@yielded/auth-persistence-drizzle 0.1.0-beta.24 → 0.1.0-beta.26

package/dist/drizzle/d1-passwords.mjs

@@ -1,808 +0,0 @@
-import { requiredPasswordConstraints, requiredPasswordRegistrationConstraints } from "./password-model.mjs";
-import { PersistenceMappingError as PersistenceMappingError$1, column, isMappedConstraintConflict, updateValues } from "./model.mjs";
-import { balancedD1And } from "./d1-generated-statement.mjs";
-import { validateDrizzleStorage } from "./storage-validation.mjs";
-import { Database } from "./d1-database.mjs";
-import { D1BatchStatements } from "./D1BatchStatements.mjs";
-import { CurrentD1PlanningDatabase, makeD1Owner } from "./d1-planning.mjs";
-import { nativeDatabase } from "./native-database.mjs";
-import { compileD1ProofCompletionPlan } from "./d1-proofs.mjs";
-import { NativeDatabase, requireStandalone, samePasswordCredentialSnapshot } from "@yielded/auth-persistence/Adapter";
-import { and, eq, getTableColumns, inArray, sql } from "drizzle-orm";
-import { Cause, Context, DateTime, Effect, Option, Predicate, Redacted, Schema } from "effect";
-import { CurrentCommitJournal, HookConfigurationError, LifecycleHooks, coordinateCommit, hasCommitScope } from "@yielded/auth/Hooks";
-import { AuthenticationEvidence, AuthenticationRequirement, snapshotAuthenticationEvidence } from "@yielded/auth/Sessions";
-import { reportPersistenceFailure } from "@yielded/auth/Persistence";
-import { ProofUnavailable } from "@yielded/auth/Proofs";
-import { EncodedPasswordHash, PasswordPersistence, PasswordUnavailable, snapshotPasswordCredential, snapshotPasswordRequirement, snapshotPasswordRevision } from "@yielded/auth/Password";
-//#region src/drizzle/d1-passwords.ts
-const unavailable = () => PasswordUnavailable.make({});
-const everyFailureMatches = (cause, classify) => classify !== void 0 && cause.reasons.length > 0 && cause.reasons.every((reason) => Cause.isFailReason(reason) && classify(Cause.fail(reason.error)));
-const validConstraints = (mapping) => Object.entries(requiredPasswordConstraints).every(([key, value]) => mapping.constraints[key] === value);
-const validRegistrationConstraints = (mapping) => Object.entries(requiredPasswordRegistrationConstraints).every(([key, value]) => mapping.constraints[key] === value);
-const containsFailure = (failure, predicate) => {
-	const seen = /* @__PURE__ */ new Set();
-	const pending = [failure];
-	for (let inspected = 0; inspected < 32 && pending.length > 0; inspected++) {
-		const current = pending.shift();
-		if (current === void 0 || current === null || seen.has(current)) continue;
-		seen.add(current);
-		if (predicate(current)) return true;
-		if (Cause.isCause(current)) {
-			for (const reason of current.reasons) if (Cause.isFailReason(reason)) pending.push(reason.error);
-			else if (Cause.isDieReason(reason)) pending.push(reason.defect);
-			continue;
-		}
-		if (typeof current !== "object") continue;
-		const wrapped = current;
-		if (wrapped.cause !== void 0) pending.push(wrapped.cause);
-		if (wrapped.reason !== void 0) pending.push(wrapped.reason);
-		if (wrapped.message !== void 0) pending.push(wrapped.message);
-	}
-	return false;
-};
-const isGuardFailure = (cause, marker) => {
-	const native = `bad JSON path: '${`$[${marker.replaceAll("'", "''")}]`}': SQLITE_ERROR`;
-	return containsFailure(cause, (value) => value === native || value === `D1_ERROR: ${native}`);
-};
-const statement = Effect.fn(function* (query) {
-	const database = yield* CurrentD1PlanningDatabase;
-	const rendered = query.toSQL();
-	return database.$client.unsafe(rendered.sql, rendered.params);
-});
-const assertion = Effect.fn(function* (condition, marker) {
-	const database = yield* CurrentD1PlanningDatabase;
-	return yield* statement(database.select({ ok: sql`case when ${condition} then 1 else json_extract('[]', ${`$[${marker}]`}) end`.as("ok") }).from(sql`(select 1)`));
-});
-const readEngineNowMillis = Effect.fn("Drizzle.readEngineNowMillis")(function* (mapping) {
-	return yield* (yield* CurrentD1PlanningDatabase).select({ value: mapping.d1.engineNowMillis.as("engine_now_millis") }).from(sql`(select 1)`).pipe(Effect.flatMap((rows) => {
-		const value = Number(rows[0]?.value);
-		return Number.isFinite(value) ? Effect.succeed(value) : Effect.fail(unavailable());
-	}));
-});
-const allocate = (asyncValue, syncValue) => asyncValue !== void 0 ? asyncValue : syncValue === void 0 ? Effect.fail(unavailable()) : Effect.try({
-	try: syncValue,
-	catch: (cause) => new PersistenceMappingError$1({
-		operation: "mapping",
-		cause
-	})
-});
-const allocateNextSecurityRevision = (mapping, current) => allocate(mapping.subject.nextSecurityRevision?.(current) ?? mapping.allocateRevision, mapping.subject.nextSecurityRevisionSync === void 0 ? mapping.allocateRevisionSync : () => mapping.subject.nextSecurityRevisionSync(current));
-const subjectColumns = (mapping) => ({
-	id: column(mapping.subject.table, mapping.subject.id),
-	status: column(mapping.subject.table, mapping.subject.status),
-	securityRevision: column(mapping.subject.table, mapping.subject.securityRevision)
-});
-const identifierColumns = (mapping) => ({
-	namespace: column(mapping.identifier.table, mapping.identifier.namespace),
-	value: column(mapping.identifier.table, mapping.identifier.value),
-	subjectId: column(mapping.identifier.table, mapping.identifier.subjectId),
-	verifiedAt: column(mapping.identifier.table, mapping.identifier.verifiedAt),
-	bindingRevision: column(mapping.identifier.table, mapping.identifier.bindingRevision)
-});
-const credentialColumns = (mapping) => ({
-	moduleId: column(mapping.credential.table, mapping.credential.moduleId),
-	subjectId: column(mapping.credential.table, mapping.credential.subjectId),
-	credentialId: column(mapping.credential.table, mapping.credential.credentialId),
-	credentialRevision: column(mapping.credential.table, mapping.credential.credentialRevision),
-	verifierVersion: column(mapping.credential.table, mapping.credential.verifierVersion),
-	verifier: column(mapping.credential.table, mapping.credential.verifier),
-	normalization: column(mapping.credential.table, mapping.credential.normalization)
-});
-const authorityColumns = (mapping) => ({
-	subjectId: column(mapping.authorityCredential.table, mapping.authorityCredential.subjectId),
-	credentialId: column(mapping.authorityCredential.table, mapping.authorityCredential.credentialId),
-	revision: column(mapping.authorityCredential.table, mapping.authorityCredential.revision),
-	status: mapping.authorityCredential.status === void 0 ? void 0 : column(mapping.authorityCredential.table, mapping.authorityCredential.status)
-});
-const commandColumns = (mapping) => ({
-	moduleId: column(mapping.command.table, mapping.command.moduleId),
-	commandId: column(mapping.command.table, mapping.command.commandId),
-	action: column(mapping.command.table, mapping.command.action),
-	bindingDigest: column(mapping.command.table, mapping.command.bindingDigest),
-	decision: column(mapping.command.table, mapping.command.decision),
-	retentionUntil: column(mapping.command.table, mapping.command.retentionUntil)
-});
-const readIdentifier = Effect.fn("Drizzle.readIdentifier")(function* (mapping, identifier) {
-	const database = yield* CurrentD1PlanningDatabase;
-	const c = identifierColumns(mapping);
-	return yield* database.select().from(mapping.identifier.table).where(and(eq(c.namespace, identifier.namespace), eq(c.value, identifier.value))).limit(1);
-});
-const readSubjectNative = Effect.fn("Drizzle.readSubjectNative")(function* (mapping, nativeSubjectId) {
-	return yield* (yield* CurrentD1PlanningDatabase).select().from(mapping.subject.table).where(eq(subjectColumns(mapping).id, nativeSubjectId)).limit(1);
-});
-const readCredentialNative = Effect.fn("Drizzle.readCredentialNative")(function* (mapping, moduleId, nativeSubjectId) {
-	const database = yield* CurrentD1PlanningDatabase;
-	const c = credentialColumns(mapping);
-	return yield* database.select().from(mapping.credential.table).where(and(eq(c.moduleId, moduleId), eq(c.subjectId, nativeSubjectId))).limit(1);
-});
-const resolveCredential = Effect.fn("DrizzleD1Password.resolveCredential")(function* (mapping, moduleId, identifier, requestedSubjectId) {
-	const identifierRow = (yield* readIdentifier(mapping, identifier))[0];
-	if (identifierRow === void 0 || !mapping.identifier.isCurrent(identifierRow)) return void 0;
-	const nativeSubjectId = identifierRow[mapping.identifier.subjectId];
-	const subject = (yield* readSubjectNative(mapping, nativeSubjectId))[0];
-	if (subject === void 0 || !mapping.subject.isActiveStatus(subject[mapping.subject.status])) return void 0;
-	const subjectId = yield* mapping.subjectId.toSubject(nativeSubjectId);
-	if (requestedSubjectId !== void 0 && subjectId !== requestedSubjectId) return void 0;
-	const credential = (yield* readCredentialNative(mapping, moduleId, nativeSubjectId))[0];
-	if (credential === void 0) return {
-		nativeSubjectId,
-		subject,
-		identifier: identifierRow
-	};
-	return {
-		nativeSubjectId,
-		subject,
-		identifier: identifierRow,
-		credential,
-		snapshot: yield* mapping.credential.decode({
-			moduleId,
-			subject,
-			identifier: identifierRow,
-			credential
-		}).pipe(Effect.flatMap(snapshotPasswordCredential))
-	};
-});
-const evidenceProofsJson = Schema.encodeSync(Schema.fromJsonString(AuthenticationEvidence.fields.proofs));
-const alternativesJson = Schema.encodeSync(Schema.fromJsonString(AuthenticationRequirement.fields.alternatives));
-const assuranceCondition = (mapping, evidence, requirement) => {
-	const proofs = evidenceProofsJson(evidence.proofs);
-	const fresh = sql`json_extract(proof.value, '$.verifiedAt') <= ${mapping.d1.engineNowMillis} and ${mapping.d1.engineNowMillis} - json_extract(proof.value, '$.verifiedAt') < ${requirement.maximumAgeMillis}`;
-	return sql`exists(
-    select 1 from json_each(${alternativesJson(requirement.alternatives)}) as alternative
-    where not exists(select 1 from json_each(${proofs}) as proof where json_extract(proof.value, '$.verifiedAt') > ${mapping.d1.engineNowMillis})
-    and not exists(select 1 from json_each(alternative.value, '$.factors') as factor where not exists(select 1 from json_each(${proofs}) as proof, json_each(proof.value, '$.factors') as held where ${fresh} and held.value = factor.value))
-    and (select count(distinct json_extract(proof.value, '$.credentialId')) from json_each(${proofs}) as proof where ${fresh}) >= json_extract(alternative.value, '$.minimumCredentials')
-    and exists(select 1 from json_each(${proofs}) as proof where ${fresh} and (json_extract(alternative.value, '$.userVerified') = 0 or json_extract(proof.value, '$.userVerified') = 1) and (json_extract(alternative.value, '$.phishingResistant') = 0 or json_extract(proof.value, '$.phishingResistant') = 1))
-  )`;
-};
-const sameIdentifier = (left, right) => left.namespace === right.namespace && left.value === right.value;
-const evidenceSatisfiedAt = (evidence, requirement, now) => {
-	if (evidence.proofs.length > 64 || evidence.revision.credentials.length > 64) return false;
-	const revisions = /* @__PURE__ */ new Map();
-	for (const revision of evidence.revision.credentials) {
-		if (revisions.has(revision.credentialId)) return false;
-		revisions.set(revision.credentialId, revision.revision);
-	}
-	if (evidence.proofs.some((proof) => !revisions.has(proof.credentialId))) return false;
-	if (evidence.proofs.some((proof) => now < DateTime.toEpochMillis(proof.verifiedAt))) return false;
-	const fresh = evidence.proofs.filter((proof) => now - DateTime.toEpochMillis(proof.verifiedAt) < requirement.maximumAgeMillis);
-	const factors = new Set(fresh.flatMap((proof) => proof.factors));
-	const credentials = new Set(fresh.map((proof) => proof.credentialId));
-	return requirement.alternatives.some((alternative) => alternative.factors.every((factor) => factors.has(factor)) && credentials.size >= alternative.minimumCredentials && fresh.some((proof) => (!alternative.userVerified || proof.userVerified) && (!alternative.phishingResistant || proof.phishingResistant)));
-};
-const snapshotMutationInput = Effect.fn("DrizzleD1Password.snapshotMutationInput")(function* (input) {
-	const expectedRevision = snapshotPasswordRevision(input.expectedRevision);
-	const evidence = yield* snapshotAuthenticationEvidence(input.authorization.evidence).pipe(Effect.mapError(unavailable));
-	const requirement = yield* snapshotPasswordRequirement(input.authorization.requirement);
-	const credential = input.credential === void 0 ? void 0 : yield* snapshotPasswordCredential(input.credential);
-	return Object.freeze({
-		...input,
-		expectedRevision,
-		replacement: Object.freeze({
-			verifier: Redacted.make(Redacted.value(input.replacement.verifier)),
-			normalization: input.replacement.normalization
-		}),
-		invalidation: Object.freeze({ ...input.invalidation }),
-		...credential === void 0 ? {} : { credential },
-		authorization: Object.freeze({
-			challenge: Object.freeze({
-				...input.authorization.challenge,
-				revision: snapshotPasswordRevision(input.authorization.challenge.revision)
-			}),
-			evidence,
-			requirement
-		})
-	});
-});
-const completionMatchesPassword = (input) => {
-	const completion = input.completion.input;
-	const binding = completion.binding;
-	if (completion.moduleId !== `${input.moduleId}/reset` || completion.purpose !== "password-reset" || binding._tag !== "Subject" || input.credential === void 0 || binding.revision.subjectId !== input.expectedRevision.subjectId || binding.revision.securityRevision !== input.expectedRevision.securityRevision || !sameIdentifier(binding.identifier, input.credential.identifier)) return false;
-	const expected = [...input.expectedRevision.credentials].sort((left, right) => left.credentialId.localeCompare(right.credentialId));
-	const actual = [...binding.revision.credentials].sort((left, right) => left.credentialId.localeCompare(right.credentialId));
-	return expected.length === actual.length && expected.every((item, index) => item.credentialId === actual[index].credentialId && item.revision === actual[index].revision);
-};
-const probeProofCompletion = Effect.fn("DrizzleD1.probeProofCompletion")(function* (mapping, input) {
-	const database = yield* CurrentD1PlanningDatabase;
-	const plan = {
-		input,
-		prepare: (decision, journal, project) => journal.prepare(project(decision))
-	};
-	const marker = `effect-auth-proof-guard:protected:${input.continuationId}`;
-	return yield* coordinateCommit(() => Effect.gen(function* () {
-		const compiled = yield* compileD1ProofCompletionPlan(mapping, plan, {
-			statements: [],
-			appliedCondition: sql`false`
-		}, () => false);
-		if (compiled.statements.length === 0) return false;
-		yield* database.$client.batch(compiled.statements);
-		return false;
-	}), { mode: "batch" }).pipe(Effect.as(false), Effect.catchCause((cause) => isGuardFailure(cause, marker) ? Effect.succeed(true) : Effect.failCause(cause)));
-});
-const identifierCurrentCondition = (mapping, input, nativeSubjectId, nativeVerifiedAt) => {
-	if (input.credential === void 0) return sql`true`;
-	const ic = identifierColumns(mapping), snapshot = input.credential;
-	return and(mapping.identifier.d1CurrentCondition({
-		identifier: snapshot.identifier,
-		nativeSubjectId
-	}), sql`exists(select 1 from ${mapping.identifier.table} where ${ic.namespace} = ${sql.param(snapshot.identifier.namespace, ic.namespace)} and ${ic.value} = ${sql.param(snapshot.identifier.value, ic.value)} and ${ic.subjectId} = ${sql.param(nativeSubjectId, ic.subjectId)} and ${ic.bindingRevision} = ${sql.param(snapshot.identifierBindingRevision, ic.bindingRevision)} and ${Predicate.isNullish(nativeVerifiedAt) ? sql`${ic.verifiedAt} is null` : sql`${ic.verifiedAt} = ${sql.param(nativeVerifiedAt, ic.verifiedAt)}`})`);
-};
-const readAuthority = Effect.fn("DrizzleD1Password.readAuthority")(function* (mapping, input, action) {
-	const database = yield* CurrentD1PlanningDatabase;
-	if (input.authorization.evidence.proofs.length > 64 || input.authorization.evidence.revision.credentials.length > 64) return void 0;
-	const revisionIds = new Set(input.authorization.evidence.revision.credentials.map((item) => item.credentialId));
-	if (revisionIds.size !== input.authorization.evidence.revision.credentials.length || input.authorization.evidence.proofs.some((proof) => !revisionIds.has(proof.credentialId))) return void 0;
-	const nativeSubjectId = yield* mapping.subjectId.toNative(input.expectedRevision.subjectId);
-	const subject = (yield* readSubjectNative(mapping, nativeSubjectId))[0];
-	if (subject === void 0 || !mapping.subject.isActiveStatus(subject[mapping.subject.status]) || subject[mapping.subject.securityRevision] !== input.expectedRevision.securityRevision || input.authorization.challenge.moduleId !== input.moduleId || input.authorization.challenge.action !== action || input.authorization.challenge.commandId !== input.commandId || input.authorization.challenge.revision.subjectId !== input.expectedRevision.subjectId || input.authorization.challenge.revision.securityRevision !== input.expectedRevision.securityRevision || input.authorization.evidence.revision.subjectId !== input.expectedRevision.subjectId || input.authorization.evidence.revision.securityRevision !== input.expectedRevision.securityRevision || input.authorization.evidence.flowId !== input.commandId || input.authorization.evidence.bindingDigest !== input.authorization.challenge.bindingDigest || action === "add-password" && (input.credential !== void 0 || input.authorization.challenge.targetCredentialId !== void 0) || input.expectedRevision.credentials.some((expected) => !input.authorization.evidence.revision.credentials.some((actual) => actual.credentialId === expected.credentialId && actual.revision === expected.revision))) return void 0;
-	let identifierCondition = sql`true`;
-	if (input.credential !== void 0) {
-		const identifier = (yield* readIdentifier(mapping, input.credential.identifier))[0];
-		if (identifier === void 0 || input.authorization.challenge.targetCredentialId !== input.credential.credentialId || !mapping.identifier.isCurrent(identifier) || !mapping.subjectId.equals(identifier[mapping.identifier.subjectId], nativeSubjectId) || identifier[mapping.identifier.bindingRevision] !== input.credential.identifierBindingRevision) return void 0;
-		const credential = (yield* readCredentialNative(mapping, input.moduleId, nativeSubjectId))[0];
-		if (credential === void 0) return void 0;
-		const snapshot = yield* mapping.credential.decode({
-			moduleId: input.moduleId,
-			subject,
-			identifier,
-			credential
-		});
-		if (!samePasswordCredentialSnapshot(snapshot, input.credential)) return void 0;
-		identifierCondition = identifierCurrentCondition(mapping, input, nativeSubjectId, identifier[mapping.identifier.verifiedAt]);
-		const ic = identifierColumns(mapping);
-		identifierCondition = and(identifierCondition, sql`exists(select 1 from ${mapping.identifier.table} where ${ic.namespace} = ${sql.param(input.credential.identifier.namespace, ic.namespace)} and ${ic.value} = ${sql.param(input.credential.identifier.value, ic.value)} and ${ic.subjectId} = ${sql.param(nativeSubjectId, ic.subjectId)} and ${ic.bindingRevision} = ${sql.param(input.credential.identifierBindingRevision, ic.bindingRevision)})`);
-	}
-	const expected = [...new Map([...input.expectedRevision.credentials, ...input.authorization.evidence.revision.credentials].map((item) => [item.credentialId, item])).values()].sort((left, right) => left.credentialId.localeCompare(right.credentialId));
-	const ac = authorityColumns(mapping);
-	const sortedRows = [...expected.length === 0 ? [] : yield* database.select().from(mapping.authorityCredential.table).where(and(eq(ac.subjectId, nativeSubjectId), inArray(ac.credentialId, expected.map((item) => item.credentialId))))].sort((left, right) => String(left[mapping.authorityCredential.credentialId]).localeCompare(String(right[mapping.authorityCredential.credentialId])));
-	if (sortedRows.length !== expected.length || sortedRows.some((row, index) => row[mapping.authorityCredential.credentialId] !== expected[index].credentialId || row[mapping.authorityCredential.revision] !== expected[index].revision || mapping.authorityCredential.status !== void 0 && mapping.authorityCredential.isActiveStatus?.(row[mapping.authorityCredential.status]) !== true)) return void 0;
-	const requirement = yield* mapping.subject.decodeActionRequirement(subject, action);
-	const engineNow = yield* readEngineNowMillis(mapping);
-	if (!evidenceSatisfiedAt(input.authorization.evidence, input.authorization.requirement, engineNow) || !evidenceSatisfiedAt(input.authorization.evidence, requirement, engineNow)) return void 0;
-	if (input.invalidation.existingSessions === "immediate" && mapping.sessionInvalidation !== "same-authority-immediate") return void 0;
-	const s = subjectColumns(mapping);
-	const credentialConditions = expected.map((item) => sql`exists(select 1 from ${mapping.authorityCredential.table} where ${ac.subjectId} = ${sql.param(nativeSubjectId, ac.subjectId)} and ${ac.credentialId} = ${sql.param(item.credentialId, ac.credentialId)} and ${ac.revision} = ${sql.param(item.revision, ac.revision)}${ac.status === void 0 ? sql`` : sql` and ${ac.status} = ${sql.param(mapping.authorityCredential.d1ActiveStatusValue, ac.status)}`})`);
-	return {
-		nativeSubjectId,
-		subject,
-		requirement,
-		identifierCondition,
-		condition: balancedD1And(sql`exists(select 1 from ${mapping.subject.table} where ${s.id} = ${sql.param(nativeSubjectId, s.id)} and ${s.status} = ${sql.param(mapping.subject.d1ActiveStatusValue, s.status)} and ${s.securityRevision} = ${sql.param(input.expectedRevision.securityRevision, s.securityRevision)})`, identifierCondition, ...credentialConditions, assuranceCondition(mapping, input.authorization.evidence, input.authorization.requirement), assuranceCondition(mapping, input.authorization.evidence, requirement))
-	};
-});
-const commandAbsentCondition = (mapping, moduleId, commandId) => {
-	const c = commandColumns(mapping);
-	return sql`not exists(select 1 from ${mapping.command.table} where ${c.moduleId} = ${sql.param(moduleId, c.moduleId)} and ${c.commandId} = ${sql.param(commandId, c.commandId)})`;
-};
-const credentialCurrentCondition = (mapping, input, nativeSubjectId) => {
-	const c = credentialColumns(mapping);
-	return input.credential === void 0 ? sql`false` : sql`exists(select 1 from ${mapping.credential.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(nativeSubjectId, c.subjectId)} and ${c.credentialId} = ${sql.param(input.credential.credentialId, c.credentialId)} and ${c.credentialRevision} = ${sql.param(input.credential.credentialRevision, c.credentialRevision)} and ${c.verifierVersion} = ${sql.param(input.credential.verifierVersion, c.verifierVersion)} and ${c.verifier} = ${sql.param(Redacted.value(input.credential.verifier), c.verifier)} and ${c.normalization} = ${sql.param(input.credential.normalization, c.normalization)})`;
-};
-const mutationStatements = Effect.fn(function* (mapping, input, nativeSubjectId, revisions, now) {
-	const database = yield* CurrentD1PlanningDatabase;
-	const c = credentialColumns(mapping);
-	const s = subjectColumns(mapping);
-	const ac = authorityColumns(mapping);
-	return [
-		yield* statement(database.update(mapping.credential.table).set(mapping.credential.encodeReplacement({
-			replacement: input.replacement,
-			credentialRevision: revisions.credentialRevision,
-			verifierVersion: revisions.verifierVersion
-		})).where(and(eq(c.moduleId, input.moduleId), eq(c.subjectId, nativeSubjectId), eq(c.credentialId, input.credential.credentialId), eq(c.credentialRevision, input.credential.credentialRevision), eq(c.verifierVersion, input.credential.verifierVersion), eq(c.verifier, Redacted.value(input.credential.verifier)), eq(c.normalization, input.credential.normalization)))),
-		yield* statement(database.update(mapping.subject.table).set(updateValues([[mapping.subject.securityRevision, revisions.nextSecurityRevision]])).where(and(eq(s.id, nativeSubjectId), eq(s.securityRevision, input.expectedRevision.securityRevision)))),
-		yield* statement(database.update(mapping.authorityCredential.table).set(mapping.authorityCredential.encodeRevision(revisions.credentialRevision)).where(and(eq(ac.subjectId, nativeSubjectId), eq(ac.credentialId, input.credential.credentialId), eq(ac.revision, input.credential.credentialRevision)))),
-		yield* statement(database.insert(mapping.command.table).values(mapping.command.encodeInsert({
-			moduleId: input.moduleId,
-			commandId: input.commandId,
-			action: input.authorization.challenge.action,
-			bindingDigest: input.authorization.challenge.bindingDigest,
-			decision: "changed",
-			retentionUntilMillis: now + mapping.commandRetentionMillis
-		})))
-	];
-});
-const replacementApplied = (mapping, input, nativeSubjectId, revisions, now, identifierCondition) => {
-	const c = credentialColumns(mapping);
-	const s = subjectColumns(mapping);
-	const ac = authorityColumns(mapping);
-	const mc = commandColumns(mapping);
-	return and(sql`exists(select 1 from ${mapping.credential.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(nativeSubjectId, c.subjectId)} and ${c.credentialId} = ${sql.param(input.credential.credentialId, c.credentialId)} and ${c.credentialRevision} = ${sql.param(revisions.credentialRevision, c.credentialRevision)} and ${c.verifierVersion} = ${sql.param(revisions.verifierVersion, c.verifierVersion)} and ${c.verifier} = ${sql.param(Redacted.value(input.replacement.verifier), c.verifier)} and ${c.normalization} = ${sql.param(input.replacement.normalization, c.normalization)})`, sql`exists(select 1 from ${mapping.subject.table} where ${s.id} = ${sql.param(nativeSubjectId, s.id)} and ${s.securityRevision} = ${sql.param(revisions.nextSecurityRevision, s.securityRevision)} and ${s.status} = ${sql.param(mapping.subject.d1ActiveStatusValue, s.status)})`, sql`exists(select 1 from ${mapping.authorityCredential.table} where ${ac.subjectId} = ${sql.param(nativeSubjectId, ac.subjectId)} and ${ac.credentialId} = ${sql.param(input.credential.credentialId, ac.credentialId)} and ${ac.revision} = ${sql.param(revisions.credentialRevision, ac.revision)}${ac.status === void 0 ? sql`` : sql` and ${ac.status} = ${sql.param(mapping.authorityCredential.d1ActiveStatusValue, ac.status)}`})`, sql`exists(select 1 from ${mapping.command.table} where ${mc.moduleId} = ${sql.param(input.moduleId, mc.moduleId)} and ${mc.commandId} = ${sql.param(input.commandId, mc.commandId)} and ${mc.bindingDigest} = ${sql.param(input.authorization.challenge.bindingDigest, mc.bindingDigest)} and ${mc.action} = ${sql.param(input.authorization.challenge.action, mc.action)} and ${mc.decision} = ${sql.param("changed", mc.decision)} and ${mc.retentionUntil} = ${sql.param(mapping.encodeInstant(now + mapping.commandRetentionMillis), mc.retentionUntil)})`, identifierCondition, sql`true`);
-};
-const compileAddMutation = Effect.fn("DrizzleD1Password.compileAddMutation")(function* (mapping, input, revisions) {
-	const database = yield* CurrentD1PlanningDatabase;
-	const { credentialId, credentialRevision, verifierVersion, nextSecurityRevision } = revisions;
-	const authority = yield* readAuthority(mapping, input, "add-password");
-	if (authority === void 0) return void 0;
-	const now = yield* readEngineNowMillis(mapping);
-	const c = credentialColumns(mapping);
-	const s = subjectColumns(mapping);
-	const ac = authorityColumns(mapping);
-	const mc = commandColumns(mapping);
-	const marker = `effect-auth-password-guard:add:${input.commandId}`;
-	const absent = sql`not exists(select 1 from ${mapping.credential.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(authority.nativeSubjectId, c.subjectId)})`;
-	const guard = and(authority.condition, absent, commandAbsentCondition(mapping, input.moduleId, input.commandId));
-	const appliedCondition = and(sql`exists(select 1 from ${mapping.credential.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(authority.nativeSubjectId, c.subjectId)} and ${c.credentialId} = ${sql.param(credentialId, c.credentialId)} and ${c.credentialRevision} = ${sql.param(credentialRevision, c.credentialRevision)} and ${c.verifierVersion} = ${sql.param(verifierVersion, c.verifierVersion)} and ${c.verifier} = ${sql.param(Redacted.value(input.replacement.verifier), c.verifier)} and ${c.normalization} = ${sql.param(input.replacement.normalization, c.normalization)})`, sql`exists(select 1 from ${mapping.authorityCredential.table} where ${ac.subjectId} = ${sql.param(authority.nativeSubjectId, ac.subjectId)} and ${ac.credentialId} = ${sql.param(credentialId, ac.credentialId)} and ${ac.revision} = ${sql.param(credentialRevision, ac.revision)}${ac.status === void 0 ? sql`` : sql` and ${ac.status} = ${sql.param(mapping.authorityCredential.d1ActiveStatusValue, ac.status)}`})`, sql`exists(select 1 from ${mapping.subject.table} where ${s.id} = ${sql.param(authority.nativeSubjectId, s.id)} and ${s.securityRevision} = ${sql.param(nextSecurityRevision, s.securityRevision)} and ${s.status} = ${sql.param(mapping.subject.d1ActiveStatusValue, s.status)})`, sql`exists(select 1 from ${mapping.command.table} where ${mc.moduleId} = ${sql.param(input.moduleId, mc.moduleId)} and ${mc.commandId} = ${sql.param(input.commandId, mc.commandId)} and ${mc.bindingDigest} = ${sql.param(input.authorization.challenge.bindingDigest, mc.bindingDigest)} and ${mc.action} = ${sql.param("add-password", mc.action)} and ${mc.decision} = ${sql.param("changed", mc.decision)} and ${mc.retentionUntil} = ${sql.param(mapping.encodeInstant(now + mapping.commandRetentionMillis), mc.retentionUntil)})`);
-	return {
-		statements: [
-			yield* assertion(guard, marker),
-			yield* statement(database.insert(mapping.credential.table).values(mapping.credential.encodeInsert({
-				moduleId: input.moduleId,
-				subjectId: authority.nativeSubjectId,
-				credentialId,
-				credentialRevision,
-				verifierVersion,
-				replacement: input.replacement
-			}))),
-			yield* statement(database.insert(mapping.authorityCredential.table).values(mapping.authorityCredential.encodeInsert({
-				subjectId: authority.nativeSubjectId,
-				credentialId,
-				revision: credentialRevision
-			}))),
-			yield* statement(database.update(mapping.subject.table).set(updateValues([[mapping.subject.securityRevision, nextSecurityRevision]])).where(and(eq(s.id, authority.nativeSubjectId), eq(s.securityRevision, input.expectedRevision.securityRevision)))),
-			yield* statement(database.insert(mapping.command.table).values(mapping.command.encodeInsert({
-				moduleId: input.moduleId,
-				commandId: input.commandId,
-				action: "add-password",
-				bindingDigest: input.authorization.challenge.bindingDigest,
-				decision: "changed",
-				retentionUntilMillis: now + mapping.commandRetentionMillis
-			}))),
-			yield* assertion(appliedCondition, marker)
-		],
-		appliedCondition,
-		marker,
-		retryable: (cause) => isGuardFailure(cause, marker)
-	};
-});
-const makePasswordPlans = (mapping, proofMapping) => {
-	const run = (plan) => Effect.gen(function* () {
-		if (!validConstraints(mapping)) return yield* unavailable();
-		return yield* plan;
-	});
-	return {
-		findCredential: (uncaptured) => Effect.gen(function* () {
-			if (!validConstraints(mapping)) return yield* unavailable();
-			const input = {
-				...uncaptured,
-				identifier: { ...uncaptured.identifier }
-			};
-			const database = yield* CurrentD1PlanningDatabase;
-			const identifierRow = (yield* readIdentifier(mapping, input.identifier))[0];
-			if (identifierRow === void 0 || !mapping.identifier.isCurrent(identifierRow)) return Option.none();
-			const nativeId = identifierRow[mapping.identifier.subjectId];
-			const sc = subjectColumns(mapping), ic = identifierColumns(mapping), cc = credentialColumns(mapping);
-			const rows = yield* database.select({
-				subject: getTableColumns(mapping.subject.table),
-				identifier: getTableColumns(mapping.identifier.table),
-				credential: getTableColumns(mapping.credential.table)
-			}).from(mapping.subject.table).innerJoin(mapping.identifier.table, and(eq(ic.namespace, input.identifier.namespace), eq(ic.value, input.identifier.value), eq(ic.subjectId, nativeId))).innerJoin(mapping.credential.table, and(eq(cc.moduleId, input.moduleId), eq(cc.subjectId, nativeId))).where(eq(sc.id, nativeId));
-			if (rows.length !== 1) return Option.none();
-			const row = rows[0];
-			if (!mapping.subject.isActiveStatus(row.subject[mapping.subject.status]) || !mapping.identifier.isCurrent(row.identifier) || !mapping.subjectId.equals(nativeId, row.subject[mapping.subject.id]) || !mapping.subjectId.equals(nativeId, row.identifier[mapping.identifier.subjectId]) || !mapping.subjectId.equals(nativeId, row.credential[mapping.credential.subjectId])) return Option.none();
-			const credential = yield* mapping.credential.decode({
-				moduleId: input.moduleId,
-				...row
-			}).pipe(Effect.flatMap(snapshotPasswordCredential));
-			return input.subjectId !== void 0 && credential.revision.subjectId !== input.subjectId ? Option.none() : Option.some(credential);
-		}),
-		rehashIfCurrent: (input) => run(Effect.gen(function* () {
-			const nextVerifier = Redacted.make(yield* Schema.decodeEffect(EncodedPasswordHash)(Redacted.value(input.nextVerifier)));
-			const credential = yield* snapshotPasswordCredential(input.credential);
-			const database = yield* CurrentD1PlanningDatabase;
-			const nativeId = yield* mapping.subjectId.toNative(credential.revision.subjectId);
-			const version = yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync);
-			if (version === credential.verifierVersion) return yield* unavailable();
-			const encoded = mapping.credential.encodeVerifier(nextVerifier, version);
-			const values = {
-				[mapping.credential.verifier]: encoded[mapping.credential.verifier],
-				[mapping.credential.verifierVersion]: encoded[mapping.credential.verifierVersion]
-			};
-			if (Object.values(values).some((value) => value === void 0)) return yield* unavailable();
-			const c = credentialColumns(mapping);
-			return {
-				receipt: void 0,
-				statements: [yield* statement(database.update(mapping.credential.table).set(values).where(and(eq(c.moduleId, credential.moduleId), eq(c.subjectId, nativeId), eq(c.credentialId, credential.credentialId), ...[
-					[c.moduleId, credential.moduleId],
-					[c.subjectId, nativeId],
-					[c.credentialId, credential.credentialId],
-					[c.credentialRevision, credential.credentialRevision],
-					[c.verifierVersion, credential.verifierVersion],
-					[c.verifier, Redacted.value(credential.verifier)],
-					[c.normalization, credential.normalization]
-				].map(([column, value]) => typeof value === "string" ? sql`cast(${column} as blob) = cast(${sql.param(value, column)} as blob)` : eq(column, value)))))]
-			};
-		})),
-		readForSubject: (input) => Effect.gen(function* () {
-			const database = yield* CurrentD1PlanningDatabase;
-			if (yield* hasCommitScope) return yield* unavailable();
-			const nativeSubjectId = yield* mapping.subjectId.toNative(input.subjectId);
-			const subject = (yield* readSubjectNative(mapping, nativeSubjectId))[0];
-			if (subject === void 0 || !mapping.subject.isActiveStatus(subject[mapping.subject.status])) return Option.none();
-			const credential = (yield* readCredentialNative(mapping, input.moduleId, nativeSubjectId))[0];
-			if (credential === void 0) return Option.none();
-			const ic = identifierColumns(mapping);
-			const identifier = (yield* database.select().from(mapping.identifier.table).where(eq(ic.subjectId, nativeSubjectId))).find((row) => mapping.identifier.isCurrent(row));
-			if (identifier === void 0) return Option.none();
-			return Option.some(yield* mapping.credential.decode({
-				moduleId: input.moduleId,
-				subject,
-				identifier,
-				credential
-			}).pipe(Effect.flatMap(snapshotPasswordCredential)));
-		}),
-		recoveryTarget: (input) => Effect.gen(function* () {
-			if (yield* hasCommitScope) return yield* unavailable();
-			const resolved = yield* resolveCredential(mapping, input.moduleId, input.identifier);
-			return resolved?.snapshot === void 0 || resolved.snapshot.identifierVerifiedAtMillis === void 0 ? Option.none() : Option.some(resolved.snapshot);
-		}),
-		addIfAbsent: (uncaptured, prepare) => Effect.gen(function* () {
-			const input = yield* snapshotMutationInput(uncaptured);
-			const credentialId = yield* allocate(mapping.allocateCredentialId, mapping.allocateCredentialIdSync);
-			const credentialRevision = yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync);
-			const verifierVersion = yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync);
-			const nextSecurityRevision = yield* allocateNextSecurityRevision(mapping, input.expectedRevision.securityRevision);
-			if (nextSecurityRevision === input.expectedRevision.securityRevision) return yield* unavailable();
-			return yield* run(Effect.gen(function* () {
-				const journal = yield* CurrentCommitJournal;
-				const compiled = yield* compileAddMutation(mapping, input, {
-					credentialId,
-					credentialRevision,
-					verifierVersion,
-					nextSecurityRevision
-				});
-				if (compiled === void 0) return {
-					receipt: prepare("rejected", journal),
-					statements: []
-				};
-				return {
-					receipt: prepare("changed", journal),
-					statements: compiled.statements,
-					postconditions: [yield* assertion(compiled.appliedCondition, compiled.marker)],
-					retryable: compiled.retryable
-				};
-			}));
-		}),
-		replaceIfCurrent: (uncaptured, prepare) => Effect.flatMap(snapshotMutationInput(uncaptured), (input) => replacementPlan(mapping, proofMapping, input, prepare, "change-password")),
-		checkReset: (input) => proofMapping === void 0 ? Effect.fail(unavailable()) : Effect.gen(function* () {
-			if (yield* hasCommitScope) return yield* unavailable();
-			if (input.moduleId.length <= 6 || !input.moduleId.endsWith("/reset") || input.purpose !== "password-reset" || input.binding._tag !== "Subject") return false;
-			const binding = input.binding;
-			const resolved = yield* resolveCredential(mapping, input.moduleId.slice(0, -6), binding.identifier, binding.revision.subjectId);
-			return resolved?.snapshot !== void 0 && resolved.snapshot.revision.securityRevision === binding.revision.securityRevision && binding.revision.credentials.every((item) => resolved.snapshot.revision.credentials.some((current) => current.credentialId === item.credentialId && current.revision === item.revision)) ? yield* probeProofCompletion(proofMapping, input) : false;
-		}),
-		resetWithProof: (uncaptured, prepare) => proofMapping === void 0 ? Effect.fail(unavailable()) : Effect.flatMap(snapshotMutationInput(uncaptured), (captured) => replacementPlan(mapping, proofMapping, Object.freeze({
-			...captured,
-			completion: uncaptured.completion
-		}), prepare, "reset-password"))
-	};
-};
-const compileReplacementMutation = Effect.fn("DrizzleD1Password.compileReplacementMutation")(function* (mapping, input, action, revisions) {
-	const { credentialRevision, verifierVersion, nextSecurityRevision } = revisions;
-	const authority = yield* readAuthority(mapping, input, action);
-	const current = authority === void 0 || input.credential === void 0 ? void 0 : (yield* readCredentialNative(mapping, input.moduleId, authority.nativeSubjectId))[0];
-	const currentMatches = current !== void 0 && current[mapping.credential.credentialId] === input.credential.credentialId && current[mapping.credential.credentialRevision] === input.credential.credentialRevision && current[mapping.credential.verifierVersion] === input.credential.verifierVersion && current[mapping.credential.verifier] === Redacted.value(input.credential.verifier) && current[mapping.credential.normalization] === input.credential.normalization;
-	if (authority === void 0 || !currentMatches) return void 0;
-	const now = yield* readEngineNowMillis(mapping);
-	const guard = and(authority.condition, credentialCurrentCondition(mapping, input, authority.nativeSubjectId), commandAbsentCondition(mapping, input.moduleId, input.commandId));
-	const marker = `effect-auth-password-guard:${action}:${input.commandId}`;
-	return {
-		protectedMutation: {
-			statements: [yield* assertion(guard, marker), ...yield* mutationStatements(mapping, input, authority.nativeSubjectId, {
-				credentialRevision,
-				verifierVersion,
-				nextSecurityRevision
-			}, now)],
-			appliedCondition: replacementApplied(mapping, input, authority.nativeSubjectId, {
-				credentialRevision,
-				verifierVersion,
-				nextSecurityRevision
-			}, now, authority.identifierCondition)
-		},
-		marker
-	};
-});
-const replacementPlan = Effect.fn("Drizzle.replacementPlan")(function* (mapping, proofMapping, input, prepare, action) {
-	const credentialRevision = yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync);
-	const verifierVersion = yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync);
-	const nextSecurityRevision = yield* allocateNextSecurityRevision(mapping, input.expectedRevision.securityRevision);
-	if (nextSecurityRevision === input.expectedRevision.securityRevision || input.credential !== void 0 && credentialRevision === input.credential.credentialRevision) return yield* unavailable();
-	const journal = yield* CurrentCommitJournal;
-	const compiledMutation = yield* compileReplacementMutation(mapping, input, action, {
-		credentialRevision,
-		verifierVersion,
-		nextSecurityRevision
-	});
-	if (compiledMutation === void 0) return {
-		receipt: prepare("rejected", journal),
-		statements: []
-	};
-	const { protectedMutation, marker } = compiledMutation;
-	if (action === "reset-password") {
-		if (proofMapping === void 0 || input.completion === void 0 || !completionMatchesPassword(input)) return {
-			receipt: prepare("rejected", journal),
-			statements: []
-		};
-		let passwordReceipt;
-		const compiled = yield* compileD1ProofCompletionPlan(proofMapping, input.completion, protectedMutation, (decision) => {
-			passwordReceipt = prepare(decision === "completed" ? "changed" : "rejected", journal);
-			return decision;
-		});
-		return {
-			receipt: passwordReceipt ?? prepare("rejected", journal),
-			statements: compiled.statements,
-			...compiled.postconditions === void 0 ? {} : { postconditions: compiled.postconditions },
-			retryable: (cause) => isGuardFailure(cause, marker) || isGuardFailure(cause, `effect-auth-proof-guard:complete:${input.completion.input.continuationId}`) || isGuardFailure(cause, `effect-auth-proof-guard:protected:${input.completion.input.continuationId}`)
-		};
-	}
-	const applied = yield* assertion(protectedMutation.appliedCondition, marker);
-	return {
-		receipt: prepare("changed", journal),
-		statements: [...protectedMutation.statements, applied],
-		postconditions: [applied],
-		retryable: (cause) => isGuardFailure(cause, marker)
-	};
-});
-const makeD1PasswordPersistenceServices = Effect.fnUntraced(function* (mapping, proofMapping) {
-	const database = yield* Database;
-	yield* validateDrizzleStorage({
-		...mapping,
-		proof: proofMapping
-	}).pipe(Effect.provideServiceEffect(NativeDatabase, nativeDatabase(Database)), Effect.mapError(unavailable));
-	const hooks = yield* LifecycleHooks;
-	const plans = makePasswordPlans(mapping, proofMapping);
-	const standalone = Effect.gen(function* () {
-		if (yield* hasCommitScope) return yield* unavailable();
-		yield* requireStandalone(unavailable, database.$client.transactionService);
-	});
-	const run = (plan) => Effect.gen(function* () {
-		yield* standalone;
-		return yield* executeStandalone(plan, 2);
-	}).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks));
-	return { passwordPersistence: {
-		findCredential: (input) => standalone.pipe(Effect.andThen(plans.findCredential(input)), Effect.provideService(CurrentD1PlanningDatabase, database), translateFailure),
-		rehashIfCurrent: (input) => run(plans.rehashIfCurrent(input)).pipe(translateFailure),
-		readForSubject: (input) => plans.readForSubject(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
-		recoveryTarget: (input) => plans.recoveryTarget(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
-		addIfAbsent: (input, prepare) => run(plans.addIfAbsent(input, prepare)).pipe(translateFailure),
-		replaceIfCurrent: (input, prepare) => run(plans.replaceIfCurrent(input, prepare)).pipe(translateFailure),
-		checkReset: (input) => plans.checkReset(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
-		resetWithProof: (input, prepare) => run(plans.resetWithProof(input, prepare)).pipe(translateFailure)
-	} };
-});
-/**
-* Owns one password transition plus application statements in one D1 batch.
-* The owner Effect is invoked once and is never replayed after an ambiguous or
-* guarded batch failure. Standalone adapter-owned commands may replan boundedly.
-*/
-function coordinateD1PasswordPersistence(acquire, options, body) {
-	return Effect.flatMap(nativeDatabase(acquire), (database) => Effect.gen(function* () {
-		yield* validateDrizzleStorage({
-			...options.mapping,
-			proof: options.proofMapping
-		}).pipe(Effect.mapError(unavailable));
-		const hooks = yield* LifecycleHooks;
-		if (yield* hasCommitScope) return yield* unavailable();
-		return (yield* coordinateCommit(() => Effect.gen(function* () {
-			const statements = [];
-			let mutation;
-			const nativeCollector = D1BatchStatements.of({ append: (statement) => Effect.sync(() => statements.push(statement)) });
-			const owner = yield* makeD1Owner(unavailable()).pipe(Effect.provideService(D1BatchStatements, nativeCollector));
-			const plans = makePasswordPlans(options.mapping, options.proofMapping);
-			const run = (plan) => coordinateCommit(() => Effect.gen(function* () {
-				const journal = yield* CurrentCommitJournal;
-				const planned = yield* plan;
-				yield* owner.check;
-				if (mutation !== void 0) return yield* unavailable();
-				const guarded = {
-					...planned,
-					journalGuard: journal.prepare(void 0)
-				};
-				mutation = guarded;
-				statements.push(...guarded.statements);
-				return guarded.receipt;
-			}), { mode: "batch" }).pipe(Effect.map((result) => result.value), Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks));
-			const provided = Context.make(PasswordPersistence, {
-				findCredential: (input) => owner.run(plans.findCredential(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), translateFailure)),
-				rehashIfCurrent: (input) => owner.run(run(plans.rehashIfCurrent(input)).pipe(translateFailure)),
-				readForSubject: (input) => owner.run(plans.readForSubject(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks), translateFailure)),
-				recoveryTarget: (input) => owner.run(plans.recoveryTarget(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks), translateFailure)),
-				addIfAbsent: (input, prepare) => owner.run(run(plans.addIfAbsent(input, prepare)).pipe(translateFailure)),
-				replaceIfCurrent: (input, prepare) => owner.run(run(plans.replaceIfCurrent(input, prepare)).pipe(translateFailure)),
-				checkReset: (input) => owner.run(plans.checkReset(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks), translateFailure)),
-				resetWithProof: (input, prepare) => owner.run(run(plans.resetWithProof(input, prepare)).pipe(translateFailure))
-			}).pipe(Context.add(D1BatchStatements, owner.collector));
-			const value = yield* owner.close(Effect.provideContext(body, provided));
-			if (mutation?.journalGuard !== void 0) {
-				const status = yield* Effect.result(mutation.journalGuard.read);
-				if (status._tag === "Success" || status.failure._tag !== "CommitPending") return yield* unavailable();
-			}
-			yield* database.$client.batch([...statements, ...mutation?.postconditions ?? []]).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, (error) => everyFailureMatches(cause, mutation?.retryable) ? unavailable() : error))), translateFailure);
-			return value;
-		}), { mode: "batch" }).pipe(Effect.provideService(LifecycleHooks, hooks))).value;
-	}).pipe(Effect.provideService(NativeDatabase, database)));
-}
-const registrationRows = Effect.fn("Drizzle.registrationRows")(function* (mapping, moduleId, requestId) {
-	const database = yield* CurrentD1PlanningDatabase;
-	const module = column(mapping.registration.table, mapping.registration.moduleId);
-	const request = column(mapping.registration.table, mapping.registration.requestId);
-	return yield* database.select().from(mapping.registration.table).where(and(eq(module, moduleId), eq(request, requestId))).limit(1);
-});
-const registrationIdentifierRows = Effect.fn("Drizzle.registrationIdentifierRows")(function* (mapping, identifier) {
-	const database = yield* CurrentD1PlanningDatabase;
-	const namespace = column(mapping.identifier.table, mapping.identifier.namespace);
-	const value = column(mapping.identifier.table, mapping.identifier.value);
-	return yield* database.select().from(mapping.identifier.table).where(and(eq(namespace, identifier.namespace), eq(value, identifier.value))).limit(1);
-});
-const planRegistration = Effect.fn("Drizzle.planRegistration")(function* (mapping, input, allocated, prepare) {
-	const database = yield* CurrentD1PlanningDatabase;
-	const journal = yield* CurrentCommitJournal;
-	const existing = (yield* registrationRows(mapping, input.moduleId, input.requestId))[0];
-	if (existing !== void 0) return {
-		receipt: prepare(yield* mapping.registration.decodeReplay(existing), journal),
-		statements: []
-	};
-	const intent = {
-		moduleId: input.moduleId,
-		requestId: input.requestId,
-		identifier: input.identifier,
-		registration: input.registration,
-		replacement: input.replacement
-	};
-	if (mapping.mode === "pending") {
-		if (allocated.recoveryReference === void 0) return yield* unavailable();
-		return {
-			receipt: prepare({
-				_tag: "Pending",
-				reference: allocated.recoveryReference
-			}, journal),
-			statements: [yield* statement(database.insert(mapping.registration.table).values(mapping.registration.encodeInsert(intent, {
-				state: "pending",
-				recoveryReference: allocated.recoveryReference
-			})))],
-			retryable: (cause) => isMappedConstraintConflict(mapping.isRequestConflict, cause)
-		};
-	}
-	if (mapping.provisioning.idMode === "generated" || allocated.nativeSubjectId === void 0) return yield* unavailable();
-	if ((yield* registrationIdentifierRows(mapping, input.identifier)).length > 0) return {
-		receipt: prepare({ _tag: "Suppressed" }, journal),
-		statements: []
-	};
-	const nativeSubjectId = allocated.nativeSubjectId;
-	return {
-		receipt: prepare({
-			_tag: "Created",
-			subjectId: yield* mapping.subjectId.toSubject(nativeSubjectId)
-		}, journal),
-		statements: [
-			yield* statement(database.insert(mapping.subject.table).values(mapping.provisioning.encodeSubjectInsert(intent, {
-				nativeSubjectId,
-				securityRevision: allocated.securityRevision
-			}))),
-			yield* statement(database.insert(mapping.identifier.table).values(mapping.identifier.encodeInitialInsert(input.identifier, nativeSubjectId, allocated.identifierRevision))),
-			yield* statement(database.insert(mapping.credential.table).values(mapping.credential.encodeInsert({
-				moduleId: input.moduleId,
-				subjectId: nativeSubjectId,
-				credentialId: allocated.credentialId,
-				credentialRevision: allocated.credentialRevision,
-				verifierVersion: allocated.verifierVersion,
-				replacement: input.replacement
-			}))),
-			yield* statement(database.insert(mapping.authorityCredential.table).values(mapping.authorityCredential.encodeInsert({
-				subjectId: nativeSubjectId,
-				credentialId: allocated.credentialId,
-				revision: allocated.credentialRevision
-			}))),
-			yield* statement(database.insert(mapping.registration.table).values(mapping.registration.encodeInsert(intent, {
-				state: "created",
-				nativeSubjectId
-			})))
-		],
-		retryable: (cause) => isMappedConstraintConflict(mapping.isRequestConflict, cause) || isMappedConstraintConflict(mapping.isIdentifierConflict, cause)
-	};
-});
-const allocateRegistration = (mapping) => Effect.gen(function* () {
-	const credentialId = yield* allocate(mapping.allocateCredentialId, mapping.allocateCredentialIdSync);
-	const securityRevision = yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync);
-	const identifierRevision = yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync);
-	const credentialRevision = yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync);
-	const verifierVersion = yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync);
-	const nativeSubjectId = mapping.mode !== "atomic" || mapping.provisioning.idMode === "generated" ? void 0 : yield* allocate(mapping.provisioning.allocateSubjectId, mapping.provisioning.allocateSubjectIdSync);
-	const recoveryReference = mapping.mode === "pending" ? yield* allocate(mapping.allocateRecoveryReference, mapping.allocateRecoveryReferenceSync) : void 0;
-	return {
-		credentialId,
-		securityRevision,
-		identifierRevision,
-		credentialRevision,
-		verifierVersion,
-		...nativeSubjectId === void 0 ? {} : { nativeSubjectId },
-		...recoveryReference === void 0 ? {} : { recoveryReference }
-	};
-});
-const makeRegistrationPlans = (mapping) => ({ register: (input, prepare) => Effect.gen(function* () {
-	if (!validRegistrationConstraints(mapping)) return yield* unavailable();
-	if (mapping.mode === "atomic" && mapping.provisioning.idMode === "generated") return yield* unavailable();
-	const allocated = yield* allocateRegistration(mapping);
-	return yield* planRegistration(mapping, input, allocated, prepare);
-}) });
-const makeD1PasswordRegistrationServices = Effect.fnUntraced(function* (mapping) {
-	const database = yield* Database;
-	yield* validateDrizzleStorage(mapping).pipe(Effect.provideServiceEffect(NativeDatabase, nativeDatabase(Database)), Effect.mapError(unavailable));
-	const hooks = yield* LifecycleHooks;
-	const plans = makeRegistrationPlans(mapping);
-	const run = (plan) => Effect.gen(function* () {
-		if (yield* hasCommitScope) return yield* unavailable();
-		return yield* executeStandalone(plan, 2);
-	}).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks));
-	return { registrationAuthority: { register: (input, prepare) => run(plans.register(input, prepare)).pipe(translateFailure) } };
-});
-function coordinateD1PasswordRegistration(acquire, options, body) {
-	return Effect.flatMap(nativeDatabase(acquire), (database) => Effect.gen(function* () {
-		yield* validateDrizzleStorage(options.mapping).pipe(Effect.mapError(unavailable));
-		const hooks = yield* LifecycleHooks;
-		if (yield* hasCommitScope) return yield* unavailable();
-		return (yield* coordinateCommit(() => Effect.gen(function* () {
-			const statements = [];
-			let mutation;
-			const nativeCollector = D1BatchStatements.of({ append: (statement) => Effect.sync(() => statements.push(statement)) });
-			const owner = yield* makeD1Owner(unavailable()).pipe(Effect.provideService(D1BatchStatements, nativeCollector));
-			const plans = makeRegistrationPlans(options.mapping);
-			const run = (plan) => coordinateCommit(() => Effect.gen(function* () {
-				const journal = yield* CurrentCommitJournal;
-				const planned = yield* plan;
-				yield* owner.check;
-				if (mutation !== void 0) return yield* unavailable();
-				const guarded = {
-					...planned,
-					journalGuard: journal.prepare(void 0)
-				};
-				mutation = guarded;
-				statements.push(...guarded.statements);
-				return guarded.receipt;
-			}), { mode: "batch" }).pipe(Effect.map((result) => result.value), Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks));
-			const provided = Context.make(options.target, { register: (input, prepare) => owner.run(run(plans.register(input, prepare)).pipe(translateFailure)) }).pipe(Context.add(D1BatchStatements, owner.collector));
-			const value = yield* owner.close(Effect.provideContext(body, provided));
-			if (mutation?.journalGuard !== void 0) {
-				const status = yield* Effect.result(mutation.journalGuard.read);
-				if (status._tag === "Success" || status.failure._tag !== "CommitPending") return yield* unavailable();
-			}
-			yield* database.$client.batch(statements).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, (error) => everyFailureMatches(cause, mutation?.retryable) ? unavailable() : error))), translateFailure);
-			return value;
-		}), { mode: "batch" }).pipe(Effect.provideService(LifecycleHooks, hooks))).value;
-	}).pipe(Effect.provideService(NativeDatabase, database)));
-}
-/** Private prepared compiler seam: it never replays a caller or prepared callback. */
-const passwordD1Kernel = {
-	statement,
-	assertion,
-	readEngineNowMillis,
-	allocate,
-	allocateNextSecurityRevision,
-	subjectColumns,
-	identifierColumns,
-	credentialColumns,
-	authorityColumns,
-	readAuthority,
-	assuranceCondition,
-	credentialCurrentCondition,
-	commandAbsentCondition,
-	compileAddMutation,
-	compileReplacementMutation,
-	completionMatchesPassword,
-	isGuardFailure
-};
-const translateFailure = (effect) => reportPersistenceFailure(effect, (error) => Schema.is(PasswordUnavailable)(error) || Schema.is(ProofUnavailable)(error) || Schema.is(HookConfigurationError)(error)).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));
-const executeStandalone = (plan, retries = 2) => Effect.suspend(() => {
-	let retryable;
-	return coordinateCommit(() => Effect.gen(function* () {
-		const database = yield* CurrentD1PlanningDatabase;
-		const planned = yield* plan;
-		retryable = planned.retryable;
-		yield* database.$client.batch(planned.statements);
-		return planned.receipt;
-	}), { mode: "batch" }).pipe(Effect.map((result) => result.value)).pipe(Effect.catchCause((cause) => retries > 0 && everyFailureMatches(cause, retryable) ? executeStandalone(plan, retries - 1) : Effect.failCause(cause)));
-});
-//#endregion
-export { coordinateD1PasswordPersistence, coordinateD1PasswordRegistration, makeD1PasswordPersistenceServices, makeD1PasswordRegistrationServices, passwordD1Kernel };
-
-//# sourceMappingURL=d1-passwords.mjs.map