@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.26

package/dist/internal/proof-kernel.mjs

@@ -1,624 +0,0 @@
-import { PersistenceMappingError } from "./mapping-error.mjs";
-import { requiredProofConstraints } from "./models/proof-model.mjs";
-import { CurrentPasswordPreparedTransaction, PasswordPreparedPostconditions } from "./PasswordPreparedPostconditions.mjs";
-import { Cause, Context, DateTime, Effect, Option, Schema } from "effect";
-import { CurrentCommitJournal, HookConfigurationError, LifecycleHooks, coordinateCommit, hasCommitScope } from "@yielded/auth/Hooks";
-import { reportPersistenceFailure } from "@yielded/auth/Persistence";
-import { ProofBinding, ProofPersistence, ProofRequestConflict, ProofUnavailable } from "@yielded/auth/Proofs";
-//#region src/internal/proof-kernel.ts
-var CurrentProofSql = class extends Context.Service()("effect-auth/CurrentProofSql") {};
-const makeProofKernel = (operations) => {
-	const { and, eq, gte, inArray, isNull, lte, notExists, sql, column, updateValues } = operations;
-	const unavailable = () => ProofUnavailable.make({});
-	const translateFailure = (effect) => reportPersistenceFailure(effect, (error) => Schema.is(ProofUnavailable)(error) || Schema.is(HookConfigurationError)(error)).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));
-	const translateIssueFailure = (effect) => reportPersistenceFailure(effect, (error) => Schema.is(ProofUnavailable)(error) || Schema.is(ProofRequestConflict)(error) || Schema.is(HookConfigurationError)(error)).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, (error) => Schema.is(ProofRequestConflict)(error) ? error : unavailable()))));
-	const conflict = () => ProofRequestConflict.make({});
-	const validConstraints = (mapping) => Object.entries(requiredProofConstraints).every(([key, value]) => mapping.constraints[key] === value);
-	const selectRows = (query, locking) => locking && typeof query.for === "function" ? query.for("update") : query;
-	const allocateVersion = (mapping, mode) => {
-		if (mode === "synchronous") return mapping.allocateVersionSync === void 0 ? Effect.fail(unavailable()) : Effect.try({
-			try: mapping.allocateVersionSync,
-			catch: (cause) => new PersistenceMappingError({
-				operation: "mapping",
-				cause
-			})
-		});
-		if (mapping.allocateVersion !== void 0) return mapping.allocateVersion;
-		return mapping.allocateVersionSync === void 0 ? Effect.fail(unavailable()) : Effect.try({
-			try: mapping.allocateVersionSync,
-			catch: (cause) => new PersistenceMappingError({
-				operation: "mapping",
-				cause
-			})
-		});
-	};
-	const canonicalBinding = Schema.encodeSync(Schema.fromJsonString(ProofBinding));
-	const sameBinding = (left, right) => canonicalBinding(left) === canonicalBinding(right);
-	const requestColumns = (mapping) => ({
-		moduleId: column(mapping.request.table, mapping.request.moduleId),
-		requestId: column(mapping.request.table, mapping.request.requestId),
-		fingerprint: column(mapping.request.table, mapping.request.fingerprint),
-		proofId: column(mapping.request.table, mapping.request.proofId),
-		retentionUntil: column(mapping.request.table, mapping.request.retentionUntil)
-	});
-	const seriesColumns = (mapping) => ({
-		moduleId: column(mapping.series.table, mapping.series.moduleId),
-		purpose: column(mapping.series.table, mapping.series.purpose),
-		scopeKey: column(mapping.series.table, mapping.series.scopeKey),
-		activeProofId: column(mapping.series.table, mapping.series.activeProofId),
-		lastIssueAt: column(mapping.series.table, mapping.series.lastIssueAt),
-		version: column(mapping.series.table, mapping.series.version)
-	});
-	const generationColumns = (mapping) => ({
-		moduleId: column(mapping.generation.table, mapping.generation.moduleId),
-		purpose: column(mapping.generation.table, mapping.generation.purpose),
-		proofId: column(mapping.generation.table, mapping.generation.proofId),
-		requestId: column(mapping.generation.table, mapping.generation.requestId),
-		seriesKey: column(mapping.generation.table, mapping.generation.seriesKey),
-		deliveryId: column(mapping.generation.table, mapping.generation.deliveryId),
-		verifierKeyId: column(mapping.generation.table, mapping.generation.verifierKeyId),
-		verifierDigest: column(mapping.generation.table, mapping.generation.verifierDigest),
-		issuedAt: column(mapping.generation.table, mapping.generation.issuedAt),
-		expiresAt: column(mapping.generation.table, mapping.generation.expiresAt),
-		version: column(mapping.generation.table, mapping.generation.version),
-		state: column(mapping.generation.table, mapping.generation.state),
-		sendCount: column(mapping.generation.table, mapping.generation.sendCount),
-		deliveryState: column(mapping.generation.table, mapping.generation.deliveryState),
-		claimVersion: column(mapping.generation.table, mapping.generation.claimVersion),
-		claimDeadline: column(mapping.generation.table, mapping.generation.claimDeadline),
-		retryAt: column(mapping.generation.table, mapping.generation.retryAt),
-		deliveryRetryMillis: column(mapping.generation.table, mapping.generation.deliveryRetryMillis),
-		retentionUntil: column(mapping.generation.table, mapping.generation.retentionUntil)
-	});
-	const continuationColumns = (mapping) => ({
-		moduleId: column(mapping.continuation.table, mapping.continuation.moduleId),
-		purpose: column(mapping.continuation.table, mapping.continuation.purpose),
-		continuationId: column(mapping.continuation.table, mapping.continuation.continuationId),
-		digest: column(mapping.continuation.table, mapping.continuation.digest),
-		proofId: column(mapping.continuation.table, mapping.continuation.proofId),
-		seriesKey: column(mapping.continuation.table, mapping.continuation.seriesKey),
-		expiresAt: column(mapping.continuation.table, mapping.continuation.expiresAt),
-		consumed: column(mapping.continuation.table, mapping.continuation.consumed),
-		version: column(mapping.continuation.table, mapping.continuation.version),
-		retentionUntil: column(mapping.continuation.table, mapping.continuation.retentionUntil)
-	});
-	const scopeColumns = (mapping) => ({
-		moduleId: column(mapping.rateScope.table, mapping.rateScope.moduleId),
-		purpose: column(mapping.rateScope.table, mapping.rateScope.purpose),
-		action: column(mapping.rateScope.table, mapping.rateScope.action),
-		scopeKind: column(mapping.rateScope.table, mapping.rateScope.scopeKind),
-		scopeKey: column(mapping.rateScope.table, mapping.rateScope.scopeKey)
-	});
-	const abuseColumns = (mapping) => ({
-		moduleId: column(mapping.abuseEvent.table, mapping.abuseEvent.moduleId),
-		purpose: column(mapping.abuseEvent.table, mapping.abuseEvent.purpose),
-		action: column(mapping.abuseEvent.table, mapping.abuseEvent.action),
-		scopeKind: column(mapping.abuseEvent.table, mapping.abuseEvent.scopeKind),
-		scopeKey: column(mapping.abuseEvent.table, mapping.abuseEvent.scopeKey),
-		commandId: column(mapping.abuseEvent.table, mapping.abuseEvent.commandId),
-		occurredAt: column(mapping.abuseEvent.table, mapping.abuseEvent.occurredAt),
-		retentionUntil: column(mapping.abuseEvent.table, mapping.abuseEvent.retentionUntil)
-	});
-	const failureColumns = (mapping) => ({
-		moduleId: column(mapping.failureEvent.table, mapping.failureEvent.moduleId),
-		purpose: column(mapping.failureEvent.table, mapping.failureEvent.purpose),
-		seriesKey: column(mapping.failureEvent.table, mapping.failureEvent.seriesKey),
-		commandId: column(mapping.failureEvent.table, mapping.failureEvent.commandId),
-		occurredAt: column(mapping.failureEvent.table, mapping.failureEvent.occurredAt),
-		retentionUntil: column(mapping.failureEvent.table, mapping.failureEvent.retentionUntil)
-	});
-	const commandColumns = (mapping) => ({
-		moduleId: column(mapping.command.table, mapping.command.moduleId),
-		commandId: column(mapping.command.table, mapping.command.commandId),
-		kind: column(mapping.command.table, mapping.command.kind),
-		decision: column(mapping.command.table, mapping.command.decision),
-		retentionUntil: column(mapping.command.table, mapping.command.retentionUntil)
-	});
-	const nowMillis = DateTime.now.pipe(Effect.map(DateTime.toEpochMillis));
-	const lockAuthority = Effect.fn("DrizzleProof.lockAuthority")(function* (mapping, moduleId, purpose, binding, locking) {
-		const database = yield* CurrentProofSql;
-		const authority = mapping.authority;
-		let nativeSubjectId;
-		if (binding._tag !== "Identifier") {
-			if (authority.subject === void 0 || authority.credential === void 0 || authority.subjectId === void 0) return yield* unavailable();
-			nativeSubjectId = yield* authority.subjectId.toNative(binding.revision.subjectId);
-			const subject = authority.subject;
-			const row = (yield* selectRows(database.select().from(subject.table).where(eq(column(subject.table, subject.id), nativeSubjectId)).limit(1), locking))[0];
-			if (row === void 0 || !subject.isActiveStatus(row[subject.status]) || row[subject.securityRevision] !== binding.revision.securityRevision) return false;
-		}
-		const identifier = authority.identifier;
-		const identifierRows = yield* selectRows(database.select().from(identifier.table).where(and(eq(column(identifier.table, identifier.namespace), binding.identifier.namespace), eq(column(identifier.table, identifier.value), binding.identifier.value))), locking);
-		if (!identifier.isCurrent({
-			moduleId,
-			purpose,
-			binding,
-			...nativeSubjectId === void 0 ? {} : { nativeSubjectId }
-		}, identifierRows)) return false;
-		if (binding._tag === "Identifier") return true;
-		const credential = authority.credential;
-		const expected = [...binding.revision.credentials].sort((a, b) => a.credentialId.localeCompare(b.credentialId));
-		const rows = expected.length === 0 ? [] : yield* selectRows(database.select().from(credential.table).where(and(eq(column(credential.table, credential.subjectId), nativeSubjectId), inArray(column(credential.table, credential.credentialId), expected.map((item) => item.credentialId)))), locking);
-		if (rows.length !== expected.length) return false;
-		return rows.map((row) => ({
-			credentialId: row[credential.credentialId],
-			revision: row[credential.revision],
-			active: credential.status === void 0 || credential.isActiveStatus?.(row[credential.status]) === true
-		})).sort((a, b) => a.credentialId.localeCompare(b.credentialId)).every((item, index) => item.active && item.credentialId === expected[index]?.credentialId && item.revision === expected[index]?.revision);
-	});
-	const scopeEntries = (keys, binding, action, policy) => {
-		const suffix = action === "issue" ? "Issues" : "Attempts";
-		const simple = action === "issue" ? "issues" : "attempts";
-		const entries = [{
-			kind: "action",
-			key: "*",
-			budget: policy.abuse[`action${suffix}`]
-		}, {
-			kind: "identifier",
-			key: keys.identifier,
-			budget: policy.abuse[simple]
-		}];
-		if (binding._tag !== "Identifier") entries.push({
-			kind: "subject",
-			key: keys.subject,
-			budget: policy.abuse[`subject${suffix}`]
-		});
-		return entries;
-	};
-	const lockScopes = Effect.fn("DrizzleProof.lockScopes")(function* (mapping, configuration, moduleId, purpose, action, entries) {
-		const database = yield* CurrentProofSql;
-		const c = scopeColumns(mapping);
-		for (const entry of entries) {
-			const values = mapping.rateScope.encodeInsert({
-				moduleId,
-				purpose,
-				action,
-				scopeKind: entry.kind,
-				scopeKey: entry.key
-			});
-			const query = database.insert(mapping.rateScope.table).values(values);
-			yield* configuration.insertIfAbsent(query, mapping.rateScope.scopeKey, entry.key);
-			yield* selectRows(database.select().from(mapping.rateScope.table).where(and(eq(c.moduleId, moduleId), eq(c.purpose, purpose), eq(c.action, action), eq(c.scopeKind, entry.kind), eq(c.scopeKey, entry.key))).limit(1), configuration.locking);
-		}
-	});
-	const admittedScopes = Effect.fn("DrizzleProof.admittedScopes")(function* (mapping, moduleId, purpose, action, entries, now) {
-		const database = yield* CurrentProofSql;
-		const c = abuseColumns(mapping);
-		const admitted = [];
-		for (const entry of entries) if ((yield* selectRows(database.select({ commandId: c.commandId }).from(mapping.abuseEvent.table).where(and(eq(c.moduleId, moduleId), eq(c.purpose, purpose), eq(c.action, action), eq(c.scopeKind, entry.kind), eq(c.scopeKey, entry.key), gte(c.occurredAt, mapping.encodeInstant(now - entry.budget.windowMillis)))).limit(entry.budget.limit), true)).length < entry.budget.limit) admitted.push(entry);
-		return admitted;
-	});
-	const insertScopeEvents = Effect.fn("Drizzle.insertScopeEvents")(function* (mapping, moduleId, purpose, action, commandId, entries, now, retentionUntil) {
-		const database = yield* CurrentProofSql;
-		return yield* Effect.forEach(entries, (entry) => database.insert(mapping.abuseEvent.table).values(mapping.abuseEvent.encodeInsert({
-			moduleId,
-			purpose,
-			action,
-			scopeKind: entry.kind,
-			scopeKey: entry.key,
-			commandId,
-			occurredAtMillis: now,
-			retentionUntilMillis: retentionUntil
-		})), { discard: true });
-	});
-	const ensureSeries = Effect.fn("DrizzleProof.ensureSeries")(function* (mapping, configuration, moduleId, purpose, scopeKey) {
-		const database = yield* CurrentProofSql;
-		const c = seriesColumns(mapping);
-		const initialVersion = yield* allocateVersion(mapping, configuration.mode);
-		const query = database.insert(mapping.series.table).values(mapping.series.encodeInsert({
-			moduleId,
-			purpose,
-			scopeKey,
-			version: initialVersion
-		}));
-		yield* configuration.insertIfAbsent(query, mapping.series.scopeKey, scopeKey);
-		return (yield* selectRows(database.select().from(mapping.series.table).where(and(eq(c.moduleId, moduleId), eq(c.purpose, purpose), eq(c.scopeKey, scopeKey))).limit(1), configuration.locking))[0] ?? (yield* unavailable());
-	});
-	const readGeneration = Effect.fn("Drizzle.readGeneration")(function* (mapping, moduleId, proofId, locking) {
-		const database = yield* CurrentProofSql;
-		const c = generationColumns(mapping);
-		return yield* selectRows(database.select().from(mapping.generation.table).where(and(eq(c.moduleId, moduleId), eq(c.proofId, proofId))).limit(1), locking);
-	});
-	const failureCount = Effect.fn("DrizzleProof.failureCount")(function* (mapping, moduleId, purpose, seriesKey, now, policy) {
-		const database = yield* CurrentProofSql;
-		const c = failureColumns(mapping);
-		return (yield* selectRows(database.select({ commandId: c.commandId }).from(mapping.failureEvent.table).where(and(eq(c.moduleId, moduleId), eq(c.purpose, purpose), eq(c.seriesKey, seriesKey), gte(c.occurredAt, mapping.encodeInstant(now - policy.abuse.attempts.windowMillis)))).limit(policy.maximumFailedAttempts), true)).length;
-	});
-	const commandRow = Effect.fn("Drizzle.commandRow")(function* (mapping, moduleId, commandId, locking) {
-		const database = yield* CurrentProofSql;
-		const c = commandColumns(mapping);
-		return yield* selectRows(database.select().from(mapping.command.table).where(and(eq(c.moduleId, moduleId), eq(c.commandId, commandId))).limit(1), locking);
-	});
-	const insertCommand = Effect.fn("Drizzle.insertCommand")(function* (mapping, moduleId, commandId, kind, decision, retentionUntil) {
-		return yield* (yield* CurrentProofSql).insert(mapping.command.table).values(mapping.command.encodeInsert({
-			moduleId,
-			commandId,
-			kind,
-			decision,
-			retentionUntilMillis: retentionUntil
-		}));
-	});
-	const owned = (database, mapping, configuration, body) => {
-		if (!validConstraints(mapping)) return Effect.fail(unavailable());
-		const run = coordinateCommit(() => database.transaction((transaction) => body.pipe(Effect.provideService(CurrentProofSql, transaction))), { mode: configuration.mode }).pipe(Effect.map((result) => result.value));
-		return configuration.coordinated !== true ? Effect.gen(function* () {
-			if (yield* hasCommitScope) return yield* unavailable();
-			yield* configuration.standaloneGuard;
-			return yield* run;
-		}) : run;
-	};
-	const makeSqlProofPersistence = Effect.fn("makeSqlProofPersistence")(function* (mapping, configuration) {
-		const database = yield* CurrentProofSql;
-		if (!configuration.coordinated) yield* (operations.validateStorage?.(mapping) ?? Effect.void).pipe(Effect.mapError(unavailable));
-		const hooks = yield* LifecycleHooks;
-		return ProofPersistence.of({
-			issue: (input, prepare) => owned(database, mapping, configuration, Effect.gen(function* () {
-				const transaction = yield* CurrentProofSql;
-				const journal = yield* CurrentCommitJournal;
-				const keys = mapping.scopeKeys({
-					moduleId: input.record.moduleId,
-					purpose: input.record.purpose,
-					binding: input.record.binding
-				});
-				const authorityCurrent = yield* lockAuthority(mapping, input.record.moduleId, input.record.purpose, input.record.binding, configuration.locking);
-				const scopes = scopeEntries(keys, input.record.binding, "issue", input.policy);
-				yield* lockScopes(mapping, configuration, input.record.moduleId, input.record.purpose, "issue", scopes.slice(0, 1));
-				const actionNow = yield* nowMillis;
-				const actionOpen = (yield* admittedScopes(mapping, input.record.moduleId, input.record.purpose, "issue", scopes.slice(0, 1), actionNow)).length === 1;
-				if (actionOpen) yield* lockScopes(mapping, configuration, input.record.moduleId, input.record.purpose, "issue", scopes.slice(1));
-				const series = actionOpen ? yield* ensureSeries(mapping, configuration, input.record.moduleId, input.record.purpose, keys.series) : void 0;
-				const now = yield* nowMillis;
-				const retentionUntil = now + input.policy.requestRetentionMillis;
-				const rc = requestColumns(mapping);
-				let requestRows = yield* selectRows(transaction.select().from(mapping.request.table).where(and(eq(rc.moduleId, input.record.moduleId), eq(rc.requestId, input.record.requestId))).limit(1), configuration.locking);
-				let request = requestRows[0];
-				if (request !== void 0) {
-					if ((yield* mapping.decodeInstant(request[mapping.request.retentionUntil])) > now) {
-						if (request[mapping.request.fingerprint] !== input.record.fingerprint) return yield* conflict();
-						return prepare({
-							_tag: "Existing",
-							receipt: yield* mapping.request.decodeReceipt(request)
-						}, journal);
-					}
-					yield* transaction.delete(mapping.request.table).where(and(eq(rc.moduleId, input.record.moduleId), eq(rc.requestId, input.record.requestId), lte(rc.retentionUntil, mapping.encodeInstant(now))));
-				}
-				const requestInsert = mapping.request.encodeInsert({
-					record: input.record,
-					createdAtMillis: now,
-					retentionUntilMillis: retentionUntil
-				});
-				const requestQuery = transaction.insert(mapping.request.table).values(requestInsert);
-				yield* configuration.insertIfAbsent(requestQuery, mapping.request.requestId, input.record.requestId);
-				requestRows = yield* selectRows(transaction.select().from(mapping.request.table).where(and(eq(rc.moduleId, input.record.moduleId), eq(rc.requestId, input.record.requestId))).limit(1), configuration.locking);
-				request = requestRows[0];
-				if (request === void 0) return yield* unavailable();
-				if (request[mapping.request.fingerprint] !== input.record.fingerprint) return yield* conflict();
-				if (request[mapping.request.proofId] !== input.record.proofId) return prepare({
-					_tag: "Existing",
-					receipt: yield* mapping.request.decodeReceipt(request)
-				}, journal);
-				const admitted = actionOpen ? yield* admittedScopes(mapping, input.record.moduleId, input.record.purpose, "issue", scopes, now) : [];
-				const sc = seriesColumns(mapping);
-				const lastIssueAt = series?.[mapping.series.lastIssueAt] === null || series?.[mapping.series.lastIssueAt] === void 0 ? void 0 : yield* mapping.decodeInstant(series[mapping.series.lastIssueAt]);
-				const activeProofId = series?.[mapping.series.activeProofId];
-				const activeGeneration = activeProofId === null || activeProofId === void 0 ? void 0 : (yield* readGeneration(mapping, input.record.moduleId, activeProofId, configuration.locking))[0];
-				if (activeProofId !== null && activeProofId !== void 0 && (activeGeneration === void 0 || activeGeneration[mapping.generation.purpose] !== input.record.purpose)) return yield* unavailable();
-				const replacementAuthorized = activeGeneration === void 0 || activeGeneration[mapping.generation.state] !== "active" || (yield* mapping.decodeInstant(activeGeneration[mapping.generation.expiresAt])) <= now || sameBinding(yield* mapping.generation.decodeBinding(activeGeneration), input.record.binding);
-				const supersedesCurrent = input.supersedes === void 0 || input.supersedes === activeProofId;
-				const allowed = authorityCurrent && input.eligible && admitted.length === scopes.length && input.record.issuedAtMillis <= now && input.record.expiresAtMillis > now && replacementAuthorized && supersedesCurrent && (lastIssueAt === void 0 || now - lastIssueAt >= input.policy.abuse.resendCooldownMillis);
-				const receipt = {
-					requestId: input.record.requestId,
-					reference: {
-						proofId: input.record.proofId,
-						purpose: input.record.purpose,
-						keyId: input.record.verifier.keyId
-					}
-				};
-				const prepared = prepare(allowed ? {
-					_tag: "Issued",
-					record: input.record
-				} : {
-					_tag: "Suppressed",
-					receipt
-				}, journal);
-				if (!allowed) return prepared;
-				yield* insertScopeEvents(mapping, input.record.moduleId, input.record.purpose, "issue", input.record.requestId, scopes, now, retentionUntil);
-				if (activeProofId !== null && activeProofId !== void 0) yield* transaction.update(mapping.generation.table).set(updateValues([[mapping.generation.state, "superseded"]])).where(and(eq(generationColumns(mapping).moduleId, input.record.moduleId), eq(generationColumns(mapping).proofId, activeProofId), eq(generationColumns(mapping).state, "active")));
-				yield* transaction.insert(mapping.generation.table).values(mapping.generation.encodeInsert({
-					record: input.record,
-					seriesKey: keys.series,
-					retentionUntilMillis: retentionUntil,
-					state: "active",
-					deliveryState: "new",
-					policy: input.policy
-				}));
-				const nextVersion = yield* allocateVersion(mapping, configuration.mode);
-				yield* transaction.update(mapping.series.table).set(updateValues([
-					[mapping.series.activeProofId, input.record.proofId],
-					[mapping.series.lastIssueAt, mapping.encodeInstant(now)],
-					[mapping.series.version, nextVersion]
-				])).where(and(eq(sc.moduleId, input.record.moduleId), eq(sc.purpose, input.record.purpose), eq(sc.scopeKey, keys.series)));
-				return prepared;
-			})).pipe(Effect.provideService(CurrentProofSql, database), Effect.provideService(LifecycleHooks, hooks), translateIssueFailure),
-			attempt: (input, prepare) => owned(database, mapping, configuration, Effect.gen(function* () {
-				const transaction = yield* CurrentProofSql;
-				const journal = yield* CurrentCommitJournal;
-				const keys = mapping.scopeKeys({
-					moduleId: input.moduleId,
-					purpose: input.purpose,
-					binding: input.binding
-				});
-				const authorityCurrent = yield* lockAuthority(mapping, input.moduleId, input.purpose, input.binding, configuration.locking);
-				const scopes = scopeEntries(keys, input.binding, "attempt", input.policy);
-				yield* lockScopes(mapping, configuration, input.moduleId, input.purpose, "attempt", scopes.slice(0, 1));
-				const actionNow = yield* nowMillis;
-				const actionOpen = (yield* admittedScopes(mapping, input.moduleId, input.purpose, "attempt", scopes.slice(0, 1), actionNow)).length === 1;
-				if (actionOpen) yield* lockScopes(mapping, configuration, input.moduleId, input.purpose, "attempt", scopes.slice(1));
-				const series = actionOpen ? yield* ensureSeries(mapping, configuration, input.moduleId, input.purpose, keys.series) : void 0;
-				const generation = (yield* readGeneration(mapping, input.moduleId, input.proofId, configuration.locking))[0];
-				const existingCommand = (yield* commandRow(mapping, input.moduleId, input.continuationId, configuration.locking))[0];
-				if (existingCommand !== void 0) {
-					if (existingCommand[mapping.command.decision] === "rejected") return prepare({ _tag: "Rejected" }, journal);
-					return yield* unavailable();
-				}
-				const now = yield* nowMillis;
-				const admitted = actionOpen ? yield* admittedScopes(mapping, input.moduleId, input.purpose, "attempt", scopes, now) : [];
-				const failures = yield* failureCount(mapping, input.moduleId, input.purpose, keys.series, now, input.policy);
-				const gc = generationColumns(mapping);
-				const activeProofId = series?.[mapping.series.activeProofId];
-				const storedBinding = generation === void 0 ? void 0 : yield* mapping.generation.decodeBinding(generation);
-				const candidateMatches = generation !== void 0 && input.candidate !== void 0 && generation[mapping.generation.verifierKeyId] === input.candidate.keyId && generation[mapping.generation.verifierDigest] === input.candidate.digest;
-				const currentGeneration = generation !== void 0 && generation[mapping.generation.purpose] === input.purpose && generation[mapping.generation.state] === "active" && activeProofId === input.proofId && storedBinding !== void 0 && sameBinding(storedBinding, input.binding) && Number(yield* mapping.decodeInstant(generation[mapping.generation.expiresAt])) > now;
-				const accepted = authorityCurrent && currentGeneration && candidateMatches && admitted.length === scopes.length && failures < input.policy.maximumFailedAttempts;
-				const retentionUntil = now + input.policy.requestRetentionMillis;
-				if (!accepted) {
-					const prepared = prepare({ _tag: "Rejected" }, journal);
-					yield* insertCommand(mapping, input.moduleId, input.continuationId, "attempt", "rejected", retentionUntil);
-					yield* insertScopeEvents(mapping, input.moduleId, input.purpose, "attempt", input.continuationId, admitted, now, retentionUntil);
-					if (admitted.length === scopes.length && currentGeneration && !candidateMatches && failures < input.policy.maximumFailedAttempts) yield* transaction.insert(mapping.failureEvent.table).values(mapping.failureEvent.encodeInsert({
-						moduleId: input.moduleId,
-						purpose: input.purpose,
-						seriesKey: keys.series,
-						commandId: input.continuationId,
-						occurredAtMillis: now,
-						retentionUntilMillis: retentionUntil
-					}));
-					return prepared;
-				}
-				const version = yield* allocateVersion(mapping, configuration.mode);
-				const expiresAt = Math.min(Number(yield* mapping.decodeInstant(generation[mapping.generation.expiresAt])), now + input.policy.continuationLifetimeMillis);
-				const continuation = {
-					moduleId: input.moduleId,
-					purpose: input.purpose,
-					continuationId: input.continuationId,
-					digest: input.continuationDigest,
-					proofId: input.proofId,
-					seriesKey: keys.series,
-					binding: input.binding,
-					expiresAtMillis: expiresAt,
-					version
-				};
-				const prepared = prepare({
-					_tag: "Accepted",
-					continuation: {
-						continuationId: input.continuationId,
-						purpose: input.purpose,
-						expiresAtMillis: expiresAt
-					}
-				}, journal);
-				yield* insertCommand(mapping, input.moduleId, input.continuationId, "attempt", "accepted", retentionUntil);
-				yield* insertScopeEvents(mapping, input.moduleId, input.purpose, "attempt", input.continuationId, scopes, now, retentionUntil);
-				yield* transaction.update(mapping.generation.table).set(updateValues([[mapping.generation.state, "consumed"]])).where(and(eq(gc.moduleId, input.moduleId), eq(gc.proofId, input.proofId), eq(gc.state, "active")));
-				yield* transaction.insert(mapping.continuation.table).values(mapping.continuation.encodeInsert({
-					...continuation,
-					retentionUntilMillis: retentionUntil
-				}));
-				return prepared;
-			})).pipe(Effect.provideService(CurrentProofSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
-			complete: (input, prepare) => owned(database, mapping, configuration, Effect.gen(function* () {
-				const journal = yield* CurrentCommitJournal;
-				return yield* completeIn(mapping, configuration, input, (decision) => prepare(decision, journal));
-			})).pipe(Effect.provideService(CurrentProofSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
-			claimDelivery: (input, prepare) => owned(database, mapping, configuration, Effect.gen(function* () {
-				const transaction = yield* CurrentProofSql;
-				const journal = yield* CurrentCommitJournal;
-				const row = (yield* readGeneration(mapping, input.moduleId, input.proofId, configuration.locking))[0];
-				const now = yield* nowMillis;
-				if (row === void 0) return prepare({ _tag: "Declined" }, journal);
-				const c = generationColumns(mapping);
-				const expiresAt = yield* mapping.decodeInstant(row[mapping.generation.expiresAt]);
-				const claimDeadline = row[mapping.generation.claimDeadline] === null || row[mapping.generation.claimDeadline] === void 0 ? void 0 : yield* mapping.decodeInstant(row[mapping.generation.claimDeadline]);
-				const retryAt = row[mapping.generation.retryAt] === null || row[mapping.generation.retryAt] === void 0 ? void 0 : yield* mapping.decodeInstant(row[mapping.generation.retryAt]);
-				let state = row[mapping.generation.deliveryState];
-				if (state === "claimed" && claimDeadline !== void 0 && claimDeadline <= now) {
-					state = "ambiguous";
-					yield* transaction.update(mapping.generation.table).set(updateValues([[mapping.generation.deliveryState, "ambiguous"]])).where(and(eq(c.moduleId, input.moduleId), eq(c.proofId, input.proofId)));
-				}
-				if (!(row[mapping.generation.version] === input.version && row[mapping.generation.deliveryId] === input.deliveryId && row[mapping.generation.state] === "active" && expiresAt > now && Number(row[mapping.generation.sendCount]) < input.policy.maximumDeliveryAttempts && (state === "new" || state === "ambiguous" && input.allowAmbiguousRetry && (retryAt === void 0 || retryAt <= now)))) return prepare({ _tag: "Declined" }, journal);
-				const claimVersion = yield* allocateVersion(mapping, configuration.mode);
-				const prepared = prepare({
-					_tag: "Claimed",
-					claimVersion
-				}, journal);
-				yield* transaction.update(mapping.generation.table).set(updateValues([
-					[mapping.generation.sendCount, Number(row[mapping.generation.sendCount]) + 1],
-					[mapping.generation.deliveryState, "claimed"],
-					[mapping.generation.claimVersion, claimVersion],
-					[mapping.generation.claimDeadline, mapping.encodeInstant(now + input.policy.deliveryClaimMillis)],
-					[mapping.generation.retryAt, mapping.encodeInstant(now + input.policy.deliveryRetryMillis)]
-				])).where(and(eq(c.moduleId, input.moduleId), eq(c.proofId, input.proofId)));
-				return prepared;
-			})).pipe(Effect.provideService(CurrentProofSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
-			settleDelivery: (input, prepare) => owned(database, mapping, configuration, Effect.gen(function* () {
-				const transaction = yield* CurrentProofSql;
-				const journal = yield* CurrentCommitJournal;
-				const initial = (yield* readGeneration(mapping, input.moduleId, input.proofId, false))[0];
-				if (initial === void 0) return prepare(void 0, journal);
-				const keys = initial[mapping.generation.seriesKey];
-				yield* ensureSeries(mapping, configuration, input.moduleId, initial[mapping.generation.purpose], keys);
-				const row = (yield* readGeneration(mapping, input.moduleId, input.proofId, configuration.locking))[0];
-				const prepared = prepare(void 0, journal);
-				if (row === void 0 || row[mapping.generation.version] !== input.version || row[mapping.generation.deliveryId] !== input.deliveryId || row[mapping.generation.claimVersion] !== input.claimVersion || row[mapping.generation.deliveryState] !== "claimed") return prepared;
-				const c = generationColumns(mapping);
-				const outcome = input.outcome;
-				const state = outcome._tag === "Accepted" ? "accepted" : outcome._tag === "DefiniteFailure" ? "failed" : "ambiguous";
-				const values = [[mapping.generation.deliveryState, state], [mapping.generation.claimDeadline, null]];
-				if (outcome._tag === "Ambiguous") values.push([mapping.generation.retryAt, mapping.encodeInstant((yield* nowMillis) + Number(row[mapping.generation.deliveryRetryMillis]))]);
-				if (outcome._tag === "DefiniteFailure") values.push([mapping.generation.state, "cancelled"]);
-				yield* transaction.update(mapping.generation.table).set(updateValues(values)).where(and(eq(c.moduleId, input.moduleId), eq(c.proofId, input.proofId)));
-				if (outcome._tag === "DefiniteFailure") {
-					const sc = seriesColumns(mapping);
-					yield* transaction.update(mapping.series.table).set(updateValues([[mapping.series.activeProofId, null]])).where(and(eq(sc.moduleId, input.moduleId), eq(sc.purpose, row[mapping.generation.purpose]), eq(sc.scopeKey, keys), eq(sc.activeProofId, input.proofId)));
-				}
-				return prepared;
-			})).pipe(Effect.provideService(CurrentProofSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
-			cancel: (input, prepare) => owned(database, mapping, configuration, Effect.gen(function* () {
-				const transaction = yield* CurrentProofSql;
-				const journal = yield* CurrentCommitJournal;
-				const authorityCurrent = yield* lockAuthority(mapping, input.moduleId, input.purpose, input.binding, configuration.locking);
-				const keys = mapping.scopeKeys({
-					moduleId: input.moduleId,
-					purpose: input.purpose,
-					binding: input.binding
-				});
-				const active = (yield* ensureSeries(mapping, configuration, input.moduleId, input.purpose, keys.series))[mapping.series.activeProofId];
-				const prepared = prepare(void 0, journal);
-				if (authorityCurrent && active !== void 0 && active !== null) {
-					const gc = generationColumns(mapping);
-					const sc = seriesColumns(mapping);
-					const row = (yield* readGeneration(mapping, input.moduleId, active, configuration.locking))[0];
-					const storedBinding = row === void 0 ? void 0 : yield* mapping.generation.decodeBinding(row);
-					if (storedBinding === void 0 || !sameBinding(storedBinding, input.binding)) return prepared;
-					yield* transaction.update(mapping.generation.table).set(updateValues([[mapping.generation.state, "cancelled"]])).where(and(eq(gc.moduleId, input.moduleId), eq(gc.proofId, active)));
-					yield* transaction.update(mapping.series.table).set(updateValues([[mapping.series.activeProofId, null]])).where(and(eq(sc.moduleId, input.moduleId), eq(sc.purpose, input.purpose), eq(sc.scopeKey, keys.series), eq(sc.activeProofId, active)));
-				}
-				return prepared;
-			})).pipe(Effect.provideService(CurrentProofSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
-			cleanup: (input, prepare) => owned(database, mapping, configuration, Effect.gen(function* () {
-				const transaction = yield* CurrentProofSql;
-				const journal = yield* CurrentCommitJournal;
-				const now = yield* nowMillis;
-				const nativeNow = mapping.encodeInstant(now);
-				const gc = generationColumns(mapping);
-				const cc = continuationColumns(mapping);
-				const rc = requestColumns(mapping);
-				const ac = abuseColumns(mapping);
-				const fc = failureColumns(mapping);
-				const mc = commandColumns(mapping);
-				const sc = seriesColumns(mapping);
-				const rsc = scopeColumns(mapping);
-				let remaining = input.limit;
-				let hasMore = false;
-				const take = (query) => selectRows(query.limit(remaining + 1), configuration.locking).pipe(Effect.map((rows) => {
-					if (rows.length > remaining) hasMore = true;
-					const selected = rows.slice(0, remaining);
-					remaining -= selected.length;
-					return selected;
-				}));
-				const continuations = yield* take(transaction.select({ continuationId: cc.continuationId }).from(mapping.continuation.table).where(and(eq(cc.moduleId, input.moduleId), lte(cc.retentionUntil, nativeNow))).orderBy(cc.retentionUntil));
-				const generations = yield* take(transaction.select({ proofId: gc.proofId }).from(mapping.generation.table).where(and(eq(gc.moduleId, input.moduleId), lte(gc.retentionUntil, nativeNow))).orderBy(gc.retentionUntil));
-				const requests = yield* take(transaction.select({ requestId: rc.requestId }).from(mapping.request.table).where(and(eq(rc.moduleId, input.moduleId), lte(rc.retentionUntil, nativeNow))).orderBy(rc.retentionUntil));
-				const abuse = yield* take(transaction.select({
-					action: ac.action,
-					scopeKind: ac.scopeKind,
-					scopeKey: ac.scopeKey,
-					commandId: ac.commandId
-				}).from(mapping.abuseEvent.table).where(and(eq(ac.moduleId, input.moduleId), lte(ac.retentionUntil, nativeNow))).orderBy(ac.retentionUntil));
-				const failures = yield* take(transaction.select({
-					seriesKey: fc.seriesKey,
-					commandId: fc.commandId
-				}).from(mapping.failureEvent.table).where(and(eq(fc.moduleId, input.moduleId), lte(fc.retentionUntil, nativeNow))).orderBy(fc.retentionUntil));
-				const commands = yield* take(transaction.select({ commandId: mc.commandId }).from(mapping.command.table).where(and(eq(mc.moduleId, input.moduleId), lte(mc.retentionUntil, nativeNow))).orderBy(mc.retentionUntil));
-				const series = yield* take(transaction.select({
-					purpose: sc.purpose,
-					scopeKey: sc.scopeKey
-				}).from(mapping.series.table).where(and(eq(sc.moduleId, input.moduleId), isNull(sc.activeProofId), notExists(transaction.select({ one: sql`1` }).from(mapping.generation.table).where(and(eq(gc.moduleId, sc.moduleId), eq(gc.purpose, sc.purpose), eq(gc.seriesKey, sc.scopeKey)))), notExists(transaction.select({ one: sql`1` }).from(mapping.failureEvent.table).where(and(eq(fc.moduleId, sc.moduleId), eq(fc.purpose, sc.purpose), eq(fc.seriesKey, sc.scopeKey)))))));
-				const rateScopes = yield* take(transaction.select({
-					purpose: rsc.purpose,
-					action: rsc.action,
-					scopeKind: rsc.scopeKind,
-					scopeKey: rsc.scopeKey
-				}).from(mapping.rateScope.table).where(and(eq(rsc.moduleId, input.moduleId), notExists(transaction.select({ one: sql`1` }).from(mapping.abuseEvent.table).where(and(eq(ac.moduleId, rsc.moduleId), eq(ac.purpose, rsc.purpose), eq(ac.action, rsc.action), eq(ac.scopeKind, rsc.scopeKind), eq(ac.scopeKey, rsc.scopeKey)))))));
-				hasMore ||= generations.length > 0 || failures.length > 0 || abuse.length > 0;
-				const prepared = prepare({
-					removed: input.limit - remaining,
-					hasMore
-				}, journal);
-				if (continuations.length > 0) yield* transaction.delete(mapping.continuation.table).where(and(eq(cc.moduleId, input.moduleId), inArray(cc.continuationId, continuations.map((row) => row.continuationId)), lte(cc.retentionUntil, nativeNow)));
-				if (generations.length > 0) yield* transaction.update(mapping.series.table).set(updateValues([[mapping.series.activeProofId, null]])).where(and(eq(sc.moduleId, input.moduleId), inArray(sc.activeProofId, generations.map((row) => row.proofId))));
-				if (generations.length > 0) yield* transaction.delete(mapping.generation.table).where(and(eq(gc.moduleId, input.moduleId), inArray(gc.proofId, generations.map((row) => row.proofId)), lte(gc.retentionUntil, nativeNow)));
-				if (requests.length > 0) yield* transaction.delete(mapping.request.table).where(and(eq(rc.moduleId, input.moduleId), inArray(rc.requestId, requests.map((row) => row.requestId)), lte(rc.retentionUntil, nativeNow)));
-				for (const row of abuse) yield* transaction.delete(mapping.abuseEvent.table).where(and(eq(ac.moduleId, input.moduleId), eq(ac.action, row.action), eq(ac.scopeKind, row.scopeKind), eq(ac.scopeKey, row.scopeKey), eq(ac.commandId, row.commandId), lte(ac.retentionUntil, nativeNow)));
-				for (const row of failures) yield* transaction.delete(mapping.failureEvent.table).where(and(eq(fc.moduleId, input.moduleId), eq(fc.seriesKey, row.seriesKey), eq(fc.commandId, row.commandId), lte(fc.retentionUntil, nativeNow)));
-				if (commands.length > 0) yield* transaction.delete(mapping.command.table).where(and(eq(mc.moduleId, input.moduleId), inArray(mc.commandId, commands.map((row) => row.commandId)), lte(mc.retentionUntil, nativeNow)));
-				for (const row of series) yield* transaction.delete(mapping.series.table).where(and(eq(sc.moduleId, input.moduleId), eq(sc.purpose, row.purpose), eq(sc.scopeKey, row.scopeKey), isNull(sc.activeProofId), notExists(transaction.select({ one: sql`1` }).from(mapping.generation.table).where(and(eq(gc.moduleId, sc.moduleId), eq(gc.purpose, sc.purpose), eq(gc.seriesKey, sc.scopeKey))))));
-				for (const row of rateScopes) yield* transaction.delete(mapping.rateScope.table).where(and(eq(rsc.moduleId, input.moduleId), eq(rsc.purpose, row.purpose), eq(rsc.action, row.action), eq(rsc.scopeKind, row.scopeKind), eq(rsc.scopeKey, row.scopeKey), notExists(transaction.select({ one: sql`1` }).from(mapping.abuseEvent.table).where(and(eq(ac.moduleId, rsc.moduleId), eq(ac.purpose, rsc.purpose), eq(ac.action, rsc.action), eq(ac.scopeKind, rsc.scopeKind), eq(ac.scopeKey, rsc.scopeKey))))));
-				return prepared;
-			})).pipe(Effect.provideService(CurrentProofSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure)
-		});
-	});
-	const inspectCompletionIn = Effect.fn("DrizzleProof.inspectCompletionIn")(function* (mapping, configuration, input, ensure) {
-		const database = yield* CurrentProofSql;
-		const authorityCurrent = yield* lockAuthority(mapping, input.moduleId, input.purpose, input.binding, configuration.locking);
-		const keys = mapping.scopeKeys({
-			moduleId: input.moduleId,
-			purpose: input.purpose,
-			binding: input.binding
-		});
-		if (ensure) yield* ensureSeries(mapping, configuration, input.moduleId, input.purpose, keys.series);
-		const c = continuationColumns(mapping);
-		const row = (yield* selectRows(database.select().from(mapping.continuation.table).where(and(eq(c.moduleId, input.moduleId), eq(c.continuationId, input.continuationId))).limit(1), configuration.locking))[0];
-		const now = yield* nowMillis;
-		const record = row === void 0 ? void 0 : yield* mapping.continuation.decode(row);
-		return authorityCurrent && row !== void 0 && record !== void 0 && record.moduleId === input.moduleId && record.continuationId === input.continuationId && record.purpose === input.purpose && record.digest === input.continuationDigest && record.seriesKey === keys.series && sameBinding(record.binding, input.binding) && row[mapping.continuation.consumed] === false && record.expiresAtMillis > now ? {
-			record,
-			row,
-			columns: c
-		} : void 0;
-	});
-	/** Nonconsuming same-owner preflight; it never inserts a series or changes expiry. */
-	const checkProofCompletionIn = Effect.fn("Drizzle.checkProofCompletionIn")(function* (mapping, configuration, input) {
-		return yield* inspectCompletionIn(mapping, configuration, input, false).pipe(Effect.map((value) => value !== void 0));
-	});
-	const completeIn = Effect.fn("DrizzleProof.completeIn")(function* (mapping, configuration, input, prepare, protectedMutation) {
-		const database = yield* CurrentProofSql;
-		const accepted = yield* inspectCompletionIn(mapping, configuration, input, true);
-		if (accepted === void 0) return prepare("rejected");
-		const { record, row: original, columns: c } = accepted;
-		if (protectedMutation !== void 0 && !(yield* protectedMutation)) return yield* unavailable();
-		const value = prepare("completed");
-		yield* database.update(mapping.continuation.table).set(updateValues([[mapping.continuation.consumed, true]])).where(and(eq(c.moduleId, input.moduleId), eq(c.continuationId, input.continuationId), eq(c.digest, input.continuationDigest), eq(c.consumed, false)));
-		yield* insertCommand(mapping, input.moduleId, input.continuationDigest, "complete", "completed", record.expiresAtMillis);
-		const assertApplied = Effect.flatMap(CurrentPasswordPreparedTransaction, (currentTransaction) => Effect.gen(function* () {
-			const persisted = (yield* selectRows(currentTransaction.select().from(mapping.continuation.table).where(and(eq(c.moduleId, input.moduleId), eq(c.continuationId, input.continuationId))).limit(1), false))[0];
-			const command = (yield* commandRow(mapping, input.moduleId, input.continuationDigest, false))[0];
-			const decoded = persisted === void 0 ? void 0 : yield* mapping.continuation.decode(persisted);
-			const immutable = [
-				mapping.continuation.moduleId,
-				mapping.continuation.purpose,
-				mapping.continuation.continuationId,
-				mapping.continuation.digest,
-				mapping.continuation.proofId,
-				mapping.continuation.seriesKey,
-				mapping.continuation.version
-			];
-			if (persisted === void 0 || decoded === void 0 || !sameBinding(decoded.binding, record.binding) || persisted[mapping.continuation.consumed] !== true || immutable.some((key) => persisted[key] !== original[key]) || (yield* mapping.decodeInstant(persisted[mapping.continuation.expiresAt])) !== record.expiresAtMillis || (yield* mapping.decodeInstant(persisted[mapping.continuation.retentionUntil])) !== (yield* mapping.decodeInstant(original[mapping.continuation.retentionUntil])) || command === void 0 || command[mapping.command.kind] !== "complete" || command[mapping.command.decision] !== "completed" || (yield* mapping.decodeInstant(command[mapping.command.retentionUntil])) !== record.expiresAtMillis) return yield* unavailable();
-			if (record.expiresAtMillis <= (yield* nowMillis)) return yield* unavailable();
-		}).pipe(Effect.provideService(CurrentProofSql, currentTransaction)));
-		yield* assertApplied.pipe(Effect.provideService(CurrentPasswordPreparedTransaction, database));
-		const postconditions = yield* Effect.serviceOption(PasswordPreparedPostconditions);
-		if (Option.isSome(postconditions) && !postconditions.value.register(assertApplied.pipe(translateFailure))) return yield* unavailable();
-		return value;
-	});
-	return {
-		makeSqlProofPersistence,
-		checkProofCompletionIn,
-		completeProofPlanIn: Effect.fn("Drizzle.completeProofPlanIn")(function* (mapping, configuration, plan, protectedMutation, project) {
-			const journal = yield* CurrentCommitJournal;
-			return yield* completeIn(mapping, configuration, plan.input, (decision) => plan.prepare(decision, journal, project), protectedMutation);
-		})
-	};
-};
-//#endregion
-export { CurrentProofSql, makeProofKernel };
-
-//# sourceMappingURL=proof-kernel.mjs.map