@yielded/auth-persistence-drizzle 0.1.0-beta.22 → 0.1.0-beta.24

package/src/drizzle/oauth-connected-maintenance.ts

@@ -1,346 +0,0 @@
-import type * as M from "@yielded/auth/OAuth";
-import {
-  OAuthConnectedRevocationClaim,
-  type OAuthConnectedRevocations,
-  snapshotOAuthSync,
-} from "@yielded/auth/OAuth";
-import { asc, eq, lte, sql } from "drizzle-orm";
-import { Effect } from "effect";
-
-import { collect, discover } from "./oauth-connected-collection";
-import * as C from "./oauth-connected-custody";
-import * as F from "./oauth-connected-flow";
-import * as S from "./oauth-connected-state";
-import { both, col, equal, CurrentOAuthTransaction } from "./oauth-owner";
-import { invariant, storage } from "./oauth-state";
-
-type WorkerInput<K extends keyof OAuthConnectedRevocations["Service"]> = Parameters<
-  OAuthConnectedRevocations["Service"][K]
->[0];
-const revocationClaimStorage = storage(OAuthConnectedRevocationClaim);
-
-const jobLocks = Effect.fn("oauthConnected.jobLocks")(function* (
-  mapping: S.Revocations,
-  job: M.OAuthConnectedRevocationJob,
-) {
-  const owner = yield* CurrentOAuthTransaction;
-
-  const token = job.context.token,
-    client = yield* S.client(mapping, token.configuration, false);
-
-  if (client === undefined) return undefined;
-
-  const tuple = yield* F.inspectTuple(mapping, token.identity),
-    t = mapping.ownership.tuple;
-
-  const native = yield* mapping.subjectId.toNative(token.subjectId);
-
-  if (tuple.row?.[t.state] !== "Owned" || !mapping.subjectId.equals(tuple.row[t.subjectId], native))
-    return undefined;
-  const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);
-
-  invariant(cohort.row !== undefined);
-
-  const j = mapping.job,
-    read = yield* owner.read(j.table, equal(j.table, { [j.jobId]: job.context.jobId }), {
-      limit: 1,
-    }),
-    row = read.rows[0];
-
-  if (row === undefined) return undefined;
-  invariant(row[j.state] === "Confirmed" || cohort.blocked);
-  invariant(
-    row[j.snapshot] === S.jobStorage.encode(job) &&
-      row[j.moduleId] === token.moduleId &&
-      mapping.subjectId.equals(native, row[j.subjectId]) &&
-      row[j.identityKey] === tuple.key &&
-      row[j.clientKey] === client.id &&
-      row[j.cohortKey] === cohort.id &&
-      row[j.grantId] === token.grantId &&
-      ["Pending", "Claimed", "Unknown", "Confirmed"].includes(row[j.state]),
-  );
-
-  return { client, cohort, row };
-});
-
-export const claimRevocation = Effect.fn("oauthConnected.claimRevocation")(function* (
-  mapping: S.Revocations,
-  input: WorkerInput<"claim">,
-) {
-  const owner = yield* CurrentOAuthTransaction;
-
-  invariant(
-    Number.isSafeInteger(input.lifetimeMillis) &&
-      input.lifetimeMillis >= 1000 &&
-      input.lifetimeMillis <= 120000,
-  );
-  const j = mapping.job;
-
-  const candidate = yield* owner.read(
-    j.table,
-    equal(j.table, { [j.moduleId]: input.moduleId, [j.state]: "Pending" }),
-    { limit: 1, takeOnly: true, lock: false, observe: false, orderBy: asc(col(j.table, j.jobId)) },
-  );
-
-  const row = candidate.rows[0];
-
-  if (row === undefined) return { _tag: "Empty" } as const;
-  const job = S.jobStorage.decode(row[j.snapshot]);
-  const locks = yield* jobLocks(mapping, job);
-
-  if (locks === undefined || locks.row[j.state] !== "Pending") return { _tag: "Empty" } as const;
-  invariant(
-    locks.row[j.claimId] === null &&
-      locks.row[j.claimedAt] === null &&
-      locks.row[j.claimExpiresAt] === null,
-  );
-
-  const now = yield* owner.now(mapping.clock),
-    expires = now + input.lifetimeMillis;
-
-  invariant(Number.isSafeInteger(expires));
-
-  const claim = snapshotOAuthSync(OAuthConnectedRevocationClaim, {
-    job,
-    claimId: input.claimId,
-    claimedAtMillis: now,
-    claimExpiresAtMillis: expires,
-  });
-
-  yield* owner.update(
-    j.table,
-    { [j.jobId]: job.context.jobId, [j.state]: "Pending" },
-    {
-      [j.state]: "Claimed",
-      [j.claimId]: input.claimId,
-      [j.claimedAt]: mapping.clock.encodeInstant(now),
-      [j.claimExpiresAt]: mapping.clock.encodeInstant(expires),
-      [j.retentionUntil]: mapping.clock.encodeInstant(S.retainedUntil(mapping, expires)),
-      [j.version]: owner.marker,
-    },
-  );
-  owner.postconditions.push(
-    sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${expires}`,
-  );
-
-  return { _tag: "Claimed", claim } as const;
-});
-
-export const settleRevocation = Effect.fn("oauthConnected.settleRevocation")(function* (
-  mapping: S.Revocations,
-  input: WorkerInput<"settle">,
-) {
-  const owner = yield* CurrentOAuthTransaction;
-  const locks = yield* jobLocks(mapping, input.claim.job);
-
-  if (locks === undefined) return { settled: false };
-
-  const j = mapping.job,
-    row = locks.row;
-
-  if (row[j.state] !== "Claimed" || row[j.claimId] !== input.claim.claimId)
-    return { settled: false };
-  invariant(
-    revocationClaimStorage.encode({
-      job: input.claim.job,
-      claimId: row[j.claimId],
-      claimedAtMillis: mapping.clock.decodeInstant(row[j.claimedAt]),
-      claimExpiresAtMillis: mapping.clock.decodeInstant(row[j.claimExpiresAt]),
-    }) === revocationClaimStorage.encode(input.claim),
-  );
-  const now = yield* owner.now(mapping.clock);
-
-  invariant(now >= input.claim.claimedAtMillis);
-  const confirmed = input.outcome === "Confirmed" && now < input.claim.claimExpiresAtMillis;
-
-  yield* owner.update(
-    j.table,
-    {
-      [j.jobId]: input.claim.job.context.jobId,
-      [j.state]: "Claimed",
-      [j.claimId]: input.claim.claimId,
-    },
-    { [j.state]: confirmed ? "Confirmed" : "Unknown", [j.version]: owner.marker },
-  );
-  if (confirmed) {
-    owner.postconditions.push(
-      sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${input.claim.claimExpiresAtMillis}`,
-    );
-    yield* C.clear(mapping, locks.client, locks.cohort, input.claim.job.context.jobId);
-  }
-
-  return { settled: true };
-});
-
-/** Candidate discovery is not authority. Each conditional write re-reads its row
- * and engine time under the client/tuple/cohort order and retains a final guard. */
-export const cleanup = Effect.fn("oauthConnected.cleanup")(function* (
-  mapping: S.Mapping,
-  input: F.Input<"cleanup">,
-) {
-  const owner = yield* CurrentOAuthTransaction;
-
-  invariant(Number.isSafeInteger(input.limit) && input.limit >= 1 && input.limit <= 1000);
-
-  const f = mapping.flow,
-    a = mapping.admission,
-    d = mapping.command;
-
-  let terminalized = 0,
-    removed = 0,
-    visited = 0,
-    hasMore = false;
-
-  const at = yield* owner.now(mapping.clock);
-
-  const candidates = yield* owner.read(
-    f.table,
-    both(
-      eq(col(f.table, f.moduleId), input.moduleId),
-      sql`((${col(f.table, f.state)} in ('Prepared','Pending') and ${col(f.table, f.expiresAt)} <= ${mapping.clock.encodeInstant(at)}) or (${col(f.table, f.state)} = 'Claimed' and ${col(f.table, f.claimExpiresAt)} <= ${mapping.clock.encodeInstant(at)}) or (${col(f.table, f.state)} not in ('Prepared','Pending','Claimed') and ${col(f.table, f.work)} <> 'Unresolved' and ${col(f.table, f.retentionUntil)} <= ${mapping.clock.encodeInstant(at)}))`,
-    ),
-    {
-      limit: input.limit + 1,
-      takeOnly: true,
-      observe: false,
-      lock: false,
-      orderBy: asc(col(f.table, f.flowId)),
-    },
-  );
-
-  const collectionCandidates = yield* discover(mapping, input.moduleId, input.limit);
-
-  const g = mapping.grant,
-    j = S.jobTable(mapping),
-    h = mapping.cohort;
-
-  yield* S.prelockClients(
-    mapping,
-    [
-      ...candidates.rows.slice(0, input.limit).map((row) => row[f.clientKey]),
-      ...collectionCandidates.jobs.slice(0, input.limit).map((row) => row[j!.clientKey]),
-      ...collectionCandidates.grants.slice(0, input.limit).map((row) => row[g.clientKey]),
-      ...collectionCandidates.cohorts.slice(0, input.limit).map((row) => row[h.clientKey]),
-    ],
-    collectionCandidates.tuples.slice(0, input.limit).map((row) => ({
-      provider: row[mapping.ownership.tuple.provider],
-      issuer: row[mapping.ownership.tuple.issuer],
-    })),
-  );
-  hasMore = candidates.rows.length > input.limit;
-  for (const candidate of candidates.rows.slice(0, input.limit)) {
-    visited++;
-    // A terminal ledger retains client key but may erase the decryptable browser snapshot.
-    const heldClient = yield* S.lockClientById(mapping, candidate[f.clientKey]);
-
-    const read = yield* owner.read(
-        f.table,
-        equal(f.table, { [f.moduleId]: input.moduleId, [f.flowId]: candidate[f.flowId] }),
-        { limit: 1 },
-      ),
-      row = read.rows[0];
-
-    if (row === undefined) continue;
-    invariant(row[f.clientKey] === heldClient.id);
-
-    const now = yield* owner.now(mapping.clock),
-      state = row[f.state];
-
-    const expires = mapping.clock.decodeInstant(
-      state === "Claimed" ? row[f.claimExpiresAt] : row[f.expiresAt],
-    );
-
-    if ((state === "Prepared" || state === "Pending" || state === "Claimed") && now >= expires) {
-      yield* owner.update(
-        f.table,
-        { [f.moduleId]: input.moduleId, [f.flowId]: row[f.flowId], [f.version]: row[f.version] },
-        {
-          [f.state]: state === "Claimed" ? "Ambiguous" : "Expired",
-          [f.snapshot]: null,
-          [f.version]: owner.marker,
-        },
-      );
-      owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${expires}`);
-      terminalized++;
-    } else if (
-      state !== "Prepared" &&
-      state !== "Pending" &&
-      state !== "Claimed" &&
-      row[f.work] !== "Unresolved" &&
-      now >= mapping.clock.decodeInstant(row[f.retentionUntil])
-    ) {
-      yield* owner.remove(f.table, {
-        [f.moduleId]: input.moduleId,
-        [f.flowId]: row[f.flowId],
-        [f.version]: row[f.version],
-      });
-      owner.postconditions.push(
-        sql`${mapping.clock.engineNowMillis} >= ${mapping.clock.decodeInstant(row[f.retentionUntil])}`,
-      );
-      removed++;
-    }
-  }
-  // Expired admission and command metadata have no external-operation obligation.
-  for (const table of [a, d]) {
-    if (visited >= input.limit) {
-      hasMore = true;
-      break;
-    }
-
-    const deadline = "expiresAt" in table ? table.expiresAt : table.retentionUntil,
-      key = "admissionId" in table ? table.admissionId : table.commandId;
-
-    const rows = yield* owner.read(
-      table.table,
-      both(
-        eq(col(table.table, table.moduleId), input.moduleId),
-        lte(col(table.table, deadline), mapping.clock.encodeInstant(at)),
-      ),
-      {
-        limit: input.limit - visited + 1,
-        takeOnly: true,
-        observe: false,
-        lock: false,
-        orderBy: asc(col(table.table, key)),
-      },
-    );
-
-    if (rows.rows.length > input.limit - visited) hasMore = true;
-    for (const candidate of rows.rows.slice(0, input.limit - visited)) {
-      visited++;
-
-      const read = yield* owner.read(
-          table.table,
-          equal(table.table, { [table.moduleId]: input.moduleId, [key]: candidate[key] }),
-          { limit: 1 },
-        ),
-        row = read.rows[0];
-
-      const now = yield* owner.now(mapping.clock);
-
-      if (row !== undefined && now >= mapping.clock.decodeInstant(row[deadline])) {
-        yield* owner.remove(table.table, {
-          [table.moduleId]: input.moduleId,
-          [key]: row[key],
-          [table.version]: row[table.version],
-        });
-        owner.postconditions.push(
-          sql`${mapping.clock.engineNowMillis} >= ${mapping.clock.decodeInstant(row[deadline])}`,
-        );
-        removed++;
-      }
-    }
-  }
-
-  const collection = yield* collect(
-    mapping,
-    input.moduleId,
-    input.limit - visited,
-    collectionCandidates,
-  );
-
-  removed += collection.removed;
-  hasMore ||= collection.hasMore;
-
-  return { terminalized, removed, hasMore };
-});

package/src/drizzle/oauth-connected-management.ts

@@ -1,365 +0,0 @@
-import * as M from "@yielded/auth/OAuth";
-import { snapshotOAuthSync } from "@yielded/auth/OAuth";
-import { asc, eq, gt, lte } from "drizzle-orm";
-import { Effect } from "effect";
-
-import * as A from "./oauth-connected-access";
-import * as C from "./oauth-connected-custody";
-import * as F from "./oauth-connected-flow";
-import * as S from "./oauth-connected-state";
-import { both, col, equal, CurrentOAuthTransaction } from "./oauth-owner";
-import { digest, invariant } from "./oauth-state";
-
-export const list = Effect.fn("oauthConnected.list")(function* (
-  mapping: S.Mapping,
-  input: F.Input<"list">,
-) {
-  const owner = yield* CurrentOAuthTransaction;
-  const found = yield* S.useAuthority(mapping, input.authorization, "metadata");
-
-  if (found === undefined) return { items: [] };
-  invariant(Number.isSafeInteger(input.limit) && input.limit >= 1 && input.limit <= 100);
-
-  const g = mapping.grant,
-    h = mapping.cohort,
-    j = S.jobTable(mapping);
-
-  const cursor = input.cursor === undefined ? undefined : M.OAuthGrantId.make(input.cursor);
-
-  const where = both(
-    equal(g.table, { [g.moduleId]: input.authorization.moduleId, [g.subjectId]: found.nativeId }),
-    cursor === undefined ? undefined : gt(col(g.table, g.grantId), cursor),
-    input.authorization.grantId === undefined
-      ? undefined
-      : eq(col(g.table, g.grantId), input.authorization.grantId),
-    input.authorization.profileKey === undefined
-      ? undefined
-      : eq(col(g.table, g.profileKey), input.authorization.profileKey),
-  );
-
-  const columns = [
-    g.moduleId,
-    g.grantId,
-    g.subjectId,
-    g.identityKey,
-    g.clientKey,
-    g.cohortKey,
-    g.cohortGeneration,
-    g.profileKey,
-    g.state,
-    g.summary,
-    g.revocationJobId,
-    g.version,
-  ];
-
-  const read = yield* owner.read(g.table, where, {
-    columns,
-    limit: input.limit + 1,
-    takeOnly: true,
-    observe: false,
-    lock: false,
-    orderBy: asc(col(g.table, g.grantId)),
-  });
-
-  const more = read.rows.length > input.limit,
-    rows = read.rows.slice(0, input.limit),
-    last = rows.at(-1)?.[g.grantId];
-
-  owner.observations.push({
-    table: g.table,
-    where: more ? both(where, lte(col(g.table, g.grantId), last)) : where,
-    rows,
-  });
-  const items: Array<typeof M.OAuthConnectedSummary.Type> = [];
-
-  for (const row of rows) {
-    const summary = S.summaryStorage.decode(row[g.summary]);
-
-    invariant(
-      summary.grantId === row[g.grantId] &&
-        summary.profileKey === row[g.profileKey] &&
-        mapping.subjectId.equals(found.nativeId, row[g.subjectId]),
-    );
-
-    const co = yield* owner.read(h.table, equal(h.table, { [h.cohortKey]: row[g.cohortKey] }), {
-      limit: 1,
-      lock: false,
-    });
-
-    const cr = co.rows[0];
-
-    invariant(
-      cr !== undefined &&
-        cr[h.clientKey] === row[g.clientKey] &&
-        cr[h.identityKey] === row[g.identityKey],
-    );
-    let status = row[g.state] as (typeof M.OAuthConnectedSummary.Type)["status"];
-
-    if (
-      status !== "Disconnected" &&
-      (cr[h.state] !== "Open" || cr[h.generation] !== row[g.cohortGeneration])
-    )
-      status = "ReauthorizationRequired";
-    let remote = summary.remoteRevocation;
-
-    if (row[g.revocationJobId] !== null) {
-      if (j === undefined) remote = "Unknown";
-      else {
-        const job = yield* owner.read(
-          j.table,
-          equal(j.table, { [j.jobId]: row[g.revocationJobId] }),
-          {
-            limit: 1,
-            lock: false,
-            columns: [j.jobId, j.moduleId, j.grantId, j.cohortKey, j.state],
-          },
-        );
-
-        const jr = job.rows[0];
-
-        invariant(
-          jr !== undefined &&
-            jr[j.moduleId] === row[g.moduleId] &&
-            jr[j.grantId] === row[g.grantId] &&
-            jr[j.cohortKey] === row[g.cohortKey],
-        );
-        remote =
-          jr[j.state] === "Confirmed"
-            ? "Confirmed"
-            : jr[j.state] === "Unknown"
-              ? "Unknown"
-              : "Pending";
-      }
-    }
-    items.push(
-      snapshotOAuthSync(M.OAuthConnectedSummary, { ...summary, status, remoteRevocation: remote }),
-    );
-  }
-
-  return { items, ...(more ? { cursor: last as string } : {}) };
-});
-
-const command = Effect.fn("oauthConnected.disconnectCommand")(function* (
-  mapping: S.Mapping,
-  moduleId: string,
-  commandId: string,
-  lock = true,
-) {
-  const owner = yield* CurrentOAuthTransaction;
-
-  const d = mapping.command,
-    read = yield* owner.read(
-      d.table,
-      equal(d.table, { [d.moduleId]: moduleId, [d.commandId]: commandId }),
-      { limit: 1, lock, observe: lock },
-    );
-
-  const row = read.rows[0];
-
-  if (row === undefined) return { read };
-
-  const grant = S.commandStorage.decode(row[d.intent]),
-    result = S.disconnectedStorage.decode(row[d.decision]);
-
-  const native = yield* mapping.subjectId.toNative(grant.context.subjectId);
-
-  invariant(
-    grant.context.moduleId === moduleId &&
-      grant.context.grantId === row[d.grantId] &&
-      result.grantId === grant.context.grantId &&
-      mapping.subjectId.equals(native, row[d.subjectId]) &&
-      !result.replayed,
-  );
-
-  return { read, row, grant, result };
-});
-
-export const inspectDisconnect = Effect.fn("oauthConnected.inspectDisconnect")(function* (
-  mapping: S.Mapping,
-  input: F.Input<"inspectDisconnect">,
-) {
-  const found = yield* S.useAuthority(mapping, input.authorization, "metadata");
-
-  if (
-    found === undefined ||
-    input.subjectId !== found.revision.subjectId ||
-    input.moduleId !== input.authorization.moduleId
-  )
-    return { _tag: "Rejected" } as const;
-  const discovered = yield* command(mapping, input.moduleId, input.commandId, false);
-
-  if (discovered.row !== undefined) {
-    if (
-      discovered.grant.context.subjectId !== input.subjectId ||
-      discovered.grant.context.grantId !== input.grantId
-    )
-      return { _tag: "Conflict" } as const;
-    if (
-      (yield* S.useAuthority(
-        mapping,
-        input.authorization,
-        "metadata",
-        discovered.grant.context,
-      )) === undefined
-    )
-      return { _tag: "Rejected" } as const;
-    const prior = yield* command(mapping, input.moduleId, input.commandId);
-    const d = mapping.command;
-
-    if (
-      prior.row === undefined ||
-      prior.row[d.intent] !== discovered.row[d.intent] ||
-      prior.row[d.decision] !== discovered.row[d.decision] ||
-      prior.row[d.version] !== discovered.row[d.version]
-    )
-      return { _tag: "Rejected" } as const;
-
-    return { _tag: "Replay", result: { ...prior.result, replayed: true } } as const;
-  }
-  const read = yield* A.locked(mapping, input.authorization, input.grantId, "metadata");
-
-  if (read === undefined) return { _tag: "Rejected" } as const;
-  const finalCommand = yield* command(mapping, input.moduleId, input.commandId);
-
-  if (finalCommand.row !== undefined) return { _tag: "Rejected" } as const;
-
-  return {
-    _tag: "Target",
-    grant: {
-      context: read.grant.context,
-      ...(read.grant.sealed === undefined ? {} : { sealed: read.grant.sealed }),
-    },
-    revision: read.found.revision,
-  } as const;
-});
-
-export const disconnect = Effect.fn("oauthConnected.disconnect")(function* (
-  mapping: S.Mapping,
-  input: F.Input<"disconnect">,
-) {
-  const owner = yield* CurrentOAuthTransaction;
-
-  const token = input.grant.context,
-    found = yield* S.current(mapping, token.subjectId);
-
-  if (
-    found === undefined ||
-    input.moduleId !== token.moduleId ||
-    !(yield* S.action(mapping, found, input.authorization, "disconnect", {
-      moduleId: input.moduleId,
-      flowId: input.commandId,
-      commandId: input.commandId,
-      revision: input.authorization.challenge.revision,
-      intent: S.disconnectStorage.encode(input.grant),
-      maximumAgeMillis: 300000,
-      configuration: token.configuration,
-      grant: token,
-    }))
-  )
-    return { _tag: "Rejected" } as const;
-  const client = yield* S.client(mapping, token.configuration, false);
-
-  if (client === undefined) return { _tag: "Rejected" } as const;
-
-  const tuple = yield* F.inspectTuple(mapping, token.identity),
-    t = mapping.ownership.tuple;
-
-  if (
-    tuple.row?.[t.state] !== "Owned" ||
-    !mapping.subjectId.equals(tuple.row[t.subjectId], found.nativeId)
-  )
-    return { _tag: "Conflict" } as const;
-  const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);
-
-  invariant(cohort.row !== undefined);
-
-  const read = yield* S.readGrant(mapping, input.moduleId, token.grantId),
-    g = mapping.grant;
-
-  if (
-    read === undefined ||
-    !C.sameContext(read.context, token) ||
-    S.disconnectStorage.encode({
-      context: read.context,
-      ...(read.sealed === undefined ? {} : { sealed: read.sealed }),
-    }) !== S.disconnectStorage.encode(input.grant)
-  )
-    return { _tag: "Conflict" } as const;
-  const prior = yield* command(mapping, input.moduleId, input.commandId);
-
-  // Only inspectDisconnect exposes replay. Mutation replay cannot repeat effects.
-  if (prior.row !== undefined) return { _tag: "Conflict" } as const;
-
-  const now = yield* owner.now(mapping.clock),
-    wasOpen = !cohort.blocked;
-
-  invariant(input.retentionUntilMillis >= now && input.retentionUntilMillis <= now + 2592000000);
-  const affected = yield* C.fence(mapping, client, cohort);
-  let remote: (typeof M.OAuthConnectedSummary.Type)["remoteRevocation"] = "Unsupported";
-
-  if (input.revocation !== undefined) {
-    yield* C.storeJob(mapping, input.revocation, token, found.nativeId, now);
-    remote = "Pending";
-  } else if (token.configuration.profile.revocation === "cohort") {
-    invariant(read.sealed === undefined);
-    remote = "Unknown";
-  }
-
-  const result = snapshotOAuthSync(M.OAuthConnectedDisconnected, {
-    _tag: "Disconnected",
-    grantId: token.grantId,
-    remoteRevocation: remote,
-    affectedGrantCount: affected,
-    replayed: false,
-  });
-
-  yield* owner.update(
-    g.table,
-    { [g.moduleId]: input.moduleId, [g.grantId]: token.grantId },
-    {
-      [g.state]: "Disconnected",
-      [g.activeIdentityKey]: null,
-      [g.sealed]: null,
-      [g.revocationJobId]: input.revocation?.context.jobId ?? read.row[g.revocationJobId],
-      [g.version]: owner.marker,
-    },
-  );
-
-  const d = mapping.command,
-    key = { [d.moduleId]: input.moduleId, [d.commandId]: input.commandId };
-
-  const inserted = yield* owner.insert(
-    d.table,
-    {
-      ...d.encodeInsert({
-        commandId: input.commandId,
-        grant: snapshotOAuthSync(M.OAuthConnectedDisconnectGrant, input.grant),
-        subjectId: S.nativeCopy(found.nativeId),
-      }),
-      ...key,
-      [d.subjectId]: found.nativeId,
-      [d.grantId]: token.grantId,
-      [d.intent]: S.commandStorage.encode({
-        context: token,
-        originalDigest: yield* digest(S.disconnectStorage.encode(input.grant)),
-        ...(input.revocation === undefined
-          ? {}
-          : { revocationJobId: input.revocation.context.jobId }),
-      }),
-      [d.decision]: S.disconnectedStorage.encode(result),
-      [d.retentionUntil]: mapping.clock.encodeInstant(input.retentionUntilMillis),
-      [d.version]: owner.marker,
-    },
-    key,
-  );
-
-  prior.read.rows = inserted.rows;
-  if (
-    wasOpen &&
-    input.revocation === undefined &&
-    token.configuration.profile.revocation === "unsupported"
-  )
-    yield* C.clear(mapping, client, cohort, undefined, true);
-
-  return result;
-});