@yielded/auth-persistence 0.1.0-beta.24 → 0.1.0-beta.26

package/src/internal/email-policy.ts

@@ -0,0 +1,235 @@
+import {
+  type EmailAddressMutation,
+  type EmailAddressTarget,
+  type EmailAction,
+  EmailUnavailable,
+  snapshotEmailCredential,
+  snapshotEmailRequirement,
+  snapshotEmailRevision,
+} from "@yielded/auth/Email";
+import type { LoginIdentifier } from "@yielded/auth/Identity";
+import {
+  snapshotAuthenticationEvidence,
+  type AuthenticationRevision,
+  type AuthenticationRequirement,
+  type SecurityRevision,
+} from "@yielded/auth/Sessions";
+import { Effect } from "effect";
+
+import { PersistenceMappingError } from "./mapping-error";
+import type { AnyEmailAddressMapping } from "./models/email-model";
+import { passwordEvidenceSatisfiedAt } from "./password-policy";
+
+const unavailable = () => EmailUnavailable.make({});
+
+const sameIdentifier = (left: LoginIdentifier, right: LoginIdentifier) =>
+  left.namespace === right.namespace && left.value === right.value;
+
+export type EmailWorkflowPolicy = Pick<
+  AnyEmailAddressMapping,
+  | "allocateCredentialId"
+  | "allocateCredentialIdSync"
+  | "allocateRevision"
+  | "allocateRevisionSync"
+  | "sessionInvalidation"
+  | "isIdentifierConflict"
+  | "isCredentialConflict"
+> & {
+  readonly subject: Pick<
+    AnyEmailAddressMapping["subject"],
+    "nextSecurityRevision" | "nextSecurityRevisionSync"
+  >;
+};
+
+export const sameEmailRevision = (left: AuthenticationRevision, right: AuthenticationRevision) => {
+  if (
+    left.subjectId !== right.subjectId ||
+    left.securityRevision !== right.securityRevision ||
+    left.credentials.length !== right.credentials.length
+  )
+    return false;
+
+  const expected = [...left.credentials].sort((a, b) =>
+    a.credentialId.localeCompare(b.credentialId),
+  );
+
+  const actual = [...right.credentials].sort((a, b) =>
+    a.credentialId.localeCompare(b.credentialId),
+  );
+
+  return expected.every(
+    (item, index) =>
+      item.credentialId === actual[index]!.credentialId &&
+      item.revision === actual[index]!.revision,
+  );
+};
+
+export const emailActionModule = (moduleId: string, action: EmailAction) =>
+  `${moduleId}/${action === "verify-address" ? "verify-address" : "change-address"}`;
+
+export const emailActionPurpose = (action: EmailAction) =>
+  action === "verify-address" ? "email-address-verification" : "email-address-change";
+
+export const emailRedemptionMatches = (input: EmailAddressMutation, action: EmailAction) => {
+  const completion = input.redemption.input;
+  const binding = completion.binding;
+
+  return (
+    completion.moduleId === emailActionModule(input.moduleId, action) &&
+    completion.purpose === emailActionPurpose(action) &&
+    binding._tag === "IdentifierChange" &&
+    sameIdentifier(binding.identifier, input.target) &&
+    sameEmailRevision(binding.revision, input.captured.revision)
+  );
+};
+
+export const snapshotEmailMutation = Effect.fn("EmailAddressPersistence.snapshotMutation")(
+  function* (input: EmailAddressMutation) {
+    const evidence = yield* snapshotAuthenticationEvidence(input.authorization.evidence).pipe(
+      Effect.mapError(unavailable),
+    );
+
+    const requirement = yield* snapshotEmailRequirement(input.authorization.requirement);
+
+    const source =
+      input.captured.source === undefined
+        ? undefined
+        : yield* snapshotEmailCredential(input.captured.source);
+
+    return Object.freeze({
+      ...input,
+      target: Object.freeze({ ...input.target }),
+      ...(input.invalidation === undefined
+        ? {}
+        : { invalidation: Object.freeze({ ...input.invalidation }) }),
+      captured: Object.freeze({
+        eligible: input.captured.eligible,
+        revision: snapshotEmailRevision(input.captured.revision),
+        ...(input.captured.targetIdentifierRevision === undefined
+          ? {}
+          : { targetIdentifierRevision: input.captured.targetIdentifierRevision }),
+        ...(source === undefined ? {} : { source }),
+      }),
+      authorization: Object.freeze({
+        challenge: Object.freeze({
+          ...input.authorization.challenge,
+          target: Object.freeze({ ...input.authorization.challenge.target }),
+          revision: snapshotEmailRevision(input.authorization.challenge.revision),
+        }),
+        evidence,
+        requirement,
+      }),
+    });
+  },
+);
+
+export const validateEmailMutation = Effect.fn("EmailAddressPersistence.validateAuthority")(
+  function* (
+    policy: EmailWorkflowPolicy,
+    input: EmailAddressMutation,
+    action: EmailAction,
+    current: Pick<EmailMutationRead, "target" | "requirement"> | undefined,
+    now: number,
+  ) {
+    const confirmsExisting =
+      action === "verify-address" && input.captured.targetIdentifierRevision !== undefined;
+
+    if (
+      !input.captured.eligible ||
+      !emailRedemptionMatches(input, action) ||
+      input.authorization.challenge.moduleId !== input.moduleId ||
+      input.authorization.challenge.action !== action ||
+      input.authorization.challenge.commandId !== input.commandId ||
+      !sameIdentifier(input.authorization.challenge.target, input.target) ||
+      input.authorization.challenge.sourceCredentialId !== input.captured.source?.credentialId ||
+      !sameEmailRevision(input.authorization.challenge.revision, input.captured.revision) ||
+      input.authorization.challenge.targetIdentifierRevision !==
+        input.captured.targetIdentifierRevision ||
+      (input.authorization.evidence.flowId as string) !== (input.commandId as string) ||
+      input.authorization.evidence.bindingDigest !== input.authorization.challenge.bindingDigest ||
+      !sameEmailRevision(input.authorization.evidence.revision, input.captured.revision) ||
+      (action === "verify-address" && input.captured.source !== undefined) ||
+      (action === "change-address" && input.captured.source === undefined) ||
+      confirmsExisting !== (input.invalidation === undefined) ||
+      (input.invalidation?.existingSessions === "immediate" &&
+        policy.sessionInvalidation !== "same-authority-immediate")
+    )
+      return false;
+
+    if (
+      current === undefined ||
+      !current.target.eligible ||
+      !sameEmailRevision(current.target.revision, input.captured.revision) ||
+      current.target.targetIdentifierRevision !== input.captured.targetIdentifierRevision ||
+      (input.captured.source !== undefined &&
+        (current.target.source === undefined ||
+          current.target.source.identifierRevision !== input.captured.source.identifierRevision ||
+          current.target.source.credentialRevision !== input.captured.source.credentialRevision ||
+          !sameIdentifier(current.target.source.identifier, input.captured.source.identifier)))
+    )
+      return false;
+
+    const currentRequirement = yield* current.requirement;
+
+    return (
+      passwordEvidenceSatisfiedAt(
+        input.authorization.evidence,
+        input.authorization.requirement,
+        now,
+      ) && passwordEvidenceSatisfiedAt(input.authorization.evidence, currentRequirement, now)
+    );
+  },
+);
+
+export const allocateEmailValue = <A>(
+  mode: "interactive" | "synchronous",
+  asynchronous: Effect.Effect<A, PersistenceMappingError> | undefined,
+  synchronous: (() => A) | undefined,
+) => {
+  if (mode === "synchronous")
+    return synchronous === undefined
+      ? Effect.fail(unavailable())
+      : Effect.try({
+          try: synchronous,
+          catch: (cause) => PersistenceMappingError.make({ operation: "mapping", cause }),
+        });
+  if (asynchronous !== undefined) return asynchronous;
+
+  return synchronous === undefined
+    ? Effect.fail(unavailable())
+    : Effect.try({
+        try: synchronous,
+        catch: (cause) => PersistenceMappingError.make({ operation: "mapping", cause }),
+      });
+};
+
+export const allocateEmailSecurityRevision = (
+  mapping: EmailWorkflowPolicy,
+  mode: "interactive" | "synchronous",
+  current: SecurityRevision,
+) => {
+  if (mode === "synchronous")
+    return mapping.subject.nextSecurityRevisionSync === undefined
+      ? Effect.fail(unavailable())
+      : Effect.try({
+          try: () => mapping.subject.nextSecurityRevisionSync!(current),
+          catch: (cause) => PersistenceMappingError.make({ operation: "mapping", cause }),
+        });
+  if (mapping.subject.nextSecurityRevision !== undefined)
+    return mapping.subject.nextSecurityRevision(current);
+  if (mapping.subject.nextSecurityRevisionSync !== undefined)
+    return Effect.try({
+      try: () => mapping.subject.nextSecurityRevisionSync!(current),
+      catch: (cause) => PersistenceMappingError.make({ operation: "mapping", cause }),
+    });
+
+  return Effect.fail(unavailable());
+};
+
+export interface EmailMutationRead {
+  readonly target: EmailAddressTarget;
+  readonly requirement: Effect.Effect<
+    AuthenticationRequirement,
+    EmailUnavailable | PersistenceMappingError
+  >;
+}

package/src/internal/email-registration-native.ts

@@ -0,0 +1,386 @@
+import {
+  type EmailUnavailable,
+  type EmailCommandId,
+  type EmailRegistrationDecision,
+  type PrepareEmailCommit,
+} from "@yielded/auth/Email";
+import {
+  CurrentCommitJournal,
+  type LifecycleHooks,
+  type PreparedCommit,
+} from "@yielded/auth/Hooks";
+import type { LoginIdentifier } from "@yielded/auth/Identity";
+import { ProofRedemptionInput, type ProofRedemptionPlan } from "@yielded/auth/Proofs";
+import type { TokenDigest } from "@yielded/auth/Schema";
+import { SecurityRevision } from "@yielded/auth/Sessions";
+import { Crypto, Effect, Schema } from "effect";
+import { SqlClient } from "effect/sql/SqlClient";
+import type { Fragment } from "effect/sql/Statement";
+
+import { sqlBatchAssertion } from "./d1-planning";
+import { ensureEmail as ensure, emailUnavailable as unavailable } from "./email-native-state";
+import { allocateEmailValue } from "./email-policy";
+import { PersistenceMappingError } from "./mapping-error";
+import type { AnyEmailRegistrationMapping } from "./models/email-model";
+import type { AnyProofPersistenceMapping } from "./models/proof-model";
+import type { NativeSqlTables, SqlTable } from "./native-sql-table";
+import { makeNativeProofStore } from "./proof-native";
+import { exactSqlText, executeSqlChange } from "./sql-change";
+import {
+  appendSqlBatchStatement,
+  makeSqlCommitExecutor,
+  registerSqlBatchPostcondition,
+  registerSqlCommitReceipt,
+  registerSqlPostcondition,
+  SqlBatchCommit,
+} from "./sql-commit";
+
+export interface EmailRegistrationAuthority<Registration> {
+  readonly inspect: (input: {
+    readonly identifier: LoginIdentifier;
+    readonly registration: Registration;
+  }) => Effect.Effect<
+    { readonly fingerprint: TokenDigest; readonly eligible: boolean },
+    EmailUnavailable
+  >;
+  readonly registerWithProof: <A>(
+    input: {
+      readonly moduleId: string;
+      readonly commandId: EmailCommandId;
+      readonly requestId: string;
+      readonly identifier: LoginIdentifier;
+      readonly registration: Registration;
+      readonly fingerprint: TokenDigest;
+      readonly redemption: ProofRedemptionPlan;
+    },
+    prepare: PrepareEmailCommit<EmailRegistrationDecision, A>,
+  ) => Effect.Effect<PreparedCommit<A>, EmailUnavailable>;
+}
+
+/** Proof redemption, SQL provisioning, and verified ownership commit together. No registration receipt survives the proof. */
+export const makeNativeEmailRegistrationServices = Effect.fnUntraced(function* <Registration>(
+  tables: NativeSqlTables,
+  mapping: AnyEmailRegistrationMapping<Registration>,
+  proofs: AnyProofPersistenceMapping,
+  batch?: SqlBatchCommit["Service"],
+): Effect.fn.Return<
+  { readonly registrationAuthority: EmailRegistrationAuthority<Registration> },
+  never,
+  SqlClient | LifecycleHooks | Crypto.Crypto
+> {
+  const sql = (yield* SqlClient).withoutTransforms(),
+    executor = yield* makeSqlCommitExecutor(unavailable),
+    crypto = yield* Crypto.Crypto;
+
+  const s = mapping.subject,
+    i = mapping.identifier,
+    c = mapping.credential,
+    a = mapping.authorityCredential;
+
+  const subject = tables(s.table),
+    identifier = tables(i.table),
+    credential = tables(c.table),
+    authority = tables(a.table);
+
+  const exact = (t: SqlTable, key: string, value: unknown) =>
+    exactSqlText(sql, t.column(key), t.value(key, value));
+
+  const id = (t: SqlTable, key: string, value: unknown) =>
+    sql`${t.column(key)} = ${t.value(key, value)}`;
+
+  const identifierKey = (value: LoginIdentifier) =>
+    sql.and([
+      exact(identifier, i.namespace, value.namespace),
+      exact(identifier, i.value, value.value),
+    ]);
+
+  const lock = sql.onDialectOrElse({ sqlite: () => sql``, orElse: () => sql`for update` }),
+    now = tables.expression(mapping.clock.engineNowMillis),
+    mode = "interactive";
+
+  const run = <A, E, R>(work: Effect.Effect<A, E, R>) =>
+    batch === undefined
+      ? executor.run(work.pipe(Effect.provideService(Crypto.Crypto, crypto)))
+      : executor
+          .batch(work.pipe(Effect.provideService(Crypto.Crypto, crypto)))
+          .pipe(Effect.provideService(SqlBatchCommit, batch));
+
+  const stage = Effect.fnUntraced(function* (statement: Fragment) {
+    if (batch === undefined) ensure((yield* executeSqlChange(sql, statement)) === 1);
+    else {
+      yield* appendSqlBatchStatement(sql`${statement}`);
+      yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = 1`));
+    }
+  });
+
+  const prepare = <A>(
+    decision: EmailRegistrationDecision,
+    project: PrepareEmailCommit<EmailRegistrationDecision, A>,
+  ) =>
+    Effect.gen(function* () {
+      const receipt = project(decision, yield* CurrentCommitJournal);
+
+      yield* registerSqlCommitReceipt(receipt);
+
+      return receipt;
+    });
+
+  const registrationAuthority: EmailRegistrationAuthority<Registration> = {
+    inspect: (input) => executor.read(mapping.inspect(input)),
+    registerWithProof: (original, project) =>
+      Effect.gen(function* () {
+        const registration = yield* mapping.snapshotRegistration(original.registration);
+
+        const inspection = yield* mapping.inspect({
+          identifier: original.identifier,
+          registration: yield* mapping.snapshotRegistration(registration),
+        });
+
+        const redemption = yield* Schema.decodeEffect(Schema.toCodecIso(ProofRedemptionInput))(
+          yield* Schema.encodeEffect(Schema.toCodecIso(ProofRedemptionInput))(
+            original.redemption.input,
+          ),
+        );
+
+        const input = {
+          ...original,
+          identifier: { ...original.identifier },
+          registration,
+          redemption,
+        };
+
+        return yield* run(
+          Effect.gen(function* () {
+            const binding = redemption.binding;
+
+            if (
+              !inspection.eligible ||
+              inspection.fingerprint !== input.fingerprint ||
+              redemption.moduleId !== `${input.moduleId}/registration` ||
+              redemption.purpose !== "email-code-registration" ||
+              binding._tag !== "Identifier" ||
+              binding.identifier.namespace !== input.identifier.namespace ||
+              binding.identifier.value !== input.identifier.value ||
+              input.requestId !== `email-registration:${input.moduleId}:${redemption.proofId}`
+            )
+              return yield* prepare({ _tag: "Rejected" }, project);
+
+            const priorRows =
+              yield* sql`select ${identifier.fields("email_registration_identifier_")} from ${identifier.name} where ${identifierKey(input.identifier)} limit 2`;
+
+            ensure(priorRows.length <= 1);
+
+            const prior =
+              priorRows[0] === undefined
+                ? undefined
+                : identifier.decode(priorRows[0], "email_registration_identifier_");
+
+            let previous:
+              | {
+                  readonly native: unknown;
+                  readonly securityRevision: SecurityRevision;
+                  readonly bindingRevision: SecurityRevision;
+                }
+              | undefined;
+
+            if (prior !== undefined) {
+              ensure(
+                prior[i.namespace] === input.identifier.namespace &&
+                  prior[i.value] === input.identifier.value,
+              );
+              if (prior[i.verifiedAt] !== null || !i.isMutableTarget(prior))
+                return yield* prepare({ _tag: "Rejected" }, project);
+
+              const previousSubject = yield* mapping.subjectId.toSubject(prior[i.subjectId]),
+                native = yield* mapping.subjectId.toNative(previousSubject);
+
+              const rows =
+                yield* sql`select ${subject.fields("email_registration_old_subject_")} from ${subject.name} where ${id(subject, s.id, native)} limit 2 ${batch === undefined ? lock : sql``}`;
+
+              if (rows.length !== 1) return yield* prepare({ _tag: "Rejected" }, project);
+              const row = subject.decode(rows[0]!, "email_registration_old_subject_");
+
+              ensure((yield* mapping.subjectId.toSubject(row[s.id])) === previousSubject);
+
+              const currentRows =
+                yield* sql`select ${identifier.fields("email_registration_current_identifier_")} from ${identifier.name} where ${identifierKey(input.identifier)} and ${id(identifier, i.subjectId, native)} and ${exact(identifier, i.bindingRevision, prior[i.bindingRevision])} and ${identifier.column(i.verifiedAt)} is null limit 2`;
+
+              if (
+                currentRows.length !== 1 ||
+                !i.isMutableTarget(
+                  identifier.decode(currentRows[0]!, "email_registration_current_identifier_"),
+                )
+              )
+                return yield* prepare({ _tag: "Rejected" }, project);
+              if (batch !== undefined) {
+                ensure(i.d1MutableTargetCondition !== undefined);
+                yield* appendSqlBatchStatement(
+                  sqlBatchAssertion(
+                    sql,
+                    sql`exists(select 1 from ${identifier.name} where ${identifierKey(input.identifier)} and ${id(identifier, i.subjectId, native)} and ${exact(identifier, i.bindingRevision, prior[i.bindingRevision])} and ${identifier.column(i.verifiedAt)} is null and ${tables.expression(i.d1MutableTargetCondition({ identifier: input.identifier, nativeSubjectId: native }))})`,
+                  ),
+                );
+              }
+              previous = {
+                native,
+                securityRevision: yield* Schema.decodeUnknownEffect(SecurityRevision)(
+                  row[s.securityRevision],
+                ),
+                bindingRevision: yield* Schema.decodeUnknownEffect(SecurityRevision)(
+                  prior[i.bindingRevision],
+                ),
+              };
+            }
+
+            const proof = yield* makeNativeProofStore(tables, proofs, batch !== undefined),
+              redeemed = yield* proof.redeemLocked(redemption);
+
+            yield* registerSqlCommitReceipt(
+              original.redemption.prepare(
+                redeemed.decision,
+                yield* CurrentCommitJournal,
+                (value) => value,
+              ),
+            );
+            if (redeemed.decision !== "redeemed")
+              return yield* prepare({ _tag: "Rejected" }, project);
+
+            const allocate = () =>
+              allocateEmailValue(mode, mapping.allocateRevision, mapping.allocateRevisionSync);
+
+            const securityRevision = yield* allocate(),
+              identifierRevision = yield* allocate(),
+              credentialRevision = yield* allocate(),
+              displacedRevision = previous === undefined ? undefined : yield* allocate(),
+              credentialId = yield* allocateEmailValue(
+                mode,
+                mapping.allocateCredentialId,
+                mapping.allocateCredentialIdSync,
+              );
+
+            const provisioning = mapping.provisioning;
+
+            if (batch !== undefined && provisioning.idMode === "generated")
+              return yield* unavailable();
+
+            let native =
+              provisioning.idMode === "generated"
+                ? undefined
+                : yield* allocateEmailValue(
+                    mode,
+                    provisioning.allocateSubjectId,
+                    provisioning.allocateSubjectIdSync,
+                  );
+
+            const insertion = sql`${subject.insert(provisioning.encodeSubjectInsert(input, { nativeSubjectId: native, securityRevision }))}`;
+
+            if (provisioning.idMode === "generated") {
+              const rows = yield* sql.onDialectOrElse({
+                mysql: () =>
+                  insertion.raw.pipe(
+                    Effect.flatMap(
+                      Schema.decodeUnknownEffect(
+                        Schema.Struct({ insertId: Schema.Union([Schema.Int, Schema.String]) }),
+                      ),
+                    ),
+                    Effect.map((header) => [{ [s.id]: header.insertId }]),
+                  ),
+                orElse: () =>
+                  sql`${insertion} returning ${subject.fields("email_registration_generated_")}`.pipe(
+                    Effect.map((rows) =>
+                      rows.map((row) => subject.decode(row, "email_registration_generated_")),
+                    ),
+                  ),
+              });
+
+              native = yield* provisioning.decodeGeneratedId(rows);
+            } else yield* stage(insertion);
+            ensure(native !== undefined);
+            const subjectId = yield* mapping.subjectId.toSubject(native);
+            const clock = yield* sql`select ${now} as engine_now`;
+            const verifiedAt = Number(clock[0]?.engine_now);
+
+            ensure(Number.isSafeInteger(verifiedAt));
+
+            const values = i.encodeVerifiedInsert({
+              identifier: input.identifier,
+              subjectId: native,
+              verifiedAtMillis: verifiedAt,
+              bindingRevision: identifierRevision,
+            });
+
+            if (previous === undefined) yield* stage(identifier.insert(values));
+            else {
+              ensure(displacedRevision !== previous.securityRevision);
+              yield* stage(
+                sql`${identifier.update(values)} where ${identifierKey(input.identifier)} and ${id(identifier, i.subjectId, previous.native)} and ${exact(identifier, i.bindingRevision, previous.bindingRevision)} and ${identifier.column(i.verifiedAt)} is null`,
+              );
+              yield* stage(
+                sql`${subject.update({ [s.securityRevision]: displacedRevision })} where ${id(subject, s.id, previous.native)} and ${exact(subject, s.securityRevision, previous.securityRevision)}`,
+              );
+            }
+            yield* stage(
+              credential.insert(
+                c.encodeVerifiedInsert({
+                  moduleId: input.moduleId,
+                  subjectId: native,
+                  credentialId,
+                  identifier: input.identifier,
+                  credentialRevision,
+                }),
+              ),
+            );
+            yield* stage(
+              authority.insert(
+                a.encodeInsert({ subjectId: native, credentialId, revision: credentialRevision }),
+              ),
+            );
+
+            const conditions: Fragment[] = [
+              redeemed.validUntil,
+              sql`exists(select 1 from ${subject.name} where ${id(subject, s.id, native)} and ${exact(subject, s.securityRevision, securityRevision)} and ${id(subject, s.status, s.activeStatusValue)})`,
+              sql`exists(select 1 from ${identifier.name} where ${identifierKey(input.identifier)} and ${id(identifier, i.subjectId, native)} and ${exact(identifier, i.bindingRevision, identifierRevision)} and ${id(identifier, i.verifiedAt, mapping.clock.encodeInstant(verifiedAt))})`,
+              sql`exists(select 1 from ${credential.name} where ${exact(credential, c.moduleId, input.moduleId)} and ${exact(credential, c.credentialId, credentialId)} and ${id(credential, c.subjectId, native)} and ${exact(credential, c.credentialRevision, credentialRevision)} and ${exact(credential, c.identifierNamespace, input.identifier.namespace)} and ${exact(credential, c.identifierValue, input.identifier.value)} and ${id(credential, c.status, c.activeStatusValue)})`,
+              sql`exists(select 1 from ${authority.name} where ${id(authority, a.subjectId, native)} and ${exact(authority, a.credentialId, credentialId)} and ${exact(authority, a.revision, credentialRevision)} and ${id(authority, a.status, a.activeStatusValue)})`,
+            ];
+
+            if (previous !== undefined)
+              conditions.push(
+                sql`exists(select 1 from ${subject.name} where ${id(subject, s.id, previous.native)} and ${exact(subject, s.securityRevision, displacedRevision)})`,
+              );
+            if (batch !== undefined) {
+              ensure(i.d1CurrentCondition !== undefined);
+              conditions.push(
+                sql`exists(select 1 from ${identifier.name} where ${identifierKey(input.identifier)} and ${id(identifier, i.subjectId, native)} and ${tables.expression(i.d1CurrentCondition({ identifier: input.identifier, nativeSubjectId: native, bindingRevision: identifierRevision }))})`,
+              );
+              yield* registerSqlBatchPostcondition({
+                name: "email-registration-authority",
+                statement: sqlBatchAssertion(sql, sql.and(conditions)),
+              });
+            } else
+              yield* registerSqlPostcondition({
+                name: "email-registration-authority",
+                check: Effect.gen(function* () {
+                  const rows =
+                    yield* sql`select ${identifier.fields("email_registration_final_")} from ${identifier.name} where ${identifierKey(input.identifier)} and ${sql.and(conditions)} limit 2`;
+
+                  ensure(
+                    rows.length === 1 &&
+                      i.isCurrent(identifier.decode(rows[0]!, "email_registration_final_")),
+                  );
+                }).pipe(
+                  Effect.mapError((cause) =>
+                    PersistenceMappingError.make({ operation: "decode", cause }),
+                  ),
+                ),
+              });
+            ensure((yield* mapping.subjectId.toSubject(native)) === subjectId);
+
+            return yield* prepare({ _tag: "Registered" }, project);
+          }),
+        );
+      }).pipe(Effect.mapError(unavailable)),
+  };
+
+  return { registrationAuthority };
+});