@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.27

package/dist/internal/password-kernel.mjs

@@ -1,508 +0,0 @@
-import { PersistenceMappingError } from "./mapping-error.mjs";
-import { makeNativeSqlTables, sqlMapping } from "./native-sql-table.mjs";
-import { NativeDatabase } from "./transaction-kernel.mjs";
-import { CurrentPasswordPreparedTransaction, PasswordPreparedPostconditions } from "./PasswordPreparedPostconditions.mjs";
-import { CurrentProofSql } from "./proof-kernel.mjs";
-import { requiredPasswordConstraints } from "./models/password-model.mjs";
-import { makePasswordCredentials, samePasswordCredentialSnapshot } from "./password-credentials.mjs";
-import { Cause, Context, DateTime, Effect, Option, Redacted, Schema } from "effect";
-import { CurrentCommitJournal, HookConfigurationError, LifecycleHooks, coordinateCommit, hasCommitScope } from "@yielded/auth/Hooks";
-import { snapshotAuthenticationEvidence } from "@yielded/auth/Sessions";
-import { reportPersistenceFailure } from "@yielded/auth/Persistence";
-import { ProofUnavailable } from "@yielded/auth/Proofs";
-import { PasswordPersistence, PasswordUnavailable, snapshotPasswordCredential, snapshotPasswordRequirement, snapshotPasswordRevision } from "@yielded/auth/Password";
-//#region src/internal/password-kernel.ts
-var CurrentPasswordSql = class extends Context.Service()("effect-auth/CurrentPasswordSql") {};
-const makePasswordKernel = (operations, proofs, nativeTables = (client) => makeNativeSqlTables(client)) => {
-	const { and, eq, inArray, column, updateValues } = operations;
-	const { completeProofPlanIn } = proofs;
-	const unavailable = () => PasswordUnavailable.make({});
-	const translateFailure = (effect) => reportPersistenceFailure(effect, (error) => Schema.is(PasswordUnavailable)(error) || Schema.is(ProofUnavailable)(error) || Schema.is(HookConfigurationError)(error)).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));
-	const nowMillis = DateTime.now.pipe(Effect.map(DateTime.toEpochMillis));
-	const validConstraints = (mapping) => Object.entries(requiredPasswordConstraints).every(([key, value]) => mapping.constraints[key] === value);
-	const selectRows = (query, locking) => locking && typeof query.for === "function" ? query.for("update") : query;
-	const subjectColumns = (mapping) => ({
-		id: column(mapping.subject.table, mapping.subject.id),
-		status: column(mapping.subject.table, mapping.subject.status),
-		securityRevision: column(mapping.subject.table, mapping.subject.securityRevision)
-	});
-	const identifierColumns = (mapping) => ({
-		namespace: column(mapping.identifier.table, mapping.identifier.namespace),
-		value: column(mapping.identifier.table, mapping.identifier.value),
-		subjectId: column(mapping.identifier.table, mapping.identifier.subjectId),
-		verifiedAt: column(mapping.identifier.table, mapping.identifier.verifiedAt),
-		bindingRevision: column(mapping.identifier.table, mapping.identifier.bindingRevision)
-	});
-	const credentialColumns = (mapping) => ({
-		moduleId: column(mapping.credential.table, mapping.credential.moduleId),
-		subjectId: column(mapping.credential.table, mapping.credential.subjectId),
-		credentialId: column(mapping.credential.table, mapping.credential.credentialId),
-		credentialRevision: column(mapping.credential.table, mapping.credential.credentialRevision),
-		verifierVersion: column(mapping.credential.table, mapping.credential.verifierVersion),
-		verifier: column(mapping.credential.table, mapping.credential.verifier),
-		normalization: column(mapping.credential.table, mapping.credential.normalization)
-	});
-	const authorityCredentialColumns = (mapping) => ({
-		subjectId: column(mapping.authorityCredential.table, mapping.authorityCredential.subjectId),
-		credentialId: column(mapping.authorityCredential.table, mapping.authorityCredential.credentialId),
-		revision: column(mapping.authorityCredential.table, mapping.authorityCredential.revision)
-	});
-	const commandColumns = (mapping) => ({
-		moduleId: column(mapping.command.table, mapping.command.moduleId),
-		commandId: column(mapping.command.table, mapping.command.commandId),
-		action: column(mapping.command.table, mapping.command.action),
-		bindingDigest: column(mapping.command.table, mapping.command.bindingDigest),
-		decision: column(mapping.command.table, mapping.command.decision),
-		retentionUntil: column(mapping.command.table, mapping.command.retentionUntil)
-	});
-	const allocate = (mode, asyncValue, syncValue) => {
-		if (mode === "synchronous") return syncValue === void 0 ? Effect.fail(unavailable()) : Effect.try({
-			try: syncValue,
-			catch: (cause) => new PersistenceMappingError({
-				operation: "mapping",
-				cause
-			})
-		});
-		if (asyncValue !== void 0) return asyncValue;
-		return syncValue === void 0 ? Effect.fail(unavailable()) : Effect.try({
-			try: syncValue,
-			catch: (cause) => new PersistenceMappingError({
-				operation: "mapping",
-				cause
-			})
-		});
-	};
-	const allocateNextSecurityRevision = (mapping, mode, current) => {
-		const asyncValue = mapping.subject.nextSecurityRevision?.(current);
-		const syncValue = mapping.subject.nextSecurityRevisionSync === void 0 ? void 0 : () => mapping.subject.nextSecurityRevisionSync(current);
-		return allocate(mode, asyncValue ?? mapping.allocateRevision, syncValue ?? mapping.allocateRevisionSync);
-	};
-	const sameIdentifier = (left, right) => left.namespace === right.namespace && left.value === right.value;
-	const evidenceSatisfiedAt = (evidence, requirement, now) => {
-		if (evidence.proofs.length > 64 || evidence.revision.credentials.length > 64) return false;
-		const revisions = /* @__PURE__ */ new Map();
-		for (const item of evidence.revision.credentials) {
-			if (revisions.has(item.credentialId)) return false;
-			revisions.set(item.credentialId, item.revision);
-		}
-		if (evidence.proofs.some((proof) => !revisions.has(proof.credentialId))) return false;
-		if (evidence.proofs.some((proof) => now < DateTime.toEpochMillis(proof.verifiedAt))) return false;
-		const eligible = evidence.proofs.filter((proof) => {
-			const age = now - DateTime.toEpochMillis(proof.verifiedAt);
-			return age >= 0 && age < requirement.maximumAgeMillis;
-		});
-		const factors = new Set(eligible.flatMap((proof) => proof.factors));
-		const credentials = new Set(eligible.map((proof) => proof.credentialId));
-		return requirement.alternatives.some((alternative) => alternative.factors.every((factor) => factors.has(factor)) && credentials.size >= alternative.minimumCredentials && eligible.some((proof) => (!alternative.userVerified || proof.userVerified) && (!alternative.phishingResistant || proof.phishingResistant)));
-	};
-	const snapshotMutationInput = Effect.fn("DrizzlePassword.snapshotMutationInput")(function* (input) {
-		const expectedRevision = snapshotPasswordRevision(input.expectedRevision);
-		const evidence = yield* snapshotAuthenticationEvidence(input.authorization.evidence).pipe(Effect.mapError(unavailable));
-		const requirement = yield* snapshotPasswordRequirement(input.authorization.requirement);
-		const credential = input.credential === void 0 ? void 0 : yield* snapshotPasswordCredential(input.credential);
-		return Object.freeze({
-			...input,
-			expectedRevision,
-			replacement: Object.freeze({
-				verifier: Redacted.make(Redacted.value(input.replacement.verifier)),
-				normalization: input.replacement.normalization
-			}),
-			invalidation: Object.freeze({ ...input.invalidation }),
-			...credential === void 0 ? {} : { credential },
-			authorization: Object.freeze({
-				challenge: Object.freeze({
-					...input.authorization.challenge,
-					revision: snapshotPasswordRevision(input.authorization.challenge.revision)
-				}),
-				evidence,
-				requirement
-			})
-		});
-	});
-	const lockSubject = Effect.fn("DrizzlePassword.lockSubject")(function* (mapping, subjectId, locking) {
-		const database = yield* CurrentPasswordSql;
-		const nativeSubjectId = yield* mapping.subjectId.toNative(subjectId);
-		const c = subjectColumns(mapping);
-		return {
-			nativeSubjectId,
-			row: (yield* selectRows(database.select().from(mapping.subject.table).where(eq(c.id, nativeSubjectId)).limit(1), locking))[0]
-		};
-	});
-	const lockIdentifier = Effect.fn("Drizzle.lockIdentifier")(function* (mapping, identifier, locking) {
-		const database = yield* CurrentPasswordSql;
-		const c = identifierColumns(mapping);
-		return yield* selectRows(database.select().from(mapping.identifier.table).where(and(eq(c.namespace, identifier.namespace), eq(c.value, identifier.value))).limit(1), locking);
-	});
-	const readPasswordCredential = Effect.fn("Drizzle.readPasswordCredential")(function* (mapping, moduleId, nativeSubjectId, locking) {
-		const database = yield* CurrentPasswordSql;
-		const c = credentialColumns(mapping);
-		return yield* selectRows(database.select().from(mapping.credential.table).where(and(eq(c.moduleId, moduleId), eq(c.subjectId, nativeSubjectId))).limit(1), locking);
-	});
-	const resolveCredential = Effect.fn("DrizzlePassword.resolveCredential")(function* (mapping, moduleId, identifier, requestedSubjectId, locking) {
-		const database = yield* CurrentPasswordSql;
-		const discovered = (yield* lockIdentifier(mapping, identifier, false))[0];
-		if (discovered === void 0 || !mapping.identifier.isCurrent(discovered)) return void 0;
-		const discoveredNative = discovered[mapping.identifier.subjectId];
-		const subject = (yield* selectRows(database.select().from(mapping.subject.table).where(eq(subjectColumns(mapping).id, discoveredNative)).limit(1), locking))[0];
-		if (subject === void 0 || !mapping.subject.isActiveStatus(subject[mapping.subject.status])) return void 0;
-		const identifierRow = (yield* lockIdentifier(mapping, identifier, locking))[0];
-		if (identifierRow === void 0 || !mapping.identifier.isCurrent(identifierRow) || !mapping.subjectId.equals(discoveredNative, identifierRow[mapping.identifier.subjectId])) return void 0;
-		const subjectId = yield* mapping.subjectId.toSubject(discoveredNative);
-		if (requestedSubjectId !== void 0 && requestedSubjectId !== subjectId) return void 0;
-		const credential = (yield* readPasswordCredential(mapping, moduleId, discoveredNative, locking))[0];
-		if (credential === void 0) return {
-			nativeSubjectId: discoveredNative,
-			subject,
-			identifier: identifierRow
-		};
-		return {
-			nativeSubjectId: discoveredNative,
-			subject,
-			identifier: identifierRow,
-			credential,
-			snapshot: yield* mapping.credential.decode({
-				moduleId,
-				subject,
-				identifier: identifierRow,
-				credential
-			}).pipe(Effect.flatMap(snapshotPasswordCredential))
-		};
-	});
-	const owned = (database, mapping, configuration, body) => {
-		if (!validConstraints(mapping)) return Effect.fail(unavailable());
-		const run = coordinateCommit(() => database.transaction((transaction) => body.pipe(Effect.provideService(CurrentPasswordSql, transaction), Effect.provideService(CurrentProofSql, transaction))), { mode: configuration.mode }).pipe(Effect.map((result) => result.value));
-		return configuration.coordinated !== true ? Effect.gen(function* () {
-			if (yield* hasCommitScope) return yield* unavailable();
-			yield* configuration.standaloneGuard;
-			return yield* run;
-		}) : run;
-	};
-	const registerFinal = Effect.fnUntraced(function* (check) {
-		const postconditions = yield* Effect.serviceOption(PasswordPreparedPostconditions);
-		if (Option.isNone(postconditions)) return;
-		const postcondition = Effect.gen(function* () {
-			const transaction = yield* CurrentPasswordPreparedTransaction;
-			if (!(yield* check.pipe(Effect.provideService(CurrentPasswordSql, transaction)))) return yield* unavailable();
-		}).pipe(translateFailure);
-		if (!postconditions.value.register(postcondition)) return yield* unavailable();
-	});
-	const safeRead = (database, configuration, body) => Effect.gen(function* () {
-		if (configuration.coordinated !== true) {
-			if (yield* hasCommitScope) return yield* unavailable();
-			yield* configuration.standaloneGuard;
-		}
-		return yield* database.transaction((transaction) => body.pipe(Effect.provideService(CurrentPasswordSql, transaction), Effect.provideService(CurrentProofSql, transaction)));
-	});
-	const proofCompletionMatchesPassword = (input) => {
-		const completion = input.completion.input;
-		const binding = completion.binding;
-		if (completion.moduleId !== `${input.moduleId}/reset` || completion.purpose !== "password-reset" || binding._tag !== "Subject" || input.credential === void 0 || binding.revision.subjectId !== input.expectedRevision.subjectId || binding.revision.securityRevision !== input.expectedRevision.securityRevision || !sameIdentifier(binding.identifier, input.credential.identifier)) return false;
-		const expected = [...input.expectedRevision.credentials].sort((left, right) => left.credentialId.localeCompare(right.credentialId));
-		const actual = [...binding.revision.credentials].sort((left, right) => left.credentialId.localeCompare(right.credentialId));
-		return expected.length === actual.length && expected.every((item, index) => item.credentialId === actual[index].credentialId && item.revision === actual[index].revision);
-	};
-	const probeProofCompletion = Effect.fn("Drizzle.probeProofCompletion")(function* (configuration, input) {
-		const database = yield* CurrentPasswordSql;
-		if (configuration.proof === void 0) return yield* Effect.fail(unavailable());
-		const validProbe = { _tag: "PasswordProofCompletionValid" };
-		const plan = {
-			input,
-			prepare: (decision, journal, project) => journal.prepare(project(decision))
-		};
-		const probe = coordinateCommit(() => database.transaction((transaction) => completeProofPlanIn(configuration.proof.mapping, configuration.proof.configuration, plan, Effect.fail(validProbe), () => false).pipe(Effect.provideService(CurrentProofSql, transaction))), { mode: configuration.mode });
-		if (configuration.coordinated === true || (yield* hasCommitScope)) return yield* unavailable();
-		yield* configuration.standaloneGuard;
-		return yield* probe.pipe(Effect.as(false), Effect.catchCause((cause) => {
-			const reason = cause.reasons[0];
-			return cause.reasons.length === 1 && reason !== void 0 && Cause.isFailReason(reason) && reason.error === validProbe ? Effect.succeed(true) : Effect.failCause(cause);
-		}));
-	});
-	const validateMutationAuthority = Effect.fn("DrizzlePassword.validateMutationAuthority")(function* (mapping, configuration, input, action) {
-		const database = yield* CurrentPasswordSql;
-		const locked = yield* lockSubject(mapping, input.expectedRevision.subjectId, configuration.locking);
-		const row = locked.row;
-		if (row === void 0 || !mapping.subject.isActiveStatus(row[mapping.subject.status]) || row[mapping.subject.securityRevision] !== input.expectedRevision.securityRevision) return void 0;
-		if (input.authorization.challenge.moduleId !== input.moduleId || input.authorization.challenge.action !== action || input.authorization.challenge.commandId !== input.commandId || input.authorization.challenge.revision.subjectId !== input.expectedRevision.subjectId || input.authorization.challenge.revision.securityRevision !== input.expectedRevision.securityRevision || input.authorization.evidence.flowId !== input.commandId || input.authorization.evidence.bindingDigest !== input.authorization.challenge.bindingDigest || input.authorization.evidence.revision.subjectId !== input.expectedRevision.subjectId || input.authorization.evidence.revision.securityRevision !== input.expectedRevision.securityRevision || action === "add-password" && (input.credential !== void 0 || input.authorization.challenge.targetCredentialId !== void 0)) return void 0;
-		if (input.expectedRevision.credentials.some((expected) => !input.authorization.evidence.revision.credentials.some((actual) => actual.credentialId === expected.credentialId && actual.revision === expected.revision))) return void 0;
-		if (input.credential !== void 0) {
-			const identifier = (yield* lockIdentifier(mapping, input.credential.identifier, configuration.locking))[0];
-			if (identifier === void 0 || !mapping.identifier.isCurrent(identifier) || !mapping.subjectId.equals(identifier[mapping.identifier.subjectId], locked.nativeSubjectId) || identifier[mapping.identifier.bindingRevision] !== input.credential.identifierBindingRevision) return void 0;
-		}
-		const allExpected = [...input.expectedRevision.credentials, ...input.authorization.evidence.revision.credentials];
-		const expected = new Map(allExpected.map((item) => [item.credentialId, item]));
-		const ac = authorityCredentialColumns(mapping);
-		const credentialRows = expected.size === 0 ? [] : yield* selectRows(database.select().from(mapping.authorityCredential.table).where(and(eq(ac.subjectId, locked.nativeSubjectId), inArray(ac.credentialId, [...expected.keys()]))).orderBy(ac.credentialId), configuration.locking);
-		if (credentialRows.length !== expected.size) return void 0;
-		for (const actual of credentialRows) {
-			const wanted = expected.get(actual[mapping.authorityCredential.credentialId]);
-			if (wanted === void 0 || actual[mapping.authorityCredential.revision] !== wanted.revision || mapping.authorityCredential.status !== void 0 && mapping.authorityCredential.isActiveStatus?.(actual[mapping.authorityCredential.status]) !== true) return void 0;
-			expected.delete(wanted.credentialId);
-		}
-		if (expected.size !== 0) return void 0;
-		if (input.credential !== void 0) {
-			const identifier = (yield* lockIdentifier(mapping, input.credential.identifier, false))[0];
-			const credential = (yield* readPasswordCredential(mapping, input.moduleId, locked.nativeSubjectId, configuration.locking))[0];
-			if (identifier === void 0 || credential === void 0) return void 0;
-			const snapshot = yield* mapping.credential.decode({
-				moduleId: input.moduleId,
-				subject: row,
-				identifier,
-				credential
-			});
-			if (!samePasswordCredentialSnapshot(snapshot, input.credential)) return void 0;
-		}
-		const currentRequirement = yield* mapping.subject.decodeActionRequirement(row, action);
-		const now = yield* nowMillis;
-		if (!evidenceSatisfiedAt(input.authorization.evidence, input.authorization.requirement, now) || !evidenceSatisfiedAt(input.authorization.evidence, currentRequirement, now)) return void 0;
-		if ((input.invalidation.existingSessions === "immediate" || input.invalidation.existingSessions === "cache-expiry") && mapping.sessionInvalidation !== "same-authority-immediate") return void 0;
-		return {
-			...locked,
-			now
-		};
-	});
-	const commandExists = Effect.fn("Drizzle.commandExists")(function* (mapping, moduleId, commandId, locking) {
-		const database = yield* CurrentPasswordSql;
-		const c = commandColumns(mapping);
-		return yield* selectRows(database.select().from(mapping.command.table).where(and(eq(c.moduleId, moduleId), eq(c.commandId, commandId))).limit(1), locking);
-	});
-	const insertCommand = Effect.fn("Drizzle.insertCommand")(function* (mapping, input, action, now) {
-		return yield* (yield* CurrentPasswordSql).insert(mapping.command.table).values(mapping.command.encodeInsert({
-			moduleId: input.moduleId,
-			commandId: input.commandId,
-			action,
-			bindingDigest: input.authorization.challenge.bindingDigest,
-			decision: "changed",
-			retentionUntilMillis: now + mapping.commandRetentionMillis
-		}));
-	});
-	const mutationPostconditions = Effect.fn("DrizzlePassword.mutationPostconditions")(function* (mapping, input, nativeSubjectId, subject, authorityCredential, now) {
-		if (subject === void 0 || !mapping.subject.isActiveStatus(subject[mapping.subject.status]) || authorityCredential === void 0 || mapping.authorityCredential.status !== void 0 && mapping.authorityCredential.isActiveStatus?.(authorityCredential[mapping.authorityCredential.status]) !== true) return false;
-		if (input.credential !== void 0) {
-			const identifier = (yield* lockIdentifier(mapping, input.credential.identifier, false))[0];
-			if (identifier === void 0 || !mapping.identifier.isCurrent(identifier) || !mapping.subjectId.equals(identifier[mapping.identifier.subjectId], nativeSubjectId) || identifier[mapping.identifier.bindingRevision] !== input.credential.identifierBindingRevision) return false;
-			const credential = (yield* readPasswordCredential(mapping, input.moduleId, nativeSubjectId, false))[0];
-			if (credential === void 0) return false;
-			if ((yield* mapping.credential.decode({
-				moduleId: input.moduleId,
-				subject,
-				identifier,
-				credential
-			})).identifierVerifiedAtMillis !== input.credential.identifierVerifiedAtMillis) return false;
-		}
-		const rows = yield* commandExists(mapping, input.moduleId, input.commandId, false);
-		const row = rows[0];
-		return rows.length === 1 && row[mapping.command.action] === input.authorization.challenge.action && row[mapping.command.bindingDigest] === input.authorization.challenge.bindingDigest && row[mapping.command.decision] === "changed" && (yield* mapping.decodeInstant(row[mapping.command.retentionUntil])) === now + mapping.commandRetentionMillis;
-	});
-	const addPasswordIn = Effect.fn("DrizzlePassword.addPasswordIn")(function* (mapping, configuration, input, revisions, commandNow) {
-		const database = yield* CurrentPasswordSql;
-		const { credentialId, credentialRevision, verifierVersion, nextSecurityRevision } = revisions;
-		const authority = yield* validateMutationAuthority(mapping, configuration, input, "add-password");
-		if (authority === void 0) return false;
-		if ((yield* commandExists(mapping, input.moduleId, input.commandId, true)).length) return false;
-		if ((yield* readPasswordCredential(mapping, input.moduleId, authority.nativeSubjectId, true)).length) return false;
-		yield* database.insert(mapping.credential.table).values(mapping.credential.encodeInsert({
-			moduleId: input.moduleId,
-			subjectId: authority.nativeSubjectId,
-			credentialId,
-			credentialRevision,
-			verifierVersion,
-			replacement: input.replacement
-		}));
-		yield* database.insert(mapping.authorityCredential.table).values(mapping.authorityCredential.encodeInsert({
-			subjectId: authority.nativeSubjectId,
-			credentialId,
-			revision: credentialRevision
-		}));
-		yield* database.update(mapping.subject.table).set(updateValues([[mapping.subject.securityRevision, nextSecurityRevision]])).where(and(eq(subjectColumns(mapping).id, authority.nativeSubjectId), eq(subjectColumns(mapping).securityRevision, input.expectedRevision.securityRevision)));
-		yield* insertCommand(mapping, input, "add-password", commandNow ?? authority.now);
-		const applied = checkMutationApplied(mapping, input, authority.nativeSubjectId, revisions, commandNow ?? authority.now);
-		if (!(yield* applied)) return yield* unavailable();
-		yield* registerFinal(applied);
-		return true;
-	});
-	const makeSqlPasswordPersistence = Effect.fn("makeSqlPasswordPersistence")(function* (mapping, configuration) {
-		const database = yield* CurrentPasswordSql;
-		if (!configuration.coordinated) yield* (operations.validateStorage?.({
-			...mapping,
-			proof: configuration.proof?.mapping
-		}) ?? Effect.void).pipe(Effect.mapError(unavailable));
-		const hooks = yield* LifecycleHooks;
-		if (!validConstraints(mapping)) return yield* unavailable();
-		const root = yield* NativeDatabase;
-		const credentials = yield* makePasswordCredentials(yield* sqlMapping(() => nativeTables(root.$client.withoutTransforms(), root)).pipe(translateFailure), mapping, configuration);
-		return PasswordPersistence.of({
-			...credentials,
-			readForSubject: (input) => safeRead(database, configuration, Effect.gen(function* () {
-				const transaction = yield* CurrentPasswordSql;
-				const locked = yield* lockSubject(mapping, input.subjectId, false);
-				if (locked.row === void 0 || !mapping.subject.isActiveStatus(locked.row[mapping.subject.status])) return Option.none();
-				const credential = (yield* readPasswordCredential(mapping, input.moduleId, locked.nativeSubjectId, false))[0];
-				if (credential === void 0) return Option.none();
-				const ic = identifierColumns(mapping);
-				const identifier = (yield* transaction.select().from(mapping.identifier.table).where(eq(ic.subjectId, locked.nativeSubjectId))).find((row) => mapping.identifier.isCurrent(row));
-				if (identifier === void 0) return Option.none();
-				const snapshot = yield* mapping.credential.decode({
-					moduleId: input.moduleId,
-					subject: locked.row,
-					identifier,
-					credential
-				}).pipe(Effect.flatMap(snapshotPasswordCredential));
-				return Option.some(snapshot);
-			})).pipe(Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
-			recoveryTarget: (input) => safeRead(database, configuration, Effect.gen(function* () {
-				const resolved = yield* resolveCredential(mapping, input.moduleId, input.identifier, void 0, false);
-				return resolved?.snapshot === void 0 || resolved.snapshot.identifierVerifiedAtMillis === void 0 ? Option.none() : Option.some(resolved.snapshot);
-			})).pipe(Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
-			addIfAbsent: (uncaptured, prepare) => Effect.gen(function* () {
-				const input = yield* snapshotMutationInput(uncaptured);
-				const credentialId = yield* allocate(configuration.mode, mapping.allocateCredentialId, mapping.allocateCredentialIdSync);
-				const credentialRevision = yield* allocate(configuration.mode, mapping.allocateRevision, mapping.allocateRevisionSync);
-				const verifierVersion = yield* allocate(configuration.mode, mapping.allocateRevision, mapping.allocateRevisionSync);
-				const nextSecurityRevision = yield* allocateNextSecurityRevision(mapping, configuration.mode, input.expectedRevision.securityRevision);
-				if (nextSecurityRevision === input.expectedRevision.securityRevision) return yield* unavailable();
-				return yield* owned(database, mapping, configuration, Effect.gen(function* () {
-					const journal = yield* CurrentCommitJournal;
-					return prepare((yield* addPasswordIn(mapping, configuration, input, {
-						credentialId,
-						credentialRevision,
-						verifierVersion,
-						nextSecurityRevision
-					})) ? "changed" : "rejected", journal);
-				}));
-			}).pipe(Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
-			replaceIfCurrent: (uncaptured, prepare) => Effect.gen(function* () {
-				const input = yield* snapshotMutationInput(uncaptured);
-				const credentialRevision = yield* allocate(configuration.mode, mapping.allocateRevision, mapping.allocateRevisionSync);
-				const verifierVersion = yield* allocate(configuration.mode, mapping.allocateRevision, mapping.allocateRevisionSync);
-				const nextSecurityRevision = yield* allocateNextSecurityRevision(mapping, configuration.mode, input.expectedRevision.securityRevision);
-				if (nextSecurityRevision === input.expectedRevision.securityRevision || input.credential !== void 0 && credentialRevision === input.credential.credentialRevision) return yield* unavailable();
-				return yield* owned(database, mapping, configuration, Effect.gen(function* () {
-					return yield* replaceIn(mapping, configuration, input, "change-password", {
-						credentialRevision,
-						verifierVersion,
-						nextSecurityRevision
-					}, prepare);
-				}));
-			}).pipe(Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
-			checkReset: (input) => (configuration.proof === void 0 ? Effect.fail(unavailable()) : Effect.gen(function* () {
-				if (input.moduleId.length <= 6 || !input.moduleId.endsWith("/reset") || input.purpose !== "password-reset" || input.binding._tag !== "Subject") return false;
-				const binding = input.binding;
-				const passwordModuleId = input.moduleId.slice(0, -6);
-				return (yield* safeRead(database, configuration, Effect.gen(function* () {
-					const resolved = yield* resolveCredential(mapping, passwordModuleId, binding.identifier, binding.revision.subjectId, false);
-					return resolved?.snapshot !== void 0 && resolved.snapshot.revision.securityRevision === binding.revision.securityRevision && binding.revision.credentials.every((item) => resolved.snapshot.revision.credentials.some((actual) => actual.credentialId === item.credentialId && actual.revision === item.revision));
-				}))) ? yield* probeProofCompletion(configuration, input) : false;
-			})).pipe(Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
-			resetWithProof: (uncaptured, prepare) => (configuration.proof === void 0 ? Effect.fail(unavailable()) : Effect.gen(function* () {
-				const input = Object.freeze({
-					...yield* snapshotMutationInput(uncaptured),
-					completion: uncaptured.completion
-				});
-				const credentialRevision = yield* allocate(configuration.mode, mapping.allocateRevision, mapping.allocateRevisionSync);
-				const verifierVersion = yield* allocate(configuration.mode, mapping.allocateRevision, mapping.allocateRevisionSync);
-				const nextSecurityRevision = yield* allocateNextSecurityRevision(mapping, configuration.mode, input.expectedRevision.securityRevision);
-				if (nextSecurityRevision === input.expectedRevision.securityRevision || input.credential !== void 0 && credentialRevision === input.credential.credentialRevision) return yield* unavailable();
-				return yield* owned(database, mapping, configuration, Effect.gen(function* () {
-					const journal = yield* CurrentCommitJournal;
-					if (!proofCompletionMatchesPassword(input)) return prepare("rejected", journal);
-					const authority = yield* validateMutationAuthority(mapping, configuration, input, "reset-password");
-					if (authority === void 0) return prepare("rejected", journal);
-					if ((yield* commandExists(mapping, input.moduleId, input.commandId, true)).length) return prepare("rejected", journal);
-					if (!(yield* currentExpectedCredential(mapping, input, authority.nativeSubjectId))) return prepare("rejected", journal);
-					let passwordReceipt;
-					yield* completeProofPlanIn(configuration.proof.mapping, configuration.proof.configuration, input.completion, Effect.gen(function* () {
-						const revisions = {
-							credentialRevision,
-							verifierVersion,
-							nextSecurityRevision
-						};
-						const applied = yield* writeReplacement(mapping, input, authority.nativeSubjectId, revisions, authority.now);
-						if (applied) yield* registerReplacement(mapping, input, authority.nativeSubjectId, revisions, authority.now);
-						return applied;
-					}), (decision) => {
-						passwordReceipt = prepare(decision === "completed" ? "changed" : "rejected", journal);
-						return decision;
-					});
-					return passwordReceipt ?? prepare("rejected", journal);
-				}));
-			})).pipe(Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure)
-		});
-	});
-	const currentExpectedCredential = Effect.fn("DrizzlePassword.currentExpectedCredential")(function* (mapping, input, nativeSubjectId) {
-		if (input.credential === void 0) return false;
-		const row = (yield* readPasswordCredential(mapping, input.moduleId, nativeSubjectId, true))[0];
-		if (row === void 0) return false;
-		return row[mapping.credential.credentialId] === input.credential.credentialId && row[mapping.credential.credentialRevision] === input.credential.credentialRevision && row[mapping.credential.verifierVersion] === input.credential.verifierVersion && row[mapping.credential.verifier] === Redacted.value(input.credential.verifier) && row[mapping.credential.normalization] === input.credential.normalization && input.authorization.challenge.targetCredentialId === input.credential.credentialId;
-	});
-	const checkMutationApplied = Effect.fn("DrizzlePassword.checkMutationApplied")(function* (mapping, input, nativeSubjectId, revisions, now) {
-		const database = yield* CurrentPasswordSql;
-		const c = credentialColumns(mapping), s = subjectColumns(mapping);
-		const credential = (yield* database.select().from(mapping.credential.table).where(and(eq(c.moduleId, input.moduleId), eq(c.subjectId, nativeSubjectId), eq(c.credentialId, revisions.credentialId), eq(c.credentialRevision, revisions.credentialRevision), eq(c.verifierVersion, revisions.verifierVersion), eq(c.verifier, Redacted.value(input.replacement.verifier)), eq(c.normalization, input.replacement.normalization))).limit(1))[0];
-		const subject = (yield* database.select().from(mapping.subject.table).where(and(eq(s.id, nativeSubjectId), eq(s.securityRevision, revisions.nextSecurityRevision))).limit(1))[0];
-		const authorityCredential = (yield* database.select().from(mapping.authorityCredential.table).where(and(eq(authorityCredentialColumns(mapping).subjectId, nativeSubjectId), eq(authorityCredentialColumns(mapping).credentialId, revisions.credentialId), eq(authorityCredentialColumns(mapping).revision, revisions.credentialRevision))).limit(1))[0];
-		return credential !== void 0 && credential[mapping.credential.credentialId] === revisions.credentialId && credential[mapping.credential.credentialRevision] === revisions.credentialRevision && credential[mapping.credential.verifierVersion] === revisions.verifierVersion && credential[mapping.credential.verifier] === Redacted.value(input.replacement.verifier) && credential[mapping.credential.normalization] === input.replacement.normalization && (yield* mutationPostconditions(mapping, input, nativeSubjectId, subject, authorityCredential, now));
-	});
-	const writeReplacement = Effect.fn("DrizzlePassword.writeReplacement")(function* (mapping, input, nativeSubjectId, revisions, now) {
-		const database = yield* CurrentPasswordSql;
-		const c = credentialColumns(mapping);
-		const s = subjectColumns(mapping);
-		yield* database.update(mapping.credential.table).set(mapping.credential.encodeReplacement({
-			replacement: input.replacement,
-			credentialRevision: revisions.credentialRevision,
-			verifierVersion: revisions.verifierVersion
-		})).where(and(eq(c.moduleId, input.moduleId), eq(c.subjectId, nativeSubjectId), eq(c.credentialId, input.credential.credentialId), eq(c.credentialRevision, input.credential.credentialRevision), eq(c.verifierVersion, input.credential.verifierVersion), eq(c.verifier, Redacted.value(input.credential.verifier)), eq(c.normalization, input.credential.normalization)));
-		yield* database.update(mapping.subject.table).set(updateValues([[mapping.subject.securityRevision, revisions.nextSecurityRevision]])).where(and(eq(s.id, nativeSubjectId), eq(s.securityRevision, input.expectedRevision.securityRevision)));
-		yield* database.update(mapping.authorityCredential.table).set(mapping.authorityCredential.encodeRevision(revisions.credentialRevision)).where(and(eq(authorityCredentialColumns(mapping).subjectId, nativeSubjectId), eq(authorityCredentialColumns(mapping).credentialId, input.credential.credentialId), eq(authorityCredentialColumns(mapping).revision, input.credential.credentialRevision)));
-		yield* insertCommand(mapping, input, input.authorization.challenge.action, now);
-		return yield* checkMutationApplied(mapping, input, nativeSubjectId, {
-			...revisions,
-			credentialId: input.credential.credentialId
-		}, now);
-	});
-	const registerReplacement = (mapping, input, nativeSubjectId, revisions, now) => registerFinal(checkMutationApplied(mapping, input, nativeSubjectId, {
-		...revisions,
-		credentialId: input.credential.credentialId
-	}, now));
-	const replaceIn = Effect.fn("Drizzle.replaceIn")(function* (mapping, configuration, input, action, revisions, prepare) {
-		const journal = yield* CurrentCommitJournal;
-		const authority = yield* validateMutationAuthority(mapping, configuration, input, action);
-		if (authority === void 0) return prepare("rejected", journal);
-		if ((yield* commandExists(mapping, input.moduleId, input.commandId, true)).length) return prepare("rejected", journal);
-		if (!(yield* currentExpectedCredential(mapping, input, authority.nativeSubjectId))) return prepare("rejected", journal);
-		const prepared = prepare("changed", journal);
-		if (!(yield* writeReplacement(mapping, input, authority.nativeSubjectId, revisions, authority.now))) return yield* unavailable();
-		yield* registerReplacement(mapping, input, authority.nativeSubjectId, revisions, authority.now);
-		return prepared;
-	});
-	return {
-		makeSqlPasswordPersistence,
-		passwordSqlKernel: {
-			allocate,
-			allocateNextSecurityRevision,
-			owned,
-			safeRead,
-			snapshotMutationInput,
-			lockSubject,
-			lockIdentifier,
-			readPasswordCredential,
-			resolveCredential,
-			validateMutationAuthority,
-			currentExpectedCredential,
-			commandExists,
-			addPasswordIn,
-			checkMutationApplied,
-			writeReplacement,
-			evidenceSatisfiedAt,
-			sameCredentialSnapshot: samePasswordCredentialSnapshot,
-			subjectColumns,
-			identifierColumns,
-			credentialColumns,
-			authorityCredentialColumns,
-			proofCompletionMatchesPassword
-		}
-	};
-};
-//#endregion
-export { CurrentPasswordSql, makePasswordKernel };
-
-//# sourceMappingURL=password-kernel.mjs.map