@yielded/auth-persistence-drizzle 0.1.0-beta.0 → 0.1.0-beta.12

package/src/drizzle/mysql-passwords.ts

@@ -5,10 +5,13 @@ import type { AnyRelations } from "drizzle-orm";
 import type { EffectMysql2Database } from "drizzle-orm/effect-mysql2";
 import type { AnyMySqlTable } from "drizzle-orm/mysql-core";
 import { Effect, Context } from "effect";
-import type { SqlError } from "effect/unstable/sql/SqlError";
+import type { SqlError } from "effect/sql/SqlError";
 
+import { Database as DatabaseService } from "./mysql-database";
+import { nativeDatabase } from "./native-database";
 import type { PasswordPersistenceMapping, PasswordRegistrationMapping } from "./password-model";
 import type { PasswordRegistrationAuthority } from "./password-registration";
+import { CurrentPasswordSql } from "./password-sql";
 import type { PasswordSqlQuery } from "./password-sql";
 import {
   coordinateTargetPasswordPersistence,
@@ -20,22 +23,27 @@ import {
 import type { ProofPersistenceMapping } from "./proof-model";
 import type { ProofSqlQuery } from "./proof-sql";
 import { sqlClientProofStandaloneGuard } from "./proof-target";
+import {
+  type TransactionService,
+  acquireTransactionService,
+  transactionService,
+} from "./standalone-guard";
 import type { SuppliedService } from "./SuppliedService";
 
 type Database = EffectMysql2Database<AnyRelations>;
 type TransactionOf<D extends Database> = Parameters<Parameters<D["transaction"]>[0]>[0];
 
-const configuration = (database: Database) => ({
+const configuration = (service: TransactionService | undefined) => ({
   mode: "interactive" as const,
   locking: true,
-  standaloneGuard: sqlClientPasswordStandaloneGuard(database),
+  standaloneGuard: sqlClientPasswordStandaloneGuard(service),
   insertIfAbsent: (query: PasswordSqlQuery, selfKey: string, selfValue: unknown) =>
     query.onDuplicateKeyUpdate({ set: { [selfKey]: selfValue } }),
   generatedSubjectRows: (query: PasswordSqlQuery) => query.$returningId(),
   proof: {
     mode: "interactive" as const,
     locking: true,
-    standaloneGuard: sqlClientProofStandaloneGuard(database),
+    standaloneGuard: sqlClientProofStandaloneGuard(service),
     insertIfAbsent: (query: ProofSqlQuery, selfKey: string, selfValue: unknown) =>
       query.onDuplicateKeyUpdate({ set: { [selfKey]: selfValue } }),
   },
@@ -64,7 +72,6 @@ export const makeMysqlPasswordPersistenceServices = <
   M extends AnyMySqlTable,
   NativeId,
 >(
-  database: Database,
   mapping: Mapping<S, I, C, AC, A, RS, CE, M, NativeId>,
   proofMapping?: ProofPersistenceMapping<
     any,
@@ -81,7 +88,10 @@ export const makeMysqlPasswordPersistenceServices = <
     any
   >,
 ) =>
-  makeTargetPasswordPersistenceServices(database, mapping, configuration(database), proofMapping);
+  Effect.flatMap(
+    Effect.map(acquireTransactionService(DatabaseService), configuration),
+    (configuration) => makeTargetPasswordPersistenceServices(mapping, configuration, proofMapping),
+  ).pipe(Effect.provideServiceEffect(CurrentPasswordSql, nativeDatabase(DatabaseService)));
 
 export function coordinateMysqlPasswordPersistence<
   D extends Database,
@@ -189,7 +199,7 @@ export function coordinateMysqlPasswordPersistence<
     coordinateTargetPasswordPersistence<TransactionOf<D>, Out, E, Exclude<R, PasswordPersistence>>(
       database,
       options.mapping,
-      configuration(database),
+      configuration(transactionService(database)),
       options.proofMapping,
       (
         transaction: TransactionOf<D>,
@@ -215,10 +225,12 @@ export const makeMysqlPasswordRegistrationServices = <
   Rq extends AnyMySqlTable,
   NativeId,
 >(
-  database: Database,
   mapping: PasswordRegistrationMapping<Registration, S, I, C, AC, Rq, NativeId>,
 ) =>
-  makeTargetPasswordRegistrationServices<Registration>(database, mapping, configuration(database));
+  Effect.flatMap(
+    Effect.map(acquireTransactionService(DatabaseService), configuration),
+    (configuration) => makeTargetPasswordRegistrationServices<Registration>(mapping, configuration),
+  ).pipe(Effect.provideServiceEffect(CurrentPasswordSql, nativeDatabase(DatabaseService)));
 
 export function coordinateMysqlPasswordRegistration<
   TargetId,
@@ -320,7 +332,7 @@ export function coordinateMysqlPasswordRegistration<
     >(
       database,
       options.mapping,
-      configuration(database),
+      configuration(transactionService(database)),
       (
         transaction: TransactionOf<D>,
         services: { readonly registrationAuthority: PasswordRegistrationAuthority<Registration> },

package/src/drizzle/mysql-proofs.ts

@@ -4,16 +4,24 @@ import type { AnyRelations } from "drizzle-orm";
 import type { EffectMysql2Database } from "drizzle-orm/effect-mysql2";
 import type { AnyMySqlTable } from "drizzle-orm/mysql-core";
 import { Effect, Context } from "effect";
-import type { SqlError } from "effect/unstable/sql/SqlError";
+import type { SqlError } from "effect/sql/SqlError";
 
 import { updateValues } from "./model";
+import { Database as DatabaseService } from "./mysql-database";
+import { nativeDatabase } from "./native-database";
 import type { ProofPersistenceMapping } from "./proof-model";
+import { CurrentProofSql } from "./proof-sql";
 import type { ProofSqlQuery } from "./proof-sql";
 import {
   coordinateTargetProofPersistence,
   makeTargetProofPersistenceServices,
   sqlClientProofStandaloneGuard,
 } from "./proof-target";
+import {
+  type TransactionService,
+  acquireTransactionService,
+  transactionService,
+} from "./standalone-guard";
 import type { SuppliedService } from "./SuppliedService";
 
 type Database = EffectMysql2Database<AnyRelations>;
@@ -33,10 +41,10 @@ type Mapping<
   NativeId,
 > = ProofPersistenceMapping<Rq, S, G, Cn, Rs, A, F, C, Sub, I, Cr, NativeId>;
 
-const configuration = (database: Database) => ({
+const configuration = (service: TransactionService | undefined) => ({
   mode: "interactive" as const,
   locking: true,
-  standaloneGuard: sqlClientProofStandaloneGuard(database),
+  standaloneGuard: sqlClientProofStandaloneGuard(service),
   insertIfAbsent: (query: ProofSqlQuery, selfKey: string, selfValue: unknown) =>
     query.onDuplicateKeyUpdate({
       set: updateValues([[selfKey, selfValue]]),
@@ -57,9 +65,12 @@ export const makeMysqlProofPersistenceServices = <
   Cr extends AnyMySqlTable,
   NativeId,
 >(
-  database: Database,
   mapping: Mapping<Rq, S, G, Cn, Rs, A, F, C, Sub, I, Cr, NativeId>,
-) => makeTargetProofPersistenceServices(database, mapping, configuration(database));
+) =>
+  Effect.flatMap(
+    Effect.map(acquireTransactionService(DatabaseService), configuration),
+    (configuration) => makeTargetProofPersistenceServices(mapping, configuration),
+  ).pipe(Effect.provideServiceEffect(CurrentProofSql, nativeDatabase(DatabaseService)));
 
 export function coordinateMysqlProofPersistence<
   D extends Database,
@@ -164,7 +175,7 @@ export function coordinateMysqlProofPersistence<
     coordinateTargetProofPersistence<Transaction, A, E, Exclude<R, ProofPersistence>>(
       database,
       options.mapping,
-      configuration(database),
+      configuration(transactionService(database)),
       (
         transaction: Transaction,
         services: { readonly proofPersistence: ProofPersistence["Service"] },

package/src/drizzle/mysql-sessions.ts

@@ -12,14 +12,17 @@ import type { AnyRelations } from "drizzle-orm";
 import type { EffectMysql2Database } from "drizzle-orm/effect-mysql2";
 import type { AnyMySqlTable } from "drizzle-orm/mysql-core";
 import { Effect, Context } from "effect";
-import type { SqlError } from "effect/unstable/sql/SqlError";
+import type { SqlError } from "effect/sql/SqlError";
 
+import { Database as DatabaseService } from "./mysql-database";
+import { nativeDatabase } from "./native-database";
 import type {
   AuthenticationAuthorityMapping,
   PendingAuthenticationMapping,
   SignedSessionValidityMapping,
   StatefulSessionMapping,
 } from "./session-model";
+import { CurrentSessionSql } from "./session-sql";
 import {
   coordinateTargetAuthenticationAuthority,
   coordinateTargetPendingAuthentication,
@@ -33,15 +36,20 @@ import {
   makeTargetSessionStepUpServices,
   coordinateTargetSessionStepUp,
 } from "./session-target";
+import {
+  type TransactionService,
+  acquireTransactionService,
+  transactionService,
+} from "./standalone-guard";
 import type { SuppliedService } from "./SuppliedService";
 
 type Database = EffectMysql2Database<AnyRelations>;
 type Transaction = Parameters<Parameters<Database["transaction"]>[0]>[0];
 
-const configuration = (database: Database) => ({
+const configuration = (service: TransactionService | undefined) => ({
   mode: "interactive" as const,
   locking: true,
-  standaloneGuard: sqlClientSessionStandaloneGuard(database),
+  standaloneGuard: sqlClientSessionStandaloneGuard(service),
 });
 
 export const makeMysqlAuthenticationAuthorityServices = <
@@ -52,9 +60,12 @@ export const makeMysqlAuthenticationAuthorityServices = <
   P extends AnyMySqlTable,
   NativeId,
 >(
-  database: Database,
   mapping: AuthenticationAuthorityMapping<Claims, S, C, F, P, NativeId>,
-) => makeTargetAuthenticationAuthorityServices<Claims>(database, mapping, configuration(database));
+) =>
+  Effect.flatMap(
+    Effect.map(acquireTransactionService(DatabaseService), configuration),
+    (configuration) => makeTargetAuthenticationAuthorityServices<Claims>(mapping, configuration),
+  ).pipe(Effect.provideServiceEffect(CurrentSessionSql, nativeDatabase(DatabaseService)));
 
 export const makeMysqlPendingAuthenticationServices = <
   Claims,
@@ -64,9 +75,12 @@ export const makeMysqlPendingAuthenticationServices = <
   F extends AnyMySqlTable,
   NativeId,
 >(
-  database: Database,
   mapping: PendingAuthenticationMapping<Claims, S, C, P, F, NativeId>,
-) => makeTargetPendingAuthenticationServices<Claims>(database, mapping, configuration(database));
+) =>
+  Effect.flatMap(
+    Effect.map(acquireTransactionService(DatabaseService), configuration),
+    (configuration) => makeTargetPendingAuthenticationServices<Claims>(mapping, configuration),
+  ).pipe(Effect.provideServiceEffect(CurrentSessionSql, nativeDatabase(DatabaseService)));
 
 export const makeMysqlStatefulSessionServices = <
   Claims,
@@ -78,9 +92,12 @@ export const makeMysqlStatefulSessionServices = <
   NativeId,
   NativeSessionId,
 >(
-  database: Database,
   mapping: StatefulSessionMapping<Claims, S, C, Session, F, P, NativeId, NativeSessionId>,
-) => makeTargetStatefulSessionServices<Claims>(database, mapping, configuration(database));
+) =>
+  Effect.flatMap(
+    Effect.map(acquireTransactionService(DatabaseService), configuration),
+    (configuration) => makeTargetStatefulSessionServices<Claims>(mapping, configuration),
+  ).pipe(Effect.provideServiceEffect(CurrentSessionSql, nativeDatabase(DatabaseService)));
 
 export const makeMysqlSignedSessionValidityServices = <
   S extends AnyMySqlTable,
@@ -88,9 +105,12 @@ export const makeMysqlSignedSessionValidityServices = <
   NativeId,
   NativeSessionId,
 >(
-  database: Database,
   mapping: SignedSessionValidityMapping<S, T, NativeId, NativeSessionId>,
-) => makeTargetSignedSessionValidityServices(database, mapping, configuration(database));
+) =>
+  Effect.flatMap(
+    Effect.map(acquireTransactionService(DatabaseService), configuration),
+    (configuration) => makeTargetSignedSessionValidityServices(mapping, configuration),
+  ).pipe(Effect.provideServiceEffect(CurrentSessionSql, nativeDatabase(DatabaseService)));
 
 export function coordinateMysqlAuthenticationAuthority<
   D extends Database,
@@ -183,7 +203,7 @@ export function coordinateMysqlAuthenticationAuthority<
     >(
       database,
       options.mapping,
-      configuration(database),
+      configuration(transactionService(database)),
       (
         transaction: Transaction,
         services: { readonly authenticationAuthority: AuthenticationAuthority["Service"] },
@@ -290,7 +310,7 @@ export function coordinateMysqlPendingAuthentication<
     coordinateTargetPendingAuthentication<Claims, Transaction, A, E, Exclude<R, TargetId>>(
       database,
       options.mapping,
-      configuration(database),
+      configuration(transactionService(database)),
       (
         transaction: Transaction,
         services: { readonly pendingAuthentication: PendingAuthentication<Claims> },
@@ -442,7 +462,7 @@ export function coordinateMysqlStatefulSessions<
     >(
       database,
       options.mapping,
-      configuration(database),
+      configuration(transactionService(database)),
       (
         transaction: Transaction,
         services: {
@@ -550,7 +570,7 @@ export function coordinateMysqlSignedSessionValidity<
     coordinateTargetSignedSessionValidity<Transaction, A, E, Exclude<R, TargetId>>(
       database,
       options.mapping,
-      configuration(database),
+      configuration(transactionService(database)),
       (
         transaction: Transaction,
         services: { readonly signedSessionValidity: SignedSessionValidity },
@@ -579,10 +599,13 @@ export const makeMysqlSessionStepUpServices = <
   NativeId,
   NativeSessionId,
 >(
-  database: Database,
   mapping: SessionStepUpMapping<NoInfer<Claims>, S, C, I, Session, T, NativeId, NativeSessionId>,
   target: Context.Service<Id, SessionStepUpPersistence<Claims>>,
-) => makeTargetSessionStepUpServices(database, mapping, target, configuration(database));
+) =>
+  Effect.flatMap(
+    Effect.map(acquireTransactionService(DatabaseService), configuration),
+    (configuration) => makeTargetSessionStepUpServices(mapping, target, configuration),
+  ).pipe(Effect.provideServiceEffect(CurrentSessionSql, nativeDatabase(DatabaseService)));
 
 export function coordinateMysqlSessionStepUp<
   Claims,
@@ -724,7 +747,7 @@ export function coordinateMysqlSessionStepUp<
       database,
       options.mapping,
       options.target,
-      configuration(database),
+      configuration(transactionService(database)),
       (
         transaction: Parameters<Parameters<D["transaction"]>[0]>[0],
         services: { readonly sessionStepUpPersistence: SessionStepUpPersistence<Claims> },

package/src/drizzle/native-database.ts

@@ -0,0 +1,22 @@
+import type {
+  TransactionNativeDatabase,
+  SessionSqlDatabase,
+  PasswordSqlDatabase,
+  EmailSqlDatabase,
+  ProofSqlDatabase,
+} from "@yielded/auth-persistence/Adapter";
+import { type Context, Effect } from "effect";
+
+/** Drizzle omits its captured $client from database class types, and only D1
+ * exposes batch. Its generic query builders implement the SQL kernel contracts
+ * through drizzleQueryOperations. The selected driver mode controls native calls. */
+export const nativeDatabase = <Id, Database>(databaseService: Context.Key<Id, Database>) =>
+  Effect.map(
+    Effect.service(databaseService),
+    (database) =>
+      database as unknown as TransactionNativeDatabase &
+        SessionSqlDatabase &
+        PasswordSqlDatabase &
+        EmailSqlDatabase &
+        ProofSqlDatabase,
+  );

package/src/drizzle/oauth-connected-access.ts

@@ -132,6 +132,7 @@ export const claimRefresh = Effect.fn("oauthConnected.claimRefresh")(function* (
 
   const claim = snapshotOAuthSync(M.OAuthConnectedRefreshClaim, {
     grant: input.grant,
+    order: String(yield* S.nextOrder(mapping, read.client)),
     claimId: input.claimId,
     claimedAtMillis: read.now,
     claimExpiresAtMillis: expires,
@@ -204,10 +205,16 @@ export const settleRefresh = Effect.fn("oauthConnected.settleRefresh")(function*
   if (incoming !== undefined)
     invariant(
       C.sameContext(
-        { ...incoming.context, tokenVersion: old.tokenVersion, metadata: old.metadata },
+        {
+          ...incoming.context,
+          tokenVersion: old.tokenVersion,
+          metadata: old.metadata,
+          exchangeOrder: old.exchangeOrder,
+        },
         old,
       ) &&
         incoming.context.tokenVersion === input.claim.nextTokenVersion &&
+        incoming.context.exchangeOrder === input.claim.order &&
         validMetadata(incoming.context, now) &&
         incoming.context.metadata.obtainedAtMillis >= input.claim.claimedAtMillis &&
         (incoming.context.metadata.refreshUseUntilMillis === undefined ||

package/src/drizzle/oauth-connected-drivers.ts

@@ -1,3 +1,4 @@
+import { NativeDatabase } from "@yielded/auth-persistence/Adapter";
 import type { LifecycleHooks } from "@yielded/auth/Hooks";
 import {
   OAuthConnectedPersistence,
@@ -9,6 +10,7 @@ import { Effect, Context } from "effect";
 
 import { makeD1Owner } from "./d1-planning";
 import { D1BatchStatements } from "./D1BatchStatements";
+import { nativeDatabase } from "./native-database";
 import type {
   OAuthConnectedMapping,
   OAuthConnectedRevocationMapping,
@@ -28,11 +30,13 @@ type TransactionOf<D> = D extends { readonly transaction: (...args: any[]) => an
 const unavailable = () => OAuthUnavailable.make({});
 
 export const makeOAuthConnectedTarget = <
+  DatabaseId,
   Database,
   Family extends Table,
   Extra = {},
   Synchronous extends boolean = false,
 >(
+  databaseService: Context.Service<DatabaseId, Database>,
   configuration: OAuthTargetConfiguration,
 ) => {
   function coordinateOAuthConnected<
@@ -300,9 +304,11 @@ export const makeOAuthConnectedTarget = <
       N,
       J extends Family = never,
     >(
-      database: Database,
       mapping: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, UA, DC, N, J> & Extra,
-    ) => makeTargetOAuthConnectedServices(database, mapping, configuration),
+    ) =>
+      makeTargetOAuthConnectedServices(mapping, configuration).pipe(
+        Effect.provideServiceEffect(NativeDatabase, nativeDatabase(databaseService)),
+      ),
     makeOAuthConnectedRevocationServices: <
       T extends Family,
       O extends Family,
@@ -313,15 +319,18 @@ export const makeOAuthConnectedTarget = <
       J extends Family,
       N,
     >(
-      database: Database,
       mapping: OAuthConnectedRevocationMapping<T, O, F, G, C, H, J, N> & Extra,
-    ) => makeTargetOAuthConnectedRevocationServices(database, mapping, configuration),
+    ) =>
+      makeTargetOAuthConnectedRevocationServices(mapping, configuration).pipe(
+        Effect.provideServiceEffect(NativeDatabase, nativeDatabase(databaseService)),
+      ),
     coordinateOAuthConnected,
     coordinateOAuthConnectedRevocations,
   };
 };
 
-export const makeD1OAuthConnectedTarget = <Database, Family extends Table, Extra>(
+export const makeD1OAuthConnectedTarget = <DatabaseId, Database, Family extends Table, Extra>(
+  databaseService: Context.Service<DatabaseId, Database>,
   configuration: OAuthTargetConfiguration,
 ) => {
   function coordinateOAuthConnected<
@@ -374,6 +383,9 @@ export const makeD1OAuthConnectedTarget = <Database, Family extends Table, Extra
           );
 
           const service: OAuthConnectedPersistence["Service"] = {
+            claimSignIn: (input, prepare) => owner.run(original.claimSignIn(input, prepare)),
+            inspectSignIn: (input) => owner.run(original.inspectSignIn(input)),
+            settleSignIn: (input, prepare) => owner.run(original.settleSignIn(input, prepare)),
             capture: (input) => owner.run(original.capture(input)),
             issue: (input, prepare) => owner.run(original.issue(input, prepare)),
             preflight: (input) => owner.run(original.preflight(input)),
@@ -458,7 +470,10 @@ export const makeD1OAuthConnectedTarget = <Database, Family extends Table, Extra
   }
 
   return {
-    ...makeOAuthConnectedTarget<Database, Family, Extra>(configuration),
+    ...makeOAuthConnectedTarget<DatabaseId, Database, Family, Extra>(
+      databaseService,
+      configuration,
+    ),
     coordinateOAuthConnected,
     coordinateOAuthConnectedRevocations,
   };

package/src/drizzle/oauth-connected-input.ts

@@ -105,6 +105,19 @@ const snapshot =
     snapshotOAuthSync(schema, input);
 
 export const connectedInputs = {
+  claimSignIn: snapshot(
+    Schema.Struct({ claim: M.OAuthClaim, configuration: M.OAuthConnectedConfiguration }),
+  ),
+  inspectSignIn: snapshot(
+    Schema.Struct({
+      reservation: M.OAuthSignInAccessClaim,
+      credential: M.OAuthCredentialSnapshot,
+      grantId: M.OAuthGrantId,
+    }),
+  ),
+  settleSignIn: snapshot(
+    Schema.Struct({ reservation: M.OAuthSignInAccessClaim, outcome: M.OAuthSignInAccessOutcome }),
+  ),
   capture: snapshot(capture),
   issue: snapshot(issue),
   preflight: snapshot(M.OAuthConnectedAccess),

package/src/drizzle/oauth-connected-model.ts

@@ -7,6 +7,8 @@ import type { SubjectIdCodec } from "./model";
 import type {
   OAuthAuthorityReadTable,
   OAuthClock,
+  OAuthCredentialReadTable,
+  OAuthFlowTable,
   OAuthOwnershipMutation,
   OAuthSubjectReadTable,
   requiredOAuthTupleConstraints,
@@ -53,6 +55,9 @@ export interface OAuthConnectedFlowTable<F extends Table, N> {
   readonly work: Column<F>;
   /** Exact sealed quarantine when no correctly sealed revocation job is available. */
   readonly custody: Column<F>;
+  /** Required when retaining grants during sign-in. subjectId is NULL until
+   * identity resolution; custom required columns are supplied by this encoder. */
+  readonly encodeSignIn?: (reservation: M.OAuthSignInAccessClaim) => InferInsertModel<F>;
   readonly encodeInsert: (input: {
     readonly flow: M.OAuthConnectedPendingFlow;
     readonly subjectId: N;
@@ -192,6 +197,12 @@ export type OAuthConnectedPolicyInput<N> = {
       readonly configuration: M.OAuthConnectedConfiguration;
       readonly grant?: M.OAuthConnectedTokenContext;
     }
+  | {
+      readonly kind: "sign-in";
+      readonly credential: M.OAuthCredentialSnapshot;
+      readonly configuration: M.OAuthConnectedConfiguration;
+      readonly grant?: M.OAuthConnectedTokenContext;
+    }
   | {
       readonly kind: "metadata" | "use";
       readonly authorization: M.OAuthConnectedUseAuthorization;
@@ -307,6 +318,12 @@ export interface OAuthConnectedMapping<
   readonly subject: OAuthConnectedSubjectTable<S>;
   readonly authority: OAuthAuthorityReadTable<AC>;
   readonly admission: OAuthConnectedAdmissionTable<A, N>;
+  /** Same shared sign-in tables used by OAuthSignInPersistence. Enable only
+   * alongside a nullable connected-flow subjectId and flow.encodeSignIn. */
+  readonly signIn?: {
+    readonly credential: OAuthCredentialReadTable<Table>;
+    readonly flow: OAuthFlowTable<Table>;
+  };
   readonly command: OAuthConnectedCommandTable<D, N>;
   readonly policy: OAuthConnectedSqlPolicy<N>;
   readonly constraints: typeof requiredOAuthConnectedConstraints;

package/src/drizzle/oauth-connected-settlement.ts

@@ -7,7 +7,7 @@ import * as C from "./oauth-connected-custody";
 import * as F from "./oauth-connected-flow";
 import * as S from "./oauth-connected-state";
 import { both, col, equal, CurrentOAuthTransaction } from "./oauth-owner";
-import { invariant, sameIdentity } from "./oauth-state";
+import { invariant, sameIdentity, oauthIdentityKey } from "./oauth-state";
 
 export const validMetadata = (context: M.OAuthConnectedTokenContext, now: number) => {
   const m = context.metadata,
@@ -35,6 +35,67 @@ export const validMetadata = (context: M.OAuthConnectedTokenContext, now: number
   );
 };
 
+/** The only writer that activates or replaces a confirmed connected grant. */
+export const activateGrant = Effect.fn("oauthConnected.activateGrant")(function* (
+  mapping: S.Mapping,
+  grant: M.OAuthConnectedStoredGrant,
+  native: unknown,
+  now: number,
+  replacing: boolean,
+) {
+  const owner = yield* CurrentOAuthTransaction;
+  const token = grant.context;
+  const g = mapping.grant;
+  const identityKey = oauthIdentityKey(token.identity);
+  const clientKey = S.clientKey(token.configuration);
+  const cohortKey = S.cohortKey(clientKey, identityKey);
+
+  const values = {
+    ...g.encodeInsert({
+      grant: snapshotOAuthSync(M.OAuthConnectedStoredGrant, grant),
+      subjectId: S.nativeCopy(native),
+    }),
+    [g.moduleId]: token.moduleId,
+    [g.grantId]: token.grantId,
+    [g.subjectId]: native,
+    [g.identityKey]: identityKey,
+    [g.activeIdentityKey]: identityKey,
+    [g.clientKey]: clientKey,
+    [g.cohortKey]: cohortKey,
+    [g.profileKey]: token.configuration.profile.key,
+    [g.grantVersion]: token.grantVersion,
+    [g.tokenVersion]: token.tokenVersion,
+    [g.cohortGeneration]: token.cohortGeneration,
+    [g.state]: "Active",
+    [g.version]: owner.marker,
+    [g.context]: S.tokenContextStorage.encode(token),
+    [g.sealed]: S.sealedStorage.encode(grant.sealed),
+    [g.summary]: S.summaryStorage.encode(C.summary(token)),
+    [g.revocationJobId]: null,
+    [g.refreshWork]: "None",
+    [g.refreshClaim]: null,
+    [g.refreshClaimExpiresAt]: null,
+    [g.retentionUntil]: mapping.clock.encodeInstant(
+      S.retainedUntil(
+        mapping,
+        Math.max(now, token.metadata.useUntilMillis, token.metadata.refreshUseUntilMillis ?? 0),
+      ),
+    ),
+  };
+
+  if (!replacing) {
+    yield* owner.insert(g.table, values, {
+      [g.moduleId]: token.moduleId,
+      [g.grantId]: token.grantId,
+    });
+  } else
+    yield* owner.update(
+      g.table,
+      { [g.moduleId]: token.moduleId, [g.grantId]: token.grantId },
+      values,
+    );
+});
+
 export const settle = Effect.fn("oauthConnected.settle")(function* (
   mapping: S.Mapping,
   input: F.Input<"settle">,
@@ -123,7 +184,8 @@ export const settle = Effect.fn("oauthConnected.settle")(function* (
 
   if (claimed === undefined) return { _tag: "Rejected" } as const;
   invariant(
-    validMetadata(token, claimed.now) &&
+    token.exchangeOrder === input.claim.order &&
+      validMetadata(token, claimed.now) &&
       token.metadata.obtainedAtMillis >= input.claim.claimedAtMillis,
   );
   const reconnect = c.reconnect;
@@ -177,46 +239,7 @@ export const settle = Effect.fn("oauthConnected.settle")(function* (
   if (tuple.row[t.state] === "Unowned")
     yield* F.acquireTuple(mapping.ownership, token.identity, tuple.key, S.nativeCopy(native));
 
-  const values = {
-    ...g.encodeInsert({
-      grant: snapshotOAuthSync(M.OAuthConnectedStoredGrant, grant),
-      subjectId: S.nativeCopy(native),
-    }),
-    [g.moduleId]: c.moduleId,
-    [g.grantId]: c.grantId,
-    [g.subjectId]: native,
-    [g.identityKey]: tuple.key,
-    [g.activeIdentityKey]: tuple.key,
-    [g.clientKey]: cl.id,
-    [g.cohortKey]: co.id,
-    [g.profileKey]: c.profile.key,
-    [g.grantVersion]: token.grantVersion,
-    [g.tokenVersion]: token.tokenVersion,
-    [g.cohortGeneration]: token.cohortGeneration,
-    [g.state]: "Active",
-    [g.version]: owner.marker,
-    [g.context]: S.tokenContextStorage.encode(token),
-    [g.sealed]: S.sealedStorage.encode(grant.sealed),
-    [g.summary]: S.summaryStorage.encode(C.summary(token)),
-    [g.revocationJobId]: null,
-    [g.refreshWork]: "None",
-    [g.refreshClaim]: null,
-    [g.refreshClaimExpiresAt]: null,
-    [g.retentionUntil]: mapping.clock.encodeInstant(
-      S.retainedUntil(
-        mapping,
-        Math.max(
-          claimed.now,
-          token.metadata.useUntilMillis,
-          token.metadata.refreshUseUntilMillis ?? 0,
-        ),
-      ),
-    ),
-  };
-
-  if (original === undefined) {
-    yield* owner.insert(g.table, values, { [g.moduleId]: c.moduleId, [g.grantId]: c.grantId });
-  } else yield* owner.update(g.table, { [g.moduleId]: c.moduleId, [g.grantId]: c.grantId }, values);
+  yield* activateGrant(mapping, grant, native, claimed.now, original !== undefined);
   yield* F.terminal(mapping, input.claim, "Connected", "Resolved", { cohort: co.id });
   owner.postconditions.push(
     sql`${mapping.clock.engineNowMillis} >= ${claimed.now} and ${mapping.clock.engineNowMillis} < ${Math.min(input.claim.claimExpiresAtMillis, token.metadata.useUntilMillis)}`,