@yielded/auth-persistence-drizzle 0.1.0-beta.23 → 0.1.0-beta.24

package/src/drizzle/oauth-connected-settlement.ts

@@ -1,251 +0,0 @@
-import * as M from "@yielded/auth/OAuth";
-import { snapshotOAuthSync } from "@yielded/auth/OAuth";
-import { ne, sql } from "drizzle-orm";
-import { Effect } from "effect";
-
-import * as C from "./oauth-connected-custody";
-import * as F from "./oauth-connected-flow";
-import * as S from "./oauth-connected-state";
-import { both, col, equal, CurrentOAuthTransaction } from "./oauth-owner";
-import { invariant, sameIdentity, oauthIdentityKey } from "./oauth-state";
-
-export const validMetadata = (context: M.OAuthConnectedTokenContext, now: number) => {
-  const m = context.metadata,
-    p = context.configuration.profile;
-
-  return (
-    p.provider === context.identity.provider &&
-    context.configuration.provider === context.identity.provider &&
-    context.configuration.issuer === context.identity.issuer &&
-    m.obtainedAtMillis <= now &&
-    m.useUntilMillis > m.obtainedAtMillis &&
-    m.useUntilMillis <= m.obtainedAtMillis + p.maximumAccessLifetimeMillis &&
-    (m.accessExpiresAtMillis === undefined || m.useUntilMillis <= m.accessExpiresAtMillis) &&
-    m.scopes.every((v) => p.scopes.includes(v)) &&
-    m.resources.every((v) => p.resources.includes(v)) &&
-    new Set(m.scopes).size === m.scopes.length &&
-    new Set(m.resources).size === m.resources.length &&
-    (m.refreshUseUntilMillis === undefined ||
-      (p.retention === "access-and-refresh" &&
-        p.maximumRefreshLifetimeMillis !== undefined &&
-        m.refreshUseUntilMillis > m.obtainedAtMillis &&
-        m.refreshUseUntilMillis <= m.obtainedAtMillis + p.maximumRefreshLifetimeMillis &&
-        (m.refreshExpiresAtMillis === undefined ||
-          m.refreshUseUntilMillis <= m.refreshExpiresAtMillis)))
-  );
-};
-
-/** The only writer that activates or replaces a confirmed connected grant. */
-export const activateGrant = Effect.fn("oauthConnected.activateGrant")(function* (
-  mapping: S.Mapping,
-  grant: M.OAuthConnectedStoredGrant,
-  native: unknown,
-  now: number,
-  replacing: boolean,
-) {
-  const owner = yield* CurrentOAuthTransaction;
-  const token = grant.context;
-  const g = mapping.grant;
-  const identityKey = yield* oauthIdentityKey(token.identity);
-  const clientKey = yield* S.clientKey(token.configuration);
-  const cohortKey = yield* S.cohortKey(clientKey, identityKey);
-
-  const values = {
-    ...g.encodeInsert({
-      grant: snapshotOAuthSync(M.OAuthConnectedStoredGrant, grant),
-      subjectId: S.nativeCopy(native),
-    }),
-    [g.moduleId]: token.moduleId,
-    [g.grantId]: token.grantId,
-    [g.subjectId]: native,
-    [g.identityKey]: identityKey,
-    [g.activeIdentityKey]: identityKey,
-    [g.clientKey]: clientKey,
-    [g.cohortKey]: cohortKey,
-    [g.profileKey]: token.configuration.profile.key,
-    [g.grantVersion]: token.grantVersion,
-    [g.tokenVersion]: token.tokenVersion,
-    [g.cohortGeneration]: token.cohortGeneration,
-    [g.state]: "Active",
-    [g.version]: owner.marker,
-    [g.context]: S.tokenContextStorage.encode(token),
-    [g.sealed]: S.sealedStorage.encode(grant.sealed),
-    [g.summary]: S.summaryStorage.encode(C.summary(token)),
-    [g.revocationJobId]: null,
-    [g.refreshWork]: "None",
-    [g.refreshClaim]: null,
-    [g.refreshClaimExpiresAt]: null,
-    [g.retentionUntil]: mapping.clock.encodeInstant(
-      S.retainedUntil(
-        mapping,
-        Math.max(now, token.metadata.useUntilMillis, token.metadata.refreshUseUntilMillis ?? 0),
-      ),
-    ),
-  };
-
-  if (!replacing) {
-    yield* owner.insert(g.table, values, {
-      [g.moduleId]: token.moduleId,
-      [g.grantId]: token.grantId,
-    });
-  } else
-    yield* owner.update(
-      g.table,
-      { [g.moduleId]: token.moduleId, [g.grantId]: token.grantId },
-      values,
-    );
-});
-
-export const settle = Effect.fn("oauthConnected.settle")(function* (
-  mapping: S.Mapping,
-  input: F.Input<"settle">,
-) {
-  const owner = yield* CurrentOAuthTransaction;
-
-  const c = input.claim.flow.context,
-    out = input.outcome;
-
-  const found = yield* S.current(mapping, c.revision.subjectId);
-
-  const authorized =
-    found !== undefined &&
-    (yield* S.action(mapping, found, input.authorization, "settle", F.expected(input.claim.flow)));
-
-  const cl = yield* S.client(mapping, S.configuration(input.claim.flow), false);
-
-  if (cl === undefined) return { _tag: "Rejected" } as const;
-  if (out._tag !== "Verified" && out._tag !== "Quarantined") {
-    const claimed = yield* F.exact(mapping, input.claim);
-
-    if (claimed === undefined) return { _tag: "Rejected" } as const;
-    const state = out._tag === "Unissued" ? "Rejected" : out._tag;
-
-    yield* F.terminal(
-      mapping,
-      input.claim,
-      state,
-      out._tag === "Cancelled" || out._tag === "Unissued" ? "Resolved" : "Unresolved",
-    );
-
-    return { _tag: state } as
-      | { readonly _tag: "Cancelled" }
-      | { readonly _tag: "Rejected" }
-      | { readonly _tag: "Conflict" }
-      | { readonly _tag: "Ambiguous" };
-  }
-
-  const grant = snapshotOAuthSync(M.OAuthConnectedStoredGrant, out.grant),
-    token = grant.context;
-
-  invariant(
-    token.moduleId === c.moduleId &&
-      token.subjectId === c.revision.subjectId &&
-      token.grantId === c.grantId &&
-      token.identity.provider === c.provider &&
-      token.identity.issuer === c.issuer &&
-      (yield* S.clientKey(token.configuration)) === cl.id &&
-      S.tokenContextStorage.encode({
-        ...token,
-        configuration: S.configuration(input.claim.flow),
-      }) === S.tokenContextStorage.encode(token),
-  );
-  const native = yield* mapping.subjectId.toNative(c.revision.subjectId);
-
-  const tuple = yield* F.readTuple(mapping.ownership, token.identity),
-    t = mapping.ownership.tuple;
-
-  if (
-    tuple.row[t.state] === "Reserved" ||
-    (tuple.row[t.state] === "Owned" && !mapping.subjectId.equals(tuple.row[t.subjectId], native))
-  ) {
-    const claimed = yield* F.exact(mapping, input.claim);
-
-    if (claimed !== undefined) yield* F.terminal(mapping, input.claim, "Conflict", "Unresolved");
-
-    return { _tag: "Conflict" } as const;
-  }
-  const co = yield* S.cohort(mapping, cl.id, tuple.key, true);
-  const original = yield* S.readGrant(mapping, c.moduleId, c.grantId);
-  const g = mapping.grant;
-
-  const other = yield* owner.read(
-    g.table,
-    both(
-      equal(g.table, {
-        [g.moduleId]: c.moduleId,
-        [g.subjectId]: native,
-        [g.profileKey]: c.profile.key,
-        [g.activeIdentityKey]: tuple.key,
-      }),
-      ne(col(g.table, g.grantId), c.grantId),
-    ),
-    { limit: 1 },
-  );
-
-  const claimed = yield* F.exact(mapping, input.claim);
-
-  if (claimed === undefined) return { _tag: "Rejected" } as const;
-  invariant(
-    token.exchangeOrder === input.claim.order &&
-      validMetadata(token, claimed.now) &&
-      token.metadata.obtainedAtMillis >= input.claim.claimedAtMillis,
-  );
-  const reconnect = c.reconnect;
-
-  const targetOkay =
-    reconnect === undefined
-      ? original === undefined
-      : original !== undefined &&
-        F.sameTarget(reconnect, original.context) &&
-        sameIdentity(reconnect.identity, token.identity) &&
-        original.row[g.refreshWork] !== "Unresolved";
-
-  const previousSafe = yield* C.noFormerOwner(mapping, tuple.key, cl.id, native);
-
-  const active =
-    out._tag === "Verified" &&
-    authorized &&
-    claimed.active &&
-    c.profile.issuance === "active" &&
-    token.metadata.useUntilMillis > claimed.now &&
-    !co.blocked &&
-    co.generation === token.cohortGeneration &&
-    S.orderNumber(input.claim.order) > co.cutoff &&
-    targetOkay &&
-    other.rows.length === 0 &&
-    previousSafe;
-
-  if (!active) {
-    // Foreign historical custody never authorizes a new remote operation.
-    if (!previousSafe) {
-      yield* F.terminal(mapping, input.claim, "Conflict", "Unresolved");
-
-      return { _tag: "Conflict" } as const;
-    }
-    if (tuple.row[t.state] === "Unowned")
-      yield* F.acquireTuple(mapping.ownership, token.identity, tuple.key, S.nativeCopy(native));
-    yield* C.fence(mapping, cl, co);
-    if (out.cleanup !== undefined) {
-      yield* C.storeJob(mapping, out.cleanup, token, native, claimed.now);
-      yield* F.terminal(mapping, input.claim, "Quarantined", "Resolved", { cohort: co.id });
-    } else
-      yield* F.terminal(mapping, input.claim, "Quarantined", "Unresolved", {
-        cohort: co.id,
-        sealed: grant,
-      });
-
-    return { _tag: targetOkay && other.rows.length === 0 ? "Rejected" : "Conflict" } as
-      | { readonly _tag: "Rejected" }
-      | { readonly _tag: "Conflict" };
-  }
-  if (tuple.row[t.state] === "Unowned")
-    yield* F.acquireTuple(mapping.ownership, token.identity, tuple.key, S.nativeCopy(native));
-
-  yield* activateGrant(mapping, grant, native, claimed.now, original !== undefined);
-  yield* F.terminal(mapping, input.claim, "Connected", "Resolved", { cohort: co.id });
-  owner.postconditions.push(
-    sql`${mapping.clock.engineNowMillis} >= ${claimed.now} and ${mapping.clock.engineNowMillis} < ${Math.min(input.claim.claimExpiresAtMillis, token.metadata.useUntilMillis)}`,
-  );
-
-  return { _tag: "Connected", grant } as const;
-});

package/src/drizzle/oauth-connected-sign-in.ts

@@ -1,443 +0,0 @@
-import * as M from "@yielded/auth/OAuth";
-import { snapshotOAuthSync } from "@yielded/auth/OAuth";
-import { sql } from "drizzle-orm";
-import { Effect, Schema } from "effect";
-
-import * as C from "./oauth-connected-custody";
-import * as F from "./oauth-connected-flow";
-import { activateGrant, validMetadata } from "./oauth-connected-settlement";
-import * as S from "./oauth-connected-state";
-import { exactClaim } from "./oauth-flow";
-import { both, equal, CurrentOAuthTransaction } from "./oauth-owner";
-import {
-  digest,
-  invariant,
-  oauthIdentityKey,
-  sameIdentity,
-  sameRevision,
-  storage,
-  unavailable,
-} from "./oauth-state";
-
-const reservationStorage = storage(M.OAuthSignInAccessClaim);
-const configurationStorage = storage(M.OAuthConnectedConfiguration);
-
-/** Reservation rows share the connected-work ledger, but have no browser
- * snapshot or subject. They can never enter the authenticated connect flow. */
-export const claimSignIn = Effect.fn("oauthConnected.claimSignIn")(function* (
-  mapping: S.Mapping,
-  input: F.Input<"claimSignIn">,
-) {
-  const owner = yield* CurrentOAuthTransaction;
-  const signIn = mapping.signIn;
-  const encode = mapping.flow.encodeSignIn;
-
-  if (signIn === undefined || encode === undefined) return yield* unavailable();
-  const { claim, configuration } = input;
-  const c = claim.flow.context;
-
-  invariant(
-    c.access !== undefined &&
-      configurationStorage.encode(configuration) ===
-        configurationStorage.encode({ ...c, profile: c.access }),
-  );
-  if (configuration.profile.revocation === "cohort")
-    invariant(mapping.revocation.mode === "cohort");
-  const client = yield* S.client(mapping, configuration, true);
-
-  invariant(client !== undefined);
-  const exact = yield* exactClaim({ ...mapping, flow: signIn.flow }, claim, "sign-in");
-
-  if (exact === undefined) return yield* unavailable();
-  const f = mapping.flow;
-  const key = { [f.moduleId]: c.moduleId, [f.flowId]: c.flowId };
-  const prior = yield* owner.read(f.table, equal(f.table, key), { limit: 1 });
-
-  const command = yield* owner.read(
-    f.table,
-    equal(f.table, { [f.moduleId]: c.moduleId, [f.commandId]: c.commandId }),
-    { limit: 1 },
-  );
-
-  if (prior.rows.length || command.rows.length) return yield* unavailable();
-  yield* S.touchScope(mapping, client.scope);
-  const order = yield* S.nextOrder(mapping, client);
-
-  const reservation = snapshotOAuthSync(M.OAuthSignInAccessClaim, {
-    claim,
-    configuration,
-    order: String(order),
-  });
-
-  const inserted = yield* owner.insert(
-    f.table,
-    {
-      ...encode(reservation),
-      ...key,
-      [f.commandId]: c.commandId,
-      [f.subjectId]: null,
-      [f.clientKey]: client.id,
-      [f.cohortKey]: null,
-      [f.state]: "Claimed",
-      [f.version]: owner.marker,
-      [f.stateDigest]: c.stateDigest,
-      [f.snapshot]: null,
-      [f.claimId]: claim.claimId,
-      [f.claimDigest]: yield* digest(reservationStorage.encode(reservation)),
-      [f.claimOrder]: mapping.order.encode(order),
-      [f.claimedAt]: mapping.clock.encodeInstant(claim.claimedAtMillis),
-      [f.claimExpiresAt]: mapping.clock.encodeInstant(claim.claimExpiresAtMillis),
-      [f.expiresAt]: mapping.clock.encodeInstant(c.expiresAtMillis),
-      [f.retentionUntil]: mapping.clock.encodeInstant(claim.flow.retentionUntilMillis),
-      [f.work]: "Unresolved",
-      [f.custody]: null,
-    },
-    key,
-  );
-
-  prior.rows = inserted.rows;
-  command.rows = inserted.rows;
-
-  return reservation;
-});
-
-const exact = Effect.fn("oauthConnected.exactSignIn")(function* (
-  mapping: S.Mapping,
-  reservation: M.OAuthSignInAccessClaim,
-) {
-  const owner = yield* CurrentOAuthTransaction;
-  const f = mapping.flow;
-  const c = reservation.claim.flow.context;
-  const key = { [f.moduleId]: c.moduleId, [f.flowId]: c.flowId };
-  const read = yield* owner.read(f.table, equal(f.table, key), { limit: 1 });
-  const row = read.rows[0];
-
-  if (
-    row === undefined ||
-    row[f.work] !== "Unresolved" ||
-    row[f.claimId] !== reservation.claim.claimId ||
-    row[f.claimDigest] !== (yield* digest(reservationStorage.encode(reservation)))
-  )
-    return undefined;
-  invariant(
-    row[f.subjectId] === null &&
-      row[f.commandId] === c.commandId &&
-      row[f.clientKey] === (yield* S.clientKey(reservation.configuration)) &&
-      S.nativeOrder(mapping, row[f.claimOrder]) === S.orderNumber(reservation.order),
-  );
-  const now = yield* owner.now(mapping.clock);
-
-  invariant(now >= reservation.claim.claimedAtMillis);
-
-  return {
-    key,
-    row,
-    now,
-    active: row[f.state] === "Claimed" && now < reservation.claim.claimExpiresAtMillis,
-  };
-});
-
-const credential = Effect.fn("oauthConnected.signInCredential")(function* (
-  mapping: S.Mapping,
-  reservation: M.OAuthSignInAccessClaim,
-  input: M.OAuthCredentialSnapshot,
-) {
-  const owner = yield* CurrentOAuthTransaction;
-  const signIn = mapping.signIn;
-
-  if (signIn === undefined) return undefined;
-  const context = reservation.claim.flow.context;
-
-  if (
-    input.moduleId !== context.moduleId ||
-    input.identity.provider !== context.provider ||
-    input.identity.issuer !== context.issuer
-  )
-    return undefined;
-  const found = yield* S.current(mapping, input.revision.subjectId);
-
-  if (found === undefined || !sameRevision(found.revision, input.revision)) return undefined;
-  const c = signIn.credential;
-
-  const loginWhere = both(
-    equal(c.table, {
-      [c.moduleId]: context.moduleId,
-      [c.credentialId]: input.credentialId,
-      [c.subjectId]: found.nativeId,
-      [c.identityKey]: yield* oauthIdentityKey(input.identity),
-      [c.credentialRevision]: input.credentialRevision,
-    }),
-    c.activeCondition,
-  );
-
-  const login = yield* owner.read(c.table, loginWhere, { limit: 1 });
-
-  if (login.rows.length !== 1 || !c.isActiveStatus(login.rows[0]![c.status])) return undefined;
-  const f = signIn.flow;
-
-  const verifiedWhere = equal(f.table, {
-    [f.moduleId]: context.moduleId,
-    [f.flowId]: context.flowId,
-    [f.state]: "Verified",
-    [f.claimId]: reservation.claim.claimId,
-    [f.stateDigest]: context.stateDigest,
-    [f.claimedAt]: mapping.clock.encodeInstant(reservation.claim.claimedAtMillis),
-    [f.claimExpiresAt]: mapping.clock.encodeInstant(reservation.claim.claimExpiresAtMillis),
-  });
-
-  const verified = yield* owner.read(f.table, verifiedWhere, { limit: 1 });
-
-  if (verified.rows.length !== 1) return undefined;
-  owner.postconditions.push(
-    sql`exists(select 1 from ${c.table} where ${loginWhere})`,
-    sql`exists(select 1 from ${f.table} where ${verifiedWhere})`,
-  );
-  if (
-    !(yield* S.policy(mapping, {
-      kind: "sign-in",
-      subjectId: found.nativeId,
-      revision: found.revision,
-      credential: snapshotOAuthSync(M.OAuthCredentialSnapshot, input),
-      configuration: reservation.configuration,
-    }))
-  )
-    return undefined;
-
-  return found;
-});
-
-const slot = Effect.fn("oauthConnected.signInSlot")(function* (
-  mapping: S.Mapping,
-  moduleId: string,
-  native: unknown,
-  identityKey: string,
-  profileKey: string,
-) {
-  const owner = yield* CurrentOAuthTransaction;
-  const g = mapping.grant;
-
-  const rows = yield* owner.read(
-    g.table,
-    equal(g.table, {
-      [g.moduleId]: moduleId,
-      [g.subjectId]: native,
-      [g.profileKey]: profileKey,
-      [g.activeIdentityKey]: identityKey,
-    }),
-    { limit: 1, admissionOnly: true },
-  );
-
-  const row = rows.rows[0];
-
-  if (row === undefined) return undefined;
-
-  return yield* S.readGrant(
-    mapping,
-    moduleId,
-    yield* Schema.decodeUnknownEffect(M.OAuthGrantId)(row[g.grantId]).pipe(
-      Effect.mapError(unavailable),
-    ),
-  );
-});
-
-/** Orders belong to one client registration. Moving a profile to another client
- * requires a newer profile generation; retired clients cannot replace it later. */
-const canReplace = Effect.fnUntraced(function* (
-  reservation: M.OAuthSignInAccessClaim,
-  previous: M.OAuthConnectedTokenContext,
-) {
-  const generation = reservation.configuration.profile.generation;
-  const oldGeneration = previous.configuration.profile.generation;
-
-  return (yield* S.clientKey(reservation.configuration)) ===
-    (yield* S.clientKey(previous.configuration))
-    ? generation >= oldGeneration &&
-        S.orderNumber(reservation.order) > S.orderNumber(previous.exchangeOrder)
-    : generation > oldGeneration;
-});
-
-export const inspectSignIn = Effect.fn("oauthConnected.inspectSignIn")(function* (
-  mapping: S.Mapping,
-  input: F.Input<"inspectSignIn">,
-) {
-  const found = yield* credential(mapping, input.reservation, input.credential);
-
-  if (found === undefined) return { _tag: "Rejected" } as const;
-  const r = input.reservation;
-  const cl = yield* S.client(mapping, r.configuration, false);
-
-  if (cl === undefined) return { _tag: "Rejected" } as const;
-  const tuple = yield* F.inspectTuple(mapping, input.credential.identity);
-  const t = mapping.ownership.tuple;
-
-  if (
-    tuple.row?.[t.state] !== "Owned" ||
-    !mapping.subjectId.equals(tuple.row[t.subjectId], found.nativeId)
-  )
-    return { _tag: "Rejected" } as const;
-  const co = yield* S.cohort(mapping, cl.id, tuple.key, false);
-
-  const previous = yield* slot(
-    mapping,
-    r.claim.flow.context.moduleId,
-    found.nativeId,
-    tuple.key,
-    r.configuration.profile.key,
-  );
-
-  const held = yield* exact(mapping, r);
-
-  if (held === undefined) return { _tag: "Rejected" } as const;
-
-  const quarantine =
-    !held.active ||
-    co.blocked ||
-    S.orderNumber(r.order) <= co.cutoff ||
-    previous?.row[mapping.grant.refreshWork] === "Unresolved" ||
-    (previous !== undefined && !(yield* canReplace(r, previous.context)));
-
-  return snapshotOAuthSync(M.OAuthSignInAccessInspection, {
-    _tag: quarantine ? "Quarantine" : "Target",
-    grantId: previous?.context.grantId ?? input.grantId,
-    cohortGeneration: co.generation,
-    ...(previous === undefined
-      ? {}
-      : { previous: snapshotOAuthSync(M.OAuthConnectedTarget, previous.context) }),
-  });
-});
-
-export const settleSignIn = Effect.fn("oauthConnected.settleSignIn")(function* (
-  mapping: S.Mapping,
-  input: F.Input<"settleSignIn">,
-) {
-  const owner = yield* CurrentOAuthTransaction;
-  const r = input.reservation;
-  const out = input.outcome;
-  const found = out._tag === "Verified" ? yield* credential(mapping, r, out.credential) : undefined;
-  const cl = yield* S.client(mapping, r.configuration, false);
-
-  if (cl === undefined) return { _tag: "Rejected" } as const;
-  const f = mapping.flow;
-
-  if (out._tag !== "Verified") {
-    const held = yield* exact(mapping, r);
-
-    if (held === undefined) return { _tag: "Rejected" } as const;
-    // Unissued means the provider definitely returned no token. Resolve that
-    // reservation. A Rejected outcome can follow a real exchange, so it stays open.
-    const state = out._tag === "Unissued" ? "Rejected" : out._tag;
-
-    yield* owner.update(f.table, held.key, {
-      [f.state]: state,
-      [f.work]: out._tag === "Cancelled" || out._tag === "Unissued" ? "Resolved" : "Unresolved",
-      [f.version]: owner.marker,
-    });
-
-    return { _tag: state };
-  }
-  const token = out.grant.context;
-
-  invariant(
-    token.moduleId === r.claim.flow.context.moduleId &&
-      token.subjectId === out.credential.revision.subjectId &&
-      sameIdentity(token.identity, out.credential.identity) &&
-      configurationStorage.encode(token.configuration) ===
-        configurationStorage.encode(r.configuration),
-  );
-  const native = yield* mapping.subjectId.toNative(token.subjectId);
-  const tuple = yield* F.readTuple(mapping.ownership, token.identity);
-  const t = mapping.ownership.tuple;
-
-  const owned =
-    tuple.row[t.state] === "Owned" && mapping.subjectId.equals(tuple.row[t.subjectId], native);
-
-  const co = yield* S.cohort(mapping, cl.id, tuple.key, true);
-  const previous = yield* S.readGrant(mapping, token.moduleId, token.grantId);
-
-  const activeSlot = yield* slot(
-    mapping,
-    token.moduleId,
-    native,
-    tuple.key,
-    token.configuration.profile.key,
-  );
-
-  const held = yield* exact(mapping, r);
-
-  if (held === undefined) return { _tag: "Rejected" } as const;
-  invariant(
-    token.exchangeOrder === r.order &&
-      validMetadata(token, held.now) &&
-      token.metadata.obtainedAtMillis >= r.claim.claimedAtMillis,
-  );
-
-  const target =
-    out.previous === undefined
-      ? previous === undefined
-      : previous !== undefined &&
-        F.sameTarget(out.previous, previous.context) &&
-        sameIdentity(previous.context.identity, token.identity) &&
-        previous.row[mapping.grant.refreshWork] !== "Unresolved" &&
-        (yield* canReplace(r, previous.context));
-
-  const previousSafe = yield* C.noFormerOwner(mapping, tuple.key, cl.id, native);
-
-  if (!owned || !previousSafe) {
-    yield* owner.update(f.table, held.key, { [f.state]: "Conflict", [f.version]: owner.marker });
-
-    return { _tag: "Conflict" } as const;
-  }
-  if (
-    out.quarantine ||
-    found === undefined ||
-    !held.active ||
-    !target ||
-    (activeSlot !== undefined && activeSlot.context.grantId !== token.grantId) ||
-    co.blocked ||
-    S.orderNumber(r.order) <= co.cutoff ||
-    co.generation !== token.cohortGeneration ||
-    token.metadata.useUntilMillis <= held.now ||
-    token.configuration.profile.issuance !== "active"
-  ) {
-    if (token.configuration.profile.revocation === "unsupported") {
-      // No remote cleanup can run for this profile. Discard the losing material;
-      // it must neither replace nor revoke the currently installed grant.
-      yield* owner.update(f.table, held.key, {
-        [f.state]: "Rejected",
-        [f.work]: "Resolved",
-        [f.subjectId]: native,
-        [f.cohortKey]: co.id,
-        [f.custody]: null,
-        [f.version]: owner.marker,
-      });
-    } else {
-      yield* C.fence(mapping, cl, co);
-      if (out.cleanup === undefined) return yield* unavailable();
-      yield* C.storeJob(mapping, out.cleanup, token, native, held.now);
-      yield* owner.update(f.table, held.key, {
-        [f.state]: "Quarantined",
-        [f.work]: "Resolved",
-        [f.subjectId]: native,
-        [f.cohortKey]: co.id,
-        [f.custody]: null,
-        [f.version]: owner.marker,
-      });
-    }
-
-    return { _tag: "Rejected" } as const;
-  }
-  yield* activateGrant(mapping, out.grant, native, held.now, previous !== undefined);
-  yield* owner.update(f.table, held.key, {
-    [f.state]: "Connected",
-    [f.work]: "Resolved",
-    [f.subjectId]: native,
-    [f.cohortKey]: co.id,
-    [f.custody]: null,
-    [f.version]: owner.marker,
-  });
-  owner.postconditions.push(
-    sql`${mapping.clock.engineNowMillis} >= ${held.now} and ${mapping.clock.engineNowMillis} < ${Math.min(r.claim.claimExpiresAtMillis, token.metadata.useUntilMillis)}`,
-  );
-
-  return { _tag: "Connected", grant: out.grant } as const;
-});