@yielded/auth-persistence-drizzle 0.1.0-beta.22 → 0.1.0-beta.24

package/src/drizzle/oauth-flow.ts

@@ -1,462 +0,0 @@
-import {
-  type OAuthLinkClaim,
-  type OAuthClaim,
-  OAuthCleanupInput,
-  OAuthCredentialSnapshot,
-  OAuthPendingFlow,
-  OAuthModuleId,
-  type OAuthVerifiedExternalIdentity,
-  OAuthAccountRevision,
-  OAuthLinkPendingFlow,
-  snapshotOAuthSync,
-} from "@yielded/auth/OAuth";
-/* oxlint-disable no-explicit-any -- private kernel shared by concrete driver mappings. */
-import { eq, sql } from "drizzle-orm";
-import { Effect } from "effect";
-
-import type { SubjectIdCodec } from "./model";
-import { CurrentOAuthTransaction, type Row, both, col, copiedRow, equal } from "./oauth-owner";
-import { invariant, oauthIdentityKey, storage } from "./oauth-state";
-
-export const pendingStorage = storage(OAuthPendingFlow);
-export const linkStorage = storage(OAuthLinkPendingFlow);
-export const credentialStorage = storage(OAuthCredentialSnapshot);
-export const revisionStorage = storage(OAuthAccountRevision);
-export type Flow = typeof OAuthPendingFlow.Type | typeof OAuthLinkPendingFlow.Type;
-export type Claim = typeof OAuthClaim.Type | typeof OAuthLinkClaim.Type;
-
-export const flowKey = (mapping: any, context: Flow["context"]) => ({
-  [mapping.moduleId]: context.moduleId,
-  [mapping.flowId]: context.flowId,
-});
-
-export const flowStorage = (purpose: "sign-in" | "link") =>
-  purpose === "link" ? linkStorage : pendingStorage;
-
-const instant = (mapping: any, value: unknown): number => {
-  const millis = mapping.clock.decodeInstant(value);
-
-  invariant(Number.isSafeInteger(millis) && millis >= 0);
-
-  return millis;
-};
-
-export const readFlow = (
-  mapping: any,
-  input: { readonly moduleId: string; readonly flowId: string },
-  purpose: "sign-in" | "link",
-) =>
-  Effect.flatMap(CurrentOAuthTransaction, (owner) =>
-    Effect.gen(function* () {
-      const f = mapping.flow;
-
-      const observation = yield* owner.read(
-        f.table,
-        equal(f.table, {
-          [f.moduleId]: input.moduleId,
-          [f.flowId]: input.flowId,
-        }),
-        { limit: 1 },
-      );
-
-      const row = observation.rows[0];
-
-      if (row === undefined || row[f.purpose] !== purpose || row[f.snapshot] === null)
-        return { observation };
-      const flow = flowStorage(purpose).decode(row[f.snapshot]) as Flow;
-      const c = flow.context;
-
-      invariant(
-        row[f.moduleId] === c.moduleId &&
-          row[f.flowId] === c.flowId &&
-          row[f.commandId] === c.commandId &&
-          row[f.generation] === c.generation &&
-          row[f.stateDigest] === c.stateDigest &&
-          row[f.binderVerifier] === c.requestBindingVerifier &&
-          instant(mapping, row[f.binderExpiresAt]) === c.requestBindingExpiresAtMillis &&
-          instant(mapping, row[f.issuedAt]) === c.issuedAtMillis &&
-          instant(mapping, row[f.expiresAt]) === c.expiresAtMillis &&
-          instant(mapping, row[f.retentionUntil]) === flow.retentionUntilMillis,
-      );
-
-      return { observation, row, flow };
-    }),
-  );
-
-export const liveFlow = (flow: Flow, now: number) =>
-  flow.context.issuedAtMillis <= now &&
-  now < flow.context.expiresAtMillis &&
-  flow.context.expiresAtMillis <= flow.context.requestBindingExpiresAtMillis &&
-  flow.retentionUntilMillis >= flow.context.expiresAtMillis + flow.context.claimLifetimeMillis;
-
-export const issueFlow = (mapping: any, original: Flow, purpose: "sign-in" | "link") =>
-  Effect.flatMap(CurrentOAuthTransaction, (owner) =>
-    Effect.gen(function* () {
-      const codec = flowStorage(purpose);
-      const flow = codec.decode(codec.encode(original as never)) as Flow;
-
-      const f = mapping.flow,
-        c = flow.context,
-        now = yield* owner.now(mapping.clock);
-
-      if (!liveFlow(flow, now)) return { _tag: "Rejected" } as const;
-      const byFlow = yield* owner.read(f.table, equal(f.table, flowKey(f, c)), { limit: 1 });
-
-      const byCommand = yield* owner.read(
-        f.table,
-        equal(f.table, {
-          [f.moduleId]: c.moduleId,
-          [f.commandId]: c.commandId,
-        }),
-        { limit: 1 },
-      );
-
-      if (byFlow.rows.length || byCommand.rows.length) return { _tag: "Rejected" } as const;
-      const encode = mapping.clock.encodeInstant;
-
-      const values = {
-        ...f.encodeInsert({ moduleId: c.moduleId, flowId: c.flowId, purpose }),
-        ...flowKey(f, c),
-        [f.commandId]: c.commandId,
-        [f.purpose]: purpose,
-        [f.generation]: c.generation,
-        [f.state]: "Pending",
-        [f.version]: owner.marker,
-        [f.stateDigest]: c.stateDigest,
-        [f.binderVerifier]: c.requestBindingVerifier,
-        [f.binderExpiresAt]: encode(c.requestBindingExpiresAtMillis),
-        [f.snapshot]: codec.encode(flow as never),
-        [f.issuedAt]: encode(c.issuedAtMillis),
-        [f.expiresAt]: encode(c.expiresAtMillis),
-        [f.claimId]: null,
-        [f.claimedAt]: null,
-        [f.claimExpiresAt]: null,
-        [f.retentionUntil]: encode(flow.retentionUntilMillis),
-      };
-
-      const inserted = yield* owner.insert(f.table, values, flowKey(f, c), true);
-
-      byFlow.rows = inserted.rows;
-      byCommand.rows = inserted.rows;
-      if (inserted.rows[0]?.[f.version] !== owner.marker) return { _tag: "Rejected" } as const;
-      owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${c.issuedAtMillis}
-      and ${mapping.clock.engineNowMillis} < ${c.expiresAtMillis}`);
-
-      return { _tag: "Issued", flow } as const;
-    }),
-  );
-
-export const matchesAccess = (flow: Flow, input: any) => {
-  const c = flow.context;
-
-  return (
-    c.moduleId === input.moduleId &&
-    c.generation === input.generation &&
-    c.flowId === input.flowId &&
-    c.provider === input.provider &&
-    c.callbackId === input.callbackId &&
-    c.stateDigest === input.stateDigest &&
-    c.requestBindingVerifier === input.requestBindingVerifier &&
-    c.requestBindingExpiresAtMillis === input.requestBindingExpiresAtMillis &&
-    (c.responseIssuerMode === "required"
-      ? input.responseIssuer === c.issuer
-      : input.responseIssuer === undefined)
-  );
-};
-
-export const claimFlow = (mapping: any, inspected: { row: Row; flow: Flow }, claimId: string) =>
-  Effect.flatMap(CurrentOAuthTransaction, (owner) =>
-    Effect.gen(function* () {
-      const now = yield* owner.now(mapping.clock),
-        flow = inspected.flow,
-        c = flow.context;
-
-      if (inspected.row[mapping.flow.state] !== "Pending" || !liveFlow(flow, now)) return undefined;
-
-      const claim = {
-        flow,
-        claimId,
-        claimedAtMillis: now,
-        claimExpiresAtMillis: now + c.claimLifetimeMillis,
-      };
-
-      invariant(
-        Number.isSafeInteger(claim.claimExpiresAtMillis) &&
-          claim.claimExpiresAtMillis <= flow.retentionUntilMillis,
-      );
-
-      const f = mapping.flow,
-        encode = mapping.clock.encodeInstant;
-
-      yield* owner.update(f.table, flowKey(f, c), {
-        [f.state]: "Claimed",
-        [f.version]: owner.marker,
-        [f.claimId]: claimId,
-        [f.claimedAt]: encode(now),
-        [f.claimExpiresAt]: encode(claim.claimExpiresAtMillis),
-      });
-      owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${now} and
-      ${mapping.clock.engineNowMillis} < ${Math.min(c.expiresAtMillis, claim.claimExpiresAtMillis)}`);
-
-      return claim;
-    }),
-  );
-
-export const exactClaim = (mapping: any, claim: Claim, purpose: "sign-in" | "link") =>
-  Effect.flatMap(CurrentOAuthTransaction, (owner) =>
-    Effect.gen(function* () {
-      const read = yield* readFlow(mapping, claim.flow.context, purpose);
-
-      const now = yield* owner.now(mapping.clock),
-        f = mapping.flow,
-        row = read.row;
-
-      if (
-        row === undefined ||
-        read.flow === undefined ||
-        row[f.state] !== "Claimed" ||
-        row[f.claimId] !== claim.claimId ||
-        instant(mapping, row[f.claimedAt]) !== claim.claimedAtMillis ||
-        instant(mapping, row[f.claimExpiresAt]) !== claim.claimExpiresAtMillis ||
-        claim.claimExpiresAtMillis !==
-          claim.claimedAtMillis + claim.flow.context.claimLifetimeMillis ||
-        now < claim.claimedAtMillis ||
-        now >= claim.claimExpiresAtMillis ||
-        flowStorage(purpose).encode(read.flow as never) !==
-          flowStorage(purpose).encode(claim.flow as never)
-      )
-        return undefined;
-      owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${claim.claimedAtMillis} and
-      ${mapping.clock.engineNowMillis} < ${claim.claimExpiresAtMillis}`);
-
-      return { ...read, now };
-    }),
-  );
-
-export const terminalFlow = (mapping: any, flow: Flow, state: string) =>
-  Effect.flatMap(CurrentOAuthTransaction, (owner) =>
-    owner.update(mapping.flow.table, flowKey(mapping.flow, flow.context), {
-      [mapping.flow.state]: state,
-      [mapping.flow.version]: owner.marker,
-      [mapping.flow.snapshot]: null,
-    }),
-  );
-
-/** Subject precedes credentials; the complete active credential vector is retained. */
-export const currentSubject = (mapping: any, nativeId: unknown) =>
-  Effect.flatMap(CurrentOAuthTransaction, (owner) =>
-    Effect.gen(function* () {
-      const s = mapping.subject,
-        a = mapping.authority;
-
-      const subject = yield* owner.read(s.table, eq(col(s.table, s.id), nativeId), { limit: 1 });
-      const row = subject.rows[0];
-      const subjectActive = sql`exists(select 1 from ${s.table} where ${both(eq(col(s.table, s.id), nativeId), s.activeCondition)})`;
-
-      if (
-        row === undefined ||
-        !s.isActiveStatus(row[s.status]) ||
-        !(yield* owner.check(subjectActive))
-      )
-        return undefined;
-      owner.postconditions.push(subjectActive);
-
-      const authorities = yield* owner.read(a.table, eq(col(a.table, a.subjectId), nativeId), {
-        orderBy: col(a.table, a.credentialId),
-      });
-
-      const active = authorities.rows.filter((item) => a.isActiveStatus(item[a.status]));
-
-      const activeGuard = sql`(select count(*) from ${a.table} where ${both(
-        eq(col(a.table, a.subjectId), nativeId),
-        a.activeCondition,
-      )}) = ${active.length}`;
-
-      invariant(yield* owner.check(activeGuard));
-      owner.postconditions.push(
-        () => sql`(select count(*) from ${a.table} where ${both(
-          eq(col(a.table, a.subjectId), nativeId),
-          a.activeCondition,
-        )}) =
-      ${authorities.rows.filter((item) => a.isActiveStatus(item[a.status])).length}`,
-      );
-
-      const credentials = active
-        .map((item) => ({ credentialId: item[a.credentialId], revision: item[a.revision] }))
-        .sort((left, right) => left.credentialId.localeCompare(right.credentialId));
-
-      invariant(new Set(credentials.map((item) => item.credentialId)).size === credentials.length);
-      const subjectId = yield* (mapping.subjectId as SubjectIdCodec<unknown>).toSubject(nativeId);
-
-      const revision = snapshotOAuthSync(OAuthAccountRevision, {
-        subjectId,
-        securityRevision: row[s.securityRevision],
-        credentials,
-      });
-
-      return { subject, row, authorities, revision, nativeId };
-    }),
-  );
-
-export const discoverOwned = (mapping: any, identity: OAuthVerifiedExternalIdentity["identity"]) =>
-  Effect.flatMap(CurrentOAuthTransaction, (owner) =>
-    Effect.gen(function* () {
-      const key = yield* oauthIdentityKey(identity),
-        o = mapping.ownership;
-
-      const where = both(eq(col(o.table, o.identityKey), key), o.ownedCondition);
-
-      const discovered = yield* owner.read(o.table, where, {
-        lock: false,
-        observe: false,
-        limit: 1,
-      });
-
-      const row = discovered.rows[0];
-
-      if (row === undefined) return { key };
-      invariant(
-        row[o.provider] === identity.provider &&
-          row[o.issuer] === identity.issuer &&
-          row[o.externalSubject] === identity.subject,
-      );
-      const nativeId = o.decodeSubjectId(copiedRow(row));
-      const current = yield* currentSubject(mapping, nativeId);
-      const owned = yield* owner.read(o.table, where, { limit: 1 });
-      const final = owned.rows[0];
-
-      if (
-        current === undefined ||
-        final === undefined ||
-        !mapping.subjectId.equals(nativeId, o.decodeSubjectId(copiedRow(final)))
-      )
-        return { key, owned: true as const };
-      invariant(
-        final[o.provider] === identity.provider &&
-          final[o.issuer] === identity.issuer &&
-          final[o.externalSubject] === identity.subject,
-      );
-      const c = mapping.credential;
-
-      const credential = yield* owner.read(c.table, eq(col(c.table, c.identityKey), key), {
-        limit: 1,
-      });
-
-      let login: Row | undefined = credential.rows[0];
-
-      if (login !== undefined && c.isActiveStatus(login[c.status])) {
-        const usable = sql`exists(select 1 from ${c.table} where ${both(
-          eq(col(c.table, c.identityKey), key),
-          c.activeCondition,
-        )})`;
-
-        if (yield* owner.check(usable)) owner.postconditions.push(usable);
-        else login = undefined;
-      }
-
-      return { key, owned: true as const, current, credential, login };
-    }),
-  );
-
-export const resolveOwned = (
-  mapping: any,
-  moduleId: string,
-  identity: OAuthVerifiedExternalIdentity["identity"],
-  found: any,
-) => {
-  const login = found.login,
-    current = found.current,
-    c = mapping.credential;
-
-  if (
-    login === undefined ||
-    current === undefined ||
-    login[c.moduleId] !== moduleId ||
-    !mapping.subjectId.equals(login[c.subjectId], current.nativeId) ||
-    !c.isActiveStatus(login[c.status])
-  )
-    return undefined;
-
-  const shared = current.revision.credentials.find(
-    (item: any) => item.credentialId === login[c.credentialId],
-  );
-
-  if (shared?.revision !== login[c.credentialRevision]) return undefined;
-
-  return snapshotOAuthSync(OAuthCredentialSnapshot, {
-    moduleId: OAuthModuleId.make(moduleId),
-    identity,
-    credentialId: login[c.credentialId],
-    credentialRevision: login[c.credentialRevision],
-    revision: current.revision,
-  });
-};
-
-export const cleanupFlows = (
-  mapping: any,
-  original: typeof OAuthCleanupInput.Type,
-  purpose: "sign-in" | "link",
-) =>
-  Effect.flatMap(CurrentOAuthTransaction, (owner) =>
-    Effect.gen(function* () {
-      const input = snapshotOAuthSync(OAuthCleanupInput, original),
-        f = mapping.flow;
-
-      const now = yield* owner.now(mapping.clock);
-
-      const candidates = yield* owner.read(
-        f.table,
-        both(
-          eq(col(f.table, f.moduleId), input.moduleId),
-          eq(col(f.table, f.purpose), purpose),
-          sql`((${col(f.table, f.state)} = 'Pending' and ${col(f.table, f.expiresAt)} <= ${mapping.clock.encodeInstant(now)})
-      or (${col(f.table, f.state)} = 'Claimed' and ${col(f.table, f.claimExpiresAt)} <= ${mapping.clock.encodeInstant(now)})
-      or (${col(f.table, f.state)} not in ('Pending','Claimed') and ${col(f.table, f.retentionUntil)} < ${mapping.clock.encodeInstant(now)}))`,
-        ),
-        { limit: input.limit, observe: false, takeOnly: true },
-      );
-
-      let terminalized = 0,
-        removed = 0;
-
-      for (const candidate of candidates.rows) {
-        const key = { [f.moduleId]: candidate[f.moduleId], [f.flowId]: candidate[f.flowId] };
-        const current = yield* owner.read(f.table, equal(f.table, key), { limit: 1 });
-
-        if (current.rows.length !== 1) continue;
-
-        const row = current.rows[0]!,
-          transitionNow = yield* owner.now(mapping.clock);
-
-        const state = row[f.state];
-
-        if (state === "Pending" || state === "Claimed") {
-          const deadline = instant(
-            mapping,
-            row[state === "Pending" ? f.expiresAt : f.claimExpiresAt],
-          );
-
-          if (transitionNow < deadline) continue;
-          yield* owner.update(f.table, key, {
-            [f.state]: state === "Pending" ? "Rejected" : "Ambiguous",
-            [f.snapshot]: null,
-            [f.version]: owner.marker,
-          });
-          owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${deadline}`);
-          terminalized++;
-        } else {
-          const retainUntil = Math.max(
-            instant(mapping, row[f.retentionUntil]),
-            row[f.claimExpiresAt] === null ? 0 : instant(mapping, row[f.claimExpiresAt]),
-          );
-
-          if (transitionNow <= retainUntil) continue;
-          yield* owner.remove(f.table, key);
-          owner.postconditions.push(sql`${mapping.clock.engineNowMillis} > ${retainUntil}`);
-          removed++;
-        }
-      }
-
-      return { terminalized, removed, hasMore: candidates.rows.length === input.limit };
-    }),
-  );

package/src/drizzle/oauth-input.ts

@@ -1,201 +0,0 @@
-import {
-  OAuthAccountRevision,
-  OAuthActionAuthorization,
-  OAuthLinkAccess,
-  OAuthLinkClaim,
-  OAuthLinkOutcome,
-  OAuthLinkPendingFlow,
-  OAuthRegistrationAccess,
-  OAuthRegistrationFingerprint,
-  OAuthRegistrationIntent,
-  OAuthClaim,
-  OAuthClaimId,
-  OAuthCleanupInput,
-  OAuthCommandId,
-  OAuthCredentialSnapshot,
-  OAuthInstant,
-  OAuthModuleId,
-  OAuthPendingFlow,
-  OAuthSignInTransactionContext,
-  OAuthVerifiedExternalIdentity,
-  snapshotOAuthSync,
-  type OAuthUnavailable,
-} from "@yielded/auth/OAuth";
-import { SessionInvalidationWindow } from "@yielded/auth/Sessions";
-/* oxlint-disable no-explicit-any -- private adapter wraps only the Effect-valued semantic ports. */
-import { Effect, Schema } from "effect";
-
-import { invariant, unavailable } from "./oauth-state";
-
-const fields = OAuthSignInTransactionContext.fields;
-
-const claimInput = Schema.Struct({
-  moduleId: fields.moduleId,
-  generation: fields.generation,
-  flowId: fields.flowId,
-  provider: fields.provider,
-  callbackId: fields.callbackId,
-  stateDigest: fields.stateDigest,
-  requestBindingVerifier: fields.requestBindingVerifier,
-  requestBindingExpiresAtMillis: fields.requestBindingExpiresAtMillis,
-  responseIssuer: Schema.optionalKey(fields.issuer),
-  claimId: OAuthClaimId,
-  nowMillis: OAuthInstant,
-});
-
-const signInOutcome = Schema.Union([
-  Schema.TaggedStruct("Verified", { identity: OAuthVerifiedExternalIdentity }),
-  Schema.TaggedStruct("Cancelled", {}),
-  Schema.TaggedStruct("Rejected", {}),
-  Schema.TaggedStruct("Ambiguous", {}),
-]);
-
-const signInSettle = Schema.Struct({
-  claim: OAuthClaim,
-  outcome: signInOutcome,
-  nowMillis: OAuthInstant,
-});
-
-const registrationSettle = Schema.Struct({
-  claim: OAuthClaim,
-  identity: OAuthVerifiedExternalIdentity,
-  intent: Schema.optionalKey(OAuthRegistrationIntent),
-  nowMillis: OAuthInstant,
-});
-
-const registerPrivate = Schema.Struct({
-  access: OAuthRegistrationAccess,
-  intent: OAuthRegistrationIntent,
-  commandId: OAuthCommandId,
-  fingerprint: OAuthRegistrationFingerprint,
-});
-
-const capture = Schema.Struct({
-  moduleId: OAuthModuleId,
-  subjectId: OAuthAccountRevision.fields.subjectId,
-});
-
-const linkIssue = Schema.Struct({
-  flow: OAuthLinkPendingFlow,
-  authorization: OAuthActionAuthorization,
-});
-
-const linkClaim = Schema.Struct({
-  access: OAuthLinkAccess,
-  flow: OAuthLinkPendingFlow,
-  claimId: OAuthClaimId,
-  authorization: OAuthActionAuthorization,
-});
-
-const linkSettle = Schema.Struct({
-  claim: OAuthLinkClaim,
-  outcome: OAuthLinkOutcome,
-  authorization: OAuthActionAuthorization,
-  invalidation: SessionInvalidationWindow,
-  nowMillis: OAuthInstant,
-});
-
-const unlinkInspect = Schema.Struct({
-  moduleId: OAuthModuleId,
-  subjectId: OAuthAccountRevision.fields.subjectId,
-  commandId: OAuthCommandId,
-  credentialId: OAuthCredentialSnapshot.fields.credentialId,
-});
-
-const unlink = Schema.Struct({
-  moduleId: OAuthModuleId,
-  commandId: OAuthCommandId,
-  credential: OAuthCredentialSnapshot,
-  authorization: OAuthActionAuthorization,
-  invalidation: SessionInvalidationWindow,
-  nowMillis: OAuthInstant,
-  retentionUntilMillis: OAuthInstant,
-});
-
-const snapshot = (schema: Schema.Codec<any, any, never, never>) => (input: any) =>
-  snapshotOAuthSync(schema, input);
-
-export const signInInputs = {
-  issue: snapshot(OAuthPendingFlow),
-  claim: snapshot(claimInput),
-  settle: snapshot(signInSettle),
-  cleanup: snapshot(OAuthCleanupInput),
-};
-
-export const registrationIntentInputs = { settle: snapshot(registrationSettle) };
-
-const capturedApplication = (
-  application: { readonly encode: (data: any) => string; readonly decode: (stored: string) => any },
-  data: any,
-) => {
-  const encoded = application.encode(data);
-
-  invariant(typeof encoded === "string" && new TextEncoder().encode(encoded).length <= 1048576);
-  const retained = application.decode(encoded);
-
-  invariant(application.encode(retained) === encoded);
-
-  return retained;
-};
-
-export const registrationInputs = (application: {
-  readonly encode: (data: any) => string;
-  readonly decode: (stored: string) => any;
-}) => ({
-  read: snapshot(OAuthRegistrationAccess),
-  inspect: (input: any) => ({
-    intent: snapshotOAuthSync(OAuthRegistrationIntent, input.intent),
-    registration: capturedApplication(application, input.registration),
-  }),
-  register: (input: any) => ({
-    ...snapshotOAuthSync(registerPrivate, input),
-    registration: capturedApplication(application, input.registration),
-  }),
-  cleanup: snapshot(OAuthCleanupInput),
-});
-
-export const accountsInputs = {
-  capture: snapshot(capture),
-  issue: snapshot(linkIssue),
-  preflight: snapshot(OAuthLinkAccess),
-  claim: snapshot(linkClaim),
-  settle: snapshot(linkSettle),
-  inspectUnlink: snapshot(unlinkInspect),
-  unlink: snapshot(unlink),
-  cleanup: snapshot(OAuthCleanupInput),
-};
-
-/** Snapshot before the first asynchronous owner/allocator step; closed bound
- * authorities reject before running even an application codec or inspector. */
-export const capturedOAuthService = <
-  S extends { [K in keyof S]: (...args: any[]) => Effect.Effect<any, OAuthUnavailable> },
->(
-  service: S,
-  inputs: { readonly [K in keyof S]: (input: any) => any },
-  active: () => boolean,
-  poison: () => void,
-): S =>
-  Object.freeze(
-    Object.fromEntries(
-      Object.entries(service).map(([key, method]) => [
-        key,
-        (input: any, prepare?: any) =>
-          Effect.suspend(() => {
-            if (!active()) return Effect.fail(unavailable());
-            const retained = inputs[key as keyof S](input);
-
-            return (method as (...args: any[]) => Effect.Effect<any, OAuthUnavailable>)(
-              retained,
-              prepare,
-            );
-          }).pipe(
-            Effect.onExit((exit) =>
-              Effect.sync(() => {
-                if (exit._tag === "Failure") poison();
-              }),
-            ),
-            Effect.catchDefect(() => Effect.fail(unavailable())),
-          ),
-      ]),
-    ),
-  ) as S;

package/src/drizzle/oauth-owner.ts

@@ -1,29 +0,0 @@
-import type { CommitJournal } from "@yielded/auth/Hooks";
-import type { OAuthUnavailable } from "@yielded/auth/OAuth";
-/* oxlint-disable no-explicit-any -- private adapter preserves the existing driver boundary. */
-import { Context } from "effect";
-
-import { unavailable } from "./oauth-state";
-import {
-  makeTransactionOwner,
-  makeTransactionRows,
-  type TransactionNativeDatabase,
-  type TransactionOwner,
-} from "./transaction-owner";
-
-export { both, type Observation, type Row } from "./transaction-owner";
-export const { col, equal, copiedRow, matchesNativeRow } = makeTransactionRows(unavailable);
-export type OAuthOwner = TransactionOwner<OAuthUnavailable>;
-
-export class CurrentOAuthTransaction extends Context.Service<CurrentOAuthTransaction, OAuthOwner>()(
-  "effect-auth/drizzle/CurrentOAuthTransaction",
-) {}
-
-export type OAuthNativeDatabase = TransactionNativeDatabase;
-
-export const makeOAuthOwner = (
-  database: any,
-  journal: CommitJournal,
-  marker: string,
-  configuration: Parameters<typeof makeTransactionOwner>[4],
-): OAuthOwner => makeTransactionOwner(database, journal, marker, unavailable, configuration);