@yielded/auth-persistence-drizzle 0.1.0-beta.22 → 0.1.0-beta.24

package/dist/drizzle/oauth-model.d.mts

@@ -1,461 +1,58 @@
-import { PersistenceMappingError, SubjectIdCodec } from "./model.mjs";
-import { InferInsertModel, InferSelectModel, SQL, Table } from "drizzle-orm";
-import { Crypto, Effect, PlatformError } from "effect";
-import { AuthenticationRequirement, SecurityRevision } from "@yielded/auth/Sessions";
-import { OAuthAccountRevision, OAuthActionAuthorization, OAuthCredentialSnapshot, OAuthExternalIdentity, OAuthRegistrationIntent } from "@yielded/auth/OAuth";
-import { AuthenticationFactor } from "@yielded/auth/Operations";
+import { DrizzleTableModel } from "./table-model.mjs";
+import * as Shared from "@yielded/auth-persistence/Adapter";
+import { OAuthAction, OAuthD1Mapping, OAuthEligibilityFact, OAuthFlowState, OAuthRegistrationAuthority, OAuthRegistrationState, OAuthTupleState, requiredOAuthAccountsConstraints, requiredOAuthRegistrationConstraints, requiredOAuthSignInConstraints, requiredOAuthTupleConstraints } from "@yielded/auth-persistence/Adapter";
+import { SQL, Table } from "drizzle-orm";
 //#region src/drizzle/oauth-model.d.ts
-type Column<T extends Table> = Extract<keyof T["_"]["columns"], string>;
-export type OAuthFlowState = "Pending" | "Claimed" | "Verified" | "RegistrationIssued" | "Linked" | "Cancelled" | "Rejected" | "Ambiguous" | "Conflict";
-export type OAuthTupleState = "Unowned" | "Reserved" | "Owned";
-export type OAuthRegistrationState = "Unbound" | "Registered" | "ProvisioningPending" | "Rejected";
-export type OAuthAction = OAuthActionAuthorization["challenge"]["action"];
 /** The engine writes every critical column explicitly after applying the pure
  * consumer encoder. Native instant values must roundtrip without precision loss. */
-export interface OAuthClock {
-  readonly encodeInstant: (millis: number) => unknown;
-  readonly decodeInstant: (value: unknown) => number;
-  /** Actual engine wall clock sampled after locks, not transaction-start time.
-   * PostgreSQL uses clock_timestamp(), never now()/CURRENT_TIMESTAMP. D1 repeats
-   * its primary-engine sample bounds in final guards. Return integer milliseconds. */
-  readonly engineNowMillis: SQL;
-}
-export interface OAuthSubjectReadTable<S extends Table> {
-  readonly table: S;
-  readonly id: Column<S>;
-  readonly status: Column<S>;
-  readonly securityRevision: Column<S>;
-  readonly isActiveStatus: (value: unknown) => boolean;
-  readonly activeCondition: SQL;
-}
-export interface OAuthSubjectTable<S extends Table> extends OAuthSubjectReadTable<S> {
-  readonly decodeActionRequirement: (row: InferSelectModel<S>, action: OAuthAction) => AuthenticationRequirement;
-  readonly decodeAuthenticationRequirement: (row: InferSelectModel<S>) => AuthenticationRequirement;
-  readonly nextSecurityRevision: (current: SecurityRevision) => SecurityRevision;
-}
-export interface OAuthOwnershipReadTable<O extends Table, N> {
-  readonly table: O;
-  readonly identityKey: Column<O>;
-  readonly provider: Column<O>;
-  readonly issuer: Column<O>;
-  readonly externalSubject: Column<O>;
-  readonly subjectId: Column<O>;
-  /** Includes Owned state when authority and ownership share a physical table. */
-  readonly ownedCondition: SQL;
-  readonly decodeSubjectId: (row: InferSelectModel<O>) => N;
-}
-export interface OAuthOwnershipTable<O extends Table, N> extends OAuthOwnershipReadTable<O, N> {
-  readonly encodeInsert: (input: {
-    readonly identity: typeof OAuthExternalIdentity.Type;
-    readonly identityKey: string;
-    readonly subjectId: N;
-  }) => InferInsertModel<O>;
-}
-export interface OAuthCredentialReadTable<C extends Table> {
-  readonly table: C;
-  readonly moduleId: Column<C>;
-  readonly credentialId: Column<C>;
-  readonly subjectId: Column<C>;
-  readonly identityKey: Column<C>;
-  readonly credentialRevision: Column<C>;
-  readonly status: Column<C>;
-  readonly isActiveStatus: (value: unknown) => boolean;
-  readonly activeCondition: SQL;
-}
-export interface OAuthCredentialTable<C extends Table, N> extends OAuthCredentialReadTable<C> {
-  readonly encodeInsert: (input: {
-    readonly moduleId: string;
-    readonly subjectId: N;
-    readonly identityKey: string;
-    readonly credentialId: string;
-    readonly credentialRevision: SecurityRevision;
-  }) => InferInsertModel<C>;
-  /** This slice removes login rows. Historical records belong in separate audit storage. */
-  readonly removal: "delete";
-}
-export interface OAuthAuthorityReadTable<C extends Table> {
-  readonly table: C;
-  readonly subjectId: Column<C>;
-  readonly credentialId: Column<C>;
-  readonly revision: Column<C>;
-  readonly status: Column<C>;
-  readonly isActiveStatus: (value: unknown) => boolean;
-  readonly activeCondition: SQL;
-}
-export interface OAuthAuthorityTable<C extends Table, N> extends OAuthAuthorityReadTable<C> {
-  readonly encodeInsert: (input: {
-    readonly subjectId: N;
-    readonly credentialId: string;
-    readonly revision: SecurityRevision;
-  }) => InferInsertModel<C>;
-}
+export type OAuthClock = Shared.OAuthClock<SQL>;
+export type OAuthSubjectReadTable<S extends Table> = Shared.OAuthSubjectReadTable<DrizzleTableModel<S>, SQL>;
+export type OAuthSubjectTable<S extends Table> = Shared.OAuthSubjectTable<DrizzleTableModel<S>, SQL>;
+export type OAuthOwnershipReadTable<O extends Table, N> = Shared.OAuthOwnershipReadTable<DrizzleTableModel<O>, N, SQL>;
+export type OAuthOwnershipTable<O extends Table, N> = Shared.OAuthOwnershipTable<DrizzleTableModel<O>, N, SQL>;
+export type OAuthCredentialReadTable<C extends Table> = Shared.OAuthCredentialReadTable<DrizzleTableModel<C>, SQL>;
+export type OAuthCredentialTable<C extends Table, N> = Shared.OAuthCredentialTable<DrizzleTableModel<C>, N, SQL>;
+export type OAuthAuthorityReadTable<C extends Table> = Shared.OAuthAuthorityReadTable<DrizzleTableModel<C>, SQL>;
+export type OAuthAuthorityTable<C extends Table, N> = Shared.OAuthAuthorityTable<DrizzleTableModel<C>, N, SQL>;
 /** Both purposes may use the same physical table. Shared tables share module/flow
  * and module/command uniqueness. The snapshot has the exact purpose-specific core
  * codec; terminal writes erase it, while identity, claim and retention columns remain. */
-export interface OAuthFlowTable<F extends Table> {
-  readonly table: F;
-  readonly moduleId: Column<F>;
-  readonly flowId: Column<F>;
-  readonly commandId: Column<F>;
-  readonly purpose: Column<F>;
-  readonly generation: Column<F>;
-  readonly state: Column<F>;
-  readonly version: Column<F>;
-  readonly stateDigest: Column<F>;
-  readonly binderVerifier: Column<F>;
-  readonly binderExpiresAt: Column<F>;
-  readonly snapshot: Column<F>;
-  readonly issuedAt: Column<F>;
-  readonly expiresAt: Column<F>;
-  readonly claimId: Column<F>;
-  readonly claimedAt: Column<F>;
-  readonly claimExpiresAt: Column<F>;
-  readonly retentionUntil: Column<F>;
-  readonly encodeInsert: (input: {
-    readonly moduleId: string;
-    readonly flowId: string;
-    readonly purpose: "sign-in" | "link";
-  }) => InferInsertModel<F>;
-}
-export interface OAuthTupleAuthorityTable<T extends Table, N> {
-  readonly table: T;
-  readonly identityKey: Column<T>;
-  readonly provider: Column<T>;
-  readonly issuer: Column<T>;
-  readonly externalSubject: Column<T>;
-  readonly state: Column<T>;
-  readonly version: Column<T>;
-  readonly subjectId: Column<T>;
-  /** Exact reservation identity; no application payload or bearer. */
-  readonly reservation: Column<T>;
-  readonly encodeInsert: (input: {
-    readonly identityKey: string;
-    readonly identity: typeof OAuthExternalIdentity.Type;
-    readonly subjectId?: N;
-  }) => InferInsertModel<T>;
-}
-export interface OAuthRegistrationIntentTable<I extends Table> {
-  readonly table: I;
-  readonly moduleId: Column<I>;
-  readonly reference: Column<I>;
-  readonly flowId: Column<I>;
-  readonly claimId: Column<I>;
-  readonly identityKey: Column<I>;
-  readonly version: Column<I>;
-  readonly state: Column<I>;
-  readonly snapshot: Column<I>;
-  readonly commandId: Column<I>;
-  readonly fingerprint: Column<I>;
-  readonly pendingReference: Column<I>;
-  readonly expiresAt: Column<I>;
-  readonly retentionUntil: Column<I>;
-  readonly encodeInsert: (intent: OAuthRegistrationIntent) => InferInsertModel<I>;
-}
-export interface OAuthRegistrationCommandTable<R extends Table, Registration> {
-  readonly table: R;
-  readonly moduleId: Column<R>;
-  readonly commandId: Column<R>;
-  readonly reference: Column<R>;
-  readonly identityKey: Column<R>;
-  readonly fingerprint: Column<R>;
-  readonly intentSnapshot: Column<R>;
-  readonly applicationSnapshot: Column<R>;
-  readonly provisioningIdentity: Column<R>;
-  readonly decision: Column<R>;
-  readonly retentionUntil: Column<R>;
-  /** Persists exact detached Type before protected pending work can start. */
-  readonly encodeInsert: (input: {
-    readonly intent: OAuthRegistrationIntent;
-    readonly commandId: string;
-    readonly fingerprint: string;
-    readonly registration: Registration;
-    readonly provisioningIdentity: string;
-  }) => InferInsertModel<R>;
-}
-export interface OAuthUnlinkCommandTable<U extends Table> {
-  readonly table: U;
-  readonly moduleId: Column<U>;
-  readonly commandId: Column<U>;
-  readonly subjectId: Column<U>;
-  readonly credentialId: Column<U>;
-  readonly intentSnapshot: Column<U>;
-  readonly decision: Column<U>;
-  readonly retentionUntil: Column<U>;
-  readonly encodeInsert: (input: {
-    readonly moduleId: string;
-    readonly commandId: string;
-    readonly credential: OAuthCredentialSnapshot;
-  }) => InferInsertModel<U>;
-}
-export interface OAuthEligibilityFact {
-  readonly credentialId: string;
-  readonly revision: SecurityRevision;
-  readonly usablePrimary: boolean;
-  readonly factors: ReadonlyArray<AuthenticationFactor>;
-  readonly userVerified: boolean;
-  readonly phishingResistant: boolean;
-}
+export type OAuthFlowTable<F extends Table> = Shared.OAuthFlowTable<DrizzleTableModel<F>>;
+export type OAuthTupleAuthorityTable<T extends Table, N> = Shared.OAuthTupleAuthorityTable<DrizzleTableModel<T>, N>;
+export type OAuthRegistrationIntentTable<I extends Table> = Shared.OAuthRegistrationIntentTable<DrizzleTableModel<I>>;
+export type OAuthRegistrationCommandTable<R extends Table, Registration> = Shared.OAuthRegistrationCommandTable<DrizzleTableModel<R>, Registration>;
+export type OAuthUnlinkCommandTable<U extends Table> = Shared.OAuthUnlinkCommandTable<DrizzleTableModel<U>>;
 /** Each descriptor reads only its own subject-scoped method rows. The native row
  * projector and SQL condition must express the same installed method eligibility.
  * All source/identifier/policy mutations advance subject securityRevision. D1 also
  * guards exact selected IDs/versions and absence/count assumptions, never just a
  * stale boolean. An over-limit graph fails closed rather than truncating. */
-export interface OAuthEligibilityTable<T extends Table, N> {
-  readonly table: T;
-  readonly subjectId: Column<T>;
-  readonly credentialId: Column<T>;
-  readonly revision: Column<T>;
-  readonly scope: string;
-  readonly condition: (subjectId: N) => SQL;
-  readonly decode: (row: InferSelectModel<T>) => OAuthEligibilityFact | undefined;
-}
+export type OAuthEligibilityTable<T extends Table, N> = Shared.OAuthEligibilityTable<DrizzleTableModel<T>, N, SQL>;
 /** Authenticated command replay uses current subject status and this additional
  * nonconsuming SQL policy. It never consumes a fresh action factor. */
-export interface OAuthMetadataPolicy<N> {
-  readonly condition: (subjectId: N) => SQL;
-}
-export interface OAuthCleanupTable<T extends Table, N> {
-  readonly table: T;
-  readonly subjectId: Column<T>;
-  /** Bound to this subject's old revision; no opaque independently committing service. */
-  readonly condition: (input: {
-    readonly subjectId: N;
-    readonly revision: OAuthAccountRevision;
-    readonly removedCredentialId?: string;
-  }) => SQL;
-  readonly disposition: "delete";
-}
-export interface OAuthRegistrationEligibility<N> {
-  /** Pure SQL guards for mutable app policy; evaluated again after app writes. */
-  readonly condition: (input: {
-    readonly intent: OAuthRegistrationIntent;
-    readonly nativeSubjectId?: N;
-  }) => SQL;
-}
-export interface OAuthD1Mapping {
-  readonly d1: {
-    readonly primary: true;
-  };
-}
-export declare const requiredOAuthSignInConstraints: {
-  readonly flow: "unique(flow.moduleId,flow.flowId)";
-  readonly command: "unique(flow.moduleId,flow.commandId)";
-  readonly stateDigest: "unique(flow.stateDigest)";
-  readonly ownership: "unique(ownership.identityKey)";
-  readonly credentialId: "unique(credential.credentialId)";
-  readonly credentialIdentity: "unique(credential.identityKey)";
-  readonly authorityCredential: "unique(authority.subjectId,authority.credentialId)";
-};
-export declare const requiredOAuthTupleConstraints: {
-  readonly identityKey: "unique(tuple.identityKey)";
-};
-export declare const requiredOAuthRegistrationConstraints: {
-  readonly intentReference: "unique(intent.moduleId,intent.reference)";
-  readonly intentFlow: "unique(intent.moduleId,intent.flowId)";
-  readonly command: "unique(registrationCommand.moduleId,registrationCommand.commandId)";
-};
-export declare const requiredOAuthAccountsConstraints: {
-  readonly unlinkCommand: "unique(unlinkCommand.moduleId,unlinkCommand.commandId)";
-};
-export interface OAuthSignInMapping<S extends Table, O extends Table, C extends Table, AC extends Table, F extends Table, N> {
-  readonly subject: OAuthSubjectReadTable<S>;
-  readonly ownership: OAuthOwnershipReadTable<O, N>;
-  readonly credential: OAuthCredentialReadTable<C>;
-  readonly authority: OAuthAuthorityReadTable<AC>;
-  readonly flow: OAuthFlowTable<F>;
-  readonly subjectId: SubjectIdCodec<N>;
-  readonly clock: OAuthClock;
-  readonly constraints: typeof requiredOAuthSignInConstraints;
-}
-export type OAuthOwnershipMutation<T extends Table, O extends Table, N> = {
-  readonly mode: "integrated";
-  readonly tuple: OAuthTupleAuthorityTable<T, N>;
-} | {
-  readonly mode: "separate";
-  readonly tuple: OAuthTupleAuthorityTable<T, N>;
-  readonly external: OAuthOwnershipTable<O, N>;
-};
-export interface OAuthRegistrationIntentMapping<S extends Table, O extends Table, C extends Table, AC extends Table, F extends Table, T extends Table, I extends Table, N> {
-  readonly signIn: OAuthSignInMapping<S, O, C, AC, F, N>;
-  readonly ownership: OAuthOwnershipMutation<T, O, N>;
-  readonly intent: OAuthRegistrationIntentTable<I>;
-  readonly tupleConstraints: typeof requiredOAuthTupleConstraints;
-  readonly registrationConstraints: Pick<typeof requiredOAuthRegistrationConstraints, "intentReference" | "intentFlow">;
-  readonly eligibility: OAuthRegistrationEligibility<N>;
-}
-export interface OAuthRegistrationBase<Registration, T extends Table, O extends Table, I extends Table, R extends Table, N> {
-  readonly ownership: OAuthOwnershipMutation<T, O, N>;
-  readonly intent: OAuthRegistrationIntentTable<I>;
-  readonly command: OAuthRegistrationCommandTable<R, Registration>;
-  readonly clock: OAuthClock;
-  readonly tupleConstraints: typeof requiredOAuthTupleConstraints;
-  readonly constraints: typeof requiredOAuthRegistrationConstraints;
-  readonly inspect: (input: {
-    readonly intent: OAuthRegistrationIntent;
-    readonly registration: Registration;
-  }) => Effect.Effect<{
-    readonly fingerprint: string;
-    readonly eligible: boolean;
-  }, PersistenceMappingError>;
-  /** Required for an explicitly bound native/DO command: no asynchronous callback
-   * is evaluated inside the physical owner. Standalone inspection is pre-owner. */
-  readonly inspectSync?: (input: {
-    readonly intent: OAuthRegistrationIntent;
-    readonly registration: Registration;
-  }) => {
-    readonly fingerprint: string;
-    readonly eligible: boolean;
-  };
-  /** Type projection, never the original wire transformation. */
-  readonly snapshot: (registration: Registration) => Effect.Effect<Registration, PersistenceMappingError>;
-  readonly snapshotSync?: (registration: Registration) => Registration;
-  /** Canonical bounded storage of Registration.Type. These are Type codecs, not
-   * the original wire decoder/encoder; decode(encode(value)) must encode identically.
-   * The engine writes and roundtrip-checks this exact string (maximum 1 MiB). */
-  readonly application: {
-    readonly encode: (registration: Registration) => string;
-    readonly decode: (stored: string) => Registration;
-  };
-  readonly eligibility: {
-    /** Stable application authority anchors, in one configured global order.
-     * Omit only for immutable/tuple-local policy or an equivalent explicit outer
-     * owner lock. Each scope must match 1..64 rows, never an absent quota row.
-     * Locks precede tuple/intent/command locks; postcondition owns changed state. */
-    readonly guards?: ReadonlyArray<OAuthRegistrationGuardDescriptor<Registration, N>>;
-    readonly admission: (input: {
-      readonly intent: OAuthRegistrationIntent;
-      readonly registration: Registration;
-      readonly nativeSubjectId?: N;
-    }) => SQL;
-    /** Evaluated after subject/application writes, including appended coordinator
-     * writes. May assert consumption of the admission invitation/quota. */
-    readonly postcondition: (input: {
-      readonly intent: OAuthRegistrationIntent;
-      readonly registration: Registration;
-      readonly nativeSubjectId?: N;
-    }) => SQL;
-  };
-  readonly allocateProvisioningIdentity: Effect.Effect<string, PersistenceMappingError>;
-  readonly retentionMillis: number;
-}
-export interface OAuthRegistrationGuardTable<T extends Table, Registration, N> {
-  readonly table: T;
-  readonly orderBy: Column<T>;
-  readonly condition: (input: {
-    readonly intent: OAuthRegistrationIntent;
-    readonly registration: Registration;
-    readonly nativeSubjectId?: N;
-  }) => SQL;
-}
-export interface OAuthRegistrationGuardDescriptor<Registration, N> {
-  readonly table: Table;
-  readonly orderBy: string;
-  readonly condition: OAuthRegistrationGuardTable<Table, Registration, N>["condition"];
-}
+export type OAuthMetadataPolicy<N> = Shared.OAuthMetadataPolicy<N, SQL>;
+export type OAuthCleanupTable<T extends Table, N> = Shared.OAuthCleanupTable<DrizzleTableModel<T>, N, SQL>;
+export type OAuthRegistrationEligibility<N> = Shared.OAuthRegistrationEligibility<N, SQL>;
+export type OAuthSignInMapping<S extends Table, O extends Table, C extends Table, AC extends Table, F extends Table, N> = Shared.OAuthSignInMapping<DrizzleTableModel<S>, DrizzleTableModel<O>, DrizzleTableModel<C>, DrizzleTableModel<AC>, DrizzleTableModel<F>, N, SQL>;
+export type OAuthOwnershipMutation<T extends Table, O extends Table, N> = Shared.OAuthOwnershipMutation<DrizzleTableModel<T>, DrizzleTableModel<O>, N, SQL>;
+export type OAuthRegistrationIntentMapping<S extends Table, O extends Table, C extends Table, AC extends Table, F extends Table, T extends Table, I extends Table, N> = Shared.OAuthRegistrationIntentMapping<DrizzleTableModel<S>, DrizzleTableModel<O>, DrizzleTableModel<C>, DrizzleTableModel<AC>, DrizzleTableModel<F>, DrizzleTableModel<T>, DrizzleTableModel<I>, N, SQL>;
+export type OAuthRegistrationBase<Registration, T extends Table, O extends Table, I extends Table, R extends Table, N> = Shared.OAuthRegistrationBase<Registration, DrizzleTableModel<T>, DrizzleTableModel<O>, DrizzleTableModel<I>, DrizzleTableModel<R>, N, SQL, Table>;
+export type OAuthRegistrationGuardTable<T extends Table, Registration, N> = Shared.OAuthRegistrationGuardTable<DrizzleTableModel<T>, Registration, N, SQL>;
+export type OAuthRegistrationGuardDescriptor<Registration, N> = Shared.OAuthRegistrationGuardDescriptor<Registration, N, SQL, Table>;
 export declare const oauthRegistrationGuardTable: <T extends Table, Registration, N>(input: OAuthRegistrationGuardTable<T, Registration, N>) => OAuthRegistrationGuardDescriptor<Registration, N>;
-export type OAuthRegistrationMapping<Registration, S extends Table, O extends Table, C extends Table, AC extends Table, T extends Table, I extends Table, R extends Table, N> = OAuthRegistrationBase<Registration, T, O, I, R, N> & ({
-  readonly mode: "pending";
-  readonly allocatePendingReference: Effect.Effect<string, PersistenceMappingError>;
-} | {
-  readonly mode: "atomic";
-  readonly subjectId: SubjectIdCodec<N>;
-  readonly subject: OAuthSubjectReadTable<S>;
-  readonly credential: OAuthCredentialTable<C, N>;
-  readonly authority: OAuthAuthorityTable<AC, N>;
-  readonly allocateSubjectId: Effect.Effect<N, PersistenceMappingError>;
-  readonly allocateCredentialId: Effect.Effect<string, PersistenceMappingError>;
-  readonly allocateRevision: Effect.Effect<SecurityRevision, PersistenceMappingError>;
-  readonly encodeSubjectInsert: (input: {
-    readonly intent: OAuthRegistrationIntent;
-    readonly registration: Registration;
-  }, ids: {
-    readonly subjectId: N;
-    readonly securityRevision: SecurityRevision;
-  }) => InferInsertModel<S>;
-});
+export type OAuthRegistrationMapping<Registration, S extends Table, O extends Table, C extends Table, AC extends Table, T extends Table, I extends Table, R extends Table, N> = Shared.OAuthRegistrationMapping<Registration, DrizzleTableModel<S>, DrizzleTableModel<O>, DrizzleTableModel<C>, DrizzleTableModel<AC>, DrizzleTableModel<T>, DrizzleTableModel<I>, DrizzleTableModel<R>, N, SQL, Table>;
 /** Heterogeneous descriptors are made by typed factories and projected privately. */
-export interface OAuthEligibilityDescriptor<N> {
-  readonly _tag: "OAuthEligibilityDescriptor";
-  readonly scope: string;
-  readonly table: Table;
-  readonly subjectId: string;
-  readonly credentialId: string;
-  readonly revision: string;
-  readonly condition: (subjectId: N) => SQL;
-  readonly decode: (row: unknown) => OAuthEligibilityFact | undefined;
-}
+export type OAuthEligibilityDescriptor<N> = Shared.OAuthEligibilityDescriptor<N, SQL, Table>;
 export declare const oauthEligibilityTable: <T extends Table, N>(input: OAuthEligibilityTable<T, N>) => OAuthEligibilityDescriptor<N>;
-export interface OAuthCleanupDescriptor<N> {
-  readonly table: Table;
-  readonly subjectId: string;
-  readonly condition: OAuthCleanupTable<Table, N>["condition"];
-}
+export type OAuthCleanupDescriptor<N> = Shared.OAuthCleanupDescriptor<N, SQL, Table>;
 export declare const oauthCleanupTable: <T extends Table, N>(input: OAuthCleanupTable<T, N>) => OAuthCleanupDescriptor<N>;
 /** A stable application/reference lock acquired before an ownership target.
  * Missing rows retain ownership. Conditions use detached native IDs; every
  * writer of the guarded reference follows the same order. */
-export interface OAuthReferenceGuardTable<T extends Table, N> {
-  readonly table: T;
-  readonly orderBy: Column<T>;
-  readonly condition: (input: {
-    readonly identity: typeof OAuthExternalIdentity.Type;
-    readonly identityKey: string;
-    readonly subjectId: N;
-  }) => SQL | Effect.Effect<SQL, PlatformError.PlatformError, Crypto.Crypto>;
-}
-export interface OAuthReferenceGuardDescriptor<N> {
-  readonly table: Table;
-  readonly orderBy: string;
-  readonly condition: OAuthReferenceGuardTable<Table, N>["condition"];
-}
+export type OAuthReferenceGuardTable<T extends Table, N> = Shared.OAuthReferenceGuardTable<DrizzleTableModel<T>, N, SQL>;
+export type OAuthReferenceGuardDescriptor<N> = Shared.OAuthReferenceGuardDescriptor<N, SQL, Table>;
 export declare const oauthReferenceGuardTable: <T extends Table, N>(input: OAuthReferenceGuardTable<T, N>) => OAuthReferenceGuardDescriptor<N>;
-export interface OAuthAccountsMapping<S extends Table, O extends Table, C extends Table, AC extends Table, F extends Table, T extends Table, U extends Table, N> {
-  readonly subject: OAuthSubjectTable<S>;
-  readonly ownership: OAuthOwnershipMutation<T, O, N>;
-  readonly credential: OAuthCredentialTable<C, N>;
-  readonly authority: OAuthAuthorityTable<AC, N>;
-  readonly flow: OAuthFlowTable<F>;
-  readonly command: OAuthUnlinkCommandTable<U>;
-  readonly subjectId: SubjectIdCodec<N>;
-  readonly clock: OAuthClock;
-  readonly constraints: typeof requiredOAuthSignInConstraints & typeof requiredOAuthAccountsConstraints;
-  readonly tupleConstraints: typeof requiredOAuthTupleConstraints;
-  readonly eligibility: ReadonlyArray<OAuthEligibilityDescriptor<N>>;
-  readonly cleanup: ReadonlyArray<OAuthCleanupDescriptor<N>>;
-  readonly metadata: OAuthMetadataPolicy<N>;
-  readonly sessionInvalidation: "same-authority-immediate" | "original-absolute-expiry";
-  /** Omit only when connected access is absent. A predicate alone conservatively
-   * retains ownership; release also needs all configured guard rows below. */
-  readonly connectedReference?: (input: {
-    readonly identityKey: string;
-    readonly subjectId: N;
-  }) => SQL;
-  /** At most 32 descriptors, each locking 1..64 stable rows in supplied order.
-   * Missing/empty guards retain Owned, even when the reference predicate is false. */
-  readonly connectedReferenceGuards?: ReadonlyArray<OAuthReferenceGuardDescriptor<N>>;
-  readonly allocateCredentialId: Effect.Effect<string, PersistenceMappingError>;
-  readonly allocateRevision: Effect.Effect<SecurityRevision, PersistenceMappingError>;
-}
-export interface OAuthRegistrationAuthority<Registration> {
-  readonly read: (access: import("@yielded/auth/OAuth").OAuthRegistrationAccess) => Effect.Effect<import("@yielded/auth/OAuth").OAuthRegistrationInspection | undefined, import("@yielded/auth/OAuth").OAuthUnavailable>;
-  readonly inspect: (input: {
-    readonly intent: OAuthRegistrationIntent;
-    readonly registration: Registration;
-  }) => Effect.Effect<{
-    readonly fingerprint: import("@yielded/auth/Schema").TokenDigest;
-    readonly eligible: boolean;
-  }, import("@yielded/auth/OAuth").OAuthUnavailable>;
-  readonly register: <A>(input: {
-    readonly access: import("@yielded/auth/OAuth").OAuthRegistrationAccess;
-    readonly intent: OAuthRegistrationIntent;
-    readonly commandId: typeof import("@yielded/auth/OAuth").OAuthCommandId.Type;
-    readonly registration: Registration;
-    readonly fingerprint: import("@yielded/auth/Schema").TokenDigest;
-  }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<import("@yielded/auth/OAuth").OAuthRegistrationDecision, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
-  readonly cleanup: <A>(input: import("@yielded/auth/OAuth").OAuthCleanupInput, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
-    readonly removed: number;
-    readonly hasMore: boolean;
-  }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
-}
+export type OAuthAccountsMapping<S extends Table, O extends Table, C extends Table, AC extends Table, F extends Table, T extends Table, U extends Table, N> = Shared.OAuthAccountsMapping<DrizzleTableModel<S>, DrizzleTableModel<O>, DrizzleTableModel<C>, DrizzleTableModel<AC>, DrizzleTableModel<F>, DrizzleTableModel<T>, DrizzleTableModel<U>, N, SQL, Table>;
 //#endregion
+export { type OAuthAction, type OAuthD1Mapping, type OAuthEligibilityFact, type OAuthFlowState, type OAuthRegistrationAuthority, type OAuthRegistrationState, type OAuthTupleState, requiredOAuthAccountsConstraints, requiredOAuthRegistrationConstraints, requiredOAuthSignInConstraints, requiredOAuthTupleConstraints };
 //# sourceMappingURL=oauth-model.d.mts.map

package/dist/drizzle/oauth-model.mjs

@@ -1,48 +1,10 @@
+import * as Shared from "@yielded/auth-persistence/Adapter";
+import { requiredOAuthAccountsConstraints, requiredOAuthRegistrationConstraints, requiredOAuthSignInConstraints, requiredOAuthTupleConstraints } from "@yielded/auth-persistence/Adapter";
 //#region src/drizzle/oauth-model.ts
-const requiredOAuthSignInConstraints = {
-	flow: "unique(flow.moduleId,flow.flowId)",
-	command: "unique(flow.moduleId,flow.commandId)",
-	stateDigest: "unique(flow.stateDigest)",
-	ownership: "unique(ownership.identityKey)",
-	credentialId: "unique(credential.credentialId)",
-	credentialIdentity: "unique(credential.identityKey)",
-	authorityCredential: "unique(authority.subjectId,authority.credentialId)"
-};
-const requiredOAuthTupleConstraints = { identityKey: "unique(tuple.identityKey)" };
-const requiredOAuthRegistrationConstraints = {
-	intentReference: "unique(intent.moduleId,intent.reference)",
-	intentFlow: "unique(intent.moduleId,intent.flowId)",
-	command: "unique(registrationCommand.moduleId,registrationCommand.commandId)"
-};
-const requiredOAuthAccountsConstraints = { unlinkCommand: "unique(unlinkCommand.moduleId,unlinkCommand.commandId)" };
-const oauthRegistrationGuardTable = (input) => Object.freeze({
-	table: input.table,
-	orderBy: input.orderBy,
-	condition: input.condition
-});
-const oauthEligibilityTable = (input) => {
-	const { table, subjectId, credentialId, revision, scope, condition, decode } = input;
-	return Object.freeze({
-		_tag: "OAuthEligibilityDescriptor",
-		table,
-		subjectId,
-		credentialId,
-		revision,
-		scope,
-		condition,
-		decode: (row) => decode(row)
-	});
-};
-const oauthCleanupTable = (input) => Object.freeze({
-	table: input.table,
-	subjectId: input.subjectId,
-	condition: input.condition
-});
-const oauthReferenceGuardTable = (input) => Object.freeze({
-	table: input.table,
-	orderBy: input.orderBy,
-	condition: input.condition
-});
+const oauthRegistrationGuardTable = (input) => Shared.oauthRegistrationGuardTable(input);
+const oauthEligibilityTable = (input) => Shared.oauthEligibilityTable(input);
+const oauthCleanupTable = (input) => Shared.oauthCleanupTable(input);
+const oauthReferenceGuardTable = (input) => Shared.oauthReferenceGuardTable(input);
 //#endregion
 export { oauthCleanupTable, oauthEligibilityTable, oauthReferenceGuardTable, oauthRegistrationGuardTable, requiredOAuthAccountsConstraints, requiredOAuthRegistrationConstraints, requiredOAuthSignInConstraints, requiredOAuthTupleConstraints };
 

package/dist/drizzle/oauth-model.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-model.mjs","names":[],"sources":["../../src/drizzle/oauth-model.ts"],"sourcesContent":["import type {\n  OAuthActionAuthorization,\n  OAuthAccountRevision,\n  OAuthRegistrationIntent,\n  OAuthCredentialSnapshot,\n  OAuthExternalIdentity,\n} from \"@yielded/auth/OAuth\";\nimport type { AuthenticationFactor } from \"@yielded/auth/Operations\";\nimport type { AuthenticationRequirement, SecurityRevision } from \"@yielded/auth/Sessions\";\nimport type { InferInsertModel, InferSelectModel, SQL, Table } from \"drizzle-orm\";\nimport type { Crypto, Effect, PlatformError } from \"effect\";\n\nimport type { PersistenceMappingError, SubjectIdCodec } from \"./model\";\n\ntype Column<T extends Table> = Extract<keyof T[\"_\"][\"columns\"], string>;\n\nexport type OAuthFlowState =\n  | \"Pending\"\n  | \"Claimed\"\n  | \"Verified\"\n  | \"RegistrationIssued\"\n  | \"Linked\"\n  | \"Cancelled\"\n  | \"Rejected\"\n  | \"Ambiguous\"\n  | \"Conflict\";\n\nexport type OAuthTupleState = \"Unowned\" | \"Reserved\" | \"Owned\";\nexport type OAuthRegistrationState = \"Unbound\" | \"Registered\" | \"ProvisioningPending\" | \"Rejected\";\nexport type OAuthAction = OAuthActionAuthorization[\"challenge\"][\"action\"];\n\n/** The engine writes every critical column explicitly after applying the pure\n * consumer encoder. Native instant values must roundtrip without precision loss. */\nexport interface OAuthClock {\n  readonly encodeInstant: (millis: number) => unknown;\n  readonly decodeInstant: (value: unknown) => number;\n  /** Actual engine wall clock sampled after locks, not transaction-start time.\n   * PostgreSQL uses clock_timestamp(), never now()/CURRENT_TIMESTAMP. D1 repeats\n   * its primary-engine sample bounds in final guards. Return integer milliseconds. */\n  readonly engineNowMillis: SQL;\n}\n\nexport interface OAuthSubjectReadTable<S extends Table> {\n  readonly table: S;\n  readonly id: Column<S>;\n  readonly status: Column<S>;\n  readonly securityRevision: Column<S>;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly activeCondition: SQL;\n}\n\nexport interface OAuthSubjectTable<S extends Table> extends OAuthSubjectReadTable<S> {\n  readonly decodeActionRequirement: (\n    row: InferSelectModel<S>,\n    action: OAuthAction,\n  ) => AuthenticationRequirement;\n  readonly decodeAuthenticationRequirement: (row: InferSelectModel<S>) => AuthenticationRequirement;\n  readonly nextSecurityRevision: (current: SecurityRevision) => SecurityRevision;\n}\n\nexport interface OAuthOwnershipReadTable<O extends Table, N> {\n  readonly table: O;\n  readonly identityKey: Column<O>;\n  readonly provider: Column<O>;\n  readonly issuer: Column<O>;\n  readonly externalSubject: Column<O>;\n  readonly subjectId: Column<O>;\n  /** Includes Owned state when authority and ownership share a physical table. */\n  readonly ownedCondition: SQL;\n  readonly decodeSubjectId: (row: InferSelectModel<O>) => N;\n}\n\nexport interface OAuthOwnershipTable<O extends Table, N> extends OAuthOwnershipReadTable<O, N> {\n  readonly encodeInsert: (input: {\n    readonly identity: typeof OAuthExternalIdentity.Type;\n    readonly identityKey: string;\n    readonly subjectId: N;\n  }) => InferInsertModel<O>;\n}\n\nexport interface OAuthCredentialReadTable<C extends Table> {\n  readonly table: C;\n  readonly moduleId: Column<C>;\n  readonly credentialId: Column<C>;\n  readonly subjectId: Column<C>;\n  readonly identityKey: Column<C>;\n  readonly credentialRevision: Column<C>;\n  readonly status: Column<C>;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly activeCondition: SQL;\n}\n\nexport interface OAuthCredentialTable<C extends Table, N> extends OAuthCredentialReadTable<C> {\n  readonly encodeInsert: (input: {\n    readonly moduleId: string;\n    readonly subjectId: N;\n    readonly identityKey: string;\n    readonly credentialId: string;\n    readonly credentialRevision: SecurityRevision;\n  }) => InferInsertModel<C>;\n  /** This slice removes login rows. Historical records belong in separate audit storage. */\n  readonly removal: \"delete\";\n}\n\nexport interface OAuthAuthorityReadTable<C extends Table> {\n  readonly table: C;\n  readonly subjectId: Column<C>;\n  readonly credentialId: Column<C>;\n  readonly revision: Column<C>;\n  readonly status: Column<C>;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly activeCondition: SQL;\n}\n\nexport interface OAuthAuthorityTable<C extends Table, N> extends OAuthAuthorityReadTable<C> {\n  readonly encodeInsert: (input: {\n    readonly subjectId: N;\n    readonly credentialId: string;\n    readonly revision: SecurityRevision;\n  }) => InferInsertModel<C>;\n}\n\n/** Both purposes may use the same physical table. Shared tables share module/flow\n * and module/command uniqueness. The snapshot has the exact purpose-specific core\n * codec; terminal writes erase it, while identity, claim and retention columns remain. */\nexport interface OAuthFlowTable<F extends Table> {\n  readonly table: F;\n  readonly moduleId: Column<F>;\n  readonly flowId: Column<F>;\n  readonly commandId: Column<F>;\n  readonly purpose: Column<F>;\n  readonly generation: Column<F>;\n  readonly state: Column<F>;\n  readonly version: Column<F>;\n  readonly stateDigest: Column<F>;\n  readonly binderVerifier: Column<F>;\n  readonly binderExpiresAt: Column<F>;\n  readonly snapshot: Column<F>;\n  readonly issuedAt: Column<F>;\n  readonly expiresAt: Column<F>;\n  readonly claimId: Column<F>;\n  readonly claimedAt: Column<F>;\n  readonly claimExpiresAt: Column<F>;\n  readonly retentionUntil: Column<F>;\n  readonly encodeInsert: (input: {\n    readonly moduleId: string;\n    readonly flowId: string;\n    readonly purpose: \"sign-in\" | \"link\";\n  }) => InferInsertModel<F>;\n}\n\nexport interface OAuthTupleAuthorityTable<T extends Table, N> {\n  readonly table: T;\n  readonly identityKey: Column<T>;\n  readonly provider: Column<T>;\n  readonly issuer: Column<T>;\n  readonly externalSubject: Column<T>;\n  readonly state: Column<T>;\n  readonly version: Column<T>;\n  readonly subjectId: Column<T>;\n  /** Exact reservation identity; no application payload or bearer. */\n  readonly reservation: Column<T>;\n  readonly encodeInsert: (input: {\n    readonly identityKey: string;\n    readonly identity: typeof OAuthExternalIdentity.Type;\n    readonly subjectId?: N;\n  }) => InferInsertModel<T>;\n}\n\nexport interface OAuthRegistrationIntentTable<I extends Table> {\n  readonly table: I;\n  readonly moduleId: Column<I>;\n  readonly reference: Column<I>;\n  readonly flowId: Column<I>;\n  readonly claimId: Column<I>;\n  readonly identityKey: Column<I>;\n  readonly version: Column<I>;\n  readonly state: Column<I>;\n  readonly snapshot: Column<I>;\n  readonly commandId: Column<I>;\n  readonly fingerprint: Column<I>;\n  readonly pendingReference: Column<I>;\n  readonly expiresAt: Column<I>;\n  readonly retentionUntil: Column<I>;\n  readonly encodeInsert: (intent: OAuthRegistrationIntent) => InferInsertModel<I>;\n}\n\nexport interface OAuthRegistrationCommandTable<R extends Table, Registration> {\n  readonly table: R;\n  readonly moduleId: Column<R>;\n  readonly commandId: Column<R>;\n  readonly reference: Column<R>;\n  readonly identityKey: Column<R>;\n  readonly fingerprint: Column<R>;\n  readonly intentSnapshot: Column<R>;\n  readonly applicationSnapshot: Column<R>;\n  readonly provisioningIdentity: Column<R>;\n  readonly decision: Column<R>;\n  readonly retentionUntil: Column<R>;\n  /** Persists exact detached Type before protected pending work can start. */\n  readonly encodeInsert: (input: {\n    readonly intent: OAuthRegistrationIntent;\n    readonly commandId: string;\n    readonly fingerprint: string;\n    readonly registration: Registration;\n    readonly provisioningIdentity: string;\n  }) => InferInsertModel<R>;\n}\n\nexport interface OAuthUnlinkCommandTable<U extends Table> {\n  readonly table: U;\n  readonly moduleId: Column<U>;\n  readonly commandId: Column<U>;\n  readonly subjectId: Column<U>;\n  readonly credentialId: Column<U>;\n  readonly intentSnapshot: Column<U>;\n  readonly decision: Column<U>;\n  readonly retentionUntil: Column<U>;\n  readonly encodeInsert: (input: {\n    readonly moduleId: string;\n    readonly commandId: string;\n    readonly credential: OAuthCredentialSnapshot;\n  }) => InferInsertModel<U>;\n}\n\nexport interface OAuthEligibilityFact {\n  readonly credentialId: string;\n  readonly revision: SecurityRevision;\n  readonly usablePrimary: boolean;\n  readonly factors: ReadonlyArray<AuthenticationFactor>;\n  readonly userVerified: boolean;\n  readonly phishingResistant: boolean;\n}\n\n/** Each descriptor reads only its own subject-scoped method rows. The native row\n * projector and SQL condition must express the same installed method eligibility.\n * All source/identifier/policy mutations advance subject securityRevision. D1 also\n * guards exact selected IDs/versions and absence/count assumptions, never just a\n * stale boolean. An over-limit graph fails closed rather than truncating. */\nexport interface OAuthEligibilityTable<T extends Table, N> {\n  readonly table: T;\n  readonly subjectId: Column<T>;\n  readonly credentialId: Column<T>;\n  readonly revision: Column<T>;\n  readonly scope: string;\n  readonly condition: (subjectId: N) => SQL;\n  readonly decode: (row: InferSelectModel<T>) => OAuthEligibilityFact | undefined;\n}\n\n/** Authenticated command replay uses current subject status and this additional\n * nonconsuming SQL policy. It never consumes a fresh action factor. */\nexport interface OAuthMetadataPolicy<N> {\n  readonly condition: (subjectId: N) => SQL;\n}\n\nexport interface OAuthCleanupTable<T extends Table, N> {\n  readonly table: T;\n  readonly subjectId: Column<T>;\n  /** Bound to this subject's old revision; no opaque independently committing service. */\n  readonly condition: (input: {\n    readonly subjectId: N;\n    readonly revision: OAuthAccountRevision;\n    readonly removedCredentialId?: string;\n  }) => SQL;\n  readonly disposition: \"delete\";\n}\n\nexport interface OAuthRegistrationEligibility<N> {\n  /** Pure SQL guards for mutable app policy; evaluated again after app writes. */\n  readonly condition: (input: {\n    readonly intent: OAuthRegistrationIntent;\n    readonly nativeSubjectId?: N;\n  }) => SQL;\n}\n\nexport interface OAuthD1Mapping {\n  readonly d1: { readonly primary: true };\n}\n\nexport const requiredOAuthSignInConstraints = {\n  flow: \"unique(flow.moduleId,flow.flowId)\",\n  command: \"unique(flow.moduleId,flow.commandId)\",\n  stateDigest: \"unique(flow.stateDigest)\",\n  ownership: \"unique(ownership.identityKey)\",\n  credentialId: \"unique(credential.credentialId)\",\n  credentialIdentity: \"unique(credential.identityKey)\",\n  authorityCredential: \"unique(authority.subjectId,authority.credentialId)\",\n} as const;\n\nexport const requiredOAuthTupleConstraints = { identityKey: \"unique(tuple.identityKey)\" } as const;\n\nexport const requiredOAuthRegistrationConstraints = {\n  intentReference: \"unique(intent.moduleId,intent.reference)\",\n  intentFlow: \"unique(intent.moduleId,intent.flowId)\",\n  command: \"unique(registrationCommand.moduleId,registrationCommand.commandId)\",\n} as const;\n\nexport const requiredOAuthAccountsConstraints = {\n  unlinkCommand: \"unique(unlinkCommand.moduleId,unlinkCommand.commandId)\",\n} as const;\n\nexport interface OAuthSignInMapping<\n  S extends Table,\n  O extends Table,\n  C extends Table,\n  AC extends Table,\n  F extends Table,\n  N,\n> {\n  readonly subject: OAuthSubjectReadTable<S>;\n  readonly ownership: OAuthOwnershipReadTable<O, N>;\n  readonly credential: OAuthCredentialReadTable<C>;\n  readonly authority: OAuthAuthorityReadTable<AC>;\n  readonly flow: OAuthFlowTable<F>;\n  readonly subjectId: SubjectIdCodec<N>;\n  readonly clock: OAuthClock;\n  readonly constraints: typeof requiredOAuthSignInConstraints;\n}\n\nexport type OAuthOwnershipMutation<T extends Table, O extends Table, N> =\n  | { readonly mode: \"integrated\"; readonly tuple: OAuthTupleAuthorityTable<T, N> }\n  | {\n      readonly mode: \"separate\";\n      readonly tuple: OAuthTupleAuthorityTable<T, N>;\n      readonly external: OAuthOwnershipTable<O, N>;\n    };\n\nexport interface OAuthRegistrationIntentMapping<\n  S extends Table,\n  O extends Table,\n  C extends Table,\n  AC extends Table,\n  F extends Table,\n  T extends Table,\n  I extends Table,\n  N,\n> {\n  readonly signIn: OAuthSignInMapping<S, O, C, AC, F, N>;\n  readonly ownership: OAuthOwnershipMutation<T, O, N>;\n  readonly intent: OAuthRegistrationIntentTable<I>;\n  readonly tupleConstraints: typeof requiredOAuthTupleConstraints;\n  readonly registrationConstraints: Pick<\n    typeof requiredOAuthRegistrationConstraints,\n    \"intentReference\" | \"intentFlow\"\n  >;\n  readonly eligibility: OAuthRegistrationEligibility<N>;\n}\n\nexport interface OAuthRegistrationBase<\n  Registration,\n  T extends Table,\n  O extends Table,\n  I extends Table,\n  R extends Table,\n  N,\n> {\n  readonly ownership: OAuthOwnershipMutation<T, O, N>;\n  readonly intent: OAuthRegistrationIntentTable<I>;\n  readonly command: OAuthRegistrationCommandTable<R, Registration>;\n  readonly clock: OAuthClock;\n  readonly tupleConstraints: typeof requiredOAuthTupleConstraints;\n  readonly constraints: typeof requiredOAuthRegistrationConstraints;\n  readonly inspect: (input: {\n    readonly intent: OAuthRegistrationIntent;\n    readonly registration: Registration;\n  }) => Effect.Effect<\n    { readonly fingerprint: string; readonly eligible: boolean },\n    PersistenceMappingError\n  >;\n  /** Required for an explicitly bound native/DO command: no asynchronous callback\n   * is evaluated inside the physical owner. Standalone inspection is pre-owner. */\n  readonly inspectSync?: (input: {\n    readonly intent: OAuthRegistrationIntent;\n    readonly registration: Registration;\n  }) => { readonly fingerprint: string; readonly eligible: boolean };\n  /** Type projection, never the original wire transformation. */\n  readonly snapshot: (\n    registration: Registration,\n  ) => Effect.Effect<Registration, PersistenceMappingError>;\n  readonly snapshotSync?: (registration: Registration) => Registration;\n  /** Canonical bounded storage of Registration.Type. These are Type codecs, not\n   * the original wire decoder/encoder; decode(encode(value)) must encode identically.\n   * The engine writes and roundtrip-checks this exact string (maximum 1 MiB). */\n  readonly application: {\n    readonly encode: (registration: Registration) => string;\n    readonly decode: (stored: string) => Registration;\n  };\n  readonly eligibility: {\n    /** Stable application authority anchors, in one configured global order.\n     * Omit only for immutable/tuple-local policy or an equivalent explicit outer\n     * owner lock. Each scope must match 1..64 rows, never an absent quota row.\n     * Locks precede tuple/intent/command locks; postcondition owns changed state. */\n    readonly guards?: ReadonlyArray<OAuthRegistrationGuardDescriptor<Registration, N>>;\n    readonly admission: (input: {\n      readonly intent: OAuthRegistrationIntent;\n      readonly registration: Registration;\n      readonly nativeSubjectId?: N;\n    }) => SQL;\n    /** Evaluated after subject/application writes, including appended coordinator\n     * writes. May assert consumption of the admission invitation/quota. */\n    readonly postcondition: (input: {\n      readonly intent: OAuthRegistrationIntent;\n      readonly registration: Registration;\n      readonly nativeSubjectId?: N;\n    }) => SQL;\n  };\n  readonly allocateProvisioningIdentity: Effect.Effect<string, PersistenceMappingError>;\n  readonly retentionMillis: number;\n}\n\nexport interface OAuthRegistrationGuardTable<T extends Table, Registration, N> {\n  readonly table: T;\n  readonly orderBy: Column<T>;\n  readonly condition: (input: {\n    readonly intent: OAuthRegistrationIntent;\n    readonly registration: Registration;\n    readonly nativeSubjectId?: N;\n  }) => SQL;\n}\n\nexport interface OAuthRegistrationGuardDescriptor<Registration, N> {\n  readonly table: Table;\n  readonly orderBy: string;\n  readonly condition: OAuthRegistrationGuardTable<Table, Registration, N>[\"condition\"];\n}\n\nexport const oauthRegistrationGuardTable = <T extends Table, Registration, N>(\n  input: OAuthRegistrationGuardTable<T, Registration, N>,\n): OAuthRegistrationGuardDescriptor<Registration, N> =>\n  Object.freeze({\n    table: input.table,\n    orderBy: input.orderBy,\n    condition: input.condition,\n  });\n\nexport type OAuthRegistrationMapping<\n  Registration,\n  S extends Table,\n  O extends Table,\n  C extends Table,\n  AC extends Table,\n  T extends Table,\n  I extends Table,\n  R extends Table,\n  N,\n> = OAuthRegistrationBase<Registration, T, O, I, R, N> &\n  (\n    | {\n        readonly mode: \"pending\";\n        readonly allocatePendingReference: Effect.Effect<string, PersistenceMappingError>;\n      }\n    | {\n        readonly mode: \"atomic\";\n        readonly subjectId: SubjectIdCodec<N>;\n        readonly subject: OAuthSubjectReadTable<S>;\n        readonly credential: OAuthCredentialTable<C, N>;\n        readonly authority: OAuthAuthorityTable<AC, N>;\n        readonly allocateSubjectId: Effect.Effect<N, PersistenceMappingError>;\n        readonly allocateCredentialId: Effect.Effect<string, PersistenceMappingError>;\n        readonly allocateRevision: Effect.Effect<SecurityRevision, PersistenceMappingError>;\n        readonly encodeSubjectInsert: (\n          input: { readonly intent: OAuthRegistrationIntent; readonly registration: Registration },\n          ids: { readonly subjectId: N; readonly securityRevision: SecurityRevision },\n        ) => InferInsertModel<S>;\n      }\n  );\n\n/** Heterogeneous descriptors are made by typed factories and projected privately. */\nexport interface OAuthEligibilityDescriptor<N> {\n  readonly _tag: \"OAuthEligibilityDescriptor\";\n  readonly scope: string;\n  readonly table: Table;\n  readonly subjectId: string;\n  readonly credentialId: string;\n  readonly revision: string;\n  readonly condition: (subjectId: N) => SQL;\n  readonly decode: (row: unknown) => OAuthEligibilityFact | undefined;\n}\n\nexport const oauthEligibilityTable = <T extends Table, N>(\n  input: OAuthEligibilityTable<T, N>,\n): OAuthEligibilityDescriptor<N> => {\n  const { table, subjectId, credentialId, revision, scope, condition, decode } = input;\n\n  return Object.freeze({\n    _tag: \"OAuthEligibilityDescriptor\",\n    table,\n    subjectId,\n    credentialId,\n    revision,\n    scope,\n    condition,\n    decode: (row: unknown) => decode(row as InferSelectModel<T>),\n  });\n};\n\nexport interface OAuthCleanupDescriptor<N> {\n  readonly table: Table;\n  readonly subjectId: string;\n  readonly condition: OAuthCleanupTable<Table, N>[\"condition\"];\n}\n\nexport const oauthCleanupTable = <T extends Table, N>(\n  input: OAuthCleanupTable<T, N>,\n): OAuthCleanupDescriptor<N> =>\n  Object.freeze({ table: input.table, subjectId: input.subjectId, condition: input.condition });\n\n/** A stable application/reference lock acquired before an ownership target.\n * Missing rows retain ownership. Conditions use detached native IDs; every\n * writer of the guarded reference follows the same order. */\nexport interface OAuthReferenceGuardTable<T extends Table, N> {\n  readonly table: T;\n  readonly orderBy: Column<T>;\n  readonly condition: (input: {\n    readonly identity: typeof OAuthExternalIdentity.Type;\n    readonly identityKey: string;\n    readonly subjectId: N;\n  }) => SQL | Effect.Effect<SQL, PlatformError.PlatformError, Crypto.Crypto>;\n}\n\nexport interface OAuthReferenceGuardDescriptor<N> {\n  readonly table: Table;\n  readonly orderBy: string;\n  readonly condition: OAuthReferenceGuardTable<Table, N>[\"condition\"];\n}\n\nexport const oauthReferenceGuardTable = <T extends Table, N>(\n  input: OAuthReferenceGuardTable<T, N>,\n): OAuthReferenceGuardDescriptor<N> =>\n  Object.freeze({\n    table: input.table,\n    orderBy: input.orderBy,\n    condition: input.condition,\n  });\n\nexport interface OAuthAccountsMapping<\n  S extends Table,\n  O extends Table,\n  C extends Table,\n  AC extends Table,\n  F extends Table,\n  T extends Table,\n  U extends Table,\n  N,\n> {\n  readonly subject: OAuthSubjectTable<S>;\n  readonly ownership: OAuthOwnershipMutation<T, O, N>;\n  readonly credential: OAuthCredentialTable<C, N>;\n  readonly authority: OAuthAuthorityTable<AC, N>;\n  readonly flow: OAuthFlowTable<F>;\n  readonly command: OAuthUnlinkCommandTable<U>;\n  readonly subjectId: SubjectIdCodec<N>;\n  readonly clock: OAuthClock;\n  readonly constraints: typeof requiredOAuthSignInConstraints &\n    typeof requiredOAuthAccountsConstraints;\n  readonly tupleConstraints: typeof requiredOAuthTupleConstraints;\n  readonly eligibility: ReadonlyArray<OAuthEligibilityDescriptor<N>>;\n  readonly cleanup: ReadonlyArray<OAuthCleanupDescriptor<N>>;\n  readonly metadata: OAuthMetadataPolicy<N>;\n  readonly sessionInvalidation: \"same-authority-immediate\" | \"original-absolute-expiry\";\n  /** Omit only when connected access is absent. A predicate alone conservatively\n   * retains ownership; release also needs all configured guard rows below. */\n  readonly connectedReference?: (input: {\n    readonly identityKey: string;\n    readonly subjectId: N;\n  }) => SQL;\n  /** At most 32 descriptors, each locking 1..64 stable rows in supplied order.\n   * Missing/empty guards retain Owned, even when the reference predicate is false. */\n  readonly connectedReferenceGuards?: ReadonlyArray<OAuthReferenceGuardDescriptor<N>>;\n  readonly allocateCredentialId: Effect.Effect<string, PersistenceMappingError>;\n  readonly allocateRevision: Effect.Effect<SecurityRevision, PersistenceMappingError>;\n}\n\nexport interface OAuthRegistrationAuthority<Registration> {\n  readonly read: (\n    access: import(\"@yielded/auth/OAuth\").OAuthRegistrationAccess,\n  ) => Effect.Effect<\n    import(\"@yielded/auth/OAuth\").OAuthRegistrationInspection | undefined,\n    import(\"@yielded/auth/OAuth\").OAuthUnavailable\n  >;\n  readonly inspect: (input: {\n    readonly intent: OAuthRegistrationIntent;\n    readonly registration: Registration;\n  }) => Effect.Effect<\n    {\n      readonly fingerprint: import(\"@yielded/auth/Schema\").TokenDigest;\n      readonly eligible: boolean;\n    },\n    import(\"@yielded/auth/OAuth\").OAuthUnavailable\n  >;\n  readonly register: <A>(\n    input: {\n      readonly access: import(\"@yielded/auth/OAuth\").OAuthRegistrationAccess;\n      readonly intent: OAuthRegistrationIntent;\n      readonly commandId: typeof import(\"@yielded/auth/OAuth\").OAuthCommandId.Type;\n      readonly registration: Registration;\n      readonly fingerprint: import(\"@yielded/auth/Schema\").TokenDigest;\n    },\n    prepare: import(\"@yielded/auth/OAuth\").PrepareOAuthCommit<\n      import(\"@yielded/auth/OAuth\").OAuthRegistrationDecision,\n      A\n    >,\n  ) => Effect.Effect<\n    import(\"@yielded/auth/Hooks\").PreparedCommit<A>,\n    import(\"@yielded/auth/OAuth\").OAuthUnavailable\n  >;\n  readonly cleanup: <A>(\n    input: import(\"@yielded/auth/OAuth\").OAuthCleanupInput,\n    prepare: import(\"@yielded/auth/OAuth\").PrepareOAuthCommit<\n      { readonly removed: number; readonly hasMore: boolean },\n      A\n    >,\n  ) => Effect.Effect<\n    import(\"@yielded/auth/Hooks\").PreparedCommit<A>,\n    import(\"@yielded/auth/OAuth\").OAuthUnavailable\n  >;\n}\n"],"mappings":";AAuRA,MAAa,iCAAiC;CAC5C,MAAM;CACN,SAAS;CACT,aAAa;CACb,WAAW;CACX,cAAc;CACd,oBAAoB;CACpB,qBAAqB;AACvB;AAEA,MAAa,gCAAgC,EAAE,aAAa,4BAA4B;AAExF,MAAa,uCAAuC;CAClD,iBAAiB;CACjB,YAAY;CACZ,SAAS;AACX;AAEA,MAAa,mCAAmC,EAC9C,eAAe,yDACjB;AA+HA,MAAa,+BACX,UAEA,OAAO,OAAO;CACZ,OAAO,MAAM;CACb,SAAS,MAAM;CACf,WAAW,MAAM;AACnB,CAAC;AA8CH,MAAa,yBACX,UACkC;CAClC,MAAM,EAAE,OAAO,WAAW,cAAc,UAAU,OAAO,WAAW,WAAW;CAE/E,OAAO,OAAO,OAAO;EACnB,MAAM;EACN;EACA;EACA;EACA;EACA;EACA;EACA,SAAS,QAAiB,OAAO,GAA0B;CAC7D,CAAC;AACH;AAQA,MAAa,qBACX,UAEA,OAAO,OAAO;CAAE,OAAO,MAAM;CAAO,WAAW,MAAM;CAAW,WAAW,MAAM;AAAU,CAAC;AAqB9F,MAAa,4BACX,UAEA,OAAO,OAAO;CACZ,OAAO,MAAM;CACb,SAAS,MAAM;CACf,WAAW,MAAM;AACnB,CAAC"}
+{"version":3,"file":"oauth-model.mjs","names":[],"sources":["../../src/drizzle/oauth-model.ts"],"sourcesContent":["import * as Shared from \"@yielded/auth-persistence/Adapter\";\nimport type { SQL, Table } from \"drizzle-orm\";\n\nimport type { DrizzleTableModel } from \"./table-model\";\n\nexport {\n  type OAuthFlowState,\n  type OAuthTupleState,\n  type OAuthRegistrationState,\n  type OAuthAction,\n  type OAuthEligibilityFact,\n  type OAuthD1Mapping,\n  requiredOAuthSignInConstraints,\n  requiredOAuthTupleConstraints,\n  requiredOAuthRegistrationConstraints,\n  requiredOAuthAccountsConstraints,\n  type OAuthRegistrationAuthority,\n} from \"@yielded/auth-persistence/Adapter\";\n\n/** The engine writes every critical column explicitly after applying the pure\n * consumer encoder. Native instant values must roundtrip without precision loss. */\nexport type OAuthClock = Shared.OAuthClock<SQL>;\n\nexport type OAuthSubjectReadTable<S extends Table> = Shared.OAuthSubjectReadTable<\n  DrizzleTableModel<S>,\n  SQL\n>;\n\nexport type OAuthSubjectTable<S extends Table> = Shared.OAuthSubjectTable<\n  DrizzleTableModel<S>,\n  SQL\n>;\n\nexport type OAuthOwnershipReadTable<O extends Table, N> = Shared.OAuthOwnershipReadTable<\n  DrizzleTableModel<O>,\n  N,\n  SQL\n>;\n\nexport type OAuthOwnershipTable<O extends Table, N> = Shared.OAuthOwnershipTable<\n  DrizzleTableModel<O>,\n  N,\n  SQL\n>;\n\nexport type OAuthCredentialReadTable<C extends Table> = Shared.OAuthCredentialReadTable<\n  DrizzleTableModel<C>,\n  SQL\n>;\n\nexport type OAuthCredentialTable<C extends Table, N> = Shared.OAuthCredentialTable<\n  DrizzleTableModel<C>,\n  N,\n  SQL\n>;\n\nexport type OAuthAuthorityReadTable<C extends Table> = Shared.OAuthAuthorityReadTable<\n  DrizzleTableModel<C>,\n  SQL\n>;\n\nexport type OAuthAuthorityTable<C extends Table, N> = Shared.OAuthAuthorityTable<\n  DrizzleTableModel<C>,\n  N,\n  SQL\n>;\n\n/** Both purposes may use the same physical table. Shared tables share module/flow\n * and module/command uniqueness. The snapshot has the exact purpose-specific core\n * codec; terminal writes erase it, while identity, claim and retention columns remain. */\nexport type OAuthFlowTable<F extends Table> = Shared.OAuthFlowTable<DrizzleTableModel<F>>;\n\nexport type OAuthTupleAuthorityTable<T extends Table, N> = Shared.OAuthTupleAuthorityTable<\n  DrizzleTableModel<T>,\n  N\n>;\n\nexport type OAuthRegistrationIntentTable<I extends Table> = Shared.OAuthRegistrationIntentTable<\n  DrizzleTableModel<I>\n>;\n\nexport type OAuthRegistrationCommandTable<\n  R extends Table,\n  Registration,\n> = Shared.OAuthRegistrationCommandTable<DrizzleTableModel<R>, Registration>;\n\nexport type OAuthUnlinkCommandTable<U extends Table> = Shared.OAuthUnlinkCommandTable<\n  DrizzleTableModel<U>\n>;\n\n/** Each descriptor reads only its own subject-scoped method rows. The native row\n * projector and SQL condition must express the same installed method eligibility.\n * All source/identifier/policy mutations advance subject securityRevision. D1 also\n * guards exact selected IDs/versions and absence/count assumptions, never just a\n * stale boolean. An over-limit graph fails closed rather than truncating. */\nexport type OAuthEligibilityTable<T extends Table, N> = Shared.OAuthEligibilityTable<\n  DrizzleTableModel<T>,\n  N,\n  SQL\n>;\n\n/** Authenticated command replay uses current subject status and this additional\n * nonconsuming SQL policy. It never consumes a fresh action factor. */\nexport type OAuthMetadataPolicy<N> = Shared.OAuthMetadataPolicy<N, SQL>;\n\nexport type OAuthCleanupTable<T extends Table, N> = Shared.OAuthCleanupTable<\n  DrizzleTableModel<T>,\n  N,\n  SQL\n>;\n\nexport type OAuthRegistrationEligibility<N> = Shared.OAuthRegistrationEligibility<N, SQL>;\n\nexport type OAuthSignInMapping<\n  S extends Table,\n  O extends Table,\n  C extends Table,\n  AC extends Table,\n  F extends Table,\n  N,\n> = Shared.OAuthSignInMapping<\n  DrizzleTableModel<S>,\n  DrizzleTableModel<O>,\n  DrizzleTableModel<C>,\n  DrizzleTableModel<AC>,\n  DrizzleTableModel<F>,\n  N,\n  SQL\n>;\n\nexport type OAuthOwnershipMutation<\n  T extends Table,\n  O extends Table,\n  N,\n> = Shared.OAuthOwnershipMutation<DrizzleTableModel<T>, DrizzleTableModel<O>, N, SQL>;\n\nexport type OAuthRegistrationIntentMapping<\n  S extends Table,\n  O extends Table,\n  C extends Table,\n  AC extends Table,\n  F extends Table,\n  T extends Table,\n  I extends Table,\n  N,\n> = Shared.OAuthRegistrationIntentMapping<\n  DrizzleTableModel<S>,\n  DrizzleTableModel<O>,\n  DrizzleTableModel<C>,\n  DrizzleTableModel<AC>,\n  DrizzleTableModel<F>,\n  DrizzleTableModel<T>,\n  DrizzleTableModel<I>,\n  N,\n  SQL\n>;\n\nexport type OAuthRegistrationBase<\n  Registration,\n  T extends Table,\n  O extends Table,\n  I extends Table,\n  R extends Table,\n  N,\n> = Shared.OAuthRegistrationBase<\n  Registration,\n  DrizzleTableModel<T>,\n  DrizzleTableModel<O>,\n  DrizzleTableModel<I>,\n  DrizzleTableModel<R>,\n  N,\n  SQL,\n  Table\n>;\n\nexport type OAuthRegistrationGuardTable<\n  T extends Table,\n  Registration,\n  N,\n> = Shared.OAuthRegistrationGuardTable<DrizzleTableModel<T>, Registration, N, SQL>;\n\nexport type OAuthRegistrationGuardDescriptor<Registration, N> =\n  Shared.OAuthRegistrationGuardDescriptor<Registration, N, SQL, Table>;\n\nexport const oauthRegistrationGuardTable = <T extends Table, Registration, N>(\n  input: OAuthRegistrationGuardTable<T, Registration, N>,\n): OAuthRegistrationGuardDescriptor<Registration, N> =>\n  Shared.oauthRegistrationGuardTable<DrizzleTableModel<T>, Registration, N, SQL>(input);\n\nexport type OAuthRegistrationMapping<\n  Registration,\n  S extends Table,\n  O extends Table,\n  C extends Table,\n  AC extends Table,\n  T extends Table,\n  I extends Table,\n  R extends Table,\n  N,\n> = Shared.OAuthRegistrationMapping<\n  Registration,\n  DrizzleTableModel<S>,\n  DrizzleTableModel<O>,\n  DrizzleTableModel<C>,\n  DrizzleTableModel<AC>,\n  DrizzleTableModel<T>,\n  DrizzleTableModel<I>,\n  DrizzleTableModel<R>,\n  N,\n  SQL,\n  Table\n>;\n\n/** Heterogeneous descriptors are made by typed factories and projected privately. */\nexport type OAuthEligibilityDescriptor<N> = Shared.OAuthEligibilityDescriptor<N, SQL, Table>;\n\nexport const oauthEligibilityTable = <T extends Table, N>(\n  input: OAuthEligibilityTable<T, N>,\n): OAuthEligibilityDescriptor<N> =>\n  Shared.oauthEligibilityTable<DrizzleTableModel<T>, N, SQL>(input);\n\nexport type OAuthCleanupDescriptor<N> = Shared.OAuthCleanupDescriptor<N, SQL, Table>;\n\nexport const oauthCleanupTable = <T extends Table, N>(\n  input: OAuthCleanupTable<T, N>,\n): OAuthCleanupDescriptor<N> => Shared.oauthCleanupTable<DrizzleTableModel<T>, N, SQL>(input);\n\n/** A stable application/reference lock acquired before an ownership target.\n * Missing rows retain ownership. Conditions use detached native IDs; every\n * writer of the guarded reference follows the same order. */\nexport type OAuthReferenceGuardTable<T extends Table, N> = Shared.OAuthReferenceGuardTable<\n  DrizzleTableModel<T>,\n  N,\n  SQL\n>;\n\nexport type OAuthReferenceGuardDescriptor<N> = Shared.OAuthReferenceGuardDescriptor<N, SQL, Table>;\n\nexport const oauthReferenceGuardTable = <T extends Table, N>(\n  input: OAuthReferenceGuardTable<T, N>,\n): OAuthReferenceGuardDescriptor<N> =>\n  Shared.oauthReferenceGuardTable<DrizzleTableModel<T>, N, SQL>(input);\n\nexport type OAuthAccountsMapping<\n  S extends Table,\n  O extends Table,\n  C extends Table,\n  AC extends Table,\n  F extends Table,\n  T extends Table,\n  U extends Table,\n  N,\n> = Shared.OAuthAccountsMapping<\n  DrizzleTableModel<S>,\n  DrizzleTableModel<O>,\n  DrizzleTableModel<C>,\n  DrizzleTableModel<AC>,\n  DrizzleTableModel<F>,\n  DrizzleTableModel<T>,\n  DrizzleTableModel<U>,\n  N,\n  SQL,\n  Table\n>;\n"],"mappings":";;;AAwLA,MAAa,+BACX,UAEA,OAAO,4BAAwE,KAAK;AA6BtF,MAAa,yBACX,UAEA,OAAO,sBAAoD,KAAK;AAIlE,MAAa,qBACX,UAC8B,OAAO,kBAAgD,KAAK;AAa5F,MAAa,4BACX,UAEA,OAAO,yBAAuD,KAAK"}