@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.26

package/dist/internal/session-native-step-up.mjs

@@ -0,0 +1,212 @@
+import { PersistenceMappingError, isMappedConstraintConflict } from "./mapping-error.mjs";
+import { sqlBatchAssertion } from "./d1-planning.mjs";
+import { CurrentSqlCommit, SqlBatchCommit, makeSqlCommitExecutor, registerSqlBatchPostcondition, registerSqlPostcondition } from "./sql-commit.mjs";
+import { normalizeSessionOperation, sameSessionRevision, sessionInvariant, sessionUnavailable } from "./session-native-state.mjs";
+import { makeConditionalSqlInsert, makeNativeSessionRecords, sameSessionRecord } from "./session-native-record.mjs";
+import { prepareNativeSession } from "./session-native-pending.mjs";
+import { allocateSessionValue } from "./session-policy.mjs";
+import { sessionEvidenceDeadline } from "./session-native-authority.mjs";
+import { makeNativeSessionPendingReader } from "./session-native-pending-read.mjs";
+import { decodeStepUpIntent, encodeStepUpIntent, stepUpIntentLive, validateStepUpPlan } from "./step-up-state.mjs";
+import { DateTime, Effect, Option, Schema } from "effect";
+import { SessionConflict, SessionMetadata, SessionStepUpInvalid, StaleAuthentication } from "@yielded/auth/Sessions";
+import { AuthenticationAssurance } from "@yielded/auth/Operations";
+//#region src/internal/session-native-step-up.ts
+const assuranceJson = Schema.encodeSync(Schema.fromJsonString(SessionMetadata.fields.assurance));
+const makeNativeSessionStepUpServices = Effect.fnUntraced(function* (tables, mapping) {
+	const batch = yield* SqlBatchCommit;
+	const { state, pending, read: readPending } = yield* makeNativeSessionPendingReader(tables, mapping, batch !== void 0);
+	const conditionalInsert = yield* makeConditionalSqlInsert();
+	const records = mapping.source.kind === "Stateful" ? yield* makeNativeSessionRecords(tables, {
+		...mapping,
+		...mapping.source
+	}) : void 0;
+	const executor = yield* makeSqlCommitExecutor(sessionUnavailable), external = yield* Effect.serviceOption(CurrentSqlCommit);
+	const { sql, now } = state;
+	const native = (work, mode = "transaction") => batch === void 0 ? executor.operation(normalizeSessionOperation(work), mode) : executor.operationBatch(normalizeSessionOperation(work)).pipe(Effect.provideService(SqlBatchCommit, batch));
+	const decode = Effect.fnUntraced(function* (stored) {
+		const intent = yield* decodeStepUpIntent(stored.snapshot);
+		sessionInvariant(intent.digest === stored.digest && intent.version === stored.version && intent.flowId === stored.flowId && intent.bindingDigest === stored.bindingDigest && intent.revision.subjectId === stored.subjectId && DateTime.toEpochMillis(intent.expiresAt) === stored.expiresAtMillis && intent.attemptLimit === stored.attemptLimit);
+		return intent;
+	});
+	const source = Effect.fnUntraced(function* (intent, instant) {
+		if (!stepUpIntentLive(intent, mapping.source.kind, DateTime.makeUnsafe(instant))) return void 0;
+		const subject = yield* mapping.subjectId.toNative(intent.revision.subjectId);
+		if (mapping.source.kind === "Stateful") {
+			sessionInvariant(records !== void 0);
+			const nativeSession = yield* mapping.source.sessionId.toNative(intent.sourceSessionId), { s, table } = records;
+			const rows = yield* sql`select ${table.fields("source_")} from ${table.name} where ${state.id(table, s.subjectId, subject)} and ${state.id(table, s.sessionId, nativeSession)} and ${records.live(table)} limit 2`;
+			sessionInvariant(rows.length <= 1);
+			if (rows[0] === void 0) return void 0;
+			const record = yield* records.decode(table.decode(rows[0], "source_"));
+			if (record.credentialVersion !== intent.sourceCredentialVersion || record.subjectId !== intent.revision.subjectId || record.sessionId !== intent.sourceSessionId || record.securityRevision !== intent.revision.securityRevision || DateTime.toEpochMillis(record.assurance.authenticatedAt) !== DateTime.toEpochMillis(intent.sourceAuthenticatedAt) || DateTime.toEpochMillis(record.expiresAt) !== DateTime.toEpochMillis(intent.sourceExpiresAt) || DateTime.toEpochMillis(record.absoluteExpiresAt) !== DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt)) return void 0;
+			return {
+				record,
+				condition: sql`exists(select 1 from ${table.name} where ${yield* records.owner(record)} and ${records.live(table)})`
+			};
+		}
+		if (mapping.source.kind === "StateAssistedSigned") {
+			const t = mapping.source.tombstone, table = tables(t.table), session = yield* mapping.source.sessionId.toNative(intent.sourceSessionId);
+			const condition = sql`not exists(select 1 from ${table.name} where ${state.exact(table, t.moduleId, mapping.moduleId)} and ${state.id(table, t.subjectId, subject)} and ${state.id(table, t.sessionId, session)})`;
+			if ((yield* sql`select 1 where ${condition}`).length !== 1) return void 0;
+			return {
+				record: void 0,
+				condition
+			};
+		}
+		return {
+			record: void 0,
+			condition: sql`1 = 1`
+		};
+	});
+	const final = Effect.fnUntraced(function* (name, condition) {
+		if (batch !== void 0) yield* registerSqlBatchPostcondition({
+			name,
+			statement: sqlBatchAssertion(sql, condition)
+		});
+		else if (Option.isSome(external)) yield* registerSqlPostcondition({
+			name,
+			check: Effect.gen(function* () {
+				sessionInvariant((yield* sql`select 1 where ${condition}`).length === 1);
+			}).pipe(Effect.mapError((cause) => PersistenceMappingError.make({
+				operation: "decode",
+				cause
+			})))
+		});
+	});
+	const snapshotCondition = (intent, snapshot) => sql.and([
+		state.exact(pending.table, pending.p.snapshot, snapshot),
+		sql`${tables.expression(mapping.clock.toMillis(pending.table.column(pending.p.expiresAt)))} = ${DateTime.toEpochMillis(intent.expiresAt)}`,
+		sql`${pending.table.column(pending.p.attemptLimit)} = ${pending.table.value(pending.p.attemptLimit, intent.attemptLimit)}`
+	]);
+	return { sessionStepUpPersistence: {
+		create: (input, _now, project) => native(Effect.gen(function* () {
+			const current = yield* state.read(input.revision.subjectId, true);
+			if (current === void 0 || !sameSessionRevision(current.revision, input.revision)) return yield* StaleAuthentication.make({});
+			const original = yield* source(input, current.now);
+			if (original === void 0) return yield* StaleAuthentication.make({});
+			const version = yield* allocateSessionValue("interactive", mapping.pending.allocateVersion, mapping.pending.allocateVersionSync);
+			const intent = {
+				...input,
+				version
+			}, snapshot = yield* encodeStepUpIntent(intent);
+			const condition = sql`${state.authorityCondition(intent.revision, current.native)} and ${state.policyCondition(current.row, current.native)} and ${original.condition} and ${now} >= ${DateTime.toEpochMillis(intent.sourceAuthenticatedAt)} and ${now} < ${DateTime.toEpochMillis(intent.expiresAt)}`;
+			yield* pending.insert({
+				moduleId: mapping.moduleId,
+				kind: "StepUp",
+				digest: intent.digest,
+				version,
+				flowId: intent.flowId,
+				subjectId: current.native,
+				bindingDigest: intent.bindingDigest,
+				snapshot,
+				expiresAt: intent.expiresAt,
+				attemptLimit: intent.attemptLimit
+			}, condition).pipe(Effect.mapError((error) => isMappedConstraintConflict(mapping.isConstraintConflict, error) ? SessionConflict.make({}) : error));
+			yield* final("session-step-up-issuance", sql`${condition} and exists(select 1 from ${pending.table.name} where ${pending.predicate(pending.table, "StepUp", intent.digest)} and ${state.exact(pending.table, pending.p.version, version)} and ${snapshotCondition(intent, snapshot)})`);
+			return yield* prepareNativeSession(intent, project);
+		})),
+		read: ({ digest }) => executor.read(Effect.gen(function* () {
+			const selected = yield* readPending("StepUp", digest);
+			if (selected === void 0) return void 0;
+			const intent = yield* decode(selected.record), current = selected.authority;
+			if (!sameSessionRevision(current.revision, intent.revision) || !stepUpIntentLive(intent, mapping.source.kind, DateTime.makeUnsafe(current.now))) return void 0;
+			return {
+				intent,
+				requirement: current.requirement
+			};
+		})).pipe(Effect.flatMap((value) => value === void 0 ? Effect.fail(SessionStepUpInvalid.make({})) : Effect.succeed(value))),
+		reject: ({ digest }, project) => native(Effect.gen(function* () {
+			yield* pending.reject("StepUp", digest);
+			return yield* prepareNativeSession({ _tag: "Rejected" }, project);
+		}), "statement"),
+		complete: (plan, project) => native(Effect.gen(function* () {
+			yield* validateStepUpPlan(plan);
+			const { intent, evidence, replacement } = plan;
+			const current = yield* state.read(intent.revision.subjectId, true);
+			if (current === void 0 || !sameSessionRevision(current.revision, evidence.revision) || !sameSessionRevision(current.revision, intent.revision)) return yield* StaleAuthentication.make({});
+			const original = yield* source(intent, current.now);
+			if (original === void 0) return yield* SessionStepUpInvalid.make({});
+			if (plan.source.guard._tag === "Stateful") {
+				if (original.record === void 0 || original.record.digest !== plan.source.guard.digest || !sameSessionRecord(original.record, {
+					...plan.source.inspection.session,
+					provenance: plan.source.inspection.provenance,
+					credentialVersion: plan.source.inspection.credentialVersion,
+					digest: plan.source.guard.digest
+				})) return yield* SessionStepUpInvalid.make({});
+			}
+			const base = yield* sessionEvidenceDeadline(evidence, current.requirement, current.now), profile = yield* sessionEvidenceDeadline(evidence, intent.requirement, current.now);
+			if (assuranceJson(AuthenticationAssurance.make({
+				...base.assessed.assurance,
+				authenticatedAt: profile.assessed.assurance.authenticatedAt
+			})) !== assuranceJson(replacement.inspection.session.assurance)) return yield* SessionStepUpInvalid.make({});
+			const deadline = Math.min(base.validUntil, profile.validUntil, DateTime.toEpochMillis(intent.expiresAt), DateTime.toEpochMillis(replacement.inspection.session.expiresAt));
+			if (current.now >= deadline || DateTime.toEpochMillis(replacement.inspection.session.issuedAt) > current.now || DateTime.toEpochMillis(replacement.inspection.session.expiresAt) > DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt)) return yield* SessionStepUpInvalid.make({});
+			const snapshot = yield* encodeStepUpIntent(intent);
+			const authority = sql`${state.authorityCondition(evidence.revision, current.native)} and ${state.policyCondition(current.row, current.native)} and ${now} >= ${current.now} and ${now} < ${deadline}`;
+			yield* pending.consume("StepUp", intent, current.native, sql`${snapshotCondition(intent, snapshot)} and ${authority} and ${original.condition}`);
+			let replacementCondition = sql`1 = 1`;
+			let replacementRecord;
+			if (replacement._tag === "Stateful" && mapping.source.kind === "Stateful") {
+				sessionInvariant(records !== void 0 && original.record !== void 0);
+				const next = {
+					...replacement.inspection.session,
+					digest: replacement.nextDigest,
+					credentialVersion: replacement.inspection.credentialVersion,
+					provenance: replacement.inspection.provenance
+				};
+				if (next.digest === original.record.digest || next.credentialVersion === original.record.credentialVersion) return yield* SessionStepUpInvalid.make({});
+				const { s, table } = records;
+				const values = {
+					...s.encodeRotation(next),
+					[s.digest]: next.digest,
+					[s.issuedAt]: s.encodeInstant(next.issuedAt),
+					[s.expiresAt]: s.encodeInstant(next.expiresAt),
+					[s.absoluteExpiresAt]: s.encodeInstant(next.absoluteExpiresAt),
+					[s.securityRevision]: next.securityRevision
+				};
+				yield* pending.stage(sql`${table.update(values)} where ${yield* records.owner(original.record)} and ${records.live(table)} and ${authority}`, 1);
+				replacementCondition = sql`exists(select 1 from ${table.name} where ${yield* records.owner(next)} and ${records.encodedCondition(values)} and ${records.live(table)})`;
+				replacementRecord = next;
+			} else if (replacement._tag === "StateAssistedSigned" && mapping.source.kind === "StateAssistedSigned") {
+				const t = mapping.source.tombstone, table = tables(t.table), session = yield* mapping.source.sessionId.toNative(intent.sourceSessionId);
+				const values = {
+					...t.encodeInsert({
+						moduleId: mapping.moduleId,
+						subjectId: current.native,
+						sessionId: session,
+						absoluteExpiresAt: intent.sourceAbsoluteExpiresAt
+					}),
+					[t.moduleId]: mapping.moduleId,
+					[t.subjectId]: current.native,
+					[t.sessionId]: session,
+					[t.absoluteExpiresAt]: t.encodeInstant(intent.sourceAbsoluteExpiresAt)
+				};
+				yield* pending.stage(conditionalInsert(table, values, sql`${authority} and ${original.condition}`), 1);
+				replacementCondition = sql`exists(select 1 from ${table.name} where ${state.exact(table, t.moduleId, mapping.moduleId)} and ${state.id(table, t.subjectId, current.native)} and ${state.id(table, t.sessionId, session)} and ${tables.expression(mapping.clock.toMillis(table.column(t.absoluteExpiresAt)))} >= ${DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt)})`;
+			} else if (replacement._tag !== "StatelessSigned" || mapping.source.kind !== "StatelessSigned") return yield* SessionStepUpInvalid.make({});
+			yield* final("session-step-up-completion", sql`${authority} and ${pending.consumedCondition("StepUp", intent, current.native)} and ${replacementCondition}`);
+			if (batch === void 0 && Option.isSome(external)) yield* registerSqlPostcondition({
+				name: "session-step-up-current-policy",
+				check: Effect.gen(function* () {
+					const actual = yield* state.read(intent.revision.subjectId);
+					sessionInvariant(actual !== void 0 && sameSessionRevision(actual.revision, evidence.revision));
+					yield* sessionEvidenceDeadline(evidence, actual.requirement, actual.now);
+					yield* sessionEvidenceDeadline(evidence, intent.requirement, actual.now);
+					if (replacementRecord !== void 0 && records !== void 0) {
+						const row = yield* records.read(replacementRecord.digest);
+						sessionInvariant(row !== void 0 && sameSessionRecord(row, replacementRecord));
+					}
+				}).pipe(Effect.mapError((cause) => PersistenceMappingError.make({
+					operation: "decode",
+					cause
+				})))
+			});
+			return yield* prepareNativeSession(replacement.inspection, project);
+		}))
+	} };
+});
+//#endregion
+export { makeNativeSessionStepUpServices };
+
+//# sourceMappingURL=session-native-step-up.mjs.map

package/dist/internal/session-native-step-up.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-native-step-up.mjs","names":[],"sources":["../../src/internal/session-native-step-up.ts"],"sourcesContent":["import type { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport { AuthenticationAssurance } from \"@yielded/auth/Operations\";\nimport {\n  SessionConflict,\n  SessionStepUpInvalid,\n  StaleAuthentication,\n  SessionMetadata,\n  type SessionStepUpPersistence,\n  type SessionStepUpIntent,\n  type StatefulSessionRecord,\n} from \"@yielded/auth/Sessions\";\nimport { DateTime, Effect, Option, Schema } from \"effect\";\nimport type { SqlClient } from \"effect/sql/SqlClient\";\nimport type { Fragment } from \"effect/sql/Statement\";\n\nimport { sqlBatchAssertion } from \"./d1-planning\";\nimport { PersistenceMappingError, isMappedConstraintConflict } from \"./mapping-error\";\nimport type { SessionStepUpMapping } from \"./models/step-up-model\";\nimport type { NativeSqlTables } from \"./native-sql-table\";\nimport { sessionEvidenceDeadline } from \"./session-native-authority\";\nimport { prepareNativeSession, type StoredSessionPending } from \"./session-native-pending\";\nimport { makeNativeSessionPendingReader } from \"./session-native-pending-read\";\nimport {\n  makeNativeSessionRecords,\n  sameSessionRecord,\n  makeConditionalSqlInsert,\n} from \"./session-native-record\";\nimport {\n  sameSessionRevision,\n  normalizeSessionOperation,\n  sessionInvariant,\n  sessionUnavailable,\n} from \"./session-native-state\";\nimport { allocateSessionValue } from \"./session-policy\";\nimport {\n  CurrentSqlCommit,\n  makeSqlCommitExecutor,\n  SqlBatchCommit,\n  registerSqlPostcondition,\n  registerSqlBatchPostcondition,\n} from \"./sql-commit\";\nimport {\n  encodeStepUpIntent,\n  decodeStepUpIntent,\n  stepUpIntentLive,\n  validateStepUpPlan,\n} from \"./step-up-state\";\nimport type { AnyTableModel } from \"./table-model\";\n\nexport type NativeSessionStepUpMapping<Claims> = SessionStepUpMapping<\n  Claims,\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  unknown,\n  unknown\n>;\n\nconst assuranceJson = Schema.encodeSync(Schema.fromJsonString(SessionMetadata.fields.assurance));\n\nexport const makeNativeSessionStepUpServices = Effect.fnUntraced(function* <Claims>(\n  tables: NativeSqlTables,\n  mapping: NativeSessionStepUpMapping<Claims>,\n): Effect.fn.Return<\n  { readonly sessionStepUpPersistence: SessionStepUpPersistence<Claims> },\n  never,\n  SqlClient | LifecycleHooks | SqlBatchCommit\n> {\n  const batch = yield* SqlBatchCommit;\n\n  const {\n    state,\n    pending,\n    read: readPending,\n  } = yield* makeNativeSessionPendingReader(tables, mapping, batch !== undefined);\n\n  const conditionalInsert = yield* makeConditionalSqlInsert();\n\n  const records =\n    mapping.source.kind === \"Stateful\"\n      ? yield* makeNativeSessionRecords(tables, { ...mapping, ...mapping.source })\n      : undefined;\n\n  const executor = yield* makeSqlCommitExecutor(sessionUnavailable),\n    external = yield* Effect.serviceOption(CurrentSqlCommit);\n\n  const { sql, now } = state;\n\n  const native = <A, E, R>(\n    work: Effect.Effect<A, E, R>,\n    mode: \"transaction\" | \"statement\" = \"transaction\",\n  ) =>\n    batch === undefined\n      ? executor.operation(normalizeSessionOperation(work), mode)\n      : executor\n          .operationBatch(normalizeSessionOperation(work))\n          .pipe(Effect.provideService(SqlBatchCommit, batch));\n\n  const decode = Effect.fnUntraced(function* (stored: StoredSessionPending) {\n    const intent = yield* decodeStepUpIntent(stored.snapshot);\n\n    sessionInvariant(\n      intent.digest === stored.digest &&\n        intent.version === stored.version &&\n        intent.flowId === stored.flowId &&\n        intent.bindingDigest === stored.bindingDigest &&\n        intent.revision.subjectId === stored.subjectId &&\n        DateTime.toEpochMillis(intent.expiresAt) === stored.expiresAtMillis &&\n        intent.attemptLimit === stored.attemptLimit,\n    );\n\n    return intent;\n  });\n\n  const source = Effect.fnUntraced(function* (\n    intent: Omit<SessionStepUpIntent, \"version\">,\n    instant: number,\n  ) {\n    if (!stepUpIntentLive(intent, mapping.source.kind, DateTime.makeUnsafe(instant)))\n      return undefined;\n    const subject = yield* mapping.subjectId.toNative(intent.revision.subjectId);\n\n    if (mapping.source.kind === \"Stateful\") {\n      sessionInvariant(records !== undefined);\n\n      const nativeSession = yield* mapping.source.sessionId.toNative(intent.sourceSessionId),\n        { s, table } = records;\n\n      const rows =\n        yield* sql`select ${table.fields(\"source_\")} from ${table.name} where ${state.id(table, s.subjectId, subject)} and ${state.id(table, s.sessionId, nativeSession)} and ${records.live(table)} limit 2`;\n\n      sessionInvariant(rows.length <= 1);\n      if (rows[0] === undefined) return undefined;\n      const record = yield* records.decode(table.decode(rows[0], \"source_\"));\n\n      if (\n        record.credentialVersion !== intent.sourceCredentialVersion ||\n        record.subjectId !== intent.revision.subjectId ||\n        record.sessionId !== intent.sourceSessionId ||\n        record.securityRevision !== intent.revision.securityRevision ||\n        DateTime.toEpochMillis(record.assurance.authenticatedAt) !==\n          DateTime.toEpochMillis(intent.sourceAuthenticatedAt) ||\n        DateTime.toEpochMillis(record.expiresAt) !==\n          DateTime.toEpochMillis(intent.sourceExpiresAt) ||\n        DateTime.toEpochMillis(record.absoluteExpiresAt) !==\n          DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt)\n      )\n        return undefined;\n\n      return {\n        record,\n        condition: sql`exists(select 1 from ${table.name} where ${yield* records.owner(record)} and ${records.live(table)})`,\n      };\n    }\n    if (mapping.source.kind === \"StateAssistedSigned\") {\n      const t = mapping.source.tombstone,\n        table = tables(t.table),\n        session = yield* mapping.source.sessionId.toNative(intent.sourceSessionId);\n\n      const condition = sql`not exists(select 1 from ${table.name} where ${state.exact(table, t.moduleId, mapping.moduleId)} and ${state.id(table, t.subjectId, subject)} and ${state.id(table, t.sessionId, session)})`;\n\n      if ((yield* sql`select 1 where ${condition}`).length !== 1) return undefined;\n\n      return { record: undefined, condition };\n    }\n\n    return { record: undefined, condition: sql`1 = 1` };\n  });\n\n  const final = Effect.fnUntraced(function* (name: string, condition: Fragment) {\n    if (batch !== undefined)\n      yield* registerSqlBatchPostcondition({ name, statement: sqlBatchAssertion(sql, condition) });\n    else if (Option.isSome(external))\n      yield* registerSqlPostcondition({\n        name,\n        check: Effect.gen(function* () {\n          sessionInvariant((yield* sql`select 1 where ${condition}`).length === 1);\n        }).pipe(\n          Effect.mapError((cause) => PersistenceMappingError.make({ operation: \"decode\", cause })),\n        ),\n      });\n  });\n\n  const snapshotCondition = (intent: SessionStepUpIntent, snapshot: string) =>\n    sql.and([\n      state.exact(pending.table, pending.p.snapshot, snapshot),\n      sql`${tables.expression(mapping.clock.toMillis(pending.table.column(pending.p.expiresAt)))} = ${DateTime.toEpochMillis(intent.expiresAt)}`,\n      sql`${pending.table.column(pending.p.attemptLimit)} = ${pending.table.value(pending.p.attemptLimit, intent.attemptLimit)}`,\n    ]);\n\n  const sessionStepUpPersistence: SessionStepUpPersistence<Claims> = {\n    create: (input, _now, project) =>\n      native(\n        Effect.gen(function* () {\n          const current = yield* state.read(input.revision.subjectId, true);\n\n          if (current === undefined || !sameSessionRevision(current.revision, input.revision))\n            return yield* StaleAuthentication.make({});\n          const original = yield* source(input, current.now);\n\n          if (original === undefined) return yield* StaleAuthentication.make({});\n\n          const version = yield* allocateSessionValue(\n            \"interactive\",\n            mapping.pending.allocateVersion,\n            mapping.pending.allocateVersionSync,\n          );\n\n          const intent = { ...input, version },\n            snapshot = yield* encodeStepUpIntent(intent);\n\n          const condition = sql`${state.authorityCondition(intent.revision, current.native)} and ${state.policyCondition(current.row, current.native)} and ${original.condition} and ${now} >= ${DateTime.toEpochMillis(intent.sourceAuthenticatedAt)} and ${now} < ${DateTime.toEpochMillis(intent.expiresAt)}`;\n\n          yield* pending\n            .insert(\n              {\n                moduleId: mapping.moduleId,\n                kind: \"StepUp\",\n                digest: intent.digest,\n                version,\n                flowId: intent.flowId,\n                subjectId: current.native,\n                bindingDigest: intent.bindingDigest,\n                snapshot,\n                expiresAt: intent.expiresAt,\n                attemptLimit: intent.attemptLimit,\n              },\n              condition,\n            )\n            .pipe(\n              Effect.mapError((error) =>\n                isMappedConstraintConflict(mapping.isConstraintConflict, error)\n                  ? SessionConflict.make({})\n                  : error,\n              ),\n            );\n          yield* final(\n            \"session-step-up-issuance\",\n            sql`${condition} and exists(select 1 from ${pending.table.name} where ${pending.predicate(pending.table, \"StepUp\", intent.digest)} and ${state.exact(pending.table, pending.p.version, version)} and ${snapshotCondition(intent, snapshot)})`,\n          );\n\n          return yield* prepareNativeSession(intent, project);\n        }),\n      ),\n    read: ({ digest }) =>\n      executor\n        .read(\n          Effect.gen(function* () {\n            const selected = yield* readPending(\"StepUp\", digest);\n\n            if (selected === undefined) return undefined;\n\n            const intent = yield* decode(selected.record),\n              current = selected.authority;\n\n            if (\n              !sameSessionRevision(current.revision, intent.revision) ||\n              !stepUpIntentLive(intent, mapping.source.kind, DateTime.makeUnsafe(current.now))\n            )\n              return undefined;\n\n            // The detached source stays original. Its live digest and metadata\n            // are rechecked by complete before any replacement is committed.\n            return { intent, requirement: current.requirement };\n          }),\n        )\n        .pipe(\n          Effect.flatMap((value) =>\n            value === undefined\n              ? Effect.fail(SessionStepUpInvalid.make({}))\n              : Effect.succeed(value),\n          ),\n        ),\n    reject: ({ digest }, project) =>\n      native(\n        Effect.gen(function* () {\n          yield* pending.reject(\"StepUp\", digest);\n\n          return yield* prepareNativeSession({ _tag: \"Rejected\" } as const, project);\n        }),\n        \"statement\",\n      ),\n    complete: (plan, project) =>\n      native(\n        Effect.gen(function* () {\n          yield* validateStepUpPlan(plan);\n          const { intent, evidence, replacement } = plan;\n          const current = yield* state.read(intent.revision.subjectId, true);\n\n          if (\n            current === undefined ||\n            !sameSessionRevision(current.revision, evidence.revision) ||\n            !sameSessionRevision(current.revision, intent.revision)\n          )\n            return yield* StaleAuthentication.make({});\n          const original = yield* source(intent, current.now);\n\n          if (original === undefined) return yield* SessionStepUpInvalid.make({});\n          if (plan.source.guard._tag === \"Stateful\") {\n            if (\n              original.record === undefined ||\n              original.record.digest !== plan.source.guard.digest ||\n              !sameSessionRecord(original.record, {\n                ...plan.source.inspection.session,\n                provenance: plan.source.inspection.provenance,\n                credentialVersion: plan.source.inspection.credentialVersion,\n                digest: plan.source.guard.digest,\n              })\n            )\n              return yield* SessionStepUpInvalid.make({});\n          }\n\n          const base = yield* sessionEvidenceDeadline(evidence, current.requirement, current.now),\n            profile = yield* sessionEvidenceDeadline(evidence, intent.requirement, current.now);\n\n          if (\n            assuranceJson(\n              AuthenticationAssurance.make({\n                ...base.assessed.assurance,\n                authenticatedAt: profile.assessed.assurance.authenticatedAt,\n              }),\n            ) !== assuranceJson(replacement.inspection.session.assurance)\n          )\n            return yield* SessionStepUpInvalid.make({});\n\n          const deadline = Math.min(\n            base.validUntil,\n            profile.validUntil,\n            DateTime.toEpochMillis(intent.expiresAt),\n            DateTime.toEpochMillis(replacement.inspection.session.expiresAt),\n          );\n\n          if (\n            current.now >= deadline ||\n            DateTime.toEpochMillis(replacement.inspection.session.issuedAt) > current.now ||\n            DateTime.toEpochMillis(replacement.inspection.session.expiresAt) >\n              DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt)\n          )\n            return yield* SessionStepUpInvalid.make({});\n          const snapshot = yield* encodeStepUpIntent(intent);\n          const authority = sql`${state.authorityCondition(evidence.revision, current.native)} and ${state.policyCondition(current.row, current.native)} and ${now} >= ${current.now} and ${now} < ${deadline}`;\n\n          yield* pending.consume(\n            \"StepUp\",\n            intent,\n            current.native,\n            sql`${snapshotCondition(intent, snapshot)} and ${authority} and ${original.condition}`,\n          );\n          let replacementCondition: Fragment = sql`1 = 1`;\n          let replacementRecord: StatefulSessionRecord<Claims> | undefined;\n\n          if (replacement._tag === \"Stateful\" && mapping.source.kind === \"Stateful\") {\n            sessionInvariant(records !== undefined && original.record !== undefined);\n\n            const next: StatefulSessionRecord<Claims> = {\n              ...replacement.inspection.session,\n              digest: replacement.nextDigest,\n              credentialVersion: replacement.inspection.credentialVersion,\n              provenance: replacement.inspection.provenance,\n            };\n\n            if (\n              next.digest === original.record.digest ||\n              next.credentialVersion === original.record.credentialVersion\n            )\n              return yield* SessionStepUpInvalid.make({});\n            const { s, table } = records;\n\n            const values = {\n              ...s.encodeRotation(next),\n              [s.digest]: next.digest,\n              [s.issuedAt]: s.encodeInstant(next.issuedAt),\n              [s.expiresAt]: s.encodeInstant(next.expiresAt),\n              [s.absoluteExpiresAt]: s.encodeInstant(next.absoluteExpiresAt),\n              [s.securityRevision]: next.securityRevision,\n            };\n\n            yield* pending.stage(\n              sql`${table.update(values)} where ${yield* records.owner(original.record)} and ${records.live(table)} and ${authority}`,\n              1,\n            );\n            replacementCondition = sql`exists(select 1 from ${table.name} where ${yield* records.owner(next)} and ${records.encodedCondition(values)} and ${records.live(table)})`;\n            replacementRecord = next;\n          } else if (\n            replacement._tag === \"StateAssistedSigned\" &&\n            mapping.source.kind === \"StateAssistedSigned\"\n          ) {\n            const t = mapping.source.tombstone,\n              table = tables(t.table),\n              session = yield* mapping.source.sessionId.toNative(intent.sourceSessionId);\n\n            const values = {\n              ...t.encodeInsert({\n                moduleId: mapping.moduleId,\n                subjectId: current.native,\n                sessionId: session,\n                absoluteExpiresAt: intent.sourceAbsoluteExpiresAt,\n              }),\n              [t.moduleId]: mapping.moduleId,\n              [t.subjectId]: current.native,\n              [t.sessionId]: session,\n              [t.absoluteExpiresAt]: t.encodeInstant(intent.sourceAbsoluteExpiresAt),\n            };\n\n            yield* pending.stage(\n              conditionalInsert(table, values, sql`${authority} and ${original.condition}`),\n              1,\n            );\n            replacementCondition = sql`exists(select 1 from ${table.name} where ${state.exact(table, t.moduleId, mapping.moduleId)} and ${state.id(table, t.subjectId, current.native)} and ${state.id(table, t.sessionId, session)} and ${tables.expression(mapping.clock.toMillis(table.column(t.absoluteExpiresAt)))} >= ${DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt)})`;\n          } else if (\n            replacement._tag !== \"StatelessSigned\" ||\n            mapping.source.kind !== \"StatelessSigned\"\n          )\n            return yield* SessionStepUpInvalid.make({});\n          yield* final(\n            \"session-step-up-completion\",\n            sql`${authority} and ${pending.consumedCondition(\"StepUp\", intent, current.native)} and ${replacementCondition}`,\n          );\n          if (batch === undefined && Option.isSome(external))\n            yield* registerSqlPostcondition({\n              name: \"session-step-up-current-policy\",\n              check: Effect.gen(function* () {\n                const actual = yield* state.read(intent.revision.subjectId);\n\n                sessionInvariant(\n                  actual !== undefined && sameSessionRevision(actual.revision, evidence.revision),\n                );\n                yield* sessionEvidenceDeadline(evidence, actual.requirement, actual.now);\n                yield* sessionEvidenceDeadline(evidence, intent.requirement, actual.now);\n                if (replacementRecord !== undefined && records !== undefined) {\n                  const row = yield* records.read(replacementRecord.digest);\n\n                  sessionInvariant(row !== undefined && sameSessionRecord(row, replacementRecord));\n                }\n              }).pipe(\n                Effect.mapError((cause) =>\n                  PersistenceMappingError.make({ operation: \"decode\", cause }),\n                ),\n              ),\n            });\n\n          return yield* prepareNativeSession(replacement.inspection, project);\n        }),\n      ),\n  };\n\n  return { sessionStepUpPersistence };\n});\n"],"mappings":";;;;;;;;;;;;;;AA4DA,MAAM,gBAAgB,OAAO,WAAW,OAAO,eAAe,gBAAgB,OAAO,SAAS,CAAC;AAE/F,MAAa,kCAAkC,OAAO,WAAW,WAC/D,QACA,SAKA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,EACJ,OACA,SACA,MAAM,gBACJ,OAAO,+BAA+B,QAAQ,SAAS,UAAU,KAAA,CAAS;CAE9E,MAAM,oBAAoB,OAAO,yBAAyB;CAE1D,MAAM,UACJ,QAAQ,OAAO,SAAS,aACpB,OAAO,yBAAyB,QAAQ;EAAE,GAAG;EAAS,GAAG,QAAQ;CAAO,CAAC,IACzE,KAAA;CAEN,MAAM,WAAW,OAAO,sBAAsB,kBAAkB,GAC9D,WAAW,OAAO,OAAO,cAAc,gBAAgB;CAEzD,MAAM,EAAE,KAAK,QAAQ;CAErB,MAAM,UACJ,MACA,OAAoC,kBAEpC,UAAU,KAAA,IACN,SAAS,UAAU,0BAA0B,IAAI,GAAG,IAAI,IACxD,SACG,eAAe,0BAA0B,IAAI,CAAC,CAAC,CAC/C,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CAE1D,MAAM,SAAS,OAAO,WAAW,WAAW,QAA8B;EACxE,MAAM,SAAS,OAAO,mBAAmB,OAAO,QAAQ;EAExD,iBACE,OAAO,WAAW,OAAO,UACvB,OAAO,YAAY,OAAO,WAC1B,OAAO,WAAW,OAAO,UACzB,OAAO,kBAAkB,OAAO,iBAChC,OAAO,SAAS,cAAc,OAAO,aACrC,SAAS,cAAc,OAAO,SAAS,MAAM,OAAO,mBACpD,OAAO,iBAAiB,OAAO,YACnC;EAEA,OAAO;CACT,CAAC;CAED,MAAM,SAAS,OAAO,WAAW,WAC/B,QACA,SACA;EACA,IAAI,CAAC,iBAAiB,QAAQ,QAAQ,OAAO,MAAM,SAAS,WAAW,OAAO,CAAC,GAC7E,OAAO,KAAA;EACT,MAAM,UAAU,OAAO,QAAQ,UAAU,SAAS,OAAO,SAAS,SAAS;EAE3E,IAAI,QAAQ,OAAO,SAAS,YAAY;GACtC,iBAAiB,YAAY,KAAA,CAAS;GAEtC,MAAM,gBAAgB,OAAO,QAAQ,OAAO,UAAU,SAAS,OAAO,eAAe,GACnF,EAAE,GAAG,UAAU;GAEjB,MAAM,OACJ,OAAO,GAAG,UAAU,MAAM,OAAO,SAAS,EAAE,QAAQ,MAAM,KAAK,SAAS,MAAM,GAAG,OAAO,EAAE,WAAW,OAAO,EAAE,OAAO,MAAM,GAAG,OAAO,EAAE,WAAW,aAAa,EAAE,OAAO,QAAQ,KAAK,KAAK,EAAE;GAE9L,iBAAiB,KAAK,UAAU,CAAC;GACjC,IAAI,KAAK,OAAO,KAAA,GAAW,OAAO,KAAA;GAClC,MAAM,SAAS,OAAO,QAAQ,OAAO,MAAM,OAAO,KAAK,IAAI,SAAS,CAAC;GAErE,IACE,OAAO,sBAAsB,OAAO,2BACpC,OAAO,cAAc,OAAO,SAAS,aACrC,OAAO,cAAc,OAAO,mBAC5B,OAAO,qBAAqB,OAAO,SAAS,oBAC5C,SAAS,cAAc,OAAO,UAAU,eAAe,MACrD,SAAS,cAAc,OAAO,qBAAqB,KACrD,SAAS,cAAc,OAAO,SAAS,MACrC,SAAS,cAAc,OAAO,eAAe,KAC/C,SAAS,cAAc,OAAO,iBAAiB,MAC7C,SAAS,cAAc,OAAO,uBAAuB,GAEvD,OAAO,KAAA;GAET,OAAO;IACL;IACA,WAAW,GAAG,wBAAwB,MAAM,KAAK,SAAS,OAAO,QAAQ,MAAM,MAAM,EAAE,OAAO,QAAQ,KAAK,KAAK,EAAE;GACpH;EACF;EACA,IAAI,QAAQ,OAAO,SAAS,uBAAuB;GACjD,MAAM,IAAI,QAAQ,OAAO,WACvB,QAAQ,OAAO,EAAE,KAAK,GACtB,UAAU,OAAO,QAAQ,OAAO,UAAU,SAAS,OAAO,eAAe;GAE3E,MAAM,YAAY,GAAG,4BAA4B,MAAM,KAAK,SAAS,MAAM,MAAM,OAAO,EAAE,UAAU,QAAQ,QAAQ,EAAE,OAAO,MAAM,GAAG,OAAO,EAAE,WAAW,OAAO,EAAE,OAAO,MAAM,GAAG,OAAO,EAAE,WAAW,OAAO,EAAE;GAEhN,KAAK,OAAO,GAAG,kBAAkB,YAAA,CAAa,WAAW,GAAG,OAAO,KAAA;GAEnE,OAAO;IAAE,QAAQ,KAAA;IAAW;GAAU;EACxC;EAEA,OAAO;GAAE,QAAQ,KAAA;GAAW,WAAW,GAAG;EAAQ;CACpD,CAAC;CAED,MAAM,QAAQ,OAAO,WAAW,WAAW,MAAc,WAAqB;EAC5E,IAAI,UAAU,KAAA,GACZ,OAAO,8BAA8B;GAAE;GAAM,WAAW,kBAAkB,KAAK,SAAS;EAAE,CAAC;OACxF,IAAI,OAAO,OAAO,QAAQ,GAC7B,OAAO,yBAAyB;GAC9B;GACA,OAAO,OAAO,IAAI,aAAa;IAC7B,kBAAkB,OAAO,GAAG,kBAAkB,YAAA,CAAa,WAAW,CAAC;GACzE,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,UAAU,wBAAwB,KAAK;IAAE,WAAW;IAAU;GAAM,CAAC,CAAC,CACzF;EACF,CAAC;CACL,CAAC;CAED,MAAM,qBAAqB,QAA6B,aACtD,IAAI,IAAI;EACN,MAAM,MAAM,QAAQ,OAAO,QAAQ,EAAE,UAAU,QAAQ;EACvD,GAAG,GAAG,OAAO,WAAW,QAAQ,MAAM,SAAS,QAAQ,MAAM,OAAO,QAAQ,EAAE,SAAS,CAAC,CAAC,EAAE,KAAK,SAAS,cAAc,OAAO,SAAS;EACvI,GAAG,GAAG,QAAQ,MAAM,OAAO,QAAQ,EAAE,YAAY,EAAE,KAAK,QAAQ,MAAM,MAAM,QAAQ,EAAE,cAAc,OAAO,YAAY;CACzH,CAAC;CAkQH,OAAO,EAAE,0BAAA;EA/PP,SAAS,OAAO,MAAM,YACpB,OACE,OAAO,IAAI,aAAa;GACtB,MAAM,UAAU,OAAO,MAAM,KAAK,MAAM,SAAS,WAAW,IAAI;GAEhE,IAAI,YAAY,KAAA,KAAa,CAAC,oBAAoB,QAAQ,UAAU,MAAM,QAAQ,GAChF,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;GAC3C,MAAM,WAAW,OAAO,OAAO,OAAO,QAAQ,GAAG;GAEjD,IAAI,aAAa,KAAA,GAAW,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;GAErE,MAAM,UAAU,OAAO,qBACrB,eACA,QAAQ,QAAQ,iBAChB,QAAQ,QAAQ,mBAClB;GAEA,MAAM,SAAS;IAAE,GAAG;IAAO;GAAQ,GACjC,WAAW,OAAO,mBAAmB,MAAM;GAE7C,MAAM,YAAY,GAAG,GAAG,MAAM,mBAAmB,OAAO,UAAU,QAAQ,MAAM,EAAE,OAAO,MAAM,gBAAgB,QAAQ,KAAK,QAAQ,MAAM,EAAE,OAAO,SAAS,UAAU,OAAO,IAAI,MAAM,SAAS,cAAc,OAAO,qBAAqB,EAAE,OAAO,IAAI,KAAK,SAAS,cAAc,OAAO,SAAS;GAEnS,OAAO,QACJ,OACC;IACE,UAAU,QAAQ;IAClB,MAAM;IACN,QAAQ,OAAO;IACf;IACA,QAAQ,OAAO;IACf,WAAW,QAAQ;IACnB,eAAe,OAAO;IACtB;IACA,WAAW,OAAO;IAClB,cAAc,OAAO;GACvB,GACA,SACF,CAAC,CACA,KACC,OAAO,UAAU,UACf,2BAA2B,QAAQ,sBAAsB,KAAK,IAC1D,gBAAgB,KAAK,CAAC,CAAC,IACvB,KACN,CACF;GACF,OAAO,MACL,4BACA,GAAG,GAAG,UAAU,4BAA4B,QAAQ,MAAM,KAAK,SAAS,QAAQ,UAAU,QAAQ,OAAO,UAAU,OAAO,MAAM,EAAE,OAAO,MAAM,MAAM,QAAQ,OAAO,QAAQ,EAAE,SAAS,OAAO,EAAE,OAAO,kBAAkB,QAAQ,QAAQ,EAAE,EAC7O;GAEA,OAAO,OAAO,qBAAqB,QAAQ,OAAO;EACpD,CAAC,CACH;EACF,OAAO,EAAE,aACP,SACG,KACC,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,OAAO,YAAY,UAAU,MAAM;GAEpD,IAAI,aAAa,KAAA,GAAW,OAAO,KAAA;GAEnC,MAAM,SAAS,OAAO,OAAO,SAAS,MAAM,GAC1C,UAAU,SAAS;GAErB,IACE,CAAC,oBAAoB,QAAQ,UAAU,OAAO,QAAQ,KACtD,CAAC,iBAAiB,QAAQ,QAAQ,OAAO,MAAM,SAAS,WAAW,QAAQ,GAAG,CAAC,GAE/E,OAAO,KAAA;GAIT,OAAO;IAAE;IAAQ,aAAa,QAAQ;GAAY;EACpD,CAAC,CACH,CAAC,CACA,KACC,OAAO,SAAS,UACd,UAAU,KAAA,IACN,OAAO,KAAK,qBAAqB,KAAK,CAAC,CAAC,CAAC,IACzC,OAAO,QAAQ,KAAK,CAC1B,CACF;EACJ,SAAS,EAAE,UAAU,YACnB,OACE,OAAO,IAAI,aAAa;GACtB,OAAO,QAAQ,OAAO,UAAU,MAAM;GAEtC,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAY,OAAO;EAC3E,CAAC,GACD,WACF;EACF,WAAW,MAAM,YACf,OACE,OAAO,IAAI,aAAa;GACtB,OAAO,mBAAmB,IAAI;GAC9B,MAAM,EAAE,QAAQ,UAAU,gBAAgB;GAC1C,MAAM,UAAU,OAAO,MAAM,KAAK,OAAO,SAAS,WAAW,IAAI;GAEjE,IACE,YAAY,KAAA,KACZ,CAAC,oBAAoB,QAAQ,UAAU,SAAS,QAAQ,KACxD,CAAC,oBAAoB,QAAQ,UAAU,OAAO,QAAQ,GAEtD,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;GAC3C,MAAM,WAAW,OAAO,OAAO,QAAQ,QAAQ,GAAG;GAElD,IAAI,aAAa,KAAA,GAAW,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;GACtE,IAAI,KAAK,OAAO,MAAM,SAAS,YAE3B;QAAA,SAAS,WAAW,KAAA,KACpB,SAAS,OAAO,WAAW,KAAK,OAAO,MAAM,UAC7C,CAAC,kBAAkB,SAAS,QAAQ;KAClC,GAAG,KAAK,OAAO,WAAW;KAC1B,YAAY,KAAK,OAAO,WAAW;KACnC,mBAAmB,KAAK,OAAO,WAAW;KAC1C,QAAQ,KAAK,OAAO,MAAM;IAC5B,CAAC,GAED,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;GAAA;GAG9C,MAAM,OAAO,OAAO,wBAAwB,UAAU,QAAQ,aAAa,QAAQ,GAAG,GACpF,UAAU,OAAO,wBAAwB,UAAU,OAAO,aAAa,QAAQ,GAAG;GAEpF,IACE,cACE,wBAAwB,KAAK;IAC3B,GAAG,KAAK,SAAS;IACjB,iBAAiB,QAAQ,SAAS,UAAU;GAC9C,CAAC,CACH,MAAM,cAAc,YAAY,WAAW,QAAQ,SAAS,GAE5D,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;GAE5C,MAAM,WAAW,KAAK,IACpB,KAAK,YACL,QAAQ,YACR,SAAS,cAAc,OAAO,SAAS,GACvC,SAAS,cAAc,YAAY,WAAW,QAAQ,SAAS,CACjE;GAEA,IACE,QAAQ,OAAO,YACf,SAAS,cAAc,YAAY,WAAW,QAAQ,QAAQ,IAAI,QAAQ,OAC1E,SAAS,cAAc,YAAY,WAAW,QAAQ,SAAS,IAC7D,SAAS,cAAc,OAAO,uBAAuB,GAEvD,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;GAC5C,MAAM,WAAW,OAAO,mBAAmB,MAAM;GACjD,MAAM,YAAY,GAAG,GAAG,MAAM,mBAAmB,SAAS,UAAU,QAAQ,MAAM,EAAE,OAAO,MAAM,gBAAgB,QAAQ,KAAK,QAAQ,MAAM,EAAE,OAAO,IAAI,MAAM,QAAQ,IAAI,OAAO,IAAI,KAAK;GAE3L,OAAO,QAAQ,QACb,UACA,QACA,QAAQ,QACR,GAAG,GAAG,kBAAkB,QAAQ,QAAQ,EAAE,OAAO,UAAU,OAAO,SAAS,WAC7E;GACA,IAAI,uBAAiC,GAAG;GACxC,IAAI;GAEJ,IAAI,YAAY,SAAS,cAAc,QAAQ,OAAO,SAAS,YAAY;IACzE,iBAAiB,YAAY,KAAA,KAAa,SAAS,WAAW,KAAA,CAAS;IAEvE,MAAM,OAAsC;KAC1C,GAAG,YAAY,WAAW;KAC1B,QAAQ,YAAY;KACpB,mBAAmB,YAAY,WAAW;KAC1C,YAAY,YAAY,WAAW;IACrC;IAEA,IACE,KAAK,WAAW,SAAS,OAAO,UAChC,KAAK,sBAAsB,SAAS,OAAO,mBAE3C,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;IAC5C,MAAM,EAAE,GAAG,UAAU;IAErB,MAAM,SAAS;KACb,GAAG,EAAE,eAAe,IAAI;MACvB,EAAE,SAAS,KAAK;MAChB,EAAE,WAAW,EAAE,cAAc,KAAK,QAAQ;MAC1C,EAAE,YAAY,EAAE,cAAc,KAAK,SAAS;MAC5C,EAAE,oBAAoB,EAAE,cAAc,KAAK,iBAAiB;MAC5D,EAAE,mBAAmB,KAAK;IAC7B;IAEA,OAAO,QAAQ,MACb,GAAG,GAAG,MAAM,OAAO,MAAM,EAAE,SAAS,OAAO,QAAQ,MAAM,SAAS,MAAM,EAAE,OAAO,QAAQ,KAAK,KAAK,EAAE,OAAO,aAC5G,CACF;IACA,uBAAuB,GAAG,wBAAwB,MAAM,KAAK,SAAS,OAAO,QAAQ,MAAM,IAAI,EAAE,OAAO,QAAQ,iBAAiB,MAAM,EAAE,OAAO,QAAQ,KAAK,KAAK,EAAE;IACpK,oBAAoB;GACtB,OAAO,IACL,YAAY,SAAS,yBACrB,QAAQ,OAAO,SAAS,uBACxB;IACA,MAAM,IAAI,QAAQ,OAAO,WACvB,QAAQ,OAAO,EAAE,KAAK,GACtB,UAAU,OAAO,QAAQ,OAAO,UAAU,SAAS,OAAO,eAAe;IAE3E,MAAM,SAAS;KACb,GAAG,EAAE,aAAa;MAChB,UAAU,QAAQ;MAClB,WAAW,QAAQ;MACnB,WAAW;MACX,mBAAmB,OAAO;KAC5B,CAAC;MACA,EAAE,WAAW,QAAQ;MACrB,EAAE,YAAY,QAAQ;MACtB,EAAE,YAAY;MACd,EAAE,oBAAoB,EAAE,cAAc,OAAO,uBAAuB;IACvE;IAEA,OAAO,QAAQ,MACb,kBAAkB,OAAO,QAAQ,GAAG,GAAG,UAAU,OAAO,SAAS,WAAW,GAC5E,CACF;IACA,uBAAuB,GAAG,wBAAwB,MAAM,KAAK,SAAS,MAAM,MAAM,OAAO,EAAE,UAAU,QAAQ,QAAQ,EAAE,OAAO,MAAM,GAAG,OAAO,EAAE,WAAW,QAAQ,MAAM,EAAE,OAAO,MAAM,GAAG,OAAO,EAAE,WAAW,OAAO,EAAE,OAAO,OAAO,WAAW,QAAQ,MAAM,SAAS,MAAM,OAAO,EAAE,iBAAiB,CAAC,CAAC,EAAE,MAAM,SAAS,cAAc,OAAO,uBAAuB,EAAE;GAC3W,OAAO,IACL,YAAY,SAAS,qBACrB,QAAQ,OAAO,SAAS,mBAExB,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;GAC5C,OAAO,MACL,8BACA,GAAG,GAAG,UAAU,OAAO,QAAQ,kBAAkB,UAAU,QAAQ,QAAQ,MAAM,EAAE,OAAO,sBAC5F;GACA,IAAI,UAAU,KAAA,KAAa,OAAO,OAAO,QAAQ,GAC/C,OAAO,yBAAyB;IAC9B,MAAM;IACN,OAAO,OAAO,IAAI,aAAa;KAC7B,MAAM,SAAS,OAAO,MAAM,KAAK,OAAO,SAAS,SAAS;KAE1D,iBACE,WAAW,KAAA,KAAa,oBAAoB,OAAO,UAAU,SAAS,QAAQ,CAChF;KACA,OAAO,wBAAwB,UAAU,OAAO,aAAa,OAAO,GAAG;KACvE,OAAO,wBAAwB,UAAU,OAAO,aAAa,OAAO,GAAG;KACvE,IAAI,sBAAsB,KAAA,KAAa,YAAY,KAAA,GAAW;MAC5D,MAAM,MAAM,OAAO,QAAQ,KAAK,kBAAkB,MAAM;MAExD,iBAAiB,QAAQ,KAAA,KAAa,kBAAkB,KAAK,iBAAiB,CAAC;KACjF;IACF,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,UACf,wBAAwB,KAAK;KAAE,WAAW;KAAU;IAAM,CAAC,CAC7D,CACF;GACF,CAAC;GAEH,OAAO,OAAO,qBAAqB,YAAY,YAAY,OAAO;EACpE,CAAC,CACH;CAG4B,EAAE;AACpC,CAAC"}

package/dist/internal/session-native-validity.d.mts

@@ -0,0 +1,15 @@
+import { AnyTableModel } from "./table-model.mjs";
+import { SignedSessionValidityMapping } from "./models/session-model.mjs";
+import { NativeSqlTables } from "./native-sql-table.mjs";
+import { SqlBatchCommit } from "./sql-commit.mjs";
+import { Effect } from "effect";
+import { LifecycleHooks } from "@yielded/auth/Hooks";
+import { SignedSessionValidity } from "@yielded/auth/Sessions";
+import { SqlClient } from "effect/sql/SqlClient";
+//#region src/internal/session-native-validity.d.ts
+export type NativeSignedSessionValidityMapping = SignedSessionValidityMapping<AnyTableModel, AnyTableModel, unknown, unknown>;
+export declare const makeNativeSignedSessionValidityServices: (tables: NativeSqlTables, mapping: NativeSignedSessionValidityMapping) => Effect.Effect<{
+  readonly signedSessionValidity: SignedSessionValidity;
+}, never, LifecycleHooks | SqlBatchCommit | SqlClient>;
+//#endregion
+//# sourceMappingURL=session-native-validity.d.mts.map

package/dist/internal/session-native-validity.mjs

@@ -0,0 +1,97 @@
+import { PersistenceMappingError } from "./mapping-error.mjs";
+import { sqlBatchAssertion } from "./d1-planning.mjs";
+import { exactSqlText, executeSqlChange } from "./sql-change.mjs";
+import { CurrentSqlCommit, SqlBatchCommit, appendSqlBatchStatement, makeSqlCommitExecutor, registerSqlBatchPostcondition, registerSqlPostcondition } from "./sql-commit.mjs";
+import { normalizeSessionOperation, sessionInvariant, sessionUnavailable } from "./session-native-state.mjs";
+import { prepareNativeSession } from "./session-native-pending.mjs";
+import { allocateSessionValue } from "./session-policy.mjs";
+import { DateTime, Effect, Option } from "effect";
+import { SessionInvalid, StaleAuthentication } from "@yielded/auth/Sessions";
+import { SqlClient } from "effect/sql/SqlClient";
+//#region src/internal/session-native-validity.ts
+const makeNativeSignedSessionValidityServices = Effect.fnUntraced(function* (tables, mapping) {
+	const batch = yield* SqlBatchCommit;
+	const sql = (yield* SqlClient).withoutTransforms(), executor = yield* makeSqlCommitExecutor(sessionUnavailable);
+	const external = yield* Effect.serviceOption(CurrentSqlCommit);
+	const s = mapping.subject, t = mapping.tombstone, subject = tables(s.table), tombstone = tables(t.table), now = tables.expression(mapping.clock.engineNowMillis);
+	const id = (table, key, value) => sql`${table.column(key)} = ${table.value(key, value)}`;
+	const exact = (table, key, value) => exactSqlText(sql, table.column(key), table.value(key, value));
+	const key = (nativeSubject, nativeSession) => sql.and([
+		exact(tombstone, t.moduleId, mapping.moduleId),
+		id(tombstone, t.subjectId, nativeSubject),
+		id(tombstone, t.sessionId, nativeSession)
+	]);
+	const native = (work) => batch === void 0 ? executor.operation(normalizeSessionOperation(work), "statement") : executor.operationBatch(normalizeSessionOperation(work)).pipe(Effect.provideService(SqlBatchCommit, batch));
+	const stage = Effect.fnUntraced(function* (statement, expected) {
+		if (batch !== void 0) {
+			yield* appendSqlBatchStatement(sql`${statement}`);
+			if (expected !== void 0) yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = ${expected}`));
+			return expected;
+		}
+		return yield* executeSqlChange(sql, statement);
+	});
+	const final = Effect.fnUntraced(function* (name, condition) {
+		if (batch !== void 0) yield* registerSqlBatchPostcondition({
+			name,
+			statement: sqlBatchAssertion(sql, condition)
+		});
+		else if (Option.isSome(external)) yield* registerSqlPostcondition({
+			name,
+			check: Effect.gen(function* () {
+				sessionInvariant((yield* sql`select 1 where ${condition}`).length === 1);
+			}).pipe(Effect.mapError((cause) => PersistenceMappingError.make({
+				operation: "decode",
+				cause
+			})))
+		});
+	});
+	return { signedSessionValidity: {
+		verify: (record) => executor.verify(Effect.gen(function* () {
+			const nativeSubject = yield* mapping.subjectId.toNative(record.subjectId), nativeSession = yield* mapping.sessionId.toNative(record.sessionId);
+			const rows = yield* sql`select ${subject.fields("subject_")} from ${subject.name} where ${id(subject, s.id, nativeSubject)} and ${id(subject, s.status, s.activeStatusValue)} and ${exact(subject, s.securityRevision, record.securityRevision)} and ${now} >= ${DateTime.toEpochMillis(record.issuedAt)} and ${now} < ${DateTime.toEpochMillis(record.expiresAt)} and ${DateTime.toEpochMillis(record.expiresAt)} <= ${DateTime.toEpochMillis(record.absoluteExpiresAt)} and not exists(select 1 from ${tombstone.name} where ${key(nativeSubject, nativeSession)}) limit 2`;
+			sessionInvariant(rows.length <= 1);
+			if (rows[0] === void 0) return false;
+			const decoded = subject.decode(rows[0], "subject_");
+			sessionInvariant((yield* mapping.subjectId.toSubject(decoded[s.id])) === record.subjectId && s.isActiveStatus(decoded[s.status]));
+			return true;
+		})).pipe(Effect.flatMap((valid) => valid ? Effect.void : Effect.fail(SessionInvalid.make({})))),
+		revoke: (input, project) => native(Effect.gen(function* () {
+			const nativeSubject = yield* mapping.subjectId.toNative(input.subjectId), nativeSession = yield* mapping.sessionId.toNative(input.sessionId);
+			const row = {
+				...t.encodeInsert({
+					moduleId: mapping.moduleId,
+					subjectId: nativeSubject,
+					sessionId: nativeSession,
+					absoluteExpiresAt: input.absoluteExpiresAt
+				}),
+				[t.moduleId]: mapping.moduleId,
+				[t.subjectId]: nativeSubject,
+				[t.sessionId]: nativeSession,
+				[t.absoluteExpiresAt]: t.encodeInstant(input.absoluteExpiresAt)
+			};
+			const expiry = tables.expression(mapping.clock.toMillis(tombstone.column(t.absoluteExpiresAt)));
+			const next = DateTime.toEpochMillis(input.absoluteExpiresAt);
+			const longest = sql`case when ${expiry} >= ${next} then ${tombstone.column(t.absoluteExpiresAt)} else ${tombstone.value(t.absoluteExpiresAt, row[t.absoluteExpiresAt])} end`;
+			const insert = tombstone.insert(row);
+			const statement = sql.onDialectOrElse({
+				mysql: () => sql`${insert} on duplicate key update ${tombstone.columnName(t.absoluteExpiresAt)} = ${longest}`,
+				orElse: () => sql`${insert} on conflict (${tombstone.columnName(t.moduleId)}, ${tombstone.columnName(t.subjectId)}, ${tombstone.columnName(t.sessionId)}) do update set ${tombstone.columnName(t.absoluteExpiresAt)} = ${longest}`
+			});
+			yield* stage(statement);
+			yield* final("assisted-session-revocation", sql`exists(select 1 from ${tombstone.name} where ${key(nativeSubject, nativeSession)} and ${expiry} >= ${next})`);
+			return yield* prepareNativeSession(void 0, project);
+		})),
+		revokeAll: (input, project) => native(Effect.gen(function* () {
+			const nativeSubject = yield* mapping.subjectId.toNative(input.subjectId);
+			const next = yield* allocateSessionValue("interactive", s.nextSecurityRevision?.(input.expectedSecurityRevision), s.nextSecurityRevisionSync === void 0 ? void 0 : () => s.nextSecurityRevisionSync(input.expectedSecurityRevision));
+			sessionInvariant(next !== input.expectedSecurityRevision);
+			if ((yield* stage(sql`${subject.update({ [s.securityRevision]: next })} where ${id(subject, s.id, nativeSubject)} and ${id(subject, s.status, s.activeStatusValue)} and ${exact(subject, s.securityRevision, input.expectedSecurityRevision)}`, 1)) !== 1) return yield* StaleAuthentication.make({});
+			yield* final("all-assisted-session-revocation", sql`exists(select 1 from ${subject.name} where ${id(subject, s.id, nativeSubject)} and ${exact(subject, s.securityRevision, next)})`);
+			return yield* prepareNativeSession(void 0, project);
+		}))
+	} };
+});
+//#endregion
+export { makeNativeSignedSessionValidityServices };
+
+//# sourceMappingURL=session-native-validity.mjs.map

package/dist/internal/session-native-validity.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-native-validity.mjs","names":[],"sources":["../../src/internal/session-native-validity.ts"],"sourcesContent":["import type { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport {\n  SessionInvalid,\n  StaleAuthentication,\n  type SignedSessionValidity,\n} from \"@yielded/auth/Sessions\";\nimport { DateTime, Effect, Option } from \"effect\";\nimport { SqlClient } from \"effect/sql/SqlClient\";\nimport type { Fragment } from \"effect/sql/Statement\";\n\nimport { sqlBatchAssertion } from \"./d1-planning\";\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport type { SignedSessionValidityMapping } from \"./models/session-model\";\nimport type { NativeSqlTables, SqlTable } from \"./native-sql-table\";\nimport { prepareNativeSession } from \"./session-native-pending\";\nimport {\n  normalizeSessionOperation,\n  sessionInvariant,\n  sessionUnavailable,\n} from \"./session-native-state\";\nimport { allocateSessionValue } from \"./session-policy\";\nimport { exactSqlText, executeSqlChange } from \"./sql-change\";\nimport {\n  CurrentSqlCommit,\n  makeSqlCommitExecutor,\n  SqlBatchCommit,\n  appendSqlBatchStatement,\n  registerSqlBatchPostcondition,\n  registerSqlPostcondition,\n} from \"./sql-commit\";\nimport type { AnyTableModel } from \"./table-model\";\n\nexport type NativeSignedSessionValidityMapping = SignedSessionValidityMapping<\n  AnyTableModel,\n  AnyTableModel,\n  unknown,\n  unknown\n>;\n\nexport const makeNativeSignedSessionValidityServices = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: NativeSignedSessionValidityMapping,\n): Effect.fn.Return<\n  { readonly signedSessionValidity: SignedSessionValidity },\n  never,\n  SqlClient | LifecycleHooks | SqlBatchCommit\n> {\n  const batch = yield* SqlBatchCommit;\n\n  const sql = (yield* SqlClient).withoutTransforms(),\n    executor = yield* makeSqlCommitExecutor(sessionUnavailable);\n\n  const external = yield* Effect.serviceOption(CurrentSqlCommit);\n\n  const s = mapping.subject,\n    t = mapping.tombstone,\n    subject = tables(s.table),\n    tombstone = tables(t.table),\n    now = tables.expression(mapping.clock.engineNowMillis);\n\n  const id = (table: SqlTable, key: string, value: unknown) =>\n    sql`${table.column(key)} = ${table.value(key, value)}`;\n\n  const exact = (table: SqlTable, key: string, value: unknown) =>\n    exactSqlText(sql, table.column(key), table.value(key, value));\n\n  const key = (nativeSubject: unknown, nativeSession: unknown) =>\n    sql.and([\n      exact(tombstone, t.moduleId, mapping.moduleId),\n      id(tombstone, t.subjectId, nativeSubject),\n      id(tombstone, t.sessionId, nativeSession),\n    ]);\n\n  const native = <A, E, R>(work: Effect.Effect<A, E, R>) =>\n    batch === undefined\n      ? executor.operation(normalizeSessionOperation(work), \"statement\")\n      : executor\n          .operationBatch(normalizeSessionOperation(work))\n          .pipe(Effect.provideService(SqlBatchCommit, batch));\n\n  const stage = Effect.fnUntraced(function* (statement: Fragment, expected?: number) {\n    if (batch !== undefined) {\n      yield* appendSqlBatchStatement(sql`${statement}`);\n      if (expected !== undefined)\n        yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = ${expected}`));\n\n      return expected;\n    }\n\n    return yield* executeSqlChange(sql, statement);\n  });\n\n  const final = Effect.fnUntraced(function* (name: string, condition: Fragment) {\n    if (batch !== undefined)\n      yield* registerSqlBatchPostcondition({ name, statement: sqlBatchAssertion(sql, condition) });\n    else if (Option.isSome(external))\n      yield* registerSqlPostcondition({\n        name,\n        check: Effect.gen(function* () {\n          sessionInvariant((yield* sql`select 1 where ${condition}`).length === 1);\n        }).pipe(\n          Effect.mapError((cause) => PersistenceMappingError.make({ operation: \"decode\", cause })),\n        ),\n      });\n  });\n\n  const signedSessionValidity: SignedSessionValidity = {\n    verify: (record) =>\n      executor\n        .verify(\n          Effect.gen(function* () {\n            const nativeSubject = yield* mapping.subjectId.toNative(record.subjectId),\n              nativeSession = yield* mapping.sessionId.toNative(record.sessionId);\n\n            const rows =\n              yield* sql`select ${subject.fields(\"subject_\")} from ${subject.name} where ${id(subject, s.id, nativeSubject)} and ${id(subject, s.status, s.activeStatusValue)} and ${exact(subject, s.securityRevision, record.securityRevision)} and ${now} >= ${DateTime.toEpochMillis(record.issuedAt)} and ${now} < ${DateTime.toEpochMillis(record.expiresAt)} and ${DateTime.toEpochMillis(record.expiresAt)} <= ${DateTime.toEpochMillis(record.absoluteExpiresAt)} and not exists(select 1 from ${tombstone.name} where ${key(nativeSubject, nativeSession)}) limit 2`;\n\n            sessionInvariant(rows.length <= 1);\n            if (rows[0] === undefined) return false;\n            const decoded = subject.decode(rows[0], \"subject_\");\n\n            sessionInvariant(\n              (yield* mapping.subjectId.toSubject(decoded[s.id])) === record.subjectId &&\n                s.isActiveStatus(decoded[s.status]),\n            );\n\n            return true;\n          }),\n        )\n        .pipe(\n          Effect.flatMap((valid) => (valid ? Effect.void : Effect.fail(SessionInvalid.make({})))),\n        ),\n    revoke: (input, project) =>\n      native(\n        Effect.gen(function* () {\n          const nativeSubject = yield* mapping.subjectId.toNative(input.subjectId),\n            nativeSession = yield* mapping.sessionId.toNative(input.sessionId);\n\n          const row = {\n            ...t.encodeInsert({\n              moduleId: mapping.moduleId,\n              subjectId: nativeSubject,\n              sessionId: nativeSession,\n              absoluteExpiresAt: input.absoluteExpiresAt,\n            }),\n            [t.moduleId]: mapping.moduleId,\n            [t.subjectId]: nativeSubject,\n            [t.sessionId]: nativeSession,\n            [t.absoluteExpiresAt]: t.encodeInstant(input.absoluteExpiresAt),\n          };\n\n          const expiry = tables.expression(\n            mapping.clock.toMillis(tombstone.column(t.absoluteExpiresAt)),\n          );\n\n          const next = DateTime.toEpochMillis(input.absoluteExpiresAt);\n          const longest = sql`case when ${expiry} >= ${next} then ${tombstone.column(t.absoluteExpiresAt)} else ${tombstone.value(t.absoluteExpiresAt, row[t.absoluteExpiresAt])} end`;\n          const insert = tombstone.insert(row);\n\n          const statement = sql.onDialectOrElse({\n            mysql: () =>\n              sql`${insert} on duplicate key update ${tombstone.columnName(t.absoluteExpiresAt)} = ${longest}`,\n            orElse: () =>\n              sql`${insert} on conflict (${tombstone.columnName(t.moduleId)}, ${tombstone.columnName(t.subjectId)}, ${tombstone.columnName(t.sessionId)}) do update set ${tombstone.columnName(t.absoluteExpiresAt)} = ${longest}`,\n          });\n\n          yield* stage(statement);\n          yield* final(\n            \"assisted-session-revocation\",\n            sql`exists(select 1 from ${tombstone.name} where ${key(nativeSubject, nativeSession)} and ${expiry} >= ${next})`,\n          );\n\n          return yield* prepareNativeSession(undefined, project);\n        }),\n      ),\n    revokeAll: (input, project) =>\n      native(\n        Effect.gen(function* () {\n          const nativeSubject = yield* mapping.subjectId.toNative(input.subjectId);\n\n          const next = yield* allocateSessionValue(\n            \"interactive\",\n            s.nextSecurityRevision?.(input.expectedSecurityRevision),\n            s.nextSecurityRevisionSync === undefined\n              ? undefined\n              : () => s.nextSecurityRevisionSync!(input.expectedSecurityRevision),\n          );\n\n          sessionInvariant(next !== input.expectedSecurityRevision);\n\n          const changed = yield* stage(\n            sql`${subject.update({ [s.securityRevision]: next })} where ${id(subject, s.id, nativeSubject)} and ${id(subject, s.status, s.activeStatusValue)} and ${exact(subject, s.securityRevision, input.expectedSecurityRevision)}`,\n            1,\n          );\n\n          if (changed !== 1) return yield* StaleAuthentication.make({});\n          yield* final(\n            \"all-assisted-session-revocation\",\n            sql`exists(select 1 from ${subject.name} where ${id(subject, s.id, nativeSubject)} and ${exact(subject, s.securityRevision, next)})`,\n          );\n\n          return yield* prepareNativeSession(undefined, project);\n        }),\n      ),\n  };\n\n  return { signedSessionValidity };\n});\n"],"mappings":";;;;;;;;;;;AAuCA,MAAa,0CAA0C,OAAO,WAAW,WACvE,QACA,SAKA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,OAAO,OAAO,UAAA,CAAW,kBAAkB,GAC/C,WAAW,OAAO,sBAAsB,kBAAkB;CAE5D,MAAM,WAAW,OAAO,OAAO,cAAc,gBAAgB;CAE7D,MAAM,IAAI,QAAQ,SAChB,IAAI,QAAQ,WACZ,UAAU,OAAO,EAAE,KAAK,GACxB,YAAY,OAAO,EAAE,KAAK,GAC1B,MAAM,OAAO,WAAW,QAAQ,MAAM,eAAe;CAEvD,MAAM,MAAM,OAAiB,KAAa,UACxC,GAAG,GAAG,MAAM,OAAO,GAAG,EAAE,KAAK,MAAM,MAAM,KAAK,KAAK;CAErD,MAAM,SAAS,OAAiB,KAAa,UAC3C,aAAa,KAAK,MAAM,OAAO,GAAG,GAAG,MAAM,MAAM,KAAK,KAAK,CAAC;CAE9D,MAAM,OAAO,eAAwB,kBACnC,IAAI,IAAI;EACN,MAAM,WAAW,EAAE,UAAU,QAAQ,QAAQ;EAC7C,GAAG,WAAW,EAAE,WAAW,aAAa;EACxC,GAAG,WAAW,EAAE,WAAW,aAAa;CAC1C,CAAC;CAEH,MAAM,UAAmB,SACvB,UAAU,KAAA,IACN,SAAS,UAAU,0BAA0B,IAAI,GAAG,WAAW,IAC/D,SACG,eAAe,0BAA0B,IAAI,CAAC,CAAC,CAC/C,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CAE1D,MAAM,QAAQ,OAAO,WAAW,WAAW,WAAqB,UAAmB;EACjF,IAAI,UAAU,KAAA,GAAW;GACvB,OAAO,wBAAwB,GAAG,GAAG,WAAW;GAChD,IAAI,aAAa,KAAA,GACf,OAAO,wBAAwB,kBAAkB,KAAK,GAAG,eAAe,UAAU,CAAC;GAErF,OAAO;EACT;EAEA,OAAO,OAAO,iBAAiB,KAAK,SAAS;CAC/C,CAAC;CAED,MAAM,QAAQ,OAAO,WAAW,WAAW,MAAc,WAAqB;EAC5E,IAAI,UAAU,KAAA,GACZ,OAAO,8BAA8B;GAAE;GAAM,WAAW,kBAAkB,KAAK,SAAS;EAAE,CAAC;OACxF,IAAI,OAAO,OAAO,QAAQ,GAC7B,OAAO,yBAAyB;GAC9B;GACA,OAAO,OAAO,IAAI,aAAa;IAC7B,kBAAkB,OAAO,GAAG,kBAAkB,YAAA,CAAa,WAAW,CAAC;GACzE,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,UAAU,wBAAwB,KAAK;IAAE,WAAW;IAAU;GAAM,CAAC,CAAC,CACzF;EACF,CAAC;CACL,CAAC;CAsGD,OAAO,EAAE,uBAAA;EAnGP,SAAS,WACP,SACG,OACC,OAAO,IAAI,aAAa;GACtB,MAAM,gBAAgB,OAAO,QAAQ,UAAU,SAAS,OAAO,SAAS,GACtE,gBAAgB,OAAO,QAAQ,UAAU,SAAS,OAAO,SAAS;GAEpE,MAAM,OACJ,OAAO,GAAG,UAAU,QAAQ,OAAO,UAAU,EAAE,QAAQ,QAAQ,KAAK,SAAS,GAAG,SAAS,EAAE,IAAI,aAAa,EAAE,OAAO,GAAG,SAAS,EAAE,QAAQ,EAAE,iBAAiB,EAAE,OAAO,MAAM,SAAS,EAAE,kBAAkB,OAAO,gBAAgB,EAAE,OAAO,IAAI,MAAM,SAAS,cAAc,OAAO,QAAQ,EAAE,OAAO,IAAI,KAAK,SAAS,cAAc,OAAO,SAAS,EAAE,OAAO,SAAS,cAAc,OAAO,SAAS,EAAE,MAAM,SAAS,cAAc,OAAO,iBAAiB,EAAE,gCAAgC,UAAU,KAAK,SAAS,IAAI,eAAe,aAAa,EAAE;GAExhB,iBAAiB,KAAK,UAAU,CAAC;GACjC,IAAI,KAAK,OAAO,KAAA,GAAW,OAAO;GAClC,MAAM,UAAU,QAAQ,OAAO,KAAK,IAAI,UAAU;GAElD,kBACG,OAAO,QAAQ,UAAU,UAAU,QAAQ,EAAE,GAAG,OAAO,OAAO,aAC7D,EAAE,eAAe,QAAQ,EAAE,OAAO,CACtC;GAEA,OAAO;EACT,CAAC,CACH,CAAC,CACA,KACC,OAAO,SAAS,UAAW,QAAQ,OAAO,OAAO,OAAO,KAAK,eAAe,KAAK,CAAC,CAAC,CAAC,CAAE,CACxF;EACJ,SAAS,OAAO,YACd,OACE,OAAO,IAAI,aAAa;GACtB,MAAM,gBAAgB,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS,GACrE,gBAAgB,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;GAEnE,MAAM,MAAM;IACV,GAAG,EAAE,aAAa;KAChB,UAAU,QAAQ;KAClB,WAAW;KACX,WAAW;KACX,mBAAmB,MAAM;IAC3B,CAAC;KACA,EAAE,WAAW,QAAQ;KACrB,EAAE,YAAY;KACd,EAAE,YAAY;KACd,EAAE,oBAAoB,EAAE,cAAc,MAAM,iBAAiB;GAChE;GAEA,MAAM,SAAS,OAAO,WACpB,QAAQ,MAAM,SAAS,UAAU,OAAO,EAAE,iBAAiB,CAAC,CAC9D;GAEA,MAAM,OAAO,SAAS,cAAc,MAAM,iBAAiB;GAC3D,MAAM,UAAU,GAAG,aAAa,OAAO,MAAM,KAAK,QAAQ,UAAU,OAAO,EAAE,iBAAiB,EAAE,QAAQ,UAAU,MAAM,EAAE,mBAAmB,IAAI,EAAE,kBAAkB,EAAE;GACvK,MAAM,SAAS,UAAU,OAAO,GAAG;GAEnC,MAAM,YAAY,IAAI,gBAAgB;IACpC,aACE,GAAG,GAAG,OAAO,2BAA2B,UAAU,WAAW,EAAE,iBAAiB,EAAE,KAAK;IACzF,cACE,GAAG,GAAG,OAAO,gBAAgB,UAAU,WAAW,EAAE,QAAQ,EAAE,IAAI,UAAU,WAAW,EAAE,SAAS,EAAE,IAAI,UAAU,WAAW,EAAE,SAAS,EAAE,kBAAkB,UAAU,WAAW,EAAE,iBAAiB,EAAE,KAAK;GAC/M,CAAC;GAED,OAAO,MAAM,SAAS;GACtB,OAAO,MACL,+BACA,GAAG,wBAAwB,UAAU,KAAK,SAAS,IAAI,eAAe,aAAa,EAAE,OAAO,OAAO,MAAM,KAAK,EAChH;GAEA,OAAO,OAAO,qBAAqB,KAAA,GAAW,OAAO;EACvD,CAAC,CACH;EACF,YAAY,OAAO,YACjB,OACE,OAAO,IAAI,aAAa;GACtB,MAAM,gBAAgB,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;GAEvE,MAAM,OAAO,OAAO,qBAClB,eACA,EAAE,uBAAuB,MAAM,wBAAwB,GACvD,EAAE,6BAA6B,KAAA,IAC3B,KAAA,UACM,EAAE,yBAA0B,MAAM,wBAAwB,CACtE;GAEA,iBAAiB,SAAS,MAAM,wBAAwB;GAOxD,KAAI,OALmB,MACrB,GAAG,GAAG,QAAQ,OAAO,GAAG,EAAE,mBAAmB,KAAK,CAAC,EAAE,SAAS,GAAG,SAAS,EAAE,IAAI,aAAa,EAAE,OAAO,GAAG,SAAS,EAAE,QAAQ,EAAE,iBAAiB,EAAE,OAAO,MAAM,SAAS,EAAE,kBAAkB,MAAM,wBAAwB,KACzN,CACF,OAEgB,GAAG,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;GAC5D,OAAO,MACL,mCACA,GAAG,wBAAwB,QAAQ,KAAK,SAAS,GAAG,SAAS,EAAE,IAAI,aAAa,EAAE,OAAO,MAAM,SAAS,EAAE,kBAAkB,IAAI,EAAE,EACpI;GAEA,OAAO,OAAO,qBAAqB,KAAA,GAAW,OAAO;EACvD,CAAC,CACH;CAGyB,EAAE;AACjC,CAAC"}

package/dist/internal/session-policy.mjs

@@ -0,0 +1,29 @@
+import { PersistenceMappingError } from "./mapping-error.mjs";
+import { DateTime, Effect } from "effect";
+import { SessionUnavailable } from "@yielded/auth/Sessions";
+//#region src/internal/session-policy.ts
+const preservesRevision = (completed, original) => {
+	const current = new Map(completed.revision.credentials.map((item) => [item.credentialId, item.revision]));
+	return completed.flowId === original.flowId && completed.bindingDigest === original.bindingDigest && completed.revision.subjectId === original.revision.subjectId && completed.revision.securityRevision === original.revision.securityRevision && original.revision.credentials.every((item) => current.get(item.credentialId) === item.revision) && original.proofs.every((expected) => completed.proofs.some((proof) => proof.method === expected.method && proof.credentialId === expected.credentialId && proof.userVerified === expected.userVerified && proof.phishingResistant === expected.phishingResistant && DateTime.toEpochMillis(proof.verifiedAt) === DateTime.toEpochMillis(expected.verifiedAt) && proof.factors.length === expected.factors.length && proof.factors.every((factor, index) => factor === expected.factors[index])));
+};
+const allocateSessionValue = (mode, asynchronous, synchronous) => {
+	if (mode === "synchronous") return synchronous === void 0 ? Effect.fail(SessionUnavailable.make({})) : Effect.try({
+		try: synchronous,
+		catch: (cause) => PersistenceMappingError.make({
+			operation: "allocate",
+			cause
+		})
+	});
+	if (asynchronous !== void 0) return asynchronous;
+	return synchronous === void 0 ? Effect.fail(SessionUnavailable.make({})) : Effect.try({
+		try: synchronous,
+		catch: (cause) => PersistenceMappingError.make({
+			operation: "allocate",
+			cause
+		})
+	});
+};
+//#endregion
+export { allocateSessionValue, preservesRevision };
+
+//# sourceMappingURL=session-policy.mjs.map

package/dist/internal/session-policy.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-policy.mjs","names":[],"sources":["../../src/internal/session-policy.ts"],"sourcesContent":["import type { AuthenticationEvidence } from \"@yielded/auth/Sessions\";\nimport { SessionUnavailable } from \"@yielded/auth/Sessions\";\nimport { DateTime, Effect } from \"effect\";\n\nimport { PersistenceMappingError } from \"./mapping-error\";\n\nexport const preservesRevision = (\n  completed: AuthenticationEvidence,\n  original: AuthenticationEvidence,\n): boolean => {\n  const current = new Map(\n    completed.revision.credentials.map((item) => [item.credentialId, item.revision]),\n  );\n\n  return (\n    completed.flowId === original.flowId &&\n    completed.bindingDigest === original.bindingDigest &&\n    completed.revision.subjectId === original.revision.subjectId &&\n    completed.revision.securityRevision === original.revision.securityRevision &&\n    original.revision.credentials.every(\n      (item) => current.get(item.credentialId) === item.revision,\n    ) &&\n    original.proofs.every((expected) =>\n      completed.proofs.some(\n        (proof) =>\n          proof.method === expected.method &&\n          proof.credentialId === expected.credentialId &&\n          proof.userVerified === expected.userVerified &&\n          proof.phishingResistant === expected.phishingResistant &&\n          DateTime.toEpochMillis(proof.verifiedAt) ===\n            DateTime.toEpochMillis(expected.verifiedAt) &&\n          proof.factors.length === expected.factors.length &&\n          proof.factors.every((factor, index) => factor === expected.factors[index]),\n      ),\n    )\n  );\n};\n\nexport const allocateSessionValue = <A>(\n  mode: \"interactive\" | \"synchronous\" | \"batch\",\n  asynchronous: Effect.Effect<A, PersistenceMappingError> | undefined,\n  synchronous: (() => A) | undefined,\n): Effect.Effect<A, PersistenceMappingError | SessionUnavailable> => {\n  if (mode === \"synchronous\")\n    return synchronous === undefined\n      ? Effect.fail(SessionUnavailable.make({}))\n      : Effect.try({\n          try: synchronous,\n          catch: (cause) => PersistenceMappingError.make({ operation: \"allocate\", cause }),\n        });\n  if (asynchronous !== undefined) return asynchronous;\n\n  return synchronous === undefined\n    ? Effect.fail(SessionUnavailable.make({}))\n    : Effect.try({\n        try: synchronous,\n        catch: (cause) => PersistenceMappingError.make({ operation: \"allocate\", cause }),\n      });\n};\n"],"mappings":";;;;AAMA,MAAa,qBACX,WACA,aACY;CACZ,MAAM,UAAU,IAAI,IAClB,UAAU,SAAS,YAAY,KAAK,SAAS,CAAC,KAAK,cAAc,KAAK,QAAQ,CAAC,CACjF;CAEA,OACE,UAAU,WAAW,SAAS,UAC9B,UAAU,kBAAkB,SAAS,iBACrC,UAAU,SAAS,cAAc,SAAS,SAAS,aACnD,UAAU,SAAS,qBAAqB,SAAS,SAAS,oBAC1D,SAAS,SAAS,YAAY,OAC3B,SAAS,QAAQ,IAAI,KAAK,YAAY,MAAM,KAAK,QACpD,KACA,SAAS,OAAO,OAAO,aACrB,UAAU,OAAO,MACd,UACC,MAAM,WAAW,SAAS,UAC1B,MAAM,iBAAiB,SAAS,gBAChC,MAAM,iBAAiB,SAAS,gBAChC,MAAM,sBAAsB,SAAS,qBACrC,SAAS,cAAc,MAAM,UAAU,MACrC,SAAS,cAAc,SAAS,UAAU,KAC5C,MAAM,QAAQ,WAAW,SAAS,QAAQ,UAC1C,MAAM,QAAQ,OAAO,QAAQ,UAAU,WAAW,SAAS,QAAQ,MAAM,CAC7E,CACF;AAEJ;AAEA,MAAa,wBACX,MACA,cACA,gBACmE;CACnE,IAAI,SAAS,eACX,OAAO,gBAAgB,KAAA,IACnB,OAAO,KAAK,mBAAmB,KAAK,CAAC,CAAC,CAAC,IACvC,OAAO,IAAI;EACT,KAAK;EACL,QAAQ,UAAU,wBAAwB,KAAK;GAAE,WAAW;GAAY;EAAM,CAAC;CACjF,CAAC;CACP,IAAI,iBAAiB,KAAA,GAAW,OAAO;CAEvC,OAAO,gBAAgB,KAAA,IACnB,OAAO,KAAK,mBAAmB,KAAK,CAAC,CAAC,CAAC,IACvC,OAAO,IAAI;EACT,KAAK;EACL,QAAQ,UAAU,wBAAwB,KAAK;GAAE,WAAW;GAAY;EAAM,CAAC;CACjF,CAAC;AACP"}

package/dist/internal/sql-authority.d.mts

@@ -0,0 +1,16 @@
+import { SqlExpression } from "./sql-expression.mjs";
+import { AuthenticationAuthorityMapping } from "./models/session-model.mjs";
+import { PersistenceConfigurationError } from "./configuration.mjs";
+import { Table } from "./sql-table.mjs";
+import { SqlTableModel } from "./sql-oauth-model.mjs";
+import { Effect } from "effect";
+import { SqlClient } from "effect/sql";
+import { LifecycleHooks } from "@yielded/auth/Hooks";
+import { AuthenticationAuthority, SessionUnavailable } from "@yielded/auth/Sessions";
+//#region src/internal/sql-authority.d.ts
+/** Direct SQL uses the same authority owner as the mapped Drizzle adapters. */
+export declare const makeAuthenticationAuthorityServices: <Claims, N>(mapping: AuthenticationAuthorityMapping<Claims, SqlTableModel<Table>, SqlTableModel<Table>, SqlTableModel<Table>, N, SqlExpression>) => Effect.Effect<{
+  readonly authenticationAuthority: AuthenticationAuthority["Service"];
+}, PersistenceConfigurationError | SessionUnavailable, LifecycleHooks | SqlClient.SqlClient>;
+//#endregion
+//# sourceMappingURL=sql-authority.d.mts.map

package/dist/internal/sql-authority.mjs

@@ -0,0 +1,32 @@
+import { PersistenceConfigurationError } from "./configuration.mjs";
+import { SqlExpression, compileSqlExpression } from "./sql-expression.mjs";
+import { makeNativeSqlTables } from "./native-sql-table.mjs";
+import { SqlBatchCommit } from "./sql-commit.mjs";
+import { makeNativeAuthenticationAuthorityServices } from "./session-native-authority.mjs";
+import { validateSqlStorage } from "./sql-storage-validation.mjs";
+import { Effect } from "effect";
+import { SqlClient } from "effect/sql";
+import { SessionUnavailable } from "@yielded/auth/Sessions";
+//#region src/internal/sql-authority.ts
+/** Direct SQL uses the same authority owner as the mapped Drizzle adapters. */
+const makeAuthenticationAuthorityServices = Effect.fnUntraced(function* (mapping) {
+	const sql = yield* SqlClient.SqlClient;
+	if (!sql.onDialectOrElse({
+		pg: () => true,
+		sqlite: () => true,
+		orElse: () => false
+	})) return yield* PersistenceConfigurationError.make({ reason: "Authentication authority requires PostgreSQL or SQLite" });
+	yield* validateSqlStorage(mapping).pipe(Effect.mapError(() => SessionUnavailable.make({})));
+	return yield* makeNativeAuthenticationAuthorityServices(makeNativeSqlTables(sql), {
+		...mapping,
+		clock: {
+			...mapping.clock,
+			toMillis: (value) => mapping.clock.toMillis(new SqlExpression((client) => compileSqlExpression(client, value))),
+			fromMillis: (value) => mapping.clock.fromMillis(new SqlExpression((client) => compileSqlExpression(client, value)))
+		}
+	}).pipe(Effect.provideService(SqlBatchCommit, void 0));
+});
+//#endregion
+export { makeAuthenticationAuthorityServices };
+
+//# sourceMappingURL=sql-authority.mjs.map

package/dist/internal/sql-authority.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-authority.mjs","names":[],"sources":["../../src/internal/sql-authority.ts"],"sourcesContent":["import type { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport { SessionUnavailable, type AuthenticationAuthority } from \"@yielded/auth/Sessions\";\nimport { Effect } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\n\nimport { PersistenceConfigurationError } from \"./configuration\";\nimport type { AuthenticationAuthorityMapping } from \"./models/session-model\";\nimport { makeNativeSqlTables } from \"./native-sql-table\";\nimport {\n  makeNativeAuthenticationAuthorityServices,\n  type NativeAuthenticationAuthorityMapping,\n} from \"./session-native-authority\";\nimport { SqlBatchCommit } from \"./sql-commit\";\nimport { SqlExpression, compileSqlExpression } from \"./sql-expression\";\nimport type { SqlTableModel } from \"./sql-oauth-model\";\nimport { validateSqlStorage } from \"./sql-storage-validation\";\n\n/** Direct SQL uses the same authority owner as the mapped Drizzle adapters. */\nexport const makeAuthenticationAuthorityServices = Effect.fnUntraced(function* <Claims, N>(\n  mapping: AuthenticationAuthorityMapping<\n    Claims,\n    SqlTableModel,\n    SqlTableModel,\n    SqlTableModel,\n    N,\n    SqlExpression\n  >,\n): Effect.fn.Return<\n  { readonly authenticationAuthority: AuthenticationAuthority[\"Service\"] },\n  SessionUnavailable | PersistenceConfigurationError,\n  LifecycleHooks | SqlClient.SqlClient\n> {\n  const sql = yield* SqlClient.SqlClient;\n\n  if (!sql.onDialectOrElse({ pg: () => true, sqlite: () => true, orElse: () => false }))\n    return yield* PersistenceConfigurationError.make({\n      reason: \"Authentication authority requires PostgreSQL or SQLite\",\n    });\n  yield* validateSqlStorage(mapping).pipe(Effect.mapError(() => SessionUnavailable.make({})));\n\n  // Erase mapped native ID callback variance, never decoded authentication data.\n  return yield* makeNativeAuthenticationAuthorityServices(makeNativeSqlTables(sql), {\n    ...mapping,\n    clock: {\n      ...mapping.clock,\n      toMillis: (value: unknown) =>\n        mapping.clock.toMillis(new SqlExpression((client) => compileSqlExpression(client, value))),\n      fromMillis: (value: unknown) =>\n        mapping.clock.fromMillis(\n          new SqlExpression((client) => compileSqlExpression(client, value)),\n        ),\n    },\n  } as unknown as NativeAuthenticationAuthorityMapping<Claims>).pipe(\n    Effect.provideService(SqlBatchCommit, undefined),\n  );\n});\n"],"mappings":";;;;;;;;;;;AAkBA,MAAa,sCAAsC,OAAO,WAAW,WACnE,SAYA;CACA,MAAM,MAAM,OAAO,UAAU;CAE7B,IAAI,CAAC,IAAI,gBAAgB;EAAE,UAAU;EAAM,cAAc;EAAM,cAAc;CAAM,CAAC,GAClF,OAAO,OAAO,8BAA8B,KAAK,EAC/C,QAAQ,yDACV,CAAC;CACH,OAAO,mBAAmB,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,mBAAmB,KAAK,CAAC,CAAC,CAAC,CAAC;CAG1F,OAAO,OAAO,0CAA0C,oBAAoB,GAAG,GAAG;EAChF,GAAG;EACH,OAAO;GACL,GAAG,QAAQ;GACX,WAAW,UACT,QAAQ,MAAM,SAAS,IAAI,eAAe,WAAW,qBAAqB,QAAQ,KAAK,CAAC,CAAC;GAC3F,aAAa,UACX,QAAQ,MAAM,WACZ,IAAI,eAAe,WAAW,qBAAqB,QAAQ,KAAK,CAAC,CACnE;EACJ;CACF,CAA4D,CAAC,CAAC,KAC5D,OAAO,eAAe,gBAAgB,KAAA,CAAS,CACjD;AACF,CAAC"}

package/dist/internal/sql-change.mjs

@@ -0,0 +1,21 @@
+import { Effect, Schema } from "effect";
+import { join } from "effect/sql/Statement";
+//#region src/internal/sql-change.ts
+/** Native row counts are the authority for conditional writes. MySQL exposes
+* its result header; PostgreSQL and SQLite return one row for every match. */
+const executeSqlChange = (sql, query) => sql.onDialectOrElse({
+	mysql: () => sql`${query}`.raw.pipe(Effect.flatMap(Schema.decodeUnknownEffect(Schema.Struct({ affectedRows: Schema.Int }))), Effect.map((result) => result.affectedRows)),
+	orElse: () => sql`${query} returning 1 as changed`.pipe(Effect.map((rows) => rows.length))
+});
+/** Effect renders an empty OR as `1=1`; an empty set of alternatives matches nothing. */
+const anySqlCondition = join(" OR ", true, "1 = 0");
+/** Keep the indexed predicate and reject collation aliases of security tokens. */
+const exactSqlText = (sql, left, right) => sql.and([sql`${left} = ${right}`, sql.onDialectOrElse({
+	mysql: () => sql`binary ${left} = binary ${right}`,
+	pg: () => sql`convert_to(cast(${left} as text), 'UTF8') = convert_to(cast(${right} as text), 'UTF8')`,
+	orElse: () => sql`cast(${left} as blob) = cast(${right} as blob)`
+})]);
+//#endregion
+export { anySqlCondition, exactSqlText, executeSqlChange };
+
+//# sourceMappingURL=sql-change.mjs.map

package/dist/internal/sql-change.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-change.mjs","names":[],"sources":["../../src/internal/sql-change.ts"],"sourcesContent":["import { Effect, Schema } from \"effect\";\nimport type { SqlClient } from \"effect/sql/SqlClient\";\nimport type { SqlError } from \"effect/sql/SqlError\";\nimport { join, type Fragment } from \"effect/sql/Statement\";\n\n/** Native row counts are the authority for conditional writes. MySQL exposes\n * its result header; PostgreSQL and SQLite return one row for every match. */\nexport const executeSqlChange = (\n  sql: SqlClient,\n  query: Fragment,\n): Effect.Effect<number, SqlError | Schema.SchemaError> =>\n  sql.onDialectOrElse({\n    mysql: () =>\n      sql`${query}`.raw.pipe(\n        Effect.flatMap(Schema.decodeUnknownEffect(Schema.Struct({ affectedRows: Schema.Int }))),\n        Effect.map((result) => result.affectedRows),\n      ),\n    orElse: () => sql`${query} returning 1 as changed`.pipe(Effect.map((rows) => rows.length)),\n  });\n\n/** Effect renders an empty OR as `1=1`; an empty set of alternatives matches nothing. */\nexport const anySqlCondition: (conditions: ReadonlyArray<Fragment>) => Fragment = join(\n  \" OR \",\n  true,\n  \"1 = 0\",\n);\n\n/** Keep the indexed predicate and reject collation aliases of security tokens. */\nexport const exactSqlText = (sql: SqlClient, left: Fragment, right: Fragment) =>\n  sql.and([\n    sql`${left} = ${right}`,\n    sql.onDialectOrElse({\n      mysql: () => sql`binary ${left} = binary ${right}`,\n      pg: () =>\n        sql`convert_to(cast(${left} as text), 'UTF8') = convert_to(cast(${right} as text), 'UTF8')`,\n      orElse: () => sql`cast(${left} as blob) = cast(${right} as blob)`,\n    }),\n  ]);\n"],"mappings":";;;;;AAOA,MAAa,oBACX,KACA,UAEA,IAAI,gBAAgB;CAClB,aACE,GAAG,GAAG,QAAQ,IAAI,KAChB,OAAO,QAAQ,OAAO,oBAAoB,OAAO,OAAO,EAAE,cAAc,OAAO,IAAI,CAAC,CAAC,CAAC,GACtF,OAAO,KAAK,WAAW,OAAO,YAAY,CAC5C;CACF,cAAc,GAAG,GAAG,MAAM,yBAAyB,KAAK,OAAO,KAAK,SAAS,KAAK,MAAM,CAAC;AAC3F,CAAC;;AAGH,MAAa,kBAAqE,KAChF,QACA,MACA,OACF;;AAGA,MAAa,gBAAgB,KAAgB,MAAgB,UAC3D,IAAI,IAAI,CACN,GAAG,GAAG,KAAK,KAAK,SAChB,IAAI,gBAAgB;CAClB,aAAa,GAAG,UAAU,KAAK,YAAY;CAC3C,UACE,GAAG,mBAAmB,KAAK,uCAAuC,MAAM;CAC1E,cAAc,GAAG,QAAQ,KAAK,mBAAmB,MAAM;AACzD,CAAC,CACH,CAAC"}

package/dist/internal/sql-cleanup.mjs

@@ -0,0 +1,35 @@
+import { sqlBatchAssertion } from "./d1-planning.mjs";
+import { executeSqlChange } from "./sql-change.mjs";
+import { appendSqlBatchStatement } from "./sql-commit.mjs";
+import { Effect, Schema } from "effect";
+import { CleanupLimit, CleanupResult } from "@yielded/auth/Persistence";
+import { SqlClient } from "effect/sql/SqlClient";
+//#region src/internal/sql-cleanup.ts
+const cleanupSqlRows = Effect.fnUntraced(function* (candidates, requested, batch = false) {
+	const limit = yield* Schema.decodeEffect(CleanupLimit)(requested);
+	const sql = (yield* SqlClient).withoutTransforms();
+	let removed = 0;
+	for (const candidate of candidates) {
+		const remaining = limit - removed;
+		if (remaining === 0) break;
+		const { table, keys, due } = candidate;
+		const aliases = keys.map((_, index) => sql.literal(`cleanup_key_${index}`));
+		const selection = sql`select ${sql.join(", ", false)(keys.map((key, index) => sql`${table.column(key)} as ${aliases[index]}`))} from ${table.name} where ${due} order by ${sql.join(", ", false)(candidate.order.length === 0 ? keys.map(table.column) : candidate.order)} limit ${remaining}`;
+		const rowKey = keys.length === 1 ? table.column(keys[0]) : sql`(${sql.join(", ", false)(keys.map(table.column))})`;
+		const deletion = sql`delete from ${table.name} where ${due} and ${rowKey} in (select ${sql.join(", ", false)(aliases)} from (${selection}) as cleanup_candidates)`;
+		if (batch) {
+			const planned = (yield* sql`${selection}`).length;
+			yield* appendSqlBatchStatement(deletion);
+			yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = ${planned}`));
+			removed += planned;
+		} else removed += yield* executeSqlChange(sql, deletion);
+	}
+	return yield* Schema.decodeEffect(CleanupResult)({
+		removed,
+		hasMore: removed === limit
+	});
+});
+//#endregion
+export { cleanupSqlRows };
+
+//# sourceMappingURL=sql-cleanup.mjs.map

package/dist/internal/sql-cleanup.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-cleanup.mjs","names":[],"sources":["../../src/internal/sql-cleanup.ts"],"sourcesContent":["import { CleanupLimit, CleanupResult } from \"@yielded/auth/Persistence\";\nimport { Effect, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql/SqlClient\";\nimport type { Fragment } from \"effect/sql/Statement\";\n\nimport { sqlBatchAssertion } from \"./d1-planning\";\nimport type { SqlTable } from \"./native-sql-table\";\nimport { executeSqlChange } from \"./sql-change\";\nimport { appendSqlBatchStatement } from \"./sql-commit\";\n\n/** A mapped row key and its strategy-owned retention predicate are the entire\n * cleanup authority. All tables share the same remaining row budget. */\nexport interface SqlCleanupTable {\n  readonly table: SqlTable;\n  readonly keys: readonly [string, ...string[]];\n  readonly due: Fragment;\n  readonly order: ReadonlyArray<Fragment>;\n}\n\nexport const cleanupSqlRows = Effect.fnUntraced(function* (\n  candidates: ReadonlyArray<SqlCleanupTable>,\n  requested: CleanupLimit,\n  batch = false,\n) {\n  const limit = yield* Schema.decodeEffect(CleanupLimit)(requested);\n  const sql = (yield* SqlClient).withoutTransforms();\n  let removed = 0;\n\n  for (const candidate of candidates) {\n    const remaining = limit - removed;\n\n    if (remaining === 0) break;\n    const { table, keys, due } = candidate;\n    const aliases = keys.map((_, index) => sql.literal(`cleanup_key_${index}`));\n    const selection = sql`select ${sql.join(\", \", false)(keys.map((key, index) => sql`${table.column(key)} as ${aliases[index]!}`))} from ${table.name} where ${due} order by ${sql.join(\", \", false)(candidate.order.length === 0 ? keys.map(table.column) : candidate.order)} limit ${remaining}`;\n\n    // An uncorrelated IN selection materializes the bounded key set before\n    // deletion, including SQLite's self-table case and composite tombstone keys.\n    const rowKey =\n      keys.length === 1\n        ? table.column(keys[0])\n        : sql`(${sql.join(\", \", false)(keys.map(table.column))})`;\n\n    const deletion = sql`delete from ${table.name} where ${due} and ${rowKey} in (select ${sql.join(\", \", false)(aliases)} from (${selection}) as cleanup_candidates)`;\n\n    if (batch) {\n      const planned = (yield* sql`${selection}`).length;\n\n      yield* appendSqlBatchStatement(deletion);\n      yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = ${planned}`));\n      removed += planned;\n    } else removed += yield* executeSqlChange(sql, deletion);\n  }\n\n  return yield* Schema.decodeEffect(CleanupResult)({ removed, hasMore: removed === limit });\n});\n"],"mappings":";;;;;;;AAmBA,MAAa,iBAAiB,OAAO,WAAW,WAC9C,YACA,WACA,QAAQ,OACR;CACA,MAAM,QAAQ,OAAO,OAAO,aAAa,YAAY,CAAC,CAAC,SAAS;CAChE,MAAM,OAAO,OAAO,UAAA,CAAW,kBAAkB;CACjD,IAAI,UAAU;CAEd,KAAK,MAAM,aAAa,YAAY;EAClC,MAAM,YAAY,QAAQ;EAE1B,IAAI,cAAc,GAAG;EACrB,MAAM,EAAE,OAAO,MAAM,QAAQ;EAC7B,MAAM,UAAU,KAAK,KAAK,GAAG,UAAU,IAAI,QAAQ,eAAe,OAAO,CAAC;EAC1E,MAAM,YAAY,GAAG,UAAU,IAAI,KAAK,MAAM,KAAK,CAAC,CAAC,KAAK,KAAK,KAAK,UAAU,GAAG,GAAG,MAAM,OAAO,GAAG,EAAE,MAAM,QAAQ,QAAS,CAAC,EAAE,QAAQ,MAAM,KAAK,SAAS,IAAI,YAAY,IAAI,KAAK,MAAM,KAAK,CAAC,CAAC,UAAU,MAAM,WAAW,IAAI,KAAK,IAAI,MAAM,MAAM,IAAI,UAAU,KAAK,EAAE,SAAS;EAIpR,MAAM,SACJ,KAAK,WAAW,IACZ,MAAM,OAAO,KAAK,EAAE,IACpB,GAAG,IAAI,IAAI,KAAK,MAAM,KAAK,CAAC,CAAC,KAAK,IAAI,MAAM,MAAM,CAAC,EAAE;EAE3D,MAAM,WAAW,GAAG,eAAe,MAAM,KAAK,SAAS,IAAI,OAAO,OAAO,cAAc,IAAI,KAAK,MAAM,KAAK,CAAC,CAAC,OAAO,EAAE,SAAS,UAAU;EAEzI,IAAI,OAAO;GACT,MAAM,WAAW,OAAO,GAAG,GAAG,YAAA,CAAa;GAE3C,OAAO,wBAAwB,QAAQ;GACvC,OAAO,wBAAwB,kBAAkB,KAAK,GAAG,eAAe,SAAS,CAAC;GAClF,WAAW;EACb,OAAO,WAAW,OAAO,iBAAiB,KAAK,QAAQ;CACzD;CAEA,OAAO,OAAO,OAAO,aAAa,aAAa,CAAC,CAAC;EAAE;EAAS,SAAS,YAAY;CAAM,CAAC;AAC1F,CAAC"}