@yielded/auth-persistence-drizzle 0.1.0-beta.25 → 0.1.0-beta.27

package/dist/drizzle/d1-sessions.mjs

@@ -1,987 +0,0 @@
-import { PersistenceMappingError as PersistenceMappingError$1, column, isMappedConstraintConflict, updateValues } from "./model.mjs";
-import { compactD1GeneratedStatement } from "./d1-generated-statement.mjs";
-import { validateDrizzleStorage } from "./storage-validation.mjs";
-import { Database } from "./d1-database.mjs";
-import { D1BatchStatements } from "./D1BatchStatements.mjs";
-import { CurrentD1PlanningDatabase, makeD1Owner } from "./d1-planning.mjs";
-import { nativeDatabase } from "./native-database.mjs";
-import { NativeDatabase, decodeStepUpIntent, encodeStepUpIntent, stepUpIntentLive, validateStepUpPlan } from "@yielded/auth-persistence/Adapter";
-import { and, eq, getTableColumns, gt, inArray, not, or, sql } from "drizzle-orm";
-import { Cause, Context, Data, DateTime, Effect, Schema } from "effect";
-import { CurrentCommitJournal, LifecycleHooks, coordinateCommit, hasCommitScope } from "@yielded/auth/Hooks";
-import { AuthenticationAuthority, AuthenticationCapture, PendingAuthenticationInvalid, SessionConflict, SessionInvalid, SessionMetadata, SessionStepUpInvalid, SessionUnavailable, StaleAuthentication, assessAuthentication, pendingAuthenticationContext, snapshotPendingAuthenticationContext, snapshotSessionAuthenticationProvenance } from "@yielded/auth/Sessions";
-import { reportPersistenceFailure } from "@yielded/auth/Persistence";
-//#region src/drizzle/d1-sessions.ts
-var CurrentD1SessionBatch = class extends Context.Service()("effect-auth/drizzle/CurrentD1SessionBatch") {};
-var D1BatchFailure = class extends Data.TaggedError("D1BatchFailure") {};
-const unavailable = () => SessionUnavailable.make({});
-const stale = () => StaleAuthentication.make({});
-const invalidPending = () => PendingAuthenticationInvalid.make({});
-const invalidSession = () => SessionInvalid.make({});
-const mapFailureCause = (effect, map) => Effect.catchCause(effect, (cause) => Effect.failCause(Cause.map(cause, map)));
-const isD1DomainError = (error) => {
-	const tag = typeof error === "object" && error !== null ? Reflect.get(error, "_tag") : void 0;
-	return tag === "SessionStepUpInvalid" || tag === "PendingAuthenticationInvalid" || tag === "SessionConflict" || tag === "SessionInvalid" || tag === "SessionUnavailable" || tag === "StaleAuthentication";
-};
-const normalizeD1Failure = (effect, isExpected) => reportPersistenceFailure(effect, isExpected).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, (error) => isD1DomainError(error) ? error : unavailable()))));
-const terminalD1 = (effect) => normalizeD1Failure(effect, isD1DomainError);
-const containsFailure = (failure, predicate) => {
-	const seen = /* @__PURE__ */ new Set();
-	const pending = [failure];
-	for (let inspected = 0; inspected < 24 && pending.length > 0; inspected++) {
-		const current = pending.shift();
-		if (current === void 0 || current === null || seen.has(current)) continue;
-		seen.add(current);
-		if (predicate(current)) return true;
-		if (Cause.isCause(current)) {
-			for (const reason of current.reasons) if (Cause.isFailReason(reason)) pending.push(reason.error);
-			else if (Cause.isDieReason(reason)) pending.push(reason.defect);
-			continue;
-		}
-		if (typeof current !== "object") continue;
-		const wrapped = current;
-		if (wrapped.cause !== void 0) pending.push(wrapped.cause);
-		if (wrapped.reason !== void 0) pending.push(wrapped.reason);
-		if (wrapped.message !== void 0) pending.push(wrapped.message);
-	}
-	return false;
-};
-const isGuardFailure = (failure) => containsFailure(failure, (value) => typeof value === "string" && value.includes("effect-auth-session-guard"));
-const recoverBatchFailure = (failure) => {
-	const { cause, mutation } = failure;
-	const onlyFailures = cause.reasons.length > 0 && cause.reasons.every(Cause.isFailReason);
-	if (mutation === void 0) return Effect.failCause(cause);
-	if (onlyFailures && mutation.isConstraintConflict !== void 0 && cause.reasons.every((reason) => Cause.isFailReason(reason) && isMappedConstraintConflict(mutation.isConstraintConflict, reason.error))) return Effect.fail(SessionConflict.make({}));
-	if (onlyFailures && mutation.recoverGuard !== void 0 && cause.reasons.every((reason) => Cause.isFailReason(reason) && isGuardFailure(reason.error))) return mutation.recoverGuard;
-	return Effect.failCause(cause);
-};
-const splitD1BatchFailure = (cause) => {
-	const marker = cause.reasons.find((reason) => Cause.isFailReason(reason) && reason.error instanceof D1BatchFailure);
-	if (marker === void 0 || !Cause.isFailReason(marker)) return void 0;
-	const remaining = Cause.fromReasons(cause.reasons.filter((reason) => reason !== marker));
-	return {
-		failure: marker.error,
-		remaining
-	};
-};
-const recoverD1BatchCause = (cause) => {
-	const split = splitD1BatchFailure(cause);
-	if (split === void 0) return Effect.failCause(cause);
-	return recoverBatchFailure(split.failure).pipe(Effect.catchCause((recovered) => Effect.failCause(Cause.combine(recovered, split.remaining))));
-};
-const recoverCoordinatedD1BatchCause = (cause) => {
-	const split = splitD1BatchFailure(cause);
-	if (split === void 0) return Effect.failCause(cause);
-	return terminalD1(recoverBatchFailure(split.failure)).pipe(Effect.catchCause((recovered) => Effect.failCause(Cause.combine(recovered, split.remaining))));
-};
-const statement = (query) => Effect.map(CurrentD1PlanningDatabase, (database) => {
-	const rendered = query.toSQL();
-	return compactD1GeneratedStatement(database.$client, database.$client.unsafe(rendered.sql, rendered.params), unavailable);
-});
-const assertion = (condition) => Effect.gen(function* () {
-	const database = yield* CurrentD1PlanningDatabase;
-	return yield* statement(database.select({ ok: sql`case when ${condition} then 1 else json_extract('[]', '$[effect-auth-session-guard]') end`.as("ok") }).from(sql`(select 1)`));
-});
-const conditionMatches = (condition) => Effect.flatMap(CurrentD1PlanningDatabase, (database) => database.select({ ok: sql`1` }).from(sql`(select 1)`).where(condition).limit(1).pipe(Effect.map((rows) => rows.length > 0)));
-function runPlanned(plan, isConstraintConflict, recoverGuard) {
-	const planned = plan.pipe(Effect.map((value) => ({
-		...value,
-		...isConstraintConflict === void 0 ? {} : { isConstraintConflict },
-		...recoverGuard === void 0 ? {} : { recoverGuard }
-	})));
-	const execution = Effect.gen(function* () {
-		const batch = yield* Effect.serviceOption(CurrentD1SessionBatch);
-		if (batch._tag === "Some") {
-			const owned = batch.value;
-			return (yield* coordinateCommit(() => Effect.gen(function* () {
-				yield* owned.owner.check;
-				const journal = yield* CurrentCommitJournal;
-				const value = yield* planned;
-				yield* owned.owner.check;
-				const guarded = {
-					...value,
-					journalGuard: journal.prepare(void 0)
-				};
-				yield* owned.append(guarded);
-				return guarded.receipt;
-			}), { mode: "batch" })).value;
-		}
-		const database = yield* CurrentD1PlanningDatabase;
-		return (yield* coordinateCommit(() => Effect.gen(function* () {
-			const prepared = yield* planned;
-			yield* database.$client.batch(prepared.statements).pipe(Effect.catchCause((cause) => Effect.fail(new D1BatchFailure({
-				cause,
-				mutation: prepared
-			}))));
-			return prepared.receipt;
-		}), { mode: "batch" })).value;
-	});
-	return normalizeD1Failure(execution.pipe(Effect.catchCause(recoverD1BatchCause)), isD1DomainError);
-}
-const subjectColumns = (mapping) => ({
-	id: column(mapping.subject.table, mapping.subject.id),
-	status: column(mapping.subject.table, mapping.subject.status),
-	revision: column(mapping.subject.table, mapping.subject.securityRevision)
-});
-const credentialColumns = (mapping) => ({
-	subjectId: column(mapping.credential.table, mapping.credential.subjectId),
-	id: column(mapping.credential.table, mapping.credential.credentialId),
-	revision: column(mapping.credential.table, mapping.credential.revision),
-	...mapping.credential.status === void 0 ? {} : { status: column(mapping.credential.table, mapping.credential.status) }
-});
-const flowColumns = (mapping) => ({
-	flowId: column(mapping.flow.table, mapping.flow.flowId),
-	subjectId: column(mapping.flow.table, mapping.flow.subjectId),
-	state: column(mapping.flow.table, mapping.flow.state),
-	pendingDigest: column(mapping.flow.table, mapping.flow.pendingDigest),
-	dedupUntil: column(mapping.flow.table, mapping.flow.dedupUntil)
-});
-const hasActiveFlow = Effect.fn("D1Session.hasActiveFlow")(function* (mapping, flowId) {
-	const database = yield* CurrentD1PlanningDatabase;
-	const f = flowColumns(mapping);
-	return yield* database.select({ flowId: f.flowId }).from(mapping.flow.table).where(and(eq(f.flowId, flowId), gt(f.dedupUntil, mapping.d1.engineNow))).limit(1).pipe(Effect.map((rows) => rows.length > 0));
-});
-const recoverFlowOrStale = (mapping, flowId) => hasActiveFlow(mapping, flowId).pipe(Effect.flatMap((active) => Effect.fail(active ? SessionConflict.make({}) : StaleAuthentication.make({}))));
-const pendingColumns = (mapping) => ({
-	digest: column(mapping.pending.table, mapping.pending.digest),
-	version: column(mapping.pending.table, mapping.pending.version),
-	flowId: column(mapping.pending.table, mapping.pending.flowId),
-	subjectId: column(mapping.pending.table, mapping.pending.subjectId),
-	bindingDigest: column(mapping.pending.table, mapping.pending.bindingDigest),
-	expiresAt: column(mapping.pending.table, mapping.pending.expiresAt),
-	attemptLimit: column(mapping.pending.table, mapping.pending.attemptLimit),
-	failedAttempts: column(mapping.pending.table, mapping.pending.failedAttempts),
-	consumed: column(mapping.pending.table, mapping.pending.consumed)
-});
-const sessionColumns = (mapping) => ({
-	sessionId: column(mapping.session.table, mapping.session.sessionId),
-	subjectId: column(mapping.session.table, mapping.session.subjectId),
-	digest: column(mapping.session.table, mapping.session.digest),
-	version: column(mapping.session.table, mapping.session.version),
-	securityRevision: column(mapping.session.table, mapping.session.securityRevision),
-	issuedAt: column(mapping.session.table, mapping.session.issuedAt),
-	expiresAt: column(mapping.session.table, mapping.session.expiresAt),
-	absoluteExpiresAt: column(mapping.session.table, mapping.session.absoluteExpiresAt)
-});
-const captureDetails = Effect.fn("DrizzleD1Session.captureDetails")(function* (mapping, subjectId, credentialIds) {
-	const database = yield* CurrentD1PlanningDatabase;
-	const requested = [...new Set(credentialIds)].sort();
-	if (requested.length !== credentialIds.length) return yield* stale();
-	const nativeSubjectId = yield* mapping.subjectId.toNative(subjectId);
-	const sc = subjectColumns(mapping);
-	const cc = credentialColumns(mapping);
-	const rows = yield* requested.length === 0 ? database.select({ subject: getTableColumns(mapping.subject.table) }).from(mapping.subject.table).where(eq(sc.id, nativeSubjectId)).limit(1).pipe(Effect.map((selected) => selected.map((row) => ({
-		subject: row.subject,
-		credential: void 0
-	})))) : database.select({
-		subject: getTableColumns(mapping.subject.table),
-		credential: getTableColumns(mapping.credential.table)
-	}).from(mapping.subject.table).innerJoin(mapping.credential.table, and(eq(cc.subjectId, sc.id), inArray(cc.id, requested))).where(eq(sc.id, nativeSubjectId));
-	const subject = rows[0]?.subject;
-	if (subject === void 0 || !mapping.subject.isActiveStatus(subject[mapping.subject.status])) return yield* stale();
-	const credentials = rows.flatMap((row) => row.credential === void 0 || row.credential === null ? [] : [row.credential]);
-	if (credentials.length !== requested.length || credentials.some((row) => mapping.credential.status !== void 0 && mapping.credential.isActiveStatus?.(row[mapping.credential.status]) !== true)) return yield* stale();
-	return {
-		subject,
-		revision: {
-			subjectId,
-			securityRevision: subject[mapping.subject.securityRevision],
-			credentials: credentials.map((row) => ({
-				credentialId: row[mapping.credential.credentialId],
-				revision: row[mapping.credential.revision]
-			})).sort((a, b) => a.credentialId.localeCompare(b.credentialId))
-		}
-	};
-});
-const capture = Effect.fn("DrizzleD1Session.capture")(function* (mapping, subjectId, credentialIds) {
-	const details = yield* captureDetails(mapping, subjectId, credentialIds);
-	const requirement = yield* mapping.subject.decodeRequirement(details.subject);
-	return yield* Schema.decodeEffect(AuthenticationCapture)({
-		revision: details.revision,
-		requirement
-	});
-});
-const requirement = Effect.fn("DrizzleD1Session.requirement")(function* (mapping, evidence) {
-	const current = yield* captureDetails(mapping, evidence.revision.subjectId, evidence.revision.credentials.map((item) => item.credentialId));
-	const expected = new Map(evidence.revision.credentials.map((item) => [item.credentialId, item.revision]));
-	if (current.revision.securityRevision !== evidence.revision.securityRevision || current.revision.credentials.some((item) => expected.get(item.credentialId) !== item.revision)) return yield* stale();
-	return yield* mapping.subject.decodeRequirement(current.subject);
-});
-const authorityCondition = (mapping, nativeSubjectId, evidence) => {
-	const sc = subjectColumns(mapping);
-	const cc = credentialColumns(mapping);
-	const subject = sql`exists(select 1 from ${mapping.subject.table} where ${sc.id} = ${sql.param(nativeSubjectId, sc.id)} and ${sc.status} = ${sql.param(mapping.d1.activeSubjectStatusValue, sc.status)} and ${sc.revision} = ${sql.param(evidence.revision.securityRevision, sc.revision)})`;
-	const credentials = evidence.revision.credentials.map((item) => sql`exists(select 1 from ${mapping.credential.table} where ${cc.subjectId} = ${sql.param(nativeSubjectId, cc.subjectId)} and ${cc.id} = ${sql.param(item.credentialId, cc.id)} and ${cc.revision} = ${sql.param(item.revision, cc.revision)}${mapping.credential.status === void 0 ? sql`` : sql` and ${cc.status} = ${sql.param(mapping.d1.activeCredentialStatusValue, cc.status)}`})`);
-	return and(subject, ...credentials);
-};
-const subjectRevisionCondition = (mapping, nativeSubjectId, revision) => {
-	const sc = subjectColumns(mapping);
-	return sql`exists(select 1 from ${mapping.subject.table} where ${sc.id} = ${sql.param(nativeSubjectId, sc.id)} and ${sc.status} = ${sql.param(mapping.d1.activeSubjectStatusValue, sc.status)} and ${sc.revision} = ${sql.param(revision, sc.revision)})`;
-};
-/** Engine-time counterpart of assessAuthentication. Complete transitions must
-* satisfy an entire alternative; incomplete pending flows need one eligible proof. */
-const freshnessCondition = (mapping, evidence, requirement, complete) => {
-	const fresh = evidence.proofs.map((proof) => {
-		const verified = DateTime.toEpochMillis(proof.verifiedAt);
-		return and(sql`${mapping.d1.engineNowMillis} >= ${verified}`, sql`${mapping.d1.engineNowMillis} - ${verified} < ${requirement.maximumAgeMillis}`);
-	});
-	const any = (conditions) => conditions.length === 0 ? sql`false` : or(...conditions);
-	const notFuture = evidence.proofs.map((proof) => sql`${mapping.d1.engineNowMillis} >= ${DateTime.toEpochMillis(proof.verifiedAt)}`);
-	if (!complete) return and(...notFuture, any(fresh));
-	const byCredential = /* @__PURE__ */ new Map();
-	evidence.proofs.forEach((proof, index) => {
-		const previous = byCredential.get(proof.credentialId) ?? [];
-		previous.push(fresh[index]);
-		byCredential.set(proof.credentialId, previous);
-	});
-	const credentialCount = sql.join([...byCredential.values()].map((proofs) => sql`case when ${any(proofs)} then 1 else 0 end`), sql` + `);
-	const alternatives = requirement.alternatives.map((alternative) => and(...alternative.factors.map((factor) => any(fresh.filter((_, index) => evidence.proofs[index].factors.includes(factor)))), sql`(${credentialCount}) >= ${alternative.minimumCredentials}`, any(fresh.filter((_, index) => (!alternative.userVerified || evidence.proofs[index].userVerified) && (!alternative.phishingResistant || evidence.proofs[index].phishingResistant)))));
-	return and(...notFuture, any(alternatives));
-};
-const allocate = (asynchronous, synchronous) => asynchronous !== void 0 ? asynchronous : synchronous === void 0 ? Effect.fail(unavailable()) : Effect.try({
-	try: synchronous,
-	catch: (cause) => PersistenceMappingError$1.make({
-		operation: "allocate",
-		cause
-	})
-});
-const sameOriginalRevision = (completed, original) => {
-	const current = new Map(completed.revision.credentials.map((item) => [item.credentialId, item.revision]));
-	return completed.flowId === original.flowId && completed.bindingDigest === original.bindingDigest && completed.revision.subjectId === original.revision.subjectId && completed.revision.securityRevision === original.revision.securityRevision && original.revision.credentials.every((item) => current.get(item.credentialId) === item.revision) && original.proofs.every((expected) => completed.proofs.some((proof) => proof.method === expected.method && proof.credentialId === expected.credentialId && proof.userVerified === expected.userVerified && proof.phishingResistant === expected.phishingResistant && DateTime.toEpochMillis(proof.verifiedAt) === DateTime.toEpochMillis(expected.verifiedAt) && proof.factors.length === expected.factors.length && proof.factors.every((factor, index) => factor === expected.factors[index])));
-};
-const readPendingWith = Effect.fn("D1Session.readPendingWith")(function* (mapping, digest, projection) {
-	const row = (yield* (yield* CurrentD1PlanningDatabase).select().from(mapping.pending.table).where(eq(pendingColumns(mapping).digest, digest)).limit(1))[0];
-	if (row === void 0) return void 0;
-	return yield* (projection === "context" ? mapping.pending.decodeContext : mapping.pending.decode)(row);
-});
-const readPending = (mapping, digest) => readPendingWith(mapping, digest, "record");
-const pendingCondition = (mapping, input, nativeSubjectId) => {
-	const p = pendingColumns(mapping);
-	const f = flowColumns(mapping);
-	return and(sql`exists(select 1 from ${mapping.pending.table} where ${p.digest} = ${sql.param(input.digest, p.digest)} and ${p.version} = ${sql.param(input.version, p.version)} and ${p.flowId} = ${sql.param(input.flowId, p.flowId)} and ${p.subjectId} = ${sql.param(nativeSubjectId, p.subjectId)} and ${p.bindingDigest} = ${sql.param(input.bindingDigest, p.bindingDigest)} and ${p.consumed} = ${sql.param(false, p.consumed)} and ${p.failedAttempts} < ${p.attemptLimit} and ${p.expiresAt} > ${mapping.d1.engineNow})`, sql`exists(select 1 from ${mapping.flow.table} where ${f.flowId} = ${sql.param(input.flowId, f.flowId)} and ${f.subjectId} = ${sql.param(nativeSubjectId, f.subjectId)} and ${f.state} = ${sql.param(mapping.flow.pendingStateValue, f.state)} and ${f.pendingDigest} = ${sql.param(input.digest, f.pendingDigest)} and ${f.dedupUntil} > ${mapping.d1.engineNow})`);
-};
-const recoverPendingOrStale = (mapping, input, subjectId) => mapping.subjectId.toNative(subjectId).pipe(Effect.flatMap((nativeSubjectId) => conditionMatches(pendingCondition(mapping, input, nativeSubjectId))), Effect.flatMap((pendingIsCurrent) => Effect.fail(pendingIsCurrent ? StaleAuthentication.make({}) : PendingAuthenticationInvalid.make({}))));
-const consumePendingStatements = Effect.fn("D1Session.consumePendingStatements")(function* (mapping, input, absoluteExpiresAt) {
-	const database = yield* CurrentD1PlanningDatabase;
-	return [yield* statement(database.update(mapping.pending.table).set(updateValues([[mapping.pending.consumed, true]])).where(and(eq(pendingColumns(mapping).digest, input.digest), eq(pendingColumns(mapping).version, input.version)))), yield* statement(database.update(mapping.flow.table).set(updateValues([
-		[mapping.flow.state, mapping.flow.establishedStateValue],
-		[mapping.flow.pendingDigest, null],
-		[mapping.flow.dedupUntil, mapping.flow.encodeInstant(absoluteExpiresAt)]
-	])).where(eq(flowColumns(mapping).flowId, input.flowId)))];
-});
-const makeD1AuthenticationAuthority = (mapping) => ({
-	capture: (subjectId, credentialIds) => capture(mapping, subjectId, credentialIds).pipe(terminalD1),
-	requirements: (evidence) => requirement(mapping, evidence).pipe(terminalD1),
-	approve: (input, prepare) => runPlanned(Effect.gen(function* () {
-		const journal = yield* CurrentCommitJournal;
-		const policy = yield* requirement(mapping, input.evidence);
-		if (!(yield* assessAuthentication(input.evidence, policy)).satisfied) return yield* stale();
-		const nativeSubjectId = yield* mapping.subjectId.toNative(input.evidence.revision.subjectId);
-		let condition = and(authorityCondition(mapping, nativeSubjectId, input.evidence), freshnessCondition(mapping, input.evidence, policy, true), sql`${mapping.d1.engineNowMillis} < ${DateTime.toEpochMillis(input.expiresAt)}`, sql`${DateTime.toEpochMillis(input.expiresAt)} <= ${DateTime.toEpochMillis(input.absoluteExpiresAt)}`);
-		const statements = [];
-		if (input.pending !== void 0) {
-			if (mapping.pending === void 0) return yield* invalidPending();
-			const pendingMapping = {
-				...mapping,
-				...mapping.pending
-			};
-			const stored = yield* readPending(pendingMapping, input.pending.digest);
-			if (stored === void 0 || !sameOriginalRevision(input.evidence, stored.evidence)) return yield* invalidPending();
-			condition = and(condition, pendingCondition(pendingMapping, input.pending, nativeSubjectId));
-			statements.push(...yield* consumePendingStatements(pendingMapping, input.pending, input.absoluteExpiresAt));
-		}
-		return {
-			receipt: prepare(void 0, journal),
-			statements: [yield* assertion(condition), ...statements]
-		};
-	}), void 0, Effect.suspend(() => input.pending === void 0 || mapping.pending === void 0 ? Effect.fail(stale()) : recoverPendingOrStale({
-		...mapping,
-		...mapping.pending
-	}, input.pending, input.evidence.revision.subjectId)))
-});
-/** D1's last authoritative statement checks the original record version and
-* security state together. A later race is still rejected by final consumption. */
-const readAuthenticatedPending = Effect.fn("D1Session.readAuthenticatedPending")(function* (mapping, input, projection) {
-	const record = yield* readPendingWith(mapping, input.digest, projection);
-	if (record === void 0 || input.bindingDigest !== void 0 && record.evidence.bindingDigest !== input.bindingDigest) return yield* invalidPending();
-	const policy = yield* mapFailureCause(requirement(mapping, record.evidence), (error) => error._tag === "StaleAuthentication" ? invalidPending() : error);
-	yield* assessAuthentication(record.evidence, policy).pipe(Effect.mapError(() => invalidPending()));
-	const nativeSubjectId = yield* mapping.subjectId.toNative(record.evidence.revision.subjectId);
-	if (!(yield* conditionMatches(and(authorityCondition(mapping, nativeSubjectId, record.evidence), freshnessCondition(mapping, record.evidence, policy, false), pendingCondition(mapping, {
-		digest: input.digest,
-		bindingDigest: record.evidence.bindingDigest,
-		flowId: record.evidence.flowId,
-		version: record.version
-	}, nativeSubjectId))))) return yield* invalidPending();
-	return record;
-});
-const makeD1PendingAuthentication = (mapping) => ({
-	create: (input, _now, prepare) => runPlanned(Effect.gen(function* () {
-		const database = yield* CurrentD1PlanningDatabase;
-		const journal = yield* CurrentCommitJournal;
-		const policy = yield* requirement(mapping, input.evidence);
-		yield* assessAuthentication(input.evidence, policy);
-		const nativeSubjectId = yield* mapping.subjectId.toNative(input.evidence.revision.subjectId);
-		if (yield* hasActiveFlow(mapping, input.evidence.flowId)) return yield* SessionConflict.make({});
-		const version = yield* allocate(mapping.pending.allocateVersion, mapping.pending.allocateVersionSync);
-		const record = {
-			...input,
-			version
-		};
-		const f = flowColumns(mapping);
-		const condition = and(authorityCondition(mapping, nativeSubjectId, input.evidence), freshnessCondition(mapping, input.evidence, policy, false), sql`${mapping.d1.engineNowMillis} < ${DateTime.toEpochMillis(input.expiresAt)}`, not(sql`exists(select 1 from ${mapping.flow.table} where ${f.flowId} = ${sql.param(input.evidence.flowId, f.flowId)} and ${f.dedupUntil} > ${mapping.d1.engineNow})`));
-		const cleanupPending = database.delete(mapping.pending.table).where(sql`${pendingColumns(mapping).flowId} in (select ${f.flowId} from ${mapping.flow.table} where ${f.flowId} = ${sql.param(input.evidence.flowId, f.flowId)} and ${f.dedupUntil} <= ${mapping.d1.engineNow})`);
-		const cleanupFlow = database.delete(mapping.flow.table).where(and(eq(f.flowId, input.evidence.flowId), sql`${f.dedupUntil} <= ${mapping.d1.engineNow}`));
-		const insertFlow = database.insert(mapping.flow.table).values(mapping.flow.encodePendingInsert({
-			evidence: input.evidence,
-			subjectId: nativeSubjectId,
-			pendingDigest: input.digest,
-			dedupUntil: input.expiresAt
-		}));
-		const insertPending = database.insert(mapping.pending.table).values(mapping.pending.encodeInsert(record, {
-			subjectId: nativeSubjectId,
-			failedAttempts: 0,
-			consumed: false
-		}));
-		return {
-			receipt: prepare(record, journal),
-			statements: [
-				yield* assertion(condition),
-				yield* statement(cleanupPending),
-				yield* statement(cleanupFlow),
-				yield* statement(insertFlow),
-				yield* statement(insertPending)
-			]
-		};
-	}), mapping.isConstraintConflict, recoverFlowOrStale(mapping, input.evidence.flowId)),
-	context: (input) => readAuthenticatedPending(mapping, input, "context").pipe(Effect.flatMap(pendingAuthenticationContext), terminalD1),
-	read: (input) => readAuthenticatedPending(mapping, input, "record").pipe(terminalD1),
-	reject: (input, prepare) => runPlanned(Effect.gen(function* () {
-		const database = yield* CurrentD1PlanningDatabase;
-		const journal = yield* CurrentCommitJournal;
-		const record = yield* readPendingWith(mapping, input.digest, "context");
-		if (record === void 0) return {
-			receipt: prepare({ _tag: "Rejected" }, journal),
-			statements: [yield* assertion(sql`true`)]
-		};
-		const nativeSubjectId = yield* mapping.subjectId.toNative(record.evidence.revision.subjectId);
-		const p = pendingColumns(mapping);
-		const condition = and(authorityCondition(mapping, nativeSubjectId, record.evidence), eq(p.digest, input.digest), eq(p.bindingDigest, input.bindingDigest), eq(p.consumed, false), gt(p.expiresAt, mapping.d1.engineNow));
-		const update = database.update(mapping.pending.table).set(updateValues([[mapping.pending.failedAttempts, sql`case when ${p.failedAttempts} < ${p.attemptLimit} then ${p.failedAttempts} + 1 else ${p.failedAttempts} end`]])).where(condition);
-		return {
-			receipt: prepare({ _tag: "Rejected" }, journal),
-			statements: [yield* statement(update)]
-		};
-	}))
-});
-const makeD1StatefulSessions = (mapping) => {
-	const s = sessionColumns(mapping);
-	return {
-		persistence: {
-			establish: (input, prepare) => runPlanned(Effect.gen(function* () {
-				const database = yield* CurrentD1PlanningDatabase;
-				const journal = yield* CurrentCommitJournal;
-				const policy = yield* requirement(mapping, input.evidence);
-				const assessed = yield* assessAuthentication(input.evidence, policy);
-				if (!assessed.satisfied) return yield* stale();
-				const nativeSubjectId = yield* mapping.subjectId.toNative(input.evidence.revision.subjectId);
-				if (input.pending === void 0 && (input.fresh !== true || input.handoffSourceSessionId !== void 0) && (yield* hasActiveFlow(mapping, input.evidence.flowId))) return yield* SessionConflict.make({});
-				const nativeSessionId = yield* allocate(mapping.session.allocateId, mapping.session.allocateIdSync);
-				const sessionId = yield* mapping.sessionId.toSession(nativeSessionId);
-				if (sessionId === input.handoffSourceSessionId) return yield* SessionConflict.make({});
-				const version = yield* allocate(mapping.session.allocateVersion, mapping.session.allocateVersionSync);
-				const record = {
-					...input.session,
-					sessionId,
-					version,
-					subjectId: input.evidence.revision.subjectId,
-					securityRevision: input.evidence.revision.securityRevision,
-					assurance: input.handoffSourceSessionId === void 0 ? assessed.assurance : input.session.assurance,
-					provenance: yield* snapshotSessionAuthenticationProvenance({ evidence: input.evidence }),
-					issuedAt: DateTime.makeUnsafe(DateTime.toEpochMillis(input.session.issuedAt))
-				};
-				const commitCondition = and(authorityCondition(mapping, nativeSubjectId, input.evidence), freshnessCondition(mapping, input.evidence, policy, true), sql`${DateTime.toEpochMillis(record.issuedAt)} <= ${mapping.d1.engineNowMillis}`, sql`${mapping.d1.engineNowMillis} < ${DateTime.toEpochMillis(record.expiresAt)}`, sql`${DateTime.toEpochMillis(record.expiresAt)} <= ${DateTime.toEpochMillis(record.absoluteExpiresAt)}`);
-				let condition = commitCondition;
-				const statements = [];
-				if (input.pending === void 0 && (input.fresh !== true || input.handoffSourceSessionId !== void 0)) {
-					const f = flowColumns(mapping);
-					condition = and(condition, not(sql`exists(select 1 from ${mapping.flow.table} where ${f.flowId} = ${sql.param(input.evidence.flowId, f.flowId)} and ${f.dedupUntil} > ${mapping.d1.engineNow})`));
-					if (mapping.pending !== void 0) statements.push(yield* statement(database.delete(mapping.pending.table).where(eq(column(mapping.pending.table, mapping.pending.flowId), input.evidence.flowId))));
-					statements.push(yield* statement(database.delete(mapping.flow.table).where(eq(f.flowId, input.evidence.flowId))), yield* statement(database.insert(mapping.flow.table).values(mapping.flow.encodeEstablishedInsert({
-						evidence: input.evidence,
-						subjectId: nativeSubjectId,
-						dedupUntil: record.absoluteExpiresAt
-					}))));
-				} else if (input.pending !== void 0) {
-					if (mapping.pending === void 0) return yield* invalidPending();
-					const stored = yield* readPending(mapping, input.pending.digest);
-					if (stored === void 0 || !sameOriginalRevision(input.evidence, stored.evidence)) return yield* invalidPending();
-					condition = and(condition, pendingCondition(mapping, input.pending, nativeSubjectId));
-					statements.push(...yield* consumePendingStatements(mapping, input.pending, record.absoluteExpiresAt));
-				}
-				statements.push(yield* statement(database.insert(mapping.session.table).values(mapping.session.encodeInsert(record, {
-					subjectId: nativeSubjectId,
-					sessionId: nativeSessionId
-				}))), yield* assertion(commitCondition));
-				return {
-					receipt: prepare(record, journal),
-					statements: [yield* assertion(condition), ...statements]
-				};
-			}), mapping.isConstraintConflict, Effect.suspend(() => input.pending === void 0 ? input.fresh === true && input.handoffSourceSessionId === void 0 ? Effect.fail(stale()) : recoverFlowOrStale(mapping, input.evidence.flowId) : recoverPendingOrStale(mapping, input.pending, input.evidence.revision.subjectId))),
-			verify: (input) => Effect.gen(function* () {
-				const rows = yield* (yield* CurrentD1PlanningDatabase).select({ ...getTableColumns(mapping.session.table) }).from(mapping.session.table).innerJoin(mapping.subject.table, and(eq(s.subjectId, subjectColumns(mapping).id), eq(s.securityRevision, subjectColumns(mapping).revision), eq(subjectColumns(mapping).status, mapping.d1.activeSubjectStatusValue))).where(and(eq(s.digest, input.digest), gt(s.expiresAt, mapping.d1.engineNow), gt(s.absoluteExpiresAt, mapping.d1.engineNow))).limit(1);
-				if (rows[0] === void 0) return yield* invalidSession();
-				return yield* mapping.session.decode(rows[0]);
-			}).pipe(terminalD1),
-			rotate: (input, prepare) => runPlanned(Effect.gen(function* () {
-				const database = yield* CurrentD1PlanningDatabase;
-				const journal = yield* CurrentCommitJournal;
-				const nativeSessionId = yield* mapping.sessionId.toNative(input.sessionId);
-				const row = (yield* database.select().from(mapping.session.table).where(eq(s.sessionId, nativeSessionId)).limit(1))[0];
-				if (row === void 0) return yield* SessionConflict.make({});
-				const current = yield* mapping.session.decode(row);
-				const nativeSubjectId = yield* mapping.subjectId.toNative(current.subjectId);
-				const version = yield* allocate(mapping.session.allocateVersion, mapping.session.allocateVersionSync);
-				const next = {
-					...current,
-					digest: input.nextDigest,
-					credentialVersion: input.nextCredentialVersion,
-					version,
-					issuedAt: DateTime.makeUnsafe(DateTime.toEpochMillis(input.now)),
-					expiresAt: input.nextExpiresAt
-				};
-				const sessionCondition = and(eq(s.sessionId, nativeSessionId), eq(s.digest, input.expectedDigest), eq(s.version, input.expectedVersion), eq(s.securityRevision, input.expectedSecurityRevision), gt(s.expiresAt, mapping.d1.engineNow), gt(s.absoluteExpiresAt, mapping.d1.engineNow));
-				const timeCondition = and(sql`${DateTime.toEpochMillis(next.issuedAt)} <= ${mapping.d1.engineNowMillis}`, sql`${mapping.d1.engineNowMillis} < ${DateTime.toEpochMillis(input.nextExpiresAt)}`, sql`${DateTime.toEpochMillis(input.nextExpiresAt)} <= ${DateTime.toEpochMillis(current.absoluteExpiresAt)}`);
-				const authority = subjectRevisionCondition(mapping, nativeSubjectId, input.expectedSecurityRevision);
-				const assertionCondition = and(authority, sql`exists(select 1 from ${mapping.session.table} where ${sessionCondition})`, timeCondition);
-				const update = database.update(mapping.session.table).set(mapping.session.encodeRotation(next)).where(and(authority, sessionCondition, timeCondition));
-				return {
-					receipt: prepare(next, journal),
-					statements: [yield* assertion(assertionCondition), yield* statement(update)]
-				};
-			}), void 0, Effect.fail(SessionConflict.make({}))),
-			revokeDigest: (digest, prepare) => runPlanned(Effect.gen(function* () {
-				const database = yield* CurrentD1PlanningDatabase;
-				const journal = yield* CurrentCommitJournal;
-				const row = (yield* database.select().from(mapping.session.table).where(eq(s.digest, digest)).limit(1))[0];
-				const statements = row === void 0 ? [yield* assertion(sql`true`)] : [yield* statement(database.delete(mapping.session.table).where(eq(s.digest, digest)))];
-				return {
-					receipt: prepare(row !== void 0, journal),
-					statements
-				};
-			})),
-			revoke: (input, prepare) => runPlanned(Effect.gen(function* () {
-				const database = yield* CurrentD1PlanningDatabase;
-				const journal = yield* CurrentCommitJournal;
-				const nativeSubjectId = yield* mapping.subjectId.toNative(input.subjectId);
-				const nativeSessionId = yield* mapping.sessionId.toNative(input.sessionId);
-				const condition = subjectRevisionCondition(mapping, nativeSubjectId, input.expectedSecurityRevision);
-				const remove = database.delete(mapping.session.table).where(and(eq(s.subjectId, nativeSubjectId), eq(s.sessionId, nativeSessionId)));
-				return {
-					receipt: prepare(void 0, journal),
-					statements: [yield* assertion(condition), yield* statement(remove)]
-				};
-			}), void 0, Effect.fail(stale())),
-			revokeAll: (input, prepare) => runPlanned(Effect.gen(function* () {
-				const database = yield* CurrentD1PlanningDatabase;
-				const journal = yield* CurrentCommitJournal;
-				const nativeSubjectId = yield* mapping.subjectId.toNative(input.subjectId);
-				const next = yield* allocate(mapping.subject.nextSecurityRevision?.(input.expectedSecurityRevision), mapping.subject.nextSecurityRevisionSync === void 0 ? void 0 : () => mapping.subject.nextSecurityRevisionSync(input.expectedSecurityRevision));
-				const sc = subjectColumns(mapping);
-				const condition = and(eq(sc.id, nativeSubjectId), eq(sc.status, mapping.d1.activeSubjectStatusValue), eq(sc.revision, input.expectedSecurityRevision));
-				const updateSubject = database.update(mapping.subject.table).set(updateValues([[mapping.subject.securityRevision, next]])).where(condition);
-				const removeSessions = database.delete(mapping.session.table).where(eq(s.subjectId, nativeSubjectId));
-				return {
-					receipt: prepare(void 0, journal),
-					statements: [
-						yield* assertion(sql`exists(select 1 from ${mapping.subject.table} where ${condition})`),
-						yield* statement(updateSubject),
-						yield* statement(removeSessions)
-					]
-				};
-			}), void 0, Effect.fail(stale()))
-		},
-		repository: { list: (input) => Effect.gen(function* () {
-			const database = yield* CurrentD1PlanningDatabase;
-			const nativeSubjectId = yield* mapping.subjectId.toNative(input.subjectId);
-			const cursor = input.cursor === void 0 ? void 0 : yield* mapping.sessionId.toNative(input.cursor);
-			const rows = yield* database.select({ ...getTableColumns(mapping.session.table) }).from(mapping.session.table).innerJoin(mapping.subject.table, and(eq(s.subjectId, subjectColumns(mapping).id), eq(s.securityRevision, subjectColumns(mapping).revision), eq(subjectColumns(mapping).status, mapping.d1.activeSubjectStatusValue))).where(and(eq(s.subjectId, nativeSubjectId), gt(s.expiresAt, mapping.d1.engineNow), gt(s.absoluteExpiresAt, mapping.d1.engineNow), cursor === void 0 ? void 0 : gt(s.sessionId, cursor))).orderBy(s.sessionId).limit(input.limit + 1);
-			const decoded = yield* Effect.forEach(rows, (row) => mapping.session.decode(row));
-			const codec = Schema.toCodecJson(Schema.toType(SessionMetadata));
-			const sessions = yield* Effect.forEach(decoded.slice(0, input.limit), (record) => Schema.encodeEffect(codec)(record).pipe(Effect.flatMap(Schema.decodeEffect(codec))));
-			const nextCursor = decoded.length <= input.limit ? void 0 : sessions.at(-1)?.sessionId;
-			return {
-				sessions,
-				...nextCursor === void 0 ? {} : { nextCursor }
-			};
-		}).pipe(terminalD1) }
-	};
-};
-const makeD1SignedValidity = (mapping) => {
-	const sc = subjectColumns(mapping);
-	const t = {
-		subjectId: column(mapping.tombstone.table, mapping.tombstone.subjectId),
-		sessionId: column(mapping.tombstone.table, mapping.tombstone.sessionId),
-		absoluteExpiresAt: column(mapping.tombstone.table, mapping.tombstone.absoluteExpiresAt)
-	};
-	return {
-		verify: (session, _now) => Effect.gen(function* () {
-			const database = yield* CurrentD1PlanningDatabase;
-			const nativeSubjectId = yield* mapping.subjectId.toNative(session.subjectId);
-			const nativeSessionId = yield* mapping.sessionId.toNative(session.sessionId);
-			if ((yield* database.select({ subjectId: sc.id }).from(mapping.subject.table).where(and(eq(sc.id, nativeSubjectId), eq(sc.status, mapping.d1.activeSubjectStatusValue), eq(sc.revision, session.securityRevision), sql`${mapping.d1.engineNowMillis} < ${DateTime.toEpochMillis(session.expiresAt)}`, sql`${mapping.d1.engineNowMillis} < ${DateTime.toEpochMillis(session.absoluteExpiresAt)}`, not(sql`exists(select 1 from ${mapping.tombstone.table} where ${t.subjectId} = ${sql.param(nativeSubjectId, t.subjectId)} and ${t.sessionId} = ${sql.param(nativeSessionId, t.sessionId)} and ${t.absoluteExpiresAt} > ${mapping.d1.engineNow})`))).limit(1)).length === 0) return yield* invalidSession();
-		}).pipe(terminalD1),
-		revoke: (input, prepare) => runPlanned(Effect.gen(function* () {
-			const database = yield* CurrentD1PlanningDatabase;
-			const journal = yield* CurrentCommitJournal;
-			const nativeSubjectId = yield* mapping.subjectId.toNative(input.subjectId);
-			const nativeSessionId = yield* mapping.sessionId.toNative(input.sessionId);
-			const condition = sql`exists(select 1 from ${mapping.subject.table} where ${sc.id} = ${sql.param(nativeSubjectId, sc.id)} and ${sc.status} = ${sql.param(mapping.d1.activeSubjectStatusValue, sc.status)} and ${sc.revision} = ${sql.param(input.expectedSecurityRevision, sc.revision)})`;
-			const encodedExpiry = mapping.tombstone.encodeInstant(input.absoluteExpiresAt);
-			const desiredExpiry = sql.param(encodedExpiry, t.absoluteExpiresAt);
-			const write = database.insert(mapping.tombstone.table).values(mapping.tombstone.encodeInsert({
-				subjectId: nativeSubjectId,
-				sessionId: nativeSessionId,
-				absoluteExpiresAt: input.absoluteExpiresAt
-			})).onConflictDoUpdate({
-				target: [t.subjectId, t.sessionId],
-				set: updateValues([[mapping.tombstone.absoluteExpiresAt, sql`case when ${t.absoluteExpiresAt} < ${desiredExpiry} then ${desiredExpiry} else ${t.absoluteExpiresAt} end`]])
-			});
-			return {
-				receipt: prepare(void 0, journal),
-				statements: [yield* assertion(condition), yield* statement(write)]
-			};
-		}), void 0, Effect.fail(stale())),
-		revokeAll: (input, prepare) => runPlanned(Effect.gen(function* () {
-			const database = yield* CurrentD1PlanningDatabase;
-			const journal = yield* CurrentCommitJournal;
-			const nativeSubjectId = yield* mapping.subjectId.toNative(input.subjectId);
-			const next = yield* allocate(mapping.subject.nextSecurityRevision?.(input.expectedSecurityRevision), mapping.subject.nextSecurityRevisionSync === void 0 ? void 0 : () => mapping.subject.nextSecurityRevisionSync(input.expectedSecurityRevision));
-			const condition = and(eq(sc.id, nativeSubjectId), eq(sc.status, mapping.d1.activeSubjectStatusValue), eq(sc.revision, input.expectedSecurityRevision));
-			const updateSubject = database.update(mapping.subject.table).set(updateValues([[mapping.subject.securityRevision, next]])).where(condition);
-			return {
-				receipt: prepare(void 0, journal),
-				statements: [yield* assertion(sql`exists(select 1 from ${mapping.subject.table} where ${condition})`), yield* statement(updateSubject)]
-			};
-		}), void 0, Effect.fail(stale()))
-	};
-};
-const makeD1SessionServiceEffects = {
-	authority: (mapping) => Effect.gen(function* () {
-		const database = yield* CurrentD1PlanningDatabase;
-		yield* validateDrizzleStorage(mapping).pipe(Effect.mapError(unavailable));
-		const hooks = yield* LifecycleHooks;
-		const raw = makeD1AuthenticationAuthority(mapping);
-		const run = (effect) => Effect.gen(function* () {
-			if ((yield* Effect.serviceOption(CurrentD1SessionBatch))._tag === "Some" || (yield* hasCommitScope)) return yield* unavailable();
-			return yield* effect.pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks));
-		});
-		return { authenticationAuthority: {
-			capture: (subjectId, credentialIds) => run(raw.capture(subjectId, credentialIds)),
-			requirements: (evidence) => run(raw.requirements(evidence)),
-			approve: (input, prepare) => run(raw.approve(input, prepare))
-		} };
-	}),
-	pending: (mapping) => Effect.gen(function* () {
-		const database = yield* CurrentD1PlanningDatabase;
-		yield* validateDrizzleStorage(mapping).pipe(Effect.mapError(unavailable));
-		const hooks = yield* LifecycleHooks;
-		const raw = makeD1PendingAuthentication(mapping);
-		const run = (effect) => Effect.gen(function* () {
-			if ((yield* Effect.serviceOption(CurrentD1SessionBatch))._tag === "Some" || (yield* hasCommitScope)) return yield* unavailable();
-			return yield* effect.pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks));
-		});
-		return { pendingAuthentication: {
-			create: (input, now, prepare) => run(raw.create(input, now, prepare)),
-			context: (input) => run(raw.context(input)),
-			read: (input) => run(raw.read(input)),
-			reject: (input, prepare) => run(raw.reject(input, prepare))
-		} };
-	}),
-	stateful: (mapping) => Effect.gen(function* () {
-		const database = yield* CurrentD1PlanningDatabase;
-		yield* validateDrizzleStorage(mapping).pipe(Effect.mapError(unavailable));
-		const hooks = yield* LifecycleHooks;
-		const raw = makeD1StatefulSessions(mapping);
-		const run = (effect) => Effect.gen(function* () {
-			if ((yield* Effect.serviceOption(CurrentD1SessionBatch))._tag === "Some" || (yield* hasCommitScope)) return yield* unavailable();
-			return yield* effect.pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks));
-		});
-		return {
-			statefulSessionPersistence: {
-				establish: (input, prepare) => run(raw.persistence.establish(input, prepare)),
-				verify: (input) => run(raw.persistence.verify(input)),
-				rotate: (input, prepare) => run(raw.persistence.rotate(input, prepare)),
-				revokeDigest: (digest, prepare) => run(raw.persistence.revokeDigest(digest, prepare)),
-				revoke: (input, prepare) => run(raw.persistence.revoke(input, prepare)),
-				revokeAll: (input, prepare) => run(raw.persistence.revokeAll(input, prepare))
-			},
-			sessionRepository: { list: (input) => run(raw.repository.list(input)) }
-		};
-	}),
-	validity: (mapping) => Effect.gen(function* () {
-		const database = yield* CurrentD1PlanningDatabase;
-		yield* validateDrizzleStorage(mapping).pipe(Effect.mapError(unavailable));
-		const hooks = yield* LifecycleHooks;
-		const raw = makeD1SignedValidity(mapping);
-		const run = (effect) => Effect.gen(function* () {
-			if ((yield* Effect.serviceOption(CurrentD1SessionBatch))._tag === "Some" || (yield* hasCommitScope)) return yield* unavailable();
-			return yield* effect.pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks));
-		});
-		return { signedSessionValidity: {
-			verify: (session, now) => run(raw.verify(session, now)),
-			revoke: (input, prepare) => run(raw.revoke(input, prepare)),
-			revokeAll: (input, prepare) => run(raw.revokeAll(input, prepare))
-		} };
-	})
-};
-/**
-* Owns one atomic D1 persistence transition together with any number of
-* application statements appended by `owner`. Keeping one persistence
-* transition makes a failed batch's domain guard recoverable without exposing
-* a prepared value. Compose additional transitions in later root batches.
-* Interruption or owner failure before `$client.batch` discards the journal;
-* the adapter performs no hidden retry and a retry must re-plan the whole owner.
-* Caller failures remain in the error channel. D1 batch/transport failures that
-* cannot be tied to this adapter's reserved guard become `SessionUnavailable`.
-*/
-const coordinateD1SessionBatch = (database, mapping, make, owner) => Effect.gen(function* () {
-	if (yield* hasCommitScope) return yield* unavailable();
-	yield* validateDrizzleStorage(mapping).pipe(Effect.mapError(unavailable));
-	return (yield* coordinateCommit(() => Effect.gen(function* () {
-		const statements = [];
-		let mutation;
-		const nativeCollector = D1BatchStatements.of({ append: (statement) => Effect.sync(() => statements.push(statement)) });
-		const d1Owner = yield* makeD1Owner(unavailable()).pipe(Effect.provideService(D1BatchStatements, nativeCollector));
-		let batch;
-		const appendMutation = (input) => d1Owner.run(Effect.suspend(() => {
-			if (mutation !== void 0) return Effect.fail(unavailable());
-			mutation = input;
-			statements.push(...input.statements);
-			return Effect.void;
-		}));
-		batch = {
-			owner: d1Owner,
-			append: appendMutation
-		};
-		const services = yield* make(batch);
-		const value = yield* d1Owner.close(Effect.provideService(owner(services, batch), D1BatchStatements, d1Owner.collector));
-		if (mutation?.journalGuard !== void 0) {
-			const status = yield* Effect.result(mutation.journalGuard.read);
-			if (status._tag === "Success" || status.failure._tag !== "CommitPending") return yield* unavailable();
-		}
-		yield* database.$client.batch(statements).pipe(Effect.catchCause((cause) => Effect.fail(new D1BatchFailure({
-			cause,
-			...mutation === void 0 ? {} : { mutation }
-		}))));
-		return value;
-	}), { mode: "batch" }).pipe(Effect.catchCause(recoverCoordinatedD1BatchCause), Effect.provideService(CurrentD1PlanningDatabase, database))).value;
-});
-const makeD1AuthenticationAuthorityServices = (mapping) => makeD1SessionServiceEffects.authority(mapping).pipe(Effect.provideServiceEffect(CurrentD1PlanningDatabase, Database), Effect.provideServiceEffect(NativeDatabase, nativeDatabase(Database)));
-const makeD1PendingAuthenticationServices = (mapping) => makeD1SessionServiceEffects.pending(mapping).pipe(Effect.provideServiceEffect(CurrentD1PlanningDatabase, Database), Effect.provideServiceEffect(NativeDatabase, nativeDatabase(Database)));
-const makeD1StatefulSessionServices = (mapping) => makeD1SessionServiceEffects.stateful(mapping).pipe(Effect.provideServiceEffect(CurrentD1PlanningDatabase, Database), Effect.provideServiceEffect(NativeDatabase, nativeDatabase(Database)));
-const makeD1SignedSessionValidityServices = (mapping) => makeD1SessionServiceEffects.validity(mapping).pipe(Effect.provideServiceEffect(CurrentD1PlanningDatabase, Database), Effect.provideServiceEffect(NativeDatabase, nativeDatabase(Database)));
-function coordinateD1AuthenticationAuthority(acquire, options, body) {
-	return Effect.flatMap(nativeDatabase(acquire), (database) => coordinateD1SessionBatch(database, options.mapping, (batch) => Effect.gen(function* () {
-		const hooks = yield* LifecycleHooks;
-		const raw = makeD1AuthenticationAuthority(options.mapping);
-		const run = (effect) => batch.owner.run(effect.pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks), Effect.provideService(CurrentD1SessionBatch, batch)));
-		return { authenticationAuthority: {
-			capture: (subjectId, credentialIds) => run(raw.capture(subjectId, credentialIds)),
-			requirements: (evidence) => run(raw.requirements(evidence)),
-			approve: (input, prepare) => run(raw.approve(input, prepare))
-		} };
-	}), (ownedServices, batch) => {
-		const provided = Context.make(AuthenticationAuthority, ownedServices.authenticationAuthority).pipe(Context.add(D1BatchStatements, batch.owner.collector));
-		return Effect.provideContext(body, provided);
-	}).pipe(Effect.provideService(NativeDatabase, database)));
-}
-function coordinateD1PendingAuthentication(acquire, options, body) {
-	return Effect.flatMap(nativeDatabase(acquire), (database) => coordinateD1SessionBatch(database, options.mapping, (batch) => Effect.gen(function* () {
-		const hooks = yield* LifecycleHooks;
-		const raw = makeD1PendingAuthentication(options.mapping);
-		const run = (effect) => batch.owner.run(effect.pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks), Effect.provideService(CurrentD1SessionBatch, batch)));
-		return { pendingAuthentication: {
-			create: (input, now, prepare) => run(raw.create(input, now, prepare)),
-			context: (input) => run(raw.context(input)),
-			read: (input) => run(raw.read(input)),
-			reject: (input, prepare) => run(raw.reject(input, prepare))
-		} };
-	}), (ownedServices, batch) => {
-		const provided = Context.make(options.target, ownedServices.pendingAuthentication).pipe(Context.add(D1BatchStatements, batch.owner.collector));
-		return Effect.provideContext(body, provided);
-	}).pipe(Effect.provideService(NativeDatabase, database)));
-}
-function coordinateD1StatefulSessions(acquire, options, body) {
-	return Effect.flatMap(nativeDatabase(acquire), (database) => coordinateD1SessionBatch(database, options.mapping, (batch) => Effect.gen(function* () {
-		const hooks = yield* LifecycleHooks;
-		const raw = makeD1StatefulSessions(options.mapping);
-		const run = (effect) => batch.owner.run(effect.pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks), Effect.provideService(CurrentD1SessionBatch, batch)));
-		return {
-			statefulSessionPersistence: {
-				establish: (input, prepare) => run(raw.persistence.establish(input, prepare)),
-				verify: (input) => run(raw.persistence.verify(input)),
-				rotate: (input, prepare) => run(raw.persistence.rotate(input, prepare)),
-				revokeDigest: (digest, prepare) => run(raw.persistence.revokeDigest(digest, prepare)),
-				revoke: (input, prepare) => run(raw.persistence.revoke(input, prepare)),
-				revokeAll: (input, prepare) => run(raw.persistence.revokeAll(input, prepare))
-			},
-			sessionRepository: { list: (input) => run(raw.repository.list(input)) }
-		};
-	}), (ownedServices, batch) => {
-		const provided = Context.make(options.persistence, ownedServices.statefulSessionPersistence).pipe(Context.add(options.repository, ownedServices.sessionRepository), Context.add(D1BatchStatements, batch.owner.collector));
-		return Effect.provideContext(body, provided);
-	}).pipe(Effect.provideService(NativeDatabase, database)));
-}
-function coordinateD1SignedSessionValidity(acquire, options, body) {
-	return Effect.flatMap(nativeDatabase(acquire), (database) => coordinateD1SessionBatch(database, options.mapping, (batch) => Effect.gen(function* () {
-		const hooks = yield* LifecycleHooks;
-		const raw = makeD1SignedValidity(options.mapping);
-		const run = (effect) => batch.owner.run(effect.pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks), Effect.provideService(CurrentD1SessionBatch, batch)));
-		return { signedSessionValidity: {
-			verify: (session, now) => run(raw.verify(session, now)),
-			revoke: (input, prepare) => run(raw.revoke(input, prepare)),
-			revokeAll: (input, prepare) => run(raw.revokeAll(input, prepare))
-		} };
-	}), (ownedServices, batch) => {
-		const provided = Context.make(options.target, ownedServices.signedSessionValidity).pipe(Context.add(D1BatchStatements, batch.owner.collector));
-		return Effect.provideContext(body, provided);
-	}).pipe(Effect.provideService(NativeDatabase, database)));
-}
-const stepUpColumns = (mapping) => Object.fromEntries([
-	"digest",
-	"version",
-	"flowId",
-	"subjectId",
-	"bindingDigest",
-	"snapshot",
-	"expiresAt",
-	"attemptLimit",
-	"failedAttempts",
-	"consumed"
-].map((key) => [key, column(mapping.intent.table, mapping.intent[key])]));
-const stepUpSourceCondition = (mapping, intent, nativeSubjectId, nativeSessionId, plan) => {
-	const source = mapping.source;
-	if (source.kind !== intent.sourceKind) return sql`false`;
-	const time = and(sql`${mapping.d1.engineNowMillis} >= ${DateTime.toEpochMillis(intent.sourceAuthenticatedAt)}`, sql`${mapping.d1.engineNowMillis} < ${DateTime.toEpochMillis(intent.sourceExpiresAt)}`, sql`${mapping.d1.engineNowMillis} < ${DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt)}`);
-	if (source.kind === "StatelessSigned") return time;
-	if (source.kind === "StateAssistedSigned") {
-		const t = source.tombstone, owner = column(t.table, t.subjectId), id = column(t.table, t.sessionId), expiry = column(t.table, t.absoluteExpiresAt);
-		return and(time, not(sql`exists(select 1 from ${t.table} where ${owner}=${sql.param(nativeSubjectId, owner)} and ${id}=${sql.param(nativeSessionId, id)} and ${expiry}>${mapping.d1.engineNow})`));
-	}
-	const s = source.session, c = sessionColumns(source);
-	const condition = and(eq(c.sessionId, nativeSessionId), eq(c.subjectId, nativeSubjectId), eq(c.securityRevision, intent.revision.securityRevision), eq(column(s.table, s.credentialVersion), intent.sourceCredentialVersion), eq(column(s.table, s.authenticatedAt), s.encodeInstant(intent.sourceAuthenticatedAt)), eq(c.expiresAt, s.encodeInstant(intent.sourceExpiresAt)), eq(c.absoluteExpiresAt, s.encodeInstant(intent.sourceAbsoluteExpiresAt)), gt(c.expiresAt, mapping.d1.engineNow), gt(c.absoluteExpiresAt, mapping.d1.engineNow), plan?.replacement._tag === "Stateful" ? eq(c.digest, plan.replacement.expectedDigest) : void 0, plan?.replacement._tag === "Stateful" ? eq(c.version, plan.replacement.expectedRowVersion) : void 0);
-	return and(time, sql`exists(select 1 from ${s.table} where ${condition})`);
-};
-const stepUpRowCondition = (mapping, row, intent, nativeSubjectId) => {
-	const c = stepUpColumns(mapping), m = mapping.intent;
-	return and(eq(c.digest, intent.digest), eq(c.version, intent.version), eq(c.flowId, intent.flowId), eq(c.subjectId, nativeSubjectId), eq(c.bindingDigest, intent.bindingDigest), eq(c.snapshot, row[m.snapshot]), eq(c.expiresAt, m.encodeInstant(intent.expiresAt)), eq(c.attemptLimit, intent.attemptLimit), eq(c.consumed, false), eq(c.failedAttempts, row[m.failedAttempts]), sql`${c.failedAttempts} >= 0`, sql`${c.failedAttempts} < ${c.attemptLimit}`, gt(c.expiresAt, mapping.d1.engineNow));
-};
-const readD1StepUp = Effect.fn("DrizzleD1StepUp.read")(function* (mapping, digest) {
-	const database = yield* CurrentD1PlanningDatabase;
-	const m = mapping.intent, c = stepUpColumns(mapping);
-	const row = (yield* database.select().from(m.table).where(eq(c.digest, digest)).limit(1))[0];
-	if (row === void 0) return yield* SessionStepUpInvalid.make({});
-	const intent = yield* decodeStepUpIntent(row[m.snapshot]);
-	if (intent.digest !== digest || !stepUpIntentLive(intent, mapping.source.kind, yield* DateTime.now) || !Schema.is(Schema.Natural)(row[m.failedAttempts])) return yield* SessionStepUpInvalid.make({});
-	const nativeSubjectId = yield* mapping.subjectId.toNative(intent.revision.subjectId);
-	const nativeSessionId = mapping.source.kind === "StatelessSigned" ? void 0 : yield* mapping.source.sessionId.toNative(intent.sourceSessionId);
-	const condition = and(authorityCondition(mapping, nativeSubjectId, intent), stepUpSourceCondition(mapping, intent, nativeSubjectId, nativeSessionId), sql`exists(select 1 from ${m.table} where ${stepUpRowCondition(mapping, row, intent, nativeSubjectId)})`, sql`${mapping.d1.engineNowMillis} < ${DateTime.toEpochMillis(intent.expiresAt)}`);
-	if (!(yield* conditionMatches(condition))) return yield* SessionStepUpInvalid.make({});
-	return {
-		row,
-		intent,
-		nativeSubjectId,
-		nativeSessionId
-	};
-});
-const isD1StepUpRejectAbsence = (error) => typeof error === "object" && error !== null && Reflect.get(error, "_tag") === "SessionStepUpInvalid";
-const recoverD1StepUpRejectAbsence = (effect, rejected) => effect.pipe(Effect.catchCause((cause) => {
-	if (cause.reasons.length > 0 && cause.reasons.every((reason) => Cause.isFailReason(reason) && isD1StepUpRejectAbsence(reason.error))) return Effect.succeed(rejected);
-	return Effect.failCause(Cause.map(cause, (error) => isD1StepUpRejectAbsence(error) ? SessionUnavailable.make({}) : error));
-}));
-const makeD1SessionStepUp = (mapping) => {
-	const m = mapping.intent, c = stepUpColumns(mapping);
-	const recover = Effect.fail(SessionStepUpInvalid.make({}));
-	return {
-		create: (input, _now, prepare) => runPlanned(Effect.gen(function* () {
-			const database = yield* CurrentD1PlanningDatabase;
-			const journal = yield* CurrentCommitJournal;
-			const version = yield* allocate(m.allocateVersion, m.allocateVersionSync), record = {
-				...input,
-				version
-			};
-			if (!stepUpIntentLive(record, mapping.source.kind, yield* DateTime.now)) return yield* stale();
-			const nativeSubjectId = yield* mapping.subjectId.toNative(input.revision.subjectId);
-			const nativeSessionId = mapping.source.kind === "StatelessSigned" ? void 0 : yield* mapping.source.sessionId.toNative(input.sourceSessionId);
-			if ((yield* database.select().from(m.table).where(or(eq(c.digest, input.digest), eq(c.flowId, input.flowId))).limit(1)).length > 0) return yield* SessionConflict.make({});
-			const condition = and(authorityCondition(mapping, nativeSubjectId, record), stepUpSourceCondition(mapping, record, nativeSubjectId, nativeSessionId), sql`${mapping.d1.engineNowMillis} < ${DateTime.toEpochMillis(input.expiresAt)}`);
-			if (!(yield* conditionMatches(condition))) return yield* stale();
-			const snapshot = yield* encodeStepUpIntent(record);
-			const values = {
-				...m.encodeInsert(record, { subjectId: nativeSubjectId }),
-				...updateValues([
-					[m.digest, record.digest],
-					[m.version, version],
-					[m.flowId, record.flowId],
-					[m.subjectId, nativeSubjectId],
-					[m.bindingDigest, record.bindingDigest],
-					[m.snapshot, snapshot],
-					[m.expiresAt, m.encodeInstant(record.expiresAt)],
-					[m.attemptLimit, record.attemptLimit],
-					[m.failedAttempts, 0],
-					[m.consumed, false]
-				])
-			};
-			const receipt = prepare(record, journal);
-			const exact = and(eq(c.digest, record.digest), eq(c.version, version), eq(c.flowId, record.flowId), eq(c.subjectId, nativeSubjectId), eq(c.bindingDigest, record.bindingDigest), eq(c.snapshot, snapshot), eq(c.expiresAt, m.encodeInstant(record.expiresAt)), eq(c.attemptLimit, record.attemptLimit), eq(c.failedAttempts, 0), eq(c.consumed, false));
-			return {
-				receipt,
-				statements: [
-					yield* assertion(condition),
-					yield* statement(database.insert(m.table).values(values)),
-					yield* assertion(sql`changes() = 1`),
-					yield* assertion(and(condition, sql`exists(select 1 from ${m.table} where ${exact})`))
-				]
-			};
-		}), mapping.isConstraintConflict, Effect.fail(stale())),
-		context: (input) => mapFailureCause(readD1StepUp(mapping, input.digest).pipe(Effect.flatMap(({ intent }) => snapshotPendingAuthenticationContext({
-			flowId: intent.flowId,
-			bindingDigest: intent.bindingDigest,
-			revision: intent.revision,
-			expiresAtMillis: DateTime.toEpochMillis(intent.expiresAt)
-		}))), (error) => error._tag === "PendingAuthenticationInvalid" ? unavailable() : error).pipe(terminalD1),
-		read: (input) => readD1StepUp(mapping, input.digest).pipe(Effect.flatMap(({ intent }) => intent.bindingDigest === input.bindingDigest ? Effect.succeed(intent) : Effect.fail(SessionStepUpInvalid.make({}))), terminalD1),
-		reject: (input, prepare) => runPlanned(Effect.gen(function* () {
-			const database = yield* CurrentD1PlanningDatabase;
-			const journal = yield* CurrentCommitJournal;
-			const selected = yield* recoverD1StepUpRejectAbsence(readD1StepUp(mapping, input.digest).pipe(Effect.map((value) => ({
-				_tag: "Found",
-				value
-			}))), { _tag: "Rejected" });
-			if (selected._tag === "Rejected") return {
-				receipt: prepare({ _tag: "Rejected" }, journal),
-				statements: []
-			};
-			const { row, intent, nativeSubjectId, nativeSessionId } = selected.value;
-			const condition = and(eq(c.digest, intent.digest), eq(c.version, intent.version), eq(c.snapshot, row[m.snapshot]), eq(c.subjectId, nativeSubjectId), eq(c.bindingDigest, intent.bindingDigest), eq(c.flowId, intent.flowId), eq(c.expiresAt, m.encodeInstant(intent.expiresAt)), eq(c.attemptLimit, intent.attemptLimit), eq(c.consumed, false), sql`${c.failedAttempts} >= 0`, sql`${c.failedAttempts} < ${c.attemptLimit}`, gt(c.expiresAt, mapping.d1.engineNow), authorityCondition(mapping, nativeSubjectId, intent), stepUpSourceCondition(mapping, intent, nativeSubjectId, nativeSessionId));
-			const write = database.update(m.table).set(updateValues([[m.failedAttempts, sql`${c.failedAttempts} + 1`]])).where(condition);
-			const settled = sql`changes() = 1 or not exists(select 1 from ${m.table} where ${condition})`;
-			return {
-				receipt: prepare({ _tag: "Rejected" }, journal),
-				statements: [yield* statement(write), yield* assertion(settled)]
-			};
-		}), void 0, Effect.fail(unavailable())),
-		complete: (plan, prepare) => runPlanned(Effect.gen(function* () {
-			const database = yield* CurrentD1PlanningDatabase;
-			const journal = yield* CurrentCommitJournal;
-			yield* validateStepUpPlan(plan);
-			const stored = yield* readD1StepUp(mapping, plan.intent.digest);
-			if ((yield* encodeStepUpIntent(stored.intent)) !== (yield* encodeStepUpIntent(plan.intent))) return yield* SessionStepUpInvalid.make({});
-			const base = yield* requirement(mapping, plan.evidence);
-			if (!(yield* assessAuthentication(plan.evidence, base)).satisfied || !(yield* assessAuthentication(plan.evidence, stored.intent.requirement)).satisfied) return yield* stale();
-			const { row, intent, nativeSubjectId, nativeSessionId } = stored, replacement = plan.replacement;
-			const target = replacement.inspection.session;
-			if (DateTime.toEpochMillis(target.expiresAt) > DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt)) return yield* SessionStepUpInvalid.make({});
-			const live = and(authorityCondition(mapping, nativeSubjectId, plan.evidence), freshnessCondition(mapping, plan.evidence, base, true), freshnessCondition(mapping, plan.evidence, intent.requirement, true), sql`${mapping.d1.engineNowMillis} >= ${DateTime.toEpochMillis(intent.sourceAuthenticatedAt)}`, sql`${mapping.d1.engineNowMillis} < ${DateTime.toEpochMillis(intent.expiresAt)}`, sql`${mapping.d1.engineNowMillis} < ${DateTime.toEpochMillis(intent.sourceExpiresAt)}`, sql`${mapping.d1.engineNowMillis} < ${DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt)}`, sql`${mapping.d1.engineNowMillis} >= ${DateTime.toEpochMillis(target.issuedAt)}`, sql`${mapping.d1.engineNowMillis} < ${DateTime.toEpochMillis(target.expiresAt)}`);
-			const source = stepUpSourceCondition(mapping, intent, nativeSubjectId, nativeSessionId, plan);
-			const version = yield* allocate(m.allocateVersion, m.allocateVersionSync);
-			if (version === intent.version) return yield* unavailable();
-			const snapshot = yield* encodeStepUpIntent({
-				...intent,
-				version
-			});
-			const consume = database.update(m.table).set(updateValues([
-				[m.consumed, true],
-				[m.version, version],
-				[m.snapshot, snapshot]
-			])).where(and(stepUpRowCondition(mapping, row, intent, nativeSubjectId), live, source));
-			const marker = sql`exists(select 1 from ${m.table} where ${c.digest}=${sql.param(intent.digest, c.digest)} and ${c.version}=${sql.param(version, c.version)} and ${c.snapshot}=${sql.param(snapshot, c.snapshot)} and ${c.consumed}=${sql.param(true, c.consumed)} and ${c.failedAttempts}=${row[m.failedAttempts]})`;
-			const statements = [yield* statement(consume), yield* assertion(sql`changes() = 1`)];
-			let post = sql`true`;
-			if (replacement._tag === "Stateful") {
-				if (mapping.source.kind !== "Stateful") return yield* SessionStepUpInvalid.make({});
-				const s = mapping.source.session, sc = sessionColumns(mapping.source);
-				const rowVersion = yield* allocate(s.allocateVersion, s.allocateVersionSync);
-				const next = {
-					...target,
-					provenance: replacement.inspection.provenance,
-					credentialVersion: replacement.inspection.credentialVersion,
-					digest: replacement.nextDigest,
-					version: rowVersion
-				};
-				const rotation = {
-					...s.encodeRotation(next),
-					...updateValues([
-						[s.version, rowVersion],
-						[s.digest, next.digest],
-						[s.credentialVersion, next.credentialVersion],
-						[s.authenticatedAt, s.encodeInstant(target.assurance.authenticatedAt)],
-						[s.issuedAt, s.encodeInstant(target.issuedAt)],
-						[s.expiresAt, s.encodeInstant(target.expiresAt)],
-						[s.absoluteExpiresAt, s.encodeInstant(target.absoluteExpiresAt)]
-					])
-				};
-				const write = database.update(s.table).set(rotation).where(and(eq(sc.sessionId, nativeSessionId), eq(sc.digest, replacement.expectedDigest), eq(sc.version, replacement.expectedRowVersion), marker, source, live));
-				statements.push(yield* statement(write), yield* assertion(sql`changes() = 1`));
-				const exact = and(eq(sc.sessionId, nativeSessionId), eq(sc.subjectId, nativeSubjectId), eq(sc.version, rowVersion), eq(sc.digest, next.digest), eq(sc.securityRevision, target.securityRevision), eq(column(s.table, s.credentialVersion), next.credentialVersion), eq(column(s.table, s.authenticatedAt), s.encodeInstant(target.assurance.authenticatedAt)), eq(sc.issuedAt, s.encodeInstant(target.issuedAt)), eq(sc.expiresAt, s.encodeInstant(target.expiresAt)), eq(sc.absoluteExpiresAt, s.encodeInstant(target.absoluteExpiresAt)));
-				post = sql`exists(select 1 from ${s.table} where ${exact})`;
-			} else if (replacement._tag === "StateAssistedSigned") {
-				if (mapping.source.kind !== "StateAssistedSigned") return yield* SessionStepUpInvalid.make({});
-				const t = mapping.source.tombstone, owner = column(t.table, t.subjectId), id = column(t.table, t.sessionId), expiry = column(t.table, t.absoluteExpiresAt);
-				statements.push(yield* statement(database.delete(t.table).where(and(eq(owner, nativeSubjectId), eq(id, nativeSessionId), sql`${expiry} <= ${mapping.d1.engineNow}`, marker))));
-				const values = t.encodeInsert({
-					subjectId: nativeSubjectId,
-					sessionId: nativeSessionId,
-					absoluteExpiresAt: replacement.tombstoneUntil
-				});
-				statements.push(yield* statement(database.insert(t.table).values(values)), yield* assertion(sql`changes() = 1`));
-				const exact = and(eq(owner, nativeSubjectId), eq(id, nativeSessionId), eq(expiry, t.encodeInstant(replacement.tombstoneUntil)));
-				post = sql`exists(select 1 from ${t.table} where ${exact})`;
-			}
-			statements.push(yield* assertion(and(marker, post, live)));
-			return {
-				receipt: prepare(replacement.inspection, journal),
-				statements
-			};
-		}), mapping.isConstraintConflict, recover)
-	};
-};
-const makeD1SessionStepUpServices = Effect.fnUntraced(function* (mapping, target) {
-	const database = yield* Database;
-	yield* validateDrizzleStorage(mapping).pipe(Effect.provideServiceEffect(NativeDatabase, nativeDatabase(Database)), Effect.mapError(unavailable));
-	const hooks = yield* LifecycleHooks;
-	const raw = makeD1SessionStepUp(mapping);
-	const run = (effect) => Effect.gen(function* () {
-		if ((yield* Effect.serviceOption(CurrentD1SessionBatch))._tag === "Some" || (yield* hasCommitScope)) return yield* unavailable();
-		return yield* effect.pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks));
-	});
-	return { sessionStepUpPersistence: target.of({
-		create: (input, now, prepare) => run(raw.create(input, now, prepare)),
-		context: (input) => run(raw.context(input)),
-		read: (input) => run(raw.read(input)),
-		reject: (input, prepare) => run(raw.reject(input, prepare)),
-		complete: (plan, prepare) => run(raw.complete(plan, prepare))
-	}) };
-});
-function coordinateD1SessionStepUp(acquire, options, body) {
-	return Effect.flatMap(nativeDatabase(acquire), (database) => coordinateD1SessionBatch(database, options.mapping, (batch) => Effect.gen(function* () {
-		const hooks = yield* LifecycleHooks;
-		const raw = makeD1SessionStepUp(options.mapping);
-		const run = (effect) => batch.owner.run(effect.pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks), Effect.provideService(CurrentD1SessionBatch, batch)));
-		return { sessionStepUpPersistence: options.target.of({
-			create: (input, now, prepare) => run(raw.create(input, now, prepare)),
-			context: (input) => run(raw.context(input)),
-			read: (input) => run(raw.read(input)),
-			reject: (input, prepare) => run(raw.reject(input, prepare)),
-			complete: (plan, prepare) => run(raw.complete(plan, prepare))
-		}) };
-	}), (ownedServices, batch) => {
-		const provided = Context.make(options.target, ownedServices.sessionStepUpPersistence).pipe(Context.add(D1BatchStatements, batch.owner.collector));
-		return Effect.provideContext(body, provided);
-	}).pipe(Effect.provideService(NativeDatabase, database)));
-}
-//#endregion
-export { coordinateD1AuthenticationAuthority, coordinateD1PendingAuthentication, coordinateD1SessionBatch, coordinateD1SessionStepUp, coordinateD1SignedSessionValidity, coordinateD1StatefulSessions, makeD1AuthenticationAuthority, makeD1AuthenticationAuthorityServices, makeD1PendingAuthentication, makeD1PendingAuthenticationServices, makeD1SessionServiceEffects, makeD1SessionStepUp, makeD1SessionStepUpServices, makeD1SignedSessionValidityServices, makeD1SignedValidity, makeD1StatefulSessionServices, makeD1StatefulSessions };
-
-//# sourceMappingURL=d1-sessions.mjs.map