@yielded/auth 0.1.0-beta.1

package/dist/drizzle/email-sql.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-sql.mjs","names":[],"sources":["../../src/drizzle/email-sql.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- the shared dialect kernel erases consumer Drizzle table types internally. */\nimport type { sql } from \"drizzle-orm\";\nimport { and, eq, inArray, lte } from \"drizzle-orm\";\nimport type { EffectDrizzleQueryError } from \"drizzle-orm/effect-core\";\nimport { Cause, Context, DateTime, Effect, Option, Schema } from \"effect\";\nimport type * as SqlError from \"effect/unstable/sql/SqlError\";\n\nimport {\n  EmailAddressPersistence,\n  type EmailAddressMutation,\n} from \"../email/EmailAddressPersistence\";\nimport { EmailSignInTargets } from \"../email/EmailSignInTargets\";\nimport { EmailUnavailable } from \"../email/errors\";\nimport type { EmailAction, EmailCredentialSnapshot } from \"../email/models\";\nimport {\n  snapshotEmailCredential,\n  snapshotEmailRequirement,\n  snapshotEmailRevision,\n} from \"../email/snapshot\";\nimport {\n  coordinateCommit,\n  CurrentCommitJournal,\n  hasCommitScope,\n  type CommitJournal,\n  type PreparedCommit,\n} from \"../hooks/commit\";\nimport { LifecycleHooks } from \"../hooks/LifecycleHooks\";\nimport { HookConfigurationError } from \"../hooks/models\";\nimport type { LoginIdentifier } from \"../identity/models\";\nimport { reportPersistenceFailure } from \"../internal/diagnostics\";\nimport { ProofUnavailable } from \"../proofs/errors\";\nimport type { ProofCompletionDecision } from \"../proofs/models\";\nimport type { ProofCompletionInput } from \"../proofs/ProofPersistence\";\nimport { assessAuthentication, snapshotAuthenticationEvidence } from \"../sessions/assurance\";\nimport type { AuthenticationRevision, SecurityRevision } from \"../sessions/models\";\nimport {\n  type AnyEmailAddressMapping,\n  type AnyEmailSignInMapping,\n  requiredEmailAddressConstraints,\n  requiredEmailSignInConstraints,\n} from \"./email-model\";\nimport { column, isMappedConstraintConflict, DrizzleMappingError, updateValues } from \"./model\";\nimport {\n  CurrentProofSql,\n  completeProofPlanIn,\n  type ProofSqlConfiguration,\n  type ProofSqlDatabase,\n} from \"./proof-sql\";\n\ntype AdapterFailure = EffectDrizzleQueryError | DrizzleMappingError | SqlError.SqlError;\ntype SignInMapping = AnyEmailSignInMapping;\ntype AddressMapping = AnyEmailAddressMapping;\nconst unavailable = () => EmailUnavailable.make({});\n\nconst translateFailure = <A, E, R>(\n  effect: Effect.Effect<A, E, R>,\n): Effect.Effect<A, EmailUnavailable, R> =>\n  reportPersistenceFailure(\n    effect,\n    (error) =>\n      Schema.is(EmailUnavailable)(error) ||\n      Schema.is(ProofUnavailable)(error) ||\n      Schema.is(HookConfigurationError)(error),\n  ).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));\n\nconst nowMillis = Effect.map(DateTime.now, DateTime.toEpochMillis);\n\nexport interface EmailSqlQuery<A = ReadonlyArray<any>> extends Effect.Effect<A, AdapterFailure> {\n  readonly getSQL: () => ReturnType<typeof sql>;\n  readonly from: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly where: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly limit: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly orderBy: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly for: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly set: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly values: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly returning: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly innerJoin: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly onConflictDoNothing: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly onDuplicateKeyUpdate: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n  readonly $returningId: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;\n}\n\nexport interface EmailSqlDatabase {\n  readonly select: (...args: ReadonlyArray<any>) => EmailSqlQuery;\n  readonly insert: (...args: ReadonlyArray<any>) => EmailSqlQuery;\n  readonly update: (...args: ReadonlyArray<any>) => EmailSqlQuery;\n  readonly delete: (...args: ReadonlyArray<any>) => EmailSqlQuery;\n  readonly transaction: <A, E, R>(\n    body: (transaction: EmailSqlDatabase) => Effect.Effect<A, E, R>,\n  ) => Effect.Effect<A, E | SqlError.SqlError, R>;\n}\n\nexport class CurrentEmailSql extends Context.Service<CurrentEmailSql, EmailSqlDatabase>()(\n  \"effect-auth/CurrentEmailSql\",\n) {}\n\nexport interface EmailSqlConfiguration {\n  readonly mode: \"interactive\" | \"synchronous\";\n  readonly locking: boolean;\n  readonly standaloneGuard: Effect.Effect<void, EmailUnavailable>;\n  readonly coordinated?: boolean;\n  readonly proof?: {\n    readonly mapping: any;\n    readonly configuration: ProofSqlConfiguration;\n  };\n}\n\nconst selectRows = (query: EmailSqlQuery, locking: boolean) =>\n  locking && typeof query.for === \"function\" ? query.for(\"update\") : query;\n\nconst sameIdentifier = (left: LoginIdentifier, right: LoginIdentifier) =>\n  left.namespace === right.namespace && left.value === right.value;\n\nexport const validEmailSignInConstraints = (mapping: SignInMapping) =>\n  Object.entries(requiredEmailSignInConstraints).every(\n    ([key, value]) =>\n      mapping.constraints[key as keyof typeof requiredEmailSignInConstraints] === value,\n  );\n\nconst validAddressConstraints = (mapping: AddressMapping) =>\n  Object.entries(requiredEmailAddressConstraints).every(\n    ([key, value]) =>\n      mapping.constraints[key as keyof typeof requiredEmailAddressConstraints] === value,\n  );\n\nconst subjectColumns = (mapping: SignInMapping) => ({\n  id: column(mapping.subject.table, mapping.subject.id),\n  status: column(mapping.subject.table, mapping.subject.status),\n  securityRevision: column(mapping.subject.table, mapping.subject.securityRevision),\n});\n\nconst identifierColumns = (mapping: SignInMapping) => ({\n  namespace: column(mapping.identifier.table, mapping.identifier.namespace),\n  value: column(mapping.identifier.table, mapping.identifier.value),\n  subjectId: column(mapping.identifier.table, mapping.identifier.subjectId),\n  verifiedAt: column(mapping.identifier.table, mapping.identifier.verifiedAt),\n  bindingRevision: column(mapping.identifier.table, mapping.identifier.bindingRevision),\n});\n\nconst credentialColumns = (mapping: SignInMapping) => ({\n  moduleId: column(mapping.credential.table, mapping.credential.moduleId),\n  subjectId: column(mapping.credential.table, mapping.credential.subjectId),\n  credentialId: column(mapping.credential.table, mapping.credential.credentialId),\n  identifierNamespace: column(mapping.credential.table, mapping.credential.identifierNamespace),\n  identifierValue: column(mapping.credential.table, mapping.credential.identifierValue),\n  credentialRevision: column(mapping.credential.table, mapping.credential.credentialRevision),\n  status: column(mapping.credential.table, mapping.credential.status),\n});\n\nconst authorityColumns = (mapping: AddressMapping) => ({\n  subjectId: column(mapping.authorityCredential.table, mapping.authorityCredential.subjectId),\n  credentialId: column(mapping.authorityCredential.table, mapping.authorityCredential.credentialId),\n  revision: column(mapping.authorityCredential.table, mapping.authorityCredential.revision),\n  status: column(mapping.authorityCredential.table, mapping.authorityCredential.status),\n});\n\nconst commandColumns = (mapping: AddressMapping) => ({\n  moduleId: column(mapping.command.table, mapping.command.moduleId),\n  commandId: column(mapping.command.table, mapping.command.commandId),\n  action: column(mapping.command.table, mapping.command.action),\n  bindingDigest: column(mapping.command.table, mapping.command.bindingDigest),\n  retentionUntil: column(mapping.command.table, mapping.command.retentionUntil),\n});\n\nconst allocate = <A>(\n  mode: EmailSqlConfiguration[\"mode\"],\n  asynchronous: Effect.Effect<A, DrizzleMappingError> | undefined,\n  synchronous: (() => A) | undefined,\n) => {\n  if (mode === \"synchronous\")\n    return synchronous === undefined\n      ? Effect.fail(unavailable())\n      : Effect.try({\n          try: synchronous,\n          catch: (cause) => new DrizzleMappingError({ operation: \"mapping\", cause }),\n        });\n  if (asynchronous !== undefined) return asynchronous;\n\n  return synchronous === undefined\n    ? Effect.fail(unavailable())\n    : Effect.try({\n        try: synchronous,\n        catch: (cause) => new DrizzleMappingError({ operation: \"mapping\", cause }),\n      });\n};\n\nconst nextSecurityRevision = (\n  mapping: AddressMapping,\n  mode: EmailSqlConfiguration[\"mode\"],\n  current: SecurityRevision,\n) => {\n  if (mode === \"synchronous\")\n    return mapping.subject.nextSecurityRevisionSync === undefined\n      ? Effect.fail(unavailable())\n      : Effect.try({\n          try: () => mapping.subject.nextSecurityRevisionSync!(current),\n          catch: (cause) => new DrizzleMappingError({ operation: \"mapping\", cause }),\n        });\n  if (mapping.subject.nextSecurityRevision !== undefined)\n    return mapping.subject.nextSecurityRevision(current);\n  if (mapping.subject.nextSecurityRevisionSync !== undefined)\n    return Effect.try({\n      try: () => mapping.subject.nextSecurityRevisionSync!(current),\n      catch: (cause) => new DrizzleMappingError({ operation: \"mapping\", cause }),\n    });\n\n  return Effect.fail(unavailable());\n};\n\nconst safeRead = <A, E, R>(\n  database: EmailSqlDatabase,\n  configuration: EmailSqlConfiguration,\n  body: Effect.Effect<A, E, R>,\n) =>\n  Effect.gen(function* () {\n    if (configuration.coordinated !== true) {\n      if (yield* hasCommitScope) return yield* unavailable();\n      yield* configuration.standaloneGuard;\n    }\n\n    return yield* database.transaction((transaction) =>\n      body.pipe(\n        Effect.provideService(CurrentEmailSql, transaction),\n        Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),\n      ),\n    );\n  });\n\nconst owned = <A, E, R>(\n  database: EmailSqlDatabase,\n  configuration: EmailSqlConfiguration,\n  body: Effect.Effect<A, E, R>,\n) => {\n  const run = coordinateCommit(\n    () =>\n      database.transaction((transaction) =>\n        body.pipe(\n          Effect.provideService(CurrentEmailSql, transaction),\n          Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),\n        ),\n      ),\n    { mode: configuration.mode },\n  ).pipe(Effect.map((result) => result.value));\n\n  return configuration.coordinated !== true\n    ? Effect.gen(function* () {\n        if (yield* hasCommitScope) return yield* unavailable();\n        yield* configuration.standaloneGuard;\n\n        return yield* run;\n      })\n    : run;\n};\n\nexport const emailLookupQuery = (\n  mapping: SignInMapping,\n  moduleId: string,\n  identifier: LoginIdentifier,\n) => {\n  const subject = subjectColumns(mapping),\n    binding = identifierColumns(mapping),\n    credential = credentialColumns(mapping);\n\n  return {\n    fields: {\n      subject: mapping.subject.table,\n      identifier: mapping.identifier.table,\n      credential: mapping.credential.table,\n    },\n    from: mapping.identifier.table,\n    subjectTable: mapping.subject.table,\n    subjectJoin: eq(subject.id, binding.subjectId),\n    credentialTable: mapping.credential.table,\n    credentialJoin: and(\n      eq(credential.moduleId, moduleId),\n      eq(credential.subjectId, binding.subjectId),\n      eq(credential.identifierNamespace, binding.namespace),\n      eq(credential.identifierValue, binding.value),\n    ),\n    predicate: and(\n      eq(binding.namespace, identifier.namespace),\n      eq(binding.value, identifier.value),\n    ),\n    limit: 1,\n  };\n};\n\nconst emailLookupRows = Effect.fn(\"Drizzle.emailLookupRows\")(function* (\n  mapping: SignInMapping,\n  moduleId: string,\n  identifier: LoginIdentifier,\n) {\n  const database = yield* CurrentEmailSql;\n  const query = emailLookupQuery(mapping, moduleId, identifier);\n\n  return yield* database\n    .select(query.fields)\n    .from(query.from)\n    .innerJoin(query.subjectTable, query.subjectJoin)\n    .innerJoin(query.credentialTable, query.credentialJoin)\n    .where(query.predicate)\n    .limit(query.limit);\n});\n\nexport const decodeEmailSnapshot = Effect.fn(\"DrizzleEmail.decodeSnapshot\")(function* (\n  mapping: SignInMapping,\n  moduleId: string,\n  requested: LoginIdentifier,\n  row: any,\n) {\n  if (\n    !mapping.subject.isActiveStatus(row.subject[mapping.subject.status]) ||\n    !mapping.identifier.isCurrent(row.identifier) ||\n    !mapping.credential.isActiveStatus(row.credential[mapping.credential.status])\n  )\n    return undefined;\n\n  const snapshot = yield* mapping.credential\n    .decode({\n      moduleId,\n      subject: row.subject,\n      identifier: row.identifier,\n      credential: row.credential,\n    })\n    .pipe(Effect.flatMap(snapshotEmailCredential));\n\n  const subjectId = yield* mapping.subjectId.toSubject(row.subject[mapping.subject.id]);\n\n  const verifiedAtMillis = yield* mapping.decodeInstant(\n    row.identifier[mapping.identifier.verifiedAt],\n  );\n\n  if (\n    snapshot.moduleId !== moduleId ||\n    !sameIdentifier(snapshot.identifier, requested) ||\n    snapshot.revision.subjectId !== subjectId ||\n    snapshot.revision.securityRevision !== row.subject[mapping.subject.securityRevision] ||\n    snapshot.identifierRevision !== row.identifier[mapping.identifier.bindingRevision] ||\n    snapshot.verifiedAtMillis !== verifiedAtMillis ||\n    snapshot.credentialId !== row.credential[mapping.credential.credentialId] ||\n    snapshot.credentialRevision !== row.credential[mapping.credential.credentialRevision]\n  )\n    return undefined;\n\n  return snapshot;\n});\n\nexport const makeSqlEmailSignInTargets = Effect.fn(\"makeSqlEmailSignInTargets\")(function (\n  database: EmailSqlDatabase,\n  mapping: SignInMapping,\n  configuration: EmailSqlConfiguration,\n): Effect.Effect<EmailSignInTargets[\"Service\"]> {\n  return Effect.succeed(\n    EmailSignInTargets.of({\n      lookup: (input) =>\n        (validEmailSignInConstraints(mapping)\n          ? safeRead(\n              database,\n              configuration,\n              Effect.gen(function* () {\n                const row = (yield* emailLookupRows(mapping, input.moduleId, input.identifier))[0];\n\n                if (row === undefined) return Option.none();\n\n                const snapshot = yield* decodeEmailSnapshot(\n                  mapping,\n                  input.moduleId,\n                  input.identifier,\n                  row,\n                );\n\n                return snapshot === undefined ? Option.none() : Option.some(snapshot);\n              }),\n            )\n          : Effect.fail(unavailable())\n        ).pipe(Effect.provideService(CurrentEmailSql, database), translateFailure),\n    }),\n  );\n});\n\nexport interface CurrentAddress {\n  readonly nativeSubjectId: unknown;\n  readonly subject: any;\n  readonly revision: AuthenticationRevision;\n  readonly source?: {\n    readonly credential: any;\n    readonly identifier: any;\n    readonly snapshot: EmailCredentialSnapshot;\n  };\n  readonly targetIdentifier?: any;\n  readonly targetCredential?: any;\n  readonly eligible: boolean;\n}\n\nconst readSubject = Effect.fn(\"DrizzleEmail.readSubject\")(function* (\n  mapping: AddressMapping,\n  subjectId: string,\n  locking: boolean,\n) {\n  const database = yield* CurrentEmailSql;\n\n  const nativeSubjectId = yield* mapping.subjectId.toNative(subjectId as any);\n  const s = subjectColumns(mapping);\n\n  const subject = (yield* selectRows(\n    database.select().from(mapping.subject.table).where(eq(s.id, nativeSubjectId)).limit(1),\n    locking,\n  ))[0];\n\n  return { nativeSubjectId, subject };\n});\n\nconst identifierRow = Effect.fn(\"Drizzle.identifierRow\")(function* (\n  mapping: SignInMapping,\n  identifier: LoginIdentifier,\n  locking: boolean,\n) {\n  const database = yield* CurrentEmailSql;\n\n  const i = identifierColumns(mapping);\n\n  return yield* selectRows(\n    database\n      .select()\n      .from(mapping.identifier.table)\n      .where(and(eq(i.namespace, identifier.namespace), eq(i.value, identifier.value)))\n      .limit(1),\n    locking,\n  );\n});\n\nconst credentialById = Effect.fn(\"Drizzle.credentialById\")(function* (\n  mapping: SignInMapping,\n  moduleId: string,\n  credentialId: string,\n  locking: boolean,\n) {\n  const database = yield* CurrentEmailSql;\n\n  const c = credentialColumns(mapping);\n\n  return yield* selectRows(\n    database\n      .select()\n      .from(mapping.credential.table)\n      .where(and(eq(c.moduleId, moduleId), eq(c.credentialId, credentialId)))\n      .limit(1),\n    locking,\n  );\n});\n\nconst credentialByIdentifier = Effect.fn(\"Drizzle.credentialByIdentifier\")(function* (\n  mapping: SignInMapping,\n  moduleId: string,\n  identifier: LoginIdentifier,\n  locking: boolean,\n) {\n  const database = yield* CurrentEmailSql;\n\n  const c = credentialColumns(mapping);\n\n  return yield* selectRows(\n    database\n      .select()\n      .from(mapping.credential.table)\n      .where(\n        and(\n          eq(c.moduleId, moduleId),\n          eq(c.identifierNamespace, identifier.namespace),\n          eq(c.identifierValue, identifier.value),\n        ),\n      )\n      .limit(1),\n    locking,\n  );\n});\n\nexport const currentAddress = Effect.fn(\"DrizzleEmail.currentAddress\")(function* (\n  mapping: AddressMapping,\n  input: {\n    readonly moduleId: string;\n    readonly subjectId: string;\n    readonly target: LoginIdentifier;\n    readonly sourceCredentialId?: string;\n  },\n  locking: boolean,\n) {\n  const database = yield* CurrentEmailSql;\n\n  const locked = yield* readSubject(mapping, input.subjectId, locking);\n\n  if (\n    locked.subject === undefined ||\n    !mapping.subject.isActiveStatus(locked.subject[mapping.subject.status])\n  )\n    return undefined;\n\n  const discoveredSource =\n    input.sourceCredentialId === undefined\n      ? undefined\n      : (yield* credentialById(mapping, input.moduleId, input.sourceCredentialId, false))[0];\n\n  const sourceIdentifier: LoginIdentifier | undefined =\n    discoveredSource === undefined\n      ? undefined\n      : {\n          namespace: discoveredSource[mapping.credential.identifierNamespace],\n          value: discoveredSource[mapping.credential.identifierValue],\n        };\n\n  const identifiers = [input.target, ...(sourceIdentifier === undefined ? [] : [sourceIdentifier])]\n    .filter(\n      (value, index, values) =>\n        values.findIndex((candidate) => sameIdentifier(candidate, value)) === index,\n    )\n    .sort((left, right) =>\n      `${left.namespace}\\u0000${left.value}`.localeCompare(\n        `${right.namespace}\\u0000${right.value}`,\n      ),\n    );\n\n  const lockedIdentifiers = new Map<string, any>();\n\n  for (const identifier of identifiers) {\n    const row = (yield* identifierRow(mapping, identifier, locking))[0];\n\n    if (row !== undefined)\n      lockedIdentifiers.set(`${identifier.namespace}\\u0000${identifier.value}`, row);\n  }\n\n  const sourceCredential =\n    input.sourceCredentialId === undefined\n      ? undefined\n      : (yield* credentialById(mapping, input.moduleId, input.sourceCredentialId, locking))[0];\n\n  const targetCredential = (yield* credentialByIdentifier(\n    mapping,\n    input.moduleId,\n    input.target,\n    locking,\n  ))[0];\n\n  const a = authorityColumns(mapping);\n\n  const authority = yield* selectRows(\n    database\n      .select()\n      .from(mapping.authorityCredential.table)\n      .where(eq(a.subjectId, locked.nativeSubjectId))\n      .orderBy(a.credentialId),\n    locking,\n  );\n\n  const activeAuthority = authority.filter((row: any) =>\n    mapping.authorityCredential.isActiveStatus(row[mapping.authorityCredential.status]),\n  );\n\n  const subjectId = yield* mapping.subjectId.toSubject(locked.nativeSubjectId);\n\n  const revision: AuthenticationRevision = Object.freeze({\n    subjectId,\n    securityRevision: locked.subject[mapping.subject.securityRevision],\n    credentials: Object.freeze(\n      activeAuthority.map((row: any) =>\n        Object.freeze({\n          credentialId: row[mapping.authorityCredential.credentialId],\n          revision: row[mapping.authorityCredential.revision],\n        }),\n      ),\n    ),\n  });\n\n  const targetIdentifier = lockedIdentifiers.get(\n    `${input.target.namespace}\\u0000${input.target.value}`,\n  );\n\n  const targetOwned =\n    targetIdentifier !== undefined &&\n    mapping.subjectId.equals(\n      targetIdentifier[mapping.identifier.subjectId],\n      locked.nativeSubjectId,\n    );\n\n  const targetMutable =\n    targetOwned &&\n    mapping.identifier.isMutableTarget(targetIdentifier) &&\n    (targetCredential === undefined ||\n      (!mapping.credential.isActiveStatus(targetCredential[mapping.credential.status]) &&\n        mapping.subjectId.equals(\n          targetCredential[mapping.credential.subjectId],\n          locked.nativeSubjectId,\n        )));\n\n  let source: CurrentAddress[\"source\"];\n\n  if (input.sourceCredentialId !== undefined) {\n    if (\n      sourceCredential === undefined ||\n      sourceIdentifier === undefined ||\n      !mapping.subjectId.equals(\n        sourceCredential[mapping.credential.subjectId],\n        locked.nativeSubjectId,\n      ) ||\n      !mapping.credential.isActiveStatus(sourceCredential[mapping.credential.status])\n    )\n      return undefined;\n\n    const sourceIdentifierRow = lockedIdentifiers.get(\n      `${sourceIdentifier.namespace}\\u0000${sourceIdentifier.value}`,\n    );\n\n    if (\n      sourceIdentifierRow === undefined ||\n      !mapping.identifier.isCurrent(sourceIdentifierRow) ||\n      !mapping.subjectId.equals(\n        sourceIdentifierRow[mapping.identifier.subjectId],\n        locked.nativeSubjectId,\n      )\n    )\n      return undefined;\n\n    const snapshot = yield* mapping.credential\n      .decode({\n        moduleId: input.moduleId,\n        subject: locked.subject,\n        identifier: sourceIdentifierRow,\n        credential: sourceCredential,\n      })\n      .pipe(Effect.flatMap(snapshotEmailCredential));\n\n    source = { credential: sourceCredential, identifier: sourceIdentifierRow, snapshot };\n  }\n  let eligible = targetIdentifier === undefined ? targetCredential === undefined : targetMutable;\n\n  if (input.sourceCredentialId !== undefined && source === undefined) eligible = false;\n  if (source !== undefined && sameIdentifier(source.snapshot.identifier, input.target))\n    eligible = false;\n  if (mapping.addressCardinality === \"single\" && input.sourceCredentialId === undefined) {\n    const c = credentialColumns(mapping);\n\n    const rows = yield* selectRows(\n      database\n        .select()\n        .from(mapping.credential.table)\n        .where(and(eq(c.moduleId, input.moduleId), eq(c.subjectId, locked.nativeSubjectId))),\n      locking,\n    );\n\n    if (rows.some((row: any) => mapping.credential.isActiveStatus(row[mapping.credential.status])))\n      eligible = false;\n  }\n\n  return {\n    nativeSubjectId: locked.nativeSubjectId,\n    subject: locked.subject,\n    revision,\n    ...(source === undefined ? {} : { source }),\n    ...(targetIdentifier === undefined ? {} : { targetIdentifier }),\n    ...(targetCredential === undefined ? {} : { targetCredential }),\n    eligible,\n  };\n});\n\nexport const sameEmailRevision = (left: AuthenticationRevision, right: AuthenticationRevision) => {\n  if (\n    left.subjectId !== right.subjectId ||\n    left.securityRevision !== right.securityRevision ||\n    left.credentials.length !== right.credentials.length\n  )\n    return false;\n\n  const expected = [...left.credentials].sort((a, b) =>\n    a.credentialId.localeCompare(b.credentialId),\n  );\n\n  const actual = [...right.credentials].sort((a, b) =>\n    a.credentialId.localeCompare(b.credentialId),\n  );\n\n  return expected.every(\n    (item, index) =>\n      item.credentialId === actual[index]!.credentialId &&\n      item.revision === actual[index]!.revision,\n  );\n};\n\nconst actionModule = (moduleId: string, action: EmailAction) =>\n  `${moduleId}/${action === \"verify-address\" ? \"verify-address\" : \"change-address\"}`;\n\nconst actionPurpose = (action: EmailAction) =>\n  action === \"verify-address\" ? \"email-address-verification\" : \"email-address-change\";\n\nconst completionMatches = (input: EmailAddressMutation, action: EmailAction) => {\n  const completion = input.completion.input;\n  const binding = completion.binding;\n\n  return (\n    completion.moduleId === actionModule(input.moduleId, action) &&\n    completion.purpose === actionPurpose(action) &&\n    binding._tag === \"IdentifierChange\" &&\n    sameIdentifier(binding.identifier, input.target) &&\n    sameEmailRevision(binding.revision, input.captured.revision)\n  );\n};\n\nexport const snapshotEmailMutation = Effect.fn(\"DrizzleEmail.snapshotMutation\")(function* (\n  input: EmailAddressMutation,\n) {\n  const evidence = yield* snapshotAuthenticationEvidence(input.authorization.evidence).pipe(\n    Effect.mapError(unavailable),\n  );\n\n  const requirement = yield* snapshotEmailRequirement(input.authorization.requirement);\n\n  const source =\n    input.captured.source === undefined\n      ? undefined\n      : yield* snapshotEmailCredential(input.captured.source);\n\n  return Object.freeze({\n    ...input,\n    target: Object.freeze({ ...input.target }),\n    invalidation: Object.freeze({ ...input.invalidation }),\n    captured: Object.freeze({\n      eligible: input.captured.eligible,\n      revision: snapshotEmailRevision(input.captured.revision),\n      ...(source === undefined ? {} : { source }),\n    }),\n    authorization: Object.freeze({\n      challenge: Object.freeze({\n        ...input.authorization.challenge,\n        target: Object.freeze({ ...input.authorization.challenge.target }),\n        revision: snapshotEmailRevision(input.authorization.challenge.revision),\n      }),\n      evidence,\n      requirement,\n    }),\n  });\n});\n\nexport const validateEmailAuthority = Effect.fn(\"DrizzleEmail.validateAuthority\")(function* (\n  mapping: AddressMapping,\n  configuration: EmailSqlConfiguration,\n  input: EmailAddressMutation,\n  action: EmailAction,\n) {\n  if (\n    !input.captured.eligible ||\n    !completionMatches(input, action) ||\n    input.authorization.challenge.moduleId !== input.moduleId ||\n    input.authorization.challenge.action !== action ||\n    input.authorization.challenge.commandId !== input.commandId ||\n    !sameIdentifier(input.authorization.challenge.target, input.target) ||\n    input.authorization.challenge.sourceCredentialId !== input.captured.source?.credentialId ||\n    !sameEmailRevision(input.authorization.challenge.revision, input.captured.revision) ||\n    (input.authorization.evidence.flowId as string) !== (input.commandId as string) ||\n    input.authorization.evidence.bindingDigest !== input.authorization.challenge.bindingDigest ||\n    !sameEmailRevision(input.authorization.evidence.revision, input.captured.revision) ||\n    (action === \"verify-address\" && input.captured.source !== undefined) ||\n    (action === \"change-address\" && input.captured.source === undefined) ||\n    (input.invalidation.existingSessions === \"immediate\" &&\n      mapping.sessionInvalidation !== \"same-authority-immediate\")\n  )\n    return undefined;\n\n  const current = yield* currentAddress(\n    mapping,\n    {\n      moduleId: input.moduleId,\n      subjectId: input.captured.revision.subjectId,\n      target: input.target,\n      ...(input.captured.source === undefined\n        ? {}\n        : { sourceCredentialId: input.captured.source.credentialId }),\n    },\n    configuration.locking,\n  );\n\n  if (\n    current === undefined ||\n    !current.eligible ||\n    !sameEmailRevision(current.revision, input.captured.revision) ||\n    (input.captured.source !== undefined &&\n      (current.source === undefined ||\n        current.source.snapshot.identifierRevision !== input.captured.source.identifierRevision ||\n        current.source.snapshot.credentialRevision !== input.captured.source.credentialRevision ||\n        !sameIdentifier(current.source.snapshot.identifier, input.captured.source.identifier)))\n  )\n    return undefined;\n\n  const currentRequirement = yield* mapping.subject.decodeActionRequirement(\n    current.subject,\n    action,\n  );\n\n  const original = yield* assessAuthentication(\n    input.authorization.evidence,\n    input.authorization.requirement,\n  ).pipe(Effect.mapError(unavailable));\n\n  const configured = yield* assessAuthentication(\n    input.authorization.evidence,\n    currentRequirement,\n  ).pipe(Effect.mapError(unavailable));\n\n  return original.satisfied && configured.satisfied ? current : undefined;\n});\n\nconst commandExists = Effect.fn(\"Drizzle.commandExists\")(function* (\n  mapping: AddressMapping,\n  moduleId: string,\n  commandId: string,\n  locking: boolean,\n) {\n  const database = yield* CurrentEmailSql;\n\n  const c = commandColumns(mapping);\n\n  return yield* selectRows(\n    database\n      .select()\n      .from(mapping.command.table)\n      .where(and(eq(c.moduleId, moduleId), eq(c.commandId, commandId)))\n      .limit(1),\n    locking,\n  );\n});\n\nconst applyMutation = Effect.fn(\"DrizzleEmail.applyMutation\")(function* (\n  mapping: AddressMapping,\n  input: EmailAddressMutation,\n  action: EmailAction,\n  current: CurrentAddress,\n  allocated: {\n    readonly targetCredentialId: string;\n    readonly targetIdentifierRevision: SecurityRevision;\n    readonly targetCredentialRevision: SecurityRevision;\n    readonly sourceIdentifierRevision: SecurityRevision;\n    readonly sourceCredentialRevision: SecurityRevision;\n    readonly nextSecurityRevision: SecurityRevision;\n  },\n  now: number,\n) {\n  const database = yield* CurrentEmailSql;\n\n  const i = identifierColumns(mapping);\n  const c = credentialColumns(mapping);\n  const a = authorityColumns(mapping);\n  const s = subjectColumns(mapping);\n\n  const targetCredentialId =\n    current.targetCredential?.[mapping.credential.credentialId] ?? allocated.targetCredentialId;\n\n  if (action === \"change-address\") {\n    const source = current.source!;\n\n    yield* database\n      .update(mapping.identifier.table)\n      .set(\n        mapping.identifier.encodeRetirement({\n          source: source.snapshot.identifier,\n          bindingRevision: allocated.sourceIdentifierRevision,\n        }),\n      )\n      .where(\n        and(\n          eq(i.namespace, source.snapshot.identifier.namespace),\n          eq(i.value, source.snapshot.identifier.value),\n          eq(i.subjectId, current.nativeSubjectId),\n          eq(i.bindingRevision, source.snapshot.identifierRevision),\n        ),\n      );\n    yield* database\n      .update(mapping.credential.table)\n      .set(\n        mapping.credential.encodeRetirement({\n          source: source.snapshot.identifier,\n          credentialRevision: allocated.sourceCredentialRevision,\n        }),\n      )\n      .where(\n        and(\n          eq(c.moduleId, input.moduleId),\n          eq(c.credentialId, source.snapshot.credentialId),\n          eq(c.subjectId, current.nativeSubjectId),\n          eq(c.credentialRevision, source.snapshot.credentialRevision),\n        ),\n      );\n    yield* database\n      .update(mapping.authorityCredential.table)\n      .set(mapping.authorityCredential.encodeRetirement(allocated.sourceCredentialRevision))\n      .where(\n        and(\n          eq(a.subjectId, current.nativeSubjectId),\n          eq(a.credentialId, source.snapshot.credentialId),\n          eq(a.revision, source.snapshot.credentialRevision),\n        ),\n      );\n  }\n  if (current.targetIdentifier === undefined) {\n    yield* database.insert(mapping.identifier.table).values(\n      mapping.identifier.encodeVerifiedInsert({\n        identifier: input.target,\n        subjectId: current.nativeSubjectId,\n        verifiedAtMillis: now,\n        bindingRevision: allocated.targetIdentifierRevision,\n      }),\n    );\n  } else {\n    yield* database\n      .update(mapping.identifier.table)\n      .set(\n        mapping.identifier.encodeVerification({\n          verifiedAtMillis: now,\n          bindingRevision: allocated.targetIdentifierRevision,\n        }),\n      )\n      .where(\n        and(\n          eq(i.namespace, input.target.namespace),\n          eq(i.value, input.target.value),\n          eq(i.subjectId, current.nativeSubjectId),\n          eq(i.bindingRevision, current.targetIdentifier![mapping.identifier.bindingRevision]),\n        ),\n      );\n  }\n  if (current.targetCredential === undefined) {\n    yield* database.insert(mapping.credential.table).values(\n      mapping.credential.encodeVerifiedInsert({\n        moduleId: input.moduleId,\n        subjectId: current.nativeSubjectId,\n        credentialId: targetCredentialId,\n        identifier: input.target,\n        credentialRevision: allocated.targetCredentialRevision,\n      }),\n    );\n    yield* database.insert(mapping.authorityCredential.table).values(\n      mapping.authorityCredential.encodeInsert({\n        subjectId: current.nativeSubjectId,\n        credentialId: targetCredentialId,\n        revision: allocated.targetCredentialRevision,\n      }),\n    );\n  } else {\n    const oldRevision = current.targetCredential[mapping.credential.credentialRevision];\n\n    yield* database\n      .update(mapping.credential.table)\n      .set(\n        mapping.credential.encodeActivation({\n          identifier: input.target,\n          credentialRevision: allocated.targetCredentialRevision,\n        }),\n      )\n      .where(\n        and(\n          eq(c.moduleId, input.moduleId),\n          eq(c.credentialId, targetCredentialId),\n          eq(c.subjectId, current.nativeSubjectId),\n          eq(c.credentialRevision, oldRevision),\n        ),\n      );\n    yield* database\n      .update(mapping.authorityCredential.table)\n      .set(mapping.authorityCredential.encodeActivation(allocated.targetCredentialRevision))\n      .where(\n        and(\n          eq(a.subjectId, current.nativeSubjectId),\n          eq(a.credentialId, targetCredentialId),\n          eq(a.revision, oldRevision),\n        ),\n      );\n  }\n  yield* database\n    .update(mapping.subject.table)\n    .set(updateValues<any>([[mapping.subject.securityRevision, allocated.nextSecurityRevision]]))\n    .where(\n      and(\n        eq(s.id, current.nativeSubjectId),\n        eq(s.securityRevision, input.captured.revision.securityRevision),\n      ),\n    );\n  yield* database.insert(mapping.command.table).values(\n    mapping.command.encodeInsert({\n      moduleId: input.moduleId,\n      commandId: input.commandId,\n      action,\n      bindingDigest: input.authorization.challenge.bindingDigest,\n      retentionUntilMillis: now + mapping.commandRetentionMillis,\n    }),\n  );\n\n  const sourceStillActive =\n    action === \"verify-address\"\n      ? []\n      : yield* selectRows(\n          database\n            .select()\n            .from(mapping.credential.table)\n            .where(\n              and(\n                eq(c.moduleId, input.moduleId),\n                eq(c.credentialId, current.source!.snapshot.credentialId),\n                eq(c.subjectId, current.nativeSubjectId),\n              ),\n            ),\n          false,\n        );\n\n  const target = (yield* emailLookupRows(mapping, input.moduleId, input.target))[0];\n\n  const targetAuthority = yield* selectRows(\n    database\n      .select()\n      .from(mapping.authorityCredential.table)\n      .where(and(eq(a.subjectId, current.nativeSubjectId), eq(a.credentialId, targetCredentialId)))\n      .limit(1),\n    false,\n  );\n\n  const command = yield* selectRows(\n    database\n      .select()\n      .from(mapping.command.table)\n      .where(\n        and(\n          eq(commandColumns(mapping).moduleId, input.moduleId),\n          eq(commandColumns(mapping).commandId, input.commandId),\n          eq(commandColumns(mapping).action, action),\n          eq(commandColumns(mapping).bindingDigest, input.authorization.challenge.bindingDigest),\n          eq(\n            commandColumns(mapping).retentionUntil,\n            mapping.encodeInstant(now + mapping.commandRetentionMillis),\n          ),\n        ),\n      )\n      .limit(1),\n    false,\n  );\n\n  const targetVerifiedAt =\n    target === undefined\n      ? undefined\n      : yield* mapping.decodeInstant(target.identifier[mapping.identifier.verifiedAt]);\n\n  const sourceIdentifier =\n    action === \"verify-address\"\n      ? []\n      : yield* identifierRow(mapping, current.source!.snapshot.identifier, false);\n\n  const sourceAuthority =\n    action === \"verify-address\"\n      ? []\n      : yield* selectRows(\n          database\n            .select()\n            .from(mapping.authorityCredential.table)\n            .where(\n              and(\n                eq(a.subjectId, current.nativeSubjectId),\n                eq(a.credentialId, current.source!.snapshot.credentialId),\n              ),\n            )\n            .limit(1),\n          false,\n        );\n\n  return (\n    target !== undefined &&\n    mapping.subjectId.equals(target.subject[mapping.subject.id], current.nativeSubjectId) &&\n    mapping.subject.isActiveStatus(target.subject[mapping.subject.status]) &&\n    target.subject[mapping.subject.securityRevision] === allocated.nextSecurityRevision &&\n    target.identifier[mapping.identifier.bindingRevision] === allocated.targetIdentifierRevision &&\n    targetVerifiedAt === now &&\n    target.credential[mapping.credential.credentialRevision] ===\n      allocated.targetCredentialRevision &&\n    target.credential[mapping.credential.credentialId] === targetCredentialId &&\n    mapping.subjectId.equals(\n      target.credential[mapping.credential.subjectId],\n      current.nativeSubjectId,\n    ) &&\n    mapping.identifier.isCurrent(target.identifier) &&\n    mapping.credential.isActiveStatus(target.credential[mapping.credential.status]) &&\n    targetAuthority.length === 1 &&\n    targetAuthority[0]![mapping.authorityCredential.revision] ===\n      allocated.targetCredentialRevision &&\n    mapping.authorityCredential.isActiveStatus(\n      targetAuthority[0]![mapping.authorityCredential.status],\n    ) &&\n    command.length === 1 &&\n    (action === \"verify-address\" ||\n      (sourceStillActive.length === 1 &&\n        sourceStillActive[0]![mapping.credential.credentialRevision] ===\n          allocated.sourceCredentialRevision &&\n        !mapping.credential.isActiveStatus(sourceStillActive[0]![mapping.credential.status]) &&\n        sourceIdentifier.length === 1 &&\n        mapping.subjectId.equals(\n          sourceIdentifier[0]![mapping.identifier.subjectId],\n          current.nativeSubjectId,\n        ) &&\n        sourceIdentifier[0]![mapping.identifier.bindingRevision] ===\n          allocated.sourceIdentifierRevision &&\n        !mapping.identifier.isCurrent(sourceIdentifier[0]!) &&\n        sourceAuthority.length === 1 &&\n        sourceAuthority[0]![mapping.authorityCredential.revision] ===\n          allocated.sourceCredentialRevision &&\n        !mapping.authorityCredential.isActiveStatus(\n          sourceAuthority[0]![mapping.authorityCredential.status],\n        )))\n  );\n});\n\nconst probeProofCompletion = Effect.fn(\"Drizzle.probeProofCompletion\")(function* (\n  configuration: EmailSqlConfiguration,\n  input: ProofCompletionInput,\n) {\n  const database = yield* CurrentEmailSql;\n\n  if (configuration.proof === undefined) return yield* Effect.fail(unavailable());\n  const validProbe = { _tag: \"EmailProofCompletionValid\" } as const;\n\n  const plan = {\n    input,\n    prepare: <A>(\n      decision: ProofCompletionDecision,\n      journal: CommitJournal,\n      project: (decision: ProofCompletionDecision) => A,\n    ) => journal.prepare(project(decision)),\n  };\n\n  const probe = coordinateCommit(\n    () =>\n      database.transaction((transaction) =>\n        completeProofPlanIn(\n          configuration.proof!.mapping,\n          configuration.proof!.configuration,\n          plan,\n          Effect.fail(validProbe),\n          () => false,\n        ).pipe(Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase)),\n      ),\n    { mode: configuration.mode },\n  );\n\n  return yield* probe.pipe(\n    Effect.as(false),\n    Effect.catchCause((cause) => {\n      const reason = cause.reasons[0];\n\n      return cause.reasons.length === 1 &&\n        reason !== undefined &&\n        Cause.isFailReason(reason) &&\n        reason.error === validProbe\n        ? Effect.succeed(true)\n        : Effect.failCause(cause);\n    }),\n  );\n});\n\nconst prepareRejected = Effect.fn(\"Drizzle.prepareRejected\")(function* <A>(\n  configuration: EmailSqlConfiguration,\n  prepare: (value: \"rejected\", journal: CommitJournal) => PreparedCommit<A>,\n) {\n  const database = yield* CurrentEmailSql;\n\n  return yield* owned(\n    database,\n    configuration,\n    Effect.gen(function* () {\n      const journal = yield* CurrentCommitJournal;\n\n      return yield* Effect.succeed(prepare(\"rejected\", journal));\n    }),\n  );\n});\n\nexport const makeSqlEmailAddressPersistence = Effect.fn(\"makeSqlEmailAddressPersistence\")(\n  function* (\n    database: EmailSqlDatabase,\n    mapping: AddressMapping,\n    configuration: EmailSqlConfiguration,\n  ): Effect.fn.Return<EmailAddressPersistence[\"Service\"], never, LifecycleHooks> {\n    const hooks = yield* LifecycleHooks;\n\n    return EmailAddressPersistence.of({\n      target: (input) =>\n        (validAddressConstraints(mapping)\n          ? safeRead(\n              database,\n              configuration,\n              Effect.gen(function* () {\n                const current = yield* currentAddress(mapping, input, configuration.locking);\n\n                if (current === undefined) return yield* unavailable();\n\n                return Object.freeze({\n                  revision: snapshotEmailRevision(current.revision),\n                  eligible: current.eligible,\n                  ...(current.source === undefined\n                    ? {}\n                    : { source: yield* snapshotEmailCredential(current.source.snapshot) }),\n                });\n              }),\n            )\n          : Effect.fail(unavailable())\n        ).pipe(\n          Effect.provideService(CurrentEmailSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      checkCompletion: (input) => {\n        if (configuration.proof === undefined || input.binding._tag !== \"IdentifierChange\")\n          return Effect.succeed(false).pipe(\n            Effect.provideService(CurrentEmailSql, database),\n            Effect.provideService(LifecycleHooks, hooks),\n            translateFailure,\n          );\n        const binding = input.binding;\n\n        return safeRead(\n          database,\n          configuration,\n          Effect.gen(function* () {\n            const action: EmailAction | undefined =\n              input.moduleId.endsWith(\"/verify-address\") &&\n              input.purpose === \"email-address-verification\"\n                ? \"verify-address\"\n                : input.moduleId.endsWith(\"/change-address\") &&\n                    input.purpose === \"email-address-change\"\n                  ? \"change-address\"\n                  : undefined;\n\n            if (action === undefined) return false;\n            const moduleId = input.moduleId.slice(0, -`/${action}`.length);\n\n            const current = yield* currentAddress(\n              mapping,\n              {\n                moduleId,\n                subjectId: binding.revision.subjectId,\n                target: binding.identifier,\n              },\n              false,\n            );\n\n            return current !== undefined && sameEmailRevision(current.revision, binding.revision);\n          }),\n        )\n          .pipe(\n            Effect.flatMap((current) =>\n              current ? probeProofCompletion(configuration, input) : Effect.succeed(false),\n            ),\n          )\n          .pipe(\n            Effect.provideService(CurrentEmailSql, database),\n            Effect.provideService(LifecycleHooks, hooks),\n            translateFailure,\n          );\n      },\n      verifyWithProof: (uncaptured, prepare) =>\n        mutateAddress(mapping, configuration, uncaptured, \"verify-address\", prepare).pipe(\n          Effect.provideService(CurrentEmailSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      changeWithProof: (uncaptured, prepare) =>\n        mutateAddress(mapping, configuration, uncaptured, \"change-address\", prepare).pipe(\n          Effect.provideService(CurrentEmailSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n      cleanup: (input, prepare) =>\n        owned(\n          database,\n          configuration,\n          Effect.gen(function* () {\n            const transaction = yield* CurrentEmailSql;\n            const journal = yield* CurrentCommitJournal;\n\n            const c = commandColumns(mapping);\n            const now = yield* nowMillis;\n\n            const rows = yield* selectRows(\n              transaction\n                .select({ commandId: c.commandId })\n                .from(mapping.command.table)\n                .where(\n                  and(\n                    eq(c.moduleId, input.moduleId),\n                    lte(c.retentionUntil, mapping.encodeInstant(now)),\n                  ),\n                )\n                .limit(input.limit + 1),\n              configuration.locking,\n            );\n\n            const selected = rows.slice(0, input.limit);\n\n            const receipt = prepare(\n              { removed: selected.length, hasMore: rows.length > input.limit },\n              journal,\n            );\n\n            if (selected.length > 0)\n              yield* transaction.delete(mapping.command.table).where(\n                and(\n                  eq(c.moduleId, input.moduleId),\n                  inArray(\n                    c.commandId,\n                    selected.map((row: any) => row.commandId),\n                  ),\n                  lte(c.retentionUntil, mapping.encodeInstant(now)),\n                ),\n              );\n\n            return receipt;\n          }),\n        ).pipe(\n          Effect.provideService(CurrentEmailSql, database),\n          Effect.provideService(LifecycleHooks, hooks),\n          translateFailure,\n        ),\n    });\n  },\n);\n\nconst mutateAddress = Effect.fn(\"Drizzle.mutateAddress\")(function* <A>(\n  mapping: AddressMapping,\n  configuration: EmailSqlConfiguration,\n  uncaptured: EmailAddressMutation,\n  action: EmailAction,\n  prepare: (value: \"changed\" | \"rejected\", journal: CommitJournal) => PreparedCommit<A>,\n) {\n  const database = yield* CurrentEmailSql;\n\n  if (!validAddressConstraints(mapping) || configuration.proof === undefined)\n    return yield* unavailable();\n  const input = yield* snapshotEmailMutation(uncaptured);\n\n  const targetCredentialId = yield* allocate(\n    configuration.mode,\n    mapping.allocateCredentialId,\n    mapping.allocateCredentialIdSync,\n  );\n\n  const targetIdentifierRevision = yield* allocate(\n    configuration.mode,\n    mapping.allocateRevision,\n    mapping.allocateRevisionSync,\n  );\n\n  const targetCredentialRevision = yield* allocate(\n    configuration.mode,\n    mapping.allocateRevision,\n    mapping.allocateRevisionSync,\n  );\n\n  const sourceIdentifierRevision = yield* allocate(\n    configuration.mode,\n    mapping.allocateRevision,\n    mapping.allocateRevisionSync,\n  );\n\n  const sourceCredentialRevision = yield* allocate(\n    configuration.mode,\n    mapping.allocateRevision,\n    mapping.allocateRevisionSync,\n  );\n\n  const nextRevision = yield* nextSecurityRevision(\n    mapping,\n    configuration.mode,\n    input.captured.revision.securityRevision,\n  );\n\n  if (\n    nextRevision === input.captured.revision.securityRevision ||\n    [\n      targetIdentifierRevision,\n      targetCredentialRevision,\n      sourceIdentifierRevision,\n      sourceCredentialRevision,\n    ].some((value) => input.captured.revision.credentials.some((item) => item.revision === value))\n  )\n    return yield* unavailable();\n\n  const run = owned(\n    database,\n    configuration,\n    Effect.gen(function* () {\n      const journal = yield* CurrentCommitJournal;\n\n      const current = yield* validateEmailAuthority(mapping, configuration, input, action);\n\n      if (current === undefined) return prepare(\"rejected\", journal);\n      if (\n        (yield* commandExists(mapping, input.moduleId, input.commandId, configuration.locking))\n          .length > 0\n      )\n        return prepare(\"rejected\", journal);\n      let receipt: PreparedCommit<A> | undefined;\n\n      yield* completeProofPlanIn(\n        configuration.proof!.mapping,\n        configuration.proof!.configuration,\n        input.completion,\n        Effect.gen(function* () {\n          // The proof helper may wait on continuation/series locks. Read the\n          // commit clock and reassess both policies only after those locks.\n          const currentRequirement = yield* mapping.subject.decodeActionRequirement(\n            current.subject,\n            action,\n          );\n\n          const original = yield* assessAuthentication(\n            input.authorization.evidence,\n            input.authorization.requirement,\n          ).pipe(Effect.mapError(unavailable));\n\n          const configured = yield* assessAuthentication(\n            input.authorization.evidence,\n            currentRequirement,\n          ).pipe(Effect.mapError(unavailable));\n\n          if (!original.satisfied || !configured.satisfied) return false;\n          const now = yield* nowMillis;\n\n          return yield* applyMutation(\n            mapping,\n            input,\n            action,\n            current,\n            {\n              targetCredentialId,\n              targetIdentifierRevision,\n              targetCredentialRevision,\n              sourceIdentifierRevision,\n              sourceCredentialRevision,\n              nextSecurityRevision: nextRevision,\n            },\n            now,\n          );\n        }),\n        (decision) => {\n          receipt = prepare(decision === \"completed\" ? \"changed\" : \"rejected\", journal);\n\n          return decision;\n        },\n      );\n\n      return receipt ?? prepare(\"rejected\", journal);\n    }),\n  );\n\n  return yield* run.pipe(\n    Effect.catchCause((cause) =>\n      (cause.reasons.every(Cause.isFailReason) &&\n        isMappedConstraintConflict(mapping.isCommandConflict, cause)) ||\n      (cause.reasons.every(Cause.isFailReason) &&\n        isMappedConstraintConflict(mapping.isIdentifierConflict, cause)) ||\n      (cause.reasons.every(Cause.isFailReason) &&\n        isMappedConstraintConflict(mapping.isCredentialConflict, cause))\n        ? prepareRejected(configuration, prepare)\n        : Effect.failCause(cause),\n    ),\n  );\n});\n"],"mappings":";;;;;;;;;;;;;;;;AAoDA,MAAM,oBAAoB,iBAAiB,KAAK,CAAC,CAAC;AAElD,MAAM,oBACJ,WAEA,yBACE,SACC,UACC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,sBAAsB,CAAC,CAAC,KAAK,CAC3C,CAAC,CAAC,KAAK,OAAO,YAAY,UAAU,OAAO,UAAU,MAAM,IAAI,aAAa,YAAY,CAAC,CAAC,CAAC,CAAC;AAE9F,MAAM,YAAY,OAAO,IAAI,SAAS,KAAK,SAAS,aAAa;AA4BjE,IAAa,kBAAb,cAAqC,QAAQ,QAA2C,CAAC,CACvF,6BACF,CAAC,CAAC,CAAC;AAaH,MAAM,cAAc,OAAsB,YACxC,WAAW,OAAO,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,IAAI;AAErE,MAAM,kBAAkB,MAAuB,UAC7C,KAAK,cAAc,MAAM,aAAa,KAAK,UAAU,MAAM;AAE7D,MAAa,+BAA+B,YAC1C,OAAO,QAAQ,8BAA8B,CAAC,CAAC,OAC5C,CAAC,KAAK,WACL,QAAQ,YAAY,SAAwD,KAChF;AAEF,MAAM,2BAA2B,YAC/B,OAAO,QAAQ,+BAA+B,CAAC,CAAC,OAC7C,CAAC,KAAK,WACL,QAAQ,YAAY,SAAyD,KACjF;AAEF,MAAM,kBAAkB,aAA4B;CAClD,IAAI,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,EAAE;CACpD,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;CAC5D,kBAAkB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,gBAAgB;AAClF;AAEA,MAAM,qBAAqB,aAA4B;CACrD,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;CACxE,OAAO,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,KAAK;CAChE,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;CACxE,YAAY,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,UAAU;CAC1E,iBAAiB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,eAAe;AACtF;AAEA,MAAM,qBAAqB,aAA4B;CACrD,UAAU,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,QAAQ;CACtE,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;CACxE,cAAc,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,YAAY;CAC9E,qBAAqB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,mBAAmB;CAC5F,iBAAiB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,eAAe;CACpF,oBAAoB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,kBAAkB;CAC1F,QAAQ,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,MAAM;AACpE;AAEA,MAAM,oBAAoB,aAA6B;CACrD,WAAW,OAAO,QAAQ,oBAAoB,OAAO,QAAQ,oBAAoB,SAAS;CAC1F,cAAc,OAAO,QAAQ,oBAAoB,OAAO,QAAQ,oBAAoB,YAAY;CAChG,UAAU,OAAO,QAAQ,oBAAoB,OAAO,QAAQ,oBAAoB,QAAQ;CACxF,QAAQ,OAAO,QAAQ,oBAAoB,OAAO,QAAQ,oBAAoB,MAAM;AACtF;AAEA,MAAM,kBAAkB,aAA6B;CACnD,UAAU,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,QAAQ;CAChE,WAAW,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,SAAS;CAClE,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;CAC5D,eAAe,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,aAAa;CAC1E,gBAAgB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,cAAc;AAC9E;AAEA,MAAM,YACJ,MACA,cACA,gBACG;CACH,IAAI,SAAS,eACX,OAAO,gBAAgB,KAAA,IACnB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;EACT,KAAK;EACL,QAAQ,UAAU,IAAI,oBAAoB;GAAE,WAAW;GAAW;EAAM,CAAC;CAC3E,CAAC;CACP,IAAI,iBAAiB,KAAA,GAAW,OAAO;CAEvC,OAAO,gBAAgB,KAAA,IACnB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;EACT,KAAK;EACL,QAAQ,UAAU,IAAI,oBAAoB;GAAE,WAAW;GAAW;EAAM,CAAC;CAC3E,CAAC;AACP;AAEA,MAAM,wBACJ,SACA,MACA,YACG;CACH,IAAI,SAAS,eACX,OAAO,QAAQ,QAAQ,6BAA6B,KAAA,IAChD,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;EACT,WAAW,QAAQ,QAAQ,yBAA0B,OAAO;EAC5D,QAAQ,UAAU,IAAI,oBAAoB;GAAE,WAAW;GAAW;EAAM,CAAC;CAC3E,CAAC;CACP,IAAI,QAAQ,QAAQ,yBAAyB,KAAA,GAC3C,OAAO,QAAQ,QAAQ,qBAAqB,OAAO;CACrD,IAAI,QAAQ,QAAQ,6BAA6B,KAAA,GAC/C,OAAO,OAAO,IAAI;EAChB,WAAW,QAAQ,QAAQ,yBAA0B,OAAO;EAC5D,QAAQ,UAAU,IAAI,oBAAoB;GAAE,WAAW;GAAW;EAAM,CAAC;CAC3E,CAAC;CAEH,OAAO,OAAO,KAAK,YAAY,CAAC;AAClC;AAEA,MAAM,YACJ,UACA,eACA,SAEA,OAAO,IAAI,aAAa;CACtB,IAAI,cAAc,gBAAgB,MAAM;EACtC,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;EACrD,OAAO,cAAc;CACvB;CAEA,OAAO,OAAO,SAAS,aAAa,gBAClC,KAAK,KACH,OAAO,eAAe,iBAAiB,WAAW,GAClD,OAAO,eAAe,iBAAiB,WAA0C,CACnF,CACF;AACF,CAAC;AAEH,MAAM,SACJ,UACA,eACA,SACG;CACH,MAAM,MAAM,uBAER,SAAS,aAAa,gBACpB,KAAK,KACH,OAAO,eAAe,iBAAiB,WAAW,GAClD,OAAO,eAAe,iBAAiB,WAA0C,CACnF,CACF,GACF,EAAE,MAAM,cAAc,KAAK,CAC7B,CAAC,CAAC,KAAK,OAAO,KAAK,WAAW,OAAO,KAAK,CAAC;CAE3C,OAAO,cAAc,gBAAgB,OACjC,OAAO,IAAI,aAAa;EACtB,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;EACrD,OAAO,cAAc;EAErB,OAAO,OAAO;CAChB,CAAC,IACD;AACN;AAEA,MAAa,oBACX,SACA,UACA,eACG;CACH,MAAM,UAAU,eAAe,OAAO,GACpC,UAAU,kBAAkB,OAAO,GACnC,aAAa,kBAAkB,OAAO;CAExC,OAAO;EACL,QAAQ;GACN,SAAS,QAAQ,QAAQ;GACzB,YAAY,QAAQ,WAAW;GAC/B,YAAY,QAAQ,WAAW;EACjC;EACA,MAAM,QAAQ,WAAW;EACzB,cAAc,QAAQ,QAAQ;EAC9B,aAAa,GAAG,QAAQ,IAAI,QAAQ,SAAS;EAC7C,iBAAiB,QAAQ,WAAW;EACpC,gBAAgB,IACd,GAAG,WAAW,UAAU,QAAQ,GAChC,GAAG,WAAW,WAAW,QAAQ,SAAS,GAC1C,GAAG,WAAW,qBAAqB,QAAQ,SAAS,GACpD,GAAG,WAAW,iBAAiB,QAAQ,KAAK,CAC9C;EACA,WAAW,IACT,GAAG,QAAQ,WAAW,WAAW,SAAS,GAC1C,GAAG,QAAQ,OAAO,WAAW,KAAK,CACpC;EACA,OAAO;CACT;AACF;AAEA,MAAM,kBAAkB,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,SACA,UACA,YACA;CACA,MAAM,WAAW,OAAO;CACxB,MAAM,QAAQ,iBAAiB,SAAS,UAAU,UAAU;CAE5D,OAAO,OAAO,SACX,OAAO,MAAM,MAAM,CAAC,CACpB,KAAK,MAAM,IAAI,CAAC,CAChB,UAAU,MAAM,cAAc,MAAM,WAAW,CAAC,CAChD,UAAU,MAAM,iBAAiB,MAAM,cAAc,CAAC,CACtD,MAAM,MAAM,SAAS,CAAC,CACtB,MAAM,MAAM,KAAK;AACtB,CAAC;AAED,MAAa,sBAAsB,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAC1E,SACA,UACA,WACA,KACA;CACA,IACE,CAAC,QAAQ,QAAQ,eAAe,IAAI,QAAQ,QAAQ,QAAQ,OAAO,KACnE,CAAC,QAAQ,WAAW,UAAU,IAAI,UAAU,KAC5C,CAAC,QAAQ,WAAW,eAAe,IAAI,WAAW,QAAQ,WAAW,OAAO,GAE5E,OAAO,KAAA;CAET,MAAM,WAAW,OAAO,QAAQ,WAC7B,OAAO;EACN;EACA,SAAS,IAAI;EACb,YAAY,IAAI;EAChB,YAAY,IAAI;CAClB,CAAC,CAAC,CACD,KAAK,OAAO,QAAQ,uBAAuB,CAAC;CAE/C,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,IAAI,QAAQ,QAAQ,QAAQ,GAAG;CAEpF,MAAM,mBAAmB,OAAO,QAAQ,cACtC,IAAI,WAAW,QAAQ,WAAW,WACpC;CAEA,IACE,SAAS,aAAa,YACtB,CAAC,eAAe,SAAS,YAAY,SAAS,KAC9C,SAAS,SAAS,cAAc,aAChC,SAAS,SAAS,qBAAqB,IAAI,QAAQ,QAAQ,QAAQ,qBACnE,SAAS,uBAAuB,IAAI,WAAW,QAAQ,WAAW,oBAClE,SAAS,qBAAqB,oBAC9B,SAAS,iBAAiB,IAAI,WAAW,QAAQ,WAAW,iBAC5D,SAAS,uBAAuB,IAAI,WAAW,QAAQ,WAAW,qBAElE,OAAO,KAAA;CAET,OAAO;AACT,CAAC;AAED,MAAa,4BAA4B,OAAO,GAAG,2BAA2B,CAAC,CAAC,SAC9E,UACA,SACA,eAC8C;CAC9C,OAAO,OAAO,QACZ,mBAAmB,GAAG,EACpB,SAAS,WACN,4BAA4B,OAAO,IAChC,SACE,UACA,eACA,OAAO,IAAI,aAAa;EACtB,MAAM,OAAO,OAAO,gBAAgB,SAAS,MAAM,UAAU,MAAM,UAAU,EAAA,CAAG;EAEhF,IAAI,QAAQ,KAAA,GAAW,OAAO,OAAO,KAAK;EAE1C,MAAM,WAAW,OAAO,oBACtB,SACA,MAAM,UACN,MAAM,YACN,GACF;EAEA,OAAO,aAAa,KAAA,IAAY,OAAO,KAAK,IAAI,OAAO,KAAK,QAAQ;CACtE,CAAC,CACH,IACA,OAAO,KAAK,YAAY,CAAC,EAAA,CAC3B,KAAK,OAAO,eAAe,iBAAiB,QAAQ,GAAG,gBAAgB,EAC7E,CAAC,CACH;AACF,CAAC;AAgBD,MAAM,cAAc,OAAO,GAAG,0BAA0B,CAAC,CAAC,WACxD,SACA,WACA,SACA;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,SAAgB;CAC1E,MAAM,IAAI,eAAe,OAAO;CAOhC,OAAO;EAAE;EAAiB,UALT,OAAO,WACtB,SAAS,OAAO,CAAC,CAAC,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAAC,MAAM,GAAG,EAAE,IAAI,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,GACtF,OACF,EAAA,CAAG;CAE+B;AACpC,CAAC;AAED,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,YACA,SACA;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,IAAI,kBAAkB,OAAO;CAEnC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,IAAI,GAAG,EAAE,WAAW,WAAW,SAAS,GAAG,GAAG,EAAE,OAAO,WAAW,KAAK,CAAC,CAAC,CAAC,CAChF,MAAM,CAAC,GACV,OACF;AACF,CAAC;AAED,MAAM,iBAAiB,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,UACA,cACA,SACA;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,IAAI,kBAAkB,OAAO;CAEnC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,IAAI,GAAG,EAAE,UAAU,QAAQ,GAAG,GAAG,EAAE,cAAc,YAAY,CAAC,CAAC,CAAC,CACtE,MAAM,CAAC,GACV,OACF;AACF,CAAC;AAED,MAAM,yBAAyB,OAAO,GAAG,gCAAgC,CAAC,CAAC,WACzE,SACA,UACA,YACA,SACA;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,IAAI,kBAAkB,OAAO;CAEnC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MACC,IACE,GAAG,EAAE,UAAU,QAAQ,GACvB,GAAG,EAAE,qBAAqB,WAAW,SAAS,GAC9C,GAAG,EAAE,iBAAiB,WAAW,KAAK,CACxC,CACF,CAAC,CACA,MAAM,CAAC,GACV,OACF;AACF,CAAC;AAED,MAAa,iBAAiB,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACrE,SACA,OAMA,SACA;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,SAAS,OAAO,YAAY,SAAS,MAAM,WAAW,OAAO;CAEnE,IACE,OAAO,YAAY,KAAA,KACnB,CAAC,QAAQ,QAAQ,eAAe,OAAO,QAAQ,QAAQ,QAAQ,OAAO,GAEtE,OAAO,KAAA;CAET,MAAM,mBACJ,MAAM,uBAAuB,KAAA,IACzB,KAAA,KACC,OAAO,eAAe,SAAS,MAAM,UAAU,MAAM,oBAAoB,KAAK,EAAA,CAAG;CAExF,MAAM,mBACJ,qBAAqB,KAAA,IACjB,KAAA,IACA;EACE,WAAW,iBAAiB,QAAQ,WAAW;EAC/C,OAAO,iBAAiB,QAAQ,WAAW;CAC7C;CAEN,MAAM,cAAc,CAAC,MAAM,QAAQ,GAAI,qBAAqB,KAAA,IAAY,CAAC,IAAI,CAAC,gBAAgB,CAAE,CAAC,CAC9F,QACE,OAAO,OAAO,WACb,OAAO,WAAW,cAAc,eAAe,WAAW,KAAK,CAAC,MAAM,KAC1E,CAAC,CACA,MAAM,MAAM,UACX,GAAG,KAAK,UAAU,QAAQ,KAAK,QAAQ,cACrC,GAAG,MAAM,UAAU,QAAQ,MAAM,OACnC,CACF;CAEF,MAAM,oCAAoB,IAAI,IAAiB;CAE/C,KAAK,MAAM,cAAc,aAAa;EACpC,MAAM,OAAO,OAAO,cAAc,SAAS,YAAY,OAAO,EAAA,CAAG;EAEjE,IAAI,QAAQ,KAAA,GACV,kBAAkB,IAAI,GAAG,WAAW,UAAU,QAAQ,WAAW,SAAS,GAAG;CACjF;CAEA,MAAM,mBACJ,MAAM,uBAAuB,KAAA,IACzB,KAAA,KACC,OAAO,eAAe,SAAS,MAAM,UAAU,MAAM,oBAAoB,OAAO,EAAA,CAAG;CAE1F,MAAM,oBAAoB,OAAO,uBAC/B,SACA,MAAM,UACN,MAAM,QACN,OACF,EAAA,CAAG;CAEH,MAAM,IAAI,iBAAiB,OAAO;CAWlC,MAAM,mBAAkB,OATC,WACvB,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,oBAAoB,KAAK,CAAC,CACvC,MAAM,GAAG,EAAE,WAAW,OAAO,eAAe,CAAC,CAAC,CAC9C,QAAQ,EAAE,YAAY,GACzB,OACF,EAAA,CAEkC,QAAQ,QACxC,QAAQ,oBAAoB,eAAe,IAAI,QAAQ,oBAAoB,OAAO,CACpF;CAEA,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,OAAO,eAAe;CAE3E,MAAM,WAAmC,OAAO,OAAO;EACrD;EACA,kBAAkB,OAAO,QAAQ,QAAQ,QAAQ;EACjD,aAAa,OAAO,OAClB,gBAAgB,KAAK,QACnB,OAAO,OAAO;GACZ,cAAc,IAAI,QAAQ,oBAAoB;GAC9C,UAAU,IAAI,QAAQ,oBAAoB;EAC5C,CAAC,CACH,CACF;CACF,CAAC;CAED,MAAM,mBAAmB,kBAAkB,IACzC,GAAG,MAAM,OAAO,UAAU,QAAQ,MAAM,OAAO,OACjD;CASA,MAAM,gBANJ,qBAAqB,KAAA,KACrB,QAAQ,UAAU,OAChB,iBAAiB,QAAQ,WAAW,YACpC,OAAO,eACT,KAIA,QAAQ,WAAW,gBAAgB,gBAAgB,MAClD,qBAAqB,KAAA,KACnB,CAAC,QAAQ,WAAW,eAAe,iBAAiB,QAAQ,WAAW,OAAO,KAC7E,QAAQ,UAAU,OAChB,iBAAiB,QAAQ,WAAW,YACpC,OAAO,eACT;CAEN,IAAI;CAEJ,IAAI,MAAM,uBAAuB,KAAA,GAAW;EAC1C,IACE,qBAAqB,KAAA,KACrB,qBAAqB,KAAA,KACrB,CAAC,QAAQ,UAAU,OACjB,iBAAiB,QAAQ,WAAW,YACpC,OAAO,eACT,KACA,CAAC,QAAQ,WAAW,eAAe,iBAAiB,QAAQ,WAAW,OAAO,GAE9E,OAAO,KAAA;EAET,MAAM,sBAAsB,kBAAkB,IAC5C,GAAG,iBAAiB,UAAU,QAAQ,iBAAiB,OACzD;EAEA,IACE,wBAAwB,KAAA,KACxB,CAAC,QAAQ,WAAW,UAAU,mBAAmB,KACjD,CAAC,QAAQ,UAAU,OACjB,oBAAoB,QAAQ,WAAW,YACvC,OAAO,eACT,GAEA,OAAO,KAAA;EAWT,SAAS;GAAE,YAAY;GAAkB,YAAY;GAAqB,UAAA,OATlD,QAAQ,WAC7B,OAAO;IACN,UAAU,MAAM;IAChB,SAAS,OAAO;IAChB,YAAY;IACZ,YAAY;GACd,CAAC,CAAC,CACD,KAAK,OAAO,QAAQ,uBAAuB,CAAC;EAEoC;CACrF;CACA,IAAI,WAAW,qBAAqB,KAAA,IAAY,qBAAqB,KAAA,IAAY;CAEjF,IAAI,MAAM,uBAAuB,KAAA,KAAa,WAAW,KAAA,GAAW,WAAW;CAC/E,IAAI,WAAW,KAAA,KAAa,eAAe,OAAO,SAAS,YAAY,MAAM,MAAM,GACjF,WAAW;CACb,IAAI,QAAQ,uBAAuB,YAAY,MAAM,uBAAuB,KAAA,GAAW;EACrF,MAAM,IAAI,kBAAkB,OAAO;EAUnC,KAAI,OARgB,WAClB,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,WAAW,OAAO,eAAe,CAAC,CAAC,GACrF,OACF,EAAA,CAES,MAAM,QAAa,QAAQ,WAAW,eAAe,IAAI,QAAQ,WAAW,OAAO,CAAC,GAC3F,WAAW;CACf;CAEA,OAAO;EACL,iBAAiB,OAAO;EACxB,SAAS,OAAO;EAChB;EACA,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO;EACzC,GAAI,qBAAqB,KAAA,IAAY,CAAC,IAAI,EAAE,iBAAiB;EAC7D,GAAI,qBAAqB,KAAA,IAAY,CAAC,IAAI,EAAE,iBAAiB;EAC7D;CACF;AACF,CAAC;AAED,MAAa,qBAAqB,MAA8B,UAAkC;CAChG,IACE,KAAK,cAAc,MAAM,aACzB,KAAK,qBAAqB,MAAM,oBAChC,KAAK,YAAY,WAAW,MAAM,YAAY,QAE9C,OAAO;CAET,MAAM,WAAW,CAAC,GAAG,KAAK,WAAW,CAAC,CAAC,MAAM,GAAG,MAC9C,EAAE,aAAa,cAAc,EAAE,YAAY,CAC7C;CAEA,MAAM,SAAS,CAAC,GAAG,MAAM,WAAW,CAAC,CAAC,MAAM,GAAG,MAC7C,EAAE,aAAa,cAAc,EAAE,YAAY,CAC7C;CAEA,OAAO,SAAS,OACb,MAAM,UACL,KAAK,iBAAiB,OAAO,MAAM,CAAE,gBACrC,KAAK,aAAa,OAAO,MAAM,CAAE,QACrC;AACF;AAEA,MAAM,gBAAgB,UAAkB,WACtC,GAAG,SAAS,GAAG,WAAW,mBAAmB,mBAAmB;AAElE,MAAM,iBAAiB,WACrB,WAAW,mBAAmB,+BAA+B;AAE/D,MAAM,qBAAqB,OAA6B,WAAwB;CAC9E,MAAM,aAAa,MAAM,WAAW;CACpC,MAAM,UAAU,WAAW;CAE3B,OACE,WAAW,aAAa,aAAa,MAAM,UAAU,MAAM,KAC3D,WAAW,YAAY,cAAc,MAAM,KAC3C,QAAQ,SAAS,sBACjB,eAAe,QAAQ,YAAY,MAAM,MAAM,KAC/C,kBAAkB,QAAQ,UAAU,MAAM,SAAS,QAAQ;AAE/D;AAEA,MAAa,wBAAwB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAC9E,OACA;CACA,MAAM,WAAW,OAAO,+BAA+B,MAAM,cAAc,QAAQ,CAAC,CAAC,KACnF,OAAO,SAAS,WAAW,CAC7B;CAEA,MAAM,cAAc,OAAO,yBAAyB,MAAM,cAAc,WAAW;CAEnF,MAAM,SACJ,MAAM,SAAS,WAAW,KAAA,IACtB,KAAA,IACA,OAAO,wBAAwB,MAAM,SAAS,MAAM;CAE1D,OAAO,OAAO,OAAO;EACnB,GAAG;EACH,QAAQ,OAAO,OAAO,EAAE,GAAG,MAAM,OAAO,CAAC;EACzC,cAAc,OAAO,OAAO,EAAE,GAAG,MAAM,aAAa,CAAC;EACrD,UAAU,OAAO,OAAO;GACtB,UAAU,MAAM,SAAS;GACzB,UAAU,sBAAsB,MAAM,SAAS,QAAQ;GACvD,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO;EAC3C,CAAC;EACD,eAAe,OAAO,OAAO;GAC3B,WAAW,OAAO,OAAO;IACvB,GAAG,MAAM,cAAc;IACvB,QAAQ,OAAO,OAAO,EAAE,GAAG,MAAM,cAAc,UAAU,OAAO,CAAC;IACjE,UAAU,sBAAsB,MAAM,cAAc,UAAU,QAAQ;GACxE,CAAC;GACD;GACA;EACF,CAAC;CACH,CAAC;AACH,CAAC;AAED,MAAa,yBAAyB,OAAO,GAAG,gCAAgC,CAAC,CAAC,WAChF,SACA,eACA,OACA,QACA;CACA,IACE,CAAC,MAAM,SAAS,YAChB,CAAC,kBAAkB,OAAO,MAAM,KAChC,MAAM,cAAc,UAAU,aAAa,MAAM,YACjD,MAAM,cAAc,UAAU,WAAW,UACzC,MAAM,cAAc,UAAU,cAAc,MAAM,aAClD,CAAC,eAAe,MAAM,cAAc,UAAU,QAAQ,MAAM,MAAM,KAClE,MAAM,cAAc,UAAU,uBAAuB,MAAM,SAAS,QAAQ,gBAC5E,CAAC,kBAAkB,MAAM,cAAc,UAAU,UAAU,MAAM,SAAS,QAAQ,KACjF,MAAM,cAAc,SAAS,WAAuB,MAAM,aAC3D,MAAM,cAAc,SAAS,kBAAkB,MAAM,cAAc,UAAU,iBAC7E,CAAC,kBAAkB,MAAM,cAAc,SAAS,UAAU,MAAM,SAAS,QAAQ,KAChF,WAAW,oBAAoB,MAAM,SAAS,WAAW,KAAA,KACzD,WAAW,oBAAoB,MAAM,SAAS,WAAW,KAAA,KACzD,MAAM,aAAa,qBAAqB,eACvC,QAAQ,wBAAwB,4BAElC,OAAO,KAAA;CAET,MAAM,UAAU,OAAO,eACrB,SACA;EACE,UAAU,MAAM;EAChB,WAAW,MAAM,SAAS,SAAS;EACnC,QAAQ,MAAM;EACd,GAAI,MAAM,SAAS,WAAW,KAAA,IAC1B,CAAC,IACD,EAAE,oBAAoB,MAAM,SAAS,OAAO,aAAa;CAC/D,GACA,cAAc,OAChB;CAEA,IACE,YAAY,KAAA,KACZ,CAAC,QAAQ,YACT,CAAC,kBAAkB,QAAQ,UAAU,MAAM,SAAS,QAAQ,KAC3D,MAAM,SAAS,WAAW,KAAA,MACxB,QAAQ,WAAW,KAAA,KAClB,QAAQ,OAAO,SAAS,uBAAuB,MAAM,SAAS,OAAO,sBACrE,QAAQ,OAAO,SAAS,uBAAuB,MAAM,SAAS,OAAO,sBACrE,CAAC,eAAe,QAAQ,OAAO,SAAS,YAAY,MAAM,SAAS,OAAO,UAAU,IAExF,OAAO,KAAA;CAET,MAAM,qBAAqB,OAAO,QAAQ,QAAQ,wBAChD,QAAQ,SACR,MACF;CAEA,MAAM,WAAW,OAAO,qBACtB,MAAM,cAAc,UACpB,MAAM,cAAc,WACtB,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;CAEnC,MAAM,aAAa,OAAO,qBACxB,MAAM,cAAc,UACpB,kBACF,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;CAEnC,OAAO,SAAS,aAAa,WAAW,YAAY,UAAU,KAAA;AAChE,CAAC;AAED,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,UACA,WACA,SACA;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,IAAI,eAAe,OAAO;CAEhC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,IAAI,GAAG,EAAE,UAAU,QAAQ,GAAG,GAAG,EAAE,WAAW,SAAS,CAAC,CAAC,CAAC,CAChE,MAAM,CAAC,GACV,OACF;AACF,CAAC;AAED,MAAM,gBAAgB,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAC5D,SACA,OACA,QACA,SACA,WAQA,KACA;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,IAAI,kBAAkB,OAAO;CACnC,MAAM,IAAI,kBAAkB,OAAO;CACnC,MAAM,IAAI,iBAAiB,OAAO;CAClC,MAAM,IAAI,eAAe,OAAO;CAEhC,MAAM,qBACJ,QAAQ,mBAAmB,QAAQ,WAAW,iBAAiB,UAAU;CAE3E,IAAI,WAAW,kBAAkB;EAC/B,MAAM,SAAS,QAAQ;EAEvB,OAAO,SACJ,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,IACC,QAAQ,WAAW,iBAAiB;GAClC,QAAQ,OAAO,SAAS;GACxB,iBAAiB,UAAU;EAC7B,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,EAAE,WAAW,OAAO,SAAS,WAAW,SAAS,GACpD,GAAG,EAAE,OAAO,OAAO,SAAS,WAAW,KAAK,GAC5C,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,iBAAiB,OAAO,SAAS,kBAAkB,CAC1D,CACF;EACF,OAAO,SACJ,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,IACC,QAAQ,WAAW,iBAAiB;GAClC,QAAQ,OAAO,SAAS;GACxB,oBAAoB,UAAU;EAChC,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,cAAc,OAAO,SAAS,YAAY,GAC/C,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,oBAAoB,OAAO,SAAS,kBAAkB,CAC7D,CACF;EACF,OAAO,SACJ,OAAO,QAAQ,oBAAoB,KAAK,CAAC,CACzC,IAAI,QAAQ,oBAAoB,iBAAiB,UAAU,wBAAwB,CAAC,CAAC,CACrF,MACC,IACE,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,cAAc,OAAO,SAAS,YAAY,GAC/C,GAAG,EAAE,UAAU,OAAO,SAAS,kBAAkB,CACnD,CACF;CACJ;CACA,IAAI,QAAQ,qBAAqB,KAAA,GAC/B,OAAO,SAAS,OAAO,QAAQ,WAAW,KAAK,CAAC,CAAC,OAC/C,QAAQ,WAAW,qBAAqB;EACtC,YAAY,MAAM;EAClB,WAAW,QAAQ;EACnB,kBAAkB;EAClB,iBAAiB,UAAU;CAC7B,CAAC,CACH;MAEA,OAAO,SACJ,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,IACC,QAAQ,WAAW,mBAAmB;EACpC,kBAAkB;EAClB,iBAAiB,UAAU;CAC7B,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,EAAE,WAAW,MAAM,OAAO,SAAS,GACtC,GAAG,EAAE,OAAO,MAAM,OAAO,KAAK,GAC9B,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,iBAAiB,QAAQ,iBAAkB,QAAQ,WAAW,gBAAgB,CACrF,CACF;CAEJ,IAAI,QAAQ,qBAAqB,KAAA,GAAW;EAC1C,OAAO,SAAS,OAAO,QAAQ,WAAW,KAAK,CAAC,CAAC,OAC/C,QAAQ,WAAW,qBAAqB;GACtC,UAAU,MAAM;GAChB,WAAW,QAAQ;GACnB,cAAc;GACd,YAAY,MAAM;GAClB,oBAAoB,UAAU;EAChC,CAAC,CACH;EACA,OAAO,SAAS,OAAO,QAAQ,oBAAoB,KAAK,CAAC,CAAC,OACxD,QAAQ,oBAAoB,aAAa;GACvC,WAAW,QAAQ;GACnB,cAAc;GACd,UAAU,UAAU;EACtB,CAAC,CACH;CACF,OAAO;EACL,MAAM,cAAc,QAAQ,iBAAiB,QAAQ,WAAW;EAEhE,OAAO,SACJ,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,IACC,QAAQ,WAAW,iBAAiB;GAClC,YAAY,MAAM;GAClB,oBAAoB,UAAU;EAChC,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,cAAc,kBAAkB,GACrC,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,oBAAoB,WAAW,CACtC,CACF;EACF,OAAO,SACJ,OAAO,QAAQ,oBAAoB,KAAK,CAAC,CACzC,IAAI,QAAQ,oBAAoB,iBAAiB,UAAU,wBAAwB,CAAC,CAAC,CACrF,MACC,IACE,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,cAAc,kBAAkB,GACrC,GAAG,EAAE,UAAU,WAAW,CAC5B,CACF;CACJ;CACA,OAAO,SACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,IAAI,aAAkB,CAAC,CAAC,QAAQ,QAAQ,kBAAkB,UAAU,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAC5F,MACC,IACE,GAAG,EAAE,IAAI,QAAQ,eAAe,GAChC,GAAG,EAAE,kBAAkB,MAAM,SAAS,SAAS,gBAAgB,CACjE,CACF;CACF,OAAO,SAAS,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,OAC5C,QAAQ,QAAQ,aAAa;EAC3B,UAAU,MAAM;EAChB,WAAW,MAAM;EACjB;EACA,eAAe,MAAM,cAAc,UAAU;EAC7C,sBAAsB,MAAM,QAAQ;CACtC,CAAC,CACH;CAEA,MAAM,oBACJ,WAAW,mBACP,CAAC,IACD,OAAO,WACL,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,cAAc,QAAQ,OAAQ,SAAS,YAAY,GACxD,GAAG,EAAE,WAAW,QAAQ,eAAe,CACzC,CACF,GACF,KACF;CAEN,MAAM,UAAU,OAAO,gBAAgB,SAAS,MAAM,UAAU,MAAM,MAAM,EAAA,CAAG;CAE/E,MAAM,kBAAkB,OAAO,WAC7B,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,oBAAoB,KAAK,CAAC,CACvC,MAAM,IAAI,GAAG,EAAE,WAAW,QAAQ,eAAe,GAAG,GAAG,EAAE,cAAc,kBAAkB,CAAC,CAAC,CAAC,CAC5F,MAAM,CAAC,GACV,KACF;CAEA,MAAM,UAAU,OAAO,WACrB,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MACC,IACE,GAAG,eAAe,OAAO,CAAC,CAAC,UAAU,MAAM,QAAQ,GACnD,GAAG,eAAe,OAAO,CAAC,CAAC,WAAW,MAAM,SAAS,GACrD,GAAG,eAAe,OAAO,CAAC,CAAC,QAAQ,MAAM,GACzC,GAAG,eAAe,OAAO,CAAC,CAAC,eAAe,MAAM,cAAc,UAAU,aAAa,GACrF,GACE,eAAe,OAAO,CAAC,CAAC,gBACxB,QAAQ,cAAc,MAAM,QAAQ,sBAAsB,CAC5D,CACF,CACF,CAAC,CACA,MAAM,CAAC,GACV,KACF;CAEA,MAAM,mBACJ,WAAW,KAAA,IACP,KAAA,IACA,OAAO,QAAQ,cAAc,OAAO,WAAW,QAAQ,WAAW,WAAW;CAEnF,MAAM,mBACJ,WAAW,mBACP,CAAC,IACD,OAAO,cAAc,SAAS,QAAQ,OAAQ,SAAS,YAAY,KAAK;CAE9E,MAAM,kBACJ,WAAW,mBACP,CAAC,IACD,OAAO,WACL,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,oBAAoB,KAAK,CAAC,CACvC,MACC,IACE,GAAG,EAAE,WAAW,QAAQ,eAAe,GACvC,GAAG,EAAE,cAAc,QAAQ,OAAQ,SAAS,YAAY,CAC1D,CACF,CAAC,CACA,MAAM,CAAC,GACV,KACF;CAEN,OACE,WAAW,KAAA,KACX,QAAQ,UAAU,OAAO,OAAO,QAAQ,QAAQ,QAAQ,KAAK,QAAQ,eAAe,KACpF,QAAQ,QAAQ,eAAe,OAAO,QAAQ,QAAQ,QAAQ,OAAO,KACrE,OAAO,QAAQ,QAAQ,QAAQ,sBAAsB,UAAU,wBAC/D,OAAO,WAAW,QAAQ,WAAW,qBAAqB,UAAU,4BACpE,qBAAqB,OACrB,OAAO,WAAW,QAAQ,WAAW,wBACnC,UAAU,4BACZ,OAAO,WAAW,QAAQ,WAAW,kBAAkB,sBACvD,QAAQ,UAAU,OAChB,OAAO,WAAW,QAAQ,WAAW,YACrC,QAAQ,eACV,KACA,QAAQ,WAAW,UAAU,OAAO,UAAU,KAC9C,QAAQ,WAAW,eAAe,OAAO,WAAW,QAAQ,WAAW,OAAO,KAC9E,gBAAgB,WAAW,KAC3B,gBAAgB,EAAE,CAAE,QAAQ,oBAAoB,cAC9C,UAAU,4BACZ,QAAQ,oBAAoB,eAC1B,gBAAgB,EAAE,CAAE,QAAQ,oBAAoB,OAClD,KACA,QAAQ,WAAW,MAClB,WAAW,oBACT,kBAAkB,WAAW,KAC5B,kBAAkB,EAAE,CAAE,QAAQ,WAAW,wBACvC,UAAU,4BACZ,CAAC,QAAQ,WAAW,eAAe,kBAAkB,EAAE,CAAE,QAAQ,WAAW,OAAO,KACnF,iBAAiB,WAAW,KAC5B,QAAQ,UAAU,OAChB,iBAAiB,EAAE,CAAE,QAAQ,WAAW,YACxC,QAAQ,eACV,KACA,iBAAiB,EAAE,CAAE,QAAQ,WAAW,qBACtC,UAAU,4BACZ,CAAC,QAAQ,WAAW,UAAU,iBAAiB,EAAG,KAClD,gBAAgB,WAAW,KAC3B,gBAAgB,EAAE,CAAE,QAAQ,oBAAoB,cAC9C,UAAU,4BACZ,CAAC,QAAQ,oBAAoB,eAC3B,gBAAgB,EAAE,CAAE,QAAQ,oBAAoB,OAClD;AAER,CAAC;AAED,MAAM,uBAAuB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACrE,eACA,OACA;CACA,MAAM,WAAW,OAAO;CAExB,IAAI,cAAc,UAAU,KAAA,GAAW,OAAO,OAAO,OAAO,KAAK,YAAY,CAAC;CAC9E,MAAM,aAAa,EAAE,MAAM,4BAA4B;CAEvD,MAAM,OAAO;EACX;EACA,UACE,UACA,SACA,YACG,QAAQ,QAAQ,QAAQ,QAAQ,CAAC;CACxC;CAgBA,OAAO,OAdO,uBAEV,SAAS,aAAa,gBACpB,oBACE,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MACA,OAAO,KAAK,UAAU,SAChB,KACR,CAAC,CAAC,KAAK,OAAO,eAAe,iBAAiB,WAA0C,CAAC,CAC3F,GACF,EAAE,MAAM,cAAc,KAAK,CAGX,CAAC,CAAC,KAClB,OAAO,GAAG,KAAK,GACf,OAAO,YAAY,UAAU;EAC3B,MAAM,SAAS,MAAM,QAAQ;EAE7B,OAAO,MAAM,QAAQ,WAAW,KAC9B,WAAW,KAAA,KACX,MAAM,aAAa,MAAM,KACzB,OAAO,UAAU,aACf,OAAO,QAAQ,IAAI,IACnB,OAAO,UAAU,KAAK;CAC5B,CAAC,CACH;AACF,CAAC;AAED,MAAM,kBAAkB,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,eACA,SACA;CACA,MAAM,WAAW,OAAO;CAExB,OAAO,OAAO,MACZ,UACA,eACA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO;EAEvB,OAAO,OAAO,OAAO,QAAQ,QAAQ,YAAY,OAAO,CAAC;CAC3D,CAAC,CACH;AACF,CAAC;AAED,MAAa,iCAAiC,OAAO,GAAG,gCAAgC,CAAC,CACvF,WACE,UACA,SACA,eAC6E;CAC7E,MAAM,QAAQ,OAAO;CAErB,OAAO,wBAAwB,GAAG;EAChC,SAAS,WACN,wBAAwB,OAAO,IAC5B,SACE,UACA,eACA,OAAO,IAAI,aAAa;GACtB,MAAM,UAAU,OAAO,eAAe,SAAS,OAAO,cAAc,OAAO;GAE3E,IAAI,YAAY,KAAA,GAAW,OAAO,OAAO,YAAY;GAErD,OAAO,OAAO,OAAO;IACnB,UAAU,sBAAsB,QAAQ,QAAQ;IAChD,UAAU,QAAQ;IAClB,GAAI,QAAQ,WAAW,KAAA,IACnB,CAAC,IACD,EAAE,QAAQ,OAAO,wBAAwB,QAAQ,OAAO,QAAQ,EAAE;GACxE,CAAC;EACH,CAAC,CACH,IACA,OAAO,KAAK,YAAY,CAAC,EAAA,CAC3B,KACA,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,kBAAkB,UAAU;GAC1B,IAAI,cAAc,UAAU,KAAA,KAAa,MAAM,QAAQ,SAAS,oBAC9D,OAAO,OAAO,QAAQ,KAAK,CAAC,CAAC,KAC3B,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;GACF,MAAM,UAAU,MAAM;GAEtB,OAAO,SACL,UACA,eACA,OAAO,IAAI,aAAa;IACtB,MAAM,SACJ,MAAM,SAAS,SAAS,iBAAiB,KACzC,MAAM,YAAY,+BACd,mBACA,MAAM,SAAS,SAAS,iBAAiB,KACvC,MAAM,YAAY,yBAClB,mBACA,KAAA;IAER,IAAI,WAAW,KAAA,GAAW,OAAO;IACjC,MAAM,WAAW,MAAM,SAAS,MAAM,GAAG,CAAC,IAAI,SAAS,MAAM;IAE7D,MAAM,UAAU,OAAO,eACrB,SACA;KACE;KACA,WAAW,QAAQ,SAAS;KAC5B,QAAQ,QAAQ;IAClB,GACA,KACF;IAEA,OAAO,YAAY,KAAA,KAAa,kBAAkB,QAAQ,UAAU,QAAQ,QAAQ;GACtF,CAAC,CACH,CAAC,CACE,KACC,OAAO,SAAS,YACd,UAAU,qBAAqB,eAAe,KAAK,IAAI,OAAO,QAAQ,KAAK,CAC7E,CACF,CAAC,CACA,KACC,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACJ;EACA,kBAAkB,YAAY,YAC5B,cAAc,SAAS,eAAe,YAAY,kBAAkB,OAAO,CAAC,CAAC,KAC3E,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,kBAAkB,YAAY,YAC5B,cAAc,SAAS,eAAe,YAAY,kBAAkB,OAAO,CAAC,CAAC,KAC3E,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,UAAU,OAAO,YACf,MACE,UACA,eACA,OAAO,IAAI,aAAa;GACtB,MAAM,cAAc,OAAO;GAC3B,MAAM,UAAU,OAAO;GAEvB,MAAM,IAAI,eAAe,OAAO;GAChC,MAAM,MAAM,OAAO;GAEnB,MAAM,OAAO,OAAO,WAClB,YACG,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAClC,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,IAAI,EAAE,gBAAgB,QAAQ,cAAc,GAAG,CAAC,CAClD,CACF,CAAC,CACA,MAAM,MAAM,QAAQ,CAAC,GACxB,cAAc,OAChB;GAEA,MAAM,WAAW,KAAK,MAAM,GAAG,MAAM,KAAK;GAE1C,MAAM,UAAU,QACd;IAAE,SAAS,SAAS;IAAQ,SAAS,KAAK,SAAS,MAAM;GAAM,GAC/D,OACF;GAEA,IAAI,SAAS,SAAS,GACpB,OAAO,YAAY,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,MAC/C,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,QACE,EAAE,WACF,SAAS,KAAK,QAAa,IAAI,SAAS,CAC1C,GACA,IAAI,EAAE,gBAAgB,QAAQ,cAAc,GAAG,CAAC,CAClD,CACF;GAEF,OAAO;EACT,CAAC,CACH,CAAC,CAAC,KACA,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;CACJ,CAAC;AACH,CACF;AAEA,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,eACA,YACA,QACA,SACA;CACA,MAAM,WAAW,OAAO;CAExB,IAAI,CAAC,wBAAwB,OAAO,KAAK,cAAc,UAAU,KAAA,GAC/D,OAAO,OAAO,YAAY;CAC5B,MAAM,QAAQ,OAAO,sBAAsB,UAAU;CAErD,MAAM,qBAAqB,OAAO,SAChC,cAAc,MACd,QAAQ,sBACR,QAAQ,wBACV;CAEA,MAAM,2BAA2B,OAAO,SACtC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;CAEA,MAAM,2BAA2B,OAAO,SACtC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;CAEA,MAAM,2BAA2B,OAAO,SACtC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;CAEA,MAAM,2BAA2B,OAAO,SACtC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;CAEA,MAAM,eAAe,OAAO,qBAC1B,SACA,cAAc,MACd,MAAM,SAAS,SAAS,gBAC1B;CAEA,IACE,iBAAiB,MAAM,SAAS,SAAS,oBACzC;EACE;EACA;EACA;EACA;CACF,CAAC,CAAC,MAAM,UAAU,MAAM,SAAS,SAAS,YAAY,MAAM,SAAS,KAAK,aAAa,KAAK,CAAC,GAE7F,OAAO,OAAO,YAAY;CAsE5B,OAAO,OApEK,MACV,UACA,eACA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO;EAEvB,MAAM,UAAU,OAAO,uBAAuB,SAAS,eAAe,OAAO,MAAM;EAEnF,IAAI,YAAY,KAAA,GAAW,OAAO,QAAQ,YAAY,OAAO;EAC7D,KACG,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,WAAW,cAAc,OAAO,EAAA,CAClF,SAAS,GAEZ,OAAO,QAAQ,YAAY,OAAO;EACpC,IAAI;EAEJ,OAAO,oBACL,cAAc,MAAO,SACrB,cAAc,MAAO,eACrB,MAAM,YACN,OAAO,IAAI,aAAa;GAGtB,MAAM,qBAAqB,OAAO,QAAQ,QAAQ,wBAChD,QAAQ,SACR,MACF;GAEA,MAAM,WAAW,OAAO,qBACtB,MAAM,cAAc,UACpB,MAAM,cAAc,WACtB,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;GAEnC,MAAM,aAAa,OAAO,qBACxB,MAAM,cAAc,UACpB,kBACF,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;GAEnC,IAAI,CAAC,SAAS,aAAa,CAAC,WAAW,WAAW,OAAO;GACzD,MAAM,MAAM,OAAO;GAEnB,OAAO,OAAO,cACZ,SACA,OACA,QACA,SACA;IACE;IACA;IACA;IACA;IACA;IACA,sBAAsB;GACxB,GACA,GACF;EACF,CAAC,IACA,aAAa;GACZ,UAAU,QAAQ,aAAa,cAAc,YAAY,YAAY,OAAO;GAE5E,OAAO;EACT,CACF;EAEA,OAAO,WAAW,QAAQ,YAAY,OAAO;CAC/C,CAAC,CAGa,CAAC,CAAC,KAChB,OAAO,YAAY,UAChB,MAAM,QAAQ,MAAM,MAAM,YAAY,KACrC,2BAA2B,QAAQ,mBAAmB,KAAK,KAC5D,MAAM,QAAQ,MAAM,MAAM,YAAY,KACrC,2BAA2B,QAAQ,sBAAsB,KAAK,KAC/D,MAAM,QAAQ,MAAM,MAAM,YAAY,KACrC,2BAA2B,QAAQ,sBAAsB,KAAK,IAC5D,gBAAgB,eAAe,OAAO,IACtC,OAAO,UAAU,KAAK,CAC5B,CACF;AACF,CAAC"}

package/dist/drizzle/email-target.d.mts

@@ -0,0 +1,28 @@
+import "../Schema.mjs";
+import "../hooks/models.mjs";
+import { LifecycleHooks } from "../hooks/LifecycleHooks.mjs";
+import "../Hooks.mjs";
+import "../Identity.mjs";
+import "../Proofs.mjs";
+import "../email/errors.mjs";
+import { EmailSignInTargets } from "../email/EmailSignInTargets.mjs";
+import { EmailAddressPersistence } from "../email/EmailAddressPersistence.mjs";
+import "../Email.mjs";
+import "./email-sql.mjs";
+import { EmailRegistrationAuthority } from "./email-registration.mjs";
+import "./proof-target.mjs";
+import { Context, Effect, Layer } from "effect";
+import "effect/unstable/sql/SqlError";
+//#region src/drizzle/email-target.d.ts
+declare const emailSignInTargetsLayer: (services: Effect.Effect<{
+  readonly emailSignInTargets: EmailSignInTargets["Service"];
+}>) => Layer.Layer<EmailSignInTargets, never, never>;
+declare const emailAddressPersistenceLayer: (services: Effect.Effect<{
+  readonly emailAddressPersistence: EmailAddressPersistence["Service"];
+}, never, LifecycleHooks>) => Layer.Layer<EmailAddressPersistence, never, LifecycleHooks>;
+declare const emailRegistrationLayer: <Id, Registration>(tag: Context.Key<Id, EmailRegistrationAuthority<Registration>>, services: Effect.Effect<{
+  readonly registrationAuthority: EmailRegistrationAuthority<Registration>;
+}, never, LifecycleHooks>) => Layer.Layer<Id, never, LifecycleHooks>;
+//#endregion
+export { emailAddressPersistenceLayer, emailRegistrationLayer, emailSignInTargetsLayer };
+//# sourceMappingURL=email-target.d.mts.map

package/dist/drizzle/email-target.mjs

@@ -0,0 +1,75 @@
+import { LifecycleHooks } from "../hooks/LifecycleHooks.mjs";
+import { coordinateCommit, hasCommitScope } from "../hooks/commit.mjs";
+import { sqlClientStandaloneGuard } from "./standalone-guard.mjs";
+import { EmailAddressPersistence } from "../email/EmailAddressPersistence.mjs";
+import { EmailSignInTargets } from "../email/EmailSignInTargets.mjs";
+import { EmailUnavailable } from "../email/errors.mjs";
+import { makeSqlEmailAddressPersistence, makeSqlEmailSignInTargets } from "./email-sql.mjs";
+import { makeSqlEmailRegistrationAuthority } from "./email-registration.mjs";
+import { Effect, Layer } from "effect";
+//#region src/drizzle/email-target.ts
+const sqlClientEmailStandaloneGuard = (database) => sqlClientStandaloneGuard(database, () => EmailUnavailable.make({}));
+const proofConfiguration = (configuration, coordinated = false) => ({
+	mode: configuration.proof.mode,
+	locking: configuration.proof.locking,
+	standaloneGuard: Effect.void,
+	coordinated,
+	insertIfAbsent: configuration.proof.insertIfAbsent
+});
+const addressOptions = (configuration, proofMapping, coordinated = false) => ({
+	mode: configuration.mode,
+	locking: configuration.locking,
+	standaloneGuard: !coordinated ? configuration.standaloneGuard : Effect.void,
+	coordinated,
+	proof: {
+		mapping: proofMapping,
+		configuration: proofConfiguration(configuration, true)
+	}
+});
+const registrationOptions = (configuration, proofMapping, coordinated = false) => ({
+	mode: configuration.mode,
+	locking: configuration.locking,
+	standaloneGuard: !coordinated ? configuration.standaloneGuard : Effect.void,
+	generatedSubjectRows: configuration.generatedSubjectRows,
+	coordinated,
+	proof: {
+		mapping: proofMapping,
+		configuration: proofConfiguration(configuration, true)
+	}
+});
+const makeTargetEmailSignInServices = (database, mapping, configuration) => Effect.gen(function* () {
+	return { emailSignInTargets: yield* makeSqlEmailSignInTargets(database, mapping, {
+		mode: configuration.mode,
+		locking: false,
+		standaloneGuard: configuration.standaloneGuard
+	}) };
+});
+const makeTargetEmailAddressServices = (database, mapping, proofMapping, configuration) => Effect.gen(function* () {
+	return { emailAddressPersistence: yield* makeSqlEmailAddressPersistence(database, mapping, addressOptions(configuration, proofMapping)) };
+});
+const makeTargetEmailRegistrationServices = (database, mapping, proofMapping, configuration) => Effect.gen(function* () {
+	return { registrationAuthority: yield* makeSqlEmailRegistrationAuthority(database, mapping, registrationOptions(configuration, proofMapping)) };
+});
+const coordinateTargetEmailAddress = (database, mapping, proofMapping, configuration, owner) => Effect.gen(function* () {
+	const hooks = yield* LifecycleHooks;
+	if (yield* hasCommitScope) return yield* EmailUnavailable.make({});
+	yield* configuration.coordinatorGuard ?? configuration.standaloneGuard;
+	return (yield* coordinateCommit(() => database.transaction((transaction) => Effect.gen(function* () {
+		return yield* owner(transaction, { emailAddressPersistence: yield* makeSqlEmailAddressPersistence(transaction, mapping, addressOptions(configuration, proofMapping, true)) });
+	})), { mode: configuration.mode }).pipe(Effect.provideService(LifecycleHooks, hooks))).value;
+});
+const coordinateTargetEmailRegistration = (database, mapping, proofMapping, configuration, owner) => Effect.gen(function* () {
+	const hooks = yield* LifecycleHooks;
+	if (yield* hasCommitScope) return yield* EmailUnavailable.make({});
+	yield* configuration.coordinatorGuard ?? configuration.standaloneGuard;
+	return (yield* coordinateCommit(() => database.transaction((transaction) => Effect.gen(function* () {
+		return yield* owner(transaction, { registrationAuthority: yield* makeSqlEmailRegistrationAuthority(transaction, mapping, registrationOptions(configuration, proofMapping, true)) });
+	})), { mode: configuration.mode }).pipe(Effect.provideService(LifecycleHooks, hooks))).value;
+});
+const emailSignInTargetsLayer = (services) => Layer.effect(EmailSignInTargets, Effect.map(services, (value) => value.emailSignInTargets));
+const emailAddressPersistenceLayer = (services) => Layer.effect(EmailAddressPersistence, Effect.map(services, (value) => value.emailAddressPersistence));
+const emailRegistrationLayer = (tag, services) => Layer.effect(tag, Effect.map(services, (value) => value.registrationAuthority));
+//#endregion
+export { coordinateTargetEmailAddress, coordinateTargetEmailRegistration, emailAddressPersistenceLayer, emailRegistrationLayer, emailSignInTargetsLayer, makeTargetEmailAddressServices, makeTargetEmailRegistrationServices, makeTargetEmailSignInServices, sqlClientEmailStandaloneGuard };
+
+//# sourceMappingURL=email-target.mjs.map

package/dist/drizzle/email-target.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-target.mjs","names":[],"sources":["../../src/drizzle/email-target.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- public driver wrappers restore concrete Drizzle generics. */\nimport type { Context } from \"effect\";\nimport { Effect, Layer } from \"effect\";\nimport type * as SqlError from \"effect/unstable/sql/SqlError\";\n\nimport { EmailAddressPersistence } from \"../email/EmailAddressPersistence\";\nimport { EmailSignInTargets } from \"../email/EmailSignInTargets\";\nimport { EmailUnavailable } from \"../email/errors\";\nimport { coordinateCommit, hasCommitScope } from \"../hooks/commit\";\nimport { LifecycleHooks } from \"../hooks/LifecycleHooks\";\nimport type { HookConfigurationError } from \"../hooks/models\";\nimport {\n  makeSqlEmailRegistrationAuthority,\n  type EmailRegistrationAuthority,\n  type EmailRegistrationConfiguration,\n} from \"./email-registration\";\nimport {\n  makeSqlEmailAddressPersistence,\n  makeSqlEmailSignInTargets,\n  type EmailSqlConfiguration,\n  type EmailSqlDatabase,\n  type EmailSqlQuery,\n} from \"./email-sql\";\nimport type { ProofTargetConfiguration } from \"./proof-target\";\nimport { sqlClientStandaloneGuard } from \"./standalone-guard\";\n\nexport interface EmailTargetConfiguration {\n  readonly mode: \"interactive\" | \"synchronous\";\n  readonly locking: boolean;\n  readonly standaloneGuard: Effect.Effect<void, EmailUnavailable>;\n  readonly coordinatorGuard?: Effect.Effect<void, EmailUnavailable>;\n  readonly generatedSubjectRows: (query: EmailSqlQuery) => EmailSqlQuery;\n  readonly proof: ProofTargetConfiguration;\n}\n\ninterface TransactionOwner<Transaction> {\n  readonly transaction: <A, E, R>(\n    body: (transaction: Transaction) => Effect.Effect<A, E, R>,\n  ) => Effect.Effect<A, E | SqlError.SqlError, R>;\n}\n\nexport type EmailCoordinatorError<E> =\n  | E\n  | EmailUnavailable\n  | HookConfigurationError\n  | SqlError.SqlError;\n\nexport const sqlClientEmailStandaloneGuard = (\n  database: unknown,\n): Effect.Effect<void, EmailUnavailable> =>\n  sqlClientStandaloneGuard(database, () => EmailUnavailable.make({}));\n\nconst proofConfiguration = (configuration: EmailTargetConfiguration, coordinated = false) => ({\n  mode: configuration.proof.mode,\n  locking: configuration.proof.locking,\n\n  standaloneGuard: Effect.void,\n  coordinated,\n  insertIfAbsent: configuration.proof.insertIfAbsent,\n});\n\nconst addressOptions = (\n  configuration: EmailTargetConfiguration,\n  proofMapping: any,\n  coordinated = false,\n): EmailSqlConfiguration => ({\n  mode: configuration.mode,\n  locking: configuration.locking,\n\n  standaloneGuard: !coordinated ? configuration.standaloneGuard : Effect.void,\n  coordinated,\n  proof: {\n    mapping: proofMapping,\n    configuration: proofConfiguration(configuration, true),\n  },\n});\n\nconst registrationOptions = (\n  configuration: EmailTargetConfiguration,\n  proofMapping: any,\n  coordinated = false,\n): EmailRegistrationConfiguration => ({\n  mode: configuration.mode,\n  locking: configuration.locking,\n\n  standaloneGuard: !coordinated ? configuration.standaloneGuard : Effect.void,\n  generatedSubjectRows: configuration.generatedSubjectRows,\n  coordinated,\n  proof: {\n    mapping: proofMapping,\n    configuration: proofConfiguration(configuration, true),\n  },\n});\n\nexport const makeTargetEmailSignInServices = (\n  database: any,\n  mapping: any,\n  configuration: EmailTargetConfiguration,\n) =>\n  Effect.gen(function* () {\n    return {\n      emailSignInTargets: yield* makeSqlEmailSignInTargets(database, mapping, {\n        mode: configuration.mode,\n        locking: false,\n        standaloneGuard: configuration.standaloneGuard,\n      }),\n    };\n  });\n\nexport const makeTargetEmailAddressServices = (\n  database: any,\n  mapping: any,\n  proofMapping: any,\n  configuration: EmailTargetConfiguration,\n) =>\n  Effect.gen(function* () {\n    return {\n      emailAddressPersistence: yield* makeSqlEmailAddressPersistence(\n        database,\n        mapping,\n        addressOptions(configuration, proofMapping),\n      ),\n    };\n  });\n\nexport const makeTargetEmailRegistrationServices = <Registration>(\n  database: any,\n  mapping: any,\n  proofMapping: any,\n  configuration: EmailTargetConfiguration,\n) =>\n  Effect.gen(function* () {\n    return {\n      registrationAuthority: yield* makeSqlEmailRegistrationAuthority<Registration>(\n        database,\n        mapping,\n        registrationOptions(configuration, proofMapping),\n      ),\n    };\n  });\n\nexport const coordinateTargetEmailAddress = <Transaction, A, E, R>(\n  database: TransactionOwner<Transaction>,\n  mapping: any,\n  proofMapping: any,\n  configuration: EmailTargetConfiguration,\n  owner: (\n    transaction: Transaction,\n    services: { readonly emailAddressPersistence: EmailAddressPersistence[\"Service\"] },\n  ) => Effect.Effect<A, E, R>,\n): Effect.Effect<A, EmailCoordinatorError<E>, R | LifecycleHooks> =>\n  Effect.gen(function* (): Effect.fn.Return<A, EmailCoordinatorError<E>, R | LifecycleHooks> {\n    const hooks = yield* LifecycleHooks;\n\n    if (yield* hasCommitScope) return yield* EmailUnavailable.make({});\n    yield* configuration.coordinatorGuard ?? configuration.standaloneGuard;\n\n    const result = yield* coordinateCommit(\n      () =>\n        database.transaction((transaction) =>\n          Effect.gen(function* () {\n            return yield* owner(transaction, {\n              emailAddressPersistence: yield* makeSqlEmailAddressPersistence(\n                transaction as unknown as EmailSqlDatabase,\n                mapping,\n                addressOptions(configuration, proofMapping, true),\n              ),\n            });\n          }),\n        ),\n      { mode: configuration.mode },\n    ).pipe(Effect.provideService(LifecycleHooks, hooks));\n\n    return result.value;\n  });\n\nexport const coordinateTargetEmailRegistration = <Registration, Transaction, A, E, R>(\n  database: TransactionOwner<Transaction>,\n  mapping: any,\n  proofMapping: any,\n  configuration: EmailTargetConfiguration,\n  owner: (\n    transaction: Transaction,\n    services: { readonly registrationAuthority: EmailRegistrationAuthority<Registration> },\n  ) => Effect.Effect<A, E, R>,\n): Effect.Effect<A, EmailCoordinatorError<E>, R | LifecycleHooks> =>\n  Effect.gen(function* (): Effect.fn.Return<A, EmailCoordinatorError<E>, R | LifecycleHooks> {\n    const hooks = yield* LifecycleHooks;\n\n    if (yield* hasCommitScope) return yield* EmailUnavailable.make({});\n    yield* configuration.coordinatorGuard ?? configuration.standaloneGuard;\n\n    const result = yield* coordinateCommit(\n      () =>\n        database.transaction((transaction) =>\n          Effect.gen(function* () {\n            return yield* owner(transaction, {\n              registrationAuthority: yield* makeSqlEmailRegistrationAuthority<Registration>(\n                transaction as unknown as EmailSqlDatabase,\n                mapping,\n                registrationOptions(configuration, proofMapping, true),\n              ),\n            });\n          }),\n        ),\n      { mode: configuration.mode },\n    ).pipe(Effect.provideService(LifecycleHooks, hooks));\n\n    return result.value;\n  });\n\nexport const emailSignInTargetsLayer = (\n  services: Effect.Effect<{ readonly emailSignInTargets: EmailSignInTargets[\"Service\"] }>,\n) =>\n  Layer.effect(\n    EmailSignInTargets,\n    Effect.map(services, (value) => value.emailSignInTargets),\n  );\n\nexport const emailAddressPersistenceLayer = (\n  services: Effect.Effect<\n    { readonly emailAddressPersistence: EmailAddressPersistence[\"Service\"] },\n    never,\n    LifecycleHooks\n  >,\n) =>\n  Layer.effect(\n    EmailAddressPersistence,\n    Effect.map(services, (value) => value.emailAddressPersistence),\n  );\n\nexport const emailRegistrationLayer = <Id, Registration>(\n  tag: Context.Key<Id, EmailRegistrationAuthority<Registration>>,\n  services: Effect.Effect<\n    { readonly registrationAuthority: EmailRegistrationAuthority<Registration> },\n    never,\n    LifecycleHooks\n  >,\n) =>\n  Layer.effect(\n    tag,\n    Effect.map(services, (value) => value.registrationAuthority),\n  );\n"],"mappings":";;;;;;;;;;AA+CA,MAAa,iCACX,aAEA,yBAAyB,gBAAgB,iBAAiB,KAAK,CAAC,CAAC,CAAC;AAEpE,MAAM,sBAAsB,eAAyC,cAAc,WAAW;CAC5F,MAAM,cAAc,MAAM;CAC1B,SAAS,cAAc,MAAM;CAE7B,iBAAiB,OAAO;CACxB;CACA,gBAAgB,cAAc,MAAM;AACtC;AAEA,MAAM,kBACJ,eACA,cACA,cAAc,WACa;CAC3B,MAAM,cAAc;CACpB,SAAS,cAAc;CAEvB,iBAAiB,CAAC,cAAc,cAAc,kBAAkB,OAAO;CACvE;CACA,OAAO;EACL,SAAS;EACT,eAAe,mBAAmB,eAAe,IAAI;CACvD;AACF;AAEA,MAAM,uBACJ,eACA,cACA,cAAc,WACsB;CACpC,MAAM,cAAc;CACpB,SAAS,cAAc;CAEvB,iBAAiB,CAAC,cAAc,cAAc,kBAAkB,OAAO;CACvE,sBAAsB,cAAc;CACpC;CACA,OAAO;EACL,SAAS;EACT,eAAe,mBAAmB,eAAe,IAAI;CACvD;AACF;AAEA,MAAa,iCACX,UACA,SACA,kBAEA,OAAO,IAAI,aAAa;CACtB,OAAO,EACL,oBAAoB,OAAO,0BAA0B,UAAU,SAAS;EACtE,MAAM,cAAc;EACpB,SAAS;EACT,iBAAiB,cAAc;CACjC,CAAC,EACH;AACF,CAAC;AAEH,MAAa,kCACX,UACA,SACA,cACA,kBAEA,OAAO,IAAI,aAAa;CACtB,OAAO,EACL,yBAAyB,OAAO,+BAC9B,UACA,SACA,eAAe,eAAe,YAAY,CAC5C,EACF;AACF,CAAC;AAEH,MAAa,uCACX,UACA,SACA,cACA,kBAEA,OAAO,IAAI,aAAa;CACtB,OAAO,EACL,uBAAuB,OAAO,kCAC5B,UACA,SACA,oBAAoB,eAAe,YAAY,CACjD,EACF;AACF,CAAC;AAEH,MAAa,gCACX,UACA,SACA,cACA,eACA,UAKA,OAAO,IAAI,aAAgF;CACzF,MAAM,QAAQ,OAAO;CAErB,IAAI,OAAO,gBAAgB,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;CACjE,OAAO,cAAc,oBAAoB,cAAc;CAkBvD,QAAO,OAhBe,uBAElB,SAAS,aAAa,gBACpB,OAAO,IAAI,aAAa;EACtB,OAAO,OAAO,MAAM,aAAa,EAC/B,yBAAyB,OAAO,+BAC9B,aACA,SACA,eAAe,eAAe,cAAc,IAAI,CAClD,EACF,CAAC;CACH,CAAC,CACH,GACF,EAAE,MAAM,cAAc,KAAK,CAC7B,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC,EAAA,CAErC;AAChB,CAAC;AAEH,MAAa,qCACX,UACA,SACA,cACA,eACA,UAKA,OAAO,IAAI,aAAgF;CACzF,MAAM,QAAQ,OAAO;CAErB,IAAI,OAAO,gBAAgB,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;CACjE,OAAO,cAAc,oBAAoB,cAAc;CAkBvD,QAAO,OAhBe,uBAElB,SAAS,aAAa,gBACpB,OAAO,IAAI,aAAa;EACtB,OAAO,OAAO,MAAM,aAAa,EAC/B,uBAAuB,OAAO,kCAC5B,aACA,SACA,oBAAoB,eAAe,cAAc,IAAI,CACvD,EACF,CAAC;CACH,CAAC,CACH,GACF,EAAE,MAAM,cAAc,KAAK,CAC7B,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC,EAAA,CAErC;AAChB,CAAC;AAEH,MAAa,2BACX,aAEA,MAAM,OACJ,oBACA,OAAO,IAAI,WAAW,UAAU,MAAM,kBAAkB,CAC1D;AAEF,MAAa,gCACX,aAMA,MAAM,OACJ,yBACA,OAAO,IAAI,WAAW,UAAU,MAAM,uBAAuB,CAC/D;AAEF,MAAa,0BACX,KACA,aAMA,MAAM,OACJ,KACA,OAAO,IAAI,WAAW,UAAU,MAAM,qBAAqB,CAC7D"}

package/dist/drizzle/model.d.mts

@@ -0,0 +1,259 @@
+import { ConsumeChallenge, NewChallenge, NewRegistration, PendingRegistration, SubjectId } from "../Schema.mjs";
+import { ExternalIdentity, LoginIdentifier } from "../identity/models.mjs";
+import { AuthStoreError } from "../Errors.mjs";
+import { ConsumeDecision } from "../auth/ConsumeDecision.mjs";
+import { ChallengeConsumeDecision } from "../internal/AuthStoreDecisions.mjs";
+import { AuthStore } from "../AuthStore.mjs";
+import { ExternalIdentityMutation } from "../identity/ExternalIdentityMutation.mjs";
+import { SubjectProvisioner, SubjectProvisioningInput } from "../identity/SubjectProvisioner.mjs";
+import { OAuthState } from "../oauth/schema.mjs";
+import { OAuthStateStore } from "../oauth/OAuthStateStore.mjs";
+import { Cause, DateTime, Effect, Layer, Schema } from "effect";
+import { AnyColumn, InferInsertModel, InferSelectModel, Table } from "drizzle-orm";
+import * as SqlClient from "effect/unstable/sql/SqlClient";
+//#region src/drizzle/model.d.ts
+type CommitMode = "interactive" | "synchronous" | "batch";
+/**
+ * Ordinary error-channel consumes must own their commit. Coordinated callers
+ * use the decision methods inside their outer transaction and translate only
+ * after that owner commits.
+ */
+interface SqlClientTransactionDatabase {
+  readonly $client: Pick<SqlClient.SqlClient, "transactionService">;
+}
+declare const requireStandaloneConsume: (database: SqlClientTransactionDatabase) => Effect.Effect<void, AuthStoreError>;
+declare const DrizzleMappingError_base: Schema.Class<DrizzleMappingError, Schema.TaggedStruct<"DrizzleMappingError", {
+  readonly operation: Schema.NonEmptyString;
+  readonly cause: Schema.Defect;
+}>, Cause.YieldableError>;
+declare class DrizzleMappingError extends DrizzleMappingError_base {}
+interface InstantCodec<NativeInstant> {
+  readonly encode: (instant: DateTime.Utc) => NativeInstant;
+  readonly decode: (native: NativeInstant) => Effect.Effect<DateTime.Utc, DrizzleMappingError>;
+}
+interface RequiredAuthStoreConstraints {
+  readonly series: "unique(namespace,value,purpose)";
+  readonly challengeDigest: "unique(tokenDigest)";
+  readonly registrationDigest: "unique(tokenDigest)";
+}
+interface RequiredOAuthStateConstraints {
+  readonly oauthStateDigest: "unique(stateDigest)";
+}
+interface RequiredAuthConstraints extends RequiredAuthStoreConstraints, RequiredOAuthStateConstraints {}
+declare const requiredAuthConstraints: RequiredAuthConstraints;
+declare const requiredAuthStoreConstraints: RequiredAuthStoreConstraints;
+declare const requiredOAuthStateConstraints: RequiredOAuthStateConstraints;
+type ColumnKey<T extends Table> = Extract<keyof T["_"]["columns"], string>;
+interface ChallengeRecord {
+  readonly challenge: NewChallenge;
+  readonly namespace: string;
+  readonly failedAttempts: number;
+  readonly consumed: boolean;
+}
+interface ChallengeColumns<T extends Table> {
+  readonly challengeId: ColumnKey<T>;
+  readonly tokenDigest: ColumnKey<T>;
+  readonly namespace: ColumnKey<T>;
+  readonly value: ColumnKey<T>;
+  readonly purpose: ColumnKey<T>;
+  readonly otpKeyId: ColumnKey<T>;
+  readonly otpDigest: ColumnKey<T>;
+  readonly issuedAt: ColumnKey<T>;
+  readonly expiresAt: ColumnKey<T>;
+  readonly attemptLimit: ColumnKey<T>;
+  readonly failedAttempts: ColumnKey<T>;
+  readonly consumed: ColumnKey<T>;
+}
+/**
+ * Inputs are immutable server-created issuances. Replacements must advance
+ * issuedAt; equal or older issuances fail even after consumption or expiry.
+ * Instant encoding must preserve this ordering. Retain the series row as an
+ * issuance watermark until every previously accepted issuance has expired;
+ * current-row expiry alone is insufficient if historical lifetimes were longer.
+ */
+interface ChallengeTableMapping<T extends Table> {
+  readonly table: T;
+  readonly columns: ChallengeColumns<T>;
+  readonly identifierNamespace: string;
+  readonly encodeInstant: (instant: DateTime.Utc) => unknown;
+  readonly encodeInsert: (input: NewChallenge, state: {
+    readonly namespace: string;
+    readonly failedAttempts: number;
+    readonly consumed: false;
+  }) => InferInsertModel<T>;
+  readonly encodeUpdate: (input: NewChallenge, state: {
+    readonly namespace: string;
+    readonly failedAttempts: unknown;
+    readonly consumed: false;
+  }) => Readonly<Record<string, unknown>>;
+  readonly decode: (row: InferSelectModel<T>) => Effect.Effect<ChallengeRecord, DrizzleMappingError>;
+}
+interface RegistrationRecord {
+  readonly registration: PendingRegistration;
+  readonly consumed: boolean;
+}
+interface RegistrationColumns<T extends Table> {
+  readonly registrationId: ColumnKey<T>;
+  readonly tokenDigest: ColumnKey<T>;
+  readonly expiresAt: ColumnKey<T>;
+  readonly consumed: ColumnKey<T>;
+}
+interface RegistrationTableMapping<T extends Table> {
+  readonly table: T;
+  readonly columns: RegistrationColumns<T>;
+  readonly encodeInstant: (instant: DateTime.Utc) => unknown;
+  readonly encodeInsert: (input: NewRegistration, consumed: false) => InferInsertModel<T>;
+  readonly decode: (row: InferSelectModel<T>) => Effect.Effect<RegistrationRecord, DrizzleMappingError>;
+}
+interface OAuthStateColumns<T extends Table> {
+  readonly stateDigest: ColumnKey<T>;
+  readonly expiresAt: ColumnKey<T>;
+  readonly consumed: ColumnKey<T>;
+}
+interface OAuthStateTableMapping<T extends Table> {
+  readonly table: T;
+  readonly columns: OAuthStateColumns<T>;
+  readonly encodeInstant: (instant: DateTime.Utc) => unknown;
+  readonly encodeInsert: (state: OAuthState, consumed: false) => InferInsertModel<T>;
+  readonly decode: (row: InferSelectModel<T>) => Effect.Effect<{
+    readonly state: OAuthState;
+    readonly consumed: boolean;
+  }, DrizzleMappingError>;
+}
+interface AuthStoreTables<Challenge extends Table, Registration extends Table> {
+  readonly constraints: RequiredAuthStoreConstraints;
+  readonly challenge: ChallengeTableMapping<Challenge>;
+  readonly registration: RegistrationTableMapping<Registration>;
+}
+interface OAuthStateTables<State extends Table> {
+  readonly constraints: RequiredOAuthStateConstraints;
+  readonly oauthState: OAuthStateTableMapping<State>;
+}
+interface AuthTables<Challenge extends Table, Registration extends Table, State extends Table> {
+  readonly constraints: RequiredAuthConstraints;
+  readonly challenge: ChallengeTableMapping<Challenge>;
+  readonly registration: RegistrationTableMapping<Registration>;
+  readonly oauthState: OAuthStateTableMapping<State>;
+}
+interface RequiredIdentityConstraints {
+  readonly identifier: "unique(namespace,value)";
+  readonly externalIdentity: "unique(provider,issuer,subject)";
+  readonly provisioningRequest: "unique(requestId)";
+  readonly provisioningSubject: "notNull(provisioningRequest.subjectId)";
+}
+interface RequiredSubjectProvisioningConstraints {
+  readonly identifier: "unique(namespace,value)";
+  readonly provisioningRequest: "unique(requestId)";
+  readonly provisioningSubject: "notNull(provisioningRequest.subjectId)";
+}
+interface RequiredExternalIdentityConstraints {
+  readonly externalIdentity: "unique(provider,issuer,subject)";
+}
+declare const requiredIdentityConstraints: RequiredIdentityConstraints;
+declare const requiredSubjectProvisioningConstraints: RequiredSubjectProvisioningConstraints;
+declare const requiredExternalIdentityConstraints: RequiredExternalIdentityConstraints;
+interface SubjectIdCodec<NativeId> {
+  readonly toNative: (id: SubjectId) => Effect.Effect<NativeId, DrizzleMappingError>;
+  readonly toSubject: (id: NativeId) => Effect.Effect<SubjectId, DrizzleMappingError>;
+  readonly equals: (left: NativeId, right: NativeId) => boolean;
+}
+interface SubjectProvisioningTables<Subject extends Table, Identifier extends Table, Request extends Table, NativeId> {
+  readonly constraints: RequiredSubjectProvisioningConstraints;
+  readonly subject: {
+    readonly table: Subject;
+    readonly id: ColumnKey<Subject>;
+    readonly status: ColumnKey<Subject>;
+    readonly isActiveStatus: (value: unknown) => boolean;
+    readonly encodeInsert: (input: SubjectProvisioningInput, allocatedId: NativeId | undefined) => InferInsertModel<Subject>;
+    readonly allocateId?: Effect.Effect<NativeId, DrizzleMappingError>;
+    /** Required instead of allocateId when a synchronous-only DO transaction preallocates IDs. */
+    readonly allocateIdSync?: () => NativeId;
+    /** Decodes MySQL `$returningId()` for an autoincrement/runtime-default key. */
+    readonly decodeGeneratedId?: (rows: ReadonlyArray<unknown>) => Effect.Effect<NativeId, DrizzleMappingError>;
+  };
+  readonly identifier: {
+    readonly table: Identifier;
+    readonly namespace: ColumnKey<Identifier>;
+    readonly value: ColumnKey<Identifier>;
+    readonly subjectId: ColumnKey<Identifier>;
+    readonly encodeInsert: (identifier: LoginIdentifier, subjectId: NativeId, verifiedAt: DateTime.Utc | undefined) => InferInsertModel<Identifier>;
+  };
+  readonly provisioningRequest: {
+    readonly table: Request;
+    readonly requestId: ColumnKey<Request>;
+    readonly fingerprint: ColumnKey<Request>;
+    readonly subjectId: ColumnKey<Request>;
+    readonly encodeInsert: (requestId: string, fingerprint: string, subjectId: NativeId) => InferInsertModel<Request>;
+  };
+  readonly subjectId: SubjectIdCodec<NativeId>;
+  /** Narrows only database constraint failures; every other cause is unavailable. */
+  readonly isConstraintConflict: (cause: unknown) => boolean;
+}
+interface ExternalIdentityTables<Subject extends Table, External extends Table, NativeId> {
+  readonly constraints: RequiredExternalIdentityConstraints;
+  readonly subject: {
+    readonly table: Subject;
+    readonly id: ColumnKey<Subject>;
+    readonly status: ColumnKey<Subject>;
+    readonly isActiveStatus: (value: unknown) => boolean;
+  };
+  readonly externalIdentity: {
+    readonly table: External;
+    readonly provider: ColumnKey<External>;
+    readonly issuer: ColumnKey<External>;
+    readonly subject: ColumnKey<External>;
+    readonly subjectId: ColumnKey<External>;
+    readonly encodeInsert: (identity: ExternalIdentity, subjectId: NativeId) => InferInsertModel<External>;
+  };
+  readonly subjectId: SubjectIdCodec<NativeId>;
+  readonly isConstraintConflict: (cause: unknown) => boolean;
+}
+interface IdentityTables<Subject extends Table, Identifier extends Table, External extends Table, Request extends Table, NativeId> {
+  readonly constraints: RequiredIdentityConstraints;
+  readonly subject: SubjectProvisioningTables<Subject, Identifier, Request, NativeId>["subject"];
+  readonly identifier: SubjectProvisioningTables<Subject, Identifier, Request, NativeId>["identifier"];
+  readonly externalIdentity: ExternalIdentityTables<Subject, External, NativeId>["externalIdentity"];
+  readonly provisioningRequest: SubjectProvisioningTables<Subject, Identifier, Request, NativeId>["provisioningRequest"];
+  readonly subjectId: SubjectIdCodec<NativeId>;
+  readonly isConstraintConflict: (cause: unknown) => boolean;
+}
+/** Extra encoders used by D1's ordered batch when the subject id is database-generated. */
+interface D1SubjectProvisioningMapping<Subject extends Table, Identifier extends Table, Request extends Table, NativeId> extends SubjectProvisioningTables<Subject, Identifier, Request, NativeId> {
+  readonly d1: {
+    readonly requestInsertWithoutSubject: (requestId: string, fingerprint: string) => Partial<InferInsertModel<Request>>;
+    readonly identifierInsertWithoutSubject: (identifier: LoginIdentifier, verifiedAt: DateTime.Utc | undefined) => Partial<InferInsertModel<Identifier>>;
+    /** Unshadowed hidden-rowid alias; omit for WITHOUT ROWID or preallocated IDs. */
+    readonly generatedRowIdAlias?: "rowid" | "_rowid_" | "oid";
+  };
+}
+interface D1ExternalIdentityMapping<Subject extends Table, External extends Table, NativeId> extends ExternalIdentityTables<Subject, External, NativeId> {
+  readonly d1: {
+    readonly activeStatusValue: unknown;
+  };
+}
+interface D1GeneratedIdentityMapping<Subject extends Table, Identifier extends Table, External extends Table, Request extends Table, NativeId> extends IdentityTables<Subject, Identifier, External, Request, NativeId> {
+  readonly d1: D1SubjectProvisioningMapping<Subject, Identifier, Request, NativeId>["d1"] & D1ExternalIdentityMapping<Subject, External, NativeId>["d1"];
+}
+declare const provisioningFingerprint: (input: SubjectProvisioningInput) => string;
+/**
+ * Drizzle wraps Effect SQL failures before adapters observe them. Give the
+ * consumer classifier each semantic wrapper in the short `cause`/`reason`
+ * chain without exposing query text or bound parameters through public errors.
+ */
+declare const isMappedConstraintConflict: (classify: (cause: unknown) => boolean, failure: unknown) => boolean;
+declare const column: <T extends Table>(table: T, key: ColumnKey<T>) => AnyColumn;
+declare const updateValues: <T extends Table>(entries: ReadonlyArray<readonly [ColumnKey<T>, unknown]>) => Partial<InferInsertModel<T>>;
+type ChallengeInput = ConsumeChallenge;
+/** Acquire an application database in Effect and expose the auth stores as one layer. */
+declare const authServicesLayer: <E, R>(acquire: Effect.Effect<{
+  readonly authStore: AuthStore["Service"];
+  readonly oauthStateStore: OAuthStateStore["Service"];
+}, E, R>) => Layer.Layer<AuthStore | OAuthStateStore, E, Exclude<R, import("effect/Scope").Scope>>;
+/** Acquire an application database in Effect and expose the identity services as one layer. */
+declare const identityServicesLayer: <E, R>(acquire: Effect.Effect<{
+  readonly subjectProvisioner: SubjectProvisioner["Service"];
+  readonly externalIdentityMutation: ExternalIdentityMutation["Service"];
+}, E, R>) => Layer.Layer<ExternalIdentityMutation | SubjectProvisioner, E, Exclude<R, import("effect/Scope").Scope>>;
+//#endregion
+export { AuthStoreTables, AuthTables, ChallengeColumns, type ChallengeConsumeDecision, ChallengeInput, ChallengeRecord, ChallengeTableMapping, CommitMode, type ConsumeDecision, D1ExternalIdentityMapping, D1GeneratedIdentityMapping, D1SubjectProvisioningMapping, DrizzleMappingError, ExternalIdentityTables, IdentityTables, InstantCodec, OAuthStateColumns, OAuthStateTableMapping, OAuthStateTables, RegistrationColumns, RegistrationRecord, RegistrationTableMapping, RequiredAuthConstraints, RequiredAuthStoreConstraints, RequiredExternalIdentityConstraints, RequiredIdentityConstraints, RequiredOAuthStateConstraints, RequiredSubjectProvisioningConstraints, SqlClientTransactionDatabase, SubjectIdCodec, SubjectProvisioningTables, authServicesLayer, column, identityServicesLayer, isMappedConstraintConflict, provisioningFingerprint, requireStandaloneConsume, requiredAuthConstraints, requiredAuthStoreConstraints, requiredExternalIdentityConstraints, requiredIdentityConstraints, requiredOAuthStateConstraints, requiredSubjectProvisioningConstraints, updateValues };
+//# sourceMappingURL=model.d.mts.map