@yielded/auth-persistence 0.1.0-beta.24 → 0.1.0-beta.26

package/src/internal/session-native-login.ts

@@ -0,0 +1,205 @@
+import type { LifecycleHooks } from "@yielded/auth/Hooks";
+import {
+  PendingAuthenticationInvalid,
+  StaleAuthentication,
+  SessionConflict,
+  type PendingAuthentication,
+  type PendingAuthenticationRecord,
+} from "@yielded/auth/Sessions";
+import { DateTime, Effect, Option } from "effect";
+import type { SqlClient } from "effect/sql/SqlClient";
+
+import { sqlBatchAssertion } from "./d1-planning";
+import { PersistenceMappingError, isMappedConstraintConflict } from "./mapping-error";
+import type { PendingAuthenticationMapping } from "./models/session-model";
+import type { NativeSqlTables } from "./native-sql-table";
+import { prepareNativeSession } from "./session-native-pending";
+import { makeNativeSessionPendingReader } from "./session-native-pending-read";
+import {
+  normalizeSessionOperation,
+  sessionUnavailable,
+  sameSessionRevision,
+  assessSessionAt,
+  sessionInvariant,
+} from "./session-native-state";
+import { allocateSessionValue } from "./session-policy";
+import {
+  CurrentSqlCommit,
+  makeSqlCommitExecutor,
+  SqlBatchCommit,
+  registerSqlPostcondition,
+  registerSqlBatchPostcondition,
+  appendSqlBatchStatement,
+} from "./sql-commit";
+import type { AnyTableModel } from "./table-model";
+
+export type NativePendingAuthenticationMapping<Claims> = PendingAuthenticationMapping<
+  Claims,
+  AnyTableModel,
+  AnyTableModel,
+  AnyTableModel,
+  unknown
+>;
+
+export const makeNativePendingAuthenticationServices = Effect.fnUntraced(function* <Claims>(
+  tables: NativeSqlTables,
+  mapping: NativePendingAuthenticationMapping<Claims>,
+): Effect.fn.Return<
+  { readonly pendingAuthentication: PendingAuthentication<Claims> },
+  never,
+  SqlClient | LifecycleHooks | SqlBatchCommit
+> {
+  const batch = yield* SqlBatchCommit;
+
+  const {
+    state,
+    pending,
+    read: readPending,
+  } = yield* makeNativeSessionPendingReader(tables, mapping, batch !== undefined);
+
+  const executor = yield* makeSqlCommitExecutor(sessionUnavailable);
+  const external = yield* Effect.serviceOption(CurrentSqlCommit);
+
+  const { sql, now } = state,
+    { p, table } = pending;
+
+  const native = <A, E, R>(
+    work: Effect.Effect<A, E, R>,
+    mode: "transaction" | "statement" = "transaction",
+  ) =>
+    batch === undefined
+      ? executor.operation(normalizeSessionOperation(work), mode)
+      : executor
+          .operationBatch(normalizeSessionOperation(work))
+          .pipe(Effect.provideService(SqlBatchCommit, batch));
+
+  const verifyPayload = Effect.fnUntraced(function* (
+    stored: import("./session-native-pending").StoredSessionPending,
+  ) {
+    const record = yield* mapping.login.decode(stored.snapshot);
+
+    sessionInvariant(
+      record.digest === stored.digest &&
+        record.version === stored.version &&
+        record.evidence.flowId === stored.flowId &&
+        record.evidence.bindingDigest === stored.bindingDigest &&
+        record.evidence.revision.subjectId === stored.subjectId &&
+        DateTime.toEpochMillis(record.expiresAt) === stored.expiresAtMillis &&
+        record.attemptLimit === stored.attemptLimit,
+    );
+
+    return record;
+  });
+
+  const read = Effect.fnUntraced(function* (
+    digest: Parameters<PendingAuthentication<Claims>["read"]>[0]["digest"],
+  ) {
+    const selected = yield* readPending("Login", digest);
+
+    if (selected === undefined) return undefined;
+    const record = yield* verifyPayload(selected.record);
+
+    if (!sameSessionRevision(selected.authority.revision, record.evidence.revision))
+      return undefined;
+
+    return { record, requirement: selected.authority.requirement };
+  });
+
+  const pendingAuthentication: PendingAuthentication<Claims> = {
+    create: (input, _now, project) =>
+      native(
+        Effect.gen(function* () {
+          const current = yield* state.read(input.evidence.revision.subjectId, true);
+
+          if (
+            current === undefined ||
+            !sameSessionRevision(current.revision, input.evidence.revision)
+          )
+            return yield* StaleAuthentication.make({});
+          yield* assessSessionAt(input.evidence, current.requirement, current.now);
+          const expires = DateTime.toEpochMillis(input.expiresAt);
+
+          if (expires <= current.now) return yield* StaleAuthentication.make({});
+
+          const version = yield* allocateSessionValue(
+            "interactive",
+            mapping.pending.allocateVersion,
+            mapping.pending.allocateVersionSync,
+          );
+
+          const record: PendingAuthenticationRecord<Claims> = { ...input, version };
+          const snapshot = yield* mapping.login.encode(record);
+          const condition = sql`${state.authorityCondition(current.revision, current.native)} and ${state.policyCondition(current.row, current.native)} and ${now} >= ${current.now} and ${now} < ${expires}`;
+
+          if (batch !== undefined)
+            yield* appendSqlBatchStatement(sqlBatchAssertion(sql, condition));
+          yield* pending
+            .insert(
+              {
+                moduleId: mapping.moduleId,
+                kind: "Login",
+                digest: record.digest,
+                version,
+                flowId: record.evidence.flowId,
+                subjectId: current.native,
+                bindingDigest: record.evidence.bindingDigest,
+                snapshot,
+                expiresAt: record.expiresAt,
+                attemptLimit: record.attemptLimit,
+              },
+              condition,
+            )
+            .pipe(
+              Effect.mapError((error) =>
+                isMappedConstraintConflict(mapping.isConstraintConflict, error)
+                  ? SessionConflict.make({})
+                  : error,
+              ),
+            );
+          const final = sql`${condition} and exists(select 1 from ${table.name} where ${pending.predicate(table, "Login", record.digest)} and ${state.exact(table, p.version, version)} and ${state.exact(table, p.snapshot, snapshot)})`;
+
+          if (batch !== undefined)
+            yield* registerSqlBatchPostcondition({
+              name: "pending-login-issuance",
+              statement: sqlBatchAssertion(sql, final),
+            });
+          else if (Option.isSome(external))
+            yield* registerSqlPostcondition({
+              name: "pending-login-issuance",
+              check: Effect.gen(function* () {
+                const rows = yield* sql`select 1 where ${final}`;
+
+                sessionInvariant(rows.length === 1);
+              }).pipe(
+                Effect.mapError((cause) =>
+                  PersistenceMappingError.make({ operation: "decode", cause }),
+                ),
+              ),
+            });
+
+          return yield* prepareNativeSession(record, project);
+        }),
+      ),
+    read: ({ digest }) =>
+      executor
+        .read(read(digest))
+        .pipe(
+          Effect.flatMap((result) =>
+            result === undefined
+              ? Effect.fail(PendingAuthenticationInvalid.make({}))
+              : Effect.succeed(result),
+          ),
+        ),
+    reject: ({ digest }, project) =>
+      native(
+        Effect.gen(function* () {
+          yield* pending.reject("Login", digest);
+
+          return yield* prepareNativeSession({ _tag: "Rejected" } as const, project);
+        }),
+        "statement",
+      ),
+  };
+
+  return { pendingAuthentication };
+});

package/src/internal/session-native-pending-read.ts

@@ -0,0 +1,68 @@
+import type { TokenDigest } from "@yielded/auth/Schema";
+import type { PendingAuthenticationKind } from "@yielded/auth/Sessions";
+import { Effect } from "effect";
+
+import type { NativeSqlTables } from "./native-sql-table";
+import { makeNativeSessionPending } from "./session-native-pending";
+import {
+  makeNativeSessionAuthorityState,
+  type NativeSessionAuthorityMapping,
+} from "./session-native-state";
+import { exactSqlText } from "./sql-change";
+
+/** Both semantic pending ports use the same kind-bound physical snapshot.
+ * Distinct native ID encodings use their own bound reads; joined rows still
+ * validate each decoded owner before returning current policy. */
+export const makeNativeSessionPendingReader = Effect.fnUntraced(function* (
+  tables: NativeSqlTables,
+  mapping: NativeSessionAuthorityMapping & Parameters<typeof makeNativeSessionPending>[1],
+  batch = false,
+) {
+  const state = yield* makeNativeSessionAuthorityState(tables, mapping, batch);
+  const pending = yield* makeNativeSessionPending(tables, mapping, batch);
+
+  const read = Effect.fnUntraced(function* (kind: PendingAuthenticationKind, digest: TokenDigest) {
+    const { sql, now } = state,
+      { p, table } = pending;
+
+    const compatible =
+      table.unencodedTextColumn?.(p.subjectId) !== undefined &&
+      state.subject.unencodedTextColumn?.(mapping.subject.id) !== undefined &&
+      state.credential.unencodedTextColumn?.(mapping.credential.subjectId) !== undefined;
+
+    if (compatible) {
+      const pt = table.as("authentication_pending"),
+        st = state.joinedSubject,
+        ct = state.joinedCredential,
+        s = mapping.subject,
+        c = mapping.credential;
+
+      const rows =
+        yield* sql`select ${pt.fields("p_")}, ${st.fields("s_")}, ${ct.fields("c_")}, ${now} as engine_now from ${pt.name} join ${st.name} on ${exactSqlText(sql, st.column(s.id), pt.column(p.subjectId))} and ${state.activeSubject(st)} left join ${ct.name} on ${exactSqlText(sql, ct.column(c.subjectId), pt.column(p.subjectId))} and ${state.activeCredential(ct)} where ${pending.predicate(pt, kind, digest)} limit 65`;
+
+      if (rows[0] === undefined) return undefined;
+      const record = yield* pending.decode(kind, pt.decode(rows[0], "p_"));
+      const owner = yield* mapping.subjectId.toNative(record.subjectId);
+
+      const authority = yield* state.decode(
+        record.subjectId,
+        owner,
+        st.decode(rows[0], "s_"),
+        rows.map((row) => ct.decode(row, "c_")),
+        rows[0].engine_now,
+      );
+
+      return authority === undefined ? undefined : { record, authority };
+    }
+    const selected = yield* pending.read(kind, digest);
+
+    if (selected === undefined) return undefined;
+    const authority = yield* state.read(selected.record.subjectId);
+
+    return authority === undefined || authority.now >= selected.record.expiresAtMillis
+      ? undefined
+      : { record: selected.record, authority };
+  });
+
+  return { state, pending, read };
+});

package/src/internal/session-native-pending.ts

@@ -0,0 +1,223 @@
+import { CurrentCommitJournal, type PreparedCommit, type CommitJournal } from "@yielded/auth/Hooks";
+import { SubjectId, TokenDigest } from "@yielded/auth/Schema";
+import {
+  AuthenticationFlowId,
+  SecurityRevision,
+  type PendingConsumption,
+  PendingAuthenticationKind,
+} from "@yielded/auth/Sessions";
+import { Effect, Schema } from "effect";
+import { SqlClient } from "effect/sql/SqlClient";
+import type { Fragment } from "effect/sql/Statement";
+
+import { sqlBatchAssertion } from "./d1-planning";
+import type { SubjectIdCodec } from "./models/common";
+import type {
+  SessionPendingTables,
+  SessionExecution,
+  SessionPendingInsert,
+} from "./models/session-model";
+import type { NativeSqlTables, SqlTable } from "./native-sql-table";
+import { makeConditionalSqlInsert } from "./session-native-record";
+import { sessionInvariant } from "./session-native-state";
+import { exactSqlText, executeSqlChange } from "./sql-change";
+import { appendSqlBatchStatement, registerSqlCommitReceipt } from "./sql-commit";
+import type { AnyTableModel } from "./table-model";
+
+export const StoredSessionPending = Schema.Struct({
+  kind: PendingAuthenticationKind,
+  digest: TokenDigest,
+  version: SecurityRevision,
+  flowId: AuthenticationFlowId,
+  subjectId: SubjectId,
+  bindingDigest: TokenDigest,
+  snapshot: Schema.String,
+  expiresAtMillis: Schema.Int,
+  attemptLimit: Schema.Int.check(Schema.isGreaterThan(0)),
+  failedAttempts: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+});
+
+export type StoredSessionPending = typeof StoredSessionPending.Type;
+
+type Mapping = SessionPendingTables<AnyTableModel, unknown> &
+  Pick<SessionExecution, "moduleId" | "clock"> & { readonly subjectId: SubjectIdCodec<unknown> };
+
+/** All consumers bind the module and kind through this owner. A caller never
+ * supplies an optional discriminator and payload is decoded only after it matches. */
+export const makeNativeSessionPending = Effect.fnUntraced(function* (
+  tables: NativeSqlTables,
+  mapping: Mapping,
+  batch = false,
+) {
+  const conditionalInsert = yield* makeConditionalSqlInsert();
+  const sql = (yield* SqlClient).withoutTransforms();
+
+  const p = mapping.pending,
+    table = tables(p.table),
+    now = tables.expression(mapping.clock.engineNowMillis);
+
+  const exact = (t: SqlTable, key: string, value: unknown) =>
+    exactSqlText(sql, t.column(key), t.value(key, value));
+
+  const millis = (t: SqlTable, key: string) =>
+    tables.expression(mapping.clock.toMillis(t.column(key)));
+
+  const scope = (t: SqlTable, kind: PendingAuthenticationKind) =>
+    sql.and([exact(t, p.moduleId, mapping.moduleId), exact(t, p.kind, kind)]);
+
+  const live = (t: SqlTable) =>
+    sql.and([
+      sql`${t.column(p.consumed)} = ${t.value(p.consumed, false)}`,
+      sql`${millis(t, p.expiresAt)} > ${now}`,
+      sql`${t.column(p.failedAttempts)} >= 0`,
+      sql`${t.column(p.failedAttempts)} < ${t.column(p.attemptLimit)}`,
+    ]);
+
+  const predicate = (t: SqlTable, kind: PendingAuthenticationKind, digest: TokenDigest) =>
+    sql.and([scope(t, kind), exact(t, p.digest, digest), live(t)]);
+
+  const decode = Effect.fnUntraced(function* (
+    kind: PendingAuthenticationKind,
+    row: Record<string, unknown>,
+  ) {
+    sessionInvariant(
+      row[p.moduleId] === mapping.moduleId &&
+        row[p.kind] === kind &&
+        (row[p.consumed] === false || row[p.consumed] === 0),
+    );
+
+    return yield* Schema.decodeUnknownEffect(StoredSessionPending)({
+      kind,
+      digest: row[p.digest],
+      version: row[p.version],
+      flowId: row[p.flowId],
+      subjectId: yield* mapping.subjectId.toSubject(row[p.subjectId]),
+      bindingDigest: row[p.bindingDigest],
+      snapshot: row[p.snapshot],
+      expiresAtMillis: mapping.clock.decodeInstant(row[p.expiresAt]),
+      attemptLimit: row[p.attemptLimit],
+      failedAttempts: row[p.failedAttempts],
+    });
+  });
+
+  const read = Effect.fnUntraced(function* (kind: PendingAuthenticationKind, digest: TokenDigest) {
+    const rows =
+      yield* sql`select ${table.fields("pending_")}, ${now} as engine_now from ${table.name} where ${predicate(table, kind, digest)} limit 2`;
+
+    sessionInvariant(rows.length <= 1);
+    if (rows[0] === undefined) return undefined;
+
+    return {
+      record: yield* decode(kind, table.decode(rows[0], "pending_")),
+      now: Number(rows[0].engine_now),
+    };
+  });
+
+  const stage = Effect.fnUntraced(function* (statement: Fragment, expected?: number) {
+    if (batch) {
+      yield* appendSqlBatchStatement(sql`${statement}`);
+      if (expected !== undefined)
+        yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = ${expected}`));
+
+      return expected;
+    }
+    const changed = yield* executeSqlChange(sql, statement);
+
+    if (expected !== undefined) sessionInvariant(changed === expected);
+
+    return changed;
+  });
+
+  const insert = Effect.fnUntraced(function* (
+    input: SessionPendingInsert<unknown>,
+    condition: Fragment = sql`1 = 1`,
+  ) {
+    sessionInvariant(input.moduleId === mapping.moduleId);
+
+    const row = {
+      ...p.encodeInsert(input),
+      [p.moduleId]: mapping.moduleId,
+      [p.kind]: input.kind,
+      [p.digest]: input.digest,
+      [p.version]: input.version,
+      [p.flowId]: input.flowId,
+      [p.subjectId]: input.subjectId,
+      [p.bindingDigest]: input.bindingDigest,
+      [p.snapshot]: input.snapshot,
+      [p.expiresAt]: p.encodeInstant(input.expiresAt),
+      [p.attemptLimit]: input.attemptLimit,
+      [p.failedAttempts]: 0,
+      [p.consumed]: false,
+    };
+
+    yield* stage(conditionalInsert(table, row, condition), 1);
+  });
+
+  const consumption = (
+    kind: PendingAuthenticationKind,
+    input: PendingConsumption,
+    native: unknown,
+  ) =>
+    sql.and([
+      predicate(table, kind, input.digest),
+      exact(table, p.version, input.version),
+      exact(table, p.flowId, input.flowId),
+      exact(table, p.bindingDigest, input.bindingDigest),
+      sql`${table.column(p.subjectId)} = ${table.value(p.subjectId, native)}`,
+    ]);
+
+  const consume = (
+    kind: PendingAuthenticationKind,
+    input: PendingConsumption,
+    native: unknown,
+    condition: Fragment = sql`1 = 1`,
+  ) =>
+    stage(
+      sql`${table.update({ [p.consumed]: true })} where ${consumption(kind, input, native)} and ${condition}`,
+      1,
+    );
+
+  const reject = (kind: PendingAuthenticationKind, digest: TokenDigest) =>
+    stage(
+      sql`${table.update({ [p.failedAttempts]: sql`${table.column(p.failedAttempts)} + 1` })} where ${predicate(table, kind, digest)}`,
+    );
+
+  const clockCondition = (record: StoredSessionPending) => sql`${now} < ${record.expiresAtMillis}`;
+
+  const consumedCondition = (
+    kind: PendingAuthenticationKind,
+    input: PendingConsumption,
+    native: unknown,
+  ) =>
+    sql`exists(select 1 from ${table.name} where ${scope(table, kind)} and ${exact(table, p.digest, input.digest)} and ${exact(table, p.version, input.version)} and ${exact(table, p.flowId, input.flowId)} and ${exact(table, p.bindingDigest, input.bindingDigest)} and ${table.column(p.subjectId)} = ${table.value(p.subjectId, native)} and ${table.column(p.consumed)} = ${table.value(p.consumed, true)})`;
+
+  return {
+    table,
+    p,
+    now,
+    scope,
+    live,
+    predicate,
+    decode,
+    read,
+    insert,
+    consumption,
+    consume,
+    reject,
+    stage,
+    clockCondition,
+    consumedCondition,
+  };
+});
+
+export const prepareNativeSession = <Value, A>(
+  value: Value,
+  project: (value: Value, journal: CommitJournal) => PreparedCommit<A>,
+) =>
+  Effect.gen(function* () {
+    const receipt = project(value, yield* CurrentCommitJournal);
+
+    yield* registerSqlCommitReceipt(receipt);
+
+    return receipt;
+  });

package/src/internal/session-native-record.ts

@@ -0,0 +1,141 @@
+import { TokenDigest } from "@yielded/auth/Schema";
+import {
+  SessionId,
+  SessionMetadata,
+  SessionAuthenticationProvenance,
+  SessionCredentialVersion,
+  SecurityRevision,
+  type StatefulSessionRecord,
+} from "@yielded/auth/Sessions";
+import { DateTime, Effect, Schema } from "effect";
+import { SqlClient } from "effect/sql/SqlClient";
+import type { Fragment } from "effect/sql/Statement";
+
+import type { SubjectIdCodec } from "./models/common";
+import type { StatefulSessionTables, SessionExecution } from "./models/session-model";
+import type { NativeSqlTables, SqlTable } from "./native-sql-table";
+import { sessionInvariant } from "./session-native-state";
+import { exactSqlText } from "./sql-change";
+import type { AnyTableModel } from "./table-model";
+
+export type NativeSessionRecordMapping<Claims> = StatefulSessionTables<
+  Claims,
+  AnyTableModel,
+  unknown,
+  unknown
+> &
+  Pick<SessionExecution, "clock"> & { readonly subjectId: SubjectIdCodec<unknown> };
+
+const metadataJson = Schema.encodeSync(Schema.fromJsonString(SessionMetadata));
+const provenanceJson = Schema.encodeSync(Schema.fromJsonString(SessionAuthenticationProvenance));
+
+export const sameSessionRecord = <Claims>(
+  left: StatefulSessionRecord<Claims>,
+  right: StatefulSessionRecord<Claims>,
+) =>
+  left.digest === right.digest &&
+  left.credentialVersion === right.credentialVersion &&
+  metadataJson(left) === metadataJson(right) &&
+  provenanceJson(left.provenance) === provenanceJson(right.provenance);
+
+export const makeConditionalSqlInsert = Effect.fnUntraced(function* () {
+  const sql = (yield* SqlClient).withoutTransforms();
+
+  return (table: SqlTable, values: Readonly<Record<string, unknown>>, condition: Fragment) => {
+    const fields = Object.entries(values).filter(([, value]) => value !== undefined);
+
+    sessionInvariant(fields.length > 0);
+
+    return sql`insert into ${table.name} (${sql.join(", ", false)(fields.map(([key]) => table.columnName(key)))}) select ${sql.join(", ", false)(fields.map(([key, value]) => table.value(key, value)))} where ${condition}`;
+  };
+});
+
+/** Security columns identify the row and own its live time bounds. In particular
+ * issuedAt may be assigned by UPDATE's database clock without rewriting a JSON
+ * copy of prepared metadata. Claims/provenance decoding remains consumer-owned. */
+export const makeNativeSessionRecords = Effect.fnUntraced(function* <Claims>(
+  tables: NativeSqlTables,
+  mapping: NativeSessionRecordMapping<Claims>,
+) {
+  const sql = (yield* SqlClient).withoutTransforms();
+
+  const s = mapping.session,
+    table = tables(s.table),
+    now = tables.expression(mapping.clock.engineNowMillis);
+
+  const exact = (t: SqlTable, key: string, value: unknown) =>
+    exactSqlText(sql, t.column(key), t.value(key, value));
+
+  const millis = (t: SqlTable, key: string) =>
+    tables.expression(mapping.clock.toMillis(t.column(key)));
+
+  const live = (t: SqlTable) =>
+    sql.and([
+      sql`${millis(t, s.issuedAt)} <= ${now}`,
+      sql`${millis(t, s.expiresAt)} > ${now}`,
+      sql`${millis(t, s.absoluteExpiresAt)} >= ${millis(t, s.expiresAt)}`,
+    ]);
+
+  const decode = Effect.fnUntraced(function* (row: Record<string, unknown>) {
+    const decoded = yield* s.decode(row);
+    const subjectId = yield* mapping.subjectId.toSubject(row[s.subjectId]);
+    const sessionId = yield* mapping.sessionId.toSession(row[s.sessionId]);
+    const digest = yield* Schema.decodeUnknownEffect(TokenDigest)(row[s.digest]);
+    const revision = yield* Schema.decodeUnknownEffect(SecurityRevision)(row[s.securityRevision]);
+    const issuedAt = DateTime.makeUnsafe(mapping.clock.decodeInstant(row[s.issuedAt]));
+    const expiresAt = mapping.clock.decodeInstant(row[s.expiresAt]);
+    const absolute = mapping.clock.decodeInstant(row[s.absoluteExpiresAt]);
+
+    sessionInvariant(
+      decoded.subjectId === subjectId &&
+        decoded.sessionId === sessionId &&
+        decoded.digest === digest &&
+        decoded.securityRevision === revision &&
+        DateTime.toEpochMillis(decoded.expiresAt) === expiresAt &&
+        DateTime.toEpochMillis(decoded.absoluteExpiresAt) === absolute,
+    );
+    yield* Schema.decodeEffect(SessionId)(sessionId);
+    yield* Schema.decodeEffect(SessionCredentialVersion)(decoded.credentialVersion);
+
+    return { ...decoded, issuedAt };
+  });
+
+  const owner = Effect.fnUntraced(function* (
+    record: Pick<StatefulSessionRecord<Claims>, "subjectId" | "sessionId" | "digest">,
+  ) {
+    const nativeSubject = yield* mapping.subjectId.toNative(record.subjectId),
+      nativeSession = yield* mapping.sessionId.toNative(record.sessionId);
+
+    return sql.and([
+      sql`${table.column(s.subjectId)} = ${table.value(s.subjectId, nativeSubject)}`,
+      sql`${table.column(s.sessionId)} = ${table.value(s.sessionId, nativeSession)}`,
+      exact(table, s.digest, record.digest),
+    ]);
+  });
+
+  // These are the semantic values supplied by the session encoder for this
+  // write, not an observed whole-row snapshot or unrelated application columns.
+  const encodedCondition = (values: Readonly<Record<string, unknown>>) =>
+    sql.and(
+      Object.entries(values)
+        .filter(([, value]) => value !== undefined)
+        .map(([key, value]) =>
+          value === null
+            ? sql`${table.column(key)} is null`
+            : typeof value === "string"
+              ? exact(table, key, value)
+              : sql`${table.column(key)} = ${table.value(key, value)}`,
+        ),
+    );
+
+  const read = Effect.fnUntraced(function* (digest: TokenDigest) {
+    const rows =
+      yield* sql`select ${table.fields("session_")} from ${table.name} where ${exact(table, s.digest, digest)} and ${live(table)} limit 2`;
+
+    sessionInvariant(rows.length <= 1);
+
+    return rows[0] === undefined ? undefined : yield* decode(table.decode(rows[0], "session_"));
+  });
+
+  return { sql, s, table, now, exact, millis, live, decode, owner, read, encodedCondition };
+});