@yielded/auth 0.1.0-beta.1

package/dist/drizzle/email-sql.mjs

@@ -0,0 +1,473 @@
+import { HookConfigurationError } from "../hooks/models.mjs";
+import { reportPersistenceFailure } from "../internal/diagnostics.mjs";
+import { LifecycleHooks } from "../hooks/LifecycleHooks.mjs";
+import { CurrentCommitJournal, coordinateCommit, hasCommitScope } from "../hooks/commit.mjs";
+import { assessAuthentication, snapshotAuthenticationEvidence } from "../sessions/assurance.mjs";
+import { requiredEmailAddressConstraints, requiredEmailSignInConstraints } from "./email-model.mjs";
+import { DrizzleMappingError, column, isMappedConstraintConflict, updateValues } from "./model.mjs";
+import { EmailAddressPersistence } from "../email/EmailAddressPersistence.mjs";
+import { EmailSignInTargets } from "../email/EmailSignInTargets.mjs";
+import { EmailUnavailable } from "../email/errors.mjs";
+import { ProofUnavailable } from "../proofs/errors.mjs";
+import { snapshotEmailCredential, snapshotEmailRequirement, snapshotEmailRevision } from "../email/snapshot.mjs";
+import { CurrentProofSql, completeProofPlanIn } from "./proof-sql.mjs";
+import { Cause, Context, DateTime, Effect, Option, Schema } from "effect";
+import { and, eq, inArray, lte } from "drizzle-orm";
+//#region src/drizzle/email-sql.ts
+const unavailable = () => EmailUnavailable.make({});
+const translateFailure = (effect) => reportPersistenceFailure(effect, (error) => Schema.is(EmailUnavailable)(error) || Schema.is(ProofUnavailable)(error) || Schema.is(HookConfigurationError)(error)).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));
+const nowMillis = Effect.map(DateTime.now, DateTime.toEpochMillis);
+var CurrentEmailSql = class extends Context.Service()("effect-auth/CurrentEmailSql") {};
+const selectRows = (query, locking) => locking && typeof query.for === "function" ? query.for("update") : query;
+const sameIdentifier = (left, right) => left.namespace === right.namespace && left.value === right.value;
+const validEmailSignInConstraints = (mapping) => Object.entries(requiredEmailSignInConstraints).every(([key, value]) => mapping.constraints[key] === value);
+const validAddressConstraints = (mapping) => Object.entries(requiredEmailAddressConstraints).every(([key, value]) => mapping.constraints[key] === value);
+const subjectColumns = (mapping) => ({
+	id: column(mapping.subject.table, mapping.subject.id),
+	status: column(mapping.subject.table, mapping.subject.status),
+	securityRevision: column(mapping.subject.table, mapping.subject.securityRevision)
+});
+const identifierColumns = (mapping) => ({
+	namespace: column(mapping.identifier.table, mapping.identifier.namespace),
+	value: column(mapping.identifier.table, mapping.identifier.value),
+	subjectId: column(mapping.identifier.table, mapping.identifier.subjectId),
+	verifiedAt: column(mapping.identifier.table, mapping.identifier.verifiedAt),
+	bindingRevision: column(mapping.identifier.table, mapping.identifier.bindingRevision)
+});
+const credentialColumns = (mapping) => ({
+	moduleId: column(mapping.credential.table, mapping.credential.moduleId),
+	subjectId: column(mapping.credential.table, mapping.credential.subjectId),
+	credentialId: column(mapping.credential.table, mapping.credential.credentialId),
+	identifierNamespace: column(mapping.credential.table, mapping.credential.identifierNamespace),
+	identifierValue: column(mapping.credential.table, mapping.credential.identifierValue),
+	credentialRevision: column(mapping.credential.table, mapping.credential.credentialRevision),
+	status: column(mapping.credential.table, mapping.credential.status)
+});
+const authorityColumns = (mapping) => ({
+	subjectId: column(mapping.authorityCredential.table, mapping.authorityCredential.subjectId),
+	credentialId: column(mapping.authorityCredential.table, mapping.authorityCredential.credentialId),
+	revision: column(mapping.authorityCredential.table, mapping.authorityCredential.revision),
+	status: column(mapping.authorityCredential.table, mapping.authorityCredential.status)
+});
+const commandColumns = (mapping) => ({
+	moduleId: column(mapping.command.table, mapping.command.moduleId),
+	commandId: column(mapping.command.table, mapping.command.commandId),
+	action: column(mapping.command.table, mapping.command.action),
+	bindingDigest: column(mapping.command.table, mapping.command.bindingDigest),
+	retentionUntil: column(mapping.command.table, mapping.command.retentionUntil)
+});
+const allocate = (mode, asynchronous, synchronous) => {
+	if (mode === "synchronous") return synchronous === void 0 ? Effect.fail(unavailable()) : Effect.try({
+		try: synchronous,
+		catch: (cause) => new DrizzleMappingError({
+			operation: "mapping",
+			cause
+		})
+	});
+	if (asynchronous !== void 0) return asynchronous;
+	return synchronous === void 0 ? Effect.fail(unavailable()) : Effect.try({
+		try: synchronous,
+		catch: (cause) => new DrizzleMappingError({
+			operation: "mapping",
+			cause
+		})
+	});
+};
+const nextSecurityRevision = (mapping, mode, current) => {
+	if (mode === "synchronous") return mapping.subject.nextSecurityRevisionSync === void 0 ? Effect.fail(unavailable()) : Effect.try({
+		try: () => mapping.subject.nextSecurityRevisionSync(current),
+		catch: (cause) => new DrizzleMappingError({
+			operation: "mapping",
+			cause
+		})
+	});
+	if (mapping.subject.nextSecurityRevision !== void 0) return mapping.subject.nextSecurityRevision(current);
+	if (mapping.subject.nextSecurityRevisionSync !== void 0) return Effect.try({
+		try: () => mapping.subject.nextSecurityRevisionSync(current),
+		catch: (cause) => new DrizzleMappingError({
+			operation: "mapping",
+			cause
+		})
+	});
+	return Effect.fail(unavailable());
+};
+const safeRead = (database, configuration, body) => Effect.gen(function* () {
+	if (configuration.coordinated !== true) {
+		if (yield* hasCommitScope) return yield* unavailable();
+		yield* configuration.standaloneGuard;
+	}
+	return yield* database.transaction((transaction) => body.pipe(Effect.provideService(CurrentEmailSql, transaction), Effect.provideService(CurrentProofSql, transaction)));
+});
+const owned = (database, configuration, body) => {
+	const run = coordinateCommit(() => database.transaction((transaction) => body.pipe(Effect.provideService(CurrentEmailSql, transaction), Effect.provideService(CurrentProofSql, transaction))), { mode: configuration.mode }).pipe(Effect.map((result) => result.value));
+	return configuration.coordinated !== true ? Effect.gen(function* () {
+		if (yield* hasCommitScope) return yield* unavailable();
+		yield* configuration.standaloneGuard;
+		return yield* run;
+	}) : run;
+};
+const emailLookupQuery = (mapping, moduleId, identifier) => {
+	const subject = subjectColumns(mapping), binding = identifierColumns(mapping), credential = credentialColumns(mapping);
+	return {
+		fields: {
+			subject: mapping.subject.table,
+			identifier: mapping.identifier.table,
+			credential: mapping.credential.table
+		},
+		from: mapping.identifier.table,
+		subjectTable: mapping.subject.table,
+		subjectJoin: eq(subject.id, binding.subjectId),
+		credentialTable: mapping.credential.table,
+		credentialJoin: and(eq(credential.moduleId, moduleId), eq(credential.subjectId, binding.subjectId), eq(credential.identifierNamespace, binding.namespace), eq(credential.identifierValue, binding.value)),
+		predicate: and(eq(binding.namespace, identifier.namespace), eq(binding.value, identifier.value)),
+		limit: 1
+	};
+};
+const emailLookupRows = Effect.fn("Drizzle.emailLookupRows")(function* (mapping, moduleId, identifier) {
+	const database = yield* CurrentEmailSql;
+	const query = emailLookupQuery(mapping, moduleId, identifier);
+	return yield* database.select(query.fields).from(query.from).innerJoin(query.subjectTable, query.subjectJoin).innerJoin(query.credentialTable, query.credentialJoin).where(query.predicate).limit(query.limit);
+});
+const decodeEmailSnapshot = Effect.fn("DrizzleEmail.decodeSnapshot")(function* (mapping, moduleId, requested, row) {
+	if (!mapping.subject.isActiveStatus(row.subject[mapping.subject.status]) || !mapping.identifier.isCurrent(row.identifier) || !mapping.credential.isActiveStatus(row.credential[mapping.credential.status])) return void 0;
+	const snapshot = yield* mapping.credential.decode({
+		moduleId,
+		subject: row.subject,
+		identifier: row.identifier,
+		credential: row.credential
+	}).pipe(Effect.flatMap(snapshotEmailCredential));
+	const subjectId = yield* mapping.subjectId.toSubject(row.subject[mapping.subject.id]);
+	const verifiedAtMillis = yield* mapping.decodeInstant(row.identifier[mapping.identifier.verifiedAt]);
+	if (snapshot.moduleId !== moduleId || !sameIdentifier(snapshot.identifier, requested) || snapshot.revision.subjectId !== subjectId || snapshot.revision.securityRevision !== row.subject[mapping.subject.securityRevision] || snapshot.identifierRevision !== row.identifier[mapping.identifier.bindingRevision] || snapshot.verifiedAtMillis !== verifiedAtMillis || snapshot.credentialId !== row.credential[mapping.credential.credentialId] || snapshot.credentialRevision !== row.credential[mapping.credential.credentialRevision]) return void 0;
+	return snapshot;
+});
+const makeSqlEmailSignInTargets = Effect.fn("makeSqlEmailSignInTargets")(function(database, mapping, configuration) {
+	return Effect.succeed(EmailSignInTargets.of({ lookup: (input) => (validEmailSignInConstraints(mapping) ? safeRead(database, configuration, Effect.gen(function* () {
+		const row = (yield* emailLookupRows(mapping, input.moduleId, input.identifier))[0];
+		if (row === void 0) return Option.none();
+		const snapshot = yield* decodeEmailSnapshot(mapping, input.moduleId, input.identifier, row);
+		return snapshot === void 0 ? Option.none() : Option.some(snapshot);
+	})) : Effect.fail(unavailable())).pipe(Effect.provideService(CurrentEmailSql, database), translateFailure) }));
+});
+const readSubject = Effect.fn("DrizzleEmail.readSubject")(function* (mapping, subjectId, locking) {
+	const database = yield* CurrentEmailSql;
+	const nativeSubjectId = yield* mapping.subjectId.toNative(subjectId);
+	const s = subjectColumns(mapping);
+	return {
+		nativeSubjectId,
+		subject: (yield* selectRows(database.select().from(mapping.subject.table).where(eq(s.id, nativeSubjectId)).limit(1), locking))[0]
+	};
+});
+const identifierRow = Effect.fn("Drizzle.identifierRow")(function* (mapping, identifier, locking) {
+	const database = yield* CurrentEmailSql;
+	const i = identifierColumns(mapping);
+	return yield* selectRows(database.select().from(mapping.identifier.table).where(and(eq(i.namespace, identifier.namespace), eq(i.value, identifier.value))).limit(1), locking);
+});
+const credentialById = Effect.fn("Drizzle.credentialById")(function* (mapping, moduleId, credentialId, locking) {
+	const database = yield* CurrentEmailSql;
+	const c = credentialColumns(mapping);
+	return yield* selectRows(database.select().from(mapping.credential.table).where(and(eq(c.moduleId, moduleId), eq(c.credentialId, credentialId))).limit(1), locking);
+});
+const credentialByIdentifier = Effect.fn("Drizzle.credentialByIdentifier")(function* (mapping, moduleId, identifier, locking) {
+	const database = yield* CurrentEmailSql;
+	const c = credentialColumns(mapping);
+	return yield* selectRows(database.select().from(mapping.credential.table).where(and(eq(c.moduleId, moduleId), eq(c.identifierNamespace, identifier.namespace), eq(c.identifierValue, identifier.value))).limit(1), locking);
+});
+const currentAddress = Effect.fn("DrizzleEmail.currentAddress")(function* (mapping, input, locking) {
+	const database = yield* CurrentEmailSql;
+	const locked = yield* readSubject(mapping, input.subjectId, locking);
+	if (locked.subject === void 0 || !mapping.subject.isActiveStatus(locked.subject[mapping.subject.status])) return void 0;
+	const discoveredSource = input.sourceCredentialId === void 0 ? void 0 : (yield* credentialById(mapping, input.moduleId, input.sourceCredentialId, false))[0];
+	const sourceIdentifier = discoveredSource === void 0 ? void 0 : {
+		namespace: discoveredSource[mapping.credential.identifierNamespace],
+		value: discoveredSource[mapping.credential.identifierValue]
+	};
+	const identifiers = [input.target, ...sourceIdentifier === void 0 ? [] : [sourceIdentifier]].filter((value, index, values) => values.findIndex((candidate) => sameIdentifier(candidate, value)) === index).sort((left, right) => `${left.namespace}\u0000${left.value}`.localeCompare(`${right.namespace}\u0000${right.value}`));
+	const lockedIdentifiers = /* @__PURE__ */ new Map();
+	for (const identifier of identifiers) {
+		const row = (yield* identifierRow(mapping, identifier, locking))[0];
+		if (row !== void 0) lockedIdentifiers.set(`${identifier.namespace}\u0000${identifier.value}`, row);
+	}
+	const sourceCredential = input.sourceCredentialId === void 0 ? void 0 : (yield* credentialById(mapping, input.moduleId, input.sourceCredentialId, locking))[0];
+	const targetCredential = (yield* credentialByIdentifier(mapping, input.moduleId, input.target, locking))[0];
+	const a = authorityColumns(mapping);
+	const activeAuthority = (yield* selectRows(database.select().from(mapping.authorityCredential.table).where(eq(a.subjectId, locked.nativeSubjectId)).orderBy(a.credentialId), locking)).filter((row) => mapping.authorityCredential.isActiveStatus(row[mapping.authorityCredential.status]));
+	const subjectId = yield* mapping.subjectId.toSubject(locked.nativeSubjectId);
+	const revision = Object.freeze({
+		subjectId,
+		securityRevision: locked.subject[mapping.subject.securityRevision],
+		credentials: Object.freeze(activeAuthority.map((row) => Object.freeze({
+			credentialId: row[mapping.authorityCredential.credentialId],
+			revision: row[mapping.authorityCredential.revision]
+		})))
+	});
+	const targetIdentifier = lockedIdentifiers.get(`${input.target.namespace}\u0000${input.target.value}`);
+	const targetMutable = targetIdentifier !== void 0 && mapping.subjectId.equals(targetIdentifier[mapping.identifier.subjectId], locked.nativeSubjectId) && mapping.identifier.isMutableTarget(targetIdentifier) && (targetCredential === void 0 || !mapping.credential.isActiveStatus(targetCredential[mapping.credential.status]) && mapping.subjectId.equals(targetCredential[mapping.credential.subjectId], locked.nativeSubjectId));
+	let source;
+	if (input.sourceCredentialId !== void 0) {
+		if (sourceCredential === void 0 || sourceIdentifier === void 0 || !mapping.subjectId.equals(sourceCredential[mapping.credential.subjectId], locked.nativeSubjectId) || !mapping.credential.isActiveStatus(sourceCredential[mapping.credential.status])) return void 0;
+		const sourceIdentifierRow = lockedIdentifiers.get(`${sourceIdentifier.namespace}\u0000${sourceIdentifier.value}`);
+		if (sourceIdentifierRow === void 0 || !mapping.identifier.isCurrent(sourceIdentifierRow) || !mapping.subjectId.equals(sourceIdentifierRow[mapping.identifier.subjectId], locked.nativeSubjectId)) return void 0;
+		source = {
+			credential: sourceCredential,
+			identifier: sourceIdentifierRow,
+			snapshot: yield* mapping.credential.decode({
+				moduleId: input.moduleId,
+				subject: locked.subject,
+				identifier: sourceIdentifierRow,
+				credential: sourceCredential
+			}).pipe(Effect.flatMap(snapshotEmailCredential))
+		};
+	}
+	let eligible = targetIdentifier === void 0 ? targetCredential === void 0 : targetMutable;
+	if (input.sourceCredentialId !== void 0 && source === void 0) eligible = false;
+	if (source !== void 0 && sameIdentifier(source.snapshot.identifier, input.target)) eligible = false;
+	if (mapping.addressCardinality === "single" && input.sourceCredentialId === void 0) {
+		const c = credentialColumns(mapping);
+		if ((yield* selectRows(database.select().from(mapping.credential.table).where(and(eq(c.moduleId, input.moduleId), eq(c.subjectId, locked.nativeSubjectId))), locking)).some((row) => mapping.credential.isActiveStatus(row[mapping.credential.status]))) eligible = false;
+	}
+	return {
+		nativeSubjectId: locked.nativeSubjectId,
+		subject: locked.subject,
+		revision,
+		...source === void 0 ? {} : { source },
+		...targetIdentifier === void 0 ? {} : { targetIdentifier },
+		...targetCredential === void 0 ? {} : { targetCredential },
+		eligible
+	};
+});
+const sameEmailRevision = (left, right) => {
+	if (left.subjectId !== right.subjectId || left.securityRevision !== right.securityRevision || left.credentials.length !== right.credentials.length) return false;
+	const expected = [...left.credentials].sort((a, b) => a.credentialId.localeCompare(b.credentialId));
+	const actual = [...right.credentials].sort((a, b) => a.credentialId.localeCompare(b.credentialId));
+	return expected.every((item, index) => item.credentialId === actual[index].credentialId && item.revision === actual[index].revision);
+};
+const actionModule = (moduleId, action) => `${moduleId}/${action === "verify-address" ? "verify-address" : "change-address"}`;
+const actionPurpose = (action) => action === "verify-address" ? "email-address-verification" : "email-address-change";
+const completionMatches = (input, action) => {
+	const completion = input.completion.input;
+	const binding = completion.binding;
+	return completion.moduleId === actionModule(input.moduleId, action) && completion.purpose === actionPurpose(action) && binding._tag === "IdentifierChange" && sameIdentifier(binding.identifier, input.target) && sameEmailRevision(binding.revision, input.captured.revision);
+};
+const snapshotEmailMutation = Effect.fn("DrizzleEmail.snapshotMutation")(function* (input) {
+	const evidence = yield* snapshotAuthenticationEvidence(input.authorization.evidence).pipe(Effect.mapError(unavailable));
+	const requirement = yield* snapshotEmailRequirement(input.authorization.requirement);
+	const source = input.captured.source === void 0 ? void 0 : yield* snapshotEmailCredential(input.captured.source);
+	return Object.freeze({
+		...input,
+		target: Object.freeze({ ...input.target }),
+		invalidation: Object.freeze({ ...input.invalidation }),
+		captured: Object.freeze({
+			eligible: input.captured.eligible,
+			revision: snapshotEmailRevision(input.captured.revision),
+			...source === void 0 ? {} : { source }
+		}),
+		authorization: Object.freeze({
+			challenge: Object.freeze({
+				...input.authorization.challenge,
+				target: Object.freeze({ ...input.authorization.challenge.target }),
+				revision: snapshotEmailRevision(input.authorization.challenge.revision)
+			}),
+			evidence,
+			requirement
+		})
+	});
+});
+const validateEmailAuthority = Effect.fn("DrizzleEmail.validateAuthority")(function* (mapping, configuration, input, action) {
+	if (!input.captured.eligible || !completionMatches(input, action) || input.authorization.challenge.moduleId !== input.moduleId || input.authorization.challenge.action !== action || input.authorization.challenge.commandId !== input.commandId || !sameIdentifier(input.authorization.challenge.target, input.target) || input.authorization.challenge.sourceCredentialId !== input.captured.source?.credentialId || !sameEmailRevision(input.authorization.challenge.revision, input.captured.revision) || input.authorization.evidence.flowId !== input.commandId || input.authorization.evidence.bindingDigest !== input.authorization.challenge.bindingDigest || !sameEmailRevision(input.authorization.evidence.revision, input.captured.revision) || action === "verify-address" && input.captured.source !== void 0 || action === "change-address" && input.captured.source === void 0 || input.invalidation.existingSessions === "immediate" && mapping.sessionInvalidation !== "same-authority-immediate") return void 0;
+	const current = yield* currentAddress(mapping, {
+		moduleId: input.moduleId,
+		subjectId: input.captured.revision.subjectId,
+		target: input.target,
+		...input.captured.source === void 0 ? {} : { sourceCredentialId: input.captured.source.credentialId }
+	}, configuration.locking);
+	if (current === void 0 || !current.eligible || !sameEmailRevision(current.revision, input.captured.revision) || input.captured.source !== void 0 && (current.source === void 0 || current.source.snapshot.identifierRevision !== input.captured.source.identifierRevision || current.source.snapshot.credentialRevision !== input.captured.source.credentialRevision || !sameIdentifier(current.source.snapshot.identifier, input.captured.source.identifier))) return void 0;
+	const currentRequirement = yield* mapping.subject.decodeActionRequirement(current.subject, action);
+	const original = yield* assessAuthentication(input.authorization.evidence, input.authorization.requirement).pipe(Effect.mapError(unavailable));
+	const configured = yield* assessAuthentication(input.authorization.evidence, currentRequirement).pipe(Effect.mapError(unavailable));
+	return original.satisfied && configured.satisfied ? current : void 0;
+});
+const commandExists = Effect.fn("Drizzle.commandExists")(function* (mapping, moduleId, commandId, locking) {
+	const database = yield* CurrentEmailSql;
+	const c = commandColumns(mapping);
+	return yield* selectRows(database.select().from(mapping.command.table).where(and(eq(c.moduleId, moduleId), eq(c.commandId, commandId))).limit(1), locking);
+});
+const applyMutation = Effect.fn("DrizzleEmail.applyMutation")(function* (mapping, input, action, current, allocated, now) {
+	const database = yield* CurrentEmailSql;
+	const i = identifierColumns(mapping);
+	const c = credentialColumns(mapping);
+	const a = authorityColumns(mapping);
+	const s = subjectColumns(mapping);
+	const targetCredentialId = current.targetCredential?.[mapping.credential.credentialId] ?? allocated.targetCredentialId;
+	if (action === "change-address") {
+		const source = current.source;
+		yield* database.update(mapping.identifier.table).set(mapping.identifier.encodeRetirement({
+			source: source.snapshot.identifier,
+			bindingRevision: allocated.sourceIdentifierRevision
+		})).where(and(eq(i.namespace, source.snapshot.identifier.namespace), eq(i.value, source.snapshot.identifier.value), eq(i.subjectId, current.nativeSubjectId), eq(i.bindingRevision, source.snapshot.identifierRevision)));
+		yield* database.update(mapping.credential.table).set(mapping.credential.encodeRetirement({
+			source: source.snapshot.identifier,
+			credentialRevision: allocated.sourceCredentialRevision
+		})).where(and(eq(c.moduleId, input.moduleId), eq(c.credentialId, source.snapshot.credentialId), eq(c.subjectId, current.nativeSubjectId), eq(c.credentialRevision, source.snapshot.credentialRevision)));
+		yield* database.update(mapping.authorityCredential.table).set(mapping.authorityCredential.encodeRetirement(allocated.sourceCredentialRevision)).where(and(eq(a.subjectId, current.nativeSubjectId), eq(a.credentialId, source.snapshot.credentialId), eq(a.revision, source.snapshot.credentialRevision)));
+	}
+	if (current.targetIdentifier === void 0) yield* database.insert(mapping.identifier.table).values(mapping.identifier.encodeVerifiedInsert({
+		identifier: input.target,
+		subjectId: current.nativeSubjectId,
+		verifiedAtMillis: now,
+		bindingRevision: allocated.targetIdentifierRevision
+	}));
+	else yield* database.update(mapping.identifier.table).set(mapping.identifier.encodeVerification({
+		verifiedAtMillis: now,
+		bindingRevision: allocated.targetIdentifierRevision
+	})).where(and(eq(i.namespace, input.target.namespace), eq(i.value, input.target.value), eq(i.subjectId, current.nativeSubjectId), eq(i.bindingRevision, current.targetIdentifier[mapping.identifier.bindingRevision])));
+	if (current.targetCredential === void 0) {
+		yield* database.insert(mapping.credential.table).values(mapping.credential.encodeVerifiedInsert({
+			moduleId: input.moduleId,
+			subjectId: current.nativeSubjectId,
+			credentialId: targetCredentialId,
+			identifier: input.target,
+			credentialRevision: allocated.targetCredentialRevision
+		}));
+		yield* database.insert(mapping.authorityCredential.table).values(mapping.authorityCredential.encodeInsert({
+			subjectId: current.nativeSubjectId,
+			credentialId: targetCredentialId,
+			revision: allocated.targetCredentialRevision
+		}));
+	} else {
+		const oldRevision = current.targetCredential[mapping.credential.credentialRevision];
+		yield* database.update(mapping.credential.table).set(mapping.credential.encodeActivation({
+			identifier: input.target,
+			credentialRevision: allocated.targetCredentialRevision
+		})).where(and(eq(c.moduleId, input.moduleId), eq(c.credentialId, targetCredentialId), eq(c.subjectId, current.nativeSubjectId), eq(c.credentialRevision, oldRevision)));
+		yield* database.update(mapping.authorityCredential.table).set(mapping.authorityCredential.encodeActivation(allocated.targetCredentialRevision)).where(and(eq(a.subjectId, current.nativeSubjectId), eq(a.credentialId, targetCredentialId), eq(a.revision, oldRevision)));
+	}
+	yield* database.update(mapping.subject.table).set(updateValues([[mapping.subject.securityRevision, allocated.nextSecurityRevision]])).where(and(eq(s.id, current.nativeSubjectId), eq(s.securityRevision, input.captured.revision.securityRevision)));
+	yield* database.insert(mapping.command.table).values(mapping.command.encodeInsert({
+		moduleId: input.moduleId,
+		commandId: input.commandId,
+		action,
+		bindingDigest: input.authorization.challenge.bindingDigest,
+		retentionUntilMillis: now + mapping.commandRetentionMillis
+	}));
+	const sourceStillActive = action === "verify-address" ? [] : yield* selectRows(database.select().from(mapping.credential.table).where(and(eq(c.moduleId, input.moduleId), eq(c.credentialId, current.source.snapshot.credentialId), eq(c.subjectId, current.nativeSubjectId))), false);
+	const target = (yield* emailLookupRows(mapping, input.moduleId, input.target))[0];
+	const targetAuthority = yield* selectRows(database.select().from(mapping.authorityCredential.table).where(and(eq(a.subjectId, current.nativeSubjectId), eq(a.credentialId, targetCredentialId))).limit(1), false);
+	const command = yield* selectRows(database.select().from(mapping.command.table).where(and(eq(commandColumns(mapping).moduleId, input.moduleId), eq(commandColumns(mapping).commandId, input.commandId), eq(commandColumns(mapping).action, action), eq(commandColumns(mapping).bindingDigest, input.authorization.challenge.bindingDigest), eq(commandColumns(mapping).retentionUntil, mapping.encodeInstant(now + mapping.commandRetentionMillis)))).limit(1), false);
+	const targetVerifiedAt = target === void 0 ? void 0 : yield* mapping.decodeInstant(target.identifier[mapping.identifier.verifiedAt]);
+	const sourceIdentifier = action === "verify-address" ? [] : yield* identifierRow(mapping, current.source.snapshot.identifier, false);
+	const sourceAuthority = action === "verify-address" ? [] : yield* selectRows(database.select().from(mapping.authorityCredential.table).where(and(eq(a.subjectId, current.nativeSubjectId), eq(a.credentialId, current.source.snapshot.credentialId))).limit(1), false);
+	return target !== void 0 && mapping.subjectId.equals(target.subject[mapping.subject.id], current.nativeSubjectId) && mapping.subject.isActiveStatus(target.subject[mapping.subject.status]) && target.subject[mapping.subject.securityRevision] === allocated.nextSecurityRevision && target.identifier[mapping.identifier.bindingRevision] === allocated.targetIdentifierRevision && targetVerifiedAt === now && target.credential[mapping.credential.credentialRevision] === allocated.targetCredentialRevision && target.credential[mapping.credential.credentialId] === targetCredentialId && mapping.subjectId.equals(target.credential[mapping.credential.subjectId], current.nativeSubjectId) && mapping.identifier.isCurrent(target.identifier) && mapping.credential.isActiveStatus(target.credential[mapping.credential.status]) && targetAuthority.length === 1 && targetAuthority[0][mapping.authorityCredential.revision] === allocated.targetCredentialRevision && mapping.authorityCredential.isActiveStatus(targetAuthority[0][mapping.authorityCredential.status]) && command.length === 1 && (action === "verify-address" || sourceStillActive.length === 1 && sourceStillActive[0][mapping.credential.credentialRevision] === allocated.sourceCredentialRevision && !mapping.credential.isActiveStatus(sourceStillActive[0][mapping.credential.status]) && sourceIdentifier.length === 1 && mapping.subjectId.equals(sourceIdentifier[0][mapping.identifier.subjectId], current.nativeSubjectId) && sourceIdentifier[0][mapping.identifier.bindingRevision] === allocated.sourceIdentifierRevision && !mapping.identifier.isCurrent(sourceIdentifier[0]) && sourceAuthority.length === 1 && sourceAuthority[0][mapping.authorityCredential.revision] === allocated.sourceCredentialRevision && !mapping.authorityCredential.isActiveStatus(sourceAuthority[0][mapping.authorityCredential.status]));
+});
+const probeProofCompletion = Effect.fn("Drizzle.probeProofCompletion")(function* (configuration, input) {
+	const database = yield* CurrentEmailSql;
+	if (configuration.proof === void 0) return yield* Effect.fail(unavailable());
+	const validProbe = { _tag: "EmailProofCompletionValid" };
+	const plan = {
+		input,
+		prepare: (decision, journal, project) => journal.prepare(project(decision))
+	};
+	return yield* coordinateCommit(() => database.transaction((transaction) => completeProofPlanIn(configuration.proof.mapping, configuration.proof.configuration, plan, Effect.fail(validProbe), () => false).pipe(Effect.provideService(CurrentProofSql, transaction))), { mode: configuration.mode }).pipe(Effect.as(false), Effect.catchCause((cause) => {
+		const reason = cause.reasons[0];
+		return cause.reasons.length === 1 && reason !== void 0 && Cause.isFailReason(reason) && reason.error === validProbe ? Effect.succeed(true) : Effect.failCause(cause);
+	}));
+});
+const prepareRejected = Effect.fn("Drizzle.prepareRejected")(function* (configuration, prepare) {
+	const database = yield* CurrentEmailSql;
+	return yield* owned(database, configuration, Effect.gen(function* () {
+		const journal = yield* CurrentCommitJournal;
+		return yield* Effect.succeed(prepare("rejected", journal));
+	}));
+});
+const makeSqlEmailAddressPersistence = Effect.fn("makeSqlEmailAddressPersistence")(function* (database, mapping, configuration) {
+	const hooks = yield* LifecycleHooks;
+	return EmailAddressPersistence.of({
+		target: (input) => (validAddressConstraints(mapping) ? safeRead(database, configuration, Effect.gen(function* () {
+			const current = yield* currentAddress(mapping, input, configuration.locking);
+			if (current === void 0) return yield* unavailable();
+			return Object.freeze({
+				revision: snapshotEmailRevision(current.revision),
+				eligible: current.eligible,
+				...current.source === void 0 ? {} : { source: yield* snapshotEmailCredential(current.source.snapshot) }
+			});
+		})) : Effect.fail(unavailable())).pipe(Effect.provideService(CurrentEmailSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
+		checkCompletion: (input) => {
+			if (configuration.proof === void 0 || input.binding._tag !== "IdentifierChange") return Effect.succeed(false).pipe(Effect.provideService(CurrentEmailSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure);
+			const binding = input.binding;
+			return safeRead(database, configuration, Effect.gen(function* () {
+				const action = input.moduleId.endsWith("/verify-address") && input.purpose === "email-address-verification" ? "verify-address" : input.moduleId.endsWith("/change-address") && input.purpose === "email-address-change" ? "change-address" : void 0;
+				if (action === void 0) return false;
+				const moduleId = input.moduleId.slice(0, -`/${action}`.length);
+				const current = yield* currentAddress(mapping, {
+					moduleId,
+					subjectId: binding.revision.subjectId,
+					target: binding.identifier
+				}, false);
+				return current !== void 0 && sameEmailRevision(current.revision, binding.revision);
+			})).pipe(Effect.flatMap((current) => current ? probeProofCompletion(configuration, input) : Effect.succeed(false))).pipe(Effect.provideService(CurrentEmailSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure);
+		},
+		verifyWithProof: (uncaptured, prepare) => mutateAddress(mapping, configuration, uncaptured, "verify-address", prepare).pipe(Effect.provideService(CurrentEmailSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
+		changeWithProof: (uncaptured, prepare) => mutateAddress(mapping, configuration, uncaptured, "change-address", prepare).pipe(Effect.provideService(CurrentEmailSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
+		cleanup: (input, prepare) => owned(database, configuration, Effect.gen(function* () {
+			const transaction = yield* CurrentEmailSql;
+			const journal = yield* CurrentCommitJournal;
+			const c = commandColumns(mapping);
+			const now = yield* nowMillis;
+			const rows = yield* selectRows(transaction.select({ commandId: c.commandId }).from(mapping.command.table).where(and(eq(c.moduleId, input.moduleId), lte(c.retentionUntil, mapping.encodeInstant(now)))).limit(input.limit + 1), configuration.locking);
+			const selected = rows.slice(0, input.limit);
+			const receipt = prepare({
+				removed: selected.length,
+				hasMore: rows.length > input.limit
+			}, journal);
+			if (selected.length > 0) yield* transaction.delete(mapping.command.table).where(and(eq(c.moduleId, input.moduleId), inArray(c.commandId, selected.map((row) => row.commandId)), lte(c.retentionUntil, mapping.encodeInstant(now))));
+			return receipt;
+		})).pipe(Effect.provideService(CurrentEmailSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure)
+	});
+});
+const mutateAddress = Effect.fn("Drizzle.mutateAddress")(function* (mapping, configuration, uncaptured, action, prepare) {
+	const database = yield* CurrentEmailSql;
+	if (!validAddressConstraints(mapping) || configuration.proof === void 0) return yield* unavailable();
+	const input = yield* snapshotEmailMutation(uncaptured);
+	const targetCredentialId = yield* allocate(configuration.mode, mapping.allocateCredentialId, mapping.allocateCredentialIdSync);
+	const targetIdentifierRevision = yield* allocate(configuration.mode, mapping.allocateRevision, mapping.allocateRevisionSync);
+	const targetCredentialRevision = yield* allocate(configuration.mode, mapping.allocateRevision, mapping.allocateRevisionSync);
+	const sourceIdentifierRevision = yield* allocate(configuration.mode, mapping.allocateRevision, mapping.allocateRevisionSync);
+	const sourceCredentialRevision = yield* allocate(configuration.mode, mapping.allocateRevision, mapping.allocateRevisionSync);
+	const nextRevision = yield* nextSecurityRevision(mapping, configuration.mode, input.captured.revision.securityRevision);
+	if (nextRevision === input.captured.revision.securityRevision || [
+		targetIdentifierRevision,
+		targetCredentialRevision,
+		sourceIdentifierRevision,
+		sourceCredentialRevision
+	].some((value) => input.captured.revision.credentials.some((item) => item.revision === value))) return yield* unavailable();
+	return yield* owned(database, configuration, Effect.gen(function* () {
+		const journal = yield* CurrentCommitJournal;
+		const current = yield* validateEmailAuthority(mapping, configuration, input, action);
+		if (current === void 0) return prepare("rejected", journal);
+		if ((yield* commandExists(mapping, input.moduleId, input.commandId, configuration.locking)).length > 0) return prepare("rejected", journal);
+		let receipt;
+		yield* completeProofPlanIn(configuration.proof.mapping, configuration.proof.configuration, input.completion, Effect.gen(function* () {
+			const currentRequirement = yield* mapping.subject.decodeActionRequirement(current.subject, action);
+			const original = yield* assessAuthentication(input.authorization.evidence, input.authorization.requirement).pipe(Effect.mapError(unavailable));
+			const configured = yield* assessAuthentication(input.authorization.evidence, currentRequirement).pipe(Effect.mapError(unavailable));
+			if (!original.satisfied || !configured.satisfied) return false;
+			const now = yield* nowMillis;
+			return yield* applyMutation(mapping, input, action, current, {
+				targetCredentialId,
+				targetIdentifierRevision,
+				targetCredentialRevision,
+				sourceIdentifierRevision,
+				sourceCredentialRevision,
+				nextSecurityRevision: nextRevision
+			}, now);
+		}), (decision) => {
+			receipt = prepare(decision === "completed" ? "changed" : "rejected", journal);
+			return decision;
+		});
+		return receipt ?? prepare("rejected", journal);
+	})).pipe(Effect.catchCause((cause) => cause.reasons.every(Cause.isFailReason) && isMappedConstraintConflict(mapping.isCommandConflict, cause) || cause.reasons.every(Cause.isFailReason) && isMappedConstraintConflict(mapping.isIdentifierConflict, cause) || cause.reasons.every(Cause.isFailReason) && isMappedConstraintConflict(mapping.isCredentialConflict, cause) ? prepareRejected(configuration, prepare) : Effect.failCause(cause)));
+});
+//#endregion
+export { CurrentEmailSql, currentAddress, decodeEmailSnapshot, emailLookupQuery, makeSqlEmailAddressPersistence, makeSqlEmailSignInTargets, sameEmailRevision, snapshotEmailMutation, validEmailSignInConstraints, validateEmailAuthority };
+
+//# sourceMappingURL=email-sql.mjs.map