@yielded/auth-persistence 0.1.0-beta.22 → 0.1.0-beta.24

package/dist/internal/configuration.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"configuration.mjs","names":[],"sources":["../../src/internal/configuration.ts"],"sourcesContent":["import type { EmailAction, EmailAddressPersistence } from \"@yielded/auth/Email\";\nimport type { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport type {\n  PasskeyActionChallenge,\n  PasskeyConfig,\n  PasskeyCredentials,\n  PasskeyEnrollmentContext,\n  PasskeyManagementPersistence,\n  PasskeyManagementPolicy,\n  PasskeyMethodPolicy,\n  PasskeyPersistence,\n  PasskeyConfigurationError,\n} from \"@yielded/auth/Passkey\";\nimport type {\n  PasswordAction,\n  PasswordPersistence,\n  PasswordUnavailable,\n} from \"@yielded/auth/Password\";\nimport type { PhoneAdmission, PhoneSignInTargets } from \"@yielded/auth/PhoneOtp\";\nimport type { ProofPersistence } from \"@yielded/auth/Proofs\";\nimport type { SubjectId } from \"@yielded/auth/Schema\";\nimport type {\n  AuthenticationAuthority,\n  AuthenticationRequirement,\n  make as makeSessions,\n} from \"@yielded/auth/Sessions\";\nimport { type Context, type Crypto, type Effect, type Layer, Schema } from \"effect\";\nimport type { SqlClient } from \"effect/sql\";\n\nimport type { PersistenceMappingError } from \"./mapping-error\";\nimport type { StorageRole } from \"./storage-tables\";\n\nexport class PersistenceConfigurationError extends Schema.TaggedError<PersistenceConfigurationError>()(\n  \"PersistenceConfigurationError\",\n  { reason: Schema.String },\n) {}\n\nexport type ClaimsCodec = Schema.Codec<unknown, unknown, never, never>;\n\nexport interface PasskeyFeature {\n  readonly kind: \"passkey\";\n  readonly moduleId: string;\n  readonly policy: Effect.Effect<PasskeyMethodPolicy, PasskeyConfigurationError, PasskeyConfig>;\n  readonly management?: boolean;\n  readonly managementPolicy?: PasskeyManagementPolicy;\n}\n\nexport interface Strategy {\n  readonly strategy: object;\n  readonly persistence?:\n    | PasskeyFeature\n    | {\n        readonly kind: \"password\" | \"phone\" | \"email\";\n        readonly moduleId: string;\n        readonly lifecycle?: boolean;\n        readonly management?: boolean;\n        readonly addresses?: boolean;\n      };\n  readonly RegistrationAuthority?: Context.Key<unknown, unknown>;\n}\n\nexport interface Definition<C extends ClaimsCodec, Id extends string> {\n  readonly namespace: string;\n  readonly claims: C;\n  readonly sessionMode?: string | undefined;\n  readonly sessions: ReturnType<typeof makeSessions<C, Id>>;\n  readonly strategies: Readonly<Record<string, Strategy>>;\n}\n\ntype KeyId<T> = T extends Context.Key<infer Id, infer _Service> ? Id : never;\ntype Enabled<\n  A extends { readonly strategies: Readonly<Record<string, Strategy>> },\n  Kind extends \"password\" | \"phone\" | \"email\" | \"passkey\",\n> = Extract<A[\"strategies\"][keyof A[\"strategies\"]], { persistence: { kind: Kind } }>;\n\ntype ManagedPassword<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> =\n  Extract<Enabled<A, \"password\">, { persistence: { management: true } }>;\n\ntype ManagedPasskey<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> =\n  Extract<Enabled<A, \"passkey\">, { persistence: { management: true } }>;\n\nexport type PasskeyRequirement<\n  A extends { readonly strategies: Readonly<Record<string, Strategy>> },\n> = Enabled<A, \"passkey\"> extends never ? never : PasskeyConfig;\n\ntype RegistrationKey<S> = S extends { readonly RegistrationAuthority: infer K } ? K : never;\ntype Registration<S> =\n  RegistrationKey<S> extends Context.Key<infer _Id, infer Service>\n    ? Service extends { readonly register: (input: infer Input, ...args: never[]) => unknown }\n      ? Input extends { readonly registration: infer Value }\n        ? Value\n        : never\n      : never\n    : never;\n\nexport interface ProvisioningId<Id extends string> {\n  readonly authNamespace: Id;\n  readonly service: \"PersistenceProvisioning\";\n}\n\nexport type Provisioning<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> = {\n  readonly [\n    K in keyof A[\"strategies\"] as A[\"strategies\"][K] extends {\n      persistence: { kind: \"password\"; management: true };\n    }\n      ? K\n      : never\n  ]: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly registration: Registration<A[\"strategies\"][K]>;\n  }) => Effect.Effect<SubjectId, PasswordUnavailable>;\n};\n\nexport type ProvisioningRequirement<\n  A extends { readonly namespace: string; readonly strategies: Readonly<Record<string, Strategy>> },\n> = ManagedPassword<A> extends never ? never : ProvisioningId<A[\"namespace\"]>;\n\ntype ProofRoles =\n  | \"proofRequests\"\n  | \"proofSeries\"\n  | \"proofGenerations\"\n  | \"proofContinuations\"\n  | \"proofScopes\"\n  | \"proofAbuse\"\n  | \"proofFailures\"\n  | \"proofCommands\";\n\ntype UsesProofs<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> =\n  | Enabled<A, \"phone\">\n  | Enabled<A, \"email\">\n  | ManagedPassword<A>;\n\nexport type Ports<C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> =\n  | AuthenticationAuthority\n  | KeyId<A[\"sessions\"][\"StatefulSessionPersistence\"]>\n  | KeyId<A[\"sessions\"][\"SessionRepository\"]>\n  | (Enabled<A, \"password\"> extends never ? never : PasswordPersistence)\n  | KeyId<RegistrationKey<ManagedPassword<A>>>\n  | (Enabled<A, \"passkey\"> extends never ? never : PasskeyPersistence | PasskeyCredentials)\n  | (ManagedPasskey<A> extends never\n      ? never\n      : PasskeyManagementPersistence | PasskeyEnrollmentContext)\n  | (Enabled<A, \"email\"> extends never ? never : EmailAddressPersistence)\n  | (UsesProofs<A> extends never ? never : ProofPersistence)\n  | (Enabled<A, \"phone\"> extends never ? never : PhoneAdmission | PhoneSignInTargets);\n\nexport type Roles<C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> =\n  | \"identifiers\"\n  | \"credentials\"\n  | \"sessions\"\n  | \"sessionFlows\"\n  | (Enabled<A, \"password\"> extends never\n      ? never\n      :\n          | \"passwords\"\n          | \"passwordAttempts\"\n          | \"passwordScopes\"\n          | \"passwordCharges\"\n          | \"passwordCommands\")\n  | (ManagedPassword<A> extends never ? never : \"passwordRegistrations\")\n  | (Enabled<A, \"phone\"> extends never ? never : \"phoneState\")\n  | (Enabled<A, \"email\"> extends never ? never : \"emailCredentials\" | \"emailCommands\")\n  | (Enabled<A, \"passkey\"> extends never\n      ? never\n      :\n          | \"passkeyCredentials\"\n          | \"passkeyOwnership\"\n          | \"passkeyHandles\"\n          | \"passkeyModules\"\n          | \"passkeyFlows\"\n          | \"passkeyAdmissions\"\n          | \"passkeyCharges\")\n  | (ManagedPasskey<A> extends never ? never : \"passkeyCommands\")\n  | (UsesProofs<A> extends never ? never : ProofRoles);\n\nexport interface SubjectOptions<T extends object, NativeId> {\n  readonly table: T;\n  readonly id: string;\n  readonly status: string;\n  readonly activeValue: unknown;\n  readonly securityRevision: string;\n  readonly idCodec: Schema.Codec<SubjectId, NativeId>;\n  readonly requirements: (\n    row: Readonly<Record<string, unknown>>,\n  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n  /** Defaults to sign-in requirements. Recovery can have a distinct application policy. */\n  readonly actionRequirements?: (\n    row: Readonly<Record<string, unknown>>,\n    action: PasswordAction | EmailAction | PasskeyActionChallenge[\"action\"],\n  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n}\n\n/** Codecs at the application-owned subject and timestamp boundary. */\nexport interface SubjectMapping {\n  readonly table: object;\n  readonly id: string;\n  readonly status: string;\n  readonly securityRevision: string;\n  readonly activeValue: unknown;\n  readonly requirements: SubjectOptions<object, unknown>[\"requirements\"];\n  readonly actionRequirements: NonNullable<SubjectOptions<object, unknown>[\"actionRequirements\"]>;\n  readonly toSubject: (value: unknown) => Effect.Effect<SubjectId, PersistenceMappingError>;\n  readonly toNative: (value: SubjectId) => Effect.Effect<unknown, PersistenceMappingError>;\n  readonly toSubjectSync: (value: unknown) => SubjectId;\n  readonly toNativeSync: (value: SubjectId) => unknown;\n}\n\nexport interface MappingInput {\n  readonly tables: Partial<Record<StorageRole, object>>;\n  readonly subjects: SubjectMapping;\n  readonly encodeInstant: (millis: number) => unknown;\n  readonly decodeInstant: (value: unknown) => Effect.Effect<number, PersistenceMappingError>;\n  readonly decodeInstantSync: (value: unknown) => number;\n}\n\nexport interface StorageLayout<\n  T extends object,\n  Role extends StorageRole = StorageRole,\n> extends MappingInput {\n  readonly namespace: string;\n  readonly schema: Readonly<Record<Role, T>>;\n}\n\nexport interface ConfigId<Id extends string> {\n  readonly authNamespace: Id;\n  readonly service: \"PersistenceConfig\";\n}\n\nexport interface TimestampOptions<Instant> {\n  readonly type: \"text\" | \"integer\";\n  readonly codec: Schema.Codec<number, Instant>;\n}\n\nexport interface BoundPersistence<\n  T extends object,\n  R,\n  C extends ClaimsCodec,\n  Id extends string,\n  A extends Definition<C, Id>,\n> {\n  readonly Config: Context.Service<ConfigId<A[\"namespace\"]>, StorageLayout<T, Roles<C, Id, A>>> & {\n    readonly layer: (\n      value: StorageLayout<T, Roles<C, Id, A>>,\n    ) => Layer.Layer<ConfigId<A[\"namespace\"]>>;\n  };\n  /** Create only the application subject. Runs inside the owning auth SQL transaction;\n   * use that SqlClient (including Drizzle over it), and return the new subject ID.\n   * Do not perform external side effects or open an independent transaction here.\n   */\n  readonly Provisioning: Context.Service<ProvisioningRequirement<A>, Provisioning<A>>;\n  readonly layer: Layer.Layer<\n    Ports<C, Id, A>,\n    PersistenceConfigurationError,\n    | Crypto.Crypto\n    | ConfigId<A[\"namespace\"]>\n    | ProvisioningRequirement<A>\n    | PasskeyRequirement<A>\n    | SqlClient.SqlClient\n    | R\n  >;\n  readonly managed: <N, Instant = number>(options: {\n    readonly subjects: SubjectOptions<T, N>;\n    readonly tables?: Partial<Record<Roles<C, Id, A>, T>>;\n    /** Stable SQL identifier prefix; reuse the deployed prefix for existing tables. */\n    readonly prefix: string;\n    readonly timestamps?: TimestampOptions<Instant>;\n  }) => StorageLayout<T, Roles<C, Id, A>>;\n  readonly map: <N, Instant = number>(options: {\n    readonly subjects: SubjectOptions<T, N>;\n    readonly tables: Readonly<Record<Roles<C, Id, A>, T>>;\n    readonly timestamps?: TimestampOptions<Instant>;\n  }) => StorageLayout<T, Roles<C, Id, A>>;\n}\n\n/** Shared configuration shape. The backend chooses table types and service requirements. */\nexport interface PersistenceApi<T extends object, R = never> {\n  readonly make: <\n    C extends ClaimsCodec,\n    const Id extends string,\n    const A extends Definition<C, Id>,\n  >(\n    auth: A & Definition<C, Id>,\n  ) => BoundPersistence<T, R, C, Id, A>;\n}\n"],"mappings":";;AAgCA,IAAa,gCAAb,cAAmD,OAAO,YAA2C,CAAC,CACpG,iCACA,EAAE,QAAQ,OAAO,OAAO,CAC1B,CAAC,CAAC,CAAC"}
+{"version":3,"file":"configuration.mjs","names":[],"sources":["../../src/internal/configuration.ts"],"sourcesContent":["import type { EmailAction, EmailAddressPersistence } from \"@yielded/auth/Email\";\nimport type { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport type {\n  PasskeyActionChallenge,\n  PasskeyConfig,\n  PasskeyCredentials,\n  PasskeyEnrollmentContext,\n  PasskeyManagementPersistence,\n  PasskeyManagementPolicy,\n  PasskeyMethodPolicy,\n  PasskeyPersistence,\n  PasskeyConfigurationError,\n} from \"@yielded/auth/Passkey\";\nimport type {\n  PasswordAction,\n  PasswordPersistence,\n  PasswordUnavailable,\n} from \"@yielded/auth/Password\";\nimport type { PhoneAdmission, PhoneSignInTargets } from \"@yielded/auth/PhoneOtp\";\nimport type { ProofPersistence } from \"@yielded/auth/Proofs\";\nimport type { SubjectId } from \"@yielded/auth/Schema\";\nimport type {\n  AuthenticationAuthority,\n  AuthenticationRequirement,\n  make as makeSessions,\n} from \"@yielded/auth/Sessions\";\nimport { type Context, type Crypto, type Effect, type Layer, Schema } from \"effect\";\nimport type { SqlClient } from \"effect/sql\";\n\nimport type { PersistenceMappingError } from \"./mapping-error\";\nimport type { StorageRole } from \"./storage-tables\";\n\nexport class PersistenceConfigurationError extends Schema.TaggedError<PersistenceConfigurationError>()(\n  \"PersistenceConfigurationError\",\n  { reason: Schema.String },\n) {}\n\nexport type ClaimsCodec = Schema.Codec<unknown, unknown, never, never>;\n\nexport interface PasskeyFeature {\n  readonly kind: \"passkey\";\n  readonly moduleId: string;\n  readonly policy: Effect.Effect<PasskeyMethodPolicy, PasskeyConfigurationError, PasskeyConfig>;\n  readonly management?: boolean;\n  readonly managementPolicy?: PasskeyManagementPolicy;\n}\n\nexport interface Strategy {\n  readonly strategy: object;\n  readonly persistence?:\n    | PasskeyFeature\n    | {\n        readonly kind: \"password\" | \"phone\" | \"email\";\n        readonly moduleId: string;\n        readonly lifecycle?: boolean;\n        readonly management?: boolean;\n        readonly addresses?: boolean;\n      };\n  readonly RegistrationAuthority?: Context.Key<unknown, unknown>;\n}\n\nexport interface Definition<C extends ClaimsCodec, Id extends string> {\n  readonly namespace: string;\n  readonly claims: C;\n  readonly sessionMode?: string | undefined;\n  readonly sessions: ReturnType<typeof makeSessions<C, Id>>;\n  readonly strategies: Readonly<Record<string, Strategy>>;\n}\n\ntype KeyId<T> = T extends Context.Key<infer Id, infer _Service> ? Id : never;\ntype Enabled<\n  A extends { readonly strategies: Readonly<Record<string, Strategy>> },\n  Kind extends \"password\" | \"phone\" | \"email\" | \"passkey\",\n> = Extract<A[\"strategies\"][keyof A[\"strategies\"]], { persistence: { kind: Kind } }>;\n\ntype ManagedPassword<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> =\n  Extract<Enabled<A, \"password\">, { persistence: { management: true } }>;\n\ntype ManagedPasskey<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> =\n  Extract<Enabled<A, \"passkey\">, { persistence: { management: true } }>;\n\nexport type PasskeyRequirement<\n  A extends { readonly strategies: Readonly<Record<string, Strategy>> },\n> = Enabled<A, \"passkey\"> extends never ? never : PasskeyConfig;\n\ntype RegistrationKey<S> = S extends { readonly RegistrationAuthority: infer K } ? K : never;\ntype Registration<S> =\n  RegistrationKey<S> extends Context.Key<infer _Id, infer Service>\n    ? Service extends { readonly register: (input: infer Input, ...args: never[]) => unknown }\n      ? Input extends { readonly registration: infer Value }\n        ? Value\n        : never\n      : never\n    : never;\n\nexport interface ProvisioningId<Id extends string> {\n  readonly authNamespace: Id;\n  readonly service: \"PersistenceProvisioning\";\n}\n\nexport type Provisioning<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> = {\n  readonly [\n    K in keyof A[\"strategies\"] as A[\"strategies\"][K] extends {\n      persistence: { kind: \"password\"; management: true };\n    }\n      ? K\n      : never\n  ]: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly registration: Registration<A[\"strategies\"][K]>;\n  }) => Effect.Effect<SubjectId, PasswordUnavailable>;\n};\n\nexport type ProvisioningRequirement<\n  A extends { readonly namespace: string; readonly strategies: Readonly<Record<string, Strategy>> },\n> = ManagedPassword<A> extends never ? never : ProvisioningId<A[\"namespace\"]>;\n\ntype ProofRoles =\n  | \"proofRequests\"\n  | \"proofSeries\"\n  | \"proofGenerations\"\n  | \"proofContinuations\"\n  | \"proofScopes\"\n  | \"proofAbuse\"\n  | \"proofFailures\"\n  | \"proofCommands\";\n\ntype UsesProofs<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> =\n  | Enabled<A, \"phone\">\n  | Enabled<A, \"email\">\n  | ManagedPassword<A>;\n\nexport type Ports<C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> =\n  | AuthenticationAuthority\n  | KeyId<A[\"sessions\"][\"StatefulSessionPersistence\"]>\n  | KeyId<A[\"sessions\"][\"SessionRepository\"]>\n  | (Enabled<A, \"password\"> extends never ? never : PasswordPersistence)\n  | KeyId<RegistrationKey<ManagedPassword<A>>>\n  | (Enabled<A, \"passkey\"> extends never ? never : PasskeyPersistence | PasskeyCredentials)\n  | (ManagedPasskey<A> extends never\n      ? never\n      : PasskeyManagementPersistence | PasskeyEnrollmentContext)\n  | (Enabled<A, \"email\"> extends never ? never : EmailAddressPersistence)\n  | (UsesProofs<A> extends never ? never : ProofPersistence)\n  | (Enabled<A, \"phone\"> extends never ? never : PhoneAdmission | PhoneSignInTargets);\n\nexport type Roles<C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> =\n  | \"identifiers\"\n  | \"credentials\"\n  | \"sessions\"\n  | \"sessionFlows\"\n  | (Enabled<A, \"password\"> extends never ? never : \"passwords\" | \"passwordCommands\")\n  | (ManagedPassword<A> extends never ? never : \"passwordRegistrations\")\n  | (Enabled<A, \"phone\"> extends never ? never : \"phoneState\")\n  | (Enabled<A, \"email\"> extends never ? never : \"emailCredentials\" | \"emailCommands\")\n  | (Enabled<A, \"passkey\"> extends never\n      ? never\n      :\n          | \"passkeyCredentials\"\n          | \"passkeyOwnership\"\n          | \"passkeyHandles\"\n          | \"passkeyModules\"\n          | \"passkeyFlows\"\n          | \"passkeyAdmissions\"\n          | \"passkeyCharges\")\n  | (ManagedPasskey<A> extends never ? never : \"passkeyCommands\")\n  | (UsesProofs<A> extends never ? never : ProofRoles);\n\nexport interface SubjectOptions<T extends object, NativeId> {\n  readonly table: T;\n  readonly id: string;\n  readonly status: string;\n  readonly activeValue: unknown;\n  readonly securityRevision: string;\n  readonly idCodec: Schema.Codec<SubjectId, NativeId>;\n  readonly requirements: (\n    row: Readonly<Record<string, unknown>>,\n  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n  /** Defaults to sign-in requirements. Recovery can have a distinct application policy. */\n  readonly actionRequirements?: (\n    row: Readonly<Record<string, unknown>>,\n    action: PasswordAction | EmailAction | PasskeyActionChallenge[\"action\"],\n  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n}\n\n/** Codecs at the application-owned subject and timestamp boundary. */\nexport interface SubjectMapping {\n  readonly table: object;\n  readonly id: string;\n  readonly status: string;\n  readonly securityRevision: string;\n  readonly activeValue: unknown;\n  readonly requirements: SubjectOptions<object, unknown>[\"requirements\"];\n  readonly actionRequirements: NonNullable<SubjectOptions<object, unknown>[\"actionRequirements\"]>;\n  readonly toSubject: (value: unknown) => Effect.Effect<SubjectId, PersistenceMappingError>;\n  readonly toNative: (value: SubjectId) => Effect.Effect<unknown, PersistenceMappingError>;\n  readonly toSubjectSync: (value: unknown) => SubjectId;\n  readonly toNativeSync: (value: SubjectId) => unknown;\n}\n\nexport interface MappingInput {\n  readonly tables: Partial<Record<StorageRole, object>>;\n  readonly subjects: SubjectMapping;\n  readonly encodeInstant: (millis: number) => unknown;\n  readonly decodeInstant: (value: unknown) => Effect.Effect<number, PersistenceMappingError>;\n  readonly decodeInstantSync: (value: unknown) => number;\n}\n\nexport interface StorageLayout<\n  T extends object,\n  Role extends StorageRole = StorageRole,\n> extends MappingInput {\n  readonly namespace: string;\n  readonly schema: Readonly<Record<Role, T>>;\n}\n\nexport interface ConfigId<Id extends string> {\n  readonly authNamespace: Id;\n  readonly service: \"PersistenceConfig\";\n}\n\nexport interface TimestampOptions<Instant> {\n  readonly type: \"text\" | \"integer\";\n  readonly codec: Schema.Codec<number, Instant>;\n}\n\nexport interface BoundPersistence<\n  T extends object,\n  R,\n  C extends ClaimsCodec,\n  Id extends string,\n  A extends Definition<C, Id>,\n> {\n  readonly Config: Context.Service<ConfigId<A[\"namespace\"]>, StorageLayout<T, Roles<C, Id, A>>> & {\n    readonly layer: (\n      value: StorageLayout<T, Roles<C, Id, A>>,\n    ) => Layer.Layer<ConfigId<A[\"namespace\"]>>;\n  };\n  /** Create only the application subject. Runs inside the owning auth SQL transaction;\n   * use that SqlClient (including Drizzle over it), and return the new subject ID.\n   * Do not perform external side effects or open an independent transaction here.\n   */\n  readonly Provisioning: Context.Service<ProvisioningRequirement<A>, Provisioning<A>>;\n  readonly layer: Layer.Layer<\n    Ports<C, Id, A>,\n    PersistenceConfigurationError,\n    | Crypto.Crypto\n    | ConfigId<A[\"namespace\"]>\n    | ProvisioningRequirement<A>\n    | PasskeyRequirement<A>\n    | SqlClient.SqlClient\n    | R\n  >;\n  readonly managed: <N, Instant = number>(options: {\n    readonly subjects: SubjectOptions<T, N>;\n    readonly tables?: Partial<Record<Roles<C, Id, A>, T>>;\n    /** Stable SQL identifier prefix; reuse the deployed prefix for existing tables. */\n    readonly prefix: string;\n    readonly timestamps?: TimestampOptions<Instant>;\n  }) => StorageLayout<T, Roles<C, Id, A>>;\n  readonly map: <N, Instant = number>(options: {\n    readonly subjects: SubjectOptions<T, N>;\n    readonly tables: Readonly<Record<Roles<C, Id, A>, T>>;\n    readonly timestamps?: TimestampOptions<Instant>;\n  }) => StorageLayout<T, Roles<C, Id, A>>;\n}\n\n/** Shared configuration shape. The backend chooses table types and service requirements. */\nexport interface PersistenceApi<T extends object, R = never> {\n  readonly make: <\n    C extends ClaimsCodec,\n    const Id extends string,\n    const A extends Definition<C, Id>,\n  >(\n    auth: A & Definition<C, Id>,\n  ) => BoundPersistence<T, R, C, Id, A>;\n}\n"],"mappings":";;AAgCA,IAAa,gCAAb,cAAmD,OAAO,YAA2C,CAAC,CACpG,iCACA,EAAE,QAAQ,OAAO,OAAO,CAC1B,CAAC,CAAC,CAAC"}

package/dist/internal/models/oauth-connected-model.d.mts

@@ -0,0 +1,294 @@
+import { SqlExpression, TableModel } from "../query-operations.mjs";
+import { SubjectIdCodec } from "./common.mjs";
+import { OAuthAuthorityReadTable, OAuthClock, OAuthCredentialReadTable, OAuthFlowTable, OAuthOwnershipMutation, OAuthSubjectReadTable, requiredOAuthTupleConstraints } from "./oauth-model.mjs";
+import { AuthenticationRequirement } from "@yielded/auth/Sessions";
+import * as M from "@yielded/auth/OAuth";
+import { OAuthAccountRevision } from "@yielded/auth/OAuth";
+declare namespace oauth_connected_model_d_exports {
+  export { OAuthConnectedAction, OAuthConnectedAdmissionTable, OAuthConnectedAuthorityMapping, OAuthConnectedClientRegistrationTable, OAuthConnectedCohortTable, OAuthConnectedCommandTable, OAuthConnectedFlowTable, OAuthConnectedGrantTable, OAuthConnectedMapping, OAuthConnectedOrderCodec, OAuthConnectedOwnershipRead, OAuthConnectedPolicyGuard, OAuthConnectedPolicyGuardTable, OAuthConnectedPolicyInput, OAuthConnectedRevocationJobTable, OAuthConnectedRevocationMapping, OAuthConnectedSqlPolicy, OAuthConnectedSubjectTable, oauthConnectedPolicyGuard, requiredOAuthConnectedConstraints, requiredOAuthConnectedRevocationConstraints };
+}
+type Column<T extends TableModel> = T["column"];
+export type OAuthConnectedAction = M.OAuthConnectedActionChallenge["action"];
+export interface OAuthConnectedSubjectTable<S extends TableModel, Expression extends SqlExpression = SqlExpression> extends OAuthSubjectReadTable<S, Expression> {
+  readonly decodeActionRequirement: (row: S["select"], action: OAuthConnectedAction) => AuthenticationRequirement;
+}
+/** All mapped order columns use exact SQL integer comparison through 2^53-1.
+ * These codecs bridge driver representations, not alternative ordering rules. */
+export interface OAuthConnectedOrderCodec {
+  readonly encode: (order: number) => unknown;
+  readonly decode: (value: unknown) => number;
+}
+export interface OAuthConnectedFlowTable<F extends TableModel, N> {
+  readonly table: F["table"];
+  readonly moduleId: Column<F>;
+  readonly flowId: Column<F>;
+  readonly commandId: Column<F>;
+  readonly subjectId: Column<F>;
+  readonly clientKey: Column<F>;
+  readonly cohortKey: Column<F>;
+  readonly state: Column<F>;
+  readonly version: Column<F>;
+  readonly stateDigest: Column<F>;
+  readonly snapshot: Column<F>;
+  readonly claimId: Column<F>;
+  readonly claimDigest: Column<F>;
+  readonly claimOrder: Column<F>;
+  readonly claimedAt: Column<F>;
+  readonly claimExpiresAt: Column<F>;
+  readonly expiresAt: Column<F>;
+  readonly retentionUntil: Column<F>;
+  /** None before claim, Unresolved after claim, Resolved only after definite
+   * cancellation or atomic transfer to a grant/job. Never reset by cleanup. */
+  readonly work: Column<F>;
+  /** Exact sealed quarantine when no correctly sealed revocation job is available. */
+  readonly custody: Column<F>;
+  /** Required when retaining grants during sign-in. subjectId is NULL until
+   * identity resolution; custom required columns are supplied by this encoder. */
+  readonly encodeSignIn?: (reservation: M.OAuthSignInAccessClaim) => F["insert"];
+  readonly encodeInsert: (input: {
+    readonly flow: M.OAuthConnectedPendingFlow;
+    readonly subjectId: N;
+  }) => F["insert"];
+}
+export interface OAuthConnectedGrantTable<G extends TableModel, N> {
+  readonly table: G["table"];
+  readonly moduleId: Column<G>;
+  readonly grantId: Column<G>;
+  readonly subjectId: Column<G>;
+  readonly identityKey: Column<G>;
+  /** Nullable unique active slot; historical/disconnected records use null. */
+  readonly activeIdentityKey: Column<G>;
+  readonly clientKey: Column<G>;
+  readonly cohortKey: Column<G>;
+  readonly profileKey: Column<G>;
+  readonly grantVersion: Column<G>;
+  readonly tokenVersion: Column<G>;
+  readonly cohortGeneration: Column<G>;
+  readonly state: Column<G>;
+  readonly version: Column<G>;
+  readonly context: Column<G>;
+  readonly sealed: Column<G>;
+  /** Canonical OAuthConnectedSummary only: list never loads token envelopes. */
+  readonly summary: Column<G>;
+  readonly revocationJobId: Column<G>;
+  readonly refreshWork: Column<G>;
+  readonly refreshClaim: Column<G>;
+  readonly refreshClaimExpiresAt: Column<G>;
+  readonly retentionUntil: Column<G>;
+  readonly encodeInsert: (input: {
+    readonly grant: M.OAuthConnectedStoredGrant;
+    readonly subjectId: N;
+  }) => G["insert"];
+}
+/** Also stores a permanent provider/issuer scope anchor. clientKey must fit 52
+ * ASCII characters. Empty clientRegistrationId is reserved for that anchor;
+ * actual profile registrations are nonempty. Scope counter stays zero. */
+export interface OAuthConnectedClientRegistrationTable<C extends TableModel> {
+  readonly table: C["table"];
+  readonly clientKey: Column<C>;
+  readonly provider: Column<C>;
+  readonly issuer: Column<C>;
+  readonly clientRegistrationId: Column<C>;
+  readonly counter: Column<C>;
+  readonly version: Column<C>;
+  readonly encodeInsert: (configuration: M.OAuthConnectedConfiguration) => C["insert"];
+}
+/** Remote authority: no local-subject column or subject-scoped key. Retain this
+ * anchor/cutoff when a legitimately released tuple gains a different local owner. */
+export interface OAuthConnectedCohortTable<C extends TableModel> {
+  readonly table: C["table"];
+  readonly cohortKey: Column<C>;
+  readonly clientKey: Column<C>;
+  readonly identityKey: Column<C>;
+  readonly generation: Column<C>;
+  readonly cutoff: Column<C>;
+  readonly state: Column<C>;
+  readonly version: Column<C>;
+  readonly encodeInsert: (input: {
+    readonly clientKey: string;
+    readonly identityKey: string;
+  }) => C["insert"];
+}
+export interface OAuthConnectedAdmissionTable<A extends TableModel, N> {
+  readonly table: A["table"];
+  readonly admissionId: Column<A>;
+  readonly moduleId: Column<A>;
+  readonly grantId: Column<A>;
+  readonly subjectId: Column<A>;
+  readonly identityKey: Column<A>;
+  readonly clientKey: Column<A>;
+  readonly cohortKey: Column<A>;
+  readonly snapshot: Column<A>;
+  readonly admittedAt: Column<A>;
+  readonly expiresAt: Column<A>;
+  readonly version: Column<A>;
+  readonly encodeInsert: (input: {
+    readonly admissionId: string;
+    readonly grant: M.OAuthConnectedStoredGrant;
+    readonly authorization: M.OAuthConnectedUseAuthorization;
+    readonly subjectId: N;
+  }) => A["insert"];
+}
+export interface OAuthConnectedCommandTable<C extends TableModel, N> {
+  readonly table: C["table"];
+  readonly moduleId: Column<C>;
+  readonly commandId: Column<C>;
+  readonly subjectId: Column<C>;
+  readonly grantId: Column<C>;
+  readonly intent: Column<C>;
+  readonly decision: Column<C>;
+  readonly retentionUntil: Column<C>;
+  readonly version: Column<C>;
+  readonly encodeInsert: (input: {
+    readonly commandId: string;
+    readonly grant: M.OAuthConnectedDisconnectGrant;
+    readonly subjectId: N;
+  }) => C["insert"];
+}
+export interface OAuthConnectedRevocationJobTable<J extends TableModel, N> {
+  readonly table: J["table"];
+  readonly jobId: Column<J>;
+  readonly moduleId: Column<J>;
+  readonly subjectId: Column<J>;
+  readonly identityKey: Column<J>;
+  readonly clientKey: Column<J>;
+  readonly cohortKey: Column<J>;
+  readonly grantId: Column<J>;
+  readonly snapshot: Column<J>;
+  readonly state: Column<J>;
+  readonly claimId: Column<J>;
+  readonly claimedAt: Column<J>;
+  readonly claimExpiresAt: Column<J>;
+  readonly retentionUntil: Column<J>;
+  readonly version: Column<J>;
+  readonly encodeInsert: (input: {
+    readonly job: M.OAuthConnectedRevocationJob;
+    readonly subjectId: N;
+  }) => J["insert"];
+}
+export type OAuthConnectedPolicyInput<N> = {
+  readonly subjectId: N;
+  readonly revision: OAuthAccountRevision;
+} & ({
+  readonly kind: "action";
+  readonly operation: "issue" | "claim" | "settle" | "disconnect";
+  readonly authorization: M.OAuthConnectedActionAuthorization;
+  readonly configuration: M.OAuthConnectedConfiguration;
+  readonly grant?: M.OAuthConnectedTokenContext;
+} | {
+  readonly kind: "sign-in";
+  readonly credential: M.OAuthCredentialSnapshot;
+  readonly configuration: M.OAuthConnectedConfiguration;
+  readonly grant?: M.OAuthConnectedTokenContext;
+} | {
+  readonly kind: "metadata" | "use";
+  readonly authorization: M.OAuthConnectedUseAuthorization;
+  readonly grant?: M.OAuthConnectedTokenContext;
+});
+export interface OAuthConnectedPolicyGuardTable<T extends TableModel, N, Expression extends SqlExpression = SqlExpression> {
+  readonly table: T["table"];
+  readonly orderBy: Column<T>;
+  readonly condition: (input: OAuthConnectedPolicyInput<N>) => Expression;
+}
+export interface OAuthConnectedPolicyGuard<N, Expression extends SqlExpression = SqlExpression, Descriptor extends object = object> {
+  readonly table: Descriptor;
+  readonly orderBy: string;
+  readonly condition: (input: OAuthConnectedPolicyInput<N>) => Expression;
+}
+export declare const oauthConnectedPolicyGuard: <T extends TableModel, N, Expression extends SqlExpression = SqlExpression>(input: OAuthConnectedPolicyGuardTable<T, N, Expression>) => OAuthConnectedPolicyGuard<N, Expression, T["table"]>;
+export interface OAuthConnectedSqlPolicy<N, Expression extends SqlExpression = SqlExpression, Descriptor extends object = object> {
+  /** Up to 32 scopes, each selecting 1..64 stable rows in global lock order.
+   * Omit only when subject/shared authority locks already serialize every mutable
+   * policy dependency or policy is immutable. All writers follow that order. */
+  readonly guards?: ReadonlyArray<OAuthConnectedPolicyGuard<N, Expression, Descriptor>>;
+  /** Recheck exact policy revision, purpose, optional grant/profile restrictions
+   * and current profile/permissions; joins and absence assumptions are authority.
+   * The engine checks this before and after every owner/application write. */
+  readonly condition: (input: OAuthConnectedPolicyInput<N>) => Expression;
+}
+export declare const requiredOAuthConnectedConstraints: {
+  readonly flow: "unique(connectedFlow.moduleId,connectedFlow.flowId)";
+  readonly flowCommand: "unique(connectedFlow.moduleId,connectedFlow.commandId)";
+  readonly stateDigest: "unique(connectedFlow.stateDigest)";
+  readonly client: "unique(connectedClient.clientKey)";
+  readonly cohort: "unique(connectedCohort.cohortKey)";
+  readonly grant: "unique(connectedGrant.moduleId,connectedGrant.grantId)";
+  readonly grantIdentity: "unique(connectedGrant.moduleId,connectedGrant.subjectId,connectedGrant.profileKey,connectedGrant.activeIdentityKey)";
+  readonly admission: "unique(connectedAdmission.admissionId)";
+  readonly command: "unique(connectedCommand.moduleId,connectedCommand.commandId)";
+};
+export declare const requiredOAuthConnectedRevocationConstraints: {
+  readonly job: "unique(connectedRevocation.jobId)";
+};
+/** Existing ownership only; workers never allocate or acquire a tuple. */
+export type OAuthConnectedOwnershipRead<T extends TableModel, O extends TableModel, N, Expression extends SqlExpression = SqlExpression> = {
+  readonly mode: "integrated";
+  readonly tuple: Omit<OAuthOwnershipMutation<T, O, N, Expression>["tuple"], "encodeInsert">;
+} | {
+  readonly mode: "separate";
+  readonly tuple: Omit<OAuthOwnershipMutation<T, O, N, Expression>["tuple"], "encodeInsert">;
+  readonly external: Omit<Extract<OAuthOwnershipMutation<T, O, N, Expression>, {
+    readonly mode: "separate";
+  }>["external"], "encodeInsert">;
+};
+export interface OAuthConnectedAuthorityMapping<T extends TableModel, O extends TableModel, F extends TableModel, G extends TableModel, C extends TableModel, H extends TableModel, N, Expression extends SqlExpression = SqlExpression> {
+  readonly ownership: OAuthConnectedOwnershipRead<T, O, N, Expression>;
+  readonly subjectId: SubjectIdCodec<N>;
+  readonly flow: Omit<OAuthConnectedFlowTable<F, N>, "encodeInsert">;
+  readonly grant: Omit<OAuthConnectedGrantTable<G, N>, "encodeInsert">;
+  readonly client: Omit<OAuthConnectedClientRegistrationTable<C>, "encodeInsert">;
+  readonly cohort: Omit<OAuthConnectedCohortTable<H>, "encodeInsert">;
+  readonly clock: OAuthClock<Expression>;
+  readonly order: OAuthConnectedOrderCodec;
+  readonly tupleConstraints: typeof requiredOAuthTupleConstraints;
+  /** Safe metadata retention, never an expiry/quiescence proof for unresolved work. */
+  readonly retentionMillis: number;
+}
+export interface OAuthConnectedMapping<S extends TableModel, AC extends TableModel, T extends TableModel, O extends TableModel, F extends TableModel, G extends TableModel, C extends TableModel, H extends TableModel, A extends TableModel, D extends TableModel, N, J extends TableModel = never, Expression extends SqlExpression = SqlExpression, Descriptor extends object = object, SignIn extends TableModel = TableModel> extends OAuthConnectedAuthorityMapping<T, O, F, G, C, H, N, Expression> {
+  readonly ownership: OAuthOwnershipMutation<T, O, N, Expression>;
+  readonly flow: OAuthConnectedFlowTable<F, N>;
+  readonly grant: OAuthConnectedGrantTable<G, N>;
+  readonly client: OAuthConnectedClientRegistrationTable<C>;
+  readonly cohort: OAuthConnectedCohortTable<H>;
+  readonly subject: OAuthConnectedSubjectTable<S, Expression>;
+  readonly authority: OAuthAuthorityReadTable<AC, Expression>;
+  readonly admission: OAuthConnectedAdmissionTable<A, N>;
+  /** Same shared sign-in tables used by OAuthSignInPersistence. Enable only
+   * alongside a nullable connected-flow subjectId and flow.encodeSignIn. */
+  readonly signIn?: {
+    readonly credential: OAuthCredentialReadTable<SignIn, Expression>;
+    readonly flow: OAuthFlowTable<SignIn>;
+  };
+  readonly command: OAuthConnectedCommandTable<D, N>;
+  readonly policy: OAuthConnectedSqlPolicy<N, Expression, Descriptor>;
+  readonly constraints: typeof requiredOAuthConnectedConstraints;
+  readonly revocation: {
+    readonly mode: "unsupported";
+  } | {
+    readonly mode: "cohort";
+    readonly job: OAuthConnectedRevocationJobTable<J, N>;
+    readonly constraints: typeof requiredOAuthConnectedRevocationConstraints;
+  };
+  /** Without an authoritative same-owner predicate, conservatively retain Owned.
+   * Include login/other installed references; never filter away former-subject
+   * work. This pure SQL constructor supports both bound values and correlated
+   * column expressions with identical semantics; it performs no I/O.
+   * Compare through the reference table's typed columns (for example, eq) so
+   * native values use their encoders. Back the same-owner lookup with an index:
+   * discovery applies this predicate before its candidate limit.
+   * Connected references are checked separately. */
+  readonly externalReference?: (input: {
+    readonly identityKey: string;
+    readonly subjectId: N;
+  } | {
+    readonly identityKey: Expression;
+    readonly subjectId: Expression;
+  }) => Expression;
+}
+export interface OAuthConnectedRevocationMapping<T extends TableModel, O extends TableModel, F extends TableModel, G extends TableModel, C extends TableModel, H extends TableModel, J extends TableModel, N, Expression extends SqlExpression = SqlExpression> extends OAuthConnectedAuthorityMapping<T, O, F, G, C, H, N, Expression> {
+  readonly job: Omit<OAuthConnectedRevocationJobTable<J, N>, "encodeInsert">;
+  readonly constraints: typeof requiredOAuthConnectedRevocationConstraints;
+}
+//#endregion
+export { oauth_connected_model_d_exports };
+//# sourceMappingURL=oauth-connected-model.d.mts.map

package/dist/internal/models/oauth-connected-model.mjs

@@ -0,0 +1,22 @@
+//#region src/internal/models/oauth-connected-model.ts
+const oauthConnectedPolicyGuard = (input) => Object.freeze({
+	table: input.table,
+	orderBy: input.orderBy,
+	condition: input.condition
+});
+const requiredOAuthConnectedConstraints = {
+	flow: "unique(connectedFlow.moduleId,connectedFlow.flowId)",
+	flowCommand: "unique(connectedFlow.moduleId,connectedFlow.commandId)",
+	stateDigest: "unique(connectedFlow.stateDigest)",
+	client: "unique(connectedClient.clientKey)",
+	cohort: "unique(connectedCohort.cohortKey)",
+	grant: "unique(connectedGrant.moduleId,connectedGrant.grantId)",
+	grantIdentity: "unique(connectedGrant.moduleId,connectedGrant.subjectId,connectedGrant.profileKey,connectedGrant.activeIdentityKey)",
+	admission: "unique(connectedAdmission.admissionId)",
+	command: "unique(connectedCommand.moduleId,connectedCommand.commandId)"
+};
+const requiredOAuthConnectedRevocationConstraints = { job: "unique(connectedRevocation.jobId)" };
+//#endregion
+export { oauthConnectedPolicyGuard, requiredOAuthConnectedConstraints, requiredOAuthConnectedRevocationConstraints };
+
+//# sourceMappingURL=oauth-connected-model.mjs.map

package/dist/internal/models/oauth-connected-model.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-connected-model.mjs","names":[],"sources":["../../../src/internal/models/oauth-connected-model.ts"],"sourcesContent":["import type { OAuthAccountRevision } from \"@yielded/auth/OAuth\";\nimport type * as M from \"@yielded/auth/OAuth\";\nimport type { AuthenticationRequirement } from \"@yielded/auth/Sessions\";\n\nimport type { TableModel as Table, SqlExpression } from \"../query-operations\";\nimport type { SubjectIdCodec } from \"./common\";\nimport type {\n  OAuthAuthorityReadTable,\n  OAuthClock,\n  OAuthCredentialReadTable,\n  OAuthFlowTable,\n  OAuthOwnershipMutation,\n  OAuthSubjectReadTable,\n  requiredOAuthTupleConstraints,\n} from \"./oauth-model\";\n\ntype Column<T extends Table> = T[\"column\"];\nexport type OAuthConnectedAction = M.OAuthConnectedActionChallenge[\"action\"];\n\nexport interface OAuthConnectedSubjectTable<\n  S extends Table,\n  Expression extends SqlExpression = SqlExpression,\n> extends OAuthSubjectReadTable<S, Expression> {\n  readonly decodeActionRequirement: (\n    row: S[\"select\"],\n    action: OAuthConnectedAction,\n  ) => AuthenticationRequirement;\n}\n\n/** All mapped order columns use exact SQL integer comparison through 2^53-1.\n * These codecs bridge driver representations, not alternative ordering rules. */\nexport interface OAuthConnectedOrderCodec {\n  readonly encode: (order: number) => unknown;\n  readonly decode: (value: unknown) => number;\n}\n\nexport interface OAuthConnectedFlowTable<F extends Table, N> {\n  readonly table: F[\"table\"];\n  readonly moduleId: Column<F>;\n  readonly flowId: Column<F>;\n  readonly commandId: Column<F>;\n  readonly subjectId: Column<F>;\n  readonly clientKey: Column<F>;\n  readonly cohortKey: Column<F>;\n  readonly state: Column<F>;\n  readonly version: Column<F>;\n  readonly stateDigest: Column<F>;\n  readonly snapshot: Column<F>;\n  readonly claimId: Column<F>;\n  readonly claimDigest: Column<F>;\n  readonly claimOrder: Column<F>;\n  readonly claimedAt: Column<F>;\n  readonly claimExpiresAt: Column<F>;\n  readonly expiresAt: Column<F>;\n  readonly retentionUntil: Column<F>;\n  /** None before claim, Unresolved after claim, Resolved only after definite\n   * cancellation or atomic transfer to a grant/job. Never reset by cleanup. */\n  readonly work: Column<F>;\n  /** Exact sealed quarantine when no correctly sealed revocation job is available. */\n  readonly custody: Column<F>;\n  /** Required when retaining grants during sign-in. subjectId is NULL until\n   * identity resolution; custom required columns are supplied by this encoder. */\n  readonly encodeSignIn?: (reservation: M.OAuthSignInAccessClaim) => F[\"insert\"];\n  readonly encodeInsert: (input: {\n    readonly flow: M.OAuthConnectedPendingFlow;\n    readonly subjectId: N;\n  }) => F[\"insert\"];\n}\n\nexport interface OAuthConnectedGrantTable<G extends Table, N> {\n  readonly table: G[\"table\"];\n  readonly moduleId: Column<G>;\n  readonly grantId: Column<G>;\n  readonly subjectId: Column<G>;\n  readonly identityKey: Column<G>;\n  /** Nullable unique active slot; historical/disconnected records use null. */\n  readonly activeIdentityKey: Column<G>;\n  readonly clientKey: Column<G>;\n  readonly cohortKey: Column<G>;\n  readonly profileKey: Column<G>;\n  readonly grantVersion: Column<G>;\n  readonly tokenVersion: Column<G>;\n  readonly cohortGeneration: Column<G>;\n  readonly state: Column<G>;\n  readonly version: Column<G>;\n  readonly context: Column<G>;\n  readonly sealed: Column<G>;\n  /** Canonical OAuthConnectedSummary only: list never loads token envelopes. */\n  readonly summary: Column<G>;\n  readonly revocationJobId: Column<G>;\n  readonly refreshWork: Column<G>;\n  readonly refreshClaim: Column<G>;\n  readonly refreshClaimExpiresAt: Column<G>;\n  readonly retentionUntil: Column<G>;\n  readonly encodeInsert: (input: {\n    readonly grant: M.OAuthConnectedStoredGrant;\n    readonly subjectId: N;\n  }) => G[\"insert\"];\n}\n\n/** Also stores a permanent provider/issuer scope anchor. clientKey must fit 52\n * ASCII characters. Empty clientRegistrationId is reserved for that anchor;\n * actual profile registrations are nonempty. Scope counter stays zero. */\nexport interface OAuthConnectedClientRegistrationTable<C extends Table> {\n  readonly table: C[\"table\"];\n  readonly clientKey: Column<C>;\n  readonly provider: Column<C>;\n  readonly issuer: Column<C>;\n  readonly clientRegistrationId: Column<C>;\n  readonly counter: Column<C>;\n  readonly version: Column<C>;\n  readonly encodeInsert: (configuration: M.OAuthConnectedConfiguration) => C[\"insert\"];\n}\n\n/** Remote authority: no local-subject column or subject-scoped key. Retain this\n * anchor/cutoff when a legitimately released tuple gains a different local owner. */\nexport interface OAuthConnectedCohortTable<C extends Table> {\n  readonly table: C[\"table\"];\n  readonly cohortKey: Column<C>;\n  readonly clientKey: Column<C>;\n  readonly identityKey: Column<C>;\n  readonly generation: Column<C>;\n  readonly cutoff: Column<C>;\n  readonly state: Column<C>;\n  readonly version: Column<C>;\n  readonly encodeInsert: (input: {\n    readonly clientKey: string;\n    readonly identityKey: string;\n  }) => C[\"insert\"];\n}\n\nexport interface OAuthConnectedAdmissionTable<A extends Table, N> {\n  readonly table: A[\"table\"];\n  readonly admissionId: Column<A>;\n  readonly moduleId: Column<A>;\n  readonly grantId: Column<A>;\n  readonly subjectId: Column<A>;\n  readonly identityKey: Column<A>;\n  readonly clientKey: Column<A>;\n  readonly cohortKey: Column<A>;\n  readonly snapshot: Column<A>;\n  readonly admittedAt: Column<A>;\n  readonly expiresAt: Column<A>;\n  readonly version: Column<A>;\n  readonly encodeInsert: (input: {\n    readonly admissionId: string;\n    readonly grant: M.OAuthConnectedStoredGrant;\n    readonly authorization: M.OAuthConnectedUseAuthorization;\n    readonly subjectId: N;\n  }) => A[\"insert\"];\n}\n\nexport interface OAuthConnectedCommandTable<C extends Table, N> {\n  readonly table: C[\"table\"];\n  readonly moduleId: Column<C>;\n  readonly commandId: Column<C>;\n  readonly subjectId: Column<C>;\n  readonly grantId: Column<C>;\n  readonly intent: Column<C>;\n  readonly decision: Column<C>;\n  readonly retentionUntil: Column<C>;\n  readonly version: Column<C>;\n  readonly encodeInsert: (input: {\n    readonly commandId: string;\n    readonly grant: M.OAuthConnectedDisconnectGrant;\n    readonly subjectId: N;\n  }) => C[\"insert\"];\n}\n\nexport interface OAuthConnectedRevocationJobTable<J extends Table, N> {\n  readonly table: J[\"table\"];\n  readonly jobId: Column<J>;\n  readonly moduleId: Column<J>;\n  readonly subjectId: Column<J>;\n  readonly identityKey: Column<J>;\n  readonly clientKey: Column<J>;\n  readonly cohortKey: Column<J>;\n  readonly grantId: Column<J>;\n  readonly snapshot: Column<J>;\n  readonly state: Column<J>;\n  readonly claimId: Column<J>;\n  readonly claimedAt: Column<J>;\n  readonly claimExpiresAt: Column<J>;\n  readonly retentionUntil: Column<J>;\n  readonly version: Column<J>;\n  readonly encodeInsert: (input: {\n    readonly job: M.OAuthConnectedRevocationJob;\n    readonly subjectId: N;\n  }) => J[\"insert\"];\n}\n\nexport type OAuthConnectedPolicyInput<N> = {\n  readonly subjectId: N;\n  readonly revision: OAuthAccountRevision;\n} & (\n  | {\n      readonly kind: \"action\";\n      readonly operation: \"issue\" | \"claim\" | \"settle\" | \"disconnect\";\n      readonly authorization: M.OAuthConnectedActionAuthorization;\n      readonly configuration: M.OAuthConnectedConfiguration;\n      readonly grant?: M.OAuthConnectedTokenContext;\n    }\n  | {\n      readonly kind: \"sign-in\";\n      readonly credential: M.OAuthCredentialSnapshot;\n      readonly configuration: M.OAuthConnectedConfiguration;\n      readonly grant?: M.OAuthConnectedTokenContext;\n    }\n  | {\n      readonly kind: \"metadata\" | \"use\";\n      readonly authorization: M.OAuthConnectedUseAuthorization;\n      readonly grant?: M.OAuthConnectedTokenContext;\n    }\n);\n\nexport interface OAuthConnectedPolicyGuardTable<\n  T extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: T[\"table\"];\n  readonly orderBy: Column<T>;\n  readonly condition: (input: OAuthConnectedPolicyInput<N>) => Expression;\n}\n\nexport interface OAuthConnectedPolicyGuard<\n  N,\n  Expression extends SqlExpression = SqlExpression,\n  Descriptor extends object = object,\n> {\n  readonly table: Descriptor;\n  readonly orderBy: string;\n  readonly condition: (input: OAuthConnectedPolicyInput<N>) => Expression;\n}\n\nexport const oauthConnectedPolicyGuard = <\n  T extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n>(\n  input: OAuthConnectedPolicyGuardTable<T, N, Expression>,\n): OAuthConnectedPolicyGuard<N, Expression, T[\"table\"]> =>\n  Object.freeze({\n    table: input.table,\n    orderBy: input.orderBy,\n    condition: input.condition,\n  });\n\nexport interface OAuthConnectedSqlPolicy<\n  N,\n  Expression extends SqlExpression = SqlExpression,\n  Descriptor extends object = object,\n> {\n  /** Up to 32 scopes, each selecting 1..64 stable rows in global lock order.\n   * Omit only when subject/shared authority locks already serialize every mutable\n   * policy dependency or policy is immutable. All writers follow that order. */\n  readonly guards?: ReadonlyArray<OAuthConnectedPolicyGuard<N, Expression, Descriptor>>;\n  /** Recheck exact policy revision, purpose, optional grant/profile restrictions\n   * and current profile/permissions; joins and absence assumptions are authority.\n   * The engine checks this before and after every owner/application write. */\n  readonly condition: (input: OAuthConnectedPolicyInput<N>) => Expression;\n}\n\nexport const requiredOAuthConnectedConstraints = {\n  flow: \"unique(connectedFlow.moduleId,connectedFlow.flowId)\",\n  flowCommand: \"unique(connectedFlow.moduleId,connectedFlow.commandId)\",\n  stateDigest: \"unique(connectedFlow.stateDigest)\",\n  client: \"unique(connectedClient.clientKey)\",\n  cohort: \"unique(connectedCohort.cohortKey)\",\n  grant: \"unique(connectedGrant.moduleId,connectedGrant.grantId)\",\n  grantIdentity:\n    \"unique(connectedGrant.moduleId,connectedGrant.subjectId,connectedGrant.profileKey,connectedGrant.activeIdentityKey)\",\n  admission: \"unique(connectedAdmission.admissionId)\",\n  command: \"unique(connectedCommand.moduleId,connectedCommand.commandId)\",\n} as const;\n\nexport const requiredOAuthConnectedRevocationConstraints = {\n  job: \"unique(connectedRevocation.jobId)\",\n} as const;\n\n/** Existing ownership only; workers never allocate or acquire a tuple. */\nexport type OAuthConnectedOwnershipRead<\n  T extends Table,\n  O extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> =\n  | {\n      readonly mode: \"integrated\";\n      readonly tuple: Omit<OAuthOwnershipMutation<T, O, N, Expression>[\"tuple\"], \"encodeInsert\">;\n    }\n  | {\n      readonly mode: \"separate\";\n      readonly tuple: Omit<OAuthOwnershipMutation<T, O, N, Expression>[\"tuple\"], \"encodeInsert\">;\n      readonly external: Omit<\n        Extract<\n          OAuthOwnershipMutation<T, O, N, Expression>,\n          { readonly mode: \"separate\" }\n        >[\"external\"],\n        \"encodeInsert\"\n      >;\n    };\n\nexport interface OAuthConnectedAuthorityMapping<\n  T extends Table,\n  O extends Table,\n  F extends Table,\n  G extends Table,\n  C extends Table,\n  H extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly ownership: OAuthConnectedOwnershipRead<T, O, N, Expression>;\n  readonly subjectId: SubjectIdCodec<N>;\n  readonly flow: Omit<OAuthConnectedFlowTable<F, N>, \"encodeInsert\">;\n  readonly grant: Omit<OAuthConnectedGrantTable<G, N>, \"encodeInsert\">;\n  readonly client: Omit<OAuthConnectedClientRegistrationTable<C>, \"encodeInsert\">;\n  readonly cohort: Omit<OAuthConnectedCohortTable<H>, \"encodeInsert\">;\n  readonly clock: OAuthClock<Expression>;\n  readonly order: OAuthConnectedOrderCodec;\n  readonly tupleConstraints: typeof requiredOAuthTupleConstraints;\n  /** Safe metadata retention, never an expiry/quiescence proof for unresolved work. */\n  readonly retentionMillis: number;\n}\n\nexport interface OAuthConnectedMapping<\n  S extends Table,\n  AC extends Table,\n  T extends Table,\n  O extends Table,\n  F extends Table,\n  G extends Table,\n  C extends Table,\n  H extends Table,\n  A extends Table,\n  D extends Table,\n  N,\n  J extends Table = never,\n  Expression extends SqlExpression = SqlExpression,\n  Descriptor extends object = object,\n  SignIn extends Table = Table,\n> extends OAuthConnectedAuthorityMapping<T, O, F, G, C, H, N, Expression> {\n  readonly ownership: OAuthOwnershipMutation<T, O, N, Expression>;\n  readonly flow: OAuthConnectedFlowTable<F, N>;\n  readonly grant: OAuthConnectedGrantTable<G, N>;\n  readonly client: OAuthConnectedClientRegistrationTable<C>;\n  readonly cohort: OAuthConnectedCohortTable<H>;\n  readonly subject: OAuthConnectedSubjectTable<S, Expression>;\n  readonly authority: OAuthAuthorityReadTable<AC, Expression>;\n  readonly admission: OAuthConnectedAdmissionTable<A, N>;\n  /** Same shared sign-in tables used by OAuthSignInPersistence. Enable only\n   * alongside a nullable connected-flow subjectId and flow.encodeSignIn. */\n  readonly signIn?: {\n    readonly credential: OAuthCredentialReadTable<SignIn, Expression>;\n    readonly flow: OAuthFlowTable<SignIn>;\n  };\n  readonly command: OAuthConnectedCommandTable<D, N>;\n  readonly policy: OAuthConnectedSqlPolicy<N, Expression, Descriptor>;\n  readonly constraints: typeof requiredOAuthConnectedConstraints;\n  readonly revocation:\n    | { readonly mode: \"unsupported\" }\n    | {\n        readonly mode: \"cohort\";\n        readonly job: OAuthConnectedRevocationJobTable<J, N>;\n        readonly constraints: typeof requiredOAuthConnectedRevocationConstraints;\n      };\n  /** Without an authoritative same-owner predicate, conservatively retain Owned.\n   * Include login/other installed references; never filter away former-subject\n   * work. This pure SQL constructor supports both bound values and correlated\n   * column expressions with identical semantics; it performs no I/O.\n   * Compare through the reference table's typed columns (for example, eq) so\n   * native values use their encoders. Back the same-owner lookup with an index:\n   * discovery applies this predicate before its candidate limit.\n   * Connected references are checked separately. */\n  readonly externalReference?: (\n    input:\n      | { readonly identityKey: string; readonly subjectId: N }\n      | { readonly identityKey: Expression; readonly subjectId: Expression },\n  ) => Expression;\n}\n\nexport interface OAuthConnectedRevocationMapping<\n  T extends Table,\n  O extends Table,\n  F extends Table,\n  G extends Table,\n  C extends Table,\n  H extends Table,\n  J extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> extends OAuthConnectedAuthorityMapping<T, O, F, G, C, H, N, Expression> {\n  readonly job: Omit<OAuthConnectedRevocationJobTable<J, N>, \"encodeInsert\">;\n  readonly constraints: typeof requiredOAuthConnectedRevocationConstraints;\n}\n"],"mappings":";AA2OA,MAAa,6BAKX,UAEA,OAAO,OAAO;CACZ,OAAO,MAAM;CACb,SAAS,MAAM;CACf,WAAW,MAAM;AACnB,CAAC;AAiBH,MAAa,oCAAoC;CAC/C,MAAM;CACN,aAAa;CACb,aAAa;CACb,QAAQ;CACR,QAAQ;CACR,OAAO;CACP,eACE;CACF,WAAW;CACX,SAAS;AACX;AAEA,MAAa,8CAA8C,EACzD,KAAK,oCACP"}