@yielded/auth-persistence 0.1.0-beta.24 → 0.1.0-beta.26

package/dist/internal/models/email-model.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"email-model.mjs","names":[],"sources":["../../../src/internal/models/email-model.ts"],"sourcesContent":["import type { EmailAction, EmailRegistrationDecision } from \"@yielded/auth/Email\";\nimport type { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport type { ProofBinding, ProofContinuationId, ProofPurpose } from \"@yielded/auth/Proofs\";\nimport type { TokenDigest } from \"@yielded/auth/Schema\";\nimport type { AuthenticationRequirement, SecurityRevision } from \"@yielded/auth/Sessions\";\nimport type { Effect } from \"effect\";\n\nimport type { AnyTableModel, TableModel as Table, SqlExpression } from \"../query-operations\";\nimport type { PersistenceMappingError, SubjectIdCodec } from \"./common\";\n\ntype ColumnKey<T extends Table> = T[\"column\"];\n\nexport interface EmailSubjectReadTable<Subject extends Table> {\n  readonly table: Subject[\"table\"];\n  readonly id: ColumnKey<Subject>;\n  readonly status: ColumnKey<Subject>;\n  readonly securityRevision: ColumnKey<Subject>;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly d1ActiveStatusValue?: unknown;\n}\n\nexport interface EmailSubjectTable<Subject extends Table> extends EmailSubjectReadTable<Subject> {\n  readonly decodeActionRequirement: (\n    row: Subject[\"select\"],\n    action: EmailAction,\n  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n  readonly nextSecurityRevision?: (\n    current: SecurityRevision,\n  ) => Effect.Effect<SecurityRevision, PersistenceMappingError>;\n  readonly nextSecurityRevisionSync?: (current: SecurityRevision) => SecurityRevision;\n  readonly d1ActiveStatusValue?: unknown;\n}\n\nexport interface EmailIdentifierReadTable<Identifier extends Table> {\n  readonly table: Identifier[\"table\"];\n  readonly namespace: ColumnKey<Identifier>;\n  readonly value: ColumnKey<Identifier>;\n  readonly subjectId: ColumnKey<Identifier>;\n  readonly verifiedAt: ColumnKey<Identifier>;\n  readonly bindingRevision: ColumnKey<Identifier>;\n  readonly isCurrent: (row: Identifier[\"select\"]) => boolean;\n}\n\nexport interface EmailIdentifierTable<\n  Identifier extends Table,\n  NativeSubjectId,\n  Expression extends SqlExpression = SqlExpression,\n> extends EmailIdentifierReadTable<Identifier> {\n  /** True only for an active, unverified binding. Confirming it preserves existing sessions. */\n  readonly isMutableTarget: (row: Identifier[\"select\"]) => boolean;\n  readonly encodeVerifiedInsert: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly subjectId: NativeSubjectId;\n    readonly verifiedAtMillis: number;\n    readonly bindingRevision: SecurityRevision;\n  }) => Identifier[\"insert\"];\n  readonly encodeVerification: (input: {\n    readonly verifiedAtMillis: number;\n    readonly bindingRevision: SecurityRevision;\n  }) => Partial<Identifier[\"insert\"]>;\n  /** Must make the selected source unavailable to sign-in. */\n  readonly encodeRetirement: (input: {\n    readonly source: LoginIdentifier;\n    readonly bindingRevision: SecurityRevision;\n  }) => Partial<Identifier[\"insert\"]>;\n  readonly d1CurrentCondition?: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly nativeSubjectId: NativeSubjectId;\n    readonly bindingRevision: SecurityRevision;\n  }) => Expression;\n  readonly d1MutableTargetCondition?: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly nativeSubjectId: NativeSubjectId;\n  }) => Expression;\n}\n\nexport interface EmailCredentialReadTable<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  _NativeSubjectId,\n> {\n  readonly table: Credential[\"table\"];\n  readonly moduleId: ColumnKey<Credential>;\n  readonly subjectId: ColumnKey<Credential>;\n  readonly credentialId: ColumnKey<Credential>;\n  readonly identifierNamespace: ColumnKey<Credential>;\n  readonly identifierValue: ColumnKey<Credential>;\n  readonly credentialRevision: ColumnKey<Credential>;\n  readonly status: ColumnKey<Credential>;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly decode: (input: {\n    readonly moduleId: string;\n    readonly subject: Subject[\"select\"];\n    readonly identifier: Identifier[\"select\"];\n    readonly credential: Credential[\"select\"];\n  }) => Effect.Effect<\n    import(\"@yielded/auth/Email\").EmailCredentialSnapshot,\n    PersistenceMappingError\n  >;\n}\n\nexport interface EmailCredentialTable<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  NativeSubjectId,\n> extends EmailCredentialReadTable<Subject, Identifier, Credential, NativeSubjectId> {\n  readonly encodeVerifiedInsert: (input: {\n    readonly moduleId: string;\n    readonly subjectId: NativeSubjectId;\n    readonly credentialId: string;\n    readonly identifier: LoginIdentifier;\n    readonly credentialRevision: SecurityRevision;\n  }) => Credential[\"insert\"];\n  readonly encodeActivation: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly credentialRevision: SecurityRevision;\n  }) => Partial<Credential[\"insert\"]>;\n  readonly encodeRetirement: (input: {\n    readonly source: LoginIdentifier;\n    readonly credentialRevision: SecurityRevision;\n  }) => Partial<Credential[\"insert\"]>;\n  readonly d1ActiveStatusValue?: unknown;\n}\n\nexport interface EmailAuthorityCredentialTable<Credential extends Table, NativeSubjectId> {\n  readonly table: Credential[\"table\"];\n  readonly subjectId: ColumnKey<Credential>;\n  readonly credentialId: ColumnKey<Credential>;\n  readonly revision: ColumnKey<Credential>;\n  readonly status: ColumnKey<Credential>;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly encodeInsert: (input: {\n    readonly subjectId: NativeSubjectId;\n    readonly credentialId: string;\n    readonly revision: SecurityRevision;\n  }) => Credential[\"insert\"];\n  readonly encodeActivation: (revision: SecurityRevision) => Partial<Credential[\"insert\"]>;\n  readonly encodeRetirement: (revision: SecurityRevision) => Partial<Credential[\"insert\"]>;\n  readonly d1ActiveStatusValue?: unknown;\n}\n\nexport interface EmailCommandTable<Command extends Table> {\n  readonly table: Command[\"table\"];\n  readonly moduleId: ColumnKey<Command>;\n  readonly commandId: ColumnKey<Command>;\n  readonly action: ColumnKey<Command>;\n  readonly bindingDigest: ColumnKey<Command>;\n  readonly retentionUntil: ColumnKey<Command>;\n  readonly encodeInsert: (input: {\n    readonly moduleId: string;\n    readonly commandId: string;\n    readonly action: EmailAction;\n    readonly bindingDigest: TokenDigest;\n    readonly retentionUntilMillis: number;\n  }) => Command[\"insert\"];\n}\n\nexport interface RequiredEmailSignInConstraints {\n  readonly identifier: \"unique(identifier.namespace,identifier.value)\";\n  readonly credentialId: \"unique(emailCredential.moduleId,emailCredential.credentialId)\";\n  readonly credentialIdentifier: \"unique(emailCredential.moduleId,emailCredential.identifierNamespace,emailCredential.identifierValue)\";\n}\n\nexport const requiredEmailSignInConstraints: RequiredEmailSignInConstraints = {\n  identifier: \"unique(identifier.namespace,identifier.value)\",\n  credentialId: \"unique(emailCredential.moduleId,emailCredential.credentialId)\",\n  credentialIdentifier:\n    \"unique(emailCredential.moduleId,emailCredential.identifierNamespace,emailCredential.identifierValue)\",\n};\n\nexport interface EmailSignInMapping<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  NativeSubjectId,\n> {\n  readonly subject: EmailSubjectReadTable<Subject>;\n  readonly identifier: EmailIdentifierReadTable<Identifier>;\n  readonly credential: EmailCredentialReadTable<Subject, Identifier, Credential, NativeSubjectId>;\n  readonly subjectId: SubjectIdCodec<NativeSubjectId>;\n  readonly constraints: RequiredEmailSignInConstraints;\n  readonly decodeInstant: (native: unknown) => Effect.Effect<number, PersistenceMappingError>;\n}\n\nexport interface RequiredEmailAddressConstraints extends RequiredEmailSignInConstraints {\n  readonly authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\";\n  readonly command: \"unique(emailCommand.moduleId,emailCommand.commandId)\";\n}\n\nexport const requiredEmailAddressConstraints: RequiredEmailAddressConstraints = {\n  ...requiredEmailSignInConstraints,\n  authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\",\n  command: \"unique(emailCommand.moduleId,emailCommand.commandId)\",\n};\n\nexport interface EmailD1Clock<Expression extends SqlExpression = SqlExpression> {\n  readonly engineNow: Expression;\n  readonly engineNowMillis: Expression;\n  readonly engineInstantPlus: (millis: number) => Expression;\n}\n\nexport interface EmailAddressMapping<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Command extends Table,\n  NativeSubjectId,\n  Expression extends SqlExpression = SqlExpression,\n> extends EmailSignInMapping<Subject, Identifier, Credential, NativeSubjectId> {\n  readonly subject: EmailSubjectTable<Subject>;\n  readonly identifier: EmailIdentifierTable<Identifier, NativeSubjectId, Expression>;\n  readonly credential: EmailCredentialTable<Subject, Identifier, Credential, NativeSubjectId>;\n  readonly authorityCredential: EmailAuthorityCredentialTable<AuthorityCredential, NativeSubjectId>;\n  readonly command: EmailCommandTable<Command>;\n  readonly constraints: RequiredEmailAddressConstraints;\n  readonly addressCardinality: \"single\" | \"multiple\";\n  readonly changeDisposition: \"retire-source\";\n  readonly allocateCredentialId?: Effect.Effect<string, PersistenceMappingError>;\n  readonly allocateCredentialIdSync?: () => string;\n  readonly allocateRevision?: Effect.Effect<SecurityRevision, PersistenceMappingError>;\n  readonly allocateRevisionSync?: () => SecurityRevision;\n  readonly encodeInstant: (epochMillis: number) => unknown;\n  readonly commandRetentionMillis: number;\n  readonly sessionInvalidation: \"same-authority-immediate\" | \"original-absolute-expiry\";\n  readonly isCommandConflict: (cause: unknown) => boolean;\n  readonly isIdentifierConflict: (cause: unknown) => boolean;\n  readonly isCredentialConflict: (cause: unknown) => boolean;\n  readonly d1?: EmailD1Clock<Expression>;\n}\n\nexport type D1EmailAddressMapping<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Command extends Table,\n  NativeSubjectId,\n  Expression extends SqlExpression = SqlExpression,\n> = EmailAddressMapping<\n  Subject,\n  Identifier,\n  Credential,\n  AuthorityCredential,\n  Command,\n  NativeSubjectId,\n  Expression\n> & {\n  readonly d1: EmailD1Clock<Expression>;\n  readonly subject: EmailSubjectTable<Subject> & {\n    readonly d1ActiveStatusValue: unknown;\n  };\n  readonly identifier: EmailIdentifierTable<Identifier, NativeSubjectId, Expression> & {\n    readonly d1CurrentCondition: NonNullable<\n      EmailIdentifierTable<Identifier, NativeSubjectId, Expression>[\"d1CurrentCondition\"]\n    >;\n    readonly d1MutableTargetCondition: NonNullable<\n      EmailIdentifierTable<Identifier, NativeSubjectId, Expression>[\"d1MutableTargetCondition\"]\n    >;\n  };\n  readonly credential: EmailCredentialTable<Subject, Identifier, Credential, NativeSubjectId> & {\n    readonly d1ActiveStatusValue: unknown;\n  };\n  readonly authorityCredential: EmailAuthorityCredentialTable<\n    AuthorityCredential,\n    NativeSubjectId\n  > & {\n    readonly d1ActiveStatusValue: unknown;\n  };\n};\n\nexport type EmailRegistrationState = \"pending\" | \"registered\";\n\nexport interface EmailRegistrationIntent<Registration> {\n  readonly moduleId: string;\n  readonly commandId: string;\n  readonly identifier: LoginIdentifier;\n  readonly registration: Registration;\n  readonly fingerprint: TokenDigest;\n  readonly completion: {\n    readonly moduleId: string;\n    readonly purpose: ProofPurpose;\n    readonly continuationId: ProofContinuationId;\n    readonly binding: ProofBinding;\n  };\n}\n\nexport interface EmailRegistrationTable<Registration, Request extends Table, NativeSubjectId> {\n  readonly table: Request[\"table\"];\n  readonly moduleId: ColumnKey<Request>;\n  readonly commandId: ColumnKey<Request>;\n  readonly fingerprint: ColumnKey<Request>;\n  readonly state: ColumnKey<Request>;\n  readonly subjectId: ColumnKey<Request>;\n  readonly pendingReference: ColumnKey<Request>;\n  readonly retentionUntil: ColumnKey<Request>;\n  readonly encodeInsert: (\n    input: EmailRegistrationIntent<Registration>,\n    state: {\n      readonly state: EmailRegistrationState;\n      readonly nativeSubjectId?: NativeSubjectId;\n      readonly pendingReference?: string;\n      readonly retentionUntilMillis: number;\n    },\n  ) => Request[\"insert\"];\n  readonly decodeReplay: (row: Request[\"select\"]) => Effect.Effect<\n    Exclude<\n      EmailRegistrationDecision,\n      {\n        readonly _tag: \"Registered\";\n      }\n    >,\n    PersistenceMappingError\n  >;\n}\n\nexport interface EmailRegistrationProvisioning<\n  Registration,\n  Subject extends Table,\n  NativeSubjectId,\n> {\n  readonly encodeSubjectInsert: (\n    input: EmailRegistrationIntent<Registration>,\n    values: {\n      readonly nativeSubjectId: NativeSubjectId | undefined;\n      readonly securityRevision: SecurityRevision;\n    },\n  ) => Subject[\"insert\"];\n  readonly allocateSubjectId?: Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n  readonly allocateSubjectIdSync?: () => NativeSubjectId;\n  readonly decodeGeneratedId?: (\n    rows: ReadonlyArray<unknown>,\n  ) => Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n}\n\nexport interface EmailRegistrationIdentifierTable<\n  Identifier extends Table,\n  NativeSubjectId,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: Identifier[\"table\"];\n  readonly namespace: ColumnKey<Identifier>;\n  readonly value: ColumnKey<Identifier>;\n  /** Atomic mailbox registration may reassign an unverified binding in place.\n   * Only subjectId, verifiedAt and bindingRevision change; the supplied proof\n   * authority must admit only absent or active-unverified registration targets.\n   * Its prior subject's mapped securityRevision advances in the same commit. */\n  readonly subjectId: ColumnKey<Identifier>;\n  readonly verifiedAt: ColumnKey<Identifier>;\n  readonly bindingRevision: ColumnKey<Identifier>;\n  readonly isCurrent: (row: Identifier[\"select\"]) => boolean;\n  readonly d1CurrentCondition?: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly nativeSubjectId: NativeSubjectId;\n    readonly bindingRevision: SecurityRevision;\n  }) => Expression;\n  readonly encodeVerifiedInsert: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly subjectId: NativeSubjectId;\n    readonly verifiedAtMillis: number;\n    readonly bindingRevision: SecurityRevision;\n  }) => Identifier[\"insert\"];\n}\n\nexport interface EmailRegistrationCredentialTable<Credential extends Table, NativeSubjectId> {\n  readonly table: Credential[\"table\"];\n  readonly moduleId: ColumnKey<Credential>;\n  readonly subjectId: ColumnKey<Credential>;\n  readonly credentialId: ColumnKey<Credential>;\n  readonly identifierNamespace: ColumnKey<Credential>;\n  readonly identifierValue: ColumnKey<Credential>;\n  readonly credentialRevision: ColumnKey<Credential>;\n  readonly status: ColumnKey<Credential>;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly d1ActiveStatusValue?: unknown;\n  readonly encodeVerifiedInsert: (input: {\n    readonly moduleId: string;\n    readonly subjectId: NativeSubjectId;\n    readonly credentialId: string;\n    readonly identifier: LoginIdentifier;\n    readonly credentialRevision: SecurityRevision;\n  }) => Credential[\"insert\"];\n}\n\nexport interface EmailRegistrationAuthorityCredentialTable<\n  Credential extends Table,\n  NativeSubjectId,\n> {\n  readonly table: Credential[\"table\"];\n  readonly subjectId: ColumnKey<Credential>;\n  readonly credentialId: ColumnKey<Credential>;\n  readonly revision: ColumnKey<Credential>;\n  readonly status: ColumnKey<Credential>;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly d1ActiveStatusValue?: unknown;\n  readonly encodeInsert: (input: {\n    readonly subjectId: NativeSubjectId;\n    readonly credentialId: string;\n    readonly revision: SecurityRevision;\n  }) => Credential[\"insert\"];\n}\n\nexport interface RequiredEmailRegistrationConstraints extends RequiredEmailSignInConstraints {\n  readonly authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\";\n  readonly request: \"unique(emailRegistration.moduleId,emailRegistration.commandId)\";\n  readonly pendingReference: \"unique(emailRegistration.pendingReference)\";\n}\n\nexport const requiredEmailRegistrationConstraints: RequiredEmailRegistrationConstraints = {\n  ...requiredEmailSignInConstraints,\n  authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\",\n  request: \"unique(emailRegistration.moduleId,emailRegistration.commandId)\",\n  pendingReference: \"unique(emailRegistration.pendingReference)\",\n};\n\ntype EmailRegistrationBase<Registration, Request extends Table, NativeSubjectId> = {\n  readonly registration: EmailRegistrationTable<Registration, Request, NativeSubjectId>;\n  readonly constraints: Pick<RequiredEmailRegistrationConstraints, \"request\" | \"pendingReference\">;\n  readonly inspect: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly registration: Registration;\n  }) => Effect.Effect<\n    {\n      readonly fingerprint: TokenDigest;\n      readonly eligible: boolean;\n    },\n    PersistenceMappingError\n  >;\n  /** Projects one detached value of the factory-specific Registration Type. */\n  readonly snapshotRegistration: (\n    registration: Registration,\n  ) => Effect.Effect<Registration, PersistenceMappingError>;\n  /** Required by synchronous transaction-bound services. */\n  readonly snapshotRegistrationSync?: (registration: Registration) => Registration;\n  /** Required by synchronous Durable Object transaction-bound services. */\n  readonly inspectSync?: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly registration: Registration;\n  }) => {\n    readonly fingerprint: TokenDigest;\n    readonly eligible: boolean;\n  };\n  readonly allocatePendingReference?: Effect.Effect<string, PersistenceMappingError>;\n  readonly allocatePendingReferenceSync?: () => string;\n  readonly encodeInstant: (epochMillis: number) => unknown;\n  readonly retentionMillis: number;\n  readonly isRequestConflict: (cause: unknown) => boolean;\n};\n\nexport type EmailRegistrationMapping<\n  Registration,\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Request extends Table,\n  NativeSubjectId,\n  Expression extends SqlExpression = SqlExpression,\n> = EmailRegistrationBase<Registration, Request, NativeSubjectId> &\n  (\n    | {\n        readonly mode: \"atomic\";\n        readonly subject: EmailSubjectReadTable<Subject>;\n        readonly identifier: EmailRegistrationIdentifierTable<\n          Identifier,\n          NativeSubjectId,\n          Expression\n        >;\n        readonly credential: EmailRegistrationCredentialTable<Credential, NativeSubjectId>;\n        readonly authorityCredential: EmailRegistrationAuthorityCredentialTable<\n          AuthorityCredential,\n          NativeSubjectId\n        >;\n        readonly subjectId: SubjectIdCodec<NativeSubjectId>;\n        readonly constraints: RequiredEmailRegistrationConstraints;\n        readonly allocateCredentialId?: Effect.Effect<string, PersistenceMappingError>;\n        readonly allocateCredentialIdSync?: () => string;\n        readonly allocateRevision?: Effect.Effect<SecurityRevision, PersistenceMappingError>;\n        readonly allocateRevisionSync?: () => SecurityRevision;\n        readonly isIdentifierConflict: (cause: unknown) => boolean;\n        readonly isCredentialConflict: (cause: unknown) => boolean;\n        readonly provisioning: EmailRegistrationProvisioning<\n          Registration,\n          Subject,\n          NativeSubjectId\n        > &\n          (\n            | {\n                readonly idMode: \"allocated\";\n                readonly allocateSubjectId: Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n              }\n            | {\n                readonly idMode: \"synchronous\";\n                readonly allocateSubjectIdSync: () => NativeSubjectId;\n              }\n            | {\n                readonly idMode: \"generated\";\n                readonly decodeGeneratedId: (\n                  rows: ReadonlyArray<unknown>,\n                ) => Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n              }\n          );\n      }\n    | {\n        readonly mode: \"pending\";\n      }\n  );\n\nexport type AnyEmailSignInMapping = EmailSignInMapping<\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  unknown\n>;\n\nexport type AnyEmailAddressMapping<Expression extends SqlExpression = SqlExpression> =\n  EmailAddressMapping<\n    AnyTableModel,\n    AnyTableModel,\n    AnyTableModel,\n    AnyTableModel,\n    AnyTableModel,\n    unknown,\n    Expression\n  >;\n\nexport type AnyEmailRegistrationMapping<\n  Registration = unknown,\n  Expression extends SqlExpression = SqlExpression,\n> = EmailRegistrationMapping<\n  Registration,\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  unknown,\n  Expression\n>;\n\nexport type D1EmailRegistrationMapping<\n  Registration,\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Request extends Table,\n  NativeSubjectId,\n  Expression extends SqlExpression = SqlExpression,\n> = EmailRegistrationMapping<\n  Registration,\n  Subject,\n  Identifier,\n  Credential,\n  AuthorityCredential,\n  Request,\n  NativeSubjectId,\n  Expression\n> & {\n  readonly d1: EmailD1Clock<Expression>;\n};\n"],"mappings":";AAqKA,MAAa,iCAAiE;CAC5E,YAAY;CACZ,cAAc;CACd,sBACE;AACJ;AAqBA,MAAa,kCAAmE;CAC9E,GAAG;CACH,qBAAqB;CACrB,SAAS;AACX;AAuNA,MAAa,uCAA6E;CACxF,GAAG;CACH,qBAAqB;CACrB,SAAS;CACT,kBAAkB;AACpB"}
+{"version":3,"file":"email-model.mjs","names":[],"sources":["../../../src/internal/models/email-model.ts"],"sourcesContent":["import type { EmailAction } from \"@yielded/auth/Email\";\nimport type { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport type { ProofRedemptionInput } from \"@yielded/auth/Proofs\";\nimport type { TokenDigest } from \"@yielded/auth/Schema\";\nimport type { AuthenticationRequirement, SecurityRevision } from \"@yielded/auth/Sessions\";\nimport type { Effect } from \"effect\";\n\nimport type { AnyTableModel, TableModel as Table, SqlExpression } from \"../table-model\";\nimport type { PersistenceMappingError, SubjectIdCodec } from \"./common\";\nimport type { ProofClock } from \"./proof-model\";\n\ntype ColumnKey<T extends Table> = T[\"column\"];\n\nexport interface EmailSubjectReadTable<Subject extends Table> {\n  readonly table: Subject[\"table\"];\n  readonly id: ColumnKey<Subject>;\n  readonly status: ColumnKey<Subject>;\n  readonly securityRevision: ColumnKey<Subject>;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly activeStatusValue: unknown;\n  readonly decodeRequirement: (\n    row: Subject[\"select\"],\n  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n}\n\nexport interface EmailSubjectTable<Subject extends Table> extends EmailSubjectReadTable<Subject> {\n  readonly decodeActionRequirement: (\n    row: Subject[\"select\"],\n    action: EmailAction,\n  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n  readonly nextSecurityRevision?: (\n    current: SecurityRevision,\n  ) => Effect.Effect<SecurityRevision, PersistenceMappingError>;\n  readonly nextSecurityRevisionSync?: (current: SecurityRevision) => SecurityRevision;\n  readonly activeStatusValue: unknown;\n}\n\nexport interface EmailIdentifierReadTable<Identifier extends Table> {\n  readonly table: Identifier[\"table\"];\n  readonly namespace: ColumnKey<Identifier>;\n  readonly value: ColumnKey<Identifier>;\n  readonly subjectId: ColumnKey<Identifier>;\n  readonly verifiedAt: ColumnKey<Identifier>;\n  readonly bindingRevision: ColumnKey<Identifier>;\n  readonly isCurrent: (row: Identifier[\"select\"]) => boolean;\n}\n\nexport interface EmailIdentifierTable<\n  Identifier extends Table,\n  NativeSubjectId,\n  Expression extends SqlExpression = SqlExpression,\n> extends EmailIdentifierReadTable<Identifier> {\n  /** True only for an active, unverified binding. Confirming it preserves existing sessions. */\n  readonly isMutableTarget: (row: Identifier[\"select\"]) => boolean;\n  readonly encodeVerifiedInsert: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly subjectId: NativeSubjectId;\n    readonly verifiedAtMillis: number;\n    readonly bindingRevision: SecurityRevision;\n  }) => Identifier[\"insert\"];\n  readonly encodeVerification: (input: {\n    readonly verifiedAtMillis: number;\n    readonly bindingRevision: SecurityRevision;\n  }) => Partial<Identifier[\"insert\"]>;\n  /** Must make the selected source unavailable to sign-in. */\n  readonly encodeRetirement: (input: {\n    readonly source: LoginIdentifier;\n    readonly bindingRevision: SecurityRevision;\n  }) => Partial<Identifier[\"insert\"]>;\n  readonly d1CurrentCondition?: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly nativeSubjectId: NativeSubjectId;\n    readonly bindingRevision: SecurityRevision;\n  }) => Expression;\n  readonly d1MutableTargetCondition?: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly nativeSubjectId: NativeSubjectId;\n  }) => Expression;\n}\n\nexport interface EmailCredentialReadTable<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  _NativeSubjectId,\n> {\n  readonly table: Credential[\"table\"];\n  readonly moduleId: ColumnKey<Credential>;\n  readonly subjectId: ColumnKey<Credential>;\n  readonly credentialId: ColumnKey<Credential>;\n  readonly identifierNamespace: ColumnKey<Credential>;\n  readonly identifierValue: ColumnKey<Credential>;\n  readonly credentialRevision: ColumnKey<Credential>;\n  readonly status: ColumnKey<Credential>;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly activeStatusValue: unknown;\n  readonly decode: (input: {\n    readonly moduleId: string;\n    readonly subject: Subject[\"select\"];\n    readonly identifier: Identifier[\"select\"];\n    readonly credential: Credential[\"select\"];\n  }) => Effect.Effect<\n    Omit<import(\"@yielded/auth/Email\").EmailCredentialSnapshot, \"requirement\">,\n    PersistenceMappingError\n  >;\n}\n\nexport interface EmailCredentialTable<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  NativeSubjectId,\n> extends EmailCredentialReadTable<Subject, Identifier, Credential, NativeSubjectId> {\n  readonly encodeVerifiedInsert: (input: {\n    readonly moduleId: string;\n    readonly subjectId: NativeSubjectId;\n    readonly credentialId: string;\n    readonly identifier: LoginIdentifier;\n    readonly credentialRevision: SecurityRevision;\n  }) => Credential[\"insert\"];\n  readonly encodeActivation: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly credentialRevision: SecurityRevision;\n  }) => Partial<Credential[\"insert\"]>;\n  readonly encodeRetirement: (input: {\n    readonly source: LoginIdentifier;\n    readonly credentialRevision: SecurityRevision;\n  }) => Partial<Credential[\"insert\"]>;\n  readonly activeStatusValue: unknown;\n}\n\nexport interface EmailAuthorityCredentialTable<Credential extends Table, NativeSubjectId> {\n  readonly table: Credential[\"table\"];\n  readonly subjectId: ColumnKey<Credential>;\n  readonly credentialId: ColumnKey<Credential>;\n  readonly revision: ColumnKey<Credential>;\n  readonly status: ColumnKey<Credential>;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly encodeInsert: (input: {\n    readonly subjectId: NativeSubjectId;\n    readonly credentialId: string;\n    readonly revision: SecurityRevision;\n  }) => Credential[\"insert\"];\n  readonly encodeActivation: (revision: SecurityRevision) => Partial<Credential[\"insert\"]>;\n  readonly encodeRetirement: (revision: SecurityRevision) => Partial<Credential[\"insert\"]>;\n  readonly activeStatusValue: unknown;\n}\n\nexport interface RequiredEmailSignInConstraints {\n  readonly authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\";\n  readonly identifier: \"unique(identifier.namespace,identifier.value)\";\n  readonly credentialId: \"unique(emailCredential.moduleId,emailCredential.credentialId)\";\n  readonly credentialIdentifier: \"unique(emailCredential.moduleId,emailCredential.identifierNamespace,emailCredential.identifierValue)\";\n}\n\nexport const requiredEmailSignInConstraints: RequiredEmailSignInConstraints = {\n  authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\",\n  identifier: \"unique(identifier.namespace,identifier.value)\",\n  credentialId: \"unique(emailCredential.moduleId,emailCredential.credentialId)\",\n  credentialIdentifier:\n    \"unique(emailCredential.moduleId,emailCredential.identifierNamespace,emailCredential.identifierValue)\",\n};\n\nexport interface EmailSignInMapping<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  NativeSubjectId,\n> {\n  readonly subject: EmailSubjectReadTable<Subject>;\n  readonly identifier: EmailIdentifierReadTable<Identifier>;\n  readonly credential: EmailCredentialReadTable<Subject, Identifier, Credential, NativeSubjectId>;\n  readonly authorityCredential: EmailAuthorityCredentialTable<AuthorityCredential, NativeSubjectId>;\n  readonly subjectId: SubjectIdCodec<NativeSubjectId>;\n  readonly constraints: RequiredEmailSignInConstraints;\n  readonly decodeInstant: (native: unknown) => Effect.Effect<number, PersistenceMappingError>;\n}\n\nexport interface RequiredEmailAddressConstraints extends RequiredEmailSignInConstraints {\n  readonly authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\";\n}\n\nexport const requiredEmailAddressConstraints: RequiredEmailAddressConstraints = {\n  ...requiredEmailSignInConstraints,\n  authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\",\n};\n\nexport interface EmailAddressMapping<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  NativeSubjectId,\n  Expression extends SqlExpression = SqlExpression,\n> extends EmailSignInMapping<\n  Subject,\n  Identifier,\n  Credential,\n  AuthorityCredential,\n  NativeSubjectId\n> {\n  readonly subject: EmailSubjectTable<Subject>;\n  readonly identifier: EmailIdentifierTable<Identifier, NativeSubjectId, Expression>;\n  readonly credential: EmailCredentialTable<Subject, Identifier, Credential, NativeSubjectId>;\n  readonly authorityCredential: EmailAuthorityCredentialTable<AuthorityCredential, NativeSubjectId>;\n  readonly constraints: RequiredEmailAddressConstraints;\n  readonly addressCardinality: \"single\" | \"multiple\";\n  readonly changeDisposition: \"retire-source\";\n  readonly allocateCredentialId?: Effect.Effect<string, PersistenceMappingError>;\n  readonly allocateCredentialIdSync?: () => string;\n  readonly allocateRevision?: Effect.Effect<SecurityRevision, PersistenceMappingError>;\n  readonly allocateRevisionSync?: () => SecurityRevision;\n  readonly encodeInstant: (epochMillis: number) => unknown;\n  readonly sessionInvalidation: \"same-authority-immediate\" | \"original-absolute-expiry\";\n  readonly isIdentifierConflict: (cause: unknown) => boolean;\n  readonly isCredentialConflict: (cause: unknown) => boolean;\n  readonly clock: ProofClock<Expression>;\n  readonly d1?: { readonly primary: true };\n}\n\nexport interface EmailRegistrationIntent<Registration> {\n  readonly moduleId: string;\n  readonly commandId: string;\n  readonly identifier: LoginIdentifier;\n  readonly registration: Registration;\n  readonly requestId: string;\n  readonly fingerprint: TokenDigest;\n  readonly redemption: ProofRedemptionInput;\n}\n\nexport interface EmailRegistrationProvisioning<\n  Registration,\n  Subject extends Table,\n  NativeSubjectId,\n> {\n  readonly encodeSubjectInsert: (\n    input: EmailRegistrationIntent<Registration>,\n    values: {\n      readonly nativeSubjectId: NativeSubjectId | undefined;\n      readonly securityRevision: SecurityRevision;\n    },\n  ) => Subject[\"insert\"];\n  readonly allocateSubjectId?: Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n  readonly allocateSubjectIdSync?: () => NativeSubjectId;\n  readonly decodeGeneratedId?: (\n    rows: ReadonlyArray<unknown>,\n  ) => Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n}\n\nexport interface EmailRegistrationIdentifierTable<\n  Identifier extends Table,\n  NativeSubjectId,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: Identifier[\"table\"];\n  readonly namespace: ColumnKey<Identifier>;\n  readonly value: ColumnKey<Identifier>;\n  /** Atomic mailbox registration may reassign an unverified binding in place.\n   * Only subjectId, verifiedAt and bindingRevision change; the supplied proof\n   * authority must admit only absent or active-unverified registration targets.\n   * Its prior subject's mapped securityRevision advances in the same commit. */\n  readonly subjectId: ColumnKey<Identifier>;\n  readonly verifiedAt: ColumnKey<Identifier>;\n  readonly bindingRevision: ColumnKey<Identifier>;\n  readonly isCurrent: (row: Identifier[\"select\"]) => boolean;\n  readonly isMutableTarget: (row: Identifier[\"select\"]) => boolean;\n  readonly d1MutableTargetCondition?: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly nativeSubjectId: NativeSubjectId;\n  }) => Expression;\n  readonly d1CurrentCondition?: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly nativeSubjectId: NativeSubjectId;\n    readonly bindingRevision: SecurityRevision;\n  }) => Expression;\n  readonly encodeVerifiedInsert: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly subjectId: NativeSubjectId;\n    readonly verifiedAtMillis: number;\n    readonly bindingRevision: SecurityRevision;\n  }) => Identifier[\"insert\"];\n}\n\nexport interface EmailRegistrationCredentialTable<Credential extends Table, NativeSubjectId> {\n  readonly table: Credential[\"table\"];\n  readonly moduleId: ColumnKey<Credential>;\n  readonly subjectId: ColumnKey<Credential>;\n  readonly credentialId: ColumnKey<Credential>;\n  readonly identifierNamespace: ColumnKey<Credential>;\n  readonly identifierValue: ColumnKey<Credential>;\n  readonly credentialRevision: ColumnKey<Credential>;\n  readonly status: ColumnKey<Credential>;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly activeStatusValue: unknown;\n  readonly encodeVerifiedInsert: (input: {\n    readonly moduleId: string;\n    readonly subjectId: NativeSubjectId;\n    readonly credentialId: string;\n    readonly identifier: LoginIdentifier;\n    readonly credentialRevision: SecurityRevision;\n  }) => Credential[\"insert\"];\n}\n\nexport interface EmailRegistrationAuthorityCredentialTable<\n  Credential extends Table,\n  NativeSubjectId,\n> {\n  readonly table: Credential[\"table\"];\n  readonly subjectId: ColumnKey<Credential>;\n  readonly credentialId: ColumnKey<Credential>;\n  readonly revision: ColumnKey<Credential>;\n  readonly status: ColumnKey<Credential>;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly activeStatusValue: unknown;\n  readonly encodeInsert: (input: {\n    readonly subjectId: NativeSubjectId;\n    readonly credentialId: string;\n    readonly revision: SecurityRevision;\n  }) => Credential[\"insert\"];\n}\n\nexport interface RequiredEmailRegistrationConstraints extends RequiredEmailSignInConstraints {\n  readonly authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\";\n}\n\nexport const requiredEmailRegistrationConstraints: RequiredEmailRegistrationConstraints = {\n  ...requiredEmailSignInConstraints,\n  authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\",\n};\n\ntype EmailRegistrationBase<Registration> = {\n  readonly inspect: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly registration: Registration;\n  }) => Effect.Effect<\n    { readonly eligible: boolean; readonly fingerprint: TokenDigest },\n    PersistenceMappingError\n  >;\n  readonly snapshotRegistration: (\n    registration: Registration,\n  ) => Effect.Effect<Registration, PersistenceMappingError>;\n  readonly snapshotRegistrationSync?: (registration: Registration) => Registration;\n  readonly inspectSync?: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly registration: Registration;\n  }) => { readonly eligible: boolean; readonly fingerprint: TokenDigest };\n};\n\nexport type EmailRegistrationMapping<\n  Registration,\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  NativeSubjectId,\n  Expression extends SqlExpression = SqlExpression,\n> = EmailRegistrationBase<Registration> & {\n  readonly mode: \"atomic\";\n  readonly clock: ProofClock<Expression>;\n  readonly d1?: { readonly primary: true };\n  readonly subject: EmailSubjectReadTable<Subject>;\n  readonly identifier: EmailRegistrationIdentifierTable<Identifier, NativeSubjectId, Expression>;\n  readonly credential: EmailRegistrationCredentialTable<Credential, NativeSubjectId>;\n  readonly authorityCredential: EmailRegistrationAuthorityCredentialTable<\n    AuthorityCredential,\n    NativeSubjectId\n  >;\n  readonly subjectId: SubjectIdCodec<NativeSubjectId>;\n  readonly constraints: RequiredEmailRegistrationConstraints;\n  readonly allocateCredentialId?: Effect.Effect<string, PersistenceMappingError>;\n  readonly allocateCredentialIdSync?: () => string;\n  readonly allocateRevision?: Effect.Effect<SecurityRevision, PersistenceMappingError>;\n  readonly allocateRevisionSync?: () => SecurityRevision;\n  readonly isIdentifierConflict: (cause: unknown) => boolean;\n  readonly isCredentialConflict: (cause: unknown) => boolean;\n  readonly provisioning: EmailRegistrationProvisioning<Registration, Subject, NativeSubjectId> &\n    (\n      | {\n          readonly idMode: \"allocated\";\n          readonly allocateSubjectId: Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n        }\n      | {\n          readonly idMode: \"synchronous\";\n          readonly allocateSubjectIdSync: () => NativeSubjectId;\n        }\n      | {\n          readonly idMode: \"generated\";\n          readonly decodeGeneratedId: (\n            rows: ReadonlyArray<unknown>,\n          ) => Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n        }\n    );\n};\n\nexport type AnyEmailSignInMapping = EmailSignInMapping<\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  unknown\n>;\n\nexport type AnyEmailAddressMapping<Expression extends SqlExpression = SqlExpression> =\n  EmailAddressMapping<\n    AnyTableModel,\n    AnyTableModel,\n    AnyTableModel,\n    AnyTableModel,\n    unknown,\n    Expression\n  >;\n\nexport type AnyEmailRegistrationMapping<\n  Registration = unknown,\n  Expression extends SqlExpression = SqlExpression,\n> = EmailRegistrationMapping<\n  Registration,\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  unknown,\n  Expression\n>;\n"],"mappings":";AA2JA,MAAa,iCAAiE;CAC5E,qBAAqB;CACrB,YAAY;CACZ,cAAc;CACd,sBACE;AACJ;AAsBA,MAAa,kCAAmE;CAC9E,GAAG;CACH,qBAAqB;AACvB;AA4IA,MAAa,uCAA6E;CACxF,GAAG;CACH,qBAAqB;AACvB"}

package/dist/internal/models/oauth-connected-model.d.mts

@@ -1,166 +1,50 @@
-import { SqlExpression, TableModel } from "../query-operations.mjs";
+import { SqlExpression, TableModel } from "../table-model.mjs";
 import { SubjectIdCodec } from "./common.mjs";
-import { OAuthAuthorityReadTable, OAuthClock, OAuthCredentialReadTable, OAuthFlowTable, OAuthOwnershipMutation, OAuthSubjectReadTable, requiredOAuthTupleConstraints } from "./oauth-model.mjs";
-import { AuthenticationRequirement } from "@yielded/auth/Sessions";
+import { OAuthAuthorityReadTable, OAuthClock, OAuthCredentialReadTable, OAuthFlowTable, OAuthOwnershipReadTable, OAuthOwnershipTable, OAuthSubjectReadTable } from "./oauth-model.mjs";
 import * as M from "@yielded/auth/OAuth";
-import { OAuthAccountRevision } from "@yielded/auth/OAuth";
 declare namespace oauth_connected_model_d_exports {
-  export { OAuthConnectedAction, OAuthConnectedAdmissionTable, OAuthConnectedAuthorityMapping, OAuthConnectedClientRegistrationTable, OAuthConnectedCohortTable, OAuthConnectedCommandTable, OAuthConnectedFlowTable, OAuthConnectedGrantTable, OAuthConnectedMapping, OAuthConnectedOrderCodec, OAuthConnectedOwnershipRead, OAuthConnectedPolicyGuard, OAuthConnectedPolicyGuardTable, OAuthConnectedPolicyInput, OAuthConnectedRevocationJobTable, OAuthConnectedRevocationMapping, OAuthConnectedSqlPolicy, OAuthConnectedSubjectTable, oauthConnectedPolicyGuard, requiredOAuthConnectedConstraints, requiredOAuthConnectedRevocationConstraints };
+  export { OAuthConnectedAction, OAuthConnectedGrantTable, OAuthConnectedMapping, OAuthConnectedPolicyInput, OAuthConnectedRevocationJobTable, OAuthConnectedRevocationMapping, OAuthConnectedSqlPolicy, requiredOAuthConnectedConstraints, requiredOAuthConnectedRevocationConstraints };
 }
 type Column<T extends TableModel> = T["column"];
 export type OAuthConnectedAction = M.OAuthConnectedActionChallenge["action"];
-export interface OAuthConnectedSubjectTable<S extends TableModel, Expression extends SqlExpression = SqlExpression> extends OAuthSubjectReadTable<S, Expression> {
-  readonly decodeActionRequirement: (row: S["select"], action: OAuthConnectedAction) => AuthenticationRequirement;
-}
-/** All mapped order columns use exact SQL integer comparison through 2^53-1.
- * These codecs bridge driver representations, not alternative ordering rules. */
-export interface OAuthConnectedOrderCodec {
-  readonly encode: (order: number) => unknown;
-  readonly decode: (value: unknown) => number;
-}
-export interface OAuthConnectedFlowTable<F extends TableModel, N> {
-  readonly table: F["table"];
-  readonly moduleId: Column<F>;
-  readonly flowId: Column<F>;
-  readonly commandId: Column<F>;
-  readonly subjectId: Column<F>;
-  readonly clientKey: Column<F>;
-  readonly cohortKey: Column<F>;
-  readonly state: Column<F>;
-  readonly version: Column<F>;
-  readonly stateDigest: Column<F>;
-  readonly snapshot: Column<F>;
-  readonly claimId: Column<F>;
-  readonly claimDigest: Column<F>;
-  readonly claimOrder: Column<F>;
-  readonly claimedAt: Column<F>;
-  readonly claimExpiresAt: Column<F>;
-  readonly expiresAt: Column<F>;
-  readonly retentionUntil: Column<F>;
-  /** None before claim, Unresolved after claim, Resolved only after definite
-   * cancellation or atomic transfer to a grant/job. Never reset by cleanup. */
-  readonly work: Column<F>;
-  /** Exact sealed quarantine when no correctly sealed revocation job is available. */
-  readonly custody: Column<F>;
-  /** Required when retaining grants during sign-in. subjectId is NULL until
-   * identity resolution; custom required columns are supplied by this encoder. */
-  readonly encodeSignIn?: (reservation: M.OAuthSignInAccessClaim) => F["insert"];
-  readonly encodeInsert: (input: {
-    readonly flow: M.OAuthConnectedPendingFlow;
-    readonly subjectId: N;
-  }) => F["insert"];
-}
+/** Immutable sealed data plus the exact refresh compare-and-set fields. */
 export interface OAuthConnectedGrantTable<G extends TableModel, N> {
   readonly table: G["table"];
   readonly moduleId: Column<G>;
   readonly grantId: Column<G>;
   readonly subjectId: Column<G>;
   readonly identityKey: Column<G>;
-  /** Nullable unique active slot; historical/disconnected records use null. */
-  readonly activeIdentityKey: Column<G>;
-  readonly clientKey: Column<G>;
-  readonly cohortKey: Column<G>;
   readonly profileKey: Column<G>;
   readonly grantVersion: Column<G>;
   readonly tokenVersion: Column<G>;
-  readonly cohortGeneration: Column<G>;
   readonly state: Column<G>;
-  readonly version: Column<G>;
-  readonly context: Column<G>;
-  readonly sealed: Column<G>;
-  /** Canonical OAuthConnectedSummary only: list never loads token envelopes. */
+  readonly snapshot: Column<G>;
+  /** Listing selects this bounded projection, never encrypted token material. */
   readonly summary: Column<G>;
-  readonly revocationJobId: Column<G>;
-  readonly refreshWork: Column<G>;
-  readonly refreshClaim: Column<G>;
+  readonly refreshClaimId: Column<G>;
+  readonly refreshNextTokenVersion: Column<G>;
+  readonly refreshClaimedAt: Column<G>;
   readonly refreshClaimExpiresAt: Column<G>;
-  readonly retentionUntil: Column<G>;
+  readonly expiresAt: Column<G>;
   readonly encodeInsert: (input: {
     readonly grant: M.OAuthConnectedStoredGrant;
     readonly subjectId: N;
   }) => G["insert"];
 }
-/** Also stores a permanent provider/issuer scope anchor. clientKey must fit 52
- * ASCII characters. Empty clientRegistrationId is reserved for that anchor;
- * actual profile registrations are nonempty. Scope counter stays zero. */
-export interface OAuthConnectedClientRegistrationTable<C extends TableModel> {
-  readonly table: C["table"];
-  readonly clientKey: Column<C>;
-  readonly provider: Column<C>;
-  readonly issuer: Column<C>;
-  readonly clientRegistrationId: Column<C>;
-  readonly counter: Column<C>;
-  readonly version: Column<C>;
-  readonly encodeInsert: (configuration: M.OAuthConnectedConfiguration) => C["insert"];
-}
-/** Remote authority: no local-subject column or subject-scoped key. Retain this
- * anchor/cutoff when a legitimately released tuple gains a different local owner. */
-export interface OAuthConnectedCohortTable<C extends TableModel> {
-  readonly table: C["table"];
-  readonly cohortKey: Column<C>;
-  readonly clientKey: Column<C>;
-  readonly identityKey: Column<C>;
-  readonly generation: Column<C>;
-  readonly cutoff: Column<C>;
-  readonly state: Column<C>;
-  readonly version: Column<C>;
-  readonly encodeInsert: (input: {
-    readonly clientKey: string;
-    readonly identityKey: string;
-  }) => C["insert"];
-}
-export interface OAuthConnectedAdmissionTable<A extends TableModel, N> {
-  readonly table: A["table"];
-  readonly admissionId: Column<A>;
-  readonly moduleId: Column<A>;
-  readonly grantId: Column<A>;
-  readonly subjectId: Column<A>;
-  readonly identityKey: Column<A>;
-  readonly clientKey: Column<A>;
-  readonly cohortKey: Column<A>;
-  readonly snapshot: Column<A>;
-  readonly admittedAt: Column<A>;
-  readonly expiresAt: Column<A>;
-  readonly version: Column<A>;
-  readonly encodeInsert: (input: {
-    readonly admissionId: string;
-    readonly grant: M.OAuthConnectedStoredGrant;
-    readonly authorization: M.OAuthConnectedUseAuthorization;
-    readonly subjectId: N;
-  }) => A["insert"];
-}
-export interface OAuthConnectedCommandTable<C extends TableModel, N> {
-  readonly table: C["table"];
-  readonly moduleId: Column<C>;
-  readonly commandId: Column<C>;
-  readonly subjectId: Column<C>;
-  readonly grantId: Column<C>;
-  readonly intent: Column<C>;
-  readonly decision: Column<C>;
-  readonly retentionUntil: Column<C>;
-  readonly version: Column<C>;
-  readonly encodeInsert: (input: {
-    readonly commandId: string;
-    readonly grant: M.OAuthConnectedDisconnectGrant;
-    readonly subjectId: N;
-  }) => C["insert"];
-}
+/** Optional provider revocation retains the exact removed grant ciphertext. A
+ * possibly spent claim is never reset to Pending or reclaimed after timeout. */
 export interface OAuthConnectedRevocationJobTable<J extends TableModel, N> {
   readonly table: J["table"];
   readonly jobId: Column<J>;
   readonly moduleId: Column<J>;
   readonly subjectId: Column<J>;
   readonly identityKey: Column<J>;
-  readonly clientKey: Column<J>;
-  readonly cohortKey: Column<J>;
-  readonly grantId: Column<J>;
   readonly snapshot: Column<J>;
   readonly state: Column<J>;
   readonly claimId: Column<J>;
   readonly claimedAt: Column<J>;
   readonly claimExpiresAt: Column<J>;
   readonly retentionUntil: Column<J>;
-  readonly version: Column<J>;
   readonly encodeInsert: (input: {
     readonly job: M.OAuthConnectedRevocationJob;
     readonly subjectId: N;
@@ -168,125 +52,72 @@ export interface OAuthConnectedRevocationJobTable<J extends TableModel, N> {
 }
 export type OAuthConnectedPolicyInput<N> = {
   readonly subjectId: N;
-  readonly revision: OAuthAccountRevision;
+  readonly revision: M.OAuthAccountRevision;
 } & ({
   readonly kind: "action";
-  readonly operation: "issue" | "claim" | "settle" | "disconnect";
+  readonly operation: "settle" | "disconnect";
   readonly authorization: M.OAuthConnectedActionAuthorization;
-  readonly configuration: M.OAuthConnectedConfiguration;
   readonly grant?: M.OAuthConnectedTokenContext;
 } | {
   readonly kind: "sign-in";
   readonly credential: M.OAuthCredentialSnapshot;
-  readonly configuration: M.OAuthConnectedConfiguration;
-  readonly grant?: M.OAuthConnectedTokenContext;
+  readonly grant: M.OAuthConnectedTokenContext;
 } | {
   readonly kind: "metadata" | "use";
   readonly authorization: M.OAuthConnectedUseAuthorization;
   readonly grant?: M.OAuthConnectedTokenContext;
 });
-export interface OAuthConnectedPolicyGuardTable<T extends TableModel, N, Expression extends SqlExpression = SqlExpression> {
-  readonly table: T["table"];
-  readonly orderBy: Column<T>;
-  readonly condition: (input: OAuthConnectedPolicyInput<N>) => Expression;
-}
-export interface OAuthConnectedPolicyGuard<N, Expression extends SqlExpression = SqlExpression, Descriptor extends object = object> {
-  readonly table: Descriptor;
-  readonly orderBy: string;
-  readonly condition: (input: OAuthConnectedPolicyInput<N>) => Expression;
-}
-export declare const oauthConnectedPolicyGuard: <T extends TableModel, N, Expression extends SqlExpression = SqlExpression>(input: OAuthConnectedPolicyGuardTable<T, N, Expression>) => OAuthConnectedPolicyGuard<N, Expression, T["table"]>;
-export interface OAuthConnectedSqlPolicy<N, Expression extends SqlExpression = SqlExpression, Descriptor extends object = object> {
-  /** Up to 32 scopes, each selecting 1..64 stable rows in global lock order.
-   * Omit only when subject/shared authority locks already serialize every mutable
-   * policy dependency or policy is immutable. All writers follow that order. */
-  readonly guards?: ReadonlyArray<OAuthConnectedPolicyGuard<N, Expression, Descriptor>>;
-  /** Recheck exact policy revision, purpose, optional grant/profile restrictions
-   * and current profile/permissions; joins and absence assumptions are authority.
-   * The engine checks this before and after every owner/application write. */
+/** Changes to mutable policy advance the same subject security revision. This
+ * predicate participates in the guarded write and final application postcondition. */
+export interface OAuthConnectedSqlPolicy<N, Expression extends SqlExpression = SqlExpression> {
   readonly condition: (input: OAuthConnectedPolicyInput<N>) => Expression;
 }
 export declare const requiredOAuthConnectedConstraints: {
-  readonly flow: "unique(connectedFlow.moduleId,connectedFlow.flowId)";
-  readonly flowCommand: "unique(connectedFlow.moduleId,connectedFlow.commandId)";
-  readonly stateDigest: "unique(connectedFlow.stateDigest)";
-  readonly client: "unique(connectedClient.clientKey)";
-  readonly cohort: "unique(connectedCohort.cohortKey)";
+  readonly flow: "unique(flow.moduleId,flow.flowId)";
+  readonly stateDigest: "unique(flow.stateDigest)";
+  readonly ownership: "unique(ownership.identityKey)";
   readonly grant: "unique(connectedGrant.moduleId,connectedGrant.grantId)";
-  readonly grantIdentity: "unique(connectedGrant.moduleId,connectedGrant.subjectId,connectedGrant.profileKey,connectedGrant.activeIdentityKey)";
-  readonly admission: "unique(connectedAdmission.admissionId)";
-  readonly command: "unique(connectedCommand.moduleId,connectedCommand.commandId)";
+  readonly activeIdentity: "unique(connectedGrant.moduleId,connectedGrant.subjectId,connectedGrant.profileKey,connectedGrant.identityKey)";
+  readonly authorityCredential: "unique(authority.subjectId,authority.credentialId)";
 };
 export declare const requiredOAuthConnectedRevocationConstraints: {
   readonly job: "unique(connectedRevocation.jobId)";
 };
-/** Existing ownership only; workers never allocate or acquire a tuple. */
-export type OAuthConnectedOwnershipRead<T extends TableModel, O extends TableModel, N, Expression extends SqlExpression = SqlExpression> = {
-  readonly mode: "integrated";
-  readonly tuple: Omit<OAuthOwnershipMutation<T, O, N, Expression>["tuple"], "encodeInsert">;
-} | {
-  readonly mode: "separate";
-  readonly tuple: Omit<OAuthOwnershipMutation<T, O, N, Expression>["tuple"], "encodeInsert">;
-  readonly external: Omit<Extract<OAuthOwnershipMutation<T, O, N, Expression>, {
-    readonly mode: "separate";
-  }>["external"], "encodeInsert">;
-};
-export interface OAuthConnectedAuthorityMapping<T extends TableModel, O extends TableModel, F extends TableModel, G extends TableModel, C extends TableModel, H extends TableModel, N, Expression extends SqlExpression = SqlExpression> {
-  readonly ownership: OAuthConnectedOwnershipRead<T, O, N, Expression>;
+export interface OAuthConnectedMapping<S extends TableModel, AC extends TableModel, O extends TableModel, F extends TableModel, G extends TableModel, N, J extends TableModel = TableModel, Expression extends SqlExpression = SqlExpression, SignIn extends TableModel = TableModel> {
+  readonly ownership: OAuthOwnershipTable<O, N>;
+  readonly subject: OAuthSubjectReadTable<S, Expression>;
+  readonly authority: OAuthAuthorityReadTable<AC, Expression>;
   readonly subjectId: SubjectIdCodec<N>;
-  readonly flow: Omit<OAuthConnectedFlowTable<F, N>, "encodeInsert">;
-  readonly grant: Omit<OAuthConnectedGrantTable<G, N>, "encodeInsert">;
-  readonly client: Omit<OAuthConnectedClientRegistrationTable<C>, "encodeInsert">;
-  readonly cohort: Omit<OAuthConnectedCohortTable<H>, "encodeInsert">;
-  readonly clock: OAuthClock<Expression>;
-  readonly order: OAuthConnectedOrderCodec;
-  readonly tupleConstraints: typeof requiredOAuthTupleConstraints;
-  /** Safe metadata retention, never an expiry/quiescence proof for unresolved work. */
-  readonly retentionMillis: number;
-}
-export interface OAuthConnectedMapping<S extends TableModel, AC extends TableModel, T extends TableModel, O extends TableModel, F extends TableModel, G extends TableModel, C extends TableModel, H extends TableModel, A extends TableModel, D extends TableModel, N, J extends TableModel = never, Expression extends SqlExpression = SqlExpression, Descriptor extends object = object, SignIn extends TableModel = TableModel> extends OAuthConnectedAuthorityMapping<T, O, F, G, C, H, N, Expression> {
-  readonly ownership: OAuthOwnershipMutation<T, O, N, Expression>;
-  readonly flow: OAuthConnectedFlowTable<F, N>;
+  readonly flow: OAuthFlowTable<F>;
   readonly grant: OAuthConnectedGrantTable<G, N>;
-  readonly client: OAuthConnectedClientRegistrationTable<C>;
-  readonly cohort: OAuthConnectedCohortTable<H>;
-  readonly subject: OAuthConnectedSubjectTable<S, Expression>;
-  readonly authority: OAuthAuthorityReadTable<AC, Expression>;
-  readonly admission: OAuthConnectedAdmissionTable<A, N>;
-  /** Same shared sign-in tables used by OAuthSignInPersistence. Enable only
-   * alongside a nullable connected-flow subjectId and flow.encodeSignIn. */
-  readonly signIn?: {
-    readonly credential: OAuthCredentialReadTable<SignIn, Expression>;
-    readonly flow: OAuthFlowTable<SignIn>;
-  };
-  readonly command: OAuthConnectedCommandTable<D, N>;
-  readonly policy: OAuthConnectedSqlPolicy<N, Expression, Descriptor>;
+  readonly credential?: OAuthCredentialReadTable<SignIn, Expression>;
+  readonly clock: OAuthClock<Expression>;
+  readonly policy: OAuthConnectedSqlPolicy<N, Expression>;
   readonly constraints: typeof requiredOAuthConnectedConstraints;
   readonly revocation: {
     readonly mode: "unsupported";
   } | {
-    readonly mode: "cohort";
+    readonly mode: "provider";
     readonly job: OAuthConnectedRevocationJobTable<J, N>;
+    readonly retentionMillis: number;
     readonly constraints: typeof requiredOAuthConnectedRevocationConstraints;
   };
-  /** Without an authoritative same-owner predicate, conservatively retain Owned.
-   * Include login/other installed references; never filter away former-subject
-   * work. This pure SQL constructor supports both bound values and correlated
-   * column expressions with identical semantics; it performs no I/O.
-   * Compare through the reference table's typed columns (for example, eq) so
-   * native values use their encoders. Back the same-owner lookup with an index:
-   * discovery applies this predicate before its candidate limit.
-   * Connected references are checked separately. */
-  readonly externalReference?: (input: {
+  /** Indexed same-owner predicate for installed references beyond these grants/jobs. */
+  readonly otherReferences: (input: {
     readonly identityKey: string;
     readonly subjectId: N;
-  } | {
-    readonly identityKey: Expression;
-    readonly subjectId: Expression;
   }) => Expression;
 }
-export interface OAuthConnectedRevocationMapping<T extends TableModel, O extends TableModel, F extends TableModel, G extends TableModel, C extends TableModel, H extends TableModel, J extends TableModel, N, Expression extends SqlExpression = SqlExpression> extends OAuthConnectedAuthorityMapping<T, O, F, G, C, H, N, Expression> {
+export interface OAuthConnectedRevocationMapping<O extends TableModel, G extends TableModel, J extends TableModel, N, Expression extends SqlExpression = SqlExpression> {
+  readonly ownership: OAuthOwnershipReadTable<O, N>;
+  readonly subjectId: SubjectIdCodec<N>;
+  readonly grant: Omit<OAuthConnectedGrantTable<G, N>, "encodeInsert">;
   readonly job: Omit<OAuthConnectedRevocationJobTable<J, N>, "encodeInsert">;
+  readonly clock: OAuthClock<Expression>;
+  readonly otherReferences: (input: {
+    readonly identityKey: string;
+    readonly subjectId: N;
+  }) => Expression;
   readonly constraints: typeof requiredOAuthConnectedRevocationConstraints;
 }
 //#endregion

package/dist/internal/models/oauth-connected-model.mjs

@@ -1,22 +1,14 @@
 //#region src/internal/models/oauth-connected-model.ts
-const oauthConnectedPolicyGuard = (input) => Object.freeze({
-	table: input.table,
-	orderBy: input.orderBy,
-	condition: input.condition
-});
 const requiredOAuthConnectedConstraints = {
-	flow: "unique(connectedFlow.moduleId,connectedFlow.flowId)",
-	flowCommand: "unique(connectedFlow.moduleId,connectedFlow.commandId)",
-	stateDigest: "unique(connectedFlow.stateDigest)",
-	client: "unique(connectedClient.clientKey)",
-	cohort: "unique(connectedCohort.cohortKey)",
+	flow: "unique(flow.moduleId,flow.flowId)",
+	stateDigest: "unique(flow.stateDigest)",
+	ownership: "unique(ownership.identityKey)",
 	grant: "unique(connectedGrant.moduleId,connectedGrant.grantId)",
-	grantIdentity: "unique(connectedGrant.moduleId,connectedGrant.subjectId,connectedGrant.profileKey,connectedGrant.activeIdentityKey)",
-	admission: "unique(connectedAdmission.admissionId)",
-	command: "unique(connectedCommand.moduleId,connectedCommand.commandId)"
+	activeIdentity: "unique(connectedGrant.moduleId,connectedGrant.subjectId,connectedGrant.profileKey,connectedGrant.identityKey)",
+	authorityCredential: "unique(authority.subjectId,authority.credentialId)"
 };
 const requiredOAuthConnectedRevocationConstraints = { job: "unique(connectedRevocation.jobId)" };
 //#endregion
-export { oauthConnectedPolicyGuard, requiredOAuthConnectedConstraints, requiredOAuthConnectedRevocationConstraints };
+export { requiredOAuthConnectedConstraints, requiredOAuthConnectedRevocationConstraints };
 
 //# sourceMappingURL=oauth-connected-model.mjs.map

package/dist/internal/models/oauth-connected-model.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-connected-model.mjs","names":[],"sources":["../../../src/internal/models/oauth-connected-model.ts"],"sourcesContent":["import type { OAuthAccountRevision } from \"@yielded/auth/OAuth\";\nimport type * as M from \"@yielded/auth/OAuth\";\nimport type { AuthenticationRequirement } from \"@yielded/auth/Sessions\";\n\nimport type { TableModel as Table, SqlExpression } from \"../query-operations\";\nimport type { SubjectIdCodec } from \"./common\";\nimport type {\n  OAuthAuthorityReadTable,\n  OAuthClock,\n  OAuthCredentialReadTable,\n  OAuthFlowTable,\n  OAuthOwnershipMutation,\n  OAuthSubjectReadTable,\n  requiredOAuthTupleConstraints,\n} from \"./oauth-model\";\n\ntype Column<T extends Table> = T[\"column\"];\nexport type OAuthConnectedAction = M.OAuthConnectedActionChallenge[\"action\"];\n\nexport interface OAuthConnectedSubjectTable<\n  S extends Table,\n  Expression extends SqlExpression = SqlExpression,\n> extends OAuthSubjectReadTable<S, Expression> {\n  readonly decodeActionRequirement: (\n    row: S[\"select\"],\n    action: OAuthConnectedAction,\n  ) => AuthenticationRequirement;\n}\n\n/** All mapped order columns use exact SQL integer comparison through 2^53-1.\n * These codecs bridge driver representations, not alternative ordering rules. */\nexport interface OAuthConnectedOrderCodec {\n  readonly encode: (order: number) => unknown;\n  readonly decode: (value: unknown) => number;\n}\n\nexport interface OAuthConnectedFlowTable<F extends Table, N> {\n  readonly table: F[\"table\"];\n  readonly moduleId: Column<F>;\n  readonly flowId: Column<F>;\n  readonly commandId: Column<F>;\n  readonly subjectId: Column<F>;\n  readonly clientKey: Column<F>;\n  readonly cohortKey: Column<F>;\n  readonly state: Column<F>;\n  readonly version: Column<F>;\n  readonly stateDigest: Column<F>;\n  readonly snapshot: Column<F>;\n  readonly claimId: Column<F>;\n  readonly claimDigest: Column<F>;\n  readonly claimOrder: Column<F>;\n  readonly claimedAt: Column<F>;\n  readonly claimExpiresAt: Column<F>;\n  readonly expiresAt: Column<F>;\n  readonly retentionUntil: Column<F>;\n  /** None before claim, Unresolved after claim, Resolved only after definite\n   * cancellation or atomic transfer to a grant/job. Never reset by cleanup. */\n  readonly work: Column<F>;\n  /** Exact sealed quarantine when no correctly sealed revocation job is available. */\n  readonly custody: Column<F>;\n  /** Required when retaining grants during sign-in. subjectId is NULL until\n   * identity resolution; custom required columns are supplied by this encoder. */\n  readonly encodeSignIn?: (reservation: M.OAuthSignInAccessClaim) => F[\"insert\"];\n  readonly encodeInsert: (input: {\n    readonly flow: M.OAuthConnectedPendingFlow;\n    readonly subjectId: N;\n  }) => F[\"insert\"];\n}\n\nexport interface OAuthConnectedGrantTable<G extends Table, N> {\n  readonly table: G[\"table\"];\n  readonly moduleId: Column<G>;\n  readonly grantId: Column<G>;\n  readonly subjectId: Column<G>;\n  readonly identityKey: Column<G>;\n  /** Nullable unique active slot; historical/disconnected records use null. */\n  readonly activeIdentityKey: Column<G>;\n  readonly clientKey: Column<G>;\n  readonly cohortKey: Column<G>;\n  readonly profileKey: Column<G>;\n  readonly grantVersion: Column<G>;\n  readonly tokenVersion: Column<G>;\n  readonly cohortGeneration: Column<G>;\n  readonly state: Column<G>;\n  readonly version: Column<G>;\n  readonly context: Column<G>;\n  readonly sealed: Column<G>;\n  /** Canonical OAuthConnectedSummary only: list never loads token envelopes. */\n  readonly summary: Column<G>;\n  readonly revocationJobId: Column<G>;\n  readonly refreshWork: Column<G>;\n  readonly refreshClaim: Column<G>;\n  readonly refreshClaimExpiresAt: Column<G>;\n  readonly retentionUntil: Column<G>;\n  readonly encodeInsert: (input: {\n    readonly grant: M.OAuthConnectedStoredGrant;\n    readonly subjectId: N;\n  }) => G[\"insert\"];\n}\n\n/** Also stores a permanent provider/issuer scope anchor. clientKey must fit 52\n * ASCII characters. Empty clientRegistrationId is reserved for that anchor;\n * actual profile registrations are nonempty. Scope counter stays zero. */\nexport interface OAuthConnectedClientRegistrationTable<C extends Table> {\n  readonly table: C[\"table\"];\n  readonly clientKey: Column<C>;\n  readonly provider: Column<C>;\n  readonly issuer: Column<C>;\n  readonly clientRegistrationId: Column<C>;\n  readonly counter: Column<C>;\n  readonly version: Column<C>;\n  readonly encodeInsert: (configuration: M.OAuthConnectedConfiguration) => C[\"insert\"];\n}\n\n/** Remote authority: no local-subject column or subject-scoped key. Retain this\n * anchor/cutoff when a legitimately released tuple gains a different local owner. */\nexport interface OAuthConnectedCohortTable<C extends Table> {\n  readonly table: C[\"table\"];\n  readonly cohortKey: Column<C>;\n  readonly clientKey: Column<C>;\n  readonly identityKey: Column<C>;\n  readonly generation: Column<C>;\n  readonly cutoff: Column<C>;\n  readonly state: Column<C>;\n  readonly version: Column<C>;\n  readonly encodeInsert: (input: {\n    readonly clientKey: string;\n    readonly identityKey: string;\n  }) => C[\"insert\"];\n}\n\nexport interface OAuthConnectedAdmissionTable<A extends Table, N> {\n  readonly table: A[\"table\"];\n  readonly admissionId: Column<A>;\n  readonly moduleId: Column<A>;\n  readonly grantId: Column<A>;\n  readonly subjectId: Column<A>;\n  readonly identityKey: Column<A>;\n  readonly clientKey: Column<A>;\n  readonly cohortKey: Column<A>;\n  readonly snapshot: Column<A>;\n  readonly admittedAt: Column<A>;\n  readonly expiresAt: Column<A>;\n  readonly version: Column<A>;\n  readonly encodeInsert: (input: {\n    readonly admissionId: string;\n    readonly grant: M.OAuthConnectedStoredGrant;\n    readonly authorization: M.OAuthConnectedUseAuthorization;\n    readonly subjectId: N;\n  }) => A[\"insert\"];\n}\n\nexport interface OAuthConnectedCommandTable<C extends Table, N> {\n  readonly table: C[\"table\"];\n  readonly moduleId: Column<C>;\n  readonly commandId: Column<C>;\n  readonly subjectId: Column<C>;\n  readonly grantId: Column<C>;\n  readonly intent: Column<C>;\n  readonly decision: Column<C>;\n  readonly retentionUntil: Column<C>;\n  readonly version: Column<C>;\n  readonly encodeInsert: (input: {\n    readonly commandId: string;\n    readonly grant: M.OAuthConnectedDisconnectGrant;\n    readonly subjectId: N;\n  }) => C[\"insert\"];\n}\n\nexport interface OAuthConnectedRevocationJobTable<J extends Table, N> {\n  readonly table: J[\"table\"];\n  readonly jobId: Column<J>;\n  readonly moduleId: Column<J>;\n  readonly subjectId: Column<J>;\n  readonly identityKey: Column<J>;\n  readonly clientKey: Column<J>;\n  readonly cohortKey: Column<J>;\n  readonly grantId: Column<J>;\n  readonly snapshot: Column<J>;\n  readonly state: Column<J>;\n  readonly claimId: Column<J>;\n  readonly claimedAt: Column<J>;\n  readonly claimExpiresAt: Column<J>;\n  readonly retentionUntil: Column<J>;\n  readonly version: Column<J>;\n  readonly encodeInsert: (input: {\n    readonly job: M.OAuthConnectedRevocationJob;\n    readonly subjectId: N;\n  }) => J[\"insert\"];\n}\n\nexport type OAuthConnectedPolicyInput<N> = {\n  readonly subjectId: N;\n  readonly revision: OAuthAccountRevision;\n} & (\n  | {\n      readonly kind: \"action\";\n      readonly operation: \"issue\" | \"claim\" | \"settle\" | \"disconnect\";\n      readonly authorization: M.OAuthConnectedActionAuthorization;\n      readonly configuration: M.OAuthConnectedConfiguration;\n      readonly grant?: M.OAuthConnectedTokenContext;\n    }\n  | {\n      readonly kind: \"sign-in\";\n      readonly credential: M.OAuthCredentialSnapshot;\n      readonly configuration: M.OAuthConnectedConfiguration;\n      readonly grant?: M.OAuthConnectedTokenContext;\n    }\n  | {\n      readonly kind: \"metadata\" | \"use\";\n      readonly authorization: M.OAuthConnectedUseAuthorization;\n      readonly grant?: M.OAuthConnectedTokenContext;\n    }\n);\n\nexport interface OAuthConnectedPolicyGuardTable<\n  T extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: T[\"table\"];\n  readonly orderBy: Column<T>;\n  readonly condition: (input: OAuthConnectedPolicyInput<N>) => Expression;\n}\n\nexport interface OAuthConnectedPolicyGuard<\n  N,\n  Expression extends SqlExpression = SqlExpression,\n  Descriptor extends object = object,\n> {\n  readonly table: Descriptor;\n  readonly orderBy: string;\n  readonly condition: (input: OAuthConnectedPolicyInput<N>) => Expression;\n}\n\nexport const oauthConnectedPolicyGuard = <\n  T extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n>(\n  input: OAuthConnectedPolicyGuardTable<T, N, Expression>,\n): OAuthConnectedPolicyGuard<N, Expression, T[\"table\"]> =>\n  Object.freeze({\n    table: input.table,\n    orderBy: input.orderBy,\n    condition: input.condition,\n  });\n\nexport interface OAuthConnectedSqlPolicy<\n  N,\n  Expression extends SqlExpression = SqlExpression,\n  Descriptor extends object = object,\n> {\n  /** Up to 32 scopes, each selecting 1..64 stable rows in global lock order.\n   * Omit only when subject/shared authority locks already serialize every mutable\n   * policy dependency or policy is immutable. All writers follow that order. */\n  readonly guards?: ReadonlyArray<OAuthConnectedPolicyGuard<N, Expression, Descriptor>>;\n  /** Recheck exact policy revision, purpose, optional grant/profile restrictions\n   * and current profile/permissions; joins and absence assumptions are authority.\n   * The engine checks this before and after every owner/application write. */\n  readonly condition: (input: OAuthConnectedPolicyInput<N>) => Expression;\n}\n\nexport const requiredOAuthConnectedConstraints = {\n  flow: \"unique(connectedFlow.moduleId,connectedFlow.flowId)\",\n  flowCommand: \"unique(connectedFlow.moduleId,connectedFlow.commandId)\",\n  stateDigest: \"unique(connectedFlow.stateDigest)\",\n  client: \"unique(connectedClient.clientKey)\",\n  cohort: \"unique(connectedCohort.cohortKey)\",\n  grant: \"unique(connectedGrant.moduleId,connectedGrant.grantId)\",\n  grantIdentity:\n    \"unique(connectedGrant.moduleId,connectedGrant.subjectId,connectedGrant.profileKey,connectedGrant.activeIdentityKey)\",\n  admission: \"unique(connectedAdmission.admissionId)\",\n  command: \"unique(connectedCommand.moduleId,connectedCommand.commandId)\",\n} as const;\n\nexport const requiredOAuthConnectedRevocationConstraints = {\n  job: \"unique(connectedRevocation.jobId)\",\n} as const;\n\n/** Existing ownership only; workers never allocate or acquire a tuple. */\nexport type OAuthConnectedOwnershipRead<\n  T extends Table,\n  O extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> =\n  | {\n      readonly mode: \"integrated\";\n      readonly tuple: Omit<OAuthOwnershipMutation<T, O, N, Expression>[\"tuple\"], \"encodeInsert\">;\n    }\n  | {\n      readonly mode: \"separate\";\n      readonly tuple: Omit<OAuthOwnershipMutation<T, O, N, Expression>[\"tuple\"], \"encodeInsert\">;\n      readonly external: Omit<\n        Extract<\n          OAuthOwnershipMutation<T, O, N, Expression>,\n          { readonly mode: \"separate\" }\n        >[\"external\"],\n        \"encodeInsert\"\n      >;\n    };\n\nexport interface OAuthConnectedAuthorityMapping<\n  T extends Table,\n  O extends Table,\n  F extends Table,\n  G extends Table,\n  C extends Table,\n  H extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly ownership: OAuthConnectedOwnershipRead<T, O, N, Expression>;\n  readonly subjectId: SubjectIdCodec<N>;\n  readonly flow: Omit<OAuthConnectedFlowTable<F, N>, \"encodeInsert\">;\n  readonly grant: Omit<OAuthConnectedGrantTable<G, N>, \"encodeInsert\">;\n  readonly client: Omit<OAuthConnectedClientRegistrationTable<C>, \"encodeInsert\">;\n  readonly cohort: Omit<OAuthConnectedCohortTable<H>, \"encodeInsert\">;\n  readonly clock: OAuthClock<Expression>;\n  readonly order: OAuthConnectedOrderCodec;\n  readonly tupleConstraints: typeof requiredOAuthTupleConstraints;\n  /** Safe metadata retention, never an expiry/quiescence proof for unresolved work. */\n  readonly retentionMillis: number;\n}\n\nexport interface OAuthConnectedMapping<\n  S extends Table,\n  AC extends Table,\n  T extends Table,\n  O extends Table,\n  F extends Table,\n  G extends Table,\n  C extends Table,\n  H extends Table,\n  A extends Table,\n  D extends Table,\n  N,\n  J extends Table = never,\n  Expression extends SqlExpression = SqlExpression,\n  Descriptor extends object = object,\n  SignIn extends Table = Table,\n> extends OAuthConnectedAuthorityMapping<T, O, F, G, C, H, N, Expression> {\n  readonly ownership: OAuthOwnershipMutation<T, O, N, Expression>;\n  readonly flow: OAuthConnectedFlowTable<F, N>;\n  readonly grant: OAuthConnectedGrantTable<G, N>;\n  readonly client: OAuthConnectedClientRegistrationTable<C>;\n  readonly cohort: OAuthConnectedCohortTable<H>;\n  readonly subject: OAuthConnectedSubjectTable<S, Expression>;\n  readonly authority: OAuthAuthorityReadTable<AC, Expression>;\n  readonly admission: OAuthConnectedAdmissionTable<A, N>;\n  /** Same shared sign-in tables used by OAuthSignInPersistence. Enable only\n   * alongside a nullable connected-flow subjectId and flow.encodeSignIn. */\n  readonly signIn?: {\n    readonly credential: OAuthCredentialReadTable<SignIn, Expression>;\n    readonly flow: OAuthFlowTable<SignIn>;\n  };\n  readonly command: OAuthConnectedCommandTable<D, N>;\n  readonly policy: OAuthConnectedSqlPolicy<N, Expression, Descriptor>;\n  readonly constraints: typeof requiredOAuthConnectedConstraints;\n  readonly revocation:\n    | { readonly mode: \"unsupported\" }\n    | {\n        readonly mode: \"cohort\";\n        readonly job: OAuthConnectedRevocationJobTable<J, N>;\n        readonly constraints: typeof requiredOAuthConnectedRevocationConstraints;\n      };\n  /** Without an authoritative same-owner predicate, conservatively retain Owned.\n   * Include login/other installed references; never filter away former-subject\n   * work. This pure SQL constructor supports both bound values and correlated\n   * column expressions with identical semantics; it performs no I/O.\n   * Compare through the reference table's typed columns (for example, eq) so\n   * native values use their encoders. Back the same-owner lookup with an index:\n   * discovery applies this predicate before its candidate limit.\n   * Connected references are checked separately. */\n  readonly externalReference?: (\n    input:\n      | { readonly identityKey: string; readonly subjectId: N }\n      | { readonly identityKey: Expression; readonly subjectId: Expression },\n  ) => Expression;\n}\n\nexport interface OAuthConnectedRevocationMapping<\n  T extends Table,\n  O extends Table,\n  F extends Table,\n  G extends Table,\n  C extends Table,\n  H extends Table,\n  J extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> extends OAuthConnectedAuthorityMapping<T, O, F, G, C, H, N, Expression> {\n  readonly job: Omit<OAuthConnectedRevocationJobTable<J, N>, \"encodeInsert\">;\n  readonly constraints: typeof requiredOAuthConnectedRevocationConstraints;\n}\n"],"mappings":";AA2OA,MAAa,6BAKX,UAEA,OAAO,OAAO;CACZ,OAAO,MAAM;CACb,SAAS,MAAM;CACf,WAAW,MAAM;AACnB,CAAC;AAiBH,MAAa,oCAAoC;CAC/C,MAAM;CACN,aAAa;CACb,aAAa;CACb,QAAQ;CACR,QAAQ;CACR,OAAO;CACP,eACE;CACF,WAAW;CACX,SAAS;AACX;AAEA,MAAa,8CAA8C,EACzD,KAAK,oCACP"}
+{"version":3,"file":"oauth-connected-model.mjs","names":[],"sources":["../../../src/internal/models/oauth-connected-model.ts"],"sourcesContent":["import type * as M from \"@yielded/auth/OAuth\";\n\nimport type { TableModel as Table, SqlExpression } from \"../table-model\";\nimport type { SubjectIdCodec } from \"./common\";\nimport type {\n  OAuthAuthorityReadTable,\n  OAuthClock,\n  OAuthCredentialReadTable,\n  OAuthFlowTable,\n  OAuthOwnershipTable,\n  OAuthOwnershipReadTable,\n  OAuthSubjectReadTable,\n} from \"./oauth-model\";\n\ntype Column<T extends Table> = T[\"column\"];\nexport type OAuthConnectedAction = M.OAuthConnectedActionChallenge[\"action\"];\n\n/** Immutable sealed data plus the exact refresh compare-and-set fields. */\nexport interface OAuthConnectedGrantTable<G extends Table, N> {\n  readonly table: G[\"table\"];\n  readonly moduleId: Column<G>;\n  readonly grantId: Column<G>;\n  readonly subjectId: Column<G>;\n  readonly identityKey: Column<G>;\n  readonly profileKey: Column<G>;\n  readonly grantVersion: Column<G>;\n  readonly tokenVersion: Column<G>;\n  readonly state: Column<G>;\n  readonly snapshot: Column<G>;\n  /** Listing selects this bounded projection, never encrypted token material. */\n  readonly summary: Column<G>;\n  readonly refreshClaimId: Column<G>;\n  readonly refreshNextTokenVersion: Column<G>;\n  readonly refreshClaimedAt: Column<G>;\n  readonly refreshClaimExpiresAt: Column<G>;\n  readonly expiresAt: Column<G>;\n  readonly encodeInsert: (input: {\n    readonly grant: M.OAuthConnectedStoredGrant;\n    readonly subjectId: N;\n  }) => G[\"insert\"];\n}\n\n/** Optional provider revocation retains the exact removed grant ciphertext. A\n * possibly spent claim is never reset to Pending or reclaimed after timeout. */\nexport interface OAuthConnectedRevocationJobTable<J extends Table, N> {\n  readonly table: J[\"table\"];\n  readonly jobId: Column<J>;\n  readonly moduleId: Column<J>;\n  readonly subjectId: Column<J>;\n  readonly identityKey: Column<J>;\n  readonly snapshot: Column<J>;\n  readonly state: Column<J>;\n  readonly claimId: Column<J>;\n  readonly claimedAt: Column<J>;\n  readonly claimExpiresAt: Column<J>;\n  readonly retentionUntil: Column<J>;\n  readonly encodeInsert: (input: {\n    readonly job: M.OAuthConnectedRevocationJob;\n    readonly subjectId: N;\n  }) => J[\"insert\"];\n}\n\nexport type OAuthConnectedPolicyInput<N> = {\n  readonly subjectId: N;\n  readonly revision: M.OAuthAccountRevision;\n} & (\n  | {\n      readonly kind: \"action\";\n      readonly operation: \"settle\" | \"disconnect\";\n      readonly authorization: M.OAuthConnectedActionAuthorization;\n      readonly grant?: M.OAuthConnectedTokenContext;\n    }\n  | {\n      readonly kind: \"sign-in\";\n      readonly credential: M.OAuthCredentialSnapshot;\n      readonly grant: M.OAuthConnectedTokenContext;\n    }\n  | {\n      readonly kind: \"metadata\" | \"use\";\n      readonly authorization: M.OAuthConnectedUseAuthorization;\n      readonly grant?: M.OAuthConnectedTokenContext;\n    }\n);\n\n/** Changes to mutable policy advance the same subject security revision. This\n * predicate participates in the guarded write and final application postcondition. */\nexport interface OAuthConnectedSqlPolicy<N, Expression extends SqlExpression = SqlExpression> {\n  readonly condition: (input: OAuthConnectedPolicyInput<N>) => Expression;\n}\n\nexport const requiredOAuthConnectedConstraints = {\n  flow: \"unique(flow.moduleId,flow.flowId)\",\n  stateDigest: \"unique(flow.stateDigest)\",\n  ownership: \"unique(ownership.identityKey)\",\n  grant: \"unique(connectedGrant.moduleId,connectedGrant.grantId)\",\n  activeIdentity:\n    \"unique(connectedGrant.moduleId,connectedGrant.subjectId,connectedGrant.profileKey,connectedGrant.identityKey)\",\n  authorityCredential: \"unique(authority.subjectId,authority.credentialId)\",\n} as const;\n\nexport const requiredOAuthConnectedRevocationConstraints = {\n  job: \"unique(connectedRevocation.jobId)\",\n} as const;\n\nexport interface OAuthConnectedMapping<\n  S extends Table,\n  AC extends Table,\n  O extends Table,\n  F extends Table,\n  G extends Table,\n  N,\n  J extends Table = Table,\n  Expression extends SqlExpression = SqlExpression,\n  SignIn extends Table = Table,\n> {\n  readonly ownership: OAuthOwnershipTable<O, N>;\n  readonly subject: OAuthSubjectReadTable<S, Expression>;\n  readonly authority: OAuthAuthorityReadTable<AC, Expression>;\n  readonly subjectId: SubjectIdCodec<N>;\n  readonly flow: OAuthFlowTable<F>;\n  readonly grant: OAuthConnectedGrantTable<G, N>;\n  readonly credential?: OAuthCredentialReadTable<SignIn, Expression>;\n  readonly clock: OAuthClock<Expression>;\n  readonly policy: OAuthConnectedSqlPolicy<N, Expression>;\n  readonly constraints: typeof requiredOAuthConnectedConstraints;\n  readonly revocation:\n    | { readonly mode: \"unsupported\" }\n    | {\n        readonly mode: \"provider\";\n        readonly job: OAuthConnectedRevocationJobTable<J, N>;\n        readonly retentionMillis: number;\n        readonly constraints: typeof requiredOAuthConnectedRevocationConstraints;\n      };\n  /** Indexed same-owner predicate for installed references beyond these grants/jobs. */\n  readonly otherReferences: (input: {\n    readonly identityKey: string;\n    readonly subjectId: N;\n  }) => Expression;\n}\n\nexport interface OAuthConnectedRevocationMapping<\n  O extends Table,\n  G extends Table,\n  J extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly ownership: OAuthOwnershipReadTable<O, N>;\n  readonly subjectId: SubjectIdCodec<N>;\n  readonly grant: Omit<OAuthConnectedGrantTable<G, N>, \"encodeInsert\">;\n  readonly job: Omit<OAuthConnectedRevocationJobTable<J, N>, \"encodeInsert\">;\n  readonly clock: OAuthClock<Expression>;\n  readonly otherReferences: (input: {\n    readonly identityKey: string;\n    readonly subjectId: N;\n  }) => Expression;\n  readonly constraints: typeof requiredOAuthConnectedRevocationConstraints;\n}\n"],"mappings":";AA0FA,MAAa,oCAAoC;CAC/C,MAAM;CACN,aAAa;CACb,WAAW;CACX,OAAO;CACP,gBACE;CACF,qBAAqB;AACvB;AAEA,MAAa,8CAA8C,EACzD,KAAK,oCACP"}