@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.26

package/src/internal/password-credentials.ts

@@ -8,13 +8,14 @@ import {
   type PasswordCredentialSnapshot,
 } from "@yielded/auth/Password";
 import { reportPersistenceFailure } from "@yielded/auth/Persistence";
+import { SecurityRevision } from "@yielded/auth/Sessions";
 import { Effect, Option, Redacted, Schema } from "effect";
+import { SqlClient } from "effect/sql";
 
 import type { PersistenceMappingError } from "./mapping-error";
 import type { AnyPasswordPersistenceMapping } from "./models/password-model";
 import { sqlMapping, type SqlTable } from "./native-sql-table";
-import type { PasswordSqlConfiguration } from "./password-kernel";
-import { NativeDatabase } from "./transaction-kernel";
+import type { PasswordWorkflowOptions } from "./password-policy";
 
 type Row = Readonly<Record<string, unknown>>;
 const unavailable = () => PasswordUnavailable.make({});
@@ -55,21 +56,22 @@ export const samePasswordCredentialSnapshot = (
 export const makePasswordCredentials = Effect.fnUntraced(function* (
   table: (table: object) => SqlTable,
   mapping: AnyPasswordPersistenceMapping,
-  options: PasswordSqlConfiguration,
+  options: PasswordWorkflowOptions,
 ): Effect.fn.Return<
   Pick<PasswordPersistence["Service"], "findCredential" | "rehashIfCurrent">,
   PasswordUnavailable,
-  NativeDatabase
+  SqlClient.SqlClient
 > {
-  const sql = (yield* NativeDatabase).$client.withoutTransforms();
+  const sql = (yield* SqlClient.SqlClient).withoutTransforms();
   const parent = yield* Effect.serviceOption(CurrentCommitJournal);
 
-  const [s, i, c] = yield* sqlMapping(
+  const [s, i, c, a] = yield* sqlMapping(
     () =>
       [
         table(mapping.subject.table),
         table(mapping.identifier.table),
         table(mapping.credential.table),
+        table(mapping.authorityCredential.table),
       ] as const,
   ).pipe(failure);
 
@@ -106,21 +108,26 @@ export const makePasswordCredentials = Effect.fnUntraced(function* (
     const subjectTable = s.as("password_subject");
     const identifierTable = i.as("password_identifier");
     const credentialTable = c.as("password_credential");
+    const authorityTable = a.as("password_authority");
+    const authority = mapping.authorityCredential;
 
     const rows = yield* sqlMapping(
       () =>
-        sql<Row>`select ${subjectTable.fields("subject_")}, ${identifierTable.fields("identifier_")}, ${credentialTable.fields("credential_")}
+        sql<Row>`select ${subjectTable.fields("subject_")}, ${identifierTable.fields("identifier_")}, ${credentialTable.fields("credential_")}, ${authorityTable.fields("authority_")}
       from ${subjectTable.name}
       inner join ${identifierTable.name} on ${identifierTable.column(mapping.identifier.namespace)} = ${identifierTable.value(mapping.identifier.namespace, identifier.namespace)}
         and ${identifierTable.column(mapping.identifier.value)} = ${identifierTable.value(mapping.identifier.value, identifier.value)}
         and ${identifierTable.column(mapping.identifier.subjectId)} = ${identifierTable.value(mapping.identifier.subjectId, nativeId)}
       inner join ${credentialTable.name} on ${credentialTable.column(mapping.credential.moduleId)} = ${credentialTable.value(mapping.credential.moduleId, moduleId)}
         and ${credentialTable.column(mapping.credential.subjectId)} = ${credentialTable.value(mapping.credential.subjectId, nativeId)}
-      where ${subjectTable.column(mapping.subject.id)} = ${subjectTable.value(mapping.subject.id, nativeId)}
+      left join ${authorityTable.name} on ${authorityTable.column(authority.subjectId)} = ${authorityTable.value(authority.subjectId, nativeId)}
+        ${authority.status === undefined || authority.d1ActiveStatusValue === undefined ? sql`` : sql`and ${authorityTable.column(authority.status)} = ${authorityTable.value(authority.status, authority.d1ActiveStatusValue)}`}
+      where ${subjectTable.column(mapping.subject.id)} = ${subjectTable.value(mapping.subject.id, nativeId)} order by ${authorityTable.column(authority.credentialId)} limit 4097
       `,
     ).pipe(Effect.flatten);
 
-    if (rows.length !== 1) return undefined;
+    if (rows.length === 0) return undefined;
+    if (rows.length > 4096) return yield* unavailable();
 
     const [subject, identifierRow, credential] = yield* sqlMapping(
       () =>
@@ -147,7 +154,42 @@ export const makePasswordCredentials = Effect.fnUntraced(function* (
       mapping.credential.decode({ moduleId, subject, identifier: identifierRow, credential }),
     ).pipe(Effect.flatten, Effect.flatMap(snapshotPasswordCredential));
 
-    return captured;
+    const factors = new Map<string, SecurityRevision>();
+
+    for (const row of rows) {
+      const factor = yield* sqlMapping(() => a.decode(row, "authority_"));
+
+      if (factor[authority.credentialId] === null || factor[authority.credentialId] === undefined)
+        continue;
+      if (!mapping.subjectId.equals(nativeId, factor[authority.subjectId]))
+        return yield* unavailable();
+      if (
+        authority.status !== undefined &&
+        authority.isActiveStatus?.(factor[authority.status]) !== true
+      )
+        continue;
+
+      const credentialId = yield* Schema.decodeUnknownEffect(Schema.String)(
+        factor[authority.credentialId],
+      );
+
+      const revision = yield* Schema.decodeUnknownEffect(SecurityRevision)(
+        factor[authority.revision],
+      );
+
+      if (factors.has(credentialId)) return yield* unavailable();
+      factors.set(credentialId, revision);
+    }
+    if (factors.size > 64 || factors.get(captured.credentialId) !== captured.credentialRevision)
+      return undefined;
+
+    return yield* snapshotPasswordCredential({
+      ...captured,
+      revision: {
+        ...captured.revision,
+        credentials: [...factors].map(([credentialId, revision]) => ({ credentialId, revision })),
+      },
+    });
   });
 
   return {

package/src/internal/password-native.ts

@@ -0,0 +1,571 @@
+import { CurrentCommitJournal, type LifecycleHooks } from "@yielded/auth/Hooks";
+import type { LoginIdentifier } from "@yielded/auth/Identity";
+import * as P from "@yielded/auth/Password";
+import { ProofRedemptionInput } from "@yielded/auth/Proofs";
+import type { SubjectId } from "@yielded/auth/Schema";
+import { SecurityRevision, type AuthenticationRequirement } from "@yielded/auth/Sessions";
+import { DateTime, Effect, Option, Redacted, Schema, Crypto } from "effect";
+import { SqlClient } from "effect/sql/SqlClient";
+import type { Fragment } from "effect/sql/Statement";
+
+import { sqlBatchAssertion } from "./d1-planning";
+import { PersistenceMappingError } from "./mapping-error";
+import type { AnyPasswordPersistenceMapping } from "./models/password-model";
+import type { AnyProofPersistenceMapping } from "./models/proof-model";
+import type { NativeSqlTables, SqlTable } from "./native-sql-table";
+import { makePasswordCredentials, samePasswordCredentialSnapshot } from "./password-credentials";
+import {
+  allocatePasswordNextSecurityRevision,
+  allocatePasswordValue,
+  passwordEvidenceSatisfiedAt,
+  passwordProofRedemptionMatches,
+  snapshotPasswordMutation,
+  validatePasswordMutation,
+} from "./password-policy";
+import { makeNativeProofStore } from "./proof-native";
+import { exactSqlText, executeSqlChange } from "./sql-change";
+import {
+  appendSqlBatchStatement,
+  CurrentSqlCommit,
+  makeSqlCommitExecutor,
+  registerSqlBatchPostcondition,
+  registerSqlCommitReceipt,
+  registerSqlPostcondition,
+  SqlBatchCommit,
+} from "./sql-commit";
+import { requireStandalone } from "./standalone";
+
+const unavailable = () => P.PasswordUnavailable.make({});
+
+const ensure: (condition: unknown) => asserts condition = (condition) => {
+  if (!condition) throw unavailable();
+};
+
+export const makeNativePasswordServices = Effect.fnUntraced(function* (
+  tables: NativeSqlTables,
+  mapping: AnyPasswordPersistenceMapping,
+  proofs?: AnyProofPersistenceMapping,
+): Effect.fn.Return<
+  { readonly passwordPersistence: P.PasswordPersistence["Service"] },
+  P.PasswordUnavailable,
+  SqlClient | LifecycleHooks | Crypto.Crypto | SqlBatchCommit
+> {
+  const batch = yield* SqlBatchCommit;
+  const sql = (yield* SqlClient).withoutTransforms();
+  const executor = yield* makeSqlCommitExecutor(unavailable);
+  const crypto = yield* Crypto.Crypto;
+  const parent = yield* Effect.serviceOption(CurrentSqlCommit);
+
+  const s = mapping.subject,
+    i = mapping.identifier,
+    c = mapping.credential,
+    a = mapping.authorityCredential;
+
+  const subject = tables(s.table).as("password_subject");
+  const identifier = tables(i.table).as("password_identifier");
+  const credential = tables(c.table).as("password_credential");
+  const authority = tables(a.table).as("password_authority");
+
+  const rawSubject = tables(s.table),
+    rawPassword = tables(c.table),
+    rawAuthority = tables(a.table);
+
+  const now = tables.expression(mapping.clock.engineNowMillis);
+  const lock = sql.onDialectOrElse({ sqlite: () => sql``, orElse: () => sql`for update` });
+
+  const exact = (table: SqlTable, key: string, value: unknown) =>
+    exactSqlText(sql, table.column(key), table.value(key, value));
+
+  const subjectKey = (table: SqlTable, key: string, nativeId: unknown) =>
+    sql`${table.column(key)} = ${table.value(key, nativeId)}`;
+
+  const run = <A, E, R>(work: Effect.Effect<A, E, R>) =>
+    batch === undefined
+      ? executor.run(work.pipe(Effect.provideService(Crypto.Crypto, crypto)))
+      : executor
+          .batch(work.pipe(Effect.provideService(Crypto.Crypto, crypto)))
+          .pipe(Effect.provideService(SqlBatchCommit, batch));
+
+  const read = Effect.fnUntraced(function* (
+    moduleId: string,
+    subjectId: SubjectId,
+    wanted?: LoginIdentifier,
+    locked?: Record<string, unknown>,
+  ) {
+    const nativeId = yield* mapping.subjectId.toNative(subjectId);
+
+    // Without one wanted identifier, retired identifiers would multiply authority
+    // rows; read authority separately so the result grows linearly.
+    const joined = wanted !== undefined;
+
+    const rows =
+      yield* sql`select ${subject.fields("password_subject_")}, ${identifier.fields("password_identifier_")}, ${credential.fields("password_credential_")}${joined ? sql`, ${authority.fields("password_authority_")}` : sql``}, ${now} as engine_now
+      from ${subject.name}
+      left join ${identifier.name} on ${subjectKey(identifier, i.subjectId, nativeId)} ${wanted === undefined ? sql`` : sql`and ${exact(identifier, i.namespace, wanted.namespace)} and ${exact(identifier, i.value, wanted.value)}`}
+      left join ${credential.name} on ${subjectKey(credential, c.subjectId, nativeId)} and ${exact(credential, c.moduleId, moduleId)}
+      ${joined ? sql`left join ${authority.name} on ${subjectKey(authority, a.subjectId, nativeId)}` : sql``}
+      where ${subjectKey(subject, s.id, nativeId)} order by ${identifier.column(i.namespace)}, ${identifier.column(i.value)}${joined ? sql`, ${authority.column(a.credentialId)}` : sql``} limit 4097`;
+
+    const authorityRows = joined
+      ? rows
+      : yield* sql`select ${authority.fields("password_authority_")} from ${authority.name} where ${subjectKey(authority, a.subjectId, nativeId)} order by ${authority.column(a.credentialId)} limit 4097`;
+
+    ensure(rows.length <= 4096 && authorityRows.length <= 4096);
+    if (rows[0] === undefined) return undefined;
+    const subjectRow = subject.decode(rows[0], "password_subject_");
+    const decodedId = yield* mapping.subjectId.toSubject(subjectRow[s.id]);
+
+    ensure(
+      decodedId === subjectId &&
+        (locked === undefined || subjectRow[s.securityRevision] === locked[s.securityRevision]),
+    );
+    const password = credential.decode(rows[0], "password_credential_");
+    const passwordRow = password[c.credentialId] === null ? undefined : password;
+
+    const factors = new Map<
+      string,
+      {
+        readonly credentialId: string;
+        readonly revision: SecurityRevision;
+        readonly active: boolean;
+      }
+    >();
+
+    let identifierRow: Record<string, unknown> | undefined;
+
+    for (const row of authorityRows) {
+      const factor = authority.decode(row, "password_authority_");
+
+      if (
+        factor[a.credentialId] !== null &&
+        (a.status === undefined || a.isActiveStatus?.(factor[a.status]) === true)
+      ) {
+        ensure(mapping.subjectId.equals(factor[a.subjectId], nativeId));
+        const id = yield* Schema.decodeUnknownEffect(Schema.String)(factor[a.credentialId]);
+        const revision = yield* Schema.decodeUnknownEffect(SecurityRevision)(factor[a.revision]);
+        const old = factors.get(id);
+
+        ensure(old === undefined || old.revision === revision);
+        factors.set(id, { credentialId: id, revision, active: true });
+      }
+    }
+    for (const row of rows) {
+      const entry = identifier.decode(row, "password_identifier_");
+
+      if (
+        entry[i.namespace] !== null &&
+        mapping.subjectId.equals(entry[i.subjectId], nativeId) &&
+        mapping.identifier.isCurrent(entry)
+      )
+        identifierRow ??= entry;
+    }
+    ensure(factors.size <= 64);
+
+    const revision = {
+      subjectId,
+      securityRevision: yield* Schema.decodeUnknownEffect(SecurityRevision)(
+        subjectRow[s.securityRevision],
+      ),
+      credentials: [...factors.values()].map(({ credentialId, revision }) => ({
+        credentialId,
+        revision,
+      })),
+    };
+
+    const snapshot =
+      identifierRow === undefined || passwordRow === undefined
+        ? undefined
+        : yield* mapping.credential
+            .decode({
+              moduleId,
+              subject: subjectRow,
+              identifier: identifierRow,
+              credential: passwordRow,
+            })
+            .pipe(Effect.flatMap(P.snapshotPasswordCredential));
+
+    if (snapshot !== undefined)
+      ensure(
+        snapshot.revision.subjectId === subjectId &&
+          snapshot.credentialId === passwordRow?.[c.credentialId],
+      );
+
+    return {
+      nativeId,
+      subjectRow,
+      identifierRow,
+      passwordRow,
+      revision,
+      snapshot: snapshot === undefined ? undefined : { ...snapshot, revision },
+      now: yield* Schema.decodeEffect(Schema.Int)(Number(rows[0].engine_now)),
+    };
+  });
+
+  const prepare = <V, A>(value: V, project: P.PreparePasswordCommit<V, A>) =>
+    Effect.gen(function* () {
+      const journal = yield* CurrentCommitJournal;
+
+      const receipt = project(value, journal);
+
+      ensure(receipt?._tag === "PreparedCommit" && Effect.isEffect(receipt.read));
+      yield* registerSqlCommitReceipt(receipt);
+
+      return receipt;
+    });
+
+  const mutation = <A>(
+    original: P.PasswordMutationInput,
+    action: P.PasswordAction,
+    project: P.PreparePasswordCommit<P.PasswordMutationDecision, A>,
+    redemption?: Parameters<P.PasswordPersistence["Service"]["resetWithProof"]>[0]["redemption"],
+  ) =>
+    run(
+      Effect.gen(function* () {
+        const input = yield* snapshotPasswordMutation(original);
+        const nativeId = yield* mapping.subjectId.toNative(input.expectedRevision.subjectId);
+
+        const rows =
+          yield* sql`select ${rawSubject.fields("password_lock_")} from ${rawSubject.name} where ${subjectKey(rawSubject, s.id, nativeId)} limit 2 ${batch === undefined ? lock : sql``}`;
+
+        if (rows.length === 0) return yield* prepare("rejected" as const, project);
+        ensure(rows.length === 1);
+        const locked = rawSubject.decode(rows[0]!, "password_lock_");
+
+        const state = yield* read(
+          input.moduleId,
+          input.expectedRevision.subjectId,
+          input.credential?.identifier,
+          locked,
+        );
+
+        if (state === undefined) return yield* prepare("rejected" as const, project);
+        const requirement = yield* s.decodeActionRequirement(state.subjectRow, action);
+
+        const valid = yield* validatePasswordMutation(
+          mapping,
+          input,
+          action,
+          {
+            subject: {
+              active: s.isActiveStatus(state.subjectRow[s.status]),
+              securityRevision: state.revision.securityRevision,
+            },
+            identifierCurrent: state.identifierRow !== undefined,
+            credentials: state.revision.credentials.map((entry) => ({ ...entry, active: true })),
+            snapshot: Effect.succeed(state.snapshot),
+            requirement: Effect.succeed(requirement),
+          },
+          state.now,
+        );
+
+        if (
+          valid === undefined ||
+          (action === "add-password"
+            ? state.passwordRow !== undefined
+            : state.snapshot === undefined ||
+              input.credential === undefined ||
+              !samePasswordCredentialSnapshot(state.snapshot, input.credential))
+        )
+          return yield* prepare("rejected" as const, project);
+        let proofValidity = sql`1 = 1`;
+
+        if (redemption !== undefined) {
+          if (proofs === undefined) return yield* unavailable();
+
+          const captured = {
+            ...redemption,
+            input: yield* Schema.decodeEffect(ProofRedemptionInput)(redemption.input),
+          };
+
+          if (!passwordProofRedemptionMatches({ ...input, redemption: captured }))
+            return yield* prepare("rejected" as const, project);
+          // Inherit the physical owner; application owners retain the exact consumed
+          // proof absence check after their callback.
+          const proof = yield* makeNativeProofStore(tables, proofs, batch !== undefined);
+          const redeemed = yield* proof.redeemLocked(captured.input);
+
+          const proofReceipt = captured.prepare(
+            redeemed.decision,
+            yield* CurrentCommitJournal,
+            (value) => value,
+          );
+
+          yield* registerSqlCommitReceipt(proofReceipt);
+          if (redeemed.decision === "rejected") return yield* prepare("rejected" as const, project);
+          proofValidity = redeemed.validUntil;
+        }
+        const mode = "interactive";
+
+        const credentialId =
+          input.credential?.credentialId ??
+          (yield* allocatePasswordValue(
+            mode,
+            mapping.allocateCredentialId,
+            mapping.allocateCredentialIdSync,
+          ));
+
+        const credentialRevision = yield* allocatePasswordValue(
+          mode,
+          mapping.allocateRevision,
+          mapping.allocateRevisionSync,
+        );
+
+        const verifierVersion = yield* allocatePasswordValue(
+          mode,
+          mapping.allocateRevision,
+          mapping.allocateRevisionSync,
+        );
+
+        const nextSecurityRevision = yield* allocatePasswordNextSecurityRevision(
+          mapping,
+          mode,
+          input.expectedRevision.securityRevision,
+        );
+
+        ensure(
+          nextSecurityRevision !== input.expectedRevision.securityRevision &&
+            credentialRevision !== input.credential?.credentialRevision &&
+            verifierVersion !== input.credential?.verifierVersion,
+        );
+
+        const freshUntil = (requirement: AuthenticationRequirement) => {
+          const deadlines = [
+            ...new Set(
+              input.authorization.evidence.proofs.map(
+                (proof) => DateTime.toEpochMillis(proof.verifiedAt) + requirement.maximumAgeMillis,
+              ),
+            ),
+          ]
+            .filter((time) => time > state.now)
+            .sort((a, b) => a - b);
+
+          return deadlines.find(
+            (time) => !passwordEvidenceSatisfiedAt(input.authorization.evidence, requirement, time),
+          );
+        };
+
+        const requestedDeadline = freshUntil(input.authorization.requirement),
+          currentDeadline = freshUntil(requirement);
+
+        ensure(requestedDeadline !== undefined && currentDeadline !== undefined);
+        const deadline = Math.min(requestedDeadline, currentDeadline);
+        const freshness = sql`${now} >= ${state.now} and ${now} < ${deadline} and ${proofValidity}`;
+
+        const stage = Effect.fnUntraced(function* (statement: Fragment) {
+          if (batch === undefined) ensure((yield* executeSqlChange(sql, statement)) === 1);
+          else {
+            yield* appendSqlBatchStatement(sql`${statement}`);
+            yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = 1`));
+          }
+        });
+
+        if (batch !== undefined) {
+          if (
+            s.d1ActiveStatusValue === undefined ||
+            (a.status !== undefined && a.d1ActiveStatusValue === undefined)
+          )
+            return yield* unavailable();
+
+          const factors = state.revision.credentials.map(
+            (factor) =>
+              sql`exists(select 1 from ${rawAuthority.name} where ${subjectKey(rawAuthority, a.subjectId, nativeId)} and ${exact(rawAuthority, a.credentialId, factor.credentialId)} and ${exact(rawAuthority, a.revision, factor.revision)} ${a.status === undefined ? sql`` : sql`and ${rawAuthority.column(a.status)} = ${rawAuthority.value(a.status, a.d1ActiveStatusValue)}`})`,
+          );
+
+          const active =
+            a.status === undefined
+              ? sql`1 = 1`
+              : sql`${rawAuthority.column(a.status)} = ${rawAuthority.value(a.status, a.d1ActiveStatusValue)}`;
+
+          const condition = sql.and([
+            sql`exists(select 1 from ${rawSubject.name} where ${subjectKey(rawSubject, s.id, nativeId)} and ${exact(rawSubject, s.securityRevision, input.expectedRevision.securityRevision)} and ${rawSubject.column(s.status)} = ${rawSubject.value(s.status, s.d1ActiveStatusValue)})`,
+            sql`(select count(*) from ${rawAuthority.name} where ${subjectKey(rawAuthority, a.subjectId, nativeId)} and ${active}) = ${factors.length}`,
+            ...factors,
+            freshness,
+          ]);
+
+          yield* appendSqlBatchStatement(sqlBatchAssertion(sql, condition));
+          if (input.credential !== undefined) {
+            if (i.d1CurrentCondition === undefined) return yield* unavailable();
+            yield* appendSqlBatchStatement(
+              sqlBatchAssertion(
+                sql,
+                sql`exists(select 1 from ${tables(i.table).name} where ${exact(tables(i.table), i.namespace, input.credential.identifier.namespace)} and ${exact(tables(i.table), i.value, input.credential.identifier.value)} and ${subjectKey(tables(i.table), i.subjectId, nativeId)} and ${tables.expression(i.d1CurrentCondition({ identifier: input.credential.identifier, nativeSubjectId: nativeId }))})`,
+              ),
+            );
+          }
+        }
+        const revisions = { credentialId, credentialRevision, verifierVersion };
+
+        if (input.credential === undefined) {
+          yield* stage(
+            sql`${rawPassword.insert(c.encodeInsert({ moduleId: input.moduleId, subjectId: nativeId, replacement: input.replacement, ...revisions }))}`,
+          );
+          yield* stage(
+            sql`${rawAuthority.insert(a.encodeInsert({ subjectId: nativeId, credentialId, revision: credentialRevision }))}`,
+          );
+        } else {
+          const old = input.credential;
+
+          yield* stage(
+            sql`${rawPassword.update(c.encodeReplacement({ replacement: input.replacement, credentialRevision, verifierVersion }))} where ${subjectKey(rawPassword, c.subjectId, nativeId)} and ${exact(rawPassword, c.moduleId, input.moduleId)} and ${exact(rawPassword, c.credentialId, old.credentialId)} and ${exact(rawPassword, c.credentialRevision, old.credentialRevision)} and ${exact(rawPassword, c.verifierVersion, old.verifierVersion)} and ${exact(rawPassword, c.verifier, Redacted.value(old.verifier))} and ${exact(rawPassword, c.normalization, old.normalization)} and ${freshness}`,
+          );
+          yield* stage(
+            sql`${rawAuthority.update(a.encodeRevision(credentialRevision))} where ${subjectKey(rawAuthority, a.subjectId, nativeId)} and ${exact(rawAuthority, a.credentialId, old.credentialId)} and ${exact(rawAuthority, a.revision, old.credentialRevision)}`,
+          );
+        }
+
+        const expectedFactors = state.revision.credentials
+          .filter((factor) => factor.credentialId !== credentialId)
+          .concat({ credentialId, revision: credentialRevision });
+
+        const finalPassword = sql`exists(select 1 from ${rawPassword.name} where ${subjectKey(rawPassword, c.subjectId, nativeId)} and ${exact(rawPassword, c.moduleId, input.moduleId)} and ${exact(rawPassword, c.credentialId, credentialId)} and ${exact(rawPassword, c.credentialRevision, credentialRevision)} and ${exact(rawPassword, c.verifierVersion, verifierVersion)} and ${exact(rawPassword, c.verifier, Redacted.value(input.replacement.verifier))} and ${exact(rawPassword, c.normalization, input.replacement.normalization)})`;
+
+        const canGuardResult =
+          (a.status === undefined || a.d1ActiveStatusValue !== undefined) &&
+          (input.credential === undefined || i.d1CurrentCondition !== undefined);
+
+        let resultingState: Fragment | undefined;
+
+        if (canGuardResult) {
+          const active =
+            a.status === undefined
+              ? sql`1 = 1`
+              : sql`${rawAuthority.column(a.status)} = ${rawAuthority.value(a.status, a.d1ActiveStatusValue)}`;
+
+          const conditions: Array<Fragment> = [
+            finalPassword,
+            freshness,
+            sql`(select count(*) from ${rawAuthority.name} where ${subjectKey(rawAuthority, a.subjectId, nativeId)} and ${active}) = ${expectedFactors.length}`,
+            ...expectedFactors.map(
+              (factor) =>
+                sql`exists(select 1 from ${rawAuthority.name} where ${subjectKey(rawAuthority, a.subjectId, nativeId)} and ${exact(rawAuthority, a.credentialId, factor.credentialId)} and ${exact(rawAuthority, a.revision, factor.revision)} and ${active})`,
+            ),
+          ];
+
+          if (input.credential !== undefined) {
+            const expected = input.credential;
+            const identifierTable = tables(i.table);
+
+            ensure(i.d1CurrentCondition !== undefined);
+            conditions.push(
+              sql`exists(select 1 from ${identifierTable.name} where ${exact(identifierTable, i.namespace, expected.identifier.namespace)} and ${exact(identifierTable, i.value, expected.identifier.value)} and ${subjectKey(identifierTable, i.subjectId, nativeId)} and ${tables.expression(i.d1CurrentCondition({ identifier: expected.identifier, nativeSubjectId: nativeId }))})`,
+              sql`exists(select 1 from ${identifierTable.name} where ${exact(identifierTable, i.namespace, expected.identifier.namespace)} and ${exact(identifierTable, i.value, expected.identifier.value)} and ${subjectKey(identifierTable, i.subjectId, nativeId)} and ${exact(identifierTable, i.bindingRevision, expected.identifierBindingRevision)} and ${expected.identifierVerifiedAtMillis === undefined ? sql`${identifierTable.column(i.verifiedAt)} is null` : sql`${identifierTable.column(i.verifiedAt)} = ${identifierTable.value(i.verifiedAt, mapping.clock.encodeInstant(expected.identifierVerifiedAtMillis))}`})`,
+            );
+          }
+          resultingState = sql.and(conditions);
+        }
+        yield* stage(
+          sql`${rawSubject.update({ [s.securityRevision]: nextSecurityRevision })} where ${subjectKey(rawSubject, s.id, nativeId)} and ${exact(rawSubject, s.securityRevision, input.expectedRevision.securityRevision)} and ${rawSubject.column(s.status)} = ${rawSubject.value(s.status, locked[s.status])} and ${freshness} and ${resultingState ?? sql`1 = 1`}`,
+        );
+        if (batch !== undefined) {
+          ensure(resultingState !== undefined);
+          yield* registerSqlBatchPostcondition({
+            name: "password-replacement-authority",
+            statement: sqlBatchAssertion(
+              sql,
+              sql.and([
+                resultingState,
+                sql`exists(select 1 from ${rawSubject.name} where ${subjectKey(rawSubject, s.id, nativeId)} and ${exact(rawSubject, s.securityRevision, nextSecurityRevision)} and ${rawSubject.column(s.status)} = ${rawSubject.value(s.status, s.d1ActiveStatusValue)})`,
+              ]),
+            ),
+          });
+        } else if (Option.isSome(parent) || resultingState === undefined)
+          yield* registerSqlPostcondition({
+            name: "password-replacement-authority",
+            check: Effect.gen(function* () {
+              const final = yield* read(
+                input.moduleId,
+                input.expectedRevision.subjectId,
+                input.credential?.identifier,
+              );
+
+              ensure(
+                final !== undefined &&
+                  s.isActiveStatus(final.subjectRow[s.status]) &&
+                  final.revision.securityRevision === nextSecurityRevision &&
+                  final.revision.credentials.length === expectedFactors.length &&
+                  expectedFactors.every((factor) =>
+                    final.revision.credentials.some(
+                      (entry) =>
+                        entry.credentialId === factor.credentialId &&
+                        entry.revision === factor.revision,
+                    ),
+                  ) &&
+                  final.now >= state.now &&
+                  final.now < deadline,
+              );
+              const password = final.passwordRow;
+
+              ensure(
+                password !== undefined &&
+                  password[c.credentialId] === credentialId &&
+                  password[c.credentialRevision] === credentialRevision &&
+                  password[c.verifierVersion] === verifierVersion &&
+                  password[c.verifier] === Redacted.value(input.replacement.verifier) &&
+                  password[c.normalization] === input.replacement.normalization,
+              );
+              if (input.credential !== undefined)
+                ensure(
+                  final.snapshot !== undefined &&
+                    final.snapshot.identifierBindingRevision ===
+                      input.credential.identifierBindingRevision &&
+                    final.snapshot.identifierVerifiedAtMillis ===
+                      input.credential.identifierVerifiedAtMillis,
+                );
+            }).pipe(
+              Effect.mapError((cause) =>
+                PersistenceMappingError.make({ operation: "decode", cause }),
+              ),
+            ),
+          });
+
+        return yield* prepare("changed" as const, project);
+      }),
+    );
+
+  const credentials = yield* makePasswordCredentials(tables, mapping, {
+    mode: "interactive",
+    locking: false,
+    coordinated: Option.isSome(parent),
+    standaloneGuard: requireStandalone(unavailable, sql.transactionService),
+  });
+
+  const passwordPersistence: P.PasswordPersistence["Service"] = {
+    ...credentials,
+    readForSubject: (input) =>
+      executor.read(
+        Effect.map(read(input.moduleId, input.subjectId), (state) =>
+          state === undefined || !s.isActiveStatus(state.subjectRow[s.status])
+            ? Option.none()
+            : Option.fromUndefinedOr(state.snapshot),
+        ),
+      ),
+    recoveryTarget: (input) =>
+      executor.read(
+        Effect.gen(function* () {
+          const rows =
+            yield* sql`select ${identifier.fields("password_recovery_")} from ${identifier.name} where ${exact(identifier, i.namespace, input.identifier.namespace)} and ${exact(identifier, i.value, input.identifier.value)} limit 2`;
+
+          if (rows.length === 0) return Option.none();
+          ensure(rows.length === 1);
+          const row = identifier.decode(rows[0]!, "password_recovery_");
+
+          if (!i.isCurrent(row)) return Option.none();
+          const subjectId = yield* mapping.subjectId.toSubject(row[i.subjectId]);
+          const state = yield* read(input.moduleId, subjectId, input.identifier);
+
+          return state === undefined ||
+            !s.isActiveStatus(state.subjectRow[s.status]) ||
+            state.snapshot?.identifierVerifiedAtMillis === undefined
+            ? Option.none()
+            : Option.some(state.snapshot);
+        }),
+      ),
+    addIfAbsent: (input, project) => mutation(input, "add-password", project),
+    replaceIfCurrent: (input, project) => mutation(input, "change-password", project),
+    resetWithProof: (input, project) =>
+      mutation(input, "reset-password", project, input.redemption),
+  };
+
+  return { passwordPersistence };
+});