@yielded/auth-persistence 0.1.0-beta.30 → 0.1.0-beta.32

package/dist/internal/session-native-pending-read.mjs

@@ -1,36 +1,42 @@
 import { exactSqlText } from "./sql-change.mjs";
-import { makeNativeSessionAuthorityState } from "./session-native-state.mjs";
+import { makeNativeSessionAuthorityState, sessionInvariant, sessionUnavailable } from "./session-native-state.mjs";
+import { canJoinTextColumns } from "./storage-validation.mjs";
 import { makeNativeSessionPending } from "./session-native-pending.mjs";
 import { Effect } from "effect";
 //#region src/internal/session-native-pending-read.ts
-/** Both semantic pending ports use the same kind-bound physical snapshot.
-* Distinct native ID encodings use their own bound reads; joined rows still
-* validate each decoded owner before returning current policy. */
+/** Both ports re-read the pending row with current authority in one snapshot.
+* Discovery only selects the independently bound owner for incompatible IDs. */
 const makeNativeSessionPendingReader = Effect.fnUntraced(function* (tables, mapping, batch = false) {
 	const state = yield* makeNativeSessionAuthorityState(tables, mapping, batch);
 	const pending = yield* makeNativeSessionPending(tables, mapping, batch);
+	const joinedIds = yield* canJoinTextColumns([
+		pending.table.unencodedTextColumn?.(pending.p.subjectId),
+		state.subject.unencodedTextColumn?.(mapping.subject.id),
+		state.credential.unencodedTextColumn?.(mapping.credential.subjectId)
+	]).pipe(Effect.mapError(sessionUnavailable));
 	return {
 		state,
 		pending,
 		read: Effect.fnUntraced(function* (kind, digest) {
 			const { sql, now } = state, { p, table } = pending;
-			if (table.unencodedTextColumn?.(p.subjectId) !== void 0 && state.subject.unencodedTextColumn?.(mapping.subject.id) !== void 0 && state.credential.unencodedTextColumn?.(mapping.credential.subjectId) !== void 0) {
-				const pt = table.as("authentication_pending"), st = state.joinedSubject, ct = state.joinedCredential, s = mapping.subject, c = mapping.credential;
-				const rows = yield* sql`select ${pt.fields("p_")}, ${st.fields("s_")}, ${ct.fields("c_")}, ${now} as engine_now from ${pt.name} join ${st.name} on ${exactSqlText(sql, st.column(s.id), pt.column(p.subjectId))} and ${state.activeSubject(st)} left join ${ct.name} on ${exactSqlText(sql, ct.column(c.subjectId), pt.column(p.subjectId))} and ${state.activeCredential(ct)} where ${pending.predicate(pt, kind, digest)} limit 65`;
-				if (rows[0] === void 0) return void 0;
-				const record = yield* pending.decode(kind, pt.decode(rows[0], "p_"));
-				const owner = yield* mapping.subjectId.toNative(record.subjectId);
-				const authority = yield* state.decode(record.subjectId, owner, st.decode(rows[0], "s_"), rows.map((row) => ct.decode(row, "c_")), rows[0].engine_now);
-				return authority === void 0 ? void 0 : {
-					record,
-					authority
-				};
+			let discoveredSubjectId;
+			let nativeId;
+			if (!joinedIds) {
+				const selected = yield* pending.read(kind, digest);
+				if (selected === void 0) return void 0;
+				discoveredSubjectId = selected.record.subjectId;
+				nativeId = yield* mapping.subjectId.toNative(discoveredSubjectId);
 			}
-			const selected = yield* pending.read(kind, digest);
-			if (selected === void 0) return void 0;
-			const authority = yield* state.read(selected.record.subjectId);
-			return authority === void 0 || authority.now >= selected.record.expiresAtMillis ? void 0 : {
-				record: selected.record,
+			const pt = table.as("authentication_pending"), st = state.joinedSubject, ct = state.joinedCredential, s = mapping.subject, c = mapping.credential;
+			const bindOwner = (table, key) => joinedIds ? exactSqlText(sql, table.column(key), pt.column(p.subjectId)) : state.id(table, key, nativeId);
+			const rows = yield* sql`select ${pt.fields("p_")}, ${st.fields("s_")}, ${ct.fields("c_")}, ${now} as engine_now from ${pt.name} join ${st.name} on ${bindOwner(st, s.id)} and ${state.activeSubject(st)} left join ${ct.name} on ${bindOwner(ct, c.subjectId)} and ${state.activeCredential(ct)} where ${pending.predicate(pt, kind, digest)}${joinedIds ? sql`` : sql` and ${bindOwner(pt, p.subjectId)}`} limit 65`;
+			if (rows[0] === void 0) return void 0;
+			const record = yield* pending.decode(kind, pt.decode(rows[0], "p_"));
+			sessionInvariant(joinedIds || record.subjectId === discoveredSubjectId);
+			const owner = yield* mapping.subjectId.toNative(record.subjectId);
+			const authority = yield* state.decode(record.subjectId, owner, rows[0], rows.map((row) => ct.decode(row, "c_")), rows[0].engine_now);
+			return authority === void 0 || authority.now >= record.expiresAtMillis ? void 0 : {
+				record,
 				authority
 			};
 		})

package/dist/internal/session-native-pending-read.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"session-native-pending-read.mjs","names":[],"sources":["../../src/internal/session-native-pending-read.ts"],"sourcesContent":["import type { TokenDigest } from \"@yielded/auth/Schema\";\nimport type { PendingAuthenticationKind } from \"@yielded/auth/Sessions\";\nimport { Effect } from \"effect\";\n\nimport type { NativeSqlTables } from \"./native-sql-table\";\nimport { makeNativeSessionPending } from \"./session-native-pending\";\nimport {\n  makeNativeSessionAuthorityState,\n  type NativeSessionAuthorityMapping,\n} from \"./session-native-state\";\nimport { exactSqlText } from \"./sql-change\";\n\n/** Both semantic pending ports use the same kind-bound physical snapshot.\n * Distinct native ID encodings use their own bound reads; joined rows still\n * validate each decoded owner before returning current policy. */\nexport const makeNativeSessionPendingReader = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: NativeSessionAuthorityMapping & Parameters<typeof makeNativeSessionPending>[1],\n  batch = false,\n) {\n  const state = yield* makeNativeSessionAuthorityState(tables, mapping, batch);\n  const pending = yield* makeNativeSessionPending(tables, mapping, batch);\n\n  const read = Effect.fnUntraced(function* (kind: PendingAuthenticationKind, digest: TokenDigest) {\n    const { sql, now } = state,\n      { p, table } = pending;\n\n    const compatible =\n      table.unencodedTextColumn?.(p.subjectId) !== undefined &&\n      state.subject.unencodedTextColumn?.(mapping.subject.id) !== undefined &&\n      state.credential.unencodedTextColumn?.(mapping.credential.subjectId) !== undefined;\n\n    if (compatible) {\n      const pt = table.as(\"authentication_pending\"),\n        st = state.joinedSubject,\n        ct = state.joinedCredential,\n        s = mapping.subject,\n        c = mapping.credential;\n\n      const rows =\n        yield* sql`select ${pt.fields(\"p_\")}, ${st.fields(\"s_\")}, ${ct.fields(\"c_\")}, ${now} as engine_now from ${pt.name} join ${st.name} on ${exactSqlText(sql, st.column(s.id), pt.column(p.subjectId))} and ${state.activeSubject(st)} left join ${ct.name} on ${exactSqlText(sql, ct.column(c.subjectId), pt.column(p.subjectId))} and ${state.activeCredential(ct)} where ${pending.predicate(pt, kind, digest)} limit 65`;\n\n      if (rows[0] === undefined) return undefined;\n      const record = yield* pending.decode(kind, pt.decode(rows[0], \"p_\"));\n      const owner = yield* mapping.subjectId.toNative(record.subjectId);\n\n      const authority = yield* state.decode(\n        record.subjectId,\n        owner,\n        st.decode(rows[0], \"s_\"),\n        rows.map((row) => ct.decode(row, \"c_\")),\n        rows[0].engine_now,\n      );\n\n      return authority === undefined ? undefined : { record, authority };\n    }\n    const selected = yield* pending.read(kind, digest);\n\n    if (selected === undefined) return undefined;\n    const authority = yield* state.read(selected.record.subjectId);\n\n    return authority === undefined || authority.now >= selected.record.expiresAtMillis\n      ? undefined\n      : { record: selected.record, authority };\n  });\n\n  return { state, pending, read };\n});\n"],"mappings":";;;;;;;;AAeA,MAAa,iCAAiC,OAAO,WAAW,WAC9D,QACA,SACA,QAAQ,OACR;CACA,MAAM,QAAQ,OAAO,gCAAgC,QAAQ,SAAS,KAAK;CAC3E,MAAM,UAAU,OAAO,yBAAyB,QAAQ,SAAS,KAAK;CA6CtE,OAAO;EAAE;EAAO;EAAS,MA3CZ,OAAO,WAAW,WAAW,MAAiC,QAAqB;GAC9F,MAAM,EAAE,KAAK,QAAQ,OACnB,EAAE,GAAG,UAAU;GAOjB,IAJE,MAAM,sBAAsB,EAAE,SAAS,MAAM,KAAA,KAC7C,MAAM,QAAQ,sBAAsB,QAAQ,QAAQ,EAAE,MAAM,KAAA,KAC5D,MAAM,WAAW,sBAAsB,QAAQ,WAAW,SAAS,MAAM,KAAA,GAE3D;IACd,MAAM,KAAK,MAAM,GAAG,wBAAwB,GAC1C,KAAK,MAAM,eACX,KAAK,MAAM,kBACX,IAAI,QAAQ,SACZ,IAAI,QAAQ;IAEd,MAAM,OACJ,OAAO,GAAG,UAAU,GAAG,OAAO,IAAI,EAAE,IAAI,GAAG,OAAO,IAAI,EAAE,IAAI,GAAG,OAAO,IAAI,EAAE,IAAI,IAAI,sBAAsB,GAAG,KAAK,QAAQ,GAAG,KAAK,MAAM,aAAa,KAAK,GAAG,OAAO,EAAE,EAAE,GAAG,GAAG,OAAO,EAAE,SAAS,CAAC,EAAE,OAAO,MAAM,cAAc,EAAE,EAAE,aAAa,GAAG,KAAK,MAAM,aAAa,KAAK,GAAG,OAAO,EAAE,SAAS,GAAG,GAAG,OAAO,EAAE,SAAS,CAAC,EAAE,OAAO,MAAM,iBAAiB,EAAE,EAAE,SAAS,QAAQ,UAAU,IAAI,MAAM,MAAM,EAAE;IAEhZ,IAAI,KAAK,OAAO,KAAA,GAAW,OAAO,KAAA;IAClC,MAAM,SAAS,OAAO,QAAQ,OAAO,MAAM,GAAG,OAAO,KAAK,IAAI,IAAI,CAAC;IACnE,MAAM,QAAQ,OAAO,QAAQ,UAAU,SAAS,OAAO,SAAS;IAEhE,MAAM,YAAY,OAAO,MAAM,OAC7B,OAAO,WACP,OACA,GAAG,OAAO,KAAK,IAAI,IAAI,GACvB,KAAK,KAAK,QAAQ,GAAG,OAAO,KAAK,IAAI,CAAC,GACtC,KAAK,EAAE,CAAC,UACV;IAEA,OAAO,cAAc,KAAA,IAAY,KAAA,IAAY;KAAE;KAAQ;IAAU;GACnE;GACA,MAAM,WAAW,OAAO,QAAQ,KAAK,MAAM,MAAM;GAEjD,IAAI,aAAa,KAAA,GAAW,OAAO,KAAA;GACnC,MAAM,YAAY,OAAO,MAAM,KAAK,SAAS,OAAO,SAAS;GAE7D,OAAO,cAAc,KAAA,KAAa,UAAU,OAAO,SAAS,OAAO,kBAC/D,KAAA,IACA;IAAE,QAAQ,SAAS;IAAQ;GAAU;EAC3C,CAE4B;CAAE;AAChC,CAAC"}
+{"version":3,"file":"session-native-pending-read.mjs","names":[],"sources":["../../src/internal/session-native-pending-read.ts"],"sourcesContent":["import type { SubjectId, TokenDigest } from \"@yielded/auth/Schema\";\nimport type { PendingAuthenticationKind } from \"@yielded/auth/Sessions\";\nimport { Effect } from \"effect\";\n\nimport type { NativeSqlTables } from \"./native-sql-table\";\nimport { makeNativeSessionPending } from \"./session-native-pending\";\nimport {\n  makeNativeSessionAuthorityState,\n  sessionInvariant,\n  sessionUnavailable,\n  type NativeSessionAuthorityMapping,\n} from \"./session-native-state\";\nimport { exactSqlText } from \"./sql-change\";\nimport { canJoinTextColumns } from \"./storage-validation\";\n\n/** Both ports re-read the pending row with current authority in one snapshot.\n * Discovery only selects the independently bound owner for incompatible IDs. */\nexport const makeNativeSessionPendingReader = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: NativeSessionAuthorityMapping & Parameters<typeof makeNativeSessionPending>[1],\n  batch = false,\n) {\n  const state = yield* makeNativeSessionAuthorityState(tables, mapping, batch);\n  const pending = yield* makeNativeSessionPending(tables, mapping, batch);\n\n  const joinedIds = yield* canJoinTextColumns([\n    pending.table.unencodedTextColumn?.(pending.p.subjectId),\n    state.subject.unencodedTextColumn?.(mapping.subject.id),\n    state.credential.unencodedTextColumn?.(mapping.credential.subjectId),\n  ]).pipe(Effect.mapError(sessionUnavailable));\n\n  const read = Effect.fnUntraced(function* (kind: PendingAuthenticationKind, digest: TokenDigest) {\n    const { sql, now } = state,\n      { p, table } = pending;\n\n    let discoveredSubjectId: SubjectId | undefined;\n    let nativeId: unknown;\n\n    if (!joinedIds) {\n      const selected = yield* pending.read(kind, digest);\n\n      if (selected === undefined) return undefined;\n      discoveredSubjectId = selected.record.subjectId;\n      nativeId = yield* mapping.subjectId.toNative(discoveredSubjectId);\n    }\n\n    const pt = table.as(\"authentication_pending\"),\n      st = state.joinedSubject,\n      ct = state.joinedCredential,\n      s = mapping.subject,\n      c = mapping.credential;\n\n    const bindOwner = (table: typeof pt, key: string) =>\n      joinedIds\n        ? exactSqlText(sql, table.column(key), pt.column(p.subjectId))\n        : state.id(table, key, nativeId);\n\n    const rows =\n      yield* sql`select ${pt.fields(\"p_\")}, ${st.fields(\"s_\")}, ${ct.fields(\"c_\")}, ${now} as engine_now from ${pt.name} join ${st.name} on ${bindOwner(st, s.id)} and ${state.activeSubject(st)} left join ${ct.name} on ${bindOwner(ct, c.subjectId)} and ${state.activeCredential(ct)} where ${pending.predicate(pt, kind, digest)}${joinedIds ? sql`` : sql` and ${bindOwner(pt, p.subjectId)}`} limit 65`;\n\n    if (rows[0] === undefined) return undefined;\n    const record = yield* pending.decode(kind, pt.decode(rows[0], \"p_\"));\n\n    sessionInvariant(joinedIds || record.subjectId === discoveredSubjectId);\n    const owner = yield* mapping.subjectId.toNative(record.subjectId);\n\n    const authority = yield* state.decode(\n      record.subjectId,\n      owner,\n      rows[0],\n      rows.map((row) => ct.decode(row, \"c_\")),\n      rows[0].engine_now,\n    );\n\n    return authority === undefined || authority.now >= record.expiresAtMillis\n      ? undefined\n      : { record, authority };\n  });\n\n  return { state, pending, read };\n});\n"],"mappings":";;;;;;;;AAiBA,MAAa,iCAAiC,OAAO,WAAW,WAC9D,QACA,SACA,QAAQ,OACR;CACA,MAAM,QAAQ,OAAO,gCAAgC,QAAQ,SAAS,KAAK;CAC3E,MAAM,UAAU,OAAO,yBAAyB,QAAQ,SAAS,KAAK;CAEtE,MAAM,YAAY,OAAO,mBAAmB;EAC1C,QAAQ,MAAM,sBAAsB,QAAQ,EAAE,SAAS;EACvD,MAAM,QAAQ,sBAAsB,QAAQ,QAAQ,EAAE;EACtD,MAAM,WAAW,sBAAsB,QAAQ,WAAW,SAAS;CACrE,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,kBAAkB,CAAC;CAkD3C,OAAO;EAAE;EAAO;EAAS,MAhDZ,OAAO,WAAW,WAAW,MAAiC,QAAqB;GAC9F,MAAM,EAAE,KAAK,QAAQ,OACnB,EAAE,GAAG,UAAU;GAEjB,IAAI;GACJ,IAAI;GAEJ,IAAI,CAAC,WAAW;IACd,MAAM,WAAW,OAAO,QAAQ,KAAK,MAAM,MAAM;IAEjD,IAAI,aAAa,KAAA,GAAW,OAAO,KAAA;IACnC,sBAAsB,SAAS,OAAO;IACtC,WAAW,OAAO,QAAQ,UAAU,SAAS,mBAAmB;GAClE;GAEA,MAAM,KAAK,MAAM,GAAG,wBAAwB,GAC1C,KAAK,MAAM,eACX,KAAK,MAAM,kBACX,IAAI,QAAQ,SACZ,IAAI,QAAQ;GAEd,MAAM,aAAa,OAAkB,QACnC,YACI,aAAa,KAAK,MAAM,OAAO,GAAG,GAAG,GAAG,OAAO,EAAE,SAAS,CAAC,IAC3D,MAAM,GAAG,OAAO,KAAK,QAAQ;GAEnC,MAAM,OACJ,OAAO,GAAG,UAAU,GAAG,OAAO,IAAI,EAAE,IAAI,GAAG,OAAO,IAAI,EAAE,IAAI,GAAG,OAAO,IAAI,EAAE,IAAI,IAAI,sBAAsB,GAAG,KAAK,QAAQ,GAAG,KAAK,MAAM,UAAU,IAAI,EAAE,EAAE,EAAE,OAAO,MAAM,cAAc,EAAE,EAAE,aAAa,GAAG,KAAK,MAAM,UAAU,IAAI,EAAE,SAAS,EAAE,OAAO,MAAM,iBAAiB,EAAE,EAAE,SAAS,QAAQ,UAAU,IAAI,MAAM,MAAM,IAAI,YAAY,GAAG,KAAK,GAAG,QAAQ,UAAU,IAAI,EAAE,SAAS,IAAI;GAEhY,IAAI,KAAK,OAAO,KAAA,GAAW,OAAO,KAAA;GAClC,MAAM,SAAS,OAAO,QAAQ,OAAO,MAAM,GAAG,OAAO,KAAK,IAAI,IAAI,CAAC;GAEnE,iBAAiB,aAAa,OAAO,cAAc,mBAAmB;GACtE,MAAM,QAAQ,OAAO,QAAQ,UAAU,SAAS,OAAO,SAAS;GAEhE,MAAM,YAAY,OAAO,MAAM,OAC7B,OAAO,WACP,OACA,KAAK,IACL,KAAK,KAAK,QAAQ,GAAG,OAAO,KAAK,IAAI,CAAC,GACtC,KAAK,EAAE,CAAC,UACV;GAEA,OAAO,cAAc,KAAA,KAAa,UAAU,OAAO,OAAO,kBACtD,KAAA,IACA;IAAE;IAAQ;GAAU;EAC1B,CAE4B;CAAE;AAChC,CAAC"}

package/dist/internal/session-native-record.mjs

@@ -3,6 +3,7 @@ import { sessionInvariant } from "./session-native-state.mjs";
 import { DateTime, Effect, Schema } from "effect";
 import { SecurityRevision, SessionAuthenticationProvenance, SessionCredentialVersion, SessionId, SessionMetadata } from "@yielded/auth/Sessions";
 import { SqlClient } from "effect/sql/SqlClient";
+import { AuthenticationClock } from "@yielded/auth/Operations";
 import { TokenDigest } from "@yielded/auth/Schema";
 //#region src/internal/session-native-record.ts
 const metadataJson = Schema.encodeSync(Schema.fromJsonString(SessionMetadata));
@@ -16,16 +17,17 @@ const makeConditionalSqlInsert = Effect.fnUntraced(function* () {
 		return sql`insert into ${table.name} (${sql.join(", ", false)(fields.map(([key]) => table.columnName(key)))}) select ${sql.join(", ", false)(fields.map(([key, value]) => table.value(key, value)))} where ${condition}`;
 	};
 });
-/** Security columns identify the row and own its live time bounds. In particular
-* issuedAt may be assigned by UPDATE's database clock without rewriting a JSON
-* copy of prepared metadata. Claims/provenance decoding remains consumer-owned. */
+/** Security columns own live time bounds and commit-time issuedAt adjustments,
+* independently of prepared JSON metadata. Claims/provenance decoding remains consumer-owned. */
 const makeNativeSessionRecords = Effect.fnUntraced(function* (tables, mapping) {
 	const sql = (yield* SqlClient).withoutTransforms();
+	const { futureToleranceMillis } = yield* AuthenticationClock;
 	const s = mapping.session, table = tables(s.table), now = tables.expression(mapping.clock.engineNowMillis);
 	const exact = (t, key, value) => exactSqlText(sql, t.column(key), t.value(key, value));
 	const millis = (t, key) => tables.expression(mapping.clock.toMillis(t.column(key)));
 	const live = (t) => sql.and([
-		sql`${millis(t, s.issuedAt)} <= ${now}`,
+		sql`${millis(t, s.issuedAt)} <= ${now} + ${futureToleranceMillis}`,
+		sql`${millis(t, s.issuedAt)} < ${millis(t, s.expiresAt)}`,
 		sql`${millis(t, s.expiresAt)} > ${now}`,
 		sql`${millis(t, s.absoluteExpiresAt)} >= ${millis(t, s.expiresAt)}`
 	]);

package/dist/internal/session-native-record.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"session-native-record.mjs","names":[],"sources":["../../src/internal/session-native-record.ts"],"sourcesContent":["import { TokenDigest } from \"@yielded/auth/Schema\";\nimport {\n  SessionId,\n  SessionMetadata,\n  SessionAuthenticationProvenance,\n  SessionCredentialVersion,\n  SecurityRevision,\n  type StatefulSessionRecord,\n} from \"@yielded/auth/Sessions\";\nimport { DateTime, Effect, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql/SqlClient\";\nimport type { Fragment } from \"effect/sql/Statement\";\n\nimport type { SubjectIdCodec } from \"./models/common\";\nimport type { StatefulSessionTables, SessionExecution } from \"./models/session-model\";\nimport type { NativeSqlTables, SqlTable } from \"./native-sql-table\";\nimport { sessionInvariant } from \"./session-native-state\";\nimport { exactSqlText } from \"./sql-change\";\nimport type { AnyTableModel } from \"./table-model\";\n\nexport type NativeSessionRecordMapping<Claims> = StatefulSessionTables<\n  Claims,\n  AnyTableModel,\n  unknown,\n  unknown\n> &\n  Pick<SessionExecution, \"clock\"> & { readonly subjectId: SubjectIdCodec<unknown> };\n\nconst metadataJson = Schema.encodeSync(Schema.fromJsonString(SessionMetadata));\nconst provenanceJson = Schema.encodeSync(Schema.fromJsonString(SessionAuthenticationProvenance));\n\nexport const sameSessionRecord = <Claims>(\n  left: StatefulSessionRecord<Claims>,\n  right: StatefulSessionRecord<Claims>,\n) =>\n  left.digest === right.digest &&\n  left.credentialVersion === right.credentialVersion &&\n  metadataJson(left) === metadataJson(right) &&\n  provenanceJson(left.provenance) === provenanceJson(right.provenance);\n\nexport const makeConditionalSqlInsert = Effect.fnUntraced(function* () {\n  const sql = (yield* SqlClient).withoutTransforms();\n\n  return (table: SqlTable, values: Readonly<Record<string, unknown>>, condition: Fragment) => {\n    const fields = Object.entries(values).filter(([, value]) => value !== undefined);\n\n    sessionInvariant(fields.length > 0);\n\n    return sql`insert into ${table.name} (${sql.join(\", \", false)(fields.map(([key]) => table.columnName(key)))}) select ${sql.join(\", \", false)(fields.map(([key, value]) => table.value(key, value)))} where ${condition}`;\n  };\n});\n\n/** Security columns identify the row and own its live time bounds. In particular\n * issuedAt may be assigned by UPDATE's database clock without rewriting a JSON\n * copy of prepared metadata. Claims/provenance decoding remains consumer-owned. */\nexport const makeNativeSessionRecords = Effect.fnUntraced(function* <Claims>(\n  tables: NativeSqlTables,\n  mapping: NativeSessionRecordMapping<Claims>,\n) {\n  const sql = (yield* SqlClient).withoutTransforms();\n\n  const s = mapping.session,\n    table = tables(s.table),\n    now = tables.expression(mapping.clock.engineNowMillis);\n\n  const exact = (t: SqlTable, key: string, value: unknown) =>\n    exactSqlText(sql, t.column(key), t.value(key, value));\n\n  const millis = (t: SqlTable, key: string) =>\n    tables.expression(mapping.clock.toMillis(t.column(key)));\n\n  const live = (t: SqlTable) =>\n    sql.and([\n      sql`${millis(t, s.issuedAt)} <= ${now}`,\n      sql`${millis(t, s.expiresAt)} > ${now}`,\n      sql`${millis(t, s.absoluteExpiresAt)} >= ${millis(t, s.expiresAt)}`,\n    ]);\n\n  const decode = Effect.fnUntraced(function* (row: Record<string, unknown>) {\n    const decoded = yield* s.decode(row);\n    const subjectId = yield* mapping.subjectId.toSubject(row[s.subjectId]);\n    const sessionId = yield* mapping.sessionId.toSession(row[s.sessionId]);\n    const digest = yield* Schema.decodeUnknownEffect(TokenDigest)(row[s.digest]);\n    const revision = yield* Schema.decodeUnknownEffect(SecurityRevision)(row[s.securityRevision]);\n    const issuedAt = DateTime.makeUnsafe(mapping.clock.decodeInstant(row[s.issuedAt]));\n    const expiresAt = mapping.clock.decodeInstant(row[s.expiresAt]);\n    const absolute = mapping.clock.decodeInstant(row[s.absoluteExpiresAt]);\n\n    sessionInvariant(\n      decoded.subjectId === subjectId &&\n        decoded.sessionId === sessionId &&\n        decoded.digest === digest &&\n        decoded.securityRevision === revision &&\n        DateTime.toEpochMillis(decoded.expiresAt) === expiresAt &&\n        DateTime.toEpochMillis(decoded.absoluteExpiresAt) === absolute,\n    );\n    yield* Schema.decodeEffect(SessionId)(sessionId);\n    yield* Schema.decodeEffect(SessionCredentialVersion)(decoded.credentialVersion);\n\n    return { ...decoded, issuedAt };\n  });\n\n  const owner = Effect.fnUntraced(function* (\n    record: Pick<StatefulSessionRecord<Claims>, \"subjectId\" | \"sessionId\" | \"digest\">,\n  ) {\n    const nativeSubject = yield* mapping.subjectId.toNative(record.subjectId),\n      nativeSession = yield* mapping.sessionId.toNative(record.sessionId);\n\n    return sql.and([\n      sql`${table.column(s.subjectId)} = ${table.value(s.subjectId, nativeSubject)}`,\n      sql`${table.column(s.sessionId)} = ${table.value(s.sessionId, nativeSession)}`,\n      exact(table, s.digest, record.digest),\n    ]);\n  });\n\n  // These are the semantic values supplied by the session encoder for this\n  // write, not an observed whole-row snapshot or unrelated application columns.\n  const encodedCondition = (values: Readonly<Record<string, unknown>>) =>\n    sql.and(\n      Object.entries(values)\n        .filter(([, value]) => value !== undefined)\n        .map(([key, value]) =>\n          value === null\n            ? sql`${table.column(key)} is null`\n            : typeof value === \"string\"\n              ? exact(table, key, value)\n              : sql`${table.column(key)} = ${table.value(key, value)}`,\n        ),\n    );\n\n  const read = Effect.fnUntraced(function* (digest: TokenDigest) {\n    const rows =\n      yield* sql`select ${table.fields(\"session_\")} from ${table.name} where ${exact(table, s.digest, digest)} and ${live(table)} limit 2`;\n\n    sessionInvariant(rows.length <= 1);\n\n    return rows[0] === undefined ? undefined : yield* decode(table.decode(rows[0], \"session_\"));\n  });\n\n  return { sql, s, table, now, exact, millis, live, decode, owner, read, encodedCondition };\n});\n"],"mappings":";;;;;;;AA4BA,MAAM,eAAe,OAAO,WAAW,OAAO,eAAe,eAAe,CAAC;AAC7E,MAAM,iBAAiB,OAAO,WAAW,OAAO,eAAe,+BAA+B,CAAC;AAE/F,MAAa,qBACX,MACA,UAEA,KAAK,WAAW,MAAM,UACtB,KAAK,sBAAsB,MAAM,qBACjC,aAAa,IAAI,MAAM,aAAa,KAAK,KACzC,eAAe,KAAK,UAAU,MAAM,eAAe,MAAM,UAAU;AAErE,MAAa,2BAA2B,OAAO,WAAW,aAAa;CACrE,MAAM,OAAO,OAAO,UAAA,CAAW,kBAAkB;CAEjD,QAAQ,OAAiB,QAA2C,cAAwB;EAC1F,MAAM,SAAS,OAAO,QAAQ,MAAM,CAAC,CAAC,QAAQ,GAAG,WAAW,UAAU,KAAA,CAAS;EAE/E,iBAAiB,OAAO,SAAS,CAAC;EAElC,OAAO,GAAG,eAAe,MAAM,KAAK,IAAI,IAAI,KAAK,MAAM,KAAK,CAAC,CAAC,OAAO,KAAK,CAAC,SAAS,MAAM,WAAW,GAAG,CAAC,CAAC,EAAE,WAAW,IAAI,KAAK,MAAM,KAAK,CAAC,CAAC,OAAO,KAAK,CAAC,KAAK,WAAW,MAAM,MAAM,KAAK,KAAK,CAAC,CAAC,EAAE,SAAS;CAC/M;AACF,CAAC;;;;AAKD,MAAa,2BAA2B,OAAO,WAAW,WACxD,QACA,SACA;CACA,MAAM,OAAO,OAAO,UAAA,CAAW,kBAAkB;CAEjD,MAAM,IAAI,QAAQ,SAChB,QAAQ,OAAO,EAAE,KAAK,GACtB,MAAM,OAAO,WAAW,QAAQ,MAAM,eAAe;CAEvD,MAAM,SAAS,GAAa,KAAa,UACvC,aAAa,KAAK,EAAE,OAAO,GAAG,GAAG,EAAE,MAAM,KAAK,KAAK,CAAC;CAEtD,MAAM,UAAU,GAAa,QAC3B,OAAO,WAAW,QAAQ,MAAM,SAAS,EAAE,OAAO,GAAG,CAAC,CAAC;CAEzD,MAAM,QAAQ,MACZ,IAAI,IAAI;EACN,GAAG,GAAG,OAAO,GAAG,EAAE,QAAQ,EAAE,MAAM;EAClC,GAAG,GAAG,OAAO,GAAG,EAAE,SAAS,EAAE,KAAK;EAClC,GAAG,GAAG,OAAO,GAAG,EAAE,iBAAiB,EAAE,MAAM,OAAO,GAAG,EAAE,SAAS;CAClE,CAAC;CAEH,MAAM,SAAS,OAAO,WAAW,WAAW,KAA8B;EACxE,MAAM,UAAU,OAAO,EAAE,OAAO,GAAG;EACnC,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,IAAI,EAAE,UAAU;EACrE,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,IAAI,EAAE,UAAU;EACrE,MAAM,SAAS,OAAO,OAAO,oBAAoB,WAAW,CAAC,CAAC,IAAI,EAAE,OAAO;EAC3E,MAAM,WAAW,OAAO,OAAO,oBAAoB,gBAAgB,CAAC,CAAC,IAAI,EAAE,iBAAiB;EAC5F,MAAM,WAAW,SAAS,WAAW,QAAQ,MAAM,cAAc,IAAI,EAAE,SAAS,CAAC;EACjF,MAAM,YAAY,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU;EAC9D,MAAM,WAAW,QAAQ,MAAM,cAAc,IAAI,EAAE,kBAAkB;EAErE,iBACE,QAAQ,cAAc,aACpB,QAAQ,cAAc,aACtB,QAAQ,WAAW,UACnB,QAAQ,qBAAqB,YAC7B,SAAS,cAAc,QAAQ,SAAS,MAAM,aAC9C,SAAS,cAAc,QAAQ,iBAAiB,MAAM,QAC1D;EACA,OAAO,OAAO,aAAa,SAAS,CAAC,CAAC,SAAS;EAC/C,OAAO,OAAO,aAAa,wBAAwB,CAAC,CAAC,QAAQ,iBAAiB;EAE9E,OAAO;GAAE,GAAG;GAAS;EAAS;CAChC,CAAC;CAED,MAAM,QAAQ,OAAO,WAAW,WAC9B,QACA;EACA,MAAM,gBAAgB,OAAO,QAAQ,UAAU,SAAS,OAAO,SAAS,GACtE,gBAAgB,OAAO,QAAQ,UAAU,SAAS,OAAO,SAAS;EAEpE,OAAO,IAAI,IAAI;GACb,GAAG,GAAG,MAAM,OAAO,EAAE,SAAS,EAAE,KAAK,MAAM,MAAM,EAAE,WAAW,aAAa;GAC3E,GAAG,GAAG,MAAM,OAAO,EAAE,SAAS,EAAE,KAAK,MAAM,MAAM,EAAE,WAAW,aAAa;GAC3E,MAAM,OAAO,EAAE,QAAQ,OAAO,MAAM;EACtC,CAAC;CACH,CAAC;CAID,MAAM,oBAAoB,WACxB,IAAI,IACF,OAAO,QAAQ,MAAM,CAAC,CACnB,QAAQ,GAAG,WAAW,UAAU,KAAA,CAAS,CAAC,CAC1C,KAAK,CAAC,KAAK,WACV,UAAU,OACN,GAAG,GAAG,MAAM,OAAO,GAAG,EAAE,YACxB,OAAO,UAAU,WACf,MAAM,OAAO,KAAK,KAAK,IACvB,GAAG,GAAG,MAAM,OAAO,GAAG,EAAE,KAAK,MAAM,MAAM,KAAK,KAAK,GAC3D,CACJ;CAWF,OAAO;EAAE;EAAK;EAAG;EAAO;EAAK;EAAO;EAAQ;EAAM;EAAQ;EAAO,MATpD,OAAO,WAAW,WAAW,QAAqB;GAC7D,MAAM,OACJ,OAAO,GAAG,UAAU,MAAM,OAAO,UAAU,EAAE,QAAQ,MAAM,KAAK,SAAS,MAAM,OAAO,EAAE,QAAQ,MAAM,EAAE,OAAO,KAAK,KAAK,EAAE;GAE7H,iBAAiB,KAAK,UAAU,CAAC;GAEjC,OAAO,KAAK,OAAO,KAAA,IAAY,KAAA,IAAY,OAAO,OAAO,MAAM,OAAO,KAAK,IAAI,UAAU,CAAC;EAC5F,CAEoE;EAAG;CAAiB;AAC1F,CAAC"}
+{"version":3,"file":"session-native-record.mjs","names":[],"sources":["../../src/internal/session-native-record.ts"],"sourcesContent":["import { AuthenticationClock } from \"@yielded/auth/Operations\";\nimport { TokenDigest } from \"@yielded/auth/Schema\";\nimport {\n  SessionId,\n  SessionMetadata,\n  SessionAuthenticationProvenance,\n  SessionCredentialVersion,\n  SecurityRevision,\n  type StatefulSessionRecord,\n} from \"@yielded/auth/Sessions\";\nimport { DateTime, Effect, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql/SqlClient\";\nimport type { Fragment } from \"effect/sql/Statement\";\n\nimport type { SubjectIdCodec } from \"./models/common\";\nimport type { StatefulSessionTables, SessionExecution } from \"./models/session-model\";\nimport type { NativeSqlTables, SqlTable } from \"./native-sql-table\";\nimport { sessionInvariant } from \"./session-native-state\";\nimport { exactSqlText } from \"./sql-change\";\nimport type { AnyTableModel } from \"./table-model\";\n\nexport type NativeSessionRecordMapping<Claims> = StatefulSessionTables<\n  Claims,\n  AnyTableModel,\n  unknown,\n  unknown\n> &\n  Pick<SessionExecution, \"clock\"> & { readonly subjectId: SubjectIdCodec<unknown> };\n\nconst metadataJson = Schema.encodeSync(Schema.fromJsonString(SessionMetadata));\nconst provenanceJson = Schema.encodeSync(Schema.fromJsonString(SessionAuthenticationProvenance));\n\nexport const sameSessionRecord = <Claims>(\n  left: StatefulSessionRecord<Claims>,\n  right: StatefulSessionRecord<Claims>,\n) =>\n  left.digest === right.digest &&\n  left.credentialVersion === right.credentialVersion &&\n  metadataJson(left) === metadataJson(right) &&\n  provenanceJson(left.provenance) === provenanceJson(right.provenance);\n\nexport const makeConditionalSqlInsert = Effect.fnUntraced(function* () {\n  const sql = (yield* SqlClient).withoutTransforms();\n\n  return (table: SqlTable, values: Readonly<Record<string, unknown>>, condition: Fragment) => {\n    const fields = Object.entries(values).filter(([, value]) => value !== undefined);\n\n    sessionInvariant(fields.length > 0);\n\n    return sql`insert into ${table.name} (${sql.join(\", \", false)(fields.map(([key]) => table.columnName(key)))}) select ${sql.join(\", \", false)(fields.map(([key, value]) => table.value(key, value)))} where ${condition}`;\n  };\n});\n\n/** Security columns own live time bounds and commit-time issuedAt adjustments,\n * independently of prepared JSON metadata. Claims/provenance decoding remains consumer-owned. */\nexport const makeNativeSessionRecords = Effect.fnUntraced(function* <Claims>(\n  tables: NativeSqlTables,\n  mapping: NativeSessionRecordMapping<Claims>,\n) {\n  const sql = (yield* SqlClient).withoutTransforms();\n  const { futureToleranceMillis } = yield* AuthenticationClock;\n\n  const s = mapping.session,\n    table = tables(s.table),\n    now = tables.expression(mapping.clock.engineNowMillis);\n\n  const exact = (t: SqlTable, key: string, value: unknown) =>\n    exactSqlText(sql, t.column(key), t.value(key, value));\n\n  const millis = (t: SqlTable, key: string) =>\n    tables.expression(mapping.clock.toMillis(t.column(key)));\n\n  const live = (t: SqlTable) =>\n    sql.and([\n      sql`${millis(t, s.issuedAt)} <= ${now} + ${futureToleranceMillis}`,\n      sql`${millis(t, s.issuedAt)} < ${millis(t, s.expiresAt)}`,\n      sql`${millis(t, s.expiresAt)} > ${now}`,\n      sql`${millis(t, s.absoluteExpiresAt)} >= ${millis(t, s.expiresAt)}`,\n    ]);\n\n  const decode = Effect.fnUntraced(function* (row: Record<string, unknown>) {\n    const decoded = yield* s.decode(row);\n    const subjectId = yield* mapping.subjectId.toSubject(row[s.subjectId]);\n    const sessionId = yield* mapping.sessionId.toSession(row[s.sessionId]);\n    const digest = yield* Schema.decodeUnknownEffect(TokenDigest)(row[s.digest]);\n    const revision = yield* Schema.decodeUnknownEffect(SecurityRevision)(row[s.securityRevision]);\n    const issuedAt = DateTime.makeUnsafe(mapping.clock.decodeInstant(row[s.issuedAt]));\n    const expiresAt = mapping.clock.decodeInstant(row[s.expiresAt]);\n    const absolute = mapping.clock.decodeInstant(row[s.absoluteExpiresAt]);\n\n    sessionInvariant(\n      decoded.subjectId === subjectId &&\n        decoded.sessionId === sessionId &&\n        decoded.digest === digest &&\n        decoded.securityRevision === revision &&\n        DateTime.toEpochMillis(decoded.expiresAt) === expiresAt &&\n        DateTime.toEpochMillis(decoded.absoluteExpiresAt) === absolute,\n    );\n    yield* Schema.decodeEffect(SessionId)(sessionId);\n    yield* Schema.decodeEffect(SessionCredentialVersion)(decoded.credentialVersion);\n\n    return { ...decoded, issuedAt };\n  });\n\n  const owner = Effect.fnUntraced(function* (\n    record: Pick<StatefulSessionRecord<Claims>, \"subjectId\" | \"sessionId\" | \"digest\">,\n  ) {\n    const nativeSubject = yield* mapping.subjectId.toNative(record.subjectId),\n      nativeSession = yield* mapping.sessionId.toNative(record.sessionId);\n\n    return sql.and([\n      sql`${table.column(s.subjectId)} = ${table.value(s.subjectId, nativeSubject)}`,\n      sql`${table.column(s.sessionId)} = ${table.value(s.sessionId, nativeSession)}`,\n      exact(table, s.digest, record.digest),\n    ]);\n  });\n\n  // These are the semantic values supplied by the session encoder for this\n  // write, not an observed whole-row snapshot or unrelated application columns.\n  const encodedCondition = (values: Readonly<Record<string, unknown>>) =>\n    sql.and(\n      Object.entries(values)\n        .filter(([, value]) => value !== undefined)\n        .map(([key, value]) =>\n          value === null\n            ? sql`${table.column(key)} is null`\n            : typeof value === \"string\"\n              ? exact(table, key, value)\n              : sql`${table.column(key)} = ${table.value(key, value)}`,\n        ),\n    );\n\n  const read = Effect.fnUntraced(function* (digest: TokenDigest) {\n    const rows =\n      yield* sql`select ${table.fields(\"session_\")} from ${table.name} where ${exact(table, s.digest, digest)} and ${live(table)} limit 2`;\n\n    sessionInvariant(rows.length <= 1);\n\n    return rows[0] === undefined ? undefined : yield* decode(table.decode(rows[0], \"session_\"));\n  });\n\n  return { sql, s, table, now, exact, millis, live, decode, owner, read, encodedCondition };\n});\n"],"mappings":";;;;;;;;AA6BA,MAAM,eAAe,OAAO,WAAW,OAAO,eAAe,eAAe,CAAC;AAC7E,MAAM,iBAAiB,OAAO,WAAW,OAAO,eAAe,+BAA+B,CAAC;AAE/F,MAAa,qBACX,MACA,UAEA,KAAK,WAAW,MAAM,UACtB,KAAK,sBAAsB,MAAM,qBACjC,aAAa,IAAI,MAAM,aAAa,KAAK,KACzC,eAAe,KAAK,UAAU,MAAM,eAAe,MAAM,UAAU;AAErE,MAAa,2BAA2B,OAAO,WAAW,aAAa;CACrE,MAAM,OAAO,OAAO,UAAA,CAAW,kBAAkB;CAEjD,QAAQ,OAAiB,QAA2C,cAAwB;EAC1F,MAAM,SAAS,OAAO,QAAQ,MAAM,CAAC,CAAC,QAAQ,GAAG,WAAW,UAAU,KAAA,CAAS;EAE/E,iBAAiB,OAAO,SAAS,CAAC;EAElC,OAAO,GAAG,eAAe,MAAM,KAAK,IAAI,IAAI,KAAK,MAAM,KAAK,CAAC,CAAC,OAAO,KAAK,CAAC,SAAS,MAAM,WAAW,GAAG,CAAC,CAAC,EAAE,WAAW,IAAI,KAAK,MAAM,KAAK,CAAC,CAAC,OAAO,KAAK,CAAC,KAAK,WAAW,MAAM,MAAM,KAAK,KAAK,CAAC,CAAC,EAAE,SAAS;CAC/M;AACF,CAAC;;;AAID,MAAa,2BAA2B,OAAO,WAAW,WACxD,QACA,SACA;CACA,MAAM,OAAO,OAAO,UAAA,CAAW,kBAAkB;CACjD,MAAM,EAAE,0BAA0B,OAAO;CAEzC,MAAM,IAAI,QAAQ,SAChB,QAAQ,OAAO,EAAE,KAAK,GACtB,MAAM,OAAO,WAAW,QAAQ,MAAM,eAAe;CAEvD,MAAM,SAAS,GAAa,KAAa,UACvC,aAAa,KAAK,EAAE,OAAO,GAAG,GAAG,EAAE,MAAM,KAAK,KAAK,CAAC;CAEtD,MAAM,UAAU,GAAa,QAC3B,OAAO,WAAW,QAAQ,MAAM,SAAS,EAAE,OAAO,GAAG,CAAC,CAAC;CAEzD,MAAM,QAAQ,MACZ,IAAI,IAAI;EACN,GAAG,GAAG,OAAO,GAAG,EAAE,QAAQ,EAAE,MAAM,IAAI,KAAK;EAC3C,GAAG,GAAG,OAAO,GAAG,EAAE,QAAQ,EAAE,KAAK,OAAO,GAAG,EAAE,SAAS;EACtD,GAAG,GAAG,OAAO,GAAG,EAAE,SAAS,EAAE,KAAK;EAClC,GAAG,GAAG,OAAO,GAAG,EAAE,iBAAiB,EAAE,MAAM,OAAO,GAAG,EAAE,SAAS;CAClE,CAAC;CAEH,MAAM,SAAS,OAAO,WAAW,WAAW,KAA8B;EACxE,MAAM,UAAU,OAAO,EAAE,OAAO,GAAG;EACnC,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,IAAI,EAAE,UAAU;EACrE,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,IAAI,EAAE,UAAU;EACrE,MAAM,SAAS,OAAO,OAAO,oBAAoB,WAAW,CAAC,CAAC,IAAI,EAAE,OAAO;EAC3E,MAAM,WAAW,OAAO,OAAO,oBAAoB,gBAAgB,CAAC,CAAC,IAAI,EAAE,iBAAiB;EAC5F,MAAM,WAAW,SAAS,WAAW,QAAQ,MAAM,cAAc,IAAI,EAAE,SAAS,CAAC;EACjF,MAAM,YAAY,QAAQ,MAAM,cAAc,IAAI,EAAE,UAAU;EAC9D,MAAM,WAAW,QAAQ,MAAM,cAAc,IAAI,EAAE,kBAAkB;EAErE,iBACE,QAAQ,cAAc,aACpB,QAAQ,cAAc,aACtB,QAAQ,WAAW,UACnB,QAAQ,qBAAqB,YAC7B,SAAS,cAAc,QAAQ,SAAS,MAAM,aAC9C,SAAS,cAAc,QAAQ,iBAAiB,MAAM,QAC1D;EACA,OAAO,OAAO,aAAa,SAAS,CAAC,CAAC,SAAS;EAC/C,OAAO,OAAO,aAAa,wBAAwB,CAAC,CAAC,QAAQ,iBAAiB;EAE9E,OAAO;GAAE,GAAG;GAAS;EAAS;CAChC,CAAC;CAED,MAAM,QAAQ,OAAO,WAAW,WAC9B,QACA;EACA,MAAM,gBAAgB,OAAO,QAAQ,UAAU,SAAS,OAAO,SAAS,GACtE,gBAAgB,OAAO,QAAQ,UAAU,SAAS,OAAO,SAAS;EAEpE,OAAO,IAAI,IAAI;GACb,GAAG,GAAG,MAAM,OAAO,EAAE,SAAS,EAAE,KAAK,MAAM,MAAM,EAAE,WAAW,aAAa;GAC3E,GAAG,GAAG,MAAM,OAAO,EAAE,SAAS,EAAE,KAAK,MAAM,MAAM,EAAE,WAAW,aAAa;GAC3E,MAAM,OAAO,EAAE,QAAQ,OAAO,MAAM;EACtC,CAAC;CACH,CAAC;CAID,MAAM,oBAAoB,WACxB,IAAI,IACF,OAAO,QAAQ,MAAM,CAAC,CACnB,QAAQ,GAAG,WAAW,UAAU,KAAA,CAAS,CAAC,CAC1C,KAAK,CAAC,KAAK,WACV,UAAU,OACN,GAAG,GAAG,MAAM,OAAO,GAAG,EAAE,YACxB,OAAO,UAAU,WACf,MAAM,OAAO,KAAK,KAAK,IACvB,GAAG,GAAG,MAAM,OAAO,GAAG,EAAE,KAAK,MAAM,MAAM,KAAK,KAAK,GAC3D,CACJ;CAWF,OAAO;EAAE;EAAK;EAAG;EAAO;EAAK;EAAO;EAAQ;EAAM;EAAQ;EAAO,MATpD,OAAO,WAAW,WAAW,QAAqB;GAC7D,MAAM,OACJ,OAAO,GAAG,UAAU,MAAM,OAAO,UAAU,EAAE,QAAQ,MAAM,KAAK,SAAS,MAAM,OAAO,EAAE,QAAQ,MAAM,EAAE,OAAO,KAAK,KAAK,EAAE;GAE7H,iBAAiB,KAAK,UAAU,CAAC;GAEjC,OAAO,KAAK,OAAO,KAAA,IAAY,KAAA,IAAY,OAAO,OAAO,MAAM,OAAO,KAAK,IAAI,UAAU,CAAC;EAC5F,CAEoE;EAAG;CAAiB;AAC1F,CAAC"}

package/dist/internal/session-native-state.mjs

@@ -1,9 +1,13 @@
 import { PersistenceMappingError } from "./mapping-error.mjs";
+import { nativeSqlAlias } from "./native-sql-table.mjs";
 import { anySqlCondition, exactSqlText } from "./sql-change.mjs";
+import { guardSqlitePolicy } from "./sqlite-policy-guard.mjs";
 import { Cause, DateTime, Effect, Schema } from "effect";
+import { fragment, parameter } from "effect/sql/Statement";
 import { reportAuthFailure } from "@yielded/auth/Persistence";
 import { AuthenticationRevision, PendingAuthenticationInvalid, SessionConflict, SessionInvalid, SessionStepUpInvalid, SessionUnavailable, StaleAuthentication, assessAuthentication } from "@yielded/auth/Sessions";
 import { SqlClient } from "effect/sql/SqlClient";
+import { AuthenticationClock } from "@yielded/auth/Operations";
 //#region src/internal/session-native-state.ts
 const sessionUnavailable = () => SessionUnavailable.make({});
 const sessionInvariant = (condition) => {
@@ -22,6 +26,7 @@ const sameSessionRevision = (left, right) => left.subjectId === right.subjectId
 * precede every credential lock, including inside an application coordinator. */
 const makeNativeSessionAuthorityState = Effect.fnUntraced(function* (tables, mapping, batch = false) {
 	const sql = (yield* SqlClient).withoutTransforms();
+	const clockPolicy = yield* AuthenticationClock;
 	const s = mapping.subject, c = mapping.credential;
 	if (batch) sessionInvariant(s.requirementColumns !== void 0);
 	const subject = tables(s.table), credential = tables(c.table);
@@ -44,7 +49,8 @@ const makeNativeSessionAuthorityState = Effect.fnUntraced(function* (tables, map
 		return id(table, c.status, c.activeStatusValue);
 	};
 	const requested = (table, ids) => anySqlCondition(ids.map((value) => exact(table, c.credentialId, value)));
-	const decode = Effect.fnUntraced(function* (subjectId, native, row, factors, instant) {
+	const decode = Effect.fnUntraced(function* (subjectId, native, projected, factors, instant) {
+		const row = subject.decode(projected, "s_");
 		sessionInvariant((yield* mapping.subjectId.toSubject(row[s.id])) === subjectId);
 		if (!s.isActiveStatus(row[s.status])) return void 0;
 		const credentials = [];
@@ -66,6 +72,10 @@ const makeNativeSessionAuthorityState = Effect.fnUntraced(function* (tables, map
 		return {
 			native,
 			row,
+			policyValues: batch ? (s.requirementColumns ?? []).map((key) => ({
+				column: subject.selectedColumn(key),
+				value: fragment([parameter(projected[nativeSqlAlias("s_", subject.keys.indexOf(key))])])
+			})) : [],
 			revision: yield* Schema.decodeUnknownEffect(AuthenticationRevision)({
 				subjectId,
 				securityRevision: row[s.securityRevision],
@@ -83,17 +93,22 @@ const makeNativeSessionAuthorityState = Effect.fnUntraced(function* (tables, map
 			sessionInvariant(owners.length <= 1);
 			if (owners[0] === void 0) return void 0;
 			const factors = yield* sql`select ${credential.fields("c_")} from ${credential.name} where ${id(credential, c.subjectId, native)} and ${activeCredential(credential)} order by ${credential.column(c.credentialId)} limit 65 ${lock}`;
-			return yield* decode(subjectId, native, subject.decode(owners[0], "s_"), factors.map((row) => credential.decode(row, "c_")), owners[0].engine_now);
+			return yield* decode(subjectId, native, owners[0], factors.map((row) => credential.decode(row, "c_")), owners[0].engine_now);
 		}
 		const rows = yield* sql`select ${joinedSubject.fields("s_")}, ${joinedCredential.fields("c_")}, ${now} as engine_now from ${joinedSubject.name} left join ${joinedCredential.name} on ${id(joinedCredential, c.subjectId, native)} and ${activeCredential(joinedCredential)} where ${id(joinedSubject, s.id, native)} and ${activeSubject(joinedSubject)} limit 65`;
 		if (rows[0] === void 0) return void 0;
-		return yield* decode(subjectId, native, joinedSubject.decode(rows[0], "s_"), rows.map((row) => joinedCredential.decode(row, "c_")), rows[0].engine_now);
+		return yield* decode(subjectId, native, rows[0], rows.map((row) => joinedCredential.decode(row, "c_")), rows[0].engine_now);
 	});
-	const policyCondition = (row, native) => {
-		if (!batch) return sql`1 = 1`;
+	const guardPolicy = Effect.fnUntraced(function* (current) {
+		if (!batch) return;
 		sessionInvariant(s.requirementColumns !== void 0);
-		return sql`exists(select 1 from ${subject.name} where ${id(subject, s.id, native)} and ${sql.and(s.requirementColumns.map((key) => row[key] === null ? sql`${subject.column(key)} is null` : typeof row[key] === "string" ? exact(subject, key, row[key]) : id(subject, key, row[key])))})`;
-	};
+		yield* guardSqlitePolicy({
+			name: "session-subject-policy",
+			table: subject.name,
+			owner: id(subject, s.id, current.native),
+			values: current.policyValues
+		});
+	});
 	const authorityCondition = (revision, native) => sql.and([
 		sql`exists(select 1 from ${subject.name} where ${id(subject, s.id, native)} and ${exact(subject, s.securityRevision, revision.securityRevision)} and ${activeSubject(subject)})`,
 		sql`(select count(*) from ${credential.name} where ${id(credential, c.subjectId, native)} and ${activeCredential(credential)}) = ${revision.credentials.length}`,
@@ -101,6 +116,7 @@ const makeNativeSessionAuthorityState = Effect.fnUntraced(function* (tables, map
 	]);
 	return {
 		sql,
+		clockPolicy,
 		subject,
 		credential,
 		joinedSubject,
@@ -116,7 +132,7 @@ const makeNativeSessionAuthorityState = Effect.fnUntraced(function* (tables, map
 		decode,
 		read,
 		authorityCondition,
-		policyCondition
+		guardPolicy
 	};
 });
 /** Evaluate freshness at the database sample. The final write also enforces the

package/dist/internal/session-native-state.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"session-native-state.mjs","names":[],"sources":["../../src/internal/session-native-state.ts"],"sourcesContent":["import { reportAuthFailure } from \"@yielded/auth/Persistence\";\nimport type { SubjectId } from \"@yielded/auth/Schema\";\nimport {\n  type AuthenticationRequirement,\n  AuthenticationRevision,\n  SessionConflict,\n  SessionInvalid,\n  SessionUnavailable,\n  SessionStepUpInvalid,\n  PendingAuthenticationInvalid,\n  StaleAuthentication,\n  assessAuthentication,\n  type AuthenticationEvidence,\n} from \"@yielded/auth/Sessions\";\nimport { Cause, Effect, Schema, DateTime } from \"effect\";\nimport { SqlClient } from \"effect/sql/SqlClient\";\nimport type { Fragment } from \"effect/sql/Statement\";\n\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport type { SessionAuthorityTables, SessionExecution } from \"./models/session-model\";\nimport type { NativeSqlTables, SqlTable } from \"./native-sql-table\";\nimport { anySqlCondition, exactSqlText } from \"./sql-change\";\nimport type { AnyTableModel } from \"./table-model\";\n\nexport const sessionUnavailable = () => SessionUnavailable.make({});\n\nexport const sessionInvariant: (condition: unknown) => asserts condition = (condition) => {\n  if (!condition)\n    throw PersistenceMappingError.make({ operation: \"decode\", cause: \"Invalid session authority\" });\n};\n\nexport type SessionDomainFailure =\n  | SessionConflict\n  | SessionInvalid\n  | SessionUnavailable\n  | SessionStepUpInvalid\n  | PendingAuthenticationInvalid\n  | StaleAuthentication;\n\nconst isDomainFailure = (error: unknown): error is SessionDomainFailure =>\n  Schema.is(SessionConflict)(error) ||\n  Schema.is(SessionInvalid)(error) ||\n  Schema.is(SessionUnavailable)(error) ||\n  Schema.is(SessionStepUpInvalid)(error) ||\n  Schema.is(PendingAuthenticationInvalid)(error) ||\n  Schema.is(StaleAuthentication)(error);\n\n/** Only schema-checked domain failures cross the owner boundary; SQL/mapping\n * failures remain Unavailable. The executor preserves every mixed cause reason. */\nexport const sessionFailure = <E>(\n  error: E,\n): Extract<E, SessionDomainFailure> | SessionUnavailable =>\n  isDomainFailure(error) ? (error as Extract<E, SessionDomainFailure>) : sessionUnavailable();\n\nexport const normalizeSessionOperation = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n  effect.pipe(\n    Effect.tapError((error) =>\n      isDomainFailure(error)\n        ? Effect.void\n        : reportAuthFailure(\"auth-persistence\", Cause.fail(error)),\n    ),\n    Effect.mapError(sessionFailure),\n  );\n\nexport type NativeSessionAuthorityMapping = SessionAuthorityTables<\n  AnyTableModel,\n  AnyTableModel,\n  unknown\n> &\n  SessionExecution;\n\nexport interface NativeSessionAuthority {\n  readonly native: unknown;\n  readonly row: Record<string, unknown>;\n  readonly revision: AuthenticationRevision;\n  readonly requirement: AuthenticationRequirement;\n  readonly now: number;\n}\n\nexport const sameSessionRevision = (left: AuthenticationRevision, right: AuthenticationRevision) =>\n  left.subjectId === right.subjectId &&\n  left.securityRevision === right.securityRevision &&\n  left.credentials.length === right.credentials.length &&\n  new Set(left.credentials.map((f) => f.credentialId)).size === left.credentials.length &&\n  left.credentials.every((f) =>\n    right.credentials.some(\n      (other) => other.credentialId === f.credentialId && other.revision === f.revision,\n    ),\n  );\n\n/** Known-subject joins bind each physical ID column independently. Subject locks\n * precede every credential lock, including inside an application coordinator. */\nexport const makeNativeSessionAuthorityState = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: NativeSessionAuthorityMapping,\n  batch = false,\n) {\n  const sql = (yield* SqlClient).withoutTransforms();\n\n  const s = mapping.subject,\n    c = mapping.credential;\n\n  if (batch) sessionInvariant(s.requirementColumns !== undefined);\n\n  const subject = tables(s.table),\n    credential = tables(c.table);\n\n  const joinedSubject = subject.as(\"session_subject\"),\n    joinedCredential = credential.as(\"session_factor\");\n\n  const now = tables.expression(mapping.clock.engineNowMillis);\n  const lock = sql.onDialectOrElse({ sqlite: () => sql``, orElse: () => sql`for update` });\n  const nativeLocks = !batch && sql.onDialectOrElse({ sqlite: () => false, orElse: () => true });\n\n  const exact = (table: SqlTable, key: string, value: unknown) =>\n    exactSqlText(sql, table.column(key), table.value(key, value));\n\n  const id = (table: SqlTable, key: string, value: unknown) =>\n    sql`${table.column(key)} = ${table.value(key, value)}`;\n\n  const activeSubject = (table: SqlTable) => id(table, s.status, s.activeStatusValue);\n\n  const activeCredential = (table: SqlTable) => {\n    if (c.status === undefined) return sql`1 = 1`;\n    sessionInvariant(c.activeStatusValue !== undefined);\n\n    return id(table, c.status, c.activeStatusValue);\n  };\n\n  const requested = (table: SqlTable, ids: ReadonlyArray<string>) =>\n    anySqlCondition(ids.map((value) => exact(table, c.credentialId, value)));\n\n  const decode = Effect.fnUntraced(function* (\n    subjectId: SubjectId,\n    native: unknown,\n    row: Record<string, unknown>,\n    factors: ReadonlyArray<Record<string, unknown>>,\n    instant: unknown,\n  ): Effect.fn.Return<\n    NativeSessionAuthority | undefined,\n    PersistenceMappingError | Schema.SchemaError\n  > {\n    sessionInvariant((yield* mapping.subjectId.toSubject(row[s.id])) === subjectId);\n    if (!s.isActiveStatus(row[s.status])) return undefined;\n    const credentials: { credentialId: string; revision: string }[] = [];\n\n    for (const factor of factors) {\n      if (factor[c.credentialId] === null || factor[c.credentialId] === undefined) continue;\n      sessionInvariant((yield* mapping.subjectId.toSubject(factor[c.subjectId])) === subjectId);\n      if (c.status !== undefined) sessionInvariant(c.isActiveStatus?.(factor[c.status]) === true);\n\n      const value = yield* Schema.decodeUnknownEffect(\n        Schema.Struct({ credentialId: Schema.String, revision: Schema.String }),\n      )({ credentialId: factor[c.credentialId], revision: factor[c.revision] });\n\n      sessionInvariant(!credentials.some((other) => other.credentialId === value.credentialId));\n      credentials.push(value);\n    }\n    sessionInvariant(credentials.length <= 64);\n\n    return {\n      native,\n      row,\n      revision: yield* Schema.decodeUnknownEffect(AuthenticationRevision)({\n        subjectId,\n        securityRevision: row[s.securityRevision],\n        credentials: credentials.sort((a, b) => a.credentialId.localeCompare(b.credentialId)),\n      }),\n      requirement: yield* s.decodeRequirement(row),\n      now: yield* Schema.decodeEffect(Schema.Int)(Number(instant)),\n    };\n  });\n\n  const read = Effect.fnUntraced(function* (subjectId: SubjectId, locking = false) {\n    const native = yield* mapping.subjectId.toNative(subjectId);\n\n    sessionInvariant((yield* mapping.subjectId.toSubject(native)) === subjectId);\n    if (locking && nativeLocks) {\n      const owners =\n        yield* sql`select ${subject.fields(\"s_\")}, ${now} as engine_now from ${subject.name} where ${id(subject, s.id, native)} and ${activeSubject(subject)} limit 2 ${lock}`;\n\n      sessionInvariant(owners.length <= 1);\n      if (owners[0] === undefined) return undefined;\n\n      const factors =\n        yield* sql`select ${credential.fields(\"c_\")} from ${credential.name} where ${id(credential, c.subjectId, native)} and ${activeCredential(credential)} order by ${credential.column(c.credentialId)} limit 65 ${lock}`;\n\n      return yield* decode(\n        subjectId,\n        native,\n        subject.decode(owners[0], \"s_\"),\n        factors.map((row) => credential.decode(row, \"c_\")),\n        owners[0].engine_now,\n      );\n    }\n\n    const rows =\n      yield* sql`select ${joinedSubject.fields(\"s_\")}, ${joinedCredential.fields(\"c_\")}, ${now} as engine_now from ${joinedSubject.name} left join ${joinedCredential.name} on ${id(joinedCredential, c.subjectId, native)} and ${activeCredential(joinedCredential)} where ${id(joinedSubject, s.id, native)} and ${activeSubject(joinedSubject)} limit 65`;\n\n    if (rows[0] === undefined) return undefined;\n\n    return yield* decode(\n      subjectId,\n      native,\n      joinedSubject.decode(rows[0], \"s_\"),\n      rows.map((row) => joinedCredential.decode(row, \"c_\")),\n      rows[0].engine_now,\n    );\n  });\n\n  const policyCondition = (row: Record<string, unknown>, native: unknown): Fragment => {\n    if (!batch) return sql`1 = 1`;\n    sessionInvariant(s.requirementColumns !== undefined);\n\n    return sql`exists(select 1 from ${subject.name} where ${id(subject, s.id, native)} and ${sql.and(s.requirementColumns.map((key) => (row[key] === null ? sql`${subject.column(key)} is null` : typeof row[key] === \"string\" ? exact(subject, key, row[key]) : id(subject, key, row[key]))))})`;\n  };\n\n  const authorityCondition = (revision: AuthenticationRevision, native: unknown): Fragment =>\n    sql.and([\n      sql`exists(select 1 from ${subject.name} where ${id(subject, s.id, native)} and ${exact(subject, s.securityRevision, revision.securityRevision)} and ${activeSubject(subject)})`,\n      sql`(select count(*) from ${credential.name} where ${id(credential, c.subjectId, native)} and ${activeCredential(credential)}) = ${revision.credentials.length}`,\n      ...revision.credentials.map(\n        (factor) =>\n          sql`exists(select 1 from ${credential.name} where ${id(credential, c.subjectId, native)} and ${exact(credential, c.credentialId, factor.credentialId)} and ${exact(credential, c.revision, factor.revision)} and ${activeCredential(credential)})`,\n      ),\n    ]);\n\n  return {\n    sql,\n    subject,\n    credential,\n    joinedSubject,\n    joinedCredential,\n    now,\n    lock,\n    nativeLocks,\n    exact,\n    id,\n    activeSubject,\n    activeCredential,\n    requested,\n    decode,\n    read,\n    authorityCondition,\n    policyCondition,\n  };\n});\n\n/** Evaluate freshness at the database sample. The final write also enforces the\n * earliest future boundary at which the same evidence would cease to satisfy. */\nexport const assessSessionAt = Effect.fnUntraced(function* (\n  evidence: AuthenticationEvidence,\n  requirement: AuthenticationRequirement,\n  now: number,\n) {\n  const result = yield* assessAuthentication(evidence, requirement, DateTime.makeUnsafe(now));\n\n  return result;\n});\n"],"mappings":";;;;;;;AAwBA,MAAa,2BAA2B,mBAAmB,KAAK,CAAC,CAAC;AAElE,MAAa,oBAA+D,cAAc;CACxF,IAAI,CAAC,WACH,MAAM,wBAAwB,KAAK;EAAE,WAAW;EAAU,OAAO;CAA4B,CAAC;AAClG;AAUA,MAAM,mBAAmB,UACvB,OAAO,GAAG,eAAe,CAAC,CAAC,KAAK,KAChC,OAAO,GAAG,cAAc,CAAC,CAAC,KAAK,KAC/B,OAAO,GAAG,kBAAkB,CAAC,CAAC,KAAK,KACnC,OAAO,GAAG,oBAAoB,CAAC,CAAC,KAAK,KACrC,OAAO,GAAG,4BAA4B,CAAC,CAAC,KAAK,KAC7C,OAAO,GAAG,mBAAmB,CAAC,CAAC,KAAK;;;AAItC,MAAa,kBACX,UAEA,gBAAgB,KAAK,IAAK,QAA6C,mBAAmB;AAE5F,MAAa,6BAAsC,WACjD,OAAO,KACL,OAAO,UAAU,UACf,gBAAgB,KAAK,IACjB,OAAO,OACP,kBAAkB,oBAAoB,MAAM,KAAK,KAAK,CAAC,CAC7D,GACA,OAAO,SAAS,cAAc,CAChC;AAiBF,MAAa,uBAAuB,MAA8B,UAChE,KAAK,cAAc,MAAM,aACzB,KAAK,qBAAqB,MAAM,oBAChC,KAAK,YAAY,WAAW,MAAM,YAAY,UAC9C,IAAI,IAAI,KAAK,YAAY,KAAK,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,SAAS,KAAK,YAAY,UAC/E,KAAK,YAAY,OAAO,MACtB,MAAM,YAAY,MACf,UAAU,MAAM,iBAAiB,EAAE,gBAAgB,MAAM,aAAa,EAAE,QAC3E,CACF;;;AAIF,MAAa,kCAAkC,OAAO,WAAW,WAC/D,QACA,SACA,QAAQ,OACR;CACA,MAAM,OAAO,OAAO,UAAA,CAAW,kBAAkB;CAEjD,MAAM,IAAI,QAAQ,SAChB,IAAI,QAAQ;CAEd,IAAI,OAAO,iBAAiB,EAAE,uBAAuB,KAAA,CAAS;CAE9D,MAAM,UAAU,OAAO,EAAE,KAAK,GAC5B,aAAa,OAAO,EAAE,KAAK;CAE7B,MAAM,gBAAgB,QAAQ,GAAG,iBAAiB,GAChD,mBAAmB,WAAW,GAAG,gBAAgB;CAEnD,MAAM,MAAM,OAAO,WAAW,QAAQ,MAAM,eAAe;CAC3D,MAAM,OAAO,IAAI,gBAAgB;EAAE,cAAc,GAAG;EAAI,cAAc,GAAG;CAAa,CAAC;CACvF,MAAM,cAAc,CAAC,SAAS,IAAI,gBAAgB;EAAE,cAAc;EAAO,cAAc;CAAK,CAAC;CAE7F,MAAM,SAAS,OAAiB,KAAa,UAC3C,aAAa,KAAK,MAAM,OAAO,GAAG,GAAG,MAAM,MAAM,KAAK,KAAK,CAAC;CAE9D,MAAM,MAAM,OAAiB,KAAa,UACxC,GAAG,GAAG,MAAM,OAAO,GAAG,EAAE,KAAK,MAAM,MAAM,KAAK,KAAK;CAErD,MAAM,iBAAiB,UAAoB,GAAG,OAAO,EAAE,QAAQ,EAAE,iBAAiB;CAElF,MAAM,oBAAoB,UAAoB;EAC5C,IAAI,EAAE,WAAW,KAAA,GAAW,OAAO,GAAG;EACtC,iBAAiB,EAAE,sBAAsB,KAAA,CAAS;EAElD,OAAO,GAAG,OAAO,EAAE,QAAQ,EAAE,iBAAiB;CAChD;CAEA,MAAM,aAAa,OAAiB,QAClC,gBAAgB,IAAI,KAAK,UAAU,MAAM,OAAO,EAAE,cAAc,KAAK,CAAC,CAAC;CAEzE,MAAM,SAAS,OAAO,WAAW,WAC/B,WACA,QACA,KACA,SACA,SAIA;EACA,kBAAkB,OAAO,QAAQ,UAAU,UAAU,IAAI,EAAE,GAAG,OAAO,SAAS;EAC9E,IAAI,CAAC,EAAE,eAAe,IAAI,EAAE,OAAO,GAAG,OAAO,KAAA;EAC7C,MAAM,cAA4D,CAAC;EAEnE,KAAK,MAAM,UAAU,SAAS;GAC5B,IAAI,OAAO,EAAE,kBAAkB,QAAQ,OAAO,EAAE,kBAAkB,KAAA,GAAW;GAC7E,kBAAkB,OAAO,QAAQ,UAAU,UAAU,OAAO,EAAE,UAAU,OAAO,SAAS;GACxF,IAAI,EAAE,WAAW,KAAA,GAAW,iBAAiB,EAAE,iBAAiB,OAAO,EAAE,OAAO,MAAM,IAAI;GAE1F,MAAM,QAAQ,OAAO,OAAO,oBAC1B,OAAO,OAAO;IAAE,cAAc,OAAO;IAAQ,UAAU,OAAO;GAAO,CAAC,CACxE,CAAC,CAAC;IAAE,cAAc,OAAO,EAAE;IAAe,UAAU,OAAO,EAAE;GAAU,CAAC;GAExE,iBAAiB,CAAC,YAAY,MAAM,UAAU,MAAM,iBAAiB,MAAM,YAAY,CAAC;GACxF,YAAY,KAAK,KAAK;EACxB;EACA,iBAAiB,YAAY,UAAU,EAAE;EAEzC,OAAO;GACL;GACA;GACA,UAAU,OAAO,OAAO,oBAAoB,sBAAsB,CAAC,CAAC;IAClE;IACA,kBAAkB,IAAI,EAAE;IACxB,aAAa,YAAY,MAAM,GAAG,MAAM,EAAE,aAAa,cAAc,EAAE,YAAY,CAAC;GACtF,CAAC;GACD,aAAa,OAAO,EAAE,kBAAkB,GAAG;GAC3C,KAAK,OAAO,OAAO,aAAa,OAAO,GAAG,CAAC,CAAC,OAAO,OAAO,CAAC;EAC7D;CACF,CAAC;CAED,MAAM,OAAO,OAAO,WAAW,WAAW,WAAsB,UAAU,OAAO;EAC/E,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,SAAS;EAE1D,kBAAkB,OAAO,QAAQ,UAAU,UAAU,MAAM,OAAO,SAAS;EAC3E,IAAI,WAAW,aAAa;GAC1B,MAAM,SACJ,OAAO,GAAG,UAAU,QAAQ,OAAO,IAAI,EAAE,IAAI,IAAI,sBAAsB,QAAQ,KAAK,SAAS,GAAG,SAAS,EAAE,IAAI,MAAM,EAAE,OAAO,cAAc,OAAO,EAAE,WAAW;GAElK,iBAAiB,OAAO,UAAU,CAAC;GACnC,IAAI,OAAO,OAAO,KAAA,GAAW,OAAO,KAAA;GAEpC,MAAM,UACJ,OAAO,GAAG,UAAU,WAAW,OAAO,IAAI,EAAE,QAAQ,WAAW,KAAK,SAAS,GAAG,YAAY,EAAE,WAAW,MAAM,EAAE,OAAO,iBAAiB,UAAU,EAAE,YAAY,WAAW,OAAO,EAAE,YAAY,EAAE,YAAY;GAEjN,OAAO,OAAO,OACZ,WACA,QACA,QAAQ,OAAO,OAAO,IAAI,IAAI,GAC9B,QAAQ,KAAK,QAAQ,WAAW,OAAO,KAAK,IAAI,CAAC,GACjD,OAAO,EAAE,CAAC,UACZ;EACF;EAEA,MAAM,OACJ,OAAO,GAAG,UAAU,cAAc,OAAO,IAAI,EAAE,IAAI,iBAAiB,OAAO,IAAI,EAAE,IAAI,IAAI,sBAAsB,cAAc,KAAK,aAAa,iBAAiB,KAAK,MAAM,GAAG,kBAAkB,EAAE,WAAW,MAAM,EAAE,OAAO,iBAAiB,gBAAgB,EAAE,SAAS,GAAG,eAAe,EAAE,IAAI,MAAM,EAAE,OAAO,cAAc,aAAa,EAAE;EAE9U,IAAI,KAAK,OAAO,KAAA,GAAW,OAAO,KAAA;EAElC,OAAO,OAAO,OACZ,WACA,QACA,cAAc,OAAO,KAAK,IAAI,IAAI,GAClC,KAAK,KAAK,QAAQ,iBAAiB,OAAO,KAAK,IAAI,CAAC,GACpD,KAAK,EAAE,CAAC,UACV;CACF,CAAC;CAED,MAAM,mBAAmB,KAA8B,WAA8B;EACnF,IAAI,CAAC,OAAO,OAAO,GAAG;EACtB,iBAAiB,EAAE,uBAAuB,KAAA,CAAS;EAEnD,OAAO,GAAG,wBAAwB,QAAQ,KAAK,SAAS,GAAG,SAAS,EAAE,IAAI,MAAM,EAAE,OAAO,IAAI,IAAI,EAAE,mBAAmB,KAAK,QAAS,IAAI,SAAS,OAAO,GAAG,GAAG,QAAQ,OAAO,GAAG,EAAE,YAAY,OAAO,IAAI,SAAS,WAAW,MAAM,SAAS,KAAK,IAAI,IAAI,IAAI,GAAG,SAAS,KAAK,IAAI,IAAI,CAAE,CAAC,EAAE;CAC7R;CAEA,MAAM,sBAAsB,UAAkC,WAC5D,IAAI,IAAI;EACN,GAAG,wBAAwB,QAAQ,KAAK,SAAS,GAAG,SAAS,EAAE,IAAI,MAAM,EAAE,OAAO,MAAM,SAAS,EAAE,kBAAkB,SAAS,gBAAgB,EAAE,OAAO,cAAc,OAAO,EAAE;EAC9K,GAAG,yBAAyB,WAAW,KAAK,SAAS,GAAG,YAAY,EAAE,WAAW,MAAM,EAAE,OAAO,iBAAiB,UAAU,EAAE,MAAM,SAAS,YAAY;EACxJ,GAAG,SAAS,YAAY,KACrB,WACC,GAAG,wBAAwB,WAAW,KAAK,SAAS,GAAG,YAAY,EAAE,WAAW,MAAM,EAAE,OAAO,MAAM,YAAY,EAAE,cAAc,OAAO,YAAY,EAAE,OAAO,MAAM,YAAY,EAAE,UAAU,OAAO,QAAQ,EAAE,OAAO,iBAAiB,UAAU,EAAE,EACpP;CACF,CAAC;CAEH,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF,CAAC;;;AAID,MAAa,kBAAkB,OAAO,WAAW,WAC/C,UACA,aACA,KACA;CAGA,OAAO,OAFe,qBAAqB,UAAU,aAAa,SAAS,WAAW,GAAG,CAAC;AAG5F,CAAC"}
+{"version":3,"file":"session-native-state.mjs","names":[],"sources":["../../src/internal/session-native-state.ts"],"sourcesContent":["import { AuthenticationClock } from \"@yielded/auth/Operations\";\nimport { reportAuthFailure } from \"@yielded/auth/Persistence\";\nimport type { SubjectId } from \"@yielded/auth/Schema\";\nimport {\n  type AuthenticationRequirement,\n  AuthenticationRevision,\n  SessionConflict,\n  SessionInvalid,\n  SessionUnavailable,\n  SessionStepUpInvalid,\n  PendingAuthenticationInvalid,\n  StaleAuthentication,\n  assessAuthentication,\n  type AuthenticationEvidence,\n} from \"@yielded/auth/Sessions\";\nimport { Cause, Effect, Schema, DateTime } from \"effect\";\nimport { SqlClient } from \"effect/sql/SqlClient\";\nimport { fragment, parameter, type Fragment } from \"effect/sql/Statement\";\n\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport type { SessionAuthorityTables, SessionExecution } from \"./models/session-model\";\nimport { nativeSqlAlias, type NativeSqlTables, type SqlTable } from \"./native-sql-table\";\nimport { anySqlCondition, exactSqlText } from \"./sql-change\";\nimport { guardSqlitePolicy, type SqlitePolicyValue } from \"./sqlite-policy-guard\";\nimport type { AnyTableModel } from \"./table-model\";\n\nexport const sessionUnavailable = () => SessionUnavailable.make({});\n\nexport const sessionInvariant: (condition: unknown) => asserts condition = (condition) => {\n  if (!condition)\n    throw PersistenceMappingError.make({ operation: \"decode\", cause: \"Invalid session authority\" });\n};\n\nexport type SessionDomainFailure =\n  | SessionConflict\n  | SessionInvalid\n  | SessionUnavailable\n  | SessionStepUpInvalid\n  | PendingAuthenticationInvalid\n  | StaleAuthentication;\n\nconst isDomainFailure = (error: unknown): error is SessionDomainFailure =>\n  Schema.is(SessionConflict)(error) ||\n  Schema.is(SessionInvalid)(error) ||\n  Schema.is(SessionUnavailable)(error) ||\n  Schema.is(SessionStepUpInvalid)(error) ||\n  Schema.is(PendingAuthenticationInvalid)(error) ||\n  Schema.is(StaleAuthentication)(error);\n\n/** Only schema-checked domain failures cross the owner boundary; SQL/mapping\n * failures remain Unavailable. The executor preserves every mixed cause reason. */\nexport const sessionFailure = <E>(\n  error: E,\n): Extract<E, SessionDomainFailure> | SessionUnavailable =>\n  isDomainFailure(error) ? (error as Extract<E, SessionDomainFailure>) : sessionUnavailable();\n\nexport const normalizeSessionOperation = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n  effect.pipe(\n    Effect.tapError((error) =>\n      isDomainFailure(error)\n        ? Effect.void\n        : reportAuthFailure(\"auth-persistence\", Cause.fail(error)),\n    ),\n    Effect.mapError(sessionFailure),\n  );\n\nexport type NativeSessionAuthorityMapping = SessionAuthorityTables<\n  AnyTableModel,\n  AnyTableModel,\n  unknown\n> &\n  SessionExecution;\n\nexport interface NativeSessionAuthority {\n  readonly native: unknown;\n  readonly row: Record<string, unknown>;\n  readonly policyValues: ReadonlyArray<SqlitePolicyValue>;\n  readonly revision: AuthenticationRevision;\n  readonly requirement: AuthenticationRequirement;\n  readonly now: number;\n}\n\nexport const sameSessionRevision = (left: AuthenticationRevision, right: AuthenticationRevision) =>\n  left.subjectId === right.subjectId &&\n  left.securityRevision === right.securityRevision &&\n  left.credentials.length === right.credentials.length &&\n  new Set(left.credentials.map((f) => f.credentialId)).size === left.credentials.length &&\n  left.credentials.every((f) =>\n    right.credentials.some(\n      (other) => other.credentialId === f.credentialId && other.revision === f.revision,\n    ),\n  );\n\n/** Known-subject joins bind each physical ID column independently. Subject locks\n * precede every credential lock, including inside an application coordinator. */\nexport const makeNativeSessionAuthorityState = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: NativeSessionAuthorityMapping,\n  batch = false,\n) {\n  const sql = (yield* SqlClient).withoutTransforms();\n  const clockPolicy = yield* AuthenticationClock;\n\n  const s = mapping.subject,\n    c = mapping.credential;\n\n  if (batch) sessionInvariant(s.requirementColumns !== undefined);\n\n  const subject = tables(s.table),\n    credential = tables(c.table);\n\n  const joinedSubject = subject.as(\"session_subject\"),\n    joinedCredential = credential.as(\"session_factor\");\n\n  const now = tables.expression(mapping.clock.engineNowMillis);\n  const lock = sql.onDialectOrElse({ sqlite: () => sql``, orElse: () => sql`for update` });\n  const nativeLocks = !batch && sql.onDialectOrElse({ sqlite: () => false, orElse: () => true });\n\n  const exact = (table: SqlTable, key: string, value: unknown) =>\n    exactSqlText(sql, table.column(key), table.value(key, value));\n\n  const id = (table: SqlTable, key: string, value: unknown) =>\n    sql`${table.column(key)} = ${table.value(key, value)}`;\n\n  const activeSubject = (table: SqlTable) => id(table, s.status, s.activeStatusValue);\n\n  const activeCredential = (table: SqlTable) => {\n    if (c.status === undefined) return sql`1 = 1`;\n    sessionInvariant(c.activeStatusValue !== undefined);\n\n    return id(table, c.status, c.activeStatusValue);\n  };\n\n  const requested = (table: SqlTable, ids: ReadonlyArray<string>) =>\n    anySqlCondition(ids.map((value) => exact(table, c.credentialId, value)));\n\n  const decode = Effect.fnUntraced(function* (\n    subjectId: SubjectId,\n    native: unknown,\n    projected: Record<string, unknown>,\n    factors: ReadonlyArray<Record<string, unknown>>,\n    instant: unknown,\n  ): Effect.fn.Return<\n    NativeSessionAuthority | undefined,\n    PersistenceMappingError | Schema.SchemaError\n  > {\n    const row = subject.decode(projected, \"s_\");\n\n    sessionInvariant((yield* mapping.subjectId.toSubject(row[s.id])) === subjectId);\n    if (!s.isActiveStatus(row[s.status])) return undefined;\n    const credentials: { credentialId: string; revision: string }[] = [];\n\n    for (const factor of factors) {\n      if (factor[c.credentialId] === null || factor[c.credentialId] === undefined) continue;\n      sessionInvariant((yield* mapping.subjectId.toSubject(factor[c.subjectId])) === subjectId);\n      if (c.status !== undefined) sessionInvariant(c.isActiveStatus?.(factor[c.status]) === true);\n\n      const value = yield* Schema.decodeUnknownEffect(\n        Schema.Struct({ credentialId: Schema.String, revision: Schema.String }),\n      )({ credentialId: factor[c.credentialId], revision: factor[c.revision] });\n\n      sessionInvariant(!credentials.some((other) => other.credentialId === value.credentialId));\n      credentials.push(value);\n    }\n    sessionInvariant(credentials.length <= 64);\n\n    return {\n      native,\n      row,\n      // Compare the selected SQL representation, without round-tripping through\n      // application codecs (for example, JSON whitespace or date precision).\n      policyValues: batch\n        ? (s.requirementColumns ?? []).map((key) => ({\n            column: subject.selectedColumn(key),\n            value: fragment([\n              parameter(projected[nativeSqlAlias(\"s_\", subject.keys.indexOf(key))]),\n            ]),\n          }))\n        : [],\n      revision: yield* Schema.decodeUnknownEffect(AuthenticationRevision)({\n        subjectId,\n        securityRevision: row[s.securityRevision],\n        credentials: credentials.sort((a, b) => a.credentialId.localeCompare(b.credentialId)),\n      }),\n      requirement: yield* s.decodeRequirement(row),\n      now: yield* Schema.decodeEffect(Schema.Int)(Number(instant)),\n    };\n  });\n\n  const read = Effect.fnUntraced(function* (subjectId: SubjectId, locking = false) {\n    const native = yield* mapping.subjectId.toNative(subjectId);\n\n    sessionInvariant((yield* mapping.subjectId.toSubject(native)) === subjectId);\n    if (locking && nativeLocks) {\n      const owners =\n        yield* sql`select ${subject.fields(\"s_\")}, ${now} as engine_now from ${subject.name} where ${id(subject, s.id, native)} and ${activeSubject(subject)} limit 2 ${lock}`;\n\n      sessionInvariant(owners.length <= 1);\n      if (owners[0] === undefined) return undefined;\n\n      const factors =\n        yield* sql`select ${credential.fields(\"c_\")} from ${credential.name} where ${id(credential, c.subjectId, native)} and ${activeCredential(credential)} order by ${credential.column(c.credentialId)} limit 65 ${lock}`;\n\n      return yield* decode(\n        subjectId,\n        native,\n        owners[0],\n        factors.map((row) => credential.decode(row, \"c_\")),\n        owners[0].engine_now,\n      );\n    }\n\n    const rows =\n      yield* sql`select ${joinedSubject.fields(\"s_\")}, ${joinedCredential.fields(\"c_\")}, ${now} as engine_now from ${joinedSubject.name} left join ${joinedCredential.name} on ${id(joinedCredential, c.subjectId, native)} and ${activeCredential(joinedCredential)} where ${id(joinedSubject, s.id, native)} and ${activeSubject(joinedSubject)} limit 65`;\n\n    if (rows[0] === undefined) return undefined;\n\n    return yield* decode(\n      subjectId,\n      native,\n      rows[0],\n      rows.map((row) => joinedCredential.decode(row, \"c_\")),\n      rows[0].engine_now,\n    );\n  });\n\n  const guardPolicy = Effect.fnUntraced(function* (current: NativeSessionAuthority) {\n    if (!batch) return;\n    sessionInvariant(s.requirementColumns !== undefined);\n\n    yield* guardSqlitePolicy({\n      name: \"session-subject-policy\",\n      table: subject.name,\n      owner: id(subject, s.id, current.native),\n      values: current.policyValues,\n    });\n  });\n\n  const authorityCondition = (revision: AuthenticationRevision, native: unknown): Fragment =>\n    sql.and([\n      sql`exists(select 1 from ${subject.name} where ${id(subject, s.id, native)} and ${exact(subject, s.securityRevision, revision.securityRevision)} and ${activeSubject(subject)})`,\n      sql`(select count(*) from ${credential.name} where ${id(credential, c.subjectId, native)} and ${activeCredential(credential)}) = ${revision.credentials.length}`,\n      ...revision.credentials.map(\n        (factor) =>\n          sql`exists(select 1 from ${credential.name} where ${id(credential, c.subjectId, native)} and ${exact(credential, c.credentialId, factor.credentialId)} and ${exact(credential, c.revision, factor.revision)} and ${activeCredential(credential)})`,\n      ),\n    ]);\n\n  return {\n    sql,\n    clockPolicy,\n    subject,\n    credential,\n    joinedSubject,\n    joinedCredential,\n    now,\n    lock,\n    nativeLocks,\n    exact,\n    id,\n    activeSubject,\n    activeCredential,\n    requested,\n    decode,\n    read,\n    authorityCondition,\n    guardPolicy,\n  };\n});\n\n/** Evaluate freshness at the database sample. The final write also enforces the\n * earliest future boundary at which the same evidence would cease to satisfy. */\nexport const assessSessionAt = Effect.fnUntraced(function* (\n  evidence: AuthenticationEvidence,\n  requirement: AuthenticationRequirement,\n  now: number,\n) {\n  const result = yield* assessAuthentication(evidence, requirement, DateTime.makeUnsafe(now));\n\n  return result;\n});\n"],"mappings":";;;;;;;;;;;AA0BA,MAAa,2BAA2B,mBAAmB,KAAK,CAAC,CAAC;AAElE,MAAa,oBAA+D,cAAc;CACxF,IAAI,CAAC,WACH,MAAM,wBAAwB,KAAK;EAAE,WAAW;EAAU,OAAO;CAA4B,CAAC;AAClG;AAUA,MAAM,mBAAmB,UACvB,OAAO,GAAG,eAAe,CAAC,CAAC,KAAK,KAChC,OAAO,GAAG,cAAc,CAAC,CAAC,KAAK,KAC/B,OAAO,GAAG,kBAAkB,CAAC,CAAC,KAAK,KACnC,OAAO,GAAG,oBAAoB,CAAC,CAAC,KAAK,KACrC,OAAO,GAAG,4BAA4B,CAAC,CAAC,KAAK,KAC7C,OAAO,GAAG,mBAAmB,CAAC,CAAC,KAAK;;;AAItC,MAAa,kBACX,UAEA,gBAAgB,KAAK,IAAK,QAA6C,mBAAmB;AAE5F,MAAa,6BAAsC,WACjD,OAAO,KACL,OAAO,UAAU,UACf,gBAAgB,KAAK,IACjB,OAAO,OACP,kBAAkB,oBAAoB,MAAM,KAAK,KAAK,CAAC,CAC7D,GACA,OAAO,SAAS,cAAc,CAChC;AAkBF,MAAa,uBAAuB,MAA8B,UAChE,KAAK,cAAc,MAAM,aACzB,KAAK,qBAAqB,MAAM,oBAChC,KAAK,YAAY,WAAW,MAAM,YAAY,UAC9C,IAAI,IAAI,KAAK,YAAY,KAAK,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,SAAS,KAAK,YAAY,UAC/E,KAAK,YAAY,OAAO,MACtB,MAAM,YAAY,MACf,UAAU,MAAM,iBAAiB,EAAE,gBAAgB,MAAM,aAAa,EAAE,QAC3E,CACF;;;AAIF,MAAa,kCAAkC,OAAO,WAAW,WAC/D,QACA,SACA,QAAQ,OACR;CACA,MAAM,OAAO,OAAO,UAAA,CAAW,kBAAkB;CACjD,MAAM,cAAc,OAAO;CAE3B,MAAM,IAAI,QAAQ,SAChB,IAAI,QAAQ;CAEd,IAAI,OAAO,iBAAiB,EAAE,uBAAuB,KAAA,CAAS;CAE9D,MAAM,UAAU,OAAO,EAAE,KAAK,GAC5B,aAAa,OAAO,EAAE,KAAK;CAE7B,MAAM,gBAAgB,QAAQ,GAAG,iBAAiB,GAChD,mBAAmB,WAAW,GAAG,gBAAgB;CAEnD,MAAM,MAAM,OAAO,WAAW,QAAQ,MAAM,eAAe;CAC3D,MAAM,OAAO,IAAI,gBAAgB;EAAE,cAAc,GAAG;EAAI,cAAc,GAAG;CAAa,CAAC;CACvF,MAAM,cAAc,CAAC,SAAS,IAAI,gBAAgB;EAAE,cAAc;EAAO,cAAc;CAAK,CAAC;CAE7F,MAAM,SAAS,OAAiB,KAAa,UAC3C,aAAa,KAAK,MAAM,OAAO,GAAG,GAAG,MAAM,MAAM,KAAK,KAAK,CAAC;CAE9D,MAAM,MAAM,OAAiB,KAAa,UACxC,GAAG,GAAG,MAAM,OAAO,GAAG,EAAE,KAAK,MAAM,MAAM,KAAK,KAAK;CAErD,MAAM,iBAAiB,UAAoB,GAAG,OAAO,EAAE,QAAQ,EAAE,iBAAiB;CAElF,MAAM,oBAAoB,UAAoB;EAC5C,IAAI,EAAE,WAAW,KAAA,GAAW,OAAO,GAAG;EACtC,iBAAiB,EAAE,sBAAsB,KAAA,CAAS;EAElD,OAAO,GAAG,OAAO,EAAE,QAAQ,EAAE,iBAAiB;CAChD;CAEA,MAAM,aAAa,OAAiB,QAClC,gBAAgB,IAAI,KAAK,UAAU,MAAM,OAAO,EAAE,cAAc,KAAK,CAAC,CAAC;CAEzE,MAAM,SAAS,OAAO,WAAW,WAC/B,WACA,QACA,WACA,SACA,SAIA;EACA,MAAM,MAAM,QAAQ,OAAO,WAAW,IAAI;EAE1C,kBAAkB,OAAO,QAAQ,UAAU,UAAU,IAAI,EAAE,GAAG,OAAO,SAAS;EAC9E,IAAI,CAAC,EAAE,eAAe,IAAI,EAAE,OAAO,GAAG,OAAO,KAAA;EAC7C,MAAM,cAA4D,CAAC;EAEnE,KAAK,MAAM,UAAU,SAAS;GAC5B,IAAI,OAAO,EAAE,kBAAkB,QAAQ,OAAO,EAAE,kBAAkB,KAAA,GAAW;GAC7E,kBAAkB,OAAO,QAAQ,UAAU,UAAU,OAAO,EAAE,UAAU,OAAO,SAAS;GACxF,IAAI,EAAE,WAAW,KAAA,GAAW,iBAAiB,EAAE,iBAAiB,OAAO,EAAE,OAAO,MAAM,IAAI;GAE1F,MAAM,QAAQ,OAAO,OAAO,oBAC1B,OAAO,OAAO;IAAE,cAAc,OAAO;IAAQ,UAAU,OAAO;GAAO,CAAC,CACxE,CAAC,CAAC;IAAE,cAAc,OAAO,EAAE;IAAe,UAAU,OAAO,EAAE;GAAU,CAAC;GAExE,iBAAiB,CAAC,YAAY,MAAM,UAAU,MAAM,iBAAiB,MAAM,YAAY,CAAC;GACxF,YAAY,KAAK,KAAK;EACxB;EACA,iBAAiB,YAAY,UAAU,EAAE;EAEzC,OAAO;GACL;GACA;GAGA,cAAc,SACT,EAAE,sBAAsB,CAAC,EAAA,CAAG,KAAK,SAAS;IACzC,QAAQ,QAAQ,eAAe,GAAG;IAClC,OAAO,SAAS,CACd,UAAU,UAAU,eAAe,MAAM,QAAQ,KAAK,QAAQ,GAAG,CAAC,EAAE,CACtE,CAAC;GACH,EAAE,IACF,CAAC;GACL,UAAU,OAAO,OAAO,oBAAoB,sBAAsB,CAAC,CAAC;IAClE;IACA,kBAAkB,IAAI,EAAE;IACxB,aAAa,YAAY,MAAM,GAAG,MAAM,EAAE,aAAa,cAAc,EAAE,YAAY,CAAC;GACtF,CAAC;GACD,aAAa,OAAO,EAAE,kBAAkB,GAAG;GAC3C,KAAK,OAAO,OAAO,aAAa,OAAO,GAAG,CAAC,CAAC,OAAO,OAAO,CAAC;EAC7D;CACF,CAAC;CAED,MAAM,OAAO,OAAO,WAAW,WAAW,WAAsB,UAAU,OAAO;EAC/E,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,SAAS;EAE1D,kBAAkB,OAAO,QAAQ,UAAU,UAAU,MAAM,OAAO,SAAS;EAC3E,IAAI,WAAW,aAAa;GAC1B,MAAM,SACJ,OAAO,GAAG,UAAU,QAAQ,OAAO,IAAI,EAAE,IAAI,IAAI,sBAAsB,QAAQ,KAAK,SAAS,GAAG,SAAS,EAAE,IAAI,MAAM,EAAE,OAAO,cAAc,OAAO,EAAE,WAAW;GAElK,iBAAiB,OAAO,UAAU,CAAC;GACnC,IAAI,OAAO,OAAO,KAAA,GAAW,OAAO,KAAA;GAEpC,MAAM,UACJ,OAAO,GAAG,UAAU,WAAW,OAAO,IAAI,EAAE,QAAQ,WAAW,KAAK,SAAS,GAAG,YAAY,EAAE,WAAW,MAAM,EAAE,OAAO,iBAAiB,UAAU,EAAE,YAAY,WAAW,OAAO,EAAE,YAAY,EAAE,YAAY;GAEjN,OAAO,OAAO,OACZ,WACA,QACA,OAAO,IACP,QAAQ,KAAK,QAAQ,WAAW,OAAO,KAAK,IAAI,CAAC,GACjD,OAAO,EAAE,CAAC,UACZ;EACF;EAEA,MAAM,OACJ,OAAO,GAAG,UAAU,cAAc,OAAO,IAAI,EAAE,IAAI,iBAAiB,OAAO,IAAI,EAAE,IAAI,IAAI,sBAAsB,cAAc,KAAK,aAAa,iBAAiB,KAAK,MAAM,GAAG,kBAAkB,EAAE,WAAW,MAAM,EAAE,OAAO,iBAAiB,gBAAgB,EAAE,SAAS,GAAG,eAAe,EAAE,IAAI,MAAM,EAAE,OAAO,cAAc,aAAa,EAAE;EAE9U,IAAI,KAAK,OAAO,KAAA,GAAW,OAAO,KAAA;EAElC,OAAO,OAAO,OACZ,WACA,QACA,KAAK,IACL,KAAK,KAAK,QAAQ,iBAAiB,OAAO,KAAK,IAAI,CAAC,GACpD,KAAK,EAAE,CAAC,UACV;CACF,CAAC;CAED,MAAM,cAAc,OAAO,WAAW,WAAW,SAAiC;EAChF,IAAI,CAAC,OAAO;EACZ,iBAAiB,EAAE,uBAAuB,KAAA,CAAS;EAEnD,OAAO,kBAAkB;GACvB,MAAM;GACN,OAAO,QAAQ;GACf,OAAO,GAAG,SAAS,EAAE,IAAI,QAAQ,MAAM;GACvC,QAAQ,QAAQ;EAClB,CAAC;CACH,CAAC;CAED,MAAM,sBAAsB,UAAkC,WAC5D,IAAI,IAAI;EACN,GAAG,wBAAwB,QAAQ,KAAK,SAAS,GAAG,SAAS,EAAE,IAAI,MAAM,EAAE,OAAO,MAAM,SAAS,EAAE,kBAAkB,SAAS,gBAAgB,EAAE,OAAO,cAAc,OAAO,EAAE;EAC9K,GAAG,yBAAyB,WAAW,KAAK,SAAS,GAAG,YAAY,EAAE,WAAW,MAAM,EAAE,OAAO,iBAAiB,UAAU,EAAE,MAAM,SAAS,YAAY;EACxJ,GAAG,SAAS,YAAY,KACrB,WACC,GAAG,wBAAwB,WAAW,KAAK,SAAS,GAAG,YAAY,EAAE,WAAW,MAAM,EAAE,OAAO,MAAM,YAAY,EAAE,cAAc,OAAO,YAAY,EAAE,OAAO,MAAM,YAAY,EAAE,UAAU,OAAO,QAAQ,EAAE,OAAO,iBAAiB,UAAU,EAAE,EACpP;CACF,CAAC;CAEH,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF,CAAC;;;AAID,MAAa,kBAAkB,OAAO,WAAW,WAC/C,UACA,aACA,KACA;CAGA,OAAO,OAFe,qBAAqB,UAAU,aAAa,SAAS,WAAW,GAAG,CAAC;AAG5F,CAAC"}

package/dist/internal/session-native-stateful.d.mts

@@ -4,13 +4,13 @@ import { NativeSqlTables } from "./native-sql-table.mjs";
 import { SqlBatchCommit } from "./sql-commit.mjs";
 import { Effect } from "effect";
 import { LifecycleHooks } from "@yielded/auth/Hooks";
-import { SessionRepository, StatefulSessionPersistence } from "@yielded/auth/Sessions";
+import { SessionRepository, SessionUnavailable, StatefulSessionPersistence } from "@yielded/auth/Sessions";
 import { SqlClient } from "effect/sql/SqlClient";
 //#region src/internal/session-native-stateful.d.ts
 export type NativeStatefulSessionMapping<Claims> = StatefulSessionMapping<Claims, AnyTableModel, AnyTableModel, AnyTableModel, AnyTableModel, unknown, unknown>;
 export declare const makeNativeStatefulSessionServices: <Claims>(tables: NativeSqlTables, mapping: NativeStatefulSessionMapping<Claims>) => Effect.Effect<{
   readonly statefulSessionPersistence: StatefulSessionPersistence<Claims>;
   readonly sessionRepository: SessionRepository;
-}, never, LifecycleHooks | SqlBatchCommit | SqlClient>;
+}, SessionUnavailable, LifecycleHooks | SqlBatchCommit | SqlClient>;
 //#endregion
 //# sourceMappingURL=session-native-stateful.d.mts.map

package/dist/internal/session-native-stateful.mjs

@@ -4,11 +4,13 @@ import { exactSqlText, executeSqlChange } from "./sql-change.mjs";
 import { CurrentSqlCommit, SqlBatchCommit, appendSqlBatchStatement, makeSqlCommitExecutor, registerSqlBatchPostcondition, registerSqlPostcondition } from "./sql-commit.mjs";
 import { makeNativeSessionAuthorityState, normalizeSessionOperation, sameSessionRevision, sessionInvariant, sessionUnavailable } from "./session-native-state.mjs";
 import { makeConditionalSqlInsert, makeNativeSessionRecords, sameSessionRecord } from "./session-native-record.mjs";
+import { canJoinTextColumns, withStorageValidation } from "./storage-validation.mjs";
 import { makeNativeSessionPending, prepareNativeSession } from "./session-native-pending.mjs";
 import { allocateSessionValue, preservesRevision } from "./session-policy.mjs";
 import { sessionEvidenceDeadline } from "./session-native-authority.mjs";
 import { DateTime, Effect, Option, Schema } from "effect";
 import { PendingAuthenticationInvalid, SessionConflict, SessionId, SessionInvalid, SessionMetadata, StaleAuthentication, snapshotSessionAuthenticationProvenance } from "@yielded/auth/Sessions";
+import { AuthenticationClock } from "@yielded/auth/Operations";
 //#region src/internal/session-native-stateful.ts
 const makeNativeStatefulSessionServices = Effect.fnUntraced(function* (tables, mapping) {
 	const batch = yield* SqlBatchCommit;
@@ -22,7 +24,7 @@ const makeNativeStatefulSessionServices = Effect.fnUntraced(function* (tables, m
 		...mapping.pending
 	}, batch !== void 0);
 	const { sql, s, table, now, exact, live } = records;
-	const native = (work, mode = "transaction") => batch === void 0 ? executor.operation(normalizeSessionOperation(work), mode) : executor.operationBatch(normalizeSessionOperation(work)).pipe(Effect.provideService(SqlBatchCommit, batch));
+	const native = (work, mode = "transaction") => (batch === void 0 ? executor.operation(normalizeSessionOperation(work), mode) : executor.operationBatch(normalizeSessionOperation(work)).pipe(Effect.provideService(SqlBatchCommit, batch))).pipe(Effect.provideService(AuthenticationClock, state.clockPolicy));
 	const stage = Effect.fnUntraced(function* (statement, expected) {
 		if (batch !== void 0) {
 			yield* appendSqlBatchStatement(sql`${statement}`);
@@ -41,7 +43,7 @@ const makeNativeStatefulSessionServices = Effect.fnUntraced(function* (tables, m
 			check: Effect.gen(function* () {
 				const rows = yield* sql`select 1 where ${condition}`;
 				sessionInvariant(rows.length === 1);
-			}).pipe(Effect.mapError((cause) => PersistenceMappingError.make({
+			}).pipe(Effect.provideService(AuthenticationClock, state.clockPolicy), Effect.mapError((cause) => PersistenceMappingError.make({
 				operation: "decode",
 				cause
 			})))
@@ -51,25 +53,26 @@ const makeNativeStatefulSessionServices = Effect.fnUntraced(function* (tables, m
 		return sql`exists(select 1 from ${table.name} where ${yield* records.owner(record)} and ${exact(table, s.securityRevision, record.securityRevision)} and ${records.millis(table, s.expiresAt)} = ${DateTime.toEpochMillis(record.expiresAt)} and ${records.millis(table, s.absoluteExpiresAt)} = ${DateTime.toEpochMillis(record.absoluteExpiresAt)} and ${records.encodedCondition(values)} and ${live(table)})`;
 	});
 	const classify = (effect) => effect.pipe(Effect.mapError((error) => isMappedConstraintConflict(mapping.isConstraintConflict, error) ? SessionConflict.make({}) : error));
+	const [joinedIds, joinedRevisions] = yield* Effect.forEach([[table.unencodedTextColumn?.(s.subjectId), state.subject.unencodedTextColumn?.(mapping.subject.id)], [table.unencodedTextColumn?.(s.securityRevision), state.subject.unencodedTextColumn?.(mapping.subject.securityRevision)]], canJoinTextColumns).pipe(withStorageValidation, Effect.mapError(sessionUnavailable));
 	const verify = Effect.fnUntraced(function* (digest) {
 		const subject = state.subject.as("verified_subject"), session = table.as("verified_session"), owner = mapping.subject;
-		if (table.unencodedTextColumn?.(s.subjectId) !== void 0 && state.subject.unencodedTextColumn?.(owner.id) !== void 0) {
-			const rows = yield* sql`select ${session.fields("session_")}, ${subject.fields("subject_")} from ${session.name} join ${subject.name} on ${exactSqlText(sql, subject.column(owner.id), session.column(s.subjectId))} and ${state.activeSubject(subject)} and ${exactSqlText(sql, subject.column(owner.securityRevision), session.column(s.securityRevision))} where ${exact(session, s.digest, digest)} and ${live(session)} limit 2`;
-			sessionInvariant(rows.length <= 1);
-			if (rows[0] === void 0) return void 0;
-			const record = yield* records.decode(session.decode(rows[0], "session_"));
-			const decoded = subject.decode(rows[0], "subject_");
-			sessionInvariant((yield* mapping.subjectId.toSubject(decoded[owner.id])) === record.subjectId && decoded[owner.securityRevision] === record.securityRevision && owner.isActiveStatus(decoded[owner.status]));
-			return record;
+		let discoveredSubjectId;
+		let nativeSubject;
+		if (!joinedIds) {
+			const discovered = yield* records.read(digest);
+			if (discovered === void 0) return void 0;
+			discoveredSubjectId = discovered.subjectId;
+			nativeSubject = yield* mapping.subjectId.toNative(discoveredSubjectId);
 		}
-		const record = yield* records.read(digest);
-		if (record === void 0) return void 0;
-		const nativeSubject = yield* mapping.subjectId.toNative(record.subjectId);
-		const rows = yield* sql`select ${subject.fields("subject_")} from ${subject.name} where ${state.id(subject, owner.id, nativeSubject)} and ${state.activeSubject(subject)} and ${state.exact(subject, owner.securityRevision, record.securityRevision)} and ${now} < ${DateTime.toEpochMillis(record.expiresAt)} limit 2`;
+		const owns = joinedIds ? exactSqlText(sql, subject.column(owner.id), session.column(s.subjectId)) : sql`${state.id(subject, owner.id, nativeSubject)} and ${state.id(session, s.subjectId, nativeSubject)}`;
+		const revision = joinedRevisions ? exactSqlText(sql, subject.column(owner.securityRevision), session.column(s.securityRevision)) : sql`true`;
+		const rows = yield* sql`select ${session.fields("session_")}, ${subject.fields("subject_")} from ${session.name} join ${subject.name} on ${owns} and ${state.activeSubject(subject)} and ${revision} where ${exact(session, s.digest, digest)} and ${live(session)} limit 2`;
 		sessionInvariant(rows.length <= 1);
 		if (rows[0] === void 0) return void 0;
-		sessionInvariant((yield* mapping.subjectId.toSubject(subject.decode(rows[0], "subject_")[owner.id])) === record.subjectId);
-		return record;
+		const record = yield* records.decode(session.decode(rows[0], "session_"));
+		const decoded = subject.decode(rows[0], "subject_");
+		sessionInvariant((joinedIds || record.subjectId === discoveredSubjectId) && (yield* mapping.subjectId.toSubject(decoded[owner.id])) === record.subjectId && owner.isActiveStatus(decoded[owner.status]));
+		return decoded[owner.securityRevision] === record.securityRevision ? record : void 0;
 	});
 	return {
 		statefulSessionPersistence: {
@@ -77,8 +80,8 @@ const makeNativeStatefulSessionServices = Effect.fnUntraced(function* (tables, m
 				const current = yield* state.read(input.evidence.revision.subjectId, true);
 				if (current === void 0 || !sameSessionRevision(current.revision, input.evidence.revision)) return yield* StaleAuthentication.make({});
 				const assessment = yield* sessionEvidenceDeadline(input.evidence, current.requirement, current.now);
-				const expires = DateTime.toEpochMillis(input.session.expiresAt), absolute = DateTime.toEpochMillis(input.session.absoluteExpiresAt);
-				if (current.now >= expires || expires > absolute) return yield* StaleAuthentication.make({});
+				const issued = Math.max(current.now, DateTime.toEpochMillis(input.now), DateTime.toEpochMillis(input.session.issuedAt), ...input.evidence.proofs.map((proof) => DateTime.toEpochMillis(proof.verifiedAt))), expires = DateTime.toEpochMillis(input.session.expiresAt), absolute = DateTime.toEpochMillis(input.session.absoluteExpiresAt);
+				if (issued - current.now > state.clockPolicy.futureToleranceMillis || issued >= expires || current.now >= expires || expires > absolute) return yield* StaleAuthentication.make({});
 				let pendingExpiry = Infinity;
 				if (input.pending !== void 0) {
 					if (pending === void 0 || mapping.pending === void 0) return yield* PendingAuthenticationInvalid.make({});
@@ -97,12 +100,12 @@ const makeNativeStatefulSessionServices = Effect.fnUntraced(function* (tables, m
 					sessionId,
 					subjectId: current.revision.subjectId,
 					securityRevision: current.revision.securityRevision,
-					assurance: input.handoffSourceSessionId === void 0 ? assessment.assessed.assurance : input.session.assurance,
 					provenance: yield* snapshotSessionAuthenticationProvenance({ evidence: input.evidence }),
-					issuedAt: DateTime.makeUnsafe(current.now)
+					issuedAt: DateTime.makeUnsafe(issued)
 				};
 				const deadline = Math.min(expires, assessment.validUntil, pendingExpiry);
-				const condition = sql`${state.authorityCondition(current.revision, current.native)} and ${state.policyCondition(current.row, current.native)} and ${now} >= ${current.now} and ${now} < ${deadline}`;
+				yield* state.guardPolicy(current);
+				const condition = sql`${state.authorityCondition(current.revision, current.native)} and ${now} >= ${current.now} and ${now} < ${deadline}`;
 				const values = {
 					...s.encodeInsert(record, {
 						subjectId: current.native,
@@ -127,7 +130,7 @@ const makeNativeStatefulSessionServices = Effect.fnUntraced(function* (tables, m
 						const authority = yield* state.read(record.subjectId);
 						sessionInvariant(authority !== void 0 && sameSessionRevision(authority.revision, input.evidence.revision));
 						yield* sessionEvidenceDeadline(input.evidence, authority.requirement, authority.now);
-					}).pipe(Effect.mapError((cause) => PersistenceMappingError.make({
+					}).pipe(Effect.provideService(AuthenticationClock, state.clockPolicy), Effect.mapError((cause) => PersistenceMappingError.make({
 						operation: "decode",
 						cause
 					})))
@@ -136,8 +139,8 @@ const makeNativeStatefulSessionServices = Effect.fnUntraced(function* (tables, m
 			}))),
 			verify: ({ digest }) => executor.verify(verify(digest)).pipe(Effect.flatMap((record) => record === void 0 ? Effect.fail(SessionInvalid.make({})) : Effect.succeed(record))),
 			rotate: (input, project) => native(classify(Effect.gen(function* () {
-				const absolute = DateTime.toEpochMillis(input.record.absoluteExpiresAt), expires = DateTime.toEpochMillis(input.nextExpiresAt);
-				if (expires > absolute || input.nextDigest === input.record.digest || input.nextCredentialVersion === input.record.credentialVersion) return yield* SessionConflict.make({});
+				const absolute = DateTime.toEpochMillis(input.record.absoluteExpiresAt), expires = DateTime.toEpochMillis(input.nextExpiresAt), preparedAt = Math.max(DateTime.toEpochMillis(input.now), DateTime.toEpochMillis(input.record.issuedAt));
+				if (expires > absolute || preparedAt >= expires || input.nextDigest === input.record.digest || input.nextCredentialVersion === input.record.credentialVersion) return yield* SessionConflict.make({});
 				const needsSample = batch !== void 0 || sql.onDialectOrElse({
 					mysql: () => true,
 					orElse: () => false
@@ -149,15 +152,15 @@ const makeNativeStatefulSessionServices = Effect.fnUntraced(function* (tables, m
 					digest: input.nextDigest,
 					credentialVersion: input.nextCredentialVersion,
 					expiresAt: input.nextExpiresAt,
-					issuedAt: DateTime.makeUnsafe(sampled)
+					issuedAt: DateTime.makeUnsafe(Math.max(sampled, preparedAt))
 				};
 				const values = {
 					...s.encodeRotation(prepared),
 					[s.digest]: prepared.digest,
-					[s.issuedAt]: tables.expression(mapping.clock.fromMillis(now)),
+					[s.issuedAt]: tables.expression(mapping.clock.fromMillis(sql`case when ${now} >= ${preparedAt} then ${now} else ${preparedAt} end`)),
 					[s.expiresAt]: s.encodeInstant(prepared.expiresAt)
 				};
-				const condition = sql`${yield* records.owner(input.record)} and ${live(table)} and ${now} < ${expires} and ${records.millis(table, s.absoluteExpiresAt)} = ${absolute}`;
+				const condition = sql`${yield* records.owner(input.record)} and ${live(table)} and ${preparedAt} <= ${now} + ${state.clockPolicy.futureToleranceMillis} and ${now} < ${expires} and ${records.millis(table, s.absoluteExpiresAt)} = ${absolute}`;
 				const update = sql`${table.update(values)} where ${condition}`;
 				let record = prepared;
 				if (needsSample) {
@@ -205,17 +208,43 @@ const makeNativeStatefulSessionServices = Effect.fnUntraced(function* (tables, m
 			sessionInvariant(Number.isSafeInteger(input.limit) && input.limit > 0 && input.limit <= 1e3);
 			const nativeSubject = yield* mapping.subjectId.toNative(input.subjectId), st = state.subject.as("listed_subject"), list = table.as("listed_session"), owner = mapping.subject;
 			const cursor = input.cursor === void 0 ? void 0 : yield* mapping.sessionId.toNative(yield* Schema.decodeEffect(SessionId)(input.cursor));
-			const rows = yield* sql`select ${list.fields("session_")}, ${st.fields("subject_")} from ${list.name} join ${st.name} on ${state.id(st, owner.id, nativeSubject)} and ${state.activeSubject(st)} and ${exactSqlText(sql, st.column(owner.securityRevision), list.column(s.securityRevision))} where ${state.id(list, s.subjectId, nativeSubject)} and ${live(list)}${cursor === void 0 ? sql`` : sql` and ${list.column(s.sessionId)} > ${list.value(s.sessionId, cursor)}`} order by ${list.column(s.sessionId)} limit ${input.limit + 1}`;
-			const decoded = yield* Effect.forEach(rows.slice(0, input.limit), (row) => Effect.gen(function* () {
-				const record = yield* records.decode(list.decode(row, "session_"));
-				sessionInvariant(record.subjectId === input.subjectId && (yield* mapping.subjectId.toSubject(st.decode(row, "subject_")[owner.id])) === input.subjectId);
-				return yield* Schema.decodeEffect(Schema.toType(SessionMetadata))(record);
-			}));
-			const nextCursor = rows.length > input.limit ? decoded.at(-1)?.sessionId : void 0;
-			return {
-				sessions: decoded,
-				...nextCursor === void 0 ? {} : { nextCursor }
-			};
+			let revision;
+			if (!joinedRevisions) {
+				const subjects = yield* sql`select ${st.fields("subject_")} from ${st.name} where ${state.id(st, owner.id, nativeSubject)} and ${state.activeSubject(st)} limit 2`;
+				sessionInvariant(subjects.length <= 1);
+				if (subjects[0] === void 0) return { sessions: [] };
+				const subject = st.decode(subjects[0], "subject_");
+				sessionInvariant((yield* mapping.subjectId.toSubject(subject[owner.id])) === input.subjectId);
+				revision = yield* Schema.decodeUnknownEffect(SessionMetadata.fields.securityRevision)(subject[owner.securityRevision]);
+			}
+			for (let attempt = 0; attempt < 2; attempt++) {
+				const currentRevision = joinedRevisions ? exactSqlText(sql, st.column(owner.securityRevision), list.column(s.securityRevision)) : sql`${state.exact(st, owner.securityRevision, revision)} and ${exact(list, s.securityRevision, revision)}`;
+				const rows = yield* sql`select ${list.fields("session_")}, ${st.fields("subject_")}, ${list.column(s.subjectId)} as session_owner from ${st.name} left join ${list.name} on ${state.id(list, s.subjectId, nativeSubject)} and ${currentRevision} and ${live(list)}${cursor === void 0 ? sql`` : sql` and ${list.column(s.sessionId)} > ${list.value(s.sessionId, cursor)}`} where ${state.id(st, owner.id, nativeSubject)} and ${state.activeSubject(st)} order by ${list.column(s.sessionId)} limit ${input.limit + 1}`;
+				const first = rows[0];
+				if (first === void 0) return { sessions: [] };
+				if (!joinedRevisions) {
+					const subject = st.decode(first, "subject_");
+					sessionInvariant((yield* mapping.subjectId.toSubject(subject[owner.id])) === input.subjectId);
+					const current = yield* Schema.decodeUnknownEffect(SessionMetadata.fields.securityRevision)(subject[owner.securityRevision]);
+					if (current !== revision) {
+						revision = current;
+						continue;
+					}
+				}
+				if (first.session_owner === null) return { sessions: [] };
+				const decoded = yield* Effect.forEach(rows.slice(0, input.limit), (row) => Effect.gen(function* () {
+					const record = yield* records.decode(list.decode(row, "session_"));
+					const subject = st.decode(row, "subject_");
+					sessionInvariant(record.subjectId === input.subjectId && (yield* mapping.subjectId.toSubject(subject[owner.id])) === input.subjectId && subject[owner.securityRevision] === record.securityRevision);
+					return yield* Schema.decodeEffect(Schema.toType(SessionMetadata))(record);
+				}));
+				const nextCursor = rows.length > input.limit ? decoded.at(-1)?.sessionId : void 0;
+				return {
+					sessions: decoded,
+					...nextCursor === void 0 ? {} : { nextCursor }
+				};
+			}
+			return yield* sessionUnavailable();
 		})) }
 	};
 });