@yielded/auth-persistence 0.1.0-beta.10 → 0.1.0-beta.12

package/dist/internal/session-kernel.d.mts

@@ -1,10 +1,11 @@
 import { QueryFailure, QueryOperations } from "./query-operations.mjs";
 import { AuthenticationAuthorityMapping, PendingAuthenticationMapping, SignedSessionValidityMapping, StatefulSessionMapping } from "./models/session-model.mjs";
 import { SessionStepUpMapping } from "./models/step-up-model.mjs";
-import { Context, Effect } from "effect";
+import { Context, DateTime, Effect } from "effect";
+import { SubjectId } from "@yielded/auth/Schema";
 import { LifecycleHooks } from "@yielded/auth/Hooks";
-import { AuthenticationAuthority, PendingAuthentication, SessionRepository, SessionStepUpPersistence, SessionUnavailable, SignedSessionValidity, StatefulSessionPersistence } from "@yielded/auth/Sessions";
-import * as SqlError$1 from "effect/unstable/sql/SqlError";
+import { AuthenticationEvidence, AuthenticationRevision, PendingAuthentication, PendingAuthenticationInvalid, PendingConsumption, PrepareSessionCommit, SessionRepository, SessionStepUpPersistence, SessionUnavailable, SignedSessionValidity, StaleAuthentication, StatefulSessionPersistence } from "@yielded/auth/Sessions";
+import * as SqlError$1 from "effect/sql/SqlError";
 //#region src/internal/session-kernel.d.ts
 type CommitMode = "interactive" | "synchronous";
 interface SessionSqlQuery<A = ReadonlyArray<any>> extends Effect.Effect<A, QueryFailure | SqlError$1.SqlError> {
@@ -23,7 +24,6 @@ export interface SessionSqlDatabase {
   readonly delete: (...args: ReadonlyArray<any>) => SessionSqlQuery;
   readonly transaction: <A, E, R>(body: (transaction: SessionSqlDatabase) => Effect.Effect<A, E, R>) => Effect.Effect<A, E | SqlError$1.SqlError, R>;
 }
-type Database = SessionSqlDatabase;
 declare const CurrentSessionSql_base: Context.ServiceClass<CurrentSessionSql, "effect-auth/drizzle/CurrentSessionSql", SessionSqlDatabase>;
 /** Native SQL authority for the current transaction or savepoint. */
 export declare class CurrentSessionSql extends CurrentSessionSql_base {}
@@ -35,14 +35,24 @@ export interface SessionSqlOptions {
   readonly standaloneGuard: Guard;
 }
 export declare const makeSessionKernel: (operations: QueryOperations) => {
-  makeSqlAuthenticationAuthority: <Claims>(database: Database, mapping: AuthenticationAuthorityMapping<Claims, any, any, any, any, any>, options: SessionSqlOptions) => Effect.Effect<AuthenticationAuthority["Service"], never, LifecycleHooks>;
-  makeSqlPendingAuthentication: <Claims>(database: Database, mapping: PendingAuthenticationMapping<Claims, any, any, any, any, any>, options: SessionSqlOptions) => Effect.Effect<PendingAuthentication<Claims>, never, LifecycleHooks>;
-  makeSqlStatefulSessions: <Claims>(database: Database, mapping: StatefulSessionMapping<Claims, any, any, any, any, any, any, any>, options: SessionSqlOptions) => Effect.Effect<{
+  makeSqlAuthenticationAuthority: <Claims>(mapping: AuthenticationAuthorityMapping<Claims, any, any, any, any, any>, options: SessionSqlOptions) => Effect.Effect<{
+    readonly capture: (subjectId: SubjectId, credentialIds: ReadonlyArray<string>) => Effect.Effect<AuthenticationRevision, StaleAuthentication | SessionUnavailable>;
+    readonly requirements: (evidence: AuthenticationEvidence) => Effect.Effect<import("@yielded/auth/Sessions").AuthenticationRequirement, StaleAuthentication | SessionUnavailable>;
+    readonly approve: <A>(input: {
+      readonly evidence: AuthenticationEvidence;
+      readonly now: DateTime.Utc;
+      readonly expiresAt: DateTime.Utc;
+      readonly absoluteExpiresAt: DateTime.Utc;
+      readonly pending?: PendingConsumption;
+    }, prepare: PrepareSessionCommit<void, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, StaleAuthentication | PendingAuthenticationInvalid | SessionUnavailable>;
+  }, never, CurrentSessionSql | LifecycleHooks>;
+  makeSqlPendingAuthentication: <Claims>(mapping: PendingAuthenticationMapping<Claims, any, any, any, any, any>, options: SessionSqlOptions) => Effect.Effect<PendingAuthentication<Claims>, never, CurrentSessionSql | LifecycleHooks>;
+  makeSqlStatefulSessions: <Claims>(mapping: StatefulSessionMapping<Claims, any, any, any, any, any, any, any>, options: SessionSqlOptions) => Effect.Effect<{
     readonly statefulSessionPersistence: StatefulSessionPersistence<Claims>;
     readonly sessionRepository: SessionRepository;
-  }, never, LifecycleHooks>;
-  makeSqlSignedValidity: (database: Database, mapping: SignedSessionValidityMapping<any, any, any, any>, options: SessionSqlOptions) => Effect.Effect<SignedSessionValidity, never, LifecycleHooks>;
-  makeSqlSessionStepUp: <Claims>(database: Database, mapping: SessionStepUpMapping<Claims, any, any, any, any, any, any, any>, options: SessionSqlOptions) => Effect.Effect<SessionStepUpPersistence<Claims>, never, LifecycleHooks>;
+  }, never, CurrentSessionSql | LifecycleHooks>;
+  makeSqlSignedValidity: (mapping: SignedSessionValidityMapping<any, any, any, any>, options: SessionSqlOptions) => Effect.Effect<SignedSessionValidity, never, CurrentSessionSql | LifecycleHooks>;
+  makeSqlSessionStepUp: <Claims>(mapping: SessionStepUpMapping<Claims, any, any, any, any, any, any, any>, options: SessionSqlOptions) => Effect.Effect<SessionStepUpPersistence<Claims>, never, CurrentSessionSql | LifecycleHooks>;
 };
 //#endregion
 //# sourceMappingURL=session-kernel.d.mts.map

package/dist/internal/session-kernel.mjs

@@ -179,7 +179,9 @@ const makeSessionKernel = (operations) => {
 			})
 		});
 	};
-	const makeSqlAuthenticationAuthority = (database, mapping, options) => Effect.map(LifecycleHooks, (hooks) => {
+	const makeSqlAuthenticationAuthority = Effect.fnUntraced(function* (mapping, options) {
+		const database = yield* CurrentSessionSql;
+		const hooks = yield* LifecycleHooks;
 		const service = {
 			capture: (subjectId, credentialIds) => safeTransaction(inTransaction(database, captureIn(mapping, subjectId, credentialIds, true))),
 			requirements: (evidence) => safeTransaction(inTransaction(database, validateEvidenceIn(mapping, evidence, true).pipe(Effect.map((result) => result.requirement)))),
@@ -233,7 +235,9 @@ const makeSessionKernel = (operations) => {
 		if (DateTime.toEpochMillis(yield* freshNow) >= DateTime.toEpochMillis(record.expiresAt)) return yield* invalidPending();
 		return record;
 	});
-	const makeSqlPendingAuthentication = (database, mapping, options) => Effect.map(LifecycleHooks, (hooks) => {
+	const makeSqlPendingAuthentication = Effect.fnUntraced(function* (mapping, options) {
+		const database = yield* CurrentSessionSql;
+		const hooks = yield* LifecycleHooks;
 		const service = {
 			create: (input, _inputNow, prepare) => owned(database, options, mapping.isConstraintConflict, Effect.gen(function* () {
 				const transaction = yield* CurrentSessionSql;
@@ -302,7 +306,9 @@ const makeSessionKernel = (operations) => {
 		expiresAt: column(mapping.session.table, mapping.session.expiresAt),
 		absoluteExpiresAt: column(mapping.session.table, mapping.session.absoluteExpiresAt)
 	});
-	const makeSqlStatefulSessions = (database, mapping, options) => Effect.map(LifecycleHooks, (hooks) => {
+	const makeSqlStatefulSessions = Effect.fnUntraced(function* (mapping, options) {
+		const database = yield* CurrentSessionSql;
+		const hooks = yield* LifecycleHooks;
 		const c = sessionColumns(mapping);
 		const persistence = {
 			establish: (input, prepare) => owned(database, options, mapping.isConstraintConflict, Effect.gen(function* () {
@@ -449,7 +455,9 @@ const makeSessionKernel = (operations) => {
 			sessionRepository: { list: (input) => repository.list(input).pipe(Effect.provideService(LifecycleHooks, hooks)) }
 		};
 	});
-	const makeSqlSignedValidity = (database, mapping, options) => Effect.map(LifecycleHooks, (hooks) => {
+	const makeSqlSignedValidity = Effect.fnUntraced(function* (mapping, options) {
+		const database = yield* CurrentSessionSql;
+		const hooks = yield* LifecycleHooks;
 		const subject = subjectColumns(mapping);
 		const tombstone = {
 			subjectId: column(mapping.tombstone.table, mapping.tombstone.subjectId),
@@ -580,155 +588,155 @@ const makeSessionKernel = (operations) => {
 		if (cause.reasons.length > 0 && cause.reasons.every((reason) => Cause.isFailReason(reason) && isSqlStepUpRejectAbsence(reason.error))) return Effect.succeed(rejected);
 		return Effect.failCause(Cause.map(cause, (error) => isSqlStepUpRejectAbsence(error) ? unavailable() : error));
 	}));
-	/** Shared implementation; public driver entrypoints restore concrete tables/IDs. */
-	const makeSqlSessionStepUp = (database, mapping, options) => Effect.map(LifecycleHooks, (hooks) => {
-		const m = mapping.intent, c = stepUpColumns(mapping);
-		const read = (digest) => mapFailureCause(safeTransaction(inTransaction(database, readSqlStepUp(mapping, digest, options.locking))), (error) => error._tag === "StaleAuthentication" ? SessionStepUpInvalid.make({}) : error);
-		const service = {
-			create: (input, _now, prepare) => owned(database, options, mapping.isConstraintConflict, Effect.gen(function* () {
-				const tx = yield* CurrentSessionSql;
-				const journal = yield* CurrentCommitJournal;
-				const authority = yield* stepUpAuthority(mapping, input.revision, options.locking);
-				const version = yield* allocate(options.mode, m.allocateVersion, m.allocateVersionSync);
-				const record = {
-					...input,
-					version
-				};
-				yield* stepUpSource(mapping, record, authority.nativeSubjectId, yield* freshNow, options.locking);
-				if ((yield* selectRows(tx.select().from(m.table).where(or(eq(c.digest, input.digest), eq(c.flowId, input.flowId))).limit(1), options.locking)).length > 0) return yield* SessionConflict.make({});
-				const snapshot = yield* encodeStepUpIntent(record);
-				const values = {
-					...m.encodeInsert(record, { subjectId: authority.nativeSubjectId }),
-					...updateValues([
-						[m.digest, record.digest],
-						[m.version, version],
-						[m.flowId, record.flowId],
-						[m.subjectId, authority.nativeSubjectId],
-						[m.bindingDigest, record.bindingDigest],
-						[m.snapshot, snapshot],
-						[m.expiresAt, m.encodeInstant(record.expiresAt)],
-						[m.attemptLimit, record.attemptLimit],
-						[m.failedAttempts, 0],
-						[m.consumed, false]
-					])
-				};
-				const receipt = prepare(record, journal);
-				yield* tx.insert(m.table).values(values).pipe(normalizeMutation(mapping));
-				if ((yield* tx.select().from(m.table).where(and(eq(c.digest, record.digest), eq(c.version, version), eq(c.flowId, record.flowId), eq(c.subjectId, authority.nativeSubjectId), eq(c.bindingDigest, record.bindingDigest), eq(c.snapshot, snapshot), eq(c.expiresAt, m.encodeInstant(record.expiresAt)), eq(c.attemptLimit, record.attemptLimit), eq(c.failedAttempts, 0), eq(c.consumed, false))).limit(1))[0] === void 0) return yield* unavailable();
-				return receipt;
-			})).pipe((effect) => mapFailureCause(effect, (error) => error._tag === "SessionStepUpInvalid" ? stale() : error)),
-			context: (input) => mapFailureCause(read(input.digest).pipe(Effect.flatMap(({ intent }) => snapshotPendingAuthenticationContext({
-				flowId: intent.flowId,
-				bindingDigest: intent.bindingDigest,
-				revision: intent.revision,
-				expiresAtMillis: DateTime.toEpochMillis(intent.expiresAt)
-			}))), (error) => error._tag === "PendingAuthenticationInvalid" ? unavailable() : error),
-			read: (input) => read(input.digest).pipe(Effect.flatMap((value) => value.intent.bindingDigest === input.bindingDigest ? Effect.succeed(value.intent) : Effect.fail(SessionStepUpInvalid.make({})))),
-			reject: (input, prepare) => owned(database, options, mapping.isConstraintConflict, Effect.gen(function* () {
-				const tx = yield* CurrentSessionSql;
-				const journal = yield* CurrentCommitJournal;
-				const selected = yield* recoverSqlStepUpRejectAbsence(readSqlStepUp(mapping, input.digest, options.locking).pipe(Effect.map((value) => ({
-					_tag: "Found",
-					value
-				}))), { _tag: "Rejected" });
-				if (selected._tag === "Rejected") return prepare({ _tag: "Rejected" }, journal);
-				const { row, intent } = selected.value;
-				const receipt = prepare({ _tag: "Rejected" }, journal);
-				yield* tx.update(m.table).set(updateValues([[m.failedAttempts, sql`${c.failedAttempts} + 1`]])).where(and(eq(c.digest, input.digest), eq(c.snapshot, row[m.snapshot]), eq(c.version, intent.version), eq(c.consumed, false), sql`${c.failedAttempts} < ${c.attemptLimit}`));
-				const written = yield* stepUpLocator(mapping, input.digest, false);
-				if (written === void 0 || written[m.version] !== intent.version || written[m.snapshot] !== row[m.snapshot] || written[m.failedAttempts] !== row[m.failedAttempts] + 1) return yield* unavailable();
-				return receipt;
-			})),
-			complete: (plan, prepare) => owned(database, options, mapping.isConstraintConflict, Effect.gen(function* () {
-				const tx = yield* CurrentSessionSql;
-				const journal = yield* CurrentCommitJournal;
-				yield* validateStepUpPlan(plan);
-				const current = yield* stepUpAuthority(mapping, plan.evidence.revision, options.locking);
-				const stored = yield* readSqlStepUp(mapping, plan.intent.digest, options.locking);
-				if ((yield* encodeStepUpIntent(stored.intent)) !== (yield* encodeStepUpIntent(plan.intent))) return yield* SessionStepUpInvalid.make({});
-				const base = yield* assessAuthentication(plan.evidence, current.requirement).pipe(Effect.mapError(() => stale()));
-				const profile = yield* assessAuthentication(plan.evidence, stored.intent.requirement).pipe(Effect.mapError(() => stale()));
-				if (!base.satisfied || !profile.satisfied) return yield* stale();
-				const replacement = plan.replacement, now = yield* freshNow;
-				if (DateTime.toEpochMillis(replacement.inspection.session.expiresAt) > DateTime.toEpochMillis(stored.intent.sourceAbsoluteExpiresAt) || DateTime.toEpochMillis(now) < DateTime.toEpochMillis(replacement.inspection.session.issuedAt) || DateTime.toEpochMillis(now) >= Math.min(DateTime.toEpochMillis(replacement.inspection.session.expiresAt), DateTime.toEpochMillis(stored.intent.expiresAt))) return yield* SessionStepUpInvalid.make({});
-				let rotation;
-				if (replacement._tag === "Stateful") {
-					if (mapping.source.kind !== "Stateful") return yield* SessionStepUpInvalid.make({});
-					const s = mapping.source.session, row = stored.source.row;
-					if (row[s.digest] !== replacement.expectedDigest || row[s.version] !== replacement.expectedRowVersion) return yield* SessionConflict.make({});
-					const version = yield* allocate(options.mode, s.allocateVersion, s.allocateVersionSync);
-					const next = {
-						...replacement.inspection.session,
-						provenance: replacement.inspection.provenance,
-						credentialVersion: replacement.inspection.credentialVersion,
-						digest: replacement.nextDigest,
+	return {
+		makeSqlAuthenticationAuthority,
+		makeSqlPendingAuthentication,
+		makeSqlStatefulSessions,
+		makeSqlSignedValidity,
+		makeSqlSessionStepUp: Effect.fnUntraced(function* (mapping, options) {
+			const database = yield* CurrentSessionSql;
+			const hooks = yield* LifecycleHooks;
+			const m = mapping.intent, c = stepUpColumns(mapping);
+			const read = (digest) => mapFailureCause(safeTransaction(inTransaction(database, readSqlStepUp(mapping, digest, options.locking))), (error) => error._tag === "StaleAuthentication" ? SessionStepUpInvalid.make({}) : error);
+			const service = {
+				create: (input, _now, prepare) => owned(database, options, mapping.isConstraintConflict, Effect.gen(function* () {
+					const tx = yield* CurrentSessionSql;
+					const journal = yield* CurrentCommitJournal;
+					const authority = yield* stepUpAuthority(mapping, input.revision, options.locking);
+					const version = yield* allocate(options.mode, m.allocateVersion, m.allocateVersionSync);
+					const record = {
+						...input,
 						version
 					};
-					rotation = {
-						...s.encodeRotation(next),
+					yield* stepUpSource(mapping, record, authority.nativeSubjectId, yield* freshNow, options.locking);
+					if ((yield* selectRows(tx.select().from(m.table).where(or(eq(c.digest, input.digest), eq(c.flowId, input.flowId))).limit(1), options.locking)).length > 0) return yield* SessionConflict.make({});
+					const snapshot = yield* encodeStepUpIntent(record);
+					const values = {
+						...m.encodeInsert(record, { subjectId: authority.nativeSubjectId }),
 						...updateValues([
-							[s.version, version],
-							[s.digest, next.digest],
-							[s.credentialVersion, next.credentialVersion],
-							[s.authenticatedAt, s.encodeInstant(next.assurance.authenticatedAt)],
-							[s.issuedAt, s.encodeInstant(next.issuedAt)],
-							[s.expiresAt, s.encodeInstant(next.expiresAt)],
-							[s.absoluteExpiresAt, s.encodeInstant(next.absoluteExpiresAt)]
+							[m.digest, record.digest],
+							[m.version, version],
+							[m.flowId, record.flowId],
+							[m.subjectId, authority.nativeSubjectId],
+							[m.bindingDigest, record.bindingDigest],
+							[m.snapshot, snapshot],
+							[m.expiresAt, m.encodeInstant(record.expiresAt)],
+							[m.attemptLimit, record.attemptLimit],
+							[m.failedAttempts, 0],
+							[m.consumed, false]
 						])
 					};
-				}
-				const completionVersion = yield* allocate(options.mode, m.allocateVersion, m.allocateVersionSync);
-				if (completionVersion === stored.intent.version) return yield* unavailable();
-				const completionSnapshot = yield* encodeStepUpIntent({
-					...stored.intent,
-					version: completionVersion
-				});
-				const receipt = prepare(replacement.inspection, journal);
-				if (replacement._tag === "Stateful" && mapping.source.kind === "Stateful") {
-					const s = mapping.source.session, sc = sessionColumns(mapping.source);
-					yield* tx.update(s.table).set(rotation).where(and(eq(sc.sessionId, stored.source.nativeSessionId), eq(sc.digest, replacement.expectedDigest), eq(sc.version, replacement.expectedRowVersion)));
-					const written = (yield* tx.select().from(s.table).where(eq(sc.sessionId, stored.source.nativeSessionId)).limit(1))[0];
-					if (written === void 0 || written[s.version] !== rotation[s.version]) return yield* unavailable();
-					const decoded = yield* s.decode(written);
-					if (decoded.version !== rotation[s.version] || !stepUpRotationMatches(plan, decoded)) return yield* unavailable();
-				} else if (replacement._tag === "StateAssistedSigned" && mapping.source.kind === "StateAssistedSigned") {
-					const t = mapping.source.tombstone;
-					const owner = column(t.table, t.subjectId), id = column(t.table, t.sessionId), expiry = column(t.table, t.absoluteExpiresAt);
-					yield* tx.delete(t.table).where(and(eq(owner, stored.nativeSubjectId), eq(id, stored.source.nativeSessionId), lte(expiry, t.encodeInstant(yield* freshNow))));
-					const values = t.encodeInsert({
-						subjectId: stored.nativeSubjectId,
-						sessionId: stored.source.nativeSessionId,
-						absoluteExpiresAt: replacement.tombstoneUntil
+					const receipt = prepare(record, journal);
+					yield* tx.insert(m.table).values(values).pipe(normalizeMutation(mapping));
+					if ((yield* tx.select().from(m.table).where(and(eq(c.digest, record.digest), eq(c.version, version), eq(c.flowId, record.flowId), eq(c.subjectId, authority.nativeSubjectId), eq(c.bindingDigest, record.bindingDigest), eq(c.snapshot, snapshot), eq(c.expiresAt, m.encodeInstant(record.expiresAt)), eq(c.attemptLimit, record.attemptLimit), eq(c.failedAttempts, 0), eq(c.consumed, false))).limit(1))[0] === void 0) return yield* unavailable();
+					return receipt;
+				})).pipe((effect) => mapFailureCause(effect, (error) => error._tag === "SessionStepUpInvalid" ? stale() : error)),
+				context: (input) => mapFailureCause(read(input.digest).pipe(Effect.flatMap(({ intent }) => snapshotPendingAuthenticationContext({
+					flowId: intent.flowId,
+					bindingDigest: intent.bindingDigest,
+					revision: intent.revision,
+					expiresAtMillis: DateTime.toEpochMillis(intent.expiresAt)
+				}))), (error) => error._tag === "PendingAuthenticationInvalid" ? unavailable() : error),
+				read: (input) => read(input.digest).pipe(Effect.flatMap((value) => value.intent.bindingDigest === input.bindingDigest ? Effect.succeed(value.intent) : Effect.fail(SessionStepUpInvalid.make({})))),
+				reject: (input, prepare) => owned(database, options, mapping.isConstraintConflict, Effect.gen(function* () {
+					const tx = yield* CurrentSessionSql;
+					const journal = yield* CurrentCommitJournal;
+					const selected = yield* recoverSqlStepUpRejectAbsence(readSqlStepUp(mapping, input.digest, options.locking).pipe(Effect.map((value) => ({
+						_tag: "Found",
+						value
+					}))), { _tag: "Rejected" });
+					if (selected._tag === "Rejected") return prepare({ _tag: "Rejected" }, journal);
+					const { row, intent } = selected.value;
+					const receipt = prepare({ _tag: "Rejected" }, journal);
+					yield* tx.update(m.table).set(updateValues([[m.failedAttempts, sql`${c.failedAttempts} + 1`]])).where(and(eq(c.digest, input.digest), eq(c.snapshot, row[m.snapshot]), eq(c.version, intent.version), eq(c.consumed, false), sql`${c.failedAttempts} < ${c.attemptLimit}`));
+					const written = yield* stepUpLocator(mapping, input.digest, false);
+					if (written === void 0 || written[m.version] !== intent.version || written[m.snapshot] !== row[m.snapshot] || written[m.failedAttempts] !== row[m.failedAttempts] + 1) return yield* unavailable();
+					return receipt;
+				})),
+				complete: (plan, prepare) => owned(database, options, mapping.isConstraintConflict, Effect.gen(function* () {
+					const tx = yield* CurrentSessionSql;
+					const journal = yield* CurrentCommitJournal;
+					yield* validateStepUpPlan(plan);
+					const current = yield* stepUpAuthority(mapping, plan.evidence.revision, options.locking);
+					const stored = yield* readSqlStepUp(mapping, plan.intent.digest, options.locking);
+					if ((yield* encodeStepUpIntent(stored.intent)) !== (yield* encodeStepUpIntent(plan.intent))) return yield* SessionStepUpInvalid.make({});
+					const base = yield* assessAuthentication(plan.evidence, current.requirement).pipe(Effect.mapError(() => stale()));
+					const profile = yield* assessAuthentication(plan.evidence, stored.intent.requirement).pipe(Effect.mapError(() => stale()));
+					if (!base.satisfied || !profile.satisfied) return yield* stale();
+					const replacement = plan.replacement, now = yield* freshNow;
+					if (DateTime.toEpochMillis(replacement.inspection.session.expiresAt) > DateTime.toEpochMillis(stored.intent.sourceAbsoluteExpiresAt) || DateTime.toEpochMillis(now) < DateTime.toEpochMillis(replacement.inspection.session.issuedAt) || DateTime.toEpochMillis(now) >= Math.min(DateTime.toEpochMillis(replacement.inspection.session.expiresAt), DateTime.toEpochMillis(stored.intent.expiresAt))) return yield* SessionStepUpInvalid.make({});
+					let rotation;
+					if (replacement._tag === "Stateful") {
+						if (mapping.source.kind !== "Stateful") return yield* SessionStepUpInvalid.make({});
+						const s = mapping.source.session, row = stored.source.row;
+						if (row[s.digest] !== replacement.expectedDigest || row[s.version] !== replacement.expectedRowVersion) return yield* SessionConflict.make({});
+						const version = yield* allocate(options.mode, s.allocateVersion, s.allocateVersionSync);
+						const next = {
+							...replacement.inspection.session,
+							provenance: replacement.inspection.provenance,
+							credentialVersion: replacement.inspection.credentialVersion,
+							digest: replacement.nextDigest,
+							version
+						};
+						rotation = {
+							...s.encodeRotation(next),
+							...updateValues([
+								[s.version, version],
+								[s.digest, next.digest],
+								[s.credentialVersion, next.credentialVersion],
+								[s.authenticatedAt, s.encodeInstant(next.assurance.authenticatedAt)],
+								[s.issuedAt, s.encodeInstant(next.issuedAt)],
+								[s.expiresAt, s.encodeInstant(next.expiresAt)],
+								[s.absoluteExpiresAt, s.encodeInstant(next.absoluteExpiresAt)]
+							])
+						};
+					}
+					const completionVersion = yield* allocate(options.mode, m.allocateVersion, m.allocateVersionSync);
+					if (completionVersion === stored.intent.version) return yield* unavailable();
+					const completionSnapshot = yield* encodeStepUpIntent({
+						...stored.intent,
+						version: completionVersion
 					});
-					yield* tx.insert(t.table).values(values).pipe(normalizeMutation(mapping));
-					if ((yield* tx.select().from(t.table).where(and(eq(owner, stored.nativeSubjectId), eq(id, stored.source.nativeSessionId), eq(expiry, t.encodeInstant(replacement.tombstoneUntil)))).limit(1))[0] === void 0) return yield* unavailable();
-				}
-				yield* tx.update(m.table).set(updateValues([
-					[m.consumed, true],
-					[m.version, completionVersion],
-					[m.snapshot, completionSnapshot]
-				])).where(and(eq(c.digest, stored.intent.digest), eq(c.version, stored.intent.version), eq(c.snapshot, stored.row[m.snapshot]), eq(c.consumed, false), eq(c.failedAttempts, stored.row[m.failedAttempts])));
-				const completed = yield* stepUpLocator(mapping, stored.intent.digest, false);
-				if (completed === void 0 || !completed[m.consumed] || completed[m.version] !== completionVersion || completed[m.snapshot] !== completionSnapshot) return yield* unavailable();
-				const commitNow = yield* freshNow;
-				if (!stepUpIntentLive(stored.intent, mapping.source.kind, commitNow) || DateTime.toEpochMillis(commitNow) >= DateTime.toEpochMillis(replacement.inspection.session.expiresAt) || !(yield* assessAuthentication(plan.evidence, current.requirement).pipe(Effect.mapError(() => stale()))).satisfied || !(yield* assessAuthentication(plan.evidence, stored.intent.requirement).pipe(Effect.mapError(() => stale()))).satisfied) return yield* stale();
-				return receipt;
-			}))
-		};
-		return {
-			create: (input, now, prepare) => service.create(input, now, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),
-			context: (input) => service.context(input).pipe(Effect.provideService(LifecycleHooks, hooks)),
-			read: (input) => service.read(input).pipe(Effect.provideService(LifecycleHooks, hooks)),
-			reject: (input, prepare) => service.reject(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),
-			complete: (plan, prepare) => service.complete(plan, prepare).pipe(Effect.provideService(LifecycleHooks, hooks))
-		};
-	});
-	return {
-		makeSqlAuthenticationAuthority,
-		makeSqlPendingAuthentication,
-		makeSqlStatefulSessions,
-		makeSqlSignedValidity,
-		makeSqlSessionStepUp
+					const receipt = prepare(replacement.inspection, journal);
+					if (replacement._tag === "Stateful" && mapping.source.kind === "Stateful") {
+						const s = mapping.source.session, sc = sessionColumns(mapping.source);
+						yield* tx.update(s.table).set(rotation).where(and(eq(sc.sessionId, stored.source.nativeSessionId), eq(sc.digest, replacement.expectedDigest), eq(sc.version, replacement.expectedRowVersion)));
+						const written = (yield* tx.select().from(s.table).where(eq(sc.sessionId, stored.source.nativeSessionId)).limit(1))[0];
+						if (written === void 0 || written[s.version] !== rotation[s.version]) return yield* unavailable();
+						const decoded = yield* s.decode(written);
+						if (decoded.version !== rotation[s.version] || !stepUpRotationMatches(plan, decoded)) return yield* unavailable();
+					} else if (replacement._tag === "StateAssistedSigned" && mapping.source.kind === "StateAssistedSigned") {
+						const t = mapping.source.tombstone;
+						const owner = column(t.table, t.subjectId), id = column(t.table, t.sessionId), expiry = column(t.table, t.absoluteExpiresAt);
+						yield* tx.delete(t.table).where(and(eq(owner, stored.nativeSubjectId), eq(id, stored.source.nativeSessionId), lte(expiry, t.encodeInstant(yield* freshNow))));
+						const values = t.encodeInsert({
+							subjectId: stored.nativeSubjectId,
+							sessionId: stored.source.nativeSessionId,
+							absoluteExpiresAt: replacement.tombstoneUntil
+						});
+						yield* tx.insert(t.table).values(values).pipe(normalizeMutation(mapping));
+						if ((yield* tx.select().from(t.table).where(and(eq(owner, stored.nativeSubjectId), eq(id, stored.source.nativeSessionId), eq(expiry, t.encodeInstant(replacement.tombstoneUntil)))).limit(1))[0] === void 0) return yield* unavailable();
+					}
+					yield* tx.update(m.table).set(updateValues([
+						[m.consumed, true],
+						[m.version, completionVersion],
+						[m.snapshot, completionSnapshot]
+					])).where(and(eq(c.digest, stored.intent.digest), eq(c.version, stored.intent.version), eq(c.snapshot, stored.row[m.snapshot]), eq(c.consumed, false), eq(c.failedAttempts, stored.row[m.failedAttempts])));
+					const completed = yield* stepUpLocator(mapping, stored.intent.digest, false);
+					if (completed === void 0 || !completed[m.consumed] || completed[m.version] !== completionVersion || completed[m.snapshot] !== completionSnapshot) return yield* unavailable();
+					const commitNow = yield* freshNow;
+					if (!stepUpIntentLive(stored.intent, mapping.source.kind, commitNow) || DateTime.toEpochMillis(commitNow) >= DateTime.toEpochMillis(replacement.inspection.session.expiresAt) || !(yield* assessAuthentication(plan.evidence, current.requirement).pipe(Effect.mapError(() => stale()))).satisfied || !(yield* assessAuthentication(plan.evidence, stored.intent.requirement).pipe(Effect.mapError(() => stale()))).satisfied) return yield* stale();
+					return receipt;
+				}))
+			};
+			return {
+				create: (input, now, prepare) => service.create(input, now, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),
+				context: (input) => service.context(input).pipe(Effect.provideService(LifecycleHooks, hooks)),
+				read: (input) => service.read(input).pipe(Effect.provideService(LifecycleHooks, hooks)),
+				reject: (input, prepare) => service.reject(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),
+				complete: (plan, prepare) => service.complete(plan, prepare).pipe(Effect.provideService(LifecycleHooks, hooks))
+			};
+		})
 	};
 };
 //#endregion