@yielded/auth 0.1.0-beta.1

package/dist/drizzle/proof-sql.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof-sql.mjs","names":[],"sources":["../../src/drizzle/proof-sql.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- Drizzle erases consumer table types inside the shared dialect kernel. */\nimport { and, eq, gte, inArray, isNull, lte, notExists, sql, type Table } from \"drizzle-orm\";\nimport type { EffectDrizzleQueryError } from \"drizzle-orm/effect-core\";\nimport { Cause, Context, DateTime, Effect, Option, Schema } from \"effect\";\nimport type * as SqlError from \"effect/unstable/sql/SqlError\";\n\nimport { coordinateCommit, CurrentCommitJournal, hasCommitScope } from \"../hooks/commit\";\nimport { LifecycleHooks } from \"../hooks/LifecycleHooks\";\nimport { HookConfigurationError } from \"../hooks/models\";\nimport { reportPersistenceFailure } from \"../internal/diagnostics\";\nimport type { ProofCompletionPlan } from \"../proofs/completion\";\nimport { ProofRequestConflict, ProofUnavailable } from \"../proofs/errors\";\nimport {\n  ProofBinding,\n  type ProofAttemptDecision,\n  type ProofCleanupResult,\n  type ProofCompletionDecision,\n  type ProofDeliveryOutcome,\n  type ProofVersion,\n} from \"../proofs/models\";\nimport type { ProofBudget, ProofPolicy } from \"../proofs/policy\";\nimport { ProofPersistence, type ProofDeliveryClaim } from \"../proofs/ProofPersistence\";\nimport { column, DrizzleMappingError, updateValues } from \"./model\";\nimport {\n  CurrentPasswordPreparedTransaction,\n  PasswordPreparedPostconditions,\n} from \"./PasswordPreparedPostconditions\";\nimport {\n  type AnyProofPersistenceMapping,\n  requiredProofConstraints,\n  type ProofPersistenceMapping,\n  type ProofAction,\n  type ProofCommandDecision,\n  type ProofContinuationRecord,\n  type ProofScopeKeys,\n  type ProofScopeKind,\n} from \"./proof-model\";\n\ntype AdapterFailure = EffectDrizzleQueryError | DrizzleMappingError | SqlError.SqlError;\n\nexport interface ProofSqlQuery<A = ReadonlyArray<any>> extends Effect.Effect<A, AdapterFailure> {\n  readonly getSQL: () => ReturnType<typeof sql>;\n  readonly from: (...args: ReadonlyArray<any>) => ProofSqlQuery<A>;\n  readonly where: (...args: ReadonlyArray<any>) => ProofSqlQuery<A>;\n  readonly limit: (...args: ReadonlyArray<any>) => ProofSqlQuery<A>;\n  readonly orderBy: (...args: ReadonlyArray<any>) => ProofSqlQuery<A>;\n  readonly for: (...args: ReadonlyArray<any>) => ProofSqlQuery<A>;\n  readonly set: (...args: ReadonlyArray<any>) => ProofSqlQuery<A>;\n  readonly values: (...args: ReadonlyArray<any>) => ProofSqlQuery<A>;\n  readonly onConflictDoNothing: (...args: ReadonlyArray<any>) => ProofSqlQuery<A>;\n  readonly onDuplicateKeyUpdate: (...args: ReadonlyArray<any>) => ProofSqlQuery<A>;\n}\n\nexport interface ProofSqlDatabase {\n  readonly select: (...args: ReadonlyArray<any>) => ProofSqlQuery;\n  readonly insert: (...args: ReadonlyArray<any>) => ProofSqlQuery;\n  readonly update: (...args: ReadonlyArray<any>) => ProofSqlQuery;\n  readonly delete: (...args: ReadonlyArray<any>) => ProofSqlQuery;\n  readonly transaction: <A, E, R>(\n    body: (transaction: ProofSqlDatabase) => Effect.Effect<A, E, R>,\n  ) => Effect.Effect<A, E | SqlError.SqlError, R>;\n}\n\nexport class CurrentProofSql extends Context.Service<CurrentProofSql, ProofSqlDatabase>()(\n  \"effect-auth/CurrentProofSql\",\n) {}\n\nexport interface ProofSqlConfiguration {\n  readonly mode: \"interactive\" | \"synchronous\";\n  readonly locking: boolean;\n  readonly standaloneGuard: Effect.Effect<void, ProofUnavailable>;\n  readonly coordinated?: boolean;\n  /** Dialect-native insert-if-absent used to create serialization anchors. */\n  readonly insertIfAbsent: (\n    query: ProofSqlQuery,\n    selfKey: string,\n    selfValue: unknown,\n  ) => ProofSqlQuery;\n}\n\ntype Database = ProofSqlDatabase;\ntype Mapping = AnyProofPersistenceMapping;\nconst unavailable = () => ProofUnavailable.make({});\n\nconst translateFailure = <A, E, R>(\n  effect: Effect.Effect<A, E, R>,\n): Effect.Effect<A, ProofUnavailable, R> =>\n  reportPersistenceFailure(\n    effect,\n    (error) => Schema.is(ProofUnavailable)(error) || Schema.is(HookConfigurationError)(error),\n  ).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));\n\nconst translateIssueFailure = <A, E, R>(\n  effect: Effect.Effect<A, E, R>,\n): Effect.Effect<A, ProofUnavailable | ProofRequestConflict, R> =>\n  reportPersistenceFailure(\n    effect,\n    (error) =>\n      Schema.is(ProofUnavailable)(error) ||\n      Schema.is(ProofRequestConflict)(error) ||\n      Schema.is(HookConfigurationError)(error),\n  ).pipe(\n    Effect.catchCause((cause) =>\n      Effect.failCause(\n        Cause.map(cause, (error) =>\n          Schema.is(ProofRequestConflict)(error) ? error : unavailable(),\n        ),\n      ),\n    ),\n  );\n\nconst conflict = () => ProofRequestConflict.make({});\n\nconst validConstraints = (mapping: Mapping) =>\n  Object.entries(requiredProofConstraints).every(\n    ([key, value]) => mapping.constraints[key as keyof typeof requiredProofConstraints] === value,\n  );\n\nconst selectRows = (query: ProofSqlQuery, locking: boolean) =>\n  locking && typeof query.for === \"function\" ? query.for(\"update\") : query;\n\nconst allocateVersion = (\n  mapping: Mapping,\n  mode: ProofSqlConfiguration[\"mode\"],\n): Effect.Effect<ProofVersion, ProofUnavailable | DrizzleMappingError> => {\n  if (mode === \"synchronous\")\n    return mapping.allocateVersionSync === undefined\n      ? Effect.fail(unavailable())\n      : Effect.try({\n          try: mapping.allocateVersionSync,\n          catch: (cause) => new DrizzleMappingError({ operation: \"mapping\", cause }),\n        });\n  if (mapping.allocateVersion !== undefined) return mapping.allocateVersion;\n\n  return mapping.allocateVersionSync === undefined\n    ? Effect.fail(unavailable())\n    : Effect.try({\n        try: mapping.allocateVersionSync,\n        catch: (cause) => new DrizzleMappingError({ operation: \"mapping\", cause }),\n      });\n};\n\nconst canonicalBinding = Schema.encodeSync(Schema.fromJsonString(ProofBinding));\n\nconst sameBinding = (left: ProofBinding, right: ProofBinding): boolean =>\n  canonicalBinding(left) === canonicalBinding(right);\n\nconst requestColumns = (mapping: Mapping) => ({\n  moduleId: column(mapping.request.table, mapping.request.moduleId),\n  requestId: column(mapping.request.table, mapping.request.requestId),\n  fingerprint: column(mapping.request.table, mapping.request.fingerprint),\n  proofId: column(mapping.request.table, mapping.request.proofId),\n  retentionUntil: column(mapping.request.table, mapping.request.retentionUntil),\n});\n\nconst seriesColumns = (mapping: Mapping) => ({\n  moduleId: column(mapping.series.table, mapping.series.moduleId),\n  purpose: column(mapping.series.table, mapping.series.purpose),\n  scopeKey: column(mapping.series.table, mapping.series.scopeKey),\n  activeProofId: column(mapping.series.table, mapping.series.activeProofId),\n  lastIssueAt: column(mapping.series.table, mapping.series.lastIssueAt),\n  version: column(mapping.series.table, mapping.series.version),\n});\n\nconst generationColumns = (mapping: Mapping) => ({\n  moduleId: column(mapping.generation.table, mapping.generation.moduleId),\n  purpose: column(mapping.generation.table, mapping.generation.purpose),\n  proofId: column(mapping.generation.table, mapping.generation.proofId),\n  requestId: column(mapping.generation.table, mapping.generation.requestId),\n  seriesKey: column(mapping.generation.table, mapping.generation.seriesKey),\n  deliveryId: column(mapping.generation.table, mapping.generation.deliveryId),\n  verifierKeyId: column(mapping.generation.table, mapping.generation.verifierKeyId),\n  verifierDigest: column(mapping.generation.table, mapping.generation.verifierDigest),\n  issuedAt: column(mapping.generation.table, mapping.generation.issuedAt),\n  expiresAt: column(mapping.generation.table, mapping.generation.expiresAt),\n  version: column(mapping.generation.table, mapping.generation.version),\n  state: column(mapping.generation.table, mapping.generation.state),\n  sendCount: column(mapping.generation.table, mapping.generation.sendCount),\n  deliveryState: column(mapping.generation.table, mapping.generation.deliveryState),\n  claimVersion: column(mapping.generation.table, mapping.generation.claimVersion),\n  claimDeadline: column(mapping.generation.table, mapping.generation.claimDeadline),\n  retryAt: column(mapping.generation.table, mapping.generation.retryAt),\n  deliveryRetryMillis: column(mapping.generation.table, mapping.generation.deliveryRetryMillis),\n  retentionUntil: column(mapping.generation.table, mapping.generation.retentionUntil),\n});\n\nconst continuationColumns = (mapping: Mapping) => ({\n  moduleId: column(mapping.continuation.table, mapping.continuation.moduleId),\n  purpose: column(mapping.continuation.table, mapping.continuation.purpose),\n  continuationId: column(mapping.continuation.table, mapping.continuation.continuationId),\n  digest: column(mapping.continuation.table, mapping.continuation.digest),\n  proofId: column(mapping.continuation.table, mapping.continuation.proofId),\n  seriesKey: column(mapping.continuation.table, mapping.continuation.seriesKey),\n  expiresAt: column(mapping.continuation.table, mapping.continuation.expiresAt),\n  consumed: column(mapping.continuation.table, mapping.continuation.consumed),\n  version: column(mapping.continuation.table, mapping.continuation.version),\n  retentionUntil: column(mapping.continuation.table, mapping.continuation.retentionUntil),\n});\n\nconst scopeColumns = (mapping: Mapping) => ({\n  moduleId: column(mapping.rateScope.table, mapping.rateScope.moduleId),\n  purpose: column(mapping.rateScope.table, mapping.rateScope.purpose),\n  action: column(mapping.rateScope.table, mapping.rateScope.action),\n  scopeKind: column(mapping.rateScope.table, mapping.rateScope.scopeKind),\n  scopeKey: column(mapping.rateScope.table, mapping.rateScope.scopeKey),\n});\n\nconst abuseColumns = (mapping: Mapping) => ({\n  moduleId: column(mapping.abuseEvent.table, mapping.abuseEvent.moduleId),\n  purpose: column(mapping.abuseEvent.table, mapping.abuseEvent.purpose),\n  action: column(mapping.abuseEvent.table, mapping.abuseEvent.action),\n  scopeKind: column(mapping.abuseEvent.table, mapping.abuseEvent.scopeKind),\n  scopeKey: column(mapping.abuseEvent.table, mapping.abuseEvent.scopeKey),\n  commandId: column(mapping.abuseEvent.table, mapping.abuseEvent.commandId),\n  occurredAt: column(mapping.abuseEvent.table, mapping.abuseEvent.occurredAt),\n  retentionUntil: column(mapping.abuseEvent.table, mapping.abuseEvent.retentionUntil),\n});\n\nconst failureColumns = (mapping: Mapping) => ({\n  moduleId: column(mapping.failureEvent.table, mapping.failureEvent.moduleId),\n  purpose: column(mapping.failureEvent.table, mapping.failureEvent.purpose),\n  seriesKey: column(mapping.failureEvent.table, mapping.failureEvent.seriesKey),\n  commandId: column(mapping.failureEvent.table, mapping.failureEvent.commandId),\n  occurredAt: column(mapping.failureEvent.table, mapping.failureEvent.occurredAt),\n  retentionUntil: column(mapping.failureEvent.table, mapping.failureEvent.retentionUntil),\n});\n\nconst commandColumns = (mapping: Mapping) => ({\n  moduleId: column(mapping.command.table, mapping.command.moduleId),\n  commandId: column(mapping.command.table, mapping.command.commandId),\n  kind: column(mapping.command.table, mapping.command.kind),\n  decision: column(mapping.command.table, mapping.command.decision),\n  retentionUntil: column(mapping.command.table, mapping.command.retentionUntil),\n});\n\nconst nowMillis = DateTime.now.pipe(Effect.map(DateTime.toEpochMillis));\n\nconst lockAuthority = Effect.fn(\"DrizzleProof.lockAuthority\")(function* (\n  mapping: Mapping,\n  moduleId: string,\n  purpose: any,\n  binding: ProofBinding,\n  locking: boolean,\n) {\n  const database = yield* CurrentProofSql;\n\n  const authority = mapping.authority;\n  let nativeSubjectId: unknown | undefined;\n\n  // Canonical order: subject, identifier rows, credentials sorted by ID.\n  if (binding._tag !== \"Identifier\") {\n    if (\n      authority.subject === undefined ||\n      authority.credential === undefined ||\n      authority.subjectId === undefined\n    )\n      return yield* unavailable();\n    nativeSubjectId = yield* authority.subjectId.toNative(binding.revision.subjectId);\n    const subject = authority.subject;\n\n    const rows = yield* selectRows(\n      database\n        .select()\n        .from(subject.table)\n        .where(eq(column(subject.table, subject.id), nativeSubjectId))\n        .limit(1),\n      locking,\n    );\n\n    const row = rows[0];\n\n    if (\n      row === undefined ||\n      !subject.isActiveStatus(row[subject.status]) ||\n      row[subject.securityRevision] !== binding.revision.securityRevision\n    )\n      return false;\n  }\n  const identifier = authority.identifier;\n\n  const identifierRows = yield* selectRows(\n    database\n      .select()\n      .from(identifier.table)\n      .where(\n        and(\n          eq(column(identifier.table, identifier.namespace), binding.identifier.namespace),\n          eq(column(identifier.table, identifier.value), binding.identifier.value),\n        ),\n      ),\n    locking,\n  );\n\n  if (\n    !identifier.isCurrent(\n      { moduleId, purpose, binding, ...(nativeSubjectId === undefined ? {} : { nativeSubjectId }) },\n      identifierRows,\n    )\n  )\n    return false;\n  if (binding._tag === \"Identifier\") return true;\n  const credential = authority.credential!;\n\n  const expected = [...binding.revision.credentials].sort((a, b) =>\n    a.credentialId.localeCompare(b.credentialId),\n  );\n\n  const rows =\n    expected.length === 0\n      ? []\n      : yield* selectRows(\n          database\n            .select()\n            .from(credential.table)\n            .where(\n              and(\n                eq(column(credential.table, credential.subjectId), nativeSubjectId),\n                inArray(\n                  column(credential.table, credential.credentialId),\n                  expected.map((item) => item.credentialId),\n                ),\n              ),\n            ),\n          locking,\n        );\n\n  if (rows.length !== expected.length) return false;\n\n  const actual = rows\n    .map((row: any) => ({\n      credentialId: row[credential.credentialId] as string,\n      revision: row[credential.revision],\n      active:\n        credential.status === undefined ||\n        credential.isActiveStatus?.(row[credential.status]) === true,\n    }))\n    .sort((a: any, b: any) => a.credentialId.localeCompare(b.credentialId));\n\n  return actual.every(\n    (item: any, index: number) =>\n      item.active &&\n      item.credentialId === expected[index]?.credentialId &&\n      item.revision === expected[index]?.revision,\n  );\n});\n\ninterface ScopeEntry {\n  readonly kind: ProofScopeKind;\n  readonly key: string;\n  readonly budget: ProofBudget;\n}\n\nconst scopeEntries = (\n  keys: ProofScopeKeys,\n  binding: ProofBinding,\n  action: ProofAction,\n  policy: ProofPolicy,\n): ReadonlyArray<ScopeEntry> => {\n  const suffix = action === \"issue\" ? \"Issues\" : \"Attempts\";\n  const simple = action === \"issue\" ? \"issues\" : \"attempts\";\n\n  const entries: ScopeEntry[] = [\n    { kind: \"action\", key: \"*\", budget: policy.abuse[`action${suffix}`] },\n    { kind: \"identifier\", key: keys.identifier, budget: policy.abuse[simple] },\n  ];\n\n  if (binding._tag !== \"Identifier\")\n    entries.push({\n      kind: \"subject\",\n      key: keys.subject,\n      budget: policy.abuse[`subject${suffix}`],\n    });\n\n  return entries;\n};\n\nconst lockScopes = Effect.fn(\"DrizzleProof.lockScopes\")(function* (\n  mapping: Mapping,\n  configuration: ProofSqlConfiguration,\n  moduleId: string,\n  purpose: any,\n  action: ProofAction,\n  entries: ReadonlyArray<ScopeEntry>,\n) {\n  const database = yield* CurrentProofSql;\n\n  const c = scopeColumns(mapping);\n\n  for (const entry of entries) {\n    const values = mapping.rateScope.encodeInsert({\n      moduleId,\n      purpose,\n      action,\n      scopeKind: entry.kind,\n      scopeKey: entry.key,\n    });\n\n    const query = database.insert(mapping.rateScope.table).values(values);\n\n    yield* configuration.insertIfAbsent(query, mapping.rateScope.scopeKey, entry.key);\n    yield* selectRows(\n      database\n        .select()\n        .from(mapping.rateScope.table)\n        .where(\n          and(\n            eq(c.moduleId, moduleId),\n            eq(c.purpose, purpose),\n            eq(c.action, action),\n            eq(c.scopeKind, entry.kind),\n            eq(c.scopeKey, entry.key),\n          ),\n        )\n        .limit(1),\n      configuration.locking,\n    );\n  }\n});\n\nconst admittedScopes = Effect.fn(\"DrizzleProof.admittedScopes\")(function* (\n  mapping: Mapping,\n  moduleId: string,\n  purpose: any,\n  action: ProofAction,\n  entries: ReadonlyArray<ScopeEntry>,\n  now: number,\n) {\n  const database = yield* CurrentProofSql;\n\n  const c = abuseColumns(mapping);\n  const admitted: ScopeEntry[] = [];\n\n  for (const entry of entries) {\n    const rows = yield* selectRows(\n      database\n        .select({ commandId: c.commandId })\n        .from(mapping.abuseEvent.table)\n        .where(\n          and(\n            eq(c.moduleId, moduleId),\n            eq(c.purpose, purpose),\n            eq(c.action, action),\n            eq(c.scopeKind, entry.kind),\n            eq(c.scopeKey, entry.key),\n            gte(c.occurredAt, mapping.encodeInstant(now - entry.budget.windowMillis)),\n          ),\n        )\n        .limit(entry.budget.limit),\n      true,\n    );\n\n    if (rows.length < entry.budget.limit) admitted.push(entry);\n  }\n\n  return admitted;\n});\n\nconst insertScopeEvents = Effect.fn(\"Drizzle.insertScopeEvents\")(function* (\n  mapping: Mapping,\n  moduleId: string,\n  purpose: any,\n  action: ProofAction,\n  commandId: string,\n  entries: ReadonlyArray<ScopeEntry>,\n  now: number,\n  retentionUntil: number,\n) {\n  const database = yield* CurrentProofSql;\n\n  return yield* Effect.forEach(\n    entries,\n    (entry) =>\n      database.insert(mapping.abuseEvent.table).values(\n        mapping.abuseEvent.encodeInsert({\n          moduleId,\n          purpose,\n          action,\n          scopeKind: entry.kind,\n          scopeKey: entry.key,\n          commandId,\n          occurredAtMillis: now,\n          retentionUntilMillis: retentionUntil,\n        }),\n      ),\n    { discard: true },\n  );\n});\n\nconst ensureSeries = Effect.fn(\"DrizzleProof.ensureSeries\")(function* (\n  mapping: Mapping,\n  configuration: ProofSqlConfiguration,\n  moduleId: string,\n  purpose: any,\n  scopeKey: string,\n) {\n  const database = yield* CurrentProofSql;\n\n  const c = seriesColumns(mapping);\n  const initialVersion = yield* allocateVersion(mapping, configuration.mode);\n\n  const query = database\n    .insert(mapping.series.table)\n    .values(mapping.series.encodeInsert({ moduleId, purpose, scopeKey, version: initialVersion }));\n\n  yield* configuration.insertIfAbsent(query, mapping.series.scopeKey, scopeKey);\n\n  const rows = yield* selectRows(\n    database\n      .select()\n      .from(mapping.series.table)\n      .where(and(eq(c.moduleId, moduleId), eq(c.purpose, purpose), eq(c.scopeKey, scopeKey)))\n      .limit(1),\n    configuration.locking,\n  );\n\n  return rows[0] ?? (yield* unavailable());\n});\n\nconst readGeneration = Effect.fn(\"Drizzle.readGeneration\")(function* (\n  mapping: Mapping,\n  moduleId: string,\n  proofId: string,\n  locking: boolean,\n) {\n  const database = yield* CurrentProofSql;\n\n  const c = generationColumns(mapping);\n\n  return yield* selectRows(\n    database\n      .select()\n      .from(mapping.generation.table)\n      .where(and(eq(c.moduleId, moduleId), eq(c.proofId, proofId)))\n      .limit(1),\n    locking,\n  );\n});\n\nconst failureCount = Effect.fn(\"DrizzleProof.failureCount\")(function* (\n  mapping: Mapping,\n  moduleId: string,\n  purpose: any,\n  seriesKey: string,\n  now: number,\n  policy: ProofPolicy,\n) {\n  const database = yield* CurrentProofSql;\n\n  const c = failureColumns(mapping);\n\n  const rows = yield* selectRows(\n    database\n      .select({ commandId: c.commandId })\n      .from(mapping.failureEvent.table)\n      .where(\n        and(\n          eq(c.moduleId, moduleId),\n          eq(c.purpose, purpose),\n          eq(c.seriesKey, seriesKey),\n          gte(c.occurredAt, mapping.encodeInstant(now - policy.abuse.attempts.windowMillis)),\n        ),\n      )\n      .limit(policy.maximumFailedAttempts),\n    true,\n  );\n\n  return rows.length;\n});\n\nconst commandRow = Effect.fn(\"Drizzle.commandRow\")(function* (\n  mapping: Mapping,\n  moduleId: string,\n  commandId: string,\n  locking: boolean,\n) {\n  const database = yield* CurrentProofSql;\n\n  const c = commandColumns(mapping);\n\n  return yield* selectRows(\n    database\n      .select()\n      .from(mapping.command.table)\n      .where(and(eq(c.moduleId, moduleId), eq(c.commandId, commandId)))\n      .limit(1),\n    locking,\n  );\n});\n\nconst insertCommand = Effect.fn(\"Drizzle.insertCommand\")(function* (\n  mapping: Mapping,\n  moduleId: string,\n  commandId: string,\n  kind: \"attempt\" | \"complete\",\n  decision: ProofCommandDecision,\n  retentionUntil: number,\n) {\n  const database = yield* CurrentProofSql;\n\n  return yield* database.insert(mapping.command.table).values(\n    mapping.command.encodeInsert({\n      moduleId,\n      commandId,\n      kind,\n      decision,\n      retentionUntilMillis: retentionUntil,\n    }),\n  );\n});\n\nconst owned = <A, E, R>(\n  database: Database,\n  mapping: Mapping,\n  configuration: ProofSqlConfiguration,\n  body: Effect.Effect<A, E, R>,\n) => {\n  if (!validConstraints(mapping)) return Effect.fail(unavailable());\n\n  const run = coordinateCommit(\n    () =>\n      database.transaction((transaction) =>\n        body.pipe(Effect.provideService(CurrentProofSql, transaction)),\n      ),\n    { mode: configuration.mode },\n  ).pipe(Effect.map((result) => result.value));\n\n  return configuration.coordinated !== true\n    ? Effect.gen(function* () {\n        if (yield* hasCommitScope) return yield* unavailable();\n        yield* configuration.standaloneGuard;\n\n        return yield* run;\n      })\n    : run;\n};\n\nexport const makeSqlProofPersistence = Effect.fn(\"makeSqlProofPersistence\")(function* (\n  database: Database,\n  mapping: Mapping,\n  configuration: ProofSqlConfiguration,\n): Effect.fn.Return<ProofPersistence[\"Service\"], never, LifecycleHooks> {\n  const hooks = yield* LifecycleHooks;\n\n  return ProofPersistence.of({\n    issue: (input, prepare) =>\n      owned(\n        database,\n        mapping,\n        configuration,\n        Effect.gen(function* () {\n          const transaction = yield* CurrentProofSql;\n          const journal = yield* CurrentCommitJournal;\n\n          const keys = mapping.scopeKeys({\n            moduleId: input.record.moduleId,\n            purpose: input.record.purpose,\n            binding: input.record.binding,\n          });\n\n          const authorityCurrent = yield* lockAuthority(\n            mapping,\n            input.record.moduleId,\n            input.record.purpose,\n            input.record.binding,\n            configuration.locking,\n          );\n\n          const scopes = scopeEntries(keys, input.record.binding, \"issue\", input.policy);\n\n          yield* lockScopes(\n            mapping,\n            configuration,\n            input.record.moduleId,\n            input.record.purpose,\n            \"issue\",\n            scopes.slice(0, 1),\n          );\n          const actionNow = yield* nowMillis;\n\n          const actionOpen =\n            (yield* admittedScopes(\n              mapping,\n              input.record.moduleId,\n              input.record.purpose,\n              \"issue\",\n              scopes.slice(0, 1),\n              actionNow,\n            )).length === 1;\n\n          if (actionOpen)\n            yield* lockScopes(\n              mapping,\n              configuration,\n              input.record.moduleId,\n              input.record.purpose,\n              \"issue\",\n              scopes.slice(1),\n            );\n\n          const series = actionOpen\n            ? yield* ensureSeries(\n                mapping,\n                configuration,\n                input.record.moduleId,\n                input.record.purpose,\n                keys.series,\n              )\n            : undefined;\n\n          const now = yield* nowMillis;\n          const retentionUntil = now + input.policy.requestRetentionMillis;\n          const rc = requestColumns(mapping);\n\n          let requestRows = yield* selectRows(\n            transaction\n              .select()\n              .from(mapping.request.table)\n              .where(\n                and(\n                  eq(rc.moduleId, input.record.moduleId),\n                  eq(rc.requestId, input.record.requestId),\n                ),\n              )\n              .limit(1),\n            configuration.locking,\n          );\n\n          let request = requestRows[0];\n\n          if (request !== undefined) {\n            const retainedUntil = yield* mapping.decodeInstant(\n              request[mapping.request.retentionUntil],\n            );\n\n            if (retainedUntil > now) {\n              if (request[mapping.request.fingerprint] !== input.record.fingerprint)\n                return yield* conflict();\n              const receipt = yield* mapping.request.decodeReceipt(request);\n\n              return prepare({ _tag: \"Existing\", receipt }, journal);\n            }\n            yield* transaction\n              .delete(mapping.request.table)\n              .where(\n                and(\n                  eq(rc.moduleId, input.record.moduleId),\n                  eq(rc.requestId, input.record.requestId),\n                  lte(rc.retentionUntil, mapping.encodeInstant(now)),\n                ),\n              );\n          }\n\n          const requestInsert = mapping.request.encodeInsert({\n            record: input.record,\n            createdAtMillis: now,\n            retentionUntilMillis: retentionUntil,\n          });\n\n          const requestQuery = transaction.insert(mapping.request.table).values(requestInsert);\n\n          yield* configuration.insertIfAbsent(\n            requestQuery,\n            mapping.request.requestId,\n            input.record.requestId,\n          );\n          requestRows = yield* selectRows(\n            transaction\n              .select()\n              .from(mapping.request.table)\n              .where(\n                and(\n                  eq(rc.moduleId, input.record.moduleId),\n                  eq(rc.requestId, input.record.requestId),\n                ),\n              )\n              .limit(1),\n            configuration.locking,\n          );\n          request = requestRows[0];\n\n          if (request === undefined) return yield* unavailable();\n          if (request[mapping.request.fingerprint] !== input.record.fingerprint)\n            return yield* conflict();\n          if (request[mapping.request.proofId] !== input.record.proofId) {\n            const receipt = yield* mapping.request.decodeReceipt(request);\n\n            return prepare({ _tag: \"Existing\", receipt }, journal);\n          }\n\n          const admitted = actionOpen\n            ? yield* admittedScopes(\n                mapping,\n                input.record.moduleId,\n                input.record.purpose,\n                \"issue\",\n                scopes,\n                now,\n              )\n            : [];\n\n          const sc = seriesColumns(mapping);\n\n          const lastIssueAt =\n            series?.[mapping.series.lastIssueAt] === null ||\n            series?.[mapping.series.lastIssueAt] === undefined\n              ? undefined\n              : yield* mapping.decodeInstant(series[mapping.series.lastIssueAt]);\n\n          const activeProofId = series?.[mapping.series.activeProofId] as string | null | undefined;\n\n          const supersedesCurrent =\n            input.supersedes === undefined || input.supersedes === activeProofId;\n\n          const allowed =\n            authorityCurrent &&\n            input.eligible &&\n            admitted.length === scopes.length &&\n            input.record.issuedAtMillis <= now &&\n            input.record.expiresAtMillis > now &&\n            supersedesCurrent &&\n            (lastIssueAt === undefined ||\n              now - lastIssueAt >= input.policy.abuse.resendCooldownMillis);\n\n          const receipt = {\n            requestId: input.record.requestId,\n            reference: {\n              proofId: input.record.proofId,\n              purpose: input.record.purpose,\n              keyId: input.record.verifier.keyId,\n            },\n          };\n\n          const prepared = prepare(\n            allowed\n              ? ({ _tag: \"Issued\", record: input.record } as const)\n              : ({ _tag: \"Suppressed\", receipt } as const),\n            journal,\n          );\n\n          if (admitted.length > 0)\n            yield* insertScopeEvents(\n              mapping,\n              input.record.moduleId,\n              input.record.purpose,\n              \"issue\",\n              input.record.requestId,\n              admitted,\n              now,\n              retentionUntil,\n            );\n          if (!allowed) return prepared;\n          if (activeProofId !== null && activeProofId !== undefined)\n            yield* transaction\n              .update(mapping.generation.table)\n              .set(updateValues<any>([[mapping.generation.state, \"superseded\"]]))\n              .where(\n                and(\n                  eq(generationColumns(mapping).moduleId, input.record.moduleId),\n                  eq(generationColumns(mapping).proofId, activeProofId),\n                  eq(generationColumns(mapping).state, \"active\"),\n                ),\n              );\n          yield* transaction.insert(mapping.generation.table).values(\n            mapping.generation.encodeInsert({\n              record: input.record,\n              seriesKey: keys.series,\n              retentionUntilMillis: retentionUntil,\n              state: \"active\",\n              deliveryState: \"new\",\n              policy: input.policy,\n            }),\n          );\n          const nextVersion = yield* allocateVersion(mapping, configuration.mode);\n\n          yield* transaction\n            .update(mapping.series.table)\n            .set(\n              updateValues<any>([\n                [mapping.series.activeProofId, input.record.proofId],\n                [mapping.series.lastIssueAt, mapping.encodeInstant(now)],\n                [mapping.series.version, nextVersion],\n              ]),\n            )\n            .where(\n              and(\n                eq(sc.moduleId, input.record.moduleId),\n                eq(sc.purpose, input.record.purpose),\n                eq(sc.scopeKey, keys.series),\n              ),\n            );\n\n          return prepared;\n        }),\n      ).pipe(\n        Effect.provideService(CurrentProofSql, database),\n        Effect.provideService(LifecycleHooks, hooks),\n        translateIssueFailure,\n      ),\n    attempt: (input, prepare) =>\n      owned(\n        database,\n        mapping,\n        configuration,\n        Effect.gen(function* () {\n          const transaction = yield* CurrentProofSql;\n          const journal = yield* CurrentCommitJournal;\n\n          const keys = mapping.scopeKeys({\n            moduleId: input.moduleId,\n            purpose: input.purpose,\n            binding: input.binding,\n          });\n\n          const authorityCurrent = yield* lockAuthority(\n            mapping,\n            input.moduleId,\n            input.purpose,\n            input.binding,\n            configuration.locking,\n          );\n\n          const scopes = scopeEntries(keys, input.binding, \"attempt\", input.policy);\n\n          yield* lockScopes(\n            mapping,\n            configuration,\n            input.moduleId,\n            input.purpose,\n            \"attempt\",\n            scopes.slice(0, 1),\n          );\n          const actionNow = yield* nowMillis;\n\n          const actionOpen =\n            (yield* admittedScopes(\n              mapping,\n              input.moduleId,\n              input.purpose,\n              \"attempt\",\n              scopes.slice(0, 1),\n              actionNow,\n            )).length === 1;\n\n          if (actionOpen)\n            yield* lockScopes(\n              mapping,\n              configuration,\n              input.moduleId,\n              input.purpose,\n              \"attempt\",\n              scopes.slice(1),\n            );\n\n          const series = actionOpen\n            ? yield* ensureSeries(\n                mapping,\n                configuration,\n                input.moduleId,\n                input.purpose,\n                keys.series,\n              )\n            : undefined;\n\n          const generation = (yield* readGeneration(\n            mapping,\n            input.moduleId,\n            input.proofId,\n            configuration.locking,\n          ))[0];\n\n          const existingCommand = (yield* commandRow(\n            mapping,\n            input.moduleId,\n            input.continuationId,\n            configuration.locking,\n          ))[0];\n\n          if (existingCommand !== undefined) {\n            if (existingCommand[mapping.command.decision] === \"rejected\")\n              return prepare({ _tag: \"Rejected\" }, journal);\n\n            return yield* unavailable();\n          }\n          const now = yield* nowMillis;\n\n          const admitted = actionOpen\n            ? yield* admittedScopes(mapping, input.moduleId, input.purpose, \"attempt\", scopes, now)\n            : [];\n\n          const failures = yield* failureCount(\n            mapping,\n            input.moduleId,\n            input.purpose,\n            keys.series,\n            now,\n            input.policy,\n          );\n\n          const gc = generationColumns(mapping);\n          const activeProofId = series?.[mapping.series.activeProofId];\n\n          const storedBinding =\n            generation === undefined\n              ? undefined\n              : yield* mapping.generation.decodeBinding(generation);\n\n          const candidateMatches =\n            generation !== undefined &&\n            input.candidate !== undefined &&\n            generation[mapping.generation.verifierKeyId] === input.candidate.keyId &&\n            generation[mapping.generation.verifierDigest] === input.candidate.digest;\n\n          const currentGeneration =\n            generation !== undefined &&\n            generation[mapping.generation.purpose] === input.purpose &&\n            generation[mapping.generation.state] === \"active\" &&\n            activeProofId === input.proofId &&\n            storedBinding !== undefined &&\n            sameBinding(storedBinding, input.binding) &&\n            Number(yield* mapping.decodeInstant(generation[mapping.generation.expiresAt])) > now;\n\n          const accepted =\n            authorityCurrent &&\n            currentGeneration &&\n            candidateMatches &&\n            admitted.length === scopes.length &&\n            failures < input.policy.maximumFailedAttempts;\n\n          const retentionUntil = now + input.policy.requestRetentionMillis;\n\n          if (!accepted) {\n            const prepared = prepare({ _tag: \"Rejected\" }, journal);\n\n            yield* insertCommand(\n              mapping,\n              input.moduleId,\n              input.continuationId,\n              \"attempt\",\n              \"rejected\",\n              retentionUntil,\n            );\n            yield* insertScopeEvents(\n              mapping,\n              input.moduleId,\n              input.purpose,\n              \"attempt\",\n              input.continuationId,\n              admitted,\n              now,\n              retentionUntil,\n            );\n            if (\n              admitted.length === scopes.length &&\n              currentGeneration &&\n              !candidateMatches &&\n              failures < input.policy.maximumFailedAttempts\n            )\n              yield* transaction.insert(mapping.failureEvent.table).values(\n                mapping.failureEvent.encodeInsert({\n                  moduleId: input.moduleId,\n                  purpose: input.purpose,\n                  seriesKey: keys.series,\n                  commandId: input.continuationId,\n                  occurredAtMillis: now,\n                  retentionUntilMillis: retentionUntil,\n                }),\n              );\n\n            return prepared;\n          }\n          const version = yield* allocateVersion(mapping, configuration.mode);\n\n          const expiresAt = Math.min(\n            Number(yield* mapping.decodeInstant(generation![mapping.generation.expiresAt])),\n            now + input.policy.continuationLifetimeMillis,\n          );\n\n          const continuation: ProofContinuationRecord = {\n            moduleId: input.moduleId,\n            purpose: input.purpose,\n            continuationId: input.continuationId,\n            digest: input.continuationDigest,\n            proofId: input.proofId,\n            seriesKey: keys.series,\n            binding: input.binding,\n            expiresAtMillis: expiresAt,\n            version,\n          };\n\n          const decision: ProofAttemptDecision = {\n            _tag: \"Accepted\",\n            continuation: {\n              continuationId: input.continuationId,\n              purpose: input.purpose,\n              expiresAtMillis: expiresAt,\n            },\n          };\n\n          const prepared = prepare(decision, journal);\n\n          yield* insertCommand(\n            mapping,\n            input.moduleId,\n            input.continuationId,\n            \"attempt\",\n            \"accepted\",\n            retentionUntil,\n          );\n          yield* insertScopeEvents(\n            mapping,\n            input.moduleId,\n            input.purpose,\n            \"attempt\",\n            input.continuationId,\n            scopes,\n            now,\n            retentionUntil,\n          );\n          yield* transaction\n            .update(mapping.generation.table)\n            .set(updateValues<any>([[mapping.generation.state, \"consumed\"]]))\n            .where(\n              and(\n                eq(gc.moduleId, input.moduleId),\n                eq(gc.proofId, input.proofId),\n                eq(gc.state, \"active\"),\n              ),\n            );\n          yield* transaction.insert(mapping.continuation.table).values(\n            mapping.continuation.encodeInsert({\n              ...continuation,\n              retentionUntilMillis: retentionUntil,\n            }),\n          );\n\n          return prepared;\n        }),\n      ).pipe(\n        Effect.provideService(CurrentProofSql, database),\n        Effect.provideService(LifecycleHooks, hooks),\n        translateFailure,\n      ),\n    complete: (input, prepare) =>\n      owned(\n        database,\n        mapping,\n        configuration,\n        Effect.gen(function* () {\n          const journal = yield* CurrentCommitJournal;\n\n          return yield* completeIn(mapping, configuration, input, (decision) =>\n            prepare(decision, journal),\n          );\n        }),\n      ).pipe(\n        Effect.provideService(CurrentProofSql, database),\n        Effect.provideService(LifecycleHooks, hooks),\n        translateFailure,\n      ),\n    claimDelivery: (input, prepare) =>\n      owned(\n        database,\n        mapping,\n        configuration,\n        Effect.gen(function* () {\n          const transaction = yield* CurrentProofSql;\n          const journal = yield* CurrentCommitJournal;\n\n          const rows = yield* readGeneration(\n            mapping,\n            input.moduleId,\n            input.proofId,\n            configuration.locking,\n          );\n\n          const row = rows[0];\n          const now = yield* nowMillis;\n\n          if (row === undefined) return prepare({ _tag: \"Declined\" }, journal);\n          const c = generationColumns(mapping);\n          const expiresAt = yield* mapping.decodeInstant(row[mapping.generation.expiresAt]);\n\n          const claimDeadline =\n            row[mapping.generation.claimDeadline] === null ||\n            row[mapping.generation.claimDeadline] === undefined\n              ? undefined\n              : yield* mapping.decodeInstant(row[mapping.generation.claimDeadline]);\n\n          const retryAt =\n            row[mapping.generation.retryAt] === null ||\n            row[mapping.generation.retryAt] === undefined\n              ? undefined\n              : yield* mapping.decodeInstant(row[mapping.generation.retryAt]);\n\n          let state = row[mapping.generation.deliveryState] as string;\n\n          if (state === \"claimed\" && claimDeadline !== undefined && claimDeadline <= now) {\n            state = \"ambiguous\";\n            yield* transaction\n              .update(mapping.generation.table)\n              .set(updateValues<any>([[mapping.generation.deliveryState, \"ambiguous\"]]))\n              .where(and(eq(c.moduleId, input.moduleId), eq(c.proofId, input.proofId)));\n          }\n\n          const canClaim =\n            row[mapping.generation.version] === input.version &&\n            row[mapping.generation.deliveryId] === input.deliveryId &&\n            row[mapping.generation.state] === \"active\" &&\n            expiresAt > now &&\n            Number(row[mapping.generation.sendCount]) < input.policy.maximumDeliveryAttempts &&\n            (state === \"new\" ||\n              (state === \"ambiguous\" &&\n                input.allowAmbiguousRetry &&\n                (retryAt === undefined || retryAt <= now)));\n\n          if (!canClaim) return prepare({ _tag: \"Declined\" }, journal);\n          const claimVersion = yield* allocateVersion(mapping, configuration.mode);\n          const decision: ProofDeliveryClaim = { _tag: \"Claimed\", claimVersion };\n          const prepared = prepare(decision, journal);\n\n          yield* transaction\n            .update(mapping.generation.table)\n            .set(\n              updateValues<any>([\n                [mapping.generation.sendCount, Number(row[mapping.generation.sendCount]) + 1],\n                [mapping.generation.deliveryState, \"claimed\"],\n                [mapping.generation.claimVersion, claimVersion],\n                [\n                  mapping.generation.claimDeadline,\n                  mapping.encodeInstant(now + input.policy.deliveryClaimMillis),\n                ],\n                [\n                  mapping.generation.retryAt,\n                  mapping.encodeInstant(now + input.policy.deliveryRetryMillis),\n                ],\n              ]),\n            )\n            .where(and(eq(c.moduleId, input.moduleId), eq(c.proofId, input.proofId)));\n\n          return prepared;\n        }),\n      ).pipe(\n        Effect.provideService(CurrentProofSql, database),\n        Effect.provideService(LifecycleHooks, hooks),\n        translateFailure,\n      ),\n    settleDelivery: (input, prepare) =>\n      owned(\n        database,\n        mapping,\n        configuration,\n        Effect.gen(function* () {\n          const transaction = yield* CurrentProofSql;\n          const journal = yield* CurrentCommitJournal;\n\n          const initial = (yield* readGeneration(mapping, input.moduleId, input.proofId, false))[0];\n\n          if (initial === undefined) return prepare(undefined, journal);\n          const keys = initial[mapping.generation.seriesKey] as string;\n\n          yield* ensureSeries(\n            mapping,\n            configuration,\n            input.moduleId,\n            initial[mapping.generation.purpose],\n            keys,\n          );\n\n          const row = (yield* readGeneration(\n            mapping,\n            input.moduleId,\n            input.proofId,\n            configuration.locking,\n          ))[0];\n\n          const prepared = prepare(undefined, journal);\n\n          if (\n            row === undefined ||\n            row[mapping.generation.version] !== input.version ||\n            row[mapping.generation.deliveryId] !== input.deliveryId ||\n            row[mapping.generation.claimVersion] !== input.claimVersion ||\n            row[mapping.generation.deliveryState] !== \"claimed\"\n          )\n            return prepared;\n          const c = generationColumns(mapping);\n          const outcome: ProofDeliveryOutcome = input.outcome;\n\n          const state =\n            outcome._tag === \"Accepted\"\n              ? \"accepted\"\n              : outcome._tag === \"DefiniteFailure\"\n                ? \"failed\"\n                : \"ambiguous\";\n\n          const values: Array<readonly [string, unknown]> = [\n            [mapping.generation.deliveryState, state],\n            [mapping.generation.claimDeadline, null],\n          ];\n\n          if (outcome._tag === \"Ambiguous\")\n            values.push([\n              mapping.generation.retryAt,\n              mapping.encodeInstant(\n                (yield* nowMillis) + Number(row[mapping.generation.deliveryRetryMillis]),\n              ),\n            ]);\n          if (outcome._tag === \"DefiniteFailure\")\n            values.push([mapping.generation.state, \"cancelled\"]);\n          yield* transaction\n            .update(mapping.generation.table)\n            .set(updateValues<any>(values))\n            .where(and(eq(c.moduleId, input.moduleId), eq(c.proofId, input.proofId)));\n          if (outcome._tag === \"DefiniteFailure\") {\n            const sc = seriesColumns(mapping);\n\n            yield* transaction\n              .update(mapping.series.table)\n              .set(updateValues<any>([[mapping.series.activeProofId, null]]))\n              .where(\n                and(\n                  eq(sc.moduleId, input.moduleId),\n                  eq(sc.purpose, row[mapping.generation.purpose]),\n                  eq(sc.scopeKey, keys),\n                  eq(sc.activeProofId, input.proofId),\n                ),\n              );\n          }\n\n          return prepared;\n        }),\n      ).pipe(\n        Effect.provideService(CurrentProofSql, database),\n        Effect.provideService(LifecycleHooks, hooks),\n        translateFailure,\n      ),\n    cancel: (input, prepare) =>\n      owned(\n        database,\n        mapping,\n        configuration,\n        Effect.gen(function* () {\n          const transaction = yield* CurrentProofSql;\n          const journal = yield* CurrentCommitJournal;\n\n          const authorityCurrent = yield* lockAuthority(\n            mapping,\n            input.moduleId,\n            input.purpose,\n            input.binding,\n            configuration.locking,\n          );\n\n          const keys = mapping.scopeKeys({\n            moduleId: input.moduleId,\n            purpose: input.purpose,\n            binding: input.binding,\n          });\n\n          const series = yield* ensureSeries(\n            mapping,\n            configuration,\n            input.moduleId,\n            input.purpose,\n            keys.series,\n          );\n\n          const active = series[mapping.series.activeProofId] as string | undefined | null;\n          const prepared = prepare(undefined, journal);\n\n          if (authorityCurrent && active !== undefined && active !== null) {\n            const gc = generationColumns(mapping);\n            const sc = seriesColumns(mapping);\n\n            const row = (yield* readGeneration(\n              mapping,\n              input.moduleId,\n              active,\n              configuration.locking,\n            ))[0];\n\n            const storedBinding =\n              row === undefined ? undefined : yield* mapping.generation.decodeBinding(row);\n\n            if (storedBinding === undefined || !sameBinding(storedBinding, input.binding))\n              return prepared;\n\n            yield* transaction\n              .update(mapping.generation.table)\n              .set(updateValues<any>([[mapping.generation.state, \"cancelled\"]]))\n              .where(and(eq(gc.moduleId, input.moduleId), eq(gc.proofId, active)));\n            yield* transaction\n              .update(mapping.series.table)\n              .set(updateValues<any>([[mapping.series.activeProofId, null]]))\n              .where(\n                and(\n                  eq(sc.moduleId, input.moduleId),\n                  eq(sc.purpose, input.purpose),\n                  eq(sc.scopeKey, keys.series),\n                  eq(sc.activeProofId, active),\n                ),\n              );\n          }\n\n          return prepared;\n        }),\n      ).pipe(\n        Effect.provideService(CurrentProofSql, database),\n        Effect.provideService(LifecycleHooks, hooks),\n        translateFailure,\n      ),\n    cleanup: (input, prepare) =>\n      owned(\n        database,\n        mapping,\n        configuration,\n        Effect.gen(function* () {\n          const transaction = yield* CurrentProofSql;\n          const journal = yield* CurrentCommitJournal;\n\n          const now = yield* nowMillis;\n          const nativeNow = mapping.encodeInstant(now);\n          const gc = generationColumns(mapping);\n          const cc = continuationColumns(mapping);\n          const rc = requestColumns(mapping);\n          const ac = abuseColumns(mapping);\n          const fc = failureColumns(mapping);\n          const mc = commandColumns(mapping);\n          const sc = seriesColumns(mapping);\n          const rsc = scopeColumns(mapping);\n          let remaining = input.limit;\n          let hasMore = false;\n\n          const take = <A>(query: ProofSqlQuery<ReadonlyArray<A>>) =>\n            selectRows(query.limit(remaining + 1), configuration.locking).pipe(\n              Effect.map((rows) => {\n                if (rows.length > remaining) hasMore = true;\n                const selected = rows.slice(0, remaining);\n\n                remaining -= selected.length;\n\n                return selected;\n              }),\n            );\n\n          // Child rows and secret-bearing generations are removed before their\n          // retained request/decision records. Every selected row counts toward\n          // one caller-wide limit and is locked until this owner commits.\n          const continuations = yield* take(\n            transaction\n              .select({ continuationId: cc.continuationId })\n              .from(mapping.continuation.table)\n              .where(and(eq(cc.moduleId, input.moduleId), lte(cc.retentionUntil, nativeNow)))\n              .orderBy(cc.retentionUntil),\n          );\n\n          const generations = yield* take(\n            transaction\n              .select({ proofId: gc.proofId })\n              .from(mapping.generation.table)\n              .where(and(eq(gc.moduleId, input.moduleId), lte(gc.retentionUntil, nativeNow)))\n              .orderBy(gc.retentionUntil),\n          );\n\n          const requests = yield* take(\n            transaction\n              .select({ requestId: rc.requestId })\n              .from(mapping.request.table)\n              .where(and(eq(rc.moduleId, input.moduleId), lte(rc.retentionUntil, nativeNow)))\n              .orderBy(rc.retentionUntil),\n          );\n\n          const abuse = yield* take(\n            transaction\n              .select({\n                action: ac.action,\n                scopeKind: ac.scopeKind,\n                scopeKey: ac.scopeKey,\n                commandId: ac.commandId,\n              })\n              .from(mapping.abuseEvent.table)\n              .where(and(eq(ac.moduleId, input.moduleId), lte(ac.retentionUntil, nativeNow)))\n              .orderBy(ac.retentionUntil),\n          );\n\n          const failures = yield* take(\n            transaction\n              .select({ seriesKey: fc.seriesKey, commandId: fc.commandId })\n              .from(mapping.failureEvent.table)\n              .where(and(eq(fc.moduleId, input.moduleId), lte(fc.retentionUntil, nativeNow)))\n              .orderBy(fc.retentionUntil),\n          );\n\n          const commands = yield* take(\n            transaction\n              .select({ commandId: mc.commandId })\n              .from(mapping.command.table)\n              .where(and(eq(mc.moduleId, input.moduleId), lte(mc.retentionUntil, nativeNow)))\n              .orderBy(mc.retentionUntil),\n          );\n\n          const series = yield* take(\n            transaction\n              .select({ purpose: sc.purpose, scopeKey: sc.scopeKey })\n              .from(mapping.series.table)\n              .where(\n                and(\n                  eq(sc.moduleId, input.moduleId),\n                  isNull(sc.activeProofId),\n                  notExists(\n                    transaction\n                      .select({ one: sql`1` })\n                      .from(mapping.generation.table)\n                      .where(\n                        and(\n                          eq(gc.moduleId, sc.moduleId),\n                          eq(gc.purpose, sc.purpose),\n                          eq(gc.seriesKey, sc.scopeKey),\n                        ),\n                      ),\n                  ),\n                  notExists(\n                    transaction\n                      .select({ one: sql`1` })\n                      .from(mapping.failureEvent.table)\n                      .where(\n                        and(\n                          eq(fc.moduleId, sc.moduleId),\n                          eq(fc.purpose, sc.purpose),\n                          eq(fc.seriesKey, sc.scopeKey),\n                        ),\n                      ),\n                  ),\n                ),\n              ),\n          );\n\n          const rateScopes = yield* take(\n            transaction\n              .select({\n                purpose: rsc.purpose,\n                action: rsc.action,\n                scopeKind: rsc.scopeKind,\n                scopeKey: rsc.scopeKey,\n              })\n              .from(mapping.rateScope.table)\n              .where(\n                and(\n                  eq(rsc.moduleId, input.moduleId),\n                  notExists(\n                    transaction\n                      .select({ one: sql`1` })\n                      .from(mapping.abuseEvent.table)\n                      .where(\n                        and(\n                          eq(ac.moduleId, rsc.moduleId),\n                          eq(ac.purpose, rsc.purpose),\n                          eq(ac.action, rsc.action),\n                          eq(ac.scopeKind, rsc.scopeKind),\n                          eq(ac.scopeKey, rsc.scopeKey),\n                        ),\n                      ),\n                  ),\n                ),\n              ),\n          );\n\n          // Removing the final history row can make an anchor eligible only after this\n          // transaction/batch commits. One extra page lets the caller reclaim it.\n          hasMore ||= generations.length > 0 || failures.length > 0 || abuse.length > 0;\n          const removed = input.limit - remaining;\n          const prepared = prepare({ removed, hasMore } satisfies ProofCleanupResult, journal);\n\n          if (continuations.length > 0)\n            yield* transaction.delete(mapping.continuation.table).where(\n              and(\n                eq(cc.moduleId, input.moduleId),\n                inArray(\n                  cc.continuationId,\n                  continuations.map((row: any) => row.continuationId),\n                ),\n                lte(cc.retentionUntil, nativeNow),\n              ),\n            );\n          if (generations.length > 0)\n            yield* transaction\n              .update(mapping.series.table)\n              .set(updateValues<any>([[mapping.series.activeProofId, null]]))\n              .where(\n                and(\n                  eq(sc.moduleId, input.moduleId),\n                  inArray(\n                    sc.activeProofId,\n                    generations.map((row: any) => row.proofId),\n                  ),\n                ),\n              );\n          if (generations.length > 0)\n            yield* transaction.delete(mapping.generation.table).where(\n              and(\n                eq(gc.moduleId, input.moduleId),\n                inArray(\n                  gc.proofId,\n                  generations.map((row: any) => row.proofId),\n                ),\n                lte(gc.retentionUntil, nativeNow),\n              ),\n            );\n          if (requests.length > 0)\n            yield* transaction.delete(mapping.request.table).where(\n              and(\n                eq(rc.moduleId, input.moduleId),\n                inArray(\n                  rc.requestId,\n                  requests.map((row: any) => row.requestId),\n                ),\n                lte(rc.retentionUntil, nativeNow),\n              ),\n            );\n          for (const row of abuse)\n            yield* transaction\n              .delete(mapping.abuseEvent.table)\n              .where(\n                and(\n                  eq(ac.moduleId, input.moduleId),\n                  eq(ac.action, row.action),\n                  eq(ac.scopeKind, row.scopeKind),\n                  eq(ac.scopeKey, row.scopeKey),\n                  eq(ac.commandId, row.commandId),\n                  lte(ac.retentionUntil, nativeNow),\n                ),\n              );\n          for (const row of failures)\n            yield* transaction\n              .delete(mapping.failureEvent.table)\n              .where(\n                and(\n                  eq(fc.moduleId, input.moduleId),\n                  eq(fc.seriesKey, row.seriesKey),\n                  eq(fc.commandId, row.commandId),\n                  lte(fc.retentionUntil, nativeNow),\n                ),\n              );\n          if (commands.length > 0)\n            yield* transaction.delete(mapping.command.table).where(\n              and(\n                eq(mc.moduleId, input.moduleId),\n                inArray(\n                  mc.commandId,\n                  commands.map((row: any) => row.commandId),\n                ),\n                lte(mc.retentionUntil, nativeNow),\n              ),\n            );\n          for (const row of series)\n            yield* transaction.delete(mapping.series.table).where(\n              and(\n                eq(sc.moduleId, input.moduleId),\n                eq(sc.purpose, row.purpose),\n                eq(sc.scopeKey, row.scopeKey),\n                isNull(sc.activeProofId),\n                notExists(\n                  transaction\n                    .select({ one: sql`1` })\n                    .from(mapping.generation.table)\n                    .where(\n                      and(\n                        eq(gc.moduleId, sc.moduleId),\n                        eq(gc.purpose, sc.purpose),\n                        eq(gc.seriesKey, sc.scopeKey),\n                      ),\n                    ),\n                ),\n              ),\n            );\n          for (const row of rateScopes)\n            yield* transaction.delete(mapping.rateScope.table).where(\n              and(\n                eq(rsc.moduleId, input.moduleId),\n                eq(rsc.purpose, row.purpose),\n                eq(rsc.action, row.action),\n                eq(rsc.scopeKind, row.scopeKind),\n                eq(rsc.scopeKey, row.scopeKey),\n                notExists(\n                  transaction\n                    .select({ one: sql`1` })\n                    .from(mapping.abuseEvent.table)\n                    .where(\n                      and(\n                        eq(ac.moduleId, rsc.moduleId),\n                        eq(ac.purpose, rsc.purpose),\n                        eq(ac.action, rsc.action),\n                        eq(ac.scopeKind, rsc.scopeKind),\n                        eq(ac.scopeKey, rsc.scopeKey),\n                      ),\n                    ),\n                ),\n              ),\n            );\n\n          return prepared;\n        }),\n      ).pipe(\n        Effect.provideService(CurrentProofSql, database),\n        Effect.provideService(LifecycleHooks, hooks),\n        translateFailure,\n      ),\n  });\n});\n\nconst inspectCompletionIn = Effect.fn(\"DrizzleProof.inspectCompletionIn\")(function* (\n  mapping: Mapping,\n  configuration: ProofSqlConfiguration,\n  input: ProofCompletionPlan[\"input\"],\n  ensure: boolean,\n) {\n  const database = yield* CurrentProofSql;\n\n  const authorityCurrent = yield* lockAuthority(\n    mapping,\n    input.moduleId,\n    input.purpose,\n    input.binding,\n    configuration.locking,\n  );\n\n  const keys = mapping.scopeKeys({\n    moduleId: input.moduleId,\n    purpose: input.purpose,\n    binding: input.binding,\n  });\n\n  if (ensure)\n    yield* ensureSeries(mapping, configuration, input.moduleId, input.purpose, keys.series);\n  const c = continuationColumns(mapping);\n\n  const rows = yield* selectRows(\n    database\n      .select()\n      .from(mapping.continuation.table)\n      .where(and(eq(c.moduleId, input.moduleId), eq(c.continuationId, input.continuationId)))\n      .limit(1),\n    configuration.locking,\n  );\n\n  const row = rows[0];\n  const now = yield* nowMillis;\n  const record = row === undefined ? undefined : yield* mapping.continuation.decode(row);\n\n  const completed =\n    authorityCurrent &&\n    row !== undefined &&\n    record !== undefined &&\n    record.moduleId === input.moduleId &&\n    record.continuationId === input.continuationId &&\n    record.purpose === input.purpose &&\n    record.digest === input.continuationDigest &&\n    record.seriesKey === keys.series &&\n    sameBinding(record.binding, input.binding) &&\n    row[mapping.continuation.consumed] === false &&\n    record.expiresAtMillis > now;\n\n  return completed ? { record: record!, row, columns: c } : undefined;\n});\n\n/** Nonconsuming same-owner preflight; it never inserts a series or changes expiry. */\nexport const checkProofCompletionIn = Effect.fn(\"Drizzle.checkProofCompletionIn\")(function* (\n  mapping: Mapping,\n  configuration: ProofSqlConfiguration,\n  input: ProofCompletionPlan[\"input\"],\n) {\n  return yield* inspectCompletionIn(mapping, configuration, input, false).pipe(\n    Effect.map((value) => value !== undefined),\n  );\n});\n\nconst completeIn = Effect.fn(\"DrizzleProof.completeIn\")(function* <A, E = never, R = never>(\n  mapping: Mapping,\n  configuration: ProofSqlConfiguration,\n  input: ProofCompletionPlan[\"input\"],\n  prepare: (decision: ProofCompletionDecision) => A,\n  protectedMutation?: Effect.Effect<boolean, E, R>,\n) {\n  const database = yield* CurrentProofSql;\n\n  const accepted = yield* inspectCompletionIn(mapping, configuration, input, true);\n\n  if (accepted === undefined) return prepare(\"rejected\");\n  const { record, row: original, columns: c } = accepted;\n\n  if (protectedMutation !== undefined && !(yield* protectedMutation)) return yield* unavailable();\n  const value = prepare(\"completed\");\n\n  yield* database\n    .update(mapping.continuation.table)\n    .set(updateValues<any>([[mapping.continuation.consumed, true]]))\n    .where(\n      and(\n        eq(c.moduleId, input.moduleId),\n        eq(c.continuationId, input.continuationId),\n        eq(c.digest, input.continuationDigest),\n        eq(c.consumed, false),\n      ),\n    );\n  yield* insertCommand(\n    mapping,\n    input.moduleId,\n    input.continuationDigest,\n    \"complete\",\n    \"completed\",\n    record.expiresAtMillis,\n  );\n\n  const assertApplied = Effect.flatMap(CurrentPasswordPreparedTransaction, (currentTransaction) =>\n    Effect.gen(function* () {\n      const persisted = (yield* selectRows(\n        currentTransaction\n          .select()\n          .from(mapping.continuation.table)\n          .where(and(eq(c.moduleId, input.moduleId), eq(c.continuationId, input.continuationId)))\n          .limit(1),\n        false,\n      ))[0];\n\n      const command = (yield* commandRow(\n        mapping,\n        input.moduleId,\n        input.continuationDigest,\n        false,\n      ))[0];\n\n      const decoded =\n        persisted === undefined ? undefined : yield* mapping.continuation.decode(persisted);\n\n      const immutable = [\n        mapping.continuation.moduleId,\n        mapping.continuation.purpose,\n        mapping.continuation.continuationId,\n        mapping.continuation.digest,\n        mapping.continuation.proofId,\n        mapping.continuation.seriesKey,\n        mapping.continuation.version,\n      ];\n\n      if (\n        persisted === undefined ||\n        decoded === undefined ||\n        !sameBinding(decoded.binding, record.binding) ||\n        persisted[mapping.continuation.consumed] !== true ||\n        immutable.some((key) => persisted[key] !== original[key]) ||\n        (yield* mapping.decodeInstant(persisted[mapping.continuation.expiresAt])) !==\n          record.expiresAtMillis ||\n        (yield* mapping.decodeInstant(persisted[mapping.continuation.retentionUntil])) !==\n          (yield* mapping.decodeInstant(original[mapping.continuation.retentionUntil])) ||\n        command === undefined ||\n        command[mapping.command.kind] !== \"complete\" ||\n        command[mapping.command.decision] !== \"completed\" ||\n        (yield* mapping.decodeInstant(command[mapping.command.retentionUntil])) !==\n          record.expiresAtMillis\n      )\n        return yield* unavailable();\n\n      if (record.expiresAtMillis <= (yield* nowMillis)) return yield* unavailable();\n    }).pipe(Effect.provideService(CurrentProofSql, currentTransaction)),\n  );\n\n  yield* assertApplied.pipe(Effect.provideService(CurrentPasswordPreparedTransaction, database));\n  const postconditions = yield* Effect.serviceOption(PasswordPreparedPostconditions);\n\n  if (\n    Option.isSome(postconditions) &&\n    !postconditions.value.register(assertApplied.pipe(translateFailure))\n  )\n    return yield* unavailable();\n\n  return value;\n});\n\n/** Private same-owner seam for password and identifier mutations. */\nexport const completeProofPlanIn = Effect.fn(\"Drizzle.completeProofPlanIn\")(function* <\n  Rq extends Table,\n  S extends Table,\n  G extends Table,\n  Cn extends Table,\n  Rs extends Table,\n  Aev extends Table,\n  F extends Table,\n  C extends Table,\n  Sub extends Table,\n  I extends Table,\n  Cr extends Table,\n  NativeId,\n  A,\n  E,\n  R,\n>(\n  mapping: ProofPersistenceMapping<Rq, S, G, Cn, Rs, Aev, F, C, Sub, I, Cr, NativeId>,\n  configuration: ProofSqlConfiguration,\n  plan: ProofCompletionPlan,\n  protectedMutation: Effect.Effect<boolean, E, R>,\n  project: (decision: ProofCompletionDecision) => A,\n) {\n  const journal = yield* CurrentCommitJournal;\n\n  return yield* completeIn(\n    mapping as unknown as Mapping,\n    configuration,\n    plan.input,\n    (decision) => plan.prepare(decision, journal, project),\n    protectedMutation,\n  );\n});\n"],"mappings":";;;;;;;;;;;;;AA+DA,IAAa,kBAAb,cAAqC,QAAQ,QAA2C,CAAC,CACvF,6BACF,CAAC,CAAC,CAAC;AAiBH,MAAM,oBAAoB,iBAAiB,KAAK,CAAC,CAAC;AAElD,MAAM,oBACJ,WAEA,yBACE,SACC,UAAU,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KAAK,OAAO,GAAG,sBAAsB,CAAC,CAAC,KAAK,CAC1F,CAAC,CAAC,KAAK,OAAO,YAAY,UAAU,OAAO,UAAU,MAAM,IAAI,aAAa,YAAY,CAAC,CAAC,CAAC,CAAC;AAE9F,MAAM,yBACJ,WAEA,yBACE,SACC,UACC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,oBAAoB,CAAC,CAAC,KAAK,KACrC,OAAO,GAAG,sBAAsB,CAAC,CAAC,KAAK,CAC3C,CAAC,CAAC,KACA,OAAO,YAAY,UACjB,OAAO,UACL,MAAM,IAAI,QAAQ,UAChB,OAAO,GAAG,oBAAoB,CAAC,CAAC,KAAK,IAAI,QAAQ,YAAY,CAC/D,CACF,CACF,CACF;AAEF,MAAM,iBAAiB,qBAAqB,KAAK,CAAC,CAAC;AAEnD,MAAM,oBAAoB,YACxB,OAAO,QAAQ,wBAAwB,CAAC,CAAC,OACtC,CAAC,KAAK,WAAW,QAAQ,YAAY,SAAkD,KAC1F;AAEF,MAAM,cAAc,OAAsB,YACxC,WAAW,OAAO,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,IAAI;AAErE,MAAM,mBACJ,SACA,SACwE;CACxE,IAAI,SAAS,eACX,OAAO,QAAQ,wBAAwB,KAAA,IACnC,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;EACT,KAAK,QAAQ;EACb,QAAQ,UAAU,IAAI,oBAAoB;GAAE,WAAW;GAAW;EAAM,CAAC;CAC3E,CAAC;CACP,IAAI,QAAQ,oBAAoB,KAAA,GAAW,OAAO,QAAQ;CAE1D,OAAO,QAAQ,wBAAwB,KAAA,IACnC,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;EACT,KAAK,QAAQ;EACb,QAAQ,UAAU,IAAI,oBAAoB;GAAE,WAAW;GAAW;EAAM,CAAC;CAC3E,CAAC;AACP;AAEA,MAAM,mBAAmB,OAAO,WAAW,OAAO,eAAe,YAAY,CAAC;AAE9E,MAAM,eAAe,MAAoB,UACvC,iBAAiB,IAAI,MAAM,iBAAiB,KAAK;AAEnD,MAAM,kBAAkB,aAAsB;CAC5C,UAAU,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,QAAQ;CAChE,WAAW,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,SAAS;CAClE,aAAa,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,WAAW;CACtE,SAAS,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,OAAO;CAC9D,gBAAgB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,cAAc;AAC9E;AAEA,MAAM,iBAAiB,aAAsB;CAC3C,UAAU,OAAO,QAAQ,OAAO,OAAO,QAAQ,OAAO,QAAQ;CAC9D,SAAS,OAAO,QAAQ,OAAO,OAAO,QAAQ,OAAO,OAAO;CAC5D,UAAU,OAAO,QAAQ,OAAO,OAAO,QAAQ,OAAO,QAAQ;CAC9D,eAAe,OAAO,QAAQ,OAAO,OAAO,QAAQ,OAAO,aAAa;CACxE,aAAa,OAAO,QAAQ,OAAO,OAAO,QAAQ,OAAO,WAAW;CACpE,SAAS,OAAO,QAAQ,OAAO,OAAO,QAAQ,OAAO,OAAO;AAC9D;AAEA,MAAM,qBAAqB,aAAsB;CAC/C,UAAU,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,QAAQ;CACtE,SAAS,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,OAAO;CACpE,SAAS,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,OAAO;CACpE,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;CACxE,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;CACxE,YAAY,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,UAAU;CAC1E,eAAe,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,aAAa;CAChF,gBAAgB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,cAAc;CAClF,UAAU,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,QAAQ;CACtE,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;CACxE,SAAS,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,OAAO;CACpE,OAAO,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,KAAK;CAChE,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;CACxE,eAAe,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,aAAa;CAChF,cAAc,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,YAAY;CAC9E,eAAe,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,aAAa;CAChF,SAAS,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,OAAO;CACpE,qBAAqB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,mBAAmB;CAC5F,gBAAgB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,cAAc;AACpF;AAEA,MAAM,uBAAuB,aAAsB;CACjD,UAAU,OAAO,QAAQ,aAAa,OAAO,QAAQ,aAAa,QAAQ;CAC1E,SAAS,OAAO,QAAQ,aAAa,OAAO,QAAQ,aAAa,OAAO;CACxE,gBAAgB,OAAO,QAAQ,aAAa,OAAO,QAAQ,aAAa,cAAc;CACtF,QAAQ,OAAO,QAAQ,aAAa,OAAO,QAAQ,aAAa,MAAM;CACtE,SAAS,OAAO,QAAQ,aAAa,OAAO,QAAQ,aAAa,OAAO;CACxE,WAAW,OAAO,QAAQ,aAAa,OAAO,QAAQ,aAAa,SAAS;CAC5E,WAAW,OAAO,QAAQ,aAAa,OAAO,QAAQ,aAAa,SAAS;CAC5E,UAAU,OAAO,QAAQ,aAAa,OAAO,QAAQ,aAAa,QAAQ;CAC1E,SAAS,OAAO,QAAQ,aAAa,OAAO,QAAQ,aAAa,OAAO;CACxE,gBAAgB,OAAO,QAAQ,aAAa,OAAO,QAAQ,aAAa,cAAc;AACxF;AAEA,MAAM,gBAAgB,aAAsB;CAC1C,UAAU,OAAO,QAAQ,UAAU,OAAO,QAAQ,UAAU,QAAQ;CACpE,SAAS,OAAO,QAAQ,UAAU,OAAO,QAAQ,UAAU,OAAO;CAClE,QAAQ,OAAO,QAAQ,UAAU,OAAO,QAAQ,UAAU,MAAM;CAChE,WAAW,OAAO,QAAQ,UAAU,OAAO,QAAQ,UAAU,SAAS;CACtE,UAAU,OAAO,QAAQ,UAAU,OAAO,QAAQ,UAAU,QAAQ;AACtE;AAEA,MAAM,gBAAgB,aAAsB;CAC1C,UAAU,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,QAAQ;CACtE,SAAS,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,OAAO;CACpE,QAAQ,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,MAAM;CAClE,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;CACxE,UAAU,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,QAAQ;CACtE,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;CACxE,YAAY,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,UAAU;CAC1E,gBAAgB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,cAAc;AACpF;AAEA,MAAM,kBAAkB,aAAsB;CAC5C,UAAU,OAAO,QAAQ,aAAa,OAAO,QAAQ,aAAa,QAAQ;CAC1E,SAAS,OAAO,QAAQ,aAAa,OAAO,QAAQ,aAAa,OAAO;CACxE,WAAW,OAAO,QAAQ,aAAa,OAAO,QAAQ,aAAa,SAAS;CAC5E,WAAW,OAAO,QAAQ,aAAa,OAAO,QAAQ,aAAa,SAAS;CAC5E,YAAY,OAAO,QAAQ,aAAa,OAAO,QAAQ,aAAa,UAAU;CAC9E,gBAAgB,OAAO,QAAQ,aAAa,OAAO,QAAQ,aAAa,cAAc;AACxF;AAEA,MAAM,kBAAkB,aAAsB;CAC5C,UAAU,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,QAAQ;CAChE,WAAW,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,SAAS;CAClE,MAAM,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,IAAI;CACxD,UAAU,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,QAAQ;CAChE,gBAAgB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,cAAc;AAC9E;AAEA,MAAM,YAAY,SAAS,IAAI,KAAK,OAAO,IAAI,SAAS,aAAa,CAAC;AAEtE,MAAM,gBAAgB,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAC5D,SACA,UACA,SACA,SACA,SACA;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,YAAY,QAAQ;CAC1B,IAAI;CAGJ,IAAI,QAAQ,SAAS,cAAc;EACjC,IACE,UAAU,YAAY,KAAA,KACtB,UAAU,eAAe,KAAA,KACzB,UAAU,cAAc,KAAA,GAExB,OAAO,OAAO,YAAY;EAC5B,kBAAkB,OAAO,UAAU,UAAU,SAAS,QAAQ,SAAS,SAAS;EAChF,MAAM,UAAU,UAAU;EAW1B,MAAM,OAAM,OATQ,WAClB,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,KAAK,CAAC,CACnB,MAAM,GAAG,OAAO,QAAQ,OAAO,QAAQ,EAAE,GAAG,eAAe,CAAC,CAAC,CAC7D,MAAM,CAAC,GACV,OACF,EAAA,CAEiB;EAEjB,IACE,QAAQ,KAAA,KACR,CAAC,QAAQ,eAAe,IAAI,QAAQ,OAAO,KAC3C,IAAI,QAAQ,sBAAsB,QAAQ,SAAS,kBAEnD,OAAO;CACX;CACA,MAAM,aAAa,UAAU;CAE7B,MAAM,iBAAiB,OAAO,WAC5B,SACG,OAAO,CAAC,CACR,KAAK,WAAW,KAAK,CAAC,CACtB,MACC,IACE,GAAG,OAAO,WAAW,OAAO,WAAW,SAAS,GAAG,QAAQ,WAAW,SAAS,GAC/E,GAAG,OAAO,WAAW,OAAO,WAAW,KAAK,GAAG,QAAQ,WAAW,KAAK,CACzE,CACF,GACF,OACF;CAEA,IACE,CAAC,WAAW,UACV;EAAE;EAAU;EAAS;EAAS,GAAI,oBAAoB,KAAA,IAAY,CAAC,IAAI,EAAE,gBAAgB;CAAG,GAC5F,cACF,GAEA,OAAO;CACT,IAAI,QAAQ,SAAS,cAAc,OAAO;CAC1C,MAAM,aAAa,UAAU;CAE7B,MAAM,WAAW,CAAC,GAAG,QAAQ,SAAS,WAAW,CAAC,CAAC,MAAM,GAAG,MAC1D,EAAE,aAAa,cAAc,EAAE,YAAY,CAC7C;CAEA,MAAM,OACJ,SAAS,WAAW,IAChB,CAAC,IACD,OAAO,WACL,SACG,OAAO,CAAC,CACR,KAAK,WAAW,KAAK,CAAC,CACtB,MACC,IACE,GAAG,OAAO,WAAW,OAAO,WAAW,SAAS,GAAG,eAAe,GAClE,QACE,OAAO,WAAW,OAAO,WAAW,YAAY,GAChD,SAAS,KAAK,SAAS,KAAK,YAAY,CAC1C,CACF,CACF,GACF,OACF;CAEN,IAAI,KAAK,WAAW,SAAS,QAAQ,OAAO;CAY5C,OAVe,KACZ,KAAK,SAAc;EAClB,cAAc,IAAI,WAAW;EAC7B,UAAU,IAAI,WAAW;EACzB,QACE,WAAW,WAAW,KAAA,KACtB,WAAW,iBAAiB,IAAI,WAAW,OAAO,MAAM;CAC5D,EAAE,CAAC,CACF,MAAM,GAAQ,MAAW,EAAE,aAAa,cAAc,EAAE,YAAY,CAE3D,CAAC,CAAC,OACX,MAAW,UACV,KAAK,UACL,KAAK,iBAAiB,SAAS,MAAM,EAAE,gBACvC,KAAK,aAAa,SAAS,MAAM,EAAE,QACvC;AACF,CAAC;AAQD,MAAM,gBACJ,MACA,SACA,QACA,WAC8B;CAC9B,MAAM,SAAS,WAAW,UAAU,WAAW;CAC/C,MAAM,SAAS,WAAW,UAAU,WAAW;CAE/C,MAAM,UAAwB,CAC5B;EAAE,MAAM;EAAU,KAAK;EAAK,QAAQ,OAAO,MAAM,SAAS;CAAU,GACpE;EAAE,MAAM;EAAc,KAAK,KAAK;EAAY,QAAQ,OAAO,MAAM;CAAQ,CAC3E;CAEA,IAAI,QAAQ,SAAS,cACnB,QAAQ,KAAK;EACX,MAAM;EACN,KAAK,KAAK;EACV,QAAQ,OAAO,MAAM,UAAU;CACjC,CAAC;CAEH,OAAO;AACT;AAEA,MAAM,aAAa,OAAO,GAAG,yBAAyB,CAAC,CAAC,WACtD,SACA,eACA,UACA,SACA,QACA,SACA;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,IAAI,aAAa,OAAO;CAE9B,KAAK,MAAM,SAAS,SAAS;EAC3B,MAAM,SAAS,QAAQ,UAAU,aAAa;GAC5C;GACA;GACA;GACA,WAAW,MAAM;GACjB,UAAU,MAAM;EAClB,CAAC;EAED,MAAM,QAAQ,SAAS,OAAO,QAAQ,UAAU,KAAK,CAAC,CAAC,OAAO,MAAM;EAEpE,OAAO,cAAc,eAAe,OAAO,QAAQ,UAAU,UAAU,MAAM,GAAG;EAChF,OAAO,WACL,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,UAAU,KAAK,CAAC,CAC7B,MACC,IACE,GAAG,EAAE,UAAU,QAAQ,GACvB,GAAG,EAAE,SAAS,OAAO,GACrB,GAAG,EAAE,QAAQ,MAAM,GACnB,GAAG,EAAE,WAAW,MAAM,IAAI,GAC1B,GAAG,EAAE,UAAU,MAAM,GAAG,CAC1B,CACF,CAAC,CACA,MAAM,CAAC,GACV,cAAc,OAChB;CACF;AACF,CAAC;AAED,MAAM,iBAAiB,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAC9D,SACA,UACA,SACA,QACA,SACA,KACA;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,IAAI,aAAa,OAAO;CAC9B,MAAM,WAAyB,CAAC;CAEhC,KAAK,MAAM,SAAS,SAmBlB,KAAI,OAlBgB,WAClB,SACG,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAClC,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MACC,IACE,GAAG,EAAE,UAAU,QAAQ,GACvB,GAAG,EAAE,SAAS,OAAO,GACrB,GAAG,EAAE,QAAQ,MAAM,GACnB,GAAG,EAAE,WAAW,MAAM,IAAI,GAC1B,GAAG,EAAE,UAAU,MAAM,GAAG,GACxB,IAAI,EAAE,YAAY,QAAQ,cAAc,MAAM,MAAM,OAAO,YAAY,CAAC,CAC1E,CACF,CAAC,CACA,MAAM,MAAM,OAAO,KAAK,GAC3B,IACF,EAAA,CAES,SAAS,MAAM,OAAO,OAAO,SAAS,KAAK,KAAK;CAG3D,OAAO;AACT,CAAC;AAED,MAAM,oBAAoB,OAAO,GAAG,2BAA2B,CAAC,CAAC,WAC/D,SACA,UACA,SACA,QACA,WACA,SACA,KACA,gBACA;CACA,MAAM,WAAW,OAAO;CAExB,OAAO,OAAO,OAAO,QACnB,UACC,UACC,SAAS,OAAO,QAAQ,WAAW,KAAK,CAAC,CAAC,OACxC,QAAQ,WAAW,aAAa;EAC9B;EACA;EACA;EACA,WAAW,MAAM;EACjB,UAAU,MAAM;EAChB;EACA,kBAAkB;EAClB,sBAAsB;CACxB,CAAC,CACH,GACF,EAAE,SAAS,KAAK,CAClB;AACF,CAAC;AAED,MAAM,eAAe,OAAO,GAAG,2BAA2B,CAAC,CAAC,WAC1D,SACA,eACA,UACA,SACA,UACA;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,IAAI,cAAc,OAAO;CAC/B,MAAM,iBAAiB,OAAO,gBAAgB,SAAS,cAAc,IAAI;CAEzE,MAAM,QAAQ,SACX,OAAO,QAAQ,OAAO,KAAK,CAAC,CAC5B,OAAO,QAAQ,OAAO,aAAa;EAAE;EAAU;EAAS;EAAU,SAAS;CAAe,CAAC,CAAC;CAE/F,OAAO,cAAc,eAAe,OAAO,QAAQ,OAAO,UAAU,QAAQ;CAW5E,QAAO,OATa,WAClB,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,OAAO,KAAK,CAAC,CAC1B,MAAM,IAAI,GAAG,EAAE,UAAU,QAAQ,GAAG,GAAG,EAAE,SAAS,OAAO,GAAG,GAAG,EAAE,UAAU,QAAQ,CAAC,CAAC,CAAC,CACtF,MAAM,CAAC,GACV,cAAc,OAChB,EAAA,CAEY,OAAO,OAAO,YAAY;AACxC,CAAC;AAED,MAAM,iBAAiB,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,UACA,SACA,SACA;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,IAAI,kBAAkB,OAAO;CAEnC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,IAAI,GAAG,EAAE,UAAU,QAAQ,GAAG,GAAG,EAAE,SAAS,OAAO,CAAC,CAAC,CAAC,CAC5D,MAAM,CAAC,GACV,OACF;AACF,CAAC;AAED,MAAM,eAAe,OAAO,GAAG,2BAA2B,CAAC,CAAC,WAC1D,SACA,UACA,SACA,WACA,KACA,QACA;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,IAAI,eAAe,OAAO;CAkBhC,QAAO,OAhBa,WAClB,SACG,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAClC,KAAK,QAAQ,aAAa,KAAK,CAAC,CAChC,MACC,IACE,GAAG,EAAE,UAAU,QAAQ,GACvB,GAAG,EAAE,SAAS,OAAO,GACrB,GAAG,EAAE,WAAW,SAAS,GACzB,IAAI,EAAE,YAAY,QAAQ,cAAc,MAAM,OAAO,MAAM,SAAS,YAAY,CAAC,CACnF,CACF,CAAC,CACA,MAAM,OAAO,qBAAqB,GACrC,IACF,EAAA,CAEY;AACd,CAAC;AAED,MAAM,aAAa,OAAO,GAAG,oBAAoB,CAAC,CAAC,WACjD,SACA,UACA,WACA,SACA;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,IAAI,eAAe,OAAO;CAEhC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,IAAI,GAAG,EAAE,UAAU,QAAQ,GAAG,GAAG,EAAE,WAAW,SAAS,CAAC,CAAC,CAAC,CAChE,MAAM,CAAC,GACV,OACF;AACF,CAAC;AAED,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,UACA,WACA,MACA,UACA,gBACA;CAGA,OAAO,QAAO,OAFU,gBAAA,CAED,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,OACnD,QAAQ,QAAQ,aAAa;EAC3B;EACA;EACA;EACA;EACA,sBAAsB;CACxB,CAAC,CACH;AACF,CAAC;AAED,MAAM,SACJ,UACA,SACA,eACA,SACG;CACH,IAAI,CAAC,iBAAiB,OAAO,GAAG,OAAO,OAAO,KAAK,YAAY,CAAC;CAEhE,MAAM,MAAM,uBAER,SAAS,aAAa,gBACpB,KAAK,KAAK,OAAO,eAAe,iBAAiB,WAAW,CAAC,CAC/D,GACF,EAAE,MAAM,cAAc,KAAK,CAC7B,CAAC,CAAC,KAAK,OAAO,KAAK,WAAW,OAAO,KAAK,CAAC;CAE3C,OAAO,cAAc,gBAAgB,OACjC,OAAO,IAAI,aAAa;EACtB,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;EACrD,OAAO,cAAc;EAErB,OAAO,OAAO;CAChB,CAAC,IACD;AACN;AAEA,MAAa,0BAA0B,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC1E,UACA,SACA,eACsE;CACtE,MAAM,QAAQ,OAAO;CAErB,OAAO,iBAAiB,GAAG;EACzB,QAAQ,OAAO,YACb,MACE,UACA,SACA,eACA,OAAO,IAAI,aAAa;GACtB,MAAM,cAAc,OAAO;GAC3B,MAAM,UAAU,OAAO;GAEvB,MAAM,OAAO,QAAQ,UAAU;IAC7B,UAAU,MAAM,OAAO;IACvB,SAAS,MAAM,OAAO;IACtB,SAAS,MAAM,OAAO;GACxB,CAAC;GAED,MAAM,mBAAmB,OAAO,cAC9B,SACA,MAAM,OAAO,UACb,MAAM,OAAO,SACb,MAAM,OAAO,SACb,cAAc,OAChB;GAEA,MAAM,SAAS,aAAa,MAAM,MAAM,OAAO,SAAS,SAAS,MAAM,MAAM;GAE7E,OAAO,WACL,SACA,eACA,MAAM,OAAO,UACb,MAAM,OAAO,SACb,SACA,OAAO,MAAM,GAAG,CAAC,CACnB;GACA,MAAM,YAAY,OAAO;GAEzB,MAAM,cACH,OAAO,eACN,SACA,MAAM,OAAO,UACb,MAAM,OAAO,SACb,SACA,OAAO,MAAM,GAAG,CAAC,GACjB,SACF,EAAA,CAAG,WAAW;GAEhB,IAAI,YACF,OAAO,WACL,SACA,eACA,MAAM,OAAO,UACb,MAAM,OAAO,SACb,SACA,OAAO,MAAM,CAAC,CAChB;GAEF,MAAM,SAAS,aACX,OAAO,aACL,SACA,eACA,MAAM,OAAO,UACb,MAAM,OAAO,SACb,KAAK,MACP,IACA,KAAA;GAEJ,MAAM,MAAM,OAAO;GACnB,MAAM,iBAAiB,MAAM,MAAM,OAAO;GAC1C,MAAM,KAAK,eAAe,OAAO;GAEjC,IAAI,cAAc,OAAO,WACvB,YACG,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MACC,IACE,GAAG,GAAG,UAAU,MAAM,OAAO,QAAQ,GACrC,GAAG,GAAG,WAAW,MAAM,OAAO,SAAS,CACzC,CACF,CAAC,CACA,MAAM,CAAC,GACV,cAAc,OAChB;GAEA,IAAI,UAAU,YAAY;GAE1B,IAAI,YAAY,KAAA,GAAW;IAKzB,KAAI,OAJyB,QAAQ,cACnC,QAAQ,QAAQ,QAAQ,eAC1B,KAEoB,KAAK;KACvB,IAAI,QAAQ,QAAQ,QAAQ,iBAAiB,MAAM,OAAO,aACxD,OAAO,OAAO,SAAS;KAGzB,OAAO,QAAQ;MAAE,MAAM;MAAY,SAAA,OAFZ,QAAQ,QAAQ,cAAc,OAAO;KAEjB,GAAG,OAAO;IACvD;IACA,OAAO,YACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,MACC,IACE,GAAG,GAAG,UAAU,MAAM,OAAO,QAAQ,GACrC,GAAG,GAAG,WAAW,MAAM,OAAO,SAAS,GACvC,IAAI,GAAG,gBAAgB,QAAQ,cAAc,GAAG,CAAC,CACnD,CACF;GACJ;GAEA,MAAM,gBAAgB,QAAQ,QAAQ,aAAa;IACjD,QAAQ,MAAM;IACd,iBAAiB;IACjB,sBAAsB;GACxB,CAAC;GAED,MAAM,eAAe,YAAY,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,OAAO,aAAa;GAEnF,OAAO,cAAc,eACnB,cACA,QAAQ,QAAQ,WAChB,MAAM,OAAO,SACf;GACA,cAAc,OAAO,WACnB,YACG,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MACC,IACE,GAAG,GAAG,UAAU,MAAM,OAAO,QAAQ,GACrC,GAAG,GAAG,WAAW,MAAM,OAAO,SAAS,CACzC,CACF,CAAC,CACA,MAAM,CAAC,GACV,cAAc,OAChB;GACA,UAAU,YAAY;GAEtB,IAAI,YAAY,KAAA,GAAW,OAAO,OAAO,YAAY;GACrD,IAAI,QAAQ,QAAQ,QAAQ,iBAAiB,MAAM,OAAO,aACxD,OAAO,OAAO,SAAS;GACzB,IAAI,QAAQ,QAAQ,QAAQ,aAAa,MAAM,OAAO,SAGpD,OAAO,QAAQ;IAAE,MAAM;IAAY,SAAA,OAFZ,QAAQ,QAAQ,cAAc,OAAO;GAEjB,GAAG,OAAO;GAGvD,MAAM,WAAW,aACb,OAAO,eACL,SACA,MAAM,OAAO,UACb,MAAM,OAAO,SACb,SACA,QACA,GACF,IACA,CAAC;GAEL,MAAM,KAAK,cAAc,OAAO;GAEhC,MAAM,cACJ,SAAS,QAAQ,OAAO,iBAAiB,QACzC,SAAS,QAAQ,OAAO,iBAAiB,KAAA,IACrC,KAAA,IACA,OAAO,QAAQ,cAAc,OAAO,QAAQ,OAAO,YAAY;GAErE,MAAM,gBAAgB,SAAS,QAAQ,OAAO;GAE9C,MAAM,oBACJ,MAAM,eAAe,KAAA,KAAa,MAAM,eAAe;GAEzD,MAAM,UACJ,oBACA,MAAM,YACN,SAAS,WAAW,OAAO,UAC3B,MAAM,OAAO,kBAAkB,OAC/B,MAAM,OAAO,kBAAkB,OAC/B,sBACC,gBAAgB,KAAA,KACf,MAAM,eAAe,MAAM,OAAO,MAAM;GAE5C,MAAM,UAAU;IACd,WAAW,MAAM,OAAO;IACxB,WAAW;KACT,SAAS,MAAM,OAAO;KACtB,SAAS,MAAM,OAAO;KACtB,OAAO,MAAM,OAAO,SAAS;IAC/B;GACF;GAEA,MAAM,WAAW,QACf,UACK;IAAE,MAAM;IAAU,QAAQ,MAAM;GAAO,IACvC;IAAE,MAAM;IAAc;GAAQ,GACnC,OACF;GAEA,IAAI,SAAS,SAAS,GACpB,OAAO,kBACL,SACA,MAAM,OAAO,UACb,MAAM,OAAO,SACb,SACA,MAAM,OAAO,WACb,UACA,KACA,cACF;GACF,IAAI,CAAC,SAAS,OAAO;GACrB,IAAI,kBAAkB,QAAQ,kBAAkB,KAAA,GAC9C,OAAO,YACJ,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,IAAI,aAAkB,CAAC,CAAC,QAAQ,WAAW,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC,CAClE,MACC,IACE,GAAG,kBAAkB,OAAO,CAAC,CAAC,UAAU,MAAM,OAAO,QAAQ,GAC7D,GAAG,kBAAkB,OAAO,CAAC,CAAC,SAAS,aAAa,GACpD,GAAG,kBAAkB,OAAO,CAAC,CAAC,OAAO,QAAQ,CAC/C,CACF;GACJ,OAAO,YAAY,OAAO,QAAQ,WAAW,KAAK,CAAC,CAAC,OAClD,QAAQ,WAAW,aAAa;IAC9B,QAAQ,MAAM;IACd,WAAW,KAAK;IAChB,sBAAsB;IACtB,OAAO;IACP,eAAe;IACf,QAAQ,MAAM;GAChB,CAAC,CACH;GACA,MAAM,cAAc,OAAO,gBAAgB,SAAS,cAAc,IAAI;GAEtE,OAAO,YACJ,OAAO,QAAQ,OAAO,KAAK,CAAC,CAC5B,IACC,aAAkB;IAChB,CAAC,QAAQ,OAAO,eAAe,MAAM,OAAO,OAAO;IACnD,CAAC,QAAQ,OAAO,aAAa,QAAQ,cAAc,GAAG,CAAC;IACvD,CAAC,QAAQ,OAAO,SAAS,WAAW;GACtC,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,GAAG,UAAU,MAAM,OAAO,QAAQ,GACrC,GAAG,GAAG,SAAS,MAAM,OAAO,OAAO,GACnC,GAAG,GAAG,UAAU,KAAK,MAAM,CAC7B,CACF;GAEF,OAAO;EACT,CAAC,CACH,CAAC,CAAC,KACA,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,qBACF;EACF,UAAU,OAAO,YACf,MACE,UACA,SACA,eACA,OAAO,IAAI,aAAa;GACtB,MAAM,cAAc,OAAO;GAC3B,MAAM,UAAU,OAAO;GAEvB,MAAM,OAAO,QAAQ,UAAU;IAC7B,UAAU,MAAM;IAChB,SAAS,MAAM;IACf,SAAS,MAAM;GACjB,CAAC;GAED,MAAM,mBAAmB,OAAO,cAC9B,SACA,MAAM,UACN,MAAM,SACN,MAAM,SACN,cAAc,OAChB;GAEA,MAAM,SAAS,aAAa,MAAM,MAAM,SAAS,WAAW,MAAM,MAAM;GAExE,OAAO,WACL,SACA,eACA,MAAM,UACN,MAAM,SACN,WACA,OAAO,MAAM,GAAG,CAAC,CACnB;GACA,MAAM,YAAY,OAAO;GAEzB,MAAM,cACH,OAAO,eACN,SACA,MAAM,UACN,MAAM,SACN,WACA,OAAO,MAAM,GAAG,CAAC,GACjB,SACF,EAAA,CAAG,WAAW;GAEhB,IAAI,YACF,OAAO,WACL,SACA,eACA,MAAM,UACN,MAAM,SACN,WACA,OAAO,MAAM,CAAC,CAChB;GAEF,MAAM,SAAS,aACX,OAAO,aACL,SACA,eACA,MAAM,UACN,MAAM,SACN,KAAK,MACP,IACA,KAAA;GAEJ,MAAM,cAAc,OAAO,eACzB,SACA,MAAM,UACN,MAAM,SACN,cAAc,OAChB,EAAA,CAAG;GAEH,MAAM,mBAAmB,OAAO,WAC9B,SACA,MAAM,UACN,MAAM,gBACN,cAAc,OAChB,EAAA,CAAG;GAEH,IAAI,oBAAoB,KAAA,GAAW;IACjC,IAAI,gBAAgB,QAAQ,QAAQ,cAAc,YAChD,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,OAAO;IAE9C,OAAO,OAAO,YAAY;GAC5B;GACA,MAAM,MAAM,OAAO;GAEnB,MAAM,WAAW,aACb,OAAO,eAAe,SAAS,MAAM,UAAU,MAAM,SAAS,WAAW,QAAQ,GAAG,IACpF,CAAC;GAEL,MAAM,WAAW,OAAO,aACtB,SACA,MAAM,UACN,MAAM,SACN,KAAK,QACL,KACA,MAAM,MACR;GAEA,MAAM,KAAK,kBAAkB,OAAO;GACpC,MAAM,gBAAgB,SAAS,QAAQ,OAAO;GAE9C,MAAM,gBACJ,eAAe,KAAA,IACX,KAAA,IACA,OAAO,QAAQ,WAAW,cAAc,UAAU;GAExD,MAAM,mBACJ,eAAe,KAAA,KACf,MAAM,cAAc,KAAA,KACpB,WAAW,QAAQ,WAAW,mBAAmB,MAAM,UAAU,SACjE,WAAW,QAAQ,WAAW,oBAAoB,MAAM,UAAU;GAEpE,MAAM,oBACJ,eAAe,KAAA,KACf,WAAW,QAAQ,WAAW,aAAa,MAAM,WACjD,WAAW,QAAQ,WAAW,WAAW,YACzC,kBAAkB,MAAM,WACxB,kBAAkB,KAAA,KAClB,YAAY,eAAe,MAAM,OAAO,KACxC,OAAO,OAAO,QAAQ,cAAc,WAAW,QAAQ,WAAW,UAAU,CAAC,IAAI;GAEnF,MAAM,WACJ,oBACA,qBACA,oBACA,SAAS,WAAW,OAAO,UAC3B,WAAW,MAAM,OAAO;GAE1B,MAAM,iBAAiB,MAAM,MAAM,OAAO;GAE1C,IAAI,CAAC,UAAU;IACb,MAAM,WAAW,QAAQ,EAAE,MAAM,WAAW,GAAG,OAAO;IAEtD,OAAO,cACL,SACA,MAAM,UACN,MAAM,gBACN,WACA,YACA,cACF;IACA,OAAO,kBACL,SACA,MAAM,UACN,MAAM,SACN,WACA,MAAM,gBACN,UACA,KACA,cACF;IACA,IACE,SAAS,WAAW,OAAO,UAC3B,qBACA,CAAC,oBACD,WAAW,MAAM,OAAO,uBAExB,OAAO,YAAY,OAAO,QAAQ,aAAa,KAAK,CAAC,CAAC,OACpD,QAAQ,aAAa,aAAa;KAChC,UAAU,MAAM;KAChB,SAAS,MAAM;KACf,WAAW,KAAK;KAChB,WAAW,MAAM;KACjB,kBAAkB;KAClB,sBAAsB;IACxB,CAAC,CACH;IAEF,OAAO;GACT;GACA,MAAM,UAAU,OAAO,gBAAgB,SAAS,cAAc,IAAI;GAElE,MAAM,YAAY,KAAK,IACrB,OAAO,OAAO,QAAQ,cAAc,WAAY,QAAQ,WAAW,UAAU,CAAC,GAC9E,MAAM,MAAM,OAAO,0BACrB;GAEA,MAAM,eAAwC;IAC5C,UAAU,MAAM;IAChB,SAAS,MAAM;IACf,gBAAgB,MAAM;IACtB,QAAQ,MAAM;IACd,SAAS,MAAM;IACf,WAAW,KAAK;IAChB,SAAS,MAAM;IACf,iBAAiB;IACjB;GACF;GAWA,MAAM,WAAW,QAAQ;IARvB,MAAM;IACN,cAAc;KACZ,gBAAgB,MAAM;KACtB,SAAS,MAAM;KACf,iBAAiB;IACnB;GAG8B,GAAG,OAAO;GAE1C,OAAO,cACL,SACA,MAAM,UACN,MAAM,gBACN,WACA,YACA,cACF;GACA,OAAO,kBACL,SACA,MAAM,UACN,MAAM,SACN,WACA,MAAM,gBACN,QACA,KACA,cACF;GACA,OAAO,YACJ,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,IAAI,aAAkB,CAAC,CAAC,QAAQ,WAAW,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAChE,MACC,IACE,GAAG,GAAG,UAAU,MAAM,QAAQ,GAC9B,GAAG,GAAG,SAAS,MAAM,OAAO,GAC5B,GAAG,GAAG,OAAO,QAAQ,CACvB,CACF;GACF,OAAO,YAAY,OAAO,QAAQ,aAAa,KAAK,CAAC,CAAC,OACpD,QAAQ,aAAa,aAAa;IAChC,GAAG;IACH,sBAAsB;GACxB,CAAC,CACH;GAEA,OAAO;EACT,CAAC,CACH,CAAC,CAAC,KACA,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,WAAW,OAAO,YAChB,MACE,UACA,SACA,eACA,OAAO,IAAI,aAAa;GACtB,MAAM,UAAU,OAAO;GAEvB,OAAO,OAAO,WAAW,SAAS,eAAe,QAAQ,aACvD,QAAQ,UAAU,OAAO,CAC3B;EACF,CAAC,CACH,CAAC,CAAC,KACA,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,gBAAgB,OAAO,YACrB,MACE,UACA,SACA,eACA,OAAO,IAAI,aAAa;GACtB,MAAM,cAAc,OAAO;GAC3B,MAAM,UAAU,OAAO;GASvB,MAAM,OAAM,OAPQ,eAClB,SACA,MAAM,UACN,MAAM,SACN,cAAc,OAChB,EAAA,CAEiB;GACjB,MAAM,MAAM,OAAO;GAEnB,IAAI,QAAQ,KAAA,GAAW,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,OAAO;GACnE,MAAM,IAAI,kBAAkB,OAAO;GACnC,MAAM,YAAY,OAAO,QAAQ,cAAc,IAAI,QAAQ,WAAW,UAAU;GAEhF,MAAM,gBACJ,IAAI,QAAQ,WAAW,mBAAmB,QAC1C,IAAI,QAAQ,WAAW,mBAAmB,KAAA,IACtC,KAAA,IACA,OAAO,QAAQ,cAAc,IAAI,QAAQ,WAAW,cAAc;GAExE,MAAM,UACJ,IAAI,QAAQ,WAAW,aAAa,QACpC,IAAI,QAAQ,WAAW,aAAa,KAAA,IAChC,KAAA,IACA,OAAO,QAAQ,cAAc,IAAI,QAAQ,WAAW,QAAQ;GAElE,IAAI,QAAQ,IAAI,QAAQ,WAAW;GAEnC,IAAI,UAAU,aAAa,kBAAkB,KAAA,KAAa,iBAAiB,KAAK;IAC9E,QAAQ;IACR,OAAO,YACJ,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,IAAI,aAAkB,CAAC,CAAC,QAAQ,WAAW,eAAe,WAAW,CAAC,CAAC,CAAC,CAAC,CACzE,MAAM,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,SAAS,MAAM,OAAO,CAAC,CAAC;GAC5E;GAaA,IAAI,EAVF,IAAI,QAAQ,WAAW,aAAa,MAAM,WAC1C,IAAI,QAAQ,WAAW,gBAAgB,MAAM,cAC7C,IAAI,QAAQ,WAAW,WAAW,YAClC,YAAY,OACZ,OAAO,IAAI,QAAQ,WAAW,UAAU,IAAI,MAAM,OAAO,4BACxD,UAAU,SACR,UAAU,eACT,MAAM,wBACL,YAAY,KAAA,KAAa,WAAW,QAE5B,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,OAAO;GAC3D,MAAM,eAAe,OAAO,gBAAgB,SAAS,cAAc,IAAI;GAEvE,MAAM,WAAW,QAAQ;IADc,MAAM;IAAW;GACxB,GAAG,OAAO;GAE1C,OAAO,YACJ,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,IACC,aAAkB;IAChB,CAAC,QAAQ,WAAW,WAAW,OAAO,IAAI,QAAQ,WAAW,UAAU,IAAI,CAAC;IAC5E,CAAC,QAAQ,WAAW,eAAe,SAAS;IAC5C,CAAC,QAAQ,WAAW,cAAc,YAAY;IAC9C,CACE,QAAQ,WAAW,eACnB,QAAQ,cAAc,MAAM,MAAM,OAAO,mBAAmB,CAC9D;IACA,CACE,QAAQ,WAAW,SACnB,QAAQ,cAAc,MAAM,MAAM,OAAO,mBAAmB,CAC9D;GACF,CAAC,CACH,CAAC,CACA,MAAM,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,SAAS,MAAM,OAAO,CAAC,CAAC;GAE1E,OAAO;EACT,CAAC,CACH,CAAC,CAAC,KACA,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,iBAAiB,OAAO,YACtB,MACE,UACA,SACA,eACA,OAAO,IAAI,aAAa;GACtB,MAAM,cAAc,OAAO;GAC3B,MAAM,UAAU,OAAO;GAEvB,MAAM,WAAW,OAAO,eAAe,SAAS,MAAM,UAAU,MAAM,SAAS,KAAK,EAAA,CAAG;GAEvF,IAAI,YAAY,KAAA,GAAW,OAAO,QAAQ,KAAA,GAAW,OAAO;GAC5D,MAAM,OAAO,QAAQ,QAAQ,WAAW;GAExC,OAAO,aACL,SACA,eACA,MAAM,UACN,QAAQ,QAAQ,WAAW,UAC3B,IACF;GAEA,MAAM,OAAO,OAAO,eAClB,SACA,MAAM,UACN,MAAM,SACN,cAAc,OAChB,EAAA,CAAG;GAEH,MAAM,WAAW,QAAQ,KAAA,GAAW,OAAO;GAE3C,IACE,QAAQ,KAAA,KACR,IAAI,QAAQ,WAAW,aAAa,MAAM,WAC1C,IAAI,QAAQ,WAAW,gBAAgB,MAAM,cAC7C,IAAI,QAAQ,WAAW,kBAAkB,MAAM,gBAC/C,IAAI,QAAQ,WAAW,mBAAmB,WAE1C,OAAO;GACT,MAAM,IAAI,kBAAkB,OAAO;GACnC,MAAM,UAAgC,MAAM;GAE5C,MAAM,QACJ,QAAQ,SAAS,aACb,aACA,QAAQ,SAAS,oBACf,WACA;GAER,MAAM,SAA4C,CAChD,CAAC,QAAQ,WAAW,eAAe,KAAK,GACxC,CAAC,QAAQ,WAAW,eAAe,IAAI,CACzC;GAEA,IAAI,QAAQ,SAAS,aACnB,OAAO,KAAK,CACV,QAAQ,WAAW,SACnB,QAAQ,eACL,OAAO,aAAa,OAAO,IAAI,QAAQ,WAAW,oBAAoB,CACzE,CACF,CAAC;GACH,IAAI,QAAQ,SAAS,mBACnB,OAAO,KAAK,CAAC,QAAQ,WAAW,OAAO,WAAW,CAAC;GACrD,OAAO,YACJ,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,IAAI,aAAkB,MAAM,CAAC,CAAC,CAC9B,MAAM,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,SAAS,MAAM,OAAO,CAAC,CAAC;GAC1E,IAAI,QAAQ,SAAS,mBAAmB;IACtC,MAAM,KAAK,cAAc,OAAO;IAEhC,OAAO,YACJ,OAAO,QAAQ,OAAO,KAAK,CAAC,CAC5B,IAAI,aAAkB,CAAC,CAAC,QAAQ,OAAO,eAAe,IAAI,CAAC,CAAC,CAAC,CAAC,CAC9D,MACC,IACE,GAAG,GAAG,UAAU,MAAM,QAAQ,GAC9B,GAAG,GAAG,SAAS,IAAI,QAAQ,WAAW,QAAQ,GAC9C,GAAG,GAAG,UAAU,IAAI,GACpB,GAAG,GAAG,eAAe,MAAM,OAAO,CACpC,CACF;GACJ;GAEA,OAAO;EACT,CAAC,CACH,CAAC,CAAC,KACA,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,SAAS,OAAO,YACd,MACE,UACA,SACA,eACA,OAAO,IAAI,aAAa;GACtB,MAAM,cAAc,OAAO;GAC3B,MAAM,UAAU,OAAO;GAEvB,MAAM,mBAAmB,OAAO,cAC9B,SACA,MAAM,UACN,MAAM,SACN,MAAM,SACN,cAAc,OAChB;GAEA,MAAM,OAAO,QAAQ,UAAU;IAC7B,UAAU,MAAM;IAChB,SAAS,MAAM;IACf,SAAS,MAAM;GACjB,CAAC;GAUD,MAAM,UAAS,OARO,aACpB,SACA,eACA,MAAM,UACN,MAAM,SACN,KAAK,MACP,EAAA,CAEsB,QAAQ,OAAO;GACrC,MAAM,WAAW,QAAQ,KAAA,GAAW,OAAO;GAE3C,IAAI,oBAAoB,WAAW,KAAA,KAAa,WAAW,MAAM;IAC/D,MAAM,KAAK,kBAAkB,OAAO;IACpC,MAAM,KAAK,cAAc,OAAO;IAEhC,MAAM,OAAO,OAAO,eAClB,SACA,MAAM,UACN,QACA,cAAc,OAChB,EAAA,CAAG;IAEH,MAAM,gBACJ,QAAQ,KAAA,IAAY,KAAA,IAAY,OAAO,QAAQ,WAAW,cAAc,GAAG;IAE7E,IAAI,kBAAkB,KAAA,KAAa,CAAC,YAAY,eAAe,MAAM,OAAO,GAC1E,OAAO;IAET,OAAO,YACJ,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,IAAI,aAAkB,CAAC,CAAC,QAAQ,WAAW,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,CACjE,MAAM,IAAI,GAAG,GAAG,UAAU,MAAM,QAAQ,GAAG,GAAG,GAAG,SAAS,MAAM,CAAC,CAAC;IACrE,OAAO,YACJ,OAAO,QAAQ,OAAO,KAAK,CAAC,CAC5B,IAAI,aAAkB,CAAC,CAAC,QAAQ,OAAO,eAAe,IAAI,CAAC,CAAC,CAAC,CAAC,CAC9D,MACC,IACE,GAAG,GAAG,UAAU,MAAM,QAAQ,GAC9B,GAAG,GAAG,SAAS,MAAM,OAAO,GAC5B,GAAG,GAAG,UAAU,KAAK,MAAM,GAC3B,GAAG,GAAG,eAAe,MAAM,CAC7B,CACF;GACJ;GAEA,OAAO;EACT,CAAC,CACH,CAAC,CAAC,KACA,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;EACF,UAAU,OAAO,YACf,MACE,UACA,SACA,eACA,OAAO,IAAI,aAAa;GACtB,MAAM,cAAc,OAAO;GAC3B,MAAM,UAAU,OAAO;GAEvB,MAAM,MAAM,OAAO;GACnB,MAAM,YAAY,QAAQ,cAAc,GAAG;GAC3C,MAAM,KAAK,kBAAkB,OAAO;GACpC,MAAM,KAAK,oBAAoB,OAAO;GACtC,MAAM,KAAK,eAAe,OAAO;GACjC,MAAM,KAAK,aAAa,OAAO;GAC/B,MAAM,KAAK,eAAe,OAAO;GACjC,MAAM,KAAK,eAAe,OAAO;GACjC,MAAM,KAAK,cAAc,OAAO;GAChC,MAAM,MAAM,aAAa,OAAO;GAChC,IAAI,YAAY,MAAM;GACtB,IAAI,UAAU;GAEd,MAAM,QAAW,UACf,WAAW,MAAM,MAAM,YAAY,CAAC,GAAG,cAAc,OAAO,CAAC,CAAC,KAC5D,OAAO,KAAK,SAAS;IACnB,IAAI,KAAK,SAAS,WAAW,UAAU;IACvC,MAAM,WAAW,KAAK,MAAM,GAAG,SAAS;IAExC,aAAa,SAAS;IAEtB,OAAO;GACT,CAAC,CACH;GAKF,MAAM,gBAAgB,OAAO,KAC3B,YACG,OAAO,EAAE,gBAAgB,GAAG,eAAe,CAAC,CAAC,CAC7C,KAAK,QAAQ,aAAa,KAAK,CAAC,CAChC,MAAM,IAAI,GAAG,GAAG,UAAU,MAAM,QAAQ,GAAG,IAAI,GAAG,gBAAgB,SAAS,CAAC,CAAC,CAAC,CAC9E,QAAQ,GAAG,cAAc,CAC9B;GAEA,MAAM,cAAc,OAAO,KACzB,YACG,OAAO,EAAE,SAAS,GAAG,QAAQ,CAAC,CAAC,CAC/B,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,IAAI,GAAG,GAAG,UAAU,MAAM,QAAQ,GAAG,IAAI,GAAG,gBAAgB,SAAS,CAAC,CAAC,CAAC,CAC9E,QAAQ,GAAG,cAAc,CAC9B;GAEA,MAAM,WAAW,OAAO,KACtB,YACG,OAAO,EAAE,WAAW,GAAG,UAAU,CAAC,CAAC,CACnC,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,IAAI,GAAG,GAAG,UAAU,MAAM,QAAQ,GAAG,IAAI,GAAG,gBAAgB,SAAS,CAAC,CAAC,CAAC,CAC9E,QAAQ,GAAG,cAAc,CAC9B;GAEA,MAAM,QAAQ,OAAO,KACnB,YACG,OAAO;IACN,QAAQ,GAAG;IACX,WAAW,GAAG;IACd,UAAU,GAAG;IACb,WAAW,GAAG;GAChB,CAAC,CAAC,CACD,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MAAM,IAAI,GAAG,GAAG,UAAU,MAAM,QAAQ,GAAG,IAAI,GAAG,gBAAgB,SAAS,CAAC,CAAC,CAAC,CAC9E,QAAQ,GAAG,cAAc,CAC9B;GAEA,MAAM,WAAW,OAAO,KACtB,YACG,OAAO;IAAE,WAAW,GAAG;IAAW,WAAW,GAAG;GAAU,CAAC,CAAC,CAC5D,KAAK,QAAQ,aAAa,KAAK,CAAC,CAChC,MAAM,IAAI,GAAG,GAAG,UAAU,MAAM,QAAQ,GAAG,IAAI,GAAG,gBAAgB,SAAS,CAAC,CAAC,CAAC,CAC9E,QAAQ,GAAG,cAAc,CAC9B;GAEA,MAAM,WAAW,OAAO,KACtB,YACG,OAAO,EAAE,WAAW,GAAG,UAAU,CAAC,CAAC,CACnC,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,IAAI,GAAG,GAAG,UAAU,MAAM,QAAQ,GAAG,IAAI,GAAG,gBAAgB,SAAS,CAAC,CAAC,CAAC,CAC9E,QAAQ,GAAG,cAAc,CAC9B;GAEA,MAAM,SAAS,OAAO,KACpB,YACG,OAAO;IAAE,SAAS,GAAG;IAAS,UAAU,GAAG;GAAS,CAAC,CAAC,CACtD,KAAK,QAAQ,OAAO,KAAK,CAAC,CAC1B,MACC,IACE,GAAG,GAAG,UAAU,MAAM,QAAQ,GAC9B,OAAO,GAAG,aAAa,GACvB,UACE,YACG,OAAO,EAAE,KAAK,GAAG,IAAI,CAAC,CAAC,CACvB,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MACC,IACE,GAAG,GAAG,UAAU,GAAG,QAAQ,GAC3B,GAAG,GAAG,SAAS,GAAG,OAAO,GACzB,GAAG,GAAG,WAAW,GAAG,QAAQ,CAC9B,CACF,CACJ,GACA,UACE,YACG,OAAO,EAAE,KAAK,GAAG,IAAI,CAAC,CAAC,CACvB,KAAK,QAAQ,aAAa,KAAK,CAAC,CAChC,MACC,IACE,GAAG,GAAG,UAAU,GAAG,QAAQ,GAC3B,GAAG,GAAG,SAAS,GAAG,OAAO,GACzB,GAAG,GAAG,WAAW,GAAG,QAAQ,CAC9B,CACF,CACJ,CACF,CACF,CACJ;GAEA,MAAM,aAAa,OAAO,KACxB,YACG,OAAO;IACN,SAAS,IAAI;IACb,QAAQ,IAAI;IACZ,WAAW,IAAI;IACf,UAAU,IAAI;GAChB,CAAC,CAAC,CACD,KAAK,QAAQ,UAAU,KAAK,CAAC,CAC7B,MACC,IACE,GAAG,IAAI,UAAU,MAAM,QAAQ,GAC/B,UACE,YACG,OAAO,EAAE,KAAK,GAAG,IAAI,CAAC,CAAC,CACvB,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MACC,IACE,GAAG,GAAG,UAAU,IAAI,QAAQ,GAC5B,GAAG,GAAG,SAAS,IAAI,OAAO,GAC1B,GAAG,GAAG,QAAQ,IAAI,MAAM,GACxB,GAAG,GAAG,WAAW,IAAI,SAAS,GAC9B,GAAG,GAAG,UAAU,IAAI,QAAQ,CAC9B,CACF,CACJ,CACF,CACF,CACJ;GAIA,YAAY,YAAY,SAAS,KAAK,SAAS,SAAS,KAAK,MAAM,SAAS;GAE5E,MAAM,WAAW,QAAQ;IAAE,SADX,MAAM,QAAQ;IACM;GAAQ,GAAgC,OAAO;GAEnF,IAAI,cAAc,SAAS,GACzB,OAAO,YAAY,OAAO,QAAQ,aAAa,KAAK,CAAC,CAAC,MACpD,IACE,GAAG,GAAG,UAAU,MAAM,QAAQ,GAC9B,QACE,GAAG,gBACH,cAAc,KAAK,QAAa,IAAI,cAAc,CACpD,GACA,IAAI,GAAG,gBAAgB,SAAS,CAClC,CACF;GACF,IAAI,YAAY,SAAS,GACvB,OAAO,YACJ,OAAO,QAAQ,OAAO,KAAK,CAAC,CAC5B,IAAI,aAAkB,CAAC,CAAC,QAAQ,OAAO,eAAe,IAAI,CAAC,CAAC,CAAC,CAAC,CAC9D,MACC,IACE,GAAG,GAAG,UAAU,MAAM,QAAQ,GAC9B,QACE,GAAG,eACH,YAAY,KAAK,QAAa,IAAI,OAAO,CAC3C,CACF,CACF;GACJ,IAAI,YAAY,SAAS,GACvB,OAAO,YAAY,OAAO,QAAQ,WAAW,KAAK,CAAC,CAAC,MAClD,IACE,GAAG,GAAG,UAAU,MAAM,QAAQ,GAC9B,QACE,GAAG,SACH,YAAY,KAAK,QAAa,IAAI,OAAO,CAC3C,GACA,IAAI,GAAG,gBAAgB,SAAS,CAClC,CACF;GACF,IAAI,SAAS,SAAS,GACpB,OAAO,YAAY,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,MAC/C,IACE,GAAG,GAAG,UAAU,MAAM,QAAQ,GAC9B,QACE,GAAG,WACH,SAAS,KAAK,QAAa,IAAI,SAAS,CAC1C,GACA,IAAI,GAAG,gBAAgB,SAAS,CAClC,CACF;GACF,KAAK,MAAM,OAAO,OAChB,OAAO,YACJ,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,MACC,IACE,GAAG,GAAG,UAAU,MAAM,QAAQ,GAC9B,GAAG,GAAG,QAAQ,IAAI,MAAM,GACxB,GAAG,GAAG,WAAW,IAAI,SAAS,GAC9B,GAAG,GAAG,UAAU,IAAI,QAAQ,GAC5B,GAAG,GAAG,WAAW,IAAI,SAAS,GAC9B,IAAI,GAAG,gBAAgB,SAAS,CAClC,CACF;GACJ,KAAK,MAAM,OAAO,UAChB,OAAO,YACJ,OAAO,QAAQ,aAAa,KAAK,CAAC,CAClC,MACC,IACE,GAAG,GAAG,UAAU,MAAM,QAAQ,GAC9B,GAAG,GAAG,WAAW,IAAI,SAAS,GAC9B,GAAG,GAAG,WAAW,IAAI,SAAS,GAC9B,IAAI,GAAG,gBAAgB,SAAS,CAClC,CACF;GACJ,IAAI,SAAS,SAAS,GACpB,OAAO,YAAY,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,MAC/C,IACE,GAAG,GAAG,UAAU,MAAM,QAAQ,GAC9B,QACE,GAAG,WACH,SAAS,KAAK,QAAa,IAAI,SAAS,CAC1C,GACA,IAAI,GAAG,gBAAgB,SAAS,CAClC,CACF;GACF,KAAK,MAAM,OAAO,QAChB,OAAO,YAAY,OAAO,QAAQ,OAAO,KAAK,CAAC,CAAC,MAC9C,IACE,GAAG,GAAG,UAAU,MAAM,QAAQ,GAC9B,GAAG,GAAG,SAAS,IAAI,OAAO,GAC1B,GAAG,GAAG,UAAU,IAAI,QAAQ,GAC5B,OAAO,GAAG,aAAa,GACvB,UACE,YACG,OAAO,EAAE,KAAK,GAAG,IAAI,CAAC,CAAC,CACvB,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MACC,IACE,GAAG,GAAG,UAAU,GAAG,QAAQ,GAC3B,GAAG,GAAG,SAAS,GAAG,OAAO,GACzB,GAAG,GAAG,WAAW,GAAG,QAAQ,CAC9B,CACF,CACJ,CACF,CACF;GACF,KAAK,MAAM,OAAO,YAChB,OAAO,YAAY,OAAO,QAAQ,UAAU,KAAK,CAAC,CAAC,MACjD,IACE,GAAG,IAAI,UAAU,MAAM,QAAQ,GAC/B,GAAG,IAAI,SAAS,IAAI,OAAO,GAC3B,GAAG,IAAI,QAAQ,IAAI,MAAM,GACzB,GAAG,IAAI,WAAW,IAAI,SAAS,GAC/B,GAAG,IAAI,UAAU,IAAI,QAAQ,GAC7B,UACE,YACG,OAAO,EAAE,KAAK,GAAG,IAAI,CAAC,CAAC,CACvB,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MACC,IACE,GAAG,GAAG,UAAU,IAAI,QAAQ,GAC5B,GAAG,GAAG,SAAS,IAAI,OAAO,GAC1B,GAAG,GAAG,QAAQ,IAAI,MAAM,GACxB,GAAG,GAAG,WAAW,IAAI,SAAS,GAC9B,GAAG,GAAG,UAAU,IAAI,QAAQ,CAC9B,CACF,CACJ,CACF,CACF;GAEF,OAAO;EACT,CAAC,CACH,CAAC,CAAC,KACA,OAAO,eAAe,iBAAiB,QAAQ,GAC/C,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF;CACJ,CAAC;AACH,CAAC;AAED,MAAM,sBAAsB,OAAO,GAAG,kCAAkC,CAAC,CAAC,WACxE,SACA,eACA,OACA,QACA;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,mBAAmB,OAAO,cAC9B,SACA,MAAM,UACN,MAAM,SACN,MAAM,SACN,cAAc,OAChB;CAEA,MAAM,OAAO,QAAQ,UAAU;EAC7B,UAAU,MAAM;EAChB,SAAS,MAAM;EACf,SAAS,MAAM;CACjB,CAAC;CAED,IAAI,QACF,OAAO,aAAa,SAAS,eAAe,MAAM,UAAU,MAAM,SAAS,KAAK,MAAM;CACxF,MAAM,IAAI,oBAAoB,OAAO;CAWrC,MAAM,OAAM,OATQ,WAClB,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,aAAa,KAAK,CAAC,CAChC,MAAM,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,gBAAgB,MAAM,cAAc,CAAC,CAAC,CAAC,CACtF,MAAM,CAAC,GACV,cAAc,OAChB,EAAA,CAEiB;CACjB,MAAM,MAAM,OAAO;CACnB,MAAM,SAAS,QAAQ,KAAA,IAAY,KAAA,IAAY,OAAO,QAAQ,aAAa,OAAO,GAAG;CAerF,OAZE,oBACA,QAAQ,KAAA,KACR,WAAW,KAAA,KACX,OAAO,aAAa,MAAM,YAC1B,OAAO,mBAAmB,MAAM,kBAChC,OAAO,YAAY,MAAM,WACzB,OAAO,WAAW,MAAM,sBACxB,OAAO,cAAc,KAAK,UAC1B,YAAY,OAAO,SAAS,MAAM,OAAO,KACzC,IAAI,QAAQ,aAAa,cAAc,SACvC,OAAO,kBAAkB,MAER;EAAU;EAAS;EAAK,SAAS;CAAE,IAAI,KAAA;AAC5D,CAAC;;AAGD,MAAa,yBAAyB,OAAO,GAAG,gCAAgC,CAAC,CAAC,WAChF,SACA,eACA,OACA;CACA,OAAO,OAAO,oBAAoB,SAAS,eAAe,OAAO,KAAK,CAAC,CAAC,KACtE,OAAO,KAAK,UAAU,UAAU,KAAA,CAAS,CAC3C;AACF,CAAC;AAED,MAAM,aAAa,OAAO,GAAG,yBAAyB,CAAC,CAAC,WACtD,SACA,eACA,OACA,SACA,mBACA;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,WAAW,OAAO,oBAAoB,SAAS,eAAe,OAAO,IAAI;CAE/E,IAAI,aAAa,KAAA,GAAW,OAAO,QAAQ,UAAU;CACrD,MAAM,EAAE,QAAQ,KAAK,UAAU,SAAS,MAAM;CAE9C,IAAI,sBAAsB,KAAA,KAAa,EAAE,OAAO,oBAAoB,OAAO,OAAO,YAAY;CAC9F,MAAM,QAAQ,QAAQ,WAAW;CAEjC,OAAO,SACJ,OAAO,QAAQ,aAAa,KAAK,CAAC,CAClC,IAAI,aAAkB,CAAC,CAAC,QAAQ,aAAa,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,CAC/D,MACC,IACE,GAAG,EAAE,UAAU,MAAM,QAAQ,GAC7B,GAAG,EAAE,gBAAgB,MAAM,cAAc,GACzC,GAAG,EAAE,QAAQ,MAAM,kBAAkB,GACrC,GAAG,EAAE,UAAU,KAAK,CACtB,CACF;CACF,OAAO,cACL,SACA,MAAM,UACN,MAAM,oBACN,YACA,aACA,OAAO,eACT;CAEA,MAAM,gBAAgB,OAAO,QAAQ,qCAAqC,uBACxE,OAAO,IAAI,aAAa;EACtB,MAAM,aAAa,OAAO,WACxB,mBACG,OAAO,CAAC,CACR,KAAK,QAAQ,aAAa,KAAK,CAAC,CAChC,MAAM,IAAI,GAAG,EAAE,UAAU,MAAM,QAAQ,GAAG,GAAG,EAAE,gBAAgB,MAAM,cAAc,CAAC,CAAC,CAAC,CACtF,MAAM,CAAC,GACV,KACF,EAAA,CAAG;EAEH,MAAM,WAAW,OAAO,WACtB,SACA,MAAM,UACN,MAAM,oBACN,KACF,EAAA,CAAG;EAEH,MAAM,UACJ,cAAc,KAAA,IAAY,KAAA,IAAY,OAAO,QAAQ,aAAa,OAAO,SAAS;EAEpF,MAAM,YAAY;GAChB,QAAQ,aAAa;GACrB,QAAQ,aAAa;GACrB,QAAQ,aAAa;GACrB,QAAQ,aAAa;GACrB,QAAQ,aAAa;GACrB,QAAQ,aAAa;GACrB,QAAQ,aAAa;EACvB;EAEA,IACE,cAAc,KAAA,KACd,YAAY,KAAA,KACZ,CAAC,YAAY,QAAQ,SAAS,OAAO,OAAO,KAC5C,UAAU,QAAQ,aAAa,cAAc,QAC7C,UAAU,MAAM,QAAQ,UAAU,SAAS,SAAS,IAAI,MACvD,OAAO,QAAQ,cAAc,UAAU,QAAQ,aAAa,UAAU,OACrE,OAAO,oBACR,OAAO,QAAQ,cAAc,UAAU,QAAQ,aAAa,eAAe,QACzE,OAAO,QAAQ,cAAc,SAAS,QAAQ,aAAa,eAAe,MAC7E,YAAY,KAAA,KACZ,QAAQ,QAAQ,QAAQ,UAAU,cAClC,QAAQ,QAAQ,QAAQ,cAAc,gBACrC,OAAO,QAAQ,cAAc,QAAQ,QAAQ,QAAQ,eAAe,OACnE,OAAO,iBAET,OAAO,OAAO,YAAY;EAE5B,IAAI,OAAO,oBAAoB,OAAO,YAAY,OAAO,OAAO,YAAY;CAC9E,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,iBAAiB,kBAAkB,CAAC,CACpE;CAEA,OAAO,cAAc,KAAK,OAAO,eAAe,oCAAoC,QAAQ,CAAC;CAC7F,MAAM,iBAAiB,OAAO,OAAO,cAAc,8BAA8B;CAEjF,IACE,OAAO,OAAO,cAAc,KAC5B,CAAC,eAAe,MAAM,SAAS,cAAc,KAAK,gBAAgB,CAAC,GAEnE,OAAO,OAAO,YAAY;CAE5B,OAAO;AACT,CAAC;;AAGD,MAAa,sBAAsB,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAiB1E,SACA,eACA,MACA,mBACA,SACA;CACA,MAAM,UAAU,OAAO;CAEvB,OAAO,OAAO,WACZ,SACA,eACA,KAAK,QACJ,aAAa,KAAK,QAAQ,UAAU,SAAS,OAAO,GACrD,iBACF;AACF,CAAC"}

package/dist/drizzle/proof-target.d.mts

@@ -0,0 +1,17 @@
+import "../Schema.mjs";
+import "../hooks/models.mjs";
+import { LifecycleHooks } from "../hooks/LifecycleHooks.mjs";
+import "../Hooks.mjs";
+import "../proofs/errors.mjs";
+import { ProofPersistence } from "../proofs/ProofPersistence.mjs";
+import "../Proofs.mjs";
+import "./proof-sql.mjs";
+import { Effect, Layer } from "effect";
+import "effect/unstable/sql/SqlError";
+//#region src/drizzle/proof-target.d.ts
+declare const proofPersistenceLayer: (services: Effect.Effect<{
+  readonly proofPersistence: ProofPersistence["Service"];
+}, never, LifecycleHooks>) => Layer.Layer<ProofPersistence, never, LifecycleHooks>;
+//#endregion
+export { proofPersistenceLayer };
+//# sourceMappingURL=proof-target.d.mts.map

package/dist/drizzle/proof-target.mjs

@@ -0,0 +1,38 @@
+import { LifecycleHooks } from "../hooks/LifecycleHooks.mjs";
+import { coordinateCommit, hasCommitScope } from "../hooks/commit.mjs";
+import { sqlClientStandaloneGuard } from "./standalone-guard.mjs";
+import { ProofUnavailable } from "../proofs/errors.mjs";
+import { ProofPersistence } from "../proofs/ProofPersistence.mjs";
+import { makeSqlProofPersistence } from "./proof-sql.mjs";
+import { Effect, Layer } from "effect";
+//#region src/drizzle/proof-target.ts
+const sqlClientProofStandaloneGuard = (database) => sqlClientStandaloneGuard(database, () => ProofUnavailable.make({}));
+const options = (configuration, coordinated = false) => ({
+	mode: configuration.mode,
+	locking: configuration.locking,
+	standaloneGuard: !coordinated ? configuration.standaloneGuard : Effect.void,
+	insertIfAbsent: configuration.insertIfAbsent,
+	coordinated
+});
+const makeTargetProofPersistenceServices = (database, mapping, configuration) => Effect.gen(function* () {
+	return { proofPersistence: yield* makeSqlProofPersistence(database, mapping, options(configuration)) };
+});
+/**
+* The native transaction is the root commit owner. Interruption or owner failure
+* rolls it back and discards the journal. No owner effect is retried. Native
+* transaction-acquisition `SqlError`s are exposed; caller errors, including
+* Drizzle query wrappers, propagate unchanged.
+*/
+const coordinateTargetProofPersistence = (database, mapping, configuration, owner) => Effect.gen(function* () {
+	const hooks = yield* LifecycleHooks;
+	if (yield* hasCommitScope) return yield* ProofUnavailable.make({});
+	yield* configuration.coordinatorGuard ?? configuration.standaloneGuard;
+	return (yield* coordinateCommit(() => database.transaction((transaction) => Effect.gen(function* () {
+		return yield* owner(transaction, { proofPersistence: yield* makeSqlProofPersistence(transaction, mapping, options(configuration, true)) });
+	})), { mode: configuration.mode }).pipe(Effect.provideService(LifecycleHooks, hooks))).value;
+});
+const proofPersistenceLayer = (services) => Layer.effect(ProofPersistence, Effect.map(services, (value) => value.proofPersistence));
+//#endregion
+export { coordinateTargetProofPersistence, makeTargetProofPersistenceServices, proofPersistenceLayer, sqlClientProofStandaloneGuard };
+
+//# sourceMappingURL=proof-target.mjs.map

package/dist/drizzle/proof-target.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof-target.mjs","names":[],"sources":["../../src/drizzle/proof-target.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- public driver entrypoints restore concrete Drizzle types. */\nimport { Effect, Layer } from \"effect\";\nimport type * as SqlError from \"effect/unstable/sql/SqlError\";\n\nimport { coordinateCommit, hasCommitScope } from \"../hooks/commit\";\nimport { LifecycleHooks } from \"../hooks/LifecycleHooks\";\nimport type { HookConfigurationError } from \"../hooks/models\";\nimport { ProofUnavailable } from \"../proofs/errors\";\nimport { ProofPersistence } from \"../proofs/ProofPersistence\";\nimport {\n  makeSqlProofPersistence,\n  type ProofSqlConfiguration,\n  type ProofSqlDatabase,\n  type ProofSqlQuery,\n} from \"./proof-sql\";\nimport { sqlClientStandaloneGuard } from \"./standalone-guard\";\n\nexport interface ProofTargetConfiguration {\n  readonly mode: \"interactive\" | \"synchronous\";\n  readonly locking: boolean;\n  readonly standaloneGuard: Effect.Effect<void, ProofUnavailable>;\n  readonly coordinatorGuard?: Effect.Effect<void, ProofUnavailable>;\n  readonly insertIfAbsent: (\n    query: ProofSqlQuery,\n    selfKey: string,\n    selfValue: unknown,\n  ) => ProofSqlQuery;\n}\n\ninterface TransactionOwner<Transaction> {\n  readonly transaction: <A, E, R>(\n    body: (transaction: Transaction) => Effect.Effect<A, E, R>,\n  ) => Effect.Effect<A, E | SqlError.SqlError, R>;\n}\n\nexport type ProofCoordinatorError<E> =\n  | E\n  | ProofUnavailable\n  | HookConfigurationError\n  | SqlError.SqlError;\n\nexport const sqlClientProofStandaloneGuard = (\n  database: unknown,\n): Effect.Effect<void, ProofUnavailable> =>\n  sqlClientStandaloneGuard(database, () => ProofUnavailable.make({}));\n\nconst options = (\n  configuration: ProofTargetConfiguration,\n  coordinated = false,\n): ProofSqlConfiguration => ({\n  mode: configuration.mode,\n  locking: configuration.locking,\n\n  standaloneGuard: !coordinated ? configuration.standaloneGuard : Effect.void,\n  insertIfAbsent: configuration.insertIfAbsent,\n  coordinated,\n});\n\nexport const makeTargetProofPersistenceServices = (\n  database: any,\n  mapping: any,\n  configuration: ProofTargetConfiguration,\n) =>\n  Effect.gen(function* () {\n    return {\n      proofPersistence: yield* makeSqlProofPersistence(database, mapping, options(configuration)),\n    };\n  });\n\n/**\n * The native transaction is the root commit owner. Interruption or owner failure\n * rolls it back and discards the journal. No owner effect is retried. Native\n * transaction-acquisition `SqlError`s are exposed; caller errors, including\n * Drizzle query wrappers, propagate unchanged.\n */\nexport const coordinateTargetProofPersistence = <Transaction, A, E, R>(\n  database: TransactionOwner<Transaction>,\n  mapping: any,\n  configuration: ProofTargetConfiguration,\n  owner: (\n    transaction: Transaction,\n    services: { readonly proofPersistence: ProofPersistence[\"Service\"] },\n  ) => Effect.Effect<A, E, R>,\n): Effect.Effect<A, ProofCoordinatorError<E>, R | LifecycleHooks> =>\n  Effect.gen(function* (): Effect.fn.Return<A, ProofCoordinatorError<E>, R | LifecycleHooks> {\n    const hooks = yield* LifecycleHooks;\n\n    if (yield* hasCommitScope) return yield* ProofUnavailable.make({});\n    yield* configuration.coordinatorGuard ?? configuration.standaloneGuard;\n\n    const result = yield* coordinateCommit(\n      () =>\n        database.transaction((transaction) =>\n          Effect.gen(function* () {\n            return yield* owner(transaction, {\n              proofPersistence: yield* makeSqlProofPersistence(\n                transaction as unknown as ProofSqlDatabase,\n                mapping,\n                options(configuration, true),\n              ),\n            });\n          }),\n        ),\n      { mode: configuration.mode },\n    ).pipe(Effect.provideService(LifecycleHooks, hooks));\n\n    return result.value;\n  });\n\nexport const proofPersistenceLayer = (\n  services: Effect.Effect<\n    { readonly proofPersistence: ProofPersistence[\"Service\"] },\n    never,\n    LifecycleHooks\n  >,\n) =>\n  Layer.effect(\n    ProofPersistence,\n    Effect.map(services, (value) => value.proofPersistence),\n  );\n"],"mappings":";;;;;;;;AAyCA,MAAa,iCACX,aAEA,yBAAyB,gBAAgB,iBAAiB,KAAK,CAAC,CAAC,CAAC;AAEpE,MAAM,WACJ,eACA,cAAc,WACa;CAC3B,MAAM,cAAc;CACpB,SAAS,cAAc;CAEvB,iBAAiB,CAAC,cAAc,cAAc,kBAAkB,OAAO;CACvE,gBAAgB,cAAc;CAC9B;AACF;AAEA,MAAa,sCACX,UACA,SACA,kBAEA,OAAO,IAAI,aAAa;CACtB,OAAO,EACL,kBAAkB,OAAO,wBAAwB,UAAU,SAAS,QAAQ,aAAa,CAAC,EAC5F;AACF,CAAC;;;;;;;AAQH,MAAa,oCACX,UACA,SACA,eACA,UAKA,OAAO,IAAI,aAAgF;CACzF,MAAM,QAAQ,OAAO;CAErB,IAAI,OAAO,gBAAgB,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;CACjE,OAAO,cAAc,oBAAoB,cAAc;CAkBvD,QAAO,OAhBe,uBAElB,SAAS,aAAa,gBACpB,OAAO,IAAI,aAAa;EACtB,OAAO,OAAO,MAAM,aAAa,EAC/B,kBAAkB,OAAO,wBACvB,aACA,SACA,QAAQ,eAAe,IAAI,CAC7B,EACF,CAAC;CACH,CAAC,CACH,GACF,EAAE,MAAM,cAAc,KAAK,CAC7B,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC,EAAA,CAErC;AAChB,CAAC;AAEH,MAAa,yBACX,aAMA,MAAM,OACJ,kBACA,OAAO,IAAI,WAAW,UAAU,MAAM,gBAAgB,CACxD"}

package/dist/drizzle/session-model.d.mts

@@ -0,0 +1,201 @@
+import { TokenDigest } from "../Schema.mjs";
+import { AuthenticationEvidence, AuthenticationRequirement, SecurityRevision, SessionId } from "../sessions/models.mjs";
+import { PendingAuthenticationRecord, PendingAuthenticationState } from "../sessions/PendingAuthentication.mjs";
+import { StatefulSessionRecord } from "../sessions/persistence.mjs";
+import { DrizzleMappingError, SubjectIdCodec } from "./model.mjs";
+import { DateTime, Effect } from "effect";
+import { InferInsertModel, InferSelectModel, SQL, Table } from "drizzle-orm";
+//#region src/drizzle/session-model.d.ts
+type ColumnKey<T extends Table> = Extract<keyof T["_"]["columns"], string>;
+interface SessionIdCodec<NativeId> {
+  readonly toNative: (id: SessionId) => Effect.Effect<NativeId, DrizzleMappingError>;
+  readonly toSession: (id: NativeId) => Effect.Effect<SessionId, DrizzleMappingError>;
+  readonly equals: (left: NativeId, right: NativeId) => boolean;
+}
+interface SessionSubjectTables<Subject extends Table, NativeId> {
+  readonly subject: {
+    readonly table: Subject;
+    readonly id: ColumnKey<Subject>;
+    readonly status: ColumnKey<Subject>;
+    readonly securityRevision: ColumnKey<Subject>;
+    readonly isActiveStatus: (value: unknown) => boolean;
+    readonly decodeRequirement: (row: InferSelectModel<Subject>) => Effect.Effect<AuthenticationRequirement, DrizzleMappingError>;
+    readonly nextSecurityRevision?: (current: SecurityRevision) => Effect.Effect<SecurityRevision, DrizzleMappingError>;
+    readonly nextSecurityRevisionSync?: (current: SecurityRevision) => SecurityRevision;
+  };
+  readonly subjectId: SubjectIdCodec<NativeId>;
+}
+interface SessionAuthorityTables<Subject extends Table, Credential extends Table, NativeId> extends SessionSubjectTables<Subject, NativeId> {
+  readonly credential: {
+    readonly table: Credential;
+    readonly subjectId: ColumnKey<Credential>;
+    readonly credentialId: ColumnKey<Credential>;
+    readonly revision: ColumnKey<Credential>;
+    /** Optional consumer status predicate; omitted means every stored credential row is active. */
+    readonly status?: ColumnKey<Credential>;
+    readonly isActiveStatus?: (value: unknown) => boolean;
+  };
+}
+interface SessionFlowTables<Flow extends Table, NativeSubjectId> {
+  readonly flow: {
+    readonly table: Flow;
+    readonly flowId: ColumnKey<Flow>;
+    readonly subjectId: ColumnKey<Flow>;
+    readonly state: ColumnKey<Flow>;
+    readonly pendingDigest: ColumnKey<Flow>;
+    readonly dedupUntil: ColumnKey<Flow>;
+    readonly pendingStateValue: unknown;
+    readonly establishedStateValue: unknown;
+    readonly encodeInstant: (instant: DateTime.Utc) => unknown;
+    readonly decodeInstant: (native: unknown) => Effect.Effect<DateTime.Utc, DrizzleMappingError>;
+    readonly encodePendingInsert: (input: {
+      readonly evidence: AuthenticationEvidence;
+      readonly subjectId: NativeSubjectId;
+      readonly pendingDigest: TokenDigest;
+      readonly dedupUntil: DateTime.Utc;
+    }) => InferInsertModel<Flow>;
+    readonly encodeEstablishedInsert: (input: {
+      readonly evidence: AuthenticationEvidence;
+      readonly subjectId: NativeSubjectId;
+      readonly dedupUntil: DateTime.Utc;
+    }) => InferInsertModel<Flow>;
+  };
+}
+interface StatefulSessionTables<Claims, Session extends Table, Flow extends Table, NativeSubjectId, NativeSessionId> extends SessionFlowTables<Flow, NativeSubjectId> {
+  readonly session: {
+    readonly table: Session;
+    readonly sessionId: ColumnKey<Session>;
+    readonly subjectId: ColumnKey<Session>;
+    readonly digest: ColumnKey<Session>;
+    readonly version: ColumnKey<Session>;
+    readonly securityRevision: ColumnKey<Session>;
+    readonly issuedAt: ColumnKey<Session>;
+    readonly expiresAt: ColumnKey<Session>;
+    readonly absoluteExpiresAt: ColumnKey<Session>;
+    readonly encodeInstant: (instant: DateTime.Utc) => unknown;
+    readonly encodeInsert: (record: StatefulSessionRecord<Claims>, ids: {
+      readonly subjectId: NativeSubjectId;
+      readonly sessionId: NativeSessionId;
+    }) => InferInsertModel<Session>;
+    /** Persist the prepared credentialVersion and retain exact private provenance. */
+    readonly encodeRotation: (record: StatefulSessionRecord<Claims>) => Partial<InferInsertModel<Session>>;
+    readonly decode: (row: InferSelectModel<Session>) => Effect.Effect<StatefulSessionRecord<Claims>, DrizzleMappingError>;
+    readonly allocateId?: Effect.Effect<NativeSessionId, DrizzleMappingError>;
+    readonly allocateIdSync?: () => NativeSessionId;
+    readonly allocateVersion?: Effect.Effect<SecurityRevision, DrizzleMappingError>;
+    readonly allocateVersionSync?: () => SecurityRevision;
+  };
+  readonly sessionId: SessionIdCodec<NativeSessionId>;
+}
+interface PendingAuthenticationTables<Claims, Pending extends Table, Flow extends Table, NativeSubjectId> extends SessionFlowTables<Flow, NativeSubjectId> {
+  readonly pending: {
+    readonly table: Pending;
+    readonly digest: ColumnKey<Pending>;
+    readonly version: ColumnKey<Pending>;
+    readonly flowId: ColumnKey<Pending>;
+    readonly subjectId: ColumnKey<Pending>;
+    readonly bindingDigest: ColumnKey<Pending>;
+    readonly expiresAt: ColumnKey<Pending>;
+    readonly attemptLimit: ColumnKey<Pending>;
+    readonly failedAttempts: ColumnKey<Pending>;
+    readonly consumed: ColumnKey<Pending>;
+    readonly encodeInstant: (instant: DateTime.Utc) => unknown;
+    readonly encodeInsert: (record: PendingAuthenticationRecord<Claims>, input: {
+      readonly subjectId: NativeSubjectId;
+      readonly failedAttempts: 0;
+      readonly consumed: false;
+    }) => InferInsertModel<Pending>;
+    readonly decode: (row: InferSelectModel<Pending>) => Effect.Effect<PendingAuthenticationRecord<Claims>, DrizzleMappingError>;
+    /** Decodes original evidence and storage guards only. The internal pending
+     * context lookup must not execute unrelated consumer Claims transforms. */
+    readonly decodeContext: (row: InferSelectModel<Pending>) => Effect.Effect<PendingAuthenticationState, DrizzleMappingError>;
+    readonly allocateVersion?: Effect.Effect<SecurityRevision, DrizzleMappingError>;
+    readonly allocateVersionSync?: () => SecurityRevision;
+  };
+}
+interface SignedSessionValidityTables<Tombstone extends Table, NativeSubjectId, NativeSessionId> {
+  readonly tombstone: {
+    readonly table: Tombstone;
+    readonly subjectId: ColumnKey<Tombstone>;
+    readonly sessionId: ColumnKey<Tombstone>;
+    readonly absoluteExpiresAt: ColumnKey<Tombstone>;
+    readonly encodeInstant: (instant: DateTime.Utc) => unknown;
+    readonly decodeInstant: (native: unknown) => Effect.Effect<DateTime.Utc, DrizzleMappingError>;
+    readonly encodeInsert: (input: {
+      readonly subjectId: NativeSubjectId;
+      readonly sessionId: NativeSessionId;
+      readonly absoluteExpiresAt: DateTime.Utc;
+    }) => InferInsertModel<Tombstone>;
+  };
+  readonly sessionId: SessionIdCodec<NativeSessionId>;
+}
+interface RequiredSessionConstraints {
+  readonly sessionDigest: "unique(session.digest)";
+  readonly flowId: "unique(flow.flowId)";
+}
+interface RequiredPendingAuthenticationConstraints {
+  readonly pendingDigest: "unique(pending.digest)";
+  readonly pendingFlow: "unique(pending.flowId)";
+  readonly flowId: "unique(flow.flowId)";
+}
+interface RequiredStatefulPendingConstraints extends RequiredSessionConstraints, RequiredPendingAuthenticationConstraints {}
+interface RequiredSignedValidityConstraints {
+  readonly tombstoneOwner: "unique(tombstone.subjectId,tombstone.sessionId)";
+}
+declare const requiredSessionConstraints: RequiredSessionConstraints;
+declare const requiredPendingAuthenticationConstraints: RequiredPendingAuthenticationConstraints;
+declare const requiredStatefulPendingConstraints: RequiredStatefulPendingConstraints;
+declare const requiredSignedValidityConstraints: RequiredSignedValidityConstraints;
+interface SessionConstraintClassifier {
+  /**
+   * Match only the named unique constraints declared by this mapping. Broad
+   * SQL/constraint classifiers can relabel application or NOT NULL failures as
+   * a domain conflict.
+   */
+  readonly isConstraintConflict: (cause: unknown) => boolean;
+}
+type AuthenticationAuthorityMapping<Claims, Subject extends Table, Credential extends Table, Flow extends Table, Pending extends Table, NativeSubjectId> = SessionAuthorityTables<Subject, Credential, NativeSubjectId> & SessionConstraintClassifier & ({
+  /** Omit for single-factor authority installations. Pending input then fails closed. */
+  readonly pending?: undefined;
+} | {
+  readonly pending: PendingAuthenticationTables<Claims, Pending, Flow, NativeSubjectId>;
+  readonly constraints: RequiredPendingAuthenticationConstraints;
+});
+type StatefulSessionMapping<Claims, Subject extends Table, Credential extends Table, Session extends Table, Flow extends Table, Pending extends Table, NativeSubjectId, NativeSessionId> = SessionAuthorityTables<Subject, Credential, NativeSubjectId> & StatefulSessionTables<Claims, Session, Flow, NativeSubjectId, NativeSessionId> & SessionConstraintClassifier & ({
+  /** Omit when this session module does not support pending MFA completion. */
+  readonly pending?: undefined;
+  readonly constraints: RequiredSessionConstraints;
+} | {
+  readonly pending: PendingAuthenticationTables<Claims, Pending, Flow, NativeSubjectId>["pending"];
+  readonly constraints: RequiredStatefulPendingConstraints;
+});
+type PendingAuthenticationMapping<Claims, Subject extends Table, Credential extends Table, Pending extends Table, Flow extends Table, NativeSubjectId> = SessionAuthorityTables<Subject, Credential, NativeSubjectId> & PendingAuthenticationTables<Claims, Pending, Flow, NativeSubjectId> & SessionConstraintClassifier & {
+  readonly constraints: RequiredPendingAuthenticationConstraints;
+};
+type SignedSessionValidityMapping<Subject extends Table, Tombstone extends Table, NativeSubjectId, NativeSessionId> = SessionSubjectTables<Subject, NativeSubjectId> & SignedSessionValidityTables<Tombstone, NativeSubjectId, NativeSessionId> & SessionConstraintClassifier & {
+  readonly constraints: RequiredSignedValidityConstraints;
+};
+/** D1 evaluates these expressions inside the atomic batch, after queueing delay.
+ * `engineNow` must use the exact native representation of every mapped instant
+ * column. `engineNowMillis` is Unix epoch milliseconds for proof freshness.
+ * Changes to the consumer's factor policy MUST bump subject.securityRevision.
+ * Supply the authoritative primary D1 database, never a replica-affined
+ * `withSession` handle, because verification and security revision reads must
+ * observe completed revocation writes across clients.
+ */
+interface D1SessionClockMapping {
+  readonly d1: {
+    readonly engineNow: SQL;
+    readonly engineNowMillis: SQL;
+    readonly activeSubjectStatusValue: unknown;
+    /** Required when `credential.status` is mapped. */
+    readonly activeCredentialStatusValue?: unknown;
+  };
+}
+type D1AuthenticationAuthorityMapping<Claims, Subject extends Table, Credential extends Table, Flow extends Table, Pending extends Table, NativeSubjectId> = AuthenticationAuthorityMapping<Claims, Subject, Credential, Flow, Pending, NativeSubjectId> & D1SessionClockMapping;
+type D1PendingAuthenticationMapping<Claims, Subject extends Table, Credential extends Table, Pending extends Table, Flow extends Table, NativeSubjectId> = PendingAuthenticationMapping<Claims, Subject, Credential, Pending, Flow, NativeSubjectId> & D1SessionClockMapping;
+type D1StatefulSessionMapping<Claims, Subject extends Table, Credential extends Table, Session extends Table, Flow extends Table, Pending extends Table, NativeSubjectId, NativeSessionId> = StatefulSessionMapping<Claims, Subject, Credential, Session, Flow, Pending, NativeSubjectId, NativeSessionId> & D1SessionClockMapping;
+type D1SignedSessionValidityMapping<Subject extends Table, Tombstone extends Table, NativeSubjectId, NativeSessionId> = SignedSessionValidityMapping<Subject, Tombstone, NativeSubjectId, NativeSessionId> & D1SessionClockMapping;
+//#endregion
+export { AuthenticationAuthorityMapping, D1AuthenticationAuthorityMapping, D1PendingAuthenticationMapping, D1SessionClockMapping, D1SignedSessionValidityMapping, D1StatefulSessionMapping, PendingAuthenticationMapping, PendingAuthenticationTables, RequiredPendingAuthenticationConstraints, RequiredSessionConstraints, RequiredSignedValidityConstraints, RequiredStatefulPendingConstraints, SessionAuthorityTables, SessionConstraintClassifier, SessionFlowTables, SessionIdCodec, SessionSubjectTables, SignedSessionValidityMapping, SignedSessionValidityTables, StatefulSessionMapping, StatefulSessionTables, requiredPendingAuthenticationConstraints, requiredSessionConstraints, requiredSignedValidityConstraints, requiredStatefulPendingConstraints };
+//# sourceMappingURL=session-model.d.mts.map

package/dist/drizzle/session-model.mjs

@@ -0,0 +1,19 @@
+//#region src/drizzle/session-model.ts
+const requiredSessionConstraints = {
+	sessionDigest: "unique(session.digest)",
+	flowId: "unique(flow.flowId)"
+};
+const requiredPendingAuthenticationConstraints = {
+	pendingDigest: "unique(pending.digest)",
+	pendingFlow: "unique(pending.flowId)",
+	flowId: "unique(flow.flowId)"
+};
+const requiredStatefulPendingConstraints = {
+	...requiredSessionConstraints,
+	...requiredPendingAuthenticationConstraints
+};
+const requiredSignedValidityConstraints = { tombstoneOwner: "unique(tombstone.subjectId,tombstone.sessionId)" };
+//#endregion
+export { requiredPendingAuthenticationConstraints, requiredSessionConstraints, requiredSignedValidityConstraints, requiredStatefulPendingConstraints };
+
+//# sourceMappingURL=session-model.mjs.map

package/dist/drizzle/session-model.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-model.mjs","names":[],"sources":["../../src/drizzle/session-model.ts"],"sourcesContent":["import type { InferInsertModel, InferSelectModel, SQL, Table } from \"drizzle-orm\";\nimport type { DateTime, Effect } from \"effect\";\n\nimport type { TokenDigest } from \"../Schema\";\nimport {\n  type AuthenticationRequirement,\n  type AuthenticationEvidence,\n  type SecurityRevision,\n  type SessionId,\n} from \"../sessions/models\";\nimport type {\n  PendingAuthenticationRecord,\n  PendingAuthenticationState,\n} from \"../sessions/PendingAuthentication\";\nimport type { StatefulSessionRecord } from \"../sessions/persistence\";\nimport type { DrizzleMappingError, SubjectIdCodec } from \"./model\";\n\ntype ColumnKey<T extends Table> = Extract<keyof T[\"_\"][\"columns\"], string>;\n\nexport interface SessionIdCodec<NativeId> {\n  readonly toNative: (id: SessionId) => Effect.Effect<NativeId, DrizzleMappingError>;\n  readonly toSession: (id: NativeId) => Effect.Effect<SessionId, DrizzleMappingError>;\n  readonly equals: (left: NativeId, right: NativeId) => boolean;\n}\n\nexport interface SessionSubjectTables<Subject extends Table, NativeId> {\n  readonly subject: {\n    readonly table: Subject;\n    readonly id: ColumnKey<Subject>;\n    readonly status: ColumnKey<Subject>;\n    readonly securityRevision: ColumnKey<Subject>;\n    readonly isActiveStatus: (value: unknown) => boolean;\n    readonly decodeRequirement: (\n      row: InferSelectModel<Subject>,\n    ) => Effect.Effect<AuthenticationRequirement, DrizzleMappingError>;\n    readonly nextSecurityRevision?: (\n      current: SecurityRevision,\n    ) => Effect.Effect<SecurityRevision, DrizzleMappingError>;\n    readonly nextSecurityRevisionSync?: (current: SecurityRevision) => SecurityRevision;\n  };\n  readonly subjectId: SubjectIdCodec<NativeId>;\n}\n\nexport interface SessionAuthorityTables<\n  Subject extends Table,\n  Credential extends Table,\n  NativeId,\n> extends SessionSubjectTables<Subject, NativeId> {\n  readonly credential: {\n    readonly table: Credential;\n    readonly subjectId: ColumnKey<Credential>;\n    readonly credentialId: ColumnKey<Credential>;\n    readonly revision: ColumnKey<Credential>;\n    /** Optional consumer status predicate; omitted means every stored credential row is active. */\n    readonly status?: ColumnKey<Credential>;\n    readonly isActiveStatus?: (value: unknown) => boolean;\n  };\n}\n\nexport interface SessionFlowTables<Flow extends Table, NativeSubjectId> {\n  readonly flow: {\n    readonly table: Flow;\n    readonly flowId: ColumnKey<Flow>;\n    readonly subjectId: ColumnKey<Flow>;\n    readonly state: ColumnKey<Flow>;\n    readonly pendingDigest: ColumnKey<Flow>;\n    readonly dedupUntil: ColumnKey<Flow>;\n    readonly pendingStateValue: unknown;\n    readonly establishedStateValue: unknown;\n    readonly encodeInstant: (instant: DateTime.Utc) => unknown;\n    readonly decodeInstant: (native: unknown) => Effect.Effect<DateTime.Utc, DrizzleMappingError>;\n    readonly encodePendingInsert: (input: {\n      readonly evidence: AuthenticationEvidence;\n      readonly subjectId: NativeSubjectId;\n      readonly pendingDigest: TokenDigest;\n      readonly dedupUntil: DateTime.Utc;\n    }) => InferInsertModel<Flow>;\n    readonly encodeEstablishedInsert: (input: {\n      readonly evidence: AuthenticationEvidence;\n      readonly subjectId: NativeSubjectId;\n      readonly dedupUntil: DateTime.Utc;\n    }) => InferInsertModel<Flow>;\n  };\n}\n\nexport interface StatefulSessionTables<\n  Claims,\n  Session extends Table,\n  Flow extends Table,\n  NativeSubjectId,\n  NativeSessionId,\n> extends SessionFlowTables<Flow, NativeSubjectId> {\n  readonly session: {\n    readonly table: Session;\n    readonly sessionId: ColumnKey<Session>;\n    readonly subjectId: ColumnKey<Session>;\n    readonly digest: ColumnKey<Session>;\n    readonly version: ColumnKey<Session>;\n    readonly securityRevision: ColumnKey<Session>;\n    readonly issuedAt: ColumnKey<Session>;\n    readonly expiresAt: ColumnKey<Session>;\n    readonly absoluteExpiresAt: ColumnKey<Session>;\n    readonly encodeInstant: (instant: DateTime.Utc) => unknown;\n    readonly encodeInsert: (\n      record: StatefulSessionRecord<Claims>,\n      ids: { readonly subjectId: NativeSubjectId; readonly sessionId: NativeSessionId },\n    ) => InferInsertModel<Session>;\n    /** Persist the prepared credentialVersion and retain exact private provenance. */\n    readonly encodeRotation: (\n      record: StatefulSessionRecord<Claims>,\n    ) => Partial<InferInsertModel<Session>>;\n    readonly decode: (\n      row: InferSelectModel<Session>,\n    ) => Effect.Effect<StatefulSessionRecord<Claims>, DrizzleMappingError>;\n    readonly allocateId?: Effect.Effect<NativeSessionId, DrizzleMappingError>;\n    readonly allocateIdSync?: () => NativeSessionId;\n    readonly allocateVersion?: Effect.Effect<SecurityRevision, DrizzleMappingError>;\n    readonly allocateVersionSync?: () => SecurityRevision;\n  };\n  readonly sessionId: SessionIdCodec<NativeSessionId>;\n}\n\nexport interface PendingAuthenticationTables<\n  Claims,\n  Pending extends Table,\n  Flow extends Table,\n  NativeSubjectId,\n> extends SessionFlowTables<Flow, NativeSubjectId> {\n  readonly pending: {\n    readonly table: Pending;\n    readonly digest: ColumnKey<Pending>;\n    readonly version: ColumnKey<Pending>;\n    readonly flowId: ColumnKey<Pending>;\n    readonly subjectId: ColumnKey<Pending>;\n    readonly bindingDigest: ColumnKey<Pending>;\n    readonly expiresAt: ColumnKey<Pending>;\n    readonly attemptLimit: ColumnKey<Pending>;\n    readonly failedAttempts: ColumnKey<Pending>;\n    readonly consumed: ColumnKey<Pending>;\n    readonly encodeInstant: (instant: DateTime.Utc) => unknown;\n    readonly encodeInsert: (\n      record: PendingAuthenticationRecord<Claims>,\n      input: {\n        readonly subjectId: NativeSubjectId;\n        readonly failedAttempts: 0;\n        readonly consumed: false;\n      },\n    ) => InferInsertModel<Pending>;\n    readonly decode: (\n      row: InferSelectModel<Pending>,\n    ) => Effect.Effect<PendingAuthenticationRecord<Claims>, DrizzleMappingError>;\n    /** Decodes original evidence and storage guards only. The internal pending\n     * context lookup must not execute unrelated consumer Claims transforms. */\n    readonly decodeContext: (\n      row: InferSelectModel<Pending>,\n    ) => Effect.Effect<PendingAuthenticationState, DrizzleMappingError>;\n    readonly allocateVersion?: Effect.Effect<SecurityRevision, DrizzleMappingError>;\n    readonly allocateVersionSync?: () => SecurityRevision;\n  };\n}\n\nexport interface SignedSessionValidityTables<\n  Tombstone extends Table,\n  NativeSubjectId,\n  NativeSessionId,\n> {\n  readonly tombstone: {\n    readonly table: Tombstone;\n    readonly subjectId: ColumnKey<Tombstone>;\n    readonly sessionId: ColumnKey<Tombstone>;\n    readonly absoluteExpiresAt: ColumnKey<Tombstone>;\n    readonly encodeInstant: (instant: DateTime.Utc) => unknown;\n    readonly decodeInstant: (native: unknown) => Effect.Effect<DateTime.Utc, DrizzleMappingError>;\n    readonly encodeInsert: (input: {\n      readonly subjectId: NativeSubjectId;\n      readonly sessionId: NativeSessionId;\n      readonly absoluteExpiresAt: DateTime.Utc;\n    }) => InferInsertModel<Tombstone>;\n  };\n  readonly sessionId: SessionIdCodec<NativeSessionId>;\n}\n\nexport interface RequiredSessionConstraints {\n  readonly sessionDigest: \"unique(session.digest)\";\n  readonly flowId: \"unique(flow.flowId)\";\n}\n\nexport interface RequiredPendingAuthenticationConstraints {\n  readonly pendingDigest: \"unique(pending.digest)\";\n  readonly pendingFlow: \"unique(pending.flowId)\";\n  readonly flowId: \"unique(flow.flowId)\";\n}\n\nexport interface RequiredStatefulPendingConstraints\n  extends RequiredSessionConstraints, RequiredPendingAuthenticationConstraints {}\n\nexport interface RequiredSignedValidityConstraints {\n  readonly tombstoneOwner: \"unique(tombstone.subjectId,tombstone.sessionId)\";\n}\n\nexport const requiredSessionConstraints: RequiredSessionConstraints = {\n  sessionDigest: \"unique(session.digest)\",\n  flowId: \"unique(flow.flowId)\",\n};\n\nexport const requiredPendingAuthenticationConstraints: RequiredPendingAuthenticationConstraints = {\n  pendingDigest: \"unique(pending.digest)\",\n  pendingFlow: \"unique(pending.flowId)\",\n  flowId: \"unique(flow.flowId)\",\n};\n\nexport const requiredStatefulPendingConstraints: RequiredStatefulPendingConstraints = {\n  ...requiredSessionConstraints,\n  ...requiredPendingAuthenticationConstraints,\n};\n\nexport const requiredSignedValidityConstraints: RequiredSignedValidityConstraints = {\n  tombstoneOwner: \"unique(tombstone.subjectId,tombstone.sessionId)\",\n};\n\nexport interface SessionConstraintClassifier {\n  /**\n   * Match only the named unique constraints declared by this mapping. Broad\n   * SQL/constraint classifiers can relabel application or NOT NULL failures as\n   * a domain conflict.\n   */\n  readonly isConstraintConflict: (cause: unknown) => boolean;\n}\n\nexport type AuthenticationAuthorityMapping<\n  Claims,\n  Subject extends Table,\n  Credential extends Table,\n  Flow extends Table,\n  Pending extends Table,\n  NativeSubjectId,\n> = SessionAuthorityTables<Subject, Credential, NativeSubjectId> &\n  SessionConstraintClassifier &\n  (\n    | {\n        /** Omit for single-factor authority installations. Pending input then fails closed. */\n        readonly pending?: undefined;\n      }\n    | {\n        readonly pending: PendingAuthenticationTables<Claims, Pending, Flow, NativeSubjectId>;\n        readonly constraints: RequiredPendingAuthenticationConstraints;\n      }\n  );\n\nexport type StatefulSessionMapping<\n  Claims,\n  Subject extends Table,\n  Credential extends Table,\n  Session extends Table,\n  Flow extends Table,\n  Pending extends Table,\n  NativeSubjectId,\n  NativeSessionId,\n> = SessionAuthorityTables<Subject, Credential, NativeSubjectId> &\n  StatefulSessionTables<Claims, Session, Flow, NativeSubjectId, NativeSessionId> &\n  SessionConstraintClassifier &\n  (\n    | {\n        /** Omit when this session module does not support pending MFA completion. */\n        readonly pending?: undefined;\n        readonly constraints: RequiredSessionConstraints;\n      }\n    | {\n        readonly pending: PendingAuthenticationTables<\n          Claims,\n          Pending,\n          Flow,\n          NativeSubjectId\n        >[\"pending\"];\n        readonly constraints: RequiredStatefulPendingConstraints;\n      }\n  );\n\nexport type PendingAuthenticationMapping<\n  Claims,\n  Subject extends Table,\n  Credential extends Table,\n  Pending extends Table,\n  Flow extends Table,\n  NativeSubjectId,\n> = SessionAuthorityTables<Subject, Credential, NativeSubjectId> &\n  PendingAuthenticationTables<Claims, Pending, Flow, NativeSubjectId> &\n  SessionConstraintClassifier & {\n    readonly constraints: RequiredPendingAuthenticationConstraints;\n  };\n\nexport type SignedSessionValidityMapping<\n  Subject extends Table,\n  Tombstone extends Table,\n  NativeSubjectId,\n  NativeSessionId,\n> = SessionSubjectTables<Subject, NativeSubjectId> &\n  SignedSessionValidityTables<Tombstone, NativeSubjectId, NativeSessionId> &\n  SessionConstraintClassifier & {\n    readonly constraints: RequiredSignedValidityConstraints;\n  };\n\n/** D1 evaluates these expressions inside the atomic batch, after queueing delay.\n * `engineNow` must use the exact native representation of every mapped instant\n * column. `engineNowMillis` is Unix epoch milliseconds for proof freshness.\n * Changes to the consumer's factor policy MUST bump subject.securityRevision.\n * Supply the authoritative primary D1 database, never a replica-affined\n * `withSession` handle, because verification and security revision reads must\n * observe completed revocation writes across clients.\n */\nexport interface D1SessionClockMapping {\n  readonly d1: {\n    readonly engineNow: SQL;\n    readonly engineNowMillis: SQL;\n    readonly activeSubjectStatusValue: unknown;\n    /** Required when `credential.status` is mapped. */\n    readonly activeCredentialStatusValue?: unknown;\n  };\n}\n\nexport type D1AuthenticationAuthorityMapping<\n  Claims,\n  Subject extends Table,\n  Credential extends Table,\n  Flow extends Table,\n  Pending extends Table,\n  NativeSubjectId,\n> = AuthenticationAuthorityMapping<Claims, Subject, Credential, Flow, Pending, NativeSubjectId> &\n  D1SessionClockMapping;\n\nexport type D1PendingAuthenticationMapping<\n  Claims,\n  Subject extends Table,\n  Credential extends Table,\n  Pending extends Table,\n  Flow extends Table,\n  NativeSubjectId,\n> = PendingAuthenticationMapping<Claims, Subject, Credential, Pending, Flow, NativeSubjectId> &\n  D1SessionClockMapping;\n\nexport type D1StatefulSessionMapping<\n  Claims,\n  Subject extends Table,\n  Credential extends Table,\n  Session extends Table,\n  Flow extends Table,\n  Pending extends Table,\n  NativeSubjectId,\n  NativeSessionId,\n> = StatefulSessionMapping<\n  Claims,\n  Subject,\n  Credential,\n  Session,\n  Flow,\n  Pending,\n  NativeSubjectId,\n  NativeSessionId\n> &\n  D1SessionClockMapping;\n\nexport type D1SignedSessionValidityMapping<\n  Subject extends Table,\n  Tombstone extends Table,\n  NativeSubjectId,\n  NativeSessionId,\n> = SignedSessionValidityMapping<Subject, Tombstone, NativeSubjectId, NativeSessionId> &\n  D1SessionClockMapping;\n"],"mappings":";AAwMA,MAAa,6BAAyD;CACpE,eAAe;CACf,QAAQ;AACV;AAEA,MAAa,2CAAqF;CAChG,eAAe;CACf,aAAa;CACb,QAAQ;AACV;AAEA,MAAa,qCAAyE;CACpF,GAAG;CACH,GAAG;AACL;AAEA,MAAa,oCAAuE,EAClF,gBAAgB,kDAClB"}