@yielded/auth-persistence 0.1.0-beta.7

package/src/internal/email-kernel.ts

@@ -0,0 +1,1532 @@
+import {
+  EmailAddressPersistence,
+  type EmailAddressMutation,
+  type EmailAction,
+  type EmailCredentialSnapshot,
+  EmailSignInTargets,
+  EmailUnavailable,
+  snapshotEmailCredential,
+  snapshotEmailRequirement,
+  snapshotEmailRevision,
+} from "@yielded/auth/Email";
+import {
+  coordinateCommit,
+  CurrentCommitJournal,
+  hasCommitScope,
+  type CommitJournal,
+  type PreparedCommit,
+  LifecycleHooks,
+  HookConfigurationError,
+} from "@yielded/auth/Hooks";
+import type { LoginIdentifier } from "@yielded/auth/Identity";
+import { reportPersistenceFailure } from "@yielded/auth/Persistence";
+import {
+  ProofUnavailable,
+  type ProofCompletionDecision,
+  type ProofCompletionInput,
+} from "@yielded/auth/Proofs";
+import {
+  assessAuthentication,
+  snapshotAuthenticationEvidence,
+  type AuthenticationRevision,
+  type SecurityRevision,
+} from "@yielded/auth/Sessions";
+/* oxlint-disable no-explicit-any -- the shared dialect kernel erases consumer Drizzle table types internally. */
+import type { sql } from "drizzle-orm";
+import type { EffectDrizzleQueryError } from "drizzle-orm/effect-core";
+import { Cause, Context, DateTime, Effect, Option, Schema } from "effect";
+import type * as SqlError from "effect/unstable/sql/SqlError";
+
+import {
+  type AnyEmailAddressMapping,
+  type AnyEmailSignInMapping,
+  requiredEmailAddressConstraints,
+  requiredEmailSignInConstraints,
+} from "../drizzle/email-model";
+import { isMappedConstraintConflict, PersistenceMappingError } from "./mapping-error";
+import {
+  CurrentProofSql,
+  type makeProofKernel,
+  type ProofSqlConfiguration,
+  type ProofSqlDatabase,
+} from "./proof-kernel";
+import type { QueryOperations } from "./query-operations";
+
+type AdapterFailure = EffectDrizzleQueryError | PersistenceMappingError | SqlError.SqlError;
+type SignInMapping = AnyEmailSignInMapping;
+type AddressMapping = AnyEmailAddressMapping;
+
+export interface EmailSqlQuery<A = ReadonlyArray<any>> extends Effect.Effect<A, AdapterFailure> {
+  readonly getSQL: () => ReturnType<typeof sql>;
+  readonly from: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;
+  readonly where: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;
+  readonly limit: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;
+  readonly orderBy: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;
+  readonly for: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;
+  readonly set: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;
+  readonly values: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;
+  readonly returning: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;
+  readonly innerJoin: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;
+  readonly onConflictDoNothing: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;
+  readonly onDuplicateKeyUpdate: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;
+  readonly $returningId: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;
+}
+
+export interface EmailSqlDatabase {
+  readonly select: (...args: ReadonlyArray<any>) => EmailSqlQuery;
+  readonly insert: (...args: ReadonlyArray<any>) => EmailSqlQuery;
+  readonly update: (...args: ReadonlyArray<any>) => EmailSqlQuery;
+  readonly delete: (...args: ReadonlyArray<any>) => EmailSqlQuery;
+  readonly transaction: <A, E, R>(
+    body: (transaction: EmailSqlDatabase) => Effect.Effect<A, E, R>,
+  ) => Effect.Effect<A, E | SqlError.SqlError, R>;
+}
+
+export class CurrentEmailSql extends Context.Service<CurrentEmailSql, EmailSqlDatabase>()(
+  "effect-auth/CurrentEmailSql",
+) {}
+
+export interface EmailSqlConfiguration {
+  readonly mode: "interactive" | "synchronous";
+  readonly locking: boolean;
+  readonly standaloneGuard: Effect.Effect<void, EmailUnavailable>;
+  readonly coordinated?: boolean;
+  readonly proof?: {
+    readonly mapping: any;
+    readonly configuration: ProofSqlConfiguration;
+  };
+}
+
+export interface CurrentAddress {
+  readonly nativeSubjectId: unknown;
+  readonly subject: any;
+  readonly revision: AuthenticationRevision;
+  readonly source?: {
+    readonly credential: any;
+    readonly identifier: any;
+    readonly snapshot: EmailCredentialSnapshot;
+  };
+  readonly targetIdentifier?: any;
+  readonly targetCredential?: any;
+  readonly targetIdentifierRevision?: SecurityRevision;
+  readonly eligible: boolean;
+}
+
+export const makeEmailKernel = (
+  operations: QueryOperations,
+  proofs: Pick<ReturnType<typeof makeProofKernel>, "completeProofPlanIn">,
+) => {
+  const { and, eq, inArray, lte, column, updateValues } = operations;
+  const { completeProofPlanIn } = proofs;
+  const unavailable = () => EmailUnavailable.make({});
+
+  const translateFailure = <A, E, R>(
+    effect: Effect.Effect<A, E, R>,
+  ): Effect.Effect<A, EmailUnavailable, R> =>
+    reportPersistenceFailure(
+      effect,
+      (error) =>
+        Schema.is(EmailUnavailable)(error) ||
+        Schema.is(ProofUnavailable)(error) ||
+        Schema.is(HookConfigurationError)(error),
+    ).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));
+
+  const nowMillis = Effect.map(DateTime.now, DateTime.toEpochMillis);
+
+  const selectRows = (query: EmailSqlQuery, locking: boolean) =>
+    locking && typeof query.for === "function" ? query.for("update") : query;
+
+  const sameIdentifier = (left: LoginIdentifier, right: LoginIdentifier) =>
+    left.namespace === right.namespace && left.value === right.value;
+
+  const validEmailSignInConstraints = (mapping: SignInMapping) =>
+    Object.entries(requiredEmailSignInConstraints).every(
+      ([key, value]) =>
+        mapping.constraints[key as keyof typeof requiredEmailSignInConstraints] === value,
+    );
+
+  const validAddressConstraints = (mapping: AddressMapping) =>
+    Object.entries(requiredEmailAddressConstraints).every(
+      ([key, value]) =>
+        mapping.constraints[key as keyof typeof requiredEmailAddressConstraints] === value,
+    );
+
+  const subjectColumns = (mapping: SignInMapping) => ({
+    id: column(mapping.subject.table, mapping.subject.id),
+    status: column(mapping.subject.table, mapping.subject.status),
+    securityRevision: column(mapping.subject.table, mapping.subject.securityRevision),
+  });
+
+  const identifierColumns = (mapping: SignInMapping) => ({
+    namespace: column(mapping.identifier.table, mapping.identifier.namespace),
+    value: column(mapping.identifier.table, mapping.identifier.value),
+    subjectId: column(mapping.identifier.table, mapping.identifier.subjectId),
+    verifiedAt: column(mapping.identifier.table, mapping.identifier.verifiedAt),
+    bindingRevision: column(mapping.identifier.table, mapping.identifier.bindingRevision),
+  });
+
+  const credentialColumns = (mapping: SignInMapping) => ({
+    moduleId: column(mapping.credential.table, mapping.credential.moduleId),
+    subjectId: column(mapping.credential.table, mapping.credential.subjectId),
+    credentialId: column(mapping.credential.table, mapping.credential.credentialId),
+    identifierNamespace: column(mapping.credential.table, mapping.credential.identifierNamespace),
+    identifierValue: column(mapping.credential.table, mapping.credential.identifierValue),
+    credentialRevision: column(mapping.credential.table, mapping.credential.credentialRevision),
+    status: column(mapping.credential.table, mapping.credential.status),
+  });
+
+  const authorityColumns = (mapping: AddressMapping) => ({
+    subjectId: column(mapping.authorityCredential.table, mapping.authorityCredential.subjectId),
+    credentialId: column(
+      mapping.authorityCredential.table,
+      mapping.authorityCredential.credentialId,
+    ),
+    revision: column(mapping.authorityCredential.table, mapping.authorityCredential.revision),
+    status: column(mapping.authorityCredential.table, mapping.authorityCredential.status),
+  });
+
+  const commandColumns = (mapping: AddressMapping) => ({
+    moduleId: column(mapping.command.table, mapping.command.moduleId),
+    commandId: column(mapping.command.table, mapping.command.commandId),
+    action: column(mapping.command.table, mapping.command.action),
+    bindingDigest: column(mapping.command.table, mapping.command.bindingDigest),
+    retentionUntil: column(mapping.command.table, mapping.command.retentionUntil),
+  });
+
+  const allocate = <A>(
+    mode: EmailSqlConfiguration["mode"],
+    asynchronous: Effect.Effect<A, PersistenceMappingError> | undefined,
+    synchronous: (() => A) | undefined,
+  ) => {
+    if (mode === "synchronous")
+      return synchronous === undefined
+        ? Effect.fail(unavailable())
+        : Effect.try({
+            try: synchronous,
+            catch: (cause) => new PersistenceMappingError({ operation: "mapping", cause }),
+          });
+    if (asynchronous !== undefined) return asynchronous;
+
+    return synchronous === undefined
+      ? Effect.fail(unavailable())
+      : Effect.try({
+          try: synchronous,
+          catch: (cause) => new PersistenceMappingError({ operation: "mapping", cause }),
+        });
+  };
+
+  const nextSecurityRevision = (
+    mapping: AddressMapping,
+    mode: EmailSqlConfiguration["mode"],
+    current: SecurityRevision,
+  ) => {
+    if (mode === "synchronous")
+      return mapping.subject.nextSecurityRevisionSync === undefined
+        ? Effect.fail(unavailable())
+        : Effect.try({
+            try: () => mapping.subject.nextSecurityRevisionSync!(current),
+            catch: (cause) => new PersistenceMappingError({ operation: "mapping", cause }),
+          });
+    if (mapping.subject.nextSecurityRevision !== undefined)
+      return mapping.subject.nextSecurityRevision(current);
+    if (mapping.subject.nextSecurityRevisionSync !== undefined)
+      return Effect.try({
+        try: () => mapping.subject.nextSecurityRevisionSync!(current),
+        catch: (cause) => new PersistenceMappingError({ operation: "mapping", cause }),
+      });
+
+    return Effect.fail(unavailable());
+  };
+
+  const safeRead = <A, E, R>(
+    database: EmailSqlDatabase,
+    configuration: EmailSqlConfiguration,
+    body: Effect.Effect<A, E, R>,
+  ) =>
+    Effect.gen(function* () {
+      if (configuration.coordinated !== true) {
+        if (yield* hasCommitScope) return yield* unavailable();
+        yield* configuration.standaloneGuard;
+      }
+
+      return yield* database.transaction((transaction) =>
+        body.pipe(
+          Effect.provideService(CurrentEmailSql, transaction),
+          Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),
+        ),
+      );
+    });
+
+  const owned = <A, E, R>(
+    database: EmailSqlDatabase,
+    configuration: EmailSqlConfiguration,
+    body: Effect.Effect<A, E, R>,
+  ) => {
+    const run = coordinateCommit(
+      () =>
+        database.transaction((transaction) =>
+          body.pipe(
+            Effect.provideService(CurrentEmailSql, transaction),
+            Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),
+          ),
+        ),
+      { mode: configuration.mode },
+    ).pipe(Effect.map((result) => result.value));
+
+    return configuration.coordinated !== true
+      ? Effect.gen(function* () {
+          if (yield* hasCommitScope) return yield* unavailable();
+          yield* configuration.standaloneGuard;
+
+          return yield* run;
+        })
+      : run;
+  };
+
+  const emailLookupQuery = (
+    mapping: SignInMapping,
+    moduleId: string,
+    identifier: LoginIdentifier,
+  ) => {
+    const subject = subjectColumns(mapping),
+      binding = identifierColumns(mapping),
+      credential = credentialColumns(mapping);
+
+    return {
+      fields: {
+        subject: mapping.subject.table,
+        identifier: mapping.identifier.table,
+        credential: mapping.credential.table,
+      },
+      from: mapping.identifier.table,
+      subjectTable: mapping.subject.table,
+      subjectJoin: eq(subject.id, binding.subjectId),
+      credentialTable: mapping.credential.table,
+      credentialJoin: and(
+        eq(credential.moduleId, moduleId),
+        eq(credential.subjectId, binding.subjectId),
+        eq(credential.identifierNamespace, binding.namespace),
+        eq(credential.identifierValue, binding.value),
+      ),
+      predicate: and(
+        eq(binding.namespace, identifier.namespace),
+        eq(binding.value, identifier.value),
+      ),
+      limit: 1,
+    };
+  };
+
+  const emailLookupRows = Effect.fn("Drizzle.emailLookupRows")(function* (
+    mapping: SignInMapping,
+    moduleId: string,
+    identifier: LoginIdentifier,
+  ) {
+    const database = yield* CurrentEmailSql;
+    const query = emailLookupQuery(mapping, moduleId, identifier);
+
+    return yield* database
+      .select(query.fields)
+      .from(query.from)
+      .innerJoin(query.subjectTable, query.subjectJoin)
+      .innerJoin(query.credentialTable, query.credentialJoin)
+      .where(query.predicate)
+      .limit(query.limit);
+  });
+
+  const decodeEmailSnapshot = Effect.fn("DrizzleEmail.decodeSnapshot")(function* (
+    mapping: SignInMapping,
+    moduleId: string,
+    requested: LoginIdentifier,
+    row: any,
+  ) {
+    if (
+      !mapping.subject.isActiveStatus(row.subject[mapping.subject.status]) ||
+      !mapping.identifier.isCurrent(row.identifier) ||
+      !mapping.credential.isActiveStatus(row.credential[mapping.credential.status])
+    )
+      return undefined;
+
+    const snapshot = yield* mapping.credential
+      .decode({
+        moduleId,
+        subject: row.subject,
+        identifier: row.identifier,
+        credential: row.credential,
+      })
+      .pipe(Effect.flatMap(snapshotEmailCredential));
+
+    const subjectId = yield* mapping.subjectId.toSubject(row.subject[mapping.subject.id]);
+
+    const verifiedAtMillis = yield* mapping.decodeInstant(
+      row.identifier[mapping.identifier.verifiedAt],
+    );
+
+    if (
+      snapshot.moduleId !== moduleId ||
+      !sameIdentifier(snapshot.identifier, requested) ||
+      snapshot.revision.subjectId !== subjectId ||
+      snapshot.revision.securityRevision !== row.subject[mapping.subject.securityRevision] ||
+      snapshot.identifierRevision !== row.identifier[mapping.identifier.bindingRevision] ||
+      snapshot.verifiedAtMillis !== verifiedAtMillis ||
+      snapshot.credentialId !== row.credential[mapping.credential.credentialId] ||
+      snapshot.credentialRevision !== row.credential[mapping.credential.credentialRevision]
+    )
+      return undefined;
+
+    return snapshot;
+  });
+
+  const makeSqlEmailSignInTargets = Effect.fn("makeSqlEmailSignInTargets")(function (
+    database: EmailSqlDatabase,
+    mapping: SignInMapping,
+    configuration: EmailSqlConfiguration,
+  ): Effect.Effect<EmailSignInTargets["Service"]> {
+    return Effect.succeed(
+      EmailSignInTargets.of({
+        lookup: (input) =>
+          (validEmailSignInConstraints(mapping)
+            ? safeRead(
+                database,
+                configuration,
+                Effect.gen(function* () {
+                  const row = (yield* emailLookupRows(
+                    mapping,
+                    input.moduleId,
+                    input.identifier,
+                  ))[0];
+
+                  if (row === undefined) return Option.none();
+
+                  const snapshot = yield* decodeEmailSnapshot(
+                    mapping,
+                    input.moduleId,
+                    input.identifier,
+                    row,
+                  );
+
+                  return snapshot === undefined ? Option.none() : Option.some(snapshot);
+                }),
+              )
+            : Effect.fail(unavailable())
+          ).pipe(Effect.provideService(CurrentEmailSql, database), translateFailure),
+      }),
+    );
+  });
+
+  const readSubject = Effect.fn("DrizzleEmail.readSubject")(function* (
+    mapping: AddressMapping,
+    subjectId: string,
+    locking: boolean,
+  ) {
+    const database = yield* CurrentEmailSql;
+
+    const nativeSubjectId = yield* mapping.subjectId.toNative(subjectId as any);
+    const s = subjectColumns(mapping);
+
+    const subject = (yield* selectRows(
+      database.select().from(mapping.subject.table).where(eq(s.id, nativeSubjectId)).limit(1),
+      locking,
+    ))[0];
+
+    return { nativeSubjectId, subject };
+  });
+
+  const identifierRow = Effect.fn("Drizzle.identifierRow")(function* (
+    mapping: SignInMapping,
+    identifier: LoginIdentifier,
+    locking: boolean,
+  ) {
+    const database = yield* CurrentEmailSql;
+
+    const i = identifierColumns(mapping);
+
+    return yield* selectRows(
+      database
+        .select()
+        .from(mapping.identifier.table)
+        .where(and(eq(i.namespace, identifier.namespace), eq(i.value, identifier.value)))
+        .limit(1),
+      locking,
+    );
+  });
+
+  const credentialById = Effect.fn("Drizzle.credentialById")(function* (
+    mapping: SignInMapping,
+    moduleId: string,
+    credentialId: string,
+    locking: boolean,
+  ) {
+    const database = yield* CurrentEmailSql;
+
+    const c = credentialColumns(mapping);
+
+    return yield* selectRows(
+      database
+        .select()
+        .from(mapping.credential.table)
+        .where(and(eq(c.moduleId, moduleId), eq(c.credentialId, credentialId)))
+        .limit(1),
+      locking,
+    );
+  });
+
+  const credentialByIdentifier = Effect.fn("Drizzle.credentialByIdentifier")(function* (
+    mapping: SignInMapping,
+    moduleId: string,
+    identifier: LoginIdentifier,
+    locking: boolean,
+  ) {
+    const database = yield* CurrentEmailSql;
+
+    const c = credentialColumns(mapping);
+
+    return yield* selectRows(
+      database
+        .select()
+        .from(mapping.credential.table)
+        .where(
+          and(
+            eq(c.moduleId, moduleId),
+            eq(c.identifierNamespace, identifier.namespace),
+            eq(c.identifierValue, identifier.value),
+          ),
+        )
+        .limit(1),
+      locking,
+    );
+  });
+
+  const currentAddress = Effect.fn("DrizzleEmail.currentAddress")(function* (
+    mapping: AddressMapping,
+    input: {
+      readonly moduleId: string;
+      readonly subjectId: string;
+      readonly target: LoginIdentifier;
+      readonly sourceCredentialId?: string;
+    },
+    locking: boolean,
+  ) {
+    const database = yield* CurrentEmailSql;
+
+    const locked = yield* readSubject(mapping, input.subjectId, locking);
+
+    if (
+      locked.subject === undefined ||
+      !mapping.subject.isActiveStatus(locked.subject[mapping.subject.status])
+    )
+      return undefined;
+
+    const discoveredSource =
+      input.sourceCredentialId === undefined
+        ? undefined
+        : (yield* credentialById(mapping, input.moduleId, input.sourceCredentialId, false))[0];
+
+    const sourceIdentifier: LoginIdentifier | undefined =
+      discoveredSource === undefined
+        ? undefined
+        : {
+            namespace: discoveredSource[mapping.credential.identifierNamespace],
+            value: discoveredSource[mapping.credential.identifierValue],
+          };
+
+    const identifiers = [
+      input.target,
+      ...(sourceIdentifier === undefined ? [] : [sourceIdentifier]),
+    ]
+      .filter(
+        (value, index, values) =>
+          values.findIndex((candidate) => sameIdentifier(candidate, value)) === index,
+      )
+      .sort((left, right) =>
+        `${left.namespace}\u0000${left.value}`.localeCompare(
+          `${right.namespace}\u0000${right.value}`,
+        ),
+      );
+
+    const lockedIdentifiers = new Map<string, any>();
+
+    for (const identifier of identifiers) {
+      const row = (yield* identifierRow(mapping, identifier, locking))[0];
+
+      if (row !== undefined)
+        lockedIdentifiers.set(`${identifier.namespace}\u0000${identifier.value}`, row);
+    }
+
+    const sourceCredential =
+      input.sourceCredentialId === undefined
+        ? undefined
+        : (yield* credentialById(mapping, input.moduleId, input.sourceCredentialId, locking))[0];
+
+    const targetCredential = (yield* credentialByIdentifier(
+      mapping,
+      input.moduleId,
+      input.target,
+      locking,
+    ))[0];
+
+    const a = authorityColumns(mapping);
+
+    const authority = yield* selectRows(
+      database
+        .select()
+        .from(mapping.authorityCredential.table)
+        .where(eq(a.subjectId, locked.nativeSubjectId))
+        .orderBy(a.credentialId),
+      locking,
+    );
+
+    const activeAuthority = authority.filter((row: any) =>
+      mapping.authorityCredential.isActiveStatus(row[mapping.authorityCredential.status]),
+    );
+
+    const subjectId = yield* mapping.subjectId.toSubject(locked.nativeSubjectId);
+
+    const revision: AuthenticationRevision = Object.freeze({
+      subjectId,
+      securityRevision: locked.subject[mapping.subject.securityRevision],
+      credentials: Object.freeze(
+        activeAuthority.map((row: any) =>
+          Object.freeze({
+            credentialId: row[mapping.authorityCredential.credentialId],
+            revision: row[mapping.authorityCredential.revision],
+          }),
+        ),
+      ),
+    });
+
+    const targetIdentifier = lockedIdentifiers.get(
+      `${input.target.namespace}\u0000${input.target.value}`,
+    );
+
+    const targetOwned =
+      targetIdentifier !== undefined &&
+      mapping.subjectId.equals(
+        targetIdentifier[mapping.identifier.subjectId],
+        locked.nativeSubjectId,
+      );
+
+    const targetMutable =
+      targetOwned &&
+      mapping.identifier.isMutableTarget(targetIdentifier) &&
+      (targetCredential === undefined ||
+        (!mapping.credential.isActiveStatus(targetCredential[mapping.credential.status]) &&
+          mapping.subjectId.equals(
+            targetCredential[mapping.credential.subjectId],
+            locked.nativeSubjectId,
+          )));
+
+    let source: CurrentAddress["source"];
+
+    if (input.sourceCredentialId !== undefined) {
+      if (
+        sourceCredential === undefined ||
+        sourceIdentifier === undefined ||
+        !mapping.subjectId.equals(
+          sourceCredential[mapping.credential.subjectId],
+          locked.nativeSubjectId,
+        ) ||
+        !mapping.credential.isActiveStatus(sourceCredential[mapping.credential.status])
+      )
+        return undefined;
+
+      const sourceIdentifierRow = lockedIdentifiers.get(
+        `${sourceIdentifier.namespace}\u0000${sourceIdentifier.value}`,
+      );
+
+      if (
+        sourceIdentifierRow === undefined ||
+        !mapping.identifier.isCurrent(sourceIdentifierRow) ||
+        !mapping.subjectId.equals(
+          sourceIdentifierRow[mapping.identifier.subjectId],
+          locked.nativeSubjectId,
+        )
+      )
+        return undefined;
+
+      const snapshot = yield* mapping.credential
+        .decode({
+          moduleId: input.moduleId,
+          subject: locked.subject,
+          identifier: sourceIdentifierRow,
+          credential: sourceCredential,
+        })
+        .pipe(Effect.flatMap(snapshotEmailCredential));
+
+      source = { credential: sourceCredential, identifier: sourceIdentifierRow, snapshot };
+    }
+    let eligible = targetIdentifier === undefined ? targetCredential === undefined : targetMutable;
+
+    if (input.sourceCredentialId !== undefined && source === undefined) eligible = false;
+    if (source !== undefined && sameIdentifier(source.snapshot.identifier, input.target))
+      eligible = false;
+    if (mapping.addressCardinality === "single" && input.sourceCredentialId === undefined) {
+      const c = credentialColumns(mapping);
+
+      const rows = yield* selectRows(
+        database
+          .select()
+          .from(mapping.credential.table)
+          .where(and(eq(c.moduleId, input.moduleId), eq(c.subjectId, locked.nativeSubjectId))),
+        locking,
+      );
+
+      if (
+        rows.some((row: any) => mapping.credential.isActiveStatus(row[mapping.credential.status]))
+      )
+        eligible = false;
+    }
+
+    return {
+      nativeSubjectId: locked.nativeSubjectId,
+      subject: locked.subject,
+      revision,
+      ...(source === undefined ? {} : { source }),
+      ...(targetIdentifier === undefined ? {} : { targetIdentifier }),
+      ...(targetCredential === undefined ? {} : { targetCredential }),
+      ...(targetMutable
+        ? { targetIdentifierRevision: targetIdentifier[mapping.identifier.bindingRevision] }
+        : {}),
+      eligible,
+    };
+  });
+
+  const sameEmailRevision = (left: AuthenticationRevision, right: AuthenticationRevision) => {
+    if (
+      left.subjectId !== right.subjectId ||
+      left.securityRevision !== right.securityRevision ||
+      left.credentials.length !== right.credentials.length
+    )
+      return false;
+
+    const expected = [...left.credentials].sort((a, b) =>
+      a.credentialId.localeCompare(b.credentialId),
+    );
+
+    const actual = [...right.credentials].sort((a, b) =>
+      a.credentialId.localeCompare(b.credentialId),
+    );
+
+    return expected.every(
+      (item, index) =>
+        item.credentialId === actual[index]!.credentialId &&
+        item.revision === actual[index]!.revision,
+    );
+  };
+
+  const actionModule = (moduleId: string, action: EmailAction) =>
+    `${moduleId}/${action === "verify-address" ? "verify-address" : "change-address"}`;
+
+  const actionPurpose = (action: EmailAction) =>
+    action === "verify-address" ? "email-address-verification" : "email-address-change";
+
+  const completionMatches = (input: EmailAddressMutation, action: EmailAction) => {
+    const completion = input.completion.input;
+    const binding = completion.binding;
+
+    return (
+      completion.moduleId === actionModule(input.moduleId, action) &&
+      completion.purpose === actionPurpose(action) &&
+      binding._tag === "IdentifierChange" &&
+      sameIdentifier(binding.identifier, input.target) &&
+      sameEmailRevision(binding.revision, input.captured.revision)
+    );
+  };
+
+  const snapshotEmailMutation = Effect.fn("DrizzleEmail.snapshotMutation")(function* (
+    input: EmailAddressMutation,
+  ) {
+    const evidence = yield* snapshotAuthenticationEvidence(input.authorization.evidence).pipe(
+      Effect.mapError(unavailable),
+    );
+
+    const requirement = yield* snapshotEmailRequirement(input.authorization.requirement);
+
+    const source =
+      input.captured.source === undefined
+        ? undefined
+        : yield* snapshotEmailCredential(input.captured.source);
+
+    return Object.freeze({
+      ...input,
+      target: Object.freeze({ ...input.target }),
+      ...(input.invalidation === undefined
+        ? {}
+        : { invalidation: Object.freeze({ ...input.invalidation }) }),
+      captured: Object.freeze({
+        eligible: input.captured.eligible,
+        revision: snapshotEmailRevision(input.captured.revision),
+        ...(input.captured.targetIdentifierRevision === undefined
+          ? {}
+          : { targetIdentifierRevision: input.captured.targetIdentifierRevision }),
+        ...(source === undefined ? {} : { source }),
+      }),
+      authorization: Object.freeze({
+        challenge: Object.freeze({
+          ...input.authorization.challenge,
+          target: Object.freeze({ ...input.authorization.challenge.target }),
+          revision: snapshotEmailRevision(input.authorization.challenge.revision),
+        }),
+        evidence,
+        requirement,
+      }),
+    });
+  });
+
+  const validateEmailAuthority = Effect.fn("DrizzleEmail.validateAuthority")(function* (
+    mapping: AddressMapping,
+    configuration: EmailSqlConfiguration,
+    input: EmailAddressMutation,
+    action: EmailAction,
+  ) {
+    const confirmsExisting =
+      action === "verify-address" && input.captured.targetIdentifierRevision !== undefined;
+
+    if (
+      !input.captured.eligible ||
+      !completionMatches(input, action) ||
+      input.authorization.challenge.moduleId !== input.moduleId ||
+      input.authorization.challenge.action !== action ||
+      input.authorization.challenge.commandId !== input.commandId ||
+      !sameIdentifier(input.authorization.challenge.target, input.target) ||
+      input.authorization.challenge.sourceCredentialId !== input.captured.source?.credentialId ||
+      !sameEmailRevision(input.authorization.challenge.revision, input.captured.revision) ||
+      input.authorization.challenge.targetIdentifierRevision !==
+        input.captured.targetIdentifierRevision ||
+      (input.authorization.evidence.flowId as string) !== (input.commandId as string) ||
+      input.authorization.evidence.bindingDigest !== input.authorization.challenge.bindingDigest ||
+      !sameEmailRevision(input.authorization.evidence.revision, input.captured.revision) ||
+      (action === "verify-address" && input.captured.source !== undefined) ||
+      (action === "change-address" && input.captured.source === undefined) ||
+      confirmsExisting !== (input.invalidation === undefined) ||
+      (input.invalidation?.existingSessions === "immediate" &&
+        mapping.sessionInvalidation !== "same-authority-immediate")
+    )
+      return undefined;
+
+    const current = yield* currentAddress(
+      mapping,
+      {
+        moduleId: input.moduleId,
+        subjectId: input.captured.revision.subjectId,
+        target: input.target,
+        ...(input.captured.source === undefined
+          ? {}
+          : { sourceCredentialId: input.captured.source.credentialId }),
+      },
+      configuration.locking,
+    );
+
+    if (
+      current === undefined ||
+      !current.eligible ||
+      !sameEmailRevision(current.revision, input.captured.revision) ||
+      current.targetIdentifierRevision !== input.captured.targetIdentifierRevision ||
+      (input.captured.source !== undefined &&
+        (current.source === undefined ||
+          current.source.snapshot.identifierRevision !== input.captured.source.identifierRevision ||
+          current.source.snapshot.credentialRevision !== input.captured.source.credentialRevision ||
+          !sameIdentifier(current.source.snapshot.identifier, input.captured.source.identifier)))
+    )
+      return undefined;
+
+    const currentRequirement = yield* mapping.subject.decodeActionRequirement(
+      current.subject,
+      action,
+    );
+
+    const original = yield* assessAuthentication(
+      input.authorization.evidence,
+      input.authorization.requirement,
+    ).pipe(Effect.mapError(unavailable));
+
+    const configured = yield* assessAuthentication(
+      input.authorization.evidence,
+      currentRequirement,
+    ).pipe(Effect.mapError(unavailable));
+
+    return original.satisfied && configured.satisfied ? current : undefined;
+  });
+
+  const commandExists = Effect.fn("Drizzle.commandExists")(function* (
+    mapping: AddressMapping,
+    moduleId: string,
+    commandId: string,
+    locking: boolean,
+  ) {
+    const database = yield* CurrentEmailSql;
+
+    const c = commandColumns(mapping);
+
+    return yield* selectRows(
+      database
+        .select()
+        .from(mapping.command.table)
+        .where(and(eq(c.moduleId, moduleId), eq(c.commandId, commandId)))
+        .limit(1),
+      locking,
+    );
+  });
+
+  const applyMutation = Effect.fn("DrizzleEmail.applyMutation")(function* (
+    mapping: AddressMapping,
+    input: EmailAddressMutation,
+    action: EmailAction,
+    current: CurrentAddress,
+    allocated: {
+      readonly targetCredentialId: string;
+      readonly targetIdentifierRevision: SecurityRevision;
+      readonly targetCredentialRevision: SecurityRevision;
+      readonly sourceIdentifierRevision: SecurityRevision;
+      readonly sourceCredentialRevision: SecurityRevision;
+      readonly nextSecurityRevision: SecurityRevision;
+    },
+    now: number,
+  ) {
+    const database = yield* CurrentEmailSql;
+
+    const i = identifierColumns(mapping);
+    const c = credentialColumns(mapping);
+    const a = authorityColumns(mapping);
+    const s = subjectColumns(mapping);
+
+    const targetCredentialId =
+      current.targetCredential?.[mapping.credential.credentialId] ?? allocated.targetCredentialId;
+
+    if (action === "change-address") {
+      const source = current.source!;
+
+      yield* database
+        .update(mapping.identifier.table)
+        .set(
+          mapping.identifier.encodeRetirement({
+            source: source.snapshot.identifier,
+            bindingRevision: allocated.sourceIdentifierRevision,
+          }),
+        )
+        .where(
+          and(
+            eq(i.namespace, source.snapshot.identifier.namespace),
+            eq(i.value, source.snapshot.identifier.value),
+            eq(i.subjectId, current.nativeSubjectId),
+            eq(i.bindingRevision, source.snapshot.identifierRevision),
+          ),
+        );
+      yield* database
+        .update(mapping.credential.table)
+        .set(
+          mapping.credential.encodeRetirement({
+            source: source.snapshot.identifier,
+            credentialRevision: allocated.sourceCredentialRevision,
+          }),
+        )
+        .where(
+          and(
+            eq(c.moduleId, input.moduleId),
+            eq(c.credentialId, source.snapshot.credentialId),
+            eq(c.subjectId, current.nativeSubjectId),
+            eq(c.credentialRevision, source.snapshot.credentialRevision),
+          ),
+        );
+      yield* database
+        .update(mapping.authorityCredential.table)
+        .set(mapping.authorityCredential.encodeRetirement(allocated.sourceCredentialRevision))
+        .where(
+          and(
+            eq(a.subjectId, current.nativeSubjectId),
+            eq(a.credentialId, source.snapshot.credentialId),
+            eq(a.revision, source.snapshot.credentialRevision),
+          ),
+        );
+    }
+    if (current.targetIdentifier === undefined) {
+      yield* database.insert(mapping.identifier.table).values(
+        mapping.identifier.encodeVerifiedInsert({
+          identifier: input.target,
+          subjectId: current.nativeSubjectId,
+          verifiedAtMillis: now,
+          bindingRevision: allocated.targetIdentifierRevision,
+        }),
+      );
+    } else {
+      yield* database
+        .update(mapping.identifier.table)
+        .set(
+          mapping.identifier.encodeVerification({
+            verifiedAtMillis: now,
+            bindingRevision: allocated.targetIdentifierRevision,
+          }),
+        )
+        .where(
+          and(
+            eq(i.namespace, input.target.namespace),
+            eq(i.value, input.target.value),
+            eq(i.subjectId, current.nativeSubjectId),
+            eq(i.bindingRevision, current.targetIdentifier![mapping.identifier.bindingRevision]),
+          ),
+        );
+    }
+    if (current.targetCredential === undefined) {
+      yield* database.insert(mapping.credential.table).values(
+        mapping.credential.encodeVerifiedInsert({
+          moduleId: input.moduleId,
+          subjectId: current.nativeSubjectId,
+          credentialId: targetCredentialId,
+          identifier: input.target,
+          credentialRevision: allocated.targetCredentialRevision,
+        }),
+      );
+      yield* database.insert(mapping.authorityCredential.table).values(
+        mapping.authorityCredential.encodeInsert({
+          subjectId: current.nativeSubjectId,
+          credentialId: targetCredentialId,
+          revision: allocated.targetCredentialRevision,
+        }),
+      );
+    } else {
+      const oldRevision = current.targetCredential[mapping.credential.credentialRevision];
+
+      yield* database
+        .update(mapping.credential.table)
+        .set(
+          mapping.credential.encodeActivation({
+            identifier: input.target,
+            credentialRevision: allocated.targetCredentialRevision,
+          }),
+        )
+        .where(
+          and(
+            eq(c.moduleId, input.moduleId),
+            eq(c.credentialId, targetCredentialId),
+            eq(c.subjectId, current.nativeSubjectId),
+            eq(c.credentialRevision, oldRevision),
+          ),
+        );
+      yield* database
+        .update(mapping.authorityCredential.table)
+        .set(mapping.authorityCredential.encodeActivation(allocated.targetCredentialRevision))
+        .where(
+          and(
+            eq(a.subjectId, current.nativeSubjectId),
+            eq(a.credentialId, targetCredentialId),
+            eq(a.revision, oldRevision),
+          ),
+        );
+    }
+    yield* database
+      .update(mapping.subject.table)
+      .set(updateValues<any>([[mapping.subject.securityRevision, allocated.nextSecurityRevision]]))
+      .where(
+        and(
+          eq(s.id, current.nativeSubjectId),
+          eq(s.securityRevision, input.captured.revision.securityRevision),
+        ),
+      );
+    yield* database.insert(mapping.command.table).values(
+      mapping.command.encodeInsert({
+        moduleId: input.moduleId,
+        commandId: input.commandId,
+        action,
+        bindingDigest: input.authorization.challenge.bindingDigest,
+        retentionUntilMillis: now + mapping.commandRetentionMillis,
+      }),
+    );
+
+    const sourceStillActive =
+      action === "verify-address"
+        ? []
+        : yield* selectRows(
+            database
+              .select()
+              .from(mapping.credential.table)
+              .where(
+                and(
+                  eq(c.moduleId, input.moduleId),
+                  eq(c.credentialId, current.source!.snapshot.credentialId),
+                  eq(c.subjectId, current.nativeSubjectId),
+                ),
+              ),
+            false,
+          );
+
+    const target = (yield* emailLookupRows(mapping, input.moduleId, input.target))[0];
+
+    const targetAuthority = yield* selectRows(
+      database
+        .select()
+        .from(mapping.authorityCredential.table)
+        .where(
+          and(eq(a.subjectId, current.nativeSubjectId), eq(a.credentialId, targetCredentialId)),
+        )
+        .limit(1),
+      false,
+    );
+
+    const command = yield* selectRows(
+      database
+        .select()
+        .from(mapping.command.table)
+        .where(
+          and(
+            eq(commandColumns(mapping).moduleId, input.moduleId),
+            eq(commandColumns(mapping).commandId, input.commandId),
+            eq(commandColumns(mapping).action, action),
+            eq(commandColumns(mapping).bindingDigest, input.authorization.challenge.bindingDigest),
+            eq(
+              commandColumns(mapping).retentionUntil,
+              mapping.encodeInstant(now + mapping.commandRetentionMillis),
+            ),
+          ),
+        )
+        .limit(1),
+      false,
+    );
+
+    const targetVerifiedAt =
+      target === undefined
+        ? undefined
+        : yield* mapping.decodeInstant(target.identifier[mapping.identifier.verifiedAt]);
+
+    const sourceIdentifier =
+      action === "verify-address"
+        ? []
+        : yield* identifierRow(mapping, current.source!.snapshot.identifier, false);
+
+    const sourceAuthority =
+      action === "verify-address"
+        ? []
+        : yield* selectRows(
+            database
+              .select()
+              .from(mapping.authorityCredential.table)
+              .where(
+                and(
+                  eq(a.subjectId, current.nativeSubjectId),
+                  eq(a.credentialId, current.source!.snapshot.credentialId),
+                ),
+              )
+              .limit(1),
+            false,
+          );
+
+    return (
+      target !== undefined &&
+      mapping.subjectId.equals(target.subject[mapping.subject.id], current.nativeSubjectId) &&
+      mapping.subject.isActiveStatus(target.subject[mapping.subject.status]) &&
+      target.subject[mapping.subject.securityRevision] === allocated.nextSecurityRevision &&
+      target.identifier[mapping.identifier.bindingRevision] ===
+        allocated.targetIdentifierRevision &&
+      targetVerifiedAt === now &&
+      target.credential[mapping.credential.credentialRevision] ===
+        allocated.targetCredentialRevision &&
+      target.credential[mapping.credential.credentialId] === targetCredentialId &&
+      mapping.subjectId.equals(
+        target.credential[mapping.credential.subjectId],
+        current.nativeSubjectId,
+      ) &&
+      mapping.identifier.isCurrent(target.identifier) &&
+      mapping.credential.isActiveStatus(target.credential[mapping.credential.status]) &&
+      targetAuthority.length === 1 &&
+      targetAuthority[0]![mapping.authorityCredential.revision] ===
+        allocated.targetCredentialRevision &&
+      mapping.authorityCredential.isActiveStatus(
+        targetAuthority[0]![mapping.authorityCredential.status],
+      ) &&
+      command.length === 1 &&
+      (action === "verify-address" ||
+        (sourceStillActive.length === 1 &&
+          sourceStillActive[0]![mapping.credential.credentialRevision] ===
+            allocated.sourceCredentialRevision &&
+          !mapping.credential.isActiveStatus(sourceStillActive[0]![mapping.credential.status]) &&
+          sourceIdentifier.length === 1 &&
+          mapping.subjectId.equals(
+            sourceIdentifier[0]![mapping.identifier.subjectId],
+            current.nativeSubjectId,
+          ) &&
+          sourceIdentifier[0]![mapping.identifier.bindingRevision] ===
+            allocated.sourceIdentifierRevision &&
+          !mapping.identifier.isCurrent(sourceIdentifier[0]!) &&
+          sourceAuthority.length === 1 &&
+          sourceAuthority[0]![mapping.authorityCredential.revision] ===
+            allocated.sourceCredentialRevision &&
+          !mapping.authorityCredential.isActiveStatus(
+            sourceAuthority[0]![mapping.authorityCredential.status],
+          )))
+    );
+  });
+
+  const probeProofCompletion = Effect.fn("Drizzle.probeProofCompletion")(function* (
+    configuration: EmailSqlConfiguration,
+    input: ProofCompletionInput,
+  ) {
+    const database = yield* CurrentEmailSql;
+
+    if (configuration.proof === undefined) return yield* Effect.fail(unavailable());
+    const validProbe = { _tag: "EmailProofCompletionValid" } as const;
+
+    const plan = {
+      input,
+      prepare: <A>(
+        decision: ProofCompletionDecision,
+        journal: CommitJournal,
+        project: (decision: ProofCompletionDecision) => A,
+      ) => journal.prepare(project(decision)),
+    };
+
+    const probe = coordinateCommit(
+      () =>
+        database.transaction((transaction) =>
+          completeProofPlanIn(
+            configuration.proof!.mapping,
+            configuration.proof!.configuration,
+            plan,
+            Effect.fail(validProbe),
+            () => false,
+          ).pipe(
+            Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),
+          ),
+        ),
+      { mode: configuration.mode },
+    );
+
+    return yield* probe.pipe(
+      Effect.as(false),
+      Effect.catchCause((cause) => {
+        const reason = cause.reasons[0];
+
+        return cause.reasons.length === 1 &&
+          reason !== undefined &&
+          Cause.isFailReason(reason) &&
+          reason.error === validProbe
+          ? Effect.succeed(true)
+          : Effect.failCause(cause);
+      }),
+    );
+  });
+
+  const prepareRejected = Effect.fn("Drizzle.prepareRejected")(function* <A>(
+    configuration: EmailSqlConfiguration,
+    prepare: (value: "rejected", journal: CommitJournal) => PreparedCommit<A>,
+  ) {
+    const database = yield* CurrentEmailSql;
+
+    return yield* owned(
+      database,
+      configuration,
+      Effect.gen(function* () {
+        const journal = yield* CurrentCommitJournal;
+
+        return yield* Effect.succeed(prepare("rejected", journal));
+      }),
+    );
+  });
+
+  const makeSqlEmailAddressPersistence = Effect.fn("makeSqlEmailAddressPersistence")(function* (
+    database: EmailSqlDatabase,
+    mapping: AddressMapping,
+    configuration: EmailSqlConfiguration,
+  ): Effect.fn.Return<EmailAddressPersistence["Service"], never, LifecycleHooks> {
+    const hooks = yield* LifecycleHooks;
+
+    return EmailAddressPersistence.of({
+      target: (input) =>
+        (validAddressConstraints(mapping)
+          ? safeRead(
+              database,
+              configuration,
+              Effect.gen(function* () {
+                const current = yield* currentAddress(mapping, input, configuration.locking);
+
+                if (current === undefined) return yield* unavailable();
+
+                return Object.freeze({
+                  revision: snapshotEmailRevision(current.revision),
+                  eligible: current.eligible,
+                  ...(current.targetIdentifierRevision === undefined
+                    ? {}
+                    : { targetIdentifierRevision: current.targetIdentifierRevision }),
+                  ...(current.source === undefined
+                    ? {}
+                    : { source: yield* snapshotEmailCredential(current.source.snapshot) }),
+                });
+              }),
+            )
+          : Effect.fail(unavailable())
+        ).pipe(
+          Effect.provideService(CurrentEmailSql, database),
+          Effect.provideService(LifecycleHooks, hooks),
+          translateFailure,
+        ),
+      checkCompletion: (input) => {
+        if (configuration.proof === undefined || input.binding._tag !== "IdentifierChange")
+          return Effect.succeed(false).pipe(
+            Effect.provideService(CurrentEmailSql, database),
+            Effect.provideService(LifecycleHooks, hooks),
+            translateFailure,
+          );
+        const binding = input.binding;
+
+        return safeRead(
+          database,
+          configuration,
+          Effect.gen(function* () {
+            const action: EmailAction | undefined =
+              input.moduleId.endsWith("/verify-address") &&
+              input.purpose === "email-address-verification"
+                ? "verify-address"
+                : input.moduleId.endsWith("/change-address") &&
+                    input.purpose === "email-address-change"
+                  ? "change-address"
+                  : undefined;
+
+            if (action === undefined) return false;
+            const moduleId = input.moduleId.slice(0, -`/${action}`.length);
+
+            const current = yield* currentAddress(
+              mapping,
+              {
+                moduleId,
+                subjectId: binding.revision.subjectId,
+                target: binding.identifier,
+              },
+              false,
+            );
+
+            return current !== undefined && sameEmailRevision(current.revision, binding.revision);
+          }),
+        )
+          .pipe(
+            Effect.flatMap((current) =>
+              current ? probeProofCompletion(configuration, input) : Effect.succeed(false),
+            ),
+          )
+          .pipe(
+            Effect.provideService(CurrentEmailSql, database),
+            Effect.provideService(LifecycleHooks, hooks),
+            translateFailure,
+          );
+      },
+      verifyWithProof: (uncaptured, prepare) =>
+        mutateAddress(mapping, configuration, uncaptured, "verify-address", prepare).pipe(
+          Effect.provideService(CurrentEmailSql, database),
+          Effect.provideService(LifecycleHooks, hooks),
+          translateFailure,
+        ),
+      changeWithProof: (uncaptured, prepare) =>
+        mutateAddress(mapping, configuration, uncaptured, "change-address", prepare).pipe(
+          Effect.provideService(CurrentEmailSql, database),
+          Effect.provideService(LifecycleHooks, hooks),
+          translateFailure,
+        ),
+      cleanup: (input, prepare) =>
+        owned(
+          database,
+          configuration,
+          Effect.gen(function* () {
+            const transaction = yield* CurrentEmailSql;
+            const journal = yield* CurrentCommitJournal;
+
+            const c = commandColumns(mapping);
+            const now = yield* nowMillis;
+
+            const rows = yield* selectRows(
+              transaction
+                .select({ commandId: c.commandId })
+                .from(mapping.command.table)
+                .where(
+                  and(
+                    eq(c.moduleId, input.moduleId),
+                    lte(c.retentionUntil, mapping.encodeInstant(now)),
+                  ),
+                )
+                .limit(input.limit + 1),
+              configuration.locking,
+            );
+
+            const selected = rows.slice(0, input.limit);
+
+            const receipt = prepare(
+              { removed: selected.length, hasMore: rows.length > input.limit },
+              journal,
+            );
+
+            if (selected.length > 0)
+              yield* transaction.delete(mapping.command.table).where(
+                and(
+                  eq(c.moduleId, input.moduleId),
+                  inArray(
+                    c.commandId,
+                    selected.map((row: any) => row.commandId),
+                  ),
+                  lte(c.retentionUntil, mapping.encodeInstant(now)),
+                ),
+              );
+
+            return receipt;
+          }),
+        ).pipe(
+          Effect.provideService(CurrentEmailSql, database),
+          Effect.provideService(LifecycleHooks, hooks),
+          translateFailure,
+        ),
+    });
+  });
+
+  const mutateAddress = Effect.fn("Drizzle.mutateAddress")(function* <A>(
+    mapping: AddressMapping,
+    configuration: EmailSqlConfiguration,
+    uncaptured: EmailAddressMutation,
+    action: EmailAction,
+    prepare: (value: "changed" | "rejected", journal: CommitJournal) => PreparedCommit<A>,
+  ) {
+    const database = yield* CurrentEmailSql;
+
+    if (!validAddressConstraints(mapping) || configuration.proof === undefined)
+      return yield* unavailable();
+    const input = yield* snapshotEmailMutation(uncaptured);
+
+    const targetCredentialId = yield* allocate(
+      configuration.mode,
+      mapping.allocateCredentialId,
+      mapping.allocateCredentialIdSync,
+    );
+
+    const targetIdentifierRevision = yield* allocate(
+      configuration.mode,
+      mapping.allocateRevision,
+      mapping.allocateRevisionSync,
+    );
+
+    const targetCredentialRevision = yield* allocate(
+      configuration.mode,
+      mapping.allocateRevision,
+      mapping.allocateRevisionSync,
+    );
+
+    const sourceIdentifierRevision = yield* allocate(
+      configuration.mode,
+      mapping.allocateRevision,
+      mapping.allocateRevisionSync,
+    );
+
+    const sourceCredentialRevision = yield* allocate(
+      configuration.mode,
+      mapping.allocateRevision,
+      mapping.allocateRevisionSync,
+    );
+
+    const confirmsExisting =
+      action === "verify-address" && input.captured.targetIdentifierRevision !== undefined;
+
+    const nextRevision = confirmsExisting
+      ? input.captured.revision.securityRevision
+      : yield* nextSecurityRevision(
+          mapping,
+          configuration.mode,
+          input.captured.revision.securityRevision,
+        );
+
+    if (
+      (!confirmsExisting && nextRevision === input.captured.revision.securityRevision) ||
+      [
+        targetIdentifierRevision,
+        targetCredentialRevision,
+        sourceIdentifierRevision,
+        sourceCredentialRevision,
+      ].some((value) => input.captured.revision.credentials.some((item) => item.revision === value))
+    )
+      return yield* unavailable();
+
+    const run = owned(
+      database,
+      configuration,
+      Effect.gen(function* () {
+        const journal = yield* CurrentCommitJournal;
+
+        const current = yield* validateEmailAuthority(mapping, configuration, input, action);
+
+        if (current === undefined) return prepare("rejected", journal);
+        if (
+          (yield* commandExists(mapping, input.moduleId, input.commandId, configuration.locking))
+            .length > 0
+        )
+          return prepare("rejected", journal);
+        let receipt: PreparedCommit<A> | undefined;
+
+        yield* completeProofPlanIn(
+          configuration.proof!.mapping,
+          configuration.proof!.configuration,
+          input.completion,
+          Effect.gen(function* () {
+            // The proof helper may wait on continuation/series locks. Read the
+            // commit clock and reassess both policies only after those locks.
+            const currentRequirement = yield* mapping.subject.decodeActionRequirement(
+              current.subject,
+              action,
+            );
+
+            const original = yield* assessAuthentication(
+              input.authorization.evidence,
+              input.authorization.requirement,
+            ).pipe(Effect.mapError(unavailable));
+
+            const configured = yield* assessAuthentication(
+              input.authorization.evidence,
+              currentRequirement,
+            ).pipe(Effect.mapError(unavailable));
+
+            if (!original.satisfied || !configured.satisfied) return false;
+            const now = yield* nowMillis;
+
+            return yield* applyMutation(
+              mapping,
+              input,
+              action,
+              current,
+              {
+                targetCredentialId,
+                targetIdentifierRevision,
+                targetCredentialRevision,
+                sourceIdentifierRevision,
+                sourceCredentialRevision,
+                nextSecurityRevision: nextRevision,
+              },
+              now,
+            );
+          }),
+          (decision) => {
+            receipt = prepare(decision === "completed" ? "changed" : "rejected", journal);
+
+            return decision;
+          },
+        );
+
+        return receipt ?? prepare("rejected", journal);
+      }),
+    );
+
+    return yield* run.pipe(
+      Effect.catchCause((cause) =>
+        (cause.reasons.every(Cause.isFailReason) &&
+          isMappedConstraintConflict(mapping.isCommandConflict, cause)) ||
+        (cause.reasons.every(Cause.isFailReason) &&
+          isMappedConstraintConflict(mapping.isIdentifierConflict, cause)) ||
+        (cause.reasons.every(Cause.isFailReason) &&
+          isMappedConstraintConflict(mapping.isCredentialConflict, cause))
+          ? prepareRejected(configuration, prepare)
+          : Effect.failCause(cause),
+      ),
+    );
+  });
+
+  return {
+    validEmailSignInConstraints,
+    emailLookupQuery,
+    decodeEmailSnapshot,
+    makeSqlEmailSignInTargets,
+    currentAddress,
+    sameEmailRevision,
+    snapshotEmailMutation,
+    validateEmailAuthority,
+    makeSqlEmailAddressPersistence,
+  };
+};