@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.26

package/dist/internal/models/oauth-model.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-model.mjs","names":[],"sources":["../../../src/internal/models/oauth-model.ts"],"sourcesContent":["import type { PreparedCommit } from \"@yielded/auth/Hooks\";\nimport type {\n  OAuthActionAuthorization,\n  OAuthAccountRevision,\n  OAuthRegistrationIntent,\n  OAuthCredentialSnapshot,\n  OAuthExternalIdentity,\n  OAuthRegistrationAccess,\n  OAuthRegistrationInspection,\n  OAuthUnavailable,\n  OAuthCommandId,\n  PrepareOAuthCommit,\n  OAuthRegistrationDecision,\n  OAuthCleanupInput,\n} from \"@yielded/auth/OAuth\";\nimport type { AuthenticationFactor } from \"@yielded/auth/Operations\";\nimport type { TokenDigest } from \"@yielded/auth/Schema\";\nimport type { AuthenticationRequirement, SecurityRevision } from \"@yielded/auth/Sessions\";\nimport type { Crypto, Effect, PlatformError } from \"effect\";\n\nimport type { TableModel as Table, SqlExpression } from \"../query-operations\";\nimport type { PersistenceMappingError, SubjectIdCodec } from \"./common\";\n\ntype Column<T extends Table> = T[\"column\"];\n\nexport type OAuthFlowState =\n  | \"Pending\"\n  | \"Claimed\"\n  | \"Verified\"\n  | \"RegistrationIssued\"\n  | \"Linked\"\n  | \"Cancelled\"\n  | \"Rejected\"\n  | \"Ambiguous\"\n  | \"Conflict\";\n\nexport type OAuthTupleState = \"Unowned\" | \"Reserved\" | \"Owned\";\nexport type OAuthRegistrationState = \"Unbound\" | \"Registered\" | \"ProvisioningPending\" | \"Rejected\";\nexport type OAuthAction = OAuthActionAuthorization[\"challenge\"][\"action\"];\n\n/** The engine writes every critical column explicitly after applying the pure\n * consumer encoder. Native instant values must roundtrip without precision loss. */\nexport interface OAuthClock<Expression extends SqlExpression = SqlExpression> {\n  readonly encodeInstant: (millis: number) => unknown;\n  readonly decodeInstant: (value: unknown) => number;\n  /** Actual engine wall clock sampled after locks, not transaction-start time.\n   * PostgreSQL uses clock_timestamp(), never now()/CURRENT_TIMESTAMP. D1 repeats\n   * its primary-engine sample bounds in final guards. Return integer milliseconds. */\n  readonly engineNowMillis: Expression;\n}\n\nexport interface OAuthSubjectReadTable<\n  S extends Table,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: S[\"table\"];\n  readonly id: Column<S>;\n  readonly status: Column<S>;\n  readonly securityRevision: Column<S>;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly activeCondition: Expression;\n}\n\nexport interface OAuthSubjectTable<\n  S extends Table,\n  Expression extends SqlExpression = SqlExpression,\n> extends OAuthSubjectReadTable<S, Expression> {\n  readonly decodeActionRequirement: (\n    row: S[\"select\"],\n    action: OAuthAction,\n  ) => AuthenticationRequirement;\n  readonly decodeAuthenticationRequirement: (row: S[\"select\"]) => AuthenticationRequirement;\n  readonly nextSecurityRevision: (current: SecurityRevision) => SecurityRevision;\n}\n\nexport interface OAuthOwnershipReadTable<\n  O extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: O[\"table\"];\n  readonly identityKey: Column<O>;\n  readonly provider: Column<O>;\n  readonly issuer: Column<O>;\n  readonly externalSubject: Column<O>;\n  readonly subjectId: Column<O>;\n  /** Includes Owned state when authority and ownership share a physical table. */\n  readonly ownedCondition: Expression;\n  readonly decodeSubjectId: (row: O[\"select\"]) => N;\n}\n\nexport interface OAuthOwnershipTable<\n  O extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> extends OAuthOwnershipReadTable<O, N, Expression> {\n  readonly encodeInsert: (input: {\n    readonly identity: typeof OAuthExternalIdentity.Type;\n    readonly identityKey: string;\n    readonly subjectId: N;\n  }) => O[\"insert\"];\n}\n\nexport interface OAuthCredentialReadTable<\n  C extends Table,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: C[\"table\"];\n  readonly moduleId: Column<C>;\n  readonly credentialId: Column<C>;\n  readonly subjectId: Column<C>;\n  readonly identityKey: Column<C>;\n  readonly credentialRevision: Column<C>;\n  readonly status: Column<C>;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly activeCondition: Expression;\n}\n\nexport interface OAuthCredentialTable<\n  C extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> extends OAuthCredentialReadTable<C, Expression> {\n  readonly encodeInsert: (input: {\n    readonly moduleId: string;\n    readonly subjectId: N;\n    readonly identityKey: string;\n    readonly credentialId: string;\n    readonly credentialRevision: SecurityRevision;\n  }) => C[\"insert\"];\n  /** This slice removes login rows. Historical records belong in separate audit storage. */\n  readonly removal: \"delete\";\n}\n\nexport interface OAuthAuthorityReadTable<\n  C extends Table,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: C[\"table\"];\n  readonly subjectId: Column<C>;\n  readonly credentialId: Column<C>;\n  readonly revision: Column<C>;\n  readonly status: Column<C>;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly activeCondition: Expression;\n}\n\nexport interface OAuthAuthorityTable<\n  C extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> extends OAuthAuthorityReadTable<C, Expression> {\n  readonly encodeInsert: (input: {\n    readonly subjectId: N;\n    readonly credentialId: string;\n    readonly revision: SecurityRevision;\n  }) => C[\"insert\"];\n}\n\n/** Both purposes may use the same physical table. Shared tables share module/flow\n * and module/command uniqueness. The snapshot has the exact purpose-specific core\n * codec; terminal writes erase it, while identity, claim and retention columns remain. */\nexport interface OAuthFlowTable<F extends Table> {\n  readonly table: F[\"table\"];\n  readonly moduleId: Column<F>;\n  readonly flowId: Column<F>;\n  readonly commandId: Column<F>;\n  readonly purpose: Column<F>;\n  readonly generation: Column<F>;\n  readonly state: Column<F>;\n  readonly version: Column<F>;\n  readonly stateDigest: Column<F>;\n  readonly binderVerifier: Column<F>;\n  readonly binderExpiresAt: Column<F>;\n  readonly snapshot: Column<F>;\n  readonly issuedAt: Column<F>;\n  readonly expiresAt: Column<F>;\n  readonly claimId: Column<F>;\n  readonly claimedAt: Column<F>;\n  readonly claimExpiresAt: Column<F>;\n  readonly retentionUntil: Column<F>;\n  readonly encodeInsert: (input: {\n    readonly moduleId: string;\n    readonly flowId: string;\n    readonly purpose: \"sign-in\" | \"link\";\n  }) => F[\"insert\"];\n}\n\nexport interface OAuthTupleAuthorityTable<T extends Table, N> {\n  readonly table: T[\"table\"];\n  readonly identityKey: Column<T>;\n  readonly provider: Column<T>;\n  readonly issuer: Column<T>;\n  readonly externalSubject: Column<T>;\n  readonly state: Column<T>;\n  readonly version: Column<T>;\n  readonly subjectId: Column<T>;\n  /** Exact reservation identity; no application payload or bearer. */\n  readonly reservation: Column<T>;\n  readonly encodeInsert: (input: {\n    readonly identityKey: string;\n    readonly identity: typeof OAuthExternalIdentity.Type;\n    readonly subjectId?: N;\n  }) => T[\"insert\"];\n}\n\nexport interface OAuthRegistrationIntentTable<I extends Table> {\n  readonly table: I[\"table\"];\n  readonly moduleId: Column<I>;\n  readonly reference: Column<I>;\n  readonly flowId: Column<I>;\n  readonly claimId: Column<I>;\n  readonly identityKey: Column<I>;\n  readonly version: Column<I>;\n  readonly state: Column<I>;\n  readonly snapshot: Column<I>;\n  readonly commandId: Column<I>;\n  readonly fingerprint: Column<I>;\n  readonly pendingReference: Column<I>;\n  readonly expiresAt: Column<I>;\n  readonly retentionUntil: Column<I>;\n  readonly encodeInsert: (intent: OAuthRegistrationIntent) => I[\"insert\"];\n}\n\nexport interface OAuthRegistrationCommandTable<R extends Table, Registration> {\n  readonly table: R[\"table\"];\n  readonly moduleId: Column<R>;\n  readonly commandId: Column<R>;\n  readonly reference: Column<R>;\n  readonly identityKey: Column<R>;\n  readonly fingerprint: Column<R>;\n  readonly intentSnapshot: Column<R>;\n  readonly applicationSnapshot: Column<R>;\n  readonly provisioningIdentity: Column<R>;\n  readonly decision: Column<R>;\n  readonly retentionUntil: Column<R>;\n  /** Persists exact detached Type before protected pending work can start. */\n  readonly encodeInsert: (input: {\n    readonly intent: OAuthRegistrationIntent;\n    readonly commandId: string;\n    readonly fingerprint: string;\n    readonly registration: Registration;\n    readonly provisioningIdentity: string;\n  }) => R[\"insert\"];\n}\n\nexport interface OAuthUnlinkCommandTable<U extends Table> {\n  readonly table: U[\"table\"];\n  readonly moduleId: Column<U>;\n  readonly commandId: Column<U>;\n  readonly subjectId: Column<U>;\n  readonly credentialId: Column<U>;\n  readonly intentSnapshot: Column<U>;\n  readonly decision: Column<U>;\n  readonly retentionUntil: Column<U>;\n  readonly encodeInsert: (input: {\n    readonly moduleId: string;\n    readonly commandId: string;\n    readonly credential: OAuthCredentialSnapshot;\n  }) => U[\"insert\"];\n}\n\nexport interface OAuthEligibilityFact {\n  readonly credentialId: string;\n  readonly revision: SecurityRevision;\n  readonly usablePrimary: boolean;\n  readonly factors: ReadonlyArray<AuthenticationFactor>;\n  readonly userVerified: boolean;\n  readonly phishingResistant: boolean;\n}\n\n/** Each descriptor reads only its own subject-scoped method rows. The native row\n * projector and SQL condition must express the same installed method eligibility.\n * All source/identifier/policy mutations advance subject securityRevision. D1 also\n * guards exact selected IDs/versions and absence/count assumptions, never just a\n * stale boolean. An over-limit graph fails closed rather than truncating. */\nexport interface OAuthEligibilityTable<\n  T extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: T[\"table\"];\n  readonly subjectId: Column<T>;\n  readonly credentialId: Column<T>;\n  readonly revision: Column<T>;\n  readonly scope: string;\n  readonly condition: (subjectId: N) => Expression;\n  readonly decode: (row: T[\"select\"]) => OAuthEligibilityFact | undefined;\n}\n\n/** Authenticated command replay uses current subject status and this additional\n * nonconsuming SQL policy. It never consumes a fresh action factor. */\nexport interface OAuthMetadataPolicy<N, Expression extends SqlExpression = SqlExpression> {\n  readonly condition: (subjectId: N) => Expression;\n}\n\nexport interface OAuthCleanupTable<\n  T extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: T[\"table\"];\n  readonly subjectId: Column<T>;\n  /** Bound to this subject's old revision; no opaque independently committing service. */\n  readonly condition: (input: {\n    readonly subjectId: N;\n    readonly revision: OAuthAccountRevision;\n    readonly removedCredentialId?: string;\n  }) => Expression;\n  readonly disposition: \"delete\";\n}\n\nexport interface OAuthRegistrationEligibility<N, Expression extends SqlExpression = SqlExpression> {\n  /** Pure SQL guards for mutable app policy; evaluated again after app writes. */\n  readonly condition: (input: {\n    readonly intent: OAuthRegistrationIntent;\n    readonly nativeSubjectId?: N;\n  }) => Expression;\n}\n\nexport interface OAuthD1Mapping {\n  readonly d1: { readonly primary: true };\n}\n\nexport const requiredOAuthSignInConstraints = {\n  flow: \"unique(flow.moduleId,flow.flowId)\",\n  command: \"unique(flow.moduleId,flow.commandId)\",\n  stateDigest: \"unique(flow.stateDigest)\",\n  ownership: \"unique(ownership.identityKey)\",\n  credentialId: \"unique(credential.credentialId)\",\n  credentialIdentity: \"unique(credential.identityKey)\",\n  authorityCredential: \"unique(authority.subjectId,authority.credentialId)\",\n} as const;\n\nexport const requiredOAuthTupleConstraints = { identityKey: \"unique(tuple.identityKey)\" } as const;\n\nexport const requiredOAuthRegistrationConstraints = {\n  intentReference: \"unique(intent.moduleId,intent.reference)\",\n  intentFlow: \"unique(intent.moduleId,intent.flowId)\",\n  command: \"unique(registrationCommand.moduleId,registrationCommand.commandId)\",\n} as const;\n\nexport const requiredOAuthAccountsConstraints = {\n  unlinkCommand: \"unique(unlinkCommand.moduleId,unlinkCommand.commandId)\",\n} as const;\n\nexport interface OAuthSignInMapping<\n  S extends Table,\n  O extends Table,\n  C extends Table,\n  AC extends Table,\n  F extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly subject: OAuthSubjectReadTable<S, Expression>;\n  readonly ownership: OAuthOwnershipReadTable<O, N, Expression>;\n  readonly credential: OAuthCredentialReadTable<C, Expression>;\n  readonly authority: OAuthAuthorityReadTable<AC, Expression>;\n  readonly flow: OAuthFlowTable<F>;\n  readonly subjectId: SubjectIdCodec<N>;\n  readonly clock: OAuthClock<Expression>;\n  readonly constraints: typeof requiredOAuthSignInConstraints;\n}\n\nexport type OAuthOwnershipMutation<\n  T extends Table,\n  O extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> =\n  | { readonly mode: \"integrated\"; readonly tuple: OAuthTupleAuthorityTable<T, N> }\n  | {\n      readonly mode: \"separate\";\n      readonly tuple: OAuthTupleAuthorityTable<T, N>;\n      readonly external: OAuthOwnershipTable<O, N, Expression>;\n    };\n\nexport interface OAuthRegistrationIntentMapping<\n  S extends Table,\n  O extends Table,\n  C extends Table,\n  AC extends Table,\n  F extends Table,\n  T extends Table,\n  I extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly signIn: OAuthSignInMapping<S, O, C, AC, F, N, Expression>;\n  readonly ownership: OAuthOwnershipMutation<T, O, N, Expression>;\n  readonly intent: OAuthRegistrationIntentTable<I>;\n  readonly tupleConstraints: typeof requiredOAuthTupleConstraints;\n  readonly registrationConstraints: Pick<\n    typeof requiredOAuthRegistrationConstraints,\n    \"intentReference\" | \"intentFlow\"\n  >;\n  readonly eligibility: OAuthRegistrationEligibility<N, Expression>;\n}\n\nexport interface OAuthRegistrationBase<\n  Registration,\n  T extends Table,\n  O extends Table,\n  I extends Table,\n  R extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n  Descriptor extends object = object,\n> {\n  readonly ownership: OAuthOwnershipMutation<T, O, N, Expression>;\n  readonly intent: OAuthRegistrationIntentTable<I>;\n  readonly command: OAuthRegistrationCommandTable<R, Registration>;\n  readonly clock: OAuthClock<Expression>;\n  readonly tupleConstraints: typeof requiredOAuthTupleConstraints;\n  readonly constraints: typeof requiredOAuthRegistrationConstraints;\n  readonly inspect: (input: {\n    readonly intent: OAuthRegistrationIntent;\n    readonly registration: Registration;\n  }) => Effect.Effect<\n    { readonly fingerprint: string; readonly eligible: boolean },\n    PersistenceMappingError\n  >;\n  /** Required for an explicitly bound native/DO command: no asynchronous callback\n   * is evaluated inside the physical owner. Standalone inspection is pre-owner. */\n  readonly inspectSync?: (input: {\n    readonly intent: OAuthRegistrationIntent;\n    readonly registration: Registration;\n  }) => { readonly fingerprint: string; readonly eligible: boolean };\n  /** Type projection, never the original wire transformation. */\n  readonly snapshot: (\n    registration: Registration,\n  ) => Effect.Effect<Registration, PersistenceMappingError>;\n  readonly snapshotSync?: (registration: Registration) => Registration;\n  /** Canonical bounded storage of Registration.Type. These are Type codecs, not\n   * the original wire decoder/encoder; decode(encode(value)) must encode identically.\n   * The engine writes and roundtrip-checks this exact string (maximum 1 MiB). */\n  readonly application: {\n    readonly encode: (registration: Registration) => string;\n    readonly decode: (stored: string) => Registration;\n  };\n  readonly eligibility: {\n    /** Stable application authority anchors, in one configured global order.\n     * Omit only for immutable/tuple-local policy or an equivalent explicit outer\n     * owner lock. Each scope must match 1..64 rows, never an absent quota row.\n     * Locks precede tuple/intent/command locks; postcondition owns changed state. */\n    readonly guards?: ReadonlyArray<\n      OAuthRegistrationGuardDescriptor<Registration, N, Expression, Descriptor>\n    >;\n    readonly admission: (input: {\n      readonly intent: OAuthRegistrationIntent;\n      readonly registration: Registration;\n      readonly nativeSubjectId?: N;\n    }) => Expression;\n    /** Evaluated after subject/application writes, including appended coordinator\n     * writes. May assert consumption of the admission invitation/quota. */\n    readonly postcondition: (input: {\n      readonly intent: OAuthRegistrationIntent;\n      readonly registration: Registration;\n      readonly nativeSubjectId?: N;\n    }) => Expression;\n  };\n  readonly allocateProvisioningIdentity: Effect.Effect<string, PersistenceMappingError>;\n  readonly retentionMillis: number;\n}\n\nexport interface OAuthRegistrationGuardTable<\n  T extends Table,\n  Registration,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: T[\"table\"];\n  readonly orderBy: Column<T>;\n  readonly condition: (input: {\n    readonly intent: OAuthRegistrationIntent;\n    readonly registration: Registration;\n    readonly nativeSubjectId?: N;\n  }) => Expression;\n}\n\nexport interface OAuthRegistrationGuardDescriptor<\n  Registration,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n  Descriptor extends object = object,\n> {\n  readonly table: Descriptor;\n  readonly orderBy: string;\n  readonly condition: OAuthRegistrationGuardTable<Table, Registration, N, Expression>[\"condition\"];\n}\n\nexport const oauthRegistrationGuardTable = <\n  T extends Table,\n  Registration,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n>(\n  input: OAuthRegistrationGuardTable<T, Registration, N, Expression>,\n): OAuthRegistrationGuardDescriptor<Registration, N, Expression, T[\"table\"]> =>\n  Object.freeze({\n    table: input.table,\n    orderBy: input.orderBy,\n    condition: input.condition,\n  });\n\nexport type OAuthRegistrationMapping<\n  Registration,\n  S extends Table,\n  O extends Table,\n  C extends Table,\n  AC extends Table,\n  T extends Table,\n  I extends Table,\n  R extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n  Descriptor extends object = object,\n> = OAuthRegistrationBase<Registration, T, O, I, R, N, Expression, Descriptor> &\n  (\n    | {\n        readonly mode: \"pending\";\n        readonly allocatePendingReference: Effect.Effect<string, PersistenceMappingError>;\n      }\n    | {\n        readonly mode: \"atomic\";\n        readonly subjectId: SubjectIdCodec<N>;\n        readonly subject: OAuthSubjectReadTable<S, Expression>;\n        readonly credential: OAuthCredentialTable<C, N, Expression>;\n        readonly authority: OAuthAuthorityTable<AC, N, Expression>;\n        readonly allocateSubjectId: Effect.Effect<N, PersistenceMappingError>;\n        readonly allocateCredentialId: Effect.Effect<string, PersistenceMappingError>;\n        readonly allocateRevision: Effect.Effect<SecurityRevision, PersistenceMappingError>;\n        readonly encodeSubjectInsert: (\n          input: { readonly intent: OAuthRegistrationIntent; readonly registration: Registration },\n          ids: { readonly subjectId: N; readonly securityRevision: SecurityRevision },\n        ) => S[\"insert\"];\n      }\n  );\n\n/** Heterogeneous descriptors are made by typed factories and projected privately. */\nexport interface OAuthEligibilityDescriptor<\n  N,\n  Expression extends SqlExpression = SqlExpression,\n  Descriptor extends object = object,\n> {\n  readonly _tag: \"OAuthEligibilityDescriptor\";\n  readonly scope: string;\n  readonly table: Descriptor;\n  readonly subjectId: string;\n  readonly credentialId: string;\n  readonly revision: string;\n  readonly condition: (subjectId: N) => Expression;\n  readonly decode: (row: unknown) => OAuthEligibilityFact | undefined;\n}\n\nexport const oauthEligibilityTable = <\n  T extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n>(\n  input: OAuthEligibilityTable<T, N, Expression>,\n): OAuthEligibilityDescriptor<N, Expression, T[\"table\"]> => {\n  const { table, subjectId, credentialId, revision, scope, condition, decode } = input;\n\n  return Object.freeze({\n    _tag: \"OAuthEligibilityDescriptor\",\n    table,\n    subjectId,\n    credentialId,\n    revision,\n    scope,\n    condition,\n    // The query owner supplies rows selected from this descriptor's mapped table.\n    decode: (row: unknown) => decode(row as T[\"select\"]),\n  });\n};\n\nexport interface OAuthCleanupDescriptor<\n  N,\n  Expression extends SqlExpression = SqlExpression,\n  Descriptor extends object = object,\n> {\n  readonly table: Descriptor;\n  readonly subjectId: string;\n  readonly condition: OAuthCleanupTable<Table, N, Expression>[\"condition\"];\n}\n\nexport const oauthCleanupTable = <\n  T extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n>(\n  input: OAuthCleanupTable<T, N, Expression>,\n): OAuthCleanupDescriptor<N, Expression, T[\"table\"]> =>\n  Object.freeze({ table: input.table, subjectId: input.subjectId, condition: input.condition });\n\n/** A stable application/reference lock acquired before an ownership target.\n * Missing rows retain ownership. Conditions use detached native IDs; every\n * writer of the guarded reference follows the same order. */\nexport interface OAuthReferenceGuardTable<\n  T extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: T[\"table\"];\n  readonly orderBy: Column<T>;\n  readonly condition: (input: {\n    readonly identity: typeof OAuthExternalIdentity.Type;\n    readonly identityKey: string;\n    readonly subjectId: N;\n  }) => Expression | Effect.Effect<Expression, PlatformError.PlatformError, Crypto.Crypto>;\n}\n\nexport interface OAuthReferenceGuardDescriptor<\n  N,\n  Expression extends SqlExpression = SqlExpression,\n  Descriptor extends object = object,\n> {\n  readonly table: Descriptor;\n  readonly orderBy: string;\n  readonly condition: OAuthReferenceGuardTable<Table, N, Expression>[\"condition\"];\n}\n\nexport const oauthReferenceGuardTable = <\n  T extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n>(\n  input: OAuthReferenceGuardTable<T, N, Expression>,\n): OAuthReferenceGuardDescriptor<N, Expression, T[\"table\"]> =>\n  Object.freeze({\n    table: input.table,\n    orderBy: input.orderBy,\n    condition: input.condition,\n  });\n\nexport interface OAuthAccountsMapping<\n  S extends Table,\n  O extends Table,\n  C extends Table,\n  AC extends Table,\n  F extends Table,\n  T extends Table,\n  U extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n  Descriptor extends object = object,\n> {\n  readonly subject: OAuthSubjectTable<S, Expression>;\n  readonly ownership: OAuthOwnershipMutation<T, O, N, Expression>;\n  readonly credential: OAuthCredentialTable<C, N, Expression>;\n  readonly authority: OAuthAuthorityTable<AC, N, Expression>;\n  readonly flow: OAuthFlowTable<F>;\n  readonly command: OAuthUnlinkCommandTable<U>;\n  readonly subjectId: SubjectIdCodec<N>;\n  readonly clock: OAuthClock<Expression>;\n  readonly constraints: typeof requiredOAuthSignInConstraints &\n    typeof requiredOAuthAccountsConstraints;\n  readonly tupleConstraints: typeof requiredOAuthTupleConstraints;\n  readonly eligibility: ReadonlyArray<OAuthEligibilityDescriptor<N, Expression, Descriptor>>;\n  readonly cleanup: ReadonlyArray<OAuthCleanupDescriptor<N, Expression, Descriptor>>;\n  readonly metadata: OAuthMetadataPolicy<N, Expression>;\n  readonly sessionInvalidation: \"same-authority-immediate\" | \"original-absolute-expiry\";\n  /** Omit only when connected access is absent. A predicate alone conservatively\n   * retains ownership; release also needs all configured guard rows below. */\n  readonly connectedReference?: (input: {\n    readonly identityKey: string;\n    readonly subjectId: N;\n  }) => Expression;\n  /** At most 32 descriptors, each locking 1..64 stable rows in supplied order.\n   * Missing/empty guards retain Owned, even when the reference predicate is false. */\n  readonly connectedReferenceGuards?: ReadonlyArray<\n    OAuthReferenceGuardDescriptor<N, Expression, Descriptor>\n  >;\n  readonly allocateCredentialId: Effect.Effect<string, PersistenceMappingError>;\n  readonly allocateRevision: Effect.Effect<SecurityRevision, PersistenceMappingError>;\n}\n\nexport interface OAuthRegistrationAuthority<Registration> {\n  readonly read: (\n    access: OAuthRegistrationAccess,\n  ) => Effect.Effect<OAuthRegistrationInspection | undefined, OAuthUnavailable>;\n  readonly inspect: (input: {\n    readonly intent: OAuthRegistrationIntent;\n    readonly registration: Registration;\n  }) => Effect.Effect<\n    {\n      readonly fingerprint: TokenDigest;\n      readonly eligible: boolean;\n    },\n    OAuthUnavailable\n  >;\n  readonly register: <A>(\n    input: {\n      readonly access: OAuthRegistrationAccess;\n      readonly intent: OAuthRegistrationIntent;\n      readonly commandId: typeof OAuthCommandId.Type;\n      readonly registration: Registration;\n      readonly fingerprint: TokenDigest;\n    },\n    prepare: PrepareOAuthCommit<OAuthRegistrationDecision, A>,\n  ) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;\n  readonly cleanup: <A>(\n    input: OAuthCleanupInput,\n    prepare: PrepareOAuthCommit<{ readonly removed: number; readonly hasMore: boolean }, A>,\n  ) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;\n}\n"],"mappings":";AAoUA,MAAa,iCAAiC;CAC5C,MAAM;CACN,SAAS;CACT,aAAa;CACb,WAAW;CACX,cAAc;CACd,oBAAoB;CACpB,qBAAqB;AACvB;AAEA,MAAa,gCAAgC,EAAE,aAAa,4BAA4B;AAExF,MAAa,uCAAuC;CAClD,iBAAiB;CACjB,YAAY;CACZ,SAAS;AACX;AAEA,MAAa,mCAAmC,EAC9C,eAAe,yDACjB;AAoJA,MAAa,+BAMX,UAEA,OAAO,OAAO;CACZ,OAAO,MAAM;CACb,SAAS,MAAM;CACf,WAAW,MAAM;AACnB,CAAC;AAoDH,MAAa,yBAKX,UAC0D;CAC1D,MAAM,EAAE,OAAO,WAAW,cAAc,UAAU,OAAO,WAAW,WAAW;CAE/E,OAAO,OAAO,OAAO;EACnB,MAAM;EACN;EACA;EACA;EACA;EACA;EACA;EAEA,SAAS,QAAiB,OAAO,GAAkB;CACrD,CAAC;AACH;AAYA,MAAa,qBAKX,UAEA,OAAO,OAAO;CAAE,OAAO,MAAM;CAAO,WAAW,MAAM;CAAW,WAAW,MAAM;AAAU,CAAC;AA6B9F,MAAa,4BAKX,UAEA,OAAO,OAAO;CACZ,OAAO,MAAM;CACb,SAAS,MAAM;CACf,WAAW,MAAM;AACnB,CAAC"}
+{"version":3,"file":"oauth-model.mjs","names":[],"sources":["../../../src/internal/models/oauth-model.ts"],"sourcesContent":["import type { PreparedCommit } from \"@yielded/auth/Hooks\";\nimport type {\n  OAuthActionAuthorization,\n  OAuthAccountRevision,\n  OAuthRegistrationIntent,\n  OAuthExternalIdentity,\n  OAuthRegistrationAccess,\n  OAuthRegistrationInspection,\n  OAuthUnavailable,\n  OAuthCommandId,\n  PrepareOAuthCommit,\n  OAuthRegistrationDecision,\n  OAuthCleanupInput,\n} from \"@yielded/auth/OAuth\";\nimport { AuthenticationFactor } from \"@yielded/auth/Operations\";\nimport type { CleanupResult } from \"@yielded/auth/Persistence\";\nimport type { TokenDigest } from \"@yielded/auth/Schema\";\nimport { type AuthenticationRequirement, SecurityRevision } from \"@yielded/auth/Sessions\";\nimport { type Effect, Schema } from \"effect\";\n\nimport type { TableModel as Table, SqlExpression } from \"../table-model\";\nimport type { PersistenceMappingError, SubjectIdCodec } from \"./common\";\n\ntype Column<T extends Table> = T[\"column\"];\nexport type OAuthAction = OAuthActionAuthorization[\"challenge\"][\"action\"];\n\nexport interface OAuthClock<Expression extends SqlExpression = SqlExpression> {\n  readonly encodeInstant: (millis: number) => unknown;\n  readonly decodeInstant: (value: unknown) => number;\n  /** Actual engine wall clock sampled after locks, not transaction-start time.\n   * PostgreSQL uses clock_timestamp(), never now()/CURRENT_TIMESTAMP. D1 repeats\n   * its primary-engine sample bounds in final guards. Return integer milliseconds. */\n  readonly engineNowMillis: Expression;\n  /** Convert a stored timestamp expression to integer milliseconds. */\n  readonly toMillis: (expression: Expression) => Expression;\n  readonly fromMillis: (expression: Expression) => Expression;\n}\n\nexport interface OAuthSubjectReadTable<\n  S extends Table,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: S[\"table\"];\n  readonly id: Column<S>;\n  readonly status: Column<S>;\n  readonly securityRevision: Column<S>;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly activeCondition: Expression;\n  readonly decodeAuthenticationRequirement: (row: S[\"select\"]) => AuthenticationRequirement;\n}\n\nexport interface OAuthSubjectTable<\n  S extends Table,\n  Expression extends SqlExpression = SqlExpression,\n> extends OAuthSubjectReadTable<S, Expression> {\n  readonly nextSecurityRevision: (current: SecurityRevision) => SecurityRevision;\n}\n\nexport interface OAuthOwnershipReadTable<O extends Table, N> {\n  readonly table: O[\"table\"];\n  readonly identityKey: Column<O>;\n  readonly provider: Column<O>;\n  readonly issuer: Column<O>;\n  readonly externalSubject: Column<O>;\n  readonly subjectId: Column<O>;\n  readonly decodeSubjectId: (row: O[\"select\"]) => N;\n}\n\nexport interface OAuthOwnershipTable<O extends Table, N> extends OAuthOwnershipReadTable<O, N> {\n  readonly encodeInsert: (input: {\n    readonly identity: typeof OAuthExternalIdentity.Type;\n    readonly identityKey: string;\n    readonly subjectId: N;\n  }) => O[\"insert\"];\n}\n\nexport interface OAuthCredentialReadTable<\n  C extends Table,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: C[\"table\"];\n  readonly moduleId: Column<C>;\n  readonly credentialId: Column<C>;\n  readonly subjectId: Column<C>;\n  readonly identityKey: Column<C>;\n  readonly credentialRevision: Column<C>;\n  readonly status: Column<C>;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly activeCondition: Expression;\n}\n\nexport interface OAuthCredentialTable<\n  C extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> extends OAuthCredentialReadTable<C, Expression> {\n  readonly encodeInsert: (input: {\n    readonly moduleId: string;\n    readonly subjectId: N;\n    readonly identityKey: string;\n    readonly credentialId: string;\n    readonly credentialRevision: SecurityRevision;\n  }) => C[\"insert\"];\n  /** This slice removes login rows. Historical records belong in separate audit storage. */\n  readonly removal: \"delete\";\n}\n\nexport interface OAuthAuthorityReadTable<\n  C extends Table,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: C[\"table\"];\n  readonly subjectId: Column<C>;\n  readonly credentialId: Column<C>;\n  readonly revision: Column<C>;\n  readonly status: Column<C>;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly activeCondition: Expression;\n}\n\nexport interface OAuthAuthorityTable<\n  C extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> extends OAuthAuthorityReadTable<C, Expression> {\n  readonly encodeInsert: (input: {\n    readonly subjectId: N;\n    readonly credentialId: string;\n    readonly revision: SecurityRevision;\n  }) => C[\"insert\"];\n}\n\n/** Live ceremonies only. Predicate columns enforce access before deletion; the\n * snapshot retains the exact authenticated context and encrypted protocol data. */\nexport interface OAuthFlowTable<F extends Table> {\n  readonly table: F[\"table\"];\n  readonly moduleId: Column<F>;\n  readonly flowId: Column<F>;\n  readonly purpose: Column<F>;\n  readonly generation: Column<F>;\n  readonly provider: Column<F>;\n  readonly callbackId: Column<F>;\n  readonly issuer: Column<F>;\n  readonly responseIssuerMode: Column<F>;\n  readonly subjectId: Column<F>;\n  readonly stateDigest: Column<F>;\n  readonly binderVerifier: Column<F>;\n  readonly binderExpiresAt: Column<F>;\n  readonly snapshot: Column<F>;\n  readonly issuedAt: Column<F>;\n  readonly expiresAt: Column<F>;\n  readonly encodeInsert: (input: {\n    readonly moduleId: string;\n    readonly flowId: string;\n    readonly purpose: \"sign-in\" | \"link\" | \"connect\";\n  }) => F[\"insert\"];\n}\n\nexport const OAuthEligibilityFact = Schema.Struct({\n  credentialId: Schema.NonEmptyString.check(Schema.isMaxLength(256)),\n  revision: SecurityRevision,\n  usablePrimary: Schema.Boolean,\n  factors: Schema.Array(AuthenticationFactor).check(Schema.isMaxLength(8)),\n  userVerified: Schema.Boolean,\n  phishingResistant: Schema.Boolean,\n});\n\nexport type OAuthEligibilityFact = typeof OAuthEligibilityFact.Type;\n\n/** Each descriptor reads only its own subject-scoped method rows. The native row\n * projector and SQL condition must express the same installed method eligibility.\n * All source/identifier/policy mutations advance subject securityRevision. D1 also\n * guards exact selected IDs/versions and absence/count assumptions, never just a\n * stale boolean. An over-limit graph fails closed rather than truncating. */\nexport interface OAuthEligibilityTable<\n  T extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: T[\"table\"];\n  readonly subjectId: Column<T>;\n  readonly credentialId: Column<T>;\n  readonly revision: Column<T>;\n  readonly scope: string;\n  readonly condition: (subjectId: N) => Expression;\n  readonly decode: (row: T[\"select\"]) => OAuthEligibilityFact | undefined;\n}\n\nexport interface OAuthCleanupTable<\n  T extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: T[\"table\"];\n  readonly subjectId: Column<T>;\n  /** Bound to this subject's old revision; no opaque independently committing service. */\n  readonly condition: (input: {\n    readonly subjectId: N;\n    readonly revision: OAuthAccountRevision;\n    readonly removedCredentialId?: string;\n  }) => Expression;\n  readonly disposition: \"delete\";\n}\n\nexport interface OAuthRegistrationGuardTable<\n  T extends Table,\n  Registration,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: T[\"table\"];\n  readonly orderBy: Column<T>;\n  readonly condition: (input: {\n    readonly intent: OAuthRegistrationIntent;\n    readonly registration: Registration;\n    readonly nativeSubjectId?: N;\n  }) => Expression;\n}\n\nexport interface OAuthRegistrationGuardDescriptor<\n  Registration,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n  Descriptor extends object = object,\n> {\n  readonly table: Descriptor;\n  readonly orderBy: string;\n  readonly condition: OAuthRegistrationGuardTable<Table, Registration, N, Expression>[\"condition\"];\n}\n\nexport const oauthRegistrationGuardTable = <\n  T extends Table,\n  Registration,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n>(\n  input: OAuthRegistrationGuardTable<T, Registration, N, Expression>,\n): OAuthRegistrationGuardDescriptor<Registration, N, Expression, T[\"table\"]> =>\n  Object.freeze({\n    table: input.table,\n    orderBy: input.orderBy,\n    condition: input.condition,\n  });\n\n/** Heterogeneous descriptors are made by typed factories and projected privately. */\nexport interface OAuthEligibilityDescriptor<\n  N,\n  Expression extends SqlExpression = SqlExpression,\n  Descriptor extends object = object,\n> {\n  readonly _tag: \"OAuthEligibilityDescriptor\";\n  readonly scope: string;\n  readonly table: Descriptor;\n  readonly subjectId: string;\n  readonly credentialId: string;\n  readonly revision: string;\n  readonly condition: (subjectId: N) => Expression;\n  readonly decode: (row: unknown) => OAuthEligibilityFact | undefined;\n}\n\nexport const oauthEligibilityTable = <\n  T extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n>(\n  input: OAuthEligibilityTable<T, N, Expression>,\n): OAuthEligibilityDescriptor<N, Expression, T[\"table\"]> => {\n  const { table, subjectId, credentialId, revision, scope, condition, decode } = input;\n\n  return Object.freeze({\n    _tag: \"OAuthEligibilityDescriptor\",\n    table,\n    subjectId,\n    credentialId,\n    revision,\n    scope,\n    condition,\n    // The query owner supplies rows selected from this descriptor's mapped table.\n    decode: (row: unknown) => decode(row as T[\"select\"]),\n  });\n};\n\nexport interface OAuthCleanupDescriptor<\n  N,\n  Expression extends SqlExpression = SqlExpression,\n  Descriptor extends object = object,\n> {\n  readonly table: Descriptor;\n  readonly subjectId: string;\n  readonly condition: OAuthCleanupTable<Table, N, Expression>[\"condition\"];\n}\n\nexport const oauthCleanupTable = <\n  T extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n>(\n  input: OAuthCleanupTable<T, N, Expression>,\n): OAuthCleanupDescriptor<N, Expression, T[\"table\"]> =>\n  Object.freeze({ table: input.table, subjectId: input.subjectId, condition: input.condition });\n\n/** Original application binding and retained decision are encoded in snapshot. */\nexport interface OAuthRegistrationIntentTable<I extends Table> {\n  readonly table: I[\"table\"];\n  readonly moduleId: Column<I>;\n  readonly reference: Column<I>;\n  readonly flowId: Column<I>;\n  readonly identityKey: Column<I>;\n  readonly snapshot: Column<I>;\n  readonly expiresAt: Column<I>;\n  readonly retentionUntil: Column<I>;\n  readonly encodeInsert: (intent: OAuthRegistrationIntent) => I[\"insert\"];\n}\n\nexport interface OAuthD1Mapping {\n  readonly d1: { readonly primary: true };\n}\n\nexport const requiredOAuthSignInConstraints = {\n  flow: \"unique(flow.moduleId,flow.flowId)\",\n  stateDigest: \"unique(flow.stateDigest)\",\n  ownership: \"unique(ownership.identityKey)\",\n  credentialId: \"unique(credential.credentialId)\",\n  credentialIdentity: \"unique(credential.identityKey)\",\n  authorityCredential: \"unique(authority.subjectId,authority.credentialId)\",\n} as const;\n\nexport const requiredOAuthRegistrationConstraints = {\n  intentReference: \"unique(intent.moduleId,intent.reference)\",\n  intentFlow: \"unique(intent.moduleId,intent.flowId)\",\n  ownership: \"unique(ownership.identityKey)\",\n  credentialId: \"unique(credential.credentialId)\",\n  credentialIdentity: \"unique(credential.identityKey)\",\n  authorityCredential: \"unique(authority.subjectId,authority.credentialId)\",\n} as const;\n\nexport interface OAuthSignInMapping<\n  S extends Table,\n  O extends Table,\n  C extends Table,\n  AC extends Table,\n  F extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly subject: OAuthSubjectReadTable<S, Expression>;\n  readonly ownership: OAuthOwnershipReadTable<O, N>;\n  readonly credential: OAuthCredentialReadTable<C, Expression>;\n  readonly authority: OAuthAuthorityReadTable<AC, Expression>;\n  readonly flow: OAuthFlowTable<F>;\n  readonly subjectId: SubjectIdCodec<N>;\n  readonly clock: OAuthClock<Expression>;\n  readonly constraints: typeof requiredOAuthSignInConstraints;\n}\n\nexport interface OAuthRegistrationIntentMapping<\n  O extends Table,\n  I extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly ownership: OAuthOwnershipReadTable<O, N>;\n  readonly intent: OAuthRegistrationIntentTable<I>;\n  readonly clock: OAuthClock<Expression>;\n  readonly constraints: Pick<\n    typeof requiredOAuthRegistrationConstraints,\n    \"intentReference\" | \"intentFlow\" | \"ownership\"\n  >;\n  readonly eligible: (intent: OAuthRegistrationIntent) => Expression;\n}\n\nexport interface OAuthRegistrationMapping<\n  Registration,\n  S extends Table,\n  O extends Table,\n  C extends Table,\n  AC extends Table,\n  I extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n  Descriptor extends object = object,\n> {\n  readonly registration: Schema.Codec<Registration, unknown, never, never>;\n  readonly ownership: OAuthOwnershipTable<O, N>;\n  readonly intent: OAuthRegistrationIntentTable<I>;\n  readonly subject: OAuthSubjectReadTable<S, Expression>;\n  readonly credential: OAuthCredentialTable<C, N, Expression>;\n  readonly authority: OAuthAuthorityTable<AC, N, Expression>;\n  readonly subjectId: SubjectIdCodec<N>;\n  readonly clock: OAuthClock<Expression>;\n  readonly constraints: typeof requiredOAuthRegistrationConstraints;\n  readonly inspect: (input: {\n    readonly intent: OAuthRegistrationIntent;\n    readonly registration: Registration;\n  }) => Effect.Effect<\n    { readonly fingerprint: string; readonly eligible: boolean },\n    PersistenceMappingError\n  >;\n  readonly eligibility: {\n    readonly guards?: ReadonlyArray<\n      OAuthRegistrationGuardDescriptor<Registration, N, Expression, Descriptor>\n    >;\n    readonly admission: (input: {\n      readonly intent: OAuthRegistrationIntent;\n      readonly registration: Registration;\n      readonly nativeSubjectId?: N;\n    }) => Expression;\n    readonly postcondition: (input: {\n      readonly intent: OAuthRegistrationIntent;\n      readonly registration: Registration;\n      readonly nativeSubjectId?: N;\n    }) => Expression;\n  };\n  readonly allocateSubjectId: Effect.Effect<N, PersistenceMappingError>;\n  readonly allocateCredentialId: Effect.Effect<string, PersistenceMappingError>;\n  readonly allocateRevision: Effect.Effect<SecurityRevision, PersistenceMappingError>;\n  readonly encodeSubjectInsert: (\n    input: {\n      readonly intent: OAuthRegistrationIntent;\n      readonly registration: Registration;\n      readonly requestId: string;\n    },\n    ids: { readonly subjectId: N; readonly securityRevision: SecurityRevision },\n  ) => S[\"insert\"];\n}\n\nexport interface OAuthAccountsMapping<\n  S extends Table,\n  O extends Table,\n  C extends Table,\n  AC extends Table,\n  F extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n  Descriptor extends object = object,\n> {\n  readonly subject: OAuthSubjectTable<S, Expression>;\n  readonly ownership: OAuthOwnershipTable<O, N>;\n  readonly credential: OAuthCredentialTable<C, N, Expression>;\n  readonly authority: OAuthAuthorityTable<AC, N, Expression>;\n  readonly flow: OAuthFlowTable<F>;\n  readonly subjectId: SubjectIdCodec<N>;\n  readonly clock: OAuthClock<Expression>;\n  readonly constraints: typeof requiredOAuthSignInConstraints;\n  readonly eligibility: ReadonlyArray<OAuthEligibilityDescriptor<N, Expression, Descriptor>>;\n  readonly cleanup: ReadonlyArray<OAuthCleanupDescriptor<N, Expression, Descriptor>>;\n  readonly sessionInvalidation: \"same-authority-immediate\" | \"original-absolute-expiry\";\n  /** Indexed same-owner reference predicate for any installed grant/application references. */\n  readonly otherReferences: (input: {\n    readonly identityKey: string;\n    readonly subjectId: N;\n  }) => Expression;\n  readonly allocateCredentialId: Effect.Effect<string, PersistenceMappingError>;\n  readonly allocateRevision: Effect.Effect<SecurityRevision, PersistenceMappingError>;\n}\n\nexport interface OAuthRegistrationAuthority<Registration> {\n  readonly read: (\n    access: OAuthRegistrationAccess,\n  ) => Effect.Effect<OAuthRegistrationInspection | undefined, OAuthUnavailable>;\n  readonly inspect: (input: {\n    readonly intent: OAuthRegistrationIntent;\n    readonly registration: Registration;\n  }) => Effect.Effect<\n    {\n      readonly fingerprint: TokenDigest;\n      readonly eligible: boolean;\n    },\n    OAuthUnavailable\n  >;\n  readonly register: <A>(\n    input: {\n      readonly access: OAuthRegistrationAccess;\n      readonly intent: OAuthRegistrationIntent;\n      readonly commandId: typeof OAuthCommandId.Type;\n      readonly registration: Registration;\n      readonly fingerprint: TokenDigest;\n      readonly payload: string;\n      readonly requestId: string;\n    },\n    prepare: PrepareOAuthCommit<OAuthRegistrationDecision, A>,\n  ) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;\n  readonly cleanup: <A>(\n    input: OAuthCleanupInput,\n    prepare: PrepareOAuthCommit<CleanupResult, A>,\n  ) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;\n}\n"],"mappings":";;;;AA8JA,MAAa,uBAAuB,OAAO,OAAO;CAChD,cAAc,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC;CACjE,UAAU;CACV,eAAe,OAAO;CACtB,SAAS,OAAO,MAAM,oBAAoB,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,CAAC;CACvE,cAAc,OAAO;CACrB,mBAAmB,OAAO;AAC5B,CAAC;AAiED,MAAa,+BAMX,UAEA,OAAO,OAAO;CACZ,OAAO,MAAM;CACb,SAAS,MAAM;CACf,WAAW,MAAM;AACnB,CAAC;AAkBH,MAAa,yBAKX,UAC0D;CAC1D,MAAM,EAAE,OAAO,WAAW,cAAc,UAAU,OAAO,WAAW,WAAW;CAE/E,OAAO,OAAO,OAAO;EACnB,MAAM;EACN;EACA;EACA;EACA;EACA;EACA;EAEA,SAAS,QAAiB,OAAO,GAAkB;CACrD,CAAC;AACH;AAYA,MAAa,qBAKX,UAEA,OAAO,OAAO;CAAE,OAAO,MAAM;CAAO,WAAW,MAAM;CAAW,WAAW,MAAM;AAAU,CAAC;AAmB9F,MAAa,iCAAiC;CAC5C,MAAM;CACN,aAAa;CACb,WAAW;CACX,cAAc;CACd,oBAAoB;CACpB,qBAAqB;AACvB;AAEA,MAAa,uCAAuC;CAClD,iBAAiB;CACjB,YAAY;CACZ,WAAW;CACX,cAAc;CACd,oBAAoB;CACpB,qBAAqB;AACvB"}

package/dist/internal/models/passkey-model.d.mts

@@ -1,8 +1,9 @@
+import { SqlExpression, TableModel } from "../table-model.mjs";
 import { PersistenceMappingError } from "../mapping-error.mjs";
-import { SqlExpression, TableModel } from "../query-operations.mjs";
 import "./common.mjs";
 import { Effect, Layer } from "effect";
-import { PasskeyCeremony, PasskeyCredential, PasskeyCredentials, PasskeyEnrollmentContext, PasskeyMethodPolicy, PasskeyPersistence } from "@yielded/auth/Passkey";
+import { PasskeyCeremony, PasskeyCredential, PasskeyCredentials, PasskeyPersistence } from "@yielded/auth/Passkey";
+import { AuthenticationRequirement } from "@yielded/auth/Sessions";
 import { SubjectId } from "@yielded/auth/Schema";
 //#region src/internal/models/passkey-model.d.ts
 export type PasskeyColumn<T extends TableModel> = T["column"];
@@ -13,12 +14,8 @@ export interface PasskeyCredentialServices {
 export interface PasskeyPersistenceServices {
   readonly passkeyPersistence: PasskeyPersistence["Service"];
 }
-export interface PasskeyEnrollmentContextServices {
-  readonly passkeyEnrollmentContext: PasskeyEnrollmentContext["Service"];
-}
 export declare const passkeyCredentialsLayer: <E, R>(services: Effect.Effect<PasskeyCredentialServices, E, R>) => Layer.Layer<PasskeyCredentials, E, R>;
 export declare const passkeyPersistenceLayer: <E, R>(services: Effect.Effect<PasskeyPersistenceServices, E, R>) => Layer.Layer<PasskeyPersistence, E, R>;
-export declare const passkeyEnrollmentContextLayer: <E, R>(services: Effect.Effect<PasskeyEnrollmentContextServices, E, R>) => Layer.Layer<PasskeyEnrollmentContext, E, R>;
 /** Native IDs roundtrip exactly; protocol IDs and authentication references are
  * different identities. These callbacks never suspend inside an owner. */
 export interface PasskeySubjectIdCodec<N> {
@@ -38,6 +35,7 @@ export interface PasskeySubjectReadTable<T extends TableModel, N, Expression ext
   readonly id: PasskeyColumn<T>;
   readonly status: PasskeyColumn<T>;
   readonly securityRevision: PasskeyColumn<T>;
+  readonly decodeRequirement: (row: T["select"]) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;
   readonly decodeId: (row: Readonly<Partial<T["select"]>>) => N;
   readonly isActiveStatus: (value: unknown) => boolean;
   readonly activeCondition: Expression;
@@ -60,7 +58,6 @@ export interface PasskeyCredentialReadTable<T extends TableModel, N, Expression
   readonly rpId: PasskeyColumn<T>;
   readonly protocolCredentialId: PasskeyColumn<T>;
   readonly credentialKey: PasskeyColumn<T>;
-  readonly handleKey: PasskeyColumn<T>;
   readonly userHandle: PasskeyColumn<T>;
   readonly publicKey: PasskeyColumn<T>;
   readonly algorithm: PasskeyColumn<T>;
@@ -72,191 +69,58 @@ export interface PasskeyCredentialReadTable<T extends TableModel, N, Expression
   readonly backupEligible: PasskeyColumn<T>;
   readonly backupState: PasskeyColumn<T>;
   readonly counter: PasskeyColumn<T>;
-  readonly maximumCounter: PasskeyColumn<T>;
-  readonly decode: (row: Readonly<Partial<T["select"]>>) => Omit<PasskeyCredential, "revision" | "active">;
+  readonly decode: (row: Readonly<Partial<T["select"]>>) => Omit<PasskeyCredential, "revision" | "active" | "requirement">;
   readonly decodeSubjectId: (row: Readonly<Partial<T["select"]>>) => N;
   readonly isActiveStatus: (value: unknown) => boolean;
   readonly activeCondition: Expression;
 }
-export interface PasskeyCredentialOwnershipTable<T extends TableModel, N, Expression extends SqlExpression = SqlExpression> {
-  readonly table: T["table"];
-  readonly credentialKey: PasskeyColumn<T>;
-  readonly rpId: PasskeyColumn<T>;
-  readonly protocolCredentialId: PasskeyColumn<T>;
-  readonly subjectId: PasskeyColumn<T>;
-  readonly credentialId: PasskeyColumn<T>;
-  readonly state: PasskeyColumn<T>;
-  readonly version: PasskeyColumn<T>;
-  readonly reservationId: PasskeyColumn<T>;
-  readonly ownedCondition: Expression;
-  readonly isOwnedState: (value: unknown) => boolean;
-  readonly decodeSubjectId: (row: Readonly<Partial<T["select"]>>) => N;
-}
-/** Reservations do not manufacture a subject; bound handles are RP-global. */
-export interface PasskeyHandleReadTable<T extends TableModel> {
-  readonly table: T["table"];
-  readonly handleKey: PasskeyColumn<T>;
-  readonly rpId: PasskeyColumn<T>;
-  readonly userHandle: PasskeyColumn<T>;
-  readonly state: PasskeyColumn<T>;
-  readonly version: PasskeyColumn<T>;
-  readonly reservationId: PasskeyColumn<T>;
-}
-export interface PasskeyHandleReservationTable<T extends TableModel, Expression extends SqlExpression = SqlExpression> extends PasskeyHandleReadTable<T> {
-  readonly reservedCondition: Expression;
-  readonly isReservedState: (value: unknown) => boolean;
-}
-export interface PasskeyHandleOwnershipTable<T extends TableModel, N, Expression extends SqlExpression = SqlExpression> extends PasskeyHandleReadTable<T> {
-  readonly subjectId: PasskeyColumn<T>;
-  readonly ownedCondition: Expression;
-  readonly isOwnedState: (value: unknown) => boolean;
-  readonly decodeSubjectId: (row: Readonly<Partial<T["select"]>>) => N;
-}
 export declare const requiredPasskeyCredentialConstraints: {
   readonly credentialId: readonly ["credentialId"];
+  readonly credentialKey: readonly ["credentialKey"];
   readonly factor: readonly ["subjectId", "credentialId"];
-  readonly credentialOwnership: readonly ["credentialKey"];
-  readonly handleOwnership: readonly ["handleKey"];
-  readonly boundSubjectHandle: readonly ["rpId", "subjectId"];
 };
-export interface PasskeyCredentialMapping<S extends TableModel, C extends TableModel, F extends TableModel, Ownership extends TableModel, Handle extends TableModel, N, Expression extends SqlExpression = SqlExpression> {
+export interface PasskeyCredentialMapping<S extends TableModel, C extends TableModel, F extends TableModel, N, Expression extends SqlExpression = SqlExpression> {
   readonly subject: PasskeySubjectReadTable<S, N, Expression>;
   readonly credential: PasskeyCredentialReadTable<C, N, Expression>;
   readonly authority: PasskeyFactorReadTable<F, Expression>;
-  readonly credentialOwnership: PasskeyCredentialOwnershipTable<Ownership, N, Expression>;
-  readonly handleOwnership: PasskeyHandleOwnershipTable<Handle, N, Expression>;
   readonly subjectIds: PasskeySubjectIdCodec<N>;
   readonly constraints: typeof requiredPasskeyCredentialConstraints;
 }
-/** A stable additional policy row, acquired before RP/credential locks. The
- * factory checks column names without erasing the consumer table at its input. */
-declare const PasskeyPolicyGuardTypeId: unique symbol;
-export interface PasskeyPolicyGuard<Expression extends SqlExpression = SqlExpression> {
-  readonly [PasskeyPolicyGuardTypeId]: true;
-  readonly scope: string;
-  readonly table: object;
-  readonly columns: ReadonlyArray<string>;
-  readonly where: (moduleId: string) => Expression;
-  readonly condition: (moduleId: string) => Expression;
-}
-export declare const passkeyPolicyGuard: <T extends TableModel, Expression extends SqlExpression = SqlExpression>(input: {
-  readonly scope: string;
-  readonly table: T["table"];
-  readonly columns: ReadonlyArray<PasskeyColumn<T>>;
-  readonly where: (moduleId: string) => Expression;
-  readonly condition: (moduleId: string) => Expression;
-}) => PasskeyPolicyGuard<Expression>;
-export interface PasskeyModuleTable<T extends TableModel, Expression extends SqlExpression = SqlExpression> {
-  readonly table: T["table"];
-  readonly moduleId: PasskeyColumn<T>;
-  readonly status: PasskeyColumn<T>;
-  readonly policyRevision: PasskeyColumn<T>;
-  /** All physical fields used by decodeMethodPolicy, including policyRevision. */
-  readonly policyColumns: ReadonlyArray<PasskeyColumn<T>>;
-  readonly isActiveStatus: (value: unknown) => boolean;
-  readonly activeCondition: Expression;
-  readonly decodeMethodPolicy: (row: Readonly<Partial<T["select"]>>) => PasskeyMethodPolicy;
-  readonly guards?: ReadonlyArray<PasskeyPolicyGuard<Expression>>;
-}
-export type PasskeyFlowState = "Pending" | "Claimed" | "Verified" | "Rejected" | "Ambiguous" | "RegistrationAccepted" | "ProvisioningPending";
 export interface PasskeyFlowInsert {
   readonly ceremony: PasskeyCeremony;
-  readonly policy: PasskeyMethodPolicy;
-  readonly marker: string;
 }
+/** An immutable, single-use challenge. Consuming or expiring it deletes the row. */
 export interface PasskeyFlowTable<T extends TableModel> {
   readonly table: T["table"];
   readonly moduleId: PasskeyColumn<T>;
   readonly flowId: PasskeyColumn<T>;
-  readonly commandId: PasskeyColumn<T>;
   readonly purpose: PasskeyColumn<T>;
-  readonly state: PasskeyColumn<T>;
-  readonly version: PasskeyColumn<T>;
-  readonly generation: PasskeyColumn<T>;
   readonly snapshot: PasskeyColumn<T>;
-  readonly policySnapshot: PasskeyColumn<T>;
   readonly requestBindingVerifier: PasskeyColumn<T>;
   readonly requestBindingExpiresAt: PasskeyColumn<T>;
   readonly issuedAt: PasskeyColumn<T>;
   readonly expiresAt: PasskeyColumn<T>;
-  readonly retentionUntil: PasskeyColumn<T>;
-  readonly claimId: PasskeyColumn<T>;
-  readonly claimedAt: PasskeyColumn<T>;
-  readonly claimExpiresAt: PasskeyColumn<T>;
-  readonly credentialSnapshot: PasskeyColumn<T>;
-  /** Core SubjectId scope text, not a consumer's native subject ID. */
-  readonly subjectScope: PasskeyColumn<T>;
-  readonly targetScope: PasskeyColumn<T>;
-  readonly states: Readonly<Record<PasskeyFlowState, unknown>>;
   readonly encodeInsert: (input: PasskeyFlowInsert) => T["insert"];
 }
-export interface PasskeyAdmissionTable<T extends TableModel> {
-  readonly table: T["table"];
-  readonly authorityScope: PasskeyColumn<T>;
-  readonly moduleId: PasskeyColumn<T>;
-  readonly version: PasskeyColumn<T>;
-  readonly ownerMarker: PasskeyColumn<T>;
-  /** One physical clock sample, reused by every charge of this decision. */
-  readonly admittedAt: PasskeyColumn<T>;
-}
-export type PasskeyChargeKind = "global" | "subject" | "target";
-export interface PasskeyChargeInsert {
-  readonly moduleId: string;
-  readonly flowId: string;
-  readonly purpose: PasskeyCeremony["purpose"];
-  readonly kind: PasskeyChargeKind;
-  readonly scope: string;
-  readonly originalWindowMillis: number;
-  readonly marker: string;
-}
-/** Charge scope is canonical core identity text; this subject-free descriptor
- * can count all purposes without decoding any unrelated native subject. */
-export interface PasskeyChargeTable<T extends TableModel> {
-  readonly table: T["table"];
-  readonly moduleId: PasskeyColumn<T>;
-  readonly flowId: PasskeyColumn<T>;
-  readonly purpose: PasskeyColumn<T>;
-  readonly kind: PasskeyColumn<T>;
-  readonly scope: PasskeyColumn<T>;
-  readonly originalWindowMillis: PasskeyColumn<T>;
-  readonly admittedAt: PasskeyColumn<T>;
-  readonly retainUntil: PasskeyColumn<T>;
-  readonly version: PasskeyColumn<T>;
-  readonly ownerMarker: PasskeyColumn<T>;
-  readonly encodeInsert: (input: PasskeyChargeInsert) => T["insert"];
-}
 export declare const requiredPasskeyPersistenceConstraints: {
   readonly flow: readonly ["moduleId", "flowId"];
-  readonly command: readonly ["moduleId", "commandId"];
-  readonly admission: readonly ["authorityScope", "moduleId"];
-  readonly charge: readonly ["moduleId", "flowId", "kind"];
 };
-export interface PasskeyCeremonyMapping<Module extends TableModel, Flow extends TableModel, Admission extends TableModel, Charge extends TableModel, Expression extends SqlExpression = SqlExpression> {
+export interface PasskeyCeremonyMapping<Flow extends TableModel, Expression extends SqlExpression = SqlExpression> {
   readonly moduleId: string;
-  readonly authorityScope: string;
-  readonly module: PasskeyModuleTable<Module, Expression>;
   readonly flow: PasskeyFlowTable<Flow>;
-  readonly admission: PasskeyAdmissionTable<Admission>;
-  readonly charge: PasskeyChargeTable<Charge>;
   readonly clock: PasskeyClock<Expression>;
   readonly constraints: typeof requiredPasskeyPersistenceConstraints;
 }
-export interface PasskeyPersistenceMapping<Read, Module extends TableModel, Flow extends TableModel, Admission extends TableModel, Charge extends TableModel, N, Expression extends SqlExpression = SqlExpression, Credential extends TableModel = TableModel> extends PasskeyCeremonyMapping<Module, Flow, Admission, Charge, Expression> {
+export interface PasskeyPersistenceMapping<Read, Flow extends TableModel, N, Expression extends SqlExpression = SqlExpression, Credential extends TableModel = TableModel> extends PasskeyCeremonyMapping<Flow, Expression> {
   readonly read: Read & {
     readonly subjectIds: PasskeySubjectIdCodec<N>;
   };
   readonly telemetry: {
     readonly lastUsedAt: PasskeyColumn<Credential>;
+    readonly encodeBackupEligible: (value: boolean) => unknown;
     readonly encodeBackupState: (value: boolean) => unknown;
   };
 }
-export interface PasskeyEnrollmentContextMapping<Read, Module extends TableModel, N, Expression extends SqlExpression = SqlExpression> {
-  readonly moduleId: string;
-  readonly read: Read & {
-    readonly subjectIds: PasskeySubjectIdCodec<N>;
-  };
-  readonly module: PasskeyModuleTable<Module, Expression>;
-}
 export interface D1PasskeyMapping {
   readonly d1: {
     readonly primary: true;

package/dist/internal/models/passkey-model.mjs

@@ -1,34 +1,15 @@
 import { Effect, Layer } from "effect";
-import { PasskeyCredentials, PasskeyEnrollmentContext, PasskeyPersistence } from "@yielded/auth/Passkey";
+import { PasskeyCredentials, PasskeyPersistence } from "@yielded/auth/Passkey";
 //#region src/internal/models/passkey-model.ts
 const passkeyCredentialsLayer = (services) => Layer.effect(PasskeyCredentials, Effect.map(services, (value) => value.passkeyCredentials));
 const passkeyPersistenceLayer = (services) => Layer.effect(PasskeyPersistence, Effect.map(services, (value) => value.passkeyPersistence));
-const passkeyEnrollmentContextLayer = (services) => Layer.effect(PasskeyEnrollmentContext, Effect.map(services, (value) => value.passkeyEnrollmentContext));
 const requiredPasskeyCredentialConstraints = {
 	credentialId: ["credentialId"],
-	factor: ["subjectId", "credentialId"],
-	credentialOwnership: ["credentialKey"],
-	handleOwnership: ["handleKey"],
-	boundSubjectHandle: ["rpId", "subjectId"]
-};
-/** A stable additional policy row, acquired before RP/credential locks. The
-* factory checks column names without erasing the consumer table at its input. */
-const PasskeyPolicyGuardTypeId = Symbol("effect-auth/drizzle/PasskeyPolicyGuard");
-const passkeyPolicyGuard = (input) => ({
-	...input,
-	[PasskeyPolicyGuardTypeId]: true
-});
-const requiredPasskeyPersistenceConstraints = {
-	flow: ["moduleId", "flowId"],
-	command: ["moduleId", "commandId"],
-	admission: ["authorityScope", "moduleId"],
-	charge: [
-		"moduleId",
-		"flowId",
-		"kind"
-	]
+	credentialKey: ["credentialKey"],
+	factor: ["subjectId", "credentialId"]
 };
+const requiredPasskeyPersistenceConstraints = { flow: ["moduleId", "flowId"] };
 //#endregion
-export { passkeyCredentialsLayer, passkeyEnrollmentContextLayer, passkeyPersistenceLayer, passkeyPolicyGuard, requiredPasskeyCredentialConstraints, requiredPasskeyPersistenceConstraints };
+export { passkeyCredentialsLayer, passkeyPersistenceLayer, requiredPasskeyCredentialConstraints, requiredPasskeyPersistenceConstraints };
 
 //# sourceMappingURL=passkey-model.mjs.map

package/dist/internal/models/passkey-model.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"passkey-model.mjs","names":[],"sources":["../../../src/internal/models/passkey-model.ts"],"sourcesContent":["import {\n  type PasskeyCeremony,\n  type PasskeyCredential,\n  type PasskeyMethodPolicy,\n  PasskeyCredentials,\n  PasskeyEnrollmentContext,\n  PasskeyPersistence,\n} from \"@yielded/auth/Passkey\";\nimport type { SubjectId } from \"@yielded/auth/Schema\";\nimport { Effect, Layer } from \"effect\";\n\nimport type { TableModel as Table, SqlExpression } from \"../query-operations\";\nimport type { PersistenceMappingError } from \"./common\";\n\nexport type PasskeyColumn<T extends Table> = T[\"column\"];\n\nexport type PasskeyMappingSource<M, RSetup = never> =\n  | M\n  | Effect.Effect<M, PersistenceMappingError, RSetup>;\n\nexport interface PasskeyCredentialServices {\n  readonly passkeyCredentials: PasskeyCredentials[\"Service\"];\n}\n\nexport interface PasskeyPersistenceServices {\n  readonly passkeyPersistence: PasskeyPersistence[\"Service\"];\n}\n\nexport interface PasskeyEnrollmentContextServices {\n  readonly passkeyEnrollmentContext: PasskeyEnrollmentContext[\"Service\"];\n}\n\nexport const passkeyCredentialsLayer = <E, R>(\n  services: Effect.Effect<PasskeyCredentialServices, E, R>,\n): Layer.Layer<PasskeyCredentials, E, R> =>\n  Layer.effect(\n    PasskeyCredentials,\n    Effect.map(services, (value) => value.passkeyCredentials),\n  );\n\nexport const passkeyPersistenceLayer = <E, R>(\n  services: Effect.Effect<PasskeyPersistenceServices, E, R>,\n): Layer.Layer<PasskeyPersistence, E, R> =>\n  Layer.effect(\n    PasskeyPersistence,\n    Effect.map(services, (value) => value.passkeyPersistence),\n  );\n\nexport const passkeyEnrollmentContextLayer = <E, R>(\n  services: Effect.Effect<PasskeyEnrollmentContextServices, E, R>,\n): Layer.Layer<PasskeyEnrollmentContext, E, R> =>\n  Layer.effect(\n    PasskeyEnrollmentContext,\n    Effect.map(services, (value) => value.passkeyEnrollmentContext),\n  );\n\n/** Native IDs roundtrip exactly; protocol IDs and authentication references are\n * different identities. These callbacks never suspend inside an owner. */\nexport interface PasskeySubjectIdCodec<N> {\n  readonly toNative: (id: SubjectId) => N;\n  readonly toSubject: (id: N) => SubjectId;\n  readonly equals: (left: N, right: N) => boolean;\n}\n\nexport interface PasskeyClock<Expression extends SqlExpression = SqlExpression> {\n  readonly encodeInstant: (millis: number) => unknown;\n  readonly decodeInstant: (value: unknown) => number;\n  readonly engineNowMillis: Expression;\n  readonly toMillis: (expression: Expression) => Expression;\n  readonly fromMillis: (expression: Expression) => Expression;\n}\n\nexport interface PasskeySubjectReadTable<\n  T extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: T[\"table\"];\n  readonly id: PasskeyColumn<T>;\n  readonly status: PasskeyColumn<T>;\n  readonly securityRevision: PasskeyColumn<T>;\n  readonly decodeId: (row: Readonly<Partial<T[\"select\"]>>) => N;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly activeCondition: Expression;\n}\n\nexport interface PasskeyFactorReadTable<\n  T extends Table,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: T[\"table\"];\n  readonly subjectId: PasskeyColumn<T>;\n  readonly credentialId: PasskeyColumn<T>;\n  readonly revision: PasskeyColumn<T>;\n  readonly status: PasskeyColumn<T>;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly activeCondition: Expression;\n}\n\n/** decode uses only these declared columns. Counter columns are native integral\n * numbers; BS may use a consumer enum. Name/creation metadata is not required. */\nexport interface PasskeyCredentialReadTable<\n  T extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: T[\"table\"];\n  readonly credentialId: PasskeyColumn<T>;\n  readonly subjectId: PasskeyColumn<T>;\n  readonly rpId: PasskeyColumn<T>;\n  readonly protocolCredentialId: PasskeyColumn<T>;\n  readonly credentialKey: PasskeyColumn<T>;\n  readonly handleKey: PasskeyColumn<T>;\n  readonly userHandle: PasskeyColumn<T>;\n  readonly publicKey: PasskeyColumn<T>;\n  readonly algorithm: PasskeyColumn<T>;\n  readonly profile: PasskeyColumn<T>;\n  readonly credentialRevision: PasskeyColumn<T>;\n  readonly status: PasskeyColumn<T>;\n  readonly primarySignIn: PasskeyColumn<T>;\n  readonly enrollmentUserVerified: PasskeyColumn<T>;\n  readonly backupEligible: PasskeyColumn<T>;\n  readonly backupState: PasskeyColumn<T>;\n  readonly counter: PasskeyColumn<T>;\n  readonly maximumCounter: PasskeyColumn<T>;\n  readonly decode: (\n    row: Readonly<Partial<T[\"select\"]>>,\n  ) => Omit<PasskeyCredential, \"revision\" | \"active\">;\n  readonly decodeSubjectId: (row: Readonly<Partial<T[\"select\"]>>) => N;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly activeCondition: Expression;\n}\n\nexport interface PasskeyCredentialOwnershipTable<\n  T extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: T[\"table\"];\n  readonly credentialKey: PasskeyColumn<T>;\n  readonly rpId: PasskeyColumn<T>;\n  readonly protocolCredentialId: PasskeyColumn<T>;\n  readonly subjectId: PasskeyColumn<T>;\n  readonly credentialId: PasskeyColumn<T>;\n  readonly state: PasskeyColumn<T>;\n  readonly version: PasskeyColumn<T>;\n  readonly reservationId: PasskeyColumn<T>;\n  readonly ownedCondition: Expression;\n  readonly isOwnedState: (value: unknown) => boolean;\n  readonly decodeSubjectId: (row: Readonly<Partial<T[\"select\"]>>) => N;\n}\n\n/** Reservations do not manufacture a subject; bound handles are RP-global. */\nexport interface PasskeyHandleReadTable<T extends Table> {\n  readonly table: T[\"table\"];\n  readonly handleKey: PasskeyColumn<T>;\n  readonly rpId: PasskeyColumn<T>;\n  readonly userHandle: PasskeyColumn<T>;\n  readonly state: PasskeyColumn<T>;\n  readonly version: PasskeyColumn<T>;\n  readonly reservationId: PasskeyColumn<T>;\n}\n\nexport interface PasskeyHandleReservationTable<\n  T extends Table,\n  Expression extends SqlExpression = SqlExpression,\n> extends PasskeyHandleReadTable<T> {\n  readonly reservedCondition: Expression;\n  readonly isReservedState: (value: unknown) => boolean;\n}\n\nexport interface PasskeyHandleOwnershipTable<\n  T extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> extends PasskeyHandleReadTable<T> {\n  readonly subjectId: PasskeyColumn<T>;\n  readonly ownedCondition: Expression;\n  readonly isOwnedState: (value: unknown) => boolean;\n  readonly decodeSubjectId: (row: Readonly<Partial<T[\"select\"]>>) => N;\n}\n\nexport const requiredPasskeyCredentialConstraints = {\n  credentialId: [\"credentialId\"],\n  factor: [\"subjectId\", \"credentialId\"],\n  credentialOwnership: [\"credentialKey\"],\n  handleOwnership: [\"handleKey\"],\n  boundSubjectHandle: [\"rpId\", \"subjectId\"],\n} as const;\n\nexport interface PasskeyCredentialMapping<\n  S extends Table,\n  C extends Table,\n  F extends Table,\n  Ownership extends Table,\n  Handle extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly subject: PasskeySubjectReadTable<S, N, Expression>;\n  readonly credential: PasskeyCredentialReadTable<C, N, Expression>;\n  readonly authority: PasskeyFactorReadTable<F, Expression>;\n  readonly credentialOwnership: PasskeyCredentialOwnershipTable<Ownership, N, Expression>;\n  readonly handleOwnership: PasskeyHandleOwnershipTable<Handle, N, Expression>;\n  readonly subjectIds: PasskeySubjectIdCodec<N>;\n  readonly constraints: typeof requiredPasskeyCredentialConstraints;\n}\n\n/** A stable additional policy row, acquired before RP/credential locks. The\n * factory checks column names without erasing the consumer table at its input. */\nconst PasskeyPolicyGuardTypeId: unique symbol = Symbol(\"effect-auth/drizzle/PasskeyPolicyGuard\");\n\nexport interface PasskeyPolicyGuard<Expression extends SqlExpression = SqlExpression> {\n  readonly [PasskeyPolicyGuardTypeId]: true;\n  readonly scope: string;\n  readonly table: object;\n  readonly columns: ReadonlyArray<string>;\n  readonly where: (moduleId: string) => Expression;\n  readonly condition: (moduleId: string) => Expression;\n}\n\nexport const passkeyPolicyGuard = <\n  T extends Table,\n  Expression extends SqlExpression = SqlExpression,\n>(input: {\n  readonly scope: string;\n  readonly table: T[\"table\"];\n  readonly columns: ReadonlyArray<PasskeyColumn<T>>;\n  readonly where: (moduleId: string) => Expression;\n  readonly condition: (moduleId: string) => Expression;\n}): PasskeyPolicyGuard<Expression> => ({ ...input, [PasskeyPolicyGuardTypeId]: true });\n\nexport interface PasskeyModuleTable<\n  T extends Table,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: T[\"table\"];\n  readonly moduleId: PasskeyColumn<T>;\n  readonly status: PasskeyColumn<T>;\n  readonly policyRevision: PasskeyColumn<T>;\n  /** All physical fields used by decodeMethodPolicy, including policyRevision. */\n  readonly policyColumns: ReadonlyArray<PasskeyColumn<T>>;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly activeCondition: Expression;\n  readonly decodeMethodPolicy: (row: Readonly<Partial<T[\"select\"]>>) => PasskeyMethodPolicy;\n  readonly guards?: ReadonlyArray<PasskeyPolicyGuard<Expression>>;\n}\n\nexport type PasskeyFlowState =\n  | \"Pending\"\n  | \"Claimed\"\n  | \"Verified\"\n  | \"Rejected\"\n  | \"Ambiguous\"\n  | \"RegistrationAccepted\"\n  | \"ProvisioningPending\";\n\nexport interface PasskeyFlowInsert {\n  readonly ceremony: PasskeyCeremony;\n  readonly policy: PasskeyMethodPolicy;\n  readonly marker: string;\n}\n\nexport interface PasskeyFlowTable<T extends Table> {\n  readonly table: T[\"table\"];\n  readonly moduleId: PasskeyColumn<T>;\n  readonly flowId: PasskeyColumn<T>;\n  readonly commandId: PasskeyColumn<T>;\n  readonly purpose: PasskeyColumn<T>;\n  readonly state: PasskeyColumn<T>;\n  readonly version: PasskeyColumn<T>;\n  readonly generation: PasskeyColumn<T>;\n  readonly snapshot: PasskeyColumn<T>;\n  readonly policySnapshot: PasskeyColumn<T>;\n  readonly requestBindingVerifier: PasskeyColumn<T>;\n  readonly requestBindingExpiresAt: PasskeyColumn<T>;\n  readonly issuedAt: PasskeyColumn<T>;\n  readonly expiresAt: PasskeyColumn<T>;\n  readonly retentionUntil: PasskeyColumn<T>;\n  readonly claimId: PasskeyColumn<T>;\n  readonly claimedAt: PasskeyColumn<T>;\n  readonly claimExpiresAt: PasskeyColumn<T>;\n  readonly credentialSnapshot: PasskeyColumn<T>;\n  /** Core SubjectId scope text, not a consumer's native subject ID. */\n  readonly subjectScope: PasskeyColumn<T>;\n  readonly targetScope: PasskeyColumn<T>;\n  readonly states: Readonly<Record<PasskeyFlowState, unknown>>;\n  readonly encodeInsert: (input: PasskeyFlowInsert) => T[\"insert\"];\n}\n\nexport interface PasskeyAdmissionTable<T extends Table> {\n  readonly table: T[\"table\"];\n  readonly authorityScope: PasskeyColumn<T>;\n  readonly moduleId: PasskeyColumn<T>;\n  readonly version: PasskeyColumn<T>;\n  readonly ownerMarker: PasskeyColumn<T>;\n  /** One physical clock sample, reused by every charge of this decision. */\n  readonly admittedAt: PasskeyColumn<T>;\n}\n\nexport type PasskeyChargeKind = \"global\" | \"subject\" | \"target\";\n\nexport interface PasskeyChargeInsert {\n  readonly moduleId: string;\n  readonly flowId: string;\n  readonly purpose: PasskeyCeremony[\"purpose\"];\n  readonly kind: PasskeyChargeKind;\n  readonly scope: string;\n  readonly originalWindowMillis: number;\n  readonly marker: string;\n}\n\n/** Charge scope is canonical core identity text; this subject-free descriptor\n * can count all purposes without decoding any unrelated native subject. */\nexport interface PasskeyChargeTable<T extends Table> {\n  readonly table: T[\"table\"];\n  readonly moduleId: PasskeyColumn<T>;\n  readonly flowId: PasskeyColumn<T>;\n  readonly purpose: PasskeyColumn<T>;\n  readonly kind: PasskeyColumn<T>;\n  readonly scope: PasskeyColumn<T>;\n  readonly originalWindowMillis: PasskeyColumn<T>;\n  readonly admittedAt: PasskeyColumn<T>;\n  readonly retainUntil: PasskeyColumn<T>;\n  readonly version: PasskeyColumn<T>;\n  readonly ownerMarker: PasskeyColumn<T>;\n  readonly encodeInsert: (input: PasskeyChargeInsert) => T[\"insert\"];\n}\n\nexport const requiredPasskeyPersistenceConstraints = {\n  flow: [\"moduleId\", \"flowId\"],\n  command: [\"moduleId\", \"commandId\"],\n  admission: [\"authorityScope\", \"moduleId\"],\n  charge: [\"moduleId\", \"flowId\", \"kind\"],\n} as const;\n\nexport interface PasskeyCeremonyMapping<\n  Module extends Table,\n  Flow extends Table,\n  Admission extends Table,\n  Charge extends Table,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly moduleId: string;\n  readonly authorityScope: string;\n  readonly module: PasskeyModuleTable<Module, Expression>;\n  readonly flow: PasskeyFlowTable<Flow>;\n  readonly admission: PasskeyAdmissionTable<Admission>;\n  readonly charge: PasskeyChargeTable<Charge>;\n  readonly clock: PasskeyClock<Expression>;\n  readonly constraints: typeof requiredPasskeyPersistenceConstraints;\n}\n\nexport interface PasskeyPersistenceMapping<\n  Read,\n  Module extends Table,\n  Flow extends Table,\n  Admission extends Table,\n  Charge extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n  Credential extends Table = Table,\n> extends PasskeyCeremonyMapping<Module, Flow, Admission, Charge, Expression> {\n  readonly read: Read & {\n    readonly subjectIds: PasskeySubjectIdCodec<N>;\n  };\n  readonly telemetry: {\n    readonly lastUsedAt: PasskeyColumn<Credential>;\n    readonly encodeBackupState: (value: boolean) => unknown;\n  };\n}\n\nexport interface PasskeyEnrollmentContextMapping<\n  Read,\n  Module extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly moduleId: string;\n  readonly read: Read & {\n    readonly subjectIds: PasskeySubjectIdCodec<N>;\n  };\n  readonly module: PasskeyModuleTable<Module, Expression>;\n}\n\nexport interface D1PasskeyMapping {\n  readonly d1: {\n    readonly primary: true;\n  };\n}\n"],"mappings":";;;AAgCA,MAAa,2BACX,aAEA,MAAM,OACJ,oBACA,OAAO,IAAI,WAAW,UAAU,MAAM,kBAAkB,CAC1D;AAEF,MAAa,2BACX,aAEA,MAAM,OACJ,oBACA,OAAO,IAAI,WAAW,UAAU,MAAM,kBAAkB,CAC1D;AAEF,MAAa,iCACX,aAEA,MAAM,OACJ,0BACA,OAAO,IAAI,WAAW,UAAU,MAAM,wBAAwB,CAChE;AAgIF,MAAa,uCAAuC;CAClD,cAAc,CAAC,cAAc;CAC7B,QAAQ,CAAC,aAAa,cAAc;CACpC,qBAAqB,CAAC,eAAe;CACrC,iBAAiB,CAAC,WAAW;CAC7B,oBAAoB,CAAC,QAAQ,WAAW;AAC1C;;;AAsBA,MAAM,2BAA0C,OAAO,wCAAwC;AAW/F,MAAa,sBAGX,WAMqC;CAAE,GAAG;EAAQ,2BAA2B;AAAK;AAmGpF,MAAa,wCAAwC;CACnD,MAAM,CAAC,YAAY,QAAQ;CAC3B,SAAS,CAAC,YAAY,WAAW;CACjC,WAAW,CAAC,kBAAkB,UAAU;CACxC,QAAQ;EAAC;EAAY;EAAU;CAAM;AACvC"}
+{"version":3,"file":"passkey-model.mjs","names":[],"sources":["../../../src/internal/models/passkey-model.ts"],"sourcesContent":["import {\n  type PasskeyCeremony,\n  type PasskeyCredential,\n  PasskeyCredentials,\n  PasskeyPersistence,\n} from \"@yielded/auth/Passkey\";\nimport type { SubjectId } from \"@yielded/auth/Schema\";\nimport type { AuthenticationRequirement } from \"@yielded/auth/Sessions\";\nimport { Effect, Layer } from \"effect\";\n\nimport type { TableModel as Table, SqlExpression } from \"../table-model\";\nimport type { PersistenceMappingError } from \"./common\";\n\nexport type PasskeyColumn<T extends Table> = T[\"column\"];\n\nexport type PasskeyMappingSource<M, RSetup = never> =\n  | M\n  | Effect.Effect<M, PersistenceMappingError, RSetup>;\n\nexport interface PasskeyCredentialServices {\n  readonly passkeyCredentials: PasskeyCredentials[\"Service\"];\n}\n\nexport interface PasskeyPersistenceServices {\n  readonly passkeyPersistence: PasskeyPersistence[\"Service\"];\n}\n\nexport const passkeyCredentialsLayer = <E, R>(\n  services: Effect.Effect<PasskeyCredentialServices, E, R>,\n): Layer.Layer<PasskeyCredentials, E, R> =>\n  Layer.effect(\n    PasskeyCredentials,\n    Effect.map(services, (value) => value.passkeyCredentials),\n  );\n\nexport const passkeyPersistenceLayer = <E, R>(\n  services: Effect.Effect<PasskeyPersistenceServices, E, R>,\n): Layer.Layer<PasskeyPersistence, E, R> =>\n  Layer.effect(\n    PasskeyPersistence,\n    Effect.map(services, (value) => value.passkeyPersistence),\n  );\n\n/** Native IDs roundtrip exactly; protocol IDs and authentication references are\n * different identities. These callbacks never suspend inside an owner. */\nexport interface PasskeySubjectIdCodec<N> {\n  readonly toNative: (id: SubjectId) => N;\n  readonly toSubject: (id: N) => SubjectId;\n  readonly equals: (left: N, right: N) => boolean;\n}\n\nexport interface PasskeyClock<Expression extends SqlExpression = SqlExpression> {\n  readonly encodeInstant: (millis: number) => unknown;\n  readonly decodeInstant: (value: unknown) => number;\n  readonly engineNowMillis: Expression;\n  readonly toMillis: (expression: Expression) => Expression;\n  readonly fromMillis: (expression: Expression) => Expression;\n}\n\nexport interface PasskeySubjectReadTable<\n  T extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: T[\"table\"];\n  readonly id: PasskeyColumn<T>;\n  readonly status: PasskeyColumn<T>;\n  readonly securityRevision: PasskeyColumn<T>;\n  readonly decodeRequirement: (\n    row: T[\"select\"],\n  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n  readonly decodeId: (row: Readonly<Partial<T[\"select\"]>>) => N;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly activeCondition: Expression;\n}\n\nexport interface PasskeyFactorReadTable<\n  T extends Table,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: T[\"table\"];\n  readonly subjectId: PasskeyColumn<T>;\n  readonly credentialId: PasskeyColumn<T>;\n  readonly revision: PasskeyColumn<T>;\n  readonly status: PasskeyColumn<T>;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly activeCondition: Expression;\n}\n\n/** decode uses only these declared columns. Counter columns are native integral\n * numbers; BS may use a consumer enum. Name/creation metadata is not required. */\nexport interface PasskeyCredentialReadTable<\n  T extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: T[\"table\"];\n  readonly credentialId: PasskeyColumn<T>;\n  readonly subjectId: PasskeyColumn<T>;\n  readonly rpId: PasskeyColumn<T>;\n  readonly protocolCredentialId: PasskeyColumn<T>;\n  readonly credentialKey: PasskeyColumn<T>;\n  readonly userHandle: PasskeyColumn<T>;\n  readonly publicKey: PasskeyColumn<T>;\n  readonly algorithm: PasskeyColumn<T>;\n  readonly profile: PasskeyColumn<T>;\n  readonly credentialRevision: PasskeyColumn<T>;\n  readonly status: PasskeyColumn<T>;\n  readonly primarySignIn: PasskeyColumn<T>;\n  readonly enrollmentUserVerified: PasskeyColumn<T>;\n  readonly backupEligible: PasskeyColumn<T>;\n  readonly backupState: PasskeyColumn<T>;\n  readonly counter: PasskeyColumn<T>;\n  readonly decode: (\n    row: Readonly<Partial<T[\"select\"]>>,\n  ) => Omit<PasskeyCredential, \"revision\" | \"active\" | \"requirement\">;\n  readonly decodeSubjectId: (row: Readonly<Partial<T[\"select\"]>>) => N;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly activeCondition: Expression;\n}\n\nexport const requiredPasskeyCredentialConstraints = {\n  credentialId: [\"credentialId\"],\n  credentialKey: [\"credentialKey\"],\n  factor: [\"subjectId\", \"credentialId\"],\n} as const;\n\nexport interface PasskeyCredentialMapping<\n  S extends Table,\n  C extends Table,\n  F extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly subject: PasskeySubjectReadTable<S, N, Expression>;\n  readonly credential: PasskeyCredentialReadTable<C, N, Expression>;\n  readonly authority: PasskeyFactorReadTable<F, Expression>;\n  readonly subjectIds: PasskeySubjectIdCodec<N>;\n  readonly constraints: typeof requiredPasskeyCredentialConstraints;\n}\n\nexport interface PasskeyFlowInsert {\n  readonly ceremony: PasskeyCeremony;\n}\n\n/** An immutable, single-use challenge. Consuming or expiring it deletes the row. */\nexport interface PasskeyFlowTable<T extends Table> {\n  readonly table: T[\"table\"];\n  readonly moduleId: PasskeyColumn<T>;\n  readonly flowId: PasskeyColumn<T>;\n  readonly purpose: PasskeyColumn<T>;\n  readonly snapshot: PasskeyColumn<T>;\n  readonly requestBindingVerifier: PasskeyColumn<T>;\n  readonly requestBindingExpiresAt: PasskeyColumn<T>;\n  readonly issuedAt: PasskeyColumn<T>;\n  readonly expiresAt: PasskeyColumn<T>;\n  readonly encodeInsert: (input: PasskeyFlowInsert) => T[\"insert\"];\n}\n\nexport const requiredPasskeyPersistenceConstraints = {\n  flow: [\"moduleId\", \"flowId\"],\n} as const;\n\nexport interface PasskeyCeremonyMapping<\n  Flow extends Table,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly moduleId: string;\n  readonly flow: PasskeyFlowTable<Flow>;\n  readonly clock: PasskeyClock<Expression>;\n  readonly constraints: typeof requiredPasskeyPersistenceConstraints;\n}\n\nexport interface PasskeyPersistenceMapping<\n  Read,\n  Flow extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n  Credential extends Table = Table,\n> extends PasskeyCeremonyMapping<Flow, Expression> {\n  readonly read: Read & {\n    readonly subjectIds: PasskeySubjectIdCodec<N>;\n  };\n  readonly telemetry: {\n    readonly lastUsedAt: PasskeyColumn<Credential>;\n    readonly encodeBackupEligible: (value: boolean) => unknown;\n    readonly encodeBackupState: (value: boolean) => unknown;\n  };\n}\n\nexport interface D1PasskeyMapping {\n  readonly d1: { readonly primary: true };\n}\n"],"mappings":";;;AA2BA,MAAa,2BACX,aAEA,MAAM,OACJ,oBACA,OAAO,IAAI,WAAW,UAAU,MAAM,kBAAkB,CAC1D;AAEF,MAAa,2BACX,aAEA,MAAM,OACJ,oBACA,OAAO,IAAI,WAAW,UAAU,MAAM,kBAAkB,CAC1D;AAgFF,MAAa,uCAAuC;CAClD,cAAc,CAAC,cAAc;CAC7B,eAAe,CAAC,eAAe;CAC/B,QAAQ,CAAC,aAAa,cAAc;AACtC;AAkCA,MAAa,wCAAwC,EACnD,MAAM,CAAC,YAAY,QAAQ,EAC7B"}

package/dist/internal/models/passkey-registration-ceremony-model.d.mts

@@ -1,49 +1,15 @@
-import { SqlExpression, TableModel } from "../query-operations.mjs";
-import { PasskeyCeremonyMapping, PasskeyChargeTable, PasskeyColumn, PasskeyFlowTable, PasskeyHandleReservationTable, PasskeyPersistenceServices } from "./passkey-model.mjs";
+import { SqlExpression, TableModel } from "../table-model.mjs";
+import { PasskeyCeremonyMapping, PasskeyPersistenceServices } from "./passkey-model.mjs";
 //#region src/internal/models/passkey-registration-ceremony-model.d.ts
 export interface PasskeyRegistrationCeremonyCapabilities {
   readonly purposes: readonly ["registration"];
   readonly issue: "registration-authority";
-  readonly assertionSettlement: false;
+  readonly assertionConsumption: false;
 }
 export interface PasskeyRegistrationCeremonyServices extends PasskeyPersistenceServices {
   readonly capabilities: PasskeyRegistrationCeremonyCapabilities;
 }
-/** Read-only custody supplied by a separate registration issuance authority.
- * No application payload codec, subject codec or provisioning callback runs here. */
-export interface PasskeyRegistrationIntentReadTable<T extends TableModel, Expression extends SqlExpression = SqlExpression> {
-  readonly table: T["table"];
-  readonly moduleId: PasskeyColumn<T>;
-  readonly flowId: PasskeyColumn<T>;
-  readonly commandId: PasskeyColumn<T>;
-  readonly state: PasskeyColumn<T>;
-  readonly version: PasskeyColumn<T>;
-  readonly fingerprint: PasskeyColumn<T>;
-  readonly handleKey: PasskeyColumn<T>;
-  readonly reservationId: PasskeyColumn<T>;
-  readonly ceremonySnapshot: PasskeyColumn<T>;
-  /** Already validated by the issuing authority; compare opaque bytes only. */
-  readonly applicationSnapshot: PasskeyColumn<T>;
-  readonly pendingCondition: Expression;
-  readonly isPendingState: (value: unknown) => boolean;
-  /** Any unresolved initial intent or provisioning job; cleanup never releases it. */
-  readonly custodyCondition: Expression;
-}
-export declare const requiredPasskeyRegistrationCeremonyConstraints: {
-  readonly flow: readonly ["moduleId", "flowId"];
-  readonly command: readonly ["moduleId", "commandId"];
-  readonly admission: readonly ["authorityScope", "moduleId"];
-  readonly charge: readonly ["moduleId", "flowId", "kind"];
-  readonly intentFlow: readonly ["moduleId", "flowId"];
-  readonly intentCommand: readonly ["moduleId", "commandId"];
-  readonly handle: readonly ["handleKey"];
-};
-export interface PasskeyRegistrationCeremonyMapping<Module extends TableModel, Flow extends TableModel, Admission extends TableModel, Charge extends TableModel, Intent extends TableModel, Handle extends TableModel, Expression extends SqlExpression = SqlExpression> extends Omit<PasskeyCeremonyMapping<Module, Flow, Admission, Charge, Expression>, "constraints" | "flow" | "charge"> {
-  readonly flow: Omit<PasskeyFlowTable<Flow>, "encodeInsert">;
-  readonly charge: Omit<PasskeyChargeTable<Charge>, "encodeInsert">;
-  readonly intent: PasskeyRegistrationIntentReadTable<Intent, Expression>;
-  readonly handle: PasskeyHandleReservationTable<Handle, Expression>;
-  readonly constraints: typeof requiredPasskeyRegistrationCeremonyConstraints;
-}
+/** The registration authority owns insertion and consumption of the challenge. */
+export type PasskeyRegistrationCeremonyMapping<Flow extends TableModel, Expression extends SqlExpression = SqlExpression> = PasskeyCeremonyMapping<Flow, Expression>;
 //#endregion
 //# sourceMappingURL=passkey-registration-ceremony-model.d.mts.map