@yielded/auth 0.1.0-beta.1

package/dist/drizzle/session-sql.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-sql.mjs","names":[],"sources":["../../src/drizzle/session-sql.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- Drizzle intentionally erases consumer table types at this adapter boundary. */\nimport { and, eq, gt, lte, inArray, or, sql } from \"drizzle-orm\";\nimport type { EffectDrizzleQueryError } from \"drizzle-orm/effect-core\";\nimport { Cause, Context, DateTime, Effect, Option, Schema } from \"effect\";\nimport type * as SqlError from \"effect/unstable/sql/SqlError\";\n\nimport { coordinateCommit, CurrentCommitJournal, hasCommitScope } from \"../hooks/commit\";\nimport { LifecycleHooks } from \"../hooks/LifecycleHooks\";\nimport { reportPersistenceFailure } from \"../internal/diagnostics\";\nimport type { SubjectId, TokenDigest } from \"../Schema\";\nimport {\n  assessAuthentication,\n  snapshotSessionAuthenticationProvenance,\n} from \"../sessions/assurance\";\nimport type { AuthenticationAuthority } from \"../sessions/AuthenticationAuthority\";\nimport type { PrepareSessionCommit } from \"../sessions/commit\";\nimport {\n  PendingAuthenticationInvalid,\n  SessionConflict,\n  SessionInvalid,\n  SessionStepUpInvalid,\n  SessionUnavailable,\n  StaleAuthentication,\n} from \"../sessions/errors\";\nimport {\n  type AuthenticationEvidence,\n  type AuthenticationRevision,\n  type PendingConsumption,\n  type SecurityRevision,\n  type SessionInspection,\n  SessionMetadata,\n} from \"../sessions/models\";\nimport {\n  pendingAuthenticationContext,\n  snapshotPendingAuthenticationContext,\n  type PendingAuthentication,\n  type PendingAuthenticationRecord,\n  type PendingAuthenticationState,\n} from \"../sessions/PendingAuthentication\";\nimport type {\n  SessionRepository,\n  SignedSessionValidity,\n  StatefulSessionPersistence,\n  StatefulSessionRecord,\n} from \"../sessions/persistence\";\nimport {\n  type SessionStepUpIntent,\n  type SessionStepUpPersistence,\n} from \"../sessions/SessionStepUpPersistence\";\nimport { column, DrizzleMappingError, isMappedConstraintConflict, updateValues } from \"./model\";\nimport type {\n  AuthenticationAuthorityMapping,\n  PendingAuthenticationTables,\n  PendingAuthenticationMapping,\n  SessionAuthorityTables,\n  SessionFlowTables,\n  SessionSubjectTables,\n  SignedSessionValidityMapping,\n  StatefulSessionMapping,\n} from \"./session-model\";\nimport type { SessionStepUpMapping } from \"./step-up-model\";\nimport {\n  decodeStepUpIntent,\n  encodeStepUpIntent,\n  sameStepUpRevision,\n  stepUpIntentLive,\n  validateStepUpPlan,\n  stepUpRotationMatches,\n} from \"./step-up-state\";\n\ntype CommitMode = \"interactive\" | \"synchronous\";\ntype AnySubjectMapping = SessionSubjectTables<any, any>;\ntype AnyAuthorityMapping = SessionAuthorityTables<any, any, any>;\ntype AnyFlowMapping = SessionFlowTables<any, any>;\ntype AnyPendingMapping = AnyAuthorityMapping &\n  AnyFlowMapping &\n  PendingAuthenticationTables<any, any, any, any>;\ntype AnyStepUpMapping = SessionStepUpMapping<any, any, any, any, any, any, any, any>;\ninterface SessionSqlQuery<A = ReadonlyArray<any>> extends Effect.Effect<\n  A,\n  EffectDrizzleQueryError | SqlError.SqlError\n> {\n  readonly from: (...args: ReadonlyArray<any>) => SessionSqlQuery<A>;\n  readonly where: (...args: ReadonlyArray<any>) => SessionSqlQuery<A>;\n  readonly limit: (...args: ReadonlyArray<any>) => SessionSqlQuery<A>;\n  readonly orderBy: (...args: ReadonlyArray<any>) => SessionSqlQuery<A>;\n  readonly for: (...args: ReadonlyArray<any>) => SessionSqlQuery<A>;\n  readonly set: (...args: ReadonlyArray<any>) => SessionSqlQuery<A>;\n  readonly values: (...args: ReadonlyArray<any>) => SessionSqlQuery<A>;\n}\n\nexport interface SessionSqlDatabase {\n  readonly select: (...args: ReadonlyArray<any>) => SessionSqlQuery;\n  readonly insert: (...args: ReadonlyArray<any>) => SessionSqlQuery;\n  readonly update: (...args: ReadonlyArray<any>) => SessionSqlQuery;\n  readonly delete: (...args: ReadonlyArray<any>) => SessionSqlQuery;\n  readonly transaction: <A, E, R>(\n    body: (transaction: SessionSqlDatabase) => Effect.Effect<A, E, R>,\n  ) => Effect.Effect<A, E | SqlError.SqlError, R>;\n}\n\ntype Database = SessionSqlDatabase;\n\n/** Native SQL authority for the current transaction or savepoint. */\nexport class CurrentSessionSql extends Context.Service<CurrentSessionSql, SessionSqlDatabase>()(\n  \"effect-auth/drizzle/CurrentSessionSql\",\n) {}\n\ntype Guard = Effect.Effect<void, SessionUnavailable>;\n\nexport interface SessionSqlOptions {\n  readonly mode: CommitMode;\n  readonly locking: boolean;\n  /** Target-specific ambient transaction preflight. It runs before IDs or writes. */\n  readonly standaloneGuard: Guard;\n}\n\nconst unavailable = () => SessionUnavailable.make({});\nconst stale = () => StaleAuthentication.make({});\nconst invalidPending = () => PendingAuthenticationInvalid.make({});\nconst invalidSession = () => SessionInvalid.make({});\n\nconst mapFailureCause = <A, E, R, E2>(\n  effect: Effect.Effect<A, E, R>,\n  map: (error: E) => E2,\n): Effect.Effect<A, E2, R> =>\n  Effect.catchCause(effect, (cause) => Effect.failCause(Cause.map(cause, map)));\n\ntype SessionDomainError =\n  | SessionStepUpInvalid\n  | PendingAuthenticationInvalid\n  | SessionConflict\n  | SessionInvalid\n  | SessionUnavailable\n  | StaleAuthentication;\ntype AdapterFailure =\n  | EffectDrizzleQueryError\n  | DrizzleMappingError\n  | Schema.SchemaError\n  | SqlError.SqlError;\n\nconst isExpectedMutationError = (error: unknown): error is SessionDomainError => {\n  const tag = typeof error === \"object\" && error !== null ? Reflect.get(error, \"_tag\") : undefined;\n\n  return (\n    tag === \"SessionStepUpInvalid\" ||\n    tag === \"StaleAuthentication\" ||\n    tag === \"PendingAuthenticationInvalid\" ||\n    tag === \"SessionConflict\" ||\n    tag === \"SessionInvalid\" ||\n    tag === \"SessionUnavailable\"\n  );\n};\n\nconst normalizeMutation =\n  (mapping: any) =>\n  <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n    effect.pipe(\n      Effect.catchCause((cause) =>\n        Effect.failCause(\n          Cause.map(cause, (error) =>\n            isMappedConstraintConflict(mapping.isConstraintConflict, error)\n              ? SessionConflict.make({})\n              : error,\n          ),\n        ),\n      ),\n    );\n\ntype NormalizedSessionFailure<E> = E extends SessionDomainError ? E : SessionUnavailable;\n\nconst safeTransaction = <A, E, R>(\n  effect: Effect.Effect<A, E, R>,\n): Effect.Effect<A, NormalizedSessionFailure<E> | SessionUnavailable, R> =>\n  reportPersistenceFailure(effect, isExpectedMutationError).pipe(\n    Effect.catchCause((cause) =>\n      Effect.failCause(\n        Cause.map(\n          cause,\n          (error): NormalizedSessionFailure<E> =>\n            (isExpectedMutationError(error) ? error : unavailable()) as NormalizedSessionFailure<E>,\n        ),\n      ),\n    ),\n  );\n\nconst selectRows = (\n  query: SessionSqlQuery,\n  locking: boolean,\n): Effect.Effect<ReadonlyArray<any>, AdapterFailure> =>\n  locking && typeof query.for === \"function\" ? query.for(\"update\") : query;\n\nconst inTransaction = <A, E, R>(\n  database: Database,\n  effect: Effect.Effect<A, E, R | CurrentSessionSql>,\n): Effect.Effect<A, E | SqlError.SqlError, Exclude<R, CurrentSessionSql>> =>\n  Effect.suspend(() =>\n    database.transaction((current) =>\n      effect.pipe(Effect.provideService(CurrentSessionSql, current)),\n    ),\n  );\n\nconst owned = <A, E, R>(\n  database: Database,\n  options: SessionSqlOptions,\n  isConstraintConflict: (cause: unknown) => boolean,\n  body: Effect.Effect<A, E, R | CurrentSessionSql | CurrentCommitJournal>,\n): Effect.Effect<\n  A,\n  NormalizedSessionFailure<E> | SessionUnavailable,\n  Exclude<Exclude<R, CurrentSessionSql>, CurrentCommitJournal> | LifecycleHooks\n> => {\n  const run = coordinateCommit(\n    () =>\n      database.transaction((current) =>\n        body.pipe(Effect.provideService(CurrentSessionSql, current)),\n      ),\n    { mode: options.mode },\n  ).pipe(\n    (effect) =>\n      reportPersistenceFailure(\n        effect,\n        (error) =>\n          isExpectedMutationError(error) || isMappedConstraintConflict(isConstraintConflict, error),\n      ),\n    Effect.map((result) => result.value),\n    Effect.catchCause((cause) =>\n      Effect.failCause(\n        Cause.map(cause, (error): NormalizedSessionFailure<E> | SessionUnavailable =>\n          isExpectedMutationError(error) ? (error as NormalizedSessionFailure<E>) : unavailable(),\n        ),\n      ),\n    ),\n  );\n\n  return Effect.gen(function* () {\n    const current = yield* Effect.serviceOption(CurrentSessionSql);\n    const transactionBound = Option.isSome(current) && current.value === database;\n\n    if (!transactionBound) {\n      // A root service must never commit one database underneath another owner.\n      if (yield* hasCommitScope) return yield* unavailable();\n      yield* options.standaloneGuard;\n    }\n\n    // A tx-bound service still owns a savepoint and child journal. If the caller\n    // catches its failure, both partial writes and prepared values are discarded.\n    return yield* run;\n  });\n};\n\nconst uniqueStrings = (values: ReadonlyArray<string>): ReadonlyArray<string> =>\n  [...new Set(values)].sort();\n\nconst preservesRevision = (\n  completed: AuthenticationEvidence,\n  original: AuthenticationEvidence,\n): boolean => {\n  const current = new Map(\n    completed.revision.credentials.map((item) => [item.credentialId, item.revision]),\n  );\n\n  return (\n    completed.flowId === original.flowId &&\n    completed.bindingDigest === original.bindingDigest &&\n    completed.revision.subjectId === original.revision.subjectId &&\n    completed.revision.securityRevision === original.revision.securityRevision &&\n    original.revision.credentials.every(\n      (item) => current.get(item.credentialId) === item.revision,\n    ) &&\n    original.proofs.every((expected) =>\n      completed.proofs.some(\n        (proof) =>\n          proof.method === expected.method &&\n          proof.credentialId === expected.credentialId &&\n          proof.userVerified === expected.userVerified &&\n          proof.phishingResistant === expected.phishingResistant &&\n          DateTime.toEpochMillis(proof.verifiedAt) ===\n            DateTime.toEpochMillis(expected.verifiedAt) &&\n          proof.factors.length === expected.factors.length &&\n          proof.factors.every((factor, index) => factor === expected.factors[index]),\n      ),\n    )\n  );\n};\n\nconst authorityColumns = (mapping: any) => ({\n  subjectId: column(mapping.subject.table, mapping.subject.id),\n  subjectStatus: column(mapping.subject.table, mapping.subject.status),\n  subjectRevision: column(mapping.subject.table, mapping.subject.securityRevision),\n  credentialSubjectId: column(mapping.credential.table, mapping.credential.subjectId),\n  credentialId: column(mapping.credential.table, mapping.credential.credentialId),\n  credentialRevision: column(mapping.credential.table, mapping.credential.revision),\n  ...(mapping.credential.status === undefined\n    ? {}\n    : { credentialStatus: column(mapping.credential.table, mapping.credential.status) }),\n});\n\nconst subjectColumns = (mapping: any) => ({\n  subjectId: column(mapping.subject.table, mapping.subject.id),\n  subjectStatus: column(mapping.subject.table, mapping.subject.status),\n  subjectRevision: column(mapping.subject.table, mapping.subject.securityRevision),\n});\n\nconst readSubject = Effect.fn(\"DrizzleSession.readSubject\")(function* (\n  mapping: AnySubjectMapping,\n  nativeSubjectId: unknown,\n  locking: boolean,\n) {\n  const database = yield* CurrentSessionSql;\n  const columns = subjectColumns(mapping);\n\n  return yield* selectRows(\n    database\n      .select()\n      .from(mapping.subject.table)\n      .where(eq(columns.subjectId, nativeSubjectId))\n      .limit(1),\n    locking,\n  );\n});\n\nconst captureDetailsIn = Effect.fn(\"DrizzleSession.captureDetails\")(function* (\n  mapping: AnyAuthorityMapping,\n  subjectId: SubjectId,\n  credentialIds: ReadonlyArray<string>,\n  locking: boolean,\n) {\n  const database = yield* CurrentSessionSql;\n  const requested = uniqueStrings(credentialIds);\n\n  if (requested.length !== credentialIds.length) return yield* stale();\n  const nativeSubjectId = yield* mapping.subjectId.toNative(subjectId);\n  const subjectRows = yield* readSubject(mapping, nativeSubjectId, locking);\n  const subject = subjectRows[0];\n  const columns = authorityColumns(mapping);\n\n  if (subject === undefined || !mapping.subject.isActiveStatus(subject[mapping.subject.status]))\n    return yield* stale();\n\n  const query = database\n    .select()\n    .from(mapping.credential.table)\n    .where(\n      and(\n        eq(columns.credentialSubjectId, nativeSubjectId),\n        requested.length === 0 ? sql<boolean>`false` : inArray(columns.credentialId, requested),\n      ),\n    )\n    .orderBy(columns.credentialId);\n\n  const credentialRows = requested.length === 0 ? [] : yield* selectRows(query, locking);\n\n  if (credentialRows.length !== requested.length) return yield* stale();\n\n  const credentials = credentialRows\n    .map((row: any) => ({\n      credentialId: row[mapping.credential.credentialId] as string,\n      revision: row[mapping.credential.revision] as SecurityRevision,\n      active:\n        mapping.credential.status === undefined ||\n        mapping.credential.isActiveStatus?.(row[mapping.credential.status]) === true,\n    }))\n    .sort((left: any, right: any) => left.credentialId.localeCompare(right.credentialId));\n\n  if (credentials.some((item: any) => !item.active)) return yield* stale();\n\n  return {\n    subject,\n    revision: {\n      subjectId,\n      securityRevision: subject[mapping.subject.securityRevision] as SecurityRevision,\n      credentials: credentials.map(({ credentialId, revision }: any) => ({\n        credentialId,\n        revision,\n      })),\n    } satisfies AuthenticationRevision,\n  };\n});\n\nconst captureIn = Effect.fn(\"DrizzleSession.capture\")(function* (\n  mapping: AnyAuthorityMapping,\n  subjectId: SubjectId,\n  credentialIds: ReadonlyArray<string>,\n  locking: boolean,\n) {\n  return (yield* captureDetailsIn(mapping, subjectId, credentialIds, locking)).revision;\n});\n\nconst validateEvidenceIn = Effect.fn(\"DrizzleSession.validateEvidence\")(function* (\n  mapping: AnyAuthorityMapping,\n  evidence: AuthenticationEvidence,\n  locking: boolean,\n) {\n  const captured = yield* captureDetailsIn(\n    mapping,\n    evidence.revision.subjectId,\n    evidence.revision.credentials.map((item) => item.credentialId),\n    locking,\n  );\n\n  if (\n    captured.revision.securityRevision !== evidence.revision.securityRevision ||\n    captured.revision.credentials.length !== evidence.revision.credentials.length ||\n    captured.revision.credentials.some(\n      (item: { credentialId: string; revision: SecurityRevision }, index: number) => {\n        const expected = [...evidence.revision.credentials].sort((a, b) =>\n          a.credentialId.localeCompare(b.credentialId),\n        )[index];\n\n        return (\n          expected === undefined ||\n          expected.credentialId !== item.credentialId ||\n          expected.revision !== item.revision\n        );\n      },\n    )\n  )\n    return yield* stale();\n  const nativeSubjectId = yield* mapping.subjectId.toNative(evidence.revision.subjectId);\n  const requirement = yield* mapping.subject.decodeRequirement(captured.subject);\n\n  return { nativeSubjectId, requirement };\n});\n\nconst flowColumns = (mapping: any) => ({\n  flowId: column(mapping.flow.table, mapping.flow.flowId),\n  subjectId: column(mapping.flow.table, mapping.flow.subjectId),\n  state: column(mapping.flow.table, mapping.flow.state),\n  pendingDigest: column(mapping.flow.table, mapping.flow.pendingDigest),\n  dedupUntil: column(mapping.flow.table, mapping.flow.dedupUntil),\n});\n\nconst readFlow = Effect.fn(\"DrizzleSession.readFlow\")(function* (\n  mapping: AnyFlowMapping,\n  flowId: string,\n  locking: boolean,\n) {\n  const database = yield* CurrentSessionSql;\n  const columns = flowColumns(mapping);\n\n  return yield* selectRows(\n    database.select().from(mapping.flow.table).where(eq(columns.flowId, flowId)).limit(1),\n    locking,\n  );\n});\n\nconst ensureDirectFlowAvailable = Effect.fn(\"DrizzleSession.ensureFlowAvailable\")(function* (\n  mapping: AnyAuthorityMapping &\n    AnyFlowMapping & {\n      readonly pending?: PendingAuthenticationTables<any, any, any, any>[\"pending\"];\n    },\n  evidence: AuthenticationEvidence,\n  nativeSubjectId: unknown,\n  dedupUntil: DateTime.Utc,\n) {\n  const database = yield* CurrentSessionSql;\n  const rows = yield* readFlow(mapping, evidence.flowId, true);\n  const existing = rows[0];\n\n  if (existing !== undefined) {\n    const now = yield* freshNow;\n\n    if (\n      DateTime.toEpochMillis(now) <\n      DateTime.toEpochMillis(yield* mapping.flow.decodeInstant(existing[mapping.flow.dedupUntil]))\n    )\n      return yield* SessionConflict.make({});\n    if (mapping.pending !== undefined)\n      yield* database\n        .delete(mapping.pending.table)\n        .where(eq(column(mapping.pending.table, mapping.pending.flowId), evidence.flowId));\n    yield* database\n      .delete(mapping.flow.table)\n      .where(eq(flowColumns(mapping).flowId, evidence.flowId));\n  }\n\n  return mapping.flow.encodeEstablishedInsert({ evidence, subjectId: nativeSubjectId, dedupUntil });\n});\n\nconst pendingColumns = (mapping: any) => ({\n  digest: column(mapping.pending.table, mapping.pending.digest),\n  version: column(mapping.pending.table, mapping.pending.version),\n  flowId: column(mapping.pending.table, mapping.pending.flowId),\n  subjectId: column(mapping.pending.table, mapping.pending.subjectId),\n  bindingDigest: column(mapping.pending.table, mapping.pending.bindingDigest),\n  expiresAt: column(mapping.pending.table, mapping.pending.expiresAt),\n  attemptLimit: column(mapping.pending.table, mapping.pending.attemptLimit),\n  failedAttempts: column(mapping.pending.table, mapping.pending.failedAttempts),\n  consumed: column(mapping.pending.table, mapping.pending.consumed),\n});\n\nconst readPending = Effect.fn(\"DrizzleSession.readPending\")(function* (\n  mapping: AnyPendingMapping,\n  digest: TokenDigest,\n  locking: boolean,\n) {\n  const database = yield* CurrentSessionSql;\n\n  return yield* selectRows(\n    database\n      .select()\n      .from(mapping.pending.table)\n      .where(eq(pendingColumns(mapping).digest, digest))\n      .limit(1),\n    locking,\n  );\n});\n\ntype PendingProjection = \"record\" | \"context\";\n\nconst validatePending = Effect.fn(\"DrizzleSession.validatePending\")(function* <\n  Record extends PendingAuthenticationState = PendingAuthenticationRecord<unknown>,\n>(mapping: AnyPendingMapping, input: PendingConsumption, projection: PendingProjection = \"record\") {\n  const rows = yield* readPending(mapping, input.digest, true);\n  const row = rows[0];\n\n  if (row === undefined) return yield* invalidPending();\n\n  const decode = (\n    projection === \"context\" ? mapping.pending.decodeContext : mapping.pending.decode\n  ) as (row: any) => Effect.Effect<Record, DrizzleMappingError>;\n\n  const record = yield* decode(row);\n  const failedAttempts = Number(row[mapping.pending.failedAttempts]);\n\n  if (\n    record.version !== input.version ||\n    record.evidence.flowId !== input.flowId ||\n    record.evidence.bindingDigest !== input.bindingDigest ||\n    row[mapping.pending.consumed] !== false ||\n    failedAttempts >= record.attemptLimit\n  )\n    return yield* invalidPending();\n  const flows = yield* readFlow(mapping, input.flowId, true);\n  const flow = flows[0];\n\n  if (\n    flow === undefined ||\n    flow[mapping.flow.state] !== mapping.flow.pendingStateValue ||\n    flow[mapping.flow.pendingDigest] !== input.digest\n  )\n    return yield* invalidPending();\n  if (DateTime.toEpochMillis(yield* freshNow) >= DateTime.toEpochMillis(record.expiresAt))\n    return yield* invalidPending();\n\n  return record;\n});\n\nconst consumePending = Effect.fn(\"DrizzleSession.consumePending\")(function* (\n  mapping: AnyPendingMapping,\n  input: PendingConsumption,\n  until: DateTime.Utc,\n) {\n  const database = yield* CurrentSessionSql;\n\n  yield* Effect.all([\n    database\n      .update(mapping.pending.table)\n      .set(updateValues<any>([[mapping.pending.consumed, true]]))\n      .where(\n        and(\n          eq(pendingColumns(mapping).digest, input.digest),\n          eq(pendingColumns(mapping).version, input.version),\n          eq(pendingColumns(mapping).consumed, false),\n        ),\n      ),\n\n    database\n      .update(mapping.flow.table)\n      .set(\n        updateValues<any>([\n          [mapping.flow.state, mapping.flow.establishedStateValue],\n          [mapping.flow.pendingDigest, null],\n          [mapping.flow.dedupUntil, mapping.flow.encodeInstant(until)],\n        ]),\n      )\n      .where(eq(flowColumns(mapping).flowId, input.flowId)),\n  ]);\n});\n\nconst freshNow = DateTime.now;\n\nconst allocate = <A>(\n  mode: CommitMode,\n  asynchronous: Effect.Effect<A, DrizzleMappingError> | undefined,\n  synchronous: (() => A) | undefined,\n): Effect.Effect<A, DrizzleMappingError | SessionUnavailable> => {\n  if (mode === \"synchronous\")\n    return synchronous === undefined\n      ? Effect.fail(unavailable())\n      : Effect.try({\n          try: synchronous,\n          catch: (cause) => DrizzleMappingError.make({ operation: \"allocate\", cause }),\n        });\n  if (asynchronous !== undefined) return asynchronous;\n\n  return synchronous === undefined\n    ? Effect.fail(unavailable())\n    : Effect.try({\n        try: synchronous,\n        catch: (cause) => DrizzleMappingError.make({ operation: \"allocate\", cause }),\n      });\n};\n\nexport const makeSqlAuthenticationAuthority = <Claims>(\n  database: Database,\n  mapping: AuthenticationAuthorityMapping<Claims, any, any, any, any, any>,\n  options: SessionSqlOptions,\n) =>\n  Effect.map(LifecycleHooks, (hooks) => {\n    const service = {\n      capture: (subjectId: SubjectId, credentialIds: ReadonlyArray<string>) =>\n        safeTransaction(\n          inTransaction(database, captureIn(mapping, subjectId, credentialIds, true)),\n        ),\n      requirements: (evidence: AuthenticationEvidence) =>\n        safeTransaction(\n          inTransaction(\n            database,\n            validateEvidenceIn(mapping, evidence, true).pipe(\n              Effect.map((result) => result.requirement),\n            ),\n          ),\n        ),\n      approve: <A>(\n        input: Parameters<AuthenticationAuthority[\"Service\"][\"approve\"]>[0],\n        prepare: PrepareSessionCommit<void, A>,\n      ) =>\n        owned(\n          database,\n          options,\n          mapping.isConstraintConflict,\n          Effect.gen(function* () {\n            const journal = yield* CurrentCommitJournal;\n            const { requirement } = yield* validateEvidenceIn(mapping, input.evidence, true);\n\n            if (input.pending === undefined) {\n              const assessed = yield* assessAuthentication(input.evidence, requirement).pipe(\n                Effect.mapError(unavailable),\n              );\n\n              const now = yield* freshNow;\n\n              if (\n                !assessed.satisfied ||\n                DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(input.expiresAt) ||\n                DateTime.toEpochMillis(input.expiresAt) >\n                  DateTime.toEpochMillis(input.absoluteExpiresAt)\n              )\n                return yield* stale();\n\n              return prepare(undefined, journal);\n            }\n            if (mapping.pending === undefined) return yield* invalidPending();\n            const pendingMapping = { ...mapping, ...mapping.pending };\n            const pending = yield* validatePending(pendingMapping, input.pending);\n\n            if (!preservesRevision(input.evidence, pending.evidence))\n              return yield* invalidPending();\n\n            const assessed = yield* assessAuthentication(input.evidence, requirement).pipe(\n              Effect.mapError(unavailable),\n            );\n\n            const now = yield* freshNow;\n\n            if (\n              !assessed.satisfied ||\n              DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(pending.expiresAt) ||\n              DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(input.expiresAt) ||\n              DateTime.toEpochMillis(input.expiresAt) >\n                DateTime.toEpochMillis(input.absoluteExpiresAt)\n            )\n              return yield* stale();\n            const receipt = prepare(undefined, journal);\n\n            yield* consumePending(pendingMapping, input.pending, input.absoluteExpiresAt);\n\n            return receipt;\n          }),\n        ),\n    };\n\n    return {\n      capture: (subjectId, credentialIds) =>\n        service\n          .capture(subjectId, credentialIds)\n          .pipe(Effect.provideService(LifecycleHooks, hooks)),\n      requirements: (evidence) =>\n        service.requirements(evidence).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      approve: (input, prepare) =>\n        service.approve(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),\n    } satisfies AuthenticationAuthority[\"Service\"];\n  });\n\n/** The same locked security checks serve full consumption reads and the\n * claims-free additional-factor context. No lock spans proof verification. */\nconst readAuthenticatedPending = Effect.fn(\"DrizzleSession.readAuthenticatedPending\")(function* <\n  Record extends PendingAuthenticationState,\n>(\n  mapping: AnyPendingMapping,\n  input: { readonly digest: TokenDigest; readonly bindingDigest?: TokenDigest },\n  projection: PendingProjection,\n) {\n  const initial = (yield* readPending(mapping, input.digest, false))[0];\n\n  if (initial === undefined) return yield* invalidPending();\n  const initialNativeSubjectId = initial[mapping.pending.subjectId];\n  const subject = (yield* readSubject(mapping, initialNativeSubjectId, true))[0];\n\n  if (subject === undefined) return yield* invalidPending();\n  const current = (yield* readPending(mapping, input.digest, true))[0];\n\n  if (\n    current === undefined ||\n    !mapping.subjectId.equals(current[mapping.pending.subjectId], initialNativeSubjectId)\n  )\n    return yield* invalidPending();\n\n  const decode = (\n    projection === \"context\" ? mapping.pending.decodeContext : mapping.pending.decode\n  ) as (row: any) => Effect.Effect<Record, DrizzleMappingError>;\n\n  const record = yield* decode(current);\n  const nativeSubjectId = yield* mapping.subjectId.toNative(record.evidence.revision.subjectId);\n  const failedAttempts = Number(current[mapping.pending.failedAttempts]);\n\n  if (\n    !mapping.subjectId.equals(nativeSubjectId, initialNativeSubjectId) ||\n    (input.bindingDigest !== undefined && record.evidence.bindingDigest !== input.bindingDigest) ||\n    current[mapping.pending.version] !== record.version ||\n    current[mapping.pending.flowId] !== record.evidence.flowId ||\n    current[mapping.pending.bindingDigest] !== record.evidence.bindingDigest ||\n    current[mapping.pending.consumed] !== false ||\n    failedAttempts >= record.attemptLimit\n  )\n    return yield* invalidPending();\n  const flow = (yield* readFlow(mapping, record.evidence.flowId, true))[0];\n\n  if (\n    flow === undefined ||\n    flow[mapping.flow.state] !== mapping.flow.pendingStateValue ||\n    flow[mapping.flow.pendingDigest] !== input.digest\n  )\n    return yield* invalidPending();\n\n  const { requirement } = yield* mapFailureCause(\n    validateEvidenceIn(mapping, record.evidence, true),\n    (error) => (error._tag === \"StaleAuthentication\" ? invalidPending() : error),\n  );\n\n  yield* assessAuthentication(record.evidence, requirement).pipe(\n    Effect.mapError(() => invalidPending()),\n  );\n  if (DateTime.toEpochMillis(yield* freshNow) >= DateTime.toEpochMillis(record.expiresAt))\n    return yield* invalidPending();\n\n  return record;\n});\n\nexport const makeSqlPendingAuthentication = <Claims>(\n  database: Database,\n  mapping: PendingAuthenticationMapping<Claims, any, any, any, any, any>,\n  options: SessionSqlOptions,\n) =>\n  Effect.map(LifecycleHooks, (hooks) => {\n    const service = {\n      create: <A>(\n        input: Omit<PendingAuthenticationRecord<Claims>, \"version\">,\n        _inputNow: DateTime.Utc,\n        prepare: PrepareSessionCommit<PendingAuthenticationRecord<Claims>, A>,\n      ) =>\n        owned(\n          database,\n          options,\n          mapping.isConstraintConflict,\n          Effect.gen(function* () {\n            const transaction = yield* CurrentSessionSql;\n            const journal = yield* CurrentCommitJournal;\n\n            const { nativeSubjectId, requirement } = yield* validateEvidenceIn(\n              mapping,\n              input.evidence,\n              true,\n            );\n\n            const existing = (yield* readFlow(mapping, input.evidence.flowId, true))[0];\n\n            if (existing !== undefined) {\n              const dedupUntil = yield* mapping.flow.decodeInstant(\n                existing[mapping.flow.dedupUntil],\n              );\n\n              if (DateTime.toEpochMillis(yield* freshNow) < DateTime.toEpochMillis(dedupUntil))\n                return yield* SessionConflict.make({});\n              yield* transaction\n                .delete(mapping.pending.table)\n                .where(eq(pendingColumns(mapping).flowId, input.evidence.flowId));\n              yield* transaction\n                .delete(mapping.flow.table)\n                .where(eq(flowColumns(mapping).flowId, input.evidence.flowId));\n            }\n\n            const version = yield* allocate(\n              options.mode,\n              mapping.pending.allocateVersion,\n              mapping.pending.allocateVersionSync,\n            );\n\n            yield* assessAuthentication(input.evidence, requirement);\n            const now = yield* freshNow;\n\n            if (DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(input.expiresAt))\n              return yield* stale();\n            const record = { ...input, version };\n            const receipt = prepare(record, journal);\n\n            yield* transaction.insert(mapping.flow.table).values(\n              mapping.flow.encodePendingInsert({\n                evidence: input.evidence,\n                subjectId: nativeSubjectId,\n                pendingDigest: input.digest,\n                dedupUntil: input.expiresAt,\n              }),\n            );\n            yield* transaction.insert(mapping.pending.table).values(\n              mapping.pending.encodeInsert(record, {\n                subjectId: nativeSubjectId,\n                failedAttempts: 0,\n                consumed: false,\n              }),\n            );\n\n            return receipt;\n          }).pipe(normalizeMutation(mapping)),\n        ),\n      context: (input: { readonly digest: TokenDigest; readonly now: DateTime.Utc }) =>\n        safeTransaction(\n          inTransaction(\n            database,\n            readAuthenticatedPending<PendingAuthenticationState>(mapping, input, \"context\"),\n          ),\n        ).pipe(Effect.flatMap(pendingAuthenticationContext)),\n      read: (input: {\n        readonly digest: TokenDigest;\n        readonly bindingDigest: TokenDigest;\n        readonly now: DateTime.Utc;\n      }) =>\n        safeTransaction(\n          inTransaction(\n            database,\n            readAuthenticatedPending<PendingAuthenticationRecord<Claims>>(mapping, input, \"record\"),\n          ),\n        ).pipe(Effect.map((record) => record as PendingAuthenticationRecord<Claims>)),\n      reject: <A>(\n        input: Parameters<PendingAuthentication<Claims>[\"reject\"]>[0],\n        prepare: PrepareSessionCommit<{ readonly _tag: \"Rejected\" }, A>,\n      ) =>\n        owned(\n          database,\n          options,\n          mapping.isConstraintConflict,\n          Effect.gen(function* () {\n            const transaction = yield* CurrentSessionSql;\n            const journal = yield* CurrentCommitJournal;\n            const initial = (yield* readPending(mapping, input.digest, false))[0];\n\n            if (initial === undefined) return prepare({ _tag: \"Rejected\" }, journal);\n            const record = yield* mapping.pending.decodeContext(initial);\n\n            const nativeSubjectId = yield* mapping.subjectId.toNative(\n              record.evidence.revision.subjectId,\n            );\n\n            const subject = (yield* readSubject(mapping, nativeSubjectId, true))[0];\n            const current = (yield* readPending(mapping, input.digest, true))[0];\n            const now = yield* freshNow;\n            const receipt = prepare({ _tag: \"Rejected\" }, journal);\n\n            if (\n              subject !== undefined &&\n              mapping.subject.isActiveStatus(subject[mapping.subject.status]) &&\n              subject[mapping.subject.securityRevision] ===\n                record.evidence.revision.securityRevision &&\n              current !== undefined &&\n              current[mapping.pending.consumed] === false &&\n              record.evidence.bindingDigest === input.bindingDigest &&\n              DateTime.toEpochMillis(now) < DateTime.toEpochMillis(record.expiresAt)\n            ) {\n              yield* transaction\n                .update(mapping.pending.table)\n                .set(\n                  updateValues<any>([\n                    [\n                      mapping.pending.failedAttempts,\n                      sql`case when ${pendingColumns(mapping).failedAttempts} < ${pendingColumns(mapping).attemptLimit} then ${pendingColumns(mapping).failedAttempts} + 1 else ${pendingColumns(mapping).failedAttempts} end`,\n                    ],\n                  ]),\n                )\n                .where(eq(pendingColumns(mapping).digest, input.digest));\n            }\n\n            return receipt;\n          }),\n        ),\n    };\n\n    return {\n      create: (input, now, prepare) =>\n        service.create(input, now, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      context: (input) => service.context(input).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      read: (input) => service.read(input).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      reject: (input, prepare) =>\n        service.reject(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),\n    } satisfies PendingAuthentication<Claims>;\n  });\n\nconst sessionColumns = (mapping: any) => ({\n  sessionId: column(mapping.session.table, mapping.session.sessionId),\n  subjectId: column(mapping.session.table, mapping.session.subjectId),\n  digest: column(mapping.session.table, mapping.session.digest),\n  version: column(mapping.session.table, mapping.session.version),\n  securityRevision: column(mapping.session.table, mapping.session.securityRevision),\n  issuedAt: column(mapping.session.table, mapping.session.issuedAt),\n  expiresAt: column(mapping.session.table, mapping.session.expiresAt),\n  absoluteExpiresAt: column(mapping.session.table, mapping.session.absoluteExpiresAt),\n});\n\nexport const makeSqlStatefulSessions = <Claims>(\n  database: Database,\n  mapping: StatefulSessionMapping<Claims, any, any, any, any, any, any, any>,\n  options: SessionSqlOptions,\n) =>\n  Effect.map(LifecycleHooks, (hooks) => {\n    const c = sessionColumns(mapping);\n\n    const persistence = {\n      establish: <A>(\n        input: Parameters<StatefulSessionPersistence<Claims>[\"establish\"]>[0],\n        prepare: PrepareSessionCommit<StatefulSessionRecord<Claims>, A>,\n      ) =>\n        owned(\n          database,\n          options,\n          mapping.isConstraintConflict,\n          Effect.gen(function* () {\n            const transaction = yield* CurrentSessionSql;\n            const journal = yield* CurrentCommitJournal;\n\n            const { nativeSubjectId, requirement } = yield* validateEvidenceIn(\n              mapping,\n              input.evidence,\n              true,\n            );\n\n            let flowInsert: unknown | undefined;\n            let pendingExpiresAt: DateTime.Utc | undefined;\n\n            if (input.pending === undefined)\n              flowInsert = yield* ensureDirectFlowAvailable(\n                mapping,\n                input.evidence,\n                nativeSubjectId,\n                input.session.absoluteExpiresAt,\n              );\n            else {\n              if (mapping.pending === undefined) return yield* invalidPending();\n              const pending = yield* validatePending(mapping, input.pending);\n\n              if (!preservesRevision(input.evidence, pending.evidence))\n                return yield* invalidPending();\n              pendingExpiresAt = pending.expiresAt;\n            }\n\n            const nativeSessionId = yield* allocate(\n              options.mode,\n              mapping.session.allocateId,\n              mapping.session.allocateIdSync,\n            );\n\n            const sessionId = yield* mapping.sessionId.toSession(nativeSessionId);\n\n            const version = yield* allocate(\n              options.mode,\n              mapping.session.allocateVersion,\n              mapping.session.allocateVersionSync,\n            );\n\n            const assessed = yield* assessAuthentication(input.evidence, requirement);\n            const now = yield* freshNow;\n\n            if (\n              !assessed.satisfied ||\n              (pendingExpiresAt !== undefined &&\n                DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(pendingExpiresAt)) ||\n              DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(input.session.expiresAt) ||\n              DateTime.toEpochMillis(input.session.expiresAt) >\n                DateTime.toEpochMillis(input.session.absoluteExpiresAt)\n            )\n              return yield* stale();\n\n            const record = {\n              ...input.session,\n              sessionId,\n              version,\n              subjectId: input.evidence.revision.subjectId,\n              securityRevision: input.evidence.revision.securityRevision,\n              assurance: assessed.assurance,\n              provenance: yield* snapshotSessionAuthenticationProvenance({\n                evidence: input.evidence,\n              }),\n              issuedAt: now,\n            };\n\n            const receipt = prepare(record, journal);\n\n            if (flowInsert !== undefined)\n              yield* transaction.insert(mapping.flow.table).values(flowInsert);\n            else\n              yield* consumePending(\n                { ...mapping, pending: mapping.pending! },\n                input.pending!,\n                input.session.absoluteExpiresAt,\n              );\n            yield* transaction.insert(mapping.session.table).values(\n              mapping.session.encodeInsert(record, {\n                subjectId: nativeSubjectId,\n                sessionId: nativeSessionId,\n              }),\n            );\n\n            return receipt;\n          }).pipe(normalizeMutation(mapping)),\n        ),\n      verify: (input: any) =>\n        safeTransaction(\n          inTransaction(\n            database,\n            Effect.gen(function* () {\n              const read = yield* CurrentSessionSql;\n\n              const rows = yield* read\n                .select()\n                .from(mapping.session.table)\n                .where(eq(c.digest, input.digest))\n                .limit(1);\n\n              const row = rows[0];\n\n              if (row === undefined) return yield* invalidSession();\n              const record = yield* mapping.session.decode(row);\n              const nativeSubjectId = yield* mapping.subjectId.toNative(record.subjectId);\n              const subjects = yield* readSubject(mapping, nativeSubjectId, false);\n              const subject = subjects[0];\n              const now = yield* freshNow;\n\n              if (\n                subject === undefined ||\n                !mapping.subject.isActiveStatus(subject[mapping.subject.status]) ||\n                subject[mapping.subject.securityRevision] !== record.securityRevision ||\n                DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(record.expiresAt) ||\n                DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(record.absoluteExpiresAt)\n              )\n                return yield* invalidSession();\n\n              return record;\n            }),\n          ),\n        ),\n      rotate: <A>(\n        input: Parameters<StatefulSessionPersistence<Claims>[\"rotate\"]>[0],\n        prepare: PrepareSessionCommit<StatefulSessionRecord<Claims>, A>,\n      ) =>\n        owned(\n          database,\n          options,\n          mapping.isConstraintConflict,\n          Effect.gen(function* () {\n            const transaction = yield* CurrentSessionSql;\n            const journal = yield* CurrentCommitJournal;\n            const nativeSessionId = yield* mapping.sessionId.toNative(input.sessionId);\n\n            const initial = (yield* transaction\n              .select()\n              .from(mapping.session.table)\n              .where(eq(c.sessionId, nativeSessionId))\n              .limit(1))[0];\n\n            if (initial === undefined) return yield* SessionConflict.make({});\n            const initialRecord = yield* mapping.session.decode(initial);\n            const nativeSubjectId = yield* mapping.subjectId.toNative(initialRecord.subjectId);\n            const subject = (yield* readSubject(mapping, nativeSubjectId, true))[0];\n\n            const row = (yield* selectRows(\n              transaction\n                .select()\n                .from(mapping.session.table)\n                .where(eq(c.sessionId, nativeSessionId))\n                .limit(1),\n              options.locking,\n            ))[0];\n\n            if (row === undefined) return yield* SessionConflict.make({});\n            const record = yield* mapping.session.decode(row);\n\n            const version = yield* allocate(\n              options.mode,\n              mapping.session.allocateVersion,\n              mapping.session.allocateVersionSync,\n            );\n\n            const now = yield* freshNow;\n\n            if (\n              subject === undefined ||\n              !mapping.subject.isActiveStatus(subject[mapping.subject.status]) ||\n              subject[mapping.subject.securityRevision] !== input.expectedSecurityRevision ||\n              record.securityRevision !== input.expectedSecurityRevision ||\n              record.digest !== input.expectedDigest ||\n              record.version !== input.expectedVersion ||\n              DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(record.expiresAt) ||\n              DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(record.absoluteExpiresAt) ||\n              DateTime.toEpochMillis(input.nextExpiresAt) >\n                DateTime.toEpochMillis(record.absoluteExpiresAt) ||\n              DateTime.toEpochMillis(input.nextExpiresAt) <= DateTime.toEpochMillis(now)\n            )\n              return yield* SessionConflict.make({});\n\n            const next = {\n              ...record,\n              digest: input.nextDigest,\n              credentialVersion: input.nextCredentialVersion,\n              version,\n              issuedAt: now,\n              expiresAt: input.nextExpiresAt,\n            };\n\n            const receipt = prepare(next, journal);\n\n            yield* transaction\n              .update(mapping.session.table)\n              .set(mapping.session.encodeRotation(next))\n              .where(\n                and(\n                  eq(c.sessionId, nativeSessionId),\n                  eq(c.digest, input.expectedDigest),\n                  eq(c.version, input.expectedVersion),\n                ),\n              );\n\n            return receipt;\n          }),\n        ),\n      revokeDigest: <A>(digest: TokenDigest, prepare: PrepareSessionCommit<boolean, A>) =>\n        owned(\n          database,\n          options,\n          mapping.isConstraintConflict,\n          Effect.gen(function* () {\n            const transaction = yield* CurrentSessionSql;\n            const journal = yield* CurrentCommitJournal;\n\n            const initial = (yield* transaction\n              .select()\n              .from(mapping.session.table)\n              .where(eq(c.digest, digest))\n              .limit(1))[0];\n\n            if (initial === undefined) return prepare(false, journal);\n            const record = yield* mapping.session.decode(initial);\n            const nativeSubjectId = yield* mapping.subjectId.toNative(record.subjectId);\n\n            yield* readSubject(mapping, nativeSubjectId, true);\n\n            const row = (yield* selectRows(\n              transaction.select().from(mapping.session.table).where(eq(c.digest, digest)).limit(1),\n              options.locking,\n            ))[0];\n\n            const receipt = prepare(row !== undefined, journal);\n\n            if (row !== undefined)\n              yield* transaction.delete(mapping.session.table).where(eq(c.digest, digest));\n\n            return receipt;\n          }),\n        ),\n      revoke: <A>(\n        input: Parameters<StatefulSessionPersistence<Claims>[\"revoke\"]>[0],\n        prepare: PrepareSessionCommit<void, A>,\n      ) =>\n        owned(\n          database,\n          options,\n          mapping.isConstraintConflict,\n          Effect.gen(function* () {\n            const transaction = yield* CurrentSessionSql;\n            const journal = yield* CurrentCommitJournal;\n            const nativeSubjectId = yield* mapping.subjectId.toNative(input.subjectId);\n            const subject = (yield* readSubject(mapping, nativeSubjectId, true))[0];\n\n            if (\n              subject === undefined ||\n              !mapping.subject.isActiveStatus(subject[mapping.subject.status]) ||\n              subject[mapping.subject.securityRevision] !== input.expectedSecurityRevision\n            )\n              return yield* stale();\n            const nativeSessionId = yield* mapping.sessionId.toNative(input.sessionId);\n            const receipt = prepare(undefined, journal);\n\n            yield* transaction\n              .delete(mapping.session.table)\n              .where(and(eq(c.subjectId, nativeSubjectId), eq(c.sessionId, nativeSessionId)));\n\n            return receipt;\n          }),\n        ),\n      revokeAll: <A>(\n        input: Parameters<StatefulSessionPersistence<Claims>[\"revokeAll\"]>[0],\n        prepare: PrepareSessionCommit<void, A>,\n      ) =>\n        owned(\n          database,\n          options,\n          mapping.isConstraintConflict,\n          Effect.gen(function* () {\n            const transaction = yield* CurrentSessionSql;\n            const journal = yield* CurrentCommitJournal;\n            const nativeSubjectId = yield* mapping.subjectId.toNative(input.subjectId);\n            const subject = (yield* readSubject(mapping, nativeSubjectId, true))[0];\n\n            if (\n              subject === undefined ||\n              !mapping.subject.isActiveStatus(subject[mapping.subject.status]) ||\n              subject[mapping.subject.securityRevision] !== input.expectedSecurityRevision\n            )\n              return yield* stale();\n            const nextRevisionSync = mapping.subject.nextSecurityRevisionSync;\n\n            const next = yield* allocate(\n              options.mode,\n              mapping.subject.nextSecurityRevision?.(input.expectedSecurityRevision),\n              nextRevisionSync === undefined\n                ? undefined\n                : () => nextRevisionSync(input.expectedSecurityRevision),\n            );\n\n            const receipt = prepare(undefined, journal);\n\n            yield* transaction\n              .update(mapping.subject.table)\n              .set(updateValues<any>([[mapping.subject.securityRevision, next]]))\n              .where(\n                and(\n                  eq(authorityColumns(mapping).subjectId, nativeSubjectId),\n                  eq(authorityColumns(mapping).subjectRevision, input.expectedSecurityRevision),\n                ),\n              );\n            yield* transaction\n              .delete(mapping.session.table)\n              .where(eq(c.subjectId, nativeSubjectId));\n\n            return receipt;\n          }),\n        ),\n    };\n\n    const repository = {\n      list: (input: any) =>\n        safeTransaction(\n          inTransaction(\n            database,\n            Effect.gen(function* () {\n              const read = yield* CurrentSessionSql;\n              const nativeSubjectId = yield* mapping.subjectId.toNative(input.subjectId);\n              const subject = (yield* readSubject(mapping, nativeSubjectId, false))[0];\n\n              if (\n                subject === undefined ||\n                !mapping.subject.isActiveStatus(subject[mapping.subject.status])\n              )\n                return { sessions: [] };\n\n              const cursor =\n                input.cursor === undefined\n                  ? undefined\n                  : yield* mapping.sessionId.toNative(input.cursor as any);\n\n              const now = yield* freshNow;\n\n              const rows = yield* read\n                .select()\n                .from(mapping.session.table)\n                .where(\n                  and(\n                    eq(c.subjectId, nativeSubjectId),\n                    eq(c.securityRevision, subject[mapping.subject.securityRevision]),\n                    gt(c.expiresAt, mapping.session.encodeInstant(now)),\n                    gt(c.absoluteExpiresAt, mapping.session.encodeInstant(now)),\n                    cursor === undefined ? undefined : gt(c.sessionId, cursor),\n                  ),\n                )\n                .orderBy(c.sessionId)\n                .limit(input.limit + 1);\n\n              const decoded = yield* Effect.forEach(rows, (row: any) =>\n                mapping.session.decode(row),\n              );\n\n              const codec = Schema.toCodecJson(Schema.toType(SessionMetadata));\n\n              const sessions = yield* Effect.forEach(decoded.slice(0, input.limit), (record: any) =>\n                Schema.encodeEffect(codec)(record).pipe(Effect.flatMap(Schema.decodeEffect(codec))),\n              );\n\n              const extra = decoded[input.limit];\n\n              return {\n                sessions,\n                ...(extra === undefined ? {} : { nextCursor: sessions.at(-1)?.sessionId }),\n              };\n            }),\n          ),\n        ),\n    };\n\n    return {\n      statefulSessionPersistence: {\n        establish: (input, prepare) =>\n          persistence.establish(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),\n        verify: (input) =>\n          persistence.verify(input).pipe(Effect.provideService(LifecycleHooks, hooks)),\n        rotate: (input, prepare) =>\n          persistence.rotate(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),\n        revokeDigest: (digest, prepare) =>\n          persistence\n            .revokeDigest(digest, prepare)\n            .pipe(Effect.provideService(LifecycleHooks, hooks)),\n        revoke: (input, prepare) =>\n          persistence.revoke(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),\n        revokeAll: (input, prepare) =>\n          persistence.revokeAll(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      } satisfies StatefulSessionPersistence<Claims>,\n      sessionRepository: {\n        list: (input) => repository.list(input).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      } satisfies SessionRepository,\n    };\n  });\n\nexport const makeSqlSignedValidity = (\n  database: Database,\n  mapping: SignedSessionValidityMapping<any, any, any, any>,\n  options: SessionSqlOptions,\n) =>\n  Effect.map(LifecycleHooks, (hooks) => {\n    const subject = subjectColumns(mapping);\n\n    const tombstone = {\n      subjectId: column(mapping.tombstone.table, mapping.tombstone.subjectId),\n      sessionId: column(mapping.tombstone.table, mapping.tombstone.sessionId),\n      absoluteExpiresAt: column(mapping.tombstone.table, mapping.tombstone.absoluteExpiresAt),\n    };\n\n    const service = {\n      verify: (session: SessionMetadata, _now: DateTime.Utc) =>\n        safeTransaction(\n          inTransaction(\n            database,\n            Effect.gen(function* () {\n              const read = yield* CurrentSessionSql;\n              const nativeSubjectId = yield* mapping.subjectId.toNative(session.subjectId);\n              const nativeSessionId = yield* mapping.sessionId.toNative(session.sessionId);\n              const subjects = yield* readSubject(mapping, nativeSubjectId, false);\n              const row = subjects[0];\n\n              if (\n                row === undefined ||\n                !mapping.subject.isActiveStatus(row[mapping.subject.status]) ||\n                row[mapping.subject.securityRevision] !== session.securityRevision\n              )\n                return yield* invalidSession();\n              const authoritativeNow = yield* freshNow;\n\n              if (\n                DateTime.toEpochMillis(authoritativeNow) >=\n                  DateTime.toEpochMillis(session.expiresAt) ||\n                DateTime.toEpochMillis(authoritativeNow) >=\n                  DateTime.toEpochMillis(session.absoluteExpiresAt)\n              )\n                return yield* invalidSession();\n\n              const revoked = yield* read\n                .select({ sessionId: tombstone.sessionId })\n                .from(mapping.tombstone.table)\n                .where(\n                  and(\n                    eq(tombstone.subjectId, nativeSubjectId),\n                    eq(tombstone.sessionId, nativeSessionId),\n                    gt(\n                      tombstone.absoluteExpiresAt,\n                      mapping.tombstone.encodeInstant(authoritativeNow),\n                    ),\n                  ),\n                )\n                .limit(1);\n\n              if (revoked.length > 0) return yield* invalidSession();\n            }),\n          ),\n        ),\n      revoke: <A>(\n        input: Parameters<SignedSessionValidity[\"revoke\"]>[0],\n        prepare: PrepareSessionCommit<void, A>,\n      ) =>\n        owned(\n          database,\n          options,\n          mapping.isConstraintConflict,\n          Effect.gen(function* () {\n            const transaction = yield* CurrentSessionSql;\n            const journal = yield* CurrentCommitJournal;\n            const nativeSubjectId = yield* mapping.subjectId.toNative(input.subjectId);\n            const row = (yield* readSubject(mapping, nativeSubjectId, true))[0];\n\n            if (\n              row === undefined ||\n              !mapping.subject.isActiveStatus(row[mapping.subject.status]) ||\n              row[mapping.subject.securityRevision] !== input.expectedSecurityRevision\n            )\n              return yield* stale();\n            const nativeSessionId = yield* mapping.sessionId.toNative(input.sessionId);\n\n            const existing = yield* transaction\n              .select()\n              .from(mapping.tombstone.table)\n              .where(\n                and(\n                  eq(tombstone.subjectId, nativeSubjectId),\n                  eq(tombstone.sessionId, nativeSessionId),\n                ),\n              )\n              .limit(1);\n\n            const receipt = prepare(undefined, journal);\n\n            if (existing[0] === undefined)\n              yield* transaction.insert(mapping.tombstone.table).values(\n                mapping.tombstone.encodeInsert({\n                  subjectId: nativeSubjectId,\n                  sessionId: nativeSessionId,\n                  absoluteExpiresAt: input.absoluteExpiresAt,\n                }),\n              );\n            else {\n              const existingExpiry = yield* mapping.tombstone.decodeInstant(\n                existing[0][mapping.tombstone.absoluteExpiresAt],\n              );\n\n              if (\n                DateTime.toEpochMillis(input.absoluteExpiresAt) >\n                DateTime.toEpochMillis(existingExpiry)\n              )\n                yield* transaction\n                  .update(mapping.tombstone.table)\n                  .set(\n                    updateValues<any>([\n                      [\n                        mapping.tombstone.absoluteExpiresAt,\n                        mapping.tombstone.encodeInstant(input.absoluteExpiresAt),\n                      ],\n                    ]),\n                  )\n                  .where(\n                    and(\n                      eq(tombstone.subjectId, nativeSubjectId),\n                      eq(tombstone.sessionId, nativeSessionId),\n                    ),\n                  );\n            }\n\n            return receipt;\n          }),\n        ),\n      revokeAll: <A>(\n        input: Parameters<SignedSessionValidity[\"revokeAll\"]>[0],\n        prepare: PrepareSessionCommit<void, A>,\n      ) =>\n        owned(\n          database,\n          options,\n          mapping.isConstraintConflict,\n          Effect.gen(function* () {\n            const transaction = yield* CurrentSessionSql;\n            const journal = yield* CurrentCommitJournal;\n            const nativeSubjectId = yield* mapping.subjectId.toNative(input.subjectId);\n            const row = (yield* readSubject(mapping, nativeSubjectId, true))[0];\n\n            if (\n              row === undefined ||\n              !mapping.subject.isActiveStatus(row[mapping.subject.status]) ||\n              row[mapping.subject.securityRevision] !== input.expectedSecurityRevision\n            )\n              return yield* stale();\n            const nextRevisionSync = mapping.subject.nextSecurityRevisionSync;\n\n            const next = yield* allocate(\n              options.mode,\n              mapping.subject.nextSecurityRevision?.(input.expectedSecurityRevision),\n              nextRevisionSync === undefined\n                ? undefined\n                : () => nextRevisionSync(input.expectedSecurityRevision),\n            );\n\n            const receipt = prepare(undefined, journal);\n\n            yield* transaction\n              .update(mapping.subject.table)\n              .set(updateValues<any>([[mapping.subject.securityRevision, next]]))\n              .where(\n                and(\n                  eq(subject.subjectId, nativeSubjectId),\n                  eq(subject.subjectRevision, input.expectedSecurityRevision),\n                ),\n              );\n\n            return receipt;\n          }),\n        ),\n    };\n\n    return {\n      verify: (session, now) =>\n        service.verify(session, now).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      revoke: (input, prepare) =>\n        service.revoke(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      revokeAll: (input, prepare) =>\n        service.revokeAll(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),\n    } satisfies SignedSessionValidity;\n  });\n\nconst stepUpColumns = (mapping: any) =>\n  Object.fromEntries(\n    [\n      \"digest\",\n      \"version\",\n      \"flowId\",\n      \"subjectId\",\n      \"bindingDigest\",\n      \"snapshot\",\n      \"expiresAt\",\n      \"attemptLimit\",\n      \"failedAttempts\",\n      \"consumed\",\n    ].map((key) => [key, column(mapping.intent.table, mapping.intent[key])]),\n  );\n\nconst stepUpLocator = Effect.fn(\"DrizzleStepUp.locator\")(function* (\n  mapping: AnyStepUpMapping,\n  digest: TokenDigest,\n  locking: boolean,\n  expiresAt?: DateTime.Utc,\n) {\n  const database = yield* CurrentSessionSql;\n\n  return yield* selectRows(\n    database\n      .select()\n      .from(mapping.intent.table)\n      .where(\n        and(\n          eq(stepUpColumns(mapping).digest, digest),\n          expiresAt === undefined\n            ? undefined\n            : eq(stepUpColumns(mapping).expiresAt, mapping.intent.encodeInstant(expiresAt)),\n        ),\n      )\n      .limit(1),\n    locking,\n  ).pipe(Effect.map((rows) => rows[0]));\n});\n\nconst stepUpAuthority = Effect.fn(\"DrizzleStepUp.authority\")(function* (\n  mapping: AnyStepUpMapping,\n  revision: AuthenticationRevision,\n  locking: boolean,\n) {\n  const current = yield* captureDetailsIn(\n    mapping,\n    revision.subjectId,\n    revision.credentials.map((c) => c.credentialId),\n    locking,\n  );\n\n  if (!sameStepUpRevision(current.revision, revision)) return yield* stale();\n  const requirement = yield* mapping.subject.decodeRequirement(current.subject);\n\n  return {\n    nativeSubjectId: yield* mapping.subjectId.toNative(revision.subjectId),\n    requirement,\n  };\n});\n\nconst stepUpSource = Effect.fn(\"DrizzleStepUp.source\")(function* (\n  mapping: AnyStepUpMapping,\n  intent: SessionStepUpIntent,\n  nativeSubjectId: unknown,\n  now: DateTime.Utc,\n  locking: boolean,\n) {\n  const database = yield* CurrentSessionSql;\n\n  if (!stepUpIntentLive(intent, mapping.source.kind, now))\n    return yield* SessionStepUpInvalid.make({});\n  const source = mapping.source;\n\n  if (source.kind === \"StatelessSigned\") return { nativeSessionId: undefined, row: undefined };\n  const nativeSessionId = yield* source.sessionId.toNative(intent.sourceSessionId);\n\n  if (source.kind === \"StateAssistedSigned\") {\n    const t = source.tombstone;\n\n    const found = yield* selectRows(\n      database\n        .select()\n        .from(t.table)\n        .where(\n          and(\n            eq(column(t.table, t.subjectId), nativeSubjectId),\n            eq(column(t.table, t.sessionId), nativeSessionId),\n            gt(column(t.table, t.absoluteExpiresAt), t.encodeInstant(now)),\n          ),\n        )\n        .limit(1),\n      locking,\n    );\n\n    if (found.length > 0) return yield* SessionStepUpInvalid.make({});\n\n    return { nativeSessionId, row: undefined };\n  }\n\n  const s = source.session,\n    c = sessionColumns(source);\n\n  const row = (yield* selectRows(\n    database\n      .select()\n      .from(s.table)\n      .where(\n        and(\n          eq(c.sessionId, nativeSessionId),\n          eq(c.subjectId, nativeSubjectId),\n          eq(c.securityRevision, intent.revision.securityRevision),\n          eq(column(s.table, s.credentialVersion), intent.sourceCredentialVersion),\n          eq(column(s.table, s.authenticatedAt), s.encodeInstant(intent.sourceAuthenticatedAt)),\n          eq(c.expiresAt, s.encodeInstant(intent.sourceExpiresAt)),\n          eq(c.absoluteExpiresAt, s.encodeInstant(intent.sourceAbsoluteExpiresAt)),\n          gt(c.expiresAt, s.encodeInstant(now)),\n          gt(c.absoluteExpiresAt, s.encodeInstant(now)),\n        ),\n      )\n      .limit(1),\n    locking,\n  ))[0];\n\n  if (row === undefined) return yield* SessionStepUpInvalid.make({});\n\n  return { nativeSessionId, row };\n});\n\nconst readSqlStepUp = Effect.fn(\"DrizzleStepUp.read\")(function* (\n  mapping: AnyStepUpMapping,\n  digest: TokenDigest,\n  locking: boolean,\n) {\n  const first = yield* stepUpLocator(mapping, digest, false);\n\n  if (first === undefined) return yield* SessionStepUpInvalid.make({});\n  const intent = yield* decodeStepUpIntent(first[mapping.intent.snapshot]);\n  const authority = yield* stepUpAuthority(mapping, intent.revision, locking);\n\n  const source = yield* stepUpSource(\n    mapping,\n    intent,\n    authority.nativeSubjectId,\n    yield* freshNow,\n    locking,\n  );\n\n  const row = yield* stepUpLocator(mapping, digest, locking, intent.expiresAt);\n  const m = mapping.intent;\n\n  if (\n    row === undefined ||\n    row[m.snapshot] !== first[m.snapshot] ||\n    row[m.version] !== intent.version ||\n    row[m.digest] !== intent.digest ||\n    digest !== intent.digest ||\n    row[m.flowId] !== intent.flowId ||\n    row[m.bindingDigest] !== intent.bindingDigest ||\n    !mapping.subjectId.equals(row[m.subjectId], authority.nativeSubjectId) ||\n    Boolean(row[m.consumed]) ||\n    !Schema.is(Schema.Natural)(row[m.failedAttempts]) ||\n    row[m.failedAttempts] >= row[m.attemptLimit] ||\n    row[m.attemptLimit] !== intent.attemptLimit ||\n    !stepUpIntentLive(intent, mapping.source.kind, yield* freshNow)\n  )\n    return yield* SessionStepUpInvalid.make({});\n\n  return { row, intent, source, ...authority };\n});\n\ntype SqlStepUpRejectAbsence = SessionStepUpInvalid | StaleAuthentication;\ntype SqlStepUpReadFailure = AdapterFailure | SqlStepUpRejectAbsence | SessionUnavailable;\n\nconst isSqlStepUpRejectAbsence = (error: unknown): error is SqlStepUpRejectAbsence => {\n  const tag = typeof error === \"object\" && error !== null ? Reflect.get(error, \"_tag\") : undefined;\n\n  return tag === \"SessionStepUpInvalid\" || tag === \"StaleAuthentication\";\n};\n\nconst recoverSqlStepUpRejectAbsence = <A, B, R>(\n  effect: Effect.Effect<A, SqlStepUpReadFailure, R>,\n  rejected: B,\n): Effect.Effect<A | B, AdapterFailure | SessionUnavailable, R> =>\n  effect.pipe(\n    Effect.catchCause((cause) => {\n      if (\n        cause.reasons.length > 0 &&\n        cause.reasons.every(\n          (reason) => Cause.isFailReason(reason) && isSqlStepUpRejectAbsence(reason.error),\n        )\n      )\n        return Effect.succeed(rejected);\n\n      return Effect.failCause(\n        Cause.map(cause, (error) => (isSqlStepUpRejectAbsence(error) ? unavailable() : error)),\n      );\n    }),\n  );\n\n/** Shared implementation; public driver entrypoints restore concrete tables/IDs. */\nexport const makeSqlSessionStepUp = <Claims>(\n  database: Database,\n  mapping: SessionStepUpMapping<Claims, any, any, any, any, any, any, any>,\n  options: SessionSqlOptions,\n) =>\n  Effect.map(LifecycleHooks, (hooks) => {\n    const m = mapping.intent,\n      c = stepUpColumns(mapping);\n\n    const read = (digest: TokenDigest) =>\n      mapFailureCause(\n        safeTransaction(inTransaction(database, readSqlStepUp(mapping, digest, options.locking))),\n        (error) => (error._tag === \"StaleAuthentication\" ? SessionStepUpInvalid.make({}) : error),\n      );\n\n    const service = {\n      create: <A>(\n        input: Omit<SessionStepUpIntent, \"version\">,\n        _now: DateTime.Utc,\n        prepare: PrepareSessionCommit<SessionStepUpIntent, A>,\n      ) =>\n        owned(\n          database,\n          options,\n          mapping.isConstraintConflict,\n          Effect.gen(function* () {\n            const tx = yield* CurrentSessionSql;\n            const journal = yield* CurrentCommitJournal;\n            const authority = yield* stepUpAuthority(mapping, input.revision, options.locking);\n            const version = yield* allocate(options.mode, m.allocateVersion, m.allocateVersionSync);\n            const record: SessionStepUpIntent = { ...input, version };\n\n            yield* stepUpSource(\n              mapping,\n              record,\n              authority.nativeSubjectId,\n              yield* freshNow,\n              options.locking,\n            );\n\n            const existing = yield* selectRows(\n              tx\n                .select()\n                .from(m.table)\n                .where(or(eq(c.digest, input.digest), eq(c.flowId, input.flowId)))\n                .limit(1),\n              options.locking,\n            );\n\n            if (existing.length > 0) return yield* SessionConflict.make({});\n            const snapshot = yield* encodeStepUpIntent(record);\n\n            const values = {\n              ...m.encodeInsert(record, { subjectId: authority.nativeSubjectId }),\n              ...updateValues<any>([\n                [m.digest, record.digest],\n                [m.version, version],\n                [m.flowId, record.flowId],\n                [m.subjectId, authority.nativeSubjectId],\n                [m.bindingDigest, record.bindingDigest],\n                [m.snapshot, snapshot],\n                [m.expiresAt, m.encodeInstant(record.expiresAt)],\n                [m.attemptLimit, record.attemptLimit],\n                [m.failedAttempts, 0],\n                [m.consumed, false],\n              ]),\n            };\n\n            const receipt = prepare(record, journal);\n\n            yield* tx.insert(m.table).values(values).pipe(normalizeMutation(mapping));\n\n            const inserted = (yield* tx\n              .select()\n              .from(m.table)\n              .where(\n                and(\n                  eq(c.digest, record.digest),\n                  eq(c.version, version),\n                  eq(c.flowId, record.flowId),\n                  eq(c.subjectId, authority.nativeSubjectId),\n                  eq(c.bindingDigest, record.bindingDigest),\n                  eq(c.snapshot, snapshot),\n                  eq(c.expiresAt, m.encodeInstant(record.expiresAt)),\n                  eq(c.attemptLimit, record.attemptLimit),\n                  eq(c.failedAttempts, 0),\n                  eq(c.consumed, false),\n                ),\n              )\n              .limit(1))[0];\n\n            if (inserted === undefined) return yield* unavailable();\n\n            return receipt;\n          }),\n        ).pipe((effect) =>\n          mapFailureCause(effect, (error) =>\n            error._tag === \"SessionStepUpInvalid\" ? stale() : error,\n          ),\n        ),\n      context: (input: any) =>\n        mapFailureCause(\n          read(input.digest).pipe(\n            Effect.flatMap(({ intent }) =>\n              snapshotPendingAuthenticationContext({\n                flowId: intent.flowId,\n                bindingDigest: intent.bindingDigest,\n                revision: intent.revision,\n                expiresAtMillis: DateTime.toEpochMillis(intent.expiresAt),\n              }),\n            ),\n          ),\n          (error) => (error._tag === \"PendingAuthenticationInvalid\" ? unavailable() : error),\n        ),\n      read: (input: any) =>\n        read(input.digest).pipe(\n          Effect.flatMap((value) =>\n            value.intent.bindingDigest === input.bindingDigest\n              ? Effect.succeed(value.intent)\n              : Effect.fail(SessionStepUpInvalid.make({})),\n          ),\n        ),\n      reject: <A>(\n        input: Parameters<SessionStepUpPersistence<Claims>[\"reject\"]>[0],\n        prepare: PrepareSessionCommit<{ readonly _tag: \"Rejected\" }, A>,\n      ) =>\n        owned(\n          database,\n          options,\n          mapping.isConstraintConflict,\n          Effect.gen(function* () {\n            const tx = yield* CurrentSessionSql;\n            const journal = yield* CurrentCommitJournal;\n\n            const selected = yield* recoverSqlStepUpRejectAbsence(\n              readSqlStepUp(mapping, input.digest, options.locking).pipe(\n                Effect.map((value) => ({ _tag: \"Found\" as const, value })),\n              ),\n              { _tag: \"Rejected\" as const },\n            );\n\n            if (selected._tag === \"Rejected\") return prepare({ _tag: \"Rejected\" }, journal);\n            const { row, intent } = selected.value;\n            const receipt = prepare({ _tag: \"Rejected\" }, journal);\n\n            yield* tx\n              .update(m.table)\n              .set(updateValues<any>([[m.failedAttempts, sql`${c.failedAttempts} + 1`]]))\n              .where(\n                and(\n                  eq(c.digest, input.digest),\n                  eq(c.snapshot, row[m.snapshot]),\n                  eq(c.version, intent.version),\n                  eq(c.consumed, false),\n                  sql`${c.failedAttempts} < ${c.attemptLimit}`,\n                ),\n              );\n            const written = yield* stepUpLocator(mapping, input.digest, false);\n\n            if (\n              written === undefined ||\n              written[m.version] !== intent.version ||\n              written[m.snapshot] !== row[m.snapshot] ||\n              written[m.failedAttempts] !== row[m.failedAttempts] + 1\n            )\n              return yield* unavailable();\n\n            return receipt;\n          }),\n        ),\n      complete: <A>(\n        plan: Parameters<SessionStepUpPersistence<Claims>[\"complete\"]>[0],\n        prepare: PrepareSessionCommit<SessionInspection<Claims>, A>,\n      ) =>\n        owned(\n          database,\n          options,\n          mapping.isConstraintConflict,\n          Effect.gen(function* () {\n            const tx = yield* CurrentSessionSql;\n            const journal = yield* CurrentCommitJournal;\n\n            yield* validateStepUpPlan(plan);\n\n            // Lock the entire combined vector before source/intent, including added factors.\n            const current = yield* stepUpAuthority(\n              mapping,\n              plan.evidence.revision,\n              options.locking,\n            );\n\n            const stored = yield* readSqlStepUp(mapping, plan.intent.digest, options.locking);\n\n            if (\n              (yield* encodeStepUpIntent(stored.intent)) !==\n              (yield* encodeStepUpIntent(plan.intent))\n            )\n              return yield* SessionStepUpInvalid.make({});\n\n            const base = yield* assessAuthentication(plan.evidence, current.requirement).pipe(\n              Effect.mapError(() => stale()),\n            );\n\n            const profile = yield* assessAuthentication(\n              plan.evidence,\n              stored.intent.requirement,\n            ).pipe(Effect.mapError(() => stale()));\n\n            if (!base.satisfied || !profile.satisfied) return yield* stale();\n\n            const replacement = plan.replacement,\n              now = yield* freshNow;\n\n            if (\n              DateTime.toEpochMillis(replacement.inspection.session.expiresAt) >\n                DateTime.toEpochMillis(stored.intent.sourceAbsoluteExpiresAt) ||\n              DateTime.toEpochMillis(now) <\n                DateTime.toEpochMillis(replacement.inspection.session.issuedAt) ||\n              DateTime.toEpochMillis(now) >=\n                Math.min(\n                  DateTime.toEpochMillis(replacement.inspection.session.expiresAt),\n                  DateTime.toEpochMillis(stored.intent.expiresAt),\n                )\n            )\n              return yield* SessionStepUpInvalid.make({});\n            let rotation: any;\n\n            if (replacement._tag === \"Stateful\") {\n              if (mapping.source.kind !== \"Stateful\") return yield* SessionStepUpInvalid.make({});\n\n              const s = mapping.source.session,\n                row = stored.source.row;\n\n              if (\n                row[s.digest] !== replacement.expectedDigest ||\n                row[s.version] !== replacement.expectedRowVersion\n              )\n                return yield* SessionConflict.make({});\n\n              const version = yield* allocate(\n                options.mode,\n                s.allocateVersion,\n                s.allocateVersionSync,\n              );\n\n              const next: StatefulSessionRecord<Claims> = {\n                ...replacement.inspection.session,\n                provenance: replacement.inspection.provenance,\n                credentialVersion: replacement.inspection.credentialVersion,\n                digest: replacement.nextDigest,\n                version,\n              };\n\n              rotation = {\n                ...s.encodeRotation(next),\n                ...updateValues<any>([\n                  [s.version, version],\n                  [s.digest, next.digest],\n                  [s.credentialVersion, next.credentialVersion],\n                  [s.authenticatedAt, s.encodeInstant(next.assurance.authenticatedAt)],\n                  [s.issuedAt, s.encodeInstant(next.issuedAt)],\n                  [s.expiresAt, s.encodeInstant(next.expiresAt)],\n                  [s.absoluteExpiresAt, s.encodeInstant(next.absoluteExpiresAt)],\n                ]),\n              };\n            }\n\n            const completionVersion = yield* allocate(\n              options.mode,\n              m.allocateVersion,\n              m.allocateVersionSync,\n            );\n\n            if (completionVersion === stored.intent.version) return yield* unavailable();\n\n            const completionSnapshot = yield* encodeStepUpIntent({\n              ...stored.intent,\n              version: completionVersion,\n            });\n\n            const receipt = prepare(replacement.inspection, journal);\n\n            if (replacement._tag === \"Stateful\" && mapping.source.kind === \"Stateful\") {\n              const s = mapping.source.session,\n                sc = sessionColumns(mapping.source);\n\n              yield* tx\n                .update(s.table)\n                .set(rotation)\n                .where(\n                  and(\n                    eq(sc.sessionId, stored.source.nativeSessionId),\n                    eq(sc.digest, replacement.expectedDigest),\n                    eq(sc.version, replacement.expectedRowVersion),\n                  ),\n                );\n\n              const written = (yield* tx\n                .select()\n                .from(s.table)\n                .where(eq(sc.sessionId, stored.source.nativeSessionId))\n                .limit(1))[0];\n\n              if (written === undefined || written[s.version] !== rotation[s.version])\n                return yield* unavailable();\n              const decoded = yield* s.decode(written);\n\n              if (decoded.version !== rotation[s.version] || !stepUpRotationMatches(plan, decoded))\n                return yield* unavailable();\n            } else if (\n              replacement._tag === \"StateAssistedSigned\" &&\n              mapping.source.kind === \"StateAssistedSigned\"\n            ) {\n              const t = mapping.source.tombstone;\n\n              const owner = column(t.table, t.subjectId),\n                id = column(t.table, t.sessionId),\n                expiry = column(t.table, t.absoluteExpiresAt);\n\n              yield* tx\n                .delete(t.table)\n                .where(\n                  and(\n                    eq(owner, stored.nativeSubjectId),\n                    eq(id, stored.source.nativeSessionId),\n                    lte(expiry, t.encodeInstant(yield* freshNow)),\n                  ),\n                );\n\n              const values = t.encodeInsert({\n                subjectId: stored.nativeSubjectId,\n                sessionId: stored.source.nativeSessionId,\n                absoluteExpiresAt: replacement.tombstoneUntil,\n              });\n\n              yield* tx.insert(t.table).values(values).pipe(normalizeMutation(mapping));\n\n              const inserted = (yield* tx\n                .select()\n                .from(t.table)\n                .where(\n                  and(\n                    eq(owner, stored.nativeSubjectId),\n                    eq(id, stored.source.nativeSessionId),\n                    eq(expiry, t.encodeInstant(replacement.tombstoneUntil)),\n                  ),\n                )\n                .limit(1))[0];\n\n              if (inserted === undefined) return yield* unavailable();\n            }\n            yield* tx\n              .update(m.table)\n              .set(\n                updateValues<any>([\n                  [m.consumed, true],\n                  [m.version, completionVersion],\n                  [m.snapshot, completionSnapshot],\n                ]),\n              )\n              .where(\n                and(\n                  eq(c.digest, stored.intent.digest),\n                  eq(c.version, stored.intent.version),\n                  eq(c.snapshot, stored.row[m.snapshot]),\n                  eq(c.consumed, false),\n                  eq(c.failedAttempts, stored.row[m.failedAttempts]),\n                ),\n              );\n            const completed = yield* stepUpLocator(mapping, stored.intent.digest, false);\n\n            if (\n              completed === undefined ||\n              !completed[m.consumed] ||\n              completed[m.version] !== completionVersion ||\n              completed[m.snapshot] !== completionSnapshot\n            )\n              return yield* unavailable();\n            const commitNow = yield* freshNow;\n\n            if (\n              !stepUpIntentLive(stored.intent, mapping.source.kind, commitNow) ||\n              DateTime.toEpochMillis(commitNow) >=\n                DateTime.toEpochMillis(replacement.inspection.session.expiresAt) ||\n              !(yield* assessAuthentication(plan.evidence, current.requirement).pipe(\n                Effect.mapError(() => stale()),\n              )).satisfied ||\n              !(yield* assessAuthentication(plan.evidence, stored.intent.requirement).pipe(\n                Effect.mapError(() => stale()),\n              )).satisfied\n            )\n              return yield* stale();\n\n            return receipt;\n          }),\n        ),\n    };\n\n    return {\n      create: (input, now, prepare) =>\n        service.create(input, now, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      context: (input) => service.context(input).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      read: (input) => service.read(input).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      reject: (input, prepare) =>\n        service.reject(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      complete: (plan, prepare) =>\n        service.complete(plan, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),\n    } satisfies SessionStepUpPersistence<Claims>;\n  });\n"],"mappings":";;;;;;;;;;;;;AAwGA,IAAa,oBAAb,cAAuC,QAAQ,QAA+C,CAAC,CAC7F,uCACF,CAAC,CAAC,CAAC;AAWH,MAAM,oBAAoB,mBAAmB,KAAK,CAAC,CAAC;AACpD,MAAM,cAAc,oBAAoB,KAAK,CAAC,CAAC;AAC/C,MAAM,uBAAuB,6BAA6B,KAAK,CAAC,CAAC;AACjE,MAAM,uBAAuB,eAAe,KAAK,CAAC,CAAC;AAEnD,MAAM,mBACJ,QACA,QAEA,OAAO,WAAW,SAAS,UAAU,OAAO,UAAU,MAAM,IAAI,OAAO,GAAG,CAAC,CAAC;AAe9E,MAAM,2BAA2B,UAAgD;CAC/E,MAAM,MAAM,OAAO,UAAU,YAAY,UAAU,OAAO,QAAQ,IAAI,OAAO,MAAM,IAAI,KAAA;CAEvF,OACE,QAAQ,0BACR,QAAQ,yBACR,QAAQ,kCACR,QAAQ,qBACR,QAAQ,oBACR,QAAQ;AAEZ;AAEA,MAAM,qBACH,aACS,WACR,OAAO,KACL,OAAO,YAAY,UACjB,OAAO,UACL,MAAM,IAAI,QAAQ,UAChB,2BAA2B,QAAQ,sBAAsB,KAAK,IAC1D,gBAAgB,KAAK,CAAC,CAAC,IACvB,KACN,CACF,CACF,CACF;AAIJ,MAAM,mBACJ,WAEA,yBAAyB,QAAQ,uBAAuB,CAAC,CAAC,KACxD,OAAO,YAAY,UACjB,OAAO,UACL,MAAM,IACJ,QACC,UACE,wBAAwB,KAAK,IAAI,QAAQ,YAAY,CAC1D,CACF,CACF,CACF;AAEF,MAAM,cACJ,OACA,YAEA,WAAW,OAAO,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,IAAI;AAErE,MAAM,iBACJ,UACA,WAEA,OAAO,cACL,SAAS,aAAa,YACpB,OAAO,KAAK,OAAO,eAAe,mBAAmB,OAAO,CAAC,CAC/D,CACF;AAEF,MAAM,SACJ,UACA,SACA,sBACA,SAKG;CACH,MAAM,MAAM,uBAER,SAAS,aAAa,YACpB,KAAK,KAAK,OAAO,eAAe,mBAAmB,OAAO,CAAC,CAC7D,GACF,EAAE,MAAM,QAAQ,KAAK,CACvB,CAAC,CAAC,MACC,WACC,yBACE,SACC,UACC,wBAAwB,KAAK,KAAK,2BAA2B,sBAAsB,KAAK,CAC5F,GACF,OAAO,KAAK,WAAW,OAAO,KAAK,GACnC,OAAO,YAAY,UACjB,OAAO,UACL,MAAM,IAAI,QAAQ,UAChB,wBAAwB,KAAK,IAAK,QAAwC,YAAY,CACxF,CACF,CACF,CACF;CAEA,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,UAAU,OAAO,OAAO,cAAc,iBAAiB;EAG7D,IAAI,EAFqB,OAAO,OAAO,OAAO,KAAK,QAAQ,UAAU,WAE9C;GAErB,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;GACrD,OAAO,QAAQ;EACjB;EAIA,OAAO,OAAO;CAChB,CAAC;AACH;AAEA,MAAM,iBAAiB,WACrB,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK;AAE5B,MAAM,qBACJ,WACA,aACY;CACZ,MAAM,UAAU,IAAI,IAClB,UAAU,SAAS,YAAY,KAAK,SAAS,CAAC,KAAK,cAAc,KAAK,QAAQ,CAAC,CACjF;CAEA,OACE,UAAU,WAAW,SAAS,UAC9B,UAAU,kBAAkB,SAAS,iBACrC,UAAU,SAAS,cAAc,SAAS,SAAS,aACnD,UAAU,SAAS,qBAAqB,SAAS,SAAS,oBAC1D,SAAS,SAAS,YAAY,OAC3B,SAAS,QAAQ,IAAI,KAAK,YAAY,MAAM,KAAK,QACpD,KACA,SAAS,OAAO,OAAO,aACrB,UAAU,OAAO,MACd,UACC,MAAM,WAAW,SAAS,UAC1B,MAAM,iBAAiB,SAAS,gBAChC,MAAM,iBAAiB,SAAS,gBAChC,MAAM,sBAAsB,SAAS,qBACrC,SAAS,cAAc,MAAM,UAAU,MACrC,SAAS,cAAc,SAAS,UAAU,KAC5C,MAAM,QAAQ,WAAW,SAAS,QAAQ,UAC1C,MAAM,QAAQ,OAAO,QAAQ,UAAU,WAAW,SAAS,QAAQ,MAAM,CAC7E,CACF;AAEJ;AAEA,MAAM,oBAAoB,aAAkB;CAC1C,WAAW,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,EAAE;CAC3D,eAAe,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;CACnE,iBAAiB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,gBAAgB;CAC/E,qBAAqB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS;CAClF,cAAc,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,YAAY;CAC9E,oBAAoB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,QAAQ;CAChF,GAAI,QAAQ,WAAW,WAAW,KAAA,IAC9B,CAAC,IACD,EAAE,kBAAkB,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,MAAM,EAAE;AACtF;AAEA,MAAM,kBAAkB,aAAkB;CACxC,WAAW,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,EAAE;CAC3D,eAAe,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;CACnE,iBAAiB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,gBAAgB;AACjF;AAEA,MAAM,cAAc,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAC1D,SACA,iBACA,SACA;CACA,MAAM,WAAW,OAAO;CACxB,MAAM,UAAU,eAAe,OAAO;CAEtC,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,GAAG,QAAQ,WAAW,eAAe,CAAC,CAAC,CAC7C,MAAM,CAAC,GACV,OACF;AACF,CAAC;AAED,MAAM,mBAAmB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAClE,SACA,WACA,eACA,SACA;CACA,MAAM,WAAW,OAAO;CACxB,MAAM,YAAY,cAAc,aAAa;CAE7C,IAAI,UAAU,WAAW,cAAc,QAAQ,OAAO,OAAO,MAAM;CACnE,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,SAAS;CAEnE,MAAM,WAAU,OADW,YAAY,SAAS,iBAAiB,OAAO,EAAA,CAC5C;CAC5B,MAAM,UAAU,iBAAiB,OAAO;CAExC,IAAI,YAAY,KAAA,KAAa,CAAC,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,GAC1F,OAAO,OAAO,MAAM;CAEtB,MAAM,QAAQ,SACX,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MACC,IACE,GAAG,QAAQ,qBAAqB,eAAe,GAC/C,UAAU,WAAW,IAAI,GAAY,UAAU,QAAQ,QAAQ,cAAc,SAAS,CACxF,CACF,CAAC,CACA,QAAQ,QAAQ,YAAY;CAE/B,MAAM,iBAAiB,UAAU,WAAW,IAAI,CAAC,IAAI,OAAO,WAAW,OAAO,OAAO;CAErF,IAAI,eAAe,WAAW,UAAU,QAAQ,OAAO,OAAO,MAAM;CAEpE,MAAM,cAAc,eACjB,KAAK,SAAc;EAClB,cAAc,IAAI,QAAQ,WAAW;EACrC,UAAU,IAAI,QAAQ,WAAW;EACjC,QACE,QAAQ,WAAW,WAAW,KAAA,KAC9B,QAAQ,WAAW,iBAAiB,IAAI,QAAQ,WAAW,OAAO,MAAM;CAC5E,EAAE,CAAC,CACF,MAAM,MAAW,UAAe,KAAK,aAAa,cAAc,MAAM,YAAY,CAAC;CAEtF,IAAI,YAAY,MAAM,SAAc,CAAC,KAAK,MAAM,GAAG,OAAO,OAAO,MAAM;CAEvE,OAAO;EACL;EACA,UAAU;GACR;GACA,kBAAkB,QAAQ,QAAQ,QAAQ;GAC1C,aAAa,YAAY,KAAK,EAAE,cAAc,gBAAqB;IACjE;IACA;GACF,EAAE;EACJ;CACF;AACF,CAAC;AAED,MAAM,YAAY,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACpD,SACA,WACA,eACA,SACA;CACA,QAAQ,OAAO,iBAAiB,SAAS,WAAW,eAAe,OAAO,EAAA,CAAG;AAC/E,CAAC;AAED,MAAM,qBAAqB,OAAO,GAAG,iCAAiC,CAAC,CAAC,WACtE,SACA,UACA,SACA;CACA,MAAM,WAAW,OAAO,iBACtB,SACA,SAAS,SAAS,WAClB,SAAS,SAAS,YAAY,KAAK,SAAS,KAAK,YAAY,GAC7D,OACF;CAEA,IACE,SAAS,SAAS,qBAAqB,SAAS,SAAS,oBACzD,SAAS,SAAS,YAAY,WAAW,SAAS,SAAS,YAAY,UACvE,SAAS,SAAS,YAAY,MAC3B,MAA4D,UAAkB;EAC7E,MAAM,WAAW,CAAC,GAAG,SAAS,SAAS,WAAW,CAAC,CAAC,MAAM,GAAG,MAC3D,EAAE,aAAa,cAAc,EAAE,YAAY,CAC7C,CAAC,CAAC;EAEF,OACE,aAAa,KAAA,KACb,SAAS,iBAAiB,KAAK,gBAC/B,SAAS,aAAa,KAAK;CAE/B,CACF,GAEA,OAAO,OAAO,MAAM;CAItB,OAAO;EAAE,iBAAA,OAHsB,QAAQ,UAAU,SAAS,SAAS,SAAS,SAAS;EAG3D,aAAA,OAFC,QAAQ,QAAQ,kBAAkB,SAAS,OAAO;CAEvC;AACxC,CAAC;AAED,MAAM,eAAe,aAAkB;CACrC,QAAQ,OAAO,QAAQ,KAAK,OAAO,QAAQ,KAAK,MAAM;CACtD,WAAW,OAAO,QAAQ,KAAK,OAAO,QAAQ,KAAK,SAAS;CAC5D,OAAO,OAAO,QAAQ,KAAK,OAAO,QAAQ,KAAK,KAAK;CACpD,eAAe,OAAO,QAAQ,KAAK,OAAO,QAAQ,KAAK,aAAa;CACpE,YAAY,OAAO,QAAQ,KAAK,OAAO,QAAQ,KAAK,UAAU;AAChE;AAEA,MAAM,WAAW,OAAO,GAAG,yBAAyB,CAAC,CAAC,WACpD,SACA,QACA,SACA;CACA,MAAM,WAAW,OAAO;CACxB,MAAM,UAAU,YAAY,OAAO;CAEnC,OAAO,OAAO,WACZ,SAAS,OAAO,CAAC,CAAC,KAAK,QAAQ,KAAK,KAAK,CAAC,CAAC,MAAM,GAAG,QAAQ,QAAQ,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GACpF,OACF;AACF,CAAC;AAED,MAAM,4BAA4B,OAAO,GAAG,oCAAoC,CAAC,CAAC,WAChF,SAIA,UACA,iBACA,YACA;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,YAAW,OADG,SAAS,SAAS,SAAS,QAAQ,IAAI,EAAA,CACrC;CAEtB,IAAI,aAAa,KAAA,GAAW;EAC1B,MAAM,MAAM,OAAO;EAEnB,IACE,SAAS,cAAc,GAAG,IAC1B,SAAS,cAAc,OAAO,QAAQ,KAAK,cAAc,SAAS,QAAQ,KAAK,WAAW,CAAC,GAE3F,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;EACvC,IAAI,QAAQ,YAAY,KAAA,GACtB,OAAO,SACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,MAAM,GAAG,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM,GAAG,SAAS,MAAM,CAAC;EACrF,OAAO,SACJ,OAAO,QAAQ,KAAK,KAAK,CAAC,CAC1B,MAAM,GAAG,YAAY,OAAO,CAAC,CAAC,QAAQ,SAAS,MAAM,CAAC;CAC3D;CAEA,OAAO,QAAQ,KAAK,wBAAwB;EAAE;EAAU,WAAW;EAAiB;CAAW,CAAC;AAClG,CAAC;AAED,MAAM,kBAAkB,aAAkB;CACxC,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;CAC5D,SAAS,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,OAAO;CAC9D,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;CAC5D,WAAW,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,SAAS;CAClE,eAAe,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,aAAa;CAC1E,WAAW,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,SAAS;CAClE,cAAc,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,YAAY;CACxE,gBAAgB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,cAAc;CAC5E,UAAU,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,QAAQ;AAClE;AAEA,MAAM,cAAc,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAC1D,SACA,QACA,SACA;CACA,MAAM,WAAW,OAAO;CAExB,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,GAAG,eAAe,OAAO,CAAC,CAAC,QAAQ,MAAM,CAAC,CAAC,CACjD,MAAM,CAAC,GACV,OACF;AACF,CAAC;AAID,MAAM,kBAAkB,OAAO,GAAG,gCAAgC,CAAC,CAAC,WAElE,SAA4B,OAA2B,aAAgC,UAAU;CAEjG,MAAM,OAAM,OADQ,YAAY,SAAS,MAAM,QAAQ,IAAI,EAAA,CAC1C;CAEjB,IAAI,QAAQ,KAAA,GAAW,OAAO,OAAO,eAAe;CAMpD,MAAM,SAAS,QAHb,eAAe,YAAY,QAAQ,QAAQ,gBAAgB,QAAQ,QAAQ,OAAA,CAGhD,GAAG;CAChC,MAAM,iBAAiB,OAAO,IAAI,QAAQ,QAAQ,eAAe;CAEjE,IACE,OAAO,YAAY,MAAM,WACzB,OAAO,SAAS,WAAW,MAAM,UACjC,OAAO,SAAS,kBAAkB,MAAM,iBACxC,IAAI,QAAQ,QAAQ,cAAc,SAClC,kBAAkB,OAAO,cAEzB,OAAO,OAAO,eAAe;CAE/B,MAAM,QAAO,OADQ,SAAS,SAAS,MAAM,QAAQ,IAAI,EAAA,CACtC;CAEnB,IACE,SAAS,KAAA,KACT,KAAK,QAAQ,KAAK,WAAW,QAAQ,KAAK,qBAC1C,KAAK,QAAQ,KAAK,mBAAmB,MAAM,QAE3C,OAAO,OAAO,eAAe;CAC/B,IAAI,SAAS,cAAc,OAAO,QAAQ,KAAK,SAAS,cAAc,OAAO,SAAS,GACpF,OAAO,OAAO,eAAe;CAE/B,OAAO;AACT,CAAC;AAED,MAAM,iBAAiB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAChE,SACA,OACA,OACA;CACA,MAAM,WAAW,OAAO;CAExB,OAAO,OAAO,IAAI,CAChB,SACG,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,IAAI,aAAkB,CAAC,CAAC,QAAQ,QAAQ,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,CAC1D,MACC,IACE,GAAG,eAAe,OAAO,CAAC,CAAC,QAAQ,MAAM,MAAM,GAC/C,GAAG,eAAe,OAAO,CAAC,CAAC,SAAS,MAAM,OAAO,GACjD,GAAG,eAAe,OAAO,CAAC,CAAC,UAAU,KAAK,CAC5C,CACF,GAEF,SACG,OAAO,QAAQ,KAAK,KAAK,CAAC,CAC1B,IACC,aAAkB;EAChB,CAAC,QAAQ,KAAK,OAAO,QAAQ,KAAK,qBAAqB;EACvD,CAAC,QAAQ,KAAK,eAAe,IAAI;EACjC,CAAC,QAAQ,KAAK,YAAY,QAAQ,KAAK,cAAc,KAAK,CAAC;CAC7D,CAAC,CACH,CAAC,CACA,MAAM,GAAG,YAAY,OAAO,CAAC,CAAC,QAAQ,MAAM,MAAM,CAAC,CACxD,CAAC;AACH,CAAC;AAED,MAAM,WAAW,SAAS;AAE1B,MAAM,YACJ,MACA,cACA,gBAC+D;CAC/D,IAAI,SAAS,eACX,OAAO,gBAAgB,KAAA,IACnB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;EACT,KAAK;EACL,QAAQ,UAAU,oBAAoB,KAAK;GAAE,WAAW;GAAY;EAAM,CAAC;CAC7E,CAAC;CACP,IAAI,iBAAiB,KAAA,GAAW,OAAO;CAEvC,OAAO,gBAAgB,KAAA,IACnB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;EACT,KAAK;EACL,QAAQ,UAAU,oBAAoB,KAAK;GAAE,WAAW;GAAY;EAAM,CAAC;CAC7E,CAAC;AACP;AAEA,MAAa,kCACX,UACA,SACA,YAEA,OAAO,IAAI,iBAAiB,UAAU;CACpC,MAAM,UAAU;EACd,UAAU,WAAsB,kBAC9B,gBACE,cAAc,UAAU,UAAU,SAAS,WAAW,eAAe,IAAI,CAAC,CAC5E;EACF,eAAe,aACb,gBACE,cACE,UACA,mBAAmB,SAAS,UAAU,IAAI,CAAC,CAAC,KAC1C,OAAO,KAAK,WAAW,OAAO,WAAW,CAC3C,CACF,CACF;EACF,UACE,OACA,YAEA,MACE,UACA,SACA,QAAQ,sBACR,OAAO,IAAI,aAAa;GACtB,MAAM,UAAU,OAAO;GACvB,MAAM,EAAE,gBAAgB,OAAO,mBAAmB,SAAS,MAAM,UAAU,IAAI;GAE/E,IAAI,MAAM,YAAY,KAAA,GAAW;IAC/B,MAAM,WAAW,OAAO,qBAAqB,MAAM,UAAU,WAAW,CAAC,CAAC,KACxE,OAAO,SAAS,WAAW,CAC7B;IAEA,MAAM,MAAM,OAAO;IAEnB,IACE,CAAC,SAAS,aACV,SAAS,cAAc,GAAG,KAAK,SAAS,cAAc,MAAM,SAAS,KACrE,SAAS,cAAc,MAAM,SAAS,IACpC,SAAS,cAAc,MAAM,iBAAiB,GAEhD,OAAO,OAAO,MAAM;IAEtB,OAAO,QAAQ,KAAA,GAAW,OAAO;GACnC;GACA,IAAI,QAAQ,YAAY,KAAA,GAAW,OAAO,OAAO,eAAe;GAChE,MAAM,iBAAiB;IAAE,GAAG;IAAS,GAAG,QAAQ;GAAQ;GACxD,MAAM,UAAU,OAAO,gBAAgB,gBAAgB,MAAM,OAAO;GAEpE,IAAI,CAAC,kBAAkB,MAAM,UAAU,QAAQ,QAAQ,GACrD,OAAO,OAAO,eAAe;GAE/B,MAAM,WAAW,OAAO,qBAAqB,MAAM,UAAU,WAAW,CAAC,CAAC,KACxE,OAAO,SAAS,WAAW,CAC7B;GAEA,MAAM,MAAM,OAAO;GAEnB,IACE,CAAC,SAAS,aACV,SAAS,cAAc,GAAG,KAAK,SAAS,cAAc,QAAQ,SAAS,KACvE,SAAS,cAAc,GAAG,KAAK,SAAS,cAAc,MAAM,SAAS,KACrE,SAAS,cAAc,MAAM,SAAS,IACpC,SAAS,cAAc,MAAM,iBAAiB,GAEhD,OAAO,OAAO,MAAM;GACtB,MAAM,UAAU,QAAQ,KAAA,GAAW,OAAO;GAE1C,OAAO,eAAe,gBAAgB,MAAM,SAAS,MAAM,iBAAiB;GAE5E,OAAO;EACT,CAAC,CACH;CACJ;CAEA,OAAO;EACL,UAAU,WAAW,kBACnB,QACG,QAAQ,WAAW,aAAa,CAAC,CACjC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;EACtD,eAAe,aACb,QAAQ,aAAa,QAAQ,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;EAClF,UAAU,OAAO,YACf,QAAQ,QAAQ,OAAO,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CACrF;AACF,CAAC;;;AAIH,MAAM,2BAA2B,OAAO,GAAG,yCAAyC,CAAC,CAAC,WAGpF,SACA,OACA,YACA;CACA,MAAM,WAAW,OAAO,YAAY,SAAS,MAAM,QAAQ,KAAK,EAAA,CAAG;CAEnE,IAAI,YAAY,KAAA,GAAW,OAAO,OAAO,eAAe;CACxD,MAAM,yBAAyB,QAAQ,QAAQ,QAAQ;CAGvD,KAFiB,OAAO,YAAY,SAAS,wBAAwB,IAAI,EAAA,CAAG,OAE5D,KAAA,GAAW,OAAO,OAAO,eAAe;CACxD,MAAM,WAAW,OAAO,YAAY,SAAS,MAAM,QAAQ,IAAI,EAAA,CAAG;CAElE,IACE,YAAY,KAAA,KACZ,CAAC,QAAQ,UAAU,OAAO,QAAQ,QAAQ,QAAQ,YAAY,sBAAsB,GAEpF,OAAO,OAAO,eAAe;CAM/B,MAAM,SAAS,QAHb,eAAe,YAAY,QAAQ,QAAQ,gBAAgB,QAAQ,QAAQ,OAAA,CAGhD,OAAO;CACpC,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,OAAO,SAAS,SAAS,SAAS;CAC5F,MAAM,iBAAiB,OAAO,QAAQ,QAAQ,QAAQ,eAAe;CAErE,IACE,CAAC,QAAQ,UAAU,OAAO,iBAAiB,sBAAsB,KAChE,MAAM,kBAAkB,KAAA,KAAa,OAAO,SAAS,kBAAkB,MAAM,iBAC9E,QAAQ,QAAQ,QAAQ,aAAa,OAAO,WAC5C,QAAQ,QAAQ,QAAQ,YAAY,OAAO,SAAS,UACpD,QAAQ,QAAQ,QAAQ,mBAAmB,OAAO,SAAS,iBAC3D,QAAQ,QAAQ,QAAQ,cAAc,SACtC,kBAAkB,OAAO,cAEzB,OAAO,OAAO,eAAe;CAC/B,MAAM,QAAQ,OAAO,SAAS,SAAS,OAAO,SAAS,QAAQ,IAAI,EAAA,CAAG;CAEtE,IACE,SAAS,KAAA,KACT,KAAK,QAAQ,KAAK,WAAW,QAAQ,KAAK,qBAC1C,KAAK,QAAQ,KAAK,mBAAmB,MAAM,QAE3C,OAAO,OAAO,eAAe;CAE/B,MAAM,EAAE,gBAAgB,OAAO,gBAC7B,mBAAmB,SAAS,OAAO,UAAU,IAAI,IAChD,UAAW,MAAM,SAAS,wBAAwB,eAAe,IAAI,KACxE;CAEA,OAAO,qBAAqB,OAAO,UAAU,WAAW,CAAC,CAAC,KACxD,OAAO,eAAe,eAAe,CAAC,CACxC;CACA,IAAI,SAAS,cAAc,OAAO,QAAQ,KAAK,SAAS,cAAc,OAAO,SAAS,GACpF,OAAO,OAAO,eAAe;CAE/B,OAAO;AACT,CAAC;AAED,MAAa,gCACX,UACA,SACA,YAEA,OAAO,IAAI,iBAAiB,UAAU;CACpC,MAAM,UAAU;EACd,SACE,OACA,WACA,YAEA,MACE,UACA,SACA,QAAQ,sBACR,OAAO,IAAI,aAAa;GACtB,MAAM,cAAc,OAAO;GAC3B,MAAM,UAAU,OAAO;GAEvB,MAAM,EAAE,iBAAiB,gBAAgB,OAAO,mBAC9C,SACA,MAAM,UACN,IACF;GAEA,MAAM,YAAY,OAAO,SAAS,SAAS,MAAM,SAAS,QAAQ,IAAI,EAAA,CAAG;GAEzE,IAAI,aAAa,KAAA,GAAW;IAC1B,MAAM,aAAa,OAAO,QAAQ,KAAK,cACrC,SAAS,QAAQ,KAAK,WACxB;IAEA,IAAI,SAAS,cAAc,OAAO,QAAQ,IAAI,SAAS,cAAc,UAAU,GAC7E,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;IACvC,OAAO,YACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,MAAM,GAAG,eAAe,OAAO,CAAC,CAAC,QAAQ,MAAM,SAAS,MAAM,CAAC;IAClE,OAAO,YACJ,OAAO,QAAQ,KAAK,KAAK,CAAC,CAC1B,MAAM,GAAG,YAAY,OAAO,CAAC,CAAC,QAAQ,MAAM,SAAS,MAAM,CAAC;GACjE;GAEA,MAAM,UAAU,OAAO,SACrB,QAAQ,MACR,QAAQ,QAAQ,iBAChB,QAAQ,QAAQ,mBAClB;GAEA,OAAO,qBAAqB,MAAM,UAAU,WAAW;GACvD,MAAM,MAAM,OAAO;GAEnB,IAAI,SAAS,cAAc,GAAG,KAAK,SAAS,cAAc,MAAM,SAAS,GACvE,OAAO,OAAO,MAAM;GACtB,MAAM,SAAS;IAAE,GAAG;IAAO;GAAQ;GACnC,MAAM,UAAU,QAAQ,QAAQ,OAAO;GAEvC,OAAO,YAAY,OAAO,QAAQ,KAAK,KAAK,CAAC,CAAC,OAC5C,QAAQ,KAAK,oBAAoB;IAC/B,UAAU,MAAM;IAChB,WAAW;IACX,eAAe,MAAM;IACrB,YAAY,MAAM;GACpB,CAAC,CACH;GACA,OAAO,YAAY,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,OAC/C,QAAQ,QAAQ,aAAa,QAAQ;IACnC,WAAW;IACX,gBAAgB;IAChB,UAAU;GACZ,CAAC,CACH;GAEA,OAAO;EACT,CAAC,CAAC,CAAC,KAAK,kBAAkB,OAAO,CAAC,CACpC;EACF,UAAU,UACR,gBACE,cACE,UACA,yBAAqD,SAAS,OAAO,SAAS,CAChF,CACF,CAAC,CAAC,KAAK,OAAO,QAAQ,4BAA4B,CAAC;EACrD,OAAO,UAKL,gBACE,cACE,UACA,yBAA8D,SAAS,OAAO,QAAQ,CACxF,CACF,CAAC,CAAC,KAAK,OAAO,KAAK,WAAW,MAA6C,CAAC;EAC9E,SACE,OACA,YAEA,MACE,UACA,SACA,QAAQ,sBACR,OAAO,IAAI,aAAa;GACtB,MAAM,cAAc,OAAO;GAC3B,MAAM,UAAU,OAAO;GACvB,MAAM,WAAW,OAAO,YAAY,SAAS,MAAM,QAAQ,KAAK,EAAA,CAAG;GAEnE,IAAI,YAAY,KAAA,GAAW,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,OAAO;GACvE,MAAM,SAAS,OAAO,QAAQ,QAAQ,cAAc,OAAO;GAE3D,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAC/C,OAAO,SAAS,SAAS,SAC3B;GAEA,MAAM,WAAW,OAAO,YAAY,SAAS,iBAAiB,IAAI,EAAA,CAAG;GACrE,MAAM,WAAW,OAAO,YAAY,SAAS,MAAM,QAAQ,IAAI,EAAA,CAAG;GAClE,MAAM,MAAM,OAAO;GACnB,MAAM,UAAU,QAAQ,EAAE,MAAM,WAAW,GAAG,OAAO;GAErD,IACE,YAAY,KAAA,KACZ,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,KAC9D,QAAQ,QAAQ,QAAQ,sBACtB,OAAO,SAAS,SAAS,oBAC3B,YAAY,KAAA,KACZ,QAAQ,QAAQ,QAAQ,cAAc,SACtC,OAAO,SAAS,kBAAkB,MAAM,iBACxC,SAAS,cAAc,GAAG,IAAI,SAAS,cAAc,OAAO,SAAS,GAErE,OAAO,YACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,IACC,aAAkB,CAChB,CACE,QAAQ,QAAQ,gBAChB,GAAG,aAAa,eAAe,OAAO,CAAC,CAAC,eAAe,KAAK,eAAe,OAAO,CAAC,CAAC,aAAa,QAAQ,eAAe,OAAO,CAAC,CAAC,eAAe,YAAY,eAAe,OAAO,CAAC,CAAC,eAAe,KACrM,CACF,CAAC,CACH,CAAC,CACA,MAAM,GAAG,eAAe,OAAO,CAAC,CAAC,QAAQ,MAAM,MAAM,CAAC;GAG3D,OAAO;EACT,CAAC,CACH;CACJ;CAEA,OAAO;EACL,SAAS,OAAO,KAAK,YACnB,QAAQ,OAAO,OAAO,KAAK,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;EACvF,UAAU,UAAU,QAAQ,QAAQ,KAAK,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;EAC5F,OAAO,UAAU,QAAQ,KAAK,KAAK,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;EACtF,SAAS,OAAO,YACd,QAAQ,OAAO,OAAO,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CACpF;AACF,CAAC;AAEH,MAAM,kBAAkB,aAAkB;CACxC,WAAW,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,SAAS;CAClE,WAAW,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,SAAS;CAClE,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,MAAM;CAC5D,SAAS,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,OAAO;CAC9D,kBAAkB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,gBAAgB;CAChF,UAAU,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,QAAQ;CAChE,WAAW,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,SAAS;CAClE,mBAAmB,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,iBAAiB;AACpF;AAEA,MAAa,2BACX,UACA,SACA,YAEA,OAAO,IAAI,iBAAiB,UAAU;CACpC,MAAM,IAAI,eAAe,OAAO;CAEhC,MAAM,cAAc;EAClB,YACE,OACA,YAEA,MACE,UACA,SACA,QAAQ,sBACR,OAAO,IAAI,aAAa;GACtB,MAAM,cAAc,OAAO;GAC3B,MAAM,UAAU,OAAO;GAEvB,MAAM,EAAE,iBAAiB,gBAAgB,OAAO,mBAC9C,SACA,MAAM,UACN,IACF;GAEA,IAAI;GACJ,IAAI;GAEJ,IAAI,MAAM,YAAY,KAAA,GACpB,aAAa,OAAO,0BAClB,SACA,MAAM,UACN,iBACA,MAAM,QAAQ,iBAChB;QACG;IACH,IAAI,QAAQ,YAAY,KAAA,GAAW,OAAO,OAAO,eAAe;IAChE,MAAM,UAAU,OAAO,gBAAgB,SAAS,MAAM,OAAO;IAE7D,IAAI,CAAC,kBAAkB,MAAM,UAAU,QAAQ,QAAQ,GACrD,OAAO,OAAO,eAAe;IAC/B,mBAAmB,QAAQ;GAC7B;GAEA,MAAM,kBAAkB,OAAO,SAC7B,QAAQ,MACR,QAAQ,QAAQ,YAChB,QAAQ,QAAQ,cAClB;GAEA,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,eAAe;GAEpE,MAAM,UAAU,OAAO,SACrB,QAAQ,MACR,QAAQ,QAAQ,iBAChB,QAAQ,QAAQ,mBAClB;GAEA,MAAM,WAAW,OAAO,qBAAqB,MAAM,UAAU,WAAW;GACxE,MAAM,MAAM,OAAO;GAEnB,IACE,CAAC,SAAS,aACT,qBAAqB,KAAA,KACpB,SAAS,cAAc,GAAG,KAAK,SAAS,cAAc,gBAAgB,KACxE,SAAS,cAAc,GAAG,KAAK,SAAS,cAAc,MAAM,QAAQ,SAAS,KAC7E,SAAS,cAAc,MAAM,QAAQ,SAAS,IAC5C,SAAS,cAAc,MAAM,QAAQ,iBAAiB,GAExD,OAAO,OAAO,MAAM;GAEtB,MAAM,SAAS;IACb,GAAG,MAAM;IACT;IACA;IACA,WAAW,MAAM,SAAS,SAAS;IACnC,kBAAkB,MAAM,SAAS,SAAS;IAC1C,WAAW,SAAS;IACpB,YAAY,OAAO,wCAAwC,EACzD,UAAU,MAAM,SAClB,CAAC;IACD,UAAU;GACZ;GAEA,MAAM,UAAU,QAAQ,QAAQ,OAAO;GAEvC,IAAI,eAAe,KAAA,GACjB,OAAO,YAAY,OAAO,QAAQ,KAAK,KAAK,CAAC,CAAC,OAAO,UAAU;QAE/D,OAAO,eACL;IAAE,GAAG;IAAS,SAAS,QAAQ;GAAS,GACxC,MAAM,SACN,MAAM,QAAQ,iBAChB;GACF,OAAO,YAAY,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,OAC/C,QAAQ,QAAQ,aAAa,QAAQ;IACnC,WAAW;IACX,WAAW;GACb,CAAC,CACH;GAEA,OAAO;EACT,CAAC,CAAC,CAAC,KAAK,kBAAkB,OAAO,CAAC,CACpC;EACF,SAAS,UACP,gBACE,cACE,UACA,OAAO,IAAI,aAAa;GAStB,MAAM,OAAM,QANQ,OAFA,kBAAA,CAGjB,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,GAAG,EAAE,QAAQ,MAAM,MAAM,CAAC,CAAC,CACjC,MAAM,CAAC,EAAA,CAEO;GAEjB,IAAI,QAAQ,KAAA,GAAW,OAAO,OAAO,eAAe;GACpD,MAAM,SAAS,OAAO,QAAQ,QAAQ,OAAO,GAAG;GAChD,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,OAAO,SAAS;GAE1E,MAAM,WAAU,OADQ,YAAY,SAAS,iBAAiB,KAAK,EAAA,CAC1C;GACzB,MAAM,MAAM,OAAO;GAEnB,IACE,YAAY,KAAA,KACZ,CAAC,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,KAC/D,QAAQ,QAAQ,QAAQ,sBAAsB,OAAO,oBACrD,SAAS,cAAc,GAAG,KAAK,SAAS,cAAc,OAAO,SAAS,KACtE,SAAS,cAAc,GAAG,KAAK,SAAS,cAAc,OAAO,iBAAiB,GAE9E,OAAO,OAAO,eAAe;GAE/B,OAAO;EACT,CAAC,CACH,CACF;EACF,SACE,OACA,YAEA,MACE,UACA,SACA,QAAQ,sBACR,OAAO,IAAI,aAAa;GACtB,MAAM,cAAc,OAAO;GAC3B,MAAM,UAAU,OAAO;GACvB,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;GAEzE,MAAM,WAAW,OAAO,YACrB,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,GAAG,EAAE,WAAW,eAAe,CAAC,CAAC,CACvC,MAAM,CAAC,EAAA,CAAG;GAEb,IAAI,YAAY,KAAA,GAAW,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;GAChE,MAAM,gBAAgB,OAAO,QAAQ,QAAQ,OAAO,OAAO;GAC3D,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,cAAc,SAAS;GACjF,MAAM,WAAW,OAAO,YAAY,SAAS,iBAAiB,IAAI,EAAA,CAAG;GAErE,MAAM,OAAO,OAAO,WAClB,YACG,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,GAAG,EAAE,WAAW,eAAe,CAAC,CAAC,CACvC,MAAM,CAAC,GACV,QAAQ,OACV,EAAA,CAAG;GAEH,IAAI,QAAQ,KAAA,GAAW,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;GAC5D,MAAM,SAAS,OAAO,QAAQ,QAAQ,OAAO,GAAG;GAEhD,MAAM,UAAU,OAAO,SACrB,QAAQ,MACR,QAAQ,QAAQ,iBAChB,QAAQ,QAAQ,mBAClB;GAEA,MAAM,MAAM,OAAO;GAEnB,IACE,YAAY,KAAA,KACZ,CAAC,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,KAC/D,QAAQ,QAAQ,QAAQ,sBAAsB,MAAM,4BACpD,OAAO,qBAAqB,MAAM,4BAClC,OAAO,WAAW,MAAM,kBACxB,OAAO,YAAY,MAAM,mBACzB,SAAS,cAAc,GAAG,KAAK,SAAS,cAAc,OAAO,SAAS,KACtE,SAAS,cAAc,GAAG,KAAK,SAAS,cAAc,OAAO,iBAAiB,KAC9E,SAAS,cAAc,MAAM,aAAa,IACxC,SAAS,cAAc,OAAO,iBAAiB,KACjD,SAAS,cAAc,MAAM,aAAa,KAAK,SAAS,cAAc,GAAG,GAEzE,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;GAEvC,MAAM,OAAO;IACX,GAAG;IACH,QAAQ,MAAM;IACd,mBAAmB,MAAM;IACzB;IACA,UAAU;IACV,WAAW,MAAM;GACnB;GAEA,MAAM,UAAU,QAAQ,MAAM,OAAO;GAErC,OAAO,YACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,IAAI,QAAQ,QAAQ,eAAe,IAAI,CAAC,CAAC,CACzC,MACC,IACE,GAAG,EAAE,WAAW,eAAe,GAC/B,GAAG,EAAE,QAAQ,MAAM,cAAc,GACjC,GAAG,EAAE,SAAS,MAAM,eAAe,CACrC,CACF;GAEF,OAAO;EACT,CAAC,CACH;EACF,eAAkB,QAAqB,YACrC,MACE,UACA,SACA,QAAQ,sBACR,OAAO,IAAI,aAAa;GACtB,MAAM,cAAc,OAAO;GAC3B,MAAM,UAAU,OAAO;GAEvB,MAAM,WAAW,OAAO,YACrB,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,GAAG,EAAE,QAAQ,MAAM,CAAC,CAAC,CAC3B,MAAM,CAAC,EAAA,CAAG;GAEb,IAAI,YAAY,KAAA,GAAW,OAAO,QAAQ,OAAO,OAAO;GACxD,MAAM,SAAS,OAAO,QAAQ,QAAQ,OAAO,OAAO;GACpD,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,OAAO,SAAS;GAE1E,OAAO,YAAY,SAAS,iBAAiB,IAAI;GAEjD,MAAM,OAAO,OAAO,WAClB,YAAY,OAAO,CAAC,CAAC,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAAC,MAAM,GAAG,EAAE,QAAQ,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GACpF,QAAQ,OACV,EAAA,CAAG;GAEH,MAAM,UAAU,QAAQ,QAAQ,KAAA,GAAW,OAAO;GAElD,IAAI,QAAQ,KAAA,GACV,OAAO,YAAY,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,MAAM,GAAG,EAAE,QAAQ,MAAM,CAAC;GAE7E,OAAO;EACT,CAAC,CACH;EACF,SACE,OACA,YAEA,MACE,UACA,SACA,QAAQ,sBACR,OAAO,IAAI,aAAa;GACtB,MAAM,cAAc,OAAO;GAC3B,MAAM,UAAU,OAAO;GACvB,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;GACzE,MAAM,WAAW,OAAO,YAAY,SAAS,iBAAiB,IAAI,EAAA,CAAG;GAErE,IACE,YAAY,KAAA,KACZ,CAAC,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,KAC/D,QAAQ,QAAQ,QAAQ,sBAAsB,MAAM,0BAEpD,OAAO,OAAO,MAAM;GACtB,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;GACzE,MAAM,UAAU,QAAQ,KAAA,GAAW,OAAO;GAE1C,OAAO,YACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,MAAM,IAAI,GAAG,EAAE,WAAW,eAAe,GAAG,GAAG,EAAE,WAAW,eAAe,CAAC,CAAC;GAEhF,OAAO;EACT,CAAC,CACH;EACF,YACE,OACA,YAEA,MACE,UACA,SACA,QAAQ,sBACR,OAAO,IAAI,aAAa;GACtB,MAAM,cAAc,OAAO;GAC3B,MAAM,UAAU,OAAO;GACvB,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;GACzE,MAAM,WAAW,OAAO,YAAY,SAAS,iBAAiB,IAAI,EAAA,CAAG;GAErE,IACE,YAAY,KAAA,KACZ,CAAC,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,KAC/D,QAAQ,QAAQ,QAAQ,sBAAsB,MAAM,0BAEpD,OAAO,OAAO,MAAM;GACtB,MAAM,mBAAmB,QAAQ,QAAQ;GAEzC,MAAM,OAAO,OAAO,SAClB,QAAQ,MACR,QAAQ,QAAQ,uBAAuB,MAAM,wBAAwB,GACrE,qBAAqB,KAAA,IACjB,KAAA,UACM,iBAAiB,MAAM,wBAAwB,CAC3D;GAEA,MAAM,UAAU,QAAQ,KAAA,GAAW,OAAO;GAE1C,OAAO,YACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,IAAI,aAAkB,CAAC,CAAC,QAAQ,QAAQ,kBAAkB,IAAI,CAAC,CAAC,CAAC,CAAC,CAClE,MACC,IACE,GAAG,iBAAiB,OAAO,CAAC,CAAC,WAAW,eAAe,GACvD,GAAG,iBAAiB,OAAO,CAAC,CAAC,iBAAiB,MAAM,wBAAwB,CAC9E,CACF;GACF,OAAO,YACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,MAAM,GAAG,EAAE,WAAW,eAAe,CAAC;GAEzC,OAAO;EACT,CAAC,CACH;CACJ;CAEA,MAAM,aAAa,EACjB,OAAO,UACL,gBACE,cACE,UACA,OAAO,IAAI,aAAa;EACtB,MAAM,OAAO,OAAO;EACpB,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;EACzE,MAAM,WAAW,OAAO,YAAY,SAAS,iBAAiB,KAAK,EAAA,CAAG;EAEtE,IACE,YAAY,KAAA,KACZ,CAAC,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,GAE/D,OAAO,EAAE,UAAU,CAAC,EAAE;EAExB,MAAM,SACJ,MAAM,WAAW,KAAA,IACb,KAAA,IACA,OAAO,QAAQ,UAAU,SAAS,MAAM,MAAa;EAE3D,MAAM,MAAM,OAAO;EAEnB,MAAM,OAAO,OAAO,KACjB,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MACC,IACE,GAAG,EAAE,WAAW,eAAe,GAC/B,GAAG,EAAE,kBAAkB,QAAQ,QAAQ,QAAQ,iBAAiB,GAChE,GAAG,EAAE,WAAW,QAAQ,QAAQ,cAAc,GAAG,CAAC,GAClD,GAAG,EAAE,mBAAmB,QAAQ,QAAQ,cAAc,GAAG,CAAC,GAC1D,WAAW,KAAA,IAAY,KAAA,IAAY,GAAG,EAAE,WAAW,MAAM,CAC3D,CACF,CAAC,CACA,QAAQ,EAAE,SAAS,CAAC,CACpB,MAAM,MAAM,QAAQ,CAAC;EAExB,MAAM,UAAU,OAAO,OAAO,QAAQ,OAAO,QAC3C,QAAQ,QAAQ,OAAO,GAAG,CAC5B;EAEA,MAAM,QAAQ,OAAO,YAAY,OAAO,OAAO,eAAe,CAAC;EAE/D,MAAM,WAAW,OAAO,OAAO,QAAQ,QAAQ,MAAM,GAAG,MAAM,KAAK,IAAI,WACrE,OAAO,aAAa,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,OAAO,QAAQ,OAAO,aAAa,KAAK,CAAC,CAAC,CACpF;EAIA,OAAO;GACL;GACA,GAJY,QAAQ,MAAM,WAIZ,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY,SAAS,GAAG,EAAE,CAAC,EAAE,UAAU;EAC1E;CACF,CAAC,CACH,CACF,EACJ;CAEA,OAAO;EACL,4BAA4B;GAC1B,YAAY,OAAO,YACjB,YAAY,UAAU,OAAO,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;GACzF,SAAS,UACP,YAAY,OAAO,KAAK,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;GAC7E,SAAS,OAAO,YACd,YAAY,OAAO,OAAO,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;GACtF,eAAe,QAAQ,YACrB,YACG,aAAa,QAAQ,OAAO,CAAC,CAC7B,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;GACtD,SAAS,OAAO,YACd,YAAY,OAAO,OAAO,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;GACtF,YAAY,OAAO,YACjB,YAAY,UAAU,OAAO,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;EAC3F;EACA,mBAAmB,EACjB,OAAO,UAAU,WAAW,KAAK,KAAK,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC,EAC3F;CACF;AACF,CAAC;AAEH,MAAa,yBACX,UACA,SACA,YAEA,OAAO,IAAI,iBAAiB,UAAU;CACpC,MAAM,UAAU,eAAe,OAAO;CAEtC,MAAM,YAAY;EAChB,WAAW,OAAO,QAAQ,UAAU,OAAO,QAAQ,UAAU,SAAS;EACtE,WAAW,OAAO,QAAQ,UAAU,OAAO,QAAQ,UAAU,SAAS;EACtE,mBAAmB,OAAO,QAAQ,UAAU,OAAO,QAAQ,UAAU,iBAAiB;CACxF;CAEA,MAAM,UAAU;EACd,SAAS,SAA0B,SACjC,gBACE,cACE,UACA,OAAO,IAAI,aAAa;GACtB,MAAM,OAAO,OAAO;GACpB,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,QAAQ,SAAS;GAC3E,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,QAAQ,SAAS;GAE3E,MAAM,OAAM,OADY,YAAY,SAAS,iBAAiB,KAAK,EAAA,CAC9C;GAErB,IACE,QAAQ,KAAA,KACR,CAAC,QAAQ,QAAQ,eAAe,IAAI,QAAQ,QAAQ,OAAO,KAC3D,IAAI,QAAQ,QAAQ,sBAAsB,QAAQ,kBAElD,OAAO,OAAO,eAAe;GAC/B,MAAM,mBAAmB,OAAO;GAEhC,IACE,SAAS,cAAc,gBAAgB,KACrC,SAAS,cAAc,QAAQ,SAAS,KAC1C,SAAS,cAAc,gBAAgB,KACrC,SAAS,cAAc,QAAQ,iBAAiB,GAElD,OAAO,OAAO,eAAe;GAiB/B,KAAI,OAfmB,KACpB,OAAO,EAAE,WAAW,UAAU,UAAU,CAAC,CAAC,CAC1C,KAAK,QAAQ,UAAU,KAAK,CAAC,CAC7B,MACC,IACE,GAAG,UAAU,WAAW,eAAe,GACvC,GAAG,UAAU,WAAW,eAAe,GACvC,GACE,UAAU,mBACV,QAAQ,UAAU,cAAc,gBAAgB,CAClD,CACF,CACF,CAAC,CACA,MAAM,CAAC,EAAA,CAEE,SAAS,GAAG,OAAO,OAAO,eAAe;EACvD,CAAC,CACH,CACF;EACF,SACE,OACA,YAEA,MACE,UACA,SACA,QAAQ,sBACR,OAAO,IAAI,aAAa;GACtB,MAAM,cAAc,OAAO;GAC3B,MAAM,UAAU,OAAO;GACvB,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;GACzE,MAAM,OAAO,OAAO,YAAY,SAAS,iBAAiB,IAAI,EAAA,CAAG;GAEjE,IACE,QAAQ,KAAA,KACR,CAAC,QAAQ,QAAQ,eAAe,IAAI,QAAQ,QAAQ,OAAO,KAC3D,IAAI,QAAQ,QAAQ,sBAAsB,MAAM,0BAEhD,OAAO,OAAO,MAAM;GACtB,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;GAEzE,MAAM,WAAW,OAAO,YACrB,OAAO,CAAC,CACR,KAAK,QAAQ,UAAU,KAAK,CAAC,CAC7B,MACC,IACE,GAAG,UAAU,WAAW,eAAe,GACvC,GAAG,UAAU,WAAW,eAAe,CACzC,CACF,CAAC,CACA,MAAM,CAAC;GAEV,MAAM,UAAU,QAAQ,KAAA,GAAW,OAAO;GAE1C,IAAI,SAAS,OAAO,KAAA,GAClB,OAAO,YAAY,OAAO,QAAQ,UAAU,KAAK,CAAC,CAAC,OACjD,QAAQ,UAAU,aAAa;IAC7B,WAAW;IACX,WAAW;IACX,mBAAmB,MAAM;GAC3B,CAAC,CACH;QACG;IACH,MAAM,iBAAiB,OAAO,QAAQ,UAAU,cAC9C,SAAS,EAAE,CAAC,QAAQ,UAAU,kBAChC;IAEA,IACE,SAAS,cAAc,MAAM,iBAAiB,IAC9C,SAAS,cAAc,cAAc,GAErC,OAAO,YACJ,OAAO,QAAQ,UAAU,KAAK,CAAC,CAC/B,IACC,aAAkB,CAChB,CACE,QAAQ,UAAU,mBAClB,QAAQ,UAAU,cAAc,MAAM,iBAAiB,CACzD,CACF,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,UAAU,WAAW,eAAe,GACvC,GAAG,UAAU,WAAW,eAAe,CACzC,CACF;GACN;GAEA,OAAO;EACT,CAAC,CACH;EACF,YACE,OACA,YAEA,MACE,UACA,SACA,QAAQ,sBACR,OAAO,IAAI,aAAa;GACtB,MAAM,cAAc,OAAO;GAC3B,MAAM,UAAU,OAAO;GACvB,MAAM,kBAAkB,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;GACzE,MAAM,OAAO,OAAO,YAAY,SAAS,iBAAiB,IAAI,EAAA,CAAG;GAEjE,IACE,QAAQ,KAAA,KACR,CAAC,QAAQ,QAAQ,eAAe,IAAI,QAAQ,QAAQ,OAAO,KAC3D,IAAI,QAAQ,QAAQ,sBAAsB,MAAM,0BAEhD,OAAO,OAAO,MAAM;GACtB,MAAM,mBAAmB,QAAQ,QAAQ;GAEzC,MAAM,OAAO,OAAO,SAClB,QAAQ,MACR,QAAQ,QAAQ,uBAAuB,MAAM,wBAAwB,GACrE,qBAAqB,KAAA,IACjB,KAAA,UACM,iBAAiB,MAAM,wBAAwB,CAC3D;GAEA,MAAM,UAAU,QAAQ,KAAA,GAAW,OAAO;GAE1C,OAAO,YACJ,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAC7B,IAAI,aAAkB,CAAC,CAAC,QAAQ,QAAQ,kBAAkB,IAAI,CAAC,CAAC,CAAC,CAAC,CAClE,MACC,IACE,GAAG,QAAQ,WAAW,eAAe,GACrC,GAAG,QAAQ,iBAAiB,MAAM,wBAAwB,CAC5D,CACF;GAEF,OAAO;EACT,CAAC,CACH;CACJ;CAEA,OAAO;EACL,SAAS,SAAS,QAChB,QAAQ,OAAO,SAAS,GAAG,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;EAChF,SAAS,OAAO,YACd,QAAQ,OAAO,OAAO,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;EAClF,YAAY,OAAO,YACjB,QAAQ,UAAU,OAAO,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CACvF;AACF,CAAC;AAEH,MAAM,iBAAiB,YACrB,OAAO,YACL;CACE;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC,CAAC,KAAK,QAAQ,CAAC,KAAK,OAAO,QAAQ,OAAO,OAAO,QAAQ,OAAO,IAAI,CAAC,CAAC,CACzE;AAEF,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,QACA,SACA,WACA;CACA,MAAM,WAAW,OAAO;CAExB,OAAO,OAAO,WACZ,SACG,OAAO,CAAC,CACR,KAAK,QAAQ,OAAO,KAAK,CAAC,CAC1B,MACC,IACE,GAAG,cAAc,OAAO,CAAC,CAAC,QAAQ,MAAM,GACxC,cAAc,KAAA,IACV,KAAA,IACA,GAAG,cAAc,OAAO,CAAC,CAAC,WAAW,QAAQ,OAAO,cAAc,SAAS,CAAC,CAClF,CACF,CAAC,CACA,MAAM,CAAC,GACV,OACF,CAAC,CAAC,KAAK,OAAO,KAAK,SAAS,KAAK,EAAE,CAAC;AACtC,CAAC;AAED,MAAM,kBAAkB,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,SACA,UACA,SACA;CACA,MAAM,UAAU,OAAO,iBACrB,SACA,SAAS,WACT,SAAS,YAAY,KAAK,MAAM,EAAE,YAAY,GAC9C,OACF;CAEA,IAAI,CAAC,mBAAmB,QAAQ,UAAU,QAAQ,GAAG,OAAO,OAAO,MAAM;CACzE,MAAM,cAAc,OAAO,QAAQ,QAAQ,kBAAkB,QAAQ,OAAO;CAE5E,OAAO;EACL,iBAAiB,OAAO,QAAQ,UAAU,SAAS,SAAS,SAAS;EACrE;CACF;AACF,CAAC;AAED,MAAM,eAAe,OAAO,GAAG,sBAAsB,CAAC,CAAC,WACrD,SACA,QACA,iBACA,KACA,SACA;CACA,MAAM,WAAW,OAAO;CAExB,IAAI,CAAC,iBAAiB,QAAQ,QAAQ,OAAO,MAAM,GAAG,GACpD,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;CAC5C,MAAM,SAAS,QAAQ;CAEvB,IAAI,OAAO,SAAS,mBAAmB,OAAO;EAAE,iBAAiB,KAAA;EAAW,KAAK,KAAA;CAAU;CAC3F,MAAM,kBAAkB,OAAO,OAAO,UAAU,SAAS,OAAO,eAAe;CAE/E,IAAI,OAAO,SAAS,uBAAuB;EACzC,MAAM,IAAI,OAAO;EAiBjB,KAAI,OAfiB,WACnB,SACG,OAAO,CAAC,CACR,KAAK,EAAE,KAAK,CAAC,CACb,MACC,IACE,GAAG,OAAO,EAAE,OAAO,EAAE,SAAS,GAAG,eAAe,GAChD,GAAG,OAAO,EAAE,OAAO,EAAE,SAAS,GAAG,eAAe,GAChD,GAAG,OAAO,EAAE,OAAO,EAAE,iBAAiB,GAAG,EAAE,cAAc,GAAG,CAAC,CAC/D,CACF,CAAC,CACA,MAAM,CAAC,GACV,OACF,EAAA,CAEU,SAAS,GAAG,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;EAEhE,OAAO;GAAE;GAAiB,KAAK,KAAA;EAAU;CAC3C;CAEA,MAAM,IAAI,OAAO,SACf,IAAI,eAAe,MAAM;CAE3B,MAAM,OAAO,OAAO,WAClB,SACG,OAAO,CAAC,CACR,KAAK,EAAE,KAAK,CAAC,CACb,MACC,IACE,GAAG,EAAE,WAAW,eAAe,GAC/B,GAAG,EAAE,WAAW,eAAe,GAC/B,GAAG,EAAE,kBAAkB,OAAO,SAAS,gBAAgB,GACvD,GAAG,OAAO,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,uBAAuB,GACvE,GAAG,OAAO,EAAE,OAAO,EAAE,eAAe,GAAG,EAAE,cAAc,OAAO,qBAAqB,CAAC,GACpF,GAAG,EAAE,WAAW,EAAE,cAAc,OAAO,eAAe,CAAC,GACvD,GAAG,EAAE,mBAAmB,EAAE,cAAc,OAAO,uBAAuB,CAAC,GACvE,GAAG,EAAE,WAAW,EAAE,cAAc,GAAG,CAAC,GACpC,GAAG,EAAE,mBAAmB,EAAE,cAAc,GAAG,CAAC,CAC9C,CACF,CAAC,CACA,MAAM,CAAC,GACV,OACF,EAAA,CAAG;CAEH,IAAI,QAAQ,KAAA,GAAW,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;CAEjE,OAAO;EAAE;EAAiB;CAAI;AAChC,CAAC;AAED,MAAM,gBAAgB,OAAO,GAAG,oBAAoB,CAAC,CAAC,WACpD,SACA,QACA,SACA;CACA,MAAM,QAAQ,OAAO,cAAc,SAAS,QAAQ,KAAK;CAEzD,IAAI,UAAU,KAAA,GAAW,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;CACnE,MAAM,SAAS,OAAO,mBAAmB,MAAM,QAAQ,OAAO,SAAS;CACvE,MAAM,YAAY,OAAO,gBAAgB,SAAS,OAAO,UAAU,OAAO;CAE1E,MAAM,SAAS,OAAO,aACpB,SACA,QACA,UAAU,iBACV,OAAO,UACP,OACF;CAEA,MAAM,MAAM,OAAO,cAAc,SAAS,QAAQ,SAAS,OAAO,SAAS;CAC3E,MAAM,IAAI,QAAQ;CAElB,IACE,QAAQ,KAAA,KACR,IAAI,EAAE,cAAc,MAAM,EAAE,aAC5B,IAAI,EAAE,aAAa,OAAO,WAC1B,IAAI,EAAE,YAAY,OAAO,UACzB,WAAW,OAAO,UAClB,IAAI,EAAE,YAAY,OAAO,UACzB,IAAI,EAAE,mBAAmB,OAAO,iBAChC,CAAC,QAAQ,UAAU,OAAO,IAAI,EAAE,YAAY,UAAU,eAAe,KACrE,QAAQ,IAAI,EAAE,SAAS,KACvB,CAAC,OAAO,GAAG,OAAO,OAAO,CAAC,CAAC,IAAI,EAAE,eAAe,KAChD,IAAI,EAAE,mBAAmB,IAAI,EAAE,iBAC/B,IAAI,EAAE,kBAAkB,OAAO,gBAC/B,CAAC,iBAAiB,QAAQ,QAAQ,OAAO,MAAM,OAAO,QAAQ,GAE9D,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;CAE5C,OAAO;EAAE;EAAK;EAAQ;EAAQ,GAAG;CAAU;AAC7C,CAAC;AAKD,MAAM,4BAA4B,UAAoD;CACpF,MAAM,MAAM,OAAO,UAAU,YAAY,UAAU,OAAO,QAAQ,IAAI,OAAO,MAAM,IAAI,KAAA;CAEvF,OAAO,QAAQ,0BAA0B,QAAQ;AACnD;AAEA,MAAM,iCACJ,QACA,aAEA,OAAO,KACL,OAAO,YAAY,UAAU;CAC3B,IACE,MAAM,QAAQ,SAAS,KACvB,MAAM,QAAQ,OACX,WAAW,MAAM,aAAa,MAAM,KAAK,yBAAyB,OAAO,KAAK,CACjF,GAEA,OAAO,OAAO,QAAQ,QAAQ;CAEhC,OAAO,OAAO,UACZ,MAAM,IAAI,QAAQ,UAAW,yBAAyB,KAAK,IAAI,YAAY,IAAI,KAAM,CACvF;AACF,CAAC,CACH;;AAGF,MAAa,wBACX,UACA,SACA,YAEA,OAAO,IAAI,iBAAiB,UAAU;CACpC,MAAM,IAAI,QAAQ,QAChB,IAAI,cAAc,OAAO;CAE3B,MAAM,QAAQ,WACZ,gBACE,gBAAgB,cAAc,UAAU,cAAc,SAAS,QAAQ,QAAQ,OAAO,CAAC,CAAC,IACvF,UAAW,MAAM,SAAS,wBAAwB,qBAAqB,KAAK,CAAC,CAAC,IAAI,KACrF;CAEF,MAAM,UAAU;EACd,SACE,OACA,MACA,YAEA,MACE,UACA,SACA,QAAQ,sBACR,OAAO,IAAI,aAAa;GACtB,MAAM,KAAK,OAAO;GAClB,MAAM,UAAU,OAAO;GACvB,MAAM,YAAY,OAAO,gBAAgB,SAAS,MAAM,UAAU,QAAQ,OAAO;GACjF,MAAM,UAAU,OAAO,SAAS,QAAQ,MAAM,EAAE,iBAAiB,EAAE,mBAAmB;GACtF,MAAM,SAA8B;IAAE,GAAG;IAAO;GAAQ;GAExD,OAAO,aACL,SACA,QACA,UAAU,iBACV,OAAO,UACP,QAAQ,OACV;GAWA,KAAI,OAToB,WACtB,GACG,OAAO,CAAC,CACR,KAAK,EAAE,KAAK,CAAC,CACb,MAAM,GAAG,GAAG,EAAE,QAAQ,MAAM,MAAM,GAAG,GAAG,EAAE,QAAQ,MAAM,MAAM,CAAC,CAAC,CAAC,CACjE,MAAM,CAAC,GACV,QAAQ,OACV,EAAA,CAEa,SAAS,GAAG,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;GAC9D,MAAM,WAAW,OAAO,mBAAmB,MAAM;GAEjD,MAAM,SAAS;IACb,GAAG,EAAE,aAAa,QAAQ,EAAE,WAAW,UAAU,gBAAgB,CAAC;IAClE,GAAG,aAAkB;KACnB,CAAC,EAAE,QAAQ,OAAO,MAAM;KACxB,CAAC,EAAE,SAAS,OAAO;KACnB,CAAC,EAAE,QAAQ,OAAO,MAAM;KACxB,CAAC,EAAE,WAAW,UAAU,eAAe;KACvC,CAAC,EAAE,eAAe,OAAO,aAAa;KACtC,CAAC,EAAE,UAAU,QAAQ;KACrB,CAAC,EAAE,WAAW,EAAE,cAAc,OAAO,SAAS,CAAC;KAC/C,CAAC,EAAE,cAAc,OAAO,YAAY;KACpC,CAAC,EAAE,gBAAgB,CAAC;KACpB,CAAC,EAAE,UAAU,KAAK;IACpB,CAAC;GACH;GAEA,MAAM,UAAU,QAAQ,QAAQ,OAAO;GAEvC,OAAO,GAAG,OAAO,EAAE,KAAK,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,KAAK,kBAAkB,OAAO,CAAC;GAqBxE,KAnBkB,OAAO,GACtB,OAAO,CAAC,CACR,KAAK,EAAE,KAAK,CAAC,CACb,MACC,IACE,GAAG,EAAE,QAAQ,OAAO,MAAM,GAC1B,GAAG,EAAE,SAAS,OAAO,GACrB,GAAG,EAAE,QAAQ,OAAO,MAAM,GAC1B,GAAG,EAAE,WAAW,UAAU,eAAe,GACzC,GAAG,EAAE,eAAe,OAAO,aAAa,GACxC,GAAG,EAAE,UAAU,QAAQ,GACvB,GAAG,EAAE,WAAW,EAAE,cAAc,OAAO,SAAS,CAAC,GACjD,GAAG,EAAE,cAAc,OAAO,YAAY,GACtC,GAAG,EAAE,gBAAgB,CAAC,GACtB,GAAG,EAAE,UAAU,KAAK,CACtB,CACF,CAAC,CACA,MAAM,CAAC,EAAA,CAAG,OAEI,KAAA,GAAW,OAAO,OAAO,YAAY;GAEtD,OAAO;EACT,CAAC,CACH,CAAC,CAAC,MAAM,WACN,gBAAgB,SAAS,UACvB,MAAM,SAAS,yBAAyB,MAAM,IAAI,KACpD,CACF;EACF,UAAU,UACR,gBACE,KAAK,MAAM,MAAM,CAAC,CAAC,KACjB,OAAO,SAAS,EAAE,aAChB,qCAAqC;GACnC,QAAQ,OAAO;GACf,eAAe,OAAO;GACtB,UAAU,OAAO;GACjB,iBAAiB,SAAS,cAAc,OAAO,SAAS;EAC1D,CAAC,CACH,CACF,IACC,UAAW,MAAM,SAAS,iCAAiC,YAAY,IAAI,KAC9E;EACF,OAAO,UACL,KAAK,MAAM,MAAM,CAAC,CAAC,KACjB,OAAO,SAAS,UACd,MAAM,OAAO,kBAAkB,MAAM,gBACjC,OAAO,QAAQ,MAAM,MAAM,IAC3B,OAAO,KAAK,qBAAqB,KAAK,CAAC,CAAC,CAAC,CAC/C,CACF;EACF,SACE,OACA,YAEA,MACE,UACA,SACA,QAAQ,sBACR,OAAO,IAAI,aAAa;GACtB,MAAM,KAAK,OAAO;GAClB,MAAM,UAAU,OAAO;GAEvB,MAAM,WAAW,OAAO,8BACtB,cAAc,SAAS,MAAM,QAAQ,QAAQ,OAAO,CAAC,CAAC,KACpD,OAAO,KAAK,WAAW;IAAE,MAAM;IAAkB;GAAM,EAAE,CAC3D,GACA,EAAE,MAAM,WAAoB,CAC9B;GAEA,IAAI,SAAS,SAAS,YAAY,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,OAAO;GAC9E,MAAM,EAAE,KAAK,WAAW,SAAS;GACjC,MAAM,UAAU,QAAQ,EAAE,MAAM,WAAW,GAAG,OAAO;GAErD,OAAO,GACJ,OAAO,EAAE,KAAK,CAAC,CACf,IAAI,aAAkB,CAAC,CAAC,EAAE,gBAAgB,GAAG,GAAG,EAAE,eAAe,KAAK,CAAC,CAAC,CAAC,CAAC,CAC1E,MACC,IACE,GAAG,EAAE,QAAQ,MAAM,MAAM,GACzB,GAAG,EAAE,UAAU,IAAI,EAAE,SAAS,GAC9B,GAAG,EAAE,SAAS,OAAO,OAAO,GAC5B,GAAG,EAAE,UAAU,KAAK,GACpB,GAAG,GAAG,EAAE,eAAe,KAAK,EAAE,cAChC,CACF;GACF,MAAM,UAAU,OAAO,cAAc,SAAS,MAAM,QAAQ,KAAK;GAEjE,IACE,YAAY,KAAA,KACZ,QAAQ,EAAE,aAAa,OAAO,WAC9B,QAAQ,EAAE,cAAc,IAAI,EAAE,aAC9B,QAAQ,EAAE,oBAAoB,IAAI,EAAE,kBAAkB,GAEtD,OAAO,OAAO,YAAY;GAE5B,OAAO;EACT,CAAC,CACH;EACF,WACE,MACA,YAEA,MACE,UACA,SACA,QAAQ,sBACR,OAAO,IAAI,aAAa;GACtB,MAAM,KAAK,OAAO;GAClB,MAAM,UAAU,OAAO;GAEvB,OAAO,mBAAmB,IAAI;GAG9B,MAAM,UAAU,OAAO,gBACrB,SACA,KAAK,SAAS,UACd,QAAQ,OACV;GAEA,MAAM,SAAS,OAAO,cAAc,SAAS,KAAK,OAAO,QAAQ,QAAQ,OAAO;GAEhF,KACG,OAAO,mBAAmB,OAAO,MAAM,QACvC,OAAO,mBAAmB,KAAK,MAAM,IAEtC,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;GAE5C,MAAM,OAAO,OAAO,qBAAqB,KAAK,UAAU,QAAQ,WAAW,CAAC,CAAC,KAC3E,OAAO,eAAe,MAAM,CAAC,CAC/B;GAEA,MAAM,UAAU,OAAO,qBACrB,KAAK,UACL,OAAO,OAAO,WAChB,CAAC,CAAC,KAAK,OAAO,eAAe,MAAM,CAAC,CAAC;GAErC,IAAI,CAAC,KAAK,aAAa,CAAC,QAAQ,WAAW,OAAO,OAAO,MAAM;GAE/D,MAAM,cAAc,KAAK,aACvB,MAAM,OAAO;GAEf,IACE,SAAS,cAAc,YAAY,WAAW,QAAQ,SAAS,IAC7D,SAAS,cAAc,OAAO,OAAO,uBAAuB,KAC9D,SAAS,cAAc,GAAG,IACxB,SAAS,cAAc,YAAY,WAAW,QAAQ,QAAQ,KAChE,SAAS,cAAc,GAAG,KACxB,KAAK,IACH,SAAS,cAAc,YAAY,WAAW,QAAQ,SAAS,GAC/D,SAAS,cAAc,OAAO,OAAO,SAAS,CAChD,GAEF,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;GAC5C,IAAI;GAEJ,IAAI,YAAY,SAAS,YAAY;IACnC,IAAI,QAAQ,OAAO,SAAS,YAAY,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;IAElF,MAAM,IAAI,QAAQ,OAAO,SACvB,MAAM,OAAO,OAAO;IAEtB,IACE,IAAI,EAAE,YAAY,YAAY,kBAC9B,IAAI,EAAE,aAAa,YAAY,oBAE/B,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;IAEvC,MAAM,UAAU,OAAO,SACrB,QAAQ,MACR,EAAE,iBACF,EAAE,mBACJ;IAEA,MAAM,OAAsC;KAC1C,GAAG,YAAY,WAAW;KAC1B,YAAY,YAAY,WAAW;KACnC,mBAAmB,YAAY,WAAW;KAC1C,QAAQ,YAAY;KACpB;IACF;IAEA,WAAW;KACT,GAAG,EAAE,eAAe,IAAI;KACxB,GAAG,aAAkB;MACnB,CAAC,EAAE,SAAS,OAAO;MACnB,CAAC,EAAE,QAAQ,KAAK,MAAM;MACtB,CAAC,EAAE,mBAAmB,KAAK,iBAAiB;MAC5C,CAAC,EAAE,iBAAiB,EAAE,cAAc,KAAK,UAAU,eAAe,CAAC;MACnE,CAAC,EAAE,UAAU,EAAE,cAAc,KAAK,QAAQ,CAAC;MAC3C,CAAC,EAAE,WAAW,EAAE,cAAc,KAAK,SAAS,CAAC;MAC7C,CAAC,EAAE,mBAAmB,EAAE,cAAc,KAAK,iBAAiB,CAAC;KAC/D,CAAC;IACH;GACF;GAEA,MAAM,oBAAoB,OAAO,SAC/B,QAAQ,MACR,EAAE,iBACF,EAAE,mBACJ;GAEA,IAAI,sBAAsB,OAAO,OAAO,SAAS,OAAO,OAAO,YAAY;GAE3E,MAAM,qBAAqB,OAAO,mBAAmB;IACnD,GAAG,OAAO;IACV,SAAS;GACX,CAAC;GAED,MAAM,UAAU,QAAQ,YAAY,YAAY,OAAO;GAEvD,IAAI,YAAY,SAAS,cAAc,QAAQ,OAAO,SAAS,YAAY;IACzE,MAAM,IAAI,QAAQ,OAAO,SACvB,KAAK,eAAe,QAAQ,MAAM;IAEpC,OAAO,GACJ,OAAO,EAAE,KAAK,CAAC,CACf,IAAI,QAAQ,CAAC,CACb,MACC,IACE,GAAG,GAAG,WAAW,OAAO,OAAO,eAAe,GAC9C,GAAG,GAAG,QAAQ,YAAY,cAAc,GACxC,GAAG,GAAG,SAAS,YAAY,kBAAkB,CAC/C,CACF;IAEF,MAAM,WAAW,OAAO,GACrB,OAAO,CAAC,CACR,KAAK,EAAE,KAAK,CAAC,CACb,MAAM,GAAG,GAAG,WAAW,OAAO,OAAO,eAAe,CAAC,CAAC,CACtD,MAAM,CAAC,EAAA,CAAG;IAEb,IAAI,YAAY,KAAA,KAAa,QAAQ,EAAE,aAAa,SAAS,EAAE,UAC7D,OAAO,OAAO,YAAY;IAC5B,MAAM,UAAU,OAAO,EAAE,OAAO,OAAO;IAEvC,IAAI,QAAQ,YAAY,SAAS,EAAE,YAAY,CAAC,sBAAsB,MAAM,OAAO,GACjF,OAAO,OAAO,YAAY;GAC9B,OAAO,IACL,YAAY,SAAS,yBACrB,QAAQ,OAAO,SAAS,uBACxB;IACA,MAAM,IAAI,QAAQ,OAAO;IAEzB,MAAM,QAAQ,OAAO,EAAE,OAAO,EAAE,SAAS,GACvC,KAAK,OAAO,EAAE,OAAO,EAAE,SAAS,GAChC,SAAS,OAAO,EAAE,OAAO,EAAE,iBAAiB;IAE9C,OAAO,GACJ,OAAO,EAAE,KAAK,CAAC,CACf,MACC,IACE,GAAG,OAAO,OAAO,eAAe,GAChC,GAAG,IAAI,OAAO,OAAO,eAAe,GACpC,IAAI,QAAQ,EAAE,cAAc,OAAO,QAAQ,CAAC,CAC9C,CACF;IAEF,MAAM,SAAS,EAAE,aAAa;KAC5B,WAAW,OAAO;KAClB,WAAW,OAAO,OAAO;KACzB,mBAAmB,YAAY;IACjC,CAAC;IAED,OAAO,GAAG,OAAO,EAAE,KAAK,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,KAAK,kBAAkB,OAAO,CAAC;IAcxE,KAZkB,OAAO,GACtB,OAAO,CAAC,CACR,KAAK,EAAE,KAAK,CAAC,CACb,MACC,IACE,GAAG,OAAO,OAAO,eAAe,GAChC,GAAG,IAAI,OAAO,OAAO,eAAe,GACpC,GAAG,QAAQ,EAAE,cAAc,YAAY,cAAc,CAAC,CACxD,CACF,CAAC,CACA,MAAM,CAAC,EAAA,CAAG,OAEI,KAAA,GAAW,OAAO,OAAO,YAAY;GACxD;GACA,OAAO,GACJ,OAAO,EAAE,KAAK,CAAC,CACf,IACC,aAAkB;IAChB,CAAC,EAAE,UAAU,IAAI;IACjB,CAAC,EAAE,SAAS,iBAAiB;IAC7B,CAAC,EAAE,UAAU,kBAAkB;GACjC,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,EAAE,QAAQ,OAAO,OAAO,MAAM,GACjC,GAAG,EAAE,SAAS,OAAO,OAAO,OAAO,GACnC,GAAG,EAAE,UAAU,OAAO,IAAI,EAAE,SAAS,GACrC,GAAG,EAAE,UAAU,KAAK,GACpB,GAAG,EAAE,gBAAgB,OAAO,IAAI,EAAE,eAAe,CACnD,CACF;GACF,MAAM,YAAY,OAAO,cAAc,SAAS,OAAO,OAAO,QAAQ,KAAK;GAE3E,IACE,cAAc,KAAA,KACd,CAAC,UAAU,EAAE,aACb,UAAU,EAAE,aAAa,qBACzB,UAAU,EAAE,cAAc,oBAE1B,OAAO,OAAO,YAAY;GAC5B,MAAM,YAAY,OAAO;GAEzB,IACE,CAAC,iBAAiB,OAAO,QAAQ,QAAQ,OAAO,MAAM,SAAS,KAC/D,SAAS,cAAc,SAAS,KAC9B,SAAS,cAAc,YAAY,WAAW,QAAQ,SAAS,KACjE,EAAE,OAAO,qBAAqB,KAAK,UAAU,QAAQ,WAAW,CAAC,CAAC,KAChE,OAAO,eAAe,MAAM,CAAC,CAC/B,EAAA,CAAG,aACH,EAAE,OAAO,qBAAqB,KAAK,UAAU,OAAO,OAAO,WAAW,CAAC,CAAC,KACtE,OAAO,eAAe,MAAM,CAAC,CAC/B,EAAA,CAAG,WAEH,OAAO,OAAO,MAAM;GAEtB,OAAO;EACT,CAAC,CACH;CACJ;CAEA,OAAO;EACL,SAAS,OAAO,KAAK,YACnB,QAAQ,OAAO,OAAO,KAAK,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;EACvF,UAAU,UAAU,QAAQ,QAAQ,KAAK,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;EAC5F,OAAO,UAAU,QAAQ,KAAK,KAAK,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;EACtF,SAAS,OAAO,YACd,QAAQ,OAAO,OAAO,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;EAClF,WAAW,MAAM,YACf,QAAQ,SAAS,MAAM,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CACrF;AACF,CAAC"}

package/dist/drizzle/session-target.d.mts

@@ -0,0 +1,37 @@
+import "../Schema.mjs";
+import "../hooks/models.mjs";
+import { LifecycleHooks } from "../hooks/LifecycleHooks.mjs";
+import "../sessions/errors.mjs";
+import { AuthenticationAuthority } from "../sessions/AuthenticationAuthority.mjs";
+import { PendingAuthentication } from "../sessions/PendingAuthentication.mjs";
+import "../Operations.mjs";
+import { SessionRepository, SignedSessionValidity, StatefulSessionPersistence } from "../sessions/persistence.mjs";
+import "../sessions/SessionStepUpPersistence.mjs";
+import "../Hooks.mjs";
+import "../Sessions.mjs";
+import { Context, Effect, Layer } from "effect";
+import "effect/unstable/sql/SqlError";
+//#region src/drizzle/session-target.d.ts
+declare const authenticationAuthorityLayer: (services: Effect.Effect<{
+  readonly authenticationAuthority: AuthenticationAuthority["Service"];
+}, never, LifecycleHooks>) => Layer.Layer<AuthenticationAuthority, never, LifecycleHooks>;
+declare const statefulSessionLayers: <Claims>(module: {
+  readonly StatefulSessionPersistence: any;
+  readonly SessionRepository: any;
+}, services: Effect.Effect<{
+  readonly statefulSessionPersistence: StatefulSessionPersistence<Claims>;
+  readonly sessionRepository: SessionRepository;
+}, never, LifecycleHooks>) => Layer.Layer<unknown, never, LifecycleHooks>;
+declare const pendingAuthenticationLayer: <Claims>(module: {
+  readonly PendingAuthentication: any;
+}, services: Effect.Effect<{
+  readonly pendingAuthentication: PendingAuthentication<Claims>;
+}, never, LifecycleHooks>) => Layer.Layer<unknown, never, LifecycleHooks>;
+declare const signedSessionValidityLayer: (module: {
+  readonly SignedSessionValidity: any;
+}, services: Effect.Effect<{
+  readonly signedSessionValidity: SignedSessionValidity;
+}, never, LifecycleHooks>) => Layer.Layer<unknown, never, LifecycleHooks>;
+//#endregion
+export { authenticationAuthorityLayer, pendingAuthenticationLayer, signedSessionValidityLayer, statefulSessionLayers };
+//# sourceMappingURL=session-target.d.mts.map

package/dist/drizzle/session-target.mjs

@@ -0,0 +1,47 @@
+import { SessionUnavailable } from "../sessions/errors.mjs";
+import { coordinateCommit, hasCommitScope } from "../hooks/commit.mjs";
+import { AuthenticationAuthority } from "../sessions/AuthenticationAuthority.mjs";
+import { CurrentSessionSql, makeSqlAuthenticationAuthority, makeSqlPendingAuthentication, makeSqlSessionStepUp, makeSqlSignedValidity, makeSqlStatefulSessions } from "./session-sql.mjs";
+import { sqlClientStandaloneGuard } from "./standalone-guard.mjs";
+import { Effect, Layer } from "effect";
+//#region src/drizzle/session-target.ts
+const sqlClientSessionStandaloneGuard = (database) => sqlClientStandaloneGuard(database, () => SessionUnavailable.make({}));
+const options = (configuration, transactionBound = false) => ({
+	mode: configuration.mode,
+	locking: configuration.locking,
+	standaloneGuard: transactionBound ? Effect.void : configuration.standaloneGuard
+});
+const makeTargetAuthenticationAuthorityServices = (database, mapping, configuration) => Effect.map(makeSqlAuthenticationAuthority(database, mapping, options(configuration)), (authenticationAuthority) => ({ authenticationAuthority }));
+const makeTargetPendingAuthenticationServices = (database, mapping, configuration) => Effect.map(makeSqlPendingAuthentication(database, mapping, options(configuration)), (pendingAuthentication) => ({ pendingAuthentication }));
+const makeTargetStatefulSessionServices = (database, mapping, configuration) => makeSqlStatefulSessions(database, mapping, options(configuration));
+const makeTargetSignedSessionValidityServices = (database, mapping, configuration) => Effect.map(makeSqlSignedValidity(database, mapping, options(configuration)), (signedSessionValidity) => ({ signedSessionValidity }));
+/**
+* The native transaction is the root commit owner. Interruption or owner
+* failure rolls it back and discards the child journal; this adapter performs
+* no hidden retry. A caller that can safely retry must rerun the complete owner
+* operation and prepare fresh bearer material. The low-level coordinator keeps
+* caller failures intact, including Drizzle query wrappers, and exposes a
+* native `SqlError` when transaction acquisition fails. Captured service
+* operations normalize their own driver failures to `SessionUnavailable`.
+*/
+const coordinate = (database, configuration, make, owner) => Effect.gen(function* () {
+	if (yield* hasCommitScope) return yield* SessionUnavailable.make({});
+	yield* configuration.coordinatorGuard ?? configuration.standaloneGuard;
+	return (yield* coordinateCommit(() => database.transaction((transaction) => Effect.gen(function* () {
+		return yield* owner(transaction, yield* make(transaction));
+	}).pipe(Effect.provideService(CurrentSessionSql, transaction))), { mode: configuration.mode })).value;
+});
+const coordinateTargetAuthenticationAuthority = (database, mapping, configuration, owner) => coordinate(database, configuration, (transaction) => Effect.map(makeSqlAuthenticationAuthority(transaction, mapping, options(configuration, true)), (authenticationAuthority) => ({ authenticationAuthority })), owner);
+const coordinateTargetPendingAuthentication = (database, mapping, configuration, owner) => coordinate(database, configuration, (transaction) => Effect.map(makeSqlPendingAuthentication(transaction, mapping, options(configuration, true)), (pendingAuthentication) => ({ pendingAuthentication })), owner);
+const coordinateTargetStatefulSessions = (database, mapping, configuration, owner) => coordinate(database, configuration, (transaction) => makeSqlStatefulSessions(transaction, mapping, options(configuration, true)), owner);
+const coordinateTargetSignedSessionValidity = (database, mapping, configuration, owner) => coordinate(database, configuration, (transaction) => Effect.map(makeSqlSignedValidity(transaction, mapping, options(configuration, true)), (signedSessionValidity) => ({ signedSessionValidity })), owner);
+const authenticationAuthorityLayer = (services) => Layer.effect(AuthenticationAuthority, Effect.map(services, (value) => value.authenticationAuthority));
+const statefulSessionLayers = (module, services) => Layer.merge(Layer.effect(module.StatefulSessionPersistence, Effect.map(services, (value) => value.statefulSessionPersistence)), Layer.effect(module.SessionRepository, Effect.map(services, (value) => value.sessionRepository)));
+const pendingAuthenticationLayer = (module, services) => Layer.effect(module.PendingAuthentication, Effect.map(services, (value) => value.pendingAuthentication));
+const signedSessionValidityLayer = (module, services) => Layer.effect(module.SignedSessionValidity, Effect.map(services, (value) => value.signedSessionValidity));
+const makeTargetSessionStepUpServices = (database, mapping, target, configuration) => Effect.map(makeSqlSessionStepUp(database, mapping, options(configuration)), (sessionStepUpPersistence) => ({ sessionStepUpPersistence: target.of(sessionStepUpPersistence) }));
+const coordinateTargetSessionStepUp = (database, mapping, target, configuration, owner) => coordinate(database, configuration, (transaction) => Effect.map(makeSqlSessionStepUp(transaction, mapping, options(configuration, true)), (sessionStepUpPersistence) => ({ sessionStepUpPersistence: target.of(sessionStepUpPersistence) })), owner);
+//#endregion
+export { authenticationAuthorityLayer, coordinateTargetAuthenticationAuthority, coordinateTargetPendingAuthentication, coordinateTargetSessionStepUp, coordinateTargetSignedSessionValidity, coordinateTargetStatefulSessions, makeTargetAuthenticationAuthorityServices, makeTargetPendingAuthenticationServices, makeTargetSessionStepUpServices, makeTargetSignedSessionValidityServices, makeTargetStatefulSessionServices, pendingAuthenticationLayer, signedSessionValidityLayer, sqlClientSessionStandaloneGuard, statefulSessionLayers };
+
+//# sourceMappingURL=session-target.mjs.map

package/dist/drizzle/session-target.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-target.mjs","names":[],"sources":["../../src/drizzle/session-target.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- target entrypoints restore each concrete Drizzle database/table type. */\nimport { type Context, Effect, Layer } from \"effect\";\nimport type * as SqlError from \"effect/unstable/sql/SqlError\";\n\nimport { coordinateCommit, hasCommitScope } from \"../hooks/commit\";\nimport type { LifecycleHooks } from \"../hooks/LifecycleHooks\";\nimport type { HookConfigurationError } from \"../hooks/models\";\nimport { AuthenticationAuthority } from \"../sessions/AuthenticationAuthority\";\nimport { SessionUnavailable } from \"../sessions/errors\";\nimport type { PendingAuthentication } from \"../sessions/PendingAuthentication\";\nimport type {\n  SessionRepository,\n  SignedSessionValidity,\n  StatefulSessionPersistence,\n} from \"../sessions/persistence\";\nimport type { SessionStepUpPersistence } from \"../sessions/SessionStepUpPersistence\";\nimport {\n  makeSqlAuthenticationAuthority,\n  makeSqlPendingAuthentication,\n  makeSqlSignedValidity,\n  makeSqlStatefulSessions,\n  makeSqlSessionStepUp,\n  CurrentSessionSql,\n  type SessionSqlDatabase,\n  type SessionSqlOptions,\n} from \"./session-sql\";\nimport { sqlClientStandaloneGuard } from \"./standalone-guard\";\n\nexport interface SessionTargetConfiguration {\n  readonly mode: \"interactive\" | \"synchronous\";\n  readonly locking: boolean;\n  readonly standaloneGuard: Effect.Effect<void, SessionUnavailable>;\n  readonly coordinatorGuard?: Effect.Effect<void, SessionUnavailable>;\n}\n\ninterface TransactionOwner<Transaction> {\n  readonly transaction: <A, E, R>(\n    body: (transaction: Transaction) => Effect.Effect<A, E, R>,\n  ) => Effect.Effect<A, E | SqlError.SqlError, R>;\n}\n\ntype CoordinatorError<E> = E | SessionUnavailable | HookConfigurationError | SqlError.SqlError;\n\nexport const sqlClientSessionStandaloneGuard = (\n  database: unknown,\n): Effect.Effect<void, SessionUnavailable> =>\n  sqlClientStandaloneGuard(database, () => SessionUnavailable.make({}));\n\nconst options = (\n  configuration: SessionTargetConfiguration,\n  transactionBound = false,\n): SessionSqlOptions => ({\n  mode: configuration.mode,\n  locking: configuration.locking,\n  standaloneGuard: transactionBound ? Effect.void : configuration.standaloneGuard,\n});\n\nexport const makeTargetAuthenticationAuthorityServices = <Claims>(\n  database: any,\n  mapping: any,\n  configuration: SessionTargetConfiguration,\n) =>\n  Effect.map(\n    makeSqlAuthenticationAuthority<Claims>(database, mapping, options(configuration)),\n    (authenticationAuthority) => ({ authenticationAuthority }),\n  );\n\nexport const makeTargetPendingAuthenticationServices = <Claims>(\n  database: any,\n  mapping: any,\n  configuration: SessionTargetConfiguration,\n) =>\n  Effect.map(\n    makeSqlPendingAuthentication<Claims>(database, mapping, options(configuration)),\n    (pendingAuthentication) => ({ pendingAuthentication }),\n  );\n\nexport const makeTargetStatefulSessionServices = <Claims>(\n  database: any,\n  mapping: any,\n  configuration: SessionTargetConfiguration,\n) => makeSqlStatefulSessions<Claims>(database, mapping, options(configuration));\n\nexport const makeTargetSignedSessionValidityServices = (\n  database: any,\n  mapping: any,\n  configuration: SessionTargetConfiguration,\n) =>\n  Effect.map(\n    makeSqlSignedValidity(database, mapping, options(configuration)),\n    (signedSessionValidity) => ({\n      signedSessionValidity,\n    }),\n  );\n\n/**\n * The native transaction is the root commit owner. Interruption or owner\n * failure rolls it back and discards the child journal; this adapter performs\n * no hidden retry. A caller that can safely retry must rerun the complete owner\n * operation and prepare fresh bearer material. The low-level coordinator keeps\n * caller failures intact, including Drizzle query wrappers, and exposes a\n * native `SqlError` when transaction acquisition fails. Captured service\n * operations normalize their own driver failures to `SessionUnavailable`.\n */\nconst coordinate = <Transaction, Services, A, E, R>(\n  database: TransactionOwner<Transaction>,\n  configuration: SessionTargetConfiguration,\n  make: (transaction: Transaction) => Effect.Effect<Services, never, LifecycleHooks>,\n  owner: (transaction: Transaction, services: Services) => Effect.Effect<A, E, R>,\n): Effect.Effect<A, CoordinatorError<E>, R | LifecycleHooks> =>\n  Effect.gen(function* (): Effect.fn.Return<A, CoordinatorError<E>, R | LifecycleHooks> {\n    if (yield* hasCommitScope) return yield* SessionUnavailable.make({});\n    yield* configuration.coordinatorGuard ?? configuration.standaloneGuard;\n\n    const result = yield* coordinateCommit(\n      () =>\n        database.transaction((transaction) =>\n          Effect.gen(function* () {\n            const services = yield* make(transaction);\n\n            return yield* owner(transaction, services);\n          }).pipe(\n            Effect.provideService(CurrentSessionSql, transaction as unknown as SessionSqlDatabase),\n          ),\n        ),\n      { mode: configuration.mode },\n    );\n\n    return result.value;\n  });\n\nexport const coordinateTargetAuthenticationAuthority = <Claims, Transaction, A, E, R>(\n  database: TransactionOwner<Transaction>,\n  mapping: any,\n  configuration: SessionTargetConfiguration,\n  owner: (\n    transaction: Transaction,\n    services: { readonly authenticationAuthority: AuthenticationAuthority[\"Service\"] },\n  ) => Effect.Effect<A, E, R>,\n) =>\n  coordinate(\n    database,\n    configuration,\n    (transaction) =>\n      Effect.map(\n        makeSqlAuthenticationAuthority<Claims>(\n          transaction as unknown as SessionSqlDatabase,\n          mapping,\n          options(configuration, true),\n        ),\n        (authenticationAuthority) => ({ authenticationAuthority }),\n      ),\n    owner,\n  );\n\nexport const coordinateTargetPendingAuthentication = <Claims, Transaction, A, E, R>(\n  database: TransactionOwner<Transaction>,\n  mapping: any,\n  configuration: SessionTargetConfiguration,\n  owner: (\n    transaction: Transaction,\n    services: { readonly pendingAuthentication: PendingAuthentication<Claims> },\n  ) => Effect.Effect<A, E, R>,\n) =>\n  coordinate(\n    database,\n    configuration,\n    (transaction) =>\n      Effect.map(\n        makeSqlPendingAuthentication<Claims>(\n          transaction as unknown as SessionSqlDatabase,\n          mapping,\n          options(configuration, true),\n        ),\n        (pendingAuthentication) => ({ pendingAuthentication }),\n      ),\n    owner,\n  );\n\nexport const coordinateTargetStatefulSessions = <Claims, Transaction, A, E, R>(\n  database: TransactionOwner<Transaction>,\n  mapping: any,\n  configuration: SessionTargetConfiguration,\n  owner: (\n    transaction: Transaction,\n    services: {\n      readonly statefulSessionPersistence: StatefulSessionPersistence<Claims>;\n      readonly sessionRepository: SessionRepository;\n    },\n  ) => Effect.Effect<A, E, R>,\n) =>\n  coordinate(\n    database,\n    configuration,\n    (transaction) =>\n      makeSqlStatefulSessions<Claims>(\n        transaction as unknown as SessionSqlDatabase,\n        mapping,\n        options(configuration, true),\n      ),\n    owner,\n  );\n\nexport const coordinateTargetSignedSessionValidity = <Transaction, A, E, R>(\n  database: TransactionOwner<Transaction>,\n  mapping: any,\n  configuration: SessionTargetConfiguration,\n  owner: (\n    transaction: Transaction,\n    services: { readonly signedSessionValidity: SignedSessionValidity },\n  ) => Effect.Effect<A, E, R>,\n) =>\n  coordinate(\n    database,\n    configuration,\n    (transaction) =>\n      Effect.map(\n        makeSqlSignedValidity(\n          transaction as unknown as SessionSqlDatabase,\n          mapping,\n          options(configuration, true),\n        ),\n        (signedSessionValidity) => ({ signedSessionValidity }),\n      ),\n    owner,\n  );\n\nexport const authenticationAuthorityLayer = (\n  services: Effect.Effect<\n    {\n      readonly authenticationAuthority: AuthenticationAuthority[\"Service\"];\n    },\n    never,\n    LifecycleHooks\n  >,\n) =>\n  Layer.effect(\n    AuthenticationAuthority,\n    Effect.map(services, (value) => value.authenticationAuthority),\n  );\n\nexport const statefulSessionLayers = <Claims>(\n  module: {\n    readonly StatefulSessionPersistence: any;\n    readonly SessionRepository: any;\n  },\n  services: Effect.Effect<\n    {\n      readonly statefulSessionPersistence: StatefulSessionPersistence<Claims>;\n      readonly sessionRepository: SessionRepository;\n    },\n    never,\n    LifecycleHooks\n  >,\n) =>\n  Layer.merge(\n    Layer.effect(\n      module.StatefulSessionPersistence,\n      Effect.map(services, (value) => value.statefulSessionPersistence),\n    ),\n    Layer.effect(\n      module.SessionRepository,\n      Effect.map(services, (value) => value.sessionRepository),\n    ),\n  );\n\nexport const pendingAuthenticationLayer = <Claims>(\n  module: { readonly PendingAuthentication: any },\n  services: Effect.Effect<\n    {\n      readonly pendingAuthentication: PendingAuthentication<Claims>;\n    },\n    never,\n    LifecycleHooks\n  >,\n) =>\n  Layer.effect(\n    module.PendingAuthentication,\n    Effect.map(services, (value) => value.pendingAuthentication),\n  );\n\nexport const signedSessionValidityLayer = (\n  module: { readonly SignedSessionValidity: any },\n  services: Effect.Effect<\n    {\n      readonly signedSessionValidity: SignedSessionValidity;\n    },\n    never,\n    LifecycleHooks\n  >,\n) =>\n  Layer.effect(\n    module.SignedSessionValidity,\n    Effect.map(services, (value) => value.signedSessionValidity),\n  );\n\nexport const makeTargetSessionStepUpServices = <Claims, Id>(\n  database: any,\n  mapping: any,\n  target: Context.Service<Id, SessionStepUpPersistence<Claims>>,\n  configuration: SessionTargetConfiguration,\n) =>\n  Effect.map(\n    makeSqlSessionStepUp<Claims>(database, mapping, options(configuration)),\n    (sessionStepUpPersistence) => ({\n      sessionStepUpPersistence: target.of(sessionStepUpPersistence),\n    }),\n  );\n\nexport const coordinateTargetSessionStepUp = <Claims, Id, Transaction, A, E, R>(\n  database: TransactionOwner<Transaction>,\n  mapping: any,\n  target: Context.Service<Id, SessionStepUpPersistence<Claims>>,\n  configuration: SessionTargetConfiguration,\n  owner: (\n    transaction: Transaction,\n    services: { readonly sessionStepUpPersistence: SessionStepUpPersistence<Claims> },\n  ) => Effect.Effect<A, E, R>,\n) =>\n  coordinate(\n    database,\n    configuration,\n    (transaction) =>\n      Effect.map(\n        makeSqlSessionStepUp<Claims>(\n          transaction as unknown as SessionSqlDatabase,\n          mapping,\n          options(configuration, true),\n        ),\n        (sessionStepUpPersistence) => ({\n          sessionStepUpPersistence: target.of(sessionStepUpPersistence),\n        }),\n      ),\n    owner,\n  );\n"],"mappings":";;;;;;;AA2CA,MAAa,mCACX,aAEA,yBAAyB,gBAAgB,mBAAmB,KAAK,CAAC,CAAC,CAAC;AAEtE,MAAM,WACJ,eACA,mBAAmB,WACI;CACvB,MAAM,cAAc;CACpB,SAAS,cAAc;CACvB,iBAAiB,mBAAmB,OAAO,OAAO,cAAc;AAClE;AAEA,MAAa,6CACX,UACA,SACA,kBAEA,OAAO,IACL,+BAAuC,UAAU,SAAS,QAAQ,aAAa,CAAC,IAC/E,6BAA6B,EAAE,wBAAwB,EAC1D;AAEF,MAAa,2CACX,UACA,SACA,kBAEA,OAAO,IACL,6BAAqC,UAAU,SAAS,QAAQ,aAAa,CAAC,IAC7E,2BAA2B,EAAE,sBAAsB,EACtD;AAEF,MAAa,qCACX,UACA,SACA,kBACG,wBAAgC,UAAU,SAAS,QAAQ,aAAa,CAAC;AAE9E,MAAa,2CACX,UACA,SACA,kBAEA,OAAO,IACL,sBAAsB,UAAU,SAAS,QAAQ,aAAa,CAAC,IAC9D,2BAA2B,EAC1B,sBACF,EACF;;;;;;;;;;AAWF,MAAM,cACJ,UACA,eACA,MACA,UAEA,OAAO,IAAI,aAA2E;CACpF,IAAI,OAAO,gBAAgB,OAAO,OAAO,mBAAmB,KAAK,CAAC,CAAC;CACnE,OAAO,cAAc,oBAAoB,cAAc;CAgBvD,QAAO,OAde,uBAElB,SAAS,aAAa,gBACpB,OAAO,IAAI,aAAa;EAGtB,OAAO,OAAO,MAAM,aAAa,OAFT,KAAK,WAAW,CAEC;CAC3C,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,mBAAmB,WAA4C,CACvF,CACF,GACF,EAAE,MAAM,cAAc,KAAK,CAC7B,EAAA,CAEc;AAChB,CAAC;AAEH,MAAa,2CACX,UACA,SACA,eACA,UAKA,WACE,UACA,gBACC,gBACC,OAAO,IACL,+BACE,aACA,SACA,QAAQ,eAAe,IAAI,CAC7B,IACC,6BAA6B,EAAE,wBAAwB,EAC1D,GACF,KACF;AAEF,MAAa,yCACX,UACA,SACA,eACA,UAKA,WACE,UACA,gBACC,gBACC,OAAO,IACL,6BACE,aACA,SACA,QAAQ,eAAe,IAAI,CAC7B,IACC,2BAA2B,EAAE,sBAAsB,EACtD,GACF,KACF;AAEF,MAAa,oCACX,UACA,SACA,eACA,UAQA,WACE,UACA,gBACC,gBACC,wBACE,aACA,SACA,QAAQ,eAAe,IAAI,CAC7B,GACF,KACF;AAEF,MAAa,yCACX,UACA,SACA,eACA,UAKA,WACE,UACA,gBACC,gBACC,OAAO,IACL,sBACE,aACA,SACA,QAAQ,eAAe,IAAI,CAC7B,IACC,2BAA2B,EAAE,sBAAsB,EACtD,GACF,KACF;AAEF,MAAa,gCACX,aAQA,MAAM,OACJ,yBACA,OAAO,IAAI,WAAW,UAAU,MAAM,uBAAuB,CAC/D;AAEF,MAAa,yBACX,QAIA,aASA,MAAM,MACJ,MAAM,OACJ,OAAO,4BACP,OAAO,IAAI,WAAW,UAAU,MAAM,0BAA0B,CAClE,GACA,MAAM,OACJ,OAAO,mBACP,OAAO,IAAI,WAAW,UAAU,MAAM,iBAAiB,CACzD,CACF;AAEF,MAAa,8BACX,QACA,aAQA,MAAM,OACJ,OAAO,uBACP,OAAO,IAAI,WAAW,UAAU,MAAM,qBAAqB,CAC7D;AAEF,MAAa,8BACX,QACA,aAQA,MAAM,OACJ,OAAO,uBACP,OAAO,IAAI,WAAW,UAAU,MAAM,qBAAqB,CAC7D;AAEF,MAAa,mCACX,UACA,SACA,QACA,kBAEA,OAAO,IACL,qBAA6B,UAAU,SAAS,QAAQ,aAAa,CAAC,IACrE,8BAA8B,EAC7B,0BAA0B,OAAO,GAAG,wBAAwB,EAC9D,EACF;AAEF,MAAa,iCACX,UACA,SACA,QACA,eACA,UAKA,WACE,UACA,gBACC,gBACC,OAAO,IACL,qBACE,aACA,SACA,QAAQ,eAAe,IAAI,CAC7B,IACC,8BAA8B,EAC7B,0BAA0B,OAAO,GAAG,wBAAwB,EAC9D,EACF,GACF,KACF"}

package/dist/drizzle/sqlite-emails.mjs

@@ -0,0 +1,45 @@
+import { EmailAddressPersistence } from "../email/EmailAddressPersistence.mjs";
+import { coordinateTargetEmailAddress, coordinateTargetEmailRegistration, makeTargetEmailAddressServices, makeTargetEmailRegistrationServices, makeTargetEmailSignInServices } from "./email-target.mjs";
+import { Context, Effect } from "effect";
+//#region src/drizzle/sqlite-emails.ts
+const sqliteEmailConfiguration = (mode, standaloneGuard, proofStandaloneGuard, coordinatorGuard) => ({
+	mode,
+	locking: false,
+	standaloneGuard,
+	...coordinatorGuard === void 0 ? {} : { coordinatorGuard },
+	generatedSubjectRows: (query) => query.returning(),
+	proof: {
+		mode,
+		locking: false,
+		standaloneGuard: proofStandaloneGuard,
+		insertIfAbsent: (query) => query.onConflictDoNothing()
+	}
+});
+const makeSqliteEmailTarget = (configuration) => {
+	const configurationFor = (database) => typeof configuration === "function" ? configuration(database) : configuration;
+	function coordinateEmailAddress(acquire, options, body) {
+		return Effect.flatMap(acquire, (database) => coordinateTargetEmailAddress(database, options.mapping, options.proofMapping, configurationFor(database), (transaction, services) => {
+			const provided = Context.make(EmailAddressPersistence, services.emailAddressPersistence);
+			const work = Effect.provideContext(body, provided);
+			return options.transaction === void 0 ? work : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
+		}));
+	}
+	function coordinateEmailRegistration(acquire, options, body) {
+		return Effect.flatMap(acquire, (database) => coordinateTargetEmailRegistration(database, options.mapping, options.proofMapping, configurationFor(database), (transaction, services) => {
+			const provided = Context.make(options.target, services.registrationAuthority);
+			const work = Effect.provideContext(body, provided);
+			return options.transaction === void 0 ? work : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
+		}));
+	}
+	return {
+		makeEmailSignInServices: (database, mapping) => makeTargetEmailSignInServices(database, mapping, configurationFor(database)),
+		makeEmailAddressServices: (database, mapping, proofMapping) => makeTargetEmailAddressServices(database, mapping, proofMapping, configurationFor(database)),
+		coordinateEmailAddress,
+		makeEmailRegistrationServices: (database, mapping, proofMapping) => makeTargetEmailRegistrationServices(database, mapping, proofMapping, configurationFor(database)),
+		coordinateEmailRegistration
+	};
+};
+//#endregion
+export { makeSqliteEmailTarget, sqliteEmailConfiguration };
+
+//# sourceMappingURL=sqlite-emails.mjs.map

package/dist/drizzle/sqlite-emails.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite-emails.mjs","names":[],"sources":["../../src/drizzle/sqlite-emails.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- proof mapping tables are independently typed by the proof owner; this driver forwards them unchanged to the shared target. */\nimport type { AnyRelations } from \"drizzle-orm\";\nimport type { EffectLibsqlDatabase } from \"drizzle-orm/effect-libsql\";\nimport type { EffectSQLiteBunDatabase } from \"drizzle-orm/effect-sqlite-bun\";\nimport type { EffectSQLiteDoDatabase as DODatabase } from \"drizzle-orm/effect-sqlite-do\";\nimport type { EffectSQLiteNodeDatabase as NodeDatabase } from \"drizzle-orm/effect-sqlite-node\";\nimport type { EffectSQLiteWasmDatabase as WasmDatabase } from \"drizzle-orm/effect-sqlite-wasm\";\nimport type { AnySQLiteTable } from \"drizzle-orm/sqlite-core\";\nimport { Effect, Context } from \"effect\";\nimport type { SqlError } from \"effect/unstable/sql/SqlError\";\n\nimport { EmailAddressPersistence } from \"../email/EmailAddressPersistence\";\nimport type { EmailUnavailable } from \"../email/errors\";\nimport type { LifecycleHooks } from \"../hooks/LifecycleHooks\";\nimport type { HookConfigurationError } from \"../hooks/models\";\nimport type {\n  EmailAddressMapping,\n  EmailRegistrationMapping,\n  EmailSignInMapping,\n} from \"./email-model\";\nimport type { EmailRegistrationAuthority } from \"./email-registration\";\nimport type { EmailSqlQuery } from \"./email-sql\";\nimport {\n  coordinateTargetEmailAddress,\n  coordinateTargetEmailRegistration,\n  makeTargetEmailAddressServices,\n  makeTargetEmailRegistrationServices,\n  makeTargetEmailSignInServices,\n  type EmailTargetConfiguration,\n} from \"./email-target\";\nimport type { ProofPersistenceMapping } from \"./proof-model\";\nimport type { ProofSqlQuery } from \"./proof-sql\";\nimport type { SuppliedService } from \"./SuppliedService\";\n\nexport type SqliteEmailDatabase =\n  | NodeDatabase<AnyRelations>\n  | EffectSQLiteBunDatabase<AnyRelations>\n  | EffectLibsqlDatabase<AnyRelations>\n  | WasmDatabase<AnyRelations>\n  | DODatabase<AnyRelations>;\n\ntype TransactionOf<D extends SqliteEmailDatabase> = Parameters<Parameters<D[\"transaction\"]>[0]>[0];\ntype ProofMapping = ProofPersistenceMapping<\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any\n>;\n\nexport const sqliteEmailConfiguration = (\n  mode: \"interactive\" | \"synchronous\",\n  standaloneGuard: EmailTargetConfiguration[\"standaloneGuard\"],\n  proofStandaloneGuard: EmailTargetConfiguration[\"proof\"][\"standaloneGuard\"],\n  coordinatorGuard?: EmailTargetConfiguration[\"coordinatorGuard\"],\n): EmailTargetConfiguration => ({\n  mode,\n  locking: false,\n  standaloneGuard,\n  ...(coordinatorGuard === undefined ? {} : { coordinatorGuard }),\n  generatedSubjectRows: (query: EmailSqlQuery) => query.returning(),\n  proof: {\n    mode,\n    locking: false,\n    standaloneGuard: proofStandaloneGuard,\n    insertIfAbsent: (query: ProofSqlQuery) => query.onConflictDoNothing(),\n  },\n});\n\nexport const makeSqliteEmailTarget = <\n  D extends SqliteEmailDatabase,\n  Synchronous extends boolean = false,\n>(\n  configuration: EmailTargetConfiguration | ((database: D) => EmailTargetConfiguration),\n) => {\n  const configurationFor = (database: D) =>\n    typeof configuration === \"function\" ? configuration(database) : configuration;\n\n  function coordinateEmailAddress<\n    Database extends D,\n    S extends AnySQLiteTable,\n    I extends AnySQLiteTable,\n    C extends AnySQLiteTable,\n    AC extends AnySQLiteTable,\n    M extends AnySQLiteTable,\n    NativeId,\n    Out,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: EmailAddressMapping<S, I, C, AC, M, NativeId>;\n      readonly proofMapping: ProofMapping;\n      readonly transaction?: never;\n    },\n    body: Effect.Effect<Out, E, Synchronous extends true ? NoInfer<EmailAddressPersistence> : R>,\n  ): Effect.Effect<\n    Out,\n    E | EmailUnavailable | HookConfigurationError | SqlError | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, EmailAddressPersistence>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateEmailAddress<\n    Database extends D,\n    S extends AnySQLiteTable,\n    I extends AnySQLiteTable,\n    C extends AnySQLiteTable,\n    AC extends AnySQLiteTable,\n    M extends AnySQLiteTable,\n    NativeId,\n    Out,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: EmailAddressMapping<S, I, C, AC, M, NativeId>;\n      readonly proofMapping: ProofMapping;\n      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<\n      Out,\n      E,\n      Synchronous extends true ? NoInfer<EmailAddressPersistence | TxId> : R\n    >,\n  ): Effect.Effect<\n    Out,\n    E | EmailUnavailable | HookConfigurationError | SqlError | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, EmailAddressPersistence | TxId>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateEmailAddress<\n    Database extends D,\n    S extends AnySQLiteTable,\n    I extends AnySQLiteTable,\n    C extends AnySQLiteTable,\n    AC extends AnySQLiteTable,\n    M extends AnySQLiteTable,\n    NativeId,\n    Out,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: EmailAddressMapping<S, I, C, AC, M, NativeId>;\n      readonly proofMapping: ProofMapping;\n      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<Out, E, R>,\n  ): Effect.Effect<\n    Out,\n    E | EmailUnavailable | HookConfigurationError | SqlError | DatabaseError,\n    Exclude<R, EmailAddressPersistence> | LifecycleHooks | DatabaseRequirements\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetEmailAddress<\n        TransactionOf<Database>,\n        Out,\n        E,\n        Exclude<R, EmailAddressPersistence>\n      >(\n        database,\n        options.mapping,\n        options.proofMapping,\n        configurationFor(database),\n        (\n          transaction: TransactionOf<Database>,\n          services: { readonly emailAddressPersistence: EmailAddressPersistence[\"Service\"] },\n        ) => {\n          const provided = Context.make(EmailAddressPersistence, services.emailAddressPersistence);\n          const work = Effect.provideContext(body, provided);\n\n          return options.transaction === undefined\n            ? work\n            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n        },\n      ),\n    );\n  }\n  function coordinateEmailRegistration<\n    Database extends D,\n    TargetId,\n    Registration,\n    S extends AnySQLiteTable,\n    I extends AnySQLiteTable,\n    C extends AnySQLiteTable,\n    AC extends AnySQLiteTable,\n    Rq extends AnySQLiteTable,\n    NativeId,\n    Out,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: EmailRegistrationMapping<NoInfer<Registration>, S, I, C, AC, Rq, NativeId>;\n      readonly proofMapping: ProofMapping;\n      readonly target: SuppliedService<TargetId, EmailRegistrationAuthority<Registration>>;\n      readonly transaction?: never;\n    },\n    body: Effect.Effect<Out, E, Synchronous extends true ? NoInfer<TargetId> : R>,\n  ): Effect.Effect<\n    Out,\n    E | EmailUnavailable | HookConfigurationError | SqlError | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, TargetId>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateEmailRegistration<\n    Database extends D,\n    TargetId,\n    Registration,\n    S extends AnySQLiteTable,\n    I extends AnySQLiteTable,\n    C extends AnySQLiteTable,\n    AC extends AnySQLiteTable,\n    Rq extends AnySQLiteTable,\n    NativeId,\n    Out,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: EmailRegistrationMapping<NoInfer<Registration>, S, I, C, AC, Rq, NativeId>;\n      readonly proofMapping: ProofMapping;\n      readonly target: SuppliedService<TargetId, EmailRegistrationAuthority<Registration>>;\n      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<Out, E, Synchronous extends true ? NoInfer<TargetId | TxId> : R>,\n  ): Effect.Effect<\n    Out,\n    E | EmailUnavailable | HookConfigurationError | SqlError | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, TargetId | TxId>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateEmailRegistration<\n    Database extends D,\n    TargetId,\n    Registration,\n    S extends AnySQLiteTable,\n    I extends AnySQLiteTable,\n    C extends AnySQLiteTable,\n    AC extends AnySQLiteTable,\n    Rq extends AnySQLiteTable,\n    NativeId,\n    Out,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: EmailRegistrationMapping<NoInfer<Registration>, S, I, C, AC, Rq, NativeId>;\n      readonly proofMapping: ProofMapping;\n      readonly target: SuppliedService<TargetId, EmailRegistrationAuthority<Registration>>;\n      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<Out, E, R>,\n  ): Effect.Effect<\n    Out,\n    E | EmailUnavailable | HookConfigurationError | SqlError | DatabaseError,\n    Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetEmailRegistration<\n        Registration,\n        TransactionOf<Database>,\n        Out,\n        E,\n        Exclude<R, TargetId>\n      >(\n        database,\n        options.mapping,\n        options.proofMapping,\n        configurationFor(database),\n        (\n          transaction: TransactionOf<Database>,\n          services: { readonly registrationAuthority: EmailRegistrationAuthority<Registration> },\n        ) => {\n          const provided = Context.make(options.target, services.registrationAuthority);\n          const work = Effect.provideContext(body, provided);\n\n          return options.transaction === undefined\n            ? work\n            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n        },\n      ),\n    );\n  }\n\n  return {\n    makeEmailSignInServices: <\n      S extends AnySQLiteTable,\n      I extends AnySQLiteTable,\n      C extends AnySQLiteTable,\n      NativeId,\n    >(\n      database: D,\n      mapping: EmailSignInMapping<S, I, C, NativeId>,\n    ) => makeTargetEmailSignInServices(database, mapping, configurationFor(database)),\n    makeEmailAddressServices: <\n      S extends AnySQLiteTable,\n      I extends AnySQLiteTable,\n      C extends AnySQLiteTable,\n      AC extends AnySQLiteTable,\n      M extends AnySQLiteTable,\n      NativeId,\n    >(\n      database: D,\n      mapping: EmailAddressMapping<S, I, C, AC, M, NativeId>,\n      proofMapping: ProofMapping,\n    ) =>\n      makeTargetEmailAddressServices(database, mapping, proofMapping, configurationFor(database)),\n    coordinateEmailAddress,\n    makeEmailRegistrationServices: <\n      Registration,\n      S extends AnySQLiteTable,\n      I extends AnySQLiteTable,\n      C extends AnySQLiteTable,\n      AC extends AnySQLiteTable,\n      Rq extends AnySQLiteTable,\n      NativeId,\n    >(\n      database: D,\n      mapping: EmailRegistrationMapping<Registration, S, I, C, AC, Rq, NativeId>,\n      proofMapping: ProofMapping,\n    ) =>\n      makeTargetEmailRegistrationServices<Registration>(\n        database,\n        mapping,\n        proofMapping,\n        configurationFor(database),\n      ),\n    coordinateEmailRegistration,\n  };\n};\n"],"mappings":";;;;AAyDA,MAAa,4BACX,MACA,iBACA,sBACA,sBAC8B;CAC9B;CACA,SAAS;CACT;CACA,GAAI,qBAAqB,KAAA,IAAY,CAAC,IAAI,EAAE,iBAAiB;CAC7D,uBAAuB,UAAyB,MAAM,UAAU;CAChE,OAAO;EACL;EACA,SAAS;EACT,iBAAiB;EACjB,iBAAiB,UAAyB,MAAM,oBAAoB;CACtE;AACF;AAEA,MAAa,yBAIX,kBACG;CACH,MAAM,oBAAoB,aACxB,OAAO,kBAAkB,aAAa,cAAc,QAAQ,IAAI;CAgElE,SAAS,uBAgBP,SACA,SAKA,MAKA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,6BAME,UACA,QAAQ,SACR,QAAQ,cACR,iBAAiB,QAAQ,IAEvB,aACA,aACG;GACH,MAAM,WAAW,QAAQ,KAAK,yBAAyB,SAAS,uBAAuB;GACvF,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;GAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;EAC1F,CACF,CACF;CACF;CAiEA,SAAS,4BAkBP,SACA,SAMA,MAKA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,kCAOE,UACA,QAAQ,SACR,QAAQ,cACR,iBAAiB,QAAQ,IAEvB,aACA,aACG;GACH,MAAM,WAAW,QAAQ,KAAK,QAAQ,QAAQ,SAAS,qBAAqB;GAC5E,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;GAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;EAC1F,CACF,CACF;CACF;CAEA,OAAO;EACL,0BAME,UACA,YACG,8BAA8B,UAAU,SAAS,iBAAiB,QAAQ,CAAC;EAChF,2BAQE,UACA,SACA,iBAEA,+BAA+B,UAAU,SAAS,cAAc,iBAAiB,QAAQ,CAAC;EAC5F;EACA,gCASE,UACA,SACA,iBAEA,oCACE,UACA,SACA,cACA,iBAAiB,QAAQ,CAC3B;EACF;CACF;AACF"}

package/dist/drizzle/sqlite-identity.mjs

@@ -0,0 +1,92 @@
+import { IdentityConflict, IdentityUnavailable, SubjectProvisioned } from "../identity/models.mjs";
+import { reportPersistenceFailure } from "../internal/diagnostics.mjs";
+import { ExternalIdentityMutation } from "../identity/ExternalIdentityMutation.mjs";
+import { SubjectProvisioner } from "../identity/SubjectProvisioner.mjs";
+import { DrizzleMappingError, column, isMappedConstraintConflict, provisioningFingerprint } from "./model.mjs";
+import { Cause, Effect, Schema } from "effect";
+import { and, eq } from "drizzle-orm";
+//#region src/drizzle/sqlite-identity.ts
+const unavailable = () => IdentityUnavailable.make();
+const isIdentityFailure = Schema.is(Schema.Union([IdentityConflict, IdentityUnavailable]));
+const mapUnavailable = (effect) => reportPersistenceFailure(effect, isIdentityFailure).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, (error) => isIdentityFailure(error) ? error : unavailable()))));
+const makeSqliteSubjectProvisioningServices = (database, mapping, mode) => {
+	const db = database;
+	const requestTable = mapping.provisioningRequest.table;
+	const requestIdColumn = column(requestTable, mapping.provisioningRequest.requestId);
+	const requestFingerprintColumn = column(requestTable, mapping.provisioningRequest.fingerprint);
+	const requestSubjectColumn = column(requestTable, mapping.provisioningRequest.subjectId);
+	const identifierTable = mapping.identifier.table;
+	const identifierNamespaceColumn = column(identifierTable, mapping.identifier.namespace);
+	const identifierValueColumn = column(identifierTable, mapping.identifier.value);
+	const subjectIdColumn = column(mapping.subject.table, mapping.subject.id);
+	const findReceipt = Effect.fn("DrizzleSqliteIdentity.findReceipt")(function* (requestId) {
+		return (yield* db.select({
+			fingerprint: requestFingerprintColumn,
+			subjectId: requestSubjectColumn
+		}).from(requestTable).where(eq(requestIdColumn, requestId)).limit(1))[0];
+	});
+	const provision = Effect.fn("DrizzleSqliteIdentity.provision")(function* (input) {
+		if (mode === "synchronous" && mapping.subject.allocateId !== void 0 && mapping.subject.allocateIdSync === void 0) return yield* unavailable();
+		const fingerprint = provisioningFingerprint(input);
+		const existing = yield* findReceipt(input.requestId);
+		if (existing !== void 0) {
+			if (existing.fingerprint !== fingerprint) return yield* IdentityConflict.make();
+			const subjectId = yield* mapping.subjectId.toSubject(existing.subjectId);
+			return SubjectProvisioned.make({ subjectId });
+		}
+		const nativeId = yield* db.transaction((tx) => Effect.gen(function* () {
+			const allocated = mode === "synchronous" ? mapping.subject.allocateIdSync?.() : mapping.subject.allocateId === void 0 ? mapping.subject.allocateIdSync?.() : yield* mapping.subject.allocateId;
+			const nativeId = (yield* tx.insert(mapping.subject.table).values(mapping.subject.encodeInsert(input, allocated)).returning({ id: subjectIdColumn }))[0]?.id ?? allocated;
+			if (nativeId === void 0) return yield* DrizzleMappingError.make({
+				operation: "provisionSubject.generatedId",
+				cause: /* @__PURE__ */ new Error("subject insert did not return its native id")
+			});
+			if (input.identifier !== void 0) yield* tx.insert(identifierTable).values(mapping.identifier.encodeInsert(input.identifier, nativeId, input.verifiedAt));
+			yield* tx.insert(requestTable).values(mapping.provisioningRequest.encodeInsert(input.requestId, fingerprint, nativeId));
+			return nativeId;
+		})).pipe(Effect.catchCause((cause) => {
+			if (cause.reasons.length === 0 || !cause.reasons.every((reason) => Cause.isFailReason(reason) && isMappedConstraintConflict(mapping.isConstraintConflict, reason.error))) return Effect.failCause(cause);
+			return findReceipt(input.requestId).pipe(Effect.flatMap((receipt) => {
+				if (receipt !== void 0 && receipt.fingerprint === fingerprint) return Effect.succeed(receipt.subjectId);
+				if (input.identifier === void 0) return IdentityConflict.make();
+				return db.select({ subjectId: column(identifierTable, mapping.identifier.subjectId) }).from(identifierTable).where(and(eq(identifierNamespaceColumn, input.identifier.namespace), eq(identifierValueColumn, input.identifier.value))).limit(1).pipe(Effect.flatMap(() => IdentityConflict.make()));
+			}));
+		}));
+		const subjectId = yield* mapping.subjectId.toSubject(nativeId);
+		return SubjectProvisioned.make({ subjectId });
+	}, mapUnavailable);
+	return { subjectProvisioner: SubjectProvisioner.of({ provision }) };
+};
+const makeSqliteExternalIdentityServices = (database, mapping) => {
+	const db = database;
+	const externalTable = mapping.externalIdentity.table;
+	const externalProviderColumn = column(externalTable, mapping.externalIdentity.provider);
+	const externalIssuerColumn = column(externalTable, mapping.externalIdentity.issuer);
+	const externalSubjectColumn = column(externalTable, mapping.externalIdentity.subject);
+	const externalSubjectIdColumn = column(externalTable, mapping.externalIdentity.subjectId);
+	const subjectIdColumn = column(mapping.subject.table, mapping.subject.id);
+	const subjectStatusColumn = column(mapping.subject.table, mapping.subject.status);
+	const bind = Effect.fn("DrizzleSqliteIdentity.bindExternalIdentity")(function* (subjectId, identity) {
+		const nativeId = yield* mapping.subjectId.toNative(subjectId);
+		if ((yield* db.transaction((tx) => Effect.gen(function* () {
+			const subjects = yield* tx.select({ status: subjectStatusColumn }).from(mapping.subject.table).where(eq(subjectIdColumn, nativeId)).limit(1);
+			if (subjects[0] === void 0 || !mapping.subject.isActiveStatus(subjects[0].status)) return { _tag: "conflict" };
+			const links = yield* tx.select({ subjectId: externalSubjectIdColumn }).from(externalTable).where(and(eq(externalProviderColumn, identity.provider), eq(externalIssuerColumn, identity.issuer), eq(externalSubjectColumn, identity.subject))).limit(1);
+			if (links[0] !== void 0) return mapping.subjectId.equals(links[0].subjectId, nativeId) ? { _tag: "bound" } : { _tag: "conflict" };
+			yield* tx.insert(externalTable).values(mapping.externalIdentity.encodeInsert(identity, nativeId));
+			return { _tag: "bound" };
+		})).pipe(Effect.catchCause((cause) => {
+			if (cause.reasons.length === 0 || !cause.reasons.every((reason) => Cause.isFailReason(reason) && isMappedConstraintConflict(mapping.isConstraintConflict, reason.error))) return Effect.failCause(cause);
+			return db.select({ subjectId: externalSubjectIdColumn }).from(externalTable).where(and(eq(externalProviderColumn, identity.provider), eq(externalIssuerColumn, identity.issuer), eq(externalSubjectColumn, identity.subject))).limit(1).pipe(Effect.map((rows) => rows[0] !== void 0 && mapping.subjectId.equals(rows[0].subjectId, nativeId) ? { _tag: "bound" } : { _tag: "conflict" }));
+		})))._tag === "conflict") return yield* IdentityConflict.make();
+	}, mapUnavailable);
+	return { externalIdentityMutation: ExternalIdentityMutation.of({ bind }) };
+};
+const makeSqliteIdentityServices = (database, mapping, mode) => ({
+	...makeSqliteSubjectProvisioningServices(database, mapping, mode),
+	...makeSqliteExternalIdentityServices(database, mapping)
+});
+//#endregion
+export { makeSqliteExternalIdentityServices, makeSqliteIdentityServices, makeSqliteSubjectProvisioningServices };
+
+//# sourceMappingURL=sqlite-identity.mjs.map