@yielded/auth-persistence 0.1.0-beta.7

package/dist/drizzle/d1-passwords.mjs

@@ -0,0 +1,1004 @@
+import { PersistenceMappingError, isMappedConstraintConflict } from "../internal/mapping-error.mjs";
+import { requiredPasswordConstraints, requiredPasswordRegistrationConstraints } from "./password-model.mjs";
+import { column, updateValues } from "./model.mjs";
+import { balancedD1And } from "./d1-generated-statement.mjs";
+import { D1BatchStatements } from "./D1BatchStatements.mjs";
+import { CurrentD1PlanningDatabase, makeD1Owner } from "./d1-planning.mjs";
+import { compileD1ProofCompletionPlan } from "./d1-proofs.mjs";
+import { Cause, Context, DateTime, Effect, Option, Predicate, Redacted, Schema } from "effect";
+import { reportPersistenceFailure } from "@yielded/auth/Persistence";
+import { CurrentCommitJournal, HookConfigurationError, LifecycleHooks, coordinateCommit, hasCommitScope } from "@yielded/auth/Hooks";
+import { AuthenticationEvidence, AuthenticationRequirement, snapshotAuthenticationEvidence } from "@yielded/auth/Sessions";
+import { PasswordPersistence, PasswordUnavailable, snapshotPasswordCredential, snapshotPasswordRequirement, snapshotPasswordRevision } from "@yielded/auth/Password";
+import { ProofUnavailable } from "@yielded/auth/Proofs";
+import { and, count, eq, gte, inArray, lte, notExists, sql } from "drizzle-orm";
+//#region src/drizzle/d1-passwords.ts
+const mapAdapter = (effect) => effect;
+const unavailable = () => PasswordUnavailable.make({});
+const everyFailureMatches = (cause, classify) => classify !== void 0 && cause.reasons.length > 0 && cause.reasons.every((reason) => Cause.isFailReason(reason) && classify(Cause.fail(reason.error)));
+const validConstraints = (mapping) => Object.entries(requiredPasswordConstraints).every(([key, value]) => mapping.constraints[key] === value);
+const validRegistrationConstraints = (mapping) => Object.entries(requiredPasswordRegistrationConstraints).every(([key, value]) => mapping.constraints[key] === value);
+const containsFailure = (failure, predicate) => {
+	const seen = /* @__PURE__ */ new Set();
+	const pending = [failure];
+	for (let inspected = 0; inspected < 32 && pending.length > 0; inspected++) {
+		const current = pending.shift();
+		if (current === void 0 || current === null || seen.has(current)) continue;
+		seen.add(current);
+		if (predicate(current)) return true;
+		if (Cause.isCause(current)) {
+			for (const reason of current.reasons) if (Cause.isFailReason(reason)) pending.push(reason.error);
+			else if (Cause.isDieReason(reason)) pending.push(reason.defect);
+			continue;
+		}
+		if (typeof current !== "object") continue;
+		const wrapped = current;
+		if (wrapped.cause !== void 0) pending.push(wrapped.cause);
+		if (wrapped.reason !== void 0) pending.push(wrapped.reason);
+		if (wrapped.message !== void 0) pending.push(wrapped.message);
+	}
+	return false;
+};
+const isGuardFailure = (cause, marker) => {
+	const native = `bad JSON path: '${`$[${marker.replaceAll("'", "''")}]`}': SQLITE_ERROR`;
+	return containsFailure(cause, (value) => value === native || value === `D1_ERROR: ${native}`);
+};
+const statement = Effect.fn(function* (query) {
+	const database = yield* CurrentD1PlanningDatabase;
+	const rendered = query.toSQL();
+	return database.$client.unsafe(rendered.sql, rendered.params);
+});
+const assertion = Effect.fn(function* (condition, marker) {
+	const database = yield* CurrentD1PlanningDatabase;
+	return yield* statement(database.select({ ok: sql`case when ${condition} then 1 else json_extract('[]', ${`$[${marker}]`}) end`.as("ok") }).from(sql`(select 1)`));
+});
+const readEngineNowMillis = Effect.fn("Drizzle.readEngineNowMillis")(function* (mapping) {
+	return yield* (yield* CurrentD1PlanningDatabase).select({ value: mapping.d1.engineNowMillis.as("engine_now_millis") }).from(sql`(select 1)`).pipe(Effect.flatMap((rows) => {
+		const value = Number(rows[0]?.value);
+		return Number.isFinite(value) ? Effect.succeed(value) : Effect.fail(unavailable());
+	}));
+});
+const driverValues = (values, entries) => ({
+	...values,
+	...Object.fromEntries(entries)
+});
+const allocate = (asyncValue, syncValue) => asyncValue !== void 0 ? asyncValue : syncValue === void 0 ? Effect.fail(unavailable()) : Effect.try({
+	try: syncValue,
+	catch: (cause) => new PersistenceMappingError({
+		operation: "mapping",
+		cause
+	})
+});
+const allocateNextSecurityRevision = (mapping, current) => allocate(mapping.subject.nextSecurityRevision?.(current) ?? mapping.allocateRevision, mapping.subject.nextSecurityRevisionSync === void 0 ? mapping.allocateRevisionSync : () => mapping.subject.nextSecurityRevisionSync(current));
+const subjectColumns = (mapping) => ({
+	id: column(mapping.subject.table, mapping.subject.id),
+	status: column(mapping.subject.table, mapping.subject.status),
+	securityRevision: column(mapping.subject.table, mapping.subject.securityRevision)
+});
+const identifierColumns = (mapping) => ({
+	namespace: column(mapping.identifier.table, mapping.identifier.namespace),
+	value: column(mapping.identifier.table, mapping.identifier.value),
+	subjectId: column(mapping.identifier.table, mapping.identifier.subjectId),
+	verifiedAt: column(mapping.identifier.table, mapping.identifier.verifiedAt),
+	bindingRevision: column(mapping.identifier.table, mapping.identifier.bindingRevision)
+});
+const credentialColumns = (mapping) => ({
+	moduleId: column(mapping.credential.table, mapping.credential.moduleId),
+	subjectId: column(mapping.credential.table, mapping.credential.subjectId),
+	credentialId: column(mapping.credential.table, mapping.credential.credentialId),
+	credentialRevision: column(mapping.credential.table, mapping.credential.credentialRevision),
+	verifierVersion: column(mapping.credential.table, mapping.credential.verifierVersion),
+	verifier: column(mapping.credential.table, mapping.credential.verifier),
+	normalization: column(mapping.credential.table, mapping.credential.normalization)
+});
+const authorityColumns = (mapping) => ({
+	subjectId: column(mapping.authorityCredential.table, mapping.authorityCredential.subjectId),
+	credentialId: column(mapping.authorityCredential.table, mapping.authorityCredential.credentialId),
+	revision: column(mapping.authorityCredential.table, mapping.authorityCredential.revision),
+	status: mapping.authorityCredential.status === void 0 ? void 0 : column(mapping.authorityCredential.table, mapping.authorityCredential.status)
+});
+const attemptColumns = (mapping) => ({
+	moduleId: column(mapping.attempt.table, mapping.attempt.moduleId),
+	action: column(mapping.attempt.table, mapping.attempt.action),
+	attemptId: column(mapping.attempt.table, mapping.attempt.attemptId),
+	identifierNamespace: column(mapping.attempt.table, mapping.attempt.identifierNamespace),
+	identifierValue: column(mapping.attempt.table, mapping.attempt.identifierValue),
+	subjectId: column(mapping.attempt.table, mapping.attempt.subjectId),
+	credentialId: column(mapping.attempt.table, mapping.attempt.credentialId),
+	securityRevision: column(mapping.attempt.table, mapping.attempt.securityRevision),
+	credentialRevision: column(mapping.attempt.table, mapping.attempt.credentialRevision),
+	verifierVersion: column(mapping.attempt.table, mapping.attempt.verifierVersion),
+	identifierBindingRevision: column(mapping.attempt.table, mapping.attempt.identifierBindingRevision),
+	admittedAt: column(mapping.attempt.table, mapping.attempt.admittedAt),
+	deadline: column(mapping.attempt.table, mapping.attempt.deadline),
+	retentionUntil: column(mapping.attempt.table, mapping.attempt.retentionUntil),
+	state: column(mapping.attempt.table, mapping.attempt.state)
+});
+const scopeColumns = (mapping) => ({
+	moduleId: column(mapping.rateScope.table, mapping.rateScope.moduleId),
+	action: column(mapping.rateScope.table, mapping.rateScope.action),
+	scopeKind: column(mapping.rateScope.table, mapping.rateScope.scopeKind),
+	scopeKey: column(mapping.rateScope.table, mapping.rateScope.scopeKey)
+});
+const chargeColumns = (mapping) => ({
+	moduleId: column(mapping.charge.table, mapping.charge.moduleId),
+	action: column(mapping.charge.table, mapping.charge.action),
+	scopeKind: column(mapping.charge.table, mapping.charge.scopeKind),
+	scopeKey: column(mapping.charge.table, mapping.charge.scopeKey),
+	attemptId: column(mapping.charge.table, mapping.charge.attemptId),
+	occurredAt: column(mapping.charge.table, mapping.charge.occurredAt),
+	retentionUntil: column(mapping.charge.table, mapping.charge.retentionUntil)
+});
+const commandColumns = (mapping) => ({
+	moduleId: column(mapping.command.table, mapping.command.moduleId),
+	commandId: column(mapping.command.table, mapping.command.commandId),
+	action: column(mapping.command.table, mapping.command.action),
+	bindingDigest: column(mapping.command.table, mapping.command.bindingDigest),
+	decision: column(mapping.command.table, mapping.command.decision),
+	retentionUntil: column(mapping.command.table, mapping.command.retentionUntil)
+});
+const readIdentifier = Effect.fn("Drizzle.readIdentifier")(function* (mapping, identifier) {
+	const database = yield* CurrentD1PlanningDatabase;
+	const c = identifierColumns(mapping);
+	return yield* database.select().from(mapping.identifier.table).where(and(eq(c.namespace, identifier.namespace), eq(c.value, identifier.value))).limit(1);
+});
+const readSubjectNative = Effect.fn("Drizzle.readSubjectNative")(function* (mapping, nativeSubjectId) {
+	return yield* (yield* CurrentD1PlanningDatabase).select().from(mapping.subject.table).where(eq(subjectColumns(mapping).id, nativeSubjectId)).limit(1);
+});
+const readCredentialNative = Effect.fn("Drizzle.readCredentialNative")(function* (mapping, moduleId, nativeSubjectId) {
+	const database = yield* CurrentD1PlanningDatabase;
+	const c = credentialColumns(mapping);
+	return yield* database.select().from(mapping.credential.table).where(and(eq(c.moduleId, moduleId), eq(c.subjectId, nativeSubjectId))).limit(1);
+});
+const resolveCredential = Effect.fn("DrizzleD1Password.resolveCredential")(function* (mapping, moduleId, identifier, requestedSubjectId) {
+	const identifierRow = (yield* readIdentifier(mapping, identifier))[0];
+	if (identifierRow === void 0 || !mapping.identifier.isCurrent(identifierRow)) return void 0;
+	const nativeSubjectId = identifierRow[mapping.identifier.subjectId];
+	const subject = (yield* readSubjectNative(mapping, nativeSubjectId))[0];
+	if (subject === void 0 || !mapping.subject.isActiveStatus(subject[mapping.subject.status])) return void 0;
+	const subjectId = yield* mapping.subjectId.toSubject(nativeSubjectId);
+	if (requestedSubjectId !== void 0 && subjectId !== requestedSubjectId) return void 0;
+	const credential = (yield* readCredentialNative(mapping, moduleId, nativeSubjectId))[0];
+	if (credential === void 0) return {
+		nativeSubjectId,
+		subject,
+		identifier: identifierRow
+	};
+	return {
+		nativeSubjectId,
+		subject,
+		identifier: identifierRow,
+		credential,
+		snapshot: yield* mapping.credential.decode({
+			moduleId,
+			subject,
+			identifier: identifierRow,
+			credential
+		}).pipe(Effect.flatMap(snapshotPasswordCredential))
+	};
+});
+const scopeEntries = (keys, policy) => {
+	const entries = [{
+		kind: "action",
+		key: keys.action,
+		...policy.action
+	}, {
+		kind: "identifier",
+		key: keys.identifier,
+		...policy.identifier
+	}];
+	if (keys.subject !== void 0) entries.push({
+		kind: "subject",
+		key: keys.subject,
+		...policy.subject
+	});
+	return entries;
+};
+const scopeAdmissionCondition = (mapping, moduleId, action, entry, policy, identifier, nativeSubjectId) => {
+	const c = chargeColumns(mapping);
+	const a = attemptColumns(mapping);
+	const pending = entry.kind === "action" ? and(eq(a.moduleId, moduleId), eq(a.action, action), eq(a.state, "pending")) : entry.kind === "identifier" ? and(eq(a.moduleId, moduleId), eq(a.action, action), eq(a.identifierNamespace, identifier.namespace), eq(a.identifierValue, identifier.value), eq(a.state, "pending")) : and(eq(a.moduleId, moduleId), eq(a.action, action), eq(a.subjectId, nativeSubjectId), eq(a.state, "pending"));
+	return sql`(select count(*) from ${mapping.charge.table} where ${c.moduleId} = ${sql.param(moduleId, c.moduleId)} and ${c.action} = ${sql.param(action, c.action)} and ${c.scopeKind} = ${sql.param(entry.kind, c.scopeKind)} and ${c.scopeKey} = ${sql.param(entry.key, c.scopeKey)} and ${c.occurredAt} >= ${mapping.d1.engineInstantMinus(entry.windowMillis)}) < ${entry.limit} and (select count(*) from ${mapping.attempt.table} where ${pending}) < ${policy.maximumPending}`;
+};
+const readScopeAdmission = Effect.fn("DrizzleD1Password.readScopeAdmission")(function* (mapping, moduleId, action, entries, policy, identifier, nativeSubjectId, now) {
+	const database = yield* CurrentD1PlanningDatabase;
+	const c = chargeColumns(mapping);
+	const a = attemptColumns(mapping);
+	const admitted = [];
+	for (let index = 0; index < entries.length; index++) {
+		const entry = entries[index];
+		const chargeRows = yield* mapAdapter(database.select({ total: count() }).from(mapping.charge.table).where(and(eq(c.moduleId, moduleId), eq(c.action, action), eq(c.scopeKind, entry.kind), eq(c.scopeKey, entry.key), gte(c.occurredAt, mapping.encodeInstant(now - entry.windowMillis)))));
+		const pendingWhere = entry.kind === "action" ? and(eq(a.moduleId, moduleId), eq(a.action, action), eq(a.state, "pending")) : entry.kind === "identifier" ? and(eq(a.moduleId, moduleId), eq(a.action, action), eq(a.identifierNamespace, identifier.namespace), eq(a.identifierValue, identifier.value), eq(a.state, "pending")) : and(eq(a.moduleId, moduleId), eq(a.action, action), eq(a.subjectId, nativeSubjectId), eq(a.state, "pending"));
+		const pendingRows = yield* mapAdapter(database.select({ total: count() }).from(mapping.attempt.table).where(pendingWhere));
+		if (Number(chargeRows[0]?.total ?? 0) < entry.limit && Number(pendingRows[0]?.total ?? 0) < policy.maximumPending) admitted.push(entry);
+		else if (index === 0) break;
+	}
+	return admitted;
+});
+const evidenceProofsJson = Schema.encodeSync(Schema.fromJsonString(AuthenticationEvidence.fields.proofs));
+const alternativesJson = Schema.encodeSync(Schema.fromJsonString(AuthenticationRequirement.fields.alternatives));
+const assuranceCondition = (mapping, evidence, requirement) => {
+	const proofs = evidenceProofsJson(evidence.proofs);
+	const fresh = sql`json_extract(proof.value, '$.verifiedAt') <= ${mapping.d1.engineNowMillis} and ${mapping.d1.engineNowMillis} - json_extract(proof.value, '$.verifiedAt') < ${requirement.maximumAgeMillis}`;
+	return sql`exists(
+    select 1 from json_each(${alternativesJson(requirement.alternatives)}) as alternative
+    where not exists(select 1 from json_each(${proofs}) as proof where json_extract(proof.value, '$.verifiedAt') > ${mapping.d1.engineNowMillis})
+    and not exists(select 1 from json_each(alternative.value, '$.factors') as factor where not exists(select 1 from json_each(${proofs}) as proof, json_each(proof.value, '$.factors') as held where ${fresh} and held.value = factor.value))
+    and (select count(distinct json_extract(proof.value, '$.credentialId')) from json_each(${proofs}) as proof where ${fresh}) >= json_extract(alternative.value, '$.minimumCredentials')
+    and exists(select 1 from json_each(${proofs}) as proof where ${fresh} and (json_extract(alternative.value, '$.userVerified') = 0 or json_extract(proof.value, '$.userVerified') = 1) and (json_extract(alternative.value, '$.phishingResistant') = 0 or json_extract(proof.value, '$.phishingResistant') = 1))
+  )`;
+};
+const sameIdentifier = (left, right) => left.namespace === right.namespace && left.value === right.value;
+const sameSnapshot = (left, right) => left.moduleId === right.moduleId && left.revision.subjectId === right.revision.subjectId && left.revision.securityRevision === right.revision.securityRevision && left.credentialId === right.credentialId && left.credentialRevision === right.credentialRevision && left.verifierVersion === right.verifierVersion && left.normalization === right.normalization && left.identifierVerifiedAtMillis === right.identifierVerifiedAtMillis && left.revision.credentials.length === right.revision.credentials.length && left.revision.credentials.every((entry) => right.revision.credentials.some((other) => other.credentialId === entry.credentialId && other.revision === entry.revision)) && left.identifierBindingRevision === right.identifierBindingRevision && sameIdentifier(left.identifier, right.identifier) && Redacted.value(left.verifier) === Redacted.value(right.verifier);
+const evidenceSatisfiedAt = (evidence, requirement, now) => {
+	if (evidence.proofs.length > 64 || evidence.revision.credentials.length > 64) return false;
+	const revisions = /* @__PURE__ */ new Map();
+	for (const revision of evidence.revision.credentials) {
+		if (revisions.has(revision.credentialId)) return false;
+		revisions.set(revision.credentialId, revision.revision);
+	}
+	if (evidence.proofs.some((proof) => !revisions.has(proof.credentialId))) return false;
+	if (evidence.proofs.some((proof) => now < DateTime.toEpochMillis(proof.verifiedAt))) return false;
+	const fresh = evidence.proofs.filter((proof) => now - DateTime.toEpochMillis(proof.verifiedAt) < requirement.maximumAgeMillis);
+	const factors = new Set(fresh.flatMap((proof) => proof.factors));
+	const credentials = new Set(fresh.map((proof) => proof.credentialId));
+	return requirement.alternatives.some((alternative) => alternative.factors.every((factor) => factors.has(factor)) && credentials.size >= alternative.minimumCredentials && fresh.some((proof) => (!alternative.userVerified || proof.userVerified) && (!alternative.phishingResistant || proof.phishingResistant)));
+};
+const snapshotMutationInput = Effect.fn("DrizzleD1Password.snapshotMutationInput")(function* (input) {
+	const expectedRevision = snapshotPasswordRevision(input.expectedRevision);
+	const evidence = yield* snapshotAuthenticationEvidence(input.authorization.evidence).pipe(Effect.mapError(unavailable));
+	const requirement = yield* snapshotPasswordRequirement(input.authorization.requirement);
+	const credential = input.credential === void 0 ? void 0 : yield* snapshotPasswordCredential(input.credential);
+	return Object.freeze({
+		...input,
+		expectedRevision,
+		replacement: Object.freeze({
+			verifier: Redacted.make(Redacted.value(input.replacement.verifier)),
+			normalization: input.replacement.normalization
+		}),
+		invalidation: Object.freeze({ ...input.invalidation }),
+		...credential === void 0 ? {} : { credential },
+		authorization: Object.freeze({
+			challenge: Object.freeze({
+				...input.authorization.challenge,
+				revision: snapshotPasswordRevision(input.authorization.challenge.revision)
+			}),
+			evidence,
+			requirement
+		})
+	});
+});
+const completionMatchesPassword = (input) => {
+	const completion = input.completion.input;
+	const binding = completion.binding;
+	if (completion.moduleId !== `${input.moduleId}/reset` || completion.purpose !== "password-reset" || binding._tag !== "Subject" || input.credential === void 0 || binding.revision.subjectId !== input.expectedRevision.subjectId || binding.revision.securityRevision !== input.expectedRevision.securityRevision || !sameIdentifier(binding.identifier, input.credential.identifier)) return false;
+	const expected = [...input.expectedRevision.credentials].sort((left, right) => left.credentialId.localeCompare(right.credentialId));
+	const actual = [...binding.revision.credentials].sort((left, right) => left.credentialId.localeCompare(right.credentialId));
+	return expected.length === actual.length && expected.every((item, index) => item.credentialId === actual[index].credentialId && item.revision === actual[index].revision);
+};
+const probeProofCompletion = Effect.fn("DrizzleD1.probeProofCompletion")(function* (mapping, input) {
+	const database = yield* CurrentD1PlanningDatabase;
+	const plan = {
+		input,
+		prepare: (decision, journal, project) => journal.prepare(project(decision))
+	};
+	const marker = `effect-auth-proof-guard:protected:${input.continuationId}`;
+	return yield* coordinateCommit(() => Effect.gen(function* () {
+		const compiled = yield* compileD1ProofCompletionPlan(mapping, plan, {
+			statements: [],
+			appliedCondition: sql`false`
+		}, () => false);
+		if (compiled.statements.length === 0) return false;
+		yield* database.$client.batch(compiled.statements);
+		return false;
+	}), { mode: "batch" }).pipe(Effect.as(false), Effect.catchCause((cause) => isGuardFailure(cause, marker) ? Effect.succeed(true) : Effect.failCause(cause)));
+});
+const identifierCurrentCondition = (mapping, input, nativeSubjectId, nativeVerifiedAt) => {
+	if (input.credential === void 0) return sql`true`;
+	const ic = identifierColumns(mapping), snapshot = input.credential;
+	return and(mapping.identifier.d1CurrentCondition({
+		identifier: snapshot.identifier,
+		nativeSubjectId
+	}), sql`exists(select 1 from ${mapping.identifier.table} where ${ic.namespace} = ${sql.param(snapshot.identifier.namespace, ic.namespace)} and ${ic.value} = ${sql.param(snapshot.identifier.value, ic.value)} and ${ic.subjectId} = ${sql.param(nativeSubjectId, ic.subjectId)} and ${ic.bindingRevision} = ${sql.param(snapshot.identifierBindingRevision, ic.bindingRevision)} and ${Predicate.isNullish(nativeVerifiedAt) ? sql`${ic.verifiedAt} is null` : sql`${ic.verifiedAt} = ${sql.param(nativeVerifiedAt, ic.verifiedAt)}`})`);
+};
+const readAuthority = Effect.fn("DrizzleD1Password.readAuthority")(function* (mapping, input, action) {
+	const database = yield* CurrentD1PlanningDatabase;
+	if (input.authorization.evidence.proofs.length > 64 || input.authorization.evidence.revision.credentials.length > 64) return void 0;
+	const revisionIds = new Set(input.authorization.evidence.revision.credentials.map((item) => item.credentialId));
+	if (revisionIds.size !== input.authorization.evidence.revision.credentials.length || input.authorization.evidence.proofs.some((proof) => !revisionIds.has(proof.credentialId))) return void 0;
+	const nativeSubjectId = yield* mapping.subjectId.toNative(input.expectedRevision.subjectId);
+	const subject = (yield* readSubjectNative(mapping, nativeSubjectId))[0];
+	if (subject === void 0 || !mapping.subject.isActiveStatus(subject[mapping.subject.status]) || subject[mapping.subject.securityRevision] !== input.expectedRevision.securityRevision || input.authorization.challenge.moduleId !== input.moduleId || input.authorization.challenge.action !== action || input.authorization.challenge.commandId !== input.commandId || input.authorization.challenge.revision.subjectId !== input.expectedRevision.subjectId || input.authorization.challenge.revision.securityRevision !== input.expectedRevision.securityRevision || input.authorization.evidence.revision.subjectId !== input.expectedRevision.subjectId || input.authorization.evidence.revision.securityRevision !== input.expectedRevision.securityRevision || input.authorization.evidence.flowId !== input.commandId || input.authorization.evidence.bindingDigest !== input.authorization.challenge.bindingDigest || action === "add-password" && (input.credential !== void 0 || input.authorization.challenge.targetCredentialId !== void 0) || input.expectedRevision.credentials.some((expected) => !input.authorization.evidence.revision.credentials.some((actual) => actual.credentialId === expected.credentialId && actual.revision === expected.revision))) return void 0;
+	let identifierCondition = sql`true`;
+	if (input.credential !== void 0) {
+		const identifier = (yield* readIdentifier(mapping, input.credential.identifier))[0];
+		if (identifier === void 0 || input.authorization.challenge.targetCredentialId !== input.credential.credentialId || !mapping.identifier.isCurrent(identifier) || !mapping.subjectId.equals(identifier[mapping.identifier.subjectId], nativeSubjectId) || identifier[mapping.identifier.bindingRevision] !== input.credential.identifierBindingRevision) return void 0;
+		const credential = (yield* readCredentialNative(mapping, input.moduleId, nativeSubjectId))[0];
+		if (credential === void 0) return void 0;
+		const snapshot = yield* mapping.credential.decode({
+			moduleId: input.moduleId,
+			subject,
+			identifier,
+			credential
+		});
+		if (!sameSnapshot(snapshot, input.credential)) return void 0;
+		identifierCondition = identifierCurrentCondition(mapping, input, nativeSubjectId, identifier[mapping.identifier.verifiedAt]);
+		const ic = identifierColumns(mapping);
+		identifierCondition = and(identifierCondition, sql`exists(select 1 from ${mapping.identifier.table} where ${ic.namespace} = ${sql.param(input.credential.identifier.namespace, ic.namespace)} and ${ic.value} = ${sql.param(input.credential.identifier.value, ic.value)} and ${ic.subjectId} = ${sql.param(nativeSubjectId, ic.subjectId)} and ${ic.bindingRevision} = ${sql.param(input.credential.identifierBindingRevision, ic.bindingRevision)})`);
+	}
+	const expected = [...new Map([...input.expectedRevision.credentials, ...input.authorization.evidence.revision.credentials].map((item) => [item.credentialId, item])).values()].sort((left, right) => left.credentialId.localeCompare(right.credentialId));
+	const ac = authorityColumns(mapping);
+	const sortedRows = [...expected.length === 0 ? [] : yield* database.select().from(mapping.authorityCredential.table).where(and(eq(ac.subjectId, nativeSubjectId), inArray(ac.credentialId, expected.map((item) => item.credentialId))))].sort((left, right) => String(left[mapping.authorityCredential.credentialId]).localeCompare(String(right[mapping.authorityCredential.credentialId])));
+	if (sortedRows.length !== expected.length || sortedRows.some((row, index) => row[mapping.authorityCredential.credentialId] !== expected[index].credentialId || row[mapping.authorityCredential.revision] !== expected[index].revision || mapping.authorityCredential.status !== void 0 && mapping.authorityCredential.isActiveStatus?.(row[mapping.authorityCredential.status]) !== true)) return void 0;
+	const requirement = yield* mapping.subject.decodeActionRequirement(subject, action);
+	const engineNow = yield* readEngineNowMillis(mapping);
+	if (!evidenceSatisfiedAt(input.authorization.evidence, input.authorization.requirement, engineNow) || !evidenceSatisfiedAt(input.authorization.evidence, requirement, engineNow)) return void 0;
+	if (input.invalidation.existingSessions === "immediate" && mapping.sessionInvalidation !== "same-authority-immediate") return void 0;
+	const s = subjectColumns(mapping);
+	const credentialConditions = expected.map((item) => sql`exists(select 1 from ${mapping.authorityCredential.table} where ${ac.subjectId} = ${sql.param(nativeSubjectId, ac.subjectId)} and ${ac.credentialId} = ${sql.param(item.credentialId, ac.credentialId)} and ${ac.revision} = ${sql.param(item.revision, ac.revision)}${ac.status === void 0 ? sql`` : sql` and ${ac.status} = ${sql.param(mapping.authorityCredential.d1ActiveStatusValue, ac.status)}`})`);
+	return {
+		nativeSubjectId,
+		subject,
+		requirement,
+		identifierCondition,
+		condition: balancedD1And(sql`exists(select 1 from ${mapping.subject.table} where ${s.id} = ${sql.param(nativeSubjectId, s.id)} and ${s.status} = ${sql.param(mapping.subject.d1ActiveStatusValue, s.status)} and ${s.securityRevision} = ${sql.param(input.expectedRevision.securityRevision, s.securityRevision)})`, identifierCondition, ...credentialConditions, assuranceCondition(mapping, input.authorization.evidence, input.authorization.requirement), assuranceCondition(mapping, input.authorization.evidence, requirement))
+	};
+});
+const commandAbsentCondition = (mapping, moduleId, commandId) => {
+	const c = commandColumns(mapping);
+	return sql`not exists(select 1 from ${mapping.command.table} where ${c.moduleId} = ${sql.param(moduleId, c.moduleId)} and ${c.commandId} = ${sql.param(commandId, c.commandId)})`;
+};
+const credentialCurrentCondition = (mapping, input, nativeSubjectId) => {
+	const c = credentialColumns(mapping);
+	return input.credential === void 0 ? sql`false` : sql`exists(select 1 from ${mapping.credential.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(nativeSubjectId, c.subjectId)} and ${c.credentialId} = ${sql.param(input.credential.credentialId, c.credentialId)} and ${c.credentialRevision} = ${sql.param(input.credential.credentialRevision, c.credentialRevision)} and ${c.verifierVersion} = ${sql.param(input.credential.verifierVersion, c.verifierVersion)} and ${c.verifier} = ${sql.param(Redacted.value(input.credential.verifier), c.verifier)} and ${c.normalization} = ${sql.param(input.credential.normalization, c.normalization)})`;
+};
+const admittedSnapshotCondition = (mapping, resolved, moduleId) => {
+	const snapshot = resolved?.snapshot;
+	if (snapshot === void 0 || resolved === void 0) return sql`true`;
+	const s = subjectColumns(mapping);
+	const i = identifierColumns(mapping);
+	const c = credentialColumns(mapping);
+	const ac = authorityColumns(mapping);
+	return and(sql`exists(select 1 from ${mapping.subject.table} where ${s.id} = ${sql.param(resolved.nativeSubjectId, s.id)} and ${s.status} = ${sql.param(mapping.subject.d1ActiveStatusValue, s.status)} and ${s.securityRevision} = ${sql.param(snapshot.revision.securityRevision, s.securityRevision)})`, mapping.identifier.d1CurrentCondition({
+		identifier: snapshot.identifier,
+		nativeSubjectId: resolved.nativeSubjectId
+	}), sql`exists(select 1 from ${mapping.identifier.table} where ${i.namespace} = ${sql.param(snapshot.identifier.namespace, i.namespace)} and ${i.value} = ${sql.param(snapshot.identifier.value, i.value)} and ${i.subjectId} = ${sql.param(resolved.nativeSubjectId, i.subjectId)} and ${i.bindingRevision} = ${sql.param(snapshot.identifierBindingRevision, i.bindingRevision)})`, sql`exists(select 1 from ${mapping.credential.table} where ${c.moduleId} = ${sql.param(moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(resolved.nativeSubjectId, c.subjectId)} and ${c.credentialId} = ${sql.param(snapshot.credentialId, c.credentialId)} and ${c.credentialRevision} = ${sql.param(snapshot.credentialRevision, c.credentialRevision)} and ${c.verifierVersion} = ${sql.param(snapshot.verifierVersion, c.verifierVersion)} and ${c.verifier} = ${sql.param(Redacted.value(snapshot.verifier), c.verifier)} and ${c.normalization} = ${sql.param(snapshot.normalization, c.normalization)})`, ...snapshot.revision.credentials.map((item) => sql`exists(select 1 from ${mapping.authorityCredential.table} where ${ac.subjectId} = ${sql.param(resolved.nativeSubjectId, ac.subjectId)} and ${ac.credentialId} = ${sql.param(item.credentialId, ac.credentialId)} and ${ac.revision} = ${sql.param(item.revision, ac.revision)}${ac.status === void 0 ? sql`` : sql` and ${ac.status} = ${sql.param(mapping.authorityCredential.d1ActiveStatusValue, ac.status)}`})`));
+};
+const mutationStatements = Effect.fn(function* (mapping, input, nativeSubjectId, revisions, now) {
+	const database = yield* CurrentD1PlanningDatabase;
+	const c = credentialColumns(mapping);
+	const s = subjectColumns(mapping);
+	const ac = authorityColumns(mapping);
+	return [
+		yield* statement(database.update(mapping.credential.table).set(mapping.credential.encodeReplacement({
+			replacement: input.replacement,
+			credentialRevision: revisions.credentialRevision,
+			verifierVersion: revisions.verifierVersion
+		})).where(and(eq(c.moduleId, input.moduleId), eq(c.subjectId, nativeSubjectId), eq(c.credentialId, input.credential.credentialId), eq(c.credentialRevision, input.credential.credentialRevision), eq(c.verifierVersion, input.credential.verifierVersion), eq(c.verifier, Redacted.value(input.credential.verifier)), eq(c.normalization, input.credential.normalization)))),
+		yield* statement(database.update(mapping.subject.table).set(updateValues([[mapping.subject.securityRevision, revisions.nextSecurityRevision]])).where(and(eq(s.id, nativeSubjectId), eq(s.securityRevision, input.expectedRevision.securityRevision)))),
+		yield* statement(database.update(mapping.authorityCredential.table).set(mapping.authorityCredential.encodeRevision(revisions.credentialRevision)).where(and(eq(ac.subjectId, nativeSubjectId), eq(ac.credentialId, input.credential.credentialId), eq(ac.revision, input.credential.credentialRevision)))),
+		yield* statement(database.insert(mapping.command.table).values(mapping.command.encodeInsert({
+			moduleId: input.moduleId,
+			commandId: input.commandId,
+			action: input.authorization.challenge.action,
+			bindingDigest: input.authorization.challenge.bindingDigest,
+			decision: "changed",
+			retentionUntilMillis: now + mapping.commandRetentionMillis
+		})))
+	];
+});
+const replacementApplied = (mapping, input, nativeSubjectId, revisions, now, identifierCondition) => {
+	const c = credentialColumns(mapping);
+	const s = subjectColumns(mapping);
+	const ac = authorityColumns(mapping);
+	const mc = commandColumns(mapping);
+	return and(sql`exists(select 1 from ${mapping.credential.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(nativeSubjectId, c.subjectId)} and ${c.credentialId} = ${sql.param(input.credential.credentialId, c.credentialId)} and ${c.credentialRevision} = ${sql.param(revisions.credentialRevision, c.credentialRevision)} and ${c.verifierVersion} = ${sql.param(revisions.verifierVersion, c.verifierVersion)} and ${c.verifier} = ${sql.param(Redacted.value(input.replacement.verifier), c.verifier)} and ${c.normalization} = ${sql.param(input.replacement.normalization, c.normalization)})`, sql`exists(select 1 from ${mapping.subject.table} where ${s.id} = ${sql.param(nativeSubjectId, s.id)} and ${s.securityRevision} = ${sql.param(revisions.nextSecurityRevision, s.securityRevision)} and ${s.status} = ${sql.param(mapping.subject.d1ActiveStatusValue, s.status)})`, sql`exists(select 1 from ${mapping.authorityCredential.table} where ${ac.subjectId} = ${sql.param(nativeSubjectId, ac.subjectId)} and ${ac.credentialId} = ${sql.param(input.credential.credentialId, ac.credentialId)} and ${ac.revision} = ${sql.param(revisions.credentialRevision, ac.revision)}${ac.status === void 0 ? sql`` : sql` and ${ac.status} = ${sql.param(mapping.authorityCredential.d1ActiveStatusValue, ac.status)}`})`, sql`exists(select 1 from ${mapping.command.table} where ${mc.moduleId} = ${sql.param(input.moduleId, mc.moduleId)} and ${mc.commandId} = ${sql.param(input.commandId, mc.commandId)} and ${mc.bindingDigest} = ${sql.param(input.authorization.challenge.bindingDigest, mc.bindingDigest)} and ${mc.action} = ${sql.param(input.authorization.challenge.action, mc.action)} and ${mc.decision} = ${sql.param("changed", mc.decision)} and ${mc.retentionUntil} = ${sql.param(mapping.encodeInstant(now + mapping.commandRetentionMillis), mc.retentionUntil)})`, identifierCondition, sql`true`);
+};
+const compileAddMutation = Effect.fn("DrizzleD1Password.compileAddMutation")(function* (mapping, input, revisions) {
+	const database = yield* CurrentD1PlanningDatabase;
+	const { credentialId, credentialRevision, verifierVersion, nextSecurityRevision } = revisions;
+	const authority = yield* readAuthority(mapping, input, "add-password");
+	if (authority === void 0) return void 0;
+	const now = yield* readEngineNowMillis(mapping);
+	const c = credentialColumns(mapping);
+	const s = subjectColumns(mapping);
+	const ac = authorityColumns(mapping);
+	const mc = commandColumns(mapping);
+	const marker = `effect-auth-password-guard:add:${input.commandId}`;
+	const absent = sql`not exists(select 1 from ${mapping.credential.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(authority.nativeSubjectId, c.subjectId)})`;
+	const guard = and(authority.condition, absent, commandAbsentCondition(mapping, input.moduleId, input.commandId));
+	const appliedCondition = and(sql`exists(select 1 from ${mapping.credential.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(authority.nativeSubjectId, c.subjectId)} and ${c.credentialId} = ${sql.param(credentialId, c.credentialId)} and ${c.credentialRevision} = ${sql.param(credentialRevision, c.credentialRevision)} and ${c.verifierVersion} = ${sql.param(verifierVersion, c.verifierVersion)} and ${c.verifier} = ${sql.param(Redacted.value(input.replacement.verifier), c.verifier)} and ${c.normalization} = ${sql.param(input.replacement.normalization, c.normalization)})`, sql`exists(select 1 from ${mapping.authorityCredential.table} where ${ac.subjectId} = ${sql.param(authority.nativeSubjectId, ac.subjectId)} and ${ac.credentialId} = ${sql.param(credentialId, ac.credentialId)} and ${ac.revision} = ${sql.param(credentialRevision, ac.revision)}${ac.status === void 0 ? sql`` : sql` and ${ac.status} = ${sql.param(mapping.authorityCredential.d1ActiveStatusValue, ac.status)}`})`, sql`exists(select 1 from ${mapping.subject.table} where ${s.id} = ${sql.param(authority.nativeSubjectId, s.id)} and ${s.securityRevision} = ${sql.param(nextSecurityRevision, s.securityRevision)} and ${s.status} = ${sql.param(mapping.subject.d1ActiveStatusValue, s.status)})`, sql`exists(select 1 from ${mapping.command.table} where ${mc.moduleId} = ${sql.param(input.moduleId, mc.moduleId)} and ${mc.commandId} = ${sql.param(input.commandId, mc.commandId)} and ${mc.bindingDigest} = ${sql.param(input.authorization.challenge.bindingDigest, mc.bindingDigest)} and ${mc.action} = ${sql.param("add-password", mc.action)} and ${mc.decision} = ${sql.param("changed", mc.decision)} and ${mc.retentionUntil} = ${sql.param(mapping.encodeInstant(now + mapping.commandRetentionMillis), mc.retentionUntil)})`);
+	return {
+		statements: [
+			yield* assertion(guard, marker),
+			yield* statement(database.insert(mapping.credential.table).values(mapping.credential.encodeInsert({
+				moduleId: input.moduleId,
+				subjectId: authority.nativeSubjectId,
+				credentialId,
+				credentialRevision,
+				verifierVersion,
+				replacement: input.replacement
+			}))),
+			yield* statement(database.insert(mapping.authorityCredential.table).values(mapping.authorityCredential.encodeInsert({
+				subjectId: authority.nativeSubjectId,
+				credentialId,
+				revision: credentialRevision
+			}))),
+			yield* statement(database.update(mapping.subject.table).set(updateValues([[mapping.subject.securityRevision, nextSecurityRevision]])).where(and(eq(s.id, authority.nativeSubjectId), eq(s.securityRevision, input.expectedRevision.securityRevision)))),
+			yield* statement(database.insert(mapping.command.table).values(mapping.command.encodeInsert({
+				moduleId: input.moduleId,
+				commandId: input.commandId,
+				action: "add-password",
+				bindingDigest: input.authorization.challenge.bindingDigest,
+				decision: "changed",
+				retentionUntilMillis: now + mapping.commandRetentionMillis
+			}))),
+			yield* assertion(appliedCondition, marker)
+		],
+		appliedCondition,
+		retryable: (cause) => isGuardFailure(cause, marker)
+	};
+});
+const makePasswordPlans = (mapping, proofMapping) => {
+	const run = (plan) => Effect.gen(function* () {
+		if (!validConstraints(mapping)) return yield* unavailable();
+		return yield* plan;
+	});
+	return {
+		admitAttempt: (input, prepare) => Effect.gen(function* () {
+			const database = yield* CurrentD1PlanningDatabase;
+			const attemptId = yield* allocate(mapping.allocateAttemptId, mapping.allocateAttemptIdSync);
+			return yield* run(Effect.gen(function* () {
+				const journal = yield* CurrentCommitJournal;
+				const now = yield* readEngineNowMillis(mapping);
+				const resolved = yield* resolveCredential(mapping, input.moduleId, input.identifier, input.subjectId);
+				const keys = mapping.scopeKeys({
+					moduleId: input.moduleId,
+					action: input.action,
+					identifier: input.identifier,
+					...resolved?.snapshot === void 0 ? {} : { subjectId: resolved.snapshot.revision.subjectId }
+				});
+				const scopes = scopeEntries(keys, input.policy);
+				const admitted = yield* readScopeAdmission(mapping, input.moduleId, input.action, scopes, input.policy, input.identifier, resolved?.nativeSubjectId, now);
+				const allAdmitted = admitted.length === scopes.length;
+				const considered = admitted.length === 0 ? scopes.slice(0, 1) : scopes;
+				const receipt = prepare(allAdmitted ? {
+					_tag: "Admitted",
+					attemptId,
+					...resolved?.snapshot === void 0 ? {} : { credential: resolved.snapshot }
+				} : { _tag: "Denied" }, journal);
+				const marker = `effect-auth-password-guard:admit:${attemptId}`;
+				const statements = [];
+				for (const entry of considered) statements.push(yield* statement(database.insert(mapping.rateScope.table).values(mapping.rateScope.encodeInsert({
+					moduleId: input.moduleId,
+					action: input.action,
+					scopeKind: entry.kind,
+					scopeKey: entry.key
+				})).onConflictDoNothing()));
+				const conditions = considered.map((entry) => {
+					const condition = scopeAdmissionCondition(mapping, input.moduleId, input.action, entry, input.policy, input.identifier, resolved?.nativeSubjectId);
+					return admitted.includes(entry) ? condition : sql`not (${condition})`;
+				});
+				statements.push(yield* assertion(and(...conditions, ...allAdmitted ? [admittedSnapshotCondition(mapping, resolved, input.moduleId)] : []), marker));
+				for (const entry of admitted) statements.push(yield* statement(database.insert(mapping.charge.table).values(driverValues(mapping.charge.encodeInsert({
+					moduleId: input.moduleId,
+					action: input.action,
+					scopeKind: entry.kind,
+					scopeKey: entry.key,
+					attemptId,
+					occurredAtMillis: now,
+					retentionUntilMillis: now + entry.windowMillis
+				}), [[mapping.charge.occurredAt, mapping.d1.engineNow], [mapping.charge.retentionUntil, mapping.d1.engineInstantPlus(entry.windowMillis)]]))));
+				if (allAdmitted) {
+					const snapshot = resolved?.snapshot;
+					const record = {
+						moduleId: input.moduleId,
+						action: input.action,
+						attemptId,
+						identifier: input.identifier,
+						...snapshot === void 0 ? {} : {
+							subjectId: snapshot.revision.subjectId,
+							credentialId: snapshot.credentialId,
+							securityRevision: snapshot.revision.securityRevision,
+							credentialRevision: snapshot.credentialRevision,
+							verifierVersion: snapshot.verifierVersion,
+							identifierBindingRevision: snapshot.identifierBindingRevision
+						},
+						admittedAtMillis: now,
+						deadlineMillis: now + input.policy.attemptLifetimeMillis,
+						retentionUntilMillis: Math.max(now + input.policy.attemptLifetimeMillis, ...scopes.map((entry) => now + entry.windowMillis))
+					};
+					statements.push(yield* statement(database.insert(mapping.attempt.table).values(driverValues(mapping.attempt.encodeInsert(record, {
+						...resolved?.nativeSubjectId === void 0 ? {} : { nativeSubjectId: resolved.nativeSubjectId },
+						state: "pending"
+					}), [
+						[mapping.attempt.admittedAt, mapping.d1.engineNow],
+						[mapping.attempt.deadline, mapping.d1.engineInstantPlus(input.policy.attemptLifetimeMillis)],
+						[mapping.attempt.retentionUntil, mapping.d1.engineInstantPlus(Math.max(input.policy.attemptLifetimeMillis, ...scopes.map((entry) => entry.windowMillis)))]
+					]))));
+				}
+				return {
+					receipt,
+					statements,
+					retryable: (cause) => isGuardFailure(cause, marker)
+				};
+			}));
+		}),
+		settleAttempt: (uncaptured, prepare) => Effect.gen(function* () {
+			const database = yield* CurrentD1PlanningDatabase;
+			const captured = uncaptured.captured === void 0 ? void 0 : yield* snapshotPasswordCredential(uncaptured.captured);
+			const input = {
+				...uncaptured,
+				...captured === void 0 ? {} : { captured }
+			};
+			return yield* run(Effect.gen(function* () {
+				const journal = yield* CurrentCommitJournal;
+				const a = attemptColumns(mapping);
+				const row = (yield* database.select().from(mapping.attempt.table).where(and(eq(a.moduleId, input.moduleId), eq(a.attemptId, input.attemptId))).limit(1))[0];
+				const engineNow = yield* readEngineNowMillis(mapping);
+				const deadline = row === void 0 ? void 0 : yield* mapping.decodeInstant(row[mapping.attempt.deadline]);
+				let resolved;
+				let verified = false;
+				if (row !== void 0 && row[mapping.attempt.state] === "pending" && input.outcome === "verified" && input.captured !== void 0 && deadline !== void 0 && deadline > engineNow) {
+					resolved = yield* resolveCredential(mapping, input.moduleId, input.captured.identifier, input.captured.revision.subjectId);
+					verified = input.captured.moduleId === input.moduleId && resolved?.snapshot !== void 0 && sameSnapshot(resolved.snapshot, input.captured) && mapping.subjectId.equals(row[mapping.attempt.subjectId], resolved.nativeSubjectId) && row[mapping.attempt.identifierNamespace] === input.captured.identifier.namespace && row[mapping.attempt.identifierValue] === input.captured.identifier.value && row[mapping.attempt.credentialId] === input.captured.credentialId && row[mapping.attempt.securityRevision] === input.captured.revision.securityRevision && row[mapping.attempt.credentialRevision] === input.captured.credentialRevision && row[mapping.attempt.verifierVersion] === input.captured.verifierVersion && row[mapping.attempt.identifierBindingRevision] === input.captured.identifierBindingRevision;
+				}
+				const decision = verified ? "verified" : "rejected";
+				const receipt = prepare(decision, journal);
+				if (row === void 0 || row[mapping.attempt.state] !== "pending") return {
+					receipt,
+					statements: []
+				};
+				const marker = `effect-auth-password-guard:settle:${input.attemptId}`;
+				const base = and(eq(a.moduleId, input.moduleId), eq(a.attemptId, input.attemptId), eq(a.state, "pending"));
+				const condition = verified ? and(base, sql`${a.deadline} > ${mapping.d1.engineNow}`) : base;
+				const statements = [yield* assertion(sql`exists(select 1 from ${mapping.attempt.table} where ${condition})`, marker), yield* statement(database.update(mapping.attempt.table).set(updateValues([[mapping.attempt.state, decision]])).where(condition))];
+				if (verified && resolved?.snapshot !== void 0) {
+					const captured = input.captured;
+					const s = subjectColumns(mapping);
+					const i = identifierColumns(mapping);
+					const c = credentialColumns(mapping);
+					const authority = and(sql`exists(select 1 from ${mapping.subject.table} where ${s.id} = ${sql.param(resolved.nativeSubjectId, s.id)} and ${s.status} = ${sql.param(mapping.subject.d1ActiveStatusValue, s.status)} and ${s.securityRevision} = ${sql.param(input.captured.revision.securityRevision, s.securityRevision)})`, mapping.identifier.d1CurrentCondition({
+						identifier: input.captured.identifier,
+						nativeSubjectId: resolved.nativeSubjectId
+					}), sql`exists(select 1 from ${mapping.credential.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(resolved.nativeSubjectId, c.subjectId)} and ${c.credentialId} = ${sql.param(input.captured.credentialId, c.credentialId)} and ${c.credentialRevision} = ${sql.param(input.captured.credentialRevision, c.credentialRevision)} and ${c.verifierVersion} = ${sql.param(input.captured.verifierVersion, c.verifierVersion)} and ${c.verifier} = ${sql.param(Redacted.value(input.captured.verifier), c.verifier)})`, sql`exists(select 1 from ${mapping.identifier.table} where ${i.namespace} = ${sql.param(input.captured.identifier.namespace, i.namespace)} and ${i.value} = ${sql.param(input.captured.identifier.value, i.value)} and ${i.subjectId} = ${sql.param(resolved.nativeSubjectId, i.subjectId)} and ${i.bindingRevision} = ${sql.param(input.captured.identifierBindingRevision, i.bindingRevision)})`);
+					statements.splice(1, 0, yield* assertion(authority, marker));
+					if (input.rehash !== void 0 && input.rehash.expectedVersion === captured.verifierVersion && Redacted.value(input.rehash.expectedVerifier) === Redacted.value(captured.verifier)) {
+						const nextVersion = yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync);
+						statements.push(yield* statement(database.update(mapping.credential.table).set(mapping.credential.encodeVerifier(input.rehash.nextVerifier, nextVersion)).where(and(eq(c.moduleId, input.moduleId), eq(c.subjectId, resolved.nativeSubjectId), eq(c.credentialId, captured.credentialId), eq(c.credentialRevision, captured.credentialRevision), eq(c.verifierVersion, input.rehash.expectedVersion), eq(c.verifier, Redacted.value(input.rehash.expectedVerifier))))));
+					}
+				}
+				return {
+					receipt,
+					statements,
+					retryable: (cause) => isGuardFailure(cause, marker)
+				};
+			}));
+		}),
+		readForSubject: (input) => Effect.gen(function* () {
+			const database = yield* CurrentD1PlanningDatabase;
+			if (yield* hasCommitScope) return yield* unavailable();
+			const nativeSubjectId = yield* mapping.subjectId.toNative(input.subjectId);
+			const subject = (yield* readSubjectNative(mapping, nativeSubjectId))[0];
+			if (subject === void 0 || !mapping.subject.isActiveStatus(subject[mapping.subject.status])) return Option.none();
+			const credential = (yield* readCredentialNative(mapping, input.moduleId, nativeSubjectId))[0];
+			if (credential === void 0) return Option.none();
+			const ic = identifierColumns(mapping);
+			const identifier = (yield* database.select().from(mapping.identifier.table).where(eq(ic.subjectId, nativeSubjectId))).find((row) => mapping.identifier.isCurrent(row));
+			if (identifier === void 0) return Option.none();
+			return Option.some(yield* mapping.credential.decode({
+				moduleId: input.moduleId,
+				subject,
+				identifier,
+				credential
+			}).pipe(Effect.flatMap(snapshotPasswordCredential)));
+		}),
+		recoveryTarget: (input) => Effect.gen(function* () {
+			if (yield* hasCommitScope) return yield* unavailable();
+			const resolved = yield* resolveCredential(mapping, input.moduleId, input.identifier);
+			return resolved?.snapshot === void 0 || resolved.snapshot.identifierVerifiedAtMillis === void 0 ? Option.none() : Option.some(resolved.snapshot);
+		}),
+		addIfAbsent: (uncaptured, prepare) => Effect.gen(function* () {
+			const input = yield* snapshotMutationInput(uncaptured);
+			const credentialId = yield* allocate(mapping.allocateCredentialId, mapping.allocateCredentialIdSync);
+			const credentialRevision = yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync);
+			const verifierVersion = yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync);
+			const nextSecurityRevision = yield* allocateNextSecurityRevision(mapping, input.expectedRevision.securityRevision);
+			if (nextSecurityRevision === input.expectedRevision.securityRevision) return yield* unavailable();
+			return yield* run(Effect.gen(function* () {
+				const journal = yield* CurrentCommitJournal;
+				const compiled = yield* compileAddMutation(mapping, input, {
+					credentialId,
+					credentialRevision,
+					verifierVersion,
+					nextSecurityRevision
+				});
+				return {
+					receipt: prepare(compiled === void 0 ? "rejected" : "changed", journal),
+					statements: compiled?.statements ?? [],
+					retryable: compiled?.retryable
+				};
+			}));
+		}),
+		replaceIfCurrent: (uncaptured, prepare) => Effect.flatMap(snapshotMutationInput(uncaptured), (input) => replacementPlan(mapping, proofMapping, input, prepare, "change-password")),
+		checkReset: (input) => proofMapping === void 0 ? Effect.fail(unavailable()) : Effect.gen(function* () {
+			if (yield* hasCommitScope) return yield* unavailable();
+			if (input.moduleId.length <= 6 || !input.moduleId.endsWith("/reset") || input.purpose !== "password-reset" || input.binding._tag !== "Subject") return false;
+			const binding = input.binding;
+			const resolved = yield* resolveCredential(mapping, input.moduleId.slice(0, -6), binding.identifier, binding.revision.subjectId);
+			return resolved?.snapshot !== void 0 && resolved.snapshot.revision.securityRevision === binding.revision.securityRevision && binding.revision.credentials.every((item) => resolved.snapshot.revision.credentials.some((current) => current.credentialId === item.credentialId && current.revision === item.revision)) ? yield* probeProofCompletion(proofMapping, input) : false;
+		}),
+		resetWithProof: (uncaptured, prepare) => proofMapping === void 0 ? Effect.fail(unavailable()) : Effect.flatMap(snapshotMutationInput(uncaptured), (captured) => replacementPlan(mapping, proofMapping, Object.freeze({
+			...captured,
+			completion: uncaptured.completion
+		}), prepare, "reset-password")),
+		cleanupAttempts: (input, prepare) => run(Effect.gen(function* () {
+			return yield* cleanupPlan(mapping, input, prepare);
+		}))
+	};
+};
+const compileReplacementMutation = Effect.fn("DrizzleD1Password.compileReplacementMutation")(function* (mapping, input, action, revisions) {
+	const { credentialRevision, verifierVersion, nextSecurityRevision } = revisions;
+	const authority = yield* readAuthority(mapping, input, action);
+	const current = authority === void 0 || input.credential === void 0 ? void 0 : (yield* readCredentialNative(mapping, input.moduleId, authority.nativeSubjectId))[0];
+	const currentMatches = current !== void 0 && current[mapping.credential.credentialId] === input.credential.credentialId && current[mapping.credential.credentialRevision] === input.credential.credentialRevision && current[mapping.credential.verifierVersion] === input.credential.verifierVersion && current[mapping.credential.verifier] === Redacted.value(input.credential.verifier) && current[mapping.credential.normalization] === input.credential.normalization;
+	if (authority === void 0 || !currentMatches) return void 0;
+	const now = yield* readEngineNowMillis(mapping);
+	const guard = and(authority.condition, credentialCurrentCondition(mapping, input, authority.nativeSubjectId), commandAbsentCondition(mapping, input.moduleId, input.commandId));
+	const marker = `effect-auth-password-guard:${action}:${input.commandId}`;
+	return {
+		protectedMutation: {
+			statements: [yield* assertion(guard, marker), ...yield* mutationStatements(mapping, input, authority.nativeSubjectId, {
+				credentialRevision,
+				verifierVersion,
+				nextSecurityRevision
+			}, now)],
+			appliedCondition: replacementApplied(mapping, input, authority.nativeSubjectId, {
+				credentialRevision,
+				verifierVersion,
+				nextSecurityRevision
+			}, now, authority.identifierCondition)
+		},
+		marker
+	};
+});
+const replacementPlan = Effect.fn("Drizzle.replacementPlan")(function* (mapping, proofMapping, input, prepare, action) {
+	const credentialRevision = yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync);
+	const verifierVersion = yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync);
+	const nextSecurityRevision = yield* allocateNextSecurityRevision(mapping, input.expectedRevision.securityRevision);
+	if (nextSecurityRevision === input.expectedRevision.securityRevision || input.credential !== void 0 && credentialRevision === input.credential.credentialRevision) return yield* unavailable();
+	const journal = yield* CurrentCommitJournal;
+	const compiledMutation = yield* compileReplacementMutation(mapping, input, action, {
+		credentialRevision,
+		verifierVersion,
+		nextSecurityRevision
+	});
+	if (compiledMutation === void 0) return {
+		receipt: prepare("rejected", journal),
+		statements: []
+	};
+	const { protectedMutation, marker } = compiledMutation;
+	if (action === "reset-password") {
+		if (proofMapping === void 0 || input.completion === void 0 || !completionMatchesPassword(input)) return {
+			receipt: prepare("rejected", journal),
+			statements: []
+		};
+		let passwordReceipt;
+		const compiled = yield* compileD1ProofCompletionPlan(proofMapping, input.completion, protectedMutation, (decision) => {
+			passwordReceipt = prepare(decision === "completed" ? "changed" : "rejected", journal);
+			return decision;
+		});
+		return {
+			receipt: passwordReceipt ?? prepare("rejected", journal),
+			statements: compiled.statements,
+			retryable: (cause) => isGuardFailure(cause, marker) || isGuardFailure(cause, `effect-auth-proof-guard:complete:${input.completion.input.continuationId}`) || isGuardFailure(cause, `effect-auth-proof-guard:protected:${input.completion.input.continuationId}`)
+		};
+	}
+	return {
+		receipt: prepare("changed", journal),
+		statements: [...protectedMutation.statements, yield* assertion(protectedMutation.appliedCondition, marker)],
+		retryable: (cause) => isGuardFailure(cause, marker)
+	};
+});
+const cleanupPlan = Effect.fn("Drizzle.cleanupPlan")(function* (mapping, input, prepare) {
+	const database = yield* CurrentD1PlanningDatabase;
+	const journal = yield* CurrentCommitJournal;
+	const now = yield* readEngineNowMillis(mapping);
+	const nativeNow = mapping.encodeInstant(now);
+	const a = attemptColumns(mapping);
+	const c = chargeColumns(mapping);
+	const sc = scopeColumns(mapping);
+	let remaining = input.limit;
+	let hasMore = false;
+	const attempts = yield* database.select({ attemptId: a.attemptId }).from(mapping.attempt.table).where(and(eq(a.moduleId, input.moduleId), lte(a.retentionUntil, nativeNow))).limit(remaining + 1);
+	if (attempts.length > remaining) hasMore = true;
+	const selectedAttempts = attempts.slice(0, remaining);
+	remaining -= selectedAttempts.length;
+	const charges = yield* database.select({
+		action: c.action,
+		scopeKind: c.scopeKind,
+		scopeKey: c.scopeKey,
+		attemptId: c.attemptId
+	}).from(mapping.charge.table).where(and(eq(c.moduleId, input.moduleId), lte(c.retentionUntil, nativeNow))).limit(remaining + 1);
+	if (charges.length > remaining) hasMore = true;
+	const selectedCharges = charges.slice(0, remaining);
+	remaining -= selectedCharges.length;
+	const scopes = yield* database.select({
+		action: sc.action,
+		scopeKind: sc.scopeKind,
+		scopeKey: sc.scopeKey
+	}).from(mapping.rateScope.table).where(and(eq(sc.moduleId, input.moduleId), notExists(database.select({ one: sql`1` }).from(mapping.charge.table).where(and(eq(c.moduleId, sc.moduleId), eq(c.action, sc.action), eq(c.scopeKind, sc.scopeKind), eq(c.scopeKey, sc.scopeKey)))))).limit(remaining + 1);
+	if (scopes.length > remaining) hasMore = true;
+	const selectedScopes = scopes.slice(0, remaining);
+	const marker = `effect-auth-password-guard:cleanup:${input.moduleId}:${now}`;
+	const statements = [];
+	for (const row of selectedAttempts) {
+		const condition = and(eq(a.moduleId, input.moduleId), eq(a.attemptId, row.attemptId), lte(a.retentionUntil, mapping.d1.engineNow));
+		statements.push(yield* assertion(sql`exists(select 1 from ${mapping.attempt.table} where ${condition})`, marker), yield* statement(database.delete(mapping.attempt.table).where(condition)));
+	}
+	for (const row of selectedCharges) {
+		const condition = and(eq(c.moduleId, input.moduleId), eq(c.action, row.action), eq(c.scopeKind, row.scopeKind), eq(c.scopeKey, row.scopeKey), eq(c.attemptId, row.attemptId), lte(c.retentionUntil, mapping.d1.engineNow));
+		statements.push(yield* assertion(sql`exists(select 1 from ${mapping.charge.table} where ${condition})`, marker), yield* statement(database.delete(mapping.charge.table).where(condition)));
+	}
+	for (const row of selectedScopes) {
+		const condition = and(eq(sc.moduleId, input.moduleId), eq(sc.action, row.action), eq(sc.scopeKind, row.scopeKind), eq(sc.scopeKey, row.scopeKey), notExists(database.select({ one: sql`1` }).from(mapping.charge.table).where(and(eq(c.moduleId, sc.moduleId), eq(c.action, sc.action), eq(c.scopeKind, sc.scopeKind), eq(c.scopeKey, sc.scopeKey)))));
+		statements.push(yield* assertion(sql`exists(select 1 from ${mapping.rateScope.table} where ${condition})`, marker), yield* statement(database.delete(mapping.rateScope.table).where(condition)));
+	}
+	return {
+		receipt: prepare({
+			removed: selectedAttempts.length + selectedCharges.length + selectedScopes.length,
+			hasMore
+		}, journal),
+		statements,
+		retryable: (cause) => isGuardFailure(cause, marker)
+	};
+});
+const makeD1PasswordPersistenceServices = (database, mapping, proofMapping) => Effect.gen(function* () {
+	const hooks = yield* LifecycleHooks;
+	const plans = makePasswordPlans(mapping, proofMapping);
+	const run = (plan) => Effect.gen(function* () {
+		if (yield* hasCommitScope) return yield* unavailable();
+		return yield* executeStandalone(plan, 2);
+	}).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks));
+	return { passwordPersistence: {
+		admitAttempt: (input, prepare) => run(plans.admitAttempt(input, prepare)).pipe(translateFailure),
+		settleAttempt: (input, prepare) => run(plans.settleAttempt(input, prepare)).pipe(translateFailure),
+		readForSubject: (input) => plans.readForSubject(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
+		recoveryTarget: (input) => plans.recoveryTarget(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
+		addIfAbsent: (input, prepare) => run(plans.addIfAbsent(input, prepare)).pipe(translateFailure),
+		replaceIfCurrent: (input, prepare) => run(plans.replaceIfCurrent(input, prepare)).pipe(translateFailure),
+		checkReset: (input) => plans.checkReset(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
+		resetWithProof: (input, prepare) => run(plans.resetWithProof(input, prepare)).pipe(translateFailure),
+		cleanupAttempts: (input, prepare) => run(plans.cleanupAttempts(input, prepare)).pipe(translateFailure)
+	} };
+});
+/**
+* Owns one password transition plus application statements in one D1 batch.
+* The owner Effect is invoked once and is never replayed after an ambiguous or
+* guarded batch failure. Standalone adapter-owned commands may replan boundedly.
+*/
+function coordinateD1PasswordPersistence(acquire, options, body) {
+	return Effect.flatMap(acquire, (database) => Effect.gen(function* () {
+		const hooks = yield* LifecycleHooks;
+		if (yield* hasCommitScope) return yield* unavailable();
+		return (yield* coordinateCommit(() => Effect.gen(function* () {
+			const statements = [];
+			let mutation;
+			const nativeCollector = D1BatchStatements.of({ append: (statement) => Effect.sync(() => statements.push(statement)) });
+			const owner = yield* makeD1Owner(unavailable()).pipe(Effect.provideService(D1BatchStatements, nativeCollector));
+			const plans = makePasswordPlans(options.mapping, options.proofMapping);
+			const run = (plan) => coordinateCommit(() => Effect.gen(function* () {
+				const journal = yield* CurrentCommitJournal;
+				const planned = yield* plan;
+				yield* owner.check;
+				if (mutation !== void 0) return yield* unavailable();
+				const guarded = {
+					...planned,
+					journalGuard: journal.prepare(void 0)
+				};
+				mutation = guarded;
+				statements.push(...guarded.statements);
+				return guarded.receipt;
+			}), { mode: "batch" }).pipe(Effect.map((result) => result.value), Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks));
+			const provided = Context.make(PasswordPersistence, {
+				admitAttempt: (input, prepare) => owner.run(run(plans.admitAttempt(input, prepare)).pipe(translateFailure)),
+				settleAttempt: (input, prepare) => owner.run(run(plans.settleAttempt(input, prepare)).pipe(translateFailure)),
+				readForSubject: (input) => owner.run(plans.readForSubject(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks), translateFailure)),
+				recoveryTarget: (input) => owner.run(plans.recoveryTarget(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks), translateFailure)),
+				addIfAbsent: (input, prepare) => owner.run(run(plans.addIfAbsent(input, prepare)).pipe(translateFailure)),
+				replaceIfCurrent: (input, prepare) => owner.run(run(plans.replaceIfCurrent(input, prepare)).pipe(translateFailure)),
+				checkReset: (input) => owner.run(plans.checkReset(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks), translateFailure)),
+				resetWithProof: (input, prepare) => owner.run(run(plans.resetWithProof(input, prepare)).pipe(translateFailure)),
+				cleanupAttempts: (input, prepare) => owner.run(run(plans.cleanupAttempts(input, prepare)).pipe(translateFailure))
+			}).pipe(Context.add(D1BatchStatements, owner.collector));
+			const value = yield* owner.close(Effect.provideContext(body, provided));
+			if (mutation?.journalGuard !== void 0) {
+				const status = yield* Effect.result(mutation.journalGuard.read);
+				if (status._tag === "Success" || status.failure._tag !== "CommitPending") return yield* unavailable();
+			}
+			yield* database.$client.batch(statements).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, (error) => everyFailureMatches(cause, mutation?.retryable) ? unavailable() : error))), translateFailure);
+			return value;
+		}), { mode: "batch" }).pipe(Effect.provideService(LifecycleHooks, hooks))).value;
+	}));
+}
+const registrationRows = Effect.fn("Drizzle.registrationRows")(function* (mapping, moduleId, requestId) {
+	const database = yield* CurrentD1PlanningDatabase;
+	const module = column(mapping.registration.table, mapping.registration.moduleId);
+	const request = column(mapping.registration.table, mapping.registration.requestId);
+	return yield* database.select().from(mapping.registration.table).where(and(eq(module, moduleId), eq(request, requestId))).limit(1);
+});
+const registrationIdentifierRows = Effect.fn("Drizzle.registrationIdentifierRows")(function* (mapping, identifier) {
+	const database = yield* CurrentD1PlanningDatabase;
+	const namespace = column(mapping.identifier.table, mapping.identifier.namespace);
+	const value = column(mapping.identifier.table, mapping.identifier.value);
+	return yield* database.select().from(mapping.identifier.table).where(and(eq(namespace, identifier.namespace), eq(value, identifier.value))).limit(1);
+});
+const planRegistration = Effect.fn("Drizzle.planRegistration")(function* (mapping, input, allocated, prepare) {
+	const database = yield* CurrentD1PlanningDatabase;
+	const journal = yield* CurrentCommitJournal;
+	const existing = (yield* registrationRows(mapping, input.moduleId, input.requestId))[0];
+	if (existing !== void 0) return {
+		receipt: prepare(yield* mapping.registration.decodeReplay(existing), journal),
+		statements: []
+	};
+	const intent = {
+		moduleId: input.moduleId,
+		requestId: input.requestId,
+		identifier: input.identifier,
+		registration: input.registration,
+		replacement: input.replacement
+	};
+	if (mapping.mode === "pending") {
+		if (allocated.recoveryReference === void 0) return yield* unavailable();
+		return {
+			receipt: prepare({
+				_tag: "Pending",
+				reference: allocated.recoveryReference
+			}, journal),
+			statements: [yield* statement(database.insert(mapping.registration.table).values(mapping.registration.encodeInsert(intent, {
+				state: "pending",
+				recoveryReference: allocated.recoveryReference
+			})))],
+			retryable: (cause) => isMappedConstraintConflict(mapping.isRequestConflict, cause)
+		};
+	}
+	if (mapping.provisioning.idMode === "generated" || allocated.nativeSubjectId === void 0) return yield* unavailable();
+	if ((yield* registrationIdentifierRows(mapping, input.identifier)).length > 0) return {
+		receipt: prepare({ _tag: "Suppressed" }, journal),
+		statements: []
+	};
+	const nativeSubjectId = allocated.nativeSubjectId;
+	return {
+		receipt: prepare({
+			_tag: "Created",
+			subjectId: yield* mapping.subjectId.toSubject(nativeSubjectId)
+		}, journal),
+		statements: [
+			yield* statement(database.insert(mapping.subject.table).values(mapping.provisioning.encodeSubjectInsert(intent, {
+				nativeSubjectId,
+				securityRevision: allocated.securityRevision
+			}))),
+			yield* statement(database.insert(mapping.identifier.table).values(mapping.identifier.encodeInitialInsert(input.identifier, nativeSubjectId, allocated.identifierRevision))),
+			yield* statement(database.insert(mapping.credential.table).values(mapping.credential.encodeInsert({
+				moduleId: input.moduleId,
+				subjectId: nativeSubjectId,
+				credentialId: allocated.credentialId,
+				credentialRevision: allocated.credentialRevision,
+				verifierVersion: allocated.verifierVersion,
+				replacement: input.replacement
+			}))),
+			yield* statement(database.insert(mapping.authorityCredential.table).values(mapping.authorityCredential.encodeInsert({
+				subjectId: nativeSubjectId,
+				credentialId: allocated.credentialId,
+				revision: allocated.credentialRevision
+			}))),
+			yield* statement(database.insert(mapping.registration.table).values(mapping.registration.encodeInsert(intent, {
+				state: "created",
+				nativeSubjectId
+			})))
+		],
+		retryable: (cause) => isMappedConstraintConflict(mapping.isRequestConflict, cause) || isMappedConstraintConflict(mapping.isIdentifierConflict, cause)
+	};
+});
+const allocateRegistration = (mapping) => Effect.gen(function* () {
+	const credentialId = yield* allocate(mapping.allocateCredentialId, mapping.allocateCredentialIdSync);
+	const securityRevision = yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync);
+	const identifierRevision = yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync);
+	const credentialRevision = yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync);
+	const verifierVersion = yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync);
+	const nativeSubjectId = mapping.mode !== "atomic" || mapping.provisioning.idMode === "generated" ? void 0 : yield* allocate(mapping.provisioning.allocateSubjectId, mapping.provisioning.allocateSubjectIdSync);
+	const recoveryReference = mapping.mode === "pending" ? yield* allocate(mapping.allocateRecoveryReference, mapping.allocateRecoveryReferenceSync) : void 0;
+	return {
+		credentialId,
+		securityRevision,
+		identifierRevision,
+		credentialRevision,
+		verifierVersion,
+		...nativeSubjectId === void 0 ? {} : { nativeSubjectId },
+		...recoveryReference === void 0 ? {} : { recoveryReference }
+	};
+});
+const makeRegistrationPlans = (mapping) => ({ register: (input, prepare) => Effect.gen(function* () {
+	if (!validRegistrationConstraints(mapping)) return yield* unavailable();
+	if (mapping.mode === "atomic" && mapping.provisioning.idMode === "generated") return yield* unavailable();
+	const allocated = yield* allocateRegistration(mapping);
+	return yield* planRegistration(mapping, input, allocated, prepare);
+}) });
+const makeD1PasswordRegistrationServices = (database, mapping) => Effect.gen(function* () {
+	const hooks = yield* LifecycleHooks;
+	const plans = makeRegistrationPlans(mapping);
+	const run = (plan) => Effect.gen(function* () {
+		if (yield* hasCommitScope) return yield* unavailable();
+		return yield* executeStandalone(plan, 2);
+	}).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks));
+	return { registrationAuthority: { register: (input, prepare) => run(plans.register(input, prepare)).pipe(translateFailure) } };
+});
+function coordinateD1PasswordRegistration(acquire, options, body) {
+	return Effect.flatMap(acquire, (database) => Effect.gen(function* () {
+		const hooks = yield* LifecycleHooks;
+		if (yield* hasCommitScope) return yield* unavailable();
+		return (yield* coordinateCommit(() => Effect.gen(function* () {
+			const statements = [];
+			let mutation;
+			const nativeCollector = D1BatchStatements.of({ append: (statement) => Effect.sync(() => statements.push(statement)) });
+			const owner = yield* makeD1Owner(unavailable()).pipe(Effect.provideService(D1BatchStatements, nativeCollector));
+			const plans = makeRegistrationPlans(options.mapping);
+			const run = (plan) => coordinateCommit(() => Effect.gen(function* () {
+				const journal = yield* CurrentCommitJournal;
+				const planned = yield* plan;
+				yield* owner.check;
+				if (mutation !== void 0) return yield* unavailable();
+				const guarded = {
+					...planned,
+					journalGuard: journal.prepare(void 0)
+				};
+				mutation = guarded;
+				statements.push(...guarded.statements);
+				return guarded.receipt;
+			}), { mode: "batch" }).pipe(Effect.map((result) => result.value), Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks));
+			const provided = Context.make(options.target, { register: (input, prepare) => owner.run(run(plans.register(input, prepare)).pipe(translateFailure)) }).pipe(Context.add(D1BatchStatements, owner.collector));
+			const value = yield* owner.close(Effect.provideContext(body, provided));
+			if (mutation?.journalGuard !== void 0) {
+				const status = yield* Effect.result(mutation.journalGuard.read);
+				if (status._tag === "Success" || status.failure._tag !== "CommitPending") return yield* unavailable();
+			}
+			yield* database.$client.batch(statements).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, (error) => everyFailureMatches(cause, mutation?.retryable) ? unavailable() : error))), translateFailure);
+			return value;
+		}), { mode: "batch" }).pipe(Effect.provideService(LifecycleHooks, hooks))).value;
+	}));
+}
+/** Private prepared compiler seam: it never replays a caller or prepared callback. */
+const passwordD1Kernel = {
+	statement,
+	assertion,
+	readEngineNowMillis,
+	allocate,
+	allocateNextSecurityRevision,
+	subjectColumns,
+	identifierColumns,
+	credentialColumns,
+	authorityColumns,
+	readAuthority,
+	assuranceCondition,
+	credentialCurrentCondition,
+	commandAbsentCondition,
+	compileAddMutation,
+	compileReplacementMutation,
+	completionMatchesPassword,
+	isGuardFailure
+};
+const translateFailure = (effect) => reportPersistenceFailure(effect, (error) => Schema.is(PasswordUnavailable)(error) || Schema.is(ProofUnavailable)(error) || Schema.is(HookConfigurationError)(error)).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));
+const executeStandalone = (plan, retries = 2) => Effect.suspend(() => {
+	let retryable;
+	return coordinateCommit(() => Effect.gen(function* () {
+		const database = yield* CurrentD1PlanningDatabase;
+		const planned = yield* plan;
+		retryable = planned.retryable;
+		yield* database.$client.batch(planned.statements);
+		return planned.receipt;
+	}), { mode: "batch" }).pipe(Effect.map((result) => result.value)).pipe(Effect.catchCause((cause) => retries > 0 && everyFailureMatches(cause, retryable) ? executeStandalone(plan, retries - 1) : Effect.failCause(cause)));
+});
+//#endregion
+export { coordinateD1PasswordPersistence, coordinateD1PasswordRegistration, makeD1PasswordPersistenceServices, makeD1PasswordRegistrationServices, passwordD1Kernel };
+
+//# sourceMappingURL=d1-passwords.mjs.map