@yielded/auth-persistence 0.1.0-beta.7

package/dist/drizzle/d1-sessions.mjs

@@ -0,0 +1,966 @@
+import { PersistenceMappingError, isMappedConstraintConflict } from "../internal/mapping-error.mjs";
+import { decodeStepUpIntent, encodeStepUpIntent, stepUpIntentLive, validateStepUpPlan } from "./step-up-state.mjs";
+import { column, updateValues } from "./model.mjs";
+import { compactD1GeneratedStatement } from "./d1-generated-statement.mjs";
+import { D1BatchStatements } from "./D1BatchStatements.mjs";
+import { CurrentD1PlanningDatabase, makeD1Owner } from "./d1-planning.mjs";
+import { Cause, Context, Data, DateTime, Effect, Schema } from "effect";
+import { reportPersistenceFailure } from "@yielded/auth/Persistence";
+import { CurrentCommitJournal, LifecycleHooks, coordinateCommit, hasCommitScope } from "@yielded/auth/Hooks";
+import { AuthenticationAuthority, PendingAuthenticationInvalid, SessionConflict, SessionInvalid, SessionMetadata, SessionStepUpInvalid, SessionUnavailable, StaleAuthentication, assessAuthentication, pendingAuthenticationContext, snapshotPendingAuthenticationContext, snapshotSessionAuthenticationProvenance } from "@yielded/auth/Sessions";
+import { and, eq, getTableColumns, gt, inArray, not, or, sql } from "drizzle-orm";
+//#region src/drizzle/d1-sessions.ts
+var CurrentD1SessionBatch = class extends Context.Service()("effect-auth/drizzle/CurrentD1SessionBatch") {};
+var D1BatchFailure = class extends Data.TaggedError("D1BatchFailure") {};
+const unavailable = () => SessionUnavailable.make({});
+const stale = () => StaleAuthentication.make({});
+const invalidPending = () => PendingAuthenticationInvalid.make({});
+const invalidSession = () => SessionInvalid.make({});
+const mapFailureCause = (effect, map) => Effect.catchCause(effect, (cause) => Effect.failCause(Cause.map(cause, map)));
+const isD1DomainError = (error) => {
+	const tag = typeof error === "object" && error !== null ? Reflect.get(error, "_tag") : void 0;
+	return tag === "SessionStepUpInvalid" || tag === "PendingAuthenticationInvalid" || tag === "SessionConflict" || tag === "SessionInvalid" || tag === "SessionUnavailable" || tag === "StaleAuthentication";
+};
+const normalizeD1Failure = (effect, isExpected) => reportPersistenceFailure(effect, isExpected).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, (error) => isD1DomainError(error) ? error : unavailable()))));
+const terminalD1 = (effect) => normalizeD1Failure(effect, isD1DomainError);
+const containsFailure = (failure, predicate) => {
+	const seen = /* @__PURE__ */ new Set();
+	const pending = [failure];
+	for (let inspected = 0; inspected < 24 && pending.length > 0; inspected++) {
+		const current = pending.shift();
+		if (current === void 0 || current === null || seen.has(current)) continue;
+		seen.add(current);
+		if (predicate(current)) return true;
+		if (Cause.isCause(current)) {
+			for (const reason of current.reasons) if (Cause.isFailReason(reason)) pending.push(reason.error);
+			else if (Cause.isDieReason(reason)) pending.push(reason.defect);
+			continue;
+		}
+		if (typeof current !== "object") continue;
+		const wrapped = current;
+		if (wrapped.cause !== void 0) pending.push(wrapped.cause);
+		if (wrapped.reason !== void 0) pending.push(wrapped.reason);
+		if (wrapped.message !== void 0) pending.push(wrapped.message);
+	}
+	return false;
+};
+const isGuardFailure = (failure) => containsFailure(failure, (value) => typeof value === "string" && value.includes("effect-auth-session-guard"));
+const recoverBatchFailure = (failure) => {
+	const { cause, mutation } = failure;
+	const onlyFailures = cause.reasons.length > 0 && cause.reasons.every(Cause.isFailReason);
+	if (mutation === void 0) return Effect.failCause(cause);
+	if (onlyFailures && mutation.isConstraintConflict !== void 0 && cause.reasons.every((reason) => Cause.isFailReason(reason) && isMappedConstraintConflict(mutation.isConstraintConflict, reason.error))) return Effect.fail(SessionConflict.make({}));
+	if (onlyFailures && mutation.recoverGuard !== void 0 && cause.reasons.every((reason) => Cause.isFailReason(reason) && isGuardFailure(reason.error))) return mutation.recoverGuard;
+	return Effect.failCause(cause);
+};
+const splitD1BatchFailure = (cause) => {
+	const marker = cause.reasons.find((reason) => Cause.isFailReason(reason) && reason.error instanceof D1BatchFailure);
+	if (marker === void 0 || !Cause.isFailReason(marker)) return void 0;
+	const remaining = Cause.fromReasons(cause.reasons.filter((reason) => reason !== marker));
+	return {
+		failure: marker.error,
+		remaining
+	};
+};
+const recoverD1BatchCause = (cause) => {
+	const split = splitD1BatchFailure(cause);
+	if (split === void 0) return Effect.failCause(cause);
+	return recoverBatchFailure(split.failure).pipe(Effect.catchCause((recovered) => Effect.failCause(Cause.combine(recovered, split.remaining))));
+};
+const recoverCoordinatedD1BatchCause = (cause) => {
+	const split = splitD1BatchFailure(cause);
+	if (split === void 0) return Effect.failCause(cause);
+	return terminalD1(recoverBatchFailure(split.failure)).pipe(Effect.catchCause((recovered) => Effect.failCause(Cause.combine(recovered, split.remaining))));
+};
+const statement = (query) => Effect.map(CurrentD1PlanningDatabase, (database) => {
+	const rendered = query.toSQL();
+	return compactD1GeneratedStatement(database.$client, database.$client.unsafe(rendered.sql, rendered.params), unavailable);
+});
+const assertion = (condition) => Effect.gen(function* () {
+	const database = yield* CurrentD1PlanningDatabase;
+	return yield* statement(database.select({ ok: sql`case when ${condition} then 1 else json_extract('[]', '$[effect-auth-session-guard]') end`.as("ok") }).from(sql`(select 1)`));
+});
+const conditionMatches = (condition) => Effect.flatMap(CurrentD1PlanningDatabase, (database) => database.select({ ok: sql`1` }).from(sql`(select 1)`).where(condition).limit(1).pipe(Effect.map((rows) => rows.length > 0)));
+function runPlanned(plan, isConstraintConflict, recoverGuard) {
+	const planned = plan.pipe(Effect.map((value) => ({
+		...value,
+		isConstraintConflict,
+		recoverGuard
+	})));
+	const execution = Effect.gen(function* () {
+		const batch = yield* Effect.serviceOption(CurrentD1SessionBatch);
+		if (batch._tag === "Some") {
+			const owned = batch.value;
+			return (yield* coordinateCommit(() => Effect.gen(function* () {
+				yield* owned.owner.check;
+				const journal = yield* CurrentCommitJournal;
+				const value = yield* planned;
+				yield* owned.owner.check;
+				const guarded = {
+					...value,
+					journalGuard: journal.prepare(void 0)
+				};
+				yield* owned.append(guarded);
+				return guarded.receipt;
+			}), { mode: "batch" })).value;
+		}
+		const database = yield* CurrentD1PlanningDatabase;
+		return (yield* coordinateCommit(() => Effect.gen(function* () {
+			const prepared = yield* planned;
+			yield* database.$client.batch(prepared.statements).pipe(Effect.catchCause((cause) => Effect.fail(new D1BatchFailure({
+				cause,
+				mutation: prepared
+			}))));
+			return prepared.receipt;
+		}), { mode: "batch" })).value;
+	});
+	return normalizeD1Failure(execution.pipe(Effect.catchCause(recoverD1BatchCause)), isD1DomainError);
+}
+const subjectColumns = (mapping) => ({
+	id: column(mapping.subject.table, mapping.subject.id),
+	status: column(mapping.subject.table, mapping.subject.status),
+	revision: column(mapping.subject.table, mapping.subject.securityRevision)
+});
+const credentialColumns = (mapping) => ({
+	subjectId: column(mapping.credential.table, mapping.credential.subjectId),
+	id: column(mapping.credential.table, mapping.credential.credentialId),
+	revision: column(mapping.credential.table, mapping.credential.revision),
+	...mapping.credential.status === void 0 ? {} : { status: column(mapping.credential.table, mapping.credential.status) }
+});
+const flowColumns = (mapping) => ({
+	flowId: column(mapping.flow.table, mapping.flow.flowId),
+	subjectId: column(mapping.flow.table, mapping.flow.subjectId),
+	state: column(mapping.flow.table, mapping.flow.state),
+	pendingDigest: column(mapping.flow.table, mapping.flow.pendingDigest),
+	dedupUntil: column(mapping.flow.table, mapping.flow.dedupUntil)
+});
+const hasActiveFlow = Effect.fn("D1Session.hasActiveFlow")(function* (mapping, flowId) {
+	const database = yield* CurrentD1PlanningDatabase;
+	const f = flowColumns(mapping);
+	return yield* database.select({ flowId: f.flowId }).from(mapping.flow.table).where(and(eq(f.flowId, flowId), gt(f.dedupUntil, mapping.d1.engineNow))).limit(1).pipe(Effect.map((rows) => rows.length > 0));
+});
+const recoverFlowOrStale = (mapping, flowId) => hasActiveFlow(mapping, flowId).pipe(Effect.flatMap((active) => Effect.fail(active ? SessionConflict.make({}) : StaleAuthentication.make({}))));
+const pendingColumns = (mapping) => ({
+	digest: column(mapping.pending.table, mapping.pending.digest),
+	version: column(mapping.pending.table, mapping.pending.version),
+	flowId: column(mapping.pending.table, mapping.pending.flowId),
+	subjectId: column(mapping.pending.table, mapping.pending.subjectId),
+	bindingDigest: column(mapping.pending.table, mapping.pending.bindingDigest),
+	expiresAt: column(mapping.pending.table, mapping.pending.expiresAt),
+	attemptLimit: column(mapping.pending.table, mapping.pending.attemptLimit),
+	failedAttempts: column(mapping.pending.table, mapping.pending.failedAttempts),
+	consumed: column(mapping.pending.table, mapping.pending.consumed)
+});
+const sessionColumns = (mapping) => ({
+	sessionId: column(mapping.session.table, mapping.session.sessionId),
+	subjectId: column(mapping.session.table, mapping.session.subjectId),
+	digest: column(mapping.session.table, mapping.session.digest),
+	version: column(mapping.session.table, mapping.session.version),
+	securityRevision: column(mapping.session.table, mapping.session.securityRevision),
+	issuedAt: column(mapping.session.table, mapping.session.issuedAt),
+	expiresAt: column(mapping.session.table, mapping.session.expiresAt),
+	absoluteExpiresAt: column(mapping.session.table, mapping.session.absoluteExpiresAt)
+});
+const captureDetails = Effect.fn("DrizzleD1Session.captureDetails")(function* (mapping, subjectId, credentialIds) {
+	const database = yield* CurrentD1PlanningDatabase;
+	const requested = [...new Set(credentialIds)].sort();
+	if (requested.length !== credentialIds.length) return yield* stale();
+	const nativeSubjectId = yield* mapping.subjectId.toNative(subjectId);
+	const sc = subjectColumns(mapping);
+	const cc = credentialColumns(mapping);
+	const rows = yield* requested.length === 0 ? database.select({ subject: getTableColumns(mapping.subject.table) }).from(mapping.subject.table).where(eq(sc.id, nativeSubjectId)).limit(1).pipe(Effect.map((selected) => selected.map((row) => ({
+		subject: row.subject,
+		credential: void 0
+	})))) : database.select({
+		subject: getTableColumns(mapping.subject.table),
+		credential: getTableColumns(mapping.credential.table)
+	}).from(mapping.subject.table).innerJoin(mapping.credential.table, and(eq(cc.subjectId, sc.id), inArray(cc.id, requested))).where(eq(sc.id, nativeSubjectId));
+	const subject = rows[0]?.subject;
+	if (subject === void 0 || !mapping.subject.isActiveStatus(subject[mapping.subject.status])) return yield* stale();
+	const credentials = rows.flatMap((row) => row.credential === void 0 || row.credential === null ? [] : [row.credential]);
+	if (credentials.length !== requested.length || credentials.some((row) => mapping.credential.status !== void 0 && mapping.credential.isActiveStatus?.(row[mapping.credential.status]) !== true)) return yield* stale();
+	return {
+		subject,
+		revision: {
+			subjectId,
+			securityRevision: subject[mapping.subject.securityRevision],
+			credentials: credentials.map((row) => ({
+				credentialId: row[mapping.credential.credentialId],
+				revision: row[mapping.credential.revision]
+			})).sort((a, b) => a.credentialId.localeCompare(b.credentialId))
+		}
+	};
+});
+const capture = Effect.fn("DrizzleD1Session.capture")(function* (mapping, subjectId, credentialIds) {
+	return (yield* captureDetails(mapping, subjectId, credentialIds)).revision;
+});
+const requirement = Effect.fn("DrizzleD1Session.requirement")(function* (mapping, evidence) {
+	const current = yield* captureDetails(mapping, evidence.revision.subjectId, evidence.revision.credentials.map((item) => item.credentialId));
+	const expected = new Map(evidence.revision.credentials.map((item) => [item.credentialId, item.revision]));
+	if (current.revision.securityRevision !== evidence.revision.securityRevision || current.revision.credentials.some((item) => expected.get(item.credentialId) !== item.revision)) return yield* stale();
+	return yield* mapping.subject.decodeRequirement(current.subject);
+});
+const authorityCondition = (mapping, nativeSubjectId, evidence) => {
+	const sc = subjectColumns(mapping);
+	const cc = credentialColumns(mapping);
+	const subject = sql`exists(select 1 from ${mapping.subject.table} where ${sc.id} = ${sql.param(nativeSubjectId, sc.id)} and ${sc.status} = ${sql.param(mapping.d1.activeSubjectStatusValue, sc.status)} and ${sc.revision} = ${sql.param(evidence.revision.securityRevision, sc.revision)})`;
+	const credentials = evidence.revision.credentials.map((item) => sql`exists(select 1 from ${mapping.credential.table} where ${cc.subjectId} = ${sql.param(nativeSubjectId, cc.subjectId)} and ${cc.id} = ${sql.param(item.credentialId, cc.id)} and ${cc.revision} = ${sql.param(item.revision, cc.revision)}${mapping.credential.status === void 0 ? sql`` : sql` and ${cc.status} = ${sql.param(mapping.d1.activeCredentialStatusValue, cc.status)}`})`);
+	return and(subject, ...credentials);
+};
+const subjectRevisionCondition = (mapping, nativeSubjectId, revision) => {
+	const sc = subjectColumns(mapping);
+	return sql`exists(select 1 from ${mapping.subject.table} where ${sc.id} = ${sql.param(nativeSubjectId, sc.id)} and ${sc.status} = ${sql.param(mapping.d1.activeSubjectStatusValue, sc.status)} and ${sc.revision} = ${sql.param(revision, sc.revision)})`;
+};
+/** Engine-time counterpart of assessAuthentication. Complete transitions must
+* satisfy an entire alternative; incomplete pending flows need one eligible proof. */
+const freshnessCondition = (mapping, evidence, requirement, complete) => {
+	const fresh = evidence.proofs.map((proof) => {
+		const verified = DateTime.toEpochMillis(proof.verifiedAt);
+		return and(sql`${mapping.d1.engineNowMillis} >= ${verified}`, sql`${mapping.d1.engineNowMillis} - ${verified} < ${requirement.maximumAgeMillis}`);
+	});
+	const any = (conditions) => conditions.length === 0 ? sql`false` : or(...conditions);
+	const notFuture = evidence.proofs.map((proof) => sql`${mapping.d1.engineNowMillis} >= ${DateTime.toEpochMillis(proof.verifiedAt)}`);
+	if (!complete) return and(...notFuture, any(fresh));
+	const byCredential = /* @__PURE__ */ new Map();
+	evidence.proofs.forEach((proof, index) => {
+		const previous = byCredential.get(proof.credentialId) ?? [];
+		previous.push(fresh[index]);
+		byCredential.set(proof.credentialId, previous);
+	});
+	const credentialCount = sql.join([...byCredential.values()].map((proofs) => sql`case when ${any(proofs)} then 1 else 0 end`), sql` + `);
+	const alternatives = requirement.alternatives.map((alternative) => and(...alternative.factors.map((factor) => any(fresh.filter((_, index) => evidence.proofs[index].factors.includes(factor)))), sql`(${credentialCount}) >= ${alternative.minimumCredentials}`, any(fresh.filter((_, index) => (!alternative.userVerified || evidence.proofs[index].userVerified) && (!alternative.phishingResistant || evidence.proofs[index].phishingResistant)))));
+	return and(...notFuture, any(alternatives));
+};
+const allocate = (asynchronous, synchronous) => asynchronous !== void 0 ? asynchronous : synchronous === void 0 ? Effect.fail(unavailable()) : Effect.try({
+	try: synchronous,
+	catch: (cause) => PersistenceMappingError.make({
+		operation: "allocate",
+		cause
+	})
+});
+const sameOriginalRevision = (completed, original) => {
+	const current = new Map(completed.revision.credentials.map((item) => [item.credentialId, item.revision]));
+	return completed.flowId === original.flowId && completed.bindingDigest === original.bindingDigest && completed.revision.subjectId === original.revision.subjectId && completed.revision.securityRevision === original.revision.securityRevision && original.revision.credentials.every((item) => current.get(item.credentialId) === item.revision) && original.proofs.every((expected) => completed.proofs.some((proof) => proof.method === expected.method && proof.credentialId === expected.credentialId && proof.userVerified === expected.userVerified && proof.phishingResistant === expected.phishingResistant && DateTime.toEpochMillis(proof.verifiedAt) === DateTime.toEpochMillis(expected.verifiedAt) && proof.factors.length === expected.factors.length && proof.factors.every((factor, index) => factor === expected.factors[index])));
+};
+const readPendingWith = Effect.fn("D1Session.readPendingWith")(function* (mapping, digest, projection) {
+	const row = (yield* (yield* CurrentD1PlanningDatabase).select().from(mapping.pending.table).where(eq(pendingColumns(mapping).digest, digest)).limit(1))[0];
+	if (row === void 0) return void 0;
+	return yield* (projection === "context" ? mapping.pending.decodeContext : mapping.pending.decode)(row);
+});
+const readPending = (mapping, digest) => readPendingWith(mapping, digest, "record");
+const pendingCondition = (mapping, input, nativeSubjectId) => {
+	const p = pendingColumns(mapping);
+	const f = flowColumns(mapping);
+	return and(sql`exists(select 1 from ${mapping.pending.table} where ${p.digest} = ${sql.param(input.digest, p.digest)} and ${p.version} = ${sql.param(input.version, p.version)} and ${p.flowId} = ${sql.param(input.flowId, p.flowId)} and ${p.subjectId} = ${sql.param(nativeSubjectId, p.subjectId)} and ${p.bindingDigest} = ${sql.param(input.bindingDigest, p.bindingDigest)} and ${p.consumed} = ${sql.param(false, p.consumed)} and ${p.failedAttempts} < ${p.attemptLimit} and ${p.expiresAt} > ${mapping.d1.engineNow})`, sql`exists(select 1 from ${mapping.flow.table} where ${f.flowId} = ${sql.param(input.flowId, f.flowId)} and ${f.subjectId} = ${sql.param(nativeSubjectId, f.subjectId)} and ${f.state} = ${sql.param(mapping.flow.pendingStateValue, f.state)} and ${f.pendingDigest} = ${sql.param(input.digest, f.pendingDigest)} and ${f.dedupUntil} > ${mapping.d1.engineNow})`);
+};
+const recoverPendingOrStale = (mapping, input, subjectId) => mapping.subjectId.toNative(subjectId).pipe(Effect.flatMap((nativeSubjectId) => conditionMatches(pendingCondition(mapping, input, nativeSubjectId))), Effect.flatMap((pendingIsCurrent) => Effect.fail(pendingIsCurrent ? StaleAuthentication.make({}) : PendingAuthenticationInvalid.make({}))));
+const consumePendingStatements = Effect.fn("D1Session.consumePendingStatements")(function* (mapping, input, absoluteExpiresAt) {
+	const database = yield* CurrentD1PlanningDatabase;
+	return [yield* statement(database.update(mapping.pending.table).set(updateValues([[mapping.pending.consumed, true]])).where(and(eq(pendingColumns(mapping).digest, input.digest), eq(pendingColumns(mapping).version, input.version)))), yield* statement(database.update(mapping.flow.table).set(updateValues([
+		[mapping.flow.state, mapping.flow.establishedStateValue],
+		[mapping.flow.pendingDigest, null],
+		[mapping.flow.dedupUntil, mapping.flow.encodeInstant(absoluteExpiresAt)]
+	])).where(eq(flowColumns(mapping).flowId, input.flowId)))];
+});
+const makeD1AuthenticationAuthority = (mapping) => ({
+	capture: (subjectId, credentialIds) => capture(mapping, subjectId, credentialIds).pipe(terminalD1),
+	requirements: (evidence) => requirement(mapping, evidence).pipe(terminalD1),
+	approve: (input, prepare) => runPlanned(Effect.gen(function* () {
+		const journal = yield* CurrentCommitJournal;
+		const policy = yield* requirement(mapping, input.evidence);
+		if (!(yield* assessAuthentication(input.evidence, policy)).satisfied) return yield* stale();
+		const nativeSubjectId = yield* mapping.subjectId.toNative(input.evidence.revision.subjectId);
+		let condition = and(authorityCondition(mapping, nativeSubjectId, input.evidence), freshnessCondition(mapping, input.evidence, policy, true), sql`${mapping.d1.engineNowMillis} < ${DateTime.toEpochMillis(input.expiresAt)}`, sql`${DateTime.toEpochMillis(input.expiresAt)} <= ${DateTime.toEpochMillis(input.absoluteExpiresAt)}`);
+		const statements = [];
+		if (input.pending !== void 0) {
+			if (mapping.pending === void 0) return yield* invalidPending();
+			const pendingMapping = {
+				...mapping,
+				...mapping.pending
+			};
+			const stored = yield* readPending(pendingMapping, input.pending.digest);
+			if (stored === void 0 || !sameOriginalRevision(input.evidence, stored.evidence)) return yield* invalidPending();
+			condition = and(condition, pendingCondition(pendingMapping, input.pending, nativeSubjectId));
+			statements.push(...yield* consumePendingStatements(pendingMapping, input.pending, input.absoluteExpiresAt));
+		}
+		return {
+			receipt: prepare(void 0, journal),
+			statements: [yield* assertion(condition), ...statements]
+		};
+	}), void 0, Effect.suspend(() => input.pending === void 0 || mapping.pending === void 0 ? Effect.fail(stale()) : recoverPendingOrStale({
+		...mapping,
+		...mapping.pending
+	}, input.pending, input.evidence.revision.subjectId)))
+});
+/** D1's last authoritative statement checks the original record version and
+* security state together. A later race is still rejected by final consumption. */
+const readAuthenticatedPending = Effect.fn("D1Session.readAuthenticatedPending")(function* (mapping, input, projection) {
+	const record = yield* readPendingWith(mapping, input.digest, projection);
+	if (record === void 0 || input.bindingDigest !== void 0 && record.evidence.bindingDigest !== input.bindingDigest) return yield* invalidPending();
+	const policy = yield* mapFailureCause(requirement(mapping, record.evidence), (error) => error._tag === "StaleAuthentication" ? invalidPending() : error);
+	yield* assessAuthentication(record.evidence, policy).pipe(Effect.mapError(() => invalidPending()));
+	const nativeSubjectId = yield* mapping.subjectId.toNative(record.evidence.revision.subjectId);
+	if (!(yield* conditionMatches(and(authorityCondition(mapping, nativeSubjectId, record.evidence), freshnessCondition(mapping, record.evidence, policy, false), pendingCondition(mapping, {
+		digest: input.digest,
+		bindingDigest: record.evidence.bindingDigest,
+		flowId: record.evidence.flowId,
+		version: record.version
+	}, nativeSubjectId))))) return yield* invalidPending();
+	return record;
+});
+const makeD1PendingAuthentication = (mapping) => ({
+	create: (input, _now, prepare) => runPlanned(Effect.gen(function* () {
+		const database = yield* CurrentD1PlanningDatabase;
+		const journal = yield* CurrentCommitJournal;
+		const policy = yield* requirement(mapping, input.evidence);
+		yield* assessAuthentication(input.evidence, policy);
+		const nativeSubjectId = yield* mapping.subjectId.toNative(input.evidence.revision.subjectId);
+		if (yield* hasActiveFlow(mapping, input.evidence.flowId)) return yield* SessionConflict.make({});
+		const version = yield* allocate(mapping.pending.allocateVersion, mapping.pending.allocateVersionSync);
+		const record = {
+			...input,
+			version
+		};
+		const f = flowColumns(mapping);
+		const condition = and(authorityCondition(mapping, nativeSubjectId, input.evidence), freshnessCondition(mapping, input.evidence, policy, false), sql`${mapping.d1.engineNowMillis} < ${DateTime.toEpochMillis(input.expiresAt)}`, not(sql`exists(select 1 from ${mapping.flow.table} where ${f.flowId} = ${sql.param(input.evidence.flowId, f.flowId)} and ${f.dedupUntil} > ${mapping.d1.engineNow})`));
+		const cleanupPending = database.delete(mapping.pending.table).where(sql`${pendingColumns(mapping).flowId} in (select ${f.flowId} from ${mapping.flow.table} where ${f.flowId} = ${sql.param(input.evidence.flowId, f.flowId)} and ${f.dedupUntil} <= ${mapping.d1.engineNow})`);
+		const cleanupFlow = database.delete(mapping.flow.table).where(and(eq(f.flowId, input.evidence.flowId), sql`${f.dedupUntil} <= ${mapping.d1.engineNow}`));
+		const insertFlow = database.insert(mapping.flow.table).values(mapping.flow.encodePendingInsert({
+			evidence: input.evidence,
+			subjectId: nativeSubjectId,
+			pendingDigest: input.digest,
+			dedupUntil: input.expiresAt
+		}));
+		const insertPending = database.insert(mapping.pending.table).values(mapping.pending.encodeInsert(record, {
+			subjectId: nativeSubjectId,
+			failedAttempts: 0,
+			consumed: false
+		}));
+		return {
+			receipt: prepare(record, journal),
+			statements: [
+				yield* assertion(condition),
+				yield* statement(cleanupPending),
+				yield* statement(cleanupFlow),
+				yield* statement(insertFlow),
+				yield* statement(insertPending)
+			]
+		};
+	}), mapping.isConstraintConflict, recoverFlowOrStale(mapping, input.evidence.flowId)),
+	context: (input) => readAuthenticatedPending(mapping, input, "context").pipe(Effect.flatMap(pendingAuthenticationContext), terminalD1),
+	read: (input) => readAuthenticatedPending(mapping, input, "record").pipe(terminalD1),
+	reject: (input, prepare) => runPlanned(Effect.gen(function* () {
+		const database = yield* CurrentD1PlanningDatabase;
+		const journal = yield* CurrentCommitJournal;
+		const record = yield* readPendingWith(mapping, input.digest, "context");
+		if (record === void 0) return {
+			receipt: prepare({ _tag: "Rejected" }, journal),
+			statements: [yield* assertion(sql`true`)]
+		};
+		const nativeSubjectId = yield* mapping.subjectId.toNative(record.evidence.revision.subjectId);
+		const p = pendingColumns(mapping);
+		const condition = and(authorityCondition(mapping, nativeSubjectId, record.evidence), eq(p.digest, input.digest), eq(p.bindingDigest, input.bindingDigest), eq(p.consumed, false), gt(p.expiresAt, mapping.d1.engineNow));
+		const update = database.update(mapping.pending.table).set(updateValues([[mapping.pending.failedAttempts, sql`case when ${p.failedAttempts} < ${p.attemptLimit} then ${p.failedAttempts} + 1 else ${p.failedAttempts} end`]])).where(condition);
+		return {
+			receipt: prepare({ _tag: "Rejected" }, journal),
+			statements: [yield* statement(update)]
+		};
+	}))
+});
+const makeD1StatefulSessions = (mapping) => {
+	const s = sessionColumns(mapping);
+	return {
+		persistence: {
+			establish: (input, prepare) => runPlanned(Effect.gen(function* () {
+				const database = yield* CurrentD1PlanningDatabase;
+				const journal = yield* CurrentCommitJournal;
+				const policy = yield* requirement(mapping, input.evidence);
+				const assessed = yield* assessAuthentication(input.evidence, policy);
+				if (!assessed.satisfied) return yield* stale();
+				const nativeSubjectId = yield* mapping.subjectId.toNative(input.evidence.revision.subjectId);
+				if (input.pending === void 0 && (yield* hasActiveFlow(mapping, input.evidence.flowId))) return yield* SessionConflict.make({});
+				const nativeSessionId = yield* allocate(mapping.session.allocateId, mapping.session.allocateIdSync);
+				const sessionId = yield* mapping.sessionId.toSession(nativeSessionId);
+				const version = yield* allocate(mapping.session.allocateVersion, mapping.session.allocateVersionSync);
+				const record = {
+					...input.session,
+					sessionId,
+					version,
+					subjectId: input.evidence.revision.subjectId,
+					securityRevision: input.evidence.revision.securityRevision,
+					assurance: assessed.assurance,
+					provenance: yield* snapshotSessionAuthenticationProvenance({ evidence: input.evidence }),
+					issuedAt: DateTime.makeUnsafe(DateTime.toEpochMillis(input.session.issuedAt))
+				};
+				let condition = and(authorityCondition(mapping, nativeSubjectId, input.evidence), freshnessCondition(mapping, input.evidence, policy, true), sql`${DateTime.toEpochMillis(record.issuedAt)} <= ${mapping.d1.engineNowMillis}`, sql`${mapping.d1.engineNowMillis} < ${DateTime.toEpochMillis(record.expiresAt)}`, sql`${DateTime.toEpochMillis(record.expiresAt)} <= ${DateTime.toEpochMillis(record.absoluteExpiresAt)}`);
+				const statements = [];
+				if (input.pending === void 0) {
+					const f = flowColumns(mapping);
+					condition = and(condition, not(sql`exists(select 1 from ${mapping.flow.table} where ${f.flowId} = ${sql.param(input.evidence.flowId, f.flowId)} and ${f.dedupUntil} > ${mapping.d1.engineNow})`));
+					if (mapping.pending !== void 0) statements.push(yield* statement(database.delete(mapping.pending.table).where(eq(column(mapping.pending.table, mapping.pending.flowId), input.evidence.flowId))));
+					statements.push(yield* statement(database.delete(mapping.flow.table).where(eq(f.flowId, input.evidence.flowId))), yield* statement(database.insert(mapping.flow.table).values(mapping.flow.encodeEstablishedInsert({
+						evidence: input.evidence,
+						subjectId: nativeSubjectId,
+						dedupUntil: record.absoluteExpiresAt
+					}))));
+				} else {
+					if (mapping.pending === void 0) return yield* invalidPending();
+					const stored = yield* readPending(mapping, input.pending.digest);
+					if (stored === void 0 || !sameOriginalRevision(input.evidence, stored.evidence)) return yield* invalidPending();
+					condition = and(condition, pendingCondition(mapping, input.pending, nativeSubjectId));
+					statements.push(...yield* consumePendingStatements(mapping, input.pending, record.absoluteExpiresAt));
+				}
+				statements.push(yield* statement(database.insert(mapping.session.table).values(mapping.session.encodeInsert(record, {
+					subjectId: nativeSubjectId,
+					sessionId: nativeSessionId
+				}))));
+				return {
+					receipt: prepare(record, journal),
+					statements: [yield* assertion(condition), ...statements]
+				};
+			}), mapping.isConstraintConflict, Effect.suspend(() => input.pending === void 0 ? recoverFlowOrStale(mapping, input.evidence.flowId) : recoverPendingOrStale(mapping, input.pending, input.evidence.revision.subjectId))),
+			verify: (input) => Effect.gen(function* () {
+				const rows = yield* (yield* CurrentD1PlanningDatabase).select({ ...getTableColumns(mapping.session.table) }).from(mapping.session.table).innerJoin(mapping.subject.table, and(eq(s.subjectId, subjectColumns(mapping).id), eq(s.securityRevision, subjectColumns(mapping).revision), eq(subjectColumns(mapping).status, mapping.d1.activeSubjectStatusValue))).where(and(eq(s.digest, input.digest), gt(s.expiresAt, mapping.d1.engineNow), gt(s.absoluteExpiresAt, mapping.d1.engineNow))).limit(1);
+				if (rows[0] === void 0) return yield* invalidSession();
+				return yield* mapping.session.decode(rows[0]);
+			}).pipe(terminalD1),
+			rotate: (input, prepare) => runPlanned(Effect.gen(function* () {
+				const database = yield* CurrentD1PlanningDatabase;
+				const journal = yield* CurrentCommitJournal;
+				const nativeSessionId = yield* mapping.sessionId.toNative(input.sessionId);
+				const row = (yield* database.select().from(mapping.session.table).where(eq(s.sessionId, nativeSessionId)).limit(1))[0];
+				if (row === void 0) return yield* SessionConflict.make({});
+				const current = yield* mapping.session.decode(row);
+				const nativeSubjectId = yield* mapping.subjectId.toNative(current.subjectId);
+				const version = yield* allocate(mapping.session.allocateVersion, mapping.session.allocateVersionSync);
+				const next = {
+					...current,
+					digest: input.nextDigest,
+					credentialVersion: input.nextCredentialVersion,
+					version,
+					issuedAt: DateTime.makeUnsafe(DateTime.toEpochMillis(input.now)),
+					expiresAt: input.nextExpiresAt
+				};
+				const sessionCondition = and(eq(s.sessionId, nativeSessionId), eq(s.digest, input.expectedDigest), eq(s.version, input.expectedVersion), eq(s.securityRevision, input.expectedSecurityRevision), gt(s.expiresAt, mapping.d1.engineNow), gt(s.absoluteExpiresAt, mapping.d1.engineNow));
+				const timeCondition = and(sql`${DateTime.toEpochMillis(next.issuedAt)} <= ${mapping.d1.engineNowMillis}`, sql`${mapping.d1.engineNowMillis} < ${DateTime.toEpochMillis(input.nextExpiresAt)}`, sql`${DateTime.toEpochMillis(input.nextExpiresAt)} <= ${DateTime.toEpochMillis(current.absoluteExpiresAt)}`);
+				const authority = subjectRevisionCondition(mapping, nativeSubjectId, input.expectedSecurityRevision);
+				const assertionCondition = and(authority, sql`exists(select 1 from ${mapping.session.table} where ${sessionCondition})`, timeCondition);
+				const update = database.update(mapping.session.table).set(mapping.session.encodeRotation(next)).where(and(authority, sessionCondition, timeCondition));
+				return {
+					receipt: prepare(next, journal),
+					statements: [yield* assertion(assertionCondition), yield* statement(update)]
+				};
+			}), void 0, Effect.fail(SessionConflict.make({}))),
+			revokeDigest: (digest, prepare) => runPlanned(Effect.gen(function* () {
+				const database = yield* CurrentD1PlanningDatabase;
+				const journal = yield* CurrentCommitJournal;
+				const row = (yield* database.select().from(mapping.session.table).where(eq(s.digest, digest)).limit(1))[0];
+				const statements = row === void 0 ? [yield* assertion(sql`true`)] : [yield* statement(database.delete(mapping.session.table).where(eq(s.digest, digest)))];
+				return {
+					receipt: prepare(row !== void 0, journal),
+					statements
+				};
+			})),
+			revoke: (input, prepare) => runPlanned(Effect.gen(function* () {
+				const database = yield* CurrentD1PlanningDatabase;
+				const journal = yield* CurrentCommitJournal;
+				const nativeSubjectId = yield* mapping.subjectId.toNative(input.subjectId);
+				const nativeSessionId = yield* mapping.sessionId.toNative(input.sessionId);
+				const condition = subjectRevisionCondition(mapping, nativeSubjectId, input.expectedSecurityRevision);
+				const remove = database.delete(mapping.session.table).where(and(eq(s.subjectId, nativeSubjectId), eq(s.sessionId, nativeSessionId)));
+				return {
+					receipt: prepare(void 0, journal),
+					statements: [yield* assertion(condition), yield* statement(remove)]
+				};
+			}), void 0, Effect.fail(stale())),
+			revokeAll: (input, prepare) => runPlanned(Effect.gen(function* () {
+				const database = yield* CurrentD1PlanningDatabase;
+				const journal = yield* CurrentCommitJournal;
+				const nativeSubjectId = yield* mapping.subjectId.toNative(input.subjectId);
+				const next = yield* allocate(mapping.subject.nextSecurityRevision?.(input.expectedSecurityRevision), mapping.subject.nextSecurityRevisionSync === void 0 ? void 0 : () => mapping.subject.nextSecurityRevisionSync(input.expectedSecurityRevision));
+				const sc = subjectColumns(mapping);
+				const condition = and(eq(sc.id, nativeSubjectId), eq(sc.status, mapping.d1.activeSubjectStatusValue), eq(sc.revision, input.expectedSecurityRevision));
+				const updateSubject = database.update(mapping.subject.table).set(updateValues([[mapping.subject.securityRevision, next]])).where(condition);
+				const removeSessions = database.delete(mapping.session.table).where(eq(s.subjectId, nativeSubjectId));
+				return {
+					receipt: prepare(void 0, journal),
+					statements: [
+						yield* assertion(sql`exists(select 1 from ${mapping.subject.table} where ${condition})`),
+						yield* statement(updateSubject),
+						yield* statement(removeSessions)
+					]
+				};
+			}), void 0, Effect.fail(stale()))
+		},
+		repository: { list: (input) => Effect.gen(function* () {
+			const database = yield* CurrentD1PlanningDatabase;
+			const nativeSubjectId = yield* mapping.subjectId.toNative(input.subjectId);
+			const cursor = input.cursor === void 0 ? void 0 : yield* mapping.sessionId.toNative(input.cursor);
+			const rows = yield* database.select({ ...getTableColumns(mapping.session.table) }).from(mapping.session.table).innerJoin(mapping.subject.table, and(eq(s.subjectId, subjectColumns(mapping).id), eq(s.securityRevision, subjectColumns(mapping).revision), eq(subjectColumns(mapping).status, mapping.d1.activeSubjectStatusValue))).where(and(eq(s.subjectId, nativeSubjectId), gt(s.expiresAt, mapping.d1.engineNow), gt(s.absoluteExpiresAt, mapping.d1.engineNow), cursor === void 0 ? void 0 : gt(s.sessionId, cursor))).orderBy(s.sessionId).limit(input.limit + 1);
+			const decoded = yield* Effect.forEach(rows, (row) => mapping.session.decode(row));
+			const codec = Schema.toCodecJson(Schema.toType(SessionMetadata));
+			const sessions = yield* Effect.forEach(decoded.slice(0, input.limit), (record) => Schema.encodeEffect(codec)(record).pipe(Effect.flatMap(Schema.decodeEffect(codec))));
+			return {
+				sessions,
+				...decoded.length <= input.limit ? {} : { nextCursor: sessions.at(-1)?.sessionId }
+			};
+		}).pipe(terminalD1) }
+	};
+};
+const makeD1SignedValidity = (mapping) => {
+	const sc = subjectColumns(mapping);
+	const t = {
+		subjectId: column(mapping.tombstone.table, mapping.tombstone.subjectId),
+		sessionId: column(mapping.tombstone.table, mapping.tombstone.sessionId),
+		absoluteExpiresAt: column(mapping.tombstone.table, mapping.tombstone.absoluteExpiresAt)
+	};
+	return {
+		verify: (session, _now) => Effect.gen(function* () {
+			const database = yield* CurrentD1PlanningDatabase;
+			const nativeSubjectId = yield* mapping.subjectId.toNative(session.subjectId);
+			const nativeSessionId = yield* mapping.sessionId.toNative(session.sessionId);
+			if ((yield* database.select({ subjectId: sc.id }).from(mapping.subject.table).where(and(eq(sc.id, nativeSubjectId), eq(sc.status, mapping.d1.activeSubjectStatusValue), eq(sc.revision, session.securityRevision), sql`${mapping.d1.engineNowMillis} < ${DateTime.toEpochMillis(session.expiresAt)}`, sql`${mapping.d1.engineNowMillis} < ${DateTime.toEpochMillis(session.absoluteExpiresAt)}`, not(sql`exists(select 1 from ${mapping.tombstone.table} where ${t.subjectId} = ${sql.param(nativeSubjectId, t.subjectId)} and ${t.sessionId} = ${sql.param(nativeSessionId, t.sessionId)} and ${t.absoluteExpiresAt} > ${mapping.d1.engineNow})`))).limit(1)).length === 0) return yield* invalidSession();
+		}).pipe(terminalD1),
+		revoke: (input, prepare) => runPlanned(Effect.gen(function* () {
+			const database = yield* CurrentD1PlanningDatabase;
+			const journal = yield* CurrentCommitJournal;
+			const nativeSubjectId = yield* mapping.subjectId.toNative(input.subjectId);
+			const nativeSessionId = yield* mapping.sessionId.toNative(input.sessionId);
+			const condition = sql`exists(select 1 from ${mapping.subject.table} where ${sc.id} = ${sql.param(nativeSubjectId, sc.id)} and ${sc.status} = ${sql.param(mapping.d1.activeSubjectStatusValue, sc.status)} and ${sc.revision} = ${sql.param(input.expectedSecurityRevision, sc.revision)})`;
+			const encodedExpiry = mapping.tombstone.encodeInstant(input.absoluteExpiresAt);
+			const desiredExpiry = sql.param(encodedExpiry, t.absoluteExpiresAt);
+			const write = database.insert(mapping.tombstone.table).values(mapping.tombstone.encodeInsert({
+				subjectId: nativeSubjectId,
+				sessionId: nativeSessionId,
+				absoluteExpiresAt: input.absoluteExpiresAt
+			})).onConflictDoUpdate({
+				target: [t.subjectId, t.sessionId],
+				set: updateValues([[mapping.tombstone.absoluteExpiresAt, sql`case when ${t.absoluteExpiresAt} < ${desiredExpiry} then ${desiredExpiry} else ${t.absoluteExpiresAt} end`]])
+			});
+			return {
+				receipt: prepare(void 0, journal),
+				statements: [yield* assertion(condition), yield* statement(write)]
+			};
+		}), void 0, Effect.fail(stale())),
+		revokeAll: (input, prepare) => runPlanned(Effect.gen(function* () {
+			const database = yield* CurrentD1PlanningDatabase;
+			const journal = yield* CurrentCommitJournal;
+			const nativeSubjectId = yield* mapping.subjectId.toNative(input.subjectId);
+			const next = yield* allocate(mapping.subject.nextSecurityRevision?.(input.expectedSecurityRevision), mapping.subject.nextSecurityRevisionSync === void 0 ? void 0 : () => mapping.subject.nextSecurityRevisionSync(input.expectedSecurityRevision));
+			const condition = and(eq(sc.id, nativeSubjectId), eq(sc.status, mapping.d1.activeSubjectStatusValue), eq(sc.revision, input.expectedSecurityRevision));
+			const updateSubject = database.update(mapping.subject.table).set(updateValues([[mapping.subject.securityRevision, next]])).where(condition);
+			return {
+				receipt: prepare(void 0, journal),
+				statements: [yield* assertion(sql`exists(select 1 from ${mapping.subject.table} where ${condition})`), yield* statement(updateSubject)]
+			};
+		}), void 0, Effect.fail(stale()))
+	};
+};
+const makeD1SessionServiceEffects = {
+	authority: (database, mapping) => Effect.gen(function* () {
+		const hooks = yield* LifecycleHooks;
+		const raw = makeD1AuthenticationAuthority(mapping);
+		const run = (effect) => Effect.gen(function* () {
+			if ((yield* Effect.serviceOption(CurrentD1SessionBatch))._tag === "Some" || (yield* hasCommitScope)) return yield* unavailable();
+			return yield* effect.pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks));
+		});
+		return { authenticationAuthority: {
+			capture: (subjectId, credentialIds) => run(raw.capture(subjectId, credentialIds)),
+			requirements: (evidence) => run(raw.requirements(evidence)),
+			approve: (input, prepare) => run(raw.approve(input, prepare))
+		} };
+	}),
+	pending: (database, mapping) => Effect.gen(function* () {
+		const hooks = yield* LifecycleHooks;
+		const raw = makeD1PendingAuthentication(mapping);
+		const run = (effect) => Effect.gen(function* () {
+			if ((yield* Effect.serviceOption(CurrentD1SessionBatch))._tag === "Some" || (yield* hasCommitScope)) return yield* unavailable();
+			return yield* effect.pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks));
+		});
+		return { pendingAuthentication: {
+			create: (input, now, prepare) => run(raw.create(input, now, prepare)),
+			context: (input) => run(raw.context(input)),
+			read: (input) => run(raw.read(input)),
+			reject: (input, prepare) => run(raw.reject(input, prepare))
+		} };
+	}),
+	stateful: (database, mapping) => Effect.gen(function* () {
+		const hooks = yield* LifecycleHooks;
+		const raw = makeD1StatefulSessions(mapping);
+		const run = (effect) => Effect.gen(function* () {
+			if ((yield* Effect.serviceOption(CurrentD1SessionBatch))._tag === "Some" || (yield* hasCommitScope)) return yield* unavailable();
+			return yield* effect.pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks));
+		});
+		return {
+			statefulSessionPersistence: {
+				establish: (input, prepare) => run(raw.persistence.establish(input, prepare)),
+				verify: (input) => run(raw.persistence.verify(input)),
+				rotate: (input, prepare) => run(raw.persistence.rotate(input, prepare)),
+				revokeDigest: (digest, prepare) => run(raw.persistence.revokeDigest(digest, prepare)),
+				revoke: (input, prepare) => run(raw.persistence.revoke(input, prepare)),
+				revokeAll: (input, prepare) => run(raw.persistence.revokeAll(input, prepare))
+			},
+			sessionRepository: { list: (input) => run(raw.repository.list(input)) }
+		};
+	}),
+	validity: (database, mapping) => Effect.gen(function* () {
+		const hooks = yield* LifecycleHooks;
+		const raw = makeD1SignedValidity(mapping);
+		const run = (effect) => Effect.gen(function* () {
+			if ((yield* Effect.serviceOption(CurrentD1SessionBatch))._tag === "Some" || (yield* hasCommitScope)) return yield* unavailable();
+			return yield* effect.pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks));
+		});
+		return { signedSessionValidity: {
+			verify: (session, now) => run(raw.verify(session, now)),
+			revoke: (input, prepare) => run(raw.revoke(input, prepare)),
+			revokeAll: (input, prepare) => run(raw.revokeAll(input, prepare))
+		} };
+	})
+};
+/**
+* Owns one atomic D1 persistence transition together with any number of
+* application statements appended by `owner`. Keeping one persistence
+* transition makes a failed batch's domain guard recoverable without exposing
+* a prepared value. Compose additional transitions in later root batches.
+* Interruption or owner failure before `$client.batch` discards the journal;
+* the adapter performs no hidden retry and a retry must re-plan the whole owner.
+* Caller failures remain in the error channel. D1 batch/transport failures that
+* cannot be tied to this adapter's reserved guard become `SessionUnavailable`.
+*/
+const coordinateD1SessionBatch = (database, make, owner) => Effect.gen(function* () {
+	if (yield* hasCommitScope) return yield* unavailable();
+	return (yield* coordinateCommit(() => Effect.gen(function* () {
+		const statements = [];
+		let mutation;
+		const nativeCollector = D1BatchStatements.of({ append: (statement) => Effect.sync(() => statements.push(statement)) });
+		const d1Owner = yield* makeD1Owner(unavailable()).pipe(Effect.provideService(D1BatchStatements, nativeCollector));
+		let batch;
+		const appendMutation = (input) => d1Owner.run(Effect.suspend(() => {
+			if (mutation !== void 0) return Effect.fail(unavailable());
+			mutation = input;
+			statements.push(...input.statements);
+			return Effect.void;
+		}));
+		batch = {
+			owner: d1Owner,
+			append: appendMutation
+		};
+		const services = yield* make(batch);
+		const value = yield* d1Owner.close(Effect.provideService(owner(services, batch), D1BatchStatements, d1Owner.collector));
+		if (mutation?.journalGuard !== void 0) {
+			const status = yield* Effect.result(mutation.journalGuard.read);
+			if (status._tag === "Success" || status.failure._tag !== "CommitPending") return yield* unavailable();
+		}
+		yield* database.$client.batch(statements).pipe(Effect.catchCause((cause) => Effect.fail(new D1BatchFailure({
+			cause,
+			...mutation === void 0 ? {} : { mutation }
+		}))));
+		return value;
+	}), { mode: "batch" }).pipe(Effect.catchCause(recoverCoordinatedD1BatchCause), Effect.provideService(CurrentD1PlanningDatabase, database))).value;
+});
+const makeD1AuthenticationAuthorityServices = (database, mapping) => makeD1SessionServiceEffects.authority(database, mapping);
+const makeD1PendingAuthenticationServices = (database, mapping) => makeD1SessionServiceEffects.pending(database, mapping);
+const makeD1StatefulSessionServices = (database, mapping) => makeD1SessionServiceEffects.stateful(database, mapping);
+const makeD1SignedSessionValidityServices = (database, mapping) => makeD1SessionServiceEffects.validity(database, mapping);
+function coordinateD1AuthenticationAuthority(acquire, options, body) {
+	return Effect.flatMap(acquire, (database) => coordinateD1SessionBatch(database, (batch) => Effect.gen(function* () {
+		const hooks = yield* LifecycleHooks;
+		const raw = makeD1AuthenticationAuthority(options.mapping);
+		const run = (effect) => batch.owner.run(effect.pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks), Effect.provideService(CurrentD1SessionBatch, batch)));
+		return { authenticationAuthority: {
+			capture: (subjectId, credentialIds) => run(raw.capture(subjectId, credentialIds)),
+			requirements: (evidence) => run(raw.requirements(evidence)),
+			approve: (input, prepare) => run(raw.approve(input, prepare))
+		} };
+	}), (ownedServices, batch) => {
+		const provided = Context.make(AuthenticationAuthority, ownedServices.authenticationAuthority).pipe(Context.add(D1BatchStatements, batch.owner.collector));
+		return Effect.provideContext(body, provided);
+	}));
+}
+function coordinateD1PendingAuthentication(acquire, options, body) {
+	return Effect.flatMap(acquire, (database) => coordinateD1SessionBatch(database, (batch) => Effect.gen(function* () {
+		const hooks = yield* LifecycleHooks;
+		const raw = makeD1PendingAuthentication(options.mapping);
+		const run = (effect) => batch.owner.run(effect.pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks), Effect.provideService(CurrentD1SessionBatch, batch)));
+		return { pendingAuthentication: {
+			create: (input, now, prepare) => run(raw.create(input, now, prepare)),
+			context: (input) => run(raw.context(input)),
+			read: (input) => run(raw.read(input)),
+			reject: (input, prepare) => run(raw.reject(input, prepare))
+		} };
+	}), (ownedServices, batch) => {
+		const provided = Context.make(options.target, ownedServices.pendingAuthentication).pipe(Context.add(D1BatchStatements, batch.owner.collector));
+		return Effect.provideContext(body, provided);
+	}));
+}
+function coordinateD1StatefulSessions(acquire, options, body) {
+	return Effect.flatMap(acquire, (database) => coordinateD1SessionBatch(database, (batch) => Effect.gen(function* () {
+		const hooks = yield* LifecycleHooks;
+		const raw = makeD1StatefulSessions(options.mapping);
+		const run = (effect) => batch.owner.run(effect.pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks), Effect.provideService(CurrentD1SessionBatch, batch)));
+		return {
+			statefulSessionPersistence: {
+				establish: (input, prepare) => run(raw.persistence.establish(input, prepare)),
+				verify: (input) => run(raw.persistence.verify(input)),
+				rotate: (input, prepare) => run(raw.persistence.rotate(input, prepare)),
+				revokeDigest: (digest, prepare) => run(raw.persistence.revokeDigest(digest, prepare)),
+				revoke: (input, prepare) => run(raw.persistence.revoke(input, prepare)),
+				revokeAll: (input, prepare) => run(raw.persistence.revokeAll(input, prepare))
+			},
+			sessionRepository: { list: (input) => run(raw.repository.list(input)) }
+		};
+	}), (ownedServices, batch) => {
+		const provided = Context.make(options.persistence, ownedServices.statefulSessionPersistence).pipe(Context.add(options.repository, ownedServices.sessionRepository), Context.add(D1BatchStatements, batch.owner.collector));
+		return Effect.provideContext(body, provided);
+	}));
+}
+function coordinateD1SignedSessionValidity(acquire, options, body) {
+	return Effect.flatMap(acquire, (database) => coordinateD1SessionBatch(database, (batch) => Effect.gen(function* () {
+		const hooks = yield* LifecycleHooks;
+		const raw = makeD1SignedValidity(options.mapping);
+		const run = (effect) => batch.owner.run(effect.pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks), Effect.provideService(CurrentD1SessionBatch, batch)));
+		return { signedSessionValidity: {
+			verify: (session, now) => run(raw.verify(session, now)),
+			revoke: (input, prepare) => run(raw.revoke(input, prepare)),
+			revokeAll: (input, prepare) => run(raw.revokeAll(input, prepare))
+		} };
+	}), (ownedServices, batch) => {
+		const provided = Context.make(options.target, ownedServices.signedSessionValidity).pipe(Context.add(D1BatchStatements, batch.owner.collector));
+		return Effect.provideContext(body, provided);
+	}));
+}
+const stepUpColumns = (mapping) => Object.fromEntries([
+	"digest",
+	"version",
+	"flowId",
+	"subjectId",
+	"bindingDigest",
+	"snapshot",
+	"expiresAt",
+	"attemptLimit",
+	"failedAttempts",
+	"consumed"
+].map((key) => [key, column(mapping.intent.table, mapping.intent[key])]));
+const stepUpSourceCondition = (mapping, intent, nativeSubjectId, nativeSessionId, plan) => {
+	const source = mapping.source;
+	if (source.kind !== intent.sourceKind) return sql`false`;
+	const time = and(sql`${mapping.d1.engineNowMillis} >= ${DateTime.toEpochMillis(intent.sourceAuthenticatedAt)}`, sql`${mapping.d1.engineNowMillis} < ${DateTime.toEpochMillis(intent.sourceExpiresAt)}`, sql`${mapping.d1.engineNowMillis} < ${DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt)}`);
+	if (source.kind === "StatelessSigned") return time;
+	if (source.kind === "StateAssistedSigned") {
+		const t = source.tombstone, owner = column(t.table, t.subjectId), id = column(t.table, t.sessionId), expiry = column(t.table, t.absoluteExpiresAt);
+		return and(time, not(sql`exists(select 1 from ${t.table} where ${owner}=${sql.param(nativeSubjectId, owner)} and ${id}=${sql.param(nativeSessionId, id)} and ${expiry}>${mapping.d1.engineNow})`));
+	}
+	const s = source.session, c = sessionColumns(source);
+	const condition = and(eq(c.sessionId, nativeSessionId), eq(c.subjectId, nativeSubjectId), eq(c.securityRevision, intent.revision.securityRevision), eq(column(s.table, s.credentialVersion), intent.sourceCredentialVersion), eq(column(s.table, s.authenticatedAt), s.encodeInstant(intent.sourceAuthenticatedAt)), eq(c.expiresAt, s.encodeInstant(intent.sourceExpiresAt)), eq(c.absoluteExpiresAt, s.encodeInstant(intent.sourceAbsoluteExpiresAt)), gt(c.expiresAt, mapping.d1.engineNow), gt(c.absoluteExpiresAt, mapping.d1.engineNow), plan?.replacement._tag === "Stateful" ? eq(c.digest, plan.replacement.expectedDigest) : void 0, plan?.replacement._tag === "Stateful" ? eq(c.version, plan.replacement.expectedRowVersion) : void 0);
+	return and(time, sql`exists(select 1 from ${s.table} where ${condition})`);
+};
+const stepUpRowCondition = (mapping, row, intent, nativeSubjectId) => {
+	const c = stepUpColumns(mapping), m = mapping.intent;
+	return and(eq(c.digest, intent.digest), eq(c.version, intent.version), eq(c.flowId, intent.flowId), eq(c.subjectId, nativeSubjectId), eq(c.bindingDigest, intent.bindingDigest), eq(c.snapshot, row[m.snapshot]), eq(c.expiresAt, m.encodeInstant(intent.expiresAt)), eq(c.attemptLimit, intent.attemptLimit), eq(c.consumed, false), eq(c.failedAttempts, row[m.failedAttempts]), sql`${c.failedAttempts} >= 0`, sql`${c.failedAttempts} < ${c.attemptLimit}`, gt(c.expiresAt, mapping.d1.engineNow));
+};
+const readD1StepUp = Effect.fn("DrizzleD1StepUp.read")(function* (mapping, digest) {
+	const database = yield* CurrentD1PlanningDatabase;
+	const m = mapping.intent, c = stepUpColumns(mapping);
+	const row = (yield* database.select().from(m.table).where(eq(c.digest, digest)).limit(1))[0];
+	if (row === void 0) return yield* SessionStepUpInvalid.make({});
+	const intent = yield* decodeStepUpIntent(row[m.snapshot]);
+	if (intent.digest !== digest || !stepUpIntentLive(intent, mapping.source.kind, yield* DateTime.now) || !Schema.is(Schema.Natural)(row[m.failedAttempts])) return yield* SessionStepUpInvalid.make({});
+	const nativeSubjectId = yield* mapping.subjectId.toNative(intent.revision.subjectId);
+	const nativeSessionId = mapping.source.kind === "StatelessSigned" ? void 0 : yield* mapping.source.sessionId.toNative(intent.sourceSessionId);
+	const condition = and(authorityCondition(mapping, nativeSubjectId, intent), stepUpSourceCondition(mapping, intent, nativeSubjectId, nativeSessionId), sql`exists(select 1 from ${m.table} where ${stepUpRowCondition(mapping, row, intent, nativeSubjectId)})`, sql`${mapping.d1.engineNowMillis} < ${DateTime.toEpochMillis(intent.expiresAt)}`);
+	if (!(yield* conditionMatches(condition))) return yield* SessionStepUpInvalid.make({});
+	return {
+		row,
+		intent,
+		nativeSubjectId,
+		nativeSessionId
+	};
+});
+const isD1StepUpRejectAbsence = (error) => typeof error === "object" && error !== null && Reflect.get(error, "_tag") === "SessionStepUpInvalid";
+const recoverD1StepUpRejectAbsence = (effect, rejected) => effect.pipe(Effect.catchCause((cause) => {
+	if (cause.reasons.length > 0 && cause.reasons.every((reason) => Cause.isFailReason(reason) && isD1StepUpRejectAbsence(reason.error))) return Effect.succeed(rejected);
+	return Effect.failCause(Cause.map(cause, (error) => isD1StepUpRejectAbsence(error) ? SessionUnavailable.make({}) : error));
+}));
+const makeD1SessionStepUp = (mapping) => {
+	const m = mapping.intent, c = stepUpColumns(mapping);
+	const recover = Effect.fail(SessionStepUpInvalid.make({}));
+	return {
+		create: (input, _now, prepare) => runPlanned(Effect.gen(function* () {
+			const database = yield* CurrentD1PlanningDatabase;
+			const journal = yield* CurrentCommitJournal;
+			const version = yield* allocate(m.allocateVersion, m.allocateVersionSync), record = {
+				...input,
+				version
+			};
+			if (!stepUpIntentLive(record, mapping.source.kind, yield* DateTime.now)) return yield* stale();
+			const nativeSubjectId = yield* mapping.subjectId.toNative(input.revision.subjectId);
+			const nativeSessionId = mapping.source.kind === "StatelessSigned" ? void 0 : yield* mapping.source.sessionId.toNative(input.sourceSessionId);
+			if ((yield* database.select().from(m.table).where(or(eq(c.digest, input.digest), eq(c.flowId, input.flowId))).limit(1)).length > 0) return yield* SessionConflict.make({});
+			const condition = and(authorityCondition(mapping, nativeSubjectId, record), stepUpSourceCondition(mapping, record, nativeSubjectId, nativeSessionId), sql`${mapping.d1.engineNowMillis} < ${DateTime.toEpochMillis(input.expiresAt)}`);
+			if (!(yield* conditionMatches(condition))) return yield* stale();
+			const snapshot = yield* encodeStepUpIntent(record);
+			const values = {
+				...m.encodeInsert(record, { subjectId: nativeSubjectId }),
+				...updateValues([
+					[m.digest, record.digest],
+					[m.version, version],
+					[m.flowId, record.flowId],
+					[m.subjectId, nativeSubjectId],
+					[m.bindingDigest, record.bindingDigest],
+					[m.snapshot, snapshot],
+					[m.expiresAt, m.encodeInstant(record.expiresAt)],
+					[m.attemptLimit, record.attemptLimit],
+					[m.failedAttempts, 0],
+					[m.consumed, false]
+				])
+			};
+			const receipt = prepare(record, journal);
+			const exact = and(eq(c.digest, record.digest), eq(c.version, version), eq(c.flowId, record.flowId), eq(c.subjectId, nativeSubjectId), eq(c.bindingDigest, record.bindingDigest), eq(c.snapshot, snapshot), eq(c.expiresAt, m.encodeInstant(record.expiresAt)), eq(c.attemptLimit, record.attemptLimit), eq(c.failedAttempts, 0), eq(c.consumed, false));
+			return {
+				receipt,
+				statements: [
+					yield* assertion(condition),
+					yield* statement(database.insert(m.table).values(values)),
+					yield* assertion(sql`changes() = 1`),
+					yield* assertion(and(condition, sql`exists(select 1 from ${m.table} where ${exact})`))
+				]
+			};
+		}), mapping.isConstraintConflict, Effect.fail(stale())),
+		context: (input) => mapFailureCause(readD1StepUp(mapping, input.digest).pipe(Effect.flatMap(({ intent }) => snapshotPendingAuthenticationContext({
+			flowId: intent.flowId,
+			bindingDigest: intent.bindingDigest,
+			revision: intent.revision,
+			expiresAtMillis: DateTime.toEpochMillis(intent.expiresAt)
+		}))), (error) => error._tag === "PendingAuthenticationInvalid" ? unavailable() : error).pipe(terminalD1),
+		read: (input) => readD1StepUp(mapping, input.digest).pipe(Effect.flatMap(({ intent }) => intent.bindingDigest === input.bindingDigest ? Effect.succeed(intent) : Effect.fail(SessionStepUpInvalid.make({}))), terminalD1),
+		reject: (input, prepare) => runPlanned(Effect.gen(function* () {
+			const database = yield* CurrentD1PlanningDatabase;
+			const journal = yield* CurrentCommitJournal;
+			const selected = yield* recoverD1StepUpRejectAbsence(readD1StepUp(mapping, input.digest).pipe(Effect.map((value) => ({
+				_tag: "Found",
+				value
+			}))), { _tag: "Rejected" });
+			if (selected._tag === "Rejected") return {
+				receipt: prepare({ _tag: "Rejected" }, journal),
+				statements: []
+			};
+			const { row, intent, nativeSubjectId, nativeSessionId } = selected.value;
+			const condition = and(eq(c.digest, intent.digest), eq(c.version, intent.version), eq(c.snapshot, row[m.snapshot]), eq(c.subjectId, nativeSubjectId), eq(c.bindingDigest, intent.bindingDigest), eq(c.flowId, intent.flowId), eq(c.expiresAt, m.encodeInstant(intent.expiresAt)), eq(c.attemptLimit, intent.attemptLimit), eq(c.consumed, false), sql`${c.failedAttempts} >= 0`, sql`${c.failedAttempts} < ${c.attemptLimit}`, gt(c.expiresAt, mapping.d1.engineNow), authorityCondition(mapping, nativeSubjectId, intent), stepUpSourceCondition(mapping, intent, nativeSubjectId, nativeSessionId));
+			const write = database.update(m.table).set(updateValues([[m.failedAttempts, sql`${c.failedAttempts} + 1`]])).where(condition);
+			const settled = sql`changes() = 1 or not exists(select 1 from ${m.table} where ${condition})`;
+			return {
+				receipt: prepare({ _tag: "Rejected" }, journal),
+				statements: [yield* statement(write), yield* assertion(settled)]
+			};
+		}), void 0, Effect.fail(unavailable())),
+		complete: (plan, prepare) => runPlanned(Effect.gen(function* () {
+			const database = yield* CurrentD1PlanningDatabase;
+			const journal = yield* CurrentCommitJournal;
+			yield* validateStepUpPlan(plan);
+			const stored = yield* readD1StepUp(mapping, plan.intent.digest);
+			if ((yield* encodeStepUpIntent(stored.intent)) !== (yield* encodeStepUpIntent(plan.intent))) return yield* SessionStepUpInvalid.make({});
+			const base = yield* requirement(mapping, plan.evidence);
+			if (!(yield* assessAuthentication(plan.evidence, base)).satisfied || !(yield* assessAuthentication(plan.evidence, stored.intent.requirement)).satisfied) return yield* stale();
+			const { row, intent, nativeSubjectId, nativeSessionId } = stored, replacement = plan.replacement;
+			const target = replacement.inspection.session;
+			if (DateTime.toEpochMillis(target.expiresAt) > DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt)) return yield* SessionStepUpInvalid.make({});
+			const live = and(authorityCondition(mapping, nativeSubjectId, plan.evidence), freshnessCondition(mapping, plan.evidence, base, true), freshnessCondition(mapping, plan.evidence, intent.requirement, true), sql`${mapping.d1.engineNowMillis} >= ${DateTime.toEpochMillis(intent.sourceAuthenticatedAt)}`, sql`${mapping.d1.engineNowMillis} < ${DateTime.toEpochMillis(intent.expiresAt)}`, sql`${mapping.d1.engineNowMillis} < ${DateTime.toEpochMillis(intent.sourceExpiresAt)}`, sql`${mapping.d1.engineNowMillis} < ${DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt)}`, sql`${mapping.d1.engineNowMillis} >= ${DateTime.toEpochMillis(target.issuedAt)}`, sql`${mapping.d1.engineNowMillis} < ${DateTime.toEpochMillis(target.expiresAt)}`);
+			const source = stepUpSourceCondition(mapping, intent, nativeSubjectId, nativeSessionId, plan);
+			const version = yield* allocate(m.allocateVersion, m.allocateVersionSync);
+			if (version === intent.version) return yield* unavailable();
+			const snapshot = yield* encodeStepUpIntent({
+				...intent,
+				version
+			});
+			const consume = database.update(m.table).set(updateValues([
+				[m.consumed, true],
+				[m.version, version],
+				[m.snapshot, snapshot]
+			])).where(and(stepUpRowCondition(mapping, row, intent, nativeSubjectId), live, source));
+			const marker = sql`exists(select 1 from ${m.table} where ${c.digest}=${sql.param(intent.digest, c.digest)} and ${c.version}=${sql.param(version, c.version)} and ${c.snapshot}=${sql.param(snapshot, c.snapshot)} and ${c.consumed}=${sql.param(true, c.consumed)} and ${c.failedAttempts}=${row[m.failedAttempts]})`;
+			const statements = [yield* statement(consume), yield* assertion(sql`changes() = 1`)];
+			let post = sql`true`;
+			if (replacement._tag === "Stateful") {
+				if (mapping.source.kind !== "Stateful") return yield* SessionStepUpInvalid.make({});
+				const s = mapping.source.session, sc = sessionColumns(mapping.source);
+				const rowVersion = yield* allocate(s.allocateVersion, s.allocateVersionSync);
+				const next = {
+					...target,
+					provenance: replacement.inspection.provenance,
+					credentialVersion: replacement.inspection.credentialVersion,
+					digest: replacement.nextDigest,
+					version: rowVersion
+				};
+				const rotation = {
+					...s.encodeRotation(next),
+					...updateValues([
+						[s.version, rowVersion],
+						[s.digest, next.digest],
+						[s.credentialVersion, next.credentialVersion],
+						[s.authenticatedAt, s.encodeInstant(target.assurance.authenticatedAt)],
+						[s.issuedAt, s.encodeInstant(target.issuedAt)],
+						[s.expiresAt, s.encodeInstant(target.expiresAt)],
+						[s.absoluteExpiresAt, s.encodeInstant(target.absoluteExpiresAt)]
+					])
+				};
+				const write = database.update(s.table).set(rotation).where(and(eq(sc.sessionId, nativeSessionId), eq(sc.digest, replacement.expectedDigest), eq(sc.version, replacement.expectedRowVersion), marker, source, live));
+				statements.push(yield* statement(write), yield* assertion(sql`changes() = 1`));
+				const exact = and(eq(sc.sessionId, nativeSessionId), eq(sc.subjectId, nativeSubjectId), eq(sc.version, rowVersion), eq(sc.digest, next.digest), eq(sc.securityRevision, target.securityRevision), eq(column(s.table, s.credentialVersion), next.credentialVersion), eq(column(s.table, s.authenticatedAt), s.encodeInstant(target.assurance.authenticatedAt)), eq(sc.issuedAt, s.encodeInstant(target.issuedAt)), eq(sc.expiresAt, s.encodeInstant(target.expiresAt)), eq(sc.absoluteExpiresAt, s.encodeInstant(target.absoluteExpiresAt)));
+				post = sql`exists(select 1 from ${s.table} where ${exact})`;
+			} else if (replacement._tag === "StateAssistedSigned") {
+				if (mapping.source.kind !== "StateAssistedSigned") return yield* SessionStepUpInvalid.make({});
+				const t = mapping.source.tombstone, owner = column(t.table, t.subjectId), id = column(t.table, t.sessionId), expiry = column(t.table, t.absoluteExpiresAt);
+				statements.push(yield* statement(database.delete(t.table).where(and(eq(owner, nativeSubjectId), eq(id, nativeSessionId), sql`${expiry} <= ${mapping.d1.engineNow}`, marker))));
+				const values = t.encodeInsert({
+					subjectId: nativeSubjectId,
+					sessionId: nativeSessionId,
+					absoluteExpiresAt: replacement.tombstoneUntil
+				});
+				statements.push(yield* statement(database.insert(t.table).values(values)), yield* assertion(sql`changes() = 1`));
+				const exact = and(eq(owner, nativeSubjectId), eq(id, nativeSessionId), eq(expiry, t.encodeInstant(replacement.tombstoneUntil)));
+				post = sql`exists(select 1 from ${t.table} where ${exact})`;
+			}
+			statements.push(yield* assertion(and(marker, post, live)));
+			return {
+				receipt: prepare(replacement.inspection, journal),
+				statements
+			};
+		}), mapping.isConstraintConflict, recover)
+	};
+};
+const makeD1SessionStepUpServices = (database, mapping, target) => Effect.gen(function* () {
+	const hooks = yield* LifecycleHooks;
+	const raw = makeD1SessionStepUp(mapping);
+	const run = (effect) => Effect.gen(function* () {
+		if ((yield* Effect.serviceOption(CurrentD1SessionBatch))._tag === "Some" || (yield* hasCommitScope)) return yield* unavailable();
+		return yield* effect.pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks));
+	});
+	return { sessionStepUpPersistence: target.of({
+		create: (input, now, prepare) => run(raw.create(input, now, prepare)),
+		context: (input) => run(raw.context(input)),
+		read: (input) => run(raw.read(input)),
+		reject: (input, prepare) => run(raw.reject(input, prepare)),
+		complete: (plan, prepare) => run(raw.complete(plan, prepare))
+	}) };
+});
+function coordinateD1SessionStepUp(acquire, options, body) {
+	return Effect.flatMap(acquire, (database) => coordinateD1SessionBatch(database, (batch) => Effect.gen(function* () {
+		const hooks = yield* LifecycleHooks;
+		const raw = makeD1SessionStepUp(options.mapping);
+		const run = (effect) => batch.owner.run(effect.pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(LifecycleHooks, hooks), Effect.provideService(CurrentD1SessionBatch, batch)));
+		return { sessionStepUpPersistence: options.target.of({
+			create: (input, now, prepare) => run(raw.create(input, now, prepare)),
+			context: (input) => run(raw.context(input)),
+			read: (input) => run(raw.read(input)),
+			reject: (input, prepare) => run(raw.reject(input, prepare)),
+			complete: (plan, prepare) => run(raw.complete(plan, prepare))
+		}) };
+	}), (ownedServices, batch) => {
+		const provided = Context.make(options.target, ownedServices.sessionStepUpPersistence).pipe(Context.add(D1BatchStatements, batch.owner.collector));
+		return Effect.provideContext(body, provided);
+	}));
+}
+//#endregion
+export { coordinateD1AuthenticationAuthority, coordinateD1PendingAuthentication, coordinateD1SessionBatch, coordinateD1SessionStepUp, coordinateD1SignedSessionValidity, coordinateD1StatefulSessions, makeD1AuthenticationAuthority, makeD1AuthenticationAuthorityServices, makeD1PendingAuthentication, makeD1PendingAuthenticationServices, makeD1SessionServiceEffects, makeD1SessionStepUp, makeD1SessionStepUpServices, makeD1SignedSessionValidityServices, makeD1SignedValidity, makeD1StatefulSessionServices, makeD1StatefulSessions };
+
+//# sourceMappingURL=d1-sessions.mjs.map