@yielded/auth-persistence 0.1.0-beta.10

package/dist/internal/password-kernel.mjs

@@ -0,0 +1,704 @@
+import { PersistenceMappingError } from "./mapping-error.mjs";
+import { CurrentProofSql } from "./proof-kernel.mjs";
+import { requiredPasswordConstraints } from "./models/password-model.mjs";
+import { Cause, Context, DateTime, Effect, Option, Redacted, Schema } from "effect";
+import { CurrentCommitJournal, HookConfigurationError, LifecycleHooks, coordinateCommit, hasCommitScope } from "@yielded/auth/Hooks";
+import { snapshotAuthenticationEvidence } from "@yielded/auth/Sessions";
+import { reportPersistenceFailure } from "@yielded/auth/Persistence";
+import { PasswordPersistence, PasswordUnavailable, snapshotPasswordCredential, snapshotPasswordRequirement, snapshotPasswordRevision } from "@yielded/auth/Password";
+import { ProofUnavailable } from "@yielded/auth/Proofs";
+//#region src/internal/password-kernel.ts
+var CurrentPasswordSql = class extends Context.Service()("effect-auth/CurrentPasswordSql") {};
+const makePasswordKernel = (operations, proofs) => {
+	const { and, eq, gte, inArray, lte, notExists, sql, column, updateValues } = operations;
+	const { completeProofPlanIn } = proofs;
+	const unavailable = () => PasswordUnavailable.make({});
+	const translateFailure = (effect) => reportPersistenceFailure(effect, (error) => Schema.is(PasswordUnavailable)(error) || Schema.is(ProofUnavailable)(error) || Schema.is(HookConfigurationError)(error)).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));
+	const nowMillis = DateTime.now.pipe(Effect.map(DateTime.toEpochMillis));
+	const validConstraints = (mapping) => Object.entries(requiredPasswordConstraints).every(([key, value]) => mapping.constraints[key] === value);
+	const selectRows = (query, locking) => locking && typeof query.for === "function" ? query.for("update") : query;
+	const subjectColumns = (mapping) => ({
+		id: column(mapping.subject.table, mapping.subject.id),
+		status: column(mapping.subject.table, mapping.subject.status),
+		securityRevision: column(mapping.subject.table, mapping.subject.securityRevision)
+	});
+	const identifierColumns = (mapping) => ({
+		namespace: column(mapping.identifier.table, mapping.identifier.namespace),
+		value: column(mapping.identifier.table, mapping.identifier.value),
+		subjectId: column(mapping.identifier.table, mapping.identifier.subjectId),
+		verifiedAt: column(mapping.identifier.table, mapping.identifier.verifiedAt),
+		bindingRevision: column(mapping.identifier.table, mapping.identifier.bindingRevision)
+	});
+	const credentialColumns = (mapping) => ({
+		moduleId: column(mapping.credential.table, mapping.credential.moduleId),
+		subjectId: column(mapping.credential.table, mapping.credential.subjectId),
+		credentialId: column(mapping.credential.table, mapping.credential.credentialId),
+		credentialRevision: column(mapping.credential.table, mapping.credential.credentialRevision),
+		verifierVersion: column(mapping.credential.table, mapping.credential.verifierVersion),
+		verifier: column(mapping.credential.table, mapping.credential.verifier),
+		normalization: column(mapping.credential.table, mapping.credential.normalization)
+	});
+	const authorityCredentialColumns = (mapping) => ({
+		subjectId: column(mapping.authorityCredential.table, mapping.authorityCredential.subjectId),
+		credentialId: column(mapping.authorityCredential.table, mapping.authorityCredential.credentialId),
+		revision: column(mapping.authorityCredential.table, mapping.authorityCredential.revision)
+	});
+	const attemptColumns = (mapping) => ({
+		moduleId: column(mapping.attempt.table, mapping.attempt.moduleId),
+		action: column(mapping.attempt.table, mapping.attempt.action),
+		attemptId: column(mapping.attempt.table, mapping.attempt.attemptId),
+		identifierNamespace: column(mapping.attempt.table, mapping.attempt.identifierNamespace),
+		identifierValue: column(mapping.attempt.table, mapping.attempt.identifierValue),
+		subjectId: column(mapping.attempt.table, mapping.attempt.subjectId),
+		credentialId: column(mapping.attempt.table, mapping.attempt.credentialId),
+		securityRevision: column(mapping.attempt.table, mapping.attempt.securityRevision),
+		credentialRevision: column(mapping.attempt.table, mapping.attempt.credentialRevision),
+		verifierVersion: column(mapping.attempt.table, mapping.attempt.verifierVersion),
+		identifierBindingRevision: column(mapping.attempt.table, mapping.attempt.identifierBindingRevision),
+		admittedAt: column(mapping.attempt.table, mapping.attempt.admittedAt),
+		deadline: column(mapping.attempt.table, mapping.attempt.deadline),
+		retentionUntil: column(mapping.attempt.table, mapping.attempt.retentionUntil),
+		state: column(mapping.attempt.table, mapping.attempt.state)
+	});
+	const scopeColumns = (mapping) => ({
+		moduleId: column(mapping.rateScope.table, mapping.rateScope.moduleId),
+		action: column(mapping.rateScope.table, mapping.rateScope.action),
+		scopeKind: column(mapping.rateScope.table, mapping.rateScope.scopeKind),
+		scopeKey: column(mapping.rateScope.table, mapping.rateScope.scopeKey)
+	});
+	const chargeColumns = (mapping) => ({
+		moduleId: column(mapping.charge.table, mapping.charge.moduleId),
+		action: column(mapping.charge.table, mapping.charge.action),
+		scopeKind: column(mapping.charge.table, mapping.charge.scopeKind),
+		scopeKey: column(mapping.charge.table, mapping.charge.scopeKey),
+		attemptId: column(mapping.charge.table, mapping.charge.attemptId),
+		occurredAt: column(mapping.charge.table, mapping.charge.occurredAt),
+		retentionUntil: column(mapping.charge.table, mapping.charge.retentionUntil)
+	});
+	const commandColumns = (mapping) => ({
+		moduleId: column(mapping.command.table, mapping.command.moduleId),
+		commandId: column(mapping.command.table, mapping.command.commandId),
+		action: column(mapping.command.table, mapping.command.action),
+		bindingDigest: column(mapping.command.table, mapping.command.bindingDigest),
+		decision: column(mapping.command.table, mapping.command.decision),
+		retentionUntil: column(mapping.command.table, mapping.command.retentionUntil)
+	});
+	const allocate = (mode, asyncValue, syncValue) => {
+		if (mode === "synchronous") return syncValue === void 0 ? Effect.fail(unavailable()) : Effect.try({
+			try: syncValue,
+			catch: (cause) => new PersistenceMappingError({
+				operation: "mapping",
+				cause
+			})
+		});
+		if (asyncValue !== void 0) return asyncValue;
+		return syncValue === void 0 ? Effect.fail(unavailable()) : Effect.try({
+			try: syncValue,
+			catch: (cause) => new PersistenceMappingError({
+				operation: "mapping",
+				cause
+			})
+		});
+	};
+	const allocateNextSecurityRevision = (mapping, mode, current) => {
+		const asyncValue = mapping.subject.nextSecurityRevision?.(current);
+		const syncValue = mapping.subject.nextSecurityRevisionSync === void 0 ? void 0 : () => mapping.subject.nextSecurityRevisionSync(current);
+		return allocate(mode, asyncValue ?? mapping.allocateRevision, syncValue ?? mapping.allocateRevisionSync);
+	};
+	const sameIdentifier = (left, right) => left.namespace === right.namespace && left.value === right.value;
+	const sameCredentialSnapshot = (left, right) => left.moduleId === right.moduleId && left.revision.subjectId === right.revision.subjectId && left.revision.securityRevision === right.revision.securityRevision && left.credentialId === right.credentialId && left.credentialRevision === right.credentialRevision && left.verifierVersion === right.verifierVersion && left.normalization === right.normalization && left.identifierVerifiedAtMillis === right.identifierVerifiedAtMillis && left.revision.credentials.length === right.revision.credentials.length && left.revision.credentials.every((entry) => right.revision.credentials.some((other) => other.credentialId === entry.credentialId && other.revision === entry.revision)) && left.identifierBindingRevision === right.identifierBindingRevision && sameIdentifier(left.identifier, right.identifier) && Redacted.value(left.verifier) === Redacted.value(right.verifier);
+	const evidenceSatisfiedAt = (evidence, requirement, now) => {
+		if (evidence.proofs.length > 64 || evidence.revision.credentials.length > 64) return false;
+		const revisions = /* @__PURE__ */ new Map();
+		for (const item of evidence.revision.credentials) {
+			if (revisions.has(item.credentialId)) return false;
+			revisions.set(item.credentialId, item.revision);
+		}
+		if (evidence.proofs.some((proof) => !revisions.has(proof.credentialId))) return false;
+		if (evidence.proofs.some((proof) => now < DateTime.toEpochMillis(proof.verifiedAt))) return false;
+		const eligible = evidence.proofs.filter((proof) => {
+			const age = now - DateTime.toEpochMillis(proof.verifiedAt);
+			return age >= 0 && age < requirement.maximumAgeMillis;
+		});
+		const factors = new Set(eligible.flatMap((proof) => proof.factors));
+		const credentials = new Set(eligible.map((proof) => proof.credentialId));
+		return requirement.alternatives.some((alternative) => alternative.factors.every((factor) => factors.has(factor)) && credentials.size >= alternative.minimumCredentials && eligible.some((proof) => (!alternative.userVerified || proof.userVerified) && (!alternative.phishingResistant || proof.phishingResistant)));
+	};
+	const snapshotMutationInput = Effect.fn("DrizzlePassword.snapshotMutationInput")(function* (input) {
+		const expectedRevision = snapshotPasswordRevision(input.expectedRevision);
+		const evidence = yield* snapshotAuthenticationEvidence(input.authorization.evidence).pipe(Effect.mapError(unavailable));
+		const requirement = yield* snapshotPasswordRequirement(input.authorization.requirement);
+		const credential = input.credential === void 0 ? void 0 : yield* snapshotPasswordCredential(input.credential);
+		return Object.freeze({
+			...input,
+			expectedRevision,
+			replacement: Object.freeze({
+				verifier: Redacted.make(Redacted.value(input.replacement.verifier)),
+				normalization: input.replacement.normalization
+			}),
+			invalidation: Object.freeze({ ...input.invalidation }),
+			...credential === void 0 ? {} : { credential },
+			authorization: Object.freeze({
+				challenge: Object.freeze({
+					...input.authorization.challenge,
+					revision: snapshotPasswordRevision(input.authorization.challenge.revision)
+				}),
+				evidence,
+				requirement
+			})
+		});
+	});
+	const lockSubject = Effect.fn("DrizzlePassword.lockSubject")(function* (mapping, subjectId, locking) {
+		const database = yield* CurrentPasswordSql;
+		const nativeSubjectId = yield* mapping.subjectId.toNative(subjectId);
+		const c = subjectColumns(mapping);
+		return {
+			nativeSubjectId,
+			row: (yield* selectRows(database.select().from(mapping.subject.table).where(eq(c.id, nativeSubjectId)).limit(1), locking))[0]
+		};
+	});
+	const lockIdentifier = Effect.fn("Drizzle.lockIdentifier")(function* (mapping, identifier, locking) {
+		const database = yield* CurrentPasswordSql;
+		const c = identifierColumns(mapping);
+		return yield* selectRows(database.select().from(mapping.identifier.table).where(and(eq(c.namespace, identifier.namespace), eq(c.value, identifier.value))).limit(1), locking);
+	});
+	const readPasswordCredential = Effect.fn("Drizzle.readPasswordCredential")(function* (mapping, moduleId, nativeSubjectId, locking) {
+		const database = yield* CurrentPasswordSql;
+		const c = credentialColumns(mapping);
+		return yield* selectRows(database.select().from(mapping.credential.table).where(and(eq(c.moduleId, moduleId), eq(c.subjectId, nativeSubjectId))).limit(1), locking);
+	});
+	const resolveCredential = Effect.fn("DrizzlePassword.resolveCredential")(function* (mapping, moduleId, identifier, requestedSubjectId, locking) {
+		const database = yield* CurrentPasswordSql;
+		const discovered = (yield* lockIdentifier(mapping, identifier, false))[0];
+		if (discovered === void 0 || !mapping.identifier.isCurrent(discovered)) return void 0;
+		const discoveredNative = discovered[mapping.identifier.subjectId];
+		const subject = (yield* selectRows(database.select().from(mapping.subject.table).where(eq(subjectColumns(mapping).id, discoveredNative)).limit(1), locking))[0];
+		if (subject === void 0 || !mapping.subject.isActiveStatus(subject[mapping.subject.status])) return void 0;
+		const identifierRow = (yield* lockIdentifier(mapping, identifier, locking))[0];
+		if (identifierRow === void 0 || !mapping.identifier.isCurrent(identifierRow) || !mapping.subjectId.equals(discoveredNative, identifierRow[mapping.identifier.subjectId])) return void 0;
+		const subjectId = yield* mapping.subjectId.toSubject(discoveredNative);
+		if (requestedSubjectId !== void 0 && requestedSubjectId !== subjectId) return void 0;
+		const credential = (yield* readPasswordCredential(mapping, moduleId, discoveredNative, locking))[0];
+		if (credential === void 0) return {
+			nativeSubjectId: discoveredNative,
+			subject,
+			identifier: identifierRow
+		};
+		return {
+			nativeSubjectId: discoveredNative,
+			subject,
+			identifier: identifierRow,
+			credential,
+			snapshot: yield* mapping.credential.decode({
+				moduleId,
+				subject,
+				identifier: identifierRow,
+				credential
+			}).pipe(Effect.flatMap(snapshotPasswordCredential))
+		};
+	});
+	const scopeEntries = (keys, policy) => {
+		const values = [{
+			kind: "action",
+			key: keys.action,
+			...policy.action
+		}, {
+			kind: "identifier",
+			key: keys.identifier,
+			...policy.identifier
+		}];
+		if (keys.subject !== void 0) values.push({
+			kind: "subject",
+			key: keys.subject,
+			...policy.subject
+		});
+		return values;
+	};
+	const lockScope = Effect.fn("DrizzlePassword.lockScope")(function* (mapping, configuration, moduleId, action, entry) {
+		const database = yield* CurrentPasswordSql;
+		const query = database.insert(mapping.rateScope.table).values(mapping.rateScope.encodeInsert({
+			moduleId,
+			action,
+			scopeKind: entry.kind,
+			scopeKey: entry.key
+		}));
+		yield* configuration.insertIfAbsent(query, mapping.rateScope.scopeKey, entry.key);
+		const c = scopeColumns(mapping);
+		yield* selectRows(database.select().from(mapping.rateScope.table).where(and(eq(c.moduleId, moduleId), eq(c.action, action), eq(c.scopeKind, entry.kind), eq(c.scopeKey, entry.key))).limit(1), configuration.locking);
+	});
+	const scopeAdmits = Effect.fn("DrizzlePassword.scopeAdmits")(function* (mapping, moduleId, action, entry, policy, identifier, nativeSubjectId, now) {
+		const database = yield* CurrentPasswordSql;
+		const c = chargeColumns(mapping);
+		if ((yield* selectRows(database.select({ attemptId: c.attemptId }).from(mapping.charge.table).where(and(eq(c.moduleId, moduleId), eq(c.action, action), eq(c.scopeKind, entry.kind), eq(c.scopeKey, entry.key), gte(c.occurredAt, mapping.encodeInstant(now - entry.windowMillis)))).limit(entry.limit), true)).length >= entry.limit) return false;
+		const a = attemptColumns(mapping);
+		const pendingWhere = entry.kind === "action" ? and(eq(a.moduleId, moduleId), eq(a.action, action), eq(a.state, "pending")) : entry.kind === "identifier" ? and(eq(a.moduleId, moduleId), eq(a.action, action), eq(a.identifierNamespace, identifier.namespace), eq(a.identifierValue, identifier.value), eq(a.state, "pending")) : and(eq(a.moduleId, moduleId), eq(a.action, action), eq(a.subjectId, nativeSubjectId), eq(a.state, "pending"));
+		return (yield* selectRows(database.select({ attemptId: a.attemptId }).from(mapping.attempt.table).where(pendingWhere).limit(policy.maximumPending), true)).length < policy.maximumPending;
+	});
+	const insertCharge = Effect.fn("Drizzle.insertCharge")(function* (mapping, moduleId, action, entry, attemptId, now) {
+		return yield* (yield* CurrentPasswordSql).insert(mapping.charge.table).values(mapping.charge.encodeInsert({
+			moduleId,
+			action,
+			scopeKind: entry.kind,
+			scopeKey: entry.key,
+			attemptId,
+			occurredAtMillis: now,
+			retentionUntilMillis: now + entry.windowMillis
+		}));
+	});
+	const owned = (database, mapping, configuration, body) => {
+		if (!validConstraints(mapping)) return Effect.fail(unavailable());
+		const run = coordinateCommit(() => database.transaction((transaction) => body.pipe(Effect.provideService(CurrentPasswordSql, transaction), Effect.provideService(CurrentProofSql, transaction))), { mode: configuration.mode }).pipe(Effect.map((result) => result.value));
+		return configuration.coordinated !== true ? Effect.gen(function* () {
+			if (yield* hasCommitScope) return yield* unavailable();
+			yield* configuration.standaloneGuard;
+			return yield* run;
+		}) : run;
+	};
+	const safeRead = (database, configuration, body) => Effect.gen(function* () {
+		if (configuration.coordinated !== true) {
+			if (yield* hasCommitScope) return yield* unavailable();
+			yield* configuration.standaloneGuard;
+		}
+		return yield* database.transaction((transaction) => body.pipe(Effect.provideService(CurrentPasswordSql, transaction), Effect.provideService(CurrentProofSql, transaction)));
+	});
+	const proofCompletionMatchesPassword = (input) => {
+		const completion = input.completion.input;
+		const binding = completion.binding;
+		if (completion.moduleId !== `${input.moduleId}/reset` || completion.purpose !== "password-reset" || binding._tag !== "Subject" || input.credential === void 0 || binding.revision.subjectId !== input.expectedRevision.subjectId || binding.revision.securityRevision !== input.expectedRevision.securityRevision || !sameIdentifier(binding.identifier, input.credential.identifier)) return false;
+		const expected = [...input.expectedRevision.credentials].sort((left, right) => left.credentialId.localeCompare(right.credentialId));
+		const actual = [...binding.revision.credentials].sort((left, right) => left.credentialId.localeCompare(right.credentialId));
+		return expected.length === actual.length && expected.every((item, index) => item.credentialId === actual[index].credentialId && item.revision === actual[index].revision);
+	};
+	const probeProofCompletion = Effect.fn("Drizzle.probeProofCompletion")(function* (configuration, input) {
+		const database = yield* CurrentPasswordSql;
+		if (configuration.proof === void 0) return yield* Effect.fail(unavailable());
+		const validProbe = { _tag: "PasswordProofCompletionValid" };
+		const plan = {
+			input,
+			prepare: (decision, journal, project) => journal.prepare(project(decision))
+		};
+		const probe = coordinateCommit(() => database.transaction((transaction) => completeProofPlanIn(configuration.proof.mapping, configuration.proof.configuration, plan, Effect.fail(validProbe), () => false).pipe(Effect.provideService(CurrentProofSql, transaction))), { mode: configuration.mode });
+		if (configuration.coordinated === true || (yield* hasCommitScope)) return yield* unavailable();
+		yield* configuration.standaloneGuard;
+		return yield* probe.pipe(Effect.as(false), Effect.catchCause((cause) => {
+			const reason = cause.reasons[0];
+			return cause.reasons.length === 1 && reason !== void 0 && Cause.isFailReason(reason) && reason.error === validProbe ? Effect.succeed(true) : Effect.failCause(cause);
+		}));
+	});
+	const validateMutationAuthority = Effect.fn("DrizzlePassword.validateMutationAuthority")(function* (mapping, configuration, input, action) {
+		const database = yield* CurrentPasswordSql;
+		const locked = yield* lockSubject(mapping, input.expectedRevision.subjectId, configuration.locking);
+		const row = locked.row;
+		if (row === void 0 || !mapping.subject.isActiveStatus(row[mapping.subject.status]) || row[mapping.subject.securityRevision] !== input.expectedRevision.securityRevision) return void 0;
+		if (input.authorization.challenge.moduleId !== input.moduleId || input.authorization.challenge.action !== action || input.authorization.challenge.commandId !== input.commandId || input.authorization.challenge.revision.subjectId !== input.expectedRevision.subjectId || input.authorization.challenge.revision.securityRevision !== input.expectedRevision.securityRevision || input.authorization.evidence.flowId !== input.commandId || input.authorization.evidence.bindingDigest !== input.authorization.challenge.bindingDigest || input.authorization.evidence.revision.subjectId !== input.expectedRevision.subjectId || input.authorization.evidence.revision.securityRevision !== input.expectedRevision.securityRevision || action === "add-password" && (input.credential !== void 0 || input.authorization.challenge.targetCredentialId !== void 0)) return void 0;
+		if (input.expectedRevision.credentials.some((expected) => !input.authorization.evidence.revision.credentials.some((actual) => actual.credentialId === expected.credentialId && actual.revision === expected.revision))) return void 0;
+		if (input.credential !== void 0) {
+			const identifier = (yield* lockIdentifier(mapping, input.credential.identifier, configuration.locking))[0];
+			if (identifier === void 0 || !mapping.identifier.isCurrent(identifier) || !mapping.subjectId.equals(identifier[mapping.identifier.subjectId], locked.nativeSubjectId) || identifier[mapping.identifier.bindingRevision] !== input.credential.identifierBindingRevision) return void 0;
+		}
+		const allExpected = [...input.expectedRevision.credentials, ...input.authorization.evidence.revision.credentials];
+		const expected = new Map(allExpected.map((item) => [item.credentialId, item]));
+		const ac = authorityCredentialColumns(mapping);
+		const credentialRows = expected.size === 0 ? [] : yield* selectRows(database.select().from(mapping.authorityCredential.table).where(and(eq(ac.subjectId, locked.nativeSubjectId), inArray(ac.credentialId, [...expected.keys()]))).orderBy(ac.credentialId), configuration.locking);
+		if (credentialRows.length !== expected.size) return void 0;
+		for (const actual of credentialRows) {
+			const wanted = expected.get(actual[mapping.authorityCredential.credentialId]);
+			if (wanted === void 0 || actual[mapping.authorityCredential.revision] !== wanted.revision || mapping.authorityCredential.status !== void 0 && mapping.authorityCredential.isActiveStatus?.(actual[mapping.authorityCredential.status]) !== true) return void 0;
+			expected.delete(wanted.credentialId);
+		}
+		if (expected.size !== 0) return void 0;
+		if (input.credential !== void 0) {
+			const identifier = (yield* lockIdentifier(mapping, input.credential.identifier, false))[0];
+			const credential = (yield* readPasswordCredential(mapping, input.moduleId, locked.nativeSubjectId, configuration.locking))[0];
+			if (identifier === void 0 || credential === void 0) return void 0;
+			const snapshot = yield* mapping.credential.decode({
+				moduleId: input.moduleId,
+				subject: row,
+				identifier,
+				credential
+			});
+			if (!sameCredentialSnapshot(snapshot, input.credential)) return void 0;
+		}
+		const currentRequirement = yield* mapping.subject.decodeActionRequirement(row, action);
+		const now = yield* nowMillis;
+		if (!evidenceSatisfiedAt(input.authorization.evidence, input.authorization.requirement, now) || !evidenceSatisfiedAt(input.authorization.evidence, currentRequirement, now)) return void 0;
+		if (input.invalidation.existingSessions === "immediate" && mapping.sessionInvalidation !== "same-authority-immediate") return void 0;
+		return {
+			...locked,
+			now
+		};
+	});
+	const commandExists = Effect.fn("Drizzle.commandExists")(function* (mapping, moduleId, commandId, locking) {
+		const database = yield* CurrentPasswordSql;
+		const c = commandColumns(mapping);
+		return yield* selectRows(database.select().from(mapping.command.table).where(and(eq(c.moduleId, moduleId), eq(c.commandId, commandId))).limit(1), locking);
+	});
+	const insertCommand = Effect.fn("Drizzle.insertCommand")(function* (mapping, input, action, now) {
+		return yield* (yield* CurrentPasswordSql).insert(mapping.command.table).values(mapping.command.encodeInsert({
+			moduleId: input.moduleId,
+			commandId: input.commandId,
+			action,
+			bindingDigest: input.authorization.challenge.bindingDigest,
+			decision: "changed",
+			retentionUntilMillis: now + mapping.commandRetentionMillis
+		}));
+	});
+	const mutationPostconditions = Effect.fn("DrizzlePassword.mutationPostconditions")(function* (mapping, input, nativeSubjectId, subject, authorityCredential, now) {
+		if (subject === void 0 || !mapping.subject.isActiveStatus(subject[mapping.subject.status]) || authorityCredential === void 0 || mapping.authorityCredential.status !== void 0 && mapping.authorityCredential.isActiveStatus?.(authorityCredential[mapping.authorityCredential.status]) !== true) return false;
+		if (input.credential !== void 0) {
+			const identifier = (yield* lockIdentifier(mapping, input.credential.identifier, false))[0];
+			if (identifier === void 0 || !mapping.identifier.isCurrent(identifier) || !mapping.subjectId.equals(identifier[mapping.identifier.subjectId], nativeSubjectId) || identifier[mapping.identifier.bindingRevision] !== input.credential.identifierBindingRevision) return false;
+			const credential = (yield* readPasswordCredential(mapping, input.moduleId, nativeSubjectId, false))[0];
+			if (credential === void 0) return false;
+			if ((yield* mapping.credential.decode({
+				moduleId: input.moduleId,
+				subject,
+				identifier,
+				credential
+			})).identifierVerifiedAtMillis !== input.credential.identifierVerifiedAtMillis) return false;
+		}
+		const rows = yield* commandExists(mapping, input.moduleId, input.commandId, false);
+		const row = rows[0];
+		return rows.length === 1 && row[mapping.command.action] === input.authorization.challenge.action && row[mapping.command.bindingDigest] === input.authorization.challenge.bindingDigest && row[mapping.command.decision] === "changed" && (yield* mapping.decodeInstant(row[mapping.command.retentionUntil])) === now + mapping.commandRetentionMillis;
+	});
+	const addPasswordIn = Effect.fn("DrizzlePassword.addPasswordIn")(function* (mapping, configuration, input, revisions, commandNow) {
+		const database = yield* CurrentPasswordSql;
+		const { credentialId, credentialRevision, verifierVersion, nextSecurityRevision } = revisions;
+		const authority = yield* validateMutationAuthority(mapping, configuration, input, "add-password");
+		if (authority === void 0) return false;
+		if ((yield* commandExists(mapping, input.moduleId, input.commandId, true)).length) return false;
+		if ((yield* readPasswordCredential(mapping, input.moduleId, authority.nativeSubjectId, true)).length) return false;
+		yield* database.insert(mapping.credential.table).values(mapping.credential.encodeInsert({
+			moduleId: input.moduleId,
+			subjectId: authority.nativeSubjectId,
+			credentialId,
+			credentialRevision,
+			verifierVersion,
+			replacement: input.replacement
+		}));
+		yield* database.insert(mapping.authorityCredential.table).values(mapping.authorityCredential.encodeInsert({
+			subjectId: authority.nativeSubjectId,
+			credentialId,
+			revision: credentialRevision
+		}));
+		yield* database.update(mapping.subject.table).set(updateValues([[mapping.subject.securityRevision, nextSecurityRevision]])).where(and(eq(subjectColumns(mapping).id, authority.nativeSubjectId), eq(subjectColumns(mapping).securityRevision, input.expectedRevision.securityRevision)));
+		yield* insertCommand(mapping, input, "add-password", commandNow ?? authority.now);
+		const inserted = (yield* readPasswordCredential(mapping, input.moduleId, authority.nativeSubjectId, false))[0];
+		const authorityInserted = (yield* database.select().from(mapping.authorityCredential.table).where(and(eq(authorityCredentialColumns(mapping).subjectId, authority.nativeSubjectId), eq(authorityCredentialColumns(mapping).credentialId, credentialId), eq(authorityCredentialColumns(mapping).revision, credentialRevision))).limit(1))[0];
+		const subjectUpdated = (yield* database.select().from(mapping.subject.table).where(and(eq(subjectColumns(mapping).id, authority.nativeSubjectId), eq(subjectColumns(mapping).securityRevision, nextSecurityRevision))).limit(1))[0];
+		if (inserted === void 0 || inserted[mapping.credential.credentialId] !== credentialId || inserted[mapping.credential.credentialRevision] !== credentialRevision || inserted[mapping.credential.verifierVersion] !== verifierVersion || inserted[mapping.credential.verifier] !== Redacted.value(input.replacement.verifier) || inserted[mapping.credential.normalization] !== input.replacement.normalization || authorityInserted === void 0 || subjectUpdated === void 0 || !(yield* mutationPostconditions(mapping, input, authority.nativeSubjectId, subjectUpdated, authorityInserted, commandNow ?? authority.now))) return yield* unavailable();
+		return true;
+	});
+	const makeSqlPasswordPersistence = Effect.fn("makeSqlPasswordPersistence")(function* (database, mapping, configuration) {
+		const hooks = yield* LifecycleHooks;
+		return PasswordPersistence.of({
+			admitAttempt: (input, prepare) => Effect.gen(function* () {
+				const attemptId = yield* allocate(configuration.mode, mapping.allocateAttemptId, mapping.allocateAttemptIdSync);
+				return yield* owned(database, mapping, configuration, Effect.gen(function* () {
+					const transaction = yield* CurrentPasswordSql;
+					const journal = yield* CurrentCommitJournal;
+					const resolved = yield* resolveCredential(mapping, input.moduleId, input.identifier, input.subjectId, configuration.locking);
+					const keys = mapping.scopeKeys({
+						moduleId: input.moduleId,
+						action: input.action,
+						identifier: input.identifier,
+						...resolved === void 0 ? {} : { subjectId: resolved.snapshot?.revision.subjectId }
+					});
+					const scopes = scopeEntries(keys, input.policy);
+					const admitted = [];
+					yield* lockScope(mapping, configuration, input.moduleId, input.action, scopes[0]);
+					let currentNow = yield* nowMillis;
+					if (yield* scopeAdmits(mapping, input.moduleId, input.action, scopes[0], input.policy, input.identifier, resolved?.nativeSubjectId, currentNow)) admitted.push(scopes[0]);
+					if (admitted.length === 1) for (const entry of scopes.slice(1)) {
+						yield* lockScope(mapping, configuration, input.moduleId, input.action, entry);
+						currentNow = yield* nowMillis;
+						if (yield* scopeAdmits(mapping, input.moduleId, input.action, entry, input.policy, input.identifier, resolved?.nativeSubjectId, currentNow)) admitted.push(entry);
+					}
+					const now = yield* nowMillis;
+					for (const entry of admitted) yield* insertCharge(mapping, input.moduleId, input.action, entry, attemptId, now);
+					if (admitted.length !== scopes.length) return prepare({ _tag: "Denied" }, journal);
+					const snapshot = resolved?.snapshot;
+					const deadline = now + input.policy.attemptLifetimeMillis;
+					const retentionUntil = Math.max(deadline, ...scopes.map((entry) => now + entry.windowMillis));
+					yield* transaction.insert(mapping.attempt.table).values(mapping.attempt.encodeInsert({
+						moduleId: input.moduleId,
+						action: input.action,
+						attemptId,
+						identifier: input.identifier,
+						...snapshot === void 0 ? {} : {
+							subjectId: snapshot.revision.subjectId,
+							credentialId: snapshot.credentialId,
+							securityRevision: snapshot.revision.securityRevision,
+							credentialRevision: snapshot.credentialRevision,
+							verifierVersion: snapshot.verifierVersion,
+							identifierBindingRevision: snapshot.identifierBindingRevision
+						},
+						admittedAtMillis: now,
+						deadlineMillis: deadline,
+						retentionUntilMillis: retentionUntil
+					}, {
+						...resolved?.nativeSubjectId === void 0 ? {} : { nativeSubjectId: resolved.nativeSubjectId },
+						state: "pending"
+					}));
+					return prepare({
+						_tag: "Admitted",
+						attemptId,
+						...snapshot === void 0 ? {} : { credential: snapshot }
+					}, journal);
+				}));
+			}).pipe(Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
+			settleAttempt: (uncaptured, prepare) => Effect.gen(function* () {
+				const captured = uncaptured.captured === void 0 ? void 0 : yield* snapshotPasswordCredential(uncaptured.captured);
+				const input = {
+					...uncaptured,
+					...captured === void 0 ? {} : { captured }
+				};
+				return yield* owned(database, mapping, configuration, Effect.gen(function* () {
+					const transaction = yield* CurrentPasswordSql;
+					const journal = yield* CurrentCommitJournal;
+					const c = attemptColumns(mapping);
+					let row = (yield* selectRows(transaction.select().from(mapping.attempt.table).where(and(eq(c.moduleId, input.moduleId), eq(c.attemptId, input.attemptId))).limit(1), false))[0];
+					if (row === void 0 || row[mapping.attempt.state] !== "pending") return prepare("rejected", journal);
+					let decision = "rejected";
+					let current;
+					let attemptMatches = false;
+					if (input.outcome === "verified" && input.captured !== void 0) {
+						current = yield* resolveCredential(mapping, input.moduleId, input.captured.identifier, input.captured.revision.subjectId, configuration.locking);
+						attemptMatches = input.captured.moduleId === input.moduleId && row[mapping.attempt.identifierNamespace] === input.captured.identifier.namespace && row[mapping.attempt.identifierValue] === input.captured.identifier.value && mapping.subjectId.equals(row[mapping.attempt.subjectId], current?.nativeSubjectId) && row[mapping.attempt.credentialId] === input.captured.credentialId && row[mapping.attempt.securityRevision] === input.captured.revision.securityRevision && row[mapping.attempt.credentialRevision] === input.captured.credentialRevision && row[mapping.attempt.verifierVersion] === input.captured.verifierVersion && row[mapping.attempt.identifierBindingRevision] === input.captured.identifierBindingRevision;
+					}
+					row = (yield* selectRows(transaction.select().from(mapping.attempt.table).where(and(eq(c.moduleId, input.moduleId), eq(c.attemptId, input.attemptId))).limit(1), configuration.locking))[0];
+					if (row === void 0 || row[mapping.attempt.state] !== "pending") return prepare("rejected", journal);
+					const now = yield* nowMillis;
+					const deadline = yield* mapping.decodeInstant(row[mapping.attempt.deadline]);
+					if (attemptMatches && current?.snapshot !== void 0 && input.captured !== void 0 && deadline > now && sameCredentialSnapshot(current.snapshot, input.captured)) decision = "verified";
+					const prepared = prepare(decision, journal);
+					yield* transaction.update(mapping.attempt.table).set(updateValues([[mapping.attempt.state, decision]])).where(and(eq(c.moduleId, input.moduleId), eq(c.attemptId, input.attemptId), eq(c.state, "pending")));
+					if (decision === "verified" && input.rehash !== void 0 && current?.snapshot !== void 0) {
+						const cc = credentialColumns(mapping);
+						const nextVersion = yield* allocate(configuration.mode, mapping.allocateRevision, mapping.allocateRevisionSync);
+						yield* transaction.update(mapping.credential.table).set(mapping.credential.encodeVerifier(input.rehash.nextVerifier, nextVersion)).where(and(eq(cc.moduleId, input.moduleId), eq(cc.subjectId, current.nativeSubjectId), eq(cc.credentialId, current.snapshot.credentialId), eq(cc.credentialRevision, current.snapshot.credentialRevision), eq(cc.verifierVersion, input.rehash.expectedVersion), eq(cc.verifier, Redacted.value(input.rehash.expectedVerifier))));
+					}
+					return prepared;
+				}));
+			}).pipe(Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
+			readForSubject: (input) => safeRead(database, configuration, Effect.gen(function* () {
+				const transaction = yield* CurrentPasswordSql;
+				const locked = yield* lockSubject(mapping, input.subjectId, false);
+				if (locked.row === void 0 || !mapping.subject.isActiveStatus(locked.row[mapping.subject.status])) return Option.none();
+				const credential = (yield* readPasswordCredential(mapping, input.moduleId, locked.nativeSubjectId, false))[0];
+				if (credential === void 0) return Option.none();
+				const ic = identifierColumns(mapping);
+				const identifier = (yield* transaction.select().from(mapping.identifier.table).where(eq(ic.subjectId, locked.nativeSubjectId))).find((row) => mapping.identifier.isCurrent(row));
+				if (identifier === void 0) return Option.none();
+				const snapshot = yield* mapping.credential.decode({
+					moduleId: input.moduleId,
+					subject: locked.row,
+					identifier,
+					credential
+				}).pipe(Effect.flatMap(snapshotPasswordCredential));
+				return Option.some(snapshot);
+			})).pipe(Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
+			recoveryTarget: (input) => safeRead(database, configuration, Effect.gen(function* () {
+				const resolved = yield* resolveCredential(mapping, input.moduleId, input.identifier, void 0, false);
+				return resolved?.snapshot === void 0 || resolved.snapshot.identifierVerifiedAtMillis === void 0 ? Option.none() : Option.some(resolved.snapshot);
+			})).pipe(Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
+			addIfAbsent: (uncaptured, prepare) => Effect.gen(function* () {
+				const input = yield* snapshotMutationInput(uncaptured);
+				const credentialId = yield* allocate(configuration.mode, mapping.allocateCredentialId, mapping.allocateCredentialIdSync);
+				const credentialRevision = yield* allocate(configuration.mode, mapping.allocateRevision, mapping.allocateRevisionSync);
+				const verifierVersion = yield* allocate(configuration.mode, mapping.allocateRevision, mapping.allocateRevisionSync);
+				const nextSecurityRevision = yield* allocateNextSecurityRevision(mapping, configuration.mode, input.expectedRevision.securityRevision);
+				if (nextSecurityRevision === input.expectedRevision.securityRevision) return yield* unavailable();
+				return yield* owned(database, mapping, configuration, Effect.gen(function* () {
+					const journal = yield* CurrentCommitJournal;
+					return prepare((yield* addPasswordIn(mapping, configuration, input, {
+						credentialId,
+						credentialRevision,
+						verifierVersion,
+						nextSecurityRevision
+					})) ? "changed" : "rejected", journal);
+				}));
+			}).pipe(Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
+			replaceIfCurrent: (uncaptured, prepare) => Effect.gen(function* () {
+				const input = yield* snapshotMutationInput(uncaptured);
+				const credentialRevision = yield* allocate(configuration.mode, mapping.allocateRevision, mapping.allocateRevisionSync);
+				const verifierVersion = yield* allocate(configuration.mode, mapping.allocateRevision, mapping.allocateRevisionSync);
+				const nextSecurityRevision = yield* allocateNextSecurityRevision(mapping, configuration.mode, input.expectedRevision.securityRevision);
+				if (nextSecurityRevision === input.expectedRevision.securityRevision || input.credential !== void 0 && credentialRevision === input.credential.credentialRevision) return yield* unavailable();
+				return yield* owned(database, mapping, configuration, Effect.gen(function* () {
+					return yield* replaceIn(mapping, configuration, input, "change-password", {
+						credentialRevision,
+						verifierVersion,
+						nextSecurityRevision
+					}, prepare);
+				}));
+			}).pipe(Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
+			checkReset: (input) => (configuration.proof === void 0 ? Effect.fail(unavailable()) : Effect.gen(function* () {
+				if (input.moduleId.length <= 6 || !input.moduleId.endsWith("/reset") || input.purpose !== "password-reset" || input.binding._tag !== "Subject") return false;
+				const binding = input.binding;
+				const passwordModuleId = input.moduleId.slice(0, -6);
+				return (yield* safeRead(database, configuration, Effect.gen(function* () {
+					const resolved = yield* resolveCredential(mapping, passwordModuleId, binding.identifier, binding.revision.subjectId, false);
+					return resolved?.snapshot !== void 0 && resolved.snapshot.revision.securityRevision === binding.revision.securityRevision && binding.revision.credentials.every((item) => resolved.snapshot.revision.credentials.some((actual) => actual.credentialId === item.credentialId && actual.revision === item.revision));
+				}))) ? yield* probeProofCompletion(configuration, input) : false;
+			})).pipe(Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
+			resetWithProof: (uncaptured, prepare) => (configuration.proof === void 0 ? Effect.fail(unavailable()) : Effect.gen(function* () {
+				const input = Object.freeze({
+					...yield* snapshotMutationInput(uncaptured),
+					completion: uncaptured.completion
+				});
+				const credentialRevision = yield* allocate(configuration.mode, mapping.allocateRevision, mapping.allocateRevisionSync);
+				const verifierVersion = yield* allocate(configuration.mode, mapping.allocateRevision, mapping.allocateRevisionSync);
+				const nextSecurityRevision = yield* allocateNextSecurityRevision(mapping, configuration.mode, input.expectedRevision.securityRevision);
+				if (nextSecurityRevision === input.expectedRevision.securityRevision || input.credential !== void 0 && credentialRevision === input.credential.credentialRevision) return yield* unavailable();
+				return yield* owned(database, mapping, configuration, Effect.gen(function* () {
+					const journal = yield* CurrentCommitJournal;
+					if (!proofCompletionMatchesPassword(input)) return prepare("rejected", journal);
+					const authority = yield* validateMutationAuthority(mapping, configuration, input, "reset-password");
+					if (authority === void 0) return prepare("rejected", journal);
+					if ((yield* commandExists(mapping, input.moduleId, input.commandId, true)).length) return prepare("rejected", journal);
+					if (!(yield* currentExpectedCredential(mapping, input, authority.nativeSubjectId))) return prepare("rejected", journal);
+					let passwordReceipt;
+					yield* completeProofPlanIn(configuration.proof.mapping, configuration.proof.configuration, input.completion, Effect.gen(function* () {
+						return yield* writeReplacement(mapping, input, authority.nativeSubjectId, {
+							credentialRevision,
+							verifierVersion,
+							nextSecurityRevision
+						}, authority.now);
+					}), (decision) => {
+						passwordReceipt = prepare(decision === "completed" ? "changed" : "rejected", journal);
+						return decision;
+					});
+					return passwordReceipt ?? prepare("rejected", journal);
+				}));
+			})).pipe(Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
+			cleanupAttempts: (input, prepare) => owned(database, mapping, configuration, Effect.gen(function* () {
+				const transaction = yield* CurrentPasswordSql;
+				const journal = yield* CurrentCommitJournal;
+				const now = yield* nowMillis;
+				const nativeNow = mapping.encodeInstant(now);
+				let remaining = input.limit;
+				let hasMore = false;
+				const a = attemptColumns(mapping);
+				const c = chargeColumns(mapping);
+				const attempts = yield* selectRows(transaction.select({ attemptId: a.attemptId }).from(mapping.attempt.table).where(and(eq(a.moduleId, input.moduleId), lte(a.retentionUntil, nativeNow))).limit(remaining + 1), false);
+				if (attempts.length > remaining) hasMore = true;
+				const attemptCandidates = attempts.slice(0, remaining);
+				remaining -= attemptCandidates.length;
+				const charges = yield* selectRows(transaction.select({
+					action: c.action,
+					scopeKind: c.scopeKind,
+					scopeKey: c.scopeKey,
+					attemptId: c.attemptId
+				}).from(mapping.charge.table).where(and(eq(c.moduleId, input.moduleId), lte(c.retentionUntil, nativeNow))).limit(remaining + 1), false);
+				if (charges.length > remaining) hasMore = true;
+				const chargeCandidates = charges.slice(0, remaining);
+				remaining -= chargeCandidates.length;
+				const sc = scopeColumns(mapping);
+				const scopes = yield* selectRows(transaction.select({
+					action: sc.action,
+					scopeKind: sc.scopeKind,
+					scopeKey: sc.scopeKey
+				}).from(mapping.rateScope.table).where(and(eq(sc.moduleId, input.moduleId), notExists(transaction.select({ one: sql`1` }).from(mapping.charge.table).where(and(eq(c.moduleId, sc.moduleId), eq(c.action, sc.action), eq(c.scopeKind, sc.scopeKind), eq(c.scopeKey, sc.scopeKey)))))).limit(remaining + 1), remaining === 0 ? false : configuration.locking);
+				if (scopes.length > remaining) hasMore = true;
+				const selectedScopes = scopes.slice(0, remaining);
+				remaining -= selectedScopes.length;
+				const selectedCharges = [];
+				for (const candidate of chargeCandidates) {
+					const locked = yield* selectRows(transaction.select({
+						action: c.action,
+						scopeKind: c.scopeKind,
+						scopeKey: c.scopeKey,
+						attemptId: c.attemptId
+					}).from(mapping.charge.table).where(and(eq(c.moduleId, input.moduleId), eq(c.action, candidate.action), eq(c.scopeKind, candidate.scopeKind), eq(c.scopeKey, candidate.scopeKey), eq(c.attemptId, candidate.attemptId), lte(c.retentionUntil, nativeNow))).limit(1), configuration.locking);
+					if (locked[0] !== void 0) selectedCharges.push(locked[0]);
+				}
+				const selectedAttempts = [];
+				for (const candidate of attemptCandidates) {
+					const locked = yield* selectRows(transaction.select({ attemptId: a.attemptId }).from(mapping.attempt.table).where(and(eq(a.moduleId, input.moduleId), eq(a.attemptId, candidate.attemptId), lte(a.retentionUntil, nativeNow))).limit(1), configuration.locking);
+					if (locked[0] !== void 0) selectedAttempts.push(locked[0]);
+				}
+				const prepared = prepare({
+					removed: selectedAttempts.length + selectedCharges.length + selectedScopes.length,
+					hasMore
+				}, journal);
+				for (const row of selectedCharges) yield* transaction.delete(mapping.charge.table).where(and(eq(c.moduleId, input.moduleId), eq(c.action, row.action), eq(c.scopeKind, row.scopeKind), eq(c.scopeKey, row.scopeKey), eq(c.attemptId, row.attemptId), lte(c.retentionUntil, nativeNow)));
+				if (selectedAttempts.length > 0) yield* transaction.delete(mapping.attempt.table).where(and(eq(a.moduleId, input.moduleId), inArray(a.attemptId, selectedAttempts.map((row) => row.attemptId)), lte(a.retentionUntil, nativeNow)));
+				for (const row of selectedScopes) yield* transaction.delete(mapping.rateScope.table).where(and(eq(sc.moduleId, input.moduleId), eq(sc.action, row.action), eq(sc.scopeKind, row.scopeKind), eq(sc.scopeKey, row.scopeKey), notExists(transaction.select({ one: sql`1` }).from(mapping.charge.table).where(and(eq(c.moduleId, sc.moduleId), eq(c.action, sc.action), eq(c.scopeKind, sc.scopeKind), eq(c.scopeKey, sc.scopeKey))))));
+				return prepared;
+			})).pipe(Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure)
+		});
+	});
+	const currentExpectedCredential = Effect.fn("DrizzlePassword.currentExpectedCredential")(function* (mapping, input, nativeSubjectId) {
+		if (input.credential === void 0) return false;
+		const row = (yield* readPasswordCredential(mapping, input.moduleId, nativeSubjectId, true))[0];
+		if (row === void 0) return false;
+		return row[mapping.credential.credentialId] === input.credential.credentialId && row[mapping.credential.credentialRevision] === input.credential.credentialRevision && row[mapping.credential.verifierVersion] === input.credential.verifierVersion && row[mapping.credential.verifier] === Redacted.value(input.credential.verifier) && row[mapping.credential.normalization] === input.credential.normalization && input.authorization.challenge.targetCredentialId === input.credential.credentialId;
+	});
+	const checkMutationApplied = Effect.fn("DrizzlePassword.checkMutationApplied")(function* (mapping, input, nativeSubjectId, revisions, now) {
+		const database = yield* CurrentPasswordSql;
+		const c = credentialColumns(mapping), s = subjectColumns(mapping);
+		const credential = (yield* database.select().from(mapping.credential.table).where(and(eq(c.moduleId, input.moduleId), eq(c.subjectId, nativeSubjectId), eq(c.credentialId, revisions.credentialId), eq(c.credentialRevision, revisions.credentialRevision), eq(c.verifierVersion, revisions.verifierVersion), eq(c.verifier, Redacted.value(input.replacement.verifier)), eq(c.normalization, input.replacement.normalization))).limit(1))[0];
+		const subject = (yield* database.select().from(mapping.subject.table).where(and(eq(s.id, nativeSubjectId), eq(s.securityRevision, revisions.nextSecurityRevision))).limit(1))[0];
+		const authorityCredential = (yield* database.select().from(mapping.authorityCredential.table).where(and(eq(authorityCredentialColumns(mapping).subjectId, nativeSubjectId), eq(authorityCredentialColumns(mapping).credentialId, revisions.credentialId), eq(authorityCredentialColumns(mapping).revision, revisions.credentialRevision))).limit(1))[0];
+		return credential !== void 0 && (yield* mutationPostconditions(mapping, input, nativeSubjectId, subject, authorityCredential, now));
+	});
+	const writeReplacement = Effect.fn("DrizzlePassword.writeReplacement")(function* (mapping, input, nativeSubjectId, revisions, now) {
+		const database = yield* CurrentPasswordSql;
+		const c = credentialColumns(mapping);
+		const s = subjectColumns(mapping);
+		yield* database.update(mapping.credential.table).set(mapping.credential.encodeReplacement({
+			replacement: input.replacement,
+			credentialRevision: revisions.credentialRevision,
+			verifierVersion: revisions.verifierVersion
+		})).where(and(eq(c.moduleId, input.moduleId), eq(c.subjectId, nativeSubjectId), eq(c.credentialId, input.credential.credentialId), eq(c.credentialRevision, input.credential.credentialRevision), eq(c.verifierVersion, input.credential.verifierVersion), eq(c.verifier, Redacted.value(input.credential.verifier)), eq(c.normalization, input.credential.normalization)));
+		yield* database.update(mapping.subject.table).set(updateValues([[mapping.subject.securityRevision, revisions.nextSecurityRevision]])).where(and(eq(s.id, nativeSubjectId), eq(s.securityRevision, input.expectedRevision.securityRevision)));
+		yield* database.update(mapping.authorityCredential.table).set(mapping.authorityCredential.encodeRevision(revisions.credentialRevision)).where(and(eq(authorityCredentialColumns(mapping).subjectId, nativeSubjectId), eq(authorityCredentialColumns(mapping).credentialId, input.credential.credentialId), eq(authorityCredentialColumns(mapping).revision, input.credential.credentialRevision)));
+		yield* insertCommand(mapping, input, input.authorization.challenge.action, now);
+		return yield* checkMutationApplied(mapping, input, nativeSubjectId, {
+			...revisions,
+			credentialId: input.credential.credentialId
+		}, now);
+	});
+	const replaceIn = Effect.fn("Drizzle.replaceIn")(function* (mapping, configuration, input, action, revisions, prepare) {
+		const journal = yield* CurrentCommitJournal;
+		const authority = yield* validateMutationAuthority(mapping, configuration, input, action);
+		if (authority === void 0) return prepare("rejected", journal);
+		if ((yield* commandExists(mapping, input.moduleId, input.commandId, true)).length) return prepare("rejected", journal);
+		if (!(yield* currentExpectedCredential(mapping, input, authority.nativeSubjectId))) return prepare("rejected", journal);
+		const prepared = prepare("changed", journal);
+		if (!(yield* writeReplacement(mapping, input, authority.nativeSubjectId, revisions, authority.now))) return yield* unavailable();
+		return prepared;
+	});
+	return {
+		makeSqlPasswordPersistence,
+		passwordSqlKernel: {
+			allocate,
+			allocateNextSecurityRevision,
+			owned,
+			safeRead,
+			snapshotMutationInput,
+			lockSubject,
+			lockIdentifier,
+			readPasswordCredential,
+			resolveCredential,
+			validateMutationAuthority,
+			currentExpectedCredential,
+			commandExists,
+			addPasswordIn,
+			checkMutationApplied,
+			writeReplacement,
+			evidenceSatisfiedAt,
+			sameCredentialSnapshot,
+			subjectColumns,
+			identifierColumns,
+			credentialColumns,
+			authorityCredentialColumns,
+			proofCompletionMatchesPassword
+		}
+	};
+};
+//#endregion
+export { CurrentPasswordSql, makePasswordKernel };
+
+//# sourceMappingURL=password-kernel.mjs.map