@yielded/auth-persistence 0.1.0-beta.10

package/dist/internal/sql-table.d.mts

@@ -0,0 +1,36 @@
+//#region src/internal/sql-table.d.ts
+export type Dialect = "pg" | "sqlite";
+export interface Compiler {
+  readonly dialect: Dialect;
+  readonly parameters: unknown[];
+}
+export declare class Fragment {
+  readonly render: (compiler: Compiler) => string;
+  readonly decode: (value: unknown) => unknown;
+  constructor(render: (compiler: Compiler) => string, decode?: (value: unknown) => unknown);
+  mapWith(decode: (value: unknown) => unknown): Fragment;
+  as(_name: string): Fragment;
+  getSQL(): Fragment;
+}
+export interface ColumnOptions {
+  readonly name: string;
+  readonly type: "text" | "integer" | "boolean";
+  readonly nullable?: boolean;
+}
+export declare class Column extends Fragment {
+  readonly tableName: string;
+  readonly options: ColumnOptions;
+  readonly schema?: string | undefined;
+  constructor(tableName: string, options: ColumnOptions, schema?: string | undefined);
+  mapToDriverValue(value: unknown): unknown;
+}
+/** Plain SQL identifiers and column representations, independent of an ORM. */
+export declare class Table extends Fragment {
+  readonly name: string;
+  readonly unique: ReadonlyArray<ReadonlyArray<string>>;
+  readonly schema?: string | undefined;
+  readonly columns: Readonly<Record<string, Column>>;
+  constructor(name: string, columns: Readonly<Record<string, ColumnOptions>>, unique: ReadonlyArray<ReadonlyArray<string>>, schema?: string | undefined);
+}
+//#endregion
+//# sourceMappingURL=sql-table.d.mts.map

package/dist/internal/sql-table.mjs

@@ -0,0 +1,81 @@
+import { PersistenceMappingError } from "./mapping-error.mjs";
+import { Option, Schema, SchemaGetter } from "effect";
+//#region src/internal/sql-table.ts
+const SqlInteger = Schema.Union([
+	Schema.Int,
+	Schema.BigInt,
+	Schema.String.check(Schema.isPattern(/^-?\d+$/))
+]).pipe(Schema.decodeTo(Schema.Int, {
+	decode: SchemaGetter.transform(Number),
+	encode: SchemaGetter.passthrough()
+}));
+const decodeInteger = Schema.decodeUnknownOption(SqlInteger);
+const identifier = (name) => "\"" + name.replaceAll("\"", "\"\"") + "\"";
+var Fragment = class Fragment {
+	render;
+	decode;
+	constructor(render, decode = (value) => value) {
+		this.render = render;
+		this.decode = decode;
+	}
+	mapWith(decode) {
+		return new Fragment(this.render, decode);
+	}
+	as(_name) {
+		return this;
+	}
+	getSQL() {
+		return this;
+	}
+};
+var Column = class extends Fragment {
+	tableName;
+	options;
+	schema;
+	constructor(tableName, options, schema) {
+		super(() => `${schema === void 0 ? "" : identifier(schema) + "."}${identifier(tableName)}.${identifier(options.name)}`, (value) => {
+			if (value === null) return value;
+			if (options.type === "boolean") {
+				if (value === true || value === 1) return true;
+				if (value === false || value === 0) return false;
+				throw PersistenceMappingError.make({
+					operation: "decode",
+					cause: "Invalid SQL boolean"
+				});
+			}
+			if (options.type === "integer") {
+				const number = decodeInteger(value);
+				if (Option.isSome(number)) return number.value;
+				throw PersistenceMappingError.make({
+					operation: "decode",
+					cause: "SQL integer is outside the safe range"
+				});
+			}
+			return value;
+		});
+		this.tableName = tableName;
+		this.options = options;
+		this.schema = schema;
+	}
+	mapToDriverValue(value) {
+		return value;
+	}
+};
+/** Plain SQL identifiers and column representations, independent of an ORM. */
+var Table = class extends Fragment {
+	name;
+	unique;
+	schema;
+	columns;
+	constructor(name, columns, unique, schema) {
+		super(() => (schema === void 0 ? "" : identifier(schema) + ".") + identifier(name));
+		this.name = name;
+		this.unique = unique;
+		this.schema = schema;
+		this.columns = Object.fromEntries(Object.entries(columns).map(([key, options]) => [key, new Column(name, options, schema)]));
+	}
+};
+//#endregion
+export { Column, Fragment, Table, identifier };
+
+//# sourceMappingURL=sql-table.mjs.map

package/dist/internal/sql-table.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-table.mjs","names":[],"sources":["../../src/internal/sql-table.ts"],"sourcesContent":["import { Option, Schema, SchemaGetter } from \"effect\";\n\nimport { PersistenceMappingError } from \"./mapping-error\";\n\nconst SqlInteger = Schema.Union([\n  Schema.Int,\n  Schema.BigInt,\n  Schema.String.check(Schema.isPattern(/^-?\\d+$/)),\n]).pipe(\n  Schema.decodeTo(Schema.Int, {\n    decode: SchemaGetter.transform(Number),\n    encode: SchemaGetter.passthrough(),\n  }),\n);\n\nconst decodeInteger = Schema.decodeUnknownOption(SqlInteger);\n\nexport type Dialect = \"pg\" | \"sqlite\";\nexport type Row = Readonly<Record<string, unknown>>;\n\nexport interface Compiler {\n  readonly dialect: Dialect;\n  readonly parameters: unknown[];\n}\n\nexport const identifier = (name: string) => '\"' + name.replaceAll('\"', '\"\"') + '\"';\n\nexport class Fragment {\n  constructor(\n    readonly render: (compiler: Compiler) => string,\n    readonly decode: (value: unknown) => unknown = (value) => value,\n  ) {}\n\n  mapWith(decode: (value: unknown) => unknown): Fragment {\n    return new Fragment(this.render, decode);\n  }\n\n  as(_name: string): Fragment {\n    return this;\n  }\n\n  getSQL(): Fragment {\n    return this;\n  }\n}\n\nexport interface ColumnOptions {\n  readonly name: string;\n  readonly type: \"text\" | \"integer\" | \"boolean\";\n  readonly nullable?: boolean;\n}\n\nexport class Column extends Fragment {\n  constructor(\n    readonly tableName: string,\n    readonly options: ColumnOptions,\n    readonly schema?: string,\n  ) {\n    super(\n      () =>\n        `${schema === undefined ? \"\" : identifier(schema) + \".\"}${identifier(tableName)}.${identifier(options.name)}`,\n      (value) => {\n        if (value === null) return value;\n        if (options.type === \"boolean\") {\n          if (value === true || value === 1) return true;\n          if (value === false || value === 0) return false;\n          throw PersistenceMappingError.make({ operation: \"decode\", cause: \"Invalid SQL boolean\" });\n        }\n        if (options.type === \"integer\") {\n          const number = decodeInteger(value);\n\n          if (Option.isSome(number)) return number.value;\n          throw PersistenceMappingError.make({\n            operation: \"decode\",\n            cause: \"SQL integer is outside the safe range\",\n          });\n        }\n\n        return value;\n      },\n    );\n  }\n\n  mapToDriverValue(value: unknown): unknown {\n    return value;\n  }\n}\n\n/** Plain SQL identifiers and column representations, independent of an ORM. */\nexport class Table extends Fragment {\n  readonly columns: Readonly<Record<string, Column>>;\n\n  constructor(\n    readonly name: string,\n    columns: Readonly<Record<string, ColumnOptions>>,\n    readonly unique: ReadonlyArray<ReadonlyArray<string>>,\n    readonly schema?: string,\n  ) {\n    super(() => (schema === undefined ? \"\" : identifier(schema) + \".\") + identifier(name));\n    this.columns = Object.fromEntries(\n      Object.entries(columns).map(([key, options]) => [key, new Column(name, options, schema)]),\n    );\n  }\n}\n"],"mappings":";;;AAIA,MAAM,aAAa,OAAO,MAAM;CAC9B,OAAO;CACP,OAAO;CACP,OAAO,OAAO,MAAM,OAAO,UAAU,SAAS,CAAC;AACjD,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,OAAO,KAAK;CAC1B,QAAQ,aAAa,UAAU,MAAM;CACrC,QAAQ,aAAa,YAAY;AACnC,CAAC,CACH;AAEA,MAAM,gBAAgB,OAAO,oBAAoB,UAAU;AAU3D,MAAa,cAAc,SAAiB,OAAM,KAAK,WAAW,MAAK,MAAI,IAAI;AAE/E,IAAa,WAAb,MAAa,SAAS;CAET;CACA;CAFX,YACE,QACA,UAAgD,UAAU,OAC1D;EAFS,KAAA,SAAA;EACA,KAAA,SAAA;CACR;CAEH,QAAQ,QAA+C;EACrD,OAAO,IAAI,SAAS,KAAK,QAAQ,MAAM;CACzC;CAEA,GAAG,OAAyB;EAC1B,OAAO;CACT;CAEA,SAAmB;EACjB,OAAO;CACT;AACF;AAQA,IAAa,SAAb,cAA4B,SAAS;CAExB;CACA;CACA;CAHX,YACE,WACA,SACA,QACA;EACA,YAEI,GAAG,WAAW,KAAA,IAAY,KAAK,WAAW,MAAM,IAAI,MAAM,WAAW,SAAS,EAAE,GAAG,WAAW,QAAQ,IAAI,MAC3G,UAAU;GACT,IAAI,UAAU,MAAM,OAAO;GAC3B,IAAI,QAAQ,SAAS,WAAW;IAC9B,IAAI,UAAU,QAAQ,UAAU,GAAG,OAAO;IAC1C,IAAI,UAAU,SAAS,UAAU,GAAG,OAAO;IAC3C,MAAM,wBAAwB,KAAK;KAAE,WAAW;KAAU,OAAO;IAAsB,CAAC;GAC1F;GACA,IAAI,QAAQ,SAAS,WAAW;IAC9B,MAAM,SAAS,cAAc,KAAK;IAElC,IAAI,OAAO,OAAO,MAAM,GAAG,OAAO,OAAO;IACzC,MAAM,wBAAwB,KAAK;KACjC,WAAW;KACX,OAAO;IACT,CAAC;GACH;GAEA,OAAO;EACT,CACF;EA1BS,KAAA,YAAA;EACA,KAAA,UAAA;EACA,KAAA,SAAA;CAyBX;CAEA,iBAAiB,OAAyB;EACxC,OAAO;CACT;AACF;;AAGA,IAAa,QAAb,cAA2B,SAAS;CAIvB;CAEA;CACA;CANX;CAEA,YACE,MACA,SACA,QACA,QACA;EACA,aAAa,WAAW,KAAA,IAAY,KAAK,WAAW,MAAM,IAAI,OAAO,WAAW,IAAI,CAAC;EAL5E,KAAA,OAAA;EAEA,KAAA,SAAA;EACA,KAAA,SAAA;EAGT,KAAK,UAAU,OAAO,YACpB,OAAO,QAAQ,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,aAAa,CAAC,KAAK,IAAI,OAAO,MAAM,SAAS,MAAM,CAAC,CAAC,CAC1F;CACF;AACF"}

package/dist/internal/standalone.d.mts

@@ -0,0 +1,9 @@
+import { Context, Effect } from "effect";
+import * as SqlClient from "effect/unstable/sql/SqlClient";
+//#region src/internal/standalone.d.ts
+/** Standalone operations must observe their own durable commit. */
+export declare const requireStandalone: <Failure>(unavailable: () => Failure, client?: {
+  readonly transactionService: Context.Key<SqlClient.TransactionConnection, SqlClient.TransactionConnection.Service>;
+}) => Effect.Effect<void, Failure>;
+//#endregion
+//# sourceMappingURL=standalone.d.mts.map

package/dist/internal/standalone.mjs

@@ -0,0 +1,13 @@
+import { Effect } from "effect";
+//#region src/internal/standalone.ts
+/** Standalone operations must observe their own durable commit. */
+const requireStandalone = (unavailable, client) => Effect.withFiber((fiber) => {
+	const services = fiber.context.mapUnsafe;
+	if (client !== void 0 && services.has(client.transactionService.key)) return Effect.fail(unavailable());
+	for (const key of services.keys()) if (key.startsWith("@effect/sql-libsql/LibsqlClient/LibsqlTransaction/")) return Effect.fail(unavailable());
+	return Effect.void;
+});
+//#endregion
+export { requireStandalone };
+
+//# sourceMappingURL=standalone.mjs.map

package/dist/internal/standalone.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"standalone.mjs","names":[],"sources":["../../src/internal/standalone.ts"],"sourcesContent":["import { type Context, Effect } from \"effect\";\nimport type * as SqlClient from \"effect/unstable/sql/SqlClient\";\n\n/** Standalone operations must observe their own durable commit. */\nexport const requireStandalone = <Failure>(\n  unavailable: () => Failure,\n  client?: {\n    readonly transactionService: Context.Key<\n      SqlClient.TransactionConnection,\n      SqlClient.TransactionConnection.Service\n    >;\n  },\n): Effect.Effect<void, Failure> =>\n  Effect.withFiber((fiber) => {\n    const services = fiber.context.mapUnsafe;\n\n    if (client !== undefined && services.has(client.transactionService.key))\n      return Effect.fail(unavailable());\n\n    // rc.117 libSQL uses a private per-client marker that is not exposed through\n    // SqlClient.transactionService. Conservatively reject every ambient libSQL\n    // transaction, including another client's, before issuing standalone writes.\n    // Recheck this upstream detail whenever the Effect driver is upgraded.\n    for (const key of services.keys()) {\n      if (key.startsWith(\"@effect/sql-libsql/LibsqlClient/LibsqlTransaction/\"))\n        return Effect.fail(unavailable());\n    }\n\n    return Effect.void;\n  });\n"],"mappings":";;;AAIA,MAAa,qBACX,aACA,WAOA,OAAO,WAAW,UAAU;CAC1B,MAAM,WAAW,MAAM,QAAQ;CAE/B,IAAI,WAAW,KAAA,KAAa,SAAS,IAAI,OAAO,mBAAmB,GAAG,GACpE,OAAO,OAAO,KAAK,YAAY,CAAC;CAMlC,KAAK,MAAM,OAAO,SAAS,KAAK,GAC9B,IAAI,IAAI,WAAW,oDAAoD,GACrE,OAAO,OAAO,KAAK,YAAY,CAAC;CAGpC,OAAO,OAAO;AAChB,CAAC"}

package/dist/internal/step-up-state.d.mts

@@ -0,0 +1,49 @@
+import { DateTime, Effect, Schema } from "effect";
+import { AuthenticationRevision, SessionStepUpCompletionPlan, SessionStepUpIntent, SessionStepUpInvalid, SessionUnavailable, StatefulSessionRecord } from "@yielded/auth/Sessions";
+//#region src/internal/step-up-state.d.ts
+export declare const encodeStepUpIntent: (intent: SessionStepUpIntent) => Effect.Effect<string, SessionUnavailable, never>;
+export declare const decodeStepUpIntent: (snapshot: string) => Effect.Effect<{
+  readonly _tag: "SessionStepUpIntent";
+  readonly digest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+  readonly version: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+  readonly flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
+  readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+  readonly revision: {
+    readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+    readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    readonly credentials: readonly {
+      readonly credentialId: string;
+      readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    }[];
+  };
+  readonly sourceKind: "StateAssistedSigned" | "Stateful" | "StatelessSigned";
+  readonly sourceSessionId: string & import("effect/Brand").Brand<"effect-auth/SessionId">;
+  readonly sourceCredentialVersion: string & import("effect/Brand").Brand<"effect-auth/SessionCredentialVersion">;
+  readonly sourceAuthenticatedAt: DateTime.Utc;
+  readonly sourceExpiresAt: DateTime.Utc;
+  readonly sourceAbsoluteExpiresAt: DateTime.Utc;
+  readonly profileId: string & import("effect/Brand").Brand<"effect-auth/SessionStepUpProfileId">;
+  readonly profileGeneration: number;
+  readonly profileDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+  readonly requirement: {
+    readonly maximumAgeMillis: number;
+    readonly alternatives: readonly [{
+      readonly userVerified: boolean;
+      readonly phishingResistant: boolean;
+      readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+      readonly minimumCredentials: number;
+    }, ...{
+      readonly userVerified: boolean;
+      readonly phishingResistant: boolean;
+      readonly factors: readonly ("inherence" | "knowledge" | "possession")[];
+      readonly minimumCredentials: number;
+    }[]];
+  };
+  readonly expiresAt: DateTime.Utc;
+  readonly attemptLimit: number;
+}, SessionUnavailable, never>;
+export declare const stepUpIntentLive: (intent: SessionStepUpIntent, kind: SessionStepUpIntent["sourceKind"], now: DateTime.Utc) => boolean;
+/** Validate core-owned plans before driver allocation/SQL expansion. No bearer or Claims decoding. */
+export declare const validateStepUpPlan: <Claims>(plan: SessionStepUpCompletionPlan<Claims>) => Effect.Effect<undefined, SessionStepUpInvalid, never>;
+//#endregion
+//# sourceMappingURL=step-up-state.d.mts.map

package/dist/internal/step-up-state.mjs

@@ -0,0 +1,32 @@
+import { DateTime, Effect, Schema } from "effect";
+import { AuthenticationEvidence, SessionMetadata, SessionStepUpIntent, SessionStepUpInvalid, SessionStepUpRequirement, SessionUnavailable } from "@yielded/auth/Sessions";
+//#region src/internal/step-up-state.ts
+const stepUpIntentCodec = Schema.fromJsonString(SessionStepUpIntent);
+const BoundedSnapshot = Schema.String.check(Schema.isMaxLength(131072));
+const encodeStepUpIntent = (intent) => Schema.encodeEffect(stepUpIntentCodec)(intent).pipe(Effect.flatMap(Schema.decodeEffect(BoundedSnapshot)), Effect.mapError(() => SessionUnavailable.make({})));
+const decodeStepUpIntent = (snapshot) => Schema.decodeEffect(BoundedSnapshot)(snapshot).pipe(Effect.flatMap(Schema.decodeEffect(stepUpIntentCodec)), Effect.mapError(() => SessionUnavailable.make({})));
+const sameStepUpRevision = (left, right) => left.subjectId === right.subjectId && left.securityRevision === right.securityRevision && left.credentials.length === right.credentials.length && new Set(left.credentials.map((c) => c.credentialId)).size === left.credentials.length && left.credentials.every((item) => right.credentials.some((other) => item.credentialId === other.credentialId && item.revision === other.revision));
+const stepUpIntentLive = (intent, kind, now) => {
+	const n = DateTime.toEpochMillis(now), authenticated = DateTime.toEpochMillis(intent.sourceAuthenticatedAt), idle = DateTime.toEpochMillis(intent.sourceExpiresAt), absolute = DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt), expires = DateTime.toEpochMillis(intent.expiresAt);
+	return intent.sourceKind === kind && authenticated <= n && n < expires && expires <= idle && idle <= absolute;
+};
+const evidenceEncoding = Schema.encodeSync(Schema.fromJsonString(AuthenticationEvidence));
+const requirementEncoding = Schema.encodeSync(Schema.fromJsonString(SessionStepUpRequirement));
+const metadataEncoding = Schema.encodeSync(Schema.fromJsonString(SessionMetadata));
+/** Validate core-owned plans before driver allocation/SQL expansion. No bearer or Claims decoding. */
+const validateStepUpPlan = Effect.fn("DrizzleStepUp.validatePlan")(function* (plan) {
+	const { intent, source, replacement, evidence } = plan;
+	const original = source.inspection;
+	if (requirementEncoding(plan.profileRequirement) !== requirementEncoding(intent.requirement) || replacement.inspection.session.subjectId !== evidence.revision.subjectId || replacement.inspection.session.securityRevision !== evidence.revision.securityRevision || intent.revision.credentials.some((item) => !evidence.revision.credentials.some((actual) => actual.credentialId === item.credentialId && actual.revision === item.revision))) return yield* SessionStepUpInvalid.make({});
+	if (intent.sourceKind !== source.guard._tag || intent.sourceKind !== replacement._tag || intent.sourceSessionId !== original.session.sessionId || intent.sourceCredentialVersion !== original.credentialVersion || !sameStepUpRevision(intent.revision, original.provenance.evidence.revision) || intent.revision.subjectId !== evidence.revision.subjectId || intent.revision.securityRevision !== evidence.revision.securityRevision || intent.flowId !== evidence.flowId || intent.bindingDigest !== evidence.bindingDigest || DateTime.toEpochMillis(intent.sourceAuthenticatedAt) !== DateTime.toEpochMillis(original.session.assurance.authenticatedAt) || DateTime.toEpochMillis(intent.sourceExpiresAt) !== DateTime.toEpochMillis(original.session.expiresAt) || DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt) !== DateTime.toEpochMillis(original.session.absoluteExpiresAt) || DateTime.toEpochMillis(intent.sourceAuthenticatedAt) !== DateTime.toEpochMillis(replacement.inspection.session.assurance.authenticatedAt) || DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt) !== DateTime.toEpochMillis(replacement.inspection.session.absoluteExpiresAt) || evidenceEncoding(replacement.inspection.provenance.evidence) !== evidenceEncoding(evidence)) return yield* SessionStepUpInvalid.make({});
+	if (replacement._tag === "Stateful" && (source.guard._tag !== "Stateful" || source.guard.digest !== replacement.expectedDigest || source.guard.rowVersion !== replacement.expectedRowVersion || replacement.inspection.session.sessionId !== intent.sourceSessionId)) return yield* SessionStepUpInvalid.make({});
+	if (replacement._tag === "StateAssistedSigned" && (replacement.tombstoneSessionId !== intent.sourceSessionId || DateTime.toEpochMillis(replacement.tombstoneUntil) !== DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt))) return yield* SessionStepUpInvalid.make({});
+	if (replacement._tag !== "Stateful" && replacement.inspection.session.sessionId === intent.sourceSessionId) return yield* SessionStepUpInvalid.make({});
+});
+/** Compare a consumer-decoded encoded update/readback with the intended rotation.
+* Claims are consumer-owned; their lossless round trip remains the codec contract. */
+const stepUpRotationMatches = (plan, record) => plan.replacement._tag === "Stateful" && record.digest === plan.replacement.nextDigest && record.credentialVersion === plan.replacement.inspection.credentialVersion && metadataEncoding(record) === metadataEncoding(plan.replacement.inspection.session) && evidenceEncoding(record.provenance.evidence) === evidenceEncoding(plan.evidence);
+//#endregion
+export { decodeStepUpIntent, encodeStepUpIntent, sameStepUpRevision, stepUpIntentCodec, stepUpIntentLive, stepUpRotationMatches, validateStepUpPlan };
+
+//# sourceMappingURL=step-up-state.mjs.map

package/dist/internal/step-up-state.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-up-state.mjs","names":[],"sources":["../../src/internal/step-up-state.ts"],"sourcesContent":["import {\n  SessionStepUpInvalid,\n  SessionUnavailable,\n  AuthenticationEvidence,\n  type AuthenticationRevision,\n  SessionMetadata,\n  SessionStepUpIntent,\n  SessionStepUpRequirement,\n  type SessionStepUpCompletionPlan,\n  type StatefulSessionRecord,\n} from \"@yielded/auth/Sessions\";\nimport { DateTime, Effect, Schema } from \"effect\";\n\nexport const stepUpIntentCodec = Schema.fromJsonString(SessionStepUpIntent);\nconst BoundedSnapshot = Schema.String.check(Schema.isMaxLength(131072));\n\nexport const encodeStepUpIntent = (intent: SessionStepUpIntent) =>\n  Schema.encodeEffect(stepUpIntentCodec)(intent).pipe(\n    Effect.flatMap(Schema.decodeEffect(BoundedSnapshot)),\n    Effect.mapError(() => SessionUnavailable.make({})),\n  );\n\nexport const decodeStepUpIntent = (snapshot: string) =>\n  Schema.decodeEffect(BoundedSnapshot)(snapshot).pipe(\n    Effect.flatMap(Schema.decodeEffect(stepUpIntentCodec)),\n    Effect.mapError(() => SessionUnavailable.make({})),\n  );\n\nexport const sameStepUpRevision = (left: AuthenticationRevision, right: AuthenticationRevision) =>\n  left.subjectId === right.subjectId &&\n  left.securityRevision === right.securityRevision &&\n  left.credentials.length === right.credentials.length &&\n  new Set(left.credentials.map((c) => c.credentialId)).size === left.credentials.length &&\n  left.credentials.every((item) =>\n    right.credentials.some(\n      (other) => item.credentialId === other.credentialId && item.revision === other.revision,\n    ),\n  );\n\nexport const stepUpIntentLive = (\n  intent: SessionStepUpIntent,\n  kind: SessionStepUpIntent[\"sourceKind\"],\n  now: DateTime.Utc,\n) => {\n  const n = DateTime.toEpochMillis(now),\n    authenticated = DateTime.toEpochMillis(intent.sourceAuthenticatedAt),\n    idle = DateTime.toEpochMillis(intent.sourceExpiresAt),\n    absolute = DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt),\n    expires = DateTime.toEpochMillis(intent.expiresAt);\n\n  return (\n    intent.sourceKind === kind &&\n    authenticated <= n &&\n    n < expires &&\n    expires <= idle &&\n    idle <= absolute\n  );\n};\n\nconst evidenceEncoding = Schema.encodeSync(Schema.fromJsonString(AuthenticationEvidence));\nconst requirementEncoding = Schema.encodeSync(Schema.fromJsonString(SessionStepUpRequirement));\nconst metadataEncoding = Schema.encodeSync(Schema.fromJsonString(SessionMetadata));\n\n/** Validate core-owned plans before driver allocation/SQL expansion. No bearer or Claims decoding. */\nexport const validateStepUpPlan = Effect.fn(\"DrizzleStepUp.validatePlan\")(function* <Claims>(\n  plan: SessionStepUpCompletionPlan<Claims>,\n) {\n  const { intent, source, replacement, evidence } = plan;\n  const original = source.inspection;\n\n  if (\n    requirementEncoding(plan.profileRequirement) !== requirementEncoding(intent.requirement) ||\n    replacement.inspection.session.subjectId !== evidence.revision.subjectId ||\n    replacement.inspection.session.securityRevision !== evidence.revision.securityRevision ||\n    intent.revision.credentials.some(\n      (item) =>\n        !evidence.revision.credentials.some(\n          (actual) =>\n            actual.credentialId === item.credentialId && actual.revision === item.revision,\n        ),\n    )\n  )\n    return yield* SessionStepUpInvalid.make({});\n  if (\n    intent.sourceKind !== source.guard._tag ||\n    intent.sourceKind !== replacement._tag ||\n    intent.sourceSessionId !== original.session.sessionId ||\n    intent.sourceCredentialVersion !== original.credentialVersion ||\n    !sameStepUpRevision(intent.revision, original.provenance.evidence.revision) ||\n    intent.revision.subjectId !== evidence.revision.subjectId ||\n    intent.revision.securityRevision !== evidence.revision.securityRevision ||\n    intent.flowId !== evidence.flowId ||\n    intent.bindingDigest !== evidence.bindingDigest ||\n    DateTime.toEpochMillis(intent.sourceAuthenticatedAt) !==\n      DateTime.toEpochMillis(original.session.assurance.authenticatedAt) ||\n    DateTime.toEpochMillis(intent.sourceExpiresAt) !==\n      DateTime.toEpochMillis(original.session.expiresAt) ||\n    DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt) !==\n      DateTime.toEpochMillis(original.session.absoluteExpiresAt) ||\n    DateTime.toEpochMillis(intent.sourceAuthenticatedAt) !==\n      DateTime.toEpochMillis(replacement.inspection.session.assurance.authenticatedAt) ||\n    DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt) !==\n      DateTime.toEpochMillis(replacement.inspection.session.absoluteExpiresAt) ||\n    evidenceEncoding(replacement.inspection.provenance.evidence) !== evidenceEncoding(evidence)\n  )\n    return yield* SessionStepUpInvalid.make({});\n  if (\n    replacement._tag === \"Stateful\" &&\n    (source.guard._tag !== \"Stateful\" ||\n      source.guard.digest !== replacement.expectedDigest ||\n      source.guard.rowVersion !== replacement.expectedRowVersion ||\n      replacement.inspection.session.sessionId !== intent.sourceSessionId)\n  )\n    return yield* SessionStepUpInvalid.make({});\n  if (\n    replacement._tag === \"StateAssistedSigned\" &&\n    (replacement.tombstoneSessionId !== intent.sourceSessionId ||\n      DateTime.toEpochMillis(replacement.tombstoneUntil) !==\n        DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt))\n  )\n    return yield* SessionStepUpInvalid.make({});\n  if (\n    replacement._tag !== \"Stateful\" &&\n    replacement.inspection.session.sessionId === intent.sourceSessionId\n  )\n    return yield* SessionStepUpInvalid.make({});\n});\n\n/** Compare a consumer-decoded encoded update/readback with the intended rotation.\n * Claims are consumer-owned; their lossless round trip remains the codec contract. */\nexport const stepUpRotationMatches = <Claims>(\n  plan: SessionStepUpCompletionPlan<Claims>,\n  record: StatefulSessionRecord<Claims>,\n) =>\n  plan.replacement._tag === \"Stateful\" &&\n  record.digest === plan.replacement.nextDigest &&\n  record.credentialVersion === plan.replacement.inspection.credentialVersion &&\n  metadataEncoding(record) === metadataEncoding(plan.replacement.inspection.session) &&\n  evidenceEncoding(record.provenance.evidence) === evidenceEncoding(plan.evidence);\n"],"mappings":";;;AAaA,MAAa,oBAAoB,OAAO,eAAe,mBAAmB;AAC1E,MAAM,kBAAkB,OAAO,OAAO,MAAM,OAAO,YAAY,MAAM,CAAC;AAEtE,MAAa,sBAAsB,WACjC,OAAO,aAAa,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,KAC7C,OAAO,QAAQ,OAAO,aAAa,eAAe,CAAC,GACnD,OAAO,eAAe,mBAAmB,KAAK,CAAC,CAAC,CAAC,CACnD;AAEF,MAAa,sBAAsB,aACjC,OAAO,aAAa,eAAe,CAAC,CAAC,QAAQ,CAAC,CAAC,KAC7C,OAAO,QAAQ,OAAO,aAAa,iBAAiB,CAAC,GACrD,OAAO,eAAe,mBAAmB,KAAK,CAAC,CAAC,CAAC,CACnD;AAEF,MAAa,sBAAsB,MAA8B,UAC/D,KAAK,cAAc,MAAM,aACzB,KAAK,qBAAqB,MAAM,oBAChC,KAAK,YAAY,WAAW,MAAM,YAAY,UAC9C,IAAI,IAAI,KAAK,YAAY,KAAK,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,SAAS,KAAK,YAAY,UAC/E,KAAK,YAAY,OAAO,SACtB,MAAM,YAAY,MACf,UAAU,KAAK,iBAAiB,MAAM,gBAAgB,KAAK,aAAa,MAAM,QACjF,CACF;AAEF,MAAa,oBACX,QACA,MACA,QACG;CACH,MAAM,IAAI,SAAS,cAAc,GAAG,GAClC,gBAAgB,SAAS,cAAc,OAAO,qBAAqB,GACnE,OAAO,SAAS,cAAc,OAAO,eAAe,GACpD,WAAW,SAAS,cAAc,OAAO,uBAAuB,GAChE,UAAU,SAAS,cAAc,OAAO,SAAS;CAEnD,OACE,OAAO,eAAe,QACtB,iBAAiB,KACjB,IAAI,WACJ,WAAW,QACX,QAAQ;AAEZ;AAEA,MAAM,mBAAmB,OAAO,WAAW,OAAO,eAAe,sBAAsB,CAAC;AACxF,MAAM,sBAAsB,OAAO,WAAW,OAAO,eAAe,wBAAwB,CAAC;AAC7F,MAAM,mBAAmB,OAAO,WAAW,OAAO,eAAe,eAAe,CAAC;;AAGjF,MAAa,qBAAqB,OAAO,GAAG,4BAA4B,CAAC,CAAC,WACxE,MACA;CACA,MAAM,EAAE,QAAQ,QAAQ,aAAa,aAAa;CAClD,MAAM,WAAW,OAAO;CAExB,IACE,oBAAoB,KAAK,kBAAkB,MAAM,oBAAoB,OAAO,WAAW,KACvF,YAAY,WAAW,QAAQ,cAAc,SAAS,SAAS,aAC/D,YAAY,WAAW,QAAQ,qBAAqB,SAAS,SAAS,oBACtE,OAAO,SAAS,YAAY,MACzB,SACC,CAAC,SAAS,SAAS,YAAY,MAC5B,WACC,OAAO,iBAAiB,KAAK,gBAAgB,OAAO,aAAa,KAAK,QAC1E,CACJ,GAEA,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;CAC5C,IACE,OAAO,eAAe,OAAO,MAAM,QACnC,OAAO,eAAe,YAAY,QAClC,OAAO,oBAAoB,SAAS,QAAQ,aAC5C,OAAO,4BAA4B,SAAS,qBAC5C,CAAC,mBAAmB,OAAO,UAAU,SAAS,WAAW,SAAS,QAAQ,KAC1E,OAAO,SAAS,cAAc,SAAS,SAAS,aAChD,OAAO,SAAS,qBAAqB,SAAS,SAAS,oBACvD,OAAO,WAAW,SAAS,UAC3B,OAAO,kBAAkB,SAAS,iBAClC,SAAS,cAAc,OAAO,qBAAqB,MACjD,SAAS,cAAc,SAAS,QAAQ,UAAU,eAAe,KACnE,SAAS,cAAc,OAAO,eAAe,MAC3C,SAAS,cAAc,SAAS,QAAQ,SAAS,KACnD,SAAS,cAAc,OAAO,uBAAuB,MACnD,SAAS,cAAc,SAAS,QAAQ,iBAAiB,KAC3D,SAAS,cAAc,OAAO,qBAAqB,MACjD,SAAS,cAAc,YAAY,WAAW,QAAQ,UAAU,eAAe,KACjF,SAAS,cAAc,OAAO,uBAAuB,MACnD,SAAS,cAAc,YAAY,WAAW,QAAQ,iBAAiB,KACzE,iBAAiB,YAAY,WAAW,WAAW,QAAQ,MAAM,iBAAiB,QAAQ,GAE1F,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;CAC5C,IACE,YAAY,SAAS,eACpB,OAAO,MAAM,SAAS,cACrB,OAAO,MAAM,WAAW,YAAY,kBACpC,OAAO,MAAM,eAAe,YAAY,sBACxC,YAAY,WAAW,QAAQ,cAAc,OAAO,kBAEtD,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;CAC5C,IACE,YAAY,SAAS,0BACpB,YAAY,uBAAuB,OAAO,mBACzC,SAAS,cAAc,YAAY,cAAc,MAC/C,SAAS,cAAc,OAAO,uBAAuB,IAEzD,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;CAC5C,IACE,YAAY,SAAS,cACrB,YAAY,WAAW,QAAQ,cAAc,OAAO,iBAEpD,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;AAC9C,CAAC;;;AAID,MAAa,yBACX,MACA,WAEA,KAAK,YAAY,SAAS,cAC1B,OAAO,WAAW,KAAK,YAAY,cACnC,OAAO,sBAAsB,KAAK,YAAY,WAAW,qBACzD,iBAAiB,MAAM,MAAM,iBAAiB,KAAK,YAAY,WAAW,OAAO,KACjF,iBAAiB,OAAO,WAAW,QAAQ,MAAM,iBAAiB,KAAK,QAAQ"}