@yielded/auth-persistence-drizzle 0.1.0-beta.22 → 0.1.0-beta.24

package/dist/drizzle/oauth-connected-model.d.mts

@@ -1,291 +1,30 @@
-import { SubjectIdCodec } from "./model.mjs";
-import { OAuthAuthorityReadTable, OAuthClock, OAuthCredentialReadTable, OAuthFlowTable, OAuthOwnershipMutation, OAuthSubjectReadTable, requiredOAuthTupleConstraints } from "./oauth-model.mjs";
-import { InferInsertModel, InferSelectModel, SQL, Table } from "drizzle-orm";
-import { AuthenticationRequirement } from "@yielded/auth/Sessions";
-import * as M from "@yielded/auth/OAuth";
-import { OAuthAccountRevision } from "@yielded/auth/OAuth";
+import { DrizzleTableModel } from "./table-model.mjs";
+import * as Shared from "@yielded/auth-persistence/Adapter";
+import { OAuthConnectedAction, OAuthConnectedOrderCodec, OAuthConnectedPolicyInput, requiredOAuthConnectedConstraints, requiredOAuthConnectedRevocationConstraints } from "@yielded/auth-persistence/Adapter";
+import { SQL, Table } from "drizzle-orm";
 //#region src/drizzle/oauth-connected-model.d.ts
-type Column<T extends Table> = Extract<keyof T["_"]["columns"], string>;
-export type OAuthConnectedAction = M.OAuthConnectedActionChallenge["action"];
-export interface OAuthConnectedSubjectTable<S extends Table> extends OAuthSubjectReadTable<S> {
-  readonly decodeActionRequirement: (row: InferSelectModel<S>, action: OAuthConnectedAction) => AuthenticationRequirement;
-}
-/** All mapped order columns use exact SQL integer comparison through 2^53-1.
- * These codecs bridge driver representations, not alternative ordering rules. */
-export interface OAuthConnectedOrderCodec {
-  readonly encode: (order: number) => unknown;
-  readonly decode: (value: unknown) => number;
-}
-export interface OAuthConnectedFlowTable<F extends Table, N> {
-  readonly table: F;
-  readonly moduleId: Column<F>;
-  readonly flowId: Column<F>;
-  readonly commandId: Column<F>;
-  readonly subjectId: Column<F>;
-  readonly clientKey: Column<F>;
-  readonly cohortKey: Column<F>;
-  readonly state: Column<F>;
-  readonly version: Column<F>;
-  readonly stateDigest: Column<F>;
-  readonly snapshot: Column<F>;
-  readonly claimId: Column<F>;
-  readonly claimDigest: Column<F>;
-  readonly claimOrder: Column<F>;
-  readonly claimedAt: Column<F>;
-  readonly claimExpiresAt: Column<F>;
-  readonly expiresAt: Column<F>;
-  readonly retentionUntil: Column<F>;
-  /** None before claim, Unresolved after claim, Resolved only after definite
-   * cancellation or atomic transfer to a grant/job. Never reset by cleanup. */
-  readonly work: Column<F>;
-  /** Exact sealed quarantine when no correctly sealed revocation job is available. */
-  readonly custody: Column<F>;
-  /** Required when retaining grants during sign-in. subjectId is NULL until
-   * identity resolution; custom required columns are supplied by this encoder. */
-  readonly encodeSignIn?: (reservation: M.OAuthSignInAccessClaim) => InferInsertModel<F>;
-  readonly encodeInsert: (input: {
-    readonly flow: M.OAuthConnectedPendingFlow;
-    readonly subjectId: N;
-  }) => InferInsertModel<F>;
-}
-export interface OAuthConnectedGrantTable<G extends Table, N> {
-  readonly table: G;
-  readonly moduleId: Column<G>;
-  readonly grantId: Column<G>;
-  readonly subjectId: Column<G>;
-  readonly identityKey: Column<G>;
-  /** Nullable unique active slot; historical/disconnected records use null. */
-  readonly activeIdentityKey: Column<G>;
-  readonly clientKey: Column<G>;
-  readonly cohortKey: Column<G>;
-  readonly profileKey: Column<G>;
-  readonly grantVersion: Column<G>;
-  readonly tokenVersion: Column<G>;
-  readonly cohortGeneration: Column<G>;
-  readonly state: Column<G>;
-  readonly version: Column<G>;
-  readonly context: Column<G>;
-  readonly sealed: Column<G>;
-  /** Canonical OAuthConnectedSummary only: list never loads token envelopes. */
-  readonly summary: Column<G>;
-  readonly revocationJobId: Column<G>;
-  readonly refreshWork: Column<G>;
-  readonly refreshClaim: Column<G>;
-  readonly refreshClaimExpiresAt: Column<G>;
-  readonly retentionUntil: Column<G>;
-  readonly encodeInsert: (input: {
-    readonly grant: M.OAuthConnectedStoredGrant;
-    readonly subjectId: N;
-  }) => InferInsertModel<G>;
-}
+export type OAuthConnectedSubjectTable<S extends Table> = Shared.OAuthConnectedSubjectTable<DrizzleTableModel<S>, SQL>;
+export type OAuthConnectedFlowTable<F extends Table, N> = Shared.OAuthConnectedFlowTable<DrizzleTableModel<F>, N>;
+export type OAuthConnectedGrantTable<G extends Table, N> = Shared.OAuthConnectedGrantTable<DrizzleTableModel<G>, N>;
 /** Also stores a permanent provider/issuer scope anchor. clientKey must fit 52
  * ASCII characters. Empty clientRegistrationId is reserved for that anchor;
  * actual profile registrations are nonempty. Scope counter stays zero. */
-export interface OAuthConnectedClientRegistrationTable<C extends Table> {
-  readonly table: C;
-  readonly clientKey: Column<C>;
-  readonly provider: Column<C>;
-  readonly issuer: Column<C>;
-  readonly clientRegistrationId: Column<C>;
-  readonly counter: Column<C>;
-  readonly version: Column<C>;
-  readonly encodeInsert: (configuration: M.OAuthConnectedConfiguration) => InferInsertModel<C>;
-}
+export type OAuthConnectedClientRegistrationTable<C extends Table> = Shared.OAuthConnectedClientRegistrationTable<DrizzleTableModel<C>>;
 /** Remote authority: no local-subject column or subject-scoped key. Retain this
  * anchor/cutoff when a legitimately released tuple gains a different local owner. */
-export interface OAuthConnectedCohortTable<C extends Table> {
-  readonly table: C;
-  readonly cohortKey: Column<C>;
-  readonly clientKey: Column<C>;
-  readonly identityKey: Column<C>;
-  readonly generation: Column<C>;
-  readonly cutoff: Column<C>;
-  readonly state: Column<C>;
-  readonly version: Column<C>;
-  readonly encodeInsert: (input: {
-    readonly clientKey: string;
-    readonly identityKey: string;
-  }) => InferInsertModel<C>;
-}
-export interface OAuthConnectedAdmissionTable<A extends Table, N> {
-  readonly table: A;
-  readonly admissionId: Column<A>;
-  readonly moduleId: Column<A>;
-  readonly grantId: Column<A>;
-  readonly subjectId: Column<A>;
-  readonly identityKey: Column<A>;
-  readonly clientKey: Column<A>;
-  readonly cohortKey: Column<A>;
-  readonly snapshot: Column<A>;
-  readonly admittedAt: Column<A>;
-  readonly expiresAt: Column<A>;
-  readonly version: Column<A>;
-  readonly encodeInsert: (input: {
-    readonly admissionId: string;
-    readonly grant: M.OAuthConnectedStoredGrant;
-    readonly authorization: M.OAuthConnectedUseAuthorization;
-    readonly subjectId: N;
-  }) => InferInsertModel<A>;
-}
-export interface OAuthConnectedCommandTable<C extends Table, N> {
-  readonly table: C;
-  readonly moduleId: Column<C>;
-  readonly commandId: Column<C>;
-  readonly subjectId: Column<C>;
-  readonly grantId: Column<C>;
-  readonly intent: Column<C>;
-  readonly decision: Column<C>;
-  readonly retentionUntil: Column<C>;
-  readonly version: Column<C>;
-  readonly encodeInsert: (input: {
-    readonly commandId: string;
-    readonly grant: M.OAuthConnectedDisconnectGrant;
-    readonly subjectId: N;
-  }) => InferInsertModel<C>;
-}
-export interface OAuthConnectedRevocationJobTable<J extends Table, N> {
-  readonly table: J;
-  readonly jobId: Column<J>;
-  readonly moduleId: Column<J>;
-  readonly subjectId: Column<J>;
-  readonly identityKey: Column<J>;
-  readonly clientKey: Column<J>;
-  readonly cohortKey: Column<J>;
-  readonly grantId: Column<J>;
-  readonly snapshot: Column<J>;
-  readonly state: Column<J>;
-  readonly claimId: Column<J>;
-  readonly claimedAt: Column<J>;
-  readonly claimExpiresAt: Column<J>;
-  readonly retentionUntil: Column<J>;
-  readonly version: Column<J>;
-  readonly encodeInsert: (input: {
-    readonly job: M.OAuthConnectedRevocationJob;
-    readonly subjectId: N;
-  }) => InferInsertModel<J>;
-}
-export type OAuthConnectedPolicyInput<N> = {
-  readonly subjectId: N;
-  readonly revision: OAuthAccountRevision;
-} & ({
-  readonly kind: "action";
-  readonly operation: "issue" | "claim" | "settle" | "disconnect";
-  readonly authorization: M.OAuthConnectedActionAuthorization;
-  readonly configuration: M.OAuthConnectedConfiguration;
-  readonly grant?: M.OAuthConnectedTokenContext;
-} | {
-  readonly kind: "sign-in";
-  readonly credential: M.OAuthCredentialSnapshot;
-  readonly configuration: M.OAuthConnectedConfiguration;
-  readonly grant?: M.OAuthConnectedTokenContext;
-} | {
-  readonly kind: "metadata" | "use";
-  readonly authorization: M.OAuthConnectedUseAuthorization;
-  readonly grant?: M.OAuthConnectedTokenContext;
-});
-export interface OAuthConnectedPolicyGuardTable<T extends Table, N> {
-  readonly table: T;
-  readonly orderBy: Column<T>;
-  readonly condition: (input: OAuthConnectedPolicyInput<N>) => SQL;
-}
-export interface OAuthConnectedPolicyGuard<N> {
-  readonly table: Table;
-  readonly orderBy: string;
-  readonly condition: (input: OAuthConnectedPolicyInput<N>) => SQL;
-}
+export type OAuthConnectedCohortTable<C extends Table> = Shared.OAuthConnectedCohortTable<DrizzleTableModel<C>>;
+export type OAuthConnectedAdmissionTable<A extends Table, N> = Shared.OAuthConnectedAdmissionTable<DrizzleTableModel<A>, N>;
+export type OAuthConnectedCommandTable<C extends Table, N> = Shared.OAuthConnectedCommandTable<DrizzleTableModel<C>, N>;
+export type OAuthConnectedRevocationJobTable<J extends Table, N> = Shared.OAuthConnectedRevocationJobTable<DrizzleTableModel<J>, N>;
+export type OAuthConnectedPolicyGuardTable<T extends Table, N> = Shared.OAuthConnectedPolicyGuardTable<DrizzleTableModel<T>, N, SQL>;
+export type OAuthConnectedPolicyGuard<N> = Shared.OAuthConnectedPolicyGuard<N, SQL, Table>;
 export declare const oauthConnectedPolicyGuard: <T extends Table, N>(input: OAuthConnectedPolicyGuardTable<T, N>) => OAuthConnectedPolicyGuard<N>;
-export interface OAuthConnectedSqlPolicy<N> {
-  /** Up to 32 scopes, each selecting 1..64 stable rows in global lock order.
-   * Omit only when subject/shared authority locks already serialize every mutable
-   * policy dependency or policy is immutable. All writers follow that order. */
-  readonly guards?: ReadonlyArray<OAuthConnectedPolicyGuard<N>>;
-  /** Recheck exact policy revision, purpose, optional grant/profile restrictions
-   * and current profile/permissions; joins and absence assumptions are authority.
-   * The engine checks this before and after every owner/application write. */
-  readonly condition: (input: OAuthConnectedPolicyInput<N>) => SQL;
-}
-export declare const requiredOAuthConnectedConstraints: {
-  readonly flow: "unique(connectedFlow.moduleId,connectedFlow.flowId)";
-  readonly flowCommand: "unique(connectedFlow.moduleId,connectedFlow.commandId)";
-  readonly stateDigest: "unique(connectedFlow.stateDigest)";
-  readonly client: "unique(connectedClient.clientKey)";
-  readonly cohort: "unique(connectedCohort.cohortKey)";
-  readonly grant: "unique(connectedGrant.moduleId,connectedGrant.grantId)";
-  readonly grantIdentity: "unique(connectedGrant.moduleId,connectedGrant.subjectId,connectedGrant.profileKey,connectedGrant.activeIdentityKey)";
-  readonly admission: "unique(connectedAdmission.admissionId)";
-  readonly command: "unique(connectedCommand.moduleId,connectedCommand.commandId)";
-};
-export declare const requiredOAuthConnectedRevocationConstraints: {
-  readonly job: "unique(connectedRevocation.jobId)";
-};
+export type OAuthConnectedSqlPolicy<N> = Shared.OAuthConnectedSqlPolicy<N, SQL, Table>;
 /** Existing ownership only; workers never allocate or acquire a tuple. */
-export type OAuthConnectedOwnershipRead<T extends Table, O extends Table, N> = {
-  readonly mode: "integrated";
-  readonly tuple: Omit<OAuthOwnershipMutation<T, O, N>["tuple"], "encodeInsert">;
-} | {
-  readonly mode: "separate";
-  readonly tuple: Omit<OAuthOwnershipMutation<T, O, N>["tuple"], "encodeInsert">;
-  readonly external: Omit<Extract<OAuthOwnershipMutation<T, O, N>, {
-    readonly mode: "separate";
-  }>["external"], "encodeInsert">;
-};
-export interface OAuthConnectedAuthorityMapping<T extends Table, O extends Table, F extends Table, G extends Table, C extends Table, H extends Table, N> {
-  readonly ownership: OAuthConnectedOwnershipRead<T, O, N>;
-  readonly subjectId: SubjectIdCodec<N>;
-  readonly flow: Omit<OAuthConnectedFlowTable<F, N>, "encodeInsert">;
-  readonly grant: Omit<OAuthConnectedGrantTable<G, N>, "encodeInsert">;
-  readonly client: Omit<OAuthConnectedClientRegistrationTable<C>, "encodeInsert">;
-  readonly cohort: Omit<OAuthConnectedCohortTable<H>, "encodeInsert">;
-  readonly clock: OAuthClock;
-  readonly order: OAuthConnectedOrderCodec;
-  readonly tupleConstraints: typeof requiredOAuthTupleConstraints;
-  /** Safe metadata retention, never an expiry/quiescence proof for unresolved work. */
-  readonly retentionMillis: number;
-}
-export interface OAuthConnectedMapping<S extends Table, AC extends Table, T extends Table, O extends Table, F extends Table, G extends Table, C extends Table, H extends Table, A extends Table, D extends Table, N, J extends Table = never> extends OAuthConnectedAuthorityMapping<T, O, F, G, C, H, N> {
-  readonly ownership: OAuthOwnershipMutation<T, O, N>;
-  readonly flow: OAuthConnectedFlowTable<F, N>;
-  readonly grant: OAuthConnectedGrantTable<G, N>;
-  readonly client: OAuthConnectedClientRegistrationTable<C>;
-  readonly cohort: OAuthConnectedCohortTable<H>;
-  readonly subject: OAuthConnectedSubjectTable<S>;
-  readonly authority: OAuthAuthorityReadTable<AC>;
-  readonly admission: OAuthConnectedAdmissionTable<A, N>;
-  /** Same shared sign-in tables used by OAuthSignInPersistence. Enable only
-   * alongside a nullable connected-flow subjectId and flow.encodeSignIn. */
-  readonly signIn?: {
-    readonly credential: OAuthCredentialReadTable<Table>;
-    readonly flow: OAuthFlowTable<Table>;
-  };
-  readonly command: OAuthConnectedCommandTable<D, N>;
-  readonly policy: OAuthConnectedSqlPolicy<N>;
-  readonly constraints: typeof requiredOAuthConnectedConstraints;
-  readonly revocation: {
-    readonly mode: "unsupported";
-  } | {
-    readonly mode: "cohort";
-    readonly job: OAuthConnectedRevocationJobTable<J, N>;
-    readonly constraints: typeof requiredOAuthConnectedRevocationConstraints;
-  };
-  /** Without an authoritative same-owner predicate, conservatively retain Owned.
-   * Include login/other installed references; never filter away former-subject
-   * work. This pure SQL constructor supports both bound values and correlated
-   * column expressions with identical semantics; it performs no I/O.
-   * Compare through the reference table's typed columns (for example, eq) so
-   * native values use their encoders. Back the same-owner lookup with an index:
-   * discovery applies this predicate before its candidate limit.
-   * Connected references are checked separately. */
-  readonly externalReference?: (input: {
-    readonly identityKey: string;
-    readonly subjectId: N;
-  } | {
-    readonly identityKey: SQL;
-    readonly subjectId: SQL;
-  }) => SQL;
-}
-export interface OAuthConnectedRevocationMapping<T extends Table, O extends Table, F extends Table, G extends Table, C extends Table, H extends Table, J extends Table, N> extends OAuthConnectedAuthorityMapping<T, O, F, G, C, H, N> {
-  readonly job: Omit<OAuthConnectedRevocationJobTable<J, N>, "encodeInsert">;
-  readonly constraints: typeof requiredOAuthConnectedRevocationConstraints;
-}
+export type OAuthConnectedOwnershipRead<T extends Table, O extends Table, N> = Shared.OAuthConnectedOwnershipRead<DrizzleTableModel<T>, DrizzleTableModel<O>, N, SQL>;
+export type OAuthConnectedAuthorityMapping<T extends Table, O extends Table, F extends Table, G extends Table, C extends Table, H extends Table, N> = Shared.OAuthConnectedAuthorityMapping<DrizzleTableModel<T>, DrizzleTableModel<O>, DrizzleTableModel<F>, DrizzleTableModel<G>, DrizzleTableModel<C>, DrizzleTableModel<H>, N, SQL>;
+export type OAuthConnectedMapping<S extends Table, AC extends Table, T extends Table, O extends Table, F extends Table, G extends Table, C extends Table, H extends Table, A extends Table, D extends Table, N, J extends Table = never> = Shared.OAuthConnectedMapping<DrizzleTableModel<S>, DrizzleTableModel<AC>, DrizzleTableModel<T>, DrizzleTableModel<O>, DrizzleTableModel<F>, DrizzleTableModel<G>, DrizzleTableModel<C>, DrizzleTableModel<H>, DrizzleTableModel<A>, DrizzleTableModel<D>, N, DrizzleTableModel<J>, SQL, Table, DrizzleTableModel<Table>>;
+export type OAuthConnectedRevocationMapping<T extends Table, O extends Table, F extends Table, G extends Table, C extends Table, H extends Table, J extends Table, N> = Shared.OAuthConnectedRevocationMapping<DrizzleTableModel<T>, DrizzleTableModel<O>, DrizzleTableModel<F>, DrizzleTableModel<G>, DrizzleTableModel<C>, DrizzleTableModel<H>, DrizzleTableModel<J>, N, SQL>;
 //#endregion
+export { type OAuthConnectedAction, type OAuthConnectedOrderCodec, type OAuthConnectedPolicyInput, requiredOAuthConnectedConstraints, requiredOAuthConnectedRevocationConstraints };
 //# sourceMappingURL=oauth-connected-model.d.mts.map

package/dist/drizzle/oauth-connected-model.mjs

@@ -1,21 +1,7 @@
+import * as Shared from "@yielded/auth-persistence/Adapter";
+import { requiredOAuthConnectedConstraints, requiredOAuthConnectedRevocationConstraints } from "@yielded/auth-persistence/Adapter";
 //#region src/drizzle/oauth-connected-model.ts
-const oauthConnectedPolicyGuard = (input) => Object.freeze({
-	table: input.table,
-	orderBy: input.orderBy,
-	condition: input.condition
-});
-const requiredOAuthConnectedConstraints = {
-	flow: "unique(connectedFlow.moduleId,connectedFlow.flowId)",
-	flowCommand: "unique(connectedFlow.moduleId,connectedFlow.commandId)",
-	stateDigest: "unique(connectedFlow.stateDigest)",
-	client: "unique(connectedClient.clientKey)",
-	cohort: "unique(connectedCohort.cohortKey)",
-	grant: "unique(connectedGrant.moduleId,connectedGrant.grantId)",
-	grantIdentity: "unique(connectedGrant.moduleId,connectedGrant.subjectId,connectedGrant.profileKey,connectedGrant.activeIdentityKey)",
-	admission: "unique(connectedAdmission.admissionId)",
-	command: "unique(connectedCommand.moduleId,connectedCommand.commandId)"
-};
-const requiredOAuthConnectedRevocationConstraints = { job: "unique(connectedRevocation.jobId)" };
+const oauthConnectedPolicyGuard = (input) => Shared.oauthConnectedPolicyGuard(input);
 //#endregion
 export { oauthConnectedPolicyGuard, requiredOAuthConnectedConstraints, requiredOAuthConnectedRevocationConstraints };
 

package/dist/drizzle/oauth-connected-model.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-connected-model.mjs","names":[],"sources":["../../src/drizzle/oauth-connected-model.ts"],"sourcesContent":["import type { OAuthAccountRevision } from \"@yielded/auth/OAuth\";\nimport type * as M from \"@yielded/auth/OAuth\";\nimport type { AuthenticationRequirement } from \"@yielded/auth/Sessions\";\nimport type { InferInsertModel, InferSelectModel, SQL, Table } from \"drizzle-orm\";\n\nimport type { SubjectIdCodec } from \"./model\";\nimport type {\n  OAuthAuthorityReadTable,\n  OAuthClock,\n  OAuthCredentialReadTable,\n  OAuthFlowTable,\n  OAuthOwnershipMutation,\n  OAuthSubjectReadTable,\n  requiredOAuthTupleConstraints,\n} from \"./oauth-model\";\n\ntype Column<T extends Table> = Extract<keyof T[\"_\"][\"columns\"], string>;\nexport type OAuthConnectedAction = M.OAuthConnectedActionChallenge[\"action\"];\n\nexport interface OAuthConnectedSubjectTable<S extends Table> extends OAuthSubjectReadTable<S> {\n  readonly decodeActionRequirement: (\n    row: InferSelectModel<S>,\n    action: OAuthConnectedAction,\n  ) => AuthenticationRequirement;\n}\n\n/** All mapped order columns use exact SQL integer comparison through 2^53-1.\n * These codecs bridge driver representations, not alternative ordering rules. */\nexport interface OAuthConnectedOrderCodec {\n  readonly encode: (order: number) => unknown;\n  readonly decode: (value: unknown) => number;\n}\n\nexport interface OAuthConnectedFlowTable<F extends Table, N> {\n  readonly table: F;\n  readonly moduleId: Column<F>;\n  readonly flowId: Column<F>;\n  readonly commandId: Column<F>;\n  readonly subjectId: Column<F>;\n  readonly clientKey: Column<F>;\n  readonly cohortKey: Column<F>;\n  readonly state: Column<F>;\n  readonly version: Column<F>;\n  readonly stateDigest: Column<F>;\n  readonly snapshot: Column<F>;\n  readonly claimId: Column<F>;\n  readonly claimDigest: Column<F>;\n  readonly claimOrder: Column<F>;\n  readonly claimedAt: Column<F>;\n  readonly claimExpiresAt: Column<F>;\n  readonly expiresAt: Column<F>;\n  readonly retentionUntil: Column<F>;\n  /** None before claim, Unresolved after claim, Resolved only after definite\n   * cancellation or atomic transfer to a grant/job. Never reset by cleanup. */\n  readonly work: Column<F>;\n  /** Exact sealed quarantine when no correctly sealed revocation job is available. */\n  readonly custody: Column<F>;\n  /** Required when retaining grants during sign-in. subjectId is NULL until\n   * identity resolution; custom required columns are supplied by this encoder. */\n  readonly encodeSignIn?: (reservation: M.OAuthSignInAccessClaim) => InferInsertModel<F>;\n  readonly encodeInsert: (input: {\n    readonly flow: M.OAuthConnectedPendingFlow;\n    readonly subjectId: N;\n  }) => InferInsertModel<F>;\n}\n\nexport interface OAuthConnectedGrantTable<G extends Table, N> {\n  readonly table: G;\n  readonly moduleId: Column<G>;\n  readonly grantId: Column<G>;\n  readonly subjectId: Column<G>;\n  readonly identityKey: Column<G>;\n  /** Nullable unique active slot; historical/disconnected records use null. */\n  readonly activeIdentityKey: Column<G>;\n  readonly clientKey: Column<G>;\n  readonly cohortKey: Column<G>;\n  readonly profileKey: Column<G>;\n  readonly grantVersion: Column<G>;\n  readonly tokenVersion: Column<G>;\n  readonly cohortGeneration: Column<G>;\n  readonly state: Column<G>;\n  readonly version: Column<G>;\n  readonly context: Column<G>;\n  readonly sealed: Column<G>;\n  /** Canonical OAuthConnectedSummary only: list never loads token envelopes. */\n  readonly summary: Column<G>;\n  readonly revocationJobId: Column<G>;\n  readonly refreshWork: Column<G>;\n  readonly refreshClaim: Column<G>;\n  readonly refreshClaimExpiresAt: Column<G>;\n  readonly retentionUntil: Column<G>;\n  readonly encodeInsert: (input: {\n    readonly grant: M.OAuthConnectedStoredGrant;\n    readonly subjectId: N;\n  }) => InferInsertModel<G>;\n}\n\n/** Also stores a permanent provider/issuer scope anchor. clientKey must fit 52\n * ASCII characters. Empty clientRegistrationId is reserved for that anchor;\n * actual profile registrations are nonempty. Scope counter stays zero. */\nexport interface OAuthConnectedClientRegistrationTable<C extends Table> {\n  readonly table: C;\n  readonly clientKey: Column<C>;\n  readonly provider: Column<C>;\n  readonly issuer: Column<C>;\n  readonly clientRegistrationId: Column<C>;\n  readonly counter: Column<C>;\n  readonly version: Column<C>;\n  readonly encodeInsert: (configuration: M.OAuthConnectedConfiguration) => InferInsertModel<C>;\n}\n\n/** Remote authority: no local-subject column or subject-scoped key. Retain this\n * anchor/cutoff when a legitimately released tuple gains a different local owner. */\nexport interface OAuthConnectedCohortTable<C extends Table> {\n  readonly table: C;\n  readonly cohortKey: Column<C>;\n  readonly clientKey: Column<C>;\n  readonly identityKey: Column<C>;\n  readonly generation: Column<C>;\n  readonly cutoff: Column<C>;\n  readonly state: Column<C>;\n  readonly version: Column<C>;\n  readonly encodeInsert: (input: {\n    readonly clientKey: string;\n    readonly identityKey: string;\n  }) => InferInsertModel<C>;\n}\n\nexport interface OAuthConnectedAdmissionTable<A extends Table, N> {\n  readonly table: A;\n  readonly admissionId: Column<A>;\n  readonly moduleId: Column<A>;\n  readonly grantId: Column<A>;\n  readonly subjectId: Column<A>;\n  readonly identityKey: Column<A>;\n  readonly clientKey: Column<A>;\n  readonly cohortKey: Column<A>;\n  readonly snapshot: Column<A>;\n  readonly admittedAt: Column<A>;\n  readonly expiresAt: Column<A>;\n  readonly version: Column<A>;\n  readonly encodeInsert: (input: {\n    readonly admissionId: string;\n    readonly grant: M.OAuthConnectedStoredGrant;\n    readonly authorization: M.OAuthConnectedUseAuthorization;\n    readonly subjectId: N;\n  }) => InferInsertModel<A>;\n}\n\nexport interface OAuthConnectedCommandTable<C extends Table, N> {\n  readonly table: C;\n  readonly moduleId: Column<C>;\n  readonly commandId: Column<C>;\n  readonly subjectId: Column<C>;\n  readonly grantId: Column<C>;\n  readonly intent: Column<C>;\n  readonly decision: Column<C>;\n  readonly retentionUntil: Column<C>;\n  readonly version: Column<C>;\n  readonly encodeInsert: (input: {\n    readonly commandId: string;\n    readonly grant: M.OAuthConnectedDisconnectGrant;\n    readonly subjectId: N;\n  }) => InferInsertModel<C>;\n}\n\nexport interface OAuthConnectedRevocationJobTable<J extends Table, N> {\n  readonly table: J;\n  readonly jobId: Column<J>;\n  readonly moduleId: Column<J>;\n  readonly subjectId: Column<J>;\n  readonly identityKey: Column<J>;\n  readonly clientKey: Column<J>;\n  readonly cohortKey: Column<J>;\n  readonly grantId: Column<J>;\n  readonly snapshot: Column<J>;\n  readonly state: Column<J>;\n  readonly claimId: Column<J>;\n  readonly claimedAt: Column<J>;\n  readonly claimExpiresAt: Column<J>;\n  readonly retentionUntil: Column<J>;\n  readonly version: Column<J>;\n  readonly encodeInsert: (input: {\n    readonly job: M.OAuthConnectedRevocationJob;\n    readonly subjectId: N;\n  }) => InferInsertModel<J>;\n}\n\nexport type OAuthConnectedPolicyInput<N> = {\n  readonly subjectId: N;\n  readonly revision: OAuthAccountRevision;\n} & (\n  | {\n      readonly kind: \"action\";\n      readonly operation: \"issue\" | \"claim\" | \"settle\" | \"disconnect\";\n      readonly authorization: M.OAuthConnectedActionAuthorization;\n      readonly configuration: M.OAuthConnectedConfiguration;\n      readonly grant?: M.OAuthConnectedTokenContext;\n    }\n  | {\n      readonly kind: \"sign-in\";\n      readonly credential: M.OAuthCredentialSnapshot;\n      readonly configuration: M.OAuthConnectedConfiguration;\n      readonly grant?: M.OAuthConnectedTokenContext;\n    }\n  | {\n      readonly kind: \"metadata\" | \"use\";\n      readonly authorization: M.OAuthConnectedUseAuthorization;\n      readonly grant?: M.OAuthConnectedTokenContext;\n    }\n);\n\nexport interface OAuthConnectedPolicyGuardTable<T extends Table, N> {\n  readonly table: T;\n  readonly orderBy: Column<T>;\n  readonly condition: (input: OAuthConnectedPolicyInput<N>) => SQL;\n}\n\nexport interface OAuthConnectedPolicyGuard<N> {\n  readonly table: Table;\n  readonly orderBy: string;\n  readonly condition: (input: OAuthConnectedPolicyInput<N>) => SQL;\n}\n\nexport const oauthConnectedPolicyGuard = <T extends Table, N>(\n  input: OAuthConnectedPolicyGuardTable<T, N>,\n): OAuthConnectedPolicyGuard<N> =>\n  Object.freeze({\n    table: input.table,\n    orderBy: input.orderBy,\n    condition: input.condition,\n  });\n\nexport interface OAuthConnectedSqlPolicy<N> {\n  /** Up to 32 scopes, each selecting 1..64 stable rows in global lock order.\n   * Omit only when subject/shared authority locks already serialize every mutable\n   * policy dependency or policy is immutable. All writers follow that order. */\n  readonly guards?: ReadonlyArray<OAuthConnectedPolicyGuard<N>>;\n  /** Recheck exact policy revision, purpose, optional grant/profile restrictions\n   * and current profile/permissions; joins and absence assumptions are authority.\n   * The engine checks this before and after every owner/application write. */\n  readonly condition: (input: OAuthConnectedPolicyInput<N>) => SQL;\n}\n\nexport const requiredOAuthConnectedConstraints = {\n  flow: \"unique(connectedFlow.moduleId,connectedFlow.flowId)\",\n  flowCommand: \"unique(connectedFlow.moduleId,connectedFlow.commandId)\",\n  stateDigest: \"unique(connectedFlow.stateDigest)\",\n  client: \"unique(connectedClient.clientKey)\",\n  cohort: \"unique(connectedCohort.cohortKey)\",\n  grant: \"unique(connectedGrant.moduleId,connectedGrant.grantId)\",\n  grantIdentity:\n    \"unique(connectedGrant.moduleId,connectedGrant.subjectId,connectedGrant.profileKey,connectedGrant.activeIdentityKey)\",\n  admission: \"unique(connectedAdmission.admissionId)\",\n  command: \"unique(connectedCommand.moduleId,connectedCommand.commandId)\",\n} as const;\n\nexport const requiredOAuthConnectedRevocationConstraints = {\n  job: \"unique(connectedRevocation.jobId)\",\n} as const;\n\n/** Existing ownership only; workers never allocate or acquire a tuple. */\nexport type OAuthConnectedOwnershipRead<T extends Table, O extends Table, N> =\n  | {\n      readonly mode: \"integrated\";\n      readonly tuple: Omit<OAuthOwnershipMutation<T, O, N>[\"tuple\"], \"encodeInsert\">;\n    }\n  | {\n      readonly mode: \"separate\";\n      readonly tuple: Omit<OAuthOwnershipMutation<T, O, N>[\"tuple\"], \"encodeInsert\">;\n      readonly external: Omit<\n        Extract<OAuthOwnershipMutation<T, O, N>, { readonly mode: \"separate\" }>[\"external\"],\n        \"encodeInsert\"\n      >;\n    };\n\nexport interface OAuthConnectedAuthorityMapping<\n  T extends Table,\n  O extends Table,\n  F extends Table,\n  G extends Table,\n  C extends Table,\n  H extends Table,\n  N,\n> {\n  readonly ownership: OAuthConnectedOwnershipRead<T, O, N>;\n  readonly subjectId: SubjectIdCodec<N>;\n  readonly flow: Omit<OAuthConnectedFlowTable<F, N>, \"encodeInsert\">;\n  readonly grant: Omit<OAuthConnectedGrantTable<G, N>, \"encodeInsert\">;\n  readonly client: Omit<OAuthConnectedClientRegistrationTable<C>, \"encodeInsert\">;\n  readonly cohort: Omit<OAuthConnectedCohortTable<H>, \"encodeInsert\">;\n  readonly clock: OAuthClock;\n  readonly order: OAuthConnectedOrderCodec;\n  readonly tupleConstraints: typeof requiredOAuthTupleConstraints;\n  /** Safe metadata retention, never an expiry/quiescence proof for unresolved work. */\n  readonly retentionMillis: number;\n}\n\nexport interface OAuthConnectedMapping<\n  S extends Table,\n  AC extends Table,\n  T extends Table,\n  O extends Table,\n  F extends Table,\n  G extends Table,\n  C extends Table,\n  H extends Table,\n  A extends Table,\n  D extends Table,\n  N,\n  J extends Table = never,\n> extends OAuthConnectedAuthorityMapping<T, O, F, G, C, H, N> {\n  readonly ownership: OAuthOwnershipMutation<T, O, N>;\n  readonly flow: OAuthConnectedFlowTable<F, N>;\n  readonly grant: OAuthConnectedGrantTable<G, N>;\n  readonly client: OAuthConnectedClientRegistrationTable<C>;\n  readonly cohort: OAuthConnectedCohortTable<H>;\n  readonly subject: OAuthConnectedSubjectTable<S>;\n  readonly authority: OAuthAuthorityReadTable<AC>;\n  readonly admission: OAuthConnectedAdmissionTable<A, N>;\n  /** Same shared sign-in tables used by OAuthSignInPersistence. Enable only\n   * alongside a nullable connected-flow subjectId and flow.encodeSignIn. */\n  readonly signIn?: {\n    readonly credential: OAuthCredentialReadTable<Table>;\n    readonly flow: OAuthFlowTable<Table>;\n  };\n  readonly command: OAuthConnectedCommandTable<D, N>;\n  readonly policy: OAuthConnectedSqlPolicy<N>;\n  readonly constraints: typeof requiredOAuthConnectedConstraints;\n  readonly revocation:\n    | { readonly mode: \"unsupported\" }\n    | {\n        readonly mode: \"cohort\";\n        readonly job: OAuthConnectedRevocationJobTable<J, N>;\n        readonly constraints: typeof requiredOAuthConnectedRevocationConstraints;\n      };\n  /** Without an authoritative same-owner predicate, conservatively retain Owned.\n   * Include login/other installed references; never filter away former-subject\n   * work. This pure SQL constructor supports both bound values and correlated\n   * column expressions with identical semantics; it performs no I/O.\n   * Compare through the reference table's typed columns (for example, eq) so\n   * native values use their encoders. Back the same-owner lookup with an index:\n   * discovery applies this predicate before its candidate limit.\n   * Connected references are checked separately. */\n  readonly externalReference?: (\n    input:\n      | { readonly identityKey: string; readonly subjectId: N }\n      | { readonly identityKey: SQL; readonly subjectId: SQL },\n  ) => SQL;\n}\n\nexport interface OAuthConnectedRevocationMapping<\n  T extends Table,\n  O extends Table,\n  F extends Table,\n  G extends Table,\n  C extends Table,\n  H extends Table,\n  J extends Table,\n  N,\n> extends OAuthConnectedAuthorityMapping<T, O, F, G, C, H, N> {\n  readonly job: Omit<OAuthConnectedRevocationJobTable<J, N>, \"encodeInsert\">;\n  readonly constraints: typeof requiredOAuthConnectedRevocationConstraints;\n}\n"],"mappings":";AAgOA,MAAa,6BACX,UAEA,OAAO,OAAO;CACZ,OAAO,MAAM;CACb,SAAS,MAAM;CACf,WAAW,MAAM;AACnB,CAAC;AAaH,MAAa,oCAAoC;CAC/C,MAAM;CACN,aAAa;CACb,aAAa;CACb,QAAQ;CACR,QAAQ;CACR,OAAO;CACP,eACE;CACF,WAAW;CACX,SAAS;AACX;AAEA,MAAa,8CAA8C,EACzD,KAAK,oCACP"}
+{"version":3,"file":"oauth-connected-model.mjs","names":[],"sources":["../../src/drizzle/oauth-connected-model.ts"],"sourcesContent":["import * as Shared from \"@yielded/auth-persistence/Adapter\";\nimport type { SQL, Table } from \"drizzle-orm\";\n\nimport type { DrizzleTableModel } from \"./table-model\";\n\nexport {\n  type OAuthConnectedAction,\n  type OAuthConnectedOrderCodec,\n  type OAuthConnectedPolicyInput,\n  requiredOAuthConnectedConstraints,\n  requiredOAuthConnectedRevocationConstraints,\n} from \"@yielded/auth-persistence/Adapter\";\n\nexport type OAuthConnectedSubjectTable<S extends Table> = Shared.OAuthConnectedSubjectTable<\n  DrizzleTableModel<S>,\n  SQL\n>;\n\nexport type OAuthConnectedFlowTable<F extends Table, N> = Shared.OAuthConnectedFlowTable<\n  DrizzleTableModel<F>,\n  N\n>;\n\nexport type OAuthConnectedGrantTable<G extends Table, N> = Shared.OAuthConnectedGrantTable<\n  DrizzleTableModel<G>,\n  N\n>;\n\n/** Also stores a permanent provider/issuer scope anchor. clientKey must fit 52\n * ASCII characters. Empty clientRegistrationId is reserved for that anchor;\n * actual profile registrations are nonempty. Scope counter stays zero. */\nexport type OAuthConnectedClientRegistrationTable<C extends Table> =\n  Shared.OAuthConnectedClientRegistrationTable<DrizzleTableModel<C>>;\n\n/** Remote authority: no local-subject column or subject-scoped key. Retain this\n * anchor/cutoff when a legitimately released tuple gains a different local owner. */\nexport type OAuthConnectedCohortTable<C extends Table> = Shared.OAuthConnectedCohortTable<\n  DrizzleTableModel<C>\n>;\n\nexport type OAuthConnectedAdmissionTable<A extends Table, N> = Shared.OAuthConnectedAdmissionTable<\n  DrizzleTableModel<A>,\n  N\n>;\n\nexport type OAuthConnectedCommandTable<C extends Table, N> = Shared.OAuthConnectedCommandTable<\n  DrizzleTableModel<C>,\n  N\n>;\n\nexport type OAuthConnectedRevocationJobTable<\n  J extends Table,\n  N,\n> = Shared.OAuthConnectedRevocationJobTable<DrizzleTableModel<J>, N>;\n\nexport type OAuthConnectedPolicyGuardTable<\n  T extends Table,\n  N,\n> = Shared.OAuthConnectedPolicyGuardTable<DrizzleTableModel<T>, N, SQL>;\n\nexport type OAuthConnectedPolicyGuard<N> = Shared.OAuthConnectedPolicyGuard<N, SQL, Table>;\n\nexport const oauthConnectedPolicyGuard = <T extends Table, N>(\n  input: OAuthConnectedPolicyGuardTable<T, N>,\n): OAuthConnectedPolicyGuard<N> =>\n  Shared.oauthConnectedPolicyGuard<DrizzleTableModel<T>, N, SQL>(input);\n\nexport type OAuthConnectedSqlPolicy<N> = Shared.OAuthConnectedSqlPolicy<N, SQL, Table>;\n\n/** Existing ownership only; workers never allocate or acquire a tuple. */\nexport type OAuthConnectedOwnershipRead<\n  T extends Table,\n  O extends Table,\n  N,\n> = Shared.OAuthConnectedOwnershipRead<DrizzleTableModel<T>, DrizzleTableModel<O>, N, SQL>;\n\nexport type OAuthConnectedAuthorityMapping<\n  T extends Table,\n  O extends Table,\n  F extends Table,\n  G extends Table,\n  C extends Table,\n  H extends Table,\n  N,\n> = Shared.OAuthConnectedAuthorityMapping<\n  DrizzleTableModel<T>,\n  DrizzleTableModel<O>,\n  DrizzleTableModel<F>,\n  DrizzleTableModel<G>,\n  DrizzleTableModel<C>,\n  DrizzleTableModel<H>,\n  N,\n  SQL\n>;\n\nexport type OAuthConnectedMapping<\n  S extends Table,\n  AC extends Table,\n  T extends Table,\n  O extends Table,\n  F extends Table,\n  G extends Table,\n  C extends Table,\n  H extends Table,\n  A extends Table,\n  D extends Table,\n  N,\n  J extends Table = never,\n> = Shared.OAuthConnectedMapping<\n  DrizzleTableModel<S>,\n  DrizzleTableModel<AC>,\n  DrizzleTableModel<T>,\n  DrizzleTableModel<O>,\n  DrizzleTableModel<F>,\n  DrizzleTableModel<G>,\n  DrizzleTableModel<C>,\n  DrizzleTableModel<H>,\n  DrizzleTableModel<A>,\n  DrizzleTableModel<D>,\n  N,\n  DrizzleTableModel<J>,\n  SQL,\n  Table,\n  DrizzleTableModel<Table>\n>;\n\nexport type OAuthConnectedRevocationMapping<\n  T extends Table,\n  O extends Table,\n  F extends Table,\n  G extends Table,\n  C extends Table,\n  H extends Table,\n  J extends Table,\n  N,\n> = Shared.OAuthConnectedRevocationMapping<\n  DrizzleTableModel<T>,\n  DrizzleTableModel<O>,\n  DrizzleTableModel<F>,\n  DrizzleTableModel<G>,\n  DrizzleTableModel<C>,\n  DrizzleTableModel<H>,\n  DrizzleTableModel<J>,\n  N,\n  SQL\n>;\n"],"mappings":";;;AA8DA,MAAa,6BACX,UAEA,OAAO,0BAAwD,KAAK"}

package/dist/drizzle/oauth-connected-reference.d.mts

@@ -1,10 +1,8 @@
 import { OAuthReferenceGuardDescriptor } from "./oauth-model.mjs";
 import { OAuthConnectedMapping } from "./oauth-connected-model.mjs";
-import "./oauth-connected-state.mjs";
 import { SQL, Table } from "drizzle-orm";
 //#region src/drizzle/oauth-connected-reference.d.ts
-/** Compose Accounts.Unlink with this connected authority. The stable scope lock
- * serializes unknown claims across every client registration for an issuer. */
+/** Compose login unlink with retained-grant ownership under this compiler. */
 export declare const oauthConnectedOwnershipReferences: <S extends Table, AC extends Table, T extends Table, O extends Table, F extends Table, G extends Table, C extends Table, H extends Table, A extends Table, D extends Table, N, J extends Table>(original: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, A, D, N, J>) => {
   readonly connectedReferenceGuards: ReadonlyArray<OAuthReferenceGuardDescriptor<N>>;
   readonly connectedReference: (input: {

package/dist/drizzle/oauth-connected-reference.mjs

@@ -1,57 +1,8 @@
-import { oauthReferenceGuardTable } from "./oauth-model.mjs";
-import { captureOAuthMapping } from "./oauth-state.mjs";
-import { both } from "./transaction-owner.mjs";
-import { col, equal } from "./oauth-owner.mjs";
-import { scopeKey } from "./oauth-connected-state.mjs";
-import { eq, is, sql } from "drizzle-orm";
-import { Effect } from "effect";
-import { MySqlTable } from "drizzle-orm/mysql-core/table";
-import { PgTable } from "drizzle-orm/pg-core/table";
+import { oauthKernel } from "./oauth-kernel.mjs";
 //#region src/drizzle/oauth-connected-reference.ts
-const exactText = (table, key, value) => {
-	const column = col(table, key), bound = sql.param(value, column);
-	return is(table, MySqlTable) ? sql`binary ${column} = binary ${bound}` : is(table, PgTable) ? sql`convert_to(cast(${column} as text),'UTF8') = convert_to(cast(${bound} as text),'UTF8')` : sql`cast(${column} as blob) = cast(${bound} as blob)`;
-};
-/** Compose Accounts.Unlink with this connected authority. The stable scope lock
-* serializes unknown claims across every client registration for an issuer. */
-const oauthConnectedOwnershipReferences = (original) => {
-	const mapping = captureOAuthMapping(original), c = mapping.client;
-	return Object.freeze({
-		connectedReferenceGuards: [oauthReferenceGuardTable({
-			table: c.table,
-			orderBy: c.clientKey,
-			condition: (input) => Effect.gen(function* () {
-				const key = yield* scopeKey(input.identity.provider, input.identity.issuer);
-				return both(equal(c.table, {
-					[c.clientKey]: key,
-					[c.counter]: mapping.order.encode(0)
-				}), exactText(c.table, c.provider, input.identity.provider), exactText(c.table, c.issuer, input.identity.issuer), exactText(c.table, c.clientRegistrationId, ""));
-			})
-		})],
-		connectedReference: (input) => connectedReferenceCondition(mapping, input.identityKey)
-	});
-};
-const connectedReferenceCondition = (mapping, identityKey, knownIdentity) => {
-	const c = mapping.client, t = mapping.ownership.tuple, f = mapping.flow, g = mapping.grant, h = mapping.cohort, a = mapping.admission, j = mapping.revocation.mode === "cohort" ? mapping.revocation.job : void 0;
-	const tuple = equal(t.table, { [t.identityKey]: identityKey });
-	const knownFlow = sql`exists(select 1 from ${h.table} where ${col(h.table, h.cohortKey)} = ${col(f.table, f.cohortKey)} and ${col(h.table, h.identityKey)} = ${identityKey})`;
-	const unknownFlow = knownIdentity === void 0 ? sql`${col(f.table, f.cohortKey)} is null and exists(select 1 from ${c.table} where ${col(c.table, c.clientKey)} = ${col(f.table, f.clientKey)} and exists(select 1 from ${t.table} where ${tuple} and ${col(c.table, c.provider)} = ${col(t.table, t.provider)} and ${col(c.table, c.issuer)} = ${col(t.table, t.issuer)}))` : sql`${col(f.table, f.cohortKey)} is null and exists(select 1 from ${c.table} where ${col(c.table, c.clientKey)} = ${col(f.table, f.clientKey)} and ${col(c.table, c.provider)} = ${knownIdentity.provider} and ${col(c.table, c.issuer)} = ${knownIdentity.issuer})`;
-	const related = [
-		f,
-		g,
-		h,
-		...j === void 0 ? [] : [j]
-	];
-	return sql`(${sql.join([
-		sql`exists(select 1 from ${g.table} where ${eq(col(g.table, g.identityKey), identityKey)})`,
-		sql`exists(select 1 from ${a.table} where ${eq(col(a.table, a.identityKey), identityKey)})`,
-		sql`exists(select 1 from ${h.table} where ${both(eq(col(h.table, h.identityKey), identityKey), eq(col(h.table, h.state), "Blocked"))})`,
-		sql`exists(select 1 from ${f.table} where ${col(f.table, f.work)} = 'Unresolved' and (${knownFlow} or (${unknownFlow})))`,
-		...j === void 0 ? [] : [sql`exists(select 1 from ${j.table} where ${eq(col(j.table, j.identityKey), identityKey)})`],
-		...related.map((v) => sql`exists(select 1 from ${v.table} where not exists(select 1 from ${c.table} where ${col(c.table, c.clientKey)} = ${col(v.table, v.clientKey)}))`)
-	], sql` or `)})`;
-};
+/** Compose login unlink with retained-grant ownership under this compiler. */
+const oauthConnectedOwnershipReferences = (original) => oauthKernel.connectedReference.oauthConnectedOwnershipReferences(original);
 //#endregion
-export { connectedReferenceCondition, oauthConnectedOwnershipReferences };
+export { oauthConnectedOwnershipReferences };
 
 //# sourceMappingURL=oauth-connected-reference.mjs.map

package/dist/drizzle/oauth-connected-reference.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-connected-reference.mjs","names":[],"sources":["../../src/drizzle/oauth-connected-reference.ts"],"sourcesContent":["import { eq, is, sql, type SQL, type Table } from \"drizzle-orm\";\nimport { MySqlTable } from \"drizzle-orm/mysql-core/table\";\nimport { PgTable } from \"drizzle-orm/pg-core/table\";\nimport { Effect } from \"effect\";\n\nimport type { OAuthConnectedMapping } from \"./oauth-connected-model\";\nimport { scopeKey, type Mapping } from \"./oauth-connected-state\";\nimport { oauthReferenceGuardTable, type OAuthReferenceGuardDescriptor } from \"./oauth-model\";\nimport { both, col, equal } from \"./oauth-owner\";\nimport { captureOAuthMapping } from \"./oauth-state\";\n\nconst exactText = (table: Table, key: string, value: string) => {\n  const column = col(table, key),\n    bound = sql.param(value, column);\n\n  return is(table, MySqlTable)\n    ? sql`binary ${column} = binary ${bound}`\n    : is(table, PgTable)\n      ? sql`convert_to(cast(${column} as text),'UTF8') = convert_to(cast(${bound} as text),'UTF8')`\n      : sql`cast(${column} as blob) = cast(${bound} as blob)`;\n};\n\n/** Compose Accounts.Unlink with this connected authority. The stable scope lock\n * serializes unknown claims across every client registration for an issuer. */\nexport const oauthConnectedOwnershipReferences = <\n  S extends Table,\n  AC extends Table,\n  T extends Table,\n  O extends Table,\n  F extends Table,\n  G extends Table,\n  C extends Table,\n  H extends Table,\n  A extends Table,\n  D extends Table,\n  N,\n  J extends Table,\n>(\n  original: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, A, D, N, J>,\n): {\n  readonly connectedReferenceGuards: ReadonlyArray<OAuthReferenceGuardDescriptor<N>>;\n  readonly connectedReference: (input: {\n    readonly identityKey: string;\n    readonly subjectId: N;\n  }) => SQL;\n} => {\n  const mapping = captureOAuthMapping(original),\n    c = mapping.client;\n\n  return Object.freeze({\n    connectedReferenceGuards: [\n      oauthReferenceGuardTable<C, N>({\n        table: c.table,\n        orderBy: c.clientKey,\n        condition: (input) =>\n          Effect.gen(function* () {\n            const key = yield* scopeKey(input.identity.provider, input.identity.issuer);\n\n            return both(\n              equal(c.table, {\n                [c.clientKey]: key,\n                [c.counter]: mapping.order.encode(0),\n              }),\n              exactText(c.table, c.provider, input.identity.provider),\n              exactText(c.table, c.issuer, input.identity.issuer),\n              exactText(c.table, c.clientRegistrationId, \"\"),\n            );\n          }),\n      }),\n    ],\n    connectedReference: (input) => connectedReferenceCondition(mapping, input.identityKey),\n  });\n};\n\nexport const connectedReferenceCondition = (\n  mapping: Mapping,\n  identityKey: string | SQL,\n  knownIdentity?: { readonly provider: string | SQL; readonly issuer: string | SQL },\n) => {\n  const c = mapping.client,\n    t = mapping.ownership.tuple,\n    f = mapping.flow,\n    g = mapping.grant,\n    h = mapping.cohort,\n    a = mapping.admission,\n    j = mapping.revocation.mode === \"cohort\" ? mapping.revocation.job : undefined;\n\n  const tuple = equal(t.table, { [t.identityKey]: identityKey });\n  const knownFlow = sql`exists(select 1 from ${h.table} where ${col(h.table, h.cohortKey)} = ${col(f.table, f.cohortKey)} and ${col(h.table, h.identityKey)} = ${identityKey})`;\n\n  const unknownFlow =\n    knownIdentity === undefined\n      ? sql`${col(f.table, f.cohortKey)} is null and exists(select 1 from ${c.table} where ${col(c.table, c.clientKey)} = ${col(f.table, f.clientKey)} and exists(select 1 from ${t.table} where ${tuple} and ${col(c.table, c.provider)} = ${col(t.table, t.provider)} and ${col(c.table, c.issuer)} = ${col(t.table, t.issuer)}))`\n      : sql`${col(f.table, f.cohortKey)} is null and exists(select 1 from ${c.table} where ${col(c.table, c.clientKey)} = ${col(f.table, f.clientKey)} and ${col(c.table, c.provider)} = ${knownIdentity.provider} and ${col(c.table, c.issuer)} = ${knownIdentity.issuer})`;\n\n  const related = [f, g, h, ...(j === undefined ? [] : [j])];\n\n  return sql`(${sql.join(\n    [\n      sql`exists(select 1 from ${g.table} where ${eq(col(g.table, g.identityKey), identityKey)})`,\n      sql`exists(select 1 from ${a.table} where ${eq(col(a.table, a.identityKey), identityKey)})`,\n      sql`exists(select 1 from ${h.table} where ${both(eq(col(h.table, h.identityKey), identityKey), eq(col(h.table, h.state), \"Blocked\"))})`,\n      sql`exists(select 1 from ${f.table} where ${col(f.table, f.work)} = 'Unresolved' and (${knownFlow} or (${unknownFlow})))`,\n      ...(j === undefined\n        ? []\n        : [\n            sql`exists(select 1 from ${j.table} where ${eq(col(j.table, j.identityKey), identityKey)})`,\n          ]),\n      // A missing real client cannot turn erased unknown work into absence.\n      ...related.map(\n        (v) =>\n          sql`exists(select 1 from ${v.table} where not exists(select 1 from ${c.table} where ${col(c.table, c.clientKey)} = ${col(v.table, v.clientKey)}))`,\n      ),\n    ],\n    sql` or `,\n  )})`;\n};\n"],"mappings":";;;;;;;;;;AAWA,MAAM,aAAa,OAAc,KAAa,UAAkB;CAC9D,MAAM,SAAS,IAAI,OAAO,GAAG,GAC3B,QAAQ,IAAI,MAAM,OAAO,MAAM;CAEjC,OAAO,GAAG,OAAO,UAAU,IACvB,GAAG,UAAU,OAAO,YAAY,UAChC,GAAG,OAAO,OAAO,IACf,GAAG,mBAAmB,OAAO,sCAAsC,MAAM,qBACzE,GAAG,QAAQ,OAAO,mBAAmB,MAAM;AACnD;;;AAIA,MAAa,qCAcX,aAOG;CACH,MAAM,UAAU,oBAAoB,QAAQ,GAC1C,IAAI,QAAQ;CAEd,OAAO,OAAO,OAAO;EACnB,0BAA0B,CACxB,yBAA+B;GAC7B,OAAO,EAAE;GACT,SAAS,EAAE;GACX,YAAY,UACV,OAAO,IAAI,aAAa;IACtB,MAAM,MAAM,OAAO,SAAS,MAAM,SAAS,UAAU,MAAM,SAAS,MAAM;IAE1E,OAAO,KACL,MAAM,EAAE,OAAO;MACZ,EAAE,YAAY;MACd,EAAE,UAAU,QAAQ,MAAM,OAAO,CAAC;IACrC,CAAC,GACD,UAAU,EAAE,OAAO,EAAE,UAAU,MAAM,SAAS,QAAQ,GACtD,UAAU,EAAE,OAAO,EAAE,QAAQ,MAAM,SAAS,MAAM,GAClD,UAAU,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAC/C;GACF,CAAC;EACL,CAAC,CACH;EACA,qBAAqB,UAAU,4BAA4B,SAAS,MAAM,WAAW;CACvF,CAAC;AACH;AAEA,MAAa,+BACX,SACA,aACA,kBACG;CACH,MAAM,IAAI,QAAQ,QAChB,IAAI,QAAQ,UAAU,OACtB,IAAI,QAAQ,MACZ,IAAI,QAAQ,OACZ,IAAI,QAAQ,QACZ,IAAI,QAAQ,WACZ,IAAI,QAAQ,WAAW,SAAS,WAAW,QAAQ,WAAW,MAAM,KAAA;CAEtE,MAAM,QAAQ,MAAM,EAAE,OAAO,GAAG,EAAE,cAAc,YAAY,CAAC;CAC7D,MAAM,YAAY,GAAG,wBAAwB,EAAE,MAAM,SAAS,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,YAAY;CAE3K,MAAM,cACJ,kBAAkB,KAAA,IACd,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,oCAAoC,EAAE,MAAM,SAAS,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,4BAA4B,EAAE,MAAM,SAAS,MAAM,OAAO,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MACzT,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,oCAAoC,EAAE,MAAM,SAAS,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,cAAc,SAAS,OAAO,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,cAAc,OAAO;CAExQ,MAAM,UAAU;EAAC;EAAG;EAAG;EAAG,GAAI,MAAM,KAAA,IAAY,CAAC,IAAI,CAAC,CAAC;CAAE;CAEzD,OAAO,GAAG,IAAI,IAAI,KAChB;EACE,GAAG,wBAAwB,EAAE,MAAM,SAAS,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,WAAW,EAAE;EACzF,GAAG,wBAAwB,EAAE,MAAM,SAAS,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,WAAW,EAAE;EACzF,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAAK,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,WAAW,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,SAAS,CAAC,EAAE;EACrI,GAAG,wBAAwB,EAAE,MAAM,SAAS,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,UAAU,OAAO,YAAY;EACrH,GAAI,MAAM,KAAA,IACN,CAAC,IACD,CACE,GAAG,wBAAwB,EAAE,MAAM,SAAS,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,WAAW,EAAE,EAC3F;EAEJ,GAAG,QAAQ,KACR,MACC,GAAG,wBAAwB,EAAE,MAAM,kCAAkC,EAAE,MAAM,SAAS,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,GACnJ;CACF,GACA,GAAG,MACL,EAAE;AACJ"}
+{"version":3,"file":"oauth-connected-reference.mjs","names":[],"sources":["../../src/drizzle/oauth-connected-reference.ts"],"sourcesContent":["import type { SQL, Table } from \"drizzle-orm\";\n\nimport type { OAuthConnectedMapping } from \"./oauth-connected-model\";\nimport { oauthKernel } from \"./oauth-kernel\";\nimport type { OAuthReferenceGuardDescriptor } from \"./oauth-model\";\n\n/** Compose login unlink with retained-grant ownership under this compiler. */\nexport const oauthConnectedOwnershipReferences = <\n  S extends Table,\n  AC extends Table,\n  T extends Table,\n  O extends Table,\n  F extends Table,\n  G extends Table,\n  C extends Table,\n  H extends Table,\n  A extends Table,\n  D extends Table,\n  N,\n  J extends Table,\n>(\n  original: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, A, D, N, J>,\n): {\n  readonly connectedReferenceGuards: ReadonlyArray<OAuthReferenceGuardDescriptor<N>>;\n  readonly connectedReference: (input: {\n    readonly identityKey: string;\n    readonly subjectId: N;\n  }) => SQL;\n} =>\n  // The shared kernel returns this adapter's expressions; only compiler handles are erased.\n  oauthKernel.connectedReference.oauthConnectedOwnershipReferences(original) as {\n    readonly connectedReferenceGuards: ReadonlyArray<OAuthReferenceGuardDescriptor<N>>;\n    readonly connectedReference: (input: {\n      readonly identityKey: string;\n      readonly subjectId: N;\n    }) => SQL;\n  };\n"],"mappings":";;;AAOA,MAAa,qCAcX,aASA,YAAY,mBAAmB,kCAAkC,QAAQ"}