@yielded/auth-persistence 0.1.0-beta.30 → 0.1.0-beta.32

package/dist/internal/session-native-stateful.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"session-native-stateful.mjs","names":[],"sources":["../../src/internal/session-native-stateful.ts"],"sourcesContent":["import type { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport {\n  SessionConflict,\n  SessionInvalid,\n  PendingAuthenticationInvalid,\n  StaleAuthentication,\n  SessionMetadata,\n  SessionId,\n  snapshotSessionAuthenticationProvenance,\n  type StatefulSessionPersistence,\n  type StatefulSessionRecord,\n  type SessionRepository,\n} from \"@yielded/auth/Sessions\";\nimport { DateTime, Effect, Option, Schema } from \"effect\";\nimport type { SqlClient } from \"effect/sql/SqlClient\";\nimport type { Fragment } from \"effect/sql/Statement\";\n\nimport { sqlBatchAssertion } from \"./d1-planning\";\nimport { PersistenceMappingError, isMappedConstraintConflict } from \"./mapping-error\";\nimport type { StatefulSessionMapping } from \"./models/session-model\";\nimport type { NativeSqlTables } from \"./native-sql-table\";\nimport { sessionEvidenceDeadline } from \"./session-native-authority\";\nimport { makeNativeSessionPending, prepareNativeSession } from \"./session-native-pending\";\nimport {\n  makeConditionalSqlInsert,\n  makeNativeSessionRecords,\n  sameSessionRecord,\n} from \"./session-native-record\";\nimport {\n  makeNativeSessionAuthorityState,\n  sameSessionRevision,\n  normalizeSessionOperation,\n  sessionInvariant,\n  sessionUnavailable,\n} from \"./session-native-state\";\nimport { allocateSessionValue, preservesRevision } from \"./session-policy\";\nimport { exactSqlText, executeSqlChange } from \"./sql-change\";\nimport {\n  CurrentSqlCommit,\n  makeSqlCommitExecutor,\n  SqlBatchCommit,\n  appendSqlBatchStatement,\n  registerSqlBatchPostcondition,\n  registerSqlPostcondition,\n} from \"./sql-commit\";\nimport type { AnyTableModel } from \"./table-model\";\n\nexport type NativeStatefulSessionMapping<Claims> = StatefulSessionMapping<\n  Claims,\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  unknown,\n  unknown\n>;\n\nexport const makeNativeStatefulSessionServices = Effect.fnUntraced(function* <Claims>(\n  tables: NativeSqlTables,\n  mapping: NativeStatefulSessionMapping<Claims>,\n): Effect.fn.Return<\n  {\n    readonly statefulSessionPersistence: StatefulSessionPersistence<Claims>;\n    readonly sessionRepository: SessionRepository;\n  },\n  never,\n  SqlClient | LifecycleHooks | SqlBatchCommit\n> {\n  const batch = yield* SqlBatchCommit;\n\n  const state = yield* makeNativeSessionAuthorityState(tables, mapping, batch !== undefined);\n  const conditionalInsert = yield* makeConditionalSqlInsert();\n  const records = yield* makeNativeSessionRecords(tables, mapping);\n  const executor = yield* makeSqlCommitExecutor(sessionUnavailable);\n  const external = yield* Effect.serviceOption(CurrentSqlCommit);\n\n  const pending =\n    mapping.pending === undefined\n      ? undefined\n      : yield* makeNativeSessionPending(\n          tables,\n          { ...mapping, ...mapping.pending },\n          batch !== undefined,\n        );\n\n  const { sql, s, table, now, exact, live } = records;\n\n  const native = <A, E, R>(\n    work: Effect.Effect<A, E, R>,\n    mode: \"transaction\" | \"statement\" = \"transaction\",\n  ) =>\n    batch === undefined\n      ? executor.operation(normalizeSessionOperation(work), mode)\n      : executor\n          .operationBatch(normalizeSessionOperation(work))\n          .pipe(Effect.provideService(SqlBatchCommit, batch));\n\n  const stage = Effect.fnUntraced(function* (statement: Fragment, expected?: number) {\n    if (batch !== undefined) {\n      yield* appendSqlBatchStatement(sql`${statement}`);\n      if (expected !== undefined)\n        yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = ${expected}`));\n\n      return expected;\n    }\n\n    return yield* executeSqlChange(sql, statement);\n  });\n\n  const finalCondition = Effect.fnUntraced(function* (name: string, condition: Fragment) {\n    if (batch !== undefined)\n      yield* registerSqlBatchPostcondition({ name, statement: sqlBatchAssertion(sql, condition) });\n    else if (Option.isSome(external))\n      yield* registerSqlPostcondition({\n        name,\n        check: Effect.gen(function* () {\n          const rows = yield* sql`select 1 where ${condition}`;\n\n          sessionInvariant(rows.length === 1);\n        }).pipe(\n          Effect.mapError((cause) => PersistenceMappingError.make({ operation: \"decode\", cause })),\n        ),\n      });\n  });\n\n  const recordCondition = Effect.fnUntraced(function* (\n    record: StatefulSessionRecord<Claims>,\n    values: Readonly<Record<string, unknown>>,\n  ) {\n    return sql`exists(select 1 from ${table.name} where ${yield* records.owner(record)} and ${exact(table, s.securityRevision, record.securityRevision)} and ${records.millis(table, s.expiresAt)} = ${DateTime.toEpochMillis(record.expiresAt)} and ${records.millis(table, s.absoluteExpiresAt)} = ${DateTime.toEpochMillis(record.absoluteExpiresAt)} and ${records.encodedCondition(values)} and ${live(table)})`;\n  });\n\n  const classify = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n    effect.pipe(\n      Effect.mapError((error) =>\n        isMappedConstraintConflict(mapping.isConstraintConflict, error)\n          ? SessionConflict.make({})\n          : error,\n      ),\n    );\n\n  const verify = Effect.fnUntraced(function* (digest: StatefulSessionRecord<Claims>[\"digest\"]) {\n    const subject = state.subject.as(\"verified_subject\"),\n      session = table.as(\"verified_session\"),\n      owner = mapping.subject;\n\n    if (\n      table.unencodedTextColumn?.(s.subjectId) !== undefined &&\n      state.subject.unencodedTextColumn?.(owner.id) !== undefined\n    ) {\n      const rows =\n        yield* sql`select ${session.fields(\"session_\")}, ${subject.fields(\"subject_\")} from ${session.name} join ${subject.name} on ${exactSqlText(sql, subject.column(owner.id), session.column(s.subjectId))} and ${state.activeSubject(subject)} and ${exactSqlText(sql, subject.column(owner.securityRevision), session.column(s.securityRevision))} where ${exact(session, s.digest, digest)} and ${live(session)} limit 2`;\n\n      sessionInvariant(rows.length <= 1);\n      if (rows[0] === undefined) return undefined;\n      const record = yield* records.decode(session.decode(rows[0], \"session_\"));\n      const decoded = subject.decode(rows[0], \"subject_\");\n\n      sessionInvariant(\n        (yield* mapping.subjectId.toSubject(decoded[owner.id])) === record.subjectId &&\n          decoded[owner.securityRevision] === record.securityRevision &&\n          owner.isActiveStatus(decoded[owner.status]),\n      );\n\n      return record;\n    }\n    const record = yield* records.read(digest);\n\n    if (record === undefined) return undefined;\n    const nativeSubject = yield* mapping.subjectId.toNative(record.subjectId);\n\n    const rows =\n      yield* sql`select ${subject.fields(\"subject_\")} from ${subject.name} where ${state.id(subject, owner.id, nativeSubject)} and ${state.activeSubject(subject)} and ${state.exact(subject, owner.securityRevision, record.securityRevision)} and ${now} < ${DateTime.toEpochMillis(record.expiresAt)} limit 2`;\n\n    sessionInvariant(rows.length <= 1);\n    if (rows[0] === undefined) return undefined;\n    sessionInvariant(\n      (yield* mapping.subjectId.toSubject(subject.decode(rows[0], \"subject_\")[owner.id])) ===\n        record.subjectId,\n    );\n\n    return record;\n  });\n\n  const persistence: StatefulSessionPersistence<Claims> = {\n    establish: (input, project) =>\n      native(\n        classify(\n          Effect.gen(function* () {\n            const current = yield* state.read(input.evidence.revision.subjectId, true);\n\n            if (\n              current === undefined ||\n              !sameSessionRevision(current.revision, input.evidence.revision)\n            )\n              return yield* StaleAuthentication.make({});\n\n            const assessment = yield* sessionEvidenceDeadline(\n              input.evidence,\n              current.requirement,\n              current.now,\n            );\n\n            const expires = DateTime.toEpochMillis(input.session.expiresAt),\n              absolute = DateTime.toEpochMillis(input.session.absoluteExpiresAt);\n\n            if (current.now >= expires || expires > absolute)\n              return yield* StaleAuthentication.make({});\n            let pendingExpiry = Infinity;\n\n            if (input.pending !== undefined) {\n              if (pending === undefined || mapping.pending === undefined)\n                return yield* PendingAuthenticationInvalid.make({});\n              const found = yield* pending.read(\"Login\", input.pending.digest);\n\n              if (\n                found === undefined ||\n                found.record.version !== input.pending.version ||\n                found.record.subjectId !== current.revision.subjectId ||\n                found.record.flowId !== input.pending.flowId ||\n                found.record.bindingDigest !== input.pending.bindingDigest\n              )\n                return yield* PendingAuthenticationInvalid.make({});\n              const original = yield* mapping.pending.login.decode(found.record.snapshot);\n\n              if (\n                original.digest !== input.pending.digest ||\n                original.version !== input.pending.version ||\n                !preservesRevision(input.evidence, original.evidence) ||\n                DateTime.toEpochMillis(original.expiresAt) !== found.record.expiresAtMillis ||\n                original.attemptLimit !== found.record.attemptLimit\n              )\n                return yield* PendingAuthenticationInvalid.make({});\n              pendingExpiry = found.record.expiresAtMillis;\n              yield* pending.consume(\"Login\", input.pending, current.native);\n            }\n\n            const nativeSession = yield* allocateSessionValue(\n              \"interactive\",\n              s.allocateId,\n              s.allocateIdSync,\n            );\n\n            const sessionId = yield* mapping.sessionId.toSession(nativeSession);\n\n            if (sessionId === input.handoffSourceSessionId) return yield* SessionConflict.make({});\n\n            const record: StatefulSessionRecord<Claims> = {\n              ...input.session,\n              sessionId,\n              subjectId: current.revision.subjectId,\n              securityRevision: current.revision.securityRevision,\n              assurance:\n                input.handoffSourceSessionId === undefined\n                  ? assessment.assessed.assurance\n                  : input.session.assurance,\n              provenance: yield* snapshotSessionAuthenticationProvenance({\n                evidence: input.evidence,\n              }),\n              issuedAt: DateTime.makeUnsafe(current.now),\n            };\n\n            const deadline = Math.min(expires, assessment.validUntil, pendingExpiry);\n            const condition = sql`${state.authorityCondition(current.revision, current.native)} and ${state.policyCondition(current.row, current.native)} and ${now} >= ${current.now} and ${now} < ${deadline}`;\n\n            const values = {\n              ...s.encodeInsert(record, { subjectId: current.native, sessionId: nativeSession }),\n              [s.sessionId]: nativeSession,\n              [s.subjectId]: current.native,\n              [s.digest]: record.digest,\n              [s.securityRevision]: record.securityRevision,\n              [s.issuedAt]: s.encodeInstant(record.issuedAt),\n              [s.expiresAt]: s.encodeInstant(record.expiresAt),\n              [s.absoluteExpiresAt]: s.encodeInstant(record.absoluteExpiresAt),\n            };\n\n            const changed = yield* stage(conditionalInsert(table, values, condition), 1);\n\n            if (changed !== 1) return yield* StaleAuthentication.make({});\n            const final = sql`${condition} and ${yield* recordCondition(record, values)}${input.pending === undefined || pending === undefined ? sql`` : sql` and ${pending.consumedCondition(\"Login\", input.pending, current.native)}`}`;\n\n            yield* finalCondition(\"stateful-session-issuance\", final);\n            if (batch === undefined && Option.isSome(external))\n              yield* registerSqlPostcondition({\n                name: \"stateful-session-issued-metadata\",\n                check: Effect.gen(function* () {\n                  const finalRecord = yield* records.read(record.digest);\n\n                  sessionInvariant(\n                    finalRecord !== undefined && sameSessionRecord(finalRecord, record),\n                  );\n                  const authority = yield* state.read(record.subjectId);\n\n                  sessionInvariant(\n                    authority !== undefined &&\n                      sameSessionRevision(authority.revision, input.evidence.revision),\n                  );\n                  yield* sessionEvidenceDeadline(\n                    input.evidence,\n                    authority.requirement,\n                    authority.now,\n                  );\n                }).pipe(\n                  Effect.mapError((cause) =>\n                    PersistenceMappingError.make({ operation: \"decode\", cause }),\n                  ),\n                ),\n              });\n\n            return yield* prepareNativeSession(record, project);\n          }),\n        ),\n      ),\n    verify: ({ digest }) =>\n      executor\n        .verify(verify(digest))\n        .pipe(\n          Effect.flatMap((record) =>\n            record === undefined ? Effect.fail(SessionInvalid.make({})) : Effect.succeed(record),\n          ),\n        ),\n    rotate: (input, project) =>\n      native(\n        classify(\n          Effect.gen(function* () {\n            const absolute = DateTime.toEpochMillis(input.record.absoluteExpiresAt),\n              expires = DateTime.toEpochMillis(input.nextExpiresAt);\n\n            if (\n              expires > absolute ||\n              input.nextDigest === input.record.digest ||\n              input.nextCredentialVersion === input.record.credentialVersion\n            )\n              return yield* SessionConflict.make({});\n\n            const needsSample =\n              batch !== undefined ||\n              sql.onDialectOrElse({ mysql: () => true, orElse: () => false });\n\n            const sampled = needsSample\n              ? Number((yield* sql`select ${now} as engine_now`)[0]?.engine_now)\n              : DateTime.toEpochMillis(input.record.issuedAt);\n\n            sessionInvariant(Number.isSafeInteger(sampled));\n\n            const prepared = {\n              ...input.record,\n              digest: input.nextDigest,\n              credentialVersion: input.nextCredentialVersion,\n              expiresAt: input.nextExpiresAt,\n              issuedAt: DateTime.makeUnsafe(sampled),\n            };\n\n            const values = {\n              ...s.encodeRotation(prepared),\n              [s.digest]: prepared.digest,\n              [s.issuedAt]: tables.expression(mapping.clock.fromMillis(now)),\n              [s.expiresAt]: s.encodeInstant(prepared.expiresAt),\n            };\n\n            const condition = sql`${yield* records.owner(input.record)} and ${live(table)} and ${now} < ${expires} and ${records.millis(table, s.absoluteExpiresAt)} = ${absolute}`;\n            const update = sql`${table.update(values)} where ${condition}`;\n            let record = prepared;\n\n            if (needsSample) {\n              // Batch receipts are prepared before execution. The exact sampled time is\n              // written and checked; no speculative UPDATE result is treated as committed.\n              const statement = sql`${table.update({ ...values, [s.issuedAt]: s.encodeInstant(prepared.issuedAt) })} where ${condition} and ${now} >= ${sampled}`;\n              const changed = yield* stage(statement, 1);\n\n              if (changed !== 1) return yield* SessionConflict.make({});\n            } else {\n              const rows = yield* sql`${update} returning ${table.fields(\"session_\")}`;\n\n              if (rows.length !== 1) return yield* SessionConflict.make({});\n              record = yield* records.decode(table.decode(rows[0]!, \"session_\"));\n            }\n            yield* finalCondition(\n              \"stateful-session-rotation\",\n              yield* recordCondition(record, {\n                ...values,\n                [s.issuedAt]: s.encodeInstant(record.issuedAt),\n              }),\n            );\n\n            return yield* prepareNativeSession(record, project);\n          }),\n        ),\n        \"statement\",\n      ),\n    revokeDigest: (digest, project) =>\n      native(\n        Effect.gen(function* () {\n          let expected: number | undefined;\n\n          if (batch !== undefined)\n            expected =\n              (yield* sql`select 1 from ${table.name} where ${exact(table, s.digest, digest)} limit 2`)\n                .length;\n\n          const changed = yield* stage(\n            sql`delete from ${table.name} where ${exact(table, s.digest, digest)}`,\n            expected,\n          );\n\n          sessionInvariant(changed !== undefined && changed <= 1);\n          yield* finalCondition(\n            \"stateful-session-digest-revocation\",\n            sql`not exists(select 1 from ${table.name} where ${exact(table, s.digest, digest)})`,\n          );\n\n          return yield* prepareNativeSession(changed === 1, project);\n        }),\n        \"statement\",\n      ),\n    revoke: (input, project) =>\n      native(\n        Effect.gen(function* () {\n          const subject = yield* mapping.subjectId.toNative(input.subjectId),\n            session = yield* mapping.sessionId.toNative(input.sessionId);\n\n          const condition = sql`${state.id(table, s.subjectId, subject)} and ${state.id(table, s.sessionId, session)}`;\n\n          yield* stage(sql`delete from ${table.name} where ${condition}`);\n          yield* finalCondition(\n            \"stateful-session-revocation\",\n            sql`not exists(select 1 from ${table.name} where ${condition})`,\n          );\n\n          return yield* prepareNativeSession(undefined, project);\n        }),\n        \"statement\",\n      ),\n    revokeAll: (input, project) =>\n      native(\n        Effect.gen(function* () {\n          const nativeSubject = yield* mapping.subjectId.toNative(input.subjectId),\n            owner = mapping.subject;\n\n          const next = yield* allocateSessionValue(\n            \"interactive\",\n            owner.nextSecurityRevision?.(input.expectedSecurityRevision),\n            owner.nextSecurityRevisionSync === undefined\n              ? undefined\n              : () => owner.nextSecurityRevisionSync!(input.expectedSecurityRevision),\n          );\n\n          sessionInvariant(next !== input.expectedSecurityRevision);\n\n          const changed = yield* stage(\n            sql`${state.subject.update({ [owner.securityRevision]: next })} where ${state.id(state.subject, owner.id, nativeSubject)} and ${state.activeSubject(state.subject)} and ${state.exact(state.subject, owner.securityRevision, input.expectedSecurityRevision)}`,\n            1,\n          );\n\n          if (changed !== 1) return yield* StaleAuthentication.make({});\n          yield* finalCondition(\n            \"all-session-revocation\",\n            sql`exists(select 1 from ${state.subject.name} where ${state.id(state.subject, owner.id, nativeSubject)} and ${state.exact(state.subject, owner.securityRevision, next)})`,\n          );\n\n          return yield* prepareNativeSession(undefined, project);\n        }),\n        \"statement\",\n      ),\n  };\n\n  const sessionRepository: SessionRepository = {\n    list: (input) =>\n      executor.read(\n        Effect.gen(function* () {\n          sessionInvariant(\n            Number.isSafeInteger(input.limit) && input.limit > 0 && input.limit <= 1000,\n          );\n\n          const nativeSubject = yield* mapping.subjectId.toNative(input.subjectId),\n            st = state.subject.as(\"listed_subject\"),\n            list = table.as(\"listed_session\"),\n            owner = mapping.subject;\n\n          const cursor =\n            input.cursor === undefined\n              ? undefined\n              : yield* mapping.sessionId.toNative(\n                  yield* Schema.decodeEffect(SessionId)(input.cursor),\n                );\n\n          const rows =\n            yield* sql`select ${list.fields(\"session_\")}, ${st.fields(\"subject_\")} from ${list.name} join ${st.name} on ${state.id(st, owner.id, nativeSubject)} and ${state.activeSubject(st)} and ${exactSqlText(sql, st.column(owner.securityRevision), list.column(s.securityRevision))} where ${state.id(list, s.subjectId, nativeSubject)} and ${live(list)}${cursor === undefined ? sql`` : sql` and ${list.column(s.sessionId)} > ${list.value(s.sessionId, cursor)}`} order by ${list.column(s.sessionId)} limit ${input.limit + 1}`;\n\n          const decoded = yield* Effect.forEach(rows.slice(0, input.limit), (row) =>\n            Effect.gen(function* () {\n              const record = yield* records.decode(list.decode(row, \"session_\"));\n\n              sessionInvariant(\n                record.subjectId === input.subjectId &&\n                  (yield* mapping.subjectId.toSubject(st.decode(row, \"subject_\")[owner.id])) ===\n                    input.subjectId,\n              );\n\n              return yield* Schema.decodeEffect(Schema.toType(SessionMetadata))(record);\n            }),\n          );\n\n          const nextCursor = rows.length > input.limit ? decoded.at(-1)?.sessionId : undefined;\n\n          return { sessions: decoded, ...(nextCursor === undefined ? {} : { nextCursor }) };\n        }),\n      ),\n  };\n\n  return { statefulSessionPersistence: persistence, sessionRepository };\n});\n"],"mappings":";;;;;;;;;;;;AAyDA,MAAa,oCAAoC,OAAO,WAAW,WACjE,QACA,SAQA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,QAAQ,OAAO,gCAAgC,QAAQ,SAAS,UAAU,KAAA,CAAS;CACzF,MAAM,oBAAoB,OAAO,yBAAyB;CAC1D,MAAM,UAAU,OAAO,yBAAyB,QAAQ,OAAO;CAC/D,MAAM,WAAW,OAAO,sBAAsB,kBAAkB;CAChE,MAAM,WAAW,OAAO,OAAO,cAAc,gBAAgB;CAE7D,MAAM,UACJ,QAAQ,YAAY,KAAA,IAChB,KAAA,IACA,OAAO,yBACL,QACA;EAAE,GAAG;EAAS,GAAG,QAAQ;CAAQ,GACjC,UAAU,KAAA,CACZ;CAEN,MAAM,EAAE,KAAK,GAAG,OAAO,KAAK,OAAO,SAAS;CAE5C,MAAM,UACJ,MACA,OAAoC,kBAEpC,UAAU,KAAA,IACN,SAAS,UAAU,0BAA0B,IAAI,GAAG,IAAI,IACxD,SACG,eAAe,0BAA0B,IAAI,CAAC,CAAC,CAC/C,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CAE1D,MAAM,QAAQ,OAAO,WAAW,WAAW,WAAqB,UAAmB;EACjF,IAAI,UAAU,KAAA,GAAW;GACvB,OAAO,wBAAwB,GAAG,GAAG,WAAW;GAChD,IAAI,aAAa,KAAA,GACf,OAAO,wBAAwB,kBAAkB,KAAK,GAAG,eAAe,UAAU,CAAC;GAErF,OAAO;EACT;EAEA,OAAO,OAAO,iBAAiB,KAAK,SAAS;CAC/C,CAAC;CAED,MAAM,iBAAiB,OAAO,WAAW,WAAW,MAAc,WAAqB;EACrF,IAAI,UAAU,KAAA,GACZ,OAAO,8BAA8B;GAAE;GAAM,WAAW,kBAAkB,KAAK,SAAS;EAAE,CAAC;OACxF,IAAI,OAAO,OAAO,QAAQ,GAC7B,OAAO,yBAAyB;GAC9B;GACA,OAAO,OAAO,IAAI,aAAa;IAC7B,MAAM,OAAO,OAAO,GAAG,kBAAkB;IAEzC,iBAAiB,KAAK,WAAW,CAAC;GACpC,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,UAAU,wBAAwB,KAAK;IAAE,WAAW;IAAU;GAAM,CAAC,CAAC,CACzF;EACF,CAAC;CACL,CAAC;CAED,MAAM,kBAAkB,OAAO,WAAW,WACxC,QACA,QACA;EACA,OAAO,GAAG,wBAAwB,MAAM,KAAK,SAAS,OAAO,QAAQ,MAAM,MAAM,EAAE,OAAO,MAAM,OAAO,EAAE,kBAAkB,OAAO,gBAAgB,EAAE,OAAO,QAAQ,OAAO,OAAO,EAAE,SAAS,EAAE,KAAK,SAAS,cAAc,OAAO,SAAS,EAAE,OAAO,QAAQ,OAAO,OAAO,EAAE,iBAAiB,EAAE,KAAK,SAAS,cAAc,OAAO,iBAAiB,EAAE,OAAO,QAAQ,iBAAiB,MAAM,EAAE,OAAO,KAAK,KAAK,EAAE;CACjZ,CAAC;CAED,MAAM,YAAqB,WACzB,OAAO,KACL,OAAO,UAAU,UACf,2BAA2B,QAAQ,sBAAsB,KAAK,IAC1D,gBAAgB,KAAK,CAAC,CAAC,IACvB,KACN,CACF;CAEF,MAAM,SAAS,OAAO,WAAW,WAAW,QAAiD;EAC3F,MAAM,UAAU,MAAM,QAAQ,GAAG,kBAAkB,GACjD,UAAU,MAAM,GAAG,kBAAkB,GACrC,QAAQ,QAAQ;EAElB,IACE,MAAM,sBAAsB,EAAE,SAAS,MAAM,KAAA,KAC7C,MAAM,QAAQ,sBAAsB,MAAM,EAAE,MAAM,KAAA,GAClD;GACA,MAAM,OACJ,OAAO,GAAG,UAAU,QAAQ,OAAO,UAAU,EAAE,IAAI,QAAQ,OAAO,UAAU,EAAE,QAAQ,QAAQ,KAAK,QAAQ,QAAQ,KAAK,MAAM,aAAa,KAAK,QAAQ,OAAO,MAAM,EAAE,GAAG,QAAQ,OAAO,EAAE,SAAS,CAAC,EAAE,OAAO,MAAM,cAAc,OAAO,EAAE,OAAO,aAAa,KAAK,QAAQ,OAAO,MAAM,gBAAgB,GAAG,QAAQ,OAAO,EAAE,gBAAgB,CAAC,EAAE,SAAS,MAAM,SAAS,EAAE,QAAQ,MAAM,EAAE,OAAO,KAAK,OAAO,EAAE;GAEjZ,iBAAiB,KAAK,UAAU,CAAC;GACjC,IAAI,KAAK,OAAO,KAAA,GAAW,OAAO,KAAA;GAClC,MAAM,SAAS,OAAO,QAAQ,OAAO,QAAQ,OAAO,KAAK,IAAI,UAAU,CAAC;GACxE,MAAM,UAAU,QAAQ,OAAO,KAAK,IAAI,UAAU;GAElD,kBACG,OAAO,QAAQ,UAAU,UAAU,QAAQ,MAAM,GAAG,OAAO,OAAO,aACjE,QAAQ,MAAM,sBAAsB,OAAO,oBAC3C,MAAM,eAAe,QAAQ,MAAM,OAAO,CAC9C;GAEA,OAAO;EACT;EACA,MAAM,SAAS,OAAO,QAAQ,KAAK,MAAM;EAEzC,IAAI,WAAW,KAAA,GAAW,OAAO,KAAA;EACjC,MAAM,gBAAgB,OAAO,QAAQ,UAAU,SAAS,OAAO,SAAS;EAExE,MAAM,OACJ,OAAO,GAAG,UAAU,QAAQ,OAAO,UAAU,EAAE,QAAQ,QAAQ,KAAK,SAAS,MAAM,GAAG,SAAS,MAAM,IAAI,aAAa,EAAE,OAAO,MAAM,cAAc,OAAO,EAAE,OAAO,MAAM,MAAM,SAAS,MAAM,kBAAkB,OAAO,gBAAgB,EAAE,OAAO,IAAI,KAAK,SAAS,cAAc,OAAO,SAAS,EAAE;EAEpS,iBAAiB,KAAK,UAAU,CAAC;EACjC,IAAI,KAAK,OAAO,KAAA,GAAW,OAAO,KAAA;EAClC,kBACG,OAAO,QAAQ,UAAU,UAAU,QAAQ,OAAO,KAAK,IAAI,UAAU,CAAC,CAAC,MAAM,GAAG,OAC/E,OAAO,SACX;EAEA,OAAO;CACT,CAAC;CAwUD,OAAO;EAAE,4BAA4B;GArUnC,YAAY,OAAO,YACjB,OACE,SACE,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO,MAAM,KAAK,MAAM,SAAS,SAAS,WAAW,IAAI;IAEzE,IACE,YAAY,KAAA,KACZ,CAAC,oBAAoB,QAAQ,UAAU,MAAM,SAAS,QAAQ,GAE9D,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;IAE3C,MAAM,aAAa,OAAO,wBACxB,MAAM,UACN,QAAQ,aACR,QAAQ,GACV;IAEA,MAAM,UAAU,SAAS,cAAc,MAAM,QAAQ,SAAS,GAC5D,WAAW,SAAS,cAAc,MAAM,QAAQ,iBAAiB;IAEnE,IAAI,QAAQ,OAAO,WAAW,UAAU,UACtC,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;IAC3C,IAAI,gBAAgB;IAEpB,IAAI,MAAM,YAAY,KAAA,GAAW;KAC/B,IAAI,YAAY,KAAA,KAAa,QAAQ,YAAY,KAAA,GAC/C,OAAO,OAAO,6BAA6B,KAAK,CAAC,CAAC;KACpD,MAAM,QAAQ,OAAO,QAAQ,KAAK,SAAS,MAAM,QAAQ,MAAM;KAE/D,IACE,UAAU,KAAA,KACV,MAAM,OAAO,YAAY,MAAM,QAAQ,WACvC,MAAM,OAAO,cAAc,QAAQ,SAAS,aAC5C,MAAM,OAAO,WAAW,MAAM,QAAQ,UACtC,MAAM,OAAO,kBAAkB,MAAM,QAAQ,eAE7C,OAAO,OAAO,6BAA6B,KAAK,CAAC,CAAC;KACpD,MAAM,WAAW,OAAO,QAAQ,QAAQ,MAAM,OAAO,MAAM,OAAO,QAAQ;KAE1E,IACE,SAAS,WAAW,MAAM,QAAQ,UAClC,SAAS,YAAY,MAAM,QAAQ,WACnC,CAAC,kBAAkB,MAAM,UAAU,SAAS,QAAQ,KACpD,SAAS,cAAc,SAAS,SAAS,MAAM,MAAM,OAAO,mBAC5D,SAAS,iBAAiB,MAAM,OAAO,cAEvC,OAAO,OAAO,6BAA6B,KAAK,CAAC,CAAC;KACpD,gBAAgB,MAAM,OAAO;KAC7B,OAAO,QAAQ,QAAQ,SAAS,MAAM,SAAS,QAAQ,MAAM;IAC/D;IAEA,MAAM,gBAAgB,OAAO,qBAC3B,eACA,EAAE,YACF,EAAE,cACJ;IAEA,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,aAAa;IAElE,IAAI,cAAc,MAAM,wBAAwB,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;IAErF,MAAM,SAAwC;KAC5C,GAAG,MAAM;KACT;KACA,WAAW,QAAQ,SAAS;KAC5B,kBAAkB,QAAQ,SAAS;KACnC,WACE,MAAM,2BAA2B,KAAA,IAC7B,WAAW,SAAS,YACpB,MAAM,QAAQ;KACpB,YAAY,OAAO,wCAAwC,EACzD,UAAU,MAAM,SAClB,CAAC;KACD,UAAU,SAAS,WAAW,QAAQ,GAAG;IAC3C;IAEA,MAAM,WAAW,KAAK,IAAI,SAAS,WAAW,YAAY,aAAa;IACvE,MAAM,YAAY,GAAG,GAAG,MAAM,mBAAmB,QAAQ,UAAU,QAAQ,MAAM,EAAE,OAAO,MAAM,gBAAgB,QAAQ,KAAK,QAAQ,MAAM,EAAE,OAAO,IAAI,MAAM,QAAQ,IAAI,OAAO,IAAI,KAAK;IAE1L,MAAM,SAAS;KACb,GAAG,EAAE,aAAa,QAAQ;MAAE,WAAW,QAAQ;MAAQ,WAAW;KAAc,CAAC;MAChF,EAAE,YAAY;MACd,EAAE,YAAY,QAAQ;MACtB,EAAE,SAAS,OAAO;MAClB,EAAE,mBAAmB,OAAO;MAC5B,EAAE,WAAW,EAAE,cAAc,OAAO,QAAQ;MAC5C,EAAE,YAAY,EAAE,cAAc,OAAO,SAAS;MAC9C,EAAE,oBAAoB,EAAE,cAAc,OAAO,iBAAiB;IACjE;IAIA,KAAI,OAFmB,MAAM,kBAAkB,OAAO,QAAQ,SAAS,GAAG,CAAC,OAE3D,GAAG,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,GAAG,UAAU,OAAO,OAAO,gBAAgB,QAAQ,MAAM,IAAI,MAAM,YAAY,KAAA,KAAa,YAAY,KAAA,IAAY,GAAG,KAAK,GAAG,QAAQ,QAAQ,kBAAkB,SAAS,MAAM,SAAS,QAAQ,MAAM;IAExN,OAAO,eAAe,6BAA6B,KAAK;IACxD,IAAI,UAAU,KAAA,KAAa,OAAO,OAAO,QAAQ,GAC/C,OAAO,yBAAyB;KAC9B,MAAM;KACN,OAAO,OAAO,IAAI,aAAa;MAC7B,MAAM,cAAc,OAAO,QAAQ,KAAK,OAAO,MAAM;MAErD,iBACE,gBAAgB,KAAA,KAAa,kBAAkB,aAAa,MAAM,CACpE;MACA,MAAM,YAAY,OAAO,MAAM,KAAK,OAAO,SAAS;MAEpD,iBACE,cAAc,KAAA,KACZ,oBAAoB,UAAU,UAAU,MAAM,SAAS,QAAQ,CACnE;MACA,OAAO,wBACL,MAAM,UACN,UAAU,aACV,UAAU,GACZ;KACF,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,UACf,wBAAwB,KAAK;MAAE,WAAW;MAAU;KAAM,CAAC,CAC7D,CACF;IACF,CAAC;IAEH,OAAO,OAAO,qBAAqB,QAAQ,OAAO;GACpD,CAAC,CACH,CACF;GACF,SAAS,EAAE,aACT,SACG,OAAO,OAAO,MAAM,CAAC,CAAC,CACtB,KACC,OAAO,SAAS,WACd,WAAW,KAAA,IAAY,OAAO,KAAK,eAAe,KAAK,CAAC,CAAC,CAAC,IAAI,OAAO,QAAQ,MAAM,CACrF,CACF;GACJ,SAAS,OAAO,YACd,OACE,SACE,OAAO,IAAI,aAAa;IACtB,MAAM,WAAW,SAAS,cAAc,MAAM,OAAO,iBAAiB,GACpE,UAAU,SAAS,cAAc,MAAM,aAAa;IAEtD,IACE,UAAU,YACV,MAAM,eAAe,MAAM,OAAO,UAClC,MAAM,0BAA0B,MAAM,OAAO,mBAE7C,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;IAEvC,MAAM,cACJ,UAAU,KAAA,KACV,IAAI,gBAAgB;KAAE,aAAa;KAAM,cAAc;IAAM,CAAC;IAEhE,MAAM,UAAU,cACZ,QAAQ,OAAO,GAAG,UAAU,IAAI,gBAAA,CAAiB,EAAE,EAAE,UAAU,IAC/D,SAAS,cAAc,MAAM,OAAO,QAAQ;IAEhD,iBAAiB,OAAO,cAAc,OAAO,CAAC;IAE9C,MAAM,WAAW;KACf,GAAG,MAAM;KACT,QAAQ,MAAM;KACd,mBAAmB,MAAM;KACzB,WAAW,MAAM;KACjB,UAAU,SAAS,WAAW,OAAO;IACvC;IAEA,MAAM,SAAS;KACb,GAAG,EAAE,eAAe,QAAQ;MAC3B,EAAE,SAAS,SAAS;MACpB,EAAE,WAAW,OAAO,WAAW,QAAQ,MAAM,WAAW,GAAG,CAAC;MAC5D,EAAE,YAAY,EAAE,cAAc,SAAS,SAAS;IACnD;IAEA,MAAM,YAAY,GAAG,GAAG,OAAO,QAAQ,MAAM,MAAM,MAAM,EAAE,OAAO,KAAK,KAAK,EAAE,OAAO,IAAI,KAAK,QAAQ,OAAO,QAAQ,OAAO,OAAO,EAAE,iBAAiB,EAAE,KAAK;IAC7J,MAAM,SAAS,GAAG,GAAG,MAAM,OAAO,MAAM,EAAE,SAAS;IACnD,IAAI,SAAS;IAEb,IAAI,aAAa;KAGf,MAAM,YAAY,GAAG,GAAG,MAAM,OAAO;MAAE,GAAG;OAAS,EAAE,WAAW,EAAE,cAAc,SAAS,QAAQ;KAAE,CAAC,EAAE,SAAS,UAAU,OAAO,IAAI,MAAM;KAG1I,KAAI,OAFmB,MAAM,WAAW,CAAC,OAEzB,GAAG,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;IAC1D,OAAO;KACL,MAAM,OAAO,OAAO,GAAG,GAAG,OAAO,aAAa,MAAM,OAAO,UAAU;KAErE,IAAI,KAAK,WAAW,GAAG,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;KAC5D,SAAS,OAAO,QAAQ,OAAO,MAAM,OAAO,KAAK,IAAK,UAAU,CAAC;IACnE;IACA,OAAO,eACL,6BACA,OAAO,gBAAgB,QAAQ;KAC7B,GAAG;MACF,EAAE,WAAW,EAAE,cAAc,OAAO,QAAQ;IAC/C,CAAC,CACH;IAEA,OAAO,OAAO,qBAAqB,QAAQ,OAAO;GACpD,CAAC,CACH,GACA,WACF;GACF,eAAe,QAAQ,YACrB,OACE,OAAO,IAAI,aAAa;IACtB,IAAI;IAEJ,IAAI,UAAU,KAAA,GACZ,YACG,OAAO,GAAG,iBAAiB,MAAM,KAAK,SAAS,MAAM,OAAO,EAAE,QAAQ,MAAM,EAAE,UAAA,CAC5E;IAEP,MAAM,UAAU,OAAO,MACrB,GAAG,eAAe,MAAM,KAAK,SAAS,MAAM,OAAO,EAAE,QAAQ,MAAM,KACnE,QACF;IAEA,iBAAiB,YAAY,KAAA,KAAa,WAAW,CAAC;IACtD,OAAO,eACL,sCACA,GAAG,4BAA4B,MAAM,KAAK,SAAS,MAAM,OAAO,EAAE,QAAQ,MAAM,EAAE,EACpF;IAEA,OAAO,OAAO,qBAAqB,YAAY,GAAG,OAAO;GAC3D,CAAC,GACD,WACF;GACF,SAAS,OAAO,YACd,OACE,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS,GAC/D,UAAU,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;IAE7D,MAAM,YAAY,GAAG,GAAG,MAAM,GAAG,OAAO,EAAE,WAAW,OAAO,EAAE,OAAO,MAAM,GAAG,OAAO,EAAE,WAAW,OAAO;IAEzG,OAAO,MAAM,GAAG,eAAe,MAAM,KAAK,SAAS,WAAW;IAC9D,OAAO,eACL,+BACA,GAAG,4BAA4B,MAAM,KAAK,SAAS,UAAU,EAC/D;IAEA,OAAO,OAAO,qBAAqB,KAAA,GAAW,OAAO;GACvD,CAAC,GACD,WACF;GACF,YAAY,OAAO,YACjB,OACE,OAAO,IAAI,aAAa;IACtB,MAAM,gBAAgB,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS,GACrE,QAAQ,QAAQ;IAElB,MAAM,OAAO,OAAO,qBAClB,eACA,MAAM,uBAAuB,MAAM,wBAAwB,GAC3D,MAAM,6BAA6B,KAAA,IAC/B,KAAA,UACM,MAAM,yBAA0B,MAAM,wBAAwB,CAC1E;IAEA,iBAAiB,SAAS,MAAM,wBAAwB;IAOxD,KAAI,OALmB,MACrB,GAAG,GAAG,MAAM,QAAQ,OAAO,GAAG,MAAM,mBAAmB,KAAK,CAAC,EAAE,SAAS,MAAM,GAAG,MAAM,SAAS,MAAM,IAAI,aAAa,EAAE,OAAO,MAAM,cAAc,MAAM,OAAO,EAAE,OAAO,MAAM,MAAM,MAAM,SAAS,MAAM,kBAAkB,MAAM,wBAAwB,KAC3P,CACF,OAEgB,GAAG,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;IAC5D,OAAO,eACL,0BACA,GAAG,wBAAwB,MAAM,QAAQ,KAAK,SAAS,MAAM,GAAG,MAAM,SAAS,MAAM,IAAI,aAAa,EAAE,OAAO,MAAM,MAAM,MAAM,SAAS,MAAM,kBAAkB,IAAI,EAAE,EAC1K;IAEA,OAAO,OAAO,qBAAqB,KAAA,GAAW,OAAO;GACvD,CAAC,GACD,WACF;EA+C2C;EAAG,mBAAA,EA3ChD,OAAO,UACL,SAAS,KACP,OAAO,IAAI,aAAa;GACtB,iBACE,OAAO,cAAc,MAAM,KAAK,KAAK,MAAM,QAAQ,KAAK,MAAM,SAAS,GACzE;GAEA,MAAM,gBAAgB,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS,GACrE,KAAK,MAAM,QAAQ,GAAG,gBAAgB,GACtC,OAAO,MAAM,GAAG,gBAAgB,GAChC,QAAQ,QAAQ;GAElB,MAAM,SACJ,MAAM,WAAW,KAAA,IACb,KAAA,IACA,OAAO,QAAQ,UAAU,SACvB,OAAO,OAAO,aAAa,SAAS,CAAC,CAAC,MAAM,MAAM,CACpD;GAEN,MAAM,OACJ,OAAO,GAAG,UAAU,KAAK,OAAO,UAAU,EAAE,IAAI,GAAG,OAAO,UAAU,EAAE,QAAQ,KAAK,KAAK,QAAQ,GAAG,KAAK,MAAM,MAAM,GAAG,IAAI,MAAM,IAAI,aAAa,EAAE,OAAO,MAAM,cAAc,EAAE,EAAE,OAAO,aAAa,KAAK,GAAG,OAAO,MAAM,gBAAgB,GAAG,KAAK,OAAO,EAAE,gBAAgB,CAAC,EAAE,SAAS,MAAM,GAAG,MAAM,EAAE,WAAW,aAAa,EAAE,OAAO,KAAK,IAAI,IAAI,WAAW,KAAA,IAAY,GAAG,KAAK,GAAG,QAAQ,KAAK,OAAO,EAAE,SAAS,EAAE,KAAK,KAAK,MAAM,EAAE,WAAW,MAAM,IAAI,YAAY,KAAK,OAAO,EAAE,SAAS,EAAE,SAAS,MAAM,QAAQ;GAEhgB,MAAM,UAAU,OAAO,OAAO,QAAQ,KAAK,MAAM,GAAG,MAAM,KAAK,IAAI,QACjE,OAAO,IAAI,aAAa;IACtB,MAAM,SAAS,OAAO,QAAQ,OAAO,KAAK,OAAO,KAAK,UAAU,CAAC;IAEjE,iBACE,OAAO,cAAc,MAAM,cACxB,OAAO,QAAQ,UAAU,UAAU,GAAG,OAAO,KAAK,UAAU,CAAC,CAAC,MAAM,GAAG,OACtE,MAAM,SACZ;IAEA,OAAO,OAAO,OAAO,aAAa,OAAO,OAAO,eAAe,CAAC,CAAC,CAAC,MAAM;GAC1E,CAAC,CACH;GAEA,MAAM,aAAa,KAAK,SAAS,MAAM,QAAQ,QAAQ,GAAG,EAAE,CAAC,EAAE,YAAY,KAAA;GAE3E,OAAO;IAAE,UAAU;IAAS,GAAI,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW;GAAG;EAClF,CAAC,CACH,EAG8D;CAAE;AACtE,CAAC"}
+{"version":3,"file":"session-native-stateful.mjs","names":[],"sources":["../../src/internal/session-native-stateful.ts"],"sourcesContent":["import type { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport { AuthenticationClock } from \"@yielded/auth/Operations\";\nimport {\n  SessionConflict,\n  SessionInvalid,\n  PendingAuthenticationInvalid,\n  StaleAuthentication,\n  SessionMetadata,\n  SessionId,\n  snapshotSessionAuthenticationProvenance,\n  type StatefulSessionPersistence,\n  type StatefulSessionRecord,\n  type SessionRepository,\n  type SessionUnavailable,\n} from \"@yielded/auth/Sessions\";\nimport { DateTime, Effect, Option, Schema } from \"effect\";\nimport type { SqlClient } from \"effect/sql/SqlClient\";\nimport type { Fragment } from \"effect/sql/Statement\";\n\nimport { sqlBatchAssertion } from \"./d1-planning\";\nimport { PersistenceMappingError, isMappedConstraintConflict } from \"./mapping-error\";\nimport type { StatefulSessionMapping } from \"./models/session-model\";\nimport type { NativeSqlTables } from \"./native-sql-table\";\nimport { sessionEvidenceDeadline } from \"./session-native-authority\";\nimport { makeNativeSessionPending, prepareNativeSession } from \"./session-native-pending\";\nimport {\n  makeConditionalSqlInsert,\n  makeNativeSessionRecords,\n  sameSessionRecord,\n} from \"./session-native-record\";\nimport {\n  makeNativeSessionAuthorityState,\n  sameSessionRevision,\n  normalizeSessionOperation,\n  sessionInvariant,\n  sessionUnavailable,\n} from \"./session-native-state\";\nimport { allocateSessionValue, preservesRevision } from \"./session-policy\";\nimport { exactSqlText, executeSqlChange } from \"./sql-change\";\nimport {\n  CurrentSqlCommit,\n  makeSqlCommitExecutor,\n  SqlBatchCommit,\n  appendSqlBatchStatement,\n  registerSqlBatchPostcondition,\n  registerSqlPostcondition,\n} from \"./sql-commit\";\nimport { canJoinTextColumns, withStorageValidation } from \"./storage-validation\";\nimport type { AnyTableModel } from \"./table-model\";\n\nexport type NativeStatefulSessionMapping<Claims> = StatefulSessionMapping<\n  Claims,\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  unknown,\n  unknown\n>;\n\nexport const makeNativeStatefulSessionServices = Effect.fnUntraced(function* <Claims>(\n  tables: NativeSqlTables,\n  mapping: NativeStatefulSessionMapping<Claims>,\n): Effect.fn.Return<\n  {\n    readonly statefulSessionPersistence: StatefulSessionPersistence<Claims>;\n    readonly sessionRepository: SessionRepository;\n  },\n  SessionUnavailable,\n  SqlClient | LifecycleHooks | SqlBatchCommit\n> {\n  const batch = yield* SqlBatchCommit;\n\n  const state = yield* makeNativeSessionAuthorityState(tables, mapping, batch !== undefined);\n  const conditionalInsert = yield* makeConditionalSqlInsert();\n  const records = yield* makeNativeSessionRecords(tables, mapping);\n  const executor = yield* makeSqlCommitExecutor(sessionUnavailable);\n  const external = yield* Effect.serviceOption(CurrentSqlCommit);\n\n  const pending =\n    mapping.pending === undefined\n      ? undefined\n      : yield* makeNativeSessionPending(\n          tables,\n          { ...mapping, ...mapping.pending },\n          batch !== undefined,\n        );\n\n  const { sql, s, table, now, exact, live } = records;\n\n  const native = <A, E, R>(\n    work: Effect.Effect<A, E, R>,\n    mode: \"transaction\" | \"statement\" = \"transaction\",\n  ) =>\n    (batch === undefined\n      ? executor.operation(normalizeSessionOperation(work), mode)\n      : executor\n          .operationBatch(normalizeSessionOperation(work))\n          .pipe(Effect.provideService(SqlBatchCommit, batch))\n    ).pipe(Effect.provideService(AuthenticationClock, state.clockPolicy));\n\n  const stage = Effect.fnUntraced(function* (statement: Fragment, expected?: number) {\n    if (batch !== undefined) {\n      yield* appendSqlBatchStatement(sql`${statement}`);\n      if (expected !== undefined)\n        yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = ${expected}`));\n\n      return expected;\n    }\n\n    return yield* executeSqlChange(sql, statement);\n  });\n\n  const finalCondition = Effect.fnUntraced(function* (name: string, condition: Fragment) {\n    if (batch !== undefined)\n      yield* registerSqlBatchPostcondition({ name, statement: sqlBatchAssertion(sql, condition) });\n    else if (Option.isSome(external))\n      yield* registerSqlPostcondition({\n        name,\n        check: Effect.gen(function* () {\n          const rows = yield* sql`select 1 where ${condition}`;\n\n          sessionInvariant(rows.length === 1);\n        }).pipe(\n          Effect.provideService(AuthenticationClock, state.clockPolicy),\n          Effect.mapError((cause) => PersistenceMappingError.make({ operation: \"decode\", cause })),\n        ),\n      });\n  });\n\n  const recordCondition = Effect.fnUntraced(function* (\n    record: StatefulSessionRecord<Claims>,\n    values: Readonly<Record<string, unknown>>,\n  ) {\n    return sql`exists(select 1 from ${table.name} where ${yield* records.owner(record)} and ${exact(table, s.securityRevision, record.securityRevision)} and ${records.millis(table, s.expiresAt)} = ${DateTime.toEpochMillis(record.expiresAt)} and ${records.millis(table, s.absoluteExpiresAt)} = ${DateTime.toEpochMillis(record.absoluteExpiresAt)} and ${records.encodedCondition(values)} and ${live(table)})`;\n  });\n\n  const classify = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n    effect.pipe(\n      Effect.mapError((error) =>\n        isMappedConstraintConflict(mapping.isConstraintConflict, error)\n          ? SessionConflict.make({})\n          : error,\n      ),\n    );\n\n  const [joinedIds, joinedRevisions] = yield* Effect.forEach(\n    [\n      [\n        table.unencodedTextColumn?.(s.subjectId),\n        state.subject.unencodedTextColumn?.(mapping.subject.id),\n      ],\n      [\n        table.unencodedTextColumn?.(s.securityRevision),\n        state.subject.unencodedTextColumn?.(mapping.subject.securityRevision),\n      ],\n    ],\n    canJoinTextColumns,\n  ).pipe(withStorageValidation, Effect.mapError(sessionUnavailable));\n\n  const verify = Effect.fnUntraced(function* (digest: StatefulSessionRecord<Claims>[\"digest\"]) {\n    const subject = state.subject.as(\"verified_subject\"),\n      session = table.as(\"verified_session\"),\n      owner = mapping.subject;\n\n    let discoveredSubjectId: StatefulSessionRecord<Claims>[\"subjectId\"] | undefined;\n    let nativeSubject: unknown;\n\n    if (!joinedIds) {\n      const discovered = yield* records.read(digest);\n\n      if (discovered === undefined) return undefined;\n      discoveredSubjectId = discovered.subjectId;\n      nativeSubject = yield* mapping.subjectId.toNative(discoveredSubjectId);\n    }\n\n    const owns = joinedIds\n      ? exactSqlText(sql, subject.column(owner.id), session.column(s.subjectId))\n      : sql`${state.id(subject, owner.id, nativeSubject)} and ${state.id(session, s.subjectId, nativeSubject)}`;\n\n    const revision = joinedRevisions\n      ? exactSqlText(\n          sql,\n          subject.column(owner.securityRevision),\n          session.column(s.securityRevision),\n        )\n      : sql`true`;\n\n    const rows =\n      yield* sql`select ${session.fields(\"session_\")}, ${subject.fields(\"subject_\")} from ${session.name} join ${subject.name} on ${owns} and ${state.activeSubject(subject)} and ${revision} where ${exact(session, s.digest, digest)} and ${live(session)} limit 2`;\n\n    sessionInvariant(rows.length <= 1);\n    if (rows[0] === undefined) return undefined;\n    const record = yield* records.decode(session.decode(rows[0], \"session_\"));\n    const decoded = subject.decode(rows[0], \"subject_\");\n\n    sessionInvariant(\n      (joinedIds || record.subjectId === discoveredSubjectId) &&\n        (yield* mapping.subjectId.toSubject(decoded[owner.id])) === record.subjectId &&\n        owner.isActiveStatus(decoded[owner.status]),\n    );\n\n    return decoded[owner.securityRevision] === record.securityRevision ? record : undefined;\n  });\n\n  const persistence: StatefulSessionPersistence<Claims> = {\n    establish: (input, project) =>\n      native(\n        classify(\n          Effect.gen(function* () {\n            const current = yield* state.read(input.evidence.revision.subjectId, true);\n\n            if (\n              current === undefined ||\n              !sameSessionRevision(current.revision, input.evidence.revision)\n            )\n              return yield* StaleAuthentication.make({});\n\n            const assessment = yield* sessionEvidenceDeadline(\n              input.evidence,\n              current.requirement,\n              current.now,\n            );\n\n            const issued = Math.max(\n                current.now,\n                DateTime.toEpochMillis(input.now),\n                DateTime.toEpochMillis(input.session.issuedAt),\n                ...input.evidence.proofs.map((proof) => DateTime.toEpochMillis(proof.verifiedAt)),\n              ),\n              expires = DateTime.toEpochMillis(input.session.expiresAt),\n              absolute = DateTime.toEpochMillis(input.session.absoluteExpiresAt);\n\n            if (\n              issued - current.now > state.clockPolicy.futureToleranceMillis ||\n              issued >= expires ||\n              current.now >= expires ||\n              expires > absolute\n            )\n              return yield* StaleAuthentication.make({});\n            let pendingExpiry = Infinity;\n\n            if (input.pending !== undefined) {\n              if (pending === undefined || mapping.pending === undefined)\n                return yield* PendingAuthenticationInvalid.make({});\n              const found = yield* pending.read(\"Login\", input.pending.digest);\n\n              if (\n                found === undefined ||\n                found.record.version !== input.pending.version ||\n                found.record.subjectId !== current.revision.subjectId ||\n                found.record.flowId !== input.pending.flowId ||\n                found.record.bindingDigest !== input.pending.bindingDigest\n              )\n                return yield* PendingAuthenticationInvalid.make({});\n              const original = yield* mapping.pending.login.decode(found.record.snapshot);\n\n              if (\n                original.digest !== input.pending.digest ||\n                original.version !== input.pending.version ||\n                !preservesRevision(input.evidence, original.evidence) ||\n                DateTime.toEpochMillis(original.expiresAt) !== found.record.expiresAtMillis ||\n                original.attemptLimit !== found.record.attemptLimit\n              )\n                return yield* PendingAuthenticationInvalid.make({});\n              pendingExpiry = found.record.expiresAtMillis;\n              yield* pending.consume(\"Login\", input.pending, current.native);\n            }\n\n            const nativeSession = yield* allocateSessionValue(\n              \"interactive\",\n              s.allocateId,\n              s.allocateIdSync,\n            );\n\n            const sessionId = yield* mapping.sessionId.toSession(nativeSession);\n\n            if (sessionId === input.handoffSourceSessionId) return yield* SessionConflict.make({});\n\n            const record: StatefulSessionRecord<Claims> = {\n              ...input.session,\n              sessionId,\n              subjectId: current.revision.subjectId,\n              securityRevision: current.revision.securityRevision,\n              provenance: yield* snapshotSessionAuthenticationProvenance({\n                evidence: input.evidence,\n              }),\n              issuedAt: DateTime.makeUnsafe(issued),\n            };\n\n            const deadline = Math.min(expires, assessment.validUntil, pendingExpiry);\n\n            yield* state.guardPolicy(current);\n            const condition = sql`${state.authorityCondition(current.revision, current.native)} and ${now} >= ${current.now} and ${now} < ${deadline}`;\n\n            const values = {\n              ...s.encodeInsert(record, { subjectId: current.native, sessionId: nativeSession }),\n              [s.sessionId]: nativeSession,\n              [s.subjectId]: current.native,\n              [s.digest]: record.digest,\n              [s.securityRevision]: record.securityRevision,\n              [s.issuedAt]: s.encodeInstant(record.issuedAt),\n              [s.expiresAt]: s.encodeInstant(record.expiresAt),\n              [s.absoluteExpiresAt]: s.encodeInstant(record.absoluteExpiresAt),\n            };\n\n            const changed = yield* stage(conditionalInsert(table, values, condition), 1);\n\n            if (changed !== 1) return yield* StaleAuthentication.make({});\n            const final = sql`${condition} and ${yield* recordCondition(record, values)}${input.pending === undefined || pending === undefined ? sql`` : sql` and ${pending.consumedCondition(\"Login\", input.pending, current.native)}`}`;\n\n            yield* finalCondition(\"stateful-session-issuance\", final);\n            if (batch === undefined && Option.isSome(external))\n              yield* registerSqlPostcondition({\n                name: \"stateful-session-issued-metadata\",\n                check: Effect.gen(function* () {\n                  const finalRecord = yield* records.read(record.digest);\n\n                  sessionInvariant(\n                    finalRecord !== undefined && sameSessionRecord(finalRecord, record),\n                  );\n                  const authority = yield* state.read(record.subjectId);\n\n                  sessionInvariant(\n                    authority !== undefined &&\n                      sameSessionRevision(authority.revision, input.evidence.revision),\n                  );\n                  yield* sessionEvidenceDeadline(\n                    input.evidence,\n                    authority.requirement,\n                    authority.now,\n                  );\n                }).pipe(\n                  Effect.provideService(AuthenticationClock, state.clockPolicy),\n                  Effect.mapError((cause) =>\n                    PersistenceMappingError.make({ operation: \"decode\", cause }),\n                  ),\n                ),\n              });\n\n            return yield* prepareNativeSession(record, project);\n          }),\n        ),\n      ),\n    verify: ({ digest }) =>\n      executor\n        .verify(verify(digest))\n        .pipe(\n          Effect.flatMap((record) =>\n            record === undefined ? Effect.fail(SessionInvalid.make({})) : Effect.succeed(record),\n          ),\n        ),\n    rotate: (input, project) =>\n      native(\n        classify(\n          Effect.gen(function* () {\n            const absolute = DateTime.toEpochMillis(input.record.absoluteExpiresAt),\n              expires = DateTime.toEpochMillis(input.nextExpiresAt),\n              preparedAt = Math.max(\n                DateTime.toEpochMillis(input.now),\n                DateTime.toEpochMillis(input.record.issuedAt),\n              );\n\n            if (\n              expires > absolute ||\n              preparedAt >= expires ||\n              input.nextDigest === input.record.digest ||\n              input.nextCredentialVersion === input.record.credentialVersion\n            )\n              return yield* SessionConflict.make({});\n\n            const needsSample =\n              batch !== undefined ||\n              sql.onDialectOrElse({ mysql: () => true, orElse: () => false });\n\n            const sampled = needsSample\n              ? Number((yield* sql`select ${now} as engine_now`)[0]?.engine_now)\n              : DateTime.toEpochMillis(input.record.issuedAt);\n\n            sessionInvariant(Number.isSafeInteger(sampled));\n\n            const prepared = {\n              ...input.record,\n              digest: input.nextDigest,\n              credentialVersion: input.nextCredentialVersion,\n              expiresAt: input.nextExpiresAt,\n              issuedAt: DateTime.makeUnsafe(Math.max(sampled, preparedAt)),\n            };\n\n            const values = {\n              ...s.encodeRotation(prepared),\n              [s.digest]: prepared.digest,\n              [s.issuedAt]: tables.expression(\n                mapping.clock.fromMillis(\n                  sql`case when ${now} >= ${preparedAt} then ${now} else ${preparedAt} end`,\n                ),\n              ),\n              [s.expiresAt]: s.encodeInstant(prepared.expiresAt),\n            };\n\n            const condition = sql`${yield* records.owner(input.record)} and ${live(table)} and ${preparedAt} <= ${now} + ${state.clockPolicy.futureToleranceMillis} and ${now} < ${expires} and ${records.millis(table, s.absoluteExpiresAt)} = ${absolute}`;\n            const update = sql`${table.update(values)} where ${condition}`;\n            let record = prepared;\n\n            if (needsSample) {\n              // Batch receipts are prepared before execution. The exact sampled time is\n              // written and checked; no speculative UPDATE result is treated as committed.\n              const statement = sql`${table.update({ ...values, [s.issuedAt]: s.encodeInstant(prepared.issuedAt) })} where ${condition} and ${now} >= ${sampled}`;\n              const changed = yield* stage(statement, 1);\n\n              if (changed !== 1) return yield* SessionConflict.make({});\n            } else {\n              const rows = yield* sql`${update} returning ${table.fields(\"session_\")}`;\n\n              if (rows.length !== 1) return yield* SessionConflict.make({});\n              record = yield* records.decode(table.decode(rows[0]!, \"session_\"));\n            }\n            yield* finalCondition(\n              \"stateful-session-rotation\",\n              yield* recordCondition(record, {\n                ...values,\n                [s.issuedAt]: s.encodeInstant(record.issuedAt),\n              }),\n            );\n\n            return yield* prepareNativeSession(record, project);\n          }),\n        ),\n        \"statement\",\n      ),\n    revokeDigest: (digest, project) =>\n      native(\n        Effect.gen(function* () {\n          let expected: number | undefined;\n\n          if (batch !== undefined)\n            expected =\n              (yield* sql`select 1 from ${table.name} where ${exact(table, s.digest, digest)} limit 2`)\n                .length;\n\n          const changed = yield* stage(\n            sql`delete from ${table.name} where ${exact(table, s.digest, digest)}`,\n            expected,\n          );\n\n          sessionInvariant(changed !== undefined && changed <= 1);\n          yield* finalCondition(\n            \"stateful-session-digest-revocation\",\n            sql`not exists(select 1 from ${table.name} where ${exact(table, s.digest, digest)})`,\n          );\n\n          return yield* prepareNativeSession(changed === 1, project);\n        }),\n        \"statement\",\n      ),\n    revoke: (input, project) =>\n      native(\n        Effect.gen(function* () {\n          const subject = yield* mapping.subjectId.toNative(input.subjectId),\n            session = yield* mapping.sessionId.toNative(input.sessionId);\n\n          const condition = sql`${state.id(table, s.subjectId, subject)} and ${state.id(table, s.sessionId, session)}`;\n\n          yield* stage(sql`delete from ${table.name} where ${condition}`);\n          yield* finalCondition(\n            \"stateful-session-revocation\",\n            sql`not exists(select 1 from ${table.name} where ${condition})`,\n          );\n\n          return yield* prepareNativeSession(undefined, project);\n        }),\n        \"statement\",\n      ),\n    revokeAll: (input, project) =>\n      native(\n        Effect.gen(function* () {\n          const nativeSubject = yield* mapping.subjectId.toNative(input.subjectId),\n            owner = mapping.subject;\n\n          const next = yield* allocateSessionValue(\n            \"interactive\",\n            owner.nextSecurityRevision?.(input.expectedSecurityRevision),\n            owner.nextSecurityRevisionSync === undefined\n              ? undefined\n              : () => owner.nextSecurityRevisionSync!(input.expectedSecurityRevision),\n          );\n\n          sessionInvariant(next !== input.expectedSecurityRevision);\n\n          const changed = yield* stage(\n            sql`${state.subject.update({ [owner.securityRevision]: next })} where ${state.id(state.subject, owner.id, nativeSubject)} and ${state.activeSubject(state.subject)} and ${state.exact(state.subject, owner.securityRevision, input.expectedSecurityRevision)}`,\n            1,\n          );\n\n          if (changed !== 1) return yield* StaleAuthentication.make({});\n          yield* finalCondition(\n            \"all-session-revocation\",\n            sql`exists(select 1 from ${state.subject.name} where ${state.id(state.subject, owner.id, nativeSubject)} and ${state.exact(state.subject, owner.securityRevision, next)})`,\n          );\n\n          return yield* prepareNativeSession(undefined, project);\n        }),\n        \"statement\",\n      ),\n  };\n\n  const sessionRepository: SessionRepository = {\n    list: (input) =>\n      executor.read(\n        Effect.gen(function* () {\n          sessionInvariant(\n            Number.isSafeInteger(input.limit) && input.limit > 0 && input.limit <= 1000,\n          );\n\n          const nativeSubject = yield* mapping.subjectId.toNative(input.subjectId),\n            st = state.subject.as(\"listed_subject\"),\n            list = table.as(\"listed_session\"),\n            owner = mapping.subject;\n\n          const cursor =\n            input.cursor === undefined\n              ? undefined\n              : yield* mapping.sessionId.toNative(\n                  yield* Schema.decodeEffect(SessionId)(input.cursor),\n                );\n\n          let revision: StatefulSessionRecord<Claims>[\"securityRevision\"] | undefined;\n\n          // Bind both revisions in SQL so stale rows cannot consume a page.\n          if (!joinedRevisions) {\n            const subjects =\n              yield* sql`select ${st.fields(\"subject_\")} from ${st.name} where ${state.id(st, owner.id, nativeSubject)} and ${state.activeSubject(st)} limit 2`;\n\n            sessionInvariant(subjects.length <= 1);\n            if (subjects[0] === undefined) return { sessions: [] };\n            const subject = st.decode(subjects[0], \"subject_\");\n\n            sessionInvariant(\n              (yield* mapping.subjectId.toSubject(subject[owner.id])) === input.subjectId,\n            );\n            revision = yield* Schema.decodeUnknownEffect(SessionMetadata.fields.securityRevision)(\n              subject[owner.securityRevision],\n            );\n          }\n\n          // Keep the owner in the page snapshot even when its discovered revision changed.\n          // Retry that read once; continued authority changes are not pagination exhaustion.\n          for (let attempt = 0; attempt < 2; attempt++) {\n            const currentRevision = joinedRevisions\n              ? exactSqlText(\n                  sql,\n                  st.column(owner.securityRevision),\n                  list.column(s.securityRevision),\n                )\n              : sql`${state.exact(st, owner.securityRevision, revision)} and ${exact(list, s.securityRevision, revision)}`;\n\n            const rows =\n              yield* sql`select ${list.fields(\"session_\")}, ${st.fields(\"subject_\")}, ${list.column(s.subjectId)} as session_owner from ${st.name} left join ${list.name} on ${state.id(list, s.subjectId, nativeSubject)} and ${currentRevision} and ${live(list)}${cursor === undefined ? sql`` : sql` and ${list.column(s.sessionId)} > ${list.value(s.sessionId, cursor)}`} where ${state.id(st, owner.id, nativeSubject)} and ${state.activeSubject(st)} order by ${list.column(s.sessionId)} limit ${input.limit + 1}`;\n\n            const first = rows[0];\n\n            if (first === undefined) return { sessions: [] };\n            if (!joinedRevisions) {\n              const subject = st.decode(first, \"subject_\");\n\n              sessionInvariant(\n                (yield* mapping.subjectId.toSubject(subject[owner.id])) === input.subjectId,\n              );\n\n              const current = yield* Schema.decodeUnknownEffect(\n                SessionMetadata.fields.securityRevision,\n              )(subject[owner.securityRevision]);\n\n              if (current !== revision) {\n                revision = current;\n                continue;\n              }\n            }\n            if (first.session_owner === null) return { sessions: [] };\n\n            const decoded = yield* Effect.forEach(rows.slice(0, input.limit), (row) =>\n              Effect.gen(function* () {\n                const record = yield* records.decode(list.decode(row, \"session_\"));\n                const subject = st.decode(row, \"subject_\");\n\n                sessionInvariant(\n                  record.subjectId === input.subjectId &&\n                    (yield* mapping.subjectId.toSubject(subject[owner.id])) === input.subjectId &&\n                    subject[owner.securityRevision] === record.securityRevision,\n                );\n\n                return yield* Schema.decodeEffect(Schema.toType(SessionMetadata))(record);\n              }),\n            );\n\n            const nextCursor = rows.length > input.limit ? decoded.at(-1)?.sessionId : undefined;\n\n            return { sessions: decoded, ...(nextCursor === undefined ? {} : { nextCursor }) };\n          }\n\n          return yield* sessionUnavailable();\n        }),\n      ),\n  };\n\n  return { statefulSessionPersistence: persistence, sessionRepository };\n});\n"],"mappings":";;;;;;;;;;;;;;AA4DA,MAAa,oCAAoC,OAAO,WAAW,WACjE,QACA,SAQA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,QAAQ,OAAO,gCAAgC,QAAQ,SAAS,UAAU,KAAA,CAAS;CACzF,MAAM,oBAAoB,OAAO,yBAAyB;CAC1D,MAAM,UAAU,OAAO,yBAAyB,QAAQ,OAAO;CAC/D,MAAM,WAAW,OAAO,sBAAsB,kBAAkB;CAChE,MAAM,WAAW,OAAO,OAAO,cAAc,gBAAgB;CAE7D,MAAM,UACJ,QAAQ,YAAY,KAAA,IAChB,KAAA,IACA,OAAO,yBACL,QACA;EAAE,GAAG;EAAS,GAAG,QAAQ;CAAQ,GACjC,UAAU,KAAA,CACZ;CAEN,MAAM,EAAE,KAAK,GAAG,OAAO,KAAK,OAAO,SAAS;CAE5C,MAAM,UACJ,MACA,OAAoC,mBAEnC,UAAU,KAAA,IACP,SAAS,UAAU,0BAA0B,IAAI,GAAG,IAAI,IACxD,SACG,eAAe,0BAA0B,IAAI,CAAC,CAAC,CAC/C,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC,EAAA,CACtD,KAAK,OAAO,eAAe,qBAAqB,MAAM,WAAW,CAAC;CAEtE,MAAM,QAAQ,OAAO,WAAW,WAAW,WAAqB,UAAmB;EACjF,IAAI,UAAU,KAAA,GAAW;GACvB,OAAO,wBAAwB,GAAG,GAAG,WAAW;GAChD,IAAI,aAAa,KAAA,GACf,OAAO,wBAAwB,kBAAkB,KAAK,GAAG,eAAe,UAAU,CAAC;GAErF,OAAO;EACT;EAEA,OAAO,OAAO,iBAAiB,KAAK,SAAS;CAC/C,CAAC;CAED,MAAM,iBAAiB,OAAO,WAAW,WAAW,MAAc,WAAqB;EACrF,IAAI,UAAU,KAAA,GACZ,OAAO,8BAA8B;GAAE;GAAM,WAAW,kBAAkB,KAAK,SAAS;EAAE,CAAC;OACxF,IAAI,OAAO,OAAO,QAAQ,GAC7B,OAAO,yBAAyB;GAC9B;GACA,OAAO,OAAO,IAAI,aAAa;IAC7B,MAAM,OAAO,OAAO,GAAG,kBAAkB;IAEzC,iBAAiB,KAAK,WAAW,CAAC;GACpC,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,qBAAqB,MAAM,WAAW,GAC5D,OAAO,UAAU,UAAU,wBAAwB,KAAK;IAAE,WAAW;IAAU;GAAM,CAAC,CAAC,CACzF;EACF,CAAC;CACL,CAAC;CAED,MAAM,kBAAkB,OAAO,WAAW,WACxC,QACA,QACA;EACA,OAAO,GAAG,wBAAwB,MAAM,KAAK,SAAS,OAAO,QAAQ,MAAM,MAAM,EAAE,OAAO,MAAM,OAAO,EAAE,kBAAkB,OAAO,gBAAgB,EAAE,OAAO,QAAQ,OAAO,OAAO,EAAE,SAAS,EAAE,KAAK,SAAS,cAAc,OAAO,SAAS,EAAE,OAAO,QAAQ,OAAO,OAAO,EAAE,iBAAiB,EAAE,KAAK,SAAS,cAAc,OAAO,iBAAiB,EAAE,OAAO,QAAQ,iBAAiB,MAAM,EAAE,OAAO,KAAK,KAAK,EAAE;CACjZ,CAAC;CAED,MAAM,YAAqB,WACzB,OAAO,KACL,OAAO,UAAU,UACf,2BAA2B,QAAQ,sBAAsB,KAAK,IAC1D,gBAAgB,KAAK,CAAC,CAAC,IACvB,KACN,CACF;CAEF,MAAM,CAAC,WAAW,mBAAmB,OAAO,OAAO,QACjD,CACE,CACE,MAAM,sBAAsB,EAAE,SAAS,GACvC,MAAM,QAAQ,sBAAsB,QAAQ,QAAQ,EAAE,CACxD,GACA,CACE,MAAM,sBAAsB,EAAE,gBAAgB,GAC9C,MAAM,QAAQ,sBAAsB,QAAQ,QAAQ,gBAAgB,CACtE,CACF,GACA,kBACF,CAAC,CAAC,KAAK,uBAAuB,OAAO,SAAS,kBAAkB,CAAC;CAEjE,MAAM,SAAS,OAAO,WAAW,WAAW,QAAiD;EAC3F,MAAM,UAAU,MAAM,QAAQ,GAAG,kBAAkB,GACjD,UAAU,MAAM,GAAG,kBAAkB,GACrC,QAAQ,QAAQ;EAElB,IAAI;EACJ,IAAI;EAEJ,IAAI,CAAC,WAAW;GACd,MAAM,aAAa,OAAO,QAAQ,KAAK,MAAM;GAE7C,IAAI,eAAe,KAAA,GAAW,OAAO,KAAA;GACrC,sBAAsB,WAAW;GACjC,gBAAgB,OAAO,QAAQ,UAAU,SAAS,mBAAmB;EACvE;EAEA,MAAM,OAAO,YACT,aAAa,KAAK,QAAQ,OAAO,MAAM,EAAE,GAAG,QAAQ,OAAO,EAAE,SAAS,CAAC,IACvE,GAAG,GAAG,MAAM,GAAG,SAAS,MAAM,IAAI,aAAa,EAAE,OAAO,MAAM,GAAG,SAAS,EAAE,WAAW,aAAa;EAExG,MAAM,WAAW,kBACb,aACE,KACA,QAAQ,OAAO,MAAM,gBAAgB,GACrC,QAAQ,OAAO,EAAE,gBAAgB,CACnC,IACA,GAAG;EAEP,MAAM,OACJ,OAAO,GAAG,UAAU,QAAQ,OAAO,UAAU,EAAE,IAAI,QAAQ,OAAO,UAAU,EAAE,QAAQ,QAAQ,KAAK,QAAQ,QAAQ,KAAK,MAAM,KAAK,OAAO,MAAM,cAAc,OAAO,EAAE,OAAO,SAAS,SAAS,MAAM,SAAS,EAAE,QAAQ,MAAM,EAAE,OAAO,KAAK,OAAO,EAAE;EAExP,iBAAiB,KAAK,UAAU,CAAC;EACjC,IAAI,KAAK,OAAO,KAAA,GAAW,OAAO,KAAA;EAClC,MAAM,SAAS,OAAO,QAAQ,OAAO,QAAQ,OAAO,KAAK,IAAI,UAAU,CAAC;EACxE,MAAM,UAAU,QAAQ,OAAO,KAAK,IAAI,UAAU;EAElD,kBACG,aAAa,OAAO,cAAc,yBAChC,OAAO,QAAQ,UAAU,UAAU,QAAQ,MAAM,GAAG,OAAO,OAAO,aACnE,MAAM,eAAe,QAAQ,MAAM,OAAO,CAC9C;EAEA,OAAO,QAAQ,MAAM,sBAAsB,OAAO,mBAAmB,SAAS,KAAA;CAChF,CAAC;CAkZD,OAAO;EAAE,4BAA4B;GA/YnC,YAAY,OAAO,YACjB,OACE,SACE,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO,MAAM,KAAK,MAAM,SAAS,SAAS,WAAW,IAAI;IAEzE,IACE,YAAY,KAAA,KACZ,CAAC,oBAAoB,QAAQ,UAAU,MAAM,SAAS,QAAQ,GAE9D,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;IAE3C,MAAM,aAAa,OAAO,wBACxB,MAAM,UACN,QAAQ,aACR,QAAQ,GACV;IAEA,MAAM,SAAS,KAAK,IAChB,QAAQ,KACR,SAAS,cAAc,MAAM,GAAG,GAChC,SAAS,cAAc,MAAM,QAAQ,QAAQ,GAC7C,GAAG,MAAM,SAAS,OAAO,KAAK,UAAU,SAAS,cAAc,MAAM,UAAU,CAAC,CAClF,GACA,UAAU,SAAS,cAAc,MAAM,QAAQ,SAAS,GACxD,WAAW,SAAS,cAAc,MAAM,QAAQ,iBAAiB;IAEnE,IACE,SAAS,QAAQ,MAAM,MAAM,YAAY,yBACzC,UAAU,WACV,QAAQ,OAAO,WACf,UAAU,UAEV,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;IAC3C,IAAI,gBAAgB;IAEpB,IAAI,MAAM,YAAY,KAAA,GAAW;KAC/B,IAAI,YAAY,KAAA,KAAa,QAAQ,YAAY,KAAA,GAC/C,OAAO,OAAO,6BAA6B,KAAK,CAAC,CAAC;KACpD,MAAM,QAAQ,OAAO,QAAQ,KAAK,SAAS,MAAM,QAAQ,MAAM;KAE/D,IACE,UAAU,KAAA,KACV,MAAM,OAAO,YAAY,MAAM,QAAQ,WACvC,MAAM,OAAO,cAAc,QAAQ,SAAS,aAC5C,MAAM,OAAO,WAAW,MAAM,QAAQ,UACtC,MAAM,OAAO,kBAAkB,MAAM,QAAQ,eAE7C,OAAO,OAAO,6BAA6B,KAAK,CAAC,CAAC;KACpD,MAAM,WAAW,OAAO,QAAQ,QAAQ,MAAM,OAAO,MAAM,OAAO,QAAQ;KAE1E,IACE,SAAS,WAAW,MAAM,QAAQ,UAClC,SAAS,YAAY,MAAM,QAAQ,WACnC,CAAC,kBAAkB,MAAM,UAAU,SAAS,QAAQ,KACpD,SAAS,cAAc,SAAS,SAAS,MAAM,MAAM,OAAO,mBAC5D,SAAS,iBAAiB,MAAM,OAAO,cAEvC,OAAO,OAAO,6BAA6B,KAAK,CAAC,CAAC;KACpD,gBAAgB,MAAM,OAAO;KAC7B,OAAO,QAAQ,QAAQ,SAAS,MAAM,SAAS,QAAQ,MAAM;IAC/D;IAEA,MAAM,gBAAgB,OAAO,qBAC3B,eACA,EAAE,YACF,EAAE,cACJ;IAEA,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,aAAa;IAElE,IAAI,cAAc,MAAM,wBAAwB,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;IAErF,MAAM,SAAwC;KAC5C,GAAG,MAAM;KACT;KACA,WAAW,QAAQ,SAAS;KAC5B,kBAAkB,QAAQ,SAAS;KACnC,YAAY,OAAO,wCAAwC,EACzD,UAAU,MAAM,SAClB,CAAC;KACD,UAAU,SAAS,WAAW,MAAM;IACtC;IAEA,MAAM,WAAW,KAAK,IAAI,SAAS,WAAW,YAAY,aAAa;IAEvE,OAAO,MAAM,YAAY,OAAO;IAChC,MAAM,YAAY,GAAG,GAAG,MAAM,mBAAmB,QAAQ,UAAU,QAAQ,MAAM,EAAE,OAAO,IAAI,MAAM,QAAQ,IAAI,OAAO,IAAI,KAAK;IAEhI,MAAM,SAAS;KACb,GAAG,EAAE,aAAa,QAAQ;MAAE,WAAW,QAAQ;MAAQ,WAAW;KAAc,CAAC;MAChF,EAAE,YAAY;MACd,EAAE,YAAY,QAAQ;MACtB,EAAE,SAAS,OAAO;MAClB,EAAE,mBAAmB,OAAO;MAC5B,EAAE,WAAW,EAAE,cAAc,OAAO,QAAQ;MAC5C,EAAE,YAAY,EAAE,cAAc,OAAO,SAAS;MAC9C,EAAE,oBAAoB,EAAE,cAAc,OAAO,iBAAiB;IACjE;IAIA,KAAI,OAFmB,MAAM,kBAAkB,OAAO,QAAQ,SAAS,GAAG,CAAC,OAE3D,GAAG,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,GAAG,UAAU,OAAO,OAAO,gBAAgB,QAAQ,MAAM,IAAI,MAAM,YAAY,KAAA,KAAa,YAAY,KAAA,IAAY,GAAG,KAAK,GAAG,QAAQ,QAAQ,kBAAkB,SAAS,MAAM,SAAS,QAAQ,MAAM;IAExN,OAAO,eAAe,6BAA6B,KAAK;IACxD,IAAI,UAAU,KAAA,KAAa,OAAO,OAAO,QAAQ,GAC/C,OAAO,yBAAyB;KAC9B,MAAM;KACN,OAAO,OAAO,IAAI,aAAa;MAC7B,MAAM,cAAc,OAAO,QAAQ,KAAK,OAAO,MAAM;MAErD,iBACE,gBAAgB,KAAA,KAAa,kBAAkB,aAAa,MAAM,CACpE;MACA,MAAM,YAAY,OAAO,MAAM,KAAK,OAAO,SAAS;MAEpD,iBACE,cAAc,KAAA,KACZ,oBAAoB,UAAU,UAAU,MAAM,SAAS,QAAQ,CACnE;MACA,OAAO,wBACL,MAAM,UACN,UAAU,aACV,UAAU,GACZ;KACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,qBAAqB,MAAM,WAAW,GAC5D,OAAO,UAAU,UACf,wBAAwB,KAAK;MAAE,WAAW;MAAU;KAAM,CAAC,CAC7D,CACF;IACF,CAAC;IAEH,OAAO,OAAO,qBAAqB,QAAQ,OAAO;GACpD,CAAC,CACH,CACF;GACF,SAAS,EAAE,aACT,SACG,OAAO,OAAO,MAAM,CAAC,CAAC,CACtB,KACC,OAAO,SAAS,WACd,WAAW,KAAA,IAAY,OAAO,KAAK,eAAe,KAAK,CAAC,CAAC,CAAC,IAAI,OAAO,QAAQ,MAAM,CACrF,CACF;GACJ,SAAS,OAAO,YACd,OACE,SACE,OAAO,IAAI,aAAa;IACtB,MAAM,WAAW,SAAS,cAAc,MAAM,OAAO,iBAAiB,GACpE,UAAU,SAAS,cAAc,MAAM,aAAa,GACpD,aAAa,KAAK,IAChB,SAAS,cAAc,MAAM,GAAG,GAChC,SAAS,cAAc,MAAM,OAAO,QAAQ,CAC9C;IAEF,IACE,UAAU,YACV,cAAc,WACd,MAAM,eAAe,MAAM,OAAO,UAClC,MAAM,0BAA0B,MAAM,OAAO,mBAE7C,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;IAEvC,MAAM,cACJ,UAAU,KAAA,KACV,IAAI,gBAAgB;KAAE,aAAa;KAAM,cAAc;IAAM,CAAC;IAEhE,MAAM,UAAU,cACZ,QAAQ,OAAO,GAAG,UAAU,IAAI,gBAAA,CAAiB,EAAE,EAAE,UAAU,IAC/D,SAAS,cAAc,MAAM,OAAO,QAAQ;IAEhD,iBAAiB,OAAO,cAAc,OAAO,CAAC;IAE9C,MAAM,WAAW;KACf,GAAG,MAAM;KACT,QAAQ,MAAM;KACd,mBAAmB,MAAM;KACzB,WAAW,MAAM;KACjB,UAAU,SAAS,WAAW,KAAK,IAAI,SAAS,UAAU,CAAC;IAC7D;IAEA,MAAM,SAAS;KACb,GAAG,EAAE,eAAe,QAAQ;MAC3B,EAAE,SAAS,SAAS;MACpB,EAAE,WAAW,OAAO,WACnB,QAAQ,MAAM,WACZ,GAAG,aAAa,IAAI,MAAM,WAAW,QAAQ,IAAI,QAAQ,WAAW,KACtE,CACF;MACC,EAAE,YAAY,EAAE,cAAc,SAAS,SAAS;IACnD;IAEA,MAAM,YAAY,GAAG,GAAG,OAAO,QAAQ,MAAM,MAAM,MAAM,EAAE,OAAO,KAAK,KAAK,EAAE,OAAO,WAAW,MAAM,IAAI,KAAK,MAAM,YAAY,sBAAsB,OAAO,IAAI,KAAK,QAAQ,OAAO,QAAQ,OAAO,OAAO,EAAE,iBAAiB,EAAE,KAAK;IACtO,MAAM,SAAS,GAAG,GAAG,MAAM,OAAO,MAAM,EAAE,SAAS;IACnD,IAAI,SAAS;IAEb,IAAI,aAAa;KAGf,MAAM,YAAY,GAAG,GAAG,MAAM,OAAO;MAAE,GAAG;OAAS,EAAE,WAAW,EAAE,cAAc,SAAS,QAAQ;KAAE,CAAC,EAAE,SAAS,UAAU,OAAO,IAAI,MAAM;KAG1I,KAAI,OAFmB,MAAM,WAAW,CAAC,OAEzB,GAAG,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;IAC1D,OAAO;KACL,MAAM,OAAO,OAAO,GAAG,GAAG,OAAO,aAAa,MAAM,OAAO,UAAU;KAErE,IAAI,KAAK,WAAW,GAAG,OAAO,OAAO,gBAAgB,KAAK,CAAC,CAAC;KAC5D,SAAS,OAAO,QAAQ,OAAO,MAAM,OAAO,KAAK,IAAK,UAAU,CAAC;IACnE;IACA,OAAO,eACL,6BACA,OAAO,gBAAgB,QAAQ;KAC7B,GAAG;MACF,EAAE,WAAW,EAAE,cAAc,OAAO,QAAQ;IAC/C,CAAC,CACH;IAEA,OAAO,OAAO,qBAAqB,QAAQ,OAAO;GACpD,CAAC,CACH,GACA,WACF;GACF,eAAe,QAAQ,YACrB,OACE,OAAO,IAAI,aAAa;IACtB,IAAI;IAEJ,IAAI,UAAU,KAAA,GACZ,YACG,OAAO,GAAG,iBAAiB,MAAM,KAAK,SAAS,MAAM,OAAO,EAAE,QAAQ,MAAM,EAAE,UAAA,CAC5E;IAEP,MAAM,UAAU,OAAO,MACrB,GAAG,eAAe,MAAM,KAAK,SAAS,MAAM,OAAO,EAAE,QAAQ,MAAM,KACnE,QACF;IAEA,iBAAiB,YAAY,KAAA,KAAa,WAAW,CAAC;IACtD,OAAO,eACL,sCACA,GAAG,4BAA4B,MAAM,KAAK,SAAS,MAAM,OAAO,EAAE,QAAQ,MAAM,EAAE,EACpF;IAEA,OAAO,OAAO,qBAAqB,YAAY,GAAG,OAAO;GAC3D,CAAC,GACD,WACF;GACF,SAAS,OAAO,YACd,OACE,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS,GAC/D,UAAU,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;IAE7D,MAAM,YAAY,GAAG,GAAG,MAAM,GAAG,OAAO,EAAE,WAAW,OAAO,EAAE,OAAO,MAAM,GAAG,OAAO,EAAE,WAAW,OAAO;IAEzG,OAAO,MAAM,GAAG,eAAe,MAAM,KAAK,SAAS,WAAW;IAC9D,OAAO,eACL,+BACA,GAAG,4BAA4B,MAAM,KAAK,SAAS,UAAU,EAC/D;IAEA,OAAO,OAAO,qBAAqB,KAAA,GAAW,OAAO;GACvD,CAAC,GACD,WACF;GACF,YAAY,OAAO,YACjB,OACE,OAAO,IAAI,aAAa;IACtB,MAAM,gBAAgB,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS,GACrE,QAAQ,QAAQ;IAElB,MAAM,OAAO,OAAO,qBAClB,eACA,MAAM,uBAAuB,MAAM,wBAAwB,GAC3D,MAAM,6BAA6B,KAAA,IAC/B,KAAA,UACM,MAAM,yBAA0B,MAAM,wBAAwB,CAC1E;IAEA,iBAAiB,SAAS,MAAM,wBAAwB;IAOxD,KAAI,OALmB,MACrB,GAAG,GAAG,MAAM,QAAQ,OAAO,GAAG,MAAM,mBAAmB,KAAK,CAAC,EAAE,SAAS,MAAM,GAAG,MAAM,SAAS,MAAM,IAAI,aAAa,EAAE,OAAO,MAAM,cAAc,MAAM,OAAO,EAAE,OAAO,MAAM,MAAM,MAAM,SAAS,MAAM,kBAAkB,MAAM,wBAAwB,KAC3P,CACF,OAEgB,GAAG,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;IAC5D,OAAO,eACL,0BACA,GAAG,wBAAwB,MAAM,QAAQ,KAAK,SAAS,MAAM,GAAG,MAAM,SAAS,MAAM,IAAI,aAAa,EAAE,OAAO,MAAM,MAAM,MAAM,SAAS,MAAM,kBAAkB,IAAI,EAAE,EAC1K;IAEA,OAAO,OAAO,qBAAqB,KAAA,GAAW,OAAO;GACvD,CAAC,GACD,WACF;EAsG2C;EAAG,mBAAA,EAlGhD,OAAO,UACL,SAAS,KACP,OAAO,IAAI,aAAa;GACtB,iBACE,OAAO,cAAc,MAAM,KAAK,KAAK,MAAM,QAAQ,KAAK,MAAM,SAAS,GACzE;GAEA,MAAM,gBAAgB,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS,GACrE,KAAK,MAAM,QAAQ,GAAG,gBAAgB,GACtC,OAAO,MAAM,GAAG,gBAAgB,GAChC,QAAQ,QAAQ;GAElB,MAAM,SACJ,MAAM,WAAW,KAAA,IACb,KAAA,IACA,OAAO,QAAQ,UAAU,SACvB,OAAO,OAAO,aAAa,SAAS,CAAC,CAAC,MAAM,MAAM,CACpD;GAEN,IAAI;GAGJ,IAAI,CAAC,iBAAiB;IACpB,MAAM,WACJ,OAAO,GAAG,UAAU,GAAG,OAAO,UAAU,EAAE,QAAQ,GAAG,KAAK,SAAS,MAAM,GAAG,IAAI,MAAM,IAAI,aAAa,EAAE,OAAO,MAAM,cAAc,EAAE,EAAE;IAE1I,iBAAiB,SAAS,UAAU,CAAC;IACrC,IAAI,SAAS,OAAO,KAAA,GAAW,OAAO,EAAE,UAAU,CAAC,EAAE;IACrD,MAAM,UAAU,GAAG,OAAO,SAAS,IAAI,UAAU;IAEjD,kBACG,OAAO,QAAQ,UAAU,UAAU,QAAQ,MAAM,GAAG,OAAO,MAAM,SACpE;IACA,WAAW,OAAO,OAAO,oBAAoB,gBAAgB,OAAO,gBAAgB,CAAC,CACnF,QAAQ,MAAM,iBAChB;GACF;GAIA,KAAK,IAAI,UAAU,GAAG,UAAU,GAAG,WAAW;IAC5C,MAAM,kBAAkB,kBACpB,aACE,KACA,GAAG,OAAO,MAAM,gBAAgB,GAChC,KAAK,OAAO,EAAE,gBAAgB,CAChC,IACA,GAAG,GAAG,MAAM,MAAM,IAAI,MAAM,kBAAkB,QAAQ,EAAE,OAAO,MAAM,MAAM,EAAE,kBAAkB,QAAQ;IAE3G,MAAM,OACJ,OAAO,GAAG,UAAU,KAAK,OAAO,UAAU,EAAE,IAAI,GAAG,OAAO,UAAU,EAAE,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,yBAAyB,GAAG,KAAK,aAAa,KAAK,KAAK,MAAM,MAAM,GAAG,MAAM,EAAE,WAAW,aAAa,EAAE,OAAO,gBAAgB,OAAO,KAAK,IAAI,IAAI,WAAW,KAAA,IAAY,GAAG,KAAK,GAAG,QAAQ,KAAK,OAAO,EAAE,SAAS,EAAE,KAAK,KAAK,MAAM,EAAE,WAAW,MAAM,IAAI,SAAS,MAAM,GAAG,IAAI,MAAM,IAAI,aAAa,EAAE,OAAO,MAAM,cAAc,EAAE,EAAE,YAAY,KAAK,OAAO,EAAE,SAAS,EAAE,SAAS,MAAM,QAAQ;IAE7e,MAAM,QAAQ,KAAK;IAEnB,IAAI,UAAU,KAAA,GAAW,OAAO,EAAE,UAAU,CAAC,EAAE;IAC/C,IAAI,CAAC,iBAAiB;KACpB,MAAM,UAAU,GAAG,OAAO,OAAO,UAAU;KAE3C,kBACG,OAAO,QAAQ,UAAU,UAAU,QAAQ,MAAM,GAAG,OAAO,MAAM,SACpE;KAEA,MAAM,UAAU,OAAO,OAAO,oBAC5B,gBAAgB,OAAO,gBACzB,CAAC,CAAC,QAAQ,MAAM,iBAAiB;KAEjC,IAAI,YAAY,UAAU;MACxB,WAAW;MACX;KACF;IACF;IACA,IAAI,MAAM,kBAAkB,MAAM,OAAO,EAAE,UAAU,CAAC,EAAE;IAExD,MAAM,UAAU,OAAO,OAAO,QAAQ,KAAK,MAAM,GAAG,MAAM,KAAK,IAAI,QACjE,OAAO,IAAI,aAAa;KACtB,MAAM,SAAS,OAAO,QAAQ,OAAO,KAAK,OAAO,KAAK,UAAU,CAAC;KACjE,MAAM,UAAU,GAAG,OAAO,KAAK,UAAU;KAEzC,iBACE,OAAO,cAAc,MAAM,cACxB,OAAO,QAAQ,UAAU,UAAU,QAAQ,MAAM,GAAG,OAAO,MAAM,aAClE,QAAQ,MAAM,sBAAsB,OAAO,gBAC/C;KAEA,OAAO,OAAO,OAAO,aAAa,OAAO,OAAO,eAAe,CAAC,CAAC,CAAC,MAAM;IAC1E,CAAC,CACH;IAEA,MAAM,aAAa,KAAK,SAAS,MAAM,QAAQ,QAAQ,GAAG,EAAE,CAAC,EAAE,YAAY,KAAA;IAE3E,OAAO;KAAE,UAAU;KAAS,GAAI,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW;IAAG;GAClF;GAEA,OAAO,OAAO,mBAAmB;EACnC,CAAC,CACH,EAG8D;CAAE;AACtE,CAAC"}

package/dist/internal/session-native-step-up.d.mts

@@ -4,12 +4,12 @@ import { NativeSqlTables } from "./native-sql-table.mjs";
 import { SqlBatchCommit } from "./sql-commit.mjs";
 import { Effect } from "effect";
 import { LifecycleHooks } from "@yielded/auth/Hooks";
-import { SessionStepUpPersistence } from "@yielded/auth/Sessions";
+import { SessionStepUpPersistence, SessionUnavailable } from "@yielded/auth/Sessions";
 import { SqlClient } from "effect/sql/SqlClient";
 //#region src/internal/session-native-step-up.d.ts
 export type NativeSessionStepUpMapping<Claims> = SessionStepUpMapping<Claims, AnyTableModel, AnyTableModel, AnyTableModel, AnyTableModel, AnyTableModel, unknown, unknown>;
 export declare const makeNativeSessionStepUpServices: <Claims>(tables: NativeSqlTables, mapping: NativeSessionStepUpMapping<Claims>) => Effect.Effect<{
   readonly sessionStepUpPersistence: SessionStepUpPersistence<Claims>;
-}, never, LifecycleHooks | SqlBatchCommit | SqlClient>;
+}, SessionUnavailable, LifecycleHooks | SqlBatchCommit | SqlClient>;
 //#endregion
 //# sourceMappingURL=session-native-step-up.d.mts.map

package/dist/internal/session-native-step-up.mjs

@@ -8,11 +8,10 @@ import { allocateSessionValue } from "./session-policy.mjs";
 import { sessionEvidenceDeadline } from "./session-native-authority.mjs";
 import { makeNativeSessionPendingReader } from "./session-native-pending-read.mjs";
 import { decodeStepUpIntent, encodeStepUpIntent, stepUpIntentLive, validateStepUpPlan } from "./step-up-state.mjs";
-import { DateTime, Effect, Option, Schema } from "effect";
-import { SessionConflict, SessionMetadata, SessionStepUpInvalid, StaleAuthentication } from "@yielded/auth/Sessions";
-import { AuthenticationAssurance } from "@yielded/auth/Operations";
+import { DateTime, Effect, Option } from "effect";
+import { SessionConflict, SessionStepUpInvalid, StaleAuthentication } from "@yielded/auth/Sessions";
+import { AuthenticationClock } from "@yielded/auth/Operations";
 //#region src/internal/session-native-step-up.ts
-const assuranceJson = Schema.encodeSync(Schema.fromJsonString(SessionMetadata.fields.assurance));
 const makeNativeSessionStepUpServices = Effect.fnUntraced(function* (tables, mapping) {
 	const batch = yield* SqlBatchCommit;
 	const { state, pending, read: readPending } = yield* makeNativeSessionPendingReader(tables, mapping, batch !== void 0);
@@ -23,14 +22,14 @@ const makeNativeSessionStepUpServices = Effect.fnUntraced(function* (tables, map
 	}) : void 0;
 	const executor = yield* makeSqlCommitExecutor(sessionUnavailable), external = yield* Effect.serviceOption(CurrentSqlCommit);
 	const { sql, now } = state;
-	const native = (work, mode = "transaction") => batch === void 0 ? executor.operation(normalizeSessionOperation(work), mode) : executor.operationBatch(normalizeSessionOperation(work)).pipe(Effect.provideService(SqlBatchCommit, batch));
+	const native = (work, mode = "transaction") => (batch === void 0 ? executor.operation(normalizeSessionOperation(work), mode) : executor.operationBatch(normalizeSessionOperation(work)).pipe(Effect.provideService(SqlBatchCommit, batch))).pipe(Effect.provideService(AuthenticationClock, state.clockPolicy));
 	const decode = Effect.fnUntraced(function* (stored) {
 		const intent = yield* decodeStepUpIntent(stored.snapshot);
 		sessionInvariant(intent.digest === stored.digest && intent.version === stored.version && intent.flowId === stored.flowId && intent.bindingDigest === stored.bindingDigest && intent.revision.subjectId === stored.subjectId && DateTime.toEpochMillis(intent.expiresAt) === stored.expiresAtMillis && intent.attemptLimit === stored.attemptLimit);
 		return intent;
 	});
 	const source = Effect.fnUntraced(function* (intent, instant) {
-		if (!stepUpIntentLive(intent, mapping.source.kind, DateTime.makeUnsafe(instant))) return void 0;
+		if (!(yield* stepUpIntentLive(intent, mapping.source.kind, DateTime.makeUnsafe(instant)))) return void 0;
 		const subject = yield* mapping.subjectId.toNative(intent.revision.subjectId);
 		if (mapping.source.kind === "Stateful") {
 			sessionInvariant(records !== void 0);
@@ -68,7 +67,7 @@ const makeNativeSessionStepUpServices = Effect.fnUntraced(function* (tables, map
 			name,
 			check: Effect.gen(function* () {
 				sessionInvariant((yield* sql`select 1 where ${condition}`).length === 1);
-			}).pipe(Effect.mapError((cause) => PersistenceMappingError.make({
+			}).pipe(Effect.provideService(AuthenticationClock, state.clockPolicy), Effect.mapError((cause) => PersistenceMappingError.make({
 				operation: "decode",
 				cause
 			})))
@@ -90,7 +89,8 @@ const makeNativeSessionStepUpServices = Effect.fnUntraced(function* (tables, map
 				...input,
 				version
 			}, snapshot = yield* encodeStepUpIntent(intent);
-			const condition = sql`${state.authorityCondition(intent.revision, current.native)} and ${state.policyCondition(current.row, current.native)} and ${original.condition} and ${now} >= ${DateTime.toEpochMillis(intent.sourceAuthenticatedAt)} and ${now} < ${DateTime.toEpochMillis(intent.expiresAt)}`;
+			yield* state.guardPolicy(current);
+			const condition = sql`${state.authorityCondition(intent.revision, current.native)} and ${original.condition} and ${now} >= ${current.now} and ${DateTime.toEpochMillis(intent.sourceAuthenticatedAt)} <= ${now} + ${state.clockPolicy.futureToleranceMillis} and ${now} < ${DateTime.toEpochMillis(intent.expiresAt)}`;
 			yield* pending.insert({
 				moduleId: mapping.moduleId,
 				kind: "StepUp",
@@ -110,12 +110,12 @@ const makeNativeSessionStepUpServices = Effect.fnUntraced(function* (tables, map
 			const selected = yield* readPending("StepUp", digest);
 			if (selected === void 0) return void 0;
 			const intent = yield* decode(selected.record), current = selected.authority;
-			if (!sameSessionRevision(current.revision, intent.revision) || !stepUpIntentLive(intent, mapping.source.kind, DateTime.makeUnsafe(current.now))) return void 0;
+			if (!sameSessionRevision(current.revision, intent.revision) || !(yield* stepUpIntentLive(intent, mapping.source.kind, DateTime.makeUnsafe(current.now)))) return void 0;
 			return {
 				intent,
 				requirement: current.requirement
 			};
-		})).pipe(Effect.flatMap((value) => value === void 0 ? Effect.fail(SessionStepUpInvalid.make({})) : Effect.succeed(value))),
+		})).pipe(Effect.provideService(AuthenticationClock, state.clockPolicy), Effect.flatMap((value) => value === void 0 ? Effect.fail(SessionStepUpInvalid.make({})) : Effect.succeed(value))),
 		reject: ({ digest }, project) => native(Effect.gen(function* () {
 			yield* pending.reject("StepUp", digest);
 			return yield* prepareNativeSession({ _tag: "Rejected" }, project);
@@ -135,15 +135,12 @@ const makeNativeSessionStepUpServices = Effect.fnUntraced(function* (tables, map
 					digest: plan.source.guard.digest
 				})) return yield* SessionStepUpInvalid.make({});
 			}
-			const base = yield* sessionEvidenceDeadline(evidence, current.requirement, current.now), profile = yield* sessionEvidenceDeadline(evidence, intent.requirement, current.now);
-			if (assuranceJson(AuthenticationAssurance.make({
-				...base.assessed.assurance,
-				authenticatedAt: profile.assessed.assurance.authenticatedAt
-			})) !== assuranceJson(replacement.inspection.session.assurance)) return yield* SessionStepUpInvalid.make({});
-			const deadline = Math.min(base.validUntil, profile.validUntil, DateTime.toEpochMillis(intent.expiresAt), DateTime.toEpochMillis(replacement.inspection.session.expiresAt));
-			if (current.now >= deadline || DateTime.toEpochMillis(replacement.inspection.session.issuedAt) > current.now || DateTime.toEpochMillis(replacement.inspection.session.expiresAt) > DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt)) return yield* SessionStepUpInvalid.make({});
+			const prepared = yield* sessionEvidenceDeadline(evidence, plan.baseRequirement, current.now), base = yield* sessionEvidenceDeadline(evidence, current.requirement, current.now), profile = yield* sessionEvidenceDeadline(evidence, intent.requirement, current.now);
+			const deadline = Math.min(prepared.validUntil, base.validUntil, profile.validUntil, DateTime.toEpochMillis(intent.expiresAt), DateTime.toEpochMillis(replacement.inspection.session.expiresAt));
+			if (current.now >= deadline || DateTime.toEpochMillis(replacement.inspection.session.issuedAt) - current.now > state.clockPolicy.futureToleranceMillis || DateTime.toEpochMillis(replacement.inspection.session.expiresAt) > DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt)) return yield* SessionStepUpInvalid.make({});
 			const snapshot = yield* encodeStepUpIntent(intent);
-			const authority = sql`${state.authorityCondition(evidence.revision, current.native)} and ${state.policyCondition(current.row, current.native)} and ${now} >= ${current.now} and ${now} < ${deadline}`;
+			yield* state.guardPolicy(current);
+			const authority = sql`${state.authorityCondition(evidence.revision, current.native)} and ${now} >= ${current.now} and ${now} < ${deadline}`;
 			yield* pending.consume("StepUp", intent, current.native, sql`${snapshotCondition(intent, snapshot)} and ${authority} and ${original.condition}`);
 			let replacementCondition = sql`1 = 1`;
 			let replacementRecord;
@@ -191,13 +188,14 @@ const makeNativeSessionStepUpServices = Effect.fnUntraced(function* (tables, map
 				check: Effect.gen(function* () {
 					const actual = yield* state.read(intent.revision.subjectId);
 					sessionInvariant(actual !== void 0 && sameSessionRevision(actual.revision, evidence.revision));
+					yield* sessionEvidenceDeadline(evidence, plan.baseRequirement, actual.now);
 					yield* sessionEvidenceDeadline(evidence, actual.requirement, actual.now);
 					yield* sessionEvidenceDeadline(evidence, intent.requirement, actual.now);
 					if (replacementRecord !== void 0 && records !== void 0) {
 						const row = yield* records.read(replacementRecord.digest);
 						sessionInvariant(row !== void 0 && sameSessionRecord(row, replacementRecord));
 					}
-				}).pipe(Effect.mapError((cause) => PersistenceMappingError.make({
+				}).pipe(Effect.provideService(AuthenticationClock, state.clockPolicy), Effect.mapError((cause) => PersistenceMappingError.make({
 					operation: "decode",
 					cause
 				})))

package/dist/internal/session-native-step-up.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"session-native-step-up.mjs","names":[],"sources":["../../src/internal/session-native-step-up.ts"],"sourcesContent":["import type { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport { AuthenticationAssurance } from \"@yielded/auth/Operations\";\nimport {\n  SessionConflict,\n  SessionStepUpInvalid,\n  StaleAuthentication,\n  SessionMetadata,\n  type SessionStepUpPersistence,\n  type SessionStepUpIntent,\n  type StatefulSessionRecord,\n} from \"@yielded/auth/Sessions\";\nimport { DateTime, Effect, Option, Schema } from \"effect\";\nimport type { SqlClient } from \"effect/sql/SqlClient\";\nimport type { Fragment } from \"effect/sql/Statement\";\n\nimport { sqlBatchAssertion } from \"./d1-planning\";\nimport { PersistenceMappingError, isMappedConstraintConflict } from \"./mapping-error\";\nimport type { SessionStepUpMapping } from \"./models/step-up-model\";\nimport type { NativeSqlTables } from \"./native-sql-table\";\nimport { sessionEvidenceDeadline } from \"./session-native-authority\";\nimport { prepareNativeSession, type StoredSessionPending } from \"./session-native-pending\";\nimport { makeNativeSessionPendingReader } from \"./session-native-pending-read\";\nimport {\n  makeNativeSessionRecords,\n  sameSessionRecord,\n  makeConditionalSqlInsert,\n} from \"./session-native-record\";\nimport {\n  sameSessionRevision,\n  normalizeSessionOperation,\n  sessionInvariant,\n  sessionUnavailable,\n} from \"./session-native-state\";\nimport { allocateSessionValue } from \"./session-policy\";\nimport {\n  CurrentSqlCommit,\n  makeSqlCommitExecutor,\n  SqlBatchCommit,\n  registerSqlPostcondition,\n  registerSqlBatchPostcondition,\n} from \"./sql-commit\";\nimport {\n  encodeStepUpIntent,\n  decodeStepUpIntent,\n  stepUpIntentLive,\n  validateStepUpPlan,\n} from \"./step-up-state\";\nimport type { AnyTableModel } from \"./table-model\";\n\nexport type NativeSessionStepUpMapping<Claims> = SessionStepUpMapping<\n  Claims,\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  unknown,\n  unknown\n>;\n\nconst assuranceJson = Schema.encodeSync(Schema.fromJsonString(SessionMetadata.fields.assurance));\n\nexport const makeNativeSessionStepUpServices = Effect.fnUntraced(function* <Claims>(\n  tables: NativeSqlTables,\n  mapping: NativeSessionStepUpMapping<Claims>,\n): Effect.fn.Return<\n  { readonly sessionStepUpPersistence: SessionStepUpPersistence<Claims> },\n  never,\n  SqlClient | LifecycleHooks | SqlBatchCommit\n> {\n  const batch = yield* SqlBatchCommit;\n\n  const {\n    state,\n    pending,\n    read: readPending,\n  } = yield* makeNativeSessionPendingReader(tables, mapping, batch !== undefined);\n\n  const conditionalInsert = yield* makeConditionalSqlInsert();\n\n  const records =\n    mapping.source.kind === \"Stateful\"\n      ? yield* makeNativeSessionRecords(tables, { ...mapping, ...mapping.source })\n      : undefined;\n\n  const executor = yield* makeSqlCommitExecutor(sessionUnavailable),\n    external = yield* Effect.serviceOption(CurrentSqlCommit);\n\n  const { sql, now } = state;\n\n  const native = <A, E, R>(\n    work: Effect.Effect<A, E, R>,\n    mode: \"transaction\" | \"statement\" = \"transaction\",\n  ) =>\n    batch === undefined\n      ? executor.operation(normalizeSessionOperation(work), mode)\n      : executor\n          .operationBatch(normalizeSessionOperation(work))\n          .pipe(Effect.provideService(SqlBatchCommit, batch));\n\n  const decode = Effect.fnUntraced(function* (stored: StoredSessionPending) {\n    const intent = yield* decodeStepUpIntent(stored.snapshot);\n\n    sessionInvariant(\n      intent.digest === stored.digest &&\n        intent.version === stored.version &&\n        intent.flowId === stored.flowId &&\n        intent.bindingDigest === stored.bindingDigest &&\n        intent.revision.subjectId === stored.subjectId &&\n        DateTime.toEpochMillis(intent.expiresAt) === stored.expiresAtMillis &&\n        intent.attemptLimit === stored.attemptLimit,\n    );\n\n    return intent;\n  });\n\n  const source = Effect.fnUntraced(function* (\n    intent: Omit<SessionStepUpIntent, \"version\">,\n    instant: number,\n  ) {\n    if (!stepUpIntentLive(intent, mapping.source.kind, DateTime.makeUnsafe(instant)))\n      return undefined;\n    const subject = yield* mapping.subjectId.toNative(intent.revision.subjectId);\n\n    if (mapping.source.kind === \"Stateful\") {\n      sessionInvariant(records !== undefined);\n\n      const nativeSession = yield* mapping.source.sessionId.toNative(intent.sourceSessionId),\n        { s, table } = records;\n\n      const rows =\n        yield* sql`select ${table.fields(\"source_\")} from ${table.name} where ${state.id(table, s.subjectId, subject)} and ${state.id(table, s.sessionId, nativeSession)} and ${records.live(table)} limit 2`;\n\n      sessionInvariant(rows.length <= 1);\n      if (rows[0] === undefined) return undefined;\n      const record = yield* records.decode(table.decode(rows[0], \"source_\"));\n\n      if (\n        record.credentialVersion !== intent.sourceCredentialVersion ||\n        record.subjectId !== intent.revision.subjectId ||\n        record.sessionId !== intent.sourceSessionId ||\n        record.securityRevision !== intent.revision.securityRevision ||\n        DateTime.toEpochMillis(record.assurance.authenticatedAt) !==\n          DateTime.toEpochMillis(intent.sourceAuthenticatedAt) ||\n        DateTime.toEpochMillis(record.expiresAt) !==\n          DateTime.toEpochMillis(intent.sourceExpiresAt) ||\n        DateTime.toEpochMillis(record.absoluteExpiresAt) !==\n          DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt)\n      )\n        return undefined;\n\n      return {\n        record,\n        condition: sql`exists(select 1 from ${table.name} where ${yield* records.owner(record)} and ${records.live(table)})`,\n      };\n    }\n    if (mapping.source.kind === \"StateAssistedSigned\") {\n      const t = mapping.source.tombstone,\n        table = tables(t.table),\n        session = yield* mapping.source.sessionId.toNative(intent.sourceSessionId);\n\n      const condition = sql`not exists(select 1 from ${table.name} where ${state.exact(table, t.moduleId, mapping.moduleId)} and ${state.id(table, t.subjectId, subject)} and ${state.id(table, t.sessionId, session)})`;\n\n      if ((yield* sql`select 1 where ${condition}`).length !== 1) return undefined;\n\n      return { record: undefined, condition };\n    }\n\n    return { record: undefined, condition: sql`1 = 1` };\n  });\n\n  const final = Effect.fnUntraced(function* (name: string, condition: Fragment) {\n    if (batch !== undefined)\n      yield* registerSqlBatchPostcondition({ name, statement: sqlBatchAssertion(sql, condition) });\n    else if (Option.isSome(external))\n      yield* registerSqlPostcondition({\n        name,\n        check: Effect.gen(function* () {\n          sessionInvariant((yield* sql`select 1 where ${condition}`).length === 1);\n        }).pipe(\n          Effect.mapError((cause) => PersistenceMappingError.make({ operation: \"decode\", cause })),\n        ),\n      });\n  });\n\n  const snapshotCondition = (intent: SessionStepUpIntent, snapshot: string) =>\n    sql.and([\n      state.exact(pending.table, pending.p.snapshot, snapshot),\n      sql`${tables.expression(mapping.clock.toMillis(pending.table.column(pending.p.expiresAt)))} = ${DateTime.toEpochMillis(intent.expiresAt)}`,\n      sql`${pending.table.column(pending.p.attemptLimit)} = ${pending.table.value(pending.p.attemptLimit, intent.attemptLimit)}`,\n    ]);\n\n  const sessionStepUpPersistence: SessionStepUpPersistence<Claims> = {\n    create: (input, _now, project) =>\n      native(\n        Effect.gen(function* () {\n          const current = yield* state.read(input.revision.subjectId, true);\n\n          if (current === undefined || !sameSessionRevision(current.revision, input.revision))\n            return yield* StaleAuthentication.make({});\n          const original = yield* source(input, current.now);\n\n          if (original === undefined) return yield* StaleAuthentication.make({});\n\n          const version = yield* allocateSessionValue(\n            \"interactive\",\n            mapping.pending.allocateVersion,\n            mapping.pending.allocateVersionSync,\n          );\n\n          const intent = { ...input, version },\n            snapshot = yield* encodeStepUpIntent(intent);\n\n          const condition = sql`${state.authorityCondition(intent.revision, current.native)} and ${state.policyCondition(current.row, current.native)} and ${original.condition} and ${now} >= ${DateTime.toEpochMillis(intent.sourceAuthenticatedAt)} and ${now} < ${DateTime.toEpochMillis(intent.expiresAt)}`;\n\n          yield* pending\n            .insert(\n              {\n                moduleId: mapping.moduleId,\n                kind: \"StepUp\",\n                digest: intent.digest,\n                version,\n                flowId: intent.flowId,\n                subjectId: current.native,\n                bindingDigest: intent.bindingDigest,\n                snapshot,\n                expiresAt: intent.expiresAt,\n                attemptLimit: intent.attemptLimit,\n              },\n              condition,\n            )\n            .pipe(\n              Effect.mapError((error) =>\n                isMappedConstraintConflict(mapping.isConstraintConflict, error)\n                  ? SessionConflict.make({})\n                  : error,\n              ),\n            );\n          yield* final(\n            \"session-step-up-issuance\",\n            sql`${condition} and exists(select 1 from ${pending.table.name} where ${pending.predicate(pending.table, \"StepUp\", intent.digest)} and ${state.exact(pending.table, pending.p.version, version)} and ${snapshotCondition(intent, snapshot)})`,\n          );\n\n          return yield* prepareNativeSession(intent, project);\n        }),\n      ),\n    read: ({ digest }) =>\n      executor\n        .read(\n          Effect.gen(function* () {\n            const selected = yield* readPending(\"StepUp\", digest);\n\n            if (selected === undefined) return undefined;\n\n            const intent = yield* decode(selected.record),\n              current = selected.authority;\n\n            if (\n              !sameSessionRevision(current.revision, intent.revision) ||\n              !stepUpIntentLive(intent, mapping.source.kind, DateTime.makeUnsafe(current.now))\n            )\n              return undefined;\n\n            // The detached source stays original. Its live digest and metadata\n            // are rechecked by complete before any replacement is committed.\n            return { intent, requirement: current.requirement };\n          }),\n        )\n        .pipe(\n          Effect.flatMap((value) =>\n            value === undefined\n              ? Effect.fail(SessionStepUpInvalid.make({}))\n              : Effect.succeed(value),\n          ),\n        ),\n    reject: ({ digest }, project) =>\n      native(\n        Effect.gen(function* () {\n          yield* pending.reject(\"StepUp\", digest);\n\n          return yield* prepareNativeSession({ _tag: \"Rejected\" } as const, project);\n        }),\n        \"statement\",\n      ),\n    complete: (plan, project) =>\n      native(\n        Effect.gen(function* () {\n          yield* validateStepUpPlan(plan);\n          const { intent, evidence, replacement } = plan;\n          const current = yield* state.read(intent.revision.subjectId, true);\n\n          if (\n            current === undefined ||\n            !sameSessionRevision(current.revision, evidence.revision) ||\n            !sameSessionRevision(current.revision, intent.revision)\n          )\n            return yield* StaleAuthentication.make({});\n          const original = yield* source(intent, current.now);\n\n          if (original === undefined) return yield* SessionStepUpInvalid.make({});\n          if (plan.source.guard._tag === \"Stateful\") {\n            if (\n              original.record === undefined ||\n              original.record.digest !== plan.source.guard.digest ||\n              !sameSessionRecord(original.record, {\n                ...plan.source.inspection.session,\n                provenance: plan.source.inspection.provenance,\n                credentialVersion: plan.source.inspection.credentialVersion,\n                digest: plan.source.guard.digest,\n              })\n            )\n              return yield* SessionStepUpInvalid.make({});\n          }\n\n          const base = yield* sessionEvidenceDeadline(evidence, current.requirement, current.now),\n            profile = yield* sessionEvidenceDeadline(evidence, intent.requirement, current.now);\n\n          if (\n            assuranceJson(\n              AuthenticationAssurance.make({\n                ...base.assessed.assurance,\n                authenticatedAt: profile.assessed.assurance.authenticatedAt,\n              }),\n            ) !== assuranceJson(replacement.inspection.session.assurance)\n          )\n            return yield* SessionStepUpInvalid.make({});\n\n          const deadline = Math.min(\n            base.validUntil,\n            profile.validUntil,\n            DateTime.toEpochMillis(intent.expiresAt),\n            DateTime.toEpochMillis(replacement.inspection.session.expiresAt),\n          );\n\n          if (\n            current.now >= deadline ||\n            DateTime.toEpochMillis(replacement.inspection.session.issuedAt) > current.now ||\n            DateTime.toEpochMillis(replacement.inspection.session.expiresAt) >\n              DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt)\n          )\n            return yield* SessionStepUpInvalid.make({});\n          const snapshot = yield* encodeStepUpIntent(intent);\n          const authority = sql`${state.authorityCondition(evidence.revision, current.native)} and ${state.policyCondition(current.row, current.native)} and ${now} >= ${current.now} and ${now} < ${deadline}`;\n\n          yield* pending.consume(\n            \"StepUp\",\n            intent,\n            current.native,\n            sql`${snapshotCondition(intent, snapshot)} and ${authority} and ${original.condition}`,\n          );\n          let replacementCondition: Fragment = sql`1 = 1`;\n          let replacementRecord: StatefulSessionRecord<Claims> | undefined;\n\n          if (replacement._tag === \"Stateful\" && mapping.source.kind === \"Stateful\") {\n            sessionInvariant(records !== undefined && original.record !== undefined);\n\n            const next: StatefulSessionRecord<Claims> = {\n              ...replacement.inspection.session,\n              digest: replacement.nextDigest,\n              credentialVersion: replacement.inspection.credentialVersion,\n              provenance: replacement.inspection.provenance,\n            };\n\n            if (\n              next.digest === original.record.digest ||\n              next.credentialVersion === original.record.credentialVersion\n            )\n              return yield* SessionStepUpInvalid.make({});\n            const { s, table } = records;\n\n            const values = {\n              ...s.encodeRotation(next),\n              [s.digest]: next.digest,\n              [s.issuedAt]: s.encodeInstant(next.issuedAt),\n              [s.expiresAt]: s.encodeInstant(next.expiresAt),\n              [s.absoluteExpiresAt]: s.encodeInstant(next.absoluteExpiresAt),\n              [s.securityRevision]: next.securityRevision,\n            };\n\n            yield* pending.stage(\n              sql`${table.update(values)} where ${yield* records.owner(original.record)} and ${records.live(table)} and ${authority}`,\n              1,\n            );\n            replacementCondition = sql`exists(select 1 from ${table.name} where ${yield* records.owner(next)} and ${records.encodedCondition(values)} and ${records.live(table)})`;\n            replacementRecord = next;\n          } else if (\n            replacement._tag === \"StateAssistedSigned\" &&\n            mapping.source.kind === \"StateAssistedSigned\"\n          ) {\n            const t = mapping.source.tombstone,\n              table = tables(t.table),\n              session = yield* mapping.source.sessionId.toNative(intent.sourceSessionId);\n\n            const values = {\n              ...t.encodeInsert({\n                moduleId: mapping.moduleId,\n                subjectId: current.native,\n                sessionId: session,\n                absoluteExpiresAt: intent.sourceAbsoluteExpiresAt,\n              }),\n              [t.moduleId]: mapping.moduleId,\n              [t.subjectId]: current.native,\n              [t.sessionId]: session,\n              [t.absoluteExpiresAt]: t.encodeInstant(intent.sourceAbsoluteExpiresAt),\n            };\n\n            yield* pending.stage(\n              conditionalInsert(table, values, sql`${authority} and ${original.condition}`),\n              1,\n            );\n            replacementCondition = sql`exists(select 1 from ${table.name} where ${state.exact(table, t.moduleId, mapping.moduleId)} and ${state.id(table, t.subjectId, current.native)} and ${state.id(table, t.sessionId, session)} and ${tables.expression(mapping.clock.toMillis(table.column(t.absoluteExpiresAt)))} >= ${DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt)})`;\n          } else if (\n            replacement._tag !== \"StatelessSigned\" ||\n            mapping.source.kind !== \"StatelessSigned\"\n          )\n            return yield* SessionStepUpInvalid.make({});\n          yield* final(\n            \"session-step-up-completion\",\n            sql`${authority} and ${pending.consumedCondition(\"StepUp\", intent, current.native)} and ${replacementCondition}`,\n          );\n          if (batch === undefined && Option.isSome(external))\n            yield* registerSqlPostcondition({\n              name: \"session-step-up-current-policy\",\n              check: Effect.gen(function* () {\n                const actual = yield* state.read(intent.revision.subjectId);\n\n                sessionInvariant(\n                  actual !== undefined && sameSessionRevision(actual.revision, evidence.revision),\n                );\n                yield* sessionEvidenceDeadline(evidence, actual.requirement, actual.now);\n                yield* sessionEvidenceDeadline(evidence, intent.requirement, actual.now);\n                if (replacementRecord !== undefined && records !== undefined) {\n                  const row = yield* records.read(replacementRecord.digest);\n\n                  sessionInvariant(row !== undefined && sameSessionRecord(row, replacementRecord));\n                }\n              }).pipe(\n                Effect.mapError((cause) =>\n                  PersistenceMappingError.make({ operation: \"decode\", cause }),\n                ),\n              ),\n            });\n\n          return yield* prepareNativeSession(replacement.inspection, project);\n        }),\n      ),\n  };\n\n  return { sessionStepUpPersistence };\n});\n"],"mappings":";;;;;;;;;;;;;;AA4DA,MAAM,gBAAgB,OAAO,WAAW,OAAO,eAAe,gBAAgB,OAAO,SAAS,CAAC;AAE/F,MAAa,kCAAkC,OAAO,WAAW,WAC/D,QACA,SAKA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,EACJ,OACA,SACA,MAAM,gBACJ,OAAO,+BAA+B,QAAQ,SAAS,UAAU,KAAA,CAAS;CAE9E,MAAM,oBAAoB,OAAO,yBAAyB;CAE1D,MAAM,UACJ,QAAQ,OAAO,SAAS,aACpB,OAAO,yBAAyB,QAAQ;EAAE,GAAG;EAAS,GAAG,QAAQ;CAAO,CAAC,IACzE,KAAA;CAEN,MAAM,WAAW,OAAO,sBAAsB,kBAAkB,GAC9D,WAAW,OAAO,OAAO,cAAc,gBAAgB;CAEzD,MAAM,EAAE,KAAK,QAAQ;CAErB,MAAM,UACJ,MACA,OAAoC,kBAEpC,UAAU,KAAA,IACN,SAAS,UAAU,0BAA0B,IAAI,GAAG,IAAI,IACxD,SACG,eAAe,0BAA0B,IAAI,CAAC,CAAC,CAC/C,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CAE1D,MAAM,SAAS,OAAO,WAAW,WAAW,QAA8B;EACxE,MAAM,SAAS,OAAO,mBAAmB,OAAO,QAAQ;EAExD,iBACE,OAAO,WAAW,OAAO,UACvB,OAAO,YAAY,OAAO,WAC1B,OAAO,WAAW,OAAO,UACzB,OAAO,kBAAkB,OAAO,iBAChC,OAAO,SAAS,cAAc,OAAO,aACrC,SAAS,cAAc,OAAO,SAAS,MAAM,OAAO,mBACpD,OAAO,iBAAiB,OAAO,YACnC;EAEA,OAAO;CACT,CAAC;CAED,MAAM,SAAS,OAAO,WAAW,WAC/B,QACA,SACA;EACA,IAAI,CAAC,iBAAiB,QAAQ,QAAQ,OAAO,MAAM,SAAS,WAAW,OAAO,CAAC,GAC7E,OAAO,KAAA;EACT,MAAM,UAAU,OAAO,QAAQ,UAAU,SAAS,OAAO,SAAS,SAAS;EAE3E,IAAI,QAAQ,OAAO,SAAS,YAAY;GACtC,iBAAiB,YAAY,KAAA,CAAS;GAEtC,MAAM,gBAAgB,OAAO,QAAQ,OAAO,UAAU,SAAS,OAAO,eAAe,GACnF,EAAE,GAAG,UAAU;GAEjB,MAAM,OACJ,OAAO,GAAG,UAAU,MAAM,OAAO,SAAS,EAAE,QAAQ,MAAM,KAAK,SAAS,MAAM,GAAG,OAAO,EAAE,WAAW,OAAO,EAAE,OAAO,MAAM,GAAG,OAAO,EAAE,WAAW,aAAa,EAAE,OAAO,QAAQ,KAAK,KAAK,EAAE;GAE9L,iBAAiB,KAAK,UAAU,CAAC;GACjC,IAAI,KAAK,OAAO,KAAA,GAAW,OAAO,KAAA;GAClC,MAAM,SAAS,OAAO,QAAQ,OAAO,MAAM,OAAO,KAAK,IAAI,SAAS,CAAC;GAErE,IACE,OAAO,sBAAsB,OAAO,2BACpC,OAAO,cAAc,OAAO,SAAS,aACrC,OAAO,cAAc,OAAO,mBAC5B,OAAO,qBAAqB,OAAO,SAAS,oBAC5C,SAAS,cAAc,OAAO,UAAU,eAAe,MACrD,SAAS,cAAc,OAAO,qBAAqB,KACrD,SAAS,cAAc,OAAO,SAAS,MACrC,SAAS,cAAc,OAAO,eAAe,KAC/C,SAAS,cAAc,OAAO,iBAAiB,MAC7C,SAAS,cAAc,OAAO,uBAAuB,GAEvD,OAAO,KAAA;GAET,OAAO;IACL;IACA,WAAW,GAAG,wBAAwB,MAAM,KAAK,SAAS,OAAO,QAAQ,MAAM,MAAM,EAAE,OAAO,QAAQ,KAAK,KAAK,EAAE;GACpH;EACF;EACA,IAAI,QAAQ,OAAO,SAAS,uBAAuB;GACjD,MAAM,IAAI,QAAQ,OAAO,WACvB,QAAQ,OAAO,EAAE,KAAK,GACtB,UAAU,OAAO,QAAQ,OAAO,UAAU,SAAS,OAAO,eAAe;GAE3E,MAAM,YAAY,GAAG,4BAA4B,MAAM,KAAK,SAAS,MAAM,MAAM,OAAO,EAAE,UAAU,QAAQ,QAAQ,EAAE,OAAO,MAAM,GAAG,OAAO,EAAE,WAAW,OAAO,EAAE,OAAO,MAAM,GAAG,OAAO,EAAE,WAAW,OAAO,EAAE;GAEhN,KAAK,OAAO,GAAG,kBAAkB,YAAA,CAAa,WAAW,GAAG,OAAO,KAAA;GAEnE,OAAO;IAAE,QAAQ,KAAA;IAAW;GAAU;EACxC;EAEA,OAAO;GAAE,QAAQ,KAAA;GAAW,WAAW,GAAG;EAAQ;CACpD,CAAC;CAED,MAAM,QAAQ,OAAO,WAAW,WAAW,MAAc,WAAqB;EAC5E,IAAI,UAAU,KAAA,GACZ,OAAO,8BAA8B;GAAE;GAAM,WAAW,kBAAkB,KAAK,SAAS;EAAE,CAAC;OACxF,IAAI,OAAO,OAAO,QAAQ,GAC7B,OAAO,yBAAyB;GAC9B;GACA,OAAO,OAAO,IAAI,aAAa;IAC7B,kBAAkB,OAAO,GAAG,kBAAkB,YAAA,CAAa,WAAW,CAAC;GACzE,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,UAAU,wBAAwB,KAAK;IAAE,WAAW;IAAU;GAAM,CAAC,CAAC,CACzF;EACF,CAAC;CACL,CAAC;CAED,MAAM,qBAAqB,QAA6B,aACtD,IAAI,IAAI;EACN,MAAM,MAAM,QAAQ,OAAO,QAAQ,EAAE,UAAU,QAAQ;EACvD,GAAG,GAAG,OAAO,WAAW,QAAQ,MAAM,SAAS,QAAQ,MAAM,OAAO,QAAQ,EAAE,SAAS,CAAC,CAAC,EAAE,KAAK,SAAS,cAAc,OAAO,SAAS;EACvI,GAAG,GAAG,QAAQ,MAAM,OAAO,QAAQ,EAAE,YAAY,EAAE,KAAK,QAAQ,MAAM,MAAM,QAAQ,EAAE,cAAc,OAAO,YAAY;CACzH,CAAC;CAkQH,OAAO,EAAE,0BAAA;EA/PP,SAAS,OAAO,MAAM,YACpB,OACE,OAAO,IAAI,aAAa;GACtB,MAAM,UAAU,OAAO,MAAM,KAAK,MAAM,SAAS,WAAW,IAAI;GAEhE,IAAI,YAAY,KAAA,KAAa,CAAC,oBAAoB,QAAQ,UAAU,MAAM,QAAQ,GAChF,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;GAC3C,MAAM,WAAW,OAAO,OAAO,OAAO,QAAQ,GAAG;GAEjD,IAAI,aAAa,KAAA,GAAW,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;GAErE,MAAM,UAAU,OAAO,qBACrB,eACA,QAAQ,QAAQ,iBAChB,QAAQ,QAAQ,mBAClB;GAEA,MAAM,SAAS;IAAE,GAAG;IAAO;GAAQ,GACjC,WAAW,OAAO,mBAAmB,MAAM;GAE7C,MAAM,YAAY,GAAG,GAAG,MAAM,mBAAmB,OAAO,UAAU,QAAQ,MAAM,EAAE,OAAO,MAAM,gBAAgB,QAAQ,KAAK,QAAQ,MAAM,EAAE,OAAO,SAAS,UAAU,OAAO,IAAI,MAAM,SAAS,cAAc,OAAO,qBAAqB,EAAE,OAAO,IAAI,KAAK,SAAS,cAAc,OAAO,SAAS;GAEnS,OAAO,QACJ,OACC;IACE,UAAU,QAAQ;IAClB,MAAM;IACN,QAAQ,OAAO;IACf;IACA,QAAQ,OAAO;IACf,WAAW,QAAQ;IACnB,eAAe,OAAO;IACtB;IACA,WAAW,OAAO;IAClB,cAAc,OAAO;GACvB,GACA,SACF,CAAC,CACA,KACC,OAAO,UAAU,UACf,2BAA2B,QAAQ,sBAAsB,KAAK,IAC1D,gBAAgB,KAAK,CAAC,CAAC,IACvB,KACN,CACF;GACF,OAAO,MACL,4BACA,GAAG,GAAG,UAAU,4BAA4B,QAAQ,MAAM,KAAK,SAAS,QAAQ,UAAU,QAAQ,OAAO,UAAU,OAAO,MAAM,EAAE,OAAO,MAAM,MAAM,QAAQ,OAAO,QAAQ,EAAE,SAAS,OAAO,EAAE,OAAO,kBAAkB,QAAQ,QAAQ,EAAE,EAC7O;GAEA,OAAO,OAAO,qBAAqB,QAAQ,OAAO;EACpD,CAAC,CACH;EACF,OAAO,EAAE,aACP,SACG,KACC,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,OAAO,YAAY,UAAU,MAAM;GAEpD,IAAI,aAAa,KAAA,GAAW,OAAO,KAAA;GAEnC,MAAM,SAAS,OAAO,OAAO,SAAS,MAAM,GAC1C,UAAU,SAAS;GAErB,IACE,CAAC,oBAAoB,QAAQ,UAAU,OAAO,QAAQ,KACtD,CAAC,iBAAiB,QAAQ,QAAQ,OAAO,MAAM,SAAS,WAAW,QAAQ,GAAG,CAAC,GAE/E,OAAO,KAAA;GAIT,OAAO;IAAE;IAAQ,aAAa,QAAQ;GAAY;EACpD,CAAC,CACH,CAAC,CACA,KACC,OAAO,SAAS,UACd,UAAU,KAAA,IACN,OAAO,KAAK,qBAAqB,KAAK,CAAC,CAAC,CAAC,IACzC,OAAO,QAAQ,KAAK,CAC1B,CACF;EACJ,SAAS,EAAE,UAAU,YACnB,OACE,OAAO,IAAI,aAAa;GACtB,OAAO,QAAQ,OAAO,UAAU,MAAM;GAEtC,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAY,OAAO;EAC3E,CAAC,GACD,WACF;EACF,WAAW,MAAM,YACf,OACE,OAAO,IAAI,aAAa;GACtB,OAAO,mBAAmB,IAAI;GAC9B,MAAM,EAAE,QAAQ,UAAU,gBAAgB;GAC1C,MAAM,UAAU,OAAO,MAAM,KAAK,OAAO,SAAS,WAAW,IAAI;GAEjE,IACE,YAAY,KAAA,KACZ,CAAC,oBAAoB,QAAQ,UAAU,SAAS,QAAQ,KACxD,CAAC,oBAAoB,QAAQ,UAAU,OAAO,QAAQ,GAEtD,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;GAC3C,MAAM,WAAW,OAAO,OAAO,QAAQ,QAAQ,GAAG;GAElD,IAAI,aAAa,KAAA,GAAW,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;GACtE,IAAI,KAAK,OAAO,MAAM,SAAS,YAE3B;QAAA,SAAS,WAAW,KAAA,KACpB,SAAS,OAAO,WAAW,KAAK,OAAO,MAAM,UAC7C,CAAC,kBAAkB,SAAS,QAAQ;KAClC,GAAG,KAAK,OAAO,WAAW;KAC1B,YAAY,KAAK,OAAO,WAAW;KACnC,mBAAmB,KAAK,OAAO,WAAW;KAC1C,QAAQ,KAAK,OAAO,MAAM;IAC5B,CAAC,GAED,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;GAAA;GAG9C,MAAM,OAAO,OAAO,wBAAwB,UAAU,QAAQ,aAAa,QAAQ,GAAG,GACpF,UAAU,OAAO,wBAAwB,UAAU,OAAO,aAAa,QAAQ,GAAG;GAEpF,IACE,cACE,wBAAwB,KAAK;IAC3B,GAAG,KAAK,SAAS;IACjB,iBAAiB,QAAQ,SAAS,UAAU;GAC9C,CAAC,CACH,MAAM,cAAc,YAAY,WAAW,QAAQ,SAAS,GAE5D,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;GAE5C,MAAM,WAAW,KAAK,IACpB,KAAK,YACL,QAAQ,YACR,SAAS,cAAc,OAAO,SAAS,GACvC,SAAS,cAAc,YAAY,WAAW,QAAQ,SAAS,CACjE;GAEA,IACE,QAAQ,OAAO,YACf,SAAS,cAAc,YAAY,WAAW,QAAQ,QAAQ,IAAI,QAAQ,OAC1E,SAAS,cAAc,YAAY,WAAW,QAAQ,SAAS,IAC7D,SAAS,cAAc,OAAO,uBAAuB,GAEvD,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;GAC5C,MAAM,WAAW,OAAO,mBAAmB,MAAM;GACjD,MAAM,YAAY,GAAG,GAAG,MAAM,mBAAmB,SAAS,UAAU,QAAQ,MAAM,EAAE,OAAO,MAAM,gBAAgB,QAAQ,KAAK,QAAQ,MAAM,EAAE,OAAO,IAAI,MAAM,QAAQ,IAAI,OAAO,IAAI,KAAK;GAE3L,OAAO,QAAQ,QACb,UACA,QACA,QAAQ,QACR,GAAG,GAAG,kBAAkB,QAAQ,QAAQ,EAAE,OAAO,UAAU,OAAO,SAAS,WAC7E;GACA,IAAI,uBAAiC,GAAG;GACxC,IAAI;GAEJ,IAAI,YAAY,SAAS,cAAc,QAAQ,OAAO,SAAS,YAAY;IACzE,iBAAiB,YAAY,KAAA,KAAa,SAAS,WAAW,KAAA,CAAS;IAEvE,MAAM,OAAsC;KAC1C,GAAG,YAAY,WAAW;KAC1B,QAAQ,YAAY;KACpB,mBAAmB,YAAY,WAAW;KAC1C,YAAY,YAAY,WAAW;IACrC;IAEA,IACE,KAAK,WAAW,SAAS,OAAO,UAChC,KAAK,sBAAsB,SAAS,OAAO,mBAE3C,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;IAC5C,MAAM,EAAE,GAAG,UAAU;IAErB,MAAM,SAAS;KACb,GAAG,EAAE,eAAe,IAAI;MACvB,EAAE,SAAS,KAAK;MAChB,EAAE,WAAW,EAAE,cAAc,KAAK,QAAQ;MAC1C,EAAE,YAAY,EAAE,cAAc,KAAK,SAAS;MAC5C,EAAE,oBAAoB,EAAE,cAAc,KAAK,iBAAiB;MAC5D,EAAE,mBAAmB,KAAK;IAC7B;IAEA,OAAO,QAAQ,MACb,GAAG,GAAG,MAAM,OAAO,MAAM,EAAE,SAAS,OAAO,QAAQ,MAAM,SAAS,MAAM,EAAE,OAAO,QAAQ,KAAK,KAAK,EAAE,OAAO,aAC5G,CACF;IACA,uBAAuB,GAAG,wBAAwB,MAAM,KAAK,SAAS,OAAO,QAAQ,MAAM,IAAI,EAAE,OAAO,QAAQ,iBAAiB,MAAM,EAAE,OAAO,QAAQ,KAAK,KAAK,EAAE;IACpK,oBAAoB;GACtB,OAAO,IACL,YAAY,SAAS,yBACrB,QAAQ,OAAO,SAAS,uBACxB;IACA,MAAM,IAAI,QAAQ,OAAO,WACvB,QAAQ,OAAO,EAAE,KAAK,GACtB,UAAU,OAAO,QAAQ,OAAO,UAAU,SAAS,OAAO,eAAe;IAE3E,MAAM,SAAS;KACb,GAAG,EAAE,aAAa;MAChB,UAAU,QAAQ;MAClB,WAAW,QAAQ;MACnB,WAAW;MACX,mBAAmB,OAAO;KAC5B,CAAC;MACA,EAAE,WAAW,QAAQ;MACrB,EAAE,YAAY,QAAQ;MACtB,EAAE,YAAY;MACd,EAAE,oBAAoB,EAAE,cAAc,OAAO,uBAAuB;IACvE;IAEA,OAAO,QAAQ,MACb,kBAAkB,OAAO,QAAQ,GAAG,GAAG,UAAU,OAAO,SAAS,WAAW,GAC5E,CACF;IACA,uBAAuB,GAAG,wBAAwB,MAAM,KAAK,SAAS,MAAM,MAAM,OAAO,EAAE,UAAU,QAAQ,QAAQ,EAAE,OAAO,MAAM,GAAG,OAAO,EAAE,WAAW,QAAQ,MAAM,EAAE,OAAO,MAAM,GAAG,OAAO,EAAE,WAAW,OAAO,EAAE,OAAO,OAAO,WAAW,QAAQ,MAAM,SAAS,MAAM,OAAO,EAAE,iBAAiB,CAAC,CAAC,EAAE,MAAM,SAAS,cAAc,OAAO,uBAAuB,EAAE;GAC3W,OAAO,IACL,YAAY,SAAS,qBACrB,QAAQ,OAAO,SAAS,mBAExB,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;GAC5C,OAAO,MACL,8BACA,GAAG,GAAG,UAAU,OAAO,QAAQ,kBAAkB,UAAU,QAAQ,QAAQ,MAAM,EAAE,OAAO,sBAC5F;GACA,IAAI,UAAU,KAAA,KAAa,OAAO,OAAO,QAAQ,GAC/C,OAAO,yBAAyB;IAC9B,MAAM;IACN,OAAO,OAAO,IAAI,aAAa;KAC7B,MAAM,SAAS,OAAO,MAAM,KAAK,OAAO,SAAS,SAAS;KAE1D,iBACE,WAAW,KAAA,KAAa,oBAAoB,OAAO,UAAU,SAAS,QAAQ,CAChF;KACA,OAAO,wBAAwB,UAAU,OAAO,aAAa,OAAO,GAAG;KACvE,OAAO,wBAAwB,UAAU,OAAO,aAAa,OAAO,GAAG;KACvE,IAAI,sBAAsB,KAAA,KAAa,YAAY,KAAA,GAAW;MAC5D,MAAM,MAAM,OAAO,QAAQ,KAAK,kBAAkB,MAAM;MAExD,iBAAiB,QAAQ,KAAA,KAAa,kBAAkB,KAAK,iBAAiB,CAAC;KACjF;IACF,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,UACf,wBAAwB,KAAK;KAAE,WAAW;KAAU;IAAM,CAAC,CAC7D,CACF;GACF,CAAC;GAEH,OAAO,OAAO,qBAAqB,YAAY,YAAY,OAAO;EACpE,CAAC,CACH;CAG4B,EAAE;AACpC,CAAC"}
+{"version":3,"file":"session-native-step-up.mjs","names":[],"sources":["../../src/internal/session-native-step-up.ts"],"sourcesContent":["import type { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport { AuthenticationClock } from \"@yielded/auth/Operations\";\nimport {\n  SessionConflict,\n  SessionStepUpInvalid,\n  StaleAuthentication,\n  type SessionStepUpPersistence,\n  type SessionStepUpIntent,\n  type StatefulSessionRecord,\n  type SessionUnavailable,\n} from \"@yielded/auth/Sessions\";\nimport { DateTime, Effect, Option } from \"effect\";\nimport type { SqlClient } from \"effect/sql/SqlClient\";\nimport type { Fragment } from \"effect/sql/Statement\";\n\nimport { sqlBatchAssertion } from \"./d1-planning\";\nimport { PersistenceMappingError, isMappedConstraintConflict } from \"./mapping-error\";\nimport type { SessionStepUpMapping } from \"./models/step-up-model\";\nimport type { NativeSqlTables } from \"./native-sql-table\";\nimport { sessionEvidenceDeadline } from \"./session-native-authority\";\nimport { prepareNativeSession, type StoredSessionPending } from \"./session-native-pending\";\nimport { makeNativeSessionPendingReader } from \"./session-native-pending-read\";\nimport {\n  makeNativeSessionRecords,\n  sameSessionRecord,\n  makeConditionalSqlInsert,\n} from \"./session-native-record\";\nimport {\n  sameSessionRevision,\n  normalizeSessionOperation,\n  sessionInvariant,\n  sessionUnavailable,\n} from \"./session-native-state\";\nimport { allocateSessionValue } from \"./session-policy\";\nimport {\n  CurrentSqlCommit,\n  makeSqlCommitExecutor,\n  SqlBatchCommit,\n  registerSqlPostcondition,\n  registerSqlBatchPostcondition,\n} from \"./sql-commit\";\nimport {\n  encodeStepUpIntent,\n  decodeStepUpIntent,\n  stepUpIntentLive,\n  validateStepUpPlan,\n} from \"./step-up-state\";\nimport type { AnyTableModel } from \"./table-model\";\n\nexport type NativeSessionStepUpMapping<Claims> = SessionStepUpMapping<\n  Claims,\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  unknown,\n  unknown\n>;\n\nexport const makeNativeSessionStepUpServices = Effect.fnUntraced(function* <Claims>(\n  tables: NativeSqlTables,\n  mapping: NativeSessionStepUpMapping<Claims>,\n): Effect.fn.Return<\n  { readonly sessionStepUpPersistence: SessionStepUpPersistence<Claims> },\n  SessionUnavailable,\n  SqlClient | LifecycleHooks | SqlBatchCommit\n> {\n  const batch = yield* SqlBatchCommit;\n\n  const {\n    state,\n    pending,\n    read: readPending,\n  } = yield* makeNativeSessionPendingReader(tables, mapping, batch !== undefined);\n\n  const conditionalInsert = yield* makeConditionalSqlInsert();\n\n  const records =\n    mapping.source.kind === \"Stateful\"\n      ? yield* makeNativeSessionRecords(tables, { ...mapping, ...mapping.source })\n      : undefined;\n\n  const executor = yield* makeSqlCommitExecutor(sessionUnavailable),\n    external = yield* Effect.serviceOption(CurrentSqlCommit);\n\n  const { sql, now } = state;\n\n  const native = <A, E, R>(\n    work: Effect.Effect<A, E, R>,\n    mode: \"transaction\" | \"statement\" = \"transaction\",\n  ) =>\n    (batch === undefined\n      ? executor.operation(normalizeSessionOperation(work), mode)\n      : executor\n          .operationBatch(normalizeSessionOperation(work))\n          .pipe(Effect.provideService(SqlBatchCommit, batch))\n    ).pipe(Effect.provideService(AuthenticationClock, state.clockPolicy));\n\n  const decode = Effect.fnUntraced(function* (stored: StoredSessionPending) {\n    const intent = yield* decodeStepUpIntent(stored.snapshot);\n\n    sessionInvariant(\n      intent.digest === stored.digest &&\n        intent.version === stored.version &&\n        intent.flowId === stored.flowId &&\n        intent.bindingDigest === stored.bindingDigest &&\n        intent.revision.subjectId === stored.subjectId &&\n        DateTime.toEpochMillis(intent.expiresAt) === stored.expiresAtMillis &&\n        intent.attemptLimit === stored.attemptLimit,\n    );\n\n    return intent;\n  });\n\n  const source = Effect.fnUntraced(function* (\n    intent: Omit<SessionStepUpIntent, \"version\">,\n    instant: number,\n  ) {\n    if (!(yield* stepUpIntentLive(intent, mapping.source.kind, DateTime.makeUnsafe(instant))))\n      return undefined;\n    const subject = yield* mapping.subjectId.toNative(intent.revision.subjectId);\n\n    if (mapping.source.kind === \"Stateful\") {\n      sessionInvariant(records !== undefined);\n\n      const nativeSession = yield* mapping.source.sessionId.toNative(intent.sourceSessionId),\n        { s, table } = records;\n\n      const rows =\n        yield* sql`select ${table.fields(\"source_\")} from ${table.name} where ${state.id(table, s.subjectId, subject)} and ${state.id(table, s.sessionId, nativeSession)} and ${records.live(table)} limit 2`;\n\n      sessionInvariant(rows.length <= 1);\n      if (rows[0] === undefined) return undefined;\n      const record = yield* records.decode(table.decode(rows[0], \"source_\"));\n\n      if (\n        record.credentialVersion !== intent.sourceCredentialVersion ||\n        record.subjectId !== intent.revision.subjectId ||\n        record.sessionId !== intent.sourceSessionId ||\n        record.securityRevision !== intent.revision.securityRevision ||\n        DateTime.toEpochMillis(record.assurance.authenticatedAt) !==\n          DateTime.toEpochMillis(intent.sourceAuthenticatedAt) ||\n        DateTime.toEpochMillis(record.expiresAt) !==\n          DateTime.toEpochMillis(intent.sourceExpiresAt) ||\n        DateTime.toEpochMillis(record.absoluteExpiresAt) !==\n          DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt)\n      )\n        return undefined;\n\n      return {\n        record,\n        condition: sql`exists(select 1 from ${table.name} where ${yield* records.owner(record)} and ${records.live(table)})`,\n      };\n    }\n    if (mapping.source.kind === \"StateAssistedSigned\") {\n      const t = mapping.source.tombstone,\n        table = tables(t.table),\n        session = yield* mapping.source.sessionId.toNative(intent.sourceSessionId);\n\n      const condition = sql`not exists(select 1 from ${table.name} where ${state.exact(table, t.moduleId, mapping.moduleId)} and ${state.id(table, t.subjectId, subject)} and ${state.id(table, t.sessionId, session)})`;\n\n      if ((yield* sql`select 1 where ${condition}`).length !== 1) return undefined;\n\n      return { record: undefined, condition };\n    }\n\n    return { record: undefined, condition: sql`1 = 1` };\n  });\n\n  const final = Effect.fnUntraced(function* (name: string, condition: Fragment) {\n    if (batch !== undefined)\n      yield* registerSqlBatchPostcondition({ name, statement: sqlBatchAssertion(sql, condition) });\n    else if (Option.isSome(external))\n      yield* registerSqlPostcondition({\n        name,\n        check: Effect.gen(function* () {\n          sessionInvariant((yield* sql`select 1 where ${condition}`).length === 1);\n        }).pipe(\n          Effect.provideService(AuthenticationClock, state.clockPolicy),\n          Effect.mapError((cause) => PersistenceMappingError.make({ operation: \"decode\", cause })),\n        ),\n      });\n  });\n\n  const snapshotCondition = (intent: SessionStepUpIntent, snapshot: string) =>\n    sql.and([\n      state.exact(pending.table, pending.p.snapshot, snapshot),\n      sql`${tables.expression(mapping.clock.toMillis(pending.table.column(pending.p.expiresAt)))} = ${DateTime.toEpochMillis(intent.expiresAt)}`,\n      sql`${pending.table.column(pending.p.attemptLimit)} = ${pending.table.value(pending.p.attemptLimit, intent.attemptLimit)}`,\n    ]);\n\n  const sessionStepUpPersistence: SessionStepUpPersistence<Claims> = {\n    create: (input, _now, project) =>\n      native(\n        Effect.gen(function* () {\n          const current = yield* state.read(input.revision.subjectId, true);\n\n          if (current === undefined || !sameSessionRevision(current.revision, input.revision))\n            return yield* StaleAuthentication.make({});\n          const original = yield* source(input, current.now);\n\n          if (original === undefined) return yield* StaleAuthentication.make({});\n\n          const version = yield* allocateSessionValue(\n            \"interactive\",\n            mapping.pending.allocateVersion,\n            mapping.pending.allocateVersionSync,\n          );\n\n          const intent = { ...input, version },\n            snapshot = yield* encodeStepUpIntent(intent);\n\n          yield* state.guardPolicy(current);\n          const condition = sql`${state.authorityCondition(intent.revision, current.native)} and ${original.condition} and ${now} >= ${current.now} and ${DateTime.toEpochMillis(intent.sourceAuthenticatedAt)} <= ${now} + ${state.clockPolicy.futureToleranceMillis} and ${now} < ${DateTime.toEpochMillis(intent.expiresAt)}`;\n\n          yield* pending\n            .insert(\n              {\n                moduleId: mapping.moduleId,\n                kind: \"StepUp\",\n                digest: intent.digest,\n                version,\n                flowId: intent.flowId,\n                subjectId: current.native,\n                bindingDigest: intent.bindingDigest,\n                snapshot,\n                expiresAt: intent.expiresAt,\n                attemptLimit: intent.attemptLimit,\n              },\n              condition,\n            )\n            .pipe(\n              Effect.mapError((error) =>\n                isMappedConstraintConflict(mapping.isConstraintConflict, error)\n                  ? SessionConflict.make({})\n                  : error,\n              ),\n            );\n          yield* final(\n            \"session-step-up-issuance\",\n            sql`${condition} and exists(select 1 from ${pending.table.name} where ${pending.predicate(pending.table, \"StepUp\", intent.digest)} and ${state.exact(pending.table, pending.p.version, version)} and ${snapshotCondition(intent, snapshot)})`,\n          );\n\n          return yield* prepareNativeSession(intent, project);\n        }),\n      ),\n    read: ({ digest }) =>\n      executor\n        .read(\n          Effect.gen(function* () {\n            const selected = yield* readPending(\"StepUp\", digest);\n\n            if (selected === undefined) return undefined;\n\n            const intent = yield* decode(selected.record),\n              current = selected.authority;\n\n            if (\n              !sameSessionRevision(current.revision, intent.revision) ||\n              !(yield* stepUpIntentLive(\n                intent,\n                mapping.source.kind,\n                DateTime.makeUnsafe(current.now),\n              ))\n            )\n              return undefined;\n\n            // The detached source stays original. Its live digest and metadata\n            // are rechecked by complete before any replacement is committed.\n            return { intent, requirement: current.requirement };\n          }),\n        )\n        .pipe(\n          Effect.provideService(AuthenticationClock, state.clockPolicy),\n          Effect.flatMap((value) =>\n            value === undefined\n              ? Effect.fail(SessionStepUpInvalid.make({}))\n              : Effect.succeed(value),\n          ),\n        ),\n    reject: ({ digest }, project) =>\n      native(\n        Effect.gen(function* () {\n          yield* pending.reject(\"StepUp\", digest);\n\n          return yield* prepareNativeSession({ _tag: \"Rejected\" } as const, project);\n        }),\n        \"statement\",\n      ),\n    complete: (plan, project) =>\n      native(\n        Effect.gen(function* () {\n          yield* validateStepUpPlan(plan);\n          const { intent, evidence, replacement } = plan;\n          const current = yield* state.read(intent.revision.subjectId, true);\n\n          if (\n            current === undefined ||\n            !sameSessionRevision(current.revision, evidence.revision) ||\n            !sameSessionRevision(current.revision, intent.revision)\n          )\n            return yield* StaleAuthentication.make({});\n          const original = yield* source(intent, current.now);\n\n          if (original === undefined) return yield* SessionStepUpInvalid.make({});\n          if (plan.source.guard._tag === \"Stateful\") {\n            if (\n              original.record === undefined ||\n              original.record.digest !== plan.source.guard.digest ||\n              !sameSessionRecord(original.record, {\n                ...plan.source.inspection.session,\n                provenance: plan.source.inspection.provenance,\n                credentialVersion: plan.source.inspection.credentialVersion,\n                digest: plan.source.guard.digest,\n              })\n            )\n              return yield* SessionStepUpInvalid.make({});\n          }\n\n          const prepared = yield* sessionEvidenceDeadline(\n              evidence,\n              plan.baseRequirement,\n              current.now,\n            ),\n            base = yield* sessionEvidenceDeadline(evidence, current.requirement, current.now),\n            profile = yield* sessionEvidenceDeadline(evidence, intent.requirement, current.now);\n\n          const deadline = Math.min(\n            prepared.validUntil,\n            base.validUntil,\n            profile.validUntil,\n            DateTime.toEpochMillis(intent.expiresAt),\n            DateTime.toEpochMillis(replacement.inspection.session.expiresAt),\n          );\n\n          if (\n            current.now >= deadline ||\n            DateTime.toEpochMillis(replacement.inspection.session.issuedAt) - current.now >\n              state.clockPolicy.futureToleranceMillis ||\n            DateTime.toEpochMillis(replacement.inspection.session.expiresAt) >\n              DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt)\n          )\n            return yield* SessionStepUpInvalid.make({});\n          const snapshot = yield* encodeStepUpIntent(intent);\n\n          yield* state.guardPolicy(current);\n          const authority = sql`${state.authorityCondition(evidence.revision, current.native)} and ${now} >= ${current.now} and ${now} < ${deadline}`;\n\n          yield* pending.consume(\n            \"StepUp\",\n            intent,\n            current.native,\n            sql`${snapshotCondition(intent, snapshot)} and ${authority} and ${original.condition}`,\n          );\n          let replacementCondition: Fragment = sql`1 = 1`;\n          let replacementRecord: StatefulSessionRecord<Claims> | undefined;\n\n          if (replacement._tag === \"Stateful\" && mapping.source.kind === \"Stateful\") {\n            sessionInvariant(records !== undefined && original.record !== undefined);\n\n            const next: StatefulSessionRecord<Claims> = {\n              ...replacement.inspection.session,\n              digest: replacement.nextDigest,\n              credentialVersion: replacement.inspection.credentialVersion,\n              provenance: replacement.inspection.provenance,\n            };\n\n            if (\n              next.digest === original.record.digest ||\n              next.credentialVersion === original.record.credentialVersion\n            )\n              return yield* SessionStepUpInvalid.make({});\n            const { s, table } = records;\n\n            const values = {\n              ...s.encodeRotation(next),\n              [s.digest]: next.digest,\n              [s.issuedAt]: s.encodeInstant(next.issuedAt),\n              [s.expiresAt]: s.encodeInstant(next.expiresAt),\n              [s.absoluteExpiresAt]: s.encodeInstant(next.absoluteExpiresAt),\n              [s.securityRevision]: next.securityRevision,\n            };\n\n            yield* pending.stage(\n              sql`${table.update(values)} where ${yield* records.owner(original.record)} and ${records.live(table)} and ${authority}`,\n              1,\n            );\n            replacementCondition = sql`exists(select 1 from ${table.name} where ${yield* records.owner(next)} and ${records.encodedCondition(values)} and ${records.live(table)})`;\n            replacementRecord = next;\n          } else if (\n            replacement._tag === \"StateAssistedSigned\" &&\n            mapping.source.kind === \"StateAssistedSigned\"\n          ) {\n            const t = mapping.source.tombstone,\n              table = tables(t.table),\n              session = yield* mapping.source.sessionId.toNative(intent.sourceSessionId);\n\n            const values = {\n              ...t.encodeInsert({\n                moduleId: mapping.moduleId,\n                subjectId: current.native,\n                sessionId: session,\n                absoluteExpiresAt: intent.sourceAbsoluteExpiresAt,\n              }),\n              [t.moduleId]: mapping.moduleId,\n              [t.subjectId]: current.native,\n              [t.sessionId]: session,\n              [t.absoluteExpiresAt]: t.encodeInstant(intent.sourceAbsoluteExpiresAt),\n            };\n\n            yield* pending.stage(\n              conditionalInsert(table, values, sql`${authority} and ${original.condition}`),\n              1,\n            );\n            replacementCondition = sql`exists(select 1 from ${table.name} where ${state.exact(table, t.moduleId, mapping.moduleId)} and ${state.id(table, t.subjectId, current.native)} and ${state.id(table, t.sessionId, session)} and ${tables.expression(mapping.clock.toMillis(table.column(t.absoluteExpiresAt)))} >= ${DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt)})`;\n          } else if (\n            replacement._tag !== \"StatelessSigned\" ||\n            mapping.source.kind !== \"StatelessSigned\"\n          )\n            return yield* SessionStepUpInvalid.make({});\n          yield* final(\n            \"session-step-up-completion\",\n            sql`${authority} and ${pending.consumedCondition(\"StepUp\", intent, current.native)} and ${replacementCondition}`,\n          );\n          if (batch === undefined && Option.isSome(external))\n            yield* registerSqlPostcondition({\n              name: \"session-step-up-current-policy\",\n              check: Effect.gen(function* () {\n                const actual = yield* state.read(intent.revision.subjectId);\n\n                sessionInvariant(\n                  actual !== undefined && sameSessionRevision(actual.revision, evidence.revision),\n                );\n                yield* sessionEvidenceDeadline(evidence, plan.baseRequirement, actual.now);\n                yield* sessionEvidenceDeadline(evidence, actual.requirement, actual.now);\n                yield* sessionEvidenceDeadline(evidence, intent.requirement, actual.now);\n                if (replacementRecord !== undefined && records !== undefined) {\n                  const row = yield* records.read(replacementRecord.digest);\n\n                  sessionInvariant(row !== undefined && sameSessionRecord(row, replacementRecord));\n                }\n              }).pipe(\n                Effect.provideService(AuthenticationClock, state.clockPolicy),\n                Effect.mapError((cause) =>\n                  PersistenceMappingError.make({ operation: \"decode\", cause }),\n                ),\n              ),\n            });\n\n          return yield* prepareNativeSession(replacement.inspection, project);\n        }),\n      ),\n  };\n\n  return { sessionStepUpPersistence };\n});\n"],"mappings":";;;;;;;;;;;;;;AA4DA,MAAa,kCAAkC,OAAO,WAAW,WAC/D,QACA,SAKA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,EACJ,OACA,SACA,MAAM,gBACJ,OAAO,+BAA+B,QAAQ,SAAS,UAAU,KAAA,CAAS;CAE9E,MAAM,oBAAoB,OAAO,yBAAyB;CAE1D,MAAM,UACJ,QAAQ,OAAO,SAAS,aACpB,OAAO,yBAAyB,QAAQ;EAAE,GAAG;EAAS,GAAG,QAAQ;CAAO,CAAC,IACzE,KAAA;CAEN,MAAM,WAAW,OAAO,sBAAsB,kBAAkB,GAC9D,WAAW,OAAO,OAAO,cAAc,gBAAgB;CAEzD,MAAM,EAAE,KAAK,QAAQ;CAErB,MAAM,UACJ,MACA,OAAoC,mBAEnC,UAAU,KAAA,IACP,SAAS,UAAU,0BAA0B,IAAI,GAAG,IAAI,IACxD,SACG,eAAe,0BAA0B,IAAI,CAAC,CAAC,CAC/C,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC,EAAA,CACtD,KAAK,OAAO,eAAe,qBAAqB,MAAM,WAAW,CAAC;CAEtE,MAAM,SAAS,OAAO,WAAW,WAAW,QAA8B;EACxE,MAAM,SAAS,OAAO,mBAAmB,OAAO,QAAQ;EAExD,iBACE,OAAO,WAAW,OAAO,UACvB,OAAO,YAAY,OAAO,WAC1B,OAAO,WAAW,OAAO,UACzB,OAAO,kBAAkB,OAAO,iBAChC,OAAO,SAAS,cAAc,OAAO,aACrC,SAAS,cAAc,OAAO,SAAS,MAAM,OAAO,mBACpD,OAAO,iBAAiB,OAAO,YACnC;EAEA,OAAO;CACT,CAAC;CAED,MAAM,SAAS,OAAO,WAAW,WAC/B,QACA,SACA;EACA,IAAI,EAAE,OAAO,iBAAiB,QAAQ,QAAQ,OAAO,MAAM,SAAS,WAAW,OAAO,CAAC,IACrF,OAAO,KAAA;EACT,MAAM,UAAU,OAAO,QAAQ,UAAU,SAAS,OAAO,SAAS,SAAS;EAE3E,IAAI,QAAQ,OAAO,SAAS,YAAY;GACtC,iBAAiB,YAAY,KAAA,CAAS;GAEtC,MAAM,gBAAgB,OAAO,QAAQ,OAAO,UAAU,SAAS,OAAO,eAAe,GACnF,EAAE,GAAG,UAAU;GAEjB,MAAM,OACJ,OAAO,GAAG,UAAU,MAAM,OAAO,SAAS,EAAE,QAAQ,MAAM,KAAK,SAAS,MAAM,GAAG,OAAO,EAAE,WAAW,OAAO,EAAE,OAAO,MAAM,GAAG,OAAO,EAAE,WAAW,aAAa,EAAE,OAAO,QAAQ,KAAK,KAAK,EAAE;GAE9L,iBAAiB,KAAK,UAAU,CAAC;GACjC,IAAI,KAAK,OAAO,KAAA,GAAW,OAAO,KAAA;GAClC,MAAM,SAAS,OAAO,QAAQ,OAAO,MAAM,OAAO,KAAK,IAAI,SAAS,CAAC;GAErE,IACE,OAAO,sBAAsB,OAAO,2BACpC,OAAO,cAAc,OAAO,SAAS,aACrC,OAAO,cAAc,OAAO,mBAC5B,OAAO,qBAAqB,OAAO,SAAS,oBAC5C,SAAS,cAAc,OAAO,UAAU,eAAe,MACrD,SAAS,cAAc,OAAO,qBAAqB,KACrD,SAAS,cAAc,OAAO,SAAS,MACrC,SAAS,cAAc,OAAO,eAAe,KAC/C,SAAS,cAAc,OAAO,iBAAiB,MAC7C,SAAS,cAAc,OAAO,uBAAuB,GAEvD,OAAO,KAAA;GAET,OAAO;IACL;IACA,WAAW,GAAG,wBAAwB,MAAM,KAAK,SAAS,OAAO,QAAQ,MAAM,MAAM,EAAE,OAAO,QAAQ,KAAK,KAAK,EAAE;GACpH;EACF;EACA,IAAI,QAAQ,OAAO,SAAS,uBAAuB;GACjD,MAAM,IAAI,QAAQ,OAAO,WACvB,QAAQ,OAAO,EAAE,KAAK,GACtB,UAAU,OAAO,QAAQ,OAAO,UAAU,SAAS,OAAO,eAAe;GAE3E,MAAM,YAAY,GAAG,4BAA4B,MAAM,KAAK,SAAS,MAAM,MAAM,OAAO,EAAE,UAAU,QAAQ,QAAQ,EAAE,OAAO,MAAM,GAAG,OAAO,EAAE,WAAW,OAAO,EAAE,OAAO,MAAM,GAAG,OAAO,EAAE,WAAW,OAAO,EAAE;GAEhN,KAAK,OAAO,GAAG,kBAAkB,YAAA,CAAa,WAAW,GAAG,OAAO,KAAA;GAEnE,OAAO;IAAE,QAAQ,KAAA;IAAW;GAAU;EACxC;EAEA,OAAO;GAAE,QAAQ,KAAA;GAAW,WAAW,GAAG;EAAQ;CACpD,CAAC;CAED,MAAM,QAAQ,OAAO,WAAW,WAAW,MAAc,WAAqB;EAC5E,IAAI,UAAU,KAAA,GACZ,OAAO,8BAA8B;GAAE;GAAM,WAAW,kBAAkB,KAAK,SAAS;EAAE,CAAC;OACxF,IAAI,OAAO,OAAO,QAAQ,GAC7B,OAAO,yBAAyB;GAC9B;GACA,OAAO,OAAO,IAAI,aAAa;IAC7B,kBAAkB,OAAO,GAAG,kBAAkB,YAAA,CAAa,WAAW,CAAC;GACzE,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,qBAAqB,MAAM,WAAW,GAC5D,OAAO,UAAU,UAAU,wBAAwB,KAAK;IAAE,WAAW;IAAU;GAAM,CAAC,CAAC,CACzF;EACF,CAAC;CACL,CAAC;CAED,MAAM,qBAAqB,QAA6B,aACtD,IAAI,IAAI;EACN,MAAM,MAAM,QAAQ,OAAO,QAAQ,EAAE,UAAU,QAAQ;EACvD,GAAG,GAAG,OAAO,WAAW,QAAQ,MAAM,SAAS,QAAQ,MAAM,OAAO,QAAQ,EAAE,SAAS,CAAC,CAAC,EAAE,KAAK,SAAS,cAAc,OAAO,SAAS;EACvI,GAAG,GAAG,QAAQ,MAAM,OAAO,QAAQ,EAAE,YAAY,EAAE,KAAK,QAAQ,MAAM,MAAM,QAAQ,EAAE,cAAc,OAAO,YAAY;CACzH,CAAC;CAyQH,OAAO,EAAE,0BAAA;EAtQP,SAAS,OAAO,MAAM,YACpB,OACE,OAAO,IAAI,aAAa;GACtB,MAAM,UAAU,OAAO,MAAM,KAAK,MAAM,SAAS,WAAW,IAAI;GAEhE,IAAI,YAAY,KAAA,KAAa,CAAC,oBAAoB,QAAQ,UAAU,MAAM,QAAQ,GAChF,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;GAC3C,MAAM,WAAW,OAAO,OAAO,OAAO,QAAQ,GAAG;GAEjD,IAAI,aAAa,KAAA,GAAW,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;GAErE,MAAM,UAAU,OAAO,qBACrB,eACA,QAAQ,QAAQ,iBAChB,QAAQ,QAAQ,mBAClB;GAEA,MAAM,SAAS;IAAE,GAAG;IAAO;GAAQ,GACjC,WAAW,OAAO,mBAAmB,MAAM;GAE7C,OAAO,MAAM,YAAY,OAAO;GAChC,MAAM,YAAY,GAAG,GAAG,MAAM,mBAAmB,OAAO,UAAU,QAAQ,MAAM,EAAE,OAAO,SAAS,UAAU,OAAO,IAAI,MAAM,QAAQ,IAAI,OAAO,SAAS,cAAc,OAAO,qBAAqB,EAAE,MAAM,IAAI,KAAK,MAAM,YAAY,sBAAsB,OAAO,IAAI,KAAK,SAAS,cAAc,OAAO,SAAS;GAEnT,OAAO,QACJ,OACC;IACE,UAAU,QAAQ;IAClB,MAAM;IACN,QAAQ,OAAO;IACf;IACA,QAAQ,OAAO;IACf,WAAW,QAAQ;IACnB,eAAe,OAAO;IACtB;IACA,WAAW,OAAO;IAClB,cAAc,OAAO;GACvB,GACA,SACF,CAAC,CACA,KACC,OAAO,UAAU,UACf,2BAA2B,QAAQ,sBAAsB,KAAK,IAC1D,gBAAgB,KAAK,CAAC,CAAC,IACvB,KACN,CACF;GACF,OAAO,MACL,4BACA,GAAG,GAAG,UAAU,4BAA4B,QAAQ,MAAM,KAAK,SAAS,QAAQ,UAAU,QAAQ,OAAO,UAAU,OAAO,MAAM,EAAE,OAAO,MAAM,MAAM,QAAQ,OAAO,QAAQ,EAAE,SAAS,OAAO,EAAE,OAAO,kBAAkB,QAAQ,QAAQ,EAAE,EAC7O;GAEA,OAAO,OAAO,qBAAqB,QAAQ,OAAO;EACpD,CAAC,CACH;EACF,OAAO,EAAE,aACP,SACG,KACC,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,OAAO,YAAY,UAAU,MAAM;GAEpD,IAAI,aAAa,KAAA,GAAW,OAAO,KAAA;GAEnC,MAAM,SAAS,OAAO,OAAO,SAAS,MAAM,GAC1C,UAAU,SAAS;GAErB,IACE,CAAC,oBAAoB,QAAQ,UAAU,OAAO,QAAQ,KACtD,EAAE,OAAO,iBACP,QACA,QAAQ,OAAO,MACf,SAAS,WAAW,QAAQ,GAAG,CACjC,IAEA,OAAO,KAAA;GAIT,OAAO;IAAE;IAAQ,aAAa,QAAQ;GAAY;EACpD,CAAC,CACH,CAAC,CACA,KACC,OAAO,eAAe,qBAAqB,MAAM,WAAW,GAC5D,OAAO,SAAS,UACd,UAAU,KAAA,IACN,OAAO,KAAK,qBAAqB,KAAK,CAAC,CAAC,CAAC,IACzC,OAAO,QAAQ,KAAK,CAC1B,CACF;EACJ,SAAS,EAAE,UAAU,YACnB,OACE,OAAO,IAAI,aAAa;GACtB,OAAO,QAAQ,OAAO,UAAU,MAAM;GAEtC,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAY,OAAO;EAC3E,CAAC,GACD,WACF;EACF,WAAW,MAAM,YACf,OACE,OAAO,IAAI,aAAa;GACtB,OAAO,mBAAmB,IAAI;GAC9B,MAAM,EAAE,QAAQ,UAAU,gBAAgB;GAC1C,MAAM,UAAU,OAAO,MAAM,KAAK,OAAO,SAAS,WAAW,IAAI;GAEjE,IACE,YAAY,KAAA,KACZ,CAAC,oBAAoB,QAAQ,UAAU,SAAS,QAAQ,KACxD,CAAC,oBAAoB,QAAQ,UAAU,OAAO,QAAQ,GAEtD,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;GAC3C,MAAM,WAAW,OAAO,OAAO,QAAQ,QAAQ,GAAG;GAElD,IAAI,aAAa,KAAA,GAAW,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;GACtE,IAAI,KAAK,OAAO,MAAM,SAAS,YAE3B;QAAA,SAAS,WAAW,KAAA,KACpB,SAAS,OAAO,WAAW,KAAK,OAAO,MAAM,UAC7C,CAAC,kBAAkB,SAAS,QAAQ;KAClC,GAAG,KAAK,OAAO,WAAW;KAC1B,YAAY,KAAK,OAAO,WAAW;KACnC,mBAAmB,KAAK,OAAO,WAAW;KAC1C,QAAQ,KAAK,OAAO,MAAM;IAC5B,CAAC,GAED,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;GAAA;GAG9C,MAAM,WAAW,OAAO,wBACpB,UACA,KAAK,iBACL,QAAQ,GACV,GACA,OAAO,OAAO,wBAAwB,UAAU,QAAQ,aAAa,QAAQ,GAAG,GAChF,UAAU,OAAO,wBAAwB,UAAU,OAAO,aAAa,QAAQ,GAAG;GAEpF,MAAM,WAAW,KAAK,IACpB,SAAS,YACT,KAAK,YACL,QAAQ,YACR,SAAS,cAAc,OAAO,SAAS,GACvC,SAAS,cAAc,YAAY,WAAW,QAAQ,SAAS,CACjE;GAEA,IACE,QAAQ,OAAO,YACf,SAAS,cAAc,YAAY,WAAW,QAAQ,QAAQ,IAAI,QAAQ,MACxE,MAAM,YAAY,yBACpB,SAAS,cAAc,YAAY,WAAW,QAAQ,SAAS,IAC7D,SAAS,cAAc,OAAO,uBAAuB,GAEvD,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;GAC5C,MAAM,WAAW,OAAO,mBAAmB,MAAM;GAEjD,OAAO,MAAM,YAAY,OAAO;GAChC,MAAM,YAAY,GAAG,GAAG,MAAM,mBAAmB,SAAS,UAAU,QAAQ,MAAM,EAAE,OAAO,IAAI,MAAM,QAAQ,IAAI,OAAO,IAAI,KAAK;GAEjI,OAAO,QAAQ,QACb,UACA,QACA,QAAQ,QACR,GAAG,GAAG,kBAAkB,QAAQ,QAAQ,EAAE,OAAO,UAAU,OAAO,SAAS,WAC7E;GACA,IAAI,uBAAiC,GAAG;GACxC,IAAI;GAEJ,IAAI,YAAY,SAAS,cAAc,QAAQ,OAAO,SAAS,YAAY;IACzE,iBAAiB,YAAY,KAAA,KAAa,SAAS,WAAW,KAAA,CAAS;IAEvE,MAAM,OAAsC;KAC1C,GAAG,YAAY,WAAW;KAC1B,QAAQ,YAAY;KACpB,mBAAmB,YAAY,WAAW;KAC1C,YAAY,YAAY,WAAW;IACrC;IAEA,IACE,KAAK,WAAW,SAAS,OAAO,UAChC,KAAK,sBAAsB,SAAS,OAAO,mBAE3C,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;IAC5C,MAAM,EAAE,GAAG,UAAU;IAErB,MAAM,SAAS;KACb,GAAG,EAAE,eAAe,IAAI;MACvB,EAAE,SAAS,KAAK;MAChB,EAAE,WAAW,EAAE,cAAc,KAAK,QAAQ;MAC1C,EAAE,YAAY,EAAE,cAAc,KAAK,SAAS;MAC5C,EAAE,oBAAoB,EAAE,cAAc,KAAK,iBAAiB;MAC5D,EAAE,mBAAmB,KAAK;IAC7B;IAEA,OAAO,QAAQ,MACb,GAAG,GAAG,MAAM,OAAO,MAAM,EAAE,SAAS,OAAO,QAAQ,MAAM,SAAS,MAAM,EAAE,OAAO,QAAQ,KAAK,KAAK,EAAE,OAAO,aAC5G,CACF;IACA,uBAAuB,GAAG,wBAAwB,MAAM,KAAK,SAAS,OAAO,QAAQ,MAAM,IAAI,EAAE,OAAO,QAAQ,iBAAiB,MAAM,EAAE,OAAO,QAAQ,KAAK,KAAK,EAAE;IACpK,oBAAoB;GACtB,OAAO,IACL,YAAY,SAAS,yBACrB,QAAQ,OAAO,SAAS,uBACxB;IACA,MAAM,IAAI,QAAQ,OAAO,WACvB,QAAQ,OAAO,EAAE,KAAK,GACtB,UAAU,OAAO,QAAQ,OAAO,UAAU,SAAS,OAAO,eAAe;IAE3E,MAAM,SAAS;KACb,GAAG,EAAE,aAAa;MAChB,UAAU,QAAQ;MAClB,WAAW,QAAQ;MACnB,WAAW;MACX,mBAAmB,OAAO;KAC5B,CAAC;MACA,EAAE,WAAW,QAAQ;MACrB,EAAE,YAAY,QAAQ;MACtB,EAAE,YAAY;MACd,EAAE,oBAAoB,EAAE,cAAc,OAAO,uBAAuB;IACvE;IAEA,OAAO,QAAQ,MACb,kBAAkB,OAAO,QAAQ,GAAG,GAAG,UAAU,OAAO,SAAS,WAAW,GAC5E,CACF;IACA,uBAAuB,GAAG,wBAAwB,MAAM,KAAK,SAAS,MAAM,MAAM,OAAO,EAAE,UAAU,QAAQ,QAAQ,EAAE,OAAO,MAAM,GAAG,OAAO,EAAE,WAAW,QAAQ,MAAM,EAAE,OAAO,MAAM,GAAG,OAAO,EAAE,WAAW,OAAO,EAAE,OAAO,OAAO,WAAW,QAAQ,MAAM,SAAS,MAAM,OAAO,EAAE,iBAAiB,CAAC,CAAC,EAAE,MAAM,SAAS,cAAc,OAAO,uBAAuB,EAAE;GAC3W,OAAO,IACL,YAAY,SAAS,qBACrB,QAAQ,OAAO,SAAS,mBAExB,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;GAC5C,OAAO,MACL,8BACA,GAAG,GAAG,UAAU,OAAO,QAAQ,kBAAkB,UAAU,QAAQ,QAAQ,MAAM,EAAE,OAAO,sBAC5F;GACA,IAAI,UAAU,KAAA,KAAa,OAAO,OAAO,QAAQ,GAC/C,OAAO,yBAAyB;IAC9B,MAAM;IACN,OAAO,OAAO,IAAI,aAAa;KAC7B,MAAM,SAAS,OAAO,MAAM,KAAK,OAAO,SAAS,SAAS;KAE1D,iBACE,WAAW,KAAA,KAAa,oBAAoB,OAAO,UAAU,SAAS,QAAQ,CAChF;KACA,OAAO,wBAAwB,UAAU,KAAK,iBAAiB,OAAO,GAAG;KACzE,OAAO,wBAAwB,UAAU,OAAO,aAAa,OAAO,GAAG;KACvE,OAAO,wBAAwB,UAAU,OAAO,aAAa,OAAO,GAAG;KACvE,IAAI,sBAAsB,KAAA,KAAa,YAAY,KAAA,GAAW;MAC5D,MAAM,MAAM,OAAO,QAAQ,KAAK,kBAAkB,MAAM;MAExD,iBAAiB,QAAQ,KAAA,KAAa,kBAAkB,KAAK,iBAAiB,CAAC;KACjF;IACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,qBAAqB,MAAM,WAAW,GAC5D,OAAO,UAAU,UACf,wBAAwB,KAAK;KAAE,WAAW;KAAU;IAAM,CAAC,CAC7D,CACF;GACF,CAAC;GAEH,OAAO,OAAO,qBAAqB,YAAY,YAAY,OAAO;EACpE,CAAC,CACH;CAG4B,EAAE;AACpC,CAAC"}

package/dist/internal/session-native-validity.mjs

@@ -8,9 +8,11 @@ import { allocateSessionValue } from "./session-policy.mjs";
 import { DateTime, Effect, Option } from "effect";
 import { SessionInvalid, StaleAuthentication } from "@yielded/auth/Sessions";
 import { SqlClient } from "effect/sql/SqlClient";
+import { AuthenticationClock } from "@yielded/auth/Operations";
 //#region src/internal/session-native-validity.ts
 const makeNativeSignedSessionValidityServices = Effect.fnUntraced(function* (tables, mapping) {
 	const batch = yield* SqlBatchCommit;
+	const { futureToleranceMillis } = yield* AuthenticationClock;
 	const sql = (yield* SqlClient).withoutTransforms(), executor = yield* makeSqlCommitExecutor(sessionUnavailable);
 	const external = yield* Effect.serviceOption(CurrentSqlCommit);
 	const s = mapping.subject, t = mapping.tombstone, subject = tables(s.table), tombstone = tables(t.table), now = tables.expression(mapping.clock.engineNowMillis);
@@ -48,7 +50,7 @@ const makeNativeSignedSessionValidityServices = Effect.fnUntraced(function* (tab
 	return { signedSessionValidity: {
 		verify: (record) => executor.verify(Effect.gen(function* () {
 			const nativeSubject = yield* mapping.subjectId.toNative(record.subjectId), nativeSession = yield* mapping.sessionId.toNative(record.sessionId);
-			const rows = yield* sql`select ${subject.fields("subject_")} from ${subject.name} where ${id(subject, s.id, nativeSubject)} and ${id(subject, s.status, s.activeStatusValue)} and ${exact(subject, s.securityRevision, record.securityRevision)} and ${now} >= ${DateTime.toEpochMillis(record.issuedAt)} and ${now} < ${DateTime.toEpochMillis(record.expiresAt)} and ${DateTime.toEpochMillis(record.expiresAt)} <= ${DateTime.toEpochMillis(record.absoluteExpiresAt)} and not exists(select 1 from ${tombstone.name} where ${key(nativeSubject, nativeSession)}) limit 2`;
+			const rows = yield* sql`select ${subject.fields("subject_")} from ${subject.name} where ${id(subject, s.id, nativeSubject)} and ${id(subject, s.status, s.activeStatusValue)} and ${exact(subject, s.securityRevision, record.securityRevision)} and ${DateTime.toEpochMillis(record.issuedAt)} <= ${now} + ${futureToleranceMillis} and ${DateTime.toEpochMillis(record.issuedAt)} < ${DateTime.toEpochMillis(record.expiresAt)} and ${now} < ${DateTime.toEpochMillis(record.expiresAt)} and ${DateTime.toEpochMillis(record.expiresAt)} <= ${DateTime.toEpochMillis(record.absoluteExpiresAt)} and not exists(select 1 from ${tombstone.name} where ${key(nativeSubject, nativeSession)}) limit 2`;
 			sessionInvariant(rows.length <= 1);
 			if (rows[0] === void 0) return false;
 			const decoded = subject.decode(rows[0], "subject_");

package/dist/internal/session-native-validity.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"session-native-validity.mjs","names":[],"sources":["../../src/internal/session-native-validity.ts"],"sourcesContent":["import type { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport {\n  SessionInvalid,\n  StaleAuthentication,\n  type SignedSessionValidity,\n} from \"@yielded/auth/Sessions\";\nimport { DateTime, Effect, Option } from \"effect\";\nimport { SqlClient } from \"effect/sql/SqlClient\";\nimport type { Fragment } from \"effect/sql/Statement\";\n\nimport { sqlBatchAssertion } from \"./d1-planning\";\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport type { SignedSessionValidityMapping } from \"./models/session-model\";\nimport type { NativeSqlTables, SqlTable } from \"./native-sql-table\";\nimport { prepareNativeSession } from \"./session-native-pending\";\nimport {\n  normalizeSessionOperation,\n  sessionInvariant,\n  sessionUnavailable,\n} from \"./session-native-state\";\nimport { allocateSessionValue } from \"./session-policy\";\nimport { exactSqlText, executeSqlChange } from \"./sql-change\";\nimport {\n  CurrentSqlCommit,\n  makeSqlCommitExecutor,\n  SqlBatchCommit,\n  appendSqlBatchStatement,\n  registerSqlBatchPostcondition,\n  registerSqlPostcondition,\n} from \"./sql-commit\";\nimport type { AnyTableModel } from \"./table-model\";\n\nexport type NativeSignedSessionValidityMapping = SignedSessionValidityMapping<\n  AnyTableModel,\n  AnyTableModel,\n  unknown,\n  unknown\n>;\n\nexport const makeNativeSignedSessionValidityServices = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: NativeSignedSessionValidityMapping,\n): Effect.fn.Return<\n  { readonly signedSessionValidity: SignedSessionValidity },\n  never,\n  SqlClient | LifecycleHooks | SqlBatchCommit\n> {\n  const batch = yield* SqlBatchCommit;\n\n  const sql = (yield* SqlClient).withoutTransforms(),\n    executor = yield* makeSqlCommitExecutor(sessionUnavailable);\n\n  const external = yield* Effect.serviceOption(CurrentSqlCommit);\n\n  const s = mapping.subject,\n    t = mapping.tombstone,\n    subject = tables(s.table),\n    tombstone = tables(t.table),\n    now = tables.expression(mapping.clock.engineNowMillis);\n\n  const id = (table: SqlTable, key: string, value: unknown) =>\n    sql`${table.column(key)} = ${table.value(key, value)}`;\n\n  const exact = (table: SqlTable, key: string, value: unknown) =>\n    exactSqlText(sql, table.column(key), table.value(key, value));\n\n  const key = (nativeSubject: unknown, nativeSession: unknown) =>\n    sql.and([\n      exact(tombstone, t.moduleId, mapping.moduleId),\n      id(tombstone, t.subjectId, nativeSubject),\n      id(tombstone, t.sessionId, nativeSession),\n    ]);\n\n  const native = <A, E, R>(work: Effect.Effect<A, E, R>) =>\n    batch === undefined\n      ? executor.operation(normalizeSessionOperation(work), \"statement\")\n      : executor\n          .operationBatch(normalizeSessionOperation(work))\n          .pipe(Effect.provideService(SqlBatchCommit, batch));\n\n  const stage = Effect.fnUntraced(function* (statement: Fragment, expected?: number) {\n    if (batch !== undefined) {\n      yield* appendSqlBatchStatement(sql`${statement}`);\n      if (expected !== undefined)\n        yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = ${expected}`));\n\n      return expected;\n    }\n\n    return yield* executeSqlChange(sql, statement);\n  });\n\n  const final = Effect.fnUntraced(function* (name: string, condition: Fragment) {\n    if (batch !== undefined)\n      yield* registerSqlBatchPostcondition({ name, statement: sqlBatchAssertion(sql, condition) });\n    else if (Option.isSome(external))\n      yield* registerSqlPostcondition({\n        name,\n        check: Effect.gen(function* () {\n          sessionInvariant((yield* sql`select 1 where ${condition}`).length === 1);\n        }).pipe(\n          Effect.mapError((cause) => PersistenceMappingError.make({ operation: \"decode\", cause })),\n        ),\n      });\n  });\n\n  const signedSessionValidity: SignedSessionValidity = {\n    verify: (record) =>\n      executor\n        .verify(\n          Effect.gen(function* () {\n            const nativeSubject = yield* mapping.subjectId.toNative(record.subjectId),\n              nativeSession = yield* mapping.sessionId.toNative(record.sessionId);\n\n            const rows =\n              yield* sql`select ${subject.fields(\"subject_\")} from ${subject.name} where ${id(subject, s.id, nativeSubject)} and ${id(subject, s.status, s.activeStatusValue)} and ${exact(subject, s.securityRevision, record.securityRevision)} and ${now} >= ${DateTime.toEpochMillis(record.issuedAt)} and ${now} < ${DateTime.toEpochMillis(record.expiresAt)} and ${DateTime.toEpochMillis(record.expiresAt)} <= ${DateTime.toEpochMillis(record.absoluteExpiresAt)} and not exists(select 1 from ${tombstone.name} where ${key(nativeSubject, nativeSession)}) limit 2`;\n\n            sessionInvariant(rows.length <= 1);\n            if (rows[0] === undefined) return false;\n            const decoded = subject.decode(rows[0], \"subject_\");\n\n            sessionInvariant(\n              (yield* mapping.subjectId.toSubject(decoded[s.id])) === record.subjectId &&\n                s.isActiveStatus(decoded[s.status]),\n            );\n\n            return true;\n          }),\n        )\n        .pipe(\n          Effect.flatMap((valid) => (valid ? Effect.void : Effect.fail(SessionInvalid.make({})))),\n        ),\n    revoke: (input, project) =>\n      native(\n        Effect.gen(function* () {\n          const nativeSubject = yield* mapping.subjectId.toNative(input.subjectId),\n            nativeSession = yield* mapping.sessionId.toNative(input.sessionId);\n\n          const row = {\n            ...t.encodeInsert({\n              moduleId: mapping.moduleId,\n              subjectId: nativeSubject,\n              sessionId: nativeSession,\n              absoluteExpiresAt: input.absoluteExpiresAt,\n            }),\n            [t.moduleId]: mapping.moduleId,\n            [t.subjectId]: nativeSubject,\n            [t.sessionId]: nativeSession,\n            [t.absoluteExpiresAt]: t.encodeInstant(input.absoluteExpiresAt),\n          };\n\n          const expiry = tables.expression(\n            mapping.clock.toMillis(tombstone.column(t.absoluteExpiresAt)),\n          );\n\n          const next = DateTime.toEpochMillis(input.absoluteExpiresAt);\n          const longest = sql`case when ${expiry} >= ${next} then ${tombstone.column(t.absoluteExpiresAt)} else ${tombstone.value(t.absoluteExpiresAt, row[t.absoluteExpiresAt])} end`;\n          const insert = tombstone.insert(row);\n\n          const statement = sql.onDialectOrElse({\n            mysql: () =>\n              sql`${insert} on duplicate key update ${tombstone.columnName(t.absoluteExpiresAt)} = ${longest}`,\n            orElse: () =>\n              sql`${insert} on conflict (${tombstone.columnName(t.moduleId)}, ${tombstone.columnName(t.subjectId)}, ${tombstone.columnName(t.sessionId)}) do update set ${tombstone.columnName(t.absoluteExpiresAt)} = ${longest}`,\n          });\n\n          yield* stage(statement);\n          yield* final(\n            \"assisted-session-revocation\",\n            sql`exists(select 1 from ${tombstone.name} where ${key(nativeSubject, nativeSession)} and ${expiry} >= ${next})`,\n          );\n\n          return yield* prepareNativeSession(undefined, project);\n        }),\n      ),\n    revokeAll: (input, project) =>\n      native(\n        Effect.gen(function* () {\n          const nativeSubject = yield* mapping.subjectId.toNative(input.subjectId);\n\n          const next = yield* allocateSessionValue(\n            \"interactive\",\n            s.nextSecurityRevision?.(input.expectedSecurityRevision),\n            s.nextSecurityRevisionSync === undefined\n              ? undefined\n              : () => s.nextSecurityRevisionSync!(input.expectedSecurityRevision),\n          );\n\n          sessionInvariant(next !== input.expectedSecurityRevision);\n\n          const changed = yield* stage(\n            sql`${subject.update({ [s.securityRevision]: next })} where ${id(subject, s.id, nativeSubject)} and ${id(subject, s.status, s.activeStatusValue)} and ${exact(subject, s.securityRevision, input.expectedSecurityRevision)}`,\n            1,\n          );\n\n          if (changed !== 1) return yield* StaleAuthentication.make({});\n          yield* final(\n            \"all-assisted-session-revocation\",\n            sql`exists(select 1 from ${subject.name} where ${id(subject, s.id, nativeSubject)} and ${exact(subject, s.securityRevision, next)})`,\n          );\n\n          return yield* prepareNativeSession(undefined, project);\n        }),\n      ),\n  };\n\n  return { signedSessionValidity };\n});\n"],"mappings":";;;;;;;;;;;AAuCA,MAAa,0CAA0C,OAAO,WAAW,WACvE,QACA,SAKA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,OAAO,OAAO,UAAA,CAAW,kBAAkB,GAC/C,WAAW,OAAO,sBAAsB,kBAAkB;CAE5D,MAAM,WAAW,OAAO,OAAO,cAAc,gBAAgB;CAE7D,MAAM,IAAI,QAAQ,SAChB,IAAI,QAAQ,WACZ,UAAU,OAAO,EAAE,KAAK,GACxB,YAAY,OAAO,EAAE,KAAK,GAC1B,MAAM,OAAO,WAAW,QAAQ,MAAM,eAAe;CAEvD,MAAM,MAAM,OAAiB,KAAa,UACxC,GAAG,GAAG,MAAM,OAAO,GAAG,EAAE,KAAK,MAAM,MAAM,KAAK,KAAK;CAErD,MAAM,SAAS,OAAiB,KAAa,UAC3C,aAAa,KAAK,MAAM,OAAO,GAAG,GAAG,MAAM,MAAM,KAAK,KAAK,CAAC;CAE9D,MAAM,OAAO,eAAwB,kBACnC,IAAI,IAAI;EACN,MAAM,WAAW,EAAE,UAAU,QAAQ,QAAQ;EAC7C,GAAG,WAAW,EAAE,WAAW,aAAa;EACxC,GAAG,WAAW,EAAE,WAAW,aAAa;CAC1C,CAAC;CAEH,MAAM,UAAmB,SACvB,UAAU,KAAA,IACN,SAAS,UAAU,0BAA0B,IAAI,GAAG,WAAW,IAC/D,SACG,eAAe,0BAA0B,IAAI,CAAC,CAAC,CAC/C,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CAE1D,MAAM,QAAQ,OAAO,WAAW,WAAW,WAAqB,UAAmB;EACjF,IAAI,UAAU,KAAA,GAAW;GACvB,OAAO,wBAAwB,GAAG,GAAG,WAAW;GAChD,IAAI,aAAa,KAAA,GACf,OAAO,wBAAwB,kBAAkB,KAAK,GAAG,eAAe,UAAU,CAAC;GAErF,OAAO;EACT;EAEA,OAAO,OAAO,iBAAiB,KAAK,SAAS;CAC/C,CAAC;CAED,MAAM,QAAQ,OAAO,WAAW,WAAW,MAAc,WAAqB;EAC5E,IAAI,UAAU,KAAA,GACZ,OAAO,8BAA8B;GAAE;GAAM,WAAW,kBAAkB,KAAK,SAAS;EAAE,CAAC;OACxF,IAAI,OAAO,OAAO,QAAQ,GAC7B,OAAO,yBAAyB;GAC9B;GACA,OAAO,OAAO,IAAI,aAAa;IAC7B,kBAAkB,OAAO,GAAG,kBAAkB,YAAA,CAAa,WAAW,CAAC;GACzE,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,UAAU,wBAAwB,KAAK;IAAE,WAAW;IAAU;GAAM,CAAC,CAAC,CACzF;EACF,CAAC;CACL,CAAC;CAsGD,OAAO,EAAE,uBAAA;EAnGP,SAAS,WACP,SACG,OACC,OAAO,IAAI,aAAa;GACtB,MAAM,gBAAgB,OAAO,QAAQ,UAAU,SAAS,OAAO,SAAS,GACtE,gBAAgB,OAAO,QAAQ,UAAU,SAAS,OAAO,SAAS;GAEpE,MAAM,OACJ,OAAO,GAAG,UAAU,QAAQ,OAAO,UAAU,EAAE,QAAQ,QAAQ,KAAK,SAAS,GAAG,SAAS,EAAE,IAAI,aAAa,EAAE,OAAO,GAAG,SAAS,EAAE,QAAQ,EAAE,iBAAiB,EAAE,OAAO,MAAM,SAAS,EAAE,kBAAkB,OAAO,gBAAgB,EAAE,OAAO,IAAI,MAAM,SAAS,cAAc,OAAO,QAAQ,EAAE,OAAO,IAAI,KAAK,SAAS,cAAc,OAAO,SAAS,EAAE,OAAO,SAAS,cAAc,OAAO,SAAS,EAAE,MAAM,SAAS,cAAc,OAAO,iBAAiB,EAAE,gCAAgC,UAAU,KAAK,SAAS,IAAI,eAAe,aAAa,EAAE;GAExhB,iBAAiB,KAAK,UAAU,CAAC;GACjC,IAAI,KAAK,OAAO,KAAA,GAAW,OAAO;GAClC,MAAM,UAAU,QAAQ,OAAO,KAAK,IAAI,UAAU;GAElD,kBACG,OAAO,QAAQ,UAAU,UAAU,QAAQ,EAAE,GAAG,OAAO,OAAO,aAC7D,EAAE,eAAe,QAAQ,EAAE,OAAO,CACtC;GAEA,OAAO;EACT,CAAC,CACH,CAAC,CACA,KACC,OAAO,SAAS,UAAW,QAAQ,OAAO,OAAO,OAAO,KAAK,eAAe,KAAK,CAAC,CAAC,CAAC,CAAE,CACxF;EACJ,SAAS,OAAO,YACd,OACE,OAAO,IAAI,aAAa;GACtB,MAAM,gBAAgB,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS,GACrE,gBAAgB,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;GAEnE,MAAM,MAAM;IACV,GAAG,EAAE,aAAa;KAChB,UAAU,QAAQ;KAClB,WAAW;KACX,WAAW;KACX,mBAAmB,MAAM;IAC3B,CAAC;KACA,EAAE,WAAW,QAAQ;KACrB,EAAE,YAAY;KACd,EAAE,YAAY;KACd,EAAE,oBAAoB,EAAE,cAAc,MAAM,iBAAiB;GAChE;GAEA,MAAM,SAAS,OAAO,WACpB,QAAQ,MAAM,SAAS,UAAU,OAAO,EAAE,iBAAiB,CAAC,CAC9D;GAEA,MAAM,OAAO,SAAS,cAAc,MAAM,iBAAiB;GAC3D,MAAM,UAAU,GAAG,aAAa,OAAO,MAAM,KAAK,QAAQ,UAAU,OAAO,EAAE,iBAAiB,EAAE,QAAQ,UAAU,MAAM,EAAE,mBAAmB,IAAI,EAAE,kBAAkB,EAAE;GACvK,MAAM,SAAS,UAAU,OAAO,GAAG;GAEnC,MAAM,YAAY,IAAI,gBAAgB;IACpC,aACE,GAAG,GAAG,OAAO,2BAA2B,UAAU,WAAW,EAAE,iBAAiB,EAAE,KAAK;IACzF,cACE,GAAG,GAAG,OAAO,gBAAgB,UAAU,WAAW,EAAE,QAAQ,EAAE,IAAI,UAAU,WAAW,EAAE,SAAS,EAAE,IAAI,UAAU,WAAW,EAAE,SAAS,EAAE,kBAAkB,UAAU,WAAW,EAAE,iBAAiB,EAAE,KAAK;GAC/M,CAAC;GAED,OAAO,MAAM,SAAS;GACtB,OAAO,MACL,+BACA,GAAG,wBAAwB,UAAU,KAAK,SAAS,IAAI,eAAe,aAAa,EAAE,OAAO,OAAO,MAAM,KAAK,EAChH;GAEA,OAAO,OAAO,qBAAqB,KAAA,GAAW,OAAO;EACvD,CAAC,CACH;EACF,YAAY,OAAO,YACjB,OACE,OAAO,IAAI,aAAa;GACtB,MAAM,gBAAgB,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;GAEvE,MAAM,OAAO,OAAO,qBAClB,eACA,EAAE,uBAAuB,MAAM,wBAAwB,GACvD,EAAE,6BAA6B,KAAA,IAC3B,KAAA,UACM,EAAE,yBAA0B,MAAM,wBAAwB,CACtE;GAEA,iBAAiB,SAAS,MAAM,wBAAwB;GAOxD,KAAI,OALmB,MACrB,GAAG,GAAG,QAAQ,OAAO,GAAG,EAAE,mBAAmB,KAAK,CAAC,EAAE,SAAS,GAAG,SAAS,EAAE,IAAI,aAAa,EAAE,OAAO,GAAG,SAAS,EAAE,QAAQ,EAAE,iBAAiB,EAAE,OAAO,MAAM,SAAS,EAAE,kBAAkB,MAAM,wBAAwB,KACzN,CACF,OAEgB,GAAG,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;GAC5D,OAAO,MACL,mCACA,GAAG,wBAAwB,QAAQ,KAAK,SAAS,GAAG,SAAS,EAAE,IAAI,aAAa,EAAE,OAAO,MAAM,SAAS,EAAE,kBAAkB,IAAI,EAAE,EACpI;GAEA,OAAO,OAAO,qBAAqB,KAAA,GAAW,OAAO;EACvD,CAAC,CACH;CAGyB,EAAE;AACjC,CAAC"}
+{"version":3,"file":"session-native-validity.mjs","names":[],"sources":["../../src/internal/session-native-validity.ts"],"sourcesContent":["import type { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport { AuthenticationClock } from \"@yielded/auth/Operations\";\nimport {\n  SessionInvalid,\n  StaleAuthentication,\n  type SignedSessionValidity,\n} from \"@yielded/auth/Sessions\";\nimport { DateTime, Effect, Option } from \"effect\";\nimport { SqlClient } from \"effect/sql/SqlClient\";\nimport type { Fragment } from \"effect/sql/Statement\";\n\nimport { sqlBatchAssertion } from \"./d1-planning\";\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport type { SignedSessionValidityMapping } from \"./models/session-model\";\nimport type { NativeSqlTables, SqlTable } from \"./native-sql-table\";\nimport { prepareNativeSession } from \"./session-native-pending\";\nimport {\n  normalizeSessionOperation,\n  sessionInvariant,\n  sessionUnavailable,\n} from \"./session-native-state\";\nimport { allocateSessionValue } from \"./session-policy\";\nimport { exactSqlText, executeSqlChange } from \"./sql-change\";\nimport {\n  CurrentSqlCommit,\n  makeSqlCommitExecutor,\n  SqlBatchCommit,\n  appendSqlBatchStatement,\n  registerSqlBatchPostcondition,\n  registerSqlPostcondition,\n} from \"./sql-commit\";\nimport type { AnyTableModel } from \"./table-model\";\n\nexport type NativeSignedSessionValidityMapping = SignedSessionValidityMapping<\n  AnyTableModel,\n  AnyTableModel,\n  unknown,\n  unknown\n>;\n\nexport const makeNativeSignedSessionValidityServices = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: NativeSignedSessionValidityMapping,\n): Effect.fn.Return<\n  { readonly signedSessionValidity: SignedSessionValidity },\n  never,\n  SqlClient | LifecycleHooks | SqlBatchCommit\n> {\n  const batch = yield* SqlBatchCommit;\n  const { futureToleranceMillis } = yield* AuthenticationClock;\n\n  const sql = (yield* SqlClient).withoutTransforms(),\n    executor = yield* makeSqlCommitExecutor(sessionUnavailable);\n\n  const external = yield* Effect.serviceOption(CurrentSqlCommit);\n\n  const s = mapping.subject,\n    t = mapping.tombstone,\n    subject = tables(s.table),\n    tombstone = tables(t.table),\n    now = tables.expression(mapping.clock.engineNowMillis);\n\n  const id = (table: SqlTable, key: string, value: unknown) =>\n    sql`${table.column(key)} = ${table.value(key, value)}`;\n\n  const exact = (table: SqlTable, key: string, value: unknown) =>\n    exactSqlText(sql, table.column(key), table.value(key, value));\n\n  const key = (nativeSubject: unknown, nativeSession: unknown) =>\n    sql.and([\n      exact(tombstone, t.moduleId, mapping.moduleId),\n      id(tombstone, t.subjectId, nativeSubject),\n      id(tombstone, t.sessionId, nativeSession),\n    ]);\n\n  const native = <A, E, R>(work: Effect.Effect<A, E, R>) =>\n    batch === undefined\n      ? executor.operation(normalizeSessionOperation(work), \"statement\")\n      : executor\n          .operationBatch(normalizeSessionOperation(work))\n          .pipe(Effect.provideService(SqlBatchCommit, batch));\n\n  const stage = Effect.fnUntraced(function* (statement: Fragment, expected?: number) {\n    if (batch !== undefined) {\n      yield* appendSqlBatchStatement(sql`${statement}`);\n      if (expected !== undefined)\n        yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = ${expected}`));\n\n      return expected;\n    }\n\n    return yield* executeSqlChange(sql, statement);\n  });\n\n  const final = Effect.fnUntraced(function* (name: string, condition: Fragment) {\n    if (batch !== undefined)\n      yield* registerSqlBatchPostcondition({ name, statement: sqlBatchAssertion(sql, condition) });\n    else if (Option.isSome(external))\n      yield* registerSqlPostcondition({\n        name,\n        check: Effect.gen(function* () {\n          sessionInvariant((yield* sql`select 1 where ${condition}`).length === 1);\n        }).pipe(\n          Effect.mapError((cause) => PersistenceMappingError.make({ operation: \"decode\", cause })),\n        ),\n      });\n  });\n\n  const signedSessionValidity: SignedSessionValidity = {\n    verify: (record) =>\n      executor\n        .verify(\n          Effect.gen(function* () {\n            const nativeSubject = yield* mapping.subjectId.toNative(record.subjectId),\n              nativeSession = yield* mapping.sessionId.toNative(record.sessionId);\n\n            const rows =\n              yield* sql`select ${subject.fields(\"subject_\")} from ${subject.name} where ${id(subject, s.id, nativeSubject)} and ${id(subject, s.status, s.activeStatusValue)} and ${exact(subject, s.securityRevision, record.securityRevision)} and ${DateTime.toEpochMillis(record.issuedAt)} <= ${now} + ${futureToleranceMillis} and ${DateTime.toEpochMillis(record.issuedAt)} < ${DateTime.toEpochMillis(record.expiresAt)} and ${now} < ${DateTime.toEpochMillis(record.expiresAt)} and ${DateTime.toEpochMillis(record.expiresAt)} <= ${DateTime.toEpochMillis(record.absoluteExpiresAt)} and not exists(select 1 from ${tombstone.name} where ${key(nativeSubject, nativeSession)}) limit 2`;\n\n            sessionInvariant(rows.length <= 1);\n            if (rows[0] === undefined) return false;\n            const decoded = subject.decode(rows[0], \"subject_\");\n\n            sessionInvariant(\n              (yield* mapping.subjectId.toSubject(decoded[s.id])) === record.subjectId &&\n                s.isActiveStatus(decoded[s.status]),\n            );\n\n            return true;\n          }),\n        )\n        .pipe(\n          Effect.flatMap((valid) => (valid ? Effect.void : Effect.fail(SessionInvalid.make({})))),\n        ),\n    revoke: (input, project) =>\n      native(\n        Effect.gen(function* () {\n          const nativeSubject = yield* mapping.subjectId.toNative(input.subjectId),\n            nativeSession = yield* mapping.sessionId.toNative(input.sessionId);\n\n          const row = {\n            ...t.encodeInsert({\n              moduleId: mapping.moduleId,\n              subjectId: nativeSubject,\n              sessionId: nativeSession,\n              absoluteExpiresAt: input.absoluteExpiresAt,\n            }),\n            [t.moduleId]: mapping.moduleId,\n            [t.subjectId]: nativeSubject,\n            [t.sessionId]: nativeSession,\n            [t.absoluteExpiresAt]: t.encodeInstant(input.absoluteExpiresAt),\n          };\n\n          const expiry = tables.expression(\n            mapping.clock.toMillis(tombstone.column(t.absoluteExpiresAt)),\n          );\n\n          const next = DateTime.toEpochMillis(input.absoluteExpiresAt);\n          const longest = sql`case when ${expiry} >= ${next} then ${tombstone.column(t.absoluteExpiresAt)} else ${tombstone.value(t.absoluteExpiresAt, row[t.absoluteExpiresAt])} end`;\n          const insert = tombstone.insert(row);\n\n          const statement = sql.onDialectOrElse({\n            mysql: () =>\n              sql`${insert} on duplicate key update ${tombstone.columnName(t.absoluteExpiresAt)} = ${longest}`,\n            orElse: () =>\n              sql`${insert} on conflict (${tombstone.columnName(t.moduleId)}, ${tombstone.columnName(t.subjectId)}, ${tombstone.columnName(t.sessionId)}) do update set ${tombstone.columnName(t.absoluteExpiresAt)} = ${longest}`,\n          });\n\n          yield* stage(statement);\n          yield* final(\n            \"assisted-session-revocation\",\n            sql`exists(select 1 from ${tombstone.name} where ${key(nativeSubject, nativeSession)} and ${expiry} >= ${next})`,\n          );\n\n          return yield* prepareNativeSession(undefined, project);\n        }),\n      ),\n    revokeAll: (input, project) =>\n      native(\n        Effect.gen(function* () {\n          const nativeSubject = yield* mapping.subjectId.toNative(input.subjectId);\n\n          const next = yield* allocateSessionValue(\n            \"interactive\",\n            s.nextSecurityRevision?.(input.expectedSecurityRevision),\n            s.nextSecurityRevisionSync === undefined\n              ? undefined\n              : () => s.nextSecurityRevisionSync!(input.expectedSecurityRevision),\n          );\n\n          sessionInvariant(next !== input.expectedSecurityRevision);\n\n          const changed = yield* stage(\n            sql`${subject.update({ [s.securityRevision]: next })} where ${id(subject, s.id, nativeSubject)} and ${id(subject, s.status, s.activeStatusValue)} and ${exact(subject, s.securityRevision, input.expectedSecurityRevision)}`,\n            1,\n          );\n\n          if (changed !== 1) return yield* StaleAuthentication.make({});\n          yield* final(\n            \"all-assisted-session-revocation\",\n            sql`exists(select 1 from ${subject.name} where ${id(subject, s.id, nativeSubject)} and ${exact(subject, s.securityRevision, next)})`,\n          );\n\n          return yield* prepareNativeSession(undefined, project);\n        }),\n      ),\n  };\n\n  return { signedSessionValidity };\n});\n"],"mappings":";;;;;;;;;;;;AAwCA,MAAa,0CAA0C,OAAO,WAAW,WACvE,QACA,SAKA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,EAAE,0BAA0B,OAAO;CAEzC,MAAM,OAAO,OAAO,UAAA,CAAW,kBAAkB,GAC/C,WAAW,OAAO,sBAAsB,kBAAkB;CAE5D,MAAM,WAAW,OAAO,OAAO,cAAc,gBAAgB;CAE7D,MAAM,IAAI,QAAQ,SAChB,IAAI,QAAQ,WACZ,UAAU,OAAO,EAAE,KAAK,GACxB,YAAY,OAAO,EAAE,KAAK,GAC1B,MAAM,OAAO,WAAW,QAAQ,MAAM,eAAe;CAEvD,MAAM,MAAM,OAAiB,KAAa,UACxC,GAAG,GAAG,MAAM,OAAO,GAAG,EAAE,KAAK,MAAM,MAAM,KAAK,KAAK;CAErD,MAAM,SAAS,OAAiB,KAAa,UAC3C,aAAa,KAAK,MAAM,OAAO,GAAG,GAAG,MAAM,MAAM,KAAK,KAAK,CAAC;CAE9D,MAAM,OAAO,eAAwB,kBACnC,IAAI,IAAI;EACN,MAAM,WAAW,EAAE,UAAU,QAAQ,QAAQ;EAC7C,GAAG,WAAW,EAAE,WAAW,aAAa;EACxC,GAAG,WAAW,EAAE,WAAW,aAAa;CAC1C,CAAC;CAEH,MAAM,UAAmB,SACvB,UAAU,KAAA,IACN,SAAS,UAAU,0BAA0B,IAAI,GAAG,WAAW,IAC/D,SACG,eAAe,0BAA0B,IAAI,CAAC,CAAC,CAC/C,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CAE1D,MAAM,QAAQ,OAAO,WAAW,WAAW,WAAqB,UAAmB;EACjF,IAAI,UAAU,KAAA,GAAW;GACvB,OAAO,wBAAwB,GAAG,GAAG,WAAW;GAChD,IAAI,aAAa,KAAA,GACf,OAAO,wBAAwB,kBAAkB,KAAK,GAAG,eAAe,UAAU,CAAC;GAErF,OAAO;EACT;EAEA,OAAO,OAAO,iBAAiB,KAAK,SAAS;CAC/C,CAAC;CAED,MAAM,QAAQ,OAAO,WAAW,WAAW,MAAc,WAAqB;EAC5E,IAAI,UAAU,KAAA,GACZ,OAAO,8BAA8B;GAAE;GAAM,WAAW,kBAAkB,KAAK,SAAS;EAAE,CAAC;OACxF,IAAI,OAAO,OAAO,QAAQ,GAC7B,OAAO,yBAAyB;GAC9B;GACA,OAAO,OAAO,IAAI,aAAa;IAC7B,kBAAkB,OAAO,GAAG,kBAAkB,YAAA,CAAa,WAAW,CAAC;GACzE,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,UAAU,wBAAwB,KAAK;IAAE,WAAW;IAAU;GAAM,CAAC,CAAC,CACzF;EACF,CAAC;CACL,CAAC;CAsGD,OAAO,EAAE,uBAAA;EAnGP,SAAS,WACP,SACG,OACC,OAAO,IAAI,aAAa;GACtB,MAAM,gBAAgB,OAAO,QAAQ,UAAU,SAAS,OAAO,SAAS,GACtE,gBAAgB,OAAO,QAAQ,UAAU,SAAS,OAAO,SAAS;GAEpE,MAAM,OACJ,OAAO,GAAG,UAAU,QAAQ,OAAO,UAAU,EAAE,QAAQ,QAAQ,KAAK,SAAS,GAAG,SAAS,EAAE,IAAI,aAAa,EAAE,OAAO,GAAG,SAAS,EAAE,QAAQ,EAAE,iBAAiB,EAAE,OAAO,MAAM,SAAS,EAAE,kBAAkB,OAAO,gBAAgB,EAAE,OAAO,SAAS,cAAc,OAAO,QAAQ,EAAE,MAAM,IAAI,KAAK,sBAAsB,OAAO,SAAS,cAAc,OAAO,QAAQ,EAAE,KAAK,SAAS,cAAc,OAAO,SAAS,EAAE,OAAO,IAAI,KAAK,SAAS,cAAc,OAAO,SAAS,EAAE,OAAO,SAAS,cAAc,OAAO,SAAS,EAAE,MAAM,SAAS,cAAc,OAAO,iBAAiB,EAAE,gCAAgC,UAAU,KAAK,SAAS,IAAI,eAAe,aAAa,EAAE;GAEhpB,iBAAiB,KAAK,UAAU,CAAC;GACjC,IAAI,KAAK,OAAO,KAAA,GAAW,OAAO;GAClC,MAAM,UAAU,QAAQ,OAAO,KAAK,IAAI,UAAU;GAElD,kBACG,OAAO,QAAQ,UAAU,UAAU,QAAQ,EAAE,GAAG,OAAO,OAAO,aAC7D,EAAE,eAAe,QAAQ,EAAE,OAAO,CACtC;GAEA,OAAO;EACT,CAAC,CACH,CAAC,CACA,KACC,OAAO,SAAS,UAAW,QAAQ,OAAO,OAAO,OAAO,KAAK,eAAe,KAAK,CAAC,CAAC,CAAC,CAAE,CACxF;EACJ,SAAS,OAAO,YACd,OACE,OAAO,IAAI,aAAa;GACtB,MAAM,gBAAgB,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS,GACrE,gBAAgB,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;GAEnE,MAAM,MAAM;IACV,GAAG,EAAE,aAAa;KAChB,UAAU,QAAQ;KAClB,WAAW;KACX,WAAW;KACX,mBAAmB,MAAM;IAC3B,CAAC;KACA,EAAE,WAAW,QAAQ;KACrB,EAAE,YAAY;KACd,EAAE,YAAY;KACd,EAAE,oBAAoB,EAAE,cAAc,MAAM,iBAAiB;GAChE;GAEA,MAAM,SAAS,OAAO,WACpB,QAAQ,MAAM,SAAS,UAAU,OAAO,EAAE,iBAAiB,CAAC,CAC9D;GAEA,MAAM,OAAO,SAAS,cAAc,MAAM,iBAAiB;GAC3D,MAAM,UAAU,GAAG,aAAa,OAAO,MAAM,KAAK,QAAQ,UAAU,OAAO,EAAE,iBAAiB,EAAE,QAAQ,UAAU,MAAM,EAAE,mBAAmB,IAAI,EAAE,kBAAkB,EAAE;GACvK,MAAM,SAAS,UAAU,OAAO,GAAG;GAEnC,MAAM,YAAY,IAAI,gBAAgB;IACpC,aACE,GAAG,GAAG,OAAO,2BAA2B,UAAU,WAAW,EAAE,iBAAiB,EAAE,KAAK;IACzF,cACE,GAAG,GAAG,OAAO,gBAAgB,UAAU,WAAW,EAAE,QAAQ,EAAE,IAAI,UAAU,WAAW,EAAE,SAAS,EAAE,IAAI,UAAU,WAAW,EAAE,SAAS,EAAE,kBAAkB,UAAU,WAAW,EAAE,iBAAiB,EAAE,KAAK;GAC/M,CAAC;GAED,OAAO,MAAM,SAAS;GACtB,OAAO,MACL,+BACA,GAAG,wBAAwB,UAAU,KAAK,SAAS,IAAI,eAAe,aAAa,EAAE,OAAO,OAAO,MAAM,KAAK,EAChH;GAEA,OAAO,OAAO,qBAAqB,KAAA,GAAW,OAAO;EACvD,CAAC,CACH;EACF,YAAY,OAAO,YACjB,OACE,OAAO,IAAI,aAAa;GACtB,MAAM,gBAAgB,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;GAEvE,MAAM,OAAO,OAAO,qBAClB,eACA,EAAE,uBAAuB,MAAM,wBAAwB,GACvD,EAAE,6BAA6B,KAAA,IAC3B,KAAA,UACM,EAAE,yBAA0B,MAAM,wBAAwB,CACtE;GAEA,iBAAiB,SAAS,MAAM,wBAAwB;GAOxD,KAAI,OALmB,MACrB,GAAG,GAAG,QAAQ,OAAO,GAAG,EAAE,mBAAmB,KAAK,CAAC,EAAE,SAAS,GAAG,SAAS,EAAE,IAAI,aAAa,EAAE,OAAO,GAAG,SAAS,EAAE,QAAQ,EAAE,iBAAiB,EAAE,OAAO,MAAM,SAAS,EAAE,kBAAkB,MAAM,wBAAwB,KACzN,CACF,OAEgB,GAAG,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;GAC5D,OAAO,MACL,mCACA,GAAG,wBAAwB,QAAQ,KAAK,SAAS,GAAG,SAAS,EAAE,IAAI,aAAa,EAAE,OAAO,MAAM,SAAS,EAAE,kBAAkB,IAAI,EAAE,EACpI;GAEA,OAAO,OAAO,qBAAqB,KAAA,GAAW,OAAO;EACvD,CAAC,CACH;CAGyB,EAAE;AACjC,CAAC"}

package/dist/internal/sql-authority.mjs

@@ -6,6 +6,7 @@ import { makeNativeAuthenticationAuthorityServices } from "./session-native-auth
 import { validateSqlStorage } from "./sql-storage-validation.mjs";
 import { Effect } from "effect";
 import { SqlClient } from "effect/sql";
+import { reportAuthDiagnostic } from "@yielded/auth/Persistence";
 import { SessionUnavailable } from "@yielded/auth/Sessions";
 //#region src/internal/sql-authority.ts
 /** Direct SQL uses the same authority owner as the mapped Drizzle adapters. */
@@ -15,7 +16,10 @@ const makeAuthenticationAuthorityServices = Effect.fnUntraced(function* (mapping
 		pg: () => true,
 		sqlite: () => true,
 		orElse: () => false
-	})) return yield* PersistenceConfigurationError.make({ reason: "Authentication authority requires PostgreSQL or SQLite" });
+	})) {
+		yield* reportAuthDiagnostic("persistence-validation", "configuration");
+		return yield* PersistenceConfigurationError.make({ reason: "Authentication authority requires PostgreSQL or SQLite" });
+	}
 	yield* validateSqlStorage(mapping).pipe(Effect.mapError(() => SessionUnavailable.make({})));
 	return yield* makeNativeAuthenticationAuthorityServices(makeNativeSqlTables(sql), {
 		...mapping,

package/dist/internal/sql-authority.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"sql-authority.mjs","names":[],"sources":["../../src/internal/sql-authority.ts"],"sourcesContent":["import type { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport { SessionUnavailable, type AuthenticationAuthority } from \"@yielded/auth/Sessions\";\nimport { Effect } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\n\nimport { PersistenceConfigurationError } from \"./configuration\";\nimport type { AuthenticationAuthorityMapping } from \"./models/session-model\";\nimport { makeNativeSqlTables } from \"./native-sql-table\";\nimport {\n  makeNativeAuthenticationAuthorityServices,\n  type NativeAuthenticationAuthorityMapping,\n} from \"./session-native-authority\";\nimport { SqlBatchCommit } from \"./sql-commit\";\nimport { SqlExpression, compileSqlExpression } from \"./sql-expression\";\nimport type { SqlTableModel } from \"./sql-oauth-model\";\nimport { validateSqlStorage } from \"./sql-storage-validation\";\n\n/** Direct SQL uses the same authority owner as the mapped Drizzle adapters. */\nexport const makeAuthenticationAuthorityServices = Effect.fnUntraced(function* <Claims, N>(\n  mapping: AuthenticationAuthorityMapping<\n    Claims,\n    SqlTableModel,\n    SqlTableModel,\n    SqlTableModel,\n    N,\n    SqlExpression\n  >,\n): Effect.fn.Return<\n  { readonly authenticationAuthority: AuthenticationAuthority[\"Service\"] },\n  SessionUnavailable | PersistenceConfigurationError,\n  LifecycleHooks | SqlClient.SqlClient\n> {\n  const sql = yield* SqlClient.SqlClient;\n\n  if (!sql.onDialectOrElse({ pg: () => true, sqlite: () => true, orElse: () => false }))\n    return yield* PersistenceConfigurationError.make({\n      reason: \"Authentication authority requires PostgreSQL or SQLite\",\n    });\n  yield* validateSqlStorage(mapping).pipe(Effect.mapError(() => SessionUnavailable.make({})));\n\n  // Erase mapped native ID callback variance, never decoded authentication data.\n  return yield* makeNativeAuthenticationAuthorityServices(makeNativeSqlTables(sql), {\n    ...mapping,\n    clock: {\n      ...mapping.clock,\n      toMillis: (value: unknown) =>\n        mapping.clock.toMillis(new SqlExpression((client) => compileSqlExpression(client, value))),\n      fromMillis: (value: unknown) =>\n        mapping.clock.fromMillis(\n          new SqlExpression((client) => compileSqlExpression(client, value)),\n        ),\n    },\n  } as unknown as NativeAuthenticationAuthorityMapping<Claims>).pipe(\n    Effect.provideService(SqlBatchCommit, undefined),\n  );\n});\n"],"mappings":";;;;;;;;;;;AAkBA,MAAa,sCAAsC,OAAO,WAAW,WACnE,SAYA;CACA,MAAM,MAAM,OAAO,UAAU;CAE7B,IAAI,CAAC,IAAI,gBAAgB;EAAE,UAAU;EAAM,cAAc;EAAM,cAAc;CAAM,CAAC,GAClF,OAAO,OAAO,8BAA8B,KAAK,EAC/C,QAAQ,yDACV,CAAC;CACH,OAAO,mBAAmB,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,mBAAmB,KAAK,CAAC,CAAC,CAAC,CAAC;CAG1F,OAAO,OAAO,0CAA0C,oBAAoB,GAAG,GAAG;EAChF,GAAG;EACH,OAAO;GACL,GAAG,QAAQ;GACX,WAAW,UACT,QAAQ,MAAM,SAAS,IAAI,eAAe,WAAW,qBAAqB,QAAQ,KAAK,CAAC,CAAC;GAC3F,aAAa,UACX,QAAQ,MAAM,WACZ,IAAI,eAAe,WAAW,qBAAqB,QAAQ,KAAK,CAAC,CACnE;EACJ;CACF,CAA4D,CAAC,CAAC,KAC5D,OAAO,eAAe,gBAAgB,KAAA,CAAS,CACjD;AACF,CAAC"}
+{"version":3,"file":"sql-authority.mjs","names":[],"sources":["../../src/internal/sql-authority.ts"],"sourcesContent":["import type { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport { reportAuthDiagnostic } from \"@yielded/auth/Persistence\";\nimport { SessionUnavailable, type AuthenticationAuthority } from \"@yielded/auth/Sessions\";\nimport { Effect } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\n\nimport { PersistenceConfigurationError } from \"./configuration\";\nimport type { AuthenticationAuthorityMapping } from \"./models/session-model\";\nimport { makeNativeSqlTables } from \"./native-sql-table\";\nimport {\n  makeNativeAuthenticationAuthorityServices,\n  type NativeAuthenticationAuthorityMapping,\n} from \"./session-native-authority\";\nimport { SqlBatchCommit } from \"./sql-commit\";\nimport { SqlExpression, compileSqlExpression } from \"./sql-expression\";\nimport type { SqlTableModel } from \"./sql-oauth-model\";\nimport { validateSqlStorage } from \"./sql-storage-validation\";\n\n/** Direct SQL uses the same authority owner as the mapped Drizzle adapters. */\nexport const makeAuthenticationAuthorityServices = Effect.fnUntraced(function* <Claims, N>(\n  mapping: AuthenticationAuthorityMapping<\n    Claims,\n    SqlTableModel,\n    SqlTableModel,\n    SqlTableModel,\n    N,\n    SqlExpression\n  >,\n): Effect.fn.Return<\n  { readonly authenticationAuthority: AuthenticationAuthority[\"Service\"] },\n  SessionUnavailable | PersistenceConfigurationError,\n  LifecycleHooks | SqlClient.SqlClient\n> {\n  const sql = yield* SqlClient.SqlClient;\n\n  if (!sql.onDialectOrElse({ pg: () => true, sqlite: () => true, orElse: () => false })) {\n    yield* reportAuthDiagnostic(\"persistence-validation\", \"configuration\");\n\n    return yield* PersistenceConfigurationError.make({\n      reason: \"Authentication authority requires PostgreSQL or SQLite\",\n    });\n  }\n  yield* validateSqlStorage(mapping).pipe(Effect.mapError(() => SessionUnavailable.make({})));\n\n  // Erase mapped native ID callback variance, never decoded authentication data.\n  return yield* makeNativeAuthenticationAuthorityServices(makeNativeSqlTables(sql), {\n    ...mapping,\n    clock: {\n      ...mapping.clock,\n      toMillis: (value: unknown) =>\n        mapping.clock.toMillis(new SqlExpression((client) => compileSqlExpression(client, value))),\n      fromMillis: (value: unknown) =>\n        mapping.clock.fromMillis(\n          new SqlExpression((client) => compileSqlExpression(client, value)),\n        ),\n    },\n  } as unknown as NativeAuthenticationAuthorityMapping<Claims>).pipe(\n    Effect.provideService(SqlBatchCommit, undefined),\n  );\n});\n"],"mappings":";;;;;;;;;;;;AAmBA,MAAa,sCAAsC,OAAO,WAAW,WACnE,SAYA;CACA,MAAM,MAAM,OAAO,UAAU;CAE7B,IAAI,CAAC,IAAI,gBAAgB;EAAE,UAAU;EAAM,cAAc;EAAM,cAAc;CAAM,CAAC,GAAG;EACrF,OAAO,qBAAqB,0BAA0B,eAAe;EAErE,OAAO,OAAO,8BAA8B,KAAK,EAC/C,QAAQ,yDACV,CAAC;CACH;CACA,OAAO,mBAAmB,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,mBAAmB,KAAK,CAAC,CAAC,CAAC,CAAC;CAG1F,OAAO,OAAO,0CAA0C,oBAAoB,GAAG,GAAG;EAChF,GAAG;EACH,OAAO;GACL,GAAG,QAAQ;GACX,WAAW,UACT,QAAQ,MAAM,SAAS,IAAI,eAAe,WAAW,qBAAqB,QAAQ,KAAK,CAAC,CAAC;GAC3F,aAAa,UACX,QAAQ,MAAM,WACZ,IAAI,eAAe,WAAW,qBAAqB,QAAQ,KAAK,CAAC,CACnE;EACJ;CACF,CAA4D,CAAC,CAAC,KAC5D,OAAO,eAAe,gBAAgB,KAAA,CAAS,CACjD;AACF,CAAC"}

package/dist/internal/sql-storage-validation.mjs

@@ -4,6 +4,7 @@ import { validateStorageBatch } from "./storage-validation.mjs";
 import { storageKeyPlans } from "./storage-plans.mjs";
 import { Effect } from "effect";
 import { SqlClient } from "effect/sql";
+import { reportAuthDiagnostic } from "@yielded/auth/Persistence";
 //#region src/internal/sql-storage-validation.ts
 /** Check declared mappings against physical keys before acquiring OAuth services. */
 const validateSqlStorage = Effect.fnUntraced(function* (mapping) {
@@ -46,7 +47,7 @@ const validateSqlStorage = Effect.fnUntraced(function* (mapping) {
 		operation: "mapping",
 		cause: "Required SQL storage key is unavailable"
 	})));
-});
+}, Effect.tapError(() => reportAuthDiagnostic("persistence-validation", "mapping")));
 //#endregion
 export { validateSqlStorage };
 

package/dist/internal/sql-storage-validation.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"sql-storage-validation.mjs","names":[],"sources":["../../src/internal/sql-storage-validation.ts"],"sourcesContent":["import { Effect } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\n\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport { Table } from \"./sql-table\";\nimport { storageKeyPlans } from \"./storage-plans\";\nimport { validateStorageBatch, type StorageValidation } from \"./storage-validation\";\n\n/** Check declared mappings against physical keys before acquiring OAuth services. */\nexport const validateSqlStorage = Effect.fnUntraced(function* (mapping: unknown) {\n  const plans = yield* Effect.try({\n    try: () =>\n      storageKeyPlans(mapping, (table) => {\n        if (!(table instanceof Table)) throw new Error(\"Expected a SQL table\");\n\n        return table.columns;\n      }),\n    catch: () =>\n      PersistenceMappingError.make({ operation: \"mapping\", cause: \"Invalid storage key mapping\" }),\n  });\n\n  const client = yield* SqlClient.SqlClient;\n\n  const dialect = client.onDialectOrElse({\n    pg: () => \"pg\" as const,\n    sqlite: () => \"sqlite\" as const,\n    orElse: () => undefined,\n  });\n\n  if (dialect === undefined)\n    return yield* PersistenceMappingError.make({\n      operation: \"mapping\",\n      cause: \"OAuth persistence requires PostgreSQL or SQLite\",\n    });\n  const validations: StorageValidation[] = [];\n\n  for (const plan of plans) {\n    if (!(plan.table instanceof Table))\n      return yield* PersistenceMappingError.make({\n        operation: \"mapping\",\n        cause: \"Expected a SQL table\",\n      });\n    validations.push({\n      table: {\n        name: plan.table.name,\n        ...(plan.table.schema === undefined ? {} : { schema: plan.table.schema }),\n        columns: Object.fromEntries(\n          Object.entries(plan.table.columns).map(([key, column]) => [key, column.options]),\n        ),\n      },\n      required: [plan.keys],\n    });\n  }\n  yield* validateStorageBatch(dialect, validations).pipe(\n    Effect.provideService(SqlClient.SqlClient, client),\n    Effect.mapError(() =>\n      PersistenceMappingError.make({\n        operation: \"mapping\",\n        cause: \"Required SQL storage key is unavailable\",\n      }),\n    ),\n  );\n});\n"],"mappings":";;;;;;;;AASA,MAAa,qBAAqB,OAAO,WAAW,WAAW,SAAkB;CAC/E,MAAM,QAAQ,OAAO,OAAO,IAAI;EAC9B,WACE,gBAAgB,UAAU,UAAU;GAClC,IAAI,EAAE,iBAAiB,QAAQ,MAAM,IAAI,MAAM,sBAAsB;GAErE,OAAO,MAAM;EACf,CAAC;EACH,aACE,wBAAwB,KAAK;GAAE,WAAW;GAAW,OAAO;EAA8B,CAAC;CAC/F,CAAC;CAED,MAAM,SAAS,OAAO,UAAU;CAEhC,MAAM,UAAU,OAAO,gBAAgB;EACrC,UAAU;EACV,cAAc;EACd,cAAc,KAAA;CAChB,CAAC;CAED,IAAI,YAAY,KAAA,GACd,OAAO,OAAO,wBAAwB,KAAK;EACzC,WAAW;EACX,OAAO;CACT,CAAC;CACH,MAAM,cAAmC,CAAC;CAE1C,KAAK,MAAM,QAAQ,OAAO;EACxB,IAAI,EAAE,KAAK,iBAAiB,QAC1B,OAAO,OAAO,wBAAwB,KAAK;GACzC,WAAW;GACX,OAAO;EACT,CAAC;EACH,YAAY,KAAK;GACf,OAAO;IACL,MAAM,KAAK,MAAM;IACjB,GAAI,KAAK,MAAM,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,KAAK,MAAM,OAAO;IACvE,SAAS,OAAO,YACd,OAAO,QAAQ,KAAK,MAAM,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC,KAAK,OAAO,OAAO,CAAC,CACjF;GACF;GACA,UAAU,CAAC,KAAK,IAAI;EACtB,CAAC;CACH;CACA,OAAO,qBAAqB,SAAS,WAAW,CAAC,CAAC,KAChD,OAAO,eAAe,UAAU,WAAW,MAAM,GACjD,OAAO,eACL,wBAAwB,KAAK;EAC3B,WAAW;EACX,OAAO;CACT,CAAC,CACH,CACF;AACF,CAAC"}
+{"version":3,"file":"sql-storage-validation.mjs","names":[],"sources":["../../src/internal/sql-storage-validation.ts"],"sourcesContent":["import { reportAuthDiagnostic } from \"@yielded/auth/Persistence\";\nimport { Effect } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\n\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport { Table } from \"./sql-table\";\nimport { storageKeyPlans } from \"./storage-plans\";\nimport { validateStorageBatch, type StorageValidation } from \"./storage-validation\";\n\n/** Check declared mappings against physical keys before acquiring OAuth services. */\nexport const validateSqlStorage = Effect.fnUntraced(\n  function* (mapping: unknown) {\n    const plans = yield* Effect.try({\n      try: () =>\n        storageKeyPlans(mapping, (table) => {\n          if (!(table instanceof Table)) throw new Error(\"Expected a SQL table\");\n\n          return table.columns;\n        }),\n      catch: () =>\n        PersistenceMappingError.make({\n          operation: \"mapping\",\n          cause: \"Invalid storage key mapping\",\n        }),\n    });\n\n    const client = yield* SqlClient.SqlClient;\n\n    const dialect = client.onDialectOrElse({\n      pg: () => \"pg\" as const,\n      sqlite: () => \"sqlite\" as const,\n      orElse: () => undefined,\n    });\n\n    if (dialect === undefined)\n      return yield* PersistenceMappingError.make({\n        operation: \"mapping\",\n        cause: \"OAuth persistence requires PostgreSQL or SQLite\",\n      });\n    const validations: StorageValidation[] = [];\n\n    for (const plan of plans) {\n      if (!(plan.table instanceof Table))\n        return yield* PersistenceMappingError.make({\n          operation: \"mapping\",\n          cause: \"Expected a SQL table\",\n        });\n      validations.push({\n        table: {\n          name: plan.table.name,\n          ...(plan.table.schema === undefined ? {} : { schema: plan.table.schema }),\n          columns: Object.fromEntries(\n            Object.entries(plan.table.columns).map(([key, column]) => [key, column.options]),\n          ),\n        },\n        required: [plan.keys],\n      });\n    }\n    yield* validateStorageBatch(dialect, validations).pipe(\n      Effect.provideService(SqlClient.SqlClient, client),\n      Effect.mapError(() =>\n        PersistenceMappingError.make({\n          operation: \"mapping\",\n          cause: \"Required SQL storage key is unavailable\",\n        }),\n      ),\n    );\n  },\n  Effect.tapError(() => reportAuthDiagnostic(\"persistence-validation\", \"mapping\")),\n);\n"],"mappings":";;;;;;;;;AAUA,MAAa,qBAAqB,OAAO,WACvC,WAAW,SAAkB;CAC3B,MAAM,QAAQ,OAAO,OAAO,IAAI;EAC9B,WACE,gBAAgB,UAAU,UAAU;GAClC,IAAI,EAAE,iBAAiB,QAAQ,MAAM,IAAI,MAAM,sBAAsB;GAErE,OAAO,MAAM;EACf,CAAC;EACH,aACE,wBAAwB,KAAK;GAC3B,WAAW;GACX,OAAO;EACT,CAAC;CACL,CAAC;CAED,MAAM,SAAS,OAAO,UAAU;CAEhC,MAAM,UAAU,OAAO,gBAAgB;EACrC,UAAU;EACV,cAAc;EACd,cAAc,KAAA;CAChB,CAAC;CAED,IAAI,YAAY,KAAA,GACd,OAAO,OAAO,wBAAwB,KAAK;EACzC,WAAW;EACX,OAAO;CACT,CAAC;CACH,MAAM,cAAmC,CAAC;CAE1C,KAAK,MAAM,QAAQ,OAAO;EACxB,IAAI,EAAE,KAAK,iBAAiB,QAC1B,OAAO,OAAO,wBAAwB,KAAK;GACzC,WAAW;GACX,OAAO;EACT,CAAC;EACH,YAAY,KAAK;GACf,OAAO;IACL,MAAM,KAAK,MAAM;IACjB,GAAI,KAAK,MAAM,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,KAAK,MAAM,OAAO;IACvE,SAAS,OAAO,YACd,OAAO,QAAQ,KAAK,MAAM,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC,KAAK,OAAO,OAAO,CAAC,CACjF;GACF;GACA,UAAU,CAAC,KAAK,IAAI;EACtB,CAAC;CACH;CACA,OAAO,qBAAqB,SAAS,WAAW,CAAC,CAAC,KAChD,OAAO,eAAe,UAAU,WAAW,MAAM,GACjD,OAAO,eACL,wBAAwB,KAAK;EAC3B,WAAW;EACX,OAAO;CACT,CAAC,CACH,CACF;AACF,GACA,OAAO,eAAe,qBAAqB,0BAA0B,SAAS,CAAC,CACjF"}