@yielded/auth-persistence 0.1.0-beta.23 → 0.1.0-beta.25

package/dist/internal/passkey-kernel.d.mts

@@ -4374,8 +4374,8 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
       readonly ceremony: import("@yielded/auth/Passkey").PasskeyCeremony;
       readonly claimId: string;
     }) => import("effect/Effect").Effect<{
-      readonly claim?: never;
       readonly _tag: "Rejected";
+      readonly claim?: never;
     } | {
       readonly _tag: "Claimed";
       readonly claim: {
@@ -4979,7 +4979,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
     invalidationMatches: (mapping: any, supplied: import("@yielded/auth/Sessions").SessionInvalidationWindow, policy: import("@yielded/auth/Passkey").PasskeyManagementPolicy) => boolean;
     invalidate: (mapping: any, subject: WriteSubject, invalidation: {
       readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
-      readonly existingSessions: "immediate" | "original-absolute-expiry";
+      readonly existingSessions: "cache-expiry" | "immediate" | "original-absolute-expiry";
       readonly maximumExposureMillis: number;
       readonly oldAuthenticationEvidence: "rejected";
     }) => import("effect/Effect").Effect<string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
@@ -5635,7 +5635,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
       readonly nowMillis: number;
     }) => import("effect/Effect").Effect<{
       readonly _tag: "Rejected";
-      readonly credential?: never;
+      credential?: never;
     } | {
       readonly _tag: "Enrolled";
       readonly credential: {
@@ -5706,20 +5706,19 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
       readonly _tag: "Rejected";
       readonly decision?: never;
     } | {
-      readonly credential?: never;
       readonly _tag: "Replay";
       readonly result: {
         readonly credentialId: string;
         readonly invalidation: {
           readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
-          readonly existingSessions: "immediate" | "original-absolute-expiry";
+          readonly existingSessions: "cache-expiry" | "immediate" | "original-absolute-expiry";
           readonly maximumExposureMillis: number;
           readonly oldAuthenticationEvidence: "rejected";
         };
         readonly replayed: true;
       };
+      credential?: never;
     } | {
-      readonly result?: never;
       readonly _tag: "Target";
       readonly credential: {
         readonly credentialId: string;
@@ -5757,6 +5756,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
         readonly counter: number;
         readonly maximumCounter: number;
       };
+      result?: never;
     }, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
     removeCredential: (mapping: any, input: {
       readonly moduleId: string;
@@ -5777,15 +5777,15 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
         readonly credentialId: string;
         readonly invalidation: {
           readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
-          readonly existingSessions: "immediate" | "original-absolute-expiry";
+          readonly existingSessions: "cache-expiry" | "immediate" | "original-absolute-expiry";
           readonly maximumExposureMillis: number;
           readonly oldAuthenticationEvidence: "rejected";
         };
         readonly replayed: true;
       };
     } | {
-      readonly result?: never;
       readonly _tag: "LastSignInMethod";
+      result?: never;
     } | {
       readonly _tag: "Removed";
       readonly result: {
@@ -5793,7 +5793,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
         replayed: boolean;
         invalidation: {
           readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
-          readonly existingSessions: "immediate" | "original-absolute-expiry";
+          readonly existingSessions: "cache-expiry" | "immediate" | "original-absolute-expiry";
           readonly maximumExposureMillis: number;
           readonly oldAuthenticationEvidence: "rejected";
         };

package/dist/internal/{password-attempts.d.mts → password-credentials.d.mts}

@@ -3,10 +3,9 @@ import "./models/password-model.mjs";
 import "./native-sql-table.mjs";
 import "./password-kernel.mjs";
 import { Effect, Option, Redacted } from "effect";
-import { LifecycleHooks } from "@yielded/auth/Hooks";
-import { PasswordCredentialSnapshot, PasswordUnavailable, PreparePasswordCommit } from "@yielded/auth/Password";
+import { EncodedPasswordHash, PasswordCredentialSnapshot, PasswordUnavailable } from "@yielded/auth/Password";
 import { LoginIdentifier } from "@yielded/auth/Identity";
-//#region src/internal/password-attempts.d.ts
+//#region src/internal/password-credentials.d.ts
 export declare const samePasswordCredentialSnapshot: (a: PasswordCredentialSnapshot, b: PasswordCredentialSnapshot) => boolean;
 //#endregion
-//# sourceMappingURL=password-attempts.d.mts.map
+//# sourceMappingURL=password-credentials.d.mts.map

package/dist/internal/password-credentials.mjs

@@ -0,0 +1,121 @@
+import { sqlMapping } from "./native-sql-table.mjs";
+import { NativeDatabase } from "./transaction-kernel.mjs";
+import { Effect, Option, Redacted, Schema } from "effect";
+import { CurrentCommitJournal, hasCommitScope } from "@yielded/auth/Hooks";
+import { reportPersistenceFailure } from "@yielded/auth/Persistence";
+import { EncodedPasswordHash, PasswordUnavailable, snapshotPasswordCredential } from "@yielded/auth/Password";
+//#region src/internal/password-credentials.ts
+const unavailable = () => PasswordUnavailable.make({});
+const failure = (effect) => reportPersistenceFailure(effect, Schema.is(PasswordUnavailable)).pipe(Effect.mapError(unavailable));
+const samePasswordCredentialSnapshot = (a, b) => a.moduleId === b.moduleId && a.revision.subjectId === b.revision.subjectId && a.revision.securityRevision === b.revision.securityRevision && a.revision.credentials.length === b.revision.credentials.length && new Set(a.revision.credentials.map((entry) => entry.credentialId)).size === a.revision.credentials.length && new Set(b.revision.credentials.map((entry) => entry.credentialId)).size === b.revision.credentials.length && a.revision.credentials.every((entry) => b.revision.credentials.some((other) => entry.credentialId === other.credentialId && entry.revision === other.revision)) && a.credentialId === b.credentialId && a.credentialRevision === b.credentialRevision && a.verifierVersion === b.verifierVersion && Redacted.value(a.verifier) === Redacted.value(b.verifier) && a.normalization === b.normalization && a.identifier.namespace === b.identifier.namespace && a.identifier.value === b.identifier.value && a.identifierBindingRevision === b.identifierBindingRevision && a.identifierVerifiedAtMillis === b.identifierVerifiedAtMillis;
+/** Lookup is read-only; rehash is one conditional maintenance write, never authentication. */
+const makePasswordCredentials = Effect.fnUntraced(function* (table, mapping, options) {
+	const sql = (yield* NativeDatabase).$client.withoutTransforms();
+	const parent = yield* Effect.serviceOption(CurrentCommitJournal);
+	const [s, i, c] = yield* sqlMapping(() => [
+		table(mapping.subject.table),
+		table(mapping.identifier.table),
+		table(mapping.credential.table)
+	]).pipe(failure);
+	const standalone = Effect.gen(function* () {
+		if (options.coordinated) {
+			const current = yield* Effect.serviceOption(CurrentCommitJournal);
+			if (Option.isNone(parent) || Option.isNone(current) || parent.value !== current.value) return yield* unavailable();
+		} else {
+			if (yield* hasCommitScope) return yield* unavailable();
+			yield* options.standaloneGuard;
+		}
+	});
+	const allocate = (asynchronous, sync) => {
+		if (options.mode !== "synchronous" && asynchronous !== void 0) return asynchronous;
+		return sync === void 0 ? Effect.fail(unavailable()) : Effect.try({
+			try: sync,
+			catch: unavailable
+		});
+	};
+	const snapshot = Effect.fnUntraced(function* (nativeId, moduleId, identifier) {
+		const subjectTable = s.as("password_subject");
+		const identifierTable = i.as("password_identifier");
+		const credentialTable = c.as("password_credential");
+		const rows = yield* sqlMapping(() => sql`select ${subjectTable.fields("subject_")}, ${identifierTable.fields("identifier_")}, ${credentialTable.fields("credential_")}
+      from ${subjectTable.name}
+      inner join ${identifierTable.name} on ${identifierTable.column(mapping.identifier.namespace)} = ${identifierTable.value(mapping.identifier.namespace, identifier.namespace)}
+        and ${identifierTable.column(mapping.identifier.value)} = ${identifierTable.value(mapping.identifier.value, identifier.value)}
+        and ${identifierTable.column(mapping.identifier.subjectId)} = ${identifierTable.value(mapping.identifier.subjectId, nativeId)}
+      inner join ${credentialTable.name} on ${credentialTable.column(mapping.credential.moduleId)} = ${credentialTable.value(mapping.credential.moduleId, moduleId)}
+        and ${credentialTable.column(mapping.credential.subjectId)} = ${credentialTable.value(mapping.credential.subjectId, nativeId)}
+      where ${subjectTable.column(mapping.subject.id)} = ${subjectTable.value(mapping.subject.id, nativeId)}
+      `).pipe(Effect.flatten);
+		if (rows.length !== 1) return void 0;
+		const [subject, identifierRow, credential] = yield* sqlMapping(() => [
+			s.decode(rows[0], "subject_"),
+			i.decode(rows[0], "identifier_"),
+			c.decode(rows[0], "credential_")
+		]);
+		if (yield* sqlMapping(() => !mapping.subject.isActiveStatus(subject[mapping.subject.status]) || !mapping.identifier.isCurrent(identifierRow) || !mapping.subjectId.equals(nativeId, identifierRow[mapping.identifier.subjectId]) || !mapping.subjectId.equals(nativeId, subject[mapping.subject.id]) || !mapping.subjectId.equals(nativeId, credential[mapping.credential.subjectId]))) return void 0;
+		return yield* sqlMapping(() => mapping.credential.decode({
+			moduleId,
+			subject,
+			identifier: identifierRow,
+			credential
+		})).pipe(Effect.flatten, Effect.flatMap(snapshotPasswordCredential));
+	});
+	return {
+		findCredential: (uncaptured) => Effect.gen(function* () {
+			const input = {
+				...uncaptured,
+				identifier: { ...uncaptured.identifier }
+			};
+			yield* standalone;
+			const identifiers = yield* sqlMapping(() => sql`select ${i.fields("i_")} from ${i.name}
+          where ${i.column(mapping.identifier.namespace)} = ${i.value(mapping.identifier.namespace, input.identifier.namespace)}
+            and ${i.column(mapping.identifier.value)} = ${i.value(mapping.identifier.value, input.identifier.value)}`).pipe(Effect.flatten);
+			const identifier = identifiers.length === 1 ? yield* sqlMapping(() => i.decode(identifiers[0], "i_")) : void 0;
+			if (identifier === void 0 || !(yield* sqlMapping(() => mapping.identifier.isCurrent(identifier)))) return Option.none();
+			const credential = yield* snapshot(identifier[mapping.identifier.subjectId], input.moduleId, input.identifier);
+			return credential === void 0 || input.subjectId !== void 0 && credential.revision.subjectId !== input.subjectId ? Option.none() : Option.some(credential);
+		}).pipe(failure),
+		rehashIfCurrent: (input) => Effect.gen(function* () {
+			const nextVerifier = Redacted.make(yield* Schema.decodeEffect(EncodedPasswordHash)(Redacted.value(input.nextVerifier)));
+			const credential = yield* snapshotPasswordCredential(input.credential);
+			yield* standalone;
+			const nativeId = yield* mapping.subjectId.toNative(credential.revision.subjectId);
+			const version = yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync);
+			if (version === credential.verifierVersion) return yield* unavailable();
+			yield* sqlMapping(() => {
+				const encoded = mapping.credential.encodeVerifier(nextVerifier, version);
+				const values = {
+					[mapping.credential.verifier]: encoded[mapping.credential.verifier],
+					[mapping.credential.verifierVersion]: encoded[mapping.credential.verifierVersion]
+				};
+				if (Object.values(values).some((value) => value === void 0)) throw unavailable();
+				const exact = sql.and(Object.entries({
+					[mapping.credential.moduleId]: credential.moduleId,
+					[mapping.credential.subjectId]: nativeId,
+					[mapping.credential.credentialId]: credential.credentialId,
+					[mapping.credential.credentialRevision]: credential.credentialRevision,
+					[mapping.credential.verifierVersion]: credential.verifierVersion,
+					[mapping.credential.verifier]: Redacted.value(credential.verifier),
+					[mapping.credential.normalization]: credential.normalization
+				}).map(([key, value]) => {
+					const column = c.column(key), bound = c.value(key, value);
+					if (typeof value !== "string") return sql`${column} = ${bound}`;
+					return sql.onDialectOrElse({
+						mysql: () => sql`binary ${column} = binary ${bound}`,
+						pg: () => sql`convert_to(cast(${column} as text), 'UTF8') = convert_to(cast(${bound} as text), 'UTF8')`,
+						orElse: () => sql`cast(${column} as blob) = cast(${bound} as blob)`
+					});
+				}));
+				return sql`${c.update(values)}
+          where ${c.column(mapping.credential.moduleId)} = ${c.value(mapping.credential.moduleId, credential.moduleId)}
+            and ${c.column(mapping.credential.subjectId)} = ${c.value(mapping.credential.subjectId, nativeId)}
+            and ${c.column(mapping.credential.credentialId)} = ${c.value(mapping.credential.credentialId, credential.credentialId)}
+            and ${exact}`;
+			}).pipe(Effect.flatten);
+		}).pipe(failure)
+	};
+});
+//#endregion
+export { makePasswordCredentials, samePasswordCredentialSnapshot };
+
+//# sourceMappingURL=password-credentials.mjs.map

package/dist/internal/password-credentials.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-credentials.mjs","names":[],"sources":["../../src/internal/password-credentials.ts"],"sourcesContent":["import { CurrentCommitJournal, hasCommitScope } from \"@yielded/auth/Hooks\";\nimport type { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport {\n  EncodedPasswordHash,\n  type PasswordPersistence,\n  PasswordUnavailable,\n  snapshotPasswordCredential,\n  type PasswordCredentialSnapshot,\n} from \"@yielded/auth/Password\";\nimport { reportPersistenceFailure } from \"@yielded/auth/Persistence\";\nimport { Effect, Option, Redacted, Schema } from \"effect\";\n\nimport type { PersistenceMappingError } from \"./mapping-error\";\nimport type { AnyPasswordPersistenceMapping } from \"./models/password-model\";\nimport { sqlMapping, type SqlTable } from \"./native-sql-table\";\nimport type { PasswordSqlConfiguration } from \"./password-kernel\";\nimport { NativeDatabase } from \"./transaction-kernel\";\n\ntype Row = Readonly<Record<string, unknown>>;\nconst unavailable = () => PasswordUnavailable.make({});\n\nconst failure = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n  reportPersistenceFailure(effect, Schema.is(PasswordUnavailable)).pipe(\n    Effect.mapError(unavailable),\n  );\n\nexport const samePasswordCredentialSnapshot = (\n  a: PasswordCredentialSnapshot,\n  b: PasswordCredentialSnapshot,\n) =>\n  a.moduleId === b.moduleId &&\n  a.revision.subjectId === b.revision.subjectId &&\n  a.revision.securityRevision === b.revision.securityRevision &&\n  a.revision.credentials.length === b.revision.credentials.length &&\n  new Set(a.revision.credentials.map((entry) => entry.credentialId)).size ===\n    a.revision.credentials.length &&\n  new Set(b.revision.credentials.map((entry) => entry.credentialId)).size ===\n    b.revision.credentials.length &&\n  a.revision.credentials.every((entry) =>\n    b.revision.credentials.some(\n      (other) => entry.credentialId === other.credentialId && entry.revision === other.revision,\n    ),\n  ) &&\n  a.credentialId === b.credentialId &&\n  a.credentialRevision === b.credentialRevision &&\n  a.verifierVersion === b.verifierVersion &&\n  Redacted.value(a.verifier) === Redacted.value(b.verifier) &&\n  a.normalization === b.normalization &&\n  a.identifier.namespace === b.identifier.namespace &&\n  a.identifier.value === b.identifier.value &&\n  a.identifierBindingRevision === b.identifierBindingRevision &&\n  a.identifierVerifiedAtMillis === b.identifierVerifiedAtMillis;\n\n/** Lookup is read-only; rehash is one conditional maintenance write, never authentication. */\nexport const makePasswordCredentials = Effect.fnUntraced(function* (\n  table: (table: object) => SqlTable,\n  mapping: AnyPasswordPersistenceMapping,\n  options: PasswordSqlConfiguration,\n): Effect.fn.Return<\n  Pick<PasswordPersistence[\"Service\"], \"findCredential\" | \"rehashIfCurrent\">,\n  PasswordUnavailable,\n  NativeDatabase\n> {\n  const sql = (yield* NativeDatabase).$client.withoutTransforms();\n  const parent = yield* Effect.serviceOption(CurrentCommitJournal);\n\n  const [s, i, c] = yield* sqlMapping(\n    () =>\n      [\n        table(mapping.subject.table),\n        table(mapping.identifier.table),\n        table(mapping.credential.table),\n      ] as const,\n  ).pipe(failure);\n\n  const standalone = Effect.gen(function* () {\n    if (options.coordinated) {\n      const current = yield* Effect.serviceOption(CurrentCommitJournal);\n\n      if (Option.isNone(parent) || Option.isNone(current) || parent.value !== current.value)\n        return yield* unavailable();\n    } else {\n      if (yield* hasCommitScope) return yield* unavailable();\n      yield* options.standaloneGuard;\n    }\n  });\n\n  const allocate = <A>(\n    asynchronous: Effect.Effect<A, PersistenceMappingError> | undefined,\n    sync: (() => A) | undefined,\n  ) => {\n    if (options.mode !== \"synchronous\" && asynchronous !== undefined) return asynchronous;\n\n    return sync === undefined\n      ? Effect.fail(unavailable())\n      : Effect.try({ try: sync, catch: unavailable });\n  };\n\n  // Bind each native ID through its own column codec. Physical encodings of the\n  // same application ID need not match across subject, identifier and password.\n  const snapshot = Effect.fnUntraced(function* (\n    nativeId: unknown,\n    moduleId: string,\n    identifier: LoginIdentifier,\n  ) {\n    const subjectTable = s.as(\"password_subject\");\n    const identifierTable = i.as(\"password_identifier\");\n    const credentialTable = c.as(\"password_credential\");\n\n    const rows = yield* sqlMapping(\n      () =>\n        sql<Row>`select ${subjectTable.fields(\"subject_\")}, ${identifierTable.fields(\"identifier_\")}, ${credentialTable.fields(\"credential_\")}\n      from ${subjectTable.name}\n      inner join ${identifierTable.name} on ${identifierTable.column(mapping.identifier.namespace)} = ${identifierTable.value(mapping.identifier.namespace, identifier.namespace)}\n        and ${identifierTable.column(mapping.identifier.value)} = ${identifierTable.value(mapping.identifier.value, identifier.value)}\n        and ${identifierTable.column(mapping.identifier.subjectId)} = ${identifierTable.value(mapping.identifier.subjectId, nativeId)}\n      inner join ${credentialTable.name} on ${credentialTable.column(mapping.credential.moduleId)} = ${credentialTable.value(mapping.credential.moduleId, moduleId)}\n        and ${credentialTable.column(mapping.credential.subjectId)} = ${credentialTable.value(mapping.credential.subjectId, nativeId)}\n      where ${subjectTable.column(mapping.subject.id)} = ${subjectTable.value(mapping.subject.id, nativeId)}\n      `,\n    ).pipe(Effect.flatten);\n\n    if (rows.length !== 1) return undefined;\n\n    const [subject, identifierRow, credential] = yield* sqlMapping(\n      () =>\n        [\n          s.decode(rows[0]!, \"subject_\"),\n          i.decode(rows[0]!, \"identifier_\"),\n          c.decode(rows[0]!, \"credential_\"),\n        ] as const,\n    );\n\n    if (\n      yield* sqlMapping(\n        () =>\n          !mapping.subject.isActiveStatus(subject[mapping.subject.status]) ||\n          !mapping.identifier.isCurrent(identifierRow) ||\n          !mapping.subjectId.equals(nativeId, identifierRow[mapping.identifier.subjectId]) ||\n          !mapping.subjectId.equals(nativeId, subject[mapping.subject.id]) ||\n          !mapping.subjectId.equals(nativeId, credential[mapping.credential.subjectId]),\n      )\n    )\n      return undefined;\n\n    const captured = yield* sqlMapping(() =>\n      mapping.credential.decode({ moduleId, subject, identifier: identifierRow, credential }),\n    ).pipe(Effect.flatten, Effect.flatMap(snapshotPasswordCredential));\n\n    return captured;\n  });\n\n  return {\n    findCredential: (uncaptured) =>\n      Effect.gen(function* () {\n        const input = { ...uncaptured, identifier: { ...uncaptured.identifier } };\n\n        yield* standalone;\n\n        const identifiers = yield* sqlMapping(\n          () => sql<Row>`select ${i.fields(\"i_\")} from ${i.name}\n          where ${i.column(mapping.identifier.namespace)} = ${i.value(mapping.identifier.namespace, input.identifier.namespace)}\n            and ${i.column(mapping.identifier.value)} = ${i.value(mapping.identifier.value, input.identifier.value)}`,\n        ).pipe(Effect.flatten);\n\n        const identifier =\n          identifiers.length === 1\n            ? yield* sqlMapping(() => i.decode(identifiers[0]!, \"i_\"))\n            : undefined;\n\n        if (\n          identifier === undefined ||\n          !(yield* sqlMapping(() => mapping.identifier.isCurrent(identifier)))\n        )\n          return Option.none();\n\n        const credential = yield* snapshot(\n          identifier[mapping.identifier.subjectId],\n          input.moduleId,\n          input.identifier,\n        );\n\n        return credential === undefined ||\n          (input.subjectId !== undefined && credential.revision.subjectId !== input.subjectId)\n          ? Option.none()\n          : Option.some(credential);\n      }).pipe(failure),\n    rehashIfCurrent: (input) =>\n      Effect.gen(function* () {\n        const nextVerifier = Redacted.make(\n          yield* Schema.decodeEffect(EncodedPasswordHash)(Redacted.value(input.nextVerifier)),\n        );\n\n        const credential = yield* snapshotPasswordCredential(input.credential);\n\n        yield* standalone;\n        const nativeId = yield* mapping.subjectId.toNative(credential.revision.subjectId);\n        const version = yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync);\n\n        if (version === credential.verifierVersion) return yield* unavailable();\n        yield* sqlMapping(() => {\n          const encoded = mapping.credential.encodeVerifier(nextVerifier, version);\n\n          // A custom encoder cannot turn maintenance into a semantic credential change.\n          const values = {\n            [mapping.credential.verifier]: encoded[mapping.credential.verifier],\n            [mapping.credential.verifierVersion]: encoded[mapping.credential.verifierVersion],\n          };\n\n          if (Object.values(values).some((value) => value === undefined)) throw unavailable();\n\n          // Ordinary identity predicates retain index use; the full CAS ignores text collation.\n          const exact = sql.and(\n            Object.entries({\n              [mapping.credential.moduleId]: credential.moduleId,\n              [mapping.credential.subjectId]: nativeId,\n              [mapping.credential.credentialId]: credential.credentialId,\n              [mapping.credential.credentialRevision]: credential.credentialRevision,\n              [mapping.credential.verifierVersion]: credential.verifierVersion,\n              [mapping.credential.verifier]: Redacted.value(credential.verifier),\n              [mapping.credential.normalization]: credential.normalization,\n            }).map(([key, value]) => {\n              const column = c.column(key),\n                bound = c.value(key, value);\n\n              if (typeof value !== \"string\") return sql`${column} = ${bound}`;\n\n              return sql.onDialectOrElse({\n                mysql: () => sql`binary ${column} = binary ${bound}`,\n                pg: () =>\n                  sql`convert_to(cast(${column} as text), 'UTF8') = convert_to(cast(${bound} as text), 'UTF8')`,\n                orElse: () => sql`cast(${column} as blob) = cast(${bound} as blob)`,\n              });\n            }),\n          );\n\n          return sql`${c.update(values)}\n          where ${c.column(mapping.credential.moduleId)} = ${c.value(mapping.credential.moduleId, credential.moduleId)}\n            and ${c.column(mapping.credential.subjectId)} = ${c.value(mapping.credential.subjectId, nativeId)}\n            and ${c.column(mapping.credential.credentialId)} = ${c.value(mapping.credential.credentialId, credential.credentialId)}\n            and ${exact}`;\n        }).pipe(Effect.flatten);\n      }).pipe(failure),\n  } satisfies Pick<PasswordPersistence[\"Service\"], \"findCredential\" | \"rehashIfCurrent\">;\n});\n"],"mappings":";;;;;;;AAmBA,MAAM,oBAAoB,oBAAoB,KAAK,CAAC,CAAC;AAErD,MAAM,WAAoB,WACxB,yBAAyB,QAAQ,OAAO,GAAG,mBAAmB,CAAC,CAAC,CAAC,KAC/D,OAAO,SAAS,WAAW,CAC7B;AAEF,MAAa,kCACX,GACA,MAEA,EAAE,aAAa,EAAE,YACjB,EAAE,SAAS,cAAc,EAAE,SAAS,aACpC,EAAE,SAAS,qBAAqB,EAAE,SAAS,oBAC3C,EAAE,SAAS,YAAY,WAAW,EAAE,SAAS,YAAY,UACzD,IAAI,IAAI,EAAE,SAAS,YAAY,KAAK,UAAU,MAAM,YAAY,CAAC,CAAC,CAAC,SACjE,EAAE,SAAS,YAAY,UACzB,IAAI,IAAI,EAAE,SAAS,YAAY,KAAK,UAAU,MAAM,YAAY,CAAC,CAAC,CAAC,SACjE,EAAE,SAAS,YAAY,UACzB,EAAE,SAAS,YAAY,OAAO,UAC5B,EAAE,SAAS,YAAY,MACpB,UAAU,MAAM,iBAAiB,MAAM,gBAAgB,MAAM,aAAa,MAAM,QACnF,CACF,KACA,EAAE,iBAAiB,EAAE,gBACrB,EAAE,uBAAuB,EAAE,sBAC3B,EAAE,oBAAoB,EAAE,mBACxB,SAAS,MAAM,EAAE,QAAQ,MAAM,SAAS,MAAM,EAAE,QAAQ,KACxD,EAAE,kBAAkB,EAAE,iBACtB,EAAE,WAAW,cAAc,EAAE,WAAW,aACxC,EAAE,WAAW,UAAU,EAAE,WAAW,SACpC,EAAE,8BAA8B,EAAE,6BAClC,EAAE,+BAA+B,EAAE;;AAGrC,MAAa,0BAA0B,OAAO,WAAW,WACvD,OACA,SACA,SAKA;CACA,MAAM,OAAO,OAAO,eAAA,CAAgB,QAAQ,kBAAkB;CAC9D,MAAM,SAAS,OAAO,OAAO,cAAc,oBAAoB;CAE/D,MAAM,CAAC,GAAG,GAAG,KAAK,OAAO,iBAErB;EACE,MAAM,QAAQ,QAAQ,KAAK;EAC3B,MAAM,QAAQ,WAAW,KAAK;EAC9B,MAAM,QAAQ,WAAW,KAAK;CAChC,CACJ,CAAC,CAAC,KAAK,OAAO;CAEd,MAAM,aAAa,OAAO,IAAI,aAAa;EACzC,IAAI,QAAQ,aAAa;GACvB,MAAM,UAAU,OAAO,OAAO,cAAc,oBAAoB;GAEhE,IAAI,OAAO,OAAO,MAAM,KAAK,OAAO,OAAO,OAAO,KAAK,OAAO,UAAU,QAAQ,OAC9E,OAAO,OAAO,YAAY;EAC9B,OAAO;GACL,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;GACrD,OAAO,QAAQ;EACjB;CACF,CAAC;CAED,MAAM,YACJ,cACA,SACG;EACH,IAAI,QAAQ,SAAS,iBAAiB,iBAAiB,KAAA,GAAW,OAAO;EAEzE,OAAO,SAAS,KAAA,IACZ,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;GAAE,KAAK;GAAM,OAAO;EAAY,CAAC;CAClD;CAIA,MAAM,WAAW,OAAO,WAAW,WACjC,UACA,UACA,YACA;EACA,MAAM,eAAe,EAAE,GAAG,kBAAkB;EAC5C,MAAM,kBAAkB,EAAE,GAAG,qBAAqB;EAClD,MAAM,kBAAkB,EAAE,GAAG,qBAAqB;EAElD,MAAM,OAAO,OAAO,iBAEhB,GAAQ,UAAU,aAAa,OAAO,UAAU,EAAE,IAAI,gBAAgB,OAAO,aAAa,EAAE,IAAI,gBAAgB,OAAO,aAAa,EAAE;aACjI,aAAa,KAAK;mBACZ,gBAAgB,KAAK,MAAM,gBAAgB,OAAO,QAAQ,WAAW,SAAS,EAAE,KAAK,gBAAgB,MAAM,QAAQ,WAAW,WAAW,WAAW,SAAS,EAAE;cACpK,gBAAgB,OAAO,QAAQ,WAAW,KAAK,EAAE,KAAK,gBAAgB,MAAM,QAAQ,WAAW,OAAO,WAAW,KAAK,EAAE;cACxH,gBAAgB,OAAO,QAAQ,WAAW,SAAS,EAAE,KAAK,gBAAgB,MAAM,QAAQ,WAAW,WAAW,QAAQ,EAAE;mBACnH,gBAAgB,KAAK,MAAM,gBAAgB,OAAO,QAAQ,WAAW,QAAQ,EAAE,KAAK,gBAAgB,MAAM,QAAQ,WAAW,UAAU,QAAQ,EAAE;cACtJ,gBAAgB,OAAO,QAAQ,WAAW,SAAS,EAAE,KAAK,gBAAgB,MAAM,QAAQ,WAAW,WAAW,QAAQ,EAAE;cACxH,aAAa,OAAO,QAAQ,QAAQ,EAAE,EAAE,KAAK,aAAa,MAAM,QAAQ,QAAQ,IAAI,QAAQ,EAAE;OAExG,CAAC,CAAC,KAAK,OAAO,OAAO;EAErB,IAAI,KAAK,WAAW,GAAG,OAAO,KAAA;EAE9B,MAAM,CAAC,SAAS,eAAe,cAAc,OAAO,iBAEhD;GACE,EAAE,OAAO,KAAK,IAAK,UAAU;GAC7B,EAAE,OAAO,KAAK,IAAK,aAAa;GAChC,EAAE,OAAO,KAAK,IAAK,aAAa;EAClC,CACJ;EAEA,IACE,OAAO,iBAEH,CAAC,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,KAC/D,CAAC,QAAQ,WAAW,UAAU,aAAa,KAC3C,CAAC,QAAQ,UAAU,OAAO,UAAU,cAAc,QAAQ,WAAW,UAAU,KAC/E,CAAC,QAAQ,UAAU,OAAO,UAAU,QAAQ,QAAQ,QAAQ,GAAG,KAC/D,CAAC,QAAQ,UAAU,OAAO,UAAU,WAAW,QAAQ,WAAW,UAAU,CAChF,GAEA,OAAO,KAAA;EAMT,OAAO,OAJiB,iBACtB,QAAQ,WAAW,OAAO;GAAE;GAAU;GAAS,YAAY;GAAe;EAAW,CAAC,CACxF,CAAC,CAAC,KAAK,OAAO,SAAS,OAAO,QAAQ,0BAA0B,CAAC;CAGnE,CAAC;CAED,OAAO;EACL,iBAAiB,eACf,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ;IAAE,GAAG;IAAY,YAAY,EAAE,GAAG,WAAW,WAAW;GAAE;GAExE,OAAO;GAEP,MAAM,cAAc,OAAO,iBACnB,GAAQ,UAAU,EAAE,OAAO,IAAI,EAAE,QAAQ,EAAE,KAAK;kBAC9C,EAAE,OAAO,QAAQ,WAAW,SAAS,EAAE,KAAK,EAAE,MAAM,QAAQ,WAAW,WAAW,MAAM,WAAW,SAAS,EAAE;kBAC9G,EAAE,OAAO,QAAQ,WAAW,KAAK,EAAE,KAAK,EAAE,MAAM,QAAQ,WAAW,OAAO,MAAM,WAAW,KAAK,GAC1G,CAAC,CAAC,KAAK,OAAO,OAAO;GAErB,MAAM,aACJ,YAAY,WAAW,IACnB,OAAO,iBAAiB,EAAE,OAAO,YAAY,IAAK,IAAI,CAAC,IACvD,KAAA;GAEN,IACE,eAAe,KAAA,KACf,EAAE,OAAO,iBAAiB,QAAQ,WAAW,UAAU,UAAU,CAAC,IAElE,OAAO,OAAO,KAAK;GAErB,MAAM,aAAa,OAAO,SACxB,WAAW,QAAQ,WAAW,YAC9B,MAAM,UACN,MAAM,UACR;GAEA,OAAO,eAAe,KAAA,KACnB,MAAM,cAAc,KAAA,KAAa,WAAW,SAAS,cAAc,MAAM,YACxE,OAAO,KAAK,IACZ,OAAO,KAAK,UAAU;EAC5B,CAAC,CAAC,CAAC,KAAK,OAAO;EACjB,kBAAkB,UAChB,OAAO,IAAI,aAAa;GACtB,MAAM,eAAe,SAAS,KAC5B,OAAO,OAAO,aAAa,mBAAmB,CAAC,CAAC,SAAS,MAAM,MAAM,YAAY,CAAC,CACpF;GAEA,MAAM,aAAa,OAAO,2BAA2B,MAAM,UAAU;GAErE,OAAO;GACP,MAAM,WAAW,OAAO,QAAQ,UAAU,SAAS,WAAW,SAAS,SAAS;GAChF,MAAM,UAAU,OAAO,SAAS,QAAQ,kBAAkB,QAAQ,oBAAoB;GAEtF,IAAI,YAAY,WAAW,iBAAiB,OAAO,OAAO,YAAY;GACtE,OAAO,iBAAiB;IACtB,MAAM,UAAU,QAAQ,WAAW,eAAe,cAAc,OAAO;IAGvE,MAAM,SAAS;MACZ,QAAQ,WAAW,WAAW,QAAQ,QAAQ,WAAW;MACzD,QAAQ,WAAW,kBAAkB,QAAQ,QAAQ,WAAW;IACnE;IAEA,IAAI,OAAO,OAAO,MAAM,CAAC,CAAC,MAAM,UAAU,UAAU,KAAA,CAAS,GAAG,MAAM,YAAY;IAGlF,MAAM,QAAQ,IAAI,IAChB,OAAO,QAAQ;MACZ,QAAQ,WAAW,WAAW,WAAW;MACzC,QAAQ,WAAW,YAAY;MAC/B,QAAQ,WAAW,eAAe,WAAW;MAC7C,QAAQ,WAAW,qBAAqB,WAAW;MACnD,QAAQ,WAAW,kBAAkB,WAAW;MAChD,QAAQ,WAAW,WAAW,SAAS,MAAM,WAAW,QAAQ;MAChE,QAAQ,WAAW,gBAAgB,WAAW;IACjD,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW;KACvB,MAAM,SAAS,EAAE,OAAO,GAAG,GACzB,QAAQ,EAAE,MAAM,KAAK,KAAK;KAE5B,IAAI,OAAO,UAAU,UAAU,OAAO,GAAG,GAAG,OAAO,KAAK;KAExD,OAAO,IAAI,gBAAgB;MACzB,aAAa,GAAG,UAAU,OAAO,YAAY;MAC7C,UACE,GAAG,mBAAmB,OAAO,uCAAuC,MAAM;MAC5E,cAAc,GAAG,QAAQ,OAAO,mBAAmB,MAAM;KAC3D,CAAC;IACH,CAAC,CACH;IAEA,OAAO,GAAG,GAAG,EAAE,OAAO,MAAM,EAAE;kBACtB,EAAE,OAAO,QAAQ,WAAW,QAAQ,EAAE,KAAK,EAAE,MAAM,QAAQ,WAAW,UAAU,WAAW,QAAQ,EAAE;kBACrG,EAAE,OAAO,QAAQ,WAAW,SAAS,EAAE,KAAK,EAAE,MAAM,QAAQ,WAAW,WAAW,QAAQ,EAAE;kBAC5F,EAAE,OAAO,QAAQ,WAAW,YAAY,EAAE,KAAK,EAAE,MAAM,QAAQ,WAAW,cAAc,WAAW,YAAY,EAAE;kBACjH;GACV,CAAC,CAAC,CAAC,KAAK,OAAO,OAAO;EACxB,CAAC,CAAC,CAAC,KAAK,OAAO;CACnB;AACF,CAAC"}

package/dist/internal/password-kernel.d.mts

@@ -4,7 +4,7 @@ import { QueryFailure, QueryOperations, SqlColumn, SqlFragment } from "./query-o
 import { AnyPasswordPersistenceMapping } from "./models/password-model.mjs";
 import { CurrentProofSql, ProofSqlConfiguration, makeProofKernel } from "./proof-kernel.mjs";
 import { NativeSqlTables } from "./native-sql-table.mjs";
-import { samePasswordCredentialSnapshot } from "./password-attempts.mjs";
+import { samePasswordCredentialSnapshot } from "./password-credentials.mjs";
 import { Context, DateTime, Effect, Option, Redacted } from "effect";
 import { CurrentCommitJournal, HookConfigurationError, LifecycleHooks, PreparedCommit } from "@yielded/auth/Hooks";
 import { AuthenticationEvidence, AuthenticationRequirement, SecurityRevision } from "@yielded/auth/Sessions";
@@ -52,24 +52,15 @@ export interface PasswordSqlConfiguration {
 type Database = PasswordSqlDatabase;
 export declare const makePasswordKernel: <Fragment extends SqlFragment = SqlFragment, Column extends SqlColumn = SqlColumn>(operations: QueryOperations<Fragment, Column>, proofs: Pick<ReturnType<typeof makeProofKernel>, "completeProofPlanIn">, nativeTables?: (client: SqlClient, database: object) => NativeSqlTables) => {
   makeSqlPasswordPersistence: (mapping: AnyPasswordPersistenceMapping<Fragment>, configuration: PasswordSqlConfiguration) => Effect.Effect<{
-    readonly prepareAttempt: (input: {
+    readonly findCredential: (input: {
       readonly moduleId: string;
-      readonly action: "sign-in" | "change";
       readonly identifier: LoginIdentifier;
       readonly subjectId?: import("@yielded/auth/Schema").SubjectId;
-      readonly attemptLifetimeMillis: number;
-    }) => Effect.Effect<import("@yielded/auth/Password").PasswordAttemptPreparation, PasswordUnavailable>;
-    readonly settleAttempt: <A>(input: {
-      readonly moduleId: string;
-      readonly attemptId: import("@yielded/auth/Password").PasswordAttemptId;
-      readonly captured?: import("@yielded/auth/Password").PasswordCredentialSnapshot;
-      readonly outcome: import("@yielded/auth/Password").PasswordAttemptDecision;
-      readonly rehash?: {
-        readonly expectedVersion: SecurityRevision;
-        readonly expectedVerifier: Redacted.Redacted<import("@yielded/auth/Password").EncodedPasswordHash>;
-        readonly nextVerifier: Redacted.Redacted<import("@yielded/auth/Password").EncodedPasswordHash>;
-      };
-    }, prepare: import("@yielded/auth/Password").PreparePasswordCommit<import("@yielded/auth/Password").PasswordAttemptDecision, A>) => Effect.Effect<PreparedCommit<A>, PasswordUnavailable>;
+    }) => Effect.Effect<Option.Option<import("@yielded/auth/Password").PasswordCredentialSnapshot>, PasswordUnavailable>;
+    readonly rehashIfCurrent: (input: {
+      readonly credential: import("@yielded/auth/Password").PasswordCredentialSnapshot;
+      readonly nextVerifier: Redacted.Redacted<import("@yielded/auth/Password").EncodedPasswordHash>;
+    }) => Effect.Effect<void, PasswordUnavailable>;
     readonly readForSubject: (input: {
       readonly moduleId: string;
       readonly subjectId: import("@yielded/auth/Schema").SubjectId;
@@ -84,13 +75,6 @@ export declare const makePasswordKernel: <Fragment extends SqlFragment = SqlFrag
     readonly resetWithProof: <A>(input: PasswordMutationInput & {
       readonly completion: ProofCompletionPlan;
     }, prepare: import("@yielded/auth/Password").PreparePasswordCommit<PasswordMutationDecision, A>) => Effect.Effect<PreparedCommit<A>, PasswordUnavailable>;
-    readonly cleanupAttempts: <A>(input: {
-      readonly moduleId: string;
-      readonly limit: number;
-    }, prepare: import("@yielded/auth/Password").PreparePasswordCommit<{
-      readonly removed: number;
-      readonly hasMore: boolean;
-    }, A>) => Effect.Effect<PreparedCommit<A>, PasswordUnavailable>;
   }, PasswordUnavailable, CurrentPasswordSql | LifecycleHooks | NativeDatabase>;
   passwordSqlKernel: {
     allocate: <A>(mode: PasswordSqlConfiguration["mode"], asyncValue: Effect.Effect<A, PersistenceMappingError> | undefined, syncValue: (() => A) | undefined) => Effect.Effect<A, PasswordUnavailable | PersistenceMappingError>;
@@ -133,7 +117,7 @@ export declare const makePasswordKernel: <Fragment extends SqlFragment = SqlFrag
       }>;
       invalidation: Readonly<{
         trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
-        existingSessions: "immediate" | "original-absolute-expiry";
+        existingSessions: "cache-expiry" | "immediate" | "original-absolute-expiry";
         maximumExposureMillis: number;
         oldAuthenticationEvidence: "rejected";
       }>;

package/dist/internal/password-kernel.mjs

@@ -4,7 +4,7 @@ import { NativeDatabase } from "./transaction-kernel.mjs";
 import { CurrentPasswordPreparedTransaction, PasswordPreparedPostconditions } from "./PasswordPreparedPostconditions.mjs";
 import { CurrentProofSql } from "./proof-kernel.mjs";
 import { requiredPasswordConstraints } from "./models/password-model.mjs";
-import { makePasswordAttempts, samePasswordCredentialSnapshot } from "./password-attempts.mjs";
+import { makePasswordCredentials, samePasswordCredentialSnapshot } from "./password-credentials.mjs";
 import { Cause, Context, DateTime, Effect, Option, Redacted, Schema } from "effect";
 import { CurrentCommitJournal, HookConfigurationError, LifecycleHooks, coordinateCommit, hasCommitScope } from "@yielded/auth/Hooks";
 import { snapshotAuthenticationEvidence } from "@yielded/auth/Sessions";
@@ -14,7 +14,7 @@ import { PasswordPersistence, PasswordUnavailable, snapshotPasswordCredential, s
 //#region src/internal/password-kernel.ts
 var CurrentPasswordSql = class extends Context.Service()("effect-auth/CurrentPasswordSql") {};
 const makePasswordKernel = (operations, proofs, nativeTables = (client) => makeNativeSqlTables(client)) => {
-	const { and, eq, inArray, lte, column, updateValues } = operations;
+	const { and, eq, inArray, column, updateValues } = operations;
 	const { completeProofPlanIn } = proofs;
 	const unavailable = () => PasswordUnavailable.make({});
 	const translateFailure = (effect) => reportPersistenceFailure(effect, (error) => Schema.is(PasswordUnavailable)(error) || Schema.is(ProofUnavailable)(error) || Schema.is(HookConfigurationError)(error)).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));
@@ -47,23 +47,6 @@ const makePasswordKernel = (operations, proofs, nativeTables = (client) => makeN
 		credentialId: column(mapping.authorityCredential.table, mapping.authorityCredential.credentialId),
 		revision: column(mapping.authorityCredential.table, mapping.authorityCredential.revision)
 	});
-	const attemptColumns = (mapping) => ({
-		moduleId: column(mapping.attempt.table, mapping.attempt.moduleId),
-		action: column(mapping.attempt.table, mapping.attempt.action),
-		attemptId: column(mapping.attempt.table, mapping.attempt.attemptId),
-		identifierNamespace: column(mapping.attempt.table, mapping.attempt.identifierNamespace),
-		identifierValue: column(mapping.attempt.table, mapping.attempt.identifierValue),
-		subjectId: column(mapping.attempt.table, mapping.attempt.subjectId),
-		credentialId: column(mapping.attempt.table, mapping.attempt.credentialId),
-		securityRevision: column(mapping.attempt.table, mapping.attempt.securityRevision),
-		credentialRevision: column(mapping.attempt.table, mapping.attempt.credentialRevision),
-		verifierVersion: column(mapping.attempt.table, mapping.attempt.verifierVersion),
-		identifierBindingRevision: column(mapping.attempt.table, mapping.attempt.identifierBindingRevision),
-		admittedAt: column(mapping.attempt.table, mapping.attempt.admittedAt),
-		deadline: column(mapping.attempt.table, mapping.attempt.deadline),
-		retentionUntil: column(mapping.attempt.table, mapping.attempt.retentionUntil),
-		state: column(mapping.attempt.table, mapping.attempt.state)
-	});
 	const commandColumns = (mapping) => ({
 		moduleId: column(mapping.command.table, mapping.command.moduleId),
 		commandId: column(mapping.command.table, mapping.command.commandId),
@@ -271,7 +254,7 @@ const makePasswordKernel = (operations, proofs, nativeTables = (client) => makeN
 		const currentRequirement = yield* mapping.subject.decodeActionRequirement(row, action);
 		const now = yield* nowMillis;
 		if (!evidenceSatisfiedAt(input.authorization.evidence, input.authorization.requirement, now) || !evidenceSatisfiedAt(input.authorization.evidence, currentRequirement, now)) return void 0;
-		if (input.invalidation.existingSessions === "immediate" && mapping.sessionInvalidation !== "same-authority-immediate") return void 0;
+		if ((input.invalidation.existingSessions === "immediate" || input.invalidation.existingSessions === "cache-expiry") && mapping.sessionInvalidation !== "same-authority-immediate") return void 0;
 		return {
 			...locked,
 			now
@@ -346,9 +329,9 @@ const makePasswordKernel = (operations, proofs, nativeTables = (client) => makeN
 		const hooks = yield* LifecycleHooks;
 		if (!validConstraints(mapping)) return yield* unavailable();
 		const root = yield* NativeDatabase;
-		const attempts = yield* makePasswordAttempts(yield* sqlMapping(() => nativeTables(root.$client.withoutTransforms(), root)).pipe(translateFailure), mapping, configuration);
+		const credentials = yield* makePasswordCredentials(yield* sqlMapping(() => nativeTables(root.$client.withoutTransforms(), root)).pipe(translateFailure), mapping, configuration);
 		return PasswordPersistence.of({
-			...attempts,
+			...credentials,
 			readForSubject: (input) => safeRead(database, configuration, Effect.gen(function* () {
 				const transaction = yield* CurrentPasswordSql;
 				const locked = yield* lockSubject(mapping, input.subjectId, false);
@@ -442,27 +425,6 @@ const makePasswordKernel = (operations, proofs, nativeTables = (client) => makeN
 					});
 					return passwordReceipt ?? prepare("rejected", journal);
 				}));
-			})).pipe(Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
-			cleanupAttempts: (input, prepare) => owned(database, mapping, configuration, Effect.gen(function* () {
-				const transaction = yield* CurrentPasswordSql;
-				const journal = yield* CurrentCommitJournal;
-				const now = yield* nowMillis;
-				const nativeNow = mapping.encodeInstant(now);
-				const a = attemptColumns(mapping);
-				const attempts = yield* selectRows(transaction.select({ attemptId: a.attemptId }).from(mapping.attempt.table).where(and(eq(a.moduleId, input.moduleId), lte(a.retentionUntil, nativeNow))).limit(input.limit + 1), false);
-				const hasMore = attempts.length > input.limit;
-				const attemptCandidates = attempts.slice(0, input.limit);
-				const selectedAttempts = [];
-				for (const candidate of attemptCandidates) {
-					const locked = yield* selectRows(transaction.select({ attemptId: a.attemptId }).from(mapping.attempt.table).where(and(eq(a.moduleId, input.moduleId), eq(a.attemptId, candidate.attemptId), lte(a.retentionUntil, nativeNow))).limit(1), configuration.locking);
-					if (locked[0] !== void 0) selectedAttempts.push(locked[0]);
-				}
-				const prepared = prepare({
-					removed: selectedAttempts.length,
-					hasMore
-				}, journal);
-				if (selectedAttempts.length > 0) yield* transaction.delete(mapping.attempt.table).where(and(eq(a.moduleId, input.moduleId), inArray(a.attemptId, selectedAttempts.map((row) => row.attemptId)), lte(a.retentionUntil, nativeNow)));
-				return prepared;
 			})).pipe(Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure)
 		});
 	});