@yielded/auth 0.1.0-beta.1

package/dist/drizzle/proof-sql.mjs

@@ -0,0 +1,618 @@
+import { HookConfigurationError } from "../hooks/models.mjs";
+import { reportPersistenceFailure } from "../internal/diagnostics.mjs";
+import { LifecycleHooks } from "../hooks/LifecycleHooks.mjs";
+import { CurrentCommitJournal, coordinateCommit, hasCommitScope } from "../hooks/commit.mjs";
+import { requiredProofConstraints } from "./proof-model.mjs";
+import { DrizzleMappingError, column, updateValues } from "./model.mjs";
+import { ProofRequestConflict, ProofUnavailable } from "../proofs/errors.mjs";
+import { ProofBinding } from "../proofs/models.mjs";
+import { ProofPersistence } from "../proofs/ProofPersistence.mjs";
+import { CurrentPasswordPreparedTransaction, PasswordPreparedPostconditions } from "./PasswordPreparedPostconditions.mjs";
+import { Cause, Context, DateTime, Effect, Option, Schema } from "effect";
+import { and, eq, gte, inArray, isNull, lte, notExists, sql } from "drizzle-orm";
+//#region src/drizzle/proof-sql.ts
+var CurrentProofSql = class extends Context.Service()("effect-auth/CurrentProofSql") {};
+const unavailable = () => ProofUnavailable.make({});
+const translateFailure = (effect) => reportPersistenceFailure(effect, (error) => Schema.is(ProofUnavailable)(error) || Schema.is(HookConfigurationError)(error)).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));
+const translateIssueFailure = (effect) => reportPersistenceFailure(effect, (error) => Schema.is(ProofUnavailable)(error) || Schema.is(ProofRequestConflict)(error) || Schema.is(HookConfigurationError)(error)).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, (error) => Schema.is(ProofRequestConflict)(error) ? error : unavailable()))));
+const conflict = () => ProofRequestConflict.make({});
+const validConstraints = (mapping) => Object.entries(requiredProofConstraints).every(([key, value]) => mapping.constraints[key] === value);
+const selectRows = (query, locking) => locking && typeof query.for === "function" ? query.for("update") : query;
+const allocateVersion = (mapping, mode) => {
+	if (mode === "synchronous") return mapping.allocateVersionSync === void 0 ? Effect.fail(unavailable()) : Effect.try({
+		try: mapping.allocateVersionSync,
+		catch: (cause) => new DrizzleMappingError({
+			operation: "mapping",
+			cause
+		})
+	});
+	if (mapping.allocateVersion !== void 0) return mapping.allocateVersion;
+	return mapping.allocateVersionSync === void 0 ? Effect.fail(unavailable()) : Effect.try({
+		try: mapping.allocateVersionSync,
+		catch: (cause) => new DrizzleMappingError({
+			operation: "mapping",
+			cause
+		})
+	});
+};
+const canonicalBinding = Schema.encodeSync(Schema.fromJsonString(ProofBinding));
+const sameBinding = (left, right) => canonicalBinding(left) === canonicalBinding(right);
+const requestColumns = (mapping) => ({
+	moduleId: column(mapping.request.table, mapping.request.moduleId),
+	requestId: column(mapping.request.table, mapping.request.requestId),
+	fingerprint: column(mapping.request.table, mapping.request.fingerprint),
+	proofId: column(mapping.request.table, mapping.request.proofId),
+	retentionUntil: column(mapping.request.table, mapping.request.retentionUntil)
+});
+const seriesColumns = (mapping) => ({
+	moduleId: column(mapping.series.table, mapping.series.moduleId),
+	purpose: column(mapping.series.table, mapping.series.purpose),
+	scopeKey: column(mapping.series.table, mapping.series.scopeKey),
+	activeProofId: column(mapping.series.table, mapping.series.activeProofId),
+	lastIssueAt: column(mapping.series.table, mapping.series.lastIssueAt),
+	version: column(mapping.series.table, mapping.series.version)
+});
+const generationColumns = (mapping) => ({
+	moduleId: column(mapping.generation.table, mapping.generation.moduleId),
+	purpose: column(mapping.generation.table, mapping.generation.purpose),
+	proofId: column(mapping.generation.table, mapping.generation.proofId),
+	requestId: column(mapping.generation.table, mapping.generation.requestId),
+	seriesKey: column(mapping.generation.table, mapping.generation.seriesKey),
+	deliveryId: column(mapping.generation.table, mapping.generation.deliveryId),
+	verifierKeyId: column(mapping.generation.table, mapping.generation.verifierKeyId),
+	verifierDigest: column(mapping.generation.table, mapping.generation.verifierDigest),
+	issuedAt: column(mapping.generation.table, mapping.generation.issuedAt),
+	expiresAt: column(mapping.generation.table, mapping.generation.expiresAt),
+	version: column(mapping.generation.table, mapping.generation.version),
+	state: column(mapping.generation.table, mapping.generation.state),
+	sendCount: column(mapping.generation.table, mapping.generation.sendCount),
+	deliveryState: column(mapping.generation.table, mapping.generation.deliveryState),
+	claimVersion: column(mapping.generation.table, mapping.generation.claimVersion),
+	claimDeadline: column(mapping.generation.table, mapping.generation.claimDeadline),
+	retryAt: column(mapping.generation.table, mapping.generation.retryAt),
+	deliveryRetryMillis: column(mapping.generation.table, mapping.generation.deliveryRetryMillis),
+	retentionUntil: column(mapping.generation.table, mapping.generation.retentionUntil)
+});
+const continuationColumns = (mapping) => ({
+	moduleId: column(mapping.continuation.table, mapping.continuation.moduleId),
+	purpose: column(mapping.continuation.table, mapping.continuation.purpose),
+	continuationId: column(mapping.continuation.table, mapping.continuation.continuationId),
+	digest: column(mapping.continuation.table, mapping.continuation.digest),
+	proofId: column(mapping.continuation.table, mapping.continuation.proofId),
+	seriesKey: column(mapping.continuation.table, mapping.continuation.seriesKey),
+	expiresAt: column(mapping.continuation.table, mapping.continuation.expiresAt),
+	consumed: column(mapping.continuation.table, mapping.continuation.consumed),
+	version: column(mapping.continuation.table, mapping.continuation.version),
+	retentionUntil: column(mapping.continuation.table, mapping.continuation.retentionUntil)
+});
+const scopeColumns = (mapping) => ({
+	moduleId: column(mapping.rateScope.table, mapping.rateScope.moduleId),
+	purpose: column(mapping.rateScope.table, mapping.rateScope.purpose),
+	action: column(mapping.rateScope.table, mapping.rateScope.action),
+	scopeKind: column(mapping.rateScope.table, mapping.rateScope.scopeKind),
+	scopeKey: column(mapping.rateScope.table, mapping.rateScope.scopeKey)
+});
+const abuseColumns = (mapping) => ({
+	moduleId: column(mapping.abuseEvent.table, mapping.abuseEvent.moduleId),
+	purpose: column(mapping.abuseEvent.table, mapping.abuseEvent.purpose),
+	action: column(mapping.abuseEvent.table, mapping.abuseEvent.action),
+	scopeKind: column(mapping.abuseEvent.table, mapping.abuseEvent.scopeKind),
+	scopeKey: column(mapping.abuseEvent.table, mapping.abuseEvent.scopeKey),
+	commandId: column(mapping.abuseEvent.table, mapping.abuseEvent.commandId),
+	occurredAt: column(mapping.abuseEvent.table, mapping.abuseEvent.occurredAt),
+	retentionUntil: column(mapping.abuseEvent.table, mapping.abuseEvent.retentionUntil)
+});
+const failureColumns = (mapping) => ({
+	moduleId: column(mapping.failureEvent.table, mapping.failureEvent.moduleId),
+	purpose: column(mapping.failureEvent.table, mapping.failureEvent.purpose),
+	seriesKey: column(mapping.failureEvent.table, mapping.failureEvent.seriesKey),
+	commandId: column(mapping.failureEvent.table, mapping.failureEvent.commandId),
+	occurredAt: column(mapping.failureEvent.table, mapping.failureEvent.occurredAt),
+	retentionUntil: column(mapping.failureEvent.table, mapping.failureEvent.retentionUntil)
+});
+const commandColumns = (mapping) => ({
+	moduleId: column(mapping.command.table, mapping.command.moduleId),
+	commandId: column(mapping.command.table, mapping.command.commandId),
+	kind: column(mapping.command.table, mapping.command.kind),
+	decision: column(mapping.command.table, mapping.command.decision),
+	retentionUntil: column(mapping.command.table, mapping.command.retentionUntil)
+});
+const nowMillis = DateTime.now.pipe(Effect.map(DateTime.toEpochMillis));
+const lockAuthority = Effect.fn("DrizzleProof.lockAuthority")(function* (mapping, moduleId, purpose, binding, locking) {
+	const database = yield* CurrentProofSql;
+	const authority = mapping.authority;
+	let nativeSubjectId;
+	if (binding._tag !== "Identifier") {
+		if (authority.subject === void 0 || authority.credential === void 0 || authority.subjectId === void 0) return yield* unavailable();
+		nativeSubjectId = yield* authority.subjectId.toNative(binding.revision.subjectId);
+		const subject = authority.subject;
+		const row = (yield* selectRows(database.select().from(subject.table).where(eq(column(subject.table, subject.id), nativeSubjectId)).limit(1), locking))[0];
+		if (row === void 0 || !subject.isActiveStatus(row[subject.status]) || row[subject.securityRevision] !== binding.revision.securityRevision) return false;
+	}
+	const identifier = authority.identifier;
+	const identifierRows = yield* selectRows(database.select().from(identifier.table).where(and(eq(column(identifier.table, identifier.namespace), binding.identifier.namespace), eq(column(identifier.table, identifier.value), binding.identifier.value))), locking);
+	if (!identifier.isCurrent({
+		moduleId,
+		purpose,
+		binding,
+		...nativeSubjectId === void 0 ? {} : { nativeSubjectId }
+	}, identifierRows)) return false;
+	if (binding._tag === "Identifier") return true;
+	const credential = authority.credential;
+	const expected = [...binding.revision.credentials].sort((a, b) => a.credentialId.localeCompare(b.credentialId));
+	const rows = expected.length === 0 ? [] : yield* selectRows(database.select().from(credential.table).where(and(eq(column(credential.table, credential.subjectId), nativeSubjectId), inArray(column(credential.table, credential.credentialId), expected.map((item) => item.credentialId)))), locking);
+	if (rows.length !== expected.length) return false;
+	return rows.map((row) => ({
+		credentialId: row[credential.credentialId],
+		revision: row[credential.revision],
+		active: credential.status === void 0 || credential.isActiveStatus?.(row[credential.status]) === true
+	})).sort((a, b) => a.credentialId.localeCompare(b.credentialId)).every((item, index) => item.active && item.credentialId === expected[index]?.credentialId && item.revision === expected[index]?.revision);
+});
+const scopeEntries = (keys, binding, action, policy) => {
+	const suffix = action === "issue" ? "Issues" : "Attempts";
+	const simple = action === "issue" ? "issues" : "attempts";
+	const entries = [{
+		kind: "action",
+		key: "*",
+		budget: policy.abuse[`action${suffix}`]
+	}, {
+		kind: "identifier",
+		key: keys.identifier,
+		budget: policy.abuse[simple]
+	}];
+	if (binding._tag !== "Identifier") entries.push({
+		kind: "subject",
+		key: keys.subject,
+		budget: policy.abuse[`subject${suffix}`]
+	});
+	return entries;
+};
+const lockScopes = Effect.fn("DrizzleProof.lockScopes")(function* (mapping, configuration, moduleId, purpose, action, entries) {
+	const database = yield* CurrentProofSql;
+	const c = scopeColumns(mapping);
+	for (const entry of entries) {
+		const values = mapping.rateScope.encodeInsert({
+			moduleId,
+			purpose,
+			action,
+			scopeKind: entry.kind,
+			scopeKey: entry.key
+		});
+		const query = database.insert(mapping.rateScope.table).values(values);
+		yield* configuration.insertIfAbsent(query, mapping.rateScope.scopeKey, entry.key);
+		yield* selectRows(database.select().from(mapping.rateScope.table).where(and(eq(c.moduleId, moduleId), eq(c.purpose, purpose), eq(c.action, action), eq(c.scopeKind, entry.kind), eq(c.scopeKey, entry.key))).limit(1), configuration.locking);
+	}
+});
+const admittedScopes = Effect.fn("DrizzleProof.admittedScopes")(function* (mapping, moduleId, purpose, action, entries, now) {
+	const database = yield* CurrentProofSql;
+	const c = abuseColumns(mapping);
+	const admitted = [];
+	for (const entry of entries) if ((yield* selectRows(database.select({ commandId: c.commandId }).from(mapping.abuseEvent.table).where(and(eq(c.moduleId, moduleId), eq(c.purpose, purpose), eq(c.action, action), eq(c.scopeKind, entry.kind), eq(c.scopeKey, entry.key), gte(c.occurredAt, mapping.encodeInstant(now - entry.budget.windowMillis)))).limit(entry.budget.limit), true)).length < entry.budget.limit) admitted.push(entry);
+	return admitted;
+});
+const insertScopeEvents = Effect.fn("Drizzle.insertScopeEvents")(function* (mapping, moduleId, purpose, action, commandId, entries, now, retentionUntil) {
+	const database = yield* CurrentProofSql;
+	return yield* Effect.forEach(entries, (entry) => database.insert(mapping.abuseEvent.table).values(mapping.abuseEvent.encodeInsert({
+		moduleId,
+		purpose,
+		action,
+		scopeKind: entry.kind,
+		scopeKey: entry.key,
+		commandId,
+		occurredAtMillis: now,
+		retentionUntilMillis: retentionUntil
+	})), { discard: true });
+});
+const ensureSeries = Effect.fn("DrizzleProof.ensureSeries")(function* (mapping, configuration, moduleId, purpose, scopeKey) {
+	const database = yield* CurrentProofSql;
+	const c = seriesColumns(mapping);
+	const initialVersion = yield* allocateVersion(mapping, configuration.mode);
+	const query = database.insert(mapping.series.table).values(mapping.series.encodeInsert({
+		moduleId,
+		purpose,
+		scopeKey,
+		version: initialVersion
+	}));
+	yield* configuration.insertIfAbsent(query, mapping.series.scopeKey, scopeKey);
+	return (yield* selectRows(database.select().from(mapping.series.table).where(and(eq(c.moduleId, moduleId), eq(c.purpose, purpose), eq(c.scopeKey, scopeKey))).limit(1), configuration.locking))[0] ?? (yield* unavailable());
+});
+const readGeneration = Effect.fn("Drizzle.readGeneration")(function* (mapping, moduleId, proofId, locking) {
+	const database = yield* CurrentProofSql;
+	const c = generationColumns(mapping);
+	return yield* selectRows(database.select().from(mapping.generation.table).where(and(eq(c.moduleId, moduleId), eq(c.proofId, proofId))).limit(1), locking);
+});
+const failureCount = Effect.fn("DrizzleProof.failureCount")(function* (mapping, moduleId, purpose, seriesKey, now, policy) {
+	const database = yield* CurrentProofSql;
+	const c = failureColumns(mapping);
+	return (yield* selectRows(database.select({ commandId: c.commandId }).from(mapping.failureEvent.table).where(and(eq(c.moduleId, moduleId), eq(c.purpose, purpose), eq(c.seriesKey, seriesKey), gte(c.occurredAt, mapping.encodeInstant(now - policy.abuse.attempts.windowMillis)))).limit(policy.maximumFailedAttempts), true)).length;
+});
+const commandRow = Effect.fn("Drizzle.commandRow")(function* (mapping, moduleId, commandId, locking) {
+	const database = yield* CurrentProofSql;
+	const c = commandColumns(mapping);
+	return yield* selectRows(database.select().from(mapping.command.table).where(and(eq(c.moduleId, moduleId), eq(c.commandId, commandId))).limit(1), locking);
+});
+const insertCommand = Effect.fn("Drizzle.insertCommand")(function* (mapping, moduleId, commandId, kind, decision, retentionUntil) {
+	return yield* (yield* CurrentProofSql).insert(mapping.command.table).values(mapping.command.encodeInsert({
+		moduleId,
+		commandId,
+		kind,
+		decision,
+		retentionUntilMillis: retentionUntil
+	}));
+});
+const owned = (database, mapping, configuration, body) => {
+	if (!validConstraints(mapping)) return Effect.fail(unavailable());
+	const run = coordinateCommit(() => database.transaction((transaction) => body.pipe(Effect.provideService(CurrentProofSql, transaction))), { mode: configuration.mode }).pipe(Effect.map((result) => result.value));
+	return configuration.coordinated !== true ? Effect.gen(function* () {
+		if (yield* hasCommitScope) return yield* unavailable();
+		yield* configuration.standaloneGuard;
+		return yield* run;
+	}) : run;
+};
+const makeSqlProofPersistence = Effect.fn("makeSqlProofPersistence")(function* (database, mapping, configuration) {
+	const hooks = yield* LifecycleHooks;
+	return ProofPersistence.of({
+		issue: (input, prepare) => owned(database, mapping, configuration, Effect.gen(function* () {
+			const transaction = yield* CurrentProofSql;
+			const journal = yield* CurrentCommitJournal;
+			const keys = mapping.scopeKeys({
+				moduleId: input.record.moduleId,
+				purpose: input.record.purpose,
+				binding: input.record.binding
+			});
+			const authorityCurrent = yield* lockAuthority(mapping, input.record.moduleId, input.record.purpose, input.record.binding, configuration.locking);
+			const scopes = scopeEntries(keys, input.record.binding, "issue", input.policy);
+			yield* lockScopes(mapping, configuration, input.record.moduleId, input.record.purpose, "issue", scopes.slice(0, 1));
+			const actionNow = yield* nowMillis;
+			const actionOpen = (yield* admittedScopes(mapping, input.record.moduleId, input.record.purpose, "issue", scopes.slice(0, 1), actionNow)).length === 1;
+			if (actionOpen) yield* lockScopes(mapping, configuration, input.record.moduleId, input.record.purpose, "issue", scopes.slice(1));
+			const series = actionOpen ? yield* ensureSeries(mapping, configuration, input.record.moduleId, input.record.purpose, keys.series) : void 0;
+			const now = yield* nowMillis;
+			const retentionUntil = now + input.policy.requestRetentionMillis;
+			const rc = requestColumns(mapping);
+			let requestRows = yield* selectRows(transaction.select().from(mapping.request.table).where(and(eq(rc.moduleId, input.record.moduleId), eq(rc.requestId, input.record.requestId))).limit(1), configuration.locking);
+			let request = requestRows[0];
+			if (request !== void 0) {
+				if ((yield* mapping.decodeInstant(request[mapping.request.retentionUntil])) > now) {
+					if (request[mapping.request.fingerprint] !== input.record.fingerprint) return yield* conflict();
+					return prepare({
+						_tag: "Existing",
+						receipt: yield* mapping.request.decodeReceipt(request)
+					}, journal);
+				}
+				yield* transaction.delete(mapping.request.table).where(and(eq(rc.moduleId, input.record.moduleId), eq(rc.requestId, input.record.requestId), lte(rc.retentionUntil, mapping.encodeInstant(now))));
+			}
+			const requestInsert = mapping.request.encodeInsert({
+				record: input.record,
+				createdAtMillis: now,
+				retentionUntilMillis: retentionUntil
+			});
+			const requestQuery = transaction.insert(mapping.request.table).values(requestInsert);
+			yield* configuration.insertIfAbsent(requestQuery, mapping.request.requestId, input.record.requestId);
+			requestRows = yield* selectRows(transaction.select().from(mapping.request.table).where(and(eq(rc.moduleId, input.record.moduleId), eq(rc.requestId, input.record.requestId))).limit(1), configuration.locking);
+			request = requestRows[0];
+			if (request === void 0) return yield* unavailable();
+			if (request[mapping.request.fingerprint] !== input.record.fingerprint) return yield* conflict();
+			if (request[mapping.request.proofId] !== input.record.proofId) return prepare({
+				_tag: "Existing",
+				receipt: yield* mapping.request.decodeReceipt(request)
+			}, journal);
+			const admitted = actionOpen ? yield* admittedScopes(mapping, input.record.moduleId, input.record.purpose, "issue", scopes, now) : [];
+			const sc = seriesColumns(mapping);
+			const lastIssueAt = series?.[mapping.series.lastIssueAt] === null || series?.[mapping.series.lastIssueAt] === void 0 ? void 0 : yield* mapping.decodeInstant(series[mapping.series.lastIssueAt]);
+			const activeProofId = series?.[mapping.series.activeProofId];
+			const supersedesCurrent = input.supersedes === void 0 || input.supersedes === activeProofId;
+			const allowed = authorityCurrent && input.eligible && admitted.length === scopes.length && input.record.issuedAtMillis <= now && input.record.expiresAtMillis > now && supersedesCurrent && (lastIssueAt === void 0 || now - lastIssueAt >= input.policy.abuse.resendCooldownMillis);
+			const receipt = {
+				requestId: input.record.requestId,
+				reference: {
+					proofId: input.record.proofId,
+					purpose: input.record.purpose,
+					keyId: input.record.verifier.keyId
+				}
+			};
+			const prepared = prepare(allowed ? {
+				_tag: "Issued",
+				record: input.record
+			} : {
+				_tag: "Suppressed",
+				receipt
+			}, journal);
+			if (admitted.length > 0) yield* insertScopeEvents(mapping, input.record.moduleId, input.record.purpose, "issue", input.record.requestId, admitted, now, retentionUntil);
+			if (!allowed) return prepared;
+			if (activeProofId !== null && activeProofId !== void 0) yield* transaction.update(mapping.generation.table).set(updateValues([[mapping.generation.state, "superseded"]])).where(and(eq(generationColumns(mapping).moduleId, input.record.moduleId), eq(generationColumns(mapping).proofId, activeProofId), eq(generationColumns(mapping).state, "active")));
+			yield* transaction.insert(mapping.generation.table).values(mapping.generation.encodeInsert({
+				record: input.record,
+				seriesKey: keys.series,
+				retentionUntilMillis: retentionUntil,
+				state: "active",
+				deliveryState: "new",
+				policy: input.policy
+			}));
+			const nextVersion = yield* allocateVersion(mapping, configuration.mode);
+			yield* transaction.update(mapping.series.table).set(updateValues([
+				[mapping.series.activeProofId, input.record.proofId],
+				[mapping.series.lastIssueAt, mapping.encodeInstant(now)],
+				[mapping.series.version, nextVersion]
+			])).where(and(eq(sc.moduleId, input.record.moduleId), eq(sc.purpose, input.record.purpose), eq(sc.scopeKey, keys.series)));
+			return prepared;
+		})).pipe(Effect.provideService(CurrentProofSql, database), Effect.provideService(LifecycleHooks, hooks), translateIssueFailure),
+		attempt: (input, prepare) => owned(database, mapping, configuration, Effect.gen(function* () {
+			const transaction = yield* CurrentProofSql;
+			const journal = yield* CurrentCommitJournal;
+			const keys = mapping.scopeKeys({
+				moduleId: input.moduleId,
+				purpose: input.purpose,
+				binding: input.binding
+			});
+			const authorityCurrent = yield* lockAuthority(mapping, input.moduleId, input.purpose, input.binding, configuration.locking);
+			const scopes = scopeEntries(keys, input.binding, "attempt", input.policy);
+			yield* lockScopes(mapping, configuration, input.moduleId, input.purpose, "attempt", scopes.slice(0, 1));
+			const actionNow = yield* nowMillis;
+			const actionOpen = (yield* admittedScopes(mapping, input.moduleId, input.purpose, "attempt", scopes.slice(0, 1), actionNow)).length === 1;
+			if (actionOpen) yield* lockScopes(mapping, configuration, input.moduleId, input.purpose, "attempt", scopes.slice(1));
+			const series = actionOpen ? yield* ensureSeries(mapping, configuration, input.moduleId, input.purpose, keys.series) : void 0;
+			const generation = (yield* readGeneration(mapping, input.moduleId, input.proofId, configuration.locking))[0];
+			const existingCommand = (yield* commandRow(mapping, input.moduleId, input.continuationId, configuration.locking))[0];
+			if (existingCommand !== void 0) {
+				if (existingCommand[mapping.command.decision] === "rejected") return prepare({ _tag: "Rejected" }, journal);
+				return yield* unavailable();
+			}
+			const now = yield* nowMillis;
+			const admitted = actionOpen ? yield* admittedScopes(mapping, input.moduleId, input.purpose, "attempt", scopes, now) : [];
+			const failures = yield* failureCount(mapping, input.moduleId, input.purpose, keys.series, now, input.policy);
+			const gc = generationColumns(mapping);
+			const activeProofId = series?.[mapping.series.activeProofId];
+			const storedBinding = generation === void 0 ? void 0 : yield* mapping.generation.decodeBinding(generation);
+			const candidateMatches = generation !== void 0 && input.candidate !== void 0 && generation[mapping.generation.verifierKeyId] === input.candidate.keyId && generation[mapping.generation.verifierDigest] === input.candidate.digest;
+			const currentGeneration = generation !== void 0 && generation[mapping.generation.purpose] === input.purpose && generation[mapping.generation.state] === "active" && activeProofId === input.proofId && storedBinding !== void 0 && sameBinding(storedBinding, input.binding) && Number(yield* mapping.decodeInstant(generation[mapping.generation.expiresAt])) > now;
+			const accepted = authorityCurrent && currentGeneration && candidateMatches && admitted.length === scopes.length && failures < input.policy.maximumFailedAttempts;
+			const retentionUntil = now + input.policy.requestRetentionMillis;
+			if (!accepted) {
+				const prepared = prepare({ _tag: "Rejected" }, journal);
+				yield* insertCommand(mapping, input.moduleId, input.continuationId, "attempt", "rejected", retentionUntil);
+				yield* insertScopeEvents(mapping, input.moduleId, input.purpose, "attempt", input.continuationId, admitted, now, retentionUntil);
+				if (admitted.length === scopes.length && currentGeneration && !candidateMatches && failures < input.policy.maximumFailedAttempts) yield* transaction.insert(mapping.failureEvent.table).values(mapping.failureEvent.encodeInsert({
+					moduleId: input.moduleId,
+					purpose: input.purpose,
+					seriesKey: keys.series,
+					commandId: input.continuationId,
+					occurredAtMillis: now,
+					retentionUntilMillis: retentionUntil
+				}));
+				return prepared;
+			}
+			const version = yield* allocateVersion(mapping, configuration.mode);
+			const expiresAt = Math.min(Number(yield* mapping.decodeInstant(generation[mapping.generation.expiresAt])), now + input.policy.continuationLifetimeMillis);
+			const continuation = {
+				moduleId: input.moduleId,
+				purpose: input.purpose,
+				continuationId: input.continuationId,
+				digest: input.continuationDigest,
+				proofId: input.proofId,
+				seriesKey: keys.series,
+				binding: input.binding,
+				expiresAtMillis: expiresAt,
+				version
+			};
+			const prepared = prepare({
+				_tag: "Accepted",
+				continuation: {
+					continuationId: input.continuationId,
+					purpose: input.purpose,
+					expiresAtMillis: expiresAt
+				}
+			}, journal);
+			yield* insertCommand(mapping, input.moduleId, input.continuationId, "attempt", "accepted", retentionUntil);
+			yield* insertScopeEvents(mapping, input.moduleId, input.purpose, "attempt", input.continuationId, scopes, now, retentionUntil);
+			yield* transaction.update(mapping.generation.table).set(updateValues([[mapping.generation.state, "consumed"]])).where(and(eq(gc.moduleId, input.moduleId), eq(gc.proofId, input.proofId), eq(gc.state, "active")));
+			yield* transaction.insert(mapping.continuation.table).values(mapping.continuation.encodeInsert({
+				...continuation,
+				retentionUntilMillis: retentionUntil
+			}));
+			return prepared;
+		})).pipe(Effect.provideService(CurrentProofSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
+		complete: (input, prepare) => owned(database, mapping, configuration, Effect.gen(function* () {
+			const journal = yield* CurrentCommitJournal;
+			return yield* completeIn(mapping, configuration, input, (decision) => prepare(decision, journal));
+		})).pipe(Effect.provideService(CurrentProofSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
+		claimDelivery: (input, prepare) => owned(database, mapping, configuration, Effect.gen(function* () {
+			const transaction = yield* CurrentProofSql;
+			const journal = yield* CurrentCommitJournal;
+			const row = (yield* readGeneration(mapping, input.moduleId, input.proofId, configuration.locking))[0];
+			const now = yield* nowMillis;
+			if (row === void 0) return prepare({ _tag: "Declined" }, journal);
+			const c = generationColumns(mapping);
+			const expiresAt = yield* mapping.decodeInstant(row[mapping.generation.expiresAt]);
+			const claimDeadline = row[mapping.generation.claimDeadline] === null || row[mapping.generation.claimDeadline] === void 0 ? void 0 : yield* mapping.decodeInstant(row[mapping.generation.claimDeadline]);
+			const retryAt = row[mapping.generation.retryAt] === null || row[mapping.generation.retryAt] === void 0 ? void 0 : yield* mapping.decodeInstant(row[mapping.generation.retryAt]);
+			let state = row[mapping.generation.deliveryState];
+			if (state === "claimed" && claimDeadline !== void 0 && claimDeadline <= now) {
+				state = "ambiguous";
+				yield* transaction.update(mapping.generation.table).set(updateValues([[mapping.generation.deliveryState, "ambiguous"]])).where(and(eq(c.moduleId, input.moduleId), eq(c.proofId, input.proofId)));
+			}
+			if (!(row[mapping.generation.version] === input.version && row[mapping.generation.deliveryId] === input.deliveryId && row[mapping.generation.state] === "active" && expiresAt > now && Number(row[mapping.generation.sendCount]) < input.policy.maximumDeliveryAttempts && (state === "new" || state === "ambiguous" && input.allowAmbiguousRetry && (retryAt === void 0 || retryAt <= now)))) return prepare({ _tag: "Declined" }, journal);
+			const claimVersion = yield* allocateVersion(mapping, configuration.mode);
+			const prepared = prepare({
+				_tag: "Claimed",
+				claimVersion
+			}, journal);
+			yield* transaction.update(mapping.generation.table).set(updateValues([
+				[mapping.generation.sendCount, Number(row[mapping.generation.sendCount]) + 1],
+				[mapping.generation.deliveryState, "claimed"],
+				[mapping.generation.claimVersion, claimVersion],
+				[mapping.generation.claimDeadline, mapping.encodeInstant(now + input.policy.deliveryClaimMillis)],
+				[mapping.generation.retryAt, mapping.encodeInstant(now + input.policy.deliveryRetryMillis)]
+			])).where(and(eq(c.moduleId, input.moduleId), eq(c.proofId, input.proofId)));
+			return prepared;
+		})).pipe(Effect.provideService(CurrentProofSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
+		settleDelivery: (input, prepare) => owned(database, mapping, configuration, Effect.gen(function* () {
+			const transaction = yield* CurrentProofSql;
+			const journal = yield* CurrentCommitJournal;
+			const initial = (yield* readGeneration(mapping, input.moduleId, input.proofId, false))[0];
+			if (initial === void 0) return prepare(void 0, journal);
+			const keys = initial[mapping.generation.seriesKey];
+			yield* ensureSeries(mapping, configuration, input.moduleId, initial[mapping.generation.purpose], keys);
+			const row = (yield* readGeneration(mapping, input.moduleId, input.proofId, configuration.locking))[0];
+			const prepared = prepare(void 0, journal);
+			if (row === void 0 || row[mapping.generation.version] !== input.version || row[mapping.generation.deliveryId] !== input.deliveryId || row[mapping.generation.claimVersion] !== input.claimVersion || row[mapping.generation.deliveryState] !== "claimed") return prepared;
+			const c = generationColumns(mapping);
+			const outcome = input.outcome;
+			const state = outcome._tag === "Accepted" ? "accepted" : outcome._tag === "DefiniteFailure" ? "failed" : "ambiguous";
+			const values = [[mapping.generation.deliveryState, state], [mapping.generation.claimDeadline, null]];
+			if (outcome._tag === "Ambiguous") values.push([mapping.generation.retryAt, mapping.encodeInstant((yield* nowMillis) + Number(row[mapping.generation.deliveryRetryMillis]))]);
+			if (outcome._tag === "DefiniteFailure") values.push([mapping.generation.state, "cancelled"]);
+			yield* transaction.update(mapping.generation.table).set(updateValues(values)).where(and(eq(c.moduleId, input.moduleId), eq(c.proofId, input.proofId)));
+			if (outcome._tag === "DefiniteFailure") {
+				const sc = seriesColumns(mapping);
+				yield* transaction.update(mapping.series.table).set(updateValues([[mapping.series.activeProofId, null]])).where(and(eq(sc.moduleId, input.moduleId), eq(sc.purpose, row[mapping.generation.purpose]), eq(sc.scopeKey, keys), eq(sc.activeProofId, input.proofId)));
+			}
+			return prepared;
+		})).pipe(Effect.provideService(CurrentProofSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
+		cancel: (input, prepare) => owned(database, mapping, configuration, Effect.gen(function* () {
+			const transaction = yield* CurrentProofSql;
+			const journal = yield* CurrentCommitJournal;
+			const authorityCurrent = yield* lockAuthority(mapping, input.moduleId, input.purpose, input.binding, configuration.locking);
+			const keys = mapping.scopeKeys({
+				moduleId: input.moduleId,
+				purpose: input.purpose,
+				binding: input.binding
+			});
+			const active = (yield* ensureSeries(mapping, configuration, input.moduleId, input.purpose, keys.series))[mapping.series.activeProofId];
+			const prepared = prepare(void 0, journal);
+			if (authorityCurrent && active !== void 0 && active !== null) {
+				const gc = generationColumns(mapping);
+				const sc = seriesColumns(mapping);
+				const row = (yield* readGeneration(mapping, input.moduleId, active, configuration.locking))[0];
+				const storedBinding = row === void 0 ? void 0 : yield* mapping.generation.decodeBinding(row);
+				if (storedBinding === void 0 || !sameBinding(storedBinding, input.binding)) return prepared;
+				yield* transaction.update(mapping.generation.table).set(updateValues([[mapping.generation.state, "cancelled"]])).where(and(eq(gc.moduleId, input.moduleId), eq(gc.proofId, active)));
+				yield* transaction.update(mapping.series.table).set(updateValues([[mapping.series.activeProofId, null]])).where(and(eq(sc.moduleId, input.moduleId), eq(sc.purpose, input.purpose), eq(sc.scopeKey, keys.series), eq(sc.activeProofId, active)));
+			}
+			return prepared;
+		})).pipe(Effect.provideService(CurrentProofSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
+		cleanup: (input, prepare) => owned(database, mapping, configuration, Effect.gen(function* () {
+			const transaction = yield* CurrentProofSql;
+			const journal = yield* CurrentCommitJournal;
+			const now = yield* nowMillis;
+			const nativeNow = mapping.encodeInstant(now);
+			const gc = generationColumns(mapping);
+			const cc = continuationColumns(mapping);
+			const rc = requestColumns(mapping);
+			const ac = abuseColumns(mapping);
+			const fc = failureColumns(mapping);
+			const mc = commandColumns(mapping);
+			const sc = seriesColumns(mapping);
+			const rsc = scopeColumns(mapping);
+			let remaining = input.limit;
+			let hasMore = false;
+			const take = (query) => selectRows(query.limit(remaining + 1), configuration.locking).pipe(Effect.map((rows) => {
+				if (rows.length > remaining) hasMore = true;
+				const selected = rows.slice(0, remaining);
+				remaining -= selected.length;
+				return selected;
+			}));
+			const continuations = yield* take(transaction.select({ continuationId: cc.continuationId }).from(mapping.continuation.table).where(and(eq(cc.moduleId, input.moduleId), lte(cc.retentionUntil, nativeNow))).orderBy(cc.retentionUntil));
+			const generations = yield* take(transaction.select({ proofId: gc.proofId }).from(mapping.generation.table).where(and(eq(gc.moduleId, input.moduleId), lte(gc.retentionUntil, nativeNow))).orderBy(gc.retentionUntil));
+			const requests = yield* take(transaction.select({ requestId: rc.requestId }).from(mapping.request.table).where(and(eq(rc.moduleId, input.moduleId), lte(rc.retentionUntil, nativeNow))).orderBy(rc.retentionUntil));
+			const abuse = yield* take(transaction.select({
+				action: ac.action,
+				scopeKind: ac.scopeKind,
+				scopeKey: ac.scopeKey,
+				commandId: ac.commandId
+			}).from(mapping.abuseEvent.table).where(and(eq(ac.moduleId, input.moduleId), lte(ac.retentionUntil, nativeNow))).orderBy(ac.retentionUntil));
+			const failures = yield* take(transaction.select({
+				seriesKey: fc.seriesKey,
+				commandId: fc.commandId
+			}).from(mapping.failureEvent.table).where(and(eq(fc.moduleId, input.moduleId), lte(fc.retentionUntil, nativeNow))).orderBy(fc.retentionUntil));
+			const commands = yield* take(transaction.select({ commandId: mc.commandId }).from(mapping.command.table).where(and(eq(mc.moduleId, input.moduleId), lte(mc.retentionUntil, nativeNow))).orderBy(mc.retentionUntil));
+			const series = yield* take(transaction.select({
+				purpose: sc.purpose,
+				scopeKey: sc.scopeKey
+			}).from(mapping.series.table).where(and(eq(sc.moduleId, input.moduleId), isNull(sc.activeProofId), notExists(transaction.select({ one: sql`1` }).from(mapping.generation.table).where(and(eq(gc.moduleId, sc.moduleId), eq(gc.purpose, sc.purpose), eq(gc.seriesKey, sc.scopeKey)))), notExists(transaction.select({ one: sql`1` }).from(mapping.failureEvent.table).where(and(eq(fc.moduleId, sc.moduleId), eq(fc.purpose, sc.purpose), eq(fc.seriesKey, sc.scopeKey)))))));
+			const rateScopes = yield* take(transaction.select({
+				purpose: rsc.purpose,
+				action: rsc.action,
+				scopeKind: rsc.scopeKind,
+				scopeKey: rsc.scopeKey
+			}).from(mapping.rateScope.table).where(and(eq(rsc.moduleId, input.moduleId), notExists(transaction.select({ one: sql`1` }).from(mapping.abuseEvent.table).where(and(eq(ac.moduleId, rsc.moduleId), eq(ac.purpose, rsc.purpose), eq(ac.action, rsc.action), eq(ac.scopeKind, rsc.scopeKind), eq(ac.scopeKey, rsc.scopeKey)))))));
+			hasMore ||= generations.length > 0 || failures.length > 0 || abuse.length > 0;
+			const prepared = prepare({
+				removed: input.limit - remaining,
+				hasMore
+			}, journal);
+			if (continuations.length > 0) yield* transaction.delete(mapping.continuation.table).where(and(eq(cc.moduleId, input.moduleId), inArray(cc.continuationId, continuations.map((row) => row.continuationId)), lte(cc.retentionUntil, nativeNow)));
+			if (generations.length > 0) yield* transaction.update(mapping.series.table).set(updateValues([[mapping.series.activeProofId, null]])).where(and(eq(sc.moduleId, input.moduleId), inArray(sc.activeProofId, generations.map((row) => row.proofId))));
+			if (generations.length > 0) yield* transaction.delete(mapping.generation.table).where(and(eq(gc.moduleId, input.moduleId), inArray(gc.proofId, generations.map((row) => row.proofId)), lte(gc.retentionUntil, nativeNow)));
+			if (requests.length > 0) yield* transaction.delete(mapping.request.table).where(and(eq(rc.moduleId, input.moduleId), inArray(rc.requestId, requests.map((row) => row.requestId)), lte(rc.retentionUntil, nativeNow)));
+			for (const row of abuse) yield* transaction.delete(mapping.abuseEvent.table).where(and(eq(ac.moduleId, input.moduleId), eq(ac.action, row.action), eq(ac.scopeKind, row.scopeKind), eq(ac.scopeKey, row.scopeKey), eq(ac.commandId, row.commandId), lte(ac.retentionUntil, nativeNow)));
+			for (const row of failures) yield* transaction.delete(mapping.failureEvent.table).where(and(eq(fc.moduleId, input.moduleId), eq(fc.seriesKey, row.seriesKey), eq(fc.commandId, row.commandId), lte(fc.retentionUntil, nativeNow)));
+			if (commands.length > 0) yield* transaction.delete(mapping.command.table).where(and(eq(mc.moduleId, input.moduleId), inArray(mc.commandId, commands.map((row) => row.commandId)), lte(mc.retentionUntil, nativeNow)));
+			for (const row of series) yield* transaction.delete(mapping.series.table).where(and(eq(sc.moduleId, input.moduleId), eq(sc.purpose, row.purpose), eq(sc.scopeKey, row.scopeKey), isNull(sc.activeProofId), notExists(transaction.select({ one: sql`1` }).from(mapping.generation.table).where(and(eq(gc.moduleId, sc.moduleId), eq(gc.purpose, sc.purpose), eq(gc.seriesKey, sc.scopeKey))))));
+			for (const row of rateScopes) yield* transaction.delete(mapping.rateScope.table).where(and(eq(rsc.moduleId, input.moduleId), eq(rsc.purpose, row.purpose), eq(rsc.action, row.action), eq(rsc.scopeKind, row.scopeKind), eq(rsc.scopeKey, row.scopeKey), notExists(transaction.select({ one: sql`1` }).from(mapping.abuseEvent.table).where(and(eq(ac.moduleId, rsc.moduleId), eq(ac.purpose, rsc.purpose), eq(ac.action, rsc.action), eq(ac.scopeKind, rsc.scopeKind), eq(ac.scopeKey, rsc.scopeKey))))));
+			return prepared;
+		})).pipe(Effect.provideService(CurrentProofSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure)
+	});
+});
+const inspectCompletionIn = Effect.fn("DrizzleProof.inspectCompletionIn")(function* (mapping, configuration, input, ensure) {
+	const database = yield* CurrentProofSql;
+	const authorityCurrent = yield* lockAuthority(mapping, input.moduleId, input.purpose, input.binding, configuration.locking);
+	const keys = mapping.scopeKeys({
+		moduleId: input.moduleId,
+		purpose: input.purpose,
+		binding: input.binding
+	});
+	if (ensure) yield* ensureSeries(mapping, configuration, input.moduleId, input.purpose, keys.series);
+	const c = continuationColumns(mapping);
+	const row = (yield* selectRows(database.select().from(mapping.continuation.table).where(and(eq(c.moduleId, input.moduleId), eq(c.continuationId, input.continuationId))).limit(1), configuration.locking))[0];
+	const now = yield* nowMillis;
+	const record = row === void 0 ? void 0 : yield* mapping.continuation.decode(row);
+	return authorityCurrent && row !== void 0 && record !== void 0 && record.moduleId === input.moduleId && record.continuationId === input.continuationId && record.purpose === input.purpose && record.digest === input.continuationDigest && record.seriesKey === keys.series && sameBinding(record.binding, input.binding) && row[mapping.continuation.consumed] === false && record.expiresAtMillis > now ? {
+		record,
+		row,
+		columns: c
+	} : void 0;
+});
+/** Nonconsuming same-owner preflight; it never inserts a series or changes expiry. */
+const checkProofCompletionIn = Effect.fn("Drizzle.checkProofCompletionIn")(function* (mapping, configuration, input) {
+	return yield* inspectCompletionIn(mapping, configuration, input, false).pipe(Effect.map((value) => value !== void 0));
+});
+const completeIn = Effect.fn("DrizzleProof.completeIn")(function* (mapping, configuration, input, prepare, protectedMutation) {
+	const database = yield* CurrentProofSql;
+	const accepted = yield* inspectCompletionIn(mapping, configuration, input, true);
+	if (accepted === void 0) return prepare("rejected");
+	const { record, row: original, columns: c } = accepted;
+	if (protectedMutation !== void 0 && !(yield* protectedMutation)) return yield* unavailable();
+	const value = prepare("completed");
+	yield* database.update(mapping.continuation.table).set(updateValues([[mapping.continuation.consumed, true]])).where(and(eq(c.moduleId, input.moduleId), eq(c.continuationId, input.continuationId), eq(c.digest, input.continuationDigest), eq(c.consumed, false)));
+	yield* insertCommand(mapping, input.moduleId, input.continuationDigest, "complete", "completed", record.expiresAtMillis);
+	const assertApplied = Effect.flatMap(CurrentPasswordPreparedTransaction, (currentTransaction) => Effect.gen(function* () {
+		const persisted = (yield* selectRows(currentTransaction.select().from(mapping.continuation.table).where(and(eq(c.moduleId, input.moduleId), eq(c.continuationId, input.continuationId))).limit(1), false))[0];
+		const command = (yield* commandRow(mapping, input.moduleId, input.continuationDigest, false))[0];
+		const decoded = persisted === void 0 ? void 0 : yield* mapping.continuation.decode(persisted);
+		const immutable = [
+			mapping.continuation.moduleId,
+			mapping.continuation.purpose,
+			mapping.continuation.continuationId,
+			mapping.continuation.digest,
+			mapping.continuation.proofId,
+			mapping.continuation.seriesKey,
+			mapping.continuation.version
+		];
+		if (persisted === void 0 || decoded === void 0 || !sameBinding(decoded.binding, record.binding) || persisted[mapping.continuation.consumed] !== true || immutable.some((key) => persisted[key] !== original[key]) || (yield* mapping.decodeInstant(persisted[mapping.continuation.expiresAt])) !== record.expiresAtMillis || (yield* mapping.decodeInstant(persisted[mapping.continuation.retentionUntil])) !== (yield* mapping.decodeInstant(original[mapping.continuation.retentionUntil])) || command === void 0 || command[mapping.command.kind] !== "complete" || command[mapping.command.decision] !== "completed" || (yield* mapping.decodeInstant(command[mapping.command.retentionUntil])) !== record.expiresAtMillis) return yield* unavailable();
+		if (record.expiresAtMillis <= (yield* nowMillis)) return yield* unavailable();
+	}).pipe(Effect.provideService(CurrentProofSql, currentTransaction)));
+	yield* assertApplied.pipe(Effect.provideService(CurrentPasswordPreparedTransaction, database));
+	const postconditions = yield* Effect.serviceOption(PasswordPreparedPostconditions);
+	if (Option.isSome(postconditions) && !postconditions.value.register(assertApplied.pipe(translateFailure))) return yield* unavailable();
+	return value;
+});
+/** Private same-owner seam for password and identifier mutations. */
+const completeProofPlanIn = Effect.fn("Drizzle.completeProofPlanIn")(function* (mapping, configuration, plan, protectedMutation, project) {
+	const journal = yield* CurrentCommitJournal;
+	return yield* completeIn(mapping, configuration, plan.input, (decision) => plan.prepare(decision, journal, project), protectedMutation);
+});
+//#endregion
+export { CurrentProofSql, checkProofCompletionIn, completeProofPlanIn, makeSqlProofPersistence };
+
+//# sourceMappingURL=proof-sql.mjs.map