@yielded/auth-persistence 0.1.0-beta.24 → 0.1.0-beta.26

package/dist/internal/session-native-state.mjs

@@ -0,0 +1,130 @@
+import { PersistenceMappingError } from "./mapping-error.mjs";
+import { anySqlCondition, exactSqlText } from "./sql-change.mjs";
+import { Cause, DateTime, Effect, Schema } from "effect";
+import { reportAuthFailure } from "@yielded/auth/Persistence";
+import { AuthenticationRevision, PendingAuthenticationInvalid, SessionConflict, SessionInvalid, SessionStepUpInvalid, SessionUnavailable, StaleAuthentication, assessAuthentication } from "@yielded/auth/Sessions";
+import { SqlClient } from "effect/sql/SqlClient";
+//#region src/internal/session-native-state.ts
+const sessionUnavailable = () => SessionUnavailable.make({});
+const sessionInvariant = (condition) => {
+	if (!condition) throw PersistenceMappingError.make({
+		operation: "decode",
+		cause: "Invalid session authority"
+	});
+};
+const isDomainFailure = (error) => Schema.is(SessionConflict)(error) || Schema.is(SessionInvalid)(error) || Schema.is(SessionUnavailable)(error) || Schema.is(SessionStepUpInvalid)(error) || Schema.is(PendingAuthenticationInvalid)(error) || Schema.is(StaleAuthentication)(error);
+/** Only schema-checked domain failures cross the owner boundary; SQL/mapping
+* failures remain Unavailable. The executor preserves every mixed cause reason. */
+const sessionFailure = (error) => isDomainFailure(error) ? error : sessionUnavailable();
+const normalizeSessionOperation = (effect) => effect.pipe(Effect.tapError((error) => isDomainFailure(error) ? Effect.void : reportAuthFailure("auth-persistence", Cause.fail(error))), Effect.mapError(sessionFailure));
+const sameSessionRevision = (left, right) => left.subjectId === right.subjectId && left.securityRevision === right.securityRevision && left.credentials.length === right.credentials.length && new Set(left.credentials.map((f) => f.credentialId)).size === left.credentials.length && left.credentials.every((f) => right.credentials.some((other) => other.credentialId === f.credentialId && other.revision === f.revision));
+/** Known-subject joins bind each physical ID column independently. Subject locks
+* precede every credential lock, including inside an application coordinator. */
+const makeNativeSessionAuthorityState = Effect.fnUntraced(function* (tables, mapping, batch = false) {
+	const sql = (yield* SqlClient).withoutTransforms();
+	const s = mapping.subject, c = mapping.credential;
+	if (batch) sessionInvariant(s.requirementColumns !== void 0);
+	const subject = tables(s.table), credential = tables(c.table);
+	const joinedSubject = subject.as("session_subject"), joinedCredential = credential.as("session_factor");
+	const now = tables.expression(mapping.clock.engineNowMillis);
+	const lock = sql.onDialectOrElse({
+		sqlite: () => sql``,
+		orElse: () => sql`for update`
+	});
+	const nativeLocks = !batch && sql.onDialectOrElse({
+		sqlite: () => false,
+		orElse: () => true
+	});
+	const exact = (table, key, value) => exactSqlText(sql, table.column(key), table.value(key, value));
+	const id = (table, key, value) => sql`${table.column(key)} = ${table.value(key, value)}`;
+	const activeSubject = (table) => id(table, s.status, s.activeStatusValue);
+	const activeCredential = (table) => {
+		if (c.status === void 0) return sql`1 = 1`;
+		sessionInvariant(c.activeStatusValue !== void 0);
+		return id(table, c.status, c.activeStatusValue);
+	};
+	const requested = (table, ids) => anySqlCondition(ids.map((value) => exact(table, c.credentialId, value)));
+	const decode = Effect.fnUntraced(function* (subjectId, native, row, factors, instant) {
+		sessionInvariant((yield* mapping.subjectId.toSubject(row[s.id])) === subjectId);
+		if (!s.isActiveStatus(row[s.status])) return void 0;
+		const credentials = [];
+		for (const factor of factors) {
+			if (factor[c.credentialId] === null || factor[c.credentialId] === void 0) continue;
+			sessionInvariant((yield* mapping.subjectId.toSubject(factor[c.subjectId])) === subjectId);
+			if (c.status !== void 0) sessionInvariant(c.isActiveStatus?.(factor[c.status]) === true);
+			const value = yield* Schema.decodeUnknownEffect(Schema.Struct({
+				credentialId: Schema.String,
+				revision: Schema.String
+			}))({
+				credentialId: factor[c.credentialId],
+				revision: factor[c.revision]
+			});
+			sessionInvariant(!credentials.some((other) => other.credentialId === value.credentialId));
+			credentials.push(value);
+		}
+		sessionInvariant(credentials.length <= 64);
+		return {
+			native,
+			row,
+			revision: yield* Schema.decodeUnknownEffect(AuthenticationRevision)({
+				subjectId,
+				securityRevision: row[s.securityRevision],
+				credentials: credentials.sort((a, b) => a.credentialId.localeCompare(b.credentialId))
+			}),
+			requirement: yield* s.decodeRequirement(row),
+			now: yield* Schema.decodeEffect(Schema.Int)(Number(instant))
+		};
+	});
+	const read = Effect.fnUntraced(function* (subjectId, locking = false) {
+		const native = yield* mapping.subjectId.toNative(subjectId);
+		sessionInvariant((yield* mapping.subjectId.toSubject(native)) === subjectId);
+		if (locking && nativeLocks) {
+			const owners = yield* sql`select ${subject.fields("s_")}, ${now} as engine_now from ${subject.name} where ${id(subject, s.id, native)} and ${activeSubject(subject)} limit 2 ${lock}`;
+			sessionInvariant(owners.length <= 1);
+			if (owners[0] === void 0) return void 0;
+			const factors = yield* sql`select ${credential.fields("c_")} from ${credential.name} where ${id(credential, c.subjectId, native)} and ${activeCredential(credential)} order by ${credential.column(c.credentialId)} limit 65 ${lock}`;
+			return yield* decode(subjectId, native, subject.decode(owners[0], "s_"), factors.map((row) => credential.decode(row, "c_")), owners[0].engine_now);
+		}
+		const rows = yield* sql`select ${joinedSubject.fields("s_")}, ${joinedCredential.fields("c_")}, ${now} as engine_now from ${joinedSubject.name} left join ${joinedCredential.name} on ${id(joinedCredential, c.subjectId, native)} and ${activeCredential(joinedCredential)} where ${id(joinedSubject, s.id, native)} and ${activeSubject(joinedSubject)} limit 65`;
+		if (rows[0] === void 0) return void 0;
+		return yield* decode(subjectId, native, joinedSubject.decode(rows[0], "s_"), rows.map((row) => joinedCredential.decode(row, "c_")), rows[0].engine_now);
+	});
+	const policyCondition = (row, native) => {
+		if (!batch) return sql`1 = 1`;
+		sessionInvariant(s.requirementColumns !== void 0);
+		return sql`exists(select 1 from ${subject.name} where ${id(subject, s.id, native)} and ${sql.and(s.requirementColumns.map((key) => row[key] === null ? sql`${subject.column(key)} is null` : typeof row[key] === "string" ? exact(subject, key, row[key]) : id(subject, key, row[key])))})`;
+	};
+	const authorityCondition = (revision, native) => sql.and([
+		sql`exists(select 1 from ${subject.name} where ${id(subject, s.id, native)} and ${exact(subject, s.securityRevision, revision.securityRevision)} and ${activeSubject(subject)})`,
+		sql`(select count(*) from ${credential.name} where ${id(credential, c.subjectId, native)} and ${activeCredential(credential)}) = ${revision.credentials.length}`,
+		...revision.credentials.map((factor) => sql`exists(select 1 from ${credential.name} where ${id(credential, c.subjectId, native)} and ${exact(credential, c.credentialId, factor.credentialId)} and ${exact(credential, c.revision, factor.revision)} and ${activeCredential(credential)})`)
+	]);
+	return {
+		sql,
+		subject,
+		credential,
+		joinedSubject,
+		joinedCredential,
+		now,
+		lock,
+		nativeLocks,
+		exact,
+		id,
+		activeSubject,
+		activeCredential,
+		requested,
+		decode,
+		read,
+		authorityCondition,
+		policyCondition
+	};
+});
+/** Evaluate freshness at the database sample. The final write also enforces the
+* earliest future boundary at which the same evidence would cease to satisfy. */
+const assessSessionAt = Effect.fnUntraced(function* (evidence, requirement, now) {
+	return yield* assessAuthentication(evidence, requirement, DateTime.makeUnsafe(now));
+});
+//#endregion
+export { assessSessionAt, makeNativeSessionAuthorityState, normalizeSessionOperation, sameSessionRevision, sessionFailure, sessionInvariant, sessionUnavailable };
+
+//# sourceMappingURL=session-native-state.mjs.map

package/dist/internal/session-native-state.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-native-state.mjs","names":[],"sources":["../../src/internal/session-native-state.ts"],"sourcesContent":["import { reportAuthFailure } from \"@yielded/auth/Persistence\";\nimport type { SubjectId } from \"@yielded/auth/Schema\";\nimport {\n  type AuthenticationRequirement,\n  AuthenticationRevision,\n  SessionConflict,\n  SessionInvalid,\n  SessionUnavailable,\n  SessionStepUpInvalid,\n  PendingAuthenticationInvalid,\n  StaleAuthentication,\n  assessAuthentication,\n  type AuthenticationEvidence,\n} from \"@yielded/auth/Sessions\";\nimport { Cause, Effect, Schema, DateTime } from \"effect\";\nimport { SqlClient } from \"effect/sql/SqlClient\";\nimport type { Fragment } from \"effect/sql/Statement\";\n\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport type { SessionAuthorityTables, SessionExecution } from \"./models/session-model\";\nimport type { NativeSqlTables, SqlTable } from \"./native-sql-table\";\nimport { anySqlCondition, exactSqlText } from \"./sql-change\";\nimport type { AnyTableModel } from \"./table-model\";\n\nexport const sessionUnavailable = () => SessionUnavailable.make({});\n\nexport const sessionInvariant: (condition: unknown) => asserts condition = (condition) => {\n  if (!condition)\n    throw PersistenceMappingError.make({ operation: \"decode\", cause: \"Invalid session authority\" });\n};\n\nexport type SessionDomainFailure =\n  | SessionConflict\n  | SessionInvalid\n  | SessionUnavailable\n  | SessionStepUpInvalid\n  | PendingAuthenticationInvalid\n  | StaleAuthentication;\n\nconst isDomainFailure = (error: unknown): error is SessionDomainFailure =>\n  Schema.is(SessionConflict)(error) ||\n  Schema.is(SessionInvalid)(error) ||\n  Schema.is(SessionUnavailable)(error) ||\n  Schema.is(SessionStepUpInvalid)(error) ||\n  Schema.is(PendingAuthenticationInvalid)(error) ||\n  Schema.is(StaleAuthentication)(error);\n\n/** Only schema-checked domain failures cross the owner boundary; SQL/mapping\n * failures remain Unavailable. The executor preserves every mixed cause reason. */\nexport const sessionFailure = <E>(\n  error: E,\n): Extract<E, SessionDomainFailure> | SessionUnavailable =>\n  isDomainFailure(error) ? (error as Extract<E, SessionDomainFailure>) : sessionUnavailable();\n\nexport const normalizeSessionOperation = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n  effect.pipe(\n    Effect.tapError((error) =>\n      isDomainFailure(error)\n        ? Effect.void\n        : reportAuthFailure(\"auth-persistence\", Cause.fail(error)),\n    ),\n    Effect.mapError(sessionFailure),\n  );\n\nexport type NativeSessionAuthorityMapping = SessionAuthorityTables<\n  AnyTableModel,\n  AnyTableModel,\n  unknown\n> &\n  SessionExecution;\n\nexport interface NativeSessionAuthority {\n  readonly native: unknown;\n  readonly row: Record<string, unknown>;\n  readonly revision: AuthenticationRevision;\n  readonly requirement: AuthenticationRequirement;\n  readonly now: number;\n}\n\nexport const sameSessionRevision = (left: AuthenticationRevision, right: AuthenticationRevision) =>\n  left.subjectId === right.subjectId &&\n  left.securityRevision === right.securityRevision &&\n  left.credentials.length === right.credentials.length &&\n  new Set(left.credentials.map((f) => f.credentialId)).size === left.credentials.length &&\n  left.credentials.every((f) =>\n    right.credentials.some(\n      (other) => other.credentialId === f.credentialId && other.revision === f.revision,\n    ),\n  );\n\n/** Known-subject joins bind each physical ID column independently. Subject locks\n * precede every credential lock, including inside an application coordinator. */\nexport const makeNativeSessionAuthorityState = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: NativeSessionAuthorityMapping,\n  batch = false,\n) {\n  const sql = (yield* SqlClient).withoutTransforms();\n\n  const s = mapping.subject,\n    c = mapping.credential;\n\n  if (batch) sessionInvariant(s.requirementColumns !== undefined);\n\n  const subject = tables(s.table),\n    credential = tables(c.table);\n\n  const joinedSubject = subject.as(\"session_subject\"),\n    joinedCredential = credential.as(\"session_factor\");\n\n  const now = tables.expression(mapping.clock.engineNowMillis);\n  const lock = sql.onDialectOrElse({ sqlite: () => sql``, orElse: () => sql`for update` });\n  const nativeLocks = !batch && sql.onDialectOrElse({ sqlite: () => false, orElse: () => true });\n\n  const exact = (table: SqlTable, key: string, value: unknown) =>\n    exactSqlText(sql, table.column(key), table.value(key, value));\n\n  const id = (table: SqlTable, key: string, value: unknown) =>\n    sql`${table.column(key)} = ${table.value(key, value)}`;\n\n  const activeSubject = (table: SqlTable) => id(table, s.status, s.activeStatusValue);\n\n  const activeCredential = (table: SqlTable) => {\n    if (c.status === undefined) return sql`1 = 1`;\n    sessionInvariant(c.activeStatusValue !== undefined);\n\n    return id(table, c.status, c.activeStatusValue);\n  };\n\n  const requested = (table: SqlTable, ids: ReadonlyArray<string>) =>\n    anySqlCondition(ids.map((value) => exact(table, c.credentialId, value)));\n\n  const decode = Effect.fnUntraced(function* (\n    subjectId: SubjectId,\n    native: unknown,\n    row: Record<string, unknown>,\n    factors: ReadonlyArray<Record<string, unknown>>,\n    instant: unknown,\n  ): Effect.fn.Return<\n    NativeSessionAuthority | undefined,\n    PersistenceMappingError | Schema.SchemaError\n  > {\n    sessionInvariant((yield* mapping.subjectId.toSubject(row[s.id])) === subjectId);\n    if (!s.isActiveStatus(row[s.status])) return undefined;\n    const credentials: { credentialId: string; revision: string }[] = [];\n\n    for (const factor of factors) {\n      if (factor[c.credentialId] === null || factor[c.credentialId] === undefined) continue;\n      sessionInvariant((yield* mapping.subjectId.toSubject(factor[c.subjectId])) === subjectId);\n      if (c.status !== undefined) sessionInvariant(c.isActiveStatus?.(factor[c.status]) === true);\n\n      const value = yield* Schema.decodeUnknownEffect(\n        Schema.Struct({ credentialId: Schema.String, revision: Schema.String }),\n      )({ credentialId: factor[c.credentialId], revision: factor[c.revision] });\n\n      sessionInvariant(!credentials.some((other) => other.credentialId === value.credentialId));\n      credentials.push(value);\n    }\n    sessionInvariant(credentials.length <= 64);\n\n    return {\n      native,\n      row,\n      revision: yield* Schema.decodeUnknownEffect(AuthenticationRevision)({\n        subjectId,\n        securityRevision: row[s.securityRevision],\n        credentials: credentials.sort((a, b) => a.credentialId.localeCompare(b.credentialId)),\n      }),\n      requirement: yield* s.decodeRequirement(row),\n      now: yield* Schema.decodeEffect(Schema.Int)(Number(instant)),\n    };\n  });\n\n  const read = Effect.fnUntraced(function* (subjectId: SubjectId, locking = false) {\n    const native = yield* mapping.subjectId.toNative(subjectId);\n\n    sessionInvariant((yield* mapping.subjectId.toSubject(native)) === subjectId);\n    if (locking && nativeLocks) {\n      const owners =\n        yield* sql`select ${subject.fields(\"s_\")}, ${now} as engine_now from ${subject.name} where ${id(subject, s.id, native)} and ${activeSubject(subject)} limit 2 ${lock}`;\n\n      sessionInvariant(owners.length <= 1);\n      if (owners[0] === undefined) return undefined;\n\n      const factors =\n        yield* sql`select ${credential.fields(\"c_\")} from ${credential.name} where ${id(credential, c.subjectId, native)} and ${activeCredential(credential)} order by ${credential.column(c.credentialId)} limit 65 ${lock}`;\n\n      return yield* decode(\n        subjectId,\n        native,\n        subject.decode(owners[0], \"s_\"),\n        factors.map((row) => credential.decode(row, \"c_\")),\n        owners[0].engine_now,\n      );\n    }\n\n    const rows =\n      yield* sql`select ${joinedSubject.fields(\"s_\")}, ${joinedCredential.fields(\"c_\")}, ${now} as engine_now from ${joinedSubject.name} left join ${joinedCredential.name} on ${id(joinedCredential, c.subjectId, native)} and ${activeCredential(joinedCredential)} where ${id(joinedSubject, s.id, native)} and ${activeSubject(joinedSubject)} limit 65`;\n\n    if (rows[0] === undefined) return undefined;\n\n    return yield* decode(\n      subjectId,\n      native,\n      joinedSubject.decode(rows[0], \"s_\"),\n      rows.map((row) => joinedCredential.decode(row, \"c_\")),\n      rows[0].engine_now,\n    );\n  });\n\n  const policyCondition = (row: Record<string, unknown>, native: unknown): Fragment => {\n    if (!batch) return sql`1 = 1`;\n    sessionInvariant(s.requirementColumns !== undefined);\n\n    return sql`exists(select 1 from ${subject.name} where ${id(subject, s.id, native)} and ${sql.and(s.requirementColumns.map((key) => (row[key] === null ? sql`${subject.column(key)} is null` : typeof row[key] === \"string\" ? exact(subject, key, row[key]) : id(subject, key, row[key]))))})`;\n  };\n\n  const authorityCondition = (revision: AuthenticationRevision, native: unknown): Fragment =>\n    sql.and([\n      sql`exists(select 1 from ${subject.name} where ${id(subject, s.id, native)} and ${exact(subject, s.securityRevision, revision.securityRevision)} and ${activeSubject(subject)})`,\n      sql`(select count(*) from ${credential.name} where ${id(credential, c.subjectId, native)} and ${activeCredential(credential)}) = ${revision.credentials.length}`,\n      ...revision.credentials.map(\n        (factor) =>\n          sql`exists(select 1 from ${credential.name} where ${id(credential, c.subjectId, native)} and ${exact(credential, c.credentialId, factor.credentialId)} and ${exact(credential, c.revision, factor.revision)} and ${activeCredential(credential)})`,\n      ),\n    ]);\n\n  return {\n    sql,\n    subject,\n    credential,\n    joinedSubject,\n    joinedCredential,\n    now,\n    lock,\n    nativeLocks,\n    exact,\n    id,\n    activeSubject,\n    activeCredential,\n    requested,\n    decode,\n    read,\n    authorityCondition,\n    policyCondition,\n  };\n});\n\n/** Evaluate freshness at the database sample. The final write also enforces the\n * earliest future boundary at which the same evidence would cease to satisfy. */\nexport const assessSessionAt = Effect.fnUntraced(function* (\n  evidence: AuthenticationEvidence,\n  requirement: AuthenticationRequirement,\n  now: number,\n) {\n  const result = yield* assessAuthentication(evidence, requirement, DateTime.makeUnsafe(now));\n\n  return result;\n});\n"],"mappings":";;;;;;;AAwBA,MAAa,2BAA2B,mBAAmB,KAAK,CAAC,CAAC;AAElE,MAAa,oBAA+D,cAAc;CACxF,IAAI,CAAC,WACH,MAAM,wBAAwB,KAAK;EAAE,WAAW;EAAU,OAAO;CAA4B,CAAC;AAClG;AAUA,MAAM,mBAAmB,UACvB,OAAO,GAAG,eAAe,CAAC,CAAC,KAAK,KAChC,OAAO,GAAG,cAAc,CAAC,CAAC,KAAK,KAC/B,OAAO,GAAG,kBAAkB,CAAC,CAAC,KAAK,KACnC,OAAO,GAAG,oBAAoB,CAAC,CAAC,KAAK,KACrC,OAAO,GAAG,4BAA4B,CAAC,CAAC,KAAK,KAC7C,OAAO,GAAG,mBAAmB,CAAC,CAAC,KAAK;;;AAItC,MAAa,kBACX,UAEA,gBAAgB,KAAK,IAAK,QAA6C,mBAAmB;AAE5F,MAAa,6BAAsC,WACjD,OAAO,KACL,OAAO,UAAU,UACf,gBAAgB,KAAK,IACjB,OAAO,OACP,kBAAkB,oBAAoB,MAAM,KAAK,KAAK,CAAC,CAC7D,GACA,OAAO,SAAS,cAAc,CAChC;AAiBF,MAAa,uBAAuB,MAA8B,UAChE,KAAK,cAAc,MAAM,aACzB,KAAK,qBAAqB,MAAM,oBAChC,KAAK,YAAY,WAAW,MAAM,YAAY,UAC9C,IAAI,IAAI,KAAK,YAAY,KAAK,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,SAAS,KAAK,YAAY,UAC/E,KAAK,YAAY,OAAO,MACtB,MAAM,YAAY,MACf,UAAU,MAAM,iBAAiB,EAAE,gBAAgB,MAAM,aAAa,EAAE,QAC3E,CACF;;;AAIF,MAAa,kCAAkC,OAAO,WAAW,WAC/D,QACA,SACA,QAAQ,OACR;CACA,MAAM,OAAO,OAAO,UAAA,CAAW,kBAAkB;CAEjD,MAAM,IAAI,QAAQ,SAChB,IAAI,QAAQ;CAEd,IAAI,OAAO,iBAAiB,EAAE,uBAAuB,KAAA,CAAS;CAE9D,MAAM,UAAU,OAAO,EAAE,KAAK,GAC5B,aAAa,OAAO,EAAE,KAAK;CAE7B,MAAM,gBAAgB,QAAQ,GAAG,iBAAiB,GAChD,mBAAmB,WAAW,GAAG,gBAAgB;CAEnD,MAAM,MAAM,OAAO,WAAW,QAAQ,MAAM,eAAe;CAC3D,MAAM,OAAO,IAAI,gBAAgB;EAAE,cAAc,GAAG;EAAI,cAAc,GAAG;CAAa,CAAC;CACvF,MAAM,cAAc,CAAC,SAAS,IAAI,gBAAgB;EAAE,cAAc;EAAO,cAAc;CAAK,CAAC;CAE7F,MAAM,SAAS,OAAiB,KAAa,UAC3C,aAAa,KAAK,MAAM,OAAO,GAAG,GAAG,MAAM,MAAM,KAAK,KAAK,CAAC;CAE9D,MAAM,MAAM,OAAiB,KAAa,UACxC,GAAG,GAAG,MAAM,OAAO,GAAG,EAAE,KAAK,MAAM,MAAM,KAAK,KAAK;CAErD,MAAM,iBAAiB,UAAoB,GAAG,OAAO,EAAE,QAAQ,EAAE,iBAAiB;CAElF,MAAM,oBAAoB,UAAoB;EAC5C,IAAI,EAAE,WAAW,KAAA,GAAW,OAAO,GAAG;EACtC,iBAAiB,EAAE,sBAAsB,KAAA,CAAS;EAElD,OAAO,GAAG,OAAO,EAAE,QAAQ,EAAE,iBAAiB;CAChD;CAEA,MAAM,aAAa,OAAiB,QAClC,gBAAgB,IAAI,KAAK,UAAU,MAAM,OAAO,EAAE,cAAc,KAAK,CAAC,CAAC;CAEzE,MAAM,SAAS,OAAO,WAAW,WAC/B,WACA,QACA,KACA,SACA,SAIA;EACA,kBAAkB,OAAO,QAAQ,UAAU,UAAU,IAAI,EAAE,GAAG,OAAO,SAAS;EAC9E,IAAI,CAAC,EAAE,eAAe,IAAI,EAAE,OAAO,GAAG,OAAO,KAAA;EAC7C,MAAM,cAA4D,CAAC;EAEnE,KAAK,MAAM,UAAU,SAAS;GAC5B,IAAI,OAAO,EAAE,kBAAkB,QAAQ,OAAO,EAAE,kBAAkB,KAAA,GAAW;GAC7E,kBAAkB,OAAO,QAAQ,UAAU,UAAU,OAAO,EAAE,UAAU,OAAO,SAAS;GACxF,IAAI,EAAE,WAAW,KAAA,GAAW,iBAAiB,EAAE,iBAAiB,OAAO,EAAE,OAAO,MAAM,IAAI;GAE1F,MAAM,QAAQ,OAAO,OAAO,oBAC1B,OAAO,OAAO;IAAE,cAAc,OAAO;IAAQ,UAAU,OAAO;GAAO,CAAC,CACxE,CAAC,CAAC;IAAE,cAAc,OAAO,EAAE;IAAe,UAAU,OAAO,EAAE;GAAU,CAAC;GAExE,iBAAiB,CAAC,YAAY,MAAM,UAAU,MAAM,iBAAiB,MAAM,YAAY,CAAC;GACxF,YAAY,KAAK,KAAK;EACxB;EACA,iBAAiB,YAAY,UAAU,EAAE;EAEzC,OAAO;GACL;GACA;GACA,UAAU,OAAO,OAAO,oBAAoB,sBAAsB,CAAC,CAAC;IAClE;IACA,kBAAkB,IAAI,EAAE;IACxB,aAAa,YAAY,MAAM,GAAG,MAAM,EAAE,aAAa,cAAc,EAAE,YAAY,CAAC;GACtF,CAAC;GACD,aAAa,OAAO,EAAE,kBAAkB,GAAG;GAC3C,KAAK,OAAO,OAAO,aAAa,OAAO,GAAG,CAAC,CAAC,OAAO,OAAO,CAAC;EAC7D;CACF,CAAC;CAED,MAAM,OAAO,OAAO,WAAW,WAAW,WAAsB,UAAU,OAAO;EAC/E,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,SAAS;EAE1D,kBAAkB,OAAO,QAAQ,UAAU,UAAU,MAAM,OAAO,SAAS;EAC3E,IAAI,WAAW,aAAa;GAC1B,MAAM,SACJ,OAAO,GAAG,UAAU,QAAQ,OAAO,IAAI,EAAE,IAAI,IAAI,sBAAsB,QAAQ,KAAK,SAAS,GAAG,SAAS,EAAE,IAAI,MAAM,EAAE,OAAO,cAAc,OAAO,EAAE,WAAW;GAElK,iBAAiB,OAAO,UAAU,CAAC;GACnC,IAAI,OAAO,OAAO,KAAA,GAAW,OAAO,KAAA;GAEpC,MAAM,UACJ,OAAO,GAAG,UAAU,WAAW,OAAO,IAAI,EAAE,QAAQ,WAAW,KAAK,SAAS,GAAG,YAAY,EAAE,WAAW,MAAM,EAAE,OAAO,iBAAiB,UAAU,EAAE,YAAY,WAAW,OAAO,EAAE,YAAY,EAAE,YAAY;GAEjN,OAAO,OAAO,OACZ,WACA,QACA,QAAQ,OAAO,OAAO,IAAI,IAAI,GAC9B,QAAQ,KAAK,QAAQ,WAAW,OAAO,KAAK,IAAI,CAAC,GACjD,OAAO,EAAE,CAAC,UACZ;EACF;EAEA,MAAM,OACJ,OAAO,GAAG,UAAU,cAAc,OAAO,IAAI,EAAE,IAAI,iBAAiB,OAAO,IAAI,EAAE,IAAI,IAAI,sBAAsB,cAAc,KAAK,aAAa,iBAAiB,KAAK,MAAM,GAAG,kBAAkB,EAAE,WAAW,MAAM,EAAE,OAAO,iBAAiB,gBAAgB,EAAE,SAAS,GAAG,eAAe,EAAE,IAAI,MAAM,EAAE,OAAO,cAAc,aAAa,EAAE;EAE9U,IAAI,KAAK,OAAO,KAAA,GAAW,OAAO,KAAA;EAElC,OAAO,OAAO,OACZ,WACA,QACA,cAAc,OAAO,KAAK,IAAI,IAAI,GAClC,KAAK,KAAK,QAAQ,iBAAiB,OAAO,KAAK,IAAI,CAAC,GACpD,KAAK,EAAE,CAAC,UACV;CACF,CAAC;CAED,MAAM,mBAAmB,KAA8B,WAA8B;EACnF,IAAI,CAAC,OAAO,OAAO,GAAG;EACtB,iBAAiB,EAAE,uBAAuB,KAAA,CAAS;EAEnD,OAAO,GAAG,wBAAwB,QAAQ,KAAK,SAAS,GAAG,SAAS,EAAE,IAAI,MAAM,EAAE,OAAO,IAAI,IAAI,EAAE,mBAAmB,KAAK,QAAS,IAAI,SAAS,OAAO,GAAG,GAAG,QAAQ,OAAO,GAAG,EAAE,YAAY,OAAO,IAAI,SAAS,WAAW,MAAM,SAAS,KAAK,IAAI,IAAI,IAAI,GAAG,SAAS,KAAK,IAAI,IAAI,CAAE,CAAC,EAAE;CAC7R;CAEA,MAAM,sBAAsB,UAAkC,WAC5D,IAAI,IAAI;EACN,GAAG,wBAAwB,QAAQ,KAAK,SAAS,GAAG,SAAS,EAAE,IAAI,MAAM,EAAE,OAAO,MAAM,SAAS,EAAE,kBAAkB,SAAS,gBAAgB,EAAE,OAAO,cAAc,OAAO,EAAE;EAC9K,GAAG,yBAAyB,WAAW,KAAK,SAAS,GAAG,YAAY,EAAE,WAAW,MAAM,EAAE,OAAO,iBAAiB,UAAU,EAAE,MAAM,SAAS,YAAY;EACxJ,GAAG,SAAS,YAAY,KACrB,WACC,GAAG,wBAAwB,WAAW,KAAK,SAAS,GAAG,YAAY,EAAE,WAAW,MAAM,EAAE,OAAO,MAAM,YAAY,EAAE,cAAc,OAAO,YAAY,EAAE,OAAO,MAAM,YAAY,EAAE,UAAU,OAAO,QAAQ,EAAE,OAAO,iBAAiB,UAAU,EAAE,EACpP;CACF,CAAC;CAEH,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF,CAAC;;;AAID,MAAa,kBAAkB,OAAO,WAAW,WAC/C,UACA,aACA,KACA;CAGA,OAAO,OAFe,qBAAqB,UAAU,aAAa,SAAS,WAAW,GAAG,CAAC;AAG5F,CAAC"}

package/dist/internal/session-native-stateful.d.mts

@@ -0,0 +1,16 @@
+import { AnyTableModel } from "./table-model.mjs";
+import { StatefulSessionMapping } from "./models/session-model.mjs";
+import { NativeSqlTables } from "./native-sql-table.mjs";
+import { SqlBatchCommit } from "./sql-commit.mjs";
+import { Effect } from "effect";
+import { LifecycleHooks } from "@yielded/auth/Hooks";
+import { SessionRepository, StatefulSessionPersistence } from "@yielded/auth/Sessions";
+import { SqlClient } from "effect/sql/SqlClient";
+//#region src/internal/session-native-stateful.d.ts
+export type NativeStatefulSessionMapping<Claims> = StatefulSessionMapping<Claims, AnyTableModel, AnyTableModel, AnyTableModel, AnyTableModel, unknown, unknown>;
+export declare const makeNativeStatefulSessionServices: <Claims>(tables: NativeSqlTables, mapping: NativeStatefulSessionMapping<Claims>) => Effect.Effect<{
+  readonly statefulSessionPersistence: StatefulSessionPersistence<Claims>;
+  readonly sessionRepository: SessionRepository;
+}, never, LifecycleHooks | SqlBatchCommit | SqlClient>;
+//#endregion
+//# sourceMappingURL=session-native-stateful.d.mts.map

package/dist/internal/session-native-stateful.mjs

@@ -0,0 +1,225 @@
+import { PersistenceMappingError, isMappedConstraintConflict } from "./mapping-error.mjs";
+import { sqlBatchAssertion } from "./d1-planning.mjs";
+import { exactSqlText, executeSqlChange } from "./sql-change.mjs";
+import { CurrentSqlCommit, SqlBatchCommit, appendSqlBatchStatement, makeSqlCommitExecutor, registerSqlBatchPostcondition, registerSqlPostcondition } from "./sql-commit.mjs";
+import { makeNativeSessionAuthorityState, normalizeSessionOperation, sameSessionRevision, sessionInvariant, sessionUnavailable } from "./session-native-state.mjs";
+import { makeConditionalSqlInsert, makeNativeSessionRecords, sameSessionRecord } from "./session-native-record.mjs";
+import { makeNativeSessionPending, prepareNativeSession } from "./session-native-pending.mjs";
+import { allocateSessionValue, preservesRevision } from "./session-policy.mjs";
+import { sessionEvidenceDeadline } from "./session-native-authority.mjs";
+import { DateTime, Effect, Option, Schema } from "effect";
+import { PendingAuthenticationInvalid, SessionConflict, SessionId, SessionInvalid, SessionMetadata, StaleAuthentication, snapshotSessionAuthenticationProvenance } from "@yielded/auth/Sessions";
+//#region src/internal/session-native-stateful.ts
+const makeNativeStatefulSessionServices = Effect.fnUntraced(function* (tables, mapping) {
+	const batch = yield* SqlBatchCommit;
+	const state = yield* makeNativeSessionAuthorityState(tables, mapping, batch !== void 0);
+	const conditionalInsert = yield* makeConditionalSqlInsert();
+	const records = yield* makeNativeSessionRecords(tables, mapping);
+	const executor = yield* makeSqlCommitExecutor(sessionUnavailable);
+	const external = yield* Effect.serviceOption(CurrentSqlCommit);
+	const pending = mapping.pending === void 0 ? void 0 : yield* makeNativeSessionPending(tables, {
+		...mapping,
+		...mapping.pending
+	}, batch !== void 0);
+	const { sql, s, table, now, exact, live } = records;
+	const native = (work, mode = "transaction") => batch === void 0 ? executor.operation(normalizeSessionOperation(work), mode) : executor.operationBatch(normalizeSessionOperation(work)).pipe(Effect.provideService(SqlBatchCommit, batch));
+	const stage = Effect.fnUntraced(function* (statement, expected) {
+		if (batch !== void 0) {
+			yield* appendSqlBatchStatement(sql`${statement}`);
+			if (expected !== void 0) yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = ${expected}`));
+			return expected;
+		}
+		return yield* executeSqlChange(sql, statement);
+	});
+	const finalCondition = Effect.fnUntraced(function* (name, condition) {
+		if (batch !== void 0) yield* registerSqlBatchPostcondition({
+			name,
+			statement: sqlBatchAssertion(sql, condition)
+		});
+		else if (Option.isSome(external)) yield* registerSqlPostcondition({
+			name,
+			check: Effect.gen(function* () {
+				const rows = yield* sql`select 1 where ${condition}`;
+				sessionInvariant(rows.length === 1);
+			}).pipe(Effect.mapError((cause) => PersistenceMappingError.make({
+				operation: "decode",
+				cause
+			})))
+		});
+	});
+	const recordCondition = Effect.fnUntraced(function* (record, values) {
+		return sql`exists(select 1 from ${table.name} where ${yield* records.owner(record)} and ${exact(table, s.securityRevision, record.securityRevision)} and ${records.millis(table, s.expiresAt)} = ${DateTime.toEpochMillis(record.expiresAt)} and ${records.millis(table, s.absoluteExpiresAt)} = ${DateTime.toEpochMillis(record.absoluteExpiresAt)} and ${records.encodedCondition(values)} and ${live(table)})`;
+	});
+	const classify = (effect) => effect.pipe(Effect.mapError((error) => isMappedConstraintConflict(mapping.isConstraintConflict, error) ? SessionConflict.make({}) : error));
+	const verify = Effect.fnUntraced(function* (digest) {
+		const subject = state.subject.as("verified_subject"), session = table.as("verified_session"), owner = mapping.subject;
+		if (table.unencodedTextColumn?.(s.subjectId) !== void 0 && state.subject.unencodedTextColumn?.(owner.id) !== void 0) {
+			const rows = yield* sql`select ${session.fields("session_")}, ${subject.fields("subject_")} from ${session.name} join ${subject.name} on ${exactSqlText(sql, subject.column(owner.id), session.column(s.subjectId))} and ${state.activeSubject(subject)} and ${exactSqlText(sql, subject.column(owner.securityRevision), session.column(s.securityRevision))} where ${exact(session, s.digest, digest)} and ${live(session)} limit 2`;
+			sessionInvariant(rows.length <= 1);
+			if (rows[0] === void 0) return void 0;
+			const record = yield* records.decode(session.decode(rows[0], "session_"));
+			const decoded = subject.decode(rows[0], "subject_");
+			sessionInvariant((yield* mapping.subjectId.toSubject(decoded[owner.id])) === record.subjectId && decoded[owner.securityRevision] === record.securityRevision && owner.isActiveStatus(decoded[owner.status]));
+			return record;
+		}
+		const record = yield* records.read(digest);
+		if (record === void 0) return void 0;
+		const nativeSubject = yield* mapping.subjectId.toNative(record.subjectId);
+		const rows = yield* sql`select ${subject.fields("subject_")} from ${subject.name} where ${state.id(subject, owner.id, nativeSubject)} and ${state.activeSubject(subject)} and ${state.exact(subject, owner.securityRevision, record.securityRevision)} and ${now} < ${DateTime.toEpochMillis(record.expiresAt)} limit 2`;
+		sessionInvariant(rows.length <= 1);
+		if (rows[0] === void 0) return void 0;
+		sessionInvariant((yield* mapping.subjectId.toSubject(subject.decode(rows[0], "subject_")[owner.id])) === record.subjectId);
+		return record;
+	});
+	return {
+		statefulSessionPersistence: {
+			establish: (input, project) => native(classify(Effect.gen(function* () {
+				const current = yield* state.read(input.evidence.revision.subjectId, true);
+				if (current === void 0 || !sameSessionRevision(current.revision, input.evidence.revision)) return yield* StaleAuthentication.make({});
+				const assessment = yield* sessionEvidenceDeadline(input.evidence, current.requirement, current.now);
+				const expires = DateTime.toEpochMillis(input.session.expiresAt), absolute = DateTime.toEpochMillis(input.session.absoluteExpiresAt);
+				if (current.now >= expires || expires > absolute) return yield* StaleAuthentication.make({});
+				let pendingExpiry = Infinity;
+				if (input.pending !== void 0) {
+					if (pending === void 0 || mapping.pending === void 0) return yield* PendingAuthenticationInvalid.make({});
+					const found = yield* pending.read("Login", input.pending.digest);
+					if (found === void 0 || found.record.version !== input.pending.version || found.record.subjectId !== current.revision.subjectId || found.record.flowId !== input.pending.flowId || found.record.bindingDigest !== input.pending.bindingDigest) return yield* PendingAuthenticationInvalid.make({});
+					const original = yield* mapping.pending.login.decode(found.record.snapshot);
+					if (original.digest !== input.pending.digest || original.version !== input.pending.version || !preservesRevision(input.evidence, original.evidence) || DateTime.toEpochMillis(original.expiresAt) !== found.record.expiresAtMillis || original.attemptLimit !== found.record.attemptLimit) return yield* PendingAuthenticationInvalid.make({});
+					pendingExpiry = found.record.expiresAtMillis;
+					yield* pending.consume("Login", input.pending, current.native);
+				}
+				const nativeSession = yield* allocateSessionValue("interactive", s.allocateId, s.allocateIdSync);
+				const sessionId = yield* mapping.sessionId.toSession(nativeSession);
+				if (sessionId === input.handoffSourceSessionId) return yield* SessionConflict.make({});
+				const record = {
+					...input.session,
+					sessionId,
+					subjectId: current.revision.subjectId,
+					securityRevision: current.revision.securityRevision,
+					assurance: input.handoffSourceSessionId === void 0 ? assessment.assessed.assurance : input.session.assurance,
+					provenance: yield* snapshotSessionAuthenticationProvenance({ evidence: input.evidence }),
+					issuedAt: DateTime.makeUnsafe(current.now)
+				};
+				const deadline = Math.min(expires, assessment.validUntil, pendingExpiry);
+				const condition = sql`${state.authorityCondition(current.revision, current.native)} and ${state.policyCondition(current.row, current.native)} and ${now} >= ${current.now} and ${now} < ${deadline}`;
+				const values = {
+					...s.encodeInsert(record, {
+						subjectId: current.native,
+						sessionId: nativeSession
+					}),
+					[s.sessionId]: nativeSession,
+					[s.subjectId]: current.native,
+					[s.digest]: record.digest,
+					[s.securityRevision]: record.securityRevision,
+					[s.issuedAt]: s.encodeInstant(record.issuedAt),
+					[s.expiresAt]: s.encodeInstant(record.expiresAt),
+					[s.absoluteExpiresAt]: s.encodeInstant(record.absoluteExpiresAt)
+				};
+				if ((yield* stage(conditionalInsert(table, values, condition), 1)) !== 1) return yield* StaleAuthentication.make({});
+				const final = sql`${condition} and ${yield* recordCondition(record, values)}${input.pending === void 0 || pending === void 0 ? sql`` : sql` and ${pending.consumedCondition("Login", input.pending, current.native)}`}`;
+				yield* finalCondition("stateful-session-issuance", final);
+				if (batch === void 0 && Option.isSome(external)) yield* registerSqlPostcondition({
+					name: "stateful-session-issued-metadata",
+					check: Effect.gen(function* () {
+						const finalRecord = yield* records.read(record.digest);
+						sessionInvariant(finalRecord !== void 0 && sameSessionRecord(finalRecord, record));
+						const authority = yield* state.read(record.subjectId);
+						sessionInvariant(authority !== void 0 && sameSessionRevision(authority.revision, input.evidence.revision));
+						yield* sessionEvidenceDeadline(input.evidence, authority.requirement, authority.now);
+					}).pipe(Effect.mapError((cause) => PersistenceMappingError.make({
+						operation: "decode",
+						cause
+					})))
+				});
+				return yield* prepareNativeSession(record, project);
+			}))),
+			verify: ({ digest }) => executor.verify(verify(digest)).pipe(Effect.flatMap((record) => record === void 0 ? Effect.fail(SessionInvalid.make({})) : Effect.succeed(record))),
+			rotate: (input, project) => native(classify(Effect.gen(function* () {
+				const absolute = DateTime.toEpochMillis(input.record.absoluteExpiresAt), expires = DateTime.toEpochMillis(input.nextExpiresAt);
+				if (expires > absolute || input.nextDigest === input.record.digest || input.nextCredentialVersion === input.record.credentialVersion) return yield* SessionConflict.make({});
+				const needsSample = batch !== void 0 || sql.onDialectOrElse({
+					mysql: () => true,
+					orElse: () => false
+				});
+				const sampled = needsSample ? Number((yield* sql`select ${now} as engine_now`)[0]?.engine_now) : DateTime.toEpochMillis(input.record.issuedAt);
+				sessionInvariant(Number.isSafeInteger(sampled));
+				const prepared = {
+					...input.record,
+					digest: input.nextDigest,
+					credentialVersion: input.nextCredentialVersion,
+					expiresAt: input.nextExpiresAt,
+					issuedAt: DateTime.makeUnsafe(sampled)
+				};
+				const values = {
+					...s.encodeRotation(prepared),
+					[s.digest]: prepared.digest,
+					[s.issuedAt]: tables.expression(mapping.clock.fromMillis(now)),
+					[s.expiresAt]: s.encodeInstant(prepared.expiresAt)
+				};
+				const condition = sql`${yield* records.owner(input.record)} and ${live(table)} and ${now} < ${expires} and ${records.millis(table, s.absoluteExpiresAt)} = ${absolute}`;
+				const update = sql`${table.update(values)} where ${condition}`;
+				let record = prepared;
+				if (needsSample) {
+					const statement = sql`${table.update({
+						...values,
+						[s.issuedAt]: s.encodeInstant(prepared.issuedAt)
+					})} where ${condition} and ${now} >= ${sampled}`;
+					if ((yield* stage(statement, 1)) !== 1) return yield* SessionConflict.make({});
+				} else {
+					const rows = yield* sql`${update} returning ${table.fields("session_")}`;
+					if (rows.length !== 1) return yield* SessionConflict.make({});
+					record = yield* records.decode(table.decode(rows[0], "session_"));
+				}
+				yield* finalCondition("stateful-session-rotation", yield* recordCondition(record, {
+					...values,
+					[s.issuedAt]: s.encodeInstant(record.issuedAt)
+				}));
+				return yield* prepareNativeSession(record, project);
+			})), "statement"),
+			revokeDigest: (digest, project) => native(Effect.gen(function* () {
+				let expected;
+				if (batch !== void 0) expected = (yield* sql`select 1 from ${table.name} where ${exact(table, s.digest, digest)} limit 2`).length;
+				const changed = yield* stage(sql`delete from ${table.name} where ${exact(table, s.digest, digest)}`, expected);
+				sessionInvariant(changed !== void 0 && changed <= 1);
+				yield* finalCondition("stateful-session-digest-revocation", sql`not exists(select 1 from ${table.name} where ${exact(table, s.digest, digest)})`);
+				return yield* prepareNativeSession(changed === 1, project);
+			}), "statement"),
+			revoke: (input, project) => native(Effect.gen(function* () {
+				const subject = yield* mapping.subjectId.toNative(input.subjectId), session = yield* mapping.sessionId.toNative(input.sessionId);
+				const condition = sql`${state.id(table, s.subjectId, subject)} and ${state.id(table, s.sessionId, session)}`;
+				yield* stage(sql`delete from ${table.name} where ${condition}`);
+				yield* finalCondition("stateful-session-revocation", sql`not exists(select 1 from ${table.name} where ${condition})`);
+				return yield* prepareNativeSession(void 0, project);
+			}), "statement"),
+			revokeAll: (input, project) => native(Effect.gen(function* () {
+				const nativeSubject = yield* mapping.subjectId.toNative(input.subjectId), owner = mapping.subject;
+				const next = yield* allocateSessionValue("interactive", owner.nextSecurityRevision?.(input.expectedSecurityRevision), owner.nextSecurityRevisionSync === void 0 ? void 0 : () => owner.nextSecurityRevisionSync(input.expectedSecurityRevision));
+				sessionInvariant(next !== input.expectedSecurityRevision);
+				if ((yield* stage(sql`${state.subject.update({ [owner.securityRevision]: next })} where ${state.id(state.subject, owner.id, nativeSubject)} and ${state.activeSubject(state.subject)} and ${state.exact(state.subject, owner.securityRevision, input.expectedSecurityRevision)}`, 1)) !== 1) return yield* StaleAuthentication.make({});
+				yield* finalCondition("all-session-revocation", sql`exists(select 1 from ${state.subject.name} where ${state.id(state.subject, owner.id, nativeSubject)} and ${state.exact(state.subject, owner.securityRevision, next)})`);
+				return yield* prepareNativeSession(void 0, project);
+			}), "statement")
+		},
+		sessionRepository: { list: (input) => executor.read(Effect.gen(function* () {
+			sessionInvariant(Number.isSafeInteger(input.limit) && input.limit > 0 && input.limit <= 1e3);
+			const nativeSubject = yield* mapping.subjectId.toNative(input.subjectId), st = state.subject.as("listed_subject"), list = table.as("listed_session"), owner = mapping.subject;
+			const cursor = input.cursor === void 0 ? void 0 : yield* mapping.sessionId.toNative(yield* Schema.decodeEffect(SessionId)(input.cursor));
+			const rows = yield* sql`select ${list.fields("session_")}, ${st.fields("subject_")} from ${list.name} join ${st.name} on ${state.id(st, owner.id, nativeSubject)} and ${state.activeSubject(st)} and ${exactSqlText(sql, st.column(owner.securityRevision), list.column(s.securityRevision))} where ${state.id(list, s.subjectId, nativeSubject)} and ${live(list)}${cursor === void 0 ? sql`` : sql` and ${list.column(s.sessionId)} > ${list.value(s.sessionId, cursor)}`} order by ${list.column(s.sessionId)} limit ${input.limit + 1}`;
+			const decoded = yield* Effect.forEach(rows.slice(0, input.limit), (row) => Effect.gen(function* () {
+				const record = yield* records.decode(list.decode(row, "session_"));
+				sessionInvariant(record.subjectId === input.subjectId && (yield* mapping.subjectId.toSubject(st.decode(row, "subject_")[owner.id])) === input.subjectId);
+				return yield* Schema.decodeEffect(Schema.toType(SessionMetadata))(record);
+			}));
+			const nextCursor = rows.length > input.limit ? decoded.at(-1)?.sessionId : void 0;
+			return {
+				sessions: decoded,
+				...nextCursor === void 0 ? {} : { nextCursor }
+			};
+		})) }
+	};
+});
+//#endregion
+export { makeNativeStatefulSessionServices };
+
+//# sourceMappingURL=session-native-stateful.mjs.map

package/dist/internal/session-native-stateful.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-native-stateful.mjs","names":[],"sources":["../../src/internal/session-native-stateful.ts"],"sourcesContent":["import type { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport {\n  SessionConflict,\n  SessionInvalid,\n  PendingAuthenticationInvalid,\n  StaleAuthentication,\n  SessionMetadata,\n  SessionId,\n  snapshotSessionAuthenticationProvenance,\n  type StatefulSessionPersistence,\n  type StatefulSessionRecord,\n  type SessionRepository,\n} from \"@yielded/auth/Sessions\";\nimport { DateTime, Effect, Option, Schema } from \"effect\";\nimport type { SqlClient } from \"effect/sql/SqlClient\";\nimport type { Fragment } from \"effect/sql/Statement\";\n\nimport { sqlBatchAssertion } from \"./d1-planning\";\nimport { PersistenceMappingError, isMappedConstraintConflict } from \"./mapping-error\";\nimport type { StatefulSessionMapping } from \"./models/session-model\";\nimport type { NativeSqlTables } from \"./native-sql-table\";\nimport { sessionEvidenceDeadline } from \"./session-native-authority\";\nimport { makeNativeSessionPending, prepareNativeSession } from \"./session-native-pending\";\nimport {\n  makeConditionalSqlInsert,\n  makeNativeSessionRecords,\n  sameSessionRecord,\n} from \"./session-native-record\";\nimport {\n  makeNativeSessionAuthorityState,\n  sameSessionRevision,\n  normalizeSessionOperation,\n  sessionInvariant,\n  sessionUnavailable,\n} from \"./session-native-state\";\nimport { allocateSessionValue, preservesRevision } from \"./session-policy\";\nimport { exactSqlText, executeSqlChange } from \"./sql-change\";\nimport {\n  CurrentSqlCommit,\n  makeSqlCommitExecutor,\n  SqlBatchCommit,\n  appendSqlBatchStatement,\n  registerSqlBatchPostcondition,\n  registerSqlPostcondition,\n} from \"./sql-commit\";\nimport type { AnyTableModel } from \"./table-model\";\n\nexport type NativeStatefulSessionMapping<Claims> = StatefulSessionMapping<\n  Claims,\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  unknown,\n  unknown\n>;\n\nexport const makeNativeStatefulSessionServices = Effect.fnUntraced(function* <Claims>(\n  tables: NativeSqlTables,\n  mapping: NativeStatefulSessionMapping<Claims>,\n): Effect.fn.Return<\n  {\n    readonly statefulSessionPersistence: StatefulSessionPersistence<Claims>;\n    readonly sessionRepository: SessionRepository;\n  },\n  never,\n  SqlClient | LifecycleHooks | SqlBatchCommit\n> {\n  const batch = yield* SqlBatchCommit;\n\n  const state = yield* makeNativeSessionAuthorityState(tables, mapping, batch !== undefined);\n  const conditionalInsert = yield* makeConditionalSqlInsert();\n  const records = yield* makeNativeSessionRecords(tables, mapping);\n  const executor = yield* makeSqlCommitExecutor(sessionUnavailable);\n  const external = yield* Effect.serviceOption(CurrentSqlCommit);\n\n  const pending =\n    mapping.pending === undefined\n      ? undefined\n      : yield* makeNativeSessionPending(\n          tables,\n          { ...mapping, ...mapping.pending },\n          batch !== undefined,\n        );\n\n  const { sql, s, table, now, exact, live } = records;\n\n  const native = <A, E, R>(\n    work: Effect.Effect<A, E, R>,\n    mode: \"transaction\" | \"statement\" = \"transaction\",\n  ) =>\n    batch === undefined\n      ? executor.operation(normalizeSessionOperation(work), mode)\n      : executor\n          .operationBatch(normalizeSessionOperation(work))\n          .pipe(Effect.provideService(SqlBatchCommit, batch));\n\n  const stage = Effect.fnUntraced(function* (statement: Fragment, expected?: number) {\n    if (batch !== undefined) {\n      yield* appendSqlBatchStatement(sql`${statement}`);\n      if (expected !== undefined)\n        yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = ${expected}`));\n\n      return expected;\n    }\n\n    return yield* executeSqlChange(sql, statement);\n  });\n\n  const finalCondition = Effect.fnUntraced(function* (name: string, condition: Fragment) {\n    if (batch !== undefined)\n      yield* registerSqlBatchPostcondition({ name, statement: sqlBatchAssertion(sql, condition) });\n    else if (Option.isSome(external))\n      yield* registerSqlPostcondition({\n        name,\n        check: Effect.gen(function* () {\n          const rows = yield* sql`select 1 where ${condition}`;\n\n          sessionInvariant(rows.length === 1);\n        }).pipe(\n          Effect.mapError((cause) => PersistenceMappingError.make({ operation: \"decode\", cause })),\n        ),\n      });\n  });\n\n  const recordCondition = Effect.fnUntraced(function* (\n    record: StatefulSessionRecord<Claims>,\n    values: Readonly<Record<string, unknown>>,\n  ) {\n    return sql`exists(select 1 from ${table.name} where ${yield* records.owner(record)} and ${exact(table, s.securityRevision, record.securityRevision)} and ${records.millis(table, s.expiresAt)} = ${DateTime.toEpochMillis(record.expiresAt)} and ${records.millis(table, s.absoluteExpiresAt)} = ${DateTime.toEpochMillis(record.absoluteExpiresAt)} and ${records.encodedCondition(values)} and ${live(table)})`;\n  });\n\n  const classify = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n    effect.pipe(\n      Effect.mapError((error) =>\n        isMappedConstraintConflict(mapping.isConstraintConflict, error)\n          ? SessionConflict.make({})\n          : error,\n      ),\n    );\n\n  const verify = Effect.fnUntraced(function* (digest: StatefulSessionRecord<Claims>[\"digest\"]) {\n    const subject = state.subject.as(\"verified_subject\"),\n      session = table.as(\"verified_session\"),\n      owner = mapping.subject;\n\n    if (\n      table.unencodedTextColumn?.(s.subjectId) !== undefined &&\n      state.subject.unencodedTextColumn?.(owner.id) !== undefined\n    ) {\n      const rows =\n        yield* sql`select ${session.fields(\"session_\")}, ${subject.fields(\"subject_\")} from ${session.name} join ${subject.name} on ${exactSqlText(sql, subject.column(owner.id), session.column(s.subjectId))} and ${state.activeSubject(subject)} and ${exactSqlText(sql, subject.column(owner.securityRevision), session.column(s.securityRevision))} where ${exact(session, s.digest, digest)} and ${live(session)} limit 2`;\n\n      sessionInvariant(rows.length <= 1);\n      if (rows[0] === undefined) return undefined;\n      const record = yield* records.decode(session.decode(rows[0], \"session_\"));\n      const decoded = subject.decode(rows[0], \"subject_\");\n\n      sessionInvariant(\n        (yield* mapping.subjectId.toSubject(decoded[owner.id])) === record.subjectId &&\n          decoded[owner.securityRevision] === record.securityRevision &&\n          owner.isActiveStatus(decoded[owner.status]),\n      );\n\n      return record;\n    }\n    const record = yield* records.read(digest);\n\n    if (record === undefined) return undefined;\n    const nativeSubject = yield* mapping.subjectId.toNative(record.subjectId);\n\n    const rows =\n      yield* sql`select ${subject.fields(\"subject_\")} from ${subject.name} where ${state.id(subject, owner.id, nativeSubject)} and ${state.activeSubject(subject)} and ${state.exact(subject, owner.securityRevision, record.securityRevision)} and ${now} < ${DateTime.toEpochMillis(record.expiresAt)} limit 2`;\n\n    sessionInvariant(rows.length <= 1);\n    if (rows[0] === undefined) return undefined;\n    sessionInvariant(\n      (yield* mapping.subjectId.toSubject(subject.decode(rows[0], \"subject_\")[owner.id])) ===\n        record.subjectId,\n    );\n\n    return record;\n  });\n\n  const persistence: StatefulSessionPersistence<Claims> = {\n    establish: (input, project) =>\n      native(\n        classify(\n          Effect.gen(function* () {\n            const current = yield* state.read(input.evidence.revision.subjectId, true);\n\n            if (\n              current === undefined ||\n              !sameSessionRevision(current.revision, input.evidence.revision)\n            )\n              return yield* StaleAuthentication.make({});\n\n            const assessment = yield* sessionEvidenceDeadline(\n              input.evidence,\n              current.requirement,\n              current.now,\n            );\n\n            const expires = DateTime.toEpochMillis(input.session.expiresAt),\n              absolute = DateTime.toEpochMillis(input.session.absoluteExpiresAt);\n\n            if (current.now >= expires || expires > absolute)\n              return yield* StaleAuthentication.make({});\n            let pendingExpiry = Infinity;\n\n            if (input.pending !== undefined) {\n              if (pending === undefined || mapping.pending === undefined)\n                return yield* PendingAuthenticationInvalid.make({});\n              const found = yield* pending.read(\"Login\", input.pending.digest);\n\n              if (\n                found === undefined ||\n                found.record.version !== input.pending.version ||\n                found.record.subjectId !== current.revision.subjectId ||\n                found.record.flowId !== input.pending.flowId ||\n                found.record.bindingDigest !== input.pending.bindingDigest\n              )\n                return yield* PendingAuthenticationInvalid.make({});\n              const original = yield* mapping.pending.login.decode(found.record.snapshot);\n\n              if (\n                original.digest !== input.pending.digest ||\n                original.version !== input.pending.version ||\n                !preservesRevision(input.evidence, original.evidence) ||\n                DateTime.toEpochMillis(original.expiresAt) !== found.record.expiresAtMillis ||\n                original.attemptLimit !== found.record.attemptLimit\n              )\n                return yield* PendingAuthenticationInvalid.make({});\n              pendingExpiry = found.record.expiresAtMillis;\n              yield* pending.consume(\"Login\", input.pending, current.native);\n            }\n\n            const nativeSession = yield* allocateSessionValue(\n              \"interactive\",\n              s.allocateId,\n              s.allocateIdSync,\n            );\n\n            const sessionId = yield* mapping.sessionId.toSession(nativeSession);\n\n            if (sessionId === input.handoffSourceSessionId) return yield* SessionConflict.make({});\n\n            const record: StatefulSessionRecord<Claims> = {\n              ...input.session,\n              sessionId,\n              subjectId: current.revision.subjectId,\n              securityRevision: current.revision.securityRevision,\n              assurance:\n                input.handoffSourceSessionId === undefined\n                  ? assessment.assessed.assurance\n                  : input.session.assurance,\n              provenance: yield* snapshotSessionAuthenticationProvenance({\n                evidence: input.evidence,\n              }),\n              issuedAt: DateTime.makeUnsafe(current.now),\n            };\n\n            const deadline = Math.min(expires, assessment.validUntil, pendingExpiry);\n            const condition = sql`${state.authorityCondition(current.revision, current.native)} and ${state.policyCondition(current.row, current.native)} and ${now} >= ${current.now} and ${now} < ${deadline}`;\n\n            const values = {\n              ...s.encodeInsert(record, { subjectId: current.native, sessionId: nativeSession }),\n              [s.sessionId]: nativeSession,\n              [s.subjectId]: current.native,\n              [s.digest]: record.digest,\n              [s.securityRevision]: record.securityRevision,\n              [s.issuedAt]: s.encodeInstant(record.issuedAt),\n              [s.expiresAt]: s.encodeInstant(record.expiresAt),\n              [s.absoluteExpiresAt]: s.encodeInstant(record.absoluteExpiresAt),\n            };\n\n            const changed = yield* stage(conditionalInsert(table, values, condition), 1);\n\n            if (changed !== 1) return yield* StaleAuthentication.make({});\n            const final = sql`${condition} and ${yield* recordCondition(record, values)}${input.pending === undefined || pending === undefined ? sql`` : sql` and ${pending.consumedCondition(\"Login\", input.pending, current.native)}`}`;\n\n            yield* finalCondition(\"stateful-session-issuance\", final);\n            if (batch === undefined && Option.isSome(external))\n              yield* registerSqlPostcondition({\n                name: \"stateful-session-issued-metadata\",\n                check: Effect.gen(function* () {\n                  const finalRecord = yield* records.read(record.digest);\n\n                  sessionInvariant(\n                    finalRecord !== undefined && sameSessionRecord(finalRecord, record),\n                  );\n                  const authority = yield* state.read(record.subjectId);\n\n                  sessionInvariant(\n                    authority !== undefined &&\n                      sameSessionRevision(authority.revision, input.evidence.revision),\n                  );\n                  yield* sessionEvidenceDeadline(\n                    input.evidence,\n                    authority.requirement,\n                    authority.now,\n                  );\n                }).pipe(\n                  Effect.mapError((cause) =>\n                    PersistenceMappingError.make({ operation: \"decode\", cause }),\n                  ),\n                ),\n              });\n\n            return yield* prepareNativeSession(record, project);\n          }),\n        ),\n      ),\n    verify: ({ digest }) =>\n      executor\n        .verify(verify(digest))\n        .pipe(\n          Effect.flatMap((record) =>\n            record === undefined ? Effect.fail(SessionInvalid.make({})) : Effect.succeed(record),\n          ),\n        ),\n    rotate: (input, project) =>\n      native(\n        classify(\n          Effect.gen(function* () {\n            const absolute = DateTime.toEpochMillis(input.record.absoluteExpiresAt),\n              expires = DateTime.toEpochMillis(input.nextExpiresAt);\n\n            if (\n              expires > absolute ||\n              input.nextDigest === input.record.digest ||\n              input.nextCredentialVersion === input.record.credentialVersion\n            )\n              return yield* SessionConflict.make({});\n\n            const needsSample =\n              batch !== undefined ||\n              sql.onDialectOrElse({ mysql: () => true, orElse: () => false });\n\n            const sampled = needsSample\n              ? Number((yield* sql`select ${now} as engine_now`)[0]?.engine_now)\n              : DateTime.toEpochMillis(input.record.issuedAt);\n\n            sessionInvariant(Number.isSafeInteger(sampled));\n\n            const prepared = {\n              ...input.record,\n              digest: input.nextDigest,\n              credentialVersion: input.nextCredentialVersion,\n              expiresAt: input.nextExpiresAt,\n              issuedAt: DateTime.makeUnsafe(sampled),\n            };\n\n            const values = {\n              ...s.encodeRotation(prepared),\n              [s.digest]: prepared.digest,\n              [s.issuedAt]: tables.expression(mapping.clock.fromMillis(now)),\n              [s.expiresAt]: s.encodeInstant(prepared.expiresAt),\n            };\n\n            const condition = sql`${yield* records.owner(input.record)} and ${live(table)} and ${now} < ${expires} and ${records.millis(table, s.absoluteExpiresAt)} = ${absolute}`;\n            const update = sql`${table.update(values)} where ${condition}`;\n            let record = prepared;\n\n            if (needsSample) {\n              // Batch receipts are prepared before execution. The exact sampled time is\n              // written and checked; no speculative UPDATE result is treated as committed.\n              const statement = sql`${table.update({ ...values, [s.issuedAt]: s.encodeInstant(prepared.issuedAt) })} where ${condition} and ${now} >= ${sampled}`;\n              const changed = yield* stage(statement, 1);\n\n              if (changed !== 1) return yield* SessionConflict.make({});\n            } else {\n              const rows = yield* sql`${update} returning ${table.fields(\"session_\")}`;\n\n              if (rows.length !== 1) return yield* SessionConflict.make({});\n              record = yield* records.decode(table.decode(rows[0]!, \"session_\"));\n            }\n            yield* finalCondition(\n              \"stateful-session-rotation\",\n              yield* recordCondition(record, {\n                ...values,\n                [s.issuedAt]: s.encodeInstant(record.issuedAt),\n              }),\n            );\n\n            return yield* prepareNativeSession(record, project);\n          }),\n        ),\n        \"statement\",\n      ),\n    revokeDigest: (digest, project) =>\n      native(\n        Effect.gen(function* () {\n          let expected: number | undefined;\n\n          if (batch !== undefined)\n            expected =\n              (yield* sql`select 1 from ${table.name} where ${exact(table, s.digest, digest)} limit 2`)\n                .length;\n\n          const changed = yield* stage(\n            sql`delete from ${table.name} where ${exact(table, s.digest, digest)}`,\n            expected,\n          );\n\n          sessionInvariant(changed !== undefined && changed <= 1);\n          yield* finalCondition(\n            \"stateful-session-digest-revocation\",\n            sql`not exists(select 1 from ${table.name} where ${exact(table, s.digest, digest)})`,\n          );\n\n          return yield* prepareNativeSession(changed === 1, project);\n        }),\n        \"statement\",\n      ),\n    revoke: (input, project) =>\n      native(\n        Effect.gen(function* () {\n          const subject = yield* mapping.subjectId.toNative(input.subjectId),\n            session = yield* mapping.sessionId.toNative(input.sessionId);\n\n          const condition = sql`${state.id(table, s.subjectId, subject)} and ${state.id(table, s.sessionId, session)}`;\n\n          yield* stage(sql`delete from ${table.name} where ${condition}`);\n          yield* finalCondition(\n            \"stateful-session-revocation\",\n            sql`not exists(select 1 from ${table.name} where ${condition})`,\n          );\n\n          return yield* prepareNativeSession(undefined, project);\n        }),\n        \"statement\",\n      ),\n    revokeAll: (input, project) =>\n      native(\n        Effect.gen(function* () {\n          const nativeSubject = yield* mapping.subjectId.toNative(input.subjectId),\n            owner = mapping.subject;\n\n          const next = yield* allocateSessionValue(\n            \"interactive\",\n            owner.nextSecurityRevision?.(input.expectedSecurityRevision),\n            owner.nextSecurityRevisionSync === undefined\n              ? undefined\n              : () => owner.nextSecurityRevisionSync!(input.expectedSecurityRevision),\n          );\n\n          sessionInvariant(next !== input.expectedSecurityRevision);\n\n          const changed = yield* stage(\n            sql`${state.subject.update({ [owner.securityRevision]: next })} where ${state.id(state.subject, owner.id, nativeSubject)} and ${state.activeSubject(state.subject)} and ${state.exact(state.subject, owner.securityRevision, input.expectedSecurityRevision)}`,\n            1,\n          );\n\n          if (changed !== 1) return yield* StaleAuthentication.make({});\n          yield* finalCondition(\n            \"all-session-revocation\",\n            sql`exists(select 1 from ${state.subject.name} where ${state.id(state.subject, owner.id, nativeSubject)} and ${state.exact(state.subject, owner.securityRevision, next)})`,\n          );\n\n          return yield* prepareNativeSession(undefined, project);\n        }),\n        \"statement\",\n      ),\n  };\n\n  const sessionRepository: SessionRepository = {\n    list: (input) =>\n      executor.read(\n        Effect.gen(function* () {\n          sessionInvariant(\n            Number.isSafeInteger(input.limit) && input.limit > 0 && input.limit <= 1000,\n          );\n\n          const nativeSubject = yield* mapping.subjectId.toNative(input.subjectId),\n            st = state.subject.as(\"listed_subject\"),\n            list = table.as(\"listed_session\"),\n            owner = mapping.subject;\n\n          const cursor =\n            input.cursor === undefined\n              ? undefined\n              : yield* mapping.sessionId.toNative(\n                  yield* Schema.decodeEffect(SessionId)(input.cursor),\n                );\n\n          const rows =\n            yield* sql`select ${list.fields(\"session_\")}, ${st.fields(\"subject_\")} from ${list.name} join ${st.name} on ${state.id(st, owner.id, nativeSubject)} and ${state.activeSubject(st)} and ${exactSqlText(sql, st.column(owner.securityRevision), list.column(s.securityRevision))} where ${state.id(list, s.subjectId, nativeSubject)} and ${live(list)}${cursor === undefined ? sql`` : sql` and ${list.column(s.sessionId)} > ${list.value(s.sessionId, cursor)}`} order by ${list.column(s.sessionId)} limit ${input.limit + 1}`;\n\n          const decoded = yield* Effect.forEach(rows.slice(0, input.limit), (row) =>\n            Effect.gen(function* () {\n              const record = yield* records.decode(list.decode(row, \"session_\"));\n\n              sessionInvariant(\n                record.subjectId === input.subjectId &&\n                  (yield* mapping.subjectId.toSubject(st.decode(row, \"subject_\")[owner.id])) ===\n                    input.subjectId,\n              );\n\n              return yield* Schema.decodeEffect(Schema.toType(SessionMetadata))(record);\n            }),\n          );\n\n          const nextCursor = rows.length > input.limit ? decoded.at(-1)?.sessionId : undefined;\n\n          return { sessions: decoded, ...(nextCursor === undefined ? {} : { nextCursor }) };\n        }),\n      ),\n  };\n\n  return { statefulSessionPersistence: persistence, sessionRepository };\n});\n"],"mappings":";;;;;;;;;;;;AAyDA,MAAa,oCAAoC,OAAO,WAAW,WACjE,QACA,SAQA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,QAAQ,OAAO,gCAAgC,QAAQ,SAAS,UAAU,KAAA,CAAS;CACzF,MAAM,oBAAoB,OAAO,yBAAyB;CAC1D,MAAM,UAAU,OAAO,yBAAyB,QAAQ,OAAO;CAC/D,MAAM,WAAW,OAAO,sBAAsB,kBAAkB;CAChE,MAAM,WAAW,OAAO,OAAO,cAAc,gBAAgB;CAE7D,MAAM,UACJ,QAAQ,YAAY,KAAA,IAChB,KAAA,IACA,OAAO,yBACL,QACA;EAAE,GAAG;EAAS,GAAG,QAAQ;CAAQ,GACjC,UAAU,KAAA,CACZ;CAEN,MAAM,EAAE,KAAK,GAAG,OAAO,KAAK,OAAO,SAAS;CAE5C,MAAM,UACJ,MACA,OAAoC,kBAEpC,UAAU,KAAA,IACN,SAAS,UAAU,0BAA0B,IAAI,GAAG,IAAI,IACxD,SACG,eAAe,0BAA0B,IAAI,CAAC,CAAC,CAC/C,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CAE1D,MAAM,QAAQ,OAAO,WAAW,WAAW,WAAqB,UAAmB;EACjF,IAAI,UAAU,KAAA,GAAW;GACvB,OAAO,wBAAwB,GAAG,GAAG,WAAW;GAChD,IAAI,aAAa,KAAA,GACf,OAAO,wBAAwB,kBAAkB,KAAK,GAAG,eAAe,UAAU,CAAC;GAErF,OAAO;EACT;EAEA,OAAO,OAAO,iBAAiB,KAAK,SAAS;CAC/C,CAAC;CAED,MAAM,iBAAiB,OAAO,WAAW,WAAW,MAAc,WAAqB;EACrF,IAAI,UAAU,KAAA,GACZ,OAAO,8BAA8B;GAAE;GAAM,WAAW,kBAAkB,KAAK,SAAS;EAAE,CAAC;OACxF,IAAI,OAAO,OAAO,QAAQ,GAC7B,OAAO,yBAAyB;GAC9B;GACA,OAAO,OAAO,IAAI,aAAa;IAC7B,MAAM,OAAO,OAAO,GAAG,kBAAkB;IAEzC,iBAAiB,KAAK,WAAW,CAAC;GACpC,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,UAAU,wBAAwB,KAAK;IAAE,WAAW;IAAU;GAAM,CAAC,CAAC,CACzF;EACF,CAAC;CACL,CAAC;CAED,MAAM,kBAAkB,OAAO,WAAW,WACxC,QACA,QACA;EACA,OAAO,GAAG,wBAAwB,MAAM,KAAK,SAAS,OAAO,QAAQ,MAAM,MAAM,EAAE,OAAO,MAAM,OAAO,EAAE,kBAAkB,OAAO,gBAAgB,EAAE,OAAO,QAAQ,OAAO,OAAO,EAAE,SAAS,EAAE,KAAK,SAAS,cAAc,OAAO,SAAS,EAAE,OAAO,QAAQ,OAAO,OAAO,EAAE,iBAAiB,EAAE,KAAK,SAAS,cAAc,OAAO,iBAAiB,EAAE,OAAO,QAAQ,iBAAiB,MAAM,EAAE,OAAO,KAAK,KAAK,EAAE;CACjZ,CAAC;CAED,MAAM,YAAqB,WACzB,OAAO,KACL,OAAO,UAAU,UACf,2BAA2B,QAAQ,sBAAsB,KAAK,IAC1D,gBAAgB,KAAK,CAAC,CAAC,IACvB,KACN,CACF;CAEF,MAAM,SAAS,OAAO,WAAW,WAAW,QAAiD;EAC3F,MAAM,UAAU,MAAM,QAAQ,GAAG,kBAAkB,GACjD,UAAU,MAAM,GAAG,kBAAkB,GACrC,QAAQ,QAAQ;EAElB,IACE,MAAM,sBAAsB,EAAE,SAAS,MAAM,KAAA,KAC7C,MAAM,QAAQ,sBAAsB,MAAM,EAAE,MAAM,KAAA,GAClD;GACA,MAAM,OACJ,OAAO,GAAG,UAAU,QAAQ,OAAO,UAAU,EAAE,IAAI,QAAQ,OAAO,UAAU,EAAE,QAAQ,QAAQ,KAAK,QAAQ,QAAQ,KAAK,MAAM,aAAa,KAAK,QAAQ,OAAO,MAAM,EAAE,GAAG,QAAQ,OAAO,EAAE,SAAS,CAAC,EAAE,OAAO,MAAM,cAAc,OAAO,EAAE,OAAO,aAAa,KAAK,QAAQ,OAAO,MAAM,gBAAgB,GAAG,QAAQ,OAAO,EAAE,gBAAgB,CAAC,EAAE,SAAS,MAAM,SAAS,EAAE,QAAQ,MAAM,EAAE,OAAO,KAAK,OAAO,EAAE;GAEjZ,iBAAiB,KAAK,UAAU,CAAC;GACjC,IAAI,KAAK,OAAO,KAAA,GAAW,OAAO,KAAA;GAClC,MAAM,SAAS,OAAO,QAAQ,OAAO,QAAQ,OAAO,KAAK,IAAI,UAAU,CAAC;GACxE,MAAM,UAAU,QAAQ,OAAO,KAAK,IAAI,UAAU;GAElD,kBACG,OAAO,QAAQ,UAAU,UAAU,QAAQ,MAAM,GAAG,OAAO,OAAO,aACjE,QAAQ,MAAM,sBAAsB,OAAO,oBAC3C,MAAM,eAAe,QAAQ,MAAM,OAAO,CAC9C;GAEA,OAAO;EACT;EACA,MAAM,SAAS,OAAO,QAAQ,KAAK,MAAM;EAEzC,IAAI,WAAW,KAAA,GAAW,OAAO,KAAA;EACjC,MAAM,gBAAgB,OAAO,QAAQ,UAAU,SAAS,OAAO,SAAS;EAExE,MAAM,OACJ,OAAO,GAAG,UAAU,QAAQ,OAAO,UAAU,EAAE,QAAQ,QAAQ,KAAK,SAAS,MAAM,GAAG,SAAS,MAAM,IAAI,aAAa,EAAE,OAAO,MAAM,cAAc,OAAO,EAAE,OAAO,MAAM,MAAM,SAAS,MAAM,kBAAkB,OAAO,gBAAgB,EAAE,OAAO,IAAI,KAAK,SAAS,cAAc,OAAO,SAAS,EAAE;EAEpS,iBAAiB,KAAK,UAAU,CAAC;EACjC,IAAI,KAAK,OAAO,KAAA,GAAW,OAAO,KAAA;EAClC,kBACG,OAAO,QAAQ,UAAU,UAAU,QAAQ,OAAO,KAAK,IAAI,UAAU,CAAC,CAAC,MAAM,GAAG,OAC/E,OAAO,SACX;EAEA,OAAO;CACT,CAAC;CAwUD,OAAO;EAAE,4BAA4B;GArUnC,YAAY,OAAO,YACjB,OACE,SACE,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO,MAAM,KAAK,MAAM,SAAS,SAAS,WAAW,IAAI;IAEzE,IACE,YAAY,KAAA,KACZ,CAAC,oBAAoB,QAAQ,UAAU,MAAM,SAAS,QAAQ,GAE9D,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;IAE3C,MAAM,aAAa,OAAO,wBACxB,MAAM,UACN,QAAQ,aACR,QAAQ,GACV;IAEA,MAAM,UAAU,SAAS,cAAc,MAAM,QAAQ,SAAS,GAC5D,WAAW,SAAS,cAAc,MAAM,QAAQ,iBAAiB;IAEnE,IAAI,QAAQ,OAAO,WAAW,UAAU,UACtC,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;IAC3C,IAAI,gBAAgB;IAEpB,IAAI,MAAM,YAAY,KAAA,GAAW;KAC/B,IAAI,YAAY,KAAA,KAAa,QAAQ,YAAY,KAAA,GAC/C,OAAO,OAAO,6BAA6B,KAAK,CAAC,CAAC;KACpD,MAAM,QAAQ,OAAO,QAAQ,KAAK,SAAS,MAAM,QAAQ,MAAM;KAE/D,IACE,UAAU,KAAA,KACV,MAAM,OAAO,YAAY,MAAM,QAAQ,WACvC,MAAM,OAAO,cAAc,QAAQ,SAAS,aAC5C,MAAM,OAAO,WAAW,MAAM,QAAQ,UACtC,MAAM,OAAO,kBAAkB,MAAM,QAAQ,eAE7C,OAAO,OAAO,6BAA6B,KAAK,CAAC,CAAC;KACpD,MAAM,WAAW,OAAO,QAAQ,QAAQ,MAAM,OAAO,MAAM,OAAO,QAAQ;KAE1E,IACE,SAAS,WAAW,MAAM,QAAQ,UAClC,SAAS,YAAY,MAAM,QAAQ,WACnC,CAAC,kBAAkB,MAAM,UAAU,SAAS,QAAQ,KACpD,SAAS,cAAc,SAAS,SAAS,MAAM,MAAM,OAAO,mBAC5D,SAAS,iBAAiB,MAAM,OAAO,cAEvC,OAAO,OAAO,6BAA6B,KAAK,CAAC,CAAC;KACpD,gBAAgB,MAAM,OAAO;KAC7B,OAAO,QAAQ,QAAQ,SAAS,MAAM,SAAS,QAAQ,MAAM;IAC/D;IAEA,MAAM,gBAAgB,OAAO,qBAC3B,eACA,EAAE,YACF,EAAE,cACJ;IAEA,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,aAAa;IAElE,IAAI,cAAc,MAAM,wBAAwB,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;IAErF,MAAM,SAAwC;KAC5C,GAAG,MAAM;KACT;KACA,WAAW,QAAQ,SAAS;KAC5B,kBAAkB,QAAQ,SAAS;KACnC,WACE,MAAM,2BAA2B,KAAA,IAC7B,WAAW,SAAS,YACpB,MAAM,QAAQ;KACpB,YAAY,OAAO,wCAAwC,EACzD,UAAU,MAAM,SAClB,CAAC;KACD,UAAU,SAAS,WAAW,QAAQ,GAAG;IAC3C;IAEA,MAAM,WAAW,KAAK,IAAI,SAAS,WAAW,YAAY,aAAa;IACvE,MAAM,YAAY,GAAG,GAAG,MAAM,mBAAmB,QAAQ,UAAU,QAAQ,MAAM,EAAE,OAAO,MAAM,gBAAgB,QAAQ,KAAK,QAAQ,MAAM,EAAE,OAAO,IAAI,MAAM,QAAQ,IAAI,OAAO,IAAI,KAAK;IAE1L,MAAM,SAAS;KACb,GAAG,EAAE,aAAa,QAAQ;MAAE,WAAW,QAAQ;MAAQ,WAAW;KAAc,CAAC;MAChF,EAAE,YAAY;MACd,EAAE,YAAY,QAAQ;MACtB,EAAE,SAAS,OAAO;MAClB,EAAE,mBAAmB,OAAO;MAC5B,EAAE,WAAW,EAAE,cAAc,OAAO,QAAQ;MAC5C,EAAE,YAAY,EAAE,cAAc,OAAO,SAAS;MAC9C,EAAE,oBAAoB,EAAE,cAAc,OAAO,iBAAiB;IACjE;IAIA,KAAI,OAFmB,MAAM,kBAAkB,OAAO,QAAQ,SAAS,GAAG,CAAC,OAE3D,GAAG,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,GAAG,UAAU,OAAO,OAAO,gBAAgB,QAAQ,MAAM,IAAI,MAAM,YAAY,KAAA,KAAa,YAAY,KAAA,IAAY,GAAG,KAAK,GAAG,QAAQ,QAAQ,kBAAkB,SAAS,MAAM,SAAS,QAAQ,MAAM;IAExN,OAAO,eAAe,6BAA6B,KAAK;IACxD,IAAI,UAAU,KAAA,KAAa,OAAO,OAAO,QAAQ,GAC/C,OAAO,yBAAyB;KAC9B,MAAM;KACN,OAAO,OAAO,IAAI,aAAa;MAC7B,MAAM,cAAc,OAAO,QAAQ,KAAK,OAAO,MAAM;MAErD,iBACE,gBAAgB,KAAA,KAAa,kBAAkB,aAAa,MAAM,CACpE;MACA,MAAM,YAAY,OAAO,MAAM,KAAK,OAAO,SAAS;MAEpD,iBACE,cAAc,KAAA,KACZ,oBAAoB,UAAU,UAAU,MAAM,SAAS,QAAQ,CACnE;MACA,OAAO,wBACL,MAAM,UACN,UAAU,aACV,UAAU,GACZ;KACF,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,UACf,wBAAwB,KAAK;MAAE,WAAW;MAAU;KAAM,CAAC,CAC7D,CACF;IACF,CAAC;IAEH,OAAO,OAAO,qBAAqB,QAAQ,OAAO;GACpD,CAAC,CACH,CACF;GACF,SAAS,EAAE,aACT,SACG,OAAO,OAAO,MAAM,CAAC,CAAC,CACtB,KACC,OAAO,SAAS,WACd,WAAW,KAAA,IAAY,OAAO,KAAK,eAAe,KAAK,CAAC,CAAC,CAAC,IAAI,OAAO,QAAQ,MAAM,CACrF,CACF;GACJ,SAAS,OAAO,YACd,OACE,SACE,OAAO,IAAI,aAAa;IACtB,MAAM,WAAW,SAAS,cAAc,MAAM,OAAO,iBAAiB,GACpE,UAAU,SAAS,cAAc,MAAM,aAAa;IAEtD,IACE,UAAU,YACV,MAAM,eAAe,MAAM,OAAO,UAClC,MAAM,0BAA0B,MAAM,OAAO,mBAE7C,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;IAEvC,MAAM,cACJ,UAAU,KAAA,KACV,IAAI,gBAAgB;KAAE,aAAa;KAAM,cAAc;IAAM,CAAC;IAEhE,MAAM,UAAU,cACZ,QAAQ,OAAO,GAAG,UAAU,IAAI,gBAAA,CAAiB,EAAE,EAAE,UAAU,IAC/D,SAAS,cAAc,MAAM,OAAO,QAAQ;IAEhD,iBAAiB,OAAO,cAAc,OAAO,CAAC;IAE9C,MAAM,WAAW;KACf,GAAG,MAAM;KACT,QAAQ,MAAM;KACd,mBAAmB,MAAM;KACzB,WAAW,MAAM;KACjB,UAAU,SAAS,WAAW,OAAO;IACvC;IAEA,MAAM,SAAS;KACb,GAAG,EAAE,eAAe,QAAQ;MAC3B,EAAE,SAAS,SAAS;MACpB,EAAE,WAAW,OAAO,WAAW,QAAQ,MAAM,WAAW,GAAG,CAAC;MAC5D,EAAE,YAAY,EAAE,cAAc,SAAS,SAAS;IACnD;IAEA,MAAM,YAAY,GAAG,GAAG,OAAO,QAAQ,MAAM,MAAM,MAAM,EAAE,OAAO,KAAK,KAAK,EAAE,OAAO,IAAI,KAAK,QAAQ,OAAO,QAAQ,OAAO,OAAO,EAAE,iBAAiB,EAAE,KAAK;IAC7J,MAAM,SAAS,GAAG,GAAG,MAAM,OAAO,MAAM,EAAE,SAAS;IACnD,IAAI,SAAS;IAEb,IAAI,aAAa;KAGf,MAAM,YAAY,GAAG,GAAG,MAAM,OAAO;MAAE,GAAG;OAAS,EAAE,WAAW,EAAE,cAAc,SAAS,QAAQ;KAAE,CAAC,EAAE,SAAS,UAAU,OAAO,IAAI,MAAM;KAG1I,KAAI,OAFmB,MAAM,WAAW,CAAC,OAEzB,GAAG,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;IAC1D,OAAO;KACL,MAAM,OAAO,OAAO,GAAG,GAAG,OAAO,aAAa,MAAM,OAAO,UAAU;KAErE,IAAI,KAAK,WAAW,GAAG,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;KAC5D,SAAS,OAAO,QAAQ,OAAO,MAAM,OAAO,KAAK,IAAK,UAAU,CAAC;IACnE;IACA,OAAO,eACL,6BACA,OAAO,gBAAgB,QAAQ;KAC7B,GAAG;MACF,EAAE,WAAW,EAAE,cAAc,OAAO,QAAQ;IAC/C,CAAC,CACH;IAEA,OAAO,OAAO,qBAAqB,QAAQ,OAAO;GACpD,CAAC,CACH,GACA,WACF;GACF,eAAe,QAAQ,YACrB,OACE,OAAO,IAAI,aAAa;IACtB,IAAI;IAEJ,IAAI,UAAU,KAAA,GACZ,YACG,OAAO,GAAG,iBAAiB,MAAM,KAAK,SAAS,MAAM,OAAO,EAAE,QAAQ,MAAM,EAAE,UAAA,CAC5E;IAEP,MAAM,UAAU,OAAO,MACrB,GAAG,eAAe,MAAM,KAAK,SAAS,MAAM,OAAO,EAAE,QAAQ,MAAM,KACnE,QACF;IAEA,iBAAiB,YAAY,KAAA,KAAa,WAAW,CAAC;IACtD,OAAO,eACL,sCACA,GAAG,4BAA4B,MAAM,KAAK,SAAS,MAAM,OAAO,EAAE,QAAQ,MAAM,EAAE,EACpF;IAEA,OAAO,OAAO,qBAAqB,YAAY,GAAG,OAAO;GAC3D,CAAC,GACD,WACF;GACF,SAAS,OAAO,YACd,OACE,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS,GAC/D,UAAU,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;IAE7D,MAAM,YAAY,GAAG,GAAG,MAAM,GAAG,OAAO,EAAE,WAAW,OAAO,EAAE,OAAO,MAAM,GAAG,OAAO,EAAE,WAAW,OAAO;IAEzG,OAAO,MAAM,GAAG,eAAe,MAAM,KAAK,SAAS,WAAW;IAC9D,OAAO,eACL,+BACA,GAAG,4BAA4B,MAAM,KAAK,SAAS,UAAU,EAC/D;IAEA,OAAO,OAAO,qBAAqB,KAAA,GAAW,OAAO;GACvD,CAAC,GACD,WACF;GACF,YAAY,OAAO,YACjB,OACE,OAAO,IAAI,aAAa;IACtB,MAAM,gBAAgB,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS,GACrE,QAAQ,QAAQ;IAElB,MAAM,OAAO,OAAO,qBAClB,eACA,MAAM,uBAAuB,MAAM,wBAAwB,GAC3D,MAAM,6BAA6B,KAAA,IAC/B,KAAA,UACM,MAAM,yBAA0B,MAAM,wBAAwB,CAC1E;IAEA,iBAAiB,SAAS,MAAM,wBAAwB;IAOxD,KAAI,OALmB,MACrB,GAAG,GAAG,MAAM,QAAQ,OAAO,GAAG,MAAM,mBAAmB,KAAK,CAAC,EAAE,SAAS,MAAM,GAAG,MAAM,SAAS,MAAM,IAAI,aAAa,EAAE,OAAO,MAAM,cAAc,MAAM,OAAO,EAAE,OAAO,MAAM,MAAM,MAAM,SAAS,MAAM,kBAAkB,MAAM,wBAAwB,KAC3P,CACF,OAEgB,GAAG,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;IAC5D,OAAO,eACL,0BACA,GAAG,wBAAwB,MAAM,QAAQ,KAAK,SAAS,MAAM,GAAG,MAAM,SAAS,MAAM,IAAI,aAAa,EAAE,OAAO,MAAM,MAAM,MAAM,SAAS,MAAM,kBAAkB,IAAI,EAAE,EAC1K;IAEA,OAAO,OAAO,qBAAqB,KAAA,GAAW,OAAO;GACvD,CAAC,GACD,WACF;EA+C2C;EAAG,mBAAA,EA3ChD,OAAO,UACL,SAAS,KACP,OAAO,IAAI,aAAa;GACtB,iBACE,OAAO,cAAc,MAAM,KAAK,KAAK,MAAM,QAAQ,KAAK,MAAM,SAAS,GACzE;GAEA,MAAM,gBAAgB,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS,GACrE,KAAK,MAAM,QAAQ,GAAG,gBAAgB,GACtC,OAAO,MAAM,GAAG,gBAAgB,GAChC,QAAQ,QAAQ;GAElB,MAAM,SACJ,MAAM,WAAW,KAAA,IACb,KAAA,IACA,OAAO,QAAQ,UAAU,SACvB,OAAO,OAAO,aAAa,SAAS,CAAC,CAAC,MAAM,MAAM,CACpD;GAEN,MAAM,OACJ,OAAO,GAAG,UAAU,KAAK,OAAO,UAAU,EAAE,IAAI,GAAG,OAAO,UAAU,EAAE,QAAQ,KAAK,KAAK,QAAQ,GAAG,KAAK,MAAM,MAAM,GAAG,IAAI,MAAM,IAAI,aAAa,EAAE,OAAO,MAAM,cAAc,EAAE,EAAE,OAAO,aAAa,KAAK,GAAG,OAAO,MAAM,gBAAgB,GAAG,KAAK,OAAO,EAAE,gBAAgB,CAAC,EAAE,SAAS,MAAM,GAAG,MAAM,EAAE,WAAW,aAAa,EAAE,OAAO,KAAK,IAAI,IAAI,WAAW,KAAA,IAAY,GAAG,KAAK,GAAG,QAAQ,KAAK,OAAO,EAAE,SAAS,EAAE,KAAK,KAAK,MAAM,EAAE,WAAW,MAAM,IAAI,YAAY,KAAK,OAAO,EAAE,SAAS,EAAE,SAAS,MAAM,QAAQ;GAEhgB,MAAM,UAAU,OAAO,OAAO,QAAQ,KAAK,MAAM,GAAG,MAAM,KAAK,IAAI,QACjE,OAAO,IAAI,aAAa;IACtB,MAAM,SAAS,OAAO,QAAQ,OAAO,KAAK,OAAO,KAAK,UAAU,CAAC;IAEjE,iBACE,OAAO,cAAc,MAAM,cACxB,OAAO,QAAQ,UAAU,UAAU,GAAG,OAAO,KAAK,UAAU,CAAC,CAAC,MAAM,GAAG,OACtE,MAAM,SACZ;IAEA,OAAO,OAAO,OAAO,aAAa,OAAO,OAAO,eAAe,CAAC,CAAC,CAAC,MAAM;GAC1E,CAAC,CACH;GAEA,MAAM,aAAa,KAAK,SAAS,MAAM,QAAQ,QAAQ,GAAG,EAAE,CAAC,EAAE,YAAY,KAAA;GAE3E,OAAO;IAAE,UAAU;IAAS,GAAI,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW;GAAG;EAClF,CAAC,CACH,EAG8D;CAAE;AACtE,CAAC"}

package/dist/internal/session-native-step-up.d.mts

@@ -0,0 +1,15 @@
+import { AnyTableModel } from "./table-model.mjs";
+import { SessionStepUpMapping } from "./models/step-up-model.mjs";
+import { NativeSqlTables } from "./native-sql-table.mjs";
+import { SqlBatchCommit } from "./sql-commit.mjs";
+import { Effect } from "effect";
+import { LifecycleHooks } from "@yielded/auth/Hooks";
+import { SessionStepUpPersistence } from "@yielded/auth/Sessions";
+import { SqlClient } from "effect/sql/SqlClient";
+//#region src/internal/session-native-step-up.d.ts
+export type NativeSessionStepUpMapping<Claims> = SessionStepUpMapping<Claims, AnyTableModel, AnyTableModel, AnyTableModel, AnyTableModel, AnyTableModel, unknown, unknown>;
+export declare const makeNativeSessionStepUpServices: <Claims>(tables: NativeSqlTables, mapping: NativeSessionStepUpMapping<Claims>) => Effect.Effect<{
+  readonly sessionStepUpPersistence: SessionStepUpPersistence<Claims>;
+}, never, LifecycleHooks | SqlBatchCommit | SqlClient>;
+//#endregion
+//# sourceMappingURL=session-native-step-up.d.mts.map