@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.26

package/dist/internal/email-kernel.mjs

@@ -1,497 +0,0 @@
-import { PersistenceMappingError, isMappedConstraintConflict } from "./mapping-error.mjs";
-import { CurrentProofSql } from "./proof-kernel.mjs";
-import { requiredEmailAddressConstraints, requiredEmailSignInConstraints } from "./models/email-model.mjs";
-import { Cause, Context, DateTime, Effect, Option, Schema } from "effect";
-import { CurrentCommitJournal, HookConfigurationError, LifecycleHooks, coordinateCommit, hasCommitScope } from "@yielded/auth/Hooks";
-import { assessAuthentication, snapshotAuthenticationEvidence } from "@yielded/auth/Sessions";
-import { reportPersistenceFailure } from "@yielded/auth/Persistence";
-import { ProofUnavailable } from "@yielded/auth/Proofs";
-import { EmailAddressPersistence, EmailSignInTargets, EmailUnavailable, snapshotEmailCredential, snapshotEmailRequirement, snapshotEmailRevision } from "@yielded/auth/Email";
-//#region src/internal/email-kernel.ts
-var CurrentEmailSql = class extends Context.Service()("effect-auth/CurrentEmailSql") {};
-const makeEmailKernel = (operations, proofs) => {
-	const { and, eq, inArray, lte, column, updateValues } = operations;
-	const { completeProofPlanIn } = proofs;
-	const unavailable = () => EmailUnavailable.make({});
-	const translateFailure = (effect) => reportPersistenceFailure(effect, (error) => Schema.is(EmailUnavailable)(error) || Schema.is(ProofUnavailable)(error) || Schema.is(HookConfigurationError)(error)).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));
-	const nowMillis = Effect.map(DateTime.now, DateTime.toEpochMillis);
-	const selectRows = (query, locking) => locking && typeof query.for === "function" ? query.for("update") : query;
-	const sameIdentifier = (left, right) => left.namespace === right.namespace && left.value === right.value;
-	const validEmailSignInConstraints = (mapping) => Object.entries(requiredEmailSignInConstraints).every(([key, value]) => mapping.constraints[key] === value);
-	const validAddressConstraints = (mapping) => Object.entries(requiredEmailAddressConstraints).every(([key, value]) => mapping.constraints[key] === value);
-	const subjectColumns = (mapping) => ({
-		id: column(mapping.subject.table, mapping.subject.id),
-		status: column(mapping.subject.table, mapping.subject.status),
-		securityRevision: column(mapping.subject.table, mapping.subject.securityRevision)
-	});
-	const identifierColumns = (mapping) => ({
-		namespace: column(mapping.identifier.table, mapping.identifier.namespace),
-		value: column(mapping.identifier.table, mapping.identifier.value),
-		subjectId: column(mapping.identifier.table, mapping.identifier.subjectId),
-		verifiedAt: column(mapping.identifier.table, mapping.identifier.verifiedAt),
-		bindingRevision: column(mapping.identifier.table, mapping.identifier.bindingRevision)
-	});
-	const credentialColumns = (mapping) => ({
-		moduleId: column(mapping.credential.table, mapping.credential.moduleId),
-		subjectId: column(mapping.credential.table, mapping.credential.subjectId),
-		credentialId: column(mapping.credential.table, mapping.credential.credentialId),
-		identifierNamespace: column(mapping.credential.table, mapping.credential.identifierNamespace),
-		identifierValue: column(mapping.credential.table, mapping.credential.identifierValue),
-		credentialRevision: column(mapping.credential.table, mapping.credential.credentialRevision),
-		status: column(mapping.credential.table, mapping.credential.status)
-	});
-	const authorityColumns = (mapping) => ({
-		subjectId: column(mapping.authorityCredential.table, mapping.authorityCredential.subjectId),
-		credentialId: column(mapping.authorityCredential.table, mapping.authorityCredential.credentialId),
-		revision: column(mapping.authorityCredential.table, mapping.authorityCredential.revision),
-		status: column(mapping.authorityCredential.table, mapping.authorityCredential.status)
-	});
-	const commandColumns = (mapping) => ({
-		moduleId: column(mapping.command.table, mapping.command.moduleId),
-		commandId: column(mapping.command.table, mapping.command.commandId),
-		action: column(mapping.command.table, mapping.command.action),
-		bindingDigest: column(mapping.command.table, mapping.command.bindingDigest),
-		retentionUntil: column(mapping.command.table, mapping.command.retentionUntil)
-	});
-	const allocate = (mode, asynchronous, synchronous) => {
-		if (mode === "synchronous") return synchronous === void 0 ? Effect.fail(unavailable()) : Effect.try({
-			try: synchronous,
-			catch: (cause) => new PersistenceMappingError({
-				operation: "mapping",
-				cause
-			})
-		});
-		if (asynchronous !== void 0) return asynchronous;
-		return synchronous === void 0 ? Effect.fail(unavailable()) : Effect.try({
-			try: synchronous,
-			catch: (cause) => new PersistenceMappingError({
-				operation: "mapping",
-				cause
-			})
-		});
-	};
-	const nextSecurityRevision = (mapping, mode, current) => {
-		if (mode === "synchronous") return mapping.subject.nextSecurityRevisionSync === void 0 ? Effect.fail(unavailable()) : Effect.try({
-			try: () => mapping.subject.nextSecurityRevisionSync(current),
-			catch: (cause) => new PersistenceMappingError({
-				operation: "mapping",
-				cause
-			})
-		});
-		if (mapping.subject.nextSecurityRevision !== void 0) return mapping.subject.nextSecurityRevision(current);
-		if (mapping.subject.nextSecurityRevisionSync !== void 0) return Effect.try({
-			try: () => mapping.subject.nextSecurityRevisionSync(current),
-			catch: (cause) => new PersistenceMappingError({
-				operation: "mapping",
-				cause
-			})
-		});
-		return Effect.fail(unavailable());
-	};
-	const safeRead = (database, configuration, body) => Effect.gen(function* () {
-		if (configuration.coordinated !== true) {
-			if (yield* hasCommitScope) return yield* unavailable();
-			yield* configuration.standaloneGuard;
-		}
-		return yield* database.transaction((transaction) => body.pipe(Effect.provideService(CurrentEmailSql, transaction), Effect.provideService(CurrentProofSql, transaction)));
-	});
-	const owned = (database, configuration, body) => {
-		const run = coordinateCommit(() => database.transaction((transaction) => body.pipe(Effect.provideService(CurrentEmailSql, transaction), Effect.provideService(CurrentProofSql, transaction))), { mode: configuration.mode }).pipe(Effect.map((result) => result.value));
-		return configuration.coordinated !== true ? Effect.gen(function* () {
-			if (yield* hasCommitScope) return yield* unavailable();
-			yield* configuration.standaloneGuard;
-			return yield* run;
-		}) : run;
-	};
-	const emailLookupQuery = (mapping, moduleId, identifier) => {
-		const subject = subjectColumns(mapping), binding = identifierColumns(mapping), credential = credentialColumns(mapping);
-		return {
-			fields: {
-				subject: mapping.subject.table,
-				identifier: mapping.identifier.table,
-				credential: mapping.credential.table
-			},
-			from: mapping.identifier.table,
-			subjectTable: mapping.subject.table,
-			subjectJoin: eq(subject.id, binding.subjectId),
-			credentialTable: mapping.credential.table,
-			credentialJoin: and(eq(credential.moduleId, moduleId), eq(credential.subjectId, binding.subjectId), eq(credential.identifierNamespace, binding.namespace), eq(credential.identifierValue, binding.value)),
-			predicate: and(eq(binding.namespace, identifier.namespace), eq(binding.value, identifier.value)),
-			limit: 1
-		};
-	};
-	const emailLookupRows = Effect.fn("Drizzle.emailLookupRows")(function* (mapping, moduleId, identifier) {
-		const database = yield* CurrentEmailSql;
-		const query = emailLookupQuery(mapping, moduleId, identifier);
-		return yield* database.select(query.fields).from(query.from).innerJoin(query.subjectTable, query.subjectJoin).innerJoin(query.credentialTable, query.credentialJoin).where(query.predicate).limit(query.limit);
-	});
-	const decodeEmailSnapshot = Effect.fn("DrizzleEmail.decodeSnapshot")(function* (mapping, moduleId, requested, row) {
-		if (!mapping.subject.isActiveStatus(row.subject[mapping.subject.status]) || !mapping.identifier.isCurrent(row.identifier) || !mapping.credential.isActiveStatus(row.credential[mapping.credential.status])) return void 0;
-		const snapshot = yield* mapping.credential.decode({
-			moduleId,
-			subject: row.subject,
-			identifier: row.identifier,
-			credential: row.credential
-		}).pipe(Effect.flatMap(snapshotEmailCredential));
-		const subjectId = yield* mapping.subjectId.toSubject(row.subject[mapping.subject.id]);
-		const verifiedAtMillis = yield* mapping.decodeInstant(row.identifier[mapping.identifier.verifiedAt]);
-		if (snapshot.moduleId !== moduleId || !sameIdentifier(snapshot.identifier, requested) || snapshot.revision.subjectId !== subjectId || snapshot.revision.securityRevision !== row.subject[mapping.subject.securityRevision] || snapshot.identifierRevision !== row.identifier[mapping.identifier.bindingRevision] || snapshot.verifiedAtMillis !== verifiedAtMillis || snapshot.credentialId !== row.credential[mapping.credential.credentialId] || snapshot.credentialRevision !== row.credential[mapping.credential.credentialRevision]) return void 0;
-		return snapshot;
-	});
-	const makeSqlEmailSignInTargets = Effect.fn("makeSqlEmailSignInTargets")(function* (mapping, configuration) {
-		const database = yield* CurrentEmailSql;
-		if (!configuration.coordinated) yield* (operations.validateStorage?.({
-			...mapping,
-			proof: configuration.proof?.mapping
-		}) ?? Effect.void).pipe(Effect.mapError(unavailable));
-		return EmailSignInTargets.of({ lookup: (input) => (validEmailSignInConstraints(mapping) ? safeRead(database, configuration, Effect.gen(function* () {
-			const row = (yield* emailLookupRows(mapping, input.moduleId, input.identifier))[0];
-			if (row === void 0) return Option.none();
-			const snapshot = yield* decodeEmailSnapshot(mapping, input.moduleId, input.identifier, row);
-			return snapshot === void 0 ? Option.none() : Option.some(snapshot);
-		})) : Effect.fail(unavailable())).pipe(Effect.provideService(CurrentEmailSql, database), translateFailure) });
-	});
-	const readSubject = Effect.fn("DrizzleEmail.readSubject")(function* (mapping, subjectId, locking) {
-		const database = yield* CurrentEmailSql;
-		const nativeSubjectId = yield* mapping.subjectId.toNative(subjectId);
-		const s = subjectColumns(mapping);
-		return {
-			nativeSubjectId,
-			subject: (yield* selectRows(database.select().from(mapping.subject.table).where(eq(s.id, nativeSubjectId)).limit(1), locking))[0]
-		};
-	});
-	const identifierRow = Effect.fn("Drizzle.identifierRow")(function* (mapping, identifier, locking) {
-		const database = yield* CurrentEmailSql;
-		const i = identifierColumns(mapping);
-		return yield* selectRows(database.select().from(mapping.identifier.table).where(and(eq(i.namespace, identifier.namespace), eq(i.value, identifier.value))).limit(1), locking);
-	});
-	const credentialById = Effect.fn("Drizzle.credentialById")(function* (mapping, moduleId, credentialId, locking) {
-		const database = yield* CurrentEmailSql;
-		const c = credentialColumns(mapping);
-		return yield* selectRows(database.select().from(mapping.credential.table).where(and(eq(c.moduleId, moduleId), eq(c.credentialId, credentialId))).limit(1), locking);
-	});
-	const credentialByIdentifier = Effect.fn("Drizzle.credentialByIdentifier")(function* (mapping, moduleId, identifier, locking) {
-		const database = yield* CurrentEmailSql;
-		const c = credentialColumns(mapping);
-		return yield* selectRows(database.select().from(mapping.credential.table).where(and(eq(c.moduleId, moduleId), eq(c.identifierNamespace, identifier.namespace), eq(c.identifierValue, identifier.value))).limit(1), locking);
-	});
-	const currentAddress = Effect.fn("DrizzleEmail.currentAddress")(function* (mapping, input, locking) {
-		const database = yield* CurrentEmailSql;
-		const locked = yield* readSubject(mapping, input.subjectId, locking);
-		if (locked.subject === void 0 || !mapping.subject.isActiveStatus(locked.subject[mapping.subject.status])) return void 0;
-		const discoveredSource = input.sourceCredentialId === void 0 ? void 0 : (yield* credentialById(mapping, input.moduleId, input.sourceCredentialId, false))[0];
-		const sourceIdentifier = discoveredSource === void 0 ? void 0 : {
-			namespace: discoveredSource[mapping.credential.identifierNamespace],
-			value: discoveredSource[mapping.credential.identifierValue]
-		};
-		const identifiers = [input.target, ...sourceIdentifier === void 0 ? [] : [sourceIdentifier]].filter((value, index, values) => values.findIndex((candidate) => sameIdentifier(candidate, value)) === index).sort((left, right) => `${left.namespace}\u0000${left.value}`.localeCompare(`${right.namespace}\u0000${right.value}`));
-		const lockedIdentifiers = /* @__PURE__ */ new Map();
-		for (const identifier of identifiers) {
-			const row = (yield* identifierRow(mapping, identifier, locking))[0];
-			if (row !== void 0) lockedIdentifiers.set(`${identifier.namespace}\u0000${identifier.value}`, row);
-		}
-		const sourceCredential = input.sourceCredentialId === void 0 ? void 0 : (yield* credentialById(mapping, input.moduleId, input.sourceCredentialId, locking))[0];
-		const targetCredential = (yield* credentialByIdentifier(mapping, input.moduleId, input.target, locking))[0];
-		const a = authorityColumns(mapping);
-		const activeAuthority = (yield* selectRows(database.select().from(mapping.authorityCredential.table).where(eq(a.subjectId, locked.nativeSubjectId)).orderBy(a.credentialId), locking)).filter((row) => mapping.authorityCredential.isActiveStatus(row[mapping.authorityCredential.status]));
-		const subjectId = yield* mapping.subjectId.toSubject(locked.nativeSubjectId);
-		const revision = Object.freeze({
-			subjectId,
-			securityRevision: locked.subject[mapping.subject.securityRevision],
-			credentials: Object.freeze(activeAuthority.map((row) => Object.freeze({
-				credentialId: row[mapping.authorityCredential.credentialId],
-				revision: row[mapping.authorityCredential.revision]
-			})))
-		});
-		const targetIdentifier = lockedIdentifiers.get(`${input.target.namespace}\u0000${input.target.value}`);
-		const targetMutable = targetIdentifier !== void 0 && mapping.subjectId.equals(targetIdentifier[mapping.identifier.subjectId], locked.nativeSubjectId) && mapping.identifier.isMutableTarget(targetIdentifier) && (targetCredential === void 0 || !mapping.credential.isActiveStatus(targetCredential[mapping.credential.status]) && mapping.subjectId.equals(targetCredential[mapping.credential.subjectId], locked.nativeSubjectId));
-		let source;
-		if (input.sourceCredentialId !== void 0) {
-			if (sourceCredential === void 0 || sourceIdentifier === void 0 || !mapping.subjectId.equals(sourceCredential[mapping.credential.subjectId], locked.nativeSubjectId) || !mapping.credential.isActiveStatus(sourceCredential[mapping.credential.status])) return void 0;
-			const sourceIdentifierRow = lockedIdentifiers.get(`${sourceIdentifier.namespace}\u0000${sourceIdentifier.value}`);
-			if (sourceIdentifierRow === void 0 || !mapping.identifier.isCurrent(sourceIdentifierRow) || !mapping.subjectId.equals(sourceIdentifierRow[mapping.identifier.subjectId], locked.nativeSubjectId)) return void 0;
-			source = {
-				credential: sourceCredential,
-				identifier: sourceIdentifierRow,
-				snapshot: yield* mapping.credential.decode({
-					moduleId: input.moduleId,
-					subject: locked.subject,
-					identifier: sourceIdentifierRow,
-					credential: sourceCredential
-				}).pipe(Effect.flatMap(snapshotEmailCredential))
-			};
-		}
-		let eligible = targetIdentifier === void 0 ? targetCredential === void 0 : targetMutable;
-		if (input.sourceCredentialId !== void 0 && source === void 0) eligible = false;
-		if (source !== void 0 && sameIdentifier(source.snapshot.identifier, input.target)) eligible = false;
-		if (mapping.addressCardinality === "single" && input.sourceCredentialId === void 0) {
-			const c = credentialColumns(mapping);
-			if ((yield* selectRows(database.select().from(mapping.credential.table).where(and(eq(c.moduleId, input.moduleId), eq(c.subjectId, locked.nativeSubjectId))), locking)).some((row) => mapping.credential.isActiveStatus(row[mapping.credential.status]))) eligible = false;
-		}
-		return {
-			nativeSubjectId: locked.nativeSubjectId,
-			subject: locked.subject,
-			revision,
-			...source === void 0 ? {} : { source },
-			...targetIdentifier === void 0 ? {} : { targetIdentifier },
-			...targetCredential === void 0 ? {} : { targetCredential },
-			...targetMutable ? { targetIdentifierRevision: targetIdentifier[mapping.identifier.bindingRevision] } : {},
-			eligible
-		};
-	});
-	const sameEmailRevision = (left, right) => {
-		if (left.subjectId !== right.subjectId || left.securityRevision !== right.securityRevision || left.credentials.length !== right.credentials.length) return false;
-		const expected = [...left.credentials].sort((a, b) => a.credentialId.localeCompare(b.credentialId));
-		const actual = [...right.credentials].sort((a, b) => a.credentialId.localeCompare(b.credentialId));
-		return expected.every((item, index) => item.credentialId === actual[index].credentialId && item.revision === actual[index].revision);
-	};
-	const actionModule = (moduleId, action) => `${moduleId}/${action === "verify-address" ? "verify-address" : "change-address"}`;
-	const actionPurpose = (action) => action === "verify-address" ? "email-address-verification" : "email-address-change";
-	const completionMatches = (input, action) => {
-		const completion = input.completion.input;
-		const binding = completion.binding;
-		return completion.moduleId === actionModule(input.moduleId, action) && completion.purpose === actionPurpose(action) && binding._tag === "IdentifierChange" && sameIdentifier(binding.identifier, input.target) && sameEmailRevision(binding.revision, input.captured.revision);
-	};
-	const snapshotEmailMutation = Effect.fn("DrizzleEmail.snapshotMutation")(function* (input) {
-		const evidence = yield* snapshotAuthenticationEvidence(input.authorization.evidence).pipe(Effect.mapError(unavailable));
-		const requirement = yield* snapshotEmailRequirement(input.authorization.requirement);
-		const source = input.captured.source === void 0 ? void 0 : yield* snapshotEmailCredential(input.captured.source);
-		return Object.freeze({
-			...input,
-			target: Object.freeze({ ...input.target }),
-			...input.invalidation === void 0 ? {} : { invalidation: Object.freeze({ ...input.invalidation }) },
-			captured: Object.freeze({
-				eligible: input.captured.eligible,
-				revision: snapshotEmailRevision(input.captured.revision),
-				...input.captured.targetIdentifierRevision === void 0 ? {} : { targetIdentifierRevision: input.captured.targetIdentifierRevision },
-				...source === void 0 ? {} : { source }
-			}),
-			authorization: Object.freeze({
-				challenge: Object.freeze({
-					...input.authorization.challenge,
-					target: Object.freeze({ ...input.authorization.challenge.target }),
-					revision: snapshotEmailRevision(input.authorization.challenge.revision)
-				}),
-				evidence,
-				requirement
-			})
-		});
-	});
-	const validateEmailAuthority = Effect.fn("DrizzleEmail.validateAuthority")(function* (mapping, configuration, input, action) {
-		const confirmsExisting = action === "verify-address" && input.captured.targetIdentifierRevision !== void 0;
-		if (!input.captured.eligible || !completionMatches(input, action) || input.authorization.challenge.moduleId !== input.moduleId || input.authorization.challenge.action !== action || input.authorization.challenge.commandId !== input.commandId || !sameIdentifier(input.authorization.challenge.target, input.target) || input.authorization.challenge.sourceCredentialId !== input.captured.source?.credentialId || !sameEmailRevision(input.authorization.challenge.revision, input.captured.revision) || input.authorization.challenge.targetIdentifierRevision !== input.captured.targetIdentifierRevision || input.authorization.evidence.flowId !== input.commandId || input.authorization.evidence.bindingDigest !== input.authorization.challenge.bindingDigest || !sameEmailRevision(input.authorization.evidence.revision, input.captured.revision) || action === "verify-address" && input.captured.source !== void 0 || action === "change-address" && input.captured.source === void 0 || confirmsExisting !== (input.invalidation === void 0) || (input.invalidation?.existingSessions === "immediate" || input.invalidation?.existingSessions === "cache-expiry") && mapping.sessionInvalidation !== "same-authority-immediate") return void 0;
-		const current = yield* currentAddress(mapping, {
-			moduleId: input.moduleId,
-			subjectId: input.captured.revision.subjectId,
-			target: input.target,
-			...input.captured.source === void 0 ? {} : { sourceCredentialId: input.captured.source.credentialId }
-		}, configuration.locking);
-		if (current === void 0 || !current.eligible || !sameEmailRevision(current.revision, input.captured.revision) || current.targetIdentifierRevision !== input.captured.targetIdentifierRevision || input.captured.source !== void 0 && (current.source === void 0 || current.source.snapshot.identifierRevision !== input.captured.source.identifierRevision || current.source.snapshot.credentialRevision !== input.captured.source.credentialRevision || !sameIdentifier(current.source.snapshot.identifier, input.captured.source.identifier))) return void 0;
-		const currentRequirement = yield* mapping.subject.decodeActionRequirement(current.subject, action);
-		const original = yield* assessAuthentication(input.authorization.evidence, input.authorization.requirement).pipe(Effect.mapError(unavailable));
-		const configured = yield* assessAuthentication(input.authorization.evidence, currentRequirement).pipe(Effect.mapError(unavailable));
-		return original.satisfied && configured.satisfied ? current : void 0;
-	});
-	const commandExists = Effect.fn("Drizzle.commandExists")(function* (mapping, moduleId, commandId, locking) {
-		const database = yield* CurrentEmailSql;
-		const c = commandColumns(mapping);
-		return yield* selectRows(database.select().from(mapping.command.table).where(and(eq(c.moduleId, moduleId), eq(c.commandId, commandId))).limit(1), locking);
-	});
-	const applyMutation = Effect.fn("DrizzleEmail.applyMutation")(function* (mapping, input, action, current, allocated, now) {
-		const database = yield* CurrentEmailSql;
-		const i = identifierColumns(mapping);
-		const c = credentialColumns(mapping);
-		const a = authorityColumns(mapping);
-		const s = subjectColumns(mapping);
-		const targetCredentialId = current.targetCredential?.[mapping.credential.credentialId] ?? allocated.targetCredentialId;
-		if (action === "change-address") {
-			const source = current.source;
-			yield* database.update(mapping.identifier.table).set(mapping.identifier.encodeRetirement({
-				source: source.snapshot.identifier,
-				bindingRevision: allocated.sourceIdentifierRevision
-			})).where(and(eq(i.namespace, source.snapshot.identifier.namespace), eq(i.value, source.snapshot.identifier.value), eq(i.subjectId, current.nativeSubjectId), eq(i.bindingRevision, source.snapshot.identifierRevision)));
-			yield* database.update(mapping.credential.table).set(mapping.credential.encodeRetirement({
-				source: source.snapshot.identifier,
-				credentialRevision: allocated.sourceCredentialRevision
-			})).where(and(eq(c.moduleId, input.moduleId), eq(c.credentialId, source.snapshot.credentialId), eq(c.subjectId, current.nativeSubjectId), eq(c.credentialRevision, source.snapshot.credentialRevision)));
-			yield* database.update(mapping.authorityCredential.table).set(mapping.authorityCredential.encodeRetirement(allocated.sourceCredentialRevision)).where(and(eq(a.subjectId, current.nativeSubjectId), eq(a.credentialId, source.snapshot.credentialId), eq(a.revision, source.snapshot.credentialRevision)));
-		}
-		if (current.targetIdentifier === void 0) yield* database.insert(mapping.identifier.table).values(mapping.identifier.encodeVerifiedInsert({
-			identifier: input.target,
-			subjectId: current.nativeSubjectId,
-			verifiedAtMillis: now,
-			bindingRevision: allocated.targetIdentifierRevision
-		}));
-		else yield* database.update(mapping.identifier.table).set(mapping.identifier.encodeVerification({
-			verifiedAtMillis: now,
-			bindingRevision: allocated.targetIdentifierRevision
-		})).where(and(eq(i.namespace, input.target.namespace), eq(i.value, input.target.value), eq(i.subjectId, current.nativeSubjectId), eq(i.bindingRevision, current.targetIdentifier[mapping.identifier.bindingRevision])));
-		if (current.targetCredential === void 0) {
-			yield* database.insert(mapping.credential.table).values(mapping.credential.encodeVerifiedInsert({
-				moduleId: input.moduleId,
-				subjectId: current.nativeSubjectId,
-				credentialId: targetCredentialId,
-				identifier: input.target,
-				credentialRevision: allocated.targetCredentialRevision
-			}));
-			yield* database.insert(mapping.authorityCredential.table).values(mapping.authorityCredential.encodeInsert({
-				subjectId: current.nativeSubjectId,
-				credentialId: targetCredentialId,
-				revision: allocated.targetCredentialRevision
-			}));
-		} else {
-			const oldRevision = current.targetCredential[mapping.credential.credentialRevision];
-			yield* database.update(mapping.credential.table).set(mapping.credential.encodeActivation({
-				identifier: input.target,
-				credentialRevision: allocated.targetCredentialRevision
-			})).where(and(eq(c.moduleId, input.moduleId), eq(c.credentialId, targetCredentialId), eq(c.subjectId, current.nativeSubjectId), eq(c.credentialRevision, oldRevision)));
-			yield* database.update(mapping.authorityCredential.table).set(mapping.authorityCredential.encodeActivation(allocated.targetCredentialRevision)).where(and(eq(a.subjectId, current.nativeSubjectId), eq(a.credentialId, targetCredentialId), eq(a.revision, oldRevision)));
-		}
-		yield* database.update(mapping.subject.table).set(updateValues([[mapping.subject.securityRevision, allocated.nextSecurityRevision]])).where(and(eq(s.id, current.nativeSubjectId), eq(s.securityRevision, input.captured.revision.securityRevision)));
-		yield* database.insert(mapping.command.table).values(mapping.command.encodeInsert({
-			moduleId: input.moduleId,
-			commandId: input.commandId,
-			action,
-			bindingDigest: input.authorization.challenge.bindingDigest,
-			retentionUntilMillis: now + mapping.commandRetentionMillis
-		}));
-		const sourceStillActive = action === "verify-address" ? [] : yield* selectRows(database.select().from(mapping.credential.table).where(and(eq(c.moduleId, input.moduleId), eq(c.credentialId, current.source.snapshot.credentialId), eq(c.subjectId, current.nativeSubjectId))), false);
-		const target = (yield* emailLookupRows(mapping, input.moduleId, input.target))[0];
-		const targetAuthority = yield* selectRows(database.select().from(mapping.authorityCredential.table).where(and(eq(a.subjectId, current.nativeSubjectId), eq(a.credentialId, targetCredentialId))).limit(1), false);
-		const command = yield* selectRows(database.select().from(mapping.command.table).where(and(eq(commandColumns(mapping).moduleId, input.moduleId), eq(commandColumns(mapping).commandId, input.commandId), eq(commandColumns(mapping).action, action), eq(commandColumns(mapping).bindingDigest, input.authorization.challenge.bindingDigest), eq(commandColumns(mapping).retentionUntil, mapping.encodeInstant(now + mapping.commandRetentionMillis)))).limit(1), false);
-		const targetVerifiedAt = target === void 0 ? void 0 : yield* mapping.decodeInstant(target.identifier[mapping.identifier.verifiedAt]);
-		const sourceIdentifier = action === "verify-address" ? [] : yield* identifierRow(mapping, current.source.snapshot.identifier, false);
-		const sourceAuthority = action === "verify-address" ? [] : yield* selectRows(database.select().from(mapping.authorityCredential.table).where(and(eq(a.subjectId, current.nativeSubjectId), eq(a.credentialId, current.source.snapshot.credentialId))).limit(1), false);
-		return target !== void 0 && mapping.subjectId.equals(target.subject[mapping.subject.id], current.nativeSubjectId) && mapping.subject.isActiveStatus(target.subject[mapping.subject.status]) && target.subject[mapping.subject.securityRevision] === allocated.nextSecurityRevision && target.identifier[mapping.identifier.bindingRevision] === allocated.targetIdentifierRevision && targetVerifiedAt === now && target.credential[mapping.credential.credentialRevision] === allocated.targetCredentialRevision && target.credential[mapping.credential.credentialId] === targetCredentialId && mapping.subjectId.equals(target.credential[mapping.credential.subjectId], current.nativeSubjectId) && mapping.identifier.isCurrent(target.identifier) && mapping.credential.isActiveStatus(target.credential[mapping.credential.status]) && targetAuthority.length === 1 && targetAuthority[0][mapping.authorityCredential.revision] === allocated.targetCredentialRevision && mapping.authorityCredential.isActiveStatus(targetAuthority[0][mapping.authorityCredential.status]) && command.length === 1 && (action === "verify-address" || sourceStillActive.length === 1 && sourceStillActive[0][mapping.credential.credentialRevision] === allocated.sourceCredentialRevision && !mapping.credential.isActiveStatus(sourceStillActive[0][mapping.credential.status]) && sourceIdentifier.length === 1 && mapping.subjectId.equals(sourceIdentifier[0][mapping.identifier.subjectId], current.nativeSubjectId) && sourceIdentifier[0][mapping.identifier.bindingRevision] === allocated.sourceIdentifierRevision && !mapping.identifier.isCurrent(sourceIdentifier[0]) && sourceAuthority.length === 1 && sourceAuthority[0][mapping.authorityCredential.revision] === allocated.sourceCredentialRevision && !mapping.authorityCredential.isActiveStatus(sourceAuthority[0][mapping.authorityCredential.status]));
-	});
-	const probeProofCompletion = Effect.fn("Drizzle.probeProofCompletion")(function* (configuration, input) {
-		const database = yield* CurrentEmailSql;
-		if (configuration.proof === void 0) return yield* Effect.fail(unavailable());
-		const validProbe = { _tag: "EmailProofCompletionValid" };
-		const plan = {
-			input,
-			prepare: (decision, journal, project) => journal.prepare(project(decision))
-		};
-		return yield* coordinateCommit(() => database.transaction((transaction) => completeProofPlanIn(configuration.proof.mapping, configuration.proof.configuration, plan, Effect.fail(validProbe), () => false).pipe(Effect.provideService(CurrentProofSql, transaction))), { mode: configuration.mode }).pipe(Effect.as(false), Effect.catchCause((cause) => {
-			const reason = cause.reasons[0];
-			return cause.reasons.length === 1 && reason !== void 0 && Cause.isFailReason(reason) && reason.error === validProbe ? Effect.succeed(true) : Effect.failCause(cause);
-		}));
-	});
-	const prepareRejected = Effect.fn("Drizzle.prepareRejected")(function* (configuration, prepare) {
-		const database = yield* CurrentEmailSql;
-		return yield* owned(database, configuration, Effect.gen(function* () {
-			const journal = yield* CurrentCommitJournal;
-			return yield* Effect.succeed(prepare("rejected", journal));
-		}));
-	});
-	const makeSqlEmailAddressPersistence = Effect.fn("makeSqlEmailAddressPersistence")(function* (mapping, configuration) {
-		const database = yield* CurrentEmailSql;
-		if (!configuration.coordinated) yield* (operations.validateStorage?.({
-			...mapping,
-			proof: configuration.proof?.mapping
-		}) ?? Effect.void).pipe(Effect.mapError(unavailable));
-		const hooks = yield* LifecycleHooks;
-		return EmailAddressPersistence.of({
-			target: (input) => (validAddressConstraints(mapping) ? safeRead(database, configuration, Effect.gen(function* () {
-				const current = yield* currentAddress(mapping, input, configuration.locking);
-				if (current === void 0) return yield* unavailable();
-				return Object.freeze({
-					revision: snapshotEmailRevision(current.revision),
-					eligible: current.eligible,
-					...current.targetIdentifierRevision === void 0 ? {} : { targetIdentifierRevision: current.targetIdentifierRevision },
-					...current.source === void 0 ? {} : { source: yield* snapshotEmailCredential(current.source.snapshot) }
-				});
-			})) : Effect.fail(unavailable())).pipe(Effect.provideService(CurrentEmailSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
-			checkCompletion: (input) => {
-				if (configuration.proof === void 0 || input.binding._tag !== "IdentifierChange") return Effect.succeed(false).pipe(Effect.provideService(CurrentEmailSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure);
-				const binding = input.binding;
-				return safeRead(database, configuration, Effect.gen(function* () {
-					const action = input.moduleId.endsWith("/verify-address") && input.purpose === "email-address-verification" ? "verify-address" : input.moduleId.endsWith("/change-address") && input.purpose === "email-address-change" ? "change-address" : void 0;
-					if (action === void 0) return false;
-					const moduleId = input.moduleId.slice(0, -`/${action}`.length);
-					const current = yield* currentAddress(mapping, {
-						moduleId,
-						subjectId: binding.revision.subjectId,
-						target: binding.identifier
-					}, false);
-					return current !== void 0 && sameEmailRevision(current.revision, binding.revision);
-				})).pipe(Effect.flatMap((current) => current ? probeProofCompletion(configuration, input) : Effect.succeed(false))).pipe(Effect.provideService(CurrentEmailSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure);
-			},
-			verifyWithProof: (uncaptured, prepare) => mutateAddress(mapping, configuration, uncaptured, "verify-address", prepare).pipe(Effect.provideService(CurrentEmailSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
-			changeWithProof: (uncaptured, prepare) => mutateAddress(mapping, configuration, uncaptured, "change-address", prepare).pipe(Effect.provideService(CurrentEmailSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
-			cleanup: (input, prepare) => owned(database, configuration, Effect.gen(function* () {
-				const transaction = yield* CurrentEmailSql;
-				const journal = yield* CurrentCommitJournal;
-				const c = commandColumns(mapping);
-				const now = yield* nowMillis;
-				const rows = yield* selectRows(transaction.select({ commandId: c.commandId }).from(mapping.command.table).where(and(eq(c.moduleId, input.moduleId), lte(c.retentionUntil, mapping.encodeInstant(now)))).limit(input.limit + 1), configuration.locking);
-				const selected = rows.slice(0, input.limit);
-				const receipt = prepare({
-					removed: selected.length,
-					hasMore: rows.length > input.limit
-				}, journal);
-				if (selected.length > 0) yield* transaction.delete(mapping.command.table).where(and(eq(c.moduleId, input.moduleId), inArray(c.commandId, selected.map((row) => row.commandId)), lte(c.retentionUntil, mapping.encodeInstant(now))));
-				return receipt;
-			})).pipe(Effect.provideService(CurrentEmailSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure)
-		});
-	});
-	const mutateAddress = Effect.fn("Drizzle.mutateAddress")(function* (mapping, configuration, uncaptured, action, prepare) {
-		const database = yield* CurrentEmailSql;
-		if (!validAddressConstraints(mapping) || configuration.proof === void 0) return yield* unavailable();
-		const input = yield* snapshotEmailMutation(uncaptured);
-		const targetCredentialId = yield* allocate(configuration.mode, mapping.allocateCredentialId, mapping.allocateCredentialIdSync);
-		const targetIdentifierRevision = yield* allocate(configuration.mode, mapping.allocateRevision, mapping.allocateRevisionSync);
-		const targetCredentialRevision = yield* allocate(configuration.mode, mapping.allocateRevision, mapping.allocateRevisionSync);
-		const sourceIdentifierRevision = yield* allocate(configuration.mode, mapping.allocateRevision, mapping.allocateRevisionSync);
-		const sourceCredentialRevision = yield* allocate(configuration.mode, mapping.allocateRevision, mapping.allocateRevisionSync);
-		const confirmsExisting = action === "verify-address" && input.captured.targetIdentifierRevision !== void 0;
-		const nextRevision = confirmsExisting ? input.captured.revision.securityRevision : yield* nextSecurityRevision(mapping, configuration.mode, input.captured.revision.securityRevision);
-		if (!confirmsExisting && nextRevision === input.captured.revision.securityRevision || [
-			targetIdentifierRevision,
-			targetCredentialRevision,
-			sourceIdentifierRevision,
-			sourceCredentialRevision
-		].some((value) => input.captured.revision.credentials.some((item) => item.revision === value))) return yield* unavailable();
-		return yield* owned(database, configuration, Effect.gen(function* () {
-			const journal = yield* CurrentCommitJournal;
-			const current = yield* validateEmailAuthority(mapping, configuration, input, action);
-			if (current === void 0) return prepare("rejected", journal);
-			if ((yield* commandExists(mapping, input.moduleId, input.commandId, configuration.locking)).length > 0) return prepare("rejected", journal);
-			let receipt;
-			yield* completeProofPlanIn(configuration.proof.mapping, configuration.proof.configuration, input.completion, Effect.gen(function* () {
-				const currentRequirement = yield* mapping.subject.decodeActionRequirement(current.subject, action);
-				const original = yield* assessAuthentication(input.authorization.evidence, input.authorization.requirement).pipe(Effect.mapError(unavailable));
-				const configured = yield* assessAuthentication(input.authorization.evidence, currentRequirement).pipe(Effect.mapError(unavailable));
-				if (!original.satisfied || !configured.satisfied) return false;
-				const now = yield* nowMillis;
-				return yield* applyMutation(mapping, input, action, current, {
-					targetCredentialId,
-					targetIdentifierRevision,
-					targetCredentialRevision,
-					sourceIdentifierRevision,
-					sourceCredentialRevision,
-					nextSecurityRevision: nextRevision
-				}, now);
-			}), (decision) => {
-				receipt = prepare(decision === "completed" ? "changed" : "rejected", journal);
-				return decision;
-			});
-			return receipt ?? prepare("rejected", journal);
-		})).pipe(Effect.catchCause((cause) => cause.reasons.every(Cause.isFailReason) && isMappedConstraintConflict(mapping.isCommandConflict, cause) || cause.reasons.every(Cause.isFailReason) && isMappedConstraintConflict(mapping.isIdentifierConflict, cause) || cause.reasons.every(Cause.isFailReason) && isMappedConstraintConflict(mapping.isCredentialConflict, cause) ? prepareRejected(configuration, prepare) : Effect.failCause(cause)));
-	});
-	return {
-		validEmailSignInConstraints,
-		emailLookupQuery,
-		decodeEmailSnapshot,
-		makeSqlEmailSignInTargets,
-		currentAddress,
-		sameEmailRevision,
-		snapshotEmailMutation,
-		validateEmailAuthority,
-		makeSqlEmailAddressPersistence
-	};
-};
-//#endregion
-export { CurrentEmailSql, makeEmailKernel };
-
-//# sourceMappingURL=email-kernel.mjs.map