@yielded/auth 0.1.0-beta.1

package/dist/drizzle/oauth-input.mjs

@@ -0,0 +1,130 @@
+import { SessionInvalidationWindow } from "../sessions/invalidation.mjs";
+import { OAuthClaim, OAuthClaimId, OAuthCleanupInput, OAuthCommandId, OAuthCredentialSnapshot, OAuthInstant, OAuthModuleId, OAuthPendingFlow, OAuthSignInTransactionContext, OAuthVerifiedExternalIdentity } from "../oauth/signInModels.mjs";
+import { OAuthAccountRevision, OAuthActionAuthorization, OAuthLinkAccess, OAuthLinkClaim, OAuthLinkOutcome, OAuthLinkPendingFlow } from "../oauth/accountsModels.mjs";
+import { OAuthRegistrationAccess, OAuthRegistrationFingerprint, OAuthRegistrationIntent } from "../oauth/registrationModels.mjs";
+import { snapshotOAuthSync } from "../oauth/signInSnapshot.mjs";
+import { invariant, unavailable } from "./oauth-state.mjs";
+import { Effect, Schema } from "effect";
+//#region src/drizzle/oauth-input.ts
+const fields = OAuthSignInTransactionContext.fields;
+const claimInput = Schema.Struct({
+	moduleId: fields.moduleId,
+	generation: fields.generation,
+	flowId: fields.flowId,
+	provider: fields.provider,
+	callbackId: fields.callbackId,
+	stateDigest: fields.stateDigest,
+	requestBindingVerifier: fields.requestBindingVerifier,
+	requestBindingExpiresAtMillis: fields.requestBindingExpiresAtMillis,
+	responseIssuer: Schema.optionalKey(fields.issuer),
+	claimId: OAuthClaimId,
+	nowMillis: OAuthInstant
+});
+const signInOutcome = Schema.Union([
+	Schema.TaggedStruct("Verified", { identity: OAuthVerifiedExternalIdentity }),
+	Schema.TaggedStruct("Cancelled", {}),
+	Schema.TaggedStruct("Rejected", {}),
+	Schema.TaggedStruct("Ambiguous", {})
+]);
+const signInSettle = Schema.Struct({
+	claim: OAuthClaim,
+	outcome: signInOutcome,
+	nowMillis: OAuthInstant
+});
+const registrationSettle = Schema.Struct({
+	claim: OAuthClaim,
+	identity: OAuthVerifiedExternalIdentity,
+	intent: Schema.optionalKey(OAuthRegistrationIntent),
+	nowMillis: OAuthInstant
+});
+const registerPrivate = Schema.Struct({
+	access: OAuthRegistrationAccess,
+	intent: OAuthRegistrationIntent,
+	commandId: OAuthCommandId,
+	fingerprint: OAuthRegistrationFingerprint
+});
+const capture = Schema.Struct({
+	moduleId: OAuthModuleId,
+	subjectId: OAuthAccountRevision.fields.subjectId
+});
+const linkIssue = Schema.Struct({
+	flow: OAuthLinkPendingFlow,
+	authorization: OAuthActionAuthorization
+});
+const linkClaim = Schema.Struct({
+	access: OAuthLinkAccess,
+	flow: OAuthLinkPendingFlow,
+	claimId: OAuthClaimId,
+	authorization: OAuthActionAuthorization
+});
+const linkSettle = Schema.Struct({
+	claim: OAuthLinkClaim,
+	outcome: OAuthLinkOutcome,
+	authorization: OAuthActionAuthorization,
+	invalidation: SessionInvalidationWindow,
+	nowMillis: OAuthInstant
+});
+const unlinkInspect = Schema.Struct({
+	moduleId: OAuthModuleId,
+	subjectId: OAuthAccountRevision.fields.subjectId,
+	commandId: OAuthCommandId,
+	credentialId: OAuthCredentialSnapshot.fields.credentialId
+});
+const unlink = Schema.Struct({
+	moduleId: OAuthModuleId,
+	commandId: OAuthCommandId,
+	credential: OAuthCredentialSnapshot,
+	authorization: OAuthActionAuthorization,
+	invalidation: SessionInvalidationWindow,
+	nowMillis: OAuthInstant,
+	retentionUntilMillis: OAuthInstant
+});
+const snapshot = (schema) => (input) => snapshotOAuthSync(schema, input);
+const signInInputs = {
+	issue: snapshot(OAuthPendingFlow),
+	claim: snapshot(claimInput),
+	settle: snapshot(signInSettle),
+	cleanup: snapshot(OAuthCleanupInput)
+};
+const registrationIntentInputs = { settle: snapshot(registrationSettle) };
+const capturedApplication = (application, data) => {
+	const encoded = application.encode(data);
+	invariant(typeof encoded === "string" && new TextEncoder().encode(encoded).length <= 1048576);
+	const retained = application.decode(encoded);
+	invariant(application.encode(retained) === encoded);
+	return retained;
+};
+const registrationInputs = (application) => ({
+	read: snapshot(OAuthRegistrationAccess),
+	inspect: (input) => ({
+		intent: snapshotOAuthSync(OAuthRegistrationIntent, input.intent),
+		registration: capturedApplication(application, input.registration)
+	}),
+	register: (input) => ({
+		...snapshotOAuthSync(registerPrivate, input),
+		registration: capturedApplication(application, input.registration)
+	}),
+	cleanup: snapshot(OAuthCleanupInput)
+});
+const accountsInputs = {
+	capture: snapshot(capture),
+	issue: snapshot(linkIssue),
+	preflight: snapshot(OAuthLinkAccess),
+	claim: snapshot(linkClaim),
+	settle: snapshot(linkSettle),
+	inspectUnlink: snapshot(unlinkInspect),
+	unlink: snapshot(unlink),
+	cleanup: snapshot(OAuthCleanupInput)
+};
+/** Snapshot before the first asynchronous owner/allocator step; closed bound
+* authorities reject before running even an application codec or inspector. */
+const capturedOAuthService = (service, inputs, active, poison) => Object.freeze(Object.fromEntries(Object.entries(service).map(([key, method]) => [key, (input, prepare) => Effect.suspend(() => {
+	if (!active()) return Effect.fail(unavailable());
+	return method(inputs[key](input), prepare);
+}).pipe(Effect.onExit((exit) => Effect.sync(() => {
+	if (exit._tag === "Failure") poison();
+})), Effect.catchDefect(() => Effect.fail(unavailable())))])));
+//#endregion
+export { accountsInputs, capturedOAuthService, registrationInputs, registrationIntentInputs, signInInputs };
+
+//# sourceMappingURL=oauth-input.mjs.map

package/dist/drizzle/oauth-input.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-input.mjs","names":[],"sources":["../../src/drizzle/oauth-input.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- private adapter wraps only the Effect-valued semantic ports. */\nimport { Effect, Schema } from \"effect\";\n\nimport {\n  OAuthAccountRevision,\n  OAuthActionAuthorization,\n  OAuthLinkAccess,\n  OAuthLinkClaim,\n  OAuthLinkOutcome,\n  OAuthLinkPendingFlow,\n} from \"../oauth/accountsModels\";\nimport {\n  OAuthRegistrationAccess,\n  OAuthRegistrationFingerprint,\n  OAuthRegistrationIntent,\n} from \"../oauth/registrationModels\";\nimport type { OAuthUnavailable } from \"../oauth/signInErrors\";\nimport {\n  OAuthClaim,\n  OAuthClaimId,\n  OAuthCleanupInput,\n  OAuthCommandId,\n  OAuthCredentialSnapshot,\n  OAuthInstant,\n  OAuthModuleId,\n  OAuthPendingFlow,\n  OAuthSignInTransactionContext,\n  OAuthVerifiedExternalIdentity,\n} from \"../oauth/signInModels\";\nimport { snapshotOAuthSync } from \"../oauth/signInSnapshot\";\nimport { SessionInvalidationWindow } from \"../sessions/invalidation\";\nimport { invariant, unavailable } from \"./oauth-state\";\n\nconst fields = OAuthSignInTransactionContext.fields;\n\nconst claimInput = Schema.Struct({\n  moduleId: fields.moduleId,\n  generation: fields.generation,\n  flowId: fields.flowId,\n  provider: fields.provider,\n  callbackId: fields.callbackId,\n  stateDigest: fields.stateDigest,\n  requestBindingVerifier: fields.requestBindingVerifier,\n  requestBindingExpiresAtMillis: fields.requestBindingExpiresAtMillis,\n  responseIssuer: Schema.optionalKey(fields.issuer),\n  claimId: OAuthClaimId,\n  nowMillis: OAuthInstant,\n});\n\nconst signInOutcome = Schema.Union([\n  Schema.TaggedStruct(\"Verified\", { identity: OAuthVerifiedExternalIdentity }),\n  Schema.TaggedStruct(\"Cancelled\", {}),\n  Schema.TaggedStruct(\"Rejected\", {}),\n  Schema.TaggedStruct(\"Ambiguous\", {}),\n]);\n\nconst signInSettle = Schema.Struct({\n  claim: OAuthClaim,\n  outcome: signInOutcome,\n  nowMillis: OAuthInstant,\n});\n\nconst registrationSettle = Schema.Struct({\n  claim: OAuthClaim,\n  identity: OAuthVerifiedExternalIdentity,\n  intent: Schema.optionalKey(OAuthRegistrationIntent),\n  nowMillis: OAuthInstant,\n});\n\nconst registerPrivate = Schema.Struct({\n  access: OAuthRegistrationAccess,\n  intent: OAuthRegistrationIntent,\n  commandId: OAuthCommandId,\n  fingerprint: OAuthRegistrationFingerprint,\n});\n\nconst capture = Schema.Struct({\n  moduleId: OAuthModuleId,\n  subjectId: OAuthAccountRevision.fields.subjectId,\n});\n\nconst linkIssue = Schema.Struct({\n  flow: OAuthLinkPendingFlow,\n  authorization: OAuthActionAuthorization,\n});\n\nconst linkClaim = Schema.Struct({\n  access: OAuthLinkAccess,\n  flow: OAuthLinkPendingFlow,\n  claimId: OAuthClaimId,\n  authorization: OAuthActionAuthorization,\n});\n\nconst linkSettle = Schema.Struct({\n  claim: OAuthLinkClaim,\n  outcome: OAuthLinkOutcome,\n  authorization: OAuthActionAuthorization,\n  invalidation: SessionInvalidationWindow,\n  nowMillis: OAuthInstant,\n});\n\nconst unlinkInspect = Schema.Struct({\n  moduleId: OAuthModuleId,\n  subjectId: OAuthAccountRevision.fields.subjectId,\n  commandId: OAuthCommandId,\n  credentialId: OAuthCredentialSnapshot.fields.credentialId,\n});\n\nconst unlink = Schema.Struct({\n  moduleId: OAuthModuleId,\n  commandId: OAuthCommandId,\n  credential: OAuthCredentialSnapshot,\n  authorization: OAuthActionAuthorization,\n  invalidation: SessionInvalidationWindow,\n  nowMillis: OAuthInstant,\n  retentionUntilMillis: OAuthInstant,\n});\n\nconst snapshot = (schema: Schema.Codec<any, any, never, never>) => (input: any) =>\n  snapshotOAuthSync(schema, input);\n\nexport const signInInputs = {\n  issue: snapshot(OAuthPendingFlow),\n  claim: snapshot(claimInput),\n  settle: snapshot(signInSettle),\n  cleanup: snapshot(OAuthCleanupInput),\n};\n\nexport const registrationIntentInputs = { settle: snapshot(registrationSettle) };\n\nconst capturedApplication = (\n  application: { readonly encode: (data: any) => string; readonly decode: (stored: string) => any },\n  data: any,\n) => {\n  const encoded = application.encode(data);\n\n  invariant(typeof encoded === \"string\" && new TextEncoder().encode(encoded).length <= 1048576);\n  const retained = application.decode(encoded);\n\n  invariant(application.encode(retained) === encoded);\n\n  return retained;\n};\n\nexport const registrationInputs = (application: {\n  readonly encode: (data: any) => string;\n  readonly decode: (stored: string) => any;\n}) => ({\n  read: snapshot(OAuthRegistrationAccess),\n  inspect: (input: any) => ({\n    intent: snapshotOAuthSync(OAuthRegistrationIntent, input.intent),\n    registration: capturedApplication(application, input.registration),\n  }),\n  register: (input: any) => ({\n    ...snapshotOAuthSync(registerPrivate, input),\n    registration: capturedApplication(application, input.registration),\n  }),\n  cleanup: snapshot(OAuthCleanupInput),\n});\n\nexport const accountsInputs = {\n  capture: snapshot(capture),\n  issue: snapshot(linkIssue),\n  preflight: snapshot(OAuthLinkAccess),\n  claim: snapshot(linkClaim),\n  settle: snapshot(linkSettle),\n  inspectUnlink: snapshot(unlinkInspect),\n  unlink: snapshot(unlink),\n  cleanup: snapshot(OAuthCleanupInput),\n};\n\n/** Snapshot before the first asynchronous owner/allocator step; closed bound\n * authorities reject before running even an application codec or inspector. */\nexport const capturedOAuthService = <\n  S extends { [K in keyof S]: (...args: any[]) => Effect.Effect<any, OAuthUnavailable> },\n>(\n  service: S,\n  inputs: { readonly [K in keyof S]: (input: any) => any },\n  active: () => boolean,\n  poison: () => void,\n): S =>\n  Object.freeze(\n    Object.fromEntries(\n      Object.entries(service).map(([key, method]) => [\n        key,\n        (input: any, prepare?: any) =>\n          Effect.suspend(() => {\n            if (!active()) return Effect.fail(unavailable());\n            const retained = inputs[key as keyof S](input);\n\n            return (method as (...args: any[]) => Effect.Effect<any, OAuthUnavailable>)(\n              retained,\n              prepare,\n            );\n          }).pipe(\n            Effect.onExit((exit) =>\n              Effect.sync(() => {\n                if (exit._tag === \"Failure\") poison();\n              }),\n            ),\n            Effect.catchDefect(() => Effect.fail(unavailable())),\n          ),\n      ]),\n    ),\n  ) as S;\n"],"mappings":";;;;;;;;AAiCA,MAAM,SAAS,8BAA8B;AAE7C,MAAM,aAAa,OAAO,OAAO;CAC/B,UAAU,OAAO;CACjB,YAAY,OAAO;CACnB,QAAQ,OAAO;CACf,UAAU,OAAO;CACjB,YAAY,OAAO;CACnB,aAAa,OAAO;CACpB,wBAAwB,OAAO;CAC/B,+BAA+B,OAAO;CACtC,gBAAgB,OAAO,YAAY,OAAO,MAAM;CAChD,SAAS;CACT,WAAW;AACb,CAAC;AAED,MAAM,gBAAgB,OAAO,MAAM;CACjC,OAAO,aAAa,YAAY,EAAE,UAAU,8BAA8B,CAAC;CAC3E,OAAO,aAAa,aAAa,CAAC,CAAC;CACnC,OAAO,aAAa,YAAY,CAAC,CAAC;CAClC,OAAO,aAAa,aAAa,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,eAAe,OAAO,OAAO;CACjC,OAAO;CACP,SAAS;CACT,WAAW;AACb,CAAC;AAED,MAAM,qBAAqB,OAAO,OAAO;CACvC,OAAO;CACP,UAAU;CACV,QAAQ,OAAO,YAAY,uBAAuB;CAClD,WAAW;AACb,CAAC;AAED,MAAM,kBAAkB,OAAO,OAAO;CACpC,QAAQ;CACR,QAAQ;CACR,WAAW;CACX,aAAa;AACf,CAAC;AAED,MAAM,UAAU,OAAO,OAAO;CAC5B,UAAU;CACV,WAAW,qBAAqB,OAAO;AACzC,CAAC;AAED,MAAM,YAAY,OAAO,OAAO;CAC9B,MAAM;CACN,eAAe;AACjB,CAAC;AAED,MAAM,YAAY,OAAO,OAAO;CAC9B,QAAQ;CACR,MAAM;CACN,SAAS;CACT,eAAe;AACjB,CAAC;AAED,MAAM,aAAa,OAAO,OAAO;CAC/B,OAAO;CACP,SAAS;CACT,eAAe;CACf,cAAc;CACd,WAAW;AACb,CAAC;AAED,MAAM,gBAAgB,OAAO,OAAO;CAClC,UAAU;CACV,WAAW,qBAAqB,OAAO;CACvC,WAAW;CACX,cAAc,wBAAwB,OAAO;AAC/C,CAAC;AAED,MAAM,SAAS,OAAO,OAAO;CAC3B,UAAU;CACV,WAAW;CACX,YAAY;CACZ,eAAe;CACf,cAAc;CACd,WAAW;CACX,sBAAsB;AACxB,CAAC;AAED,MAAM,YAAY,YAAkD,UAClE,kBAAkB,QAAQ,KAAK;AAEjC,MAAa,eAAe;CAC1B,OAAO,SAAS,gBAAgB;CAChC,OAAO,SAAS,UAAU;CAC1B,QAAQ,SAAS,YAAY;CAC7B,SAAS,SAAS,iBAAiB;AACrC;AAEA,MAAa,2BAA2B,EAAE,QAAQ,SAAS,kBAAkB,EAAE;AAE/E,MAAM,uBACJ,aACA,SACG;CACH,MAAM,UAAU,YAAY,OAAO,IAAI;CAEvC,UAAU,OAAO,YAAY,YAAY,IAAI,YAAY,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,UAAU,OAAO;CAC5F,MAAM,WAAW,YAAY,OAAO,OAAO;CAE3C,UAAU,YAAY,OAAO,QAAQ,MAAM,OAAO;CAElD,OAAO;AACT;AAEA,MAAa,sBAAsB,iBAG5B;CACL,MAAM,SAAS,uBAAuB;CACtC,UAAU,WAAgB;EACxB,QAAQ,kBAAkB,yBAAyB,MAAM,MAAM;EAC/D,cAAc,oBAAoB,aAAa,MAAM,YAAY;CACnE;CACA,WAAW,WAAgB;EACzB,GAAG,kBAAkB,iBAAiB,KAAK;EAC3C,cAAc,oBAAoB,aAAa,MAAM,YAAY;CACnE;CACA,SAAS,SAAS,iBAAiB;AACrC;AAEA,MAAa,iBAAiB;CAC5B,SAAS,SAAS,OAAO;CACzB,OAAO,SAAS,SAAS;CACzB,WAAW,SAAS,eAAe;CACnC,OAAO,SAAS,SAAS;CACzB,QAAQ,SAAS,UAAU;CAC3B,eAAe,SAAS,aAAa;CACrC,QAAQ,SAAS,MAAM;CACvB,SAAS,SAAS,iBAAiB;AACrC;;;AAIA,MAAa,wBAGX,SACA,QACA,QACA,WAEA,OAAO,OACL,OAAO,YACL,OAAO,QAAQ,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,YAAY,CAC7C,MACC,OAAY,YACX,OAAO,cAAc;CACnB,IAAI,CAAC,OAAO,GAAG,OAAO,OAAO,KAAK,YAAY,CAAC;CAG/C,OAAQ,OAFS,OAAO,IAAe,CAAC,KAG/B,GACP,OACF;AACF,CAAC,CAAC,CAAC,KACD,OAAO,QAAQ,SACb,OAAO,WAAW;CAChB,IAAI,KAAK,SAAS,WAAW,OAAO;AACtC,CAAC,CACH,GACA,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CACrD,CACJ,CAAC,CACH,CACF"}

package/dist/drizzle/oauth-model.d.mts

@@ -0,0 +1,468 @@
+import { TokenDigest } from "../Schema.mjs";
+import { AuthenticationFactor } from "../operations/context.mjs";
+import { AuthenticationRequirement, SecurityRevision } from "../sessions/models.mjs";
+import { PreparedCommit } from "../hooks/commit.mjs";
+import { DrizzleMappingError, SubjectIdCodec } from "./model.mjs";
+import { OAuthRegistrationAccess, OAuthRegistrationDecision, OAuthRegistrationInspection, OAuthRegistrationIntent } from "../oauth/registrationModels.mjs";
+import { OAuthUnavailable } from "../oauth/signInErrors.mjs";
+import { OAuthCleanupInput, OAuthCommandId, OAuthCredentialSnapshot, OAuthExternalIdentity } from "../oauth/signInModels.mjs";
+import { PrepareOAuthCommit } from "../oauth/OAuthSignInPersistence.mjs";
+import { OAuthAccountRevision, OAuthActionAuthorization } from "../oauth/accountsModels.mjs";
+import { Effect } from "effect";
+import { InferInsertModel, InferSelectModel, SQL, Table } from "drizzle-orm";
+//#region src/drizzle/oauth-model.d.ts
+type Column<T extends Table> = Extract<keyof T["_"]["columns"], string>;
+type OAuthFlowState = "Pending" | "Claimed" | "Verified" | "RegistrationIssued" | "Linked" | "Cancelled" | "Rejected" | "Ambiguous" | "Conflict";
+type OAuthTupleState = "Unowned" | "Reserved" | "Owned";
+type OAuthRegistrationState = "Unbound" | "Registered" | "ProvisioningPending" | "Rejected";
+type OAuthAction = OAuthActionAuthorization["challenge"]["action"];
+/** The engine writes every critical column explicitly after applying the pure
+ * consumer encoder. Native instant values must roundtrip without precision loss. */
+interface OAuthClock {
+  readonly encodeInstant: (millis: number) => unknown;
+  readonly decodeInstant: (value: unknown) => number;
+  /** Actual engine wall clock sampled after locks, not transaction-start time.
+   * PostgreSQL uses clock_timestamp(), never now()/CURRENT_TIMESTAMP. D1 repeats
+   * its primary-engine sample bounds in final guards. Return integer milliseconds. */
+  readonly engineNowMillis: SQL;
+}
+interface OAuthSubjectReadTable<S extends Table> {
+  readonly table: S;
+  readonly id: Column<S>;
+  readonly status: Column<S>;
+  readonly securityRevision: Column<S>;
+  readonly isActiveStatus: (value: unknown) => boolean;
+  readonly activeCondition: SQL;
+}
+interface OAuthSubjectTable<S extends Table> extends OAuthSubjectReadTable<S> {
+  readonly decodeActionRequirement: (row: InferSelectModel<S>, action: OAuthAction) => AuthenticationRequirement;
+  readonly decodeAuthenticationRequirement: (row: InferSelectModel<S>) => AuthenticationRequirement;
+  readonly nextSecurityRevision: (current: SecurityRevision) => SecurityRevision;
+}
+interface OAuthOwnershipReadTable<O extends Table, N> {
+  readonly table: O;
+  readonly identityKey: Column<O>;
+  readonly provider: Column<O>;
+  readonly issuer: Column<O>;
+  readonly externalSubject: Column<O>;
+  readonly subjectId: Column<O>;
+  /** Includes Owned state when authority and ownership share a physical table. */
+  readonly ownedCondition: SQL;
+  readonly decodeSubjectId: (row: InferSelectModel<O>) => N;
+}
+interface OAuthOwnershipTable<O extends Table, N> extends OAuthOwnershipReadTable<O, N> {
+  readonly encodeInsert: (input: {
+    readonly identity: typeof OAuthExternalIdentity.Type;
+    readonly identityKey: string;
+    readonly subjectId: N;
+  }) => InferInsertModel<O>;
+}
+interface OAuthCredentialReadTable<C extends Table> {
+  readonly table: C;
+  readonly moduleId: Column<C>;
+  readonly credentialId: Column<C>;
+  readonly subjectId: Column<C>;
+  readonly identityKey: Column<C>;
+  readonly credentialRevision: Column<C>;
+  readonly status: Column<C>;
+  readonly isActiveStatus: (value: unknown) => boolean;
+  readonly activeCondition: SQL;
+}
+interface OAuthCredentialTable<C extends Table, N> extends OAuthCredentialReadTable<C> {
+  readonly encodeInsert: (input: {
+    readonly moduleId: string;
+    readonly subjectId: N;
+    readonly identityKey: string;
+    readonly credentialId: string;
+    readonly credentialRevision: SecurityRevision;
+  }) => InferInsertModel<C>;
+  /** This slice removes login rows. Historical records belong in separate audit storage. */
+  readonly removal: "delete";
+}
+interface OAuthAuthorityReadTable<C extends Table> {
+  readonly table: C;
+  readonly subjectId: Column<C>;
+  readonly credentialId: Column<C>;
+  readonly revision: Column<C>;
+  readonly status: Column<C>;
+  readonly isActiveStatus: (value: unknown) => boolean;
+  readonly activeCondition: SQL;
+}
+interface OAuthAuthorityTable<C extends Table, N> extends OAuthAuthorityReadTable<C> {
+  readonly encodeInsert: (input: {
+    readonly subjectId: N;
+    readonly credentialId: string;
+    readonly revision: SecurityRevision;
+  }) => InferInsertModel<C>;
+}
+/** Both purposes may use the same physical table. Shared tables share module/flow
+ * and module/command uniqueness. The snapshot has the exact purpose-specific core
+ * codec; terminal writes erase it, while identity, claim and retention columns remain. */
+interface OAuthFlowTable<F extends Table> {
+  readonly table: F;
+  readonly moduleId: Column<F>;
+  readonly flowId: Column<F>;
+  readonly commandId: Column<F>;
+  readonly purpose: Column<F>;
+  readonly generation: Column<F>;
+  readonly state: Column<F>;
+  readonly version: Column<F>;
+  readonly stateDigest: Column<F>;
+  readonly binderVerifier: Column<F>;
+  readonly binderExpiresAt: Column<F>;
+  readonly snapshot: Column<F>;
+  readonly issuedAt: Column<F>;
+  readonly expiresAt: Column<F>;
+  readonly claimId: Column<F>;
+  readonly claimedAt: Column<F>;
+  readonly claimExpiresAt: Column<F>;
+  readonly retentionUntil: Column<F>;
+  readonly encodeInsert: (input: {
+    readonly moduleId: string;
+    readonly flowId: string;
+    readonly purpose: "sign-in" | "link";
+  }) => InferInsertModel<F>;
+}
+interface OAuthTupleAuthorityTable<T extends Table, N> {
+  readonly table: T;
+  readonly identityKey: Column<T>;
+  readonly provider: Column<T>;
+  readonly issuer: Column<T>;
+  readonly externalSubject: Column<T>;
+  readonly state: Column<T>;
+  readonly version: Column<T>;
+  readonly subjectId: Column<T>;
+  /** Exact reservation identity; no application payload or bearer. */
+  readonly reservation: Column<T>;
+  readonly encodeInsert: (input: {
+    readonly identityKey: string;
+    readonly identity: typeof OAuthExternalIdentity.Type;
+    readonly subjectId?: N;
+  }) => InferInsertModel<T>;
+}
+interface OAuthRegistrationIntentTable<I extends Table> {
+  readonly table: I;
+  readonly moduleId: Column<I>;
+  readonly reference: Column<I>;
+  readonly flowId: Column<I>;
+  readonly claimId: Column<I>;
+  readonly identityKey: Column<I>;
+  readonly version: Column<I>;
+  readonly state: Column<I>;
+  readonly snapshot: Column<I>;
+  readonly commandId: Column<I>;
+  readonly fingerprint: Column<I>;
+  readonly pendingReference: Column<I>;
+  readonly expiresAt: Column<I>;
+  readonly retentionUntil: Column<I>;
+  readonly encodeInsert: (intent: OAuthRegistrationIntent) => InferInsertModel<I>;
+}
+interface OAuthRegistrationCommandTable<R extends Table, Registration> {
+  readonly table: R;
+  readonly moduleId: Column<R>;
+  readonly commandId: Column<R>;
+  readonly reference: Column<R>;
+  readonly identityKey: Column<R>;
+  readonly fingerprint: Column<R>;
+  readonly intentSnapshot: Column<R>;
+  readonly applicationSnapshot: Column<R>;
+  readonly provisioningIdentity: Column<R>;
+  readonly decision: Column<R>;
+  readonly retentionUntil: Column<R>;
+  /** Persists exact detached Type before protected pending work can start. */
+  readonly encodeInsert: (input: {
+    readonly intent: OAuthRegistrationIntent;
+    readonly commandId: string;
+    readonly fingerprint: string;
+    readonly registration: Registration;
+    readonly provisioningIdentity: string;
+  }) => InferInsertModel<R>;
+}
+interface OAuthUnlinkCommandTable<U extends Table> {
+  readonly table: U;
+  readonly moduleId: Column<U>;
+  readonly commandId: Column<U>;
+  readonly subjectId: Column<U>;
+  readonly credentialId: Column<U>;
+  readonly intentSnapshot: Column<U>;
+  readonly decision: Column<U>;
+  readonly retentionUntil: Column<U>;
+  readonly encodeInsert: (input: {
+    readonly moduleId: string;
+    readonly commandId: string;
+    readonly credential: OAuthCredentialSnapshot;
+  }) => InferInsertModel<U>;
+}
+interface OAuthEligibilityFact {
+  readonly credentialId: string;
+  readonly revision: SecurityRevision;
+  readonly usablePrimary: boolean;
+  readonly factors: ReadonlyArray<AuthenticationFactor>;
+  readonly userVerified: boolean;
+  readonly phishingResistant: boolean;
+}
+/** Each descriptor reads only its own subject-scoped method rows. The native row
+ * projector and SQL condition must express the same installed method eligibility.
+ * All source/identifier/policy mutations advance subject securityRevision. D1 also
+ * guards exact selected IDs/versions and absence/count assumptions, never just a
+ * stale boolean. An over-limit graph fails closed rather than truncating. */
+interface OAuthEligibilityTable<T extends Table, N> {
+  readonly table: T;
+  readonly subjectId: Column<T>;
+  readonly credentialId: Column<T>;
+  readonly revision: Column<T>;
+  readonly scope: string;
+  readonly condition: (subjectId: N) => SQL;
+  readonly decode: (row: InferSelectModel<T>) => OAuthEligibilityFact | undefined;
+}
+/** Authenticated command replay uses current subject status and this additional
+ * nonconsuming SQL policy. It never consumes a fresh action factor. */
+interface OAuthMetadataPolicy<N> {
+  readonly condition: (subjectId: N) => SQL;
+}
+interface OAuthCleanupTable<T extends Table, N> {
+  readonly table: T;
+  readonly subjectId: Column<T>;
+  /** Bound to this subject's old revision; no opaque independently committing service. */
+  readonly condition: (input: {
+    readonly subjectId: N;
+    readonly revision: OAuthAccountRevision;
+    readonly removedCredentialId?: string;
+  }) => SQL;
+  readonly disposition: "delete";
+}
+interface OAuthRegistrationEligibility<N> {
+  /** Pure SQL guards for mutable app policy; evaluated again after app writes. */
+  readonly condition: (input: {
+    readonly intent: OAuthRegistrationIntent;
+    readonly nativeSubjectId?: N;
+  }) => SQL;
+}
+interface OAuthD1Mapping {
+  readonly d1: {
+    readonly primary: true;
+  };
+}
+declare const requiredOAuthSignInConstraints: {
+  readonly flow: "unique(flow.moduleId,flow.flowId)";
+  readonly command: "unique(flow.moduleId,flow.commandId)";
+  readonly stateDigest: "unique(flow.stateDigest)";
+  readonly ownership: "unique(ownership.identityKey)";
+  readonly credentialId: "unique(credential.credentialId)";
+  readonly credentialIdentity: "unique(credential.identityKey)";
+  readonly authorityCredential: "unique(authority.subjectId,authority.credentialId)";
+};
+declare const requiredOAuthTupleConstraints: {
+  readonly identityKey: "unique(tuple.identityKey)";
+};
+declare const requiredOAuthRegistrationConstraints: {
+  readonly intentReference: "unique(intent.moduleId,intent.reference)";
+  readonly intentFlow: "unique(intent.moduleId,intent.flowId)";
+  readonly command: "unique(registrationCommand.moduleId,registrationCommand.commandId)";
+};
+declare const requiredOAuthAccountsConstraints: {
+  readonly unlinkCommand: "unique(unlinkCommand.moduleId,unlinkCommand.commandId)";
+};
+interface OAuthSignInMapping<S extends Table, O extends Table, C extends Table, AC extends Table, F extends Table, N> {
+  readonly subject: OAuthSubjectReadTable<S>;
+  readonly ownership: OAuthOwnershipReadTable<O, N>;
+  readonly credential: OAuthCredentialReadTable<C>;
+  readonly authority: OAuthAuthorityReadTable<AC>;
+  readonly flow: OAuthFlowTable<F>;
+  readonly subjectId: SubjectIdCodec<N>;
+  readonly clock: OAuthClock;
+  readonly constraints: typeof requiredOAuthSignInConstraints;
+}
+type OAuthOwnershipMutation<T extends Table, O extends Table, N> = {
+  readonly mode: "integrated";
+  readonly tuple: OAuthTupleAuthorityTable<T, N>;
+} | {
+  readonly mode: "separate";
+  readonly tuple: OAuthTupleAuthorityTable<T, N>;
+  readonly external: OAuthOwnershipTable<O, N>;
+};
+interface OAuthRegistrationIntentMapping<S extends Table, O extends Table, C extends Table, AC extends Table, F extends Table, T extends Table, I extends Table, N> {
+  readonly signIn: OAuthSignInMapping<S, O, C, AC, F, N>;
+  readonly ownership: OAuthOwnershipMutation<T, O, N>;
+  readonly intent: OAuthRegistrationIntentTable<I>;
+  readonly tupleConstraints: typeof requiredOAuthTupleConstraints;
+  readonly registrationConstraints: Pick<typeof requiredOAuthRegistrationConstraints, "intentReference" | "intentFlow">;
+  readonly eligibility: OAuthRegistrationEligibility<N>;
+}
+interface OAuthRegistrationBase<Registration, T extends Table, O extends Table, I extends Table, R extends Table, N> {
+  readonly ownership: OAuthOwnershipMutation<T, O, N>;
+  readonly intent: OAuthRegistrationIntentTable<I>;
+  readonly command: OAuthRegistrationCommandTable<R, Registration>;
+  readonly clock: OAuthClock;
+  readonly tupleConstraints: typeof requiredOAuthTupleConstraints;
+  readonly constraints: typeof requiredOAuthRegistrationConstraints;
+  readonly inspect: (input: {
+    readonly intent: OAuthRegistrationIntent;
+    readonly registration: Registration;
+  }) => Effect.Effect<{
+    readonly fingerprint: string;
+    readonly eligible: boolean;
+  }, DrizzleMappingError>;
+  /** Required for an explicitly bound native/DO command: no asynchronous callback
+   * is evaluated inside the physical owner. Standalone inspection is pre-owner. */
+  readonly inspectSync?: (input: {
+    readonly intent: OAuthRegistrationIntent;
+    readonly registration: Registration;
+  }) => {
+    readonly fingerprint: string;
+    readonly eligible: boolean;
+  };
+  /** Type projection, never the original wire transformation. */
+  readonly snapshot: (registration: Registration) => Effect.Effect<Registration, DrizzleMappingError>;
+  readonly snapshotSync?: (registration: Registration) => Registration;
+  /** Canonical bounded storage of Registration.Type. These are Type codecs, not
+   * the original wire decoder/encoder; decode(encode(value)) must encode identically.
+   * The engine writes and roundtrip-checks this exact string (maximum 1 MiB). */
+  readonly application: {
+    readonly encode: (registration: Registration) => string;
+    readonly decode: (stored: string) => Registration;
+  };
+  readonly eligibility: {
+    /** Stable application authority anchors, in one configured global order.
+     * Omit only for immutable/tuple-local policy or an equivalent explicit outer
+     * owner lock. Each scope must match 1..64 rows, never an absent quota row.
+     * Locks precede tuple/intent/command locks; postcondition owns changed state. */
+    readonly guards?: ReadonlyArray<OAuthRegistrationGuardDescriptor<Registration, N>>;
+    readonly admission: (input: {
+      readonly intent: OAuthRegistrationIntent;
+      readonly registration: Registration;
+      readonly nativeSubjectId?: N;
+    }) => SQL;
+    /** Evaluated after subject/application writes, including appended coordinator
+     * writes. May assert consumption of the admission invitation/quota. */
+    readonly postcondition: (input: {
+      readonly intent: OAuthRegistrationIntent;
+      readonly registration: Registration;
+      readonly nativeSubjectId?: N;
+    }) => SQL;
+  };
+  readonly allocateProvisioningIdentity: Effect.Effect<string, DrizzleMappingError>;
+  readonly retentionMillis: number;
+}
+interface OAuthRegistrationGuardTable<T extends Table, Registration, N> {
+  readonly table: T;
+  readonly orderBy: Column<T>;
+  readonly condition: (input: {
+    readonly intent: OAuthRegistrationIntent;
+    readonly registration: Registration;
+    readonly nativeSubjectId?: N;
+  }) => SQL;
+}
+interface OAuthRegistrationGuardDescriptor<Registration, N> {
+  readonly table: Table;
+  readonly orderBy: string;
+  readonly condition: OAuthRegistrationGuardTable<Table, Registration, N>["condition"];
+}
+declare const oauthRegistrationGuardTable: <T extends Table, Registration, N>(input: OAuthRegistrationGuardTable<T, Registration, N>) => OAuthRegistrationGuardDescriptor<Registration, N>;
+type OAuthRegistrationMapping<Registration, S extends Table, O extends Table, C extends Table, AC extends Table, T extends Table, I extends Table, R extends Table, N> = OAuthRegistrationBase<Registration, T, O, I, R, N> & ({
+  readonly mode: "pending";
+  readonly allocatePendingReference: Effect.Effect<string, DrizzleMappingError>;
+} | {
+  readonly mode: "atomic";
+  readonly subjectId: SubjectIdCodec<N>;
+  readonly subject: OAuthSubjectReadTable<S>;
+  readonly credential: OAuthCredentialTable<C, N>;
+  readonly authority: OAuthAuthorityTable<AC, N>;
+  readonly allocateSubjectId: Effect.Effect<N, DrizzleMappingError>;
+  readonly allocateCredentialId: Effect.Effect<string, DrizzleMappingError>;
+  readonly allocateRevision: Effect.Effect<SecurityRevision, DrizzleMappingError>;
+  readonly encodeSubjectInsert: (input: {
+    readonly intent: OAuthRegistrationIntent;
+    readonly registration: Registration;
+  }, ids: {
+    readonly subjectId: N;
+    readonly securityRevision: SecurityRevision;
+  }) => InferInsertModel<S>;
+});
+/** Heterogeneous descriptors are made by typed factories and projected privately. */
+interface OAuthEligibilityDescriptor<N> {
+  readonly _tag: "OAuthEligibilityDescriptor";
+  readonly scope: string;
+  readonly table: Table;
+  readonly subjectId: string;
+  readonly credentialId: string;
+  readonly revision: string;
+  readonly condition: (subjectId: N) => SQL;
+  readonly decode: (row: unknown) => OAuthEligibilityFact | undefined;
+}
+declare const oauthEligibilityTable: <T extends Table, N>(input: OAuthEligibilityTable<T, N>) => OAuthEligibilityDescriptor<N>;
+interface OAuthCleanupDescriptor<N> {
+  readonly table: Table;
+  readonly subjectId: string;
+  readonly condition: OAuthCleanupTable<Table, N>["condition"];
+}
+declare const oauthCleanupTable: <T extends Table, N>(input: OAuthCleanupTable<T, N>) => OAuthCleanupDescriptor<N>;
+/** A stable application/reference lock acquired before an ownership target.
+ * Missing rows retain ownership. Conditions are synchronous and use detached
+ * native IDs; every writer of the guarded reference follows the same order. */
+interface OAuthReferenceGuardTable<T extends Table, N> {
+  readonly table: T;
+  readonly orderBy: Column<T>;
+  readonly condition: (input: {
+    readonly identity: typeof OAuthExternalIdentity.Type;
+    readonly identityKey: string;
+    readonly subjectId: N;
+  }) => SQL;
+}
+interface OAuthReferenceGuardDescriptor<N> {
+  readonly table: Table;
+  readonly orderBy: string;
+  readonly condition: OAuthReferenceGuardTable<Table, N>["condition"];
+}
+declare const oauthReferenceGuardTable: <T extends Table, N>(input: OAuthReferenceGuardTable<T, N>) => OAuthReferenceGuardDescriptor<N>;
+interface OAuthAccountsMapping<S extends Table, O extends Table, C extends Table, AC extends Table, F extends Table, T extends Table, U extends Table, N> {
+  readonly subject: OAuthSubjectTable<S>;
+  readonly ownership: OAuthOwnershipMutation<T, O, N>;
+  readonly credential: OAuthCredentialTable<C, N>;
+  readonly authority: OAuthAuthorityTable<AC, N>;
+  readonly flow: OAuthFlowTable<F>;
+  readonly command: OAuthUnlinkCommandTable<U>;
+  readonly subjectId: SubjectIdCodec<N>;
+  readonly clock: OAuthClock;
+  readonly constraints: typeof requiredOAuthSignInConstraints & typeof requiredOAuthAccountsConstraints;
+  readonly tupleConstraints: typeof requiredOAuthTupleConstraints;
+  readonly eligibility: ReadonlyArray<OAuthEligibilityDescriptor<N>>;
+  readonly cleanup: ReadonlyArray<OAuthCleanupDescriptor<N>>;
+  readonly metadata: OAuthMetadataPolicy<N>;
+  readonly sessionInvalidation: "same-authority-immediate" | "original-absolute-expiry";
+  /** Omit only when connected access is absent. A predicate alone conservatively
+   * retains ownership; release also needs all configured guard rows below. */
+  readonly connectedReference?: (input: {
+    readonly identityKey: string;
+    readonly subjectId: N;
+  }) => SQL;
+  /** At most 32 descriptors, each locking 1..64 stable rows in supplied order.
+   * Missing/empty guards retain Owned, even when the reference predicate is false. */
+  readonly connectedReferenceGuards?: ReadonlyArray<OAuthReferenceGuardDescriptor<N>>;
+  readonly allocateCredentialId: Effect.Effect<string, DrizzleMappingError>;
+  readonly allocateRevision: Effect.Effect<SecurityRevision, DrizzleMappingError>;
+}
+interface OAuthRegistrationAuthority<Registration> {
+  readonly read: (access: OAuthRegistrationAccess) => Effect.Effect<OAuthRegistrationInspection | undefined, OAuthUnavailable>;
+  readonly inspect: (input: {
+    readonly intent: OAuthRegistrationIntent;
+    readonly registration: Registration;
+  }) => Effect.Effect<{
+    readonly fingerprint: TokenDigest;
+    readonly eligible: boolean;
+  }, OAuthUnavailable>;
+  readonly register: <A>(input: {
+    readonly access: OAuthRegistrationAccess;
+    readonly intent: OAuthRegistrationIntent;
+    readonly commandId: typeof OAuthCommandId.Type;
+    readonly registration: Registration;
+    readonly fingerprint: TokenDigest;
+  }, prepare: PrepareOAuthCommit<OAuthRegistrationDecision, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;
+  readonly cleanup: <A>(input: OAuthCleanupInput, prepare: PrepareOAuthCommit<{
+    readonly removed: number;
+    readonly hasMore: boolean;
+  }, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;
+}
+//#endregion
+export { OAuthAccountsMapping, OAuthAction, OAuthAuthorityReadTable, OAuthAuthorityTable, OAuthCleanupDescriptor, OAuthCleanupTable, OAuthClock, OAuthCredentialReadTable, OAuthCredentialTable, OAuthD1Mapping, OAuthEligibilityDescriptor, OAuthEligibilityFact, OAuthEligibilityTable, OAuthFlowState, OAuthFlowTable, OAuthMetadataPolicy, OAuthOwnershipMutation, OAuthOwnershipReadTable, OAuthOwnershipTable, OAuthReferenceGuardDescriptor, OAuthReferenceGuardTable, OAuthRegistrationAuthority, OAuthRegistrationBase, OAuthRegistrationCommandTable, OAuthRegistrationEligibility, OAuthRegistrationGuardDescriptor, OAuthRegistrationGuardTable, OAuthRegistrationIntentMapping, OAuthRegistrationIntentTable, OAuthRegistrationMapping, OAuthRegistrationState, OAuthSignInMapping, OAuthSubjectReadTable, OAuthSubjectTable, OAuthTupleAuthorityTable, OAuthTupleState, OAuthUnlinkCommandTable, oauthCleanupTable, oauthEligibilityTable, oauthReferenceGuardTable, oauthRegistrationGuardTable, requiredOAuthAccountsConstraints, requiredOAuthRegistrationConstraints, requiredOAuthSignInConstraints, requiredOAuthTupleConstraints };
+//# sourceMappingURL=oauth-model.d.mts.map

package/dist/drizzle/oauth-model.mjs

@@ -0,0 +1,49 @@
+//#region src/drizzle/oauth-model.ts
+const requiredOAuthSignInConstraints = {
+	flow: "unique(flow.moduleId,flow.flowId)",
+	command: "unique(flow.moduleId,flow.commandId)",
+	stateDigest: "unique(flow.stateDigest)",
+	ownership: "unique(ownership.identityKey)",
+	credentialId: "unique(credential.credentialId)",
+	credentialIdentity: "unique(credential.identityKey)",
+	authorityCredential: "unique(authority.subjectId,authority.credentialId)"
+};
+const requiredOAuthTupleConstraints = { identityKey: "unique(tuple.identityKey)" };
+const requiredOAuthRegistrationConstraints = {
+	intentReference: "unique(intent.moduleId,intent.reference)",
+	intentFlow: "unique(intent.moduleId,intent.flowId)",
+	command: "unique(registrationCommand.moduleId,registrationCommand.commandId)"
+};
+const requiredOAuthAccountsConstraints = { unlinkCommand: "unique(unlinkCommand.moduleId,unlinkCommand.commandId)" };
+const oauthRegistrationGuardTable = (input) => Object.freeze({
+	table: input.table,
+	orderBy: input.orderBy,
+	condition: input.condition
+});
+const oauthEligibilityTable = (input) => {
+	const { table, subjectId, credentialId, revision, scope, condition, decode } = input;
+	return Object.freeze({
+		_tag: "OAuthEligibilityDescriptor",
+		table,
+		subjectId,
+		credentialId,
+		revision,
+		scope,
+		condition,
+		decode: (row) => decode(row)
+	});
+};
+const oauthCleanupTable = (input) => Object.freeze({
+	table: input.table,
+	subjectId: input.subjectId,
+	condition: input.condition
+});
+const oauthReferenceGuardTable = (input) => Object.freeze({
+	table: input.table,
+	orderBy: input.orderBy,
+	condition: input.condition
+});
+//#endregion
+export { oauthCleanupTable, oauthEligibilityTable, oauthReferenceGuardTable, oauthRegistrationGuardTable, requiredOAuthAccountsConstraints, requiredOAuthRegistrationConstraints, requiredOAuthSignInConstraints, requiredOAuthTupleConstraints };
+
+//# sourceMappingURL=oauth-model.mjs.map