@yielded/auth-persistence-drizzle 0.1.0-beta.25 → 0.1.0-beta.27

package/dist/drizzle/d1-emails.mjs

@@ -1,626 +0,0 @@
-import { requiredEmailAddressConstraints, requiredEmailRegistrationConstraints } from "./email-model.mjs";
-import { PersistenceMappingError as PersistenceMappingError$1, column, isMappedConstraintConflict, updateValues } from "./model.mjs";
-import { validateDrizzleStorage } from "./storage-validation.mjs";
-import { CurrentEmailSql, currentAddress, decodeEmailSnapshot, emailLookupQuery, sameEmailRevision, snapshotEmailMutation, validEmailSignInConstraints, validateEmailAuthority } from "./email-sql.mjs";
-import { readEmailRegistrationTarget } from "./email-registration.mjs";
-import { Database } from "./d1-database.mjs";
-import { D1BatchStatements } from "./D1BatchStatements.mjs";
-import { CurrentD1PlanningDatabase, makeD1Owner } from "./d1-planning.mjs";
-import { nativeDatabase } from "./native-database.mjs";
-import { compileD1ProofCompletionPlan } from "./d1-proofs.mjs";
-import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
-import { and, eq, inArray, lte, sql } from "drizzle-orm";
-import { Cause, Context, DateTime, Effect, Option, Schema } from "effect";
-import { CurrentCommitJournal, HookConfigurationError, LifecycleHooks, coordinateCommit, hasCommitScope } from "@yielded/auth/Hooks";
-import { assessAuthentication } from "@yielded/auth/Sessions";
-import { EmailAddressPersistence, EmailSignInTargets, EmailUnavailable } from "@yielded/auth/Email";
-import { reportPersistenceFailure } from "@yielded/auth/Persistence";
-import { ProofUnavailable } from "@yielded/auth/Proofs";
-//#region src/drizzle/d1-emails.ts
-const emailLookupRows = Effect.fn("DrizzleD1.emailLookupRows")(function* (mapping, moduleId, identifier) {
-	const database = yield* CurrentD1PlanningDatabase;
-	const query = emailLookupQuery(mapping, moduleId, identifier);
-	return yield* database.select(query.fields).from(query.from).innerJoin(query.subjectTable, query.subjectJoin).innerJoin(query.credentialTable, query.credentialJoin).where(query.predicate).limit(query.limit);
-});
-const unavailable = () => EmailUnavailable.make({});
-const everyFailureMatches = (cause, classify) => classify !== void 0 && cause.reasons.length > 0 && cause.reasons.every((reason) => Cause.isFailReason(reason) && classify(Cause.fail(reason.error)));
-const statement = Effect.fn(function* (query) {
-	const database = yield* CurrentD1PlanningDatabase;
-	const rendered = query.toSQL();
-	return database.$client.unsafe(rendered.sql, rendered.params);
-});
-const containsFailure = (failure, predicate) => {
-	const pending = [failure];
-	const seen = /* @__PURE__ */ new Set();
-	for (let index = 0; index < 32 && pending.length > 0; index++) {
-		const value = pending.shift();
-		if (value === null || value === void 0 || seen.has(value)) continue;
-		seen.add(value);
-		if (predicate(value)) return true;
-		if (Cause.isCause(value)) {
-			for (const reason of value.reasons) if (Cause.isFailReason(reason)) pending.push(reason.error);
-			else if (Cause.isDieReason(reason)) pending.push(reason.defect);
-		} else if (typeof value === "object") {
-			const wrapped = value;
-			if (wrapped.cause !== void 0) pending.push(wrapped.cause);
-			if (wrapped.reason !== void 0) pending.push(wrapped.reason);
-			if (wrapped.message !== void 0) pending.push(wrapped.message);
-		}
-	}
-	return false;
-};
-const guardFailure = (cause, marker) => {
-	const native = `bad JSON path: '${`$[${marker.replaceAll("'", "''")}]`}': SQLITE_ERROR`;
-	return containsFailure(cause, (value) => value === native || value === `D1_ERROR: ${native}`);
-};
-const assertion = Effect.fn(function* (condition, marker) {
-	const database = yield* CurrentD1PlanningDatabase;
-	return yield* statement(database.select({ ok: sql`case when ${condition} then 1 else json_extract('[]', ${`$[${marker}]`}) end`.as("ok") }).from(sql`(select 1)`));
-});
-const existsSql = (query) => sql`exists(${query})`;
-const notExistsSql = (query) => sql`not exists(${query})`;
-const readEngineNowMillis = Effect.fn("Drizzle.readEngineNowMillis")(function* (clock) {
-	const database = yield* CurrentD1PlanningDatabase;
-	return yield* awaitRows(database.select({ value: sql`${clock.engineNowMillis}`.mapWith(Number) }).from(sql`(select 1)`)).pipe(Effect.flatMap((rows) => typeof rows[0]?.value === "number" && Number.isFinite(rows[0].value) ? Effect.succeed(rows[0].value) : Effect.fail(unavailable())));
-});
-const driverValues = (values, entries) => ({
-	...values,
-	...Object.fromEntries(entries)
-});
-const allocate = (asynchronous, synchronous) => asynchronous !== void 0 ? asynchronous : synchronous === void 0 ? Effect.fail(unavailable()) : Effect.try({
-	try: synchronous,
-	catch: (cause) => new PersistenceMappingError$1({
-		operation: "mapping",
-		cause
-	})
-});
-const validAddress = (mapping) => Object.entries(requiredEmailAddressConstraints).every(([key, value]) => mapping.constraints[key] === value);
-const evidenceCondition = (mapping, evidence, requirement) => {
-	const fresh = (proof) => {
-		const verified = DateTime.toEpochMillis(proof.verifiedAt);
-		return sql`${mapping.d1.engineNowMillis} >= ${verified} and ${mapping.d1.engineNowMillis} - ${verified} < ${requirement.maximumAgeMillis}`;
-	};
-	const alternatives = requirement.alternatives.flatMap((alternative) => {
-		const byCredential = /* @__PURE__ */ new Map();
-		for (const proof of evidence.proofs) byCredential.set(proof.credentialId, [...byCredential.get(proof.credentialId) ?? [], fresh(proof)]);
-		const credentials = [...byCredential.values()].map((conditions) => sql`(${sql.join(conditions, sql` or `)})`);
-		const factors = alternative.factors.map((factor) => {
-			const matches = evidence.proofs.filter((proof) => proof.factors.includes(factor)).map(fresh);
-			return matches.length === 0 ? sql`false` : sql`(${sql.join(matches, sql` or `)})`;
-		});
-		const assurance = evidence.proofs.filter((proof) => (!alternative.userVerified || proof.userVerified) && (!alternative.phishingResistant || proof.phishingResistant)).map(fresh);
-		if (assurance.length === 0 || credentials.length < alternative.minimumCredentials) return [];
-		const minimum = alternative.minimumCredentials === 0 ? sql`true` : sql`(${sql.join(credentials.map((condition) => sql`case when ${condition} then 1 else 0 end`), sql` + `)}) >= ${alternative.minimumCredentials}`;
-		return [and(...factors, sql`(${sql.join(assurance, sql` or `)})`, minimum)];
-	});
-	const noFuture = evidence.proofs.map((proof) => sql`${mapping.d1.engineNowMillis} >= ${DateTime.toEpochMillis(proof.verifiedAt)}`);
-	return alternatives.length === 0 ? sql`false` : and(...noFuture, sql`(${sql.join(alternatives, sql` or `)})`);
-};
-const subjectCondition = (mapping, current, revision) => {
-	const id = column(mapping.subject.table, mapping.subject.id);
-	const status = column(mapping.subject.table, mapping.subject.status);
-	const security = column(mapping.subject.table, mapping.subject.securityRevision);
-	return existsSql(sql`select 1 from ${mapping.subject.table} where ${id}=${sql.param(current.nativeSubjectId, id)} and ${status}=${sql.param(mapping.subject.d1ActiveStatusValue, status)} and ${security}=${sql.param(revision, security)}`);
-};
-const authorityRevisionCondition = (mapping, current) => {
-	const a = mapping.authorityCredential;
-	const subject = column(a.table, a.subjectId);
-	const credential = column(a.table, a.credentialId);
-	const revision = column(a.table, a.revision);
-	const status = column(a.table, a.status);
-	const expected = current.revision.credentials;
-	const matches = expected.map((item) => existsSql(sql`select 1 from ${a.table} where ${subject}=${sql.param(current.nativeSubjectId, subject)} and ${credential}=${sql.param(item.credentialId, credential)} and ${revision}=${sql.param(item.revision, revision)} and ${status}=${sql.param(a.d1ActiveStatusValue, status)}`));
-	return and(...matches, sql`(select count(*) from ${a.table} where ${subject}=${sql.param(current.nativeSubjectId, subject)} and ${status}=${sql.param(a.d1ActiveStatusValue, status)})=${expected.length}`);
-};
-const mutationPlan = Effect.fn("Drizzle.mutationPlan")(function* (mapping, proofMapping, uncaptured, action, prepare) {
-	const database = yield* CurrentD1PlanningDatabase;
-	const journal = yield* CurrentCommitJournal;
-	if (!validAddress(mapping)) return yield* unavailable();
-	const input = yield* snapshotEmailMutation(uncaptured).pipe(Effect.mapError(unavailable));
-	const current = yield* validateEmailAuthority(mapping, {
-		mode: "interactive",
-		locking: false,
-		standaloneGuard: Effect.void
-	}, input, action);
-	if (current === void 0) return {
-		receipt: prepare("rejected", journal),
-		statements: []
-	};
-	if ((yield* awaitRows(database.select().from(mapping.command.table).where(and(eq(column(mapping.command.table, mapping.command.moduleId), input.moduleId), eq(column(mapping.command.table, mapping.command.commandId), input.commandId))).limit(1))).length > 0) return {
-		receipt: prepare("rejected", journal),
-		statements: []
-	};
-	const requirement = yield* mapping.subject.decodeActionRequirement(current.subject, action);
-	const original = yield* assessAuthentication(input.authorization.evidence, input.authorization.requirement).pipe(Effect.mapError(unavailable));
-	const configured = yield* assessAuthentication(input.authorization.evidence, requirement).pipe(Effect.mapError(unavailable));
-	if (!original.satisfied || !configured.satisfied) return {
-		receipt: prepare("rejected", journal),
-		statements: []
-	};
-	const transitionMillis = yield* readEngineNowMillis(mapping.d1);
-	const transitionInstant = mapping.encodeInstant(transitionMillis);
-	const targetCredentialId = current.targetCredential?.[mapping.credential.credentialId] ?? (yield* allocate(mapping.allocateCredentialId, mapping.allocateCredentialIdSync));
-	const targetIdentifierRevision = yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync);
-	const targetCredentialRevision = yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync);
-	const sourceIdentifierRevision = yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync);
-	const sourceCredentialRevision = yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync);
-	const confirmsExisting = action === "verify-address" && input.captured.targetIdentifierRevision !== void 0;
-	const nextRevision = confirmsExisting ? input.captured.revision.securityRevision : yield* allocate(mapping.subject.nextSecurityRevision?.(input.captured.revision.securityRevision) ?? mapping.allocateRevision, mapping.subject.nextSecurityRevisionSync === void 0 ? mapping.allocateRevisionSync : () => mapping.subject.nextSecurityRevisionSync(input.captured.revision.securityRevision));
-	if (!confirmsExisting && nextRevision === input.captured.revision.securityRevision || current.targetIdentifier !== void 0 && targetIdentifierRevision === current.targetIdentifier[mapping.identifier.bindingRevision] || current.targetCredential !== void 0 && targetCredentialRevision === current.targetCredential[mapping.credential.credentialRevision] || current.source !== void 0 && (sourceIdentifierRevision === current.source.snapshot.identifierRevision || sourceCredentialRevision === current.source.snapshot.credentialRevision)) return yield* unavailable();
-	const statements = [];
-	const i = mapping.identifier;
-	const c = mapping.credential;
-	const a = mapping.authorityCredential;
-	const sc = current.source;
-	const authorityMarker = `effect-auth-email-guard:authority:${input.commandId}`;
-	const targetIdentifierPrecondition = current.targetIdentifier === void 0 ? notExistsSql(sql`select 1 from ${i.table} where ${column(i.table, i.namespace)}=${sql.param(input.target.namespace, column(i.table, i.namespace))} and ${column(i.table, i.value)}=${sql.param(input.target.value, column(i.table, i.value))}`) : existsSql(sql`select 1 from ${i.table} where ${column(i.table, i.bindingRevision)}=${sql.param(current.targetIdentifier[i.bindingRevision], column(i.table, i.bindingRevision))} and ${i.d1MutableTargetCondition({
-		identifier: input.target,
-		nativeSubjectId: current.nativeSubjectId
-	})}`);
-	const targetCredentialPrecondition = current.targetCredential === void 0 ? notExistsSql(sql`select 1 from ${c.table} where ${column(c.table, c.moduleId)}=${sql.param(input.moduleId, column(c.table, c.moduleId))} and ${column(c.table, c.identifierNamespace)}=${sql.param(input.target.namespace, column(c.table, c.identifierNamespace))} and ${column(c.table, c.identifierValue)}=${sql.param(input.target.value, column(c.table, c.identifierValue))}`) : existsSql(sql`select 1 from ${c.table} where ${column(c.table, c.moduleId)}=${sql.param(input.moduleId, column(c.table, c.moduleId))} and ${column(c.table, c.credentialId)}=${sql.param(current.targetCredential[c.credentialId], column(c.table, c.credentialId))} and ${column(c.table, c.subjectId)}=${sql.param(current.nativeSubjectId, column(c.table, c.subjectId))} and ${column(c.table, c.credentialRevision)}=${sql.param(current.targetCredential[c.credentialRevision], column(c.table, c.credentialRevision))} and ${column(c.table, c.status)}<>${sql.param(c.d1ActiveStatusValue, column(c.table, c.status))}`);
-	const sourcePrecondition = action === "verify-address" ? sql`true` : and(existsSql(sql`select 1 from ${i.table} where ${i.d1CurrentCondition({
-		identifier: sc.snapshot.identifier,
-		nativeSubjectId: current.nativeSubjectId,
-		bindingRevision: sc.snapshot.identifierRevision
-	})}`), existsSql(sql`select 1 from ${c.table} where ${column(c.table, c.moduleId)}=${sql.param(input.moduleId, column(c.table, c.moduleId))} and ${column(c.table, c.credentialId)}=${sql.param(sc.snapshot.credentialId, column(c.table, c.credentialId))} and ${column(c.table, c.subjectId)}=${sql.param(current.nativeSubjectId, column(c.table, c.subjectId))} and ${column(c.table, c.credentialRevision)}=${sql.param(sc.snapshot.credentialRevision, column(c.table, c.credentialRevision))} and ${column(c.table, c.status)}=${sql.param(c.d1ActiveStatusValue, column(c.table, c.status))}`));
-	statements.push(yield* assertion(and(subjectCondition(mapping, current, input.captured.revision.securityRevision), authorityRevisionCondition(mapping, current), targetIdentifierPrecondition, targetCredentialPrecondition, sourcePrecondition, evidenceCondition(mapping, input.authorization.evidence, input.authorization.requirement), evidenceCondition(mapping, input.authorization.evidence, requirement)), authorityMarker));
-	if (action === "change-address") {
-		statements.push(yield* statement(database.update(i.table).set(i.encodeRetirement({
-			source: sc.snapshot.identifier,
-			bindingRevision: sourceIdentifierRevision
-		})).where(and(eq(column(i.table, i.namespace), sc.snapshot.identifier.namespace), eq(column(i.table, i.value), sc.snapshot.identifier.value), eq(column(i.table, i.subjectId), current.nativeSubjectId), eq(column(i.table, i.bindingRevision), sc.snapshot.identifierRevision)))));
-		statements.push(yield* statement(database.update(c.table).set(c.encodeRetirement({
-			source: sc.snapshot.identifier,
-			credentialRevision: sourceCredentialRevision
-		})).where(and(eq(column(c.table, c.moduleId), input.moduleId), eq(column(c.table, c.credentialId), sc.snapshot.credentialId), eq(column(c.table, c.subjectId), current.nativeSubjectId), eq(column(c.table, c.credentialRevision), sc.snapshot.credentialRevision)))));
-		statements.push(yield* statement(database.update(a.table).set(a.encodeRetirement(sourceCredentialRevision)).where(and(eq(column(a.table, a.subjectId), current.nativeSubjectId), eq(column(a.table, a.credentialId), sc.snapshot.credentialId), eq(column(a.table, a.revision), sc.snapshot.credentialRevision)))));
-	}
-	if (current.targetIdentifier === void 0) statements.push(yield* statement(database.insert(i.table).values(driverValues(i.encodeVerifiedInsert({
-		identifier: input.target,
-		subjectId: current.nativeSubjectId,
-		verifiedAtMillis: transitionMillis,
-		bindingRevision: targetIdentifierRevision
-	}), [[i.verifiedAt, transitionInstant]]))));
-	else statements.push(yield* statement(database.update(i.table).set(driverValues(i.encodeVerification({
-		verifiedAtMillis: transitionMillis,
-		bindingRevision: targetIdentifierRevision
-	}), [[i.verifiedAt, transitionInstant]])).where(and(eq(column(i.table, i.namespace), input.target.namespace), eq(column(i.table, i.value), input.target.value), eq(column(i.table, i.subjectId), current.nativeSubjectId), eq(column(i.table, i.bindingRevision), current.targetIdentifier[i.bindingRevision])))));
-	if (current.targetCredential === void 0) {
-		statements.push(yield* statement(database.insert(c.table).values(c.encodeVerifiedInsert({
-			moduleId: input.moduleId,
-			subjectId: current.nativeSubjectId,
-			credentialId: targetCredentialId,
-			identifier: input.target,
-			credentialRevision: targetCredentialRevision
-		}))));
-		statements.push(yield* statement(database.insert(a.table).values(a.encodeInsert({
-			subjectId: current.nativeSubjectId,
-			credentialId: targetCredentialId,
-			revision: targetCredentialRevision
-		}))));
-	} else {
-		const oldRevision = current.targetCredential[c.credentialRevision];
-		statements.push(yield* statement(database.update(c.table).set(c.encodeActivation({
-			identifier: input.target,
-			credentialRevision: targetCredentialRevision
-		})).where(and(eq(column(c.table, c.moduleId), input.moduleId), eq(column(c.table, c.credentialId), targetCredentialId), eq(column(c.table, c.subjectId), current.nativeSubjectId), eq(column(c.table, c.credentialRevision), oldRevision)))));
-		statements.push(yield* statement(database.update(a.table).set(a.encodeActivation(targetCredentialRevision)).where(and(eq(column(a.table, a.subjectId), current.nativeSubjectId), eq(column(a.table, a.credentialId), targetCredentialId), eq(column(a.table, a.revision), oldRevision)))));
-	}
-	statements.push(yield* statement(database.update(mapping.subject.table).set(updateValues([[mapping.subject.securityRevision, nextRevision]])).where(and(eq(column(mapping.subject.table, mapping.subject.id), current.nativeSubjectId), eq(column(mapping.subject.table, mapping.subject.securityRevision), input.captured.revision.securityRevision)))));
-	statements.push(yield* statement(database.insert(mapping.command.table).values(driverValues(mapping.command.encodeInsert({
-		moduleId: input.moduleId,
-		commandId: input.commandId,
-		action,
-		bindingDigest: input.authorization.challenge.bindingDigest,
-		retentionUntilMillis: transitionMillis + mapping.commandRetentionMillis
-	}), [[mapping.command.retentionUntil, mapping.encodeInstant(transitionMillis + mapping.commandRetentionMillis)]]))));
-	const targetExists = existsSql(sql`select 1 from ${i.table} where ${column(i.table, i.bindingRevision)}=${sql.param(targetIdentifierRevision, column(i.table, i.bindingRevision))} and ${column(i.table, i.verifiedAt)}=${sql.param(transitionInstant, column(i.table, i.verifiedAt))} and ${i.d1CurrentCondition({
-		identifier: input.target,
-		nativeSubjectId: current.nativeSubjectId,
-		bindingRevision: targetIdentifierRevision
-	})}`);
-	const credentialExists = existsSql(sql`select 1 from ${c.table} where ${column(c.table, c.moduleId)}=${sql.param(input.moduleId, column(c.table, c.moduleId))} and ${column(c.table, c.credentialId)}=${sql.param(targetCredentialId, column(c.table, c.credentialId))} and ${column(c.table, c.subjectId)}=${sql.param(current.nativeSubjectId, column(c.table, c.subjectId))} and ${column(c.table, c.identifierNamespace)}=${sql.param(input.target.namespace, column(c.table, c.identifierNamespace))} and ${column(c.table, c.identifierValue)}=${sql.param(input.target.value, column(c.table, c.identifierValue))} and ${column(c.table, c.credentialRevision)}=${sql.param(targetCredentialRevision, column(c.table, c.credentialRevision))} and ${column(c.table, c.status)}=${sql.param(c.d1ActiveStatusValue, column(c.table, c.status))}`);
-	const authorityExists = existsSql(sql`select 1 from ${a.table} where ${column(a.table, a.subjectId)}=${sql.param(current.nativeSubjectId, column(a.table, a.subjectId))} and ${column(a.table, a.credentialId)}=${sql.param(targetCredentialId, column(a.table, a.credentialId))} and ${column(a.table, a.revision)}=${sql.param(targetCredentialRevision, column(a.table, a.revision))} and ${column(a.table, a.status)}=${sql.param(a.d1ActiveStatusValue, column(a.table, a.status))}`);
-	const commandExists = existsSql(sql`select 1 from ${mapping.command.table} where ${column(mapping.command.table, mapping.command.moduleId)}=${sql.param(input.moduleId, column(mapping.command.table, mapping.command.moduleId))} and ${column(mapping.command.table, mapping.command.commandId)}=${sql.param(input.commandId, column(mapping.command.table, mapping.command.commandId))} and ${column(mapping.command.table, mapping.command.action)}=${sql.param(action, column(mapping.command.table, mapping.command.action))} and ${column(mapping.command.table, mapping.command.bindingDigest)}=${sql.param(input.authorization.challenge.bindingDigest, column(mapping.command.table, mapping.command.bindingDigest))} and ${column(mapping.command.table, mapping.command.retentionUntil)}=${sql.param(mapping.encodeInstant(transitionMillis + mapping.commandRetentionMillis), column(mapping.command.table, mapping.command.retentionUntil))}`);
-	const sourceRetired = action === "verify-address" ? sql`true` : and(existsSql(sql`select 1 from ${i.table} where ${column(i.table, i.namespace)}=${sql.param(sc.snapshot.identifier.namespace, column(i.table, i.namespace))} and ${column(i.table, i.value)}=${sql.param(sc.snapshot.identifier.value, column(i.table, i.value))} and ${column(i.table, i.subjectId)}=${sql.param(current.nativeSubjectId, column(i.table, i.subjectId))} and ${column(i.table, i.bindingRevision)}=${sql.param(sourceIdentifierRevision, column(i.table, i.bindingRevision))} and not (${i.d1CurrentCondition({
-		identifier: sc.snapshot.identifier,
-		nativeSubjectId: current.nativeSubjectId,
-		bindingRevision: sourceIdentifierRevision
-	})})`), existsSql(sql`select 1 from ${c.table} where ${column(c.table, c.moduleId)}=${sql.param(input.moduleId, column(c.table, c.moduleId))} and ${column(c.table, c.credentialId)}=${sql.param(sc.snapshot.credentialId, column(c.table, c.credentialId))} and ${column(c.table, c.subjectId)}=${sql.param(current.nativeSubjectId, column(c.table, c.subjectId))} and ${column(c.table, c.identifierNamespace)}=${sql.param(sc.snapshot.identifier.namespace, column(c.table, c.identifierNamespace))} and ${column(c.table, c.identifierValue)}=${sql.param(sc.snapshot.identifier.value, column(c.table, c.identifierValue))} and ${column(c.table, c.credentialRevision)}=${sql.param(sourceCredentialRevision, column(c.table, c.credentialRevision))} and ${column(c.table, c.status)}<>${sql.param(c.d1ActiveStatusValue, column(c.table, c.status))}`), existsSql(sql`select 1 from ${a.table} where ${column(a.table, a.subjectId)}=${sql.param(current.nativeSubjectId, column(a.table, a.subjectId))} and ${column(a.table, a.credentialId)}=${sql.param(sc.snapshot.credentialId, column(a.table, a.credentialId))} and ${column(a.table, a.revision)}=${sql.param(sourceCredentialRevision, column(a.table, a.revision))} and ${column(a.table, a.status)}<>${sql.param(a.d1ActiveStatusValue, column(a.table, a.status))}`));
-	const applied = and(subjectCondition(mapping, current, nextRevision), targetExists, credentialExists, authorityExists, commandExists, sourceRetired, evidenceCondition(mapping, input.authorization.evidence, input.authorization.requirement), evidenceCondition(mapping, input.authorization.evidence, requirement));
-	const compiled = yield* compileD1ProofCompletionPlan(proofMapping, input.completion, {
-		statements,
-		appliedCondition: applied
-	}, (decision) => decision);
-	const marker = `effect-auth-proof-guard:protected:${input.completion.input.continuationId}`;
-	return {
-		receipt: prepare(compiled.statements.length === 0 ? "rejected" : "changed", journal),
-		statements: compiled.statements,
-		retryable: (cause) => guardFailure(cause, marker) || guardFailure(cause, authorityMarker) || isMappedConstraintConflict(mapping.isCommandConflict, cause) || isMappedConstraintConflict(mapping.isIdentifierConflict, cause) || isMappedConstraintConflict(mapping.isCredentialConflict, cause)
-	};
-});
-const awaitRows = (effect) => effect;
-const probeCompletion = Effect.fn("DrizzleD1.probeCompletion")(function* (proofMapping, input) {
-	const database = yield* CurrentD1PlanningDatabase;
-	const plan = {
-		input,
-		prepare: (decision, journal, project) => journal.prepare(project(decision))
-	};
-	const marker = `effect-auth-proof-guard:protected:${input.continuationId}`;
-	return yield* coordinateCommit(() => Effect.gen(function* () {
-		const compiled = yield* compileD1ProofCompletionPlan(proofMapping, plan, {
-			statements: [],
-			appliedCondition: sql`false`
-		}, () => false);
-		if (compiled.statements.length === 0) return false;
-		yield* database.$client.batch(compiled.statements);
-		return false;
-	}), { mode: "batch" }).pipe(Effect.as(false), Effect.catchCause((cause) => guardFailure(cause, marker) ? Effect.succeed(true) : Effect.failCause(cause)));
-});
-const makeAddressPlans = (mapping, proofMapping) => ({
-	target: (input) => currentAddress(mapping, input, false).pipe(Effect.flatMap((current) => current === void 0 ? Effect.fail(unavailable()) : Effect.succeed({
-		revision: current.revision,
-		eligible: current.eligible,
-		...current.targetIdentifierRevision === void 0 ? {} : { targetIdentifierRevision: current.targetIdentifierRevision },
-		...current.source === void 0 ? {} : { source: current.source.snapshot }
-	}))),
-	checkCompletion: (input) => {
-		if (input.binding._tag !== "IdentifierChange") return Effect.succeed(false);
-		const binding = input.binding;
-		const action = input.moduleId.endsWith("/verify-address") && input.purpose === "email-address-verification" ? "verify-address" : input.moduleId.endsWith("/change-address") && input.purpose === "email-address-change" ? "change-address" : void 0;
-		if (action === void 0) return Effect.succeed(false);
-		const moduleId = input.moduleId.slice(0, -`/${action}`.length);
-		return currentAddress(mapping, {
-			moduleId,
-			subjectId: binding.revision.subjectId,
-			target: binding.identifier
-		}, false).pipe(Effect.flatMap((current) => current !== void 0 && sameEmailRevision(current.revision, binding.revision) ? probeCompletion(proofMapping, input) : Effect.succeed(false)));
-	},
-	verifyWithProof: (input, prepare) => mutationPlan(mapping, proofMapping, input, "verify-address", prepare),
-	changeWithProof: (input, prepare) => mutationPlan(mapping, proofMapping, input, "change-address", prepare),
-	cleanup: (input, prepare) => Effect.gen(function* () {
-		const database = yield* CurrentD1PlanningDatabase;
-		const journal = yield* CurrentCommitJournal;
-		const module = column(mapping.command.table, mapping.command.moduleId);
-		const id = column(mapping.command.table, mapping.command.commandId);
-		const retention = column(mapping.command.table, mapping.command.retentionUntil);
-		const rows = yield* awaitRows(database.select({ commandId: id }).from(mapping.command.table).where(and(eq(module, input.moduleId), lte(retention, mapping.d1.engineNow))).limit(input.limit + 1));
-		const selected = rows.slice(0, input.limit);
-		const marker = `effect-auth-email-guard:cleanup:${input.moduleId}`;
-		const selectedIds = selected.map((row) => row.commandId);
-		const selectedWhere = and(eq(module, input.moduleId), inArray(id, selectedIds), lte(retention, mapping.d1.engineNow));
-		const statements = selected.length === 0 ? [] : [yield* assertion(sql`(select count(*) from ${mapping.command.table} where ${selectedWhere})=${selected.length}`, marker), yield* statement(database.delete(mapping.command.table).where(selectedWhere))];
-		return {
-			receipt: prepare({
-				removed: selected.length,
-				hasMore: rows.length > input.limit
-			}, journal),
-			statements,
-			retryable: (cause) => guardFailure(cause, marker)
-		};
-	})
-});
-const registrationRows = Effect.fn("Drizzle.registrationRows")(function* (mapping, moduleId, commandId) {
-	const database = yield* CurrentD1PlanningDatabase;
-	return yield* awaitRows(database.select().from(mapping.registration.table).where(and(eq(column(mapping.registration.table, mapping.registration.moduleId), moduleId), eq(column(mapping.registration.table, mapping.registration.commandId), commandId))).limit(1));
-});
-const sameIdentifier = (left, right) => left.namespace === right.namespace && left.value === right.value;
-const registrationCompletionMatches = (mapping, input) => input.completion.input.moduleId === `${input.moduleId}/registration` && input.completion.input.purpose === "email-code-registration" && input.completion.input.binding._tag === "Identifier" && sameIdentifier(input.completion.input.binding.identifier, input.identifier) && mapping.constraints.request === requiredEmailRegistrationConstraints.request && mapping.constraints.pendingReference === requiredEmailRegistrationConstraints.pendingReference && (mapping.mode === "pending" || Object.entries(requiredEmailRegistrationConstraints).every(([key, value]) => mapping.constraints[key] === value));
-const registrationPlan = Effect.fn("Drizzle.registrationPlan")(function* (mapping, proofMapping, input, inspected, allocated, prepare) {
-	const database = yield* CurrentD1PlanningDatabase;
-	const journal = yield* CurrentCommitJournal;
-	const existing = (yield* registrationRows(mapping, input.moduleId, input.commandId))[0];
-	if (existing !== void 0) return {
-		receipt: prepare(existing[mapping.registration.fingerprint] !== input.fingerprint ? { _tag: "Rejected" } : yield* mapping.registration.decodeReplay(existing), journal),
-		statements: []
-	};
-	if (!registrationCompletionMatches(mapping, input) || !inspected.eligible || inspected.fingerprint !== input.fingerprint || mapping.mode === "atomic" && (mapping.provisioning.idMode === "generated" || mapping.subject.d1ActiveStatusValue === void 0 || mapping.identifier.d1CurrentCondition === void 0 || mapping.credential.d1ActiveStatusValue === void 0 || mapping.authorityCredential.d1ActiveStatusValue === void 0)) return {
-		receipt: prepare({ _tag: "Rejected" }, journal),
-		statements: []
-	};
-	const target = mapping.mode === "atomic" ? yield* readEmailRegistrationTarget(mapping, input.identifier, false) : void 0;
-	if (target?._tag === "Rejected") return {
-		receipt: prepare({ _tag: "Rejected" }, journal),
-		statements: []
-	};
-	if (target?._tag === "Reserved" && (allocated.displacedSecurityRevision === void 0 || allocated.displacedSecurityRevision === target.securityRevision || allocated.identifierRevision === target.bindingRevision)) return yield* unavailable();
-	const intent = {
-		moduleId: input.moduleId,
-		commandId: input.commandId,
-		identifier: input.identifier,
-		registration: input.registration,
-		fingerprint: input.fingerprint,
-		completion: {
-			moduleId: input.completion.input.moduleId,
-			purpose: input.completion.input.purpose,
-			continuationId: input.completion.input.continuationId,
-			binding: input.completion.input.binding
-		}
-	};
-	const transitionMillis = yield* readEngineNowMillis(mapping.d1);
-	const retentionInstant = mapping.encodeInstant(transitionMillis + mapping.retentionMillis);
-	const statements = [];
-	let applied;
-	let desired;
-	const registrationModule = column(mapping.registration.table, mapping.registration.moduleId);
-	const registrationCommand = column(mapping.registration.table, mapping.registration.commandId);
-	const registrationFingerprint = column(mapping.registration.table, mapping.registration.fingerprint);
-	const registrationState = column(mapping.registration.table, mapping.registration.state);
-	if (mapping.mode === "pending") {
-		if (allocated.pendingReference === void 0) return {
-			receipt: prepare({ _tag: "Rejected" }, journal),
-			statements: []
-		};
-		desired = {
-			_tag: "ProvisioningPending",
-			reference: allocated.pendingReference
-		};
-		statements.push(yield* statement(database.insert(mapping.registration.table).values(driverValues(mapping.registration.encodeInsert(intent, {
-			state: "pending",
-			pendingReference: allocated.pendingReference,
-			retentionUntilMillis: transitionMillis + mapping.retentionMillis
-		}), [[mapping.registration.retentionUntil, retentionInstant]]))));
-		applied = existsSql(sql`select 1 from ${mapping.registration.table} where ${registrationModule}=${sql.param(input.moduleId, registrationModule)} and ${registrationCommand}=${sql.param(input.commandId, registrationCommand)} and ${registrationFingerprint}=${sql.param(input.fingerprint, registrationFingerprint)} and ${registrationState}='pending' and ${column(mapping.registration.table, mapping.registration.pendingReference)}=${sql.param(allocated.pendingReference, column(mapping.registration.table, mapping.registration.pendingReference))} and ${column(mapping.registration.table, mapping.registration.subjectId)} is null and ${column(mapping.registration.table, mapping.registration.retentionUntil)}=${sql.param(retentionInstant, column(mapping.registration.table, mapping.registration.retentionUntil))}`);
-	} else {
-		if (allocated.nativeSubjectId === void 0 || allocated.credentialId === void 0 || allocated.securityRevision === void 0 || allocated.identifierRevision === void 0 || allocated.credentialRevision === void 0) return {
-			receipt: prepare({ _tag: "Rejected" }, journal),
-			statements: []
-		};
-		const nativeSubjectId = allocated.nativeSubjectId;
-		desired = { _tag: "Registered" };
-		const i = mapping.identifier;
-		const s = mapping.subject;
-		const marker = `effect-auth-proof-guard:protected:${input.completion.input.continuationId}`;
-		if (target?._tag === "Reserved") statements.push(yield* assertion(and(existsSql(sql`select 1 from ${i.table} where
-          ${column(i.table, i.namespace)}=${sql.param(input.identifier.namespace, column(i.table, i.namespace))}
-          and ${column(i.table, i.value)}=${sql.param(input.identifier.value, column(i.table, i.value))}
-          and ${column(i.table, i.subjectId)}=${sql.param(target.nativeSubjectId, column(i.table, i.subjectId))}
-          and ${column(i.table, i.bindingRevision)}=${sql.param(target.bindingRevision, column(i.table, i.bindingRevision))}
-          and ${column(i.table, i.verifiedAt)} is null`), existsSql(sql`select 1 from ${s.table} where
-          ${column(s.table, s.id)}=${sql.param(target.nativeSubjectId, column(s.table, s.id))}
-          and ${column(s.table, s.securityRevision)}=${sql.param(target.securityRevision, column(s.table, s.securityRevision))}`)), marker));
-		statements.push(yield* statement(database.insert(mapping.subject.table).values(mapping.provisioning.encodeSubjectInsert(intent, {
-			nativeSubjectId,
-			securityRevision: allocated.securityRevision
-		}))), ...target?._tag === "Reserved" ? [yield* statement(database.update(i.table).set(updateValues([
-			[i.subjectId, nativeSubjectId],
-			[i.verifiedAt, mapping.encodeInstant(transitionMillis)],
-			[i.bindingRevision, allocated.identifierRevision]
-		])).where(and(eq(column(i.table, i.namespace), input.identifier.namespace), eq(column(i.table, i.value), input.identifier.value), eq(column(i.table, i.subjectId), target.nativeSubjectId), eq(column(i.table, i.bindingRevision), target.bindingRevision), sql`${column(i.table, i.verifiedAt)} is null`))), yield* statement(database.update(s.table).set(updateValues([[s.securityRevision, allocated.displacedSecurityRevision]])).where(and(eq(column(s.table, s.id), target.nativeSubjectId), eq(column(s.table, s.securityRevision), target.securityRevision))))] : [yield* statement(database.insert(i.table).values(driverValues(i.encodeVerifiedInsert({
-			identifier: input.identifier,
-			subjectId: nativeSubjectId,
-			verifiedAtMillis: transitionMillis,
-			bindingRevision: allocated.identifierRevision
-		}), [[i.verifiedAt, mapping.encodeInstant(transitionMillis)]])))], yield* statement(database.insert(mapping.credential.table).values(mapping.credential.encodeVerifiedInsert({
-			moduleId: input.moduleId,
-			subjectId: nativeSubjectId,
-			credentialId: allocated.credentialId,
-			identifier: input.identifier,
-			credentialRevision: allocated.credentialRevision
-		}))), yield* statement(database.insert(mapping.authorityCredential.table).values(mapping.authorityCredential.encodeInsert({
-			subjectId: nativeSubjectId,
-			credentialId: allocated.credentialId,
-			revision: allocated.credentialRevision
-		}))), yield* statement(database.insert(mapping.registration.table).values(driverValues(mapping.registration.encodeInsert(intent, {
-			state: "registered",
-			nativeSubjectId,
-			retentionUntilMillis: transitionMillis + mapping.retentionMillis
-		}), [[mapping.registration.retentionUntil, retentionInstant]]))));
-		const sId = column(mapping.subject.table, mapping.subject.id);
-		const sStatus = column(mapping.subject.table, mapping.subject.status);
-		const sRevision = column(mapping.subject.table, mapping.subject.securityRevision);
-		const iNamespace = column(mapping.identifier.table, mapping.identifier.namespace);
-		const iValue = column(mapping.identifier.table, mapping.identifier.value);
-		const iSubject = column(mapping.identifier.table, mapping.identifier.subjectId);
-		const iVerifiedAt = column(mapping.identifier.table, mapping.identifier.verifiedAt);
-		const iRevision = column(mapping.identifier.table, mapping.identifier.bindingRevision);
-		const cModule = column(mapping.credential.table, mapping.credential.moduleId);
-		const cSubject = column(mapping.credential.table, mapping.credential.subjectId);
-		const cId = column(mapping.credential.table, mapping.credential.credentialId);
-		const cNamespace = column(mapping.credential.table, mapping.credential.identifierNamespace);
-		const cValue = column(mapping.credential.table, mapping.credential.identifierValue);
-		const cRevision = column(mapping.credential.table, mapping.credential.credentialRevision);
-		const aSubject = column(mapping.authorityCredential.table, mapping.authorityCredential.subjectId);
-		const aId = column(mapping.authorityCredential.table, mapping.authorityCredential.credentialId);
-		const aRevision = column(mapping.authorityCredential.table, mapping.authorityCredential.revision);
-		applied = and(target?._tag === "Reserved" ? existsSql(sql`select 1 from ${s.table} where
-            ${sId}=${sql.param(target.nativeSubjectId, sId)}
-            and ${sRevision}=${sql.param(allocated.displacedSecurityRevision, sRevision)}`) : sql`true`, existsSql(sql`select 1 from ${mapping.subject.table} where ${sId}=${sql.param(nativeSubjectId, sId)} and ${sStatus}=${sql.param(mapping.subject.d1ActiveStatusValue, sStatus)} and ${sRevision}=${sql.param(allocated.securityRevision, sRevision)}`), existsSql(sql`select 1 from ${mapping.identifier.table} where ${iNamespace}=${sql.param(input.identifier.namespace, iNamespace)} and ${iValue}=${sql.param(input.identifier.value, iValue)} and ${iSubject}=${sql.param(nativeSubjectId, iSubject)} and ${iVerifiedAt}=${sql.param(mapping.encodeInstant(transitionMillis), iVerifiedAt)} and ${iRevision}=${sql.param(allocated.identifierRevision, iRevision)} and ${mapping.identifier.d1CurrentCondition({
-			identifier: input.identifier,
-			nativeSubjectId,
-			bindingRevision: allocated.identifierRevision
-		})}`), existsSql(sql`select 1 from ${mapping.credential.table} where ${cModule}=${sql.param(input.moduleId, cModule)} and ${cSubject}=${sql.param(nativeSubjectId, cSubject)} and ${cId}=${sql.param(allocated.credentialId, cId)} and ${cNamespace}=${sql.param(input.identifier.namespace, cNamespace)} and ${cValue}=${sql.param(input.identifier.value, cValue)} and ${cRevision}=${sql.param(allocated.credentialRevision, cRevision)} and ${column(mapping.credential.table, mapping.credential.status)}=${sql.param(mapping.credential.d1ActiveStatusValue, column(mapping.credential.table, mapping.credential.status))}`), existsSql(sql`select 1 from ${mapping.authorityCredential.table} where ${aSubject}=${sql.param(nativeSubjectId, aSubject)} and ${aId}=${sql.param(allocated.credentialId, aId)} and ${aRevision}=${sql.param(allocated.credentialRevision, aRevision)} and ${column(mapping.authorityCredential.table, mapping.authorityCredential.status)}=${sql.param(mapping.authorityCredential.d1ActiveStatusValue, column(mapping.authorityCredential.table, mapping.authorityCredential.status))}`), existsSql(sql`select 1 from ${mapping.registration.table} where ${registrationModule}=${sql.param(input.moduleId, registrationModule)} and ${registrationCommand}=${sql.param(input.commandId, registrationCommand)} and ${registrationFingerprint}=${sql.param(input.fingerprint, registrationFingerprint)} and ${registrationState}='registered' and ${column(mapping.registration.table, mapping.registration.subjectId)}=${sql.param(nativeSubjectId, column(mapping.registration.table, mapping.registration.subjectId))} and ${column(mapping.registration.table, mapping.registration.pendingReference)} is null and ${column(mapping.registration.table, mapping.registration.retentionUntil)}=${sql.param(retentionInstant, column(mapping.registration.table, mapping.registration.retentionUntil))}`));
-	}
-	let receipt;
-	const compiled = yield* compileD1ProofCompletionPlan(proofMapping, input.completion, {
-		statements,
-		appliedCondition: applied
-	}, (completion) => {
-		receipt = prepare(completion === "completed" ? desired : { _tag: "Rejected" }, journal);
-		return completion;
-	});
-	const marker = `effect-auth-proof-guard:protected:${input.completion.input.continuationId}`;
-	return {
-		receipt: receipt ?? prepare({ _tag: "Rejected" }, journal),
-		statements: compiled.statements,
-		retryable: (cause) => guardFailure(cause, marker) || isMappedConstraintConflict(mapping.isRequestConflict, cause) || mapping.mode === "atomic" && (isMappedConstraintConflict(mapping.isIdentifierConflict, cause) || isMappedConstraintConflict(mapping.isCredentialConflict, cause))
-	};
-});
-const makeRegistrationPlans = (mapping, proofMapping) => ({
-	inspect: (input) => mapping.inspect(input),
-	registerWithProof: (uncaptured, prepare) => Effect.gen(function* () {
-		const registration = yield* mapping.snapshotRegistration(uncaptured.registration);
-		const inspectionRegistration = yield* mapping.snapshotRegistration(uncaptured.registration);
-		const input = Object.freeze({
-			...uncaptured,
-			identifier: Object.freeze({ ...uncaptured.identifier }),
-			registration
-		});
-		const inspected = yield* mapping.inspect({
-			identifier: input.identifier,
-			registration: inspectionRegistration
-		});
-		const atomic = mapping.mode === "atomic";
-		const credentialId = atomic ? yield* allocate(mapping.allocateCredentialId, mapping.allocateCredentialIdSync) : void 0;
-		const securityRevision = atomic ? yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync) : void 0;
-		const displacedSecurityRevision = atomic ? yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync) : void 0;
-		const identifierRevision = atomic ? yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync) : void 0;
-		const credentialRevision = atomic ? yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync) : void 0;
-		const nativeSubjectId = atomic && mapping.provisioning.idMode !== "generated" ? yield* allocate(mapping.provisioning.allocateSubjectId, mapping.provisioning.allocateSubjectIdSync) : void 0;
-		const pendingReference = mapping.mode === "pending" ? yield* allocate(mapping.allocatePendingReference, mapping.allocatePendingReferenceSync) : void 0;
-		return yield* registrationPlan(mapping, proofMapping, input, inspected, {
-			...credentialId === void 0 ? {} : { credentialId },
-			...securityRevision === void 0 ? {} : { securityRevision },
-			...displacedSecurityRevision === void 0 ? {} : { displacedSecurityRevision },
-			...identifierRevision === void 0 ? {} : { identifierRevision },
-			...credentialRevision === void 0 ? {} : { credentialRevision },
-			...nativeSubjectId === void 0 ? {} : { nativeSubjectId },
-			...pendingReference === void 0 ? {} : { pendingReference }
-		}, prepare);
-	})
-});
-const makeD1EmailSignInServices = (mapping) => Effect.flatMap(nativeDatabase(Database), (database) => validateDrizzleStorage(mapping).pipe(Effect.provideService(NativeDatabase, database), Effect.mapError(unavailable), Effect.as({ emailSignInTargets: EmailSignInTargets.of({ lookup: (input) => {
-	if (!validEmailSignInConstraints(mapping)) return Effect.fail(unavailable());
-	return emailLookupRows(mapping, input.moduleId, input.identifier).pipe(Effect.flatMap((rows) => {
-		const row = rows[0];
-		if (row === void 0) return Effect.succeed(Option.none());
-		return decodeEmailSnapshot(mapping, input.moduleId, input.identifier, row).pipe(Effect.map((snapshot) => snapshot === void 0 ? Option.none() : Option.some(snapshot)));
-	}), Effect.provideService(CurrentD1PlanningDatabase, database), translateFailure);
-} }) })));
-const makeD1EmailAddressServices = Effect.fnUntraced(function* (mapping, proofMapping) {
-	const database = yield* Database;
-	yield* validateDrizzleStorage({
-		...mapping,
-		proof: proofMapping
-	}).pipe(Effect.provideServiceEffect(NativeDatabase, nativeDatabase(Database)), Effect.mapError(unavailable));
-	const hooks = yield* LifecycleHooks;
-	const plans = makeAddressPlans(mapping, proofMapping);
-	const run = (plan) => Effect.gen(function* () {
-		if (yield* hasCommitScope) return yield* unavailable();
-		return yield* executeStandalone(plan, 2);
-	}).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(CurrentEmailSql, database), Effect.provideService(LifecycleHooks, hooks));
-	return { emailAddressPersistence: {
-		target: (input) => plans.target(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(CurrentEmailSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
-		checkCompletion: (input) => plans.checkCompletion(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(CurrentEmailSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
-		verifyWithProof: (input, prepare) => run(plans.verifyWithProof(input, prepare)).pipe(translateFailure),
-		changeWithProof: (input, prepare) => run(plans.changeWithProof(input, prepare)).pipe(translateFailure),
-		cleanup: (input, prepare) => run(plans.cleanup(input, prepare)).pipe(translateFailure)
-	} };
-});
-const makeD1EmailRegistrationServices = Effect.fnUntraced(function* (mapping, proofMapping) {
-	const database = yield* Database;
-	yield* validateDrizzleStorage({
-		...mapping,
-		proof: proofMapping
-	}).pipe(Effect.provideServiceEffect(NativeDatabase, nativeDatabase(Database)), Effect.mapError(unavailable));
-	const hooks = yield* LifecycleHooks;
-	const plans = makeRegistrationPlans(mapping, proofMapping);
-	const run = (plan) => Effect.gen(function* () {
-		if (yield* hasCommitScope) return yield* unavailable();
-		return yield* executeStandalone(plan, 2);
-	}).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(CurrentEmailSql, database), Effect.provideService(LifecycleHooks, hooks));
-	return { registrationAuthority: {
-		inspect: (input) => plans.inspect(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(CurrentEmailSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
-		registerWithProof: (input, prepare) => run(plans.registerWithProof(input, prepare)).pipe(translateFailure)
-	} };
-});
-function coordinateD1EmailAddress(acquire, options, body) {
-	return Effect.flatMap(nativeDatabase(acquire), (database) => Effect.gen(function* () {
-		yield* validateDrizzleStorage({
-			...options.mapping,
-			proof: options.proofMapping
-		}).pipe(Effect.mapError(unavailable));
-		const hooks = yield* LifecycleHooks;
-		if (yield* hasCommitScope) return yield* unavailable();
-		return (yield* coordinateCommit(() => Effect.gen(function* () {
-			const statements = [];
-			let mutation;
-			const nativeCollector = D1BatchStatements.of({ append: (statement) => Effect.sync(() => statements.push(statement)) });
-			const owner = yield* makeD1Owner(unavailable()).pipe(Effect.provideService(D1BatchStatements, nativeCollector));
-			const plans = makeAddressPlans(options.mapping, options.proofMapping);
-			const run = (plan) => coordinateCommit(() => Effect.gen(function* () {
-				const journal = yield* CurrentCommitJournal;
-				const planned = yield* plan;
-				yield* owner.check;
-				if (mutation !== void 0) return yield* unavailable();
-				const guarded = {
-					...planned,
-					journalGuard: journal.prepare(void 0)
-				};
-				mutation = guarded;
-				statements.push(...guarded.statements);
-				return guarded.receipt;
-			}), { mode: "batch" }).pipe(Effect.map((result) => result.value), Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(CurrentEmailSql, database), Effect.provideService(LifecycleHooks, hooks));
-			const provided = Context.make(EmailAddressPersistence, {
-				target: (input) => owner.run(plans.target(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(CurrentEmailSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure)),
-				checkCompletion: (input) => owner.run(plans.checkCompletion(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(CurrentEmailSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure)),
-				verifyWithProof: (input, prepare) => owner.run(run(plans.verifyWithProof(input, prepare)).pipe(translateFailure)),
-				changeWithProof: (input, prepare) => owner.run(run(plans.changeWithProof(input, prepare)).pipe(translateFailure)),
-				cleanup: (input, prepare) => owner.run(run(plans.cleanup(input, prepare)).pipe(translateFailure))
-			}).pipe(Context.add(D1BatchStatements, owner.collector));
-			const value = yield* owner.close(Effect.provideContext(body, provided));
-			if (mutation?.journalGuard !== void 0) {
-				const status = yield* Effect.result(mutation.journalGuard.read);
-				if (status._tag === "Success" || status.failure._tag !== "CommitPending") return yield* unavailable();
-			}
-			yield* database.$client.batch(statements).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, (error) => everyFailureMatches(cause, mutation?.retryable) ? unavailable() : error))), translateFailure);
-			return value;
-		}), { mode: "batch" }).pipe(Effect.provideService(LifecycleHooks, hooks))).value;
-	}).pipe(Effect.provideService(NativeDatabase, database)));
-}
-function coordinateD1EmailRegistration(acquire, options, body) {
-	return Effect.flatMap(nativeDatabase(acquire), (database) => Effect.gen(function* () {
-		yield* validateDrizzleStorage({
-			...options.mapping,
-			proof: options.proofMapping
-		}).pipe(Effect.mapError(unavailable));
-		const hooks = yield* LifecycleHooks;
-		if (yield* hasCommitScope) return yield* unavailable();
-		return (yield* coordinateCommit(() => Effect.gen(function* () {
-			const statements = [];
-			let mutation;
-			const nativeCollector = D1BatchStatements.of({ append: (statement) => Effect.sync(() => statements.push(statement)) });
-			const owner = yield* makeD1Owner(unavailable()).pipe(Effect.provideService(D1BatchStatements, nativeCollector));
-			const plans = makeRegistrationPlans(options.mapping, options.proofMapping);
-			const run = (plan) => coordinateCommit(() => Effect.gen(function* () {
-				const journal = yield* CurrentCommitJournal;
-				const planned = yield* plan;
-				yield* owner.check;
-				if (mutation !== void 0) return yield* unavailable();
-				const guarded = {
-					...planned,
-					journalGuard: journal.prepare(void 0)
-				};
-				mutation = guarded;
-				statements.push(...guarded.statements);
-				return guarded.receipt;
-			}), { mode: "batch" }).pipe(Effect.map((result) => result.value), Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(CurrentEmailSql, database), Effect.provideService(LifecycleHooks, hooks));
-			const provided = Context.make(options.target, {
-				inspect: (input) => owner.run(plans.inspect(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(CurrentEmailSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure)),
-				registerWithProof: (input, prepare) => owner.run(run(plans.registerWithProof(input, prepare)).pipe(translateFailure))
-			}).pipe(Context.add(D1BatchStatements, owner.collector));
-			const value = yield* owner.close(Effect.provideContext(body, provided));
-			if (mutation?.journalGuard !== void 0) {
-				const status = yield* Effect.result(mutation.journalGuard.read);
-				if (status._tag === "Success" || status.failure._tag !== "CommitPending") return yield* unavailable();
-			}
-			yield* database.$client.batch(statements).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, (error) => everyFailureMatches(cause, mutation?.retryable) ? unavailable() : error))), translateFailure);
-			return value;
-		}), { mode: "batch" }).pipe(Effect.provideService(LifecycleHooks, hooks))).value;
-	}).pipe(Effect.provideService(NativeDatabase, database)));
-}
-const translateFailure = (effect) => reportPersistenceFailure(effect, (error) => Schema.is(EmailUnavailable)(error) || Schema.is(ProofUnavailable)(error) || Schema.is(HookConfigurationError)(error)).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));
-const executeStandalone = (plan, retries = 2) => Effect.suspend(() => {
-	let retryable;
-	return coordinateCommit(() => Effect.gen(function* () {
-		const database = yield* CurrentD1PlanningDatabase;
-		const planned = yield* plan;
-		retryable = planned.retryable;
-		yield* database.$client.batch(planned.statements);
-		return planned.receipt;
-	}), { mode: "batch" }).pipe(Effect.map((result) => result.value)).pipe(Effect.catchCause((cause) => retries > 0 && everyFailureMatches(cause, retryable) ? executeStandalone(plan, retries - 1) : Effect.failCause(cause)));
-});
-//#endregion
-export { coordinateD1EmailAddress, coordinateD1EmailRegistration, makeD1EmailAddressServices, makeD1EmailRegistrationServices, makeD1EmailSignInServices };
-
-//# sourceMappingURL=d1-emails.mjs.map