@yielded/auth-persistence 0.1.0-beta.23 → 0.1.0-beta.25

package/src/internal/sql-oauth-model.ts

@@ -0,0 +1,263 @@
+import * as Shared from "./models/oauth-model";
+import type { TableModel } from "./query-operations";
+import type { Fragment as SQL, Table } from "./sql-table";
+
+export interface SqlTableModel<T extends Table = Table> extends TableModel {
+  readonly table: T;
+}
+
+export {
+  type OAuthFlowState,
+  type OAuthTupleState,
+  type OAuthRegistrationState,
+  type OAuthAction,
+  type OAuthEligibilityFact,
+  type OAuthD1Mapping,
+  requiredOAuthSignInConstraints,
+  requiredOAuthTupleConstraints,
+  requiredOAuthRegistrationConstraints,
+  requiredOAuthAccountsConstraints,
+  type OAuthRegistrationAuthority,
+} from "./models/oauth-model";
+
+/** The engine writes every critical column explicitly after applying the pure
+ * consumer encoder. Native instant values must roundtrip without precision loss. */
+export type OAuthClock = Shared.OAuthClock<SQL>;
+
+export type OAuthSubjectReadTable<S extends Table> = Shared.OAuthSubjectReadTable<
+  SqlTableModel<S>,
+  SQL
+>;
+
+export type OAuthSubjectTable<S extends Table> = Shared.OAuthSubjectTable<SqlTableModel<S>, SQL>;
+
+export type OAuthOwnershipReadTable<O extends Table, N> = Shared.OAuthOwnershipReadTable<
+  SqlTableModel<O>,
+  N,
+  SQL
+>;
+
+export type OAuthOwnershipTable<O extends Table, N> = Shared.OAuthOwnershipTable<
+  SqlTableModel<O>,
+  N,
+  SQL
+>;
+
+export type OAuthCredentialReadTable<C extends Table> = Shared.OAuthCredentialReadTable<
+  SqlTableModel<C>,
+  SQL
+>;
+
+export type OAuthCredentialTable<C extends Table, N> = Shared.OAuthCredentialTable<
+  SqlTableModel<C>,
+  N,
+  SQL
+>;
+
+export type OAuthAuthorityReadTable<C extends Table> = Shared.OAuthAuthorityReadTable<
+  SqlTableModel<C>,
+  SQL
+>;
+
+export type OAuthAuthorityTable<C extends Table, N> = Shared.OAuthAuthorityTable<
+  SqlTableModel<C>,
+  N,
+  SQL
+>;
+
+/** Both purposes may use the same physical table. Shared tables share module/flow
+ * and module/command uniqueness. The snapshot has the exact purpose-specific core
+ * codec; terminal writes erase it, while identity, claim and retention columns remain. */
+export type OAuthFlowTable<F extends Table> = Shared.OAuthFlowTable<SqlTableModel<F>>;
+
+export type OAuthTupleAuthorityTable<T extends Table, N> = Shared.OAuthTupleAuthorityTable<
+  SqlTableModel<T>,
+  N
+>;
+
+export type OAuthRegistrationIntentTable<I extends Table> = Shared.OAuthRegistrationIntentTable<
+  SqlTableModel<I>
+>;
+
+export type OAuthRegistrationCommandTable<
+  R extends Table,
+  Registration,
+> = Shared.OAuthRegistrationCommandTable<SqlTableModel<R>, Registration>;
+
+export type OAuthUnlinkCommandTable<U extends Table> = Shared.OAuthUnlinkCommandTable<
+  SqlTableModel<U>
+>;
+
+/** Each descriptor reads only its own subject-scoped method rows. The native row
+ * projector and SQL condition must express the same installed method eligibility.
+ * All source/identifier/policy mutations advance subject securityRevision. D1 also
+ * guards exact selected IDs/versions and absence/count assumptions, never just a
+ * stale boolean. An over-limit graph fails closed rather than truncating. */
+export type OAuthEligibilityTable<T extends Table, N> = Shared.OAuthEligibilityTable<
+  SqlTableModel<T>,
+  N,
+  SQL
+>;
+
+/** Authenticated command replay uses current subject status and this additional
+ * nonconsuming SQL policy. It never consumes a fresh action factor. */
+export type OAuthMetadataPolicy<N> = Shared.OAuthMetadataPolicy<N, SQL>;
+
+export type OAuthCleanupTable<T extends Table, N> = Shared.OAuthCleanupTable<
+  SqlTableModel<T>,
+  N,
+  SQL
+>;
+
+export type OAuthRegistrationEligibility<N> = Shared.OAuthRegistrationEligibility<N, SQL>;
+
+export type OAuthSignInMapping<
+  S extends Table,
+  O extends Table,
+  C extends Table,
+  AC extends Table,
+  F extends Table,
+  N,
+> = Shared.OAuthSignInMapping<
+  SqlTableModel<S>,
+  SqlTableModel<O>,
+  SqlTableModel<C>,
+  SqlTableModel<AC>,
+  SqlTableModel<F>,
+  N,
+  SQL
+>;
+
+export type OAuthOwnershipMutation<
+  T extends Table,
+  O extends Table,
+  N,
+> = Shared.OAuthOwnershipMutation<SqlTableModel<T>, SqlTableModel<O>, N, SQL>;
+
+export type OAuthRegistrationIntentMapping<
+  S extends Table,
+  O extends Table,
+  C extends Table,
+  AC extends Table,
+  F extends Table,
+  T extends Table,
+  I extends Table,
+  N,
+> = Shared.OAuthRegistrationIntentMapping<
+  SqlTableModel<S>,
+  SqlTableModel<O>,
+  SqlTableModel<C>,
+  SqlTableModel<AC>,
+  SqlTableModel<F>,
+  SqlTableModel<T>,
+  SqlTableModel<I>,
+  N,
+  SQL
+>;
+
+export type OAuthRegistrationBase<
+  Registration,
+  T extends Table,
+  O extends Table,
+  I extends Table,
+  R extends Table,
+  N,
+> = Shared.OAuthRegistrationBase<
+  Registration,
+  SqlTableModel<T>,
+  SqlTableModel<O>,
+  SqlTableModel<I>,
+  SqlTableModel<R>,
+  N,
+  SQL,
+  Table
+>;
+
+export type OAuthRegistrationGuardTable<
+  T extends Table,
+  Registration,
+  N,
+> = Shared.OAuthRegistrationGuardTable<SqlTableModel<T>, Registration, N, SQL>;
+
+export type OAuthRegistrationGuardDescriptor<Registration, N> =
+  Shared.OAuthRegistrationGuardDescriptor<Registration, N, SQL, Table>;
+
+export const oauthRegistrationGuardTable = <T extends Table, Registration, N>(
+  input: OAuthRegistrationGuardTable<T, Registration, N>,
+): OAuthRegistrationGuardDescriptor<Registration, N> =>
+  Shared.oauthRegistrationGuardTable<SqlTableModel<T>, Registration, N, SQL>(input);
+
+export type OAuthRegistrationMapping<
+  Registration,
+  S extends Table,
+  O extends Table,
+  C extends Table,
+  AC extends Table,
+  T extends Table,
+  I extends Table,
+  R extends Table,
+  N,
+> = Shared.OAuthRegistrationMapping<
+  Registration,
+  SqlTableModel<S>,
+  SqlTableModel<O>,
+  SqlTableModel<C>,
+  SqlTableModel<AC>,
+  SqlTableModel<T>,
+  SqlTableModel<I>,
+  SqlTableModel<R>,
+  N,
+  SQL,
+  Table
+>;
+
+/** Heterogeneous descriptors are made by typed factories and projected privately. */
+export type OAuthEligibilityDescriptor<N> = Shared.OAuthEligibilityDescriptor<N, SQL, Table>;
+
+export const oauthEligibilityTable = <T extends Table, N>(
+  input: OAuthEligibilityTable<T, N>,
+): OAuthEligibilityDescriptor<N> => Shared.oauthEligibilityTable<SqlTableModel<T>, N, SQL>(input);
+
+export type OAuthCleanupDescriptor<N> = Shared.OAuthCleanupDescriptor<N, SQL, Table>;
+
+export const oauthCleanupTable = <T extends Table, N>(
+  input: OAuthCleanupTable<T, N>,
+): OAuthCleanupDescriptor<N> => Shared.oauthCleanupTable<SqlTableModel<T>, N, SQL>(input);
+
+/** A stable application/reference lock acquired before an ownership target.
+ * Missing rows retain ownership. Conditions use detached native IDs; every
+ * writer of the guarded reference follows the same order. */
+export type OAuthReferenceGuardTable<T extends Table, N> = Shared.OAuthReferenceGuardTable<
+  SqlTableModel<T>,
+  N,
+  SQL
+>;
+
+export type OAuthReferenceGuardDescriptor<N> = Shared.OAuthReferenceGuardDescriptor<N, SQL, Table>;
+
+export const oauthReferenceGuardTable = <T extends Table, N>(
+  input: OAuthReferenceGuardTable<T, N>,
+): OAuthReferenceGuardDescriptor<N> =>
+  Shared.oauthReferenceGuardTable<SqlTableModel<T>, N, SQL>(input);
+
+export type OAuthAccountsMapping<
+  S extends Table,
+  O extends Table,
+  C extends Table,
+  AC extends Table,
+  F extends Table,
+  T extends Table,
+  U extends Table,
+  N,
+> = Shared.OAuthAccountsMapping<
+  SqlTableModel<S>,
+  SqlTableModel<O>,
+  SqlTableModel<C>,
+  SqlTableModel<AC>,
+  SqlTableModel<F>,
+  SqlTableModel<T>,
+  SqlTableModel<U>,
+  N,
+  SQL,
+  Table
+>;

package/src/internal/sql-query.ts

@@ -46,7 +46,7 @@ const combine = (separator: string, values: ReadonlyArray<Fragment | undefined>)
       );
 };
 
-const and = (...values: ReadonlyArray<Fragment | undefined>) => combine(" AND ", values);
+export const and = (...values: ReadonlyArray<Fragment | undefined>) => combine(" AND ", values);
 const or = (...values: ReadonlyArray<Fragment | undefined>) => combine(" OR ", values);
 
 const operations = {
@@ -54,9 +54,11 @@ const operations = {
   or,
   asc: (value: unknown) => template`${value} ASC`,
   eq: (left: unknown, right: unknown) => template`${left} = ${right}`,
+  ne: (left: unknown, right: unknown) => template`${left} <> ${right}`,
   gt: (left: unknown, right: unknown) => template`${left} > ${right}`,
   gte: (left: unknown, right: unknown) => template`${left} >= ${right}`,
   lte: (left: unknown, right: unknown) => template`${left} <= ${right}`,
+  isNotNull: (value: unknown) => template`${value} IS NOT NULL`,
   isNull: (value: unknown) => template`${value} IS NULL`,
   notExists: (value: unknown) => template`NOT EXISTS (${value})`,
   inArray: (column: unknown, values: ReadonlyArray<unknown>) =>
@@ -119,8 +121,8 @@ interface QueryState {
 const selectionFor = (state: QueryState): Selection =>
   state.selection ?? (state.table instanceof Table ? state.table.columns : {});
 
+// Logical keys may exceed SQL identifier limits; only short internal aliases reach the driver.
 const selectionFields = (selection: Selection) => {
-  const used = new Set(Object.keys(selection));
   let index = 0;
 
   return Object.entries(selection).flatMap<{
@@ -130,16 +132,13 @@ const selectionFields = (selection: Selection) => {
     readonly alias: string;
   }>(([key, value]) =>
     value instanceof Table
-      ? Object.entries(value.columns).map(([name, column]) => {
-          let alias: string;
-
-          do alias = `auth_column_${index++}`;
-          while (used.has(alias));
-          used.add(alias);
-
-          return { key, name, column, alias };
-        })
-      : [{ key, name: undefined, column: value, alias: key }],
+      ? Object.entries(value.columns).map(([name, column]) => ({
+          key,
+          name,
+          column,
+          alias: `auth_column_${index++}`,
+        }))
+      : [{ key, name: undefined, column: value, alias: `auth_column_${index++}` }],
   );
 };
 
@@ -214,7 +213,9 @@ const compile = (state: QueryState, compiler: Compiler): string => {
 
 /** Captures one Effect SQL client. Its transaction service remains the physical owner. */
 export const makeSqlDatabase = Effect.fnUntraced(function* (dialect: Dialect) {
-  const client = yield* SqlClient;
+  // Mappings and projection aliases own their names. Retain the client's
+  // connection and transaction identity while bypassing naming transforms.
+  const client = (yield* SqlClient).withoutTransforms();
 
   const query = (state: QueryState): Query => {
     const execute = Effect.suspend(() => {
@@ -299,3 +300,5 @@ export interface SqlDatabase {
 }
 
 export const sql = template;
+
+export const { eq } = operations;

package/src/internal/sql-storage-validation.ts

@@ -0,0 +1,64 @@
+import { Effect } from "effect";
+import { SqlClient } from "effect/sql";
+
+import { PersistenceMappingError } from "./mapping-error";
+import { Table } from "./sql-table";
+import { storageKeyPlans } from "./storage-plans";
+import { validateStorageBatch, type StorageValidation } from "./storage-validation";
+import { NativeDatabase } from "./transaction-kernel";
+
+/** Check declared mappings against physical keys before acquiring OAuth services. */
+export const validateSqlStorage = Effect.fnUntraced(function* (mapping: unknown) {
+  const plans = yield* Effect.try({
+    try: () =>
+      storageKeyPlans(mapping, (table) => {
+        if (!(table instanceof Table)) throw new Error("Expected a SQL table");
+
+        return table.columns;
+      }),
+    catch: () =>
+      PersistenceMappingError.make({ operation: "mapping", cause: "Invalid storage key mapping" }),
+  });
+
+  const { $client: client } = yield* NativeDatabase;
+
+  const dialect = client.onDialectOrElse({
+    pg: () => "pg" as const,
+    sqlite: () => "sqlite" as const,
+    orElse: () => undefined,
+  });
+
+  if (dialect === undefined)
+    return yield* PersistenceMappingError.make({
+      operation: "mapping",
+      cause: "OAuth persistence requires PostgreSQL or SQLite",
+    });
+  const validations: StorageValidation[] = [];
+
+  for (const plan of plans) {
+    if (!(plan.table instanceof Table))
+      return yield* PersistenceMappingError.make({
+        operation: "mapping",
+        cause: "Expected a SQL table",
+      });
+    validations.push({
+      table: {
+        name: plan.table.name,
+        ...(plan.table.schema === undefined ? {} : { schema: plan.table.schema }),
+        columns: Object.fromEntries(
+          Object.entries(plan.table.columns).map(([key, column]) => [key, column.options]),
+        ),
+      },
+      required: [plan.keys],
+    });
+  }
+  yield* validateStorageBatch(dialect, validations).pipe(
+    Effect.provideService(SqlClient.SqlClient, client),
+    Effect.mapError(() =>
+      PersistenceMappingError.make({
+        operation: "mapping",
+        cause: "Required SQL storage key is unavailable",
+      }),
+    ),
+  );
+});

package/src/internal/storage-mapping.ts

@@ -1,7 +1,6 @@
 import { EmailCredentialSnapshot } from "@yielded/auth/Email";
 import { LoginIdentifier } from "@yielded/auth/Identity";
 import {
-  PasswordAttemptId,
   PasswordCredentialSnapshot,
   EncodedPasswordHash,
   type PasswordReplacement,
@@ -375,7 +374,6 @@ export const makeMappings = Effect.fnUntraced(function* (input: MappingInput) {
       isCommandConflict: () => false,
       encodeInstant: instant,
       decodeInstant: readInstant,
-      allocateAttemptId: allocate.pipe(Effect.map(PasswordAttemptId.make)),
       allocateCredentialId: allocate,
       allocateRevision: allocate.pipe(Effect.map(SecurityRevision.make)),
       commandRetentionMillis: 86_400_000,
@@ -444,41 +442,6 @@ export const makeMappings = Effect.fnUntraced(function* (input: MappingInput) {
             });
           }),
       },
-      attempt: {
-        ...mapped("passwordAttempts"),
-        moduleId: "moduleId",
-        action: "action",
-        attemptId: "attemptId",
-        identifierNamespace: "identifierNamespace",
-        identifierValue: "identifierValue",
-        subjectId: "subjectId",
-        credentialId: "credentialId",
-        securityRevision: "securityRevision",
-        credentialRevision: "credentialRevision",
-        verifierVersion: "verifierVersion",
-        identifierBindingRevision: "identifierBindingRevision",
-        admittedAt: "admittedAt",
-        deadline: "deadline",
-        retentionUntil: "retentionUntil",
-        state: "state",
-        encodeInsert: (row, { nativeSubjectId, state }) => ({
-          moduleId: row.moduleId,
-          action: row.action,
-          attemptId: row.attemptId,
-          identifierNamespace: row.identifier.namespace,
-          identifierValue: row.identifier.value,
-          subjectId: nativeSubjectId ?? null,
-          credentialId: row.credentialId ?? null,
-          securityRevision: row.securityRevision ?? null,
-          credentialRevision: row.credentialRevision ?? null,
-          verifierVersion: row.verifierVersion ?? null,
-          identifierBindingRevision: row.identifierBindingRevision ?? null,
-          admittedAt: instant(row.admittedAtMillis),
-          deadline: instant(row.deadlineMillis),
-          retentionUntil: instant(row.retentionUntilMillis),
-          state,
-        }),
-      },
       command: {
         ...mapped("passwordCommands"),
         moduleId: "moduleId",

package/src/internal/storage-plans.ts

@@ -0,0 +1,218 @@
+import { Predicate, Schema } from "effect";
+
+// These are mapping contracts, not a parser for arbitrary constraint declarations.
+// Role aliases are explicit because their documentation names differ from mapping fields.
+const uniquePlans: Readonly<Record<string, readonly [string, ReadonlyArray<string>]>> = {
+  "unique(abuseEvent.moduleId,abuseEvent.action,abuseEvent.scopeKind,abuseEvent.scopeKey,abuseEvent.commandId)":
+    ["abuseEvent", ["moduleId", "action", "scopeKind", "scopeKey", "commandId"]],
+  "unique(admission.moduleId)": ["admission", ["moduleId"]],
+  "unique(attempt.moduleId,attempt.attemptId)": ["attempt", ["moduleId", "attemptId"]],
+  "unique(authority.subjectId,authority.credentialId)": [
+    "authority",
+    ["subjectId", "credentialId"],
+  ],
+  "unique(authorityCredential.subjectId,authorityCredential.credentialId)": [
+    "authorityCredential",
+    ["subjectId", "credentialId"],
+  ],
+  "unique(command.moduleId,command.commandId)": ["command", ["moduleId", "commandId"]],
+  "unique(connectedAdmission.admissionId)": ["admission", ["admissionId"]],
+  "unique(connectedClient.clientKey)": ["client", ["clientKey"]],
+  "unique(connectedCohort.cohortKey)": ["cohort", ["cohortKey"]],
+  "unique(connectedCommand.moduleId,connectedCommand.commandId)": [
+    "command",
+    ["moduleId", "commandId"],
+  ],
+  "unique(connectedFlow.moduleId,connectedFlow.commandId)": ["flow", ["moduleId", "commandId"]],
+  "unique(connectedFlow.moduleId,connectedFlow.flowId)": ["flow", ["moduleId", "flowId"]],
+  "unique(connectedFlow.stateDigest)": ["flow", ["stateDigest"]],
+  "unique(connectedGrant.moduleId,connectedGrant.grantId)": ["grant", ["moduleId", "grantId"]],
+  "unique(connectedGrant.moduleId,connectedGrant.subjectId,connectedGrant.profileKey,connectedGrant.activeIdentityKey)":
+    ["grant", ["moduleId", "subjectId", "profileKey", "activeIdentityKey"]],
+  "unique(connectedRevocation.jobId)": ["job", ["jobId"]],
+  "unique(continuation.moduleId,continuation.continuationId)": [
+    "continuation",
+    ["moduleId", "continuationId"],
+  ],
+  "unique(continuation.moduleId,continuation.digest)": ["continuation", ["moduleId", "digest"]],
+  "unique(credential.credentialId)": ["credential", ["credentialId"]],
+  "unique(credential.identityKey)": ["credential", ["identityKey"]],
+  "unique(credential.moduleId,credential.credentialId)": [
+    "credential",
+    ["moduleId", "credentialId"],
+  ],
+  "unique(credential.moduleId,credential.subjectId)": ["credential", ["moduleId", "subjectId"]],
+  "unique(emailCommand.moduleId,emailCommand.commandId)": ["command", ["moduleId", "commandId"]],
+  "unique(emailCredential.moduleId,emailCredential.credentialId)": [
+    "credential",
+    ["moduleId", "credentialId"],
+  ],
+  "unique(emailCredential.moduleId,emailCredential.identifierNamespace,emailCredential.identifierValue)":
+    ["credential", ["moduleId", "identifierNamespace", "identifierValue"]],
+  "unique(emailRegistration.moduleId,emailRegistration.commandId)": [
+    "registration",
+    ["moduleId", "commandId"],
+  ],
+  "unique(emailRegistration.pendingReference)": ["registration", ["pendingReference"]],
+  "unique(failureEvent.moduleId,failureEvent.seriesKey,failureEvent.commandId)": [
+    "failureEvent",
+    ["moduleId", "seriesKey", "commandId"],
+  ],
+  "unique(flow.flowId)": ["flow", ["flowId"]],
+  "unique(flow.moduleId,flow.commandId)": ["flow", ["moduleId", "commandId"]],
+  "unique(flow.moduleId,flow.flowId)": ["flow", ["moduleId", "flowId"]],
+  "unique(flow.stateDigest)": ["flow", ["stateDigest"]],
+  "unique(generation.moduleId,generation.deliveryId)": ["generation", ["moduleId", "deliveryId"]],
+  "unique(generation.moduleId,generation.proofId)": ["generation", ["moduleId", "proofId"]],
+  "unique(identifier.namespace,identifier.value)": ["identifier", ["namespace", "value"]],
+  "unique(intent.digest)": ["intent", ["digest"]],
+  "unique(intent.flowId)": ["intent", ["flowId"]],
+  "unique(intent.moduleId,intent.commandId)": ["intent", ["moduleId", "commandId"]],
+  "unique(intent.moduleId,intent.flowId)": ["intent", ["moduleId", "flowId"]],
+  "unique(intent.moduleId,intent.intentId)": ["intent", ["moduleId", "intentId"]],
+  "unique(intent.moduleId,intent.reference)": ["intent", ["moduleId", "reference"]],
+  "unique(ownership.identityKey)": ["ownership", ["identityKey"]],
+  "unique(pending.digest)": ["pending", ["digest"]],
+  "unique(pending.flowId)": ["pending", ["flowId"]],
+  "unique(rateScope.moduleId,rateScope.purpose,rateScope.action,rateScope.scopeKind,rateScope.scopeKey)":
+    ["rateScope", ["moduleId", "purpose", "action", "scopeKind", "scopeKey"]],
+  "unique(registration.moduleId,registration.requestId)": [
+    "registration",
+    ["moduleId", "requestId"],
+  ],
+  "unique(registration.recoveryReference)": ["registration", ["recoveryReference"]],
+  "unique(registrationCommand.moduleId,registrationCommand.commandId)": [
+    "command",
+    ["moduleId", "commandId"],
+  ],
+  "unique(request.moduleId,request.requestId)": ["request", ["moduleId", "requestId"]],
+  "unique(series.moduleId,series.purpose,series.scopeKey)": [
+    "series",
+    ["moduleId", "purpose", "scopeKey"],
+  ],
+  "unique(session.digest)": ["session", ["digest"]],
+  "unique(tombstone.subjectId,tombstone.sessionId)": ["tombstone", ["subjectId", "sessionId"]],
+  "unique(tuple.identityKey)": ["ownership.tuple", ["identityKey"]],
+  "unique(unlinkCommand.moduleId,unlinkCommand.commandId)": ["command", ["moduleId", "commandId"]],
+};
+
+const arrayRoles: Readonly<Record<string, string>> = {
+  credentialId: "credential",
+  factor: "authority",
+  credentialOwnership: "credentialOwnership",
+  handleOwnership: "handleOwnership",
+  boundSubjectHandle: "handleOwnership",
+  flow: "flow",
+  command: "flow",
+  admission: "admission",
+  charge: "charge",
+  intentFlow: "intent",
+  intentCommand: "intent",
+  handle: "handle",
+};
+
+const nestedMappings = [
+  "read",
+  "signIn",
+  "password",
+  "proof",
+  "proofs",
+  "revocation",
+  "pending",
+  "session",
+  "source",
+];
+
+const constraintGroups = [
+  "constraints",
+  "tupleConstraints",
+  "registrationConstraints",
+  "managementConstraints",
+];
+
+const MappingRecord = Schema.Record(Schema.String, Schema.Unknown);
+const record = Schema.decodeUnknownSync(MappingRecord);
+
+export const storageKeyPlans = (
+  input: unknown,
+  columnsFor: (table: object) => Readonly<Record<string, unknown>>,
+) => {
+  const mapping = record(input);
+  const result: Array<{ readonly table: object; readonly keys: ReadonlyArray<string> }> = [];
+
+  for (const group of constraintGroups) {
+    if (mapping[group] === undefined) continue;
+    for (const [name, declaration] of Object.entries(record(mapping[group]))) {
+      if (declaration === "notNull(provisioningRequest.subjectId)") continue;
+      let role: string;
+      let keys: ReadonlyArray<string>;
+
+      if (typeof declaration === "string") {
+        const plan = uniquePlans[declaration];
+
+        if (plan !== undefined) [role, keys] = plan;
+        else if (declaration === "unique(id)") {
+          role = "subject";
+          keys = ["id"];
+        } else if (declaration === "unique(scope)") {
+          role = name;
+          keys = ["scope"];
+        } else if (declaration === "unique(credentialId)") {
+          role = "credential";
+          keys = ["id"];
+        } else if (declaration === "unique(namespace,value)") {
+          role = "identifier";
+          keys = ["namespace", "value"];
+        } else if (declaration === "unique(provider,issuer,subject)") {
+          role = "externalIdentity";
+          keys = ["provider", "issuer", "subject"];
+        } else if (declaration === "unique(requestId)") {
+          role = "provisioningRequest";
+          keys = ["requestId"];
+        } else throw new Error("Unknown storage constraint");
+      } else if (Array.isArray(declaration) && declaration.every(Predicate.isString)) {
+        const mappedRole =
+          group === "managementConstraints" && name === "command" ? "command" : arrayRoles[name];
+
+        if (mappedRole === undefined) throw new Error("Unknown storage constraint");
+        role = mappedRole;
+        keys = declaration;
+      } else throw new Error("Invalid storage constraint");
+
+      let target: unknown = mapping;
+
+      for (const segment of role.split(".")) target = record(target)[segment];
+      // Session authority places its pending tables in one nested mapping.
+      if (target === undefined && Schema.is(MappingRecord)(mapping.pending))
+        target = mapping.pending[role];
+      let mapped = record(target);
+
+      if (role === "pending" && mapped.table === undefined) mapped = record(mapped.pending);
+      // OAuth ownership can be integrated into its tuple authority or separate.
+      if (role === "ownership" && mapped.table === undefined)
+        mapped = record(mapped.external ?? mapped.tuple);
+      if (!Predicate.isObject(mapped.table)) throw new Error("Missing storage table");
+      const columns = columnsFor(mapped.table);
+
+      result.push({
+        table: mapped.table,
+        keys: keys.map((key) => {
+          const value = mapped[key];
+
+          if (typeof value !== "string" || columns[value] === undefined)
+            throw new Error("Missing mapped key");
+
+          return value;
+        }),
+      });
+    }
+  }
+  for (const nested of nestedMappings) {
+    const value = mapping[nested];
+
+    if (Schema.is(MappingRecord)(value) && value.table === undefined)
+      result.push(...storageKeyPlans(value, columnsFor));
+  }
+
+  return result;
+};