@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.27

package/src/internal/oauth/flow.ts

@@ -1,505 +0,0 @@
-/* oxlint-disable no-explicit-any -- compiler table shapes are erased; domain codecs and error channels remain typed. */
-import {
-  type OAuthLinkClaim,
-  type OAuthClaim,
-  OAuthCleanupInput,
-  OAuthCredentialSnapshot,
-  OAuthPendingFlow,
-  OAuthModuleId,
-  type OAuthVerifiedExternalIdentity,
-  OAuthAccountRevision,
-  OAuthLinkPendingFlow,
-  snapshotOAuthSync,
-} from "@yielded/auth/OAuth";
-import { Effect, Context, Layer } from "effect";
-
-import type { SubjectIdCodec } from "../models/common";
-import { CurrentOAuthTransaction } from "./owner";
-import type { Row } from "./owner";
-import { OAuthQueryCompiler } from "./query-compiler";
-import { invariant, oauthIdentityKey, storage } from "./state";
-
-export type Flow = typeof OAuthPendingFlow.Type | typeof OAuthLinkPendingFlow.Type;
-
-export type Claim = typeof OAuthClaim.Type | typeof OAuthLinkClaim.Type;
-
-const make = Effect.gen(function* () {
-  const operations = yield* OAuthQueryCompiler;
-
-  const { eq, sql } = operations;
-  const { both, col, copiedRow, equal } = operations;
-
-  const pendingStorage = storage(OAuthPendingFlow);
-
-  const linkStorage = storage(OAuthLinkPendingFlow);
-
-  const credentialStorage = storage(OAuthCredentialSnapshot);
-
-  const revisionStorage = storage(OAuthAccountRevision);
-
-  const flowKey = (mapping: any, context: Flow["context"]) => ({
-    [mapping.moduleId]: context.moduleId,
-    [mapping.flowId]: context.flowId,
-  });
-
-  const flowStorage = (purpose: "sign-in" | "link") =>
-    purpose === "link" ? linkStorage : pendingStorage;
-
-  const instant = (mapping: any, value: unknown): number => {
-    const millis = mapping.clock.decodeInstant(value);
-
-    invariant(Number.isSafeInteger(millis) && millis >= 0);
-
-    return millis;
-  };
-
-  const readFlow = (
-    mapping: any,
-    input: { readonly moduleId: string; readonly flowId: string },
-    purpose: "sign-in" | "link",
-  ) =>
-    Effect.flatMap(CurrentOAuthTransaction, (owner) =>
-      Effect.gen(function* () {
-        const f = mapping.flow;
-
-        const observation = yield* owner.read(
-          f.table,
-          equal(f.table, {
-            [f.moduleId]: input.moduleId,
-            [f.flowId]: input.flowId,
-          }),
-          { limit: 1 },
-        );
-
-        const row = observation.rows[0];
-
-        if (row === undefined || row[f.purpose] !== purpose || row[f.snapshot] === null)
-          return { observation };
-        const flow = flowStorage(purpose).decode(row[f.snapshot]) as Flow;
-        const c = flow.context;
-
-        invariant(
-          row[f.moduleId] === c.moduleId &&
-            row[f.flowId] === c.flowId &&
-            row[f.commandId] === c.commandId &&
-            row[f.generation] === c.generation &&
-            row[f.stateDigest] === c.stateDigest &&
-            row[f.binderVerifier] === c.requestBindingVerifier &&
-            instant(mapping, row[f.binderExpiresAt]) === c.requestBindingExpiresAtMillis &&
-            instant(mapping, row[f.issuedAt]) === c.issuedAtMillis &&
-            instant(mapping, row[f.expiresAt]) === c.expiresAtMillis &&
-            instant(mapping, row[f.retentionUntil]) === flow.retentionUntilMillis,
-        );
-
-        return { observation, row, flow };
-      }),
-    );
-
-  const liveFlow = (flow: Flow, now: number) =>
-    flow.context.issuedAtMillis <= now &&
-    now < flow.context.expiresAtMillis &&
-    flow.context.expiresAtMillis <= flow.context.requestBindingExpiresAtMillis &&
-    flow.retentionUntilMillis >= flow.context.expiresAtMillis + flow.context.claimLifetimeMillis;
-
-  const issueFlow = (mapping: any, original: Flow, purpose: "sign-in" | "link") =>
-    Effect.flatMap(CurrentOAuthTransaction, (owner) =>
-      Effect.gen(function* () {
-        const codec = flowStorage(purpose);
-        const flow = codec.decode(codec.encode(original as never)) as Flow;
-
-        const f = mapping.flow,
-          c = flow.context,
-          now = yield* owner.now(mapping.clock);
-
-        if (!liveFlow(flow, now)) return { _tag: "Rejected" } as const;
-        const byFlow = yield* owner.read(f.table, equal(f.table, flowKey(f, c)), { limit: 1 });
-
-        const byCommand = yield* owner.read(
-          f.table,
-          equal(f.table, {
-            [f.moduleId]: c.moduleId,
-            [f.commandId]: c.commandId,
-          }),
-          { limit: 1 },
-        );
-
-        if (byFlow.rows.length || byCommand.rows.length) return { _tag: "Rejected" } as const;
-        const encode = mapping.clock.encodeInstant;
-
-        const values = {
-          ...f.encodeInsert({ moduleId: c.moduleId, flowId: c.flowId, purpose }),
-          ...flowKey(f, c),
-          [f.commandId]: c.commandId,
-          [f.purpose]: purpose,
-          [f.generation]: c.generation,
-          [f.state]: "Pending",
-          [f.version]: owner.marker,
-          [f.stateDigest]: c.stateDigest,
-          [f.binderVerifier]: c.requestBindingVerifier,
-          [f.binderExpiresAt]: encode(c.requestBindingExpiresAtMillis),
-          [f.snapshot]: codec.encode(flow as never),
-          [f.issuedAt]: encode(c.issuedAtMillis),
-          [f.expiresAt]: encode(c.expiresAtMillis),
-          [f.claimId]: null,
-          [f.claimedAt]: null,
-          [f.claimExpiresAt]: null,
-          [f.retentionUntil]: encode(flow.retentionUntilMillis),
-        };
-
-        const inserted = yield* owner.insert(f.table, values, flowKey(f, c), true);
-
-        byFlow.rows = inserted.rows;
-        byCommand.rows = inserted.rows;
-        if (inserted.rows[0]?.[f.version] !== owner.marker) return { _tag: "Rejected" } as const;
-        owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${c.issuedAtMillis}
-      and ${mapping.clock.engineNowMillis} < ${c.expiresAtMillis}`);
-
-        return { _tag: "Issued", flow } as const;
-      }),
-    );
-
-  const matchesAccess = (flow: Flow, input: any) => {
-    const c = flow.context;
-
-    return (
-      c.moduleId === input.moduleId &&
-      c.generation === input.generation &&
-      c.flowId === input.flowId &&
-      c.provider === input.provider &&
-      c.callbackId === input.callbackId &&
-      c.stateDigest === input.stateDigest &&
-      c.requestBindingVerifier === input.requestBindingVerifier &&
-      c.requestBindingExpiresAtMillis === input.requestBindingExpiresAtMillis &&
-      (c.responseIssuerMode === "required"
-        ? input.responseIssuer === c.issuer
-        : input.responseIssuer === undefined)
-    );
-  };
-
-  const claimFlow = (mapping: any, inspected: { row: Row; flow: Flow }, claimId: string) =>
-    Effect.flatMap(CurrentOAuthTransaction, (owner) =>
-      Effect.gen(function* () {
-        const now = yield* owner.now(mapping.clock),
-          flow = inspected.flow,
-          c = flow.context;
-
-        if (inspected.row[mapping.flow.state] !== "Pending" || !liveFlow(flow, now))
-          return undefined;
-
-        const claim = {
-          flow,
-          claimId,
-          claimedAtMillis: now,
-          claimExpiresAtMillis: now + c.claimLifetimeMillis,
-        };
-
-        invariant(
-          Number.isSafeInteger(claim.claimExpiresAtMillis) &&
-            claim.claimExpiresAtMillis <= flow.retentionUntilMillis,
-        );
-
-        const f = mapping.flow,
-          encode = mapping.clock.encodeInstant;
-
-        yield* owner.update(f.table, flowKey(f, c), {
-          [f.state]: "Claimed",
-          [f.version]: owner.marker,
-          [f.claimId]: claimId,
-          [f.claimedAt]: encode(now),
-          [f.claimExpiresAt]: encode(claim.claimExpiresAtMillis),
-        });
-        owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${now} and
-      ${mapping.clock.engineNowMillis} < ${Math.min(c.expiresAtMillis, claim.claimExpiresAtMillis)}`);
-
-        return claim;
-      }),
-    );
-
-  const exactClaim = (mapping: any, claim: Claim, purpose: "sign-in" | "link") =>
-    Effect.flatMap(CurrentOAuthTransaction, (owner) =>
-      Effect.gen(function* () {
-        const read = yield* readFlow(mapping, claim.flow.context, purpose);
-
-        const now = yield* owner.now(mapping.clock),
-          f = mapping.flow,
-          row = read.row;
-
-        if (
-          row === undefined ||
-          read.flow === undefined ||
-          row[f.state] !== "Claimed" ||
-          row[f.claimId] !== claim.claimId ||
-          instant(mapping, row[f.claimedAt]) !== claim.claimedAtMillis ||
-          instant(mapping, row[f.claimExpiresAt]) !== claim.claimExpiresAtMillis ||
-          claim.claimExpiresAtMillis !==
-            claim.claimedAtMillis + claim.flow.context.claimLifetimeMillis ||
-          now < claim.claimedAtMillis ||
-          now >= claim.claimExpiresAtMillis ||
-          flowStorage(purpose).encode(read.flow as never) !==
-            flowStorage(purpose).encode(claim.flow as never)
-        )
-          return undefined;
-        owner.postconditions
-          .push(sql`${mapping.clock.engineNowMillis} >= ${claim.claimedAtMillis} and
-      ${mapping.clock.engineNowMillis} < ${claim.claimExpiresAtMillis}`);
-
-        return { ...read, now };
-      }),
-    );
-
-  const terminalFlow = (mapping: any, flow: Flow, state: string) =>
-    Effect.flatMap(CurrentOAuthTransaction, (owner) =>
-      owner.update(mapping.flow.table, flowKey(mapping.flow, flow.context), {
-        [mapping.flow.state]: state,
-        [mapping.flow.version]: owner.marker,
-        [mapping.flow.snapshot]: null,
-      }),
-    );
-
-  /** Subject precedes credentials; the complete active credential vector is retained. */
-  const currentSubject = (mapping: any, nativeId: unknown) =>
-    Effect.flatMap(CurrentOAuthTransaction, (owner) =>
-      Effect.gen(function* () {
-        const s = mapping.subject,
-          a = mapping.authority;
-
-        const subject = yield* owner.read(s.table, eq(col(s.table, s.id), nativeId), { limit: 1 });
-        const row = subject.rows[0];
-        const subjectActive = sql`exists(select 1 from ${s.table} where ${both(eq(col(s.table, s.id), nativeId), s.activeCondition)})`;
-
-        if (
-          row === undefined ||
-          !s.isActiveStatus(row[s.status]) ||
-          !(yield* owner.check(subjectActive))
-        )
-          return undefined;
-        owner.postconditions.push(subjectActive);
-
-        const authorities = yield* owner.read(a.table, eq(col(a.table, a.subjectId), nativeId), {
-          orderBy: col(a.table, a.credentialId),
-        });
-
-        const active = authorities.rows.filter((item) => a.isActiveStatus(item[a.status]));
-
-        const activeGuard = sql`(select count(*) from ${a.table} where ${both(
-          eq(col(a.table, a.subjectId), nativeId),
-          a.activeCondition,
-        )}) = ${active.length}`;
-
-        invariant(yield* owner.check(activeGuard));
-        owner.postconditions.push(
-          () => sql`(select count(*) from ${a.table} where ${both(
-            eq(col(a.table, a.subjectId), nativeId),
-            a.activeCondition,
-          )}) =
-      ${authorities.rows.filter((item) => a.isActiveStatus(item[a.status])).length}`,
-        );
-
-        const credentials = active
-          .map((item) => ({ credentialId: item[a.credentialId], revision: item[a.revision] }))
-          .sort((left, right) => left.credentialId.localeCompare(right.credentialId));
-
-        invariant(
-          new Set(credentials.map((item) => item.credentialId)).size === credentials.length,
-        );
-        const subjectId = yield* (mapping.subjectId as SubjectIdCodec<unknown>).toSubject(nativeId);
-
-        const revision = snapshotOAuthSync(OAuthAccountRevision, {
-          subjectId,
-          securityRevision: row[s.securityRevision],
-          credentials,
-        });
-
-        return { subject, row, authorities, revision, nativeId };
-      }),
-    );
-
-  const discoverOwned = (mapping: any, identity: OAuthVerifiedExternalIdentity["identity"]) =>
-    Effect.flatMap(CurrentOAuthTransaction, (owner) =>
-      Effect.gen(function* () {
-        const key = yield* oauthIdentityKey(identity),
-          o = mapping.ownership;
-
-        const where = both(eq(col(o.table, o.identityKey), key), o.ownedCondition);
-
-        const discovered = yield* owner.read(o.table, where, {
-          lock: false,
-          observe: false,
-          limit: 1,
-        });
-
-        const row = discovered.rows[0];
-
-        if (row === undefined) return { key };
-        invariant(
-          row[o.provider] === identity.provider &&
-            row[o.issuer] === identity.issuer &&
-            row[o.externalSubject] === identity.subject,
-        );
-        const nativeId = o.decodeSubjectId(copiedRow(row));
-        const current = yield* currentSubject(mapping, nativeId);
-        const owned = yield* owner.read(o.table, where, { limit: 1 });
-        const final = owned.rows[0];
-
-        if (
-          current === undefined ||
-          final === undefined ||
-          !mapping.subjectId.equals(nativeId, o.decodeSubjectId(copiedRow(final)))
-        )
-          return { key, owned: true as const };
-        invariant(
-          final[o.provider] === identity.provider &&
-            final[o.issuer] === identity.issuer &&
-            final[o.externalSubject] === identity.subject,
-        );
-        const c = mapping.credential;
-
-        const credential = yield* owner.read(c.table, eq(col(c.table, c.identityKey), key), {
-          limit: 1,
-        });
-
-        let login: Row | undefined = credential.rows[0];
-
-        if (login !== undefined && c.isActiveStatus(login[c.status])) {
-          const usable = sql`exists(select 1 from ${c.table} where ${both(
-            eq(col(c.table, c.identityKey), key),
-            c.activeCondition,
-          )})`;
-
-          if (yield* owner.check(usable)) owner.postconditions.push(usable);
-          else login = undefined;
-        }
-
-        return { key, owned: true as const, current, credential, login };
-      }),
-    );
-
-  const resolveOwned = (
-    mapping: any,
-    moduleId: string,
-    identity: OAuthVerifiedExternalIdentity["identity"],
-    found: any,
-  ) => {
-    const login = found.login,
-      current = found.current,
-      c = mapping.credential;
-
-    if (
-      login === undefined ||
-      current === undefined ||
-      login[c.moduleId] !== moduleId ||
-      !mapping.subjectId.equals(login[c.subjectId], current.nativeId) ||
-      !c.isActiveStatus(login[c.status])
-    )
-      return undefined;
-
-    const shared = current.revision.credentials.find(
-      (item: any) => item.credentialId === login[c.credentialId],
-    );
-
-    if (shared?.revision !== login[c.credentialRevision]) return undefined;
-
-    return snapshotOAuthSync(OAuthCredentialSnapshot, {
-      moduleId: OAuthModuleId.make(moduleId),
-      identity,
-      credentialId: login[c.credentialId],
-      credentialRevision: login[c.credentialRevision],
-      revision: current.revision,
-    });
-  };
-
-  const cleanupFlows = (
-    mapping: any,
-    original: typeof OAuthCleanupInput.Type,
-    purpose: "sign-in" | "link",
-  ) =>
-    Effect.flatMap(CurrentOAuthTransaction, (owner) =>
-      Effect.gen(function* () {
-        const input = snapshotOAuthSync(OAuthCleanupInput, original),
-          f = mapping.flow;
-
-        const now = yield* owner.now(mapping.clock);
-
-        const candidates = yield* owner.read(
-          f.table,
-          both(
-            eq(col(f.table, f.moduleId), input.moduleId),
-            eq(col(f.table, f.purpose), purpose),
-            sql`((${col(f.table, f.state)} = 'Pending' and ${col(f.table, f.expiresAt)} <= ${mapping.clock.encodeInstant(now)})
-      or (${col(f.table, f.state)} = 'Claimed' and ${col(f.table, f.claimExpiresAt)} <= ${mapping.clock.encodeInstant(now)})
-      or (${col(f.table, f.state)} not in ('Pending','Claimed') and ${col(f.table, f.retentionUntil)} < ${mapping.clock.encodeInstant(now)}))`,
-          ),
-          { limit: input.limit, observe: false, takeOnly: true },
-        );
-
-        let terminalized = 0,
-          removed = 0;
-
-        for (const candidate of candidates.rows) {
-          const key = { [f.moduleId]: candidate[f.moduleId], [f.flowId]: candidate[f.flowId] };
-          const current = yield* owner.read(f.table, equal(f.table, key), { limit: 1 });
-
-          if (current.rows.length !== 1) continue;
-
-          const row = current.rows[0]!,
-            transitionNow = yield* owner.now(mapping.clock);
-
-          const state = row[f.state];
-
-          if (state === "Pending" || state === "Claimed") {
-            const deadline = instant(
-              mapping,
-              row[state === "Pending" ? f.expiresAt : f.claimExpiresAt],
-            );
-
-            if (transitionNow < deadline) continue;
-            yield* owner.update(f.table, key, {
-              [f.state]: state === "Pending" ? "Rejected" : "Ambiguous",
-              [f.snapshot]: null,
-              [f.version]: owner.marker,
-            });
-            owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${deadline}`);
-            terminalized++;
-          } else {
-            const retainUntil = Math.max(
-              instant(mapping, row[f.retentionUntil]),
-              row[f.claimExpiresAt] === null ? 0 : instant(mapping, row[f.claimExpiresAt]),
-            );
-
-            if (transitionNow <= retainUntil) continue;
-            yield* owner.remove(f.table, key);
-            owner.postconditions.push(sql`${mapping.clock.engineNowMillis} > ${retainUntil}`);
-            removed++;
-          }
-        }
-
-        return { terminalized, removed, hasMore: candidates.rows.length === input.limit };
-      }),
-    );
-
-  return {
-    pendingStorage,
-    linkStorage,
-    credentialStorage,
-    revisionStorage,
-    flowKey,
-    flowStorage,
-    readFlow,
-    liveFlow,
-    issueFlow,
-    matchesAccess,
-    claimFlow,
-    exactClaim,
-    terminalFlow,
-    currentSubject,
-    discoverOwned,
-    resolveOwned,
-    cleanupFlows,
-  };
-});
-
-export class OAuthFlow extends Context.Service<OAuthFlow, Effect.Success<typeof make>>()(
-  "effect-auth/persistence/OAuthFlow",
-) {
-  static readonly layer = Layer.effect(OAuthFlow, make);
-}

package/src/internal/oauth/input.ts

@@ -1,201 +0,0 @@
-import {
-  OAuthAccountRevision,
-  OAuthActionAuthorization,
-  OAuthLinkAccess,
-  OAuthLinkClaim,
-  OAuthLinkOutcome,
-  OAuthLinkPendingFlow,
-  OAuthRegistrationAccess,
-  OAuthRegistrationFingerprint,
-  OAuthRegistrationIntent,
-  OAuthClaim,
-  OAuthClaimId,
-  OAuthCleanupInput,
-  OAuthCommandId,
-  OAuthCredentialSnapshot,
-  OAuthInstant,
-  OAuthModuleId,
-  OAuthPendingFlow,
-  OAuthSignInTransactionContext,
-  OAuthVerifiedExternalIdentity,
-  snapshotOAuthSync,
-  type OAuthUnavailable,
-} from "@yielded/auth/OAuth";
-import { SessionInvalidationWindow } from "@yielded/auth/Sessions";
-/* oxlint-disable no-explicit-any -- private adapter wraps only the Effect-valued semantic ports. */
-import { Effect, Schema } from "effect";
-
-import { invariant, unavailable } from "./state";
-
-const fields = OAuthSignInTransactionContext.fields;
-
-const claimInput = Schema.Struct({
-  moduleId: fields.moduleId,
-  generation: fields.generation,
-  flowId: fields.flowId,
-  provider: fields.provider,
-  callbackId: fields.callbackId,
-  stateDigest: fields.stateDigest,
-  requestBindingVerifier: fields.requestBindingVerifier,
-  requestBindingExpiresAtMillis: fields.requestBindingExpiresAtMillis,
-  responseIssuer: Schema.optionalKey(fields.issuer),
-  claimId: OAuthClaimId,
-  nowMillis: OAuthInstant,
-});
-
-const signInOutcome = Schema.Union([
-  Schema.TaggedStruct("Verified", { identity: OAuthVerifiedExternalIdentity }),
-  Schema.TaggedStruct("Cancelled", {}),
-  Schema.TaggedStruct("Rejected", {}),
-  Schema.TaggedStruct("Ambiguous", {}),
-]);
-
-const signInSettle = Schema.Struct({
-  claim: OAuthClaim,
-  outcome: signInOutcome,
-  nowMillis: OAuthInstant,
-});
-
-const registrationSettle = Schema.Struct({
-  claim: OAuthClaim,
-  identity: OAuthVerifiedExternalIdentity,
-  intent: Schema.optionalKey(OAuthRegistrationIntent),
-  nowMillis: OAuthInstant,
-});
-
-const registerPrivate = Schema.Struct({
-  access: OAuthRegistrationAccess,
-  intent: OAuthRegistrationIntent,
-  commandId: OAuthCommandId,
-  fingerprint: OAuthRegistrationFingerprint,
-});
-
-const capture = Schema.Struct({
-  moduleId: OAuthModuleId,
-  subjectId: OAuthAccountRevision.fields.subjectId,
-});
-
-const linkIssue = Schema.Struct({
-  flow: OAuthLinkPendingFlow,
-  authorization: OAuthActionAuthorization,
-});
-
-const linkClaim = Schema.Struct({
-  access: OAuthLinkAccess,
-  flow: OAuthLinkPendingFlow,
-  claimId: OAuthClaimId,
-  authorization: OAuthActionAuthorization,
-});
-
-const linkSettle = Schema.Struct({
-  claim: OAuthLinkClaim,
-  outcome: OAuthLinkOutcome,
-  authorization: OAuthActionAuthorization,
-  invalidation: SessionInvalidationWindow,
-  nowMillis: OAuthInstant,
-});
-
-const unlinkInspect = Schema.Struct({
-  moduleId: OAuthModuleId,
-  subjectId: OAuthAccountRevision.fields.subjectId,
-  commandId: OAuthCommandId,
-  credentialId: OAuthCredentialSnapshot.fields.credentialId,
-});
-
-const unlink = Schema.Struct({
-  moduleId: OAuthModuleId,
-  commandId: OAuthCommandId,
-  credential: OAuthCredentialSnapshot,
-  authorization: OAuthActionAuthorization,
-  invalidation: SessionInvalidationWindow,
-  nowMillis: OAuthInstant,
-  retentionUntilMillis: OAuthInstant,
-});
-
-const snapshot = (schema: Schema.Codec<any, any, never, never>) => (input: any) =>
-  snapshotOAuthSync(schema, input);
-
-export const signInInputs = {
-  issue: snapshot(OAuthPendingFlow),
-  claim: snapshot(claimInput),
-  settle: snapshot(signInSettle),
-  cleanup: snapshot(OAuthCleanupInput),
-};
-
-export const registrationIntentInputs = { settle: snapshot(registrationSettle) };
-
-const capturedApplication = (
-  application: { readonly encode: (data: any) => string; readonly decode: (stored: string) => any },
-  data: any,
-) => {
-  const encoded = application.encode(data);
-
-  invariant(typeof encoded === "string" && new TextEncoder().encode(encoded).length <= 1048576);
-  const retained = application.decode(encoded);
-
-  invariant(application.encode(retained) === encoded);
-
-  return retained;
-};
-
-export const registrationInputs = (application: {
-  readonly encode: (data: any) => string;
-  readonly decode: (stored: string) => any;
-}) => ({
-  read: snapshot(OAuthRegistrationAccess),
-  inspect: (input: any) => ({
-    intent: snapshotOAuthSync(OAuthRegistrationIntent, input.intent),
-    registration: capturedApplication(application, input.registration),
-  }),
-  register: (input: any) => ({
-    ...snapshotOAuthSync(registerPrivate, input),
-    registration: capturedApplication(application, input.registration),
-  }),
-  cleanup: snapshot(OAuthCleanupInput),
-});
-
-export const accountsInputs = {
-  capture: snapshot(capture),
-  issue: snapshot(linkIssue),
-  preflight: snapshot(OAuthLinkAccess),
-  claim: snapshot(linkClaim),
-  settle: snapshot(linkSettle),
-  inspectUnlink: snapshot(unlinkInspect),
-  unlink: snapshot(unlink),
-  cleanup: snapshot(OAuthCleanupInput),
-};
-
-/** Snapshot before the first asynchronous owner/allocator step; closed bound
- * authorities reject before running even an application codec or inspector. */
-export const capturedOAuthService = <
-  S extends { [K in keyof S]: (...args: any[]) => Effect.Effect<any, OAuthUnavailable> },
->(
-  service: S,
-  inputs: { readonly [K in keyof S]: (input: any) => any },
-  active: () => boolean,
-  poison: () => void,
-): S =>
-  Object.freeze(
-    Object.fromEntries(
-      Object.entries(service).map(([key, method]) => [
-        key,
-        (input: any, prepare?: any) =>
-          Effect.suspend(() => {
-            if (!active()) return Effect.fail(unavailable());
-            const retained = inputs[key as keyof S](input);
-
-            return (method as (...args: any[]) => Effect.Effect<any, OAuthUnavailable>)(
-              retained,
-              prepare,
-            );
-          }).pipe(
-            Effect.onExit((exit) =>
-              Effect.sync(() => {
-                if (exit._tag === "Failure") poison();
-              }),
-            ),
-            Effect.catchDefect(() => Effect.fail(unavailable())),
-          ),
-      ]),
-    ),
-  ) as S;