@murphai/murph 1.3.0 → 1.3.2

package/node_modules/@murphai/device-syncd/dist/public-ingress.js

@@ -1,28 +1,56 @@
 import { deviceSyncError, isDeviceSyncError } from "./errors.js";
 import { sanitizeHostedRuntimeErrorText } from "./hosted-runtime.js";
-import { isEstablishedDeviceSyncConnection } from "./public-account.js";
+import { isDeviceSyncConnectionSetupExpiredAt, isDeviceSyncConnectionSetupPending, isDeviceSyncSourceDisconnectFenced, isEstablishedDeviceSyncConnection, } from "./public-account.js";
 import { resolveDeviceSyncProviderCredentialPolicy } from "./provider-credential-policy.js";
 import { resolvePublicProviderDefaultScopes } from "./public-provider-descriptor-shared.js";
 import { normalizeConfiguredDeviceSyncJobInput, } from "./provider-job-definitions.js";
+import { DEVICE_SYNC_PREPARED_WEBHOOK_SCHEMA, parsePreparedDeviceSyncWebhook, } from "./prepared-webhook.js";
 import { resolveDeviceProviderConnectionDescriptor } from "@murphai/importers/device-providers/provider-descriptors";
+import { buildJunctionProviderSourceInstanceKey } from "./config/junction-connect-sources.js";
 import { addMilliseconds, generateStateCode, joinUrl, normalizeOriginList, normalizePublicBaseUrl, normalizeString, resolveRelativeOrAllowedOriginUrl, sanitizeStoredDeviceSyncMetadata, scopeWebhookTraceId, sha256Text, splitScopeList, toIsoTimestamp, } from "./shared.js";
+function resolveDefinitivePreProviderOAuthCallbackError(provider, query) {
+    if (resolveDeviceProviderConnectionDescriptor(provider.descriptor).kind !== "oauth2") {
+        return null;
+    }
+    if (normalizeString(query.get("error")) !== undefined) {
+        return deviceSyncError({
+            code: "OAUTH_CALLBACK_REJECTED",
+            message: "OAuth authorization was denied or canceled.",
+            retryable: false,
+            httpStatus: 400,
+        });
+    }
+    if (normalizeString(query.get("code")) === undefined) {
+        return deviceSyncError({
+            code: "OAUTH_CODE_MISSING",
+            message: "OAuth callback is missing the authorization code.",
+            retryable: false,
+            httpStatus: 400,
+        });
+    }
+    return null;
+}
 const WEBHOOK_TRACE_PROCESSING_TTL_MS = 5 * 60_000;
 const SEEDED_CONNECTION_ACCOUNT_ID_STATE_METADATA_KEY = "__murphSeededConnectionAccountId";
 const SEEDED_CONNECTION_EXTERNAL_ACCOUNT_ID_STATE_METADATA_KEY = "__murphSeededConnectionExternalAccountId";
 const SEEDED_CONNECTION_SETUP_EXPIRES_AT_STATE_METADATA_KEY = "__murphSeededConnectionSetupExpiresAt";
+const SEEDED_CONNECTION_CONNECTED_AT_STATE_METADATA_KEY = "__murphSeededConnectionConnectedAt";
 const LEGACY_SEEDED_CONNECTION_UPDATED_AT_STATE_METADATA_KEY = "__murphSeededConnectionUpdatedAt";
 const CONNECT_SOURCE_ID_STATE_METADATA_KEY = "__murphConnectSourceId";
 const CONNECT_TARGET_STATE_METADATA_KEY = "__murphConnectTarget";
 const SOURCE_PROVIDER_SLUG_STATE_METADATA_KEY = "__murphSourceProviderSlug";
 function toIngressWebhook(parsed) {
     const resourceCategory = normalizeString(parsed.resourceCategory);
+    const sourceProviderSlug = normalizeString(parsed.sourceProviderSlug);
     const dataSourceProviderSlug = normalizeString(parsed.dataSourceProviderSlug);
     return {
         acceptanceMode: parsed.acceptanceMode,
         eventType: parsed.eventType,
         jobs: [...parsed.jobs],
         ...(parsed.occurredAt ? { occurredAt: parsed.occurredAt } : {}),
+        ...(parsed.providerSentAt ? { providerSentAt: parsed.providerSentAt } : {}),
         ...(resourceCategory ? { resourceCategory } : {}),
+        ...(sourceProviderSlug ? { sourceProviderSlug } : {}),
         ...(dataSourceProviderSlug ? { dataSourceProviderSlug } : {}),
     };
 }
@@ -111,18 +139,6 @@ function resolveAndValidateProviderConnectionCredential(provider, connection) {
     validateProviderConnectionCredential(provider, credential);
     return credential;
 }
-function requireConnectionOAuthTokens(connection) {
-    const credential = resolveProviderConnectionCredential(connection);
-    if (credential.kind !== "oauth_tokens") {
-        throw deviceSyncError({
-            code: "OAUTH_TOKENS_REQUIRED",
-            message: "This connection cleanup path requires OAuth token credentials.",
-            retryable: false,
-            httpStatus: 500,
-        });
-    }
-    return credential.tokens;
-}
 function buildConnectionCallbackQuery(input) {
     if (input.query) {
         return new URLSearchParams(input.query);
@@ -178,6 +194,7 @@ function buildProviderConnectionStateMetadata(metadata) {
     delete providerMetadata[SEEDED_CONNECTION_ACCOUNT_ID_STATE_METADATA_KEY];
     delete providerMetadata[SEEDED_CONNECTION_EXTERNAL_ACCOUNT_ID_STATE_METADATA_KEY];
     delete providerMetadata[SEEDED_CONNECTION_SETUP_EXPIRES_AT_STATE_METADATA_KEY];
+    delete providerMetadata[SEEDED_CONNECTION_CONNECTED_AT_STATE_METADATA_KEY];
     delete providerMetadata[LEGACY_SEEDED_CONNECTION_UPDATED_AT_STATE_METADATA_KEY];
     delete providerMetadata[CONNECT_SOURCE_ID_STATE_METADATA_KEY];
     delete providerMetadata[CONNECT_TARGET_STATE_METADATA_KEY];
@@ -189,6 +206,7 @@ function sanitizeConnectionStateMetadata(value) {
     delete metadata[SEEDED_CONNECTION_ACCOUNT_ID_STATE_METADATA_KEY];
     delete metadata[SEEDED_CONNECTION_EXTERNAL_ACCOUNT_ID_STATE_METADATA_KEY];
     delete metadata[SEEDED_CONNECTION_SETUP_EXPIRES_AT_STATE_METADATA_KEY];
+    delete metadata[SEEDED_CONNECTION_CONNECTED_AT_STATE_METADATA_KEY];
     delete metadata[LEGACY_SEEDED_CONNECTION_UPDATED_AT_STATE_METADATA_KEY];
     delete metadata[CONNECT_SOURCE_ID_STATE_METADATA_KEY];
     delete metadata[CONNECT_TARGET_STATE_METADATA_KEY];
@@ -225,6 +243,10 @@ function readSeededConnectionSetupExpiresAt(metadata) {
     const value = metadata?.[SEEDED_CONNECTION_SETUP_EXPIRES_AT_STATE_METADATA_KEY];
     return typeof value === "string" ? normalizeString(value) ?? null : null;
 }
+function readSeededConnectionConnectedAt(metadata) {
+    const value = metadata?.[SEEDED_CONNECTION_CONNECTED_AT_STATE_METADATA_KEY];
+    return typeof value === "string" ? normalizeString(value) ?? null : null;
+}
 function readConnectSourceId(metadata) {
     const value = metadata?.[CONNECT_SOURCE_ID_STATE_METADATA_KEY];
     return typeof value === "string" ? normalizeString(value) ?? null : null;
@@ -242,6 +264,7 @@ function setSeededConnectionStateMetadata(metadata, account) {
     return {
         ...metadata,
         [SEEDED_CONNECTION_ACCOUNT_ID_STATE_METADATA_KEY]: account.id,
+        [SEEDED_CONNECTION_CONNECTED_AT_STATE_METADATA_KEY]: account.connectedAt,
         ...(setupExpiresAt
             ? { [SEEDED_CONNECTION_SETUP_EXPIRES_AT_STATE_METADATA_KEY]: setupExpiresAt }
             : {}),
@@ -290,6 +313,14 @@ function assertSeededConnectionExternalAccountMatches(input) {
 function connectionFlowRequiresCallbackUrl(connectionKind) {
     return connectionKind === "oauth2" || connectionKind === "external_link";
 }
+function connectionSourceStartStaleError() {
+    throw deviceSyncError({
+        code: "CONNECTION_SOURCE_START_STALE",
+        message: "Device source state changed while its connection link was starting. Retry.",
+        retryable: true,
+        httpStatus: 409,
+    });
+}
 export class DeviceSyncPublicIngress {
     publicBaseUrl;
     allowedReturnOrigins;
@@ -368,7 +399,9 @@ export class DeviceSyncPublicIngress {
             ownerId: input.ownerId ?? null,
             sourceProviderSlug: input.sourceProviderSlug ?? null,
         });
+        const sourceProviderSlug = normalizeString(input.sourceProviderSlug);
         let seededAccount = null;
+        let reusedEstablishedJunctionAccount = false;
         if (started.connectionSeed) {
             validateProviderConnectionCredential(provider, started.connectionSeed.credential);
             seededAccount = await this.store.upsertConnection({
@@ -382,9 +415,34 @@ export class DeviceSyncPublicIngress {
                 scopes: started.connectionSeed.scopes ?? started.scopes ?? descriptor.defaultScopes,
                 credential: started.connectionSeed.credential,
                 metadata: started.connectionSeed.metadata ?? {},
+                existingAccountPolicy: provider.provider === "junction" && sourceProviderSlug !== null
+                    ? "preserve_established"
+                    : "replace",
                 connectedAt: now,
                 nextReconcileAt: started.connectionSeed.nextReconcileAt ?? null,
             });
+            reusedEstablishedJunctionAccount =
+                provider.provider === "junction"
+                    && sourceProviderSlug !== null
+                    && isEstablishedDeviceSyncConnection(seededAccount);
+            const sourceInstanceKey = provider.provider === "junction" && sourceProviderSlug
+                ? buildJunctionProviderSourceInstanceKey({
+                    connectionId: seededAccount.id,
+                    sourceProviderSlug,
+                })
+                : null;
+            if (sourceInstanceKey
+                && sourceProviderSlug
+                && !(reusedEstablishedJunctionAccount && input.sourceLifecycleProof)) {
+                await this.store.upsertConnectionSource({
+                    connectionId: seededAccount.id,
+                    sourceInstanceKey,
+                    sourceProviderSlug,
+                    status: "disconnected",
+                    firstSeenAt: now,
+                    lastSeenAt: now,
+                }, { fenceActiveWorkOnReconnect: reusedEstablishedJunctionAccount });
+            }
         }
         let stateMetadata = buildConnectionStateMetadata({
             providerMetadata: started.stateMetadata,
@@ -395,7 +453,32 @@ export class DeviceSyncPublicIngress {
         if (seededAccount) {
             stateMetadata = setSeededConnectionStateMetadata(stateMetadata, seededAccount);
         }
+        const requirePreparedSourceLifecycleCurrent = async () => {
+            const proof = input.sourceLifecycleProof ?? null;
+            if (!proof) {
+                return;
+            }
+            if (!reusedEstablishedJunctionAccount
+                || !seededAccount
+                || !sourceProviderSlug
+                || proof.connectionId !== seededAccount.id
+                || normalizeString(proof.sourceProviderSlug) !== sourceProviderSlug) {
+                connectionSourceStartStaleError();
+            }
+            const sources = await this.store.listConnectionSources({
+                connectionId: seededAccount.id,
+                sourceProviderSlug,
+            });
+            const source = sources.find((candidate) => candidate.sourceInstanceKey === proof.sourceInstanceKey);
+            if (!source
+                || source.lastSeenAt !== proof.lastSeenAt
+                || source.lastErrorCode !== null
+                || source.status !== "disconnected") {
+                connectionSourceStartStaleError();
+            }
+        };
         try {
+            await requirePreparedSourceLifecycleCurrent();
             await this.store.createOAuthState({
                 state,
                 provider: provider.provider,
@@ -405,10 +488,11 @@ export class DeviceSyncPublicIngress {
                 expiresAt,
                 metadata: stateMetadata,
             });
+            await requirePreparedSourceLifecycleCurrent();
         }
         catch (error) {
-            if (seededAccount) {
-                await this.markSeededConnectionSetupFailed(provider, seededAccount.id, seededAccount.connectedAt, null, now, error);
+            if (seededAccount && !reusedEstablishedJunctionAccount) {
+                await this.markSeededConnectionSetupFailed(provider, seededAccount.id, seededAccount.connectedAt, null, input.ownerId ?? null, now, error);
             }
             throw error;
         }
@@ -557,7 +641,7 @@ export class DeviceSyncPublicIngress {
                     : [...descriptor.defaultScopes],
                 credential: resolveAndValidateProviderConnectionCredential(provider, connection),
                 metadata: connection.metadata ?? {},
-                reuseEstablishedConnection: true,
+                existingAccountPolicy: "preserve_established",
                 connectedAt: now,
                 nextReconcileAt: connection.nextReconcileAt ?? null,
             });
@@ -565,15 +649,21 @@ export class DeviceSyncPublicIngress {
             previousAccount = persisted.previousAccount;
         }
         if (!canReuseExistingAccount && shouldRunSdkConnectionEstablishedHook(previousAccount)) {
-            await this.runSdkConnectionEstablishedHook({
-                account,
-                connection: {
-                    ...connection,
-                    ...(initialJobs ? { initialJobs } : {}),
-                },
-                provider,
-                now,
-            });
+            try {
+                await this.runSdkConnectionEstablishedHook({
+                    account,
+                    connection: {
+                        ...connection,
+                        ...(initialJobs ? { initialJobs } : {}),
+                    },
+                    provider,
+                    now,
+                });
+            }
+            catch (error) {
+                await this.cleanupPersistedOAuthConnection(provider, account, connection, now, error);
+                throw error;
+            }
         }
         return {
             account,
@@ -603,18 +693,7 @@ export class DeviceSyncPublicIngress {
             : false;
     }
     async runSdkConnectionEstablishedHook(input) {
-        try {
-            await this.hooks.onConnectionEstablished?.(input);
-        }
-        catch (error) {
-            this.logger.warn?.("Device sync SDK sign-in established hook failed; continuing token mint.", {
-                provider: input.provider.provider,
-                accountId: input.account.id,
-                externalAccountIdHash: hashExternalAccountIdForLogs(input.connection.externalAccountId),
-                failureCode: "DEVICE_SYNC_SDK_SIGN_IN_ESTABLISHED_HOOK_FAILED",
-                error: summarizePublicIngressError(error),
-            });
-        }
+        await this.hooks.onConnectionEstablished?.(input);
     }
     async handleConnectionCallback(input) {
         const provider = this.requireProvider(input.provider);
@@ -627,7 +706,10 @@ export class DeviceSyncPublicIngress {
         const callbackQuery = callback.query;
         const state = callback.state;
         const expectedOwnerId = normalizeString(input.expectedOwnerId);
-        const stateResult = await this.store.consumeOAuthState(state, now, provider.provider, expectedOwnerId ?? undefined);
+        const preProviderError = resolveDefinitivePreProviderOAuthCallbackError(provider, callbackQuery);
+        const stateResult = preProviderError
+            ? await this.store.discardUnconsumedOAuthState(state, now, provider.provider, expectedOwnerId ?? undefined)
+            : await this.store.consumeOAuthState(state, now, provider.provider, expectedOwnerId ?? undefined);
         if (stateResult.status === "missing") {
             throw deviceSyncError({
                 code: "OAUTH_STATE_INVALID",
@@ -670,12 +752,42 @@ export class DeviceSyncPublicIngress {
                 returnTo: this.sanitizeStoredReturnTo(stateResult.record.returnTo ?? null),
             });
         }
+        if (stateResult.status === "recovery_required") {
+            throw attachOAuthCallbackContext(deviceSyncError({
+                code: "OAUTH_CALLBACK_RECOVERY_REQUIRED",
+                message: "This provider connection did not finish safely. Remove Murph access in the provider account before deleting your Murph account, or contact support.",
+                retryable: false,
+                httpStatus: 409,
+            }), {
+                connectSourceId: readConnectSourceId(stateResult.record.metadata),
+                connectTarget: readConnectTarget(stateResult.record.metadata),
+                provider: provider.provider,
+                returnTo: this.sanitizeStoredReturnTo(stateResult.record.returnTo ?? null),
+            });
+        }
+        if (stateResult.status === "discarded") {
+            const callbackError = normalizeString(callbackQuery.get("error"));
+            if (callbackError) {
+                this.logger.warn?.("OAuth callback was rejected by the provider.", {
+                    provider: provider.provider,
+                    callbackError,
+                });
+            }
+            throw attachOAuthCallbackContext(preProviderError, {
+                connectSourceId: readConnectSourceId(stateResult.record.metadata),
+                connectTarget: readConnectTarget(stateResult.record.metadata),
+                provider: provider.provider,
+                returnTo: this.sanitizeStoredReturnTo(stateResult.record.returnTo ?? null),
+            });
+        }
         const stateRecord = stateResult.record;
         const returnTo = this.sanitizeStoredReturnTo(stateRecord.returnTo ?? null);
         const seededAccountId = readSeededConnectionAccountId(stateRecord.metadata);
         let seededExternalAccountId = readSeededConnectionExternalAccountId(stateRecord.metadata);
         const seededSetupExpiresAt = readSeededConnectionSetupExpiresAt(stateRecord.metadata);
-        const seededConnectedAt = seededAccountId ? stateRecord.createdAt : null;
+        const seededConnectedAt = seededAccountId
+            ? readSeededConnectionConnectedAt(stateRecord.metadata) ?? stateRecord.createdAt
+            : null;
         const connectSourceId = readConnectSourceId(stateRecord.metadata);
         const connectTarget = readConnectTarget(stateRecord.metadata);
         const sourceProviderSlug = readSourceProviderSlug(stateRecord.metadata);
@@ -688,42 +800,27 @@ export class DeviceSyncPublicIngress {
         let connection = null;
         let account = null;
         let connectionPersisted = false;
-        let seededAccount = seededAccountId ? await this.store.getConnectionById(seededAccountId) : null;
-        if (seededAccount && seededAccount.provider !== provider.provider) {
-            throw attachOAuthCallbackContext(deviceSyncError({
-                code: "CONNECTION_SEEDED_ACCOUNT_MISMATCH",
-                message: "Device sync connection callback referenced a seeded account for another provider.",
-                retryable: false,
-                httpStatus: 400,
-            }), callbackContext);
-        }
-        if (seededAccountId && !seededAccount) {
-            throw attachOAuthCallbackContext(deviceSyncError({
-                code: "CONNECTION_SEEDED_ACCOUNT_MISMATCH",
-                message: "Device sync connection callback referenced an unexpected seeded account.",
-                retryable: false,
-                httpStatus: 400,
-            }), callbackContext);
-        }
-        if (seededAccount?.status === "disconnected") {
-            throw attachOAuthCallbackContext(deviceSyncError({
-                code: "CONNECTION_ALREADY_DISCONNECTED",
-                message: "Device sync connection callback was received after the seeded account was disconnected.",
-                retryable: false,
-                httpStatus: 409,
-            }), callbackContext);
-        }
-        if (seededAccount && seededAccount.connectedAt !== seededConnectedAt) {
-            throw attachOAuthCallbackContext(deviceSyncError({
-                code: "CONNECTION_SEEDED_ACCOUNT_CHANGED",
-                message: "Device sync connection changed after this connection flow started.",
-                retryable: false,
-                httpStatus: 409,
-            }), callbackContext);
-        }
-        seededExternalAccountId = seededAccount?.externalAccountId ?? seededExternalAccountId ?? null;
-        if (seededExternalAccountId) {
-            seededAccount ??= await this.store.getConnectionByExternalAccount(provider.provider, seededExternalAccountId);
+        let providerWorkStarted = false;
+        let reusedEstablishedJunctionAccount = false;
+        let seededAccount = null;
+        try {
+            seededAccount = seededAccountId ? await this.store.getConnectionById(seededAccountId) : null;
+            if (seededAccount && seededAccount.provider !== provider.provider) {
+                throw attachOAuthCallbackContext(deviceSyncError({
+                    code: "CONNECTION_SEEDED_ACCOUNT_MISMATCH",
+                    message: "Device sync connection callback referenced a seeded account for another provider.",
+                    retryable: false,
+                    httpStatus: 400,
+                }), callbackContext);
+            }
+            if (seededAccountId && !seededAccount) {
+                throw attachOAuthCallbackContext(deviceSyncError({
+                    code: "CONNECTION_SEEDED_ACCOUNT_MISMATCH",
+                    message: "Device sync connection callback referenced an unexpected seeded account.",
+                    retryable: false,
+                    httpStatus: 400,
+                }), callbackContext);
+            }
             if (seededAccount?.status === "disconnected") {
                 throw attachOAuthCallbackContext(deviceSyncError({
                     code: "CONNECTION_ALREADY_DISCONNECTED",
@@ -732,8 +829,31 @@ export class DeviceSyncPublicIngress {
                     httpStatus: 409,
                 }), callbackContext);
             }
-        }
-        try {
+            if (seededAccount && seededAccount.connectedAt !== seededConnectedAt) {
+                throw attachOAuthCallbackContext(deviceSyncError({
+                    code: "CONNECTION_SEEDED_ACCOUNT_CHANGED",
+                    message: "Device sync connection changed after this connection flow started.",
+                    retryable: false,
+                    httpStatus: 409,
+                }), callbackContext);
+            }
+            seededExternalAccountId = seededAccount?.externalAccountId ?? seededExternalAccountId ?? null;
+            reusedEstablishedJunctionAccount =
+                provider.provider === "junction"
+                    && sourceProviderSlug !== null
+                    && seededAccount !== null
+                    && isEstablishedDeviceSyncConnection(seededAccount);
+            if (seededExternalAccountId) {
+                seededAccount ??= await this.store.getConnectionByExternalAccount(provider.provider, seededExternalAccountId);
+                if (seededAccount?.status === "disconnected") {
+                    throw attachOAuthCallbackContext(deviceSyncError({
+                        code: "CONNECTION_ALREADY_DISCONNECTED",
+                        message: "Device sync connection callback was received after the seeded account was disconnected.",
+                        retryable: false,
+                        httpStatus: 409,
+                    }), callbackContext);
+                }
+            }
             if (!descriptor.callbackUrl && connectionFlowRequiresCallbackUrl(descriptor.connectionKind)) {
                 throw deviceSyncError({
                     code: "CONNECTION_CALLBACK_URL_REQUIRED",
@@ -750,11 +870,13 @@ export class DeviceSyncPublicIngress {
                 });
             }
             const grantedScopes = splitScopeList(input.scope ?? callbackQuery.get("scope"));
+            providerWorkStarted = true;
             connection = await completeProviderConnection(provider, {
                 callbackUrl: descriptor.callbackUrl ?? "",
                 state,
                 stateMetadata: buildProviderConnectionStateMetadata(stateRecord.metadata ?? {}),
                 seededExternalAccountId,
+                sourceProviderSlug,
                 query: callbackQuery,
                 now,
                 grantedScopes,
@@ -797,6 +919,9 @@ export class DeviceSyncPublicIngress {
                         : [...descriptor.defaultScopes],
                 credential: resolveAndValidateProviderConnectionCredential(provider, connection),
                 metadata: connection.metadata ?? {},
+                existingAccountPolicy: reusedEstablishedJunctionAccount
+                    ? "preserve_established"
+                    : "replace",
                 existingAccountGuard: seededAccountId
                     ? {
                         expectedAccountId: seededAccountId,
@@ -806,10 +931,15 @@ export class DeviceSyncPublicIngress {
                     : null,
                 connectedAt: now,
                 nextReconcileAt: connection.nextReconcileAt ?? null,
+                oauthClaim: {
+                    state,
+                    consumedAt: stateResult.consumedAt,
+                },
             });
             connectionPersisted = true;
-            await this.hooks.onConnectionEstablished?.({
+            const establishment = await this.hooks.onConnectionEstablished?.({
                 account,
+                connectionStartedAt: stateRecord.createdAt,
                 ...(connectSourceId ? { connectSourceId } : {}),
                 ...(connectTarget ? { connectTarget } : {}),
                 ...(sourceProviderSlug ? { sourceProviderSlug } : {}),
@@ -820,6 +950,17 @@ export class DeviceSyncPublicIngress {
                 provider,
                 now,
             });
+            if (provider.provider === "junction"
+                && sourceProviderSlug
+                && (!establishment
+                    || establishment.sourceAdmissionCommitted !== true)) {
+                throw deviceSyncError({
+                    code: "CONNECTION_SOURCE_ADMISSION_NOT_COMMITTED",
+                    message: "Device connection completion did not commit the requested source. Start the connection again.",
+                    retryable: false,
+                    httpStatus: 409,
+                });
+            }
             return {
                 account,
                 returnTo,
@@ -829,19 +970,46 @@ export class DeviceSyncPublicIngress {
             };
         }
         catch (error) {
-            if (connection) {
+            if (reusedEstablishedJunctionAccount) {
+                // Never apply account-wide cleanup to a source-scoped Link attempt.
+                // Provider completion precedes hosted source admission, so a rejected
+                // obsolete Link can have recreated the exact provider registration.
+                // The hosted hook owns source-epoch-aware target cleanup; it is the
+                // only safe place to remove that registration without touching the
+                // established parent or a newer accepted source epoch.
+                const cleanupAccount = account ?? seededAccount;
+                if (connection && cleanupAccount && sourceProviderSlug) {
+                    try {
+                        await this.hooks.onConnectionSourceAdmissionRejected?.({
+                            account: cleanupAccount,
+                            connectionStartedAt: stateRecord.createdAt,
+                            sourceProviderSlug,
+                            provider,
+                            now,
+                        });
+                    }
+                    catch (cleanupError) {
+                        throw attachOAuthCallbackContext(cleanupError, callbackContext);
+                    }
+                }
+            }
+            else if (connection) {
                 try {
                     if (connectionPersisted && account) {
                         await this.cleanupPersistedOAuthConnection(provider, account, connection, now, error);
                     }
                     else if (isSeededAccountDisconnectedGuardError(error)) {
-                        await this.cleanupFailedOAuthConnection(provider, connection, now);
+                        if (!await this.ensureFailedOAuthConnectionCleanupOwnership(provider, connection, stateRecord.ownerId ?? null, now, { state, consumedAt: stateResult.consumedAt })) {
+                            throw createOAuthSetupCleanupOwnershipError(error);
+                        }
                     }
                     else if (seededAccountId) {
-                        await this.markSeededConnectionSetupFailed(provider, seededAccountId, seededConnectedAt, connection, now, error);
+                        await this.markSeededConnectionSetupFailed(provider, seededAccountId, seededConnectedAt, connection, stateRecord.ownerId ?? null, now, error, { state, consumedAt: stateResult.consumedAt });
                     }
                     else {
-                        await this.cleanupFailedOAuthConnection(provider, connection, now);
+                        if (!await this.ensureFailedOAuthConnectionCleanupOwnership(provider, connection, stateRecord.ownerId ?? null, now, { state, consumedAt: stateResult.consumedAt })) {
+                            throw createOAuthSetupCleanupOwnershipError(error);
+                        }
                     }
                 }
                 catch (cleanupError) {
@@ -850,75 +1018,63 @@ export class DeviceSyncPublicIngress {
             }
             else if (seededAccountId) {
                 try {
-                    await this.markSeededConnectionSetupFailed(provider, seededAccountId, seededConnectedAt, null, now, error);
+                    await this.markSeededConnectionSetupFailed(provider, seededAccountId, seededConnectedAt, null, stateRecord.ownerId ?? null, now, error, { state, consumedAt: stateResult.consumedAt });
                 }
                 catch (cleanupError) {
                     throw attachOAuthCallbackContext(cleanupError, callbackContext);
                 }
             }
+            if (!connection
+                && !seededAccountId
+                && (!providerWorkStarted
+                    || provider.provider === "junction")
+                && !await this.store.resolveOAuthStateWithoutProviderAuthority({
+                    state,
+                    consumedAt: stateResult.consumedAt,
+                })) {
+                throw attachOAuthCallbackContext(createOAuthSetupCleanupOwnershipError(error), callbackContext);
+            }
             throw attachOAuthCallbackContext(error, callbackContext);
         }
     }
-    async handleWebhook(providerName, headers, rawBody) {
-        const provider = this.requireProvider(providerName);
-        const verifyAndParseWebhook = resolveProviderWebhookVerifier(provider);
-        if (!provider.descriptor.webhook?.path || !verifyAndParseWebhook) {
-            throw deviceSyncError({
-                code: "WEBHOOKS_NOT_SUPPORTED",
-                message: `Device sync provider ${provider.provider} does not accept webhooks.`,
-                retryable: false,
-                httpStatus: 404,
-            });
-        }
-        const now = toIsoTimestamp(new Date());
-        const parsed = await verifyAndParseWebhook({
-            headers,
-            rawBody,
-            now,
-        });
-        const jobs = parsed.jobs.map((job) => normalizeConfiguredDeviceSyncJobInput(provider.provider, job, "webhook"));
-        const traceId = scopeWebhookTraceId(provider.provider, parsed.externalAccountId, parsed.traceId);
+    async prepareWebhookForDurableEnqueue(providerName, headers, rawBody, receivedAt) {
+        return this.prepareWebhook(providerName, headers, rawBody, receivedAt);
+    }
+    async handleWebhook(providerName, headers, rawBody, receivedAt = new Date()) {
+        return this.handlePreparedWebhook(await this.prepareWebhook(providerName, headers, rawBody, receivedAt));
+    }
+    async handlePreparedWebhook(value) {
+        const prepared = parsePreparedDeviceSyncWebhook(value);
+        // Provider registration remains live authority. The prepared event freezes
+        // only the authenticated envelope interpretation, never whether Murph
+        // still recognizes and permits this provider at dequeue.
+        const now = prepared.receivedAt;
+        const traceId = prepared.traceId;
         const claimToken = generateStateCode();
+        // One delivery-attempt instant owns trace leasing and pending-setup lifetime
+        // checks. The frozen receipt below remains provider event semantics.
+        const claimedAt = toIsoTimestamp(new Date());
         const webhook = toIngressWebhook({
-            ...parsed,
-            jobs,
+            ...prepared,
+            jobs: prepared.jobs,
         });
         const claimWebhookTrace = () => this.store.claimWebhookTrace({
-            provider: provider.provider,
+            provider: prepared.provider,
             traceId,
+            claimedAt,
             claimToken,
-            externalAccountId: parsed.externalAccountId,
+            externalAccountId: prepared.externalAccountId,
             eventType: webhook.eventType,
             receivedAt: now,
-            processingExpiresAt: addMilliseconds(now, WEBHOOK_TRACE_PROCESSING_TTL_MS),
+            processingExpiresAt: addMilliseconds(claimedAt, WEBHOOK_TRACE_PROCESSING_TTL_MS),
         });
-        const account = await this.store.getConnectionByExternalAccount(provider.provider, parsed.externalAccountId);
-        if (account?.status === "active" && webhook.acceptanceMode === "level_dirty_hint") {
-            // Only provider-declared level hints can be satisfied by committed dirty state.
-            // Exact webhook work must pass through trace claim and durable acceptance.
-            const alreadySatisfied = await this.hooks.onLevelDirtyWebhookAlreadySatisfied?.({
-                account,
-                traceId,
-                webhook,
-                provider,
-                now,
-            });
-            if (alreadySatisfied?.accepted === true) {
-                return {
-                    accepted: true,
-                    duplicate: false,
-                    provider: provider.provider,
-                    eventType: webhook.eventType,
-                    traceId,
-                };
-            }
-        }
+        const webhookSourceProviderSlug = normalizeString(webhook.sourceProviderSlug);
         const traceClaim = await claimWebhookTrace();
         if (traceClaim === "processed") {
             return {
                 accepted: true,
                 duplicate: true,
-                provider: provider.provider,
+                provider: prepared.provider,
                 eventType: webhook.eventType,
                 traceId,
             };
@@ -931,20 +1087,42 @@ export class DeviceSyncPublicIngress {
                 httpStatus: 503,
             });
         }
-        if (!account) {
+        // Queue delay can outlive a provider registration. The prepared meaning is
+        // already authenticated, so a removed provider is a terminal authority
+        // loss rather than a reason to retain encrypted work forever.
+        const provider = this.registry.get(prepared.provider);
+        if (!provider) {
+            await completeClaimedWebhookTrace(this.store, prepared.provider, traceId, claimToken);
+            return {
+                accepted: true,
+                duplicate: false,
+                provider: prepared.provider,
+                eventType: webhook.eventType,
+                traceId,
+            };
+        }
+        let webhookConnection;
+        try {
+            webhookConnection = await this.store.getWebhookConnectionByExternalAccount(provider.provider, prepared.externalAccountId);
+        }
+        catch (error) {
+            await this.store.releaseWebhookTrace(provider.provider, traceId, claimToken);
+            throw error;
+        }
+        if (!webhookConnection) {
             const unknownWebhookLogContext = {
                 provider: provider.provider,
-                externalAccountIdHash: hashExternalAccountIdForLogs(parsed.externalAccountId),
+                externalAccountIdHash: hashExternalAccountIdForLogs(prepared.externalAccountId),
                 eventType: webhook.eventType,
                 traceId,
                 acceptanceMode: webhook.acceptanceMode,
-                unknownAccountAction: parsed.unknownAccountAction ?? "retry",
+                unknownAccountAction: prepared.unknownAccountAction ?? "retry",
                 unknownWebhookHookConfigured: Boolean(this.hooks.onUnknownWebhook),
             };
-            if (parsed.externalAccountDiagnostic) {
-                unknownWebhookLogContext.externalAccountDiagnostic = parsed.externalAccountDiagnostic;
+            if (prepared.externalAccountDiagnostic) {
+                unknownWebhookLogContext.externalAccountDiagnostic = prepared.externalAccountDiagnostic;
             }
-            const shouldAcceptUnknownWebhook = parsed.unknownAccountAction === "accept"
+            const shouldAcceptUnknownWebhook = prepared.unknownAccountAction === "accept"
                 && webhook.acceptanceMode === "level_dirty_hint";
             this.logger.warn?.(shouldAcceptUnknownWebhook
                 ? "Accepting orphan webhook for unknown device sync account."
@@ -958,7 +1136,7 @@ export class DeviceSyncPublicIngress {
                             ...webhook,
                             jobs: [],
                         },
-                        externalAccountId: parsed.externalAccountId,
+                        externalAccountId: prepared.externalAccountId,
                         now,
                     });
                     await completeClaimedWebhookTrace(this.store, provider.provider, traceId, claimToken);
@@ -985,6 +1163,128 @@ export class DeviceSyncPublicIngress {
                 httpStatus: 503,
             });
         }
+        const { account, connectionOwnerId } = webhookConnection;
+        if (account.status === "active"
+            && isDeviceSyncConnectionSetupPending(account)
+            && isDeviceSyncConnectionSetupExpiredAt(account, claimedAt)) {
+            this.logger.warn?.("Ignoring webhook side effects for expired incomplete device sync setup.", {
+                provider: provider.provider,
+                accountId: account.id,
+                eventType: webhook.eventType,
+                traceId,
+            });
+            await completeClaimedWebhookTrace(this.store, provider.provider, traceId, claimToken);
+            return {
+                accepted: true,
+                duplicate: false,
+                provider: provider.provider,
+                eventType: webhook.eventType,
+                traceId,
+            };
+        }
+        let sourceAdmissionDeferred = false;
+        try {
+            // A dirty row proves only that import invalidation is queued. Await exact-
+            // source lifecycle work before dirty coalescing can complete this trace.
+            if (webhookSourceProviderSlug) {
+                const sourceInstanceKey = provider.provider === "junction"
+                    ? buildJunctionProviderSourceInstanceKey({
+                        connectionId: account.id,
+                        sourceProviderSlug: webhookSourceProviderSlug,
+                    })
+                    : null;
+                const source = await this.store.resolveConnectionSourceAdmissionCandidate({
+                    connectionId: account.id,
+                    ...(sourceInstanceKey ? { sourceInstanceKey } : {}),
+                    sourceProviderSlug: webhookSourceProviderSlug,
+                });
+                if (!source
+                    || source.status !== "connected"
+                    || isDeviceSyncSourceDisconnectFenced(source)) {
+                    const sourceObservation = await this.hooks.onConnectionSourceObserved?.({
+                        account,
+                        eventType: webhook.eventType,
+                        sourceProviderSlug: webhookSourceProviderSlug,
+                        provider,
+                        now,
+                    });
+                    sourceAdmissionDeferred = Boolean(sourceObservation
+                        && "sourceAdmissionDeferred" in sourceObservation
+                        && sourceObservation.sourceAdmissionDeferred === true
+                        && this.hooks.onWebhookAccepted);
+                    if (sourceObservation
+                        && "sourceRegistrationRemoved" in sourceObservation
+                        && sourceObservation.sourceRegistrationRemoved === true) {
+                        await completeClaimedWebhookTrace(this.store, provider.provider, traceId, claimToken);
+                        return {
+                            accepted: true,
+                            duplicate: false,
+                            provider: provider.provider,
+                            eventType: webhook.eventType,
+                            traceId,
+                        };
+                    }
+                    if (account.status === "active"
+                        && !isDeviceSyncConnectionSetupPending(account)
+                        && source
+                        && (!sourceObservation
+                            || !("sourceAdmissionCommitted" in sourceObservation)
+                            || sourceObservation.sourceAdmissionCommitted !== true)
+                        && !(sourceObservation
+                            && "sourceAdmissionDeferred" in sourceObservation
+                            && sourceObservation.sourceAdmissionDeferred === true)) {
+                        throw deviceSyncError({
+                            code: "WEBHOOK_SOURCE_NOT_READY",
+                            message: "Device source setup must finish before its webhook can be accepted.",
+                            retryable: true,
+                            httpStatus: 503,
+                        });
+                    }
+                }
+            }
+            if (account.status === "active"
+                && !isDeviceSyncConnectionSetupPending(account)
+                && webhook.acceptanceMode === "level_dirty_hint") {
+                const alreadySatisfied = await this.hooks.onLevelDirtyWebhookAlreadySatisfied?.({
+                    account,
+                    traceId,
+                    webhook,
+                    provider,
+                    now,
+                });
+                if (alreadySatisfied?.accepted === true) {
+                    await completeClaimedWebhookTrace(this.store, provider.provider, traceId, claimToken);
+                    return {
+                        accepted: true,
+                        duplicate: false,
+                        provider: provider.provider,
+                        eventType: webhook.eventType,
+                        traceId,
+                    };
+                }
+            }
+        }
+        catch (error) {
+            await this.store.releaseWebhookTrace(provider.provider, traceId, claimToken);
+            throw error;
+        }
+        if (account.status === "active"
+            && isDeviceSyncConnectionSetupPending(account)
+            && !sourceAdmissionDeferred) {
+            this.logger.warn?.("Delaying webhook side effects until device sync setup is confirmed.", {
+                provider: provider.provider,
+                accountId: account.id,
+                eventType: webhook.eventType,
+                traceId,
+            });
+            await this.store.releaseWebhookTrace(provider.provider, traceId, claimToken);
+            throw deviceSyncError({
+                code: "WEBHOOK_ACCOUNT_NOT_READY",
+                message: "Device sync setup must finish before webhook side effects can be accepted.",
+                retryable: true,
+                httpStatus: 503,
+            });
+        }
         switch (account.status) {
             case "active":
                 break;
@@ -1021,15 +1321,20 @@ export class DeviceSyncPublicIngress {
                 };
         }
         const onWebhookAccepted = this.hooks.onWebhookAccepted;
+        let receiptStateOwned = false;
         try {
             const acceptedResult = await onWebhookAccepted?.({
                 account,
                 claimToken,
+                connectionOwnerId,
+                processingAttemptedAt: claimedAt,
+                sourceAdmissionDeferred,
                 traceId,
                 webhook,
                 provider,
                 now,
             });
+            receiptStateOwned = acceptedResult?.receiptStateOwned === true;
             if (!onWebhookAccepted) {
                 await completeClaimedWebhookTrace(this.store, provider.provider, traceId, claimToken);
             }
@@ -1047,7 +1352,9 @@ export class DeviceSyncPublicIngress {
             throw error;
         }
         try {
-            await this.store.markWebhookReceived(account.id, now);
+            if (!receiptStateOwned) {
+                await this.store.markWebhookReceived(account.id, now);
+            }
         }
         catch (error) {
             this.logger.warn?.("Failed to record last webhook receipt time after durable acceptance.", {
@@ -1064,7 +1371,7 @@ export class DeviceSyncPublicIngress {
         // arrival against the source the provider named. Like the receipt stamp,
         // this runs after durable acceptance and never fails the webhook.
         const dataSourceProviderSlug = webhook.dataSourceProviderSlug ?? null;
-        if (dataSourceProviderSlug) {
+        if (dataSourceProviderSlug && !receiptStateOwned) {
             try {
                 await this.store.markConnectionSourceDataReceived({
                     connectionId: account.id,
@@ -1091,6 +1398,34 @@ export class DeviceSyncPublicIngress {
             traceId,
         };
     }
+    async prepareWebhook(providerName, headers, rawBody, receivedAt) {
+        const provider = this.requireProvider(providerName);
+        const verifyAndParseWebhook = resolveProviderWebhookVerifier(provider);
+        if (!provider.descriptor.webhook?.path || !verifyAndParseWebhook) {
+            throw deviceSyncError({
+                code: "WEBHOOKS_NOT_SUPPORTED",
+                message: `Device sync provider ${provider.provider} does not accept webhooks.`,
+                retryable: false,
+                httpStatus: 404,
+            });
+        }
+        const now = toIsoTimestamp(receivedAt);
+        const parsed = await verifyAndParseWebhook({
+            headers,
+            rawBody,
+            now,
+        });
+        const jobs = parsed.jobs.map((job) => normalizeConfiguredDeviceSyncJobInput(provider.provider, job, "webhook"));
+        const traceId = scopeWebhookTraceId(provider.provider, parsed.externalAccountId, parsed.traceId);
+        return parsePreparedDeviceSyncWebhook({
+            ...parsed,
+            jobs,
+            provider: provider.provider,
+            receivedAt: now,
+            schema: DEVICE_SYNC_PREPARED_WEBHOOK_SCHEMA,
+            traceId,
+        });
+    }
     requireProvider(providerName) {
         const provider = this.registry.get(providerName);
         if (!provider) {
@@ -1123,34 +1458,23 @@ export class DeviceSyncPublicIngress {
         }
         return resolved;
     }
-    async cleanupFailedOAuthConnection(provider, connection, now) {
-        let credential;
-        try {
-            credential = readProviderConnectionCredential(connection);
-        }
-        catch (error) {
-            this.logger.warn?.("Skipping provider access revocation after invalid callback credential material.", {
-                provider: provider.provider,
-                externalAccountIdHash: hashExternalAccountIdForLogs(connection.externalAccountId),
-                failureCode: "DEVICE_SYNC_INVALID_CALLBACK_CREDENTIAL_REVOKE_SKIPPED",
-                error: summarizePublicIngressError(error),
-            });
-            return;
-        }
+    async revokeStoredOAuthCleanupAccount(provider, account) {
         const revokeAccess = provider.connectionHandler?.revokeAccess;
-        if (!revokeAccess || credential?.kind !== "oauth_tokens") {
-            return;
+        if (!revokeAccess || account.credential.kind !== "oauth_tokens") {
+            return true;
         }
         try {
-            await revokeAccess(buildPendingOAuthCleanupAccount(provider.provider, connection, now));
+            await revokeAccess(account);
+            return true;
         }
         catch (error) {
             this.logger.warn?.("Failed to revoke provider access after OAuth callback setup failed.", {
                 provider: provider.provider,
-                externalAccountIdHash: hashExternalAccountIdForLogs(connection.externalAccountId),
+                externalAccountIdHash: hashExternalAccountIdForLogs(account.externalAccountId),
                 failureCode: "DEVICE_SYNC_OAUTH_SETUP_FAILURE_REVOKE_FAILED",
                 error: summarizePublicIngressError(error),
             });
+            return false;
         }
     }
     async cleanupPersistedOAuthConnection(provider, account, connection, now, error) {
@@ -1173,10 +1497,15 @@ export class DeviceSyncPublicIngress {
                 failureCode: "DEVICE_SYNC_OAUTH_SETUP_FAILURE_RECORD_FAILED",
                 error: summarizePublicIngressError(markError),
             });
+            const durableAccount = await this.store.getConnectionById(account.id);
+            if (durableAccount) {
+                return;
+            }
             throw deviceSyncError({
                 code: "OAUTH_SETUP_CLEANUP_FAILED",
-                message: "OAuth connection setup failed after persistence, and stored-token cleanup did not complete.",
-                httpStatus: 500,
+                message: "OAuth connection setup failed after persistence, and cleanup ownership could not be confirmed.",
+                httpStatus: 503,
+                retryable: true,
                 details: {
                     accountId: account.id,
                     setupFailureCode: failure.code,
@@ -1195,12 +1524,53 @@ export class DeviceSyncPublicIngress {
                 },
             });
         }
-        if (markResult.applied) {
-            await this.cleanupFailedOAuthConnection(provider, connection, now);
+        if (markResult.blockedByRefreshLease) {
+            return;
+        }
+        if (!markResult.applied || markResult.oauthTokenVersion === null) {
+            return;
+        }
+        const cleanupAccount = await this.store.getOAuthCleanupAccount({
+            accountId: account.id,
+            expectedConnectedAt: account.connectedAt,
+            expectedTokenVersion: markResult.oauthTokenVersion,
+        });
+        if (cleanupAccount
+            && await this.revokeStoredOAuthCleanupAccount(provider, cleanupAccount)) {
+            await this.store.clearOAuthCredentialAfterConfirmedRevoke({
+                accountId: account.id,
+                expectedConnectedAt: account.connectedAt,
+                expectedTokenVersion: markResult.oauthTokenVersion,
+                now,
+            });
         }
     }
-    async markSeededConnectionSetupFailed(provider, accountId, expectedConnectedAt, connection, now, error) {
+    async markSeededConnectionSetupFailed(provider, accountId, expectedConnectedAt, connection, ownerId, now, error, oauthClaim) {
         const failure = summarizeOAuthSetupFailure(error);
+        if (!connection
+            && oauthClaim
+            && isSeededAccountDisconnectedGuardError(error)) {
+            if (await this.store.resolveOAuthStateWithoutProviderAuthority(oauthClaim)) {
+                return;
+            }
+            throw createOAuthSetupCleanupOwnershipError(error);
+        }
+        if (connection
+            && readProviderConnectionCredential(connection)?.kind === "oauth_tokens") {
+            if (!await this.ensureFailedOAuthConnectionCleanupOwnership(provider, connection, ownerId, now, oauthClaim)) {
+                throw deviceSyncError({
+                    code: "CONNECTION_SETUP_CLEANUP_FAILED",
+                    message: "Seeded device sync setup failed, and provider cleanup ownership could not be persisted.",
+                    httpStatus: 503,
+                    retryable: true,
+                    details: {
+                        accountId,
+                        setupFailureCode: failure.code,
+                    },
+                });
+            }
+            oauthClaim = undefined;
+        }
         let markResult;
         try {
             markResult = await this.store.markConnectionSetupFailed({
@@ -1209,6 +1579,7 @@ export class DeviceSyncPublicIngress {
                 now,
                 code: failure.code,
                 message: failure.message,
+                oauthClaim,
             });
         }
         catch (markError) {
@@ -1230,18 +1601,106 @@ export class DeviceSyncPublicIngress {
             });
         }
         if (!markResult.account) {
+            if (oauthClaim
+                && await this.store.resolveOAuthStateWithoutProviderAuthority(oauthClaim)) {
+                return;
+            }
             throw deviceSyncError({
                 code: "CONNECTION_SETUP_CLEANUP_FAILED",
-                message: "Seeded device sync connection setup failed, and setup failure could not confirm the account.",
-                httpStatus: 500,
+                message: "Seeded device sync connection setup failed, and its exact callback claim could not be resolved.",
+                httpStatus: 503,
+                retryable: true,
                 details: {
                     accountId,
                     setupFailureCode: failure.code,
                 },
             });
         }
-        if (markResult.applied && connection) {
-            await this.cleanupFailedOAuthConnection(provider, connection, now);
+        if (!markResult.applied && oauthClaim) {
+            const resolved = await this.store.resolveOAuthStateWithoutProviderAuthority(oauthClaim);
+            if (!resolved) {
+                throw deviceSyncError({
+                    code: "CONNECTION_SETUP_CLEANUP_FAILED",
+                    message: "Seeded device sync callback claim changed before setup failure resolved.",
+                    httpStatus: 503,
+                    retryable: true,
+                    details: {
+                        accountId,
+                        setupFailureCode: failure.code,
+                    },
+                });
+            }
+        }
+    }
+    async ensureFailedOAuthConnectionCleanupOwnership(provider, connection, ownerId, now, oauthClaim) {
+        if (readProviderConnectionCredential(connection)?.kind !== "oauth_tokens") {
+            return oauthClaim
+                ? this.store.resolveOAuthStateWithoutProviderAuthority(oauthClaim)
+                : true;
+        }
+        const ownership = await this.persistFailedOAuthConnectionCleanupOwner(provider, connection, ownerId, now, oauthClaim);
+        if (!ownership) {
+            return false;
+        }
+        const markResult = await this.store.markConnectionSetupFailed({
+            accountId: ownership.account.id,
+            code: "OAUTH_SETUP_FAILED",
+            expectedConnectedAt: ownership.account.connectedAt,
+            message: "OAuth callback setup failed before connection establishment completed.",
+            now,
+        });
+        if (markResult.blockedByRefreshLease) {
+            return true;
+        }
+        if (!markResult.applied || markResult.oauthTokenVersion === null) {
+            return true;
+        }
+        const cleanupAccount = await this.store.getOAuthCleanupAccount({
+            accountId: ownership.account.id,
+            expectedConnectedAt: ownership.account.connectedAt,
+            expectedTokenVersion: markResult.oauthTokenVersion,
+        });
+        if (cleanupAccount
+            && await this.revokeStoredOAuthCleanupAccount(provider, cleanupAccount)) {
+            await this.store.clearOAuthCredentialAfterConfirmedRevoke({
+                accountId: ownership.account.id,
+                expectedConnectedAt: ownership.account.connectedAt,
+                expectedTokenVersion: markResult.oauthTokenVersion,
+                now,
+            });
+        }
+        return true;
+    }
+    async persistFailedOAuthConnectionCleanupOwner(provider, connection, ownerId, now, oauthClaim) {
+        try {
+            const credential = resolveAndValidateProviderConnectionCredential(provider, connection);
+            const account = await this.store.upsertConnection({
+                cleanupOwnership: "oauth_provider_revoke",
+                connectedAt: now,
+                credential,
+                displayName: connection.displayName ?? null,
+                existingAccountPolicy: "replace",
+                externalAccountId: connection.externalAccountId,
+                metadata: connection.metadata ?? {},
+                nextReconcileAt: null,
+                ownerId,
+                provider: provider.provider,
+                scopes: [...(connection.scopes ?? [])],
+                setupExpiresAt: null,
+                setupPhase: "failed",
+                status: "reauthorization_required",
+                oauthClaim,
+            });
+            return { account };
+        }
+        catch (error) {
+            this.logger.warn?.("Failed to persist provider cleanup ownership after OAuth setup failure.", {
+                provider: provider.provider,
+                externalAccountIdHash: hashExternalAccountIdForLogs(connection.externalAccountId),
+                failureCode: "DEVICE_SYNC_OAUTH_CLEANUP_OWNER_PERSIST_FAILED",
+                error: summarizePublicIngressError(error),
+            });
+            return null;
         }
     }
 }
@@ -1265,40 +1724,6 @@ export function createDeviceSyncPublicIngress(input) {
 function hashExternalAccountIdForLogs(value) {
     return sha256Text(value);
 }
-function buildPendingOAuthCleanupAccount(provider, connection, now) {
-    const tokens = requireConnectionOAuthTokens(connection);
-    return {
-        id: `pending-oauth:${provider}:${connection.externalAccountId}`,
-        provider,
-        externalAccountId: connection.externalAccountId,
-        disconnectGeneration: 0,
-        displayName: connection.displayName ?? null,
-        status: "active",
-        setupPhase: null,
-        setupExpiresAt: null,
-        scopes: [...(connection.scopes ?? [])],
-        accessTokenExpiresAt: tokens.accessTokenExpiresAt ?? null,
-        metadata: { ...(connection.metadata ?? {}) },
-        connectedAt: now,
-        lastWebhookAt: null,
-        lastSyncStartedAt: null,
-        lastSyncCompletedAt: null,
-        lastSyncErrorAt: null,
-        lastErrorCode: null,
-        lastErrorMessage: null,
-        nextReconcileAt: connection.nextReconcileAt ?? null,
-        createdAt: now,
-        updatedAt: now,
-        credential: {
-            kind: "oauth_tokens",
-            tokens: {
-                accessToken: tokens.accessToken,
-                refreshToken: tokens.refreshToken ?? null,
-                accessTokenExpiresAt: tokens.accessTokenExpiresAt ?? null,
-            },
-        },
-    };
-}
 function summarizePublicIngressError(error) {
     if (error instanceof Error) {
         const cause = toPlainRecord(error.cause);
@@ -1336,6 +1761,15 @@ function summarizeOAuthSetupFailure(error) {
         message: sanitizeHostedRuntimeErrorText(rawMessage) ?? "OAuth connection setup failed.",
     };
 }
+function createOAuthSetupCleanupOwnershipError(cause) {
+    return deviceSyncError({
+        code: "OAUTH_SETUP_CLEANUP_FAILED",
+        message: "OAuth connection setup failed, and cleanup ownership could not be confirmed.",
+        httpStatus: 503,
+        retryable: true,
+        cause,
+    });
+}
 function attachOAuthCallbackContext(error, context) {
     if (!isDeviceSyncError(error)) {
         return error;
@@ -1364,6 +1798,7 @@ export { createDeviceSyncRegistry } from "./registry.js";
 export { toRedactedPublicDeviceSyncAccount } from "./public-account.js";
 export { sanitizeStoredDeviceSyncMetadata } from "./shared.js";
 export { resolveDeviceSyncWebhookPreflightResponse } from "./webhook-verification.js";
+export { createJunctionDeviceSyncProvider } from "./providers/junction.js";
 export { createOuraDeviceSyncProvider } from "./providers/oura.js";
 export { createWhoopDeviceSyncProvider } from "./providers/whoop.js";
 export { createStravaDeviceSyncProvider, resolveStravaWebhookPreflightResponse } from "./providers/strava.js";