@yielded/auth-persistence 0.1.0-beta.7

package/dist/internal/email-kernel.mjs

@@ -0,0 +1,487 @@
+import { PersistenceMappingError, isMappedConstraintConflict } from "./mapping-error.mjs";
+import { requiredEmailAddressConstraints, requiredEmailSignInConstraints } from "../drizzle/email-model.mjs";
+import { CurrentProofSql } from "./proof-kernel.mjs";
+import { Cause, Context, DateTime, Effect, Option, Schema } from "effect";
+import { reportPersistenceFailure } from "@yielded/auth/Persistence";
+import { CurrentCommitJournal, HookConfigurationError, LifecycleHooks, coordinateCommit, hasCommitScope } from "@yielded/auth/Hooks";
+import { assessAuthentication, snapshotAuthenticationEvidence } from "@yielded/auth/Sessions";
+import { EmailAddressPersistence, EmailSignInTargets, EmailUnavailable, snapshotEmailCredential, snapshotEmailRequirement, snapshotEmailRevision } from "@yielded/auth/Email";
+import { ProofUnavailable } from "@yielded/auth/Proofs";
+//#region src/internal/email-kernel.ts
+var CurrentEmailSql = class extends Context.Service()("effect-auth/CurrentEmailSql") {};
+const makeEmailKernel = (operations, proofs) => {
+	const { and, eq, inArray, lte, column, updateValues } = operations;
+	const { completeProofPlanIn } = proofs;
+	const unavailable = () => EmailUnavailable.make({});
+	const translateFailure = (effect) => reportPersistenceFailure(effect, (error) => Schema.is(EmailUnavailable)(error) || Schema.is(ProofUnavailable)(error) || Schema.is(HookConfigurationError)(error)).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));
+	const nowMillis = Effect.map(DateTime.now, DateTime.toEpochMillis);
+	const selectRows = (query, locking) => locking && typeof query.for === "function" ? query.for("update") : query;
+	const sameIdentifier = (left, right) => left.namespace === right.namespace && left.value === right.value;
+	const validEmailSignInConstraints = (mapping) => Object.entries(requiredEmailSignInConstraints).every(([key, value]) => mapping.constraints[key] === value);
+	const validAddressConstraints = (mapping) => Object.entries(requiredEmailAddressConstraints).every(([key, value]) => mapping.constraints[key] === value);
+	const subjectColumns = (mapping) => ({
+		id: column(mapping.subject.table, mapping.subject.id),
+		status: column(mapping.subject.table, mapping.subject.status),
+		securityRevision: column(mapping.subject.table, mapping.subject.securityRevision)
+	});
+	const identifierColumns = (mapping) => ({
+		namespace: column(mapping.identifier.table, mapping.identifier.namespace),
+		value: column(mapping.identifier.table, mapping.identifier.value),
+		subjectId: column(mapping.identifier.table, mapping.identifier.subjectId),
+		verifiedAt: column(mapping.identifier.table, mapping.identifier.verifiedAt),
+		bindingRevision: column(mapping.identifier.table, mapping.identifier.bindingRevision)
+	});
+	const credentialColumns = (mapping) => ({
+		moduleId: column(mapping.credential.table, mapping.credential.moduleId),
+		subjectId: column(mapping.credential.table, mapping.credential.subjectId),
+		credentialId: column(mapping.credential.table, mapping.credential.credentialId),
+		identifierNamespace: column(mapping.credential.table, mapping.credential.identifierNamespace),
+		identifierValue: column(mapping.credential.table, mapping.credential.identifierValue),
+		credentialRevision: column(mapping.credential.table, mapping.credential.credentialRevision),
+		status: column(mapping.credential.table, mapping.credential.status)
+	});
+	const authorityColumns = (mapping) => ({
+		subjectId: column(mapping.authorityCredential.table, mapping.authorityCredential.subjectId),
+		credentialId: column(mapping.authorityCredential.table, mapping.authorityCredential.credentialId),
+		revision: column(mapping.authorityCredential.table, mapping.authorityCredential.revision),
+		status: column(mapping.authorityCredential.table, mapping.authorityCredential.status)
+	});
+	const commandColumns = (mapping) => ({
+		moduleId: column(mapping.command.table, mapping.command.moduleId),
+		commandId: column(mapping.command.table, mapping.command.commandId),
+		action: column(mapping.command.table, mapping.command.action),
+		bindingDigest: column(mapping.command.table, mapping.command.bindingDigest),
+		retentionUntil: column(mapping.command.table, mapping.command.retentionUntil)
+	});
+	const allocate = (mode, asynchronous, synchronous) => {
+		if (mode === "synchronous") return synchronous === void 0 ? Effect.fail(unavailable()) : Effect.try({
+			try: synchronous,
+			catch: (cause) => new PersistenceMappingError({
+				operation: "mapping",
+				cause
+			})
+		});
+		if (asynchronous !== void 0) return asynchronous;
+		return synchronous === void 0 ? Effect.fail(unavailable()) : Effect.try({
+			try: synchronous,
+			catch: (cause) => new PersistenceMappingError({
+				operation: "mapping",
+				cause
+			})
+		});
+	};
+	const nextSecurityRevision = (mapping, mode, current) => {
+		if (mode === "synchronous") return mapping.subject.nextSecurityRevisionSync === void 0 ? Effect.fail(unavailable()) : Effect.try({
+			try: () => mapping.subject.nextSecurityRevisionSync(current),
+			catch: (cause) => new PersistenceMappingError({
+				operation: "mapping",
+				cause
+			})
+		});
+		if (mapping.subject.nextSecurityRevision !== void 0) return mapping.subject.nextSecurityRevision(current);
+		if (mapping.subject.nextSecurityRevisionSync !== void 0) return Effect.try({
+			try: () => mapping.subject.nextSecurityRevisionSync(current),
+			catch: (cause) => new PersistenceMappingError({
+				operation: "mapping",
+				cause
+			})
+		});
+		return Effect.fail(unavailable());
+	};
+	const safeRead = (database, configuration, body) => Effect.gen(function* () {
+		if (configuration.coordinated !== true) {
+			if (yield* hasCommitScope) return yield* unavailable();
+			yield* configuration.standaloneGuard;
+		}
+		return yield* database.transaction((transaction) => body.pipe(Effect.provideService(CurrentEmailSql, transaction), Effect.provideService(CurrentProofSql, transaction)));
+	});
+	const owned = (database, configuration, body) => {
+		const run = coordinateCommit(() => database.transaction((transaction) => body.pipe(Effect.provideService(CurrentEmailSql, transaction), Effect.provideService(CurrentProofSql, transaction))), { mode: configuration.mode }).pipe(Effect.map((result) => result.value));
+		return configuration.coordinated !== true ? Effect.gen(function* () {
+			if (yield* hasCommitScope) return yield* unavailable();
+			yield* configuration.standaloneGuard;
+			return yield* run;
+		}) : run;
+	};
+	const emailLookupQuery = (mapping, moduleId, identifier) => {
+		const subject = subjectColumns(mapping), binding = identifierColumns(mapping), credential = credentialColumns(mapping);
+		return {
+			fields: {
+				subject: mapping.subject.table,
+				identifier: mapping.identifier.table,
+				credential: mapping.credential.table
+			},
+			from: mapping.identifier.table,
+			subjectTable: mapping.subject.table,
+			subjectJoin: eq(subject.id, binding.subjectId),
+			credentialTable: mapping.credential.table,
+			credentialJoin: and(eq(credential.moduleId, moduleId), eq(credential.subjectId, binding.subjectId), eq(credential.identifierNamespace, binding.namespace), eq(credential.identifierValue, binding.value)),
+			predicate: and(eq(binding.namespace, identifier.namespace), eq(binding.value, identifier.value)),
+			limit: 1
+		};
+	};
+	const emailLookupRows = Effect.fn("Drizzle.emailLookupRows")(function* (mapping, moduleId, identifier) {
+		const database = yield* CurrentEmailSql;
+		const query = emailLookupQuery(mapping, moduleId, identifier);
+		return yield* database.select(query.fields).from(query.from).innerJoin(query.subjectTable, query.subjectJoin).innerJoin(query.credentialTable, query.credentialJoin).where(query.predicate).limit(query.limit);
+	});
+	const decodeEmailSnapshot = Effect.fn("DrizzleEmail.decodeSnapshot")(function* (mapping, moduleId, requested, row) {
+		if (!mapping.subject.isActiveStatus(row.subject[mapping.subject.status]) || !mapping.identifier.isCurrent(row.identifier) || !mapping.credential.isActiveStatus(row.credential[mapping.credential.status])) return void 0;
+		const snapshot = yield* mapping.credential.decode({
+			moduleId,
+			subject: row.subject,
+			identifier: row.identifier,
+			credential: row.credential
+		}).pipe(Effect.flatMap(snapshotEmailCredential));
+		const subjectId = yield* mapping.subjectId.toSubject(row.subject[mapping.subject.id]);
+		const verifiedAtMillis = yield* mapping.decodeInstant(row.identifier[mapping.identifier.verifiedAt]);
+		if (snapshot.moduleId !== moduleId || !sameIdentifier(snapshot.identifier, requested) || snapshot.revision.subjectId !== subjectId || snapshot.revision.securityRevision !== row.subject[mapping.subject.securityRevision] || snapshot.identifierRevision !== row.identifier[mapping.identifier.bindingRevision] || snapshot.verifiedAtMillis !== verifiedAtMillis || snapshot.credentialId !== row.credential[mapping.credential.credentialId] || snapshot.credentialRevision !== row.credential[mapping.credential.credentialRevision]) return void 0;
+		return snapshot;
+	});
+	const makeSqlEmailSignInTargets = Effect.fn("makeSqlEmailSignInTargets")(function(database, mapping, configuration) {
+		return Effect.succeed(EmailSignInTargets.of({ lookup: (input) => (validEmailSignInConstraints(mapping) ? safeRead(database, configuration, Effect.gen(function* () {
+			const row = (yield* emailLookupRows(mapping, input.moduleId, input.identifier))[0];
+			if (row === void 0) return Option.none();
+			const snapshot = yield* decodeEmailSnapshot(mapping, input.moduleId, input.identifier, row);
+			return snapshot === void 0 ? Option.none() : Option.some(snapshot);
+		})) : Effect.fail(unavailable())).pipe(Effect.provideService(CurrentEmailSql, database), translateFailure) }));
+	});
+	const readSubject = Effect.fn("DrizzleEmail.readSubject")(function* (mapping, subjectId, locking) {
+		const database = yield* CurrentEmailSql;
+		const nativeSubjectId = yield* mapping.subjectId.toNative(subjectId);
+		const s = subjectColumns(mapping);
+		return {
+			nativeSubjectId,
+			subject: (yield* selectRows(database.select().from(mapping.subject.table).where(eq(s.id, nativeSubjectId)).limit(1), locking))[0]
+		};
+	});
+	const identifierRow = Effect.fn("Drizzle.identifierRow")(function* (mapping, identifier, locking) {
+		const database = yield* CurrentEmailSql;
+		const i = identifierColumns(mapping);
+		return yield* selectRows(database.select().from(mapping.identifier.table).where(and(eq(i.namespace, identifier.namespace), eq(i.value, identifier.value))).limit(1), locking);
+	});
+	const credentialById = Effect.fn("Drizzle.credentialById")(function* (mapping, moduleId, credentialId, locking) {
+		const database = yield* CurrentEmailSql;
+		const c = credentialColumns(mapping);
+		return yield* selectRows(database.select().from(mapping.credential.table).where(and(eq(c.moduleId, moduleId), eq(c.credentialId, credentialId))).limit(1), locking);
+	});
+	const credentialByIdentifier = Effect.fn("Drizzle.credentialByIdentifier")(function* (mapping, moduleId, identifier, locking) {
+		const database = yield* CurrentEmailSql;
+		const c = credentialColumns(mapping);
+		return yield* selectRows(database.select().from(mapping.credential.table).where(and(eq(c.moduleId, moduleId), eq(c.identifierNamespace, identifier.namespace), eq(c.identifierValue, identifier.value))).limit(1), locking);
+	});
+	const currentAddress = Effect.fn("DrizzleEmail.currentAddress")(function* (mapping, input, locking) {
+		const database = yield* CurrentEmailSql;
+		const locked = yield* readSubject(mapping, input.subjectId, locking);
+		if (locked.subject === void 0 || !mapping.subject.isActiveStatus(locked.subject[mapping.subject.status])) return void 0;
+		const discoveredSource = input.sourceCredentialId === void 0 ? void 0 : (yield* credentialById(mapping, input.moduleId, input.sourceCredentialId, false))[0];
+		const sourceIdentifier = discoveredSource === void 0 ? void 0 : {
+			namespace: discoveredSource[mapping.credential.identifierNamespace],
+			value: discoveredSource[mapping.credential.identifierValue]
+		};
+		const identifiers = [input.target, ...sourceIdentifier === void 0 ? [] : [sourceIdentifier]].filter((value, index, values) => values.findIndex((candidate) => sameIdentifier(candidate, value)) === index).sort((left, right) => `${left.namespace}\u0000${left.value}`.localeCompare(`${right.namespace}\u0000${right.value}`));
+		const lockedIdentifiers = /* @__PURE__ */ new Map();
+		for (const identifier of identifiers) {
+			const row = (yield* identifierRow(mapping, identifier, locking))[0];
+			if (row !== void 0) lockedIdentifiers.set(`${identifier.namespace}\u0000${identifier.value}`, row);
+		}
+		const sourceCredential = input.sourceCredentialId === void 0 ? void 0 : (yield* credentialById(mapping, input.moduleId, input.sourceCredentialId, locking))[0];
+		const targetCredential = (yield* credentialByIdentifier(mapping, input.moduleId, input.target, locking))[0];
+		const a = authorityColumns(mapping);
+		const activeAuthority = (yield* selectRows(database.select().from(mapping.authorityCredential.table).where(eq(a.subjectId, locked.nativeSubjectId)).orderBy(a.credentialId), locking)).filter((row) => mapping.authorityCredential.isActiveStatus(row[mapping.authorityCredential.status]));
+		const subjectId = yield* mapping.subjectId.toSubject(locked.nativeSubjectId);
+		const revision = Object.freeze({
+			subjectId,
+			securityRevision: locked.subject[mapping.subject.securityRevision],
+			credentials: Object.freeze(activeAuthority.map((row) => Object.freeze({
+				credentialId: row[mapping.authorityCredential.credentialId],
+				revision: row[mapping.authorityCredential.revision]
+			})))
+		});
+		const targetIdentifier = lockedIdentifiers.get(`${input.target.namespace}\u0000${input.target.value}`);
+		const targetMutable = targetIdentifier !== void 0 && mapping.subjectId.equals(targetIdentifier[mapping.identifier.subjectId], locked.nativeSubjectId) && mapping.identifier.isMutableTarget(targetIdentifier) && (targetCredential === void 0 || !mapping.credential.isActiveStatus(targetCredential[mapping.credential.status]) && mapping.subjectId.equals(targetCredential[mapping.credential.subjectId], locked.nativeSubjectId));
+		let source;
+		if (input.sourceCredentialId !== void 0) {
+			if (sourceCredential === void 0 || sourceIdentifier === void 0 || !mapping.subjectId.equals(sourceCredential[mapping.credential.subjectId], locked.nativeSubjectId) || !mapping.credential.isActiveStatus(sourceCredential[mapping.credential.status])) return void 0;
+			const sourceIdentifierRow = lockedIdentifiers.get(`${sourceIdentifier.namespace}\u0000${sourceIdentifier.value}`);
+			if (sourceIdentifierRow === void 0 || !mapping.identifier.isCurrent(sourceIdentifierRow) || !mapping.subjectId.equals(sourceIdentifierRow[mapping.identifier.subjectId], locked.nativeSubjectId)) return void 0;
+			source = {
+				credential: sourceCredential,
+				identifier: sourceIdentifierRow,
+				snapshot: yield* mapping.credential.decode({
+					moduleId: input.moduleId,
+					subject: locked.subject,
+					identifier: sourceIdentifierRow,
+					credential: sourceCredential
+				}).pipe(Effect.flatMap(snapshotEmailCredential))
+			};
+		}
+		let eligible = targetIdentifier === void 0 ? targetCredential === void 0 : targetMutable;
+		if (input.sourceCredentialId !== void 0 && source === void 0) eligible = false;
+		if (source !== void 0 && sameIdentifier(source.snapshot.identifier, input.target)) eligible = false;
+		if (mapping.addressCardinality === "single" && input.sourceCredentialId === void 0) {
+			const c = credentialColumns(mapping);
+			if ((yield* selectRows(database.select().from(mapping.credential.table).where(and(eq(c.moduleId, input.moduleId), eq(c.subjectId, locked.nativeSubjectId))), locking)).some((row) => mapping.credential.isActiveStatus(row[mapping.credential.status]))) eligible = false;
+		}
+		return {
+			nativeSubjectId: locked.nativeSubjectId,
+			subject: locked.subject,
+			revision,
+			...source === void 0 ? {} : { source },
+			...targetIdentifier === void 0 ? {} : { targetIdentifier },
+			...targetCredential === void 0 ? {} : { targetCredential },
+			...targetMutable ? { targetIdentifierRevision: targetIdentifier[mapping.identifier.bindingRevision] } : {},
+			eligible
+		};
+	});
+	const sameEmailRevision = (left, right) => {
+		if (left.subjectId !== right.subjectId || left.securityRevision !== right.securityRevision || left.credentials.length !== right.credentials.length) return false;
+		const expected = [...left.credentials].sort((a, b) => a.credentialId.localeCompare(b.credentialId));
+		const actual = [...right.credentials].sort((a, b) => a.credentialId.localeCompare(b.credentialId));
+		return expected.every((item, index) => item.credentialId === actual[index].credentialId && item.revision === actual[index].revision);
+	};
+	const actionModule = (moduleId, action) => `${moduleId}/${action === "verify-address" ? "verify-address" : "change-address"}`;
+	const actionPurpose = (action) => action === "verify-address" ? "email-address-verification" : "email-address-change";
+	const completionMatches = (input, action) => {
+		const completion = input.completion.input;
+		const binding = completion.binding;
+		return completion.moduleId === actionModule(input.moduleId, action) && completion.purpose === actionPurpose(action) && binding._tag === "IdentifierChange" && sameIdentifier(binding.identifier, input.target) && sameEmailRevision(binding.revision, input.captured.revision);
+	};
+	const snapshotEmailMutation = Effect.fn("DrizzleEmail.snapshotMutation")(function* (input) {
+		const evidence = yield* snapshotAuthenticationEvidence(input.authorization.evidence).pipe(Effect.mapError(unavailable));
+		const requirement = yield* snapshotEmailRequirement(input.authorization.requirement);
+		const source = input.captured.source === void 0 ? void 0 : yield* snapshotEmailCredential(input.captured.source);
+		return Object.freeze({
+			...input,
+			target: Object.freeze({ ...input.target }),
+			...input.invalidation === void 0 ? {} : { invalidation: Object.freeze({ ...input.invalidation }) },
+			captured: Object.freeze({
+				eligible: input.captured.eligible,
+				revision: snapshotEmailRevision(input.captured.revision),
+				...input.captured.targetIdentifierRevision === void 0 ? {} : { targetIdentifierRevision: input.captured.targetIdentifierRevision },
+				...source === void 0 ? {} : { source }
+			}),
+			authorization: Object.freeze({
+				challenge: Object.freeze({
+					...input.authorization.challenge,
+					target: Object.freeze({ ...input.authorization.challenge.target }),
+					revision: snapshotEmailRevision(input.authorization.challenge.revision)
+				}),
+				evidence,
+				requirement
+			})
+		});
+	});
+	const validateEmailAuthority = Effect.fn("DrizzleEmail.validateAuthority")(function* (mapping, configuration, input, action) {
+		const confirmsExisting = action === "verify-address" && input.captured.targetIdentifierRevision !== void 0;
+		if (!input.captured.eligible || !completionMatches(input, action) || input.authorization.challenge.moduleId !== input.moduleId || input.authorization.challenge.action !== action || input.authorization.challenge.commandId !== input.commandId || !sameIdentifier(input.authorization.challenge.target, input.target) || input.authorization.challenge.sourceCredentialId !== input.captured.source?.credentialId || !sameEmailRevision(input.authorization.challenge.revision, input.captured.revision) || input.authorization.challenge.targetIdentifierRevision !== input.captured.targetIdentifierRevision || input.authorization.evidence.flowId !== input.commandId || input.authorization.evidence.bindingDigest !== input.authorization.challenge.bindingDigest || !sameEmailRevision(input.authorization.evidence.revision, input.captured.revision) || action === "verify-address" && input.captured.source !== void 0 || action === "change-address" && input.captured.source === void 0 || confirmsExisting !== (input.invalidation === void 0) || input.invalidation?.existingSessions === "immediate" && mapping.sessionInvalidation !== "same-authority-immediate") return void 0;
+		const current = yield* currentAddress(mapping, {
+			moduleId: input.moduleId,
+			subjectId: input.captured.revision.subjectId,
+			target: input.target,
+			...input.captured.source === void 0 ? {} : { sourceCredentialId: input.captured.source.credentialId }
+		}, configuration.locking);
+		if (current === void 0 || !current.eligible || !sameEmailRevision(current.revision, input.captured.revision) || current.targetIdentifierRevision !== input.captured.targetIdentifierRevision || input.captured.source !== void 0 && (current.source === void 0 || current.source.snapshot.identifierRevision !== input.captured.source.identifierRevision || current.source.snapshot.credentialRevision !== input.captured.source.credentialRevision || !sameIdentifier(current.source.snapshot.identifier, input.captured.source.identifier))) return void 0;
+		const currentRequirement = yield* mapping.subject.decodeActionRequirement(current.subject, action);
+		const original = yield* assessAuthentication(input.authorization.evidence, input.authorization.requirement).pipe(Effect.mapError(unavailable));
+		const configured = yield* assessAuthentication(input.authorization.evidence, currentRequirement).pipe(Effect.mapError(unavailable));
+		return original.satisfied && configured.satisfied ? current : void 0;
+	});
+	const commandExists = Effect.fn("Drizzle.commandExists")(function* (mapping, moduleId, commandId, locking) {
+		const database = yield* CurrentEmailSql;
+		const c = commandColumns(mapping);
+		return yield* selectRows(database.select().from(mapping.command.table).where(and(eq(c.moduleId, moduleId), eq(c.commandId, commandId))).limit(1), locking);
+	});
+	const applyMutation = Effect.fn("DrizzleEmail.applyMutation")(function* (mapping, input, action, current, allocated, now) {
+		const database = yield* CurrentEmailSql;
+		const i = identifierColumns(mapping);
+		const c = credentialColumns(mapping);
+		const a = authorityColumns(mapping);
+		const s = subjectColumns(mapping);
+		const targetCredentialId = current.targetCredential?.[mapping.credential.credentialId] ?? allocated.targetCredentialId;
+		if (action === "change-address") {
+			const source = current.source;
+			yield* database.update(mapping.identifier.table).set(mapping.identifier.encodeRetirement({
+				source: source.snapshot.identifier,
+				bindingRevision: allocated.sourceIdentifierRevision
+			})).where(and(eq(i.namespace, source.snapshot.identifier.namespace), eq(i.value, source.snapshot.identifier.value), eq(i.subjectId, current.nativeSubjectId), eq(i.bindingRevision, source.snapshot.identifierRevision)));
+			yield* database.update(mapping.credential.table).set(mapping.credential.encodeRetirement({
+				source: source.snapshot.identifier,
+				credentialRevision: allocated.sourceCredentialRevision
+			})).where(and(eq(c.moduleId, input.moduleId), eq(c.credentialId, source.snapshot.credentialId), eq(c.subjectId, current.nativeSubjectId), eq(c.credentialRevision, source.snapshot.credentialRevision)));
+			yield* database.update(mapping.authorityCredential.table).set(mapping.authorityCredential.encodeRetirement(allocated.sourceCredentialRevision)).where(and(eq(a.subjectId, current.nativeSubjectId), eq(a.credentialId, source.snapshot.credentialId), eq(a.revision, source.snapshot.credentialRevision)));
+		}
+		if (current.targetIdentifier === void 0) yield* database.insert(mapping.identifier.table).values(mapping.identifier.encodeVerifiedInsert({
+			identifier: input.target,
+			subjectId: current.nativeSubjectId,
+			verifiedAtMillis: now,
+			bindingRevision: allocated.targetIdentifierRevision
+		}));
+		else yield* database.update(mapping.identifier.table).set(mapping.identifier.encodeVerification({
+			verifiedAtMillis: now,
+			bindingRevision: allocated.targetIdentifierRevision
+		})).where(and(eq(i.namespace, input.target.namespace), eq(i.value, input.target.value), eq(i.subjectId, current.nativeSubjectId), eq(i.bindingRevision, current.targetIdentifier[mapping.identifier.bindingRevision])));
+		if (current.targetCredential === void 0) {
+			yield* database.insert(mapping.credential.table).values(mapping.credential.encodeVerifiedInsert({
+				moduleId: input.moduleId,
+				subjectId: current.nativeSubjectId,
+				credentialId: targetCredentialId,
+				identifier: input.target,
+				credentialRevision: allocated.targetCredentialRevision
+			}));
+			yield* database.insert(mapping.authorityCredential.table).values(mapping.authorityCredential.encodeInsert({
+				subjectId: current.nativeSubjectId,
+				credentialId: targetCredentialId,
+				revision: allocated.targetCredentialRevision
+			}));
+		} else {
+			const oldRevision = current.targetCredential[mapping.credential.credentialRevision];
+			yield* database.update(mapping.credential.table).set(mapping.credential.encodeActivation({
+				identifier: input.target,
+				credentialRevision: allocated.targetCredentialRevision
+			})).where(and(eq(c.moduleId, input.moduleId), eq(c.credentialId, targetCredentialId), eq(c.subjectId, current.nativeSubjectId), eq(c.credentialRevision, oldRevision)));
+			yield* database.update(mapping.authorityCredential.table).set(mapping.authorityCredential.encodeActivation(allocated.targetCredentialRevision)).where(and(eq(a.subjectId, current.nativeSubjectId), eq(a.credentialId, targetCredentialId), eq(a.revision, oldRevision)));
+		}
+		yield* database.update(mapping.subject.table).set(updateValues([[mapping.subject.securityRevision, allocated.nextSecurityRevision]])).where(and(eq(s.id, current.nativeSubjectId), eq(s.securityRevision, input.captured.revision.securityRevision)));
+		yield* database.insert(mapping.command.table).values(mapping.command.encodeInsert({
+			moduleId: input.moduleId,
+			commandId: input.commandId,
+			action,
+			bindingDigest: input.authorization.challenge.bindingDigest,
+			retentionUntilMillis: now + mapping.commandRetentionMillis
+		}));
+		const sourceStillActive = action === "verify-address" ? [] : yield* selectRows(database.select().from(mapping.credential.table).where(and(eq(c.moduleId, input.moduleId), eq(c.credentialId, current.source.snapshot.credentialId), eq(c.subjectId, current.nativeSubjectId))), false);
+		const target = (yield* emailLookupRows(mapping, input.moduleId, input.target))[0];
+		const targetAuthority = yield* selectRows(database.select().from(mapping.authorityCredential.table).where(and(eq(a.subjectId, current.nativeSubjectId), eq(a.credentialId, targetCredentialId))).limit(1), false);
+		const command = yield* selectRows(database.select().from(mapping.command.table).where(and(eq(commandColumns(mapping).moduleId, input.moduleId), eq(commandColumns(mapping).commandId, input.commandId), eq(commandColumns(mapping).action, action), eq(commandColumns(mapping).bindingDigest, input.authorization.challenge.bindingDigest), eq(commandColumns(mapping).retentionUntil, mapping.encodeInstant(now + mapping.commandRetentionMillis)))).limit(1), false);
+		const targetVerifiedAt = target === void 0 ? void 0 : yield* mapping.decodeInstant(target.identifier[mapping.identifier.verifiedAt]);
+		const sourceIdentifier = action === "verify-address" ? [] : yield* identifierRow(mapping, current.source.snapshot.identifier, false);
+		const sourceAuthority = action === "verify-address" ? [] : yield* selectRows(database.select().from(mapping.authorityCredential.table).where(and(eq(a.subjectId, current.nativeSubjectId), eq(a.credentialId, current.source.snapshot.credentialId))).limit(1), false);
+		return target !== void 0 && mapping.subjectId.equals(target.subject[mapping.subject.id], current.nativeSubjectId) && mapping.subject.isActiveStatus(target.subject[mapping.subject.status]) && target.subject[mapping.subject.securityRevision] === allocated.nextSecurityRevision && target.identifier[mapping.identifier.bindingRevision] === allocated.targetIdentifierRevision && targetVerifiedAt === now && target.credential[mapping.credential.credentialRevision] === allocated.targetCredentialRevision && target.credential[mapping.credential.credentialId] === targetCredentialId && mapping.subjectId.equals(target.credential[mapping.credential.subjectId], current.nativeSubjectId) && mapping.identifier.isCurrent(target.identifier) && mapping.credential.isActiveStatus(target.credential[mapping.credential.status]) && targetAuthority.length === 1 && targetAuthority[0][mapping.authorityCredential.revision] === allocated.targetCredentialRevision && mapping.authorityCredential.isActiveStatus(targetAuthority[0][mapping.authorityCredential.status]) && command.length === 1 && (action === "verify-address" || sourceStillActive.length === 1 && sourceStillActive[0][mapping.credential.credentialRevision] === allocated.sourceCredentialRevision && !mapping.credential.isActiveStatus(sourceStillActive[0][mapping.credential.status]) && sourceIdentifier.length === 1 && mapping.subjectId.equals(sourceIdentifier[0][mapping.identifier.subjectId], current.nativeSubjectId) && sourceIdentifier[0][mapping.identifier.bindingRevision] === allocated.sourceIdentifierRevision && !mapping.identifier.isCurrent(sourceIdentifier[0]) && sourceAuthority.length === 1 && sourceAuthority[0][mapping.authorityCredential.revision] === allocated.sourceCredentialRevision && !mapping.authorityCredential.isActiveStatus(sourceAuthority[0][mapping.authorityCredential.status]));
+	});
+	const probeProofCompletion = Effect.fn("Drizzle.probeProofCompletion")(function* (configuration, input) {
+		const database = yield* CurrentEmailSql;
+		if (configuration.proof === void 0) return yield* Effect.fail(unavailable());
+		const validProbe = { _tag: "EmailProofCompletionValid" };
+		const plan = {
+			input,
+			prepare: (decision, journal, project) => journal.prepare(project(decision))
+		};
+		return yield* coordinateCommit(() => database.transaction((transaction) => completeProofPlanIn(configuration.proof.mapping, configuration.proof.configuration, plan, Effect.fail(validProbe), () => false).pipe(Effect.provideService(CurrentProofSql, transaction))), { mode: configuration.mode }).pipe(Effect.as(false), Effect.catchCause((cause) => {
+			const reason = cause.reasons[0];
+			return cause.reasons.length === 1 && reason !== void 0 && Cause.isFailReason(reason) && reason.error === validProbe ? Effect.succeed(true) : Effect.failCause(cause);
+		}));
+	});
+	const prepareRejected = Effect.fn("Drizzle.prepareRejected")(function* (configuration, prepare) {
+		const database = yield* CurrentEmailSql;
+		return yield* owned(database, configuration, Effect.gen(function* () {
+			const journal = yield* CurrentCommitJournal;
+			return yield* Effect.succeed(prepare("rejected", journal));
+		}));
+	});
+	const makeSqlEmailAddressPersistence = Effect.fn("makeSqlEmailAddressPersistence")(function* (database, mapping, configuration) {
+		const hooks = yield* LifecycleHooks;
+		return EmailAddressPersistence.of({
+			target: (input) => (validAddressConstraints(mapping) ? safeRead(database, configuration, Effect.gen(function* () {
+				const current = yield* currentAddress(mapping, input, configuration.locking);
+				if (current === void 0) return yield* unavailable();
+				return Object.freeze({
+					revision: snapshotEmailRevision(current.revision),
+					eligible: current.eligible,
+					...current.targetIdentifierRevision === void 0 ? {} : { targetIdentifierRevision: current.targetIdentifierRevision },
+					...current.source === void 0 ? {} : { source: yield* snapshotEmailCredential(current.source.snapshot) }
+				});
+			})) : Effect.fail(unavailable())).pipe(Effect.provideService(CurrentEmailSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
+			checkCompletion: (input) => {
+				if (configuration.proof === void 0 || input.binding._tag !== "IdentifierChange") return Effect.succeed(false).pipe(Effect.provideService(CurrentEmailSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure);
+				const binding = input.binding;
+				return safeRead(database, configuration, Effect.gen(function* () {
+					const action = input.moduleId.endsWith("/verify-address") && input.purpose === "email-address-verification" ? "verify-address" : input.moduleId.endsWith("/change-address") && input.purpose === "email-address-change" ? "change-address" : void 0;
+					if (action === void 0) return false;
+					const moduleId = input.moduleId.slice(0, -`/${action}`.length);
+					const current = yield* currentAddress(mapping, {
+						moduleId,
+						subjectId: binding.revision.subjectId,
+						target: binding.identifier
+					}, false);
+					return current !== void 0 && sameEmailRevision(current.revision, binding.revision);
+				})).pipe(Effect.flatMap((current) => current ? probeProofCompletion(configuration, input) : Effect.succeed(false))).pipe(Effect.provideService(CurrentEmailSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure);
+			},
+			verifyWithProof: (uncaptured, prepare) => mutateAddress(mapping, configuration, uncaptured, "verify-address", prepare).pipe(Effect.provideService(CurrentEmailSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
+			changeWithProof: (uncaptured, prepare) => mutateAddress(mapping, configuration, uncaptured, "change-address", prepare).pipe(Effect.provideService(CurrentEmailSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
+			cleanup: (input, prepare) => owned(database, configuration, Effect.gen(function* () {
+				const transaction = yield* CurrentEmailSql;
+				const journal = yield* CurrentCommitJournal;
+				const c = commandColumns(mapping);
+				const now = yield* nowMillis;
+				const rows = yield* selectRows(transaction.select({ commandId: c.commandId }).from(mapping.command.table).where(and(eq(c.moduleId, input.moduleId), lte(c.retentionUntil, mapping.encodeInstant(now)))).limit(input.limit + 1), configuration.locking);
+				const selected = rows.slice(0, input.limit);
+				const receipt = prepare({
+					removed: selected.length,
+					hasMore: rows.length > input.limit
+				}, journal);
+				if (selected.length > 0) yield* transaction.delete(mapping.command.table).where(and(eq(c.moduleId, input.moduleId), inArray(c.commandId, selected.map((row) => row.commandId)), lte(c.retentionUntil, mapping.encodeInstant(now))));
+				return receipt;
+			})).pipe(Effect.provideService(CurrentEmailSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure)
+		});
+	});
+	const mutateAddress = Effect.fn("Drizzle.mutateAddress")(function* (mapping, configuration, uncaptured, action, prepare) {
+		const database = yield* CurrentEmailSql;
+		if (!validAddressConstraints(mapping) || configuration.proof === void 0) return yield* unavailable();
+		const input = yield* snapshotEmailMutation(uncaptured);
+		const targetCredentialId = yield* allocate(configuration.mode, mapping.allocateCredentialId, mapping.allocateCredentialIdSync);
+		const targetIdentifierRevision = yield* allocate(configuration.mode, mapping.allocateRevision, mapping.allocateRevisionSync);
+		const targetCredentialRevision = yield* allocate(configuration.mode, mapping.allocateRevision, mapping.allocateRevisionSync);
+		const sourceIdentifierRevision = yield* allocate(configuration.mode, mapping.allocateRevision, mapping.allocateRevisionSync);
+		const sourceCredentialRevision = yield* allocate(configuration.mode, mapping.allocateRevision, mapping.allocateRevisionSync);
+		const confirmsExisting = action === "verify-address" && input.captured.targetIdentifierRevision !== void 0;
+		const nextRevision = confirmsExisting ? input.captured.revision.securityRevision : yield* nextSecurityRevision(mapping, configuration.mode, input.captured.revision.securityRevision);
+		if (!confirmsExisting && nextRevision === input.captured.revision.securityRevision || [
+			targetIdentifierRevision,
+			targetCredentialRevision,
+			sourceIdentifierRevision,
+			sourceCredentialRevision
+		].some((value) => input.captured.revision.credentials.some((item) => item.revision === value))) return yield* unavailable();
+		return yield* owned(database, configuration, Effect.gen(function* () {
+			const journal = yield* CurrentCommitJournal;
+			const current = yield* validateEmailAuthority(mapping, configuration, input, action);
+			if (current === void 0) return prepare("rejected", journal);
+			if ((yield* commandExists(mapping, input.moduleId, input.commandId, configuration.locking)).length > 0) return prepare("rejected", journal);
+			let receipt;
+			yield* completeProofPlanIn(configuration.proof.mapping, configuration.proof.configuration, input.completion, Effect.gen(function* () {
+				const currentRequirement = yield* mapping.subject.decodeActionRequirement(current.subject, action);
+				const original = yield* assessAuthentication(input.authorization.evidence, input.authorization.requirement).pipe(Effect.mapError(unavailable));
+				const configured = yield* assessAuthentication(input.authorization.evidence, currentRequirement).pipe(Effect.mapError(unavailable));
+				if (!original.satisfied || !configured.satisfied) return false;
+				const now = yield* nowMillis;
+				return yield* applyMutation(mapping, input, action, current, {
+					targetCredentialId,
+					targetIdentifierRevision,
+					targetCredentialRevision,
+					sourceIdentifierRevision,
+					sourceCredentialRevision,
+					nextSecurityRevision: nextRevision
+				}, now);
+			}), (decision) => {
+				receipt = prepare(decision === "completed" ? "changed" : "rejected", journal);
+				return decision;
+			});
+			return receipt ?? prepare("rejected", journal);
+		})).pipe(Effect.catchCause((cause) => cause.reasons.every(Cause.isFailReason) && isMappedConstraintConflict(mapping.isCommandConflict, cause) || cause.reasons.every(Cause.isFailReason) && isMappedConstraintConflict(mapping.isIdentifierConflict, cause) || cause.reasons.every(Cause.isFailReason) && isMappedConstraintConflict(mapping.isCredentialConflict, cause) ? prepareRejected(configuration, prepare) : Effect.failCause(cause)));
+	});
+	return {
+		validEmailSignInConstraints,
+		emailLookupQuery,
+		decodeEmailSnapshot,
+		makeSqlEmailSignInTargets,
+		currentAddress,
+		sameEmailRevision,
+		snapshotEmailMutation,
+		validateEmailAuthority,
+		makeSqlEmailAddressPersistence
+	};
+};
+//#endregion
+export { CurrentEmailSql, makeEmailKernel };
+
+//# sourceMappingURL=email-kernel.mjs.map