@yielded/auth-persistence-drizzle 0.1.0-beta.22 → 0.1.0-beta.24

package/dist/drizzle/d1-passwords.mjs

@@ -7,16 +7,15 @@ import { D1BatchStatements } from "./D1BatchStatements.mjs";
 import { CurrentD1PlanningDatabase, makeD1Owner } from "./d1-planning.mjs";
 import { nativeDatabase } from "./native-database.mjs";
 import { compileD1ProofCompletionPlan } from "./d1-proofs.mjs";
-import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
-import { and, count, eq, gte, inArray, lte, notExists, sql } from "drizzle-orm";
+import { NativeDatabase, requireStandalone, samePasswordCredentialSnapshot } from "@yielded/auth-persistence/Adapter";
+import { and, eq, getTableColumns, inArray, sql } from "drizzle-orm";
 import { Cause, Context, DateTime, Effect, Option, Predicate, Redacted, Schema } from "effect";
 import { CurrentCommitJournal, HookConfigurationError, LifecycleHooks, coordinateCommit, hasCommitScope } from "@yielded/auth/Hooks";
 import { AuthenticationEvidence, AuthenticationRequirement, snapshotAuthenticationEvidence } from "@yielded/auth/Sessions";
 import { reportPersistenceFailure } from "@yielded/auth/Persistence";
 import { ProofUnavailable } from "@yielded/auth/Proofs";
-import { PasswordPersistence, PasswordUnavailable, snapshotPasswordCredential, snapshotPasswordRequirement, snapshotPasswordRevision } from "@yielded/auth/Password";
+import { EncodedPasswordHash, PasswordPersistence, PasswordUnavailable, snapshotPasswordCredential, snapshotPasswordRequirement, snapshotPasswordRevision } from "@yielded/auth/Password";
 //#region src/drizzle/d1-passwords.ts
-const mapAdapter = (effect) => effect;
 const unavailable = () => PasswordUnavailable.make({});
 const everyFailureMatches = (cause, classify) => classify !== void 0 && cause.reasons.length > 0 && cause.reasons.every((reason) => Cause.isFailReason(reason) && classify(Cause.fail(reason.error)));
 const validConstraints = (mapping) => Object.entries(requiredPasswordConstraints).every(([key, value]) => mapping.constraints[key] === value);
@@ -61,10 +60,6 @@ const readEngineNowMillis = Effect.fn("Drizzle.readEngineNowMillis")(function* (
 		return Number.isFinite(value) ? Effect.succeed(value) : Effect.fail(unavailable());
 	}));
 });
-const driverValues = (values, entries) => ({
-	...values,
-	...Object.fromEntries(entries)
-});
 const allocate = (asyncValue, syncValue) => asyncValue !== void 0 ? asyncValue : syncValue === void 0 ? Effect.fail(unavailable()) : Effect.try({
 	try: syncValue,
 	catch: (cause) => new PersistenceMappingError$1({
@@ -100,38 +95,6 @@ const authorityColumns = (mapping) => ({
 	revision: column(mapping.authorityCredential.table, mapping.authorityCredential.revision),
 	status: mapping.authorityCredential.status === void 0 ? void 0 : column(mapping.authorityCredential.table, mapping.authorityCredential.status)
 });
-const attemptColumns = (mapping) => ({
-	moduleId: column(mapping.attempt.table, mapping.attempt.moduleId),
-	action: column(mapping.attempt.table, mapping.attempt.action),
-	attemptId: column(mapping.attempt.table, mapping.attempt.attemptId),
-	identifierNamespace: column(mapping.attempt.table, mapping.attempt.identifierNamespace),
-	identifierValue: column(mapping.attempt.table, mapping.attempt.identifierValue),
-	subjectId: column(mapping.attempt.table, mapping.attempt.subjectId),
-	credentialId: column(mapping.attempt.table, mapping.attempt.credentialId),
-	securityRevision: column(mapping.attempt.table, mapping.attempt.securityRevision),
-	credentialRevision: column(mapping.attempt.table, mapping.attempt.credentialRevision),
-	verifierVersion: column(mapping.attempt.table, mapping.attempt.verifierVersion),
-	identifierBindingRevision: column(mapping.attempt.table, mapping.attempt.identifierBindingRevision),
-	admittedAt: column(mapping.attempt.table, mapping.attempt.admittedAt),
-	deadline: column(mapping.attempt.table, mapping.attempt.deadline),
-	retentionUntil: column(mapping.attempt.table, mapping.attempt.retentionUntil),
-	state: column(mapping.attempt.table, mapping.attempt.state)
-});
-const scopeColumns = (mapping) => ({
-	moduleId: column(mapping.rateScope.table, mapping.rateScope.moduleId),
-	action: column(mapping.rateScope.table, mapping.rateScope.action),
-	scopeKind: column(mapping.rateScope.table, mapping.rateScope.scopeKind),
-	scopeKey: column(mapping.rateScope.table, mapping.rateScope.scopeKey)
-});
-const chargeColumns = (mapping) => ({
-	moduleId: column(mapping.charge.table, mapping.charge.moduleId),
-	action: column(mapping.charge.table, mapping.charge.action),
-	scopeKind: column(mapping.charge.table, mapping.charge.scopeKind),
-	scopeKey: column(mapping.charge.table, mapping.charge.scopeKey),
-	attemptId: column(mapping.charge.table, mapping.charge.attemptId),
-	occurredAt: column(mapping.charge.table, mapping.charge.occurredAt),
-	retentionUntil: column(mapping.charge.table, mapping.charge.retentionUntil)
-});
 const commandColumns = (mapping) => ({
 	moduleId: column(mapping.command.table, mapping.command.moduleId),
 	commandId: column(mapping.command.table, mapping.command.commandId),
@@ -180,45 +143,6 @@ const resolveCredential = Effect.fn("DrizzleD1Password.resolveCredential")(funct
 		}).pipe(Effect.flatMap(snapshotPasswordCredential))
 	};
 });
-const scopeEntries = (keys, policy) => {
-	const entries = [{
-		kind: "action",
-		key: keys.action,
-		...policy.action
-	}, {
-		kind: "identifier",
-		key: keys.identifier,
-		...policy.identifier
-	}];
-	if (keys.subject !== void 0) entries.push({
-		kind: "subject",
-		key: keys.subject,
-		...policy.subject
-	});
-	return entries;
-};
-const livePendingAttempts = (mapping, moduleId, action, entry, identifier, nativeSubjectId, activeAt) => {
-	const a = attemptColumns(mapping);
-	return and(entry.kind === "action" ? and(eq(a.moduleId, moduleId), eq(a.action, action)) : entry.kind === "identifier" ? and(eq(a.moduleId, moduleId), eq(a.action, action), eq(a.identifierNamespace, identifier.namespace), eq(a.identifierValue, identifier.value)) : and(eq(a.moduleId, moduleId), eq(a.action, action), eq(a.subjectId, nativeSubjectId)), eq(a.state, "pending"), sql`${a.retentionUntil} > ${activeAt}`);
-};
-const scopeAdmissionCondition = (mapping, moduleId, action, entry, policy, identifier, nativeSubjectId) => {
-	const c = chargeColumns(mapping);
-	const pending = livePendingAttempts(mapping, moduleId, action, entry, identifier, nativeSubjectId, mapping.d1.engineNow);
-	return sql`(select count(*) from ${mapping.charge.table} where ${c.moduleId} = ${sql.param(moduleId, c.moduleId)} and ${c.action} = ${sql.param(action, c.action)} and ${c.scopeKind} = ${sql.param(entry.kind, c.scopeKind)} and ${c.scopeKey} = ${sql.param(entry.key, c.scopeKey)} and ${c.occurredAt} >= ${mapping.d1.engineInstantMinus(entry.windowMillis)}) < ${entry.limit} and (select count(*) from ${mapping.attempt.table} where ${pending}) < ${policy.maximumPending}`;
-};
-const readScopeAdmission = Effect.fn("DrizzleD1Password.readScopeAdmission")(function* (mapping, moduleId, action, entries, policy, identifier, nativeSubjectId, now) {
-	const database = yield* CurrentD1PlanningDatabase;
-	const c = chargeColumns(mapping);
-	const admitted = [];
-	for (let index = 0; index < entries.length; index++) {
-		const entry = entries[index];
-		const chargeRows = yield* mapAdapter(database.select({ total: count() }).from(mapping.charge.table).where(and(eq(c.moduleId, moduleId), eq(c.action, action), eq(c.scopeKind, entry.kind), eq(c.scopeKey, entry.key), gte(c.occurredAt, mapping.encodeInstant(now - entry.windowMillis)))));
-		const pendingRows = yield* mapAdapter(database.select({ total: count() }).from(mapping.attempt.table).where(livePendingAttempts(mapping, moduleId, action, entry, identifier, nativeSubjectId, mapping.encodeInstant(now))));
-		if (Number(chargeRows[0]?.total ?? 0) < entry.limit && Number(pendingRows[0]?.total ?? 0) < policy.maximumPending) admitted.push(entry);
-		else if (index === 0) break;
-	}
-	return admitted;
-});
 const evidenceProofsJson = Schema.encodeSync(Schema.fromJsonString(AuthenticationEvidence.fields.proofs));
 const alternativesJson = Schema.encodeSync(Schema.fromJsonString(AuthenticationRequirement.fields.alternatives));
 const assuranceCondition = (mapping, evidence, requirement) => {
@@ -233,7 +157,6 @@ const assuranceCondition = (mapping, evidence, requirement) => {
   )`;
 };
 const sameIdentifier = (left, right) => left.namespace === right.namespace && left.value === right.value;
-const sameSnapshot = (left, right) => left.moduleId === right.moduleId && left.revision.subjectId === right.revision.subjectId && left.revision.securityRevision === right.revision.securityRevision && left.credentialId === right.credentialId && left.credentialRevision === right.credentialRevision && left.verifierVersion === right.verifierVersion && left.normalization === right.normalization && left.identifierVerifiedAtMillis === right.identifierVerifiedAtMillis && left.revision.credentials.length === right.revision.credentials.length && left.revision.credentials.every((entry) => right.revision.credentials.some((other) => other.credentialId === entry.credentialId && other.revision === entry.revision)) && left.identifierBindingRevision === right.identifierBindingRevision && sameIdentifier(left.identifier, right.identifier) && Redacted.value(left.verifier) === Redacted.value(right.verifier);
 const evidenceSatisfiedAt = (evidence, requirement, now) => {
 	if (evidence.proofs.length > 64 || evidence.revision.credentials.length > 64) return false;
 	const revisions = /* @__PURE__ */ new Map();
@@ -325,7 +248,7 @@ const readAuthority = Effect.fn("DrizzleD1Password.readAuthority")(function* (ma
 			identifier,
 			credential
 		});
-		if (!sameSnapshot(snapshot, input.credential)) return void 0;
+		if (!samePasswordCredentialSnapshot(snapshot, input.credential)) return void 0;
 		identifierCondition = identifierCurrentCondition(mapping, input, nativeSubjectId, identifier[mapping.identifier.verifiedAt]);
 		const ic = identifierColumns(mapping);
 		identifierCondition = and(identifierCondition, sql`exists(select 1 from ${mapping.identifier.table} where ${ic.namespace} = ${sql.param(input.credential.identifier.namespace, ic.namespace)} and ${ic.value} = ${sql.param(input.credential.identifier.value, ic.value)} and ${ic.subjectId} = ${sql.param(nativeSubjectId, ic.subjectId)} and ${ic.bindingRevision} = ${sql.param(input.credential.identifierBindingRevision, ic.bindingRevision)})`);
@@ -356,18 +279,6 @@ const credentialCurrentCondition = (mapping, input, nativeSubjectId) => {
 	const c = credentialColumns(mapping);
 	return input.credential === void 0 ? sql`false` : sql`exists(select 1 from ${mapping.credential.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(nativeSubjectId, c.subjectId)} and ${c.credentialId} = ${sql.param(input.credential.credentialId, c.credentialId)} and ${c.credentialRevision} = ${sql.param(input.credential.credentialRevision, c.credentialRevision)} and ${c.verifierVersion} = ${sql.param(input.credential.verifierVersion, c.verifierVersion)} and ${c.verifier} = ${sql.param(Redacted.value(input.credential.verifier), c.verifier)} and ${c.normalization} = ${sql.param(input.credential.normalization, c.normalization)})`;
 };
-const admittedSnapshotCondition = (mapping, resolved, moduleId) => {
-	const snapshot = resolved?.snapshot;
-	if (snapshot === void 0 || resolved === void 0) return sql`true`;
-	const s = subjectColumns(mapping);
-	const i = identifierColumns(mapping);
-	const c = credentialColumns(mapping);
-	const ac = authorityColumns(mapping);
-	return and(sql`exists(select 1 from ${mapping.subject.table} where ${s.id} = ${sql.param(resolved.nativeSubjectId, s.id)} and ${s.status} = ${sql.param(mapping.subject.d1ActiveStatusValue, s.status)} and ${s.securityRevision} = ${sql.param(snapshot.revision.securityRevision, s.securityRevision)})`, mapping.identifier.d1CurrentCondition({
-		identifier: snapshot.identifier,
-		nativeSubjectId: resolved.nativeSubjectId
-	}), sql`exists(select 1 from ${mapping.identifier.table} where ${i.namespace} = ${sql.param(snapshot.identifier.namespace, i.namespace)} and ${i.value} = ${sql.param(snapshot.identifier.value, i.value)} and ${i.subjectId} = ${sql.param(resolved.nativeSubjectId, i.subjectId)} and ${i.bindingRevision} = ${sql.param(snapshot.identifierBindingRevision, i.bindingRevision)})`, sql`exists(select 1 from ${mapping.credential.table} where ${c.moduleId} = ${sql.param(moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(resolved.nativeSubjectId, c.subjectId)} and ${c.credentialId} = ${sql.param(snapshot.credentialId, c.credentialId)} and ${c.credentialRevision} = ${sql.param(snapshot.credentialRevision, c.credentialRevision)} and ${c.verifierVersion} = ${sql.param(snapshot.verifierVersion, c.verifierVersion)} and ${c.verifier} = ${sql.param(Redacted.value(snapshot.verifier), c.verifier)} and ${c.normalization} = ${sql.param(snapshot.normalization, c.normalization)})`, ...snapshot.revision.credentials.map((item) => sql`exists(select 1 from ${mapping.authorityCredential.table} where ${ac.subjectId} = ${sql.param(resolved.nativeSubjectId, ac.subjectId)} and ${ac.credentialId} = ${sql.param(item.credentialId, ac.credentialId)} and ${ac.revision} = ${sql.param(item.revision, ac.revision)}${ac.status === void 0 ? sql`` : sql` and ${ac.status} = ${sql.param(mapping.authorityCredential.d1ActiveStatusValue, ac.status)}`})`));
-};
 const mutationStatements = Effect.fn(function* (mapping, input, nativeSubjectId, revisions, now) {
 	const database = yield* CurrentD1PlanningDatabase;
 	const c = credentialColumns(mapping);
@@ -440,6 +351,7 @@ const compileAddMutation = Effect.fn("DrizzleD1Password.compileAddMutation")(fun
 			yield* assertion(appliedCondition, marker)
 		],
 		appliedCondition,
+		marker,
 		retryable: (cause) => isGuardFailure(cause, marker)
 	};
 });
@@ -449,136 +361,58 @@ const makePasswordPlans = (mapping, proofMapping) => {
 		return yield* plan;
 	});
 	return {
-		admitAttempt: (input, prepare) => Effect.gen(function* () {
-			const database = yield* CurrentD1PlanningDatabase;
-			const attemptId = yield* allocate(mapping.allocateAttemptId, mapping.allocateAttemptIdSync);
-			return yield* run(Effect.gen(function* () {
-				const journal = yield* CurrentCommitJournal;
-				const now = yield* readEngineNowMillis(mapping);
-				const resolved = yield* resolveCredential(mapping, input.moduleId, input.identifier, input.subjectId);
-				const keys = mapping.scopeKeys({
-					moduleId: input.moduleId,
-					action: input.action,
-					identifier: input.identifier,
-					...resolved?.snapshot === void 0 ? {} : { subjectId: resolved.snapshot.revision.subjectId }
-				});
-				const scopes = scopeEntries(keys, input.policy);
-				const admitted = yield* readScopeAdmission(mapping, input.moduleId, input.action, scopes, input.policy, input.identifier, resolved?.nativeSubjectId, now);
-				const allAdmitted = admitted.length === scopes.length;
-				const considered = admitted.length === 0 ? scopes.slice(0, 1) : scopes;
-				const receipt = prepare(allAdmitted ? {
-					_tag: "Admitted",
-					attemptId,
-					...resolved?.snapshot === void 0 ? {} : { credential: resolved.snapshot }
-				} : { _tag: "Denied" }, journal);
-				const marker = `effect-auth-password-guard:admit:${attemptId}`;
-				const statements = [];
-				for (const entry of considered) statements.push(yield* statement(database.insert(mapping.rateScope.table).values(mapping.rateScope.encodeInsert({
-					moduleId: input.moduleId,
-					action: input.action,
-					scopeKind: entry.kind,
-					scopeKey: entry.key
-				})).onConflictDoNothing()));
-				const conditions = considered.map((entry) => {
-					const condition = scopeAdmissionCondition(mapping, input.moduleId, input.action, entry, input.policy, input.identifier, resolved?.nativeSubjectId);
-					return admitted.includes(entry) ? condition : sql`not (${condition})`;
-				});
-				statements.push(yield* assertion(and(...conditions, ...allAdmitted ? [admittedSnapshotCondition(mapping, resolved, input.moduleId)] : []), marker));
-				for (const entry of admitted) statements.push(yield* statement(database.insert(mapping.charge.table).values(driverValues(mapping.charge.encodeInsert({
-					moduleId: input.moduleId,
-					action: input.action,
-					scopeKind: entry.kind,
-					scopeKey: entry.key,
-					attemptId,
-					occurredAtMillis: now,
-					retentionUntilMillis: now + entry.windowMillis
-				}), [[mapping.charge.occurredAt, mapping.d1.engineNow], [mapping.charge.retentionUntil, mapping.d1.engineInstantPlus(entry.windowMillis)]]))));
-				if (allAdmitted) {
-					const snapshot = resolved?.snapshot;
-					const record = {
-						moduleId: input.moduleId,
-						action: input.action,
-						attemptId,
-						identifier: input.identifier,
-						...snapshot === void 0 ? {} : {
-							subjectId: snapshot.revision.subjectId,
-							credentialId: snapshot.credentialId,
-							securityRevision: snapshot.revision.securityRevision,
-							credentialRevision: snapshot.credentialRevision,
-							verifierVersion: snapshot.verifierVersion,
-							identifierBindingRevision: snapshot.identifierBindingRevision
-						},
-						admittedAtMillis: now,
-						deadlineMillis: now + input.policy.attemptLifetimeMillis,
-						retentionUntilMillis: Math.max(now + input.policy.attemptLifetimeMillis, ...scopes.map((entry) => now + entry.windowMillis))
-					};
-					statements.push(yield* statement(database.insert(mapping.attempt.table).values(driverValues(mapping.attempt.encodeInsert(record, {
-						...resolved?.nativeSubjectId === void 0 ? {} : { nativeSubjectId: resolved.nativeSubjectId },
-						state: "pending"
-					}), [
-						[mapping.attempt.admittedAt, mapping.d1.engineNow],
-						[mapping.attempt.deadline, mapping.d1.engineInstantPlus(input.policy.attemptLifetimeMillis)],
-						[mapping.attempt.retentionUntil, mapping.d1.engineInstantPlus(Math.max(input.policy.attemptLifetimeMillis, ...scopes.map((entry) => entry.windowMillis)))]
-					]))));
-				}
-				return {
-					receipt,
-					statements,
-					retryable: (cause) => isGuardFailure(cause, marker)
-				};
-			}));
-		}),
-		settleAttempt: (uncaptured, prepare) => Effect.gen(function* () {
-			const database = yield* CurrentD1PlanningDatabase;
-			const captured = uncaptured.captured === void 0 ? void 0 : yield* snapshotPasswordCredential(uncaptured.captured);
+		findCredential: (uncaptured) => Effect.gen(function* () {
+			if (!validConstraints(mapping)) return yield* unavailable();
 			const input = {
 				...uncaptured,
-				...captured === void 0 ? {} : { captured }
+				identifier: { ...uncaptured.identifier }
 			};
-			return yield* run(Effect.gen(function* () {
-				const journal = yield* CurrentCommitJournal;
-				const a = attemptColumns(mapping);
-				const row = (yield* database.select().from(mapping.attempt.table).where(and(eq(a.moduleId, input.moduleId), eq(a.attemptId, input.attemptId))).limit(1))[0];
-				const engineNow = yield* readEngineNowMillis(mapping);
-				const deadline = row === void 0 ? void 0 : yield* mapping.decodeInstant(row[mapping.attempt.deadline]);
-				let resolved;
-				let verified = false;
-				if (row !== void 0 && row[mapping.attempt.state] === "pending" && input.outcome === "verified" && input.captured !== void 0 && deadline !== void 0 && deadline > engineNow) {
-					resolved = yield* resolveCredential(mapping, input.moduleId, input.captured.identifier, input.captured.revision.subjectId);
-					verified = input.captured.moduleId === input.moduleId && resolved?.snapshot !== void 0 && sameSnapshot(resolved.snapshot, input.captured) && mapping.subjectId.equals(row[mapping.attempt.subjectId], resolved.nativeSubjectId) && row[mapping.attempt.identifierNamespace] === input.captured.identifier.namespace && row[mapping.attempt.identifierValue] === input.captured.identifier.value && row[mapping.attempt.credentialId] === input.captured.credentialId && row[mapping.attempt.securityRevision] === input.captured.revision.securityRevision && row[mapping.attempt.credentialRevision] === input.captured.credentialRevision && row[mapping.attempt.verifierVersion] === input.captured.verifierVersion && row[mapping.attempt.identifierBindingRevision] === input.captured.identifierBindingRevision;
-				}
-				const decision = verified ? "verified" : "rejected";
-				const receipt = prepare(decision, journal);
-				if (row === void 0 || row[mapping.attempt.state] !== "pending") return {
-					receipt,
-					statements: []
-				};
-				const marker = `effect-auth-password-guard:settle:${input.attemptId}`;
-				const base = and(eq(a.moduleId, input.moduleId), eq(a.attemptId, input.attemptId), eq(a.state, "pending"));
-				const condition = verified ? and(base, sql`${a.deadline} > ${mapping.d1.engineNow}`) : base;
-				const statements = [yield* assertion(sql`exists(select 1 from ${mapping.attempt.table} where ${condition})`, marker), yield* statement(database.update(mapping.attempt.table).set(updateValues([[mapping.attempt.state, decision]])).where(condition))];
-				if (verified && resolved?.snapshot !== void 0) {
-					const captured = input.captured;
-					const s = subjectColumns(mapping);
-					const i = identifierColumns(mapping);
-					const c = credentialColumns(mapping);
-					const authority = and(sql`exists(select 1 from ${mapping.subject.table} where ${s.id} = ${sql.param(resolved.nativeSubjectId, s.id)} and ${s.status} = ${sql.param(mapping.subject.d1ActiveStatusValue, s.status)} and ${s.securityRevision} = ${sql.param(input.captured.revision.securityRevision, s.securityRevision)})`, mapping.identifier.d1CurrentCondition({
-						identifier: input.captured.identifier,
-						nativeSubjectId: resolved.nativeSubjectId
-					}), sql`exists(select 1 from ${mapping.credential.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(resolved.nativeSubjectId, c.subjectId)} and ${c.credentialId} = ${sql.param(input.captured.credentialId, c.credentialId)} and ${c.credentialRevision} = ${sql.param(input.captured.credentialRevision, c.credentialRevision)} and ${c.verifierVersion} = ${sql.param(input.captured.verifierVersion, c.verifierVersion)} and ${c.verifier} = ${sql.param(Redacted.value(input.captured.verifier), c.verifier)})`, sql`exists(select 1 from ${mapping.identifier.table} where ${i.namespace} = ${sql.param(input.captured.identifier.namespace, i.namespace)} and ${i.value} = ${sql.param(input.captured.identifier.value, i.value)} and ${i.subjectId} = ${sql.param(resolved.nativeSubjectId, i.subjectId)} and ${i.bindingRevision} = ${sql.param(input.captured.identifierBindingRevision, i.bindingRevision)})`);
-					statements.splice(1, 0, yield* assertion(authority, marker));
-					if (input.rehash !== void 0 && input.rehash.expectedVersion === captured.verifierVersion && Redacted.value(input.rehash.expectedVerifier) === Redacted.value(captured.verifier)) {
-						const nextVersion = yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync);
-						statements.push(yield* statement(database.update(mapping.credential.table).set(mapping.credential.encodeVerifier(input.rehash.nextVerifier, nextVersion)).where(and(eq(c.moduleId, input.moduleId), eq(c.subjectId, resolved.nativeSubjectId), eq(c.credentialId, captured.credentialId), eq(c.credentialRevision, captured.credentialRevision), eq(c.verifierVersion, input.rehash.expectedVersion), eq(c.verifier, Redacted.value(input.rehash.expectedVerifier))))));
-					}
-				}
-				return {
-					receipt,
-					statements,
-					retryable: (cause) => isGuardFailure(cause, marker)
-				};
-			}));
+			const database = yield* CurrentD1PlanningDatabase;
+			const identifierRow = (yield* readIdentifier(mapping, input.identifier))[0];
+			if (identifierRow === void 0 || !mapping.identifier.isCurrent(identifierRow)) return Option.none();
+			const nativeId = identifierRow[mapping.identifier.subjectId];
+			const sc = subjectColumns(mapping), ic = identifierColumns(mapping), cc = credentialColumns(mapping);
+			const rows = yield* database.select({
+				subject: getTableColumns(mapping.subject.table),
+				identifier: getTableColumns(mapping.identifier.table),
+				credential: getTableColumns(mapping.credential.table)
+			}).from(mapping.subject.table).innerJoin(mapping.identifier.table, and(eq(ic.namespace, input.identifier.namespace), eq(ic.value, input.identifier.value), eq(ic.subjectId, nativeId))).innerJoin(mapping.credential.table, and(eq(cc.moduleId, input.moduleId), eq(cc.subjectId, nativeId))).where(eq(sc.id, nativeId));
+			if (rows.length !== 1) return Option.none();
+			const row = rows[0];
+			if (!mapping.subject.isActiveStatus(row.subject[mapping.subject.status]) || !mapping.identifier.isCurrent(row.identifier) || !mapping.subjectId.equals(nativeId, row.subject[mapping.subject.id]) || !mapping.subjectId.equals(nativeId, row.identifier[mapping.identifier.subjectId]) || !mapping.subjectId.equals(nativeId, row.credential[mapping.credential.subjectId])) return Option.none();
+			const credential = yield* mapping.credential.decode({
+				moduleId: input.moduleId,
+				...row
+			}).pipe(Effect.flatMap(snapshotPasswordCredential));
+			return input.subjectId !== void 0 && credential.revision.subjectId !== input.subjectId ? Option.none() : Option.some(credential);
 		}),
+		rehashIfCurrent: (input) => run(Effect.gen(function* () {
+			const nextVerifier = Redacted.make(yield* Schema.decodeEffect(EncodedPasswordHash)(Redacted.value(input.nextVerifier)));
+			const credential = yield* snapshotPasswordCredential(input.credential);
+			const database = yield* CurrentD1PlanningDatabase;
+			const nativeId = yield* mapping.subjectId.toNative(credential.revision.subjectId);
+			const version = yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync);
+			if (version === credential.verifierVersion) return yield* unavailable();
+			const encoded = mapping.credential.encodeVerifier(nextVerifier, version);
+			const values = {
+				[mapping.credential.verifier]: encoded[mapping.credential.verifier],
+				[mapping.credential.verifierVersion]: encoded[mapping.credential.verifierVersion]
+			};
+			if (Object.values(values).some((value) => value === void 0)) return yield* unavailable();
+			const c = credentialColumns(mapping);
+			return {
+				receipt: void 0,
+				statements: [yield* statement(database.update(mapping.credential.table).set(values).where(and(eq(c.moduleId, credential.moduleId), eq(c.subjectId, nativeId), eq(c.credentialId, credential.credentialId), ...[
+					[c.moduleId, credential.moduleId],
+					[c.subjectId, nativeId],
+					[c.credentialId, credential.credentialId],
+					[c.credentialRevision, credential.credentialRevision],
+					[c.verifierVersion, credential.verifierVersion],
+					[c.verifier, Redacted.value(credential.verifier)],
+					[c.normalization, credential.normalization]
+				].map(([column, value]) => typeof value === "string" ? sql`cast(${column} as blob) = cast(${sql.param(value, column)} as blob)` : eq(column, value)))))]
+			};
+		})),
 		readForSubject: (input) => Effect.gen(function* () {
 			const database = yield* CurrentD1PlanningDatabase;
 			if (yield* hasCommitScope) return yield* unavailable();
@@ -617,10 +451,15 @@ const makePasswordPlans = (mapping, proofMapping) => {
 					verifierVersion,
 					nextSecurityRevision
 				});
+				if (compiled === void 0) return {
+					receipt: prepare("rejected", journal),
+					statements: []
+				};
 				return {
-					receipt: prepare(compiled === void 0 ? "rejected" : "changed", journal),
-					statements: compiled?.statements ?? [],
-					...compiled?.retryable === void 0 ? {} : { retryable: compiled.retryable }
+					receipt: prepare("changed", journal),
+					statements: compiled.statements,
+					postconditions: [yield* assertion(compiled.appliedCondition, compiled.marker)],
+					retryable: compiled.retryable
 				};
 			}));
 		}),
@@ -635,10 +474,7 @@ const makePasswordPlans = (mapping, proofMapping) => {
 		resetWithProof: (uncaptured, prepare) => proofMapping === void 0 ? Effect.fail(unavailable()) : Effect.flatMap(snapshotMutationInput(uncaptured), (captured) => replacementPlan(mapping, proofMapping, Object.freeze({
 			...captured,
 			completion: uncaptured.completion
-		}), prepare, "reset-password")),
-		cleanupAttempts: (input, prepare) => run(Effect.gen(function* () {
-			return yield* cleanupPlan(mapping, input, prepare);
-		}))
+		}), prepare, "reset-password"))
 	};
 };
 const compileReplacementMutation = Effect.fn("DrizzleD1Password.compileReplacementMutation")(function* (mapping, input, action, revisions) {
@@ -695,65 +531,15 @@ const replacementPlan = Effect.fn("Drizzle.replacementPlan")(function* (mapping,
 		return {
 			receipt: passwordReceipt ?? prepare("rejected", journal),
 			statements: compiled.statements,
+			...compiled.postconditions === void 0 ? {} : { postconditions: compiled.postconditions },
 			retryable: (cause) => isGuardFailure(cause, marker) || isGuardFailure(cause, `effect-auth-proof-guard:complete:${input.completion.input.continuationId}`) || isGuardFailure(cause, `effect-auth-proof-guard:protected:${input.completion.input.continuationId}`)
 		};
 	}
+	const applied = yield* assertion(protectedMutation.appliedCondition, marker);
 	return {
 		receipt: prepare("changed", journal),
-		statements: [...protectedMutation.statements, yield* assertion(protectedMutation.appliedCondition, marker)],
-		retryable: (cause) => isGuardFailure(cause, marker)
-	};
-});
-const cleanupPlan = Effect.fn("Drizzle.cleanupPlan")(function* (mapping, input, prepare) {
-	const database = yield* CurrentD1PlanningDatabase;
-	const journal = yield* CurrentCommitJournal;
-	const now = yield* readEngineNowMillis(mapping);
-	const nativeNow = mapping.encodeInstant(now);
-	const a = attemptColumns(mapping);
-	const c = chargeColumns(mapping);
-	const sc = scopeColumns(mapping);
-	let remaining = input.limit;
-	let hasMore = false;
-	const attempts = yield* database.select({ attemptId: a.attemptId }).from(mapping.attempt.table).where(and(eq(a.moduleId, input.moduleId), lte(a.retentionUntil, nativeNow))).limit(remaining + 1);
-	if (attempts.length > remaining) hasMore = true;
-	const selectedAttempts = attempts.slice(0, remaining);
-	remaining -= selectedAttempts.length;
-	const charges = yield* database.select({
-		action: c.action,
-		scopeKind: c.scopeKind,
-		scopeKey: c.scopeKey,
-		attemptId: c.attemptId
-	}).from(mapping.charge.table).where(and(eq(c.moduleId, input.moduleId), lte(c.retentionUntil, nativeNow))).limit(remaining + 1);
-	if (charges.length > remaining) hasMore = true;
-	const selectedCharges = charges.slice(0, remaining);
-	remaining -= selectedCharges.length;
-	const scopes = yield* database.select({
-		action: sc.action,
-		scopeKind: sc.scopeKind,
-		scopeKey: sc.scopeKey
-	}).from(mapping.rateScope.table).where(and(eq(sc.moduleId, input.moduleId), notExists(database.select({ one: sql`1` }).from(mapping.charge.table).where(and(eq(c.moduleId, sc.moduleId), eq(c.action, sc.action), eq(c.scopeKind, sc.scopeKind), eq(c.scopeKey, sc.scopeKey)))))).limit(remaining + 1);
-	if (scopes.length > remaining) hasMore = true;
-	const selectedScopes = scopes.slice(0, remaining);
-	const marker = `effect-auth-password-guard:cleanup:${input.moduleId}:${now}`;
-	const statements = [];
-	for (const row of selectedAttempts) {
-		const condition = and(eq(a.moduleId, input.moduleId), eq(a.attemptId, row.attemptId), lte(a.retentionUntil, mapping.d1.engineNow));
-		statements.push(yield* assertion(sql`exists(select 1 from ${mapping.attempt.table} where ${condition})`, marker), yield* statement(database.delete(mapping.attempt.table).where(condition)));
-	}
-	for (const row of selectedCharges) {
-		const condition = and(eq(c.moduleId, input.moduleId), eq(c.action, row.action), eq(c.scopeKind, row.scopeKind), eq(c.scopeKey, row.scopeKey), eq(c.attemptId, row.attemptId), lte(c.retentionUntil, mapping.d1.engineNow));
-		statements.push(yield* assertion(sql`exists(select 1 from ${mapping.charge.table} where ${condition})`, marker), yield* statement(database.delete(mapping.charge.table).where(condition)));
-	}
-	for (const row of selectedScopes) {
-		const condition = and(eq(sc.moduleId, input.moduleId), eq(sc.action, row.action), eq(sc.scopeKind, row.scopeKind), eq(sc.scopeKey, row.scopeKey), notExists(database.select({ one: sql`1` }).from(mapping.charge.table).where(and(eq(c.moduleId, sc.moduleId), eq(c.action, sc.action), eq(c.scopeKind, sc.scopeKind), eq(c.scopeKey, sc.scopeKey)))));
-		statements.push(yield* assertion(sql`exists(select 1 from ${mapping.rateScope.table} where ${condition})`, marker), yield* statement(database.delete(mapping.rateScope.table).where(condition)));
-	}
-	return {
-		receipt: prepare({
-			removed: selectedAttempts.length + selectedCharges.length + selectedScopes.length,
-			hasMore
-		}, journal),
-		statements,
+		statements: [...protectedMutation.statements, applied],
+		postconditions: [applied],
 		retryable: (cause) => isGuardFailure(cause, marker)
 	};
 });
@@ -765,20 +551,23 @@ const makeD1PasswordPersistenceServices = Effect.fnUntraced(function* (mapping,
 	}).pipe(Effect.provideServiceEffect(NativeDatabase, nativeDatabase(Database)), Effect.mapError(unavailable));
 	const hooks = yield* LifecycleHooks;
 	const plans = makePasswordPlans(mapping, proofMapping);
-	const run = (plan) => Effect.gen(function* () {
+	const standalone = Effect.gen(function* () {
 		if (yield* hasCommitScope) return yield* unavailable();
+		yield* requireStandalone(unavailable, database.$client.transactionService);
+	});
+	const run = (plan) => Effect.gen(function* () {
+		yield* standalone;
 		return yield* executeStandalone(plan, 2);
 	}).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks));
 	return { passwordPersistence: {
-		admitAttempt: (input, prepare) => run(plans.admitAttempt(input, prepare)).pipe(translateFailure),
-		settleAttempt: (input, prepare) => run(plans.settleAttempt(input, prepare)).pipe(translateFailure),
+		findCredential: (input) => standalone.pipe(Effect.andThen(plans.findCredential(input)), Effect.provideService(CurrentD1PlanningDatabase, database), translateFailure),
+		rehashIfCurrent: (input) => run(plans.rehashIfCurrent(input)).pipe(translateFailure),
 		readForSubject: (input) => plans.readForSubject(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
 		recoveryTarget: (input) => plans.recoveryTarget(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
 		addIfAbsent: (input, prepare) => run(plans.addIfAbsent(input, prepare)).pipe(translateFailure),
 		replaceIfCurrent: (input, prepare) => run(plans.replaceIfCurrent(input, prepare)).pipe(translateFailure),
 		checkReset: (input) => plans.checkReset(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
-		resetWithProof: (input, prepare) => run(plans.resetWithProof(input, prepare)).pipe(translateFailure),
-		cleanupAttempts: (input, prepare) => run(plans.cleanupAttempts(input, prepare)).pipe(translateFailure)
+		resetWithProof: (input, prepare) => run(plans.resetWithProof(input, prepare)).pipe(translateFailure)
 	} };
 });
 /**
@@ -814,22 +603,21 @@ function coordinateD1PasswordPersistence(acquire, options, body) {
 				return guarded.receipt;
 			}), { mode: "batch" }).pipe(Effect.map((result) => result.value), Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks));
 			const provided = Context.make(PasswordPersistence, {
-				admitAttempt: (input, prepare) => owner.run(run(plans.admitAttempt(input, prepare)).pipe(translateFailure)),
-				settleAttempt: (input, prepare) => owner.run(run(plans.settleAttempt(input, prepare)).pipe(translateFailure)),
+				findCredential: (input) => owner.run(plans.findCredential(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), translateFailure)),
+				rehashIfCurrent: (input) => owner.run(run(plans.rehashIfCurrent(input)).pipe(translateFailure)),
 				readForSubject: (input) => owner.run(plans.readForSubject(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks), translateFailure)),
 				recoveryTarget: (input) => owner.run(plans.recoveryTarget(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks), translateFailure)),
 				addIfAbsent: (input, prepare) => owner.run(run(plans.addIfAbsent(input, prepare)).pipe(translateFailure)),
 				replaceIfCurrent: (input, prepare) => owner.run(run(plans.replaceIfCurrent(input, prepare)).pipe(translateFailure)),
 				checkReset: (input) => owner.run(plans.checkReset(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks), translateFailure)),
-				resetWithProof: (input, prepare) => owner.run(run(plans.resetWithProof(input, prepare)).pipe(translateFailure)),
-				cleanupAttempts: (input, prepare) => owner.run(run(plans.cleanupAttempts(input, prepare)).pipe(translateFailure))
+				resetWithProof: (input, prepare) => owner.run(run(plans.resetWithProof(input, prepare)).pipe(translateFailure))
 			}).pipe(Context.add(D1BatchStatements, owner.collector));
 			const value = yield* owner.close(Effect.provideContext(body, provided));
 			if (mutation?.journalGuard !== void 0) {
 				const status = yield* Effect.result(mutation.journalGuard.read);
 				if (status._tag === "Success" || status.failure._tag !== "CommitPending") return yield* unavailable();
 			}
-			yield* database.$client.batch(statements).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, (error) => everyFailureMatches(cause, mutation?.retryable) ? unavailable() : error))), translateFailure);
+			yield* database.$client.batch([...statements, ...mutation?.postconditions ?? []]).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, (error) => everyFailureMatches(cause, mutation?.retryable) ? unavailable() : error))), translateFailure);
 			return value;
 		}), { mode: "batch" }).pipe(Effect.provideService(LifecycleHooks, hooks))).value;
 	}).pipe(Effect.provideService(NativeDatabase, database)));