@yielded/auth-persistence 0.1.0-beta.7 → 0.1.0-beta.9

package/dist/drizzle/oauth-connected-target.d.mts

@@ -1,12 +1,12 @@
 import { OAuthTargetConfiguration } from "./oauth-target.mjs";
-import { Mapping, Revocations } from "./oauth-connected-state.mjs";
+import { Mapping, Revocations, oauth_connected_state_d_exports } from "./oauth-connected-state.mjs";
 import { Effect, Layer, Schema } from "effect";
 import { LifecycleHooks } from "@yielded/auth/Hooks";
 import * as M from "@yielded/auth/OAuth";
 import { OAuthConnectedPersistence, OAuthConnectedRevocationDecision, OAuthConnectedRevocations, OAuthExternalIdentity, PrepareOAuthCommit } from "@yielded/auth/OAuth";
 import { Statement } from "effect/unstable/sql/Statement";
 //#region src/drizzle/oauth-connected-target.d.ts
-declare const makeTargetOAuthConnectedServices: (database: any, mapping: Mapping, configuration: OAuthTargetConfiguration) => Effect.Effect<{
+export declare const makeTargetOAuthConnectedServices: (database: any, mapping: Mapping, configuration: OAuthTargetConfiguration) => Effect.Effect<{
   oauthConnectedPersistence: {
     readonly capture: (input: {
       readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
@@ -226,14 +226,14 @@ declare const makeTargetOAuthConnectedServices: (database: any, mapping: Mapping
       readonly identity: typeof OAuthExternalIdentity.Type;
     }) => Effect.Effect<{
       readonly _tag: "Rejected";
+    } | {
+      readonly _tag: "Conflict";
     } | {
       readonly _tag: "Target";
       readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
     } | {
       readonly _tag: "Quarantine";
       readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-    } | {
-      readonly _tag: "Conflict";
     }, M.OAuthUnavailable>;
     readonly settle: <A>(input: {
       readonly claim: M.OAuthConnectedClaim;
@@ -242,12 +242,12 @@ declare const makeTargetOAuthConnectedServices: (database: any, mapping: Mapping
       readonly nowMillis: number;
     }, prepare: PrepareOAuthCommit<{
       readonly _tag: "Rejected";
-    } | {
-      readonly _tag: "Conflict";
     } | {
       readonly _tag: "Cancelled";
     } | {
       readonly _tag: "Ambiguous";
+    } | {
+      readonly _tag: "Conflict";
     } | {
       readonly _tag: "Connected";
       readonly grant: {
@@ -731,7 +731,7 @@ declare const makeTargetOAuthConnectedServices: (database: any, mapping: Mapping
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, M.OAuthUnavailable, never>;
   };
 }, never, LifecycleHooks>;
-declare const makeTargetOAuthConnectedRevocationServices: (database: any, mapping: Revocations, configuration: OAuthTargetConfiguration) => Effect.Effect<{
+export declare const makeTargetOAuthConnectedRevocationServices: (database: any, mapping: Revocations, configuration: OAuthTargetConfiguration) => Effect.Effect<{
   oauthConnectedRevocations: {
     readonly claim: <A>(input: {
       readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
@@ -746,8 +746,7 @@ declare const makeTargetOAuthConnectedRevocationServices: (database: any, mappin
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, M.OAuthUnavailable>;
   };
 }, never, LifecycleHooks>;
-declare const oauthConnectedPersistenceLayer: (services: ReturnType<typeof makeTargetOAuthConnectedServices>) => Layer.Layer<OAuthConnectedPersistence, never, LifecycleHooks>;
-declare const oauthConnectedRevocationsLayer: (services: ReturnType<typeof makeTargetOAuthConnectedRevocationServices>) => Layer.Layer<OAuthConnectedRevocations, never, LifecycleHooks>;
+export declare const oauthConnectedPersistenceLayer: (services: ReturnType<typeof makeTargetOAuthConnectedServices>) => Layer.Layer<OAuthConnectedPersistence, never, LifecycleHooks>;
+export declare const oauthConnectedRevocationsLayer: (services: ReturnType<typeof makeTargetOAuthConnectedRevocationServices>) => Layer.Layer<OAuthConnectedRevocations, never, LifecycleHooks>;
 //#endregion
-export { makeTargetOAuthConnectedRevocationServices, makeTargetOAuthConnectedServices, oauthConnectedPersistenceLayer, oauthConnectedRevocationsLayer };
 //# sourceMappingURL=oauth-connected-target.d.mts.map

package/dist/drizzle/oauth-flow.d.mts

@@ -1,5 +1,25 @@
+import { PersistenceMappingError } from "../internal/mapping-error.mjs";
 import "./model.mjs";
+import { Observation, Row } from "../internal/transaction-kernel.mjs";
 import "./transaction-owner.mjs";
-import "./oauth-owner.mjs";
+import { CurrentOAuthTransaction } from "./oauth-owner.mjs";
 import { Effect } from "effect";
-import { OAuthClaim, OAuthCleanupInput, OAuthLinkClaim, OAuthLinkPendingFlow, OAuthPendingFlow, OAuthVerifiedExternalIdentity } from "@yielded/auth/OAuth";
+import { OAuthClaim, OAuthCleanupInput, OAuthLinkClaim, OAuthLinkPendingFlow, OAuthPendingFlow, OAuthVerifiedExternalIdentity } from "@yielded/auth/OAuth";
+//#region src/drizzle/oauth-flow.d.ts
+/** Subject precedes credentials; the complete active credential vector is retained. */
+export declare const currentSubject: (mapping: any, nativeId: unknown) => Effect.Effect<{
+  subject: Observation;
+  row: Row;
+  authorities: Observation;
+  revision: {
+    readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+    readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    readonly credentials: readonly {
+      readonly credentialId: string;
+      readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    }[];
+  };
+  nativeId: unknown;
+} | undefined, import("@yielded/auth/OAuth").OAuthUnavailable | PersistenceMappingError, CurrentOAuthTransaction>;
+//#endregion
+//# sourceMappingURL=oauth-flow.d.mts.map

package/dist/drizzle/oauth-model.d.mts

@@ -7,13 +7,13 @@ import { InferInsertModel, InferSelectModel, SQL, Table } from "drizzle-orm";
 import { AuthenticationFactor } from "@yielded/auth/Operations";
 //#region src/drizzle/oauth-model.d.ts
 type Column<T extends Table> = Extract<keyof T["_"]["columns"], string>;
-type OAuthFlowState = "Pending" | "Claimed" | "Verified" | "RegistrationIssued" | "Linked" | "Cancelled" | "Rejected" | "Ambiguous" | "Conflict";
-type OAuthTupleState = "Unowned" | "Reserved" | "Owned";
-type OAuthRegistrationState = "Unbound" | "Registered" | "ProvisioningPending" | "Rejected";
-type OAuthAction = OAuthActionAuthorization["challenge"]["action"];
+export type OAuthFlowState = "Pending" | "Claimed" | "Verified" | "RegistrationIssued" | "Linked" | "Cancelled" | "Rejected" | "Ambiguous" | "Conflict";
+export type OAuthTupleState = "Unowned" | "Reserved" | "Owned";
+export type OAuthRegistrationState = "Unbound" | "Registered" | "ProvisioningPending" | "Rejected";
+export type OAuthAction = OAuthActionAuthorization["challenge"]["action"];
 /** The engine writes every critical column explicitly after applying the pure
  * consumer encoder. Native instant values must roundtrip without precision loss. */
-interface OAuthClock {
+export interface OAuthClock {
   readonly encodeInstant: (millis: number) => unknown;
   readonly decodeInstant: (value: unknown) => number;
   /** Actual engine wall clock sampled after locks, not transaction-start time.
@@ -21,7 +21,7 @@ interface OAuthClock {
    * its primary-engine sample bounds in final guards. Return integer milliseconds. */
   readonly engineNowMillis: SQL;
 }
-interface OAuthSubjectReadTable<S extends Table> {
+export interface OAuthSubjectReadTable<S extends Table> {
   readonly table: S;
   readonly id: Column<S>;
   readonly status: Column<S>;
@@ -29,12 +29,12 @@ interface OAuthSubjectReadTable<S extends Table> {
   readonly isActiveStatus: (value: unknown) => boolean;
   readonly activeCondition: SQL;
 }
-interface OAuthSubjectTable<S extends Table> extends OAuthSubjectReadTable<S> {
+export interface OAuthSubjectTable<S extends Table> extends OAuthSubjectReadTable<S> {
   readonly decodeActionRequirement: (row: InferSelectModel<S>, action: OAuthAction) => AuthenticationRequirement;
   readonly decodeAuthenticationRequirement: (row: InferSelectModel<S>) => AuthenticationRequirement;
   readonly nextSecurityRevision: (current: SecurityRevision) => SecurityRevision;
 }
-interface OAuthOwnershipReadTable<O extends Table, N> {
+export interface OAuthOwnershipReadTable<O extends Table, N> {
   readonly table: O;
   readonly identityKey: Column<O>;
   readonly provider: Column<O>;
@@ -45,14 +45,14 @@ interface OAuthOwnershipReadTable<O extends Table, N> {
   readonly ownedCondition: SQL;
   readonly decodeSubjectId: (row: InferSelectModel<O>) => N;
 }
-interface OAuthOwnershipTable<O extends Table, N> extends OAuthOwnershipReadTable<O, N> {
+export interface OAuthOwnershipTable<O extends Table, N> extends OAuthOwnershipReadTable<O, N> {
   readonly encodeInsert: (input: {
     readonly identity: typeof OAuthExternalIdentity.Type;
     readonly identityKey: string;
     readonly subjectId: N;
   }) => InferInsertModel<O>;
 }
-interface OAuthCredentialReadTable<C extends Table> {
+export interface OAuthCredentialReadTable<C extends Table> {
   readonly table: C;
   readonly moduleId: Column<C>;
   readonly credentialId: Column<C>;
@@ -63,7 +63,7 @@ interface OAuthCredentialReadTable<C extends Table> {
   readonly isActiveStatus: (value: unknown) => boolean;
   readonly activeCondition: SQL;
 }
-interface OAuthCredentialTable<C extends Table, N> extends OAuthCredentialReadTable<C> {
+export interface OAuthCredentialTable<C extends Table, N> extends OAuthCredentialReadTable<C> {
   readonly encodeInsert: (input: {
     readonly moduleId: string;
     readonly subjectId: N;
@@ -74,7 +74,7 @@ interface OAuthCredentialTable<C extends Table, N> extends OAuthCredentialReadTa
   /** This slice removes login rows. Historical records belong in separate audit storage. */
   readonly removal: "delete";
 }
-interface OAuthAuthorityReadTable<C extends Table> {
+export interface OAuthAuthorityReadTable<C extends Table> {
   readonly table: C;
   readonly subjectId: Column<C>;
   readonly credentialId: Column<C>;
@@ -83,7 +83,7 @@ interface OAuthAuthorityReadTable<C extends Table> {
   readonly isActiveStatus: (value: unknown) => boolean;
   readonly activeCondition: SQL;
 }
-interface OAuthAuthorityTable<C extends Table, N> extends OAuthAuthorityReadTable<C> {
+export interface OAuthAuthorityTable<C extends Table, N> extends OAuthAuthorityReadTable<C> {
   readonly encodeInsert: (input: {
     readonly subjectId: N;
     readonly credentialId: string;
@@ -93,7 +93,7 @@ interface OAuthAuthorityTable<C extends Table, N> extends OAuthAuthorityReadTabl
 /** Both purposes may use the same physical table. Shared tables share module/flow
  * and module/command uniqueness. The snapshot has the exact purpose-specific core
  * codec; terminal writes erase it, while identity, claim and retention columns remain. */
-interface OAuthFlowTable<F extends Table> {
+export interface OAuthFlowTable<F extends Table> {
   readonly table: F;
   readonly moduleId: Column<F>;
   readonly flowId: Column<F>;
@@ -118,7 +118,7 @@ interface OAuthFlowTable<F extends Table> {
     readonly purpose: "sign-in" | "link";
   }) => InferInsertModel<F>;
 }
-interface OAuthTupleAuthorityTable<T extends Table, N> {
+export interface OAuthTupleAuthorityTable<T extends Table, N> {
   readonly table: T;
   readonly identityKey: Column<T>;
   readonly provider: Column<T>;
@@ -135,7 +135,7 @@ interface OAuthTupleAuthorityTable<T extends Table, N> {
     readonly subjectId?: N;
   }) => InferInsertModel<T>;
 }
-interface OAuthRegistrationIntentTable<I extends Table> {
+export interface OAuthRegistrationIntentTable<I extends Table> {
   readonly table: I;
   readonly moduleId: Column<I>;
   readonly reference: Column<I>;
@@ -152,7 +152,7 @@ interface OAuthRegistrationIntentTable<I extends Table> {
   readonly retentionUntil: Column<I>;
   readonly encodeInsert: (intent: OAuthRegistrationIntent) => InferInsertModel<I>;
 }
-interface OAuthRegistrationCommandTable<R extends Table, Registration> {
+export interface OAuthRegistrationCommandTable<R extends Table, Registration> {
   readonly table: R;
   readonly moduleId: Column<R>;
   readonly commandId: Column<R>;
@@ -173,7 +173,7 @@ interface OAuthRegistrationCommandTable<R extends Table, Registration> {
     readonly provisioningIdentity: string;
   }) => InferInsertModel<R>;
 }
-interface OAuthUnlinkCommandTable<U extends Table> {
+export interface OAuthUnlinkCommandTable<U extends Table> {
   readonly table: U;
   readonly moduleId: Column<U>;
   readonly commandId: Column<U>;
@@ -188,7 +188,7 @@ interface OAuthUnlinkCommandTable<U extends Table> {
     readonly credential: OAuthCredentialSnapshot;
   }) => InferInsertModel<U>;
 }
-interface OAuthEligibilityFact {
+export interface OAuthEligibilityFact {
   readonly credentialId: string;
   readonly revision: SecurityRevision;
   readonly usablePrimary: boolean;
@@ -201,7 +201,7 @@ interface OAuthEligibilityFact {
  * All source/identifier/policy mutations advance subject securityRevision. D1 also
  * guards exact selected IDs/versions and absence/count assumptions, never just a
  * stale boolean. An over-limit graph fails closed rather than truncating. */
-interface OAuthEligibilityTable<T extends Table, N> {
+export interface OAuthEligibilityTable<T extends Table, N> {
   readonly table: T;
   readonly subjectId: Column<T>;
   readonly credentialId: Column<T>;
@@ -212,10 +212,10 @@ interface OAuthEligibilityTable<T extends Table, N> {
 }
 /** Authenticated command replay uses current subject status and this additional
  * nonconsuming SQL policy. It never consumes a fresh action factor. */
-interface OAuthMetadataPolicy<N> {
+export interface OAuthMetadataPolicy<N> {
   readonly condition: (subjectId: N) => SQL;
 }
-interface OAuthCleanupTable<T extends Table, N> {
+export interface OAuthCleanupTable<T extends Table, N> {
   readonly table: T;
   readonly subjectId: Column<T>;
   /** Bound to this subject's old revision; no opaque independently committing service. */
@@ -226,19 +226,19 @@ interface OAuthCleanupTable<T extends Table, N> {
   }) => SQL;
   readonly disposition: "delete";
 }
-interface OAuthRegistrationEligibility<N> {
+export interface OAuthRegistrationEligibility<N> {
   /** Pure SQL guards for mutable app policy; evaluated again after app writes. */
   readonly condition: (input: {
     readonly intent: OAuthRegistrationIntent;
     readonly nativeSubjectId?: N;
   }) => SQL;
 }
-interface OAuthD1Mapping {
+export interface OAuthD1Mapping {
   readonly d1: {
     readonly primary: true;
   };
 }
-declare const requiredOAuthSignInConstraints: {
+export declare const requiredOAuthSignInConstraints: {
   readonly flow: "unique(flow.moduleId,flow.flowId)";
   readonly command: "unique(flow.moduleId,flow.commandId)";
   readonly stateDigest: "unique(flow.stateDigest)";
@@ -247,18 +247,18 @@ declare const requiredOAuthSignInConstraints: {
   readonly credentialIdentity: "unique(credential.identityKey)";
   readonly authorityCredential: "unique(authority.subjectId,authority.credentialId)";
 };
-declare const requiredOAuthTupleConstraints: {
+export declare const requiredOAuthTupleConstraints: {
   readonly identityKey: "unique(tuple.identityKey)";
 };
-declare const requiredOAuthRegistrationConstraints: {
+export declare const requiredOAuthRegistrationConstraints: {
   readonly intentReference: "unique(intent.moduleId,intent.reference)";
   readonly intentFlow: "unique(intent.moduleId,intent.flowId)";
   readonly command: "unique(registrationCommand.moduleId,registrationCommand.commandId)";
 };
-declare const requiredOAuthAccountsConstraints: {
+export declare const requiredOAuthAccountsConstraints: {
   readonly unlinkCommand: "unique(unlinkCommand.moduleId,unlinkCommand.commandId)";
 };
-interface OAuthSignInMapping<S extends Table, O extends Table, C extends Table, AC extends Table, F extends Table, N> {
+export interface OAuthSignInMapping<S extends Table, O extends Table, C extends Table, AC extends Table, F extends Table, N> {
   readonly subject: OAuthSubjectReadTable<S>;
   readonly ownership: OAuthOwnershipReadTable<O, N>;
   readonly credential: OAuthCredentialReadTable<C>;
@@ -268,7 +268,7 @@ interface OAuthSignInMapping<S extends Table, O extends Table, C extends Table,
   readonly clock: OAuthClock;
   readonly constraints: typeof requiredOAuthSignInConstraints;
 }
-type OAuthOwnershipMutation<T extends Table, O extends Table, N> = {
+export type OAuthOwnershipMutation<T extends Table, O extends Table, N> = {
   readonly mode: "integrated";
   readonly tuple: OAuthTupleAuthorityTable<T, N>;
 } | {
@@ -276,7 +276,7 @@ type OAuthOwnershipMutation<T extends Table, O extends Table, N> = {
   readonly tuple: OAuthTupleAuthorityTable<T, N>;
   readonly external: OAuthOwnershipTable<O, N>;
 };
-interface OAuthRegistrationIntentMapping<S extends Table, O extends Table, C extends Table, AC extends Table, F extends Table, T extends Table, I extends Table, N> {
+export interface OAuthRegistrationIntentMapping<S extends Table, O extends Table, C extends Table, AC extends Table, F extends Table, T extends Table, I extends Table, N> {
   readonly signIn: OAuthSignInMapping<S, O, C, AC, F, N>;
   readonly ownership: OAuthOwnershipMutation<T, O, N>;
   readonly intent: OAuthRegistrationIntentTable<I>;
@@ -284,7 +284,7 @@ interface OAuthRegistrationIntentMapping<S extends Table, O extends Table, C ext
   readonly registrationConstraints: Pick<typeof requiredOAuthRegistrationConstraints, "intentReference" | "intentFlow">;
   readonly eligibility: OAuthRegistrationEligibility<N>;
 }
-interface OAuthRegistrationBase<Registration, T extends Table, O extends Table, I extends Table, R extends Table, N> {
+export interface OAuthRegistrationBase<Registration, T extends Table, O extends Table, I extends Table, R extends Table, N> {
   readonly ownership: OAuthOwnershipMutation<T, O, N>;
   readonly intent: OAuthRegistrationIntentTable<I>;
   readonly command: OAuthRegistrationCommandTable<R, Registration>;
@@ -339,7 +339,7 @@ interface OAuthRegistrationBase<Registration, T extends Table, O extends Table,
   readonly allocateProvisioningIdentity: Effect.Effect<string, PersistenceMappingError>;
   readonly retentionMillis: number;
 }
-interface OAuthRegistrationGuardTable<T extends Table, Registration, N> {
+export interface OAuthRegistrationGuardTable<T extends Table, Registration, N> {
   readonly table: T;
   readonly orderBy: Column<T>;
   readonly condition: (input: {
@@ -348,13 +348,13 @@ interface OAuthRegistrationGuardTable<T extends Table, Registration, N> {
     readonly nativeSubjectId?: N;
   }) => SQL;
 }
-interface OAuthRegistrationGuardDescriptor<Registration, N> {
+export interface OAuthRegistrationGuardDescriptor<Registration, N> {
   readonly table: Table;
   readonly orderBy: string;
   readonly condition: OAuthRegistrationGuardTable<Table, Registration, N>["condition"];
 }
-declare const oauthRegistrationGuardTable: <T extends Table, Registration, N>(input: OAuthRegistrationGuardTable<T, Registration, N>) => OAuthRegistrationGuardDescriptor<Registration, N>;
-type OAuthRegistrationMapping<Registration, S extends Table, O extends Table, C extends Table, AC extends Table, T extends Table, I extends Table, R extends Table, N> = OAuthRegistrationBase<Registration, T, O, I, R, N> & ({
+export declare const oauthRegistrationGuardTable: <T extends Table, Registration, N>(input: OAuthRegistrationGuardTable<T, Registration, N>) => OAuthRegistrationGuardDescriptor<Registration, N>;
+export type OAuthRegistrationMapping<Registration, S extends Table, O extends Table, C extends Table, AC extends Table, T extends Table, I extends Table, R extends Table, N> = OAuthRegistrationBase<Registration, T, O, I, R, N> & ({
   readonly mode: "pending";
   readonly allocatePendingReference: Effect.Effect<string, PersistenceMappingError>;
 } | {
@@ -375,7 +375,7 @@ type OAuthRegistrationMapping<Registration, S extends Table, O extends Table, C
   }) => InferInsertModel<S>;
 });
 /** Heterogeneous descriptors are made by typed factories and projected privately. */
-interface OAuthEligibilityDescriptor<N> {
+export interface OAuthEligibilityDescriptor<N> {
   readonly _tag: "OAuthEligibilityDescriptor";
   readonly scope: string;
   readonly table: Table;
@@ -385,17 +385,17 @@ interface OAuthEligibilityDescriptor<N> {
   readonly condition: (subjectId: N) => SQL;
   readonly decode: (row: unknown) => OAuthEligibilityFact | undefined;
 }
-declare const oauthEligibilityTable: <T extends Table, N>(input: OAuthEligibilityTable<T, N>) => OAuthEligibilityDescriptor<N>;
-interface OAuthCleanupDescriptor<N> {
+export declare const oauthEligibilityTable: <T extends Table, N>(input: OAuthEligibilityTable<T, N>) => OAuthEligibilityDescriptor<N>;
+export interface OAuthCleanupDescriptor<N> {
   readonly table: Table;
   readonly subjectId: string;
   readonly condition: OAuthCleanupTable<Table, N>["condition"];
 }
-declare const oauthCleanupTable: <T extends Table, N>(input: OAuthCleanupTable<T, N>) => OAuthCleanupDescriptor<N>;
+export declare const oauthCleanupTable: <T extends Table, N>(input: OAuthCleanupTable<T, N>) => OAuthCleanupDescriptor<N>;
 /** A stable application/reference lock acquired before an ownership target.
  * Missing rows retain ownership. Conditions are synchronous and use detached
  * native IDs; every writer of the guarded reference follows the same order. */
-interface OAuthReferenceGuardTable<T extends Table, N> {
+export interface OAuthReferenceGuardTable<T extends Table, N> {
   readonly table: T;
   readonly orderBy: Column<T>;
   readonly condition: (input: {
@@ -404,13 +404,13 @@ interface OAuthReferenceGuardTable<T extends Table, N> {
     readonly subjectId: N;
   }) => SQL;
 }
-interface OAuthReferenceGuardDescriptor<N> {
+export interface OAuthReferenceGuardDescriptor<N> {
   readonly table: Table;
   readonly orderBy: string;
   readonly condition: OAuthReferenceGuardTable<Table, N>["condition"];
 }
-declare const oauthReferenceGuardTable: <T extends Table, N>(input: OAuthReferenceGuardTable<T, N>) => OAuthReferenceGuardDescriptor<N>;
-interface OAuthAccountsMapping<S extends Table, O extends Table, C extends Table, AC extends Table, F extends Table, T extends Table, U extends Table, N> {
+export declare const oauthReferenceGuardTable: <T extends Table, N>(input: OAuthReferenceGuardTable<T, N>) => OAuthReferenceGuardDescriptor<N>;
+export interface OAuthAccountsMapping<S extends Table, O extends Table, C extends Table, AC extends Table, F extends Table, T extends Table, U extends Table, N> {
   readonly subject: OAuthSubjectTable<S>;
   readonly ownership: OAuthOwnershipMutation<T, O, N>;
   readonly credential: OAuthCredentialTable<C, N>;
@@ -437,7 +437,7 @@ interface OAuthAccountsMapping<S extends Table, O extends Table, C extends Table
   readonly allocateCredentialId: Effect.Effect<string, PersistenceMappingError>;
   readonly allocateRevision: Effect.Effect<SecurityRevision, PersistenceMappingError>;
 }
-interface OAuthRegistrationAuthority<Registration> {
+export interface OAuthRegistrationAuthority<Registration> {
   readonly read: (access: import("@yielded/auth/OAuth").OAuthRegistrationAccess) => Effect.Effect<import("@yielded/auth/OAuth").OAuthRegistrationInspection | undefined, import("@yielded/auth/OAuth").OAuthUnavailable>;
   readonly inspect: (input: {
     readonly intent: OAuthRegistrationIntent;
@@ -459,5 +459,4 @@ interface OAuthRegistrationAuthority<Registration> {
   }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
 }
 //#endregion
-export { OAuthAccountsMapping, OAuthAction, OAuthAuthorityReadTable, OAuthAuthorityTable, OAuthCleanupDescriptor, OAuthCleanupTable, OAuthClock, OAuthCredentialReadTable, OAuthCredentialTable, OAuthD1Mapping, OAuthEligibilityDescriptor, OAuthEligibilityFact, OAuthEligibilityTable, OAuthFlowState, OAuthFlowTable, OAuthMetadataPolicy, OAuthOwnershipMutation, OAuthOwnershipReadTable, OAuthOwnershipTable, OAuthReferenceGuardDescriptor, OAuthReferenceGuardTable, OAuthRegistrationAuthority, OAuthRegistrationBase, OAuthRegistrationCommandTable, OAuthRegistrationEligibility, OAuthRegistrationGuardDescriptor, OAuthRegistrationGuardTable, OAuthRegistrationIntentMapping, OAuthRegistrationIntentTable, OAuthRegistrationMapping, OAuthRegistrationState, OAuthSignInMapping, OAuthSubjectReadTable, OAuthSubjectTable, OAuthTupleAuthorityTable, OAuthTupleState, OAuthUnlinkCommandTable, oauthCleanupTable, oauthEligibilityTable, oauthReferenceGuardTable, oauthRegistrationGuardTable, requiredOAuthAccountsConstraints, requiredOAuthRegistrationConstraints, requiredOAuthSignInConstraints, requiredOAuthTupleConstraints };
 //# sourceMappingURL=oauth-model.d.mts.map

package/dist/drizzle/oauth-owner.d.mts

@@ -1,4 +1,12 @@
+import { Observation, Row, TransactionOwner } from "../internal/transaction-kernel.mjs";
 import "./transaction-owner.mjs";
 import { Context } from "effect";
-import "@yielded/auth/Hooks";
-import { OAuthUnavailable } from "@yielded/auth/OAuth";
+import { CommitJournal } from "@yielded/auth/Hooks";
+import { OAuthUnavailable } from "@yielded/auth/OAuth";
+//#region src/drizzle/oauth-owner.d.ts
+export type OAuthOwner = TransactionOwner<OAuthUnavailable>;
+declare const CurrentOAuthTransaction_base: Context.ServiceClass<CurrentOAuthTransaction, "effect-auth/drizzle/CurrentOAuthTransaction", OAuthOwner>;
+export declare class CurrentOAuthTransaction extends CurrentOAuthTransaction_base {}
+//#endregion
+export type { Row };
+//# sourceMappingURL=oauth-owner.d.mts.map

package/dist/drizzle/oauth-target.d.mts

@@ -9,9 +9,9 @@ import { LifecycleHooks } from "@yielded/auth/Hooks";
 import { OAuthAccountRevision, OAuthAccountsPersistence, OAuthClaim, OAuthClaimDecision, OAuthCleanupInput, OAuthCredentialSnapshot, OAuthIssueDecision, OAuthLinkClaimDecision, OAuthLinkDecision, OAuthLinkIssueDecision, OAuthLinkPendingFlow, OAuthPendingFlow, OAuthRegistrationIntent, OAuthRegistrationIntents, OAuthSettlementDecision, OAuthSignInPersistence, OAuthUnavailable, OAuthUnlinkDecision, OAuthUnlinkInspection, OAuthVerifiedExternalIdentity, PrepareOAuthCommit } from "@yielded/auth/OAuth";
 import { Statement } from "effect/unstable/sql/Statement";
 //#region src/drizzle/oauth-target.d.ts
-type OAuthTargetConfiguration = TransactionTargetConfiguration<OAuthUnavailable>;
-type OAuthCoordinatorError<E> = TransactionCoordinatorError<E, OAuthUnavailable>;
-declare const makeTargetOAuthSignInServices: (database: any, mapping: any, configuration: OAuthTargetConfiguration) => Effect.Effect<{
+export type OAuthTargetConfiguration = TransactionTargetConfiguration<OAuthUnavailable>;
+export type OAuthCoordinatorError<E> = TransactionCoordinatorError<E, OAuthUnavailable>;
+export declare const makeTargetOAuthSignInServices: (database: any, mapping: any, configuration: OAuthTargetConfiguration) => Effect.Effect<{
   oauthSignInPersistence: {
     readonly issue: <A>(input: OAuthPendingFlow, prepare: PrepareOAuthCommit<OAuthIssueDecision, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, OAuthUnavailable>;
     readonly claim: <A>(input: {
@@ -44,7 +44,7 @@ declare const makeTargetOAuthSignInServices: (database: any, mapping: any, confi
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, OAuthUnavailable>;
   };
 }, never, LifecycleHooks>;
-declare const makeTargetOAuthRegistrationIntentServices: (database: any, mapping: any, configuration: OAuthTargetConfiguration) => Effect.Effect<{
+export declare const makeTargetOAuthRegistrationIntentServices: (database: any, mapping: any, configuration: OAuthTargetConfiguration) => Effect.Effect<{
   oauthRegistrationIntents: {
     readonly settle: <A>(input: {
       readonly claim: OAuthClaim;
@@ -54,7 +54,7 @@ declare const makeTargetOAuthRegistrationIntentServices: (database: any, mapping
     }, prepare: PrepareOAuthCommit<import("@yielded/auth/OAuth").OAuthRegistrationSettlement, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, OAuthUnavailable>;
   };
 }, never, LifecycleHooks>;
-declare const makeTargetOAuthAccountsServices: (database: any, mapping: any, configuration: OAuthTargetConfiguration) => Effect.Effect<{
+export declare const makeTargetOAuthAccountsServices: (database: any, mapping: any, configuration: OAuthTargetConfiguration) => Effect.Effect<{
   oauthAccountsPersistence: {
     readonly capture: (input: {
       readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
@@ -100,12 +100,11 @@ declare const makeTargetOAuthAccountsServices: (database: any, mapping: any, con
     }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, OAuthUnavailable>;
   };
 }, never, LifecycleHooks>;
-declare const oauthAccountsPersistenceLayer: (services: ReturnType<typeof makeTargetOAuthAccountsServices>) => Layer.Layer<OAuthAccountsPersistence, never, LifecycleHooks>;
-declare const oauthSignInPersistenceLayer: (services: ReturnType<typeof makeTargetOAuthSignInServices>) => Layer.Layer<OAuthSignInPersistence, never, LifecycleHooks>;
-declare const oauthRegistrationIntentsLayer: (services: ReturnType<typeof makeTargetOAuthRegistrationIntentServices>) => Layer.Layer<OAuthRegistrationIntents, never, LifecycleHooks>;
-declare const oauthRegistrationAuthorityLayer: <Id, Registration>(tag: Context.Key<Id, OAuthRegistrationAuthority<Registration>>, services: Effect.Effect<{
+export declare const oauthAccountsPersistenceLayer: (services: ReturnType<typeof makeTargetOAuthAccountsServices>) => Layer.Layer<OAuthAccountsPersistence, never, LifecycleHooks>;
+export declare const oauthSignInPersistenceLayer: (services: ReturnType<typeof makeTargetOAuthSignInServices>) => Layer.Layer<OAuthSignInPersistence, never, LifecycleHooks>;
+export declare const oauthRegistrationIntentsLayer: (services: ReturnType<typeof makeTargetOAuthRegistrationIntentServices>) => Layer.Layer<OAuthRegistrationIntents, never, LifecycleHooks>;
+export declare const oauthRegistrationAuthorityLayer: <Id, Registration>(tag: Context.Key<Id, OAuthRegistrationAuthority<Registration>>, services: Effect.Effect<{
   readonly registrationAuthority: OAuthRegistrationAuthority<Registration>;
 }, never, LifecycleHooks>) => Layer.Layer<Id, never, LifecycleHooks>;
 //#endregion
-export { OAuthCoordinatorError, OAuthTargetConfiguration, makeTargetOAuthAccountsServices, makeTargetOAuthRegistrationIntentServices, makeTargetOAuthSignInServices, oauthAccountsPersistenceLayer, oauthRegistrationAuthorityLayer, oauthRegistrationIntentsLayer, oauthSignInPersistenceLayer };
 //# sourceMappingURL=oauth-target.d.mts.map