@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.27

package/dist/internal/sql-persistence.mjs

@@ -1,9 +1,7 @@
 import { PersistenceConfigurationError } from "./configuration.mjs";
 import { Table } from "./sql-table.mjs";
 import { makeNativeSqlTables } from "./native-sql-table.mjs";
-import { makeComposedPasskeys } from "./passkeys.mjs";
 import { createPersistence } from "./persistence.mjs";
-import { makeSqlDatabase, sqlQueryOperations } from "./sql-query.mjs";
 import { Effect } from "effect";
 import { SqlClient } from "effect/sql";
 //#region src/internal/sql-persistence.ts
@@ -17,17 +15,15 @@ const AuthPersistence = {
 			columns: Object.fromEntries(Object.entries(table.columns).map(([key, column]) => [key, column.options])),
 			unique: table.unique
 		}),
-		operations: sqlQueryOperations,
-		nativeTables: (client) => makeNativeSqlTables(client),
-		passkeys: makeComposedPasskeys(sqlQueryOperations),
+		nativeTables: makeNativeSqlTables,
 		acquire: Effect.gen(function* () {
-			const dialect = (yield* SqlClient.SqlClient).onDialectOrElse({
+			const sql = yield* SqlClient.SqlClient;
+			if (sql.onDialectOrElse({
 				pg: () => "pg",
 				sqlite: () => "sqlite",
 				orElse: () => void 0
-			});
-			if (dialect === void 0) return yield* PersistenceConfigurationError.make({ reason: "Use an explicit adapter for this SQL dialect" });
-			return yield* makeSqlDatabase(dialect);
+			}) === void 0) return yield* PersistenceConfigurationError.make({ reason: "Use an explicit adapter for this SQL dialect" });
+			return sql;
 		})
 	}),
 	table

package/dist/internal/sql-persistence.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"sql-persistence.mjs","names":[],"sources":["../../src/internal/sql-persistence.ts"],"sourcesContent":["import { Effect } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\n\nimport { PersistenceConfigurationError, type PersistenceApi } from \"./configuration\";\nimport { makeNativeSqlTables } from \"./native-sql-table\";\nimport { makeComposedPasskeys } from \"./passkeys\";\nimport { createPersistence } from \"./persistence\";\nimport { makeSqlDatabase, sqlQueryOperations } from \"./sql-query\";\nimport { Table } from \"./sql-table\";\nimport type { StorageTable } from \"./storage-tables\";\n\nconst table = (definition: StorageTable) =>\n  new Table(definition.name, definition.columns, definition.unique, definition.schema);\n\nexport const AuthPersistence: PersistenceApi<Table> & { readonly table: typeof table } = {\n  ...createPersistence({\n    makeTable: table,\n    describe: (table: Table): StorageTable => ({\n      name: table.name,\n      ...(table.schema === undefined ? {} : { schema: table.schema }),\n      columns: Object.fromEntries(\n        Object.entries(table.columns).map(([key, column]) => [key, column.options]),\n      ),\n      unique: table.unique,\n    }),\n    operations: sqlQueryOperations,\n    nativeTables: (client) => makeNativeSqlTables(client),\n    passkeys: makeComposedPasskeys(sqlQueryOperations),\n    acquire: Effect.gen(function* () {\n      const sql = yield* SqlClient.SqlClient;\n\n      const dialect = sql.onDialectOrElse({\n        pg: () => \"pg\" as const,\n        sqlite: () => \"sqlite\" as const,\n        orElse: () => undefined,\n      });\n\n      if (dialect === undefined)\n        return yield* PersistenceConfigurationError.make({\n          reason: \"Use an explicit adapter for this SQL dialect\",\n        });\n\n      return yield* makeSqlDatabase(dialect);\n    }),\n  }),\n  table,\n};\n"],"mappings":";;;;;;;;;AAWA,MAAM,SAAS,eACb,IAAI,MAAM,WAAW,MAAM,WAAW,SAAS,WAAW,QAAQ,WAAW,MAAM;AAErF,MAAa,kBAA4E;CACvF,GAAG,kBAAkB;EACnB,WAAW;EACX,WAAW,WAAgC;GACzC,MAAM,MAAM;GACZ,GAAI,MAAM,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO;GAC7D,SAAS,OAAO,YACd,OAAO,QAAQ,MAAM,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC,KAAK,OAAO,OAAO,CAAC,CAC5E;GACA,QAAQ,MAAM;EAChB;EACA,YAAY;EACZ,eAAe,WAAW,oBAAoB,MAAM;EACpD,UAAU,qBAAqB,kBAAkB;EACjD,SAAS,OAAO,IAAI,aAAa;GAG/B,MAAM,WAAU,OAFG,UAAU,UAAA,CAET,gBAAgB;IAClC,UAAU;IACV,cAAc;IACd,cAAc,KAAA;GAChB,CAAC;GAED,IAAI,YAAY,KAAA,GACd,OAAO,OAAO,8BAA8B,KAAK,EAC/C,QAAQ,+CACV,CAAC;GAEH,OAAO,OAAO,gBAAgB,OAAO;EACvC,CAAC;CACH,CAAC;CACD;AACF"}
+{"version":3,"file":"sql-persistence.mjs","names":[],"sources":["../../src/internal/sql-persistence.ts"],"sourcesContent":["import { Effect } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\n\nimport { PersistenceConfigurationError, type PersistenceApi } from \"./configuration\";\nimport { makeNativeSqlTables } from \"./native-sql-table\";\nimport { createPersistence } from \"./persistence\";\nimport { Table } from \"./sql-table\";\nimport type { StorageTable } from \"./storage-tables\";\n\nconst table = (definition: StorageTable) =>\n  new Table(definition.name, definition.columns, definition.unique, definition.schema);\n\nexport const AuthPersistence: PersistenceApi<Table> & { readonly table: typeof table } = {\n  ...createPersistence({\n    makeTable: table,\n    describe: (table: Table): StorageTable => ({\n      name: table.name,\n      ...(table.schema === undefined ? {} : { schema: table.schema }),\n      columns: Object.fromEntries(\n        Object.entries(table.columns).map(([key, column]) => [key, column.options]),\n      ),\n      unique: table.unique,\n    }),\n    nativeTables: makeNativeSqlTables,\n    acquire: Effect.gen(function* () {\n      const sql = yield* SqlClient.SqlClient;\n\n      const dialect = sql.onDialectOrElse({\n        pg: () => \"pg\" as const,\n        sqlite: () => \"sqlite\" as const,\n        orElse: () => undefined,\n      });\n\n      if (dialect === undefined)\n        return yield* PersistenceConfigurationError.make({\n          reason: \"Use an explicit adapter for this SQL dialect\",\n        });\n\n      return sql;\n    }),\n  }),\n  table,\n};\n"],"mappings":";;;;;;;AASA,MAAM,SAAS,eACb,IAAI,MAAM,WAAW,MAAM,WAAW,SAAS,WAAW,QAAQ,WAAW,MAAM;AAErF,MAAa,kBAA4E;CACvF,GAAG,kBAAkB;EACnB,WAAW;EACX,WAAW,WAAgC;GACzC,MAAM,MAAM;GACZ,GAAI,MAAM,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO;GAC7D,SAAS,OAAO,YACd,OAAO,QAAQ,MAAM,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC,KAAK,OAAO,OAAO,CAAC,CAC5E;GACA,QAAQ,MAAM;EAChB;EACA,cAAc;EACd,SAAS,OAAO,IAAI,aAAa;GAC/B,MAAM,MAAM,OAAO,UAAU;GAQ7B,IANgB,IAAI,gBAAgB;IAClC,UAAU;IACV,cAAc;IACd,cAAc,KAAA;GAChB,CAEU,MAAM,KAAA,GACd,OAAO,OAAO,8BAA8B,KAAK,EAC/C,QAAQ,+CACV,CAAC;GAEH,OAAO;EACT,CAAC;CACH,CAAC;CACD;AACF"}

package/dist/internal/sql-storage-validation.mjs

@@ -1,6 +1,5 @@
 import { PersistenceMappingError } from "./mapping-error.mjs";
 import { Table } from "./sql-table.mjs";
-import { NativeDatabase } from "./transaction-kernel.mjs";
 import { validateStorageBatch } from "./storage-validation.mjs";
 import { storageKeyPlans } from "./storage-plans.mjs";
 import { Effect } from "effect";
@@ -18,7 +17,7 @@ const validateSqlStorage = Effect.fnUntraced(function* (mapping) {
 			cause: "Invalid storage key mapping"
 		})
 	});
-	const { $client: client } = yield* NativeDatabase;
+	const client = yield* SqlClient.SqlClient;
 	const dialect = client.onDialectOrElse({
 		pg: () => "pg",
 		sqlite: () => "sqlite",

package/dist/internal/sql-storage-validation.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"sql-storage-validation.mjs","names":[],"sources":["../../src/internal/sql-storage-validation.ts"],"sourcesContent":["import { Effect } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\n\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport { Table } from \"./sql-table\";\nimport { storageKeyPlans } from \"./storage-plans\";\nimport { validateStorageBatch, type StorageValidation } from \"./storage-validation\";\nimport { NativeDatabase } from \"./transaction-kernel\";\n\n/** Check declared mappings against physical keys before acquiring OAuth services. */\nexport const validateSqlStorage = Effect.fnUntraced(function* (mapping: unknown) {\n  const plans = yield* Effect.try({\n    try: () =>\n      storageKeyPlans(mapping, (table) => {\n        if (!(table instanceof Table)) throw new Error(\"Expected a SQL table\");\n\n        return table.columns;\n      }),\n    catch: () =>\n      PersistenceMappingError.make({ operation: \"mapping\", cause: \"Invalid storage key mapping\" }),\n  });\n\n  const { $client: client } = yield* NativeDatabase;\n\n  const dialect = client.onDialectOrElse({\n    pg: () => \"pg\" as const,\n    sqlite: () => \"sqlite\" as const,\n    orElse: () => undefined,\n  });\n\n  if (dialect === undefined)\n    return yield* PersistenceMappingError.make({\n      operation: \"mapping\",\n      cause: \"OAuth persistence requires PostgreSQL or SQLite\",\n    });\n  const validations: StorageValidation[] = [];\n\n  for (const plan of plans) {\n    if (!(plan.table instanceof Table))\n      return yield* PersistenceMappingError.make({\n        operation: \"mapping\",\n        cause: \"Expected a SQL table\",\n      });\n    validations.push({\n      table: {\n        name: plan.table.name,\n        ...(plan.table.schema === undefined ? {} : { schema: plan.table.schema }),\n        columns: Object.fromEntries(\n          Object.entries(plan.table.columns).map(([key, column]) => [key, column.options]),\n        ),\n      },\n      required: [plan.keys],\n    });\n  }\n  yield* validateStorageBatch(dialect, validations).pipe(\n    Effect.provideService(SqlClient.SqlClient, client),\n    Effect.mapError(() =>\n      PersistenceMappingError.make({\n        operation: \"mapping\",\n        cause: \"Required SQL storage key is unavailable\",\n      }),\n    ),\n  );\n});\n"],"mappings":";;;;;;;;;AAUA,MAAa,qBAAqB,OAAO,WAAW,WAAW,SAAkB;CAC/E,MAAM,QAAQ,OAAO,OAAO,IAAI;EAC9B,WACE,gBAAgB,UAAU,UAAU;GAClC,IAAI,EAAE,iBAAiB,QAAQ,MAAM,IAAI,MAAM,sBAAsB;GAErE,OAAO,MAAM;EACf,CAAC;EACH,aACE,wBAAwB,KAAK;GAAE,WAAW;GAAW,OAAO;EAA8B,CAAC;CAC/F,CAAC;CAED,MAAM,EAAE,SAAS,WAAW,OAAO;CAEnC,MAAM,UAAU,OAAO,gBAAgB;EACrC,UAAU;EACV,cAAc;EACd,cAAc,KAAA;CAChB,CAAC;CAED,IAAI,YAAY,KAAA,GACd,OAAO,OAAO,wBAAwB,KAAK;EACzC,WAAW;EACX,OAAO;CACT,CAAC;CACH,MAAM,cAAmC,CAAC;CAE1C,KAAK,MAAM,QAAQ,OAAO;EACxB,IAAI,EAAE,KAAK,iBAAiB,QAC1B,OAAO,OAAO,wBAAwB,KAAK;GACzC,WAAW;GACX,OAAO;EACT,CAAC;EACH,YAAY,KAAK;GACf,OAAO;IACL,MAAM,KAAK,MAAM;IACjB,GAAI,KAAK,MAAM,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,KAAK,MAAM,OAAO;IACvE,SAAS,OAAO,YACd,OAAO,QAAQ,KAAK,MAAM,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC,KAAK,OAAO,OAAO,CAAC,CACjF;GACF;GACA,UAAU,CAAC,KAAK,IAAI;EACtB,CAAC;CACH;CACA,OAAO,qBAAqB,SAAS,WAAW,CAAC,CAAC,KAChD,OAAO,eAAe,UAAU,WAAW,MAAM,GACjD,OAAO,eACL,wBAAwB,KAAK;EAC3B,WAAW;EACX,OAAO;CACT,CAAC,CACH,CACF;AACF,CAAC"}
+{"version":3,"file":"sql-storage-validation.mjs","names":[],"sources":["../../src/internal/sql-storage-validation.ts"],"sourcesContent":["import { Effect } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\n\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport { Table } from \"./sql-table\";\nimport { storageKeyPlans } from \"./storage-plans\";\nimport { validateStorageBatch, type StorageValidation } from \"./storage-validation\";\n\n/** Check declared mappings against physical keys before acquiring OAuth services. */\nexport const validateSqlStorage = Effect.fnUntraced(function* (mapping: unknown) {\n  const plans = yield* Effect.try({\n    try: () =>\n      storageKeyPlans(mapping, (table) => {\n        if (!(table instanceof Table)) throw new Error(\"Expected a SQL table\");\n\n        return table.columns;\n      }),\n    catch: () =>\n      PersistenceMappingError.make({ operation: \"mapping\", cause: \"Invalid storage key mapping\" }),\n  });\n\n  const client = yield* SqlClient.SqlClient;\n\n  const dialect = client.onDialectOrElse({\n    pg: () => \"pg\" as const,\n    sqlite: () => \"sqlite\" as const,\n    orElse: () => undefined,\n  });\n\n  if (dialect === undefined)\n    return yield* PersistenceMappingError.make({\n      operation: \"mapping\",\n      cause: \"OAuth persistence requires PostgreSQL or SQLite\",\n    });\n  const validations: StorageValidation[] = [];\n\n  for (const plan of plans) {\n    if (!(plan.table instanceof Table))\n      return yield* PersistenceMappingError.make({\n        operation: \"mapping\",\n        cause: \"Expected a SQL table\",\n      });\n    validations.push({\n      table: {\n        name: plan.table.name,\n        ...(plan.table.schema === undefined ? {} : { schema: plan.table.schema }),\n        columns: Object.fromEntries(\n          Object.entries(plan.table.columns).map(([key, column]) => [key, column.options]),\n        ),\n      },\n      required: [plan.keys],\n    });\n  }\n  yield* validateStorageBatch(dialect, validations).pipe(\n    Effect.provideService(SqlClient.SqlClient, client),\n    Effect.mapError(() =>\n      PersistenceMappingError.make({\n        operation: \"mapping\",\n        cause: \"Required SQL storage key is unavailable\",\n      }),\n    ),\n  );\n});\n"],"mappings":";;;;;;;;AASA,MAAa,qBAAqB,OAAO,WAAW,WAAW,SAAkB;CAC/E,MAAM,QAAQ,OAAO,OAAO,IAAI;EAC9B,WACE,gBAAgB,UAAU,UAAU;GAClC,IAAI,EAAE,iBAAiB,QAAQ,MAAM,IAAI,MAAM,sBAAsB;GAErE,OAAO,MAAM;EACf,CAAC;EACH,aACE,wBAAwB,KAAK;GAAE,WAAW;GAAW,OAAO;EAA8B,CAAC;CAC/F,CAAC;CAED,MAAM,SAAS,OAAO,UAAU;CAEhC,MAAM,UAAU,OAAO,gBAAgB;EACrC,UAAU;EACV,cAAc;EACd,cAAc,KAAA;CAChB,CAAC;CAED,IAAI,YAAY,KAAA,GACd,OAAO,OAAO,wBAAwB,KAAK;EACzC,WAAW;EACX,OAAO;CACT,CAAC;CACH,MAAM,cAAmC,CAAC;CAE1C,KAAK,MAAM,QAAQ,OAAO;EACxB,IAAI,EAAE,KAAK,iBAAiB,QAC1B,OAAO,OAAO,wBAAwB,KAAK;GACzC,WAAW;GACX,OAAO;EACT,CAAC;EACH,YAAY,KAAK;GACf,OAAO;IACL,MAAM,KAAK,MAAM;IACjB,GAAI,KAAK,MAAM,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,KAAK,MAAM,OAAO;IACvE,SAAS,OAAO,YACd,OAAO,QAAQ,KAAK,MAAM,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC,KAAK,OAAO,OAAO,CAAC,CACjF;GACF;GACA,UAAU,CAAC,KAAK,IAAI;EACtB,CAAC;CACH;CACA,OAAO,qBAAqB,SAAS,WAAW,CAAC,CAAC,KAChD,OAAO,eAAe,UAAU,WAAW,MAAM,GACjD,OAAO,eACL,wBAAwB,KAAK;EAC3B,WAAW;EACX,OAAO;CACT,CAAC,CACH,CACF;AACF,CAAC"}

package/dist/internal/sql-table.d.mts

@@ -1,31 +1,18 @@
 //#region src/internal/sql-table.d.ts
-export type Dialect = "pg" | "sqlite";
-export interface Compiler {
-  readonly dialect: Dialect;
-  readonly parameters: unknown[];
-}
-export declare class Fragment {
-  readonly render: (compiler: Compiler) => string;
-  readonly decode: (value: unknown) => unknown;
-  constructor(render: (compiler: Compiler) => string, decode?: (value: unknown) => unknown);
-  mapWith(decode: (value: unknown) => unknown): Fragment;
-  as(_name: string): Fragment;
-  getSQL(): Fragment;
-}
 export interface ColumnOptions {
   readonly name: string;
   readonly type: "text" | "integer" | "boolean";
   readonly nullable?: boolean;
 }
-export declare class Column extends Fragment {
+export declare class Column {
   readonly tableName: string;
   readonly options: ColumnOptions;
   readonly schema?: string | undefined;
   constructor(tableName: string, options: ColumnOptions, schema?: string | undefined);
-  mapToDriverValue(value: unknown): unknown;
+  decode(value: unknown): unknown;
 }
 /** Plain SQL identifiers and column representations, independent of an ORM. */
-export declare class Table extends Fragment {
+export declare class Table {
   readonly name: string;
   readonly unique: ReadonlyArray<ReadonlyArray<string>>;
   readonly schema?: string | undefined;

package/dist/internal/sql-table.mjs

@@ -11,64 +11,43 @@ const SqlInteger = Schema.Union([
 }));
 const decodeInteger = Schema.decodeUnknownOption(SqlInteger);
 const identifier = (name) => "\"" + name.replaceAll("\"", "\"\"") + "\"";
-var Fragment = class Fragment {
-	render;
-	decode;
-	constructor(render, decode = (value) => value) {
-		this.render = render;
-		this.decode = decode;
-	}
-	mapWith(decode) {
-		return new Fragment(this.render, decode);
-	}
-	as(_name) {
-		return this;
-	}
-	getSQL() {
-		return this;
-	}
-};
-var Column = class extends Fragment {
+var Column = class {
 	tableName;
 	options;
 	schema;
 	constructor(tableName, options, schema) {
-		super(() => `${schema === void 0 ? "" : identifier(schema) + "."}${identifier(tableName)}.${identifier(options.name)}`, (value) => {
-			if (value === null) return value;
-			if (options.type === "boolean") {
-				if (value === true || value === 1) return true;
-				if (value === false || value === 0) return false;
-				throw PersistenceMappingError.make({
-					operation: "decode",
-					cause: "Invalid SQL boolean"
-				});
-			}
-			if (options.type === "integer") {
-				const number = decodeInteger(value);
-				if (Option.isSome(number)) return number.value;
-				throw PersistenceMappingError.make({
-					operation: "decode",
-					cause: "SQL integer is outside the safe range"
-				});
-			}
-			return value;
-		});
 		this.tableName = tableName;
 		this.options = options;
 		this.schema = schema;
 	}
-	mapToDriverValue(value) {
+	decode(value) {
+		if (value === null) return value;
+		if (this.options.type === "boolean") {
+			if (value === true || value === 1) return true;
+			if (value === false || value === 0) return false;
+			throw PersistenceMappingError.make({
+				operation: "decode",
+				cause: "Invalid SQL boolean"
+			});
+		}
+		if (this.options.type === "integer") {
+			const number = decodeInteger(value);
+			if (Option.isSome(number)) return number.value;
+			throw PersistenceMappingError.make({
+				operation: "decode",
+				cause: "SQL integer is outside the safe range"
+			});
+		}
 		return value;
 	}
 };
 /** Plain SQL identifiers and column representations, independent of an ORM. */
-var Table = class extends Fragment {
+var Table = class {
 	name;
 	unique;
 	schema;
 	columns;
 	constructor(name, columns, unique, schema) {
-		super(() => (schema === void 0 ? "" : identifier(schema) + ".") + identifier(name));
 		this.name = name;
 		this.unique = unique;
 		this.schema = schema;
@@ -76,6 +55,6 @@ var Table = class extends Fragment {
 	}
 };
 //#endregion
-export { Column, Fragment, Table, identifier };
+export { Column, Table, identifier };
 
 //# sourceMappingURL=sql-table.mjs.map

package/dist/internal/sql-table.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"sql-table.mjs","names":[],"sources":["../../src/internal/sql-table.ts"],"sourcesContent":["import { Option, Schema, SchemaGetter } from \"effect\";\n\nimport { PersistenceMappingError } from \"./mapping-error\";\n\nconst SqlInteger = Schema.Union([\n  Schema.Int,\n  Schema.BigInt,\n  Schema.String.check(Schema.isPattern(/^-?\\d+$/)),\n]).pipe(\n  Schema.decodeTo(Schema.Int, {\n    decode: SchemaGetter.transform(Number),\n    encode: SchemaGetter.passthrough(),\n  }),\n);\n\nconst decodeInteger = Schema.decodeUnknownOption(SqlInteger);\n\nexport type Dialect = \"pg\" | \"sqlite\";\nexport type Row = Readonly<Record<string, unknown>>;\n\nexport interface Compiler {\n  readonly dialect: Dialect;\n  readonly parameters: unknown[];\n}\n\nexport const identifier = (name: string) => '\"' + name.replaceAll('\"', '\"\"') + '\"';\n\nexport class Fragment {\n  constructor(\n    readonly render: (compiler: Compiler) => string,\n    readonly decode: (value: unknown) => unknown = (value) => value,\n  ) {}\n\n  mapWith(decode: (value: unknown) => unknown): Fragment {\n    return new Fragment(this.render, decode);\n  }\n\n  as(_name: string): Fragment {\n    return this;\n  }\n\n  getSQL(): Fragment {\n    return this;\n  }\n}\n\nexport interface ColumnOptions {\n  readonly name: string;\n  readonly type: \"text\" | \"integer\" | \"boolean\";\n  readonly nullable?: boolean;\n}\n\nexport class Column extends Fragment {\n  constructor(\n    readonly tableName: string,\n    readonly options: ColumnOptions,\n    readonly schema?: string,\n  ) {\n    super(\n      () =>\n        `${schema === undefined ? \"\" : identifier(schema) + \".\"}${identifier(tableName)}.${identifier(options.name)}`,\n      (value) => {\n        if (value === null) return value;\n        if (options.type === \"boolean\") {\n          if (value === true || value === 1) return true;\n          if (value === false || value === 0) return false;\n          throw PersistenceMappingError.make({ operation: \"decode\", cause: \"Invalid SQL boolean\" });\n        }\n        if (options.type === \"integer\") {\n          const number = decodeInteger(value);\n\n          if (Option.isSome(number)) return number.value;\n          throw PersistenceMappingError.make({\n            operation: \"decode\",\n            cause: \"SQL integer is outside the safe range\",\n          });\n        }\n\n        return value;\n      },\n    );\n  }\n\n  mapToDriverValue(value: unknown): unknown {\n    return value;\n  }\n}\n\n/** Plain SQL identifiers and column representations, independent of an ORM. */\nexport class Table extends Fragment {\n  readonly columns: Readonly<Record<string, Column>>;\n\n  constructor(\n    readonly name: string,\n    columns: Readonly<Record<string, ColumnOptions>>,\n    readonly unique: ReadonlyArray<ReadonlyArray<string>>,\n    readonly schema?: string,\n  ) {\n    super(() => (schema === undefined ? \"\" : identifier(schema) + \".\") + identifier(name));\n    this.columns = Object.fromEntries(\n      Object.entries(columns).map(([key, options]) => [key, new Column(name, options, schema)]),\n    );\n  }\n}\n"],"mappings":";;;AAIA,MAAM,aAAa,OAAO,MAAM;CAC9B,OAAO;CACP,OAAO;CACP,OAAO,OAAO,MAAM,OAAO,UAAU,SAAS,CAAC;AACjD,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,OAAO,KAAK;CAC1B,QAAQ,aAAa,UAAU,MAAM;CACrC,QAAQ,aAAa,YAAY;AACnC,CAAC,CACH;AAEA,MAAM,gBAAgB,OAAO,oBAAoB,UAAU;AAU3D,MAAa,cAAc,SAAiB,OAAM,KAAK,WAAW,MAAK,MAAI,IAAI;AAE/E,IAAa,WAAb,MAAa,SAAS;CAET;CACA;CAFX,YACE,QACA,UAAgD,UAAU,OAC1D;EAFS,KAAA,SAAA;EACA,KAAA,SAAA;CACR;CAEH,QAAQ,QAA+C;EACrD,OAAO,IAAI,SAAS,KAAK,QAAQ,MAAM;CACzC;CAEA,GAAG,OAAyB;EAC1B,OAAO;CACT;CAEA,SAAmB;EACjB,OAAO;CACT;AACF;AAQA,IAAa,SAAb,cAA4B,SAAS;CAExB;CACA;CACA;CAHX,YACE,WACA,SACA,QACA;EACA,YAEI,GAAG,WAAW,KAAA,IAAY,KAAK,WAAW,MAAM,IAAI,MAAM,WAAW,SAAS,EAAE,GAAG,WAAW,QAAQ,IAAI,MAC3G,UAAU;GACT,IAAI,UAAU,MAAM,OAAO;GAC3B,IAAI,QAAQ,SAAS,WAAW;IAC9B,IAAI,UAAU,QAAQ,UAAU,GAAG,OAAO;IAC1C,IAAI,UAAU,SAAS,UAAU,GAAG,OAAO;IAC3C,MAAM,wBAAwB,KAAK;KAAE,WAAW;KAAU,OAAO;IAAsB,CAAC;GAC1F;GACA,IAAI,QAAQ,SAAS,WAAW;IAC9B,MAAM,SAAS,cAAc,KAAK;IAElC,IAAI,OAAO,OAAO,MAAM,GAAG,OAAO,OAAO;IACzC,MAAM,wBAAwB,KAAK;KACjC,WAAW;KACX,OAAO;IACT,CAAC;GACH;GAEA,OAAO;EACT,CACF;EA1BS,KAAA,YAAA;EACA,KAAA,UAAA;EACA,KAAA,SAAA;CAyBX;CAEA,iBAAiB,OAAyB;EACxC,OAAO;CACT;AACF;;AAGA,IAAa,QAAb,cAA2B,SAAS;CAIvB;CAEA;CACA;CANX;CAEA,YACE,MACA,SACA,QACA,QACA;EACA,aAAa,WAAW,KAAA,IAAY,KAAK,WAAW,MAAM,IAAI,OAAO,WAAW,IAAI,CAAC;EAL5E,KAAA,OAAA;EAEA,KAAA,SAAA;EACA,KAAA,SAAA;EAGT,KAAK,UAAU,OAAO,YACpB,OAAO,QAAQ,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,aAAa,CAAC,KAAK,IAAI,OAAO,MAAM,SAAS,MAAM,CAAC,CAAC,CAC1F;CACF;AACF"}
+{"version":3,"file":"sql-table.mjs","names":[],"sources":["../../src/internal/sql-table.ts"],"sourcesContent":["import { Option, Schema, SchemaGetter } from \"effect\";\n\nimport { PersistenceMappingError } from \"./mapping-error\";\n\nconst SqlInteger = Schema.Union([\n  Schema.Int,\n  Schema.BigInt,\n  Schema.String.check(Schema.isPattern(/^-?\\d+$/)),\n]).pipe(\n  Schema.decodeTo(Schema.Int, {\n    decode: SchemaGetter.transform(Number),\n    encode: SchemaGetter.passthrough(),\n  }),\n);\n\nconst decodeInteger = Schema.decodeUnknownOption(SqlInteger);\n\nexport type Dialect = \"pg\" | \"sqlite\";\nexport type Row = Readonly<Record<string, unknown>>;\n\nexport const identifier = (name: string) => '\"' + name.replaceAll('\"', '\"\"') + '\"';\n\nexport interface ColumnOptions {\n  readonly name: string;\n  readonly type: \"text\" | \"integer\" | \"boolean\";\n  readonly nullable?: boolean;\n}\n\nexport class Column {\n  constructor(\n    readonly tableName: string,\n    readonly options: ColumnOptions,\n    readonly schema?: string,\n  ) {}\n\n  decode(value: unknown): unknown {\n    if (value === null) return value;\n    if (this.options.type === \"boolean\") {\n      if (value === true || value === 1) return true;\n      if (value === false || value === 0) return false;\n      throw PersistenceMappingError.make({ operation: \"decode\", cause: \"Invalid SQL boolean\" });\n    }\n    if (this.options.type === \"integer\") {\n      const number = decodeInteger(value);\n\n      if (Option.isSome(number)) return number.value;\n      throw PersistenceMappingError.make({\n        operation: \"decode\",\n        cause: \"SQL integer is outside the safe range\",\n      });\n    }\n\n    return value;\n  }\n}\n\n/** Plain SQL identifiers and column representations, independent of an ORM. */\nexport class Table {\n  readonly columns: Readonly<Record<string, Column>>;\n\n  constructor(\n    readonly name: string,\n    columns: Readonly<Record<string, ColumnOptions>>,\n    readonly unique: ReadonlyArray<ReadonlyArray<string>>,\n    readonly schema?: string,\n  ) {\n    this.columns = Object.fromEntries(\n      Object.entries(columns).map(([key, options]) => [key, new Column(name, options, schema)]),\n    );\n  }\n}\n"],"mappings":";;;AAIA,MAAM,aAAa,OAAO,MAAM;CAC9B,OAAO;CACP,OAAO;CACP,OAAO,OAAO,MAAM,OAAO,UAAU,SAAS,CAAC;AACjD,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,OAAO,KAAK;CAC1B,QAAQ,aAAa,UAAU,MAAM;CACrC,QAAQ,aAAa,YAAY;AACnC,CAAC,CACH;AAEA,MAAM,gBAAgB,OAAO,oBAAoB,UAAU;AAK3D,MAAa,cAAc,SAAiB,OAAM,KAAK,WAAW,MAAK,MAAI,IAAI;AAQ/E,IAAa,SAAb,MAAoB;CAEP;CACA;CACA;CAHX,YACE,WACA,SACA,QACA;EAHS,KAAA,YAAA;EACA,KAAA,UAAA;EACA,KAAA,SAAA;CACR;CAEH,OAAO,OAAyB;EAC9B,IAAI,UAAU,MAAM,OAAO;EAC3B,IAAI,KAAK,QAAQ,SAAS,WAAW;GACnC,IAAI,UAAU,QAAQ,UAAU,GAAG,OAAO;GAC1C,IAAI,UAAU,SAAS,UAAU,GAAG,OAAO;GAC3C,MAAM,wBAAwB,KAAK;IAAE,WAAW;IAAU,OAAO;GAAsB,CAAC;EAC1F;EACA,IAAI,KAAK,QAAQ,SAAS,WAAW;GACnC,MAAM,SAAS,cAAc,KAAK;GAElC,IAAI,OAAO,OAAO,MAAM,GAAG,OAAO,OAAO;GACzC,MAAM,wBAAwB,KAAK;IACjC,WAAW;IACX,OAAO;GACT,CAAC;EACH;EAEA,OAAO;CACT;AACF;;AAGA,IAAa,QAAb,MAAmB;CAIN;CAEA;CACA;CANX;CAEA,YACE,MACA,SACA,QACA,QACA;EAJS,KAAA,OAAA;EAEA,KAAA,SAAA;EACA,KAAA,SAAA;EAET,KAAK,UAAU,OAAO,YACpB,OAAO,QAAQ,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,aAAa,CAAC,KAAK,IAAI,OAAO,MAAM,SAAS,MAAM,CAAC,CAAC,CAC1F;CACF;AACF"}

package/dist/internal/standalone.mjs

@@ -2,9 +2,8 @@ import { Effect } from "effect";
 //#region src/internal/standalone.ts
 /** Standalone operations must observe their own durable commit. */
 const requireStandalone = (unavailable, transactionService) => Effect.withFiber((fiber) => {
-	const services = fiber.context.mapUnsafe;
-	if (transactionService !== void 0 && services.has(transactionService.key)) return Effect.fail(unavailable());
-	for (const key of services.keys()) if (key.startsWith("@effect/sql-libsql/LibsqlClient/LibsqlTransaction/")) return Effect.fail(unavailable());
+	if (transactionService === void 0) return Effect.fail(unavailable());
+	if (fiber.context.mapUnsafe.has(transactionService.key)) return Effect.fail(unavailable());
 	return Effect.void;
 });
 //#endregion

package/dist/internal/standalone.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"standalone.mjs","names":[],"sources":["../../src/internal/standalone.ts"],"sourcesContent":["import { type Context, Effect } from \"effect\";\nimport type * as SqlClient from \"effect/sql/SqlClient\";\n\n/** Standalone operations must observe their own durable commit. */\nexport const requireStandalone = <Failure>(\n  unavailable: () => Failure,\n  transactionService?: Context.Key<\n    SqlClient.TransactionConnection,\n    SqlClient.TransactionConnection.Service\n  >,\n): Effect.Effect<void, Failure> =>\n  Effect.withFiber((fiber) => {\n    const services = fiber.context.mapUnsafe;\n\n    if (transactionService !== undefined && services.has(transactionService.key))\n      return Effect.fail(unavailable());\n\n    // rc.117 libSQL uses a private per-client marker that is not exposed through\n    // SqlClient.transactionService. Conservatively reject every ambient libSQL\n    // transaction, including another client's, before issuing standalone writes.\n    // Recheck this upstream detail whenever the Effect driver is upgraded.\n    for (const key of services.keys()) {\n      if (key.startsWith(\"@effect/sql-libsql/LibsqlClient/LibsqlTransaction/\"))\n        return Effect.fail(unavailable());\n    }\n\n    return Effect.void;\n  });\n"],"mappings":";;;AAIA,MAAa,qBACX,aACA,uBAKA,OAAO,WAAW,UAAU;CAC1B,MAAM,WAAW,MAAM,QAAQ;CAE/B,IAAI,uBAAuB,KAAA,KAAa,SAAS,IAAI,mBAAmB,GAAG,GACzE,OAAO,OAAO,KAAK,YAAY,CAAC;CAMlC,KAAK,MAAM,OAAO,SAAS,KAAK,GAC9B,IAAI,IAAI,WAAW,oDAAoD,GACrE,OAAO,OAAO,KAAK,YAAY,CAAC;CAGpC,OAAO,OAAO;AAChB,CAAC"}
+{"version":3,"file":"standalone.mjs","names":[],"sources":["../../src/internal/standalone.ts"],"sourcesContent":["import { type Context, Effect } from \"effect\";\nimport type * as SqlClient from \"effect/sql/SqlClient\";\n\n/** Standalone operations must observe their own durable commit. */\nexport const requireStandalone = <Failure>(\n  unavailable: () => Failure,\n  transactionService?: Context.Key<\n    SqlClient.TransactionConnection,\n    SqlClient.TransactionConnection.Service\n  >,\n): Effect.Effect<void, Failure> =>\n  Effect.withFiber((fiber) => {\n    if (transactionService === undefined) return Effect.fail(unavailable());\n    const services = fiber.context.mapUnsafe;\n\n    if (services.has(transactionService.key)) return Effect.fail(unavailable());\n\n    return Effect.void;\n  });\n"],"mappings":";;;AAIA,MAAa,qBACX,aACA,uBAKA,OAAO,WAAW,UAAU;CAC1B,IAAI,uBAAuB,KAAA,GAAW,OAAO,OAAO,KAAK,YAAY,CAAC;CAGtE,IAFiB,MAAM,QAAQ,UAElB,IAAI,mBAAmB,GAAG,GAAG,OAAO,OAAO,KAAK,YAAY,CAAC;CAE1E,OAAO,OAAO;AAChB,CAAC"}

package/dist/internal/step-up-state.mjs

@@ -1,3 +1,4 @@
+import { sameSessionRevision } from "./session-native-state.mjs";
 import { DateTime, Effect, Schema } from "effect";
 import { AuthenticationEvidence, SessionMetadata, SessionStepUpIntent, SessionStepUpInvalid, SessionStepUpRequirement, SessionUnavailable } from "@yielded/auth/Sessions";
 //#region src/internal/step-up-state.ts
@@ -5,28 +6,24 @@ const stepUpIntentCodec = Schema.fromJsonString(SessionStepUpIntent);
 const BoundedSnapshot = Schema.String.check(Schema.isMaxLength(131072));
 const encodeStepUpIntent = (intent) => Schema.encodeEffect(stepUpIntentCodec)(intent).pipe(Effect.flatMap(Schema.decodeEffect(BoundedSnapshot)), Effect.mapError(() => SessionUnavailable.make({})));
 const decodeStepUpIntent = (snapshot) => Schema.decodeEffect(BoundedSnapshot)(snapshot).pipe(Effect.flatMap(Schema.decodeEffect(stepUpIntentCodec)), Effect.mapError(() => SessionUnavailable.make({})));
-const sameStepUpRevision = (left, right) => left.subjectId === right.subjectId && left.securityRevision === right.securityRevision && left.credentials.length === right.credentials.length && new Set(left.credentials.map((c) => c.credentialId)).size === left.credentials.length && left.credentials.every((item) => right.credentials.some((other) => item.credentialId === other.credentialId && item.revision === other.revision));
 const stepUpIntentLive = (intent, kind, now) => {
 	const n = DateTime.toEpochMillis(now), authenticated = DateTime.toEpochMillis(intent.sourceAuthenticatedAt), idle = DateTime.toEpochMillis(intent.sourceExpiresAt), absolute = DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt), expires = DateTime.toEpochMillis(intent.expiresAt);
 	return intent.sourceKind === kind && authenticated <= n && n < expires && expires <= idle && idle <= absolute;
 };
 const evidenceEncoding = Schema.encodeSync(Schema.fromJsonString(AuthenticationEvidence));
 const requirementEncoding = Schema.encodeSync(Schema.fromJsonString(SessionStepUpRequirement));
-const metadataEncoding = Schema.encodeSync(Schema.fromJsonString(SessionMetadata));
+Schema.encodeSync(Schema.fromJsonString(SessionMetadata));
 /** Validate core-owned plans before driver allocation/SQL expansion. No bearer or Claims decoding. */
 const validateStepUpPlan = Effect.fn("DrizzleStepUp.validatePlan")(function* (plan) {
 	const { intent, source, replacement, evidence } = plan;
 	const original = source.inspection;
 	if (requirementEncoding(plan.profileRequirement) !== requirementEncoding(intent.requirement) || replacement.inspection.session.subjectId !== evidence.revision.subjectId || replacement.inspection.session.securityRevision !== evidence.revision.securityRevision || intent.revision.credentials.some((item) => !evidence.revision.credentials.some((actual) => actual.credentialId === item.credentialId && actual.revision === item.revision))) return yield* SessionStepUpInvalid.make({});
-	if (intent.sourceKind !== source.guard._tag || intent.sourceKind !== replacement._tag || intent.sourceSessionId !== original.session.sessionId || intent.sourceCredentialVersion !== original.credentialVersion || !sameStepUpRevision(intent.revision, original.provenance.evidence.revision) || intent.revision.subjectId !== evidence.revision.subjectId || intent.revision.securityRevision !== evidence.revision.securityRevision || intent.flowId !== evidence.flowId || intent.bindingDigest !== evidence.bindingDigest || DateTime.toEpochMillis(intent.sourceAuthenticatedAt) !== DateTime.toEpochMillis(original.session.assurance.authenticatedAt) || DateTime.toEpochMillis(intent.sourceExpiresAt) !== DateTime.toEpochMillis(original.session.expiresAt) || DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt) !== DateTime.toEpochMillis(original.session.absoluteExpiresAt) || DateTime.toEpochMillis(intent.sourceAuthenticatedAt) !== DateTime.toEpochMillis(replacement.inspection.session.assurance.authenticatedAt) || DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt) !== DateTime.toEpochMillis(replacement.inspection.session.absoluteExpiresAt) || evidenceEncoding(replacement.inspection.provenance.evidence) !== evidenceEncoding(evidence)) return yield* SessionStepUpInvalid.make({});
-	if (replacement._tag === "Stateful" && (source.guard._tag !== "Stateful" || source.guard.digest !== replacement.expectedDigest || source.guard.rowVersion !== replacement.expectedRowVersion || replacement.inspection.session.sessionId !== intent.sourceSessionId)) return yield* SessionStepUpInvalid.make({});
+	if (intent.sourceKind !== source.guard._tag || intent.sourceKind !== replacement._tag || intent.sourceSessionId !== original.session.sessionId || intent.sourceCredentialVersion !== original.credentialVersion || !sameSessionRevision(intent.revision, original.provenance.evidence.revision) || intent.revision.subjectId !== evidence.revision.subjectId || intent.revision.securityRevision !== evidence.revision.securityRevision || intent.flowId !== evidence.flowId || intent.bindingDigest !== evidence.bindingDigest || DateTime.toEpochMillis(intent.sourceAuthenticatedAt) !== DateTime.toEpochMillis(original.session.assurance.authenticatedAt) || DateTime.toEpochMillis(intent.sourceExpiresAt) !== DateTime.toEpochMillis(original.session.expiresAt) || DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt) !== DateTime.toEpochMillis(original.session.absoluteExpiresAt) || DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt) !== DateTime.toEpochMillis(replacement.inspection.session.absoluteExpiresAt) || evidenceEncoding(replacement.inspection.provenance.evidence) !== evidenceEncoding(evidence)) return yield* SessionStepUpInvalid.make({});
+	if (replacement._tag === "Stateful" && (source.guard._tag !== "Stateful" || source.guard.digest !== replacement.expectedDigest || replacement.inspection.session.sessionId !== intent.sourceSessionId)) return yield* SessionStepUpInvalid.make({});
 	if (replacement._tag === "StateAssistedSigned" && (replacement.tombstoneSessionId !== intent.sourceSessionId || DateTime.toEpochMillis(replacement.tombstoneUntil) !== DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt))) return yield* SessionStepUpInvalid.make({});
 	if (replacement._tag !== "Stateful" && replacement.inspection.session.sessionId === intent.sourceSessionId) return yield* SessionStepUpInvalid.make({});
 });
-/** Compare a consumer-decoded encoded update/readback with the intended rotation.
-* Claims are consumer-owned; their lossless round trip remains the codec contract. */
-const stepUpRotationMatches = (plan, record) => plan.replacement._tag === "Stateful" && record.digest === plan.replacement.nextDigest && record.credentialVersion === plan.replacement.inspection.credentialVersion && metadataEncoding(record) === metadataEncoding(plan.replacement.inspection.session) && evidenceEncoding(record.provenance.evidence) === evidenceEncoding(plan.evidence);
 //#endregion
-export { decodeStepUpIntent, encodeStepUpIntent, sameStepUpRevision, stepUpIntentCodec, stepUpIntentLive, stepUpRotationMatches, validateStepUpPlan };
+export { decodeStepUpIntent, encodeStepUpIntent, stepUpIntentCodec, stepUpIntentLive, validateStepUpPlan };
 
 //# sourceMappingURL=step-up-state.mjs.map

package/dist/internal/step-up-state.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"step-up-state.mjs","names":[],"sources":["../../src/internal/step-up-state.ts"],"sourcesContent":["import {\n  SessionStepUpInvalid,\n  SessionUnavailable,\n  AuthenticationEvidence,\n  type AuthenticationRevision,\n  SessionMetadata,\n  SessionStepUpIntent,\n  SessionStepUpRequirement,\n  type SessionStepUpCompletionPlan,\n  type StatefulSessionRecord,\n} from \"@yielded/auth/Sessions\";\nimport { DateTime, Effect, Schema } from \"effect\";\n\nexport const stepUpIntentCodec = Schema.fromJsonString(SessionStepUpIntent);\nconst BoundedSnapshot = Schema.String.check(Schema.isMaxLength(131072));\n\nexport const encodeStepUpIntent = (intent: SessionStepUpIntent) =>\n  Schema.encodeEffect(stepUpIntentCodec)(intent).pipe(\n    Effect.flatMap(Schema.decodeEffect(BoundedSnapshot)),\n    Effect.mapError(() => SessionUnavailable.make({})),\n  );\n\nexport const decodeStepUpIntent = (snapshot: string) =>\n  Schema.decodeEffect(BoundedSnapshot)(snapshot).pipe(\n    Effect.flatMap(Schema.decodeEffect(stepUpIntentCodec)),\n    Effect.mapError(() => SessionUnavailable.make({})),\n  );\n\nexport const sameStepUpRevision = (left: AuthenticationRevision, right: AuthenticationRevision) =>\n  left.subjectId === right.subjectId &&\n  left.securityRevision === right.securityRevision &&\n  left.credentials.length === right.credentials.length &&\n  new Set(left.credentials.map((c) => c.credentialId)).size === left.credentials.length &&\n  left.credentials.every((item) =>\n    right.credentials.some(\n      (other) => item.credentialId === other.credentialId && item.revision === other.revision,\n    ),\n  );\n\nexport const stepUpIntentLive = (\n  intent: SessionStepUpIntent,\n  kind: SessionStepUpIntent[\"sourceKind\"],\n  now: DateTime.Utc,\n) => {\n  const n = DateTime.toEpochMillis(now),\n    authenticated = DateTime.toEpochMillis(intent.sourceAuthenticatedAt),\n    idle = DateTime.toEpochMillis(intent.sourceExpiresAt),\n    absolute = DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt),\n    expires = DateTime.toEpochMillis(intent.expiresAt);\n\n  return (\n    intent.sourceKind === kind &&\n    authenticated <= n &&\n    n < expires &&\n    expires <= idle &&\n    idle <= absolute\n  );\n};\n\nconst evidenceEncoding = Schema.encodeSync(Schema.fromJsonString(AuthenticationEvidence));\nconst requirementEncoding = Schema.encodeSync(Schema.fromJsonString(SessionStepUpRequirement));\nconst metadataEncoding = Schema.encodeSync(Schema.fromJsonString(SessionMetadata));\n\n/** Validate core-owned plans before driver allocation/SQL expansion. No bearer or Claims decoding. */\nexport const validateStepUpPlan = Effect.fn(\"DrizzleStepUp.validatePlan\")(function* <Claims>(\n  plan: SessionStepUpCompletionPlan<Claims>,\n) {\n  const { intent, source, replacement, evidence } = plan;\n  const original = source.inspection;\n\n  if (\n    requirementEncoding(plan.profileRequirement) !== requirementEncoding(intent.requirement) ||\n    replacement.inspection.session.subjectId !== evidence.revision.subjectId ||\n    replacement.inspection.session.securityRevision !== evidence.revision.securityRevision ||\n    intent.revision.credentials.some(\n      (item) =>\n        !evidence.revision.credentials.some(\n          (actual) =>\n            actual.credentialId === item.credentialId && actual.revision === item.revision,\n        ),\n    )\n  )\n    return yield* SessionStepUpInvalid.make({});\n  if (\n    intent.sourceKind !== source.guard._tag ||\n    intent.sourceKind !== replacement._tag ||\n    intent.sourceSessionId !== original.session.sessionId ||\n    intent.sourceCredentialVersion !== original.credentialVersion ||\n    !sameStepUpRevision(intent.revision, original.provenance.evidence.revision) ||\n    intent.revision.subjectId !== evidence.revision.subjectId ||\n    intent.revision.securityRevision !== evidence.revision.securityRevision ||\n    intent.flowId !== evidence.flowId ||\n    intent.bindingDigest !== evidence.bindingDigest ||\n    DateTime.toEpochMillis(intent.sourceAuthenticatedAt) !==\n      DateTime.toEpochMillis(original.session.assurance.authenticatedAt) ||\n    DateTime.toEpochMillis(intent.sourceExpiresAt) !==\n      DateTime.toEpochMillis(original.session.expiresAt) ||\n    DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt) !==\n      DateTime.toEpochMillis(original.session.absoluteExpiresAt) ||\n    DateTime.toEpochMillis(intent.sourceAuthenticatedAt) !==\n      DateTime.toEpochMillis(replacement.inspection.session.assurance.authenticatedAt) ||\n    DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt) !==\n      DateTime.toEpochMillis(replacement.inspection.session.absoluteExpiresAt) ||\n    evidenceEncoding(replacement.inspection.provenance.evidence) !== evidenceEncoding(evidence)\n  )\n    return yield* SessionStepUpInvalid.make({});\n  if (\n    replacement._tag === \"Stateful\" &&\n    (source.guard._tag !== \"Stateful\" ||\n      source.guard.digest !== replacement.expectedDigest ||\n      source.guard.rowVersion !== replacement.expectedRowVersion ||\n      replacement.inspection.session.sessionId !== intent.sourceSessionId)\n  )\n    return yield* SessionStepUpInvalid.make({});\n  if (\n    replacement._tag === \"StateAssistedSigned\" &&\n    (replacement.tombstoneSessionId !== intent.sourceSessionId ||\n      DateTime.toEpochMillis(replacement.tombstoneUntil) !==\n        DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt))\n  )\n    return yield* SessionStepUpInvalid.make({});\n  if (\n    replacement._tag !== \"Stateful\" &&\n    replacement.inspection.session.sessionId === intent.sourceSessionId\n  )\n    return yield* SessionStepUpInvalid.make({});\n});\n\n/** Compare a consumer-decoded encoded update/readback with the intended rotation.\n * Claims are consumer-owned; their lossless round trip remains the codec contract. */\nexport const stepUpRotationMatches = <Claims>(\n  plan: SessionStepUpCompletionPlan<Claims>,\n  record: StatefulSessionRecord<Claims>,\n) =>\n  plan.replacement._tag === \"Stateful\" &&\n  record.digest === plan.replacement.nextDigest &&\n  record.credentialVersion === plan.replacement.inspection.credentialVersion &&\n  metadataEncoding(record) === metadataEncoding(plan.replacement.inspection.session) &&\n  evidenceEncoding(record.provenance.evidence) === evidenceEncoding(plan.evidence);\n"],"mappings":";;;AAaA,MAAa,oBAAoB,OAAO,eAAe,mBAAmB;AAC1E,MAAM,kBAAkB,OAAO,OAAO,MAAM,OAAO,YAAY,MAAM,CAAC;AAEtE,MAAa,sBAAsB,WACjC,OAAO,aAAa,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,KAC7C,OAAO,QAAQ,OAAO,aAAa,eAAe,CAAC,GACnD,OAAO,eAAe,mBAAmB,KAAK,CAAC,CAAC,CAAC,CACnD;AAEF,MAAa,sBAAsB,aACjC,OAAO,aAAa,eAAe,CAAC,CAAC,QAAQ,CAAC,CAAC,KAC7C,OAAO,QAAQ,OAAO,aAAa,iBAAiB,CAAC,GACrD,OAAO,eAAe,mBAAmB,KAAK,CAAC,CAAC,CAAC,CACnD;AAEF,MAAa,sBAAsB,MAA8B,UAC/D,KAAK,cAAc,MAAM,aACzB,KAAK,qBAAqB,MAAM,oBAChC,KAAK,YAAY,WAAW,MAAM,YAAY,UAC9C,IAAI,IAAI,KAAK,YAAY,KAAK,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,SAAS,KAAK,YAAY,UAC/E,KAAK,YAAY,OAAO,SACtB,MAAM,YAAY,MACf,UAAU,KAAK,iBAAiB,MAAM,gBAAgB,KAAK,aAAa,MAAM,QACjF,CACF;AAEF,MAAa,oBACX,QACA,MACA,QACG;CACH,MAAM,IAAI,SAAS,cAAc,GAAG,GAClC,gBAAgB,SAAS,cAAc,OAAO,qBAAqB,GACnE,OAAO,SAAS,cAAc,OAAO,eAAe,GACpD,WAAW,SAAS,cAAc,OAAO,uBAAuB,GAChE,UAAU,SAAS,cAAc,OAAO,SAAS;CAEnD,OACE,OAAO,eAAe,QACtB,iBAAiB,KACjB,IAAI,WACJ,WAAW,QACX,QAAQ;AAEZ;AAEA,MAAM,mBAAmB,OAAO,WAAW,OAAO,eAAe,sBAAsB,CAAC;AACxF,MAAM,sBAAsB,OAAO,WAAW,OAAO,eAAe,wBAAwB,CAAC;AAC7F,MAAM,mBAAmB,OAAO,WAAW,OAAO,eAAe,eAAe,CAAC;;AAGjF,MAAa,qBAAqB,OAAO,GAAG,4BAA4B,CAAC,CAAC,WACxE,MACA;CACA,MAAM,EAAE,QAAQ,QAAQ,aAAa,aAAa;CAClD,MAAM,WAAW,OAAO;CAExB,IACE,oBAAoB,KAAK,kBAAkB,MAAM,oBAAoB,OAAO,WAAW,KACvF,YAAY,WAAW,QAAQ,cAAc,SAAS,SAAS,aAC/D,YAAY,WAAW,QAAQ,qBAAqB,SAAS,SAAS,oBACtE,OAAO,SAAS,YAAY,MACzB,SACC,CAAC,SAAS,SAAS,YAAY,MAC5B,WACC,OAAO,iBAAiB,KAAK,gBAAgB,OAAO,aAAa,KAAK,QAC1E,CACJ,GAEA,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;CAC5C,IACE,OAAO,eAAe,OAAO,MAAM,QACnC,OAAO,eAAe,YAAY,QAClC,OAAO,oBAAoB,SAAS,QAAQ,aAC5C,OAAO,4BAA4B,SAAS,qBAC5C,CAAC,mBAAmB,OAAO,UAAU,SAAS,WAAW,SAAS,QAAQ,KAC1E,OAAO,SAAS,cAAc,SAAS,SAAS,aAChD,OAAO,SAAS,qBAAqB,SAAS,SAAS,oBACvD,OAAO,WAAW,SAAS,UAC3B,OAAO,kBAAkB,SAAS,iBAClC,SAAS,cAAc,OAAO,qBAAqB,MACjD,SAAS,cAAc,SAAS,QAAQ,UAAU,eAAe,KACnE,SAAS,cAAc,OAAO,eAAe,MAC3C,SAAS,cAAc,SAAS,QAAQ,SAAS,KACnD,SAAS,cAAc,OAAO,uBAAuB,MACnD,SAAS,cAAc,SAAS,QAAQ,iBAAiB,KAC3D,SAAS,cAAc,OAAO,qBAAqB,MACjD,SAAS,cAAc,YAAY,WAAW,QAAQ,UAAU,eAAe,KACjF,SAAS,cAAc,OAAO,uBAAuB,MACnD,SAAS,cAAc,YAAY,WAAW,QAAQ,iBAAiB,KACzE,iBAAiB,YAAY,WAAW,WAAW,QAAQ,MAAM,iBAAiB,QAAQ,GAE1F,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;CAC5C,IACE,YAAY,SAAS,eACpB,OAAO,MAAM,SAAS,cACrB,OAAO,MAAM,WAAW,YAAY,kBACpC,OAAO,MAAM,eAAe,YAAY,sBACxC,YAAY,WAAW,QAAQ,cAAc,OAAO,kBAEtD,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;CAC5C,IACE,YAAY,SAAS,0BACpB,YAAY,uBAAuB,OAAO,mBACzC,SAAS,cAAc,YAAY,cAAc,MAC/C,SAAS,cAAc,OAAO,uBAAuB,IAEzD,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;CAC5C,IACE,YAAY,SAAS,cACrB,YAAY,WAAW,QAAQ,cAAc,OAAO,iBAEpD,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;AAC9C,CAAC;;;AAID,MAAa,yBACX,MACA,WAEA,KAAK,YAAY,SAAS,cAC1B,OAAO,WAAW,KAAK,YAAY,cACnC,OAAO,sBAAsB,KAAK,YAAY,WAAW,qBACzD,iBAAiB,MAAM,MAAM,iBAAiB,KAAK,YAAY,WAAW,OAAO,KACjF,iBAAiB,OAAO,WAAW,QAAQ,MAAM,iBAAiB,KAAK,QAAQ"}
+{"version":3,"file":"step-up-state.mjs","names":[],"sources":["../../src/internal/step-up-state.ts"],"sourcesContent":["import {\n  SessionStepUpInvalid,\n  SessionUnavailable,\n  AuthenticationEvidence,\n  SessionMetadata,\n  SessionStepUpIntent,\n  SessionStepUpRequirement,\n  type SessionStepUpCompletionPlan,\n  type StatefulSessionRecord,\n} from \"@yielded/auth/Sessions\";\nimport { DateTime, Effect, Schema } from \"effect\";\n\nimport { sameSessionRevision } from \"./session-native-state\";\n\nexport const stepUpIntentCodec = Schema.fromJsonString(SessionStepUpIntent);\nconst BoundedSnapshot = Schema.String.check(Schema.isMaxLength(131072));\n\nexport const encodeStepUpIntent = (intent: SessionStepUpIntent) =>\n  Schema.encodeEffect(stepUpIntentCodec)(intent).pipe(\n    Effect.flatMap(Schema.decodeEffect(BoundedSnapshot)),\n    Effect.mapError(() => SessionUnavailable.make({})),\n  );\n\nexport const decodeStepUpIntent = (snapshot: string) =>\n  Schema.decodeEffect(BoundedSnapshot)(snapshot).pipe(\n    Effect.flatMap(Schema.decodeEffect(stepUpIntentCodec)),\n    Effect.mapError(() => SessionUnavailable.make({})),\n  );\n\nexport const stepUpIntentLive = (\n  intent: Omit<SessionStepUpIntent, \"version\">,\n  kind: SessionStepUpIntent[\"sourceKind\"],\n  now: DateTime.Utc,\n) => {\n  const n = DateTime.toEpochMillis(now),\n    authenticated = DateTime.toEpochMillis(intent.sourceAuthenticatedAt),\n    idle = DateTime.toEpochMillis(intent.sourceExpiresAt),\n    absolute = DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt),\n    expires = DateTime.toEpochMillis(intent.expiresAt);\n\n  return (\n    intent.sourceKind === kind &&\n    authenticated <= n &&\n    n < expires &&\n    expires <= idle &&\n    idle <= absolute\n  );\n};\n\nconst evidenceEncoding = Schema.encodeSync(Schema.fromJsonString(AuthenticationEvidence));\nconst requirementEncoding = Schema.encodeSync(Schema.fromJsonString(SessionStepUpRequirement));\nconst metadataEncoding = Schema.encodeSync(Schema.fromJsonString(SessionMetadata));\n\n/** Validate core-owned plans before driver allocation/SQL expansion. No bearer or Claims decoding. */\nexport const validateStepUpPlan = Effect.fn(\"DrizzleStepUp.validatePlan\")(function* <Claims>(\n  plan: SessionStepUpCompletionPlan<Claims>,\n) {\n  const { intent, source, replacement, evidence } = plan;\n  const original = source.inspection;\n\n  if (\n    requirementEncoding(plan.profileRequirement) !== requirementEncoding(intent.requirement) ||\n    replacement.inspection.session.subjectId !== evidence.revision.subjectId ||\n    replacement.inspection.session.securityRevision !== evidence.revision.securityRevision ||\n    intent.revision.credentials.some(\n      (item) =>\n        !evidence.revision.credentials.some(\n          (actual) =>\n            actual.credentialId === item.credentialId && actual.revision === item.revision,\n        ),\n    )\n  )\n    return yield* SessionStepUpInvalid.make({});\n  if (\n    intent.sourceKind !== source.guard._tag ||\n    intent.sourceKind !== replacement._tag ||\n    intent.sourceSessionId !== original.session.sessionId ||\n    intent.sourceCredentialVersion !== original.credentialVersion ||\n    !sameSessionRevision(intent.revision, original.provenance.evidence.revision) ||\n    intent.revision.subjectId !== evidence.revision.subjectId ||\n    intent.revision.securityRevision !== evidence.revision.securityRevision ||\n    intent.flowId !== evidence.flowId ||\n    intent.bindingDigest !== evidence.bindingDigest ||\n    DateTime.toEpochMillis(intent.sourceAuthenticatedAt) !==\n      DateTime.toEpochMillis(original.session.assurance.authenticatedAt) ||\n    DateTime.toEpochMillis(intent.sourceExpiresAt) !==\n      DateTime.toEpochMillis(original.session.expiresAt) ||\n    DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt) !==\n      DateTime.toEpochMillis(original.session.absoluteExpiresAt) ||\n    DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt) !==\n      DateTime.toEpochMillis(replacement.inspection.session.absoluteExpiresAt) ||\n    evidenceEncoding(replacement.inspection.provenance.evidence) !== evidenceEncoding(evidence)\n  )\n    return yield* SessionStepUpInvalid.make({});\n  if (\n    replacement._tag === \"Stateful\" &&\n    (source.guard._tag !== \"Stateful\" ||\n      source.guard.digest !== replacement.expectedDigest ||\n      replacement.inspection.session.sessionId !== intent.sourceSessionId)\n  )\n    return yield* SessionStepUpInvalid.make({});\n  if (\n    replacement._tag === \"StateAssistedSigned\" &&\n    (replacement.tombstoneSessionId !== intent.sourceSessionId ||\n      DateTime.toEpochMillis(replacement.tombstoneUntil) !==\n        DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt))\n  )\n    return yield* SessionStepUpInvalid.make({});\n  if (\n    replacement._tag !== \"Stateful\" &&\n    replacement.inspection.session.sessionId === intent.sourceSessionId\n  )\n    return yield* SessionStepUpInvalid.make({});\n});\n\n/** Compare a consumer-decoded encoded update/readback with the intended rotation.\n * Claims are consumer-owned; their lossless round trip remains the codec contract. */\nexport const stepUpRotationMatches = <Claims>(\n  plan: SessionStepUpCompletionPlan<Claims>,\n  record: StatefulSessionRecord<Claims>,\n) =>\n  plan.replacement._tag === \"Stateful\" &&\n  record.digest === plan.replacement.nextDigest &&\n  record.credentialVersion === plan.replacement.inspection.credentialVersion &&\n  metadataEncoding(record) === metadataEncoding(plan.replacement.inspection.session) &&\n  evidenceEncoding(record.provenance.evidence) === evidenceEncoding(plan.evidence);\n"],"mappings":";;;;AAcA,MAAa,oBAAoB,OAAO,eAAe,mBAAmB;AAC1E,MAAM,kBAAkB,OAAO,OAAO,MAAM,OAAO,YAAY,MAAM,CAAC;AAEtE,MAAa,sBAAsB,WACjC,OAAO,aAAa,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,KAC7C,OAAO,QAAQ,OAAO,aAAa,eAAe,CAAC,GACnD,OAAO,eAAe,mBAAmB,KAAK,CAAC,CAAC,CAAC,CACnD;AAEF,MAAa,sBAAsB,aACjC,OAAO,aAAa,eAAe,CAAC,CAAC,QAAQ,CAAC,CAAC,KAC7C,OAAO,QAAQ,OAAO,aAAa,iBAAiB,CAAC,GACrD,OAAO,eAAe,mBAAmB,KAAK,CAAC,CAAC,CAAC,CACnD;AAEF,MAAa,oBACX,QACA,MACA,QACG;CACH,MAAM,IAAI,SAAS,cAAc,GAAG,GAClC,gBAAgB,SAAS,cAAc,OAAO,qBAAqB,GACnE,OAAO,SAAS,cAAc,OAAO,eAAe,GACpD,WAAW,SAAS,cAAc,OAAO,uBAAuB,GAChE,UAAU,SAAS,cAAc,OAAO,SAAS;CAEnD,OACE,OAAO,eAAe,QACtB,iBAAiB,KACjB,IAAI,WACJ,WAAW,QACX,QAAQ;AAEZ;AAEA,MAAM,mBAAmB,OAAO,WAAW,OAAO,eAAe,sBAAsB,CAAC;AACxF,MAAM,sBAAsB,OAAO,WAAW,OAAO,eAAe,wBAAwB,CAAC;AACpE,OAAO,WAAW,OAAO,eAAe,eAAe,CAAC;;AAGjF,MAAa,qBAAqB,OAAO,GAAG,4BAA4B,CAAC,CAAC,WACxE,MACA;CACA,MAAM,EAAE,QAAQ,QAAQ,aAAa,aAAa;CAClD,MAAM,WAAW,OAAO;CAExB,IACE,oBAAoB,KAAK,kBAAkB,MAAM,oBAAoB,OAAO,WAAW,KACvF,YAAY,WAAW,QAAQ,cAAc,SAAS,SAAS,aAC/D,YAAY,WAAW,QAAQ,qBAAqB,SAAS,SAAS,oBACtE,OAAO,SAAS,YAAY,MACzB,SACC,CAAC,SAAS,SAAS,YAAY,MAC5B,WACC,OAAO,iBAAiB,KAAK,gBAAgB,OAAO,aAAa,KAAK,QAC1E,CACJ,GAEA,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;CAC5C,IACE,OAAO,eAAe,OAAO,MAAM,QACnC,OAAO,eAAe,YAAY,QAClC,OAAO,oBAAoB,SAAS,QAAQ,aAC5C,OAAO,4BAA4B,SAAS,qBAC5C,CAAC,oBAAoB,OAAO,UAAU,SAAS,WAAW,SAAS,QAAQ,KAC3E,OAAO,SAAS,cAAc,SAAS,SAAS,aAChD,OAAO,SAAS,qBAAqB,SAAS,SAAS,oBACvD,OAAO,WAAW,SAAS,UAC3B,OAAO,kBAAkB,SAAS,iBAClC,SAAS,cAAc,OAAO,qBAAqB,MACjD,SAAS,cAAc,SAAS,QAAQ,UAAU,eAAe,KACnE,SAAS,cAAc,OAAO,eAAe,MAC3C,SAAS,cAAc,SAAS,QAAQ,SAAS,KACnD,SAAS,cAAc,OAAO,uBAAuB,MACnD,SAAS,cAAc,SAAS,QAAQ,iBAAiB,KAC3D,SAAS,cAAc,OAAO,uBAAuB,MACnD,SAAS,cAAc,YAAY,WAAW,QAAQ,iBAAiB,KACzE,iBAAiB,YAAY,WAAW,WAAW,QAAQ,MAAM,iBAAiB,QAAQ,GAE1F,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;CAC5C,IACE,YAAY,SAAS,eACpB,OAAO,MAAM,SAAS,cACrB,OAAO,MAAM,WAAW,YAAY,kBACpC,YAAY,WAAW,QAAQ,cAAc,OAAO,kBAEtD,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;CAC5C,IACE,YAAY,SAAS,0BACpB,YAAY,uBAAuB,OAAO,mBACzC,SAAS,cAAc,YAAY,cAAc,MAC/C,SAAS,cAAc,OAAO,uBAAuB,IAEzD,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;CAC5C,IACE,YAAY,SAAS,cACrB,YAAY,WAAW,QAAQ,cAAc,OAAO,iBAEpD,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;AAC9C,CAAC"}

package/dist/internal/storage-clock.mjs

@@ -0,0 +1,44 @@
+import { PersistenceMappingError } from "./mapping-error.mjs";
+import { compileSqlExpression } from "./sql-expression.mjs";
+import { Effect } from "effect";
+import { SqlClient } from "effect/sql/SqlClient";
+//#region src/internal/storage-clock.ts
+/** Managed storage supports epoch milliseconds or canonical ISO text. */
+const makeStorageClock = Effect.fnUntraced(function* (storage) {
+	const sql = (yield* SqlClient).withoutTransforms();
+	const encoded = storage.encodeInstant(0);
+	const numeric = typeof encoded === "number";
+	if (!numeric && encoded !== "1970-01-01T00:00:00.000Z") return yield* PersistenceMappingError.make({
+		operation: "mapping",
+		cause: "Unsupported managed timestamp representation"
+	});
+	return {
+		encodeInstant: storage.encodeInstant,
+		decodeInstant: storage.decodeInstantSync,
+		engineNowMillis: sql.onDialectOrElse({
+			pg: () => sql`cast(extract(epoch from clock_timestamp()) * 1000 as bigint)`,
+			mysql: () => sql`cast(unix_timestamp(current_timestamp(3)) * 1000 as signed)`,
+			orElse: () => sql`cast(round((julianday('now') - 2440587.5) * 86400000) as integer)`
+		}),
+		toMillis: (expression) => {
+			const value = compileSqlExpression(sql, expression);
+			return numeric ? value : sql.onDialectOrElse({
+				pg: () => sql`cast(extract(epoch from cast(${value} as timestamptz)) * 1000 as bigint)`,
+				mysql: () => sql`cast(unix_timestamp(str_to_date(${value}, '%Y-%m-%dT%H:%i:%s.%fZ')) * 1000 as signed)`,
+				orElse: () => sql`cast(round((julianday(${value}) - 2440587.5) * 86400000) as integer)`
+			});
+		},
+		fromMillis: (expression) => {
+			const value = compileSqlExpression(sql, expression);
+			return numeric ? value : sql.onDialectOrElse({
+				pg: () => sql`to_char(to_timestamp((${value}) / 1000.0) at time zone 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')`,
+				mysql: () => sql`concat(date_format(from_unixtime((${value}) / 1000.0), '%Y-%m-%dT%H:%i:%s.'), lpad(mod(${value}, 1000), 3, '0'), 'Z')`,
+				orElse: () => sql`strftime('%Y-%m-%dT%H:%M:%fZ', (${value}) / 1000.0, 'unixepoch')`
+			});
+		}
+	};
+});
+//#endregion
+export { makeStorageClock };
+
+//# sourceMappingURL=storage-clock.mjs.map

package/dist/internal/storage-clock.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-clock.mjs","names":[],"sources":["../../src/internal/storage-clock.ts"],"sourcesContent":["import { Effect } from \"effect\";\nimport { SqlClient } from \"effect/sql/SqlClient\";\n\nimport type { MappingInput } from \"./configuration\";\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport type { ProofClock } from \"./models/proof-model\";\nimport { compileSqlExpression } from \"./sql-expression\";\nimport type { SqlExpression } from \"./table-model\";\n\n/** Managed storage supports epoch milliseconds or canonical ISO text. */\nexport const makeStorageClock = Effect.fnUntraced(function* (storage: MappingInput) {\n  const sql = (yield* SqlClient).withoutTransforms();\n  const encoded = storage.encodeInstant(0);\n  const numeric = typeof encoded === \"number\";\n\n  if (!numeric && encoded !== \"1970-01-01T00:00:00.000Z\")\n    return yield* PersistenceMappingError.make({\n      operation: \"mapping\",\n      cause: \"Unsupported managed timestamp representation\",\n    });\n\n  const clock: ProofClock<SqlExpression> = {\n    encodeInstant: storage.encodeInstant,\n    decodeInstant: storage.decodeInstantSync,\n    engineNowMillis: sql.onDialectOrElse({\n      pg: () => sql`cast(extract(epoch from clock_timestamp()) * 1000 as bigint)`,\n      mysql: () => sql`cast(unix_timestamp(current_timestamp(3)) * 1000 as signed)`,\n      orElse: () => sql`cast(round((julianday('now') - 2440587.5) * 86400000) as integer)`,\n    }),\n    toMillis: (expression) => {\n      const value = compileSqlExpression(sql, expression);\n\n      return numeric\n        ? value\n        : sql.onDialectOrElse({\n            pg: () => sql`cast(extract(epoch from cast(${value} as timestamptz)) * 1000 as bigint)`,\n            mysql: () =>\n              sql`cast(unix_timestamp(str_to_date(${value}, '%Y-%m-%dT%H:%i:%s.%fZ')) * 1000 as signed)`,\n            orElse: () => sql`cast(round((julianday(${value}) - 2440587.5) * 86400000) as integer)`,\n          });\n    },\n    fromMillis: (expression) => {\n      const value = compileSqlExpression(sql, expression);\n\n      return numeric\n        ? value\n        : sql.onDialectOrElse({\n            pg: () =>\n              sql`to_char(to_timestamp((${value}) / 1000.0) at time zone 'UTC', 'YYYY-MM-DD\"T\"HH24:MI:SS.MS\"Z\"')`,\n            mysql: () =>\n              sql`concat(date_format(from_unixtime((${value}) / 1000.0), '%Y-%m-%dT%H:%i:%s.'), lpad(mod(${value}, 1000), 3, '0'), 'Z')`,\n            orElse: () => sql`strftime('%Y-%m-%dT%H:%M:%fZ', (${value}) / 1000.0, 'unixepoch')`,\n          });\n    },\n  };\n\n  return clock;\n});\n"],"mappings":";;;;;;AAUA,MAAa,mBAAmB,OAAO,WAAW,WAAW,SAAuB;CAClF,MAAM,OAAO,OAAO,UAAA,CAAW,kBAAkB;CACjD,MAAM,UAAU,QAAQ,cAAc,CAAC;CACvC,MAAM,UAAU,OAAO,YAAY;CAEnC,IAAI,CAAC,WAAW,YAAY,4BAC1B,OAAO,OAAO,wBAAwB,KAAK;EACzC,WAAW;EACX,OAAO;CACT,CAAC;CAqCH,OAAO;EAlCL,eAAe,QAAQ;EACvB,eAAe,QAAQ;EACvB,iBAAiB,IAAI,gBAAgB;GACnC,UAAU,GAAG;GACb,aAAa,GAAG;GAChB,cAAc,GAAG;EACnB,CAAC;EACD,WAAW,eAAe;GACxB,MAAM,QAAQ,qBAAqB,KAAK,UAAU;GAElD,OAAO,UACH,QACA,IAAI,gBAAgB;IAClB,UAAU,GAAG,gCAAgC,MAAM;IACnD,aACE,GAAG,mCAAmC,MAAM;IAC9C,cAAc,GAAG,yBAAyB,MAAM;GAClD,CAAC;EACP;EACA,aAAa,eAAe;GAC1B,MAAM,QAAQ,qBAAqB,KAAK,UAAU;GAElD,OAAO,UACH,QACA,IAAI,gBAAgB;IAClB,UACE,GAAG,yBAAyB,MAAM;IACpC,aACE,GAAG,qCAAqC,MAAM,+CAA+C,MAAM;IACrG,cAAc,GAAG,mCAAmC,MAAM;GAC5D,CAAC;EACP;CAGS;AACb,CAAC"}

package/dist/internal/storage-mapping.d.mts

@@ -1,9 +1,9 @@
+import { SqlExpression, TableModel } from "./table-model.mjs";
 import { PersistenceMappingError } from "./mapping-error.mjs";
-import { SqlFragment, TableModel } from "./query-operations.mjs";
+import { AnyProofPersistenceMapping } from "./models/proof-model.mjs";
 import { AnyEmailAddressMapping } from "./models/email-model.mjs";
 import { AnyPasswordPersistenceMapping } from "./models/password-model.mjs";
-import { AnyProofPersistenceMapping } from "./models/proof-model.mjs";
-import { StatefulSessionMapping } from "./models/session-model.mjs";
+import { PendingAuthenticationMapping, StatefulSessionMapping } from "./models/session-model.mjs";
 import { StorageRole } from "./storage-tables.mjs";
 import { MappingInput } from "./configuration.mjs";
 import { Crypto, Effect, Schema } from "effect";
@@ -31,6 +31,7 @@ export declare const makeMappings: (input: MappingInput) => Effect.Effect<{
       securityRevision: string;
       isActiveStatus: (value: unknown) => boolean;
       d1ActiveStatusValue: unknown;
+      activeStatusValue: unknown;
       decodeRequirement: (row: Readonly<Record<string, unknown>>) => Effect.Effect<import("@yielded/auth/Sessions").AuthenticationRequirement, PersistenceMappingError>;
       decodeActionRequirement: (row: Readonly<Record<string, unknown>>, action: import("@yielded/auth/Password").PasswordAction | import("@yielded/auth/Email").EmailAction | import("@yielded/auth/Passkey").PasskeyActionChallenge["action"]) => Effect.Effect<import("@yielded/auth/Sessions").AuthenticationRequirement, PersistenceMappingError>;
       nextSecurityRevision: () => Effect.Effect<string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">, PersistenceMappingError, never>;
@@ -41,6 +42,7 @@ export declare const makeMappings: (input: MappingInput) => Effect.Effect<{
       credentialId: string;
       revision: string;
       status: string;
+      activeStatusValue: boolean;
       isActiveStatus: (value: unknown) => value is true;
       encodeInsert: (row: object) => {
         active: boolean;
@@ -50,11 +52,12 @@ export declare const makeMappings: (input: MappingInput) => Effect.Effect<{
       };
     };
   };
-  proofs: () => AnyProofPersistenceMapping<SqlFragment>;
-  passwords: () => AnyPasswordPersistenceMapping<SqlFragment>;
-  emails: () => AnyEmailAddressMapping<SqlFragment>;
-  sessions: <C extends Schema.Codec<unknown, unknown, never, never>>(claims: C) => StatefulSessionMapping<C["Type"], TableModel, TableModel, TableModel, TableModel, TableModel, unknown, string>;
+  proofs: () => AnyProofPersistenceMapping<SqlExpression>;
+  passwords: () => AnyPasswordPersistenceMapping<SqlExpression>;
+  emails: () => AnyEmailAddressMapping<SqlExpression>;
+  sessions: <C extends Schema.Codec<unknown, unknown, never, never>>(claims: C, moduleId: string) => StatefulSessionMapping<C["Type"], TableModel, TableModel, TableModel, TableModel, unknown, unknown>;
+  pending: <C extends Schema.Codec<unknown, unknown, never, never>>(claims: C, moduleId: string) => PendingAuthenticationMapping<C["Type"], TableModel, TableModel, TableModel, unknown>;
   string: typeof string;
-}, never, Crypto.Crypto>;
+}, PersistenceMappingError, Crypto.Crypto | import("effect/sql/SqlClient").SqlClient>;
 //#endregion
 //# sourceMappingURL=storage-mapping.d.mts.map