@yielded/auth-persistence-drizzle 0.1.0-beta.22 → 0.1.0-beta.23

package/dist/drizzle/d1-passwords.mjs

@@ -7,8 +7,8 @@ import { D1BatchStatements } from "./D1BatchStatements.mjs";
 import { CurrentD1PlanningDatabase, makeD1Owner } from "./d1-planning.mjs";
 import { nativeDatabase } from "./native-database.mjs";
 import { compileD1ProofCompletionPlan } from "./d1-proofs.mjs";
-import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
-import { and, count, eq, gte, inArray, lte, notExists, sql } from "drizzle-orm";
+import { NativeDatabase, requireStandalone, samePasswordCredentialSnapshot } from "@yielded/auth-persistence/Adapter";
+import { and, eq, inArray, lte, sql } from "drizzle-orm";
 import { Cause, Context, DateTime, Effect, Option, Predicate, Redacted, Schema } from "effect";
 import { CurrentCommitJournal, HookConfigurationError, LifecycleHooks, coordinateCommit, hasCommitScope } from "@yielded/auth/Hooks";
 import { AuthenticationEvidence, AuthenticationRequirement, snapshotAuthenticationEvidence } from "@yielded/auth/Sessions";
@@ -16,7 +16,6 @@ import { reportPersistenceFailure } from "@yielded/auth/Persistence";
 import { ProofUnavailable } from "@yielded/auth/Proofs";
 import { PasswordPersistence, PasswordUnavailable, snapshotPasswordCredential, snapshotPasswordRequirement, snapshotPasswordRevision } from "@yielded/auth/Password";
 //#region src/drizzle/d1-passwords.ts
-const mapAdapter = (effect) => effect;
 const unavailable = () => PasswordUnavailable.make({});
 const everyFailureMatches = (cause, classify) => classify !== void 0 && cause.reasons.length > 0 && cause.reasons.every((reason) => Cause.isFailReason(reason) && classify(Cause.fail(reason.error)));
 const validConstraints = (mapping) => Object.entries(requiredPasswordConstraints).every(([key, value]) => mapping.constraints[key] === value);
@@ -117,21 +116,6 @@ const attemptColumns = (mapping) => ({
 	retentionUntil: column(mapping.attempt.table, mapping.attempt.retentionUntil),
 	state: column(mapping.attempt.table, mapping.attempt.state)
 });
-const scopeColumns = (mapping) => ({
-	moduleId: column(mapping.rateScope.table, mapping.rateScope.moduleId),
-	action: column(mapping.rateScope.table, mapping.rateScope.action),
-	scopeKind: column(mapping.rateScope.table, mapping.rateScope.scopeKind),
-	scopeKey: column(mapping.rateScope.table, mapping.rateScope.scopeKey)
-});
-const chargeColumns = (mapping) => ({
-	moduleId: column(mapping.charge.table, mapping.charge.moduleId),
-	action: column(mapping.charge.table, mapping.charge.action),
-	scopeKind: column(mapping.charge.table, mapping.charge.scopeKind),
-	scopeKey: column(mapping.charge.table, mapping.charge.scopeKey),
-	attemptId: column(mapping.charge.table, mapping.charge.attemptId),
-	occurredAt: column(mapping.charge.table, mapping.charge.occurredAt),
-	retentionUntil: column(mapping.charge.table, mapping.charge.retentionUntil)
-});
 const commandColumns = (mapping) => ({
 	moduleId: column(mapping.command.table, mapping.command.moduleId),
 	commandId: column(mapping.command.table, mapping.command.commandId),
@@ -180,45 +164,6 @@ const resolveCredential = Effect.fn("DrizzleD1Password.resolveCredential")(funct
 		}).pipe(Effect.flatMap(snapshotPasswordCredential))
 	};
 });
-const scopeEntries = (keys, policy) => {
-	const entries = [{
-		kind: "action",
-		key: keys.action,
-		...policy.action
-	}, {
-		kind: "identifier",
-		key: keys.identifier,
-		...policy.identifier
-	}];
-	if (keys.subject !== void 0) entries.push({
-		kind: "subject",
-		key: keys.subject,
-		...policy.subject
-	});
-	return entries;
-};
-const livePendingAttempts = (mapping, moduleId, action, entry, identifier, nativeSubjectId, activeAt) => {
-	const a = attemptColumns(mapping);
-	return and(entry.kind === "action" ? and(eq(a.moduleId, moduleId), eq(a.action, action)) : entry.kind === "identifier" ? and(eq(a.moduleId, moduleId), eq(a.action, action), eq(a.identifierNamespace, identifier.namespace), eq(a.identifierValue, identifier.value)) : and(eq(a.moduleId, moduleId), eq(a.action, action), eq(a.subjectId, nativeSubjectId)), eq(a.state, "pending"), sql`${a.retentionUntil} > ${activeAt}`);
-};
-const scopeAdmissionCondition = (mapping, moduleId, action, entry, policy, identifier, nativeSubjectId) => {
-	const c = chargeColumns(mapping);
-	const pending = livePendingAttempts(mapping, moduleId, action, entry, identifier, nativeSubjectId, mapping.d1.engineNow);
-	return sql`(select count(*) from ${mapping.charge.table} where ${c.moduleId} = ${sql.param(moduleId, c.moduleId)} and ${c.action} = ${sql.param(action, c.action)} and ${c.scopeKind} = ${sql.param(entry.kind, c.scopeKind)} and ${c.scopeKey} = ${sql.param(entry.key, c.scopeKey)} and ${c.occurredAt} >= ${mapping.d1.engineInstantMinus(entry.windowMillis)}) < ${entry.limit} and (select count(*) from ${mapping.attempt.table} where ${pending}) < ${policy.maximumPending}`;
-};
-const readScopeAdmission = Effect.fn("DrizzleD1Password.readScopeAdmission")(function* (mapping, moduleId, action, entries, policy, identifier, nativeSubjectId, now) {
-	const database = yield* CurrentD1PlanningDatabase;
-	const c = chargeColumns(mapping);
-	const admitted = [];
-	for (let index = 0; index < entries.length; index++) {
-		const entry = entries[index];
-		const chargeRows = yield* mapAdapter(database.select({ total: count() }).from(mapping.charge.table).where(and(eq(c.moduleId, moduleId), eq(c.action, action), eq(c.scopeKind, entry.kind), eq(c.scopeKey, entry.key), gte(c.occurredAt, mapping.encodeInstant(now - entry.windowMillis)))));
-		const pendingRows = yield* mapAdapter(database.select({ total: count() }).from(mapping.attempt.table).where(livePendingAttempts(mapping, moduleId, action, entry, identifier, nativeSubjectId, mapping.encodeInstant(now))));
-		if (Number(chargeRows[0]?.total ?? 0) < entry.limit && Number(pendingRows[0]?.total ?? 0) < policy.maximumPending) admitted.push(entry);
-		else if (index === 0) break;
-	}
-	return admitted;
-});
 const evidenceProofsJson = Schema.encodeSync(Schema.fromJsonString(AuthenticationEvidence.fields.proofs));
 const alternativesJson = Schema.encodeSync(Schema.fromJsonString(AuthenticationRequirement.fields.alternatives));
 const assuranceCondition = (mapping, evidence, requirement) => {
@@ -233,7 +178,6 @@ const assuranceCondition = (mapping, evidence, requirement) => {
   )`;
 };
 const sameIdentifier = (left, right) => left.namespace === right.namespace && left.value === right.value;
-const sameSnapshot = (left, right) => left.moduleId === right.moduleId && left.revision.subjectId === right.revision.subjectId && left.revision.securityRevision === right.revision.securityRevision && left.credentialId === right.credentialId && left.credentialRevision === right.credentialRevision && left.verifierVersion === right.verifierVersion && left.normalization === right.normalization && left.identifierVerifiedAtMillis === right.identifierVerifiedAtMillis && left.revision.credentials.length === right.revision.credentials.length && left.revision.credentials.every((entry) => right.revision.credentials.some((other) => other.credentialId === entry.credentialId && other.revision === entry.revision)) && left.identifierBindingRevision === right.identifierBindingRevision && sameIdentifier(left.identifier, right.identifier) && Redacted.value(left.verifier) === Redacted.value(right.verifier);
 const evidenceSatisfiedAt = (evidence, requirement, now) => {
 	if (evidence.proofs.length > 64 || evidence.revision.credentials.length > 64) return false;
 	const revisions = /* @__PURE__ */ new Map();
@@ -325,7 +269,7 @@ const readAuthority = Effect.fn("DrizzleD1Password.readAuthority")(function* (ma
 			identifier,
 			credential
 		});
-		if (!sameSnapshot(snapshot, input.credential)) return void 0;
+		if (!samePasswordCredentialSnapshot(snapshot, input.credential)) return void 0;
 		identifierCondition = identifierCurrentCondition(mapping, input, nativeSubjectId, identifier[mapping.identifier.verifiedAt]);
 		const ic = identifierColumns(mapping);
 		identifierCondition = and(identifierCondition, sql`exists(select 1 from ${mapping.identifier.table} where ${ic.namespace} = ${sql.param(input.credential.identifier.namespace, ic.namespace)} and ${ic.value} = ${sql.param(input.credential.identifier.value, ic.value)} and ${ic.subjectId} = ${sql.param(nativeSubjectId, ic.subjectId)} and ${ic.bindingRevision} = ${sql.param(input.credential.identifierBindingRevision, ic.bindingRevision)})`);
@@ -366,7 +310,7 @@ const admittedSnapshotCondition = (mapping, resolved, moduleId) => {
 	return and(sql`exists(select 1 from ${mapping.subject.table} where ${s.id} = ${sql.param(resolved.nativeSubjectId, s.id)} and ${s.status} = ${sql.param(mapping.subject.d1ActiveStatusValue, s.status)} and ${s.securityRevision} = ${sql.param(snapshot.revision.securityRevision, s.securityRevision)})`, mapping.identifier.d1CurrentCondition({
 		identifier: snapshot.identifier,
 		nativeSubjectId: resolved.nativeSubjectId
-	}), sql`exists(select 1 from ${mapping.identifier.table} where ${i.namespace} = ${sql.param(snapshot.identifier.namespace, i.namespace)} and ${i.value} = ${sql.param(snapshot.identifier.value, i.value)} and ${i.subjectId} = ${sql.param(resolved.nativeSubjectId, i.subjectId)} and ${i.bindingRevision} = ${sql.param(snapshot.identifierBindingRevision, i.bindingRevision)})`, sql`exists(select 1 from ${mapping.credential.table} where ${c.moduleId} = ${sql.param(moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(resolved.nativeSubjectId, c.subjectId)} and ${c.credentialId} = ${sql.param(snapshot.credentialId, c.credentialId)} and ${c.credentialRevision} = ${sql.param(snapshot.credentialRevision, c.credentialRevision)} and ${c.verifierVersion} = ${sql.param(snapshot.verifierVersion, c.verifierVersion)} and ${c.verifier} = ${sql.param(Redacted.value(snapshot.verifier), c.verifier)} and ${c.normalization} = ${sql.param(snapshot.normalization, c.normalization)})`, ...snapshot.revision.credentials.map((item) => sql`exists(select 1 from ${mapping.authorityCredential.table} where ${ac.subjectId} = ${sql.param(resolved.nativeSubjectId, ac.subjectId)} and ${ac.credentialId} = ${sql.param(item.credentialId, ac.credentialId)} and ${ac.revision} = ${sql.param(item.revision, ac.revision)}${ac.status === void 0 ? sql`` : sql` and ${ac.status} = ${sql.param(mapping.authorityCredential.d1ActiveStatusValue, ac.status)}`})`));
+	}), sql`exists(select 1 from ${mapping.identifier.table} where ${i.namespace} = ${sql.param(snapshot.identifier.namespace, i.namespace)} and ${i.value} = ${sql.param(snapshot.identifier.value, i.value)} and ${i.subjectId} = ${sql.param(resolved.nativeSubjectId, i.subjectId)} and ${i.bindingRevision} = ${sql.param(snapshot.identifierBindingRevision, i.bindingRevision)} and ${Predicate.isNullish(resolved.identifier[mapping.identifier.verifiedAt]) ? sql`${i.verifiedAt} is null` : sql`${i.verifiedAt} = ${sql.param(resolved.identifier[mapping.identifier.verifiedAt], i.verifiedAt)}`})`, sql`exists(select 1 from ${mapping.credential.table} where ${c.moduleId} = ${sql.param(moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(resolved.nativeSubjectId, c.subjectId)} and ${c.credentialId} = ${sql.param(snapshot.credentialId, c.credentialId)} and ${c.credentialRevision} = ${sql.param(snapshot.credentialRevision, c.credentialRevision)} and ${c.verifierVersion} = ${sql.param(snapshot.verifierVersion, c.verifierVersion)} and ${c.verifier} = ${sql.param(Redacted.value(snapshot.verifier), c.verifier)} and ${c.normalization} = ${sql.param(snapshot.normalization, c.normalization)})`, ...snapshot.revision.credentials.map((item) => sql`exists(select 1 from ${mapping.authorityCredential.table} where ${ac.subjectId} = ${sql.param(resolved.nativeSubjectId, ac.subjectId)} and ${ac.credentialId} = ${sql.param(item.credentialId, ac.credentialId)} and ${ac.revision} = ${sql.param(item.revision, ac.revision)}${ac.status === void 0 ? sql`` : sql` and ${ac.status} = ${sql.param(mapping.authorityCredential.d1ActiveStatusValue, ac.status)}`})`));
 };
 const mutationStatements = Effect.fn(function* (mapping, input, nativeSubjectId, revisions, now) {
 	const database = yield* CurrentD1PlanningDatabase;
@@ -440,6 +384,7 @@ const compileAddMutation = Effect.fn("DrizzleD1Password.compileAddMutation")(fun
 			yield* assertion(appliedCondition, marker)
 		],
 		appliedCondition,
+		marker,
 		retryable: (cause) => isGuardFailure(cause, marker)
 	};
 });
@@ -449,52 +394,31 @@ const makePasswordPlans = (mapping, proofMapping) => {
 		return yield* plan;
 	});
 	return {
-		admitAttempt: (input, prepare) => Effect.gen(function* () {
-			const database = yield* CurrentD1PlanningDatabase;
+		prepareAttempt: (uncaptured) => Effect.gen(function* () {
+			if (!validConstraints(mapping)) return yield* unavailable();
+			const input = Object.freeze({
+				...uncaptured,
+				identifier: Object.freeze({ ...uncaptured.identifier })
+			});
+			const resolved = yield* resolveCredential(mapping, input.moduleId, input.identifier, input.subjectId);
+			const snapshot = resolved?.snapshot;
 			const attemptId = yield* allocate(mapping.allocateAttemptId, mapping.allocateAttemptIdSync);
-			return yield* run(Effect.gen(function* () {
-				const journal = yield* CurrentCommitJournal;
-				const now = yield* readEngineNowMillis(mapping);
-				const resolved = yield* resolveCredential(mapping, input.moduleId, input.identifier, input.subjectId);
-				const keys = mapping.scopeKeys({
-					moduleId: input.moduleId,
-					action: input.action,
-					identifier: input.identifier,
-					...resolved?.snapshot === void 0 ? {} : { subjectId: resolved.snapshot.revision.subjectId }
-				});
-				const scopes = scopeEntries(keys, input.policy);
-				const admitted = yield* readScopeAdmission(mapping, input.moduleId, input.action, scopes, input.policy, input.identifier, resolved?.nativeSubjectId, now);
-				const allAdmitted = admitted.length === scopes.length;
-				const considered = admitted.length === 0 ? scopes.slice(0, 1) : scopes;
-				const receipt = prepare(allAdmitted ? {
-					_tag: "Admitted",
-					attemptId,
-					...resolved?.snapshot === void 0 ? {} : { credential: resolved.snapshot }
-				} : { _tag: "Denied" }, journal);
-				const marker = `effect-auth-password-guard:admit:${attemptId}`;
-				const statements = [];
-				for (const entry of considered) statements.push(yield* statement(database.insert(mapping.rateScope.table).values(mapping.rateScope.encodeInsert({
-					moduleId: input.moduleId,
-					action: input.action,
-					scopeKind: entry.kind,
-					scopeKey: entry.key
-				})).onConflictDoNothing()));
-				const conditions = considered.map((entry) => {
-					const condition = scopeAdmissionCondition(mapping, input.moduleId, input.action, entry, input.policy, input.identifier, resolved?.nativeSubjectId);
-					return admitted.includes(entry) ? condition : sql`not (${condition})`;
-				});
-				statements.push(yield* assertion(and(...conditions, ...allAdmitted ? [admittedSnapshotCondition(mapping, resolved, input.moduleId)] : []), marker));
-				for (const entry of admitted) statements.push(yield* statement(database.insert(mapping.charge.table).values(driverValues(mapping.charge.encodeInsert({
-					moduleId: input.moduleId,
-					action: input.action,
-					scopeKind: entry.kind,
-					scopeKey: entry.key,
-					attemptId,
-					occurredAtMillis: now,
-					retentionUntilMillis: now + entry.windowMillis
-				}), [[mapping.charge.occurredAt, mapping.d1.engineNow], [mapping.charge.retentionUntil, mapping.d1.engineInstantPlus(entry.windowMillis)]]))));
-				if (allAdmitted) {
-					const snapshot = resolved?.snapshot;
+			let used = false;
+			return Object.freeze({
+				...snapshot === void 0 ? {} : { credential: snapshot },
+				claim: Effect.suspend(() => {
+					if (used) return Effect.fail(unavailable());
+					used = true;
+					return Effect.void;
+				}),
+				admit: (prepare) => run(Effect.gen(function* () {
+					const database = yield* CurrentD1PlanningDatabase;
+					const journal = yield* CurrentCommitJournal;
+					const now = yield* readEngineNowMillis(mapping);
+					const marker = `effect-auth-password-guard:admit:${attemptId}`;
+					const a = attemptColumns(mapping);
+					const key = and(eq(a.moduleId, input.moduleId), eq(a.attemptId, attemptId));
+					const current = admittedSnapshotCondition(mapping, resolved, input.moduleId);
 					const record = {
 						moduleId: input.moduleId,
 						action: input.action,
@@ -509,24 +433,33 @@ const makePasswordPlans = (mapping, proofMapping) => {
 							identifierBindingRevision: snapshot.identifierBindingRevision
 						},
 						admittedAtMillis: now,
-						deadlineMillis: now + input.policy.attemptLifetimeMillis,
-						retentionUntilMillis: Math.max(now + input.policy.attemptLifetimeMillis, ...scopes.map((entry) => now + entry.windowMillis))
+						deadlineMillis: now + input.attemptLifetimeMillis,
+						retentionUntilMillis: now + input.attemptLifetimeMillis
 					};
-					statements.push(yield* statement(database.insert(mapping.attempt.table).values(driverValues(mapping.attempt.encodeInsert(record, {
-						...resolved?.nativeSubjectId === void 0 ? {} : { nativeSubjectId: resolved.nativeSubjectId },
-						state: "pending"
-					}), [
-						[mapping.attempt.admittedAt, mapping.d1.engineNow],
-						[mapping.attempt.deadline, mapping.d1.engineInstantPlus(input.policy.attemptLifetimeMillis)],
-						[mapping.attempt.retentionUntil, mapping.d1.engineInstantPlus(Math.max(input.policy.attemptLifetimeMillis, ...scopes.map((entry) => entry.windowMillis)))]
-					]))));
-				}
-				return {
-					receipt,
-					statements,
-					retryable: (cause) => isGuardFailure(cause, marker)
-				};
-			}));
+					const receipt = prepare({
+						_tag: "Admitted",
+						attemptId,
+						...snapshot === void 0 ? {} : { credential: snapshot }
+					}, journal);
+					const admitted = and(current, sql`exists(select 1 from ${mapping.attempt.table} where ${key} and ${a.state} = ${"pending"} and ${a.deadline} > ${mapping.d1.engineNow})`);
+					return {
+						receipt,
+						statements: [
+							yield* assertion(and(current, sql`not exists(select 1 from ${mapping.attempt.table} where ${key})`), marker),
+							yield* statement(database.insert(mapping.attempt.table).values(driverValues(mapping.attempt.encodeInsert(record, {
+								...resolved?.nativeSubjectId === void 0 ? {} : { nativeSubjectId: resolved.nativeSubjectId },
+								state: "pending"
+							}), [
+								[mapping.attempt.admittedAt, mapping.d1.engineNow],
+								[mapping.attempt.deadline, mapping.d1.engineInstantPlus(input.attemptLifetimeMillis)],
+								[mapping.attempt.retentionUntil, mapping.d1.engineInstantPlus(input.attemptLifetimeMillis)]
+							]))),
+							yield* assertion(and(sql`changes() = 1`, admitted), marker)
+						],
+						postconditions: [yield* assertion(admitted, marker)]
+					};
+				}))
+			});
 		}),
 		settleAttempt: (uncaptured, prepare) => Effect.gen(function* () {
 			const database = yield* CurrentD1PlanningDatabase;
@@ -545,7 +478,7 @@ const makePasswordPlans = (mapping, proofMapping) => {
 				let verified = false;
 				if (row !== void 0 && row[mapping.attempt.state] === "pending" && input.outcome === "verified" && input.captured !== void 0 && deadline !== void 0 && deadline > engineNow) {
 					resolved = yield* resolveCredential(mapping, input.moduleId, input.captured.identifier, input.captured.revision.subjectId);
-					verified = input.captured.moduleId === input.moduleId && resolved?.snapshot !== void 0 && sameSnapshot(resolved.snapshot, input.captured) && mapping.subjectId.equals(row[mapping.attempt.subjectId], resolved.nativeSubjectId) && row[mapping.attempt.identifierNamespace] === input.captured.identifier.namespace && row[mapping.attempt.identifierValue] === input.captured.identifier.value && row[mapping.attempt.credentialId] === input.captured.credentialId && row[mapping.attempt.securityRevision] === input.captured.revision.securityRevision && row[mapping.attempt.credentialRevision] === input.captured.credentialRevision && row[mapping.attempt.verifierVersion] === input.captured.verifierVersion && row[mapping.attempt.identifierBindingRevision] === input.captured.identifierBindingRevision;
+					verified = input.captured.moduleId === input.moduleId && resolved?.snapshot !== void 0 && samePasswordCredentialSnapshot(resolved.snapshot, input.captured) && mapping.subjectId.equals(row[mapping.attempt.subjectId], resolved.nativeSubjectId) && row[mapping.attempt.identifierNamespace] === input.captured.identifier.namespace && row[mapping.attempt.identifierValue] === input.captured.identifier.value && row[mapping.attempt.credentialId] === input.captured.credentialId && row[mapping.attempt.securityRevision] === input.captured.revision.securityRevision && row[mapping.attempt.credentialRevision] === input.captured.credentialRevision && row[mapping.attempt.verifierVersion] === input.captured.verifierVersion && row[mapping.attempt.identifierBindingRevision] === input.captured.identifierBindingRevision;
 				}
 				const decision = verified ? "verified" : "rejected";
 				const receipt = prepare(decision, journal);
@@ -555,26 +488,34 @@ const makePasswordPlans = (mapping, proofMapping) => {
 				};
 				const marker = `effect-auth-password-guard:settle:${input.attemptId}`;
 				const base = and(eq(a.moduleId, input.moduleId), eq(a.attemptId, input.attemptId), eq(a.state, "pending"));
-				const condition = verified ? and(base, sql`${a.deadline} > ${mapping.d1.engineNow}`) : base;
+				const attemptSnapshot = verified && resolved?.snapshot !== void 0 ? and(eq(a.action, row[mapping.attempt.action]), eq(a.subjectId, resolved.nativeSubjectId), eq(a.identifierNamespace, input.captured.identifier.namespace), eq(a.identifierValue, input.captured.identifier.value), eq(a.credentialId, input.captured.credentialId), eq(a.securityRevision, input.captured.revision.securityRevision), eq(a.credentialRevision, input.captured.credentialRevision), eq(a.verifierVersion, input.captured.verifierVersion), eq(a.identifierBindingRevision, input.captured.identifierBindingRevision), eq(a.deadline, row[mapping.attempt.deadline])) : sql`true`;
+				const condition = verified ? and(base, attemptSnapshot, sql`${a.deadline} > ${mapping.d1.engineNow}`) : base;
 				const statements = [yield* assertion(sql`exists(select 1 from ${mapping.attempt.table} where ${condition})`, marker), yield* statement(database.update(mapping.attempt.table).set(updateValues([[mapping.attempt.state, decision]])).where(condition))];
+				let finalAuthority = sql`true`;
 				if (verified && resolved?.snapshot !== void 0) {
 					const captured = input.captured;
-					const s = subjectColumns(mapping);
-					const i = identifierColumns(mapping);
 					const c = credentialColumns(mapping);
-					const authority = and(sql`exists(select 1 from ${mapping.subject.table} where ${s.id} = ${sql.param(resolved.nativeSubjectId, s.id)} and ${s.status} = ${sql.param(mapping.subject.d1ActiveStatusValue, s.status)} and ${s.securityRevision} = ${sql.param(input.captured.revision.securityRevision, s.securityRevision)})`, mapping.identifier.d1CurrentCondition({
-						identifier: input.captured.identifier,
-						nativeSubjectId: resolved.nativeSubjectId
-					}), sql`exists(select 1 from ${mapping.credential.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(resolved.nativeSubjectId, c.subjectId)} and ${c.credentialId} = ${sql.param(input.captured.credentialId, c.credentialId)} and ${c.credentialRevision} = ${sql.param(input.captured.credentialRevision, c.credentialRevision)} and ${c.verifierVersion} = ${sql.param(input.captured.verifierVersion, c.verifierVersion)} and ${c.verifier} = ${sql.param(Redacted.value(input.captured.verifier), c.verifier)})`, sql`exists(select 1 from ${mapping.identifier.table} where ${i.namespace} = ${sql.param(input.captured.identifier.namespace, i.namespace)} and ${i.value} = ${sql.param(input.captured.identifier.value, i.value)} and ${i.subjectId} = ${sql.param(resolved.nativeSubjectId, i.subjectId)} and ${i.bindingRevision} = ${sql.param(input.captured.identifierBindingRevision, i.bindingRevision)})`);
-					statements.splice(1, 0, yield* assertion(authority, marker));
+					finalAuthority = admittedSnapshotCondition(mapping, resolved, input.moduleId);
+					statements.splice(1, 0, yield* assertion(finalAuthority, marker));
 					if (input.rehash !== void 0 && input.rehash.expectedVersion === captured.verifierVersion && Redacted.value(input.rehash.expectedVerifier) === Redacted.value(captured.verifier)) {
 						const nextVersion = yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync);
-						statements.push(yield* statement(database.update(mapping.credential.table).set(mapping.credential.encodeVerifier(input.rehash.nextVerifier, nextVersion)).where(and(eq(c.moduleId, input.moduleId), eq(c.subjectId, resolved.nativeSubjectId), eq(c.credentialId, captured.credentialId), eq(c.credentialRevision, captured.credentialRevision), eq(c.verifierVersion, input.rehash.expectedVersion), eq(c.verifier, Redacted.value(input.rehash.expectedVerifier))))));
+						statements.push(yield* assertion(sql`changes() = 1`, marker), yield* statement(database.update(mapping.credential.table).set(mapping.credential.encodeVerifier(input.rehash.nextVerifier, nextVersion)).where(and(eq(c.moduleId, input.moduleId), eq(c.subjectId, resolved.nativeSubjectId), eq(c.credentialId, captured.credentialId), eq(c.credentialRevision, captured.credentialRevision), eq(c.verifierVersion, input.rehash.expectedVersion), eq(c.verifier, Redacted.value(input.rehash.expectedVerifier))))));
+						finalAuthority = admittedSnapshotCondition(mapping, {
+							...resolved,
+							snapshot: {
+								...resolved.snapshot,
+								verifierVersion: nextVersion,
+								verifier: input.rehash.nextVerifier
+							}
+						}, input.moduleId);
 					}
 				}
+				const settled = and(finalAuthority, sql`exists(select 1 from ${mapping.attempt.table} where ${a.moduleId} = ${sql.param(input.moduleId, a.moduleId)} and ${a.attemptId} = ${sql.param(input.attemptId, a.attemptId)} and ${a.state} = ${sql.param(decision, a.state)} and ${attemptSnapshot}${verified ? sql` and ${a.deadline} > ${mapping.d1.engineNow}` : sql``})`);
+				statements.push(yield* assertion(and(sql`changes() = 1`, settled), marker));
 				return {
 					receipt,
 					statements,
+					postconditions: [yield* assertion(settled, marker)],
 					retryable: (cause) => isGuardFailure(cause, marker)
 				};
 			}));
@@ -617,10 +558,15 @@ const makePasswordPlans = (mapping, proofMapping) => {
 					verifierVersion,
 					nextSecurityRevision
 				});
+				if (compiled === void 0) return {
+					receipt: prepare("rejected", journal),
+					statements: []
+				};
 				return {
-					receipt: prepare(compiled === void 0 ? "rejected" : "changed", journal),
-					statements: compiled?.statements ?? [],
-					...compiled?.retryable === void 0 ? {} : { retryable: compiled.retryable }
+					receipt: prepare("changed", journal),
+					statements: compiled.statements,
+					postconditions: [yield* assertion(compiled.appliedCondition, compiled.marker)],
+					retryable: compiled.retryable
 				};
 			}));
 		}),
@@ -695,12 +641,15 @@ const replacementPlan = Effect.fn("Drizzle.replacementPlan")(function* (mapping,
 		return {
 			receipt: passwordReceipt ?? prepare("rejected", journal),
 			statements: compiled.statements,
+			...compiled.postconditions === void 0 ? {} : { postconditions: compiled.postconditions },
 			retryable: (cause) => isGuardFailure(cause, marker) || isGuardFailure(cause, `effect-auth-proof-guard:complete:${input.completion.input.continuationId}`) || isGuardFailure(cause, `effect-auth-proof-guard:protected:${input.completion.input.continuationId}`)
 		};
 	}
+	const applied = yield* assertion(protectedMutation.appliedCondition, marker);
 	return {
 		receipt: prepare("changed", journal),
-		statements: [...protectedMutation.statements, yield* assertion(protectedMutation.appliedCondition, marker)],
+		statements: [...protectedMutation.statements, applied],
+		postconditions: [applied],
 		retryable: (cause) => isGuardFailure(cause, marker)
 	};
 });
@@ -710,47 +659,18 @@ const cleanupPlan = Effect.fn("Drizzle.cleanupPlan")(function* (mapping, input,
 	const now = yield* readEngineNowMillis(mapping);
 	const nativeNow = mapping.encodeInstant(now);
 	const a = attemptColumns(mapping);
-	const c = chargeColumns(mapping);
-	const sc = scopeColumns(mapping);
-	let remaining = input.limit;
-	let hasMore = false;
-	const attempts = yield* database.select({ attemptId: a.attemptId }).from(mapping.attempt.table).where(and(eq(a.moduleId, input.moduleId), lte(a.retentionUntil, nativeNow))).limit(remaining + 1);
-	if (attempts.length > remaining) hasMore = true;
-	const selectedAttempts = attempts.slice(0, remaining);
-	remaining -= selectedAttempts.length;
-	const charges = yield* database.select({
-		action: c.action,
-		scopeKind: c.scopeKind,
-		scopeKey: c.scopeKey,
-		attemptId: c.attemptId
-	}).from(mapping.charge.table).where(and(eq(c.moduleId, input.moduleId), lte(c.retentionUntil, nativeNow))).limit(remaining + 1);
-	if (charges.length > remaining) hasMore = true;
-	const selectedCharges = charges.slice(0, remaining);
-	remaining -= selectedCharges.length;
-	const scopes = yield* database.select({
-		action: sc.action,
-		scopeKind: sc.scopeKind,
-		scopeKey: sc.scopeKey
-	}).from(mapping.rateScope.table).where(and(eq(sc.moduleId, input.moduleId), notExists(database.select({ one: sql`1` }).from(mapping.charge.table).where(and(eq(c.moduleId, sc.moduleId), eq(c.action, sc.action), eq(c.scopeKind, sc.scopeKind), eq(c.scopeKey, sc.scopeKey)))))).limit(remaining + 1);
-	if (scopes.length > remaining) hasMore = true;
-	const selectedScopes = scopes.slice(0, remaining);
+	const attempts = yield* database.select({ attemptId: a.attemptId }).from(mapping.attempt.table).where(and(eq(a.moduleId, input.moduleId), lte(a.retentionUntil, nativeNow))).limit(input.limit + 1);
+	const selectedAttempts = attempts.slice(0, input.limit);
+	const hasMore = attempts.length > selectedAttempts.length;
 	const marker = `effect-auth-password-guard:cleanup:${input.moduleId}:${now}`;
 	const statements = [];
 	for (const row of selectedAttempts) {
 		const condition = and(eq(a.moduleId, input.moduleId), eq(a.attemptId, row.attemptId), lte(a.retentionUntil, mapping.d1.engineNow));
 		statements.push(yield* assertion(sql`exists(select 1 from ${mapping.attempt.table} where ${condition})`, marker), yield* statement(database.delete(mapping.attempt.table).where(condition)));
 	}
-	for (const row of selectedCharges) {
-		const condition = and(eq(c.moduleId, input.moduleId), eq(c.action, row.action), eq(c.scopeKind, row.scopeKind), eq(c.scopeKey, row.scopeKey), eq(c.attemptId, row.attemptId), lte(c.retentionUntil, mapping.d1.engineNow));
-		statements.push(yield* assertion(sql`exists(select 1 from ${mapping.charge.table} where ${condition})`, marker), yield* statement(database.delete(mapping.charge.table).where(condition)));
-	}
-	for (const row of selectedScopes) {
-		const condition = and(eq(sc.moduleId, input.moduleId), eq(sc.action, row.action), eq(sc.scopeKind, row.scopeKind), eq(sc.scopeKey, row.scopeKey), notExists(database.select({ one: sql`1` }).from(mapping.charge.table).where(and(eq(c.moduleId, sc.moduleId), eq(c.action, sc.action), eq(c.scopeKind, sc.scopeKind), eq(c.scopeKey, sc.scopeKey)))));
-		statements.push(yield* assertion(sql`exists(select 1 from ${mapping.rateScope.table} where ${condition})`, marker), yield* statement(database.delete(mapping.rateScope.table).where(condition)));
-	}
 	return {
 		receipt: prepare({
-			removed: selectedAttempts.length + selectedCharges.length + selectedScopes.length,
+			removed: selectedAttempts.length,
 			hasMore
 		}, journal),
 		statements,
@@ -765,12 +685,19 @@ const makeD1PasswordPersistenceServices = Effect.fnUntraced(function* (mapping,
 	}).pipe(Effect.provideServiceEffect(NativeDatabase, nativeDatabase(Database)), Effect.mapError(unavailable));
 	const hooks = yield* LifecycleHooks;
 	const plans = makePasswordPlans(mapping, proofMapping);
-	const run = (plan) => Effect.gen(function* () {
+	const standalone = Effect.gen(function* () {
 		if (yield* hasCommitScope) return yield* unavailable();
+		yield* requireStandalone(unavailable, database.$client.transactionService);
+	});
+	const run = (plan) => Effect.gen(function* () {
+		yield* standalone;
 		return yield* executeStandalone(plan, 2);
 	}).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks));
 	return { passwordPersistence: {
-		admitAttempt: (input, prepare) => run(plans.admitAttempt(input, prepare)).pipe(translateFailure),
+		prepareAttempt: (input) => standalone.pipe(Effect.andThen(plans.prepareAttempt(input)), Effect.map((planned) => Object.freeze({
+			...planned.credential === void 0 ? {} : { credential: planned.credential },
+			admit: (prepare) => planned.claim.pipe(Effect.andThen(run(planned.admit(prepare))), translateFailure)
+		})), Effect.provideService(CurrentD1PlanningDatabase, database), translateFailure),
 		settleAttempt: (input, prepare) => run(plans.settleAttempt(input, prepare)).pipe(translateFailure),
 		readForSubject: (input) => plans.readForSubject(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
 		recoveryTarget: (input) => plans.recoveryTarget(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
@@ -814,7 +741,10 @@ function coordinateD1PasswordPersistence(acquire, options, body) {
 				return guarded.receipt;
 			}), { mode: "batch" }).pipe(Effect.map((result) => result.value), Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks));
 			const provided = Context.make(PasswordPersistence, {
-				admitAttempt: (input, prepare) => owner.run(run(plans.admitAttempt(input, prepare)).pipe(translateFailure)),
+				prepareAttempt: (input) => owner.run(plans.prepareAttempt(input).pipe(Effect.map((planned) => Object.freeze({
+					...planned.credential === void 0 ? {} : { credential: planned.credential },
+					admit: (prepare) => owner.run(planned.claim.pipe(Effect.andThen(run(planned.admit(prepare))), translateFailure))
+				})), Effect.provideService(CurrentD1PlanningDatabase, database), translateFailure)),
 				settleAttempt: (input, prepare) => owner.run(run(plans.settleAttempt(input, prepare)).pipe(translateFailure)),
 				readForSubject: (input) => owner.run(plans.readForSubject(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks), translateFailure)),
 				recoveryTarget: (input) => owner.run(plans.recoveryTarget(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks), translateFailure)),
@@ -829,7 +759,7 @@ function coordinateD1PasswordPersistence(acquire, options, body) {
 				const status = yield* Effect.result(mutation.journalGuard.read);
 				if (status._tag === "Success" || status.failure._tag !== "CommitPending") return yield* unavailable();
 			}
-			yield* database.$client.batch(statements).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, (error) => everyFailureMatches(cause, mutation?.retryable) ? unavailable() : error))), translateFailure);
+			yield* database.$client.batch([...statements, ...mutation?.postconditions ?? []]).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, (error) => everyFailureMatches(cause, mutation?.retryable) ? unavailable() : error))), translateFailure);
 			return value;
 		}), { mode: "batch" }).pipe(Effect.provideService(LifecycleHooks, hooks))).value;
 	}).pipe(Effect.provideService(NativeDatabase, database)));