@yielded/auth-persistence 0.1.0-beta.7

package/src/drizzle/oauth-connected-maintenance.ts

@@ -0,0 +1,345 @@
+import type * as M from "@yielded/auth/OAuth";
+import {
+  OAuthConnectedRevocationClaim,
+  type OAuthConnectedRevocations,
+  snapshotOAuthSync,
+} from "@yielded/auth/OAuth";
+import { asc, eq, lte, sql } from "drizzle-orm";
+import { Effect } from "effect";
+
+import { collect, discover } from "./oauth-connected-collection";
+import * as C from "./oauth-connected-custody";
+import * as F from "./oauth-connected-flow";
+import * as S from "./oauth-connected-state";
+import { both, col, equal, CurrentOAuthTransaction } from "./oauth-owner";
+import { invariant, storage } from "./oauth-state";
+
+type WorkerInput<K extends keyof OAuthConnectedRevocations["Service"]> = Parameters<
+  OAuthConnectedRevocations["Service"][K]
+>[0];
+const revocationClaimStorage = storage(OAuthConnectedRevocationClaim);
+
+const jobLocks = Effect.fn("oauthConnected.jobLocks")(function* (
+  mapping: S.Revocations,
+  job: M.OAuthConnectedRevocationJob,
+) {
+  const owner = yield* CurrentOAuthTransaction;
+
+  const token = job.context.token,
+    client = yield* S.client(mapping, token.configuration, false);
+
+  if (client === undefined) return undefined;
+
+  const tuple = yield* F.inspectTuple(mapping, token.identity),
+    t = mapping.ownership.tuple;
+
+  const native = yield* mapping.subjectId.toNative(token.subjectId);
+
+  if (tuple.row?.[t.state] !== "Owned" || !mapping.subjectId.equals(tuple.row[t.subjectId], native))
+    return undefined;
+  const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);
+
+  invariant(cohort.row !== undefined);
+
+  const j = mapping.job,
+    read = yield* owner.read(j.table, equal(j.table, { [j.jobId]: job.context.jobId }), {
+      limit: 1,
+    }),
+    row = read.rows[0];
+
+  if (row === undefined) return undefined;
+  invariant(row[j.state] === "Confirmed" || cohort.blocked);
+  invariant(
+    row[j.snapshot] === S.jobStorage.encode(job) &&
+      row[j.moduleId] === token.moduleId &&
+      mapping.subjectId.equals(native, row[j.subjectId]) &&
+      row[j.identityKey] === tuple.key &&
+      row[j.clientKey] === client.id &&
+      row[j.cohortKey] === cohort.id &&
+      row[j.grantId] === token.grantId &&
+      ["Pending", "Claimed", "Unknown", "Confirmed"].includes(row[j.state]),
+  );
+
+  return { client, cohort, row };
+});
+
+export const claimRevocation = Effect.fn("oauthConnected.claimRevocation")(function* (
+  mapping: S.Revocations,
+  input: WorkerInput<"claim">,
+) {
+  const owner = yield* CurrentOAuthTransaction;
+
+  invariant(
+    Number.isSafeInteger(input.lifetimeMillis) &&
+      input.lifetimeMillis >= 1000 &&
+      input.lifetimeMillis <= 120000,
+  );
+  const j = mapping.job;
+
+  const candidate = yield* owner.read(
+    j.table,
+    equal(j.table, { [j.moduleId]: input.moduleId, [j.state]: "Pending" }),
+    { limit: 1, takeOnly: true, lock: false, observe: false, orderBy: asc(col(j.table, j.jobId)) },
+  );
+
+  const row = candidate.rows[0];
+
+  if (row === undefined) return { _tag: "Empty" } as const;
+  const job = S.jobStorage.decode(row[j.snapshot]);
+  const locks = yield* jobLocks(mapping, job);
+
+  if (locks === undefined || locks.row[j.state] !== "Pending") return { _tag: "Empty" } as const;
+  invariant(
+    locks.row[j.claimId] === null &&
+      locks.row[j.claimedAt] === null &&
+      locks.row[j.claimExpiresAt] === null,
+  );
+
+  const now = yield* owner.now(mapping.clock),
+    expires = now + input.lifetimeMillis;
+
+  invariant(Number.isSafeInteger(expires));
+
+  const claim = snapshotOAuthSync(OAuthConnectedRevocationClaim, {
+    job,
+    claimId: input.claimId,
+    claimedAtMillis: now,
+    claimExpiresAtMillis: expires,
+  });
+
+  yield* owner.update(
+    j.table,
+    { [j.jobId]: job.context.jobId, [j.state]: "Pending" },
+    {
+      [j.state]: "Claimed",
+      [j.claimId]: input.claimId,
+      [j.claimedAt]: mapping.clock.encodeInstant(now),
+      [j.claimExpiresAt]: mapping.clock.encodeInstant(expires),
+      [j.retentionUntil]: mapping.clock.encodeInstant(S.retainedUntil(mapping, expires)),
+      [j.version]: owner.marker,
+    },
+  );
+  owner.postconditions.push(
+    sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${expires}`,
+  );
+
+  return { _tag: "Claimed", claim } as const;
+});
+
+export const settleRevocation = Effect.fn("oauthConnected.settleRevocation")(function* (
+  mapping: S.Revocations,
+  input: WorkerInput<"settle">,
+) {
+  const owner = yield* CurrentOAuthTransaction;
+  const locks = yield* jobLocks(mapping, input.claim.job);
+
+  if (locks === undefined) return { settled: false };
+
+  const j = mapping.job,
+    row = locks.row;
+
+  if (row[j.state] !== "Claimed" || row[j.claimId] !== input.claim.claimId)
+    return { settled: false };
+  invariant(
+    revocationClaimStorage.encode({
+      job: input.claim.job,
+      claimId: row[j.claimId],
+      claimedAtMillis: mapping.clock.decodeInstant(row[j.claimedAt]),
+      claimExpiresAtMillis: mapping.clock.decodeInstant(row[j.claimExpiresAt]),
+    }) === revocationClaimStorage.encode(input.claim),
+  );
+  const now = yield* owner.now(mapping.clock);
+
+  invariant(now >= input.claim.claimedAtMillis);
+  const confirmed = input.outcome === "Confirmed" && now < input.claim.claimExpiresAtMillis;
+
+  yield* owner.update(
+    j.table,
+    {
+      [j.jobId]: input.claim.job.context.jobId,
+      [j.state]: "Claimed",
+      [j.claimId]: input.claim.claimId,
+    },
+    { [j.state]: confirmed ? "Confirmed" : "Unknown", [j.version]: owner.marker },
+  );
+  if (confirmed) {
+    owner.postconditions.push(
+      sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${input.claim.claimExpiresAtMillis}`,
+    );
+    yield* C.clear(mapping, locks.client, locks.cohort, input.claim.job.context.jobId);
+  }
+
+  return { settled: true };
+});
+
+/** Candidate discovery is not authority. Each conditional write re-reads its row
+ * and engine time under the client/tuple/cohort order and retains a final guard. */
+export const cleanup = Effect.fn("oauthConnected.cleanup")(function* (
+  mapping: S.Mapping,
+  input: F.Input<"cleanup">,
+) {
+  const owner = yield* CurrentOAuthTransaction;
+
+  invariant(Number.isSafeInteger(input.limit) && input.limit >= 1 && input.limit <= 1000);
+
+  const f = mapping.flow,
+    a = mapping.admission,
+    d = mapping.command;
+
+  let terminalized = 0,
+    removed = 0,
+    visited = 0,
+    hasMore = false;
+
+  const at = yield* owner.now(mapping.clock);
+
+  const candidates = yield* owner.read(
+    f.table,
+    both(
+      eq(col(f.table, f.moduleId), input.moduleId),
+      sql`((${col(f.table, f.state)} = 'Pending' and ${col(f.table, f.expiresAt)} <= ${mapping.clock.encodeInstant(at)}) or (${col(f.table, f.state)} = 'Claimed' and ${col(f.table, f.claimExpiresAt)} <= ${mapping.clock.encodeInstant(at)}) or (${col(f.table, f.state)} not in ('Pending','Claimed') and ${col(f.table, f.work)} <> 'Unresolved' and ${col(f.table, f.retentionUntil)} <= ${mapping.clock.encodeInstant(at)}))`,
+    ),
+    {
+      limit: input.limit + 1,
+      takeOnly: true,
+      observe: false,
+      lock: false,
+      orderBy: asc(col(f.table, f.flowId)),
+    },
+  );
+
+  const collectionCandidates = yield* discover(mapping, input.moduleId, input.limit);
+
+  const g = mapping.grant,
+    j = S.jobTable(mapping),
+    h = mapping.cohort;
+
+  yield* S.prelockClients(
+    mapping,
+    [
+      ...candidates.rows.slice(0, input.limit).map((row) => row[f.clientKey]),
+      ...collectionCandidates.jobs.slice(0, input.limit).map((row) => row[j!.clientKey]),
+      ...collectionCandidates.grants.slice(0, input.limit).map((row) => row[g.clientKey]),
+      ...collectionCandidates.cohorts.slice(0, input.limit).map((row) => row[h.clientKey]),
+    ],
+    collectionCandidates.tuples.slice(0, input.limit).map((row) => ({
+      provider: row[mapping.ownership.tuple.provider],
+      issuer: row[mapping.ownership.tuple.issuer],
+    })),
+  );
+  hasMore = candidates.rows.length > input.limit;
+  for (const candidate of candidates.rows.slice(0, input.limit)) {
+    visited++;
+    // A terminal ledger retains client key but may erase the decryptable browser snapshot.
+    const heldClient = yield* S.lockClientById(mapping, candidate[f.clientKey]);
+
+    const read = yield* owner.read(
+        f.table,
+        equal(f.table, { [f.moduleId]: input.moduleId, [f.flowId]: candidate[f.flowId] }),
+        { limit: 1 },
+      ),
+      row = read.rows[0];
+
+    if (row === undefined) continue;
+    invariant(row[f.clientKey] === heldClient.id);
+
+    const now = yield* owner.now(mapping.clock),
+      state = row[f.state];
+
+    const expires = mapping.clock.decodeInstant(
+      state === "Claimed" ? row[f.claimExpiresAt] : row[f.expiresAt],
+    );
+
+    if ((state === "Pending" || state === "Claimed") && now >= expires) {
+      yield* owner.update(
+        f.table,
+        { [f.moduleId]: input.moduleId, [f.flowId]: row[f.flowId], [f.version]: row[f.version] },
+        {
+          [f.state]: state === "Claimed" ? "Ambiguous" : "Expired",
+          [f.snapshot]: null,
+          [f.version]: owner.marker,
+        },
+      );
+      owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${expires}`);
+      terminalized++;
+    } else if (
+      state !== "Pending" &&
+      state !== "Claimed" &&
+      row[f.work] !== "Unresolved" &&
+      now >= mapping.clock.decodeInstant(row[f.retentionUntil])
+    ) {
+      yield* owner.remove(f.table, {
+        [f.moduleId]: input.moduleId,
+        [f.flowId]: row[f.flowId],
+        [f.version]: row[f.version],
+      });
+      owner.postconditions.push(
+        sql`${mapping.clock.engineNowMillis} >= ${mapping.clock.decodeInstant(row[f.retentionUntil])}`,
+      );
+      removed++;
+    }
+  }
+  // Expired admission and command metadata have no external-operation obligation.
+  for (const table of [a, d]) {
+    if (visited >= input.limit) {
+      hasMore = true;
+      break;
+    }
+
+    const deadline = "expiresAt" in table ? table.expiresAt : table.retentionUntil,
+      key = "admissionId" in table ? table.admissionId : table.commandId;
+
+    const rows = yield* owner.read(
+      table.table,
+      both(
+        eq(col(table.table, table.moduleId), input.moduleId),
+        lte(col(table.table, deadline), mapping.clock.encodeInstant(at)),
+      ),
+      {
+        limit: input.limit - visited + 1,
+        takeOnly: true,
+        observe: false,
+        lock: false,
+        orderBy: asc(col(table.table, key)),
+      },
+    );
+
+    if (rows.rows.length > input.limit - visited) hasMore = true;
+    for (const candidate of rows.rows.slice(0, input.limit - visited)) {
+      visited++;
+
+      const read = yield* owner.read(
+          table.table,
+          equal(table.table, { [table.moduleId]: input.moduleId, [key]: candidate[key] }),
+          { limit: 1 },
+        ),
+        row = read.rows[0];
+
+      const now = yield* owner.now(mapping.clock);
+
+      if (row !== undefined && now >= mapping.clock.decodeInstant(row[deadline])) {
+        yield* owner.remove(table.table, {
+          [table.moduleId]: input.moduleId,
+          [key]: row[key],
+          [table.version]: row[table.version],
+        });
+        owner.postconditions.push(
+          sql`${mapping.clock.engineNowMillis} >= ${mapping.clock.decodeInstant(row[deadline])}`,
+        );
+        removed++;
+      }
+    }
+  }
+
+  const collection = yield* collect(
+    mapping,
+    input.moduleId,
+    input.limit - visited,
+    collectionCandidates,
+  );
+
+  removed += collection.removed;
+  hasMore ||= collection.hasMore;
+
+  return { terminalized, removed, hasMore };
+});

package/src/drizzle/oauth-connected-management.ts

@@ -0,0 +1,365 @@
+import * as M from "@yielded/auth/OAuth";
+import { snapshotOAuthSync } from "@yielded/auth/OAuth";
+import { asc, eq, gt, lte } from "drizzle-orm";
+import { Effect } from "effect";
+
+import * as A from "./oauth-connected-access";
+import * as C from "./oauth-connected-custody";
+import * as F from "./oauth-connected-flow";
+import * as S from "./oauth-connected-state";
+import { both, col, equal, CurrentOAuthTransaction } from "./oauth-owner";
+import { digest, invariant } from "./oauth-state";
+
+export const list = Effect.fn("oauthConnected.list")(function* (
+  mapping: S.Mapping,
+  input: F.Input<"list">,
+) {
+  const owner = yield* CurrentOAuthTransaction;
+  const found = yield* S.useAuthority(mapping, input.authorization, "metadata");
+
+  if (found === undefined) return { items: [] };
+  invariant(Number.isSafeInteger(input.limit) && input.limit >= 1 && input.limit <= 100);
+
+  const g = mapping.grant,
+    h = mapping.cohort,
+    j = S.jobTable(mapping);
+
+  const cursor = input.cursor === undefined ? undefined : M.OAuthGrantId.make(input.cursor);
+
+  const where = both(
+    equal(g.table, { [g.moduleId]: input.authorization.moduleId, [g.subjectId]: found.nativeId }),
+    cursor === undefined ? undefined : gt(col(g.table, g.grantId), cursor),
+    input.authorization.grantId === undefined
+      ? undefined
+      : eq(col(g.table, g.grantId), input.authorization.grantId),
+    input.authorization.profileKey === undefined
+      ? undefined
+      : eq(col(g.table, g.profileKey), input.authorization.profileKey),
+  );
+
+  const columns = [
+    g.moduleId,
+    g.grantId,
+    g.subjectId,
+    g.identityKey,
+    g.clientKey,
+    g.cohortKey,
+    g.cohortGeneration,
+    g.profileKey,
+    g.state,
+    g.summary,
+    g.revocationJobId,
+    g.version,
+  ];
+
+  const read = yield* owner.read(g.table, where, {
+    columns,
+    limit: input.limit + 1,
+    takeOnly: true,
+    observe: false,
+    lock: false,
+    orderBy: asc(col(g.table, g.grantId)),
+  });
+
+  const more = read.rows.length > input.limit,
+    rows = read.rows.slice(0, input.limit),
+    last = rows.at(-1)?.[g.grantId];
+
+  owner.observations.push({
+    table: g.table,
+    where: more ? both(where, lte(col(g.table, g.grantId), last)) : where,
+    rows,
+  });
+  const items: Array<typeof M.OAuthConnectedSummary.Type> = [];
+
+  for (const row of rows) {
+    const summary = S.summaryStorage.decode(row[g.summary]);
+
+    invariant(
+      summary.grantId === row[g.grantId] &&
+        summary.profileKey === row[g.profileKey] &&
+        mapping.subjectId.equals(found.nativeId, row[g.subjectId]),
+    );
+
+    const co = yield* owner.read(h.table, equal(h.table, { [h.cohortKey]: row[g.cohortKey] }), {
+      limit: 1,
+      lock: false,
+    });
+
+    const cr = co.rows[0];
+
+    invariant(
+      cr !== undefined &&
+        cr[h.clientKey] === row[g.clientKey] &&
+        cr[h.identityKey] === row[g.identityKey],
+    );
+    let status = row[g.state] as (typeof M.OAuthConnectedSummary.Type)["status"];
+
+    if (
+      status !== "Disconnected" &&
+      (cr[h.state] !== "Open" || cr[h.generation] !== row[g.cohortGeneration])
+    )
+      status = "ReauthorizationRequired";
+    let remote = summary.remoteRevocation;
+
+    if (row[g.revocationJobId] !== null) {
+      if (j === undefined) remote = "Unknown";
+      else {
+        const job = yield* owner.read(
+          j.table,
+          equal(j.table, { [j.jobId]: row[g.revocationJobId] }),
+          {
+            limit: 1,
+            lock: false,
+            columns: [j.jobId, j.moduleId, j.grantId, j.cohortKey, j.state],
+          },
+        );
+
+        const jr = job.rows[0];
+
+        invariant(
+          jr !== undefined &&
+            jr[j.moduleId] === row[g.moduleId] &&
+            jr[j.grantId] === row[g.grantId] &&
+            jr[j.cohortKey] === row[g.cohortKey],
+        );
+        remote =
+          jr[j.state] === "Confirmed"
+            ? "Confirmed"
+            : jr[j.state] === "Unknown"
+              ? "Unknown"
+              : "Pending";
+      }
+    }
+    items.push(
+      snapshotOAuthSync(M.OAuthConnectedSummary, { ...summary, status, remoteRevocation: remote }),
+    );
+  }
+
+  return { items, ...(more ? { cursor: last as string } : {}) };
+});
+
+const command = Effect.fn("oauthConnected.disconnectCommand")(function* (
+  mapping: S.Mapping,
+  moduleId: string,
+  commandId: string,
+  lock = true,
+) {
+  const owner = yield* CurrentOAuthTransaction;
+
+  const d = mapping.command,
+    read = yield* owner.read(
+      d.table,
+      equal(d.table, { [d.moduleId]: moduleId, [d.commandId]: commandId }),
+      { limit: 1, lock, observe: lock },
+    );
+
+  const row = read.rows[0];
+
+  if (row === undefined) return { read };
+
+  const grant = S.commandStorage.decode(row[d.intent]),
+    result = S.disconnectedStorage.decode(row[d.decision]);
+
+  const native = yield* mapping.subjectId.toNative(grant.context.subjectId);
+
+  invariant(
+    grant.context.moduleId === moduleId &&
+      grant.context.grantId === row[d.grantId] &&
+      result.grantId === grant.context.grantId &&
+      mapping.subjectId.equals(native, row[d.subjectId]) &&
+      !result.replayed,
+  );
+
+  return { read, row, grant, result };
+});
+
+export const inspectDisconnect = Effect.fn("oauthConnected.inspectDisconnect")(function* (
+  mapping: S.Mapping,
+  input: F.Input<"inspectDisconnect">,
+) {
+  const found = yield* S.useAuthority(mapping, input.authorization, "metadata");
+
+  if (
+    found === undefined ||
+    input.subjectId !== found.revision.subjectId ||
+    input.moduleId !== input.authorization.moduleId
+  )
+    return { _tag: "Rejected" } as const;
+  const discovered = yield* command(mapping, input.moduleId, input.commandId, false);
+
+  if (discovered.row !== undefined) {
+    if (
+      discovered.grant.context.subjectId !== input.subjectId ||
+      discovered.grant.context.grantId !== input.grantId
+    )
+      return { _tag: "Conflict" } as const;
+    if (
+      (yield* S.useAuthority(
+        mapping,
+        input.authorization,
+        "metadata",
+        discovered.grant.context,
+      )) === undefined
+    )
+      return { _tag: "Rejected" } as const;
+    const prior = yield* command(mapping, input.moduleId, input.commandId);
+    const d = mapping.command;
+
+    if (
+      prior.row === undefined ||
+      prior.row[d.intent] !== discovered.row[d.intent] ||
+      prior.row[d.decision] !== discovered.row[d.decision] ||
+      prior.row[d.version] !== discovered.row[d.version]
+    )
+      return { _tag: "Rejected" } as const;
+
+    return { _tag: "Replay", result: { ...prior.result, replayed: true } } as const;
+  }
+  const read = yield* A.locked(mapping, input.authorization, input.grantId, "metadata");
+
+  if (read === undefined) return { _tag: "Rejected" } as const;
+  const finalCommand = yield* command(mapping, input.moduleId, input.commandId);
+
+  if (finalCommand.row !== undefined) return { _tag: "Rejected" } as const;
+
+  return {
+    _tag: "Target",
+    grant: {
+      context: read.grant.context,
+      ...(read.grant.sealed === undefined ? {} : { sealed: read.grant.sealed }),
+    },
+    revision: read.found.revision,
+  } as const;
+});
+
+export const disconnect = Effect.fn("oauthConnected.disconnect")(function* (
+  mapping: S.Mapping,
+  input: F.Input<"disconnect">,
+) {
+  const owner = yield* CurrentOAuthTransaction;
+
+  const token = input.grant.context,
+    found = yield* S.current(mapping, token.subjectId);
+
+  if (
+    found === undefined ||
+    input.moduleId !== token.moduleId ||
+    !(yield* S.action(mapping, found, input.authorization, "disconnect", {
+      moduleId: input.moduleId,
+      flowId: input.commandId,
+      commandId: input.commandId,
+      revision: input.authorization.challenge.revision,
+      intent: S.disconnectStorage.encode(input.grant),
+      maximumAgeMillis: 300000,
+      configuration: token.configuration,
+      grant: token,
+    }))
+  )
+    return { _tag: "Rejected" } as const;
+  const client = yield* S.client(mapping, token.configuration, false);
+
+  if (client === undefined) return { _tag: "Rejected" } as const;
+
+  const tuple = yield* F.inspectTuple(mapping, token.identity),
+    t = mapping.ownership.tuple;
+
+  if (
+    tuple.row?.[t.state] !== "Owned" ||
+    !mapping.subjectId.equals(tuple.row[t.subjectId], found.nativeId)
+  )
+    return { _tag: "Conflict" } as const;
+  const cohort = yield* S.cohort(mapping, client.id, tuple.key, false);
+
+  invariant(cohort.row !== undefined);
+
+  const read = yield* S.readGrant(mapping, input.moduleId, token.grantId),
+    g = mapping.grant;
+
+  if (
+    read === undefined ||
+    !C.sameContext(read.context, token) ||
+    S.disconnectStorage.encode({
+      context: read.context,
+      ...(read.sealed === undefined ? {} : { sealed: read.sealed }),
+    }) !== S.disconnectStorage.encode(input.grant)
+  )
+    return { _tag: "Conflict" } as const;
+  const prior = yield* command(mapping, input.moduleId, input.commandId);
+
+  // Only inspectDisconnect exposes replay. Mutation replay cannot repeat effects.
+  if (prior.row !== undefined) return { _tag: "Conflict" } as const;
+
+  const now = yield* owner.now(mapping.clock),
+    wasOpen = !cohort.blocked;
+
+  invariant(input.retentionUntilMillis >= now && input.retentionUntilMillis <= now + 2592000000);
+  const affected = yield* C.fence(mapping, client, cohort);
+  let remote: (typeof M.OAuthConnectedSummary.Type)["remoteRevocation"] = "Unsupported";
+
+  if (input.revocation !== undefined) {
+    yield* C.storeJob(mapping, input.revocation, token, found.nativeId, now);
+    remote = "Pending";
+  } else if (token.configuration.profile.revocation === "cohort") {
+    invariant(read.sealed === undefined);
+    remote = "Unknown";
+  }
+
+  const result = snapshotOAuthSync(M.OAuthConnectedDisconnected, {
+    _tag: "Disconnected",
+    grantId: token.grantId,
+    remoteRevocation: remote,
+    affectedGrantCount: affected,
+    replayed: false,
+  });
+
+  yield* owner.update(
+    g.table,
+    { [g.moduleId]: input.moduleId, [g.grantId]: token.grantId },
+    {
+      [g.state]: "Disconnected",
+      [g.activeIdentityKey]: null,
+      [g.sealed]: null,
+      [g.revocationJobId]: input.revocation?.context.jobId ?? read.row[g.revocationJobId],
+      [g.version]: owner.marker,
+    },
+  );
+
+  const d = mapping.command,
+    key = { [d.moduleId]: input.moduleId, [d.commandId]: input.commandId };
+
+  const inserted = yield* owner.insert(
+    d.table,
+    {
+      ...d.encodeInsert({
+        commandId: input.commandId,
+        grant: snapshotOAuthSync(M.OAuthConnectedDisconnectGrant, input.grant),
+        subjectId: S.nativeCopy(found.nativeId),
+      }),
+      ...key,
+      [d.subjectId]: found.nativeId,
+      [d.grantId]: token.grantId,
+      [d.intent]: S.commandStorage.encode({
+        context: token,
+        originalDigest: digest(S.disconnectStorage.encode(input.grant)),
+        ...(input.revocation === undefined
+          ? {}
+          : { revocationJobId: input.revocation.context.jobId }),
+      }),
+      [d.decision]: S.disconnectedStorage.encode(result),
+      [d.retentionUntil]: mapping.clock.encodeInstant(input.retentionUntilMillis),
+      [d.version]: owner.marker,
+    },
+    key,
+  );
+
+  prior.read.rows = inserted.rows;
+  if (
+    wasOpen &&
+    input.revocation === undefined &&
+    token.configuration.profile.revocation === "unsupported"
+  )
+    yield* C.clear(mapping, client, cohort, undefined, true);
+
+  return result;
+});