@yielded/auth-persistence-drizzle 0.1.0-beta.24 → 0.1.0-beta.26

package/dist/drizzle/d1-proofs.mjs

@@ -1,842 +0,0 @@
-import { requiredProofConstraints } from "./proof-model.mjs";
-import { PersistenceMappingError as PersistenceMappingError$1, column, isMappedConstraintConflict, updateValues } from "./model.mjs";
-import { balancedD1And } from "./d1-generated-statement.mjs";
-import { validateDrizzleStorage } from "./storage-validation.mjs";
-import { Database } from "./d1-database.mjs";
-import { D1BatchStatements } from "./D1BatchStatements.mjs";
-import { CurrentD1PlanningDatabase, makeD1Owner } from "./d1-planning.mjs";
-import { nativeDatabase } from "./native-database.mjs";
-import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
-import { and, count, eq, gte, inArray, isNull, lte, notExists, or, sql } from "drizzle-orm";
-import { Cause, Context, Effect, Schema } from "effect";
-import { CurrentCommitJournal, HookConfigurationError, LifecycleHooks, coordinateCommit, hasCommitScope } from "@yielded/auth/Hooks";
-import { reportPersistenceFailure } from "@yielded/auth/Persistence";
-import { ProofBinding, ProofPersistence, ProofRequestConflict, ProofUnavailable } from "@yielded/auth/Proofs";
-//#region src/drizzle/d1-proofs.ts
-const unavailable = () => ProofUnavailable.make({});
-const everyFailureMatches = (cause, classify) => classify !== void 0 && cause.reasons.length > 0 && cause.reasons.every((reason) => Cause.isFailReason(reason) && classify(Cause.fail(reason.error)));
-const conflict = () => ProofRequestConflict.make({});
-const validConstraints = (mapping) => Object.entries(requiredProofConstraints).every(([key, value]) => mapping.constraints[key] === value);
-const canonicalBinding = Schema.encodeSync(Schema.fromJsonString(ProofBinding));
-const sameBinding = (left, right) => canonicalBinding(left) === canonicalBinding(right);
-const containsFailure = (failure, predicate) => {
-	const seen = /* @__PURE__ */ new Set();
-	const pending = [failure];
-	for (let inspected = 0; inspected < 32 && pending.length > 0; inspected++) {
-		const current = pending.shift();
-		if (current === void 0 || current === null || seen.has(current)) continue;
-		seen.add(current);
-		if (predicate(current)) return true;
-		if (Cause.isCause(current)) {
-			for (const reason of current.reasons) if (Cause.isFailReason(reason)) pending.push(reason.error);
-			else if (Cause.isDieReason(reason)) pending.push(reason.defect);
-			continue;
-		}
-		if (typeof current !== "object") continue;
-		const wrapped = current;
-		if (wrapped.cause !== void 0) pending.push(wrapped.cause);
-		if (wrapped.reason !== void 0) pending.push(wrapped.reason);
-		if (wrapped.message !== void 0) pending.push(wrapped.message);
-	}
-	return false;
-};
-const isGuardFailure = (cause, marker) => {
-	const nativeMessage = `bad JSON path: '${`$[${marker.replaceAll("'", "''")}]`}': SQLITE_ERROR`;
-	return containsFailure(cause, (value) => value === nativeMessage || value === `D1_ERROR: ${nativeMessage}`);
-};
-const statement = Effect.fn(function* (query) {
-	const database = yield* CurrentD1PlanningDatabase;
-	const rendered = query.toSQL();
-	return database.$client.unsafe(rendered.sql, rendered.params);
-});
-const readEngineNowMillis = Effect.fn("Drizzle.readEngineNowMillis")(function* (mapping) {
-	return yield* (yield* CurrentD1PlanningDatabase).select({ value: mapping.d1.engineNowMillis.as("engine_now_millis") }).from(sql`(select 1)`).pipe(Effect.flatMap((rows) => {
-		const value = Number(rows[0]?.value);
-		return Number.isFinite(value) ? Effect.succeed(value) : Effect.fail(unavailable());
-	}));
-});
-const driverValues = (values, entries) => ({
-	...values,
-	...Object.fromEntries(entries)
-});
-const assertion = Effect.fn(function* (condition, marker) {
-	const database = yield* CurrentD1PlanningDatabase;
-	return yield* statement(database.select({ ok: sql`case when ${condition} then 1 else json_extract('[]', ${`$[${marker}]`}) end`.as("ok") }).from(sql`(select 1)`));
-});
-const allocateVersion = (mapping) => mapping.allocateVersion !== void 0 ? mapping.allocateVersion : mapping.allocateVersionSync === void 0 ? Effect.fail(unavailable()) : Effect.try({
-	try: mapping.allocateVersionSync,
-	catch: (cause) => new PersistenceMappingError$1({
-		operation: "mapping",
-		cause
-	})
-});
-const requestColumns = (mapping) => ({
-	moduleId: column(mapping.request.table, mapping.request.moduleId),
-	requestId: column(mapping.request.table, mapping.request.requestId),
-	fingerprint: column(mapping.request.table, mapping.request.fingerprint),
-	proofId: column(mapping.request.table, mapping.request.proofId),
-	retentionUntil: column(mapping.request.table, mapping.request.retentionUntil)
-});
-const seriesColumns = (mapping) => ({
-	moduleId: column(mapping.series.table, mapping.series.moduleId),
-	purpose: column(mapping.series.table, mapping.series.purpose),
-	scopeKey: column(mapping.series.table, mapping.series.scopeKey),
-	activeProofId: column(mapping.series.table, mapping.series.activeProofId),
-	lastIssueAt: column(mapping.series.table, mapping.series.lastIssueAt),
-	version: column(mapping.series.table, mapping.series.version)
-});
-const generationColumns = (mapping) => ({
-	moduleId: column(mapping.generation.table, mapping.generation.moduleId),
-	purpose: column(mapping.generation.table, mapping.generation.purpose),
-	proofId: column(mapping.generation.table, mapping.generation.proofId),
-	seriesKey: column(mapping.generation.table, mapping.generation.seriesKey),
-	deliveryId: column(mapping.generation.table, mapping.generation.deliveryId),
-	verifierKeyId: column(mapping.generation.table, mapping.generation.verifierKeyId),
-	verifierDigest: column(mapping.generation.table, mapping.generation.verifierDigest),
-	expiresAt: column(mapping.generation.table, mapping.generation.expiresAt),
-	version: column(mapping.generation.table, mapping.generation.version),
-	state: column(mapping.generation.table, mapping.generation.state),
-	sendCount: column(mapping.generation.table, mapping.generation.sendCount),
-	deliveryState: column(mapping.generation.table, mapping.generation.deliveryState),
-	claimVersion: column(mapping.generation.table, mapping.generation.claimVersion),
-	claimDeadline: column(mapping.generation.table, mapping.generation.claimDeadline),
-	retryAt: column(mapping.generation.table, mapping.generation.retryAt),
-	deliveryRetryMillis: column(mapping.generation.table, mapping.generation.deliveryRetryMillis),
-	retentionUntil: column(mapping.generation.table, mapping.generation.retentionUntil)
-});
-const continuationColumns = (mapping) => ({
-	moduleId: column(mapping.continuation.table, mapping.continuation.moduleId),
-	continuationId: column(mapping.continuation.table, mapping.continuation.continuationId),
-	digest: column(mapping.continuation.table, mapping.continuation.digest),
-	consumed: column(mapping.continuation.table, mapping.continuation.consumed),
-	retentionUntil: column(mapping.continuation.table, mapping.continuation.retentionUntil)
-});
-const scopeColumns = (mapping) => ({
-	moduleId: column(mapping.rateScope.table, mapping.rateScope.moduleId),
-	purpose: column(mapping.rateScope.table, mapping.rateScope.purpose),
-	action: column(mapping.rateScope.table, mapping.rateScope.action),
-	scopeKind: column(mapping.rateScope.table, mapping.rateScope.scopeKind),
-	scopeKey: column(mapping.rateScope.table, mapping.rateScope.scopeKey)
-});
-const abuseColumns = (mapping) => ({
-	moduleId: column(mapping.abuseEvent.table, mapping.abuseEvent.moduleId),
-	purpose: column(mapping.abuseEvent.table, mapping.abuseEvent.purpose),
-	action: column(mapping.abuseEvent.table, mapping.abuseEvent.action),
-	scopeKind: column(mapping.abuseEvent.table, mapping.abuseEvent.scopeKind),
-	scopeKey: column(mapping.abuseEvent.table, mapping.abuseEvent.scopeKey),
-	commandId: column(mapping.abuseEvent.table, mapping.abuseEvent.commandId),
-	occurredAt: column(mapping.abuseEvent.table, mapping.abuseEvent.occurredAt),
-	retentionUntil: column(mapping.abuseEvent.table, mapping.abuseEvent.retentionUntil)
-});
-const failureColumns = (mapping) => ({
-	moduleId: column(mapping.failureEvent.table, mapping.failureEvent.moduleId),
-	purpose: column(mapping.failureEvent.table, mapping.failureEvent.purpose),
-	seriesKey: column(mapping.failureEvent.table, mapping.failureEvent.seriesKey),
-	commandId: column(mapping.failureEvent.table, mapping.failureEvent.commandId),
-	occurredAt: column(mapping.failureEvent.table, mapping.failureEvent.occurredAt),
-	retentionUntil: column(mapping.failureEvent.table, mapping.failureEvent.retentionUntil)
-});
-const commandColumns = (mapping) => ({
-	moduleId: column(mapping.command.table, mapping.command.moduleId),
-	commandId: column(mapping.command.table, mapping.command.commandId),
-	decision: column(mapping.command.table, mapping.command.decision),
-	retentionUntil: column(mapping.command.table, mapping.command.retentionUntil)
-});
-const scopeEntries = (keys, binding, action, policy) => {
-	const suffix = action === "issue" ? "Issues" : "Attempts";
-	const simple = action === "issue" ? "issues" : "attempts";
-	const entries = [{
-		kind: "action",
-		key: "*",
-		budget: policy.abuse[`action${suffix}`]
-	}, {
-		kind: "identifier",
-		key: keys.identifier,
-		budget: policy.abuse[simple]
-	}];
-	if (binding._tag !== "Identifier") entries.push({
-		kind: "subject",
-		key: keys.subject,
-		budget: policy.abuse[`subject${suffix}`]
-	});
-	return entries;
-};
-const scopeCondition = (mapping, moduleId, purpose, action, entry) => {
-	const c = abuseColumns(mapping);
-	return sql`(select count(*) from ${mapping.abuseEvent.table} where ${c.moduleId} = ${sql.param(moduleId, c.moduleId)} and ${c.purpose} = ${sql.param(purpose, c.purpose)} and ${c.action} = ${sql.param(action, c.action)} and ${c.scopeKind} = ${sql.param(entry.kind, c.scopeKind)} and ${c.scopeKey} = ${sql.param(entry.key, c.scopeKey)} and ${c.occurredAt} >= ${mapping.d1.engineInstantMinus(entry.budget.windowMillis)}) < ${entry.budget.limit}`;
-};
-const failureCondition = (mapping, moduleId, purpose, seriesKey, policy) => {
-	const c = failureColumns(mapping);
-	return sql`(select count(*) from ${mapping.failureEvent.table} where ${c.moduleId} = ${sql.param(moduleId, c.moduleId)} and ${c.purpose} = ${sql.param(purpose, c.purpose)} and ${c.seriesKey} = ${sql.param(seriesKey, c.seriesKey)} and ${c.occurredAt} >= ${mapping.d1.engineInstantMinus(policy.abuse.attempts.windowMillis)}) < ${policy.maximumFailedAttempts}`;
-};
-const readScopeAdmission = Effect.fn("DrizzleD1Proof.readScopeAdmission")(function* (mapping, moduleId, purpose, action, entries, now) {
-	const database = yield* CurrentD1PlanningDatabase;
-	const c = abuseColumns(mapping);
-	const admitted = [];
-	for (const entry of entries) {
-		const rows = yield* database.select({ total: count() }).from(mapping.abuseEvent.table).where(and(eq(c.moduleId, moduleId), eq(c.purpose, purpose), eq(c.action, action), eq(c.scopeKind, entry.kind), eq(c.scopeKey, entry.key), gte(c.occurredAt, mapping.encodeInstant(now - entry.budget.windowMillis))));
-		if (Number(rows[0]?.total ?? 0) < entry.budget.limit) admitted.push(entry);
-	}
-	return admitted;
-});
-const authority = Effect.fn("DrizzleD1Proof.authority")(function* (mapping, moduleId, purpose, binding) {
-	const database = yield* CurrentD1PlanningDatabase;
-	let nativeSubjectId;
-	let subjectCurrent = true;
-	const parts = [];
-	if (binding._tag !== "Identifier") {
-		if (mapping.authority.subject === void 0 || mapping.authority.credential === void 0 || mapping.authority.subjectId === void 0) return yield* unavailable();
-		nativeSubjectId = yield* mapping.authority.subjectId.toNative(binding.revision.subjectId);
-		const subject = mapping.authority.subject;
-		const id = column(subject.table, subject.id);
-		const status = column(subject.table, subject.status);
-		const revision = column(subject.table, subject.securityRevision);
-		const subjectRow = (yield* database.select().from(subject.table).where(eq(id, nativeSubjectId)).limit(1))[0];
-		subjectCurrent = subjectRow !== void 0 && subject.isActiveStatus(subjectRow[subject.status]) && subjectRow[subject.securityRevision] === binding.revision.securityRevision;
-		parts.push(sql`exists(select 1 from ${subject.table} where ${id} = ${sql.param(nativeSubjectId, id)} and ${status} = ${sql.param(subject.d1ActiveStatusValue, status)} and ${revision} = ${sql.param(binding.revision.securityRevision, revision)})`);
-	}
-	const identifier = mapping.authority.identifier;
-	const namespace = column(identifier.table, identifier.namespace);
-	const value = column(identifier.table, identifier.value);
-	const identifierRows = yield* database.select().from(identifier.table).where(and(eq(namespace, binding.identifier.namespace), eq(value, binding.identifier.value)));
-	const input = {
-		moduleId,
-		purpose,
-		binding,
-		...nativeSubjectId === void 0 ? {} : { nativeSubjectId }
-	};
-	const identifierCurrent = identifier.isCurrent(input, identifierRows);
-	parts.push(identifier.d1CurrentCondition(input));
-	let credentialsCurrent = true;
-	if (binding._tag !== "Identifier") {
-		const credential = mapping.authority.credential;
-		const owner = column(credential.table, credential.subjectId);
-		const id = column(credential.table, credential.credentialId);
-		const revision = column(credential.table, credential.revision);
-		const status = credential.status === void 0 ? void 0 : column(credential.table, credential.status);
-		const expected = [...binding.revision.credentials].sort((a, b) => a.credentialId.localeCompare(b.credentialId));
-		const actual = (expected.length === 0 ? [] : yield* database.select().from(credential.table).where(and(eq(owner, nativeSubjectId), inArray(id, expected.map((item) => item.credentialId))))).map((row) => ({
-			id: row[credential.credentialId],
-			revision: row[credential.revision],
-			active: credential.status === void 0 || credential.isActiveStatus?.(row[credential.status]) === true
-		})).sort((a, b) => String(a.id).localeCompare(String(b.id)));
-		credentialsCurrent = actual.length === expected.length && actual.every((row, index) => row.active && row.id === expected[index]?.credentialId && row.revision === expected[index]?.revision);
-		for (const expectedCredential of expected) parts.push(sql`exists(select 1 from ${credential.table} where ${owner} = ${sql.param(nativeSubjectId, owner)} and ${id} = ${sql.param(expectedCredential.credentialId, id)} and ${revision} = ${sql.param(expectedCredential.revision, revision)}${status === void 0 ? sql`` : sql` and ${status} = ${sql.param(credential.d1ActiveStatusValue, status)}`})`);
-	}
-	return {
-		current: subjectCurrent && identifierCurrent && credentialsCurrent,
-		condition: balancedD1And(...parts) ?? sql`1 = 1`
-	};
-});
-const anchorStatements = Effect.fn(function* (mapping, moduleId, purpose, action, entries, seriesKey, seriesVersion, includeSeries) {
-	const database = yield* CurrentD1PlanningDatabase;
-	return [...yield* Effect.forEach(entries, Effect.fn(function* (entry) {
-		return yield* statement(database.insert(mapping.rateScope.table).values(mapping.rateScope.encodeInsert({
-			moduleId,
-			purpose,
-			action,
-			scopeKind: entry.kind,
-			scopeKey: entry.key
-		})).onConflictDoNothing());
-	})), ...includeSeries ? [yield* statement(database.insert(mapping.series.table).values(mapping.series.encodeInsert({
-		moduleId,
-		purpose,
-		scopeKey: seriesKey,
-		version: seriesVersion
-	})).onConflictDoNothing())] : []];
-});
-const insertScopeStatements = Effect.fn(function* (mapping, moduleId, purpose, action, commandId, entries, now, retentionUntil, marker) {
-	const database = yield* CurrentD1PlanningDatabase;
-	return (yield* Effect.forEach(entries, Effect.fn(function* (entry) {
-		return [yield* assertion(scopeCondition(mapping, moduleId, purpose, action, entry), marker), yield* statement(database.insert(mapping.abuseEvent.table).values(driverValues(mapping.abuseEvent.encodeInsert({
-			moduleId,
-			purpose,
-			action,
-			scopeKind: entry.kind,
-			scopeKey: entry.key,
-			commandId,
-			occurredAtMillis: now,
-			retentionUntilMillis: retentionUntil
-		}), [[mapping.abuseEvent.occurredAt, mapping.d1.engineNow], [mapping.abuseEvent.retentionUntil, mapping.d1.engineInstantPlus(retentionUntil - now)]])))];
-	}))).flat();
-});
-const readSeries = Effect.fn("Drizzle.readSeries")(function* (mapping, moduleId, purpose, key) {
-	const database = yield* CurrentD1PlanningDatabase;
-	const c = seriesColumns(mapping);
-	return yield* database.select().from(mapping.series.table).where(and(eq(c.moduleId, moduleId), eq(c.purpose, purpose), eq(c.scopeKey, key))).limit(1);
-});
-const readGeneration = Effect.fn("Drizzle.readGeneration")(function* (mapping, moduleId, proofId) {
-	const database = yield* CurrentD1PlanningDatabase;
-	const c = generationColumns(mapping);
-	return yield* database.select().from(mapping.generation.table).where(and(eq(c.moduleId, moduleId), eq(c.proofId, proofId))).limit(1);
-});
-const commandInsert = Effect.fn(function* (mapping, moduleId, commandId, kind, decision, retentionUntil, nativeRetention) {
-	const database = yield* CurrentD1PlanningDatabase;
-	return yield* statement(database.insert(mapping.command.table).values(driverValues(mapping.command.encodeInsert({
-		moduleId,
-		commandId,
-		kind,
-		decision,
-		retentionUntilMillis: retentionUntil
-	}), nativeRetention === void 0 ? [] : [[mapping.command.retentionUntil, nativeRetention]])));
-});
-const issuePlan = Effect.fn("Drizzle.issuePlan")(function* (mapping, input, prepare) {
-	const database = yield* CurrentD1PlanningDatabase;
-	const journal = yield* CurrentCommitJournal;
-	const keys = mapping.scopeKeys({
-		moduleId: input.record.moduleId,
-		purpose: input.record.purpose,
-		binding: input.record.binding
-	});
-	const current = yield* authority(mapping, input.record.moduleId, input.record.purpose, input.record.binding);
-	const now = yield* readEngineNowMillis(mapping);
-	const retentionUntil = now + input.policy.requestRetentionMillis;
-	const rc = requestColumns(mapping);
-	const existingRequest = (yield* database.select().from(mapping.request.table).where(and(eq(rc.moduleId, input.record.moduleId), eq(rc.requestId, input.record.requestId))).limit(1))[0];
-	if (existingRequest !== void 0) {
-		if ((yield* mapping.decodeInstant(existingRequest[mapping.request.retentionUntil])) > now) {
-			if (existingRequest[mapping.request.fingerprint] !== input.record.fingerprint) return yield* conflict();
-			return {
-				receipt: prepare({
-					_tag: "Existing",
-					receipt: yield* mapping.request.decodeReceipt(existingRequest)
-				}, journal),
-				statements: []
-			};
-		}
-	}
-	const scopes = scopeEntries(keys, input.record.binding, "issue", input.policy);
-	const initiallyAdmitted = yield* readScopeAdmission(mapping, input.record.moduleId, input.record.purpose, "issue", scopes, now);
-	const actionOpen = initiallyAdmitted.some((entry) => entry.kind === "action");
-	const admitted = actionOpen ? initiallyAdmitted : [];
-	const existingSeries = actionOpen ? (yield* readSeries(mapping, input.record.moduleId, input.record.purpose, keys.series))[0] : void 0;
-	const seriesVersion = yield* allocateVersion(mapping);
-	const active = existingSeries?.[mapping.series.activeProofId];
-	const activeGeneration = active === null || active === void 0 ? void 0 : (yield* readGeneration(mapping, input.record.moduleId, active))[0];
-	if (active !== null && active !== void 0 && (activeGeneration === void 0 || activeGeneration[mapping.generation.purpose] !== input.record.purpose)) return yield* unavailable();
-	const matchesActiveBinding = activeGeneration !== void 0 && sameBinding(yield* mapping.generation.decodeBinding(activeGeneration), input.record.binding);
-	const replacesLiveProof = activeGeneration !== void 0 && activeGeneration[mapping.generation.state] === "active" && (yield* mapping.decodeInstant(activeGeneration[mapping.generation.expiresAt])) > now;
-	const lastIssue = existingSeries?.[mapping.series.lastIssueAt] === null || existingSeries?.[mapping.series.lastIssueAt] === void 0 ? void 0 : yield* mapping.decodeInstant(existingSeries[mapping.series.lastIssueAt]);
-	const allowed = current.current && input.eligible && admitted.length === scopes.length && input.record.issuedAtMillis <= now && input.record.expiresAtMillis > now && (!replacesLiveProof || matchesActiveBinding) && (input.supersedes === void 0 || input.supersedes === active) && (lastIssue === void 0 || now - lastIssue >= input.policy.abuse.resendCooldownMillis);
-	const receipt = {
-		requestId: input.record.requestId,
-		reference: {
-			proofId: input.record.proofId,
-			purpose: input.record.purpose,
-			keyId: input.record.verifier.keyId
-		}
-	};
-	const prepared = prepare(allowed ? {
-		_tag: "Issued",
-		record: input.record
-	} : {
-		_tag: "Suppressed",
-		receipt
-	}, journal);
-	const statements = [];
-	const marker = `effect-auth-proof-guard:issue:${input.record.requestId}`;
-	if (existingRequest !== void 0) statements.push(yield* statement(database.delete(mapping.request.table).where(and(eq(rc.moduleId, input.record.moduleId), eq(rc.requestId, input.record.requestId), lte(rc.retentionUntil, mapping.d1.engineNow)))));
-	statements.push(yield* statement(database.insert(mapping.request.table).values(driverValues(mapping.request.encodeInsert({
-		record: input.record,
-		createdAtMillis: now,
-		retentionUntilMillis: retentionUntil
-	}), [[mapping.request.createdAt, mapping.d1.engineNow], [mapping.request.retentionUntil, mapping.d1.engineInstantPlus(input.policy.requestRetentionMillis)]]))), ...yield* anchorStatements(mapping, input.record.moduleId, input.record.purpose, "issue", actionOpen ? scopes : scopes.slice(0, 1), keys.series, seriesVersion, actionOpen), ...yield* insertScopeStatements(mapping, input.record.moduleId, input.record.purpose, "issue", input.record.requestId, allowed ? scopes : [], now, retentionUntil, marker));
-	if (allowed) {
-		const sc = seriesColumns(mapping);
-		const gc = generationColumns(mapping);
-		const replacementCondition = activeGeneration === void 0 ? sql`1 = 1` : sql`exists(select 1 from ${mapping.generation.table} where ${and(eq(gc.moduleId, input.record.moduleId), eq(gc.proofId, activeGeneration[mapping.generation.proofId]), eq(gc.version, activeGeneration[mapping.generation.version]), eq(column(mapping.generation.table, mapping.generation.binding), activeGeneration[mapping.generation.binding]), matchesActiveBinding ? sql`1 = 1` : sql`(${gc.state} <> 'active' or ${gc.expiresAt} <= ${mapping.d1.engineNow})`)})`;
-		const seriesCondition = and(eq(sc.moduleId, input.record.moduleId), eq(sc.purpose, input.record.purpose), eq(sc.scopeKey, keys.series), active === null || active === void 0 ? or(eq(sc.activeProofId, null), sql`${sc.activeProofId} is null`) : eq(sc.activeProofId, active), lastIssue === void 0 ? sql`1 = 1` : lte(sc.lastIssueAt, mapping.d1.engineInstantMinus(input.policy.abuse.resendCooldownMillis)));
-		statements.push(yield* assertion(and(current.condition, replacementCondition, sql`${mapping.d1.engineNowMillis} >= ${input.record.issuedAtMillis}`, sql`${mapping.d1.engineNow} < ${sql.param(mapping.encodeInstant(input.record.expiresAtMillis), generationColumns(mapping).expiresAt)}`, sql`exists(select 1 from ${mapping.series.table} where ${seriesCondition})`), marker));
-		if (active !== null && active !== void 0) statements.push(yield* statement(database.update(mapping.generation.table).set(updateValues([[mapping.generation.state, "superseded"]])).where(and(eq(generationColumns(mapping).moduleId, input.record.moduleId), eq(generationColumns(mapping).proofId, active), eq(generationColumns(mapping).state, "active")))));
-		statements.push(yield* statement(database.insert(mapping.generation.table).values(driverValues(mapping.generation.encodeInsert({
-			record: input.record,
-			seriesKey: keys.series,
-			retentionUntilMillis: retentionUntil,
-			state: "active",
-			deliveryState: "new",
-			policy: input.policy
-		}), [[mapping.generation.retentionUntil, mapping.d1.engineInstantPlus(input.policy.requestRetentionMillis)]]))), yield* statement(database.update(mapping.series.table).set(updateValues([
-			[mapping.series.activeProofId, input.record.proofId],
-			[mapping.series.lastIssueAt, mapping.d1.engineNow],
-			[mapping.series.version, seriesVersion]
-		])).where(and(eq(sc.moduleId, input.record.moduleId), eq(sc.purpose, input.record.purpose), eq(sc.scopeKey, keys.series)))));
-	}
-	return {
-		receipt: prepared,
-		statements,
-		retryable: (cause) => isMappedConstraintConflict(mapping.isRequestConflict, cause) || isMappedConstraintConflict(mapping.isSeriesConflict, cause) || isGuardFailure(cause, marker)
-	};
-});
-const attemptPlan = Effect.fn("Drizzle.attemptPlan")(function* (mapping, input, prepare) {
-	const database = yield* CurrentD1PlanningDatabase;
-	const journal = yield* CurrentCommitJournal;
-	const keys = mapping.scopeKeys({
-		moduleId: input.moduleId,
-		purpose: input.purpose,
-		binding: input.binding
-	});
-	const current = yield* authority(mapping, input.moduleId, input.purpose, input.binding);
-	const command = commandColumns(mapping);
-	const existingCommand = (yield* database.select().from(mapping.command.table).where(and(eq(command.moduleId, input.moduleId), eq(command.commandId, input.continuationId))).limit(1))[0];
-	if (existingCommand !== void 0) {
-		if (existingCommand[mapping.command.decision] === "rejected") return {
-			receipt: prepare({ _tag: "Rejected" }, journal),
-			statements: []
-		};
-		return yield* unavailable();
-	}
-	const now = yield* readEngineNowMillis(mapping);
-	const scopes = scopeEntries(keys, input.binding, "attempt", input.policy);
-	const initiallyAdmitted = yield* readScopeAdmission(mapping, input.moduleId, input.purpose, "attempt", scopes, now);
-	const actionOpen = initiallyAdmitted.some((entry) => entry.kind === "action");
-	const admitted = actionOpen ? initiallyAdmitted : [];
-	const series = actionOpen ? (yield* readSeries(mapping, input.moduleId, input.purpose, keys.series))[0] : void 0;
-	const generation = (yield* readGeneration(mapping, input.moduleId, input.proofId))[0];
-	const fc = failureColumns(mapping);
-	const failureRows = yield* database.select({ total: count() }).from(mapping.failureEvent.table).where(and(eq(fc.moduleId, input.moduleId), eq(fc.purpose, input.purpose), eq(fc.seriesKey, keys.series), gte(fc.occurredAt, mapping.encodeInstant(now - input.policy.abuse.attempts.windowMillis))));
-	const failures = Number(failureRows[0]?.total ?? 0);
-	const storedBinding = generation === void 0 ? void 0 : yield* mapping.generation.decodeBinding(generation);
-	const expires = generation === void 0 ? void 0 : yield* mapping.decodeInstant(generation[mapping.generation.expiresAt]);
-	const currentGeneration = generation !== void 0 && generation[mapping.generation.purpose] === input.purpose && generation[mapping.generation.state] === "active" && series?.[mapping.series.activeProofId] === input.proofId && storedBinding !== void 0 && sameBinding(storedBinding, input.binding) && expires !== void 0 && expires > now;
-	const candidateMatches = generation !== void 0 && input.candidate !== void 0 && generation[mapping.generation.verifierKeyId] === input.candidate.keyId && generation[mapping.generation.verifierDigest] === input.candidate.digest;
-	const accepted = current.current && currentGeneration && candidateMatches && admitted.length === scopes.length && failures < input.policy.maximumFailedAttempts;
-	const retentionUntil = now + input.policy.requestRetentionMillis;
-	const seriesVersion = yield* allocateVersion(mapping);
-	const statements = [...yield* anchorStatements(mapping, input.moduleId, input.purpose, "attempt", actionOpen ? scopes : scopes.slice(0, 1), keys.series, seriesVersion, actionOpen), ...yield* insertScopeStatements(mapping, input.moduleId, input.purpose, "attempt", input.continuationId, admitted, now, retentionUntil, `effect-auth-proof-guard:attempt:${input.continuationId}`)];
-	const marker = `effect-auth-proof-guard:attempt:${input.continuationId}`;
-	if (!accepted) {
-		const prepared = prepare({ _tag: "Rejected" }, journal);
-		if (admitted.length === scopes.length && current.current && currentGeneration && !candidateMatches && failures < input.policy.maximumFailedAttempts) {
-			const gc = generationColumns(mapping);
-			const sc = seriesColumns(mapping);
-			statements.push(yield* assertion(and(current.condition, sql`exists(select 1 from ${mapping.series.table} where ${sc.moduleId} = ${sql.param(input.moduleId, sc.moduleId)} and ${sc.purpose} = ${sql.param(input.purpose, sc.purpose)} and ${sc.scopeKey} = ${sql.param(keys.series, sc.scopeKey)} and ${sc.activeProofId} = ${sql.param(input.proofId, sc.activeProofId)})`, sql`exists(select 1 from ${mapping.generation.table} where ${gc.moduleId} = ${sql.param(input.moduleId, gc.moduleId)} and ${gc.proofId} = ${sql.param(input.proofId, gc.proofId)} and ${gc.state} = 'active' and ${gc.expiresAt} > ${mapping.d1.engineNow})`, failureCondition(mapping, input.moduleId, input.purpose, keys.series, input.policy)), marker), yield* statement(database.insert(mapping.failureEvent.table).values(driverValues(mapping.failureEvent.encodeInsert({
-				moduleId: input.moduleId,
-				purpose: input.purpose,
-				seriesKey: keys.series,
-				commandId: input.continuationId,
-				occurredAtMillis: now,
-				retentionUntilMillis: retentionUntil
-			}), [[mapping.failureEvent.occurredAt, mapping.d1.engineNow], [mapping.failureEvent.retentionUntil, mapping.d1.engineInstantPlus(input.policy.requestRetentionMillis)]]))));
-		}
-		statements.push(yield* commandInsert(mapping, input.moduleId, input.continuationId, "attempt", "rejected", retentionUntil, mapping.d1.engineInstantPlus(input.policy.requestRetentionMillis)));
-		return {
-			receipt: prepared,
-			statements,
-			retryable: (cause) => isMappedConstraintConflict(mapping.isCommandConflict, cause) || isMappedConstraintConflict(mapping.isSeriesConflict, cause) || isGuardFailure(cause, marker)
-		};
-	}
-	const version = yield* allocateVersion(mapping);
-	const continuationExpires = Math.min(expires, now + input.policy.continuationLifetimeMillis);
-	const continuation = {
-		moduleId: input.moduleId,
-		purpose: input.purpose,
-		continuationId: input.continuationId,
-		digest: input.continuationDigest,
-		proofId: input.proofId,
-		seriesKey: keys.series,
-		binding: input.binding,
-		expiresAtMillis: continuationExpires,
-		version
-	};
-	const prepared = prepare({
-		_tag: "Accepted",
-		continuation: {
-			continuationId: input.continuationId,
-			purpose: input.purpose,
-			expiresAtMillis: continuationExpires
-		}
-	}, journal);
-	const gc = generationColumns(mapping);
-	const sc = seriesColumns(mapping);
-	statements.push(yield* assertion(and(current.condition, failureCondition(mapping, input.moduleId, input.purpose, keys.series, input.policy), sql`exists(select 1 from ${mapping.series.table} where ${sc.moduleId} = ${sql.param(input.moduleId, sc.moduleId)} and ${sc.purpose} = ${sql.param(input.purpose, sc.purpose)} and ${sc.scopeKey} = ${sql.param(keys.series, sc.scopeKey)} and ${sc.activeProofId} = ${sql.param(input.proofId, sc.activeProofId)})`, sql`exists(select 1 from ${mapping.generation.table} where ${gc.moduleId} = ${sql.param(input.moduleId, gc.moduleId)} and ${gc.proofId} = ${sql.param(input.proofId, gc.proofId)} and ${gc.purpose} = ${sql.param(input.purpose, gc.purpose)} and ${gc.state} = 'active' and ${gc.verifierKeyId} = ${sql.param(input.candidate.keyId, gc.verifierKeyId)} and ${gc.verifierDigest} = ${sql.param(input.candidate.digest, gc.verifierDigest)} and ${gc.expiresAt} > ${mapping.d1.engineNow})`), marker), yield* commandInsert(mapping, input.moduleId, input.continuationId, "attempt", "accepted", retentionUntil, mapping.d1.engineInstantPlus(input.policy.requestRetentionMillis)), yield* statement(database.update(mapping.generation.table).set(updateValues([[mapping.generation.state, "consumed"]])).where(and(eq(gc.moduleId, input.moduleId), eq(gc.proofId, input.proofId), eq(gc.state, "active")))), yield* statement(database.insert(mapping.continuation.table).values(driverValues(mapping.continuation.encodeInsert({
-		...continuation,
-		retentionUntilMillis: retentionUntil
-	}), [[mapping.continuation.retentionUntil, mapping.d1.engineInstantPlus(input.policy.requestRetentionMillis)]]))));
-	return {
-		receipt: prepared,
-		statements,
-		retryable: (cause) => isMappedConstraintConflict(mapping.isCommandConflict, cause) || isMappedConstraintConflict(mapping.isSeriesConflict, cause) || isGuardFailure(cause, marker)
-	};
-});
-const inspectD1Completion = Effect.fn("DrizzleD1Proof.inspectCompletion")(function* (mapping, input) {
-	const database = yield* CurrentD1PlanningDatabase;
-	const keys = mapping.scopeKeys({
-		moduleId: input.moduleId,
-		purpose: input.purpose,
-		binding: input.binding
-	});
-	const current = yield* authority(mapping, input.moduleId, input.purpose, input.binding);
-	const c = continuationColumns(mapping);
-	const row = (yield* database.select().from(mapping.continuation.table).where(and(eq(c.moduleId, input.moduleId), eq(c.continuationId, input.continuationId))).limit(1))[0];
-	const now = yield* readEngineNowMillis(mapping);
-	const record = row === void 0 ? void 0 : yield* mapping.continuation.decode(row);
-	const accepted = current.current && record !== void 0 && record.moduleId === input.moduleId && record.continuationId === input.continuationId && record.purpose === input.purpose && record.digest === input.continuationDigest && record.seriesKey === keys.series && sameBinding(record.binding, input.binding) && row[mapping.continuation.consumed] === false && record.expiresAtMillis > now;
-	const immutable = [
-		mapping.continuation.moduleId,
-		mapping.continuation.purpose,
-		mapping.continuation.continuationId,
-		mapping.continuation.digest,
-		mapping.continuation.proofId,
-		mapping.continuation.seriesKey,
-		mapping.continuation.binding,
-		mapping.continuation.expiresAt,
-		mapping.continuation.version,
-		mapping.continuation.retentionUntil
-	];
-	const exact = row === void 0 ? sql`false` : and(...immutable.map((key) => eq(column(mapping.continuation.table, key), row[key])));
-	return {
-		accepted,
-		record,
-		row,
-		columns: c,
-		condition: and(current.condition, sql`exists(select 1 from ${mapping.continuation.table} where ${exact} and ${c.consumed} = ${sql.param(false, c.consumed)} and ${column(mapping.continuation.table, mapping.continuation.expiresAt)} > ${mapping.d1.engineNow})`),
-		appliedCondition: row === void 0 ? sql`false` : sql`exists(select 1 from ${mapping.continuation.table} where ${exact} and ${c.consumed} = ${sql.param(true, c.consumed)} and ${column(mapping.continuation.table, mapping.continuation.expiresAt)} > ${mapping.d1.engineNow})`
-	};
-});
-/** Read-only preflight plus its exact final-engine-time batch predicate. */
-const checkD1ProofCompletion = Effect.fn("Drizzle.checkD1ProofCompletion")(function* (mapping, input) {
-	return yield* inspectD1Completion(mapping, input);
-});
-const completionPlan = Effect.fn("Drizzle.completionPlan")(function* (mapping, input, prepare) {
-	const database = yield* CurrentD1PlanningDatabase;
-	const journal = yield* CurrentCommitJournal;
-	const inspected = yield* inspectD1Completion(mapping, input);
-	const { accepted, record, columns: c } = inspected;
-	const receipt = prepare(accepted ? "completed" : "rejected", journal);
-	if (!accepted) return {
-		receipt,
-		statements: []
-	};
-	const postconditions = [yield* assertion(and(inspected.appliedCondition, sql`exists(select 1 from ${mapping.command.table} where ${column(mapping.command.table, mapping.command.moduleId)} = ${sql.param(input.moduleId, column(mapping.command.table, mapping.command.moduleId))} and ${column(mapping.command.table, mapping.command.commandId)} = ${sql.param(input.continuationDigest, column(mapping.command.table, mapping.command.commandId))} and ${column(mapping.command.table, mapping.command.kind)} = ${sql.param("complete", column(mapping.command.table, mapping.command.kind))} and ${column(mapping.command.table, mapping.command.decision)} = ${sql.param("completed", column(mapping.command.table, mapping.command.decision))} and ${column(mapping.command.table, mapping.command.retentionUntil)} = ${sql.param(mapping.encodeInstant(record.expiresAtMillis), column(mapping.command.table, mapping.command.retentionUntil))})`), `effect-auth-proof-guard:complete:${input.continuationId}`)];
-	return {
-		receipt,
-		statements: [
-			yield* assertion(inspected.condition, `effect-auth-proof-guard:complete:${input.continuationId}`),
-			yield* statement(database.update(mapping.continuation.table).set(updateValues([[mapping.continuation.consumed, true]])).where(and(eq(c.moduleId, input.moduleId), eq(c.continuationId, input.continuationId), eq(c.digest, input.continuationDigest), eq(c.consumed, false)))),
-			yield* commandInsert(mapping, input.moduleId, input.continuationDigest, "complete", "completed", record.expiresAtMillis),
-			...postconditions
-		],
-		postconditions,
-		retryable: (cause) => isMappedConstraintConflict(mapping.isCommandConflict, cause) || isGuardFailure(cause, `effect-auth-proof-guard:complete:${input.continuationId}`)
-	};
-});
-const makeProofPlans = (mapping) => {
-	const run = (plan) => Effect.gen(function* () {
-		if (!validConstraints(mapping)) return yield* unavailable();
-		return yield* plan;
-	});
-	return {
-		issue: (input, prepare) => run(Effect.gen(function* () {
-			return yield* issuePlan(mapping, input, prepare);
-		})),
-		attempt: (input, prepare) => run(Effect.gen(function* () {
-			return yield* attemptPlan(mapping, input, prepare);
-		})),
-		complete: (input, prepare) => run(Effect.gen(function* () {
-			return yield* completionPlan(mapping, input, prepare);
-		})),
-		claimDelivery: (input, prepare) => Effect.gen(function* () {
-			const database = yield* CurrentD1PlanningDatabase;
-			return yield* run(Effect.gen(function* () {
-				const journal = yield* CurrentCommitJournal;
-				const row = (yield* readGeneration(mapping, input.moduleId, input.proofId))[0];
-				const now = yield* readEngineNowMillis(mapping);
-				const c = generationColumns(mapping);
-				if (row === void 0) return {
-					receipt: prepare({ _tag: "Declined" }, journal),
-					statements: []
-				};
-				const expires = yield* mapping.decodeInstant(row[mapping.generation.expiresAt]);
-				const claimDeadline = row[mapping.generation.claimDeadline] === null || row[mapping.generation.claimDeadline] === void 0 ? void 0 : yield* mapping.decodeInstant(row[mapping.generation.claimDeadline]);
-				const retryAt = row[mapping.generation.retryAt] === null || row[mapping.generation.retryAt] === void 0 ? void 0 : yield* mapping.decodeInstant(row[mapping.generation.retryAt]);
-				const state = row[mapping.generation.deliveryState];
-				const expiredClaim = state === "claimed" && claimDeadline !== void 0 && claimDeadline <= now;
-				const effectiveState = expiredClaim ? "ambiguous" : state;
-				if (!(row[mapping.generation.version] === input.version && row[mapping.generation.deliveryId] === input.deliveryId && row[mapping.generation.state] === "active" && expires > now && Number(row[mapping.generation.sendCount]) < input.policy.maximumDeliveryAttempts && (effectiveState === "new" || effectiveState === "ambiguous" && input.allowAmbiguousRetry && (retryAt === void 0 || retryAt <= now)))) {
-					const statements = expiredClaim ? [yield* statement(database.update(mapping.generation.table).set(updateValues([[mapping.generation.deliveryState, "ambiguous"]])).where(and(eq(c.moduleId, input.moduleId), eq(c.proofId, input.proofId), eq(c.deliveryState, "claimed"), lte(c.claimDeadline, mapping.d1.engineNow))))] : [];
-					return {
-						receipt: prepare({ _tag: "Declined" }, journal),
-						statements
-					};
-				}
-				const claimVersion = yield* allocateVersion(mapping);
-				const decision = {
-					_tag: "Claimed",
-					claimVersion
-				};
-				const condition = and(eq(c.moduleId, input.moduleId), eq(c.proofId, input.proofId), eq(c.version, input.version), eq(c.deliveryId, input.deliveryId), eq(c.state, "active"), sql`${c.expiresAt} > ${mapping.d1.engineNow}`, sql`${c.sendCount} < ${input.policy.maximumDeliveryAttempts}`, effectiveState === "new" ? eq(c.deliveryState, "new") : and(eq(c.deliveryState, "ambiguous"), or(sql`${c.retryAt} is null`, lte(c.retryAt, mapping.d1.engineNow))));
-				return {
-					receipt: prepare(decision, journal),
-					statements: [yield* assertion(sql`exists(select 1 from ${mapping.generation.table} where ${condition})`, `effect-auth-proof-guard:claim:${input.proofId}`), yield* statement(database.update(mapping.generation.table).set(updateValues([
-						[mapping.generation.sendCount, Number(row[mapping.generation.sendCount]) + 1],
-						[mapping.generation.deliveryState, "claimed"],
-						[mapping.generation.claimVersion, claimVersion],
-						[mapping.generation.claimDeadline, mapping.d1.engineInstantPlus(input.policy.deliveryClaimMillis)],
-						[mapping.generation.retryAt, mapping.d1.engineInstantPlus(input.policy.deliveryRetryMillis)]
-					])).where(condition))],
-					retryable: (cause) => isGuardFailure(cause, `effect-auth-proof-guard:claim:${input.proofId}`)
-				};
-			}));
-		}),
-		settleDelivery: (input, prepare) => Effect.gen(function* () {
-			const database = yield* CurrentD1PlanningDatabase;
-			return yield* run(Effect.gen(function* () {
-				const journal = yield* CurrentCommitJournal;
-				const row = (yield* readGeneration(mapping, input.moduleId, input.proofId))[0];
-				const receipt = prepare(void 0, journal);
-				if (row === void 0 || row[mapping.generation.version] !== input.version || row[mapping.generation.deliveryId] !== input.deliveryId || row[mapping.generation.claimVersion] !== input.claimVersion || row[mapping.generation.deliveryState] !== "claimed") return {
-					receipt,
-					statements: []
-				};
-				const c = generationColumns(mapping);
-				const outcome = input.outcome;
-				const state = outcome._tag === "Accepted" ? "accepted" : outcome._tag === "DefiniteFailure" ? "failed" : "ambiguous";
-				const values = [[mapping.generation.deliveryState, state], [mapping.generation.claimDeadline, null]];
-				if (outcome._tag === "Ambiguous") values.push([mapping.generation.retryAt, mapping.d1.engineInstantPlus(Number(row[mapping.generation.deliveryRetryMillis]))]);
-				if (outcome._tag === "DefiniteFailure") values.push([mapping.generation.state, "cancelled"]);
-				const condition = and(eq(c.moduleId, input.moduleId), eq(c.proofId, input.proofId), eq(c.version, input.version), eq(c.deliveryId, input.deliveryId), eq(c.claimVersion, input.claimVersion), eq(c.deliveryState, "claimed"));
-				const statements = [yield* statement(database.update(mapping.generation.table).set(updateValues(values)).where(condition))];
-				if (outcome._tag === "DefiniteFailure") {
-					const sc = seriesColumns(mapping);
-					statements.push(yield* statement(database.update(mapping.series.table).set(updateValues([[mapping.series.activeProofId, null]])).where(and(eq(sc.moduleId, input.moduleId), eq(sc.purpose, row[mapping.generation.purpose]), eq(sc.scopeKey, row[mapping.generation.seriesKey]), eq(sc.activeProofId, input.proofId), sql`exists(select 1 from ${mapping.generation.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${c.proofId} = ${sql.param(input.proofId, c.proofId)} and ${c.version} = ${sql.param(input.version, c.version)} and ${c.deliveryId} = ${sql.param(input.deliveryId, c.deliveryId)} and ${c.claimVersion} = ${sql.param(input.claimVersion, c.claimVersion)} and ${c.deliveryState} = 'failed' and ${c.state} = 'cancelled')`))));
-				}
-				return {
-					receipt,
-					statements
-				};
-			}));
-		}),
-		cancel: (input, prepare) => Effect.gen(function* () {
-			const database = yield* CurrentD1PlanningDatabase;
-			return yield* run(Effect.gen(function* () {
-				const journal = yield* CurrentCommitJournal;
-				const keys = mapping.scopeKeys({
-					moduleId: input.moduleId,
-					purpose: input.purpose,
-					binding: input.binding
-				});
-				const current = yield* authority(mapping, input.moduleId, input.purpose, input.binding);
-				const series = (yield* readSeries(mapping, input.moduleId, input.purpose, keys.series))[0];
-				const receipt = prepare(void 0, journal);
-				const active = series?.[mapping.series.activeProofId];
-				if (!current.current || active === null || active === void 0) return {
-					receipt,
-					statements: []
-				};
-				const generation = (yield* readGeneration(mapping, input.moduleId, active))[0];
-				const storedBinding = generation === void 0 ? void 0 : yield* mapping.generation.decodeBinding(generation);
-				if (storedBinding === void 0 || !sameBinding(storedBinding, input.binding)) return {
-					receipt,
-					statements: []
-				};
-				const gc = generationColumns(mapping);
-				const sc = seriesColumns(mapping);
-				const marker = `effect-auth-proof-guard:cancel:${active}`;
-				return {
-					receipt,
-					statements: [
-						yield* assertion(and(current.condition, sql`exists(select 1 from ${mapping.series.table} where ${sc.moduleId} = ${sql.param(input.moduleId, sc.moduleId)} and ${sc.purpose} = ${sql.param(input.purpose, sc.purpose)} and ${sc.scopeKey} = ${sql.param(keys.series, sc.scopeKey)} and ${sc.activeProofId} = ${sql.param(active, sc.activeProofId)})`, sql`exists(select 1 from ${mapping.generation.table} where ${gc.moduleId} = ${sql.param(input.moduleId, gc.moduleId)} and ${gc.proofId} = ${sql.param(active, gc.proofId)} and ${gc.state} = 'active')`), marker),
-						yield* statement(database.update(mapping.generation.table).set(updateValues([[mapping.generation.state, "cancelled"]])).where(and(eq(gc.moduleId, input.moduleId), eq(gc.proofId, active), eq(gc.state, "active")))),
-						yield* statement(database.update(mapping.series.table).set(updateValues([[mapping.series.activeProofId, null]])).where(and(eq(sc.moduleId, input.moduleId), eq(sc.purpose, input.purpose), eq(sc.scopeKey, keys.series), eq(sc.activeProofId, active))))
-					],
-					retryable: (cause) => isGuardFailure(cause, marker)
-				};
-			}));
-		}),
-		cleanup: (input, prepare) => Effect.gen(function* () {
-			const database = yield* CurrentD1PlanningDatabase;
-			return yield* run(Effect.gen(function* () {
-				const journal = yield* CurrentCommitJournal;
-				const now = yield* readEngineNowMillis(mapping);
-				const nativeNow = mapping.encodeInstant(now);
-				const gc = generationColumns(mapping);
-				const cc = continuationColumns(mapping);
-				const rc = requestColumns(mapping);
-				const ac = abuseColumns(mapping);
-				const fc = failureColumns(mapping);
-				const mc = commandColumns(mapping);
-				const sc = seriesColumns(mapping);
-				const rsc = scopeColumns(mapping);
-				let remaining = input.limit;
-				let hasMore = false;
-				const take = (effect) => effect.pipe(Effect.map((rows) => {
-					if (rows.length > remaining) hasMore = true;
-					const selected = rows.slice(0, remaining);
-					remaining -= selected.length;
-					return selected;
-				}));
-				const continuations = yield* take(database.select({ continuationId: cc.continuationId }).from(mapping.continuation.table).where(and(eq(cc.moduleId, input.moduleId), lte(cc.retentionUntil, nativeNow))).limit(remaining + 1));
-				const generations = yield* take(database.select({ proofId: gc.proofId }).from(mapping.generation.table).where(and(eq(gc.moduleId, input.moduleId), lte(gc.retentionUntil, nativeNow))).limit(remaining + 1));
-				const requests = yield* take(database.select({ requestId: rc.requestId }).from(mapping.request.table).where(and(eq(rc.moduleId, input.moduleId), lte(rc.retentionUntil, nativeNow))).limit(remaining + 1));
-				const abuse = yield* take(database.select({
-					action: ac.action,
-					scopeKind: ac.scopeKind,
-					scopeKey: ac.scopeKey,
-					commandId: ac.commandId
-				}).from(mapping.abuseEvent.table).where(and(eq(ac.moduleId, input.moduleId), lte(ac.retentionUntil, nativeNow))).limit(remaining + 1));
-				const failures = yield* take(database.select({
-					seriesKey: fc.seriesKey,
-					commandId: fc.commandId
-				}).from(mapping.failureEvent.table).where(and(eq(fc.moduleId, input.moduleId), lte(fc.retentionUntil, nativeNow))).limit(remaining + 1));
-				const commands = yield* take(database.select({ commandId: mc.commandId }).from(mapping.command.table).where(and(eq(mc.moduleId, input.moduleId), lte(mc.retentionUntil, nativeNow))).limit(remaining + 1));
-				const series = yield* take(database.select({
-					purpose: sc.purpose,
-					scopeKey: sc.scopeKey
-				}).from(mapping.series.table).where(and(eq(sc.moduleId, input.moduleId), isNull(sc.activeProofId), notExists(database.select({ one: sql`1` }).from(mapping.generation.table).where(and(eq(gc.moduleId, sc.moduleId), eq(gc.purpose, sc.purpose), eq(gc.seriesKey, sc.scopeKey)))), notExists(database.select({ one: sql`1` }).from(mapping.failureEvent.table).where(and(eq(fc.moduleId, sc.moduleId), eq(fc.purpose, sc.purpose), eq(fc.seriesKey, sc.scopeKey)))))).limit(remaining + 1));
-				const rateScopes = yield* take(database.select({
-					purpose: rsc.purpose,
-					action: rsc.action,
-					scopeKind: rsc.scopeKind,
-					scopeKey: rsc.scopeKey
-				}).from(mapping.rateScope.table).where(and(eq(rsc.moduleId, input.moduleId), notExists(database.select({ one: sql`1` }).from(mapping.abuseEvent.table).where(and(eq(ac.moduleId, rsc.moduleId), eq(ac.purpose, rsc.purpose), eq(ac.action, rsc.action), eq(ac.scopeKind, rsc.scopeKind), eq(ac.scopeKey, rsc.scopeKey)))))).limit(remaining + 1));
-				const marker = `effect-auth-proof-guard:cleanup:${input.moduleId}:${now}`;
-				const statements = [];
-				const guardedDelete = Effect.fn(function* (condition, query) {
-					statements.push(yield* assertion(condition, marker), yield* statement(query));
-				});
-				for (const row of continuations) {
-					const condition = and(eq(cc.moduleId, input.moduleId), eq(cc.continuationId, row.continuationId), lte(cc.retentionUntil, mapping.d1.engineNow));
-					yield* guardedDelete(sql`exists(select 1 from ${mapping.continuation.table} where ${condition})`, database.delete(mapping.continuation.table).where(condition));
-				}
-				for (const row of generations) {
-					const condition = and(eq(gc.moduleId, input.moduleId), eq(gc.proofId, row.proofId), lte(gc.retentionUntil, mapping.d1.engineNow));
-					yield* guardedDelete(sql`exists(select 1 from ${mapping.generation.table} where ${condition})`, database.update(mapping.series.table).set(updateValues([[mapping.series.activeProofId, null]])).where(and(eq(sc.moduleId, input.moduleId), eq(sc.activeProofId, row.proofId))));
-					statements.push(yield* statement(database.delete(mapping.generation.table).where(condition)));
-				}
-				for (const row of requests) {
-					const condition = and(eq(rc.moduleId, input.moduleId), eq(rc.requestId, row.requestId), lte(rc.retentionUntil, mapping.d1.engineNow));
-					yield* guardedDelete(sql`exists(select 1 from ${mapping.request.table} where ${condition})`, database.delete(mapping.request.table).where(condition));
-				}
-				for (const row of abuse) {
-					const condition = and(eq(ac.moduleId, input.moduleId), eq(ac.action, row.action), eq(ac.scopeKind, row.scopeKind), eq(ac.scopeKey, row.scopeKey), eq(ac.commandId, row.commandId), lte(ac.retentionUntil, mapping.d1.engineNow));
-					yield* guardedDelete(sql`exists(select 1 from ${mapping.abuseEvent.table} where ${condition})`, database.delete(mapping.abuseEvent.table).where(condition));
-				}
-				for (const row of failures) {
-					const condition = and(eq(fc.moduleId, input.moduleId), eq(fc.seriesKey, row.seriesKey), eq(fc.commandId, row.commandId), lte(fc.retentionUntil, mapping.d1.engineNow));
-					yield* guardedDelete(sql`exists(select 1 from ${mapping.failureEvent.table} where ${condition})`, database.delete(mapping.failureEvent.table).where(condition));
-				}
-				for (const row of commands) {
-					const condition = and(eq(mc.moduleId, input.moduleId), eq(mc.commandId, row.commandId), lte(mc.retentionUntil, mapping.d1.engineNow));
-					yield* guardedDelete(sql`exists(select 1 from ${mapping.command.table} where ${condition})`, database.delete(mapping.command.table).where(condition));
-				}
-				for (const row of series) {
-					const condition = and(eq(sc.moduleId, input.moduleId), eq(sc.purpose, row.purpose), eq(sc.scopeKey, row.scopeKey), isNull(sc.activeProofId), notExists(database.select({ one: sql`1` }).from(mapping.generation.table).where(and(eq(gc.moduleId, sc.moduleId), eq(gc.purpose, sc.purpose), eq(gc.seriesKey, sc.scopeKey)))));
-					yield* guardedDelete(sql`exists(select 1 from ${mapping.series.table} where ${condition})`, database.delete(mapping.series.table).where(condition));
-				}
-				for (const row of rateScopes) {
-					const condition = and(eq(rsc.moduleId, input.moduleId), eq(rsc.purpose, row.purpose), eq(rsc.action, row.action), eq(rsc.scopeKind, row.scopeKind), eq(rsc.scopeKey, row.scopeKey), notExists(database.select({ one: sql`1` }).from(mapping.abuseEvent.table).where(and(eq(ac.moduleId, rsc.moduleId), eq(ac.purpose, rsc.purpose), eq(ac.action, rsc.action), eq(ac.scopeKind, rsc.scopeKind), eq(ac.scopeKey, rsc.scopeKey)))));
-					yield* guardedDelete(sql`exists(select 1 from ${mapping.rateScope.table} where ${condition})`, database.delete(mapping.rateScope.table).where(condition));
-				}
-				hasMore ||= generations.length > 0 || failures.length > 0 || abuse.length > 0;
-				return {
-					receipt: prepare({
-						removed: input.limit - remaining,
-						hasMore
-					}, journal),
-					statements,
-					retryable: (cause) => isGuardFailure(cause, marker)
-				};
-			}));
-		})
-	};
-};
-const makeD1ProofPersistenceServices = Effect.fnUntraced(function* (mapping) {
-	const database = yield* Database;
-	yield* validateDrizzleStorage(mapping).pipe(Effect.provideServiceEffect(NativeDatabase, nativeDatabase(Database)), Effect.mapError(unavailable));
-	const hooks = yield* LifecycleHooks;
-	const plans = makeProofPlans(mapping);
-	const run = (plan) => Effect.gen(function* () {
-		if (yield* hasCommitScope) return yield* unavailable();
-		return yield* executeStandalone(plan, 2);
-	}).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks));
-	return { proofPersistence: {
-		issue: (input, prepare) => run(plans.issue(input, prepare)).pipe(translateIssueFailure),
-		attempt: (input, prepare) => run(plans.attempt(input, prepare)).pipe(translateFailure),
-		complete: (input, prepare) => run(plans.complete(input, prepare)).pipe(translateFailure),
-		claimDelivery: (input, prepare) => run(plans.claimDelivery(input, prepare)).pipe(translateFailure),
-		settleDelivery: (input, prepare) => run(plans.settleDelivery(input, prepare)).pipe(translateFailure),
-		cancel: (input, prepare) => run(plans.cancel(input, prepare)).pipe(translateFailure),
-		cleanup: (input, prepare) => run(plans.cleanup(input, prepare)).pipe(translateFailure)
-	} };
-});
-/**
-* Owns one proof transition plus application statements in one D1 batch. It
-* never replays the owner effect. A reserved guard or named race becomes
-* ProofUnavailable so the caller can retry the entire command with fresh secrets.
-*/
-function coordinateD1ProofPersistence(acquire, options, body) {
-	return Effect.flatMap(nativeDatabase(acquire), (database) => Effect.gen(function* () {
-		yield* validateDrizzleStorage(options.mapping).pipe(Effect.mapError(unavailable));
-		const hooks = yield* LifecycleHooks;
-		if (yield* hasCommitScope) return yield* unavailable();
-		return (yield* coordinateCommit(() => Effect.gen(function* () {
-			const statements = [];
-			let mutation;
-			const nativeCollector = D1BatchStatements.of({ append: (statement) => Effect.sync(() => statements.push(statement)) });
-			const owner = yield* makeD1Owner(unavailable()).pipe(Effect.provideService(D1BatchStatements, nativeCollector));
-			const plans = makeProofPlans(options.mapping);
-			const run = (plan) => coordinateCommit(() => Effect.gen(function* () {
-				const journal = yield* CurrentCommitJournal;
-				const planned = yield* plan;
-				yield* owner.check;
-				if (mutation !== void 0) return yield* unavailable();
-				const guarded = {
-					...planned,
-					journalGuard: journal.prepare(void 0)
-				};
-				mutation = guarded;
-				statements.push(...guarded.statements);
-				return guarded.receipt;
-			}), { mode: "batch" }).pipe(Effect.map((result) => result.value), Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks));
-			const provided = Context.make(ProofPersistence, {
-				issue: (input, prepare) => owner.run(run(plans.issue(input, prepare)).pipe(translateIssueFailure)),
-				attempt: (input, prepare) => owner.run(run(plans.attempt(input, prepare)).pipe(translateFailure)),
-				complete: (input, prepare) => owner.run(run(plans.complete(input, prepare)).pipe(translateFailure)),
-				claimDelivery: (input, prepare) => owner.run(run(plans.claimDelivery(input, prepare)).pipe(translateFailure)),
-				settleDelivery: (input, prepare) => owner.run(run(plans.settleDelivery(input, prepare)).pipe(translateFailure)),
-				cancel: (input, prepare) => owner.run(run(plans.cancel(input, prepare)).pipe(translateFailure)),
-				cleanup: (input, prepare) => owner.run(run(plans.cleanup(input, prepare)).pipe(translateFailure))
-			}).pipe(Context.add(D1BatchStatements, owner.collector));
-			const value = yield* owner.close(Effect.provideContext(body, provided));
-			if (mutation?.journalGuard !== void 0) {
-				const status = yield* Effect.result(mutation.journalGuard.read);
-				if (status._tag === "Success" || status.failure._tag !== "CommitPending") return yield* unavailable();
-			}
-			yield* database.$client.batch(statements).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, (error) => everyFailureMatches(cause, mutation?.retryable) ? unavailable() : error))), translateFailure);
-			return value;
-		}), { mode: "batch" }).pipe(Effect.provideService(LifecycleHooks, hooks))).value;
-	}).pipe(Effect.provideService(NativeDatabase, database)));
-}
-/** Private compiler seam for a future same-owner D1 password-reset batch. */
-const compileD1ProofCompletionPlan = Effect.fn("Drizzle.compileD1ProofCompletionPlan")(function* (mapping, plan, protectedMutation, project) {
-	const planned = yield* completionPlan(mapping, plan.input, (decision, activeJournal) => plan.prepare(decision, activeJournal, project));
-	if (planned.statements.length === 0) return planned;
-	const [freshGuard, ...completionStatements] = planned.statements;
-	const marker = `effect-auth-proof-guard:protected:${plan.input.continuationId}`;
-	return {
-		receipt: planned.receipt,
-		statements: [
-			freshGuard,
-			...protectedMutation.statements,
-			yield* assertion(protectedMutation.appliedCondition, marker),
-			...completionStatements
-		],
-		postconditions: [yield* assertion(protectedMutation.appliedCondition, marker), ...planned.postconditions ?? []]
-	};
-});
-const translateFailure = (effect) => reportPersistenceFailure(effect, (error) => Schema.is(ProofUnavailable)(error) || Schema.is(HookConfigurationError)(error)).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));
-const translateIssueFailure = (effect) => reportPersistenceFailure(effect, (error) => Schema.is(ProofUnavailable)(error) || Schema.is(ProofRequestConflict)(error) || Schema.is(HookConfigurationError)(error)).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, (error) => Schema.is(ProofRequestConflict)(error) ? error : unavailable()))));
-const executeStandalone = (plan, retries = 2) => Effect.suspend(() => {
-	let retryable;
-	return coordinateCommit(() => Effect.gen(function* () {
-		const database = yield* CurrentD1PlanningDatabase;
-		const planned = yield* plan;
-		retryable = planned.retryable;
-		yield* database.$client.batch(planned.statements);
-		return planned.receipt;
-	}), { mode: "batch" }).pipe(Effect.map((result) => result.value)).pipe(Effect.catchCause((cause) => retries > 0 && everyFailureMatches(cause, retryable) ? executeStandalone(plan, retries - 1) : Effect.failCause(cause)));
-});
-//#endregion
-export { checkD1ProofCompletion, compileD1ProofCompletionPlan, coordinateD1ProofPersistence, makeD1ProofPersistenceServices };
-
-//# sourceMappingURL=d1-proofs.mjs.map