@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.27

package/src/internal/models/oauth-model.ts

@@ -3,7 +3,6 @@ import type {
   OAuthActionAuthorization,
   OAuthAccountRevision,
   OAuthRegistrationIntent,
-  OAuthCredentialSnapshot,
   OAuthExternalIdentity,
   OAuthRegistrationAccess,
   OAuthRegistrationInspection,
@@ -13,33 +12,18 @@ import type {
   OAuthRegistrationDecision,
   OAuthCleanupInput,
 } from "@yielded/auth/OAuth";
-import type { AuthenticationFactor } from "@yielded/auth/Operations";
+import { AuthenticationFactor } from "@yielded/auth/Operations";
+import type { CleanupResult } from "@yielded/auth/Persistence";
 import type { TokenDigest } from "@yielded/auth/Schema";
-import type { AuthenticationRequirement, SecurityRevision } from "@yielded/auth/Sessions";
-import type { Crypto, Effect, PlatformError } from "effect";
+import { type AuthenticationRequirement, SecurityRevision } from "@yielded/auth/Sessions";
+import { type Effect, Schema } from "effect";
 
-import type { TableModel as Table, SqlExpression } from "../query-operations";
+import type { TableModel as Table, SqlExpression } from "../table-model";
 import type { PersistenceMappingError, SubjectIdCodec } from "./common";
 
 type Column<T extends Table> = T["column"];
-
-export type OAuthFlowState =
-  | "Pending"
-  | "Claimed"
-  | "Verified"
-  | "RegistrationIssued"
-  | "Linked"
-  | "Cancelled"
-  | "Rejected"
-  | "Ambiguous"
-  | "Conflict";
-
-export type OAuthTupleState = "Unowned" | "Reserved" | "Owned";
-export type OAuthRegistrationState = "Unbound" | "Registered" | "ProvisioningPending" | "Rejected";
 export type OAuthAction = OAuthActionAuthorization["challenge"]["action"];
 
-/** The engine writes every critical column explicitly after applying the pure
- * consumer encoder. Native instant values must roundtrip without precision loss. */
 export interface OAuthClock<Expression extends SqlExpression = SqlExpression> {
   readonly encodeInstant: (millis: number) => unknown;
   readonly decodeInstant: (value: unknown) => number;
@@ -47,6 +31,9 @@ export interface OAuthClock<Expression extends SqlExpression = SqlExpression> {
    * PostgreSQL uses clock_timestamp(), never now()/CURRENT_TIMESTAMP. D1 repeats
    * its primary-engine sample bounds in final guards. Return integer milliseconds. */
   readonly engineNowMillis: Expression;
+  /** Convert a stored timestamp expression to integer milliseconds. */
+  readonly toMillis: (expression: Expression) => Expression;
+  readonly fromMillis: (expression: Expression) => Expression;
 }
 
 export interface OAuthSubjectReadTable<
@@ -59,41 +46,27 @@ export interface OAuthSubjectReadTable<
   readonly securityRevision: Column<S>;
   readonly isActiveStatus: (value: unknown) => boolean;
   readonly activeCondition: Expression;
+  readonly decodeAuthenticationRequirement: (row: S["select"]) => AuthenticationRequirement;
 }
 
 export interface OAuthSubjectTable<
   S extends Table,
   Expression extends SqlExpression = SqlExpression,
 > extends OAuthSubjectReadTable<S, Expression> {
-  readonly decodeActionRequirement: (
-    row: S["select"],
-    action: OAuthAction,
-  ) => AuthenticationRequirement;
-  readonly decodeAuthenticationRequirement: (row: S["select"]) => AuthenticationRequirement;
   readonly nextSecurityRevision: (current: SecurityRevision) => SecurityRevision;
 }
 
-export interface OAuthOwnershipReadTable<
-  O extends Table,
-  N,
-  Expression extends SqlExpression = SqlExpression,
-> {
+export interface OAuthOwnershipReadTable<O extends Table, N> {
   readonly table: O["table"];
   readonly identityKey: Column<O>;
   readonly provider: Column<O>;
   readonly issuer: Column<O>;
   readonly externalSubject: Column<O>;
   readonly subjectId: Column<O>;
-  /** Includes Owned state when authority and ownership share a physical table. */
-  readonly ownedCondition: Expression;
   readonly decodeSubjectId: (row: O["select"]) => N;
 }
 
-export interface OAuthOwnershipTable<
-  O extends Table,
-  N,
-  Expression extends SqlExpression = SqlExpression,
-> extends OAuthOwnershipReadTable<O, N, Expression> {
+export interface OAuthOwnershipTable<O extends Table, N> extends OAuthOwnershipReadTable<O, N> {
   readonly encodeInsert: (input: {
     readonly identity: typeof OAuthExternalIdentity.Type;
     readonly identityKey: string;
@@ -157,117 +130,42 @@ export interface OAuthAuthorityTable<
   }) => C["insert"];
 }
 
-/** Both purposes may use the same physical table. Shared tables share module/flow
- * and module/command uniqueness. The snapshot has the exact purpose-specific core
- * codec; terminal writes erase it, while identity, claim and retention columns remain. */
+/** Live ceremonies only. Predicate columns enforce access before deletion; the
+ * snapshot retains the exact authenticated context and encrypted protocol data. */
 export interface OAuthFlowTable<F extends Table> {
   readonly table: F["table"];
   readonly moduleId: Column<F>;
   readonly flowId: Column<F>;
-  readonly commandId: Column<F>;
   readonly purpose: Column<F>;
   readonly generation: Column<F>;
-  readonly state: Column<F>;
-  readonly version: Column<F>;
+  readonly provider: Column<F>;
+  readonly callbackId: Column<F>;
+  readonly issuer: Column<F>;
+  readonly responseIssuerMode: Column<F>;
+  readonly subjectId: Column<F>;
   readonly stateDigest: Column<F>;
   readonly binderVerifier: Column<F>;
   readonly binderExpiresAt: Column<F>;
   readonly snapshot: Column<F>;
   readonly issuedAt: Column<F>;
   readonly expiresAt: Column<F>;
-  readonly claimId: Column<F>;
-  readonly claimedAt: Column<F>;
-  readonly claimExpiresAt: Column<F>;
-  readonly retentionUntil: Column<F>;
   readonly encodeInsert: (input: {
     readonly moduleId: string;
     readonly flowId: string;
-    readonly purpose: "sign-in" | "link";
+    readonly purpose: "sign-in" | "link" | "connect";
   }) => F["insert"];
 }
 
-export interface OAuthTupleAuthorityTable<T extends Table, N> {
-  readonly table: T["table"];
-  readonly identityKey: Column<T>;
-  readonly provider: Column<T>;
-  readonly issuer: Column<T>;
-  readonly externalSubject: Column<T>;
-  readonly state: Column<T>;
-  readonly version: Column<T>;
-  readonly subjectId: Column<T>;
-  /** Exact reservation identity; no application payload or bearer. */
-  readonly reservation: Column<T>;
-  readonly encodeInsert: (input: {
-    readonly identityKey: string;
-    readonly identity: typeof OAuthExternalIdentity.Type;
-    readonly subjectId?: N;
-  }) => T["insert"];
-}
+export const OAuthEligibilityFact = Schema.Struct({
+  credentialId: Schema.NonEmptyString.check(Schema.isMaxLength(256)),
+  revision: SecurityRevision,
+  usablePrimary: Schema.Boolean,
+  factors: Schema.Array(AuthenticationFactor).check(Schema.isMaxLength(8)),
+  userVerified: Schema.Boolean,
+  phishingResistant: Schema.Boolean,
+});
 
-export interface OAuthRegistrationIntentTable<I extends Table> {
-  readonly table: I["table"];
-  readonly moduleId: Column<I>;
-  readonly reference: Column<I>;
-  readonly flowId: Column<I>;
-  readonly claimId: Column<I>;
-  readonly identityKey: Column<I>;
-  readonly version: Column<I>;
-  readonly state: Column<I>;
-  readonly snapshot: Column<I>;
-  readonly commandId: Column<I>;
-  readonly fingerprint: Column<I>;
-  readonly pendingReference: Column<I>;
-  readonly expiresAt: Column<I>;
-  readonly retentionUntil: Column<I>;
-  readonly encodeInsert: (intent: OAuthRegistrationIntent) => I["insert"];
-}
-
-export interface OAuthRegistrationCommandTable<R extends Table, Registration> {
-  readonly table: R["table"];
-  readonly moduleId: Column<R>;
-  readonly commandId: Column<R>;
-  readonly reference: Column<R>;
-  readonly identityKey: Column<R>;
-  readonly fingerprint: Column<R>;
-  readonly intentSnapshot: Column<R>;
-  readonly applicationSnapshot: Column<R>;
-  readonly provisioningIdentity: Column<R>;
-  readonly decision: Column<R>;
-  readonly retentionUntil: Column<R>;
-  /** Persists exact detached Type before protected pending work can start. */
-  readonly encodeInsert: (input: {
-    readonly intent: OAuthRegistrationIntent;
-    readonly commandId: string;
-    readonly fingerprint: string;
-    readonly registration: Registration;
-    readonly provisioningIdentity: string;
-  }) => R["insert"];
-}
-
-export interface OAuthUnlinkCommandTable<U extends Table> {
-  readonly table: U["table"];
-  readonly moduleId: Column<U>;
-  readonly commandId: Column<U>;
-  readonly subjectId: Column<U>;
-  readonly credentialId: Column<U>;
-  readonly intentSnapshot: Column<U>;
-  readonly decision: Column<U>;
-  readonly retentionUntil: Column<U>;
-  readonly encodeInsert: (input: {
-    readonly moduleId: string;
-    readonly commandId: string;
-    readonly credential: OAuthCredentialSnapshot;
-  }) => U["insert"];
-}
-
-export interface OAuthEligibilityFact {
-  readonly credentialId: string;
-  readonly revision: SecurityRevision;
-  readonly usablePrimary: boolean;
-  readonly factors: ReadonlyArray<AuthenticationFactor>;
-  readonly userVerified: boolean;
-  readonly phishingResistant: boolean;
-}
+export type OAuthEligibilityFact = typeof OAuthEligibilityFact.Type;
 
 /** Each descriptor reads only its own subject-scoped method rows. The native row
  * projector and SQL condition must express the same installed method eligibility.
@@ -288,12 +186,6 @@ export interface OAuthEligibilityTable<
   readonly decode: (row: T["select"]) => OAuthEligibilityFact | undefined;
 }
 
-/** Authenticated command replay uses current subject status and this additional
- * nonconsuming SQL policy. It never consumes a fresh action factor. */
-export interface OAuthMetadataPolicy<N, Expression extends SqlExpression = SqlExpression> {
-  readonly condition: (subjectId: N) => Expression;
-}
-
 export interface OAuthCleanupTable<
   T extends Table,
   N,
@@ -310,160 +202,6 @@ export interface OAuthCleanupTable<
   readonly disposition: "delete";
 }
 
-export interface OAuthRegistrationEligibility<N, Expression extends SqlExpression = SqlExpression> {
-  /** Pure SQL guards for mutable app policy; evaluated again after app writes. */
-  readonly condition: (input: {
-    readonly intent: OAuthRegistrationIntent;
-    readonly nativeSubjectId?: N;
-  }) => Expression;
-}
-
-export interface OAuthD1Mapping {
-  readonly d1: { readonly primary: true };
-}
-
-export const requiredOAuthSignInConstraints = {
-  flow: "unique(flow.moduleId,flow.flowId)",
-  command: "unique(flow.moduleId,flow.commandId)",
-  stateDigest: "unique(flow.stateDigest)",
-  ownership: "unique(ownership.identityKey)",
-  credentialId: "unique(credential.credentialId)",
-  credentialIdentity: "unique(credential.identityKey)",
-  authorityCredential: "unique(authority.subjectId,authority.credentialId)",
-} as const;
-
-export const requiredOAuthTupleConstraints = { identityKey: "unique(tuple.identityKey)" } as const;
-
-export const requiredOAuthRegistrationConstraints = {
-  intentReference: "unique(intent.moduleId,intent.reference)",
-  intentFlow: "unique(intent.moduleId,intent.flowId)",
-  command: "unique(registrationCommand.moduleId,registrationCommand.commandId)",
-} as const;
-
-export const requiredOAuthAccountsConstraints = {
-  unlinkCommand: "unique(unlinkCommand.moduleId,unlinkCommand.commandId)",
-} as const;
-
-export interface OAuthSignInMapping<
-  S extends Table,
-  O extends Table,
-  C extends Table,
-  AC extends Table,
-  F extends Table,
-  N,
-  Expression extends SqlExpression = SqlExpression,
-> {
-  readonly subject: OAuthSubjectReadTable<S, Expression>;
-  readonly ownership: OAuthOwnershipReadTable<O, N, Expression>;
-  readonly credential: OAuthCredentialReadTable<C, Expression>;
-  readonly authority: OAuthAuthorityReadTable<AC, Expression>;
-  readonly flow: OAuthFlowTable<F>;
-  readonly subjectId: SubjectIdCodec<N>;
-  readonly clock: OAuthClock<Expression>;
-  readonly constraints: typeof requiredOAuthSignInConstraints;
-}
-
-export type OAuthOwnershipMutation<
-  T extends Table,
-  O extends Table,
-  N,
-  Expression extends SqlExpression = SqlExpression,
-> =
-  | { readonly mode: "integrated"; readonly tuple: OAuthTupleAuthorityTable<T, N> }
-  | {
-      readonly mode: "separate";
-      readonly tuple: OAuthTupleAuthorityTable<T, N>;
-      readonly external: OAuthOwnershipTable<O, N, Expression>;
-    };
-
-export interface OAuthRegistrationIntentMapping<
-  S extends Table,
-  O extends Table,
-  C extends Table,
-  AC extends Table,
-  F extends Table,
-  T extends Table,
-  I extends Table,
-  N,
-  Expression extends SqlExpression = SqlExpression,
-> {
-  readonly signIn: OAuthSignInMapping<S, O, C, AC, F, N, Expression>;
-  readonly ownership: OAuthOwnershipMutation<T, O, N, Expression>;
-  readonly intent: OAuthRegistrationIntentTable<I>;
-  readonly tupleConstraints: typeof requiredOAuthTupleConstraints;
-  readonly registrationConstraints: Pick<
-    typeof requiredOAuthRegistrationConstraints,
-    "intentReference" | "intentFlow"
-  >;
-  readonly eligibility: OAuthRegistrationEligibility<N, Expression>;
-}
-
-export interface OAuthRegistrationBase<
-  Registration,
-  T extends Table,
-  O extends Table,
-  I extends Table,
-  R extends Table,
-  N,
-  Expression extends SqlExpression = SqlExpression,
-  Descriptor extends object = object,
-> {
-  readonly ownership: OAuthOwnershipMutation<T, O, N, Expression>;
-  readonly intent: OAuthRegistrationIntentTable<I>;
-  readonly command: OAuthRegistrationCommandTable<R, Registration>;
-  readonly clock: OAuthClock<Expression>;
-  readonly tupleConstraints: typeof requiredOAuthTupleConstraints;
-  readonly constraints: typeof requiredOAuthRegistrationConstraints;
-  readonly inspect: (input: {
-    readonly intent: OAuthRegistrationIntent;
-    readonly registration: Registration;
-  }) => Effect.Effect<
-    { readonly fingerprint: string; readonly eligible: boolean },
-    PersistenceMappingError
-  >;
-  /** Required for an explicitly bound native/DO command: no asynchronous callback
-   * is evaluated inside the physical owner. Standalone inspection is pre-owner. */
-  readonly inspectSync?: (input: {
-    readonly intent: OAuthRegistrationIntent;
-    readonly registration: Registration;
-  }) => { readonly fingerprint: string; readonly eligible: boolean };
-  /** Type projection, never the original wire transformation. */
-  readonly snapshot: (
-    registration: Registration,
-  ) => Effect.Effect<Registration, PersistenceMappingError>;
-  readonly snapshotSync?: (registration: Registration) => Registration;
-  /** Canonical bounded storage of Registration.Type. These are Type codecs, not
-   * the original wire decoder/encoder; decode(encode(value)) must encode identically.
-   * The engine writes and roundtrip-checks this exact string (maximum 1 MiB). */
-  readonly application: {
-    readonly encode: (registration: Registration) => string;
-    readonly decode: (stored: string) => Registration;
-  };
-  readonly eligibility: {
-    /** Stable application authority anchors, in one configured global order.
-     * Omit only for immutable/tuple-local policy or an equivalent explicit outer
-     * owner lock. Each scope must match 1..64 rows, never an absent quota row.
-     * Locks precede tuple/intent/command locks; postcondition owns changed state. */
-    readonly guards?: ReadonlyArray<
-      OAuthRegistrationGuardDescriptor<Registration, N, Expression, Descriptor>
-    >;
-    readonly admission: (input: {
-      readonly intent: OAuthRegistrationIntent;
-      readonly registration: Registration;
-      readonly nativeSubjectId?: N;
-    }) => Expression;
-    /** Evaluated after subject/application writes, including appended coordinator
-     * writes. May assert consumption of the admission invitation/quota. */
-    readonly postcondition: (input: {
-      readonly intent: OAuthRegistrationIntent;
-      readonly registration: Registration;
-      readonly nativeSubjectId?: N;
-    }) => Expression;
-  };
-  readonly allocateProvisioningIdentity: Effect.Effect<string, PersistenceMappingError>;
-  readonly retentionMillis: number;
-}
-
 export interface OAuthRegistrationGuardTable<
   T extends Table,
   Registration,
@@ -504,40 +242,6 @@ export const oauthRegistrationGuardTable = <
     condition: input.condition,
   });
 
-export type OAuthRegistrationMapping<
-  Registration,
-  S extends Table,
-  O extends Table,
-  C extends Table,
-  AC extends Table,
-  T extends Table,
-  I extends Table,
-  R extends Table,
-  N,
-  Expression extends SqlExpression = SqlExpression,
-  Descriptor extends object = object,
-> = OAuthRegistrationBase<Registration, T, O, I, R, N, Expression, Descriptor> &
-  (
-    | {
-        readonly mode: "pending";
-        readonly allocatePendingReference: Effect.Effect<string, PersistenceMappingError>;
-      }
-    | {
-        readonly mode: "atomic";
-        readonly subjectId: SubjectIdCodec<N>;
-        readonly subject: OAuthSubjectReadTable<S, Expression>;
-        readonly credential: OAuthCredentialTable<C, N, Expression>;
-        readonly authority: OAuthAuthorityTable<AC, N, Expression>;
-        readonly allocateSubjectId: Effect.Effect<N, PersistenceMappingError>;
-        readonly allocateCredentialId: Effect.Effect<string, PersistenceMappingError>;
-        readonly allocateRevision: Effect.Effect<SecurityRevision, PersistenceMappingError>;
-        readonly encodeSubjectInsert: (
-          input: { readonly intent: OAuthRegistrationIntent; readonly registration: Registration },
-          ids: { readonly subjectId: N; readonly securityRevision: SecurityRevision },
-        ) => S["insert"];
-      }
-  );
-
 /** Heterogeneous descriptors are made by typed factories and projected privately. */
 export interface OAuthEligibilityDescriptor<
   N,
@@ -595,45 +299,130 @@ export const oauthCleanupTable = <
 ): OAuthCleanupDescriptor<N, Expression, T["table"]> =>
   Object.freeze({ table: input.table, subjectId: input.subjectId, condition: input.condition });
 
-/** A stable application/reference lock acquired before an ownership target.
- * Missing rows retain ownership. Conditions use detached native IDs; every
- * writer of the guarded reference follows the same order. */
-export interface OAuthReferenceGuardTable<
-  T extends Table,
+/** Original application binding and retained decision are encoded in snapshot. */
+export interface OAuthRegistrationIntentTable<I extends Table> {
+  readonly table: I["table"];
+  readonly moduleId: Column<I>;
+  readonly reference: Column<I>;
+  readonly flowId: Column<I>;
+  readonly identityKey: Column<I>;
+  readonly snapshot: Column<I>;
+  readonly expiresAt: Column<I>;
+  readonly retentionUntil: Column<I>;
+  readonly encodeInsert: (intent: OAuthRegistrationIntent) => I["insert"];
+}
+
+export interface OAuthD1Mapping {
+  readonly d1: { readonly primary: true };
+}
+
+export const requiredOAuthSignInConstraints = {
+  flow: "unique(flow.moduleId,flow.flowId)",
+  stateDigest: "unique(flow.stateDigest)",
+  ownership: "unique(ownership.identityKey)",
+  credentialId: "unique(credential.credentialId)",
+  credentialIdentity: "unique(credential.identityKey)",
+  authorityCredential: "unique(authority.subjectId,authority.credentialId)",
+} as const;
+
+export const requiredOAuthRegistrationConstraints = {
+  intentReference: "unique(intent.moduleId,intent.reference)",
+  intentFlow: "unique(intent.moduleId,intent.flowId)",
+  ownership: "unique(ownership.identityKey)",
+  credentialId: "unique(credential.credentialId)",
+  credentialIdentity: "unique(credential.identityKey)",
+  authorityCredential: "unique(authority.subjectId,authority.credentialId)",
+} as const;
+
+export interface OAuthSignInMapping<
+  S extends Table,
+  O extends Table,
+  C extends Table,
+  AC extends Table,
+  F extends Table,
   N,
   Expression extends SqlExpression = SqlExpression,
 > {
-  readonly table: T["table"];
-  readonly orderBy: Column<T>;
-  readonly condition: (input: {
-    readonly identity: typeof OAuthExternalIdentity.Type;
-    readonly identityKey: string;
-    readonly subjectId: N;
-  }) => Expression | Effect.Effect<Expression, PlatformError.PlatformError, Crypto.Crypto>;
+  readonly subject: OAuthSubjectReadTable<S, Expression>;
+  readonly ownership: OAuthOwnershipReadTable<O, N>;
+  readonly credential: OAuthCredentialReadTable<C, Expression>;
+  readonly authority: OAuthAuthorityReadTable<AC, Expression>;
+  readonly flow: OAuthFlowTable<F>;
+  readonly subjectId: SubjectIdCodec<N>;
+  readonly clock: OAuthClock<Expression>;
+  readonly constraints: typeof requiredOAuthSignInConstraints;
 }
 
-export interface OAuthReferenceGuardDescriptor<
+export interface OAuthRegistrationIntentMapping<
+  O extends Table,
+  I extends Table,
   N,
   Expression extends SqlExpression = SqlExpression,
-  Descriptor extends object = object,
 > {
-  readonly table: Descriptor;
-  readonly orderBy: string;
-  readonly condition: OAuthReferenceGuardTable<Table, N, Expression>["condition"];
+  readonly ownership: OAuthOwnershipReadTable<O, N>;
+  readonly intent: OAuthRegistrationIntentTable<I>;
+  readonly clock: OAuthClock<Expression>;
+  readonly constraints: Pick<
+    typeof requiredOAuthRegistrationConstraints,
+    "intentReference" | "intentFlow" | "ownership"
+  >;
+  readonly eligible: (intent: OAuthRegistrationIntent) => Expression;
 }
 
-export const oauthReferenceGuardTable = <
-  T extends Table,
+export interface OAuthRegistrationMapping<
+  Registration,
+  S extends Table,
+  O extends Table,
+  C extends Table,
+  AC extends Table,
+  I extends Table,
   N,
   Expression extends SqlExpression = SqlExpression,
->(
-  input: OAuthReferenceGuardTable<T, N, Expression>,
-): OAuthReferenceGuardDescriptor<N, Expression, T["table"]> =>
-  Object.freeze({
-    table: input.table,
-    orderBy: input.orderBy,
-    condition: input.condition,
-  });
+  Descriptor extends object = object,
+> {
+  readonly registration: Schema.Codec<Registration, unknown, never, never>;
+  readonly ownership: OAuthOwnershipTable<O, N>;
+  readonly intent: OAuthRegistrationIntentTable<I>;
+  readonly subject: OAuthSubjectReadTable<S, Expression>;
+  readonly credential: OAuthCredentialTable<C, N, Expression>;
+  readonly authority: OAuthAuthorityTable<AC, N, Expression>;
+  readonly subjectId: SubjectIdCodec<N>;
+  readonly clock: OAuthClock<Expression>;
+  readonly constraints: typeof requiredOAuthRegistrationConstraints;
+  readonly inspect: (input: {
+    readonly intent: OAuthRegistrationIntent;
+    readonly registration: Registration;
+  }) => Effect.Effect<
+    { readonly fingerprint: string; readonly eligible: boolean },
+    PersistenceMappingError
+  >;
+  readonly eligibility: {
+    readonly guards?: ReadonlyArray<
+      OAuthRegistrationGuardDescriptor<Registration, N, Expression, Descriptor>
+    >;
+    readonly admission: (input: {
+      readonly intent: OAuthRegistrationIntent;
+      readonly registration: Registration;
+      readonly nativeSubjectId?: N;
+    }) => Expression;
+    readonly postcondition: (input: {
+      readonly intent: OAuthRegistrationIntent;
+      readonly registration: Registration;
+      readonly nativeSubjectId?: N;
+    }) => Expression;
+  };
+  readonly allocateSubjectId: Effect.Effect<N, PersistenceMappingError>;
+  readonly allocateCredentialId: Effect.Effect<string, PersistenceMappingError>;
+  readonly allocateRevision: Effect.Effect<SecurityRevision, PersistenceMappingError>;
+  readonly encodeSubjectInsert: (
+    input: {
+      readonly intent: OAuthRegistrationIntent;
+      readonly registration: Registration;
+      readonly requestId: string;
+    },
+    ids: { readonly subjectId: N; readonly securityRevision: SecurityRevision },
+  ) => S["insert"];
+}
 
 export interface OAuthAccountsMapping<
   S extends Table,
@@ -641,38 +430,26 @@ export interface OAuthAccountsMapping<
   C extends Table,
   AC extends Table,
   F extends Table,
-  T extends Table,
-  U extends Table,
   N,
   Expression extends SqlExpression = SqlExpression,
   Descriptor extends object = object,
 > {
   readonly subject: OAuthSubjectTable<S, Expression>;
-  readonly ownership: OAuthOwnershipMutation<T, O, N, Expression>;
+  readonly ownership: OAuthOwnershipTable<O, N>;
   readonly credential: OAuthCredentialTable<C, N, Expression>;
   readonly authority: OAuthAuthorityTable<AC, N, Expression>;
   readonly flow: OAuthFlowTable<F>;
-  readonly command: OAuthUnlinkCommandTable<U>;
   readonly subjectId: SubjectIdCodec<N>;
   readonly clock: OAuthClock<Expression>;
-  readonly constraints: typeof requiredOAuthSignInConstraints &
-    typeof requiredOAuthAccountsConstraints;
-  readonly tupleConstraints: typeof requiredOAuthTupleConstraints;
+  readonly constraints: typeof requiredOAuthSignInConstraints;
   readonly eligibility: ReadonlyArray<OAuthEligibilityDescriptor<N, Expression, Descriptor>>;
   readonly cleanup: ReadonlyArray<OAuthCleanupDescriptor<N, Expression, Descriptor>>;
-  readonly metadata: OAuthMetadataPolicy<N, Expression>;
   readonly sessionInvalidation: "same-authority-immediate" | "original-absolute-expiry";
-  /** Omit only when connected access is absent. A predicate alone conservatively
-   * retains ownership; release also needs all configured guard rows below. */
-  readonly connectedReference?: (input: {
+  /** Indexed same-owner reference predicate for any installed grant/application references. */
+  readonly otherReferences: (input: {
     readonly identityKey: string;
     readonly subjectId: N;
   }) => Expression;
-  /** At most 32 descriptors, each locking 1..64 stable rows in supplied order.
-   * Missing/empty guards retain Owned, even when the reference predicate is false. */
-  readonly connectedReferenceGuards?: ReadonlyArray<
-    OAuthReferenceGuardDescriptor<N, Expression, Descriptor>
-  >;
   readonly allocateCredentialId: Effect.Effect<string, PersistenceMappingError>;
   readonly allocateRevision: Effect.Effect<SecurityRevision, PersistenceMappingError>;
 }
@@ -698,11 +475,13 @@ export interface OAuthRegistrationAuthority<Registration> {
       readonly commandId: typeof OAuthCommandId.Type;
       readonly registration: Registration;
       readonly fingerprint: TokenDigest;
+      readonly payload: string;
+      readonly requestId: string;
     },
     prepare: PrepareOAuthCommit<OAuthRegistrationDecision, A>,
   ) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;
   readonly cleanup: <A>(
     input: OAuthCleanupInput,
-    prepare: PrepareOAuthCommit<{ readonly removed: number; readonly hasMore: boolean }, A>,
+    prepare: PrepareOAuthCommit<CleanupResult, A>,
   ) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;
 }