@yielded/auth-persistence 0.1.0-beta.23 → 0.1.0-beta.24

package/src/internal/oauth/flow.ts

@@ -0,0 +1,505 @@
+/* oxlint-disable no-explicit-any -- compiler table shapes are erased; domain codecs and error channels remain typed. */
+import {
+  type OAuthLinkClaim,
+  type OAuthClaim,
+  OAuthCleanupInput,
+  OAuthCredentialSnapshot,
+  OAuthPendingFlow,
+  OAuthModuleId,
+  type OAuthVerifiedExternalIdentity,
+  OAuthAccountRevision,
+  OAuthLinkPendingFlow,
+  snapshotOAuthSync,
+} from "@yielded/auth/OAuth";
+import { Effect, Context, Layer } from "effect";
+
+import type { SubjectIdCodec } from "../models/common";
+import { CurrentOAuthTransaction } from "./owner";
+import type { Row } from "./owner";
+import { OAuthQueryCompiler } from "./query-compiler";
+import { invariant, oauthIdentityKey, storage } from "./state";
+
+export type Flow = typeof OAuthPendingFlow.Type | typeof OAuthLinkPendingFlow.Type;
+
+export type Claim = typeof OAuthClaim.Type | typeof OAuthLinkClaim.Type;
+
+const make = Effect.gen(function* () {
+  const operations = yield* OAuthQueryCompiler;
+
+  const { eq, sql } = operations;
+  const { both, col, copiedRow, equal } = operations;
+
+  const pendingStorage = storage(OAuthPendingFlow);
+
+  const linkStorage = storage(OAuthLinkPendingFlow);
+
+  const credentialStorage = storage(OAuthCredentialSnapshot);
+
+  const revisionStorage = storage(OAuthAccountRevision);
+
+  const flowKey = (mapping: any, context: Flow["context"]) => ({
+    [mapping.moduleId]: context.moduleId,
+    [mapping.flowId]: context.flowId,
+  });
+
+  const flowStorage = (purpose: "sign-in" | "link") =>
+    purpose === "link" ? linkStorage : pendingStorage;
+
+  const instant = (mapping: any, value: unknown): number => {
+    const millis = mapping.clock.decodeInstant(value);
+
+    invariant(Number.isSafeInteger(millis) && millis >= 0);
+
+    return millis;
+  };
+
+  const readFlow = (
+    mapping: any,
+    input: { readonly moduleId: string; readonly flowId: string },
+    purpose: "sign-in" | "link",
+  ) =>
+    Effect.flatMap(CurrentOAuthTransaction, (owner) =>
+      Effect.gen(function* () {
+        const f = mapping.flow;
+
+        const observation = yield* owner.read(
+          f.table,
+          equal(f.table, {
+            [f.moduleId]: input.moduleId,
+            [f.flowId]: input.flowId,
+          }),
+          { limit: 1 },
+        );
+
+        const row = observation.rows[0];
+
+        if (row === undefined || row[f.purpose] !== purpose || row[f.snapshot] === null)
+          return { observation };
+        const flow = flowStorage(purpose).decode(row[f.snapshot]) as Flow;
+        const c = flow.context;
+
+        invariant(
+          row[f.moduleId] === c.moduleId &&
+            row[f.flowId] === c.flowId &&
+            row[f.commandId] === c.commandId &&
+            row[f.generation] === c.generation &&
+            row[f.stateDigest] === c.stateDigest &&
+            row[f.binderVerifier] === c.requestBindingVerifier &&
+            instant(mapping, row[f.binderExpiresAt]) === c.requestBindingExpiresAtMillis &&
+            instant(mapping, row[f.issuedAt]) === c.issuedAtMillis &&
+            instant(mapping, row[f.expiresAt]) === c.expiresAtMillis &&
+            instant(mapping, row[f.retentionUntil]) === flow.retentionUntilMillis,
+        );
+
+        return { observation, row, flow };
+      }),
+    );
+
+  const liveFlow = (flow: Flow, now: number) =>
+    flow.context.issuedAtMillis <= now &&
+    now < flow.context.expiresAtMillis &&
+    flow.context.expiresAtMillis <= flow.context.requestBindingExpiresAtMillis &&
+    flow.retentionUntilMillis >= flow.context.expiresAtMillis + flow.context.claimLifetimeMillis;
+
+  const issueFlow = (mapping: any, original: Flow, purpose: "sign-in" | "link") =>
+    Effect.flatMap(CurrentOAuthTransaction, (owner) =>
+      Effect.gen(function* () {
+        const codec = flowStorage(purpose);
+        const flow = codec.decode(codec.encode(original as never)) as Flow;
+
+        const f = mapping.flow,
+          c = flow.context,
+          now = yield* owner.now(mapping.clock);
+
+        if (!liveFlow(flow, now)) return { _tag: "Rejected" } as const;
+        const byFlow = yield* owner.read(f.table, equal(f.table, flowKey(f, c)), { limit: 1 });
+
+        const byCommand = yield* owner.read(
+          f.table,
+          equal(f.table, {
+            [f.moduleId]: c.moduleId,
+            [f.commandId]: c.commandId,
+          }),
+          { limit: 1 },
+        );
+
+        if (byFlow.rows.length || byCommand.rows.length) return { _tag: "Rejected" } as const;
+        const encode = mapping.clock.encodeInstant;
+
+        const values = {
+          ...f.encodeInsert({ moduleId: c.moduleId, flowId: c.flowId, purpose }),
+          ...flowKey(f, c),
+          [f.commandId]: c.commandId,
+          [f.purpose]: purpose,
+          [f.generation]: c.generation,
+          [f.state]: "Pending",
+          [f.version]: owner.marker,
+          [f.stateDigest]: c.stateDigest,
+          [f.binderVerifier]: c.requestBindingVerifier,
+          [f.binderExpiresAt]: encode(c.requestBindingExpiresAtMillis),
+          [f.snapshot]: codec.encode(flow as never),
+          [f.issuedAt]: encode(c.issuedAtMillis),
+          [f.expiresAt]: encode(c.expiresAtMillis),
+          [f.claimId]: null,
+          [f.claimedAt]: null,
+          [f.claimExpiresAt]: null,
+          [f.retentionUntil]: encode(flow.retentionUntilMillis),
+        };
+
+        const inserted = yield* owner.insert(f.table, values, flowKey(f, c), true);
+
+        byFlow.rows = inserted.rows;
+        byCommand.rows = inserted.rows;
+        if (inserted.rows[0]?.[f.version] !== owner.marker) return { _tag: "Rejected" } as const;
+        owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${c.issuedAtMillis}
+      and ${mapping.clock.engineNowMillis} < ${c.expiresAtMillis}`);
+
+        return { _tag: "Issued", flow } as const;
+      }),
+    );
+
+  const matchesAccess = (flow: Flow, input: any) => {
+    const c = flow.context;
+
+    return (
+      c.moduleId === input.moduleId &&
+      c.generation === input.generation &&
+      c.flowId === input.flowId &&
+      c.provider === input.provider &&
+      c.callbackId === input.callbackId &&
+      c.stateDigest === input.stateDigest &&
+      c.requestBindingVerifier === input.requestBindingVerifier &&
+      c.requestBindingExpiresAtMillis === input.requestBindingExpiresAtMillis &&
+      (c.responseIssuerMode === "required"
+        ? input.responseIssuer === c.issuer
+        : input.responseIssuer === undefined)
+    );
+  };
+
+  const claimFlow = (mapping: any, inspected: { row: Row; flow: Flow }, claimId: string) =>
+    Effect.flatMap(CurrentOAuthTransaction, (owner) =>
+      Effect.gen(function* () {
+        const now = yield* owner.now(mapping.clock),
+          flow = inspected.flow,
+          c = flow.context;
+
+        if (inspected.row[mapping.flow.state] !== "Pending" || !liveFlow(flow, now))
+          return undefined;
+
+        const claim = {
+          flow,
+          claimId,
+          claimedAtMillis: now,
+          claimExpiresAtMillis: now + c.claimLifetimeMillis,
+        };
+
+        invariant(
+          Number.isSafeInteger(claim.claimExpiresAtMillis) &&
+            claim.claimExpiresAtMillis <= flow.retentionUntilMillis,
+        );
+
+        const f = mapping.flow,
+          encode = mapping.clock.encodeInstant;
+
+        yield* owner.update(f.table, flowKey(f, c), {
+          [f.state]: "Claimed",
+          [f.version]: owner.marker,
+          [f.claimId]: claimId,
+          [f.claimedAt]: encode(now),
+          [f.claimExpiresAt]: encode(claim.claimExpiresAtMillis),
+        });
+        owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${now} and
+      ${mapping.clock.engineNowMillis} < ${Math.min(c.expiresAtMillis, claim.claimExpiresAtMillis)}`);
+
+        return claim;
+      }),
+    );
+
+  const exactClaim = (mapping: any, claim: Claim, purpose: "sign-in" | "link") =>
+    Effect.flatMap(CurrentOAuthTransaction, (owner) =>
+      Effect.gen(function* () {
+        const read = yield* readFlow(mapping, claim.flow.context, purpose);
+
+        const now = yield* owner.now(mapping.clock),
+          f = mapping.flow,
+          row = read.row;
+
+        if (
+          row === undefined ||
+          read.flow === undefined ||
+          row[f.state] !== "Claimed" ||
+          row[f.claimId] !== claim.claimId ||
+          instant(mapping, row[f.claimedAt]) !== claim.claimedAtMillis ||
+          instant(mapping, row[f.claimExpiresAt]) !== claim.claimExpiresAtMillis ||
+          claim.claimExpiresAtMillis !==
+            claim.claimedAtMillis + claim.flow.context.claimLifetimeMillis ||
+          now < claim.claimedAtMillis ||
+          now >= claim.claimExpiresAtMillis ||
+          flowStorage(purpose).encode(read.flow as never) !==
+            flowStorage(purpose).encode(claim.flow as never)
+        )
+          return undefined;
+        owner.postconditions
+          .push(sql`${mapping.clock.engineNowMillis} >= ${claim.claimedAtMillis} and
+      ${mapping.clock.engineNowMillis} < ${claim.claimExpiresAtMillis}`);
+
+        return { ...read, now };
+      }),
+    );
+
+  const terminalFlow = (mapping: any, flow: Flow, state: string) =>
+    Effect.flatMap(CurrentOAuthTransaction, (owner) =>
+      owner.update(mapping.flow.table, flowKey(mapping.flow, flow.context), {
+        [mapping.flow.state]: state,
+        [mapping.flow.version]: owner.marker,
+        [mapping.flow.snapshot]: null,
+      }),
+    );
+
+  /** Subject precedes credentials; the complete active credential vector is retained. */
+  const currentSubject = (mapping: any, nativeId: unknown) =>
+    Effect.flatMap(CurrentOAuthTransaction, (owner) =>
+      Effect.gen(function* () {
+        const s = mapping.subject,
+          a = mapping.authority;
+
+        const subject = yield* owner.read(s.table, eq(col(s.table, s.id), nativeId), { limit: 1 });
+        const row = subject.rows[0];
+        const subjectActive = sql`exists(select 1 from ${s.table} where ${both(eq(col(s.table, s.id), nativeId), s.activeCondition)})`;
+
+        if (
+          row === undefined ||
+          !s.isActiveStatus(row[s.status]) ||
+          !(yield* owner.check(subjectActive))
+        )
+          return undefined;
+        owner.postconditions.push(subjectActive);
+
+        const authorities = yield* owner.read(a.table, eq(col(a.table, a.subjectId), nativeId), {
+          orderBy: col(a.table, a.credentialId),
+        });
+
+        const active = authorities.rows.filter((item) => a.isActiveStatus(item[a.status]));
+
+        const activeGuard = sql`(select count(*) from ${a.table} where ${both(
+          eq(col(a.table, a.subjectId), nativeId),
+          a.activeCondition,
+        )}) = ${active.length}`;
+
+        invariant(yield* owner.check(activeGuard));
+        owner.postconditions.push(
+          () => sql`(select count(*) from ${a.table} where ${both(
+            eq(col(a.table, a.subjectId), nativeId),
+            a.activeCondition,
+          )}) =
+      ${authorities.rows.filter((item) => a.isActiveStatus(item[a.status])).length}`,
+        );
+
+        const credentials = active
+          .map((item) => ({ credentialId: item[a.credentialId], revision: item[a.revision] }))
+          .sort((left, right) => left.credentialId.localeCompare(right.credentialId));
+
+        invariant(
+          new Set(credentials.map((item) => item.credentialId)).size === credentials.length,
+        );
+        const subjectId = yield* (mapping.subjectId as SubjectIdCodec<unknown>).toSubject(nativeId);
+
+        const revision = snapshotOAuthSync(OAuthAccountRevision, {
+          subjectId,
+          securityRevision: row[s.securityRevision],
+          credentials,
+        });
+
+        return { subject, row, authorities, revision, nativeId };
+      }),
+    );
+
+  const discoverOwned = (mapping: any, identity: OAuthVerifiedExternalIdentity["identity"]) =>
+    Effect.flatMap(CurrentOAuthTransaction, (owner) =>
+      Effect.gen(function* () {
+        const key = yield* oauthIdentityKey(identity),
+          o = mapping.ownership;
+
+        const where = both(eq(col(o.table, o.identityKey), key), o.ownedCondition);
+
+        const discovered = yield* owner.read(o.table, where, {
+          lock: false,
+          observe: false,
+          limit: 1,
+        });
+
+        const row = discovered.rows[0];
+
+        if (row === undefined) return { key };
+        invariant(
+          row[o.provider] === identity.provider &&
+            row[o.issuer] === identity.issuer &&
+            row[o.externalSubject] === identity.subject,
+        );
+        const nativeId = o.decodeSubjectId(copiedRow(row));
+        const current = yield* currentSubject(mapping, nativeId);
+        const owned = yield* owner.read(o.table, where, { limit: 1 });
+        const final = owned.rows[0];
+
+        if (
+          current === undefined ||
+          final === undefined ||
+          !mapping.subjectId.equals(nativeId, o.decodeSubjectId(copiedRow(final)))
+        )
+          return { key, owned: true as const };
+        invariant(
+          final[o.provider] === identity.provider &&
+            final[o.issuer] === identity.issuer &&
+            final[o.externalSubject] === identity.subject,
+        );
+        const c = mapping.credential;
+
+        const credential = yield* owner.read(c.table, eq(col(c.table, c.identityKey), key), {
+          limit: 1,
+        });
+
+        let login: Row | undefined = credential.rows[0];
+
+        if (login !== undefined && c.isActiveStatus(login[c.status])) {
+          const usable = sql`exists(select 1 from ${c.table} where ${both(
+            eq(col(c.table, c.identityKey), key),
+            c.activeCondition,
+          )})`;
+
+          if (yield* owner.check(usable)) owner.postconditions.push(usable);
+          else login = undefined;
+        }
+
+        return { key, owned: true as const, current, credential, login };
+      }),
+    );
+
+  const resolveOwned = (
+    mapping: any,
+    moduleId: string,
+    identity: OAuthVerifiedExternalIdentity["identity"],
+    found: any,
+  ) => {
+    const login = found.login,
+      current = found.current,
+      c = mapping.credential;
+
+    if (
+      login === undefined ||
+      current === undefined ||
+      login[c.moduleId] !== moduleId ||
+      !mapping.subjectId.equals(login[c.subjectId], current.nativeId) ||
+      !c.isActiveStatus(login[c.status])
+    )
+      return undefined;
+
+    const shared = current.revision.credentials.find(
+      (item: any) => item.credentialId === login[c.credentialId],
+    );
+
+    if (shared?.revision !== login[c.credentialRevision]) return undefined;
+
+    return snapshotOAuthSync(OAuthCredentialSnapshot, {
+      moduleId: OAuthModuleId.make(moduleId),
+      identity,
+      credentialId: login[c.credentialId],
+      credentialRevision: login[c.credentialRevision],
+      revision: current.revision,
+    });
+  };
+
+  const cleanupFlows = (
+    mapping: any,
+    original: typeof OAuthCleanupInput.Type,
+    purpose: "sign-in" | "link",
+  ) =>
+    Effect.flatMap(CurrentOAuthTransaction, (owner) =>
+      Effect.gen(function* () {
+        const input = snapshotOAuthSync(OAuthCleanupInput, original),
+          f = mapping.flow;
+
+        const now = yield* owner.now(mapping.clock);
+
+        const candidates = yield* owner.read(
+          f.table,
+          both(
+            eq(col(f.table, f.moduleId), input.moduleId),
+            eq(col(f.table, f.purpose), purpose),
+            sql`((${col(f.table, f.state)} = 'Pending' and ${col(f.table, f.expiresAt)} <= ${mapping.clock.encodeInstant(now)})
+      or (${col(f.table, f.state)} = 'Claimed' and ${col(f.table, f.claimExpiresAt)} <= ${mapping.clock.encodeInstant(now)})
+      or (${col(f.table, f.state)} not in ('Pending','Claimed') and ${col(f.table, f.retentionUntil)} < ${mapping.clock.encodeInstant(now)}))`,
+          ),
+          { limit: input.limit, observe: false, takeOnly: true },
+        );
+
+        let terminalized = 0,
+          removed = 0;
+
+        for (const candidate of candidates.rows) {
+          const key = { [f.moduleId]: candidate[f.moduleId], [f.flowId]: candidate[f.flowId] };
+          const current = yield* owner.read(f.table, equal(f.table, key), { limit: 1 });
+
+          if (current.rows.length !== 1) continue;
+
+          const row = current.rows[0]!,
+            transitionNow = yield* owner.now(mapping.clock);
+
+          const state = row[f.state];
+
+          if (state === "Pending" || state === "Claimed") {
+            const deadline = instant(
+              mapping,
+              row[state === "Pending" ? f.expiresAt : f.claimExpiresAt],
+            );
+
+            if (transitionNow < deadline) continue;
+            yield* owner.update(f.table, key, {
+              [f.state]: state === "Pending" ? "Rejected" : "Ambiguous",
+              [f.snapshot]: null,
+              [f.version]: owner.marker,
+            });
+            owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${deadline}`);
+            terminalized++;
+          } else {
+            const retainUntil = Math.max(
+              instant(mapping, row[f.retentionUntil]),
+              row[f.claimExpiresAt] === null ? 0 : instant(mapping, row[f.claimExpiresAt]),
+            );
+
+            if (transitionNow <= retainUntil) continue;
+            yield* owner.remove(f.table, key);
+            owner.postconditions.push(sql`${mapping.clock.engineNowMillis} > ${retainUntil}`);
+            removed++;
+          }
+        }
+
+        return { terminalized, removed, hasMore: candidates.rows.length === input.limit };
+      }),
+    );
+
+  return {
+    pendingStorage,
+    linkStorage,
+    credentialStorage,
+    revisionStorage,
+    flowKey,
+    flowStorage,
+    readFlow,
+    liveFlow,
+    issueFlow,
+    matchesAccess,
+    claimFlow,
+    exactClaim,
+    terminalFlow,
+    currentSubject,
+    discoverOwned,
+    resolveOwned,
+    cleanupFlows,
+  };
+});
+
+export class OAuthFlow extends Context.Service<OAuthFlow, Effect.Success<typeof make>>()(
+  "effect-auth/persistence/OAuthFlow",
+) {
+  static readonly layer = Layer.effect(OAuthFlow, make);
+}

package/src/internal/oauth/input.ts

@@ -0,0 +1,201 @@
+import {
+  OAuthAccountRevision,
+  OAuthActionAuthorization,
+  OAuthLinkAccess,
+  OAuthLinkClaim,
+  OAuthLinkOutcome,
+  OAuthLinkPendingFlow,
+  OAuthRegistrationAccess,
+  OAuthRegistrationFingerprint,
+  OAuthRegistrationIntent,
+  OAuthClaim,
+  OAuthClaimId,
+  OAuthCleanupInput,
+  OAuthCommandId,
+  OAuthCredentialSnapshot,
+  OAuthInstant,
+  OAuthModuleId,
+  OAuthPendingFlow,
+  OAuthSignInTransactionContext,
+  OAuthVerifiedExternalIdentity,
+  snapshotOAuthSync,
+  type OAuthUnavailable,
+} from "@yielded/auth/OAuth";
+import { SessionInvalidationWindow } from "@yielded/auth/Sessions";
+/* oxlint-disable no-explicit-any -- private adapter wraps only the Effect-valued semantic ports. */
+import { Effect, Schema } from "effect";
+
+import { invariant, unavailable } from "./state";
+
+const fields = OAuthSignInTransactionContext.fields;
+
+const claimInput = Schema.Struct({
+  moduleId: fields.moduleId,
+  generation: fields.generation,
+  flowId: fields.flowId,
+  provider: fields.provider,
+  callbackId: fields.callbackId,
+  stateDigest: fields.stateDigest,
+  requestBindingVerifier: fields.requestBindingVerifier,
+  requestBindingExpiresAtMillis: fields.requestBindingExpiresAtMillis,
+  responseIssuer: Schema.optionalKey(fields.issuer),
+  claimId: OAuthClaimId,
+  nowMillis: OAuthInstant,
+});
+
+const signInOutcome = Schema.Union([
+  Schema.TaggedStruct("Verified", { identity: OAuthVerifiedExternalIdentity }),
+  Schema.TaggedStruct("Cancelled", {}),
+  Schema.TaggedStruct("Rejected", {}),
+  Schema.TaggedStruct("Ambiguous", {}),
+]);
+
+const signInSettle = Schema.Struct({
+  claim: OAuthClaim,
+  outcome: signInOutcome,
+  nowMillis: OAuthInstant,
+});
+
+const registrationSettle = Schema.Struct({
+  claim: OAuthClaim,
+  identity: OAuthVerifiedExternalIdentity,
+  intent: Schema.optionalKey(OAuthRegistrationIntent),
+  nowMillis: OAuthInstant,
+});
+
+const registerPrivate = Schema.Struct({
+  access: OAuthRegistrationAccess,
+  intent: OAuthRegistrationIntent,
+  commandId: OAuthCommandId,
+  fingerprint: OAuthRegistrationFingerprint,
+});
+
+const capture = Schema.Struct({
+  moduleId: OAuthModuleId,
+  subjectId: OAuthAccountRevision.fields.subjectId,
+});
+
+const linkIssue = Schema.Struct({
+  flow: OAuthLinkPendingFlow,
+  authorization: OAuthActionAuthorization,
+});
+
+const linkClaim = Schema.Struct({
+  access: OAuthLinkAccess,
+  flow: OAuthLinkPendingFlow,
+  claimId: OAuthClaimId,
+  authorization: OAuthActionAuthorization,
+});
+
+const linkSettle = Schema.Struct({
+  claim: OAuthLinkClaim,
+  outcome: OAuthLinkOutcome,
+  authorization: OAuthActionAuthorization,
+  invalidation: SessionInvalidationWindow,
+  nowMillis: OAuthInstant,
+});
+
+const unlinkInspect = Schema.Struct({
+  moduleId: OAuthModuleId,
+  subjectId: OAuthAccountRevision.fields.subjectId,
+  commandId: OAuthCommandId,
+  credentialId: OAuthCredentialSnapshot.fields.credentialId,
+});
+
+const unlink = Schema.Struct({
+  moduleId: OAuthModuleId,
+  commandId: OAuthCommandId,
+  credential: OAuthCredentialSnapshot,
+  authorization: OAuthActionAuthorization,
+  invalidation: SessionInvalidationWindow,
+  nowMillis: OAuthInstant,
+  retentionUntilMillis: OAuthInstant,
+});
+
+const snapshot = (schema: Schema.Codec<any, any, never, never>) => (input: any) =>
+  snapshotOAuthSync(schema, input);
+
+export const signInInputs = {
+  issue: snapshot(OAuthPendingFlow),
+  claim: snapshot(claimInput),
+  settle: snapshot(signInSettle),
+  cleanup: snapshot(OAuthCleanupInput),
+};
+
+export const registrationIntentInputs = { settle: snapshot(registrationSettle) };
+
+const capturedApplication = (
+  application: { readonly encode: (data: any) => string; readonly decode: (stored: string) => any },
+  data: any,
+) => {
+  const encoded = application.encode(data);
+
+  invariant(typeof encoded === "string" && new TextEncoder().encode(encoded).length <= 1048576);
+  const retained = application.decode(encoded);
+
+  invariant(application.encode(retained) === encoded);
+
+  return retained;
+};
+
+export const registrationInputs = (application: {
+  readonly encode: (data: any) => string;
+  readonly decode: (stored: string) => any;
+}) => ({
+  read: snapshot(OAuthRegistrationAccess),
+  inspect: (input: any) => ({
+    intent: snapshotOAuthSync(OAuthRegistrationIntent, input.intent),
+    registration: capturedApplication(application, input.registration),
+  }),
+  register: (input: any) => ({
+    ...snapshotOAuthSync(registerPrivate, input),
+    registration: capturedApplication(application, input.registration),
+  }),
+  cleanup: snapshot(OAuthCleanupInput),
+});
+
+export const accountsInputs = {
+  capture: snapshot(capture),
+  issue: snapshot(linkIssue),
+  preflight: snapshot(OAuthLinkAccess),
+  claim: snapshot(linkClaim),
+  settle: snapshot(linkSettle),
+  inspectUnlink: snapshot(unlinkInspect),
+  unlink: snapshot(unlink),
+  cleanup: snapshot(OAuthCleanupInput),
+};
+
+/** Snapshot before the first asynchronous owner/allocator step; closed bound
+ * authorities reject before running even an application codec or inspector. */
+export const capturedOAuthService = <
+  S extends { [K in keyof S]: (...args: any[]) => Effect.Effect<any, OAuthUnavailable> },
+>(
+  service: S,
+  inputs: { readonly [K in keyof S]: (input: any) => any },
+  active: () => boolean,
+  poison: () => void,
+): S =>
+  Object.freeze(
+    Object.fromEntries(
+      Object.entries(service).map(([key, method]) => [
+        key,
+        (input: any, prepare?: any) =>
+          Effect.suspend(() => {
+            if (!active()) return Effect.fail(unavailable());
+            const retained = inputs[key as keyof S](input);
+
+            return (method as (...args: any[]) => Effect.Effect<any, OAuthUnavailable>)(
+              retained,
+              prepare,
+            );
+          }).pipe(
+            Effect.onExit((exit) =>
+              Effect.sync(() => {
+                if (exit._tag === "Failure") poison();
+              }),
+            ),
+            Effect.catchDefect(() => Effect.fail(unavailable())),
+          ),
+      ]),
+    ),
+  ) as S;