@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.27

package/dist/internal/session-native-authority.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-native-authority.mjs","names":[],"sources":["../../src/internal/session-native-authority.ts"],"sourcesContent":["import { type LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport {\n  type AuthenticationAuthority,\n  StaleAuthentication,\n  PendingAuthenticationInvalid,\n  type AuthenticationEvidence,\n  type PendingConsumption,\n  type AuthenticationRequirement,\n} from \"@yielded/auth/Sessions\";\nimport { DateTime, Effect, Option } from \"effect\";\nimport type { SqlClient } from \"effect/sql/SqlClient\";\n\nimport { sqlBatchAssertion } from \"./d1-planning\";\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport type { AuthenticationAuthorityMapping } from \"./models/session-model\";\nimport type { NativeSqlTables } from \"./native-sql-table\";\nimport { makeNativeSessionPending, prepareNativeSession } from \"./session-native-pending\";\nimport {\n  makeNativeSessionAuthorityState,\n  normalizeSessionOperation,\n  sessionUnavailable,\n  sameSessionRevision,\n  assessSessionAt,\n} from \"./session-native-state\";\nimport { preservesRevision } from \"./session-policy\";\nimport {\n  CurrentSqlCommit,\n  makeSqlCommitExecutor,\n  SqlBatchCommit,\n  registerSqlPostcondition,\n  registerSqlBatchPostcondition,\n  appendSqlBatchStatement,\n} from \"./sql-commit\";\nimport type { AnyTableModel } from \"./table-model\";\n\nexport type NativeAuthenticationAuthorityMapping<Claims> = AuthenticationAuthorityMapping<\n  Claims,\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  unknown\n>;\n\nexport const sessionEvidenceDeadline = Effect.fnUntraced(function* (\n  evidence: AuthenticationEvidence,\n  requirement: AuthenticationRequirement,\n  now: number,\n) {\n  const assessed = yield* assessSessionAt(evidence, requirement, now);\n\n  if (!assessed.satisfied) return yield* StaleAuthentication.make({});\n\n  const boundaries = [\n    ...new Set(\n      evidence.proofs.map(\n        (proof) => DateTime.toEpochMillis(proof.verifiedAt) + requirement.maximumAgeMillis,\n      ),\n    ),\n  ]\n    .filter((n) => n > now)\n    .sort((a, b) => a - b);\n\n  for (const boundary of boundaries) {\n    const after = yield* assessSessionAt(evidence, requirement, boundary).pipe(Effect.result);\n\n    if (after._tag === \"Failure\" || !after.success.satisfied)\n      return { assessed, validUntil: boundary };\n  }\n\n  return yield* StaleAuthentication.make({});\n});\n\nexport const makeNativeAuthenticationAuthorityServices = Effect.fnUntraced(function* <Claims>(\n  tables: NativeSqlTables,\n  mapping: NativeAuthenticationAuthorityMapping<Claims>,\n): Effect.fn.Return<\n  { readonly authenticationAuthority: AuthenticationAuthority[\"Service\"] },\n  never,\n  SqlClient | LifecycleHooks | SqlBatchCommit\n> {\n  const batch = yield* SqlBatchCommit;\n\n  const state = yield* makeNativeSessionAuthorityState(tables, mapping, batch !== undefined);\n  const executor = yield* makeSqlCommitExecutor(sessionUnavailable);\n  const external = yield* Effect.serviceOption(CurrentSqlCommit);\n\n  const pending =\n    mapping.pending === undefined\n      ? undefined\n      : yield* makeNativeSessionPending(\n          tables,\n          { ...mapping, ...mapping.pending },\n          batch !== undefined,\n        );\n\n  const { sql, now } = state;\n\n  const readEvidence = Effect.fnUntraced(function* (\n    evidence: AuthenticationEvidence,\n    locking: boolean,\n  ) {\n    const current = yield* state.read(evidence.revision.subjectId, locking);\n\n    return current !== undefined && sameSessionRevision(current.revision, evidence.revision)\n      ? current\n      : undefined;\n  });\n\n  const consume = Effect.fnUntraced(function* (\n    input: PendingConsumption,\n    evidence: AuthenticationEvidence,\n    native: unknown,\n  ) {\n    if (pending === undefined || mapping.pending === undefined)\n      return yield* PendingAuthenticationInvalid.make({});\n    const found = yield* pending.read(\"Login\", input.digest);\n\n    if (\n      found === undefined ||\n      found.record.version !== input.version ||\n      found.record.flowId !== input.flowId ||\n      found.record.bindingDigest !== input.bindingDigest ||\n      found.record.subjectId !== evidence.revision.subjectId\n    )\n      return yield* PendingAuthenticationInvalid.make({});\n    const original = yield* mapping.pending.login.decode(found.record.snapshot);\n\n    if (\n      original.digest !== input.digest ||\n      original.version !== input.version ||\n      !preservesRevision(evidence, original.evidence) ||\n      DateTime.toEpochMillis(original.expiresAt) !== found.record.expiresAtMillis ||\n      original.attemptLimit !== found.record.attemptLimit\n    )\n      return yield* PendingAuthenticationInvalid.make({});\n    yield* pending.consume(\"Login\", input, native);\n\n    return found.record.expiresAtMillis;\n  });\n\n  const native = <A, E, R>(work: Effect.Effect<A, E, R>) =>\n    batch === undefined\n      ? executor.operation(normalizeSessionOperation(work))\n      : executor\n          .operationBatch(normalizeSessionOperation(work))\n          .pipe(Effect.provideService(SqlBatchCommit, batch));\n\n  const authenticationAuthority: AuthenticationAuthority[\"Service\"] = {\n    capture: (subjectId, credentialIds) =>\n      executor\n        .read(state.read(subjectId))\n        .pipe(\n          Effect.flatMap((current) =>\n            current === undefined ||\n            new Set(credentialIds).size !== credentialIds.length ||\n            credentialIds.some(\n              (id) => !current.revision.credentials.some((f) => f.credentialId === id),\n            )\n              ? Effect.fail(StaleAuthentication.make({}))\n              : Effect.succeed({ revision: current.revision, requirement: current.requirement }),\n          ),\n        ),\n    requirements: (evidence) =>\n      executor\n        .read(readEvidence(evidence, false))\n        .pipe(\n          Effect.flatMap((current) =>\n            current === undefined\n              ? Effect.fail(StaleAuthentication.make({}))\n              : Effect.succeed(current.requirement),\n          ),\n        ),\n    approve: (input, project) =>\n      native(\n        Effect.gen(function* () {\n          const current = yield* readEvidence(input.evidence, true);\n\n          if (current === undefined) return yield* StaleAuthentication.make({});\n\n          const assessment = yield* sessionEvidenceDeadline(\n            input.evidence,\n            current.requirement,\n            current.now,\n          );\n\n          const expires = DateTime.toEpochMillis(input.expiresAt),\n            absolute = DateTime.toEpochMillis(input.absoluteExpiresAt);\n\n          if (current.now >= expires || expires > absolute)\n            return yield* StaleAuthentication.make({});\n\n          const pendingExpiry =\n            input.pending === undefined\n              ? undefined\n              : yield* consume(input.pending, input.evidence, current.native);\n\n          const deadline = Math.min(assessment.validUntil, expires, pendingExpiry ?? Infinity);\n          const condition = sql`${state.authorityCondition(current.revision, current.native)} and ${state.policyCondition(current.row, current.native)} and ${now} >= ${current.now} and ${now} < ${deadline}`;\n\n          if (batch !== undefined) {\n            yield* appendSqlBatchStatement(sqlBatchAssertion(sql, condition));\n            yield* registerSqlBatchPostcondition({\n              name: \"signed-session-issuance-authority\",\n              statement: sqlBatchAssertion(\n                sql,\n                input.pending === undefined || pending === undefined\n                  ? condition\n                  : sql`${condition} and ${pending.consumedCondition(\"Login\", input.pending, current.native)}`,\n              ),\n            });\n          } else if (Option.isSome(external)) {\n            yield* registerSqlPostcondition({\n              name: \"signed-session-issuance-authority\",\n              check: Effect.gen(function* () {\n                const final = yield* readEvidence(input.evidence, false);\n\n                if (final === undefined || final.now < current.now || final.now >= deadline)\n                  return yield* StaleAuthentication.make({});\n                yield* sessionEvidenceDeadline(input.evidence, final.requirement, final.now);\n                if (input.pending !== undefined && pending !== undefined) {\n                  const rows =\n                    yield* sql`select 1 where ${pending.consumedCondition(\"Login\", input.pending, current.native)}`;\n\n                  if (rows.length !== 1) return yield* PendingAuthenticationInvalid.make({});\n                }\n              }).pipe(\n                Effect.mapError((cause) =>\n                  PersistenceMappingError.make({ operation: \"decode\", cause }),\n                ),\n              ),\n            });\n          } else {\n            // A signed credential has no session INSERT that can enforce the\n            // original evidence deadline. Check that deadline at this owner.\n            const rows =\n              yield* sql`select 1 where ${now} >= ${current.now} and ${now} < ${deadline}`;\n\n            if (rows.length !== 1) return yield* StaleAuthentication.make({});\n          }\n\n          return yield* prepareNativeSession(undefined, project);\n        }),\n      ),\n  };\n\n  return { authenticationAuthority };\n});\n"],"mappings":";;;;;;;;;;AA2CA,MAAa,0BAA0B,OAAO,WAAW,WACvD,UACA,aACA,KACA;CACA,MAAM,WAAW,OAAO,gBAAgB,UAAU,aAAa,GAAG;CAElE,IAAI,CAAC,SAAS,WAAW,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;CAElE,MAAM,aAAa,CACjB,GAAG,IAAI,IACL,SAAS,OAAO,KACb,UAAU,SAAS,cAAc,MAAM,UAAU,IAAI,YAAY,gBACpE,CACF,CACF,CAAC,CACE,QAAQ,MAAM,IAAI,GAAG,CAAC,CACtB,MAAM,GAAG,MAAM,IAAI,CAAC;CAEvB,KAAK,MAAM,YAAY,YAAY;EACjC,MAAM,QAAQ,OAAO,gBAAgB,UAAU,aAAa,QAAQ,CAAC,CAAC,KAAK,OAAO,MAAM;EAExF,IAAI,MAAM,SAAS,aAAa,CAAC,MAAM,QAAQ,WAC7C,OAAO;GAAE;GAAU,YAAY;EAAS;CAC5C;CAEA,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;AAC3C,CAAC;AAED,MAAa,4CAA4C,OAAO,WAAW,WACzE,QACA,SAKA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,QAAQ,OAAO,gCAAgC,QAAQ,SAAS,UAAU,KAAA,CAAS;CACzF,MAAM,WAAW,OAAO,sBAAsB,kBAAkB;CAChE,MAAM,WAAW,OAAO,OAAO,cAAc,gBAAgB;CAE7D,MAAM,UACJ,QAAQ,YAAY,KAAA,IAChB,KAAA,IACA,OAAO,yBACL,QACA;EAAE,GAAG;EAAS,GAAG,QAAQ;CAAQ,GACjC,UAAU,KAAA,CACZ;CAEN,MAAM,EAAE,KAAK,QAAQ;CAErB,MAAM,eAAe,OAAO,WAAW,WACrC,UACA,SACA;EACA,MAAM,UAAU,OAAO,MAAM,KAAK,SAAS,SAAS,WAAW,OAAO;EAEtE,OAAO,YAAY,KAAA,KAAa,oBAAoB,QAAQ,UAAU,SAAS,QAAQ,IACnF,UACA,KAAA;CACN,CAAC;CAED,MAAM,UAAU,OAAO,WAAW,WAChC,OACA,UACA,QACA;EACA,IAAI,YAAY,KAAA,KAAa,QAAQ,YAAY,KAAA,GAC/C,OAAO,OAAO,6BAA6B,KAAK,CAAC,CAAC;EACpD,MAAM,QAAQ,OAAO,QAAQ,KAAK,SAAS,MAAM,MAAM;EAEvD,IACE,UAAU,KAAA,KACV,MAAM,OAAO,YAAY,MAAM,WAC/B,MAAM,OAAO,WAAW,MAAM,UAC9B,MAAM,OAAO,kBAAkB,MAAM,iBACrC,MAAM,OAAO,cAAc,SAAS,SAAS,WAE7C,OAAO,OAAO,6BAA6B,KAAK,CAAC,CAAC;EACpD,MAAM,WAAW,OAAO,QAAQ,QAAQ,MAAM,OAAO,MAAM,OAAO,QAAQ;EAE1E,IACE,SAAS,WAAW,MAAM,UAC1B,SAAS,YAAY,MAAM,WAC3B,CAAC,kBAAkB,UAAU,SAAS,QAAQ,KAC9C,SAAS,cAAc,SAAS,SAAS,MAAM,MAAM,OAAO,mBAC5D,SAAS,iBAAiB,MAAM,OAAO,cAEvC,OAAO,OAAO,6BAA6B,KAAK,CAAC,CAAC;EACpD,OAAO,QAAQ,QAAQ,SAAS,OAAO,MAAM;EAE7C,OAAO,MAAM,OAAO;CACtB,CAAC;CAED,MAAM,UAAmB,SACvB,UAAU,KAAA,IACN,SAAS,UAAU,0BAA0B,IAAI,CAAC,IAClD,SACG,eAAe,0BAA0B,IAAI,CAAC,CAAC,CAC/C,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CAoG1D,OAAO,EAAE,yBAAA;EAjGP,UAAU,WAAW,kBACnB,SACG,KAAK,MAAM,KAAK,SAAS,CAAC,CAAC,CAC3B,KACC,OAAO,SAAS,YACd,YAAY,KAAA,KACZ,IAAI,IAAI,aAAa,CAAC,CAAC,SAAS,cAAc,UAC9C,cAAc,MACX,OAAO,CAAC,QAAQ,SAAS,YAAY,MAAM,MAAM,EAAE,iBAAiB,EAAE,CACzE,IACI,OAAO,KAAK,oBAAoB,KAAK,CAAC,CAAC,CAAC,IACxC,OAAO,QAAQ;GAAE,UAAU,QAAQ;GAAU,aAAa,QAAQ;EAAY,CAAC,CACrF,CACF;EACJ,eAAe,aACb,SACG,KAAK,aAAa,UAAU,KAAK,CAAC,CAAC,CACnC,KACC,OAAO,SAAS,YACd,YAAY,KAAA,IACR,OAAO,KAAK,oBAAoB,KAAK,CAAC,CAAC,CAAC,IACxC,OAAO,QAAQ,QAAQ,WAAW,CACxC,CACF;EACJ,UAAU,OAAO,YACf,OACE,OAAO,IAAI,aAAa;GACtB,MAAM,UAAU,OAAO,aAAa,MAAM,UAAU,IAAI;GAExD,IAAI,YAAY,KAAA,GAAW,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;GAEpE,MAAM,aAAa,OAAO,wBACxB,MAAM,UACN,QAAQ,aACR,QAAQ,GACV;GAEA,MAAM,UAAU,SAAS,cAAc,MAAM,SAAS,GACpD,WAAW,SAAS,cAAc,MAAM,iBAAiB;GAE3D,IAAI,QAAQ,OAAO,WAAW,UAAU,UACtC,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;GAE3C,MAAM,gBACJ,MAAM,YAAY,KAAA,IACd,KAAA,IACA,OAAO,QAAQ,MAAM,SAAS,MAAM,UAAU,QAAQ,MAAM;GAElE,MAAM,WAAW,KAAK,IAAI,WAAW,YAAY,SAAS,iBAAiB,QAAQ;GACnF,MAAM,YAAY,GAAG,GAAG,MAAM,mBAAmB,QAAQ,UAAU,QAAQ,MAAM,EAAE,OAAO,MAAM,gBAAgB,QAAQ,KAAK,QAAQ,MAAM,EAAE,OAAO,IAAI,MAAM,QAAQ,IAAI,OAAO,IAAI,KAAK;GAE1L,IAAI,UAAU,KAAA,GAAW;IACvB,OAAO,wBAAwB,kBAAkB,KAAK,SAAS,CAAC;IAChE,OAAO,8BAA8B;KACnC,MAAM;KACN,WAAW,kBACT,KACA,MAAM,YAAY,KAAA,KAAa,YAAY,KAAA,IACvC,YACA,GAAG,GAAG,UAAU,OAAO,QAAQ,kBAAkB,SAAS,MAAM,SAAS,QAAQ,MAAM,GAC7F;IACF,CAAC;GACH,OAAO,IAAI,OAAO,OAAO,QAAQ,GAC/B,OAAO,yBAAyB;IAC9B,MAAM;IACN,OAAO,OAAO,IAAI,aAAa;KAC7B,MAAM,QAAQ,OAAO,aAAa,MAAM,UAAU,KAAK;KAEvD,IAAI,UAAU,KAAA,KAAa,MAAM,MAAM,QAAQ,OAAO,MAAM,OAAO,UACjE,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;KAC3C,OAAO,wBAAwB,MAAM,UAAU,MAAM,aAAa,MAAM,GAAG;KAC3E,IAAI,MAAM,YAAY,KAAA,KAAa,YAAY,KAAA,GAIzC;WAAA,OAFK,GAAG,kBAAkB,QAAQ,kBAAkB,SAAS,MAAM,SAAS,QAAQ,MAAM,IAAA,CAErF,WAAW,GAAG,OAAO,OAAO,6BAA6B,KAAK,CAAC,CAAC;KAAA;IAE7E,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,UACf,wBAAwB,KAAK;KAAE,WAAW;KAAU;IAAM,CAAC,CAC7D,CACF;GACF,CAAC;QAOD,KAAI,OAFK,GAAG,kBAAkB,IAAI,MAAM,QAAQ,IAAI,OAAO,IAAI,KAAK,WAAA,CAE3D,WAAW,GAAG,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;GAGlE,OAAO,OAAO,qBAAqB,KAAA,GAAW,OAAO;EACvD,CAAC,CACH;CAG2B,EAAE;AACnC,CAAC"}

package/dist/internal/session-native-cleanup.d.mts

@@ -0,0 +1,14 @@
+import { AnyTableModel } from "./table-model.mjs";
+import { SessionCleanupMapping } from "./models/session-model.mjs";
+import { NativeSqlTables } from "./native-sql-table.mjs";
+import { SqlBatchCommit } from "./sql-commit.mjs";
+import { Effect } from "effect";
+import { LifecycleHooks } from "@yielded/auth/Hooks";
+import { SessionCleanup } from "@yielded/auth/Sessions";
+import { SqlClient } from "effect/sql/SqlClient";
+//#region src/internal/session-native-cleanup.d.ts
+export declare const makeNativeSessionCleanupServices: (tables: NativeSqlTables, mapping: SessionCleanupMapping<AnyTableModel, AnyTableModel, unknown, unknown>) => Effect.Effect<{
+  readonly sessionCleanup: SessionCleanup;
+}, never, LifecycleHooks | SqlBatchCommit | SqlClient>;
+//#endregion
+//# sourceMappingURL=session-native-cleanup.d.mts.map

package/dist/internal/session-native-cleanup.mjs

@@ -0,0 +1,48 @@
+import { exactSqlText } from "./sql-change.mjs";
+import { SqlBatchCommit, makeSqlCommitExecutor } from "./sql-commit.mjs";
+import { cleanupSqlRows } from "./sql-cleanup.mjs";
+import { sessionUnavailable } from "./session-native-state.mjs";
+import { Effect } from "effect";
+import { SqlClient } from "effect/sql/SqlClient";
+//#region src/internal/session-native-cleanup.ts
+const makeNativeSessionCleanupServices = Effect.fnUntraced(function* (tables, mapping) {
+	const batch = yield* SqlBatchCommit;
+	const sql = (yield* SqlClient).withoutTransforms();
+	const executor = yield* makeSqlCommitExecutor(sessionUnavailable);
+	const now = tables.expression(mapping.clock.engineNowMillis);
+	const candidates = [];
+	if (mapping.pending !== void 0) {
+		const p = mapping.pending, table = tables(p.table);
+		candidates.push({
+			table,
+			keys: [p.digest],
+			due: sql`${exactSqlText(sql, table.column(p.moduleId), table.value(p.moduleId, mapping.moduleId))} and ${tables.expression(mapping.clock.toMillis(table.column(p.expiresAt)))} <= ${now}`,
+			order: [table.column(p.expiresAt), table.column(p.digest)]
+		});
+	}
+	if (mapping.tombstone !== void 0) {
+		const t = mapping.tombstone, table = tables(t.table);
+		candidates.push({
+			table,
+			keys: [
+				t.moduleId,
+				t.subjectId,
+				t.sessionId
+			],
+			due: sql`${exactSqlText(sql, table.column(t.moduleId), table.value(t.moduleId, mapping.moduleId))} and ${tables.expression(mapping.clock.toMillis(table.column(t.absoluteExpiresAt)))} <= ${now}`,
+			order: [table.column(t.absoluteExpiresAt), table.column(t.sessionId)]
+		});
+	}
+	return { sessionCleanup: { cleanup: ({ limit }) => {
+		if (candidates.length === 0) return executor.read(Effect.succeed({
+			removed: 0,
+			hasMore: false
+		}));
+		const work = cleanupSqlRows(candidates, limit, batch !== void 0);
+		return batch === void 0 ? executor.run(work, candidates.length > 1 ? "transaction" : "statement") : executor.batch(work).pipe(Effect.provideService(SqlBatchCommit, batch));
+	} } };
+});
+//#endregion
+export { makeNativeSessionCleanupServices };
+
+//# sourceMappingURL=session-native-cleanup.mjs.map

package/dist/internal/session-native-cleanup.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-native-cleanup.mjs","names":[],"sources":["../../src/internal/session-native-cleanup.ts"],"sourcesContent":["import type { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport type { SessionCleanup } from \"@yielded/auth/Sessions\";\nimport { Effect } from \"effect\";\nimport { SqlClient } from \"effect/sql/SqlClient\";\n\nimport type { SessionCleanupMapping } from \"./models/session-model\";\nimport type { NativeSqlTables } from \"./native-sql-table\";\nimport { sessionUnavailable } from \"./session-native-state\";\nimport { exactSqlText } from \"./sql-change\";\nimport { cleanupSqlRows, type SqlCleanupTable } from \"./sql-cleanup\";\nimport { makeSqlCommitExecutor, SqlBatchCommit } from \"./sql-commit\";\nimport type { AnyTableModel } from \"./table-model\";\n\nexport const makeNativeSessionCleanupServices = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: SessionCleanupMapping<AnyTableModel, AnyTableModel, unknown, unknown>,\n): Effect.fn.Return<\n  { readonly sessionCleanup: SessionCleanup },\n  never,\n  SqlClient | LifecycleHooks | SqlBatchCommit\n> {\n  const batch = yield* SqlBatchCommit;\n\n  const sql = (yield* SqlClient).withoutTransforms();\n  const executor = yield* makeSqlCommitExecutor(sessionUnavailable);\n  const now = tables.expression(mapping.clock.engineNowMillis);\n  const candidates: SqlCleanupTable[] = [];\n\n  if (mapping.pending !== undefined) {\n    const p = mapping.pending,\n      table = tables(p.table);\n\n    candidates.push({\n      table,\n      keys: [p.digest],\n      due: sql`${exactSqlText(sql, table.column(p.moduleId), table.value(p.moduleId, mapping.moduleId))} and ${tables.expression(mapping.clock.toMillis(table.column(p.expiresAt)))} <= ${now}`,\n      order: [table.column(p.expiresAt), table.column(p.digest)],\n    });\n  }\n  if (mapping.tombstone !== undefined) {\n    const t = mapping.tombstone,\n      table = tables(t.table);\n\n    candidates.push({\n      table,\n      keys: [t.moduleId, t.subjectId, t.sessionId],\n      due: sql`${exactSqlText(sql, table.column(t.moduleId), table.value(t.moduleId, mapping.moduleId))} and ${tables.expression(mapping.clock.toMillis(table.column(t.absoluteExpiresAt)))} <= ${now}`,\n      order: [table.column(t.absoluteExpiresAt), table.column(t.sessionId)],\n    });\n  }\n\n  return {\n    sessionCleanup: {\n      cleanup: ({ limit }) => {\n        if (candidates.length === 0)\n          return executor.read(Effect.succeed({ removed: 0, hasMore: false }));\n        const work = cleanupSqlRows(candidates, limit, batch !== undefined);\n\n        return batch === undefined\n          ? executor.run(work, candidates.length > 1 ? \"transaction\" : \"statement\")\n          : executor.batch(work).pipe(Effect.provideService(SqlBatchCommit, batch));\n      },\n    },\n  };\n});\n"],"mappings":";;;;;;;AAaA,MAAa,mCAAmC,OAAO,WAAW,WAChE,QACA,SAKA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,OAAO,OAAO,UAAA,CAAW,kBAAkB;CACjD,MAAM,WAAW,OAAO,sBAAsB,kBAAkB;CAChE,MAAM,MAAM,OAAO,WAAW,QAAQ,MAAM,eAAe;CAC3D,MAAM,aAAgC,CAAC;CAEvC,IAAI,QAAQ,YAAY,KAAA,GAAW;EACjC,MAAM,IAAI,QAAQ,SAChB,QAAQ,OAAO,EAAE,KAAK;EAExB,WAAW,KAAK;GACd;GACA,MAAM,CAAC,EAAE,MAAM;GACf,KAAK,GAAG,GAAG,aAAa,KAAK,MAAM,OAAO,EAAE,QAAQ,GAAG,MAAM,MAAM,EAAE,UAAU,QAAQ,QAAQ,CAAC,EAAE,OAAO,OAAO,WAAW,QAAQ,MAAM,SAAS,MAAM,OAAO,EAAE,SAAS,CAAC,CAAC,EAAE,MAAM;GACpL,OAAO,CAAC,MAAM,OAAO,EAAE,SAAS,GAAG,MAAM,OAAO,EAAE,MAAM,CAAC;EAC3D,CAAC;CACH;CACA,IAAI,QAAQ,cAAc,KAAA,GAAW;EACnC,MAAM,IAAI,QAAQ,WAChB,QAAQ,OAAO,EAAE,KAAK;EAExB,WAAW,KAAK;GACd;GACA,MAAM;IAAC,EAAE;IAAU,EAAE;IAAW,EAAE;GAAS;GAC3C,KAAK,GAAG,GAAG,aAAa,KAAK,MAAM,OAAO,EAAE,QAAQ,GAAG,MAAM,MAAM,EAAE,UAAU,QAAQ,QAAQ,CAAC,EAAE,OAAO,OAAO,WAAW,QAAQ,MAAM,SAAS,MAAM,OAAO,EAAE,iBAAiB,CAAC,CAAC,EAAE,MAAM;GAC5L,OAAO,CAAC,MAAM,OAAO,EAAE,iBAAiB,GAAG,MAAM,OAAO,EAAE,SAAS,CAAC;EACtE,CAAC;CACH;CAEA,OAAO,EACL,gBAAgB,EACd,UAAU,EAAE,YAAY;EACtB,IAAI,WAAW,WAAW,GACxB,OAAO,SAAS,KAAK,OAAO,QAAQ;GAAE,SAAS;GAAG,SAAS;EAAM,CAAC,CAAC;EACrE,MAAM,OAAO,eAAe,YAAY,OAAO,UAAU,KAAA,CAAS;EAElE,OAAO,UAAU,KAAA,IACb,SAAS,IAAI,MAAM,WAAW,SAAS,IAAI,gBAAgB,WAAW,IACtE,SAAS,MAAM,IAAI,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CAC5E,EACF,EACF;AACF,CAAC"}

package/dist/internal/session-native-login.d.mts

@@ -0,0 +1,15 @@
+import { AnyTableModel } from "./table-model.mjs";
+import { PendingAuthenticationMapping } from "./models/session-model.mjs";
+import { NativeSqlTables } from "./native-sql-table.mjs";
+import { SqlBatchCommit } from "./sql-commit.mjs";
+import { Effect } from "effect";
+import { LifecycleHooks } from "@yielded/auth/Hooks";
+import { PendingAuthentication } from "@yielded/auth/Sessions";
+import { SqlClient } from "effect/sql/SqlClient";
+//#region src/internal/session-native-login.d.ts
+export type NativePendingAuthenticationMapping<Claims> = PendingAuthenticationMapping<Claims, AnyTableModel, AnyTableModel, AnyTableModel, unknown>;
+export declare const makeNativePendingAuthenticationServices: <Claims>(tables: NativeSqlTables, mapping: NativePendingAuthenticationMapping<Claims>) => Effect.Effect<{
+  readonly pendingAuthentication: PendingAuthentication<Claims>;
+}, never, LifecycleHooks | SqlBatchCommit | SqlClient>;
+//#endregion
+//# sourceMappingURL=session-native-login.d.mts.map

package/dist/internal/session-native-login.mjs

@@ -0,0 +1,87 @@
+import { PersistenceMappingError, isMappedConstraintConflict } from "./mapping-error.mjs";
+import { sqlBatchAssertion } from "./d1-planning.mjs";
+import { CurrentSqlCommit, SqlBatchCommit, appendSqlBatchStatement, makeSqlCommitExecutor, registerSqlBatchPostcondition, registerSqlPostcondition } from "./sql-commit.mjs";
+import { assessSessionAt, normalizeSessionOperation, sameSessionRevision, sessionInvariant, sessionUnavailable } from "./session-native-state.mjs";
+import { prepareNativeSession } from "./session-native-pending.mjs";
+import { allocateSessionValue } from "./session-policy.mjs";
+import { makeNativeSessionPendingReader } from "./session-native-pending-read.mjs";
+import { DateTime, Effect, Option } from "effect";
+import { PendingAuthenticationInvalid, SessionConflict, StaleAuthentication } from "@yielded/auth/Sessions";
+//#region src/internal/session-native-login.ts
+const makeNativePendingAuthenticationServices = Effect.fnUntraced(function* (tables, mapping) {
+	const batch = yield* SqlBatchCommit;
+	const { state, pending, read: readPending } = yield* makeNativeSessionPendingReader(tables, mapping, batch !== void 0);
+	const executor = yield* makeSqlCommitExecutor(sessionUnavailable);
+	const external = yield* Effect.serviceOption(CurrentSqlCommit);
+	const { sql, now } = state, { p, table } = pending;
+	const native = (work, mode = "transaction") => batch === void 0 ? executor.operation(normalizeSessionOperation(work), mode) : executor.operationBatch(normalizeSessionOperation(work)).pipe(Effect.provideService(SqlBatchCommit, batch));
+	const verifyPayload = Effect.fnUntraced(function* (stored) {
+		const record = yield* mapping.login.decode(stored.snapshot);
+		sessionInvariant(record.digest === stored.digest && record.version === stored.version && record.evidence.flowId === stored.flowId && record.evidence.bindingDigest === stored.bindingDigest && record.evidence.revision.subjectId === stored.subjectId && DateTime.toEpochMillis(record.expiresAt) === stored.expiresAtMillis && record.attemptLimit === stored.attemptLimit);
+		return record;
+	});
+	const read = Effect.fnUntraced(function* (digest) {
+		const selected = yield* readPending("Login", digest);
+		if (selected === void 0) return void 0;
+		const record = yield* verifyPayload(selected.record);
+		if (!sameSessionRevision(selected.authority.revision, record.evidence.revision)) return void 0;
+		return {
+			record,
+			requirement: selected.authority.requirement
+		};
+	});
+	return { pendingAuthentication: {
+		create: (input, _now, project) => native(Effect.gen(function* () {
+			const current = yield* state.read(input.evidence.revision.subjectId, true);
+			if (current === void 0 || !sameSessionRevision(current.revision, input.evidence.revision)) return yield* StaleAuthentication.make({});
+			yield* assessSessionAt(input.evidence, current.requirement, current.now);
+			const expires = DateTime.toEpochMillis(input.expiresAt);
+			if (expires <= current.now) return yield* StaleAuthentication.make({});
+			const version = yield* allocateSessionValue("interactive", mapping.pending.allocateVersion, mapping.pending.allocateVersionSync);
+			const record = {
+				...input,
+				version
+			};
+			const snapshot = yield* mapping.login.encode(record);
+			const condition = sql`${state.authorityCondition(current.revision, current.native)} and ${state.policyCondition(current.row, current.native)} and ${now} >= ${current.now} and ${now} < ${expires}`;
+			if (batch !== void 0) yield* appendSqlBatchStatement(sqlBatchAssertion(sql, condition));
+			yield* pending.insert({
+				moduleId: mapping.moduleId,
+				kind: "Login",
+				digest: record.digest,
+				version,
+				flowId: record.evidence.flowId,
+				subjectId: current.native,
+				bindingDigest: record.evidence.bindingDigest,
+				snapshot,
+				expiresAt: record.expiresAt,
+				attemptLimit: record.attemptLimit
+			}, condition).pipe(Effect.mapError((error) => isMappedConstraintConflict(mapping.isConstraintConflict, error) ? SessionConflict.make({}) : error));
+			const final = sql`${condition} and exists(select 1 from ${table.name} where ${pending.predicate(table, "Login", record.digest)} and ${state.exact(table, p.version, version)} and ${state.exact(table, p.snapshot, snapshot)})`;
+			if (batch !== void 0) yield* registerSqlBatchPostcondition({
+				name: "pending-login-issuance",
+				statement: sqlBatchAssertion(sql, final)
+			});
+			else if (Option.isSome(external)) yield* registerSqlPostcondition({
+				name: "pending-login-issuance",
+				check: Effect.gen(function* () {
+					const rows = yield* sql`select 1 where ${final}`;
+					sessionInvariant(rows.length === 1);
+				}).pipe(Effect.mapError((cause) => PersistenceMappingError.make({
+					operation: "decode",
+					cause
+				})))
+			});
+			return yield* prepareNativeSession(record, project);
+		})),
+		read: ({ digest }) => executor.read(read(digest)).pipe(Effect.flatMap((result) => result === void 0 ? Effect.fail(PendingAuthenticationInvalid.make({})) : Effect.succeed(result))),
+		reject: ({ digest }, project) => native(Effect.gen(function* () {
+			yield* pending.reject("Login", digest);
+			return yield* prepareNativeSession({ _tag: "Rejected" }, project);
+		}), "statement")
+	} };
+});
+//#endregion
+export { makeNativePendingAuthenticationServices };
+
+//# sourceMappingURL=session-native-login.mjs.map

package/dist/internal/session-native-login.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-native-login.mjs","names":[],"sources":["../../src/internal/session-native-login.ts"],"sourcesContent":["import type { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport {\n  PendingAuthenticationInvalid,\n  StaleAuthentication,\n  SessionConflict,\n  type PendingAuthentication,\n  type PendingAuthenticationRecord,\n} from \"@yielded/auth/Sessions\";\nimport { DateTime, Effect, Option } from \"effect\";\nimport type { SqlClient } from \"effect/sql/SqlClient\";\n\nimport { sqlBatchAssertion } from \"./d1-planning\";\nimport { PersistenceMappingError, isMappedConstraintConflict } from \"./mapping-error\";\nimport type { PendingAuthenticationMapping } from \"./models/session-model\";\nimport type { NativeSqlTables } from \"./native-sql-table\";\nimport { prepareNativeSession } from \"./session-native-pending\";\nimport { makeNativeSessionPendingReader } from \"./session-native-pending-read\";\nimport {\n  normalizeSessionOperation,\n  sessionUnavailable,\n  sameSessionRevision,\n  assessSessionAt,\n  sessionInvariant,\n} from \"./session-native-state\";\nimport { allocateSessionValue } from \"./session-policy\";\nimport {\n  CurrentSqlCommit,\n  makeSqlCommitExecutor,\n  SqlBatchCommit,\n  registerSqlPostcondition,\n  registerSqlBatchPostcondition,\n  appendSqlBatchStatement,\n} from \"./sql-commit\";\nimport type { AnyTableModel } from \"./table-model\";\n\nexport type NativePendingAuthenticationMapping<Claims> = PendingAuthenticationMapping<\n  Claims,\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  unknown\n>;\n\nexport const makeNativePendingAuthenticationServices = Effect.fnUntraced(function* <Claims>(\n  tables: NativeSqlTables,\n  mapping: NativePendingAuthenticationMapping<Claims>,\n): Effect.fn.Return<\n  { readonly pendingAuthentication: PendingAuthentication<Claims> },\n  never,\n  SqlClient | LifecycleHooks | SqlBatchCommit\n> {\n  const batch = yield* SqlBatchCommit;\n\n  const {\n    state,\n    pending,\n    read: readPending,\n  } = yield* makeNativeSessionPendingReader(tables, mapping, batch !== undefined);\n\n  const executor = yield* makeSqlCommitExecutor(sessionUnavailable);\n  const external = yield* Effect.serviceOption(CurrentSqlCommit);\n\n  const { sql, now } = state,\n    { p, table } = pending;\n\n  const native = <A, E, R>(\n    work: Effect.Effect<A, E, R>,\n    mode: \"transaction\" | \"statement\" = \"transaction\",\n  ) =>\n    batch === undefined\n      ? executor.operation(normalizeSessionOperation(work), mode)\n      : executor\n          .operationBatch(normalizeSessionOperation(work))\n          .pipe(Effect.provideService(SqlBatchCommit, batch));\n\n  const verifyPayload = Effect.fnUntraced(function* (\n    stored: import(\"./session-native-pending\").StoredSessionPending,\n  ) {\n    const record = yield* mapping.login.decode(stored.snapshot);\n\n    sessionInvariant(\n      record.digest === stored.digest &&\n        record.version === stored.version &&\n        record.evidence.flowId === stored.flowId &&\n        record.evidence.bindingDigest === stored.bindingDigest &&\n        record.evidence.revision.subjectId === stored.subjectId &&\n        DateTime.toEpochMillis(record.expiresAt) === stored.expiresAtMillis &&\n        record.attemptLimit === stored.attemptLimit,\n    );\n\n    return record;\n  });\n\n  const read = Effect.fnUntraced(function* (\n    digest: Parameters<PendingAuthentication<Claims>[\"read\"]>[0][\"digest\"],\n  ) {\n    const selected = yield* readPending(\"Login\", digest);\n\n    if (selected === undefined) return undefined;\n    const record = yield* verifyPayload(selected.record);\n\n    if (!sameSessionRevision(selected.authority.revision, record.evidence.revision))\n      return undefined;\n\n    return { record, requirement: selected.authority.requirement };\n  });\n\n  const pendingAuthentication: PendingAuthentication<Claims> = {\n    create: (input, _now, project) =>\n      native(\n        Effect.gen(function* () {\n          const current = yield* state.read(input.evidence.revision.subjectId, true);\n\n          if (\n            current === undefined ||\n            !sameSessionRevision(current.revision, input.evidence.revision)\n          )\n            return yield* StaleAuthentication.make({});\n          yield* assessSessionAt(input.evidence, current.requirement, current.now);\n          const expires = DateTime.toEpochMillis(input.expiresAt);\n\n          if (expires <= current.now) return yield* StaleAuthentication.make({});\n\n          const version = yield* allocateSessionValue(\n            \"interactive\",\n            mapping.pending.allocateVersion,\n            mapping.pending.allocateVersionSync,\n          );\n\n          const record: PendingAuthenticationRecord<Claims> = { ...input, version };\n          const snapshot = yield* mapping.login.encode(record);\n          const condition = sql`${state.authorityCondition(current.revision, current.native)} and ${state.policyCondition(current.row, current.native)} and ${now} >= ${current.now} and ${now} < ${expires}`;\n\n          if (batch !== undefined)\n            yield* appendSqlBatchStatement(sqlBatchAssertion(sql, condition));\n          yield* pending\n            .insert(\n              {\n                moduleId: mapping.moduleId,\n                kind: \"Login\",\n                digest: record.digest,\n                version,\n                flowId: record.evidence.flowId,\n                subjectId: current.native,\n                bindingDigest: record.evidence.bindingDigest,\n                snapshot,\n                expiresAt: record.expiresAt,\n                attemptLimit: record.attemptLimit,\n              },\n              condition,\n            )\n            .pipe(\n              Effect.mapError((error) =>\n                isMappedConstraintConflict(mapping.isConstraintConflict, error)\n                  ? SessionConflict.make({})\n                  : error,\n              ),\n            );\n          const final = sql`${condition} and exists(select 1 from ${table.name} where ${pending.predicate(table, \"Login\", record.digest)} and ${state.exact(table, p.version, version)} and ${state.exact(table, p.snapshot, snapshot)})`;\n\n          if (batch !== undefined)\n            yield* registerSqlBatchPostcondition({\n              name: \"pending-login-issuance\",\n              statement: sqlBatchAssertion(sql, final),\n            });\n          else if (Option.isSome(external))\n            yield* registerSqlPostcondition({\n              name: \"pending-login-issuance\",\n              check: Effect.gen(function* () {\n                const rows = yield* sql`select 1 where ${final}`;\n\n                sessionInvariant(rows.length === 1);\n              }).pipe(\n                Effect.mapError((cause) =>\n                  PersistenceMappingError.make({ operation: \"decode\", cause }),\n                ),\n              ),\n            });\n\n          return yield* prepareNativeSession(record, project);\n        }),\n      ),\n    read: ({ digest }) =>\n      executor\n        .read(read(digest))\n        .pipe(\n          Effect.flatMap((result) =>\n            result === undefined\n              ? Effect.fail(PendingAuthenticationInvalid.make({}))\n              : Effect.succeed(result),\n          ),\n        ),\n    reject: ({ digest }, project) =>\n      native(\n        Effect.gen(function* () {\n          yield* pending.reject(\"Login\", digest);\n\n          return yield* prepareNativeSession({ _tag: \"Rejected\" } as const, project);\n        }),\n        \"statement\",\n      ),\n  };\n\n  return { pendingAuthentication };\n});\n"],"mappings":";;;;;;;;;;AA2CA,MAAa,0CAA0C,OAAO,WAAW,WACvE,QACA,SAKA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,EACJ,OACA,SACA,MAAM,gBACJ,OAAO,+BAA+B,QAAQ,SAAS,UAAU,KAAA,CAAS;CAE9E,MAAM,WAAW,OAAO,sBAAsB,kBAAkB;CAChE,MAAM,WAAW,OAAO,OAAO,cAAc,gBAAgB;CAE7D,MAAM,EAAE,KAAK,QAAQ,OACnB,EAAE,GAAG,UAAU;CAEjB,MAAM,UACJ,MACA,OAAoC,kBAEpC,UAAU,KAAA,IACN,SAAS,UAAU,0BAA0B,IAAI,GAAG,IAAI,IACxD,SACG,eAAe,0BAA0B,IAAI,CAAC,CAAC,CAC/C,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CAE1D,MAAM,gBAAgB,OAAO,WAAW,WACtC,QACA;EACA,MAAM,SAAS,OAAO,QAAQ,MAAM,OAAO,OAAO,QAAQ;EAE1D,iBACE,OAAO,WAAW,OAAO,UACvB,OAAO,YAAY,OAAO,WAC1B,OAAO,SAAS,WAAW,OAAO,UAClC,OAAO,SAAS,kBAAkB,OAAO,iBACzC,OAAO,SAAS,SAAS,cAAc,OAAO,aAC9C,SAAS,cAAc,OAAO,SAAS,MAAM,OAAO,mBACpD,OAAO,iBAAiB,OAAO,YACnC;EAEA,OAAO;CACT,CAAC;CAED,MAAM,OAAO,OAAO,WAAW,WAC7B,QACA;EACA,MAAM,WAAW,OAAO,YAAY,SAAS,MAAM;EAEnD,IAAI,aAAa,KAAA,GAAW,OAAO,KAAA;EACnC,MAAM,SAAS,OAAO,cAAc,SAAS,MAAM;EAEnD,IAAI,CAAC,oBAAoB,SAAS,UAAU,UAAU,OAAO,SAAS,QAAQ,GAC5E,OAAO,KAAA;EAET,OAAO;GAAE;GAAQ,aAAa,SAAS,UAAU;EAAY;CAC/D,CAAC;CAkGD,OAAO,EAAE,uBAAA;EA/FP,SAAS,OAAO,MAAM,YACpB,OACE,OAAO,IAAI,aAAa;GACtB,MAAM,UAAU,OAAO,MAAM,KAAK,MAAM,SAAS,SAAS,WAAW,IAAI;GAEzE,IACE,YAAY,KAAA,KACZ,CAAC,oBAAoB,QAAQ,UAAU,MAAM,SAAS,QAAQ,GAE9D,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;GAC3C,OAAO,gBAAgB,MAAM,UAAU,QAAQ,aAAa,QAAQ,GAAG;GACvE,MAAM,UAAU,SAAS,cAAc,MAAM,SAAS;GAEtD,IAAI,WAAW,QAAQ,KAAK,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;GAErE,MAAM,UAAU,OAAO,qBACrB,eACA,QAAQ,QAAQ,iBAChB,QAAQ,QAAQ,mBAClB;GAEA,MAAM,SAA8C;IAAE,GAAG;IAAO;GAAQ;GACxE,MAAM,WAAW,OAAO,QAAQ,MAAM,OAAO,MAAM;GACnD,MAAM,YAAY,GAAG,GAAG,MAAM,mBAAmB,QAAQ,UAAU,QAAQ,MAAM,EAAE,OAAO,MAAM,gBAAgB,QAAQ,KAAK,QAAQ,MAAM,EAAE,OAAO,IAAI,MAAM,QAAQ,IAAI,OAAO,IAAI,KAAK;GAE1L,IAAI,UAAU,KAAA,GACZ,OAAO,wBAAwB,kBAAkB,KAAK,SAAS,CAAC;GAClE,OAAO,QACJ,OACC;IACE,UAAU,QAAQ;IAClB,MAAM;IACN,QAAQ,OAAO;IACf;IACA,QAAQ,OAAO,SAAS;IACxB,WAAW,QAAQ;IACnB,eAAe,OAAO,SAAS;IAC/B;IACA,WAAW,OAAO;IAClB,cAAc,OAAO;GACvB,GACA,SACF,CAAC,CACA,KACC,OAAO,UAAU,UACf,2BAA2B,QAAQ,sBAAsB,KAAK,IAC1D,gBAAgB,KAAK,CAAC,CAAC,IACvB,KACN,CACF;GACF,MAAM,QAAQ,GAAG,GAAG,UAAU,4BAA4B,MAAM,KAAK,SAAS,QAAQ,UAAU,OAAO,SAAS,OAAO,MAAM,EAAE,OAAO,MAAM,MAAM,OAAO,EAAE,SAAS,OAAO,EAAE,OAAO,MAAM,MAAM,OAAO,EAAE,UAAU,QAAQ,EAAE;GAE7N,IAAI,UAAU,KAAA,GACZ,OAAO,8BAA8B;IACnC,MAAM;IACN,WAAW,kBAAkB,KAAK,KAAK;GACzC,CAAC;QACE,IAAI,OAAO,OAAO,QAAQ,GAC7B,OAAO,yBAAyB;IAC9B,MAAM;IACN,OAAO,OAAO,IAAI,aAAa;KAC7B,MAAM,OAAO,OAAO,GAAG,kBAAkB;KAEzC,iBAAiB,KAAK,WAAW,CAAC;IACpC,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,UACf,wBAAwB,KAAK;KAAE,WAAW;KAAU;IAAM,CAAC,CAC7D,CACF;GACF,CAAC;GAEH,OAAO,OAAO,qBAAqB,QAAQ,OAAO;EACpD,CAAC,CACH;EACF,OAAO,EAAE,aACP,SACG,KAAK,KAAK,MAAM,CAAC,CAAC,CAClB,KACC,OAAO,SAAS,WACd,WAAW,KAAA,IACP,OAAO,KAAK,6BAA6B,KAAK,CAAC,CAAC,CAAC,IACjD,OAAO,QAAQ,MAAM,CAC3B,CACF;EACJ,SAAS,EAAE,UAAU,YACnB,OACE,OAAO,IAAI,aAAa;GACtB,OAAO,QAAQ,OAAO,SAAS,MAAM;GAErC,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAY,OAAO;EAC3E,CAAC,GACD,WACF;CAGyB,EAAE;AACjC,CAAC"}

package/dist/internal/session-native-pending-read.mjs

@@ -0,0 +1,42 @@
+import { exactSqlText } from "./sql-change.mjs";
+import { makeNativeSessionAuthorityState } from "./session-native-state.mjs";
+import { makeNativeSessionPending } from "./session-native-pending.mjs";
+import { Effect } from "effect";
+//#region src/internal/session-native-pending-read.ts
+/** Both semantic pending ports use the same kind-bound physical snapshot.
+* Distinct native ID encodings use their own bound reads; joined rows still
+* validate each decoded owner before returning current policy. */
+const makeNativeSessionPendingReader = Effect.fnUntraced(function* (tables, mapping, batch = false) {
+	const state = yield* makeNativeSessionAuthorityState(tables, mapping, batch);
+	const pending = yield* makeNativeSessionPending(tables, mapping, batch);
+	return {
+		state,
+		pending,
+		read: Effect.fnUntraced(function* (kind, digest) {
+			const { sql, now } = state, { p, table } = pending;
+			if (table.unencodedTextColumn?.(p.subjectId) !== void 0 && state.subject.unencodedTextColumn?.(mapping.subject.id) !== void 0 && state.credential.unencodedTextColumn?.(mapping.credential.subjectId) !== void 0) {
+				const pt = table.as("authentication_pending"), st = state.joinedSubject, ct = state.joinedCredential, s = mapping.subject, c = mapping.credential;
+				const rows = yield* sql`select ${pt.fields("p_")}, ${st.fields("s_")}, ${ct.fields("c_")}, ${now} as engine_now from ${pt.name} join ${st.name} on ${exactSqlText(sql, st.column(s.id), pt.column(p.subjectId))} and ${state.activeSubject(st)} left join ${ct.name} on ${exactSqlText(sql, ct.column(c.subjectId), pt.column(p.subjectId))} and ${state.activeCredential(ct)} where ${pending.predicate(pt, kind, digest)} limit 65`;
+				if (rows[0] === void 0) return void 0;
+				const record = yield* pending.decode(kind, pt.decode(rows[0], "p_"));
+				const owner = yield* mapping.subjectId.toNative(record.subjectId);
+				const authority = yield* state.decode(record.subjectId, owner, st.decode(rows[0], "s_"), rows.map((row) => ct.decode(row, "c_")), rows[0].engine_now);
+				return authority === void 0 ? void 0 : {
+					record,
+					authority
+				};
+			}
+			const selected = yield* pending.read(kind, digest);
+			if (selected === void 0) return void 0;
+			const authority = yield* state.read(selected.record.subjectId);
+			return authority === void 0 || authority.now >= selected.record.expiresAtMillis ? void 0 : {
+				record: selected.record,
+				authority
+			};
+		})
+	};
+});
+//#endregion
+export { makeNativeSessionPendingReader };
+
+//# sourceMappingURL=session-native-pending-read.mjs.map

package/dist/internal/session-native-pending-read.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-native-pending-read.mjs","names":[],"sources":["../../src/internal/session-native-pending-read.ts"],"sourcesContent":["import type { TokenDigest } from \"@yielded/auth/Schema\";\nimport type { PendingAuthenticationKind } from \"@yielded/auth/Sessions\";\nimport { Effect } from \"effect\";\n\nimport type { NativeSqlTables } from \"./native-sql-table\";\nimport { makeNativeSessionPending } from \"./session-native-pending\";\nimport {\n  makeNativeSessionAuthorityState,\n  type NativeSessionAuthorityMapping,\n} from \"./session-native-state\";\nimport { exactSqlText } from \"./sql-change\";\n\n/** Both semantic pending ports use the same kind-bound physical snapshot.\n * Distinct native ID encodings use their own bound reads; joined rows still\n * validate each decoded owner before returning current policy. */\nexport const makeNativeSessionPendingReader = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: NativeSessionAuthorityMapping & Parameters<typeof makeNativeSessionPending>[1],\n  batch = false,\n) {\n  const state = yield* makeNativeSessionAuthorityState(tables, mapping, batch);\n  const pending = yield* makeNativeSessionPending(tables, mapping, batch);\n\n  const read = Effect.fnUntraced(function* (kind: PendingAuthenticationKind, digest: TokenDigest) {\n    const { sql, now } = state,\n      { p, table } = pending;\n\n    const compatible =\n      table.unencodedTextColumn?.(p.subjectId) !== undefined &&\n      state.subject.unencodedTextColumn?.(mapping.subject.id) !== undefined &&\n      state.credential.unencodedTextColumn?.(mapping.credential.subjectId) !== undefined;\n\n    if (compatible) {\n      const pt = table.as(\"authentication_pending\"),\n        st = state.joinedSubject,\n        ct = state.joinedCredential,\n        s = mapping.subject,\n        c = mapping.credential;\n\n      const rows =\n        yield* sql`select ${pt.fields(\"p_\")}, ${st.fields(\"s_\")}, ${ct.fields(\"c_\")}, ${now} as engine_now from ${pt.name} join ${st.name} on ${exactSqlText(sql, st.column(s.id), pt.column(p.subjectId))} and ${state.activeSubject(st)} left join ${ct.name} on ${exactSqlText(sql, ct.column(c.subjectId), pt.column(p.subjectId))} and ${state.activeCredential(ct)} where ${pending.predicate(pt, kind, digest)} limit 65`;\n\n      if (rows[0] === undefined) return undefined;\n      const record = yield* pending.decode(kind, pt.decode(rows[0], \"p_\"));\n      const owner = yield* mapping.subjectId.toNative(record.subjectId);\n\n      const authority = yield* state.decode(\n        record.subjectId,\n        owner,\n        st.decode(rows[0], \"s_\"),\n        rows.map((row) => ct.decode(row, \"c_\")),\n        rows[0].engine_now,\n      );\n\n      return authority === undefined ? undefined : { record, authority };\n    }\n    const selected = yield* pending.read(kind, digest);\n\n    if (selected === undefined) return undefined;\n    const authority = yield* state.read(selected.record.subjectId);\n\n    return authority === undefined || authority.now >= selected.record.expiresAtMillis\n      ? undefined\n      : { record: selected.record, authority };\n  });\n\n  return { state, pending, read };\n});\n"],"mappings":";;;;;;;;AAeA,MAAa,iCAAiC,OAAO,WAAW,WAC9D,QACA,SACA,QAAQ,OACR;CACA,MAAM,QAAQ,OAAO,gCAAgC,QAAQ,SAAS,KAAK;CAC3E,MAAM,UAAU,OAAO,yBAAyB,QAAQ,SAAS,KAAK;CA6CtE,OAAO;EAAE;EAAO;EAAS,MA3CZ,OAAO,WAAW,WAAW,MAAiC,QAAqB;GAC9F,MAAM,EAAE,KAAK,QAAQ,OACnB,EAAE,GAAG,UAAU;GAOjB,IAJE,MAAM,sBAAsB,EAAE,SAAS,MAAM,KAAA,KAC7C,MAAM,QAAQ,sBAAsB,QAAQ,QAAQ,EAAE,MAAM,KAAA,KAC5D,MAAM,WAAW,sBAAsB,QAAQ,WAAW,SAAS,MAAM,KAAA,GAE3D;IACd,MAAM,KAAK,MAAM,GAAG,wBAAwB,GAC1C,KAAK,MAAM,eACX,KAAK,MAAM,kBACX,IAAI,QAAQ,SACZ,IAAI,QAAQ;IAEd,MAAM,OACJ,OAAO,GAAG,UAAU,GAAG,OAAO,IAAI,EAAE,IAAI,GAAG,OAAO,IAAI,EAAE,IAAI,GAAG,OAAO,IAAI,EAAE,IAAI,IAAI,sBAAsB,GAAG,KAAK,QAAQ,GAAG,KAAK,MAAM,aAAa,KAAK,GAAG,OAAO,EAAE,EAAE,GAAG,GAAG,OAAO,EAAE,SAAS,CAAC,EAAE,OAAO,MAAM,cAAc,EAAE,EAAE,aAAa,GAAG,KAAK,MAAM,aAAa,KAAK,GAAG,OAAO,EAAE,SAAS,GAAG,GAAG,OAAO,EAAE,SAAS,CAAC,EAAE,OAAO,MAAM,iBAAiB,EAAE,EAAE,SAAS,QAAQ,UAAU,IAAI,MAAM,MAAM,EAAE;IAEhZ,IAAI,KAAK,OAAO,KAAA,GAAW,OAAO,KAAA;IAClC,MAAM,SAAS,OAAO,QAAQ,OAAO,MAAM,GAAG,OAAO,KAAK,IAAI,IAAI,CAAC;IACnE,MAAM,QAAQ,OAAO,QAAQ,UAAU,SAAS,OAAO,SAAS;IAEhE,MAAM,YAAY,OAAO,MAAM,OAC7B,OAAO,WACP,OACA,GAAG,OAAO,KAAK,IAAI,IAAI,GACvB,KAAK,KAAK,QAAQ,GAAG,OAAO,KAAK,IAAI,CAAC,GACtC,KAAK,EAAE,CAAC,UACV;IAEA,OAAO,cAAc,KAAA,IAAY,KAAA,IAAY;KAAE;KAAQ;IAAU;GACnE;GACA,MAAM,WAAW,OAAO,QAAQ,KAAK,MAAM,MAAM;GAEjD,IAAI,aAAa,KAAA,GAAW,OAAO,KAAA;GACnC,MAAM,YAAY,OAAO,MAAM,KAAK,SAAS,OAAO,SAAS;GAE7D,OAAO,cAAc,KAAA,KAAa,UAAU,OAAO,SAAS,OAAO,kBAC/D,KAAA,IACA;IAAE,QAAQ,SAAS;IAAQ;GAAU;EAC3C,CAE4B;CAAE;AAChC,CAAC"}

package/dist/internal/session-native-pending.mjs

@@ -0,0 +1,134 @@
+import { sqlBatchAssertion } from "./d1-planning.mjs";
+import { exactSqlText, executeSqlChange } from "./sql-change.mjs";
+import { appendSqlBatchStatement, registerSqlCommitReceipt } from "./sql-commit.mjs";
+import { sessionInvariant } from "./session-native-state.mjs";
+import { makeConditionalSqlInsert } from "./session-native-record.mjs";
+import { Effect, Schema } from "effect";
+import { CurrentCommitJournal } from "@yielded/auth/Hooks";
+import { AuthenticationFlowId, PendingAuthenticationKind, SecurityRevision } from "@yielded/auth/Sessions";
+import { SqlClient } from "effect/sql/SqlClient";
+import { SubjectId, TokenDigest } from "@yielded/auth/Schema";
+//#region src/internal/session-native-pending.ts
+const StoredSessionPending = Schema.Struct({
+	kind: PendingAuthenticationKind,
+	digest: TokenDigest,
+	version: SecurityRevision,
+	flowId: AuthenticationFlowId,
+	subjectId: SubjectId,
+	bindingDigest: TokenDigest,
+	snapshot: Schema.String,
+	expiresAtMillis: Schema.Int,
+	attemptLimit: Schema.Int.check(Schema.isGreaterThan(0)),
+	failedAttempts: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0))
+});
+/** All consumers bind the module and kind through this owner. A caller never
+* supplies an optional discriminator and payload is decoded only after it matches. */
+const makeNativeSessionPending = Effect.fnUntraced(function* (tables, mapping, batch = false) {
+	const conditionalInsert = yield* makeConditionalSqlInsert();
+	const sql = (yield* SqlClient).withoutTransforms();
+	const p = mapping.pending, table = tables(p.table), now = tables.expression(mapping.clock.engineNowMillis);
+	const exact = (t, key, value) => exactSqlText(sql, t.column(key), t.value(key, value));
+	const millis = (t, key) => tables.expression(mapping.clock.toMillis(t.column(key)));
+	const scope = (t, kind) => sql.and([exact(t, p.moduleId, mapping.moduleId), exact(t, p.kind, kind)]);
+	const live = (t) => sql.and([
+		sql`${t.column(p.consumed)} = ${t.value(p.consumed, false)}`,
+		sql`${millis(t, p.expiresAt)} > ${now}`,
+		sql`${t.column(p.failedAttempts)} >= 0`,
+		sql`${t.column(p.failedAttempts)} < ${t.column(p.attemptLimit)}`
+	]);
+	const predicate = (t, kind, digest) => sql.and([
+		scope(t, kind),
+		exact(t, p.digest, digest),
+		live(t)
+	]);
+	const decode = Effect.fnUntraced(function* (kind, row) {
+		sessionInvariant(row[p.moduleId] === mapping.moduleId && row[p.kind] === kind && (row[p.consumed] === false || row[p.consumed] === 0));
+		return yield* Schema.decodeUnknownEffect(StoredSessionPending)({
+			kind,
+			digest: row[p.digest],
+			version: row[p.version],
+			flowId: row[p.flowId],
+			subjectId: yield* mapping.subjectId.toSubject(row[p.subjectId]),
+			bindingDigest: row[p.bindingDigest],
+			snapshot: row[p.snapshot],
+			expiresAtMillis: mapping.clock.decodeInstant(row[p.expiresAt]),
+			attemptLimit: row[p.attemptLimit],
+			failedAttempts: row[p.failedAttempts]
+		});
+	});
+	const read = Effect.fnUntraced(function* (kind, digest) {
+		const rows = yield* sql`select ${table.fields("pending_")}, ${now} as engine_now from ${table.name} where ${predicate(table, kind, digest)} limit 2`;
+		sessionInvariant(rows.length <= 1);
+		if (rows[0] === void 0) return void 0;
+		return {
+			record: yield* decode(kind, table.decode(rows[0], "pending_")),
+			now: Number(rows[0].engine_now)
+		};
+	});
+	const stage = Effect.fnUntraced(function* (statement, expected) {
+		if (batch) {
+			yield* appendSqlBatchStatement(sql`${statement}`);
+			if (expected !== void 0) yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = ${expected}`));
+			return expected;
+		}
+		const changed = yield* executeSqlChange(sql, statement);
+		if (expected !== void 0) sessionInvariant(changed === expected);
+		return changed;
+	});
+	const insert = Effect.fnUntraced(function* (input, condition = sql`1 = 1`) {
+		sessionInvariant(input.moduleId === mapping.moduleId);
+		const row = {
+			...p.encodeInsert(input),
+			[p.moduleId]: mapping.moduleId,
+			[p.kind]: input.kind,
+			[p.digest]: input.digest,
+			[p.version]: input.version,
+			[p.flowId]: input.flowId,
+			[p.subjectId]: input.subjectId,
+			[p.bindingDigest]: input.bindingDigest,
+			[p.snapshot]: input.snapshot,
+			[p.expiresAt]: p.encodeInstant(input.expiresAt),
+			[p.attemptLimit]: input.attemptLimit,
+			[p.failedAttempts]: 0,
+			[p.consumed]: false
+		};
+		yield* stage(conditionalInsert(table, row, condition), 1);
+	});
+	const consumption = (kind, input, native) => sql.and([
+		predicate(table, kind, input.digest),
+		exact(table, p.version, input.version),
+		exact(table, p.flowId, input.flowId),
+		exact(table, p.bindingDigest, input.bindingDigest),
+		sql`${table.column(p.subjectId)} = ${table.value(p.subjectId, native)}`
+	]);
+	const consume = (kind, input, native, condition = sql`1 = 1`) => stage(sql`${table.update({ [p.consumed]: true })} where ${consumption(kind, input, native)} and ${condition}`, 1);
+	const reject = (kind, digest) => stage(sql`${table.update({ [p.failedAttempts]: sql`${table.column(p.failedAttempts)} + 1` })} where ${predicate(table, kind, digest)}`);
+	const clockCondition = (record) => sql`${now} < ${record.expiresAtMillis}`;
+	const consumedCondition = (kind, input, native) => sql`exists(select 1 from ${table.name} where ${scope(table, kind)} and ${exact(table, p.digest, input.digest)} and ${exact(table, p.version, input.version)} and ${exact(table, p.flowId, input.flowId)} and ${exact(table, p.bindingDigest, input.bindingDigest)} and ${table.column(p.subjectId)} = ${table.value(p.subjectId, native)} and ${table.column(p.consumed)} = ${table.value(p.consumed, true)})`;
+	return {
+		table,
+		p,
+		now,
+		scope,
+		live,
+		predicate,
+		decode,
+		read,
+		insert,
+		consumption,
+		consume,
+		reject,
+		stage,
+		clockCondition,
+		consumedCondition
+	};
+});
+const prepareNativeSession = (value, project) => Effect.gen(function* () {
+	const receipt = project(value, yield* CurrentCommitJournal);
+	yield* registerSqlCommitReceipt(receipt);
+	return receipt;
+});
+//#endregion
+export { StoredSessionPending, makeNativeSessionPending, prepareNativeSession };
+
+//# sourceMappingURL=session-native-pending.mjs.map

package/dist/internal/session-native-pending.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-native-pending.mjs","names":[],"sources":["../../src/internal/session-native-pending.ts"],"sourcesContent":["import { CurrentCommitJournal, type PreparedCommit, type CommitJournal } from \"@yielded/auth/Hooks\";\nimport { SubjectId, TokenDigest } from \"@yielded/auth/Schema\";\nimport {\n  AuthenticationFlowId,\n  SecurityRevision,\n  type PendingConsumption,\n  PendingAuthenticationKind,\n} from \"@yielded/auth/Sessions\";\nimport { Effect, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql/SqlClient\";\nimport type { Fragment } from \"effect/sql/Statement\";\n\nimport { sqlBatchAssertion } from \"./d1-planning\";\nimport type { SubjectIdCodec } from \"./models/common\";\nimport type {\n  SessionPendingTables,\n  SessionExecution,\n  SessionPendingInsert,\n} from \"./models/session-model\";\nimport type { NativeSqlTables, SqlTable } from \"./native-sql-table\";\nimport { makeConditionalSqlInsert } from \"./session-native-record\";\nimport { sessionInvariant } from \"./session-native-state\";\nimport { exactSqlText, executeSqlChange } from \"./sql-change\";\nimport { appendSqlBatchStatement, registerSqlCommitReceipt } from \"./sql-commit\";\nimport type { AnyTableModel } from \"./table-model\";\n\nexport const StoredSessionPending = Schema.Struct({\n  kind: PendingAuthenticationKind,\n  digest: TokenDigest,\n  version: SecurityRevision,\n  flowId: AuthenticationFlowId,\n  subjectId: SubjectId,\n  bindingDigest: TokenDigest,\n  snapshot: Schema.String,\n  expiresAtMillis: Schema.Int,\n  attemptLimit: Schema.Int.check(Schema.isGreaterThan(0)),\n  failedAttempts: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),\n});\n\nexport type StoredSessionPending = typeof StoredSessionPending.Type;\n\ntype Mapping = SessionPendingTables<AnyTableModel, unknown> &\n  Pick<SessionExecution, \"moduleId\" | \"clock\"> & { readonly subjectId: SubjectIdCodec<unknown> };\n\n/** All consumers bind the module and kind through this owner. A caller never\n * supplies an optional discriminator and payload is decoded only after it matches. */\nexport const makeNativeSessionPending = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: Mapping,\n  batch = false,\n) {\n  const conditionalInsert = yield* makeConditionalSqlInsert();\n  const sql = (yield* SqlClient).withoutTransforms();\n\n  const p = mapping.pending,\n    table = tables(p.table),\n    now = tables.expression(mapping.clock.engineNowMillis);\n\n  const exact = (t: SqlTable, key: string, value: unknown) =>\n    exactSqlText(sql, t.column(key), t.value(key, value));\n\n  const millis = (t: SqlTable, key: string) =>\n    tables.expression(mapping.clock.toMillis(t.column(key)));\n\n  const scope = (t: SqlTable, kind: PendingAuthenticationKind) =>\n    sql.and([exact(t, p.moduleId, mapping.moduleId), exact(t, p.kind, kind)]);\n\n  const live = (t: SqlTable) =>\n    sql.and([\n      sql`${t.column(p.consumed)} = ${t.value(p.consumed, false)}`,\n      sql`${millis(t, p.expiresAt)} > ${now}`,\n      sql`${t.column(p.failedAttempts)} >= 0`,\n      sql`${t.column(p.failedAttempts)} < ${t.column(p.attemptLimit)}`,\n    ]);\n\n  const predicate = (t: SqlTable, kind: PendingAuthenticationKind, digest: TokenDigest) =>\n    sql.and([scope(t, kind), exact(t, p.digest, digest), live(t)]);\n\n  const decode = Effect.fnUntraced(function* (\n    kind: PendingAuthenticationKind,\n    row: Record<string, unknown>,\n  ) {\n    sessionInvariant(\n      row[p.moduleId] === mapping.moduleId &&\n        row[p.kind] === kind &&\n        (row[p.consumed] === false || row[p.consumed] === 0),\n    );\n\n    return yield* Schema.decodeUnknownEffect(StoredSessionPending)({\n      kind,\n      digest: row[p.digest],\n      version: row[p.version],\n      flowId: row[p.flowId],\n      subjectId: yield* mapping.subjectId.toSubject(row[p.subjectId]),\n      bindingDigest: row[p.bindingDigest],\n      snapshot: row[p.snapshot],\n      expiresAtMillis: mapping.clock.decodeInstant(row[p.expiresAt]),\n      attemptLimit: row[p.attemptLimit],\n      failedAttempts: row[p.failedAttempts],\n    });\n  });\n\n  const read = Effect.fnUntraced(function* (kind: PendingAuthenticationKind, digest: TokenDigest) {\n    const rows =\n      yield* sql`select ${table.fields(\"pending_\")}, ${now} as engine_now from ${table.name} where ${predicate(table, kind, digest)} limit 2`;\n\n    sessionInvariant(rows.length <= 1);\n    if (rows[0] === undefined) return undefined;\n\n    return {\n      record: yield* decode(kind, table.decode(rows[0], \"pending_\")),\n      now: Number(rows[0].engine_now),\n    };\n  });\n\n  const stage = Effect.fnUntraced(function* (statement: Fragment, expected?: number) {\n    if (batch) {\n      yield* appendSqlBatchStatement(sql`${statement}`);\n      if (expected !== undefined)\n        yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = ${expected}`));\n\n      return expected;\n    }\n    const changed = yield* executeSqlChange(sql, statement);\n\n    if (expected !== undefined) sessionInvariant(changed === expected);\n\n    return changed;\n  });\n\n  const insert = Effect.fnUntraced(function* (\n    input: SessionPendingInsert<unknown>,\n    condition: Fragment = sql`1 = 1`,\n  ) {\n    sessionInvariant(input.moduleId === mapping.moduleId);\n\n    const row = {\n      ...p.encodeInsert(input),\n      [p.moduleId]: mapping.moduleId,\n      [p.kind]: input.kind,\n      [p.digest]: input.digest,\n      [p.version]: input.version,\n      [p.flowId]: input.flowId,\n      [p.subjectId]: input.subjectId,\n      [p.bindingDigest]: input.bindingDigest,\n      [p.snapshot]: input.snapshot,\n      [p.expiresAt]: p.encodeInstant(input.expiresAt),\n      [p.attemptLimit]: input.attemptLimit,\n      [p.failedAttempts]: 0,\n      [p.consumed]: false,\n    };\n\n    yield* stage(conditionalInsert(table, row, condition), 1);\n  });\n\n  const consumption = (\n    kind: PendingAuthenticationKind,\n    input: PendingConsumption,\n    native: unknown,\n  ) =>\n    sql.and([\n      predicate(table, kind, input.digest),\n      exact(table, p.version, input.version),\n      exact(table, p.flowId, input.flowId),\n      exact(table, p.bindingDigest, input.bindingDigest),\n      sql`${table.column(p.subjectId)} = ${table.value(p.subjectId, native)}`,\n    ]);\n\n  const consume = (\n    kind: PendingAuthenticationKind,\n    input: PendingConsumption,\n    native: unknown,\n    condition: Fragment = sql`1 = 1`,\n  ) =>\n    stage(\n      sql`${table.update({ [p.consumed]: true })} where ${consumption(kind, input, native)} and ${condition}`,\n      1,\n    );\n\n  const reject = (kind: PendingAuthenticationKind, digest: TokenDigest) =>\n    stage(\n      sql`${table.update({ [p.failedAttempts]: sql`${table.column(p.failedAttempts)} + 1` })} where ${predicate(table, kind, digest)}`,\n    );\n\n  const clockCondition = (record: StoredSessionPending) => sql`${now} < ${record.expiresAtMillis}`;\n\n  const consumedCondition = (\n    kind: PendingAuthenticationKind,\n    input: PendingConsumption,\n    native: unknown,\n  ) =>\n    sql`exists(select 1 from ${table.name} where ${scope(table, kind)} and ${exact(table, p.digest, input.digest)} and ${exact(table, p.version, input.version)} and ${exact(table, p.flowId, input.flowId)} and ${exact(table, p.bindingDigest, input.bindingDigest)} and ${table.column(p.subjectId)} = ${table.value(p.subjectId, native)} and ${table.column(p.consumed)} = ${table.value(p.consumed, true)})`;\n\n  return {\n    table,\n    p,\n    now,\n    scope,\n    live,\n    predicate,\n    decode,\n    read,\n    insert,\n    consumption,\n    consume,\n    reject,\n    stage,\n    clockCondition,\n    consumedCondition,\n  };\n});\n\nexport const prepareNativeSession = <Value, A>(\n  value: Value,\n  project: (value: Value, journal: CommitJournal) => PreparedCommit<A>,\n) =>\n  Effect.gen(function* () {\n    const receipt = project(value, yield* CurrentCommitJournal);\n\n    yield* registerSqlCommitReceipt(receipt);\n\n    return receipt;\n  });\n"],"mappings":";;;;;;;;;;;AA0BA,MAAa,uBAAuB,OAAO,OAAO;CAChD,MAAM;CACN,QAAQ;CACR,SAAS;CACT,QAAQ;CACR,WAAW;CACX,eAAe;CACf,UAAU,OAAO;CACjB,iBAAiB,OAAO;CACxB,cAAc,OAAO,IAAI,MAAM,OAAO,cAAc,CAAC,CAAC;CACtD,gBAAgB,OAAO,IAAI,MAAM,OAAO,uBAAuB,CAAC,CAAC;AACnE,CAAC;;;AASD,MAAa,2BAA2B,OAAO,WAAW,WACxD,QACA,SACA,QAAQ,OACR;CACA,MAAM,oBAAoB,OAAO,yBAAyB;CAC1D,MAAM,OAAO,OAAO,UAAA,CAAW,kBAAkB;CAEjD,MAAM,IAAI,QAAQ,SAChB,QAAQ,OAAO,EAAE,KAAK,GACtB,MAAM,OAAO,WAAW,QAAQ,MAAM,eAAe;CAEvD,MAAM,SAAS,GAAa,KAAa,UACvC,aAAa,KAAK,EAAE,OAAO,GAAG,GAAG,EAAE,MAAM,KAAK,KAAK,CAAC;CAEtD,MAAM,UAAU,GAAa,QAC3B,OAAO,WAAW,QAAQ,MAAM,SAAS,EAAE,OAAO,GAAG,CAAC,CAAC;CAEzD,MAAM,SAAS,GAAa,SAC1B,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,UAAU,QAAQ,QAAQ,GAAG,MAAM,GAAG,EAAE,MAAM,IAAI,CAAC,CAAC;CAE1E,MAAM,QAAQ,MACZ,IAAI,IAAI;EACN,GAAG,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,KAAK;EACzD,GAAG,GAAG,OAAO,GAAG,EAAE,SAAS,EAAE,KAAK;EAClC,GAAG,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE;EACjC,GAAG,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY;CAC/D,CAAC;CAEH,MAAM,aAAa,GAAa,MAAiC,WAC/D,IAAI,IAAI;EAAC,MAAM,GAAG,IAAI;EAAG,MAAM,GAAG,EAAE,QAAQ,MAAM;EAAG,KAAK,CAAC;CAAC,CAAC;CAE/D,MAAM,SAAS,OAAO,WAAW,WAC/B,MACA,KACA;EACA,iBACE,IAAI,EAAE,cAAc,QAAQ,YAC1B,IAAI,EAAE,UAAU,SACf,IAAI,EAAE,cAAc,SAAS,IAAI,EAAE,cAAc,EACtD;EAEA,OAAO,OAAO,OAAO,oBAAoB,oBAAoB,CAAC,CAAC;GAC7D;GACA,QAAQ,IAAI,EAAE;GACd,SAAS,IAAI,EAAE;GACf,QAAQ,IAAI,EAAE;GACd,WAAW,OAAO,QAAQ,UAAU,UAAU,IAAI,EAAE,UAAU;GAC9D,eAAe,IAAI,EAAE;GACrB,UAAU,IAAI,EAAE;GAChB,iBAAiB,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU;GAC7D,cAAc,IAAI,EAAE;GACpB,gBAAgB,IAAI,EAAE;EACxB,CAAC;CACH,CAAC;CAED,MAAM,OAAO,OAAO,WAAW,WAAW,MAAiC,QAAqB;EAC9F,MAAM,OACJ,OAAO,GAAG,UAAU,MAAM,OAAO,UAAU,EAAE,IAAI,IAAI,sBAAsB,MAAM,KAAK,SAAS,UAAU,OAAO,MAAM,MAAM,EAAE;EAEhI,iBAAiB,KAAK,UAAU,CAAC;EACjC,IAAI,KAAK,OAAO,KAAA,GAAW,OAAO,KAAA;EAElC,OAAO;GACL,QAAQ,OAAO,OAAO,MAAM,MAAM,OAAO,KAAK,IAAI,UAAU,CAAC;GAC7D,KAAK,OAAO,KAAK,EAAE,CAAC,UAAU;EAChC;CACF,CAAC;CAED,MAAM,QAAQ,OAAO,WAAW,WAAW,WAAqB,UAAmB;EACjF,IAAI,OAAO;GACT,OAAO,wBAAwB,GAAG,GAAG,WAAW;GAChD,IAAI,aAAa,KAAA,GACf,OAAO,wBAAwB,kBAAkB,KAAK,GAAG,eAAe,UAAU,CAAC;GAErF,OAAO;EACT;EACA,MAAM,UAAU,OAAO,iBAAiB,KAAK,SAAS;EAEtD,IAAI,aAAa,KAAA,GAAW,iBAAiB,YAAY,QAAQ;EAEjE,OAAO;CACT,CAAC;CAED,MAAM,SAAS,OAAO,WAAW,WAC/B,OACA,YAAsB,GAAG,SACzB;EACA,iBAAiB,MAAM,aAAa,QAAQ,QAAQ;EAEpD,MAAM,MAAM;GACV,GAAG,EAAE,aAAa,KAAK;IACtB,EAAE,WAAW,QAAQ;IACrB,EAAE,OAAO,MAAM;IACf,EAAE,SAAS,MAAM;IACjB,EAAE,UAAU,MAAM;IAClB,EAAE,SAAS,MAAM;IACjB,EAAE,YAAY,MAAM;IACpB,EAAE,gBAAgB,MAAM;IACxB,EAAE,WAAW,MAAM;IACnB,EAAE,YAAY,EAAE,cAAc,MAAM,SAAS;IAC7C,EAAE,eAAe,MAAM;IACvB,EAAE,iBAAiB;IACnB,EAAE,WAAW;EAChB;EAEA,OAAO,MAAM,kBAAkB,OAAO,KAAK,SAAS,GAAG,CAAC;CAC1D,CAAC;CAED,MAAM,eACJ,MACA,OACA,WAEA,IAAI,IAAI;EACN,UAAU,OAAO,MAAM,MAAM,MAAM;EACnC,MAAM,OAAO,EAAE,SAAS,MAAM,OAAO;EACrC,MAAM,OAAO,EAAE,QAAQ,MAAM,MAAM;EACnC,MAAM,OAAO,EAAE,eAAe,MAAM,aAAa;EACjD,GAAG,GAAG,MAAM,OAAO,EAAE,SAAS,EAAE,KAAK,MAAM,MAAM,EAAE,WAAW,MAAM;CACtE,CAAC;CAEH,MAAM,WACJ,MACA,OACA,QACA,YAAsB,GAAG,YAEzB,MACE,GAAG,GAAG,MAAM,OAAO,GAAG,EAAE,WAAW,KAAK,CAAC,EAAE,SAAS,YAAY,MAAM,OAAO,MAAM,EAAE,OAAO,aAC5F,CACF;CAEF,MAAM,UAAU,MAAiC,WAC/C,MACE,GAAG,GAAG,MAAM,OAAO,GAAG,EAAE,iBAAiB,GAAG,GAAG,MAAM,OAAO,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,SAAS,UAAU,OAAO,MAAM,MAAM,GAC/H;CAEF,MAAM,kBAAkB,WAAiC,GAAG,GAAG,IAAI,KAAK,OAAO;CAE/E,MAAM,qBACJ,MACA,OACA,WAEA,GAAG,wBAAwB,MAAM,KAAK,SAAS,MAAM,OAAO,IAAI,EAAE,OAAO,MAAM,OAAO,EAAE,QAAQ,MAAM,MAAM,EAAE,OAAO,MAAM,OAAO,EAAE,SAAS,MAAM,OAAO,EAAE,OAAO,MAAM,OAAO,EAAE,QAAQ,MAAM,MAAM,EAAE,OAAO,MAAM,OAAO,EAAE,eAAe,MAAM,aAAa,EAAE,OAAO,MAAM,OAAO,EAAE,SAAS,EAAE,KAAK,MAAM,MAAM,EAAE,WAAW,MAAM,EAAE,OAAO,MAAM,OAAO,EAAE,QAAQ,EAAE,KAAK,MAAM,MAAM,EAAE,UAAU,IAAI,EAAE;CAE9Y,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF,CAAC;AAED,MAAa,wBACX,OACA,YAEA,OAAO,IAAI,aAAa;CACtB,MAAM,UAAU,QAAQ,OAAO,OAAO,oBAAoB;CAE1D,OAAO,yBAAyB,OAAO;CAEvC,OAAO;AACT,CAAC"}

package/dist/internal/session-native-record.mjs

@@ -0,0 +1,79 @@
+import { exactSqlText } from "./sql-change.mjs";
+import { sessionInvariant } from "./session-native-state.mjs";
+import { DateTime, Effect, Schema } from "effect";
+import { SecurityRevision, SessionAuthenticationProvenance, SessionCredentialVersion, SessionId, SessionMetadata } from "@yielded/auth/Sessions";
+import { SqlClient } from "effect/sql/SqlClient";
+import { TokenDigest } from "@yielded/auth/Schema";
+//#region src/internal/session-native-record.ts
+const metadataJson = Schema.encodeSync(Schema.fromJsonString(SessionMetadata));
+const provenanceJson = Schema.encodeSync(Schema.fromJsonString(SessionAuthenticationProvenance));
+const sameSessionRecord = (left, right) => left.digest === right.digest && left.credentialVersion === right.credentialVersion && metadataJson(left) === metadataJson(right) && provenanceJson(left.provenance) === provenanceJson(right.provenance);
+const makeConditionalSqlInsert = Effect.fnUntraced(function* () {
+	const sql = (yield* SqlClient).withoutTransforms();
+	return (table, values, condition) => {
+		const fields = Object.entries(values).filter(([, value]) => value !== void 0);
+		sessionInvariant(fields.length > 0);
+		return sql`insert into ${table.name} (${sql.join(", ", false)(fields.map(([key]) => table.columnName(key)))}) select ${sql.join(", ", false)(fields.map(([key, value]) => table.value(key, value)))} where ${condition}`;
+	};
+});
+/** Security columns identify the row and own its live time bounds. In particular
+* issuedAt may be assigned by UPDATE's database clock without rewriting a JSON
+* copy of prepared metadata. Claims/provenance decoding remains consumer-owned. */
+const makeNativeSessionRecords = Effect.fnUntraced(function* (tables, mapping) {
+	const sql = (yield* SqlClient).withoutTransforms();
+	const s = mapping.session, table = tables(s.table), now = tables.expression(mapping.clock.engineNowMillis);
+	const exact = (t, key, value) => exactSqlText(sql, t.column(key), t.value(key, value));
+	const millis = (t, key) => tables.expression(mapping.clock.toMillis(t.column(key)));
+	const live = (t) => sql.and([
+		sql`${millis(t, s.issuedAt)} <= ${now}`,
+		sql`${millis(t, s.expiresAt)} > ${now}`,
+		sql`${millis(t, s.absoluteExpiresAt)} >= ${millis(t, s.expiresAt)}`
+	]);
+	const decode = Effect.fnUntraced(function* (row) {
+		const decoded = yield* s.decode(row);
+		const subjectId = yield* mapping.subjectId.toSubject(row[s.subjectId]);
+		const sessionId = yield* mapping.sessionId.toSession(row[s.sessionId]);
+		const digest = yield* Schema.decodeUnknownEffect(TokenDigest)(row[s.digest]);
+		const revision = yield* Schema.decodeUnknownEffect(SecurityRevision)(row[s.securityRevision]);
+		const issuedAt = DateTime.makeUnsafe(mapping.clock.decodeInstant(row[s.issuedAt]));
+		const expiresAt = mapping.clock.decodeInstant(row[s.expiresAt]);
+		const absolute = mapping.clock.decodeInstant(row[s.absoluteExpiresAt]);
+		sessionInvariant(decoded.subjectId === subjectId && decoded.sessionId === sessionId && decoded.digest === digest && decoded.securityRevision === revision && DateTime.toEpochMillis(decoded.expiresAt) === expiresAt && DateTime.toEpochMillis(decoded.absoluteExpiresAt) === absolute);
+		yield* Schema.decodeEffect(SessionId)(sessionId);
+		yield* Schema.decodeEffect(SessionCredentialVersion)(decoded.credentialVersion);
+		return {
+			...decoded,
+			issuedAt
+		};
+	});
+	const owner = Effect.fnUntraced(function* (record) {
+		const nativeSubject = yield* mapping.subjectId.toNative(record.subjectId), nativeSession = yield* mapping.sessionId.toNative(record.sessionId);
+		return sql.and([
+			sql`${table.column(s.subjectId)} = ${table.value(s.subjectId, nativeSubject)}`,
+			sql`${table.column(s.sessionId)} = ${table.value(s.sessionId, nativeSession)}`,
+			exact(table, s.digest, record.digest)
+		]);
+	});
+	const encodedCondition = (values) => sql.and(Object.entries(values).filter(([, value]) => value !== void 0).map(([key, value]) => value === null ? sql`${table.column(key)} is null` : typeof value === "string" ? exact(table, key, value) : sql`${table.column(key)} = ${table.value(key, value)}`));
+	return {
+		sql,
+		s,
+		table,
+		now,
+		exact,
+		millis,
+		live,
+		decode,
+		owner,
+		read: Effect.fnUntraced(function* (digest) {
+			const rows = yield* sql`select ${table.fields("session_")} from ${table.name} where ${exact(table, s.digest, digest)} and ${live(table)} limit 2`;
+			sessionInvariant(rows.length <= 1);
+			return rows[0] === void 0 ? void 0 : yield* decode(table.decode(rows[0], "session_"));
+		}),
+		encodedCondition
+	};
+});
+//#endregion
+export { makeConditionalSqlInsert, makeNativeSessionRecords, sameSessionRecord };
+
+//# sourceMappingURL=session-native-record.mjs.map

package/dist/internal/session-native-record.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-native-record.mjs","names":[],"sources":["../../src/internal/session-native-record.ts"],"sourcesContent":["import { TokenDigest } from \"@yielded/auth/Schema\";\nimport {\n  SessionId,\n  SessionMetadata,\n  SessionAuthenticationProvenance,\n  SessionCredentialVersion,\n  SecurityRevision,\n  type StatefulSessionRecord,\n} from \"@yielded/auth/Sessions\";\nimport { DateTime, Effect, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql/SqlClient\";\nimport type { Fragment } from \"effect/sql/Statement\";\n\nimport type { SubjectIdCodec } from \"./models/common\";\nimport type { StatefulSessionTables, SessionExecution } from \"./models/session-model\";\nimport type { NativeSqlTables, SqlTable } from \"./native-sql-table\";\nimport { sessionInvariant } from \"./session-native-state\";\nimport { exactSqlText } from \"./sql-change\";\nimport type { AnyTableModel } from \"./table-model\";\n\nexport type NativeSessionRecordMapping<Claims> = StatefulSessionTables<\n  Claims,\n  AnyTableModel,\n  unknown,\n  unknown\n> &\n  Pick<SessionExecution, \"clock\"> & { readonly subjectId: SubjectIdCodec<unknown> };\n\nconst metadataJson = Schema.encodeSync(Schema.fromJsonString(SessionMetadata));\nconst provenanceJson = Schema.encodeSync(Schema.fromJsonString(SessionAuthenticationProvenance));\n\nexport const sameSessionRecord = <Claims>(\n  left: StatefulSessionRecord<Claims>,\n  right: StatefulSessionRecord<Claims>,\n) =>\n  left.digest === right.digest &&\n  left.credentialVersion === right.credentialVersion &&\n  metadataJson(left) === metadataJson(right) &&\n  provenanceJson(left.provenance) === provenanceJson(right.provenance);\n\nexport const makeConditionalSqlInsert = Effect.fnUntraced(function* () {\n  const sql = (yield* SqlClient).withoutTransforms();\n\n  return (table: SqlTable, values: Readonly<Record<string, unknown>>, condition: Fragment) => {\n    const fields = Object.entries(values).filter(([, value]) => value !== undefined);\n\n    sessionInvariant(fields.length > 0);\n\n    return sql`insert into ${table.name} (${sql.join(\", \", false)(fields.map(([key]) => table.columnName(key)))}) select ${sql.join(\", \", false)(fields.map(([key, value]) => table.value(key, value)))} where ${condition}`;\n  };\n});\n\n/** Security columns identify the row and own its live time bounds. In particular\n * issuedAt may be assigned by UPDATE's database clock without rewriting a JSON\n * copy of prepared metadata. Claims/provenance decoding remains consumer-owned. */\nexport const makeNativeSessionRecords = Effect.fnUntraced(function* <Claims>(\n  tables: NativeSqlTables,\n  mapping: NativeSessionRecordMapping<Claims>,\n) {\n  const sql = (yield* SqlClient).withoutTransforms();\n\n  const s = mapping.session,\n    table = tables(s.table),\n    now = tables.expression(mapping.clock.engineNowMillis);\n\n  const exact = (t: SqlTable, key: string, value: unknown) =>\n    exactSqlText(sql, t.column(key), t.value(key, value));\n\n  const millis = (t: SqlTable, key: string) =>\n    tables.expression(mapping.clock.toMillis(t.column(key)));\n\n  const live = (t: SqlTable) =>\n    sql.and([\n      sql`${millis(t, s.issuedAt)} <= ${now}`,\n      sql`${millis(t, s.expiresAt)} > ${now}`,\n      sql`${millis(t, s.absoluteExpiresAt)} >= ${millis(t, s.expiresAt)}`,\n    ]);\n\n  const decode = Effect.fnUntraced(function* (row: Record<string, unknown>) {\n    const decoded = yield* s.decode(row);\n    const subjectId = yield* mapping.subjectId.toSubject(row[s.subjectId]);\n    const sessionId = yield* mapping.sessionId.toSession(row[s.sessionId]);\n    const digest = yield* Schema.decodeUnknownEffect(TokenDigest)(row[s.digest]);\n    const revision = yield* Schema.decodeUnknownEffect(SecurityRevision)(row[s.securityRevision]);\n    const issuedAt = DateTime.makeUnsafe(mapping.clock.decodeInstant(row[s.issuedAt]));\n    const expiresAt = mapping.clock.decodeInstant(row[s.expiresAt]);\n    const absolute = mapping.clock.decodeInstant(row[s.absoluteExpiresAt]);\n\n    sessionInvariant(\n      decoded.subjectId === subjectId &&\n        decoded.sessionId === sessionId &&\n        decoded.digest === digest &&\n        decoded.securityRevision === revision &&\n        DateTime.toEpochMillis(decoded.expiresAt) === expiresAt &&\n        DateTime.toEpochMillis(decoded.absoluteExpiresAt) === absolute,\n    );\n    yield* Schema.decodeEffect(SessionId)(sessionId);\n    yield* Schema.decodeEffect(SessionCredentialVersion)(decoded.credentialVersion);\n\n    return { ...decoded, issuedAt };\n  });\n\n  const owner = Effect.fnUntraced(function* (\n    record: Pick<StatefulSessionRecord<Claims>, \"subjectId\" | \"sessionId\" | \"digest\">,\n  ) {\n    const nativeSubject = yield* mapping.subjectId.toNative(record.subjectId),\n      nativeSession = yield* mapping.sessionId.toNative(record.sessionId);\n\n    return sql.and([\n      sql`${table.column(s.subjectId)} = ${table.value(s.subjectId, nativeSubject)}`,\n      sql`${table.column(s.sessionId)} = ${table.value(s.sessionId, nativeSession)}`,\n      exact(table, s.digest, record.digest),\n    ]);\n  });\n\n  // These are the semantic values supplied by the session encoder for this\n  // write, not an observed whole-row snapshot or unrelated application columns.\n  const encodedCondition = (values: Readonly<Record<string, unknown>>) =>\n    sql.and(\n      Object.entries(values)\n        .filter(([, value]) => value !== undefined)\n        .map(([key, value]) =>\n          value === null\n            ? sql`${table.column(key)} is null`\n            : typeof value === \"string\"\n              ? exact(table, key, value)\n              : sql`${table.column(key)} = ${table.value(key, value)}`,\n        ),\n    );\n\n  const read = Effect.fnUntraced(function* (digest: TokenDigest) {\n    const rows =\n      yield* sql`select ${table.fields(\"session_\")} from ${table.name} where ${exact(table, s.digest, digest)} and ${live(table)} limit 2`;\n\n    sessionInvariant(rows.length <= 1);\n\n    return rows[0] === undefined ? undefined : yield* decode(table.decode(rows[0], \"session_\"));\n  });\n\n  return { sql, s, table, now, exact, millis, live, decode, owner, read, encodedCondition };\n});\n"],"mappings":";;;;;;;AA4BA,MAAM,eAAe,OAAO,WAAW,OAAO,eAAe,eAAe,CAAC;AAC7E,MAAM,iBAAiB,OAAO,WAAW,OAAO,eAAe,+BAA+B,CAAC;AAE/F,MAAa,qBACX,MACA,UAEA,KAAK,WAAW,MAAM,UACtB,KAAK,sBAAsB,MAAM,qBACjC,aAAa,IAAI,MAAM,aAAa,KAAK,KACzC,eAAe,KAAK,UAAU,MAAM,eAAe,MAAM,UAAU;AAErE,MAAa,2BAA2B,OAAO,WAAW,aAAa;CACrE,MAAM,OAAO,OAAO,UAAA,CAAW,kBAAkB;CAEjD,QAAQ,OAAiB,QAA2C,cAAwB;EAC1F,MAAM,SAAS,OAAO,QAAQ,MAAM,CAAC,CAAC,QAAQ,GAAG,WAAW,UAAU,KAAA,CAAS;EAE/E,iBAAiB,OAAO,SAAS,CAAC;EAElC,OAAO,GAAG,eAAe,MAAM,KAAK,IAAI,IAAI,KAAK,MAAM,KAAK,CAAC,CAAC,OAAO,KAAK,CAAC,SAAS,MAAM,WAAW,GAAG,CAAC,CAAC,EAAE,WAAW,IAAI,KAAK,MAAM,KAAK,CAAC,CAAC,OAAO,KAAK,CAAC,KAAK,WAAW,MAAM,MAAM,KAAK,KAAK,CAAC,CAAC,EAAE,SAAS;CAC/M;AACF,CAAC;;;;AAKD,MAAa,2BAA2B,OAAO,WAAW,WACxD,QACA,SACA;CACA,MAAM,OAAO,OAAO,UAAA,CAAW,kBAAkB;CAEjD,MAAM,IAAI,QAAQ,SAChB,QAAQ,OAAO,EAAE,KAAK,GACtB,MAAM,OAAO,WAAW,QAAQ,MAAM,eAAe;CAEvD,MAAM,SAAS,GAAa,KAAa,UACvC,aAAa,KAAK,EAAE,OAAO,GAAG,GAAG,EAAE,MAAM,KAAK,KAAK,CAAC;CAEtD,MAAM,UAAU,GAAa,QAC3B,OAAO,WAAW,QAAQ,MAAM,SAAS,EAAE,OAAO,GAAG,CAAC,CAAC;CAEzD,MAAM,QAAQ,MACZ,IAAI,IAAI;EACN,GAAG,GAAG,OAAO,GAAG,EAAE,QAAQ,EAAE,MAAM;EAClC,GAAG,GAAG,OAAO,GAAG,EAAE,SAAS,EAAE,KAAK;EAClC,GAAG,GAAG,OAAO,GAAG,EAAE,iBAAiB,EAAE,MAAM,OAAO,GAAG,EAAE,SAAS;CAClE,CAAC;CAEH,MAAM,SAAS,OAAO,WAAW,WAAW,KAA8B;EACxE,MAAM,UAAU,OAAO,EAAE,OAAO,GAAG;EACnC,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,IAAI,EAAE,UAAU;EACrE,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,IAAI,EAAE,UAAU;EACrE,MAAM,SAAS,OAAO,OAAO,oBAAoB,WAAW,CAAC,CAAC,IAAI,EAAE,OAAO;EAC3E,MAAM,WAAW,OAAO,OAAO,oBAAoB,gBAAgB,CAAC,CAAC,IAAI,EAAE,iBAAiB;EAC5F,MAAM,WAAW,SAAS,WAAW,QAAQ,MAAM,cAAc,IAAI,EAAE,SAAS,CAAC;EACjF,MAAM,YAAY,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU;EAC9D,MAAM,WAAW,QAAQ,MAAM,cAAc,IAAI,EAAE,kBAAkB;EAErE,iBACE,QAAQ,cAAc,aACpB,QAAQ,cAAc,aACtB,QAAQ,WAAW,UACnB,QAAQ,qBAAqB,YAC7B,SAAS,cAAc,QAAQ,SAAS,MAAM,aAC9C,SAAS,cAAc,QAAQ,iBAAiB,MAAM,QAC1D;EACA,OAAO,OAAO,aAAa,SAAS,CAAC,CAAC,SAAS;EAC/C,OAAO,OAAO,aAAa,wBAAwB,CAAC,CAAC,QAAQ,iBAAiB;EAE9E,OAAO;GAAE,GAAG;GAAS;EAAS;CAChC,CAAC;CAED,MAAM,QAAQ,OAAO,WAAW,WAC9B,QACA;EACA,MAAM,gBAAgB,OAAO,QAAQ,UAAU,SAAS,OAAO,SAAS,GACtE,gBAAgB,OAAO,QAAQ,UAAU,SAAS,OAAO,SAAS;EAEpE,OAAO,IAAI,IAAI;GACb,GAAG,GAAG,MAAM,OAAO,EAAE,SAAS,EAAE,KAAK,MAAM,MAAM,EAAE,WAAW,aAAa;GAC3E,GAAG,GAAG,MAAM,OAAO,EAAE,SAAS,EAAE,KAAK,MAAM,MAAM,EAAE,WAAW,aAAa;GAC3E,MAAM,OAAO,EAAE,QAAQ,OAAO,MAAM;EACtC,CAAC;CACH,CAAC;CAID,MAAM,oBAAoB,WACxB,IAAI,IACF,OAAO,QAAQ,MAAM,CAAC,CACnB,QAAQ,GAAG,WAAW,UAAU,KAAA,CAAS,CAAC,CAC1C,KAAK,CAAC,KAAK,WACV,UAAU,OACN,GAAG,GAAG,MAAM,OAAO,GAAG,EAAE,YACxB,OAAO,UAAU,WACf,MAAM,OAAO,KAAK,KAAK,IACvB,GAAG,GAAG,MAAM,OAAO,GAAG,EAAE,KAAK,MAAM,MAAM,KAAK,KAAK,GAC3D,CACJ;CAWF,OAAO;EAAE;EAAK;EAAG;EAAO;EAAK;EAAO;EAAQ;EAAM;EAAQ;EAAO,MATpD,OAAO,WAAW,WAAW,QAAqB;GAC7D,MAAM,OACJ,OAAO,GAAG,UAAU,MAAM,OAAO,UAAU,EAAE,QAAQ,MAAM,KAAK,SAAS,MAAM,OAAO,EAAE,QAAQ,MAAM,EAAE,OAAO,KAAK,KAAK,EAAE;GAE7H,iBAAiB,KAAK,UAAU,CAAC;GAEjC,OAAO,KAAK,OAAO,KAAA,IAAY,KAAA,IAAY,OAAO,OAAO,MAAM,OAAO,KAAK,IAAI,UAAU,CAAC;EAC5F,CAEoE;EAAG;CAAiB;AAC1F,CAAC"}