@yielded/auth-persistence 0.1.0-beta.10

package/dist/internal/proof-kernel.mjs

@@ -0,0 +1,619 @@
+import { PersistenceMappingError } from "./mapping-error.mjs";
+import { requiredProofConstraints } from "./models/proof-model.mjs";
+import { CurrentPasswordPreparedTransaction, PasswordPreparedPostconditions } from "./PasswordPreparedPostconditions.mjs";
+import { Cause, Context, DateTime, Effect, Option, Schema } from "effect";
+import { CurrentCommitJournal, HookConfigurationError, LifecycleHooks, coordinateCommit, hasCommitScope } from "@yielded/auth/Hooks";
+import { reportPersistenceFailure } from "@yielded/auth/Persistence";
+import { ProofBinding, ProofPersistence, ProofRequestConflict, ProofUnavailable } from "@yielded/auth/Proofs";
+//#region src/internal/proof-kernel.ts
+var CurrentProofSql = class extends Context.Service()("effect-auth/CurrentProofSql") {};
+const makeProofKernel = (operations) => {
+	const { and, eq, gte, inArray, isNull, lte, notExists, sql, column, updateValues } = operations;
+	const unavailable = () => ProofUnavailable.make({});
+	const translateFailure = (effect) => reportPersistenceFailure(effect, (error) => Schema.is(ProofUnavailable)(error) || Schema.is(HookConfigurationError)(error)).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));
+	const translateIssueFailure = (effect) => reportPersistenceFailure(effect, (error) => Schema.is(ProofUnavailable)(error) || Schema.is(ProofRequestConflict)(error) || Schema.is(HookConfigurationError)(error)).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, (error) => Schema.is(ProofRequestConflict)(error) ? error : unavailable()))));
+	const conflict = () => ProofRequestConflict.make({});
+	const validConstraints = (mapping) => Object.entries(requiredProofConstraints).every(([key, value]) => mapping.constraints[key] === value);
+	const selectRows = (query, locking) => locking && typeof query.for === "function" ? query.for("update") : query;
+	const allocateVersion = (mapping, mode) => {
+		if (mode === "synchronous") return mapping.allocateVersionSync === void 0 ? Effect.fail(unavailable()) : Effect.try({
+			try: mapping.allocateVersionSync,
+			catch: (cause) => new PersistenceMappingError({
+				operation: "mapping",
+				cause
+			})
+		});
+		if (mapping.allocateVersion !== void 0) return mapping.allocateVersion;
+		return mapping.allocateVersionSync === void 0 ? Effect.fail(unavailable()) : Effect.try({
+			try: mapping.allocateVersionSync,
+			catch: (cause) => new PersistenceMappingError({
+				operation: "mapping",
+				cause
+			})
+		});
+	};
+	const canonicalBinding = Schema.encodeSync(Schema.fromJsonString(ProofBinding));
+	const sameBinding = (left, right) => canonicalBinding(left) === canonicalBinding(right);
+	const requestColumns = (mapping) => ({
+		moduleId: column(mapping.request.table, mapping.request.moduleId),
+		requestId: column(mapping.request.table, mapping.request.requestId),
+		fingerprint: column(mapping.request.table, mapping.request.fingerprint),
+		proofId: column(mapping.request.table, mapping.request.proofId),
+		retentionUntil: column(mapping.request.table, mapping.request.retentionUntil)
+	});
+	const seriesColumns = (mapping) => ({
+		moduleId: column(mapping.series.table, mapping.series.moduleId),
+		purpose: column(mapping.series.table, mapping.series.purpose),
+		scopeKey: column(mapping.series.table, mapping.series.scopeKey),
+		activeProofId: column(mapping.series.table, mapping.series.activeProofId),
+		lastIssueAt: column(mapping.series.table, mapping.series.lastIssueAt),
+		version: column(mapping.series.table, mapping.series.version)
+	});
+	const generationColumns = (mapping) => ({
+		moduleId: column(mapping.generation.table, mapping.generation.moduleId),
+		purpose: column(mapping.generation.table, mapping.generation.purpose),
+		proofId: column(mapping.generation.table, mapping.generation.proofId),
+		requestId: column(mapping.generation.table, mapping.generation.requestId),
+		seriesKey: column(mapping.generation.table, mapping.generation.seriesKey),
+		deliveryId: column(mapping.generation.table, mapping.generation.deliveryId),
+		verifierKeyId: column(mapping.generation.table, mapping.generation.verifierKeyId),
+		verifierDigest: column(mapping.generation.table, mapping.generation.verifierDigest),
+		issuedAt: column(mapping.generation.table, mapping.generation.issuedAt),
+		expiresAt: column(mapping.generation.table, mapping.generation.expiresAt),
+		version: column(mapping.generation.table, mapping.generation.version),
+		state: column(mapping.generation.table, mapping.generation.state),
+		sendCount: column(mapping.generation.table, mapping.generation.sendCount),
+		deliveryState: column(mapping.generation.table, mapping.generation.deliveryState),
+		claimVersion: column(mapping.generation.table, mapping.generation.claimVersion),
+		claimDeadline: column(mapping.generation.table, mapping.generation.claimDeadline),
+		retryAt: column(mapping.generation.table, mapping.generation.retryAt),
+		deliveryRetryMillis: column(mapping.generation.table, mapping.generation.deliveryRetryMillis),
+		retentionUntil: column(mapping.generation.table, mapping.generation.retentionUntil)
+	});
+	const continuationColumns = (mapping) => ({
+		moduleId: column(mapping.continuation.table, mapping.continuation.moduleId),
+		purpose: column(mapping.continuation.table, mapping.continuation.purpose),
+		continuationId: column(mapping.continuation.table, mapping.continuation.continuationId),
+		digest: column(mapping.continuation.table, mapping.continuation.digest),
+		proofId: column(mapping.continuation.table, mapping.continuation.proofId),
+		seriesKey: column(mapping.continuation.table, mapping.continuation.seriesKey),
+		expiresAt: column(mapping.continuation.table, mapping.continuation.expiresAt),
+		consumed: column(mapping.continuation.table, mapping.continuation.consumed),
+		version: column(mapping.continuation.table, mapping.continuation.version),
+		retentionUntil: column(mapping.continuation.table, mapping.continuation.retentionUntil)
+	});
+	const scopeColumns = (mapping) => ({
+		moduleId: column(mapping.rateScope.table, mapping.rateScope.moduleId),
+		purpose: column(mapping.rateScope.table, mapping.rateScope.purpose),
+		action: column(mapping.rateScope.table, mapping.rateScope.action),
+		scopeKind: column(mapping.rateScope.table, mapping.rateScope.scopeKind),
+		scopeKey: column(mapping.rateScope.table, mapping.rateScope.scopeKey)
+	});
+	const abuseColumns = (mapping) => ({
+		moduleId: column(mapping.abuseEvent.table, mapping.abuseEvent.moduleId),
+		purpose: column(mapping.abuseEvent.table, mapping.abuseEvent.purpose),
+		action: column(mapping.abuseEvent.table, mapping.abuseEvent.action),
+		scopeKind: column(mapping.abuseEvent.table, mapping.abuseEvent.scopeKind),
+		scopeKey: column(mapping.abuseEvent.table, mapping.abuseEvent.scopeKey),
+		commandId: column(mapping.abuseEvent.table, mapping.abuseEvent.commandId),
+		occurredAt: column(mapping.abuseEvent.table, mapping.abuseEvent.occurredAt),
+		retentionUntil: column(mapping.abuseEvent.table, mapping.abuseEvent.retentionUntil)
+	});
+	const failureColumns = (mapping) => ({
+		moduleId: column(mapping.failureEvent.table, mapping.failureEvent.moduleId),
+		purpose: column(mapping.failureEvent.table, mapping.failureEvent.purpose),
+		seriesKey: column(mapping.failureEvent.table, mapping.failureEvent.seriesKey),
+		commandId: column(mapping.failureEvent.table, mapping.failureEvent.commandId),
+		occurredAt: column(mapping.failureEvent.table, mapping.failureEvent.occurredAt),
+		retentionUntil: column(mapping.failureEvent.table, mapping.failureEvent.retentionUntil)
+	});
+	const commandColumns = (mapping) => ({
+		moduleId: column(mapping.command.table, mapping.command.moduleId),
+		commandId: column(mapping.command.table, mapping.command.commandId),
+		kind: column(mapping.command.table, mapping.command.kind),
+		decision: column(mapping.command.table, mapping.command.decision),
+		retentionUntil: column(mapping.command.table, mapping.command.retentionUntil)
+	});
+	const nowMillis = DateTime.now.pipe(Effect.map(DateTime.toEpochMillis));
+	const lockAuthority = Effect.fn("DrizzleProof.lockAuthority")(function* (mapping, moduleId, purpose, binding, locking) {
+		const database = yield* CurrentProofSql;
+		const authority = mapping.authority;
+		let nativeSubjectId;
+		if (binding._tag !== "Identifier") {
+			if (authority.subject === void 0 || authority.credential === void 0 || authority.subjectId === void 0) return yield* unavailable();
+			nativeSubjectId = yield* authority.subjectId.toNative(binding.revision.subjectId);
+			const subject = authority.subject;
+			const row = (yield* selectRows(database.select().from(subject.table).where(eq(column(subject.table, subject.id), nativeSubjectId)).limit(1), locking))[0];
+			if (row === void 0 || !subject.isActiveStatus(row[subject.status]) || row[subject.securityRevision] !== binding.revision.securityRevision) return false;
+		}
+		const identifier = authority.identifier;
+		const identifierRows = yield* selectRows(database.select().from(identifier.table).where(and(eq(column(identifier.table, identifier.namespace), binding.identifier.namespace), eq(column(identifier.table, identifier.value), binding.identifier.value))), locking);
+		if (!identifier.isCurrent({
+			moduleId,
+			purpose,
+			binding,
+			...nativeSubjectId === void 0 ? {} : { nativeSubjectId }
+		}, identifierRows)) return false;
+		if (binding._tag === "Identifier") return true;
+		const credential = authority.credential;
+		const expected = [...binding.revision.credentials].sort((a, b) => a.credentialId.localeCompare(b.credentialId));
+		const rows = expected.length === 0 ? [] : yield* selectRows(database.select().from(credential.table).where(and(eq(column(credential.table, credential.subjectId), nativeSubjectId), inArray(column(credential.table, credential.credentialId), expected.map((item) => item.credentialId)))), locking);
+		if (rows.length !== expected.length) return false;
+		return rows.map((row) => ({
+			credentialId: row[credential.credentialId],
+			revision: row[credential.revision],
+			active: credential.status === void 0 || credential.isActiveStatus?.(row[credential.status]) === true
+		})).sort((a, b) => a.credentialId.localeCompare(b.credentialId)).every((item, index) => item.active && item.credentialId === expected[index]?.credentialId && item.revision === expected[index]?.revision);
+	});
+	const scopeEntries = (keys, binding, action, policy) => {
+		const suffix = action === "issue" ? "Issues" : "Attempts";
+		const simple = action === "issue" ? "issues" : "attempts";
+		const entries = [{
+			kind: "action",
+			key: "*",
+			budget: policy.abuse[`action${suffix}`]
+		}, {
+			kind: "identifier",
+			key: keys.identifier,
+			budget: policy.abuse[simple]
+		}];
+		if (binding._tag !== "Identifier") entries.push({
+			kind: "subject",
+			key: keys.subject,
+			budget: policy.abuse[`subject${suffix}`]
+		});
+		return entries;
+	};
+	const lockScopes = Effect.fn("DrizzleProof.lockScopes")(function* (mapping, configuration, moduleId, purpose, action, entries) {
+		const database = yield* CurrentProofSql;
+		const c = scopeColumns(mapping);
+		for (const entry of entries) {
+			const values = mapping.rateScope.encodeInsert({
+				moduleId,
+				purpose,
+				action,
+				scopeKind: entry.kind,
+				scopeKey: entry.key
+			});
+			const query = database.insert(mapping.rateScope.table).values(values);
+			yield* configuration.insertIfAbsent(query, mapping.rateScope.scopeKey, entry.key);
+			yield* selectRows(database.select().from(mapping.rateScope.table).where(and(eq(c.moduleId, moduleId), eq(c.purpose, purpose), eq(c.action, action), eq(c.scopeKind, entry.kind), eq(c.scopeKey, entry.key))).limit(1), configuration.locking);
+		}
+	});
+	const admittedScopes = Effect.fn("DrizzleProof.admittedScopes")(function* (mapping, moduleId, purpose, action, entries, now) {
+		const database = yield* CurrentProofSql;
+		const c = abuseColumns(mapping);
+		const admitted = [];
+		for (const entry of entries) if ((yield* selectRows(database.select({ commandId: c.commandId }).from(mapping.abuseEvent.table).where(and(eq(c.moduleId, moduleId), eq(c.purpose, purpose), eq(c.action, action), eq(c.scopeKind, entry.kind), eq(c.scopeKey, entry.key), gte(c.occurredAt, mapping.encodeInstant(now - entry.budget.windowMillis)))).limit(entry.budget.limit), true)).length < entry.budget.limit) admitted.push(entry);
+		return admitted;
+	});
+	const insertScopeEvents = Effect.fn("Drizzle.insertScopeEvents")(function* (mapping, moduleId, purpose, action, commandId, entries, now, retentionUntil) {
+		const database = yield* CurrentProofSql;
+		return yield* Effect.forEach(entries, (entry) => database.insert(mapping.abuseEvent.table).values(mapping.abuseEvent.encodeInsert({
+			moduleId,
+			purpose,
+			action,
+			scopeKind: entry.kind,
+			scopeKey: entry.key,
+			commandId,
+			occurredAtMillis: now,
+			retentionUntilMillis: retentionUntil
+		})), { discard: true });
+	});
+	const ensureSeries = Effect.fn("DrizzleProof.ensureSeries")(function* (mapping, configuration, moduleId, purpose, scopeKey) {
+		const database = yield* CurrentProofSql;
+		const c = seriesColumns(mapping);
+		const initialVersion = yield* allocateVersion(mapping, configuration.mode);
+		const query = database.insert(mapping.series.table).values(mapping.series.encodeInsert({
+			moduleId,
+			purpose,
+			scopeKey,
+			version: initialVersion
+		}));
+		yield* configuration.insertIfAbsent(query, mapping.series.scopeKey, scopeKey);
+		return (yield* selectRows(database.select().from(mapping.series.table).where(and(eq(c.moduleId, moduleId), eq(c.purpose, purpose), eq(c.scopeKey, scopeKey))).limit(1), configuration.locking))[0] ?? (yield* unavailable());
+	});
+	const readGeneration = Effect.fn("Drizzle.readGeneration")(function* (mapping, moduleId, proofId, locking) {
+		const database = yield* CurrentProofSql;
+		const c = generationColumns(mapping);
+		return yield* selectRows(database.select().from(mapping.generation.table).where(and(eq(c.moduleId, moduleId), eq(c.proofId, proofId))).limit(1), locking);
+	});
+	const failureCount = Effect.fn("DrizzleProof.failureCount")(function* (mapping, moduleId, purpose, seriesKey, now, policy) {
+		const database = yield* CurrentProofSql;
+		const c = failureColumns(mapping);
+		return (yield* selectRows(database.select({ commandId: c.commandId }).from(mapping.failureEvent.table).where(and(eq(c.moduleId, moduleId), eq(c.purpose, purpose), eq(c.seriesKey, seriesKey), gte(c.occurredAt, mapping.encodeInstant(now - policy.abuse.attempts.windowMillis)))).limit(policy.maximumFailedAttempts), true)).length;
+	});
+	const commandRow = Effect.fn("Drizzle.commandRow")(function* (mapping, moduleId, commandId, locking) {
+		const database = yield* CurrentProofSql;
+		const c = commandColumns(mapping);
+		return yield* selectRows(database.select().from(mapping.command.table).where(and(eq(c.moduleId, moduleId), eq(c.commandId, commandId))).limit(1), locking);
+	});
+	const insertCommand = Effect.fn("Drizzle.insertCommand")(function* (mapping, moduleId, commandId, kind, decision, retentionUntil) {
+		return yield* (yield* CurrentProofSql).insert(mapping.command.table).values(mapping.command.encodeInsert({
+			moduleId,
+			commandId,
+			kind,
+			decision,
+			retentionUntilMillis: retentionUntil
+		}));
+	});
+	const owned = (database, mapping, configuration, body) => {
+		if (!validConstraints(mapping)) return Effect.fail(unavailable());
+		const run = coordinateCommit(() => database.transaction((transaction) => body.pipe(Effect.provideService(CurrentProofSql, transaction))), { mode: configuration.mode }).pipe(Effect.map((result) => result.value));
+		return configuration.coordinated !== true ? Effect.gen(function* () {
+			if (yield* hasCommitScope) return yield* unavailable();
+			yield* configuration.standaloneGuard;
+			return yield* run;
+		}) : run;
+	};
+	const makeSqlProofPersistence = Effect.fn("makeSqlProofPersistence")(function* (database, mapping, configuration) {
+		const hooks = yield* LifecycleHooks;
+		return ProofPersistence.of({
+			issue: (input, prepare) => owned(database, mapping, configuration, Effect.gen(function* () {
+				const transaction = yield* CurrentProofSql;
+				const journal = yield* CurrentCommitJournal;
+				const keys = mapping.scopeKeys({
+					moduleId: input.record.moduleId,
+					purpose: input.record.purpose,
+					binding: input.record.binding
+				});
+				const authorityCurrent = yield* lockAuthority(mapping, input.record.moduleId, input.record.purpose, input.record.binding, configuration.locking);
+				const scopes = scopeEntries(keys, input.record.binding, "issue", input.policy);
+				yield* lockScopes(mapping, configuration, input.record.moduleId, input.record.purpose, "issue", scopes.slice(0, 1));
+				const actionNow = yield* nowMillis;
+				const actionOpen = (yield* admittedScopes(mapping, input.record.moduleId, input.record.purpose, "issue", scopes.slice(0, 1), actionNow)).length === 1;
+				if (actionOpen) yield* lockScopes(mapping, configuration, input.record.moduleId, input.record.purpose, "issue", scopes.slice(1));
+				const series = actionOpen ? yield* ensureSeries(mapping, configuration, input.record.moduleId, input.record.purpose, keys.series) : void 0;
+				const now = yield* nowMillis;
+				const retentionUntil = now + input.policy.requestRetentionMillis;
+				const rc = requestColumns(mapping);
+				let requestRows = yield* selectRows(transaction.select().from(mapping.request.table).where(and(eq(rc.moduleId, input.record.moduleId), eq(rc.requestId, input.record.requestId))).limit(1), configuration.locking);
+				let request = requestRows[0];
+				if (request !== void 0) {
+					if ((yield* mapping.decodeInstant(request[mapping.request.retentionUntil])) > now) {
+						if (request[mapping.request.fingerprint] !== input.record.fingerprint) return yield* conflict();
+						return prepare({
+							_tag: "Existing",
+							receipt: yield* mapping.request.decodeReceipt(request)
+						}, journal);
+					}
+					yield* transaction.delete(mapping.request.table).where(and(eq(rc.moduleId, input.record.moduleId), eq(rc.requestId, input.record.requestId), lte(rc.retentionUntil, mapping.encodeInstant(now))));
+				}
+				const requestInsert = mapping.request.encodeInsert({
+					record: input.record,
+					createdAtMillis: now,
+					retentionUntilMillis: retentionUntil
+				});
+				const requestQuery = transaction.insert(mapping.request.table).values(requestInsert);
+				yield* configuration.insertIfAbsent(requestQuery, mapping.request.requestId, input.record.requestId);
+				requestRows = yield* selectRows(transaction.select().from(mapping.request.table).where(and(eq(rc.moduleId, input.record.moduleId), eq(rc.requestId, input.record.requestId))).limit(1), configuration.locking);
+				request = requestRows[0];
+				if (request === void 0) return yield* unavailable();
+				if (request[mapping.request.fingerprint] !== input.record.fingerprint) return yield* conflict();
+				if (request[mapping.request.proofId] !== input.record.proofId) return prepare({
+					_tag: "Existing",
+					receipt: yield* mapping.request.decodeReceipt(request)
+				}, journal);
+				const admitted = actionOpen ? yield* admittedScopes(mapping, input.record.moduleId, input.record.purpose, "issue", scopes, now) : [];
+				const sc = seriesColumns(mapping);
+				const lastIssueAt = series?.[mapping.series.lastIssueAt] === null || series?.[mapping.series.lastIssueAt] === void 0 ? void 0 : yield* mapping.decodeInstant(series[mapping.series.lastIssueAt]);
+				const activeProofId = series?.[mapping.series.activeProofId];
+				const supersedesCurrent = input.supersedes === void 0 || input.supersedes === activeProofId;
+				const allowed = authorityCurrent && input.eligible && admitted.length === scopes.length && input.record.issuedAtMillis <= now && input.record.expiresAtMillis > now && supersedesCurrent && (lastIssueAt === void 0 || now - lastIssueAt >= input.policy.abuse.resendCooldownMillis);
+				const receipt = {
+					requestId: input.record.requestId,
+					reference: {
+						proofId: input.record.proofId,
+						purpose: input.record.purpose,
+						keyId: input.record.verifier.keyId
+					}
+				};
+				const prepared = prepare(allowed ? {
+					_tag: "Issued",
+					record: input.record
+				} : {
+					_tag: "Suppressed",
+					receipt
+				}, journal);
+				if (admitted.length > 0) yield* insertScopeEvents(mapping, input.record.moduleId, input.record.purpose, "issue", input.record.requestId, admitted, now, retentionUntil);
+				if (!allowed) return prepared;
+				if (activeProofId !== null && activeProofId !== void 0) yield* transaction.update(mapping.generation.table).set(updateValues([[mapping.generation.state, "superseded"]])).where(and(eq(generationColumns(mapping).moduleId, input.record.moduleId), eq(generationColumns(mapping).proofId, activeProofId), eq(generationColumns(mapping).state, "active")));
+				yield* transaction.insert(mapping.generation.table).values(mapping.generation.encodeInsert({
+					record: input.record,
+					seriesKey: keys.series,
+					retentionUntilMillis: retentionUntil,
+					state: "active",
+					deliveryState: "new",
+					policy: input.policy
+				}));
+				const nextVersion = yield* allocateVersion(mapping, configuration.mode);
+				yield* transaction.update(mapping.series.table).set(updateValues([
+					[mapping.series.activeProofId, input.record.proofId],
+					[mapping.series.lastIssueAt, mapping.encodeInstant(now)],
+					[mapping.series.version, nextVersion]
+				])).where(and(eq(sc.moduleId, input.record.moduleId), eq(sc.purpose, input.record.purpose), eq(sc.scopeKey, keys.series)));
+				return prepared;
+			})).pipe(Effect.provideService(CurrentProofSql, database), Effect.provideService(LifecycleHooks, hooks), translateIssueFailure),
+			attempt: (input, prepare) => owned(database, mapping, configuration, Effect.gen(function* () {
+				const transaction = yield* CurrentProofSql;
+				const journal = yield* CurrentCommitJournal;
+				const keys = mapping.scopeKeys({
+					moduleId: input.moduleId,
+					purpose: input.purpose,
+					binding: input.binding
+				});
+				const authorityCurrent = yield* lockAuthority(mapping, input.moduleId, input.purpose, input.binding, configuration.locking);
+				const scopes = scopeEntries(keys, input.binding, "attempt", input.policy);
+				yield* lockScopes(mapping, configuration, input.moduleId, input.purpose, "attempt", scopes.slice(0, 1));
+				const actionNow = yield* nowMillis;
+				const actionOpen = (yield* admittedScopes(mapping, input.moduleId, input.purpose, "attempt", scopes.slice(0, 1), actionNow)).length === 1;
+				if (actionOpen) yield* lockScopes(mapping, configuration, input.moduleId, input.purpose, "attempt", scopes.slice(1));
+				const series = actionOpen ? yield* ensureSeries(mapping, configuration, input.moduleId, input.purpose, keys.series) : void 0;
+				const generation = (yield* readGeneration(mapping, input.moduleId, input.proofId, configuration.locking))[0];
+				const existingCommand = (yield* commandRow(mapping, input.moduleId, input.continuationId, configuration.locking))[0];
+				if (existingCommand !== void 0) {
+					if (existingCommand[mapping.command.decision] === "rejected") return prepare({ _tag: "Rejected" }, journal);
+					return yield* unavailable();
+				}
+				const now = yield* nowMillis;
+				const admitted = actionOpen ? yield* admittedScopes(mapping, input.moduleId, input.purpose, "attempt", scopes, now) : [];
+				const failures = yield* failureCount(mapping, input.moduleId, input.purpose, keys.series, now, input.policy);
+				const gc = generationColumns(mapping);
+				const activeProofId = series?.[mapping.series.activeProofId];
+				const storedBinding = generation === void 0 ? void 0 : yield* mapping.generation.decodeBinding(generation);
+				const candidateMatches = generation !== void 0 && input.candidate !== void 0 && generation[mapping.generation.verifierKeyId] === input.candidate.keyId && generation[mapping.generation.verifierDigest] === input.candidate.digest;
+				const currentGeneration = generation !== void 0 && generation[mapping.generation.purpose] === input.purpose && generation[mapping.generation.state] === "active" && activeProofId === input.proofId && storedBinding !== void 0 && sameBinding(storedBinding, input.binding) && Number(yield* mapping.decodeInstant(generation[mapping.generation.expiresAt])) > now;
+				const accepted = authorityCurrent && currentGeneration && candidateMatches && admitted.length === scopes.length && failures < input.policy.maximumFailedAttempts;
+				const retentionUntil = now + input.policy.requestRetentionMillis;
+				if (!accepted) {
+					const prepared = prepare({ _tag: "Rejected" }, journal);
+					yield* insertCommand(mapping, input.moduleId, input.continuationId, "attempt", "rejected", retentionUntil);
+					yield* insertScopeEvents(mapping, input.moduleId, input.purpose, "attempt", input.continuationId, admitted, now, retentionUntil);
+					if (admitted.length === scopes.length && currentGeneration && !candidateMatches && failures < input.policy.maximumFailedAttempts) yield* transaction.insert(mapping.failureEvent.table).values(mapping.failureEvent.encodeInsert({
+						moduleId: input.moduleId,
+						purpose: input.purpose,
+						seriesKey: keys.series,
+						commandId: input.continuationId,
+						occurredAtMillis: now,
+						retentionUntilMillis: retentionUntil
+					}));
+					return prepared;
+				}
+				const version = yield* allocateVersion(mapping, configuration.mode);
+				const expiresAt = Math.min(Number(yield* mapping.decodeInstant(generation[mapping.generation.expiresAt])), now + input.policy.continuationLifetimeMillis);
+				const continuation = {
+					moduleId: input.moduleId,
+					purpose: input.purpose,
+					continuationId: input.continuationId,
+					digest: input.continuationDigest,
+					proofId: input.proofId,
+					seriesKey: keys.series,
+					binding: input.binding,
+					expiresAtMillis: expiresAt,
+					version
+				};
+				const prepared = prepare({
+					_tag: "Accepted",
+					continuation: {
+						continuationId: input.continuationId,
+						purpose: input.purpose,
+						expiresAtMillis: expiresAt
+					}
+				}, journal);
+				yield* insertCommand(mapping, input.moduleId, input.continuationId, "attempt", "accepted", retentionUntil);
+				yield* insertScopeEvents(mapping, input.moduleId, input.purpose, "attempt", input.continuationId, scopes, now, retentionUntil);
+				yield* transaction.update(mapping.generation.table).set(updateValues([[mapping.generation.state, "consumed"]])).where(and(eq(gc.moduleId, input.moduleId), eq(gc.proofId, input.proofId), eq(gc.state, "active")));
+				yield* transaction.insert(mapping.continuation.table).values(mapping.continuation.encodeInsert({
+					...continuation,
+					retentionUntilMillis: retentionUntil
+				}));
+				return prepared;
+			})).pipe(Effect.provideService(CurrentProofSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
+			complete: (input, prepare) => owned(database, mapping, configuration, Effect.gen(function* () {
+				const journal = yield* CurrentCommitJournal;
+				return yield* completeIn(mapping, configuration, input, (decision) => prepare(decision, journal));
+			})).pipe(Effect.provideService(CurrentProofSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
+			claimDelivery: (input, prepare) => owned(database, mapping, configuration, Effect.gen(function* () {
+				const transaction = yield* CurrentProofSql;
+				const journal = yield* CurrentCommitJournal;
+				const row = (yield* readGeneration(mapping, input.moduleId, input.proofId, configuration.locking))[0];
+				const now = yield* nowMillis;
+				if (row === void 0) return prepare({ _tag: "Declined" }, journal);
+				const c = generationColumns(mapping);
+				const expiresAt = yield* mapping.decodeInstant(row[mapping.generation.expiresAt]);
+				const claimDeadline = row[mapping.generation.claimDeadline] === null || row[mapping.generation.claimDeadline] === void 0 ? void 0 : yield* mapping.decodeInstant(row[mapping.generation.claimDeadline]);
+				const retryAt = row[mapping.generation.retryAt] === null || row[mapping.generation.retryAt] === void 0 ? void 0 : yield* mapping.decodeInstant(row[mapping.generation.retryAt]);
+				let state = row[mapping.generation.deliveryState];
+				if (state === "claimed" && claimDeadline !== void 0 && claimDeadline <= now) {
+					state = "ambiguous";
+					yield* transaction.update(mapping.generation.table).set(updateValues([[mapping.generation.deliveryState, "ambiguous"]])).where(and(eq(c.moduleId, input.moduleId), eq(c.proofId, input.proofId)));
+				}
+				if (!(row[mapping.generation.version] === input.version && row[mapping.generation.deliveryId] === input.deliveryId && row[mapping.generation.state] === "active" && expiresAt > now && Number(row[mapping.generation.sendCount]) < input.policy.maximumDeliveryAttempts && (state === "new" || state === "ambiguous" && input.allowAmbiguousRetry && (retryAt === void 0 || retryAt <= now)))) return prepare({ _tag: "Declined" }, journal);
+				const claimVersion = yield* allocateVersion(mapping, configuration.mode);
+				const prepared = prepare({
+					_tag: "Claimed",
+					claimVersion
+				}, journal);
+				yield* transaction.update(mapping.generation.table).set(updateValues([
+					[mapping.generation.sendCount, Number(row[mapping.generation.sendCount]) + 1],
+					[mapping.generation.deliveryState, "claimed"],
+					[mapping.generation.claimVersion, claimVersion],
+					[mapping.generation.claimDeadline, mapping.encodeInstant(now + input.policy.deliveryClaimMillis)],
+					[mapping.generation.retryAt, mapping.encodeInstant(now + input.policy.deliveryRetryMillis)]
+				])).where(and(eq(c.moduleId, input.moduleId), eq(c.proofId, input.proofId)));
+				return prepared;
+			})).pipe(Effect.provideService(CurrentProofSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
+			settleDelivery: (input, prepare) => owned(database, mapping, configuration, Effect.gen(function* () {
+				const transaction = yield* CurrentProofSql;
+				const journal = yield* CurrentCommitJournal;
+				const initial = (yield* readGeneration(mapping, input.moduleId, input.proofId, false))[0];
+				if (initial === void 0) return prepare(void 0, journal);
+				const keys = initial[mapping.generation.seriesKey];
+				yield* ensureSeries(mapping, configuration, input.moduleId, initial[mapping.generation.purpose], keys);
+				const row = (yield* readGeneration(mapping, input.moduleId, input.proofId, configuration.locking))[0];
+				const prepared = prepare(void 0, journal);
+				if (row === void 0 || row[mapping.generation.version] !== input.version || row[mapping.generation.deliveryId] !== input.deliveryId || row[mapping.generation.claimVersion] !== input.claimVersion || row[mapping.generation.deliveryState] !== "claimed") return prepared;
+				const c = generationColumns(mapping);
+				const outcome = input.outcome;
+				const state = outcome._tag === "Accepted" ? "accepted" : outcome._tag === "DefiniteFailure" ? "failed" : "ambiguous";
+				const values = [[mapping.generation.deliveryState, state], [mapping.generation.claimDeadline, null]];
+				if (outcome._tag === "Ambiguous") values.push([mapping.generation.retryAt, mapping.encodeInstant((yield* nowMillis) + Number(row[mapping.generation.deliveryRetryMillis]))]);
+				if (outcome._tag === "DefiniteFailure") values.push([mapping.generation.state, "cancelled"]);
+				yield* transaction.update(mapping.generation.table).set(updateValues(values)).where(and(eq(c.moduleId, input.moduleId), eq(c.proofId, input.proofId)));
+				if (outcome._tag === "DefiniteFailure") {
+					const sc = seriesColumns(mapping);
+					yield* transaction.update(mapping.series.table).set(updateValues([[mapping.series.activeProofId, null]])).where(and(eq(sc.moduleId, input.moduleId), eq(sc.purpose, row[mapping.generation.purpose]), eq(sc.scopeKey, keys), eq(sc.activeProofId, input.proofId)));
+				}
+				return prepared;
+			})).pipe(Effect.provideService(CurrentProofSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
+			cancel: (input, prepare) => owned(database, mapping, configuration, Effect.gen(function* () {
+				const transaction = yield* CurrentProofSql;
+				const journal = yield* CurrentCommitJournal;
+				const authorityCurrent = yield* lockAuthority(mapping, input.moduleId, input.purpose, input.binding, configuration.locking);
+				const keys = mapping.scopeKeys({
+					moduleId: input.moduleId,
+					purpose: input.purpose,
+					binding: input.binding
+				});
+				const active = (yield* ensureSeries(mapping, configuration, input.moduleId, input.purpose, keys.series))[mapping.series.activeProofId];
+				const prepared = prepare(void 0, journal);
+				if (authorityCurrent && active !== void 0 && active !== null) {
+					const gc = generationColumns(mapping);
+					const sc = seriesColumns(mapping);
+					const row = (yield* readGeneration(mapping, input.moduleId, active, configuration.locking))[0];
+					const storedBinding = row === void 0 ? void 0 : yield* mapping.generation.decodeBinding(row);
+					if (storedBinding === void 0 || !sameBinding(storedBinding, input.binding)) return prepared;
+					yield* transaction.update(mapping.generation.table).set(updateValues([[mapping.generation.state, "cancelled"]])).where(and(eq(gc.moduleId, input.moduleId), eq(gc.proofId, active)));
+					yield* transaction.update(mapping.series.table).set(updateValues([[mapping.series.activeProofId, null]])).where(and(eq(sc.moduleId, input.moduleId), eq(sc.purpose, input.purpose), eq(sc.scopeKey, keys.series), eq(sc.activeProofId, active)));
+				}
+				return prepared;
+			})).pipe(Effect.provideService(CurrentProofSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
+			cleanup: (input, prepare) => owned(database, mapping, configuration, Effect.gen(function* () {
+				const transaction = yield* CurrentProofSql;
+				const journal = yield* CurrentCommitJournal;
+				const now = yield* nowMillis;
+				const nativeNow = mapping.encodeInstant(now);
+				const gc = generationColumns(mapping);
+				const cc = continuationColumns(mapping);
+				const rc = requestColumns(mapping);
+				const ac = abuseColumns(mapping);
+				const fc = failureColumns(mapping);
+				const mc = commandColumns(mapping);
+				const sc = seriesColumns(mapping);
+				const rsc = scopeColumns(mapping);
+				let remaining = input.limit;
+				let hasMore = false;
+				const take = (query) => selectRows(query.limit(remaining + 1), configuration.locking).pipe(Effect.map((rows) => {
+					if (rows.length > remaining) hasMore = true;
+					const selected = rows.slice(0, remaining);
+					remaining -= selected.length;
+					return selected;
+				}));
+				const continuations = yield* take(transaction.select({ continuationId: cc.continuationId }).from(mapping.continuation.table).where(and(eq(cc.moduleId, input.moduleId), lte(cc.retentionUntil, nativeNow))).orderBy(cc.retentionUntil));
+				const generations = yield* take(transaction.select({ proofId: gc.proofId }).from(mapping.generation.table).where(and(eq(gc.moduleId, input.moduleId), lte(gc.retentionUntil, nativeNow))).orderBy(gc.retentionUntil));
+				const requests = yield* take(transaction.select({ requestId: rc.requestId }).from(mapping.request.table).where(and(eq(rc.moduleId, input.moduleId), lte(rc.retentionUntil, nativeNow))).orderBy(rc.retentionUntil));
+				const abuse = yield* take(transaction.select({
+					action: ac.action,
+					scopeKind: ac.scopeKind,
+					scopeKey: ac.scopeKey,
+					commandId: ac.commandId
+				}).from(mapping.abuseEvent.table).where(and(eq(ac.moduleId, input.moduleId), lte(ac.retentionUntil, nativeNow))).orderBy(ac.retentionUntil));
+				const failures = yield* take(transaction.select({
+					seriesKey: fc.seriesKey,
+					commandId: fc.commandId
+				}).from(mapping.failureEvent.table).where(and(eq(fc.moduleId, input.moduleId), lte(fc.retentionUntil, nativeNow))).orderBy(fc.retentionUntil));
+				const commands = yield* take(transaction.select({ commandId: mc.commandId }).from(mapping.command.table).where(and(eq(mc.moduleId, input.moduleId), lte(mc.retentionUntil, nativeNow))).orderBy(mc.retentionUntil));
+				const series = yield* take(transaction.select({
+					purpose: sc.purpose,
+					scopeKey: sc.scopeKey
+				}).from(mapping.series.table).where(and(eq(sc.moduleId, input.moduleId), isNull(sc.activeProofId), notExists(transaction.select({ one: sql`1` }).from(mapping.generation.table).where(and(eq(gc.moduleId, sc.moduleId), eq(gc.purpose, sc.purpose), eq(gc.seriesKey, sc.scopeKey)))), notExists(transaction.select({ one: sql`1` }).from(mapping.failureEvent.table).where(and(eq(fc.moduleId, sc.moduleId), eq(fc.purpose, sc.purpose), eq(fc.seriesKey, sc.scopeKey)))))));
+				const rateScopes = yield* take(transaction.select({
+					purpose: rsc.purpose,
+					action: rsc.action,
+					scopeKind: rsc.scopeKind,
+					scopeKey: rsc.scopeKey
+				}).from(mapping.rateScope.table).where(and(eq(rsc.moduleId, input.moduleId), notExists(transaction.select({ one: sql`1` }).from(mapping.abuseEvent.table).where(and(eq(ac.moduleId, rsc.moduleId), eq(ac.purpose, rsc.purpose), eq(ac.action, rsc.action), eq(ac.scopeKind, rsc.scopeKind), eq(ac.scopeKey, rsc.scopeKey)))))));
+				hasMore ||= generations.length > 0 || failures.length > 0 || abuse.length > 0;
+				const prepared = prepare({
+					removed: input.limit - remaining,
+					hasMore
+				}, journal);
+				if (continuations.length > 0) yield* transaction.delete(mapping.continuation.table).where(and(eq(cc.moduleId, input.moduleId), inArray(cc.continuationId, continuations.map((row) => row.continuationId)), lte(cc.retentionUntil, nativeNow)));
+				if (generations.length > 0) yield* transaction.update(mapping.series.table).set(updateValues([[mapping.series.activeProofId, null]])).where(and(eq(sc.moduleId, input.moduleId), inArray(sc.activeProofId, generations.map((row) => row.proofId))));
+				if (generations.length > 0) yield* transaction.delete(mapping.generation.table).where(and(eq(gc.moduleId, input.moduleId), inArray(gc.proofId, generations.map((row) => row.proofId)), lte(gc.retentionUntil, nativeNow)));
+				if (requests.length > 0) yield* transaction.delete(mapping.request.table).where(and(eq(rc.moduleId, input.moduleId), inArray(rc.requestId, requests.map((row) => row.requestId)), lte(rc.retentionUntil, nativeNow)));
+				for (const row of abuse) yield* transaction.delete(mapping.abuseEvent.table).where(and(eq(ac.moduleId, input.moduleId), eq(ac.action, row.action), eq(ac.scopeKind, row.scopeKind), eq(ac.scopeKey, row.scopeKey), eq(ac.commandId, row.commandId), lte(ac.retentionUntil, nativeNow)));
+				for (const row of failures) yield* transaction.delete(mapping.failureEvent.table).where(and(eq(fc.moduleId, input.moduleId), eq(fc.seriesKey, row.seriesKey), eq(fc.commandId, row.commandId), lte(fc.retentionUntil, nativeNow)));
+				if (commands.length > 0) yield* transaction.delete(mapping.command.table).where(and(eq(mc.moduleId, input.moduleId), inArray(mc.commandId, commands.map((row) => row.commandId)), lte(mc.retentionUntil, nativeNow)));
+				for (const row of series) yield* transaction.delete(mapping.series.table).where(and(eq(sc.moduleId, input.moduleId), eq(sc.purpose, row.purpose), eq(sc.scopeKey, row.scopeKey), isNull(sc.activeProofId), notExists(transaction.select({ one: sql`1` }).from(mapping.generation.table).where(and(eq(gc.moduleId, sc.moduleId), eq(gc.purpose, sc.purpose), eq(gc.seriesKey, sc.scopeKey))))));
+				for (const row of rateScopes) yield* transaction.delete(mapping.rateScope.table).where(and(eq(rsc.moduleId, input.moduleId), eq(rsc.purpose, row.purpose), eq(rsc.action, row.action), eq(rsc.scopeKind, row.scopeKind), eq(rsc.scopeKey, row.scopeKey), notExists(transaction.select({ one: sql`1` }).from(mapping.abuseEvent.table).where(and(eq(ac.moduleId, rsc.moduleId), eq(ac.purpose, rsc.purpose), eq(ac.action, rsc.action), eq(ac.scopeKind, rsc.scopeKind), eq(ac.scopeKey, rsc.scopeKey))))));
+				return prepared;
+			})).pipe(Effect.provideService(CurrentProofSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure)
+		});
+	});
+	const inspectCompletionIn = Effect.fn("DrizzleProof.inspectCompletionIn")(function* (mapping, configuration, input, ensure) {
+		const database = yield* CurrentProofSql;
+		const authorityCurrent = yield* lockAuthority(mapping, input.moduleId, input.purpose, input.binding, configuration.locking);
+		const keys = mapping.scopeKeys({
+			moduleId: input.moduleId,
+			purpose: input.purpose,
+			binding: input.binding
+		});
+		if (ensure) yield* ensureSeries(mapping, configuration, input.moduleId, input.purpose, keys.series);
+		const c = continuationColumns(mapping);
+		const row = (yield* selectRows(database.select().from(mapping.continuation.table).where(and(eq(c.moduleId, input.moduleId), eq(c.continuationId, input.continuationId))).limit(1), configuration.locking))[0];
+		const now = yield* nowMillis;
+		const record = row === void 0 ? void 0 : yield* mapping.continuation.decode(row);
+		return authorityCurrent && row !== void 0 && record !== void 0 && record.moduleId === input.moduleId && record.continuationId === input.continuationId && record.purpose === input.purpose && record.digest === input.continuationDigest && record.seriesKey === keys.series && sameBinding(record.binding, input.binding) && row[mapping.continuation.consumed] === false && record.expiresAtMillis > now ? {
+			record,
+			row,
+			columns: c
+		} : void 0;
+	});
+	/** Nonconsuming same-owner preflight; it never inserts a series or changes expiry. */
+	const checkProofCompletionIn = Effect.fn("Drizzle.checkProofCompletionIn")(function* (mapping, configuration, input) {
+		return yield* inspectCompletionIn(mapping, configuration, input, false).pipe(Effect.map((value) => value !== void 0));
+	});
+	const completeIn = Effect.fn("DrizzleProof.completeIn")(function* (mapping, configuration, input, prepare, protectedMutation) {
+		const database = yield* CurrentProofSql;
+		const accepted = yield* inspectCompletionIn(mapping, configuration, input, true);
+		if (accepted === void 0) return prepare("rejected");
+		const { record, row: original, columns: c } = accepted;
+		if (protectedMutation !== void 0 && !(yield* protectedMutation)) return yield* unavailable();
+		const value = prepare("completed");
+		yield* database.update(mapping.continuation.table).set(updateValues([[mapping.continuation.consumed, true]])).where(and(eq(c.moduleId, input.moduleId), eq(c.continuationId, input.continuationId), eq(c.digest, input.continuationDigest), eq(c.consumed, false)));
+		yield* insertCommand(mapping, input.moduleId, input.continuationDigest, "complete", "completed", record.expiresAtMillis);
+		const assertApplied = Effect.flatMap(CurrentPasswordPreparedTransaction, (currentTransaction) => Effect.gen(function* () {
+			const persisted = (yield* selectRows(currentTransaction.select().from(mapping.continuation.table).where(and(eq(c.moduleId, input.moduleId), eq(c.continuationId, input.continuationId))).limit(1), false))[0];
+			const command = (yield* commandRow(mapping, input.moduleId, input.continuationDigest, false))[0];
+			const decoded = persisted === void 0 ? void 0 : yield* mapping.continuation.decode(persisted);
+			const immutable = [
+				mapping.continuation.moduleId,
+				mapping.continuation.purpose,
+				mapping.continuation.continuationId,
+				mapping.continuation.digest,
+				mapping.continuation.proofId,
+				mapping.continuation.seriesKey,
+				mapping.continuation.version
+			];
+			if (persisted === void 0 || decoded === void 0 || !sameBinding(decoded.binding, record.binding) || persisted[mapping.continuation.consumed] !== true || immutable.some((key) => persisted[key] !== original[key]) || (yield* mapping.decodeInstant(persisted[mapping.continuation.expiresAt])) !== record.expiresAtMillis || (yield* mapping.decodeInstant(persisted[mapping.continuation.retentionUntil])) !== (yield* mapping.decodeInstant(original[mapping.continuation.retentionUntil])) || command === void 0 || command[mapping.command.kind] !== "complete" || command[mapping.command.decision] !== "completed" || (yield* mapping.decodeInstant(command[mapping.command.retentionUntil])) !== record.expiresAtMillis) return yield* unavailable();
+			if (record.expiresAtMillis <= (yield* nowMillis)) return yield* unavailable();
+		}).pipe(Effect.provideService(CurrentProofSql, currentTransaction)));
+		yield* assertApplied.pipe(Effect.provideService(CurrentPasswordPreparedTransaction, database));
+		const postconditions = yield* Effect.serviceOption(PasswordPreparedPostconditions);
+		if (Option.isSome(postconditions) && !postconditions.value.register(assertApplied.pipe(translateFailure))) return yield* unavailable();
+		return value;
+	});
+	return {
+		makeSqlProofPersistence,
+		checkProofCompletionIn,
+		completeProofPlanIn: Effect.fn("Drizzle.completeProofPlanIn")(function* (mapping, configuration, plan, protectedMutation, project) {
+			const journal = yield* CurrentCommitJournal;
+			return yield* completeIn(mapping, configuration, plan.input, (decision) => plan.prepare(decision, journal, project), protectedMutation);
+		})
+	};
+};
+//#endregion
+export { CurrentProofSql, makeProofKernel };
+
+//# sourceMappingURL=proof-kernel.mjs.map