@yielded/auth-persistence 0.1.0-beta.22 → 0.1.0-beta.24

package/src/internal/persistence.ts

@@ -29,6 +29,7 @@ import {
 import { randomId } from "./crypto";
 import { makeEmailKernel, CurrentEmailSql, type EmailSqlDatabase } from "./email-kernel";
 import { PersistenceMappingError } from "./mapping-error";
+import type { NativeSqlTables } from "./native-sql-table";
 import {
   makePasswordKernel,
   CurrentPasswordSql,
@@ -69,6 +70,7 @@ export interface Backend<T extends object, R> {
   readonly describe: (table: T) => StorageTable;
   readonly acquire: Effect.Effect<object, PersistenceConfigurationError, R | SqlClient.SqlClient>;
   readonly operations: QueryOperations;
+  readonly nativeTables: (client: SqlClient.SqlClient, database: object) => NativeSqlTables;
   readonly passkeys: (input: {
     readonly storage: MappingInput;
     readonly namespace: string;
@@ -112,9 +114,9 @@ export const createPersistence = <T extends object, R>(
   backend: Backend<T, R>,
 ): PersistenceApi<T, R> => {
   const proofKernel = makeProofKernel(backend.operations);
-  const passwordKernel = makePasswordKernel(backend.operations, proofKernel);
+  const passwordKernel = makePasswordKernel(backend.operations, proofKernel, backend.nativeTables);
   const emailKernel = makeEmailKernel(backend.operations, proofKernel);
-  const sessionKernel = makeSessionKernel(backend.operations);
+  const sessionKernel = makeSessionKernel(backend.operations, backend.nativeTables);
   const transactionKernel = makeTransactionKernel(backend.operations);
   const executionKernel = makeTransactionExecutionKernel(transactionKernel);
   const phoneKernel = makePhoneKernel(backend.operations, transactionKernel);
@@ -139,14 +141,7 @@ export const createPersistence = <T extends object, R>(
 
     const roles: StorageRole[] = ["identifiers", "credentials", "sessions", "sessionFlows"];
 
-    if (password)
-      roles.push(
-        "passwords",
-        "passwordAttempts",
-        "passwordScopes",
-        "passwordCharges",
-        "passwordCommands",
-      );
+    if (password) roles.push("passwords", "passwordCommands");
     if (management) roles.push("passwordRegistrations");
     if (email) roles.push("emailCredentials", "emailCommands");
     if (phone) roles.push("phoneState");

package/src/internal/query-operations.ts

@@ -60,10 +60,12 @@ export interface QueryOperations<
   readonly balancedD1And: Predicate<Fragment>;
   readonly asc: (value: unknown) => Fragment;
   readonly eq: Comparison<Fragment>;
+  readonly ne: Comparison<Fragment>;
   readonly gt: Comparison<Fragment>;
   readonly gte: Comparison<Fragment>;
   readonly lte: Comparison<Fragment>;
   readonly inArray: (value: unknown, values: ReadonlyArray<unknown>) => Fragment;
+  readonly isNotNull: (value: unknown) => Fragment;
   readonly isNull: (value: unknown) => Fragment;
   readonly notExists: (value: SqlExpression) => Fragment;
   readonly sql: {

package/src/internal/session-kernel.ts

@@ -8,6 +8,7 @@ import { reportPersistenceFailure } from "@yielded/auth/Persistence";
 import type { SubjectId, TokenDigest } from "@yielded/auth/Schema";
 import {
   assessAuthentication,
+  AuthenticationCapture,
   snapshotSessionAuthenticationProvenance,
   PendingAuthenticationInvalid,
   SessionConflict,
@@ -36,8 +37,10 @@ import {
   type SessionStepUpPersistence,
 } from "@yielded/auth/Sessions";
 import { Cause, Context, DateTime, Effect, Option, Schema } from "effect";
+import type { SqlClient } from "effect/sql/SqlClient";
 import type * as SqlError from "effect/sql/SqlError";
 
+import { makeAuthoritySnapshot } from "./authority-snapshot";
 import { PersistenceMappingError, isMappedConstraintConflict } from "./mapping-error";
 import type {
   AuthenticationAuthorityMapping,
@@ -50,6 +53,7 @@ import type {
   StatefulSessionMapping,
 } from "./models/session-model";
 import type { SessionStepUpMapping } from "./models/step-up-model";
+import { makeNativeSqlTables, sqlMapping, type NativeSqlTables } from "./native-sql-table";
 /* oxlint-disable no-explicit-any -- existing storage kernels erase foreign table shapes; domain errors remain typed. */
 import type { QueryFailure } from "./query-operations";
 import type { QueryOperations } from "./query-operations";
@@ -61,7 +65,21 @@ import {
   validateStepUpPlan,
   stepUpRotationMatches,
 } from "./step-up-state";
-import type { NativeDatabase } from "./transaction-kernel";
+import { canJoinTextColumns } from "./storage-validation";
+import { NativeDatabase } from "./transaction-kernel";
+
+const decodeRevocationFlag = Schema.decodeUnknownEffect(Schema.Literals([0, 1]));
+
+/** Reads need no transaction of their own. A caller-owned transaction still
+ * needs a savepoint so catching an SQL failure does not leave it aborted. */
+const withVerificationSavepoint = Effect.fnUntraced(function* <A, E, R>(
+  effect: Effect.Effect<A, E, R>,
+): Effect.fn.Return<A, E | SqlError.SqlError, R | NativeDatabase> {
+  const { $client } = yield* NativeDatabase;
+  const transaction = yield* Effect.serviceOption($client.transactionService);
+
+  return yield* Option.isSome(transaction) ? $client.withTransaction(effect) : effect;
+});
 
 type CommitMode = "interactive" | "synchronous";
 
@@ -139,7 +157,11 @@ type SqlStepUpRejectAbsence = SessionStepUpInvalid | StaleAuthentication;
 
 type SqlStepUpReadFailure = AdapterFailure | SqlStepUpRejectAbsence | SessionUnavailable;
 
-export const makeSessionKernel = (operations: QueryOperations) => {
+export const makeSessionKernel = (
+  operations: QueryOperations,
+  nativeTables: (client: SqlClient, database: object) => NativeSqlTables = (client) =>
+    makeNativeSqlTables(client),
+) => {
   const { and, eq, gt, lte, inArray, or, sql, column, updateValues } = operations;
   const unavailable = () => SessionUnavailable.make({});
 
@@ -396,15 +418,6 @@ export const makeSessionKernel = (operations: QueryOperations) => {
     };
   });
 
-  const captureIn = Effect.fn("DrizzleSession.capture")(function* (
-    mapping: AnyAuthorityMapping,
-    subjectId: SubjectId,
-    credentialIds: ReadonlyArray<string>,
-    locking: boolean,
-  ) {
-    return (yield* captureDetailsIn(mapping, subjectId, credentialIds, locking)).revision;
-  });
-
   const validateEvidenceIn = Effect.fn("DrizzleSession.validateEvidence")(function* (
     mapping: AnyAuthorityMapping,
     evidence: AuthenticationEvidence,
@@ -417,6 +430,17 @@ export const makeSessionKernel = (operations: QueryOperations) => {
       locking,
     );
 
+    return yield* validateCapturedEvidence(mapping, evidence, captured);
+  });
+
+  const validateCapturedEvidence = Effect.fnUntraced(function* (
+    mapping: AnyAuthorityMapping,
+    evidence: AuthenticationEvidence,
+    captured: {
+      readonly subject: Record<string, unknown>;
+      readonly revision: AuthenticationRevision;
+    },
+  ) {
     if (
       captured.revision.securityRevision !== evidence.revision.securityRevision ||
       captured.revision.credentials.length !== evidence.revision.credentials.length ||
@@ -643,18 +667,37 @@ export const makeSessionKernel = (operations: QueryOperations) => {
       );
     const hooks = yield* LifecycleHooks;
 
+    const root = yield* NativeDatabase;
+    const sqlClient = root.$client.withoutTransforms();
+
+    const tables = yield* sqlMapping(() => nativeTables(sqlClient, root)).pipe(
+      Effect.mapError(unavailable),
+    );
+
+    const readSnapshot = makeAuthoritySnapshot(tables, mapping);
+
     const service = {
       capture: (subjectId: SubjectId, credentialIds: ReadonlyArray<string>) =>
         safeTransaction(
-          inTransaction(database, captureIn(mapping, subjectId, credentialIds, true)),
+          readSnapshot(subjectId, credentialIds).pipe(
+            Effect.flatMap((value) =>
+              Effect.flatMap(mapping.subject.decodeRequirement(value.subject), (requirement) =>
+                Schema.decodeEffect(AuthenticationCapture)({
+                  revision: value.revision,
+                  requirement,
+                }),
+              ),
+            ),
+          ),
         ),
       requirements: (evidence: AuthenticationEvidence) =>
         safeTransaction(
-          inTransaction(
-            database,
-            validateEvidenceIn(mapping, evidence, true).pipe(
-              Effect.map((result) => result.requirement),
-            ),
+          readSnapshot(
+            evidence.revision.subjectId,
+            evidence.revision.credentials.map((item) => item.credentialId),
+          ).pipe(
+            Effect.flatMap((captured) => validateCapturedEvidence(mapping, evidence, captured)),
+            Effect.map((value) => value.requirement),
           ),
         ),
       approve: <A>(
@@ -667,7 +710,20 @@ export const makeSessionKernel = (operations: QueryOperations) => {
           mapping.isConstraintConflict,
           Effect.gen(function* () {
             const journal = yield* CurrentCommitJournal;
-            const { requirement } = yield* validateEvidenceIn(mapping, input.evidence, true);
+
+            // With row locks, lock the subject before its credentials in separate
+            // reads: a joined FOR UPDATE does not fix that order on every table
+            // layout, and a coordinated application may already hold the subject
+            // lock. Without row locks one native snapshot is already serialized.
+            const { requirement } = yield* options.locking
+              ? validateEvidenceIn(mapping, input.evidence, true)
+              : Effect.flatMap(
+                  readSnapshot(
+                    input.evidence.revision.subjectId,
+                    input.evidence.revision.credentials.map((item) => item.credentialId),
+                  ),
+                  (captured) => validateCapturedEvidence(mapping, input.evidence, captured),
+                );
 
             if (input.pending === undefined) {
               const assessed = yield* assessAuthentication(input.evidence, requirement).pipe(
@@ -720,11 +776,24 @@ export const makeSessionKernel = (operations: QueryOperations) => {
       capture: (subjectId, credentialIds) =>
         service
           .capture(subjectId, credentialIds)
-          .pipe(Effect.provideService(LifecycleHooks, hooks)),
+          .pipe(
+            Effect.provideService(NativeDatabase, root),
+            Effect.provideService(LifecycleHooks, hooks),
+          ),
       requirements: (evidence) =>
-        service.requirements(evidence).pipe(Effect.provideService(LifecycleHooks, hooks)),
+        service
+          .requirements(evidence)
+          .pipe(
+            Effect.provideService(NativeDatabase, root),
+            Effect.provideService(LifecycleHooks, hooks),
+          ),
       approve: (input, prepare) =>
-        service.approve(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),
+        service
+          .approve(input, prepare)
+          .pipe(
+            Effect.provideService(NativeDatabase, root),
+            Effect.provideService(LifecycleHooks, hooks),
+          ),
     } satisfies AuthenticationAuthority["Service"];
   });
 
@@ -991,8 +1060,33 @@ export const makeSessionKernel = (operations: QueryOperations) => {
       );
     const hooks = yield* LifecycleHooks;
 
+    const root = yield* NativeDatabase;
+
+    const tables = yield* sqlMapping(() =>
+      nativeTables(root.$client.withoutTransforms(), root),
+    ).pipe(Effect.mapError(unavailable));
+
+    const readSnapshot = makeAuthoritySnapshot(tables, mapping);
     const c = sessionColumns(mapping);
 
+    const verification = yield* safeTransaction(
+      Effect.gen(function* () {
+        const { session, subject } = yield* sqlMapping(() => ({
+          session: tables(mapping.session.table).as("auth_session"),
+          subject: tables(mapping.subject.table).as("auth_subject"),
+        }));
+
+        const [sessionOwner, subjectOwner] = yield* sqlMapping(() => [
+          session.unencodedTextColumn?.(mapping.session.subjectId),
+          subject.unencodedTextColumn?.(mapping.subject.id),
+        ]);
+
+        const canJoinOwner = yield* canJoinTextColumns(sessionOwner, subjectOwner);
+
+        return { session, subject, canJoinOwner };
+      }),
+    );
+
     const persistence = {
       establish: <A>(
         input: Parameters<StatefulSessionPersistence<Claims>["establish"]>[0],
@@ -1006,23 +1100,29 @@ export const makeSessionKernel = (operations: QueryOperations) => {
             const transaction = yield* CurrentSessionSql;
             const journal = yield* CurrentCommitJournal;
 
-            const { nativeSubjectId, requirement } = yield* validateEvidenceIn(
-              mapping,
-              input.evidence,
-              true,
-            );
+            // Ordered locks with row locks; one serialized snapshot without (see approve).
+            const { nativeSubjectId, requirement } = yield* options.locking
+              ? validateEvidenceIn(mapping, input.evidence, true)
+              : Effect.flatMap(
+                  readSnapshot(
+                    input.evidence.revision.subjectId,
+                    input.evidence.revision.credentials.map((item) => item.credentialId),
+                  ),
+                  (captured) => validateCapturedEvidence(mapping, input.evidence, captured),
+                );
 
             let flowInsert: unknown | undefined;
             let pendingExpiresAt: DateTime.Utc | undefined;
 
-            if (input.pending === undefined)
-              flowInsert = yield* ensureDirectFlowAvailable(
-                mapping,
-                input.evidence,
-                nativeSubjectId,
-                input.session.absoluteExpiresAt,
-              );
-            else {
+            if (input.pending === undefined) {
+              if (input.fresh !== true || input.handoffSourceSessionId !== undefined)
+                flowInsert = yield* ensureDirectFlowAvailable(
+                  mapping,
+                  input.evidence,
+                  nativeSubjectId,
+                  input.session.absoluteExpiresAt,
+                );
+            } else {
               if (mapping.pending === undefined) return yield* invalidPending();
               const pending = yield* validatePending(mapping, input.pending);
 
@@ -1080,7 +1180,7 @@ export const makeSessionKernel = (operations: QueryOperations) => {
 
             if (flowInsert !== undefined)
               yield* transaction.insert(mapping.flow.table).values(flowInsert);
-            else
+            else if (input.pending !== undefined)
               yield* consumePending(
                 { ...mapping, pending: mapping.pending! },
                 input.pending!,
@@ -1107,32 +1207,55 @@ export const makeSessionKernel = (operations: QueryOperations) => {
             return receipt;
           }).pipe(normalizeMutation(mapping)),
         ),
-      verify: (input: any) =>
+      verify: (input: Parameters<StatefulSessionPersistence<Claims>["verify"]>[0]) =>
         safeTransaction(
-          inTransaction(
-            database,
+          withVerificationSavepoint(
             Effect.gen(function* () {
-              const read = yield* CurrentSessionSql;
+              const sql = root.$client.withoutTransforms();
+              const { session, subject, canJoinOwner } = verification;
 
-              const rows = yield* read
-                .select()
-                .from(mapping.session.table)
-                .where(eq(c.digest, input.digest))
-                .limit(1);
+              // A digest carries no owner. Custom codecs require decoding that
+              // native ID first; never compare differently encoded ID columns.
+              const owner = canJoinOwner
+                ? undefined
+                : (yield* database
+                    .select({ subjectId: c.subjectId })
+                    .from(mapping.session.table)
+                    .where(eq(c.digest, input.digest))
+                    .limit(1))[0];
+
+              if (!canJoinOwner && owner === undefined) return yield* invalidSession();
+
+              // The final statement reads both rows even after owner discovery,
+              // so deletion, rotation or owner changes cannot reuse the first read.
+              const rows = yield* sqlMapping(
+                () => sql<
+                  Record<string, unknown>
+                >`select ${session.fields("v_")}, ${subject.fields("s_")}
+              from ${session.name} inner join ${subject.name} on
+                ${subject.column(mapping.subject.id)} = ${
+                  owner === undefined
+                    ? session.column(mapping.session.subjectId)
+                    : subject.value(mapping.subject.id, owner.subjectId)
+                }
+              where ${session.column(mapping.session.digest)} = ${session.value(mapping.session.digest, input.digest)}
+              limit 1`,
+              ).pipe(Effect.flatten);
 
               const row = rows[0];
 
               if (row === undefined) return yield* invalidSession();
-              const record = yield* mapping.session.decode(row);
+              const sessionRow = yield* sqlMapping(() => session.decode(row, "v_"));
+              const subjectRow = yield* sqlMapping(() => subject.decode(row, "s_"));
+              const record = yield* mapping.session.decode(sessionRow);
               const nativeSubjectId = yield* mapping.subjectId.toNative(record.subjectId);
-              const subjects = yield* readSubject(mapping, nativeSubjectId, false);
-              const subject = subjects[0];
               const now = yield* freshNow;
 
               if (
-                subject === undefined ||
-                !mapping.subject.isActiveStatus(subject[mapping.subject.status]) ||
-                subject[mapping.subject.securityRevision] !== record.securityRevision ||
+                !mapping.subjectId.equals(nativeSubjectId, sessionRow[mapping.session.subjectId]) ||
+                !mapping.subjectId.equals(nativeSubjectId, subjectRow[mapping.subject.id]) ||
+                !mapping.subject.isActiveStatus(subjectRow[mapping.subject.status]) ||
+                subjectRow[mapping.subject.securityRevision] !== record.securityRevision ||
                 DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(record.expiresAt) ||
                 DateTime.toEpochMillis(now) >= DateTime.toEpochMillis(record.absoluteExpiresAt)
               )
@@ -1403,9 +1526,19 @@ export const makeSessionKernel = (operations: QueryOperations) => {
     return {
       statefulSessionPersistence: {
         establish: (input, prepare) =>
-          persistence.establish(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),
+          persistence
+            .establish(input, prepare)
+            .pipe(
+              Effect.provideService(NativeDatabase, root),
+              Effect.provideService(LifecycleHooks, hooks),
+            ),
         verify: (input) =>
-          persistence.verify(input).pipe(Effect.provideService(LifecycleHooks, hooks)),
+          persistence
+            .verify(input)
+            .pipe(
+              Effect.provideService(NativeDatabase, root),
+              Effect.provideService(LifecycleHooks, hooks),
+            ),
         rotate: (input, prepare) =>
           persistence.rotate(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),
         revokeDigest: (digest, prepare) =>
@@ -1447,50 +1580,62 @@ export const makeSessionKernel = (operations: QueryOperations) => {
       absoluteExpiresAt: column(mapping.tombstone.table, mapping.tombstone.absoluteExpiresAt),
     };
 
+    const root = yield* NativeDatabase;
+
+    const tables = yield* sqlMapping(() =>
+      nativeTables(root.$client.withoutTransforms(), root),
+    ).pipe(Effect.mapError(unavailable));
+
     const service = {
       verify: (session: SessionMetadata, _now: DateTime.Utc) =>
         safeTransaction(
-          inTransaction(
-            database,
+          withVerificationSavepoint(
             Effect.gen(function* () {
-              const read = yield* CurrentSessionSql;
+              const sql = root.$client.withoutTransforms();
               const nativeSubjectId = yield* mapping.subjectId.toNative(session.subjectId);
               const nativeSessionId = yield* mapping.sessionId.toNative(session.sessionId);
-              const subjects = yield* readSubject(mapping, nativeSubjectId, false);
-              const row = subjects[0];
+              const readNow = yield* freshNow;
+
+              // Independent bound IDs preserve each column's physical type and
+              // codec. Both authority and revocation come from this statement.
+              const { subjectTable, rows } = yield* sqlMapping(() => {
+                const subjectTable = tables(mapping.subject.table).as("auth_subject");
+                const revoked = tables(mapping.tombstone.table).as("auth_revocation");
+
+                return {
+                  subjectTable,
+                  rows: sql<Record<string, unknown>>`
+                  select ${subjectTable.fields("s_")},
+                    case when exists (
+                      select 1 from ${revoked.name}
+                      where ${revoked.column(mapping.tombstone.subjectId)} = ${revoked.value(mapping.tombstone.subjectId, nativeSubjectId)}
+                        and ${revoked.column(mapping.tombstone.sessionId)} = ${revoked.value(mapping.tombstone.sessionId, nativeSessionId)}
+                        and ${revoked.column(mapping.tombstone.absoluteExpiresAt)} > ${revoked.value(mapping.tombstone.absoluteExpiresAt, mapping.tombstone.encodeInstant(readNow))}
+                    ) then 1 else 0 end as auth_revoked
+                  from ${subjectTable.name}
+                  where ${subjectTable.column(mapping.subject.id)} = ${subjectTable.value(mapping.subject.id, nativeSubjectId)}
+                  limit 1`,
+                };
+              });
 
-              if (
-                row === undefined ||
-                !mapping.subject.isActiveStatus(row[mapping.subject.status]) ||
-                row[mapping.subject.securityRevision] !== session.securityRevision
-              )
-                return yield* invalidSession();
+              const result = (yield* rows)[0];
+
+              if (result === undefined) return yield* invalidSession();
+              const row = yield* sqlMapping(() => subjectTable.decode(result, "s_"));
+              const revoked = yield* decodeRevocationFlag(result.auth_revoked);
               const authoritativeNow = yield* freshNow;
 
               if (
+                !mapping.subjectId.equals(nativeSubjectId, row[mapping.subject.id]) ||
+                !mapping.subject.isActiveStatus(row[mapping.subject.status]) ||
+                row[mapping.subject.securityRevision] !== session.securityRevision ||
+                revoked === 1 ||
                 DateTime.toEpochMillis(authoritativeNow) >=
                   DateTime.toEpochMillis(session.expiresAt) ||
                 DateTime.toEpochMillis(authoritativeNow) >=
                   DateTime.toEpochMillis(session.absoluteExpiresAt)
               )
                 return yield* invalidSession();
-
-              const revoked = yield* read
-                .select({ sessionId: tombstone.sessionId })
-                .from(mapping.tombstone.table)
-                .where(
-                  and(
-                    eq(tombstone.subjectId, nativeSubjectId),
-                    eq(tombstone.sessionId, nativeSessionId),
-                    gt(
-                      tombstone.absoluteExpiresAt,
-                      mapping.tombstone.encodeInstant(authoritativeNow),
-                    ),
-                  ),
-                )
-                .limit(1);
-
-              if (revoked.length > 0) return yield* invalidSession();
             }),
           ),
         ),
@@ -1616,7 +1761,12 @@ export const makeSessionKernel = (operations: QueryOperations) => {
 
     return {
       verify: (session, now) =>
-        service.verify(session, now).pipe(Effect.provideService(LifecycleHooks, hooks)),
+        service
+          .verify(session, now)
+          .pipe(
+            Effect.provideService(NativeDatabase, root),
+            Effect.provideService(LifecycleHooks, hooks),
+          ),
       revoke: (input, prepare) =>
         service.revoke(input, prepare).pipe(Effect.provideService(LifecycleHooks, hooks)),
       revokeAll: (input, prepare) =>

package/src/internal/sql-oauth-connected-model.ts

@@ -0,0 +1,145 @@
+import * as Shared from "./models/oauth-connected-model";
+import type { SqlTableModel } from "./sql-oauth-model";
+import type { Fragment as SQL, Table } from "./sql-table";
+
+export {
+  type OAuthConnectedAction,
+  type OAuthConnectedOrderCodec,
+  type OAuthConnectedPolicyInput,
+  requiredOAuthConnectedConstraints,
+  requiredOAuthConnectedRevocationConstraints,
+} from "./models/oauth-connected-model";
+
+export type OAuthConnectedSubjectTable<S extends Table> = Shared.OAuthConnectedSubjectTable<
+  SqlTableModel<S>,
+  SQL
+>;
+
+export type OAuthConnectedFlowTable<F extends Table, N> = Shared.OAuthConnectedFlowTable<
+  SqlTableModel<F>,
+  N
+>;
+
+export type OAuthConnectedGrantTable<G extends Table, N> = Shared.OAuthConnectedGrantTable<
+  SqlTableModel<G>,
+  N
+>;
+
+/** Also stores a permanent provider/issuer scope anchor. clientKey must fit 52
+ * ASCII characters. Empty clientRegistrationId is reserved for that anchor;
+ * actual profile registrations are nonempty. Scope counter stays zero. */
+export type OAuthConnectedClientRegistrationTable<C extends Table> =
+  Shared.OAuthConnectedClientRegistrationTable<SqlTableModel<C>>;
+
+/** Remote authority: no local-subject column or subject-scoped key. Retain this
+ * anchor/cutoff when a legitimately released tuple gains a different local owner. */
+export type OAuthConnectedCohortTable<C extends Table> = Shared.OAuthConnectedCohortTable<
+  SqlTableModel<C>
+>;
+
+export type OAuthConnectedAdmissionTable<A extends Table, N> = Shared.OAuthConnectedAdmissionTable<
+  SqlTableModel<A>,
+  N
+>;
+
+export type OAuthConnectedCommandTable<C extends Table, N> = Shared.OAuthConnectedCommandTable<
+  SqlTableModel<C>,
+  N
+>;
+
+export type OAuthConnectedRevocationJobTable<
+  J extends Table,
+  N,
+> = Shared.OAuthConnectedRevocationJobTable<SqlTableModel<J>, N>;
+
+export type OAuthConnectedPolicyGuardTable<
+  T extends Table,
+  N,
+> = Shared.OAuthConnectedPolicyGuardTable<SqlTableModel<T>, N, SQL>;
+
+export type OAuthConnectedPolicyGuard<N> = Shared.OAuthConnectedPolicyGuard<N, SQL, Table>;
+
+export const oauthConnectedPolicyGuard = <T extends Table, N>(
+  input: OAuthConnectedPolicyGuardTable<T, N>,
+): OAuthConnectedPolicyGuard<N> =>
+  Shared.oauthConnectedPolicyGuard<SqlTableModel<T>, N, SQL>(input);
+
+export type OAuthConnectedSqlPolicy<N> = Shared.OAuthConnectedSqlPolicy<N, SQL, Table>;
+
+/** Existing ownership only; workers never allocate or acquire a tuple. */
+export type OAuthConnectedOwnershipRead<
+  T extends Table,
+  O extends Table,
+  N,
+> = Shared.OAuthConnectedOwnershipRead<SqlTableModel<T>, SqlTableModel<O>, N, SQL>;
+
+export type OAuthConnectedAuthorityMapping<
+  T extends Table,
+  O extends Table,
+  F extends Table,
+  G extends Table,
+  C extends Table,
+  H extends Table,
+  N,
+> = Shared.OAuthConnectedAuthorityMapping<
+  SqlTableModel<T>,
+  SqlTableModel<O>,
+  SqlTableModel<F>,
+  SqlTableModel<G>,
+  SqlTableModel<C>,
+  SqlTableModel<H>,
+  N,
+  SQL
+>;
+
+export type OAuthConnectedMapping<
+  S extends Table,
+  AC extends Table,
+  T extends Table,
+  O extends Table,
+  F extends Table,
+  G extends Table,
+  C extends Table,
+  H extends Table,
+  A extends Table,
+  D extends Table,
+  N,
+  J extends Table = never,
+> = Shared.OAuthConnectedMapping<
+  SqlTableModel<S>,
+  SqlTableModel<AC>,
+  SqlTableModel<T>,
+  SqlTableModel<O>,
+  SqlTableModel<F>,
+  SqlTableModel<G>,
+  SqlTableModel<C>,
+  SqlTableModel<H>,
+  SqlTableModel<A>,
+  SqlTableModel<D>,
+  N,
+  SqlTableModel<J>,
+  SQL,
+  Table,
+  SqlTableModel<Table>
+>;
+
+export type OAuthConnectedRevocationMapping<
+  T extends Table,
+  O extends Table,
+  F extends Table,
+  G extends Table,
+  C extends Table,
+  H extends Table,
+  J extends Table,
+  N,
+> = Shared.OAuthConnectedRevocationMapping<
+  SqlTableModel<T>,
+  SqlTableModel<O>,
+  SqlTableModel<F>,
+  SqlTableModel<G>,
+  SqlTableModel<C>,
+  SqlTableModel<H>,
+  SqlTableModel<J>,
+  N,
+  SQL
+>;