@yielded/auth-persistence 0.1.0-beta.22 → 0.1.0-beta.24

package/dist/internal/password-credentials.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-credentials.mjs","names":[],"sources":["../../src/internal/password-credentials.ts"],"sourcesContent":["import { CurrentCommitJournal, hasCommitScope } from \"@yielded/auth/Hooks\";\nimport type { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport {\n  EncodedPasswordHash,\n  type PasswordPersistence,\n  PasswordUnavailable,\n  snapshotPasswordCredential,\n  type PasswordCredentialSnapshot,\n} from \"@yielded/auth/Password\";\nimport { reportPersistenceFailure } from \"@yielded/auth/Persistence\";\nimport { Effect, Option, Redacted, Schema } from \"effect\";\n\nimport type { PersistenceMappingError } from \"./mapping-error\";\nimport type { AnyPasswordPersistenceMapping } from \"./models/password-model\";\nimport { sqlMapping, type SqlTable } from \"./native-sql-table\";\nimport type { PasswordSqlConfiguration } from \"./password-kernel\";\nimport { NativeDatabase } from \"./transaction-kernel\";\n\ntype Row = Readonly<Record<string, unknown>>;\nconst unavailable = () => PasswordUnavailable.make({});\n\nconst failure = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n  reportPersistenceFailure(effect, Schema.is(PasswordUnavailable)).pipe(\n    Effect.mapError(unavailable),\n  );\n\nexport const samePasswordCredentialSnapshot = (\n  a: PasswordCredentialSnapshot,\n  b: PasswordCredentialSnapshot,\n) =>\n  a.moduleId === b.moduleId &&\n  a.revision.subjectId === b.revision.subjectId &&\n  a.revision.securityRevision === b.revision.securityRevision &&\n  a.revision.credentials.length === b.revision.credentials.length &&\n  new Set(a.revision.credentials.map((entry) => entry.credentialId)).size ===\n    a.revision.credentials.length &&\n  new Set(b.revision.credentials.map((entry) => entry.credentialId)).size ===\n    b.revision.credentials.length &&\n  a.revision.credentials.every((entry) =>\n    b.revision.credentials.some(\n      (other) => entry.credentialId === other.credentialId && entry.revision === other.revision,\n    ),\n  ) &&\n  a.credentialId === b.credentialId &&\n  a.credentialRevision === b.credentialRevision &&\n  a.verifierVersion === b.verifierVersion &&\n  Redacted.value(a.verifier) === Redacted.value(b.verifier) &&\n  a.normalization === b.normalization &&\n  a.identifier.namespace === b.identifier.namespace &&\n  a.identifier.value === b.identifier.value &&\n  a.identifierBindingRevision === b.identifierBindingRevision &&\n  a.identifierVerifiedAtMillis === b.identifierVerifiedAtMillis;\n\n/** Lookup is read-only; rehash is one conditional maintenance write, never authentication. */\nexport const makePasswordCredentials = Effect.fnUntraced(function* (\n  table: (table: object) => SqlTable,\n  mapping: AnyPasswordPersistenceMapping,\n  options: PasswordSqlConfiguration,\n): Effect.fn.Return<\n  Pick<PasswordPersistence[\"Service\"], \"findCredential\" | \"rehashIfCurrent\">,\n  PasswordUnavailable,\n  NativeDatabase\n> {\n  const sql = (yield* NativeDatabase).$client.withoutTransforms();\n  const parent = yield* Effect.serviceOption(CurrentCommitJournal);\n\n  const [s, i, c] = yield* sqlMapping(\n    () =>\n      [\n        table(mapping.subject.table),\n        table(mapping.identifier.table),\n        table(mapping.credential.table),\n      ] as const,\n  ).pipe(failure);\n\n  const standalone = Effect.gen(function* () {\n    if (options.coordinated) {\n      const current = yield* Effect.serviceOption(CurrentCommitJournal);\n\n      if (Option.isNone(parent) || Option.isNone(current) || parent.value !== current.value)\n        return yield* unavailable();\n    } else {\n      if (yield* hasCommitScope) return yield* unavailable();\n      yield* options.standaloneGuard;\n    }\n  });\n\n  const allocate = <A>(\n    asynchronous: Effect.Effect<A, PersistenceMappingError> | undefined,\n    sync: (() => A) | undefined,\n  ) => {\n    if (options.mode !== \"synchronous\" && asynchronous !== undefined) return asynchronous;\n\n    return sync === undefined\n      ? Effect.fail(unavailable())\n      : Effect.try({ try: sync, catch: unavailable });\n  };\n\n  // Bind each native ID through its own column codec. Physical encodings of the\n  // same application ID need not match across subject, identifier and password.\n  const snapshot = Effect.fnUntraced(function* (\n    nativeId: unknown,\n    moduleId: string,\n    identifier: LoginIdentifier,\n  ) {\n    const subjectTable = s.as(\"password_subject\");\n    const identifierTable = i.as(\"password_identifier\");\n    const credentialTable = c.as(\"password_credential\");\n\n    const rows = yield* sqlMapping(\n      () =>\n        sql<Row>`select ${subjectTable.fields(\"subject_\")}, ${identifierTable.fields(\"identifier_\")}, ${credentialTable.fields(\"credential_\")}\n      from ${subjectTable.name}\n      inner join ${identifierTable.name} on ${identifierTable.column(mapping.identifier.namespace)} = ${identifierTable.value(mapping.identifier.namespace, identifier.namespace)}\n        and ${identifierTable.column(mapping.identifier.value)} = ${identifierTable.value(mapping.identifier.value, identifier.value)}\n        and ${identifierTable.column(mapping.identifier.subjectId)} = ${identifierTable.value(mapping.identifier.subjectId, nativeId)}\n      inner join ${credentialTable.name} on ${credentialTable.column(mapping.credential.moduleId)} = ${credentialTable.value(mapping.credential.moduleId, moduleId)}\n        and ${credentialTable.column(mapping.credential.subjectId)} = ${credentialTable.value(mapping.credential.subjectId, nativeId)}\n      where ${subjectTable.column(mapping.subject.id)} = ${subjectTable.value(mapping.subject.id, nativeId)}\n      `,\n    ).pipe(Effect.flatten);\n\n    if (rows.length !== 1) return undefined;\n\n    const [subject, identifierRow, credential] = yield* sqlMapping(\n      () =>\n        [\n          s.decode(rows[0]!, \"subject_\"),\n          i.decode(rows[0]!, \"identifier_\"),\n          c.decode(rows[0]!, \"credential_\"),\n        ] as const,\n    );\n\n    if (\n      yield* sqlMapping(\n        () =>\n          !mapping.subject.isActiveStatus(subject[mapping.subject.status]) ||\n          !mapping.identifier.isCurrent(identifierRow) ||\n          !mapping.subjectId.equals(nativeId, identifierRow[mapping.identifier.subjectId]) ||\n          !mapping.subjectId.equals(nativeId, subject[mapping.subject.id]) ||\n          !mapping.subjectId.equals(nativeId, credential[mapping.credential.subjectId]),\n      )\n    )\n      return undefined;\n\n    const captured = yield* sqlMapping(() =>\n      mapping.credential.decode({ moduleId, subject, identifier: identifierRow, credential }),\n    ).pipe(Effect.flatten, Effect.flatMap(snapshotPasswordCredential));\n\n    return captured;\n  });\n\n  return {\n    findCredential: (uncaptured) =>\n      Effect.gen(function* () {\n        const input = { ...uncaptured, identifier: { ...uncaptured.identifier } };\n\n        yield* standalone;\n\n        const identifiers = yield* sqlMapping(\n          () => sql<Row>`select ${i.fields(\"i_\")} from ${i.name}\n          where ${i.column(mapping.identifier.namespace)} = ${i.value(mapping.identifier.namespace, input.identifier.namespace)}\n            and ${i.column(mapping.identifier.value)} = ${i.value(mapping.identifier.value, input.identifier.value)}`,\n        ).pipe(Effect.flatten);\n\n        const identifier =\n          identifiers.length === 1\n            ? yield* sqlMapping(() => i.decode(identifiers[0]!, \"i_\"))\n            : undefined;\n\n        if (\n          identifier === undefined ||\n          !(yield* sqlMapping(() => mapping.identifier.isCurrent(identifier)))\n        )\n          return Option.none();\n\n        const credential = yield* snapshot(\n          identifier[mapping.identifier.subjectId],\n          input.moduleId,\n          input.identifier,\n        );\n\n        return credential === undefined ||\n          (input.subjectId !== undefined && credential.revision.subjectId !== input.subjectId)\n          ? Option.none()\n          : Option.some(credential);\n      }).pipe(failure),\n    rehashIfCurrent: (input) =>\n      Effect.gen(function* () {\n        const nextVerifier = Redacted.make(\n          yield* Schema.decodeEffect(EncodedPasswordHash)(Redacted.value(input.nextVerifier)),\n        );\n\n        const credential = yield* snapshotPasswordCredential(input.credential);\n\n        yield* standalone;\n        const nativeId = yield* mapping.subjectId.toNative(credential.revision.subjectId);\n        const version = yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync);\n\n        if (version === credential.verifierVersion) return yield* unavailable();\n        yield* sqlMapping(() => {\n          const encoded = mapping.credential.encodeVerifier(nextVerifier, version);\n\n          // A custom encoder cannot turn maintenance into a semantic credential change.\n          const values = {\n            [mapping.credential.verifier]: encoded[mapping.credential.verifier],\n            [mapping.credential.verifierVersion]: encoded[mapping.credential.verifierVersion],\n          };\n\n          if (Object.values(values).some((value) => value === undefined)) throw unavailable();\n\n          // Ordinary identity predicates retain index use; the full CAS ignores text collation.\n          const exact = sql.and(\n            Object.entries({\n              [mapping.credential.moduleId]: credential.moduleId,\n              [mapping.credential.subjectId]: nativeId,\n              [mapping.credential.credentialId]: credential.credentialId,\n              [mapping.credential.credentialRevision]: credential.credentialRevision,\n              [mapping.credential.verifierVersion]: credential.verifierVersion,\n              [mapping.credential.verifier]: Redacted.value(credential.verifier),\n              [mapping.credential.normalization]: credential.normalization,\n            }).map(([key, value]) => {\n              const column = c.column(key),\n                bound = c.value(key, value);\n\n              if (typeof value !== \"string\") return sql`${column} = ${bound}`;\n\n              return sql.onDialectOrElse({\n                mysql: () => sql`binary ${column} = binary ${bound}`,\n                pg: () =>\n                  sql`convert_to(cast(${column} as text), 'UTF8') = convert_to(cast(${bound} as text), 'UTF8')`,\n                orElse: () => sql`cast(${column} as blob) = cast(${bound} as blob)`,\n              });\n            }),\n          );\n\n          return sql`${c.update(values)}\n          where ${c.column(mapping.credential.moduleId)} = ${c.value(mapping.credential.moduleId, credential.moduleId)}\n            and ${c.column(mapping.credential.subjectId)} = ${c.value(mapping.credential.subjectId, nativeId)}\n            and ${c.column(mapping.credential.credentialId)} = ${c.value(mapping.credential.credentialId, credential.credentialId)}\n            and ${exact}`;\n        }).pipe(Effect.flatten);\n      }).pipe(failure),\n  } satisfies Pick<PasswordPersistence[\"Service\"], \"findCredential\" | \"rehashIfCurrent\">;\n});\n"],"mappings":";;;;;;;AAmBA,MAAM,oBAAoB,oBAAoB,KAAK,CAAC,CAAC;AAErD,MAAM,WAAoB,WACxB,yBAAyB,QAAQ,OAAO,GAAG,mBAAmB,CAAC,CAAC,CAAC,KAC/D,OAAO,SAAS,WAAW,CAC7B;AAEF,MAAa,kCACX,GACA,MAEA,EAAE,aAAa,EAAE,YACjB,EAAE,SAAS,cAAc,EAAE,SAAS,aACpC,EAAE,SAAS,qBAAqB,EAAE,SAAS,oBAC3C,EAAE,SAAS,YAAY,WAAW,EAAE,SAAS,YAAY,UACzD,IAAI,IAAI,EAAE,SAAS,YAAY,KAAK,UAAU,MAAM,YAAY,CAAC,CAAC,CAAC,SACjE,EAAE,SAAS,YAAY,UACzB,IAAI,IAAI,EAAE,SAAS,YAAY,KAAK,UAAU,MAAM,YAAY,CAAC,CAAC,CAAC,SACjE,EAAE,SAAS,YAAY,UACzB,EAAE,SAAS,YAAY,OAAO,UAC5B,EAAE,SAAS,YAAY,MACpB,UAAU,MAAM,iBAAiB,MAAM,gBAAgB,MAAM,aAAa,MAAM,QACnF,CACF,KACA,EAAE,iBAAiB,EAAE,gBACrB,EAAE,uBAAuB,EAAE,sBAC3B,EAAE,oBAAoB,EAAE,mBACxB,SAAS,MAAM,EAAE,QAAQ,MAAM,SAAS,MAAM,EAAE,QAAQ,KACxD,EAAE,kBAAkB,EAAE,iBACtB,EAAE,WAAW,cAAc,EAAE,WAAW,aACxC,EAAE,WAAW,UAAU,EAAE,WAAW,SACpC,EAAE,8BAA8B,EAAE,6BAClC,EAAE,+BAA+B,EAAE;;AAGrC,MAAa,0BAA0B,OAAO,WAAW,WACvD,OACA,SACA,SAKA;CACA,MAAM,OAAO,OAAO,eAAA,CAAgB,QAAQ,kBAAkB;CAC9D,MAAM,SAAS,OAAO,OAAO,cAAc,oBAAoB;CAE/D,MAAM,CAAC,GAAG,GAAG,KAAK,OAAO,iBAErB;EACE,MAAM,QAAQ,QAAQ,KAAK;EAC3B,MAAM,QAAQ,WAAW,KAAK;EAC9B,MAAM,QAAQ,WAAW,KAAK;CAChC,CACJ,CAAC,CAAC,KAAK,OAAO;CAEd,MAAM,aAAa,OAAO,IAAI,aAAa;EACzC,IAAI,QAAQ,aAAa;GACvB,MAAM,UAAU,OAAO,OAAO,cAAc,oBAAoB;GAEhE,IAAI,OAAO,OAAO,MAAM,KAAK,OAAO,OAAO,OAAO,KAAK,OAAO,UAAU,QAAQ,OAC9E,OAAO,OAAO,YAAY;EAC9B,OAAO;GACL,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;GACrD,OAAO,QAAQ;EACjB;CACF,CAAC;CAED,MAAM,YACJ,cACA,SACG;EACH,IAAI,QAAQ,SAAS,iBAAiB,iBAAiB,KAAA,GAAW,OAAO;EAEzE,OAAO,SAAS,KAAA,IACZ,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;GAAE,KAAK;GAAM,OAAO;EAAY,CAAC;CAClD;CAIA,MAAM,WAAW,OAAO,WAAW,WACjC,UACA,UACA,YACA;EACA,MAAM,eAAe,EAAE,GAAG,kBAAkB;EAC5C,MAAM,kBAAkB,EAAE,GAAG,qBAAqB;EAClD,MAAM,kBAAkB,EAAE,GAAG,qBAAqB;EAElD,MAAM,OAAO,OAAO,iBAEhB,GAAQ,UAAU,aAAa,OAAO,UAAU,EAAE,IAAI,gBAAgB,OAAO,aAAa,EAAE,IAAI,gBAAgB,OAAO,aAAa,EAAE;aACjI,aAAa,KAAK;mBACZ,gBAAgB,KAAK,MAAM,gBAAgB,OAAO,QAAQ,WAAW,SAAS,EAAE,KAAK,gBAAgB,MAAM,QAAQ,WAAW,WAAW,WAAW,SAAS,EAAE;cACpK,gBAAgB,OAAO,QAAQ,WAAW,KAAK,EAAE,KAAK,gBAAgB,MAAM,QAAQ,WAAW,OAAO,WAAW,KAAK,EAAE;cACxH,gBAAgB,OAAO,QAAQ,WAAW,SAAS,EAAE,KAAK,gBAAgB,MAAM,QAAQ,WAAW,WAAW,QAAQ,EAAE;mBACnH,gBAAgB,KAAK,MAAM,gBAAgB,OAAO,QAAQ,WAAW,QAAQ,EAAE,KAAK,gBAAgB,MAAM,QAAQ,WAAW,UAAU,QAAQ,EAAE;cACtJ,gBAAgB,OAAO,QAAQ,WAAW,SAAS,EAAE,KAAK,gBAAgB,MAAM,QAAQ,WAAW,WAAW,QAAQ,EAAE;cACxH,aAAa,OAAO,QAAQ,QAAQ,EAAE,EAAE,KAAK,aAAa,MAAM,QAAQ,QAAQ,IAAI,QAAQ,EAAE;OAExG,CAAC,CAAC,KAAK,OAAO,OAAO;EAErB,IAAI,KAAK,WAAW,GAAG,OAAO,KAAA;EAE9B,MAAM,CAAC,SAAS,eAAe,cAAc,OAAO,iBAEhD;GACE,EAAE,OAAO,KAAK,IAAK,UAAU;GAC7B,EAAE,OAAO,KAAK,IAAK,aAAa;GAChC,EAAE,OAAO,KAAK,IAAK,aAAa;EAClC,CACJ;EAEA,IACE,OAAO,iBAEH,CAAC,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,KAC/D,CAAC,QAAQ,WAAW,UAAU,aAAa,KAC3C,CAAC,QAAQ,UAAU,OAAO,UAAU,cAAc,QAAQ,WAAW,UAAU,KAC/E,CAAC,QAAQ,UAAU,OAAO,UAAU,QAAQ,QAAQ,QAAQ,GAAG,KAC/D,CAAC,QAAQ,UAAU,OAAO,UAAU,WAAW,QAAQ,WAAW,UAAU,CAChF,GAEA,OAAO,KAAA;EAMT,OAAO,OAJiB,iBACtB,QAAQ,WAAW,OAAO;GAAE;GAAU;GAAS,YAAY;GAAe;EAAW,CAAC,CACxF,CAAC,CAAC,KAAK,OAAO,SAAS,OAAO,QAAQ,0BAA0B,CAAC;CAGnE,CAAC;CAED,OAAO;EACL,iBAAiB,eACf,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ;IAAE,GAAG;IAAY,YAAY,EAAE,GAAG,WAAW,WAAW;GAAE;GAExE,OAAO;GAEP,MAAM,cAAc,OAAO,iBACnB,GAAQ,UAAU,EAAE,OAAO,IAAI,EAAE,QAAQ,EAAE,KAAK;kBAC9C,EAAE,OAAO,QAAQ,WAAW,SAAS,EAAE,KAAK,EAAE,MAAM,QAAQ,WAAW,WAAW,MAAM,WAAW,SAAS,EAAE;kBAC9G,EAAE,OAAO,QAAQ,WAAW,KAAK,EAAE,KAAK,EAAE,MAAM,QAAQ,WAAW,OAAO,MAAM,WAAW,KAAK,GAC1G,CAAC,CAAC,KAAK,OAAO,OAAO;GAErB,MAAM,aACJ,YAAY,WAAW,IACnB,OAAO,iBAAiB,EAAE,OAAO,YAAY,IAAK,IAAI,CAAC,IACvD,KAAA;GAEN,IACE,eAAe,KAAA,KACf,EAAE,OAAO,iBAAiB,QAAQ,WAAW,UAAU,UAAU,CAAC,IAElE,OAAO,OAAO,KAAK;GAErB,MAAM,aAAa,OAAO,SACxB,WAAW,QAAQ,WAAW,YAC9B,MAAM,UACN,MAAM,UACR;GAEA,OAAO,eAAe,KAAA,KACnB,MAAM,cAAc,KAAA,KAAa,WAAW,SAAS,cAAc,MAAM,YACxE,OAAO,KAAK,IACZ,OAAO,KAAK,UAAU;EAC5B,CAAC,CAAC,CAAC,KAAK,OAAO;EACjB,kBAAkB,UAChB,OAAO,IAAI,aAAa;GACtB,MAAM,eAAe,SAAS,KAC5B,OAAO,OAAO,aAAa,mBAAmB,CAAC,CAAC,SAAS,MAAM,MAAM,YAAY,CAAC,CACpF;GAEA,MAAM,aAAa,OAAO,2BAA2B,MAAM,UAAU;GAErE,OAAO;GACP,MAAM,WAAW,OAAO,QAAQ,UAAU,SAAS,WAAW,SAAS,SAAS;GAChF,MAAM,UAAU,OAAO,SAAS,QAAQ,kBAAkB,QAAQ,oBAAoB;GAEtF,IAAI,YAAY,WAAW,iBAAiB,OAAO,OAAO,YAAY;GACtE,OAAO,iBAAiB;IACtB,MAAM,UAAU,QAAQ,WAAW,eAAe,cAAc,OAAO;IAGvE,MAAM,SAAS;MACZ,QAAQ,WAAW,WAAW,QAAQ,QAAQ,WAAW;MACzD,QAAQ,WAAW,kBAAkB,QAAQ,QAAQ,WAAW;IACnE;IAEA,IAAI,OAAO,OAAO,MAAM,CAAC,CAAC,MAAM,UAAU,UAAU,KAAA,CAAS,GAAG,MAAM,YAAY;IAGlF,MAAM,QAAQ,IAAI,IAChB,OAAO,QAAQ;MACZ,QAAQ,WAAW,WAAW,WAAW;MACzC,QAAQ,WAAW,YAAY;MAC/B,QAAQ,WAAW,eAAe,WAAW;MAC7C,QAAQ,WAAW,qBAAqB,WAAW;MACnD,QAAQ,WAAW,kBAAkB,WAAW;MAChD,QAAQ,WAAW,WAAW,SAAS,MAAM,WAAW,QAAQ;MAChE,QAAQ,WAAW,gBAAgB,WAAW;IACjD,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW;KACvB,MAAM,SAAS,EAAE,OAAO,GAAG,GACzB,QAAQ,EAAE,MAAM,KAAK,KAAK;KAE5B,IAAI,OAAO,UAAU,UAAU,OAAO,GAAG,GAAG,OAAO,KAAK;KAExD,OAAO,IAAI,gBAAgB;MACzB,aAAa,GAAG,UAAU,OAAO,YAAY;MAC7C,UACE,GAAG,mBAAmB,OAAO,uCAAuC,MAAM;MAC5E,cAAc,GAAG,QAAQ,OAAO,mBAAmB,MAAM;KAC3D,CAAC;IACH,CAAC,CACH;IAEA,OAAO,GAAG,GAAG,EAAE,OAAO,MAAM,EAAE;kBACtB,EAAE,OAAO,QAAQ,WAAW,QAAQ,EAAE,KAAK,EAAE,MAAM,QAAQ,WAAW,UAAU,WAAW,QAAQ,EAAE;kBACrG,EAAE,OAAO,QAAQ,WAAW,SAAS,EAAE,KAAK,EAAE,MAAM,QAAQ,WAAW,WAAW,QAAQ,EAAE;kBAC5F,EAAE,OAAO,QAAQ,WAAW,YAAY,EAAE,KAAK,EAAE,MAAM,QAAQ,WAAW,cAAc,WAAW,YAAY,EAAE;kBACjH;GACV,CAAC,CAAC,CAAC,KAAK,OAAO,OAAO;EACxB,CAAC,CAAC,CAAC,KAAK,OAAO;CACnB;AACF,CAAC"}

package/dist/internal/password-kernel.d.mts

@@ -3,12 +3,15 @@ import { NativeDatabase } from "./transaction-kernel.mjs";
 import { QueryFailure, QueryOperations, SqlColumn, SqlFragment } from "./query-operations.mjs";
 import { AnyPasswordPersistenceMapping } from "./models/password-model.mjs";
 import { CurrentProofSql, ProofSqlConfiguration, makeProofKernel } from "./proof-kernel.mjs";
+import { NativeSqlTables } from "./native-sql-table.mjs";
+import { samePasswordCredentialSnapshot } from "./password-credentials.mjs";
 import { Context, DateTime, Effect, Option, Redacted } from "effect";
 import { CurrentCommitJournal, HookConfigurationError, LifecycleHooks, PreparedCommit } from "@yielded/auth/Hooks";
 import { AuthenticationEvidence, AuthenticationRequirement, SecurityRevision } from "@yielded/auth/Sessions";
 import { ProofCompletionInput, ProofCompletionPlan } from "@yielded/auth/Proofs";
-import { PasswordAttemptDecision, PasswordAttemptPolicy, PasswordCredentialSnapshot, PasswordMutationDecision, PasswordMutationInput, PasswordUnavailable } from "@yielded/auth/Password";
+import { PasswordMutationDecision, PasswordMutationInput, PasswordUnavailable } from "@yielded/auth/Password";
 import { LoginIdentifier } from "@yielded/auth/Identity";
+import { SqlClient } from "effect/sql/SqlClient";
 import * as SqlError$1 from "effect/sql/SqlError";
 //#region src/internal/password-kernel.d.ts
 type AdapterFailure = QueryFailure | PersistenceMappingError | SqlError$1.SqlError;
@@ -47,47 +50,31 @@ export interface PasswordSqlConfiguration {
   };
 }
 type Database = PasswordSqlDatabase;
-export declare const makePasswordKernel: <Fragment extends SqlFragment = SqlFragment, Column extends SqlColumn = SqlColumn>(operations: QueryOperations<Fragment, Column>, proofs: Pick<ReturnType<typeof makeProofKernel>, "completeProofPlanIn">) => {
+export declare const makePasswordKernel: <Fragment extends SqlFragment = SqlFragment, Column extends SqlColumn = SqlColumn>(operations: QueryOperations<Fragment, Column>, proofs: Pick<ReturnType<typeof makeProofKernel>, "completeProofPlanIn">, nativeTables?: (client: SqlClient, database: object) => NativeSqlTables) => {
   makeSqlPasswordPersistence: (mapping: AnyPasswordPersistenceMapping<Fragment>, configuration: PasswordSqlConfiguration) => Effect.Effect<{
-    readonly admitAttempt: <A>(input: {
+    readonly findCredential: (input: {
       readonly moduleId: string;
-      readonly action: "sign-in" | "change";
       readonly identifier: LoginIdentifier;
       readonly subjectId?: import("@yielded/auth/Schema").SubjectId;
-      readonly policy: PasswordAttemptPolicy;
-    }, prepare: import("@yielded/auth/Password").PreparePasswordCommit<import("@yielded/auth/Password").PasswordAttemptAdmission, A>) => Effect.Effect<PreparedCommit<A>, PasswordUnavailable>;
-    readonly settleAttempt: <A>(input: {
-      readonly moduleId: string;
-      readonly attemptId: import("@yielded/auth/Password").PasswordAttemptId;
-      readonly captured?: PasswordCredentialSnapshot;
-      readonly outcome: PasswordAttemptDecision;
-      readonly rehash?: {
-        readonly expectedVersion: SecurityRevision;
-        readonly expectedVerifier: Redacted.Redacted<import("@yielded/auth/Password").EncodedPasswordHash>;
-        readonly nextVerifier: Redacted.Redacted<import("@yielded/auth/Password").EncodedPasswordHash>;
-      };
-    }, prepare: import("@yielded/auth/Password").PreparePasswordCommit<PasswordAttemptDecision, A>) => Effect.Effect<PreparedCommit<A>, PasswordUnavailable>;
+    }) => Effect.Effect<Option.Option<import("@yielded/auth/Password").PasswordCredentialSnapshot>, PasswordUnavailable>;
+    readonly rehashIfCurrent: (input: {
+      readonly credential: import("@yielded/auth/Password").PasswordCredentialSnapshot;
+      readonly nextVerifier: Redacted.Redacted<import("@yielded/auth/Password").EncodedPasswordHash>;
+    }) => Effect.Effect<void, PasswordUnavailable>;
     readonly readForSubject: (input: {
       readonly moduleId: string;
       readonly subjectId: import("@yielded/auth/Schema").SubjectId;
-    }) => Effect.Effect<Option.Option<PasswordCredentialSnapshot>, PasswordUnavailable>;
+    }) => Effect.Effect<Option.Option<import("@yielded/auth/Password").PasswordCredentialSnapshot>, PasswordUnavailable>;
     readonly recoveryTarget: (input: {
       readonly moduleId: string;
       readonly identifier: LoginIdentifier;
-    }) => Effect.Effect<Option.Option<PasswordCredentialSnapshot>, PasswordUnavailable>;
+    }) => Effect.Effect<Option.Option<import("@yielded/auth/Password").PasswordCredentialSnapshot>, PasswordUnavailable>;
     readonly addIfAbsent: <A>(input: PasswordMutationInput, prepare: import("@yielded/auth/Password").PreparePasswordCommit<PasswordMutationDecision, A>) => Effect.Effect<PreparedCommit<A>, PasswordUnavailable>;
     readonly replaceIfCurrent: <A>(input: PasswordMutationInput, prepare: import("@yielded/auth/Password").PreparePasswordCommit<PasswordMutationDecision, A>) => Effect.Effect<PreparedCommit<A>, PasswordUnavailable>;
     readonly checkReset: (input: ProofCompletionInput) => Effect.Effect<boolean, PasswordUnavailable>;
     readonly resetWithProof: <A>(input: PasswordMutationInput & {
       readonly completion: ProofCompletionPlan;
     }, prepare: import("@yielded/auth/Password").PreparePasswordCommit<PasswordMutationDecision, A>) => Effect.Effect<PreparedCommit<A>, PasswordUnavailable>;
-    readonly cleanupAttempts: <A>(input: {
-      readonly moduleId: string;
-      readonly limit: number;
-    }, prepare: import("@yielded/auth/Password").PreparePasswordCommit<{
-      readonly removed: number;
-      readonly hasMore: boolean;
-    }, A>) => Effect.Effect<PreparedCommit<A>, PasswordUnavailable>;
   }, PasswordUnavailable, CurrentPasswordSql | LifecycleHooks | NativeDatabase>;
   passwordSqlKernel: {
     allocate: <A>(mode: PasswordSqlConfiguration["mode"], asyncValue: Effect.Effect<A, PersistenceMappingError> | undefined, syncValue: (() => A) | undefined) => Effect.Effect<A, PasswordUnavailable | PersistenceMappingError>;
@@ -203,8 +190,8 @@ export declare const makePasswordKernel: <Fragment extends SqlFragment = SqlFrag
       nativeSubjectId: any;
       subject: any;
       identifier: any;
+      credential?: never;
       snapshot?: never;
-      readonly credential?: never;
     } | {
       nativeSubjectId: any;
       subject: any;
@@ -255,7 +242,7 @@ export declare const makePasswordKernel: <Fragment extends SqlFragment = SqlFrag
       readonly nextSecurityRevision: SecurityRevision;
     }, now: number) => Effect.Effect<boolean, AdapterFailure, CurrentPasswordSql>;
     evidenceSatisfiedAt: (evidence: AuthenticationEvidence, requirement: AuthenticationRequirement, now: number) => boolean;
-    sameCredentialSnapshot: (left: PasswordCredentialSnapshot, right: PasswordCredentialSnapshot) => boolean;
+    sameCredentialSnapshot: typeof samePasswordCredentialSnapshot;
     subjectColumns: (mapping: AnyPasswordPersistenceMapping<Fragment>) => {
       id: Column;
       status: Column;

package/dist/internal/password-kernel.mjs

@@ -1,6 +1,10 @@
 import { PersistenceMappingError } from "./mapping-error.mjs";
+import { makeNativeSqlTables, sqlMapping } from "./native-sql-table.mjs";
+import { NativeDatabase } from "./transaction-kernel.mjs";
+import { CurrentPasswordPreparedTransaction, PasswordPreparedPostconditions } from "./PasswordPreparedPostconditions.mjs";
 import { CurrentProofSql } from "./proof-kernel.mjs";
 import { requiredPasswordConstraints } from "./models/password-model.mjs";
+import { makePasswordCredentials, samePasswordCredentialSnapshot } from "./password-credentials.mjs";
 import { Cause, Context, DateTime, Effect, Option, Redacted, Schema } from "effect";
 import { CurrentCommitJournal, HookConfigurationError, LifecycleHooks, coordinateCommit, hasCommitScope } from "@yielded/auth/Hooks";
 import { snapshotAuthenticationEvidence } from "@yielded/auth/Sessions";
@@ -9,8 +13,8 @@ import { ProofUnavailable } from "@yielded/auth/Proofs";
 import { PasswordPersistence, PasswordUnavailable, snapshotPasswordCredential, snapshotPasswordRequirement, snapshotPasswordRevision } from "@yielded/auth/Password";
 //#region src/internal/password-kernel.ts
 var CurrentPasswordSql = class extends Context.Service()("effect-auth/CurrentPasswordSql") {};
-const makePasswordKernel = (operations, proofs) => {
-	const { and, eq, gt, gte, inArray, lte, notExists, sql, column, updateValues } = operations;
+const makePasswordKernel = (operations, proofs, nativeTables = (client) => makeNativeSqlTables(client)) => {
+	const { and, eq, inArray, column, updateValues } = operations;
 	const { completeProofPlanIn } = proofs;
 	const unavailable = () => PasswordUnavailable.make({});
 	const translateFailure = (effect) => reportPersistenceFailure(effect, (error) => Schema.is(PasswordUnavailable)(error) || Schema.is(ProofUnavailable)(error) || Schema.is(HookConfigurationError)(error)).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));
@@ -43,38 +47,6 @@ const makePasswordKernel = (operations, proofs) => {
 		credentialId: column(mapping.authorityCredential.table, mapping.authorityCredential.credentialId),
 		revision: column(mapping.authorityCredential.table, mapping.authorityCredential.revision)
 	});
-	const attemptColumns = (mapping) => ({
-		moduleId: column(mapping.attempt.table, mapping.attempt.moduleId),
-		action: column(mapping.attempt.table, mapping.attempt.action),
-		attemptId: column(mapping.attempt.table, mapping.attempt.attemptId),
-		identifierNamespace: column(mapping.attempt.table, mapping.attempt.identifierNamespace),
-		identifierValue: column(mapping.attempt.table, mapping.attempt.identifierValue),
-		subjectId: column(mapping.attempt.table, mapping.attempt.subjectId),
-		credentialId: column(mapping.attempt.table, mapping.attempt.credentialId),
-		securityRevision: column(mapping.attempt.table, mapping.attempt.securityRevision),
-		credentialRevision: column(mapping.attempt.table, mapping.attempt.credentialRevision),
-		verifierVersion: column(mapping.attempt.table, mapping.attempt.verifierVersion),
-		identifierBindingRevision: column(mapping.attempt.table, mapping.attempt.identifierBindingRevision),
-		admittedAt: column(mapping.attempt.table, mapping.attempt.admittedAt),
-		deadline: column(mapping.attempt.table, mapping.attempt.deadline),
-		retentionUntil: column(mapping.attempt.table, mapping.attempt.retentionUntil),
-		state: column(mapping.attempt.table, mapping.attempt.state)
-	});
-	const scopeColumns = (mapping) => ({
-		moduleId: column(mapping.rateScope.table, mapping.rateScope.moduleId),
-		action: column(mapping.rateScope.table, mapping.rateScope.action),
-		scopeKind: column(mapping.rateScope.table, mapping.rateScope.scopeKind),
-		scopeKey: column(mapping.rateScope.table, mapping.rateScope.scopeKey)
-	});
-	const chargeColumns = (mapping) => ({
-		moduleId: column(mapping.charge.table, mapping.charge.moduleId),
-		action: column(mapping.charge.table, mapping.charge.action),
-		scopeKind: column(mapping.charge.table, mapping.charge.scopeKind),
-		scopeKey: column(mapping.charge.table, mapping.charge.scopeKey),
-		attemptId: column(mapping.charge.table, mapping.charge.attemptId),
-		occurredAt: column(mapping.charge.table, mapping.charge.occurredAt),
-		retentionUntil: column(mapping.charge.table, mapping.charge.retentionUntil)
-	});
 	const commandColumns = (mapping) => ({
 		moduleId: column(mapping.command.table, mapping.command.moduleId),
 		commandId: column(mapping.command.table, mapping.command.commandId),
@@ -106,7 +78,6 @@ const makePasswordKernel = (operations, proofs) => {
 		return allocate(mode, asyncValue ?? mapping.allocateRevision, syncValue ?? mapping.allocateRevisionSync);
 	};
 	const sameIdentifier = (left, right) => left.namespace === right.namespace && left.value === right.value;
-	const sameCredentialSnapshot = (left, right) => left.moduleId === right.moduleId && left.revision.subjectId === right.revision.subjectId && left.revision.securityRevision === right.revision.securityRevision && left.credentialId === right.credentialId && left.credentialRevision === right.credentialRevision && left.verifierVersion === right.verifierVersion && left.normalization === right.normalization && left.identifierVerifiedAtMillis === right.identifierVerifiedAtMillis && left.revision.credentials.length === right.revision.credentials.length && left.revision.credentials.every((entry) => right.revision.credentials.some((other) => other.credentialId === entry.credentialId && other.revision === entry.revision)) && left.identifierBindingRevision === right.identifierBindingRevision && sameIdentifier(left.identifier, right.identifier) && Redacted.value(left.verifier) === Redacted.value(right.verifier);
 	const evidenceSatisfiedAt = (evidence, requirement, now) => {
 		if (evidence.proofs.length > 64 || evidence.revision.credentials.length > 64) return false;
 		const revisions = /* @__PURE__ */ new Map();
@@ -197,54 +168,6 @@ const makePasswordKernel = (operations, proofs) => {
 			}).pipe(Effect.flatMap(snapshotPasswordCredential))
 		};
 	});
-	const scopeEntries = (keys, policy) => {
-		const values = [{
-			kind: "action",
-			key: keys.action,
-			...policy.action
-		}, {
-			kind: "identifier",
-			key: keys.identifier,
-			...policy.identifier
-		}];
-		if (keys.subject !== void 0) values.push({
-			kind: "subject",
-			key: keys.subject,
-			...policy.subject
-		});
-		return values;
-	};
-	const lockScope = Effect.fn("DrizzlePassword.lockScope")(function* (mapping, configuration, moduleId, action, entry) {
-		const database = yield* CurrentPasswordSql;
-		const query = database.insert(mapping.rateScope.table).values(mapping.rateScope.encodeInsert({
-			moduleId,
-			action,
-			scopeKind: entry.kind,
-			scopeKey: entry.key
-		}));
-		yield* configuration.insertIfAbsent(query, mapping.rateScope.scopeKey, entry.key);
-		const c = scopeColumns(mapping);
-		yield* selectRows(database.select().from(mapping.rateScope.table).where(and(eq(c.moduleId, moduleId), eq(c.action, action), eq(c.scopeKind, entry.kind), eq(c.scopeKey, entry.key))).limit(1), configuration.locking);
-	});
-	const scopeAdmits = Effect.fn("DrizzlePassword.scopeAdmits")(function* (mapping, moduleId, action, entry, policy, identifier, nativeSubjectId, now) {
-		const database = yield* CurrentPasswordSql;
-		const c = chargeColumns(mapping);
-		if ((yield* selectRows(database.select({ attemptId: c.attemptId }).from(mapping.charge.table).where(and(eq(c.moduleId, moduleId), eq(c.action, action), eq(c.scopeKind, entry.kind), eq(c.scopeKey, entry.key), gte(c.occurredAt, mapping.encodeInstant(now - entry.windowMillis)))).limit(entry.limit), true)).length >= entry.limit) return false;
-		const a = attemptColumns(mapping);
-		const pendingWhere = and(entry.kind === "action" ? and(eq(a.moduleId, moduleId), eq(a.action, action)) : entry.kind === "identifier" ? and(eq(a.moduleId, moduleId), eq(a.action, action), eq(a.identifierNamespace, identifier.namespace), eq(a.identifierValue, identifier.value)) : and(eq(a.moduleId, moduleId), eq(a.action, action), eq(a.subjectId, nativeSubjectId)), eq(a.state, "pending"), gt(a.retentionUntil, mapping.encodeInstant(now)));
-		return (yield* selectRows(database.select({ attemptId: a.attemptId }).from(mapping.attempt.table).where(pendingWhere).limit(policy.maximumPending), true)).length < policy.maximumPending;
-	});
-	const insertCharge = Effect.fn("Drizzle.insertCharge")(function* (mapping, moduleId, action, entry, attemptId, now) {
-		return yield* (yield* CurrentPasswordSql).insert(mapping.charge.table).values(mapping.charge.encodeInsert({
-			moduleId,
-			action,
-			scopeKind: entry.kind,
-			scopeKey: entry.key,
-			attemptId,
-			occurredAtMillis: now,
-			retentionUntilMillis: now + entry.windowMillis
-		}));
-	});
 	const owned = (database, mapping, configuration, body) => {
 		if (!validConstraints(mapping)) return Effect.fail(unavailable());
 		const run = coordinateCommit(() => database.transaction((transaction) => body.pipe(Effect.provideService(CurrentPasswordSql, transaction), Effect.provideService(CurrentProofSql, transaction))), { mode: configuration.mode }).pipe(Effect.map((result) => result.value));
@@ -254,6 +177,15 @@ const makePasswordKernel = (operations, proofs) => {
 			return yield* run;
 		}) : run;
 	};
+	const registerFinal = Effect.fnUntraced(function* (check) {
+		const postconditions = yield* Effect.serviceOption(PasswordPreparedPostconditions);
+		if (Option.isNone(postconditions)) return;
+		const postcondition = Effect.gen(function* () {
+			const transaction = yield* CurrentPasswordPreparedTransaction;
+			if (!(yield* check.pipe(Effect.provideService(CurrentPasswordSql, transaction)))) return yield* unavailable();
+		}).pipe(translateFailure);
+		if (!postconditions.value.register(postcondition)) return yield* unavailable();
+	});
 	const safeRead = (database, configuration, body) => Effect.gen(function* () {
 		if (configuration.coordinated !== true) {
 			if (yield* hasCommitScope) return yield* unavailable();
@@ -317,7 +249,7 @@ const makePasswordKernel = (operations, proofs) => {
 				identifier,
 				credential
 			});
-			if (!sameCredentialSnapshot(snapshot, input.credential)) return void 0;
+			if (!samePasswordCredentialSnapshot(snapshot, input.credential)) return void 0;
 		}
 		const currentRequirement = yield* mapping.subject.decodeActionRequirement(row, action);
 		const now = yield* nowMillis;
@@ -383,10 +315,9 @@ const makePasswordKernel = (operations, proofs) => {
 		}));
 		yield* database.update(mapping.subject.table).set(updateValues([[mapping.subject.securityRevision, nextSecurityRevision]])).where(and(eq(subjectColumns(mapping).id, authority.nativeSubjectId), eq(subjectColumns(mapping).securityRevision, input.expectedRevision.securityRevision)));
 		yield* insertCommand(mapping, input, "add-password", commandNow ?? authority.now);
-		const inserted = (yield* readPasswordCredential(mapping, input.moduleId, authority.nativeSubjectId, false))[0];
-		const authorityInserted = (yield* database.select().from(mapping.authorityCredential.table).where(and(eq(authorityCredentialColumns(mapping).subjectId, authority.nativeSubjectId), eq(authorityCredentialColumns(mapping).credentialId, credentialId), eq(authorityCredentialColumns(mapping).revision, credentialRevision))).limit(1))[0];
-		const subjectUpdated = (yield* database.select().from(mapping.subject.table).where(and(eq(subjectColumns(mapping).id, authority.nativeSubjectId), eq(subjectColumns(mapping).securityRevision, nextSecurityRevision))).limit(1))[0];
-		if (inserted === void 0 || inserted[mapping.credential.credentialId] !== credentialId || inserted[mapping.credential.credentialRevision] !== credentialRevision || inserted[mapping.credential.verifierVersion] !== verifierVersion || inserted[mapping.credential.verifier] !== Redacted.value(input.replacement.verifier) || inserted[mapping.credential.normalization] !== input.replacement.normalization || authorityInserted === void 0 || subjectUpdated === void 0 || !(yield* mutationPostconditions(mapping, input, authority.nativeSubjectId, subjectUpdated, authorityInserted, commandNow ?? authority.now))) return yield* unavailable();
+		const applied = checkMutationApplied(mapping, input, authority.nativeSubjectId, revisions, commandNow ?? authority.now);
+		if (!(yield* applied)) return yield* unavailable();
+		yield* registerFinal(applied);
 		return true;
 	});
 	const makeSqlPasswordPersistence = Effect.fn("makeSqlPasswordPersistence")(function* (mapping, configuration) {
@@ -396,96 +327,11 @@ const makePasswordKernel = (operations, proofs) => {
 			proof: configuration.proof?.mapping
 		}) ?? Effect.void).pipe(Effect.mapError(unavailable));
 		const hooks = yield* LifecycleHooks;
+		if (!validConstraints(mapping)) return yield* unavailable();
+		const root = yield* NativeDatabase;
+		const credentials = yield* makePasswordCredentials(yield* sqlMapping(() => nativeTables(root.$client.withoutTransforms(), root)).pipe(translateFailure), mapping, configuration);
 		return PasswordPersistence.of({
-			admitAttempt: (input, prepare) => Effect.gen(function* () {
-				const attemptId = yield* allocate(configuration.mode, mapping.allocateAttemptId, mapping.allocateAttemptIdSync);
-				return yield* owned(database, mapping, configuration, Effect.gen(function* () {
-					const transaction = yield* CurrentPasswordSql;
-					const journal = yield* CurrentCommitJournal;
-					const resolved = yield* resolveCredential(mapping, input.moduleId, input.identifier, input.subjectId, configuration.locking);
-					const keys = mapping.scopeKeys({
-						moduleId: input.moduleId,
-						action: input.action,
-						identifier: input.identifier,
-						...resolved?.snapshot === void 0 ? {} : { subjectId: resolved.snapshot.revision.subjectId }
-					});
-					const scopes = scopeEntries(keys, input.policy);
-					const admitted = [];
-					yield* lockScope(mapping, configuration, input.moduleId, input.action, scopes[0]);
-					let currentNow = yield* nowMillis;
-					if (yield* scopeAdmits(mapping, input.moduleId, input.action, scopes[0], input.policy, input.identifier, resolved?.nativeSubjectId, currentNow)) admitted.push(scopes[0]);
-					if (admitted.length === 1) for (const entry of scopes.slice(1)) {
-						yield* lockScope(mapping, configuration, input.moduleId, input.action, entry);
-						currentNow = yield* nowMillis;
-						if (yield* scopeAdmits(mapping, input.moduleId, input.action, entry, input.policy, input.identifier, resolved?.nativeSubjectId, currentNow)) admitted.push(entry);
-					}
-					const now = yield* nowMillis;
-					for (const entry of admitted) yield* insertCharge(mapping, input.moduleId, input.action, entry, attemptId, now);
-					if (admitted.length !== scopes.length) return prepare({ _tag: "Denied" }, journal);
-					const snapshot = resolved?.snapshot;
-					const deadline = now + input.policy.attemptLifetimeMillis;
-					const retentionUntil = Math.max(deadline, ...scopes.map((entry) => now + entry.windowMillis));
-					yield* transaction.insert(mapping.attempt.table).values(mapping.attempt.encodeInsert({
-						moduleId: input.moduleId,
-						action: input.action,
-						attemptId,
-						identifier: input.identifier,
-						...snapshot === void 0 ? {} : {
-							subjectId: snapshot.revision.subjectId,
-							credentialId: snapshot.credentialId,
-							securityRevision: snapshot.revision.securityRevision,
-							credentialRevision: snapshot.credentialRevision,
-							verifierVersion: snapshot.verifierVersion,
-							identifierBindingRevision: snapshot.identifierBindingRevision
-						},
-						admittedAtMillis: now,
-						deadlineMillis: deadline,
-						retentionUntilMillis: retentionUntil
-					}, {
-						...resolved?.nativeSubjectId === void 0 ? {} : { nativeSubjectId: resolved.nativeSubjectId },
-						state: "pending"
-					}));
-					return prepare({
-						_tag: "Admitted",
-						attemptId,
-						...snapshot === void 0 ? {} : { credential: snapshot }
-					}, journal);
-				}));
-			}).pipe(Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
-			settleAttempt: (uncaptured, prepare) => Effect.gen(function* () {
-				const captured = uncaptured.captured === void 0 ? void 0 : yield* snapshotPasswordCredential(uncaptured.captured);
-				const input = {
-					...uncaptured,
-					...captured === void 0 ? {} : { captured }
-				};
-				return yield* owned(database, mapping, configuration, Effect.gen(function* () {
-					const transaction = yield* CurrentPasswordSql;
-					const journal = yield* CurrentCommitJournal;
-					const c = attemptColumns(mapping);
-					let row = (yield* selectRows(transaction.select().from(mapping.attempt.table).where(and(eq(c.moduleId, input.moduleId), eq(c.attemptId, input.attemptId))).limit(1), false))[0];
-					if (row === void 0 || row[mapping.attempt.state] !== "pending") return prepare("rejected", journal);
-					let decision = "rejected";
-					let current;
-					let attemptMatches = false;
-					if (input.outcome === "verified" && input.captured !== void 0) {
-						current = yield* resolveCredential(mapping, input.moduleId, input.captured.identifier, input.captured.revision.subjectId, configuration.locking);
-						attemptMatches = input.captured.moduleId === input.moduleId && row[mapping.attempt.identifierNamespace] === input.captured.identifier.namespace && row[mapping.attempt.identifierValue] === input.captured.identifier.value && mapping.subjectId.equals(row[mapping.attempt.subjectId], current?.nativeSubjectId) && row[mapping.attempt.credentialId] === input.captured.credentialId && row[mapping.attempt.securityRevision] === input.captured.revision.securityRevision && row[mapping.attempt.credentialRevision] === input.captured.credentialRevision && row[mapping.attempt.verifierVersion] === input.captured.verifierVersion && row[mapping.attempt.identifierBindingRevision] === input.captured.identifierBindingRevision;
-					}
-					row = (yield* selectRows(transaction.select().from(mapping.attempt.table).where(and(eq(c.moduleId, input.moduleId), eq(c.attemptId, input.attemptId))).limit(1), configuration.locking))[0];
-					if (row === void 0 || row[mapping.attempt.state] !== "pending") return prepare("rejected", journal);
-					const now = yield* nowMillis;
-					const deadline = yield* mapping.decodeInstant(row[mapping.attempt.deadline]);
-					if (attemptMatches && current?.snapshot !== void 0 && input.captured !== void 0 && deadline > now && sameCredentialSnapshot(current.snapshot, input.captured)) decision = "verified";
-					const prepared = prepare(decision, journal);
-					yield* transaction.update(mapping.attempt.table).set(updateValues([[mapping.attempt.state, decision]])).where(and(eq(c.moduleId, input.moduleId), eq(c.attemptId, input.attemptId), eq(c.state, "pending")));
-					if (decision === "verified" && input.rehash !== void 0 && current?.snapshot !== void 0) {
-						const cc = credentialColumns(mapping);
-						const nextVersion = yield* allocate(configuration.mode, mapping.allocateRevision, mapping.allocateRevisionSync);
-						yield* transaction.update(mapping.credential.table).set(mapping.credential.encodeVerifier(input.rehash.nextVerifier, nextVersion)).where(and(eq(cc.moduleId, input.moduleId), eq(cc.subjectId, current.nativeSubjectId), eq(cc.credentialId, current.snapshot.credentialId), eq(cc.credentialRevision, current.snapshot.credentialRevision), eq(cc.verifierVersion, input.rehash.expectedVersion), eq(cc.verifier, Redacted.value(input.rehash.expectedVerifier))));
-					}
-					return prepared;
-				}));
-			}).pipe(Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
+			...credentials,
 			readForSubject: (input) => safeRead(database, configuration, Effect.gen(function* () {
 				const transaction = yield* CurrentPasswordSql;
 				const locked = yield* lockSubject(mapping, input.subjectId, false);
@@ -565,72 +411,20 @@ const makePasswordKernel = (operations, proofs) => {
 					if (!(yield* currentExpectedCredential(mapping, input, authority.nativeSubjectId))) return prepare("rejected", journal);
 					let passwordReceipt;
 					yield* completeProofPlanIn(configuration.proof.mapping, configuration.proof.configuration, input.completion, Effect.gen(function* () {
-						return yield* writeReplacement(mapping, input, authority.nativeSubjectId, {
+						const revisions = {
 							credentialRevision,
 							verifierVersion,
 							nextSecurityRevision
-						}, authority.now);
+						};
+						const applied = yield* writeReplacement(mapping, input, authority.nativeSubjectId, revisions, authority.now);
+						if (applied) yield* registerReplacement(mapping, input, authority.nativeSubjectId, revisions, authority.now);
+						return applied;
 					}), (decision) => {
 						passwordReceipt = prepare(decision === "completed" ? "changed" : "rejected", journal);
 						return decision;
 					});
 					return passwordReceipt ?? prepare("rejected", journal);
 				}));
-			})).pipe(Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
-			cleanupAttempts: (input, prepare) => owned(database, mapping, configuration, Effect.gen(function* () {
-				const transaction = yield* CurrentPasswordSql;
-				const journal = yield* CurrentCommitJournal;
-				const now = yield* nowMillis;
-				const nativeNow = mapping.encodeInstant(now);
-				let remaining = input.limit;
-				let hasMore = false;
-				const a = attemptColumns(mapping);
-				const c = chargeColumns(mapping);
-				const attempts = yield* selectRows(transaction.select({ attemptId: a.attemptId }).from(mapping.attempt.table).where(and(eq(a.moduleId, input.moduleId), lte(a.retentionUntil, nativeNow))).limit(remaining + 1), false);
-				if (attempts.length > remaining) hasMore = true;
-				const attemptCandidates = attempts.slice(0, remaining);
-				remaining -= attemptCandidates.length;
-				const charges = yield* selectRows(transaction.select({
-					action: c.action,
-					scopeKind: c.scopeKind,
-					scopeKey: c.scopeKey,
-					attemptId: c.attemptId
-				}).from(mapping.charge.table).where(and(eq(c.moduleId, input.moduleId), lte(c.retentionUntil, nativeNow))).limit(remaining + 1), false);
-				if (charges.length > remaining) hasMore = true;
-				const chargeCandidates = charges.slice(0, remaining);
-				remaining -= chargeCandidates.length;
-				const sc = scopeColumns(mapping);
-				const scopes = yield* selectRows(transaction.select({
-					action: sc.action,
-					scopeKind: sc.scopeKind,
-					scopeKey: sc.scopeKey
-				}).from(mapping.rateScope.table).where(and(eq(sc.moduleId, input.moduleId), notExists(transaction.select({ one: sql`1` }).from(mapping.charge.table).where(and(eq(c.moduleId, sc.moduleId), eq(c.action, sc.action), eq(c.scopeKind, sc.scopeKind), eq(c.scopeKey, sc.scopeKey)))))).limit(remaining + 1), remaining === 0 ? false : configuration.locking);
-				if (scopes.length > remaining) hasMore = true;
-				const selectedScopes = scopes.slice(0, remaining);
-				remaining -= selectedScopes.length;
-				const selectedCharges = [];
-				for (const candidate of chargeCandidates) {
-					const locked = yield* selectRows(transaction.select({
-						action: c.action,
-						scopeKind: c.scopeKind,
-						scopeKey: c.scopeKey,
-						attemptId: c.attemptId
-					}).from(mapping.charge.table).where(and(eq(c.moduleId, input.moduleId), eq(c.action, candidate.action), eq(c.scopeKind, candidate.scopeKind), eq(c.scopeKey, candidate.scopeKey), eq(c.attemptId, candidate.attemptId), lte(c.retentionUntil, nativeNow))).limit(1), configuration.locking);
-					if (locked[0] !== void 0) selectedCharges.push(locked[0]);
-				}
-				const selectedAttempts = [];
-				for (const candidate of attemptCandidates) {
-					const locked = yield* selectRows(transaction.select({ attemptId: a.attemptId }).from(mapping.attempt.table).where(and(eq(a.moduleId, input.moduleId), eq(a.attemptId, candidate.attemptId), lte(a.retentionUntil, nativeNow))).limit(1), configuration.locking);
-					if (locked[0] !== void 0) selectedAttempts.push(locked[0]);
-				}
-				const prepared = prepare({
-					removed: selectedAttempts.length + selectedCharges.length + selectedScopes.length,
-					hasMore
-				}, journal);
-				for (const row of selectedCharges) yield* transaction.delete(mapping.charge.table).where(and(eq(c.moduleId, input.moduleId), eq(c.action, row.action), eq(c.scopeKind, row.scopeKind), eq(c.scopeKey, row.scopeKey), eq(c.attemptId, row.attemptId), lte(c.retentionUntil, nativeNow)));
-				if (selectedAttempts.length > 0) yield* transaction.delete(mapping.attempt.table).where(and(eq(a.moduleId, input.moduleId), inArray(a.attemptId, selectedAttempts.map((row) => row.attemptId)), lte(a.retentionUntil, nativeNow)));
-				for (const row of selectedScopes) yield* transaction.delete(mapping.rateScope.table).where(and(eq(sc.moduleId, input.moduleId), eq(sc.action, row.action), eq(sc.scopeKind, row.scopeKind), eq(sc.scopeKey, row.scopeKey), notExists(transaction.select({ one: sql`1` }).from(mapping.charge.table).where(and(eq(c.moduleId, sc.moduleId), eq(c.action, sc.action), eq(c.scopeKind, sc.scopeKind), eq(c.scopeKey, sc.scopeKey))))));
-				return prepared;
 			})).pipe(Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure)
 		});
 	});
@@ -646,7 +440,7 @@ const makePasswordKernel = (operations, proofs) => {
 		const credential = (yield* database.select().from(mapping.credential.table).where(and(eq(c.moduleId, input.moduleId), eq(c.subjectId, nativeSubjectId), eq(c.credentialId, revisions.credentialId), eq(c.credentialRevision, revisions.credentialRevision), eq(c.verifierVersion, revisions.verifierVersion), eq(c.verifier, Redacted.value(input.replacement.verifier)), eq(c.normalization, input.replacement.normalization))).limit(1))[0];
 		const subject = (yield* database.select().from(mapping.subject.table).where(and(eq(s.id, nativeSubjectId), eq(s.securityRevision, revisions.nextSecurityRevision))).limit(1))[0];
 		const authorityCredential = (yield* database.select().from(mapping.authorityCredential.table).where(and(eq(authorityCredentialColumns(mapping).subjectId, nativeSubjectId), eq(authorityCredentialColumns(mapping).credentialId, revisions.credentialId), eq(authorityCredentialColumns(mapping).revision, revisions.credentialRevision))).limit(1))[0];
-		return credential !== void 0 && (yield* mutationPostconditions(mapping, input, nativeSubjectId, subject, authorityCredential, now));
+		return credential !== void 0 && credential[mapping.credential.credentialId] === revisions.credentialId && credential[mapping.credential.credentialRevision] === revisions.credentialRevision && credential[mapping.credential.verifierVersion] === revisions.verifierVersion && credential[mapping.credential.verifier] === Redacted.value(input.replacement.verifier) && credential[mapping.credential.normalization] === input.replacement.normalization && (yield* mutationPostconditions(mapping, input, nativeSubjectId, subject, authorityCredential, now));
 	});
 	const writeReplacement = Effect.fn("DrizzlePassword.writeReplacement")(function* (mapping, input, nativeSubjectId, revisions, now) {
 		const database = yield* CurrentPasswordSql;
@@ -665,6 +459,10 @@ const makePasswordKernel = (operations, proofs) => {
 			credentialId: input.credential.credentialId
 		}, now);
 	});
+	const registerReplacement = (mapping, input, nativeSubjectId, revisions, now) => registerFinal(checkMutationApplied(mapping, input, nativeSubjectId, {
+		...revisions,
+		credentialId: input.credential.credentialId
+	}, now));
 	const replaceIn = Effect.fn("Drizzle.replaceIn")(function* (mapping, configuration, input, action, revisions, prepare) {
 		const journal = yield* CurrentCommitJournal;
 		const authority = yield* validateMutationAuthority(mapping, configuration, input, action);
@@ -673,6 +471,7 @@ const makePasswordKernel = (operations, proofs) => {
 		if (!(yield* currentExpectedCredential(mapping, input, authority.nativeSubjectId))) return prepare("rejected", journal);
 		const prepared = prepare("changed", journal);
 		if (!(yield* writeReplacement(mapping, input, authority.nativeSubjectId, revisions, authority.now))) return yield* unavailable();
+		yield* registerReplacement(mapping, input, authority.nativeSubjectId, revisions, authority.now);
 		return prepared;
 	});
 	return {
@@ -694,7 +493,7 @@ const makePasswordKernel = (operations, proofs) => {
 			checkMutationApplied,
 			writeReplacement,
 			evidenceSatisfiedAt,
-			sameCredentialSnapshot,
+			sameCredentialSnapshot: samePasswordCredentialSnapshot,
 			subjectColumns,
 			identifierColumns,
 			credentialColumns,