@yielded/auth 0.1.0-beta.1

package/src/drizzle/proof-sql.ts

@@ -0,0 +1,1912 @@
+/* oxlint-disable no-explicit-any -- Drizzle erases consumer table types inside the shared dialect kernel. */
+import { and, eq, gte, inArray, isNull, lte, notExists, sql, type Table } from "drizzle-orm";
+import type { EffectDrizzleQueryError } from "drizzle-orm/effect-core";
+import { Cause, Context, DateTime, Effect, Option, Schema } from "effect";
+import type * as SqlError from "effect/unstable/sql/SqlError";
+
+import { coordinateCommit, CurrentCommitJournal, hasCommitScope } from "../hooks/commit";
+import { LifecycleHooks } from "../hooks/LifecycleHooks";
+import { HookConfigurationError } from "../hooks/models";
+import { reportPersistenceFailure } from "../internal/diagnostics";
+import type { ProofCompletionPlan } from "../proofs/completion";
+import { ProofRequestConflict, ProofUnavailable } from "../proofs/errors";
+import {
+  ProofBinding,
+  type ProofAttemptDecision,
+  type ProofCleanupResult,
+  type ProofCompletionDecision,
+  type ProofDeliveryOutcome,
+  type ProofVersion,
+} from "../proofs/models";
+import type { ProofBudget, ProofPolicy } from "../proofs/policy";
+import { ProofPersistence, type ProofDeliveryClaim } from "../proofs/ProofPersistence";
+import { column, DrizzleMappingError, updateValues } from "./model";
+import {
+  CurrentPasswordPreparedTransaction,
+  PasswordPreparedPostconditions,
+} from "./PasswordPreparedPostconditions";
+import {
+  type AnyProofPersistenceMapping,
+  requiredProofConstraints,
+  type ProofPersistenceMapping,
+  type ProofAction,
+  type ProofCommandDecision,
+  type ProofContinuationRecord,
+  type ProofScopeKeys,
+  type ProofScopeKind,
+} from "./proof-model";
+
+type AdapterFailure = EffectDrizzleQueryError | DrizzleMappingError | SqlError.SqlError;
+
+export interface ProofSqlQuery<A = ReadonlyArray<any>> extends Effect.Effect<A, AdapterFailure> {
+  readonly getSQL: () => ReturnType<typeof sql>;
+  readonly from: (...args: ReadonlyArray<any>) => ProofSqlQuery<A>;
+  readonly where: (...args: ReadonlyArray<any>) => ProofSqlQuery<A>;
+  readonly limit: (...args: ReadonlyArray<any>) => ProofSqlQuery<A>;
+  readonly orderBy: (...args: ReadonlyArray<any>) => ProofSqlQuery<A>;
+  readonly for: (...args: ReadonlyArray<any>) => ProofSqlQuery<A>;
+  readonly set: (...args: ReadonlyArray<any>) => ProofSqlQuery<A>;
+  readonly values: (...args: ReadonlyArray<any>) => ProofSqlQuery<A>;
+  readonly onConflictDoNothing: (...args: ReadonlyArray<any>) => ProofSqlQuery<A>;
+  readonly onDuplicateKeyUpdate: (...args: ReadonlyArray<any>) => ProofSqlQuery<A>;
+}
+
+export interface ProofSqlDatabase {
+  readonly select: (...args: ReadonlyArray<any>) => ProofSqlQuery;
+  readonly insert: (...args: ReadonlyArray<any>) => ProofSqlQuery;
+  readonly update: (...args: ReadonlyArray<any>) => ProofSqlQuery;
+  readonly delete: (...args: ReadonlyArray<any>) => ProofSqlQuery;
+  readonly transaction: <A, E, R>(
+    body: (transaction: ProofSqlDatabase) => Effect.Effect<A, E, R>,
+  ) => Effect.Effect<A, E | SqlError.SqlError, R>;
+}
+
+export class CurrentProofSql extends Context.Service<CurrentProofSql, ProofSqlDatabase>()(
+  "effect-auth/CurrentProofSql",
+) {}
+
+export interface ProofSqlConfiguration {
+  readonly mode: "interactive" | "synchronous";
+  readonly locking: boolean;
+  readonly standaloneGuard: Effect.Effect<void, ProofUnavailable>;
+  readonly coordinated?: boolean;
+  /** Dialect-native insert-if-absent used to create serialization anchors. */
+  readonly insertIfAbsent: (
+    query: ProofSqlQuery,
+    selfKey: string,
+    selfValue: unknown,
+  ) => ProofSqlQuery;
+}
+
+type Database = ProofSqlDatabase;
+type Mapping = AnyProofPersistenceMapping;
+const unavailable = () => ProofUnavailable.make({});
+
+const translateFailure = <A, E, R>(
+  effect: Effect.Effect<A, E, R>,
+): Effect.Effect<A, ProofUnavailable, R> =>
+  reportPersistenceFailure(
+    effect,
+    (error) => Schema.is(ProofUnavailable)(error) || Schema.is(HookConfigurationError)(error),
+  ).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));
+
+const translateIssueFailure = <A, E, R>(
+  effect: Effect.Effect<A, E, R>,
+): Effect.Effect<A, ProofUnavailable | ProofRequestConflict, R> =>
+  reportPersistenceFailure(
+    effect,
+    (error) =>
+      Schema.is(ProofUnavailable)(error) ||
+      Schema.is(ProofRequestConflict)(error) ||
+      Schema.is(HookConfigurationError)(error),
+  ).pipe(
+    Effect.catchCause((cause) =>
+      Effect.failCause(
+        Cause.map(cause, (error) =>
+          Schema.is(ProofRequestConflict)(error) ? error : unavailable(),
+        ),
+      ),
+    ),
+  );
+
+const conflict = () => ProofRequestConflict.make({});
+
+const validConstraints = (mapping: Mapping) =>
+  Object.entries(requiredProofConstraints).every(
+    ([key, value]) => mapping.constraints[key as keyof typeof requiredProofConstraints] === value,
+  );
+
+const selectRows = (query: ProofSqlQuery, locking: boolean) =>
+  locking && typeof query.for === "function" ? query.for("update") : query;
+
+const allocateVersion = (
+  mapping: Mapping,
+  mode: ProofSqlConfiguration["mode"],
+): Effect.Effect<ProofVersion, ProofUnavailable | DrizzleMappingError> => {
+  if (mode === "synchronous")
+    return mapping.allocateVersionSync === undefined
+      ? Effect.fail(unavailable())
+      : Effect.try({
+          try: mapping.allocateVersionSync,
+          catch: (cause) => new DrizzleMappingError({ operation: "mapping", cause }),
+        });
+  if (mapping.allocateVersion !== undefined) return mapping.allocateVersion;
+
+  return mapping.allocateVersionSync === undefined
+    ? Effect.fail(unavailable())
+    : Effect.try({
+        try: mapping.allocateVersionSync,
+        catch: (cause) => new DrizzleMappingError({ operation: "mapping", cause }),
+      });
+};
+
+const canonicalBinding = Schema.encodeSync(Schema.fromJsonString(ProofBinding));
+
+const sameBinding = (left: ProofBinding, right: ProofBinding): boolean =>
+  canonicalBinding(left) === canonicalBinding(right);
+
+const requestColumns = (mapping: Mapping) => ({
+  moduleId: column(mapping.request.table, mapping.request.moduleId),
+  requestId: column(mapping.request.table, mapping.request.requestId),
+  fingerprint: column(mapping.request.table, mapping.request.fingerprint),
+  proofId: column(mapping.request.table, mapping.request.proofId),
+  retentionUntil: column(mapping.request.table, mapping.request.retentionUntil),
+});
+
+const seriesColumns = (mapping: Mapping) => ({
+  moduleId: column(mapping.series.table, mapping.series.moduleId),
+  purpose: column(mapping.series.table, mapping.series.purpose),
+  scopeKey: column(mapping.series.table, mapping.series.scopeKey),
+  activeProofId: column(mapping.series.table, mapping.series.activeProofId),
+  lastIssueAt: column(mapping.series.table, mapping.series.lastIssueAt),
+  version: column(mapping.series.table, mapping.series.version),
+});
+
+const generationColumns = (mapping: Mapping) => ({
+  moduleId: column(mapping.generation.table, mapping.generation.moduleId),
+  purpose: column(mapping.generation.table, mapping.generation.purpose),
+  proofId: column(mapping.generation.table, mapping.generation.proofId),
+  requestId: column(mapping.generation.table, mapping.generation.requestId),
+  seriesKey: column(mapping.generation.table, mapping.generation.seriesKey),
+  deliveryId: column(mapping.generation.table, mapping.generation.deliveryId),
+  verifierKeyId: column(mapping.generation.table, mapping.generation.verifierKeyId),
+  verifierDigest: column(mapping.generation.table, mapping.generation.verifierDigest),
+  issuedAt: column(mapping.generation.table, mapping.generation.issuedAt),
+  expiresAt: column(mapping.generation.table, mapping.generation.expiresAt),
+  version: column(mapping.generation.table, mapping.generation.version),
+  state: column(mapping.generation.table, mapping.generation.state),
+  sendCount: column(mapping.generation.table, mapping.generation.sendCount),
+  deliveryState: column(mapping.generation.table, mapping.generation.deliveryState),
+  claimVersion: column(mapping.generation.table, mapping.generation.claimVersion),
+  claimDeadline: column(mapping.generation.table, mapping.generation.claimDeadline),
+  retryAt: column(mapping.generation.table, mapping.generation.retryAt),
+  deliveryRetryMillis: column(mapping.generation.table, mapping.generation.deliveryRetryMillis),
+  retentionUntil: column(mapping.generation.table, mapping.generation.retentionUntil),
+});
+
+const continuationColumns = (mapping: Mapping) => ({
+  moduleId: column(mapping.continuation.table, mapping.continuation.moduleId),
+  purpose: column(mapping.continuation.table, mapping.continuation.purpose),
+  continuationId: column(mapping.continuation.table, mapping.continuation.continuationId),
+  digest: column(mapping.continuation.table, mapping.continuation.digest),
+  proofId: column(mapping.continuation.table, mapping.continuation.proofId),
+  seriesKey: column(mapping.continuation.table, mapping.continuation.seriesKey),
+  expiresAt: column(mapping.continuation.table, mapping.continuation.expiresAt),
+  consumed: column(mapping.continuation.table, mapping.continuation.consumed),
+  version: column(mapping.continuation.table, mapping.continuation.version),
+  retentionUntil: column(mapping.continuation.table, mapping.continuation.retentionUntil),
+});
+
+const scopeColumns = (mapping: Mapping) => ({
+  moduleId: column(mapping.rateScope.table, mapping.rateScope.moduleId),
+  purpose: column(mapping.rateScope.table, mapping.rateScope.purpose),
+  action: column(mapping.rateScope.table, mapping.rateScope.action),
+  scopeKind: column(mapping.rateScope.table, mapping.rateScope.scopeKind),
+  scopeKey: column(mapping.rateScope.table, mapping.rateScope.scopeKey),
+});
+
+const abuseColumns = (mapping: Mapping) => ({
+  moduleId: column(mapping.abuseEvent.table, mapping.abuseEvent.moduleId),
+  purpose: column(mapping.abuseEvent.table, mapping.abuseEvent.purpose),
+  action: column(mapping.abuseEvent.table, mapping.abuseEvent.action),
+  scopeKind: column(mapping.abuseEvent.table, mapping.abuseEvent.scopeKind),
+  scopeKey: column(mapping.abuseEvent.table, mapping.abuseEvent.scopeKey),
+  commandId: column(mapping.abuseEvent.table, mapping.abuseEvent.commandId),
+  occurredAt: column(mapping.abuseEvent.table, mapping.abuseEvent.occurredAt),
+  retentionUntil: column(mapping.abuseEvent.table, mapping.abuseEvent.retentionUntil),
+});
+
+const failureColumns = (mapping: Mapping) => ({
+  moduleId: column(mapping.failureEvent.table, mapping.failureEvent.moduleId),
+  purpose: column(mapping.failureEvent.table, mapping.failureEvent.purpose),
+  seriesKey: column(mapping.failureEvent.table, mapping.failureEvent.seriesKey),
+  commandId: column(mapping.failureEvent.table, mapping.failureEvent.commandId),
+  occurredAt: column(mapping.failureEvent.table, mapping.failureEvent.occurredAt),
+  retentionUntil: column(mapping.failureEvent.table, mapping.failureEvent.retentionUntil),
+});
+
+const commandColumns = (mapping: Mapping) => ({
+  moduleId: column(mapping.command.table, mapping.command.moduleId),
+  commandId: column(mapping.command.table, mapping.command.commandId),
+  kind: column(mapping.command.table, mapping.command.kind),
+  decision: column(mapping.command.table, mapping.command.decision),
+  retentionUntil: column(mapping.command.table, mapping.command.retentionUntil),
+});
+
+const nowMillis = DateTime.now.pipe(Effect.map(DateTime.toEpochMillis));
+
+const lockAuthority = Effect.fn("DrizzleProof.lockAuthority")(function* (
+  mapping: Mapping,
+  moduleId: string,
+  purpose: any,
+  binding: ProofBinding,
+  locking: boolean,
+) {
+  const database = yield* CurrentProofSql;
+
+  const authority = mapping.authority;
+  let nativeSubjectId: unknown | undefined;
+
+  // Canonical order: subject, identifier rows, credentials sorted by ID.
+  if (binding._tag !== "Identifier") {
+    if (
+      authority.subject === undefined ||
+      authority.credential === undefined ||
+      authority.subjectId === undefined
+    )
+      return yield* unavailable();
+    nativeSubjectId = yield* authority.subjectId.toNative(binding.revision.subjectId);
+    const subject = authority.subject;
+
+    const rows = yield* selectRows(
+      database
+        .select()
+        .from(subject.table)
+        .where(eq(column(subject.table, subject.id), nativeSubjectId))
+        .limit(1),
+      locking,
+    );
+
+    const row = rows[0];
+
+    if (
+      row === undefined ||
+      !subject.isActiveStatus(row[subject.status]) ||
+      row[subject.securityRevision] !== binding.revision.securityRevision
+    )
+      return false;
+  }
+  const identifier = authority.identifier;
+
+  const identifierRows = yield* selectRows(
+    database
+      .select()
+      .from(identifier.table)
+      .where(
+        and(
+          eq(column(identifier.table, identifier.namespace), binding.identifier.namespace),
+          eq(column(identifier.table, identifier.value), binding.identifier.value),
+        ),
+      ),
+    locking,
+  );
+
+  if (
+    !identifier.isCurrent(
+      { moduleId, purpose, binding, ...(nativeSubjectId === undefined ? {} : { nativeSubjectId }) },
+      identifierRows,
+    )
+  )
+    return false;
+  if (binding._tag === "Identifier") return true;
+  const credential = authority.credential!;
+
+  const expected = [...binding.revision.credentials].sort((a, b) =>
+    a.credentialId.localeCompare(b.credentialId),
+  );
+
+  const rows =
+    expected.length === 0
+      ? []
+      : yield* selectRows(
+          database
+            .select()
+            .from(credential.table)
+            .where(
+              and(
+                eq(column(credential.table, credential.subjectId), nativeSubjectId),
+                inArray(
+                  column(credential.table, credential.credentialId),
+                  expected.map((item) => item.credentialId),
+                ),
+              ),
+            ),
+          locking,
+        );
+
+  if (rows.length !== expected.length) return false;
+
+  const actual = rows
+    .map((row: any) => ({
+      credentialId: row[credential.credentialId] as string,
+      revision: row[credential.revision],
+      active:
+        credential.status === undefined ||
+        credential.isActiveStatus?.(row[credential.status]) === true,
+    }))
+    .sort((a: any, b: any) => a.credentialId.localeCompare(b.credentialId));
+
+  return actual.every(
+    (item: any, index: number) =>
+      item.active &&
+      item.credentialId === expected[index]?.credentialId &&
+      item.revision === expected[index]?.revision,
+  );
+});
+
+interface ScopeEntry {
+  readonly kind: ProofScopeKind;
+  readonly key: string;
+  readonly budget: ProofBudget;
+}
+
+const scopeEntries = (
+  keys: ProofScopeKeys,
+  binding: ProofBinding,
+  action: ProofAction,
+  policy: ProofPolicy,
+): ReadonlyArray<ScopeEntry> => {
+  const suffix = action === "issue" ? "Issues" : "Attempts";
+  const simple = action === "issue" ? "issues" : "attempts";
+
+  const entries: ScopeEntry[] = [
+    { kind: "action", key: "*", budget: policy.abuse[`action${suffix}`] },
+    { kind: "identifier", key: keys.identifier, budget: policy.abuse[simple] },
+  ];
+
+  if (binding._tag !== "Identifier")
+    entries.push({
+      kind: "subject",
+      key: keys.subject,
+      budget: policy.abuse[`subject${suffix}`],
+    });
+
+  return entries;
+};
+
+const lockScopes = Effect.fn("DrizzleProof.lockScopes")(function* (
+  mapping: Mapping,
+  configuration: ProofSqlConfiguration,
+  moduleId: string,
+  purpose: any,
+  action: ProofAction,
+  entries: ReadonlyArray<ScopeEntry>,
+) {
+  const database = yield* CurrentProofSql;
+
+  const c = scopeColumns(mapping);
+
+  for (const entry of entries) {
+    const values = mapping.rateScope.encodeInsert({
+      moduleId,
+      purpose,
+      action,
+      scopeKind: entry.kind,
+      scopeKey: entry.key,
+    });
+
+    const query = database.insert(mapping.rateScope.table).values(values);
+
+    yield* configuration.insertIfAbsent(query, mapping.rateScope.scopeKey, entry.key);
+    yield* selectRows(
+      database
+        .select()
+        .from(mapping.rateScope.table)
+        .where(
+          and(
+            eq(c.moduleId, moduleId),
+            eq(c.purpose, purpose),
+            eq(c.action, action),
+            eq(c.scopeKind, entry.kind),
+            eq(c.scopeKey, entry.key),
+          ),
+        )
+        .limit(1),
+      configuration.locking,
+    );
+  }
+});
+
+const admittedScopes = Effect.fn("DrizzleProof.admittedScopes")(function* (
+  mapping: Mapping,
+  moduleId: string,
+  purpose: any,
+  action: ProofAction,
+  entries: ReadonlyArray<ScopeEntry>,
+  now: number,
+) {
+  const database = yield* CurrentProofSql;
+
+  const c = abuseColumns(mapping);
+  const admitted: ScopeEntry[] = [];
+
+  for (const entry of entries) {
+    const rows = yield* selectRows(
+      database
+        .select({ commandId: c.commandId })
+        .from(mapping.abuseEvent.table)
+        .where(
+          and(
+            eq(c.moduleId, moduleId),
+            eq(c.purpose, purpose),
+            eq(c.action, action),
+            eq(c.scopeKind, entry.kind),
+            eq(c.scopeKey, entry.key),
+            gte(c.occurredAt, mapping.encodeInstant(now - entry.budget.windowMillis)),
+          ),
+        )
+        .limit(entry.budget.limit),
+      true,
+    );
+
+    if (rows.length < entry.budget.limit) admitted.push(entry);
+  }
+
+  return admitted;
+});
+
+const insertScopeEvents = Effect.fn("Drizzle.insertScopeEvents")(function* (
+  mapping: Mapping,
+  moduleId: string,
+  purpose: any,
+  action: ProofAction,
+  commandId: string,
+  entries: ReadonlyArray<ScopeEntry>,
+  now: number,
+  retentionUntil: number,
+) {
+  const database = yield* CurrentProofSql;
+
+  return yield* Effect.forEach(
+    entries,
+    (entry) =>
+      database.insert(mapping.abuseEvent.table).values(
+        mapping.abuseEvent.encodeInsert({
+          moduleId,
+          purpose,
+          action,
+          scopeKind: entry.kind,
+          scopeKey: entry.key,
+          commandId,
+          occurredAtMillis: now,
+          retentionUntilMillis: retentionUntil,
+        }),
+      ),
+    { discard: true },
+  );
+});
+
+const ensureSeries = Effect.fn("DrizzleProof.ensureSeries")(function* (
+  mapping: Mapping,
+  configuration: ProofSqlConfiguration,
+  moduleId: string,
+  purpose: any,
+  scopeKey: string,
+) {
+  const database = yield* CurrentProofSql;
+
+  const c = seriesColumns(mapping);
+  const initialVersion = yield* allocateVersion(mapping, configuration.mode);
+
+  const query = database
+    .insert(mapping.series.table)
+    .values(mapping.series.encodeInsert({ moduleId, purpose, scopeKey, version: initialVersion }));
+
+  yield* configuration.insertIfAbsent(query, mapping.series.scopeKey, scopeKey);
+
+  const rows = yield* selectRows(
+    database
+      .select()
+      .from(mapping.series.table)
+      .where(and(eq(c.moduleId, moduleId), eq(c.purpose, purpose), eq(c.scopeKey, scopeKey)))
+      .limit(1),
+    configuration.locking,
+  );
+
+  return rows[0] ?? (yield* unavailable());
+});
+
+const readGeneration = Effect.fn("Drizzle.readGeneration")(function* (
+  mapping: Mapping,
+  moduleId: string,
+  proofId: string,
+  locking: boolean,
+) {
+  const database = yield* CurrentProofSql;
+
+  const c = generationColumns(mapping);
+
+  return yield* selectRows(
+    database
+      .select()
+      .from(mapping.generation.table)
+      .where(and(eq(c.moduleId, moduleId), eq(c.proofId, proofId)))
+      .limit(1),
+    locking,
+  );
+});
+
+const failureCount = Effect.fn("DrizzleProof.failureCount")(function* (
+  mapping: Mapping,
+  moduleId: string,
+  purpose: any,
+  seriesKey: string,
+  now: number,
+  policy: ProofPolicy,
+) {
+  const database = yield* CurrentProofSql;
+
+  const c = failureColumns(mapping);
+
+  const rows = yield* selectRows(
+    database
+      .select({ commandId: c.commandId })
+      .from(mapping.failureEvent.table)
+      .where(
+        and(
+          eq(c.moduleId, moduleId),
+          eq(c.purpose, purpose),
+          eq(c.seriesKey, seriesKey),
+          gte(c.occurredAt, mapping.encodeInstant(now - policy.abuse.attempts.windowMillis)),
+        ),
+      )
+      .limit(policy.maximumFailedAttempts),
+    true,
+  );
+
+  return rows.length;
+});
+
+const commandRow = Effect.fn("Drizzle.commandRow")(function* (
+  mapping: Mapping,
+  moduleId: string,
+  commandId: string,
+  locking: boolean,
+) {
+  const database = yield* CurrentProofSql;
+
+  const c = commandColumns(mapping);
+
+  return yield* selectRows(
+    database
+      .select()
+      .from(mapping.command.table)
+      .where(and(eq(c.moduleId, moduleId), eq(c.commandId, commandId)))
+      .limit(1),
+    locking,
+  );
+});
+
+const insertCommand = Effect.fn("Drizzle.insertCommand")(function* (
+  mapping: Mapping,
+  moduleId: string,
+  commandId: string,
+  kind: "attempt" | "complete",
+  decision: ProofCommandDecision,
+  retentionUntil: number,
+) {
+  const database = yield* CurrentProofSql;
+
+  return yield* database.insert(mapping.command.table).values(
+    mapping.command.encodeInsert({
+      moduleId,
+      commandId,
+      kind,
+      decision,
+      retentionUntilMillis: retentionUntil,
+    }),
+  );
+});
+
+const owned = <A, E, R>(
+  database: Database,
+  mapping: Mapping,
+  configuration: ProofSqlConfiguration,
+  body: Effect.Effect<A, E, R>,
+) => {
+  if (!validConstraints(mapping)) return Effect.fail(unavailable());
+
+  const run = coordinateCommit(
+    () =>
+      database.transaction((transaction) =>
+        body.pipe(Effect.provideService(CurrentProofSql, transaction)),
+      ),
+    { mode: configuration.mode },
+  ).pipe(Effect.map((result) => result.value));
+
+  return configuration.coordinated !== true
+    ? Effect.gen(function* () {
+        if (yield* hasCommitScope) return yield* unavailable();
+        yield* configuration.standaloneGuard;
+
+        return yield* run;
+      })
+    : run;
+};
+
+export const makeSqlProofPersistence = Effect.fn("makeSqlProofPersistence")(function* (
+  database: Database,
+  mapping: Mapping,
+  configuration: ProofSqlConfiguration,
+): Effect.fn.Return<ProofPersistence["Service"], never, LifecycleHooks> {
+  const hooks = yield* LifecycleHooks;
+
+  return ProofPersistence.of({
+    issue: (input, prepare) =>
+      owned(
+        database,
+        mapping,
+        configuration,
+        Effect.gen(function* () {
+          const transaction = yield* CurrentProofSql;
+          const journal = yield* CurrentCommitJournal;
+
+          const keys = mapping.scopeKeys({
+            moduleId: input.record.moduleId,
+            purpose: input.record.purpose,
+            binding: input.record.binding,
+          });
+
+          const authorityCurrent = yield* lockAuthority(
+            mapping,
+            input.record.moduleId,
+            input.record.purpose,
+            input.record.binding,
+            configuration.locking,
+          );
+
+          const scopes = scopeEntries(keys, input.record.binding, "issue", input.policy);
+
+          yield* lockScopes(
+            mapping,
+            configuration,
+            input.record.moduleId,
+            input.record.purpose,
+            "issue",
+            scopes.slice(0, 1),
+          );
+          const actionNow = yield* nowMillis;
+
+          const actionOpen =
+            (yield* admittedScopes(
+              mapping,
+              input.record.moduleId,
+              input.record.purpose,
+              "issue",
+              scopes.slice(0, 1),
+              actionNow,
+            )).length === 1;
+
+          if (actionOpen)
+            yield* lockScopes(
+              mapping,
+              configuration,
+              input.record.moduleId,
+              input.record.purpose,
+              "issue",
+              scopes.slice(1),
+            );
+
+          const series = actionOpen
+            ? yield* ensureSeries(
+                mapping,
+                configuration,
+                input.record.moduleId,
+                input.record.purpose,
+                keys.series,
+              )
+            : undefined;
+
+          const now = yield* nowMillis;
+          const retentionUntil = now + input.policy.requestRetentionMillis;
+          const rc = requestColumns(mapping);
+
+          let requestRows = yield* selectRows(
+            transaction
+              .select()
+              .from(mapping.request.table)
+              .where(
+                and(
+                  eq(rc.moduleId, input.record.moduleId),
+                  eq(rc.requestId, input.record.requestId),
+                ),
+              )
+              .limit(1),
+            configuration.locking,
+          );
+
+          let request = requestRows[0];
+
+          if (request !== undefined) {
+            const retainedUntil = yield* mapping.decodeInstant(
+              request[mapping.request.retentionUntil],
+            );
+
+            if (retainedUntil > now) {
+              if (request[mapping.request.fingerprint] !== input.record.fingerprint)
+                return yield* conflict();
+              const receipt = yield* mapping.request.decodeReceipt(request);
+
+              return prepare({ _tag: "Existing", receipt }, journal);
+            }
+            yield* transaction
+              .delete(mapping.request.table)
+              .where(
+                and(
+                  eq(rc.moduleId, input.record.moduleId),
+                  eq(rc.requestId, input.record.requestId),
+                  lte(rc.retentionUntil, mapping.encodeInstant(now)),
+                ),
+              );
+          }
+
+          const requestInsert = mapping.request.encodeInsert({
+            record: input.record,
+            createdAtMillis: now,
+            retentionUntilMillis: retentionUntil,
+          });
+
+          const requestQuery = transaction.insert(mapping.request.table).values(requestInsert);
+
+          yield* configuration.insertIfAbsent(
+            requestQuery,
+            mapping.request.requestId,
+            input.record.requestId,
+          );
+          requestRows = yield* selectRows(
+            transaction
+              .select()
+              .from(mapping.request.table)
+              .where(
+                and(
+                  eq(rc.moduleId, input.record.moduleId),
+                  eq(rc.requestId, input.record.requestId),
+                ),
+              )
+              .limit(1),
+            configuration.locking,
+          );
+          request = requestRows[0];
+
+          if (request === undefined) return yield* unavailable();
+          if (request[mapping.request.fingerprint] !== input.record.fingerprint)
+            return yield* conflict();
+          if (request[mapping.request.proofId] !== input.record.proofId) {
+            const receipt = yield* mapping.request.decodeReceipt(request);
+
+            return prepare({ _tag: "Existing", receipt }, journal);
+          }
+
+          const admitted = actionOpen
+            ? yield* admittedScopes(
+                mapping,
+                input.record.moduleId,
+                input.record.purpose,
+                "issue",
+                scopes,
+                now,
+              )
+            : [];
+
+          const sc = seriesColumns(mapping);
+
+          const lastIssueAt =
+            series?.[mapping.series.lastIssueAt] === null ||
+            series?.[mapping.series.lastIssueAt] === undefined
+              ? undefined
+              : yield* mapping.decodeInstant(series[mapping.series.lastIssueAt]);
+
+          const activeProofId = series?.[mapping.series.activeProofId] as string | null | undefined;
+
+          const supersedesCurrent =
+            input.supersedes === undefined || input.supersedes === activeProofId;
+
+          const allowed =
+            authorityCurrent &&
+            input.eligible &&
+            admitted.length === scopes.length &&
+            input.record.issuedAtMillis <= now &&
+            input.record.expiresAtMillis > now &&
+            supersedesCurrent &&
+            (lastIssueAt === undefined ||
+              now - lastIssueAt >= input.policy.abuse.resendCooldownMillis);
+
+          const receipt = {
+            requestId: input.record.requestId,
+            reference: {
+              proofId: input.record.proofId,
+              purpose: input.record.purpose,
+              keyId: input.record.verifier.keyId,
+            },
+          };
+
+          const prepared = prepare(
+            allowed
+              ? ({ _tag: "Issued", record: input.record } as const)
+              : ({ _tag: "Suppressed", receipt } as const),
+            journal,
+          );
+
+          if (admitted.length > 0)
+            yield* insertScopeEvents(
+              mapping,
+              input.record.moduleId,
+              input.record.purpose,
+              "issue",
+              input.record.requestId,
+              admitted,
+              now,
+              retentionUntil,
+            );
+          if (!allowed) return prepared;
+          if (activeProofId !== null && activeProofId !== undefined)
+            yield* transaction
+              .update(mapping.generation.table)
+              .set(updateValues<any>([[mapping.generation.state, "superseded"]]))
+              .where(
+                and(
+                  eq(generationColumns(mapping).moduleId, input.record.moduleId),
+                  eq(generationColumns(mapping).proofId, activeProofId),
+                  eq(generationColumns(mapping).state, "active"),
+                ),
+              );
+          yield* transaction.insert(mapping.generation.table).values(
+            mapping.generation.encodeInsert({
+              record: input.record,
+              seriesKey: keys.series,
+              retentionUntilMillis: retentionUntil,
+              state: "active",
+              deliveryState: "new",
+              policy: input.policy,
+            }),
+          );
+          const nextVersion = yield* allocateVersion(mapping, configuration.mode);
+
+          yield* transaction
+            .update(mapping.series.table)
+            .set(
+              updateValues<any>([
+                [mapping.series.activeProofId, input.record.proofId],
+                [mapping.series.lastIssueAt, mapping.encodeInstant(now)],
+                [mapping.series.version, nextVersion],
+              ]),
+            )
+            .where(
+              and(
+                eq(sc.moduleId, input.record.moduleId),
+                eq(sc.purpose, input.record.purpose),
+                eq(sc.scopeKey, keys.series),
+              ),
+            );
+
+          return prepared;
+        }),
+      ).pipe(
+        Effect.provideService(CurrentProofSql, database),
+        Effect.provideService(LifecycleHooks, hooks),
+        translateIssueFailure,
+      ),
+    attempt: (input, prepare) =>
+      owned(
+        database,
+        mapping,
+        configuration,
+        Effect.gen(function* () {
+          const transaction = yield* CurrentProofSql;
+          const journal = yield* CurrentCommitJournal;
+
+          const keys = mapping.scopeKeys({
+            moduleId: input.moduleId,
+            purpose: input.purpose,
+            binding: input.binding,
+          });
+
+          const authorityCurrent = yield* lockAuthority(
+            mapping,
+            input.moduleId,
+            input.purpose,
+            input.binding,
+            configuration.locking,
+          );
+
+          const scopes = scopeEntries(keys, input.binding, "attempt", input.policy);
+
+          yield* lockScopes(
+            mapping,
+            configuration,
+            input.moduleId,
+            input.purpose,
+            "attempt",
+            scopes.slice(0, 1),
+          );
+          const actionNow = yield* nowMillis;
+
+          const actionOpen =
+            (yield* admittedScopes(
+              mapping,
+              input.moduleId,
+              input.purpose,
+              "attempt",
+              scopes.slice(0, 1),
+              actionNow,
+            )).length === 1;
+
+          if (actionOpen)
+            yield* lockScopes(
+              mapping,
+              configuration,
+              input.moduleId,
+              input.purpose,
+              "attempt",
+              scopes.slice(1),
+            );
+
+          const series = actionOpen
+            ? yield* ensureSeries(
+                mapping,
+                configuration,
+                input.moduleId,
+                input.purpose,
+                keys.series,
+              )
+            : undefined;
+
+          const generation = (yield* readGeneration(
+            mapping,
+            input.moduleId,
+            input.proofId,
+            configuration.locking,
+          ))[0];
+
+          const existingCommand = (yield* commandRow(
+            mapping,
+            input.moduleId,
+            input.continuationId,
+            configuration.locking,
+          ))[0];
+
+          if (existingCommand !== undefined) {
+            if (existingCommand[mapping.command.decision] === "rejected")
+              return prepare({ _tag: "Rejected" }, journal);
+
+            return yield* unavailable();
+          }
+          const now = yield* nowMillis;
+
+          const admitted = actionOpen
+            ? yield* admittedScopes(mapping, input.moduleId, input.purpose, "attempt", scopes, now)
+            : [];
+
+          const failures = yield* failureCount(
+            mapping,
+            input.moduleId,
+            input.purpose,
+            keys.series,
+            now,
+            input.policy,
+          );
+
+          const gc = generationColumns(mapping);
+          const activeProofId = series?.[mapping.series.activeProofId];
+
+          const storedBinding =
+            generation === undefined
+              ? undefined
+              : yield* mapping.generation.decodeBinding(generation);
+
+          const candidateMatches =
+            generation !== undefined &&
+            input.candidate !== undefined &&
+            generation[mapping.generation.verifierKeyId] === input.candidate.keyId &&
+            generation[mapping.generation.verifierDigest] === input.candidate.digest;
+
+          const currentGeneration =
+            generation !== undefined &&
+            generation[mapping.generation.purpose] === input.purpose &&
+            generation[mapping.generation.state] === "active" &&
+            activeProofId === input.proofId &&
+            storedBinding !== undefined &&
+            sameBinding(storedBinding, input.binding) &&
+            Number(yield* mapping.decodeInstant(generation[mapping.generation.expiresAt])) > now;
+
+          const accepted =
+            authorityCurrent &&
+            currentGeneration &&
+            candidateMatches &&
+            admitted.length === scopes.length &&
+            failures < input.policy.maximumFailedAttempts;
+
+          const retentionUntil = now + input.policy.requestRetentionMillis;
+
+          if (!accepted) {
+            const prepared = prepare({ _tag: "Rejected" }, journal);
+
+            yield* insertCommand(
+              mapping,
+              input.moduleId,
+              input.continuationId,
+              "attempt",
+              "rejected",
+              retentionUntil,
+            );
+            yield* insertScopeEvents(
+              mapping,
+              input.moduleId,
+              input.purpose,
+              "attempt",
+              input.continuationId,
+              admitted,
+              now,
+              retentionUntil,
+            );
+            if (
+              admitted.length === scopes.length &&
+              currentGeneration &&
+              !candidateMatches &&
+              failures < input.policy.maximumFailedAttempts
+            )
+              yield* transaction.insert(mapping.failureEvent.table).values(
+                mapping.failureEvent.encodeInsert({
+                  moduleId: input.moduleId,
+                  purpose: input.purpose,
+                  seriesKey: keys.series,
+                  commandId: input.continuationId,
+                  occurredAtMillis: now,
+                  retentionUntilMillis: retentionUntil,
+                }),
+              );
+
+            return prepared;
+          }
+          const version = yield* allocateVersion(mapping, configuration.mode);
+
+          const expiresAt = Math.min(
+            Number(yield* mapping.decodeInstant(generation![mapping.generation.expiresAt])),
+            now + input.policy.continuationLifetimeMillis,
+          );
+
+          const continuation: ProofContinuationRecord = {
+            moduleId: input.moduleId,
+            purpose: input.purpose,
+            continuationId: input.continuationId,
+            digest: input.continuationDigest,
+            proofId: input.proofId,
+            seriesKey: keys.series,
+            binding: input.binding,
+            expiresAtMillis: expiresAt,
+            version,
+          };
+
+          const decision: ProofAttemptDecision = {
+            _tag: "Accepted",
+            continuation: {
+              continuationId: input.continuationId,
+              purpose: input.purpose,
+              expiresAtMillis: expiresAt,
+            },
+          };
+
+          const prepared = prepare(decision, journal);
+
+          yield* insertCommand(
+            mapping,
+            input.moduleId,
+            input.continuationId,
+            "attempt",
+            "accepted",
+            retentionUntil,
+          );
+          yield* insertScopeEvents(
+            mapping,
+            input.moduleId,
+            input.purpose,
+            "attempt",
+            input.continuationId,
+            scopes,
+            now,
+            retentionUntil,
+          );
+          yield* transaction
+            .update(mapping.generation.table)
+            .set(updateValues<any>([[mapping.generation.state, "consumed"]]))
+            .where(
+              and(
+                eq(gc.moduleId, input.moduleId),
+                eq(gc.proofId, input.proofId),
+                eq(gc.state, "active"),
+              ),
+            );
+          yield* transaction.insert(mapping.continuation.table).values(
+            mapping.continuation.encodeInsert({
+              ...continuation,
+              retentionUntilMillis: retentionUntil,
+            }),
+          );
+
+          return prepared;
+        }),
+      ).pipe(
+        Effect.provideService(CurrentProofSql, database),
+        Effect.provideService(LifecycleHooks, hooks),
+        translateFailure,
+      ),
+    complete: (input, prepare) =>
+      owned(
+        database,
+        mapping,
+        configuration,
+        Effect.gen(function* () {
+          const journal = yield* CurrentCommitJournal;
+
+          return yield* completeIn(mapping, configuration, input, (decision) =>
+            prepare(decision, journal),
+          );
+        }),
+      ).pipe(
+        Effect.provideService(CurrentProofSql, database),
+        Effect.provideService(LifecycleHooks, hooks),
+        translateFailure,
+      ),
+    claimDelivery: (input, prepare) =>
+      owned(
+        database,
+        mapping,
+        configuration,
+        Effect.gen(function* () {
+          const transaction = yield* CurrentProofSql;
+          const journal = yield* CurrentCommitJournal;
+
+          const rows = yield* readGeneration(
+            mapping,
+            input.moduleId,
+            input.proofId,
+            configuration.locking,
+          );
+
+          const row = rows[0];
+          const now = yield* nowMillis;
+
+          if (row === undefined) return prepare({ _tag: "Declined" }, journal);
+          const c = generationColumns(mapping);
+          const expiresAt = yield* mapping.decodeInstant(row[mapping.generation.expiresAt]);
+
+          const claimDeadline =
+            row[mapping.generation.claimDeadline] === null ||
+            row[mapping.generation.claimDeadline] === undefined
+              ? undefined
+              : yield* mapping.decodeInstant(row[mapping.generation.claimDeadline]);
+
+          const retryAt =
+            row[mapping.generation.retryAt] === null ||
+            row[mapping.generation.retryAt] === undefined
+              ? undefined
+              : yield* mapping.decodeInstant(row[mapping.generation.retryAt]);
+
+          let state = row[mapping.generation.deliveryState] as string;
+
+          if (state === "claimed" && claimDeadline !== undefined && claimDeadline <= now) {
+            state = "ambiguous";
+            yield* transaction
+              .update(mapping.generation.table)
+              .set(updateValues<any>([[mapping.generation.deliveryState, "ambiguous"]]))
+              .where(and(eq(c.moduleId, input.moduleId), eq(c.proofId, input.proofId)));
+          }
+
+          const canClaim =
+            row[mapping.generation.version] === input.version &&
+            row[mapping.generation.deliveryId] === input.deliveryId &&
+            row[mapping.generation.state] === "active" &&
+            expiresAt > now &&
+            Number(row[mapping.generation.sendCount]) < input.policy.maximumDeliveryAttempts &&
+            (state === "new" ||
+              (state === "ambiguous" &&
+                input.allowAmbiguousRetry &&
+                (retryAt === undefined || retryAt <= now)));
+
+          if (!canClaim) return prepare({ _tag: "Declined" }, journal);
+          const claimVersion = yield* allocateVersion(mapping, configuration.mode);
+          const decision: ProofDeliveryClaim = { _tag: "Claimed", claimVersion };
+          const prepared = prepare(decision, journal);
+
+          yield* transaction
+            .update(mapping.generation.table)
+            .set(
+              updateValues<any>([
+                [mapping.generation.sendCount, Number(row[mapping.generation.sendCount]) + 1],
+                [mapping.generation.deliveryState, "claimed"],
+                [mapping.generation.claimVersion, claimVersion],
+                [
+                  mapping.generation.claimDeadline,
+                  mapping.encodeInstant(now + input.policy.deliveryClaimMillis),
+                ],
+                [
+                  mapping.generation.retryAt,
+                  mapping.encodeInstant(now + input.policy.deliveryRetryMillis),
+                ],
+              ]),
+            )
+            .where(and(eq(c.moduleId, input.moduleId), eq(c.proofId, input.proofId)));
+
+          return prepared;
+        }),
+      ).pipe(
+        Effect.provideService(CurrentProofSql, database),
+        Effect.provideService(LifecycleHooks, hooks),
+        translateFailure,
+      ),
+    settleDelivery: (input, prepare) =>
+      owned(
+        database,
+        mapping,
+        configuration,
+        Effect.gen(function* () {
+          const transaction = yield* CurrentProofSql;
+          const journal = yield* CurrentCommitJournal;
+
+          const initial = (yield* readGeneration(mapping, input.moduleId, input.proofId, false))[0];
+
+          if (initial === undefined) return prepare(undefined, journal);
+          const keys = initial[mapping.generation.seriesKey] as string;
+
+          yield* ensureSeries(
+            mapping,
+            configuration,
+            input.moduleId,
+            initial[mapping.generation.purpose],
+            keys,
+          );
+
+          const row = (yield* readGeneration(
+            mapping,
+            input.moduleId,
+            input.proofId,
+            configuration.locking,
+          ))[0];
+
+          const prepared = prepare(undefined, journal);
+
+          if (
+            row === undefined ||
+            row[mapping.generation.version] !== input.version ||
+            row[mapping.generation.deliveryId] !== input.deliveryId ||
+            row[mapping.generation.claimVersion] !== input.claimVersion ||
+            row[mapping.generation.deliveryState] !== "claimed"
+          )
+            return prepared;
+          const c = generationColumns(mapping);
+          const outcome: ProofDeliveryOutcome = input.outcome;
+
+          const state =
+            outcome._tag === "Accepted"
+              ? "accepted"
+              : outcome._tag === "DefiniteFailure"
+                ? "failed"
+                : "ambiguous";
+
+          const values: Array<readonly [string, unknown]> = [
+            [mapping.generation.deliveryState, state],
+            [mapping.generation.claimDeadline, null],
+          ];
+
+          if (outcome._tag === "Ambiguous")
+            values.push([
+              mapping.generation.retryAt,
+              mapping.encodeInstant(
+                (yield* nowMillis) + Number(row[mapping.generation.deliveryRetryMillis]),
+              ),
+            ]);
+          if (outcome._tag === "DefiniteFailure")
+            values.push([mapping.generation.state, "cancelled"]);
+          yield* transaction
+            .update(mapping.generation.table)
+            .set(updateValues<any>(values))
+            .where(and(eq(c.moduleId, input.moduleId), eq(c.proofId, input.proofId)));
+          if (outcome._tag === "DefiniteFailure") {
+            const sc = seriesColumns(mapping);
+
+            yield* transaction
+              .update(mapping.series.table)
+              .set(updateValues<any>([[mapping.series.activeProofId, null]]))
+              .where(
+                and(
+                  eq(sc.moduleId, input.moduleId),
+                  eq(sc.purpose, row[mapping.generation.purpose]),
+                  eq(sc.scopeKey, keys),
+                  eq(sc.activeProofId, input.proofId),
+                ),
+              );
+          }
+
+          return prepared;
+        }),
+      ).pipe(
+        Effect.provideService(CurrentProofSql, database),
+        Effect.provideService(LifecycleHooks, hooks),
+        translateFailure,
+      ),
+    cancel: (input, prepare) =>
+      owned(
+        database,
+        mapping,
+        configuration,
+        Effect.gen(function* () {
+          const transaction = yield* CurrentProofSql;
+          const journal = yield* CurrentCommitJournal;
+
+          const authorityCurrent = yield* lockAuthority(
+            mapping,
+            input.moduleId,
+            input.purpose,
+            input.binding,
+            configuration.locking,
+          );
+
+          const keys = mapping.scopeKeys({
+            moduleId: input.moduleId,
+            purpose: input.purpose,
+            binding: input.binding,
+          });
+
+          const series = yield* ensureSeries(
+            mapping,
+            configuration,
+            input.moduleId,
+            input.purpose,
+            keys.series,
+          );
+
+          const active = series[mapping.series.activeProofId] as string | undefined | null;
+          const prepared = prepare(undefined, journal);
+
+          if (authorityCurrent && active !== undefined && active !== null) {
+            const gc = generationColumns(mapping);
+            const sc = seriesColumns(mapping);
+
+            const row = (yield* readGeneration(
+              mapping,
+              input.moduleId,
+              active,
+              configuration.locking,
+            ))[0];
+
+            const storedBinding =
+              row === undefined ? undefined : yield* mapping.generation.decodeBinding(row);
+
+            if (storedBinding === undefined || !sameBinding(storedBinding, input.binding))
+              return prepared;
+
+            yield* transaction
+              .update(mapping.generation.table)
+              .set(updateValues<any>([[mapping.generation.state, "cancelled"]]))
+              .where(and(eq(gc.moduleId, input.moduleId), eq(gc.proofId, active)));
+            yield* transaction
+              .update(mapping.series.table)
+              .set(updateValues<any>([[mapping.series.activeProofId, null]]))
+              .where(
+                and(
+                  eq(sc.moduleId, input.moduleId),
+                  eq(sc.purpose, input.purpose),
+                  eq(sc.scopeKey, keys.series),
+                  eq(sc.activeProofId, active),
+                ),
+              );
+          }
+
+          return prepared;
+        }),
+      ).pipe(
+        Effect.provideService(CurrentProofSql, database),
+        Effect.provideService(LifecycleHooks, hooks),
+        translateFailure,
+      ),
+    cleanup: (input, prepare) =>
+      owned(
+        database,
+        mapping,
+        configuration,
+        Effect.gen(function* () {
+          const transaction = yield* CurrentProofSql;
+          const journal = yield* CurrentCommitJournal;
+
+          const now = yield* nowMillis;
+          const nativeNow = mapping.encodeInstant(now);
+          const gc = generationColumns(mapping);
+          const cc = continuationColumns(mapping);
+          const rc = requestColumns(mapping);
+          const ac = abuseColumns(mapping);
+          const fc = failureColumns(mapping);
+          const mc = commandColumns(mapping);
+          const sc = seriesColumns(mapping);
+          const rsc = scopeColumns(mapping);
+          let remaining = input.limit;
+          let hasMore = false;
+
+          const take = <A>(query: ProofSqlQuery<ReadonlyArray<A>>) =>
+            selectRows(query.limit(remaining + 1), configuration.locking).pipe(
+              Effect.map((rows) => {
+                if (rows.length > remaining) hasMore = true;
+                const selected = rows.slice(0, remaining);
+
+                remaining -= selected.length;
+
+                return selected;
+              }),
+            );
+
+          // Child rows and secret-bearing generations are removed before their
+          // retained request/decision records. Every selected row counts toward
+          // one caller-wide limit and is locked until this owner commits.
+          const continuations = yield* take(
+            transaction
+              .select({ continuationId: cc.continuationId })
+              .from(mapping.continuation.table)
+              .where(and(eq(cc.moduleId, input.moduleId), lte(cc.retentionUntil, nativeNow)))
+              .orderBy(cc.retentionUntil),
+          );
+
+          const generations = yield* take(
+            transaction
+              .select({ proofId: gc.proofId })
+              .from(mapping.generation.table)
+              .where(and(eq(gc.moduleId, input.moduleId), lte(gc.retentionUntil, nativeNow)))
+              .orderBy(gc.retentionUntil),
+          );
+
+          const requests = yield* take(
+            transaction
+              .select({ requestId: rc.requestId })
+              .from(mapping.request.table)
+              .where(and(eq(rc.moduleId, input.moduleId), lte(rc.retentionUntil, nativeNow)))
+              .orderBy(rc.retentionUntil),
+          );
+
+          const abuse = yield* take(
+            transaction
+              .select({
+                action: ac.action,
+                scopeKind: ac.scopeKind,
+                scopeKey: ac.scopeKey,
+                commandId: ac.commandId,
+              })
+              .from(mapping.abuseEvent.table)
+              .where(and(eq(ac.moduleId, input.moduleId), lte(ac.retentionUntil, nativeNow)))
+              .orderBy(ac.retentionUntil),
+          );
+
+          const failures = yield* take(
+            transaction
+              .select({ seriesKey: fc.seriesKey, commandId: fc.commandId })
+              .from(mapping.failureEvent.table)
+              .where(and(eq(fc.moduleId, input.moduleId), lte(fc.retentionUntil, nativeNow)))
+              .orderBy(fc.retentionUntil),
+          );
+
+          const commands = yield* take(
+            transaction
+              .select({ commandId: mc.commandId })
+              .from(mapping.command.table)
+              .where(and(eq(mc.moduleId, input.moduleId), lte(mc.retentionUntil, nativeNow)))
+              .orderBy(mc.retentionUntil),
+          );
+
+          const series = yield* take(
+            transaction
+              .select({ purpose: sc.purpose, scopeKey: sc.scopeKey })
+              .from(mapping.series.table)
+              .where(
+                and(
+                  eq(sc.moduleId, input.moduleId),
+                  isNull(sc.activeProofId),
+                  notExists(
+                    transaction
+                      .select({ one: sql`1` })
+                      .from(mapping.generation.table)
+                      .where(
+                        and(
+                          eq(gc.moduleId, sc.moduleId),
+                          eq(gc.purpose, sc.purpose),
+                          eq(gc.seriesKey, sc.scopeKey),
+                        ),
+                      ),
+                  ),
+                  notExists(
+                    transaction
+                      .select({ one: sql`1` })
+                      .from(mapping.failureEvent.table)
+                      .where(
+                        and(
+                          eq(fc.moduleId, sc.moduleId),
+                          eq(fc.purpose, sc.purpose),
+                          eq(fc.seriesKey, sc.scopeKey),
+                        ),
+                      ),
+                  ),
+                ),
+              ),
+          );
+
+          const rateScopes = yield* take(
+            transaction
+              .select({
+                purpose: rsc.purpose,
+                action: rsc.action,
+                scopeKind: rsc.scopeKind,
+                scopeKey: rsc.scopeKey,
+              })
+              .from(mapping.rateScope.table)
+              .where(
+                and(
+                  eq(rsc.moduleId, input.moduleId),
+                  notExists(
+                    transaction
+                      .select({ one: sql`1` })
+                      .from(mapping.abuseEvent.table)
+                      .where(
+                        and(
+                          eq(ac.moduleId, rsc.moduleId),
+                          eq(ac.purpose, rsc.purpose),
+                          eq(ac.action, rsc.action),
+                          eq(ac.scopeKind, rsc.scopeKind),
+                          eq(ac.scopeKey, rsc.scopeKey),
+                        ),
+                      ),
+                  ),
+                ),
+              ),
+          );
+
+          // Removing the final history row can make an anchor eligible only after this
+          // transaction/batch commits. One extra page lets the caller reclaim it.
+          hasMore ||= generations.length > 0 || failures.length > 0 || abuse.length > 0;
+          const removed = input.limit - remaining;
+          const prepared = prepare({ removed, hasMore } satisfies ProofCleanupResult, journal);
+
+          if (continuations.length > 0)
+            yield* transaction.delete(mapping.continuation.table).where(
+              and(
+                eq(cc.moduleId, input.moduleId),
+                inArray(
+                  cc.continuationId,
+                  continuations.map((row: any) => row.continuationId),
+                ),
+                lte(cc.retentionUntil, nativeNow),
+              ),
+            );
+          if (generations.length > 0)
+            yield* transaction
+              .update(mapping.series.table)
+              .set(updateValues<any>([[mapping.series.activeProofId, null]]))
+              .where(
+                and(
+                  eq(sc.moduleId, input.moduleId),
+                  inArray(
+                    sc.activeProofId,
+                    generations.map((row: any) => row.proofId),
+                  ),
+                ),
+              );
+          if (generations.length > 0)
+            yield* transaction.delete(mapping.generation.table).where(
+              and(
+                eq(gc.moduleId, input.moduleId),
+                inArray(
+                  gc.proofId,
+                  generations.map((row: any) => row.proofId),
+                ),
+                lte(gc.retentionUntil, nativeNow),
+              ),
+            );
+          if (requests.length > 0)
+            yield* transaction.delete(mapping.request.table).where(
+              and(
+                eq(rc.moduleId, input.moduleId),
+                inArray(
+                  rc.requestId,
+                  requests.map((row: any) => row.requestId),
+                ),
+                lte(rc.retentionUntil, nativeNow),
+              ),
+            );
+          for (const row of abuse)
+            yield* transaction
+              .delete(mapping.abuseEvent.table)
+              .where(
+                and(
+                  eq(ac.moduleId, input.moduleId),
+                  eq(ac.action, row.action),
+                  eq(ac.scopeKind, row.scopeKind),
+                  eq(ac.scopeKey, row.scopeKey),
+                  eq(ac.commandId, row.commandId),
+                  lte(ac.retentionUntil, nativeNow),
+                ),
+              );
+          for (const row of failures)
+            yield* transaction
+              .delete(mapping.failureEvent.table)
+              .where(
+                and(
+                  eq(fc.moduleId, input.moduleId),
+                  eq(fc.seriesKey, row.seriesKey),
+                  eq(fc.commandId, row.commandId),
+                  lte(fc.retentionUntil, nativeNow),
+                ),
+              );
+          if (commands.length > 0)
+            yield* transaction.delete(mapping.command.table).where(
+              and(
+                eq(mc.moduleId, input.moduleId),
+                inArray(
+                  mc.commandId,
+                  commands.map((row: any) => row.commandId),
+                ),
+                lte(mc.retentionUntil, nativeNow),
+              ),
+            );
+          for (const row of series)
+            yield* transaction.delete(mapping.series.table).where(
+              and(
+                eq(sc.moduleId, input.moduleId),
+                eq(sc.purpose, row.purpose),
+                eq(sc.scopeKey, row.scopeKey),
+                isNull(sc.activeProofId),
+                notExists(
+                  transaction
+                    .select({ one: sql`1` })
+                    .from(mapping.generation.table)
+                    .where(
+                      and(
+                        eq(gc.moduleId, sc.moduleId),
+                        eq(gc.purpose, sc.purpose),
+                        eq(gc.seriesKey, sc.scopeKey),
+                      ),
+                    ),
+                ),
+              ),
+            );
+          for (const row of rateScopes)
+            yield* transaction.delete(mapping.rateScope.table).where(
+              and(
+                eq(rsc.moduleId, input.moduleId),
+                eq(rsc.purpose, row.purpose),
+                eq(rsc.action, row.action),
+                eq(rsc.scopeKind, row.scopeKind),
+                eq(rsc.scopeKey, row.scopeKey),
+                notExists(
+                  transaction
+                    .select({ one: sql`1` })
+                    .from(mapping.abuseEvent.table)
+                    .where(
+                      and(
+                        eq(ac.moduleId, rsc.moduleId),
+                        eq(ac.purpose, rsc.purpose),
+                        eq(ac.action, rsc.action),
+                        eq(ac.scopeKind, rsc.scopeKind),
+                        eq(ac.scopeKey, rsc.scopeKey),
+                      ),
+                    ),
+                ),
+              ),
+            );
+
+          return prepared;
+        }),
+      ).pipe(
+        Effect.provideService(CurrentProofSql, database),
+        Effect.provideService(LifecycleHooks, hooks),
+        translateFailure,
+      ),
+  });
+});
+
+const inspectCompletionIn = Effect.fn("DrizzleProof.inspectCompletionIn")(function* (
+  mapping: Mapping,
+  configuration: ProofSqlConfiguration,
+  input: ProofCompletionPlan["input"],
+  ensure: boolean,
+) {
+  const database = yield* CurrentProofSql;
+
+  const authorityCurrent = yield* lockAuthority(
+    mapping,
+    input.moduleId,
+    input.purpose,
+    input.binding,
+    configuration.locking,
+  );
+
+  const keys = mapping.scopeKeys({
+    moduleId: input.moduleId,
+    purpose: input.purpose,
+    binding: input.binding,
+  });
+
+  if (ensure)
+    yield* ensureSeries(mapping, configuration, input.moduleId, input.purpose, keys.series);
+  const c = continuationColumns(mapping);
+
+  const rows = yield* selectRows(
+    database
+      .select()
+      .from(mapping.continuation.table)
+      .where(and(eq(c.moduleId, input.moduleId), eq(c.continuationId, input.continuationId)))
+      .limit(1),
+    configuration.locking,
+  );
+
+  const row = rows[0];
+  const now = yield* nowMillis;
+  const record = row === undefined ? undefined : yield* mapping.continuation.decode(row);
+
+  const completed =
+    authorityCurrent &&
+    row !== undefined &&
+    record !== undefined &&
+    record.moduleId === input.moduleId &&
+    record.continuationId === input.continuationId &&
+    record.purpose === input.purpose &&
+    record.digest === input.continuationDigest &&
+    record.seriesKey === keys.series &&
+    sameBinding(record.binding, input.binding) &&
+    row[mapping.continuation.consumed] === false &&
+    record.expiresAtMillis > now;
+
+  return completed ? { record: record!, row, columns: c } : undefined;
+});
+
+/** Nonconsuming same-owner preflight; it never inserts a series or changes expiry. */
+export const checkProofCompletionIn = Effect.fn("Drizzle.checkProofCompletionIn")(function* (
+  mapping: Mapping,
+  configuration: ProofSqlConfiguration,
+  input: ProofCompletionPlan["input"],
+) {
+  return yield* inspectCompletionIn(mapping, configuration, input, false).pipe(
+    Effect.map((value) => value !== undefined),
+  );
+});
+
+const completeIn = Effect.fn("DrizzleProof.completeIn")(function* <A, E = never, R = never>(
+  mapping: Mapping,
+  configuration: ProofSqlConfiguration,
+  input: ProofCompletionPlan["input"],
+  prepare: (decision: ProofCompletionDecision) => A,
+  protectedMutation?: Effect.Effect<boolean, E, R>,
+) {
+  const database = yield* CurrentProofSql;
+
+  const accepted = yield* inspectCompletionIn(mapping, configuration, input, true);
+
+  if (accepted === undefined) return prepare("rejected");
+  const { record, row: original, columns: c } = accepted;
+
+  if (protectedMutation !== undefined && !(yield* protectedMutation)) return yield* unavailable();
+  const value = prepare("completed");
+
+  yield* database
+    .update(mapping.continuation.table)
+    .set(updateValues<any>([[mapping.continuation.consumed, true]]))
+    .where(
+      and(
+        eq(c.moduleId, input.moduleId),
+        eq(c.continuationId, input.continuationId),
+        eq(c.digest, input.continuationDigest),
+        eq(c.consumed, false),
+      ),
+    );
+  yield* insertCommand(
+    mapping,
+    input.moduleId,
+    input.continuationDigest,
+    "complete",
+    "completed",
+    record.expiresAtMillis,
+  );
+
+  const assertApplied = Effect.flatMap(CurrentPasswordPreparedTransaction, (currentTransaction) =>
+    Effect.gen(function* () {
+      const persisted = (yield* selectRows(
+        currentTransaction
+          .select()
+          .from(mapping.continuation.table)
+          .where(and(eq(c.moduleId, input.moduleId), eq(c.continuationId, input.continuationId)))
+          .limit(1),
+        false,
+      ))[0];
+
+      const command = (yield* commandRow(
+        mapping,
+        input.moduleId,
+        input.continuationDigest,
+        false,
+      ))[0];
+
+      const decoded =
+        persisted === undefined ? undefined : yield* mapping.continuation.decode(persisted);
+
+      const immutable = [
+        mapping.continuation.moduleId,
+        mapping.continuation.purpose,
+        mapping.continuation.continuationId,
+        mapping.continuation.digest,
+        mapping.continuation.proofId,
+        mapping.continuation.seriesKey,
+        mapping.continuation.version,
+      ];
+
+      if (
+        persisted === undefined ||
+        decoded === undefined ||
+        !sameBinding(decoded.binding, record.binding) ||
+        persisted[mapping.continuation.consumed] !== true ||
+        immutable.some((key) => persisted[key] !== original[key]) ||
+        (yield* mapping.decodeInstant(persisted[mapping.continuation.expiresAt])) !==
+          record.expiresAtMillis ||
+        (yield* mapping.decodeInstant(persisted[mapping.continuation.retentionUntil])) !==
+          (yield* mapping.decodeInstant(original[mapping.continuation.retentionUntil])) ||
+        command === undefined ||
+        command[mapping.command.kind] !== "complete" ||
+        command[mapping.command.decision] !== "completed" ||
+        (yield* mapping.decodeInstant(command[mapping.command.retentionUntil])) !==
+          record.expiresAtMillis
+      )
+        return yield* unavailable();
+
+      if (record.expiresAtMillis <= (yield* nowMillis)) return yield* unavailable();
+    }).pipe(Effect.provideService(CurrentProofSql, currentTransaction)),
+  );
+
+  yield* assertApplied.pipe(Effect.provideService(CurrentPasswordPreparedTransaction, database));
+  const postconditions = yield* Effect.serviceOption(PasswordPreparedPostconditions);
+
+  if (
+    Option.isSome(postconditions) &&
+    !postconditions.value.register(assertApplied.pipe(translateFailure))
+  )
+    return yield* unavailable();
+
+  return value;
+});
+
+/** Private same-owner seam for password and identifier mutations. */
+export const completeProofPlanIn = Effect.fn("Drizzle.completeProofPlanIn")(function* <
+  Rq extends Table,
+  S extends Table,
+  G extends Table,
+  Cn extends Table,
+  Rs extends Table,
+  Aev extends Table,
+  F extends Table,
+  C extends Table,
+  Sub extends Table,
+  I extends Table,
+  Cr extends Table,
+  NativeId,
+  A,
+  E,
+  R,
+>(
+  mapping: ProofPersistenceMapping<Rq, S, G, Cn, Rs, Aev, F, C, Sub, I, Cr, NativeId>,
+  configuration: ProofSqlConfiguration,
+  plan: ProofCompletionPlan,
+  protectedMutation: Effect.Effect<boolean, E, R>,
+  project: (decision: ProofCompletionDecision) => A,
+) {
+  const journal = yield* CurrentCommitJournal;
+
+  return yield* completeIn(
+    mapping as unknown as Mapping,
+    configuration,
+    plan.input,
+    (decision) => plan.prepare(decision, journal, project),
+    protectedMutation,
+  );
+});