@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.27

package/src/internal/password-policy.ts

@@ -0,0 +1,307 @@
+import type { LoginIdentifier } from "@yielded/auth/Identity";
+import {
+  PasswordUnavailable,
+  snapshotPasswordCredential,
+  snapshotPasswordRequirement,
+  snapshotPasswordRevision,
+  type PasswordAction,
+  type PasswordCredentialSnapshot,
+  type PasswordMutationInput,
+} from "@yielded/auth/Password";
+import type { ProofRedemptionPlan } from "@yielded/auth/Proofs";
+import {
+  snapshotAuthenticationEvidence,
+  type AuthenticationEvidence,
+  type AuthenticationRequirement,
+  type SecurityRevision,
+} from "@yielded/auth/Sessions";
+import { DateTime, Effect, Redacted } from "effect";
+
+import { PersistenceMappingError } from "./mapping-error";
+import type { AnyProofPersistenceMapping } from "./models/proof-model";
+
+const unavailable = () => PasswordUnavailable.make({});
+
+export const samePasswordIdentifier = (left: LoginIdentifier, right: LoginIdentifier) =>
+  left.namespace === right.namespace && left.value === right.value;
+
+export const samePasswordCredential = (
+  left: PasswordCredentialSnapshot,
+  right: PasswordCredentialSnapshot,
+) =>
+  left.moduleId === right.moduleId &&
+  left.revision.subjectId === right.revision.subjectId &&
+  left.revision.securityRevision === right.revision.securityRevision &&
+  left.credentialId === right.credentialId &&
+  left.credentialRevision === right.credentialRevision &&
+  left.verifierVersion === right.verifierVersion &&
+  left.normalization === right.normalization &&
+  left.identifierVerifiedAtMillis === right.identifierVerifiedAtMillis &&
+  left.revision.credentials.length === right.revision.credentials.length &&
+  left.revision.credentials.every((entry) =>
+    right.revision.credentials.some(
+      (other) => other.credentialId === entry.credentialId && other.revision === entry.revision,
+    ),
+  ) &&
+  left.identifierBindingRevision === right.identifierBindingRevision &&
+  samePasswordIdentifier(left.identifier, right.identifier) &&
+  Redacted.value(left.verifier) === Redacted.value(right.verifier);
+
+export const passwordEvidenceSatisfiedAt = (
+  evidence: AuthenticationEvidence,
+  requirement: AuthenticationRequirement,
+  now: number,
+): boolean => {
+  if (evidence.proofs.length > 64 || evidence.revision.credentials.length > 64) return false;
+  const revisions = new Map<string, string>();
+
+  for (const item of evidence.revision.credentials) {
+    if (revisions.has(item.credentialId)) return false;
+    revisions.set(item.credentialId, item.revision);
+  }
+  if (evidence.proofs.some((proof) => !revisions.has(proof.credentialId))) return false;
+  if (evidence.proofs.some((proof) => now < DateTime.toEpochMillis(proof.verifiedAt))) return false;
+
+  const eligible = evidence.proofs.filter((proof) => {
+    const age = now - DateTime.toEpochMillis(proof.verifiedAt);
+
+    return age >= 0 && age < requirement.maximumAgeMillis;
+  });
+
+  const factors = new Set(eligible.flatMap((proof) => proof.factors));
+  const credentials = new Set(eligible.map((proof) => proof.credentialId));
+
+  return requirement.alternatives.some(
+    (alternative) =>
+      alternative.factors.every((factor) => factors.has(factor)) &&
+      credentials.size >= alternative.minimumCredentials &&
+      eligible.some(
+        (proof) =>
+          (!alternative.userVerified || proof.userVerified) &&
+          (!alternative.phishingResistant || proof.phishingResistant),
+      ),
+  );
+};
+
+export const snapshotPasswordMutation = Effect.fn("PasswordPersistence.snapshotMutation")(
+  function* (input: PasswordMutationInput) {
+    const expectedRevision = snapshotPasswordRevision(input.expectedRevision);
+
+    const evidence = yield* snapshotAuthenticationEvidence(input.authorization.evidence).pipe(
+      Effect.mapError(unavailable),
+    );
+
+    const requirement = yield* snapshotPasswordRequirement(input.authorization.requirement);
+
+    const credential =
+      input.credential === undefined
+        ? undefined
+        : yield* snapshotPasswordCredential(input.credential);
+
+    return Object.freeze({
+      ...input,
+      expectedRevision,
+      replacement: Object.freeze({
+        verifier: Redacted.make(Redacted.value(input.replacement.verifier)),
+        normalization: input.replacement.normalization,
+      }),
+      invalidation: Object.freeze({ ...input.invalidation }),
+      ...(credential === undefined ? {} : { credential }),
+      authorization: Object.freeze({
+        challenge: Object.freeze({
+          ...input.authorization.challenge,
+          revision: snapshotPasswordRevision(input.authorization.challenge.revision),
+        }),
+        evidence,
+        requirement,
+      }),
+    });
+  },
+);
+
+export const passwordProofRedemptionMatches = (
+  input: PasswordMutationInput & { readonly redemption: ProofRedemptionPlan },
+) => {
+  const completion = input.redemption.input;
+  const binding = completion.binding;
+
+  if (
+    completion.moduleId !== `${input.moduleId}/reset` ||
+    completion.purpose !== "password-reset" ||
+    binding._tag !== "Subject" ||
+    input.credential === undefined ||
+    binding.revision.subjectId !== input.expectedRevision.subjectId ||
+    binding.revision.securityRevision !== input.expectedRevision.securityRevision ||
+    !samePasswordIdentifier(binding.identifier, input.credential.identifier)
+  )
+    return false;
+
+  const expected = [...input.expectedRevision.credentials].sort((left, right) =>
+    left.credentialId.localeCompare(right.credentialId),
+  );
+
+  const actual = [...binding.revision.credentials].sort((left, right) =>
+    left.credentialId.localeCompare(right.credentialId),
+  );
+
+  return (
+    expected.length === actual.length &&
+    expected.every(
+      (item, index) =>
+        item.credentialId === actual[index]!.credentialId &&
+        item.revision === actual[index]!.revision,
+    )
+  );
+};
+
+export interface PasswordWorkflowPolicy {
+  readonly allocateCredentialId?: Effect.Effect<string, PersistenceMappingError>;
+  readonly allocateCredentialIdSync?: () => string;
+  readonly allocateRevision?: Effect.Effect<SecurityRevision, PersistenceMappingError>;
+  readonly allocateRevisionSync?: () => SecurityRevision;
+  readonly subject: {
+    readonly nextSecurityRevision?: (
+      current: SecurityRevision,
+    ) => Effect.Effect<SecurityRevision, PersistenceMappingError>;
+    readonly nextSecurityRevisionSync?: (current: SecurityRevision) => SecurityRevision;
+  };
+  readonly sessionInvalidation: "same-authority-immediate" | "original-absolute-expiry";
+}
+
+export interface PasswordWorkflowOptions {
+  readonly mode: "interactive" | "synchronous";
+  readonly locking: boolean;
+  readonly coordinated?: boolean;
+  readonly standaloneGuard: Effect.Effect<void, PasswordUnavailable>;
+  readonly proof?: AnyProofPersistenceMapping;
+}
+
+export const allocatePasswordValue = <A>(
+  mode: PasswordWorkflowOptions["mode"],
+  asynchronous: Effect.Effect<A, PersistenceMappingError> | undefined,
+  synchronous: (() => A) | undefined,
+): Effect.Effect<A, PasswordUnavailable | PersistenceMappingError> =>
+  mode !== "synchronous" && asynchronous !== undefined
+    ? asynchronous
+    : synchronous === undefined
+      ? Effect.fail(unavailable())
+      : Effect.try({
+          try: synchronous,
+          catch: (cause) => PersistenceMappingError.make({ operation: "mapping", cause }),
+        });
+
+export const allocatePasswordNextSecurityRevision = (
+  policy: PasswordWorkflowPolicy,
+  mode: PasswordWorkflowOptions["mode"],
+  current: SecurityRevision,
+) =>
+  allocatePasswordValue(
+    mode,
+    policy.subject.nextSecurityRevision?.(current) ?? policy.allocateRevision,
+    policy.subject.nextSecurityRevisionSync === undefined
+      ? policy.allocateRevisionSync
+      : () => policy.subject.nextSecurityRevisionSync!(current),
+  );
+
+export const passwordMutationEvidenceMatches = (input: PasswordMutationInput) =>
+  !input.expectedRevision.credentials.some(
+    (expected) =>
+      !input.authorization.evidence.revision.credentials.some(
+        (actual) =>
+          actual.credentialId === expected.credentialId && actual.revision === expected.revision,
+      ),
+  );
+
+export const validatePasswordMutation = Effect.fnUntraced(function* (
+  policy: PasswordWorkflowPolicy,
+  input: PasswordMutationInput,
+  action: PasswordAction,
+  current: Pick<
+    PasswordMutationRead,
+    "subject" | "identifierCurrent" | "credentials" | "snapshot" | "requirement"
+  >,
+  now: number,
+) {
+  if (
+    current.subject === undefined ||
+    !current.subject.active ||
+    current.subject.securityRevision !== input.expectedRevision.securityRevision
+  )
+    return undefined;
+  const { challenge, evidence } = input.authorization;
+
+  if (
+    challenge.moduleId !== input.moduleId ||
+    challenge.action !== action ||
+    challenge.commandId !== input.commandId ||
+    challenge.revision.subjectId !== input.expectedRevision.subjectId ||
+    challenge.revision.securityRevision !== input.expectedRevision.securityRevision ||
+    (evidence.flowId as string) !== (input.commandId as string) ||
+    evidence.bindingDigest !== challenge.bindingDigest ||
+    evidence.revision.subjectId !== input.expectedRevision.subjectId ||
+    evidence.revision.securityRevision !== input.expectedRevision.securityRevision ||
+    (action === "add-password" &&
+      (input.credential !== undefined || challenge.targetCredentialId !== undefined))
+  )
+    return undefined;
+  if (!passwordMutationEvidenceMatches(input)) return undefined;
+  if (input.credential !== undefined && !current.identifierCurrent) return undefined;
+
+  const expected = new Map(
+    [...input.expectedRevision.credentials, ...evidence.revision.credentials].map((item) => [
+      item.credentialId,
+      item,
+    ]),
+  );
+
+  if (current.credentials.length !== expected.size) return undefined;
+  for (const credential of current.credentials) {
+    const wanted = expected.get(credential.credentialId);
+
+    if (wanted === undefined || credential.revision !== wanted.revision || !credential.active)
+      return undefined;
+    expected.delete(wanted.credentialId);
+  }
+  if (expected.size !== 0) return undefined;
+  if (input.credential !== undefined) {
+    const snapshot = yield* current.snapshot;
+
+    if (snapshot === undefined || !samePasswordCredential(snapshot, input.credential))
+      return undefined;
+  }
+  const requirement = yield* current.requirement;
+
+  if (
+    !passwordEvidenceSatisfiedAt(evidence, input.authorization.requirement, now) ||
+    !passwordEvidenceSatisfiedAt(evidence, requirement, now)
+  )
+    return undefined;
+  if (
+    input.invalidation.existingSessions === "immediate" &&
+    policy.sessionInvalidation !== "same-authority-immediate"
+  )
+    return undefined;
+
+  return now;
+});
+
+/** Decoded subject-first snapshot used only for this action's policy decision. */
+export interface PasswordMutationRead {
+  readonly subject:
+    | { readonly active: boolean; readonly securityRevision: SecurityRevision }
+    | undefined;
+  readonly identifierCurrent: boolean;
+  readonly credentials: ReadonlyArray<{
+    readonly credentialId: string;
+    readonly revision: SecurityRevision;
+    readonly active: boolean;
+  }>;
+  readonly snapshot: Effect.Effect<
+    PasswordCredentialSnapshot | undefined,
+    PasswordUnavailable | PersistenceMappingError
+  >;
+  readonly requirement: Effect.Effect<
+    AuthenticationRequirement,
+    PasswordUnavailable | PersistenceMappingError
+  >;
+}

package/src/internal/password-registration-native.ts

@@ -0,0 +1,322 @@
+import { CurrentCommitJournal, type LifecycleHooks } from "@yielded/auth/Hooks";
+import type { LoginIdentifier } from "@yielded/auth/Identity";
+import {
+  PasswordUnavailable,
+  type PasswordReplacement,
+  type PreparePasswordCommit,
+  type PasswordRegistrationDecision,
+} from "@yielded/auth/Password";
+import type { SubjectId } from "@yielded/auth/Schema";
+import type { SecurityRevision } from "@yielded/auth/Sessions";
+import { Effect, Redacted, Schema, Option, Data, Cause, type Crypto } from "effect";
+import { SqlClient } from "effect/sql/SqlClient";
+import type { Fragment } from "effect/sql/Statement";
+
+import { sqlBatchAssertion } from "./d1-planning";
+import { PersistenceMappingError, isMappedConstraintConflict } from "./mapping-error";
+import type { AnyPasswordRegistrationMapping } from "./models/password-model";
+import type { NativeSqlTables, SqlTable } from "./native-sql-table";
+import { allocatePasswordValue } from "./password-policy";
+import type { PasswordRegistrationAuthority } from "./registration-contract";
+import { exactSqlText, executeSqlChange } from "./sql-change";
+import {
+  appendSqlBatchStatement,
+  CurrentSqlCommit,
+  makeSqlCommitExecutor,
+  registerSqlBatchPostcondition,
+  registerSqlCommitReceipt,
+  registerSqlPostcondition,
+  SqlBatchCommit,
+} from "./sql-commit";
+
+const unavailable = () => PasswordUnavailable.make({});
+
+const ensure: (condition: unknown) => asserts condition = (condition) => {
+  if (!condition) throw unavailable();
+};
+
+export class PasswordIdentifierTaken extends Data.TaggedError("PasswordIdentifierTaken") {}
+
+type BindingMapping = Pick<
+  AnyPasswordRegistrationMapping,
+  "subject" | "identifier" | "credential" | "authorityCredential" | "subjectId"
+> & { readonly isIdentifierConflict?: (cause: unknown) => boolean };
+
+/** Shared binding writes for mapped SQL provisioning and application provisioning. */
+export const makeNativePasswordRegistrationStore = Effect.fnUntraced(function* (
+  tables: NativeSqlTables,
+  mapping: BindingMapping,
+  batch = false,
+) {
+  const sql = (yield* SqlClient).withoutTransforms();
+
+  const s = mapping.subject,
+    i = mapping.identifier,
+    c = mapping.credential,
+    a = mapping.authorityCredential;
+
+  const subject = tables(s.table),
+    identifier = tables(i.table),
+    password = tables(c.table),
+    authority = tables(a.table);
+
+  const exact = (table: SqlTable, key: string, value: unknown) =>
+    exactSqlText(sql, table.column(key), table.value(key, value));
+
+  const owner = (table: SqlTable, key: string, value: unknown) =>
+    sql`${table.column(key)} = ${table.value(key, value)}`;
+
+  const stage = Effect.fnUntraced(function* (statement: Fragment) {
+    if (batch) {
+      yield* appendSqlBatchStatement(sql`${statement}`);
+      yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = 1`));
+    } else ensure((yield* executeSqlChange(sql, statement)) === 1);
+  });
+
+  const available = (value: LoginIdentifier) =>
+    sql`select 1 from ${identifier.name} where ${exact(identifier, i.namespace, value.namespace)} and ${exact(identifier, i.value, value.value)} limit 1`;
+
+  const bind = Effect.fnUntraced(function* (input: {
+    readonly moduleId: string;
+    readonly identifier: LoginIdentifier;
+    readonly subjectId: SubjectId;
+    readonly securityRevision: SecurityRevision;
+    readonly identifierRevision: SecurityRevision;
+    readonly credentialId: string;
+    readonly credentialRevision: SecurityRevision;
+    readonly verifierVersion: SecurityRevision;
+    readonly replacement: PasswordReplacement;
+  }) {
+    const nativeId = yield* mapping.subjectId.toNative(input.subjectId);
+
+    const initial = sql`${identifier.insert(i.encodeInitialInsert(input.identifier, nativeId, input.identifierRevision))}`;
+
+    if (batch) yield* stage(initial);
+    else
+      yield* sql.onDialectOrElse({
+        mysql: () =>
+          stage(initial).pipe(
+            Effect.catchIf(
+              (cause) =>
+                mapping.isIdentifierConflict !== undefined &&
+                isMappedConstraintConflict(mapping.isIdentifierConflict, cause),
+              () => Effect.fail(new PasswordIdentifierTaken()),
+            ),
+          ),
+        orElse: () =>
+          sql`${initial} on conflict (${identifier.columnName(i.namespace)}, ${identifier.columnName(i.value)}) do nothing returning 1 as bound`.pipe(
+            Effect.flatMap((rows) =>
+              rows.length === 1 ? Effect.void : Effect.fail(new PasswordIdentifierTaken()),
+            ),
+          ),
+      });
+    yield* stage(sql`${password.insert(c.encodeInsert({ ...input, subjectId: nativeId }))}`);
+    yield* stage(
+      sql`${authority.insert(a.encodeInsert({ subjectId: nativeId, credentialId: input.credentialId, revision: input.credentialRevision }))}`,
+    );
+    const passwordCondition = sql`exists(select 1 from ${password.name} where ${owner(password, c.subjectId, nativeId)} and ${exact(password, c.moduleId, input.moduleId)} and ${exact(password, c.credentialId, input.credentialId)} and ${exact(password, c.credentialRevision, input.credentialRevision)} and ${exact(password, c.verifierVersion, input.verifierVersion)} and ${exact(password, c.verifier, Redacted.value(input.replacement.verifier))} and ${exact(password, c.normalization, input.replacement.normalization)})`;
+    const identifierCondition = sql`exists(select 1 from ${identifier.name} where ${exact(identifier, i.namespace, input.identifier.namespace)} and ${exact(identifier, i.value, input.identifier.value)} and ${owner(identifier, i.subjectId, nativeId)} and ${exact(identifier, i.bindingRevision, input.identifierRevision)} and ${identifier.column(i.verifiedAt)} is null)`;
+    const authorityCondition = sql`exists(select 1 from ${authority.name} where ${owner(authority, a.subjectId, nativeId)} and ${exact(authority, a.credentialId, input.credentialId)} and ${exact(authority, a.revision, input.credentialRevision)} ${a.status === undefined ? sql`` : sql`and ${authority.column(a.status)} = ${authority.value(a.status, a.d1ActiveStatusValue)}`})`;
+
+    if (batch) {
+      ensure(
+        i.d1CurrentCondition !== undefined &&
+          s.d1ActiveStatusValue !== undefined &&
+          (a.status === undefined || a.d1ActiveStatusValue !== undefined),
+      );
+      yield* registerSqlBatchPostcondition({
+        name: "password-registration-authority",
+        statement: sqlBatchAssertion(
+          sql,
+          sql.and([
+            passwordCondition,
+            identifierCondition,
+            sql`exists(select 1 from ${identifier.name} where ${exact(identifier, i.namespace, input.identifier.namespace)} and ${exact(identifier, i.value, input.identifier.value)} and ${owner(identifier, i.subjectId, nativeId)} and ${tables.expression(i.d1CurrentCondition!({ identifier: input.identifier, nativeSubjectId: nativeId }))})`,
+            authorityCondition,
+            sql`exists(select 1 from ${subject.name} where ${owner(subject, s.id, nativeId)} and ${exact(subject, s.securityRevision, input.securityRevision)} and ${subject.column(s.status)} = ${subject.value(s.status, s.d1ActiveStatusValue)})`,
+          ]),
+        ),
+      });
+    } else
+      yield* registerSqlPostcondition({
+        name: "password-registration-authority",
+        check: Effect.gen(function* () {
+          const rows =
+            yield* sql`select ${subject.fields("registration_subject_")}, ${authority.fields("registration_factor_")}, ${identifier.fields("registration_identifier_")} from ${subject.name} inner join ${identifier.name} on ${exact(identifier, i.namespace, input.identifier.namespace)} and ${exact(identifier, i.value, input.identifier.value)} and ${owner(identifier, i.subjectId, nativeId)} inner join ${authority.name} on ${owner(authority, a.subjectId, nativeId)} and ${exact(authority, a.credentialId, input.credentialId)} and ${exact(authority, a.revision, input.credentialRevision)} where ${owner(subject, s.id, nativeId)} and ${exact(subject, s.securityRevision, input.securityRevision)} and ${passwordCondition} and ${identifierCondition} limit 2`;
+
+          ensure(rows.length === 1);
+          const subjectRow = subject.decode(rows[0]!, "registration_subject_");
+          const factorRow = authority.decode(rows[0]!, "registration_factor_");
+
+          ensure(
+            i.isCurrent(identifier.decode(rows[0]!, "registration_identifier_")) &&
+              s.isActiveStatus(subjectRow[s.status]) &&
+              (a.status === undefined || a.isActiveStatus?.(factorRow[a.status]) === true),
+          );
+        }).pipe(
+          Effect.mapError((cause) => PersistenceMappingError.make({ operation: "decode", cause })),
+        ),
+      });
+  });
+
+  const prepare = <A>(
+    value: PasswordRegistrationDecision,
+    project: PreparePasswordCommit<PasswordRegistrationDecision, A>,
+  ) =>
+    Effect.gen(function* () {
+      const receipt = project(value, yield* CurrentCommitJournal);
+      const current = yield* CurrentSqlCommit;
+
+      if (current.mode === "batch" && current.statements.length === 0)
+        yield* appendSqlBatchStatement(sql`select 1`);
+      ensure(receipt?._tag === "PreparedCommit" && Effect.isEffect(receipt.read));
+      yield* registerSqlCommitReceipt(receipt);
+
+      return receipt;
+    });
+
+  return { available, bind, prepare, stage };
+});
+
+export const makeNativePasswordRegistrationServices = Effect.fnUntraced(function* <Registration>(
+  tables: NativeSqlTables,
+  mapping: AnyPasswordRegistrationMapping<Registration>,
+  batch?: SqlBatchCommit["Service"],
+): Effect.fn.Return<
+  { readonly registrationAuthority: PasswordRegistrationAuthority<Registration> },
+  PasswordUnavailable,
+  SqlClient | LifecycleHooks | Crypto.Crypto
+> {
+  const sql = (yield* SqlClient).withoutTransforms();
+  const executor = yield* makeSqlCommitExecutor(unavailable);
+  const store = yield* makeNativePasswordRegistrationStore(tables, mapping, batch !== undefined);
+  const mode = "interactive";
+  const parent = yield* Effect.serviceOption(CurrentSqlCommit);
+
+  const run = <A, E, R>(work: Effect.Effect<A, E, R>, suppressed: Effect.Effect<A, E, R>) =>
+    batch !== undefined
+      ? executor.batch(work).pipe(Effect.provideService(SqlBatchCommit, batch))
+      : Option.isSome(parent)
+        ? executor.run(work)
+        : executor
+            .operation(
+              work.pipe(
+                Effect.mapError((error) =>
+                  error instanceof PasswordIdentifierTaken ? error : unavailable(),
+                ),
+              ),
+            )
+            .pipe(
+              Effect.catchCause((cause) =>
+                cause.reasons.length > 0 &&
+                cause.reasons.every(
+                  (reason) =>
+                    Cause.isFailReason(reason) && reason.error instanceof PasswordIdentifierTaken,
+                )
+                  ? executor.run(suppressed, "statement")
+                  : Effect.failCause(cause),
+              ),
+              Effect.mapError(unavailable),
+            );
+
+  const registrationAuthority: PasswordRegistrationAuthority<Registration> = {
+    register: (input, project) =>
+      executor.read(store.available(input.identifier)).pipe(
+        Effect.flatMap((existing) =>
+          existing.length !== 0
+            ? executor.run(store.prepare({ _tag: "Suppressed" }, project), "statement")
+            : run(
+                Effect.gen(function* () {
+                  const provisioning = mapping.provisioning;
+
+                  if (batch !== undefined && provisioning.idMode === "generated")
+                    return yield* unavailable();
+
+                  let nativeId =
+                    provisioning.idMode === "generated"
+                      ? undefined
+                      : yield* allocatePasswordValue(
+                          mode,
+                          provisioning.allocateSubjectId,
+                          provisioning.allocateSubjectIdSync,
+                        );
+
+                  const securityRevision = yield* allocatePasswordValue(
+                    mode,
+                    mapping.allocateRevision,
+                    mapping.allocateRevisionSync,
+                  );
+
+                  const identifierRevision = yield* allocatePasswordValue(
+                    mode,
+                    mapping.allocateRevision,
+                    mapping.allocateRevisionSync,
+                  );
+
+                  const credentialRevision = yield* allocatePasswordValue(
+                    mode,
+                    mapping.allocateRevision,
+                    mapping.allocateRevisionSync,
+                  );
+
+                  const verifierVersion = yield* allocatePasswordValue(
+                    mode,
+                    mapping.allocateRevision,
+                    mapping.allocateRevisionSync,
+                  );
+
+                  const credentialId = yield* allocatePasswordValue(
+                    mode,
+                    mapping.allocateCredentialId,
+                    mapping.allocateCredentialIdSync,
+                  );
+
+                  const subject = tables(mapping.subject.table);
+                  const insertion = sql`${subject.insert(provisioning.encodeSubjectInsert(input, { nativeSubjectId: nativeId, securityRevision }))}`;
+
+                  if (provisioning.idMode === "generated") {
+                    const generated = yield* sql.onDialectOrElse({
+                      mysql: () =>
+                        insertion.raw.pipe(
+                          Effect.flatMap(
+                            Schema.decodeUnknownEffect(
+                              Schema.Struct({
+                                insertId: Schema.Union([Schema.Int, Schema.String]),
+                              }),
+                            ),
+                          ),
+                          Effect.map((header) => [{ [mapping.subject.id]: header.insertId }]),
+                        ),
+                      orElse: () =>
+                        sql`${insertion} returning ${subject.fields("registration_generated_")}`.pipe(
+                          Effect.map((rows) =>
+                            rows.map((row) => subject.decode(row, "registration_generated_")),
+                          ),
+                        ),
+                    });
+
+                    nativeId = yield* provisioning.decodeGeneratedId(generated);
+                  } else yield* store.stage(insertion);
+                  ensure(nativeId !== undefined);
+                  const subjectId = yield* mapping.subjectId.toSubject(nativeId);
+
+                  yield* store.bind({
+                    ...input,
+                    subjectId,
+                    securityRevision,
+                    identifierRevision,
+                    credentialId,
+                    credentialRevision,
+                    verifierVersion,
+                  });
+
+                  return yield* store.prepare({ _tag: "Created", subjectId }, project);
+                }),
+                store.prepare({ _tag: "Suppressed" }, project),
+              ),
+        ),
+      ),
+  };
+
+  return { registrationAuthority };
+});