@yielded/auth-persistence 0.1.0-beta.10

package/dist/internal/session-kernel.mjs

@@ -0,0 +1,737 @@
+import { PersistenceMappingError, isMappedConstraintConflict } from "./mapping-error.mjs";
+import { decodeStepUpIntent, encodeStepUpIntent, sameStepUpRevision, stepUpIntentLive, stepUpRotationMatches, validateStepUpPlan } from "./step-up-state.mjs";
+import { Cause, Context, DateTime, Effect, Option, Schema } from "effect";
+import { CurrentCommitJournal, LifecycleHooks, coordinateCommit, hasCommitScope } from "@yielded/auth/Hooks";
+import { PendingAuthenticationInvalid, SessionConflict, SessionInvalid, SessionMetadata, SessionStepUpInvalid, SessionUnavailable, StaleAuthentication, assessAuthentication, pendingAuthenticationContext, snapshotPendingAuthenticationContext, snapshotSessionAuthenticationProvenance } from "@yielded/auth/Sessions";
+import { reportPersistenceFailure } from "@yielded/auth/Persistence";
+//#region src/internal/session-kernel.ts
+/** Native SQL authority for the current transaction or savepoint. */
+var CurrentSessionSql = class extends Context.Service()("effect-auth/drizzle/CurrentSessionSql") {};
+const makeSessionKernel = (operations) => {
+	const { and, eq, gt, lte, inArray, or, sql, column, updateValues } = operations;
+	const unavailable = () => SessionUnavailable.make({});
+	const stale = () => StaleAuthentication.make({});
+	const invalidPending = () => PendingAuthenticationInvalid.make({});
+	const invalidSession = () => SessionInvalid.make({});
+	const mapFailureCause = (effect, map) => Effect.catchCause(effect, (cause) => Effect.failCause(Cause.map(cause, map)));
+	const isExpectedMutationError = (error) => {
+		const tag = typeof error === "object" && error !== null ? Reflect.get(error, "_tag") : void 0;
+		return tag === "SessionStepUpInvalid" || tag === "StaleAuthentication" || tag === "PendingAuthenticationInvalid" || tag === "SessionConflict" || tag === "SessionInvalid" || tag === "SessionUnavailable";
+	};
+	const normalizeMutation = (mapping) => (effect) => effect.pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, (error) => isMappedConstraintConflict(mapping.isConstraintConflict, error) ? SessionConflict.make({}) : error))));
+	const safeTransaction = (effect) => reportPersistenceFailure(effect, isExpectedMutationError).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, (error) => isExpectedMutationError(error) ? error : unavailable()))));
+	const selectRows = (query, locking) => locking && typeof query.for === "function" ? query.for("update") : query;
+	const inTransaction = (database, effect) => Effect.suspend(() => database.transaction((current) => effect.pipe(Effect.provideService(CurrentSessionSql, current))));
+	const owned = (database, options, isConstraintConflict, body) => {
+		const run = coordinateCommit(() => database.transaction((current) => body.pipe(Effect.provideService(CurrentSessionSql, current))), { mode: options.mode }).pipe((effect) => reportPersistenceFailure(effect, (error) => isExpectedMutationError(error) || isMappedConstraintConflict(isConstraintConflict, error)), Effect.map((result) => result.value), Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, (error) => isExpectedMutationError(error) ? error : unavailable()))));
+		return Effect.gen(function* () {
+			const current = yield* Effect.serviceOption(CurrentSessionSql);
+			if (!(Option.isSome(current) && current.value === database)) {
+				if (yield* hasCommitScope) return yield* unavailable();
+				yield* options.standaloneGuard;
+			}
+			return yield* run;
+		});
+	};
+	const uniqueStrings = (values) => [...new Set(values)].sort();
+	const preservesRevision = (completed, original) => {
+		const current = new Map(completed.revision.credentials.map((item) => [item.credentialId, item.revision]));
+		return completed.flowId === original.flowId && completed.bindingDigest === original.bindingDigest && completed.revision.subjectId === original.revision.subjectId && completed.revision.securityRevision === original.revision.securityRevision && original.revision.credentials.every((item) => current.get(item.credentialId) === item.revision) && original.proofs.every((expected) => completed.proofs.some((proof) => proof.method === expected.method && proof.credentialId === expected.credentialId && proof.userVerified === expected.userVerified && proof.phishingResistant === expected.phishingResistant && DateTime.toEpochMillis(proof.verifiedAt) === DateTime.toEpochMillis(expected.verifiedAt) && proof.factors.length === expected.factors.length && proof.factors.every((factor, index) => factor === expected.factors[index])));
+	};
+	const authorityColumns = (mapping) => ({
+		subjectId: column(mapping.subject.table, mapping.subject.id),
+		subjectStatus: column(mapping.subject.table, mapping.subject.status),
+		subjectRevision: column(mapping.subject.table, mapping.subject.securityRevision),
+		credentialSubjectId: column(mapping.credential.table, mapping.credential.subjectId),
+		credentialId: column(mapping.credential.table, mapping.credential.credentialId),
+		credentialRevision: column(mapping.credential.table, mapping.credential.revision),
+		...mapping.credential.status === void 0 ? {} : { credentialStatus: column(mapping.credential.table, mapping.credential.status) }
+	});
+	const subjectColumns = (mapping) => ({
+		subjectId: column(mapping.subject.table, mapping.subject.id),
+		subjectStatus: column(mapping.subject.table, mapping.subject.status),
+		subjectRevision: column(mapping.subject.table, mapping.subject.securityRevision)
+	});
+	const readSubject = Effect.fn("DrizzleSession.readSubject")(function* (mapping, nativeSubjectId, locking) {
+		const database = yield* CurrentSessionSql;
+		const columns = subjectColumns(mapping);
+		return yield* selectRows(database.select().from(mapping.subject.table).where(eq(columns.subjectId, nativeSubjectId)).limit(1), locking);
+	});
+	const captureDetailsIn = Effect.fn("DrizzleSession.captureDetails")(function* (mapping, subjectId, credentialIds, locking) {
+		const database = yield* CurrentSessionSql;
+		const requested = uniqueStrings(credentialIds);
+		if (requested.length !== credentialIds.length) return yield* stale();
+		const nativeSubjectId = yield* mapping.subjectId.toNative(subjectId);
+		const subject = (yield* readSubject(mapping, nativeSubjectId, locking))[0];
+		const columns = authorityColumns(mapping);
+		if (subject === void 0 || !mapping.subject.isActiveStatus(subject[mapping.subject.status])) return yield* stale();
+		const query = database.select().from(mapping.credential.table).where(and(eq(columns.credentialSubjectId, nativeSubjectId), requested.length === 0 ? sql`false` : inArray(columns.credentialId, requested))).orderBy(columns.credentialId);
+		const credentialRows = requested.length === 0 ? [] : yield* selectRows(query, locking);
+		if (credentialRows.length !== requested.length) return yield* stale();
+		const credentials = credentialRows.map((row) => ({
+			credentialId: row[mapping.credential.credentialId],
+			revision: row[mapping.credential.revision],
+			active: mapping.credential.status === void 0 || mapping.credential.isActiveStatus?.(row[mapping.credential.status]) === true
+		})).sort((left, right) => left.credentialId.localeCompare(right.credentialId));
+		if (credentials.some((item) => !item.active)) return yield* stale();
+		return {
+			subject,
+			revision: {
+				subjectId,
+				securityRevision: subject[mapping.subject.securityRevision],
+				credentials: credentials.map(({ credentialId, revision }) => ({
+					credentialId,
+					revision
+				}))
+			}
+		};
+	});
+	const captureIn = Effect.fn("DrizzleSession.capture")(function* (mapping, subjectId, credentialIds, locking) {
+		return (yield* captureDetailsIn(mapping, subjectId, credentialIds, locking)).revision;
+	});
+	const validateEvidenceIn = Effect.fn("DrizzleSession.validateEvidence")(function* (mapping, evidence, locking) {
+		const captured = yield* captureDetailsIn(mapping, evidence.revision.subjectId, evidence.revision.credentials.map((item) => item.credentialId), locking);
+		if (captured.revision.securityRevision !== evidence.revision.securityRevision || captured.revision.credentials.length !== evidence.revision.credentials.length || captured.revision.credentials.some((item, index) => {
+			const expected = [...evidence.revision.credentials].sort((a, b) => a.credentialId.localeCompare(b.credentialId))[index];
+			return expected === void 0 || expected.credentialId !== item.credentialId || expected.revision !== item.revision;
+		})) return yield* stale();
+		return {
+			nativeSubjectId: yield* mapping.subjectId.toNative(evidence.revision.subjectId),
+			requirement: yield* mapping.subject.decodeRequirement(captured.subject)
+		};
+	});
+	const flowColumns = (mapping) => ({
+		flowId: column(mapping.flow.table, mapping.flow.flowId),
+		subjectId: column(mapping.flow.table, mapping.flow.subjectId),
+		state: column(mapping.flow.table, mapping.flow.state),
+		pendingDigest: column(mapping.flow.table, mapping.flow.pendingDigest),
+		dedupUntil: column(mapping.flow.table, mapping.flow.dedupUntil)
+	});
+	const readFlow = Effect.fn("DrizzleSession.readFlow")(function* (mapping, flowId, locking) {
+		const database = yield* CurrentSessionSql;
+		const columns = flowColumns(mapping);
+		return yield* selectRows(database.select().from(mapping.flow.table).where(eq(columns.flowId, flowId)).limit(1), locking);
+	});
+	const ensureDirectFlowAvailable = Effect.fn("DrizzleSession.ensureFlowAvailable")(function* (mapping, evidence, nativeSubjectId, dedupUntil) {
+		const database = yield* CurrentSessionSql;
+		const existing = (yield* readFlow(mapping, evidence.flowId, true))[0];
+		if (existing !== void 0) {
+			const now = yield* freshNow;
+			if (DateTime.toEpochMillis(now) < DateTime.toEpochMillis(yield* mapping.flow.decodeInstant(existing[mapping.flow.dedupUntil]))) return yield* SessionConflict.make({});
+			if (mapping.pending !== void 0) yield* database.delete(mapping.pending.table).where(eq(column(mapping.pending.table, mapping.pending.flowId), evidence.flowId));
+			yield* database.delete(mapping.flow.table).where(eq(flowColumns(mapping).flowId, evidence.flowId));
+		}
+		return mapping.flow.encodeEstablishedInsert({
+			evidence,
+			subjectId: nativeSubjectId,
+			dedupUntil
+		});
+	});
+	const pendingColumns = (mapping) => ({
+		digest: column(mapping.pending.table, mapping.pending.digest),
+		version: column(mapping.pending.table, mapping.pending.version),
+		flowId: column(mapping.pending.table, mapping.pending.flowId),
+		subjectId: column(mapping.pending.table, mapping.pending.subjectId),
+		bindingDigest: column(mapping.pending.table, mapping.pending.bindingDigest),
+		expiresAt: column(mapping.pending.table, mapping.pending.expiresAt),
+		attemptLimit: column(mapping.pending.table, mapping.pending.attemptLimit),
+		failedAttempts: column(mapping.pending.table, mapping.pending.failedAttempts),
+		consumed: column(mapping.pending.table, mapping.pending.consumed)
+	});
+	const readPending = Effect.fn("DrizzleSession.readPending")(function* (mapping, digest, locking) {
+		const database = yield* CurrentSessionSql;
+		return yield* selectRows(database.select().from(mapping.pending.table).where(eq(pendingColumns(mapping).digest, digest)).limit(1), locking);
+	});
+	const validatePending = Effect.fn("DrizzleSession.validatePending")(function* (mapping, input, projection = "record") {
+		const row = (yield* readPending(mapping, input.digest, true))[0];
+		if (row === void 0) return yield* invalidPending();
+		const record = yield* (projection === "context" ? mapping.pending.decodeContext : mapping.pending.decode)(row);
+		const failedAttempts = Number(row[mapping.pending.failedAttempts]);
+		if (record.version !== input.version || record.evidence.flowId !== input.flowId || record.evidence.bindingDigest !== input.bindingDigest || row[mapping.pending.consumed] !== false || failedAttempts >= record.attemptLimit) return yield* invalidPending();
+		const flow = (yield* readFlow(mapping, input.flowId, true))[0];
+		if (flow === void 0 || flow[mapping.flow.state] !== mapping.flow.pendingStateValue || flow[mapping.flow.pendingDigest] !== input.digest) return yield* invalidPending();
+		if (DateTime.toEpochMillis(yield* freshNow) >= DateTime.toEpochMillis(record.expiresAt)) return yield* invalidPending();
+		return record;
+	});
+	const consumePending = Effect.fn("DrizzleSession.consumePending")(function* (mapping, input, until) {
+		const database = yield* CurrentSessionSql;
+		yield* Effect.all([database.update(mapping.pending.table).set(updateValues([[mapping.pending.consumed, true]])).where(and(eq(pendingColumns(mapping).digest, input.digest), eq(pendingColumns(mapping).version, input.version), eq(pendingColumns(mapping).consumed, false))), database.update(mapping.flow.table).set(updateValues([
+			[mapping.flow.state, mapping.flow.establishedStateValue],
+			[mapping.flow.pendingDigest, null],
+			[mapping.flow.dedupUntil, mapping.flow.encodeInstant(until)]
+		])).where(eq(flowColumns(mapping).flowId, input.flowId))]);
+	});
+	const freshNow = DateTime.now;
+	const allocate = (mode, asynchronous, synchronous) => {
+		if (mode === "synchronous") return synchronous === void 0 ? Effect.fail(unavailable()) : Effect.try({
+			try: synchronous,
+			catch: (cause) => PersistenceMappingError.make({
+				operation: "allocate",
+				cause
+			})
+		});
+		if (asynchronous !== void 0) return asynchronous;
+		return synchronous === void 0 ? Effect.fail(unavailable()) : Effect.try({
+			try: synchronous,
+			catch: (cause) => PersistenceMappingError.make({
+				operation: "allocate",
+				cause
+			})
+		});
+	};
+	const makeSqlAuthenticationAuthority = (database, mapping, options) => Effect.map(LifecycleHooks, (hooks) => {
+		const service = {
+			capture: (subjectId, credentialIds) => safeTransaction(inTransaction(database, captureIn(mapping, subjectId, credentialIds, true))),
+			requirements: (evidence) => safeTransaction(inTransaction(database, validateEvidenceIn(mapping, evidence, true).pipe(Effect.map((result) => result.requirement)))),
+			approve: (input, prepare) => owned(database, options, mapping.isConstraintConflict, Effect.gen(function* () {
+				const journal = yield* CurrentCommitJournal;
+				const { requirement } = yield* validateEvidenceIn(mapping, input.evidence, true);
+				if (input.pending === void 0) {
+					const assessed = yield* assessAuthentication(input.evidence, requirement).pipe(Effect.mapError(unavailable));
+					const now = yield* freshNow;
+					if (!assessed.satisfied || DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(input.expiresAt) || DateTime.toEpochMillis(input.expiresAt) > DateTime.toEpochMillis(input.absoluteExpiresAt)) return yield* stale();
+					return prepare(void 0, journal);
+				}
+				if (mapping.pending === void 0) return yield* invalidPending();
+				const pendingMapping = {
+					...mapping,
+					...mapping.pending
+				};
+				const pending = yield* validatePending(pendingMapping, input.pending);
+				if (!preservesRevision(input.evidence, pending.evidence)) return yield* invalidPending();
+				const assessed = yield* assessAuthentication(input.evidence, requirement).pipe(Effect.mapError(unavailable));
+				const now = yield* freshNow;
+				if (!assessed.satisfied || DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(pending.expiresAt) || DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(input.expiresAt) || DateTime.toEpochMillis(input.expiresAt) > DateTime.toEpochMillis(input.absoluteExpiresAt)) return yield* stale();
+				const receipt = prepare(void 0, journal);
+				yield* consumePending(pendingMapping, input.pending, input.absoluteExpiresAt);
+				return receipt;
+			}))
+		};
+		return {
+			capture: (subjectId, credentialIds) => service.capture(subjectId, credentialIds).pipe(Effect.provideService(LifecycleHooks, hooks)),
+			requirements: (evidence) => service.requirements(evidence).pipe(Effect.provideService(LifecycleHooks, hooks)),
+			approve: (input, prepare) => service.approve(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks))
+		};
+	});
+	/** The same locked security checks serve full consumption reads and the
+	* claims-free additional-factor context. No lock spans proof verification. */
+	const readAuthenticatedPending = Effect.fn("DrizzleSession.readAuthenticatedPending")(function* (mapping, input, projection) {
+		const initial = (yield* readPending(mapping, input.digest, false))[0];
+		if (initial === void 0) return yield* invalidPending();
+		const initialNativeSubjectId = initial[mapping.pending.subjectId];
+		if ((yield* readSubject(mapping, initialNativeSubjectId, true))[0] === void 0) return yield* invalidPending();
+		const current = (yield* readPending(mapping, input.digest, true))[0];
+		if (current === void 0 || !mapping.subjectId.equals(current[mapping.pending.subjectId], initialNativeSubjectId)) return yield* invalidPending();
+		const record = yield* (projection === "context" ? mapping.pending.decodeContext : mapping.pending.decode)(current);
+		const nativeSubjectId = yield* mapping.subjectId.toNative(record.evidence.revision.subjectId);
+		const failedAttempts = Number(current[mapping.pending.failedAttempts]);
+		if (!mapping.subjectId.equals(nativeSubjectId, initialNativeSubjectId) || input.bindingDigest !== void 0 && record.evidence.bindingDigest !== input.bindingDigest || current[mapping.pending.version] !== record.version || current[mapping.pending.flowId] !== record.evidence.flowId || current[mapping.pending.bindingDigest] !== record.evidence.bindingDigest || current[mapping.pending.consumed] !== false || failedAttempts >= record.attemptLimit) return yield* invalidPending();
+		const flow = (yield* readFlow(mapping, record.evidence.flowId, true))[0];
+		if (flow === void 0 || flow[mapping.flow.state] !== mapping.flow.pendingStateValue || flow[mapping.flow.pendingDigest] !== input.digest) return yield* invalidPending();
+		const { requirement } = yield* mapFailureCause(validateEvidenceIn(mapping, record.evidence, true), (error) => Schema.is(StaleAuthentication)(error) ? invalidPending() : error);
+		yield* assessAuthentication(record.evidence, requirement).pipe(Effect.mapError(() => invalidPending()));
+		if (DateTime.toEpochMillis(yield* freshNow) >= DateTime.toEpochMillis(record.expiresAt)) return yield* invalidPending();
+		return record;
+	});
+	const makeSqlPendingAuthentication = (database, mapping, options) => Effect.map(LifecycleHooks, (hooks) => {
+		const service = {
+			create: (input, _inputNow, prepare) => owned(database, options, mapping.isConstraintConflict, Effect.gen(function* () {
+				const transaction = yield* CurrentSessionSql;
+				const journal = yield* CurrentCommitJournal;
+				const { nativeSubjectId, requirement } = yield* validateEvidenceIn(mapping, input.evidence, true);
+				const existing = (yield* readFlow(mapping, input.evidence.flowId, true))[0];
+				if (existing !== void 0) {
+					const dedupUntil = yield* mapping.flow.decodeInstant(existing[mapping.flow.dedupUntil]);
+					if (DateTime.toEpochMillis(yield* freshNow) < DateTime.toEpochMillis(dedupUntil)) return yield* SessionConflict.make({});
+					yield* transaction.delete(mapping.pending.table).where(eq(pendingColumns(mapping).flowId, input.evidence.flowId));
+					yield* transaction.delete(mapping.flow.table).where(eq(flowColumns(mapping).flowId, input.evidence.flowId));
+				}
+				const version = yield* allocate(options.mode, mapping.pending.allocateVersion, mapping.pending.allocateVersionSync);
+				yield* assessAuthentication(input.evidence, requirement);
+				const now = yield* freshNow;
+				if (DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(input.expiresAt)) return yield* stale();
+				const record = {
+					...input,
+					version
+				};
+				const receipt = prepare(record, journal);
+				yield* transaction.insert(mapping.flow.table).values(mapping.flow.encodePendingInsert({
+					evidence: input.evidence,
+					subjectId: nativeSubjectId,
+					pendingDigest: input.digest,
+					dedupUntil: input.expiresAt
+				}));
+				yield* transaction.insert(mapping.pending.table).values(mapping.pending.encodeInsert(record, {
+					subjectId: nativeSubjectId,
+					failedAttempts: 0,
+					consumed: false
+				}));
+				return receipt;
+			}).pipe(normalizeMutation(mapping))),
+			context: (input) => safeTransaction(inTransaction(database, readAuthenticatedPending(mapping, input, "context"))).pipe(Effect.flatMap(pendingAuthenticationContext)),
+			read: (input) => safeTransaction(inTransaction(database, readAuthenticatedPending(mapping, input, "record"))).pipe(Effect.map((record) => record)),
+			reject: (input, prepare) => owned(database, options, mapping.isConstraintConflict, Effect.gen(function* () {
+				const transaction = yield* CurrentSessionSql;
+				const journal = yield* CurrentCommitJournal;
+				const initial = (yield* readPending(mapping, input.digest, false))[0];
+				if (initial === void 0) return prepare({ _tag: "Rejected" }, journal);
+				const record = yield* mapping.pending.decodeContext(initial);
+				const nativeSubjectId = yield* mapping.subjectId.toNative(record.evidence.revision.subjectId);
+				const subject = (yield* readSubject(mapping, nativeSubjectId, true))[0];
+				const current = (yield* readPending(mapping, input.digest, true))[0];
+				const now = yield* freshNow;
+				const receipt = prepare({ _tag: "Rejected" }, journal);
+				if (subject !== void 0 && mapping.subject.isActiveStatus(subject[mapping.subject.status]) && subject[mapping.subject.securityRevision] === record.evidence.revision.securityRevision && current !== void 0 && current[mapping.pending.consumed] === false && record.evidence.bindingDigest === input.bindingDigest && DateTime.toEpochMillis(now) < DateTime.toEpochMillis(record.expiresAt)) yield* transaction.update(mapping.pending.table).set(updateValues([[mapping.pending.failedAttempts, sql`case when ${pendingColumns(mapping).failedAttempts} < ${pendingColumns(mapping).attemptLimit} then ${pendingColumns(mapping).failedAttempts} + 1 else ${pendingColumns(mapping).failedAttempts} end`]])).where(eq(pendingColumns(mapping).digest, input.digest));
+				return receipt;
+			}))
+		};
+		return {
+			create: (input, now, prepare) => service.create(input, now, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),
+			context: (input) => service.context(input).pipe(Effect.provideService(LifecycleHooks, hooks)),
+			read: (input) => service.read(input).pipe(Effect.provideService(LifecycleHooks, hooks)),
+			reject: (input, prepare) => service.reject(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks))
+		};
+	});
+	const sessionColumns = (mapping) => ({
+		sessionId: column(mapping.session.table, mapping.session.sessionId),
+		subjectId: column(mapping.session.table, mapping.session.subjectId),
+		digest: column(mapping.session.table, mapping.session.digest),
+		version: column(mapping.session.table, mapping.session.version),
+		securityRevision: column(mapping.session.table, mapping.session.securityRevision),
+		issuedAt: column(mapping.session.table, mapping.session.issuedAt),
+		expiresAt: column(mapping.session.table, mapping.session.expiresAt),
+		absoluteExpiresAt: column(mapping.session.table, mapping.session.absoluteExpiresAt)
+	});
+	const makeSqlStatefulSessions = (database, mapping, options) => Effect.map(LifecycleHooks, (hooks) => {
+		const c = sessionColumns(mapping);
+		const persistence = {
+			establish: (input, prepare) => owned(database, options, mapping.isConstraintConflict, Effect.gen(function* () {
+				const transaction = yield* CurrentSessionSql;
+				const journal = yield* CurrentCommitJournal;
+				const { nativeSubjectId, requirement } = yield* validateEvidenceIn(mapping, input.evidence, true);
+				let flowInsert;
+				let pendingExpiresAt;
+				if (input.pending === void 0) flowInsert = yield* ensureDirectFlowAvailable(mapping, input.evidence, nativeSubjectId, input.session.absoluteExpiresAt);
+				else {
+					if (mapping.pending === void 0) return yield* invalidPending();
+					const pending = yield* validatePending(mapping, input.pending);
+					if (!preservesRevision(input.evidence, pending.evidence)) return yield* invalidPending();
+					pendingExpiresAt = pending.expiresAt;
+				}
+				const nativeSessionId = yield* allocate(options.mode, mapping.session.allocateId, mapping.session.allocateIdSync);
+				const sessionId = yield* mapping.sessionId.toSession(nativeSessionId);
+				const version = yield* allocate(options.mode, mapping.session.allocateVersion, mapping.session.allocateVersionSync);
+				const assessed = yield* assessAuthentication(input.evidence, requirement);
+				const now = yield* freshNow;
+				if (!assessed.satisfied || pendingExpiresAt !== void 0 && DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(pendingExpiresAt) || DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(input.session.expiresAt) || DateTime.toEpochMillis(input.session.expiresAt) > DateTime.toEpochMillis(input.session.absoluteExpiresAt)) return yield* stale();
+				const record = {
+					...input.session,
+					sessionId,
+					version,
+					subjectId: input.evidence.revision.subjectId,
+					securityRevision: input.evidence.revision.securityRevision,
+					assurance: assessed.assurance,
+					provenance: yield* snapshotSessionAuthenticationProvenance({ evidence: input.evidence }),
+					issuedAt: now
+				};
+				const receipt = prepare(record, journal);
+				if (flowInsert !== void 0) yield* transaction.insert(mapping.flow.table).values(flowInsert);
+				else yield* consumePending({
+					...mapping,
+					pending: mapping.pending
+				}, input.pending, input.session.absoluteExpiresAt);
+				yield* transaction.insert(mapping.session.table).values(mapping.session.encodeInsert(record, {
+					subjectId: nativeSubjectId,
+					sessionId: nativeSessionId
+				}));
+				return receipt;
+			}).pipe(normalizeMutation(mapping))),
+			verify: (input) => safeTransaction(inTransaction(database, Effect.gen(function* () {
+				const row = (yield* (yield* CurrentSessionSql).select().from(mapping.session.table).where(eq(c.digest, input.digest)).limit(1))[0];
+				if (row === void 0) return yield* invalidSession();
+				const record = yield* mapping.session.decode(row);
+				const nativeSubjectId = yield* mapping.subjectId.toNative(record.subjectId);
+				const subject = (yield* readSubject(mapping, nativeSubjectId, false))[0];
+				const now = yield* freshNow;
+				if (subject === void 0 || !mapping.subject.isActiveStatus(subject[mapping.subject.status]) || subject[mapping.subject.securityRevision] !== record.securityRevision || DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(record.expiresAt) || DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(record.absoluteExpiresAt)) return yield* invalidSession();
+				return record;
+			}))),
+			rotate: (input, prepare) => owned(database, options, mapping.isConstraintConflict, Effect.gen(function* () {
+				const transaction = yield* CurrentSessionSql;
+				const journal = yield* CurrentCommitJournal;
+				const nativeSessionId = yield* mapping.sessionId.toNative(input.sessionId);
+				const initial = (yield* transaction.select().from(mapping.session.table).where(eq(c.sessionId, nativeSessionId)).limit(1))[0];
+				if (initial === void 0) return yield* SessionConflict.make({});
+				const initialRecord = yield* mapping.session.decode(initial);
+				const nativeSubjectId = yield* mapping.subjectId.toNative(initialRecord.subjectId);
+				const subject = (yield* readSubject(mapping, nativeSubjectId, true))[0];
+				const row = (yield* selectRows(transaction.select().from(mapping.session.table).where(eq(c.sessionId, nativeSessionId)).limit(1), options.locking))[0];
+				if (row === void 0) return yield* SessionConflict.make({});
+				const record = yield* mapping.session.decode(row);
+				const version = yield* allocate(options.mode, mapping.session.allocateVersion, mapping.session.allocateVersionSync);
+				const now = yield* freshNow;
+				if (subject === void 0 || !mapping.subject.isActiveStatus(subject[mapping.subject.status]) || subject[mapping.subject.securityRevision] !== input.expectedSecurityRevision || record.securityRevision !== input.expectedSecurityRevision || record.digest !== input.expectedDigest || record.version !== input.expectedVersion || DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(record.expiresAt) || DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(record.absoluteExpiresAt) || DateTime.toEpochMillis(input.nextExpiresAt) > DateTime.toEpochMillis(record.absoluteExpiresAt) || DateTime.toEpochMillis(input.nextExpiresAt) <= DateTime.toEpochMillis(now)) return yield* SessionConflict.make({});
+				const next = {
+					...record,
+					digest: input.nextDigest,
+					credentialVersion: input.nextCredentialVersion,
+					version,
+					issuedAt: now,
+					expiresAt: input.nextExpiresAt
+				};
+				const receipt = prepare(next, journal);
+				yield* transaction.update(mapping.session.table).set(mapping.session.encodeRotation(next)).where(and(eq(c.sessionId, nativeSessionId), eq(c.digest, input.expectedDigest), eq(c.version, input.expectedVersion)));
+				return receipt;
+			})),
+			revokeDigest: (digest, prepare) => owned(database, options, mapping.isConstraintConflict, Effect.gen(function* () {
+				const transaction = yield* CurrentSessionSql;
+				const journal = yield* CurrentCommitJournal;
+				const initial = (yield* transaction.select().from(mapping.session.table).where(eq(c.digest, digest)).limit(1))[0];
+				if (initial === void 0) return prepare(false, journal);
+				const record = yield* mapping.session.decode(initial);
+				const nativeSubjectId = yield* mapping.subjectId.toNative(record.subjectId);
+				yield* readSubject(mapping, nativeSubjectId, true);
+				const row = (yield* selectRows(transaction.select().from(mapping.session.table).where(eq(c.digest, digest)).limit(1), options.locking))[0];
+				const receipt = prepare(row !== void 0, journal);
+				if (row !== void 0) yield* transaction.delete(mapping.session.table).where(eq(c.digest, digest));
+				return receipt;
+			})),
+			revoke: (input, prepare) => owned(database, options, mapping.isConstraintConflict, Effect.gen(function* () {
+				const transaction = yield* CurrentSessionSql;
+				const journal = yield* CurrentCommitJournal;
+				const nativeSubjectId = yield* mapping.subjectId.toNative(input.subjectId);
+				const subject = (yield* readSubject(mapping, nativeSubjectId, true))[0];
+				if (subject === void 0 || !mapping.subject.isActiveStatus(subject[mapping.subject.status]) || subject[mapping.subject.securityRevision] !== input.expectedSecurityRevision) return yield* stale();
+				const nativeSessionId = yield* mapping.sessionId.toNative(input.sessionId);
+				const receipt = prepare(void 0, journal);
+				yield* transaction.delete(mapping.session.table).where(and(eq(c.subjectId, nativeSubjectId), eq(c.sessionId, nativeSessionId)));
+				return receipt;
+			})),
+			revokeAll: (input, prepare) => owned(database, options, mapping.isConstraintConflict, Effect.gen(function* () {
+				const transaction = yield* CurrentSessionSql;
+				const journal = yield* CurrentCommitJournal;
+				const nativeSubjectId = yield* mapping.subjectId.toNative(input.subjectId);
+				const subject = (yield* readSubject(mapping, nativeSubjectId, true))[0];
+				if (subject === void 0 || !mapping.subject.isActiveStatus(subject[mapping.subject.status]) || subject[mapping.subject.securityRevision] !== input.expectedSecurityRevision) return yield* stale();
+				const nextRevisionSync = mapping.subject.nextSecurityRevisionSync;
+				const next = yield* allocate(options.mode, mapping.subject.nextSecurityRevision?.(input.expectedSecurityRevision), nextRevisionSync === void 0 ? void 0 : () => nextRevisionSync(input.expectedSecurityRevision));
+				const receipt = prepare(void 0, journal);
+				yield* transaction.update(mapping.subject.table).set(updateValues([[mapping.subject.securityRevision, next]])).where(and(eq(authorityColumns(mapping).subjectId, nativeSubjectId), eq(authorityColumns(mapping).subjectRevision, input.expectedSecurityRevision)));
+				yield* transaction.delete(mapping.session.table).where(eq(c.subjectId, nativeSubjectId));
+				return receipt;
+			}))
+		};
+		const repository = { list: (input) => safeTransaction(inTransaction(database, Effect.gen(function* () {
+			const read = yield* CurrentSessionSql;
+			const nativeSubjectId = yield* mapping.subjectId.toNative(input.subjectId);
+			const subject = (yield* readSubject(mapping, nativeSubjectId, false))[0];
+			if (subject === void 0 || !mapping.subject.isActiveStatus(subject[mapping.subject.status])) return { sessions: [] };
+			const cursor = input.cursor === void 0 ? void 0 : yield* mapping.sessionId.toNative(input.cursor);
+			const now = yield* freshNow;
+			const rows = yield* read.select().from(mapping.session.table).where(and(eq(c.subjectId, nativeSubjectId), eq(c.securityRevision, subject[mapping.subject.securityRevision]), gt(c.expiresAt, mapping.session.encodeInstant(now)), gt(c.absoluteExpiresAt, mapping.session.encodeInstant(now)), cursor === void 0 ? void 0 : gt(c.sessionId, cursor))).orderBy(c.sessionId).limit(input.limit + 1);
+			const decoded = yield* Effect.forEach(rows, (row) => mapping.session.decode(row));
+			const codec = Schema.toCodecJson(Schema.toType(SessionMetadata));
+			const sessions = yield* Effect.forEach(decoded.slice(0, input.limit), (record) => Schema.encodeEffect(codec)(record).pipe(Effect.flatMap(Schema.decodeEffect(codec))));
+			return {
+				sessions,
+				...decoded[input.limit] === void 0 ? {} : { nextCursor: sessions.at(-1)?.sessionId }
+			};
+		}))) };
+		return {
+			statefulSessionPersistence: {
+				establish: (input, prepare) => persistence.establish(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),
+				verify: (input) => persistence.verify(input).pipe(Effect.provideService(LifecycleHooks, hooks)),
+				rotate: (input, prepare) => persistence.rotate(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),
+				revokeDigest: (digest, prepare) => persistence.revokeDigest(digest, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),
+				revoke: (input, prepare) => persistence.revoke(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),
+				revokeAll: (input, prepare) => persistence.revokeAll(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks))
+			},
+			sessionRepository: { list: (input) => repository.list(input).pipe(Effect.provideService(LifecycleHooks, hooks)) }
+		};
+	});
+	const makeSqlSignedValidity = (database, mapping, options) => Effect.map(LifecycleHooks, (hooks) => {
+		const subject = subjectColumns(mapping);
+		const tombstone = {
+			subjectId: column(mapping.tombstone.table, mapping.tombstone.subjectId),
+			sessionId: column(mapping.tombstone.table, mapping.tombstone.sessionId),
+			absoluteExpiresAt: column(mapping.tombstone.table, mapping.tombstone.absoluteExpiresAt)
+		};
+		const service = {
+			verify: (session, _now) => safeTransaction(inTransaction(database, Effect.gen(function* () {
+				const read = yield* CurrentSessionSql;
+				const nativeSubjectId = yield* mapping.subjectId.toNative(session.subjectId);
+				const nativeSessionId = yield* mapping.sessionId.toNative(session.sessionId);
+				const row = (yield* readSubject(mapping, nativeSubjectId, false))[0];
+				if (row === void 0 || !mapping.subject.isActiveStatus(row[mapping.subject.status]) || row[mapping.subject.securityRevision] !== session.securityRevision) return yield* invalidSession();
+				const authoritativeNow = yield* freshNow;
+				if (DateTime.toEpochMillis(authoritativeNow) >= DateTime.toEpochMillis(session.expiresAt) || DateTime.toEpochMillis(authoritativeNow) >= DateTime.toEpochMillis(session.absoluteExpiresAt)) return yield* invalidSession();
+				if ((yield* read.select({ sessionId: tombstone.sessionId }).from(mapping.tombstone.table).where(and(eq(tombstone.subjectId, nativeSubjectId), eq(tombstone.sessionId, nativeSessionId), gt(tombstone.absoluteExpiresAt, mapping.tombstone.encodeInstant(authoritativeNow)))).limit(1)).length > 0) return yield* invalidSession();
+			}))),
+			revoke: (input, prepare) => owned(database, options, mapping.isConstraintConflict, Effect.gen(function* () {
+				const transaction = yield* CurrentSessionSql;
+				const journal = yield* CurrentCommitJournal;
+				const nativeSubjectId = yield* mapping.subjectId.toNative(input.subjectId);
+				const row = (yield* readSubject(mapping, nativeSubjectId, true))[0];
+				if (row === void 0 || !mapping.subject.isActiveStatus(row[mapping.subject.status]) || row[mapping.subject.securityRevision] !== input.expectedSecurityRevision) return yield* stale();
+				const nativeSessionId = yield* mapping.sessionId.toNative(input.sessionId);
+				const existing = yield* transaction.select().from(mapping.tombstone.table).where(and(eq(tombstone.subjectId, nativeSubjectId), eq(tombstone.sessionId, nativeSessionId))).limit(1);
+				const receipt = prepare(void 0, journal);
+				if (existing[0] === void 0) yield* transaction.insert(mapping.tombstone.table).values(mapping.tombstone.encodeInsert({
+					subjectId: nativeSubjectId,
+					sessionId: nativeSessionId,
+					absoluteExpiresAt: input.absoluteExpiresAt
+				}));
+				else {
+					const existingExpiry = yield* mapping.tombstone.decodeInstant(existing[0][mapping.tombstone.absoluteExpiresAt]);
+					if (DateTime.toEpochMillis(input.absoluteExpiresAt) > DateTime.toEpochMillis(existingExpiry)) yield* transaction.update(mapping.tombstone.table).set(updateValues([[mapping.tombstone.absoluteExpiresAt, mapping.tombstone.encodeInstant(input.absoluteExpiresAt)]])).where(and(eq(tombstone.subjectId, nativeSubjectId), eq(tombstone.sessionId, nativeSessionId)));
+				}
+				return receipt;
+			})),
+			revokeAll: (input, prepare) => owned(database, options, mapping.isConstraintConflict, Effect.gen(function* () {
+				const transaction = yield* CurrentSessionSql;
+				const journal = yield* CurrentCommitJournal;
+				const nativeSubjectId = yield* mapping.subjectId.toNative(input.subjectId);
+				const row = (yield* readSubject(mapping, nativeSubjectId, true))[0];
+				if (row === void 0 || !mapping.subject.isActiveStatus(row[mapping.subject.status]) || row[mapping.subject.securityRevision] !== input.expectedSecurityRevision) return yield* stale();
+				const nextRevisionSync = mapping.subject.nextSecurityRevisionSync;
+				const next = yield* allocate(options.mode, mapping.subject.nextSecurityRevision?.(input.expectedSecurityRevision), nextRevisionSync === void 0 ? void 0 : () => nextRevisionSync(input.expectedSecurityRevision));
+				const receipt = prepare(void 0, journal);
+				yield* transaction.update(mapping.subject.table).set(updateValues([[mapping.subject.securityRevision, next]])).where(and(eq(subject.subjectId, nativeSubjectId), eq(subject.subjectRevision, input.expectedSecurityRevision)));
+				return receipt;
+			}))
+		};
+		return {
+			verify: (session, now) => service.verify(session, now).pipe(Effect.provideService(LifecycleHooks, hooks)),
+			revoke: (input, prepare) => service.revoke(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),
+			revokeAll: (input, prepare) => service.revokeAll(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks))
+		};
+	});
+	const stepUpColumns = (mapping) => Object.fromEntries([
+		"digest",
+		"version",
+		"flowId",
+		"subjectId",
+		"bindingDigest",
+		"snapshot",
+		"expiresAt",
+		"attemptLimit",
+		"failedAttempts",
+		"consumed"
+	].map((key) => [key, column(mapping.intent.table, mapping.intent[key])]));
+	const stepUpLocator = Effect.fn("DrizzleStepUp.locator")(function* (mapping, digest, locking, expiresAt) {
+		const database = yield* CurrentSessionSql;
+		return yield* selectRows(database.select().from(mapping.intent.table).where(and(eq(stepUpColumns(mapping).digest, digest), expiresAt === void 0 ? void 0 : eq(stepUpColumns(mapping).expiresAt, mapping.intent.encodeInstant(expiresAt)))).limit(1), locking).pipe(Effect.map((rows) => rows[0]));
+	});
+	const stepUpAuthority = Effect.fn("DrizzleStepUp.authority")(function* (mapping, revision, locking) {
+		const current = yield* captureDetailsIn(mapping, revision.subjectId, revision.credentials.map((c) => c.credentialId), locking);
+		if (!sameStepUpRevision(current.revision, revision)) return yield* stale();
+		const requirement = yield* mapping.subject.decodeRequirement(current.subject);
+		return {
+			nativeSubjectId: yield* mapping.subjectId.toNative(revision.subjectId),
+			requirement
+		};
+	});
+	const stepUpSource = Effect.fn("DrizzleStepUp.source")(function* (mapping, intent, nativeSubjectId, now, locking) {
+		const database = yield* CurrentSessionSql;
+		if (!stepUpIntentLive(intent, mapping.source.kind, now)) return yield* SessionStepUpInvalid.make({});
+		const source = mapping.source;
+		if (source.kind === "StatelessSigned") return {
+			nativeSessionId: void 0,
+			row: void 0
+		};
+		const nativeSessionId = yield* source.sessionId.toNative(intent.sourceSessionId);
+		if (source.kind === "StateAssistedSigned") {
+			const t = source.tombstone;
+			if ((yield* selectRows(database.select().from(t.table).where(and(eq(column(t.table, t.subjectId), nativeSubjectId), eq(column(t.table, t.sessionId), nativeSessionId), gt(column(t.table, t.absoluteExpiresAt), t.encodeInstant(now)))).limit(1), locking)).length > 0) return yield* SessionStepUpInvalid.make({});
+			return {
+				nativeSessionId,
+				row: void 0
+			};
+		}
+		const s = source.session, c = sessionColumns(source);
+		const row = (yield* selectRows(database.select().from(s.table).where(and(eq(c.sessionId, nativeSessionId), eq(c.subjectId, nativeSubjectId), eq(c.securityRevision, intent.revision.securityRevision), eq(column(s.table, s.credentialVersion), intent.sourceCredentialVersion), eq(column(s.table, s.authenticatedAt), s.encodeInstant(intent.sourceAuthenticatedAt)), eq(c.expiresAt, s.encodeInstant(intent.sourceExpiresAt)), eq(c.absoluteExpiresAt, s.encodeInstant(intent.sourceAbsoluteExpiresAt)), gt(c.expiresAt, s.encodeInstant(now)), gt(c.absoluteExpiresAt, s.encodeInstant(now)))).limit(1), locking))[0];
+		if (row === void 0) return yield* SessionStepUpInvalid.make({});
+		return {
+			nativeSessionId,
+			row
+		};
+	});
+	const readSqlStepUp = Effect.fn("DrizzleStepUp.read")(function* (mapping, digest, locking) {
+		const first = yield* stepUpLocator(mapping, digest, false);
+		if (first === void 0) return yield* SessionStepUpInvalid.make({});
+		const intent = yield* decodeStepUpIntent(first[mapping.intent.snapshot]);
+		const authority = yield* stepUpAuthority(mapping, intent.revision, locking);
+		const source = yield* stepUpSource(mapping, intent, authority.nativeSubjectId, yield* freshNow, locking);
+		const row = yield* stepUpLocator(mapping, digest, locking, intent.expiresAt);
+		const m = mapping.intent;
+		if (row === void 0 || row[m.snapshot] !== first[m.snapshot] || row[m.version] !== intent.version || row[m.digest] !== intent.digest || digest !== intent.digest || row[m.flowId] !== intent.flowId || row[m.bindingDigest] !== intent.bindingDigest || !mapping.subjectId.equals(row[m.subjectId], authority.nativeSubjectId) || Boolean(row[m.consumed]) || !Schema.is(Schema.Natural)(row[m.failedAttempts]) || row[m.failedAttempts] >= row[m.attemptLimit] || row[m.attemptLimit] !== intent.attemptLimit || !stepUpIntentLive(intent, mapping.source.kind, yield* freshNow)) return yield* SessionStepUpInvalid.make({});
+		return {
+			row,
+			intent,
+			source,
+			...authority
+		};
+	});
+	const isSqlStepUpRejectAbsence = (error) => {
+		const tag = typeof error === "object" && error !== null ? Reflect.get(error, "_tag") : void 0;
+		return tag === "SessionStepUpInvalid" || tag === "StaleAuthentication";
+	};
+	const recoverSqlStepUpRejectAbsence = (effect, rejected) => effect.pipe(Effect.catchCause((cause) => {
+		if (cause.reasons.length > 0 && cause.reasons.every((reason) => Cause.isFailReason(reason) && isSqlStepUpRejectAbsence(reason.error))) return Effect.succeed(rejected);
+		return Effect.failCause(Cause.map(cause, (error) => isSqlStepUpRejectAbsence(error) ? unavailable() : error));
+	}));
+	/** Shared implementation; public driver entrypoints restore concrete tables/IDs. */
+	const makeSqlSessionStepUp = (database, mapping, options) => Effect.map(LifecycleHooks, (hooks) => {
+		const m = mapping.intent, c = stepUpColumns(mapping);
+		const read = (digest) => mapFailureCause(safeTransaction(inTransaction(database, readSqlStepUp(mapping, digest, options.locking))), (error) => error._tag === "StaleAuthentication" ? SessionStepUpInvalid.make({}) : error);
+		const service = {
+			create: (input, _now, prepare) => owned(database, options, mapping.isConstraintConflict, Effect.gen(function* () {
+				const tx = yield* CurrentSessionSql;
+				const journal = yield* CurrentCommitJournal;
+				const authority = yield* stepUpAuthority(mapping, input.revision, options.locking);
+				const version = yield* allocate(options.mode, m.allocateVersion, m.allocateVersionSync);
+				const record = {
+					...input,
+					version
+				};
+				yield* stepUpSource(mapping, record, authority.nativeSubjectId, yield* freshNow, options.locking);
+				if ((yield* selectRows(tx.select().from(m.table).where(or(eq(c.digest, input.digest), eq(c.flowId, input.flowId))).limit(1), options.locking)).length > 0) return yield* SessionConflict.make({});
+				const snapshot = yield* encodeStepUpIntent(record);
+				const values = {
+					...m.encodeInsert(record, { subjectId: authority.nativeSubjectId }),
+					...updateValues([
+						[m.digest, record.digest],
+						[m.version, version],
+						[m.flowId, record.flowId],
+						[m.subjectId, authority.nativeSubjectId],
+						[m.bindingDigest, record.bindingDigest],
+						[m.snapshot, snapshot],
+						[m.expiresAt, m.encodeInstant(record.expiresAt)],
+						[m.attemptLimit, record.attemptLimit],
+						[m.failedAttempts, 0],
+						[m.consumed, false]
+					])
+				};
+				const receipt = prepare(record, journal);
+				yield* tx.insert(m.table).values(values).pipe(normalizeMutation(mapping));
+				if ((yield* tx.select().from(m.table).where(and(eq(c.digest, record.digest), eq(c.version, version), eq(c.flowId, record.flowId), eq(c.subjectId, authority.nativeSubjectId), eq(c.bindingDigest, record.bindingDigest), eq(c.snapshot, snapshot), eq(c.expiresAt, m.encodeInstant(record.expiresAt)), eq(c.attemptLimit, record.attemptLimit), eq(c.failedAttempts, 0), eq(c.consumed, false))).limit(1))[0] === void 0) return yield* unavailable();
+				return receipt;
+			})).pipe((effect) => mapFailureCause(effect, (error) => error._tag === "SessionStepUpInvalid" ? stale() : error)),
+			context: (input) => mapFailureCause(read(input.digest).pipe(Effect.flatMap(({ intent }) => snapshotPendingAuthenticationContext({
+				flowId: intent.flowId,
+				bindingDigest: intent.bindingDigest,
+				revision: intent.revision,
+				expiresAtMillis: DateTime.toEpochMillis(intent.expiresAt)
+			}))), (error) => error._tag === "PendingAuthenticationInvalid" ? unavailable() : error),
+			read: (input) => read(input.digest).pipe(Effect.flatMap((value) => value.intent.bindingDigest === input.bindingDigest ? Effect.succeed(value.intent) : Effect.fail(SessionStepUpInvalid.make({})))),
+			reject: (input, prepare) => owned(database, options, mapping.isConstraintConflict, Effect.gen(function* () {
+				const tx = yield* CurrentSessionSql;
+				const journal = yield* CurrentCommitJournal;
+				const selected = yield* recoverSqlStepUpRejectAbsence(readSqlStepUp(mapping, input.digest, options.locking).pipe(Effect.map((value) => ({
+					_tag: "Found",
+					value
+				}))), { _tag: "Rejected" });
+				if (selected._tag === "Rejected") return prepare({ _tag: "Rejected" }, journal);
+				const { row, intent } = selected.value;
+				const receipt = prepare({ _tag: "Rejected" }, journal);
+				yield* tx.update(m.table).set(updateValues([[m.failedAttempts, sql`${c.failedAttempts} + 1`]])).where(and(eq(c.digest, input.digest), eq(c.snapshot, row[m.snapshot]), eq(c.version, intent.version), eq(c.consumed, false), sql`${c.failedAttempts} < ${c.attemptLimit}`));
+				const written = yield* stepUpLocator(mapping, input.digest, false);
+				if (written === void 0 || written[m.version] !== intent.version || written[m.snapshot] !== row[m.snapshot] || written[m.failedAttempts] !== row[m.failedAttempts] + 1) return yield* unavailable();
+				return receipt;
+			})),
+			complete: (plan, prepare) => owned(database, options, mapping.isConstraintConflict, Effect.gen(function* () {
+				const tx = yield* CurrentSessionSql;
+				const journal = yield* CurrentCommitJournal;
+				yield* validateStepUpPlan(plan);
+				const current = yield* stepUpAuthority(mapping, plan.evidence.revision, options.locking);
+				const stored = yield* readSqlStepUp(mapping, plan.intent.digest, options.locking);
+				if ((yield* encodeStepUpIntent(stored.intent)) !== (yield* encodeStepUpIntent(plan.intent))) return yield* SessionStepUpInvalid.make({});
+				const base = yield* assessAuthentication(plan.evidence, current.requirement).pipe(Effect.mapError(() => stale()));
+				const profile = yield* assessAuthentication(plan.evidence, stored.intent.requirement).pipe(Effect.mapError(() => stale()));
+				if (!base.satisfied || !profile.satisfied) return yield* stale();
+				const replacement = plan.replacement, now = yield* freshNow;
+				if (DateTime.toEpochMillis(replacement.inspection.session.expiresAt) > DateTime.toEpochMillis(stored.intent.sourceAbsoluteExpiresAt) || DateTime.toEpochMillis(now) < DateTime.toEpochMillis(replacement.inspection.session.issuedAt) || DateTime.toEpochMillis(now) >= Math.min(DateTime.toEpochMillis(replacement.inspection.session.expiresAt), DateTime.toEpochMillis(stored.intent.expiresAt))) return yield* SessionStepUpInvalid.make({});
+				let rotation;
+				if (replacement._tag === "Stateful") {
+					if (mapping.source.kind !== "Stateful") return yield* SessionStepUpInvalid.make({});
+					const s = mapping.source.session, row = stored.source.row;
+					if (row[s.digest] !== replacement.expectedDigest || row[s.version] !== replacement.expectedRowVersion) return yield* SessionConflict.make({});
+					const version = yield* allocate(options.mode, s.allocateVersion, s.allocateVersionSync);
+					const next = {
+						...replacement.inspection.session,
+						provenance: replacement.inspection.provenance,
+						credentialVersion: replacement.inspection.credentialVersion,
+						digest: replacement.nextDigest,
+						version
+					};
+					rotation = {
+						...s.encodeRotation(next),
+						...updateValues([
+							[s.version, version],
+							[s.digest, next.digest],
+							[s.credentialVersion, next.credentialVersion],
+							[s.authenticatedAt, s.encodeInstant(next.assurance.authenticatedAt)],
+							[s.issuedAt, s.encodeInstant(next.issuedAt)],
+							[s.expiresAt, s.encodeInstant(next.expiresAt)],
+							[s.absoluteExpiresAt, s.encodeInstant(next.absoluteExpiresAt)]
+						])
+					};
+				}
+				const completionVersion = yield* allocate(options.mode, m.allocateVersion, m.allocateVersionSync);
+				if (completionVersion === stored.intent.version) return yield* unavailable();
+				const completionSnapshot = yield* encodeStepUpIntent({
+					...stored.intent,
+					version: completionVersion
+				});
+				const receipt = prepare(replacement.inspection, journal);
+				if (replacement._tag === "Stateful" && mapping.source.kind === "Stateful") {
+					const s = mapping.source.session, sc = sessionColumns(mapping.source);
+					yield* tx.update(s.table).set(rotation).where(and(eq(sc.sessionId, stored.source.nativeSessionId), eq(sc.digest, replacement.expectedDigest), eq(sc.version, replacement.expectedRowVersion)));
+					const written = (yield* tx.select().from(s.table).where(eq(sc.sessionId, stored.source.nativeSessionId)).limit(1))[0];
+					if (written === void 0 || written[s.version] !== rotation[s.version]) return yield* unavailable();
+					const decoded = yield* s.decode(written);
+					if (decoded.version !== rotation[s.version] || !stepUpRotationMatches(plan, decoded)) return yield* unavailable();
+				} else if (replacement._tag === "StateAssistedSigned" && mapping.source.kind === "StateAssistedSigned") {
+					const t = mapping.source.tombstone;
+					const owner = column(t.table, t.subjectId), id = column(t.table, t.sessionId), expiry = column(t.table, t.absoluteExpiresAt);
+					yield* tx.delete(t.table).where(and(eq(owner, stored.nativeSubjectId), eq(id, stored.source.nativeSessionId), lte(expiry, t.encodeInstant(yield* freshNow))));
+					const values = t.encodeInsert({
+						subjectId: stored.nativeSubjectId,
+						sessionId: stored.source.nativeSessionId,
+						absoluteExpiresAt: replacement.tombstoneUntil
+					});
+					yield* tx.insert(t.table).values(values).pipe(normalizeMutation(mapping));
+					if ((yield* tx.select().from(t.table).where(and(eq(owner, stored.nativeSubjectId), eq(id, stored.source.nativeSessionId), eq(expiry, t.encodeInstant(replacement.tombstoneUntil)))).limit(1))[0] === void 0) return yield* unavailable();
+				}
+				yield* tx.update(m.table).set(updateValues([
+					[m.consumed, true],
+					[m.version, completionVersion],
+					[m.snapshot, completionSnapshot]
+				])).where(and(eq(c.digest, stored.intent.digest), eq(c.version, stored.intent.version), eq(c.snapshot, stored.row[m.snapshot]), eq(c.consumed, false), eq(c.failedAttempts, stored.row[m.failedAttempts])));
+				const completed = yield* stepUpLocator(mapping, stored.intent.digest, false);
+				if (completed === void 0 || !completed[m.consumed] || completed[m.version] !== completionVersion || completed[m.snapshot] !== completionSnapshot) return yield* unavailable();
+				const commitNow = yield* freshNow;
+				if (!stepUpIntentLive(stored.intent, mapping.source.kind, commitNow) || DateTime.toEpochMillis(commitNow) >= DateTime.toEpochMillis(replacement.inspection.session.expiresAt) || !(yield* assessAuthentication(plan.evidence, current.requirement).pipe(Effect.mapError(() => stale()))).satisfied || !(yield* assessAuthentication(plan.evidence, stored.intent.requirement).pipe(Effect.mapError(() => stale()))).satisfied) return yield* stale();
+				return receipt;
+			}))
+		};
+		return {
+			create: (input, now, prepare) => service.create(input, now, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),
+			context: (input) => service.context(input).pipe(Effect.provideService(LifecycleHooks, hooks)),
+			read: (input) => service.read(input).pipe(Effect.provideService(LifecycleHooks, hooks)),
+			reject: (input, prepare) => service.reject(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),
+			complete: (plan, prepare) => service.complete(plan, prepare).pipe(Effect.provideService(LifecycleHooks, hooks))
+		};
+	});
+	return {
+		makeSqlAuthenticationAuthority,
+		makeSqlPendingAuthentication,
+		makeSqlStatefulSessions,
+		makeSqlSignedValidity,
+		makeSqlSessionStepUp
+	};
+};
+//#endregion
+export { CurrentSessionSql, makeSessionKernel };
+
+//# sourceMappingURL=session-kernel.mjs.map