@yielded/auth-persistence-drizzle 0.1.0-beta.23 → 0.1.0-beta.25

package/dist/drizzle/d1-passwords.mjs

@@ -8,13 +8,13 @@ import { CurrentD1PlanningDatabase, makeD1Owner } from "./d1-planning.mjs";
 import { nativeDatabase } from "./native-database.mjs";
 import { compileD1ProofCompletionPlan } from "./d1-proofs.mjs";
 import { NativeDatabase, requireStandalone, samePasswordCredentialSnapshot } from "@yielded/auth-persistence/Adapter";
-import { and, eq, inArray, lte, sql } from "drizzle-orm";
+import { and, eq, getTableColumns, inArray, sql } from "drizzle-orm";
 import { Cause, Context, DateTime, Effect, Option, Predicate, Redacted, Schema } from "effect";
 import { CurrentCommitJournal, HookConfigurationError, LifecycleHooks, coordinateCommit, hasCommitScope } from "@yielded/auth/Hooks";
 import { AuthenticationEvidence, AuthenticationRequirement, snapshotAuthenticationEvidence } from "@yielded/auth/Sessions";
 import { reportPersistenceFailure } from "@yielded/auth/Persistence";
 import { ProofUnavailable } from "@yielded/auth/Proofs";
-import { PasswordPersistence, PasswordUnavailable, snapshotPasswordCredential, snapshotPasswordRequirement, snapshotPasswordRevision } from "@yielded/auth/Password";
+import { EncodedPasswordHash, PasswordPersistence, PasswordUnavailable, snapshotPasswordCredential, snapshotPasswordRequirement, snapshotPasswordRevision } from "@yielded/auth/Password";
 //#region src/drizzle/d1-passwords.ts
 const unavailable = () => PasswordUnavailable.make({});
 const everyFailureMatches = (cause, classify) => classify !== void 0 && cause.reasons.length > 0 && cause.reasons.every((reason) => Cause.isFailReason(reason) && classify(Cause.fail(reason.error)));
@@ -60,10 +60,6 @@ const readEngineNowMillis = Effect.fn("Drizzle.readEngineNowMillis")(function* (
 		return Number.isFinite(value) ? Effect.succeed(value) : Effect.fail(unavailable());
 	}));
 });
-const driverValues = (values, entries) => ({
-	...values,
-	...Object.fromEntries(entries)
-});
 const allocate = (asyncValue, syncValue) => asyncValue !== void 0 ? asyncValue : syncValue === void 0 ? Effect.fail(unavailable()) : Effect.try({
 	try: syncValue,
 	catch: (cause) => new PersistenceMappingError$1({
@@ -99,23 +95,6 @@ const authorityColumns = (mapping) => ({
 	revision: column(mapping.authorityCredential.table, mapping.authorityCredential.revision),
 	status: mapping.authorityCredential.status === void 0 ? void 0 : column(mapping.authorityCredential.table, mapping.authorityCredential.status)
 });
-const attemptColumns = (mapping) => ({
-	moduleId: column(mapping.attempt.table, mapping.attempt.moduleId),
-	action: column(mapping.attempt.table, mapping.attempt.action),
-	attemptId: column(mapping.attempt.table, mapping.attempt.attemptId),
-	identifierNamespace: column(mapping.attempt.table, mapping.attempt.identifierNamespace),
-	identifierValue: column(mapping.attempt.table, mapping.attempt.identifierValue),
-	subjectId: column(mapping.attempt.table, mapping.attempt.subjectId),
-	credentialId: column(mapping.attempt.table, mapping.attempt.credentialId),
-	securityRevision: column(mapping.attempt.table, mapping.attempt.securityRevision),
-	credentialRevision: column(mapping.attempt.table, mapping.attempt.credentialRevision),
-	verifierVersion: column(mapping.attempt.table, mapping.attempt.verifierVersion),
-	identifierBindingRevision: column(mapping.attempt.table, mapping.attempt.identifierBindingRevision),
-	admittedAt: column(mapping.attempt.table, mapping.attempt.admittedAt),
-	deadline: column(mapping.attempt.table, mapping.attempt.deadline),
-	retentionUntil: column(mapping.attempt.table, mapping.attempt.retentionUntil),
-	state: column(mapping.attempt.table, mapping.attempt.state)
-});
 const commandColumns = (mapping) => ({
 	moduleId: column(mapping.command.table, mapping.command.moduleId),
 	commandId: column(mapping.command.table, mapping.command.commandId),
@@ -281,7 +260,7 @@ const readAuthority = Effect.fn("DrizzleD1Password.readAuthority")(function* (ma
 	const requirement = yield* mapping.subject.decodeActionRequirement(subject, action);
 	const engineNow = yield* readEngineNowMillis(mapping);
 	if (!evidenceSatisfiedAt(input.authorization.evidence, input.authorization.requirement, engineNow) || !evidenceSatisfiedAt(input.authorization.evidence, requirement, engineNow)) return void 0;
-	if (input.invalidation.existingSessions === "immediate" && mapping.sessionInvalidation !== "same-authority-immediate") return void 0;
+	if ((input.invalidation.existingSessions === "immediate" || input.invalidation.existingSessions === "cache-expiry") && mapping.sessionInvalidation !== "same-authority-immediate") return void 0;
 	const s = subjectColumns(mapping);
 	const credentialConditions = expected.map((item) => sql`exists(select 1 from ${mapping.authorityCredential.table} where ${ac.subjectId} = ${sql.param(nativeSubjectId, ac.subjectId)} and ${ac.credentialId} = ${sql.param(item.credentialId, ac.credentialId)} and ${ac.revision} = ${sql.param(item.revision, ac.revision)}${ac.status === void 0 ? sql`` : sql` and ${ac.status} = ${sql.param(mapping.authorityCredential.d1ActiveStatusValue, ac.status)}`})`);
 	return {
@@ -300,18 +279,6 @@ const credentialCurrentCondition = (mapping, input, nativeSubjectId) => {
 	const c = credentialColumns(mapping);
 	return input.credential === void 0 ? sql`false` : sql`exists(select 1 from ${mapping.credential.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(nativeSubjectId, c.subjectId)} and ${c.credentialId} = ${sql.param(input.credential.credentialId, c.credentialId)} and ${c.credentialRevision} = ${sql.param(input.credential.credentialRevision, c.credentialRevision)} and ${c.verifierVersion} = ${sql.param(input.credential.verifierVersion, c.verifierVersion)} and ${c.verifier} = ${sql.param(Redacted.value(input.credential.verifier), c.verifier)} and ${c.normalization} = ${sql.param(input.credential.normalization, c.normalization)})`;
 };
-const admittedSnapshotCondition = (mapping, resolved, moduleId) => {
-	const snapshot = resolved?.snapshot;
-	if (snapshot === void 0 || resolved === void 0) return sql`true`;
-	const s = subjectColumns(mapping);
-	const i = identifierColumns(mapping);
-	const c = credentialColumns(mapping);
-	const ac = authorityColumns(mapping);
-	return and(sql`exists(select 1 from ${mapping.subject.table} where ${s.id} = ${sql.param(resolved.nativeSubjectId, s.id)} and ${s.status} = ${sql.param(mapping.subject.d1ActiveStatusValue, s.status)} and ${s.securityRevision} = ${sql.param(snapshot.revision.securityRevision, s.securityRevision)})`, mapping.identifier.d1CurrentCondition({
-		identifier: snapshot.identifier,
-		nativeSubjectId: resolved.nativeSubjectId
-	}), sql`exists(select 1 from ${mapping.identifier.table} where ${i.namespace} = ${sql.param(snapshot.identifier.namespace, i.namespace)} and ${i.value} = ${sql.param(snapshot.identifier.value, i.value)} and ${i.subjectId} = ${sql.param(resolved.nativeSubjectId, i.subjectId)} and ${i.bindingRevision} = ${sql.param(snapshot.identifierBindingRevision, i.bindingRevision)} and ${Predicate.isNullish(resolved.identifier[mapping.identifier.verifiedAt]) ? sql`${i.verifiedAt} is null` : sql`${i.verifiedAt} = ${sql.param(resolved.identifier[mapping.identifier.verifiedAt], i.verifiedAt)}`})`, sql`exists(select 1 from ${mapping.credential.table} where ${c.moduleId} = ${sql.param(moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(resolved.nativeSubjectId, c.subjectId)} and ${c.credentialId} = ${sql.param(snapshot.credentialId, c.credentialId)} and ${c.credentialRevision} = ${sql.param(snapshot.credentialRevision, c.credentialRevision)} and ${c.verifierVersion} = ${sql.param(snapshot.verifierVersion, c.verifierVersion)} and ${c.verifier} = ${sql.param(Redacted.value(snapshot.verifier), c.verifier)} and ${c.normalization} = ${sql.param(snapshot.normalization, c.normalization)})`, ...snapshot.revision.credentials.map((item) => sql`exists(select 1 from ${mapping.authorityCredential.table} where ${ac.subjectId} = ${sql.param(resolved.nativeSubjectId, ac.subjectId)} and ${ac.credentialId} = ${sql.param(item.credentialId, ac.credentialId)} and ${ac.revision} = ${sql.param(item.revision, ac.revision)}${ac.status === void 0 ? sql`` : sql` and ${ac.status} = ${sql.param(mapping.authorityCredential.d1ActiveStatusValue, ac.status)}`})`));
-};
 const mutationStatements = Effect.fn(function* (mapping, input, nativeSubjectId, revisions, now) {
 	const database = yield* CurrentD1PlanningDatabase;
 	const c = credentialColumns(mapping);
@@ -394,132 +361,58 @@ const makePasswordPlans = (mapping, proofMapping) => {
 		return yield* plan;
 	});
 	return {
-		prepareAttempt: (uncaptured) => Effect.gen(function* () {
+		findCredential: (uncaptured) => Effect.gen(function* () {
 			if (!validConstraints(mapping)) return yield* unavailable();
-			const input = Object.freeze({
-				...uncaptured,
-				identifier: Object.freeze({ ...uncaptured.identifier })
-			});
-			const resolved = yield* resolveCredential(mapping, input.moduleId, input.identifier, input.subjectId);
-			const snapshot = resolved?.snapshot;
-			const attemptId = yield* allocate(mapping.allocateAttemptId, mapping.allocateAttemptIdSync);
-			let used = false;
-			return Object.freeze({
-				...snapshot === void 0 ? {} : { credential: snapshot },
-				claim: Effect.suspend(() => {
-					if (used) return Effect.fail(unavailable());
-					used = true;
-					return Effect.void;
-				}),
-				admit: (prepare) => run(Effect.gen(function* () {
-					const database = yield* CurrentD1PlanningDatabase;
-					const journal = yield* CurrentCommitJournal;
-					const now = yield* readEngineNowMillis(mapping);
-					const marker = `effect-auth-password-guard:admit:${attemptId}`;
-					const a = attemptColumns(mapping);
-					const key = and(eq(a.moduleId, input.moduleId), eq(a.attemptId, attemptId));
-					const current = admittedSnapshotCondition(mapping, resolved, input.moduleId);
-					const record = {
-						moduleId: input.moduleId,
-						action: input.action,
-						attemptId,
-						identifier: input.identifier,
-						...snapshot === void 0 ? {} : {
-							subjectId: snapshot.revision.subjectId,
-							credentialId: snapshot.credentialId,
-							securityRevision: snapshot.revision.securityRevision,
-							credentialRevision: snapshot.credentialRevision,
-							verifierVersion: snapshot.verifierVersion,
-							identifierBindingRevision: snapshot.identifierBindingRevision
-						},
-						admittedAtMillis: now,
-						deadlineMillis: now + input.attemptLifetimeMillis,
-						retentionUntilMillis: now + input.attemptLifetimeMillis
-					};
-					const receipt = prepare({
-						_tag: "Admitted",
-						attemptId,
-						...snapshot === void 0 ? {} : { credential: snapshot }
-					}, journal);
-					const admitted = and(current, sql`exists(select 1 from ${mapping.attempt.table} where ${key} and ${a.state} = ${"pending"} and ${a.deadline} > ${mapping.d1.engineNow})`);
-					return {
-						receipt,
-						statements: [
-							yield* assertion(and(current, sql`not exists(select 1 from ${mapping.attempt.table} where ${key})`), marker),
-							yield* statement(database.insert(mapping.attempt.table).values(driverValues(mapping.attempt.encodeInsert(record, {
-								...resolved?.nativeSubjectId === void 0 ? {} : { nativeSubjectId: resolved.nativeSubjectId },
-								state: "pending"
-							}), [
-								[mapping.attempt.admittedAt, mapping.d1.engineNow],
-								[mapping.attempt.deadline, mapping.d1.engineInstantPlus(input.attemptLifetimeMillis)],
-								[mapping.attempt.retentionUntil, mapping.d1.engineInstantPlus(input.attemptLifetimeMillis)]
-							]))),
-							yield* assertion(and(sql`changes() = 1`, admitted), marker)
-						],
-						postconditions: [yield* assertion(admitted, marker)]
-					};
-				}))
-			});
-		}),
-		settleAttempt: (uncaptured, prepare) => Effect.gen(function* () {
-			const database = yield* CurrentD1PlanningDatabase;
-			const captured = uncaptured.captured === void 0 ? void 0 : yield* snapshotPasswordCredential(uncaptured.captured);
 			const input = {
 				...uncaptured,
-				...captured === void 0 ? {} : { captured }
+				identifier: { ...uncaptured.identifier }
 			};
-			return yield* run(Effect.gen(function* () {
-				const journal = yield* CurrentCommitJournal;
-				const a = attemptColumns(mapping);
-				const row = (yield* database.select().from(mapping.attempt.table).where(and(eq(a.moduleId, input.moduleId), eq(a.attemptId, input.attemptId))).limit(1))[0];
-				const engineNow = yield* readEngineNowMillis(mapping);
-				const deadline = row === void 0 ? void 0 : yield* mapping.decodeInstant(row[mapping.attempt.deadline]);
-				let resolved;
-				let verified = false;
-				if (row !== void 0 && row[mapping.attempt.state] === "pending" && input.outcome === "verified" && input.captured !== void 0 && deadline !== void 0 && deadline > engineNow) {
-					resolved = yield* resolveCredential(mapping, input.moduleId, input.captured.identifier, input.captured.revision.subjectId);
-					verified = input.captured.moduleId === input.moduleId && resolved?.snapshot !== void 0 && samePasswordCredentialSnapshot(resolved.snapshot, input.captured) && mapping.subjectId.equals(row[mapping.attempt.subjectId], resolved.nativeSubjectId) && row[mapping.attempt.identifierNamespace] === input.captured.identifier.namespace && row[mapping.attempt.identifierValue] === input.captured.identifier.value && row[mapping.attempt.credentialId] === input.captured.credentialId && row[mapping.attempt.securityRevision] === input.captured.revision.securityRevision && row[mapping.attempt.credentialRevision] === input.captured.credentialRevision && row[mapping.attempt.verifierVersion] === input.captured.verifierVersion && row[mapping.attempt.identifierBindingRevision] === input.captured.identifierBindingRevision;
-				}
-				const decision = verified ? "verified" : "rejected";
-				const receipt = prepare(decision, journal);
-				if (row === void 0 || row[mapping.attempt.state] !== "pending") return {
-					receipt,
-					statements: []
-				};
-				const marker = `effect-auth-password-guard:settle:${input.attemptId}`;
-				const base = and(eq(a.moduleId, input.moduleId), eq(a.attemptId, input.attemptId), eq(a.state, "pending"));
-				const attemptSnapshot = verified && resolved?.snapshot !== void 0 ? and(eq(a.action, row[mapping.attempt.action]), eq(a.subjectId, resolved.nativeSubjectId), eq(a.identifierNamespace, input.captured.identifier.namespace), eq(a.identifierValue, input.captured.identifier.value), eq(a.credentialId, input.captured.credentialId), eq(a.securityRevision, input.captured.revision.securityRevision), eq(a.credentialRevision, input.captured.credentialRevision), eq(a.verifierVersion, input.captured.verifierVersion), eq(a.identifierBindingRevision, input.captured.identifierBindingRevision), eq(a.deadline, row[mapping.attempt.deadline])) : sql`true`;
-				const condition = verified ? and(base, attemptSnapshot, sql`${a.deadline} > ${mapping.d1.engineNow}`) : base;
-				const statements = [yield* assertion(sql`exists(select 1 from ${mapping.attempt.table} where ${condition})`, marker), yield* statement(database.update(mapping.attempt.table).set(updateValues([[mapping.attempt.state, decision]])).where(condition))];
-				let finalAuthority = sql`true`;
-				if (verified && resolved?.snapshot !== void 0) {
-					const captured = input.captured;
-					const c = credentialColumns(mapping);
-					finalAuthority = admittedSnapshotCondition(mapping, resolved, input.moduleId);
-					statements.splice(1, 0, yield* assertion(finalAuthority, marker));
-					if (input.rehash !== void 0 && input.rehash.expectedVersion === captured.verifierVersion && Redacted.value(input.rehash.expectedVerifier) === Redacted.value(captured.verifier)) {
-						const nextVersion = yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync);
-						statements.push(yield* assertion(sql`changes() = 1`, marker), yield* statement(database.update(mapping.credential.table).set(mapping.credential.encodeVerifier(input.rehash.nextVerifier, nextVersion)).where(and(eq(c.moduleId, input.moduleId), eq(c.subjectId, resolved.nativeSubjectId), eq(c.credentialId, captured.credentialId), eq(c.credentialRevision, captured.credentialRevision), eq(c.verifierVersion, input.rehash.expectedVersion), eq(c.verifier, Redacted.value(input.rehash.expectedVerifier))))));
-						finalAuthority = admittedSnapshotCondition(mapping, {
-							...resolved,
-							snapshot: {
-								...resolved.snapshot,
-								verifierVersion: nextVersion,
-								verifier: input.rehash.nextVerifier
-							}
-						}, input.moduleId);
-					}
-				}
-				const settled = and(finalAuthority, sql`exists(select 1 from ${mapping.attempt.table} where ${a.moduleId} = ${sql.param(input.moduleId, a.moduleId)} and ${a.attemptId} = ${sql.param(input.attemptId, a.attemptId)} and ${a.state} = ${sql.param(decision, a.state)} and ${attemptSnapshot}${verified ? sql` and ${a.deadline} > ${mapping.d1.engineNow}` : sql``})`);
-				statements.push(yield* assertion(and(sql`changes() = 1`, settled), marker));
-				return {
-					receipt,
-					statements,
-					postconditions: [yield* assertion(settled, marker)],
-					retryable: (cause) => isGuardFailure(cause, marker)
-				};
-			}));
+			const database = yield* CurrentD1PlanningDatabase;
+			const identifierRow = (yield* readIdentifier(mapping, input.identifier))[0];
+			if (identifierRow === void 0 || !mapping.identifier.isCurrent(identifierRow)) return Option.none();
+			const nativeId = identifierRow[mapping.identifier.subjectId];
+			const sc = subjectColumns(mapping), ic = identifierColumns(mapping), cc = credentialColumns(mapping);
+			const rows = yield* database.select({
+				subject: getTableColumns(mapping.subject.table),
+				identifier: getTableColumns(mapping.identifier.table),
+				credential: getTableColumns(mapping.credential.table)
+			}).from(mapping.subject.table).innerJoin(mapping.identifier.table, and(eq(ic.namespace, input.identifier.namespace), eq(ic.value, input.identifier.value), eq(ic.subjectId, nativeId))).innerJoin(mapping.credential.table, and(eq(cc.moduleId, input.moduleId), eq(cc.subjectId, nativeId))).where(eq(sc.id, nativeId));
+			if (rows.length !== 1) return Option.none();
+			const row = rows[0];
+			if (!mapping.subject.isActiveStatus(row.subject[mapping.subject.status]) || !mapping.identifier.isCurrent(row.identifier) || !mapping.subjectId.equals(nativeId, row.subject[mapping.subject.id]) || !mapping.subjectId.equals(nativeId, row.identifier[mapping.identifier.subjectId]) || !mapping.subjectId.equals(nativeId, row.credential[mapping.credential.subjectId])) return Option.none();
+			const credential = yield* mapping.credential.decode({
+				moduleId: input.moduleId,
+				...row
+			}).pipe(Effect.flatMap(snapshotPasswordCredential));
+			return input.subjectId !== void 0 && credential.revision.subjectId !== input.subjectId ? Option.none() : Option.some(credential);
 		}),
+		rehashIfCurrent: (input) => run(Effect.gen(function* () {
+			const nextVerifier = Redacted.make(yield* Schema.decodeEffect(EncodedPasswordHash)(Redacted.value(input.nextVerifier)));
+			const credential = yield* snapshotPasswordCredential(input.credential);
+			const database = yield* CurrentD1PlanningDatabase;
+			const nativeId = yield* mapping.subjectId.toNative(credential.revision.subjectId);
+			const version = yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync);
+			if (version === credential.verifierVersion) return yield* unavailable();
+			const encoded = mapping.credential.encodeVerifier(nextVerifier, version);
+			const values = {
+				[mapping.credential.verifier]: encoded[mapping.credential.verifier],
+				[mapping.credential.verifierVersion]: encoded[mapping.credential.verifierVersion]
+			};
+			if (Object.values(values).some((value) => value === void 0)) return yield* unavailable();
+			const c = credentialColumns(mapping);
+			return {
+				receipt: void 0,
+				statements: [yield* statement(database.update(mapping.credential.table).set(values).where(and(eq(c.moduleId, credential.moduleId), eq(c.subjectId, nativeId), eq(c.credentialId, credential.credentialId), ...[
+					[c.moduleId, credential.moduleId],
+					[c.subjectId, nativeId],
+					[c.credentialId, credential.credentialId],
+					[c.credentialRevision, credential.credentialRevision],
+					[c.verifierVersion, credential.verifierVersion],
+					[c.verifier, Redacted.value(credential.verifier)],
+					[c.normalization, credential.normalization]
+				].map(([column, value]) => typeof value === "string" ? sql`cast(${column} as blob) = cast(${sql.param(value, column)} as blob)` : eq(column, value)))))]
+			};
+		})),
 		readForSubject: (input) => Effect.gen(function* () {
 			const database = yield* CurrentD1PlanningDatabase;
 			if (yield* hasCommitScope) return yield* unavailable();
@@ -581,10 +474,7 @@ const makePasswordPlans = (mapping, proofMapping) => {
 		resetWithProof: (uncaptured, prepare) => proofMapping === void 0 ? Effect.fail(unavailable()) : Effect.flatMap(snapshotMutationInput(uncaptured), (captured) => replacementPlan(mapping, proofMapping, Object.freeze({
 			...captured,
 			completion: uncaptured.completion
-		}), prepare, "reset-password")),
-		cleanupAttempts: (input, prepare) => run(Effect.gen(function* () {
-			return yield* cleanupPlan(mapping, input, prepare);
-		}))
+		}), prepare, "reset-password"))
 	};
 };
 const compileReplacementMutation = Effect.fn("DrizzleD1Password.compileReplacementMutation")(function* (mapping, input, action, revisions) {
@@ -653,30 +543,6 @@ const replacementPlan = Effect.fn("Drizzle.replacementPlan")(function* (mapping,
 		retryable: (cause) => isGuardFailure(cause, marker)
 	};
 });
-const cleanupPlan = Effect.fn("Drizzle.cleanupPlan")(function* (mapping, input, prepare) {
-	const database = yield* CurrentD1PlanningDatabase;
-	const journal = yield* CurrentCommitJournal;
-	const now = yield* readEngineNowMillis(mapping);
-	const nativeNow = mapping.encodeInstant(now);
-	const a = attemptColumns(mapping);
-	const attempts = yield* database.select({ attemptId: a.attemptId }).from(mapping.attempt.table).where(and(eq(a.moduleId, input.moduleId), lte(a.retentionUntil, nativeNow))).limit(input.limit + 1);
-	const selectedAttempts = attempts.slice(0, input.limit);
-	const hasMore = attempts.length > selectedAttempts.length;
-	const marker = `effect-auth-password-guard:cleanup:${input.moduleId}:${now}`;
-	const statements = [];
-	for (const row of selectedAttempts) {
-		const condition = and(eq(a.moduleId, input.moduleId), eq(a.attemptId, row.attemptId), lte(a.retentionUntil, mapping.d1.engineNow));
-		statements.push(yield* assertion(sql`exists(select 1 from ${mapping.attempt.table} where ${condition})`, marker), yield* statement(database.delete(mapping.attempt.table).where(condition)));
-	}
-	return {
-		receipt: prepare({
-			removed: selectedAttempts.length,
-			hasMore
-		}, journal),
-		statements,
-		retryable: (cause) => isGuardFailure(cause, marker)
-	};
-});
 const makeD1PasswordPersistenceServices = Effect.fnUntraced(function* (mapping, proofMapping) {
 	const database = yield* Database;
 	yield* validateDrizzleStorage({
@@ -694,18 +560,14 @@ const makeD1PasswordPersistenceServices = Effect.fnUntraced(function* (mapping,
 		return yield* executeStandalone(plan, 2);
 	}).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks));
 	return { passwordPersistence: {
-		prepareAttempt: (input) => standalone.pipe(Effect.andThen(plans.prepareAttempt(input)), Effect.map((planned) => Object.freeze({
-			...planned.credential === void 0 ? {} : { credential: planned.credential },
-			admit: (prepare) => planned.claim.pipe(Effect.andThen(run(planned.admit(prepare))), translateFailure)
-		})), Effect.provideService(CurrentD1PlanningDatabase, database), translateFailure),
-		settleAttempt: (input, prepare) => run(plans.settleAttempt(input, prepare)).pipe(translateFailure),
+		findCredential: (input) => standalone.pipe(Effect.andThen(plans.findCredential(input)), Effect.provideService(CurrentD1PlanningDatabase, database), translateFailure),
+		rehashIfCurrent: (input) => run(plans.rehashIfCurrent(input)).pipe(translateFailure),
 		readForSubject: (input) => plans.readForSubject(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
 		recoveryTarget: (input) => plans.recoveryTarget(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
 		addIfAbsent: (input, prepare) => run(plans.addIfAbsent(input, prepare)).pipe(translateFailure),
 		replaceIfCurrent: (input, prepare) => run(plans.replaceIfCurrent(input, prepare)).pipe(translateFailure),
 		checkReset: (input) => plans.checkReset(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
-		resetWithProof: (input, prepare) => run(plans.resetWithProof(input, prepare)).pipe(translateFailure),
-		cleanupAttempts: (input, prepare) => run(plans.cleanupAttempts(input, prepare)).pipe(translateFailure)
+		resetWithProof: (input, prepare) => run(plans.resetWithProof(input, prepare)).pipe(translateFailure)
 	} };
 });
 /**
@@ -741,18 +603,14 @@ function coordinateD1PasswordPersistence(acquire, options, body) {
 				return guarded.receipt;
 			}), { mode: "batch" }).pipe(Effect.map((result) => result.value), Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks));
 			const provided = Context.make(PasswordPersistence, {
-				prepareAttempt: (input) => owner.run(plans.prepareAttempt(input).pipe(Effect.map((planned) => Object.freeze({
-					...planned.credential === void 0 ? {} : { credential: planned.credential },
-					admit: (prepare) => owner.run(planned.claim.pipe(Effect.andThen(run(planned.admit(prepare))), translateFailure))
-				})), Effect.provideService(CurrentD1PlanningDatabase, database), translateFailure)),
-				settleAttempt: (input, prepare) => owner.run(run(plans.settleAttempt(input, prepare)).pipe(translateFailure)),
+				findCredential: (input) => owner.run(plans.findCredential(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), translateFailure)),
+				rehashIfCurrent: (input) => owner.run(run(plans.rehashIfCurrent(input)).pipe(translateFailure)),
 				readForSubject: (input) => owner.run(plans.readForSubject(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks), translateFailure)),
 				recoveryTarget: (input) => owner.run(plans.recoveryTarget(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks), translateFailure)),
 				addIfAbsent: (input, prepare) => owner.run(run(plans.addIfAbsent(input, prepare)).pipe(translateFailure)),
 				replaceIfCurrent: (input, prepare) => owner.run(run(plans.replaceIfCurrent(input, prepare)).pipe(translateFailure)),
 				checkReset: (input) => owner.run(plans.checkReset(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks), translateFailure)),
-				resetWithProof: (input, prepare) => owner.run(run(plans.resetWithProof(input, prepare)).pipe(translateFailure)),
-				cleanupAttempts: (input, prepare) => owner.run(run(plans.cleanupAttempts(input, prepare)).pipe(translateFailure))
+				resetWithProof: (input, prepare) => owner.run(run(plans.resetWithProof(input, prepare)).pipe(translateFailure))
 			}).pipe(Context.add(D1BatchStatements, owner.collector));
 			const value = yield* owner.close(Effect.provideContext(body, provided));
 			if (mutation?.journalGuard !== void 0) {