@dual-os/sdk 0.0.0-stage → 0.8.0-next.0

package/dist/AuthMethodExecution.d.ts

@@ -0,0 +1,223 @@
+import "./AuthMethodExecution.js";
+import { Any, AuthMethodHookError, Display, ExpectedOAuth2MethodError, HookContext, Input, InputSchema, Material, MaterialSchema, OAuth2RefreshTokenUnavailableError, OAuth2TokenResponse, RefreshContext, Requirements, Setup, SetupSchema, TestResult, Value, ValueSchema } from "./AuthMethod.js";
+import { Effect, Schema } from "effect";
+declare namespace AuthMethodExecution_d_exports {
+  export { AuthMethodExecution_d_exports as AuthMethodExecution, JsonRequest, decodeInput, decodeMaterial, decodeSetup, decodeValue, display, executeJson, prepare, prepareDecoded, prepareOAuth2Tokens, prepareUnknown, refreshDecoded, refreshUnknown, resolve, resolveDecoded, resolveUnknown, test };
+}
+type SetupRequirements<Method extends Any> = SetupSchema<Method> extends Schema.Top ? Schema.Codec.DecodingServices<SetupSchema<Method>> : never;
+type InputRequirements<Method extends Any> = InputSchema<Method> extends Schema.Top ? Schema.Codec.DecodingServices<InputSchema<Method>> : never;
+type MaterialRequirements<Method extends Any> = Schema.Codec.DecodingServices<MaterialSchema<Method>>;
+type ValueRequirements<Method extends Any> = Schema.Codec.DecodingServices<ValueSchema<Method>>;
+/**
+ * Decode a runtime auth value using the selected method schema.
+ *
+ * @since 0.0.0
+ * @category constructors
+ */
+export declare const decodeValue: <Method extends Any>(method: Method, value: unknown) => Effect.Effect<Value<Method>, Schema.SchemaError, ValueRequirements<Method>>;
+/**
+ * Decode organization/admin-level setup for a method, if it declares one.
+ *
+ * @since 0.0.0
+ * @category constructors
+ */
+export declare const decodeSetup: <Method extends Any>(method: Method, setup: unknown) => Effect.Effect<Setup<Method>, Schema.SchemaError, SetupRequirements<Method>>;
+/**
+ * Decode submitted setup input using the method input schema, if any.
+ *
+ * @since 0.0.0
+ * @category constructors
+ */
+export declare const decodeInput: <Method extends Any>(method: Method, input: unknown) => Effect.Effect<Input<Method>, Schema.SchemaError, InputRequirements<Method>>;
+/**
+ * Decode encrypted stored material using the method material schema.
+ *
+ * @since 0.0.0
+ * @category constructors
+ */
+export declare const decodeMaterial: <Method extends Any>(method: Method, material: unknown) => Effect.Effect<Material<Method>, Schema.SchemaError, MaterialRequirements<Method>>;
+/**
+ * Prepare already-decoded setup input into encrypted stored material.
+ *
+ * @since 0.0.0
+ * @category constructors
+ */
+export declare const prepareDecoded: <Method extends Any>(method: Method, input: Input<Method>, context?: HookContext<Setup<Method>>) => Effect.Effect<Material<Method>, Schema.SchemaError | AuthMethodHookError, MaterialRequirements<Method> | Requirements<Method>>;
+/**
+ * Decode and prepare submitted setup input into encrypted stored material.
+ *
+ * @since 0.0.0
+ * @category constructors
+ */
+export declare const prepareUnknown: <Method extends Any>(method: Method, input: unknown, context?: HookContext<Setup<Method>>) => Effect.Effect<Material<Method>, Schema.SchemaError | AuthMethodHookError, InputRequirements<Method> | MaterialRequirements<Method> | Requirements<Method>>;
+/**
+ * Decode and prepare submitted setup input into encrypted stored material.
+ *
+ * @since 0.0.0
+ * @category constructors
+ */
+export declare const prepare: <Method extends Any>(method: Method, input: unknown, context?: HookContext<Setup<Method>>) => Effect.Effect<Material<Method>, Schema.SchemaError | AuthMethodHookError, InputRequirements<Method> | MaterialRequirements<Method> | Requirements<Method>>;
+/**
+ * Refresh already-decoded stored material when the auth method supports it.
+ *
+ * A result of `undefined` means the material is still usable and should not be
+ * persisted again.
+ *
+ * @since 0.0.0
+ * @category constructors
+ */
+export declare const refreshDecoded: <Method extends Any>(method: Method, material: Material<Method>, context: RefreshContext<Setup<Method>>) => Effect.Effect<Material<Method> | undefined, ExpectedOAuth2MethodError | OAuth2RefreshTokenUnavailableError | Schema.SchemaError | AuthMethodHookError, MaterialRequirements<Method> | Requirements<Method>>;
+/**
+ * Decode stored material and run the auth method refresh hook, if any.
+ *
+ * @since 0.0.0
+ * @category constructors
+ */
+export declare const refreshUnknown: <Method extends Any>(method: Method, material: unknown, context: RefreshContext<Setup<Method>>) => Effect.Effect<Material<Method> | undefined, ExpectedOAuth2MethodError | OAuth2RefreshTokenUnavailableError | Schema.SchemaError | AuthMethodHookError, MaterialRequirements<Method> | Requirements<Method>>;
+/**
+ * Prepare normalized OAuth2 token exchange output into encrypted stored material.
+ *
+ * OAuth2 has no frontend-submitted setup input. The platform owns redirect,
+ * callback, state/PKCE, and token exchange, then calls this helper at the
+ * token-response boundary.
+ *
+ * @since 0.0.0
+ * @category constructors
+ */
+export declare const prepareOAuth2Tokens: <Method extends Any>(method: Method, tokens: OAuth2TokenResponse, context?: HookContext<Setup<Method>>) => Effect.Effect<Material<Method>, ExpectedOAuth2MethodError | Schema.SchemaError | AuthMethodHookError, MaterialRequirements<Method> | Requirements<Method>>;
+/**
+ * Resolve already-decoded stored material into the runtime value handlers receive.
+ *
+ * @since 0.0.0
+ * @category constructors
+ */
+export declare const resolveDecoded: <Method extends Any>(method: Method, material: Material<Method>, context?: HookContext<Setup<Method>>) => Effect.Effect<Value<Method>, Schema.SchemaError | AuthMethodHookError, ValueRequirements<Method> | Requirements<Method>>;
+/**
+ * Decode stored material and resolve it into the runtime value handlers receive.
+ *
+ * @since 0.0.0
+ * @category constructors
+ */
+export declare const resolve: <Method extends Any>(method: Method, material: unknown, context?: HookContext<Setup<Method>>) => Effect.Effect<Value<Method>, Schema.SchemaError | AuthMethodHookError, MaterialRequirements<Method> | ValueRequirements<Method> | Requirements<Method>>;
+/**
+ * Resolve untrusted persisted material into the runtime value handlers receive.
+ *
+ * This is the persistence-boundary variant of {@link resolve}: callers can pass
+ * raw JSON from storage and the method material schema is decoded before any
+ * provider hook runs.
+ *
+ * @since 0.0.0
+ * @category constructors
+ */
+export declare const resolveUnknown: typeof resolve;
+/** Operation-specific authentication data for isolated execution. */
+export type JsonRequest = typeof JsonRequest.Type;
+export declare const JsonRequest: Schema.Union<readonly [Schema.TaggedStruct<"decodeSetup", {
+  authMethodId: Schema.NonEmptyString;
+  providerId: Schema.NonEmptyString;
+  setup: Schema.optionalKey<Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+}>, Schema.TaggedStruct<"prepare", {
+  readonly authMethodId: Schema.NonEmptyString;
+  readonly providerId: Schema.NonEmptyString;
+  readonly setup: Schema.optionalKey<Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+  readonly input: Schema.Codec<Schema.Json, Schema.Json, never, never>;
+}>, Schema.TaggedStruct<"prepareOAuth2Tokens", {
+  readonly authMethodId: Schema.NonEmptyString;
+  readonly providerId: Schema.NonEmptyString;
+  readonly setup: Schema.optionalKey<Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+  readonly tokens: Schema.Struct<{
+    readonly accessToken: Schema.String;
+    readonly expiresAt: Schema.optionalKey<Schema.Number>;
+    readonly expiresIn: Schema.optionalKey<Schema.Number>;
+    readonly raw: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+    readonly refreshToken: Schema.optionalKey<Schema.String>;
+    readonly scope: Schema.optionalKey<Schema.String>;
+    readonly tokenType: Schema.optionalKey<Schema.String>;
+  }>;
+}>, Schema.TaggedStruct<"refresh", {
+  readonly authMethodId: Schema.NonEmptyString;
+  readonly providerId: Schema.NonEmptyString;
+  readonly setup: Schema.optionalKey<Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+  readonly material: Schema.Codec<Schema.Json, Schema.Json, never, never>;
+  readonly minValidityMs: Schema.Finite;
+  readonly now: Schema.Finite;
+  readonly reason: Schema.Literals<readonly ["before-use", "forced"]>;
+}>, Schema.TaggedStruct<"resolve", {
+  readonly authMethodId: Schema.NonEmptyString;
+  readonly providerId: Schema.NonEmptyString;
+  readonly setup: Schema.optionalKey<Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+  readonly material: Schema.Codec<Schema.Json, Schema.Json, never, never>;
+}>, Schema.TaggedStruct<"display", {
+  readonly authMethodId: Schema.NonEmptyString;
+  readonly providerId: Schema.NonEmptyString;
+  readonly setup: Schema.optionalKey<Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+  readonly material: Schema.Codec<Schema.Json, Schema.Json, never, never>;
+}>, Schema.TaggedStruct<"test", {
+  readonly authMethodId: Schema.NonEmptyString;
+  readonly providerId: Schema.NonEmptyString;
+  readonly setup: Schema.optionalKey<Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+  readonly material: Schema.Codec<Schema.Json, Schema.Json, never, never>;
+}>]>;
+/** Decode canonical JSON once; executable hooks and codecs stay in the guest. */
+export declare const executeJson: (method: Any, request: {
+  readonly _tag: "decodeSetup";
+  readonly authMethodId: string;
+  readonly providerId: string;
+  readonly setup?: Schema.Json;
+} | {
+  readonly _tag: "display";
+  readonly authMethodId: string;
+  readonly providerId: string;
+  readonly setup?: Schema.Json;
+  readonly material: Schema.Json;
+} | {
+  readonly _tag: "prepare";
+  readonly authMethodId: string;
+  readonly providerId: string;
+  readonly setup?: Schema.Json;
+  readonly input: Schema.Json;
+} | {
+  readonly _tag: "prepareOAuth2Tokens";
+  readonly authMethodId: string;
+  readonly providerId: string;
+  readonly setup?: Schema.Json;
+  readonly tokens: {
+    readonly accessToken: string;
+    readonly expiresAt?: number;
+    readonly expiresIn?: number;
+    readonly raw: {
+      readonly [x: string]: Schema.Json;
+    };
+    readonly refreshToken?: string;
+    readonly scope?: string;
+    readonly tokenType?: string;
+  };
+} | {
+  readonly _tag: "refresh";
+  readonly authMethodId: string;
+  readonly providerId: string;
+  readonly setup?: Schema.Json;
+  readonly material: Schema.Json;
+  readonly minValidityMs: number;
+  readonly now: number;
+  readonly reason: "before-use" | "forced";
+} | {
+  readonly _tag: "resolve";
+  readonly authMethodId: string;
+  readonly providerId: string;
+  readonly setup?: Schema.Json;
+  readonly material: Schema.Json;
+} | {
+  readonly _tag: "test";
+  readonly authMethodId: string;
+  readonly providerId: string;
+  readonly setup?: Schema.Json;
+  readonly material: Schema.Json;
+}) => Effect.Effect<Display | TestResult | Schema.Json | undefined, AuthMethodHookError | ExpectedOAuth2MethodError | OAuth2RefreshTokenUnavailableError | Schema.SchemaError, any>;
+/** @since 0.0.0 @category constructors */
+export declare const display: <Method extends Any>(method: Method, material: Material<Method>, context?: HookContext<Setup<Method>>) => Effect.Effect<Display | undefined, Schema.SchemaError | AuthMethodHookError, MaterialRequirements<Method> | Requirements<Method>>;
+/** @since 0.0.0 @category constructors */
+export declare const test: <Method extends Any>(method: Method, material: Material<Method>, context?: HookContext<Setup<Method>>) => Effect.Effect<TestResult, Schema.SchemaError | AuthMethodHookError, MaterialRequirements<Method> | Requirements<Method>>;
+//#endregion
+export { AuthMethodExecution_d_exports as AuthMethodExecution, AuthMethodExecution_d_exports };
+//# sourceMappingURL=AuthMethodExecution.d.ts.map

package/dist/AuthMethodExecution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthMethodExecution.d.ts","names":["AuthMethod.Any","AuthMethod.SetupSchema","AuthMethod.InputSchema","AuthMethod.MaterialSchema","AuthMethod.ValueSchema","AuthMethod.Value","AuthMethod.Setup","AuthMethod.Input","AuthMethod.Material","AuthMethod.HookContext","AuthMethod.AuthMethodHookError","AuthMethod.Requirements","AuthMethod.RefreshContext","AuthMethod.ExpectedOAuth2MethodError","AuthMethod.OAuth2RefreshTokenUnavailableError","AuthMethod.OAuth2TokenResponse","AuthMethod.Display","AuthMethod.TestResult"],"sources":["../src/AuthMethodExecution.ts"],"mappings":";;;;;;KAgEK,kBAAkB,eAAeA,OACpCC,YAAuB,gBAAgB,OAAO,MAC1C,OAAO,MAAM,iBAAiBA,YAAuB;KAGtD,kBAAkB,eAAeD,OACpCE,YAAuB,gBAAgB,OAAO,MAC1C,OAAO,MAAM,iBAAiBA,YAAuB;KAGtD,qBAAqB,eAAeF,OAAkB,OAAO,MAAM,iBACtEG,eAA0B;KAGvB,kBAAkB,eAAeH,OAAkB,OAAO,MAAM,iBACnEI,YAAuB;;;;;;;qBASZ,cAAc,eAAeJ,KACxC,QAAQ,QACR,mBACG,OAAO,OAAOK,MAAiB,SAAS,OAAO,aAAa,kBAAkB;;;;;;;qBAWtE,cAAc,eAAeL,KACxC,QAAQ,QACR,mBACG,OAAO,OAAOM,MAAiB,SAAS,OAAO,aAAa,kBAAkB;;;;;;;qBAgBtE,cAAc,eAAeN,KACxC,QAAQ,QACR,mBACG,OAAO,OAAOO,MAAiB,SAAS,OAAO,aAAa,kBAAkB;;;;;;;qBAgBtE,iBAAiB,eAAeP,KAC3C,QAAQ,QACR,sBACG,OAAO,OACVQ,SAAoB,SACpB,OAAO,aACP,qBAAqB;;;;;;;qBASV,iBAAiB,eAAeR,KAC3C,QAAQ,QACR,OAAOO,MAAiB,SACxB,UAAUE,YAAuBH,MAAiB,aAC/C,OAAO,OACVE,SAAoB,SACpB,OAAO,cAAcE,qBACrB,qBAAqB,UAAUC,aAAwB;;;;;;;qBAwB5C,iBAAiB,eAAeX,KAC3C,QAAQ,QACR,gBACA,UAAUS,YAAuBH,MAAiB,aAC/C,OAAO,OACVE,SAAoB,SACpB,OAAO,cAAcE,qBACrB,kBAAkB,UAAU,qBAAqB,UAAUC,aAAwB;;;;;;;qBAqDxE,UA5DiB,eAAeX,KAAc,QACjD,QAAM,gBACA,UACJS,YAAuBH,MAAiB,aAC/C,OAAO,OACVE,SAAoB,SACpB,OAAO,cAAcE,qBACrB,kBAAkB,UAAU,qBAAqB,UAAUC,aAAwB;;;;;;;;;;qBAgExE,iBAAiB,eAAeX,KAC3C,QAAQ,QACR,UAAUQ,SAAoB,SAC9B,SAASI,eAA0BN,MAAiB,aACjD,OAAO,OACVE,SAAoB,qBAClBK,4BACAC,qCACA,OAAO,cACPJ,qBACF,qBAAqB,UAAUC,aAAwB;;;;;;;qBA0B5C,iBAAiB,eAAeX,KAC3C,QAAQ,QACR,mBACA,SAASY,eAA0BN,MAAiB,aACjD,OAAO,OACVE,SAAoB,qBAClBK,4BACAC,qCACA,OAAO,cACPJ,qBACF,qBAAqB,UAAUC,aAAwB;;;;;;;;;;;qBAgB5C,sBAAsB,eAAeX,KAChD,QAAQ,QACR,QAAQe,qBACR,UAAUN,YAAuBH,MAAiB,aAC/C,OAAO,OACVE,SAAoB,SACpBK,4BAAuC,OAAO,cAAcH,qBAC5D,qBAAqB,UAAUC,aAAwB;;;;;;;qBA6B5C,iBAAiB,eAAeX,KAC3C,QAAQ,QACR,UAAUQ,SAAoB,SAC9B,UAAUC,YAAuBH,MAAiB,aAC/C,OAAO,OACVD,MAAiB,SACjB,OAAO,cAAcK,qBACrB,kBAAkB,UAAUC,aAAwB;;;;;;;qBAwBzC,UAAU,eAAeX,KACpC,QAAQ,QACR,mBACA,UAAUS,YAAuBH,MAAiB,aAC/C,OAAO,OACVD,MAAiB,SACjB,OAAO,cAAcK,qBACrB,qBAAqB,UAAU,kBAAkB,UAAUC,aAAwB;;;;;;;;;;;qBAgBxE,uBAAuB;;YASxB,qBAAqB,YAAY;qBAChC,aAAW,OAAA,gBAAA,OAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBA4BX,cAAW,QAAAX,KAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MA8CtB,OAAA,OAAAgB,UAAAC,aAAA,OAAA,kBAAAP,sBAAAG,4BAAAC,qCAAA,OAAA;;qBAGW,UAAU,eAAed,KACpC,QAAQ,QACR,UAAUQ,SAAoB,SAC9B,UAAUC,YAAuBH,MAAiB,aAC/C,OAAO,OACVU,qBACA,OAAO,cAAcN,qBACrB,qBAAqB,UAAUC,aAAwB;;qBAiB5C,OAAO,eAAeX,KACjC,QAAQ,QACR,UAAUQ,SAAoB,SAC9B,UAAUC,YAAuBH,MAAiB,aAC/C,OAAO,OACVW,YACA,OAAO,cAAcP,qBACrB,qBAAqB,UAAUC,aAAwB"}

package/dist/AuthMethodExecution.js

@@ -0,0 +1,277 @@
+import { __exportAll } from "./_virtual/_rolldown/runtime.js";
+import { Service } from "./OAuth2TokenRefresher.js";
+import "./AuthMethodExecution.js";
+import { AuthMethodHookError, ExpectedOAuth2MethodError, OAuth2RefreshTokenUnavailableError } from "./AuthMethod.js";
+import { Effect, Schema } from "effect";
+//#region src/AuthMethodExecution.ts
+/**
+* Credential decoding, hook execution, material refresh, and value resolution.
+*
+* @since 0.0.0
+*/
+var AuthMethodExecution_exports = /* @__PURE__ */ __exportAll({
+	AuthMethodExecution: () => AuthMethodExecution_exports,
+	JsonRequest: () => JsonRequest,
+	decodeInput: () => decodeInput,
+	decodeMaterial: () => decodeMaterial,
+	decodeSetup: () => decodeSetup,
+	decodeValue: () => decodeValue,
+	display: () => display,
+	executeJson: () => executeJson,
+	prepare: () => prepare,
+	prepareDecoded: () => prepareDecoded,
+	prepareOAuth2Tokens: () => prepareOAuth2Tokens,
+	prepareUnknown: () => prepareUnknown,
+	refreshDecoded: () => refreshDecoded,
+	refreshUnknown: () => refreshUnknown,
+	resolve: () => resolve,
+	resolveDecoded: () => resolveDecoded,
+	resolveUnknown: () => resolveUnknown,
+	test: () => test
+});
+const hookError = (methodIdentifier, operation, cause) => new AuthMethodHookError({
+	cause,
+	methodIdentifier,
+	operation
+});
+const runHook = (methodIdentifier, operation, hook) => Effect.try({
+	catch: (cause) => hookError(methodIdentifier, operation, cause),
+	try: hook
+}).pipe(Effect.flatMap((result) => toEffect(result).pipe(Effect.mapError((cause) => hookError(methodIdentifier, operation, cause)))));
+const toEffect = (value) => Effect.isEffect(value) ? value : Effect.succeed(value);
+const hookContext = (context) => context ?? { setup: void 0 };
+const toImpl = (method) => method;
+/**
+* Decode a runtime auth value using the selected method schema.
+*
+* @since 0.0.0
+* @category constructors
+*/
+const decodeValue = (method, value) => Schema.decodeUnknownEffect(toImpl(method).schema)(value);
+/**
+* Decode organization/admin-level setup for a method, if it declares one.
+*
+* @since 0.0.0
+* @category constructors
+*/
+const decodeSetup = (method, setup) => {
+	const impl = toImpl(method);
+	return impl.setup === void 0 ? Effect.void : Schema.decodeUnknownEffect(impl.setup)(setup);
+};
+/**
+* Decode submitted setup input using the method input schema, if any.
+*
+* @since 0.0.0
+* @category constructors
+*/
+const decodeInput = (method, input) => {
+	const impl = toImpl(method);
+	return impl.input === void 0 ? Effect.void : Schema.decodeUnknownEffect(impl.input)(input);
+};
+/**
+* Decode encrypted stored material using the method material schema.
+*
+* @since 0.0.0
+* @category constructors
+*/
+const decodeMaterial = (method, material) => Schema.decodeUnknownEffect(toImpl(method).material)(material);
+/**
+* Prepare already-decoded setup input into encrypted stored material.
+*
+* @since 0.0.0
+* @category constructors
+*/
+const prepareDecoded = (method, input, context) => {
+	const impl = toImpl(method);
+	const prepare = impl.prepare;
+	if (prepare === void 0) return impl.input === impl.material ? Effect.succeed(input) : Schema.decodeUnknownEffect(impl.material)(input);
+	return runHook(impl.identifier, "prepare", () => prepare(input, hookContext(context))).pipe(Effect.flatMap((material) => Schema.decodeUnknownEffect(impl.material)(material)));
+};
+/**
+* Decode and prepare submitted setup input into encrypted stored material.
+*
+* @since 0.0.0
+* @category constructors
+*/
+const prepareUnknown = (method, input, context) => decodeInput(method, input).pipe(Effect.flatMap((decodedInput) => prepareDecoded(method, decodedInput, context)));
+const oauth2ExpiresAt = (material) => typeof material === "object" && material !== null && "expiresAt" in material ? typeof material.expiresAt === "number" ? material.expiresAt : void 0 : void 0;
+const oauth2RefreshToken = (material) => typeof material === "object" && material !== null && "refreshToken" in material ? typeof material.refreshToken === "string" && material.refreshToken.trim() !== "" ? material.refreshToken : void 0 : void 0;
+const refreshOAuth2Decoded = Effect.fn("AuthMethod.refreshOAuth2Decoded")(function* (method, material, context) {
+	if (context.reason === "before-use" && (oauth2ExpiresAt(material) ?? Number.NEGATIVE_INFINITY) > context.now + context.minValidityMs) return;
+	const refreshToken = oauth2RefreshToken(material);
+	if (refreshToken === void 0) return yield* new OAuth2RefreshTokenUnavailableError({ methodIdentifier: method.identifier });
+	const refresher = yield* Service;
+	const tokens = yield* runHook(method.identifier, "oauth2TokenRefresh", () => refresher.refresh({
+		method,
+		refreshToken,
+		setup: context.setup
+	}));
+	return yield* prepareOAuth2Tokens(method, tokens, { setup: context.setup });
+});
+/**
+* Decode and prepare submitted setup input into encrypted stored material.
+*
+* @since 0.0.0
+* @category constructors
+*/
+const prepare = prepareUnknown;
+/**
+* Refresh already-decoded stored material when the auth method supports it.
+*
+* A result of `undefined` means the material is still usable and should not be
+* persisted again.
+*
+* @since 0.0.0
+* @category constructors
+*/
+const refreshDecoded = (method, material, context) => {
+	const impl = toImpl(method);
+	if (impl.oauth2 !== void 0) return refreshOAuth2Decoded(method, material, context);
+	const refresh = impl.refresh;
+	if (refresh === void 0) return Effect.void;
+	return runHook(impl.identifier, "refresh", () => refresh(material, context)).pipe(Effect.flatMap((refreshed) => refreshed === void 0 ? Effect.void : Schema.decodeUnknownEffect(impl.material)(refreshed)));
+};
+/**
+* Decode stored material and run the auth method refresh hook, if any.
+*
+* @since 0.0.0
+* @category constructors
+*/
+const refreshUnknown = (method, material, context) => decodeMaterial(method, material).pipe(Effect.flatMap((decodedMaterial) => refreshDecoded(method, decodedMaterial, context)));
+/**
+* Prepare normalized OAuth2 token exchange output into encrypted stored material.
+*
+* OAuth2 has no frontend-submitted setup input. The platform owns redirect,
+* callback, state/PKCE, and token exchange, then calls this helper at the
+* token-response boundary.
+*
+* @since 0.0.0
+* @category constructors
+*/
+const prepareOAuth2Tokens = (method, tokens, context) => {
+	const impl = toImpl(method);
+	if (impl.oauth2 === void 0) return Effect.fail(new ExpectedOAuth2MethodError({ methodIdentifier: impl.identifier }));
+	const fromTokens = impl.oauth2.fromTokens;
+	return (fromTokens === void 0 ? Effect.succeed(tokens) : runHook(impl.identifier, "prepareOAuth2Tokens", () => fromTokens(tokens, hookContext(context)))).pipe(Effect.flatMap((value) => Schema.decodeUnknownEffect(impl.material)(value)));
+};
+/**
+* Resolve already-decoded stored material into the runtime value handlers receive.
+*
+* @since 0.0.0
+* @category constructors
+*/
+const resolveDecoded = (method, material, context) => {
+	const impl = toImpl(method);
+	const resolve = impl.resolve;
+	if (resolve === void 0) return impl.material === impl.value ? Effect.succeed(material) : Schema.decodeUnknownEffect(impl.schema)(material);
+	return runHook(impl.identifier, "resolve", () => resolve(material, hookContext(context))).pipe(Effect.flatMap((value) => Schema.decodeUnknownEffect(impl.schema)(value)));
+};
+/**
+* Decode stored material and resolve it into the runtime value handlers receive.
+*
+* @since 0.0.0
+* @category constructors
+*/
+const resolve = (method, material, context) => decodeMaterial(method, material).pipe(Effect.flatMap((decodedMaterial) => resolveDecoded(method, decodedMaterial, context)));
+/**
+* Resolve untrusted persisted material into the runtime value handlers receive.
+*
+* This is the persistence-boundary variant of {@link resolve}: callers can pass
+* raw JSON from storage and the method material schema is decoded before any
+* provider hook runs.
+*
+* @since 0.0.0
+* @category constructors
+*/
+const resolveUnknown = resolve;
+const jsonAuth = {
+	authMethodId: Schema.NonEmptyString,
+	providerId: Schema.NonEmptyString,
+	setup: Schema.optionalKey(Schema.Json)
+};
+const JsonRequest = Schema.Union([
+	Schema.TaggedStruct("decodeSetup", jsonAuth),
+	Schema.TaggedStruct("prepare", {
+		...jsonAuth,
+		input: Schema.Json
+	}),
+	Schema.TaggedStruct("prepareOAuth2Tokens", {
+		...jsonAuth,
+		tokens: Schema.Struct({
+			accessToken: Schema.String,
+			expiresAt: Schema.optionalKey(Schema.Number),
+			expiresIn: Schema.optionalKey(Schema.Number),
+			raw: Schema.Record(Schema.String, Schema.Json),
+			refreshToken: Schema.optionalKey(Schema.String),
+			scope: Schema.optionalKey(Schema.String),
+			tokenType: Schema.optionalKey(Schema.String)
+		})
+	}),
+	Schema.TaggedStruct("refresh", {
+		...jsonAuth,
+		material: Schema.Json,
+		minValidityMs: Schema.Finite.check(Schema.isGreaterThanOrEqualTo(0)),
+		now: Schema.Finite,
+		reason: Schema.Literals(["before-use", "forced"])
+	}),
+	Schema.TaggedStruct("resolve", {
+		...jsonAuth,
+		material: Schema.Json
+	}),
+	Schema.TaggedStruct("display", {
+		...jsonAuth,
+		material: Schema.Json
+	}),
+	Schema.TaggedStruct("test", {
+		...jsonAuth,
+		material: Schema.Json
+	})
+]);
+/** Decode canonical JSON once; executable hooks and codecs stay in the guest. */
+const executeJson = Effect.fn("AuthMethod.executeJson")(function* (method, request) {
+	const decode = (schema, value) => Schema.decodeUnknownEffect(Schema.toCodecJson(schema))(value);
+	const encode = (schema, value) => Schema.encodeEffect(Schema.toCodecJson(schema))(value);
+	const setup = method.setup === void 0 ? void 0 : yield* decode(method.setup, request.setup);
+	if (request._tag === "decodeSetup") return method.setup === void 0 ? void 0 : yield* encode(method.setup, setup);
+	if (request._tag === "prepare") {
+		const input = method.input === void 0 ? void 0 : yield* decode(method.input, request.input);
+		return yield* encode(method.material, yield* prepareDecoded(method, input, { setup }));
+	}
+	if (request._tag === "prepareOAuth2Tokens") return yield* encode(method.material, yield* prepareOAuth2Tokens(method, request.tokens, { setup }));
+	const material = yield* decode(method.material, request.material);
+	if (request._tag === "refresh") {
+		const refreshed = yield* refreshDecoded(method, material, {
+			...request,
+			setup
+		});
+		return refreshed === void 0 ? void 0 : yield* encode(method.material, refreshed);
+	}
+	if (request._tag === "resolve") return {
+		methodId: method.identifier,
+		providerId: request.providerId,
+		value: yield* encode(method.value, yield* resolveDecoded(method, material, { setup }))
+	};
+	const impl = toImpl(method);
+	if (request._tag === "display") {
+		const hook = impl.display;
+		return hook === void 0 ? void 0 : yield* runHook(method.identifier, "display", () => hook(material, { setup }));
+	}
+	const hook = impl.test;
+	return hook === void 0 ? { ok: true } : yield* runHook(method.identifier, "test", () => hook(material, { setup }));
+});
+/** @since 0.0.0 @category constructors */
+const display = (method, material, context) => {
+	const impl = toImpl(method);
+	const displayHook = impl.display;
+	return decodeMaterial(method, material).pipe(Effect.flatMap((decodedMaterial) => displayHook === void 0 ? Effect.void : runHook(impl.identifier, "display", () => displayHook(decodedMaterial, hookContext(context)))));
+};
+/** @since 0.0.0 @category constructors */
+const test = (method, material, context) => {
+	const impl = toImpl(method);
+	const testHook = impl.test;
+	return decodeMaterial(method, material).pipe(Effect.flatMap((decodedMaterial) => testHook === void 0 ? Effect.succeed({ ok: true }) : runHook(impl.identifier, "test", () => testHook(decodedMaterial, hookContext(context)))));
+};
+//#endregion
+export { AuthMethodExecution_exports as AuthMethodExecution, AuthMethodExecution_exports, JsonRequest, decodeInput, decodeMaterial, decodeSetup, decodeValue, display, executeJson, prepare, prepareDecoded, prepareOAuth2Tokens, prepareUnknown, refreshDecoded, refreshUnknown, resolve, resolveDecoded, resolveUnknown, test };
+
+//# sourceMappingURL=AuthMethodExecution.js.map

package/dist/AuthMethodExecution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthMethodExecution.js","names":["AuthMethod.AuthMethodHookError","AuthMethod.OAuth2RefreshTokenUnavailableError","OAuth2TokenRefresher.Service","AuthMethod.ExpectedOAuth2MethodError"],"sources":["../src/AuthMethodExecution.ts"],"sourcesContent":["/**\n * Credential decoding, hook execution, material refresh, and value resolution.\n *\n * @since 0.0.0\n */\nimport { Effect, Schema } from \"effect\";\n\nimport * as AuthMethod from \"./AuthMethod.ts\";\nimport { OAuth2TokenRefresher } from \"./OAuth2TokenRefresher.ts\";\n\nconst hookError = (\n  methodIdentifier: string,\n  operation: AuthMethod.AuthMethodHookOperation,\n  cause: unknown,\n): AuthMethod.AuthMethodHookError =>\n  new AuthMethod.AuthMethodHookError({ cause, methodIdentifier, operation });\n\nconst runHook = <A, R>(\n  methodIdentifier: string,\n  operation: AuthMethod.AuthMethodHookOperation,\n  hook: () => AuthMethod.MaybeEffect<A, unknown, R>,\n): Effect.Effect<A, AuthMethod.AuthMethodHookError, R> =>\n  Effect.try({ catch: cause => hookError(methodIdentifier, operation, cause), try: hook }).pipe(\n    Effect.flatMap(result =>\n      toEffect(result).pipe(\n        Effect.mapError(cause => hookError(methodIdentifier, operation, cause)),\n      ),\n    ),\n  );\n\nconst toEffect = <Value, Error, Requirements>(\n  value: AuthMethod.MaybeEffect<Value, Error, Requirements>,\n): Effect.Effect<Value, Error, Requirements> =>\n  Effect.isEffect(value) ? value : Effect.succeed(value);\n\nconst hookContext = (\n  context: AuthMethod.HookContext<unknown> | undefined,\n): AuthMethod.HookContext<unknown> => context ?? { setup: undefined };\n\n/**\n * Erased runtime view of an auth method.\n *\n * Execution helpers implement against this view and re-expose precise\n * per-method types through their public signatures; the single `as never`\n * closing each implementation is the contained boundary between the two.\n */\ninterface AnyImpl {\n  readonly identifier: string;\n  readonly kind: AuthMethod.AuthMethodKind;\n  readonly setup: Schema.Top | undefined;\n  readonly input: Schema.Top | undefined;\n  readonly material: Schema.Top;\n  readonly value: Schema.Top;\n  readonly schema: Schema.Top;\n  readonly prepare: AuthMethod.PrepareHook<unknown, unknown, unknown, unknown, unknown> | undefined;\n  readonly refresh: AuthMethod.RefreshHook<unknown, unknown, unknown, unknown> | undefined;\n  readonly resolve: AuthMethod.ResolveHook<unknown, unknown, unknown, unknown, unknown> | undefined;\n  readonly display: AuthMethod.DisplayHook<unknown, unknown, unknown, unknown> | undefined;\n  readonly test: AuthMethod.TestHook<unknown, unknown, unknown, unknown> | undefined;\n  readonly oauth2: AuthMethod.OAuth2Setup<Schema.Top, unknown, unknown> | undefined;\n}\n\nconst toImpl = (method: AuthMethod.Any): AnyImpl => method as AnyImpl;\n\ntype SetupRequirements<Method extends AuthMethod.Any> =\n  AuthMethod.SetupSchema<Method> extends Schema.Top\n    ? Schema.Codec.DecodingServices<AuthMethod.SetupSchema<Method>>\n    : never;\n\ntype InputRequirements<Method extends AuthMethod.Any> =\n  AuthMethod.InputSchema<Method> extends Schema.Top\n    ? Schema.Codec.DecodingServices<AuthMethod.InputSchema<Method>>\n    : never;\n\ntype MaterialRequirements<Method extends AuthMethod.Any> = Schema.Codec.DecodingServices<\n  AuthMethod.MaterialSchema<Method>\n>;\n\ntype ValueRequirements<Method extends AuthMethod.Any> = Schema.Codec.DecodingServices<\n  AuthMethod.ValueSchema<Method>\n>;\n\n/**\n * Decode a runtime auth value using the selected method schema.\n *\n * @since 0.0.0\n * @category constructors\n */\nexport const decodeValue: <Method extends AuthMethod.Any>(\n  method: Method,\n  value: unknown,\n) => Effect.Effect<AuthMethod.Value<Method>, Schema.SchemaError, ValueRequirements<Method>> = (\n  method,\n  value,\n) => Schema.decodeUnknownEffect(toImpl(method).schema)(value) as never;\n\n/**\n * Decode organization/admin-level setup for a method, if it declares one.\n *\n * @since 0.0.0\n * @category constructors\n */\nexport const decodeSetup: <Method extends AuthMethod.Any>(\n  method: Method,\n  setup: unknown,\n) => Effect.Effect<AuthMethod.Setup<Method>, Schema.SchemaError, SetupRequirements<Method>> = (\n  method,\n  setup,\n) => {\n  const impl = toImpl(method);\n  return (\n    impl.setup === undefined ? Effect.void : Schema.decodeUnknownEffect(impl.setup)(setup)\n  ) as never;\n};\n\n/**\n * Decode submitted setup input using the method input schema, if any.\n *\n * @since 0.0.0\n * @category constructors\n */\nexport const decodeInput: <Method extends AuthMethod.Any>(\n  method: Method,\n  input: unknown,\n) => Effect.Effect<AuthMethod.Input<Method>, Schema.SchemaError, InputRequirements<Method>> = (\n  method,\n  input,\n) => {\n  const impl = toImpl(method);\n  return (\n    impl.input === undefined ? Effect.void : Schema.decodeUnknownEffect(impl.input)(input)\n  ) as never;\n};\n\n/**\n * Decode encrypted stored material using the method material schema.\n *\n * @since 0.0.0\n * @category constructors\n */\nexport const decodeMaterial: <Method extends AuthMethod.Any>(\n  method: Method,\n  material: unknown,\n) => Effect.Effect<\n  AuthMethod.Material<Method>,\n  Schema.SchemaError,\n  MaterialRequirements<Method>\n> = (method, material) => Schema.decodeUnknownEffect(toImpl(method).material)(material) as never;\n\n/**\n * Prepare already-decoded setup input into encrypted stored material.\n *\n * @since 0.0.0\n * @category constructors\n */\nexport const prepareDecoded: <Method extends AuthMethod.Any>(\n  method: Method,\n  input: AuthMethod.Input<Method>,\n  context?: AuthMethod.HookContext<AuthMethod.Setup<Method>>,\n) => Effect.Effect<\n  AuthMethod.Material<Method>,\n  Schema.SchemaError | AuthMethod.AuthMethodHookError,\n  MaterialRequirements<Method> | AuthMethod.Requirements<Method>\n> = (method, input, context) => {\n  const impl = toImpl(method);\n  const prepare = impl.prepare;\n\n  if (prepare === undefined) {\n    return (\n      impl.input === impl.material\n        ? Effect.succeed(input)\n        : Schema.decodeUnknownEffect(impl.material)(input)\n    ) as never;\n  }\n\n  return runHook(impl.identifier, \"prepare\", () => prepare(input, hookContext(context))).pipe(\n    Effect.flatMap(material => Schema.decodeUnknownEffect(impl.material)(material)),\n  ) as never;\n};\n\n/**\n * Decode and prepare submitted setup input into encrypted stored material.\n *\n * @since 0.0.0\n * @category constructors\n */\nexport const prepareUnknown: <Method extends AuthMethod.Any>(\n  method: Method,\n  input: unknown,\n  context?: AuthMethod.HookContext<AuthMethod.Setup<Method>>,\n) => Effect.Effect<\n  AuthMethod.Material<Method>,\n  Schema.SchemaError | AuthMethod.AuthMethodHookError,\n  InputRequirements<Method> | MaterialRequirements<Method> | AuthMethod.Requirements<Method>\n> = (method, input, context) =>\n  decodeInput(method, input).pipe(\n    Effect.flatMap(decodedInput => prepareDecoded(method, decodedInput, context)),\n  );\n\nconst oauth2ExpiresAt = (material: unknown): number | undefined =>\n  typeof material === \"object\" && material !== null && \"expiresAt\" in material\n    ? typeof (material as { readonly expiresAt?: unknown }).expiresAt === \"number\"\n      ? (material as { readonly expiresAt: number }).expiresAt\n      : undefined\n    : undefined;\n\nconst oauth2RefreshToken = (material: unknown): string | undefined =>\n  typeof material === \"object\" && material !== null && \"refreshToken\" in material\n    ? typeof (material as { readonly refreshToken?: unknown }).refreshToken === \"string\" &&\n      (material as { readonly refreshToken: string }).refreshToken.trim() !== \"\"\n      ? (material as { readonly refreshToken: string }).refreshToken\n      : undefined\n    : undefined;\n\nconst refreshOAuth2Decoded = Effect.fn(\"AuthMethod.refreshOAuth2Decoded\")(function* (\n  method: AuthMethod.Any,\n  material: unknown,\n  context: AuthMethod.RefreshContext<unknown>,\n) {\n  if (\n    context.reason === \"before-use\" &&\n    (oauth2ExpiresAt(material) ?? Number.NEGATIVE_INFINITY) > context.now + context.minValidityMs\n  ) {\n    return undefined;\n  }\n\n  const refreshToken = oauth2RefreshToken(material);\n  if (refreshToken === undefined) {\n    return yield* new AuthMethod.OAuth2RefreshTokenUnavailableError({\n      methodIdentifier: method.identifier,\n    });\n  }\n\n  const refresher = yield* OAuth2TokenRefresher.Service;\n  const tokens = yield* runHook(method.identifier, \"oauth2TokenRefresh\", () =>\n    refresher.refresh({ method, refreshToken, setup: context.setup }),\n  );\n  return yield* prepareOAuth2Tokens(method, tokens, { setup: context.setup });\n});\n\n/**\n * Decode and prepare submitted setup input into encrypted stored material.\n *\n * @since 0.0.0\n * @category constructors\n */\nexport const prepare = prepareUnknown;\n\n/**\n * Refresh already-decoded stored material when the auth method supports it.\n *\n * A result of `undefined` means the material is still usable and should not be\n * persisted again.\n *\n * @since 0.0.0\n * @category constructors\n */\nexport const refreshDecoded: <Method extends AuthMethod.Any>(\n  method: Method,\n  material: AuthMethod.Material<Method>,\n  context: AuthMethod.RefreshContext<AuthMethod.Setup<Method>>,\n) => Effect.Effect<\n  AuthMethod.Material<Method> | undefined,\n  | AuthMethod.ExpectedOAuth2MethodError\n  | AuthMethod.OAuth2RefreshTokenUnavailableError\n  | Schema.SchemaError\n  | AuthMethod.AuthMethodHookError,\n  MaterialRequirements<Method> | AuthMethod.Requirements<Method>\n> = (method, material, context) => {\n  const impl = toImpl(method);\n\n  if (impl.oauth2 !== undefined) {\n    return refreshOAuth2Decoded(method, material, context) as never;\n  }\n\n  const refresh = impl.refresh;\n  if (refresh === undefined) {\n    return Effect.void as never;\n  }\n\n  return runHook(impl.identifier, \"refresh\", () => refresh(material, context)).pipe(\n    Effect.flatMap(refreshed =>\n      refreshed === undefined ? Effect.void : Schema.decodeUnknownEffect(impl.material)(refreshed),\n    ),\n  ) as never;\n};\n\n/**\n * Decode stored material and run the auth method refresh hook, if any.\n *\n * @since 0.0.0\n * @category constructors\n */\nexport const refreshUnknown: <Method extends AuthMethod.Any>(\n  method: Method,\n  material: unknown,\n  context: AuthMethod.RefreshContext<AuthMethod.Setup<Method>>,\n) => Effect.Effect<\n  AuthMethod.Material<Method> | undefined,\n  | AuthMethod.ExpectedOAuth2MethodError\n  | AuthMethod.OAuth2RefreshTokenUnavailableError\n  | Schema.SchemaError\n  | AuthMethod.AuthMethodHookError,\n  MaterialRequirements<Method> | AuthMethod.Requirements<Method>\n> = (method, material, context) =>\n  decodeMaterial(method, material).pipe(\n    Effect.flatMap(decodedMaterial => refreshDecoded(method, decodedMaterial, context)),\n  );\n\n/**\n * Prepare normalized OAuth2 token exchange output into encrypted stored material.\n *\n * OAuth2 has no frontend-submitted setup input. The platform owns redirect,\n * callback, state/PKCE, and token exchange, then calls this helper at the\n * token-response boundary.\n *\n * @since 0.0.0\n * @category constructors\n */\nexport const prepareOAuth2Tokens: <Method extends AuthMethod.Any>(\n  method: Method,\n  tokens: AuthMethod.OAuth2TokenResponse,\n  context?: AuthMethod.HookContext<AuthMethod.Setup<Method>>,\n) => Effect.Effect<\n  AuthMethod.Material<Method>,\n  AuthMethod.ExpectedOAuth2MethodError | Schema.SchemaError | AuthMethod.AuthMethodHookError,\n  MaterialRequirements<Method> | AuthMethod.Requirements<Method>\n> = (method, tokens, context) => {\n  const impl = toImpl(method);\n\n  if (impl.oauth2 === undefined) {\n    return Effect.fail(\n      new AuthMethod.ExpectedOAuth2MethodError({ methodIdentifier: impl.identifier }),\n    ) as never;\n  }\n\n  const fromTokens = impl.oauth2.fromTokens;\n  const material: Effect.Effect<unknown, unknown, unknown> =\n    fromTokens === undefined\n      ? Effect.succeed(tokens)\n      : runHook(impl.identifier, \"prepareOAuth2Tokens\", () =>\n          fromTokens(tokens, hookContext(context)),\n        );\n\n  return material.pipe(\n    Effect.flatMap(value => Schema.decodeUnknownEffect(impl.material)(value)),\n  ) as never;\n};\n\n/**\n * Resolve already-decoded stored material into the runtime value handlers receive.\n *\n * @since 0.0.0\n * @category constructors\n */\nexport const resolveDecoded: <Method extends AuthMethod.Any>(\n  method: Method,\n  material: AuthMethod.Material<Method>,\n  context?: AuthMethod.HookContext<AuthMethod.Setup<Method>>,\n) => Effect.Effect<\n  AuthMethod.Value<Method>,\n  Schema.SchemaError | AuthMethod.AuthMethodHookError,\n  ValueRequirements<Method> | AuthMethod.Requirements<Method>\n> = (method, material, context) => {\n  const impl = toImpl(method);\n  const resolve = impl.resolve;\n\n  if (resolve === undefined) {\n    return (\n      impl.material === impl.value\n        ? Effect.succeed(material)\n        : Schema.decodeUnknownEffect(impl.schema)(material)\n    ) as never;\n  }\n\n  return runHook(impl.identifier, \"resolve\", () => resolve(material, hookContext(context))).pipe(\n    Effect.flatMap(value => Schema.decodeUnknownEffect(impl.schema)(value)),\n  ) as never;\n};\n\n/**\n * Decode stored material and resolve it into the runtime value handlers receive.\n *\n * @since 0.0.0\n * @category constructors\n */\nexport const resolve: <Method extends AuthMethod.Any>(\n  method: Method,\n  material: unknown,\n  context?: AuthMethod.HookContext<AuthMethod.Setup<Method>>,\n) => Effect.Effect<\n  AuthMethod.Value<Method>,\n  Schema.SchemaError | AuthMethod.AuthMethodHookError,\n  MaterialRequirements<Method> | ValueRequirements<Method> | AuthMethod.Requirements<Method>\n> = (method, material, context) =>\n  decodeMaterial(method, material).pipe(\n    Effect.flatMap(decodedMaterial => resolveDecoded(method, decodedMaterial, context)),\n  );\n\n/**\n * Resolve untrusted persisted material into the runtime value handlers receive.\n *\n * This is the persistence-boundary variant of {@link resolve}: callers can pass\n * raw JSON from storage and the method material schema is decoded before any\n * provider hook runs.\n *\n * @since 0.0.0\n * @category constructors\n */\nexport const resolveUnknown: typeof resolve = resolve;\n\nconst jsonAuth = {\n  authMethodId: Schema.NonEmptyString,\n  providerId: Schema.NonEmptyString,\n  setup: Schema.optionalKey(Schema.Json),\n};\n\n/** Operation-specific authentication data for isolated execution. */\nexport type JsonRequest = typeof JsonRequest.Type;\nexport const JsonRequest = Schema.Union([\n  Schema.TaggedStruct(\"decodeSetup\", jsonAuth),\n  Schema.TaggedStruct(\"prepare\", { ...jsonAuth, input: Schema.Json }),\n  Schema.TaggedStruct(\"prepareOAuth2Tokens\", {\n    ...jsonAuth,\n    tokens: Schema.Struct({\n      accessToken: Schema.String,\n      expiresAt: Schema.optionalKey(Schema.Number),\n      expiresIn: Schema.optionalKey(Schema.Number),\n      raw: Schema.Record(Schema.String, Schema.Json),\n      refreshToken: Schema.optionalKey(Schema.String),\n      scope: Schema.optionalKey(Schema.String),\n      tokenType: Schema.optionalKey(Schema.String),\n    }),\n  }),\n  Schema.TaggedStruct(\"refresh\", {\n    ...jsonAuth,\n    material: Schema.Json,\n    minValidityMs: Schema.Finite.check(Schema.isGreaterThanOrEqualTo(0)),\n    now: Schema.Finite,\n    reason: Schema.Literals([\"before-use\", \"forced\"]),\n  }),\n  Schema.TaggedStruct(\"resolve\", { ...jsonAuth, material: Schema.Json }),\n  Schema.TaggedStruct(\"display\", { ...jsonAuth, material: Schema.Json }),\n  Schema.TaggedStruct(\"test\", { ...jsonAuth, material: Schema.Json }),\n]);\n\n/** Decode canonical JSON once; executable hooks and codecs stay in the guest. */\nexport const executeJson = Effect.fn(\"AuthMethod.executeJson\")(function* (\n  method: AuthMethod.Any,\n  request: JsonRequest,\n) {\n  const decode = (schema: Schema.Top, value: unknown) =>\n    Schema.decodeUnknownEffect(Schema.toCodecJson(schema))(value);\n  const encode = (schema: Schema.Top, value: unknown) =>\n    Schema.encodeEffect(Schema.toCodecJson(schema))(value);\n  const setup = method.setup === undefined ? undefined : yield* decode(method.setup, request.setup);\n  if (request._tag === \"decodeSetup\") {\n    return method.setup === undefined ? undefined : yield* encode(method.setup, setup);\n  }\n  if (request._tag === \"prepare\") {\n    const input =\n      method.input === undefined ? undefined : yield* decode(method.input, request.input);\n    return yield* encode(method.material, yield* prepareDecoded(method, input, { setup }));\n  }\n  if (request._tag === \"prepareOAuth2Tokens\") {\n    return yield* encode(\n      method.material,\n      yield* prepareOAuth2Tokens(method, request.tokens, { setup }),\n    );\n  }\n  const material = yield* decode(method.material, request.material);\n  if (request._tag === \"refresh\") {\n    const refreshed = yield* refreshDecoded(method, material, { ...request, setup });\n    return refreshed === undefined ? undefined : yield* encode(method.material, refreshed);\n  }\n  if (request._tag === \"resolve\") {\n    return {\n      methodId: method.identifier,\n      providerId: request.providerId,\n      value: yield* encode(method.value, yield* resolveDecoded(method, material, { setup })),\n    };\n  }\n  const impl = toImpl(method);\n  if (request._tag === \"display\") {\n    const hook = impl.display;\n    return hook === undefined\n      ? undefined\n      : yield* runHook(method.identifier, \"display\", () => hook(material, { setup }));\n  }\n  const hook = impl.test;\n  return hook === undefined\n    ? { ok: true }\n    : yield* runHook(method.identifier, \"test\", () => hook(material, { setup }));\n});\n\n/** @since 0.0.0 @category constructors */\nexport const display: <Method extends AuthMethod.Any>(\n  method: Method,\n  material: AuthMethod.Material<Method>,\n  context?: AuthMethod.HookContext<AuthMethod.Setup<Method>>,\n) => Effect.Effect<\n  AuthMethod.Display | undefined,\n  Schema.SchemaError | AuthMethod.AuthMethodHookError,\n  MaterialRequirements<Method> | AuthMethod.Requirements<Method>\n> = (method, material, context) => {\n  const impl = toImpl(method);\n  const displayHook = impl.display;\n\n  return decodeMaterial(method, material).pipe(\n    Effect.flatMap(decodedMaterial =>\n      displayHook === undefined\n        ? Effect.void\n        : runHook(impl.identifier, \"display\", () =>\n            displayHook(decodedMaterial, hookContext(context)),\n          ),\n    ),\n  ) as never;\n};\n\n/** @since 0.0.0 @category constructors */\nexport const test: <Method extends AuthMethod.Any>(\n  method: Method,\n  material: AuthMethod.Material<Method>,\n  context?: AuthMethod.HookContext<AuthMethod.Setup<Method>>,\n) => Effect.Effect<\n  AuthMethod.TestResult,\n  Schema.SchemaError | AuthMethod.AuthMethodHookError,\n  MaterialRequirements<Method> | AuthMethod.Requirements<Method>\n> = (method, material, context) => {\n  const impl = toImpl(method);\n  const testHook = impl.test;\n\n  return decodeMaterial(method, material).pipe(\n    Effect.flatMap(decodedMaterial =>\n      testHook === undefined\n        ? Effect.succeed<AuthMethod.TestResult>({ ok: true })\n        : runHook(impl.identifier, \"test\", () => testHook(decodedMaterial, hookContext(context))),\n    ),\n  ) as never;\n};\n\nexport * as AuthMethodExecution from \"./AuthMethodExecution.ts\";\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAUA,MAAM,aACJ,kBACA,WACA,UAEA,IAAIA,oBAA+B;CAAE;CAAO;CAAkB;AAAU,CAAC;AAE3E,MAAM,WACJ,kBACA,WACA,SAEA,OAAO,IAAI;CAAE,QAAO,UAAS,UAAU,kBAAkB,WAAW,KAAK;CAAG,KAAK;AAAK,CAAC,CAAC,CAAC,KACvF,OAAO,SAAQ,WACb,SAAS,MAAM,CAAC,CAAC,KACf,OAAO,UAAS,UAAS,UAAU,kBAAkB,WAAW,KAAK,CAAC,CACxE,CACF,CACF;AAEF,MAAM,YACJ,UAEA,OAAO,SAAS,KAAK,IAAI,QAAQ,OAAO,QAAQ,KAAK;AAEvD,MAAM,eACJ,YACoC,WAAW,EAAE,OAAO,KAAA,EAAU;AAyBpE,MAAM,UAAU,WAAoC;;;;;;;AA0BpD,MAAa,eAIX,QACA,UACG,OAAO,oBAAoB,OAAO,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK;;;;;;;AAQ5D,MAAa,eAIX,QACA,UACG;CACH,MAAM,OAAO,OAAO,MAAM;CAC1B,OACE,KAAK,UAAU,KAAA,IAAY,OAAO,OAAO,OAAO,oBAAoB,KAAK,KAAK,CAAC,CAAC,KAAK;AAEzF;;;;;;;AAQA,MAAa,eAIX,QACA,UACG;CACH,MAAM,OAAO,OAAO,MAAM;CAC1B,OACE,KAAK,UAAU,KAAA,IAAY,OAAO,OAAO,OAAO,oBAAoB,KAAK,KAAK,CAAC,CAAC,KAAK;AAEzF;;;;;;;AAQA,MAAa,kBAOR,QAAQ,aAAa,OAAO,oBAAoB,OAAO,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,QAAQ;;;;;;;AAQtF,MAAa,kBAQR,QAAQ,OAAO,YAAY;CAC9B,MAAM,OAAO,OAAO,MAAM;CAC1B,MAAM,UAAU,KAAK;CAErB,IAAI,YAAY,KAAA,GACd,OACE,KAAK,UAAU,KAAK,WAChB,OAAO,QAAQ,KAAK,IACpB,OAAO,oBAAoB,KAAK,QAAQ,CAAC,CAAC,KAAK;CAIvD,OAAO,QAAQ,KAAK,YAAY,iBAAiB,QAAQ,OAAO,YAAY,OAAO,CAAC,CAAC,CAAC,CAAC,KACrF,OAAO,SAAQ,aAAY,OAAO,oBAAoB,KAAK,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAChF;AACF;;;;;;;AAQA,MAAa,kBAQR,QAAQ,OAAO,YAClB,YAAY,QAAQ,KAAK,CAAC,CAAC,KACzB,OAAO,SAAQ,iBAAgB,eAAe,QAAQ,cAAc,OAAO,CAAC,CAC9E;AAEF,MAAM,mBAAmB,aACvB,OAAO,aAAa,YAAY,aAAa,QAAQ,eAAe,WAChE,OAAQ,SAA8C,cAAc,WACjE,SAA4C,YAC7C,KAAA,IACF,KAAA;AAEN,MAAM,sBAAsB,aAC1B,OAAO,aAAa,YAAY,aAAa,QAAQ,kBAAkB,WACnE,OAAQ,SAAiD,iBAAiB,YACzE,SAA+C,aAAa,KAAK,MAAM,KACrE,SAA+C,eAChD,KAAA,IACF,KAAA;AAEN,MAAM,uBAAuB,OAAO,GAAG,iCAAiC,CAAC,CAAC,WACxE,QACA,UACA,SACA;CACA,IACE,QAAQ,WAAW,iBAClB,gBAAgB,QAAQ,KAAK,OAAO,qBAAqB,QAAQ,MAAM,QAAQ,eAEhF;CAGF,MAAM,eAAe,mBAAmB,QAAQ;CAChD,IAAI,iBAAiB,KAAA,GACnB,OAAO,OAAO,IAAIC,mCAA8C,EAC9D,kBAAkB,OAAO,WAC3B,CAAC;CAGH,MAAM,YAAY,OAAOC;CACzB,MAAM,SAAS,OAAO,QAAQ,OAAO,YAAY,4BAC/C,UAAU,QAAQ;EAAE;EAAQ;EAAc,OAAO,QAAQ;CAAM,CAAC,CAClE;CACA,OAAO,OAAO,oBAAoB,QAAQ,QAAQ,EAAE,OAAO,QAAQ,MAAM,CAAC;AAC5E,CAAC;;;;;;;AAQD,MAAa,UAAU;;;;;;;;;;AAWvB,MAAa,kBAWR,QAAQ,UAAU,YAAY;CACjC,MAAM,OAAO,OAAO,MAAM;CAE1B,IAAI,KAAK,WAAW,KAAA,GAClB,OAAO,qBAAqB,QAAQ,UAAU,OAAO;CAGvD,MAAM,UAAU,KAAK;CACrB,IAAI,YAAY,KAAA,GACd,OAAO,OAAO;CAGhB,OAAO,QAAQ,KAAK,YAAY,iBAAiB,QAAQ,UAAU,OAAO,CAAC,CAAC,CAAC,KAC3E,OAAO,SAAQ,cACb,cAAc,KAAA,IAAY,OAAO,OAAO,OAAO,oBAAoB,KAAK,QAAQ,CAAC,CAAC,SAAS,CAC7F,CACF;AACF;;;;;;;AAQA,MAAa,kBAWR,QAAQ,UAAU,YACrB,eAAe,QAAQ,QAAQ,CAAC,CAAC,KAC/B,OAAO,SAAQ,oBAAmB,eAAe,QAAQ,iBAAiB,OAAO,CAAC,CACpF;;;;;;;;;;;AAYF,MAAa,uBAQR,QAAQ,QAAQ,YAAY;CAC/B,MAAM,OAAO,OAAO,MAAM;CAE1B,IAAI,KAAK,WAAW,KAAA,GAClB,OAAO,OAAO,KACZ,IAAIC,0BAAqC,EAAE,kBAAkB,KAAK,WAAW,CAAC,CAChF;CAGF,MAAM,aAAa,KAAK,OAAO;CAQ/B,QANE,eAAe,KAAA,IACX,OAAO,QAAQ,MAAM,IACrB,QAAQ,KAAK,YAAY,6BACvB,WAAW,QAAQ,YAAY,OAAO,CAAC,CACzC,EAAA,CAEU,KACd,OAAO,SAAQ,UAAS,OAAO,oBAAoB,KAAK,QAAQ,CAAC,CAAC,KAAK,CAAC,CAC1E;AACF;;;;;;;AAQA,MAAa,kBAQR,QAAQ,UAAU,YAAY;CACjC,MAAM,OAAO,OAAO,MAAM;CAC1B,MAAM,UAAU,KAAK;CAErB,IAAI,YAAY,KAAA,GACd,OACE,KAAK,aAAa,KAAK,QACnB,OAAO,QAAQ,QAAQ,IACvB,OAAO,oBAAoB,KAAK,MAAM,CAAC,CAAC,QAAQ;CAIxD,OAAO,QAAQ,KAAK,YAAY,iBAAiB,QAAQ,UAAU,YAAY,OAAO,CAAC,CAAC,CAAC,CAAC,KACxF,OAAO,SAAQ,UAAS,OAAO,oBAAoB,KAAK,MAAM,CAAC,CAAC,KAAK,CAAC,CACxE;AACF;;;;;;;AAQA,MAAa,WAQR,QAAQ,UAAU,YACrB,eAAe,QAAQ,QAAQ,CAAC,CAAC,KAC/B,OAAO,SAAQ,oBAAmB,eAAe,QAAQ,iBAAiB,OAAO,CAAC,CACpF;;;;;;;;;;;AAYF,MAAa,iBAAiC;AAE9C,MAAM,WAAW;CACf,cAAc,OAAO;CACrB,YAAY,OAAO;CACnB,OAAO,OAAO,YAAY,OAAO,IAAI;AACvC;AAIA,MAAa,cAAc,OAAO,MAAM;CACtC,OAAO,aAAa,eAAe,QAAQ;CAC3C,OAAO,aAAa,WAAW;EAAE,GAAG;EAAU,OAAO,OAAO;CAAK,CAAC;CAClE,OAAO,aAAa,uBAAuB;EACzC,GAAG;EACH,QAAQ,OAAO,OAAO;GACpB,aAAa,OAAO;GACpB,WAAW,OAAO,YAAY,OAAO,MAAM;GAC3C,WAAW,OAAO,YAAY,OAAO,MAAM;GAC3C,KAAK,OAAO,OAAO,OAAO,QAAQ,OAAO,IAAI;GAC7C,cAAc,OAAO,YAAY,OAAO,MAAM;GAC9C,OAAO,OAAO,YAAY,OAAO,MAAM;GACvC,WAAW,OAAO,YAAY,OAAO,MAAM;EAC7C,CAAC;CACH,CAAC;CACD,OAAO,aAAa,WAAW;EAC7B,GAAG;EACH,UAAU,OAAO;EACjB,eAAe,OAAO,OAAO,MAAM,OAAO,uBAAuB,CAAC,CAAC;EACnE,KAAK,OAAO;EACZ,QAAQ,OAAO,SAAS,CAAC,cAAc,QAAQ,CAAC;CAClD,CAAC;CACD,OAAO,aAAa,WAAW;EAAE,GAAG;EAAU,UAAU,OAAO;CAAK,CAAC;CACrE,OAAO,aAAa,WAAW;EAAE,GAAG;EAAU,UAAU,OAAO;CAAK,CAAC;CACrE,OAAO,aAAa,QAAQ;EAAE,GAAG;EAAU,UAAU,OAAO;CAAK,CAAC;AACpE,CAAC;;AAGD,MAAa,cAAc,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAC7D,QACA,SACA;CACA,MAAM,UAAU,QAAoB,UAClC,OAAO,oBAAoB,OAAO,YAAY,MAAM,CAAC,CAAC,CAAC,KAAK;CAC9D,MAAM,UAAU,QAAoB,UAClC,OAAO,aAAa,OAAO,YAAY,MAAM,CAAC,CAAC,CAAC,KAAK;CACvD,MAAM,QAAQ,OAAO,UAAU,KAAA,IAAY,KAAA,IAAY,OAAO,OAAO,OAAO,OAAO,QAAQ,KAAK;CAChG,IAAI,QAAQ,SAAS,eACnB,OAAO,OAAO,UAAU,KAAA,IAAY,KAAA,IAAY,OAAO,OAAO,OAAO,OAAO,KAAK;CAEnF,IAAI,QAAQ,SAAS,WAAW;EAC9B,MAAM,QACJ,OAAO,UAAU,KAAA,IAAY,KAAA,IAAY,OAAO,OAAO,OAAO,OAAO,QAAQ,KAAK;EACpF,OAAO,OAAO,OAAO,OAAO,UAAU,OAAO,eAAe,QAAQ,OAAO,EAAE,MAAM,CAAC,CAAC;CACvF;CACA,IAAI,QAAQ,SAAS,uBACnB,OAAO,OAAO,OACZ,OAAO,UACP,OAAO,oBAAoB,QAAQ,QAAQ,QAAQ,EAAE,MAAM,CAAC,CAC9D;CAEF,MAAM,WAAW,OAAO,OAAO,OAAO,UAAU,QAAQ,QAAQ;CAChE,IAAI,QAAQ,SAAS,WAAW;EAC9B,MAAM,YAAY,OAAO,eAAe,QAAQ,UAAU;GAAE,GAAG;GAAS;EAAM,CAAC;EAC/E,OAAO,cAAc,KAAA,IAAY,KAAA,IAAY,OAAO,OAAO,OAAO,UAAU,SAAS;CACvF;CACA,IAAI,QAAQ,SAAS,WACnB,OAAO;EACL,UAAU,OAAO;EACjB,YAAY,QAAQ;EACpB,OAAO,OAAO,OAAO,OAAO,OAAO,OAAO,eAAe,QAAQ,UAAU,EAAE,MAAM,CAAC,CAAC;CACvF;CAEF,MAAM,OAAO,OAAO,MAAM;CAC1B,IAAI,QAAQ,SAAS,WAAW;EAC9B,MAAM,OAAO,KAAK;EAClB,OAAO,SAAS,KAAA,IACZ,KAAA,IACA,OAAO,QAAQ,OAAO,YAAY,iBAAiB,KAAK,UAAU,EAAE,MAAM,CAAC,CAAC;CAClF;CACA,MAAM,OAAO,KAAK;CAClB,OAAO,SAAS,KAAA,IACZ,EAAE,IAAI,KAAK,IACX,OAAO,QAAQ,OAAO,YAAY,cAAc,KAAK,UAAU,EAAE,MAAM,CAAC,CAAC;AAC/E,CAAC;;AAGD,MAAa,WAQR,QAAQ,UAAU,YAAY;CACjC,MAAM,OAAO,OAAO,MAAM;CAC1B,MAAM,cAAc,KAAK;CAEzB,OAAO,eAAe,QAAQ,QAAQ,CAAC,CAAC,KACtC,OAAO,SAAQ,oBACb,gBAAgB,KAAA,IACZ,OAAO,OACP,QAAQ,KAAK,YAAY,iBACvB,YAAY,iBAAiB,YAAY,OAAO,CAAC,CACnD,CACN,CACF;AACF;;AAGA,MAAa,QAQR,QAAQ,UAAU,YAAY;CACjC,MAAM,OAAO,OAAO,MAAM;CAC1B,MAAM,WAAW,KAAK;CAEtB,OAAO,eAAe,QAAQ,QAAQ,CAAC,CAAC,KACtC,OAAO,SAAQ,oBACb,aAAa,KAAA,IACT,OAAO,QAA+B,EAAE,IAAI,KAAK,CAAC,IAClD,QAAQ,KAAK,YAAY,cAAc,SAAS,iBAAiB,YAAY,OAAO,CAAC,CAAC,CAC5F,CACF;AACF"}