@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.26

package/dist/internal/session-kernel.mjs

@@ -1,820 +0,0 @@
-import { PersistenceMappingError, isMappedConstraintConflict } from "./mapping-error.mjs";
-import { makeNativeSqlTables, sqlMapping } from "./native-sql-table.mjs";
-import { NativeDatabase } from "./transaction-kernel.mjs";
-import { makeAuthoritySnapshot } from "./authority-snapshot.mjs";
-import { decodeStepUpIntent, encodeStepUpIntent, sameStepUpRevision, stepUpIntentLive, stepUpRotationMatches, validateStepUpPlan } from "./step-up-state.mjs";
-import { canJoinTextColumns } from "./storage-validation.mjs";
-import { Cause, Context, DateTime, Effect, Option, Schema } from "effect";
-import { CurrentCommitJournal, LifecycleHooks, coordinateCommit, hasCommitScope } from "@yielded/auth/Hooks";
-import { AuthenticationCapture, PendingAuthenticationInvalid, SessionConflict, SessionInvalid, SessionMetadata, SessionStepUpInvalid, SessionUnavailable, StaleAuthentication, assessAuthentication, pendingAuthenticationContext, snapshotPendingAuthenticationContext, snapshotSessionAuthenticationProvenance } from "@yielded/auth/Sessions";
-import { reportPersistenceFailure } from "@yielded/auth/Persistence";
-//#region src/internal/session-kernel.ts
-const decodeRevocationFlag = Schema.decodeUnknownEffect(Schema.Literals([0, 1]));
-/** Reads need no transaction of their own. A caller-owned transaction still
-* needs a savepoint so catching an SQL failure does not leave it aborted. */
-const withVerificationSavepoint = Effect.fnUntraced(function* (effect) {
-	const { $client } = yield* NativeDatabase;
-	const transaction = yield* Effect.serviceOption($client.transactionService);
-	return yield* Option.isSome(transaction) ? $client.withTransaction(effect) : effect;
-});
-/** Native SQL authority for the current transaction or savepoint. */
-var CurrentSessionSql = class extends Context.Service()("effect-auth/drizzle/CurrentSessionSql") {};
-const makeSessionKernel = (operations, nativeTables = (client) => makeNativeSqlTables(client)) => {
-	const { and, eq, gt, lte, inArray, or, sql, column, updateValues } = operations;
-	const unavailable = () => SessionUnavailable.make({});
-	const stale = () => StaleAuthentication.make({});
-	const invalidPending = () => PendingAuthenticationInvalid.make({});
-	const invalidSession = () => SessionInvalid.make({});
-	const mapFailureCause = (effect, map) => Effect.catchCause(effect, (cause) => Effect.failCause(Cause.map(cause, map)));
-	const isExpectedMutationError = (error) => {
-		const tag = typeof error === "object" && error !== null ? Reflect.get(error, "_tag") : void 0;
-		return tag === "SessionStepUpInvalid" || tag === "StaleAuthentication" || tag === "PendingAuthenticationInvalid" || tag === "SessionConflict" || tag === "SessionInvalid" || tag === "SessionUnavailable";
-	};
-	const normalizeMutation = (mapping) => (effect) => effect.pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, (error) => isMappedConstraintConflict(mapping.isConstraintConflict, error) ? SessionConflict.make({}) : error))));
-	const safeTransaction = (effect) => reportPersistenceFailure(effect, isExpectedMutationError).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, (error) => isExpectedMutationError(error) ? error : unavailable()))));
-	const selectRows = (query, locking) => locking && typeof query.for === "function" ? query.for("update") : query;
-	const inTransaction = (database, effect) => Effect.suspend(() => database.transaction((current) => effect.pipe(Effect.provideService(CurrentSessionSql, current))));
-	const owned = (database, options, isConstraintConflict, body) => {
-		const run = coordinateCommit(() => database.transaction((current) => body.pipe(Effect.provideService(CurrentSessionSql, current))), { mode: options.mode }).pipe((effect) => reportPersistenceFailure(effect, (error) => isExpectedMutationError(error) || isMappedConstraintConflict(isConstraintConflict, error)), Effect.map((result) => result.value), Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, (error) => isExpectedMutationError(error) ? error : unavailable()))));
-		return Effect.gen(function* () {
-			const current = yield* Effect.serviceOption(CurrentSessionSql);
-			if (!(Option.isSome(current) && current.value === database)) {
-				if (yield* hasCommitScope) return yield* unavailable();
-				yield* options.standaloneGuard;
-			}
-			return yield* run;
-		});
-	};
-	const uniqueStrings = (values) => [...new Set(values)].sort();
-	const preservesRevision = (completed, original) => {
-		const current = new Map(completed.revision.credentials.map((item) => [item.credentialId, item.revision]));
-		return completed.flowId === original.flowId && completed.bindingDigest === original.bindingDigest && completed.revision.subjectId === original.revision.subjectId && completed.revision.securityRevision === original.revision.securityRevision && original.revision.credentials.every((item) => current.get(item.credentialId) === item.revision) && original.proofs.every((expected) => completed.proofs.some((proof) => proof.method === expected.method && proof.credentialId === expected.credentialId && proof.userVerified === expected.userVerified && proof.phishingResistant === expected.phishingResistant && DateTime.toEpochMillis(proof.verifiedAt) === DateTime.toEpochMillis(expected.verifiedAt) && proof.factors.length === expected.factors.length && proof.factors.every((factor, index) => factor === expected.factors[index])));
-	};
-	const authorityColumns = (mapping) => ({
-		subjectId: column(mapping.subject.table, mapping.subject.id),
-		subjectStatus: column(mapping.subject.table, mapping.subject.status),
-		subjectRevision: column(mapping.subject.table, mapping.subject.securityRevision),
-		credentialSubjectId: column(mapping.credential.table, mapping.credential.subjectId),
-		credentialId: column(mapping.credential.table, mapping.credential.credentialId),
-		credentialRevision: column(mapping.credential.table, mapping.credential.revision),
-		...mapping.credential.status === void 0 ? {} : { credentialStatus: column(mapping.credential.table, mapping.credential.status) }
-	});
-	const subjectColumns = (mapping) => ({
-		subjectId: column(mapping.subject.table, mapping.subject.id),
-		subjectStatus: column(mapping.subject.table, mapping.subject.status),
-		subjectRevision: column(mapping.subject.table, mapping.subject.securityRevision)
-	});
-	const readSubject = Effect.fn("DrizzleSession.readSubject")(function* (mapping, nativeSubjectId, locking) {
-		const database = yield* CurrentSessionSql;
-		const columns = subjectColumns(mapping);
-		return yield* selectRows(database.select().from(mapping.subject.table).where(eq(columns.subjectId, nativeSubjectId)).limit(1), locking);
-	});
-	const captureDetailsIn = Effect.fn("DrizzleSession.captureDetails")(function* (mapping, subjectId, credentialIds, locking) {
-		const database = yield* CurrentSessionSql;
-		const requested = uniqueStrings(credentialIds);
-		if (requested.length !== credentialIds.length) return yield* stale();
-		const nativeSubjectId = yield* mapping.subjectId.toNative(subjectId);
-		const subject = (yield* readSubject(mapping, nativeSubjectId, locking))[0];
-		const columns = authorityColumns(mapping);
-		if (subject === void 0 || !mapping.subject.isActiveStatus(subject[mapping.subject.status])) return yield* stale();
-		const query = database.select().from(mapping.credential.table).where(and(eq(columns.credentialSubjectId, nativeSubjectId), requested.length === 0 ? sql`false` : inArray(columns.credentialId, requested))).orderBy(columns.credentialId);
-		const credentialRows = requested.length === 0 ? [] : yield* selectRows(query, locking);
-		if (credentialRows.length !== requested.length) return yield* stale();
-		const credentials = credentialRows.map((row) => ({
-			credentialId: row[mapping.credential.credentialId],
-			revision: row[mapping.credential.revision],
-			active: mapping.credential.status === void 0 || mapping.credential.isActiveStatus?.(row[mapping.credential.status]) === true
-		})).sort((left, right) => left.credentialId.localeCompare(right.credentialId));
-		if (credentials.some((item) => !item.active)) return yield* stale();
-		return {
-			subject,
-			revision: {
-				subjectId,
-				securityRevision: subject[mapping.subject.securityRevision],
-				credentials: credentials.map(({ credentialId, revision }) => ({
-					credentialId,
-					revision
-				}))
-			}
-		};
-	});
-	const validateEvidenceIn = Effect.fn("DrizzleSession.validateEvidence")(function* (mapping, evidence, locking) {
-		const captured = yield* captureDetailsIn(mapping, evidence.revision.subjectId, evidence.revision.credentials.map((item) => item.credentialId), locking);
-		return yield* validateCapturedEvidence(mapping, evidence, captured);
-	});
-	const validateCapturedEvidence = Effect.fnUntraced(function* (mapping, evidence, captured) {
-		if (captured.revision.securityRevision !== evidence.revision.securityRevision || captured.revision.credentials.length !== evidence.revision.credentials.length || captured.revision.credentials.some((item, index) => {
-			const expected = [...evidence.revision.credentials].sort((a, b) => a.credentialId.localeCompare(b.credentialId))[index];
-			return expected === void 0 || expected.credentialId !== item.credentialId || expected.revision !== item.revision;
-		})) return yield* stale();
-		return {
-			nativeSubjectId: yield* mapping.subjectId.toNative(evidence.revision.subjectId),
-			requirement: yield* mapping.subject.decodeRequirement(captured.subject)
-		};
-	});
-	const flowColumns = (mapping) => ({
-		flowId: column(mapping.flow.table, mapping.flow.flowId),
-		subjectId: column(mapping.flow.table, mapping.flow.subjectId),
-		state: column(mapping.flow.table, mapping.flow.state),
-		pendingDigest: column(mapping.flow.table, mapping.flow.pendingDigest),
-		dedupUntil: column(mapping.flow.table, mapping.flow.dedupUntil)
-	});
-	const readFlow = Effect.fn("DrizzleSession.readFlow")(function* (mapping, flowId, locking) {
-		const database = yield* CurrentSessionSql;
-		const columns = flowColumns(mapping);
-		return yield* selectRows(database.select().from(mapping.flow.table).where(eq(columns.flowId, flowId)).limit(1), locking);
-	});
-	const ensureDirectFlowAvailable = Effect.fn("DrizzleSession.ensureFlowAvailable")(function* (mapping, evidence, nativeSubjectId, dedupUntil) {
-		const database = yield* CurrentSessionSql;
-		const existing = (yield* readFlow(mapping, evidence.flowId, true))[0];
-		if (existing !== void 0) {
-			const now = yield* freshNow;
-			if (DateTime.toEpochMillis(now) < DateTime.toEpochMillis(yield* mapping.flow.decodeInstant(existing[mapping.flow.dedupUntil]))) return yield* SessionConflict.make({});
-			if (mapping.pending !== void 0) yield* database.delete(mapping.pending.table).where(eq(column(mapping.pending.table, mapping.pending.flowId), evidence.flowId));
-			yield* database.delete(mapping.flow.table).where(eq(flowColumns(mapping).flowId, evidence.flowId));
-		}
-		return mapping.flow.encodeEstablishedInsert({
-			evidence,
-			subjectId: nativeSubjectId,
-			dedupUntil
-		});
-	});
-	const pendingColumns = (mapping) => ({
-		digest: column(mapping.pending.table, mapping.pending.digest),
-		version: column(mapping.pending.table, mapping.pending.version),
-		flowId: column(mapping.pending.table, mapping.pending.flowId),
-		subjectId: column(mapping.pending.table, mapping.pending.subjectId),
-		bindingDigest: column(mapping.pending.table, mapping.pending.bindingDigest),
-		expiresAt: column(mapping.pending.table, mapping.pending.expiresAt),
-		attemptLimit: column(mapping.pending.table, mapping.pending.attemptLimit),
-		failedAttempts: column(mapping.pending.table, mapping.pending.failedAttempts),
-		consumed: column(mapping.pending.table, mapping.pending.consumed)
-	});
-	const readPending = Effect.fn("DrizzleSession.readPending")(function* (mapping, digest, locking) {
-		const database = yield* CurrentSessionSql;
-		return yield* selectRows(database.select().from(mapping.pending.table).where(eq(pendingColumns(mapping).digest, digest)).limit(1), locking);
-	});
-	const validatePending = Effect.fn("DrizzleSession.validatePending")(function* (mapping, input, projection = "record") {
-		const row = (yield* readPending(mapping, input.digest, true))[0];
-		if (row === void 0) return yield* invalidPending();
-		const record = yield* (projection === "context" ? mapping.pending.decodeContext : mapping.pending.decode)(row);
-		const failedAttempts = Number(row[mapping.pending.failedAttempts]);
-		if (record.version !== input.version || record.evidence.flowId !== input.flowId || record.evidence.bindingDigest !== input.bindingDigest || row[mapping.pending.consumed] !== false || failedAttempts >= record.attemptLimit) return yield* invalidPending();
-		const flow = (yield* readFlow(mapping, input.flowId, true))[0];
-		if (flow === void 0 || flow[mapping.flow.state] !== mapping.flow.pendingStateValue || flow[mapping.flow.pendingDigest] !== input.digest) return yield* invalidPending();
-		if (DateTime.toEpochMillis(yield* freshNow) >= DateTime.toEpochMillis(record.expiresAt)) return yield* invalidPending();
-		return record;
-	});
-	const consumePending = Effect.fn("DrizzleSession.consumePending")(function* (mapping, input, until) {
-		const database = yield* CurrentSessionSql;
-		yield* Effect.all([database.update(mapping.pending.table).set(updateValues([[mapping.pending.consumed, true]])).where(and(eq(pendingColumns(mapping).digest, input.digest), eq(pendingColumns(mapping).version, input.version), eq(pendingColumns(mapping).consumed, false))), database.update(mapping.flow.table).set(updateValues([
-			[mapping.flow.state, mapping.flow.establishedStateValue],
-			[mapping.flow.pendingDigest, null],
-			[mapping.flow.dedupUntil, mapping.flow.encodeInstant(until)]
-		])).where(eq(flowColumns(mapping).flowId, input.flowId))]);
-	});
-	const freshNow = DateTime.now;
-	const allocate = (mode, asynchronous, synchronous) => {
-		if (mode === "synchronous") return synchronous === void 0 ? Effect.fail(unavailable()) : Effect.try({
-			try: synchronous,
-			catch: (cause) => PersistenceMappingError.make({
-				operation: "allocate",
-				cause
-			})
-		});
-		if (asynchronous !== void 0) return asynchronous;
-		return synchronous === void 0 ? Effect.fail(unavailable()) : Effect.try({
-			try: synchronous,
-			catch: (cause) => PersistenceMappingError.make({
-				operation: "allocate",
-				cause
-			})
-		});
-	};
-	const makeSqlAuthenticationAuthority = Effect.fnUntraced(function* (mapping, options) {
-		const database = yield* CurrentSessionSql;
-		if (!options.coordinated) yield* (operations.validateStorage?.(mapping) ?? Effect.void).pipe(Effect.mapError(unavailable));
-		const hooks = yield* LifecycleHooks;
-		const root = yield* NativeDatabase;
-		const sqlClient = root.$client.withoutTransforms();
-		const tables = yield* sqlMapping(() => nativeTables(sqlClient, root)).pipe(Effect.mapError(unavailable));
-		const readSnapshot = makeAuthoritySnapshot(tables, mapping);
-		const service = {
-			capture: (subjectId, credentialIds) => safeTransaction(readSnapshot(subjectId, credentialIds).pipe(Effect.flatMap((value) => Effect.flatMap(mapping.subject.decodeRequirement(value.subject), (requirement) => Schema.decodeEffect(AuthenticationCapture)({
-				revision: value.revision,
-				requirement
-			}))))),
-			requirements: (evidence) => safeTransaction(readSnapshot(evidence.revision.subjectId, evidence.revision.credentials.map((item) => item.credentialId)).pipe(Effect.flatMap((captured) => validateCapturedEvidence(mapping, evidence, captured)), Effect.map((value) => value.requirement))),
-			approve: (input, prepare) => owned(database, options, mapping.isConstraintConflict, Effect.gen(function* () {
-				const journal = yield* CurrentCommitJournal;
-				const { requirement } = yield* options.locking ? validateEvidenceIn(mapping, input.evidence, true) : Effect.flatMap(readSnapshot(input.evidence.revision.subjectId, input.evidence.revision.credentials.map((item) => item.credentialId)), (captured) => validateCapturedEvidence(mapping, input.evidence, captured));
-				if (input.pending === void 0) {
-					const assessed = yield* assessAuthentication(input.evidence, requirement).pipe(Effect.mapError(unavailable));
-					const now = yield* freshNow;
-					if (!assessed.satisfied || DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(input.expiresAt) || DateTime.toEpochMillis(input.expiresAt) > DateTime.toEpochMillis(input.absoluteExpiresAt)) return yield* stale();
-					return prepare(void 0, journal);
-				}
-				if (mapping.pending === void 0) return yield* invalidPending();
-				const pendingMapping = {
-					...mapping,
-					...mapping.pending
-				};
-				const pending = yield* validatePending(pendingMapping, input.pending);
-				if (!preservesRevision(input.evidence, pending.evidence)) return yield* invalidPending();
-				const assessed = yield* assessAuthentication(input.evidence, requirement).pipe(Effect.mapError(unavailable));
-				const now = yield* freshNow;
-				if (!assessed.satisfied || DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(pending.expiresAt) || DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(input.expiresAt) || DateTime.toEpochMillis(input.expiresAt) > DateTime.toEpochMillis(input.absoluteExpiresAt)) return yield* stale();
-				const receipt = prepare(void 0, journal);
-				yield* consumePending(pendingMapping, input.pending, input.absoluteExpiresAt);
-				return receipt;
-			}))
-		};
-		return {
-			capture: (subjectId, credentialIds) => service.capture(subjectId, credentialIds).pipe(Effect.provideService(NativeDatabase, root), Effect.provideService(LifecycleHooks, hooks)),
-			requirements: (evidence) => service.requirements(evidence).pipe(Effect.provideService(NativeDatabase, root), Effect.provideService(LifecycleHooks, hooks)),
-			approve: (input, prepare) => service.approve(input, prepare).pipe(Effect.provideService(NativeDatabase, root), Effect.provideService(LifecycleHooks, hooks))
-		};
-	});
-	/** The same locked security checks serve full consumption reads and the
-	* claims-free additional-factor context. No lock spans proof verification. */
-	const readAuthenticatedPending = Effect.fn("DrizzleSession.readAuthenticatedPending")(function* (mapping, input, projection) {
-		const initial = (yield* readPending(mapping, input.digest, false))[0];
-		if (initial === void 0) return yield* invalidPending();
-		const initialNativeSubjectId = initial[mapping.pending.subjectId];
-		if ((yield* readSubject(mapping, initialNativeSubjectId, true))[0] === void 0) return yield* invalidPending();
-		const current = (yield* readPending(mapping, input.digest, true))[0];
-		if (current === void 0 || !mapping.subjectId.equals(current[mapping.pending.subjectId], initialNativeSubjectId)) return yield* invalidPending();
-		const record = yield* (projection === "context" ? mapping.pending.decodeContext : mapping.pending.decode)(current);
-		const nativeSubjectId = yield* mapping.subjectId.toNative(record.evidence.revision.subjectId);
-		const failedAttempts = Number(current[mapping.pending.failedAttempts]);
-		if (!mapping.subjectId.equals(nativeSubjectId, initialNativeSubjectId) || input.bindingDigest !== void 0 && record.evidence.bindingDigest !== input.bindingDigest || current[mapping.pending.version] !== record.version || current[mapping.pending.flowId] !== record.evidence.flowId || current[mapping.pending.bindingDigest] !== record.evidence.bindingDigest || current[mapping.pending.consumed] !== false || failedAttempts >= record.attemptLimit) return yield* invalidPending();
-		const flow = (yield* readFlow(mapping, record.evidence.flowId, true))[0];
-		if (flow === void 0 || flow[mapping.flow.state] !== mapping.flow.pendingStateValue || flow[mapping.flow.pendingDigest] !== input.digest) return yield* invalidPending();
-		const { requirement } = yield* mapFailureCause(validateEvidenceIn(mapping, record.evidence, true), (error) => Schema.is(StaleAuthentication)(error) ? invalidPending() : error);
-		yield* assessAuthentication(record.evidence, requirement).pipe(Effect.mapError(() => invalidPending()));
-		if (DateTime.toEpochMillis(yield* freshNow) >= DateTime.toEpochMillis(record.expiresAt)) return yield* invalidPending();
-		return record;
-	});
-	const makeSqlPendingAuthentication = Effect.fnUntraced(function* (mapping, options) {
-		const database = yield* CurrentSessionSql;
-		if (!options.coordinated) yield* (operations.validateStorage?.(mapping) ?? Effect.void).pipe(Effect.mapError(unavailable));
-		const hooks = yield* LifecycleHooks;
-		const service = {
-			create: (input, _inputNow, prepare) => owned(database, options, mapping.isConstraintConflict, Effect.gen(function* () {
-				const transaction = yield* CurrentSessionSql;
-				const journal = yield* CurrentCommitJournal;
-				const { nativeSubjectId, requirement } = yield* validateEvidenceIn(mapping, input.evidence, true);
-				const existing = (yield* readFlow(mapping, input.evidence.flowId, true))[0];
-				if (existing !== void 0) {
-					const dedupUntil = yield* mapping.flow.decodeInstant(existing[mapping.flow.dedupUntil]);
-					if (DateTime.toEpochMillis(yield* freshNow) < DateTime.toEpochMillis(dedupUntil)) return yield* SessionConflict.make({});
-					yield* transaction.delete(mapping.pending.table).where(eq(pendingColumns(mapping).flowId, input.evidence.flowId));
-					yield* transaction.delete(mapping.flow.table).where(eq(flowColumns(mapping).flowId, input.evidence.flowId));
-				}
-				const version = yield* allocate(options.mode, mapping.pending.allocateVersion, mapping.pending.allocateVersionSync);
-				yield* assessAuthentication(input.evidence, requirement);
-				const now = yield* freshNow;
-				if (DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(input.expiresAt)) return yield* stale();
-				const record = {
-					...input,
-					version
-				};
-				const receipt = prepare(record, journal);
-				yield* transaction.insert(mapping.flow.table).values(mapping.flow.encodePendingInsert({
-					evidence: input.evidence,
-					subjectId: nativeSubjectId,
-					pendingDigest: input.digest,
-					dedupUntil: input.expiresAt
-				}));
-				yield* transaction.insert(mapping.pending.table).values(mapping.pending.encodeInsert(record, {
-					subjectId: nativeSubjectId,
-					failedAttempts: 0,
-					consumed: false
-				}));
-				return receipt;
-			}).pipe(normalizeMutation(mapping))),
-			context: (input) => safeTransaction(inTransaction(database, readAuthenticatedPending(mapping, input, "context"))).pipe(Effect.flatMap(pendingAuthenticationContext)),
-			read: (input) => safeTransaction(inTransaction(database, readAuthenticatedPending(mapping, input, "record"))).pipe(Effect.map((record) => record)),
-			reject: (input, prepare) => owned(database, options, mapping.isConstraintConflict, Effect.gen(function* () {
-				const transaction = yield* CurrentSessionSql;
-				const journal = yield* CurrentCommitJournal;
-				const initial = (yield* readPending(mapping, input.digest, false))[0];
-				if (initial === void 0) return prepare({ _tag: "Rejected" }, journal);
-				const record = yield* mapping.pending.decodeContext(initial);
-				const nativeSubjectId = yield* mapping.subjectId.toNative(record.evidence.revision.subjectId);
-				const subject = (yield* readSubject(mapping, nativeSubjectId, true))[0];
-				const current = (yield* readPending(mapping, input.digest, true))[0];
-				const now = yield* freshNow;
-				const receipt = prepare({ _tag: "Rejected" }, journal);
-				if (subject !== void 0 && mapping.subject.isActiveStatus(subject[mapping.subject.status]) && subject[mapping.subject.securityRevision] === record.evidence.revision.securityRevision && current !== void 0 && current[mapping.pending.consumed] === false && record.evidence.bindingDigest === input.bindingDigest && DateTime.toEpochMillis(now) < DateTime.toEpochMillis(record.expiresAt)) yield* transaction.update(mapping.pending.table).set(updateValues([[mapping.pending.failedAttempts, sql`case when ${pendingColumns(mapping).failedAttempts} < ${pendingColumns(mapping).attemptLimit} then ${pendingColumns(mapping).failedAttempts} + 1 else ${pendingColumns(mapping).failedAttempts} end`]])).where(eq(pendingColumns(mapping).digest, input.digest));
-				return receipt;
-			}))
-		};
-		return {
-			create: (input, now, prepare) => service.create(input, now, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),
-			context: (input) => service.context(input).pipe(Effect.provideService(LifecycleHooks, hooks)),
-			read: (input) => service.read(input).pipe(Effect.provideService(LifecycleHooks, hooks)),
-			reject: (input, prepare) => service.reject(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks))
-		};
-	});
-	const sessionColumns = (mapping) => ({
-		sessionId: column(mapping.session.table, mapping.session.sessionId),
-		subjectId: column(mapping.session.table, mapping.session.subjectId),
-		digest: column(mapping.session.table, mapping.session.digest),
-		version: column(mapping.session.table, mapping.session.version),
-		securityRevision: column(mapping.session.table, mapping.session.securityRevision),
-		issuedAt: column(mapping.session.table, mapping.session.issuedAt),
-		expiresAt: column(mapping.session.table, mapping.session.expiresAt),
-		absoluteExpiresAt: column(mapping.session.table, mapping.session.absoluteExpiresAt)
-	});
-	const makeSqlStatefulSessions = Effect.fnUntraced(function* (mapping, options) {
-		const database = yield* CurrentSessionSql;
-		if (!options.coordinated) yield* (operations.validateStorage?.(mapping) ?? Effect.void).pipe(Effect.mapError(unavailable));
-		const hooks = yield* LifecycleHooks;
-		const root = yield* NativeDatabase;
-		const tables = yield* sqlMapping(() => nativeTables(root.$client.withoutTransforms(), root)).pipe(Effect.mapError(unavailable));
-		const readSnapshot = makeAuthoritySnapshot(tables, mapping);
-		const c = sessionColumns(mapping);
-		const verification = yield* safeTransaction(Effect.gen(function* () {
-			const { session, subject } = yield* sqlMapping(() => ({
-				session: tables(mapping.session.table).as("auth_session"),
-				subject: tables(mapping.subject.table).as("auth_subject")
-			}));
-			const [sessionOwner, subjectOwner] = yield* sqlMapping(() => [session.unencodedTextColumn?.(mapping.session.subjectId), subject.unencodedTextColumn?.(mapping.subject.id)]);
-			return {
-				session,
-				subject,
-				canJoinOwner: yield* canJoinTextColumns(sessionOwner, subjectOwner)
-			};
-		}));
-		const persistence = {
-			establish: (input, prepare) => owned(database, options, mapping.isConstraintConflict, Effect.gen(function* () {
-				const transaction = yield* CurrentSessionSql;
-				const journal = yield* CurrentCommitJournal;
-				const { nativeSubjectId, requirement } = yield* options.locking ? validateEvidenceIn(mapping, input.evidence, true) : Effect.flatMap(readSnapshot(input.evidence.revision.subjectId, input.evidence.revision.credentials.map((item) => item.credentialId)), (captured) => validateCapturedEvidence(mapping, input.evidence, captured));
-				let flowInsert;
-				let pendingExpiresAt;
-				if (input.pending === void 0) {
-					if (input.fresh !== true || input.handoffSourceSessionId !== void 0) flowInsert = yield* ensureDirectFlowAvailable(mapping, input.evidence, nativeSubjectId, input.session.absoluteExpiresAt);
-				} else {
-					if (mapping.pending === void 0) return yield* invalidPending();
-					const pending = yield* validatePending(mapping, input.pending);
-					if (!preservesRevision(input.evidence, pending.evidence)) return yield* invalidPending();
-					pendingExpiresAt = pending.expiresAt;
-				}
-				const nativeSessionId = yield* allocate(options.mode, mapping.session.allocateId, mapping.session.allocateIdSync);
-				const sessionId = yield* mapping.sessionId.toSession(nativeSessionId);
-				if (sessionId === input.handoffSourceSessionId) return yield* SessionConflict.make({});
-				const version = yield* allocate(options.mode, mapping.session.allocateVersion, mapping.session.allocateVersionSync);
-				const assessed = yield* assessAuthentication(input.evidence, requirement);
-				const now = yield* freshNow;
-				if (!assessed.satisfied || pendingExpiresAt !== void 0 && DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(pendingExpiresAt) || DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(input.session.expiresAt) || DateTime.toEpochMillis(input.session.expiresAt) > DateTime.toEpochMillis(input.session.absoluteExpiresAt)) return yield* stale();
-				const record = {
-					...input.session,
-					sessionId,
-					version,
-					subjectId: input.evidence.revision.subjectId,
-					securityRevision: input.evidence.revision.securityRevision,
-					assurance: input.handoffSourceSessionId === void 0 ? assessed.assurance : input.session.assurance,
-					provenance: yield* snapshotSessionAuthenticationProvenance({ evidence: input.evidence }),
-					issuedAt: now
-				};
-				const receipt = prepare(record, journal);
-				if (flowInsert !== void 0) yield* transaction.insert(mapping.flow.table).values(flowInsert);
-				else if (input.pending !== void 0) yield* consumePending({
-					...mapping,
-					pending: mapping.pending
-				}, input.pending, input.session.absoluteExpiresAt);
-				yield* transaction.insert(mapping.session.table).values(mapping.session.encodeInsert(record, {
-					subjectId: nativeSubjectId,
-					sessionId: nativeSessionId
-				}));
-				const commitNow = yield* freshNow;
-				if (DateTime.toEpochMillis(commitNow) < DateTime.toEpochMillis(record.issuedAt) || DateTime.toEpochMillis(commitNow) >= DateTime.toEpochMillis(record.expiresAt) || !(yield* assessAuthentication(input.evidence, requirement)).satisfied) return yield* stale();
-				return receipt;
-			}).pipe(normalizeMutation(mapping))),
-			verify: (input) => safeTransaction(withVerificationSavepoint(Effect.gen(function* () {
-				const sql = root.$client.withoutTransforms();
-				const { session, subject, canJoinOwner } = verification;
-				const owner = canJoinOwner ? void 0 : (yield* database.select({ subjectId: c.subjectId }).from(mapping.session.table).where(eq(c.digest, input.digest)).limit(1))[0];
-				if (!canJoinOwner && owner === void 0) return yield* invalidSession();
-				const row = (yield* sqlMapping(() => sql`select ${session.fields("v_")}, ${subject.fields("s_")}
-              from ${session.name} inner join ${subject.name} on
-                ${subject.column(mapping.subject.id)} = ${owner === void 0 ? session.column(mapping.session.subjectId) : subject.value(mapping.subject.id, owner.subjectId)}
-              where ${session.column(mapping.session.digest)} = ${session.value(mapping.session.digest, input.digest)}
-              limit 1`).pipe(Effect.flatten))[0];
-				if (row === void 0) return yield* invalidSession();
-				const sessionRow = yield* sqlMapping(() => session.decode(row, "v_"));
-				const subjectRow = yield* sqlMapping(() => subject.decode(row, "s_"));
-				const record = yield* mapping.session.decode(sessionRow);
-				const nativeSubjectId = yield* mapping.subjectId.toNative(record.subjectId);
-				const now = yield* freshNow;
-				if (!mapping.subjectId.equals(nativeSubjectId, sessionRow[mapping.session.subjectId]) || !mapping.subjectId.equals(nativeSubjectId, subjectRow[mapping.subject.id]) || !mapping.subject.isActiveStatus(subjectRow[mapping.subject.status]) || subjectRow[mapping.subject.securityRevision] !== record.securityRevision || DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(record.expiresAt) || DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(record.absoluteExpiresAt)) return yield* invalidSession();
-				return record;
-			}))),
-			rotate: (input, prepare) => owned(database, options, mapping.isConstraintConflict, Effect.gen(function* () {
-				const transaction = yield* CurrentSessionSql;
-				const journal = yield* CurrentCommitJournal;
-				const nativeSessionId = yield* mapping.sessionId.toNative(input.sessionId);
-				const initial = (yield* transaction.select().from(mapping.session.table).where(eq(c.sessionId, nativeSessionId)).limit(1))[0];
-				if (initial === void 0) return yield* SessionConflict.make({});
-				const initialRecord = yield* mapping.session.decode(initial);
-				const nativeSubjectId = yield* mapping.subjectId.toNative(initialRecord.subjectId);
-				const subject = (yield* readSubject(mapping, nativeSubjectId, true))[0];
-				const row = (yield* selectRows(transaction.select().from(mapping.session.table).where(eq(c.sessionId, nativeSessionId)).limit(1), options.locking))[0];
-				if (row === void 0) return yield* SessionConflict.make({});
-				const record = yield* mapping.session.decode(row);
-				const version = yield* allocate(options.mode, mapping.session.allocateVersion, mapping.session.allocateVersionSync);
-				const now = yield* freshNow;
-				if (subject === void 0 || !mapping.subject.isActiveStatus(subject[mapping.subject.status]) || subject[mapping.subject.securityRevision] !== input.expectedSecurityRevision || record.securityRevision !== input.expectedSecurityRevision || record.digest !== input.expectedDigest || record.version !== input.expectedVersion || DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(record.expiresAt) || DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(record.absoluteExpiresAt) || DateTime.toEpochMillis(input.nextExpiresAt) > DateTime.toEpochMillis(record.absoluteExpiresAt) || DateTime.toEpochMillis(input.nextExpiresAt) <= DateTime.toEpochMillis(now)) return yield* SessionConflict.make({});
-				const next = {
-					...record,
-					digest: input.nextDigest,
-					credentialVersion: input.nextCredentialVersion,
-					version,
-					issuedAt: now,
-					expiresAt: input.nextExpiresAt
-				};
-				const receipt = prepare(next, journal);
-				yield* transaction.update(mapping.session.table).set(mapping.session.encodeRotation(next)).where(and(eq(c.sessionId, nativeSessionId), eq(c.digest, input.expectedDigest), eq(c.version, input.expectedVersion)));
-				return receipt;
-			})),
-			revokeDigest: (digest, prepare) => owned(database, options, mapping.isConstraintConflict, Effect.gen(function* () {
-				const transaction = yield* CurrentSessionSql;
-				const journal = yield* CurrentCommitJournal;
-				const initial = (yield* transaction.select().from(mapping.session.table).where(eq(c.digest, digest)).limit(1))[0];
-				if (initial === void 0) return prepare(false, journal);
-				const record = yield* mapping.session.decode(initial);
-				const nativeSubjectId = yield* mapping.subjectId.toNative(record.subjectId);
-				yield* readSubject(mapping, nativeSubjectId, true);
-				const row = (yield* selectRows(transaction.select().from(mapping.session.table).where(eq(c.digest, digest)).limit(1), options.locking))[0];
-				const receipt = prepare(row !== void 0, journal);
-				if (row !== void 0) yield* transaction.delete(mapping.session.table).where(eq(c.digest, digest));
-				return receipt;
-			})),
-			revoke: (input, prepare) => owned(database, options, mapping.isConstraintConflict, Effect.gen(function* () {
-				const transaction = yield* CurrentSessionSql;
-				const journal = yield* CurrentCommitJournal;
-				const nativeSubjectId = yield* mapping.subjectId.toNative(input.subjectId);
-				const subject = (yield* readSubject(mapping, nativeSubjectId, true))[0];
-				if (subject === void 0 || !mapping.subject.isActiveStatus(subject[mapping.subject.status]) || subject[mapping.subject.securityRevision] !== input.expectedSecurityRevision) return yield* stale();
-				const nativeSessionId = yield* mapping.sessionId.toNative(input.sessionId);
-				const receipt = prepare(void 0, journal);
-				yield* transaction.delete(mapping.session.table).where(and(eq(c.subjectId, nativeSubjectId), eq(c.sessionId, nativeSessionId)));
-				return receipt;
-			})),
-			revokeAll: (input, prepare) => owned(database, options, mapping.isConstraintConflict, Effect.gen(function* () {
-				const transaction = yield* CurrentSessionSql;
-				const journal = yield* CurrentCommitJournal;
-				const nativeSubjectId = yield* mapping.subjectId.toNative(input.subjectId);
-				const subject = (yield* readSubject(mapping, nativeSubjectId, true))[0];
-				if (subject === void 0 || !mapping.subject.isActiveStatus(subject[mapping.subject.status]) || subject[mapping.subject.securityRevision] !== input.expectedSecurityRevision) return yield* stale();
-				const nextRevisionSync = mapping.subject.nextSecurityRevisionSync;
-				const next = yield* allocate(options.mode, mapping.subject.nextSecurityRevision?.(input.expectedSecurityRevision), nextRevisionSync === void 0 ? void 0 : () => nextRevisionSync(input.expectedSecurityRevision));
-				const receipt = prepare(void 0, journal);
-				yield* transaction.update(mapping.subject.table).set(updateValues([[mapping.subject.securityRevision, next]])).where(and(eq(authorityColumns(mapping).subjectId, nativeSubjectId), eq(authorityColumns(mapping).subjectRevision, input.expectedSecurityRevision)));
-				yield* transaction.delete(mapping.session.table).where(eq(c.subjectId, nativeSubjectId));
-				return receipt;
-			}))
-		};
-		const repository = { list: (input) => safeTransaction(inTransaction(database, Effect.gen(function* () {
-			const read = yield* CurrentSessionSql;
-			const nativeSubjectId = yield* mapping.subjectId.toNative(input.subjectId);
-			const subject = (yield* readSubject(mapping, nativeSubjectId, false))[0];
-			if (subject === void 0 || !mapping.subject.isActiveStatus(subject[mapping.subject.status])) return { sessions: [] };
-			const cursor = input.cursor === void 0 ? void 0 : yield* mapping.sessionId.toNative(input.cursor);
-			const now = yield* freshNow;
-			const rows = yield* read.select().from(mapping.session.table).where(and(eq(c.subjectId, nativeSubjectId), eq(c.securityRevision, subject[mapping.subject.securityRevision]), gt(c.expiresAt, mapping.session.encodeInstant(now)), gt(c.absoluteExpiresAt, mapping.session.encodeInstant(now)), cursor === void 0 ? void 0 : gt(c.sessionId, cursor))).orderBy(c.sessionId).limit(input.limit + 1);
-			const decoded = yield* Effect.forEach(rows, (row) => mapping.session.decode(row));
-			const codec = Schema.toCodecJson(Schema.toType(SessionMetadata));
-			const sessions = yield* Effect.forEach(decoded.slice(0, input.limit), (record) => Schema.encodeEffect(codec)(record).pipe(Effect.flatMap(Schema.decodeEffect(codec))));
-			const nextCursor = decoded[input.limit] === void 0 ? void 0 : sessions.at(-1)?.sessionId;
-			return {
-				sessions,
-				...nextCursor === void 0 ? {} : { nextCursor }
-			};
-		}))) };
-		return {
-			statefulSessionPersistence: {
-				establish: (input, prepare) => persistence.establish(input, prepare).pipe(Effect.provideService(NativeDatabase, root), Effect.provideService(LifecycleHooks, hooks)),
-				verify: (input) => persistence.verify(input).pipe(Effect.provideService(NativeDatabase, root), Effect.provideService(LifecycleHooks, hooks)),
-				rotate: (input, prepare) => persistence.rotate(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),
-				revokeDigest: (digest, prepare) => persistence.revokeDigest(digest, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),
-				revoke: (input, prepare) => persistence.revoke(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),
-				revokeAll: (input, prepare) => persistence.revokeAll(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks))
-			},
-			sessionRepository: { list: (input) => repository.list(input).pipe(Effect.provideService(LifecycleHooks, hooks)) }
-		};
-	});
-	const makeSqlSignedValidity = Effect.fnUntraced(function* (mapping, options) {
-		const database = yield* CurrentSessionSql;
-		if (!options.coordinated) yield* (operations.validateStorage?.(mapping) ?? Effect.void).pipe(Effect.mapError(unavailable));
-		const hooks = yield* LifecycleHooks;
-		const subject = subjectColumns(mapping);
-		const tombstone = {
-			subjectId: column(mapping.tombstone.table, mapping.tombstone.subjectId),
-			sessionId: column(mapping.tombstone.table, mapping.tombstone.sessionId),
-			absoluteExpiresAt: column(mapping.tombstone.table, mapping.tombstone.absoluteExpiresAt)
-		};
-		const root = yield* NativeDatabase;
-		const tables = yield* sqlMapping(() => nativeTables(root.$client.withoutTransforms(), root)).pipe(Effect.mapError(unavailable));
-		const service = {
-			verify: (session, _now) => safeTransaction(withVerificationSavepoint(Effect.gen(function* () {
-				const sql = root.$client.withoutTransforms();
-				const nativeSubjectId = yield* mapping.subjectId.toNative(session.subjectId);
-				const nativeSessionId = yield* mapping.sessionId.toNative(session.sessionId);
-				const readNow = yield* freshNow;
-				const { subjectTable, rows } = yield* sqlMapping(() => {
-					const subjectTable = tables(mapping.subject.table).as("auth_subject");
-					const revoked = tables(mapping.tombstone.table).as("auth_revocation");
-					return {
-						subjectTable,
-						rows: sql`
-                  select ${subjectTable.fields("s_")},
-                    case when exists (
-                      select 1 from ${revoked.name}
-                      where ${revoked.column(mapping.tombstone.subjectId)} = ${revoked.value(mapping.tombstone.subjectId, nativeSubjectId)}
-                        and ${revoked.column(mapping.tombstone.sessionId)} = ${revoked.value(mapping.tombstone.sessionId, nativeSessionId)}
-                        and ${revoked.column(mapping.tombstone.absoluteExpiresAt)} > ${revoked.value(mapping.tombstone.absoluteExpiresAt, mapping.tombstone.encodeInstant(readNow))}
-                    ) then 1 else 0 end as auth_revoked
-                  from ${subjectTable.name}
-                  where ${subjectTable.column(mapping.subject.id)} = ${subjectTable.value(mapping.subject.id, nativeSubjectId)}
-                  limit 1`
-					};
-				});
-				const result = (yield* rows)[0];
-				if (result === void 0) return yield* invalidSession();
-				const row = yield* sqlMapping(() => subjectTable.decode(result, "s_"));
-				const revoked = yield* decodeRevocationFlag(result.auth_revoked);
-				const authoritativeNow = yield* freshNow;
-				if (!mapping.subjectId.equals(nativeSubjectId, row[mapping.subject.id]) || !mapping.subject.isActiveStatus(row[mapping.subject.status]) || row[mapping.subject.securityRevision] !== session.securityRevision || revoked === 1 || DateTime.toEpochMillis(authoritativeNow) >= DateTime.toEpochMillis(session.expiresAt) || DateTime.toEpochMillis(authoritativeNow) >= DateTime.toEpochMillis(session.absoluteExpiresAt)) return yield* invalidSession();
-			}))),
-			revoke: (input, prepare) => owned(database, options, mapping.isConstraintConflict, Effect.gen(function* () {
-				const transaction = yield* CurrentSessionSql;
-				const journal = yield* CurrentCommitJournal;
-				const nativeSubjectId = yield* mapping.subjectId.toNative(input.subjectId);
-				const row = (yield* readSubject(mapping, nativeSubjectId, true))[0];
-				if (row === void 0 || !mapping.subject.isActiveStatus(row[mapping.subject.status]) || row[mapping.subject.securityRevision] !== input.expectedSecurityRevision) return yield* stale();
-				const nativeSessionId = yield* mapping.sessionId.toNative(input.sessionId);
-				const existing = yield* transaction.select().from(mapping.tombstone.table).where(and(eq(tombstone.subjectId, nativeSubjectId), eq(tombstone.sessionId, nativeSessionId))).limit(1);
-				const receipt = prepare(void 0, journal);
-				if (existing[0] === void 0) yield* transaction.insert(mapping.tombstone.table).values(mapping.tombstone.encodeInsert({
-					subjectId: nativeSubjectId,
-					sessionId: nativeSessionId,
-					absoluteExpiresAt: input.absoluteExpiresAt
-				}));
-				else {
-					const existingExpiry = yield* mapping.tombstone.decodeInstant(existing[0][mapping.tombstone.absoluteExpiresAt]);
-					if (DateTime.toEpochMillis(input.absoluteExpiresAt) > DateTime.toEpochMillis(existingExpiry)) yield* transaction.update(mapping.tombstone.table).set(updateValues([[mapping.tombstone.absoluteExpiresAt, mapping.tombstone.encodeInstant(input.absoluteExpiresAt)]])).where(and(eq(tombstone.subjectId, nativeSubjectId), eq(tombstone.sessionId, nativeSessionId)));
-				}
-				return receipt;
-			})),
-			revokeAll: (input, prepare) => owned(database, options, mapping.isConstraintConflict, Effect.gen(function* () {
-				const transaction = yield* CurrentSessionSql;
-				const journal = yield* CurrentCommitJournal;
-				const nativeSubjectId = yield* mapping.subjectId.toNative(input.subjectId);
-				const row = (yield* readSubject(mapping, nativeSubjectId, true))[0];
-				if (row === void 0 || !mapping.subject.isActiveStatus(row[mapping.subject.status]) || row[mapping.subject.securityRevision] !== input.expectedSecurityRevision) return yield* stale();
-				const nextRevisionSync = mapping.subject.nextSecurityRevisionSync;
-				const next = yield* allocate(options.mode, mapping.subject.nextSecurityRevision?.(input.expectedSecurityRevision), nextRevisionSync === void 0 ? void 0 : () => nextRevisionSync(input.expectedSecurityRevision));
-				const receipt = prepare(void 0, journal);
-				yield* transaction.update(mapping.subject.table).set(updateValues([[mapping.subject.securityRevision, next]])).where(and(eq(subject.subjectId, nativeSubjectId), eq(subject.subjectRevision, input.expectedSecurityRevision)));
-				return receipt;
-			}))
-		};
-		return {
-			verify: (session, now) => service.verify(session, now).pipe(Effect.provideService(NativeDatabase, root), Effect.provideService(LifecycleHooks, hooks)),
-			revoke: (input, prepare) => service.revoke(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),
-			revokeAll: (input, prepare) => service.revokeAll(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks))
-		};
-	});
-	const stepUpColumns = (mapping) => Object.fromEntries([
-		"digest",
-		"version",
-		"flowId",
-		"subjectId",
-		"bindingDigest",
-		"snapshot",
-		"expiresAt",
-		"attemptLimit",
-		"failedAttempts",
-		"consumed"
-	].map((key) => [key, column(mapping.intent.table, mapping.intent[key])]));
-	const stepUpLocator = Effect.fn("DrizzleStepUp.locator")(function* (mapping, digest, locking, expiresAt) {
-		const database = yield* CurrentSessionSql;
-		return yield* selectRows(database.select().from(mapping.intent.table).where(and(eq(stepUpColumns(mapping).digest, digest), expiresAt === void 0 ? void 0 : eq(stepUpColumns(mapping).expiresAt, mapping.intent.encodeInstant(expiresAt)))).limit(1), locking).pipe(Effect.map((rows) => rows[0]));
-	});
-	const stepUpAuthority = Effect.fn("DrizzleStepUp.authority")(function* (mapping, revision, locking) {
-		const current = yield* captureDetailsIn(mapping, revision.subjectId, revision.credentials.map((c) => c.credentialId), locking);
-		if (!sameStepUpRevision(current.revision, revision)) return yield* stale();
-		const requirement = yield* mapping.subject.decodeRequirement(current.subject);
-		return {
-			nativeSubjectId: yield* mapping.subjectId.toNative(revision.subjectId),
-			requirement
-		};
-	});
-	const stepUpSource = Effect.fn("DrizzleStepUp.source")(function* (mapping, intent, nativeSubjectId, now, locking) {
-		const database = yield* CurrentSessionSql;
-		if (!stepUpIntentLive(intent, mapping.source.kind, now)) return yield* SessionStepUpInvalid.make({});
-		const source = mapping.source;
-		if (source.kind === "StatelessSigned") return {
-			nativeSessionId: void 0,
-			row: void 0
-		};
-		const nativeSessionId = yield* source.sessionId.toNative(intent.sourceSessionId);
-		if (source.kind === "StateAssistedSigned") {
-			const t = source.tombstone;
-			if ((yield* selectRows(database.select().from(t.table).where(and(eq(column(t.table, t.subjectId), nativeSubjectId), eq(column(t.table, t.sessionId), nativeSessionId), gt(column(t.table, t.absoluteExpiresAt), t.encodeInstant(now)))).limit(1), locking)).length > 0) return yield* SessionStepUpInvalid.make({});
-			return {
-				nativeSessionId,
-				row: void 0
-			};
-		}
-		const s = source.session, c = sessionColumns(source);
-		const row = (yield* selectRows(database.select().from(s.table).where(and(eq(c.sessionId, nativeSessionId), eq(c.subjectId, nativeSubjectId), eq(c.securityRevision, intent.revision.securityRevision), eq(column(s.table, s.credentialVersion), intent.sourceCredentialVersion), eq(column(s.table, s.authenticatedAt), s.encodeInstant(intent.sourceAuthenticatedAt)), eq(c.expiresAt, s.encodeInstant(intent.sourceExpiresAt)), eq(c.absoluteExpiresAt, s.encodeInstant(intent.sourceAbsoluteExpiresAt)), gt(c.expiresAt, s.encodeInstant(now)), gt(c.absoluteExpiresAt, s.encodeInstant(now)))).limit(1), locking))[0];
-		if (row === void 0) return yield* SessionStepUpInvalid.make({});
-		return {
-			nativeSessionId,
-			row
-		};
-	});
-	const readSqlStepUp = Effect.fn("DrizzleStepUp.read")(function* (mapping, digest, locking) {
-		const first = yield* stepUpLocator(mapping, digest, false);
-		if (first === void 0) return yield* SessionStepUpInvalid.make({});
-		const intent = yield* decodeStepUpIntent(first[mapping.intent.snapshot]);
-		const authority = yield* stepUpAuthority(mapping, intent.revision, locking);
-		const source = yield* stepUpSource(mapping, intent, authority.nativeSubjectId, yield* freshNow, locking);
-		const row = yield* stepUpLocator(mapping, digest, locking, intent.expiresAt);
-		const m = mapping.intent;
-		if (row === void 0 || row[m.snapshot] !== first[m.snapshot] || row[m.version] !== intent.version || row[m.digest] !== intent.digest || digest !== intent.digest || row[m.flowId] !== intent.flowId || row[m.bindingDigest] !== intent.bindingDigest || !mapping.subjectId.equals(row[m.subjectId], authority.nativeSubjectId) || Boolean(row[m.consumed]) || !Schema.is(Schema.Natural)(row[m.failedAttempts]) || row[m.failedAttempts] >= row[m.attemptLimit] || row[m.attemptLimit] !== intent.attemptLimit || !stepUpIntentLive(intent, mapping.source.kind, yield* freshNow)) return yield* SessionStepUpInvalid.make({});
-		return {
-			row,
-			intent,
-			source,
-			...authority
-		};
-	});
-	const isSqlStepUpRejectAbsence = (error) => {
-		const tag = typeof error === "object" && error !== null ? Reflect.get(error, "_tag") : void 0;
-		return tag === "SessionStepUpInvalid" || tag === "StaleAuthentication";
-	};
-	const recoverSqlStepUpRejectAbsence = (effect, rejected) => effect.pipe(Effect.catchCause((cause) => {
-		if (cause.reasons.length > 0 && cause.reasons.every((reason) => Cause.isFailReason(reason) && isSqlStepUpRejectAbsence(reason.error))) return Effect.succeed(rejected);
-		return Effect.failCause(Cause.map(cause, (error) => isSqlStepUpRejectAbsence(error) ? unavailable() : error));
-	}));
-	return {
-		makeSqlAuthenticationAuthority,
-		makeSqlPendingAuthentication,
-		makeSqlStatefulSessions,
-		makeSqlSignedValidity,
-		makeSqlSessionStepUp: Effect.fnUntraced(function* (mapping, options) {
-			const database = yield* CurrentSessionSql;
-			if (!options.coordinated) yield* (operations.validateStorage?.(mapping) ?? Effect.void).pipe(Effect.mapError(unavailable));
-			const hooks = yield* LifecycleHooks;
-			const m = mapping.intent, c = stepUpColumns(mapping);
-			const read = (digest) => mapFailureCause(safeTransaction(inTransaction(database, readSqlStepUp(mapping, digest, options.locking))), (error) => error._tag === "StaleAuthentication" ? SessionStepUpInvalid.make({}) : error);
-			const service = {
-				create: (input, _now, prepare) => owned(database, options, mapping.isConstraintConflict, Effect.gen(function* () {
-					const tx = yield* CurrentSessionSql;
-					const journal = yield* CurrentCommitJournal;
-					const authority = yield* stepUpAuthority(mapping, input.revision, options.locking);
-					const version = yield* allocate(options.mode, m.allocateVersion, m.allocateVersionSync);
-					const record = {
-						...input,
-						version
-					};
-					yield* stepUpSource(mapping, record, authority.nativeSubjectId, yield* freshNow, options.locking);
-					if ((yield* selectRows(tx.select().from(m.table).where(or(eq(c.digest, input.digest), eq(c.flowId, input.flowId))).limit(1), options.locking)).length > 0) return yield* SessionConflict.make({});
-					const snapshot = yield* encodeStepUpIntent(record);
-					const values = {
-						...m.encodeInsert(record, { subjectId: authority.nativeSubjectId }),
-						...updateValues([
-							[m.digest, record.digest],
-							[m.version, version],
-							[m.flowId, record.flowId],
-							[m.subjectId, authority.nativeSubjectId],
-							[m.bindingDigest, record.bindingDigest],
-							[m.snapshot, snapshot],
-							[m.expiresAt, m.encodeInstant(record.expiresAt)],
-							[m.attemptLimit, record.attemptLimit],
-							[m.failedAttempts, 0],
-							[m.consumed, false]
-						])
-					};
-					const receipt = prepare(record, journal);
-					yield* tx.insert(m.table).values(values).pipe(normalizeMutation(mapping));
-					if ((yield* tx.select().from(m.table).where(and(eq(c.digest, record.digest), eq(c.version, version), eq(c.flowId, record.flowId), eq(c.subjectId, authority.nativeSubjectId), eq(c.bindingDigest, record.bindingDigest), eq(c.snapshot, snapshot), eq(c.expiresAt, m.encodeInstant(record.expiresAt)), eq(c.attemptLimit, record.attemptLimit), eq(c.failedAttempts, 0), eq(c.consumed, false))).limit(1))[0] === void 0) return yield* unavailable();
-					return receipt;
-				})).pipe((effect) => mapFailureCause(effect, (error) => error._tag === "SessionStepUpInvalid" ? stale() : error)),
-				context: (input) => mapFailureCause(read(input.digest).pipe(Effect.flatMap(({ intent }) => snapshotPendingAuthenticationContext({
-					flowId: intent.flowId,
-					bindingDigest: intent.bindingDigest,
-					revision: intent.revision,
-					expiresAtMillis: DateTime.toEpochMillis(intent.expiresAt)
-				}))), (error) => error._tag === "PendingAuthenticationInvalid" ? unavailable() : error),
-				read: (input) => read(input.digest).pipe(Effect.flatMap((value) => value.intent.bindingDigest === input.bindingDigest ? Effect.succeed(value.intent) : Effect.fail(SessionStepUpInvalid.make({})))),
-				reject: (input, prepare) => owned(database, options, mapping.isConstraintConflict, Effect.gen(function* () {
-					const tx = yield* CurrentSessionSql;
-					const journal = yield* CurrentCommitJournal;
-					const selected = yield* recoverSqlStepUpRejectAbsence(readSqlStepUp(mapping, input.digest, options.locking).pipe(Effect.map((value) => ({
-						_tag: "Found",
-						value
-					}))), { _tag: "Rejected" });
-					if (selected._tag === "Rejected") return prepare({ _tag: "Rejected" }, journal);
-					const { row, intent } = selected.value;
-					const receipt = prepare({ _tag: "Rejected" }, journal);
-					yield* tx.update(m.table).set(updateValues([[m.failedAttempts, sql`${c.failedAttempts} + 1`]])).where(and(eq(c.digest, input.digest), eq(c.snapshot, row[m.snapshot]), eq(c.version, intent.version), eq(c.consumed, false), sql`${c.failedAttempts} < ${c.attemptLimit}`));
-					const written = yield* stepUpLocator(mapping, input.digest, false);
-					if (written === void 0 || written[m.version] !== intent.version || written[m.snapshot] !== row[m.snapshot] || written[m.failedAttempts] !== row[m.failedAttempts] + 1) return yield* unavailable();
-					return receipt;
-				})),
-				complete: (plan, prepare) => owned(database, options, mapping.isConstraintConflict, Effect.gen(function* () {
-					const tx = yield* CurrentSessionSql;
-					const journal = yield* CurrentCommitJournal;
-					yield* validateStepUpPlan(plan);
-					const current = yield* stepUpAuthority(mapping, plan.evidence.revision, options.locking);
-					const stored = yield* readSqlStepUp(mapping, plan.intent.digest, options.locking);
-					if ((yield* encodeStepUpIntent(stored.intent)) !== (yield* encodeStepUpIntent(plan.intent))) return yield* SessionStepUpInvalid.make({});
-					const base = yield* assessAuthentication(plan.evidence, current.requirement).pipe(Effect.mapError(() => stale()));
-					const profile = yield* assessAuthentication(plan.evidence, stored.intent.requirement).pipe(Effect.mapError(() => stale()));
-					if (!base.satisfied || !profile.satisfied) return yield* stale();
-					const replacement = plan.replacement, now = yield* freshNow;
-					if (DateTime.toEpochMillis(replacement.inspection.session.expiresAt) > DateTime.toEpochMillis(stored.intent.sourceAbsoluteExpiresAt) || DateTime.toEpochMillis(now) < DateTime.toEpochMillis(replacement.inspection.session.issuedAt) || DateTime.toEpochMillis(now) >= Math.min(DateTime.toEpochMillis(replacement.inspection.session.expiresAt), DateTime.toEpochMillis(stored.intent.expiresAt))) return yield* SessionStepUpInvalid.make({});
-					let rotation;
-					if (replacement._tag === "Stateful") {
-						if (mapping.source.kind !== "Stateful") return yield* SessionStepUpInvalid.make({});
-						const s = mapping.source.session, row = stored.source.row;
-						if (row[s.digest] !== replacement.expectedDigest || row[s.version] !== replacement.expectedRowVersion) return yield* SessionConflict.make({});
-						const version = yield* allocate(options.mode, s.allocateVersion, s.allocateVersionSync);
-						const next = {
-							...replacement.inspection.session,
-							provenance: replacement.inspection.provenance,
-							credentialVersion: replacement.inspection.credentialVersion,
-							digest: replacement.nextDigest,
-							version
-						};
-						rotation = {
-							...s.encodeRotation(next),
-							...updateValues([
-								[s.version, version],
-								[s.digest, next.digest],
-								[s.credentialVersion, next.credentialVersion],
-								[s.authenticatedAt, s.encodeInstant(next.assurance.authenticatedAt)],
-								[s.issuedAt, s.encodeInstant(next.issuedAt)],
-								[s.expiresAt, s.encodeInstant(next.expiresAt)],
-								[s.absoluteExpiresAt, s.encodeInstant(next.absoluteExpiresAt)]
-							])
-						};
-					}
-					const completionVersion = yield* allocate(options.mode, m.allocateVersion, m.allocateVersionSync);
-					if (completionVersion === stored.intent.version) return yield* unavailable();
-					const completionSnapshot = yield* encodeStepUpIntent({
-						...stored.intent,
-						version: completionVersion
-					});
-					const receipt = prepare(replacement.inspection, journal);
-					if (replacement._tag === "Stateful" && mapping.source.kind === "Stateful") {
-						const s = mapping.source.session, sc = sessionColumns(mapping.source);
-						yield* tx.update(s.table).set(rotation).where(and(eq(sc.sessionId, stored.source.nativeSessionId), eq(sc.digest, replacement.expectedDigest), eq(sc.version, replacement.expectedRowVersion)));
-						const written = (yield* tx.select().from(s.table).where(eq(sc.sessionId, stored.source.nativeSessionId)).limit(1))[0];
-						if (written === void 0 || written[s.version] !== rotation[s.version]) return yield* unavailable();
-						const decoded = yield* s.decode(written);
-						if (decoded.version !== rotation[s.version] || !stepUpRotationMatches(plan, decoded)) return yield* unavailable();
-					} else if (replacement._tag === "StateAssistedSigned" && mapping.source.kind === "StateAssistedSigned") {
-						const t = mapping.source.tombstone;
-						const owner = column(t.table, t.subjectId), id = column(t.table, t.sessionId), expiry = column(t.table, t.absoluteExpiresAt);
-						yield* tx.delete(t.table).where(and(eq(owner, stored.nativeSubjectId), eq(id, stored.source.nativeSessionId), lte(expiry, t.encodeInstant(yield* freshNow))));
-						const values = t.encodeInsert({
-							subjectId: stored.nativeSubjectId,
-							sessionId: stored.source.nativeSessionId,
-							absoluteExpiresAt: replacement.tombstoneUntil
-						});
-						yield* tx.insert(t.table).values(values).pipe(normalizeMutation(mapping));
-						if ((yield* tx.select().from(t.table).where(and(eq(owner, stored.nativeSubjectId), eq(id, stored.source.nativeSessionId), eq(expiry, t.encodeInstant(replacement.tombstoneUntil)))).limit(1))[0] === void 0) return yield* unavailable();
-					}
-					yield* tx.update(m.table).set(updateValues([
-						[m.consumed, true],
-						[m.version, completionVersion],
-						[m.snapshot, completionSnapshot]
-					])).where(and(eq(c.digest, stored.intent.digest), eq(c.version, stored.intent.version), eq(c.snapshot, stored.row[m.snapshot]), eq(c.consumed, false), eq(c.failedAttempts, stored.row[m.failedAttempts])));
-					const completed = yield* stepUpLocator(mapping, stored.intent.digest, false);
-					if (completed === void 0 || !completed[m.consumed] || completed[m.version] !== completionVersion || completed[m.snapshot] !== completionSnapshot) return yield* unavailable();
-					const commitNow = yield* freshNow;
-					if (!stepUpIntentLive(stored.intent, mapping.source.kind, commitNow) || DateTime.toEpochMillis(commitNow) >= DateTime.toEpochMillis(replacement.inspection.session.expiresAt) || !(yield* assessAuthentication(plan.evidence, current.requirement).pipe(Effect.mapError(() => stale()))).satisfied || !(yield* assessAuthentication(plan.evidence, stored.intent.requirement).pipe(Effect.mapError(() => stale()))).satisfied) return yield* stale();
-					return receipt;
-				}))
-			};
-			return {
-				create: (input, now, prepare) => service.create(input, now, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),
-				context: (input) => service.context(input).pipe(Effect.provideService(LifecycleHooks, hooks)),
-				read: (input) => service.read(input).pipe(Effect.provideService(LifecycleHooks, hooks)),
-				reject: (input, prepare) => service.reject(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),
-				complete: (plan, prepare) => service.complete(plan, prepare).pipe(Effect.provideService(LifecycleHooks, hooks))
-			};
-		})
-	};
-};
-//#endregion
-export { CurrentSessionSql, makeSessionKernel };
-
-//# sourceMappingURL=session-kernel.mjs.map