@yielded/auth-persistence-drizzle 0.1.0-beta.0

package/dist/drizzle/d1-proofs.mjs

@@ -0,0 +1,829 @@
+import { requiredProofConstraints } from "./proof-model.mjs";
+import { PersistenceMappingError, column, isMappedConstraintConflict, updateValues } from "./model.mjs";
+import { balancedD1And } from "./d1-generated-statement.mjs";
+import { D1BatchStatements } from "./D1BatchStatements.mjs";
+import { CurrentD1PlanningDatabase, makeD1Owner } from "./d1-planning.mjs";
+import { and, count, eq, gte, inArray, isNull, lte, notExists, or, sql } from "drizzle-orm";
+import { Cause, Context, Effect, Schema } from "effect";
+import { CurrentCommitJournal, HookConfigurationError, LifecycleHooks, coordinateCommit, hasCommitScope } from "@yielded/auth/Hooks";
+import { reportPersistenceFailure } from "@yielded/auth/Persistence";
+import { ProofBinding, ProofPersistence, ProofRequestConflict, ProofUnavailable } from "@yielded/auth/Proofs";
+//#region src/drizzle/d1-proofs.ts
+const unavailable = () => ProofUnavailable.make({});
+const everyFailureMatches = (cause, classify) => classify !== void 0 && cause.reasons.length > 0 && cause.reasons.every((reason) => Cause.isFailReason(reason) && classify(Cause.fail(reason.error)));
+const conflict = () => ProofRequestConflict.make({});
+const validConstraints = (mapping) => Object.entries(requiredProofConstraints).every(([key, value]) => mapping.constraints[key] === value);
+const canonicalBinding = Schema.encodeSync(Schema.fromJsonString(ProofBinding));
+const sameBinding = (left, right) => canonicalBinding(left) === canonicalBinding(right);
+const containsFailure = (failure, predicate) => {
+	const seen = /* @__PURE__ */ new Set();
+	const pending = [failure];
+	for (let inspected = 0; inspected < 32 && pending.length > 0; inspected++) {
+		const current = pending.shift();
+		if (current === void 0 || current === null || seen.has(current)) continue;
+		seen.add(current);
+		if (predicate(current)) return true;
+		if (Cause.isCause(current)) {
+			for (const reason of current.reasons) if (Cause.isFailReason(reason)) pending.push(reason.error);
+			else if (Cause.isDieReason(reason)) pending.push(reason.defect);
+			continue;
+		}
+		if (typeof current !== "object") continue;
+		const wrapped = current;
+		if (wrapped.cause !== void 0) pending.push(wrapped.cause);
+		if (wrapped.reason !== void 0) pending.push(wrapped.reason);
+		if (wrapped.message !== void 0) pending.push(wrapped.message);
+	}
+	return false;
+};
+const isGuardFailure = (cause, marker) => {
+	const nativeMessage = `bad JSON path: '${`$[${marker.replaceAll("'", "''")}]`}': SQLITE_ERROR`;
+	return containsFailure(cause, (value) => value === nativeMessage || value === `D1_ERROR: ${nativeMessage}`);
+};
+const statement = Effect.fn(function* (query) {
+	const database = yield* CurrentD1PlanningDatabase;
+	const rendered = query.toSQL();
+	return database.$client.unsafe(rendered.sql, rendered.params);
+});
+const readEngineNowMillis = Effect.fn("Drizzle.readEngineNowMillis")(function* (mapping) {
+	return yield* (yield* CurrentD1PlanningDatabase).select({ value: mapping.d1.engineNowMillis.as("engine_now_millis") }).from(sql`(select 1)`).pipe(Effect.flatMap((rows) => {
+		const value = Number(rows[0]?.value);
+		return Number.isFinite(value) ? Effect.succeed(value) : Effect.fail(unavailable());
+	}));
+});
+const driverValues = (values, entries) => ({
+	...values,
+	...Object.fromEntries(entries)
+});
+const assertion = Effect.fn(function* (condition, marker) {
+	const database = yield* CurrentD1PlanningDatabase;
+	return yield* statement(database.select({ ok: sql`case when ${condition} then 1 else json_extract('[]', ${`$[${marker}]`}) end`.as("ok") }).from(sql`(select 1)`));
+});
+const allocateVersion = (mapping) => mapping.allocateVersion !== void 0 ? mapping.allocateVersion : mapping.allocateVersionSync === void 0 ? Effect.fail(unavailable()) : Effect.try({
+	try: mapping.allocateVersionSync,
+	catch: (cause) => new PersistenceMappingError({
+		operation: "mapping",
+		cause
+	})
+});
+const requestColumns = (mapping) => ({
+	moduleId: column(mapping.request.table, mapping.request.moduleId),
+	requestId: column(mapping.request.table, mapping.request.requestId),
+	fingerprint: column(mapping.request.table, mapping.request.fingerprint),
+	proofId: column(mapping.request.table, mapping.request.proofId),
+	retentionUntil: column(mapping.request.table, mapping.request.retentionUntil)
+});
+const seriesColumns = (mapping) => ({
+	moduleId: column(mapping.series.table, mapping.series.moduleId),
+	purpose: column(mapping.series.table, mapping.series.purpose),
+	scopeKey: column(mapping.series.table, mapping.series.scopeKey),
+	activeProofId: column(mapping.series.table, mapping.series.activeProofId),
+	lastIssueAt: column(mapping.series.table, mapping.series.lastIssueAt),
+	version: column(mapping.series.table, mapping.series.version)
+});
+const generationColumns = (mapping) => ({
+	moduleId: column(mapping.generation.table, mapping.generation.moduleId),
+	purpose: column(mapping.generation.table, mapping.generation.purpose),
+	proofId: column(mapping.generation.table, mapping.generation.proofId),
+	seriesKey: column(mapping.generation.table, mapping.generation.seriesKey),
+	deliveryId: column(mapping.generation.table, mapping.generation.deliveryId),
+	verifierKeyId: column(mapping.generation.table, mapping.generation.verifierKeyId),
+	verifierDigest: column(mapping.generation.table, mapping.generation.verifierDigest),
+	expiresAt: column(mapping.generation.table, mapping.generation.expiresAt),
+	version: column(mapping.generation.table, mapping.generation.version),
+	state: column(mapping.generation.table, mapping.generation.state),
+	sendCount: column(mapping.generation.table, mapping.generation.sendCount),
+	deliveryState: column(mapping.generation.table, mapping.generation.deliveryState),
+	claimVersion: column(mapping.generation.table, mapping.generation.claimVersion),
+	claimDeadline: column(mapping.generation.table, mapping.generation.claimDeadline),
+	retryAt: column(mapping.generation.table, mapping.generation.retryAt),
+	deliveryRetryMillis: column(mapping.generation.table, mapping.generation.deliveryRetryMillis),
+	retentionUntil: column(mapping.generation.table, mapping.generation.retentionUntil)
+});
+const continuationColumns = (mapping) => ({
+	moduleId: column(mapping.continuation.table, mapping.continuation.moduleId),
+	continuationId: column(mapping.continuation.table, mapping.continuation.continuationId),
+	digest: column(mapping.continuation.table, mapping.continuation.digest),
+	consumed: column(mapping.continuation.table, mapping.continuation.consumed),
+	retentionUntil: column(mapping.continuation.table, mapping.continuation.retentionUntil)
+});
+const scopeColumns = (mapping) => ({
+	moduleId: column(mapping.rateScope.table, mapping.rateScope.moduleId),
+	purpose: column(mapping.rateScope.table, mapping.rateScope.purpose),
+	action: column(mapping.rateScope.table, mapping.rateScope.action),
+	scopeKind: column(mapping.rateScope.table, mapping.rateScope.scopeKind),
+	scopeKey: column(mapping.rateScope.table, mapping.rateScope.scopeKey)
+});
+const abuseColumns = (mapping) => ({
+	moduleId: column(mapping.abuseEvent.table, mapping.abuseEvent.moduleId),
+	purpose: column(mapping.abuseEvent.table, mapping.abuseEvent.purpose),
+	action: column(mapping.abuseEvent.table, mapping.abuseEvent.action),
+	scopeKind: column(mapping.abuseEvent.table, mapping.abuseEvent.scopeKind),
+	scopeKey: column(mapping.abuseEvent.table, mapping.abuseEvent.scopeKey),
+	commandId: column(mapping.abuseEvent.table, mapping.abuseEvent.commandId),
+	occurredAt: column(mapping.abuseEvent.table, mapping.abuseEvent.occurredAt),
+	retentionUntil: column(mapping.abuseEvent.table, mapping.abuseEvent.retentionUntil)
+});
+const failureColumns = (mapping) => ({
+	moduleId: column(mapping.failureEvent.table, mapping.failureEvent.moduleId),
+	purpose: column(mapping.failureEvent.table, mapping.failureEvent.purpose),
+	seriesKey: column(mapping.failureEvent.table, mapping.failureEvent.seriesKey),
+	commandId: column(mapping.failureEvent.table, mapping.failureEvent.commandId),
+	occurredAt: column(mapping.failureEvent.table, mapping.failureEvent.occurredAt),
+	retentionUntil: column(mapping.failureEvent.table, mapping.failureEvent.retentionUntil)
+});
+const commandColumns = (mapping) => ({
+	moduleId: column(mapping.command.table, mapping.command.moduleId),
+	commandId: column(mapping.command.table, mapping.command.commandId),
+	decision: column(mapping.command.table, mapping.command.decision),
+	retentionUntil: column(mapping.command.table, mapping.command.retentionUntil)
+});
+const scopeEntries = (keys, binding, action, policy) => {
+	const suffix = action === "issue" ? "Issues" : "Attempts";
+	const simple = action === "issue" ? "issues" : "attempts";
+	const entries = [{
+		kind: "action",
+		key: "*",
+		budget: policy.abuse[`action${suffix}`]
+	}, {
+		kind: "identifier",
+		key: keys.identifier,
+		budget: policy.abuse[simple]
+	}];
+	if (binding._tag !== "Identifier") entries.push({
+		kind: "subject",
+		key: keys.subject,
+		budget: policy.abuse[`subject${suffix}`]
+	});
+	return entries;
+};
+const scopeCondition = (mapping, moduleId, purpose, action, entry) => {
+	const c = abuseColumns(mapping);
+	return sql`(select count(*) from ${mapping.abuseEvent.table} where ${c.moduleId} = ${sql.param(moduleId, c.moduleId)} and ${c.purpose} = ${sql.param(purpose, c.purpose)} and ${c.action} = ${sql.param(action, c.action)} and ${c.scopeKind} = ${sql.param(entry.kind, c.scopeKind)} and ${c.scopeKey} = ${sql.param(entry.key, c.scopeKey)} and ${c.occurredAt} >= ${mapping.d1.engineInstantMinus(entry.budget.windowMillis)}) < ${entry.budget.limit}`;
+};
+const failureCondition = (mapping, moduleId, purpose, seriesKey, policy) => {
+	const c = failureColumns(mapping);
+	return sql`(select count(*) from ${mapping.failureEvent.table} where ${c.moduleId} = ${sql.param(moduleId, c.moduleId)} and ${c.purpose} = ${sql.param(purpose, c.purpose)} and ${c.seriesKey} = ${sql.param(seriesKey, c.seriesKey)} and ${c.occurredAt} >= ${mapping.d1.engineInstantMinus(policy.abuse.attempts.windowMillis)}) < ${policy.maximumFailedAttempts}`;
+};
+const readScopeAdmission = Effect.fn("DrizzleD1Proof.readScopeAdmission")(function* (mapping, moduleId, purpose, action, entries, now) {
+	const database = yield* CurrentD1PlanningDatabase;
+	const c = abuseColumns(mapping);
+	const admitted = [];
+	for (const entry of entries) {
+		const rows = yield* database.select({ total: count() }).from(mapping.abuseEvent.table).where(and(eq(c.moduleId, moduleId), eq(c.purpose, purpose), eq(c.action, action), eq(c.scopeKind, entry.kind), eq(c.scopeKey, entry.key), gte(c.occurredAt, mapping.encodeInstant(now - entry.budget.windowMillis))));
+		if (Number(rows[0]?.total ?? 0) < entry.budget.limit) admitted.push(entry);
+	}
+	return admitted;
+});
+const authority = Effect.fn("DrizzleD1Proof.authority")(function* (mapping, moduleId, purpose, binding) {
+	const database = yield* CurrentD1PlanningDatabase;
+	let nativeSubjectId;
+	let subjectCurrent = true;
+	const parts = [];
+	if (binding._tag !== "Identifier") {
+		if (mapping.authority.subject === void 0 || mapping.authority.credential === void 0 || mapping.authority.subjectId === void 0) return yield* unavailable();
+		nativeSubjectId = yield* mapping.authority.subjectId.toNative(binding.revision.subjectId);
+		const subject = mapping.authority.subject;
+		const id = column(subject.table, subject.id);
+		const status = column(subject.table, subject.status);
+		const revision = column(subject.table, subject.securityRevision);
+		const subjectRow = (yield* database.select().from(subject.table).where(eq(id, nativeSubjectId)).limit(1))[0];
+		subjectCurrent = subjectRow !== void 0 && subject.isActiveStatus(subjectRow[subject.status]) && subjectRow[subject.securityRevision] === binding.revision.securityRevision;
+		parts.push(sql`exists(select 1 from ${subject.table} where ${id} = ${sql.param(nativeSubjectId, id)} and ${status} = ${sql.param(subject.d1ActiveStatusValue, status)} and ${revision} = ${sql.param(binding.revision.securityRevision, revision)})`);
+	}
+	const identifier = mapping.authority.identifier;
+	const namespace = column(identifier.table, identifier.namespace);
+	const value = column(identifier.table, identifier.value);
+	const identifierRows = yield* database.select().from(identifier.table).where(and(eq(namespace, binding.identifier.namespace), eq(value, binding.identifier.value)));
+	const input = {
+		moduleId,
+		purpose,
+		binding,
+		...nativeSubjectId === void 0 ? {} : { nativeSubjectId }
+	};
+	const identifierCurrent = identifier.isCurrent(input, identifierRows);
+	parts.push(identifier.d1CurrentCondition(input));
+	let credentialsCurrent = true;
+	if (binding._tag !== "Identifier") {
+		const credential = mapping.authority.credential;
+		const owner = column(credential.table, credential.subjectId);
+		const id = column(credential.table, credential.credentialId);
+		const revision = column(credential.table, credential.revision);
+		const status = credential.status === void 0 ? void 0 : column(credential.table, credential.status);
+		const expected = [...binding.revision.credentials].sort((a, b) => a.credentialId.localeCompare(b.credentialId));
+		const actual = (expected.length === 0 ? [] : yield* database.select().from(credential.table).where(and(eq(owner, nativeSubjectId), inArray(id, expected.map((item) => item.credentialId))))).map((row) => ({
+			id: row[credential.credentialId],
+			revision: row[credential.revision],
+			active: credential.status === void 0 || credential.isActiveStatus?.(row[credential.status]) === true
+		})).sort((a, b) => String(a.id).localeCompare(String(b.id)));
+		credentialsCurrent = actual.length === expected.length && actual.every((row, index) => row.active && row.id === expected[index]?.credentialId && row.revision === expected[index]?.revision);
+		for (const expectedCredential of expected) parts.push(sql`exists(select 1 from ${credential.table} where ${owner} = ${sql.param(nativeSubjectId, owner)} and ${id} = ${sql.param(expectedCredential.credentialId, id)} and ${revision} = ${sql.param(expectedCredential.revision, revision)}${status === void 0 ? sql`` : sql` and ${status} = ${sql.param(credential.d1ActiveStatusValue, status)}`})`);
+	}
+	return {
+		current: subjectCurrent && identifierCurrent && credentialsCurrent,
+		condition: balancedD1And(...parts) ?? sql`1 = 1`
+	};
+});
+const anchorStatements = Effect.fn(function* (mapping, moduleId, purpose, action, entries, seriesKey, seriesVersion, includeSeries) {
+	const database = yield* CurrentD1PlanningDatabase;
+	return [...yield* Effect.forEach(entries, Effect.fn(function* (entry) {
+		return yield* statement(database.insert(mapping.rateScope.table).values(mapping.rateScope.encodeInsert({
+			moduleId,
+			purpose,
+			action,
+			scopeKind: entry.kind,
+			scopeKey: entry.key
+		})).onConflictDoNothing());
+	})), ...includeSeries ? [yield* statement(database.insert(mapping.series.table).values(mapping.series.encodeInsert({
+		moduleId,
+		purpose,
+		scopeKey: seriesKey,
+		version: seriesVersion
+	})).onConflictDoNothing())] : []];
+});
+const insertScopeStatements = Effect.fn(function* (mapping, moduleId, purpose, action, commandId, entries, now, retentionUntil, marker) {
+	const database = yield* CurrentD1PlanningDatabase;
+	return (yield* Effect.forEach(entries, Effect.fn(function* (entry) {
+		return [yield* assertion(scopeCondition(mapping, moduleId, purpose, action, entry), marker), yield* statement(database.insert(mapping.abuseEvent.table).values(driverValues(mapping.abuseEvent.encodeInsert({
+			moduleId,
+			purpose,
+			action,
+			scopeKind: entry.kind,
+			scopeKey: entry.key,
+			commandId,
+			occurredAtMillis: now,
+			retentionUntilMillis: retentionUntil
+		}), [[mapping.abuseEvent.occurredAt, mapping.d1.engineNow], [mapping.abuseEvent.retentionUntil, mapping.d1.engineInstantPlus(retentionUntil - now)]])))];
+	}))).flat();
+});
+const readSeries = Effect.fn("Drizzle.readSeries")(function* (mapping, moduleId, purpose, key) {
+	const database = yield* CurrentD1PlanningDatabase;
+	const c = seriesColumns(mapping);
+	return yield* database.select().from(mapping.series.table).where(and(eq(c.moduleId, moduleId), eq(c.purpose, purpose), eq(c.scopeKey, key))).limit(1);
+});
+const readGeneration = Effect.fn("Drizzle.readGeneration")(function* (mapping, moduleId, proofId) {
+	const database = yield* CurrentD1PlanningDatabase;
+	const c = generationColumns(mapping);
+	return yield* database.select().from(mapping.generation.table).where(and(eq(c.moduleId, moduleId), eq(c.proofId, proofId))).limit(1);
+});
+const commandInsert = Effect.fn(function* (mapping, moduleId, commandId, kind, decision, retentionUntil, nativeRetention) {
+	const database = yield* CurrentD1PlanningDatabase;
+	return yield* statement(database.insert(mapping.command.table).values(driverValues(mapping.command.encodeInsert({
+		moduleId,
+		commandId,
+		kind,
+		decision,
+		retentionUntilMillis: retentionUntil
+	}), nativeRetention === void 0 ? [] : [[mapping.command.retentionUntil, nativeRetention]])));
+});
+const issuePlan = Effect.fn("Drizzle.issuePlan")(function* (mapping, input, prepare) {
+	const database = yield* CurrentD1PlanningDatabase;
+	const journal = yield* CurrentCommitJournal;
+	const keys = mapping.scopeKeys({
+		moduleId: input.record.moduleId,
+		purpose: input.record.purpose,
+		binding: input.record.binding
+	});
+	const current = yield* authority(mapping, input.record.moduleId, input.record.purpose, input.record.binding);
+	const now = yield* readEngineNowMillis(mapping);
+	const retentionUntil = now + input.policy.requestRetentionMillis;
+	const rc = requestColumns(mapping);
+	const existingRequest = (yield* database.select().from(mapping.request.table).where(and(eq(rc.moduleId, input.record.moduleId), eq(rc.requestId, input.record.requestId))).limit(1))[0];
+	if (existingRequest !== void 0) {
+		if ((yield* mapping.decodeInstant(existingRequest[mapping.request.retentionUntil])) > now) {
+			if (existingRequest[mapping.request.fingerprint] !== input.record.fingerprint) return yield* conflict();
+			return {
+				receipt: prepare({
+					_tag: "Existing",
+					receipt: yield* mapping.request.decodeReceipt(existingRequest)
+				}, journal),
+				statements: []
+			};
+		}
+	}
+	const scopes = scopeEntries(keys, input.record.binding, "issue", input.policy);
+	const initiallyAdmitted = yield* readScopeAdmission(mapping, input.record.moduleId, input.record.purpose, "issue", scopes, now);
+	const actionOpen = initiallyAdmitted.some((entry) => entry.kind === "action");
+	const admitted = actionOpen ? initiallyAdmitted : [];
+	const existingSeries = actionOpen ? (yield* readSeries(mapping, input.record.moduleId, input.record.purpose, keys.series))[0] : void 0;
+	const seriesVersion = yield* allocateVersion(mapping);
+	const active = existingSeries?.[mapping.series.activeProofId];
+	const lastIssue = existingSeries?.[mapping.series.lastIssueAt] === null || existingSeries?.[mapping.series.lastIssueAt] === void 0 ? void 0 : yield* mapping.decodeInstant(existingSeries[mapping.series.lastIssueAt]);
+	const allowed = current.current && input.eligible && admitted.length === scopes.length && input.record.issuedAtMillis <= now && input.record.expiresAtMillis > now && (input.supersedes === void 0 || input.supersedes === active) && (lastIssue === void 0 || now - lastIssue >= input.policy.abuse.resendCooldownMillis);
+	const receipt = {
+		requestId: input.record.requestId,
+		reference: {
+			proofId: input.record.proofId,
+			purpose: input.record.purpose,
+			keyId: input.record.verifier.keyId
+		}
+	};
+	const prepared = prepare(allowed ? {
+		_tag: "Issued",
+		record: input.record
+	} : {
+		_tag: "Suppressed",
+		receipt
+	}, journal);
+	const statements = [];
+	const marker = `effect-auth-proof-guard:issue:${input.record.requestId}`;
+	if (existingRequest !== void 0) statements.push(yield* statement(database.delete(mapping.request.table).where(and(eq(rc.moduleId, input.record.moduleId), eq(rc.requestId, input.record.requestId), lte(rc.retentionUntil, mapping.d1.engineNow)))));
+	statements.push(yield* statement(database.insert(mapping.request.table).values(driverValues(mapping.request.encodeInsert({
+		record: input.record,
+		createdAtMillis: now,
+		retentionUntilMillis: retentionUntil
+	}), [[mapping.request.createdAt, mapping.d1.engineNow], [mapping.request.retentionUntil, mapping.d1.engineInstantPlus(input.policy.requestRetentionMillis)]]))), ...yield* anchorStatements(mapping, input.record.moduleId, input.record.purpose, "issue", actionOpen ? scopes : scopes.slice(0, 1), keys.series, seriesVersion, actionOpen), ...yield* insertScopeStatements(mapping, input.record.moduleId, input.record.purpose, "issue", input.record.requestId, admitted, now, retentionUntil, marker));
+	if (allowed) {
+		const sc = seriesColumns(mapping);
+		const seriesCondition = and(eq(sc.moduleId, input.record.moduleId), eq(sc.purpose, input.record.purpose), eq(sc.scopeKey, keys.series), active === null || active === void 0 ? or(eq(sc.activeProofId, null), sql`${sc.activeProofId} is null`) : eq(sc.activeProofId, active), lastIssue === void 0 ? sql`1 = 1` : lte(sc.lastIssueAt, mapping.d1.engineInstantMinus(input.policy.abuse.resendCooldownMillis)));
+		statements.push(yield* assertion(and(current.condition, sql`${mapping.d1.engineNowMillis} >= ${input.record.issuedAtMillis}`, sql`${mapping.d1.engineNow} < ${sql.param(mapping.encodeInstant(input.record.expiresAtMillis), generationColumns(mapping).expiresAt)}`, sql`exists(select 1 from ${mapping.series.table} where ${seriesCondition})`), marker));
+		if (active !== null && active !== void 0) statements.push(yield* statement(database.update(mapping.generation.table).set(updateValues([[mapping.generation.state, "superseded"]])).where(and(eq(generationColumns(mapping).moduleId, input.record.moduleId), eq(generationColumns(mapping).proofId, active), eq(generationColumns(mapping).state, "active")))));
+		statements.push(yield* statement(database.insert(mapping.generation.table).values(driverValues(mapping.generation.encodeInsert({
+			record: input.record,
+			seriesKey: keys.series,
+			retentionUntilMillis: retentionUntil,
+			state: "active",
+			deliveryState: "new",
+			policy: input.policy
+		}), [[mapping.generation.retentionUntil, mapping.d1.engineInstantPlus(input.policy.requestRetentionMillis)]]))), yield* statement(database.update(mapping.series.table).set(updateValues([
+			[mapping.series.activeProofId, input.record.proofId],
+			[mapping.series.lastIssueAt, mapping.d1.engineNow],
+			[mapping.series.version, seriesVersion]
+		])).where(and(eq(sc.moduleId, input.record.moduleId), eq(sc.purpose, input.record.purpose), eq(sc.scopeKey, keys.series)))));
+	}
+	return {
+		receipt: prepared,
+		statements,
+		retryable: (cause) => isMappedConstraintConflict(mapping.isRequestConflict, cause) || isMappedConstraintConflict(mapping.isSeriesConflict, cause) || isGuardFailure(cause, marker)
+	};
+});
+const attemptPlan = Effect.fn("Drizzle.attemptPlan")(function* (mapping, input, prepare) {
+	const database = yield* CurrentD1PlanningDatabase;
+	const journal = yield* CurrentCommitJournal;
+	const keys = mapping.scopeKeys({
+		moduleId: input.moduleId,
+		purpose: input.purpose,
+		binding: input.binding
+	});
+	const current = yield* authority(mapping, input.moduleId, input.purpose, input.binding);
+	const command = commandColumns(mapping);
+	const existingCommand = (yield* database.select().from(mapping.command.table).where(and(eq(command.moduleId, input.moduleId), eq(command.commandId, input.continuationId))).limit(1))[0];
+	if (existingCommand !== void 0) {
+		if (existingCommand[mapping.command.decision] === "rejected") return {
+			receipt: prepare({ _tag: "Rejected" }, journal),
+			statements: []
+		};
+		return yield* unavailable();
+	}
+	const now = yield* readEngineNowMillis(mapping);
+	const scopes = scopeEntries(keys, input.binding, "attempt", input.policy);
+	const initiallyAdmitted = yield* readScopeAdmission(mapping, input.moduleId, input.purpose, "attempt", scopes, now);
+	const actionOpen = initiallyAdmitted.some((entry) => entry.kind === "action");
+	const admitted = actionOpen ? initiallyAdmitted : [];
+	const series = actionOpen ? (yield* readSeries(mapping, input.moduleId, input.purpose, keys.series))[0] : void 0;
+	const generation = (yield* readGeneration(mapping, input.moduleId, input.proofId))[0];
+	const fc = failureColumns(mapping);
+	const failureRows = yield* database.select({ total: count() }).from(mapping.failureEvent.table).where(and(eq(fc.moduleId, input.moduleId), eq(fc.purpose, input.purpose), eq(fc.seriesKey, keys.series), gte(fc.occurredAt, mapping.encodeInstant(now - input.policy.abuse.attempts.windowMillis))));
+	const failures = Number(failureRows[0]?.total ?? 0);
+	const storedBinding = generation === void 0 ? void 0 : yield* mapping.generation.decodeBinding(generation);
+	const expires = generation === void 0 ? void 0 : yield* mapping.decodeInstant(generation[mapping.generation.expiresAt]);
+	const currentGeneration = generation !== void 0 && generation[mapping.generation.purpose] === input.purpose && generation[mapping.generation.state] === "active" && series?.[mapping.series.activeProofId] === input.proofId && storedBinding !== void 0 && sameBinding(storedBinding, input.binding) && expires !== void 0 && expires > now;
+	const candidateMatches = generation !== void 0 && input.candidate !== void 0 && generation[mapping.generation.verifierKeyId] === input.candidate.keyId && generation[mapping.generation.verifierDigest] === input.candidate.digest;
+	const accepted = current.current && currentGeneration && candidateMatches && admitted.length === scopes.length && failures < input.policy.maximumFailedAttempts;
+	const retentionUntil = now + input.policy.requestRetentionMillis;
+	const seriesVersion = yield* allocateVersion(mapping);
+	const statements = [...yield* anchorStatements(mapping, input.moduleId, input.purpose, "attempt", actionOpen ? scopes : scopes.slice(0, 1), keys.series, seriesVersion, actionOpen), ...yield* insertScopeStatements(mapping, input.moduleId, input.purpose, "attempt", input.continuationId, admitted, now, retentionUntil, `effect-auth-proof-guard:attempt:${input.continuationId}`)];
+	const marker = `effect-auth-proof-guard:attempt:${input.continuationId}`;
+	if (!accepted) {
+		const prepared = prepare({ _tag: "Rejected" }, journal);
+		if (admitted.length === scopes.length && current.current && currentGeneration && !candidateMatches && failures < input.policy.maximumFailedAttempts) {
+			const gc = generationColumns(mapping);
+			const sc = seriesColumns(mapping);
+			statements.push(yield* assertion(and(current.condition, sql`exists(select 1 from ${mapping.series.table} where ${sc.moduleId} = ${sql.param(input.moduleId, sc.moduleId)} and ${sc.purpose} = ${sql.param(input.purpose, sc.purpose)} and ${sc.scopeKey} = ${sql.param(keys.series, sc.scopeKey)} and ${sc.activeProofId} = ${sql.param(input.proofId, sc.activeProofId)})`, sql`exists(select 1 from ${mapping.generation.table} where ${gc.moduleId} = ${sql.param(input.moduleId, gc.moduleId)} and ${gc.proofId} = ${sql.param(input.proofId, gc.proofId)} and ${gc.state} = 'active' and ${gc.expiresAt} > ${mapping.d1.engineNow})`, failureCondition(mapping, input.moduleId, input.purpose, keys.series, input.policy)), marker), yield* statement(database.insert(mapping.failureEvent.table).values(driverValues(mapping.failureEvent.encodeInsert({
+				moduleId: input.moduleId,
+				purpose: input.purpose,
+				seriesKey: keys.series,
+				commandId: input.continuationId,
+				occurredAtMillis: now,
+				retentionUntilMillis: retentionUntil
+			}), [[mapping.failureEvent.occurredAt, mapping.d1.engineNow], [mapping.failureEvent.retentionUntil, mapping.d1.engineInstantPlus(input.policy.requestRetentionMillis)]]))));
+		}
+		statements.push(yield* commandInsert(mapping, input.moduleId, input.continuationId, "attempt", "rejected", retentionUntil, mapping.d1.engineInstantPlus(input.policy.requestRetentionMillis)));
+		return {
+			receipt: prepared,
+			statements,
+			retryable: (cause) => isMappedConstraintConflict(mapping.isCommandConflict, cause) || isMappedConstraintConflict(mapping.isSeriesConflict, cause) || isGuardFailure(cause, marker)
+		};
+	}
+	const version = yield* allocateVersion(mapping);
+	const continuationExpires = Math.min(expires, now + input.policy.continuationLifetimeMillis);
+	const continuation = {
+		moduleId: input.moduleId,
+		purpose: input.purpose,
+		continuationId: input.continuationId,
+		digest: input.continuationDigest,
+		proofId: input.proofId,
+		seriesKey: keys.series,
+		binding: input.binding,
+		expiresAtMillis: continuationExpires,
+		version
+	};
+	const prepared = prepare({
+		_tag: "Accepted",
+		continuation: {
+			continuationId: input.continuationId,
+			purpose: input.purpose,
+			expiresAtMillis: continuationExpires
+		}
+	}, journal);
+	const gc = generationColumns(mapping);
+	const sc = seriesColumns(mapping);
+	statements.push(yield* assertion(and(current.condition, failureCondition(mapping, input.moduleId, input.purpose, keys.series, input.policy), sql`exists(select 1 from ${mapping.series.table} where ${sc.moduleId} = ${sql.param(input.moduleId, sc.moduleId)} and ${sc.purpose} = ${sql.param(input.purpose, sc.purpose)} and ${sc.scopeKey} = ${sql.param(keys.series, sc.scopeKey)} and ${sc.activeProofId} = ${sql.param(input.proofId, sc.activeProofId)})`, sql`exists(select 1 from ${mapping.generation.table} where ${gc.moduleId} = ${sql.param(input.moduleId, gc.moduleId)} and ${gc.proofId} = ${sql.param(input.proofId, gc.proofId)} and ${gc.purpose} = ${sql.param(input.purpose, gc.purpose)} and ${gc.state} = 'active' and ${gc.verifierKeyId} = ${sql.param(input.candidate.keyId, gc.verifierKeyId)} and ${gc.verifierDigest} = ${sql.param(input.candidate.digest, gc.verifierDigest)} and ${gc.expiresAt} > ${mapping.d1.engineNow})`), marker), yield* commandInsert(mapping, input.moduleId, input.continuationId, "attempt", "accepted", retentionUntil, mapping.d1.engineInstantPlus(input.policy.requestRetentionMillis)), yield* statement(database.update(mapping.generation.table).set(updateValues([[mapping.generation.state, "consumed"]])).where(and(eq(gc.moduleId, input.moduleId), eq(gc.proofId, input.proofId), eq(gc.state, "active")))), yield* statement(database.insert(mapping.continuation.table).values(driverValues(mapping.continuation.encodeInsert({
+		...continuation,
+		retentionUntilMillis: retentionUntil
+	}), [[mapping.continuation.retentionUntil, mapping.d1.engineInstantPlus(input.policy.requestRetentionMillis)]]))));
+	return {
+		receipt: prepared,
+		statements,
+		retryable: (cause) => isMappedConstraintConflict(mapping.isCommandConflict, cause) || isMappedConstraintConflict(mapping.isSeriesConflict, cause) || isGuardFailure(cause, marker)
+	};
+});
+const inspectD1Completion = Effect.fn("DrizzleD1Proof.inspectCompletion")(function* (mapping, input) {
+	const database = yield* CurrentD1PlanningDatabase;
+	const keys = mapping.scopeKeys({
+		moduleId: input.moduleId,
+		purpose: input.purpose,
+		binding: input.binding
+	});
+	const current = yield* authority(mapping, input.moduleId, input.purpose, input.binding);
+	const c = continuationColumns(mapping);
+	const row = (yield* database.select().from(mapping.continuation.table).where(and(eq(c.moduleId, input.moduleId), eq(c.continuationId, input.continuationId))).limit(1))[0];
+	const now = yield* readEngineNowMillis(mapping);
+	const record = row === void 0 ? void 0 : yield* mapping.continuation.decode(row);
+	const accepted = current.current && record !== void 0 && record.moduleId === input.moduleId && record.continuationId === input.continuationId && record.purpose === input.purpose && record.digest === input.continuationDigest && record.seriesKey === keys.series && sameBinding(record.binding, input.binding) && row[mapping.continuation.consumed] === false && record.expiresAtMillis > now;
+	const immutable = [
+		mapping.continuation.moduleId,
+		mapping.continuation.purpose,
+		mapping.continuation.continuationId,
+		mapping.continuation.digest,
+		mapping.continuation.proofId,
+		mapping.continuation.seriesKey,
+		mapping.continuation.binding,
+		mapping.continuation.expiresAt,
+		mapping.continuation.version,
+		mapping.continuation.retentionUntil
+	];
+	const exact = row === void 0 ? sql`false` : and(...immutable.map((key) => eq(column(mapping.continuation.table, key), row[key])));
+	return {
+		accepted,
+		record,
+		row,
+		columns: c,
+		condition: and(current.condition, sql`exists(select 1 from ${mapping.continuation.table} where ${exact} and ${c.consumed} = ${sql.param(false, c.consumed)} and ${column(mapping.continuation.table, mapping.continuation.expiresAt)} > ${mapping.d1.engineNow})`),
+		appliedCondition: row === void 0 ? sql`false` : sql`exists(select 1 from ${mapping.continuation.table} where ${exact} and ${c.consumed} = ${sql.param(true, c.consumed)} and ${column(mapping.continuation.table, mapping.continuation.expiresAt)} > ${mapping.d1.engineNow})`
+	};
+});
+/** Read-only preflight plus its exact final-engine-time batch predicate. */
+const checkD1ProofCompletion = Effect.fn("Drizzle.checkD1ProofCompletion")(function* (mapping, input) {
+	return yield* inspectD1Completion(mapping, input);
+});
+const completionPlan = Effect.fn("Drizzle.completionPlan")(function* (mapping, input, prepare) {
+	const database = yield* CurrentD1PlanningDatabase;
+	const journal = yield* CurrentCommitJournal;
+	const inspected = yield* inspectD1Completion(mapping, input);
+	const { accepted, record, columns: c } = inspected;
+	const receipt = prepare(accepted ? "completed" : "rejected", journal);
+	if (!accepted) return {
+		receipt,
+		statements: []
+	};
+	const postconditions = [yield* assertion(and(inspected.appliedCondition, sql`exists(select 1 from ${mapping.command.table} where ${column(mapping.command.table, mapping.command.moduleId)} = ${sql.param(input.moduleId, column(mapping.command.table, mapping.command.moduleId))} and ${column(mapping.command.table, mapping.command.commandId)} = ${sql.param(input.continuationDigest, column(mapping.command.table, mapping.command.commandId))} and ${column(mapping.command.table, mapping.command.kind)} = ${sql.param("complete", column(mapping.command.table, mapping.command.kind))} and ${column(mapping.command.table, mapping.command.decision)} = ${sql.param("completed", column(mapping.command.table, mapping.command.decision))} and ${column(mapping.command.table, mapping.command.retentionUntil)} = ${sql.param(mapping.encodeInstant(record.expiresAtMillis), column(mapping.command.table, mapping.command.retentionUntil))})`), `effect-auth-proof-guard:complete:${input.continuationId}`)];
+	return {
+		receipt,
+		statements: [
+			yield* assertion(inspected.condition, `effect-auth-proof-guard:complete:${input.continuationId}`),
+			yield* statement(database.update(mapping.continuation.table).set(updateValues([[mapping.continuation.consumed, true]])).where(and(eq(c.moduleId, input.moduleId), eq(c.continuationId, input.continuationId), eq(c.digest, input.continuationDigest), eq(c.consumed, false)))),
+			yield* commandInsert(mapping, input.moduleId, input.continuationDigest, "complete", "completed", record.expiresAtMillis),
+			...postconditions
+		],
+		postconditions,
+		retryable: (cause) => isMappedConstraintConflict(mapping.isCommandConflict, cause) || isGuardFailure(cause, `effect-auth-proof-guard:complete:${input.continuationId}`)
+	};
+});
+const makeProofPlans = (mapping) => {
+	const run = (plan) => Effect.gen(function* () {
+		if (!validConstraints(mapping)) return yield* unavailable();
+		return yield* plan;
+	});
+	return {
+		issue: (input, prepare) => run(Effect.gen(function* () {
+			return yield* issuePlan(mapping, input, prepare);
+		})),
+		attempt: (input, prepare) => run(Effect.gen(function* () {
+			return yield* attemptPlan(mapping, input, prepare);
+		})),
+		complete: (input, prepare) => run(Effect.gen(function* () {
+			return yield* completionPlan(mapping, input, prepare);
+		})),
+		claimDelivery: (input, prepare) => Effect.gen(function* () {
+			const database = yield* CurrentD1PlanningDatabase;
+			return yield* run(Effect.gen(function* () {
+				const journal = yield* CurrentCommitJournal;
+				const row = (yield* readGeneration(mapping, input.moduleId, input.proofId))[0];
+				const now = yield* readEngineNowMillis(mapping);
+				const c = generationColumns(mapping);
+				if (row === void 0) return {
+					receipt: prepare({ _tag: "Declined" }, journal),
+					statements: []
+				};
+				const expires = yield* mapping.decodeInstant(row[mapping.generation.expiresAt]);
+				const claimDeadline = row[mapping.generation.claimDeadline] === null || row[mapping.generation.claimDeadline] === void 0 ? void 0 : yield* mapping.decodeInstant(row[mapping.generation.claimDeadline]);
+				const retryAt = row[mapping.generation.retryAt] === null || row[mapping.generation.retryAt] === void 0 ? void 0 : yield* mapping.decodeInstant(row[mapping.generation.retryAt]);
+				const state = row[mapping.generation.deliveryState];
+				const expiredClaim = state === "claimed" && claimDeadline !== void 0 && claimDeadline <= now;
+				const effectiveState = expiredClaim ? "ambiguous" : state;
+				if (!(row[mapping.generation.version] === input.version && row[mapping.generation.deliveryId] === input.deliveryId && row[mapping.generation.state] === "active" && expires > now && Number(row[mapping.generation.sendCount]) < input.policy.maximumDeliveryAttempts && (effectiveState === "new" || effectiveState === "ambiguous" && input.allowAmbiguousRetry && (retryAt === void 0 || retryAt <= now)))) {
+					const statements = expiredClaim ? [yield* statement(database.update(mapping.generation.table).set(updateValues([[mapping.generation.deliveryState, "ambiguous"]])).where(and(eq(c.moduleId, input.moduleId), eq(c.proofId, input.proofId), eq(c.deliveryState, "claimed"), lte(c.claimDeadline, mapping.d1.engineNow))))] : [];
+					return {
+						receipt: prepare({ _tag: "Declined" }, journal),
+						statements
+					};
+				}
+				const claimVersion = yield* allocateVersion(mapping);
+				const decision = {
+					_tag: "Claimed",
+					claimVersion
+				};
+				const condition = and(eq(c.moduleId, input.moduleId), eq(c.proofId, input.proofId), eq(c.version, input.version), eq(c.deliveryId, input.deliveryId), eq(c.state, "active"), sql`${c.expiresAt} > ${mapping.d1.engineNow}`, sql`${c.sendCount} < ${input.policy.maximumDeliveryAttempts}`, effectiveState === "new" ? eq(c.deliveryState, "new") : and(eq(c.deliveryState, "ambiguous"), or(sql`${c.retryAt} is null`, lte(c.retryAt, mapping.d1.engineNow))));
+				return {
+					receipt: prepare(decision, journal),
+					statements: [yield* assertion(sql`exists(select 1 from ${mapping.generation.table} where ${condition})`, `effect-auth-proof-guard:claim:${input.proofId}`), yield* statement(database.update(mapping.generation.table).set(updateValues([
+						[mapping.generation.sendCount, Number(row[mapping.generation.sendCount]) + 1],
+						[mapping.generation.deliveryState, "claimed"],
+						[mapping.generation.claimVersion, claimVersion],
+						[mapping.generation.claimDeadline, mapping.d1.engineInstantPlus(input.policy.deliveryClaimMillis)],
+						[mapping.generation.retryAt, mapping.d1.engineInstantPlus(input.policy.deliveryRetryMillis)]
+					])).where(condition))],
+					retryable: (cause) => isGuardFailure(cause, `effect-auth-proof-guard:claim:${input.proofId}`)
+				};
+			}));
+		}),
+		settleDelivery: (input, prepare) => Effect.gen(function* () {
+			const database = yield* CurrentD1PlanningDatabase;
+			return yield* run(Effect.gen(function* () {
+				const journal = yield* CurrentCommitJournal;
+				const row = (yield* readGeneration(mapping, input.moduleId, input.proofId))[0];
+				const receipt = prepare(void 0, journal);
+				if (row === void 0 || row[mapping.generation.version] !== input.version || row[mapping.generation.deliveryId] !== input.deliveryId || row[mapping.generation.claimVersion] !== input.claimVersion || row[mapping.generation.deliveryState] !== "claimed") return {
+					receipt,
+					statements: []
+				};
+				const c = generationColumns(mapping);
+				const outcome = input.outcome;
+				const state = outcome._tag === "Accepted" ? "accepted" : outcome._tag === "DefiniteFailure" ? "failed" : "ambiguous";
+				const values = [[mapping.generation.deliveryState, state], [mapping.generation.claimDeadline, null]];
+				if (outcome._tag === "Ambiguous") values.push([mapping.generation.retryAt, mapping.d1.engineInstantPlus(Number(row[mapping.generation.deliveryRetryMillis]))]);
+				if (outcome._tag === "DefiniteFailure") values.push([mapping.generation.state, "cancelled"]);
+				const condition = and(eq(c.moduleId, input.moduleId), eq(c.proofId, input.proofId), eq(c.version, input.version), eq(c.deliveryId, input.deliveryId), eq(c.claimVersion, input.claimVersion), eq(c.deliveryState, "claimed"));
+				const statements = [yield* statement(database.update(mapping.generation.table).set(updateValues(values)).where(condition))];
+				if (outcome._tag === "DefiniteFailure") {
+					const sc = seriesColumns(mapping);
+					statements.push(yield* statement(database.update(mapping.series.table).set(updateValues([[mapping.series.activeProofId, null]])).where(and(eq(sc.moduleId, input.moduleId), eq(sc.purpose, row[mapping.generation.purpose]), eq(sc.scopeKey, row[mapping.generation.seriesKey]), eq(sc.activeProofId, input.proofId), sql`exists(select 1 from ${mapping.generation.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${c.proofId} = ${sql.param(input.proofId, c.proofId)} and ${c.version} = ${sql.param(input.version, c.version)} and ${c.deliveryId} = ${sql.param(input.deliveryId, c.deliveryId)} and ${c.claimVersion} = ${sql.param(input.claimVersion, c.claimVersion)} and ${c.deliveryState} = 'failed' and ${c.state} = 'cancelled')`))));
+				}
+				return {
+					receipt,
+					statements
+				};
+			}));
+		}),
+		cancel: (input, prepare) => Effect.gen(function* () {
+			const database = yield* CurrentD1PlanningDatabase;
+			return yield* run(Effect.gen(function* () {
+				const journal = yield* CurrentCommitJournal;
+				const keys = mapping.scopeKeys({
+					moduleId: input.moduleId,
+					purpose: input.purpose,
+					binding: input.binding
+				});
+				const current = yield* authority(mapping, input.moduleId, input.purpose, input.binding);
+				const series = (yield* readSeries(mapping, input.moduleId, input.purpose, keys.series))[0];
+				const receipt = prepare(void 0, journal);
+				const active = series?.[mapping.series.activeProofId];
+				if (!current.current || active === null || active === void 0) return {
+					receipt,
+					statements: []
+				};
+				const generation = (yield* readGeneration(mapping, input.moduleId, active))[0];
+				const storedBinding = generation === void 0 ? void 0 : yield* mapping.generation.decodeBinding(generation);
+				if (storedBinding === void 0 || !sameBinding(storedBinding, input.binding)) return {
+					receipt,
+					statements: []
+				};
+				const gc = generationColumns(mapping);
+				const sc = seriesColumns(mapping);
+				const marker = `effect-auth-proof-guard:cancel:${active}`;
+				return {
+					receipt,
+					statements: [
+						yield* assertion(and(current.condition, sql`exists(select 1 from ${mapping.series.table} where ${sc.moduleId} = ${sql.param(input.moduleId, sc.moduleId)} and ${sc.purpose} = ${sql.param(input.purpose, sc.purpose)} and ${sc.scopeKey} = ${sql.param(keys.series, sc.scopeKey)} and ${sc.activeProofId} = ${sql.param(active, sc.activeProofId)})`, sql`exists(select 1 from ${mapping.generation.table} where ${gc.moduleId} = ${sql.param(input.moduleId, gc.moduleId)} and ${gc.proofId} = ${sql.param(active, gc.proofId)} and ${gc.state} = 'active')`), marker),
+						yield* statement(database.update(mapping.generation.table).set(updateValues([[mapping.generation.state, "cancelled"]])).where(and(eq(gc.moduleId, input.moduleId), eq(gc.proofId, active), eq(gc.state, "active")))),
+						yield* statement(database.update(mapping.series.table).set(updateValues([[mapping.series.activeProofId, null]])).where(and(eq(sc.moduleId, input.moduleId), eq(sc.purpose, input.purpose), eq(sc.scopeKey, keys.series), eq(sc.activeProofId, active))))
+					],
+					retryable: (cause) => isGuardFailure(cause, marker)
+				};
+			}));
+		}),
+		cleanup: (input, prepare) => Effect.gen(function* () {
+			const database = yield* CurrentD1PlanningDatabase;
+			return yield* run(Effect.gen(function* () {
+				const journal = yield* CurrentCommitJournal;
+				const now = yield* readEngineNowMillis(mapping);
+				const nativeNow = mapping.encodeInstant(now);
+				const gc = generationColumns(mapping);
+				const cc = continuationColumns(mapping);
+				const rc = requestColumns(mapping);
+				const ac = abuseColumns(mapping);
+				const fc = failureColumns(mapping);
+				const mc = commandColumns(mapping);
+				const sc = seriesColumns(mapping);
+				const rsc = scopeColumns(mapping);
+				let remaining = input.limit;
+				let hasMore = false;
+				const take = (effect) => effect.pipe(Effect.map((rows) => {
+					if (rows.length > remaining) hasMore = true;
+					const selected = rows.slice(0, remaining);
+					remaining -= selected.length;
+					return selected;
+				}));
+				const continuations = yield* take(database.select({ continuationId: cc.continuationId }).from(mapping.continuation.table).where(and(eq(cc.moduleId, input.moduleId), lte(cc.retentionUntil, nativeNow))).limit(remaining + 1));
+				const generations = yield* take(database.select({ proofId: gc.proofId }).from(mapping.generation.table).where(and(eq(gc.moduleId, input.moduleId), lte(gc.retentionUntil, nativeNow))).limit(remaining + 1));
+				const requests = yield* take(database.select({ requestId: rc.requestId }).from(mapping.request.table).where(and(eq(rc.moduleId, input.moduleId), lte(rc.retentionUntil, nativeNow))).limit(remaining + 1));
+				const abuse = yield* take(database.select({
+					action: ac.action,
+					scopeKind: ac.scopeKind,
+					scopeKey: ac.scopeKey,
+					commandId: ac.commandId
+				}).from(mapping.abuseEvent.table).where(and(eq(ac.moduleId, input.moduleId), lte(ac.retentionUntil, nativeNow))).limit(remaining + 1));
+				const failures = yield* take(database.select({
+					seriesKey: fc.seriesKey,
+					commandId: fc.commandId
+				}).from(mapping.failureEvent.table).where(and(eq(fc.moduleId, input.moduleId), lte(fc.retentionUntil, nativeNow))).limit(remaining + 1));
+				const commands = yield* take(database.select({ commandId: mc.commandId }).from(mapping.command.table).where(and(eq(mc.moduleId, input.moduleId), lte(mc.retentionUntil, nativeNow))).limit(remaining + 1));
+				const series = yield* take(database.select({
+					purpose: sc.purpose,
+					scopeKey: sc.scopeKey
+				}).from(mapping.series.table).where(and(eq(sc.moduleId, input.moduleId), isNull(sc.activeProofId), notExists(database.select({ one: sql`1` }).from(mapping.generation.table).where(and(eq(gc.moduleId, sc.moduleId), eq(gc.purpose, sc.purpose), eq(gc.seriesKey, sc.scopeKey)))), notExists(database.select({ one: sql`1` }).from(mapping.failureEvent.table).where(and(eq(fc.moduleId, sc.moduleId), eq(fc.purpose, sc.purpose), eq(fc.seriesKey, sc.scopeKey)))))).limit(remaining + 1));
+				const rateScopes = yield* take(database.select({
+					purpose: rsc.purpose,
+					action: rsc.action,
+					scopeKind: rsc.scopeKind,
+					scopeKey: rsc.scopeKey
+				}).from(mapping.rateScope.table).where(and(eq(rsc.moduleId, input.moduleId), notExists(database.select({ one: sql`1` }).from(mapping.abuseEvent.table).where(and(eq(ac.moduleId, rsc.moduleId), eq(ac.purpose, rsc.purpose), eq(ac.action, rsc.action), eq(ac.scopeKind, rsc.scopeKind), eq(ac.scopeKey, rsc.scopeKey)))))).limit(remaining + 1));
+				const marker = `effect-auth-proof-guard:cleanup:${input.moduleId}:${now}`;
+				const statements = [];
+				const guardedDelete = Effect.fn(function* (condition, query) {
+					statements.push(yield* assertion(condition, marker), yield* statement(query));
+				});
+				for (const row of continuations) {
+					const condition = and(eq(cc.moduleId, input.moduleId), eq(cc.continuationId, row.continuationId), lte(cc.retentionUntil, mapping.d1.engineNow));
+					yield* guardedDelete(sql`exists(select 1 from ${mapping.continuation.table} where ${condition})`, database.delete(mapping.continuation.table).where(condition));
+				}
+				for (const row of generations) {
+					const condition = and(eq(gc.moduleId, input.moduleId), eq(gc.proofId, row.proofId), lte(gc.retentionUntil, mapping.d1.engineNow));
+					yield* guardedDelete(sql`exists(select 1 from ${mapping.generation.table} where ${condition})`, database.update(mapping.series.table).set(updateValues([[mapping.series.activeProofId, null]])).where(and(eq(sc.moduleId, input.moduleId), eq(sc.activeProofId, row.proofId))));
+					statements.push(yield* statement(database.delete(mapping.generation.table).where(condition)));
+				}
+				for (const row of requests) {
+					const condition = and(eq(rc.moduleId, input.moduleId), eq(rc.requestId, row.requestId), lte(rc.retentionUntil, mapping.d1.engineNow));
+					yield* guardedDelete(sql`exists(select 1 from ${mapping.request.table} where ${condition})`, database.delete(mapping.request.table).where(condition));
+				}
+				for (const row of abuse) {
+					const condition = and(eq(ac.moduleId, input.moduleId), eq(ac.action, row.action), eq(ac.scopeKind, row.scopeKind), eq(ac.scopeKey, row.scopeKey), eq(ac.commandId, row.commandId), lte(ac.retentionUntil, mapping.d1.engineNow));
+					yield* guardedDelete(sql`exists(select 1 from ${mapping.abuseEvent.table} where ${condition})`, database.delete(mapping.abuseEvent.table).where(condition));
+				}
+				for (const row of failures) {
+					const condition = and(eq(fc.moduleId, input.moduleId), eq(fc.seriesKey, row.seriesKey), eq(fc.commandId, row.commandId), lte(fc.retentionUntil, mapping.d1.engineNow));
+					yield* guardedDelete(sql`exists(select 1 from ${mapping.failureEvent.table} where ${condition})`, database.delete(mapping.failureEvent.table).where(condition));
+				}
+				for (const row of commands) {
+					const condition = and(eq(mc.moduleId, input.moduleId), eq(mc.commandId, row.commandId), lte(mc.retentionUntil, mapping.d1.engineNow));
+					yield* guardedDelete(sql`exists(select 1 from ${mapping.command.table} where ${condition})`, database.delete(mapping.command.table).where(condition));
+				}
+				for (const row of series) {
+					const condition = and(eq(sc.moduleId, input.moduleId), eq(sc.purpose, row.purpose), eq(sc.scopeKey, row.scopeKey), isNull(sc.activeProofId), notExists(database.select({ one: sql`1` }).from(mapping.generation.table).where(and(eq(gc.moduleId, sc.moduleId), eq(gc.purpose, sc.purpose), eq(gc.seriesKey, sc.scopeKey)))));
+					yield* guardedDelete(sql`exists(select 1 from ${mapping.series.table} where ${condition})`, database.delete(mapping.series.table).where(condition));
+				}
+				for (const row of rateScopes) {
+					const condition = and(eq(rsc.moduleId, input.moduleId), eq(rsc.purpose, row.purpose), eq(rsc.action, row.action), eq(rsc.scopeKind, row.scopeKind), eq(rsc.scopeKey, row.scopeKey), notExists(database.select({ one: sql`1` }).from(mapping.abuseEvent.table).where(and(eq(ac.moduleId, rsc.moduleId), eq(ac.purpose, rsc.purpose), eq(ac.action, rsc.action), eq(ac.scopeKind, rsc.scopeKind), eq(ac.scopeKey, rsc.scopeKey)))));
+					yield* guardedDelete(sql`exists(select 1 from ${mapping.rateScope.table} where ${condition})`, database.delete(mapping.rateScope.table).where(condition));
+				}
+				hasMore ||= generations.length > 0 || failures.length > 0 || abuse.length > 0;
+				return {
+					receipt: prepare({
+						removed: input.limit - remaining,
+						hasMore
+					}, journal),
+					statements,
+					retryable: (cause) => isGuardFailure(cause, marker)
+				};
+			}));
+		})
+	};
+};
+const makeD1ProofPersistenceServices = (database, mapping) => Effect.gen(function* () {
+	const hooks = yield* LifecycleHooks;
+	const plans = makeProofPlans(mapping);
+	const run = (plan) => Effect.gen(function* () {
+		if (yield* hasCommitScope) return yield* unavailable();
+		return yield* executeStandalone(plan, 2);
+	}).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks));
+	return { proofPersistence: {
+		issue: (input, prepare) => run(plans.issue(input, prepare)).pipe(translateIssueFailure),
+		attempt: (input, prepare) => run(plans.attempt(input, prepare)).pipe(translateFailure),
+		complete: (input, prepare) => run(plans.complete(input, prepare)).pipe(translateFailure),
+		claimDelivery: (input, prepare) => run(plans.claimDelivery(input, prepare)).pipe(translateFailure),
+		settleDelivery: (input, prepare) => run(plans.settleDelivery(input, prepare)).pipe(translateFailure),
+		cancel: (input, prepare) => run(plans.cancel(input, prepare)).pipe(translateFailure),
+		cleanup: (input, prepare) => run(plans.cleanup(input, prepare)).pipe(translateFailure)
+	} };
+});
+/**
+* Owns one proof transition plus application statements in one D1 batch. It
+* never replays the owner effect. A reserved guard or named race becomes
+* ProofUnavailable so the caller can retry the entire command with fresh secrets.
+*/
+function coordinateD1ProofPersistence(acquire, options, body) {
+	return Effect.flatMap(acquire, (database) => Effect.gen(function* () {
+		const hooks = yield* LifecycleHooks;
+		if (yield* hasCommitScope) return yield* unavailable();
+		return (yield* coordinateCommit(() => Effect.gen(function* () {
+			const statements = [];
+			let mutation;
+			const nativeCollector = D1BatchStatements.of({ append: (statement) => Effect.sync(() => statements.push(statement)) });
+			const owner = yield* makeD1Owner(unavailable()).pipe(Effect.provideService(D1BatchStatements, nativeCollector));
+			const plans = makeProofPlans(options.mapping);
+			const run = (plan) => coordinateCommit(() => Effect.gen(function* () {
+				const journal = yield* CurrentCommitJournal;
+				const planned = yield* plan;
+				yield* owner.check;
+				if (mutation !== void 0) return yield* unavailable();
+				const guarded = {
+					...planned,
+					journalGuard: journal.prepare(void 0)
+				};
+				mutation = guarded;
+				statements.push(...guarded.statements);
+				return guarded.receipt;
+			}), { mode: "batch" }).pipe(Effect.map((result) => result.value), Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks));
+			const provided = Context.make(ProofPersistence, {
+				issue: (input, prepare) => owner.run(run(plans.issue(input, prepare)).pipe(translateIssueFailure)),
+				attempt: (input, prepare) => owner.run(run(plans.attempt(input, prepare)).pipe(translateFailure)),
+				complete: (input, prepare) => owner.run(run(plans.complete(input, prepare)).pipe(translateFailure)),
+				claimDelivery: (input, prepare) => owner.run(run(plans.claimDelivery(input, prepare)).pipe(translateFailure)),
+				settleDelivery: (input, prepare) => owner.run(run(plans.settleDelivery(input, prepare)).pipe(translateFailure)),
+				cancel: (input, prepare) => owner.run(run(plans.cancel(input, prepare)).pipe(translateFailure)),
+				cleanup: (input, prepare) => owner.run(run(plans.cleanup(input, prepare)).pipe(translateFailure))
+			}).pipe(Context.add(D1BatchStatements, owner.collector));
+			const value = yield* owner.close(Effect.provideContext(body, provided));
+			if (mutation?.journalGuard !== void 0) {
+				const status = yield* Effect.result(mutation.journalGuard.read);
+				if (status._tag === "Success" || status.failure._tag !== "CommitPending") return yield* unavailable();
+			}
+			yield* database.$client.batch(statements).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, (error) => everyFailureMatches(cause, mutation?.retryable) ? unavailable() : error))), translateFailure);
+			return value;
+		}), { mode: "batch" }).pipe(Effect.provideService(LifecycleHooks, hooks))).value;
+	}));
+}
+/** Private compiler seam for a future same-owner D1 password-reset batch. */
+const compileD1ProofCompletionPlan = Effect.fn("Drizzle.compileD1ProofCompletionPlan")(function* (mapping, plan, protectedMutation, project) {
+	const planned = yield* completionPlan(mapping, plan.input, (decision, activeJournal) => plan.prepare(decision, activeJournal, project));
+	if (planned.statements.length === 0) return planned;
+	const [freshGuard, ...completionStatements] = planned.statements;
+	const marker = `effect-auth-proof-guard:protected:${plan.input.continuationId}`;
+	return {
+		receipt: planned.receipt,
+		statements: [
+			freshGuard,
+			...protectedMutation.statements,
+			yield* assertion(protectedMutation.appliedCondition, marker),
+			...completionStatements
+		],
+		postconditions: [yield* assertion(protectedMutation.appliedCondition, marker), ...planned.postconditions ?? []]
+	};
+});
+const translateFailure = (effect) => reportPersistenceFailure(effect, (error) => Schema.is(ProofUnavailable)(error) || Schema.is(HookConfigurationError)(error)).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));
+const translateIssueFailure = (effect) => reportPersistenceFailure(effect, (error) => Schema.is(ProofUnavailable)(error) || Schema.is(ProofRequestConflict)(error) || Schema.is(HookConfigurationError)(error)).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, (error) => Schema.is(ProofRequestConflict)(error) ? error : unavailable()))));
+const executeStandalone = (plan, retries = 2) => Effect.suspend(() => {
+	let retryable;
+	return coordinateCommit(() => Effect.gen(function* () {
+		const database = yield* CurrentD1PlanningDatabase;
+		const planned = yield* plan;
+		retryable = planned.retryable;
+		yield* database.$client.batch(planned.statements);
+		return planned.receipt;
+	}), { mode: "batch" }).pipe(Effect.map((result) => result.value)).pipe(Effect.catchCause((cause) => retries > 0 && everyFailureMatches(cause, retryable) ? executeStandalone(plan, retries - 1) : Effect.failCause(cause)));
+});
+//#endregion
+export { checkD1ProofCompletion, compileD1ProofCompletionPlan, coordinateD1ProofPersistence, makeD1ProofPersistenceServices };
+
+//# sourceMappingURL=d1-proofs.mjs.map