@yielded/auth-persistence 0.1.0-beta.24 → 0.1.0-beta.26

package/src/internal/oauth-kernel.ts

@@ -1,294 +0,0 @@
-import { Effect, Layer } from "effect";
-import type { SqlClient } from "effect/sql/SqlClient";
-
-import { OAuthAccounts } from "./oauth/accounts";
-import { OAuthConnectedAccess } from "./oauth/connected-access";
-import { OAuthConnectedCollection } from "./oauth/connected-collection";
-import { OAuthConnectedCustody } from "./oauth/connected-custody";
-import { OAuthConnectedFlow } from "./oauth/connected-flow";
-import { OAuthConnectedMaintenance } from "./oauth/connected-maintenance";
-import { OAuthConnectedManagement } from "./oauth/connected-management";
-import { makeOAuthConnectedReferenceKernel } from "./oauth/connected-reference";
-import { OAuthConnectedSettlement } from "./oauth/connected-settlement";
-import { OAuthConnectedSignIn } from "./oauth/connected-sign-in";
-import { OAuthConnectedState } from "./oauth/connected-state";
-import {
-  OAuthConnectedTarget,
-  oauthConnectedPersistenceLayer,
-  oauthConnectedRevocationsLayer,
-} from "./oauth/connected-target";
-import { OAuthFlow } from "./oauth/flow";
-import { OAuthTransactionExecution } from "./oauth/owner";
-import { OAuthQueryCompiler } from "./oauth/query-compiler";
-import { OAuthRegistration } from "./oauth/registration";
-import { captureOAuthMapping, unavailable } from "./oauth/state";
-import {
-  OAuthTarget,
-  oauthAccountsPersistenceLayer,
-  oauthSignInPersistenceLayer,
-  oauthRegistrationIntentsLayer,
-  oauthRegistrationAuthorityLayer,
-} from "./oauth/target";
-import type { QueryOperations } from "./query-operations";
-import { requireStandalone } from "./standalone";
-import { makeTransactionExecutionKernel } from "./transaction-execution-kernel";
-import { makeTransactionKernel } from "./transaction-kernel";
-
-export type OAuthKernel = ReturnType<typeof makeOAuthKernel>;
-
-/** Adapter composition root. Shared operation Layers acquire their dependencies;
- * database and transaction services are still resolved by each operation. */
-export const makeOAuthKernel = (
-  operations: QueryOperations,
-  dialect: (table: object) => "pg" | "sqlite" | "mysql",
-) => {
-  const transactions = makeTransactionKernel(operations);
-  const connectedReference = makeOAuthConnectedReferenceKernel(operations, dialect);
-
-  const compilerLive = Layer.succeed(OAuthQueryCompiler, {
-    ...operations,
-    ...transactions.makeTransactionRows(unavailable),
-    both: transactions.both,
-    connectedReferenceCondition: connectedReference.connectedReferenceCondition,
-  });
-
-  const executionLive = Layer.succeed(
-    OAuthTransactionExecution,
-    makeTransactionExecutionKernel(transactions),
-  );
-
-  const flowLive = OAuthFlow.layer.pipe(Layer.provide([compilerLive]));
-  const registrationLive = OAuthRegistration.layer.pipe(Layer.provide([compilerLive, flowLive]));
-
-  const accountsLive = OAuthAccounts.layer.pipe(
-    Layer.provide([compilerLive, flowLive, registrationLive]),
-  );
-
-  const targetLive = OAuthTarget.layer.pipe(
-    Layer.provide([compilerLive, accountsLive, flowLive, registrationLive, executionLive]),
-  );
-
-  const connectedStateLive = OAuthConnectedState.layer.pipe(
-    Layer.provide([compilerLive, flowLive]),
-  );
-
-  const connectedFlowLive = OAuthConnectedFlow.layer.pipe(
-    Layer.provide([compilerLive, connectedStateLive, registrationLive]),
-  );
-
-  const connectedCustodyLive = OAuthConnectedCustody.layer.pipe(
-    Layer.provide([compilerLive, connectedStateLive]),
-  );
-
-  const connectedCollectionLive = OAuthConnectedCollection.layer.pipe(
-    Layer.provide([compilerLive, connectedCustodyLive, connectedFlowLive, connectedStateLive]),
-  );
-
-  const connectedSettlementLive = OAuthConnectedSettlement.layer.pipe(
-    Layer.provide([compilerLive, connectedCustodyLive, connectedFlowLive, connectedStateLive]),
-  );
-
-  const connectedAccessLive = OAuthConnectedAccess.layer.pipe(
-    Layer.provide([
-      compilerLive,
-      connectedCustodyLive,
-      connectedFlowLive,
-      connectedSettlementLive,
-      connectedStateLive,
-    ]),
-  );
-
-  const connectedManagementLive = OAuthConnectedManagement.layer.pipe(
-    Layer.provide([
-      compilerLive,
-      connectedAccessLive,
-      connectedCustodyLive,
-      connectedFlowLive,
-      connectedStateLive,
-    ]),
-  );
-
-  const connectedMaintenanceLive = OAuthConnectedMaintenance.layer.pipe(
-    Layer.provide([
-      compilerLive,
-      connectedCollectionLive,
-      connectedCustodyLive,
-      connectedFlowLive,
-      connectedStateLive,
-    ]),
-  );
-
-  const connectedSignInLive = OAuthConnectedSignIn.layer.pipe(
-    Layer.provide([
-      compilerLive,
-      connectedCustodyLive,
-      connectedFlowLive,
-      connectedSettlementLive,
-      connectedStateLive,
-      flowLive,
-    ]),
-  );
-
-  const connectedTargetLive = OAuthConnectedTarget.layer.pipe(
-    Layer.provide([
-      connectedAccessLive,
-      connectedFlowLive,
-      connectedMaintenanceLive,
-      connectedManagementLive,
-      connectedSettlementLive,
-      connectedSignInLive,
-      connectedStateLive,
-      targetLive,
-    ]),
-  );
-
-  // Keep shared operation Layers local to this adapter compiler, even inside another
-  // coordinator. Preserve constructor-time snapshots before deferred acquisition.
-  const makeTargetOAuthSignInServices: OAuthTarget["Service"]["makeTargetOAuthSignInServices"] = (
-    mapping,
-    configuration,
-  ) => {
-    const captured = captureOAuthMapping(mapping);
-
-    return Effect.flatMap(OAuthTarget, (service) =>
-      service.makeTargetOAuthSignInServices(captured, configuration),
-    ).pipe(Effect.provide(targetLive, { local: true }));
-  };
-
-  const makeTargetOAuthRegistrationIntentServices: OAuthTarget["Service"]["makeTargetOAuthRegistrationIntentServices"] =
-    (mapping, configuration) => {
-      const captured = captureOAuthMapping(mapping);
-
-      return Effect.flatMap(OAuthTarget, (service) =>
-        service.makeTargetOAuthRegistrationIntentServices(captured, configuration),
-      ).pipe(Effect.provide(targetLive, { local: true }));
-    };
-
-  const makeTargetOAuthRegistrationServices: OAuthTarget["Service"]["makeTargetOAuthRegistrationServices"] =
-    (mapping, configuration) => {
-      const captured = captureOAuthMapping(mapping);
-
-      return Effect.flatMap(OAuthTarget, (service) =>
-        service.makeTargetOAuthRegistrationServices(captured, configuration),
-      ).pipe(Effect.provide(targetLive, { local: true }));
-    };
-
-  const makeTargetOAuthAccountsServices: OAuthTarget["Service"]["makeTargetOAuthAccountsServices"] =
-    (mapping, configuration) => {
-      const captured = captureOAuthMapping(mapping);
-
-      return Effect.flatMap(OAuthTarget, (service) =>
-        service.makeTargetOAuthAccountsServices(captured, configuration),
-      ).pipe(Effect.provide(targetLive, { local: true }));
-    };
-
-  const coordinateTargetOAuthRegistration: OAuthTarget["Service"]["coordinateTargetOAuthRegistration"] =
-    (database, mapping, configuration, owner) => {
-      const captured = captureOAuthMapping(mapping);
-
-      return Effect.flatMap(OAuthTarget, (service) =>
-        service.coordinateTargetOAuthRegistration(database, captured, configuration, owner),
-      ).pipe(Effect.provide(targetLive, { local: true }));
-    };
-
-  const coordinateTargetOAuthSignIn: OAuthTarget["Service"]["coordinateTargetOAuthSignIn"] = (
-    database,
-    mapping,
-    configuration,
-    owner,
-  ) => {
-    const captured = captureOAuthMapping(mapping);
-
-    return Effect.flatMap(OAuthTarget, (service) =>
-      service.coordinateTargetOAuthSignIn(database, captured, configuration, owner),
-    ).pipe(Effect.provide(targetLive, { local: true }));
-  };
-
-  const coordinateTargetOAuthRegistrationIntents: OAuthTarget["Service"]["coordinateTargetOAuthRegistrationIntents"] =
-    (database, mapping, configuration, owner) => {
-      const captured = captureOAuthMapping(mapping);
-
-      return Effect.flatMap(OAuthTarget, (service) =>
-        service.coordinateTargetOAuthRegistrationIntents(database, captured, configuration, owner),
-      ).pipe(Effect.provide(targetLive, { local: true }));
-    };
-
-  const coordinateTargetOAuthAccounts: OAuthTarget["Service"]["coordinateTargetOAuthAccounts"] = (
-    database,
-    mapping,
-    configuration,
-    owner,
-  ) => {
-    const captured = captureOAuthMapping(mapping);
-
-    return Effect.flatMap(OAuthTarget, (service) =>
-      service.coordinateTargetOAuthAccounts(database, captured, configuration, owner),
-    ).pipe(Effect.provide(targetLive, { local: true }));
-  };
-
-  const makeTargetOAuthConnectedServices: OAuthConnectedTarget["Service"]["makeTargetOAuthConnectedServices"] =
-    (mapping, configuration) => {
-      const captured = captureOAuthMapping(mapping);
-
-      return Effect.flatMap(OAuthConnectedTarget, (service) =>
-        service.makeTargetOAuthConnectedServices(captured, configuration),
-      ).pipe(Effect.provide(connectedTargetLive, { local: true }));
-    };
-
-  const makeTargetOAuthConnectedRevocationServices: OAuthConnectedTarget["Service"]["makeTargetOAuthConnectedRevocationServices"] =
-    (mapping, configuration) => {
-      const captured = captureOAuthMapping(mapping);
-
-      return Effect.flatMap(OAuthConnectedTarget, (service) =>
-        service.makeTargetOAuthConnectedRevocationServices(captured, configuration),
-      ).pipe(Effect.provide(connectedTargetLive, { local: true }));
-    };
-
-  const coordinateTargetOAuthConnected: OAuthConnectedTarget["Service"]["coordinateTargetOAuthConnected"] =
-    (database, mapping, configuration, owner) => {
-      const captured = captureOAuthMapping(mapping);
-
-      return Effect.flatMap(OAuthConnectedTarget, (service) =>
-        service.coordinateTargetOAuthConnected(database, captured, configuration, owner),
-      ).pipe(Effect.provide(connectedTargetLive, { local: true }));
-    };
-
-  const coordinateTargetOAuthConnectedRevocations: OAuthConnectedTarget["Service"]["coordinateTargetOAuthConnectedRevocations"] =
-    (database, mapping, configuration, owner) => {
-      const captured = captureOAuthMapping(mapping);
-
-      return Effect.flatMap(OAuthConnectedTarget, (service) =>
-        service.coordinateTargetOAuthConnectedRevocations(database, captured, configuration, owner),
-      ).pipe(Effect.provide(connectedTargetLive, { local: true }));
-    };
-
-  const sqlClientOAuthStandaloneGuard = (service: SqlClient["transactionService"] | undefined) =>
-    requireStandalone(unavailable, service);
-
-  return {
-    target: {
-      makeTargetOAuthSignInServices,
-      makeTargetOAuthRegistrationIntentServices,
-      makeTargetOAuthRegistrationServices,
-      makeTargetOAuthAccountsServices,
-      coordinateTargetOAuthRegistration,
-      coordinateTargetOAuthSignIn,
-      coordinateTargetOAuthRegistrationIntents,
-      coordinateTargetOAuthAccounts,
-      sqlClientOAuthStandaloneGuard,
-      oauthAccountsPersistenceLayer,
-      oauthSignInPersistenceLayer,
-      oauthRegistrationIntentsLayer,
-      oauthRegistrationAuthorityLayer,
-    },
-    connectedTarget: {
-      makeTargetOAuthConnectedServices,
-      makeTargetOAuthConnectedRevocationServices,
-      coordinateTargetOAuthConnected,
-      coordinateTargetOAuthConnectedRevocations,
-      oauthConnectedPersistenceLayer,
-      oauthConnectedRevocationsLayer,
-    },
-    connectedReference,
-  };
-};

package/src/internal/passkey/admission.ts

@@ -1,368 +0,0 @@
-/* oxlint-disable no-explicit-any -- existing mapped-row bridge; public adapters preserve table, ID, and Effect types. */
-
-import type { PasskeyCeremony, PasskeyMethodPolicy } from "@yielded/auth/Passkey";
-import { Effect } from "effect";
-
-import type { PasskeyChargeKind } from "../models/passkey-model";
-import type { SqlExpression as SQL, QueryOperations } from "../query-operations";
-import type { makeTransactionKernel } from "../transaction-kernel";
-import { CurrentPasskeyTransaction } from "./state";
-import type { makePasskeyStateKernel } from "./state";
-
-export const makePasskeyAdmissionKernel = (
-  operations: QueryOperations,
-  state: Pick<
-    ReturnType<typeof makePasskeyStateKernel>,
-    | "col"
-    | "equal"
-    | "existsExact"
-    | "invariant"
-    | "key"
-    | "mappedColumns"
-    | "subjectScope"
-    | "targetScope"
-  >,
-  transactions: Pick<ReturnType<typeof makeTransactionKernel>, "both">,
-) => {
-  const { sql } = operations;
-  const { col, equal, existsExact, key, mappedColumns, subjectScope, targetScope } = state;
-  const invariant: (value: unknown) => asserts value = state.invariant;
-  const { both } = transactions;
-
-  const chargeRetentionMillis = 86_400_000;
-
-  const chargeScopes = Effect.fnUntraced(function* (ceremony: PasskeyCeremony, subjectId?: string) {
-    const scopes: { kind: PasskeyChargeKind; scope: string }[] = [
-      { kind: "global", scope: yield* key("global", [ceremony.moduleId]) },
-    ];
-
-    if (subjectId !== undefined)
-      scopes.push({ kind: "subject", scope: yield* subjectScope(subjectId) });
-    const target = yield* targetScope(ceremony);
-
-    if (target !== null) scopes.push({ kind: "target", scope: target });
-
-    return scopes;
-  });
-
-  const lockAdmission = Effect.fn("passkey.lockAdmission")(function* (mapping: any) {
-    const owner = yield* CurrentPasskeyTransaction;
-    const table = mapping.admission;
-
-    const identity = {
-      [table.authorityScope]: mapping.authorityScope,
-      [table.moduleId]: mapping.moduleId,
-    };
-
-    // The previous marker/time is telemetry, not an authentication CAS. Actual
-    // engine predicates serialize admission, including separately planned D1 batches.
-    const found = yield* owner.read(table.table, equal(table.table, identity), {
-      limit: 1,
-      observe: false,
-      columns: [table.authorityScope, table.moduleId],
-    });
-
-    invariant(found.rows.length === 1);
-    invariant(
-      found.rows[0]![table.authorityScope] === mapping.authorityScope &&
-        found.rows[0]![table.moduleId] === mapping.moduleId,
-    );
-
-    const marked = {
-      ...identity,
-      [table.version]: owner.marker,
-      [table.ownerMarker]: owner.marker,
-    };
-
-    yield* owner.updateGuarded(
-      table.table,
-      owner.exact(table.table, identity),
-      {
-        [table.version]: owner.marker,
-        [table.ownerMarker]: owner.marker,
-        [table.admittedAt]: null,
-      },
-      { rows: 1, postcondition: yield* existsExact(table.table, marked) },
-    );
-  });
-
-  const pendingCount = (mapping: any, scope?: string) => {
-    const table = mapping.flow;
-
-    return sql`(select count(*) from ${table.table} where ${both(
-      equal(table.table, { [table.moduleId]: mapping.moduleId }),
-      sql`${col(table.table, table.state)} in (${table.states.Pending}, ${table.states.Claimed})`,
-      scope === undefined ? undefined : equal(table.table, { [table.subjectScope]: scope }),
-    )})`;
-  };
-
-  const chargedCount = (mapping: any, kind: PasskeyChargeKind, scope: string, window: number) => {
-    const table = mapping.charge;
-    const clock = mapping.clock;
-
-    return sql`(select count(*) from ${table.table} where ${both(
-      equal(table.table, { [table.moduleId]: mapping.moduleId, [table.kind]: kind }),
-      kind === "global" ? undefined : equal(table.table, { [table.scope]: scope }),
-      sql`${col(table.table, table.admittedAt)} is not null`,
-      sql`${clock.toMillis(sql`${col(table.table, table.admittedAt)}`)} > ${clock.engineNowMillis} - ${window}`,
-    )})`;
-  };
-
-  const admissionCondition = Effect.fnUntraced(function* (
-    mapping: any,
-    policies: ReadonlyArray<PasskeyMethodPolicy>,
-    ceremony: PasskeyCeremony,
-    subjectId: string | undefined,
-    added: ReadonlyArray<PasskeyChargeKind>,
-    newFlow: boolean,
-    resolvedSubject: boolean,
-  ) {
-    const subject = subjectId === undefined ? undefined : yield* subjectScope(subjectId);
-    const scopes = yield* chargeScopes(ceremony, subjectId);
-
-    return both(
-      ...policies.flatMap((policy) => [
-        sql`${pendingCount(mapping)} + ${newFlow ? 1 : 0} <= ${policy.maximumPending}`,
-        subjectId === undefined
-          ? undefined
-          : sql`${pendingCount(mapping, subject)} + ${newFlow || resolvedSubject ? 1 : 0} <= ${policy.maximumPendingPerSubject}`,
-        ...scopes.map(
-          ({ kind, scope }) =>
-            sql`${chargedCount(mapping, kind, scope, policy.admission[kind].windowMillis)} + ${added.includes(kind) ? 1 : 0} <= ${policy.admission[kind].limit}`,
-        ),
-      ]),
-    );
-  });
-
-  const guardAdmission = (
-    mapping: any,
-    policies: ReadonlyArray<PasskeyMethodPolicy>,
-    ceremony: PasskeyCeremony,
-    subjectId?: string,
-  ) =>
-    Effect.gen(function* () {
-      const owner = yield* CurrentPasskeyTransaction;
-
-      owner.postconditions.push(
-        yield* admissionCondition(mapping, policies, ceremony, subjectId, [], false, false),
-      );
-    });
-
-  const readCharges = Effect.fn("passkey.readCharges")(function* (
-    mapping: any,
-    ceremony: PasskeyCeremony,
-    policy: PasskeyMethodPolicy,
-    subjectId?: string,
-  ) {
-    const owner = yield* CurrentPasskeyTransaction;
-    const table = mapping.charge;
-
-    const where = equal(table.table, {
-      [table.moduleId]: ceremony.moduleId,
-      [table.flowId]: ceremony.flowId,
-    });
-
-    const found = yield* owner.read(table.table, where, {
-      limit: 3,
-      observe: false,
-      columns: mappedColumns(table),
-    });
-
-    const scopes = yield* chargeScopes(ceremony, subjectId);
-
-    invariant(found.rows.length === scopes.length);
-    for (const { kind, scope } of scopes) {
-      const rows = found.rows.filter((row) => row[table.kind] === kind);
-
-      invariant(rows.length === 1);
-      const row = rows[0]!;
-      const admitted = mapping.clock.decodeInstant(row[table.admittedAt]);
-      const retained = mapping.clock.decodeInstant(row[table.retainUntil]);
-
-      invariant(
-        Number.isSafeInteger(admitted) &&
-          admitted >= 0 &&
-          retained === admitted + chargeRetentionMillis,
-      );
-      invariant(
-        row[table.moduleId] === ceremony.moduleId &&
-          row[table.flowId] === ceremony.flowId &&
-          row[table.purpose] === ceremony.purpose,
-      );
-      invariant(
-        row[table.scope] === scope &&
-          row[table.originalWindowMillis] === policy.admission[kind].windowMillis,
-      );
-      owner.observations.push({
-        table: table.table,
-        where: equal(table.table, {
-          [table.moduleId]: ceremony.moduleId,
-          [table.flowId]: ceremony.flowId,
-          [table.kind]: kind,
-        }),
-        rows: [row],
-      });
-    }
-  });
-
-  const guardChargeSet = (mapping: any, ceremony: PasskeyCeremony, subjectId?: string) =>
-    Effect.flatMap(CurrentPasskeyTransaction, (owner) =>
-      Effect.gen(function* () {
-        const table = mapping.charge;
-        const scopes = yield* chargeScopes(ceremony, subjectId);
-
-        const where = equal(table.table, {
-          [table.moduleId]: ceremony.moduleId,
-          [table.flowId]: ceremony.flowId,
-        });
-
-        owner.postconditions.push(
-          sql`(select count(*) from ${table.table} where ${where}) = ${scopes.length}`,
-        );
-        for (const { kind, scope } of scopes)
-          owner.postconditions.push(
-            yield* existsExact(table.table, {
-              [table.moduleId]: ceremony.moduleId,
-              [table.flowId]: ceremony.flowId,
-              [table.purpose]: ceremony.purpose,
-              [table.kind]: kind,
-              [table.scope]: scope,
-            }),
-          );
-      }),
-    );
-
-  const insertCharges = Effect.fn("passkey.insertCharges")(function* (
-    mapping: any,
-    ceremony: PasskeyCeremony,
-    policy: PasskeyMethodPolicy,
-    kinds: ReadonlyArray<PasskeyChargeKind>,
-    subjectId?: string,
-  ) {
-    const owner = yield* CurrentPasskeyTransaction;
-
-    if (kinds.length === 0) return;
-    const table = mapping.charge;
-    const anchor = mapping.admission;
-    const clock = mapping.clock;
-    const earliest = yield* owner.now(clock);
-    const identities: Record<string, unknown>[] = [];
-
-    for (const { kind, scope } of (yield* chargeScopes(ceremony, subjectId)).filter((item) =>
-      kinds.includes(item.kind),
-    )) {
-      const identity = {
-        [table.moduleId]: ceremony.moduleId,
-        [table.flowId]: ceremony.flowId,
-        [table.kind]: kind,
-      };
-
-      const values = {
-        ...table.encodeInsert({
-          moduleId: ceremony.moduleId,
-          flowId: ceremony.flowId,
-          purpose: ceremony.purpose,
-          kind,
-          scope,
-          originalWindowMillis: policy.admission[kind].windowMillis,
-          marker: owner.marker,
-        }),
-        ...identity,
-        [table.purpose]: ceremony.purpose,
-        [table.scope]: scope,
-        [table.originalWindowMillis]: policy.admission[kind].windowMillis,
-        [table.admittedAt]: null,
-        [table.retainUntil]: null,
-        [table.version]: owner.marker,
-        [table.ownerMarker]: owner.marker,
-      };
-
-      const observation = yield* owner.insert(table.table, values, identity);
-
-      observation.rows = observation.rows.map((row) =>
-        Object.fromEntries(
-          Object.entries(row).filter(
-            ([name]) => name !== table.admittedAt && name !== table.retainUntil,
-          ),
-        ),
-      );
-      identities.push(identity);
-    }
-    invariant(identities.length === kinds.length);
-
-    const anchorIdentity = {
-      [anchor.authorityScope]: mapping.authorityScope,
-      [anchor.moduleId]: mapping.moduleId,
-      [anchor.version]: owner.marker,
-      [anchor.ownerMarker]: owner.marker,
-    };
-
-    const stamp = sql`(select ${col(anchor.table, anchor.admittedAt)} from ${anchor.table} where ${owner.exact(anchor.table, anchorIdentity)})`;
-    const stampMillis = clock.toMillis(stamp);
-
-    const validStamp: SQL = both(
-      yield* existsExact(anchor.table, anchorIdentity),
-      sql`${stamp} is not null`,
-      sql`${stampMillis} >= ${earliest}`,
-      sql`${stampMillis} <= ${clock.engineNowMillis}`,
-      sql`${stampMillis} <= ${8640000000000000 - chargeRetentionMillis}`,
-    );
-
-    yield* owner.finalUpdate(
-      anchor.table,
-      owner.exact(anchor.table, { ...anchorIdentity, [anchor.admittedAt]: null }),
-      {
-        [anchor.admittedAt]: clock.fromMillis(clock.engineNowMillis),
-      },
-      { rows: 1, postcondition: validStamp },
-    );
-    for (const identity of identities) {
-      const expected = {
-        ...identity,
-        [table.version]: owner.marker,
-        [table.ownerMarker]: owner.marker,
-      };
-
-      const postcondition = yield* existsExact(
-        table.table,
-        expected,
-        both(
-          sql`${clock.toMillis(sql`${col(table.table, table.admittedAt)}`)} = ${stampMillis}`,
-          sql`${clock.toMillis(sql`${col(table.table, table.retainUntil)}`)} = ${stampMillis} + ${chargeRetentionMillis}`,
-        ),
-      );
-
-      yield* owner.finalUpdate(
-        table.table,
-        owner.exact(table.table, {
-          ...expected,
-          [table.admittedAt]: null,
-          [table.retainUntil]: null,
-        }),
-        {
-          [table.admittedAt]: stamp,
-          [table.retainUntil]: clock.fromMillis(sql`${stampMillis} + ${chargeRetentionMillis}`),
-        },
-        { rows: 1, postcondition },
-      );
-    }
-    owner.postconditions.push(
-      sql`(select count(*) from ${table.table} where ${owner.exact(table.table, {
-        [table.moduleId]: ceremony.moduleId,
-        [table.flowId]: ceremony.flowId,
-        [table.ownerMarker]: owner.marker,
-      })}) = ${identities.length}`,
-    );
-  });
-
-  return {
-    chargeRetentionMillis,
-    chargeScopes,
-    lockAdmission,
-    admissionCondition,
-    guardAdmission,
-    readCharges,
-    guardChargeSet,
-    insertCharges,
-  };
-};