\n    added: ReadonlyArray<PasskeyChargeKind>,\n    newFlow: boolean,\n    resolvedSubject: boolean,\n  ) =>\n    both(\n      ...policies.flatMap((policy) => [\n        sql`${pendingCount(mapping)} + ${newFlow ? 1 : 0} <= ${policy.maximumPending}`,\n        subjectId === undefined\n          ? undefined\n          : sql`${pendingCount(mapping, subjectScope(subjectId))} + ${newFlow || resolvedSubject ? 1 : 0} <= ${policy.maximumPendingPerSubject}`,\n        ...chargeScopes(ceremony, subjectId).map(\n          ({ kind, scope }) =>\n            sql`${chargedCount(mapping, kind, scope, policy.admission[kind].windowMillis)} + ${added.includes(kind) ? 1 : 0} <= ${policy.admission[kind].limit}`,\n        ),\n      ]),\n    );\n\n  const guardAdmission = (\n    mapping: any,\n    policies: ReadonlyArray<PasskeyMethodPolicy>,\n    ceremony: PasskeyCeremony,\n    subjectId?: string,\n  ) =>\n    Effect.map(CurrentPasskeyTransaction, (owner) => {\n      owner.postconditions.push(\n        admissionCondition(mapping, policies, ceremony, subjectId, [], false, false),\n      );\n    });\n\n  const readCharges = Effect.fn(\"passkey.readCharges\")(function* (\n    mapping: any,\n    ceremony: PasskeyCeremony,\n    policy: PasskeyMethodPolicy,\n    subjectId?: string,\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const table = mapping.charge;\n\n    const where = equal(table.table, {\n      [table.moduleId]: ceremony.moduleId,\n      [table.flowId]: ceremony.flowId,\n    });\n\n    const found = yield* owner.read(table.table, where, {\n      limit: 3,\n      observe: false,\n      columns: mappedColumns(table),\n    });\n\n    const scopes = chargeScopes(ceremony, subjectId);\n\n    invariant(found.rows.length === scopes.length);\n    for (const { kind, scope } of scopes) {\n      const rows = found.rows.filter((row) => row[table.kind] === kind);\n\n      invariant(rows.length === 1);\n      const row = rows[0]!;\n      const admitted = mapping.clock.decodeInstant(row[table.admittedAt]);\n      const retained = mapping.clock.decodeInstant(row[table.retainUntil]);\n\n      invariant(\n        Number.isSafeInteger(admitted) &&\n          admitted >= 0 &&\n          retained === admitted + chargeRetentionMillis,\n      );\n      invariant(\n        row[table.moduleId] === ceremony.moduleId &&\n          row[table.flowId] === ceremony.flowId &&\n          row[table.purpose] === ceremony.purpose,\n      );\n      invariant(\n        row[table.scope] === scope &&\n          row[table.originalWindowMillis] === policy.admission[kind].windowMillis,\n      );\n      owner.observations.push({\n        table: table.table,\n        where: equal(table.table, {\n          [table.moduleId]: ceremony.moduleId,\n          [table.flowId]: ceremony.flowId,\n          [table.kind]: kind,\n        }),\n        rows: [row],\n      });\n    }\n  });\n\n  const guardChargeSet = (mapping: any, ceremony: PasskeyCeremony, subjectId?: string) =>\n    Effect.flatMap(CurrentPasskeyTransaction, (owner) =>\n      Effect.gen(function* () {\n        const table = mapping.charge;\n        const scopes = chargeScopes(ceremony, subjectId);\n\n        const where = equal(table.table, {\n          [table.moduleId]: ceremony.moduleId,\n          [table.flowId]: ceremony.flowId,\n        });\n\n        owner.postconditions.push(\n          sql`(select count(*) from ${table.table} where ${where}) = ${scopes.length}`,\n        );\n        for (const { kind, scope } of scopes)\n          owner.postconditions.push(\n            yield* existsExact(table.table, {\n              [table.moduleId]: ceremony.moduleId,\n              [table.flowId]: ceremony.flowId,\n              [table.purpose]: ceremony.purpose,\n              [table.kind]: kind,\n              [table.scope]: scope,\n            }),\n          );\n      }),\n    );\n\n  const insertCharges = Effect.fn(\"passkey.insertCharges\")(function* (\n    mapping: any,\n    ceremony: PasskeyCeremony,\n    policy: PasskeyMethodPolicy,\n    kinds: ReadonlyArray<PasskeyChargeKind>,\n    subjectId?: string,\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n\n    if (kinds.length === 0) return;\n    const table = mapping.charge;\n    const anchor = mapping.admission;\n    const clock = mapping.clock;\n    const earliest = yield* owner.now(clock);\n    const identities: Record<string, unknown>[] = [];\n\n    for (const { kind, scope } of chargeScopes(ceremony, subjectId).filter((item) =>\n      kinds.includes(item.kind),\n    )) {\n      const identity = {\n        [table.moduleId]: ceremony.moduleId,\n        [table.flowId]: ceremony.flowId,\n        [table.kind]: kind,\n      };\n\n      const values = {\n        ...table.encodeInsert({\n          moduleId: ceremony.moduleId,\n          flowId: ceremony.flowId,\n          purpose: ceremony.purpose,\n          kind,\n          scope,\n          originalWindowMillis: policy.admission[kind].windowMillis,\n          marker: owner.marker,\n        }),\n        ...identity,\n        [table.purpose]: ceremony.purpose,\n        [table.scope]: scope,\n        [table.originalWindowMillis]: policy.admission[kind].windowMillis,\n        [table.admittedAt]: null,\n        [table.retainUntil]: null,\n        [table.version]: owner.marker,\n        [table.ownerMarker]: owner.marker,\n      };\n\n      const observation = yield* owner.insert(table.table, values, identity);\n\n      observation.rows = observation.rows.map((row) =>\n        Object.fromEntries(\n          Object.entries(row).filter(\n            ([name]) => name !== table.admittedAt && name !== table.retainUntil,\n          ),\n        ),\n      );\n      identities.push(identity);\n    }\n    invariant(identities.length === kinds.length);\n\n    const anchorIdentity = {\n      [anchor.authorityScope]: mapping.authorityScope,\n      [anchor.moduleId]: mapping.moduleId,\n      [anchor.version]: owner.marker,\n      [anchor.ownerMarker]: owner.marker,\n    };\n\n    const stamp = sql`(select ${col(anchor.table, anchor.admittedAt)} from ${anchor.table} where ${owner.exact(anchor.table, anchorIdentity)})`;\n    const stampMillis = clock.toMillis(stamp);\n\n    const validStamp: SQL = both(\n      yield* existsExact(anchor.table, anchorIdentity),\n      sql`${stamp} is not null`,\n      sql`${stampMillis} >= ${earliest}`,\n      sql`${stampMillis} <= ${clock.engineNowMillis}`,\n      sql`${stampMillis} <= ${8640000000000000 - chargeRetentionMillis}`,\n    );\n\n    yield* owner.finalUpdate(\n      anchor.table,\n      owner.exact(anchor.table, { ...anchorIdentity, [anchor.admittedAt]: null }),\n      {\n        [anchor.admittedAt]: clock.fromMillis(clock.engineNowMillis),\n      },\n      { rows: 1, postcondition: validStamp },\n    );\n    for (const identity of identities) {\n      const expected = {\n        ...identity,\n        [table.version]: owner.marker,\n        [table.ownerMarker]: owner.marker,\n      };\n\n      const postcondition = yield* existsExact(\n        table.table,\n        expected,\n        both(\n          sql`${clock.toMillis(sql`${col(table.table, table.admittedAt)}`)} = ${stampMillis}`,\n          sql`${clock.toMillis(sql`${col(table.table, table.retainUntil)}`)} = ${stampMillis} + ${chargeRetentionMillis}`,\n        ),\n      );\n\n      yield* owner.finalUpdate(\n        table.table,\n        owner.exact(table.table, {\n          ...expected,\n          [table.admittedAt]: null,\n          [table.retainUntil]: null,\n        }),\n        {\n          [table.admittedAt]: stamp,\n          [table.retainUntil]: clock.fromMillis(sql`${stampMillis} + ${chargeRetentionMillis}`),\n        },\n        { rows: 1, postcondition },\n      );\n    }\n    owner.postconditions.push(\n      sql`(select count(*) from ${table.table} where ${owner.exact(table.table, {\n        [table.moduleId]: ceremony.moduleId,\n        [table.flowId]: ceremony.flowId,\n        [table.ownerMarker]: owner.marker,\n      })}) = ${identities.length}`,\n    );\n  });\n\n  return {\n    chargeRetentionMillis,\n    chargeScopes,\n    lockAdmission,\n    admissionCondition,\n    guardAdmission,\n    readCharges,\n    guardChargeSet,\n    insertCharges,\n  };\n};\n"],"mappings":";;;AAYA,MAAa,8BACX,YACA,OAWA,iBACG;CACH,MAAM,EAAE,QAAQ;CAChB,MAAM,EAAE,KAAK,OAAO,aAAa,KAAK,eAAe,cAAc,gBAAgB;CACnF,MAAM,YAA+C,MAAM;CAC3D,MAAM,EAAE,SAAS;CAEjB,MAAM,wBAAwB;CAE9B,MAAM,gBAAgB,UAA2B,cAAuB;EACtE,MAAM,SAAuD,CAC3D;GAAE,MAAM;GAAU,OAAO,IAAI,UAAU,CAAC,SAAS,QAAQ,CAAC;EAAE,CAC9D;EAEA,IAAI,cAAc,KAAA,GAAW,OAAO,KAAK;GAAE,MAAM;GAAW,OAAO,aAAa,SAAS;EAAE,CAAC;EAC5F,MAAM,SAAS,YAAY,QAAQ;EAEnC,IAAI,WAAW,MAAM,OAAO,KAAK;GAAE,MAAM;GAAU,OAAO;EAAO,CAAC;EAElE,OAAO;CACT;CAEA,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WAAW,SAAc;EAChF,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,QAAQ;EAEtB,MAAM,WAAW;IACd,MAAM,iBAAiB,QAAQ;IAC/B,MAAM,WAAW,QAAQ;EAC5B;EAIA,MAAM,QAAQ,OAAO,MAAM,KAAK,MAAM,OAAO,MAAM,MAAM,OAAO,QAAQ,GAAG;GACzE,OAAO;GACP,SAAS;GACT,SAAS,CAAC,MAAM,gBAAgB,MAAM,QAAQ;EAChD,CAAC;EAED,UAAU,MAAM,KAAK,WAAW,CAAC;EACjC,UACE,MAAM,KAAK,EAAE,CAAE,MAAM,oBAAoB,QAAQ,kBAC/C,MAAM,KAAK,EAAE,CAAE,MAAM,cAAc,QAAQ,QAC/C;EAEA,MAAM,SAAS;GACb,GAAG;IACF,MAAM,UAAU,MAAM;IACtB,MAAM,cAAc,MAAM;EAC7B;EAEA,OAAO,MAAM,cACX,MAAM,OACN,MAAM,MAAM,MAAM,OAAO,QAAQ,GACjC;IACG,MAAM,UAAU,MAAM;IACtB,MAAM,cAAc,MAAM;IAC1B,MAAM,aAAa;EACtB,GACA;GAAE,MAAM;GAAG,eAAe,OAAO,YAAY,MAAM,OAAO,MAAM;EAAE,CACpE;CACF,CAAC;CAED,MAAM,gBAAgB,SAAc,UAAmB;EACrD,MAAM,QAAQ,QAAQ;EAEtB,OAAO,GAAG,yBAAyB,MAAM,MAAM,SAAS,KACtD,MAAM,MAAM,OAAO,GAAG,MAAM,WAAW,QAAQ,SAAS,CAAC,GACzD,GAAG,GAAG,IAAI,MAAM,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,OAAO,QAAQ,IAAI,MAAM,OAAO,QAAQ,IACzF,UAAU,KAAA,IAAY,KAAA,IAAY,MAAM,MAAM,OAAO,GAAG,MAAM,eAAe,MAAM,CAAC,CACtF,EAAE;CACJ;CAEA,MAAM,gBAAgB,SAAc,MAAyB,OAAe,WAAmB;EAC7F,MAAM,QAAQ,QAAQ;EACtB,MAAM,QAAQ,QAAQ;EAEtB,OAAO,GAAG,yBAAyB,MAAM,MAAM,SAAS,KACtD,MAAM,MAAM,OAAO;IAAG,MAAM,WAAW,QAAQ;IAAW,MAAM,OAAO;EAAK,CAAC,GAC7E,SAAS,WAAW,KAAA,IAAY,MAAM,MAAM,OAAO,GAAG,MAAM,QAAQ,MAAM,CAAC,GAC3E,GAAG,GAAG,IAAI,MAAM,OAAO,MAAM,UAAU,EAAE,eACzC,GAAG,GAAG,MAAM,SAAS,GAAG,GAAG,IAAI,MAAM,OAAO,MAAM,UAAU,GAAG,EAAE,KAAK,MAAM,gBAAgB,KAAK,QACnG,EAAE;CACJ;CAEA,MAAM,sBACJ,SACA,UACA,UACA,WACA,OACA,SACA,oBAEA,KACE,GAAG,SAAS,SAAS,WAAW;EAC9B,GAAG,GAAG,aAAa,OAAO,EAAE,KAAK,UAAU,IAAI,EAAE,MAAM,OAAO;EAC9D,cAAc,KAAA,IACV,KAAA,IACA,GAAG,GAAG,aAAa,SAAS,aAAa,SAAS,CAAC,EAAE,KAAK,WAAW,kBAAkB,IAAI,EAAE,MAAM,OAAO;EAC9G,GAAG,aAAa,UAAU,SAAS,CAAC,CAAC,KAClC,EAAE,MAAM,YACP,GAAG,GAAG,aAAa,SAAS,MAAM,OAAO,OAAO,UAAU,KAAK,CAAC,YAAY,EAAE,KAAK,MAAM,SAAS,IAAI,IAAI,IAAI,EAAE,MAAM,OAAO,UAAU,KAAK,CAAC,OACjJ;CACF,CAAC,CACH;CAEF,MAAM,kBACJ,SACA,UACA,UACA,cAEA,OAAO,IAAI,4BAA4B,UAAU;EAC/C,MAAM,eAAe,KACnB,mBAAmB,SAAS,UAAU,UAAU,WAAW,CAAC,GAAG,OAAO,KAAK,CAC7E;CACF,CAAC;CAEH,MAAM,cAAc,OAAO,GAAG,qBAAqB,CAAC,CAAC,WACnD,SACA,UACA,QACA,WACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,QAAQ;EAEtB,MAAM,QAAQ,MAAM,MAAM,OAAO;IAC9B,MAAM,WAAW,SAAS;IAC1B,MAAM,SAAS,SAAS;EAC3B,CAAC;EAED,MAAM,QAAQ,OAAO,MAAM,KAAK,MAAM,OAAO,OAAO;GAClD,OAAO;GACP,SAAS;GACT,SAAS,cAAc,KAAK;EAC9B,CAAC;EAED,MAAM,SAAS,aAAa,UAAU,SAAS;EAE/C,UAAU,MAAM,KAAK,WAAW,OAAO,MAAM;EAC7C,KAAK,MAAM,EAAE,MAAM,WAAW,QAAQ;GACpC,MAAM,OAAO,MAAM,KAAK,QAAQ,QAAQ,IAAI,MAAM,UAAU,IAAI;GAEhE,UAAU,KAAK,WAAW,CAAC;GAC3B,MAAM,MAAM,KAAK;GACjB,MAAM,WAAW,QAAQ,MAAM,cAAc,IAAI,MAAM,WAAW;GAClE,MAAM,WAAW,QAAQ,MAAM,cAAc,IAAI,MAAM,YAAY;GAEnE,UACE,OAAO,cAAc,QAAQ,KAC3B,YAAY,KACZ,aAAa,WAAW,qBAC5B;GACA,UACE,IAAI,MAAM,cAAc,SAAS,YAC/B,IAAI,MAAM,YAAY,SAAS,UAC/B,IAAI,MAAM,aAAa,SAAS,OACpC;GACA,UACE,IAAI,MAAM,WAAW,SACnB,IAAI,MAAM,0BAA0B,OAAO,UAAU,KAAK,CAAC,YAC/D;GACA,MAAM,aAAa,KAAK;IACtB,OAAO,MAAM;IACb,OAAO,MAAM,MAAM,OAAO;MACvB,MAAM,WAAW,SAAS;MAC1B,MAAM,SAAS,SAAS;MACxB,MAAM,OAAO;IAChB,CAAC;IACD,MAAM,CAAC,GAAG;GACZ,CAAC;EACH;CACF,CAAC;CAED,MAAM,kBAAkB,SAAc,UAA2B,cAC/D,OAAO,QAAQ,4BAA4B,UACzC,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,QAAQ;EACtB,MAAM,SAAS,aAAa,UAAU,SAAS;EAE/C,MAAM,QAAQ,MAAM,MAAM,OAAO;IAC9B,MAAM,WAAW,SAAS;IAC1B,MAAM,SAAS,SAAS;EAC3B,CAAC;EAED,MAAM,eAAe,KACnB,GAAG,yBAAyB,MAAM,MAAM,SAAS,MAAM,MAAM,OAAO,QACtE;EACA,KAAK,MAAM,EAAE,MAAM,WAAW,QAC5B,MAAM,eAAe,KACnB,OAAO,YAAY,MAAM,OAAO;IAC7B,MAAM,WAAW,SAAS;IAC1B,MAAM,SAAS,SAAS;IACxB,MAAM,UAAU,SAAS;IACzB,MAAM,OAAO;IACb,MAAM,QAAQ;EACjB,CAAC,CACH;CACJ,CAAC,CACH;CA6HF,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA,eAnIoB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,UACA,QACA,OACA,WACA;GACA,MAAM,QAAQ,OAAO;GAErB,IAAI,MAAM,WAAW,GAAG;GACxB,MAAM,QAAQ,QAAQ;GACtB,MAAM,SAAS,QAAQ;GACvB,MAAM,QAAQ,QAAQ;GACtB,MAAM,WAAW,OAAO,MAAM,IAAI,KAAK;GACvC,MAAM,aAAwC,CAAC;GAE/C,KAAK,MAAM,EAAE,MAAM,WAAW,aAAa,UAAU,SAAS,CAAC,CAAC,QAAQ,SACtE,MAAM,SAAS,KAAK,IAAI,CAC1B,GAAG;IACD,MAAM,WAAW;MACd,MAAM,WAAW,SAAS;MAC1B,MAAM,SAAS,SAAS;MACxB,MAAM,OAAO;IAChB;IAEA,MAAM,SAAS;KACb,GAAG,MAAM,aAAa;MACpB,UAAU,SAAS;MACnB,QAAQ,SAAS;MACjB,SAAS,SAAS;MAClB;MACA;MACA,sBAAsB,OAAO,UAAU,KAAK,CAAC;MAC7C,QAAQ,MAAM;KAChB,CAAC;KACD,GAAG;MACF,MAAM,UAAU,SAAS;MACzB,MAAM,QAAQ;MACd,MAAM,uBAAuB,OAAO,UAAU,KAAK,CAAC;MACpD,MAAM,aAAa;MACnB,MAAM,cAAc;MACpB,MAAM,UAAU,MAAM;MACtB,MAAM,cAAc,MAAM;IAC7B;IAEA,MAAM,cAAc,OAAO,MAAM,OAAO,MAAM,OAAO,QAAQ,QAAQ;IAErE,YAAY,OAAO,YAAY,KAAK,KAAK,QACvC,OAAO,YACL,OAAO,QAAQ,GAAG,CAAC,CAAC,QACjB,CAAC,UAAU,SAAS,MAAM,cAAc,SAAS,MAAM,WAC1D,CACF,CACF;IACA,WAAW,KAAK,QAAQ;GAC1B;GACA,UAAU,WAAW,WAAW,MAAM,MAAM;GAE5C,MAAM,iBAAiB;KACpB,OAAO,iBAAiB,QAAQ;KAChC,OAAO,WAAW,QAAQ;KAC1B,OAAO,UAAU,MAAM;KACvB,OAAO,cAAc,MAAM;GAC9B;GAEA,MAAM,QAAQ,GAAG,WAAW,IAAI,OAAO,OAAO,OAAO,UAAU,EAAE,QAAQ,OAAO,MAAM,SAAS,MAAM,MAAM,OAAO,OAAO,cAAc,EAAE;GACzI,MAAM,cAAc,MAAM,SAAS,KAAK;GAExC,MAAM,aAAkB,KACtB,OAAO,YAAY,OAAO,OAAO,cAAc,GAC/C,GAAG,GAAG,MAAM,eACZ,GAAG,GAAG,YAAY,MAAM,YACxB,GAAG,GAAG,YAAY,MAAM,MAAM,mBAC9B,GAAG,GAAG,YAAY,MAAM,eAC1B;GAEA,OAAO,MAAM,YACX,OAAO,OACP,MAAM,MAAM,OAAO,OAAO;IAAE,GAAG;KAAiB,OAAO,aAAa;GAAK,CAAC,GAC1E,GACG,OAAO,aAAa,MAAM,WAAW,MAAM,eAAe,EAC7D,GACA;IAAE,MAAM;IAAG,eAAe;GAAW,CACvC;GACA,KAAK,MAAM,YAAY,YAAY;IACjC,MAAM,WAAW;KACf,GAAG;MACF,MAAM,UAAU,MAAM;MACtB,MAAM,cAAc,MAAM;IAC7B;IAEA,MAAM,gBAAgB,OAAO,YAC3B,MAAM,OACN,UACA,KACE,GAAG,GAAG,MAAM,SAAS,GAAG,GAAG,IAAI,MAAM,OAAO,MAAM,UAAU,GAAG,EAAE,KAAK,eACtE,GAAG,GAAG,MAAM,SAAS,GAAG,GAAG,IAAI,MAAM,OAAO,MAAM,WAAW,GAAG,EAAE,KAAK,YAAY,KAAK,uBAC1F,CACF;IAEA,OAAO,MAAM,YACX,MAAM,OACN,MAAM,MAAM,MAAM,OAAO;KACvB,GAAG;MACF,MAAM,aAAa;MACnB,MAAM,cAAc;IACvB,CAAC,GACD;MACG,MAAM,aAAa;MACnB,MAAM,cAAc,MAAM,WAAW,GAAG,GAAG,YAAY,KAAK,uBAAuB;IACtF,GACA;KAAE,MAAM;KAAG;IAAc,CAC3B;GACF;GACA,MAAM,eAAe,KACnB,GAAG,yBAAyB,MAAM,MAAM,SAAS,MAAM,MAAM,MAAM,OAAO;KACvE,MAAM,WAAW,SAAS;KAC1B,MAAM,SAAS,SAAS;KACxB,MAAM,cAAc,MAAM;GAC7B,CAAC,EAAE,MAAM,WAAW,QACtB;EACF,CAUc;CACd;AACF"}

package/dist/internal/passkey/credentials.d.mts

@@ -0,0 +1,6 @@
+import "../query-operations.mjs";
+import "../transaction-kernel.mjs";
+import "./state.mjs";
+import { Effect } from "effect";
+import { PasskeyCredential, PasskeyRevision } from "@yielded/auth/Passkey";
+import { SubjectId } from "@yielded/auth/Schema";