@happyvertical/smrt-profiles 0.51.32 → 0.51.34

package/dist/testing/oidcProvisioningDecisionMatrix.d.ts

@@ -0,0 +1,1168 @@
+/**
+ * Canonical executable contract for Profile and User OIDC provisioning.
+ *
+ * The Profiles and Users suites execute the applicable rows directly. Public
+ * documentation links here instead of maintaining a second behavioral table.
+ */
+export type OidcProvisioningIdentityState = 'none' | 'exact_global_person' | 'exact_legacy_tenant_profile' | 'exact_legacy_non_person_profile' | 'exact_ambiguous_legacy_links' | 'exact_missing_profile';
+export type OidcProvisioningEmailState = 'missing' | 'no_match' | 'one_unowned_global_person' | 'tenant_scoped_collision' | 'non_person_collision' | 'duplicate_normalized_profiles' | 'already_owned_global_person' | 'different_global_person';
+export type OidcProvisioningVerificationState = 'verified' | 'unverified' | 'claim_missing';
+export type OidcProvisioningResolverResult = 'absent' | 'undefined' | 'null' | 'same_profile' | 'different_profile' | 'owned_profile' | 'throws';
+export type OidcProvisioningOwnerAuthorizationResult = 'matching_owner' | 'multiple_owners' | 'no_owner' | 'null' | 'wrong_user';
+export type OidcProvisioningExecutionState = 'first_callback' | 'exact_subsequent_callback' | 'concurrent_winner_and_observer' | 'concurrent_email_competitors' | 'durable_arbiter_retry' | 'caller_owned_transaction' | 'concurrent_authorized_callbacks' | 'root_transaction_rollback' | 'duckdb_caller_owned_transaction';
+export type OidcProvisioningPublicErrorCode = 'ambiguous_email' | 'ambiguous_identity' | 'email_mismatch' | 'email_key_backfill_required' | 'missing_profile' | 'non_person' | 'profile_owned' | 'rejected' | 'tenant_scoped' | 'transaction_required' | 'user_email_backfill_required' | 'user_email_conflict' | null;
+export type OidcProvisioningPublicError = {
+    code: Exclude<OidcProvisioningPublicErrorCode, null>;
+} | {
+    messageIncludes: string;
+} | {
+    name: string;
+} | null;
+export type OidcProvisioningSelectedProfile = 'new_profile' | 'email_match' | 'exact_identity_profile' | 'resolver_profile' | 'authorized_profile' | 'concurrent_winner' | null;
+export type OidcProvisioningReadiness = 'none' | 'profile_email_keys' | 'profile_and_user_email_keys';
+export interface OidcProvisioningCreatedRows {
+    profile: number;
+    oidcIdentity: number;
+    user: number;
+    session: number;
+}
+export interface OidcProvisioningSurfaceExpectation {
+    outcome: 'success' | 'rejected' | 'mixed';
+    publicError: OidcProvisioningPublicError;
+    selectedProfile: OidcProvisioningSelectedProfile;
+    resolverCalls: number | 'at_least_2';
+    ownerAuthorizerCalls: number | 'at_least_2';
+    /** Exact issuer/subject authority is never rebindable. */
+    rebindAllowed: false;
+    /** Backfill marker state installed by the runner for this surface. */
+    readiness: OidcProvisioningReadiness;
+    retry: 'none' | 'once_after_race';
+    resultCreated: 'created' | 'reused' | 'created_and_reused' | 'none';
+    createdRows: OidcProvisioningCreatedRows;
+}
+export type OidcProvisioningAdapterStatus = 'required' | 'sqlite_parity' | 'root_serialized' | 'not_applicable' | 'unsupported';
+export interface OidcProvisioningAdapterExpectation {
+    status: OidcProvisioningAdapterStatus;
+    invariant?: string;
+}
+export interface OidcProvisioningScenario {
+    id: string;
+    title: string;
+    identity: OidcProvisioningIdentityState;
+    email: OidcProvisioningEmailState;
+    verification: OidcProvisioningVerificationState;
+    resolver: OidcProvisioningResolverResult;
+    ownerAuthorization?: OidcProvisioningOwnerAuthorizationResult;
+    execution: OidcProvisioningExecutionState;
+    adapters: {
+        sqlite: OidcProvisioningAdapterExpectation;
+        postgres: OidcProvisioningAdapterExpectation;
+        duckdb: OidcProvisioningAdapterExpectation;
+    };
+    expectations: {
+        profiles?: OidcProvisioningSurfaceExpectation;
+        users?: OidcProvisioningSurfaceExpectation;
+    };
+}
+/**
+ * Typed scenario table consumed by both package suites.
+ *
+ * Row counts are deltas from the declared fixture state. A rejected row always
+ * declares zero User and session creation; the runners assert every delta.
+ */
+export declare const OIDC_PROVISIONING_DECISION_MATRIX: readonly [{
+    readonly id: "new-verified-no-match";
+    readonly title: "verified first callback creates a new canonical identity";
+    readonly identity: "none";
+    readonly email: "no_match";
+    readonly verification: "verified";
+    readonly resolver: "absent";
+    readonly execution: "first_callback";
+    readonly adapters: {
+        readonly sqlite: {
+            readonly status: "required";
+        };
+        readonly postgres: {
+            readonly status: "sqlite_parity";
+        };
+        readonly duckdb: {
+            readonly status: "root_serialized";
+            readonly invariant: "DuckDB provisioning is supported through a root database and is serialized per database URL.";
+        };
+    };
+    readonly expectations: {
+        readonly profiles: OidcProvisioningSurfaceExpectation;
+        readonly users: OidcProvisioningSurfaceExpectation;
+    };
+}, {
+    readonly id: "new-missing-email";
+    readonly title: "Profile-only provisioning allows a missing email while Users reject";
+    readonly identity: "none";
+    readonly email: "missing";
+    readonly verification: "claim_missing";
+    readonly resolver: "absent";
+    readonly execution: "first_callback";
+    readonly adapters: {
+        readonly sqlite: {
+            readonly status: "required";
+        };
+        readonly postgres: {
+            readonly status: "sqlite_parity";
+        };
+        readonly duckdb: {
+            readonly status: "root_serialized";
+            readonly invariant: "DuckDB provisioning is supported through a root database and is serialized per database URL.";
+        };
+    };
+    readonly expectations: {
+        readonly profiles: OidcProvisioningSurfaceExpectation;
+        readonly users: OidcProvisioningSurfaceExpectation;
+    };
+}, {
+    readonly id: "new-unverified-no-match";
+    readonly title: "Profile-only provisioning isolates an unverified email while Users reject";
+    readonly identity: "none";
+    readonly email: "no_match";
+    readonly verification: "unverified";
+    readonly resolver: "absent";
+    readonly execution: "first_callback";
+    readonly adapters: {
+        readonly sqlite: {
+            readonly status: "required";
+        };
+        readonly postgres: {
+            readonly status: "sqlite_parity";
+        };
+        readonly duckdb: {
+            readonly status: "root_serialized";
+            readonly invariant: "DuckDB provisioning is supported through a root database and is serialized per database URL.";
+        };
+    };
+    readonly expectations: {
+        readonly profiles: OidcProvisioningSurfaceExpectation;
+        readonly users: OidcProvisioningSurfaceExpectation;
+    };
+}, {
+    readonly id: "new-unverified-email-match";
+    readonly title: "an unverified email never reuses an existing Profile";
+    readonly identity: "none";
+    readonly email: "one_unowned_global_person";
+    readonly verification: "unverified";
+    readonly resolver: "absent";
+    readonly execution: "first_callback";
+    readonly adapters: {
+        readonly sqlite: {
+            readonly status: "required";
+        };
+        readonly postgres: {
+            readonly status: "sqlite_parity";
+        };
+        readonly duckdb: {
+            readonly status: "root_serialized";
+            readonly invariant: "DuckDB provisioning is supported through a root database and is serialized per database URL.";
+        };
+    };
+    readonly expectations: {
+        readonly profiles: OidcProvisioningSurfaceExpectation;
+        readonly users: OidcProvisioningSurfaceExpectation;
+    };
+}, {
+    readonly id: "new-verified-email-match";
+    readonly title: "only owner-aware User provisioning may reuse a safe email match";
+    readonly identity: "none";
+    readonly email: "one_unowned_global_person";
+    readonly verification: "verified";
+    readonly resolver: "absent";
+    readonly execution: "first_callback";
+    readonly adapters: {
+        readonly sqlite: {
+            readonly status: "required";
+        };
+        readonly postgres: {
+            readonly status: "sqlite_parity";
+        };
+        readonly duckdb: {
+            readonly status: "root_serialized";
+            readonly invariant: "DuckDB provisioning is supported through a root database and is serialized per database URL.";
+        };
+    };
+    readonly expectations: {
+        readonly profiles: OidcProvisioningSurfaceExpectation;
+        readonly users: OidcProvisioningSurfaceExpectation;
+    };
+}, {
+    readonly id: "new-verified-tenant-collision";
+    readonly title: "tenant-scoped email collisions fail closed";
+    readonly identity: "none";
+    readonly email: "tenant_scoped_collision";
+    readonly verification: "verified";
+    readonly resolver: "absent";
+    readonly execution: "first_callback";
+    readonly adapters: {
+        readonly sqlite: {
+            readonly status: "required";
+        };
+        readonly postgres: {
+            readonly status: "sqlite_parity";
+        };
+        readonly duckdb: {
+            readonly status: "root_serialized";
+            readonly invariant: "DuckDB provisioning is supported through a root database and is serialized per database URL.";
+        };
+    };
+    readonly expectations: {
+        readonly profiles: OidcProvisioningSurfaceExpectation;
+        readonly users: OidcProvisioningSurfaceExpectation;
+    };
+}, {
+    readonly id: "new-verified-non-person-collision";
+    readonly title: "non-Person email collisions fail closed";
+    readonly identity: "none";
+    readonly email: "non_person_collision";
+    readonly verification: "verified";
+    readonly resolver: "absent";
+    readonly execution: "first_callback";
+    readonly adapters: {
+        readonly sqlite: {
+            readonly status: "required";
+        };
+        readonly postgres: {
+            readonly status: "sqlite_parity";
+        };
+        readonly duckdb: {
+            readonly status: "root_serialized";
+            readonly invariant: "DuckDB provisioning is supported through a root database and is serialized per database URL.";
+        };
+    };
+    readonly expectations: {
+        readonly profiles: OidcProvisioningSurfaceExpectation;
+        readonly users: OidcProvisioningSurfaceExpectation;
+    };
+}, {
+    readonly id: "new-verified-duplicate-email";
+    readonly title: "duplicate normalized Profile emails fail closed";
+    readonly identity: "none";
+    readonly email: "duplicate_normalized_profiles";
+    readonly verification: "verified";
+    readonly resolver: "absent";
+    readonly execution: "first_callback";
+    readonly adapters: {
+        readonly sqlite: {
+            readonly status: "required";
+        };
+        readonly postgres: {
+            readonly status: "sqlite_parity";
+        };
+        readonly duckdb: {
+            readonly status: "root_serialized";
+            readonly invariant: "DuckDB provisioning is supported through a root database and is serialized per database URL.";
+        };
+    };
+    readonly expectations: {
+        readonly profiles: OidcProvisioningSurfaceExpectation;
+        readonly users: OidcProvisioningSurfaceExpectation;
+    };
+}, {
+    readonly id: "new-verified-owned-profile";
+    readonly title: "an already-owned email match cannot acquire another identity";
+    readonly identity: "none";
+    readonly email: "already_owned_global_person";
+    readonly verification: "verified";
+    readonly resolver: "absent";
+    readonly execution: "first_callback";
+    readonly adapters: {
+        readonly sqlite: {
+            readonly status: "required";
+        };
+        readonly postgres: {
+            readonly status: "sqlite_parity";
+        };
+        readonly duckdb: {
+            readonly status: "root_serialized";
+            readonly invariant: "DuckDB provisioning is supported through a root database and is serialized per database URL.";
+        };
+    };
+    readonly expectations: {
+        readonly users: OidcProvisioningSurfaceExpectation;
+    };
+}, {
+    readonly id: "owner-authorized-first-binding";
+    readonly title: "explicit owner authorization binds a verified first identity to its pre-provisioned User";
+    readonly identity: "none";
+    readonly email: "already_owned_global_person";
+    readonly verification: "verified";
+    readonly resolver: "absent";
+    readonly ownerAuthorization: "matching_owner";
+    readonly execution: "first_callback";
+    readonly adapters: {
+        readonly sqlite: {
+            readonly status: "required";
+        };
+        readonly postgres: {
+            readonly status: "sqlite_parity";
+        };
+        readonly duckdb: {
+            readonly status: "root_serialized";
+            readonly invariant: "DuckDB provisioning is supported through a root database and is serialized per database URL.";
+        };
+    };
+    readonly expectations: {
+        readonly users: OidcProvisioningSurfaceExpectation;
+    };
+}, {
+    readonly id: "owner-authorizer-rejects";
+    readonly title: "a null owner authorization rejects before identity creation";
+    readonly identity: "none";
+    readonly email: "already_owned_global_person";
+    readonly verification: "verified";
+    readonly resolver: "absent";
+    readonly ownerAuthorization: "null";
+    readonly execution: "first_callback";
+    readonly adapters: {
+        readonly sqlite: {
+            readonly status: "required";
+        };
+        readonly postgres: {
+            readonly status: "sqlite_parity";
+        };
+        readonly duckdb: {
+            readonly status: "root_serialized";
+            readonly invariant: "DuckDB provisioning is supported through a root database and is serialized per database URL.";
+        };
+    };
+    readonly expectations: {
+        readonly users: OidcProvisioningSurfaceExpectation;
+    };
+}, {
+    readonly id: "owner-authorized-unverified";
+    readonly title: "owner authorization never overrides an explicitly unverified email";
+    readonly identity: "none";
+    readonly email: "already_owned_global_person";
+    readonly verification: "unverified";
+    readonly resolver: "absent";
+    readonly ownerAuthorization: "matching_owner";
+    readonly execution: "first_callback";
+    readonly adapters: {
+        readonly sqlite: {
+            readonly status: "required";
+        };
+        readonly postgres: {
+            readonly status: "sqlite_parity";
+        };
+        readonly duckdb: {
+            readonly status: "root_serialized";
+            readonly invariant: "DuckDB provisioning is supported through a root database and is serialized per database URL.";
+        };
+    };
+    readonly expectations: {
+        readonly users: OidcProvisioningSurfaceExpectation;
+    };
+}, {
+    readonly id: "owner-authorized-missing-verification";
+    readonly title: "owner authorization requires an explicit true verification claim";
+    readonly identity: "none";
+    readonly email: "already_owned_global_person";
+    readonly verification: "claim_missing";
+    readonly resolver: "absent";
+    readonly ownerAuthorization: "matching_owner";
+    readonly execution: "first_callback";
+    readonly adapters: {
+        readonly sqlite: {
+            readonly status: "required";
+        };
+        readonly postgres: {
+            readonly status: "sqlite_parity";
+        };
+        readonly duckdb: {
+            readonly status: "root_serialized";
+            readonly invariant: "DuckDB provisioning is supported through a root database and is serialized per database URL.";
+        };
+    };
+    readonly expectations: {
+        readonly users: OidcProvisioningSurfaceExpectation;
+    };
+}, {
+    readonly id: "owner-authorized-profile-email-mismatch";
+    readonly title: "an authorized Profile must match the verified claim email";
+    readonly identity: "none";
+    readonly email: "different_global_person";
+    readonly verification: "verified";
+    readonly resolver: "absent";
+    readonly ownerAuthorization: "matching_owner";
+    readonly execution: "first_callback";
+    readonly adapters: {
+        readonly sqlite: {
+            readonly status: "required";
+        };
+        readonly postgres: {
+            readonly status: "sqlite_parity";
+        };
+        readonly duckdb: {
+            readonly status: "root_serialized";
+            readonly invariant: "DuckDB provisioning is supported through a root database and is serialized per database URL.";
+        };
+    };
+    readonly expectations: {
+        readonly users: OidcProvisioningSurfaceExpectation;
+    };
+}, {
+    readonly id: "owner-authorized-user-email-mismatch";
+    readonly title: "the authorized owner must match the verified claim email";
+    readonly identity: "none";
+    readonly email: "already_owned_global_person";
+    readonly verification: "verified";
+    readonly resolver: "absent";
+    readonly ownerAuthorization: "matching_owner";
+    readonly execution: "first_callback";
+    readonly adapters: {
+        readonly sqlite: {
+            readonly status: "required";
+        };
+        readonly postgres: {
+            readonly status: "sqlite_parity";
+        };
+        readonly duckdb: {
+            readonly status: "root_serialized";
+            readonly invariant: "DuckDB provisioning is supported through a root database and is serialized per database URL.";
+        };
+    };
+    readonly expectations: {
+        readonly users: OidcProvisioningSurfaceExpectation;
+    };
+}, {
+    readonly id: "owner-authorized-tenant-profile";
+    readonly title: "owner authorization cannot select a tenant-scoped Profile";
+    readonly identity: "none";
+    readonly email: "tenant_scoped_collision";
+    readonly verification: "verified";
+    readonly resolver: "absent";
+    readonly ownerAuthorization: "matching_owner";
+    readonly execution: "first_callback";
+    readonly adapters: {
+        readonly sqlite: {
+            readonly status: "required";
+        };
+        readonly postgres: {
+            readonly status: "sqlite_parity";
+        };
+        readonly duckdb: {
+            readonly status: "root_serialized";
+            readonly invariant: "DuckDB provisioning is supported through a root database and is serialized per database URL.";
+        };
+    };
+    readonly expectations: {
+        readonly users: OidcProvisioningSurfaceExpectation;
+    };
+}, {
+    readonly id: "owner-authorized-non-person";
+    readonly title: "owner authorization cannot select a non-Person Profile";
+    readonly identity: "none";
+    readonly email: "non_person_collision";
+    readonly verification: "verified";
+    readonly resolver: "absent";
+    readonly ownerAuthorization: "matching_owner";
+    readonly execution: "first_callback";
+    readonly adapters: {
+        readonly sqlite: {
+            readonly status: "required";
+        };
+        readonly postgres: {
+            readonly status: "sqlite_parity";
+        };
+        readonly duckdb: {
+            readonly status: "root_serialized";
+            readonly invariant: "DuckDB provisioning is supported through a root database and is serialized per database URL.";
+        };
+    };
+    readonly expectations: {
+        readonly users: OidcProvisioningSurfaceExpectation;
+    };
+}, {
+    readonly id: "owner-authorized-ambiguous-profile";
+    readonly title: "owner authorization cannot select an ambiguous Profile email";
+    readonly identity: "none";
+    readonly email: "duplicate_normalized_profiles";
+    readonly verification: "verified";
+    readonly resolver: "absent";
+    readonly ownerAuthorization: "matching_owner";
+    readonly execution: "first_callback";
+    readonly adapters: {
+        readonly sqlite: {
+            readonly status: "required";
+        };
+        readonly postgres: {
+            readonly status: "sqlite_parity";
+        };
+        readonly duckdb: {
+            readonly status: "root_serialized";
+            readonly invariant: "DuckDB provisioning is supported through a root database and is serialized per database URL.";
+        };
+    };
+    readonly expectations: {
+        readonly users: OidcProvisioningSurfaceExpectation;
+    };
+}, {
+    readonly id: "owner-authorized-no-owner";
+    readonly title: "owner authorization requires exactly one Profile owner";
+    readonly identity: "none";
+    readonly email: "one_unowned_global_person";
+    readonly verification: "verified";
+    readonly resolver: "absent";
+    readonly ownerAuthorization: "no_owner";
+    readonly execution: "first_callback";
+    readonly adapters: {
+        readonly sqlite: {
+            readonly status: "required";
+        };
+        readonly postgres: {
+            readonly status: "sqlite_parity";
+        };
+        readonly duckdb: {
+            readonly status: "root_serialized";
+            readonly invariant: "DuckDB provisioning is supported through a root database and is serialized per database URL.";
+        };
+    };
+    readonly expectations: {
+        readonly users: OidcProvisioningSurfaceExpectation;
+    };
+}, {
+    readonly id: "owner-authorized-multiple-owners";
+    readonly title: "owner authorization rejects legacy multiple Profile owners";
+    readonly identity: "none";
+    readonly email: "already_owned_global_person";
+    readonly verification: "verified";
+    readonly resolver: "absent";
+    readonly ownerAuthorization: "multiple_owners";
+    readonly execution: "first_callback";
+    readonly adapters: {
+        readonly sqlite: {
+            readonly status: "required";
+        };
+        readonly postgres: {
+            readonly status: "sqlite_parity";
+        };
+        readonly duckdb: {
+            readonly status: "root_serialized";
+            readonly invariant: "DuckDB provisioning is supported through a root database and is serialized per database URL.";
+        };
+    };
+    readonly expectations: {
+        readonly users: OidcProvisioningSurfaceExpectation;
+    };
+}, {
+    readonly id: "owner-authorized-wrong-user";
+    readonly title: "owner authorization rejects a User that does not own the Profile";
+    readonly identity: "none";
+    readonly email: "already_owned_global_person";
+    readonly verification: "verified";
+    readonly resolver: "absent";
+    readonly ownerAuthorization: "wrong_user";
+    readonly execution: "first_callback";
+    readonly adapters: {
+        readonly sqlite: {
+            readonly status: "required";
+        };
+        readonly postgres: {
+            readonly status: "sqlite_parity";
+        };
+        readonly duckdb: {
+            readonly status: "root_serialized";
+            readonly invariant: "DuckDB provisioning is supported through a root database and is serialized per database URL.";
+        };
+    };
+    readonly expectations: {
+        readonly users: OidcProvisioningSurfaceExpectation;
+    };
+}, {
+    readonly id: "owner-authorized-conflicting-identity";
+    readonly title: "owner authorization cannot rebind an exact conflicting identity";
+    readonly identity: "exact_global_person";
+    readonly email: "different_global_person";
+    readonly verification: "verified";
+    readonly resolver: "absent";
+    readonly ownerAuthorization: "matching_owner";
+    readonly execution: "exact_subsequent_callback";
+    readonly adapters: {
+        readonly sqlite: {
+            readonly status: "required";
+        };
+        readonly postgres: {
+            readonly status: "sqlite_parity";
+        };
+        readonly duckdb: {
+            readonly status: "root_serialized";
+            readonly invariant: "DuckDB provisioning is supported through a root database and is serialized per database URL.";
+        };
+    };
+    readonly expectations: {
+        readonly users: OidcProvisioningSurfaceExpectation;
+    };
+}, {
+    readonly id: "owner-authorized-concurrent-callbacks";
+    readonly title: "concurrent authorized callbacks converge on one existing User and identity";
+    readonly identity: "none";
+    readonly email: "already_owned_global_person";
+    readonly verification: "verified";
+    readonly resolver: "absent";
+    readonly ownerAuthorization: "matching_owner";
+    readonly execution: "concurrent_authorized_callbacks";
+    readonly adapters: {
+        readonly sqlite: {
+            readonly status: "required";
+        };
+        readonly postgres: {
+            readonly status: "required";
+        };
+        readonly duckdb: {
+            readonly status: "root_serialized";
+            readonly invariant: "DuckDB uses root-handle serialization instead of overlapping independent transactions.";
+        };
+    };
+    readonly expectations: {
+        readonly users: OidcProvisioningSurfaceExpectation;
+    };
+}, {
+    readonly id: "owner-authorizer-durable-arbiter-retry";
+    readonly title: "a durable race retry invokes the idempotent owner authorizer again";
+    readonly identity: "none";
+    readonly email: "already_owned_global_person";
+    readonly verification: "verified";
+    readonly resolver: "absent";
+    readonly ownerAuthorization: "matching_owner";
+    readonly execution: "durable_arbiter_retry";
+    readonly adapters: {
+        readonly sqlite: {
+            readonly status: "required";
+        };
+        readonly postgres: {
+            readonly status: "required";
+        };
+        readonly duckdb: {
+            readonly status: "root_serialized";
+            readonly invariant: "DuckDB uses root-handle serialization instead of overlapping independent transactions.";
+        };
+    };
+    readonly expectations: {
+        readonly users: OidcProvisioningSurfaceExpectation;
+    };
+}, {
+    readonly id: "exact-safe-owned";
+    readonly title: "an exact safe identity reuses its canonical Profile and User";
+    readonly identity: "exact_global_person";
+    readonly email: "already_owned_global_person";
+    readonly verification: "verified";
+    readonly resolver: "absent";
+    readonly execution: "exact_subsequent_callback";
+    readonly adapters: {
+        readonly sqlite: {
+            readonly status: "required";
+        };
+        readonly postgres: {
+            readonly status: "sqlite_parity";
+        };
+        readonly duckdb: {
+            readonly status: "root_serialized";
+            readonly invariant: "DuckDB provisioning is supported through a root database and is serialized per database URL.";
+        };
+    };
+    readonly expectations: {
+        readonly profiles: OidcProvisioningSurfaceExpectation;
+        readonly users: OidcProvisioningSurfaceExpectation;
+    };
+}, {
+    readonly id: "exact-safe-unowned";
+    readonly title: "an exact safe identity without an owner may create one User";
+    readonly identity: "exact_global_person";
+    readonly email: "one_unowned_global_person";
+    readonly verification: "verified";
+    readonly resolver: "absent";
+    readonly execution: "exact_subsequent_callback";
+    readonly adapters: {
+        readonly sqlite: {
+            readonly status: "required";
+        };
+        readonly postgres: {
+            readonly status: "sqlite_parity";
+        };
+        readonly duckdb: {
+            readonly status: "root_serialized";
+            readonly invariant: "DuckDB provisioning is supported through a root database and is serialized per database URL.";
+        };
+    };
+    readonly expectations: {
+        readonly profiles: OidcProvisioningSurfaceExpectation;
+        readonly users: OidcProvisioningSurfaceExpectation;
+    };
+}, {
+    readonly id: "exact-legacy-tenant-profile";
+    readonly title: "Profile-only legacy exact reuse succeeds while Users fail closed";
+    readonly identity: "exact_legacy_tenant_profile";
+    readonly email: "tenant_scoped_collision";
+    readonly verification: "verified";
+    readonly resolver: "absent";
+    readonly execution: "exact_subsequent_callback";
+    readonly adapters: {
+        readonly sqlite: {
+            readonly status: "required";
+        };
+        readonly postgres: {
+            readonly status: "sqlite_parity";
+        };
+        readonly duckdb: {
+            readonly status: "root_serialized";
+            readonly invariant: "DuckDB provisioning is supported through a root database and is serialized per database URL.";
+        };
+    };
+    readonly expectations: {
+        readonly profiles: OidcProvisioningSurfaceExpectation;
+        readonly users: OidcProvisioningSurfaceExpectation;
+    };
+}, {
+    readonly id: "exact-legacy-non-person-profile";
+    readonly title: "Profile-only non-Person exact reuse succeeds while Users fail closed";
+    readonly identity: "exact_legacy_non_person_profile";
+    readonly email: "non_person_collision";
+    readonly verification: "verified";
+    readonly resolver: "absent";
+    readonly execution: "exact_subsequent_callback";
+    readonly adapters: {
+        readonly sqlite: {
+            readonly status: "required";
+        };
+        readonly postgres: {
+            readonly status: "sqlite_parity";
+        };
+        readonly duckdb: {
+            readonly status: "root_serialized";
+            readonly invariant: "DuckDB provisioning is supported through a root database and is serialized per database URL.";
+        };
+    };
+    readonly expectations: {
+        readonly profiles: OidcProvisioningSurfaceExpectation;
+        readonly users: OidcProvisioningSurfaceExpectation;
+    };
+}, {
+    readonly id: "exact-ambiguous-legacy-links";
+    readonly title: "ambiguous legacy exact identities fail closed";
+    readonly identity: "exact_ambiguous_legacy_links";
+    readonly email: "one_unowned_global_person";
+    readonly verification: "verified";
+    readonly resolver: "absent";
+    readonly execution: "exact_subsequent_callback";
+    readonly adapters: {
+        readonly sqlite: {
+            readonly status: "required";
+        };
+        readonly postgres: {
+            readonly status: "sqlite_parity";
+        };
+        readonly duckdb: {
+            readonly status: "root_serialized";
+            readonly invariant: "DuckDB provisioning is supported through a root database and is serialized per database URL.";
+        };
+    };
+    readonly expectations: {
+        readonly profiles: OidcProvisioningSurfaceExpectation;
+        readonly users: OidcProvisioningSurfaceExpectation;
+    };
+}, {
+    readonly id: "exact-missing-profile";
+    readonly title: "an exact identity with a missing Profile fails closed";
+    readonly identity: "exact_missing_profile";
+    readonly email: "no_match";
+    readonly verification: "verified";
+    readonly resolver: "absent";
+    readonly execution: "exact_subsequent_callback";
+    readonly adapters: {
+        readonly sqlite: {
+            readonly status: "required";
+        };
+        readonly postgres: {
+            readonly status: "sqlite_parity";
+        };
+        readonly duckdb: {
+            readonly status: "root_serialized";
+            readonly invariant: "DuckDB provisioning is supported through a root database and is serialized per database URL.";
+        };
+    };
+    readonly expectations: {
+        readonly profiles: OidcProvisioningSurfaceExpectation;
+        readonly users: OidcProvisioningSurfaceExpectation;
+    };
+}, {
+    readonly id: "resolver-undefined-new";
+    readonly title: "undefined resolver output selects the secure default";
+    readonly identity: "none";
+    readonly email: "no_match";
+    readonly verification: "verified";
+    readonly resolver: "undefined";
+    readonly execution: "first_callback";
+    readonly adapters: {
+        readonly sqlite: {
+            readonly status: "required";
+        };
+        readonly postgres: {
+            readonly status: "sqlite_parity";
+        };
+        readonly duckdb: {
+            readonly status: "root_serialized";
+            readonly invariant: "DuckDB provisioning is supported through a root database and is serialized per database URL.";
+        };
+    };
+    readonly expectations: {
+        readonly users: OidcProvisioningSurfaceExpectation;
+    };
+}, {
+    readonly id: "resolver-null-new";
+    readonly title: "null resolver output rejects before provisioning";
+    readonly identity: "none";
+    readonly email: "no_match";
+    readonly verification: "verified";
+    readonly resolver: "null";
+    readonly execution: "first_callback";
+    readonly adapters: {
+        readonly sqlite: {
+            readonly status: "required";
+        };
+        readonly postgres: {
+            readonly status: "sqlite_parity";
+        };
+        readonly duckdb: {
+            readonly status: "root_serialized";
+            readonly invariant: "DuckDB provisioning is supported through a root database and is serialized per database URL.";
+        };
+    };
+    readonly expectations: {
+        readonly users: OidcProvisioningSurfaceExpectation;
+    };
+}, {
+    readonly id: "resolver-same-new";
+    readonly title: "a resolver may select the same safe canonical Profile for a new identity";
+    readonly identity: "none";
+    readonly email: "one_unowned_global_person";
+    readonly verification: "verified";
+    readonly resolver: "same_profile";
+    readonly execution: "first_callback";
+    readonly adapters: {
+        readonly sqlite: {
+            readonly status: "required";
+        };
+        readonly postgres: {
+            readonly status: "sqlite_parity";
+        };
+        readonly duckdb: {
+            readonly status: "root_serialized";
+            readonly invariant: "DuckDB provisioning is supported through a root database and is serialized per database URL.";
+        };
+    };
+    readonly expectations: {
+        readonly users: OidcProvisioningSurfaceExpectation;
+    };
+}, {
+    readonly id: "resolver-owned-new";
+    readonly title: "a resolver-selected owned Profile fails closed";
+    readonly identity: "none";
+    readonly email: "already_owned_global_person";
+    readonly verification: "verified";
+    readonly resolver: "owned_profile";
+    readonly execution: "first_callback";
+    readonly adapters: {
+        readonly sqlite: {
+            readonly status: "required";
+        };
+        readonly postgres: {
+            readonly status: "sqlite_parity";
+        };
+        readonly duckdb: {
+            readonly status: "root_serialized";
+            readonly invariant: "DuckDB provisioning is supported through a root database and is serialized per database URL.";
+        };
+    };
+    readonly expectations: {
+        readonly users: OidcProvisioningSurfaceExpectation;
+    };
+}, {
+    readonly id: "resolver-same-exact";
+    readonly title: "a resolver may confirm but not rebind an exact identity";
+    readonly identity: "exact_global_person";
+    readonly email: "already_owned_global_person";
+    readonly verification: "verified";
+    readonly resolver: "same_profile";
+    readonly execution: "exact_subsequent_callback";
+    readonly adapters: {
+        readonly sqlite: {
+            readonly status: "required";
+        };
+        readonly postgres: {
+            readonly status: "sqlite_parity";
+        };
+        readonly duckdb: {
+            readonly status: "root_serialized";
+            readonly invariant: "DuckDB provisioning is supported through a root database and is serialized per database URL.";
+        };
+    };
+    readonly expectations: {
+        readonly users: OidcProvisioningSurfaceExpectation;
+    };
+}, {
+    readonly id: "resolver-different-exact";
+    readonly title: "a resolver cannot rebind an exact identity to a different Profile";
+    readonly identity: "exact_global_person";
+    readonly email: "different_global_person";
+    readonly verification: "verified";
+    readonly resolver: "different_profile";
+    readonly execution: "exact_subsequent_callback";
+    readonly adapters: {
+        readonly sqlite: {
+            readonly status: "required";
+        };
+        readonly postgres: {
+            readonly status: "sqlite_parity";
+        };
+        readonly duckdb: {
+            readonly status: "root_serialized";
+            readonly invariant: "DuckDB provisioning is supported through a root database and is serialized per database URL.";
+        };
+    };
+    readonly expectations: {
+        readonly users: OidcProvisioningSurfaceExpectation;
+    };
+}, {
+    readonly id: "resolver-null-exact";
+    readonly title: "null resolver output rejects exact identity reuse";
+    readonly identity: "exact_global_person";
+    readonly email: "already_owned_global_person";
+    readonly verification: "verified";
+    readonly resolver: "null";
+    readonly execution: "exact_subsequent_callback";
+    readonly adapters: {
+        readonly sqlite: {
+            readonly status: "required";
+        };
+        readonly postgres: {
+            readonly status: "sqlite_parity";
+        };
+        readonly duckdb: {
+            readonly status: "root_serialized";
+            readonly invariant: "DuckDB provisioning is supported through a root database and is serialized per database URL.";
+        };
+    };
+    readonly expectations: {
+        readonly users: OidcProvisioningSurfaceExpectation;
+    };
+}, {
+    readonly id: "resolver-throws-new";
+    readonly title: "resolver exceptions roll back without authentication state";
+    readonly identity: "none";
+    readonly email: "no_match";
+    readonly verification: "verified";
+    readonly resolver: "throws";
+    readonly execution: "first_callback";
+    readonly adapters: {
+        readonly sqlite: {
+            readonly status: "required";
+        };
+        readonly postgres: {
+            readonly status: "sqlite_parity";
+        };
+        readonly duckdb: {
+            readonly status: "root_serialized";
+            readonly invariant: "DuckDB provisioning is supported through a root database and is serialized per database URL.";
+        };
+    };
+    readonly expectations: {
+        readonly users: OidcProvisioningSurfaceExpectation;
+    };
+}, {
+    readonly id: "profile-readiness-missing";
+    readonly title: "email-based lookup fails until Profile email keys are ready";
+    readonly identity: "none";
+    readonly email: "one_unowned_global_person";
+    readonly verification: "verified";
+    readonly resolver: "absent";
+    readonly execution: "first_callback";
+    readonly adapters: {
+        readonly sqlite: {
+            readonly status: "required";
+        };
+        readonly postgres: {
+            readonly status: "sqlite_parity";
+        };
+        readonly duckdb: {
+            readonly status: "root_serialized";
+            readonly invariant: "DuckDB provisioning is supported through a root database and is serialized per database URL.";
+        };
+    };
+    readonly expectations: {
+        readonly profiles: OidcProvisioningSurfaceExpectation;
+        readonly users: OidcProvisioningSurfaceExpectation;
+    };
+}, {
+    readonly id: "user-readiness-missing";
+    readonly title: "User creation fails until User email keys are ready";
+    readonly identity: "none";
+    readonly email: "no_match";
+    readonly verification: "verified";
+    readonly resolver: "absent";
+    readonly execution: "first_callback";
+    readonly adapters: {
+        readonly sqlite: {
+            readonly status: "required";
+        };
+        readonly postgres: {
+            readonly status: "sqlite_parity";
+        };
+        readonly duckdb: {
+            readonly status: "root_serialized";
+            readonly invariant: "DuckDB provisioning is supported through a root database and is serialized per database URL.";
+        };
+    };
+    readonly expectations: {
+        readonly users: OidcProvisioningSurfaceExpectation;
+    };
+}, {
+    readonly id: "concurrent-winner-and-observer";
+    readonly title: "both concurrent callbacks run policy and converge on the winner";
+    readonly identity: "none";
+    readonly email: "no_match";
+    readonly verification: "verified";
+    readonly resolver: "undefined";
+    readonly execution: "concurrent_winner_and_observer";
+    readonly adapters: {
+        readonly sqlite: {
+            readonly status: "required";
+        };
+        readonly postgres: {
+            readonly status: "required";
+        };
+        readonly duckdb: {
+            readonly status: "root_serialized";
+            readonly invariant: "DuckDB uses root-handle serialization instead of overlapping independent transactions.";
+        };
+    };
+    readonly expectations: {
+        readonly profiles: OidcProvisioningSurfaceExpectation;
+        readonly users: OidcProvisioningSurfaceExpectation;
+    };
+}, {
+    readonly id: "concurrent-email-competitors";
+    readonly title: "only one concurrent subject may claim a verified email";
+    readonly identity: "none";
+    readonly email: "no_match";
+    readonly verification: "verified";
+    readonly resolver: "undefined";
+    readonly execution: "concurrent_email_competitors";
+    readonly adapters: {
+        readonly sqlite: {
+            readonly status: "required";
+        };
+        readonly postgres: {
+            readonly status: "required";
+        };
+        readonly duckdb: {
+            readonly status: "root_serialized";
+            readonly invariant: "DuckDB uses root-handle serialization instead of overlapping independent transactions.";
+        };
+    };
+    readonly expectations: {
+        readonly users: OidcProvisioningSurfaceExpectation;
+    };
+}, {
+    readonly id: "resolver-durable-arbiter-retry";
+    readonly title: "a durable race retry invokes the idempotent resolver again";
+    readonly identity: "none";
+    readonly email: "no_match";
+    readonly verification: "verified";
+    readonly resolver: "undefined";
+    readonly execution: "durable_arbiter_retry";
+    readonly adapters: {
+        readonly sqlite: {
+            readonly status: "required";
+        };
+        readonly postgres: {
+            readonly status: "required";
+        };
+        readonly duckdb: {
+            readonly status: "root_serialized";
+            readonly invariant: "DuckDB uses root-handle serialization instead of overlapping independent transactions.";
+        };
+    };
+    readonly expectations: {
+        readonly users: OidcProvisioningSurfaceExpectation;
+    };
+}, {
+    readonly id: "caller-owned-transaction";
+    readonly title: "caller-owned transactions use a savepoint where supported";
+    readonly identity: "none";
+    readonly email: "no_match";
+    readonly verification: "verified";
+    readonly resolver: "undefined";
+    readonly execution: "caller_owned_transaction";
+    readonly adapters: {
+        readonly sqlite: {
+            readonly status: "required";
+        };
+        readonly postgres: {
+            readonly status: "required";
+        };
+        readonly duckdb: {
+            readonly status: "unsupported";
+            readonly invariant: "DuckDB transaction handles do not support the savepoint contract; pass the root database.";
+        };
+    };
+    readonly expectations: {
+        readonly profiles: OidcProvisioningSurfaceExpectation;
+        readonly users: OidcProvisioningSurfaceExpectation;
+    };
+}, {
+    readonly id: "root-transaction-resolver-rollback";
+    readonly title: "root coordination rolls resolver rejection back atomically";
+    readonly identity: "none";
+    readonly email: "no_match";
+    readonly verification: "verified";
+    readonly resolver: "null";
+    readonly execution: "root_transaction_rollback";
+    readonly adapters: {
+        readonly sqlite: {
+            readonly status: "required";
+        };
+        readonly postgres: {
+            readonly status: "required";
+        };
+        readonly duckdb: {
+            readonly status: "root_serialized";
+            readonly invariant: "DuckDB uses root-handle serialization instead of overlapping independent transactions.";
+        };
+    };
+    readonly expectations: {
+        readonly users: OidcProvisioningSurfaceExpectation;
+    };
+}, {
+    readonly id: "duckdb-caller-owned-transaction";
+    readonly title: "DuckDB caller-owned transactions fail closed and remain usable";
+    readonly identity: "none";
+    readonly email: "no_match";
+    readonly verification: "verified";
+    readonly resolver: "absent";
+    readonly execution: "duckdb_caller_owned_transaction";
+    readonly adapters: {
+        readonly sqlite: {
+            readonly status: "not_applicable";
+        };
+        readonly postgres: {
+            readonly status: "not_applicable";
+        };
+        readonly duckdb: {
+            readonly status: "required";
+            readonly invariant: "DuckDB transaction handles fail closed before provisioning writes and leave the caller transaction usable.";
+        };
+    };
+    readonly expectations: {
+        readonly profiles: OidcProvisioningSurfaceExpectation;
+        readonly users: OidcProvisioningSurfaceExpectation;
+    };
+}];
+export type OidcProvisioningDecisionScenario = (typeof OIDC_PROVISIONING_DECISION_MATRIX)[number];
+export declare function getOidcProvisioningDecisionScenario(id: OidcProvisioningDecisionScenario['id']): OidcProvisioningDecisionScenario;
+export declare function getOidcProvisioningPublicErrorCode(expectation: OidcProvisioningSurfaceExpectation | undefined): Exclude<OidcProvisioningPublicErrorCode, null>;
+//# sourceMappingURL=oidcProvisioningDecisionMatrix.d.ts.map