@yielded/auth-persistence 0.1.0-beta.24 → 0.1.0-beta.26

package/dist/internal/models/oauth-model.d.mts

@@ -1,22 +1,17 @@
+import { SqlExpression, TableModel } from "../table-model.mjs";
 import { PersistenceMappingError } from "../mapping-error.mjs";
-import { SqlExpression, TableModel } from "../query-operations.mjs";
 import { SubjectIdCodec } from "./common.mjs";
-import { Crypto, Effect, PlatformError } from "effect";
-import { TokenDigest } from "@yielded/auth/Schema";
+import { Effect, Schema } from "effect";
 import { PreparedCommit } from "@yielded/auth/Hooks";
+import { CleanupResult } from "@yielded/auth/Persistence";
 import { AuthenticationRequirement, SecurityRevision } from "@yielded/auth/Sessions";
-import { OAuthAccountRevision, OAuthActionAuthorization, OAuthCleanupInput, OAuthCommandId, OAuthCredentialSnapshot, OAuthExternalIdentity, OAuthRegistrationAccess, OAuthRegistrationDecision, OAuthRegistrationInspection, OAuthRegistrationIntent, OAuthUnavailable, PrepareOAuthCommit } from "@yielded/auth/OAuth";
-import { AuthenticationFactor } from "@yielded/auth/Operations";
+import { TokenDigest } from "@yielded/auth/Schema";
+import { OAuthAccountRevision, OAuthActionAuthorization, OAuthCleanupInput, OAuthCommandId, OAuthExternalIdentity, OAuthRegistrationAccess, OAuthRegistrationDecision, OAuthRegistrationInspection, OAuthRegistrationIntent, OAuthUnavailable, PrepareOAuthCommit } from "@yielded/auth/OAuth";
 declare namespace oauth_model_d_exports {
-  export { OAuthAccountsMapping, OAuthAction, OAuthAuthorityReadTable, OAuthAuthorityTable, OAuthCleanupDescriptor, OAuthCleanupTable, OAuthClock, OAuthCredentialReadTable, OAuthCredentialTable, OAuthD1Mapping, OAuthEligibilityDescriptor, OAuthEligibilityFact, OAuthEligibilityTable, OAuthFlowState, OAuthFlowTable, OAuthMetadataPolicy, OAuthOwnershipMutation, OAuthOwnershipReadTable, OAuthOwnershipTable, OAuthReferenceGuardDescriptor, OAuthReferenceGuardTable, OAuthRegistrationAuthority, OAuthRegistrationBase, OAuthRegistrationCommandTable, OAuthRegistrationEligibility, OAuthRegistrationGuardDescriptor, OAuthRegistrationGuardTable, OAuthRegistrationIntentMapping, OAuthRegistrationIntentTable, OAuthRegistrationMapping, OAuthRegistrationState, OAuthSignInMapping, OAuthSubjectReadTable, OAuthSubjectTable, OAuthTupleAuthorityTable, OAuthTupleState, OAuthUnlinkCommandTable, oauthCleanupTable, oauthEligibilityTable, oauthReferenceGuardTable, oauthRegistrationGuardTable, requiredOAuthAccountsConstraints, requiredOAuthRegistrationConstraints, requiredOAuthSignInConstraints, requiredOAuthTupleConstraints };
+  export { OAuthAccountsMapping, OAuthAction, OAuthAuthorityReadTable, OAuthAuthorityTable, OAuthCleanupDescriptor, OAuthCleanupTable, OAuthClock, OAuthCredentialReadTable, OAuthCredentialTable, OAuthD1Mapping, OAuthEligibilityDescriptor, OAuthEligibilityFact, OAuthEligibilityTable, OAuthFlowTable, OAuthOwnershipReadTable, OAuthOwnershipTable, OAuthRegistrationAuthority, OAuthRegistrationGuardDescriptor, OAuthRegistrationGuardTable, OAuthRegistrationIntentMapping, OAuthRegistrationIntentTable, OAuthRegistrationMapping, OAuthSignInMapping, OAuthSubjectReadTable, OAuthSubjectTable, oauthCleanupTable, oauthEligibilityTable, oauthRegistrationGuardTable, requiredOAuthRegistrationConstraints, requiredOAuthSignInConstraints };
 }
 type Column<T extends TableModel> = T["column"];
-export type OAuthFlowState = "Pending" | "Claimed" | "Verified" | "RegistrationIssued" | "Linked" | "Cancelled" | "Rejected" | "Ambiguous" | "Conflict";
-export type OAuthTupleState = "Unowned" | "Reserved" | "Owned";
-export type OAuthRegistrationState = "Unbound" | "Registered" | "ProvisioningPending" | "Rejected";
 export type OAuthAction = OAuthActionAuthorization["challenge"]["action"];
-/** The engine writes every critical column explicitly after applying the pure
- * consumer encoder. Native instant values must roundtrip without precision loss. */
 export interface OAuthClock<Expression extends SqlExpression = SqlExpression> {
   readonly encodeInstant: (millis: number) => unknown;
   readonly decodeInstant: (value: unknown) => number;
@@ -24,6 +19,9 @@ export interface OAuthClock<Expression extends SqlExpression = SqlExpression> {
    * PostgreSQL uses clock_timestamp(), never now()/CURRENT_TIMESTAMP. D1 repeats
    * its primary-engine sample bounds in final guards. Return integer milliseconds. */
   readonly engineNowMillis: Expression;
+  /** Convert a stored timestamp expression to integer milliseconds. */
+  readonly toMillis: (expression: Expression) => Expression;
+  readonly fromMillis: (expression: Expression) => Expression;
 }
 export interface OAuthSubjectReadTable<S extends TableModel, Expression extends SqlExpression = SqlExpression> {
   readonly table: S["table"];
@@ -32,24 +30,21 @@ export interface OAuthSubjectReadTable<S extends TableModel, Expression extends
   readonly securityRevision: Column<S>;
   readonly isActiveStatus: (value: unknown) => boolean;
   readonly activeCondition: Expression;
+  readonly decodeAuthenticationRequirement: (row: S["select"]) => AuthenticationRequirement;
 }
 export interface OAuthSubjectTable<S extends TableModel, Expression extends SqlExpression = SqlExpression> extends OAuthSubjectReadTable<S, Expression> {
-  readonly decodeActionRequirement: (row: S["select"], action: OAuthAction) => AuthenticationRequirement;
-  readonly decodeAuthenticationRequirement: (row: S["select"]) => AuthenticationRequirement;
   readonly nextSecurityRevision: (current: SecurityRevision) => SecurityRevision;
 }
-export interface OAuthOwnershipReadTable<O extends TableModel, N, Expression extends SqlExpression = SqlExpression> {
+export interface OAuthOwnershipReadTable<O extends TableModel, N> {
   readonly table: O["table"];
   readonly identityKey: Column<O>;
   readonly provider: Column<O>;
   readonly issuer: Column<O>;
   readonly externalSubject: Column<O>;
   readonly subjectId: Column<O>;
-  /** Includes Owned state when authority and ownership share a physical table. */
-  readonly ownedCondition: Expression;
   readonly decodeSubjectId: (row: O["select"]) => N;
 }
-export interface OAuthOwnershipTable<O extends TableModel, N, Expression extends SqlExpression = SqlExpression> extends OAuthOwnershipReadTable<O, N, Expression> {
+export interface OAuthOwnershipTable<O extends TableModel, N> extends OAuthOwnershipReadTable<O, N> {
   readonly encodeInsert: (input: {
     readonly identity: typeof OAuthExternalIdentity.Type;
     readonly identityKey: string;
@@ -94,112 +89,40 @@ export interface OAuthAuthorityTable<C extends TableModel, N, Expression extends
     readonly revision: SecurityRevision;
   }) => C["insert"];
 }
-/** Both purposes may use the same physical table. Shared tables share module/flow
- * and module/command uniqueness. The snapshot has the exact purpose-specific core
- * codec; terminal writes erase it, while identity, claim and retention columns remain. */
+/** Live ceremonies only. Predicate columns enforce access before deletion; the
+ * snapshot retains the exact authenticated context and encrypted protocol data. */
 export interface OAuthFlowTable<F extends TableModel> {
   readonly table: F["table"];
   readonly moduleId: Column<F>;
   readonly flowId: Column<F>;
-  readonly commandId: Column<F>;
   readonly purpose: Column<F>;
   readonly generation: Column<F>;
-  readonly state: Column<F>;
-  readonly version: Column<F>;
+  readonly provider: Column<F>;
+  readonly callbackId: Column<F>;
+  readonly issuer: Column<F>;
+  readonly responseIssuerMode: Column<F>;
+  readonly subjectId: Column<F>;
   readonly stateDigest: Column<F>;
   readonly binderVerifier: Column<F>;
   readonly binderExpiresAt: Column<F>;
   readonly snapshot: Column<F>;
   readonly issuedAt: Column<F>;
   readonly expiresAt: Column<F>;
-  readonly claimId: Column<F>;
-  readonly claimedAt: Column<F>;
-  readonly claimExpiresAt: Column<F>;
-  readonly retentionUntil: Column<F>;
   readonly encodeInsert: (input: {
     readonly moduleId: string;
     readonly flowId: string;
-    readonly purpose: "sign-in" | "link";
+    readonly purpose: "sign-in" | "link" | "connect";
   }) => F["insert"];
 }
-export interface OAuthTupleAuthorityTable<T extends TableModel, N> {
-  readonly table: T["table"];
-  readonly identityKey: Column<T>;
-  readonly provider: Column<T>;
-  readonly issuer: Column<T>;
-  readonly externalSubject: Column<T>;
-  readonly state: Column<T>;
-  readonly version: Column<T>;
-  readonly subjectId: Column<T>;
-  /** Exact reservation identity; no application payload or bearer. */
-  readonly reservation: Column<T>;
-  readonly encodeInsert: (input: {
-    readonly identityKey: string;
-    readonly identity: typeof OAuthExternalIdentity.Type;
-    readonly subjectId?: N;
-  }) => T["insert"];
-}
-export interface OAuthRegistrationIntentTable<I extends TableModel> {
-  readonly table: I["table"];
-  readonly moduleId: Column<I>;
-  readonly reference: Column<I>;
-  readonly flowId: Column<I>;
-  readonly claimId: Column<I>;
-  readonly identityKey: Column<I>;
-  readonly version: Column<I>;
-  readonly state: Column<I>;
-  readonly snapshot: Column<I>;
-  readonly commandId: Column<I>;
-  readonly fingerprint: Column<I>;
-  readonly pendingReference: Column<I>;
-  readonly expiresAt: Column<I>;
-  readonly retentionUntil: Column<I>;
-  readonly encodeInsert: (intent: OAuthRegistrationIntent) => I["insert"];
-}
-export interface OAuthRegistrationCommandTable<R extends TableModel, Registration> {
-  readonly table: R["table"];
-  readonly moduleId: Column<R>;
-  readonly commandId: Column<R>;
-  readonly reference: Column<R>;
-  readonly identityKey: Column<R>;
-  readonly fingerprint: Column<R>;
-  readonly intentSnapshot: Column<R>;
-  readonly applicationSnapshot: Column<R>;
-  readonly provisioningIdentity: Column<R>;
-  readonly decision: Column<R>;
-  readonly retentionUntil: Column<R>;
-  /** Persists exact detached Type before protected pending work can start. */
-  readonly encodeInsert: (input: {
-    readonly intent: OAuthRegistrationIntent;
-    readonly commandId: string;
-    readonly fingerprint: string;
-    readonly registration: Registration;
-    readonly provisioningIdentity: string;
-  }) => R["insert"];
-}
-export interface OAuthUnlinkCommandTable<U extends TableModel> {
-  readonly table: U["table"];
-  readonly moduleId: Column<U>;
-  readonly commandId: Column<U>;
-  readonly subjectId: Column<U>;
-  readonly credentialId: Column<U>;
-  readonly intentSnapshot: Column<U>;
-  readonly decision: Column<U>;
-  readonly retentionUntil: Column<U>;
-  readonly encodeInsert: (input: {
-    readonly moduleId: string;
-    readonly commandId: string;
-    readonly credential: OAuthCredentialSnapshot;
-  }) => U["insert"];
-}
-export interface OAuthEligibilityFact {
-  readonly credentialId: string;
-  readonly revision: SecurityRevision;
-  readonly usablePrimary: boolean;
-  readonly factors: ReadonlyArray<AuthenticationFactor>;
-  readonly userVerified: boolean;
-  readonly phishingResistant: boolean;
-}
+export declare const OAuthEligibilityFact: Schema.Struct<{
+  readonly credentialId: Schema.NonEmptyString;
+  readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+  readonly usablePrimary: Schema.Boolean;
+  readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+  readonly userVerified: Schema.Boolean;
+  readonly phishingResistant: Schema.Boolean;
+}>;
+export type OAuthEligibilityFact = typeof OAuthEligibilityFact.Type;
 /** Each descriptor reads only its own subject-scoped method rows. The native row
  * projector and SQL condition must express the same installed method eligibility.
  * All source/identifier/policy mutations advance subject securityRevision. D1 also
@@ -214,11 +137,6 @@ export interface OAuthEligibilityTable<T extends TableModel, N, Expression exten
   readonly condition: (subjectId: N) => Expression;
   readonly decode: (row: T["select"]) => OAuthEligibilityFact | undefined;
 }
-/** Authenticated command replay uses current subject status and this additional
- * nonconsuming SQL policy. It never consumes a fresh action factor. */
-export interface OAuthMetadataPolicy<N, Expression extends SqlExpression = SqlExpression> {
-  readonly condition: (subjectId: N) => Expression;
-}
 export interface OAuthCleanupTable<T extends TableModel, N, Expression extends SqlExpression = SqlExpression> {
   readonly table: T["table"];
   readonly subjectId: Column<T>;
@@ -230,13 +148,51 @@ export interface OAuthCleanupTable<T extends TableModel, N, Expression extends S
   }) => Expression;
   readonly disposition: "delete";
 }
-export interface OAuthRegistrationEligibility<N, Expression extends SqlExpression = SqlExpression> {
-  /** Pure SQL guards for mutable app policy; evaluated again after app writes. */
+export interface OAuthRegistrationGuardTable<T extends TableModel, Registration, N, Expression extends SqlExpression = SqlExpression> {
+  readonly table: T["table"];
+  readonly orderBy: Column<T>;
   readonly condition: (input: {
     readonly intent: OAuthRegistrationIntent;
+    readonly registration: Registration;
     readonly nativeSubjectId?: N;
   }) => Expression;
 }
+export interface OAuthRegistrationGuardDescriptor<Registration, N, Expression extends SqlExpression = SqlExpression, Descriptor extends object = object> {
+  readonly table: Descriptor;
+  readonly orderBy: string;
+  readonly condition: OAuthRegistrationGuardTable<TableModel, Registration, N, Expression>["condition"];
+}
+export declare const oauthRegistrationGuardTable: <T extends TableModel, Registration, N, Expression extends SqlExpression = SqlExpression>(input: OAuthRegistrationGuardTable<T, Registration, N, Expression>) => OAuthRegistrationGuardDescriptor<Registration, N, Expression, T["table"]>;
+/** Heterogeneous descriptors are made by typed factories and projected privately. */
+export interface OAuthEligibilityDescriptor<N, Expression extends SqlExpression = SqlExpression, Descriptor extends object = object> {
+  readonly _tag: "OAuthEligibilityDescriptor";
+  readonly scope: string;
+  readonly table: Descriptor;
+  readonly subjectId: string;
+  readonly credentialId: string;
+  readonly revision: string;
+  readonly condition: (subjectId: N) => Expression;
+  readonly decode: (row: unknown) => OAuthEligibilityFact | undefined;
+}
+export declare const oauthEligibilityTable: <T extends TableModel, N, Expression extends SqlExpression = SqlExpression>(input: OAuthEligibilityTable<T, N, Expression>) => OAuthEligibilityDescriptor<N, Expression, T["table"]>;
+export interface OAuthCleanupDescriptor<N, Expression extends SqlExpression = SqlExpression, Descriptor extends object = object> {
+  readonly table: Descriptor;
+  readonly subjectId: string;
+  readonly condition: OAuthCleanupTable<TableModel, N, Expression>["condition"];
+}
+export declare const oauthCleanupTable: <T extends TableModel, N, Expression extends SqlExpression = SqlExpression>(input: OAuthCleanupTable<T, N, Expression>) => OAuthCleanupDescriptor<N, Expression, T["table"]>;
+/** Original application binding and retained decision are encoded in snapshot. */
+export interface OAuthRegistrationIntentTable<I extends TableModel> {
+  readonly table: I["table"];
+  readonly moduleId: Column<I>;
+  readonly reference: Column<I>;
+  readonly flowId: Column<I>;
+  readonly identityKey: Column<I>;
+  readonly snapshot: Column<I>;
+  readonly expiresAt: Column<I>;
+  readonly retentionUntil: Column<I>;
+  readonly encodeInsert: (intent: OAuthRegistrationIntent) => I["insert"];
+}
 export interface OAuthD1Mapping {
   readonly d1: {
     readonly primary: true;
@@ -244,27 +200,23 @@ export interface OAuthD1Mapping {
 }
 export declare const requiredOAuthSignInConstraints: {
   readonly flow: "unique(flow.moduleId,flow.flowId)";
-  readonly command: "unique(flow.moduleId,flow.commandId)";
   readonly stateDigest: "unique(flow.stateDigest)";
   readonly ownership: "unique(ownership.identityKey)";
   readonly credentialId: "unique(credential.credentialId)";
   readonly credentialIdentity: "unique(credential.identityKey)";
   readonly authorityCredential: "unique(authority.subjectId,authority.credentialId)";
 };
-export declare const requiredOAuthTupleConstraints: {
-  readonly identityKey: "unique(tuple.identityKey)";
-};
 export declare const requiredOAuthRegistrationConstraints: {
   readonly intentReference: "unique(intent.moduleId,intent.reference)";
   readonly intentFlow: "unique(intent.moduleId,intent.flowId)";
-  readonly command: "unique(registrationCommand.moduleId,registrationCommand.commandId)";
-};
-export declare const requiredOAuthAccountsConstraints: {
-  readonly unlinkCommand: "unique(unlinkCommand.moduleId,unlinkCommand.commandId)";
+  readonly ownership: "unique(ownership.identityKey)";
+  readonly credentialId: "unique(credential.credentialId)";
+  readonly credentialIdentity: "unique(credential.identityKey)";
+  readonly authorityCredential: "unique(authority.subjectId,authority.credentialId)";
 };
 export interface OAuthSignInMapping<S extends TableModel, O extends TableModel, C extends TableModel, AC extends TableModel, F extends TableModel, N, Expression extends SqlExpression = SqlExpression> {
   readonly subject: OAuthSubjectReadTable<S, Expression>;
-  readonly ownership: OAuthOwnershipReadTable<O, N, Expression>;
+  readonly ownership: OAuthOwnershipReadTable<O, N>;
   readonly credential: OAuthCredentialReadTable<C, Expression>;
   readonly authority: OAuthAuthorityReadTable<AC, Expression>;
   readonly flow: OAuthFlowTable<F>;
@@ -272,28 +224,22 @@ export interface OAuthSignInMapping<S extends TableModel, O extends TableModel,
   readonly clock: OAuthClock<Expression>;
   readonly constraints: typeof requiredOAuthSignInConstraints;
 }
-export type OAuthOwnershipMutation<T extends TableModel, O extends TableModel, N, Expression extends SqlExpression = SqlExpression> = {
-  readonly mode: "integrated";
-  readonly tuple: OAuthTupleAuthorityTable<T, N>;
-} | {
-  readonly mode: "separate";
-  readonly tuple: OAuthTupleAuthorityTable<T, N>;
-  readonly external: OAuthOwnershipTable<O, N, Expression>;
-};
-export interface OAuthRegistrationIntentMapping<S extends TableModel, O extends TableModel, C extends TableModel, AC extends TableModel, F extends TableModel, T extends TableModel, I extends TableModel, N, Expression extends SqlExpression = SqlExpression> {
-  readonly signIn: OAuthSignInMapping<S, O, C, AC, F, N, Expression>;
-  readonly ownership: OAuthOwnershipMutation<T, O, N, Expression>;
+export interface OAuthRegistrationIntentMapping<O extends TableModel, I extends TableModel, N, Expression extends SqlExpression = SqlExpression> {
+  readonly ownership: OAuthOwnershipReadTable<O, N>;
   readonly intent: OAuthRegistrationIntentTable<I>;
-  readonly tupleConstraints: typeof requiredOAuthTupleConstraints;
-  readonly registrationConstraints: Pick<typeof requiredOAuthRegistrationConstraints, "intentReference" | "intentFlow">;
-  readonly eligibility: OAuthRegistrationEligibility<N, Expression>;
+  readonly clock: OAuthClock<Expression>;
+  readonly constraints: Pick<typeof requiredOAuthRegistrationConstraints, "intentReference" | "intentFlow" | "ownership">;
+  readonly eligible: (intent: OAuthRegistrationIntent) => Expression;
 }
-export interface OAuthRegistrationBase<Registration, T extends TableModel, O extends TableModel, I extends TableModel, R extends TableModel, N, Expression extends SqlExpression = SqlExpression, Descriptor extends object = object> {
-  readonly ownership: OAuthOwnershipMutation<T, O, N, Expression>;
+export interface OAuthRegistrationMapping<Registration, S extends TableModel, O extends TableModel, C extends TableModel, AC extends TableModel, I extends TableModel, N, Expression extends SqlExpression = SqlExpression, Descriptor extends object = object> {
+  readonly registration: Schema.Codec<Registration, unknown, never, never>;
+  readonly ownership: OAuthOwnershipTable<O, N>;
   readonly intent: OAuthRegistrationIntentTable<I>;
-  readonly command: OAuthRegistrationCommandTable<R, Registration>;
+  readonly subject: OAuthSubjectReadTable<S, Expression>;
+  readonly credential: OAuthCredentialTable<C, N, Expression>;
+  readonly authority: OAuthAuthorityTable<AC, N, Expression>;
+  readonly subjectId: SubjectIdCodec<N>;
   readonly clock: OAuthClock<Expression>;
-  readonly tupleConstraints: typeof requiredOAuthTupleConstraints;
   readonly constraints: typeof requiredOAuthRegistrationConstraints;
   readonly inspect: (input: {
     readonly intent: OAuthRegistrationIntent;
@@ -302,142 +248,48 @@ export interface OAuthRegistrationBase<Registration, T extends TableModel, O ext
     readonly fingerprint: string;
     readonly eligible: boolean;
   }, PersistenceMappingError>;
-  /** Required for an explicitly bound native/DO command: no asynchronous callback
-   * is evaluated inside the physical owner. Standalone inspection is pre-owner. */
-  readonly inspectSync?: (input: {
-    readonly intent: OAuthRegistrationIntent;
-    readonly registration: Registration;
-  }) => {
-    readonly fingerprint: string;
-    readonly eligible: boolean;
-  };
-  /** Type projection, never the original wire transformation. */
-  readonly snapshot: (registration: Registration) => Effect.Effect<Registration, PersistenceMappingError>;
-  readonly snapshotSync?: (registration: Registration) => Registration;
-  /** Canonical bounded storage of Registration.Type. These are Type codecs, not
-   * the original wire decoder/encoder; decode(encode(value)) must encode identically.
-   * The engine writes and roundtrip-checks this exact string (maximum 1 MiB). */
-  readonly application: {
-    readonly encode: (registration: Registration) => string;
-    readonly decode: (stored: string) => Registration;
-  };
   readonly eligibility: {
-    /** Stable application authority anchors, in one configured global order.
-     * Omit only for immutable/tuple-local policy or an equivalent explicit outer
-     * owner lock. Each scope must match 1..64 rows, never an absent quota row.
-     * Locks precede tuple/intent/command locks; postcondition owns changed state. */
     readonly guards?: ReadonlyArray<OAuthRegistrationGuardDescriptor<Registration, N, Expression, Descriptor>>;
     readonly admission: (input: {
       readonly intent: OAuthRegistrationIntent;
       readonly registration: Registration;
       readonly nativeSubjectId?: N;
     }) => Expression;
-    /** Evaluated after subject/application writes, including appended coordinator
-     * writes. May assert consumption of the admission invitation/quota. */
     readonly postcondition: (input: {
       readonly intent: OAuthRegistrationIntent;
       readonly registration: Registration;
       readonly nativeSubjectId?: N;
     }) => Expression;
   };
-  readonly allocateProvisioningIdentity: Effect.Effect<string, PersistenceMappingError>;
-  readonly retentionMillis: number;
-}
-export interface OAuthRegistrationGuardTable<T extends TableModel, Registration, N, Expression extends SqlExpression = SqlExpression> {
-  readonly table: T["table"];
-  readonly orderBy: Column<T>;
-  readonly condition: (input: {
-    readonly intent: OAuthRegistrationIntent;
-    readonly registration: Registration;
-    readonly nativeSubjectId?: N;
-  }) => Expression;
-}
-export interface OAuthRegistrationGuardDescriptor<Registration, N, Expression extends SqlExpression = SqlExpression, Descriptor extends object = object> {
-  readonly table: Descriptor;
-  readonly orderBy: string;
-  readonly condition: OAuthRegistrationGuardTable<TableModel, Registration, N, Expression>["condition"];
-}
-export declare const oauthRegistrationGuardTable: <T extends TableModel, Registration, N, Expression extends SqlExpression = SqlExpression>(input: OAuthRegistrationGuardTable<T, Registration, N, Expression>) => OAuthRegistrationGuardDescriptor<Registration, N, Expression, T["table"]>;
-export type OAuthRegistrationMapping<Registration, S extends TableModel, O extends TableModel, C extends TableModel, AC extends TableModel, T extends TableModel, I extends TableModel, R extends TableModel, N, Expression extends SqlExpression = SqlExpression, Descriptor extends object = object> = OAuthRegistrationBase<Registration, T, O, I, R, N, Expression, Descriptor> & ({
-  readonly mode: "pending";
-  readonly allocatePendingReference: Effect.Effect<string, PersistenceMappingError>;
-} | {
-  readonly mode: "atomic";
-  readonly subjectId: SubjectIdCodec<N>;
-  readonly subject: OAuthSubjectReadTable<S, Expression>;
-  readonly credential: OAuthCredentialTable<C, N, Expression>;
-  readonly authority: OAuthAuthorityTable<AC, N, Expression>;
   readonly allocateSubjectId: Effect.Effect<N, PersistenceMappingError>;
   readonly allocateCredentialId: Effect.Effect<string, PersistenceMappingError>;
   readonly allocateRevision: Effect.Effect<SecurityRevision, PersistenceMappingError>;
   readonly encodeSubjectInsert: (input: {
     readonly intent: OAuthRegistrationIntent;
     readonly registration: Registration;
+    readonly requestId: string;
   }, ids: {
     readonly subjectId: N;
     readonly securityRevision: SecurityRevision;
   }) => S["insert"];
-});
-/** Heterogeneous descriptors are made by typed factories and projected privately. */
-export interface OAuthEligibilityDescriptor<N, Expression extends SqlExpression = SqlExpression, Descriptor extends object = object> {
-  readonly _tag: "OAuthEligibilityDescriptor";
-  readonly scope: string;
-  readonly table: Descriptor;
-  readonly subjectId: string;
-  readonly credentialId: string;
-  readonly revision: string;
-  readonly condition: (subjectId: N) => Expression;
-  readonly decode: (row: unknown) => OAuthEligibilityFact | undefined;
-}
-export declare const oauthEligibilityTable: <T extends TableModel, N, Expression extends SqlExpression = SqlExpression>(input: OAuthEligibilityTable<T, N, Expression>) => OAuthEligibilityDescriptor<N, Expression, T["table"]>;
-export interface OAuthCleanupDescriptor<N, Expression extends SqlExpression = SqlExpression, Descriptor extends object = object> {
-  readonly table: Descriptor;
-  readonly subjectId: string;
-  readonly condition: OAuthCleanupTable<TableModel, N, Expression>["condition"];
 }
-export declare const oauthCleanupTable: <T extends TableModel, N, Expression extends SqlExpression = SqlExpression>(input: OAuthCleanupTable<T, N, Expression>) => OAuthCleanupDescriptor<N, Expression, T["table"]>;
-/** A stable application/reference lock acquired before an ownership target.
- * Missing rows retain ownership. Conditions use detached native IDs; every
- * writer of the guarded reference follows the same order. */
-export interface OAuthReferenceGuardTable<T extends TableModel, N, Expression extends SqlExpression = SqlExpression> {
-  readonly table: T["table"];
-  readonly orderBy: Column<T>;
-  readonly condition: (input: {
-    readonly identity: typeof OAuthExternalIdentity.Type;
-    readonly identityKey: string;
-    readonly subjectId: N;
-  }) => Expression | Effect.Effect<Expression, PlatformError.PlatformError, Crypto.Crypto>;
-}
-export interface OAuthReferenceGuardDescriptor<N, Expression extends SqlExpression = SqlExpression, Descriptor extends object = object> {
-  readonly table: Descriptor;
-  readonly orderBy: string;
-  readonly condition: OAuthReferenceGuardTable<TableModel, N, Expression>["condition"];
-}
-export declare const oauthReferenceGuardTable: <T extends TableModel, N, Expression extends SqlExpression = SqlExpression>(input: OAuthReferenceGuardTable<T, N, Expression>) => OAuthReferenceGuardDescriptor<N, Expression, T["table"]>;
-export interface OAuthAccountsMapping<S extends TableModel, O extends TableModel, C extends TableModel, AC extends TableModel, F extends TableModel, T extends TableModel, U extends TableModel, N, Expression extends SqlExpression = SqlExpression, Descriptor extends object = object> {
+export interface OAuthAccountsMapping<S extends TableModel, O extends TableModel, C extends TableModel, AC extends TableModel, F extends TableModel, N, Expression extends SqlExpression = SqlExpression, Descriptor extends object = object> {
   readonly subject: OAuthSubjectTable<S, Expression>;
-  readonly ownership: OAuthOwnershipMutation<T, O, N, Expression>;
+  readonly ownership: OAuthOwnershipTable<O, N>;
   readonly credential: OAuthCredentialTable<C, N, Expression>;
   readonly authority: OAuthAuthorityTable<AC, N, Expression>;
   readonly flow: OAuthFlowTable<F>;
-  readonly command: OAuthUnlinkCommandTable<U>;
   readonly subjectId: SubjectIdCodec<N>;
   readonly clock: OAuthClock<Expression>;
-  readonly constraints: typeof requiredOAuthSignInConstraints & typeof requiredOAuthAccountsConstraints;
-  readonly tupleConstraints: typeof requiredOAuthTupleConstraints;
+  readonly constraints: typeof requiredOAuthSignInConstraints;
   readonly eligibility: ReadonlyArray<OAuthEligibilityDescriptor<N, Expression, Descriptor>>;
   readonly cleanup: ReadonlyArray<OAuthCleanupDescriptor<N, Expression, Descriptor>>;
-  readonly metadata: OAuthMetadataPolicy<N, Expression>;
   readonly sessionInvalidation: "same-authority-immediate" | "original-absolute-expiry";
-  /** Omit only when connected access is absent. A predicate alone conservatively
-   * retains ownership; release also needs all configured guard rows below. */
-  readonly connectedReference?: (input: {
+  /** Indexed same-owner reference predicate for any installed grant/application references. */
+  readonly otherReferences: (input: {
     readonly identityKey: string;
     readonly subjectId: N;
   }) => Expression;
-  /** At most 32 descriptors, each locking 1..64 stable rows in supplied order.
-   * Missing/empty guards retain Owned, even when the reference predicate is false. */
-  readonly connectedReferenceGuards?: ReadonlyArray<OAuthReferenceGuardDescriptor<N, Expression, Descriptor>>;
   readonly allocateCredentialId: Effect.Effect<string, PersistenceMappingError>;
   readonly allocateRevision: Effect.Effect<SecurityRevision, PersistenceMappingError>;
 }
@@ -456,11 +308,10 @@ export interface OAuthRegistrationAuthority<Registration> {
     readonly commandId: typeof OAuthCommandId.Type;
     readonly registration: Registration;
     readonly fingerprint: TokenDigest;
+    readonly payload: string;
+    readonly requestId: string;
   }, prepare: PrepareOAuthCommit<OAuthRegistrationDecision, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;
-  readonly cleanup: <A>(input: OAuthCleanupInput, prepare: PrepareOAuthCommit<{
-    readonly removed: number;
-    readonly hasMore: boolean;
-  }, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;
+  readonly cleanup: <A>(input: OAuthCleanupInput, prepare: PrepareOAuthCommit<CleanupResult, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;
 }
 //#endregion
 export { oauth_model_d_exports };

package/dist/internal/models/oauth-model.mjs

@@ -1,20 +1,15 @@
+import { Schema } from "effect";
+import { SecurityRevision } from "@yielded/auth/Sessions";
+import { AuthenticationFactor } from "@yielded/auth/Operations";
 //#region src/internal/models/oauth-model.ts
-const requiredOAuthSignInConstraints = {
-	flow: "unique(flow.moduleId,flow.flowId)",
-	command: "unique(flow.moduleId,flow.commandId)",
-	stateDigest: "unique(flow.stateDigest)",
-	ownership: "unique(ownership.identityKey)",
-	credentialId: "unique(credential.credentialId)",
-	credentialIdentity: "unique(credential.identityKey)",
-	authorityCredential: "unique(authority.subjectId,authority.credentialId)"
-};
-const requiredOAuthTupleConstraints = { identityKey: "unique(tuple.identityKey)" };
-const requiredOAuthRegistrationConstraints = {
-	intentReference: "unique(intent.moduleId,intent.reference)",
-	intentFlow: "unique(intent.moduleId,intent.flowId)",
-	command: "unique(registrationCommand.moduleId,registrationCommand.commandId)"
-};
-const requiredOAuthAccountsConstraints = { unlinkCommand: "unique(unlinkCommand.moduleId,unlinkCommand.commandId)" };
+const OAuthEligibilityFact = Schema.Struct({
+	credentialId: Schema.NonEmptyString.check(Schema.isMaxLength(256)),
+	revision: SecurityRevision,
+	usablePrimary: Schema.Boolean,
+	factors: Schema.Array(AuthenticationFactor).check(Schema.isMaxLength(8)),
+	userVerified: Schema.Boolean,
+	phishingResistant: Schema.Boolean
+});
 const oauthRegistrationGuardTable = (input) => Object.freeze({
 	table: input.table,
 	orderBy: input.orderBy,
@@ -38,12 +33,23 @@ const oauthCleanupTable = (input) => Object.freeze({
 	subjectId: input.subjectId,
 	condition: input.condition
 });
-const oauthReferenceGuardTable = (input) => Object.freeze({
-	table: input.table,
-	orderBy: input.orderBy,
-	condition: input.condition
-});
+const requiredOAuthSignInConstraints = {
+	flow: "unique(flow.moduleId,flow.flowId)",
+	stateDigest: "unique(flow.stateDigest)",
+	ownership: "unique(ownership.identityKey)",
+	credentialId: "unique(credential.credentialId)",
+	credentialIdentity: "unique(credential.identityKey)",
+	authorityCredential: "unique(authority.subjectId,authority.credentialId)"
+};
+const requiredOAuthRegistrationConstraints = {
+	intentReference: "unique(intent.moduleId,intent.reference)",
+	intentFlow: "unique(intent.moduleId,intent.flowId)",
+	ownership: "unique(ownership.identityKey)",
+	credentialId: "unique(credential.credentialId)",
+	credentialIdentity: "unique(credential.identityKey)",
+	authorityCredential: "unique(authority.subjectId,authority.credentialId)"
+};
 //#endregion
-export { oauthCleanupTable, oauthEligibilityTable, oauthReferenceGuardTable, oauthRegistrationGuardTable, requiredOAuthAccountsConstraints, requiredOAuthRegistrationConstraints, requiredOAuthSignInConstraints, requiredOAuthTupleConstraints };
+export { OAuthEligibilityFact, oauthCleanupTable, oauthEligibilityTable, oauthRegistrationGuardTable, requiredOAuthRegistrationConstraints, requiredOAuthSignInConstraints };
 
 //# sourceMappingURL=oauth-model.mjs.map