@dual-os/sdk 0.0.0-stage → 0.8.0-next.0

package/src/AuthMethodBinding.ts

@@ -0,0 +1,112 @@
+/**
+ * Resolved auth method bindings exposed to action and trigger handlers.
+ *
+ * @since 0.0.0
+ */
+import type * as AuthMethod from "./AuthMethod.ts";
+
+/**
+ * A resolved connection binding selected for one invocation.
+ *
+ * The selected connection is backed by one provider-owned auth method.
+ *
+ * @since 0.0.0
+ * @category models
+ */
+export type Binding<out Method extends AuthMethod.Any = AuthMethod.Any> = {
+  readonly providerId: string;
+  readonly connectionId: string | undefined;
+  readonly method: Method;
+  readonly methodId: Method["identifier"];
+  readonly value: AuthMethod.Value<Method>;
+};
+
+/**
+ * Create a resolved connection binding.
+ *
+ * @since 0.0.0
+ * @category constructors
+ */
+export const makeBinding = <Method extends AuthMethod.Any>(options: {
+  readonly providerId: string;
+  readonly connectionId: string | undefined;
+  readonly method: Method;
+  readonly value: AuthMethod.Value<Method>;
+}): Binding<Method> => ({
+  connectionId: options.connectionId,
+  method: options.method,
+  methodId: options.method.identifier,
+  providerId: options.providerId,
+  value: options.value,
+});
+
+/**
+ * Union of resolved connection bindings for the provided method list.
+ *
+ * @since 0.0.0
+ * @category type-level
+ */
+export type BindingFor<Methods extends readonly AuthMethod.Any[]> =
+  Methods[number] extends infer Method
+    ? Method extends AuthMethod.Any
+      ? Binding<Method>
+      : never
+    : never;
+
+/**
+ * Resolved connection binding narrowed to one method from a provider-owned method list.
+ *
+ * @since 0.0.0
+ * @category type-level
+ */
+export type BindingForMethod<
+  Methods extends readonly AuthMethod.Any[],
+  Method extends Methods[number],
+> = BindingFor<Methods> & Binding<Method>;
+
+/**
+ * Exhaustive handlers for the currently selected connection binding.
+ *
+ * @since 0.0.0
+ * @category models
+ */
+export type MatchCases<Methods extends readonly AuthMethod.Any[], Result> = {
+  readonly [Method in Methods[number] as Method["identifier"]]: (
+    binding: BindingForMethod<Methods, Method>,
+  ) => Result;
+};
+
+/**
+ * Runtime auth helper context exposed to action handlers.
+ *
+ * @since 0.0.0
+ * @category models
+ */
+export interface Context<Methods extends readonly AuthMethod.Any[]> {
+  readonly current: BindingFor<Methods>;
+  // tsrs accepts this `this` predicate only on an interface or class member.
+  is<Method extends Methods[number]>(
+    method: Method,
+  ): this is Context<Methods> & { readonly current: BindingForMethod<Methods, Method> };
+  is<Method extends Methods[number]>(
+    binding: BindingFor<Methods>,
+    method: Method,
+  ): binding is BindingForMethod<Methods, Method>;
+  match<Result>(cases: MatchCases<Methods, Result>): Result;
+}
+
+/**
+ * Runtime type guard for matching a resolved binding against a provider-owned method.
+ *
+ * @since 0.0.0
+ * @category guards
+ */
+export const isBindingForMethod = <
+  Methods extends readonly AuthMethod.Any[],
+  Method extends Methods[number],
+>(
+  binding: BindingFor<Methods>,
+  method: Method,
+): binding is BindingForMethod<Methods, Method> => (binding as Binding).method === method;
+
+export * as AuthMethodBinding from "./AuthMethodBinding.ts";

package/src/AuthMethodExecution.ts

@@ -0,0 +1,542 @@
+/**
+ * Credential decoding, hook execution, material refresh, and value resolution.
+ *
+ * @since 0.0.0
+ */
+import { Effect, Schema } from "effect";
+
+import * as AuthMethod from "./AuthMethod.ts";
+import { OAuth2TokenRefresher } from "./OAuth2TokenRefresher.ts";
+
+const hookError = (
+  methodIdentifier: string,
+  operation: AuthMethod.AuthMethodHookOperation,
+  cause: unknown,
+): AuthMethod.AuthMethodHookError =>
+  new AuthMethod.AuthMethodHookError({ cause, methodIdentifier, operation });
+
+const runHook = <A, R>(
+  methodIdentifier: string,
+  operation: AuthMethod.AuthMethodHookOperation,
+  hook: () => AuthMethod.MaybeEffect<A, unknown, R>,
+): Effect.Effect<A, AuthMethod.AuthMethodHookError, R> =>
+  Effect.try({ catch: cause => hookError(methodIdentifier, operation, cause), try: hook }).pipe(
+    Effect.flatMap(result =>
+      toEffect(result).pipe(
+        Effect.mapError(cause => hookError(methodIdentifier, operation, cause)),
+      ),
+    ),
+  );
+
+const toEffect = <Value, Error, Requirements>(
+  value: AuthMethod.MaybeEffect<Value, Error, Requirements>,
+): Effect.Effect<Value, Error, Requirements> =>
+  Effect.isEffect(value) ? value : Effect.succeed(value);
+
+const hookContext = (
+  context: AuthMethod.HookContext<unknown> | undefined,
+): AuthMethod.HookContext<unknown> => context ?? { setup: undefined };
+
+/**
+ * Erased runtime view of an auth method.
+ *
+ * Execution helpers implement against this view and re-expose precise
+ * per-method types through their public signatures; the single `as never`
+ * closing each implementation is the contained boundary between the two.
+ */
+interface AnyImpl {
+  readonly identifier: string;
+  readonly kind: AuthMethod.AuthMethodKind;
+  readonly setup: Schema.Top | undefined;
+  readonly input: Schema.Top | undefined;
+  readonly material: Schema.Top;
+  readonly value: Schema.Top;
+  readonly schema: Schema.Top;
+  readonly prepare: AuthMethod.PrepareHook<unknown, unknown, unknown, unknown, unknown> | undefined;
+  readonly refresh: AuthMethod.RefreshHook<unknown, unknown, unknown, unknown> | undefined;
+  readonly resolve: AuthMethod.ResolveHook<unknown, unknown, unknown, unknown, unknown> | undefined;
+  readonly display: AuthMethod.DisplayHook<unknown, unknown, unknown, unknown> | undefined;
+  readonly test: AuthMethod.TestHook<unknown, unknown, unknown, unknown> | undefined;
+  readonly oauth2: AuthMethod.OAuth2Setup<Schema.Top, unknown, unknown> | undefined;
+}
+
+const toImpl = (method: AuthMethod.Any): AnyImpl => method as AnyImpl;
+
+type SetupRequirements<Method extends AuthMethod.Any> =
+  AuthMethod.SetupSchema<Method> extends Schema.Top
+    ? Schema.Codec.DecodingServices<AuthMethod.SetupSchema<Method>>
+    : never;
+
+type InputRequirements<Method extends AuthMethod.Any> =
+  AuthMethod.InputSchema<Method> extends Schema.Top
+    ? Schema.Codec.DecodingServices<AuthMethod.InputSchema<Method>>
+    : never;
+
+type MaterialRequirements<Method extends AuthMethod.Any> = Schema.Codec.DecodingServices<
+  AuthMethod.MaterialSchema<Method>
+>;
+
+type ValueRequirements<Method extends AuthMethod.Any> = Schema.Codec.DecodingServices<
+  AuthMethod.ValueSchema<Method>
+>;
+
+/**
+ * Decode a runtime auth value using the selected method schema.
+ *
+ * @since 0.0.0
+ * @category constructors
+ */
+export const decodeValue: <Method extends AuthMethod.Any>(
+  method: Method,
+  value: unknown,
+) => Effect.Effect<AuthMethod.Value<Method>, Schema.SchemaError, ValueRequirements<Method>> = (
+  method,
+  value,
+) => Schema.decodeUnknownEffect(toImpl(method).schema)(value) as never;
+
+/**
+ * Decode organization/admin-level setup for a method, if it declares one.
+ *
+ * @since 0.0.0
+ * @category constructors
+ */
+export const decodeSetup: <Method extends AuthMethod.Any>(
+  method: Method,
+  setup: unknown,
+) => Effect.Effect<AuthMethod.Setup<Method>, Schema.SchemaError, SetupRequirements<Method>> = (
+  method,
+  setup,
+) => {
+  const impl = toImpl(method);
+  return (
+    impl.setup === undefined ? Effect.void : Schema.decodeUnknownEffect(impl.setup)(setup)
+  ) as never;
+};
+
+/**
+ * Decode submitted setup input using the method input schema, if any.
+ *
+ * @since 0.0.0
+ * @category constructors
+ */
+export const decodeInput: <Method extends AuthMethod.Any>(
+  method: Method,
+  input: unknown,
+) => Effect.Effect<AuthMethod.Input<Method>, Schema.SchemaError, InputRequirements<Method>> = (
+  method,
+  input,
+) => {
+  const impl = toImpl(method);
+  return (
+    impl.input === undefined ? Effect.void : Schema.decodeUnknownEffect(impl.input)(input)
+  ) as never;
+};
+
+/**
+ * Decode encrypted stored material using the method material schema.
+ *
+ * @since 0.0.0
+ * @category constructors
+ */
+export const decodeMaterial: <Method extends AuthMethod.Any>(
+  method: Method,
+  material: unknown,
+) => Effect.Effect<
+  AuthMethod.Material<Method>,
+  Schema.SchemaError,
+  MaterialRequirements<Method>
+> = (method, material) => Schema.decodeUnknownEffect(toImpl(method).material)(material) as never;
+
+/**
+ * Prepare already-decoded setup input into encrypted stored material.
+ *
+ * @since 0.0.0
+ * @category constructors
+ */
+export const prepareDecoded: <Method extends AuthMethod.Any>(
+  method: Method,
+  input: AuthMethod.Input<Method>,
+  context?: AuthMethod.HookContext<AuthMethod.Setup<Method>>,
+) => Effect.Effect<
+  AuthMethod.Material<Method>,
+  Schema.SchemaError | AuthMethod.AuthMethodHookError,
+  MaterialRequirements<Method> | AuthMethod.Requirements<Method>
+> = (method, input, context) => {
+  const impl = toImpl(method);
+  const prepare = impl.prepare;
+
+  if (prepare === undefined) {
+    return (
+      impl.input === impl.material
+        ? Effect.succeed(input)
+        : Schema.decodeUnknownEffect(impl.material)(input)
+    ) as never;
+  }
+
+  return runHook(impl.identifier, "prepare", () => prepare(input, hookContext(context))).pipe(
+    Effect.flatMap(material => Schema.decodeUnknownEffect(impl.material)(material)),
+  ) as never;
+};
+
+/**
+ * Decode and prepare submitted setup input into encrypted stored material.
+ *
+ * @since 0.0.0
+ * @category constructors
+ */
+export const prepareUnknown: <Method extends AuthMethod.Any>(
+  method: Method,
+  input: unknown,
+  context?: AuthMethod.HookContext<AuthMethod.Setup<Method>>,
+) => Effect.Effect<
+  AuthMethod.Material<Method>,
+  Schema.SchemaError | AuthMethod.AuthMethodHookError,
+  InputRequirements<Method> | MaterialRequirements<Method> | AuthMethod.Requirements<Method>
+> = (method, input, context) =>
+  decodeInput(method, input).pipe(
+    Effect.flatMap(decodedInput => prepareDecoded(method, decodedInput, context)),
+  );
+
+const oauth2ExpiresAt = (material: unknown): number | undefined =>
+  typeof material === "object" && material !== null && "expiresAt" in material
+    ? typeof (material as { readonly expiresAt?: unknown }).expiresAt === "number"
+      ? (material as { readonly expiresAt: number }).expiresAt
+      : undefined
+    : undefined;
+
+const oauth2RefreshToken = (material: unknown): string | undefined =>
+  typeof material === "object" && material !== null && "refreshToken" in material
+    ? typeof (material as { readonly refreshToken?: unknown }).refreshToken === "string" &&
+      (material as { readonly refreshToken: string }).refreshToken.trim() !== ""
+      ? (material as { readonly refreshToken: string }).refreshToken
+      : undefined
+    : undefined;
+
+const refreshOAuth2Decoded = Effect.fn("AuthMethod.refreshOAuth2Decoded")(function* (
+  method: AuthMethod.Any,
+  material: unknown,
+  context: AuthMethod.RefreshContext<unknown>,
+) {
+  if (
+    context.reason === "before-use" &&
+    (oauth2ExpiresAt(material) ?? Number.NEGATIVE_INFINITY) > context.now + context.minValidityMs
+  ) {
+    return undefined;
+  }
+
+  const refreshToken = oauth2RefreshToken(material);
+  if (refreshToken === undefined) {
+    return yield* new AuthMethod.OAuth2RefreshTokenUnavailableError({
+      methodIdentifier: method.identifier,
+    });
+  }
+
+  const refresher = yield* OAuth2TokenRefresher.Service;
+  const tokens = yield* runHook(method.identifier, "oauth2TokenRefresh", () =>
+    refresher.refresh({ method, refreshToken, setup: context.setup }),
+  );
+  return yield* prepareOAuth2Tokens(method, tokens, { setup: context.setup });
+});
+
+/**
+ * Decode and prepare submitted setup input into encrypted stored material.
+ *
+ * @since 0.0.0
+ * @category constructors
+ */
+export const prepare = prepareUnknown;
+
+/**
+ * Refresh already-decoded stored material when the auth method supports it.
+ *
+ * A result of `undefined` means the material is still usable and should not be
+ * persisted again.
+ *
+ * @since 0.0.0
+ * @category constructors
+ */
+export const refreshDecoded: <Method extends AuthMethod.Any>(
+  method: Method,
+  material: AuthMethod.Material<Method>,
+  context: AuthMethod.RefreshContext<AuthMethod.Setup<Method>>,
+) => Effect.Effect<
+  AuthMethod.Material<Method> | undefined,
+  | AuthMethod.ExpectedOAuth2MethodError
+  | AuthMethod.OAuth2RefreshTokenUnavailableError
+  | Schema.SchemaError
+  | AuthMethod.AuthMethodHookError,
+  MaterialRequirements<Method> | AuthMethod.Requirements<Method>
+> = (method, material, context) => {
+  const impl = toImpl(method);
+
+  if (impl.oauth2 !== undefined) {
+    return refreshOAuth2Decoded(method, material, context) as never;
+  }
+
+  const refresh = impl.refresh;
+  if (refresh === undefined) {
+    return Effect.void as never;
+  }
+
+  return runHook(impl.identifier, "refresh", () => refresh(material, context)).pipe(
+    Effect.flatMap(refreshed =>
+      refreshed === undefined ? Effect.void : Schema.decodeUnknownEffect(impl.material)(refreshed),
+    ),
+  ) as never;
+};
+
+/**
+ * Decode stored material and run the auth method refresh hook, if any.
+ *
+ * @since 0.0.0
+ * @category constructors
+ */
+export const refreshUnknown: <Method extends AuthMethod.Any>(
+  method: Method,
+  material: unknown,
+  context: AuthMethod.RefreshContext<AuthMethod.Setup<Method>>,
+) => Effect.Effect<
+  AuthMethod.Material<Method> | undefined,
+  | AuthMethod.ExpectedOAuth2MethodError
+  | AuthMethod.OAuth2RefreshTokenUnavailableError
+  | Schema.SchemaError
+  | AuthMethod.AuthMethodHookError,
+  MaterialRequirements<Method> | AuthMethod.Requirements<Method>
+> = (method, material, context) =>
+  decodeMaterial(method, material).pipe(
+    Effect.flatMap(decodedMaterial => refreshDecoded(method, decodedMaterial, context)),
+  );
+
+/**
+ * Prepare normalized OAuth2 token exchange output into encrypted stored material.
+ *
+ * OAuth2 has no frontend-submitted setup input. The platform owns redirect,
+ * callback, state/PKCE, and token exchange, then calls this helper at the
+ * token-response boundary.
+ *
+ * @since 0.0.0
+ * @category constructors
+ */
+export const prepareOAuth2Tokens: <Method extends AuthMethod.Any>(
+  method: Method,
+  tokens: AuthMethod.OAuth2TokenResponse,
+  context?: AuthMethod.HookContext<AuthMethod.Setup<Method>>,
+) => Effect.Effect<
+  AuthMethod.Material<Method>,
+  AuthMethod.ExpectedOAuth2MethodError | Schema.SchemaError | AuthMethod.AuthMethodHookError,
+  MaterialRequirements<Method> | AuthMethod.Requirements<Method>
+> = (method, tokens, context) => {
+  const impl = toImpl(method);
+
+  if (impl.oauth2 === undefined) {
+    return Effect.fail(
+      new AuthMethod.ExpectedOAuth2MethodError({ methodIdentifier: impl.identifier }),
+    ) as never;
+  }
+
+  const fromTokens = impl.oauth2.fromTokens;
+  const material: Effect.Effect<unknown, unknown, unknown> =
+    fromTokens === undefined
+      ? Effect.succeed(tokens)
+      : runHook(impl.identifier, "prepareOAuth2Tokens", () =>
+          fromTokens(tokens, hookContext(context)),
+        );
+
+  return material.pipe(
+    Effect.flatMap(value => Schema.decodeUnknownEffect(impl.material)(value)),
+  ) as never;
+};
+
+/**
+ * Resolve already-decoded stored material into the runtime value handlers receive.
+ *
+ * @since 0.0.0
+ * @category constructors
+ */
+export const resolveDecoded: <Method extends AuthMethod.Any>(
+  method: Method,
+  material: AuthMethod.Material<Method>,
+  context?: AuthMethod.HookContext<AuthMethod.Setup<Method>>,
+) => Effect.Effect<
+  AuthMethod.Value<Method>,
+  Schema.SchemaError | AuthMethod.AuthMethodHookError,
+  ValueRequirements<Method> | AuthMethod.Requirements<Method>
+> = (method, material, context) => {
+  const impl = toImpl(method);
+  const resolve = impl.resolve;
+
+  if (resolve === undefined) {
+    return (
+      impl.material === impl.value
+        ? Effect.succeed(material)
+        : Schema.decodeUnknownEffect(impl.schema)(material)
+    ) as never;
+  }
+
+  return runHook(impl.identifier, "resolve", () => resolve(material, hookContext(context))).pipe(
+    Effect.flatMap(value => Schema.decodeUnknownEffect(impl.schema)(value)),
+  ) as never;
+};
+
+/**
+ * Decode stored material and resolve it into the runtime value handlers receive.
+ *
+ * @since 0.0.0
+ * @category constructors
+ */
+export const resolve: <Method extends AuthMethod.Any>(
+  method: Method,
+  material: unknown,
+  context?: AuthMethod.HookContext<AuthMethod.Setup<Method>>,
+) => Effect.Effect<
+  AuthMethod.Value<Method>,
+  Schema.SchemaError | AuthMethod.AuthMethodHookError,
+  MaterialRequirements<Method> | ValueRequirements<Method> | AuthMethod.Requirements<Method>
+> = (method, material, context) =>
+  decodeMaterial(method, material).pipe(
+    Effect.flatMap(decodedMaterial => resolveDecoded(method, decodedMaterial, context)),
+  );
+
+/**
+ * Resolve untrusted persisted material into the runtime value handlers receive.
+ *
+ * This is the persistence-boundary variant of {@link resolve}: callers can pass
+ * raw JSON from storage and the method material schema is decoded before any
+ * provider hook runs.
+ *
+ * @since 0.0.0
+ * @category constructors
+ */
+export const resolveUnknown: typeof resolve = resolve;
+
+const jsonAuth = {
+  authMethodId: Schema.NonEmptyString,
+  providerId: Schema.NonEmptyString,
+  setup: Schema.optionalKey(Schema.Json),
+};
+
+/** Operation-specific authentication data for isolated execution. */
+export type JsonRequest = typeof JsonRequest.Type;
+export const JsonRequest = Schema.Union([
+  Schema.TaggedStruct("decodeSetup", jsonAuth),
+  Schema.TaggedStruct("prepare", { ...jsonAuth, input: Schema.Json }),
+  Schema.TaggedStruct("prepareOAuth2Tokens", {
+    ...jsonAuth,
+    tokens: Schema.Struct({
+      accessToken: Schema.String,
+      expiresAt: Schema.optionalKey(Schema.Number),
+      expiresIn: Schema.optionalKey(Schema.Number),
+      raw: Schema.Record(Schema.String, Schema.Json),
+      refreshToken: Schema.optionalKey(Schema.String),
+      scope: Schema.optionalKey(Schema.String),
+      tokenType: Schema.optionalKey(Schema.String),
+    }),
+  }),
+  Schema.TaggedStruct("refresh", {
+    ...jsonAuth,
+    material: Schema.Json,
+    minValidityMs: Schema.Finite.check(Schema.isGreaterThanOrEqualTo(0)),
+    now: Schema.Finite,
+    reason: Schema.Literals(["before-use", "forced"]),
+  }),
+  Schema.TaggedStruct("resolve", { ...jsonAuth, material: Schema.Json }),
+  Schema.TaggedStruct("display", { ...jsonAuth, material: Schema.Json }),
+  Schema.TaggedStruct("test", { ...jsonAuth, material: Schema.Json }),
+]);
+
+/** Decode canonical JSON once; executable hooks and codecs stay in the guest. */
+export const executeJson = Effect.fn("AuthMethod.executeJson")(function* (
+  method: AuthMethod.Any,
+  request: JsonRequest,
+) {
+  const decode = (schema: Schema.Top, value: unknown) =>
+    Schema.decodeUnknownEffect(Schema.toCodecJson(schema))(value);
+  const encode = (schema: Schema.Top, value: unknown) =>
+    Schema.encodeEffect(Schema.toCodecJson(schema))(value);
+  const setup = method.setup === undefined ? undefined : yield* decode(method.setup, request.setup);
+  if (request._tag === "decodeSetup") {
+    return method.setup === undefined ? undefined : yield* encode(method.setup, setup);
+  }
+  if (request._tag === "prepare") {
+    const input =
+      method.input === undefined ? undefined : yield* decode(method.input, request.input);
+    return yield* encode(method.material, yield* prepareDecoded(method, input, { setup }));
+  }
+  if (request._tag === "prepareOAuth2Tokens") {
+    return yield* encode(
+      method.material,
+      yield* prepareOAuth2Tokens(method, request.tokens, { setup }),
+    );
+  }
+  const material = yield* decode(method.material, request.material);
+  if (request._tag === "refresh") {
+    const refreshed = yield* refreshDecoded(method, material, { ...request, setup });
+    return refreshed === undefined ? undefined : yield* encode(method.material, refreshed);
+  }
+  if (request._tag === "resolve") {
+    return {
+      methodId: method.identifier,
+      providerId: request.providerId,
+      value: yield* encode(method.value, yield* resolveDecoded(method, material, { setup })),
+    };
+  }
+  const impl = toImpl(method);
+  if (request._tag === "display") {
+    const hook = impl.display;
+    return hook === undefined
+      ? undefined
+      : yield* runHook(method.identifier, "display", () => hook(material, { setup }));
+  }
+  const hook = impl.test;
+  return hook === undefined
+    ? { ok: true }
+    : yield* runHook(method.identifier, "test", () => hook(material, { setup }));
+});
+
+/** @since 0.0.0 @category constructors */
+export const display: <Method extends AuthMethod.Any>(
+  method: Method,
+  material: AuthMethod.Material<Method>,
+  context?: AuthMethod.HookContext<AuthMethod.Setup<Method>>,
+) => Effect.Effect<
+  AuthMethod.Display | undefined,
+  Schema.SchemaError | AuthMethod.AuthMethodHookError,
+  MaterialRequirements<Method> | AuthMethod.Requirements<Method>
+> = (method, material, context) => {
+  const impl = toImpl(method);
+  const displayHook = impl.display;
+
+  return decodeMaterial(method, material).pipe(
+    Effect.flatMap(decodedMaterial =>
+      displayHook === undefined
+        ? Effect.void
+        : runHook(impl.identifier, "display", () =>
+            displayHook(decodedMaterial, hookContext(context)),
+          ),
+    ),
+  ) as never;
+};
+
+/** @since 0.0.0 @category constructors */
+export const test: <Method extends AuthMethod.Any>(
+  method: Method,
+  material: AuthMethod.Material<Method>,
+  context?: AuthMethod.HookContext<AuthMethod.Setup<Method>>,
+) => Effect.Effect<
+  AuthMethod.TestResult,
+  Schema.SchemaError | AuthMethod.AuthMethodHookError,
+  MaterialRequirements<Method> | AuthMethod.Requirements<Method>
+> = (method, material, context) => {
+  const impl = toImpl(method);
+  const testHook = impl.test;
+
+  return decodeMaterial(method, material).pipe(
+    Effect.flatMap(decodedMaterial =>
+      testHook === undefined
+        ? Effect.succeed<AuthMethod.TestResult>({ ok: true })
+        : runHook(impl.identifier, "test", () => testHook(decodedMaterial, hookContext(context))),
+    ),
+  ) as never;
+};
+
+export * as AuthMethodExecution from "./AuthMethodExecution.ts";