@yielded/auth-persistence 0.1.0-beta.21 → 0.1.0-beta.23

package/dist/internal/password-kernel.mjs

@@ -1,6 +1,10 @@
 import { PersistenceMappingError } from "./mapping-error.mjs";
+import { makeNativeSqlTables, sqlMapping } from "./native-sql-table.mjs";
+import { NativeDatabase } from "./transaction-kernel.mjs";
+import { CurrentPasswordPreparedTransaction, PasswordPreparedPostconditions } from "./PasswordPreparedPostconditions.mjs";
 import { CurrentProofSql } from "./proof-kernel.mjs";
 import { requiredPasswordConstraints } from "./models/password-model.mjs";
+import { makePasswordAttempts, samePasswordCredentialSnapshot } from "./password-attempts.mjs";
 import { Cause, Context, DateTime, Effect, Option, Redacted, Schema } from "effect";
 import { CurrentCommitJournal, HookConfigurationError, LifecycleHooks, coordinateCommit, hasCommitScope } from "@yielded/auth/Hooks";
 import { snapshotAuthenticationEvidence } from "@yielded/auth/Sessions";
@@ -9,8 +13,8 @@ import { ProofUnavailable } from "@yielded/auth/Proofs";
 import { PasswordPersistence, PasswordUnavailable, snapshotPasswordCredential, snapshotPasswordRequirement, snapshotPasswordRevision } from "@yielded/auth/Password";
 //#region src/internal/password-kernel.ts
 var CurrentPasswordSql = class extends Context.Service()("effect-auth/CurrentPasswordSql") {};
-const makePasswordKernel = (operations, proofs) => {
-	const { and, eq, gt, gte, inArray, lte, notExists, sql, column, updateValues } = operations;
+const makePasswordKernel = (operations, proofs, nativeTables = (client) => makeNativeSqlTables(client)) => {
+	const { and, eq, inArray, lte, column, updateValues } = operations;
 	const { completeProofPlanIn } = proofs;
 	const unavailable = () => PasswordUnavailable.make({});
 	const translateFailure = (effect) => reportPersistenceFailure(effect, (error) => Schema.is(PasswordUnavailable)(error) || Schema.is(ProofUnavailable)(error) || Schema.is(HookConfigurationError)(error)).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));
@@ -60,21 +64,6 @@ const makePasswordKernel = (operations, proofs) => {
 		retentionUntil: column(mapping.attempt.table, mapping.attempt.retentionUntil),
 		state: column(mapping.attempt.table, mapping.attempt.state)
 	});
-	const scopeColumns = (mapping) => ({
-		moduleId: column(mapping.rateScope.table, mapping.rateScope.moduleId),
-		action: column(mapping.rateScope.table, mapping.rateScope.action),
-		scopeKind: column(mapping.rateScope.table, mapping.rateScope.scopeKind),
-		scopeKey: column(mapping.rateScope.table, mapping.rateScope.scopeKey)
-	});
-	const chargeColumns = (mapping) => ({
-		moduleId: column(mapping.charge.table, mapping.charge.moduleId),
-		action: column(mapping.charge.table, mapping.charge.action),
-		scopeKind: column(mapping.charge.table, mapping.charge.scopeKind),
-		scopeKey: column(mapping.charge.table, mapping.charge.scopeKey),
-		attemptId: column(mapping.charge.table, mapping.charge.attemptId),
-		occurredAt: column(mapping.charge.table, mapping.charge.occurredAt),
-		retentionUntil: column(mapping.charge.table, mapping.charge.retentionUntil)
-	});
 	const commandColumns = (mapping) => ({
 		moduleId: column(mapping.command.table, mapping.command.moduleId),
 		commandId: column(mapping.command.table, mapping.command.commandId),
@@ -106,7 +95,6 @@ const makePasswordKernel = (operations, proofs) => {
 		return allocate(mode, asyncValue ?? mapping.allocateRevision, syncValue ?? mapping.allocateRevisionSync);
 	};
 	const sameIdentifier = (left, right) => left.namespace === right.namespace && left.value === right.value;
-	const sameCredentialSnapshot = (left, right) => left.moduleId === right.moduleId && left.revision.subjectId === right.revision.subjectId && left.revision.securityRevision === right.revision.securityRevision && left.credentialId === right.credentialId && left.credentialRevision === right.credentialRevision && left.verifierVersion === right.verifierVersion && left.normalization === right.normalization && left.identifierVerifiedAtMillis === right.identifierVerifiedAtMillis && left.revision.credentials.length === right.revision.credentials.length && left.revision.credentials.every((entry) => right.revision.credentials.some((other) => other.credentialId === entry.credentialId && other.revision === entry.revision)) && left.identifierBindingRevision === right.identifierBindingRevision && sameIdentifier(left.identifier, right.identifier) && Redacted.value(left.verifier) === Redacted.value(right.verifier);
 	const evidenceSatisfiedAt = (evidence, requirement, now) => {
 		if (evidence.proofs.length > 64 || evidence.revision.credentials.length > 64) return false;
 		const revisions = /* @__PURE__ */ new Map();
@@ -197,54 +185,6 @@ const makePasswordKernel = (operations, proofs) => {
 			}).pipe(Effect.flatMap(snapshotPasswordCredential))
 		};
 	});
-	const scopeEntries = (keys, policy) => {
-		const values = [{
-			kind: "action",
-			key: keys.action,
-			...policy.action
-		}, {
-			kind: "identifier",
-			key: keys.identifier,
-			...policy.identifier
-		}];
-		if (keys.subject !== void 0) values.push({
-			kind: "subject",
-			key: keys.subject,
-			...policy.subject
-		});
-		return values;
-	};
-	const lockScope = Effect.fn("DrizzlePassword.lockScope")(function* (mapping, configuration, moduleId, action, entry) {
-		const database = yield* CurrentPasswordSql;
-		const query = database.insert(mapping.rateScope.table).values(mapping.rateScope.encodeInsert({
-			moduleId,
-			action,
-			scopeKind: entry.kind,
-			scopeKey: entry.key
-		}));
-		yield* configuration.insertIfAbsent(query, mapping.rateScope.scopeKey, entry.key);
-		const c = scopeColumns(mapping);
-		yield* selectRows(database.select().from(mapping.rateScope.table).where(and(eq(c.moduleId, moduleId), eq(c.action, action), eq(c.scopeKind, entry.kind), eq(c.scopeKey, entry.key))).limit(1), configuration.locking);
-	});
-	const scopeAdmits = Effect.fn("DrizzlePassword.scopeAdmits")(function* (mapping, moduleId, action, entry, policy, identifier, nativeSubjectId, now) {
-		const database = yield* CurrentPasswordSql;
-		const c = chargeColumns(mapping);
-		if ((yield* selectRows(database.select({ attemptId: c.attemptId }).from(mapping.charge.table).where(and(eq(c.moduleId, moduleId), eq(c.action, action), eq(c.scopeKind, entry.kind), eq(c.scopeKey, entry.key), gte(c.occurredAt, mapping.encodeInstant(now - entry.windowMillis)))).limit(entry.limit), true)).length >= entry.limit) return false;
-		const a = attemptColumns(mapping);
-		const pendingWhere = and(entry.kind === "action" ? and(eq(a.moduleId, moduleId), eq(a.action, action)) : entry.kind === "identifier" ? and(eq(a.moduleId, moduleId), eq(a.action, action), eq(a.identifierNamespace, identifier.namespace), eq(a.identifierValue, identifier.value)) : and(eq(a.moduleId, moduleId), eq(a.action, action), eq(a.subjectId, nativeSubjectId)), eq(a.state, "pending"), gt(a.retentionUntil, mapping.encodeInstant(now)));
-		return (yield* selectRows(database.select({ attemptId: a.attemptId }).from(mapping.attempt.table).where(pendingWhere).limit(policy.maximumPending), true)).length < policy.maximumPending;
-	});
-	const insertCharge = Effect.fn("Drizzle.insertCharge")(function* (mapping, moduleId, action, entry, attemptId, now) {
-		return yield* (yield* CurrentPasswordSql).insert(mapping.charge.table).values(mapping.charge.encodeInsert({
-			moduleId,
-			action,
-			scopeKind: entry.kind,
-			scopeKey: entry.key,
-			attemptId,
-			occurredAtMillis: now,
-			retentionUntilMillis: now + entry.windowMillis
-		}));
-	});
 	const owned = (database, mapping, configuration, body) => {
 		if (!validConstraints(mapping)) return Effect.fail(unavailable());
 		const run = coordinateCommit(() => database.transaction((transaction) => body.pipe(Effect.provideService(CurrentPasswordSql, transaction), Effect.provideService(CurrentProofSql, transaction))), { mode: configuration.mode }).pipe(Effect.map((result) => result.value));
@@ -254,6 +194,15 @@ const makePasswordKernel = (operations, proofs) => {
 			return yield* run;
 		}) : run;
 	};
+	const registerFinal = Effect.fnUntraced(function* (check) {
+		const postconditions = yield* Effect.serviceOption(PasswordPreparedPostconditions);
+		if (Option.isNone(postconditions)) return;
+		const postcondition = Effect.gen(function* () {
+			const transaction = yield* CurrentPasswordPreparedTransaction;
+			if (!(yield* check.pipe(Effect.provideService(CurrentPasswordSql, transaction)))) return yield* unavailable();
+		}).pipe(translateFailure);
+		if (!postconditions.value.register(postcondition)) return yield* unavailable();
+	});
 	const safeRead = (database, configuration, body) => Effect.gen(function* () {
 		if (configuration.coordinated !== true) {
 			if (yield* hasCommitScope) return yield* unavailable();
@@ -317,7 +266,7 @@ const makePasswordKernel = (operations, proofs) => {
 				identifier,
 				credential
 			});
-			if (!sameCredentialSnapshot(snapshot, input.credential)) return void 0;
+			if (!samePasswordCredentialSnapshot(snapshot, input.credential)) return void 0;
 		}
 		const currentRequirement = yield* mapping.subject.decodeActionRequirement(row, action);
 		const now = yield* nowMillis;
@@ -383,10 +332,9 @@ const makePasswordKernel = (operations, proofs) => {
 		}));
 		yield* database.update(mapping.subject.table).set(updateValues([[mapping.subject.securityRevision, nextSecurityRevision]])).where(and(eq(subjectColumns(mapping).id, authority.nativeSubjectId), eq(subjectColumns(mapping).securityRevision, input.expectedRevision.securityRevision)));
 		yield* insertCommand(mapping, input, "add-password", commandNow ?? authority.now);
-		const inserted = (yield* readPasswordCredential(mapping, input.moduleId, authority.nativeSubjectId, false))[0];
-		const authorityInserted = (yield* database.select().from(mapping.authorityCredential.table).where(and(eq(authorityCredentialColumns(mapping).subjectId, authority.nativeSubjectId), eq(authorityCredentialColumns(mapping).credentialId, credentialId), eq(authorityCredentialColumns(mapping).revision, credentialRevision))).limit(1))[0];
-		const subjectUpdated = (yield* database.select().from(mapping.subject.table).where(and(eq(subjectColumns(mapping).id, authority.nativeSubjectId), eq(subjectColumns(mapping).securityRevision, nextSecurityRevision))).limit(1))[0];
-		if (inserted === void 0 || inserted[mapping.credential.credentialId] !== credentialId || inserted[mapping.credential.credentialRevision] !== credentialRevision || inserted[mapping.credential.verifierVersion] !== verifierVersion || inserted[mapping.credential.verifier] !== Redacted.value(input.replacement.verifier) || inserted[mapping.credential.normalization] !== input.replacement.normalization || authorityInserted === void 0 || subjectUpdated === void 0 || !(yield* mutationPostconditions(mapping, input, authority.nativeSubjectId, subjectUpdated, authorityInserted, commandNow ?? authority.now))) return yield* unavailable();
+		const applied = checkMutationApplied(mapping, input, authority.nativeSubjectId, revisions, commandNow ?? authority.now);
+		if (!(yield* applied)) return yield* unavailable();
+		yield* registerFinal(applied);
 		return true;
 	});
 	const makeSqlPasswordPersistence = Effect.fn("makeSqlPasswordPersistence")(function* (mapping, configuration) {
@@ -396,96 +344,11 @@ const makePasswordKernel = (operations, proofs) => {
 			proof: configuration.proof?.mapping
 		}) ?? Effect.void).pipe(Effect.mapError(unavailable));
 		const hooks = yield* LifecycleHooks;
+		if (!validConstraints(mapping)) return yield* unavailable();
+		const root = yield* NativeDatabase;
+		const attempts = yield* makePasswordAttempts(yield* sqlMapping(() => nativeTables(root.$client.withoutTransforms(), root)).pipe(translateFailure), mapping, configuration);
 		return PasswordPersistence.of({
-			admitAttempt: (input, prepare) => Effect.gen(function* () {
-				const attemptId = yield* allocate(configuration.mode, mapping.allocateAttemptId, mapping.allocateAttemptIdSync);
-				return yield* owned(database, mapping, configuration, Effect.gen(function* () {
-					const transaction = yield* CurrentPasswordSql;
-					const journal = yield* CurrentCommitJournal;
-					const resolved = yield* resolveCredential(mapping, input.moduleId, input.identifier, input.subjectId, configuration.locking);
-					const keys = mapping.scopeKeys({
-						moduleId: input.moduleId,
-						action: input.action,
-						identifier: input.identifier,
-						...resolved?.snapshot === void 0 ? {} : { subjectId: resolved.snapshot.revision.subjectId }
-					});
-					const scopes = scopeEntries(keys, input.policy);
-					const admitted = [];
-					yield* lockScope(mapping, configuration, input.moduleId, input.action, scopes[0]);
-					let currentNow = yield* nowMillis;
-					if (yield* scopeAdmits(mapping, input.moduleId, input.action, scopes[0], input.policy, input.identifier, resolved?.nativeSubjectId, currentNow)) admitted.push(scopes[0]);
-					if (admitted.length === 1) for (const entry of scopes.slice(1)) {
-						yield* lockScope(mapping, configuration, input.moduleId, input.action, entry);
-						currentNow = yield* nowMillis;
-						if (yield* scopeAdmits(mapping, input.moduleId, input.action, entry, input.policy, input.identifier, resolved?.nativeSubjectId, currentNow)) admitted.push(entry);
-					}
-					const now = yield* nowMillis;
-					for (const entry of admitted) yield* insertCharge(mapping, input.moduleId, input.action, entry, attemptId, now);
-					if (admitted.length !== scopes.length) return prepare({ _tag: "Denied" }, journal);
-					const snapshot = resolved?.snapshot;
-					const deadline = now + input.policy.attemptLifetimeMillis;
-					const retentionUntil = Math.max(deadline, ...scopes.map((entry) => now + entry.windowMillis));
-					yield* transaction.insert(mapping.attempt.table).values(mapping.attempt.encodeInsert({
-						moduleId: input.moduleId,
-						action: input.action,
-						attemptId,
-						identifier: input.identifier,
-						...snapshot === void 0 ? {} : {
-							subjectId: snapshot.revision.subjectId,
-							credentialId: snapshot.credentialId,
-							securityRevision: snapshot.revision.securityRevision,
-							credentialRevision: snapshot.credentialRevision,
-							verifierVersion: snapshot.verifierVersion,
-							identifierBindingRevision: snapshot.identifierBindingRevision
-						},
-						admittedAtMillis: now,
-						deadlineMillis: deadline,
-						retentionUntilMillis: retentionUntil
-					}, {
-						...resolved?.nativeSubjectId === void 0 ? {} : { nativeSubjectId: resolved.nativeSubjectId },
-						state: "pending"
-					}));
-					return prepare({
-						_tag: "Admitted",
-						attemptId,
-						...snapshot === void 0 ? {} : { credential: snapshot }
-					}, journal);
-				}));
-			}).pipe(Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
-			settleAttempt: (uncaptured, prepare) => Effect.gen(function* () {
-				const captured = uncaptured.captured === void 0 ? void 0 : yield* snapshotPasswordCredential(uncaptured.captured);
-				const input = {
-					...uncaptured,
-					...captured === void 0 ? {} : { captured }
-				};
-				return yield* owned(database, mapping, configuration, Effect.gen(function* () {
-					const transaction = yield* CurrentPasswordSql;
-					const journal = yield* CurrentCommitJournal;
-					const c = attemptColumns(mapping);
-					let row = (yield* selectRows(transaction.select().from(mapping.attempt.table).where(and(eq(c.moduleId, input.moduleId), eq(c.attemptId, input.attemptId))).limit(1), false))[0];
-					if (row === void 0 || row[mapping.attempt.state] !== "pending") return prepare("rejected", journal);
-					let decision = "rejected";
-					let current;
-					let attemptMatches = false;
-					if (input.outcome === "verified" && input.captured !== void 0) {
-						current = yield* resolveCredential(mapping, input.moduleId, input.captured.identifier, input.captured.revision.subjectId, configuration.locking);
-						attemptMatches = input.captured.moduleId === input.moduleId && row[mapping.attempt.identifierNamespace] === input.captured.identifier.namespace && row[mapping.attempt.identifierValue] === input.captured.identifier.value && mapping.subjectId.equals(row[mapping.attempt.subjectId], current?.nativeSubjectId) && row[mapping.attempt.credentialId] === input.captured.credentialId && row[mapping.attempt.securityRevision] === input.captured.revision.securityRevision && row[mapping.attempt.credentialRevision] === input.captured.credentialRevision && row[mapping.attempt.verifierVersion] === input.captured.verifierVersion && row[mapping.attempt.identifierBindingRevision] === input.captured.identifierBindingRevision;
-					}
-					row = (yield* selectRows(transaction.select().from(mapping.attempt.table).where(and(eq(c.moduleId, input.moduleId), eq(c.attemptId, input.attemptId))).limit(1), configuration.locking))[0];
-					if (row === void 0 || row[mapping.attempt.state] !== "pending") return prepare("rejected", journal);
-					const now = yield* nowMillis;
-					const deadline = yield* mapping.decodeInstant(row[mapping.attempt.deadline]);
-					if (attemptMatches && current?.snapshot !== void 0 && input.captured !== void 0 && deadline > now && sameCredentialSnapshot(current.snapshot, input.captured)) decision = "verified";
-					const prepared = prepare(decision, journal);
-					yield* transaction.update(mapping.attempt.table).set(updateValues([[mapping.attempt.state, decision]])).where(and(eq(c.moduleId, input.moduleId), eq(c.attemptId, input.attemptId), eq(c.state, "pending")));
-					if (decision === "verified" && input.rehash !== void 0 && current?.snapshot !== void 0) {
-						const cc = credentialColumns(mapping);
-						const nextVersion = yield* allocate(configuration.mode, mapping.allocateRevision, mapping.allocateRevisionSync);
-						yield* transaction.update(mapping.credential.table).set(mapping.credential.encodeVerifier(input.rehash.nextVerifier, nextVersion)).where(and(eq(cc.moduleId, input.moduleId), eq(cc.subjectId, current.nativeSubjectId), eq(cc.credentialId, current.snapshot.credentialId), eq(cc.credentialRevision, current.snapshot.credentialRevision), eq(cc.verifierVersion, input.rehash.expectedVersion), eq(cc.verifier, Redacted.value(input.rehash.expectedVerifier))));
-					}
-					return prepared;
-				}));
-			}).pipe(Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
+			...attempts,
 			readForSubject: (input) => safeRead(database, configuration, Effect.gen(function* () {
 				const transaction = yield* CurrentPasswordSql;
 				const locked = yield* lockSubject(mapping, input.subjectId, false);
@@ -565,11 +428,14 @@ const makePasswordKernel = (operations, proofs) => {
 					if (!(yield* currentExpectedCredential(mapping, input, authority.nativeSubjectId))) return prepare("rejected", journal);
 					let passwordReceipt;
 					yield* completeProofPlanIn(configuration.proof.mapping, configuration.proof.configuration, input.completion, Effect.gen(function* () {
-						return yield* writeReplacement(mapping, input, authority.nativeSubjectId, {
+						const revisions = {
 							credentialRevision,
 							verifierVersion,
 							nextSecurityRevision
-						}, authority.now);
+						};
+						const applied = yield* writeReplacement(mapping, input, authority.nativeSubjectId, revisions, authority.now);
+						if (applied) yield* registerReplacement(mapping, input, authority.nativeSubjectId, revisions, authority.now);
+						return applied;
 					}), (decision) => {
 						passwordReceipt = prepare(decision === "completed" ? "changed" : "rejected", journal);
 						return decision;
@@ -582,54 +448,20 @@ const makePasswordKernel = (operations, proofs) => {
 				const journal = yield* CurrentCommitJournal;
 				const now = yield* nowMillis;
 				const nativeNow = mapping.encodeInstant(now);
-				let remaining = input.limit;
-				let hasMore = false;
 				const a = attemptColumns(mapping);
-				const c = chargeColumns(mapping);
-				const attempts = yield* selectRows(transaction.select({ attemptId: a.attemptId }).from(mapping.attempt.table).where(and(eq(a.moduleId, input.moduleId), lte(a.retentionUntil, nativeNow))).limit(remaining + 1), false);
-				if (attempts.length > remaining) hasMore = true;
-				const attemptCandidates = attempts.slice(0, remaining);
-				remaining -= attemptCandidates.length;
-				const charges = yield* selectRows(transaction.select({
-					action: c.action,
-					scopeKind: c.scopeKind,
-					scopeKey: c.scopeKey,
-					attemptId: c.attemptId
-				}).from(mapping.charge.table).where(and(eq(c.moduleId, input.moduleId), lte(c.retentionUntil, nativeNow))).limit(remaining + 1), false);
-				if (charges.length > remaining) hasMore = true;
-				const chargeCandidates = charges.slice(0, remaining);
-				remaining -= chargeCandidates.length;
-				const sc = scopeColumns(mapping);
-				const scopes = yield* selectRows(transaction.select({
-					action: sc.action,
-					scopeKind: sc.scopeKind,
-					scopeKey: sc.scopeKey
-				}).from(mapping.rateScope.table).where(and(eq(sc.moduleId, input.moduleId), notExists(transaction.select({ one: sql`1` }).from(mapping.charge.table).where(and(eq(c.moduleId, sc.moduleId), eq(c.action, sc.action), eq(c.scopeKind, sc.scopeKind), eq(c.scopeKey, sc.scopeKey)))))).limit(remaining + 1), remaining === 0 ? false : configuration.locking);
-				if (scopes.length > remaining) hasMore = true;
-				const selectedScopes = scopes.slice(0, remaining);
-				remaining -= selectedScopes.length;
-				const selectedCharges = [];
-				for (const candidate of chargeCandidates) {
-					const locked = yield* selectRows(transaction.select({
-						action: c.action,
-						scopeKind: c.scopeKind,
-						scopeKey: c.scopeKey,
-						attemptId: c.attemptId
-					}).from(mapping.charge.table).where(and(eq(c.moduleId, input.moduleId), eq(c.action, candidate.action), eq(c.scopeKind, candidate.scopeKind), eq(c.scopeKey, candidate.scopeKey), eq(c.attemptId, candidate.attemptId), lte(c.retentionUntil, nativeNow))).limit(1), configuration.locking);
-					if (locked[0] !== void 0) selectedCharges.push(locked[0]);
-				}
+				const attempts = yield* selectRows(transaction.select({ attemptId: a.attemptId }).from(mapping.attempt.table).where(and(eq(a.moduleId, input.moduleId), lte(a.retentionUntil, nativeNow))).limit(input.limit + 1), false);
+				const hasMore = attempts.length > input.limit;
+				const attemptCandidates = attempts.slice(0, input.limit);
 				const selectedAttempts = [];
 				for (const candidate of attemptCandidates) {
 					const locked = yield* selectRows(transaction.select({ attemptId: a.attemptId }).from(mapping.attempt.table).where(and(eq(a.moduleId, input.moduleId), eq(a.attemptId, candidate.attemptId), lte(a.retentionUntil, nativeNow))).limit(1), configuration.locking);
 					if (locked[0] !== void 0) selectedAttempts.push(locked[0]);
 				}
 				const prepared = prepare({
-					removed: selectedAttempts.length + selectedCharges.length + selectedScopes.length,
+					removed: selectedAttempts.length,
 					hasMore
 				}, journal);
-				for (const row of selectedCharges) yield* transaction.delete(mapping.charge.table).where(and(eq(c.moduleId, input.moduleId), eq(c.action, row.action), eq(c.scopeKind, row.scopeKind), eq(c.scopeKey, row.scopeKey), eq(c.attemptId, row.attemptId), lte(c.retentionUntil, nativeNow)));
 				if (selectedAttempts.length > 0) yield* transaction.delete(mapping.attempt.table).where(and(eq(a.moduleId, input.moduleId), inArray(a.attemptId, selectedAttempts.map((row) => row.attemptId)), lte(a.retentionUntil, nativeNow)));
-				for (const row of selectedScopes) yield* transaction.delete(mapping.rateScope.table).where(and(eq(sc.moduleId, input.moduleId), eq(sc.action, row.action), eq(sc.scopeKind, row.scopeKind), eq(sc.scopeKey, row.scopeKey), notExists(transaction.select({ one: sql`1` }).from(mapping.charge.table).where(and(eq(c.moduleId, sc.moduleId), eq(c.action, sc.action), eq(c.scopeKind, sc.scopeKind), eq(c.scopeKey, sc.scopeKey))))));
 				return prepared;
 			})).pipe(Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure)
 		});
@@ -646,7 +478,7 @@ const makePasswordKernel = (operations, proofs) => {
 		const credential = (yield* database.select().from(mapping.credential.table).where(and(eq(c.moduleId, input.moduleId), eq(c.subjectId, nativeSubjectId), eq(c.credentialId, revisions.credentialId), eq(c.credentialRevision, revisions.credentialRevision), eq(c.verifierVersion, revisions.verifierVersion), eq(c.verifier, Redacted.value(input.replacement.verifier)), eq(c.normalization, input.replacement.normalization))).limit(1))[0];
 		const subject = (yield* database.select().from(mapping.subject.table).where(and(eq(s.id, nativeSubjectId), eq(s.securityRevision, revisions.nextSecurityRevision))).limit(1))[0];
 		const authorityCredential = (yield* database.select().from(mapping.authorityCredential.table).where(and(eq(authorityCredentialColumns(mapping).subjectId, nativeSubjectId), eq(authorityCredentialColumns(mapping).credentialId, revisions.credentialId), eq(authorityCredentialColumns(mapping).revision, revisions.credentialRevision))).limit(1))[0];
-		return credential !== void 0 && (yield* mutationPostconditions(mapping, input, nativeSubjectId, subject, authorityCredential, now));
+		return credential !== void 0 && credential[mapping.credential.credentialId] === revisions.credentialId && credential[mapping.credential.credentialRevision] === revisions.credentialRevision && credential[mapping.credential.verifierVersion] === revisions.verifierVersion && credential[mapping.credential.verifier] === Redacted.value(input.replacement.verifier) && credential[mapping.credential.normalization] === input.replacement.normalization && (yield* mutationPostconditions(mapping, input, nativeSubjectId, subject, authorityCredential, now));
 	});
 	const writeReplacement = Effect.fn("DrizzlePassword.writeReplacement")(function* (mapping, input, nativeSubjectId, revisions, now) {
 		const database = yield* CurrentPasswordSql;
@@ -665,6 +497,10 @@ const makePasswordKernel = (operations, proofs) => {
 			credentialId: input.credential.credentialId
 		}, now);
 	});
+	const registerReplacement = (mapping, input, nativeSubjectId, revisions, now) => registerFinal(checkMutationApplied(mapping, input, nativeSubjectId, {
+		...revisions,
+		credentialId: input.credential.credentialId
+	}, now));
 	const replaceIn = Effect.fn("Drizzle.replaceIn")(function* (mapping, configuration, input, action, revisions, prepare) {
 		const journal = yield* CurrentCommitJournal;
 		const authority = yield* validateMutationAuthority(mapping, configuration, input, action);
@@ -673,6 +509,7 @@ const makePasswordKernel = (operations, proofs) => {
 		if (!(yield* currentExpectedCredential(mapping, input, authority.nativeSubjectId))) return prepare("rejected", journal);
 		const prepared = prepare("changed", journal);
 		if (!(yield* writeReplacement(mapping, input, authority.nativeSubjectId, revisions, authority.now))) return yield* unavailable();
+		yield* registerReplacement(mapping, input, authority.nativeSubjectId, revisions, authority.now);
 		return prepared;
 	});
 	return {
@@ -694,7 +531,7 @@ const makePasswordKernel = (operations, proofs) => {
 			checkMutationApplied,
 			writeReplacement,
 			evidenceSatisfiedAt,
-			sameCredentialSnapshot,
+			sameCredentialSnapshot: samePasswordCredentialSnapshot,
 			subjectColumns,
 			identifierColumns,
 			credentialColumns,