@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.27

package/dist/internal/models/session-model.d.mts

@@ -1,9 +1,10 @@
+import { SqlExpression, TableModel } from "../table-model.mjs";
 import { PersistenceMappingError } from "../mapping-error.mjs";
-import { SqlExpression, TableModel } from "../query-operations.mjs";
 import { SubjectIdCodec } from "./common.mjs";
+import { ProofClock } from "./proof-model.mjs";
 import { DateTime, Effect } from "effect";
+import { AuthenticationFlowId, AuthenticationRequirement, PendingAuthenticationRecord, SecurityRevision, SessionId, StatefulSessionRecord } from "@yielded/auth/Sessions";
 import { TokenDigest } from "@yielded/auth/Schema";
-import { AuthenticationEvidence, AuthenticationRequirement, PendingAuthenticationRecord, PendingAuthenticationState, SecurityRevision, SessionId, StatefulSessionRecord } from "@yielded/auth/Sessions";
 //#region src/internal/models/session-model.d.ts
 type ColumnKey<T extends TableModel> = T["column"];
 export interface SessionIdCodec<NativeId> {
@@ -17,8 +18,12 @@ export interface SessionSubjectTables<Subject extends TableModel, NativeId> {
     readonly id: ColumnKey<Subject>;
     readonly status: ColumnKey<Subject>;
     readonly securityRevision: ColumnKey<Subject>;
+    readonly activeStatusValue: unknown;
     readonly isActiveStatus: (value: unknown) => boolean;
     readonly decodeRequirement: (row: Subject["select"]) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;
+    /** Required for D1 authority writes. Declare every mutable subject input of
+     * decodeRequirement; [] explicitly declares a constant requirement. */
+    readonly requirementColumns?: ReadonlyArray<ColumnKey<Subject>>;
     readonly nextSecurityRevision?: (current: SecurityRevision) => Effect.Effect<SecurityRevision, PersistenceMappingError>;
     readonly nextSecurityRevisionSync?: (current: SecurityRevision) => SecurityRevision;
   };
@@ -30,43 +35,29 @@ export interface SessionAuthorityTables<Subject extends TableModel, Credential e
     readonly subjectId: ColumnKey<Credential>;
     readonly credentialId: ColumnKey<Credential>;
     readonly revision: ColumnKey<Credential>;
-    /** Optional consumer status predicate; omitted means every stored credential row is active. */
+    /** Omitted status means every row is an active credential. */
     readonly status?: ColumnKey<Credential>;
+    readonly activeStatusValue?: unknown;
     readonly isActiveStatus?: (value: unknown) => boolean;
   };
 }
-export interface SessionFlowTables<Flow extends TableModel, NativeSubjectId> {
-  readonly flow: {
-    readonly table: Flow["table"];
-    readonly flowId: ColumnKey<Flow>;
-    readonly subjectId: ColumnKey<Flow>;
-    readonly state: ColumnKey<Flow>;
-    readonly pendingDigest: ColumnKey<Flow>;
-    readonly dedupUntil: ColumnKey<Flow>;
-    readonly pendingStateValue: unknown;
-    readonly establishedStateValue: unknown;
-    readonly encodeInstant: (instant: DateTime.Utc) => unknown;
-    readonly decodeInstant: (native: unknown) => Effect.Effect<DateTime.Utc, PersistenceMappingError>;
-    readonly encodePendingInsert: (input: {
-      readonly evidence: AuthenticationEvidence;
-      readonly subjectId: NativeSubjectId;
-      readonly pendingDigest: TokenDigest;
-      readonly dedupUntil: DateTime.Utc;
-    }) => Flow["insert"];
-    readonly encodeEstablishedInsert: (input: {
-      readonly evidence: AuthenticationEvidence;
-      readonly subjectId: NativeSubjectId;
-      readonly dedupUntil: DateTime.Utc;
-    }) => Flow["insert"];
+export interface SessionExecution<Expression extends SqlExpression = SqlExpression> {
+  /** Exact session module scope for pending rows and revocation tombstones. */
+  readonly moduleId: string;
+  readonly clock: ProofClock<Expression>;
+  /** D1 mappings must use the authoritative primary database. */
+  readonly d1?: {
+    readonly primary: true;
   };
+  /** Match only the declared unique keys, never generic SQL failures. */
+  readonly isConstraintConflict: (cause: unknown) => boolean;
 }
-export interface StatefulSessionTables<Claims, Session extends TableModel, Flow extends TableModel, NativeSubjectId, NativeSessionId> extends SessionFlowTables<Flow, NativeSubjectId> {
+export interface StatefulSessionTables<Claims, Session extends TableModel, NativeSubjectId, NativeSessionId> {
   readonly session: {
     readonly table: Session["table"];
     readonly sessionId: ColumnKey<Session>;
     readonly subjectId: ColumnKey<Session>;
     readonly digest: ColumnKey<Session>;
-    readonly version: ColumnKey<Session>;
     readonly securityRevision: ColumnKey<Session>;
     readonly issuedAt: ColumnKey<Session>;
     readonly expiresAt: ColumnKey<Session>;
@@ -76,51 +67,67 @@ export interface StatefulSessionTables<Claims, Session extends TableModel, Flow
       readonly subjectId: NativeSubjectId;
       readonly sessionId: NativeSessionId;
     }) => Session["insert"];
-    /** Persist the prepared credentialVersion and retain exact private provenance. */
+    /** Replace prepared metadata and retain exact private provenance. Digest binds the immutable source metadata. */
     readonly encodeRotation: (record: StatefulSessionRecord<Claims>) => Partial<Session["insert"]>;
     readonly decode: (row: Session["select"]) => Effect.Effect<StatefulSessionRecord<Claims>, PersistenceMappingError>;
     readonly allocateId?: Effect.Effect<NativeSessionId, PersistenceMappingError>;
     readonly allocateIdSync?: () => NativeSessionId;
-    readonly allocateVersion?: Effect.Effect<SecurityRevision, PersistenceMappingError>;
-    readonly allocateVersionSync?: () => SecurityRevision;
   };
   readonly sessionId: SessionIdCodec<NativeSessionId>;
 }
-export interface PendingAuthenticationTables<Claims, Pending extends TableModel, Flow extends TableModel, NativeSubjectId> extends SessionFlowTables<Flow, NativeSubjectId> {
+export interface SessionPendingInsert<NativeId> {
+  readonly moduleId: string;
+  readonly kind: "Login" | "StepUp";
+  readonly digest: TokenDigest;
+  readonly version: SecurityRevision;
+  readonly flowId: AuthenticationFlowId;
+  readonly subjectId: NativeId;
+  readonly bindingDigest: TokenDigest;
+  readonly snapshot: string;
+  readonly expiresAt: DateTime.Utc;
+  readonly attemptLimit: number;
+}
+/** One physical table and one SQL owner for Login and StepUp. The adapter sets
+ * every guard column and binds kind before decoding, charging or consuming. */
+export interface SessionPendingTables<Pending extends TableModel, NativeSubjectId> {
   readonly pending: {
     readonly table: Pending["table"];
+    readonly moduleId: ColumnKey<Pending>;
+    readonly kind: ColumnKey<Pending>;
     readonly digest: ColumnKey<Pending>;
     readonly version: ColumnKey<Pending>;
     readonly flowId: ColumnKey<Pending>;
     readonly subjectId: ColumnKey<Pending>;
     readonly bindingDigest: ColumnKey<Pending>;
+    readonly snapshot: ColumnKey<Pending>;
     readonly expiresAt: ColumnKey<Pending>;
     readonly attemptLimit: ColumnKey<Pending>;
     readonly failedAttempts: ColumnKey<Pending>;
     readonly consumed: ColumnKey<Pending>;
     readonly encodeInstant: (instant: DateTime.Utc) => unknown;
-    readonly encodeInsert: (record: PendingAuthenticationRecord<Claims>, input: {
-      readonly subjectId: NativeSubjectId;
-      readonly failedAttempts: 0;
-      readonly consumed: false;
-    }) => Pending["insert"];
-    readonly decode: (row: Pending["select"]) => Effect.Effect<PendingAuthenticationRecord<Claims>, PersistenceMappingError>;
-    /** Decodes original evidence and storage guards only. The internal pending
-     * context lookup must not execute unrelated consumer Claims transforms. */
-    readonly decodeContext: (row: Pending["select"]) => Effect.Effect<PendingAuthenticationState, PersistenceMappingError>;
+    readonly encodeInsert: (input: SessionPendingInsert<NativeSubjectId>) => Pending["insert"];
     readonly allocateVersion?: Effect.Effect<SecurityRevision, PersistenceMappingError>;
     readonly allocateVersionSync?: () => SecurityRevision;
   };
 }
+export interface PendingAuthenticationTables<Claims, Pending extends TableModel, NativeSubjectId> extends SessionPendingTables<Pending, NativeSubjectId> {
+  /** Canonical JSON of the full record; the consumer Schema owns Claims encoding. */
+  readonly login: {
+    readonly encode: (record: PendingAuthenticationRecord<Claims>) => Effect.Effect<string, PersistenceMappingError>;
+    readonly decode: (snapshot: unknown) => Effect.Effect<PendingAuthenticationRecord<Claims>, PersistenceMappingError>;
+  };
+}
 export interface SignedSessionValidityTables<Tombstone extends TableModel, NativeSubjectId, NativeSessionId> {
   readonly tombstone: {
     readonly table: Tombstone["table"];
+    readonly moduleId: ColumnKey<Tombstone>;
     readonly subjectId: ColumnKey<Tombstone>;
     readonly sessionId: ColumnKey<Tombstone>;
     readonly absoluteExpiresAt: ColumnKey<Tombstone>;
     readonly encodeInstant: (instant: DateTime.Utc) => unknown;
     readonly decodeInstant: (native: unknown) => Effect.Effect<DateTime.Utc, PersistenceMappingError>;
     readonly encodeInsert: (input: {
+      readonly moduleId: string;
       readonly subjectId: NativeSubjectId;
       readonly sessionId: NativeSessionId;
       readonly absoluteExpiresAt: DateTime.Utc;
@@ -128,72 +135,46 @@ export interface SignedSessionValidityTables<Tombstone extends TableModel, Nativ
   };
   readonly sessionId: SessionIdCodec<NativeSessionId>;
 }
-export interface RequiredSessionConstraints {
+export declare const requiredSessionConstraints: {
   readonly sessionDigest: "unique(session.digest)";
-  readonly flowId: "unique(flow.flowId)";
-}
-export interface RequiredPendingAuthenticationConstraints {
+};
+export declare const requiredPendingAuthenticationConstraints: {
   readonly pendingDigest: "unique(pending.digest)";
-  readonly pendingFlow: "unique(pending.flowId)";
-  readonly flowId: "unique(flow.flowId)";
-}
-export interface RequiredStatefulPendingConstraints extends RequiredSessionConstraints, RequiredPendingAuthenticationConstraints {}
-export interface RequiredSignedValidityConstraints {
-  readonly tombstoneOwner: "unique(tombstone.subjectId,tombstone.sessionId)";
-}
-export declare const requiredSessionConstraints: RequiredSessionConstraints;
-export declare const requiredPendingAuthenticationConstraints: RequiredPendingAuthenticationConstraints;
-export declare const requiredStatefulPendingConstraints: RequiredStatefulPendingConstraints;
-export declare const requiredSignedValidityConstraints: RequiredSignedValidityConstraints;
-export interface SessionConstraintClassifier {
-  /**
-   * Match only the named unique constraints declared by this mapping. Broad
-   * SQL/constraint classifiers can relabel application or NOT NULL failures as
-   * a domain conflict.
-   */
-  readonly isConstraintConflict: (cause: unknown) => boolean;
-}
-export type AuthenticationAuthorityMapping<Claims, Subject extends TableModel, Credential extends TableModel, Flow extends TableModel, Pending extends TableModel, NativeSubjectId> = SessionAuthorityTables<Subject, Credential, NativeSubjectId> & SessionConstraintClassifier & ({
-  /** Omit for single-factor authority installations. Pending input then fails closed. */
+};
+export declare const requiredStatefulPendingConstraints: {
+  readonly sessionDigest: "unique(session.digest)";
+  readonly pendingDigest: "unique(pending.digest)";
+};
+export declare const requiredSignedValidityConstraints: {
+  readonly tombstoneOwner: "unique(tombstone.moduleId,tombstone.subjectId,tombstone.sessionId)";
+};
+export type RequiredSessionConstraints = typeof requiredSessionConstraints;
+export type RequiredPendingAuthenticationConstraints = typeof requiredPendingAuthenticationConstraints;
+export type RequiredStatefulPendingConstraints = typeof requiredStatefulPendingConstraints;
+export type RequiredSignedValidityConstraints = typeof requiredSignedValidityConstraints;
+export type AuthenticationAuthorityMapping<Claims, Subject extends TableModel, Credential extends TableModel, Pending extends TableModel, NativeSubjectId, Expression extends SqlExpression = SqlExpression> = SessionAuthorityTables<Subject, Credential, NativeSubjectId> & SessionExecution<Expression> & ({
   readonly pending?: undefined;
 } | {
-  readonly pending: PendingAuthenticationTables<Claims, Pending, Flow, NativeSubjectId>;
+  readonly pending: PendingAuthenticationTables<Claims, Pending, NativeSubjectId>;
   readonly constraints: RequiredPendingAuthenticationConstraints;
 });
-export type StatefulSessionMapping<Claims, Subject extends TableModel, Credential extends TableModel, Session extends TableModel, Flow extends TableModel, Pending extends TableModel, NativeSubjectId, NativeSessionId> = SessionAuthorityTables<Subject, Credential, NativeSubjectId> & StatefulSessionTables<Claims, Session, Flow, NativeSubjectId, NativeSessionId> & SessionConstraintClassifier & ({
-  /** Omit when this session module does not support pending MFA completion. */
+export type StatefulSessionMapping<Claims, Subject extends TableModel, Credential extends TableModel, Session extends TableModel, Pending extends TableModel, NativeSubjectId, NativeSessionId, Expression extends SqlExpression = SqlExpression> = SessionAuthorityTables<Subject, Credential, NativeSubjectId> & StatefulSessionTables<Claims, Session, NativeSubjectId, NativeSessionId> & SessionExecution<Expression> & ({
   readonly pending?: undefined;
   readonly constraints: RequiredSessionConstraints;
 } | {
-  readonly pending: PendingAuthenticationTables<Claims, Pending, Flow, NativeSubjectId>["pending"];
+  readonly pending: PendingAuthenticationTables<Claims, Pending, NativeSubjectId>;
   readonly constraints: RequiredStatefulPendingConstraints;
 });
-export type PendingAuthenticationMapping<Claims, Subject extends TableModel, Credential extends TableModel, Pending extends TableModel, Flow extends TableModel, NativeSubjectId> = SessionAuthorityTables<Subject, Credential, NativeSubjectId> & PendingAuthenticationTables<Claims, Pending, Flow, NativeSubjectId> & SessionConstraintClassifier & {
+export type PendingAuthenticationMapping<Claims, Subject extends TableModel, Credential extends TableModel, Pending extends TableModel, NativeSubjectId, Expression extends SqlExpression = SqlExpression> = SessionAuthorityTables<Subject, Credential, NativeSubjectId> & PendingAuthenticationTables<Claims, Pending, NativeSubjectId> & SessionExecution<Expression> & {
   readonly constraints: RequiredPendingAuthenticationConstraints;
 };
-export type SignedSessionValidityMapping<Subject extends TableModel, Tombstone extends TableModel, NativeSubjectId, NativeSessionId> = SessionSubjectTables<Subject, NativeSubjectId> & SignedSessionValidityTables<Tombstone, NativeSubjectId, NativeSessionId> & SessionConstraintClassifier & {
+export type SignedSessionValidityMapping<Subject extends TableModel, Tombstone extends TableModel, NativeSubjectId, NativeSessionId, Expression extends SqlExpression = SqlExpression> = SessionSubjectTables<Subject, NativeSubjectId> & SignedSessionValidityTables<Tombstone, NativeSubjectId, NativeSessionId> & SessionExecution<Expression> & {
   readonly constraints: RequiredSignedValidityConstraints;
 };
-/** D1 evaluates these expressions inside the atomic batch, after queueing delay.
- * `engineNow` must use the exact native representation of every mapped instant
- * column. `engineNowMillis` is Unix epoch milliseconds for proof freshness.
- * Changes to the consumer's factor policy MUST bump subject.securityRevision.
- * Supply the authoritative primary D1 database, never a replica-affined
- * `withSession` handle, because verification and security revision reads must
- * observe completed revocation writes across clients.
- */
-export interface D1SessionClockMapping<Expression extends SqlExpression = SqlExpression> {
-  readonly d1: {
-    readonly engineNow: Expression;
-    readonly engineNowMillis: Expression;
-    readonly activeSubjectStatusValue: unknown;
-    /** Required when `credential.status` is mapped. */
-    readonly activeCredentialStatusValue?: unknown;
-  };
-}
-export type D1AuthenticationAuthorityMapping<Claims, Subject extends TableModel, Credential extends TableModel, Flow extends TableModel, Pending extends TableModel, NativeSubjectId, Expression extends SqlExpression = SqlExpression> = AuthenticationAuthorityMapping<Claims, Subject, Credential, Flow, Pending, NativeSubjectId> & D1SessionClockMapping<Expression>;
-export type D1PendingAuthenticationMapping<Claims, Subject extends TableModel, Credential extends TableModel, Pending extends TableModel, Flow extends TableModel, NativeSubjectId, Expression extends SqlExpression = SqlExpression> = PendingAuthenticationMapping<Claims, Subject, Credential, Pending, Flow, NativeSubjectId> & D1SessionClockMapping<Expression>;
-export type D1StatefulSessionMapping<Claims, Subject extends TableModel, Credential extends TableModel, Session extends TableModel, Flow extends TableModel, Pending extends TableModel, NativeSubjectId, NativeSessionId, Expression extends SqlExpression = SqlExpression> = StatefulSessionMapping<Claims, Subject, Credential, Session, Flow, Pending, NativeSubjectId, NativeSessionId> & D1SessionClockMapping<Expression>;
-export type D1SignedSessionValidityMapping<Subject extends TableModel, Tombstone extends TableModel, NativeSubjectId, NativeSessionId, Expression extends SqlExpression = SqlExpression> = SignedSessionValidityMapping<Subject, Tombstone, NativeSubjectId, NativeSessionId> & D1SessionClockMapping<Expression>;
+/** Maintenance uses the same mapped rows and one total per-call deletion limit. */
+export type SessionCleanupMapping<Pending extends TableModel, Tombstone extends TableModel, NativeSubjectId, NativeSessionId, Expression extends SqlExpression = SqlExpression> = Pick<SessionExecution<Expression>, "moduleId" | "clock" | "d1"> & {
+  readonly pending?: SessionPendingTables<Pending, NativeSubjectId>["pending"];
+  readonly tombstone?: SignedSessionValidityTables<Tombstone, NativeSubjectId, NativeSessionId>["tombstone"];
+};
 //#endregion
 //# sourceMappingURL=session-model.d.mts.map

package/dist/internal/models/session-model.mjs

@@ -1,19 +1,11 @@
-import "@yielded/auth/Sessions";
 //#region src/internal/models/session-model.ts
-const requiredSessionConstraints = {
-	sessionDigest: "unique(session.digest)",
-	flowId: "unique(flow.flowId)"
-};
-const requiredPendingAuthenticationConstraints = {
-	pendingDigest: "unique(pending.digest)",
-	pendingFlow: "unique(pending.flowId)",
-	flowId: "unique(flow.flowId)"
-};
+const requiredSessionConstraints = { sessionDigest: "unique(session.digest)" };
+const requiredPendingAuthenticationConstraints = { pendingDigest: "unique(pending.digest)" };
 const requiredStatefulPendingConstraints = {
 	...requiredSessionConstraints,
 	...requiredPendingAuthenticationConstraints
 };
-const requiredSignedValidityConstraints = { tombstoneOwner: "unique(tombstone.subjectId,tombstone.sessionId)" };
+const requiredSignedValidityConstraints = { tombstoneOwner: "unique(tombstone.moduleId,tombstone.subjectId,tombstone.sessionId)" };
 //#endregion
 export { requiredPendingAuthenticationConstraints, requiredSessionConstraints, requiredSignedValidityConstraints, requiredStatefulPendingConstraints };
 

package/dist/internal/models/session-model.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"session-model.mjs","names":[],"sources":["../../../src/internal/models/session-model.ts"],"sourcesContent":["import type { TokenDigest } from \"@yielded/auth/Schema\";\nimport {\n  type AuthenticationRequirement,\n  type AuthenticationEvidence,\n  type SecurityRevision,\n  type SessionId,\n  type PendingAuthenticationRecord,\n  type PendingAuthenticationState,\n  type StatefulSessionRecord,\n} from \"@yielded/auth/Sessions\";\nimport type { DateTime, Effect } from \"effect\";\n\nimport type { TableModel as Table, SqlExpression } from \"../query-operations\";\nimport type { PersistenceMappingError, SubjectIdCodec } from \"./common\";\n\ntype ColumnKey<T extends Table> = T[\"column\"];\n\nexport interface SessionIdCodec<NativeId> {\n  readonly toNative: (id: SessionId) => Effect.Effect<NativeId, PersistenceMappingError>;\n  readonly toSession: (id: NativeId) => Effect.Effect<SessionId, PersistenceMappingError>;\n  readonly equals: (left: NativeId, right: NativeId) => boolean;\n}\n\nexport interface SessionSubjectTables<Subject extends Table, NativeId> {\n  readonly subject: {\n    readonly table: Subject[\"table\"];\n    readonly id: ColumnKey<Subject>;\n    readonly status: ColumnKey<Subject>;\n    readonly securityRevision: ColumnKey<Subject>;\n    readonly isActiveStatus: (value: unknown) => boolean;\n    readonly decodeRequirement: (\n      row: Subject[\"select\"],\n    ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n    readonly nextSecurityRevision?: (\n      current: SecurityRevision,\n    ) => Effect.Effect<SecurityRevision, PersistenceMappingError>;\n    readonly nextSecurityRevisionSync?: (current: SecurityRevision) => SecurityRevision;\n  };\n  readonly subjectId: SubjectIdCodec<NativeId>;\n}\n\nexport interface SessionAuthorityTables<\n  Subject extends Table,\n  Credential extends Table,\n  NativeId,\n> extends SessionSubjectTables<Subject, NativeId> {\n  readonly credential: {\n    readonly table: Credential[\"table\"];\n    readonly subjectId: ColumnKey<Credential>;\n    readonly credentialId: ColumnKey<Credential>;\n    readonly revision: ColumnKey<Credential>;\n    /** Optional consumer status predicate; omitted means every stored credential row is active. */\n    readonly status?: ColumnKey<Credential>;\n    readonly isActiveStatus?: (value: unknown) => boolean;\n  };\n}\n\nexport interface SessionFlowTables<Flow extends Table, NativeSubjectId> {\n  readonly flow: {\n    readonly table: Flow[\"table\"];\n    readonly flowId: ColumnKey<Flow>;\n    readonly subjectId: ColumnKey<Flow>;\n    readonly state: ColumnKey<Flow>;\n    readonly pendingDigest: ColumnKey<Flow>;\n    readonly dedupUntil: ColumnKey<Flow>;\n    readonly pendingStateValue: unknown;\n    readonly establishedStateValue: unknown;\n    readonly encodeInstant: (instant: DateTime.Utc) => unknown;\n    readonly decodeInstant: (\n      native: unknown,\n    ) => Effect.Effect<DateTime.Utc, PersistenceMappingError>;\n    readonly encodePendingInsert: (input: {\n      readonly evidence: AuthenticationEvidence;\n      readonly subjectId: NativeSubjectId;\n      readonly pendingDigest: TokenDigest;\n      readonly dedupUntil: DateTime.Utc;\n    }) => Flow[\"insert\"];\n    readonly encodeEstablishedInsert: (input: {\n      readonly evidence: AuthenticationEvidence;\n      readonly subjectId: NativeSubjectId;\n      readonly dedupUntil: DateTime.Utc;\n    }) => Flow[\"insert\"];\n  };\n}\n\nexport interface StatefulSessionTables<\n  Claims,\n  Session extends Table,\n  Flow extends Table,\n  NativeSubjectId,\n  NativeSessionId,\n> extends SessionFlowTables<Flow, NativeSubjectId> {\n  readonly session: {\n    readonly table: Session[\"table\"];\n    readonly sessionId: ColumnKey<Session>;\n    readonly subjectId: ColumnKey<Session>;\n    readonly digest: ColumnKey<Session>;\n    readonly version: ColumnKey<Session>;\n    readonly securityRevision: ColumnKey<Session>;\n    readonly issuedAt: ColumnKey<Session>;\n    readonly expiresAt: ColumnKey<Session>;\n    readonly absoluteExpiresAt: ColumnKey<Session>;\n    readonly encodeInstant: (instant: DateTime.Utc) => unknown;\n    readonly encodeInsert: (\n      record: StatefulSessionRecord<Claims>,\n      ids: {\n        readonly subjectId: NativeSubjectId;\n        readonly sessionId: NativeSessionId;\n      },\n    ) => Session[\"insert\"];\n    /** Persist the prepared credentialVersion and retain exact private provenance. */\n    readonly encodeRotation: (record: StatefulSessionRecord<Claims>) => Partial<Session[\"insert\"]>;\n    readonly decode: (\n      row: Session[\"select\"],\n    ) => Effect.Effect<StatefulSessionRecord<Claims>, PersistenceMappingError>;\n    readonly allocateId?: Effect.Effect<NativeSessionId, PersistenceMappingError>;\n    readonly allocateIdSync?: () => NativeSessionId;\n    readonly allocateVersion?: Effect.Effect<SecurityRevision, PersistenceMappingError>;\n    readonly allocateVersionSync?: () => SecurityRevision;\n  };\n  readonly sessionId: SessionIdCodec<NativeSessionId>;\n}\n\nexport interface PendingAuthenticationTables<\n  Claims,\n  Pending extends Table,\n  Flow extends Table,\n  NativeSubjectId,\n> extends SessionFlowTables<Flow, NativeSubjectId> {\n  readonly pending: {\n    readonly table: Pending[\"table\"];\n    readonly digest: ColumnKey<Pending>;\n    readonly version: ColumnKey<Pending>;\n    readonly flowId: ColumnKey<Pending>;\n    readonly subjectId: ColumnKey<Pending>;\n    readonly bindingDigest: ColumnKey<Pending>;\n    readonly expiresAt: ColumnKey<Pending>;\n    readonly attemptLimit: ColumnKey<Pending>;\n    readonly failedAttempts: ColumnKey<Pending>;\n    readonly consumed: ColumnKey<Pending>;\n    readonly encodeInstant: (instant: DateTime.Utc) => unknown;\n    readonly encodeInsert: (\n      record: PendingAuthenticationRecord<Claims>,\n      input: {\n        readonly subjectId: NativeSubjectId;\n        readonly failedAttempts: 0;\n        readonly consumed: false;\n      },\n    ) => Pending[\"insert\"];\n    readonly decode: (\n      row: Pending[\"select\"],\n    ) => Effect.Effect<PendingAuthenticationRecord<Claims>, PersistenceMappingError>;\n    /** Decodes original evidence and storage guards only. The internal pending\n     * context lookup must not execute unrelated consumer Claims transforms. */\n    readonly decodeContext: (\n      row: Pending[\"select\"],\n    ) => Effect.Effect<PendingAuthenticationState, PersistenceMappingError>;\n    readonly allocateVersion?: Effect.Effect<SecurityRevision, PersistenceMappingError>;\n    readonly allocateVersionSync?: () => SecurityRevision;\n  };\n}\n\nexport interface SignedSessionValidityTables<\n  Tombstone extends Table,\n  NativeSubjectId,\n  NativeSessionId,\n> {\n  readonly tombstone: {\n    readonly table: Tombstone[\"table\"];\n    readonly subjectId: ColumnKey<Tombstone>;\n    readonly sessionId: ColumnKey<Tombstone>;\n    readonly absoluteExpiresAt: ColumnKey<Tombstone>;\n    readonly encodeInstant: (instant: DateTime.Utc) => unknown;\n    readonly decodeInstant: (\n      native: unknown,\n    ) => Effect.Effect<DateTime.Utc, PersistenceMappingError>;\n    readonly encodeInsert: (input: {\n      readonly subjectId: NativeSubjectId;\n      readonly sessionId: NativeSessionId;\n      readonly absoluteExpiresAt: DateTime.Utc;\n    }) => Tombstone[\"insert\"];\n  };\n  readonly sessionId: SessionIdCodec<NativeSessionId>;\n}\n\nexport interface RequiredSessionConstraints {\n  readonly sessionDigest: \"unique(session.digest)\";\n  readonly flowId: \"unique(flow.flowId)\";\n}\n\nexport interface RequiredPendingAuthenticationConstraints {\n  readonly pendingDigest: \"unique(pending.digest)\";\n  readonly pendingFlow: \"unique(pending.flowId)\";\n  readonly flowId: \"unique(flow.flowId)\";\n}\n\nexport interface RequiredStatefulPendingConstraints\n  extends RequiredSessionConstraints, RequiredPendingAuthenticationConstraints {}\n\nexport interface RequiredSignedValidityConstraints {\n  readonly tombstoneOwner: \"unique(tombstone.subjectId,tombstone.sessionId)\";\n}\n\nexport const requiredSessionConstraints: RequiredSessionConstraints = {\n  sessionDigest: \"unique(session.digest)\",\n  flowId: \"unique(flow.flowId)\",\n};\n\nexport const requiredPendingAuthenticationConstraints: RequiredPendingAuthenticationConstraints = {\n  pendingDigest: \"unique(pending.digest)\",\n  pendingFlow: \"unique(pending.flowId)\",\n  flowId: \"unique(flow.flowId)\",\n};\n\nexport const requiredStatefulPendingConstraints: RequiredStatefulPendingConstraints = {\n  ...requiredSessionConstraints,\n  ...requiredPendingAuthenticationConstraints,\n};\n\nexport const requiredSignedValidityConstraints: RequiredSignedValidityConstraints = {\n  tombstoneOwner: \"unique(tombstone.subjectId,tombstone.sessionId)\",\n};\n\nexport interface SessionConstraintClassifier {\n  /**\n   * Match only the named unique constraints declared by this mapping. Broad\n   * SQL/constraint classifiers can relabel application or NOT NULL failures as\n   * a domain conflict.\n   */\n  readonly isConstraintConflict: (cause: unknown) => boolean;\n}\n\nexport type AuthenticationAuthorityMapping<\n  Claims,\n  Subject extends Table,\n  Credential extends Table,\n  Flow extends Table,\n  Pending extends Table,\n  NativeSubjectId,\n> = SessionAuthorityTables<Subject, Credential, NativeSubjectId> &\n  SessionConstraintClassifier &\n  (\n    | {\n        /** Omit for single-factor authority installations. Pending input then fails closed. */\n        readonly pending?: undefined;\n      }\n    | {\n        readonly pending: PendingAuthenticationTables<Claims, Pending, Flow, NativeSubjectId>;\n        readonly constraints: RequiredPendingAuthenticationConstraints;\n      }\n  );\n\nexport type StatefulSessionMapping<\n  Claims,\n  Subject extends Table,\n  Credential extends Table,\n  Session extends Table,\n  Flow extends Table,\n  Pending extends Table,\n  NativeSubjectId,\n  NativeSessionId,\n> = SessionAuthorityTables<Subject, Credential, NativeSubjectId> &\n  StatefulSessionTables<Claims, Session, Flow, NativeSubjectId, NativeSessionId> &\n  SessionConstraintClassifier &\n  (\n    | {\n        /** Omit when this session module does not support pending MFA completion. */\n        readonly pending?: undefined;\n        readonly constraints: RequiredSessionConstraints;\n      }\n    | {\n        readonly pending: PendingAuthenticationTables<\n          Claims,\n          Pending,\n          Flow,\n          NativeSubjectId\n        >[\"pending\"];\n        readonly constraints: RequiredStatefulPendingConstraints;\n      }\n  );\n\nexport type PendingAuthenticationMapping<\n  Claims,\n  Subject extends Table,\n  Credential extends Table,\n  Pending extends Table,\n  Flow extends Table,\n  NativeSubjectId,\n> = SessionAuthorityTables<Subject, Credential, NativeSubjectId> &\n  PendingAuthenticationTables<Claims, Pending, Flow, NativeSubjectId> &\n  SessionConstraintClassifier & {\n    readonly constraints: RequiredPendingAuthenticationConstraints;\n  };\n\nexport type SignedSessionValidityMapping<\n  Subject extends Table,\n  Tombstone extends Table,\n  NativeSubjectId,\n  NativeSessionId,\n> = SessionSubjectTables<Subject, NativeSubjectId> &\n  SignedSessionValidityTables<Tombstone, NativeSubjectId, NativeSessionId> &\n  SessionConstraintClassifier & {\n    readonly constraints: RequiredSignedValidityConstraints;\n  };\n\n/** D1 evaluates these expressions inside the atomic batch, after queueing delay.\n * `engineNow` must use the exact native representation of every mapped instant\n * column. `engineNowMillis` is Unix epoch milliseconds for proof freshness.\n * Changes to the consumer's factor policy MUST bump subject.securityRevision.\n * Supply the authoritative primary D1 database, never a replica-affined\n * `withSession` handle, because verification and security revision reads must\n * observe completed revocation writes across clients.\n */\nexport interface D1SessionClockMapping<Expression extends SqlExpression = SqlExpression> {\n  readonly d1: {\n    readonly engineNow: Expression;\n    readonly engineNowMillis: Expression;\n    readonly activeSubjectStatusValue: unknown;\n    /** Required when `credential.status` is mapped. */\n    readonly activeCredentialStatusValue?: unknown;\n  };\n}\n\nexport type D1AuthenticationAuthorityMapping<\n  Claims,\n  Subject extends Table,\n  Credential extends Table,\n  Flow extends Table,\n  Pending extends Table,\n  NativeSubjectId,\n  Expression extends SqlExpression = SqlExpression,\n> = AuthenticationAuthorityMapping<Claims, Subject, Credential, Flow, Pending, NativeSubjectId> &\n  D1SessionClockMapping<Expression>;\n\nexport type D1PendingAuthenticationMapping<\n  Claims,\n  Subject extends Table,\n  Credential extends Table,\n  Pending extends Table,\n  Flow extends Table,\n  NativeSubjectId,\n  Expression extends SqlExpression = SqlExpression,\n> = PendingAuthenticationMapping<Claims, Subject, Credential, Pending, Flow, NativeSubjectId> &\n  D1SessionClockMapping<Expression>;\n\nexport type D1StatefulSessionMapping<\n  Claims,\n  Subject extends Table,\n  Credential extends Table,\n  Session extends Table,\n  Flow extends Table,\n  Pending extends Table,\n  NativeSubjectId,\n  NativeSessionId,\n  Expression extends SqlExpression = SqlExpression,\n> = StatefulSessionMapping<\n  Claims,\n  Subject,\n  Credential,\n  Session,\n  Flow,\n  Pending,\n  NativeSubjectId,\n  NativeSessionId\n> &\n  D1SessionClockMapping<Expression>;\n\nexport type D1SignedSessionValidityMapping<\n  Subject extends Table,\n  Tombstone extends Table,\n  NativeSubjectId,\n  NativeSessionId,\n  Expression extends SqlExpression = SqlExpression,\n> = SignedSessionValidityMapping<Subject, Tombstone, NativeSubjectId, NativeSessionId> &\n  D1SessionClockMapping<Expression>;\n"],"mappings":";;AA2MA,MAAa,6BAAyD;CACpE,eAAe;CACf,QAAQ;AACV;AAEA,MAAa,2CAAqF;CAChG,eAAe;CACf,aAAa;CACb,QAAQ;AACV;AAEA,MAAa,qCAAyE;CACpF,GAAG;CACH,GAAG;AACL;AAEA,MAAa,oCAAuE,EAClF,gBAAgB,kDAClB"}
+{"version":3,"file":"session-model.mjs","names":[],"sources":["../../../src/internal/models/session-model.ts"],"sourcesContent":["import type { TokenDigest } from \"@yielded/auth/Schema\";\nimport type {\n  AuthenticationRequirement,\n  SecurityRevision,\n  SessionId,\n  AuthenticationFlowId,\n  PendingAuthenticationRecord,\n  StatefulSessionRecord,\n} from \"@yielded/auth/Sessions\";\nimport type { DateTime, Effect } from \"effect\";\n\nimport type { TableModel as Table, SqlExpression } from \"../table-model\";\nimport type { PersistenceMappingError, SubjectIdCodec } from \"./common\";\nimport type { ProofClock } from \"./proof-model\";\n\ntype ColumnKey<T extends Table> = T[\"column\"];\n\nexport interface SessionIdCodec<NativeId> {\n  readonly toNative: (id: SessionId) => Effect.Effect<NativeId, PersistenceMappingError>;\n  readonly toSession: (id: NativeId) => Effect.Effect<SessionId, PersistenceMappingError>;\n  readonly equals: (left: NativeId, right: NativeId) => boolean;\n}\n\nexport interface SessionSubjectTables<Subject extends Table, NativeId> {\n  readonly subject: {\n    readonly table: Subject[\"table\"];\n    readonly id: ColumnKey<Subject>;\n    readonly status: ColumnKey<Subject>;\n    readonly securityRevision: ColumnKey<Subject>;\n    readonly activeStatusValue: unknown;\n    readonly isActiveStatus: (value: unknown) => boolean;\n    readonly decodeRequirement: (\n      row: Subject[\"select\"],\n    ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n    /** Required for D1 authority writes. Declare every mutable subject input of\n     * decodeRequirement; [] explicitly declares a constant requirement. */\n    readonly requirementColumns?: ReadonlyArray<ColumnKey<Subject>>;\n    readonly nextSecurityRevision?: (\n      current: SecurityRevision,\n    ) => Effect.Effect<SecurityRevision, PersistenceMappingError>;\n    readonly nextSecurityRevisionSync?: (current: SecurityRevision) => SecurityRevision;\n  };\n  readonly subjectId: SubjectIdCodec<NativeId>;\n}\n\nexport interface SessionAuthorityTables<\n  Subject extends Table,\n  Credential extends Table,\n  NativeId,\n> extends SessionSubjectTables<Subject, NativeId> {\n  readonly credential: {\n    readonly table: Credential[\"table\"];\n    readonly subjectId: ColumnKey<Credential>;\n    readonly credentialId: ColumnKey<Credential>;\n    readonly revision: ColumnKey<Credential>;\n    /** Omitted status means every row is an active credential. */\n    readonly status?: ColumnKey<Credential>;\n    readonly activeStatusValue?: unknown;\n    readonly isActiveStatus?: (value: unknown) => boolean;\n  };\n}\n\nexport interface SessionExecution<Expression extends SqlExpression = SqlExpression> {\n  /** Exact session module scope for pending rows and revocation tombstones. */\n  readonly moduleId: string;\n  readonly clock: ProofClock<Expression>;\n  /** D1 mappings must use the authoritative primary database. */\n  readonly d1?: { readonly primary: true };\n  /** Match only the declared unique keys, never generic SQL failures. */\n  readonly isConstraintConflict: (cause: unknown) => boolean;\n}\n\nexport interface StatefulSessionTables<\n  Claims,\n  Session extends Table,\n  NativeSubjectId,\n  NativeSessionId,\n> {\n  readonly session: {\n    readonly table: Session[\"table\"];\n    readonly sessionId: ColumnKey<Session>;\n    readonly subjectId: ColumnKey<Session>;\n    readonly digest: ColumnKey<Session>;\n    readonly securityRevision: ColumnKey<Session>;\n    readonly issuedAt: ColumnKey<Session>;\n    readonly expiresAt: ColumnKey<Session>;\n    readonly absoluteExpiresAt: ColumnKey<Session>;\n    readonly encodeInstant: (instant: DateTime.Utc) => unknown;\n    readonly encodeInsert: (\n      record: StatefulSessionRecord<Claims>,\n      ids: { readonly subjectId: NativeSubjectId; readonly sessionId: NativeSessionId },\n    ) => Session[\"insert\"];\n    /** Replace prepared metadata and retain exact private provenance. Digest binds the immutable source metadata. */\n    readonly encodeRotation: (record: StatefulSessionRecord<Claims>) => Partial<Session[\"insert\"]>;\n    readonly decode: (\n      row: Session[\"select\"],\n    ) => Effect.Effect<StatefulSessionRecord<Claims>, PersistenceMappingError>;\n    readonly allocateId?: Effect.Effect<NativeSessionId, PersistenceMappingError>;\n    readonly allocateIdSync?: () => NativeSessionId;\n  };\n  readonly sessionId: SessionIdCodec<NativeSessionId>;\n}\n\nexport interface SessionPendingInsert<NativeId> {\n  readonly moduleId: string;\n  readonly kind: \"Login\" | \"StepUp\";\n  readonly digest: TokenDigest;\n  readonly version: SecurityRevision;\n  readonly flowId: AuthenticationFlowId;\n  readonly subjectId: NativeId;\n  readonly bindingDigest: TokenDigest;\n  readonly snapshot: string;\n  readonly expiresAt: DateTime.Utc;\n  readonly attemptLimit: number;\n}\n\n/** One physical table and one SQL owner for Login and StepUp. The adapter sets\n * every guard column and binds kind before decoding, charging or consuming. */\nexport interface SessionPendingTables<Pending extends Table, NativeSubjectId> {\n  readonly pending: {\n    readonly table: Pending[\"table\"];\n    readonly moduleId: ColumnKey<Pending>;\n    readonly kind: ColumnKey<Pending>;\n    readonly digest: ColumnKey<Pending>;\n    readonly version: ColumnKey<Pending>;\n    readonly flowId: ColumnKey<Pending>;\n    readonly subjectId: ColumnKey<Pending>;\n    readonly bindingDigest: ColumnKey<Pending>;\n    readonly snapshot: ColumnKey<Pending>;\n    readonly expiresAt: ColumnKey<Pending>;\n    readonly attemptLimit: ColumnKey<Pending>;\n    readonly failedAttempts: ColumnKey<Pending>;\n    readonly consumed: ColumnKey<Pending>;\n    readonly encodeInstant: (instant: DateTime.Utc) => unknown;\n    readonly encodeInsert: (input: SessionPendingInsert<NativeSubjectId>) => Pending[\"insert\"];\n    readonly allocateVersion?: Effect.Effect<SecurityRevision, PersistenceMappingError>;\n    readonly allocateVersionSync?: () => SecurityRevision;\n  };\n}\n\nexport interface PendingAuthenticationTables<\n  Claims,\n  Pending extends Table,\n  NativeSubjectId,\n> extends SessionPendingTables<Pending, NativeSubjectId> {\n  /** Canonical JSON of the full record; the consumer Schema owns Claims encoding. */\n  readonly login: {\n    readonly encode: (\n      record: PendingAuthenticationRecord<Claims>,\n    ) => Effect.Effect<string, PersistenceMappingError>;\n    readonly decode: (\n      snapshot: unknown,\n    ) => Effect.Effect<PendingAuthenticationRecord<Claims>, PersistenceMappingError>;\n  };\n}\n\nexport interface SignedSessionValidityTables<\n  Tombstone extends Table,\n  NativeSubjectId,\n  NativeSessionId,\n> {\n  readonly tombstone: {\n    readonly table: Tombstone[\"table\"];\n    readonly moduleId: ColumnKey<Tombstone>;\n    readonly subjectId: ColumnKey<Tombstone>;\n    readonly sessionId: ColumnKey<Tombstone>;\n    readonly absoluteExpiresAt: ColumnKey<Tombstone>;\n    readonly encodeInstant: (instant: DateTime.Utc) => unknown;\n    readonly decodeInstant: (\n      native: unknown,\n    ) => Effect.Effect<DateTime.Utc, PersistenceMappingError>;\n    readonly encodeInsert: (input: {\n      readonly moduleId: string;\n      readonly subjectId: NativeSubjectId;\n      readonly sessionId: NativeSessionId;\n      readonly absoluteExpiresAt: DateTime.Utc;\n    }) => Tombstone[\"insert\"];\n  };\n  readonly sessionId: SessionIdCodec<NativeSessionId>;\n}\n\nexport const requiredSessionConstraints = { sessionDigest: \"unique(session.digest)\" } as const;\n\nexport const requiredPendingAuthenticationConstraints = {\n  pendingDigest: \"unique(pending.digest)\",\n} as const;\n\nexport const requiredStatefulPendingConstraints = {\n  ...requiredSessionConstraints,\n  ...requiredPendingAuthenticationConstraints,\n} as const;\n\nexport const requiredSignedValidityConstraints = {\n  tombstoneOwner: \"unique(tombstone.moduleId,tombstone.subjectId,tombstone.sessionId)\",\n} as const;\n\nexport type RequiredSessionConstraints = typeof requiredSessionConstraints;\n\nexport type RequiredPendingAuthenticationConstraints =\n  typeof requiredPendingAuthenticationConstraints;\n\nexport type RequiredStatefulPendingConstraints = typeof requiredStatefulPendingConstraints;\nexport type RequiredSignedValidityConstraints = typeof requiredSignedValidityConstraints;\n\nexport type AuthenticationAuthorityMapping<\n  Claims,\n  Subject extends Table,\n  Credential extends Table,\n  Pending extends Table,\n  NativeSubjectId,\n  Expression extends SqlExpression = SqlExpression,\n> = SessionAuthorityTables<Subject, Credential, NativeSubjectId> &\n  SessionExecution<Expression> &\n  (\n    | { readonly pending?: undefined }\n    | {\n        readonly pending: PendingAuthenticationTables<Claims, Pending, NativeSubjectId>;\n        readonly constraints: RequiredPendingAuthenticationConstraints;\n      }\n  );\n\nexport type StatefulSessionMapping<\n  Claims,\n  Subject extends Table,\n  Credential extends Table,\n  Session extends Table,\n  Pending extends Table,\n  NativeSubjectId,\n  NativeSessionId,\n  Expression extends SqlExpression = SqlExpression,\n> = SessionAuthorityTables<Subject, Credential, NativeSubjectId> &\n  StatefulSessionTables<Claims, Session, NativeSubjectId, NativeSessionId> &\n  SessionExecution<Expression> &\n  (\n    | { readonly pending?: undefined; readonly constraints: RequiredSessionConstraints }\n    | {\n        readonly pending: PendingAuthenticationTables<Claims, Pending, NativeSubjectId>;\n        readonly constraints: RequiredStatefulPendingConstraints;\n      }\n  );\n\nexport type PendingAuthenticationMapping<\n  Claims,\n  Subject extends Table,\n  Credential extends Table,\n  Pending extends Table,\n  NativeSubjectId,\n  Expression extends SqlExpression = SqlExpression,\n> = SessionAuthorityTables<Subject, Credential, NativeSubjectId> &\n  PendingAuthenticationTables<Claims, Pending, NativeSubjectId> &\n  SessionExecution<Expression> & { readonly constraints: RequiredPendingAuthenticationConstraints };\n\nexport type SignedSessionValidityMapping<\n  Subject extends Table,\n  Tombstone extends Table,\n  NativeSubjectId,\n  NativeSessionId,\n  Expression extends SqlExpression = SqlExpression,\n> = SessionSubjectTables<Subject, NativeSubjectId> &\n  SignedSessionValidityTables<Tombstone, NativeSubjectId, NativeSessionId> &\n  SessionExecution<Expression> & { readonly constraints: RequiredSignedValidityConstraints };\n\n/** Maintenance uses the same mapped rows and one total per-call deletion limit. */\nexport type SessionCleanupMapping<\n  Pending extends Table,\n  Tombstone extends Table,\n  NativeSubjectId,\n  NativeSessionId,\n  Expression extends SqlExpression = SqlExpression,\n> = Pick<SessionExecution<Expression>, \"moduleId\" | \"clock\" | \"d1\"> & {\n  readonly pending?: SessionPendingTables<Pending, NativeSubjectId>[\"pending\"];\n  readonly tombstone?: SignedSessionValidityTables<\n    Tombstone,\n    NativeSubjectId,\n    NativeSessionId\n  >[\"tombstone\"];\n};\n"],"mappings":";AAqLA,MAAa,6BAA6B,EAAE,eAAe,yBAAyB;AAEpF,MAAa,2CAA2C,EACtD,eAAe,yBACjB;AAEA,MAAa,qCAAqC;CAChD,GAAG;CACH,GAAG;AACL;AAEA,MAAa,oCAAoC,EAC/C,gBAAgB,qEAClB"}

package/dist/internal/models/step-up-model.d.mts

@@ -1,66 +1,28 @@
-import { PersistenceMappingError } from "../mapping-error.mjs";
-import { SqlExpression, TableModel } from "../query-operations.mjs";
-import "./common.mjs";
-import { D1SessionClockMapping, SessionAuthorityTables, SessionConstraintClassifier, SessionIdCodec, SignedSessionValidityTables, StatefulSessionTables } from "./session-model.mjs";
-import { DateTime, Effect } from "effect";
-import { SecurityRevision, SessionStepUpIntent } from "@yielded/auth/Sessions";
+import { SqlExpression, TableModel } from "../table-model.mjs";
+import { SessionAuthorityTables, SessionExecution, SessionPendingTables, SignedSessionValidityTables, StatefulSessionTables } from "./session-model.mjs";
 //#region src/internal/models/step-up-model.d.ts
-type ColumnKey<T extends TableModel> = T["column"];
-/** Distinct from login-pending storage. Snapshot is TEXT encoded by the core's
- * SessionStepUpIntent schema; it contains no Claims and needs no consumer decoder. */
-export interface SessionStepUpIntentTables<Intent extends TableModel, NativeSubjectId> {
-  readonly intent: {
-    readonly table: Intent["table"];
-    readonly digest: ColumnKey<Intent>;
-    readonly version: ColumnKey<Intent>;
-    readonly flowId: ColumnKey<Intent>;
-    readonly subjectId: ColumnKey<Intent>;
-    readonly bindingDigest: ColumnKey<Intent>;
-    readonly snapshot: ColumnKey<Intent>;
-    readonly expiresAt: ColumnKey<Intent>;
-    readonly attemptLimit: ColumnKey<Intent>;
-    readonly failedAttempts: ColumnKey<Intent>;
-    readonly consumed: ColumnKey<Intent>;
-    readonly encodeInstant: (instant: DateTime.Utc) => unknown;
-    /** Consumer fields/defaults; the adapter sets all mapped security columns. */
-    readonly encodeInsert: (intent: SessionStepUpIntent, input: {
-      readonly subjectId: NativeSubjectId;
-    }) => Intent["insert"];
-    readonly allocateVersion?: Effect.Effect<SecurityRevision, PersistenceMappingError>;
-    readonly allocateVersionSync?: () => SecurityRevision;
-  };
-}
-export interface RequiredSessionStepUpConstraints {
-  readonly intentDigest: "unique(intent.digest)";
-  readonly intentFlow: "unique(intent.flowId)";
-}
-export declare const requiredSessionStepUpConstraints: RequiredSessionStepUpConstraints;
-/** Fixed source discriminator is checked against every stored intent. A minimal
- * pure-signed installation does not provide dummy session or tombstone tables. */
+export declare const requiredSessionStepUpConstraints: {
+  readonly pendingDigest: "unique(pending.digest)";
+};
+export type RequiredSessionStepUpConstraints = typeof requiredSessionStepUpConstraints;
+/** Stateful metadata is decoded from the exact inspected digest's record. No
+ * duplicate credentialVersion/authenticatedAt columns or row-version CAS. */
 export type SessionStepUpSourceTables<Claims, Session extends TableModel, Tombstone extends TableModel, NativeSubjectId, NativeSessionId> = {
   readonly kind: "StatelessSigned";
 } | ({
   readonly kind: "StateAssistedSigned";
   readonly constraints: {
-    readonly tombstoneOwner: "unique(tombstone.subjectId,tombstone.sessionId)";
+    readonly tombstoneOwner: "unique(tombstone.moduleId,tombstone.subjectId,tombstone.sessionId)";
   };
-} & SignedSessionValidityTables<Tombstone, NativeSubjectId, NativeSessionId>) | {
+} & SignedSessionValidityTables<Tombstone, NativeSubjectId, NativeSessionId>) | ({
   readonly kind: "Stateful";
   readonly constraints: {
     readonly sessionDigest: "unique(session.digest)";
   };
-  readonly sessionId: SessionIdCodec<NativeSessionId>;
-  /** encodeRotation must replace Claims, provenance, and the queryable security
-   * fields together; it must not retain the old proof payload. */
-  readonly session: StatefulSessionTables<Claims, Session, TableModel, NativeSubjectId, NativeSessionId>["session"] & {
-    readonly credentialVersion: ColumnKey<Session>;
-    readonly authenticatedAt: ColumnKey<Session>;
-  };
-};
-export type SessionStepUpMapping<Claims, Subject extends TableModel, Credential extends TableModel, Intent extends TableModel, Session extends TableModel, Tombstone extends TableModel, NativeSubjectId, NativeSessionId> = SessionAuthorityTables<Subject, Credential, NativeSubjectId> & SessionStepUpIntentTables<Intent, NativeSubjectId> & SessionConstraintClassifier & {
+} & StatefulSessionTables<Claims, Session, NativeSubjectId, NativeSessionId>);
+export type SessionStepUpMapping<Claims, Subject extends TableModel, Credential extends TableModel, Pending extends TableModel, Session extends TableModel, Tombstone extends TableModel, NativeSubjectId, NativeSessionId, Expression extends SqlExpression = SqlExpression> = SessionAuthorityTables<Subject, Credential, NativeSubjectId> & SessionPendingTables<Pending, NativeSubjectId> & SessionExecution<Expression> & {
   readonly source: SessionStepUpSourceTables<Claims, Session, Tombstone, NativeSubjectId, NativeSessionId>;
   readonly constraints: RequiredSessionStepUpConstraints;
 };
-export type D1SessionStepUpMapping<Claims, Subject extends TableModel, Credential extends TableModel, Intent extends TableModel, Session extends TableModel, Tombstone extends TableModel, NativeSubjectId, NativeSessionId, Expression extends SqlExpression = SqlExpression> = SessionStepUpMapping<Claims, Subject, Credential, Intent, Session, Tombstone, NativeSubjectId, NativeSessionId> & D1SessionClockMapping<Expression>;
 //#endregion
 //# sourceMappingURL=step-up-model.d.mts.map

package/dist/internal/models/step-up-model.mjs

@@ -1,8 +1,6 @@
+import { requiredPendingAuthenticationConstraints } from "./session-model.mjs";
 //#region src/internal/models/step-up-model.ts
-const requiredSessionStepUpConstraints = {
-	intentDigest: "unique(intent.digest)",
-	intentFlow: "unique(intent.flowId)"
-};
+const requiredSessionStepUpConstraints = requiredPendingAuthenticationConstraints;
 //#endregion
 export { requiredSessionStepUpConstraints };
 

package/dist/internal/models/step-up-model.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"step-up-model.mjs","names":[],"sources":["../../../src/internal/models/step-up-model.ts"],"sourcesContent":["import type { SecurityRevision, SessionStepUpIntent } from \"@yielded/auth/Sessions\";\nimport type { DateTime, Effect } from \"effect\";\n\nimport type { TableModel as Table, SqlExpression } from \"../query-operations\";\nimport type { PersistenceMappingError } from \"./common\";\nimport type {\n  D1SessionClockMapping,\n  SessionAuthorityTables,\n  SessionConstraintClassifier,\n  SessionIdCodec,\n  SignedSessionValidityTables,\n  StatefulSessionTables,\n} from \"./session-model\";\n\ntype ColumnKey<T extends Table> = T[\"column\"];\n\n/** Distinct from login-pending storage. Snapshot is TEXT encoded by the core's\n * SessionStepUpIntent schema; it contains no Claims and needs no consumer decoder. */\nexport interface SessionStepUpIntentTables<Intent extends Table, NativeSubjectId> {\n  readonly intent: {\n    readonly table: Intent[\"table\"];\n    readonly digest: ColumnKey<Intent>;\n    readonly version: ColumnKey<Intent>;\n    readonly flowId: ColumnKey<Intent>;\n    readonly subjectId: ColumnKey<Intent>;\n    readonly bindingDigest: ColumnKey<Intent>;\n    readonly snapshot: ColumnKey<Intent>;\n    readonly expiresAt: ColumnKey<Intent>;\n    readonly attemptLimit: ColumnKey<Intent>;\n    readonly failedAttempts: ColumnKey<Intent>;\n    readonly consumed: ColumnKey<Intent>;\n    readonly encodeInstant: (instant: DateTime.Utc) => unknown;\n    /** Consumer fields/defaults; the adapter sets all mapped security columns. */\n    readonly encodeInsert: (\n      intent: SessionStepUpIntent,\n      input: {\n        readonly subjectId: NativeSubjectId;\n      },\n    ) => Intent[\"insert\"];\n    readonly allocateVersion?: Effect.Effect<SecurityRevision, PersistenceMappingError>;\n    readonly allocateVersionSync?: () => SecurityRevision;\n  };\n}\n\nexport interface RequiredSessionStepUpConstraints {\n  readonly intentDigest: \"unique(intent.digest)\";\n  readonly intentFlow: \"unique(intent.flowId)\";\n}\n\nexport const requiredSessionStepUpConstraints: RequiredSessionStepUpConstraints = {\n  intentDigest: \"unique(intent.digest)\",\n  intentFlow: \"unique(intent.flowId)\",\n};\n\n/** Fixed source discriminator is checked against every stored intent. A minimal\n * pure-signed installation does not provide dummy session or tombstone tables. */\nexport type SessionStepUpSourceTables<\n  Claims,\n  Session extends Table,\n  Tombstone extends Table,\n  NativeSubjectId,\n  NativeSessionId,\n> =\n  | {\n      readonly kind: \"StatelessSigned\";\n    }\n  | ({\n      readonly kind: \"StateAssistedSigned\";\n      readonly constraints: {\n        readonly tombstoneOwner: \"unique(tombstone.subjectId,tombstone.sessionId)\";\n      };\n    } & SignedSessionValidityTables<Tombstone, NativeSubjectId, NativeSessionId>)\n  | {\n      readonly kind: \"Stateful\";\n      readonly constraints: {\n        readonly sessionDigest: \"unique(session.digest)\";\n      };\n      readonly sessionId: SessionIdCodec<NativeSessionId>;\n      /** encodeRotation must replace Claims, provenance, and the queryable security\n       * fields together; it must not retain the old proof payload. */\n      readonly session: StatefulSessionTables<\n        Claims,\n        Session,\n        Table,\n        NativeSubjectId,\n        NativeSessionId\n      >[\"session\"] & {\n        readonly credentialVersion: ColumnKey<Session>;\n        readonly authenticatedAt: ColumnKey<Session>;\n      };\n    };\n\nexport type SessionStepUpMapping<\n  Claims,\n  Subject extends Table,\n  Credential extends Table,\n  Intent extends Table,\n  Session extends Table,\n  Tombstone extends Table,\n  NativeSubjectId,\n  NativeSessionId,\n> = SessionAuthorityTables<Subject, Credential, NativeSubjectId> &\n  SessionStepUpIntentTables<Intent, NativeSubjectId> &\n  SessionConstraintClassifier & {\n    readonly source: SessionStepUpSourceTables<\n      Claims,\n      Session,\n      Tombstone,\n      NativeSubjectId,\n      NativeSessionId\n    >;\n    readonly constraints: RequiredSessionStepUpConstraints;\n  };\n\nexport type D1SessionStepUpMapping<\n  Claims,\n  Subject extends Table,\n  Credential extends Table,\n  Intent extends Table,\n  Session extends Table,\n  Tombstone extends Table,\n  NativeSubjectId,\n  NativeSessionId,\n  Expression extends SqlExpression = SqlExpression,\n> = SessionStepUpMapping<\n  Claims,\n  Subject,\n  Credential,\n  Intent,\n  Session,\n  Tombstone,\n  NativeSubjectId,\n  NativeSessionId\n> &\n  D1SessionClockMapping<Expression>;\n"],"mappings":";AAiDA,MAAa,mCAAqE;CAChF,cAAc;CACd,YAAY;AACd"}
+{"version":3,"file":"step-up-model.mjs","names":[],"sources":["../../../src/internal/models/step-up-model.ts"],"sourcesContent":["import type { TableModel as Table, SqlExpression } from \"../table-model\";\nimport type {\n  SessionAuthorityTables,\n  SessionExecution,\n  SessionPendingTables,\n  SignedSessionValidityTables,\n  StatefulSessionTables,\n} from \"./session-model\";\nimport { requiredPendingAuthenticationConstraints } from \"./session-model\";\n\nexport const requiredSessionStepUpConstraints = requiredPendingAuthenticationConstraints;\nexport type RequiredSessionStepUpConstraints = typeof requiredSessionStepUpConstraints;\n\n/** Stateful metadata is decoded from the exact inspected digest's record. No\n * duplicate credentialVersion/authenticatedAt columns or row-version CAS. */\nexport type SessionStepUpSourceTables<\n  Claims,\n  Session extends Table,\n  Tombstone extends Table,\n  NativeSubjectId,\n  NativeSessionId,\n> =\n  | { readonly kind: \"StatelessSigned\" }\n  | ({\n      readonly kind: \"StateAssistedSigned\";\n      readonly constraints: {\n        readonly tombstoneOwner: \"unique(tombstone.moduleId,tombstone.subjectId,tombstone.sessionId)\";\n      };\n    } & SignedSessionValidityTables<Tombstone, NativeSubjectId, NativeSessionId>)\n  | ({\n      readonly kind: \"Stateful\";\n      readonly constraints: { readonly sessionDigest: \"unique(session.digest)\" };\n    } & StatefulSessionTables<Claims, Session, NativeSubjectId, NativeSessionId>);\n\nexport type SessionStepUpMapping<\n  Claims,\n  Subject extends Table,\n  Credential extends Table,\n  Pending extends Table,\n  Session extends Table,\n  Tombstone extends Table,\n  NativeSubjectId,\n  NativeSessionId,\n  Expression extends SqlExpression = SqlExpression,\n> = SessionAuthorityTables<Subject, Credential, NativeSubjectId> &\n  SessionPendingTables<Pending, NativeSubjectId> &\n  SessionExecution<Expression> & {\n    readonly source: SessionStepUpSourceTables<\n      Claims,\n      Session,\n      Tombstone,\n      NativeSubjectId,\n      NativeSessionId\n    >;\n    readonly constraints: RequiredSessionStepUpConstraints;\n  };\n"],"mappings":";;AAUA,MAAa,mCAAmC"}

package/dist/internal/models/totp-model.d.mts

@@ -0,0 +1,76 @@
+import { SqlExpression, TableModel } from "../table-model.mjs";
+import { PersistenceMappingError } from "../mapping-error.mjs";
+import { ProofClock } from "./proof-model.mjs";
+import { PendingAuthenticationTables } from "./session-model.mjs";
+import { Effect } from "effect";
+import { AuthenticationRequirement } from "@yielded/auth/Sessions";
+import { SubjectId } from "@yielded/auth/Schema";
+import { TotpPolicy } from "@yielded/auth/Totp";
+//#region src/internal/models/totp-model.d.ts
+export declare const requiredTotpConstraints: {
+  readonly factor: "unique(scope)";
+  readonly credential: "unique(credentialId)";
+  readonly subject: "unique(id)";
+};
+export type TotpMappingSource<M, R = never> = M | Effect.Effect<M, PersistenceMappingError, R>;
+/** One encrypted factor row and the common credential authority. Version protects
+ * accepted-step, failure-budget and recovery-code changes; no command receipts. */
+export interface TotpMapping<S extends TableModel, F extends TableModel, C extends TableModel, N, P extends TableModel = TableModel, Expression extends SqlExpression = SqlExpression> {
+  readonly moduleId: string;
+  readonly policy: TotpPolicy;
+  readonly constraints: typeof requiredTotpConstraints;
+  readonly d1?: {
+    readonly primary: true;
+  };
+  readonly subjectIds: {
+    readonly toNative: (id: SubjectId) => N;
+    readonly toSubject: (id: N) => SubjectId;
+  };
+  readonly subject: {
+    readonly table: S["table"];
+    readonly id: S["column"];
+    readonly securityRevision: S["column"];
+    readonly factorEnabled: S["column"];
+    readonly activeCondition: Expression;
+    readonly encodeEnabled: (enabled: boolean) => unknown;
+    readonly decodeRequirement: (row: S["select"]) => AuthenticationRequirement;
+    /** Required for D1: declare every independently mutable input read by
+     * decodeRequirement. An explicit [] promises a constant requirement. */
+    readonly requirementColumns?: ReadonlyArray<S["column"]>;
+  };
+  readonly factor: {
+    readonly table: F["table"];
+    readonly scope: F["column"];
+    readonly state: F["column"];
+    readonly version: F["column"];
+    readonly encodeInsert: (value: {
+      readonly scope: string;
+      readonly state: string;
+      readonly version: string;
+    }) => F["insert"];
+  };
+  readonly credential: {
+    readonly table: C["table"];
+    readonly id: C["column"];
+    readonly subjectId: C["column"];
+    readonly revision: C["column"];
+    readonly status: C["column"];
+    readonly activeCondition: Expression;
+    readonly encodeStatus: (active: boolean) => unknown;
+    readonly encodeInsert: (value: {
+      readonly credentialId: string;
+      readonly subjectId: N;
+      readonly revision: string;
+      readonly active: boolean;
+    }) => C["insert"];
+  };
+  readonly engineNowMillis: Expression;
+  /** Reset uses the very same Login-kind row owner as pending authentication. */
+  readonly pending?: Omit<PendingAuthenticationTables<unknown, P, N>, "login"> & {
+    readonly login: Pick<PendingAuthenticationTables<unknown, P, N>["login"], "decode">;
+    readonly moduleId: string;
+    readonly clock: ProofClock<Expression>;
+  };
+}
+//#endregion
+//# sourceMappingURL=totp-model.d.mts.map

package/dist/internal/models/totp-model.mjs

@@ -0,0 +1,10 @@
+//#region src/internal/models/totp-model.ts
+const requiredTotpConstraints = {
+	factor: "unique(scope)",
+	credential: "unique(credentialId)",
+	subject: "unique(id)"
+};
+//#endregion
+export { requiredTotpConstraints };
+
+//# sourceMappingURL=totp-model.mjs.map

package/dist/internal/models/totp-model.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp-model.mjs","names":[],"sources":["../../../src/internal/models/totp-model.ts"],"sourcesContent":["import type { SubjectId } from \"@yielded/auth/Schema\";\nimport type { AuthenticationRequirement } from \"@yielded/auth/Sessions\";\nimport type { TotpPolicy } from \"@yielded/auth/Totp\";\nimport type { Effect } from \"effect\";\n\nimport type { PersistenceMappingError } from \"../mapping-error\";\nimport type { TableModel, SqlExpression } from \"../table-model\";\nimport type { ProofClock } from \"./proof-model\";\nimport type { PendingAuthenticationTables } from \"./session-model\";\n\nexport const requiredTotpConstraints = {\n  factor: \"unique(scope)\",\n  credential: \"unique(credentialId)\",\n  subject: \"unique(id)\",\n} as const;\n\nexport type TotpMappingSource<M, R = never> = M | Effect.Effect<M, PersistenceMappingError, R>;\n\n/** One encrypted factor row and the common credential authority. Version protects\n * accepted-step, failure-budget and recovery-code changes; no command receipts. */\nexport interface TotpMapping<\n  S extends TableModel,\n  F extends TableModel,\n  C extends TableModel,\n  N,\n  P extends TableModel = TableModel,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly moduleId: string;\n  readonly policy: TotpPolicy;\n  readonly constraints: typeof requiredTotpConstraints;\n  readonly d1?: { readonly primary: true };\n  readonly subjectIds: {\n    readonly toNative: (id: SubjectId) => N;\n    readonly toSubject: (id: N) => SubjectId;\n  };\n  readonly subject: {\n    readonly table: S[\"table\"];\n    readonly id: S[\"column\"];\n    readonly securityRevision: S[\"column\"];\n    readonly factorEnabled: S[\"column\"];\n    readonly activeCondition: Expression;\n    readonly encodeEnabled: (enabled: boolean) => unknown;\n    readonly decodeRequirement: (row: S[\"select\"]) => AuthenticationRequirement;\n    /** Required for D1: declare every independently mutable input read by\n     * decodeRequirement. An explicit [] promises a constant requirement. */\n    readonly requirementColumns?: ReadonlyArray<S[\"column\"]>;\n  };\n  readonly factor: {\n    readonly table: F[\"table\"];\n    readonly scope: F[\"column\"];\n    readonly state: F[\"column\"];\n    readonly version: F[\"column\"];\n    readonly encodeInsert: (value: {\n      readonly scope: string;\n      readonly state: string;\n      readonly version: string;\n    }) => F[\"insert\"];\n  };\n  readonly credential: {\n    readonly table: C[\"table\"];\n    readonly id: C[\"column\"];\n    readonly subjectId: C[\"column\"];\n    readonly revision: C[\"column\"];\n    readonly status: C[\"column\"];\n    readonly activeCondition: Expression;\n    readonly encodeStatus: (active: boolean) => unknown;\n    readonly encodeInsert: (value: {\n      readonly credentialId: string;\n      readonly subjectId: N;\n      readonly revision: string;\n      readonly active: boolean;\n    }) => C[\"insert\"];\n  };\n  readonly engineNowMillis: Expression;\n  /** Reset uses the very same Login-kind row owner as pending authentication. */\n  readonly pending?: Omit<PendingAuthenticationTables<unknown, P, N>, \"login\"> & {\n    readonly login: Pick<PendingAuthenticationTables<unknown, P, N>[\"login\"], \"decode\">;\n    readonly moduleId: string;\n    readonly clock: ProofClock<Expression>;\n  };\n}\n"],"mappings":";AAUA,MAAa,0BAA0B;CACrC,QAAQ;CACR,YAAY;CACZ,SAAS;AACX"}

package/dist/internal/native-sql-table.d.mts

@@ -1,16 +1,29 @@
-import "./mapping-error.mjs";
-import { PhysicalTextColumn } from "./storage-validation.mjs";
+import { PersistenceMappingError } from "./mapping-error.mjs";
 import { Effect } from "effect";
 import * as Statement$1 from "effect/sql/Statement";
 import { SqlClient } from "effect/sql/SqlClient";
 //#region src/internal/native-sql-table.d.ts
+export interface PhysicalTextColumn {
+  readonly table: {
+    readonly name: string;
+    readonly schema?: string;
+  };
+  readonly name: string;
+}
+/** Capture synchronous mapping callbacks without changing SQL execution errors. */
+export declare const sqlMapping: <A>(thunk: () => A) => Effect.Effect<A, PersistenceMappingError>;
 /** Physical SQL representation only. Semantic row codecs and policy remain in
  * the owning mapping. Execute assembled statements without name/result transforms. */
 export interface SqlTable {
+  readonly keys: ReadonlyArray<string>;
   readonly name: Statement$1.Fragment;
   /** Alias reads only; writes continue to target the original physical table. */
   readonly as: (alias: string) => SqlTable;
   readonly column: (key: string) => Statement$1.Fragment;
+  /** Unqualified physical name for conflict targets and assignment lists. */
+  readonly columnName: (key: string) => Statement$1.Fragment;
+  /** Result projection, including the physical driver's result codec cast. */
+  readonly selectedColumn: (key: string) => Statement$1.Fragment;
   /** Optional codec-free text candidate. Physical type/collation compatibility
    * must still be checked against the database before comparing columns. */
   readonly unencodedTextColumn?: (key: string) => PhysicalTextColumn | undefined;
@@ -23,12 +36,16 @@ export interface SqlTable {
   /** Complete UPDATE ... SET prefix; the owning operation supplies its predicate. */
   readonly update: (values: Readonly<Record<string, unknown>>) => Statement$1.Fragment;
 }
-export type NativeSqlTables = (table: object) => SqlTable;
+export interface NativeSqlTables {
+  (table: object): SqlTable;
+  /** Compile a mapped predicate without executing it or acquiring resources. */
+  readonly expression: (value: unknown) => Statement$1.Fragment;
+}
 /** Prefixes are short ASCII identifiers so ordinal aliases cannot be truncated
  * by PostgreSQL. Callers distinguish tables by prefix, never by physical names. */
 export declare const nativeSqlAlias: (prefix: string, index: number) => string;
 /** Cache physical metadata only; insert/update materialize values and hooks at
  * each call. Construction acquires no client and owns no transaction. */
-export declare const makeNativeSqlTables: (client: SqlClient, convert?: (client: SqlClient, table: object) => SqlTable) => NativeSqlTables;
+export declare const makeNativeSqlTables: (client: SqlClient, convert?: (client: SqlClient, table: object) => SqlTable, expression?: NativeSqlTables["expression"]) => NativeSqlTables;
 //#endregion
 //# sourceMappingURL=native-sql-table.d.mts.map