@yielded/auth 0.1.0-beta.1

package/src/drizzle/oauth-connected-model.ts

@@ -0,0 +1,347 @@
+import type { InferInsertModel, InferSelectModel, SQL, Table } from "drizzle-orm";
+
+import type { OAuthAccountRevision } from "../oauth/accountsModels";
+import type * as M from "../oauth/connectedModels";
+import type { AuthenticationRequirement } from "../sessions/models";
+import type { SubjectIdCodec } from "./model";
+import type {
+  OAuthAuthorityReadTable,
+  OAuthClock,
+  OAuthOwnershipMutation,
+  OAuthSubjectReadTable,
+  requiredOAuthTupleConstraints,
+} from "./oauth-model";
+
+type Column<T extends Table> = Extract<keyof T["_"]["columns"], string>;
+export type OAuthConnectedAction = M.OAuthConnectedActionChallenge["action"];
+
+export interface OAuthConnectedSubjectTable<S extends Table> extends OAuthSubjectReadTable<S> {
+  readonly decodeActionRequirement: (
+    row: InferSelectModel<S>,
+    action: OAuthConnectedAction,
+  ) => AuthenticationRequirement;
+}
+
+/** All mapped order columns use exact SQL integer comparison through 2^53-1.
+ * These codecs bridge driver representations, not alternative ordering rules. */
+export interface OAuthConnectedOrderCodec {
+  readonly encode: (order: number) => unknown;
+  readonly decode: (value: unknown) => number;
+}
+
+export interface OAuthConnectedFlowTable<F extends Table, N> {
+  readonly table: F;
+  readonly moduleId: Column<F>;
+  readonly flowId: Column<F>;
+  readonly commandId: Column<F>;
+  readonly subjectId: Column<F>;
+  readonly clientKey: Column<F>;
+  readonly cohortKey: Column<F>;
+  readonly state: Column<F>;
+  readonly version: Column<F>;
+  readonly stateDigest: Column<F>;
+  readonly snapshot: Column<F>;
+  readonly claimId: Column<F>;
+  readonly claimDigest: Column<F>;
+  readonly claimOrder: Column<F>;
+  readonly claimedAt: Column<F>;
+  readonly claimExpiresAt: Column<F>;
+  readonly expiresAt: Column<F>;
+  readonly retentionUntil: Column<F>;
+  /** None before claim, Unresolved after claim, Resolved only after definite
+   * cancellation or atomic transfer to a grant/job. Never reset by cleanup. */
+  readonly work: Column<F>;
+  /** Exact sealed quarantine when no correctly sealed revocation job is available. */
+  readonly custody: Column<F>;
+  readonly encodeInsert: (input: {
+    readonly flow: M.OAuthConnectedPendingFlow;
+    readonly subjectId: N;
+  }) => InferInsertModel<F>;
+}
+
+export interface OAuthConnectedGrantTable<G extends Table, N> {
+  readonly table: G;
+  readonly moduleId: Column<G>;
+  readonly grantId: Column<G>;
+  readonly subjectId: Column<G>;
+  readonly identityKey: Column<G>;
+  /** Nullable unique active slot; historical/disconnected records use null. */
+  readonly activeIdentityKey: Column<G>;
+  readonly clientKey: Column<G>;
+  readonly cohortKey: Column<G>;
+  readonly profileKey: Column<G>;
+  readonly grantVersion: Column<G>;
+  readonly tokenVersion: Column<G>;
+  readonly cohortGeneration: Column<G>;
+  readonly state: Column<G>;
+  readonly version: Column<G>;
+  readonly context: Column<G>;
+  readonly sealed: Column<G>;
+  /** Canonical OAuthConnectedSummary only: list never loads token envelopes. */
+  readonly summary: Column<G>;
+  readonly revocationJobId: Column<G>;
+  readonly refreshWork: Column<G>;
+  readonly refreshClaim: Column<G>;
+  readonly refreshClaimExpiresAt: Column<G>;
+  readonly retentionUntil: Column<G>;
+  readonly encodeInsert: (input: {
+    readonly grant: M.OAuthConnectedStoredGrant;
+    readonly subjectId: N;
+  }) => InferInsertModel<G>;
+}
+
+/** Also stores a permanent provider/issuer scope anchor. clientKey must fit 52
+ * ASCII characters. Empty clientRegistrationId is reserved for that anchor;
+ * actual profile registrations are nonempty. Scope counter stays zero. */
+export interface OAuthConnectedClientRegistrationTable<C extends Table> {
+  readonly table: C;
+  readonly clientKey: Column<C>;
+  readonly provider: Column<C>;
+  readonly issuer: Column<C>;
+  readonly clientRegistrationId: Column<C>;
+  readonly counter: Column<C>;
+  readonly version: Column<C>;
+  readonly encodeInsert: (configuration: M.OAuthConnectedConfiguration) => InferInsertModel<C>;
+}
+
+/** Remote authority: no local-subject column or subject-scoped key. Retain this
+ * anchor/cutoff when a legitimately released tuple gains a different local owner. */
+export interface OAuthConnectedCohortTable<C extends Table> {
+  readonly table: C;
+  readonly cohortKey: Column<C>;
+  readonly clientKey: Column<C>;
+  readonly identityKey: Column<C>;
+  readonly generation: Column<C>;
+  readonly cutoff: Column<C>;
+  readonly state: Column<C>;
+  readonly version: Column<C>;
+  readonly encodeInsert: (input: {
+    readonly clientKey: string;
+    readonly identityKey: string;
+  }) => InferInsertModel<C>;
+}
+
+export interface OAuthConnectedAdmissionTable<A extends Table, N> {
+  readonly table: A;
+  readonly admissionId: Column<A>;
+  readonly moduleId: Column<A>;
+  readonly grantId: Column<A>;
+  readonly subjectId: Column<A>;
+  readonly identityKey: Column<A>;
+  readonly clientKey: Column<A>;
+  readonly cohortKey: Column<A>;
+  readonly snapshot: Column<A>;
+  readonly admittedAt: Column<A>;
+  readonly expiresAt: Column<A>;
+  readonly version: Column<A>;
+  readonly encodeInsert: (input: {
+    readonly admissionId: string;
+    readonly grant: M.OAuthConnectedStoredGrant;
+    readonly authorization: M.OAuthConnectedUseAuthorization;
+    readonly subjectId: N;
+  }) => InferInsertModel<A>;
+}
+
+export interface OAuthConnectedCommandTable<C extends Table, N> {
+  readonly table: C;
+  readonly moduleId: Column<C>;
+  readonly commandId: Column<C>;
+  readonly subjectId: Column<C>;
+  readonly grantId: Column<C>;
+  readonly intent: Column<C>;
+  readonly decision: Column<C>;
+  readonly retentionUntil: Column<C>;
+  readonly version: Column<C>;
+  readonly encodeInsert: (input: {
+    readonly commandId: string;
+    readonly grant: M.OAuthConnectedDisconnectGrant;
+    readonly subjectId: N;
+  }) => InferInsertModel<C>;
+}
+
+export interface OAuthConnectedRevocationJobTable<J extends Table, N> {
+  readonly table: J;
+  readonly jobId: Column<J>;
+  readonly moduleId: Column<J>;
+  readonly subjectId: Column<J>;
+  readonly identityKey: Column<J>;
+  readonly clientKey: Column<J>;
+  readonly cohortKey: Column<J>;
+  readonly grantId: Column<J>;
+  readonly snapshot: Column<J>;
+  readonly state: Column<J>;
+  readonly claimId: Column<J>;
+  readonly claimedAt: Column<J>;
+  readonly claimExpiresAt: Column<J>;
+  readonly retentionUntil: Column<J>;
+  readonly version: Column<J>;
+  readonly encodeInsert: (input: {
+    readonly job: M.OAuthConnectedRevocationJob;
+    readonly subjectId: N;
+  }) => InferInsertModel<J>;
+}
+
+export type OAuthConnectedPolicyInput<N> = {
+  readonly subjectId: N;
+  readonly revision: OAuthAccountRevision;
+} & (
+  | {
+      readonly kind: "action";
+      readonly operation: "issue" | "claim" | "settle" | "disconnect";
+      readonly authorization: M.OAuthConnectedActionAuthorization;
+      readonly configuration: M.OAuthConnectedConfiguration;
+      readonly grant?: M.OAuthConnectedTokenContext;
+    }
+  | {
+      readonly kind: "metadata" | "use";
+      readonly authorization: M.OAuthConnectedUseAuthorization;
+      readonly grant?: M.OAuthConnectedTokenContext;
+    }
+);
+
+export interface OAuthConnectedPolicyGuardTable<T extends Table, N> {
+  readonly table: T;
+  readonly orderBy: Column<T>;
+  readonly condition: (input: OAuthConnectedPolicyInput<N>) => SQL;
+}
+
+export interface OAuthConnectedPolicyGuard<N> {
+  readonly table: Table;
+  readonly orderBy: string;
+  readonly condition: (input: OAuthConnectedPolicyInput<N>) => SQL;
+}
+
+export const oauthConnectedPolicyGuard = <T extends Table, N>(
+  input: OAuthConnectedPolicyGuardTable<T, N>,
+): OAuthConnectedPolicyGuard<N> =>
+  Object.freeze({
+    table: input.table,
+    orderBy: input.orderBy,
+    condition: input.condition,
+  });
+
+export interface OAuthConnectedSqlPolicy<N> {
+  /** Up to 32 scopes, each selecting 1..64 stable rows in global lock order.
+   * Omit only when subject/shared authority locks already serialize every mutable
+   * policy dependency or policy is immutable. All writers follow that order. */
+  readonly guards?: ReadonlyArray<OAuthConnectedPolicyGuard<N>>;
+  /** Recheck exact policy revision, purpose, optional grant/profile restrictions
+   * and current profile/permissions; joins and absence assumptions are authority.
+   * The engine checks this before and after every owner/application write. */
+  readonly condition: (input: OAuthConnectedPolicyInput<N>) => SQL;
+}
+
+export const requiredOAuthConnectedConstraints = {
+  flow: "unique(connectedFlow.moduleId,connectedFlow.flowId)",
+  flowCommand: "unique(connectedFlow.moduleId,connectedFlow.commandId)",
+  stateDigest: "unique(connectedFlow.stateDigest)",
+  client: "unique(connectedClient.clientKey)",
+  cohort: "unique(connectedCohort.cohortKey)",
+  grant: "unique(connectedGrant.moduleId,connectedGrant.grantId)",
+  grantIdentity:
+    "unique(connectedGrant.moduleId,connectedGrant.subjectId,connectedGrant.profileKey,connectedGrant.activeIdentityKey)",
+  admission: "unique(connectedAdmission.admissionId)",
+  command: "unique(connectedCommand.moduleId,connectedCommand.commandId)",
+} as const;
+
+export const requiredOAuthConnectedRevocationConstraints = {
+  job: "unique(connectedRevocation.jobId)",
+} as const;
+
+/** Existing ownership only; workers never allocate or acquire a tuple. */
+export type OAuthConnectedOwnershipRead<T extends Table, O extends Table, N> =
+  | {
+      readonly mode: "integrated";
+      readonly tuple: Omit<OAuthOwnershipMutation<T, O, N>["tuple"], "encodeInsert">;
+    }
+  | {
+      readonly mode: "separate";
+      readonly tuple: Omit<OAuthOwnershipMutation<T, O, N>["tuple"], "encodeInsert">;
+      readonly external: Omit<
+        Extract<OAuthOwnershipMutation<T, O, N>, { readonly mode: "separate" }>["external"],
+        "encodeInsert"
+      >;
+    };
+
+export interface OAuthConnectedAuthorityMapping<
+  T extends Table,
+  O extends Table,
+  F extends Table,
+  G extends Table,
+  C extends Table,
+  H extends Table,
+  N,
+> {
+  readonly ownership: OAuthConnectedOwnershipRead<T, O, N>;
+  readonly subjectId: SubjectIdCodec<N>;
+  readonly flow: Omit<OAuthConnectedFlowTable<F, N>, "encodeInsert">;
+  readonly grant: Omit<OAuthConnectedGrantTable<G, N>, "encodeInsert">;
+  readonly client: Omit<OAuthConnectedClientRegistrationTable<C>, "encodeInsert">;
+  readonly cohort: Omit<OAuthConnectedCohortTable<H>, "encodeInsert">;
+  readonly clock: OAuthClock;
+  readonly order: OAuthConnectedOrderCodec;
+  readonly tupleConstraints: typeof requiredOAuthTupleConstraints;
+  /** Safe metadata retention, never an expiry/quiescence proof for unresolved work. */
+  readonly retentionMillis: number;
+}
+
+export interface OAuthConnectedMapping<
+  S extends Table,
+  AC extends Table,
+  T extends Table,
+  O extends Table,
+  F extends Table,
+  G extends Table,
+  C extends Table,
+  H extends Table,
+  A extends Table,
+  D extends Table,
+  N,
+  J extends Table = never,
+> extends OAuthConnectedAuthorityMapping<T, O, F, G, C, H, N> {
+  readonly ownership: OAuthOwnershipMutation<T, O, N>;
+  readonly flow: OAuthConnectedFlowTable<F, N>;
+  readonly grant: OAuthConnectedGrantTable<G, N>;
+  readonly client: OAuthConnectedClientRegistrationTable<C>;
+  readonly cohort: OAuthConnectedCohortTable<H>;
+  readonly subject: OAuthConnectedSubjectTable<S>;
+  readonly authority: OAuthAuthorityReadTable<AC>;
+  readonly admission: OAuthConnectedAdmissionTable<A, N>;
+  readonly command: OAuthConnectedCommandTable<D, N>;
+  readonly policy: OAuthConnectedSqlPolicy<N>;
+  readonly constraints: typeof requiredOAuthConnectedConstraints;
+  readonly revocation:
+    | { readonly mode: "unsupported" }
+    | {
+        readonly mode: "cohort";
+        readonly job: OAuthConnectedRevocationJobTable<J, N>;
+        readonly constraints: typeof requiredOAuthConnectedRevocationConstraints;
+      };
+  /** Without an authoritative same-owner predicate, conservatively retain Owned.
+   * Include login/other installed references; never filter away former-subject
+   * work. This pure SQL constructor supports both bound values and correlated
+   * column expressions with identical semantics; it performs no I/O.
+   * Compare through the reference table's typed columns (for example, eq) so
+   * native values use their encoders. Back the same-owner lookup with an index:
+   * discovery applies this predicate before its candidate limit.
+   * Connected references are checked separately. */
+  readonly externalReference?: (
+    input:
+      | { readonly identityKey: string; readonly subjectId: N }
+      | { readonly identityKey: SQL; readonly subjectId: SQL },
+  ) => SQL;
+}
+
+export interface OAuthConnectedRevocationMapping<
+  T extends Table,
+  O extends Table,
+  F extends Table,
+  G extends Table,
+  C extends Table,
+  H extends Table,
+  J extends Table,
+  N,
+> extends OAuthConnectedAuthorityMapping<T, O, F, G, C, H, N> {
+  readonly job: Omit<OAuthConnectedRevocationJobTable<J, N>, "encodeInsert">;
+  readonly constraints: typeof requiredOAuthConnectedRevocationConstraints;
+}

package/src/drizzle/oauth-connected-reference.ts

@@ -0,0 +1,112 @@
+import { eq, is, sql, type SQL, type Table } from "drizzle-orm";
+import { MySqlTable } from "drizzle-orm/mysql-core/table";
+import { PgTable } from "drizzle-orm/pg-core/table";
+
+import type { OAuthConnectedMapping } from "./oauth-connected-model";
+import { scopeKey, type Mapping } from "./oauth-connected-state";
+import { oauthReferenceGuardTable, type OAuthReferenceGuardDescriptor } from "./oauth-model";
+import { both, col, equal } from "./oauth-owner";
+import { captureOAuthMapping } from "./oauth-state";
+
+const exactText = (table: Table, key: string, value: string) => {
+  const column = col(table, key),
+    bound = sql.param(value, column);
+
+  return is(table, MySqlTable)
+    ? sql`binary ${column} = binary ${bound}`
+    : is(table, PgTable)
+      ? sql`convert_to(cast(${column} as text),'UTF8') = convert_to(cast(${bound} as text),'UTF8')`
+      : sql`cast(${column} as blob) = cast(${bound} as blob)`;
+};
+
+/** Compose Accounts.Unlink with this connected authority. The stable scope lock
+ * serializes unknown claims across every client registration for an issuer. */
+export const oauthConnectedOwnershipReferences = <
+  S extends Table,
+  AC extends Table,
+  T extends Table,
+  O extends Table,
+  F extends Table,
+  G extends Table,
+  C extends Table,
+  H extends Table,
+  A extends Table,
+  D extends Table,
+  N,
+  J extends Table,
+>(
+  original: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, A, D, N, J>,
+): {
+  readonly connectedReferenceGuards: ReadonlyArray<OAuthReferenceGuardDescriptor<N>>;
+  readonly connectedReference: (input: {
+    readonly identityKey: string;
+    readonly subjectId: N;
+  }) => SQL;
+} => {
+  const mapping = captureOAuthMapping(original),
+    c = mapping.client;
+
+  return Object.freeze({
+    connectedReferenceGuards: [
+      oauthReferenceGuardTable<C, N>({
+        table: c.table,
+        orderBy: c.clientKey,
+        condition: (input) =>
+          both(
+            equal(c.table, {
+              [c.clientKey]: scopeKey(input.identity.provider, input.identity.issuer),
+              [c.counter]: mapping.order.encode(0),
+            }),
+            exactText(c.table, c.provider, input.identity.provider),
+            exactText(c.table, c.issuer, input.identity.issuer),
+            exactText(c.table, c.clientRegistrationId, ""),
+          ),
+      }),
+    ],
+    connectedReference: (input) => connectedReferenceCondition(mapping, input.identityKey),
+  });
+};
+
+export const connectedReferenceCondition = (
+  mapping: Mapping,
+  identityKey: string | SQL,
+  knownIdentity?: { readonly provider: string | SQL; readonly issuer: string | SQL },
+) => {
+  const c = mapping.client,
+    t = mapping.ownership.tuple,
+    f = mapping.flow,
+    g = mapping.grant,
+    h = mapping.cohort,
+    a = mapping.admission,
+    j = mapping.revocation.mode === "cohort" ? mapping.revocation.job : undefined;
+
+  const tuple = equal(t.table, { [t.identityKey]: identityKey });
+  const knownFlow = sql`exists(select 1 from ${h.table} where ${col(h.table, h.cohortKey)} = ${col(f.table, f.cohortKey)} and ${col(h.table, h.identityKey)} = ${identityKey})`;
+
+  const unknownFlow =
+    knownIdentity === undefined
+      ? sql`${col(f.table, f.cohortKey)} is null and exists(select 1 from ${c.table} where ${col(c.table, c.clientKey)} = ${col(f.table, f.clientKey)} and exists(select 1 from ${t.table} where ${tuple} and ${col(c.table, c.provider)} = ${col(t.table, t.provider)} and ${col(c.table, c.issuer)} = ${col(t.table, t.issuer)}))`
+      : sql`${col(f.table, f.cohortKey)} is null and exists(select 1 from ${c.table} where ${col(c.table, c.clientKey)} = ${col(f.table, f.clientKey)} and ${col(c.table, c.provider)} = ${knownIdentity.provider} and ${col(c.table, c.issuer)} = ${knownIdentity.issuer})`;
+
+  const related = [f, g, h, ...(j === undefined ? [] : [j])];
+
+  return sql`(${sql.join(
+    [
+      sql`exists(select 1 from ${g.table} where ${eq(col(g.table, g.identityKey), identityKey)})`,
+      sql`exists(select 1 from ${a.table} where ${eq(col(a.table, a.identityKey), identityKey)})`,
+      sql`exists(select 1 from ${h.table} where ${both(eq(col(h.table, h.identityKey), identityKey), eq(col(h.table, h.state), "Blocked"))})`,
+      sql`exists(select 1 from ${f.table} where ${col(f.table, f.work)} = 'Unresolved' and (${knownFlow} or (${unknownFlow})))`,
+      ...(j === undefined
+        ? []
+        : [
+            sql`exists(select 1 from ${j.table} where ${eq(col(j.table, j.identityKey), identityKey)})`,
+          ]),
+      // A missing real client cannot turn erased unknown work into absence.
+      ...related.map(
+        (v) =>
+          sql`exists(select 1 from ${v.table} where not exists(select 1 from ${c.table} where ${col(c.table, c.clientKey)} = ${col(v.table, v.clientKey)}))`,
+      ),
+    ],
+    sql` or `,
+  )})`;
+};

package/src/drizzle/oauth-connected-settlement.ts

@@ -0,0 +1,226 @@
+import { ne, sql } from "drizzle-orm";
+import { Effect } from "effect";
+
+import * as M from "../oauth/connectedModels";
+import { snapshotOAuthSync } from "../oauth/signInSnapshot";
+import * as C from "./oauth-connected-custody";
+import * as F from "./oauth-connected-flow";
+import * as S from "./oauth-connected-state";
+import { both, col, equal, CurrentOAuthTransaction } from "./oauth-owner";
+import { invariant, sameIdentity } from "./oauth-state";
+
+export const validMetadata = (context: M.OAuthConnectedTokenContext, now: number) => {
+  const m = context.metadata,
+    p = context.configuration.profile;
+
+  return (
+    p.provider === context.identity.provider &&
+    context.configuration.provider === context.identity.provider &&
+    context.configuration.issuer === context.identity.issuer &&
+    m.obtainedAtMillis <= now &&
+    m.useUntilMillis > m.obtainedAtMillis &&
+    m.useUntilMillis <= m.obtainedAtMillis + p.maximumAccessLifetimeMillis &&
+    (m.accessExpiresAtMillis === undefined || m.useUntilMillis <= m.accessExpiresAtMillis) &&
+    m.scopes.every((v) => p.scopes.includes(v)) &&
+    m.resources.every((v) => p.resources.includes(v)) &&
+    new Set(m.scopes).size === m.scopes.length &&
+    new Set(m.resources).size === m.resources.length &&
+    (m.refreshUseUntilMillis === undefined ||
+      (p.retention === "access-and-refresh" &&
+        p.maximumRefreshLifetimeMillis !== undefined &&
+        m.refreshUseUntilMillis > m.obtainedAtMillis &&
+        m.refreshUseUntilMillis <= m.obtainedAtMillis + p.maximumRefreshLifetimeMillis &&
+        (m.refreshExpiresAtMillis === undefined ||
+          m.refreshUseUntilMillis <= m.refreshExpiresAtMillis)))
+  );
+};
+
+export const settle = Effect.fn("oauthConnected.settle")(function* (
+  mapping: S.Mapping,
+  input: F.Input<"settle">,
+) {
+  const owner = yield* CurrentOAuthTransaction;
+
+  const c = input.claim.flow.context,
+    out = input.outcome;
+
+  const found = yield* S.current(mapping, c.revision.subjectId);
+
+  const authorized =
+    found !== undefined &&
+    (yield* S.action(mapping, found, input.authorization, "settle", F.expected(input.claim.flow)));
+
+  const cl = yield* S.client(mapping, S.configuration(input.claim.flow), false);
+
+  if (cl === undefined) return { _tag: "Rejected" } as const;
+  if (out._tag !== "Verified" && out._tag !== "Quarantined") {
+    const claimed = yield* F.exact(mapping, input.claim);
+
+    if (claimed === undefined) return { _tag: "Rejected" } as const;
+    yield* F.terminal(
+      mapping,
+      input.claim,
+      out._tag,
+      out._tag === "Cancelled" ? "Resolved" : "Unresolved",
+    );
+
+    return { _tag: out._tag } as
+      | { readonly _tag: "Cancelled" }
+      | { readonly _tag: "Rejected" }
+      | { readonly _tag: "Conflict" }
+      | { readonly _tag: "Ambiguous" };
+  }
+
+  const grant = snapshotOAuthSync(M.OAuthConnectedStoredGrant, out.grant),
+    token = grant.context;
+
+  invariant(
+    token.moduleId === c.moduleId &&
+      token.subjectId === c.revision.subjectId &&
+      token.grantId === c.grantId &&
+      token.identity.provider === c.provider &&
+      token.identity.issuer === c.issuer &&
+      S.clientKey(token.configuration) === cl.id &&
+      S.tokenContextStorage.encode({
+        ...token,
+        configuration: S.configuration(input.claim.flow),
+      }) === S.tokenContextStorage.encode(token),
+  );
+  const native = yield* mapping.subjectId.toNative(c.revision.subjectId);
+
+  const tuple = yield* F.readTuple(mapping.ownership, token.identity),
+    t = mapping.ownership.tuple;
+
+  if (
+    tuple.row[t.state] === "Reserved" ||
+    (tuple.row[t.state] === "Owned" && !mapping.subjectId.equals(tuple.row[t.subjectId], native))
+  ) {
+    const claimed = yield* F.exact(mapping, input.claim);
+
+    if (claimed !== undefined) yield* F.terminal(mapping, input.claim, "Conflict", "Unresolved");
+
+    return { _tag: "Conflict" } as const;
+  }
+  const co = yield* S.cohort(mapping, cl.id, tuple.key, true);
+  const original = yield* S.readGrant(mapping, c.moduleId, c.grantId);
+  const g = mapping.grant;
+
+  const other = yield* owner.read(
+    g.table,
+    both(
+      equal(g.table, {
+        [g.moduleId]: c.moduleId,
+        [g.subjectId]: native,
+        [g.profileKey]: c.profile.key,
+        [g.activeIdentityKey]: tuple.key,
+      }),
+      ne(col(g.table, g.grantId), c.grantId),
+    ),
+    { limit: 1 },
+  );
+
+  const claimed = yield* F.exact(mapping, input.claim);
+
+  if (claimed === undefined) return { _tag: "Rejected" } as const;
+  invariant(
+    validMetadata(token, claimed.now) &&
+      token.metadata.obtainedAtMillis >= input.claim.claimedAtMillis,
+  );
+  const reconnect = c.reconnect;
+
+  const targetOkay =
+    reconnect === undefined
+      ? original === undefined
+      : original !== undefined &&
+        F.sameTarget(reconnect, original.context) &&
+        sameIdentity(reconnect.identity, token.identity) &&
+        original.row[g.refreshWork] !== "Unresolved";
+
+  const previousSafe = yield* C.noFormerOwner(mapping, tuple.key, cl.id, native);
+
+  const active =
+    out._tag === "Verified" &&
+    authorized &&
+    claimed.active &&
+    c.profile.issuance === "active" &&
+    token.metadata.useUntilMillis > claimed.now &&
+    !co.blocked &&
+    co.generation === token.cohortGeneration &&
+    S.orderNumber(input.claim.order) > co.cutoff &&
+    targetOkay &&
+    other.rows.length === 0 &&
+    previousSafe;
+
+  if (!active) {
+    // Foreign historical custody never authorizes a new remote operation.
+    if (!previousSafe) {
+      yield* F.terminal(mapping, input.claim, "Conflict", "Unresolved");
+
+      return { _tag: "Conflict" } as const;
+    }
+    if (tuple.row[t.state] === "Unowned")
+      yield* F.acquireTuple(mapping.ownership, token.identity, tuple.key, S.nativeCopy(native));
+    yield* C.fence(mapping, cl, co);
+    if (out.cleanup !== undefined) {
+      yield* C.storeJob(mapping, out.cleanup, token, native, claimed.now);
+      yield* F.terminal(mapping, input.claim, "Quarantined", "Resolved", { cohort: co.id });
+    } else
+      yield* F.terminal(mapping, input.claim, "Quarantined", "Unresolved", {
+        cohort: co.id,
+        sealed: grant,
+      });
+
+    return { _tag: targetOkay && other.rows.length === 0 ? "Rejected" : "Conflict" } as
+      | { readonly _tag: "Rejected" }
+      | { readonly _tag: "Conflict" };
+  }
+  if (tuple.row[t.state] === "Unowned")
+    yield* F.acquireTuple(mapping.ownership, token.identity, tuple.key, S.nativeCopy(native));
+
+  const values = {
+    ...g.encodeInsert({
+      grant: snapshotOAuthSync(M.OAuthConnectedStoredGrant, grant),
+      subjectId: S.nativeCopy(native),
+    }),
+    [g.moduleId]: c.moduleId,
+    [g.grantId]: c.grantId,
+    [g.subjectId]: native,
+    [g.identityKey]: tuple.key,
+    [g.activeIdentityKey]: tuple.key,
+    [g.clientKey]: cl.id,
+    [g.cohortKey]: co.id,
+    [g.profileKey]: c.profile.key,
+    [g.grantVersion]: token.grantVersion,
+    [g.tokenVersion]: token.tokenVersion,
+    [g.cohortGeneration]: token.cohortGeneration,
+    [g.state]: "Active",
+    [g.version]: owner.marker,
+    [g.context]: S.tokenContextStorage.encode(token),
+    [g.sealed]: S.sealedStorage.encode(grant.sealed),
+    [g.summary]: S.summaryStorage.encode(C.summary(token)),
+    [g.revocationJobId]: null,
+    [g.refreshWork]: "None",
+    [g.refreshClaim]: null,
+    [g.refreshClaimExpiresAt]: null,
+    [g.retentionUntil]: mapping.clock.encodeInstant(
+      S.retainedUntil(
+        mapping,
+        Math.max(
+          claimed.now,
+          token.metadata.useUntilMillis,
+          token.metadata.refreshUseUntilMillis ?? 0,
+        ),
+      ),
+    ),
+  };
+
+  if (original === undefined) {
+    yield* owner.insert(g.table, values, { [g.moduleId]: c.moduleId, [g.grantId]: c.grantId });
+  } else yield* owner.update(g.table, { [g.moduleId]: c.moduleId, [g.grantId]: c.grantId }, values);
+  yield* F.terminal(mapping, input.claim, "Connected", "Resolved", { cohort: co.id });
+  owner.postconditions.push(
+    sql`${mapping.clock.engineNowMillis} >= ${claimed.now} and ${mapping.clock.engineNowMillis} < ${Math.min(input.claim.claimExpiresAtMillis, token.metadata.useUntilMillis)}`,
+  );
+
+  return { _tag: "Connected", grant } as const;
+});