@yielded/auth-persistence-drizzle 0.1.0-beta.22 → 0.1.0-beta.24

package/src/drizzle/d1-passwords.ts

@@ -1,6 +1,10 @@
 /* oxlint-disable no-explicit-any -- D1 plans bridge consumer-owned Drizzle rows and SQL statements. */
 import type { D1Client } from "@effect/sql-d1/D1Client";
-import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
+import {
+  NativeDatabase,
+  requireStandalone,
+  samePasswordCredentialSnapshot as sameSnapshot,
+} from "@yielded/auth-persistence/Adapter";
 import {
   coordinateCommit,
   CurrentCommitJournal,
@@ -12,6 +16,7 @@ import {
 } from "@yielded/auth/Hooks";
 import type { LoginIdentifier } from "@yielded/auth/Identity";
 import {
+  EncodedPasswordHash,
   PasswordUnavailable,
   PasswordPersistence,
   type PasswordMutationInput,
@@ -20,10 +25,7 @@ import {
   snapshotPasswordRequirement,
   snapshotPasswordRevision,
   type PasswordAction,
-  type PasswordAttemptDecision,
-  type PasswordCredentialSnapshot,
   type PasswordMutationDecision,
-  type PasswordAttemptPolicy,
 } from "@yielded/auth/Password";
 import { reportPersistenceFailure } from "@yielded/auth/Persistence";
 import {
@@ -40,18 +42,14 @@ import {
 } from "@yielded/auth/Sessions";
 import {
   and,
-  count,
   eq,
-  gte,
+  getTableColumns,
   inArray,
-  lte,
-  notExists,
   sql,
   type AnyRelations,
   type SQL,
   type Table,
 } from "drizzle-orm";
-import type { EffectDrizzleQueryError } from "drizzle-orm/effect-core";
 import type { EffectSQLiteD1Database } from "drizzle-orm/effect-d1";
 import type { AnySQLiteTable } from "drizzle-orm/sqlite-core";
 import { Cause, DateTime, Effect, Option, Predicate, Redacted, Schema, Context } from "effect";
@@ -67,10 +65,7 @@ import { nativeDatabase } from "./native-database";
 import {
   type AnyPasswordRegistrationMapping,
   type D1PasswordPersistenceMapping,
-  type PasswordAttemptRecord,
-  type PasswordRateScopeKind,
   type PasswordRegistrationMapping,
-  type PasswordScopeKeys,
   requiredPasswordConstraints,
   requiredPasswordRegistrationConstraints,
 } from "./password-model";
@@ -85,24 +80,14 @@ type PlanPrepare<Method extends (...args: any[]) => any, A> = (
 ) => PreparedCommit<A>;
 
 type Database = EffectSQLiteD1Database<AnyRelations> & { readonly $client: D1Client };
-type Mapping = D1PasswordPersistenceMapping<
-  Table,
-  Table,
-  Table,
-  Table,
-  Table,
-  Table,
-  Table,
-  Table,
-  unknown
->;
+type Mapping = D1PasswordPersistenceMapping<Table, Table, Table, Table, Table, unknown>;
 type RegistrationMapping<Registration> = AnyPasswordRegistrationMapping<Registration>;
-type AdapterFailure = PersistenceMappingError | EffectDrizzleQueryError;
-const mapAdapter = <A>(effect: Effect.Effect<A, AdapterFailure>) => effect;
 
 interface Planned<A> {
   readonly receipt: A;
   readonly statements: ReadonlyArray<Statement<any>>;
+  /** Final-state guards without `changes()`, repeated after coordinated statements. */
+  readonly postconditions?: ReadonlyArray<Statement<any>>;
   readonly retryable?: (cause: unknown) => boolean;
   readonly journalGuard?: PreparedCommit<void>;
 }
@@ -209,11 +194,6 @@ const readEngineNowMillis = Effect.fn("Drizzle.readEngineNowMillis")(function* (
     );
 });
 
-const driverValues = (values: object, entries: ReadonlyArray<readonly [string, unknown]>) => ({
-  ...values,
-  ...Object.fromEntries(entries),
-});
-
 const allocate = <A>(
   asyncValue: Effect.Effect<A, PersistenceMappingError> | undefined,
   syncValue: (() => A) | undefined,
@@ -269,44 +249,6 @@ const authorityColumns = (mapping: Mapping) => ({
       : column(mapping.authorityCredential.table, mapping.authorityCredential.status),
 });
 
-const attemptColumns = (mapping: Mapping) => ({
-  moduleId: column(mapping.attempt.table, mapping.attempt.moduleId),
-  action: column(mapping.attempt.table, mapping.attempt.action),
-  attemptId: column(mapping.attempt.table, mapping.attempt.attemptId),
-  identifierNamespace: column(mapping.attempt.table, mapping.attempt.identifierNamespace),
-  identifierValue: column(mapping.attempt.table, mapping.attempt.identifierValue),
-  subjectId: column(mapping.attempt.table, mapping.attempt.subjectId),
-  credentialId: column(mapping.attempt.table, mapping.attempt.credentialId),
-  securityRevision: column(mapping.attempt.table, mapping.attempt.securityRevision),
-  credentialRevision: column(mapping.attempt.table, mapping.attempt.credentialRevision),
-  verifierVersion: column(mapping.attempt.table, mapping.attempt.verifierVersion),
-  identifierBindingRevision: column(
-    mapping.attempt.table,
-    mapping.attempt.identifierBindingRevision,
-  ),
-  admittedAt: column(mapping.attempt.table, mapping.attempt.admittedAt),
-  deadline: column(mapping.attempt.table, mapping.attempt.deadline),
-  retentionUntil: column(mapping.attempt.table, mapping.attempt.retentionUntil),
-  state: column(mapping.attempt.table, mapping.attempt.state),
-});
-
-const scopeColumns = (mapping: Mapping) => ({
-  moduleId: column(mapping.rateScope.table, mapping.rateScope.moduleId),
-  action: column(mapping.rateScope.table, mapping.rateScope.action),
-  scopeKind: column(mapping.rateScope.table, mapping.rateScope.scopeKind),
-  scopeKey: column(mapping.rateScope.table, mapping.rateScope.scopeKey),
-});
-
-const chargeColumns = (mapping: Mapping) => ({
-  moduleId: column(mapping.charge.table, mapping.charge.moduleId),
-  action: column(mapping.charge.table, mapping.charge.action),
-  scopeKind: column(mapping.charge.table, mapping.charge.scopeKind),
-  scopeKey: column(mapping.charge.table, mapping.charge.scopeKey),
-  attemptId: column(mapping.charge.table, mapping.charge.attemptId),
-  occurredAt: column(mapping.charge.table, mapping.charge.occurredAt),
-  retentionUntil: column(mapping.charge.table, mapping.charge.retentionUntil),
-});
-
 const commandColumns = (mapping: Mapping) => ({
   moduleId: column(mapping.command.table, mapping.command.moduleId),
   commandId: column(mapping.command.table, mapping.command.commandId),
@@ -360,14 +302,6 @@ const readCredentialNative = Effect.fn("Drizzle.readCredentialNative")(function*
     .limit(1);
 });
 
-interface Resolved {
-  readonly nativeSubjectId: unknown;
-  readonly subject: any;
-  readonly identifier: any;
-  readonly credential?: any;
-  readonly snapshot?: PasswordCredentialSnapshot;
-}
-
 const resolveCredential = Effect.fn("DrizzleD1Password.resolveCredential")(function* (
   mapping: Mapping,
   moduleId: string,
@@ -396,137 +330,6 @@ const resolveCredential = Effect.fn("DrizzleD1Password.resolveCredential")(funct
   return { nativeSubjectId, subject, identifier: identifierRow, credential, snapshot };
 });
 
-interface ScopeEntry {
-  readonly kind: PasswordRateScopeKind;
-  readonly key: string;
-  readonly limit: number;
-  readonly windowMillis: number;
-}
-
-const scopeEntries = (keys: PasswordScopeKeys, policy: PasswordAttemptPolicy) => {
-  const entries: ScopeEntry[] = [
-    { kind: "action", key: keys.action, ...policy.action },
-    { kind: "identifier", key: keys.identifier, ...policy.identifier },
-  ];
-
-  if (keys.subject !== undefined)
-    entries.push({ kind: "subject", key: keys.subject, ...policy.subject });
-
-  return entries;
-};
-
-const livePendingAttempts = (
-  mapping: Mapping,
-  moduleId: string,
-  action: "sign-in" | "change",
-  entry: ScopeEntry,
-  identifier: LoginIdentifier,
-  nativeSubjectId: unknown | undefined,
-  activeAt: unknown,
-) => {
-  const a = attemptColumns(mapping);
-
-  return and(
-    entry.kind === "action"
-      ? and(eq(a.moduleId, moduleId), eq(a.action, action))
-      : entry.kind === "identifier"
-        ? and(
-            eq(a.moduleId, moduleId),
-            eq(a.action, action),
-            eq(a.identifierNamespace, identifier.namespace),
-            eq(a.identifierValue, identifier.value),
-          )
-        : and(eq(a.moduleId, moduleId), eq(a.action, action), eq(a.subjectId, nativeSubjectId)),
-    eq(a.state, "pending"),
-    sql`${a.retentionUntil} > ${activeAt}`,
-  );
-};
-
-const scopeAdmissionCondition = (
-  mapping: Mapping,
-  moduleId: string,
-  action: "sign-in" | "change",
-  entry: ScopeEntry,
-  policy: PasswordAttemptPolicy,
-  identifier: LoginIdentifier,
-  nativeSubjectId: unknown | undefined,
-) => {
-  const c = chargeColumns(mapping);
-
-  const pending = livePendingAttempts(
-    mapping,
-    moduleId,
-    action,
-    entry,
-    identifier,
-    nativeSubjectId,
-    mapping.d1.engineNow,
-  );
-
-  return sql`(select count(*) from ${mapping.charge.table} where ${c.moduleId} = ${sql.param(moduleId, c.moduleId)} and ${c.action} = ${sql.param(action, c.action)} and ${c.scopeKind} = ${sql.param(entry.kind, c.scopeKind)} and ${c.scopeKey} = ${sql.param(entry.key, c.scopeKey)} and ${c.occurredAt} >= ${mapping.d1.engineInstantMinus(entry.windowMillis)}) < ${entry.limit} and (select count(*) from ${mapping.attempt.table} where ${pending}) < ${policy.maximumPending}`;
-};
-
-const readScopeAdmission = Effect.fn("DrizzleD1Password.readScopeAdmission")(function* (
-  mapping: Mapping,
-  moduleId: string,
-  action: "sign-in" | "change",
-  entries: ReadonlyArray<ScopeEntry>,
-  policy: PasswordAttemptPolicy,
-  identifier: LoginIdentifier,
-  nativeSubjectId: unknown | undefined,
-  now: number,
-) {
-  const database = yield* CurrentD1PlanningDatabase;
-
-  const c = chargeColumns(mapping);
-  const admitted: ScopeEntry[] = [];
-
-  for (let index = 0; index < entries.length; index++) {
-    const entry = entries[index]!;
-
-    const chargeRows = yield* mapAdapter(
-      database
-        .select({ total: count() })
-        .from(mapping.charge.table)
-        .where(
-          and(
-            eq(c.moduleId, moduleId),
-            eq(c.action, action),
-            eq(c.scopeKind, entry.kind),
-            eq(c.scopeKey, entry.key),
-            gte(c.occurredAt, mapping.encodeInstant(now - entry.windowMillis)),
-          ),
-        ),
-    );
-
-    const pendingRows = yield* mapAdapter(
-      database
-        .select({ total: count() })
-        .from(mapping.attempt.table)
-        .where(
-          livePendingAttempts(
-            mapping,
-            moduleId,
-            action,
-            entry,
-            identifier,
-            nativeSubjectId,
-            mapping.encodeInstant(now),
-          ),
-        ),
-    );
-
-    const admittedHere =
-      Number(chargeRows[0]?.total ?? 0) < entry.limit &&
-      Number(pendingRows[0]?.total ?? 0) < policy.maximumPending;
-
-    if (admittedHere) admitted.push(entry);
-    else if (index === 0) break;
-  }
-
-  return admitted;
-});
-
 const evidenceProofsJson = Schema.encodeSync(
   Schema.fromJsonString(AuthenticationEvidence.fields.proofs),
 );
@@ -555,25 +358,6 @@ const assuranceCondition = (
 const sameIdentifier = (left: LoginIdentifier, right: LoginIdentifier) =>
   left.namespace === right.namespace && left.value === right.value;
 
-const sameSnapshot = (left: PasswordCredentialSnapshot, right: PasswordCredentialSnapshot) =>
-  left.moduleId === right.moduleId &&
-  left.revision.subjectId === right.revision.subjectId &&
-  left.revision.securityRevision === right.revision.securityRevision &&
-  left.credentialId === right.credentialId &&
-  left.credentialRevision === right.credentialRevision &&
-  left.verifierVersion === right.verifierVersion &&
-  left.normalization === right.normalization &&
-  left.identifierVerifiedAtMillis === right.identifierVerifiedAtMillis &&
-  left.revision.credentials.length === right.revision.credentials.length &&
-  left.revision.credentials.every((entry) =>
-    right.revision.credentials.some(
-      (other) => other.credentialId === entry.credentialId && other.revision === entry.revision,
-    ),
-  ) &&
-  left.identifierBindingRevision === right.identifierBindingRevision &&
-  sameIdentifier(left.identifier, right.identifier) &&
-  Redacted.value(left.verifier) === Redacted.value(right.verifier);
-
 const evidenceSatisfiedAt = (
   evidence: PasswordMutationInput["authorization"]["evidence"],
   requirement: PasswordMutationInput["authorization"]["requirement"],
@@ -928,34 +712,6 @@ const credentialCurrentCondition = (
     : sql`exists(select 1 from ${mapping.credential.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(nativeSubjectId, c.subjectId)} and ${c.credentialId} = ${sql.param(input.credential.credentialId, c.credentialId)} and ${c.credentialRevision} = ${sql.param(input.credential.credentialRevision, c.credentialRevision)} and ${c.verifierVersion} = ${sql.param(input.credential.verifierVersion, c.verifierVersion)} and ${c.verifier} = ${sql.param(Redacted.value(input.credential.verifier), c.verifier)} and ${c.normalization} = ${sql.param(input.credential.normalization, c.normalization)})`;
 };
 
-const admittedSnapshotCondition = (
-  mapping: Mapping,
-  resolved: Resolved | undefined,
-  moduleId: string,
-) => {
-  const snapshot = resolved?.snapshot;
-
-  if (snapshot === undefined || resolved === undefined) return sql`true`;
-  const s = subjectColumns(mapping);
-  const i = identifierColumns(mapping);
-  const c = credentialColumns(mapping);
-  const ac = authorityColumns(mapping);
-
-  return and(
-    sql`exists(select 1 from ${mapping.subject.table} where ${s.id} = ${sql.param(resolved.nativeSubjectId, s.id)} and ${s.status} = ${sql.param(mapping.subject.d1ActiveStatusValue, s.status)} and ${s.securityRevision} = ${sql.param(snapshot.revision.securityRevision, s.securityRevision)})`,
-    mapping.identifier.d1CurrentCondition({
-      identifier: snapshot.identifier,
-      nativeSubjectId: resolved.nativeSubjectId,
-    }),
-    sql`exists(select 1 from ${mapping.identifier.table} where ${i.namespace} = ${sql.param(snapshot.identifier.namespace, i.namespace)} and ${i.value} = ${sql.param(snapshot.identifier.value, i.value)} and ${i.subjectId} = ${sql.param(resolved.nativeSubjectId, i.subjectId)} and ${i.bindingRevision} = ${sql.param(snapshot.identifierBindingRevision, i.bindingRevision)})`,
-    sql`exists(select 1 from ${mapping.credential.table} where ${c.moduleId} = ${sql.param(moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(resolved.nativeSubjectId, c.subjectId)} and ${c.credentialId} = ${sql.param(snapshot.credentialId, c.credentialId)} and ${c.credentialRevision} = ${sql.param(snapshot.credentialRevision, c.credentialRevision)} and ${c.verifierVersion} = ${sql.param(snapshot.verifierVersion, c.verifierVersion)} and ${c.verifier} = ${sql.param(Redacted.value(snapshot.verifier), c.verifier)} and ${c.normalization} = ${sql.param(snapshot.normalization, c.normalization)})`,
-    ...snapshot.revision.credentials.map(
-      (item) =>
-        sql`exists(select 1 from ${mapping.authorityCredential.table} where ${ac.subjectId} = ${sql.param(resolved.nativeSubjectId, ac.subjectId)} and ${ac.credentialId} = ${sql.param(item.credentialId, ac.credentialId)} and ${ac.revision} = ${sql.param(item.revision, ac.revision)}${ac.status === undefined ? sql`` : sql` and ${ac.status} = ${sql.param(mapping.authorityCredential.d1ActiveStatusValue, ac.status)}`})`,
-    ),
-  )!;
-};
-
 const mutationStatements = Effect.fn(function* (
   mapping: Mapping,
   input: PasswordMutationInput,
@@ -1150,6 +906,7 @@ const compileAddMutation = Effect.fn("DrizzleD1Password.compileAddMutation")(fun
   return {
     statements,
     appliedCondition,
+    marker,
     retryable: (cause: unknown) => isGuardFailure(cause, marker),
   };
 });
@@ -1179,357 +936,121 @@ const makePasswordPlans = (
     });
 
   return {
-    admitAttempt: <A>(
-      input: Parameters<PasswordPersistence["Service"]["admitAttempt"]>[0],
-      prepare: PlanPrepare<PasswordPersistence["Service"]["admitAttempt"], A>,
-    ) =>
+    findCredential: (uncaptured: Parameters<PasswordPersistence["Service"]["findCredential"]>[0]) =>
       Effect.gen(function* () {
+        if (!validConstraints(mapping)) return yield* unavailable();
+        const input = { ...uncaptured, identifier: { ...uncaptured.identifier } };
         const database = yield* CurrentD1PlanningDatabase;
+        const identifierRow = (yield* readIdentifier(mapping, input.identifier))[0];
 
-        const attemptId = yield* allocate(mapping.allocateAttemptId, mapping.allocateAttemptIdSync);
-
-        return yield* run(
-          Effect.gen(function* () {
-            const journal = yield* CurrentCommitJournal;
-
-            const now = yield* readEngineNowMillis(mapping);
-
-            const resolved = yield* resolveCredential(
-              mapping,
-              input.moduleId,
-              input.identifier,
-              input.subjectId,
-            );
-
-            const keys = mapping.scopeKeys({
-              moduleId: input.moduleId,
-              action: input.action,
-              identifier: input.identifier,
-              ...(resolved?.snapshot === undefined
-                ? {}
-                : { subjectId: resolved.snapshot.revision.subjectId }),
-            });
-
-            const scopes = scopeEntries(keys, input.policy);
-
-            const admitted = yield* readScopeAdmission(
-              mapping,
-              input.moduleId,
-              input.action,
-              scopes,
-              input.policy,
-              input.identifier,
-              resolved?.nativeSubjectId,
-              now,
-            );
-
-            const allAdmitted = admitted.length === scopes.length;
-            const considered = admitted.length === 0 ? scopes.slice(0, 1) : scopes;
-
-            const receipt = prepare(
-              allAdmitted
-                ? {
-                    _tag: "Admitted" as const,
-                    attemptId,
-                    ...(resolved?.snapshot === undefined ? {} : { credential: resolved.snapshot }),
-                  }
-                : { _tag: "Denied" as const },
-              journal,
-            );
-
-            const marker = `effect-auth-password-guard:admit:${attemptId}`;
-            const statements: Statement<any>[] = [];
+        if (identifierRow === undefined || !mapping.identifier.isCurrent(identifierRow))
+          return Option.none();
+        const nativeId = identifierRow[mapping.identifier.subjectId];
+
+        const sc = subjectColumns(mapping),
+          ic = identifierColumns(mapping),
+          cc = credentialColumns(mapping);
+
+        // Bind the same native ID through each column's codec, then inspect one coherent snapshot.
+        const rows = yield* database
+          .select({
+            subject: getTableColumns(mapping.subject.table),
+            identifier: getTableColumns(mapping.identifier.table),
+            credential: getTableColumns(mapping.credential.table),
+          })
+          .from(mapping.subject.table)
+          .innerJoin(
+            mapping.identifier.table,
+            and(
+              eq(ic.namespace, input.identifier.namespace),
+              eq(ic.value, input.identifier.value),
+              eq(ic.subjectId, nativeId),
+            ),
+          )
+          .innerJoin(
+            mapping.credential.table,
+            and(eq(cc.moduleId, input.moduleId), eq(cc.subjectId, nativeId)),
+          )
+          .where(eq(sc.id, nativeId));
 
-            for (const entry of considered) {
-              statements.push(
-                yield* statement(
-                  database
-                    .insert(mapping.rateScope.table)
-                    .values(
-                      mapping.rateScope.encodeInsert({
-                        moduleId: input.moduleId,
-                        action: input.action,
-                        scopeKind: entry.kind,
-                        scopeKey: entry.key,
-                      }),
-                    )
-                    .onConflictDoNothing(),
-                ),
-              );
-            }
+        if (rows.length !== 1) return Option.none();
+        const row = rows[0]!;
 
-            const conditions = considered.map((entry) => {
-              const condition = scopeAdmissionCondition(
-                mapping,
-                input.moduleId,
-                input.action,
-                entry,
-                input.policy,
-                input.identifier,
-                resolved?.nativeSubjectId,
-              );
+        if (
+          !mapping.subject.isActiveStatus(row.subject[mapping.subject.status]) ||
+          !mapping.identifier.isCurrent(row.identifier) ||
+          !mapping.subjectId.equals(nativeId, row.subject[mapping.subject.id]) ||
+          !mapping.subjectId.equals(nativeId, row.identifier[mapping.identifier.subjectId]) ||
+          !mapping.subjectId.equals(nativeId, row.credential[mapping.credential.subjectId])
+        )
+          return Option.none();
 
-              return admitted.includes(entry) ? condition : sql`not (${condition})`;
-            });
+        const credential = yield* mapping.credential
+          .decode({ moduleId: input.moduleId, ...row })
+          .pipe(Effect.flatMap(snapshotPasswordCredential));
 
-            statements.push(
-              yield* assertion(
-                and(
-                  ...conditions,
-                  ...(allAdmitted
-                    ? [admittedSnapshotCondition(mapping, resolved, input.moduleId)]
-                    : []),
-                )!,
-                marker,
-              ),
-            );
-            for (const entry of admitted)
-              statements.push(
-                yield* statement(
-                  database.insert(mapping.charge.table).values(
-                    driverValues(
-                      mapping.charge.encodeInsert({
-                        moduleId: input.moduleId,
-                        action: input.action,
-                        scopeKind: entry.kind,
-                        scopeKey: entry.key,
-                        attemptId,
-                        occurredAtMillis: now,
-                        retentionUntilMillis: now + entry.windowMillis,
-                      }),
-                      [
-                        [mapping.charge.occurredAt, mapping.d1.engineNow],
-                        [
-                          mapping.charge.retentionUntil,
-                          mapping.d1.engineInstantPlus(entry.windowMillis),
-                        ],
-                      ],
-                    ),
-                  ),
-                ),
-              );
-            if (allAdmitted) {
-              const snapshot = resolved?.snapshot;
-
-              const record: PasswordAttemptRecord = {
-                moduleId: input.moduleId,
-                action: input.action,
-                attemptId,
-                identifier: input.identifier,
-                ...(snapshot === undefined
-                  ? {}
-                  : {
-                      subjectId: snapshot.revision.subjectId,
-                      credentialId: snapshot.credentialId,
-                      securityRevision: snapshot.revision.securityRevision,
-                      credentialRevision: snapshot.credentialRevision,
-                      verifierVersion: snapshot.verifierVersion,
-                      identifierBindingRevision: snapshot.identifierBindingRevision,
-                    }),
-                admittedAtMillis: now,
-                deadlineMillis: now + input.policy.attemptLifetimeMillis,
-                retentionUntilMillis: Math.max(
-                  now + input.policy.attemptLifetimeMillis,
-                  ...scopes.map((entry) => now + entry.windowMillis),
-                ),
-              };
-
-              statements.push(
-                yield* statement(
-                  database.insert(mapping.attempt.table).values(
-                    driverValues(
-                      mapping.attempt.encodeInsert(record, {
-                        ...(resolved?.nativeSubjectId === undefined
-                          ? {}
-                          : { nativeSubjectId: resolved.nativeSubjectId }),
-                        state: "pending",
-                      }),
-                      [
-                        [mapping.attempt.admittedAt, mapping.d1.engineNow],
-                        [
-                          mapping.attempt.deadline,
-                          mapping.d1.engineInstantPlus(input.policy.attemptLifetimeMillis),
-                        ],
-                        [
-                          mapping.attempt.retentionUntil,
-                          mapping.d1.engineInstantPlus(
-                            Math.max(
-                              input.policy.attemptLifetimeMillis,
-                              ...scopes.map((entry) => entry.windowMillis),
-                            ),
-                          ),
-                        ],
-                      ],
-                    ),
-                  ),
-                ),
-              );
-            }
-
-            return {
-              receipt,
-              statements,
-              retryable: (cause: unknown) => isGuardFailure(cause, marker),
-            };
-          }),
-        );
+        return input.subjectId !== undefined && credential.revision.subjectId !== input.subjectId
+          ? Option.none()
+          : Option.some(credential);
       }),
-    settleAttempt: <A>(
-      uncaptured: Parameters<PasswordPersistence["Service"]["settleAttempt"]>[0],
-      prepare: PlanPrepare<PasswordPersistence["Service"]["settleAttempt"], A>,
-    ) =>
-      Effect.gen(function* () {
-        const database = yield* CurrentD1PlanningDatabase;
-
-        const captured =
-          uncaptured.captured === undefined
-            ? undefined
-            : yield* snapshotPasswordCredential(uncaptured.captured);
-
-        const input = { ...uncaptured, ...(captured === undefined ? {} : { captured }) };
-
-        return yield* run(
-          Effect.gen(function* () {
-            const journal = yield* CurrentCommitJournal;
-
-            const a = attemptColumns(mapping);
+    rehashIfCurrent: (input: Parameters<PasswordPersistence["Service"]["rehashIfCurrent"]>[0]) =>
+      run(
+        Effect.gen(function* () {
+          const nextVerifier = Redacted.make(
+            yield* Schema.decodeEffect(EncodedPasswordHash)(Redacted.value(input.nextVerifier)),
+          );
 
-            const rows = yield* database
-              .select()
-              .from(mapping.attempt.table)
-              .where(and(eq(a.moduleId, input.moduleId), eq(a.attemptId, input.attemptId)))
-              .limit(1);
+          const credential = yield* snapshotPasswordCredential(input.credential);
+          const database = yield* CurrentD1PlanningDatabase;
+          const nativeId = yield* mapping.subjectId.toNative(credential.revision.subjectId);
+          const version = yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync);
 
-            const row = rows[0];
-            const engineNow = yield* readEngineNowMillis(mapping);
+          if (version === credential.verifierVersion) return yield* unavailable();
+          const encoded = mapping.credential.encodeVerifier(nextVerifier, version);
 
-            const deadline =
-              row === undefined
-                ? undefined
-                : yield* mapping.decodeInstant(row[mapping.attempt.deadline]);
+          const values = {
+            [mapping.credential.verifier]: encoded[mapping.credential.verifier],
+            [mapping.credential.verifierVersion]: encoded[mapping.credential.verifierVersion],
+          };
 
-            let resolved: Resolved | undefined;
-            let verified = false;
+          if (Object.values(values).some((value) => value === undefined))
+            return yield* unavailable();
+          const c = credentialColumns(mapping);
 
-            if (
-              row !== undefined &&
-              row[mapping.attempt.state] === "pending" &&
-              input.outcome === "verified" &&
-              input.captured !== undefined &&
-              deadline !== undefined &&
-              deadline > engineNow
-            ) {
-              resolved = yield* resolveCredential(
-                mapping,
-                input.moduleId,
-                input.captured.identifier,
-                input.captured.revision.subjectId,
-              );
-              verified =
-                input.captured.moduleId === input.moduleId &&
-                resolved?.snapshot !== undefined &&
-                sameSnapshot(resolved.snapshot, input.captured) &&
-                mapping.subjectId.equals(
-                  row[mapping.attempt.subjectId],
-                  resolved.nativeSubjectId,
-                ) &&
-                row[mapping.attempt.identifierNamespace] === input.captured.identifier.namespace &&
-                row[mapping.attempt.identifierValue] === input.captured.identifier.value &&
-                row[mapping.attempt.credentialId] === input.captured.credentialId &&
-                row[mapping.attempt.securityRevision] ===
-                  input.captured.revision.securityRevision &&
-                row[mapping.attempt.credentialRevision] === input.captured.credentialRevision &&
-                row[mapping.attempt.verifierVersion] === input.captured.verifierVersion &&
-                row[mapping.attempt.identifierBindingRevision] ===
-                  input.captured.identifierBindingRevision;
-            }
-            const decision: PasswordAttemptDecision = verified ? "verified" : "rejected";
-            const receipt = prepare(decision, journal);
-
-            if (row === undefined || row[mapping.attempt.state] !== "pending")
-              return { receipt, statements: [] };
-            const marker = `effect-auth-password-guard:settle:${input.attemptId}`;
-
-            const base = and(
-              eq(a.moduleId, input.moduleId),
-              eq(a.attemptId, input.attemptId),
-              eq(a.state, "pending"),
-            )!;
-
-            const condition = verified
-              ? and(base, sql`${a.deadline} > ${mapping.d1.engineNow}`)!
-              : base;
-
-            const statements: Statement<any>[] = [
-              yield* assertion(
-                sql`exists(select 1 from ${mapping.attempt.table} where ${condition})`,
-                marker,
-              ),
+          return {
+            receipt: undefined,
+            statements: [
               yield* statement(
                 database
-                  .update(mapping.attempt.table)
-                  .set(updateValues([[mapping.attempt.state, decision]]))
-                  .where(condition),
-              ),
-            ];
-
-            if (verified && resolved?.snapshot !== undefined) {
-              const captured = input.captured!;
-              const s = subjectColumns(mapping);
-              const i = identifierColumns(mapping);
-              const c = credentialColumns(mapping);
-
-              const authority = and(
-                sql`exists(select 1 from ${mapping.subject.table} where ${s.id} = ${sql.param(resolved.nativeSubjectId, s.id)} and ${s.status} = ${sql.param(mapping.subject.d1ActiveStatusValue, s.status)} and ${s.securityRevision} = ${sql.param(input.captured!.revision.securityRevision, s.securityRevision)})`,
-                mapping.identifier.d1CurrentCondition({
-                  identifier: input.captured!.identifier,
-                  nativeSubjectId: resolved.nativeSubjectId,
-                }),
-                sql`exists(select 1 from ${mapping.credential.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(resolved.nativeSubjectId, c.subjectId)} and ${c.credentialId} = ${sql.param(input.captured!.credentialId, c.credentialId)} and ${c.credentialRevision} = ${sql.param(input.captured!.credentialRevision, c.credentialRevision)} and ${c.verifierVersion} = ${sql.param(input.captured!.verifierVersion, c.verifierVersion)} and ${c.verifier} = ${sql.param(Redacted.value(input.captured!.verifier), c.verifier)})`,
-                sql`exists(select 1 from ${mapping.identifier.table} where ${i.namespace} = ${sql.param(input.captured!.identifier.namespace, i.namespace)} and ${i.value} = ${sql.param(input.captured!.identifier.value, i.value)} and ${i.subjectId} = ${sql.param(resolved.nativeSubjectId, i.subjectId)} and ${i.bindingRevision} = ${sql.param(input.captured!.identifierBindingRevision, i.bindingRevision)})`,
-              )!;
-
-              statements.splice(1, 0, yield* assertion(authority, marker));
-              if (
-                input.rehash !== undefined &&
-                input.rehash.expectedVersion === captured.verifierVersion &&
-                Redacted.value(input.rehash.expectedVerifier) === Redacted.value(captured.verifier)
-              ) {
-                const nextVersion = yield* allocate(
-                  mapping.allocateRevision,
-                  mapping.allocateRevisionSync,
-                );
-
-                statements.push(
-                  yield* statement(
-                    database
-                      .update(mapping.credential.table)
-                      .set(
-                        mapping.credential.encodeVerifier(input.rehash.nextVerifier, nextVersion),
-                      )
-                      .where(
-                        and(
-                          eq(c.moduleId, input.moduleId),
-                          eq(c.subjectId, resolved.nativeSubjectId),
-                          eq(c.credentialId, captured.credentialId),
-                          eq(c.credentialRevision, captured.credentialRevision),
-                          eq(c.verifierVersion, input.rehash.expectedVersion),
-                          eq(c.verifier, Redacted.value(input.rehash.expectedVerifier)),
-                        ),
+                  .update(mapping.credential.table)
+                  .set(values)
+                  .where(
+                    and(
+                      eq(c.moduleId, credential.moduleId),
+                      eq(c.subjectId, nativeId),
+                      eq(c.credentialId, credential.credentialId),
+                      ...(
+                        [
+                          [c.moduleId, credential.moduleId],
+                          [c.subjectId, nativeId],
+                          [c.credentialId, credential.credentialId],
+                          [c.credentialRevision, credential.credentialRevision],
+                          [c.verifierVersion, credential.verifierVersion],
+                          [c.verifier, Redacted.value(credential.verifier)],
+                          [c.normalization, credential.normalization],
+                        ] as const
+                      ).map(([column, value]) =>
+                        typeof value === "string"
+                          ? sql`cast(${column} as blob) = cast(${sql.param(value, column)} as blob)`
+                          : eq(column, value),
                       ),
+                    ),
                   ),
-                );
-              }
-            }
-
-            return {
-              receipt,
-              statements,
-              retryable: (cause: unknown) => isGuardFailure(cause, marker),
-            };
-          }),
-        );
-      }),
+              ),
+            ],
+          };
+        }),
+      ),
     readForSubject: (input: Parameters<PasswordPersistence["Service"]["readForSubject"]>[0]) =>
       Effect.gen(function* () {
         const database = yield* CurrentD1PlanningDatabase;
@@ -1619,10 +1140,14 @@ const makePasswordPlans = (
               nextSecurityRevision,
             });
 
+            if (compiled === undefined)
+              return { receipt: prepare("rejected", journal), statements: [] };
+
             return {
-              receipt: prepare(compiled === undefined ? "rejected" : "changed", journal),
-              statements: compiled?.statements ?? [],
-              ...(compiled?.retryable === undefined ? {} : { retryable: compiled.retryable }),
+              receipt: prepare("changed", journal),
+              statements: compiled.statements,
+              postconditions: [yield* assertion(compiled.appliedCondition, compiled.marker)],
+              retryable: compiled.retryable,
             };
           }),
         );
@@ -1683,15 +1208,6 @@ const makePasswordPlans = (
               "reset-password",
             ),
           ),
-    cleanupAttempts: <A>(
-      input: Parameters<PasswordPersistence["Service"]["cleanupAttempts"]>[0],
-      prepare: PlanPrepare<PasswordPersistence["Service"]["cleanupAttempts"], A>,
-    ) =>
-      run(
-        Effect.gen(function* () {
-          return yield* cleanupPlan(mapping, input, prepare);
-        }),
-      ),
   };
 };
 
@@ -1826,6 +1342,7 @@ const replacementPlan = Effect.fn("Drizzle.replacementPlan")(function* <A>(
     return {
       receipt: passwordReceipt ?? prepare("rejected", journal),
       statements: compiled.statements,
+      ...(compiled.postconditions === undefined ? {} : { postconditions: compiled.postconditions }),
       retryable: (cause: unknown) =>
         isGuardFailure(cause, marker) ||
         isGuardFailure(
@@ -1839,159 +1356,12 @@ const replacementPlan = Effect.fn("Drizzle.replacementPlan")(function* <A>(
     };
   }
 
-  return {
-    receipt: prepare("changed", journal),
-    statements: [
-      ...protectedMutation.statements,
-      yield* assertion(protectedMutation.appliedCondition, marker),
-    ],
-    retryable: (cause: unknown) => isGuardFailure(cause, marker),
-  };
-});
-
-const cleanupPlan = Effect.fn("Drizzle.cleanupPlan")(function* <A>(
-  mapping: Mapping,
-  input: { readonly moduleId: string; readonly limit: number },
-  prepare: PreparePasswordCommit<{ readonly removed: number; readonly hasMore: boolean }, A>,
-) {
-  const database = yield* CurrentD1PlanningDatabase;
-  const journal = yield* CurrentCommitJournal;
-
-  const now = yield* readEngineNowMillis(mapping);
-  const nativeNow = mapping.encodeInstant(now);
-  const a = attemptColumns(mapping);
-  const c = chargeColumns(mapping);
-  const sc = scopeColumns(mapping);
-  let remaining = input.limit;
-  let hasMore = false;
-
-  const attempts = yield* database
-    .select({ attemptId: a.attemptId })
-    .from(mapping.attempt.table)
-    .where(and(eq(a.moduleId, input.moduleId), lte(a.retentionUntil, nativeNow)))
-    .limit(remaining + 1);
-
-  if (attempts.length > remaining) hasMore = true;
-  const selectedAttempts = attempts.slice(0, remaining);
-
-  remaining -= selectedAttempts.length;
-
-  const charges = yield* database
-    .select({
-      action: c.action,
-      scopeKind: c.scopeKind,
-      scopeKey: c.scopeKey,
-      attemptId: c.attemptId,
-    })
-    .from(mapping.charge.table)
-    .where(and(eq(c.moduleId, input.moduleId), lte(c.retentionUntil, nativeNow)))
-    .limit(remaining + 1);
-
-  if (charges.length > remaining) hasMore = true;
-  const selectedCharges = charges.slice(0, remaining);
-
-  remaining -= selectedCharges.length;
-
-  const scopes = yield* database
-    .select({ action: sc.action, scopeKind: sc.scopeKind, scopeKey: sc.scopeKey })
-    .from(mapping.rateScope.table)
-    .where(
-      and(
-        eq(sc.moduleId, input.moduleId),
-        notExists(
-          database
-            .select({ one: sql`1` })
-            .from(mapping.charge.table)
-            .where(
-              and(
-                eq(c.moduleId, sc.moduleId),
-                eq(c.action, sc.action),
-                eq(c.scopeKind, sc.scopeKind),
-                eq(c.scopeKey, sc.scopeKey),
-              ),
-            ),
-        ),
-      ),
-    )
-    .limit(remaining + 1);
-
-  if (scopes.length > remaining) hasMore = true;
-  const selectedScopes = scopes.slice(0, remaining);
-  const marker = `effect-auth-password-guard:cleanup:${input.moduleId}:${now}`;
-  const statements: Statement<any>[] = [];
-
-  for (const row of selectedAttempts) {
-    const condition = and(
-      eq(a.moduleId, input.moduleId),
-      eq(a.attemptId, row.attemptId),
-      lte(a.retentionUntil, mapping.d1.engineNow),
-    )!;
-
-    statements.push(
-      yield* assertion(
-        sql`exists(select 1 from ${mapping.attempt.table} where ${condition})`,
-        marker,
-      ),
-      yield* statement(database.delete(mapping.attempt.table).where(condition)),
-    );
-  }
-  for (const row of selectedCharges) {
-    const condition = and(
-      eq(c.moduleId, input.moduleId),
-      eq(c.action, row.action),
-      eq(c.scopeKind, row.scopeKind),
-      eq(c.scopeKey, row.scopeKey),
-      eq(c.attemptId, row.attemptId),
-      lte(c.retentionUntil, mapping.d1.engineNow),
-    )!;
-
-    statements.push(
-      yield* assertion(
-        sql`exists(select 1 from ${mapping.charge.table} where ${condition})`,
-        marker,
-      ),
-      yield* statement(database.delete(mapping.charge.table).where(condition)),
-    );
-  }
-  for (const row of selectedScopes) {
-    const condition = and(
-      eq(sc.moduleId, input.moduleId),
-      eq(sc.action, row.action),
-      eq(sc.scopeKind, row.scopeKind),
-      eq(sc.scopeKey, row.scopeKey),
-      notExists(
-        database
-          .select({ one: sql`1` })
-          .from(mapping.charge.table)
-          .where(
-            and(
-              eq(c.moduleId, sc.moduleId),
-              eq(c.action, sc.action),
-              eq(c.scopeKind, sc.scopeKind),
-              eq(c.scopeKey, sc.scopeKey),
-            ),
-          ),
-      ),
-    )!;
-
-    statements.push(
-      yield* assertion(
-        sql`exists(select 1 from ${mapping.rateScope.table} where ${condition})`,
-        marker,
-      ),
-      yield* statement(database.delete(mapping.rateScope.table).where(condition)),
-    );
-  }
+  const applied = yield* assertion(protectedMutation.appliedCondition, marker);
 
   return {
-    receipt: prepare(
-      {
-        removed: selectedAttempts.length + selectedCharges.length + selectedScopes.length,
-        hasMore,
-      },
-      journal,
-    ),
-    statements,
+    receipt: prepare("changed", journal),
+    statements: [...protectedMutation.statements, applied],
+    postconditions: [applied],
     retryable: (cause: unknown) => isGuardFailure(cause, marker),
   };
 });
@@ -2001,13 +1371,10 @@ export const makeD1PasswordPersistenceServices = Effect.fnUntraced(function* <
   I extends AnySQLiteTable,
   C extends AnySQLiteTable,
   AC extends AnySQLiteTable,
-  A extends AnySQLiteTable,
-  RS extends AnySQLiteTable,
-  CE extends AnySQLiteTable,
   M extends AnySQLiteTable,
   NativeId,
 >(
-  mapping: D1PasswordPersistenceMapping<S, I, C, AC, A, RS, CE, M, NativeId>,
+  mapping: D1PasswordPersistenceMapping<S, I, C, AC, M, NativeId>,
   proofMapping?: D1ProofPersistenceMapping<
     any,
     any,
@@ -2033,9 +1400,14 @@ export const makeD1PasswordPersistenceServices = Effect.fnUntraced(function* <
   const hooks = yield* LifecycleHooks;
   const plans = makePasswordPlans(mapping as unknown as Mapping, proofMapping);
 
+  const standalone = Effect.gen(function* () {
+    if (yield* hasCommitScope) return yield* unavailable();
+    yield* requireStandalone(unavailable, database.$client.transactionService);
+  });
+
   const run = <Out, Err, Env>(plan: Effect.Effect<Planned<Out>, Err, Env>) =>
     Effect.gen(function* () {
-      if (yield* hasCommitScope) return yield* unavailable();
+      yield* standalone;
 
       return yield* executeStandalone(plan, 2);
     }).pipe(
@@ -2044,10 +1416,13 @@ export const makeD1PasswordPersistenceServices = Effect.fnUntraced(function* <
     );
 
   const service: PasswordPersistence["Service"] = {
-    admitAttempt: (input, prepare) =>
-      run(plans.admitAttempt(input, prepare)).pipe(translateFailure),
-    settleAttempt: (input, prepare) =>
-      run(plans.settleAttempt(input, prepare)).pipe(translateFailure),
+    findCredential: (input) =>
+      standalone.pipe(
+        Effect.andThen(plans.findCredential(input)),
+        Effect.provideService(CurrentD1PlanningDatabase, database),
+        translateFailure,
+      ),
+    rehashIfCurrent: (input) => run(plans.rehashIfCurrent(input)).pipe(translateFailure),
     readForSubject: (input) =>
       plans
         .readForSubject(input)
@@ -2077,8 +1452,6 @@ export const makeD1PasswordPersistenceServices = Effect.fnUntraced(function* <
         ),
     resetWithProof: (input, prepare) =>
       run(plans.resetWithProof(input, prepare)).pipe(translateFailure),
-    cleanupAttempts: (input, prepare) =>
-      run(plans.cleanupAttempts(input, prepare)).pipe(translateFailure),
   };
 
   return { passwordPersistence: service };
@@ -2096,9 +1469,6 @@ export function coordinateD1PasswordPersistence<
   I extends AnySQLiteTable,
   C extends AnySQLiteTable,
   AC extends AnySQLiteTable,
-  At extends AnySQLiteTable,
-  RS extends AnySQLiteTable,
-  CE extends AnySQLiteTable,
   M extends AnySQLiteTable,
   NativeId,
   A,
@@ -2109,7 +1479,7 @@ export function coordinateD1PasswordPersistence<
 >(
   acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,
   options: {
-    readonly mapping: D1PasswordPersistenceMapping<S, I, C, AC, At, RS, CE, M, NativeId>;
+    readonly mapping: D1PasswordPersistenceMapping<S, I, C, AC, M, NativeId>;
     readonly proofMapping?:
       | D1ProofPersistenceMapping<any, any, any, any, any, any, any, any, any, any, any, any>
       | undefined;
@@ -2173,10 +1543,17 @@ export function coordinateD1PasswordPersistence<
               );
 
             const service: PasswordPersistence["Service"] = {
-              admitAttempt: (input, prepare) =>
-                owner.run(run(plans.admitAttempt(input, prepare)).pipe(translateFailure)),
-              settleAttempt: (input, prepare) =>
-                owner.run(run(plans.settleAttempt(input, prepare)).pipe(translateFailure)),
+              findCredential: (input) =>
+                owner.run(
+                  plans
+                    .findCredential(input)
+                    .pipe(
+                      Effect.provideService(CurrentD1PlanningDatabase, database),
+                      translateFailure,
+                    ),
+                ),
+              rehashIfCurrent: (input) =>
+                owner.run(run(plans.rehashIfCurrent(input)).pipe(translateFailure)),
               readForSubject: (input) =>
                 owner.run(
                   plans
@@ -2213,8 +1590,6 @@ export function coordinateD1PasswordPersistence<
                 ),
               resetWithProof: (input, prepare) =>
                 owner.run(run(plans.resetWithProof(input, prepare)).pipe(translateFailure)),
-              cleanupAttempts: (input, prepare) =>
-                owner.run(run(plans.cleanupAttempts(input, prepare)).pipe(translateFailure)),
             };
 
             const provided = Context.make(PasswordPersistence, service).pipe(
@@ -2229,16 +1604,19 @@ export function coordinateD1PasswordPersistence<
               if (status._tag === "Success" || status.failure._tag !== "CommitPending")
                 return yield* unavailable();
             }
-            yield* database.$client.batch(statements).pipe(
-              Effect.catchCause((cause) =>
-                Effect.failCause(
-                  Cause.map(cause, (error) =>
-                    everyFailureMatches(cause, mutation?.retryable) ? unavailable() : error,
+            // Re-assert the password's final state after application statements.
+            yield* database.$client
+              .batch([...statements, ...(mutation?.postconditions ?? [])])
+              .pipe(
+                Effect.catchCause((cause) =>
+                  Effect.failCause(
+                    Cause.map(cause, (error) =>
+                      everyFailureMatches(cause, mutation?.retryable) ? unavailable() : error,
+                    ),
                   ),
                 ),
-              ),
-              translateFailure,
-            );
+                translateFailure,
+              );
 
             return value;
           }),