@yielded/auth 0.1.0-beta.1

package/src/drizzle/email-sql.ts

@@ -0,0 +1,1468 @@
+/* oxlint-disable no-explicit-any -- the shared dialect kernel erases consumer Drizzle table types internally. */
+import type { sql } from "drizzle-orm";
+import { and, eq, inArray, lte } from "drizzle-orm";
+import type { EffectDrizzleQueryError } from "drizzle-orm/effect-core";
+import { Cause, Context, DateTime, Effect, Option, Schema } from "effect";
+import type * as SqlError from "effect/unstable/sql/SqlError";
+
+import {
+  EmailAddressPersistence,
+  type EmailAddressMutation,
+} from "../email/EmailAddressPersistence";
+import { EmailSignInTargets } from "../email/EmailSignInTargets";
+import { EmailUnavailable } from "../email/errors";
+import type { EmailAction, EmailCredentialSnapshot } from "../email/models";
+import {
+  snapshotEmailCredential,
+  snapshotEmailRequirement,
+  snapshotEmailRevision,
+} from "../email/snapshot";
+import {
+  coordinateCommit,
+  CurrentCommitJournal,
+  hasCommitScope,
+  type CommitJournal,
+  type PreparedCommit,
+} from "../hooks/commit";
+import { LifecycleHooks } from "../hooks/LifecycleHooks";
+import { HookConfigurationError } from "../hooks/models";
+import type { LoginIdentifier } from "../identity/models";
+import { reportPersistenceFailure } from "../internal/diagnostics";
+import { ProofUnavailable } from "../proofs/errors";
+import type { ProofCompletionDecision } from "../proofs/models";
+import type { ProofCompletionInput } from "../proofs/ProofPersistence";
+import { assessAuthentication, snapshotAuthenticationEvidence } from "../sessions/assurance";
+import type { AuthenticationRevision, SecurityRevision } from "../sessions/models";
+import {
+  type AnyEmailAddressMapping,
+  type AnyEmailSignInMapping,
+  requiredEmailAddressConstraints,
+  requiredEmailSignInConstraints,
+} from "./email-model";
+import { column, isMappedConstraintConflict, DrizzleMappingError, updateValues } from "./model";
+import {
+  CurrentProofSql,
+  completeProofPlanIn,
+  type ProofSqlConfiguration,
+  type ProofSqlDatabase,
+} from "./proof-sql";
+
+type AdapterFailure = EffectDrizzleQueryError | DrizzleMappingError | SqlError.SqlError;
+type SignInMapping = AnyEmailSignInMapping;
+type AddressMapping = AnyEmailAddressMapping;
+const unavailable = () => EmailUnavailable.make({});
+
+const translateFailure = <A, E, R>(
+  effect: Effect.Effect<A, E, R>,
+): Effect.Effect<A, EmailUnavailable, R> =>
+  reportPersistenceFailure(
+    effect,
+    (error) =>
+      Schema.is(EmailUnavailable)(error) ||
+      Schema.is(ProofUnavailable)(error) ||
+      Schema.is(HookConfigurationError)(error),
+  ).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));
+
+const nowMillis = Effect.map(DateTime.now, DateTime.toEpochMillis);
+
+export interface EmailSqlQuery<A = ReadonlyArray<any>> extends Effect.Effect<A, AdapterFailure> {
+  readonly getSQL: () => ReturnType<typeof sql>;
+  readonly from: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;
+  readonly where: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;
+  readonly limit: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;
+  readonly orderBy: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;
+  readonly for: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;
+  readonly set: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;
+  readonly values: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;
+  readonly returning: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;
+  readonly innerJoin: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;
+  readonly onConflictDoNothing: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;
+  readonly onDuplicateKeyUpdate: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;
+  readonly $returningId: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;
+}
+
+export interface EmailSqlDatabase {
+  readonly select: (...args: ReadonlyArray<any>) => EmailSqlQuery;
+  readonly insert: (...args: ReadonlyArray<any>) => EmailSqlQuery;
+  readonly update: (...args: ReadonlyArray<any>) => EmailSqlQuery;
+  readonly delete: (...args: ReadonlyArray<any>) => EmailSqlQuery;
+  readonly transaction: <A, E, R>(
+    body: (transaction: EmailSqlDatabase) => Effect.Effect<A, E, R>,
+  ) => Effect.Effect<A, E | SqlError.SqlError, R>;
+}
+
+export class CurrentEmailSql extends Context.Service<CurrentEmailSql, EmailSqlDatabase>()(
+  "effect-auth/CurrentEmailSql",
+) {}
+
+export interface EmailSqlConfiguration {
+  readonly mode: "interactive" | "synchronous";
+  readonly locking: boolean;
+  readonly standaloneGuard: Effect.Effect<void, EmailUnavailable>;
+  readonly coordinated?: boolean;
+  readonly proof?: {
+    readonly mapping: any;
+    readonly configuration: ProofSqlConfiguration;
+  };
+}
+
+const selectRows = (query: EmailSqlQuery, locking: boolean) =>
+  locking && typeof query.for === "function" ? query.for("update") : query;
+
+const sameIdentifier = (left: LoginIdentifier, right: LoginIdentifier) =>
+  left.namespace === right.namespace && left.value === right.value;
+
+export const validEmailSignInConstraints = (mapping: SignInMapping) =>
+  Object.entries(requiredEmailSignInConstraints).every(
+    ([key, value]) =>
+      mapping.constraints[key as keyof typeof requiredEmailSignInConstraints] === value,
+  );
+
+const validAddressConstraints = (mapping: AddressMapping) =>
+  Object.entries(requiredEmailAddressConstraints).every(
+    ([key, value]) =>
+      mapping.constraints[key as keyof typeof requiredEmailAddressConstraints] === value,
+  );
+
+const subjectColumns = (mapping: SignInMapping) => ({
+  id: column(mapping.subject.table, mapping.subject.id),
+  status: column(mapping.subject.table, mapping.subject.status),
+  securityRevision: column(mapping.subject.table, mapping.subject.securityRevision),
+});
+
+const identifierColumns = (mapping: SignInMapping) => ({
+  namespace: column(mapping.identifier.table, mapping.identifier.namespace),
+  value: column(mapping.identifier.table, mapping.identifier.value),
+  subjectId: column(mapping.identifier.table, mapping.identifier.subjectId),
+  verifiedAt: column(mapping.identifier.table, mapping.identifier.verifiedAt),
+  bindingRevision: column(mapping.identifier.table, mapping.identifier.bindingRevision),
+});
+
+const credentialColumns = (mapping: SignInMapping) => ({
+  moduleId: column(mapping.credential.table, mapping.credential.moduleId),
+  subjectId: column(mapping.credential.table, mapping.credential.subjectId),
+  credentialId: column(mapping.credential.table, mapping.credential.credentialId),
+  identifierNamespace: column(mapping.credential.table, mapping.credential.identifierNamespace),
+  identifierValue: column(mapping.credential.table, mapping.credential.identifierValue),
+  credentialRevision: column(mapping.credential.table, mapping.credential.credentialRevision),
+  status: column(mapping.credential.table, mapping.credential.status),
+});
+
+const authorityColumns = (mapping: AddressMapping) => ({
+  subjectId: column(mapping.authorityCredential.table, mapping.authorityCredential.subjectId),
+  credentialId: column(mapping.authorityCredential.table, mapping.authorityCredential.credentialId),
+  revision: column(mapping.authorityCredential.table, mapping.authorityCredential.revision),
+  status: column(mapping.authorityCredential.table, mapping.authorityCredential.status),
+});
+
+const commandColumns = (mapping: AddressMapping) => ({
+  moduleId: column(mapping.command.table, mapping.command.moduleId),
+  commandId: column(mapping.command.table, mapping.command.commandId),
+  action: column(mapping.command.table, mapping.command.action),
+  bindingDigest: column(mapping.command.table, mapping.command.bindingDigest),
+  retentionUntil: column(mapping.command.table, mapping.command.retentionUntil),
+});
+
+const allocate = <A>(
+  mode: EmailSqlConfiguration["mode"],
+  asynchronous: Effect.Effect<A, DrizzleMappingError> | undefined,
+  synchronous: (() => A) | undefined,
+) => {
+  if (mode === "synchronous")
+    return synchronous === undefined
+      ? Effect.fail(unavailable())
+      : Effect.try({
+          try: synchronous,
+          catch: (cause) => new DrizzleMappingError({ operation: "mapping", cause }),
+        });
+  if (asynchronous !== undefined) return asynchronous;
+
+  return synchronous === undefined
+    ? Effect.fail(unavailable())
+    : Effect.try({
+        try: synchronous,
+        catch: (cause) => new DrizzleMappingError({ operation: "mapping", cause }),
+      });
+};
+
+const nextSecurityRevision = (
+  mapping: AddressMapping,
+  mode: EmailSqlConfiguration["mode"],
+  current: SecurityRevision,
+) => {
+  if (mode === "synchronous")
+    return mapping.subject.nextSecurityRevisionSync === undefined
+      ? Effect.fail(unavailable())
+      : Effect.try({
+          try: () => mapping.subject.nextSecurityRevisionSync!(current),
+          catch: (cause) => new DrizzleMappingError({ operation: "mapping", cause }),
+        });
+  if (mapping.subject.nextSecurityRevision !== undefined)
+    return mapping.subject.nextSecurityRevision(current);
+  if (mapping.subject.nextSecurityRevisionSync !== undefined)
+    return Effect.try({
+      try: () => mapping.subject.nextSecurityRevisionSync!(current),
+      catch: (cause) => new DrizzleMappingError({ operation: "mapping", cause }),
+    });
+
+  return Effect.fail(unavailable());
+};
+
+const safeRead = <A, E, R>(
+  database: EmailSqlDatabase,
+  configuration: EmailSqlConfiguration,
+  body: Effect.Effect<A, E, R>,
+) =>
+  Effect.gen(function* () {
+    if (configuration.coordinated !== true) {
+      if (yield* hasCommitScope) return yield* unavailable();
+      yield* configuration.standaloneGuard;
+    }
+
+    return yield* database.transaction((transaction) =>
+      body.pipe(
+        Effect.provideService(CurrentEmailSql, transaction),
+        Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),
+      ),
+    );
+  });
+
+const owned = <A, E, R>(
+  database: EmailSqlDatabase,
+  configuration: EmailSqlConfiguration,
+  body: Effect.Effect<A, E, R>,
+) => {
+  const run = coordinateCommit(
+    () =>
+      database.transaction((transaction) =>
+        body.pipe(
+          Effect.provideService(CurrentEmailSql, transaction),
+          Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),
+        ),
+      ),
+    { mode: configuration.mode },
+  ).pipe(Effect.map((result) => result.value));
+
+  return configuration.coordinated !== true
+    ? Effect.gen(function* () {
+        if (yield* hasCommitScope) return yield* unavailable();
+        yield* configuration.standaloneGuard;
+
+        return yield* run;
+      })
+    : run;
+};
+
+export const emailLookupQuery = (
+  mapping: SignInMapping,
+  moduleId: string,
+  identifier: LoginIdentifier,
+) => {
+  const subject = subjectColumns(mapping),
+    binding = identifierColumns(mapping),
+    credential = credentialColumns(mapping);
+
+  return {
+    fields: {
+      subject: mapping.subject.table,
+      identifier: mapping.identifier.table,
+      credential: mapping.credential.table,
+    },
+    from: mapping.identifier.table,
+    subjectTable: mapping.subject.table,
+    subjectJoin: eq(subject.id, binding.subjectId),
+    credentialTable: mapping.credential.table,
+    credentialJoin: and(
+      eq(credential.moduleId, moduleId),
+      eq(credential.subjectId, binding.subjectId),
+      eq(credential.identifierNamespace, binding.namespace),
+      eq(credential.identifierValue, binding.value),
+    ),
+    predicate: and(
+      eq(binding.namespace, identifier.namespace),
+      eq(binding.value, identifier.value),
+    ),
+    limit: 1,
+  };
+};
+
+const emailLookupRows = Effect.fn("Drizzle.emailLookupRows")(function* (
+  mapping: SignInMapping,
+  moduleId: string,
+  identifier: LoginIdentifier,
+) {
+  const database = yield* CurrentEmailSql;
+  const query = emailLookupQuery(mapping, moduleId, identifier);
+
+  return yield* database
+    .select(query.fields)
+    .from(query.from)
+    .innerJoin(query.subjectTable, query.subjectJoin)
+    .innerJoin(query.credentialTable, query.credentialJoin)
+    .where(query.predicate)
+    .limit(query.limit);
+});
+
+export const decodeEmailSnapshot = Effect.fn("DrizzleEmail.decodeSnapshot")(function* (
+  mapping: SignInMapping,
+  moduleId: string,
+  requested: LoginIdentifier,
+  row: any,
+) {
+  if (
+    !mapping.subject.isActiveStatus(row.subject[mapping.subject.status]) ||
+    !mapping.identifier.isCurrent(row.identifier) ||
+    !mapping.credential.isActiveStatus(row.credential[mapping.credential.status])
+  )
+    return undefined;
+
+  const snapshot = yield* mapping.credential
+    .decode({
+      moduleId,
+      subject: row.subject,
+      identifier: row.identifier,
+      credential: row.credential,
+    })
+    .pipe(Effect.flatMap(snapshotEmailCredential));
+
+  const subjectId = yield* mapping.subjectId.toSubject(row.subject[mapping.subject.id]);
+
+  const verifiedAtMillis = yield* mapping.decodeInstant(
+    row.identifier[mapping.identifier.verifiedAt],
+  );
+
+  if (
+    snapshot.moduleId !== moduleId ||
+    !sameIdentifier(snapshot.identifier, requested) ||
+    snapshot.revision.subjectId !== subjectId ||
+    snapshot.revision.securityRevision !== row.subject[mapping.subject.securityRevision] ||
+    snapshot.identifierRevision !== row.identifier[mapping.identifier.bindingRevision] ||
+    snapshot.verifiedAtMillis !== verifiedAtMillis ||
+    snapshot.credentialId !== row.credential[mapping.credential.credentialId] ||
+    snapshot.credentialRevision !== row.credential[mapping.credential.credentialRevision]
+  )
+    return undefined;
+
+  return snapshot;
+});
+
+export const makeSqlEmailSignInTargets = Effect.fn("makeSqlEmailSignInTargets")(function (
+  database: EmailSqlDatabase,
+  mapping: SignInMapping,
+  configuration: EmailSqlConfiguration,
+): Effect.Effect<EmailSignInTargets["Service"]> {
+  return Effect.succeed(
+    EmailSignInTargets.of({
+      lookup: (input) =>
+        (validEmailSignInConstraints(mapping)
+          ? safeRead(
+              database,
+              configuration,
+              Effect.gen(function* () {
+                const row = (yield* emailLookupRows(mapping, input.moduleId, input.identifier))[0];
+
+                if (row === undefined) return Option.none();
+
+                const snapshot = yield* decodeEmailSnapshot(
+                  mapping,
+                  input.moduleId,
+                  input.identifier,
+                  row,
+                );
+
+                return snapshot === undefined ? Option.none() : Option.some(snapshot);
+              }),
+            )
+          : Effect.fail(unavailable())
+        ).pipe(Effect.provideService(CurrentEmailSql, database), translateFailure),
+    }),
+  );
+});
+
+export interface CurrentAddress {
+  readonly nativeSubjectId: unknown;
+  readonly subject: any;
+  readonly revision: AuthenticationRevision;
+  readonly source?: {
+    readonly credential: any;
+    readonly identifier: any;
+    readonly snapshot: EmailCredentialSnapshot;
+  };
+  readonly targetIdentifier?: any;
+  readonly targetCredential?: any;
+  readonly eligible: boolean;
+}
+
+const readSubject = Effect.fn("DrizzleEmail.readSubject")(function* (
+  mapping: AddressMapping,
+  subjectId: string,
+  locking: boolean,
+) {
+  const database = yield* CurrentEmailSql;
+
+  const nativeSubjectId = yield* mapping.subjectId.toNative(subjectId as any);
+  const s = subjectColumns(mapping);
+
+  const subject = (yield* selectRows(
+    database.select().from(mapping.subject.table).where(eq(s.id, nativeSubjectId)).limit(1),
+    locking,
+  ))[0];
+
+  return { nativeSubjectId, subject };
+});
+
+const identifierRow = Effect.fn("Drizzle.identifierRow")(function* (
+  mapping: SignInMapping,
+  identifier: LoginIdentifier,
+  locking: boolean,
+) {
+  const database = yield* CurrentEmailSql;
+
+  const i = identifierColumns(mapping);
+
+  return yield* selectRows(
+    database
+      .select()
+      .from(mapping.identifier.table)
+      .where(and(eq(i.namespace, identifier.namespace), eq(i.value, identifier.value)))
+      .limit(1),
+    locking,
+  );
+});
+
+const credentialById = Effect.fn("Drizzle.credentialById")(function* (
+  mapping: SignInMapping,
+  moduleId: string,
+  credentialId: string,
+  locking: boolean,
+) {
+  const database = yield* CurrentEmailSql;
+
+  const c = credentialColumns(mapping);
+
+  return yield* selectRows(
+    database
+      .select()
+      .from(mapping.credential.table)
+      .where(and(eq(c.moduleId, moduleId), eq(c.credentialId, credentialId)))
+      .limit(1),
+    locking,
+  );
+});
+
+const credentialByIdentifier = Effect.fn("Drizzle.credentialByIdentifier")(function* (
+  mapping: SignInMapping,
+  moduleId: string,
+  identifier: LoginIdentifier,
+  locking: boolean,
+) {
+  const database = yield* CurrentEmailSql;
+
+  const c = credentialColumns(mapping);
+
+  return yield* selectRows(
+    database
+      .select()
+      .from(mapping.credential.table)
+      .where(
+        and(
+          eq(c.moduleId, moduleId),
+          eq(c.identifierNamespace, identifier.namespace),
+          eq(c.identifierValue, identifier.value),
+        ),
+      )
+      .limit(1),
+    locking,
+  );
+});
+
+export const currentAddress = Effect.fn("DrizzleEmail.currentAddress")(function* (
+  mapping: AddressMapping,
+  input: {
+    readonly moduleId: string;
+    readonly subjectId: string;
+    readonly target: LoginIdentifier;
+    readonly sourceCredentialId?: string;
+  },
+  locking: boolean,
+) {
+  const database = yield* CurrentEmailSql;
+
+  const locked = yield* readSubject(mapping, input.subjectId, locking);
+
+  if (
+    locked.subject === undefined ||
+    !mapping.subject.isActiveStatus(locked.subject[mapping.subject.status])
+  )
+    return undefined;
+
+  const discoveredSource =
+    input.sourceCredentialId === undefined
+      ? undefined
+      : (yield* credentialById(mapping, input.moduleId, input.sourceCredentialId, false))[0];
+
+  const sourceIdentifier: LoginIdentifier | undefined =
+    discoveredSource === undefined
+      ? undefined
+      : {
+          namespace: discoveredSource[mapping.credential.identifierNamespace],
+          value: discoveredSource[mapping.credential.identifierValue],
+        };
+
+  const identifiers = [input.target, ...(sourceIdentifier === undefined ? [] : [sourceIdentifier])]
+    .filter(
+      (value, index, values) =>
+        values.findIndex((candidate) => sameIdentifier(candidate, value)) === index,
+    )
+    .sort((left, right) =>
+      `${left.namespace}\u0000${left.value}`.localeCompare(
+        `${right.namespace}\u0000${right.value}`,
+      ),
+    );
+
+  const lockedIdentifiers = new Map<string, any>();
+
+  for (const identifier of identifiers) {
+    const row = (yield* identifierRow(mapping, identifier, locking))[0];
+
+    if (row !== undefined)
+      lockedIdentifiers.set(`${identifier.namespace}\u0000${identifier.value}`, row);
+  }
+
+  const sourceCredential =
+    input.sourceCredentialId === undefined
+      ? undefined
+      : (yield* credentialById(mapping, input.moduleId, input.sourceCredentialId, locking))[0];
+
+  const targetCredential = (yield* credentialByIdentifier(
+    mapping,
+    input.moduleId,
+    input.target,
+    locking,
+  ))[0];
+
+  const a = authorityColumns(mapping);
+
+  const authority = yield* selectRows(
+    database
+      .select()
+      .from(mapping.authorityCredential.table)
+      .where(eq(a.subjectId, locked.nativeSubjectId))
+      .orderBy(a.credentialId),
+    locking,
+  );
+
+  const activeAuthority = authority.filter((row: any) =>
+    mapping.authorityCredential.isActiveStatus(row[mapping.authorityCredential.status]),
+  );
+
+  const subjectId = yield* mapping.subjectId.toSubject(locked.nativeSubjectId);
+
+  const revision: AuthenticationRevision = Object.freeze({
+    subjectId,
+    securityRevision: locked.subject[mapping.subject.securityRevision],
+    credentials: Object.freeze(
+      activeAuthority.map((row: any) =>
+        Object.freeze({
+          credentialId: row[mapping.authorityCredential.credentialId],
+          revision: row[mapping.authorityCredential.revision],
+        }),
+      ),
+    ),
+  });
+
+  const targetIdentifier = lockedIdentifiers.get(
+    `${input.target.namespace}\u0000${input.target.value}`,
+  );
+
+  const targetOwned =
+    targetIdentifier !== undefined &&
+    mapping.subjectId.equals(
+      targetIdentifier[mapping.identifier.subjectId],
+      locked.nativeSubjectId,
+    );
+
+  const targetMutable =
+    targetOwned &&
+    mapping.identifier.isMutableTarget(targetIdentifier) &&
+    (targetCredential === undefined ||
+      (!mapping.credential.isActiveStatus(targetCredential[mapping.credential.status]) &&
+        mapping.subjectId.equals(
+          targetCredential[mapping.credential.subjectId],
+          locked.nativeSubjectId,
+        )));
+
+  let source: CurrentAddress["source"];
+
+  if (input.sourceCredentialId !== undefined) {
+    if (
+      sourceCredential === undefined ||
+      sourceIdentifier === undefined ||
+      !mapping.subjectId.equals(
+        sourceCredential[mapping.credential.subjectId],
+        locked.nativeSubjectId,
+      ) ||
+      !mapping.credential.isActiveStatus(sourceCredential[mapping.credential.status])
+    )
+      return undefined;
+
+    const sourceIdentifierRow = lockedIdentifiers.get(
+      `${sourceIdentifier.namespace}\u0000${sourceIdentifier.value}`,
+    );
+
+    if (
+      sourceIdentifierRow === undefined ||
+      !mapping.identifier.isCurrent(sourceIdentifierRow) ||
+      !mapping.subjectId.equals(
+        sourceIdentifierRow[mapping.identifier.subjectId],
+        locked.nativeSubjectId,
+      )
+    )
+      return undefined;
+
+    const snapshot = yield* mapping.credential
+      .decode({
+        moduleId: input.moduleId,
+        subject: locked.subject,
+        identifier: sourceIdentifierRow,
+        credential: sourceCredential,
+      })
+      .pipe(Effect.flatMap(snapshotEmailCredential));
+
+    source = { credential: sourceCredential, identifier: sourceIdentifierRow, snapshot };
+  }
+  let eligible = targetIdentifier === undefined ? targetCredential === undefined : targetMutable;
+
+  if (input.sourceCredentialId !== undefined && source === undefined) eligible = false;
+  if (source !== undefined && sameIdentifier(source.snapshot.identifier, input.target))
+    eligible = false;
+  if (mapping.addressCardinality === "single" && input.sourceCredentialId === undefined) {
+    const c = credentialColumns(mapping);
+
+    const rows = yield* selectRows(
+      database
+        .select()
+        .from(mapping.credential.table)
+        .where(and(eq(c.moduleId, input.moduleId), eq(c.subjectId, locked.nativeSubjectId))),
+      locking,
+    );
+
+    if (rows.some((row: any) => mapping.credential.isActiveStatus(row[mapping.credential.status])))
+      eligible = false;
+  }
+
+  return {
+    nativeSubjectId: locked.nativeSubjectId,
+    subject: locked.subject,
+    revision,
+    ...(source === undefined ? {} : { source }),
+    ...(targetIdentifier === undefined ? {} : { targetIdentifier }),
+    ...(targetCredential === undefined ? {} : { targetCredential }),
+    eligible,
+  };
+});
+
+export const sameEmailRevision = (left: AuthenticationRevision, right: AuthenticationRevision) => {
+  if (
+    left.subjectId !== right.subjectId ||
+    left.securityRevision !== right.securityRevision ||
+    left.credentials.length !== right.credentials.length
+  )
+    return false;
+
+  const expected = [...left.credentials].sort((a, b) =>
+    a.credentialId.localeCompare(b.credentialId),
+  );
+
+  const actual = [...right.credentials].sort((a, b) =>
+    a.credentialId.localeCompare(b.credentialId),
+  );
+
+  return expected.every(
+    (item, index) =>
+      item.credentialId === actual[index]!.credentialId &&
+      item.revision === actual[index]!.revision,
+  );
+};
+
+const actionModule = (moduleId: string, action: EmailAction) =>
+  `${moduleId}/${action === "verify-address" ? "verify-address" : "change-address"}`;
+
+const actionPurpose = (action: EmailAction) =>
+  action === "verify-address" ? "email-address-verification" : "email-address-change";
+
+const completionMatches = (input: EmailAddressMutation, action: EmailAction) => {
+  const completion = input.completion.input;
+  const binding = completion.binding;
+
+  return (
+    completion.moduleId === actionModule(input.moduleId, action) &&
+    completion.purpose === actionPurpose(action) &&
+    binding._tag === "IdentifierChange" &&
+    sameIdentifier(binding.identifier, input.target) &&
+    sameEmailRevision(binding.revision, input.captured.revision)
+  );
+};
+
+export const snapshotEmailMutation = Effect.fn("DrizzleEmail.snapshotMutation")(function* (
+  input: EmailAddressMutation,
+) {
+  const evidence = yield* snapshotAuthenticationEvidence(input.authorization.evidence).pipe(
+    Effect.mapError(unavailable),
+  );
+
+  const requirement = yield* snapshotEmailRequirement(input.authorization.requirement);
+
+  const source =
+    input.captured.source === undefined
+      ? undefined
+      : yield* snapshotEmailCredential(input.captured.source);
+
+  return Object.freeze({
+    ...input,
+    target: Object.freeze({ ...input.target }),
+    invalidation: Object.freeze({ ...input.invalidation }),
+    captured: Object.freeze({
+      eligible: input.captured.eligible,
+      revision: snapshotEmailRevision(input.captured.revision),
+      ...(source === undefined ? {} : { source }),
+    }),
+    authorization: Object.freeze({
+      challenge: Object.freeze({
+        ...input.authorization.challenge,
+        target: Object.freeze({ ...input.authorization.challenge.target }),
+        revision: snapshotEmailRevision(input.authorization.challenge.revision),
+      }),
+      evidence,
+      requirement,
+    }),
+  });
+});
+
+export const validateEmailAuthority = Effect.fn("DrizzleEmail.validateAuthority")(function* (
+  mapping: AddressMapping,
+  configuration: EmailSqlConfiguration,
+  input: EmailAddressMutation,
+  action: EmailAction,
+) {
+  if (
+    !input.captured.eligible ||
+    !completionMatches(input, action) ||
+    input.authorization.challenge.moduleId !== input.moduleId ||
+    input.authorization.challenge.action !== action ||
+    input.authorization.challenge.commandId !== input.commandId ||
+    !sameIdentifier(input.authorization.challenge.target, input.target) ||
+    input.authorization.challenge.sourceCredentialId !== input.captured.source?.credentialId ||
+    !sameEmailRevision(input.authorization.challenge.revision, input.captured.revision) ||
+    (input.authorization.evidence.flowId as string) !== (input.commandId as string) ||
+    input.authorization.evidence.bindingDigest !== input.authorization.challenge.bindingDigest ||
+    !sameEmailRevision(input.authorization.evidence.revision, input.captured.revision) ||
+    (action === "verify-address" && input.captured.source !== undefined) ||
+    (action === "change-address" && input.captured.source === undefined) ||
+    (input.invalidation.existingSessions === "immediate" &&
+      mapping.sessionInvalidation !== "same-authority-immediate")
+  )
+    return undefined;
+
+  const current = yield* currentAddress(
+    mapping,
+    {
+      moduleId: input.moduleId,
+      subjectId: input.captured.revision.subjectId,
+      target: input.target,
+      ...(input.captured.source === undefined
+        ? {}
+        : { sourceCredentialId: input.captured.source.credentialId }),
+    },
+    configuration.locking,
+  );
+
+  if (
+    current === undefined ||
+    !current.eligible ||
+    !sameEmailRevision(current.revision, input.captured.revision) ||
+    (input.captured.source !== undefined &&
+      (current.source === undefined ||
+        current.source.snapshot.identifierRevision !== input.captured.source.identifierRevision ||
+        current.source.snapshot.credentialRevision !== input.captured.source.credentialRevision ||
+        !sameIdentifier(current.source.snapshot.identifier, input.captured.source.identifier)))
+  )
+    return undefined;
+
+  const currentRequirement = yield* mapping.subject.decodeActionRequirement(
+    current.subject,
+    action,
+  );
+
+  const original = yield* assessAuthentication(
+    input.authorization.evidence,
+    input.authorization.requirement,
+  ).pipe(Effect.mapError(unavailable));
+
+  const configured = yield* assessAuthentication(
+    input.authorization.evidence,
+    currentRequirement,
+  ).pipe(Effect.mapError(unavailable));
+
+  return original.satisfied && configured.satisfied ? current : undefined;
+});
+
+const commandExists = Effect.fn("Drizzle.commandExists")(function* (
+  mapping: AddressMapping,
+  moduleId: string,
+  commandId: string,
+  locking: boolean,
+) {
+  const database = yield* CurrentEmailSql;
+
+  const c = commandColumns(mapping);
+
+  return yield* selectRows(
+    database
+      .select()
+      .from(mapping.command.table)
+      .where(and(eq(c.moduleId, moduleId), eq(c.commandId, commandId)))
+      .limit(1),
+    locking,
+  );
+});
+
+const applyMutation = Effect.fn("DrizzleEmail.applyMutation")(function* (
+  mapping: AddressMapping,
+  input: EmailAddressMutation,
+  action: EmailAction,
+  current: CurrentAddress,
+  allocated: {
+    readonly targetCredentialId: string;
+    readonly targetIdentifierRevision: SecurityRevision;
+    readonly targetCredentialRevision: SecurityRevision;
+    readonly sourceIdentifierRevision: SecurityRevision;
+    readonly sourceCredentialRevision: SecurityRevision;
+    readonly nextSecurityRevision: SecurityRevision;
+  },
+  now: number,
+) {
+  const database = yield* CurrentEmailSql;
+
+  const i = identifierColumns(mapping);
+  const c = credentialColumns(mapping);
+  const a = authorityColumns(mapping);
+  const s = subjectColumns(mapping);
+
+  const targetCredentialId =
+    current.targetCredential?.[mapping.credential.credentialId] ?? allocated.targetCredentialId;
+
+  if (action === "change-address") {
+    const source = current.source!;
+
+    yield* database
+      .update(mapping.identifier.table)
+      .set(
+        mapping.identifier.encodeRetirement({
+          source: source.snapshot.identifier,
+          bindingRevision: allocated.sourceIdentifierRevision,
+        }),
+      )
+      .where(
+        and(
+          eq(i.namespace, source.snapshot.identifier.namespace),
+          eq(i.value, source.snapshot.identifier.value),
+          eq(i.subjectId, current.nativeSubjectId),
+          eq(i.bindingRevision, source.snapshot.identifierRevision),
+        ),
+      );
+    yield* database
+      .update(mapping.credential.table)
+      .set(
+        mapping.credential.encodeRetirement({
+          source: source.snapshot.identifier,
+          credentialRevision: allocated.sourceCredentialRevision,
+        }),
+      )
+      .where(
+        and(
+          eq(c.moduleId, input.moduleId),
+          eq(c.credentialId, source.snapshot.credentialId),
+          eq(c.subjectId, current.nativeSubjectId),
+          eq(c.credentialRevision, source.snapshot.credentialRevision),
+        ),
+      );
+    yield* database
+      .update(mapping.authorityCredential.table)
+      .set(mapping.authorityCredential.encodeRetirement(allocated.sourceCredentialRevision))
+      .where(
+        and(
+          eq(a.subjectId, current.nativeSubjectId),
+          eq(a.credentialId, source.snapshot.credentialId),
+          eq(a.revision, source.snapshot.credentialRevision),
+        ),
+      );
+  }
+  if (current.targetIdentifier === undefined) {
+    yield* database.insert(mapping.identifier.table).values(
+      mapping.identifier.encodeVerifiedInsert({
+        identifier: input.target,
+        subjectId: current.nativeSubjectId,
+        verifiedAtMillis: now,
+        bindingRevision: allocated.targetIdentifierRevision,
+      }),
+    );
+  } else {
+    yield* database
+      .update(mapping.identifier.table)
+      .set(
+        mapping.identifier.encodeVerification({
+          verifiedAtMillis: now,
+          bindingRevision: allocated.targetIdentifierRevision,
+        }),
+      )
+      .where(
+        and(
+          eq(i.namespace, input.target.namespace),
+          eq(i.value, input.target.value),
+          eq(i.subjectId, current.nativeSubjectId),
+          eq(i.bindingRevision, current.targetIdentifier![mapping.identifier.bindingRevision]),
+        ),
+      );
+  }
+  if (current.targetCredential === undefined) {
+    yield* database.insert(mapping.credential.table).values(
+      mapping.credential.encodeVerifiedInsert({
+        moduleId: input.moduleId,
+        subjectId: current.nativeSubjectId,
+        credentialId: targetCredentialId,
+        identifier: input.target,
+        credentialRevision: allocated.targetCredentialRevision,
+      }),
+    );
+    yield* database.insert(mapping.authorityCredential.table).values(
+      mapping.authorityCredential.encodeInsert({
+        subjectId: current.nativeSubjectId,
+        credentialId: targetCredentialId,
+        revision: allocated.targetCredentialRevision,
+      }),
+    );
+  } else {
+    const oldRevision = current.targetCredential[mapping.credential.credentialRevision];
+
+    yield* database
+      .update(mapping.credential.table)
+      .set(
+        mapping.credential.encodeActivation({
+          identifier: input.target,
+          credentialRevision: allocated.targetCredentialRevision,
+        }),
+      )
+      .where(
+        and(
+          eq(c.moduleId, input.moduleId),
+          eq(c.credentialId, targetCredentialId),
+          eq(c.subjectId, current.nativeSubjectId),
+          eq(c.credentialRevision, oldRevision),
+        ),
+      );
+    yield* database
+      .update(mapping.authorityCredential.table)
+      .set(mapping.authorityCredential.encodeActivation(allocated.targetCredentialRevision))
+      .where(
+        and(
+          eq(a.subjectId, current.nativeSubjectId),
+          eq(a.credentialId, targetCredentialId),
+          eq(a.revision, oldRevision),
+        ),
+      );
+  }
+  yield* database
+    .update(mapping.subject.table)
+    .set(updateValues<any>([[mapping.subject.securityRevision, allocated.nextSecurityRevision]]))
+    .where(
+      and(
+        eq(s.id, current.nativeSubjectId),
+        eq(s.securityRevision, input.captured.revision.securityRevision),
+      ),
+    );
+  yield* database.insert(mapping.command.table).values(
+    mapping.command.encodeInsert({
+      moduleId: input.moduleId,
+      commandId: input.commandId,
+      action,
+      bindingDigest: input.authorization.challenge.bindingDigest,
+      retentionUntilMillis: now + mapping.commandRetentionMillis,
+    }),
+  );
+
+  const sourceStillActive =
+    action === "verify-address"
+      ? []
+      : yield* selectRows(
+          database
+            .select()
+            .from(mapping.credential.table)
+            .where(
+              and(
+                eq(c.moduleId, input.moduleId),
+                eq(c.credentialId, current.source!.snapshot.credentialId),
+                eq(c.subjectId, current.nativeSubjectId),
+              ),
+            ),
+          false,
+        );
+
+  const target = (yield* emailLookupRows(mapping, input.moduleId, input.target))[0];
+
+  const targetAuthority = yield* selectRows(
+    database
+      .select()
+      .from(mapping.authorityCredential.table)
+      .where(and(eq(a.subjectId, current.nativeSubjectId), eq(a.credentialId, targetCredentialId)))
+      .limit(1),
+    false,
+  );
+
+  const command = yield* selectRows(
+    database
+      .select()
+      .from(mapping.command.table)
+      .where(
+        and(
+          eq(commandColumns(mapping).moduleId, input.moduleId),
+          eq(commandColumns(mapping).commandId, input.commandId),
+          eq(commandColumns(mapping).action, action),
+          eq(commandColumns(mapping).bindingDigest, input.authorization.challenge.bindingDigest),
+          eq(
+            commandColumns(mapping).retentionUntil,
+            mapping.encodeInstant(now + mapping.commandRetentionMillis),
+          ),
+        ),
+      )
+      .limit(1),
+    false,
+  );
+
+  const targetVerifiedAt =
+    target === undefined
+      ? undefined
+      : yield* mapping.decodeInstant(target.identifier[mapping.identifier.verifiedAt]);
+
+  const sourceIdentifier =
+    action === "verify-address"
+      ? []
+      : yield* identifierRow(mapping, current.source!.snapshot.identifier, false);
+
+  const sourceAuthority =
+    action === "verify-address"
+      ? []
+      : yield* selectRows(
+          database
+            .select()
+            .from(mapping.authorityCredential.table)
+            .where(
+              and(
+                eq(a.subjectId, current.nativeSubjectId),
+                eq(a.credentialId, current.source!.snapshot.credentialId),
+              ),
+            )
+            .limit(1),
+          false,
+        );
+
+  return (
+    target !== undefined &&
+    mapping.subjectId.equals(target.subject[mapping.subject.id], current.nativeSubjectId) &&
+    mapping.subject.isActiveStatus(target.subject[mapping.subject.status]) &&
+    target.subject[mapping.subject.securityRevision] === allocated.nextSecurityRevision &&
+    target.identifier[mapping.identifier.bindingRevision] === allocated.targetIdentifierRevision &&
+    targetVerifiedAt === now &&
+    target.credential[mapping.credential.credentialRevision] ===
+      allocated.targetCredentialRevision &&
+    target.credential[mapping.credential.credentialId] === targetCredentialId &&
+    mapping.subjectId.equals(
+      target.credential[mapping.credential.subjectId],
+      current.nativeSubjectId,
+    ) &&
+    mapping.identifier.isCurrent(target.identifier) &&
+    mapping.credential.isActiveStatus(target.credential[mapping.credential.status]) &&
+    targetAuthority.length === 1 &&
+    targetAuthority[0]![mapping.authorityCredential.revision] ===
+      allocated.targetCredentialRevision &&
+    mapping.authorityCredential.isActiveStatus(
+      targetAuthority[0]![mapping.authorityCredential.status],
+    ) &&
+    command.length === 1 &&
+    (action === "verify-address" ||
+      (sourceStillActive.length === 1 &&
+        sourceStillActive[0]![mapping.credential.credentialRevision] ===
+          allocated.sourceCredentialRevision &&
+        !mapping.credential.isActiveStatus(sourceStillActive[0]![mapping.credential.status]) &&
+        sourceIdentifier.length === 1 &&
+        mapping.subjectId.equals(
+          sourceIdentifier[0]![mapping.identifier.subjectId],
+          current.nativeSubjectId,
+        ) &&
+        sourceIdentifier[0]![mapping.identifier.bindingRevision] ===
+          allocated.sourceIdentifierRevision &&
+        !mapping.identifier.isCurrent(sourceIdentifier[0]!) &&
+        sourceAuthority.length === 1 &&
+        sourceAuthority[0]![mapping.authorityCredential.revision] ===
+          allocated.sourceCredentialRevision &&
+        !mapping.authorityCredential.isActiveStatus(
+          sourceAuthority[0]![mapping.authorityCredential.status],
+        )))
+  );
+});
+
+const probeProofCompletion = Effect.fn("Drizzle.probeProofCompletion")(function* (
+  configuration: EmailSqlConfiguration,
+  input: ProofCompletionInput,
+) {
+  const database = yield* CurrentEmailSql;
+
+  if (configuration.proof === undefined) return yield* Effect.fail(unavailable());
+  const validProbe = { _tag: "EmailProofCompletionValid" } as const;
+
+  const plan = {
+    input,
+    prepare: <A>(
+      decision: ProofCompletionDecision,
+      journal: CommitJournal,
+      project: (decision: ProofCompletionDecision) => A,
+    ) => journal.prepare(project(decision)),
+  };
+
+  const probe = coordinateCommit(
+    () =>
+      database.transaction((transaction) =>
+        completeProofPlanIn(
+          configuration.proof!.mapping,
+          configuration.proof!.configuration,
+          plan,
+          Effect.fail(validProbe),
+          () => false,
+        ).pipe(Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase)),
+      ),
+    { mode: configuration.mode },
+  );
+
+  return yield* probe.pipe(
+    Effect.as(false),
+    Effect.catchCause((cause) => {
+      const reason = cause.reasons[0];
+
+      return cause.reasons.length === 1 &&
+        reason !== undefined &&
+        Cause.isFailReason(reason) &&
+        reason.error === validProbe
+        ? Effect.succeed(true)
+        : Effect.failCause(cause);
+    }),
+  );
+});
+
+const prepareRejected = Effect.fn("Drizzle.prepareRejected")(function* <A>(
+  configuration: EmailSqlConfiguration,
+  prepare: (value: "rejected", journal: CommitJournal) => PreparedCommit<A>,
+) {
+  const database = yield* CurrentEmailSql;
+
+  return yield* owned(
+    database,
+    configuration,
+    Effect.gen(function* () {
+      const journal = yield* CurrentCommitJournal;
+
+      return yield* Effect.succeed(prepare("rejected", journal));
+    }),
+  );
+});
+
+export const makeSqlEmailAddressPersistence = Effect.fn("makeSqlEmailAddressPersistence")(
+  function* (
+    database: EmailSqlDatabase,
+    mapping: AddressMapping,
+    configuration: EmailSqlConfiguration,
+  ): Effect.fn.Return<EmailAddressPersistence["Service"], never, LifecycleHooks> {
+    const hooks = yield* LifecycleHooks;
+
+    return EmailAddressPersistence.of({
+      target: (input) =>
+        (validAddressConstraints(mapping)
+          ? safeRead(
+              database,
+              configuration,
+              Effect.gen(function* () {
+                const current = yield* currentAddress(mapping, input, configuration.locking);
+
+                if (current === undefined) return yield* unavailable();
+
+                return Object.freeze({
+                  revision: snapshotEmailRevision(current.revision),
+                  eligible: current.eligible,
+                  ...(current.source === undefined
+                    ? {}
+                    : { source: yield* snapshotEmailCredential(current.source.snapshot) }),
+                });
+              }),
+            )
+          : Effect.fail(unavailable())
+        ).pipe(
+          Effect.provideService(CurrentEmailSql, database),
+          Effect.provideService(LifecycleHooks, hooks),
+          translateFailure,
+        ),
+      checkCompletion: (input) => {
+        if (configuration.proof === undefined || input.binding._tag !== "IdentifierChange")
+          return Effect.succeed(false).pipe(
+            Effect.provideService(CurrentEmailSql, database),
+            Effect.provideService(LifecycleHooks, hooks),
+            translateFailure,
+          );
+        const binding = input.binding;
+
+        return safeRead(
+          database,
+          configuration,
+          Effect.gen(function* () {
+            const action: EmailAction | undefined =
+              input.moduleId.endsWith("/verify-address") &&
+              input.purpose === "email-address-verification"
+                ? "verify-address"
+                : input.moduleId.endsWith("/change-address") &&
+                    input.purpose === "email-address-change"
+                  ? "change-address"
+                  : undefined;
+
+            if (action === undefined) return false;
+            const moduleId = input.moduleId.slice(0, -`/${action}`.length);
+
+            const current = yield* currentAddress(
+              mapping,
+              {
+                moduleId,
+                subjectId: binding.revision.subjectId,
+                target: binding.identifier,
+              },
+              false,
+            );
+
+            return current !== undefined && sameEmailRevision(current.revision, binding.revision);
+          }),
+        )
+          .pipe(
+            Effect.flatMap((current) =>
+              current ? probeProofCompletion(configuration, input) : Effect.succeed(false),
+            ),
+          )
+          .pipe(
+            Effect.provideService(CurrentEmailSql, database),
+            Effect.provideService(LifecycleHooks, hooks),
+            translateFailure,
+          );
+      },
+      verifyWithProof: (uncaptured, prepare) =>
+        mutateAddress(mapping, configuration, uncaptured, "verify-address", prepare).pipe(
+          Effect.provideService(CurrentEmailSql, database),
+          Effect.provideService(LifecycleHooks, hooks),
+          translateFailure,
+        ),
+      changeWithProof: (uncaptured, prepare) =>
+        mutateAddress(mapping, configuration, uncaptured, "change-address", prepare).pipe(
+          Effect.provideService(CurrentEmailSql, database),
+          Effect.provideService(LifecycleHooks, hooks),
+          translateFailure,
+        ),
+      cleanup: (input, prepare) =>
+        owned(
+          database,
+          configuration,
+          Effect.gen(function* () {
+            const transaction = yield* CurrentEmailSql;
+            const journal = yield* CurrentCommitJournal;
+
+            const c = commandColumns(mapping);
+            const now = yield* nowMillis;
+
+            const rows = yield* selectRows(
+              transaction
+                .select({ commandId: c.commandId })
+                .from(mapping.command.table)
+                .where(
+                  and(
+                    eq(c.moduleId, input.moduleId),
+                    lte(c.retentionUntil, mapping.encodeInstant(now)),
+                  ),
+                )
+                .limit(input.limit + 1),
+              configuration.locking,
+            );
+
+            const selected = rows.slice(0, input.limit);
+
+            const receipt = prepare(
+              { removed: selected.length, hasMore: rows.length > input.limit },
+              journal,
+            );
+
+            if (selected.length > 0)
+              yield* transaction.delete(mapping.command.table).where(
+                and(
+                  eq(c.moduleId, input.moduleId),
+                  inArray(
+                    c.commandId,
+                    selected.map((row: any) => row.commandId),
+                  ),
+                  lte(c.retentionUntil, mapping.encodeInstant(now)),
+                ),
+              );
+
+            return receipt;
+          }),
+        ).pipe(
+          Effect.provideService(CurrentEmailSql, database),
+          Effect.provideService(LifecycleHooks, hooks),
+          translateFailure,
+        ),
+    });
+  },
+);
+
+const mutateAddress = Effect.fn("Drizzle.mutateAddress")(function* <A>(
+  mapping: AddressMapping,
+  configuration: EmailSqlConfiguration,
+  uncaptured: EmailAddressMutation,
+  action: EmailAction,
+  prepare: (value: "changed" | "rejected", journal: CommitJournal) => PreparedCommit<A>,
+) {
+  const database = yield* CurrentEmailSql;
+
+  if (!validAddressConstraints(mapping) || configuration.proof === undefined)
+    return yield* unavailable();
+  const input = yield* snapshotEmailMutation(uncaptured);
+
+  const targetCredentialId = yield* allocate(
+    configuration.mode,
+    mapping.allocateCredentialId,
+    mapping.allocateCredentialIdSync,
+  );
+
+  const targetIdentifierRevision = yield* allocate(
+    configuration.mode,
+    mapping.allocateRevision,
+    mapping.allocateRevisionSync,
+  );
+
+  const targetCredentialRevision = yield* allocate(
+    configuration.mode,
+    mapping.allocateRevision,
+    mapping.allocateRevisionSync,
+  );
+
+  const sourceIdentifierRevision = yield* allocate(
+    configuration.mode,
+    mapping.allocateRevision,
+    mapping.allocateRevisionSync,
+  );
+
+  const sourceCredentialRevision = yield* allocate(
+    configuration.mode,
+    mapping.allocateRevision,
+    mapping.allocateRevisionSync,
+  );
+
+  const nextRevision = yield* nextSecurityRevision(
+    mapping,
+    configuration.mode,
+    input.captured.revision.securityRevision,
+  );
+
+  if (
+    nextRevision === input.captured.revision.securityRevision ||
+    [
+      targetIdentifierRevision,
+      targetCredentialRevision,
+      sourceIdentifierRevision,
+      sourceCredentialRevision,
+    ].some((value) => input.captured.revision.credentials.some((item) => item.revision === value))
+  )
+    return yield* unavailable();
+
+  const run = owned(
+    database,
+    configuration,
+    Effect.gen(function* () {
+      const journal = yield* CurrentCommitJournal;
+
+      const current = yield* validateEmailAuthority(mapping, configuration, input, action);
+
+      if (current === undefined) return prepare("rejected", journal);
+      if (
+        (yield* commandExists(mapping, input.moduleId, input.commandId, configuration.locking))
+          .length > 0
+      )
+        return prepare("rejected", journal);
+      let receipt: PreparedCommit<A> | undefined;
+
+      yield* completeProofPlanIn(
+        configuration.proof!.mapping,
+        configuration.proof!.configuration,
+        input.completion,
+        Effect.gen(function* () {
+          // The proof helper may wait on continuation/series locks. Read the
+          // commit clock and reassess both policies only after those locks.
+          const currentRequirement = yield* mapping.subject.decodeActionRequirement(
+            current.subject,
+            action,
+          );
+
+          const original = yield* assessAuthentication(
+            input.authorization.evidence,
+            input.authorization.requirement,
+          ).pipe(Effect.mapError(unavailable));
+
+          const configured = yield* assessAuthentication(
+            input.authorization.evidence,
+            currentRequirement,
+          ).pipe(Effect.mapError(unavailable));
+
+          if (!original.satisfied || !configured.satisfied) return false;
+          const now = yield* nowMillis;
+
+          return yield* applyMutation(
+            mapping,
+            input,
+            action,
+            current,
+            {
+              targetCredentialId,
+              targetIdentifierRevision,
+              targetCredentialRevision,
+              sourceIdentifierRevision,
+              sourceCredentialRevision,
+              nextSecurityRevision: nextRevision,
+            },
+            now,
+          );
+        }),
+        (decision) => {
+          receipt = prepare(decision === "completed" ? "changed" : "rejected", journal);
+
+          return decision;
+        },
+      );
+
+      return receipt ?? prepare("rejected", journal);
+    }),
+  );
+
+  return yield* run.pipe(
+    Effect.catchCause((cause) =>
+      (cause.reasons.every(Cause.isFailReason) &&
+        isMappedConstraintConflict(mapping.isCommandConflict, cause)) ||
+      (cause.reasons.every(Cause.isFailReason) &&
+        isMappedConstraintConflict(mapping.isIdentifierConflict, cause)) ||
+      (cause.reasons.every(Cause.isFailReason) &&
+        isMappedConstraintConflict(mapping.isCredentialConflict, cause))
+        ? prepareRejected(configuration, prepare)
+        : Effect.failCause(cause),
+    ),
+  );
+});