@yielded/auth-persistence-drizzle 0.1.0-beta.22 → 0.1.0-beta.24

package/src/drizzle/oauth-accounts.ts

@@ -1,805 +0,0 @@
-import {
-  OAuthAccountRevision,
-  OAuthActionAuthorization,
-  OAuthLinkAccess,
-  OAuthLinkClaim,
-  OAuthLinkPendingFlow,
-  OAuthLinkTransactionContext,
-  OAuthUnlinked,
-  OAuthCredentialSnapshot,
-  snapshotOAuthSync,
-} from "@yielded/auth/OAuth";
-import {
-  SessionInvalidationWindow,
-  AuthenticationRequirement,
-  SecurityRevision,
-} from "@yielded/auth/Sessions";
-/* oxlint-disable no-explicit-any -- private owner implementation; public mappings retain native IDs. */
-import { eq, sql } from "drizzle-orm";
-import { DateTime, Effect } from "effect";
-
-import type { SubjectIdCodec } from "./model";
-import {
-  claimFlow,
-  credentialStorage,
-  currentSubject,
-  exactClaim,
-  issueFlow,
-  linkStorage,
-  matchesAccess,
-  readFlow,
-  terminalFlow,
-} from "./oauth-flow";
-import type { OAuthReferenceGuardDescriptor, OAuthEligibilityFact } from "./oauth-model";
-import { both, col, copiedRow, equal, CurrentOAuthTransaction } from "./oauth-owner";
-import { acquireTuple, readTuple } from "./oauth-registration";
-import {
-  invariant,
-  oauthIdentityKey,
-  sameRevision,
-  satisfies,
-  storage,
-  validAction,
-} from "./oauth-state";
-
-const contextStorage = storage(OAuthLinkTransactionContext);
-const unlinkedStorage = storage(OAuthUnlinked);
-
-export const accountCurrent = (mapping: any, subjectId: OAuthAccountRevision["subjectId"]) =>
-  Effect.gen(function* () {
-    const native = yield* (mapping.subjectId as SubjectIdCodec<unknown>).toNative(subjectId);
-
-    return yield* currentSubject(mapping, native);
-  });
-
-const authorization = (
-  mapping: any,
-  current: any,
-  auth: OAuthActionAuthorization,
-  action: OAuthActionAuthorization["challenge"]["action"],
-  flowId: string,
-  commandId: string,
-  intent: string,
-  maximumAge: number,
-) =>
-  Effect.flatMap(CurrentOAuthTransaction, (owner) =>
-    Effect.gen(function* () {
-      const now = yield* owner.now(mapping.clock);
-
-      const currentRequirement = snapshotOAuthSync(
-        AuthenticationRequirement,
-        mapping.subject.decodeActionRequirement(copiedRow(current.row), action),
-      );
-
-      const accepted = yield* validAction(
-        auth,
-        {
-          moduleId: auth.challenge.moduleId,
-          action,
-          flowId,
-          commandId,
-          revision: current.revision,
-          intent,
-        },
-        currentRequirement,
-        now,
-        maximumAge,
-      );
-
-      if (!accepted) return false;
-
-      const age = Math.min(
-        maximumAge,
-        auth.requirement.maximumAgeMillis,
-        currentRequirement.maximumAgeMillis,
-      );
-
-      const fresh = auth.evidence.proofs.filter(
-        (proof) => now - DateTime.toEpochMillis(proof.verifiedAt) < age,
-      );
-
-      invariant(fresh.length > 0);
-
-      const deadline = Math.min(
-        ...fresh.map((proof) => DateTime.toEpochMillis(proof.verifiedAt) + age),
-      );
-
-      owner.postconditions.push(
-        sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${deadline}`,
-      );
-
-      return true;
-    }),
-  );
-
-const currentLink = (mapping: any, flow: typeof OAuthLinkPendingFlow.Type) =>
-  Effect.gen(function* () {
-    const current = yield* accountCurrent(mapping, flow.context.revision.subjectId);
-
-    return current !== undefined && sameRevision(current.revision, flow.context.revision)
-      ? current
-      : undefined;
-  });
-
-export const issueLink = (mapping: any, input: any) =>
-  Effect.gen(function* () {
-    const flow = snapshotOAuthSync(OAuthLinkPendingFlow, input.flow),
-      c = flow.context;
-
-    const current = yield* currentLink(mapping, flow);
-    const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization);
-
-    if (
-      current === undefined ||
-      auth.challenge.moduleId !== c.moduleId ||
-      !(yield* authorization(
-        mapping,
-        current,
-        auth,
-        "link-begin",
-        c.flowId,
-        c.commandId,
-        contextStorage.encode(c),
-        c.maximumEvidenceAgeMillis,
-      ))
-    )
-      return { _tag: "Rejected" } as const;
-
-    return yield* issueFlow(mapping, flow, "link");
-  });
-
-export const preflightLink = (mapping: any, original: typeof OAuthLinkAccess.Type) =>
-  Effect.flatMap(CurrentOAuthTransaction, (owner) =>
-    Effect.gen(function* () {
-      const input = snapshotOAuthSync(OAuthLinkAccess, original);
-      // The authenticated subject is known before discovering/locking any flow.
-      const current = yield* accountCurrent(mapping, input.subjectId);
-      const found = yield* readFlow(mapping, input, "link");
-      const now = yield* owner.now(mapping.clock);
-
-      if (
-        current === undefined ||
-        found.flow === undefined ||
-        found.row?.[mapping.flow.state] !== "Pending" ||
-        !matchesAccess(found.flow, input)
-      )
-        return undefined;
-
-      const flow = snapshotOAuthSync(OAuthLinkPendingFlow, found.flow as never),
-        c = flow.context;
-
-      if (
-        c.revision.subjectId !== input.subjectId ||
-        !sameRevision(current.revision, c.revision) ||
-        now < c.issuedAtMillis ||
-        now >= c.expiresAtMillis
-      )
-        return undefined;
-      owner.postconditions.push(
-        sql`${mapping.clock.engineNowMillis} >= ${c.issuedAtMillis} and ${mapping.clock.engineNowMillis} < ${c.expiresAtMillis}`,
-      );
-
-      return { current, flow, row: found.row };
-    }),
-  );
-
-export const claimLink = (mapping: any, input: any) =>
-  Effect.gen(function* () {
-    const found = yield* preflightLink(mapping, input.access);
-    const flow = snapshotOAuthSync(OAuthLinkPendingFlow, input.flow);
-
-    const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization),
-      c = flow.context;
-
-    if (
-      found === undefined ||
-      linkStorage.encode(found.flow) !== linkStorage.encode(flow) ||
-      auth.challenge.moduleId !== c.moduleId ||
-      !(yield* authorization(
-        mapping,
-        found.current,
-        auth,
-        "link-complete",
-        c.flowId,
-        c.commandId,
-        contextStorage.encode(c),
-        c.maximumEvidenceAgeMillis,
-      ))
-    )
-      return { _tag: "Rejected" } as const;
-    const claim = yield* claimFlow(mapping, { row: found.row!, flow }, input.claimId);
-
-    return claim === undefined
-      ? ({ _tag: "Rejected" } as const)
-      : ({ _tag: "Claimed", claim } as const);
-  });
-
-const checkInvalidation = (mapping: any, original: SessionInvalidationWindow) => {
-  const value = snapshotOAuthSync(SessionInvalidationWindow, original);
-
-  invariant(
-    value.trigger === "credential-change" &&
-      value.oldAuthenticationEvidence === "rejected" &&
-      (mapping.sessionInvalidation === "same-authority-immediate"
-        ? value.existingSessions === "immediate" && value.maximumExposureMillis === 0
-        : value.existingSessions === "original-absolute-expiry"),
-  );
-
-  return value;
-};
-
-const advance = (mapping: any, current: any, removed?: string) =>
-  Effect.flatMap(CurrentOAuthTransaction, (owner) =>
-    Effect.gen(function* () {
-      const revision = mapping.subject.nextSecurityRevision(current.revision.securityRevision);
-
-      invariant(
-        typeof revision === "string" &&
-          revision.length > 0 &&
-          revision.length <= 256 &&
-          revision !== current.revision.securityRevision,
-      );
-      const subject = mapping.subject;
-
-      yield* owner.update(
-        subject.table,
-        { [subject.id]: current.nativeId },
-        { [subject.securityRevision]: revision },
-      );
-      for (const cleanup of mapping.cleanup) {
-        const condition = both(
-          eq(col(cleanup.table, cleanup.subjectId), current.nativeId),
-          cleanup.condition({
-            subjectId: current.nativeId,
-            revision: snapshotOAuthSync(OAuthAccountRevision, current.revision),
-            ...(removed === undefined ? {} : { removedCredentialId: removed }),
-          }),
-        );
-
-        yield* owner.write(owner.database.delete(cleanup.table).where(condition));
-        owner.postconditions.push(
-          sql`not exists(select 1 from ${cleanup.table} where ${condition})`,
-        );
-      }
-
-      return SecurityRevision.make(revision);
-    }),
-  );
-
-export const settleLink = (
-  mapping: any,
-  input: any,
-  allocated: { readonly credentialId: string; readonly revision: SecurityRevision },
-) =>
-  Effect.flatMap(CurrentOAuthTransaction, (owner) =>
-    Effect.gen(function* () {
-      const claim = snapshotOAuthSync(OAuthLinkClaim, input.claim),
-        flow = claim.flow,
-        c = flow.context;
-
-      const current = yield* currentLink(mapping, flow);
-
-      // Known subject is always locked before tuple/flow; even a rejected outcome
-      // settles its exact original claim without adopting a newer revision.
-      const identity =
-        input.outcome._tag === "Verified" ? input.outcome.identity.identity : undefined;
-
-      if (identity !== undefined)
-        invariant(identity.provider === c.provider && identity.issuer === c.issuer);
-
-      const tuple =
-        identity !== undefined && current !== undefined
-          ? yield* readTuple(mapping.ownership, identity)
-          : undefined;
-
-      const exact = yield* exactClaim(mapping, claim, "link");
-
-      if (exact === undefined) return { _tag: "Rejected" } as const;
-      let decision: any = { _tag: input.outcome._tag };
-
-      if (input.outcome._tag === "Verified") {
-        decision = { _tag: "Rejected" };
-        const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization);
-
-        if (
-          current !== undefined &&
-          tuple !== undefined &&
-          auth.challenge.moduleId === c.moduleId &&
-          (yield* authorization(
-            mapping,
-            current,
-            auth,
-            "link-complete",
-            c.flowId,
-            c.commandId,
-            contextStorage.encode(c),
-            c.maximumEvidenceAgeMillis,
-          ))
-        ) {
-          const t = mapping.ownership.tuple,
-            cr = mapping.credential,
-            a = mapping.authority;
-
-          const login = yield* owner.read(cr.table, eq(col(cr.table, cr.identityKey), tuple.key), {
-            limit: 1,
-          });
-
-          const previous = login.rows[0];
-
-          if (
-            tuple.row[t.state] === "Reserved" ||
-            (tuple.row[t.state] === "Owned" &&
-              !mapping.subjectId.equals(tuple.row[t.subjectId], current.nativeId)) ||
-            (previous !== undefined &&
-              (previous[cr.moduleId] !== c.moduleId ||
-                !mapping.subjectId.equals(previous[cr.subjectId], current.nativeId) ||
-                !cr.isActiveStatus(previous[cr.status])))
-          )
-            decision = { _tag: "Conflict" };
-          else if (previous !== undefined) {
-            const shared = current.revision.credentials.find(
-              (item: any) => item.credentialId === previous[cr.credentialId],
-            );
-
-            if (
-              tuple.row[t.state] !== "Owned" ||
-              shared?.revision !== previous[cr.credentialRevision] ||
-              !(yield* owner.check(
-                sql`exists(select 1 from ${cr.table} where ${both(eq(col(cr.table, cr.identityKey), tuple.key), cr.activeCondition)})`,
-              ))
-            )
-              decision = { _tag: "Conflict" };
-            else
-              decision = {
-                _tag: "Linked",
-                changed: false,
-                credential: snapshotOAuthSync(OAuthCredentialSnapshot, {
-                  moduleId: c.moduleId,
-                  identity,
-                  credentialId: previous[cr.credentialId],
-                  credentialRevision: previous[cr.credentialRevision],
-                  revision: current.revision,
-                }),
-              };
-          } else {
-            checkInvalidation(mapping, input.invalidation);
-
-            const values = {
-              ...cr.encodeInsert({
-                moduleId: c.moduleId,
-                subjectId: current.nativeId,
-                identityKey: tuple.key,
-                credentialId: allocated.credentialId,
-                credentialRevision: allocated.revision,
-              }),
-              [cr.moduleId]: c.moduleId,
-              [cr.subjectId]: current.nativeId,
-              [cr.identityKey]: tuple.key,
-              [cr.credentialId]: allocated.credentialId,
-              [cr.credentialRevision]: allocated.revision,
-            };
-
-            invariant(cr.isActiveStatus(values[cr.status]));
-
-            const inserted = yield* owner.insert(cr.table, values, {
-              [cr.credentialId]: allocated.credentialId,
-            });
-
-            login.rows = inserted.rows;
-
-            const sharedValues = {
-              ...a.encodeInsert({
-                subjectId: current.nativeId,
-                credentialId: allocated.credentialId,
-                revision: allocated.revision,
-              }),
-              [a.subjectId]: current.nativeId,
-              [a.credentialId]: allocated.credentialId,
-              [a.revision]: allocated.revision,
-            };
-
-            invariant(a.isActiveStatus(sharedValues[a.status]));
-
-            const shared = yield* owner.insert(a.table, sharedValues, {
-              [a.subjectId]: current.nativeId,
-              [a.credentialId]: allocated.credentialId,
-            });
-
-            current.authorities.rows = [...current.authorities.rows, ...shared.rows];
-            owner.postconditions.push(
-              sql`exists(select 1 from ${cr.table} where ${both(
-                eq(col(cr.table, cr.credentialId), allocated.credentialId),
-                cr.activeCondition,
-              )})`,
-              sql`exists(select 1 from ${a.table} where ${both(
-                eq(col(a.table, a.subjectId), current.nativeId),
-                eq(col(a.table, a.credentialId), allocated.credentialId),
-                a.activeCondition,
-              )})`,
-            );
-            if (tuple.row[t.state] === "Unowned")
-              yield* acquireTuple(mapping.ownership, identity, tuple.key, current.nativeId);
-            const next = yield* advance(mapping, current);
-
-            const revision = snapshotOAuthSync(OAuthAccountRevision, {
-              ...current.revision,
-              securityRevision: next,
-              credentials: [
-                ...current.revision.credentials,
-                { credentialId: allocated.credentialId, revision: allocated.revision },
-              ],
-            });
-
-            decision = {
-              _tag: "Linked",
-              changed: true,
-              credential: snapshotOAuthSync(OAuthCredentialSnapshot, {
-                moduleId: c.moduleId,
-                identity,
-                credentialId: allocated.credentialId,
-                credentialRevision: allocated.revision as never,
-                revision,
-              }),
-            };
-          }
-        }
-      }
-      yield* terminalFlow(mapping, flow, decision._tag);
-
-      return decision;
-    }),
-  );
-
-const targetCredential = (mapping: any, moduleId: string, credentialId: string, current: any) =>
-  Effect.flatMap(CurrentOAuthTransaction, (owner) =>
-    Effect.gen(function* () {
-      const cr = mapping.credential;
-
-      const found = yield* owner.read(cr.table, eq(col(cr.table, cr.credentialId), credentialId), {
-        limit: 1,
-      });
-
-      const row = found.rows[0];
-
-      if (
-        row === undefined ||
-        row[cr.moduleId] !== moduleId ||
-        !mapping.subjectId.equals(row[cr.subjectId], current.nativeId) ||
-        !cr.isActiveStatus(row[cr.status])
-      )
-        return undefined;
-      const t = mapping.ownership.tuple;
-
-      const tuple = yield* owner.read(
-        t.table,
-        eq(col(t.table, t.identityKey), row[cr.identityKey]),
-        {
-          limit: 1,
-        },
-      );
-
-      const ownership = tuple.rows[0];
-
-      if (
-        ownership === undefined ||
-        ownership[t.state] !== "Owned" ||
-        !mapping.subjectId.equals(ownership[t.subjectId], current.nativeId)
-      )
-        return undefined;
-
-      const identity = {
-        provider: ownership[t.provider],
-        issuer: ownership[t.issuer],
-        subject: ownership[t.externalSubject],
-      };
-
-      invariant((yield* oauthIdentityKey(identity)) === row[cr.identityKey]);
-
-      const shared = current.revision.credentials.find(
-        (item: any) => item.credentialId === credentialId,
-      );
-
-      if (
-        shared?.revision !== row[cr.credentialRevision] ||
-        !(yield* owner.check(
-          sql`exists(select 1 from ${cr.table} where ${both(eq(col(cr.table, cr.credentialId), credentialId), cr.activeCondition)})`,
-        ))
-      )
-        return undefined;
-
-      return snapshotOAuthSync(OAuthCredentialSnapshot, {
-        moduleId: moduleId as never,
-        identity,
-        credentialId,
-        credentialRevision: row[cr.credentialRevision],
-        revision: current.revision,
-      });
-    }),
-  );
-
-const unlinkCommand = (mapping: any, moduleId: string, commandId: string) =>
-  Effect.flatMap(CurrentOAuthTransaction, (owner) =>
-    owner.read(
-      mapping.command.table,
-      equal(mapping.command.table, {
-        [mapping.command.moduleId]: moduleId,
-        [mapping.command.commandId]: commandId,
-      }),
-      { limit: 1 },
-    ),
-  );
-
-export const inspectUnlink = (mapping: any, input: any) =>
-  Effect.flatMap(CurrentOAuthTransaction, (owner) =>
-    Effect.gen(function* () {
-      const current = yield* accountCurrent(mapping, input.subjectId);
-
-      if (current === undefined) return { _tag: "Rejected" } as const;
-
-      const command = yield* unlinkCommand(mapping, input.moduleId, input.commandId),
-        r = mapping.command;
-
-      const old = command.rows[0];
-
-      if (old !== undefined) {
-        const intent = credentialStorage.decode(old[r.intentSnapshot]);
-
-        if (
-          intent.moduleId !== input.moduleId ||
-          intent.revision.subjectId !== input.subjectId ||
-          intent.credentialId !== input.credentialId ||
-          !mapping.subjectId.equals(old[r.subjectId], current.nativeId) ||
-          old[r.credentialId] !== input.credentialId
-        )
-          return { _tag: "Conflict" } as const;
-        const metadata = mapping.metadata.condition(current.nativeId);
-
-        if (!(yield* owner.check(metadata))) return { _tag: "Rejected" } as const;
-        owner.postconditions.push(metadata);
-
-        return { _tag: "Replay", result: unlinkedStorage.decode(old[r.decision]) } as const;
-      }
-
-      const credential = yield* targetCredential(
-        mapping,
-        input.moduleId,
-        input.credentialId,
-        current,
-      );
-
-      return credential === undefined
-        ? ({ _tag: "Rejected" } as const)
-        : ({ _tag: "Target", credential } as const);
-    }),
-  );
-
-const remainingEligibility = (mapping: any, current: any, removed: string) =>
-  Effect.flatMap(CurrentOAuthTransaction, (owner) =>
-    Effect.gen(function* () {
-      invariant(mapping.eligibility.length > 0 && mapping.eligibility.length <= 32);
-      const facts = new Map<string, OAuthEligibilityFact>();
-
-      const revisions = new Map(
-        current.revision.credentials.map((item: any) => [item.credentialId, item.revision]),
-      );
-
-      for (const descriptor of mapping.eligibility) {
-        const observed = yield* owner.read(
-          descriptor.table,
-          both(
-            eq(col(descriptor.table, descriptor.subjectId), current.nativeId),
-            descriptor.condition(current.nativeId),
-          ),
-          { orderBy: col(descriptor.table, descriptor.credentialId) },
-        );
-
-        for (const row of observed.rows) {
-          const fact = descriptor.decode(copiedRow(row)) as OAuthEligibilityFact | undefined;
-
-          if (fact === undefined || fact.credentialId === removed) continue;
-          invariant(
-            fact.credentialId === row[descriptor.credentialId] &&
-              fact.revision === row[descriptor.revision] &&
-              revisions.get(fact.credentialId) === fact.revision &&
-              fact.factors.length <= 8 &&
-              fact.factors.every((factor) =>
-                ["knowledge", "possession", "inherence"].includes(factor),
-              ),
-          );
-          invariant(
-            typeof fact.usablePrimary === "boolean" &&
-              typeof fact.userVerified === "boolean" &&
-              typeof fact.phishingResistant === "boolean",
-          );
-
-          const normalized = {
-            credentialId: fact.credentialId,
-            revision: fact.revision,
-            usablePrimary: fact.usablePrimary,
-            factors: [...new Set(fact.factors)].sort(),
-            userVerified: fact.userVerified,
-            phishingResistant: fact.phishingResistant,
-          };
-
-          const prior = facts.get(fact.credentialId);
-
-          // oxlint-disable-next-line no-restricted-properties -- Canonical bounded eligibility fact fingerprint rejects contradictory duplicate IDs.
-          invariant(prior === undefined || JSON.stringify(prior) === JSON.stringify(normalized));
-          facts.set(fact.credentialId, normalized);
-        }
-      }
-      const available = [...facts.values()];
-
-      const requirement = snapshotOAuthSync(
-        AuthenticationRequirement,
-        mapping.subject.decodeAuthenticationRequirement(copiedRow(current.row)),
-      );
-
-      return available.some((fact) => fact.usablePrimary) && satisfies(available, requirement);
-    }),
-  );
-
-export const unlink = (mapping: any, input: any) =>
-  Effect.flatMap(CurrentOAuthTransaction, (owner) =>
-    Effect.gen(function* () {
-      const expected = snapshotOAuthSync(OAuthCredentialSnapshot, input.credential);
-
-      invariant(expected.moduleId === input.moduleId);
-      const current = yield* accountCurrent(mapping, expected.revision.subjectId);
-
-      if (current === undefined) return { _tag: "Rejected" } as const;
-
-      const guards: ReadonlyArray<OAuthReferenceGuardDescriptor<unknown>> =
-        mapping.connectedReferenceGuards ?? [];
-
-      invariant(guards.length <= 32);
-      let referencesGuarded = mapping.connectedReference !== undefined && guards.length > 0;
-
-      if (mapping.connectedReference !== undefined)
-        for (const guard of guards) {
-          const condition = guard.condition({
-            identity: snapshotOAuthSync(OAuthCredentialSnapshot.fields.identity, expected.identity),
-            identityKey: yield* oauthIdentityKey(expected.identity),
-            subjectId: copiedRow({ value: current.nativeId }).value,
-          });
-
-          const read = yield* owner.read(
-            guard.table,
-            Effect.isEffect(condition) ? yield* condition : condition,
-            { orderBy: col(guard.table, guard.orderBy) },
-          );
-
-          if (read.rows.length === 0) referencesGuarded = false;
-        }
-
-      const command = yield* unlinkCommand(mapping, input.moduleId, input.commandId),
-        r = mapping.command;
-
-      const previous = command.rows[0];
-
-      if (previous !== undefined) {
-        if (
-          previous[r.intentSnapshot] !== credentialStorage.encode(expected) ||
-          previous[r.credentialId] !== expected.credentialId ||
-          !mapping.subjectId.equals(previous[r.subjectId], current.nativeId)
-        )
-          return { _tag: "Conflict" } as const;
-        const metadata = mapping.metadata.condition(current.nativeId);
-
-        if (!(yield* owner.check(metadata))) return { _tag: "Rejected" } as const;
-        owner.postconditions.push(metadata);
-
-        return {
-          _tag: "Unlinked",
-          replayed: true,
-          result: unlinkedStorage.decode(previous[r.decision]),
-        } as const;
-      }
-
-      const actual = yield* targetCredential(
-        mapping,
-        input.moduleId,
-        expected.credentialId,
-        current,
-      );
-
-      if (
-        actual === undefined ||
-        credentialStorage.encode(actual) !== credentialStorage.encode(expected)
-      )
-        return { _tag: "Rejected" } as const;
-      const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization);
-
-      if (
-        auth.challenge.moduleId !== input.moduleId ||
-        !(yield* authorization(
-          mapping,
-          current,
-          auth,
-          "unlink",
-          input.commandId,
-          input.commandId,
-          credentialStorage.encode(expected),
-          auth.requirement.maximumAgeMillis,
-        ))
-      )
-        return { _tag: "Rejected" } as const;
-      if (!(yield* remainingEligibility(mapping, current, expected.credentialId)))
-        return { _tag: "LastSignInMethod" } as const;
-
-      const invalidation = checkInvalidation(mapping, input.invalidation),
-        cr = mapping.credential,
-        a = mapping.authority;
-
-      const key = yield* oauthIdentityKey(expected.identity),
-        t = mapping.ownership.tuple;
-
-      const connected = mapping.connectedReference?.({
-        identityKey: key,
-        subjectId: copiedRow({ value: current.nativeId }).value,
-      });
-
-      const retain =
-        connected !== undefined && (!referencesGuarded || (yield* owner.check(connected)));
-
-      if (connected !== undefined && referencesGuarded)
-        owner.postconditions.push(retain ? connected : sql`not (${connected})`);
-      yield* owner.remove(cr.table, { [cr.credentialId]: expected.credentialId });
-      yield* owner.remove(a.table, {
-        [a.subjectId]: current.nativeId,
-        [a.credentialId]: expected.credentialId,
-      });
-      if (!retain) {
-        yield* owner.update(
-          t.table,
-          { [t.identityKey]: key },
-          {
-            [t.state]: "Unowned",
-            [t.subjectId]: null,
-            [t.reservation]: null,
-            [t.version]: owner.marker,
-          },
-        );
-        if (mapping.ownership.mode === "separate")
-          yield* owner.remove(mapping.ownership.external.table, {
-            [mapping.ownership.external.identityKey]: key,
-          });
-      }
-      yield* advance(mapping, current, expected.credentialId);
-
-      const result = snapshotOAuthSync(OAuthUnlinked, {
-        _tag: "Unlinked",
-        credentialId: expected.credentialId,
-        invalidation,
-      });
-
-      const now = yield* owner.now(mapping.clock);
-
-      invariant(
-        Number.isSafeInteger(input.retentionUntilMillis) &&
-          input.retentionUntilMillis > now &&
-          input.retentionUntilMillis >= input.nowMillis + 120000,
-      );
-      const commandKey = { [r.moduleId]: input.moduleId, [r.commandId]: input.commandId };
-
-      const values = {
-        ...r.encodeInsert({
-          moduleId: input.moduleId,
-          commandId: input.commandId,
-          credential: snapshotOAuthSync(OAuthCredentialSnapshot, expected),
-        }),
-        ...commandKey,
-        [r.subjectId]: current.nativeId,
-        [r.credentialId]: expected.credentialId,
-        [r.intentSnapshot]: credentialStorage.encode(expected),
-        [r.decision]: unlinkedStorage.encode(result),
-        [r.retentionUntil]: mapping.clock.encodeInstant(input.retentionUntilMillis),
-      };
-
-      const inserted = yield* owner.insert(r.table, values, commandKey);
-
-      command.rows = inserted.rows;
-
-      return { _tag: "Unlinked", result, replayed: false } as const;
-    }),
-  );