@yielded/auth-persistence-drizzle 0.1.0-beta.23 → 0.1.0-beta.24

package/src/drizzle/oauth-connected-access.ts

@@ -1,361 +0,0 @@
-import * as M from "@yielded/auth/OAuth";
-import { snapshotOAuthSync } from "@yielded/auth/OAuth";
-import { sql } from "drizzle-orm";
-import { Effect } from "effect";
-
-import * as C from "./oauth-connected-custody";
-import * as F from "./oauth-connected-flow";
-import { validMetadata } from "./oauth-connected-settlement";
-import * as S from "./oauth-connected-state";
-import { equal, CurrentOAuthTransaction } from "./oauth-owner";
-import { invariant } from "./oauth-state";
-
-export const locked = Effect.fn("oauthConnected.lockedGrant")(function* (
-  mapping: S.Mapping,
-  authorization: M.OAuthConnectedUseAuthorization,
-  grantId: M.OAuthConnectedTokenContext["grantId"],
-  purpose: "use" | "metadata",
-) {
-  const owner = yield* CurrentOAuthTransaction;
-  const initial = yield* S.readGrant(mapping, authorization.moduleId, grantId, false);
-
-  if (initial === undefined) return undefined;
-  const found = yield* S.useAuthority(mapping, authorization, purpose, initial.context);
-
-  if (found === undefined) return undefined;
-  const client = yield* S.client(mapping, initial.context.configuration, false);
-
-  if (client === undefined) return undefined;
-
-  const tuple = yield* F.inspectTuple(mapping, initial.context.identity),
-    t = mapping.ownership.tuple;
-
-  if (
-    tuple.row?.[t.state] !== "Owned" ||
-    !mapping.subjectId.equals(tuple.row[t.subjectId], found.nativeId)
-  )
-    return undefined;
-  const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);
-
-  invariant(cohort.row !== undefined);
-  const grant = yield* S.readGrant(mapping, authorization.moduleId, grantId);
-
-  if (grant === undefined || !C.sameContext(grant.context, initial.context)) return undefined;
-
-  return { found, client, tuple, cohort, grant, now: yield* owner.now(mapping.clock) };
-});
-
-export const state = (
-  mapping: S.Authority,
-  read: NonNullable<Effect.Success<ReturnType<typeof locked>>>,
-) => {
-  const g = mapping.grant;
-
-  if (
-    read.cohort.blocked ||
-    read.cohort.generation !== read.grant.context.cohortGeneration ||
-    read.grant.row[g.activeIdentityKey] !== read.tuple.key
-  )
-    return "ReauthorizationRequired" as const;
-
-  return read.grant.row[g.state] === "Refreshing"
-    ? ("Busy" as const)
-    : read.grant.row[g.state] === "Active"
-      ? ("Active" as const)
-      : ("ReauthorizationRequired" as const);
-};
-
-export const inspectAccess = Effect.fn("oauthConnected.inspectAccess")(function* (
-  mapping: S.Mapping,
-  input: F.Input<"inspectAccess">,
-) {
-  const read = yield* locked(mapping, input.authorization, input.grantId, "use");
-
-  if (read === undefined || read.grant.context.configuration.profile.key !== input.profileKey)
-    return { _tag: "Rejected" } as const;
-  const status = state(mapping, read);
-
-  if (status !== "Active") return { _tag: status };
-  if (read.grant.sealed === undefined) return { _tag: "ReauthorizationRequired" } as const;
-
-  return {
-    _tag: "Target",
-    grant: { context: read.grant.context, sealed: read.grant.sealed },
-  } as const;
-});
-
-export const claimRefresh = Effect.fn("oauthConnected.claimRefresh")(function* (
-  mapping: S.Mapping,
-  input: F.Input<"claimRefresh">,
-) {
-  const owner = yield* CurrentOAuthTransaction;
-  const read = yield* locked(mapping, input.authorization, input.grant.context.grantId, "use");
-
-  if (read === undefined) return { _tag: "Rejected" } as const;
-
-  const status = state(mapping, read),
-    g = mapping.grant;
-
-  if (status !== "Active") return { _tag: status };
-
-  const token = read.grant.context,
-    p = token.configuration.profile;
-
-  if (
-    read.grant.sealed === undefined ||
-    !C.sameGrant(input.grant, { context: token, sealed: read.grant.sealed })
-  )
-    return { _tag: "Rejected" } as const;
-  if (read.grant.row[g.refreshWork] === "Unresolved") return { _tag: "Busy" } as const;
-  if (
-    p.refresh === "unsupported" ||
-    token.metadata.refreshUseUntilMillis === undefined ||
-    read.now >= token.metadata.refreshUseUntilMillis
-  )
-    return { _tag: "ReauthorizationRequired" } as const;
-  if (read.now < token.metadata.useUntilMillis - p.refreshAheadMillis)
-    return { _tag: "Busy" } as const;
-  invariant(
-    Number.isSafeInteger(input.lifetimeMillis) &&
-      input.lifetimeMillis >= 1000 &&
-      input.lifetimeMillis <= 120000 &&
-      input.nextTokenVersion !== token.tokenVersion,
-  );
-
-  const expires = Math.min(
-    read.now + input.lifetimeMillis,
-    token.metadata.refreshUseUntilMillis,
-    input.authorization.expiresAtMillis,
-  );
-
-  if (expires <= read.now) return { _tag: "Rejected" } as const;
-
-  const claim = snapshotOAuthSync(M.OAuthConnectedRefreshClaim, {
-    grant: input.grant,
-    order: String(yield* S.nextOrder(mapping, read.client)),
-    claimId: input.claimId,
-    claimedAtMillis: read.now,
-    claimExpiresAtMillis: expires,
-    nextTokenVersion: input.nextTokenVersion,
-  });
-
-  yield* owner.update(
-    g.table,
-    { [g.moduleId]: token.moduleId, [g.grantId]: token.grantId },
-    {
-      [g.state]: "Refreshing",
-      [g.refreshWork]: "Unresolved",
-      [g.refreshClaim]: S.refreshStorage.encode(claim),
-      [g.refreshClaimExpiresAt]: mapping.clock.encodeInstant(expires),
-      [g.version]: owner.marker,
-    },
-  );
-  owner.postconditions.push(
-    sql`${mapping.clock.engineNowMillis} >= ${read.now} and ${mapping.clock.engineNowMillis} < ${expires}`,
-  );
-
-  return { _tag: "Claimed", claim } as const;
-});
-
-export const settleRefresh = Effect.fn("oauthConnected.settleRefresh")(function* (
-  mapping: S.Mapping,
-  input: F.Input<"settleRefresh">,
-) {
-  const owner = yield* CurrentOAuthTransaction;
-
-  const old = input.claim.grant.context,
-    g = mapping.grant;
-
-  // Capture policy before suffix locks. Loss of authorization still permits only
-  // cleanup of exact original work under its unchanged global owner.
-  const authorized =
-    (yield* S.useAuthority(mapping, input.authorization, "use", old)) !== undefined;
-
-  const native = yield* mapping.subjectId.toNative(old.subjectId);
-  const client = yield* S.client(mapping, old.configuration, false);
-
-  if (client === undefined) return { _tag: "Rejected" } as const;
-
-  const tuple = yield* F.inspectTuple(mapping, old.identity),
-    t = mapping.ownership.tuple;
-
-  if (tuple.row?.[t.state] !== "Owned" || !mapping.subjectId.equals(tuple.row[t.subjectId], native))
-    return { _tag: "Rejected" } as const;
-  const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);
-
-  invariant(cohort.row !== undefined);
-  const read = yield* S.readGrant(mapping, old.moduleId, old.grantId);
-
-  if (
-    read === undefined ||
-    read.row[g.refreshWork] !== "Unresolved" ||
-    read.row[g.refreshClaim] !== S.refreshStorage.encode(input.claim)
-  )
-    return { _tag: "Rejected" } as const;
-  invariant(
-    mapping.clock.decodeInstant(read.row[g.refreshClaimExpiresAt]) ===
-      input.claim.claimExpiresAtMillis,
-  );
-  const now = yield* owner.now(mapping.clock);
-
-  invariant(now >= input.claim.claimedAtMillis);
-  const outcome = input.outcome;
-  const incoming = outcome._tag === "Refreshed" ? outcome.grant : undefined;
-
-  if (incoming !== undefined)
-    invariant(
-      C.sameContext(
-        {
-          ...incoming.context,
-          tokenVersion: old.tokenVersion,
-          metadata: old.metadata,
-          exchangeOrder: old.exchangeOrder,
-        },
-        old,
-      ) &&
-        incoming.context.tokenVersion === input.claim.nextTokenVersion &&
-        incoming.context.exchangeOrder === input.claim.order &&
-        validMetadata(incoming.context, now) &&
-        incoming.context.metadata.obtainedAtMillis >= input.claim.claimedAtMillis &&
-        (incoming.context.metadata.refreshUseUntilMillis === undefined ||
-          (old.metadata.refreshUseUntilMillis !== undefined &&
-            incoming.context.metadata.refreshUseUntilMillis <= old.metadata.refreshUseUntilMillis)),
-    );
-
-  const active =
-    incoming !== undefined &&
-    authorized &&
-    read.row[g.state] === "Refreshing" &&
-    C.sameContext(read.context, old) &&
-    !cohort.blocked &&
-    cohort.generation === old.cohortGeneration &&
-    now < input.claim.claimExpiresAtMillis &&
-    now < incoming.context.metadata.useUntilMillis;
-
-  if (active) {
-    yield* owner.update(
-      g.table,
-      { [g.moduleId]: old.moduleId, [g.grantId]: old.grantId },
-      {
-        [g.state]: "Active",
-        [g.context]: S.tokenContextStorage.encode(incoming.context),
-        [g.sealed]: S.sealedStorage.encode(incoming.sealed),
-        [g.summary]: S.summaryStorage.encode(C.summary(incoming.context)),
-        [g.tokenVersion]: incoming.context.tokenVersion,
-        [g.refreshWork]: "Resolved",
-        [g.version]: owner.marker,
-      },
-    );
-    owner.postconditions.push(
-      sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${Math.min(input.claim.claimExpiresAtMillis, incoming.context.metadata.useUntilMillis)}`,
-    );
-
-    return { _tag: "Refreshed", grant: incoming } as const;
-  }
-  yield* C.fence(mapping, client, cohort);
-  if (incoming !== undefined && outcome._tag === "Refreshed" && outcome.cleanup !== undefined) {
-    yield* C.storeJob(mapping, outcome.cleanup, incoming.context, native, now);
-    yield* owner.update(
-      g.table,
-      { [g.moduleId]: old.moduleId, [g.grantId]: old.grantId },
-      {
-        [g.refreshWork]: "Resolved",
-        [g.revocationJobId]: outcome.cleanup.context.jobId,
-        [g.sealed]: null,
-        [g.version]: owner.marker,
-      },
-    );
-  } else if (incoming !== undefined)
-    yield* owner.update(
-      g.table,
-      { [g.moduleId]: old.moduleId, [g.grantId]: old.grantId },
-      {
-        [g.context]: S.tokenContextStorage.encode(incoming.context),
-        [g.sealed]: S.sealedStorage.encode(incoming.sealed),
-        [g.tokenVersion]: incoming.context.tokenVersion,
-        [g.summary]: S.summaryStorage.encode(C.summary(incoming.context)),
-        [g.version]: owner.marker,
-      },
-    );
-
-  return { _tag: "ReauthorizationRequired" } as const;
-});
-
-export const admitUse = Effect.fn("oauthConnected.admitUse")(function* (
-  mapping: S.Mapping,
-  input: F.Input<"admitUse">,
-) {
-  const owner = yield* CurrentOAuthTransaction;
-  const read = yield* locked(mapping, input.authorization, input.grant.context.grantId, "use");
-
-  if (read === undefined) return { _tag: "Rejected" } as const;
-  const status = state(mapping, read);
-
-  if (status !== "Active") return { _tag: status };
-  const token = read.grant.context;
-
-  if (
-    read.grant.sealed === undefined ||
-    !C.sameGrant(input.grant, { context: token, sealed: read.grant.sealed }) ||
-    read.now >= token.metadata.useUntilMillis
-  )
-    return { _tag: "ReauthorizationRequired" } as const;
-  invariant(
-    Number.isSafeInteger(input.lifetimeMillis) &&
-      input.lifetimeMillis >= 1 &&
-      input.lifetimeMillis <= 30000,
-  );
-
-  const expires = Math.min(
-      read.now + input.lifetimeMillis,
-      input.authorization.expiresAtMillis,
-      token.metadata.useUntilMillis,
-    ),
-    a = mapping.admission;
-
-  const key = { [a.admissionId]: input.admissionId },
-    prior = yield* owner.read(a.table, equal(a.table, key), { limit: 1 });
-
-  if (prior.rows.length) return { _tag: "Rejected" } as const;
-
-  const inserted = yield* owner.insert(
-    a.table,
-    {
-      ...a.encodeInsert({
-        admissionId: input.admissionId,
-        grant: snapshotOAuthSync(M.OAuthConnectedStoredGrant, input.grant),
-        authorization: snapshotOAuthSync(M.OAuthConnectedUseAuthorization, input.authorization),
-        subjectId: S.nativeCopy(read.found.nativeId),
-      }),
-      ...key,
-      [a.moduleId]: token.moduleId,
-      [a.grantId]: token.grantId,
-      [a.subjectId]: read.found.nativeId,
-      [a.identityKey]: read.tuple.key,
-      [a.clientKey]: read.client.id,
-      [a.cohortKey]: read.cohort.id,
-      [a.snapshot]: S.admissionStorage.encode({
-        grant: input.grant,
-        authorization: input.authorization,
-      }),
-      [a.admittedAt]: mapping.clock.encodeInstant(read.now),
-      [a.expiresAt]: mapping.clock.encodeInstant(expires),
-      [a.version]: owner.marker,
-    },
-    key,
-  );
-
-  prior.rows = inserted.rows;
-  owner.postconditions.push(
-    sql`${mapping.clock.engineNowMillis} >= ${read.now} and ${mapping.clock.engineNowMillis} < ${expires}`,
-  );
-
-  return {
-    _tag: "Admitted",
-    admissionId: input.admissionId,
-    grantId: token.grantId,
-    tokenVersion: token.tokenVersion,
-    admittedAtMillis: read.now,
-    expiresAtMillis: expires,
-  } as const;
-});

package/src/drizzle/oauth-connected-collection.ts

@@ -1,324 +0,0 @@
-import { asc, eq, lte, sql } from "drizzle-orm";
-import { Effect } from "effect";
-
-import * as C from "./oauth-connected-custody";
-import * as F from "./oauth-connected-flow";
-import { connectedReferenceCondition } from "./oauth-connected-reference";
-import * as S from "./oauth-connected-state";
-import { both, col, equal, CurrentOAuthTransaction, type Row } from "./oauth-owner";
-import { invariant, oauthIdentityKey } from "./oauth-state";
-
-export interface Candidates {
-  readonly jobs: ReadonlyArray<Row>;
-  readonly grants: ReadonlyArray<Row>;
-  readonly cohorts: ReadonlyArray<Row>;
-  readonly tuples: ReadonlyArray<Row>;
-}
-
-export const discover = Effect.fn("oauthConnected.collectionCandidates")(function* (
-  mapping: S.Mapping,
-  moduleId: string,
-  limit: number,
-) {
-  const owner = yield* CurrentOAuthTransaction;
-
-  const g = mapping.grant,
-    j = S.jobTable(mapping),
-    h = mapping.cohort,
-    at = yield* owner.now(mapping.clock);
-
-  const jobs =
-    j === undefined
-      ? { rows: [] }
-      : yield* owner.read(
-          j.table,
-          both(
-            eq(col(j.table, j.moduleId), moduleId),
-            eq(col(j.table, j.state), "Confirmed"),
-            lte(col(j.table, j.retentionUntil), mapping.clock.encodeInstant(at)),
-          ),
-          {
-            limit: limit + 1,
-            takeOnly: true,
-            observe: false,
-            lock: false,
-            orderBy: asc(col(j.table, j.jobId)),
-          },
-        );
-
-  const grants = yield* owner.read(
-    g.table,
-    both(
-      eq(col(g.table, g.moduleId), moduleId),
-      sql`${col(g.table, g.state)} in ('Disconnected','ReauthorizationRequired')`,
-      sql`${col(g.table, g.sealed)} is null`,
-      sql`${col(g.table, g.refreshWork)} <> 'Unresolved'`,
-      lte(col(g.table, g.retentionUntil), mapping.clock.encodeInstant(at)),
-      sql`${col(g.table, g.revocationJobId)} is null`,
-      sql`not exists(select 1 from ${mapping.admission.table} where ${col(mapping.admission.table, mapping.admission.moduleId)} = ${col(g.table, g.moduleId)} and ${col(mapping.admission.table, mapping.admission.grantId)} = ${col(g.table, g.grantId)})`,
-      sql`not exists(select 1 from ${mapping.command.table} where ${col(mapping.command.table, mapping.command.moduleId)} = ${col(g.table, g.moduleId)} and ${col(mapping.command.table, mapping.command.grantId)} = ${col(g.table, g.grantId)})`,
-      j === undefined
-        ? undefined
-        : sql`not exists(select 1 from ${j.table} where ${col(j.table, j.moduleId)} = ${col(g.table, g.moduleId)} and ${col(j.table, j.grantId)} = ${col(g.table, g.grantId)})`,
-    ),
-    {
-      limit: limit + 1,
-      takeOnly: true,
-      observe: false,
-      lock: false,
-      orderBy: asc(col(g.table, g.grantId)),
-    },
-  );
-
-  const cohorts =
-    j === undefined
-      ? { rows: [] }
-      : yield* owner.read(
-          h.table,
-          both(
-            equal(h.table, { [h.state]: "Blocked" }),
-            C.clearableCondition(
-              mapping,
-              sql`${col(h.table, h.cohortKey)}`,
-              sql`${col(h.table, h.clientKey)}`,
-            ),
-          ),
-          {
-            limit: limit + 1,
-            takeOnly: true,
-            observe: false,
-            lock: false,
-            orderBy: asc(col(h.table, h.cohortKey)),
-          },
-        );
-
-  const t = mapping.ownership.tuple;
-
-  const tuples =
-    mapping.externalReference === undefined
-      ? { rows: [] }
-      : yield* owner.read(
-          t.table,
-          both(
-            eq(col(t.table, t.state), "Owned"),
-            sql`not (${connectedReferenceCondition(mapping, sql`${col(t.table, t.identityKey)}`, { provider: sql`${col(t.table, t.provider)}`, issuer: sql`${col(t.table, t.issuer)}` })})`,
-            sql`not (${mapping.externalReference({ identityKey: sql`${col(t.table, t.identityKey)}`, subjectId: sql`${col(t.table, t.subjectId)}` })})`,
-          ),
-          {
-            limit: limit + 1,
-            takeOnly: true,
-            observe: false,
-            lock: false,
-            orderBy: asc(col(t.table, t.identityKey)),
-          },
-        );
-
-  return { jobs: jobs.rows, grants: grants.rows, cohorts: cohorts.rows, tuples: tuples.rows };
-});
-
-export const collect = Effect.fn("oauthConnected.collect")(function* (
-  mapping: S.Mapping,
-  moduleId: string,
-  limit: number,
-  discovered: Candidates,
-) {
-  const owner = yield* CurrentOAuthTransaction;
-
-  let visited = 0,
-    removed = 0,
-    hasMore = false;
-
-  if (limit === 0) return { visited, removed, hasMore: true };
-
-  const g = mapping.grant,
-    j = S.jobTable(mapping),
-    h = mapping.cohort;
-
-  if (j !== undefined) {
-    const candidates = { rows: discovered.jobs };
-
-    hasMore = candidates.rows.length > limit;
-    for (const candidate of candidates.rows.slice(0, limit)) {
-      visited++;
-
-      const job = S.jobStorage.decode(candidate[j.snapshot]),
-        token = job.context.token;
-
-      const client = yield* S.client(mapping, token.configuration, false);
-
-      invariant(client !== undefined);
-      const tuple = yield* F.inspectTuple(mapping, token.identity);
-      const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);
-
-      invariant(cohort.row !== undefined);
-      const grant = yield* S.readGrant(mapping, token.moduleId, token.grantId);
-
-      const read = yield* owner.read(j.table, equal(j.table, { [j.jobId]: job.context.jobId }), {
-          limit: 1,
-        }),
-        row = read.rows[0];
-
-      if (row === undefined) continue;
-      const native = yield* mapping.subjectId.toNative(token.subjectId);
-
-      invariant(
-        row[j.snapshot] === S.jobStorage.encode(job) &&
-          row[j.moduleId] === moduleId &&
-          row[j.identityKey] === tuple.key &&
-          row[j.clientKey] === client.id &&
-          row[j.cohortKey] === cohort.id &&
-          row[j.grantId] === token.grantId &&
-          mapping.subjectId.equals(row[j.subjectId], native),
-      );
-
-      const now = yield* owner.now(mapping.clock),
-        until = mapping.clock.decodeInstant(row[j.retentionUntil]);
-
-      if (row[j.state] !== "Confirmed" || now < until) continue;
-      if (grant?.row[g.revocationJobId] === job.context.jobId) {
-        const summary = S.summaryStorage.decode(grant.row[g.summary]);
-
-        yield* owner.update(
-          g.table,
-          { [g.moduleId]: token.moduleId, [g.grantId]: token.grantId },
-          {
-            [g.revocationJobId]: null,
-            [g.summary]: S.summaryStorage.encode({ ...summary, remoteRevocation: "Confirmed" }),
-            [g.version]: owner.marker,
-          },
-        );
-      }
-      yield* owner.remove(j.table, {
-        [j.jobId]: job.context.jobId,
-        [j.state]: "Confirmed",
-        [j.version]: row[j.version],
-      });
-      owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${until}`);
-      removed++;
-    }
-  }
-  if (visited < limit) {
-    const candidates = { rows: discovered.grants };
-    const remaining = limit - visited;
-
-    if (candidates.rows.length > remaining) hasMore = true;
-    for (const candidate of candidates.rows.slice(0, remaining)) {
-      visited++;
-      const context = S.tokenContextStorage.decode(candidate[g.context]);
-      const client = yield* S.client(mapping, context.configuration, false);
-
-      invariant(client !== undefined);
-      const tuple = yield* F.inspectTuple(mapping, context.identity);
-      const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);
-
-      invariant(cohort.row !== undefined);
-      const grant = yield* S.readGrant(mapping, moduleId, context.grantId);
-
-      if (grant === undefined) continue;
-
-      const now = yield* owner.now(mapping.clock),
-        until = mapping.clock.decodeInstant(grant.row[g.retentionUntil]);
-
-      if (
-        !["Disconnected", "ReauthorizationRequired"].includes(grant.row[g.state]) ||
-        grant.row[g.sealed] !== null ||
-        grant.row[g.refreshWork] === "Unresolved" ||
-        grant.row[g.revocationJobId] !== null ||
-        now < until
-      )
-        continue;
-
-      const a = mapping.admission,
-        d = mapping.command;
-
-      const references = both(
-        sql`not exists(select 1 from ${a.table} where ${equal(a.table, { [a.moduleId]: moduleId, [a.grantId]: context.grantId })})`,
-        sql`not exists(select 1 from ${d.table} where ${equal(d.table, { [d.moduleId]: moduleId, [d.grantId]: context.grantId })})`,
-        ...(j === undefined
-          ? []
-          : [
-              sql`not exists(select 1 from ${j.table} where ${equal(j.table, { [j.moduleId]: moduleId, [j.grantId]: context.grantId })})`,
-            ]),
-      );
-
-      if (!(yield* owner.check(references))) continue;
-      yield* owner.remove(g.table, {
-        [g.moduleId]: moduleId,
-        [g.grantId]: context.grantId,
-        [g.version]: grant.row[g.version],
-      });
-      owner.postconditions.push(references, sql`${mapping.clock.engineNowMillis} >= ${until}`);
-      removed++;
-    }
-  }
-  // Clearing is global remote authority, independent of the module which happens
-  // to run cleanup. No subject filter may hide a former owner's unresolved work.
-  if (visited < limit && j !== undefined) {
-    const candidates = { rows: discovered.cohorts };
-    const remaining = limit - visited;
-
-    if (candidates.rows.length > remaining) hasMore = true;
-    for (const candidate of candidates.rows.slice(0, remaining)) {
-      visited++;
-      const id = candidate[h.clientKey];
-      const client = yield* S.lockClientById(mapping, id);
-      const cohort = yield* S.cohort(mapping, id, candidate[h.identityKey], false);
-
-      invariant(cohort.id === candidate[h.cohortKey] && cohort.row !== undefined);
-      yield* C.clear(mapping, client, cohort);
-    }
-  }
-  if (visited < limit && mapping.externalReference !== undefined) {
-    const t = mapping.ownership.tuple,
-      remaining = limit - visited;
-
-    if (discovered.tuples.length > remaining) hasMore = true;
-    for (const candidate of discovered.tuples.slice(0, remaining)) {
-      visited++;
-      const scope = yield* S.heldScope(mapping, candidate[t.provider], candidate[t.issuer]);
-
-      if (scope === undefined) continue;
-
-      const identity = {
-        provider: candidate[t.provider],
-        issuer: candidate[t.issuer],
-        subject: candidate[t.externalSubject],
-      };
-
-      invariant((yield* oauthIdentityKey(identity)) === candidate[t.identityKey]);
-
-      const tuple = yield* F.inspectTuple(mapping, identity),
-        row = tuple.row;
-
-      if (row === undefined || row[t.state] !== "Owned") continue;
-      const native = row[t.subjectId];
-
-      invariant(native !== null);
-
-      const noRefs = both(
-        sql`not (${connectedReferenceCondition(mapping, tuple.key)})`,
-        sql`not (${mapping.externalReference({ identityKey: tuple.key, subjectId: S.nativeCopy(native) })})`,
-      );
-
-      if (!(yield* owner.check(noRefs))) continue;
-      yield* S.touchScope(mapping, scope);
-      yield* owner.update(
-        t.table,
-        { [t.identityKey]: tuple.key, [t.state]: "Owned", [t.subjectId]: native },
-        {
-          [t.state]: "Unowned",
-          [t.subjectId]: null,
-          [t.reservation]: null,
-          [t.version]: owner.marker,
-        },
-      );
-      if (mapping.ownership.mode === "separate")
-        yield* owner.remove(mapping.ownership.external.table, {
-          [mapping.ownership.external.identityKey]: tuple.key,
-        });
-      owner.postconditions.push(noRefs);
-    }
-  }
-
-  return { visited, removed, hasMore };
-});