@yielded/auth-persistence-drizzle 0.1.0-beta.0

package/dist/drizzle/d1-emails.mjs

@@ -0,0 +1,578 @@
+import { requiredEmailAddressConstraints, requiredEmailRegistrationConstraints } from "./email-model.mjs";
+import { PersistenceMappingError, column, isMappedConstraintConflict, updateValues } from "./model.mjs";
+import { CurrentEmailSql, currentAddress, decodeEmailSnapshot, emailLookupQuery, sameEmailRevision, snapshotEmailMutation, validEmailSignInConstraints, validateEmailAuthority } from "./email-sql.mjs";
+import { D1BatchStatements } from "./D1BatchStatements.mjs";
+import { CurrentD1PlanningDatabase, makeD1Owner } from "./d1-planning.mjs";
+import { compileD1ProofCompletionPlan } from "./d1-proofs.mjs";
+import { and, eq, inArray, lte, sql } from "drizzle-orm";
+import { Cause, Context, DateTime, Effect, Option, Schema } from "effect";
+import { CurrentCommitJournal, HookConfigurationError, LifecycleHooks, coordinateCommit, hasCommitScope } from "@yielded/auth/Hooks";
+import { assessAuthentication } from "@yielded/auth/Sessions";
+import { EmailAddressPersistence, EmailSignInTargets, EmailUnavailable } from "@yielded/auth/Email";
+import { reportPersistenceFailure } from "@yielded/auth/Persistence";
+import { ProofUnavailable } from "@yielded/auth/Proofs";
+//#region src/drizzle/d1-emails.ts
+const emailLookupRows = Effect.fn("DrizzleD1.emailLookupRows")(function* (mapping, moduleId, identifier) {
+	const database = yield* CurrentD1PlanningDatabase;
+	const query = emailLookupQuery(mapping, moduleId, identifier);
+	return yield* database.select(query.fields).from(query.from).innerJoin(query.subjectTable, query.subjectJoin).innerJoin(query.credentialTable, query.credentialJoin).where(query.predicate).limit(query.limit);
+});
+const unavailable = () => EmailUnavailable.make({});
+const everyFailureMatches = (cause, classify) => classify !== void 0 && cause.reasons.length > 0 && cause.reasons.every((reason) => Cause.isFailReason(reason) && classify(Cause.fail(reason.error)));
+const statement = Effect.fn(function* (query) {
+	const database = yield* CurrentD1PlanningDatabase;
+	const rendered = query.toSQL();
+	return database.$client.unsafe(rendered.sql, rendered.params);
+});
+const containsFailure = (failure, predicate) => {
+	const pending = [failure];
+	const seen = /* @__PURE__ */ new Set();
+	for (let index = 0; index < 32 && pending.length > 0; index++) {
+		const value = pending.shift();
+		if (value === null || value === void 0 || seen.has(value)) continue;
+		seen.add(value);
+		if (predicate(value)) return true;
+		if (Cause.isCause(value)) {
+			for (const reason of value.reasons) if (Cause.isFailReason(reason)) pending.push(reason.error);
+			else if (Cause.isDieReason(reason)) pending.push(reason.defect);
+		} else if (typeof value === "object") {
+			const wrapped = value;
+			if (wrapped.cause !== void 0) pending.push(wrapped.cause);
+			if (wrapped.reason !== void 0) pending.push(wrapped.reason);
+			if (wrapped.message !== void 0) pending.push(wrapped.message);
+		}
+	}
+	return false;
+};
+const guardFailure = (cause, marker) => {
+	const native = `bad JSON path: '${`$[${marker.replaceAll("'", "''")}]`}': SQLITE_ERROR`;
+	return containsFailure(cause, (value) => value === native || value === `D1_ERROR: ${native}`);
+};
+const assertion = Effect.fn(function* (condition, marker) {
+	const database = yield* CurrentD1PlanningDatabase;
+	return yield* statement(database.select({ ok: sql`case when ${condition} then 1 else json_extract('[]', ${`$[${marker}]`}) end`.as("ok") }).from(sql`(select 1)`));
+});
+const existsSql = (query) => sql`exists(${query})`;
+const notExistsSql = (query) => sql`not exists(${query})`;
+const readEngineNowMillis = Effect.fn("Drizzle.readEngineNowMillis")(function* (clock) {
+	const database = yield* CurrentD1PlanningDatabase;
+	return yield* awaitRows(database.select({ value: sql`${clock.engineNowMillis}`.mapWith(Number) }).from(sql`(select 1)`)).pipe(Effect.flatMap((rows) => typeof rows[0]?.value === "number" && Number.isFinite(rows[0].value) ? Effect.succeed(rows[0].value) : Effect.fail(unavailable())));
+});
+const driverValues = (values, entries) => ({
+	...values,
+	...Object.fromEntries(entries)
+});
+const allocate = (asynchronous, synchronous) => asynchronous !== void 0 ? asynchronous : synchronous === void 0 ? Effect.fail(unavailable()) : Effect.try({
+	try: synchronous,
+	catch: (cause) => new PersistenceMappingError({
+		operation: "mapping",
+		cause
+	})
+});
+const validAddress = (mapping) => Object.entries(requiredEmailAddressConstraints).every(([key, value]) => mapping.constraints[key] === value);
+const evidenceCondition = (mapping, evidence, requirement) => {
+	const fresh = (proof) => {
+		const verified = DateTime.toEpochMillis(proof.verifiedAt);
+		return sql`${mapping.d1.engineNowMillis} >= ${verified} and ${mapping.d1.engineNowMillis} - ${verified} < ${requirement.maximumAgeMillis}`;
+	};
+	const alternatives = requirement.alternatives.flatMap((alternative) => {
+		const byCredential = /* @__PURE__ */ new Map();
+		for (const proof of evidence.proofs) byCredential.set(proof.credentialId, [...byCredential.get(proof.credentialId) ?? [], fresh(proof)]);
+		const credentials = [...byCredential.values()].map((conditions) => sql`(${sql.join(conditions, sql` or `)})`);
+		const factors = alternative.factors.map((factor) => {
+			const matches = evidence.proofs.filter((proof) => proof.factors.includes(factor)).map(fresh);
+			return matches.length === 0 ? sql`false` : sql`(${sql.join(matches, sql` or `)})`;
+		});
+		const assurance = evidence.proofs.filter((proof) => (!alternative.userVerified || proof.userVerified) && (!alternative.phishingResistant || proof.phishingResistant)).map(fresh);
+		if (assurance.length === 0 || credentials.length < alternative.minimumCredentials) return [];
+		const minimum = alternative.minimumCredentials === 0 ? sql`true` : sql`(${sql.join(credentials.map((condition) => sql`case when ${condition} then 1 else 0 end`), sql` + `)}) >= ${alternative.minimumCredentials}`;
+		return [and(...factors, sql`(${sql.join(assurance, sql` or `)})`, minimum)];
+	});
+	const noFuture = evidence.proofs.map((proof) => sql`${mapping.d1.engineNowMillis} >= ${DateTime.toEpochMillis(proof.verifiedAt)}`);
+	return alternatives.length === 0 ? sql`false` : and(...noFuture, sql`(${sql.join(alternatives, sql` or `)})`);
+};
+const subjectCondition = (mapping, current, revision) => {
+	const id = column(mapping.subject.table, mapping.subject.id);
+	const status = column(mapping.subject.table, mapping.subject.status);
+	const security = column(mapping.subject.table, mapping.subject.securityRevision);
+	return existsSql(sql`select 1 from ${mapping.subject.table} where ${id}=${sql.param(current.nativeSubjectId, id)} and ${status}=${sql.param(mapping.subject.d1ActiveStatusValue, status)} and ${security}=${sql.param(revision, security)}`);
+};
+const authorityRevisionCondition = (mapping, current) => {
+	const a = mapping.authorityCredential;
+	const subject = column(a.table, a.subjectId);
+	const credential = column(a.table, a.credentialId);
+	const revision = column(a.table, a.revision);
+	const status = column(a.table, a.status);
+	const expected = current.revision.credentials;
+	const matches = expected.map((item) => existsSql(sql`select 1 from ${a.table} where ${subject}=${sql.param(current.nativeSubjectId, subject)} and ${credential}=${sql.param(item.credentialId, credential)} and ${revision}=${sql.param(item.revision, revision)} and ${status}=${sql.param(a.d1ActiveStatusValue, status)}`));
+	return and(...matches, sql`(select count(*) from ${a.table} where ${subject}=${sql.param(current.nativeSubjectId, subject)} and ${status}=${sql.param(a.d1ActiveStatusValue, status)})=${expected.length}`);
+};
+const mutationPlan = Effect.fn("Drizzle.mutationPlan")(function* (mapping, proofMapping, uncaptured, action, prepare) {
+	const database = yield* CurrentD1PlanningDatabase;
+	const journal = yield* CurrentCommitJournal;
+	if (!validAddress(mapping)) return yield* unavailable();
+	const input = yield* snapshotEmailMutation(uncaptured).pipe(Effect.mapError(unavailable));
+	const current = yield* validateEmailAuthority(mapping, {
+		mode: "interactive",
+		locking: false,
+		standaloneGuard: Effect.void
+	}, input, action);
+	if (current === void 0) return {
+		receipt: prepare("rejected", journal),
+		statements: []
+	};
+	if ((yield* awaitRows(database.select().from(mapping.command.table).where(and(eq(column(mapping.command.table, mapping.command.moduleId), input.moduleId), eq(column(mapping.command.table, mapping.command.commandId), input.commandId))).limit(1))).length > 0) return {
+		receipt: prepare("rejected", journal),
+		statements: []
+	};
+	const requirement = yield* mapping.subject.decodeActionRequirement(current.subject, action);
+	const original = yield* assessAuthentication(input.authorization.evidence, input.authorization.requirement).pipe(Effect.mapError(unavailable));
+	const configured = yield* assessAuthentication(input.authorization.evidence, requirement).pipe(Effect.mapError(unavailable));
+	if (!original.satisfied || !configured.satisfied) return {
+		receipt: prepare("rejected", journal),
+		statements: []
+	};
+	const transitionMillis = yield* readEngineNowMillis(mapping.d1);
+	const transitionInstant = mapping.encodeInstant(transitionMillis);
+	const targetCredentialId = current.targetCredential?.[mapping.credential.credentialId] ?? (yield* allocate(mapping.allocateCredentialId, mapping.allocateCredentialIdSync));
+	const targetIdentifierRevision = yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync);
+	const targetCredentialRevision = yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync);
+	const sourceIdentifierRevision = yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync);
+	const sourceCredentialRevision = yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync);
+	const confirmsExisting = action === "verify-address" && input.captured.targetIdentifierRevision !== void 0;
+	const nextRevision = confirmsExisting ? input.captured.revision.securityRevision : yield* allocate(mapping.subject.nextSecurityRevision?.(input.captured.revision.securityRevision) ?? mapping.allocateRevision, mapping.subject.nextSecurityRevisionSync === void 0 ? mapping.allocateRevisionSync : () => mapping.subject.nextSecurityRevisionSync(input.captured.revision.securityRevision));
+	if (!confirmsExisting && nextRevision === input.captured.revision.securityRevision || current.targetIdentifier !== void 0 && targetIdentifierRevision === current.targetIdentifier[mapping.identifier.bindingRevision] || current.targetCredential !== void 0 && targetCredentialRevision === current.targetCredential[mapping.credential.credentialRevision] || current.source !== void 0 && (sourceIdentifierRevision === current.source.snapshot.identifierRevision || sourceCredentialRevision === current.source.snapshot.credentialRevision)) return yield* unavailable();
+	const statements = [];
+	const i = mapping.identifier;
+	const c = mapping.credential;
+	const a = mapping.authorityCredential;
+	const sc = current.source;
+	const authorityMarker = `effect-auth-email-guard:authority:${input.commandId}`;
+	const targetIdentifierPrecondition = current.targetIdentifier === void 0 ? notExistsSql(sql`select 1 from ${i.table} where ${column(i.table, i.namespace)}=${sql.param(input.target.namespace, column(i.table, i.namespace))} and ${column(i.table, i.value)}=${sql.param(input.target.value, column(i.table, i.value))}`) : existsSql(sql`select 1 from ${i.table} where ${column(i.table, i.bindingRevision)}=${sql.param(current.targetIdentifier[i.bindingRevision], column(i.table, i.bindingRevision))} and ${i.d1MutableTargetCondition({
+		identifier: input.target,
+		nativeSubjectId: current.nativeSubjectId
+	})}`);
+	const targetCredentialPrecondition = current.targetCredential === void 0 ? notExistsSql(sql`select 1 from ${c.table} where ${column(c.table, c.moduleId)}=${sql.param(input.moduleId, column(c.table, c.moduleId))} and ${column(c.table, c.identifierNamespace)}=${sql.param(input.target.namespace, column(c.table, c.identifierNamespace))} and ${column(c.table, c.identifierValue)}=${sql.param(input.target.value, column(c.table, c.identifierValue))}`) : existsSql(sql`select 1 from ${c.table} where ${column(c.table, c.moduleId)}=${sql.param(input.moduleId, column(c.table, c.moduleId))} and ${column(c.table, c.credentialId)}=${sql.param(current.targetCredential[c.credentialId], column(c.table, c.credentialId))} and ${column(c.table, c.subjectId)}=${sql.param(current.nativeSubjectId, column(c.table, c.subjectId))} and ${column(c.table, c.credentialRevision)}=${sql.param(current.targetCredential[c.credentialRevision], column(c.table, c.credentialRevision))} and ${column(c.table, c.status)}<>${sql.param(c.d1ActiveStatusValue, column(c.table, c.status))}`);
+	const sourcePrecondition = action === "verify-address" ? sql`true` : and(existsSql(sql`select 1 from ${i.table} where ${i.d1CurrentCondition({
+		identifier: sc.snapshot.identifier,
+		nativeSubjectId: current.nativeSubjectId,
+		bindingRevision: sc.snapshot.identifierRevision
+	})}`), existsSql(sql`select 1 from ${c.table} where ${column(c.table, c.moduleId)}=${sql.param(input.moduleId, column(c.table, c.moduleId))} and ${column(c.table, c.credentialId)}=${sql.param(sc.snapshot.credentialId, column(c.table, c.credentialId))} and ${column(c.table, c.subjectId)}=${sql.param(current.nativeSubjectId, column(c.table, c.subjectId))} and ${column(c.table, c.credentialRevision)}=${sql.param(sc.snapshot.credentialRevision, column(c.table, c.credentialRevision))} and ${column(c.table, c.status)}=${sql.param(c.d1ActiveStatusValue, column(c.table, c.status))}`));
+	statements.push(yield* assertion(and(subjectCondition(mapping, current, input.captured.revision.securityRevision), authorityRevisionCondition(mapping, current), targetIdentifierPrecondition, targetCredentialPrecondition, sourcePrecondition, evidenceCondition(mapping, input.authorization.evidence, input.authorization.requirement), evidenceCondition(mapping, input.authorization.evidence, requirement)), authorityMarker));
+	if (action === "change-address") {
+		statements.push(yield* statement(database.update(i.table).set(i.encodeRetirement({
+			source: sc.snapshot.identifier,
+			bindingRevision: sourceIdentifierRevision
+		})).where(and(eq(column(i.table, i.namespace), sc.snapshot.identifier.namespace), eq(column(i.table, i.value), sc.snapshot.identifier.value), eq(column(i.table, i.subjectId), current.nativeSubjectId), eq(column(i.table, i.bindingRevision), sc.snapshot.identifierRevision)))));
+		statements.push(yield* statement(database.update(c.table).set(c.encodeRetirement({
+			source: sc.snapshot.identifier,
+			credentialRevision: sourceCredentialRevision
+		})).where(and(eq(column(c.table, c.moduleId), input.moduleId), eq(column(c.table, c.credentialId), sc.snapshot.credentialId), eq(column(c.table, c.subjectId), current.nativeSubjectId), eq(column(c.table, c.credentialRevision), sc.snapshot.credentialRevision)))));
+		statements.push(yield* statement(database.update(a.table).set(a.encodeRetirement(sourceCredentialRevision)).where(and(eq(column(a.table, a.subjectId), current.nativeSubjectId), eq(column(a.table, a.credentialId), sc.snapshot.credentialId), eq(column(a.table, a.revision), sc.snapshot.credentialRevision)))));
+	}
+	if (current.targetIdentifier === void 0) statements.push(yield* statement(database.insert(i.table).values(driverValues(i.encodeVerifiedInsert({
+		identifier: input.target,
+		subjectId: current.nativeSubjectId,
+		verifiedAtMillis: transitionMillis,
+		bindingRevision: targetIdentifierRevision
+	}), [[i.verifiedAt, transitionInstant]]))));
+	else statements.push(yield* statement(database.update(i.table).set(driverValues(i.encodeVerification({
+		verifiedAtMillis: transitionMillis,
+		bindingRevision: targetIdentifierRevision
+	}), [[i.verifiedAt, transitionInstant]])).where(and(eq(column(i.table, i.namespace), input.target.namespace), eq(column(i.table, i.value), input.target.value), eq(column(i.table, i.subjectId), current.nativeSubjectId), eq(column(i.table, i.bindingRevision), current.targetIdentifier[i.bindingRevision])))));
+	if (current.targetCredential === void 0) {
+		statements.push(yield* statement(database.insert(c.table).values(c.encodeVerifiedInsert({
+			moduleId: input.moduleId,
+			subjectId: current.nativeSubjectId,
+			credentialId: targetCredentialId,
+			identifier: input.target,
+			credentialRevision: targetCredentialRevision
+		}))));
+		statements.push(yield* statement(database.insert(a.table).values(a.encodeInsert({
+			subjectId: current.nativeSubjectId,
+			credentialId: targetCredentialId,
+			revision: targetCredentialRevision
+		}))));
+	} else {
+		const oldRevision = current.targetCredential[c.credentialRevision];
+		statements.push(yield* statement(database.update(c.table).set(c.encodeActivation({
+			identifier: input.target,
+			credentialRevision: targetCredentialRevision
+		})).where(and(eq(column(c.table, c.moduleId), input.moduleId), eq(column(c.table, c.credentialId), targetCredentialId), eq(column(c.table, c.subjectId), current.nativeSubjectId), eq(column(c.table, c.credentialRevision), oldRevision)))));
+		statements.push(yield* statement(database.update(a.table).set(a.encodeActivation(targetCredentialRevision)).where(and(eq(column(a.table, a.subjectId), current.nativeSubjectId), eq(column(a.table, a.credentialId), targetCredentialId), eq(column(a.table, a.revision), oldRevision)))));
+	}
+	statements.push(yield* statement(database.update(mapping.subject.table).set(updateValues([[mapping.subject.securityRevision, nextRevision]])).where(and(eq(column(mapping.subject.table, mapping.subject.id), current.nativeSubjectId), eq(column(mapping.subject.table, mapping.subject.securityRevision), input.captured.revision.securityRevision)))));
+	statements.push(yield* statement(database.insert(mapping.command.table).values(driverValues(mapping.command.encodeInsert({
+		moduleId: input.moduleId,
+		commandId: input.commandId,
+		action,
+		bindingDigest: input.authorization.challenge.bindingDigest,
+		retentionUntilMillis: transitionMillis + mapping.commandRetentionMillis
+	}), [[mapping.command.retentionUntil, mapping.encodeInstant(transitionMillis + mapping.commandRetentionMillis)]]))));
+	const targetExists = existsSql(sql`select 1 from ${i.table} where ${column(i.table, i.bindingRevision)}=${sql.param(targetIdentifierRevision, column(i.table, i.bindingRevision))} and ${column(i.table, i.verifiedAt)}=${sql.param(transitionInstant, column(i.table, i.verifiedAt))} and ${i.d1CurrentCondition({
+		identifier: input.target,
+		nativeSubjectId: current.nativeSubjectId,
+		bindingRevision: targetIdentifierRevision
+	})}`);
+	const credentialExists = existsSql(sql`select 1 from ${c.table} where ${column(c.table, c.moduleId)}=${sql.param(input.moduleId, column(c.table, c.moduleId))} and ${column(c.table, c.credentialId)}=${sql.param(targetCredentialId, column(c.table, c.credentialId))} and ${column(c.table, c.subjectId)}=${sql.param(current.nativeSubjectId, column(c.table, c.subjectId))} and ${column(c.table, c.identifierNamespace)}=${sql.param(input.target.namespace, column(c.table, c.identifierNamespace))} and ${column(c.table, c.identifierValue)}=${sql.param(input.target.value, column(c.table, c.identifierValue))} and ${column(c.table, c.credentialRevision)}=${sql.param(targetCredentialRevision, column(c.table, c.credentialRevision))} and ${column(c.table, c.status)}=${sql.param(c.d1ActiveStatusValue, column(c.table, c.status))}`);
+	const authorityExists = existsSql(sql`select 1 from ${a.table} where ${column(a.table, a.subjectId)}=${sql.param(current.nativeSubjectId, column(a.table, a.subjectId))} and ${column(a.table, a.credentialId)}=${sql.param(targetCredentialId, column(a.table, a.credentialId))} and ${column(a.table, a.revision)}=${sql.param(targetCredentialRevision, column(a.table, a.revision))} and ${column(a.table, a.status)}=${sql.param(a.d1ActiveStatusValue, column(a.table, a.status))}`);
+	const commandExists = existsSql(sql`select 1 from ${mapping.command.table} where ${column(mapping.command.table, mapping.command.moduleId)}=${sql.param(input.moduleId, column(mapping.command.table, mapping.command.moduleId))} and ${column(mapping.command.table, mapping.command.commandId)}=${sql.param(input.commandId, column(mapping.command.table, mapping.command.commandId))} and ${column(mapping.command.table, mapping.command.action)}=${sql.param(action, column(mapping.command.table, mapping.command.action))} and ${column(mapping.command.table, mapping.command.bindingDigest)}=${sql.param(input.authorization.challenge.bindingDigest, column(mapping.command.table, mapping.command.bindingDigest))} and ${column(mapping.command.table, mapping.command.retentionUntil)}=${sql.param(mapping.encodeInstant(transitionMillis + mapping.commandRetentionMillis), column(mapping.command.table, mapping.command.retentionUntil))}`);
+	const sourceRetired = action === "verify-address" ? sql`true` : and(existsSql(sql`select 1 from ${i.table} where ${column(i.table, i.namespace)}=${sql.param(sc.snapshot.identifier.namespace, column(i.table, i.namespace))} and ${column(i.table, i.value)}=${sql.param(sc.snapshot.identifier.value, column(i.table, i.value))} and ${column(i.table, i.subjectId)}=${sql.param(current.nativeSubjectId, column(i.table, i.subjectId))} and ${column(i.table, i.bindingRevision)}=${sql.param(sourceIdentifierRevision, column(i.table, i.bindingRevision))} and not (${i.d1CurrentCondition({
+		identifier: sc.snapshot.identifier,
+		nativeSubjectId: current.nativeSubjectId,
+		bindingRevision: sourceIdentifierRevision
+	})})`), existsSql(sql`select 1 from ${c.table} where ${column(c.table, c.moduleId)}=${sql.param(input.moduleId, column(c.table, c.moduleId))} and ${column(c.table, c.credentialId)}=${sql.param(sc.snapshot.credentialId, column(c.table, c.credentialId))} and ${column(c.table, c.subjectId)}=${sql.param(current.nativeSubjectId, column(c.table, c.subjectId))} and ${column(c.table, c.identifierNamespace)}=${sql.param(sc.snapshot.identifier.namespace, column(c.table, c.identifierNamespace))} and ${column(c.table, c.identifierValue)}=${sql.param(sc.snapshot.identifier.value, column(c.table, c.identifierValue))} and ${column(c.table, c.credentialRevision)}=${sql.param(sourceCredentialRevision, column(c.table, c.credentialRevision))} and ${column(c.table, c.status)}<>${sql.param(c.d1ActiveStatusValue, column(c.table, c.status))}`), existsSql(sql`select 1 from ${a.table} where ${column(a.table, a.subjectId)}=${sql.param(current.nativeSubjectId, column(a.table, a.subjectId))} and ${column(a.table, a.credentialId)}=${sql.param(sc.snapshot.credentialId, column(a.table, a.credentialId))} and ${column(a.table, a.revision)}=${sql.param(sourceCredentialRevision, column(a.table, a.revision))} and ${column(a.table, a.status)}<>${sql.param(a.d1ActiveStatusValue, column(a.table, a.status))}`));
+	const applied = and(subjectCondition(mapping, current, nextRevision), targetExists, credentialExists, authorityExists, commandExists, sourceRetired, evidenceCondition(mapping, input.authorization.evidence, input.authorization.requirement), evidenceCondition(mapping, input.authorization.evidence, requirement));
+	const compiled = yield* compileD1ProofCompletionPlan(proofMapping, input.completion, {
+		statements,
+		appliedCondition: applied
+	}, (decision) => decision);
+	const marker = `effect-auth-proof-guard:protected:${input.completion.input.continuationId}`;
+	return {
+		receipt: prepare(compiled.statements.length === 0 ? "rejected" : "changed", journal),
+		statements: compiled.statements,
+		retryable: (cause) => guardFailure(cause, marker) || guardFailure(cause, authorityMarker) || isMappedConstraintConflict(mapping.isCommandConflict, cause) || isMappedConstraintConflict(mapping.isIdentifierConflict, cause) || isMappedConstraintConflict(mapping.isCredentialConflict, cause)
+	};
+});
+const awaitRows = (effect) => effect;
+const probeCompletion = Effect.fn("DrizzleD1.probeCompletion")(function* (proofMapping, input) {
+	const database = yield* CurrentD1PlanningDatabase;
+	const plan = {
+		input,
+		prepare: (decision, journal, project) => journal.prepare(project(decision))
+	};
+	const marker = `effect-auth-proof-guard:protected:${input.continuationId}`;
+	return yield* coordinateCommit(() => Effect.gen(function* () {
+		const compiled = yield* compileD1ProofCompletionPlan(proofMapping, plan, {
+			statements: [],
+			appliedCondition: sql`false`
+		}, () => false);
+		if (compiled.statements.length === 0) return false;
+		yield* database.$client.batch(compiled.statements);
+		return false;
+	}), { mode: "batch" }).pipe(Effect.as(false), Effect.catchCause((cause) => guardFailure(cause, marker) ? Effect.succeed(true) : Effect.failCause(cause)));
+});
+const makeAddressPlans = (mapping, proofMapping) => ({
+	target: (input) => currentAddress(mapping, input, false).pipe(Effect.flatMap((current) => current === void 0 ? Effect.fail(unavailable()) : Effect.succeed({
+		revision: current.revision,
+		eligible: current.eligible,
+		...current.targetIdentifierRevision === void 0 ? {} : { targetIdentifierRevision: current.targetIdentifierRevision },
+		...current.source === void 0 ? {} : { source: current.source.snapshot }
+	}))),
+	checkCompletion: (input) => {
+		if (input.binding._tag !== "IdentifierChange") return Effect.succeed(false);
+		const binding = input.binding;
+		const action = input.moduleId.endsWith("/verify-address") && input.purpose === "email-address-verification" ? "verify-address" : input.moduleId.endsWith("/change-address") && input.purpose === "email-address-change" ? "change-address" : void 0;
+		if (action === void 0) return Effect.succeed(false);
+		const moduleId = input.moduleId.slice(0, -`/${action}`.length);
+		return currentAddress(mapping, {
+			moduleId,
+			subjectId: binding.revision.subjectId,
+			target: binding.identifier
+		}, false).pipe(Effect.flatMap((current) => current !== void 0 && sameEmailRevision(current.revision, binding.revision) ? probeCompletion(proofMapping, input) : Effect.succeed(false)));
+	},
+	verifyWithProof: (input, prepare) => mutationPlan(mapping, proofMapping, input, "verify-address", prepare),
+	changeWithProof: (input, prepare) => mutationPlan(mapping, proofMapping, input, "change-address", prepare),
+	cleanup: (input, prepare) => Effect.gen(function* () {
+		const database = yield* CurrentD1PlanningDatabase;
+		const journal = yield* CurrentCommitJournal;
+		const module = column(mapping.command.table, mapping.command.moduleId);
+		const id = column(mapping.command.table, mapping.command.commandId);
+		const retention = column(mapping.command.table, mapping.command.retentionUntil);
+		const rows = yield* awaitRows(database.select({ commandId: id }).from(mapping.command.table).where(and(eq(module, input.moduleId), lte(retention, mapping.d1.engineNow))).limit(input.limit + 1));
+		const selected = rows.slice(0, input.limit);
+		const marker = `effect-auth-email-guard:cleanup:${input.moduleId}`;
+		const selectedIds = selected.map((row) => row.commandId);
+		const selectedWhere = and(eq(module, input.moduleId), inArray(id, selectedIds), lte(retention, mapping.d1.engineNow));
+		const statements = selected.length === 0 ? [] : [yield* assertion(sql`(select count(*) from ${mapping.command.table} where ${selectedWhere})=${selected.length}`, marker), yield* statement(database.delete(mapping.command.table).where(selectedWhere))];
+		return {
+			receipt: prepare({
+				removed: selected.length,
+				hasMore: rows.length > input.limit
+			}, journal),
+			statements,
+			retryable: (cause) => guardFailure(cause, marker)
+		};
+	})
+});
+const registrationRows = Effect.fn("Drizzle.registrationRows")(function* (mapping, moduleId, commandId) {
+	const database = yield* CurrentD1PlanningDatabase;
+	return yield* awaitRows(database.select().from(mapping.registration.table).where(and(eq(column(mapping.registration.table, mapping.registration.moduleId), moduleId), eq(column(mapping.registration.table, mapping.registration.commandId), commandId))).limit(1));
+});
+const sameIdentifier = (left, right) => left.namespace === right.namespace && left.value === right.value;
+const registrationCompletionMatches = (mapping, input) => input.completion.input.moduleId === `${input.moduleId}/registration` && input.completion.input.purpose === "email-code-registration" && input.completion.input.binding._tag === "Identifier" && sameIdentifier(input.completion.input.binding.identifier, input.identifier) && mapping.constraints.request === requiredEmailRegistrationConstraints.request && mapping.constraints.pendingReference === requiredEmailRegistrationConstraints.pendingReference && (mapping.mode === "pending" || Object.entries(requiredEmailRegistrationConstraints).every(([key, value]) => mapping.constraints[key] === value));
+const registrationPlan = Effect.fn("Drizzle.registrationPlan")(function* (mapping, proofMapping, input, inspected, allocated, prepare) {
+	const database = yield* CurrentD1PlanningDatabase;
+	const journal = yield* CurrentCommitJournal;
+	const existing = (yield* registrationRows(mapping, input.moduleId, input.commandId))[0];
+	if (existing !== void 0) return {
+		receipt: prepare(existing[mapping.registration.fingerprint] !== input.fingerprint ? { _tag: "Rejected" } : yield* mapping.registration.decodeReplay(existing), journal),
+		statements: []
+	};
+	if (!registrationCompletionMatches(mapping, input) || !inspected.eligible || inspected.fingerprint !== input.fingerprint || mapping.mode === "atomic" && (mapping.provisioning.idMode === "generated" || mapping.subject.d1ActiveStatusValue === void 0 || mapping.identifier.d1CurrentCondition === void 0 || mapping.credential.d1ActiveStatusValue === void 0 || mapping.authorityCredential.d1ActiveStatusValue === void 0)) return {
+		receipt: prepare({ _tag: "Rejected" }, journal),
+		statements: []
+	};
+	const intent = {
+		moduleId: input.moduleId,
+		commandId: input.commandId,
+		identifier: input.identifier,
+		registration: input.registration,
+		fingerprint: input.fingerprint,
+		completion: {
+			moduleId: input.completion.input.moduleId,
+			purpose: input.completion.input.purpose,
+			continuationId: input.completion.input.continuationId,
+			binding: input.completion.input.binding
+		}
+	};
+	const transitionMillis = yield* readEngineNowMillis(mapping.d1);
+	const retentionInstant = mapping.encodeInstant(transitionMillis + mapping.retentionMillis);
+	const statements = [];
+	let applied;
+	let desired;
+	const registrationModule = column(mapping.registration.table, mapping.registration.moduleId);
+	const registrationCommand = column(mapping.registration.table, mapping.registration.commandId);
+	const registrationFingerprint = column(mapping.registration.table, mapping.registration.fingerprint);
+	const registrationState = column(mapping.registration.table, mapping.registration.state);
+	if (mapping.mode === "pending") {
+		if (allocated.pendingReference === void 0) return {
+			receipt: prepare({ _tag: "Rejected" }, journal),
+			statements: []
+		};
+		desired = {
+			_tag: "ProvisioningPending",
+			reference: allocated.pendingReference
+		};
+		statements.push(yield* statement(database.insert(mapping.registration.table).values(driverValues(mapping.registration.encodeInsert(intent, {
+			state: "pending",
+			pendingReference: allocated.pendingReference,
+			retentionUntilMillis: transitionMillis + mapping.retentionMillis
+		}), [[mapping.registration.retentionUntil, retentionInstant]]))));
+		applied = existsSql(sql`select 1 from ${mapping.registration.table} where ${registrationModule}=${sql.param(input.moduleId, registrationModule)} and ${registrationCommand}=${sql.param(input.commandId, registrationCommand)} and ${registrationFingerprint}=${sql.param(input.fingerprint, registrationFingerprint)} and ${registrationState}='pending' and ${column(mapping.registration.table, mapping.registration.pendingReference)}=${sql.param(allocated.pendingReference, column(mapping.registration.table, mapping.registration.pendingReference))} and ${column(mapping.registration.table, mapping.registration.subjectId)} is null and ${column(mapping.registration.table, mapping.registration.retentionUntil)}=${sql.param(retentionInstant, column(mapping.registration.table, mapping.registration.retentionUntil))}`);
+	} else {
+		if (allocated.nativeSubjectId === void 0 || allocated.credentialId === void 0 || allocated.securityRevision === void 0 || allocated.identifierRevision === void 0 || allocated.credentialRevision === void 0) return {
+			receipt: prepare({ _tag: "Rejected" }, journal),
+			statements: []
+		};
+		const nativeSubjectId = allocated.nativeSubjectId;
+		desired = { _tag: "Registered" };
+		statements.push(yield* statement(database.insert(mapping.subject.table).values(mapping.provisioning.encodeSubjectInsert(intent, {
+			nativeSubjectId,
+			securityRevision: allocated.securityRevision
+		}))), yield* statement(database.insert(mapping.identifier.table).values(driverValues(mapping.identifier.encodeVerifiedInsert({
+			identifier: input.identifier,
+			subjectId: nativeSubjectId,
+			verifiedAtMillis: transitionMillis,
+			bindingRevision: allocated.identifierRevision
+		}), [[mapping.identifier.verifiedAt, mapping.encodeInstant(transitionMillis)]]))), yield* statement(database.insert(mapping.credential.table).values(mapping.credential.encodeVerifiedInsert({
+			moduleId: input.moduleId,
+			subjectId: nativeSubjectId,
+			credentialId: allocated.credentialId,
+			identifier: input.identifier,
+			credentialRevision: allocated.credentialRevision
+		}))), yield* statement(database.insert(mapping.authorityCredential.table).values(mapping.authorityCredential.encodeInsert({
+			subjectId: nativeSubjectId,
+			credentialId: allocated.credentialId,
+			revision: allocated.credentialRevision
+		}))), yield* statement(database.insert(mapping.registration.table).values(driverValues(mapping.registration.encodeInsert(intent, {
+			state: "registered",
+			nativeSubjectId,
+			retentionUntilMillis: transitionMillis + mapping.retentionMillis
+		}), [[mapping.registration.retentionUntil, retentionInstant]]))));
+		const sId = column(mapping.subject.table, mapping.subject.id);
+		const sStatus = column(mapping.subject.table, mapping.subject.status);
+		const sRevision = column(mapping.subject.table, mapping.subject.securityRevision);
+		const iNamespace = column(mapping.identifier.table, mapping.identifier.namespace);
+		const iValue = column(mapping.identifier.table, mapping.identifier.value);
+		const iSubject = column(mapping.identifier.table, mapping.identifier.subjectId);
+		const iVerifiedAt = column(mapping.identifier.table, mapping.identifier.verifiedAt);
+		const iRevision = column(mapping.identifier.table, mapping.identifier.bindingRevision);
+		const cModule = column(mapping.credential.table, mapping.credential.moduleId);
+		const cSubject = column(mapping.credential.table, mapping.credential.subjectId);
+		const cId = column(mapping.credential.table, mapping.credential.credentialId);
+		const cNamespace = column(mapping.credential.table, mapping.credential.identifierNamespace);
+		const cValue = column(mapping.credential.table, mapping.credential.identifierValue);
+		const cRevision = column(mapping.credential.table, mapping.credential.credentialRevision);
+		const aSubject = column(mapping.authorityCredential.table, mapping.authorityCredential.subjectId);
+		const aId = column(mapping.authorityCredential.table, mapping.authorityCredential.credentialId);
+		const aRevision = column(mapping.authorityCredential.table, mapping.authorityCredential.revision);
+		applied = and(existsSql(sql`select 1 from ${mapping.subject.table} where ${sId}=${sql.param(nativeSubjectId, sId)} and ${sStatus}=${sql.param(mapping.subject.d1ActiveStatusValue, sStatus)} and ${sRevision}=${sql.param(allocated.securityRevision, sRevision)}`), existsSql(sql`select 1 from ${mapping.identifier.table} where ${iNamespace}=${sql.param(input.identifier.namespace, iNamespace)} and ${iValue}=${sql.param(input.identifier.value, iValue)} and ${iSubject}=${sql.param(nativeSubjectId, iSubject)} and ${iVerifiedAt}=${sql.param(mapping.encodeInstant(transitionMillis), iVerifiedAt)} and ${iRevision}=${sql.param(allocated.identifierRevision, iRevision)} and ${mapping.identifier.d1CurrentCondition({
+			identifier: input.identifier,
+			nativeSubjectId,
+			bindingRevision: allocated.identifierRevision
+		})}`), existsSql(sql`select 1 from ${mapping.credential.table} where ${cModule}=${sql.param(input.moduleId, cModule)} and ${cSubject}=${sql.param(nativeSubjectId, cSubject)} and ${cId}=${sql.param(allocated.credentialId, cId)} and ${cNamespace}=${sql.param(input.identifier.namespace, cNamespace)} and ${cValue}=${sql.param(input.identifier.value, cValue)} and ${cRevision}=${sql.param(allocated.credentialRevision, cRevision)} and ${column(mapping.credential.table, mapping.credential.status)}=${sql.param(mapping.credential.d1ActiveStatusValue, column(mapping.credential.table, mapping.credential.status))}`), existsSql(sql`select 1 from ${mapping.authorityCredential.table} where ${aSubject}=${sql.param(nativeSubjectId, aSubject)} and ${aId}=${sql.param(allocated.credentialId, aId)} and ${aRevision}=${sql.param(allocated.credentialRevision, aRevision)} and ${column(mapping.authorityCredential.table, mapping.authorityCredential.status)}=${sql.param(mapping.authorityCredential.d1ActiveStatusValue, column(mapping.authorityCredential.table, mapping.authorityCredential.status))}`), existsSql(sql`select 1 from ${mapping.registration.table} where ${registrationModule}=${sql.param(input.moduleId, registrationModule)} and ${registrationCommand}=${sql.param(input.commandId, registrationCommand)} and ${registrationFingerprint}=${sql.param(input.fingerprint, registrationFingerprint)} and ${registrationState}='registered' and ${column(mapping.registration.table, mapping.registration.subjectId)}=${sql.param(nativeSubjectId, column(mapping.registration.table, mapping.registration.subjectId))} and ${column(mapping.registration.table, mapping.registration.pendingReference)} is null and ${column(mapping.registration.table, mapping.registration.retentionUntil)}=${sql.param(retentionInstant, column(mapping.registration.table, mapping.registration.retentionUntil))}`));
+	}
+	let receipt;
+	const compiled = yield* compileD1ProofCompletionPlan(proofMapping, input.completion, {
+		statements,
+		appliedCondition: applied
+	}, (completion) => {
+		receipt = prepare(completion === "completed" ? desired : { _tag: "Rejected" }, journal);
+		return completion;
+	});
+	const marker = `effect-auth-proof-guard:protected:${input.completion.input.continuationId}`;
+	return {
+		receipt: receipt ?? prepare({ _tag: "Rejected" }, journal),
+		statements: compiled.statements,
+		retryable: (cause) => guardFailure(cause, marker) || isMappedConstraintConflict(mapping.isRequestConflict, cause) || mapping.mode === "atomic" && (isMappedConstraintConflict(mapping.isIdentifierConflict, cause) || isMappedConstraintConflict(mapping.isCredentialConflict, cause))
+	};
+});
+const makeRegistrationPlans = (mapping, proofMapping) => ({
+	inspect: (input) => mapping.inspect(input),
+	registerWithProof: (uncaptured, prepare) => Effect.gen(function* () {
+		const registration = yield* mapping.snapshotRegistration(uncaptured.registration);
+		const inspectionRegistration = yield* mapping.snapshotRegistration(uncaptured.registration);
+		const input = Object.freeze({
+			...uncaptured,
+			identifier: Object.freeze({ ...uncaptured.identifier }),
+			registration
+		});
+		const inspected = yield* mapping.inspect({
+			identifier: input.identifier,
+			registration: inspectionRegistration
+		});
+		const atomic = mapping.mode === "atomic";
+		const credentialId = atomic ? yield* allocate(mapping.allocateCredentialId, mapping.allocateCredentialIdSync) : void 0;
+		const securityRevision = atomic ? yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync) : void 0;
+		const identifierRevision = atomic ? yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync) : void 0;
+		const credentialRevision = atomic ? yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync) : void 0;
+		const nativeSubjectId = atomic && mapping.provisioning.idMode !== "generated" ? yield* allocate(mapping.provisioning.allocateSubjectId, mapping.provisioning.allocateSubjectIdSync) : void 0;
+		const pendingReference = mapping.mode === "pending" ? yield* allocate(mapping.allocatePendingReference, mapping.allocatePendingReferenceSync) : void 0;
+		return yield* registrationPlan(mapping, proofMapping, input, inspected, {
+			...credentialId === void 0 ? {} : { credentialId },
+			...securityRevision === void 0 ? {} : { securityRevision },
+			...identifierRevision === void 0 ? {} : { identifierRevision },
+			...credentialRevision === void 0 ? {} : { credentialRevision },
+			...nativeSubjectId === void 0 ? {} : { nativeSubjectId },
+			...pendingReference === void 0 ? {} : { pendingReference }
+		}, prepare);
+	})
+});
+const makeD1EmailSignInServices = (database, mapping) => Effect.succeed({ emailSignInTargets: EmailSignInTargets.of({ lookup: (input) => {
+	if (!validEmailSignInConstraints(mapping)) return Effect.fail(unavailable());
+	return emailLookupRows(mapping, input.moduleId, input.identifier).pipe(Effect.flatMap((rows) => {
+		const row = rows[0];
+		if (row === void 0) return Effect.succeed(Option.none());
+		return decodeEmailSnapshot(mapping, input.moduleId, input.identifier, row).pipe(Effect.map((snapshot) => snapshot === void 0 ? Option.none() : Option.some(snapshot)));
+	}), Effect.provideService(CurrentD1PlanningDatabase, database), translateFailure);
+} }) });
+const makeD1EmailAddressServices = (database, mapping, proofMapping) => Effect.gen(function* () {
+	const hooks = yield* LifecycleHooks;
+	const plans = makeAddressPlans(mapping, proofMapping);
+	const run = (plan) => Effect.gen(function* () {
+		if (yield* hasCommitScope) return yield* unavailable();
+		return yield* executeStandalone(plan, 2);
+	}).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(CurrentEmailSql, database), Effect.provideService(LifecycleHooks, hooks));
+	return { emailAddressPersistence: {
+		target: (input) => plans.target(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(CurrentEmailSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
+		checkCompletion: (input) => plans.checkCompletion(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(CurrentEmailSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
+		verifyWithProof: (input, prepare) => run(plans.verifyWithProof(input, prepare)).pipe(translateFailure),
+		changeWithProof: (input, prepare) => run(plans.changeWithProof(input, prepare)).pipe(translateFailure),
+		cleanup: (input, prepare) => run(plans.cleanup(input, prepare)).pipe(translateFailure)
+	} };
+});
+const makeD1EmailRegistrationServices = (database, mapping, proofMapping) => Effect.gen(function* () {
+	const hooks = yield* LifecycleHooks;
+	const plans = makeRegistrationPlans(mapping, proofMapping);
+	const run = (plan) => Effect.gen(function* () {
+		if (yield* hasCommitScope) return yield* unavailable();
+		return yield* executeStandalone(plan, 2);
+	}).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(CurrentEmailSql, database), Effect.provideService(LifecycleHooks, hooks));
+	return { registrationAuthority: {
+		inspect: (input) => plans.inspect(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(CurrentEmailSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
+		registerWithProof: (input, prepare) => run(plans.registerWithProof(input, prepare)).pipe(translateFailure)
+	} };
+});
+function coordinateD1EmailAddress(acquire, options, body) {
+	return Effect.flatMap(acquire, (database) => Effect.gen(function* () {
+		const hooks = yield* LifecycleHooks;
+		if (yield* hasCommitScope) return yield* unavailable();
+		return (yield* coordinateCommit(() => Effect.gen(function* () {
+			const statements = [];
+			let mutation;
+			const nativeCollector = D1BatchStatements.of({ append: (statement) => Effect.sync(() => statements.push(statement)) });
+			const owner = yield* makeD1Owner(unavailable()).pipe(Effect.provideService(D1BatchStatements, nativeCollector));
+			const plans = makeAddressPlans(options.mapping, options.proofMapping);
+			const run = (plan) => coordinateCommit(() => Effect.gen(function* () {
+				const journal = yield* CurrentCommitJournal;
+				const planned = yield* plan;
+				yield* owner.check;
+				if (mutation !== void 0) return yield* unavailable();
+				const guarded = {
+					...planned,
+					journalGuard: journal.prepare(void 0)
+				};
+				mutation = guarded;
+				statements.push(...guarded.statements);
+				return guarded.receipt;
+			}), { mode: "batch" }).pipe(Effect.map((result) => result.value), Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(CurrentEmailSql, database), Effect.provideService(LifecycleHooks, hooks));
+			const provided = Context.make(EmailAddressPersistence, {
+				target: (input) => owner.run(plans.target(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(CurrentEmailSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure)),
+				checkCompletion: (input) => owner.run(plans.checkCompletion(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(CurrentEmailSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure)),
+				verifyWithProof: (input, prepare) => owner.run(run(plans.verifyWithProof(input, prepare)).pipe(translateFailure)),
+				changeWithProof: (input, prepare) => owner.run(run(plans.changeWithProof(input, prepare)).pipe(translateFailure)),
+				cleanup: (input, prepare) => owner.run(run(plans.cleanup(input, prepare)).pipe(translateFailure))
+			}).pipe(Context.add(D1BatchStatements, owner.collector));
+			const value = yield* owner.close(Effect.provideContext(body, provided));
+			if (mutation?.journalGuard !== void 0) {
+				const status = yield* Effect.result(mutation.journalGuard.read);
+				if (status._tag === "Success" || status.failure._tag !== "CommitPending") return yield* unavailable();
+			}
+			yield* database.$client.batch(statements).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, (error) => everyFailureMatches(cause, mutation?.retryable) ? unavailable() : error))), translateFailure);
+			return value;
+		}), { mode: "batch" }).pipe(Effect.provideService(LifecycleHooks, hooks))).value;
+	}));
+}
+function coordinateD1EmailRegistration(acquire, options, body) {
+	return Effect.flatMap(acquire, (database) => Effect.gen(function* () {
+		const hooks = yield* LifecycleHooks;
+		if (yield* hasCommitScope) return yield* unavailable();
+		return (yield* coordinateCommit(() => Effect.gen(function* () {
+			const statements = [];
+			let mutation;
+			const nativeCollector = D1BatchStatements.of({ append: (statement) => Effect.sync(() => statements.push(statement)) });
+			const owner = yield* makeD1Owner(unavailable()).pipe(Effect.provideService(D1BatchStatements, nativeCollector));
+			const plans = makeRegistrationPlans(options.mapping, options.proofMapping);
+			const run = (plan) => coordinateCommit(() => Effect.gen(function* () {
+				const journal = yield* CurrentCommitJournal;
+				const planned = yield* plan;
+				yield* owner.check;
+				if (mutation !== void 0) return yield* unavailable();
+				const guarded = {
+					...planned,
+					journalGuard: journal.prepare(void 0)
+				};
+				mutation = guarded;
+				statements.push(...guarded.statements);
+				return guarded.receipt;
+			}), { mode: "batch" }).pipe(Effect.map((result) => result.value), Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(CurrentEmailSql, database), Effect.provideService(LifecycleHooks, hooks));
+			const provided = Context.make(options.target, {
+				inspect: (input) => owner.run(plans.inspect(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(CurrentEmailSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure)),
+				registerWithProof: (input, prepare) => owner.run(run(plans.registerWithProof(input, prepare)).pipe(translateFailure))
+			}).pipe(Context.add(D1BatchStatements, owner.collector));
+			const value = yield* owner.close(Effect.provideContext(body, provided));
+			if (mutation?.journalGuard !== void 0) {
+				const status = yield* Effect.result(mutation.journalGuard.read);
+				if (status._tag === "Success" || status.failure._tag !== "CommitPending") return yield* unavailable();
+			}
+			yield* database.$client.batch(statements).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, (error) => everyFailureMatches(cause, mutation?.retryable) ? unavailable() : error))), translateFailure);
+			return value;
+		}), { mode: "batch" }).pipe(Effect.provideService(LifecycleHooks, hooks))).value;
+	}));
+}
+const translateFailure = (effect) => reportPersistenceFailure(effect, (error) => Schema.is(EmailUnavailable)(error) || Schema.is(ProofUnavailable)(error) || Schema.is(HookConfigurationError)(error)).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));
+const executeStandalone = (plan, retries = 2) => Effect.suspend(() => {
+	let retryable;
+	return coordinateCommit(() => Effect.gen(function* () {
+		const database = yield* CurrentD1PlanningDatabase;
+		const planned = yield* plan;
+		retryable = planned.retryable;
+		yield* database.$client.batch(planned.statements);
+		return planned.receipt;
+	}), { mode: "batch" }).pipe(Effect.map((result) => result.value)).pipe(Effect.catchCause((cause) => retries > 0 && everyFailureMatches(cause, retryable) ? executeStandalone(plan, retries - 1) : Effect.failCause(cause)));
+});
+//#endregion
+export { coordinateD1EmailAddress, coordinateD1EmailRegistration, makeD1EmailAddressServices, makeD1EmailRegistrationServices, makeD1EmailSignInServices };
+
+//# sourceMappingURL=d1-emails.mjs.map