@dual-os/sdk 0.0.0-stage → 0.8.0-next.0

package/dist/AuthMethod.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthMethod.d.ts","names":["OAuth2TokenRefresher.Service"],"sources":["../src/AuthMethod.ts"],"mappings":";;;;;;;;;;;;qBAoBa;;;;;YAMD,gBAAgB;;;;;;;;;;;;;;;;;iBAkBX,yBAAyB;WAC/B,eAAe,MAAM,UAAU;;;;;;;;iBASzB,YAAY,SAAS;YAC1B,SAAS;WACV;WACA;WACA;WACA,MAAM;WACN,OAAO,OAAO;WACd,OAAO,OAAO;WACd,UAAU,OAAO;WACjB,OAAO,OAAO;WACd,QAAQ,OAAO;WACf;WACA;WACA;WACA;WACA;WACA,QAAQ,YAAY,OAAO;;;YAI1B;;YAGA,WAAW,kBAAkB,OAAO,mBAAmB,kBAAkB,OAAO,MACxF,OAAO,OAAO,KAAK;;iBAIN,YAAY;WAClB,OAAO;;;YAIN,YAAY,OAAO,eAAe,wBAC1C,QACA,OAAO,OAAO,OAAO,OAAO;;YAGpB,YAAY,OAAO,UAAU,eAAe,sBAAsB,sBAC5E,OAAO,OACP,SAAS,YAAY,WAClB,YAAY,UAAU,OAAO;;YAGtB;;iBAGK,eAAe,2BAA2B,YAAY;WAC5D;WACA;WACA,QAAQ;;;YAIP,YAAY,UAAU,eAAe,sBAAsB,sBACrE,UAAU,UACV,SAAS,eAAe,WACrB,YAAY,sBAAsB,OAAO;;YAGlC,YAAY,UAAU,OAAO,eAAe,sBAAsB,sBAC5E,UAAU,UACV,SAAS,YAAY,WAClB,YAAY,OAAO,OAAO;;iBAGd;WACN;WACA;WACA,WAAW;;;YAIV,YAAY,UAAU,eAAe,sBAAsB,sBACrE,UAAU,UACV,SAAS,YAAY,WAClB,YAAY,SAAS,OAAO;;iBAGhB;WACN;WACA;;;;;;qBAIE,kCAAkC;;YAMnC,SAAS,UAAU,eAAe,sBAAsB,sBAClE,UAAU,UACV,SAAS,YAAY,WAClB,YAAY,YAAY,OAAO;;;;;;;iBAQnB,kBAAkB,oBAAoB,OAAO;WACnD;WACA;WACA,QAAQ;;;iBAIF,YACf,oBAAoB,OAAO,KAC3B,oBAAoB,OAAO,qCACnB,kBAAkB;WACjB,QAAQ;;;iBAIF,2BACf,oBAAoB,OAAO,KAC3B,oBAAoB,OAAO,MAAM,aACjC,oBAAoB,OAAO,6BAC3B,6BACA,6BACA,6BACA,6BACA;WAES;WACA;WACA,QAAQ;WACR,OAAO;WACP;WACA,QAAQ;WACR,UAAU,YACjB,WAAW,cACX,WAAW,mBAEX,qBACA,WAAW;WAEJ,UAAU,YACjB,WAAW,mBAEX,qBACA,WAAW;WAEJ,UAAU,YACjB,WAAW,cACX,OAAO,OAAO,KAAK,mBAEnB,qBACA,WAAW;WAEJ,UAAU,YACjB,WAAW,mBAEX,qBACA,WAAW;WAEJ,OAAO,SAAS,WAAW,mBAAmB,kBAAkB,WAAW;;;iBAIrE,wBACf,oBAAoB,OAAO,iBAC3B,uBAAuB,OAAO,KAC9B,oBAAoB,OAAO,MAAM,gBACjC,oBAAoB,OAAO,6BAC3B,6BACA,6BACA,6BACA,6BACA;WAES;WACA;WACA,QAAQ;WACR,OAAO;WACP,UAAU;WACV,QAAQ;WACR,UAAU,YACjB,WAAW,cACX,OAAO,OAAO,KAAK,sBAEnB,qBACA,WAAW;WAEJ,UAAU,YACjB,OAAO,OAAO,KAAK,sBAEnB,qBACA,WAAW;WAEJ,UAAU,YACjB,OAAO,OAAO,KAAK,iBACnB,OAAO,OAAO,KAAK,mBAEnB,qBACA,WAAW;WAEJ,UAAU,YACjB,OAAO,OAAO,KAAK,sBAEnB,qBACA,WAAW;WAEJ,OAAO,SACd,OAAO,OAAO,KAAK,sBAEnB,kBACA,WAAW;;;iBAKE;WACN,mBAAmB,OAAO;WAC1B,wBAAwB,OAAO;WAC/B;;;YAIC,iBAAiB,UAAU,SAAS,YAAY,WAAW;;YAG3D,aAAa,qBAAqB,qBAAqB,iBAAiB;;YAGxE,mBAAmB,UAAU,SAAS,YAAY;;;;;;;;;;;YAYlD,eAAe,8BAA8B,mBAAmB;;YAGhE,iBAAiB,UAC3B,SAAS,YAAY,WAClB,SAAS;;;;;;;;;YAUF,aAAa,qBACrB,SAAS,0BACT,iBAAiB;;YAGT,kBAAkB,eAC5B,SAAS,YAAY,gBAClB,SAAS;;;;;;;;;YAUF,cAAc,aAAa,wBACnC,SAAS,0BACT,kBAAkB;;qBAGT,6BAA2B,OAAA;;;;;;;;;YAU5B,qCAAqC,4BAA4B;;qBAGhE,qBAAmB,OAAA;;;;;;;;;;YAWpB,6BAA6B,oBAAoB;;;;;qBAGhD,2CAA2C;;qBAM3C,yBAAuB,OAAA;;YAWxB,iCAAiC,wBAAwB;;;;;;;qBAGxD,4BAA4B;;qBAM5B,qBAAmB,OAAA;;;;;;;;;;iBAWf,YACf,uBAAuB,OAAO,KAC9B,mBACA;WAES;WACA,QAAQ,aAAa;WACrB,eAAe,eAAe;WAC9B,mBAAmB,eAAe;WAClC,WAAW,eAAe;WAC1B;WACA,sBAAsB,aAAa;WACnC,cAAc,aAAa;WAC3B,eAAe,cAAc;;WAE7B;;WAEA,gBAAgB,OAAO,QAAQ;WAC/B,aAAa,YACpB,qBACA,OAAO,OAAO,KAAK,sBAEnB,mBACA;;;iBAKa,cACf,uBAAuB,OAAO,KAC9B,oBAAoB,OAAO,MAAM,gBACjC,oBAAoB,OAAO,6BAC3B,2BACA,6BACA,6BACA,kCACQ,YAAY,gBAAgB,WAAW,cAAc;WACpD;WACA;WACA,QAAQ;WACR,UAAU;WACV,QAAQ;WACR,aAAa,YACpB,qBACA,OAAO,OAAO,KAAK,sBAEnB,mBACA,WAAW;WAEJ,UAAU,YACjB,OAAO,OAAO,KAAK,iBACnB,OAAO,OAAO,KAAK,mBAEnB,qBACA,WAAW;WAEJ,UAAU,YACjB,OAAO,OAAO,KAAK,sBAEnB,qBACA,WAAW;WAEJ,OAAO,SACd,OAAO,OAAO,KAAK,sBAEnB,kBACA,WAAW;;;;;;;;iBAUE,eACX,wCACA,oBAAoB,OAAO,kBAAkB,OAAO,qBACpD,oBAAoB,OAAO,kBAAkB,OAAO,qBACpD,uBAAuB,OAAO,MAAM,OAAO,SAC3C,oBAAoB,OAAO,MAAM,OAAO,SACxC,8BAEI,SAAS;YACP,SAAS,qBAAqB;WAC/B,YAAY;WACZ;WACA;WACA,MAAM;WACN,OAAO;WACP,OAAO;WACP,UAAU;WACV,OAAO;;WAEP,QAAQ;WACR,SACL,YACE,WAAW,cACX,OAAO,OAAO,KAAK,sBAEnB,cACA,WAAW;WAGR,SACL,YAAY,OAAO,OAAO,KAAK,sBAAsB,cAAc,WAAW;WAEzE,SACL,YACE,OAAO,OAAO,KAAK,iBACnB,OAAO,OAAO,KAAK,mBAEnB,cACA,WAAW;WAGR,SACL,YAAY,OAAO,OAAO,KAAK,sBAAsB,cAAc,WAAW;WAEzE,MACL,SAAS,OAAO,OAAO,KAAK,sBAAsB,cAAc,WAAW;WAEtE,QAAQ,YAAY,gBAAgB,WAAW,cAAc;;;;;;;;qBA4G3D,aACL,2BACN,oBAAoB,OAAO,KAC3B,oBAAoB,OAAO,6BAA2B,YAE1C,YAAU,SACb,YAAY,aAAa,iBACjC,WAAW,YAAY,aAAa,aAAa,aAAa;;;;;;;qBASpD,aACL,2BACN,oBAAoB,OAAO,KAC3B,oBAAoB,OAAO,6BAA2B,YAE1C,YAAU,SACb,YAAY,aAAa,iBACjC,WAAW,YAAY,aAAa,aAAa,aAAa;;;;;;;wBAuBjD,WACR,2BACN,oBAAoB,OAAO,KAC3B,oBAAoB,OAAO,MAAM,aACjC,oBAAoB,OAAO,6BAC3B,6BACA,6BACA,6BACA,6BACA,0BAEA,YAAY,YACZ,SAAS,2BACP,aACA,aACA,aACA,qBACA,qBACA,qBACA,qBACA,oBAED,WACD,YACA,aACA,aACA,aACA,aACE,sBACA,sBACA,sBACA,sBACA;wBAEY,WACR,2BACN,oBAAoB,OAAO,iBAC3B,uBAAuB,OAAO,KAC9B,oBAAoB,OAAO,MAAM,gBACjC,oBAAoB,OAAO,6BAC3B,6BACA,6BACA,6BACA,6BACA,0BAEA,YAAY,YACZ,SAAS,wBACP,aACA,gBACA,aACA,aACA,qBACA,qBACA,qBACA,qBACA,oBAED,WACD,YACA,aACA,aACA,gBACA,aACE,sBACA,sBACA,sBACA,sBACA;;;;;;;;;;qBAiDS,eACL,2BACN,uBAAuB,OAAO,KAC9B,oBAAoB,OAAO,MAAM,gBACjC,oBAAoB,OAAO,6BAC3B,2BACA,6BACA,6BACA,0BAAwB,YAEZ,YAAU,SACb,cACP,gBACA,aACA,aACA,mBACA,qBACA,qBACA,sBAED,WACD,YACA,wBAEA,gBACA,aAGEA,UACA,OAAO,MAAM,iBAAiB,kBAC9B,oBACA,sBACA,sBACA;;;;;;;qBA8CS,eAAY,eAAiB,KAAK;;;;;;;YAQnC,MAAM,eAAe,OAAO,OAAO,OAAO,KAAK,YAAY;;YAG3D,MAAM,eAAe,OAAO,WAAW,YAAY;;;;;;;YAQnD,MAAM,eAAe,OAAO,WAAW,YAAY;;;;;;;YAQnD,SAAS,eAAe,OAAO,OAAO,OAAO,KAAK,eAAe;;;;;;;YAQjE,YAAY,eAAe,OAAO;;YAGlC,YAAY,eAAe,OAAO;;YAGlC,YAAY,eAAe,OAAO;;YAGlC,eAAe,eAAe,OAAO;;;;;;;YAQrC,aAAa,eAAe,OAAO,MAAM,UAAU,KAC7D,OAAO"}

package/dist/AuthMethod.js

@@ -0,0 +1,225 @@
+import { __exportAll } from "./_virtual/_rolldown/runtime.js";
+import { validateIdentifier } from "./internal/identifier.js";
+import { PipeableProto } from "./internal/proto.js";
+import { isBindingForMethod, makeBinding } from "./AuthMethodBinding.js";
+import { OAuth2TokenRefresher_exports, Service } from "./OAuth2TokenRefresher.js";
+import { decodeInput, decodeMaterial, decodeSetup, decodeValue, display, prepare, prepareDecoded, prepareOAuth2Tokens, prepareUnknown, refreshDecoded, refreshUnknown, resolve, resolveDecoded, resolveUnknown, test } from "./AuthMethodExecution.js";
+import { Function, Predicate, Schema } from "effect";
+//#region src/AuthMethod.ts
+/**
+* Canonical auth-method definition builders and types for the Dual SDK.
+*
+* Providers own auth methods shared by all actions and triggers under them.
+*
+* @since 0.0.0
+*/
+var AuthMethod_exports = /* @__PURE__ */ __exportAll({
+	AuthMethodHookError: () => AuthMethodHookError,
+	AuthMethodHookOperation: () => AuthMethodHookOperation,
+	ExpectedOAuth2MethodError: () => ExpectedOAuth2MethodError,
+	OAuth2ProviderTokenResponse: () => OAuth2ProviderTokenResponse,
+	OAuth2RefreshTokenUnavailableError: () => OAuth2RefreshTokenUnavailableError,
+	OAuth2TokenMaterial: () => OAuth2TokenMaterial,
+	OAuth2TokenRefresher: () => OAuth2TokenRefresher_exports,
+	OAuth2TokenResponse: () => OAuth2TokenResponse,
+	Service: () => Service,
+	TypeId: () => TypeId,
+	auth: () => auth,
+	decodeInput: () => decodeInput,
+	decodeMaterial: () => decodeMaterial,
+	decodeSetup: () => decodeSetup,
+	decodeValue: () => decodeValue,
+	display: () => display,
+	form: () => form,
+	isAuthMethod: () => isAuthMethod,
+	isBindingForMethod: () => isBindingForMethod,
+	make: () => make,
+	makeBinding: () => makeBinding,
+	oauth2: () => oauth2,
+	prepare: () => prepare,
+	prepareDecoded: () => prepareDecoded,
+	prepareOAuth2Tokens: () => prepareOAuth2Tokens,
+	prepareUnknown: () => prepareUnknown,
+	refreshDecoded: () => refreshDecoded,
+	refreshUnknown: () => refreshUnknown,
+	resolve: () => resolve,
+	resolveDecoded: () => resolveDecoded,
+	resolveUnknown: () => resolveUnknown,
+	test: () => test
+});
+/**
+* @since 0.0.0
+* @category type ids
+*/
+const TypeId = "@dual-os/sdk/AuthMethod";
+/** @since 0.0.0 @category errors */
+var ExpectedOAuth2MethodError = class extends Schema.TaggedError()("ExpectedOAuth2MethodError", { methodIdentifier: Schema.String }) {};
+/** @since 0.0.0 @category schemas */
+const OAuth2ProviderTokenResponse = Schema.Struct({
+	access_token: Schema.optional(Schema.String),
+	expires_at: Schema.optional(Schema.String),
+	expires_in: Schema.optional(Schema.Union([Schema.Number, Schema.String])),
+	refresh_token: Schema.optional(Schema.String),
+	scope: Schema.optional(Schema.String),
+	token_type: Schema.optional(Schema.String)
+});
+/** @since 0.0.0 @category schemas */
+const OAuth2TokenResponse = Schema.Struct({
+	accessToken: Schema.String,
+	expiresAt: Schema.optional(Schema.Number),
+	expiresIn: Schema.optional(Schema.Number),
+	raw: Schema.Record(Schema.String, Schema.Unknown),
+	refreshToken: Schema.optional(Schema.String),
+	scope: Schema.optional(Schema.String),
+	tokenType: Schema.optional(Schema.String)
+});
+/** @since 0.0.0 @category errors */
+var OAuth2RefreshTokenUnavailableError = class extends Schema.TaggedError()("OAuth2RefreshTokenUnavailableError", { methodIdentifier: Schema.String }) {};
+/** @since 0.0.0 @category errors */
+const AuthMethodHookOperation = Schema.Literals([
+	"prepare",
+	"refresh",
+	"prepareOAuth2Tokens",
+	"resolve",
+	"display",
+	"test",
+	"oauth2TokenRefresh"
+]);
+/** @since 0.0.0 @category errors */
+var AuthMethodHookError = class extends Schema.TaggedError()("AuthMethodHookError", {
+	cause: Schema.Defect(),
+	methodIdentifier: Schema.String,
+	operation: AuthMethodHookOperation
+}) {};
+/** @since 0.0.0 @category schemas */
+const OAuth2TokenMaterial = Schema.Struct({
+	accessToken: Schema.String,
+	expiresAt: Schema.optional(Schema.Number),
+	expiresIn: Schema.optional(Schema.Number),
+	raw: Schema.optional(Schema.Record(Schema.String, Schema.Unknown)),
+	refreshToken: Schema.optional(Schema.String),
+	scope: Schema.optional(Schema.String),
+	tokenType: Schema.optional(Schema.String)
+});
+const Proto = {
+	...PipeableProto,
+	[TypeId]: { _Requirements: Function.identity }
+};
+const makeAuthMethod = (identifier, options) => {
+	validateIdentifier("auth-method", identifier);
+	return Object.assign(Object.create(Proto), {
+		description: options.description,
+		display: options.display,
+		identifier,
+		input: options.input,
+		kind: options.kind,
+		material: options.material,
+		name: options.name,
+		oauth2: options.oauth2,
+		prepare: options.prepare,
+		refresh: options.refresh,
+		resolve: options.resolve,
+		schema: options.value,
+		setup: options.setup,
+		test: options.test,
+		value: options.value
+	});
+};
+/**
+* Create an {@link AuthMethod} definition.
+*
+* @since 0.0.0
+* @category constructors
+*/
+const make = (identifier, options) => form(identifier, options);
+/**
+* Create a simple form auth method where input, stored material, and runtime value share one schema.
+*
+* @since 0.0.0
+* @category constructors
+*/
+const form = (identifier, options) => makeAuthMethod(identifier, {
+	description: options.description,
+	display: void 0,
+	input: options.schema,
+	kind: "form",
+	material: options.schema,
+	name: options.name,
+	oauth2: void 0,
+	prepare: void 0,
+	refresh: void 0,
+	resolve: void 0,
+	setup: options.setup,
+	test: void 0,
+	value: options.schema
+});
+function auth(identifier, options) {
+	const material = options.material ?? options.input;
+	if (material === void 0) throw new Error(`auth method "${identifier}" requires material when input is omitted`);
+	return makeAuthMethod(identifier, {
+		description: options.description,
+		display: options.display,
+		input: options.input,
+		kind: "custom",
+		material,
+		name: options.name,
+		oauth2: void 0,
+		prepare: options.prepare,
+		refresh: options.refresh,
+		resolve: options.resolve,
+		setup: options.setup,
+		test: options.test,
+		value: options.value ?? material
+	});
+}
+/**
+* Create an OAuth2 auth method over the same setup primitive.
+*
+* OAuth2 has no submitted form input; the platform owns the browser redirect,
+* callback, state/PKCE, and token exchange before storing mapped material.
+*
+* @since 0.0.0
+* @category constructors
+*/
+const oauth2 = (identifier, options) => {
+	const oauth2Setup = {
+		client: options.client,
+		scopes: options.scopes,
+		...options.discoveryUrl === void 0 ? {} : { discoveryUrl: options.discoveryUrl },
+		...options.authorizationUrl === void 0 ? {} : { authorizationUrl: options.authorizationUrl },
+		...options.tokenUrl === void 0 ? {} : { tokenUrl: options.tokenUrl },
+		...options.pkce === void 0 ? {} : { pkce: options.pkce },
+		...options.authorizationParams === void 0 ? {} : { authorizationParams: options.authorizationParams },
+		...options.tokenParams === void 0 ? {} : { tokenParams: options.tokenParams },
+		...options.tokenHeaders === void 0 ? {} : { tokenHeaders: options.tokenHeaders },
+		...options.tokenRequestEncoding === void 0 ? {} : { tokenRequestEncoding: options.tokenRequestEncoding },
+		...options.tokenResponse === void 0 ? {} : { tokenResponse: options.tokenResponse },
+		...options.fromTokens === void 0 ? {} : { fromTokens: options.fromTokens }
+	};
+	return makeAuthMethod(identifier, {
+		description: options.description,
+		display: options.display,
+		input: void 0,
+		kind: "oauth2",
+		material: options.material,
+		name: options.name,
+		oauth2: oauth2Setup,
+		prepare: void 0,
+		refresh: void 0,
+		resolve: options.resolve,
+		setup: options.setup,
+		test: options.test,
+		value: options.value ?? options.material
+	});
+};
+/**
+* Check if a value is an {@link AuthMethod}.
+*
+* @since 0.0.0
+* @category guards
+*/
+const isAuthMethod = (u) => Predicate.hasProperty(u, TypeId);
+//#endregion
+export { AuthMethodHookError, AuthMethodHookOperation, AuthMethod_exports, ExpectedOAuth2MethodError, OAuth2ProviderTokenResponse, OAuth2RefreshTokenUnavailableError, OAuth2TokenMaterial, OAuth2TokenRefresher_exports as OAuth2TokenRefresher, OAuth2TokenResponse, Service, TypeId, auth, decodeInput, decodeMaterial, decodeSetup, decodeValue, display, form, isAuthMethod, isBindingForMethod, make, makeBinding, oauth2, prepare, prepareDecoded, prepareOAuth2Tokens, prepareUnknown, refreshDecoded, refreshUnknown, resolve, resolveDecoded, resolveUnknown, test };
+
+//# sourceMappingURL=AuthMethod.js.map

package/dist/AuthMethod.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthMethod.js","names":["Func"],"sources":["../src/AuthMethod.ts"],"sourcesContent":["/**\n * Canonical auth-method definition builders and types for the Dual SDK.\n *\n * Providers own auth methods shared by all actions and triggers under them.\n *\n * @since 0.0.0\n */\nimport { Function as Func, Predicate, Schema } from \"effect\";\nimport type { Config, Effect, Pipeable } from \"effect\";\n\nimport type * as Types from \"effect/Types\";\n\nimport { validateIdentifier } from \"./internal/identifier.ts\";\nimport { PipeableProto } from \"./internal/proto.ts\";\nimport type * as OAuth2TokenRefresher from \"./OAuth2TokenRefresher.ts\";\n\n/**\n * @since 0.0.0\n * @category type ids\n */\nexport const TypeId = \"@dual-os/sdk/AuthMethod\" as const;\n\n/**\n * @since 0.0.0\n * @category type ids\n */\nexport type TypeId = typeof TypeId;\n\n/**\n * Phantom inference slot for the hook requirements union.\n *\n * Unlike the schema parameters, hook requirements only occur inside optional\n * hook signatures, which TypeScript cannot reliably infer through; this slot\n * gives the {@link Requirements} extractor a stable inference site.\n *\n * One union instead of per-hook parameters on purpose: in practice a method's\n * dependencies are provided once at the plugin/app definition (for example a\n * Gmail client layer), not separately per hook, and every consumption path\n * (invoke, trigger phases, credential lifecycle, `DualRuntime.toLayer`) must demand\n * the same set so none of them can silently under-require.\n *\n * @since 0.0.0\n * @category models\n */\nexport interface RequirementsVariance<out Requirements> {\n  readonly _Requirements: Types.Covariant<Requirements>;\n}\n\n/**\n * Constraint type for working with any {@link AuthMethod}.\n *\n * @since 0.0.0\n * @category type-level\n */\nexport interface Any extends Pipeable.Pipeable {\n  readonly [TypeId]: RequirementsVariance<any>;\n  readonly identifier: string;\n  readonly name: string | undefined;\n  readonly description: string | undefined;\n  readonly kind: AuthMethodKind;\n  readonly setup: Schema.Top | undefined;\n  readonly input: Schema.Top | undefined;\n  readonly material: Schema.Top;\n  readonly value: Schema.Top;\n  readonly schema: Schema.Top;\n  readonly prepare: unknown;\n  readonly refresh: unknown;\n  readonly resolve: unknown;\n  readonly display: unknown;\n  readonly test: unknown;\n  readonly oauth2: OAuth2Setup<Schema.Top, any, any> | undefined;\n}\n\n/** @since 0.0.0 @category models */\nexport type AuthMethodKind = \"form\" | \"oauth2\" | \"custom\";\n\n/** @since 0.0.0 @category type-level */\nexport type SchemaType<SchemaDef extends Schema.Top | undefined> = SchemaDef extends Schema.Top\n  ? Schema.Schema.Type<SchemaDef>\n  : undefined;\n\n/** @since 0.0.0 @category hooks */\nexport interface HookContext<Setup = undefined> {\n  readonly setup: Setup;\n}\n\n/** @since 0.0.0 @category hooks */\nexport type MaybeEffect<Value, Error = never, Requirements = never> =\n  | Value\n  | Effect.Effect<Value, Error, Requirements>;\n\n/** @since 0.0.0 @category hooks */\nexport type PrepareHook<Input, Material, Error = never, Requirements = never, Setup = undefined> = (\n  input: Input,\n  context: HookContext<Setup>,\n) => MaybeEffect<Material, Error, Requirements>;\n\n/** @since 0.0.0 @category hooks */\nexport type RefreshReason = \"before-use\" | \"forced\";\n\n/** @since 0.0.0 @category hooks */\nexport interface RefreshContext<Setup = undefined> extends HookContext<Setup> {\n  readonly now: number;\n  readonly minValidityMs: number;\n  readonly reason: RefreshReason;\n}\n\n/** @since 0.0.0 @category hooks */\nexport type RefreshHook<Material, Error = never, Requirements = never, Setup = undefined> = (\n  material: Material,\n  context: RefreshContext<Setup>,\n) => MaybeEffect<Material | undefined, Error, Requirements>;\n\n/** @since 0.0.0 @category hooks */\nexport type ResolveHook<Material, Value, Error = never, Requirements = never, Setup = undefined> = (\n  material: Material,\n  context: HookContext<Setup>,\n) => MaybeEffect<Value, Error, Requirements>;\n\n/** @since 0.0.0 @category models */\nexport interface Display {\n  readonly label?: string;\n  readonly description?: string;\n  readonly metadata?: Record<string, unknown>;\n}\n\n/** @since 0.0.0 @category hooks */\nexport type DisplayHook<Material, Error = never, Requirements = never, Setup = undefined> = (\n  material: Material,\n  context: HookContext<Setup>,\n) => MaybeEffect<Display, Error, Requirements>;\n\n/** @since 0.0.0 @category models */\nexport interface TestResult {\n  readonly ok: boolean;\n  readonly message?: string;\n}\n\n/** @since 0.0.0 @category errors */\nexport class ExpectedOAuth2MethodError extends Schema.TaggedError<ExpectedOAuth2MethodError>()(\n  \"ExpectedOAuth2MethodError\",\n  { methodIdentifier: Schema.String },\n) {}\n\n/** @since 0.0.0 @category hooks */\nexport type TestHook<Material, Error = never, Requirements = never, Setup = undefined> = (\n  material: Material,\n  context: HookContext<Setup>,\n) => MaybeEffect<TestResult, Error, Requirements>;\n\n/**\n * Options used to create an {@link AuthMethod}.\n *\n * @since 0.0.0\n * @category models\n */\nexport interface AuthMethodOptions<ValueSchema extends Schema.Top> {\n  readonly name?: string;\n  readonly description?: string;\n  readonly schema: ValueSchema;\n}\n\n/** @since 0.0.0 @category models */\nexport interface FormOptions<\n  ValueSchema extends Schema.Top,\n  SetupSchema extends Schema.Top | undefined = undefined,\n> extends AuthMethodOptions<ValueSchema> {\n  readonly setup?: SetupSchema;\n}\n\n/** @since 0.0.0 @category models */\nexport interface AuthOptionsWithoutMaterial<\n  InputSchema extends Schema.Top,\n  ValueSchema extends Schema.Top = InputSchema,\n  SetupSchema extends Schema.Top | undefined = undefined,\n  PrepareRequirements = never,\n  RefreshRequirements = never,\n  ResolveRequirements = never,\n  DisplayRequirements = never,\n  TestRequirements = never,\n> {\n  readonly name?: string;\n  readonly description?: string;\n  readonly setup?: SetupSchema;\n  readonly input: InputSchema;\n  readonly material?: undefined;\n  readonly value?: ValueSchema;\n  readonly prepare?: PrepareHook<\n    SchemaType<InputSchema>,\n    SchemaType<InputSchema>,\n    any,\n    PrepareRequirements,\n    SchemaType<SetupSchema>\n  >;\n  readonly refresh?: RefreshHook<\n    SchemaType<InputSchema>,\n    any,\n    RefreshRequirements,\n    SchemaType<SetupSchema>\n  >;\n  readonly resolve?: ResolveHook<\n    SchemaType<InputSchema>,\n    Schema.Schema.Type<ValueSchema>,\n    any,\n    ResolveRequirements,\n    SchemaType<SetupSchema>\n  >;\n  readonly display?: DisplayHook<\n    SchemaType<InputSchema>,\n    any,\n    DisplayRequirements,\n    SchemaType<SetupSchema>\n  >;\n  readonly test?: TestHook<SchemaType<InputSchema>, any, TestRequirements, SchemaType<SetupSchema>>;\n}\n\n/** @since 0.0.0 @category models */\nexport interface AuthOptionsWithMaterial<\n  InputSchema extends Schema.Top | undefined,\n  MaterialSchema extends Schema.Top,\n  ValueSchema extends Schema.Top = MaterialSchema,\n  SetupSchema extends Schema.Top | undefined = undefined,\n  PrepareRequirements = never,\n  RefreshRequirements = never,\n  ResolveRequirements = never,\n  DisplayRequirements = never,\n  TestRequirements = never,\n> {\n  readonly name?: string;\n  readonly description?: string;\n  readonly setup?: SetupSchema;\n  readonly input: InputSchema;\n  readonly material: MaterialSchema;\n  readonly value?: ValueSchema;\n  readonly prepare?: PrepareHook<\n    SchemaType<InputSchema>,\n    Schema.Schema.Type<MaterialSchema>,\n    any,\n    PrepareRequirements,\n    SchemaType<SetupSchema>\n  >;\n  readonly refresh?: RefreshHook<\n    Schema.Schema.Type<MaterialSchema>,\n    any,\n    RefreshRequirements,\n    SchemaType<SetupSchema>\n  >;\n  readonly resolve?: ResolveHook<\n    Schema.Schema.Type<MaterialSchema>,\n    Schema.Schema.Type<ValueSchema>,\n    any,\n    ResolveRequirements,\n    SchemaType<SetupSchema>\n  >;\n  readonly display?: DisplayHook<\n    Schema.Schema.Type<MaterialSchema>,\n    any,\n    DisplayRequirements,\n    SchemaType<SetupSchema>\n  >;\n  readonly test?: TestHook<\n    Schema.Schema.Type<MaterialSchema>,\n    any,\n    TestRequirements,\n    SchemaType<SetupSchema>\n  >;\n}\n\n/** @since 0.0.0 @category models */\nexport interface OAuth2ClientConfig {\n  readonly clientId: string | Config.Config<string>;\n  readonly clientSecret?: string | Config.Config<string>;\n  readonly authentication?: \"basic\" | \"post\" | \"none\";\n}\n\n/** @since 0.0.0 @category hooks */\nexport type OAuth2ClientHook<Setup> = (context: HookContext<Setup>) => OAuth2ClientConfig;\n\n/** @since 0.0.0 @category models */\nexport type OAuth2Client<Setup = undefined> = OAuth2ClientConfig | OAuth2ClientHook<Setup>;\n\n/** @since 0.0.0 @category hooks */\nexport type OAuth2EndpointHook<Setup> = (context: HookContext<Setup>) => string;\n\n/**\n * An OAuth2 endpoint, fixed or derived from the setup.\n *\n * Providers that host one instance per customer — a Microsoft tenant, a\n * self-hosted GitLab — cannot name their endpoints until the connection's setup\n * says which instance it is.\n *\n * @since 0.0.0\n * @category models\n */\nexport type OAuth2Endpoint<Setup = undefined> = string | OAuth2EndpointHook<Setup>;\n\n/** @since 0.0.0 @category models */\nexport type OAuth2ParamsHook<Setup> = (\n  context: HookContext<Setup>,\n) => Readonly<Record<string, string>>;\n\n/**\n * Query parameters added to the authorization or token request, fixed or\n * derived from the setup — the same freedom the endpoints have. A provider\n * that knows which account a connection is for can say so in the request\n * instead of leaving the choice to whatever session the browser carries.\n *\n * @since 0.0.0 @category models\n */\nexport type OAuth2Params<Setup = undefined> =\n  | Readonly<Record<string, string>>\n  | OAuth2ParamsHook<Setup>;\n\n/** @since 0.0.0 @category hooks */\nexport type OAuth2HeadersHook<SetupValue> = (\n  context: HookContext<SetupValue>,\n) => Readonly<Record<string, string>>;\n\n/**\n * Provider headers for token exchange and refresh, fixed or derived from setup.\n * Hosts must reject invalid headers and case-insensitive overrides of client\n * authentication and transport headers. Keep values out of authorization URLs,\n * public metadata, logs, and errors.\n *\n * @since 0.0.0 @category models\n */\nexport type OAuth2Headers<SetupValue = HookContext[\"setup\"]> =\n  | Readonly<Record<string, string>>\n  | OAuth2HeadersHook<SetupValue>;\n\n/** @since 0.0.0 @category schemas */\nexport const OAuth2ProviderTokenResponse = Schema.Struct({\n  access_token: Schema.optional(Schema.String),\n  expires_at: Schema.optional(Schema.String),\n  expires_in: Schema.optional(Schema.Union([Schema.Number, Schema.String])),\n  refresh_token: Schema.optional(Schema.String),\n  scope: Schema.optional(Schema.String),\n  token_type: Schema.optional(Schema.String),\n});\n\n/** @since 0.0.0 @category models */\nexport type OAuth2ProviderTokenResponse = typeof OAuth2ProviderTokenResponse.Type;\n\n/** @since 0.0.0 @category schemas */\nexport const OAuth2TokenResponse = Schema.Struct({\n  accessToken: Schema.String,\n  expiresAt: Schema.optional(Schema.Number),\n  expiresIn: Schema.optional(Schema.Number),\n  raw: Schema.Record(Schema.String, Schema.Unknown),\n  refreshToken: Schema.optional(Schema.String),\n  scope: Schema.optional(Schema.String),\n  tokenType: Schema.optional(Schema.String),\n});\n\n/** @since 0.0.0 @category models */\nexport type OAuth2TokenResponse = typeof OAuth2TokenResponse.Type;\n\n/** @since 0.0.0 @category errors */\nexport class OAuth2RefreshTokenUnavailableError extends Schema.TaggedError<OAuth2RefreshTokenUnavailableError>()(\n  \"OAuth2RefreshTokenUnavailableError\",\n  { methodIdentifier: Schema.String },\n) {}\n\n/** @since 0.0.0 @category errors */\nexport const AuthMethodHookOperation = Schema.Literals([\n  \"prepare\",\n  \"refresh\",\n  \"prepareOAuth2Tokens\",\n  \"resolve\",\n  \"display\",\n  \"test\",\n  \"oauth2TokenRefresh\",\n]);\n\n/** @since 0.0.0 @category errors */\nexport type AuthMethodHookOperation = typeof AuthMethodHookOperation.Type;\n\n/** @since 0.0.0 @category errors */\nexport class AuthMethodHookError extends Schema.TaggedError<AuthMethodHookError>()(\n  \"AuthMethodHookError\",\n  { cause: Schema.Defect(), methodIdentifier: Schema.String, operation: AuthMethodHookOperation },\n) {}\n\n/** @since 0.0.0 @category schemas */\nexport const OAuth2TokenMaterial = Schema.Struct({\n  accessToken: Schema.String,\n  expiresAt: Schema.optional(Schema.Number),\n  expiresIn: Schema.optional(Schema.Number),\n  raw: Schema.optional(Schema.Record(Schema.String, Schema.Unknown)),\n  refreshToken: Schema.optional(Schema.String),\n  scope: Schema.optional(Schema.String),\n  tokenType: Schema.optional(Schema.String),\n});\n\n/** @since 0.0.0 @category models */\nexport interface OAuth2Setup<\n  MaterialSchema extends Schema.Top,\n  Setup = undefined,\n  TokenRequirements = never,\n> {\n  readonly scopes: readonly string[];\n  readonly client: OAuth2Client<Setup>;\n  readonly discoveryUrl?: OAuth2Endpoint<Setup>;\n  readonly authorizationUrl?: OAuth2Endpoint<Setup>;\n  readonly tokenUrl?: OAuth2Endpoint<Setup>;\n  readonly pkce?: boolean;\n  readonly authorizationParams?: OAuth2Params<Setup>;\n  readonly tokenParams?: OAuth2Params<Setup>;\n  readonly tokenHeaders?: OAuth2Headers<Setup>;\n  /** Token request body encoding. Standard OAuth2 methods use form encoding. */\n  readonly tokenRequestEncoding?: \"form\" | \"json\";\n  /** Decode a provider response into the standard token fields before host normalization. */\n  readonly tokenResponse?: Schema.Decoder<OAuth2ProviderTokenResponse>;\n  readonly fromTokens?: PrepareHook<\n    OAuth2TokenResponse,\n    Schema.Schema.Type<MaterialSchema>,\n    any,\n    TokenRequirements,\n    Setup\n  >;\n}\n\n/** @since 0.0.0 @category models */\nexport interface OAuth2Options<\n  MaterialSchema extends Schema.Top,\n  ValueSchema extends Schema.Top = MaterialSchema,\n  SetupSchema extends Schema.Top | undefined = undefined,\n  TokenRequirements = never,\n  ResolveRequirements = never,\n  DisplayRequirements = never,\n  TestRequirements = never,\n> extends OAuth2Setup<MaterialSchema, SchemaType<SetupSchema>, TokenRequirements> {\n  readonly name?: string;\n  readonly description?: string;\n  readonly setup?: SetupSchema;\n  readonly material: MaterialSchema;\n  readonly value?: ValueSchema;\n  readonly fromTokens?: PrepareHook<\n    OAuth2TokenResponse,\n    Schema.Schema.Type<MaterialSchema>,\n    any,\n    TokenRequirements,\n    SchemaType<SetupSchema>\n  >;\n  readonly resolve?: ResolveHook<\n    Schema.Schema.Type<MaterialSchema>,\n    Schema.Schema.Type<ValueSchema>,\n    any,\n    ResolveRequirements,\n    SchemaType<SetupSchema>\n  >;\n  readonly display?: DisplayHook<\n    Schema.Schema.Type<MaterialSchema>,\n    any,\n    DisplayRequirements,\n    SchemaType<SetupSchema>\n  >;\n  readonly test?: TestHook<\n    Schema.Schema.Type<MaterialSchema>,\n    any,\n    TestRequirements,\n    SchemaType<SetupSchema>\n  >;\n}\n\n/**\n * A typed provider-owned auth method definition.\n *\n * @since 0.0.0\n * @category models\n */\nexport interface AuthMethod<\n  out Identifier extends string = string,\n  out SetupSchema extends Schema.Top | undefined = Schema.Top | undefined,\n  out InputSchema extends Schema.Top | undefined = Schema.Top | undefined,\n  out MaterialSchema extends Schema.Top = Schema.Top,\n  out ValueSchema extends Schema.Top = Schema.Top,\n  out Requirements = never,\n>\n  extends Pipeable.Pipeable {\n  readonly [TypeId]: RequirementsVariance<Requirements>;\n  readonly identifier: Identifier;\n  readonly name: string | undefined;\n  readonly description: string | undefined;\n  readonly kind: AuthMethodKind;\n  readonly setup: SetupSchema;\n  readonly input: InputSchema;\n  readonly material: MaterialSchema;\n  readonly value: ValueSchema;\n  /** Runtime value schema retained for concise action/trigger typing. */\n  readonly schema: ValueSchema;\n  readonly prepare:\n    | PrepareHook<\n        SchemaType<InputSchema>,\n        Schema.Schema.Type<MaterialSchema>,\n        any,\n        Requirements,\n        SchemaType<SetupSchema>\n      >\n    | undefined;\n  readonly refresh:\n    | RefreshHook<Schema.Schema.Type<MaterialSchema>, any, Requirements, SchemaType<SetupSchema>>\n    | undefined;\n  readonly resolve:\n    | ResolveHook<\n        Schema.Schema.Type<MaterialSchema>,\n        Schema.Schema.Type<ValueSchema>,\n        any,\n        Requirements,\n        SchemaType<SetupSchema>\n      >\n    | undefined;\n  readonly display:\n    | DisplayHook<Schema.Schema.Type<MaterialSchema>, any, Requirements, SchemaType<SetupSchema>>\n    | undefined;\n  readonly test:\n    | TestHook<Schema.Schema.Type<MaterialSchema>, any, Requirements, SchemaType<SetupSchema>>\n    | undefined;\n  readonly oauth2: OAuth2Setup<MaterialSchema, SchemaType<SetupSchema>, Requirements> | undefined;\n}\n\nconst Proto = { ...PipeableProto, [TypeId]: { _Requirements: Func.identity } };\n\nconst makeAuthMethod = <\n  const Identifier extends string,\n  SetupSchema extends Schema.Top | undefined,\n  InputSchema extends Schema.Top | undefined,\n  MaterialSchema extends Schema.Top,\n  ValueSchema extends Schema.Top,\n  TokenRequirements = never,\n  RefreshRequirements = never,\n  PrepareRequirements = never,\n  ResolveRequirements = never,\n  DisplayRequirements = never,\n  TestRequirements = never,\n>(\n  identifier: Identifier,\n  options: {\n    readonly name: string | undefined;\n    readonly description: string | undefined;\n    readonly kind: AuthMethodKind;\n    readonly setup: SetupSchema;\n    readonly input: InputSchema;\n    readonly material: MaterialSchema;\n    readonly value: ValueSchema;\n    readonly prepare:\n      | PrepareHook<\n          SchemaType<InputSchema>,\n          Schema.Schema.Type<MaterialSchema>,\n          any,\n          PrepareRequirements,\n          SchemaType<SetupSchema>\n        >\n      | undefined;\n    readonly refresh:\n      | RefreshHook<\n          Schema.Schema.Type<MaterialSchema>,\n          any,\n          RefreshRequirements,\n          SchemaType<SetupSchema>\n        >\n      | undefined;\n    readonly resolve:\n      | ResolveHook<\n          Schema.Schema.Type<MaterialSchema>,\n          Schema.Schema.Type<ValueSchema>,\n          any,\n          ResolveRequirements,\n          SchemaType<SetupSchema>\n        >\n      | undefined;\n    readonly display:\n      | DisplayHook<\n          Schema.Schema.Type<MaterialSchema>,\n          any,\n          DisplayRequirements,\n          SchemaType<SetupSchema>\n        >\n      | undefined;\n    readonly test:\n      | TestHook<Schema.Schema.Type<MaterialSchema>, any, TestRequirements, SchemaType<SetupSchema>>\n      | undefined;\n    readonly oauth2:\n      | OAuth2Setup<MaterialSchema, SchemaType<SetupSchema>, TokenRequirements>\n      | undefined;\n  },\n): AuthMethod<\n  Identifier,\n  SetupSchema,\n  InputSchema,\n  MaterialSchema,\n  ValueSchema,\n  | TokenRequirements\n  | RefreshRequirements\n  | PrepareRequirements\n  | ResolveRequirements\n  | DisplayRequirements\n  | TestRequirements\n> => {\n  validateIdentifier(\"auth-method\", identifier);\n\n  return Object.assign(Object.create(Proto), {\n    description: options.description,\n    display: options.display,\n    identifier,\n    input: options.input,\n    kind: options.kind,\n    material: options.material,\n    name: options.name,\n    oauth2: options.oauth2,\n    prepare: options.prepare,\n    refresh: options.refresh,\n    resolve: options.resolve,\n    schema: options.value,\n    setup: options.setup,\n    test: options.test,\n    value: options.value,\n  });\n};\n\n/**\n * Create an {@link AuthMethod} definition.\n *\n * @since 0.0.0\n * @category constructors\n */\nexport const make = <\n  const Identifier extends string,\n  ValueSchema extends Schema.Top,\n  SetupSchema extends Schema.Top | undefined = undefined,\n>(\n  identifier: Identifier,\n  options: FormOptions<ValueSchema, SetupSchema>,\n): AuthMethod<Identifier, SetupSchema, ValueSchema, ValueSchema, ValueSchema> =>\n  form(identifier, options);\n\n/**\n * Create a simple form auth method where input, stored material, and runtime value share one schema.\n *\n * @since 0.0.0\n * @category constructors\n */\nexport const form = <\n  const Identifier extends string,\n  ValueSchema extends Schema.Top,\n  SetupSchema extends Schema.Top | undefined = undefined,\n>(\n  identifier: Identifier,\n  options: FormOptions<ValueSchema, SetupSchema>,\n): AuthMethod<Identifier, SetupSchema, ValueSchema, ValueSchema, ValueSchema> =>\n  makeAuthMethod(identifier, {\n    description: options.description,\n    display: undefined,\n    input: options.schema,\n    kind: \"form\",\n    material: options.schema,\n    name: options.name,\n    oauth2: undefined,\n    prepare: undefined,\n    refresh: undefined,\n    resolve: undefined,\n    setup: options.setup as SetupSchema,\n    test: undefined,\n    value: options.schema,\n  });\n\n/**\n * Create a custom auth setup method.\n *\n * @since 0.0.0\n * @category constructors\n */\nexport function auth<\n  const Identifier extends string,\n  InputSchema extends Schema.Top,\n  ValueSchema extends Schema.Top = InputSchema,\n  SetupSchema extends Schema.Top | undefined = undefined,\n  PrepareRequirements = never,\n  RefreshRequirements = never,\n  ResolveRequirements = never,\n  DisplayRequirements = never,\n  TestRequirements = never,\n>(\n  identifier: Identifier,\n  options: AuthOptionsWithoutMaterial<\n    InputSchema,\n    ValueSchema,\n    SetupSchema,\n    PrepareRequirements,\n    RefreshRequirements,\n    ResolveRequirements,\n    DisplayRequirements,\n    TestRequirements\n  >,\n): AuthMethod<\n  Identifier,\n  SetupSchema,\n  InputSchema,\n  InputSchema,\n  ValueSchema,\n  | PrepareRequirements\n  | RefreshRequirements\n  | ResolveRequirements\n  | DisplayRequirements\n  | TestRequirements\n>;\nexport function auth<\n  const Identifier extends string,\n  InputSchema extends Schema.Top | undefined,\n  MaterialSchema extends Schema.Top,\n  ValueSchema extends Schema.Top = MaterialSchema,\n  SetupSchema extends Schema.Top | undefined = undefined,\n  PrepareRequirements = never,\n  RefreshRequirements = never,\n  ResolveRequirements = never,\n  DisplayRequirements = never,\n  TestRequirements = never,\n>(\n  identifier: Identifier,\n  options: AuthOptionsWithMaterial<\n    InputSchema,\n    MaterialSchema,\n    ValueSchema,\n    SetupSchema,\n    PrepareRequirements,\n    RefreshRequirements,\n    ResolveRequirements,\n    DisplayRequirements,\n    TestRequirements\n  >,\n): AuthMethod<\n  Identifier,\n  SetupSchema,\n  InputSchema,\n  MaterialSchema,\n  ValueSchema,\n  | PrepareRequirements\n  | RefreshRequirements\n  | ResolveRequirements\n  | DisplayRequirements\n  | TestRequirements\n>;\nexport function auth(\n  identifier: string,\n  options:\n    | AuthOptionsWithoutMaterial<Schema.Top, Schema.Top, any, any, any, any, any, any>\n    | AuthOptionsWithMaterial<\n        Schema.Top | undefined,\n        Schema.Top,\n        Schema.Top,\n        any,\n        any,\n        any,\n        any,\n        any,\n        any\n      >,\n): Any {\n  const material = options.material ?? options.input;\n  if (material === undefined) {\n    throw new Error(`auth method \"${identifier}\" requires material when input is omitted`);\n  }\n\n  return makeAuthMethod(identifier, {\n    description: options.description,\n    display: options.display,\n    input: options.input,\n    kind: \"custom\",\n    material,\n    name: options.name,\n    oauth2: undefined,\n    prepare: options.prepare,\n    refresh: options.refresh,\n    resolve: options.resolve,\n    setup: options.setup,\n    test: options.test,\n    value: options.value ?? material,\n  });\n}\n\n/**\n * Create an OAuth2 auth method over the same setup primitive.\n *\n * OAuth2 has no submitted form input; the platform owns the browser redirect,\n * callback, state/PKCE, and token exchange before storing mapped material.\n *\n * @since 0.0.0\n * @category constructors\n */\nexport const oauth2 = <\n  const Identifier extends string,\n  MaterialSchema extends Schema.Top,\n  ValueSchema extends Schema.Top = MaterialSchema,\n  SetupSchema extends Schema.Top | undefined = undefined,\n  TokenRequirements = never,\n  ResolveRequirements = never,\n  DisplayRequirements = never,\n  TestRequirements = never,\n>(\n  identifier: Identifier,\n  options: OAuth2Options<\n    MaterialSchema,\n    ValueSchema,\n    SetupSchema,\n    TokenRequirements,\n    ResolveRequirements,\n    DisplayRequirements,\n    TestRequirements\n  >,\n): AuthMethod<\n  Identifier,\n  SetupSchema,\n  undefined,\n  MaterialSchema,\n  ValueSchema,\n  // The built-in oauth2 refresh path needs the token refresher service and\n  // re-decodes refreshed material, so those join the user hook requirements.\n  | OAuth2TokenRefresher.Service\n  | Schema.Codec.DecodingServices<MaterialSchema>\n  | TokenRequirements\n  | ResolveRequirements\n  | DisplayRequirements\n  | TestRequirements\n> => {\n  const oauth2Setup: OAuth2Setup<MaterialSchema, SchemaType<SetupSchema>, TokenRequirements> = {\n    client: options.client,\n    scopes: options.scopes,\n    ...(options.discoveryUrl === undefined ? {} : { discoveryUrl: options.discoveryUrl }),\n    ...(options.authorizationUrl === undefined\n      ? {}\n      : { authorizationUrl: options.authorizationUrl }),\n    ...(options.tokenUrl === undefined ? {} : { tokenUrl: options.tokenUrl }),\n    ...(options.pkce === undefined ? {} : { pkce: options.pkce }),\n    ...(options.authorizationParams === undefined\n      ? {}\n      : { authorizationParams: options.authorizationParams }),\n    ...(options.tokenParams === undefined ? {} : { tokenParams: options.tokenParams }),\n    ...(options.tokenHeaders === undefined ? {} : { tokenHeaders: options.tokenHeaders }),\n    ...(options.tokenRequestEncoding === undefined\n      ? {}\n      : { tokenRequestEncoding: options.tokenRequestEncoding }),\n    ...(options.tokenResponse === undefined ? {} : { tokenResponse: options.tokenResponse }),\n    ...(options.fromTokens === undefined ? {} : { fromTokens: options.fromTokens }),\n  };\n\n  return makeAuthMethod(identifier, {\n    description: options.description,\n    display: options.display,\n    input: undefined,\n    kind: \"oauth2\",\n    material: options.material,\n    name: options.name,\n    oauth2: oauth2Setup,\n    prepare: undefined,\n    refresh: undefined,\n    resolve: options.resolve,\n    setup: options.setup as SetupSchema,\n    test: options.test,\n    value: (options.value ?? options.material) as ValueSchema,\n  });\n};\n\n/**\n * Check if a value is an {@link AuthMethod}.\n *\n * @since 0.0.0\n * @category guards\n */\nexport const isAuthMethod = (u: unknown): u is Any => Predicate.hasProperty(u, TypeId);\n\n/**\n * Resolved value type carried by a {@link AuthMethod}.\n *\n * @since 0.0.0\n * @category type-level\n */\nexport type Value<Method extends Any> = Schema.Schema.Type<ValueSchema<Method>>;\n\n/** @since 0.0.0 @category type-level */\nexport type Setup<Method extends Any> = SchemaType<SetupSchema<Method>>;\n\n/**\n * Submitted setup input type carried by an {@link AuthMethod}.\n *\n * @since 0.0.0\n * @category type-level\n */\nexport type Input<Method extends Any> = SchemaType<InputSchema<Method>>;\n\n/**\n * Encrypted stored material type carried by an {@link AuthMethod}.\n *\n * @since 0.0.0\n * @category type-level\n */\nexport type Material<Method extends Any> = Schema.Schema.Type<MaterialSchema<Method>>;\n\n/**\n * Schema type carried by a {@link AuthMethod}.\n *\n * @since 0.0.0\n * @category type-level\n */\nexport type ValueSchema<Method extends Any> = Method[\"value\"];\n\n/** @since 0.0.0 @category type-level */\nexport type SetupSchema<Method extends Any> = Method[\"setup\"];\n\n/** @since 0.0.0 @category type-level */\nexport type InputSchema<Method extends Any> = Method[\"input\"];\n\n/** @since 0.0.0 @category type-level */\nexport type MaterialSchema<Method extends Any> = Method[\"material\"];\n\n/**\n * Services required by the method's hooks, as one union.\n *\n * @since 0.0.0\n * @category type-level\n */\nexport type Requirements<Method extends Any> = Types.Covariant.Type<\n  Method[TypeId][\"_Requirements\"]\n>;\n\n// Compatibility exports keep the original AuthMethod namespace intact while\n// focused callers can import each runtime module directly.\nexport {\n  type Binding,\n  type BindingFor,\n  type BindingForMethod,\n  type MatchCases,\n  type Context,\n  makeBinding,\n  isBindingForMethod,\n} from \"./AuthMethodBinding.ts\";\nexport {\n  decodeValue,\n  decodeSetup,\n  decodeInput,\n  decodeMaterial,\n  prepareDecoded,\n  prepareUnknown,\n  prepare,\n  refreshDecoded,\n  refreshUnknown,\n  prepareOAuth2Tokens,\n  resolveDecoded,\n  resolve,\n  resolveUnknown,\n  display,\n  test,\n} from \"./AuthMethodExecution.ts\";\nexport { Service } from \"./OAuth2TokenRefresher.ts\";\nexport * as OAuth2TokenRefresher from \"./OAuth2TokenRefresher.ts\";\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoBA,MAAa,SAAS;;AAuHtB,IAAa,4BAAb,cAA+C,OAAO,YAAuC,CAAC,CAC5F,6BACA,EAAE,kBAAkB,OAAO,OAAO,CACpC,CAAC,CAAC,CAAC;;AA6LH,MAAa,8BAA8B,OAAO,OAAO;CACvD,cAAc,OAAO,SAAS,OAAO,MAAM;CAC3C,YAAY,OAAO,SAAS,OAAO,MAAM;CACzC,YAAY,OAAO,SAAS,OAAO,MAAM,CAAC,OAAO,QAAQ,OAAO,MAAM,CAAC,CAAC;CACxE,eAAe,OAAO,SAAS,OAAO,MAAM;CAC5C,OAAO,OAAO,SAAS,OAAO,MAAM;CACpC,YAAY,OAAO,SAAS,OAAO,MAAM;AAC3C,CAAC;;AAMD,MAAa,sBAAsB,OAAO,OAAO;CAC/C,aAAa,OAAO;CACpB,WAAW,OAAO,SAAS,OAAO,MAAM;CACxC,WAAW,OAAO,SAAS,OAAO,MAAM;CACxC,KAAK,OAAO,OAAO,OAAO,QAAQ,OAAO,OAAO;CAChD,cAAc,OAAO,SAAS,OAAO,MAAM;CAC3C,OAAO,OAAO,SAAS,OAAO,MAAM;CACpC,WAAW,OAAO,SAAS,OAAO,MAAM;AAC1C,CAAC;;AAMD,IAAa,qCAAb,cAAwD,OAAO,YAAgD,CAAC,CAC9G,sCACA,EAAE,kBAAkB,OAAO,OAAO,CACpC,CAAC,CAAC,CAAC;;AAGH,MAAa,0BAA0B,OAAO,SAAS;CACrD;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;AAMD,IAAa,sBAAb,cAAyC,OAAO,YAAiC,CAAC,CAChF,uBACA;CAAE,OAAO,OAAO,OAAO;CAAG,kBAAkB,OAAO;CAAQ,WAAW;AAAwB,CAChG,CAAC,CAAC,CAAC;;AAGH,MAAa,sBAAsB,OAAO,OAAO;CAC/C,aAAa,OAAO;CACpB,WAAW,OAAO,SAAS,OAAO,MAAM;CACxC,WAAW,OAAO,SAAS,OAAO,MAAM;CACxC,KAAK,OAAO,SAAS,OAAO,OAAO,OAAO,QAAQ,OAAO,OAAO,CAAC;CACjE,cAAc,OAAO,SAAS,OAAO,MAAM;CAC3C,OAAO,OAAO,SAAS,OAAO,MAAM;CACpC,WAAW,OAAO,SAAS,OAAO,MAAM;AAC1C,CAAC;AAiID,MAAM,QAAQ;CAAE,GAAG;EAAgB,SAAS,EAAE,eAAeA,SAAK,SAAS;AAAE;AAE7E,MAAM,kBAaJ,YACA,YA6DG;CACH,mBAAmB,eAAe,UAAU;CAE5C,OAAO,OAAO,OAAO,OAAO,OAAO,KAAK,GAAG;EACzC,aAAa,QAAQ;EACrB,SAAS,QAAQ;EACjB;EACA,OAAO,QAAQ;EACf,MAAM,QAAQ;EACd,UAAU,QAAQ;EAClB,MAAM,QAAQ;EACd,QAAQ,QAAQ;EAChB,SAAS,QAAQ;EACjB,SAAS,QAAQ;EACjB,SAAS,QAAQ;EACjB,QAAQ,QAAQ;EAChB,OAAO,QAAQ;EACf,MAAM,QAAQ;EACd,OAAO,QAAQ;CACjB,CAAC;AACH;;;;;;;AAQA,MAAa,QAKX,YACA,YAEA,KAAK,YAAY,OAAO;;;;;;;AAQ1B,MAAa,QAKX,YACA,YAEA,eAAe,YAAY;CACzB,aAAa,QAAQ;CACrB,SAAS,KAAA;CACT,OAAO,QAAQ;CACf,MAAM;CACN,UAAU,QAAQ;CAClB,MAAM,QAAQ;CACd,QAAQ,KAAA;CACR,SAAS,KAAA;CACT,SAAS,KAAA;CACT,SAAS,KAAA;CACT,OAAO,QAAQ;CACf,MAAM,KAAA;CACN,OAAO,QAAQ;AACjB,CAAC;AA8EH,SAAgB,KACd,YACA,SAaK;CACL,MAAM,WAAW,QAAQ,YAAY,QAAQ;CAC7C,IAAI,aAAa,KAAA,GACf,MAAM,IAAI,MAAM,gBAAgB,WAAW,0CAA0C;CAGvF,OAAO,eAAe,YAAY;EAChC,aAAa,QAAQ;EACrB,SAAS,QAAQ;EACjB,OAAO,QAAQ;EACf,MAAM;EACN;EACA,MAAM,QAAQ;EACd,QAAQ,KAAA;EACR,SAAS,QAAQ;EACjB,SAAS,QAAQ;EACjB,SAAS,QAAQ;EACjB,OAAO,QAAQ;EACf,MAAM,QAAQ;EACd,OAAO,QAAQ,SAAS;CAC1B,CAAC;AACH;;;;;;;;;;AAWA,MAAa,UAUX,YACA,YAuBG;CACH,MAAM,cAAuF;EAC3F,QAAQ,QAAQ;EAChB,QAAQ,QAAQ;EAChB,GAAI,QAAQ,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,cAAc,QAAQ,aAAa;EACnF,GAAI,QAAQ,qBAAqB,KAAA,IAC7B,CAAC,IACD,EAAE,kBAAkB,QAAQ,iBAAiB;EACjD,GAAI,QAAQ,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU,QAAQ,SAAS;EACvE,GAAI,QAAQ,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,QAAQ,KAAK;EAC3D,GAAI,QAAQ,wBAAwB,KAAA,IAChC,CAAC,IACD,EAAE,qBAAqB,QAAQ,oBAAoB;EACvD,GAAI,QAAQ,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa,QAAQ,YAAY;EAChF,GAAI,QAAQ,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,cAAc,QAAQ,aAAa;EACnF,GAAI,QAAQ,yBAAyB,KAAA,IACjC,CAAC,IACD,EAAE,sBAAsB,QAAQ,qBAAqB;EACzD,GAAI,QAAQ,kBAAkB,KAAA,IAAY,CAAC,IAAI,EAAE,eAAe,QAAQ,cAAc;EACtF,GAAI,QAAQ,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY,QAAQ,WAAW;CAC/E;CAEA,OAAO,eAAe,YAAY;EAChC,aAAa,QAAQ;EACrB,SAAS,QAAQ;EACjB,OAAO,KAAA;EACP,MAAM;EACN,UAAU,QAAQ;EAClB,MAAM,QAAQ;EACd,QAAQ;EACR,SAAS,KAAA;EACT,SAAS,KAAA;EACT,SAAS,QAAQ;EACjB,OAAO,QAAQ;EACf,MAAM,QAAQ;EACd,OAAQ,QAAQ,SAAS,QAAQ;CACnC,CAAC;AACH;;;;;;;AAQA,MAAa,gBAAgB,MAAyB,UAAU,YAAY,GAAG,MAAM"}

package/dist/AuthMethodBinding.d.ts

@@ -0,0 +1,77 @@
+import "./AuthMethodBinding.js";
+import { Any, Value } from "./AuthMethod.js";
+declare namespace AuthMethodBinding_d_exports {
+  export { AuthMethodBinding_d_exports as AuthMethodBinding, Binding, BindingFor, BindingForMethod, Context, MatchCases, isBindingForMethod, makeBinding };
+}
+/**
+ * A resolved connection binding selected for one invocation.
+ *
+ * The selected connection is backed by one provider-owned auth method.
+ *
+ * @since 0.0.0
+ * @category models
+ */
+export type Binding<out Method extends Any = Any> = {
+  readonly providerId: string;
+  readonly connectionId: string | undefined;
+  readonly method: Method;
+  readonly methodId: Method["identifier"];
+  readonly value: Value<Method>;
+};
+/**
+ * Create a resolved connection binding.
+ *
+ * @since 0.0.0
+ * @category constructors
+ */
+export declare const makeBinding: <Method extends Any>(options: {
+  readonly providerId: string;
+  readonly connectionId: string | undefined;
+  readonly method: Method;
+  readonly value: Value<Method>;
+}) => Binding<Method>;
+/**
+ * Union of resolved connection bindings for the provided method list.
+ *
+ * @since 0.0.0
+ * @category type-level
+ */
+export type BindingFor<Methods extends readonly Any[]> = Methods[number] extends (infer Method) ? Method extends Any ? Binding<Method> : never : never;
+/**
+ * Resolved connection binding narrowed to one method from a provider-owned method list.
+ *
+ * @since 0.0.0
+ * @category type-level
+ */
+export type BindingForMethod<Methods extends readonly Any[], Method extends Methods[number]> = BindingFor<Methods> & Binding<Method>;
+/**
+ * Exhaustive handlers for the currently selected connection binding.
+ *
+ * @since 0.0.0
+ * @category models
+ */
+export type MatchCases<Methods extends readonly Any[], Result> = { readonly [Method in Methods[number] as Method["identifier"]]: (binding: BindingForMethod<Methods, Method>) => Result; };
+/**
+ * Runtime auth helper context exposed to action handlers.
+ *
+ * @since 0.0.0
+ * @category models
+ */
+export interface Context<Methods extends readonly Any[]> {
+  readonly current: BindingFor<Methods>;
+  is<Method extends Methods[number]>(method: Method): this is Context<Methods> & {
+    readonly current: BindingForMethod<Methods, Method>;
+  };
+  is<Method extends Methods[number]>(binding: BindingFor<Methods>, method: Method): binding is BindingForMethod<Methods, Method>;
+  match<Result>(cases: MatchCases<Methods, Result>): Result;
+}
+/**
+ * Runtime type guard for matching a resolved binding against a provider-owned method.
+ *
+ * @since 0.0.0
+ * @category guards
+ */
+export declare const isBindingForMethod: <Methods extends readonly Any[], Method extends Methods[number]>(binding: BindingFor<Methods>, method: Method) => binding is BindingForMethod<Methods, Method>;
+//#endregion
+export { AuthMethodBinding_d_exports as AuthMethodBinding, AuthMethodBinding_d_exports };
+//# sourceMappingURL=AuthMethodBinding.d.ts.map

package/dist/AuthMethodBinding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthMethodBinding.d.ts","names":["AuthMethod.Any","AuthMethod.Value"],"sources":["../src/AuthMethodBinding.ts"],"mappings":";;;;;;;;;;;;;YAeY,YAAY,eAAeA,MAAiBA;WAC7C;WACA;WACA,QAAQ;WACR,UAAU;WACV,OAAOC,MAAiB;;;;;;;;qBAStB,cAAe,eAAeD,KAAc;WAC9C;WACA;WACA,QAAQ;WACR,OAAOC,MAAiB;MAC/B,QAAQ;;;;;;;YAcA,WAAW,yBAAyBD,SAC9C,+BAA8B,UAC1B,eAAeA,MACb,QAAQ;;;;;;;YAUJ,iBACV,yBAAyBA,OACzB,eAAe,mBACb,WAAW,WAAW,QAAQ;;;;;;;YAQtB,WAAW,yBAAyBA,OAAkB,sBACtD,UAAU,mBAAmB,wBACrC,SAAS,iBAAiB,SAAS,YAChC;;;;;;;iBASU,QAAQ,yBAAyBA;WACvC,SAAS,WAAW;EAE7B,GAAG,eAAe,iBAChB,QAAQ,iBACC,QAAQ;aAAsB,SAAS,iBAAiB,SAAS;;EAC5E,GAAG,eAAe,iBAChB,SAAS,WAAW,UACpB,QAAQ,SACP,WAAW,iBAAiB,SAAS;EACxC,MAAM,QAAQ,OAAO,WAAW,SAAS,UAAU;;;;;;;;qBASxC,qBACX,yBAAyBA,OACzB,eAAe,iBAAe,SAErB,WAAW,UAAQ,QACpB,WACP,WAAW,iBAAiB,SAAS"}

package/dist/AuthMethodBinding.js

@@ -0,0 +1,31 @@
+import { __exportAll } from "./_virtual/_rolldown/runtime.js";
+//#region src/AuthMethodBinding.ts
+var AuthMethodBinding_exports = /* @__PURE__ */ __exportAll({
+	AuthMethodBinding: () => AuthMethodBinding_exports,
+	isBindingForMethod: () => isBindingForMethod,
+	makeBinding: () => makeBinding
+});
+/**
+* Create a resolved connection binding.
+*
+* @since 0.0.0
+* @category constructors
+*/
+const makeBinding = (options) => ({
+	connectionId: options.connectionId,
+	method: options.method,
+	methodId: options.method.identifier,
+	providerId: options.providerId,
+	value: options.value
+});
+/**
+* Runtime type guard for matching a resolved binding against a provider-owned method.
+*
+* @since 0.0.0
+* @category guards
+*/
+const isBindingForMethod = (binding, method) => binding.method === method;
+//#endregion
+export { AuthMethodBinding_exports as AuthMethodBinding, AuthMethodBinding_exports, isBindingForMethod, makeBinding };
+
+//# sourceMappingURL=AuthMethodBinding.js.map

package/dist/AuthMethodBinding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthMethodBinding.js","names":[],"sources":["../src/AuthMethodBinding.ts"],"sourcesContent":["/**\n * Resolved auth method bindings exposed to action and trigger handlers.\n *\n * @since 0.0.0\n */\nimport type * as AuthMethod from \"./AuthMethod.ts\";\n\n/**\n * A resolved connection binding selected for one invocation.\n *\n * The selected connection is backed by one provider-owned auth method.\n *\n * @since 0.0.0\n * @category models\n */\nexport type Binding<out Method extends AuthMethod.Any = AuthMethod.Any> = {\n  readonly providerId: string;\n  readonly connectionId: string | undefined;\n  readonly method: Method;\n  readonly methodId: Method[\"identifier\"];\n  readonly value: AuthMethod.Value<Method>;\n};\n\n/**\n * Create a resolved connection binding.\n *\n * @since 0.0.0\n * @category constructors\n */\nexport const makeBinding = <Method extends AuthMethod.Any>(options: {\n  readonly providerId: string;\n  readonly connectionId: string | undefined;\n  readonly method: Method;\n  readonly value: AuthMethod.Value<Method>;\n}): Binding<Method> => ({\n  connectionId: options.connectionId,\n  method: options.method,\n  methodId: options.method.identifier,\n  providerId: options.providerId,\n  value: options.value,\n});\n\n/**\n * Union of resolved connection bindings for the provided method list.\n *\n * @since 0.0.0\n * @category type-level\n */\nexport type BindingFor<Methods extends readonly AuthMethod.Any[]> =\n  Methods[number] extends infer Method\n    ? Method extends AuthMethod.Any\n      ? Binding<Method>\n      : never\n    : never;\n\n/**\n * Resolved connection binding narrowed to one method from a provider-owned method list.\n *\n * @since 0.0.0\n * @category type-level\n */\nexport type BindingForMethod<\n  Methods extends readonly AuthMethod.Any[],\n  Method extends Methods[number],\n> = BindingFor<Methods> & Binding<Method>;\n\n/**\n * Exhaustive handlers for the currently selected connection binding.\n *\n * @since 0.0.0\n * @category models\n */\nexport type MatchCases<Methods extends readonly AuthMethod.Any[], Result> = {\n  readonly [Method in Methods[number] as Method[\"identifier\"]]: (\n    binding: BindingForMethod<Methods, Method>,\n  ) => Result;\n};\n\n/**\n * Runtime auth helper context exposed to action handlers.\n *\n * @since 0.0.0\n * @category models\n */\nexport interface Context<Methods extends readonly AuthMethod.Any[]> {\n  readonly current: BindingFor<Methods>;\n  // tsrs accepts this `this` predicate only on an interface or class member.\n  is<Method extends Methods[number]>(\n    method: Method,\n  ): this is Context<Methods> & { readonly current: BindingForMethod<Methods, Method> };\n  is<Method extends Methods[number]>(\n    binding: BindingFor<Methods>,\n    method: Method,\n  ): binding is BindingForMethod<Methods, Method>;\n  match<Result>(cases: MatchCases<Methods, Result>): Result;\n}\n\n/**\n * Runtime type guard for matching a resolved binding against a provider-owned method.\n *\n * @since 0.0.0\n * @category guards\n */\nexport const isBindingForMethod = <\n  Methods extends readonly AuthMethod.Any[],\n  Method extends Methods[number],\n>(\n  binding: BindingFor<Methods>,\n  method: Method,\n): binding is BindingForMethod<Methods, Method> => (binding as Binding).method === method;\n\nexport * as AuthMethodBinding from \"./AuthMethodBinding.ts\";\n"],"mappings":";;;;;;;;;;;;;AA6BA,MAAa,eAA8C,aAKnC;CACtB,cAAc,QAAQ;CACtB,QAAQ,QAAQ;CAChB,UAAU,QAAQ,OAAO;CACzB,YAAY,QAAQ;CACpB,OAAO,QAAQ;AACjB;;;;;;;AA+DA,MAAa,sBAIX,SACA,WACkD,QAAoB,WAAW"}