@yielded/auth-persistence 0.1.0-beta.7

package/dist/drizzle/d1-password-prepared.d.mts

@@ -0,0 +1,25 @@
+import { D1PasswordPreparedPersistenceMapping, D1PasswordPreparedProofMapping } from "./password-prepared-model.mjs";
+import { D1BatchStatements } from "./D1BatchStatements.mjs";
+import { SuppliedService } from "./SuppliedService.mjs";
+import { Effect } from "effect";
+import { HookConfigurationError, LifecycleHooks } from "@yielded/auth/Hooks";
+import { PasswordPreparedPersistence, PasswordUnavailable } from "@yielded/auth/Password";
+import { AnyRelations } from "drizzle-orm";
+import { AnySQLiteTable } from "drizzle-orm/sqlite-core";
+import { D1Client } from "@effect/sql-d1/D1Client";
+import { EffectSQLiteD1Database } from "drizzle-orm/effect-d1";
+//#region src/drizzle/d1-password-prepared.d.ts
+type Database = EffectSQLiteD1Database<AnyRelations> & {
+  readonly $client: D1Client;
+};
+declare const makeD1PasswordPreparedPersistenceServices: <S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, At extends AnySQLiteTable, RS extends AnySQLiteTable, CE extends AnySQLiteTable, M extends AnySQLiteTable, T extends AnySQLiteTable, B extends AnySQLiteTable, NativeId, PS extends AnySQLiteTable = AnySQLiteTable, PC extends AnySQLiteTable = AnySQLiteTable, PM extends AnySQLiteTable = AnySQLiteTable, PSub extends AnySQLiteTable = AnySQLiteTable, PI extends AnySQLiteTable = AnySQLiteTable, PCr extends AnySQLiteTable = AnySQLiteTable, PNativeId = unknown>(database: Database, mapping: D1PasswordPreparedPersistenceMapping<S, I, C, AC, At, RS, CE, M, T, B, NativeId>, proofMapping?: D1PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId>) => Effect.Effect<{
+  passwordPreparedPersistence: PasswordPreparedPersistence;
+}, never, LifecycleHooks>;
+declare function coordinateD1PasswordPreparedPersistence<TargetId, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, At extends AnySQLiteTable, RS extends AnySQLiteTable, CE extends AnySQLiteTable, M extends AnySQLiteTable, T extends AnySQLiteTable, B extends AnySQLiteTable, NativeId, PS extends AnySQLiteTable, PC extends AnySQLiteTable, PM extends AnySQLiteTable, PSub extends AnySQLiteTable, PI extends AnySQLiteTable, PCr extends AnySQLiteTable, PNativeId, A, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+  readonly mapping: D1PasswordPreparedPersistenceMapping<S, I, C, AC, At, RS, CE, M, T, B, NativeId>;
+  readonly proofMapping?: D1PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId> | undefined;
+  readonly target: SuppliedService<TargetId, PasswordPreparedPersistence>;
+}, body: Effect.Effect<A, E, R>): Effect.Effect<A, E | PasswordUnavailable | HookConfigurationError | DatabaseError, Exclude<R, TargetId | D1BatchStatements> | LifecycleHooks | DatabaseRequirements>;
+//#endregion
+export { coordinateD1PasswordPreparedPersistence, makeD1PasswordPreparedPersistenceServices };
+//# sourceMappingURL=d1-password-prepared.d.mts.map

package/dist/drizzle/d1-password-prepared.mjs

@@ -0,0 +1,461 @@
+import { PersistenceMappingError } from "../internal/mapping-error.mjs";
+import { CurrentPasswordSql } from "../internal/password-kernel.mjs";
+import { column, updateValues } from "./model.mjs";
+import { balancedD1And, compactD1GeneratedStatement } from "./d1-generated-statement.mjs";
+import { CompletionInput, ContextInput, encodeReservation, evidenceCurrent, identifierScope, reservationOf, sameRevision, snapshotMutation, snapshotReserve, unavailable } from "./password-prepared-state.mjs";
+import { passwordPreparedSqlKernel } from "./password-prepared-sql.mjs";
+import { D1BatchStatements } from "./D1BatchStatements.mjs";
+import { CurrentD1PlanningDatabase, makeD1Owner } from "./d1-planning.mjs";
+import { checkD1ProofCompletion, compileD1ProofCompletionPlan } from "./d1-proofs.mjs";
+import { passwordD1Kernel } from "./d1-passwords.mjs";
+import { Cause, Context, DateTime, Effect, Predicate, Redacted, Schema } from "effect";
+import { reportPersistenceFailure } from "@yielded/auth/Persistence";
+import { CurrentCommitJournal, HookConfigurationError, LifecycleHooks, coordinateCommit, hasCommitScope } from "@yielded/auth/Hooks";
+import { PasswordPreparedVersion, PasswordRejected, PasswordUnavailable, decodePasswordPreparedReady, encodePasswordPreparedReady, snapshotPasswordPreparedReady, snapshotPasswordPreparedReservation } from "@yielded/auth/Password";
+import { ProofBinding, ProofUnavailable } from "@yielded/auth/Proofs";
+import { SQL, eq, is, isNotNull, lte, or, sql } from "drizzle-orm";
+//#region src/drizzle/d1-password-prepared.ts
+const everyFailureMatches = (cause, classify) => classify !== void 0 && cause.reasons.length > 0 && cause.reasons.every((reason) => Cause.isFailReason(reason) && classify(Cause.fail(reason.error)));
+const bindingJson = Schema.encodeSync(Schema.fromJsonString(ProofBinding));
+const authorityCondition = (mapping, current, moduleId) => {
+	const p = mapping.password, s = passwordD1Kernel.subjectColumns(p), i = passwordD1Kernel.identifierColumns(p), c = passwordD1Kernel.credentialColumns(p), ac = passwordD1Kernel.authorityColumns(p);
+	const snapshot = current.snapshot, native = current.nativeSubjectId;
+	const identifier = snapshot === void 0 ? sql`true` : balancedD1And(p.identifier.d1CurrentCondition({
+		identifier: snapshot.identifier,
+		nativeSubjectId: native
+	}), sql`exists(select 1 from ${p.identifier.table} where ${i.namespace} = ${sql.param(snapshot.identifier.namespace, i.namespace)} and ${i.value} = ${sql.param(snapshot.identifier.value, i.value)} and ${i.subjectId} = ${sql.param(native, i.subjectId)} and ${i.bindingRevision} = ${sql.param(snapshot.identifierBindingRevision, i.bindingRevision)} and ${Predicate.isNullish(current.identifier[p.identifier.verifiedAt]) ? sql`${i.verifiedAt} is null` : sql`${i.verifiedAt} = ${sql.param(current.identifier[p.identifier.verifiedAt], i.verifiedAt)}`})`);
+	return balancedD1And(sql`exists(select 1 from ${p.subject.table} where ${s.id} = ${sql.param(native, s.id)} and ${s.status} = ${sql.param(p.subject.d1ActiveStatusValue, s.status)} and ${s.securityRevision} = ${sql.param(current.revision.securityRevision, s.securityRevision)})`, identifier, snapshot === void 0 ? sql`not exists(select 1 from ${p.credential.table} where ${c.moduleId} = ${sql.param(moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(native, c.subjectId)})` : sql`exists(select 1 from ${p.credential.table} where ${c.moduleId} = ${sql.param(moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(native, c.subjectId)} and ${c.credentialId} = ${sql.param(snapshot.credentialId, c.credentialId)} and ${c.credentialRevision} = ${sql.param(snapshot.credentialRevision, c.credentialRevision)} and ${c.verifierVersion} = ${sql.param(snapshot.verifierVersion, c.verifierVersion)} and ${c.verifier} = ${sql.param(Redacted.value(snapshot.verifier), c.verifier)} and ${c.normalization} = ${sql.param(snapshot.normalization, c.normalization)})`, ...current.revision.credentials.map((entry) => sql`exists(select 1 from ${p.authorityCredential.table} where ${ac.subjectId} = ${sql.param(native, ac.subjectId)} and ${ac.credentialId} = ${sql.param(entry.credentialId, ac.credentialId)} and ${ac.revision} = ${sql.param(entry.revision, ac.revision)}${ac.status === void 0 ? sql`` : sql` and ${ac.status} = ${sql.param(p.authorityCredential.d1ActiveStatusValue, ac.status)}`})`));
+};
+const existsRow = (mapping, row) => sql`exists(select 1 from ${mapping.intent.table} where ${passwordPreparedSqlKernel.rowCondition(mapping, row)})`;
+const terminalStatements = Effect.fn(function* (mapping, row, state, marker) {
+	const database = yield* CurrentD1PlanningDatabase;
+	const t = mapping.intent;
+	return [yield* passwordD1Kernel.statement(database.update(t.table).set(t.encodeTerminal(state)).where(passwordPreparedSqlKernel.rowCondition(mapping, row))), yield* passwordD1Kernel.assertion(existsRow(mapping, {
+		...row,
+		[t.state]: t.states[state],
+		[t.snapshot]: null,
+		[t.digest]: null
+	}), marker)];
+});
+const selectInsert = Effect.fn(function* (table, values, condition) {
+	const database = yield* CurrentD1PlanningDatabase;
+	const selected = Object.fromEntries(Object.entries(values).filter(([, value]) => value !== void 0).map(([key, value]) => [key, (is(value, SQL) ? value : sql`${sql.param(value, column(table, key))}`).as(key)]));
+	return database.insert(table).select(database.select(selected).from(sql`(select 1)`).where(condition));
+});
+const makePreparedPlans = (mapping, proofMapping) => {
+	const p = mapping.password, t = mapping.intent, c = passwordPreparedSqlKernel.columns(mapping), config = { locking: false };
+	const readRows = Effect.fn(function* (condition) {
+		return yield* (yield* CurrentD1PlanningDatabase).select().from(t.table).where(condition).limit(2);
+	});
+	const run = (plan) => Effect.gen(function* () {
+		const database = yield* CurrentD1PlanningDatabase;
+		return yield* passwordPreparedSqlKernel.valid(mapping) ? plan.pipe(Effect.flatMap((planned) => Effect.try({
+			try: () => ({
+				...planned,
+				statements: planned.statements.map((statement) => compactD1GeneratedStatement(database.$client, statement, unavailable)),
+				postconditions: planned.postconditions?.map((statement) => compactD1GeneratedStatement(database.$client, statement, unavailable))
+			}),
+			catch: (cause) => Schema.is(PasswordUnavailable)(cause) ? cause : PersistenceMappingError.make({
+				operation: "mapping",
+				cause
+			})
+		}))) : Effect.fail(unavailable());
+	});
+	const current = (record) => passwordPreparedSqlKernel.currentAuthority(mapping, config, record);
+	const complete = (uncaptured, prepare) => Effect.gen(function* () {
+		const input = yield* snapshotMutation(uncaptured);
+		const completion = uncaptured.completion === void 0 ? void 0 : {
+			prepare: uncaptured.completion.prepare,
+			input: yield* Schema.encodeEffect(Schema.fromJsonString(CompletionInput))(uncaptured.completion.input).pipe(Effect.flatMap(Schema.decodeEffect(Schema.fromJsonString(CompletionInput))), Effect.mapError(unavailable))
+		};
+		if (input.intent.action === "reset-password" !== (completion !== void 0) || completion !== void 0 && proofMapping === void 0) return yield* unavailable();
+		const credentialRevision = yield* passwordD1Kernel.allocate(p.allocateRevision, p.allocateRevisionSync), verifierVersion = yield* passwordD1Kernel.allocate(p.allocateRevision, p.allocateRevisionSync), nextSecurityRevision = yield* passwordD1Kernel.allocateNextSecurityRevision(p, input.intent.revision.securityRevision);
+		if (nextSecurityRevision === input.intent.revision.securityRevision || credentialRevision === input.intent.credential?.credentialRevision || verifierVersion === input.intent.credential?.verifierVersion) return yield* unavailable();
+		const credentialId = input.intent.action === "add-password" ? yield* passwordD1Kernel.allocate(p.allocateCredentialId, p.allocateCredentialIdSync) : void 0;
+		return yield* run(Effect.gen(function* () {
+			const journal = yield* CurrentCommitJournal;
+			const authority = yield* current(input.intent), rows = yield* readRows(balancedD1And(eq(c.moduleId, input.intent.moduleId), eq(c.intentId, input.intent.intentId))), row = rows[0], now = yield* passwordD1Kernel.readEngineNowMillis(p);
+			if (authority === void 0 || rows.length !== 1 || !(yield* passwordPreparedSqlKernel.recordMatches(mapping, row, input.intent, authority.nativeSubjectId, yield* encodePasswordPreparedReady(input.intent))) || !evidenceCurrent(input, authority.requirement, now)) return {
+				receipt: prepare("rejected", journal),
+				statements: []
+			};
+			const marker = `effect-auth-password-prepared:complete:${input.intent.intentId}`;
+			const requirements = [
+				input.mutation.authorization.requirement,
+				input.intent.capturedRequirement,
+				input.capturedRequirement,
+				authority.requirement,
+				input.currentRequirement
+			];
+			const age = Math.min(...requirements.map((value) => value.maximumAgeMillis));
+			const live = balancedD1And(existsRow(mapping, row), authorityCondition(mapping, authority, input.intent.moduleId), sql`${p.d1.engineNowMillis} >= ${input.intent.issuedAtMillis} and ${p.d1.engineNowMillis} < ${input.intent.expiresAtMillis}`, ...requirements.map((requirement) => passwordD1Kernel.assuranceCondition(p, input.mutation.authorization.evidence, requirement)), ...(input.intent.baseEvidence?.proofs ?? []).map((proof) => sql`${p.d1.engineNowMillis} >= ${DateTime.toEpochMillis(proof.verifiedAt)} and ${p.d1.engineNowMillis} < ${DateTime.toEpochMillis(proof.verifiedAt) + age}`));
+			let mutation;
+			let passwordApplied;
+			let mutationGuard;
+			if (input.intent.action === "add-password") {
+				const compiled = yield* passwordD1Kernel.compileAddMutation(p, input.mutation, {
+					credentialId,
+					credentialRevision,
+					verifierVersion,
+					nextSecurityRevision
+				});
+				if (compiled === void 0) return {
+					receipt: prepare("rejected", journal),
+					statements: []
+				};
+				mutation = compiled.statements;
+				mutationGuard = compiled.retryable;
+				passwordApplied = compiled.appliedCondition;
+			} else {
+				const compiled = yield* passwordD1Kernel.compileReplacementMutation(p, input.mutation, input.intent.action, {
+					credentialRevision,
+					verifierVersion,
+					nextSecurityRevision
+				});
+				if (compiled === void 0) return {
+					receipt: prepare("rejected", journal),
+					statements: []
+				};
+				passwordApplied = compiled.protectedMutation.appliedCondition;
+				mutationGuard = (cause) => passwordD1Kernel.isGuardFailure(cause, compiled.marker);
+				mutation = [...compiled.protectedMutation.statements, yield* passwordD1Kernel.assertion(compiled.protectedMutation.appliedCondition, marker)];
+			}
+			const terminal = {
+				...row,
+				[t.state]: t.states.Consumed,
+				[t.snapshot]: null,
+				[t.digest]: null
+			};
+			const protectedMutation = {
+				statements: [
+					yield* passwordD1Kernel.assertion(live, marker),
+					...mutation,
+					...yield* terminalStatements(mapping, row, "Consumed", marker)
+				],
+				appliedCondition: balancedD1And(passwordApplied, existsRow(mapping, terminal), sql`${p.d1.engineNowMillis} >= ${input.intent.issuedAtMillis} and ${p.d1.engineNowMillis} < ${input.intent.expiresAtMillis}`, ...(input.intent.baseEvidence?.proofs ?? []).map((proof) => sql`${p.d1.engineNowMillis} >= ${DateTime.toEpochMillis(proof.verifiedAt)} and ${p.d1.engineNowMillis} < ${DateTime.toEpochMillis(proof.verifiedAt) + age}`), ...requirements.map((requirement) => passwordD1Kernel.assuranceCondition(p, input.mutation.authorization.evidence, requirement)))
+			};
+			if (completion !== void 0) {
+				if (input.intent.reset === void 0 || completion.input.continuationId !== input.intent.reset.continuationId || bindingJson(completion.input.binding) !== bindingJson(input.intent.reset.binding) || !passwordD1Kernel.completionMatchesPassword({
+					...input.mutation,
+					completion
+				})) return {
+					receipt: prepare("rejected", journal),
+					statements: []
+				};
+				let receipt;
+				const compiled = yield* compileD1ProofCompletionPlan(proofMapping, completion, protectedMutation, (decision) => {
+					receipt = prepare(decision === "completed" ? "changed" : "rejected", journal);
+					return decision;
+				});
+				return {
+					retryable: (cause) => passwordD1Kernel.isGuardFailure(cause, marker) || mutationGuard?.(cause) === true || completion !== void 0 && (passwordD1Kernel.isGuardFailure(cause, `effect-auth-proof-guard:complete:${completion.input.continuationId}`) || passwordD1Kernel.isGuardFailure(cause, `effect-auth-proof-guard:protected:${completion.input.continuationId}`)),
+					receipt: receipt ?? prepare("rejected", journal),
+					statements: compiled.statements,
+					postconditions: compiled.postconditions
+				};
+			}
+			const postconditions = [yield* passwordD1Kernel.assertion(protectedMutation.appliedCondition, marker)];
+			return {
+				retryable: (cause) => passwordD1Kernel.isGuardFailure(cause, marker) || mutationGuard?.(cause) === true,
+				receipt: prepare("changed", journal),
+				statements: [...protectedMutation.statements, ...postconditions],
+				postconditions
+			};
+		}));
+	});
+	return {
+		reserve: (uncaptured, prepare) => Effect.gen(function* () {
+			const database = yield* CurrentD1PlanningDatabase;
+			const input = yield* snapshotReserve(uncaptured);
+			if (input.action === "reset-password" !== (input.reset !== void 0 && input.completion !== void 0) || input.action === "reset-password" && proofMapping === void 0 || input.generation !== input.policy.generation || input.policy.retentionMillis < Math.max(input.policy.preparationLifetimeMillis + input.policy.lifetimeMillis, input.policy.admission.action.windowMillis, input.policy.admission.subject.windowMillis, input.policy.admission.identifier.windowMillis) || input.invalidation.existingSessions === "immediate" && p.sessionInvalidation !== "same-authority-immediate") return yield* unavailable();
+			const version = PasswordPreparedVersion.make(yield* passwordD1Kernel.allocate(mapping.allocateVersion, mapping.allocateVersionSync));
+			return yield* run(Effect.gen(function* () {
+				const journal = yield* CurrentCommitJournal;
+				const authority = yield* passwordPreparedSqlKernel.captureAuthority(mapping, config, input);
+				if (authority === void 0) return yield* unavailable();
+				let proofCondition = sql`true`;
+				if (input.reset !== void 0) {
+					if (input.completion === void 0 || input.completion.moduleId !== `${input.moduleId}/reset` || input.completion.purpose !== "password-reset" || input.reset.continuationId !== input.completion.continuationId || bindingJson(input.reset.binding) !== bindingJson(input.completion.binding) || input.reset.binding._tag !== "Subject" || !sameRevision(input.reset.binding.revision, authority.revision) || authority.snapshot?.identifierVerifiedAtMillis === void 0) return yield* unavailable();
+					const inspected = yield* checkD1ProofCompletion(proofMapping, input.completion);
+					if (!inspected.accepted) return yield* unavailable();
+					proofCondition = inspected.condition;
+				}
+				const ownerCurrent = balancedD1And(authorityCondition(mapping, authority, input.moduleId), proofCondition);
+				const marker = `effect-auth-password-prepared:reserve:${input.intentId}`;
+				const existing = yield* readRows(balancedD1And(eq(c.moduleId, input.moduleId), eq(c.commandId, input.commandId)));
+				if (existing.length) return {
+					retryable: (cause) => passwordD1Kernel.isGuardFailure(cause, marker),
+					receipt: prepare({ _tag: "Existing" }, journal),
+					statements: [yield* passwordD1Kernel.assertion(balancedD1And(ownerCurrent, existsRow(mapping, existing[0])), marker)]
+				};
+				const now = yield* passwordD1Kernel.readEngineNowMillis(p), scope = identifierScope({
+					credential: authority.snapshot,
+					revision: authority.revision
+				});
+				const reservation = yield* snapshotPasswordPreparedReservation({
+					_tag: "Preparing",
+					moduleId: input.moduleId,
+					generation: input.generation,
+					intentId: input.intentId,
+					version,
+					commandId: input.commandId,
+					action: input.action,
+					revision: authority.revision,
+					...authority.snapshot === void 0 ? {} : { credential: authority.snapshot },
+					capturedRequirement: authority.requirement,
+					...input.reset === void 0 ? {} : { reset: input.reset },
+					invalidation: input.invalidation,
+					createdAtMillis: now,
+					preparationExpiresAtMillis: now + input.policy.preparationLifetimeMillis,
+					retainUntilMillis: now + input.policy.retentionMillis
+				});
+				const snapshot = yield* encodeReservation(reservation), window = Math.max(input.policy.admission.action.windowMillis, input.policy.admission.identifier.windowMillis, input.policy.admission.subject.windowMillis);
+				const a = mapping.admission, am = column(a.table, a.moduleId), ai = column(a.table, a.intentId), at = column(a.table, a.admittedAt), ar = column(a.table, a.admissionRetainUntil);
+				const stamp = sql`(select ${at} from ${a.table} where ${am} = ${sql.param(input.moduleId, am)})`, retention = sql`(select ${ar} from ${a.table} where ${am} = ${sql.param(input.moduleId, am)})`;
+				const active = sql`(select count(*) from ${t.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(authority.nativeSubjectId, c.subjectId)} and ((${c.state} = ${sql.param(t.states.Preparing, c.state)} and ${c.preparationExpiresAt} > ${p.d1.engineNow}) or (${c.state} = ${sql.param(t.states.Ready, c.state)} and ${c.expiresAt} > ${p.d1.engineNow}))) < ${input.policy.maximumPendingPerSubject}`;
+				const budgets = [
+					[eq(c.action, input.action), input.policy.admission.action],
+					[eq(c.identifierScope, scope), input.policy.admission.identifier],
+					[eq(c.subjectId, authority.nativeSubjectId), input.policy.admission.subject]
+				];
+				const admissionDecision = balancedD1And(ownerCurrent, active, ...budgets.map(([condition, budget]) => sql`(select count(*) from ${t.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${condition} and ${c.admittedAt} > ${p.d1.engineInstantMinus(budget.windowMillis)}) < ${budget.limit}`), sql`not exists(select 1 from ${t.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${c.commandId} = ${sql.param(input.commandId, c.commandId)})`, sql`${p.d1.engineNowMillis} >= ${now} and ${p.d1.engineNowMillis} < ${reservation.preparationExpiresAtMillis}`);
+				const admittedMillis = mapping.admissionClock.toMillis(stamp), retainedMillis = mapping.admissionClock.toMillis(retention);
+				const clockGuard = balancedD1And(sql`exists(select 1 from ${a.table} where ${am} = ${sql.param(input.moduleId, am)} and ${ai} = ${sql.param(input.intentId, ai)})`, sql`${admittedMillis} >= ${now} and ${admittedMillis} <= ${p.d1.engineNowMillis}`, sql`${retainedMillis} = ${admittedMillis} + ${window}`);
+				const guard = balancedD1And(sql`changes() = 1`, clockGuard);
+				const values = {
+					...t.encodeInsert({
+						reservation,
+						nativeSubjectId: authority.nativeSubjectId,
+						identifierScope: scope,
+						snapshot,
+						admittedAtMillis: now,
+						admissionRetainUntilMillis: now + window
+					}),
+					[t.admittedAt]: stamp,
+					[t.admissionRetainUntil]: retention
+				};
+				const expected = {
+					[t.moduleId]: input.moduleId,
+					[t.intentId]: input.intentId,
+					[t.commandId]: input.commandId,
+					[t.subjectId]: authority.nativeSubjectId,
+					[t.action]: input.action,
+					[t.generation]: input.generation,
+					[t.version]: version,
+					[t.state]: t.states.Preparing,
+					[t.digest]: null,
+					[t.snapshot]: snapshot,
+					[t.identifierScope]: scope,
+					[t.createdAt]: p.encodeInstant(now),
+					[t.preparationExpiresAt]: p.encodeInstant(reservation.preparationExpiresAtMillis),
+					[t.expiresAt]: null,
+					[t.retainUntil]: p.encodeInstant(reservation.retainUntilMillis),
+					[t.admittedAt]: stamp,
+					[t.admissionRetainUntil]: retention
+				};
+				return {
+					retryable: (cause) => passwordD1Kernel.isGuardFailure(cause, marker),
+					receipt: prepare({
+						_tag: "Reserved",
+						reservation
+					}, journal),
+					statements: [
+						yield* passwordD1Kernel.statement(database.insert(a.table).values(a.encodeInsert(input.moduleId)).onConflictDoNothing()),
+						yield* passwordD1Kernel.statement(database.update(a.table).set(updateValues([
+							[a.intentId, input.intentId],
+							[a.admittedAt, p.d1.engineNow],
+							[a.admissionRetainUntil, p.d1.engineInstantPlus(window)]
+						])).where(balancedD1And(eq(am, input.moduleId), admissionDecision))),
+						yield* passwordD1Kernel.statement(yield* selectInsert(t.table, values, guard)),
+						yield* passwordD1Kernel.assertion(existsRow(mapping, expected), marker),
+						yield* passwordD1Kernel.assertion(balancedD1And(ownerCurrent, clockGuard, sql`${p.d1.engineNowMillis} < ${reservation.preparationExpiresAtMillis}`, sql`(select count(*) from ${t.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(authority.nativeSubjectId, c.subjectId)} and ((${c.state} = ${sql.param(t.states.Preparing, c.state)} and ${c.preparationExpiresAt} > ${p.d1.engineNow}) or (${c.state} = ${sql.param(t.states.Ready, c.state)} and ${c.expiresAt} > ${p.d1.engineNow}))) <= ${input.policy.maximumPendingPerSubject}`, ...budgets.map(([condition, budget]) => sql`(select count(*) from ${t.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${condition} and ${c.admittedAt} > ${p.d1.engineInstantMinus(budget.windowMillis)}) <= ${budget.limit}`)), marker)
+					]
+				};
+			}));
+		}),
+		publishReady: (uncaptured, prepare) => Effect.gen(function* () {
+			const database = yield* CurrentD1PlanningDatabase;
+			const reservation = yield* snapshotPasswordPreparedReservation(uncaptured.reservation), ready = yield* snapshotPasswordPreparedReady(uncaptured.ready), snapshot = yield* encodeReservation(reservation), readySnapshot = yield* encodePasswordPreparedReady(ready);
+			if ((yield* encodeReservation(reservationOf(ready))) !== snapshot) return yield* unavailable();
+			return yield* run(Effect.gen(function* () {
+				const journal = yield* CurrentCommitJournal;
+				const authority = yield* current(reservation), rows = yield* readRows(balancedD1And(eq(c.moduleId, reservation.moduleId), eq(c.intentId, reservation.intentId))), row = rows[0];
+				if (authority === void 0 || rows.length !== 1 || !(yield* passwordPreparedSqlKernel.recordMatches(mapping, row, reservation, authority.nativeSubjectId, snapshot))) return {
+					receipt: prepare("rejected", journal),
+					statements: []
+				};
+				const marker = `effect-auth-password-prepared:ready:${ready.intentId}`, live = balancedD1And(authorityCondition(mapping, authority, ready.moduleId), sql`${p.d1.engineNowMillis} >= ${ready.issuedAtMillis} and ${p.d1.engineNowMillis} < ${reservation.preparationExpiresAtMillis} and ${p.d1.engineNowMillis} < ${ready.expiresAtMillis}`);
+				const expected = {
+					...row,
+					[t.state]: t.states.Ready,
+					[t.snapshot]: readySnapshot,
+					[t.digest]: ready.digest,
+					[t.expiresAt]: p.encodeInstant(ready.expiresAtMillis)
+				};
+				return {
+					retryable: (cause) => passwordD1Kernel.isGuardFailure(cause, marker),
+					receipt: prepare("published", journal),
+					statements: [
+						yield* passwordD1Kernel.assertion(balancedD1And(live, existsRow(mapping, row)), marker),
+						yield* passwordD1Kernel.statement(database.update(t.table).set(t.encodeReady({
+							ready,
+							snapshot: readySnapshot
+						})).where(passwordPreparedSqlKernel.rowCondition(mapping, row))),
+						yield* passwordD1Kernel.assertion(balancedD1And(live, existsRow(mapping, expected)), marker)
+					]
+				};
+			}));
+		}),
+		context: (uncaptured) => Effect.gen(function* () {
+			const database = yield* CurrentD1PlanningDatabase;
+			if (yield* hasCommitScope) return yield* unavailable();
+			const input = yield* Schema.decodeEffect(ContextInput)({ ...uncaptured }).pipe(Effect.mapError(unavailable)), rows = yield* readRows(balancedD1And(eq(c.moduleId, input.moduleId), eq(c.generation, input.generation), eq(c.digest, input.digest), eq(c.state, t.states.Ready)));
+			if (rows.length !== 1) return yield* PasswordRejected.make({});
+			const record = yield* decodePasswordPreparedReady(rows[0][t.snapshot]), authority = yield* current(record);
+			if (authority === void 0 || record.moduleId !== input.moduleId || record.generation !== input.generation || record.digest !== input.digest || !(yield* passwordPreparedSqlKernel.recordMatches(mapping, rows[0], record, authority.nativeSubjectId, yield* encodePasswordPreparedReady(record)))) return yield* PasswordRejected.make({});
+			const condition = balancedD1And(passwordPreparedSqlKernel.rowCondition(mapping, rows[0]), authorityCondition(mapping, authority, record.moduleId), sql`${p.d1.engineNowMillis} >= ${record.issuedAtMillis} and ${p.d1.engineNowMillis} < ${record.expiresAtMillis}`);
+			const guardStatement = yield* passwordD1Kernel.assertion(sql`exists(select 1 from ${t.table} where ${condition})`, `effect-auth-password-prepared:context:${record.intentId}`);
+			const guard = yield* Effect.try({
+				try: () => compactD1GeneratedStatement(database.$client, guardStatement, unavailable),
+				catch: (cause) => Schema.is(PasswordUnavailable)(cause) ? cause : PersistenceMappingError.make({
+					operation: "mapping",
+					cause
+				})
+			});
+			yield* database.$client.batch([guard]).pipe(Effect.catchCause((cause) => everyFailureMatches(cause, (failure) => passwordD1Kernel.isGuardFailure(failure, `effect-auth-password-prepared:context:${record.intentId}`)) ? Effect.fail(PasswordRejected.make({})) : Effect.failCause(cause)));
+			return {
+				record,
+				currentRequirement: authority.requirement
+			};
+		}),
+		complete,
+		resetWithProof: complete,
+		cancel: (uncaptured, prepare) => Effect.gen(function* () {
+			const record = yield* snapshotPasswordPreparedReady(uncaptured.record);
+			return yield* run(Effect.gen(function* () {
+				const journal = yield* CurrentCommitJournal;
+				const authority = yield* current(record), rows = yield* readRows(balancedD1And(eq(c.moduleId, record.moduleId), eq(c.intentId, record.intentId))), row = rows[0];
+				if (authority === void 0 || rows.length !== 1 || !(yield* passwordPreparedSqlKernel.recordMatches(mapping, row, record, authority.nativeSubjectId, yield* encodePasswordPreparedReady(record)))) return {
+					receipt: prepare(false, journal),
+					statements: []
+				};
+				const marker = `effect-auth-password-prepared:cancel:${record.intentId}`;
+				return {
+					retryable: (cause) => passwordD1Kernel.isGuardFailure(cause, marker),
+					receipt: prepare(true, journal),
+					statements: [yield* passwordD1Kernel.assertion(balancedD1And(existsRow(mapping, row), authorityCondition(mapping, authority, record.moduleId), sql`${p.d1.engineNowMillis} >= ${record.issuedAtMillis} and ${p.d1.engineNowMillis} < ${record.expiresAtMillis}`), marker), ...yield* terminalStatements(mapping, row, "Cancelled", marker)]
+				};
+			}));
+		}),
+		cleanup: (uncaptured, prepare) => Effect.gen(function* () {
+			const database = yield* CurrentD1PlanningDatabase;
+			const input = { ...uncaptured };
+			if (!Number.isSafeInteger(input.limit) || input.limit < 1 || input.limit > 1e3) return yield* unavailable();
+			return yield* run(Effect.gen(function* () {
+				const journal = yield* CurrentCommitJournal;
+				const due = balancedD1And(eq(c.moduleId, input.moduleId), or(balancedD1And(lte(c.retainUntil, p.d1.engineNow), lte(c.admissionRetainUntil, p.d1.engineNow)), balancedD1And(isNotNull(c.snapshot), or(balancedD1And(eq(c.state, t.states.Preparing), lte(c.preparationExpiresAt, p.d1.engineNow)), balancedD1And(eq(c.state, t.states.Ready), lte(c.expiresAt, p.d1.engineNow))))));
+				const rows = yield* database.select().from(t.table).where(due).orderBy(c.createdAt, c.intentId).limit(input.limit + 1);
+				const now = yield* passwordD1Kernel.readEngineNowMillis(p), statements = [], marker = `effect-auth-password-prepared:cleanup:${input.moduleId}`;
+				let removed = 0;
+				for (const row of rows.slice(0, input.limit)) {
+					const retained = yield* p.decodeInstant(row[t.retainUntil]), charge = yield* p.decodeInstant(row[t.admissionRetainUntil]);
+					statements.push(yield* passwordD1Kernel.assertion(balancedD1And(existsRow(mapping, row), sql`exists(select 1 from ${t.table} where ${passwordPreparedSqlKernel.rowCondition(mapping, row)} and ${due})`), marker));
+					if (retained <= now && charge <= now) {
+						statements.push(yield* passwordD1Kernel.statement(database.delete(t.table).where(balancedD1And(passwordPreparedSqlKernel.rowCondition(mapping, row), lte(c.retainUntil, p.d1.engineNow), lte(c.admissionRetainUntil, p.d1.engineNow)))), yield* passwordD1Kernel.assertion(sql`not exists(select 1 from ${t.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${c.intentId} = ${sql.param(row[t.intentId], c.intentId)})`, marker));
+						removed++;
+					} else statements.push(...yield* terminalStatements(mapping, row, "Expired", marker));
+				}
+				const hasMore = rows.length > input.limit;
+				statements.push(yield* passwordD1Kernel.assertion(hasMore ? sql`exists(select 1 from ${t.table} where ${due})` : sql`not exists(select 1 from ${t.table} where ${due})`, marker));
+				return {
+					retryable: (cause) => passwordD1Kernel.isGuardFailure(cause, marker),
+					receipt: prepare({
+						removed,
+						hasMore
+					}, journal),
+					statements
+				};
+			}));
+		})
+	};
+};
+const makeD1PasswordPreparedPersistenceServices = (database, mapping, proofMapping) => Effect.gen(function* () {
+	const hooks = yield* LifecycleHooks;
+	const plans = makePreparedPlans(mapping, proofMapping);
+	const run = (plan) => Effect.gen(function* () {
+		if (yield* hasCommitScope) return yield* unavailable();
+		return yield* executeStandalone(plan);
+	}).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks));
+	return { passwordPreparedPersistence: {
+		reserve: (input, prepare) => run(plans.reserve(input, prepare)).pipe(translateFailure),
+		publishReady: (input, prepare) => run(plans.publishReady(input, prepare)).pipe(translateFailure),
+		context: (input) => plans.context(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks), translateContextFailure),
+		complete: (input, prepare) => run(plans.complete(input, prepare)).pipe(translateFailure),
+		resetWithProof: (input, prepare) => run(plans.resetWithProof(input, prepare)).pipe(translateFailure),
+		cancel: (input, prepare) => run(plans.cancel(input, prepare)).pipe(translateFailure),
+		cleanup: (input, prepare) => run(plans.cleanup(input, prepare)).pipe(translateFailure)
+	} };
+});
+function coordinateD1PasswordPreparedPersistence(acquire, options, body) {
+	return Effect.flatMap(acquire, (database) => Effect.gen(function* () {
+		const hooks = yield* LifecycleHooks;
+		if (yield* hasCommitScope) return yield* unavailable();
+		return (yield* coordinateCommit(() => Effect.gen(function* () {
+			const statements = [];
+			let mutation;
+			let poisoned = false;
+			const nativeCollector = D1BatchStatements.of({ append: (statement) => Effect.sync(() => statements.push(statement)) });
+			const owner = yield* makeD1Owner(unavailable()).pipe(Effect.provideService(D1BatchStatements, nativeCollector));
+			const protect = (effect) => effect.pipe(Effect.onError(() => Effect.sync(() => {
+				poisoned = true;
+			})));
+			const plans = makePreparedPlans(options.mapping, options.proofMapping);
+			const run = (plan) => coordinateCommit(() => Effect.gen(function* () {
+				const journal = yield* CurrentCommitJournal;
+				const planned = yield* plan;
+				yield* owner.check;
+				if (mutation !== void 0) return yield* unavailable();
+				const guarded = {
+					...planned,
+					journalGuard: journal.prepare(void 0)
+				};
+				mutation = guarded;
+				statements.push(...guarded.statements);
+				return guarded.receipt;
+			}), { mode: "batch" }).pipe(Effect.map((result) => result.value), Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks));
+			const provided = Context.make(options.target, {
+				reserve: (input, prepare) => owner.run(protect(run(plans.reserve(input, prepare)).pipe(translateFailure))),
+				publishReady: (input, prepare) => owner.run(protect(run(plans.publishReady(input, prepare)).pipe(translateFailure))),
+				context: (input) => owner.run(protect(plans.context(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks), translateContextFailure))),
+				complete: (input, prepare) => owner.run(protect(run(plans.complete(input, prepare)).pipe(translateFailure))),
+				resetWithProof: (input, prepare) => owner.run(protect(run(plans.resetWithProof(input, prepare)).pipe(translateFailure))),
+				cancel: (input, prepare) => owner.run(protect(run(plans.cancel(input, prepare)).pipe(translateFailure))),
+				cleanup: (input, prepare) => owner.run(protect(run(plans.cleanup(input, prepare)).pipe(translateFailure)))
+			}).pipe(Context.add(D1BatchStatements, owner.collector));
+			const value = yield* owner.close(Effect.provideContext(body, provided));
+			if (poisoned) return yield* unavailable();
+			if (mutation?.journalGuard !== void 0) {
+				const status = yield* Effect.result(mutation.journalGuard.read);
+				if (status._tag === "Success" || status.failure._tag !== "CommitPending") return yield* unavailable();
+			}
+			yield* database.$client.batch([...statements, ...mutation?.postconditions ?? []]).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, (error) => everyFailureMatches(cause, mutation?.retryable) ? unavailable() : error))), translateFailure);
+			return value;
+		}), { mode: "batch" }).pipe(Effect.provideService(LifecycleHooks, hooks))).value;
+	}));
+}
+const translateFailure = (effect) => reportPersistenceFailure(effect, (error) => Schema.is(PasswordUnavailable)(error) || Schema.is(ProofUnavailable)(error) || Schema.is(HookConfigurationError)(error)).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));
+const translateContextFailure = (effect) => reportPersistenceFailure(effect, (error) => Schema.is(PasswordUnavailable)(error) || Schema.is(PasswordRejected)(error) || Schema.is(ProofUnavailable)(error) || Schema.is(HookConfigurationError)(error)).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, (error) => Schema.is(PasswordRejected)(error) ? error : unavailable()))));
+const executeStandalone = (plan) => Effect.suspend(() => {
+	let retryable;
+	return coordinateCommit(() => Effect.gen(function* () {
+		const database = yield* CurrentD1PlanningDatabase;
+		const planned = yield* plan;
+		retryable = planned.retryable;
+		yield* database.$client.batch([...planned.statements, ...planned.postconditions ?? []]);
+		return planned.receipt;
+	}), { mode: "batch" }).pipe(Effect.map((result) => result.value), Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, (error) => everyFailureMatches(cause, retryable) ? unavailable() : error))));
+});
+//#endregion
+export { coordinateD1PasswordPreparedPersistence, makeD1PasswordPreparedPersistenceServices };
+
+//# sourceMappingURL=d1-password-prepared.mjs.map