@yielded/auth 0.1.0-beta.1

package/dist/email/EmailIdentifierNotifier.mjs

@@ -0,0 +1,31 @@
+import { HookDeliveryFailed } from "../hooks/models.mjs";
+import { hookContribution } from "../hooks/LifecycleHooks.mjs";
+import { Context, Effect } from "effect";
+//#region src/email/EmailIdentifierNotifier.ts
+/** Optional explicit notification capability. Vendor failure never rolls back an
+* identifier change. Stable event IDs support consumer idempotency; direct hooks
+* are best effort, not a durable outbox or an exactly-once delivery guarantee.
+*/
+var EmailIdentifierNotifier = class extends Context.Service()("effect-auth/EmailIdentifierNotifier") {};
+const emailIdentifierNotifications = (moduleId) => {
+	const contribution = hookContribution(`email/${moduleId}/old-address-notification`);
+	const layer = contribution.layer({ after: Effect.fn("EmailIdentifierNotifier.after")(function* (event) {
+		if (event.snapshot.operation !== `${moduleId}/change-address` || event.snapshot.action !== "identifier-change") return;
+		const [oldIdentifier, newIdentifier] = event.snapshot.identifiers;
+		if (!oldIdentifier || !newIdentifier) return yield* HookDeliveryFailed.make({});
+		yield* (yield* EmailIdentifierNotifier).notify({
+			eventId: event.id,
+			oldIdentifier,
+			newIdentifier,
+			occurredAtMillis: event.occurredAtMillis
+		});
+	}) });
+	return Object.freeze({
+		contribution,
+		layer
+	});
+};
+//#endregion
+export { EmailIdentifierNotifier, emailIdentifierNotifications };
+
+//# sourceMappingURL=EmailIdentifierNotifier.mjs.map

package/dist/email/EmailIdentifierNotifier.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"EmailIdentifierNotifier.mjs","names":[],"sources":["../../src/email/EmailIdentifierNotifier.ts"],"sourcesContent":["import { Context, Effect } from \"effect\";\n\nimport { hookContribution } from \"../hooks/LifecycleHooks\";\nimport { HookDeliveryFailed, type LifecycleEventId } from \"../hooks/models\";\nimport type { LoginIdentifier } from \"../identity/models\";\n\n/** Optional explicit notification capability. Vendor failure never rolls back an\n * identifier change. Stable event IDs support consumer idempotency; direct hooks\n * are best effort, not a durable outbox or an exactly-once delivery guarantee.\n */\nexport class EmailIdentifierNotifier extends Context.Service<\n  EmailIdentifierNotifier,\n  {\n    readonly notify: (input: {\n      readonly eventId: LifecycleEventId;\n      readonly oldIdentifier: LoginIdentifier;\n      readonly newIdentifier: LoginIdentifier;\n      readonly occurredAtMillis: number;\n    }) => Effect.Effect<void, HookDeliveryFailed>;\n  }\n>()(\"effect-auth/EmailIdentifierNotifier\") {}\n\nexport const emailIdentifierNotifications = <const Id extends string>(moduleId: Id) => {\n  const contribution = hookContribution(`email/${moduleId}/old-address-notification`);\n\n  const layer = contribution.layer({\n    after: Effect.fn(\"EmailIdentifierNotifier.after\")(function* (event) {\n      if (\n        event.snapshot.operation !== `${moduleId}/change-address` ||\n        event.snapshot.action !== \"identifier-change\"\n      )\n        return;\n      const [oldIdentifier, newIdentifier] = event.snapshot.identifiers;\n\n      if (!oldIdentifier || !newIdentifier) return yield* HookDeliveryFailed.make({});\n      const notifier = yield* EmailIdentifierNotifier;\n\n      yield* notifier.notify({\n        eventId: event.id,\n        oldIdentifier,\n        newIdentifier,\n        occurredAtMillis: event.occurredAtMillis,\n      });\n    }),\n  });\n\n  return Object.freeze({ contribution, layer });\n};\n"],"mappings":";;;;;;;;AAUA,IAAa,0BAAb,cAA6C,QAAQ,QAUnD,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC;AAE5C,MAAa,gCAAyD,aAAiB;CACrF,MAAM,eAAe,iBAAiB,SAAS,SAAS,0BAA0B;CAElF,MAAM,QAAQ,aAAa,MAAM,EAC/B,OAAO,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAAW,OAAO;EAClE,IACE,MAAM,SAAS,cAAc,GAAG,SAAS,oBACzC,MAAM,SAAS,WAAW,qBAE1B;EACF,MAAM,CAAC,eAAe,iBAAiB,MAAM,SAAS;EAEtD,IAAI,CAAC,iBAAiB,CAAC,eAAe,OAAO,OAAO,mBAAmB,KAAK,CAAC,CAAC;EAG9E,QAAO,OAFiB,wBAAA,CAER,OAAO;GACrB,SAAS,MAAM;GACf;GACA;GACA,kBAAkB,MAAM;EAC1B,CAAC;CACH,CAAC,EACH,CAAC;CAED,OAAO,OAAO,OAAO;EAAE;EAAc;CAAM,CAAC;AAC9C"}

package/dist/email/EmailReturnTargets.d.mts

@@ -0,0 +1,19 @@
+import { SafeReturnTarget } from "./models.mjs";
+import { EmailConfigurationError, EmailRejected, EmailUnavailable } from "./errors.mjs";
+import { Context, Effect, Layer } from "effect";
+//#region src/email/EmailReturnTargets.d.ts
+declare const EmailReturnTargets_base: Context.ServiceClass<EmailReturnTargets, "effect-auth/EmailReturnTargets", {
+  readonly resolve: (input: string) => Effect.Effect<SafeReturnTarget, EmailRejected | EmailUnavailable>;
+}>;
+/** Resolve before issuance and again before consumption. Never take a target from
+ * email/deep-link data. The core returns this canonical value; it never redirects.
+ */
+declare class EmailReturnTargets extends EmailReturnTargets_base {
+  /** Explicit exact application-route allowlist; no query, fragment, normalization
+   * or fallback to unvalidated input. Consumers may provide a stricter own Layer.
+   */
+  static readonly exactRoutes: (routes: ReadonlyArray<string>) => Layer.Layer<EmailReturnTargets, EmailConfigurationError, never>;
+}
+//#endregion
+export { EmailReturnTargets };
+//# sourceMappingURL=EmailReturnTargets.d.mts.map

package/dist/email/EmailReturnTargets.mjs

@@ -0,0 +1,29 @@
+import { EmailConfigurationError, EmailRejected } from "./errors.mjs";
+import { SafeReturnTarget } from "./models.mjs";
+import { Context, Effect, Layer, Schema } from "effect";
+//#region src/email/EmailReturnTargets.ts
+/** Resolve before issuance and again before consumption. Never take a target from
+* email/deep-link data. The core returns this canonical value; it never redirects.
+*/
+var EmailReturnTargets = class EmailReturnTargets extends Context.Service()("effect-auth/EmailReturnTargets") {
+	/** Explicit exact application-route allowlist; no query, fragment, normalization
+	* or fallback to unvalidated input. Consumers may provide a stricter own Layer.
+	*/
+	static exactRoutes = (routes) => {
+		const captured = [...routes];
+		return Layer.effect(this, Effect.gen(function* () {
+			const route = Schema.String.check(Schema.isMaxLength(2048), Schema.isPattern(/^\/(?!\/)[A-Za-z0-9/_-]*$/));
+			const checked = yield* Schema.decodeEffect(Schema.Array(route).check(Schema.isMinLength(1), Schema.isMaxLength(128)))(captured).pipe(Effect.mapError(() => EmailConfigurationError.make({})));
+			const allowed = new Set(checked);
+			return EmailReturnTargets.of({ resolve: Effect.fn("EmailReturnTargets.resolve")(function* (input) {
+				yield* Schema.decodeEffect(route)(input).pipe(Effect.mapError(() => EmailRejected.make({})));
+				if (!allowed.has(input)) return yield* EmailRejected.make({});
+				return SafeReturnTarget.make(input);
+			}) });
+		}));
+	};
+};
+//#endregion
+export { EmailReturnTargets };
+
+//# sourceMappingURL=EmailReturnTargets.mjs.map

package/dist/email/EmailReturnTargets.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"EmailReturnTargets.mjs","names":[],"sources":["../../src/email/EmailReturnTargets.ts"],"sourcesContent":["import { Context, Effect, Layer, Schema } from \"effect\";\n\nimport { EmailConfigurationError, EmailRejected, type EmailUnavailable } from \"./errors\";\nimport { SafeReturnTarget } from \"./models\";\n\n/** Resolve before issuance and again before consumption. Never take a target from\n * email/deep-link data. The core returns this canonical value; it never redirects.\n */\nexport class EmailReturnTargets extends Context.Service<\n  EmailReturnTargets,\n  {\n    readonly resolve: (\n      input: string,\n    ) => Effect.Effect<SafeReturnTarget, EmailRejected | EmailUnavailable>;\n  }\n>()(\"effect-auth/EmailReturnTargets\") {\n  /** Explicit exact application-route allowlist; no query, fragment, normalization\n   * or fallback to unvalidated input. Consumers may provide a stricter own Layer.\n   */\n  static readonly exactRoutes = (routes: ReadonlyArray<string>) => {\n    const captured = [...routes];\n\n    return Layer.effect(\n      this,\n      Effect.gen(function* () {\n        const route = Schema.String.check(\n          Schema.isMaxLength(2048),\n          Schema.isPattern(/^\\/(?!\\/)[A-Za-z0-9/_-]*$/),\n        );\n\n        const checked = yield* Schema.decodeEffect(\n          Schema.Array(route).check(Schema.isMinLength(1), Schema.isMaxLength(128)),\n        )(captured).pipe(Effect.mapError(() => EmailConfigurationError.make({})));\n\n        const allowed = new Set(checked);\n\n        return EmailReturnTargets.of({\n          resolve: Effect.fn(\"EmailReturnTargets.resolve\")(function* (input) {\n            yield* Schema.decodeEffect(route)(input).pipe(\n              Effect.mapError(() => EmailRejected.make({})),\n            );\n            if (!allowed.has(input)) return yield* EmailRejected.make({});\n\n            return SafeReturnTarget.make(input);\n          }),\n        });\n      }),\n    );\n  };\n}\n"],"mappings":";;;;;;;AAQA,IAAa,qBAAb,MAAa,2BAA2B,QAAQ,QAO9C,CAAC,CAAC,gCAAgC,CAAC,CAAC;;;;CAIpC,OAAgB,eAAe,WAAkC;EAC/D,MAAM,WAAW,CAAC,GAAG,MAAM;EAE3B,OAAO,MAAM,OACX,MACA,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,OAAO,MAC1B,OAAO,YAAY,IAAI,GACvB,OAAO,UAAU,2BAA2B,CAC9C;GAEA,MAAM,UAAU,OAAO,OAAO,aAC5B,OAAO,MAAM,KAAK,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,GAAG,CAAC,CAC1E,CAAC,CAAC,QAAQ,CAAC,CAAC,KAAK,OAAO,eAAe,wBAAwB,KAAK,CAAC,CAAC,CAAC,CAAC;GAExE,MAAM,UAAU,IAAI,IAAI,OAAO;GAE/B,OAAO,mBAAmB,GAAG,EAC3B,SAAS,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAAW,OAAO;IACjE,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,KACvC,OAAO,eAAe,cAAc,KAAK,CAAC,CAAC,CAAC,CAC9C;IACA,IAAI,CAAC,QAAQ,IAAI,KAAK,GAAG,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;IAE5D,OAAO,iBAAiB,KAAK,KAAK;GACpC,CAAC,EACH,CAAC;EACH,CAAC,CACH;CACF;AACF"}

package/dist/email/EmailSignInTargets.d.mts

@@ -0,0 +1,20 @@
+import { LoginIdentifier } from "../identity/models.mjs";
+import { EmailCredentialSnapshot } from "./models.mjs";
+import { EmailUnavailable } from "./errors.mjs";
+import { Context, Effect, Option } from "effect";
+//#region src/email/EmailSignInTargets.d.ts
+declare const EmailSignInTargets_base: Context.ServiceClass<EmailSignInTargets, "effect-auth/EmailSignInTargets", {
+  readonly lookup: (input: {
+    readonly moduleId: string;
+    readonly identifier: LoginIdentifier;
+  }) => Effect.Effect<Option.Option<EmailCredentialSnapshot>, EmailUnavailable>;
+}>;
+/** Active subject + verified exact identifier + active configured email credential.
+ * Capture their SAME revisions before verification; absent/ineligible returns None.
+ * Every identifier change invalidating captured login bumps subject securityRevision
+ * atomically because AuthenticationRevision does not contain identifierRevision.
+ */
+declare class EmailSignInTargets extends EmailSignInTargets_base {}
+//#endregion
+export { EmailSignInTargets };
+//# sourceMappingURL=EmailSignInTargets.d.mts.map

package/dist/email/EmailSignInTargets.mjs

@@ -0,0 +1,12 @@
+import { Context } from "effect";
+//#region src/email/EmailSignInTargets.ts
+/** Active subject + verified exact identifier + active configured email credential.
+* Capture their SAME revisions before verification; absent/ineligible returns None.
+* Every identifier change invalidating captured login bumps subject securityRevision
+* atomically because AuthenticationRevision does not contain identifierRevision.
+*/
+var EmailSignInTargets = class extends Context.Service()("effect-auth/EmailSignInTargets") {};
+//#endregion
+export { EmailSignInTargets };
+
+//# sourceMappingURL=EmailSignInTargets.mjs.map

package/dist/email/EmailSignInTargets.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"EmailSignInTargets.mjs","names":[],"sources":["../../src/email/EmailSignInTargets.ts"],"sourcesContent":["import { Context, type Effect, type Option } from \"effect\";\n\nimport type { LoginIdentifier } from \"../identity/models\";\nimport type { EmailUnavailable } from \"./errors\";\nimport type { EmailCredentialSnapshot } from \"./models\";\n\n/** Active subject + verified exact identifier + active configured email credential.\n * Capture their SAME revisions before verification; absent/ineligible returns None.\n * Every identifier change invalidating captured login bumps subject securityRevision\n * atomically because AuthenticationRevision does not contain identifierRevision.\n */\nexport class EmailSignInTargets extends Context.Service<\n  EmailSignInTargets,\n  {\n    readonly lookup: (input: {\n      readonly moduleId: string;\n      readonly identifier: LoginIdentifier;\n    }) => Effect.Effect<Option.Option<EmailCredentialSnapshot>, EmailUnavailable>;\n  }\n>()(\"effect-auth/EmailSignInTargets\") {}\n"],"mappings":";;;;;;;AAWA,IAAa,qBAAb,cAAwC,QAAQ,QAQ9C,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC"}

package/dist/email/addresses.d.mts

@@ -0,0 +1,33 @@
+import "../operations/context.mjs";
+import "../operations/credentials.mjs";
+import "../operations/operation.mjs";
+import "../identity/models.mjs";
+import "../hooks/models.mjs";
+import "../hooks/LifecycleHooks.mjs";
+import "../hooks/commit.mjs";
+import "../WebCrypto.mjs";
+import "../operations/requestBinding.mjs";
+import "../Operations.mjs";
+import "../Auth.mjs";
+import "../sessions/module.mjs";
+import "./models.mjs";
+import "../proofs/models.mjs";
+import "../proofs/module.mjs";
+import "../Proofs.mjs";
+import "./errors.mjs";
+import "./EmailActionEvidence.mjs";
+import "./EmailAddressPersistence.mjs";
+import { Context, Crypto, Effect, Layer, Schema } from "effect";
+//#region src/email/addresses.d.ts
+declare const Configuration: Schema.Struct<{
+  readonly maximumEvidenceAgeMillis: Schema.Int;
+  readonly requireImmediateInvalidation: Schema.Boolean;
+}>;
+type EmailAddressPolicy = typeof Configuration.Type;
+interface AddressModule<Id extends string> {
+  readonly moduleId: Id;
+  readonly kind: "addresses";
+}
+//#endregion
+export { AddressModule, EmailAddressPolicy };
+//# sourceMappingURL=addresses.d.mts.map

package/dist/email/addresses.mjs

@@ -0,0 +1,404 @@
+import { Email, TokenDigest } from "../Schema.mjs";
+import { LoginIdentifier } from "../identity/models.mjs";
+import { HookDenied, LifecycleEventId, lifecycleEvent, lifecycleSnapshot } from "../hooks/models.mjs";
+import { makeOperation, operationGroup } from "../operations/operation.mjs";
+import { SessionInvalidationWindow, sessionInvalidationWindow } from "../sessions/invalidation.mjs";
+import { AuthenticationFlowId } from "../sessions/models.mjs";
+import { LifecycleHooks } from "../hooks/LifecycleHooks.mjs";
+import { hasCommitScope } from "../hooks/commit.mjs";
+import { assessAuthentication, snapshotAuthenticationEvidence } from "../sessions/assurance.mjs";
+import { EmailAddressPersistence } from "./EmailAddressPersistence.mjs";
+import { EmailActionRequired, EmailConfigurationError, EmailMethodUnsupported, EmailRejected, EmailUnavailable } from "./errors.mjs";
+import { EmailActionChallenge, EmailCommandId } from "./models.mjs";
+import { snapshotEmailCredential, snapshotEmailRequirement, snapshotEmailRevision } from "./snapshot.mjs";
+import { ProofContinuation, ProofContinuationId, ProofId, ProofReference, ProofRequestId, ProofRequestReceipt } from "../proofs/models.mjs";
+import { RequestBindingCredential, RequestBindingFlowId } from "../operations/requestBindingModels.mjs";
+import { readProofCommit } from "../proofs/dispatch.mjs";
+import { EmailActionEvidence } from "./EmailActionEvidence.mjs";
+import { Context, Crypto, DateTime, Effect, Encoding, Layer, Schema } from "effect";
+//#region src/email/addresses.ts
+const BoundedId = Schema.NonEmptyString.check(Schema.isMaxLength(256));
+const Secret = Schema.RedactedFromValue(Schema.String.check(Schema.isMaxLength(4096)));
+const base = {
+	flowId: RequestBindingFlowId,
+	requestBinding: RequestBindingCredential,
+	commandId: EmailCommandId,
+	email: Schema.String.check(Schema.isMaxLength(320)).pipe(Schema.decodeTo(Email)),
+	sourceCredentialId: Schema.optionalKey(BoundedId),
+	actionProof: Schema.optionalKey(Secret)
+};
+Schema.Struct(base);
+const RequestInput = Schema.Struct({
+	...base,
+	requestId: ProofRequestId,
+	locale: Schema.NonEmptyString.check(Schema.isMaxLength(64))
+});
+const ResendInput = Schema.Struct({
+	...RequestInput.fields,
+	supersedes: ProofId
+});
+const AttemptInput = Schema.Struct({
+	...base,
+	reference: ProofReference,
+	secret: Secret
+});
+const CompleteInput = Schema.Struct({
+	...base,
+	continuationId: ProofContinuationId,
+	credential: Secret
+});
+const ChangeRequest = Schema.Struct({
+	...RequestInput.fields,
+	sourceCredentialId: BoundedId
+});
+const ChangeResend = Schema.Struct({
+	...ResendInput.fields,
+	sourceCredentialId: BoundedId
+});
+const ChangeAttempt = Schema.Struct({
+	...AttemptInput.fields,
+	sourceCredentialId: BoundedId
+});
+const ChangeComplete = Schema.Struct({
+	...CompleteInput.fields,
+	sourceCredentialId: BoundedId
+});
+const Success = Schema.Struct({ invalidation: SessionInvalidationWindow });
+const AttemptSuccess = Schema.Struct({ continuation: ProofContinuation });
+const Failure = Schema.Union([
+	EmailRejected,
+	EmailUnavailable,
+	EmailActionRequired,
+	EmailMethodUnsupported,
+	HookDenied
+]);
+const tuple = Schema.fromJsonString(Schema.Array(Schema.String));
+const noAmbient = Effect.fn("EmailAddresses.noAmbient")(function* () {
+	if (yield* hasCommitScope) return yield* EmailMethodUnsupported.make({});
+});
+const Configuration = Schema.Struct({
+	maximumEvidenceAgeMillis: Schema.Int.check(Schema.isBetween({
+		minimum: 1e3,
+		maximum: 3e5
+	})),
+	requireImmediateInvalidation: Schema.Boolean
+});
+const makeEmailAddresses = (moduleId, binding, verifyProof, changeProof, sessions, configuration) => {
+	const capturedPolicy = { ...configuration };
+	const Addresses = Context.Service(`effect-auth/email/${moduleId}/Addresses`);
+	const layer = Layer.effect(Addresses, Effect.gen(function* () {
+		const policy = yield* Schema.decodeEffect(Configuration)(capturedPolicy).pipe(Effect.mapError(() => EmailConfigurationError.make({})));
+		const binder = yield* binding.RequestBinding;
+		const persistence = yield* EmailAddressPersistence;
+		const actionAuthority = yield* EmailActionEvidence;
+		const verify = yield* verifyProof.Proofs;
+		const change = yield* changeProof.Proofs;
+		const strategy = yield* sessions.SessionStrategy;
+		const crypto = yield* Crypto.Crypto;
+		const hooks = yield* LifecycleHooks;
+		const digest = Effect.fn("EmailAddresses.digest")(function* (parts) {
+			const message = yield* Schema.encodeEffect(tuple)(parts);
+			return TokenDigest.make(Encoding.encodeBase64Url(yield* crypto.digest("SHA-256", new TextEncoder().encode(message))));
+		}, Effect.mapError(() => EmailUnavailable.make({})));
+		const bound = Effect.fn("EmailAddresses.binding")(function* (action, invocation, request) {
+			if (invocation._tag !== "Authenticated") return yield* EmailRejected.make({});
+			if (policy.requireImmediateInvalidation && strategy.capabilities.subjectInvalidation !== "immediate") return yield* EmailMethodUnsupported.make({});
+			if (action === "change-address" && request.sourceCredentialId === void 0) return yield* EmailRejected.make({});
+			const privateBinding = yield* binder.verify(request.flowId, request.requestBinding).pipe(Effect.mapError(() => EmailRejected.make({})));
+			const identifier = Object.freeze(LoginIdentifier.make({
+				namespace: "email",
+				value: request.email
+			}));
+			const current = yield* persistence.target({
+				moduleId,
+				subjectId: invocation.subjectId,
+				target: identifier,
+				sourceCredentialId: request.sourceCredentialId
+			});
+			const captured = Object.freeze({
+				revision: snapshotEmailRevision(current.revision),
+				eligible: current.eligible,
+				...current.source === void 0 ? {} : { source: yield* snapshotEmailCredential(current.source) }
+			});
+			if (captured.revision.subjectId !== invocation.subjectId || action === "change-address" && (captured.source === void 0 || captured.source.credentialId !== request.sourceCredentialId || captured.source.revision.subjectId !== invocation.subjectId || captured.source.revision.securityRevision !== captured.revision.securityRevision)) return yield* EmailRejected.make({});
+			const actionDigest = yield* digest([
+				"effect-auth/email-action/v1",
+				moduleId,
+				action,
+				request.commandId,
+				captured.revision.subjectId,
+				captured.revision.securityRevision,
+				captured.source?.credentialId ?? "",
+				captured.source?.identifier.value ?? "",
+				identifier.value,
+				...[...captured.revision.credentials].sort((a, b) => a.credentialId < b.credentialId ? -1 : a.credentialId > b.credentialId ? 1 : 0).flatMap((item) => [item.credentialId, item.revision])
+			]);
+			const decoded = EmailActionChallenge.make({
+				moduleId,
+				action,
+				commandId: request.commandId,
+				revision: captured.revision,
+				target: identifier,
+				...captured.source === void 0 ? {} : { sourceCredentialId: captured.source.credentialId },
+				bindingDigest: actionDigest
+			});
+			const challenge = Object.freeze({
+				...decoded,
+				revision: snapshotEmailRevision(decoded.revision),
+				target: Object.freeze(LoginIdentifier.make(decoded.target))
+			});
+			const contextDigest = yield* digest([
+				"effect-auth/email-address-proof/v1",
+				moduleId,
+				action,
+				request.flowId,
+				privateBinding.verifier,
+				actionDigest
+			]);
+			return {
+				captured,
+				identifier,
+				challenge,
+				binding: {
+					_tag: "IdentifierChange",
+					identifier,
+					revision: captured.revision,
+					flowId: request.flowId,
+					contextDigest
+				}
+			};
+		});
+		const authorize = Effect.fn("EmailAddresses.authorize")(function* (invocation, request, challenge) {
+			const grant = yield* actionAuthority.verify({
+				invocation,
+				challenge,
+				proof: request.actionProof
+			});
+			const raw = yield* snapshotAuthenticationEvidence(grant.evidence).pipe(Effect.mapError(() => EmailActionRequired.make({})));
+			const evidence = {
+				...raw,
+				revision: snapshotEmailRevision(raw.revision)
+			};
+			if (evidence.flowId !== AuthenticationFlowId.make(challenge.commandId) || evidence.bindingDigest !== challenge.bindingDigest || evidence.revision.subjectId !== challenge.revision.subjectId || evidence.revision.securityRevision !== challenge.revision.securityRevision || challenge.revision.credentials.some((expected) => !evidence.revision.credentials.some((actual) => expected.credentialId === actual.credentialId && expected.revision === actual.revision))) return yield* EmailActionRequired.make({});
+			const requirement = yield* snapshotEmailRequirement({
+				...grant.requirement,
+				maximumAgeMillis: Math.min(policy.maximumEvidenceAgeMillis, grant.requirement.maximumAgeMillis)
+			});
+			if (!(yield* assessAuthentication(evidence, requirement).pipe(Effect.mapError(() => EmailActionRequired.make({})))).satisfied) return yield* EmailActionRequired.make({});
+			return Object.freeze({
+				challenge,
+				evidence,
+				requirement
+			});
+		});
+		return Addresses.of({
+			request: Effect.fn("EmailAddresses.request")(function* (action, invocation, input, supersedes) {
+				yield* noAmbient();
+				const current = yield* bound(action, invocation, input);
+				yield* authorize(invocation, input, current.challenge);
+				const dispatch = yield* (action === "verify-address" ? verify : change).prepareIssue({
+					requestId: input.requestId,
+					binding: current.binding,
+					locale: input.locale,
+					eligible: current.captured.eligible,
+					...supersedes === void 0 ? {} : { supersedes }
+				}).pipe(Effect.flatMap(readProofCommit), Effect.mapError(() => EmailUnavailable.make({})));
+				yield* dispatch.dispatch.pipe(Effect.mapError(() => EmailUnavailable.make({})));
+				return dispatch.receipt;
+			}),
+			attempt: Effect.fn("EmailAddresses.attempt")(function* (action, invocation, input) {
+				yield* noAmbient();
+				const current = yield* bound(action, invocation, input);
+				const result = yield* (action === "verify-address" ? verify : change).prepareAttempt({
+					reference: input.reference,
+					credential: input.secret,
+					binding: current.binding
+				}).pipe(Effect.flatMap(readProofCommit), Effect.mapError(() => EmailRejected.make({})));
+				if (result.value._tag === "Rejected") return yield* EmailRejected.make({});
+				return {
+					value: { continuation: result.value.continuation },
+					credentialCommands: result.credentialCommands
+				};
+			}),
+			planComplete: Effect.fn("EmailAddresses.planComplete")(function* (action, invocation, input) {
+				yield* noAmbient();
+				const current = yield* bound(action, invocation, input);
+				const completion = yield* (action === "verify-address" ? verify : change).planComplete({
+					continuationId: input.continuationId,
+					credential: input.credential,
+					binding: current.binding
+				}).pipe(Effect.mapError(() => EmailRejected.make({})));
+				if (!(yield* persistence.checkCompletion(completion.input))) return yield* EmailRejected.make({});
+				const authorization = yield* authorize(invocation, input, current.challenge);
+				const invalidation = sessionInvalidationWindow("identifier-change", strategy.capabilities, strategy.policy);
+				const snapshot = lifecycleSnapshot({
+					action: "identifier-change",
+					operation: `${moduleId}/${action}`,
+					method: "email-code",
+					subjectId: current.captured.revision.subjectId,
+					identifiers: [...action === "change-address" && current.captured.source ? [current.captured.source.identifier] : [], current.identifier]
+				});
+				yield* hooks.before(snapshot);
+				const bytes = yield* crypto.randomBytes(32).pipe(Effect.mapError(() => EmailUnavailable.make({})));
+				const event = lifecycleEvent({
+					id: LifecycleEventId.make(Encoding.encodeBase64Url(bytes)),
+					occurredAtMillis: DateTime.toEpochMillis(yield* DateTime.now),
+					snapshot
+				});
+				const mutation = Object.freeze({
+					moduleId,
+					commandId: input.commandId,
+					target: current.identifier,
+					captured: current.captured,
+					authorization,
+					completion,
+					invalidation
+				});
+				const prepare = (decision, journal) => {
+					if (decision === "changed") journal.stage(event);
+					return journal.prepare({
+						value: decision === "changed" ? { invalidation } : { _tag: "Rejected" },
+						credentialCommands: decision === "changed" ? [
+							{
+								_tag: "Clear",
+								slot: "session"
+							},
+							{
+								_tag: "Clear",
+								slot: "pending-proof"
+							},
+							{
+								_tag: "Clear",
+								slot: "proof-continuation"
+							},
+							{
+								_tag: "Clear",
+								slot: "request-binding"
+							}
+						] : []
+					});
+				};
+				const commit = Effect.gen(function* () {
+					const owner = yield* EmailAddressPersistence;
+					return yield* action === "verify-address" ? owner.verifyWithProof(mutation, prepare) : owner.changeWithProof(mutation, prepare);
+				});
+				return Object.freeze({ commit });
+			}),
+			cleanup: Effect.fn("EmailAddresses.cleanup")(function* (limit) {
+				yield* noAmbient();
+				yield* Schema.decodeEffect(Schema.Int.check(Schema.isBetween({
+					minimum: 1,
+					maximum: 1e3
+				})))(limit).pipe(Effect.mapError(() => EmailRejected.make({})));
+				return yield* (yield* persistence.cleanup({
+					moduleId,
+					limit
+				}, (value, journal) => journal.prepare(value))).read.pipe(Effect.mapError(() => EmailUnavailable.make({})));
+			})
+		});
+	}));
+	const makeOperations = (mode, schemas) => {
+		const action = mode === "verify" ? "verify-address" : "change-address";
+		const Request = makeOperation(`${moduleId}/address/${mode}/request`, {
+			payload: schemas.request,
+			success: ProofRequestReceipt,
+			error: Failure,
+			access: "authenticated",
+			exposure: "public",
+			replay: "idempotent"
+		});
+		const Resend = makeOperation(`${moduleId}/address/${mode}/resend`, {
+			payload: schemas.resend,
+			success: ProofRequestReceipt,
+			error: Failure,
+			access: "authenticated",
+			exposure: "public",
+			replay: "idempotent"
+		});
+		const Attempt = makeOperation(`${moduleId}/address/${mode}/attempt`, {
+			payload: schemas.attempt,
+			success: AttemptSuccess,
+			error: Failure,
+			access: "authenticated",
+			exposure: "public",
+			replay: "single-use",
+			credentials: true
+		});
+		const Complete = makeOperation(`${moduleId}/address/${mode}/complete`, {
+			payload: schemas.complete,
+			success: Success,
+			error: Failure,
+			access: "authenticated",
+			exposure: "public",
+			replay: "single-use",
+			credentials: true
+		});
+		const handlersLayer = Layer.mergeAll(Request.handlerLayer(Effect.fn("EmailAddresses.Request")(function* (input, invocation) {
+			return yield* (yield* Addresses).request(action, invocation, input);
+		})), Resend.handlerLayer(Effect.fn("EmailAddresses.Resend")(function* (input, invocation) {
+			return yield* (yield* Addresses).request(action, invocation, input, input.supersedes);
+		})), Attempt.credentialHandlerLayer(Effect.fn("EmailAddresses.Attempt")(function* (input, invocation) {
+			return yield* (yield* Addresses).attempt(action, invocation, input);
+		})), Complete.credentialHandlerLayer(Effect.fn("EmailAddresses.Complete")(function* (input, invocation) {
+			const result = yield* (yield* (yield* (yield* Addresses).planComplete(action, invocation, input)).commit).read.pipe(Effect.mapError(() => EmailUnavailable.make({})));
+			if (!("invalidation" in result.value)) return yield* EmailRejected.make({});
+			return {
+				value: result.value,
+				credentialCommands: result.credentialCommands
+			};
+		})));
+		return Object.freeze({
+			operations: {
+				Request,
+				Resend,
+				Attempt,
+				Complete
+			},
+			handlersLayer,
+			group: operationGroup(Request, Resend, Attempt, Complete)
+		});
+	};
+	const verify = makeOperations("verify", {
+		request: RequestInput,
+		resend: ResendInput,
+		attempt: AttemptInput,
+		complete: CompleteInput
+	});
+	const change = makeOperations("change", {
+		request: ChangeRequest,
+		resend: ChangeResend,
+		attempt: ChangeAttempt,
+		complete: ChangeComplete
+	});
+	const Cleanup = makeOperation(`${moduleId}/address/cleanup`, {
+		payload: Schema.Struct({ limit: Schema.Int.check(Schema.isBetween({
+			minimum: 1,
+			maximum: 1e3
+		})) }),
+		success: Schema.Struct({
+			removed: Schema.Natural,
+			hasMore: Schema.Boolean
+		}),
+		error: Failure,
+		access: "system",
+		exposure: "internal",
+		replay: "idempotent"
+	});
+	const cleanupLayer = Cleanup.handlerLayer(Effect.fn("EmailAddresses.Cleanup")(function* (input) {
+		return yield* (yield* Addresses).cleanup(input.limit);
+	}));
+	return Object.freeze({
+		Addresses,
+		layer,
+		verify,
+		change,
+		Cleanup,
+		cleanupLayer,
+		verifyProof,
+		changeProof
+	});
+};
+//#endregion
+export { makeEmailAddresses };
+
+//# sourceMappingURL=addresses.mjs.map

package/dist/email/addresses.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"addresses.mjs","names":[],"sources":["../../src/email/addresses.ts"],"sourcesContent":["import { Context, Crypto, DateTime, Effect, Encoding, Layer, Schema } from \"effect\";\n\nimport { hasCommitScope, type PreparedCommit } from \"../hooks/commit\";\nimport { LifecycleHooks } from \"../hooks/LifecycleHooks\";\nimport { HookDenied, LifecycleEventId, lifecycleEvent, lifecycleSnapshot } from \"../hooks/models\";\nimport { LoginIdentifier } from \"../identity/models\";\nimport type { AuthInvocation } from \"../operations/context\";\nimport type { AuthOperationResult } from \"../operations/credentials\";\nimport { makeOperation, operationGroup } from \"../operations/operation\";\nimport type { makeRequestBinding } from \"../operations/requestBinding\";\nimport { RequestBindingCredential, RequestBindingFlowId } from \"../operations/requestBinding\";\nimport { readProofCommit } from \"../proofs/dispatch\";\nimport type { ProofBinding } from \"../proofs/models\";\nimport {\n  ProofContinuation,\n  ProofContinuationId,\n  ProofId,\n  ProofReference,\n  ProofRequestId,\n  ProofRequestReceipt,\n} from \"../proofs/models\";\nimport type { makeProofModule } from \"../proofs/module\";\nimport { Email, TokenDigest } from \"../Schema\";\nimport { assessAuthentication, snapshotAuthenticationEvidence } from \"../sessions/assurance\";\nimport { SessionInvalidationWindow, sessionInvalidationWindow } from \"../sessions/invalidation\";\nimport { AuthenticationFlowId } from \"../sessions/models\";\nimport type { makeSessionModule } from \"../sessions/module\";\nimport { EmailActionEvidence, type EmailActionAuthorization } from \"./EmailActionEvidence\";\nimport { EmailAddressPersistence, type EmailAddressTarget } from \"./EmailAddressPersistence\";\nimport {\n  EmailActionRequired,\n  EmailConfigurationError,\n  EmailMethodUnsupported,\n  EmailRejected,\n  EmailUnavailable,\n} from \"./errors\";\nimport { EmailActionChallenge, EmailCommandId, type EmailAction } from \"./models\";\nimport {\n  snapshotEmailCredential,\n  snapshotEmailRequirement,\n  snapshotEmailRevision,\n} from \"./snapshot\";\n\nconst BoundedId = Schema.NonEmptyString.check(Schema.isMaxLength(256));\nconst Secret = Schema.RedactedFromValue(Schema.String.check(Schema.isMaxLength(4096)));\n\nconst base = {\n  flowId: RequestBindingFlowId,\n  requestBinding: RequestBindingCredential,\n  commandId: EmailCommandId,\n  email: Schema.String.check(Schema.isMaxLength(320)).pipe(Schema.decodeTo(Email)),\n  sourceCredentialId: Schema.optionalKey(BoundedId),\n  actionProof: Schema.optionalKey(Secret),\n};\n\nconst BindingInput = Schema.Struct(base);\n\nconst RequestInput = Schema.Struct({\n  ...base,\n  requestId: ProofRequestId,\n  locale: Schema.NonEmptyString.check(Schema.isMaxLength(64)),\n});\n\nconst ResendInput = Schema.Struct({ ...RequestInput.fields, supersedes: ProofId });\nconst AttemptInput = Schema.Struct({ ...base, reference: ProofReference, secret: Secret });\n\nconst CompleteInput = Schema.Struct({\n  ...base,\n  continuationId: ProofContinuationId,\n  credential: Secret,\n});\n\nconst ChangeRequest = Schema.Struct({ ...RequestInput.fields, sourceCredentialId: BoundedId });\nconst ChangeResend = Schema.Struct({ ...ResendInput.fields, sourceCredentialId: BoundedId });\nconst ChangeAttempt = Schema.Struct({ ...AttemptInput.fields, sourceCredentialId: BoundedId });\nconst ChangeComplete = Schema.Struct({ ...CompleteInput.fields, sourceCredentialId: BoundedId });\nconst Success = Schema.Struct({ invalidation: SessionInvalidationWindow });\nconst AttemptSuccess = Schema.Struct({ continuation: ProofContinuation });\n\nconst Failure = Schema.Union([\n  EmailRejected,\n  EmailUnavailable,\n  EmailActionRequired,\n  EmailMethodUnsupported,\n  HookDenied,\n]);\n\ntype Failure = typeof Failure.Type;\nconst tuple = Schema.fromJsonString(Schema.Array(Schema.String));\n\nconst noAmbient = Effect.fn(\"EmailAddresses.noAmbient\")(function* () {\n  if (yield* hasCommitScope) return yield* EmailMethodUnsupported.make({});\n});\n\nconst Configuration = Schema.Struct({\n  maximumEvidenceAgeMillis: Schema.Int.check(Schema.isBetween({ minimum: 1000, maximum: 300_000 })),\n  requireImmediateInvalidation: Schema.Boolean,\n});\n\nexport type EmailAddressPolicy = typeof Configuration.Type;\n\nexport interface AddressModule<Id extends string> {\n  readonly moduleId: Id;\n  readonly kind: \"addresses\";\n}\n\nexport const makeEmailAddresses = <\n  const Id extends string,\n  const VerifyId extends string,\n  const ChangeId extends string,\n  const SessionId extends string,\n  Claims extends Schema.Codec<unknown, unknown, unknown, unknown>,\n>(\n  moduleId: Id,\n  binding: ReturnType<typeof makeRequestBinding<Id, \"email-entry\">>,\n  verifyProof: ReturnType<typeof makeProofModule<VerifyId, typeof ProofBinding>>,\n  changeProof: ReturnType<typeof makeProofModule<ChangeId, typeof ProofBinding>>,\n  sessions: ReturnType<typeof makeSessionModule<SessionId, Claims>>,\n  configuration: EmailAddressPolicy,\n) => {\n  const capturedPolicy = { ...configuration };\n\n  type Result = AuthOperationResult<typeof Success.Type | { readonly _tag: \"Rejected\" }>;\n  type Plan = {\n    readonly commit: Effect.Effect<\n      PreparedCommit<Result>,\n      EmailUnavailable,\n      EmailAddressPersistence\n    >;\n  };\n\n  const Addresses = Context.Service<\n    AddressModule<Id>,\n    {\n      readonly request: (\n        action: EmailAction,\n        invocation: AuthInvocation,\n        input: typeof RequestInput.Type,\n        supersedes?: ProofId,\n      ) => Effect.Effect<ProofRequestReceipt, Failure>;\n      readonly attempt: (\n        action: EmailAction,\n        invocation: AuthInvocation,\n        input: typeof AttemptInput.Type,\n      ) => Effect.Effect<AuthOperationResult<typeof AttemptSuccess.Type>, Failure>;\n      readonly planComplete: (\n        action: EmailAction,\n        invocation: AuthInvocation,\n        input: typeof CompleteInput.Type,\n      ) => Effect.Effect<Plan, Failure>;\n      readonly cleanup: (\n        limit: number,\n      ) => Effect.Effect<{ readonly removed: number; readonly hasMore: boolean }, Failure>;\n    }\n  >(`effect-auth/email/${moduleId}/Addresses`);\n\n  const layer = Layer.effect(\n    Addresses,\n    Effect.gen(function* () {\n      const policy = yield* Schema.decodeEffect(Configuration)(capturedPolicy).pipe(\n        Effect.mapError(() => EmailConfigurationError.make({})),\n      );\n\n      const binder = yield* binding.RequestBinding;\n      const persistence = yield* EmailAddressPersistence;\n      const actionAuthority = yield* EmailActionEvidence;\n      const verify = yield* verifyProof.Proofs;\n      const change = yield* changeProof.Proofs;\n      const strategy = yield* sessions.SessionStrategy;\n      const crypto = yield* Crypto.Crypto;\n      const hooks = yield* LifecycleHooks;\n\n      const digest = Effect.fn(\"EmailAddresses.digest\")(\n        function* (parts: ReadonlyArray<string>) {\n          const message = yield* Schema.encodeEffect(tuple)(parts);\n\n          return TokenDigest.make(\n            Encoding.encodeBase64Url(\n              yield* crypto.digest(\"SHA-256\", new TextEncoder().encode(message)),\n            ),\n          );\n        },\n        Effect.mapError(() => EmailUnavailable.make({})),\n      );\n\n      const bound = Effect.fn(\"EmailAddresses.binding\")(function* (\n        action: EmailAction,\n        invocation: AuthInvocation,\n        request: typeof BindingInput.Type,\n      ) {\n        if (invocation._tag !== \"Authenticated\") return yield* EmailRejected.make({});\n        if (\n          policy.requireImmediateInvalidation &&\n          strategy.capabilities.subjectInvalidation !== \"immediate\"\n        )\n          return yield* EmailMethodUnsupported.make({});\n        if (action === \"change-address\" && request.sourceCredentialId === undefined)\n          return yield* EmailRejected.make({});\n\n        const privateBinding = yield* binder\n          .verify(request.flowId, request.requestBinding)\n          .pipe(Effect.mapError(() => EmailRejected.make({})));\n\n        const identifier = Object.freeze(\n          LoginIdentifier.make({ namespace: \"email\", value: request.email }),\n        );\n\n        const current = yield* persistence.target({\n          moduleId,\n          subjectId: invocation.subjectId,\n          target: identifier,\n          sourceCredentialId: request.sourceCredentialId,\n        });\n\n        const captured: EmailAddressTarget = Object.freeze({\n          revision: snapshotEmailRevision(current.revision),\n          eligible: current.eligible,\n          ...(current.source === undefined\n            ? {}\n            : { source: yield* snapshotEmailCredential(current.source) }),\n        });\n\n        if (\n          captured.revision.subjectId !== invocation.subjectId ||\n          (action === \"change-address\" &&\n            (captured.source === undefined ||\n              captured.source.credentialId !== request.sourceCredentialId ||\n              captured.source.revision.subjectId !== invocation.subjectId ||\n              captured.source.revision.securityRevision !== captured.revision.securityRevision))\n        )\n          return yield* EmailRejected.make({});\n\n        const actionDigest = yield* digest([\n          \"effect-auth/email-action/v1\",\n          moduleId,\n          action,\n          request.commandId,\n          captured.revision.subjectId,\n          captured.revision.securityRevision,\n          captured.source?.credentialId ?? \"\",\n          captured.source?.identifier.value ?? \"\",\n          identifier.value,\n          ...[...captured.revision.credentials]\n            .sort((a, b) =>\n              a.credentialId < b.credentialId ? -1 : a.credentialId > b.credentialId ? 1 : 0,\n            )\n            .flatMap((item) => [item.credentialId, item.revision]),\n        ]);\n\n        const decoded = EmailActionChallenge.make({\n          moduleId,\n          action,\n          commandId: request.commandId,\n          revision: captured.revision,\n          target: identifier,\n          ...(captured.source === undefined\n            ? {}\n            : { sourceCredentialId: captured.source.credentialId }),\n          bindingDigest: actionDigest,\n        });\n\n        const challenge = Object.freeze({\n          ...decoded,\n          revision: snapshotEmailRevision(decoded.revision),\n          target: Object.freeze(LoginIdentifier.make(decoded.target)),\n        });\n\n        const contextDigest = yield* digest([\n          \"effect-auth/email-address-proof/v1\",\n          moduleId,\n          action,\n          request.flowId,\n          privateBinding.verifier,\n          actionDigest,\n        ]);\n\n        const proofBinding: ProofBinding = {\n          _tag: \"IdentifierChange\",\n          identifier,\n          revision: captured.revision,\n          flowId: request.flowId,\n          contextDigest,\n        };\n\n        return { captured, identifier, challenge, binding: proofBinding };\n      });\n\n      const authorize = Effect.fn(\"EmailAddresses.authorize\")(function* (\n        invocation: AuthInvocation,\n        request: typeof BindingInput.Type,\n        challenge: EmailActionChallenge,\n      ) {\n        const grant = yield* actionAuthority.verify({\n          invocation,\n          challenge,\n          proof: request.actionProof,\n        });\n\n        const raw = yield* snapshotAuthenticationEvidence(grant.evidence).pipe(\n          Effect.mapError(() => EmailActionRequired.make({})),\n        );\n\n        const evidence = { ...raw, revision: snapshotEmailRevision(raw.revision) };\n\n        if (\n          evidence.flowId !== AuthenticationFlowId.make(challenge.commandId) ||\n          evidence.bindingDigest !== challenge.bindingDigest ||\n          evidence.revision.subjectId !== challenge.revision.subjectId ||\n          evidence.revision.securityRevision !== challenge.revision.securityRevision ||\n          challenge.revision.credentials.some(\n            (expected) =>\n              !evidence.revision.credentials.some(\n                (actual) =>\n                  expected.credentialId === actual.credentialId &&\n                  expected.revision === actual.revision,\n              ),\n          )\n        )\n          return yield* EmailActionRequired.make({});\n\n        const requirement = yield* snapshotEmailRequirement({\n          ...grant.requirement,\n          maximumAgeMillis: Math.min(\n            policy.maximumEvidenceAgeMillis,\n            grant.requirement.maximumAgeMillis,\n          ),\n        });\n\n        if (\n          !(yield* assessAuthentication(evidence, requirement).pipe(\n            Effect.mapError(() => EmailActionRequired.make({})),\n          )).satisfied\n        )\n          return yield* EmailActionRequired.make({});\n\n        return Object.freeze({\n          challenge,\n          evidence,\n          requirement,\n        }) satisfies EmailActionAuthorization;\n      });\n\n      return Addresses.of({\n        request: Effect.fn(\"EmailAddresses.request\")(\n          function* (action, invocation, input, supersedes) {\n            yield* noAmbient();\n            const current = yield* bound(action, invocation, input);\n\n            yield* authorize(invocation, input, current.challenge);\n            const proofs = action === \"verify-address\" ? verify : change;\n\n            const dispatch = yield* proofs\n              .prepareIssue({\n                requestId: input.requestId,\n                binding: current.binding,\n                locale: input.locale,\n                eligible: current.captured.eligible,\n                ...(supersedes === undefined ? {} : { supersedes }),\n              })\n              .pipe(\n                Effect.flatMap(readProofCommit),\n                Effect.mapError(() => EmailUnavailable.make({})),\n              );\n\n            yield* dispatch.dispatch.pipe(Effect.mapError(() => EmailUnavailable.make({})));\n\n            return dispatch.receipt;\n          },\n        ),\n        attempt: Effect.fn(\"EmailAddresses.attempt\")(function* (action, invocation, input) {\n          yield* noAmbient();\n          const current = yield* bound(action, invocation, input);\n          const proofs = action === \"verify-address\" ? verify : change;\n\n          const result = yield* proofs\n            .prepareAttempt({\n              reference: input.reference,\n              credential: input.secret,\n              binding: current.binding,\n            })\n            .pipe(\n              Effect.flatMap(readProofCommit),\n              Effect.mapError(() => EmailRejected.make({})),\n            );\n\n          if (result.value._tag === \"Rejected\") return yield* EmailRejected.make({});\n\n          return {\n            value: { continuation: result.value.continuation },\n            credentialCommands: result.credentialCommands,\n          };\n        }),\n        planComplete: Effect.fn(\"EmailAddresses.planComplete\")(\n          function* (action, invocation, input) {\n            yield* noAmbient();\n            const current = yield* bound(action, invocation, input);\n            const proofs = action === \"verify-address\" ? verify : change;\n\n            const completion = yield* proofs\n              .planComplete({\n                continuationId: input.continuationId,\n                credential: input.credential,\n                binding: current.binding,\n              })\n              .pipe(Effect.mapError(() => EmailRejected.make({})));\n\n            if (!(yield* persistence.checkCompletion(completion.input)))\n              return yield* EmailRejected.make({});\n            const authorization = yield* authorize(invocation, input, current.challenge);\n\n            const invalidation = sessionInvalidationWindow(\n              \"identifier-change\",\n              strategy.capabilities,\n              strategy.policy,\n            );\n\n            const snapshot = lifecycleSnapshot({\n              action: \"identifier-change\",\n              operation: `${moduleId}/${action}`,\n              method: \"email-code\",\n              subjectId: current.captured.revision.subjectId,\n              identifiers: [\n                ...(action === \"change-address\" && current.captured.source\n                  ? [current.captured.source.identifier]\n                  : []),\n                current.identifier,\n              ],\n            });\n\n            yield* hooks.before(snapshot);\n\n            const bytes = yield* crypto\n              .randomBytes(32)\n              .pipe(Effect.mapError(() => EmailUnavailable.make({})));\n\n            const event = lifecycleEvent({\n              id: LifecycleEventId.make(Encoding.encodeBase64Url(bytes)),\n              occurredAtMillis: DateTime.toEpochMillis(yield* DateTime.now),\n              snapshot,\n            });\n\n            const mutation = Object.freeze({\n              moduleId,\n              commandId: input.commandId,\n              target: current.identifier,\n              captured: current.captured,\n              authorization,\n              completion,\n              invalidation,\n            });\n\n            const prepare = (\n              decision: \"changed\" | \"rejected\",\n              journal: Parameters<\n                Parameters<EmailAddressPersistence[\"Service\"][\"changeWithProof\"]>[1]\n              >[1],\n            ) => {\n              if (decision === \"changed\") journal.stage(event);\n\n              return journal.prepare<Result>({\n                value: decision === \"changed\" ? { invalidation } : { _tag: \"Rejected\" },\n                credentialCommands:\n                  decision === \"changed\"\n                    ? [\n                        { _tag: \"Clear\", slot: \"session\" },\n                        { _tag: \"Clear\", slot: \"pending-proof\" },\n                        { _tag: \"Clear\", slot: \"proof-continuation\" },\n                        { _tag: \"Clear\", slot: \"request-binding\" },\n                      ]\n                    : [],\n              });\n            };\n\n            const commit = Effect.gen(function* () {\n              const owner = yield* EmailAddressPersistence;\n\n              return yield* action === \"verify-address\"\n                ? owner.verifyWithProof(mutation, prepare)\n                : owner.changeWithProof(mutation, prepare);\n            });\n\n            return Object.freeze({ commit });\n          },\n        ),\n        cleanup: Effect.fn(\"EmailAddresses.cleanup\")(function* (limit) {\n          yield* noAmbient();\n          yield* Schema.decodeEffect(\n            Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 1000 })),\n          )(limit).pipe(Effect.mapError(() => EmailRejected.make({})));\n\n          const receipt = yield* persistence.cleanup({ moduleId, limit }, (value, journal) =>\n            journal.prepare(value),\n          );\n\n          return yield* receipt.read.pipe(Effect.mapError(() => EmailUnavailable.make({})));\n        }),\n      });\n    }),\n  );\n\n  const makeOperations = <\n    const Mode extends \"verify\" | \"change\",\n    const Schemas extends {\n      readonly request: typeof RequestInput | typeof ChangeRequest;\n      readonly resend: typeof ResendInput | typeof ChangeResend;\n      readonly attempt: typeof AttemptInput | typeof ChangeAttempt;\n      readonly complete: typeof CompleteInput | typeof ChangeComplete;\n    },\n  >(\n    mode: Mode,\n    schemas: Schemas,\n  ) => {\n    const action = mode === \"verify\" ? \"verify-address\" : \"change-address\";\n\n    const Request = makeOperation(`${moduleId}/address/${mode}/request`, {\n      payload: schemas.request,\n      success: ProofRequestReceipt,\n      error: Failure,\n      access: \"authenticated\",\n      exposure: \"public\",\n      replay: \"idempotent\",\n    });\n\n    const Resend = makeOperation(`${moduleId}/address/${mode}/resend`, {\n      payload: schemas.resend,\n      success: ProofRequestReceipt,\n      error: Failure,\n      access: \"authenticated\",\n      exposure: \"public\",\n      replay: \"idempotent\",\n    });\n\n    const Attempt = makeOperation(`${moduleId}/address/${mode}/attempt`, {\n      payload: schemas.attempt,\n      success: AttemptSuccess,\n      error: Failure,\n      access: \"authenticated\",\n      exposure: \"public\",\n      replay: \"single-use\",\n      credentials: true,\n    });\n\n    const Complete = makeOperation(`${moduleId}/address/${mode}/complete`, {\n      payload: schemas.complete,\n      success: Success,\n      error: Failure,\n      access: \"authenticated\",\n      exposure: \"public\",\n      replay: \"single-use\",\n      credentials: true,\n    });\n\n    const handlersLayer = Layer.mergeAll(\n      Request.handlerLayer(\n        Effect.fn(\"EmailAddresses.Request\")(function* (input, invocation) {\n          return yield* (yield* Addresses).request(action, invocation, input);\n        }),\n      ),\n      Resend.handlerLayer(\n        Effect.fn(\"EmailAddresses.Resend\")(function* (input, invocation) {\n          return yield* (yield* Addresses).request(action, invocation, input, input.supersedes);\n        }),\n      ),\n      Attempt.credentialHandlerLayer(\n        Effect.fn(\"EmailAddresses.Attempt\")(function* (input, invocation) {\n          return yield* (yield* Addresses).attempt(action, invocation, input);\n        }),\n      ),\n      Complete.credentialHandlerLayer(\n        Effect.fn(\"EmailAddresses.Complete\")(function* (input, invocation) {\n          const plan = yield* (yield* Addresses).planComplete(action, invocation, input);\n          const receipt = yield* plan.commit;\n          const result = yield* receipt.read.pipe(Effect.mapError(() => EmailUnavailable.make({})));\n\n          if (!(\"invalidation\" in result.value)) return yield* EmailRejected.make({});\n\n          return { value: result.value, credentialCommands: result.credentialCommands };\n        }),\n      ),\n    );\n\n    return Object.freeze({\n      operations: { Request, Resend, Attempt, Complete },\n      handlersLayer,\n      group: operationGroup(Request, Resend, Attempt, Complete),\n    });\n  };\n\n  const verify = makeOperations(\"verify\", {\n    request: RequestInput,\n    resend: ResendInput,\n    attempt: AttemptInput,\n    complete: CompleteInput,\n  });\n\n  const change = makeOperations(\"change\", {\n    request: ChangeRequest,\n    resend: ChangeResend,\n    attempt: ChangeAttempt,\n    complete: ChangeComplete,\n  });\n\n  const Cleanup = makeOperation(`${moduleId}/address/cleanup`, {\n    payload: Schema.Struct({\n      limit: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 1000 })),\n    }),\n    success: Schema.Struct({ removed: Schema.Natural, hasMore: Schema.Boolean }),\n    error: Failure,\n    access: \"system\",\n    exposure: \"internal\",\n    replay: \"idempotent\",\n  });\n\n  const cleanupLayer = Cleanup.handlerLayer(\n    Effect.fn(\"EmailAddresses.Cleanup\")(function* (input) {\n      return yield* (yield* Addresses).cleanup(input.limit);\n    }),\n  );\n\n  return Object.freeze({\n    Addresses,\n    layer,\n    verify,\n    change,\n    Cleanup,\n    cleanupLayer,\n    verifyProof,\n    changeProof,\n  });\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA2CA,MAAM,YAAY,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC;AACrE,MAAM,SAAS,OAAO,kBAAkB,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC,CAAC;AAErF,MAAM,OAAO;CACX,QAAQ;CACR,gBAAgB;CAChB,WAAW;CACX,OAAO,OAAO,OAAO,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,KAAK,CAAC;CAC/E,oBAAoB,OAAO,YAAY,SAAS;CAChD,aAAa,OAAO,YAAY,MAAM;AACxC;AAEqB,OAAO,OAAO,IAAI;AAEvC,MAAM,eAAe,OAAO,OAAO;CACjC,GAAG;CACH,WAAW;CACX,QAAQ,OAAO,eAAe,MAAM,OAAO,YAAY,EAAE,CAAC;AAC5D,CAAC;AAED,MAAM,cAAc,OAAO,OAAO;CAAE,GAAG,aAAa;CAAQ,YAAY;AAAQ,CAAC;AACjF,MAAM,eAAe,OAAO,OAAO;CAAE,GAAG;CAAM,WAAW;CAAgB,QAAQ;AAAO,CAAC;AAEzF,MAAM,gBAAgB,OAAO,OAAO;CAClC,GAAG;CACH,gBAAgB;CAChB,YAAY;AACd,CAAC;AAED,MAAM,gBAAgB,OAAO,OAAO;CAAE,GAAG,aAAa;CAAQ,oBAAoB;AAAU,CAAC;AAC7F,MAAM,eAAe,OAAO,OAAO;CAAE,GAAG,YAAY;CAAQ,oBAAoB;AAAU,CAAC;AAC3F,MAAM,gBAAgB,OAAO,OAAO;CAAE,GAAG,aAAa;CAAQ,oBAAoB;AAAU,CAAC;AAC7F,MAAM,iBAAiB,OAAO,OAAO;CAAE,GAAG,cAAc;CAAQ,oBAAoB;AAAU,CAAC;AAC/F,MAAM,UAAU,OAAO,OAAO,EAAE,cAAc,0BAA0B,CAAC;AACzE,MAAM,iBAAiB,OAAO,OAAO,EAAE,cAAc,kBAAkB,CAAC;AAExE,MAAM,UAAU,OAAO,MAAM;CAC3B;CACA;CACA;CACA;CACA;AACF,CAAC;AAGD,MAAM,QAAQ,OAAO,eAAe,OAAO,MAAM,OAAO,MAAM,CAAC;AAE/D,MAAM,YAAY,OAAO,GAAG,0BAA0B,CAAC,CAAC,aAAa;CACnE,IAAI,OAAO,gBAAgB,OAAO,OAAO,uBAAuB,KAAK,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,gBAAgB,OAAO,OAAO;CAClC,0BAA0B,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAM,SAAS;CAAQ,CAAC,CAAC;CAChG,8BAA8B,OAAO;AACvC,CAAC;AASD,MAAa,sBAOX,UACA,SACA,aACA,aACA,UACA,kBACG;CACH,MAAM,iBAAiB,EAAE,GAAG,cAAc;CAW1C,MAAM,YAAY,QAAQ,QAuBxB,qBAAqB,SAAS,WAAW;CAE3C,MAAM,QAAQ,MAAM,OAClB,WACA,OAAO,IAAI,aAAa;EACtB,MAAM,SAAS,OAAO,OAAO,aAAa,aAAa,CAAC,CAAC,cAAc,CAAC,CAAC,KACvE,OAAO,eAAe,wBAAwB,KAAK,CAAC,CAAC,CAAC,CACxD;EAEA,MAAM,SAAS,OAAO,QAAQ;EAC9B,MAAM,cAAc,OAAO;EAC3B,MAAM,kBAAkB,OAAO;EAC/B,MAAM,SAAS,OAAO,YAAY;EAClC,MAAM,SAAS,OAAO,YAAY;EAClC,MAAM,WAAW,OAAO,SAAS;EACjC,MAAM,SAAS,OAAO,OAAO;EAC7B,MAAM,QAAQ,OAAO;EAErB,MAAM,SAAS,OAAO,GAAG,uBAAuB,CAAC,CAC/C,WAAW,OAA8B;GACvC,MAAM,UAAU,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC,KAAK;GAEvD,OAAO,YAAY,KACjB,SAAS,gBACP,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,OAAO,CAAC,CACnE,CACF;EACF,GACA,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CACjD;EAEA,MAAM,QAAQ,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAChD,QACA,YACA,SACA;GACA,IAAI,WAAW,SAAS,iBAAiB,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;GAC5E,IACE,OAAO,gCACP,SAAS,aAAa,wBAAwB,aAE9C,OAAO,OAAO,uBAAuB,KAAK,CAAC,CAAC;GAC9C,IAAI,WAAW,oBAAoB,QAAQ,uBAAuB,KAAA,GAChE,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;GAErC,MAAM,iBAAiB,OAAO,OAC3B,OAAO,QAAQ,QAAQ,QAAQ,cAAc,CAAC,CAC9C,KAAK,OAAO,eAAe,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC;GAErD,MAAM,aAAa,OAAO,OACxB,gBAAgB,KAAK;IAAE,WAAW;IAAS,OAAO,QAAQ;GAAM,CAAC,CACnE;GAEA,MAAM,UAAU,OAAO,YAAY,OAAO;IACxC;IACA,WAAW,WAAW;IACtB,QAAQ;IACR,oBAAoB,QAAQ;GAC9B,CAAC;GAED,MAAM,WAA+B,OAAO,OAAO;IACjD,UAAU,sBAAsB,QAAQ,QAAQ;IAChD,UAAU,QAAQ;IAClB,GAAI,QAAQ,WAAW,KAAA,IACnB,CAAC,IACD,EAAE,QAAQ,OAAO,wBAAwB,QAAQ,MAAM,EAAE;GAC/D,CAAC;GAED,IACE,SAAS,SAAS,cAAc,WAAW,aAC1C,WAAW,qBACT,SAAS,WAAW,KAAA,KACnB,SAAS,OAAO,iBAAiB,QAAQ,sBACzC,SAAS,OAAO,SAAS,cAAc,WAAW,aAClD,SAAS,OAAO,SAAS,qBAAqB,SAAS,SAAS,mBAEpE,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;GAErC,MAAM,eAAe,OAAO,OAAO;IACjC;IACA;IACA;IACA,QAAQ;IACR,SAAS,SAAS;IAClB,SAAS,SAAS;IAClB,SAAS,QAAQ,gBAAgB;IACjC,SAAS,QAAQ,WAAW,SAAS;IACrC,WAAW;IACX,GAAG,CAAC,GAAG,SAAS,SAAS,WAAW,CAAC,CAClC,MAAM,GAAG,MACR,EAAE,eAAe,EAAE,eAAe,KAAK,EAAE,eAAe,EAAE,eAAe,IAAI,CAC/E,CAAC,CACA,SAAS,SAAS,CAAC,KAAK,cAAc,KAAK,QAAQ,CAAC;GACzD,CAAC;GAED,MAAM,UAAU,qBAAqB,KAAK;IACxC;IACA;IACA,WAAW,QAAQ;IACnB,UAAU,SAAS;IACnB,QAAQ;IACR,GAAI,SAAS,WAAW,KAAA,IACpB,CAAC,IACD,EAAE,oBAAoB,SAAS,OAAO,aAAa;IACvD,eAAe;GACjB,CAAC;GAED,MAAM,YAAY,OAAO,OAAO;IAC9B,GAAG;IACH,UAAU,sBAAsB,QAAQ,QAAQ;IAChD,QAAQ,OAAO,OAAO,gBAAgB,KAAK,QAAQ,MAAM,CAAC;GAC5D,CAAC;GAED,MAAM,gBAAgB,OAAO,OAAO;IAClC;IACA;IACA;IACA,QAAQ;IACR,eAAe;IACf;GACF,CAAC;GAUD,OAAO;IAAE;IAAU;IAAY;IAAW,SAAS;KAPjD,MAAM;KACN;KACA,UAAU,SAAS;KACnB,QAAQ,QAAQ;KAChB;IAG4D;GAAE;EAClE,CAAC;EAED,MAAM,YAAY,OAAO,GAAG,0BAA0B,CAAC,CAAC,WACtD,YACA,SACA,WACA;GACA,MAAM,QAAQ,OAAO,gBAAgB,OAAO;IAC1C;IACA;IACA,OAAO,QAAQ;GACjB,CAAC;GAED,MAAM,MAAM,OAAO,+BAA+B,MAAM,QAAQ,CAAC,CAAC,KAChE,OAAO,eAAe,oBAAoB,KAAK,CAAC,CAAC,CAAC,CACpD;GAEA,MAAM,WAAW;IAAE,GAAG;IAAK,UAAU,sBAAsB,IAAI,QAAQ;GAAE;GAEzE,IACE,SAAS,WAAW,qBAAqB,KAAK,UAAU,SAAS,KACjE,SAAS,kBAAkB,UAAU,iBACrC,SAAS,SAAS,cAAc,UAAU,SAAS,aACnD,SAAS,SAAS,qBAAqB,UAAU,SAAS,oBAC1D,UAAU,SAAS,YAAY,MAC5B,aACC,CAAC,SAAS,SAAS,YAAY,MAC5B,WACC,SAAS,iBAAiB,OAAO,gBACjC,SAAS,aAAa,OAAO,QACjC,CACJ,GAEA,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;GAE3C,MAAM,cAAc,OAAO,yBAAyB;IAClD,GAAG,MAAM;IACT,kBAAkB,KAAK,IACrB,OAAO,0BACP,MAAM,YAAY,gBACpB;GACF,CAAC;GAED,IACE,EAAE,OAAO,qBAAqB,UAAU,WAAW,CAAC,CAAC,KACnD,OAAO,eAAe,oBAAoB,KAAK,CAAC,CAAC,CAAC,CACpD,EAAA,CAAG,WAEH,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;GAE3C,OAAO,OAAO,OAAO;IACnB;IACA;IACA;GACF,CAAC;EACH,CAAC;EAED,OAAO,UAAU,GAAG;GAClB,SAAS,OAAO,GAAG,wBAAwB,CAAC,CAC1C,WAAW,QAAQ,YAAY,OAAO,YAAY;IAChD,OAAO,UAAU;IACjB,MAAM,UAAU,OAAO,MAAM,QAAQ,YAAY,KAAK;IAEtD,OAAO,UAAU,YAAY,OAAO,QAAQ,SAAS;IAGrD,MAAM,WAAW,QAFF,WAAW,mBAAmB,SAAS,OAAA,CAGnD,aAAa;KACZ,WAAW,MAAM;KACjB,SAAS,QAAQ;KACjB,QAAQ,MAAM;KACd,UAAU,QAAQ,SAAS;KAC3B,GAAI,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW;IACnD,CAAC,CAAC,CACD,KACC,OAAO,QAAQ,eAAe,GAC9B,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CACjD;IAEF,OAAO,SAAS,SAAS,KAAK,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC;IAE9E,OAAO,SAAS;GAClB,CACF;GACA,SAAS,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAAW,QAAQ,YAAY,OAAO;IACjF,OAAO,UAAU;IACjB,MAAM,UAAU,OAAO,MAAM,QAAQ,YAAY,KAAK;IAGtD,MAAM,SAAS,QAFA,WAAW,mBAAmB,SAAS,OAAA,CAGnD,eAAe;KACd,WAAW,MAAM;KACjB,YAAY,MAAM;KAClB,SAAS,QAAQ;IACnB,CAAC,CAAC,CACD,KACC,OAAO,QAAQ,eAAe,GAC9B,OAAO,eAAe,cAAc,KAAK,CAAC,CAAC,CAAC,CAC9C;IAEF,IAAI,OAAO,MAAM,SAAS,YAAY,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;IAEzE,OAAO;KACL,OAAO,EAAE,cAAc,OAAO,MAAM,aAAa;KACjD,oBAAoB,OAAO;IAC7B;GACF,CAAC;GACD,cAAc,OAAO,GAAG,6BAA6B,CAAC,CACpD,WAAW,QAAQ,YAAY,OAAO;IACpC,OAAO,UAAU;IACjB,MAAM,UAAU,OAAO,MAAM,QAAQ,YAAY,KAAK;IAGtD,MAAM,aAAa,QAFJ,WAAW,mBAAmB,SAAS,OAAA,CAGnD,aAAa;KACZ,gBAAgB,MAAM;KACtB,YAAY,MAAM;KAClB,SAAS,QAAQ;IACnB,CAAC,CAAC,CACD,KAAK,OAAO,eAAe,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC;IAErD,IAAI,EAAE,OAAO,YAAY,gBAAgB,WAAW,KAAK,IACvD,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;IACrC,MAAM,gBAAgB,OAAO,UAAU,YAAY,OAAO,QAAQ,SAAS;IAE3E,MAAM,eAAe,0BACnB,qBACA,SAAS,cACT,SAAS,MACX;IAEA,MAAM,WAAW,kBAAkB;KACjC,QAAQ;KACR,WAAW,GAAG,SAAS,GAAG;KAC1B,QAAQ;KACR,WAAW,QAAQ,SAAS,SAAS;KACrC,aAAa,CACX,GAAI,WAAW,oBAAoB,QAAQ,SAAS,SAChD,CAAC,QAAQ,SAAS,OAAO,UAAU,IACnC,CAAC,GACL,QAAQ,UACV;IACF,CAAC;IAED,OAAO,MAAM,OAAO,QAAQ;IAE5B,MAAM,QAAQ,OAAO,OAClB,YAAY,EAAE,CAAC,CACf,KAAK,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC;IAExD,MAAM,QAAQ,eAAe;KAC3B,IAAI,iBAAiB,KAAK,SAAS,gBAAgB,KAAK,CAAC;KACzD,kBAAkB,SAAS,cAAc,OAAO,SAAS,GAAG;KAC5D;IACF,CAAC;IAED,MAAM,WAAW,OAAO,OAAO;KAC7B;KACA,WAAW,MAAM;KACjB,QAAQ,QAAQ;KAChB,UAAU,QAAQ;KAClB;KACA;KACA;IACF,CAAC;IAED,MAAM,WACJ,UACA,YAGG;KACH,IAAI,aAAa,WAAW,QAAQ,MAAM,KAAK;KAE/C,OAAO,QAAQ,QAAgB;MAC7B,OAAO,aAAa,YAAY,EAAE,aAAa,IAAI,EAAE,MAAM,WAAW;MACtE,oBACE,aAAa,YACT;OACE;QAAE,MAAM;QAAS,MAAM;OAAU;OACjC;QAAE,MAAM;QAAS,MAAM;OAAgB;OACvC;QAAE,MAAM;QAAS,MAAM;OAAqB;OAC5C;QAAE,MAAM;QAAS,MAAM;OAAkB;MAC3C,IACA,CAAC;KACT,CAAC;IACH;IAEA,MAAM,SAAS,OAAO,IAAI,aAAa;KACrC,MAAM,QAAQ,OAAO;KAErB,OAAO,OAAO,WAAW,mBACrB,MAAM,gBAAgB,UAAU,OAAO,IACvC,MAAM,gBAAgB,UAAU,OAAO;IAC7C,CAAC;IAED,OAAO,OAAO,OAAO,EAAE,OAAO,CAAC;GACjC,CACF;GACA,SAAS,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAAW,OAAO;IAC7D,OAAO,UAAU;IACjB,OAAO,OAAO,aACZ,OAAO,IAAI,MAAM,OAAO,UAAU;KAAE,SAAS;KAAG,SAAS;IAAK,CAAC,CAAC,CAClE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,OAAO,eAAe,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC;IAM3D,OAAO,QAAO,OAJS,YAAY,QAAQ;KAAE;KAAU;IAAM,IAAI,OAAO,YACtE,QAAQ,QAAQ,KAAK,CACvB,EAAA,CAEsB,KAAK,KAAK,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC;GAClF,CAAC;EACH,CAAC;CACH,CAAC,CACH;CAEA,MAAM,kBASJ,MACA,YACG;EACH,MAAM,SAAS,SAAS,WAAW,mBAAmB;EAEtD,MAAM,UAAU,cAAc,GAAG,SAAS,WAAW,KAAK,WAAW;GACnE,SAAS,QAAQ;GACjB,SAAS;GACT,OAAO;GACP,QAAQ;GACR,UAAU;GACV,QAAQ;EACV,CAAC;EAED,MAAM,SAAS,cAAc,GAAG,SAAS,WAAW,KAAK,UAAU;GACjE,SAAS,QAAQ;GACjB,SAAS;GACT,OAAO;GACP,QAAQ;GACR,UAAU;GACV,QAAQ;EACV,CAAC;EAED,MAAM,UAAU,cAAc,GAAG,SAAS,WAAW,KAAK,WAAW;GACnE,SAAS,QAAQ;GACjB,SAAS;GACT,OAAO;GACP,QAAQ;GACR,UAAU;GACV,QAAQ;GACR,aAAa;EACf,CAAC;EAED,MAAM,WAAW,cAAc,GAAG,SAAS,WAAW,KAAK,YAAY;GACrE,SAAS,QAAQ;GACjB,SAAS;GACT,OAAO;GACP,QAAQ;GACR,UAAU;GACV,QAAQ;GACR,aAAa;EACf,CAAC;EAED,MAAM,gBAAgB,MAAM,SAC1B,QAAQ,aACN,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAAW,OAAO,YAAY;GAChE,OAAO,QAAQ,OAAO,UAAA,CAAW,QAAQ,QAAQ,YAAY,KAAK;EACpE,CAAC,CACH,GACA,OAAO,aACL,OAAO,GAAG,uBAAuB,CAAC,CAAC,WAAW,OAAO,YAAY;GAC/D,OAAO,QAAQ,OAAO,UAAA,CAAW,QAAQ,QAAQ,YAAY,OAAO,MAAM,UAAU;EACtF,CAAC,CACH,GACA,QAAQ,uBACN,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAAW,OAAO,YAAY;GAChE,OAAO,QAAQ,OAAO,UAAA,CAAW,QAAQ,QAAQ,YAAY,KAAK;EACpE,CAAC,CACH,GACA,SAAS,uBACP,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAAW,OAAO,YAAY;GAGjE,MAAM,SAAS,QAAO,QADC,QADF,OAAO,UAAA,CAAW,aAAa,QAAQ,YAAY,KAAK,EAAA,CACjD,OAAA,CACE,KAAK,KAAK,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC;GAExF,IAAI,EAAE,kBAAkB,OAAO,QAAQ,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;GAE1E,OAAO;IAAE,OAAO,OAAO;IAAO,oBAAoB,OAAO;GAAmB;EAC9E,CAAC,CACH,CACF;EAEA,OAAO,OAAO,OAAO;GACnB,YAAY;IAAE;IAAS;IAAQ;IAAS;GAAS;GACjD;GACA,OAAO,eAAe,SAAS,QAAQ,SAAS,QAAQ;EAC1D,CAAC;CACH;CAEA,MAAM,SAAS,eAAe,UAAU;EACtC,SAAS;EACT,QAAQ;EACR,SAAS;EACT,UAAU;CACZ,CAAC;CAED,MAAM,SAAS,eAAe,UAAU;EACtC,SAAS;EACT,QAAQ;EACR,SAAS;EACT,UAAU;CACZ,CAAC;CAED,MAAM,UAAU,cAAc,GAAG,SAAS,mBAAmB;EAC3D,SAAS,OAAO,OAAO,EACrB,OAAO,OAAO,IAAI,MAAM,OAAO,UAAU;GAAE,SAAS;GAAG,SAAS;EAAK,CAAC,CAAC,EACzE,CAAC;EACD,SAAS,OAAO,OAAO;GAAE,SAAS,OAAO;GAAS,SAAS,OAAO;EAAQ,CAAC;EAC3E,OAAO;EACP,QAAQ;EACR,UAAU;EACV,QAAQ;CACV,CAAC;CAED,MAAM,eAAe,QAAQ,aAC3B,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAAW,OAAO;EACpD,OAAO,QAAQ,OAAO,UAAA,CAAW,QAAQ,MAAM,KAAK;CACtD,CAAC,CACH;CAEA,OAAO,OAAO,OAAO;EACnB;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC;AACH"}