@yielded/auth-persistence 0.1.0-beta.23 → 0.1.0-beta.25

package/dist/internal/models/oauth-model.d.mts

@@ -0,0 +1,467 @@
+import { PersistenceMappingError } from "../mapping-error.mjs";
+import { SqlExpression, TableModel } from "../query-operations.mjs";
+import { SubjectIdCodec } from "./common.mjs";
+import { Crypto, Effect, PlatformError } from "effect";
+import { TokenDigest } from "@yielded/auth/Schema";
+import { PreparedCommit } from "@yielded/auth/Hooks";
+import { AuthenticationRequirement, SecurityRevision } from "@yielded/auth/Sessions";
+import { OAuthAccountRevision, OAuthActionAuthorization, OAuthCleanupInput, OAuthCommandId, OAuthCredentialSnapshot, OAuthExternalIdentity, OAuthRegistrationAccess, OAuthRegistrationDecision, OAuthRegistrationInspection, OAuthRegistrationIntent, OAuthUnavailable, PrepareOAuthCommit } from "@yielded/auth/OAuth";
+import { AuthenticationFactor } from "@yielded/auth/Operations";
+declare namespace oauth_model_d_exports {
+  export { OAuthAccountsMapping, OAuthAction, OAuthAuthorityReadTable, OAuthAuthorityTable, OAuthCleanupDescriptor, OAuthCleanupTable, OAuthClock, OAuthCredentialReadTable, OAuthCredentialTable, OAuthD1Mapping, OAuthEligibilityDescriptor, OAuthEligibilityFact, OAuthEligibilityTable, OAuthFlowState, OAuthFlowTable, OAuthMetadataPolicy, OAuthOwnershipMutation, OAuthOwnershipReadTable, OAuthOwnershipTable, OAuthReferenceGuardDescriptor, OAuthReferenceGuardTable, OAuthRegistrationAuthority, OAuthRegistrationBase, OAuthRegistrationCommandTable, OAuthRegistrationEligibility, OAuthRegistrationGuardDescriptor, OAuthRegistrationGuardTable, OAuthRegistrationIntentMapping, OAuthRegistrationIntentTable, OAuthRegistrationMapping, OAuthRegistrationState, OAuthSignInMapping, OAuthSubjectReadTable, OAuthSubjectTable, OAuthTupleAuthorityTable, OAuthTupleState, OAuthUnlinkCommandTable, oauthCleanupTable, oauthEligibilityTable, oauthReferenceGuardTable, oauthRegistrationGuardTable, requiredOAuthAccountsConstraints, requiredOAuthRegistrationConstraints, requiredOAuthSignInConstraints, requiredOAuthTupleConstraints };
+}
+type Column<T extends TableModel> = T["column"];
+export type OAuthFlowState = "Pending" | "Claimed" | "Verified" | "RegistrationIssued" | "Linked" | "Cancelled" | "Rejected" | "Ambiguous" | "Conflict";
+export type OAuthTupleState = "Unowned" | "Reserved" | "Owned";
+export type OAuthRegistrationState = "Unbound" | "Registered" | "ProvisioningPending" | "Rejected";
+export type OAuthAction = OAuthActionAuthorization["challenge"]["action"];
+/** The engine writes every critical column explicitly after applying the pure
+ * consumer encoder. Native instant values must roundtrip without precision loss. */
+export interface OAuthClock<Expression extends SqlExpression = SqlExpression> {
+  readonly encodeInstant: (millis: number) => unknown;
+  readonly decodeInstant: (value: unknown) => number;
+  /** Actual engine wall clock sampled after locks, not transaction-start time.
+   * PostgreSQL uses clock_timestamp(), never now()/CURRENT_TIMESTAMP. D1 repeats
+   * its primary-engine sample bounds in final guards. Return integer milliseconds. */
+  readonly engineNowMillis: Expression;
+}
+export interface OAuthSubjectReadTable<S extends TableModel, Expression extends SqlExpression = SqlExpression> {
+  readonly table: S["table"];
+  readonly id: Column<S>;
+  readonly status: Column<S>;
+  readonly securityRevision: Column<S>;
+  readonly isActiveStatus: (value: unknown) => boolean;
+  readonly activeCondition: Expression;
+}
+export interface OAuthSubjectTable<S extends TableModel, Expression extends SqlExpression = SqlExpression> extends OAuthSubjectReadTable<S, Expression> {
+  readonly decodeActionRequirement: (row: S["select"], action: OAuthAction) => AuthenticationRequirement;
+  readonly decodeAuthenticationRequirement: (row: S["select"]) => AuthenticationRequirement;
+  readonly nextSecurityRevision: (current: SecurityRevision) => SecurityRevision;
+}
+export interface OAuthOwnershipReadTable<O extends TableModel, N, Expression extends SqlExpression = SqlExpression> {
+  readonly table: O["table"];
+  readonly identityKey: Column<O>;
+  readonly provider: Column<O>;
+  readonly issuer: Column<O>;
+  readonly externalSubject: Column<O>;
+  readonly subjectId: Column<O>;
+  /** Includes Owned state when authority and ownership share a physical table. */
+  readonly ownedCondition: Expression;
+  readonly decodeSubjectId: (row: O["select"]) => N;
+}
+export interface OAuthOwnershipTable<O extends TableModel, N, Expression extends SqlExpression = SqlExpression> extends OAuthOwnershipReadTable<O, N, Expression> {
+  readonly encodeInsert: (input: {
+    readonly identity: typeof OAuthExternalIdentity.Type;
+    readonly identityKey: string;
+    readonly subjectId: N;
+  }) => O["insert"];
+}
+export interface OAuthCredentialReadTable<C extends TableModel, Expression extends SqlExpression = SqlExpression> {
+  readonly table: C["table"];
+  readonly moduleId: Column<C>;
+  readonly credentialId: Column<C>;
+  readonly subjectId: Column<C>;
+  readonly identityKey: Column<C>;
+  readonly credentialRevision: Column<C>;
+  readonly status: Column<C>;
+  readonly isActiveStatus: (value: unknown) => boolean;
+  readonly activeCondition: Expression;
+}
+export interface OAuthCredentialTable<C extends TableModel, N, Expression extends SqlExpression = SqlExpression> extends OAuthCredentialReadTable<C, Expression> {
+  readonly encodeInsert: (input: {
+    readonly moduleId: string;
+    readonly subjectId: N;
+    readonly identityKey: string;
+    readonly credentialId: string;
+    readonly credentialRevision: SecurityRevision;
+  }) => C["insert"];
+  /** This slice removes login rows. Historical records belong in separate audit storage. */
+  readonly removal: "delete";
+}
+export interface OAuthAuthorityReadTable<C extends TableModel, Expression extends SqlExpression = SqlExpression> {
+  readonly table: C["table"];
+  readonly subjectId: Column<C>;
+  readonly credentialId: Column<C>;
+  readonly revision: Column<C>;
+  readonly status: Column<C>;
+  readonly isActiveStatus: (value: unknown) => boolean;
+  readonly activeCondition: Expression;
+}
+export interface OAuthAuthorityTable<C extends TableModel, N, Expression extends SqlExpression = SqlExpression> extends OAuthAuthorityReadTable<C, Expression> {
+  readonly encodeInsert: (input: {
+    readonly subjectId: N;
+    readonly credentialId: string;
+    readonly revision: SecurityRevision;
+  }) => C["insert"];
+}
+/** Both purposes may use the same physical table. Shared tables share module/flow
+ * and module/command uniqueness. The snapshot has the exact purpose-specific core
+ * codec; terminal writes erase it, while identity, claim and retention columns remain. */
+export interface OAuthFlowTable<F extends TableModel> {
+  readonly table: F["table"];
+  readonly moduleId: Column<F>;
+  readonly flowId: Column<F>;
+  readonly commandId: Column<F>;
+  readonly purpose: Column<F>;
+  readonly generation: Column<F>;
+  readonly state: Column<F>;
+  readonly version: Column<F>;
+  readonly stateDigest: Column<F>;
+  readonly binderVerifier: Column<F>;
+  readonly binderExpiresAt: Column<F>;
+  readonly snapshot: Column<F>;
+  readonly issuedAt: Column<F>;
+  readonly expiresAt: Column<F>;
+  readonly claimId: Column<F>;
+  readonly claimedAt: Column<F>;
+  readonly claimExpiresAt: Column<F>;
+  readonly retentionUntil: Column<F>;
+  readonly encodeInsert: (input: {
+    readonly moduleId: string;
+    readonly flowId: string;
+    readonly purpose: "sign-in" | "link";
+  }) => F["insert"];
+}
+export interface OAuthTupleAuthorityTable<T extends TableModel, N> {
+  readonly table: T["table"];
+  readonly identityKey: Column<T>;
+  readonly provider: Column<T>;
+  readonly issuer: Column<T>;
+  readonly externalSubject: Column<T>;
+  readonly state: Column<T>;
+  readonly version: Column<T>;
+  readonly subjectId: Column<T>;
+  /** Exact reservation identity; no application payload or bearer. */
+  readonly reservation: Column<T>;
+  readonly encodeInsert: (input: {
+    readonly identityKey: string;
+    readonly identity: typeof OAuthExternalIdentity.Type;
+    readonly subjectId?: N;
+  }) => T["insert"];
+}
+export interface OAuthRegistrationIntentTable<I extends TableModel> {
+  readonly table: I["table"];
+  readonly moduleId: Column<I>;
+  readonly reference: Column<I>;
+  readonly flowId: Column<I>;
+  readonly claimId: Column<I>;
+  readonly identityKey: Column<I>;
+  readonly version: Column<I>;
+  readonly state: Column<I>;
+  readonly snapshot: Column<I>;
+  readonly commandId: Column<I>;
+  readonly fingerprint: Column<I>;
+  readonly pendingReference: Column<I>;
+  readonly expiresAt: Column<I>;
+  readonly retentionUntil: Column<I>;
+  readonly encodeInsert: (intent: OAuthRegistrationIntent) => I["insert"];
+}
+export interface OAuthRegistrationCommandTable<R extends TableModel, Registration> {
+  readonly table: R["table"];
+  readonly moduleId: Column<R>;
+  readonly commandId: Column<R>;
+  readonly reference: Column<R>;
+  readonly identityKey: Column<R>;
+  readonly fingerprint: Column<R>;
+  readonly intentSnapshot: Column<R>;
+  readonly applicationSnapshot: Column<R>;
+  readonly provisioningIdentity: Column<R>;
+  readonly decision: Column<R>;
+  readonly retentionUntil: Column<R>;
+  /** Persists exact detached Type before protected pending work can start. */
+  readonly encodeInsert: (input: {
+    readonly intent: OAuthRegistrationIntent;
+    readonly commandId: string;
+    readonly fingerprint: string;
+    readonly registration: Registration;
+    readonly provisioningIdentity: string;
+  }) => R["insert"];
+}
+export interface OAuthUnlinkCommandTable<U extends TableModel> {
+  readonly table: U["table"];
+  readonly moduleId: Column<U>;
+  readonly commandId: Column<U>;
+  readonly subjectId: Column<U>;
+  readonly credentialId: Column<U>;
+  readonly intentSnapshot: Column<U>;
+  readonly decision: Column<U>;
+  readonly retentionUntil: Column<U>;
+  readonly encodeInsert: (input: {
+    readonly moduleId: string;
+    readonly commandId: string;
+    readonly credential: OAuthCredentialSnapshot;
+  }) => U["insert"];
+}
+export interface OAuthEligibilityFact {
+  readonly credentialId: string;
+  readonly revision: SecurityRevision;
+  readonly usablePrimary: boolean;
+  readonly factors: ReadonlyArray<AuthenticationFactor>;
+  readonly userVerified: boolean;
+  readonly phishingResistant: boolean;
+}
+/** Each descriptor reads only its own subject-scoped method rows. The native row
+ * projector and SQL condition must express the same installed method eligibility.
+ * All source/identifier/policy mutations advance subject securityRevision. D1 also
+ * guards exact selected IDs/versions and absence/count assumptions, never just a
+ * stale boolean. An over-limit graph fails closed rather than truncating. */
+export interface OAuthEligibilityTable<T extends TableModel, N, Expression extends SqlExpression = SqlExpression> {
+  readonly table: T["table"];
+  readonly subjectId: Column<T>;
+  readonly credentialId: Column<T>;
+  readonly revision: Column<T>;
+  readonly scope: string;
+  readonly condition: (subjectId: N) => Expression;
+  readonly decode: (row: T["select"]) => OAuthEligibilityFact | undefined;
+}
+/** Authenticated command replay uses current subject status and this additional
+ * nonconsuming SQL policy. It never consumes a fresh action factor. */
+export interface OAuthMetadataPolicy<N, Expression extends SqlExpression = SqlExpression> {
+  readonly condition: (subjectId: N) => Expression;
+}
+export interface OAuthCleanupTable<T extends TableModel, N, Expression extends SqlExpression = SqlExpression> {
+  readonly table: T["table"];
+  readonly subjectId: Column<T>;
+  /** Bound to this subject's old revision; no opaque independently committing service. */
+  readonly condition: (input: {
+    readonly subjectId: N;
+    readonly revision: OAuthAccountRevision;
+    readonly removedCredentialId?: string;
+  }) => Expression;
+  readonly disposition: "delete";
+}
+export interface OAuthRegistrationEligibility<N, Expression extends SqlExpression = SqlExpression> {
+  /** Pure SQL guards for mutable app policy; evaluated again after app writes. */
+  readonly condition: (input: {
+    readonly intent: OAuthRegistrationIntent;
+    readonly nativeSubjectId?: N;
+  }) => Expression;
+}
+export interface OAuthD1Mapping {
+  readonly d1: {
+    readonly primary: true;
+  };
+}
+export declare const requiredOAuthSignInConstraints: {
+  readonly flow: "unique(flow.moduleId,flow.flowId)";
+  readonly command: "unique(flow.moduleId,flow.commandId)";
+  readonly stateDigest: "unique(flow.stateDigest)";
+  readonly ownership: "unique(ownership.identityKey)";
+  readonly credentialId: "unique(credential.credentialId)";
+  readonly credentialIdentity: "unique(credential.identityKey)";
+  readonly authorityCredential: "unique(authority.subjectId,authority.credentialId)";
+};
+export declare const requiredOAuthTupleConstraints: {
+  readonly identityKey: "unique(tuple.identityKey)";
+};
+export declare const requiredOAuthRegistrationConstraints: {
+  readonly intentReference: "unique(intent.moduleId,intent.reference)";
+  readonly intentFlow: "unique(intent.moduleId,intent.flowId)";
+  readonly command: "unique(registrationCommand.moduleId,registrationCommand.commandId)";
+};
+export declare const requiredOAuthAccountsConstraints: {
+  readonly unlinkCommand: "unique(unlinkCommand.moduleId,unlinkCommand.commandId)";
+};
+export interface OAuthSignInMapping<S extends TableModel, O extends TableModel, C extends TableModel, AC extends TableModel, F extends TableModel, N, Expression extends SqlExpression = SqlExpression> {
+  readonly subject: OAuthSubjectReadTable<S, Expression>;
+  readonly ownership: OAuthOwnershipReadTable<O, N, Expression>;
+  readonly credential: OAuthCredentialReadTable<C, Expression>;
+  readonly authority: OAuthAuthorityReadTable<AC, Expression>;
+  readonly flow: OAuthFlowTable<F>;
+  readonly subjectId: SubjectIdCodec<N>;
+  readonly clock: OAuthClock<Expression>;
+  readonly constraints: typeof requiredOAuthSignInConstraints;
+}
+export type OAuthOwnershipMutation<T extends TableModel, O extends TableModel, N, Expression extends SqlExpression = SqlExpression> = {
+  readonly mode: "integrated";
+  readonly tuple: OAuthTupleAuthorityTable<T, N>;
+} | {
+  readonly mode: "separate";
+  readonly tuple: OAuthTupleAuthorityTable<T, N>;
+  readonly external: OAuthOwnershipTable<O, N, Expression>;
+};
+export interface OAuthRegistrationIntentMapping<S extends TableModel, O extends TableModel, C extends TableModel, AC extends TableModel, F extends TableModel, T extends TableModel, I extends TableModel, N, Expression extends SqlExpression = SqlExpression> {
+  readonly signIn: OAuthSignInMapping<S, O, C, AC, F, N, Expression>;
+  readonly ownership: OAuthOwnershipMutation<T, O, N, Expression>;
+  readonly intent: OAuthRegistrationIntentTable<I>;
+  readonly tupleConstraints: typeof requiredOAuthTupleConstraints;
+  readonly registrationConstraints: Pick<typeof requiredOAuthRegistrationConstraints, "intentReference" | "intentFlow">;
+  readonly eligibility: OAuthRegistrationEligibility<N, Expression>;
+}
+export interface OAuthRegistrationBase<Registration, T extends TableModel, O extends TableModel, I extends TableModel, R extends TableModel, N, Expression extends SqlExpression = SqlExpression, Descriptor extends object = object> {
+  readonly ownership: OAuthOwnershipMutation<T, O, N, Expression>;
+  readonly intent: OAuthRegistrationIntentTable<I>;
+  readonly command: OAuthRegistrationCommandTable<R, Registration>;
+  readonly clock: OAuthClock<Expression>;
+  readonly tupleConstraints: typeof requiredOAuthTupleConstraints;
+  readonly constraints: typeof requiredOAuthRegistrationConstraints;
+  readonly inspect: (input: {
+    readonly intent: OAuthRegistrationIntent;
+    readonly registration: Registration;
+  }) => Effect.Effect<{
+    readonly fingerprint: string;
+    readonly eligible: boolean;
+  }, PersistenceMappingError>;
+  /** Required for an explicitly bound native/DO command: no asynchronous callback
+   * is evaluated inside the physical owner. Standalone inspection is pre-owner. */
+  readonly inspectSync?: (input: {
+    readonly intent: OAuthRegistrationIntent;
+    readonly registration: Registration;
+  }) => {
+    readonly fingerprint: string;
+    readonly eligible: boolean;
+  };
+  /** Type projection, never the original wire transformation. */
+  readonly snapshot: (registration: Registration) => Effect.Effect<Registration, PersistenceMappingError>;
+  readonly snapshotSync?: (registration: Registration) => Registration;
+  /** Canonical bounded storage of Registration.Type. These are Type codecs, not
+   * the original wire decoder/encoder; decode(encode(value)) must encode identically.
+   * The engine writes and roundtrip-checks this exact string (maximum 1 MiB). */
+  readonly application: {
+    readonly encode: (registration: Registration) => string;
+    readonly decode: (stored: string) => Registration;
+  };
+  readonly eligibility: {
+    /** Stable application authority anchors, in one configured global order.
+     * Omit only for immutable/tuple-local policy or an equivalent explicit outer
+     * owner lock. Each scope must match 1..64 rows, never an absent quota row.
+     * Locks precede tuple/intent/command locks; postcondition owns changed state. */
+    readonly guards?: ReadonlyArray<OAuthRegistrationGuardDescriptor<Registration, N, Expression, Descriptor>>;
+    readonly admission: (input: {
+      readonly intent: OAuthRegistrationIntent;
+      readonly registration: Registration;
+      readonly nativeSubjectId?: N;
+    }) => Expression;
+    /** Evaluated after subject/application writes, including appended coordinator
+     * writes. May assert consumption of the admission invitation/quota. */
+    readonly postcondition: (input: {
+      readonly intent: OAuthRegistrationIntent;
+      readonly registration: Registration;
+      readonly nativeSubjectId?: N;
+    }) => Expression;
+  };
+  readonly allocateProvisioningIdentity: Effect.Effect<string, PersistenceMappingError>;
+  readonly retentionMillis: number;
+}
+export interface OAuthRegistrationGuardTable<T extends TableModel, Registration, N, Expression extends SqlExpression = SqlExpression> {
+  readonly table: T["table"];
+  readonly orderBy: Column<T>;
+  readonly condition: (input: {
+    readonly intent: OAuthRegistrationIntent;
+    readonly registration: Registration;
+    readonly nativeSubjectId?: N;
+  }) => Expression;
+}
+export interface OAuthRegistrationGuardDescriptor<Registration, N, Expression extends SqlExpression = SqlExpression, Descriptor extends object = object> {
+  readonly table: Descriptor;
+  readonly orderBy: string;
+  readonly condition: OAuthRegistrationGuardTable<TableModel, Registration, N, Expression>["condition"];
+}
+export declare const oauthRegistrationGuardTable: <T extends TableModel, Registration, N, Expression extends SqlExpression = SqlExpression>(input: OAuthRegistrationGuardTable<T, Registration, N, Expression>) => OAuthRegistrationGuardDescriptor<Registration, N, Expression, T["table"]>;
+export type OAuthRegistrationMapping<Registration, S extends TableModel, O extends TableModel, C extends TableModel, AC extends TableModel, T extends TableModel, I extends TableModel, R extends TableModel, N, Expression extends SqlExpression = SqlExpression, Descriptor extends object = object> = OAuthRegistrationBase<Registration, T, O, I, R, N, Expression, Descriptor> & ({
+  readonly mode: "pending";
+  readonly allocatePendingReference: Effect.Effect<string, PersistenceMappingError>;
+} | {
+  readonly mode: "atomic";
+  readonly subjectId: SubjectIdCodec<N>;
+  readonly subject: OAuthSubjectReadTable<S, Expression>;
+  readonly credential: OAuthCredentialTable<C, N, Expression>;
+  readonly authority: OAuthAuthorityTable<AC, N, Expression>;
+  readonly allocateSubjectId: Effect.Effect<N, PersistenceMappingError>;
+  readonly allocateCredentialId: Effect.Effect<string, PersistenceMappingError>;
+  readonly allocateRevision: Effect.Effect<SecurityRevision, PersistenceMappingError>;
+  readonly encodeSubjectInsert: (input: {
+    readonly intent: OAuthRegistrationIntent;
+    readonly registration: Registration;
+  }, ids: {
+    readonly subjectId: N;
+    readonly securityRevision: SecurityRevision;
+  }) => S["insert"];
+});
+/** Heterogeneous descriptors are made by typed factories and projected privately. */
+export interface OAuthEligibilityDescriptor<N, Expression extends SqlExpression = SqlExpression, Descriptor extends object = object> {
+  readonly _tag: "OAuthEligibilityDescriptor";
+  readonly scope: string;
+  readonly table: Descriptor;
+  readonly subjectId: string;
+  readonly credentialId: string;
+  readonly revision: string;
+  readonly condition: (subjectId: N) => Expression;
+  readonly decode: (row: unknown) => OAuthEligibilityFact | undefined;
+}
+export declare const oauthEligibilityTable: <T extends TableModel, N, Expression extends SqlExpression = SqlExpression>(input: OAuthEligibilityTable<T, N, Expression>) => OAuthEligibilityDescriptor<N, Expression, T["table"]>;
+export interface OAuthCleanupDescriptor<N, Expression extends SqlExpression = SqlExpression, Descriptor extends object = object> {
+  readonly table: Descriptor;
+  readonly subjectId: string;
+  readonly condition: OAuthCleanupTable<TableModel, N, Expression>["condition"];
+}
+export declare const oauthCleanupTable: <T extends TableModel, N, Expression extends SqlExpression = SqlExpression>(input: OAuthCleanupTable<T, N, Expression>) => OAuthCleanupDescriptor<N, Expression, T["table"]>;
+/** A stable application/reference lock acquired before an ownership target.
+ * Missing rows retain ownership. Conditions use detached native IDs; every
+ * writer of the guarded reference follows the same order. */
+export interface OAuthReferenceGuardTable<T extends TableModel, N, Expression extends SqlExpression = SqlExpression> {
+  readonly table: T["table"];
+  readonly orderBy: Column<T>;
+  readonly condition: (input: {
+    readonly identity: typeof OAuthExternalIdentity.Type;
+    readonly identityKey: string;
+    readonly subjectId: N;
+  }) => Expression | Effect.Effect<Expression, PlatformError.PlatformError, Crypto.Crypto>;
+}
+export interface OAuthReferenceGuardDescriptor<N, Expression extends SqlExpression = SqlExpression, Descriptor extends object = object> {
+  readonly table: Descriptor;
+  readonly orderBy: string;
+  readonly condition: OAuthReferenceGuardTable<TableModel, N, Expression>["condition"];
+}
+export declare const oauthReferenceGuardTable: <T extends TableModel, N, Expression extends SqlExpression = SqlExpression>(input: OAuthReferenceGuardTable<T, N, Expression>) => OAuthReferenceGuardDescriptor<N, Expression, T["table"]>;
+export interface OAuthAccountsMapping<S extends TableModel, O extends TableModel, C extends TableModel, AC extends TableModel, F extends TableModel, T extends TableModel, U extends TableModel, N, Expression extends SqlExpression = SqlExpression, Descriptor extends object = object> {
+  readonly subject: OAuthSubjectTable<S, Expression>;
+  readonly ownership: OAuthOwnershipMutation<T, O, N, Expression>;
+  readonly credential: OAuthCredentialTable<C, N, Expression>;
+  readonly authority: OAuthAuthorityTable<AC, N, Expression>;
+  readonly flow: OAuthFlowTable<F>;
+  readonly command: OAuthUnlinkCommandTable<U>;
+  readonly subjectId: SubjectIdCodec<N>;
+  readonly clock: OAuthClock<Expression>;
+  readonly constraints: typeof requiredOAuthSignInConstraints & typeof requiredOAuthAccountsConstraints;
+  readonly tupleConstraints: typeof requiredOAuthTupleConstraints;
+  readonly eligibility: ReadonlyArray<OAuthEligibilityDescriptor<N, Expression, Descriptor>>;
+  readonly cleanup: ReadonlyArray<OAuthCleanupDescriptor<N, Expression, Descriptor>>;
+  readonly metadata: OAuthMetadataPolicy<N, Expression>;
+  readonly sessionInvalidation: "same-authority-immediate" | "original-absolute-expiry";
+  /** Omit only when connected access is absent. A predicate alone conservatively
+   * retains ownership; release also needs all configured guard rows below. */
+  readonly connectedReference?: (input: {
+    readonly identityKey: string;
+    readonly subjectId: N;
+  }) => Expression;
+  /** At most 32 descriptors, each locking 1..64 stable rows in supplied order.
+   * Missing/empty guards retain Owned, even when the reference predicate is false. */
+  readonly connectedReferenceGuards?: ReadonlyArray<OAuthReferenceGuardDescriptor<N, Expression, Descriptor>>;
+  readonly allocateCredentialId: Effect.Effect<string, PersistenceMappingError>;
+  readonly allocateRevision: Effect.Effect<SecurityRevision, PersistenceMappingError>;
+}
+export interface OAuthRegistrationAuthority<Registration> {
+  readonly read: (access: OAuthRegistrationAccess) => Effect.Effect<OAuthRegistrationInspection | undefined, OAuthUnavailable>;
+  readonly inspect: (input: {
+    readonly intent: OAuthRegistrationIntent;
+    readonly registration: Registration;
+  }) => Effect.Effect<{
+    readonly fingerprint: TokenDigest;
+    readonly eligible: boolean;
+  }, OAuthUnavailable>;
+  readonly register: <A>(input: {
+    readonly access: OAuthRegistrationAccess;
+    readonly intent: OAuthRegistrationIntent;
+    readonly commandId: typeof OAuthCommandId.Type;
+    readonly registration: Registration;
+    readonly fingerprint: TokenDigest;
+  }, prepare: PrepareOAuthCommit<OAuthRegistrationDecision, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;
+  readonly cleanup: <A>(input: OAuthCleanupInput, prepare: PrepareOAuthCommit<{
+    readonly removed: number;
+    readonly hasMore: boolean;
+  }, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;
+}
+//#endregion
+export { oauth_model_d_exports };
+//# sourceMappingURL=oauth-model.d.mts.map

package/dist/internal/models/oauth-model.mjs

@@ -0,0 +1,49 @@
+//#region src/internal/models/oauth-model.ts
+const requiredOAuthSignInConstraints = {
+	flow: "unique(flow.moduleId,flow.flowId)",
+	command: "unique(flow.moduleId,flow.commandId)",
+	stateDigest: "unique(flow.stateDigest)",
+	ownership: "unique(ownership.identityKey)",
+	credentialId: "unique(credential.credentialId)",
+	credentialIdentity: "unique(credential.identityKey)",
+	authorityCredential: "unique(authority.subjectId,authority.credentialId)"
+};
+const requiredOAuthTupleConstraints = { identityKey: "unique(tuple.identityKey)" };
+const requiredOAuthRegistrationConstraints = {
+	intentReference: "unique(intent.moduleId,intent.reference)",
+	intentFlow: "unique(intent.moduleId,intent.flowId)",
+	command: "unique(registrationCommand.moduleId,registrationCommand.commandId)"
+};
+const requiredOAuthAccountsConstraints = { unlinkCommand: "unique(unlinkCommand.moduleId,unlinkCommand.commandId)" };
+const oauthRegistrationGuardTable = (input) => Object.freeze({
+	table: input.table,
+	orderBy: input.orderBy,
+	condition: input.condition
+});
+const oauthEligibilityTable = (input) => {
+	const { table, subjectId, credentialId, revision, scope, condition, decode } = input;
+	return Object.freeze({
+		_tag: "OAuthEligibilityDescriptor",
+		table,
+		subjectId,
+		credentialId,
+		revision,
+		scope,
+		condition,
+		decode: (row) => decode(row)
+	});
+};
+const oauthCleanupTable = (input) => Object.freeze({
+	table: input.table,
+	subjectId: input.subjectId,
+	condition: input.condition
+});
+const oauthReferenceGuardTable = (input) => Object.freeze({
+	table: input.table,
+	orderBy: input.orderBy,
+	condition: input.condition
+});
+//#endregion
+export { oauthCleanupTable, oauthEligibilityTable, oauthReferenceGuardTable, oauthRegistrationGuardTable, requiredOAuthAccountsConstraints, requiredOAuthRegistrationConstraints, requiredOAuthSignInConstraints, requiredOAuthTupleConstraints };
+
+//# sourceMappingURL=oauth-model.mjs.map

package/dist/internal/models/oauth-model.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-model.mjs","names":[],"sources":["../../../src/internal/models/oauth-model.ts"],"sourcesContent":["import type { PreparedCommit } from \"@yielded/auth/Hooks\";\nimport type {\n  OAuthActionAuthorization,\n  OAuthAccountRevision,\n  OAuthRegistrationIntent,\n  OAuthCredentialSnapshot,\n  OAuthExternalIdentity,\n  OAuthRegistrationAccess,\n  OAuthRegistrationInspection,\n  OAuthUnavailable,\n  OAuthCommandId,\n  PrepareOAuthCommit,\n  OAuthRegistrationDecision,\n  OAuthCleanupInput,\n} from \"@yielded/auth/OAuth\";\nimport type { AuthenticationFactor } from \"@yielded/auth/Operations\";\nimport type { TokenDigest } from \"@yielded/auth/Schema\";\nimport type { AuthenticationRequirement, SecurityRevision } from \"@yielded/auth/Sessions\";\nimport type { Crypto, Effect, PlatformError } from \"effect\";\n\nimport type { TableModel as Table, SqlExpression } from \"../query-operations\";\nimport type { PersistenceMappingError, SubjectIdCodec } from \"./common\";\n\ntype Column<T extends Table> = T[\"column\"];\n\nexport type OAuthFlowState =\n  | \"Pending\"\n  | \"Claimed\"\n  | \"Verified\"\n  | \"RegistrationIssued\"\n  | \"Linked\"\n  | \"Cancelled\"\n  | \"Rejected\"\n  | \"Ambiguous\"\n  | \"Conflict\";\n\nexport type OAuthTupleState = \"Unowned\" | \"Reserved\" | \"Owned\";\nexport type OAuthRegistrationState = \"Unbound\" | \"Registered\" | \"ProvisioningPending\" | \"Rejected\";\nexport type OAuthAction = OAuthActionAuthorization[\"challenge\"][\"action\"];\n\n/** The engine writes every critical column explicitly after applying the pure\n * consumer encoder. Native instant values must roundtrip without precision loss. */\nexport interface OAuthClock<Expression extends SqlExpression = SqlExpression> {\n  readonly encodeInstant: (millis: number) => unknown;\n  readonly decodeInstant: (value: unknown) => number;\n  /** Actual engine wall clock sampled after locks, not transaction-start time.\n   * PostgreSQL uses clock_timestamp(), never now()/CURRENT_TIMESTAMP. D1 repeats\n   * its primary-engine sample bounds in final guards. Return integer milliseconds. */\n  readonly engineNowMillis: Expression;\n}\n\nexport interface OAuthSubjectReadTable<\n  S extends Table,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: S[\"table\"];\n  readonly id: Column<S>;\n  readonly status: Column<S>;\n  readonly securityRevision: Column<S>;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly activeCondition: Expression;\n}\n\nexport interface OAuthSubjectTable<\n  S extends Table,\n  Expression extends SqlExpression = SqlExpression,\n> extends OAuthSubjectReadTable<S, Expression> {\n  readonly decodeActionRequirement: (\n    row: S[\"select\"],\n    action: OAuthAction,\n  ) => AuthenticationRequirement;\n  readonly decodeAuthenticationRequirement: (row: S[\"select\"]) => AuthenticationRequirement;\n  readonly nextSecurityRevision: (current: SecurityRevision) => SecurityRevision;\n}\n\nexport interface OAuthOwnershipReadTable<\n  O extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: O[\"table\"];\n  readonly identityKey: Column<O>;\n  readonly provider: Column<O>;\n  readonly issuer: Column<O>;\n  readonly externalSubject: Column<O>;\n  readonly subjectId: Column<O>;\n  /** Includes Owned state when authority and ownership share a physical table. */\n  readonly ownedCondition: Expression;\n  readonly decodeSubjectId: (row: O[\"select\"]) => N;\n}\n\nexport interface OAuthOwnershipTable<\n  O extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> extends OAuthOwnershipReadTable<O, N, Expression> {\n  readonly encodeInsert: (input: {\n    readonly identity: typeof OAuthExternalIdentity.Type;\n    readonly identityKey: string;\n    readonly subjectId: N;\n  }) => O[\"insert\"];\n}\n\nexport interface OAuthCredentialReadTable<\n  C extends Table,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: C[\"table\"];\n  readonly moduleId: Column<C>;\n  readonly credentialId: Column<C>;\n  readonly subjectId: Column<C>;\n  readonly identityKey: Column<C>;\n  readonly credentialRevision: Column<C>;\n  readonly status: Column<C>;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly activeCondition: Expression;\n}\n\nexport interface OAuthCredentialTable<\n  C extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> extends OAuthCredentialReadTable<C, Expression> {\n  readonly encodeInsert: (input: {\n    readonly moduleId: string;\n    readonly subjectId: N;\n    readonly identityKey: string;\n    readonly credentialId: string;\n    readonly credentialRevision: SecurityRevision;\n  }) => C[\"insert\"];\n  /** This slice removes login rows. Historical records belong in separate audit storage. */\n  readonly removal: \"delete\";\n}\n\nexport interface OAuthAuthorityReadTable<\n  C extends Table,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: C[\"table\"];\n  readonly subjectId: Column<C>;\n  readonly credentialId: Column<C>;\n  readonly revision: Column<C>;\n  readonly status: Column<C>;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly activeCondition: Expression;\n}\n\nexport interface OAuthAuthorityTable<\n  C extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> extends OAuthAuthorityReadTable<C, Expression> {\n  readonly encodeInsert: (input: {\n    readonly subjectId: N;\n    readonly credentialId: string;\n    readonly revision: SecurityRevision;\n  }) => C[\"insert\"];\n}\n\n/** Both purposes may use the same physical table. Shared tables share module/flow\n * and module/command uniqueness. The snapshot has the exact purpose-specific core\n * codec; terminal writes erase it, while identity, claim and retention columns remain. */\nexport interface OAuthFlowTable<F extends Table> {\n  readonly table: F[\"table\"];\n  readonly moduleId: Column<F>;\n  readonly flowId: Column<F>;\n  readonly commandId: Column<F>;\n  readonly purpose: Column<F>;\n  readonly generation: Column<F>;\n  readonly state: Column<F>;\n  readonly version: Column<F>;\n  readonly stateDigest: Column<F>;\n  readonly binderVerifier: Column<F>;\n  readonly binderExpiresAt: Column<F>;\n  readonly snapshot: Column<F>;\n  readonly issuedAt: Column<F>;\n  readonly expiresAt: Column<F>;\n  readonly claimId: Column<F>;\n  readonly claimedAt: Column<F>;\n  readonly claimExpiresAt: Column<F>;\n  readonly retentionUntil: Column<F>;\n  readonly encodeInsert: (input: {\n    readonly moduleId: string;\n    readonly flowId: string;\n    readonly purpose: \"sign-in\" | \"link\";\n  }) => F[\"insert\"];\n}\n\nexport interface OAuthTupleAuthorityTable<T extends Table, N> {\n  readonly table: T[\"table\"];\n  readonly identityKey: Column<T>;\n  readonly provider: Column<T>;\n  readonly issuer: Column<T>;\n  readonly externalSubject: Column<T>;\n  readonly state: Column<T>;\n  readonly version: Column<T>;\n  readonly subjectId: Column<T>;\n  /** Exact reservation identity; no application payload or bearer. */\n  readonly reservation: Column<T>;\n  readonly encodeInsert: (input: {\n    readonly identityKey: string;\n    readonly identity: typeof OAuthExternalIdentity.Type;\n    readonly subjectId?: N;\n  }) => T[\"insert\"];\n}\n\nexport interface OAuthRegistrationIntentTable<I extends Table> {\n  readonly table: I[\"table\"];\n  readonly moduleId: Column<I>;\n  readonly reference: Column<I>;\n  readonly flowId: Column<I>;\n  readonly claimId: Column<I>;\n  readonly identityKey: Column<I>;\n  readonly version: Column<I>;\n  readonly state: Column<I>;\n  readonly snapshot: Column<I>;\n  readonly commandId: Column<I>;\n  readonly fingerprint: Column<I>;\n  readonly pendingReference: Column<I>;\n  readonly expiresAt: Column<I>;\n  readonly retentionUntil: Column<I>;\n  readonly encodeInsert: (intent: OAuthRegistrationIntent) => I[\"insert\"];\n}\n\nexport interface OAuthRegistrationCommandTable<R extends Table, Registration> {\n  readonly table: R[\"table\"];\n  readonly moduleId: Column<R>;\n  readonly commandId: Column<R>;\n  readonly reference: Column<R>;\n  readonly identityKey: Column<R>;\n  readonly fingerprint: Column<R>;\n  readonly intentSnapshot: Column<R>;\n  readonly applicationSnapshot: Column<R>;\n  readonly provisioningIdentity: Column<R>;\n  readonly decision: Column<R>;\n  readonly retentionUntil: Column<R>;\n  /** Persists exact detached Type before protected pending work can start. */\n  readonly encodeInsert: (input: {\n    readonly intent: OAuthRegistrationIntent;\n    readonly commandId: string;\n    readonly fingerprint: string;\n    readonly registration: Registration;\n    readonly provisioningIdentity: string;\n  }) => R[\"insert\"];\n}\n\nexport interface OAuthUnlinkCommandTable<U extends Table> {\n  readonly table: U[\"table\"];\n  readonly moduleId: Column<U>;\n  readonly commandId: Column<U>;\n  readonly subjectId: Column<U>;\n  readonly credentialId: Column<U>;\n  readonly intentSnapshot: Column<U>;\n  readonly decision: Column<U>;\n  readonly retentionUntil: Column<U>;\n  readonly encodeInsert: (input: {\n    readonly moduleId: string;\n    readonly commandId: string;\n    readonly credential: OAuthCredentialSnapshot;\n  }) => U[\"insert\"];\n}\n\nexport interface OAuthEligibilityFact {\n  readonly credentialId: string;\n  readonly revision: SecurityRevision;\n  readonly usablePrimary: boolean;\n  readonly factors: ReadonlyArray<AuthenticationFactor>;\n  readonly userVerified: boolean;\n  readonly phishingResistant: boolean;\n}\n\n/** Each descriptor reads only its own subject-scoped method rows. The native row\n * projector and SQL condition must express the same installed method eligibility.\n * All source/identifier/policy mutations advance subject securityRevision. D1 also\n * guards exact selected IDs/versions and absence/count assumptions, never just a\n * stale boolean. An over-limit graph fails closed rather than truncating. */\nexport interface OAuthEligibilityTable<\n  T extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: T[\"table\"];\n  readonly subjectId: Column<T>;\n  readonly credentialId: Column<T>;\n  readonly revision: Column<T>;\n  readonly scope: string;\n  readonly condition: (subjectId: N) => Expression;\n  readonly decode: (row: T[\"select\"]) => OAuthEligibilityFact | undefined;\n}\n\n/** Authenticated command replay uses current subject status and this additional\n * nonconsuming SQL policy. It never consumes a fresh action factor. */\nexport interface OAuthMetadataPolicy<N, Expression extends SqlExpression = SqlExpression> {\n  readonly condition: (subjectId: N) => Expression;\n}\n\nexport interface OAuthCleanupTable<\n  T extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: T[\"table\"];\n  readonly subjectId: Column<T>;\n  /** Bound to this subject's old revision; no opaque independently committing service. */\n  readonly condition: (input: {\n    readonly subjectId: N;\n    readonly revision: OAuthAccountRevision;\n    readonly removedCredentialId?: string;\n  }) => Expression;\n  readonly disposition: \"delete\";\n}\n\nexport interface OAuthRegistrationEligibility<N, Expression extends SqlExpression = SqlExpression> {\n  /** Pure SQL guards for mutable app policy; evaluated again after app writes. */\n  readonly condition: (input: {\n    readonly intent: OAuthRegistrationIntent;\n    readonly nativeSubjectId?: N;\n  }) => Expression;\n}\n\nexport interface OAuthD1Mapping {\n  readonly d1: { readonly primary: true };\n}\n\nexport const requiredOAuthSignInConstraints = {\n  flow: \"unique(flow.moduleId,flow.flowId)\",\n  command: \"unique(flow.moduleId,flow.commandId)\",\n  stateDigest: \"unique(flow.stateDigest)\",\n  ownership: \"unique(ownership.identityKey)\",\n  credentialId: \"unique(credential.credentialId)\",\n  credentialIdentity: \"unique(credential.identityKey)\",\n  authorityCredential: \"unique(authority.subjectId,authority.credentialId)\",\n} as const;\n\nexport const requiredOAuthTupleConstraints = { identityKey: \"unique(tuple.identityKey)\" } as const;\n\nexport const requiredOAuthRegistrationConstraints = {\n  intentReference: \"unique(intent.moduleId,intent.reference)\",\n  intentFlow: \"unique(intent.moduleId,intent.flowId)\",\n  command: \"unique(registrationCommand.moduleId,registrationCommand.commandId)\",\n} as const;\n\nexport const requiredOAuthAccountsConstraints = {\n  unlinkCommand: \"unique(unlinkCommand.moduleId,unlinkCommand.commandId)\",\n} as const;\n\nexport interface OAuthSignInMapping<\n  S extends Table,\n  O extends Table,\n  C extends Table,\n  AC extends Table,\n  F extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly subject: OAuthSubjectReadTable<S, Expression>;\n  readonly ownership: OAuthOwnershipReadTable<O, N, Expression>;\n  readonly credential: OAuthCredentialReadTable<C, Expression>;\n  readonly authority: OAuthAuthorityReadTable<AC, Expression>;\n  readonly flow: OAuthFlowTable<F>;\n  readonly subjectId: SubjectIdCodec<N>;\n  readonly clock: OAuthClock<Expression>;\n  readonly constraints: typeof requiredOAuthSignInConstraints;\n}\n\nexport type OAuthOwnershipMutation<\n  T extends Table,\n  O extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> =\n  | { readonly mode: \"integrated\"; readonly tuple: OAuthTupleAuthorityTable<T, N> }\n  | {\n      readonly mode: \"separate\";\n      readonly tuple: OAuthTupleAuthorityTable<T, N>;\n      readonly external: OAuthOwnershipTable<O, N, Expression>;\n    };\n\nexport interface OAuthRegistrationIntentMapping<\n  S extends Table,\n  O extends Table,\n  C extends Table,\n  AC extends Table,\n  F extends Table,\n  T extends Table,\n  I extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly signIn: OAuthSignInMapping<S, O, C, AC, F, N, Expression>;\n  readonly ownership: OAuthOwnershipMutation<T, O, N, Expression>;\n  readonly intent: OAuthRegistrationIntentTable<I>;\n  readonly tupleConstraints: typeof requiredOAuthTupleConstraints;\n  readonly registrationConstraints: Pick<\n    typeof requiredOAuthRegistrationConstraints,\n    \"intentReference\" | \"intentFlow\"\n  >;\n  readonly eligibility: OAuthRegistrationEligibility<N, Expression>;\n}\n\nexport interface OAuthRegistrationBase<\n  Registration,\n  T extends Table,\n  O extends Table,\n  I extends Table,\n  R extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n  Descriptor extends object = object,\n> {\n  readonly ownership: OAuthOwnershipMutation<T, O, N, Expression>;\n  readonly intent: OAuthRegistrationIntentTable<I>;\n  readonly command: OAuthRegistrationCommandTable<R, Registration>;\n  readonly clock: OAuthClock<Expression>;\n  readonly tupleConstraints: typeof requiredOAuthTupleConstraints;\n  readonly constraints: typeof requiredOAuthRegistrationConstraints;\n  readonly inspect: (input: {\n    readonly intent: OAuthRegistrationIntent;\n    readonly registration: Registration;\n  }) => Effect.Effect<\n    { readonly fingerprint: string; readonly eligible: boolean },\n    PersistenceMappingError\n  >;\n  /** Required for an explicitly bound native/DO command: no asynchronous callback\n   * is evaluated inside the physical owner. Standalone inspection is pre-owner. */\n  readonly inspectSync?: (input: {\n    readonly intent: OAuthRegistrationIntent;\n    readonly registration: Registration;\n  }) => { readonly fingerprint: string; readonly eligible: boolean };\n  /** Type projection, never the original wire transformation. */\n  readonly snapshot: (\n    registration: Registration,\n  ) => Effect.Effect<Registration, PersistenceMappingError>;\n  readonly snapshotSync?: (registration: Registration) => Registration;\n  /** Canonical bounded storage of Registration.Type. These are Type codecs, not\n   * the original wire decoder/encoder; decode(encode(value)) must encode identically.\n   * The engine writes and roundtrip-checks this exact string (maximum 1 MiB). */\n  readonly application: {\n    readonly encode: (registration: Registration) => string;\n    readonly decode: (stored: string) => Registration;\n  };\n  readonly eligibility: {\n    /** Stable application authority anchors, in one configured global order.\n     * Omit only for immutable/tuple-local policy or an equivalent explicit outer\n     * owner lock. Each scope must match 1..64 rows, never an absent quota row.\n     * Locks precede tuple/intent/command locks; postcondition owns changed state. */\n    readonly guards?: ReadonlyArray<\n      OAuthRegistrationGuardDescriptor<Registration, N, Expression, Descriptor>\n    >;\n    readonly admission: (input: {\n      readonly intent: OAuthRegistrationIntent;\n      readonly registration: Registration;\n      readonly nativeSubjectId?: N;\n    }) => Expression;\n    /** Evaluated after subject/application writes, including appended coordinator\n     * writes. May assert consumption of the admission invitation/quota. */\n    readonly postcondition: (input: {\n      readonly intent: OAuthRegistrationIntent;\n      readonly registration: Registration;\n      readonly nativeSubjectId?: N;\n    }) => Expression;\n  };\n  readonly allocateProvisioningIdentity: Effect.Effect<string, PersistenceMappingError>;\n  readonly retentionMillis: number;\n}\n\nexport interface OAuthRegistrationGuardTable<\n  T extends Table,\n  Registration,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: T[\"table\"];\n  readonly orderBy: Column<T>;\n  readonly condition: (input: {\n    readonly intent: OAuthRegistrationIntent;\n    readonly registration: Registration;\n    readonly nativeSubjectId?: N;\n  }) => Expression;\n}\n\nexport interface OAuthRegistrationGuardDescriptor<\n  Registration,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n  Descriptor extends object = object,\n> {\n  readonly table: Descriptor;\n  readonly orderBy: string;\n  readonly condition: OAuthRegistrationGuardTable<Table, Registration, N, Expression>[\"condition\"];\n}\n\nexport const oauthRegistrationGuardTable = <\n  T extends Table,\n  Registration,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n>(\n  input: OAuthRegistrationGuardTable<T, Registration, N, Expression>,\n): OAuthRegistrationGuardDescriptor<Registration, N, Expression, T[\"table\"]> =>\n  Object.freeze({\n    table: input.table,\n    orderBy: input.orderBy,\n    condition: input.condition,\n  });\n\nexport type OAuthRegistrationMapping<\n  Registration,\n  S extends Table,\n  O extends Table,\n  C extends Table,\n  AC extends Table,\n  T extends Table,\n  I extends Table,\n  R extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n  Descriptor extends object = object,\n> = OAuthRegistrationBase<Registration, T, O, I, R, N, Expression, Descriptor> &\n  (\n    | {\n        readonly mode: \"pending\";\n        readonly allocatePendingReference: Effect.Effect<string, PersistenceMappingError>;\n      }\n    | {\n        readonly mode: \"atomic\";\n        readonly subjectId: SubjectIdCodec<N>;\n        readonly subject: OAuthSubjectReadTable<S, Expression>;\n        readonly credential: OAuthCredentialTable<C, N, Expression>;\n        readonly authority: OAuthAuthorityTable<AC, N, Expression>;\n        readonly allocateSubjectId: Effect.Effect<N, PersistenceMappingError>;\n        readonly allocateCredentialId: Effect.Effect<string, PersistenceMappingError>;\n        readonly allocateRevision: Effect.Effect<SecurityRevision, PersistenceMappingError>;\n        readonly encodeSubjectInsert: (\n          input: { readonly intent: OAuthRegistrationIntent; readonly registration: Registration },\n          ids: { readonly subjectId: N; readonly securityRevision: SecurityRevision },\n        ) => S[\"insert\"];\n      }\n  );\n\n/** Heterogeneous descriptors are made by typed factories and projected privately. */\nexport interface OAuthEligibilityDescriptor<\n  N,\n  Expression extends SqlExpression = SqlExpression,\n  Descriptor extends object = object,\n> {\n  readonly _tag: \"OAuthEligibilityDescriptor\";\n  readonly scope: string;\n  readonly table: Descriptor;\n  readonly subjectId: string;\n  readonly credentialId: string;\n  readonly revision: string;\n  readonly condition: (subjectId: N) => Expression;\n  readonly decode: (row: unknown) => OAuthEligibilityFact | undefined;\n}\n\nexport const oauthEligibilityTable = <\n  T extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n>(\n  input: OAuthEligibilityTable<T, N, Expression>,\n): OAuthEligibilityDescriptor<N, Expression, T[\"table\"]> => {\n  const { table, subjectId, credentialId, revision, scope, condition, decode } = input;\n\n  return Object.freeze({\n    _tag: \"OAuthEligibilityDescriptor\",\n    table,\n    subjectId,\n    credentialId,\n    revision,\n    scope,\n    condition,\n    // The query owner supplies rows selected from this descriptor's mapped table.\n    decode: (row: unknown) => decode(row as T[\"select\"]),\n  });\n};\n\nexport interface OAuthCleanupDescriptor<\n  N,\n  Expression extends SqlExpression = SqlExpression,\n  Descriptor extends object = object,\n> {\n  readonly table: Descriptor;\n  readonly subjectId: string;\n  readonly condition: OAuthCleanupTable<Table, N, Expression>[\"condition\"];\n}\n\nexport const oauthCleanupTable = <\n  T extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n>(\n  input: OAuthCleanupTable<T, N, Expression>,\n): OAuthCleanupDescriptor<N, Expression, T[\"table\"]> =>\n  Object.freeze({ table: input.table, subjectId: input.subjectId, condition: input.condition });\n\n/** A stable application/reference lock acquired before an ownership target.\n * Missing rows retain ownership. Conditions use detached native IDs; every\n * writer of the guarded reference follows the same order. */\nexport interface OAuthReferenceGuardTable<\n  T extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: T[\"table\"];\n  readonly orderBy: Column<T>;\n  readonly condition: (input: {\n    readonly identity: typeof OAuthExternalIdentity.Type;\n    readonly identityKey: string;\n    readonly subjectId: N;\n  }) => Expression | Effect.Effect<Expression, PlatformError.PlatformError, Crypto.Crypto>;\n}\n\nexport interface OAuthReferenceGuardDescriptor<\n  N,\n  Expression extends SqlExpression = SqlExpression,\n  Descriptor extends object = object,\n> {\n  readonly table: Descriptor;\n  readonly orderBy: string;\n  readonly condition: OAuthReferenceGuardTable<Table, N, Expression>[\"condition\"];\n}\n\nexport const oauthReferenceGuardTable = <\n  T extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n>(\n  input: OAuthReferenceGuardTable<T, N, Expression>,\n): OAuthReferenceGuardDescriptor<N, Expression, T[\"table\"]> =>\n  Object.freeze({\n    table: input.table,\n    orderBy: input.orderBy,\n    condition: input.condition,\n  });\n\nexport interface OAuthAccountsMapping<\n  S extends Table,\n  O extends Table,\n  C extends Table,\n  AC extends Table,\n  F extends Table,\n  T extends Table,\n  U extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n  Descriptor extends object = object,\n> {\n  readonly subject: OAuthSubjectTable<S, Expression>;\n  readonly ownership: OAuthOwnershipMutation<T, O, N, Expression>;\n  readonly credential: OAuthCredentialTable<C, N, Expression>;\n  readonly authority: OAuthAuthorityTable<AC, N, Expression>;\n  readonly flow: OAuthFlowTable<F>;\n  readonly command: OAuthUnlinkCommandTable<U>;\n  readonly subjectId: SubjectIdCodec<N>;\n  readonly clock: OAuthClock<Expression>;\n  readonly constraints: typeof requiredOAuthSignInConstraints &\n    typeof requiredOAuthAccountsConstraints;\n  readonly tupleConstraints: typeof requiredOAuthTupleConstraints;\n  readonly eligibility: ReadonlyArray<OAuthEligibilityDescriptor<N, Expression, Descriptor>>;\n  readonly cleanup: ReadonlyArray<OAuthCleanupDescriptor<N, Expression, Descriptor>>;\n  readonly metadata: OAuthMetadataPolicy<N, Expression>;\n  readonly sessionInvalidation: \"same-authority-immediate\" | \"original-absolute-expiry\";\n  /** Omit only when connected access is absent. A predicate alone conservatively\n   * retains ownership; release also needs all configured guard rows below. */\n  readonly connectedReference?: (input: {\n    readonly identityKey: string;\n    readonly subjectId: N;\n  }) => Expression;\n  /** At most 32 descriptors, each locking 1..64 stable rows in supplied order.\n   * Missing/empty guards retain Owned, even when the reference predicate is false. */\n  readonly connectedReferenceGuards?: ReadonlyArray<\n    OAuthReferenceGuardDescriptor<N, Expression, Descriptor>\n  >;\n  readonly allocateCredentialId: Effect.Effect<string, PersistenceMappingError>;\n  readonly allocateRevision: Effect.Effect<SecurityRevision, PersistenceMappingError>;\n}\n\nexport interface OAuthRegistrationAuthority<Registration> {\n  readonly read: (\n    access: OAuthRegistrationAccess,\n  ) => Effect.Effect<OAuthRegistrationInspection | undefined, OAuthUnavailable>;\n  readonly inspect: (input: {\n    readonly intent: OAuthRegistrationIntent;\n    readonly registration: Registration;\n  }) => Effect.Effect<\n    {\n      readonly fingerprint: TokenDigest;\n      readonly eligible: boolean;\n    },\n    OAuthUnavailable\n  >;\n  readonly register: <A>(\n    input: {\n      readonly access: OAuthRegistrationAccess;\n      readonly intent: OAuthRegistrationIntent;\n      readonly commandId: typeof OAuthCommandId.Type;\n      readonly registration: Registration;\n      readonly fingerprint: TokenDigest;\n    },\n    prepare: PrepareOAuthCommit<OAuthRegistrationDecision, A>,\n  ) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;\n  readonly cleanup: <A>(\n    input: OAuthCleanupInput,\n    prepare: PrepareOAuthCommit<{ readonly removed: number; readonly hasMore: boolean }, A>,\n  ) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;\n}\n"],"mappings":";AAoUA,MAAa,iCAAiC;CAC5C,MAAM;CACN,SAAS;CACT,aAAa;CACb,WAAW;CACX,cAAc;CACd,oBAAoB;CACpB,qBAAqB;AACvB;AAEA,MAAa,gCAAgC,EAAE,aAAa,4BAA4B;AAExF,MAAa,uCAAuC;CAClD,iBAAiB;CACjB,YAAY;CACZ,SAAS;AACX;AAEA,MAAa,mCAAmC,EAC9C,eAAe,yDACjB;AAoJA,MAAa,+BAMX,UAEA,OAAO,OAAO;CACZ,OAAO,MAAM;CACb,SAAS,MAAM;CACf,WAAW,MAAM;AACnB,CAAC;AAoDH,MAAa,yBAKX,UAC0D;CAC1D,MAAM,EAAE,OAAO,WAAW,cAAc,UAAU,OAAO,WAAW,WAAW;CAE/E,OAAO,OAAO,OAAO;EACnB,MAAM;EACN;EACA;EACA;EACA;EACA;EACA;EAEA,SAAS,QAAiB,OAAO,GAAkB;CACrD,CAAC;AACH;AAYA,MAAa,qBAKX,UAEA,OAAO,OAAO;CAAE,OAAO,MAAM;CAAO,WAAW,MAAM;CAAW,WAAW,MAAM;AAAU,CAAC;AA6B9F,MAAa,4BAKX,UAEA,OAAO,OAAO;CACZ,OAAO,MAAM;CACb,SAAS,MAAM;CACf,WAAW,MAAM;AACnB,CAAC"}