@neontechspace/fluxerly 1000.0.0-nightly.12

package/dist/native-supervisor.js

@@ -0,0 +1,126 @@
+import * as Cause from "effect/Cause";
+import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+import * as Stream from "effect/Stream";
+import { ConfigurationError } from "#sdk/errors";
+import { attachAccountLimits, attachIdentifyGate } from "#sdk/internal/client";
+import { ChildBridge, childFailureReason, createSupervisor, supervisorOptionError } from "#sdk/internal/supervisor";
+import { childClientOptionsError } from "#sdk/internal/configuration";
+import { readInput } from "#sdk/internal/defects";
+import { SupervisorChildError, SupervisorError, } from "#sdk/supervisor";
+/** Read the child options once, so later getter changes cannot alter the client or configure Effect */
+function readChildOptions(options) {
+    const invalidOptions = supervisorOptionError(options, ["token", "clientOptions", "configure"], "configuration", "Supervisor child options");
+    if (invalidOptions)
+        return invalidOptions;
+    const clientOptions = options.clientOptions;
+    const invalid = childClientOptionsError(clientOptions);
+    if (invalid)
+        return invalid;
+    const { messageFields, instance, rest, transport, uploads, logging, onError, gateway, cache, connection, observe, sharding, } = clientOptions ?? {};
+    const configure = options.configure;
+    return {
+        sessions: sharding?.sessions,
+        clientOptions: {
+            ...(messageFields === undefined ? {} : { messageFields }),
+            ...(instance === undefined ? {} : { instance }),
+            ...(rest === undefined ? {} : { rest }),
+            ...(transport === undefined ? {} : { transport }),
+            ...(uploads === undefined ? {} : { uploads }),
+            ...(logging === undefined ? {} : { logging }),
+            ...(onError === undefined ? {} : { onError }),
+            ...(gateway === undefined ? {} : { gateway }),
+            ...(cache === undefined ? {} : { cache }),
+            ...(connection === undefined ? {} : { connection }),
+            ...(observe === undefined ? {} : { observe }),
+        },
+        token: options.token,
+        // Keep the options object as the receiver, as a method call on it would
+        configure: (context) => Reflect.apply(configure, options, [context]),
+    };
+}
+function childClientOptions(settings, assignment, bridge) {
+    const sharding = settings.sessions === undefined ? assignment : { ...assignment, sessions: settings.sessions };
+    return attachAccountLimits(attachIdentifyGate({ ...settings.clientOptions, token: settings.token, sharding }, bridge.identifyGate), bridge.accountLimits);
+}
+/** Build native supervisor tools around this entry point's scoped client creator */
+export function makeNativeSupervisor(createClient) {
+    const child = Object.freeze({
+        run: (options) => 
+        // Reading the caller options is marked as application input
+        readInput(() => readChildOptions(options)).pipe(Effect.flatMap((settings) => {
+            if (settings instanceof ConfigurationError)
+                return Effect.fail(settings);
+            return Effect.scoped(Effect.gen(function* () {
+                const bridge = yield* ChildBridge.open();
+                yield* Effect.addFinalizer(() => Effect.sync(() => bridge.close()));
+                const initial = yield* Effect.raceFirst(bridge
+                    .waitForAssignment()
+                    .pipe(Effect.map((assignment) => ({ kind: "assignment", assignment }))), bridge.waitForStop().pipe(Effect.map(() => ({ kind: "stop" }))));
+                if (initial.kind === "stop")
+                    return;
+                const assigned = initial.assignment;
+                const client = yield* createClient(childClientOptions(settings, assigned, bridge));
+                yield* Stream.runForEach(client.observeState(), (state) => Effect.sync(() => bridge.state(state))).pipe(Effect.forkScoped);
+                const configureExits = [];
+                let stoppedDuringConfiguration = false;
+                const configured = yield* Effect.exit(Effect.raceFirst(settings.configure(Object.freeze({ client, assignment: assigned })).pipe(Effect.onExit((exit) => Effect.sync(() => {
+                    configureExits.push(exit);
+                })), Effect.as("configured")), bridge.waitForStop().pipe(Effect.tap(() => Effect.sync(() => {
+                    stoppedDuringConfiguration = true;
+                })), Effect.as("stop"))).pipe(
+                // raceFirst awaits the interrupted configure branch but discards its finalizer defects
+                // A cooperative stop remains an IPC success, while the child retains local cleanup defects
+                Effect.onExit((outcome) => {
+                    const missing = configureExits.flatMap((exit) => Exit.isFailure(exit)
+                        ? exit.cause.reasons.filter((reason) => reason._tag !== "Interrupt" &&
+                            (!Exit.isFailure(outcome) ||
+                                !outcome.cause.reasons.includes(reason)))
+                        : []);
+                    return missing.length
+                        ? Effect.failCause(Cause.fromReasons(missing))
+                        : Effect.void;
+                })));
+                if (Exit.isFailure(configured)) {
+                    if (!stoppedDuringConfiguration)
+                        bridge.failed("configure");
+                    return yield* Effect.failCause(configured.cause);
+                }
+                if (configured.value === "stop")
+                    return;
+                bridge.ready();
+                bridge.state(client.state);
+                bridge.reportDiagnostics(() => client.diagnostics());
+                let stopping = false;
+                const outcome = yield* Effect.exit(Effect.raceFirst(client.run().pipe(
+                // A stop before READY cancels startup, so run fails with ClientClosedError.
+                // The stop branch then finishes the drain and decides the outcome
+                Effect.catchTag("ClientClosedError", (error) => stopping ? Effect.never : Effect.fail(error)), Effect.as("client")), bridge.waitForStop().pipe(
+                // Begin the drain before raceFirst interrupts run and its zero-drain finalizer
+                Effect.flatMap(() => {
+                    stopping = true;
+                    return client.shutdown(bridge.drainMs > 0 ? { drainMs: bridge.drainMs } : undefined);
+                }), Effect.as("stop"))));
+                if (Exit.isFailure(outcome)) {
+                    const failure = outcome.cause.reasons.find((reason) => reason._tag === "Fail");
+                    if (failure?._tag !== "Fail")
+                        bridge.failed("client");
+                    else if (!(failure.error instanceof SupervisorChildError))
+                        bridge.failed(childFailureReason(failure.error));
+                    return yield* Effect.failCause(outcome.cause);
+                }
+            }));
+        })),
+    });
+    return Object.freeze({
+        create: (options) => createSupervisor(options, true).pipe(Effect.orDie, Effect.map((owner) => Object.freeze({
+            start: () => owner.start(),
+            waitForClose: () => owner.waitForClose(),
+            waitForReady: () => owner.waitForReady(),
+            status: () => owner.status(),
+            shutdown: () => owner.shutdown(),
+        }))),
+        child,
+    });
+}
+//# sourceMappingURL=native-supervisor.js.map

package/dist/native-supervisor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-supervisor.js","sourceRoot":"","sources":["../src/native-supervisor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,IAAI,MAAM,aAAa,CAAA;AACnC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC,OAAO,EAAE,kBAAkB,EAAqB,MAAM,aAAa,CAAA;AACnE,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAA;AACnH,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAA;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AAEjD,OAAO,EACH,oBAAoB,EAGpB,eAAe,GAGlB,MAAM,iBAAiB,CAAA;AAuIxB,uGAAuG;AACvG,SAAS,gBAAgB,CAAO,OAA2C;IACvE,MAAM,cAAc,GAAG,qBAAqB,CACxC,OAAO,EACP,CAAC,OAAO,EAAE,eAAe,EAAE,WAAW,CAAC,EACvC,eAAe,EACf,0BAA0B,CAC7B,CAAA;IACD,IAAI,cAAc;QAAE,OAAO,cAAc,CAAA;IACzC,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAA;IAC3C,MAAM,OAAO,GAAG,uBAAuB,CAAC,aAAa,CAAC,CAAA;IACtD,IAAI,OAAO;QAAE,OAAO,OAAO,CAAA;IAC3B,MAAM,EACF,aAAa,EACb,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,KAAK,EACL,UAAU,EACV,OAAO,EACP,QAAQ,GACX,GAAG,aAAa,IAAI,EAAE,CAAA;IACvB,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;IACnC,OAAO;QACH,QAAQ,EAAE,QAAQ,EAAE,QAAQ;QAC5B,aAAa,EAAE;YACX,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC;YACzD,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;YAC/C,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;YACvC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;YACjD,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;YAC7C,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;YAC7C,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;YAC7C,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;YAC7C,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;YACzC,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;YACnD,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;SAChD;QACD,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,wEAAwE;QACxE,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;KACvE,CAAA;AACL,CAAC;AAED,SAAS,kBAAkB,CACvB,QAA6B,EAC7B,UAAgC,EAChC,MAAmB;IAEnB,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAA;IAC9G,OAAO,mBAAmB,CACtB,kBAAkB,CAAC,EAAE,GAAG,QAAQ,CAAC,aAAa,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,YAAY,CAAC,EACvG,MAAM,CAAC,aAAa,CACvB,CAAA;AACL,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,oBAAoB,CAChC,YAAgH;IAEhH,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;QACxB,GAAG,EAAE,CACD,OAA2C,EAC+D,EAAE;QAC5G,4DAA4D;QAC5D,SAAS,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAC3C,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;YACxB,IAAI,QAAQ,YAAY,kBAAkB;gBAAE,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YACxE,OAAO,MAAM,CAAC,MAAM,CAChB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAChB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,CAAA;gBACxC,KAAK,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;gBACnE,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,CACnC,MAAM;qBACD,iBAAiB,EAAE;qBACnB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,YAAqB,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EACpF,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,CAAC,CAAC,CAAC,CAC3E,CAAA;gBACD,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM;oBAAE,OAAM;gBACnC,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAA;gBACnC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAA;gBAClF,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CACtD,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CACzC,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;gBACzB,MAAM,cAAc,GAA4B,EAAE,CAAA;gBAClD,IAAI,0BAA0B,GAAG,KAAK,CAAA;gBACtC,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACjC,MAAM,CAAC,SAAS,CACZ,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CACpE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACnB,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;oBACb,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC7B,CAAC,CAAC,CACL,EACD,MAAM,CAAC,EAAE,CAAC,YAAqB,CAAC,CACnC,EACD,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,CACrB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CACZ,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;oBACb,0BAA0B,GAAG,IAAI,CAAA;gBACrC,CAAC,CAAC,CACL,EACD,MAAM,CAAC,EAAE,CAAC,MAAe,CAAC,CAC7B,CACJ,CAAC,IAAI;gBACF,uFAAuF;gBACvF,2FAA2F;gBAC3F,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE;oBACtB,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAC5C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;wBAChB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CACrB,CAAC,MAAM,EAAE,EAAE,CACP,MAAM,CAAC,IAAI,KAAK,WAAW;4BAC3B,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;gCACrB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CACnD;wBACH,CAAC,CAAC,EAAE,CACX,CAAA;oBACD,OAAO,OAAO,CAAC,MAAM;wBACjB,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;wBAC9C,CAAC,CAAC,MAAM,CAAC,IAAI,CAAA;gBACrB,CAAC,CAAC,CACL,CACJ,CAAA;gBACD,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC7B,IAAI,CAAC,0BAA0B;wBAAE,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;oBAC3D,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;gBACpD,CAAC;gBACD,IAAI,UAAU,CAAC,KAAK,KAAK,MAAM;oBAAE,OAAM;gBACvC,MAAM,CAAC,KAAK,EAAE,CAAA;gBACd,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;gBAC1B,MAAM,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;gBACpD,IAAI,QAAQ,GAAG,KAAK,CAAA;gBACpB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAC9B,MAAM,CAAC,SAAS,CACZ,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI;gBACb,4EAA4E;gBAC5E,kEAAkE;gBAClE,MAAM,CAAC,QAAQ,CAAC,mBAAmB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC3C,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAC/C,EACD,MAAM,CAAC,EAAE,CAAC,QAAiB,CAAC,CAC/B,EACD,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI;gBACrB,+EAA+E;gBAC/E,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE;oBAChB,QAAQ,GAAG,IAAI,CAAA;oBACf,OAAO,MAAM,CAAC,QAAQ,CAClB,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAC/D,CAAA;gBACL,CAAC,CAAC,EACF,MAAM,CAAC,EAAE,CAAC,MAAe,CAAC,CAC7B,CACJ,CACJ,CAAA;gBACD,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAA;oBAC9E,IAAI,OAAO,EAAE,IAAI,KAAK,MAAM;wBAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;yBAChD,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,YAAY,oBAAoB,CAAC;wBACrD,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA;oBACpD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;gBACjD,CAAC;YACL,CAAC,CAAC,CACL,CAAA;QACL,CAAC,CAAC,CAKL;KACR,CAAC,CAAA;IACF,OAAO,MAAM,CAAC,MAAM,CAAC;QACjB,MAAM,EAAE,CAAC,OAA0B,EAAE,EAAE,CACnC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,IAAI,CAChC,MAAM,CAAC,KAAK,EACZ,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACjB,MAAM,CAAC,MAAM,CAAC;YACV,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE;YAC1B,YAAY,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE;YACxC,YAAY,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE;YACxC,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE;YAC5B,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE;SACnC,CAAC,CACL,CACJ;QACL,KAAK;KACR,CAAC,CAAA;AACN,CAAC"}

package/dist/oauth.d.ts

@@ -0,0 +1,298 @@
+import type { OperationOptions } from "./client.js";
+import type { InstanceOptions } from "./instance.js";
+import type { LoggingOptions } from "./logging.js";
+import type { ClientClosedError } from "./errors.js";
+import { type ApiErrorDetail, type RequestCredential } from "./api-errors.js";
+import { FluxerlyError } from "./errors.js";
+import { type InputValidationDetail } from "./input-validation.js";
+/**
+ * Choose which account data the user may share, or request bot installation, in authorizationUrl
+ *
+ * @category OAuth
+ */
+export declare const OAuthScopes: Readonly<{
+    /** Read the consenting account's basic identity */
+    Identify: "identify";
+    /** Request the consenting account's email fields */
+    Email: "email";
+    /** Read the consenting account's community memberships */
+    Guilds: "guilds";
+    /** Read the consenting account's connected accounts */
+    Connections: "connections";
+    /** Include bot installation in the consent request */
+    Bot: "bot";
+}>;
+/** One supported authorization scope from OAuthScopes.
+ * Returned token scopes remain strings because Fluxer can grant additional scopes unknown to this SDK
+ *
+ * @category OAuth
+ */
+export type OAuthScope = (typeof OAuthScopes)[keyof typeof OAuthScopes];
+/** Create a server-side OAuth client for exchanging authorization codes with an application secret.
+ * Keep the secret on the application server, not in browser code.
+ * This client is separate from a bot-token client. The application handles the consent callback and stores tokens
+ *
+ * @category OAuth
+ */
+export interface OAuthConfig {
+    /** Decimal Fluxer application ID */
+    readonly clientId: string;
+    /** Application client secret retained until shutdown.
+     * Shutdown releases the SDK's reference, not caller-held copies or the string's underlying memory
+     */
+    readonly clientSecret: string;
+    /** Omit for hosted Fluxer. A supplied instance requires its root URL and trusts its discovered service origins */
+    readonly instance?: InstanceOptions;
+    /**
+     * Log records for this OAuth client, with the same settings as the client option logging. Omit it for the default
+     * console output of Info and above. A rejected client ID or secret logs one rest.rejected Warn record per operation
+     * and Fluxer code, even when the application handles the failure. A rejected user access token is only returned
+     */
+    readonly logging?: LoggingOptions;
+}
+/** Build the consent URL for an authorization-code request with PKCE.
+ * The application keeps state and the PKCE verifier. When the callback arrives, it checks that state matches the sent value.
+ * The SDK does not save these values, open a browser or handle the redirect.
+ * Values are sampled once when authorizationUrl starts, then validated and encoded from that snapshot
+ *
+ * @category OAuth
+ */
+export interface OAuthAuthorizationInput {
+    /** Exact registered redirect, using HTTPS or loopback HTTP, without embedded credentials or a fragment.
+     * Must contain 1–256 well-formed UTF-16 units, with no surrounding whitespace, U+000C or U+202E.
+     * Noncanonical values are rejected rather than normalized
+     */
+    readonly redirectUri: string;
+    /** Provide 1–256 delegated or bot-installation scopes from OAuthScopes.
+     * Supplied entries, including duplicates, count toward this SDK defensive limit.
+     * Duplicates are removed in first-occurrence order before serialization
+     */
+    readonly scopes: readonly OAuthScope[];
+    /** Unpredictable caller-generated value of 1–256 well-formed UTF-16 units, verified by the application on callback.
+     * Surrounding whitespace, U+000C and U+202E are rejected, not removed, so accepted state is preserved exactly
+     */
+    readonly state: string;
+    /** Public hash challenge produced by oauth.createPkce, using S256 and exactly 43 base64url characters.
+     * Retain the paired secret verifier for exchangeCode when the callback arrives
+     */
+    readonly codeChallenge: string;
+    /** Optional community installation target for the bot scope. This hint neither proves membership nor grants permissions */
+    readonly guildId?: string;
+    /** Optional group-DM installation target for the bot scope. Mutually exclusive with guildId and not proof of installation */
+    readonly channelId?: string;
+    /** Optional unsigned 64-bit bot permission bitfield, serialized as a decimal provider parameter without local authorization */
+    readonly permissions?: bigint;
+    /** Ask the bot-installation consent page to hide community selection. This does not establish a selected target */
+    readonly disableGuildSelect?: boolean;
+}
+/** Values received or retained by the application for exchangeCode after a consent callback.
+ * Verify the callback's state before exchanging its code, since the SDK does not perform that check.
+ * Values are sampled once when exchangeCode starts, then validated and transmitted from that snapshot
+ *
+ * @category OAuth
+ */
+export interface OAuthCodeExchangeInput {
+    /** Callback code of 1–256 well-formed UTF-16 units to exchange for tokens.
+     * Surrounding whitespace, U+000C and U+202E are rejected rather than changing the opaque credential.
+     * A dispatched attempt may consume this one-use code even if its response is lost
+     */
+    readonly code: string;
+    /** The exact redirect URI used in the authorization request, with the same 1–256-unit and canonical-text requirements */
+    readonly redirectUri: string;
+    /** Original secret PKCE verifier, such as the verifier returned by oauth.createPkce.
+     * Must contain 43–128 ASCII letters, digits or the characters - . _ ~
+     */
+    readonly codeVerifier: string;
+}
+/** Credentials returned by a successful exchangeCode or refresh call.
+ * Store and protect these values in the application, since the SDK does not retain them or schedule refreshes.
+ * After a refresh, use the new credentials. The previous refresh token may no longer work
+ *
+ * @category OAuth
+ */
+export interface OAuthTokens {
+    /** Bearer credential for delegated reads, not a bot token */
+    readonly accessToken: string;
+    /** Credential for an explicit refresh call, which may rotate it */
+    readonly refreshToken: string;
+    /** Authentication scheme for the access token */
+    readonly tokenType: "Bearer";
+    /** Provider-reported lifetime in seconds, not an absolute expiry or a scheduled refresh */
+    readonly expiresInSeconds: number;
+    /** Granted scopes as returned by Fluxer. They can differ from requested scopes */
+    readonly scopes: readonly string[];
+}
+/** Frozen basic account identity returned by fetchIdentity using a delegated access token.
+ * Optional email fields are included only when Fluxer supplies them, not synthesized from requested scopes
+ *
+ * @category OAuth
+ */
+export interface OAuthIdentity {
+    /** Decimal account ID */
+    readonly id: string;
+    /** Account username */
+    readonly username: string;
+    /** Provider discriminator string, preserved without numeric conversion */
+    readonly discriminator: string;
+    /** Account-wide display name, or null when absent. The display.name helper reads it */
+    readonly displayName: string | null;
+    /** Avatar hash, or null when the account has no avatar */
+    readonly avatar: string | null;
+    /** Email address when supplied, null when explicitly absent, or an omitted field when not returned */
+    readonly email?: string | null;
+    /** Provider verification flag when supplied, null when unspecified, or an omitted field when not returned */
+    readonly verified?: boolean | null;
+}
+/**
+ * One connection returned by fetchConnections with the connections scope, as an immutable value
+ *
+ * @category OAuth
+ */
+export interface OAuthConnection {
+    /** Provider connection identifier, which may be empty and is not necessarily a decimal account ID */
+    readonly id: string;
+    /** Connection kind accepted by this SDK's response parser, currently bsky or domain */
+    readonly type: string;
+    /** Provider connection name, which may be empty */
+    readonly name: string;
+    /** Whether Fluxer reports that the connection is verified */
+    readonly verified: boolean;
+    /** Provider visibility bitfield, preserved as a nonnegative 32-bit integer without interpreting its flags */
+    readonly visibilityFlags: number;
+    /** Provider sort-order value, preserved without reordering the returned list */
+    readonly sortOrder: number;
+}
+/** Token-check result when Fluxer does not report the credential as active for this application.
+ * This does not distinguish an unknown, expired or revoked token from a token issued to another client
+ *
+ * @category OAuth
+ */
+export interface OAuthInactiveIntrospection {
+    /** Fluxer did not report this token as active for this application */
+    readonly active: false;
+}
+/** Token-check result when Fluxer reports this application's access or refresh token as active.
+ * Inspect tokenType before using optional access-token expiry data
+ *
+ * @category OAuth
+ */
+export interface OAuthActiveIntrospection {
+    /** Fluxer reported this token as active at the time of the request, not guaranteed for later use */
+    readonly active: true;
+    /** Decimal ID of the application to which the token belongs */
+    readonly clientId: string;
+    /** Subject account ID when Fluxer includes one. Its absence does not make an otherwise active access token inactive */
+    readonly subjectId?: string;
+    /** Whether the inspected credential is an access token or refresh token */
+    readonly tokenType: "Bearer" | "refresh_token";
+    /** Granted scopes parsed from Fluxer's space-separated response, with no authorization decision or retention */
+    readonly scopes: readonly string[];
+    /** Provider-reported Unix seconds when this token was issued */
+    readonly issuedAtUnixSeconds: number;
+    /** Provider-reported Unix seconds for an access token. Refresh-token results omit this field */
+    readonly expiresAtUnixSeconds?: number;
+}
+/** Result of introspect, which explicitly asks Fluxer whether a token is active for this application.
+ * An inactive result does not explain why the token is inactive or prove it was revoked
+ *
+ * @category OAuth
+ */
+export type OAuthIntrospection = OAuthInactiveIntrospection | OAuthActiveIntrospection;
+/** Set the deadline for one OAuth call without scheduling retries or changing another call's lifetime.
+ * Malformed options return a local input error before discovery
+ *
+ * @category OAuth
+ */
+export interface OAuthOperationOptions {
+    /** Total milliseconds across discovery and the operation, integer 1–2,147,483,647, default 30,000.
+     * Required cleanup can outlast this deadline
+     */
+    readonly timeoutMs?: number;
+}
+/**
+ * Default-API OAuth cancellation affects only that operation and awaits request cleanup
+ *
+ * @category OAuth
+ */
+export interface DefaultOAuthOperationOptions extends OAuthOperationOptions, OperationOptions {
+}
+/**
+ * Public OAuth call identified by operation-error metadata
+ *
+ * @category Errors
+ */
+export type OAuthOperation = "oauth.authorizationUrl" | "oauth.exchangeCode" | "oauth.refresh" | "oauth.revoke" | "oauth.fetchIdentity" | "oauth.fetchGuilds" | "oauth.fetchConnections" | "oauth.introspect";
+/** @internal The credential an OAuth call sent, for its rejection hint and log record */
+export declare const oauthCredential: (operation: OAuthOperation, oauthError: string | null) => RequestCredential;
+/** An OAuth call failed an input check, reached a local capacity limit, or failed during its request or response.
+ * A deadline expiry is also reported here.
+ * Inspect outcome before deciding whether to retry a code exchange, refresh or revocation.
+ * The SDK does not retry these operations automatically.
+ * Failures of fetchIdentity, fetchGuilds, fetchConnections and introspect set details.read for errors.isRetryable and do not imply a token change.
+ * SDK-reported discovery and transport failures retain sanitized causes with safe transport codes when available.
+ * Only reviewed error classifications are retained, not bodies, provider descriptions or credentials
+ *
+ * @category Errors
+ */
+export declare class OAuthOperationError extends FluxerlyError {
+    /** Discriminator for narrowing this expected failure in either entry point */
+    readonly _tag = "OAuthOperationError";
+    /** OAuth call that failed */
+    readonly operation: OAuthOperation;
+    /** Input validation, full local capacity, HTTP rejection, network failure, invalid response, deadline expiry or HTTP 429 */
+    readonly reason: "input" | "busy" | "rejected" | "network" | "response" | "timeout" | "rateLimit";
+    /** Whether the request may have reached Fluxer, described by {@link OperationOutcome}.
+     * An unknown token-changing request may have taken effect, so retrying can consume or invalidate credentials again.
+     * Read calls cannot change tokens, even when their request outcome is unknown
+     */
+    readonly outcome: "notDispatched" | "rejected" | "unknown";
+    /** HTTP status when received, otherwise null */
+    readonly status: number | null;
+    /** Numeric Retry-After duration in milliseconds for a 429 response, or null when unavailable */
+    readonly retryAfterMs: number | null;
+    /** Recognized RFC OAuth error code, otherwise null */
+    readonly oauthError: string | null;
+    /** Safe local validation facts when the SDK can identify a failed input rule, otherwise null */
+    readonly inputValidation: InputValidationDetail | null;
+    /** Reviewed Fluxer HTTP error detail when the response uses the normal Fluxer envelope, otherwise null */
+    readonly apiError: ApiErrorDetail | null;
+    /** Create the failure from an options object, with an optional underlying cause */
+    constructor(options: {
+        readonly operation: OAuthOperation;
+        readonly reason: "input" | "busy" | "rejected" | "network" | "response" | "timeout" | "rateLimit";
+        readonly outcome: "notDispatched" | "rejected" | "unknown";
+        readonly status?: number | null | undefined;
+        readonly retryAfterMs?: number | null | undefined;
+        readonly oauthError?: string | null | undefined;
+        readonly inputValidation?: InputValidationDetail | null | undefined;
+        readonly apiError?: ApiErrorDetail | null | undefined;
+        /**
+         * Fluxer error code that this SDK version does not recognize, recorded as details.providerCode and named in the
+         * message. Ignored when apiError is present or the code does not have the shape of a Fluxer code
+         */
+        readonly providerCode?: string | null | undefined;
+        readonly cause?: unknown;
+    });
+}
+/** Expected OAuth failures shared by both entry points.
+ * Default-API calls add CancelledError, while native interruption remains in the Effect cause
+ *
+ * @category Errors
+ */
+export type OAuthOperationFailure = OAuthOperationError | ClientClosedError;
+/** A PKCE secret and its public hash challenge, used to prove that the code exchange belongs to the authorization request.
+ * The application owns these values, and the SDK does not retain them
+ *
+ * @category OAuth
+ */
+export interface OAuthPkce {
+    /** Secret to retain for exchangeCode, not to publish in the consent URL or logs */
+    readonly verifier: string;
+    /** Public S256 challenge to pass to authorizationUrl */
+    readonly challenge: string;
+}
+/** Generate a random PKCE verifier and its SHA-256 base64url challenge for one authorization request.
+ * Both entry points expose it as oauth.createPkce
+ */
+export declare function createPkce(): OAuthPkce;
+//# sourceMappingURL=oauth.d.ts.map

package/dist/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAIH,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACzB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,aAAa,EAAoB,MAAM,aAAa,CAAA;AAC7D,OAAO,EAA+B,KAAK,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAE/F;;;;GAIG;AACH,eAAO,MAAM,WAAW,EAAE,QAAQ,CAAC;IAC/B,mDAAmD;IACnD,QAAQ,EAAE,UAAU,CAAA;IACpB,oDAAoD;IACpD,KAAK,EAAE,OAAO,CAAA;IACd,0DAA0D;IAC1D,MAAM,EAAE,QAAQ,CAAA;IAChB,uDAAuD;IACvD,WAAW,EAAE,aAAa,CAAA;IAC1B,sDAAsD;IACtD,GAAG,EAAE,KAAK,CAAA;CACb,CAMC,CAAA;AAEF;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,OAAO,WAAW,CAAC,CAAA;AAEvE;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IACxB,oCAAoC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB;;OAEG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,kHAAkH;IAClH,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAA;IACnC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,CAAA;CACpC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,uBAAuB;IACpC;;;OAGG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,CAAA;IACtC;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB;;OAEG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,2HAA2H;IAC3H,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,6HAA6H;IAC7H,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,+HAA+H;IAC/H,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,mHAAmH;IACnH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;CACxC;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACnC;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,yHAAyH;IACzH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B;;OAEG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAChC;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IACxB,6DAA6D;IAC7D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,mEAAmE;IACnE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,iDAAiD;IACjD,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAA;IAC5B,2FAA2F;IAC3F,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,kFAAkF;IAClF,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC1B,yBAAyB;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,uBAAuB;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,0EAA0E;IAC1E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,uFAAuF;IACvF,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,sGAAsG;IACtG,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,6GAA6G;IAC7G,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,IAAI,CAAA;CACrC;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC5B,qGAAqG;IACrG,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,uFAAuF;IACvF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,mDAAmD;IACnD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,6GAA6G;IAC7G,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,gFAAgF;IAChF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC7B;AAED;;;;GAIG;AACH,MAAM,WAAW,0BAA0B;IACvC,sEAAsE;IACtE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAA;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACrC,oGAAoG;IACpG,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAA;IACrB,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,uHAAuH;IACvH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,EAAE,QAAQ,GAAG,eAAe,CAAA;IAC9C,gHAAgH;IAChH,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC,gEAAgE;IAChE,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;IACpC,gGAAgG;IAChG,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAA;CACzC;AAED;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,0BAA0B,GAAG,wBAAwB,CAAA;AAEtF;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IAClC;;OAEG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,4BAA6B,SAAQ,qBAAqB,EAAE,gBAAgB;CAAG;AAEhG;;;;GAIG;AACH,MAAM,MAAM,cAAc,GACpB,wBAAwB,GACxB,oBAAoB,GACpB,eAAe,GACf,cAAc,GACd,qBAAqB,GACrB,mBAAmB,GACnB,wBAAwB,GACxB,kBAAkB,CAAA;AASxB,yFAAyF;AACzF,eAAO,MAAM,eAAe,cAAe,cAAc,cAAc,MAAM,GAAG,IAAI,KAAG,iBACgB,CAAA;AAEvG;;;;;;;;;GASG;AACH,qBAAa,mBAAoB,SAAQ,aAAa;IAClD,8EAA8E;IAC9E,QAAQ,CAAC,IAAI,yBAAwB;IACrC,6BAA6B;IAC7B,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAA;IAClC,4HAA4H;IAC5H,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,WAAW,CAAA;IACjG;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,UAAU,GAAG,SAAS,CAAA;IAC1D,gDAAgD;IAChD,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,gGAAgG;IAChG,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IACpC,sDAAsD;IACtD,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,gGAAgG;IAChG,QAAQ,CAAC,eAAe,EAAE,qBAAqB,GAAG,IAAI,CAAA;IACtD,0GAA0G;IAC1G,QAAQ,CAAC,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAA;IACxC,mFAAmF;IACnF,YAAY,OAAO,EAAE;QACjB,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAA;QAClC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,WAAW,CAAA;QACjG,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,UAAU,GAAG,SAAS,CAAA;QAC1D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;QAC3C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;QACjD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;QAC/C,QAAQ,CAAC,eAAe,CAAC,EAAE,qBAAqB,GAAG,IAAI,GAAG,SAAS,CAAA;QACnE,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,CAAA;QACrD;;;WAGG;QACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;QACjD,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAC3B,EAiEA;CACJ;AAED;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAAG,mBAAmB,GAAG,iBAAiB,CAAA;AAE3E;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACtB,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,wDAAwD;IACxD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC7B;AAED;;GAEG;AACH,wBAAgB,UAAU,IAAI,SAAS,CAItC"}

package/dist/oauth.js

@@ -0,0 +1,128 @@
+import { createHash, randomBytes } from "node:crypto";
+import { operationErrorMessage, operationFailureHint, safeProviderCode, } from "./api-errors.js";
+import { FluxerlyError, operationDetails } from "./errors.js";
+import { freezeInputValidationDetail } from "./input-validation.js";
+/**
+ * Choose which account data the user may share, or request bot installation, in authorizationUrl
+ *
+ * @category OAuth
+ */
+export const OAuthScopes = Object.freeze({
+    Identify: "identify",
+    Email: "email",
+    Guilds: "guilds",
+    Connections: "connections",
+    Bot: "bot",
+});
+/** Calls that send the user's access token. The others authenticate with the application's client ID and secret */
+const userTokenOperations = new Set([
+    "oauth.fetchIdentity",
+    "oauth.fetchGuilds",
+    "oauth.fetchConnections",
+]);
+/** @internal The credential an OAuth call sent, for its rejection hint and log record */
+export const oauthCredential = (operation, oauthError) => oauthError !== "invalid_client" && userTokenOperations.has(operation) ? "oauthUser" : "oauthClient";
+/** An OAuth call failed an input check, reached a local capacity limit, or failed during its request or response.
+ * A deadline expiry is also reported here.
+ * Inspect outcome before deciding whether to retry a code exchange, refresh or revocation.
+ * The SDK does not retry these operations automatically.
+ * Failures of fetchIdentity, fetchGuilds, fetchConnections and introspect set details.read for errors.isRetryable and do not imply a token change.
+ * SDK-reported discovery and transport failures retain sanitized causes with safe transport codes when available.
+ * Only reviewed error classifications are retained, not bodies, provider descriptions or credentials
+ *
+ * @category Errors
+ */
+export class OAuthOperationError extends FluxerlyError {
+    /** Discriminator for narrowing this expected failure in either entry point */
+    _tag = "OAuthOperationError";
+    /** OAuth call that failed */
+    operation;
+    /** Input validation, full local capacity, HTTP rejection, network failure, invalid response, deadline expiry or HTTP 429 */
+    reason;
+    /** Whether the request may have reached Fluxer, described by {@link OperationOutcome}.
+     * An unknown token-changing request may have taken effect, so retrying can consume or invalidate credentials again.
+     * Read calls cannot change tokens, even when their request outcome is unknown
+     */
+    outcome;
+    /** HTTP status when received, otherwise null */
+    status;
+    /** Numeric Retry-After duration in milliseconds for a 429 response, or null when unavailable */
+    retryAfterMs;
+    /** Recognized RFC OAuth error code, otherwise null */
+    oauthError;
+    /** Safe local validation facts when the SDK can identify a failed input rule, otherwise null */
+    inputValidation;
+    /** Reviewed Fluxer HTTP error detail when the response uses the normal Fluxer envelope, otherwise null */
+    apiError;
+    /** Create the failure from an options object, with an optional underlying cause */
+    constructor(options) {
+        const operation = options.operation;
+        const reason = options.reason;
+        const outcome = options.outcome;
+        const status = options.status ?? null;
+        const retryAfterMs = options.retryAfterMs ?? null;
+        const oauthError = options.oauthError ?? null;
+        const inputValidation = options.inputValidation ?? null;
+        const apiError = options.apiError ?? null;
+        const providerCode = safeProviderCode(apiError, options.providerCode ?? null);
+        const read = operation === "oauth.fetchIdentity" ||
+            operation === "oauth.fetchGuilds" ||
+            operation === "oauth.fetchConnections" ||
+            operation === "oauth.introspect";
+        super(operationErrorMessage({
+            subject: "OAuth",
+            operation,
+            reason,
+            outcome,
+            status,
+            apiError,
+            inputExplanation: oauthError === null
+                ? (inputValidation?.explanation ?? null)
+                : `Fluxer returned the OAuth error ${oauthError}`,
+            retryAfterMs,
+            facts: { providerCode, read },
+        }), {
+            code: `oauth.${reason}`,
+            hint: operationFailureHint({
+                reason,
+                outcome,
+                status,
+                retryAfterMs,
+                apiError,
+                inputPath: inputValidation?.path ?? null,
+                oauthError,
+                credential: oauthCredential(operation, oauthError),
+                read,
+            }),
+            cause: options.cause,
+            details: operationDetails({
+                operation,
+                reason,
+                outcome,
+                status,
+                retryAfterMs,
+                oauthError,
+                providerCode,
+                read,
+            }),
+        });
+        this.operation = operation;
+        this.reason = reason;
+        this.outcome = outcome;
+        this.status = status;
+        this.retryAfterMs = retryAfterMs;
+        this.oauthError = oauthError;
+        this.apiError = apiError;
+        this.name = this._tag;
+        this.inputValidation = freezeInputValidationDetail(inputValidation);
+    }
+}
+/** Generate a random PKCE verifier and its SHA-256 base64url challenge for one authorization request.
+ * Both entry points expose it as oauth.createPkce
+ */
+export function createPkce() {
+    const verifier = randomBytes(32).toString("base64url");
+    const challenge = createHash("sha256").update(verifier).digest("base64url");
+    return Object.freeze({ verifier, challenge });
+}
+//# sourceMappingURL=oauth.js.map

package/dist/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAKrD,OAAO,EACH,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,GAGnB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC7D,OAAO,EAAE,2BAA2B,EAA8B,MAAM,uBAAuB,CAAA;AAE/F;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAWnB,MAAM,CAAC,MAAM,CAAC;IACf,QAAQ,EAAE,UAAU;IACpB,KAAK,EAAE,OAAO;IACd,MAAM,EAAE,QAAQ;IAChB,WAAW,EAAE,aAAa;IAC1B,GAAG,EAAE,KAAK;CACb,CAAC,CAAA;AA8NF,mHAAmH;AACnH,MAAM,mBAAmB,GAAgC,IAAI,GAAG,CAAiB;IAC7E,qBAAqB;IACrB,mBAAmB;IACnB,wBAAwB;CAC3B,CAAC,CAAA;AAEF,yFAAyF;AACzF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,SAAyB,EAAE,UAAyB,EAAqB,EAAE,CACvG,UAAU,KAAK,gBAAgB,IAAI,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAA;AAEvG;;;;;;;;;GASG;AACH,MAAM,OAAO,mBAAoB,SAAQ,aAAa;IAClD,8EAA8E;IACrE,IAAI,GAAG,qBAAqB,CAAA;IACrC,6BAA6B;IACpB,SAAS,CAAgB;IAClC,4HAA4H;IACnH,MAAM,CAAkF;IACjG;;;OAGG;IACM,OAAO,CAA0C;IAC1D,gDAAgD;IACvC,MAAM,CAAe;IAC9B,gGAAgG;IACvF,YAAY,CAAe;IACpC,sDAAsD;IAC7C,UAAU,CAAe;IAClC,gGAAgG;IACvF,eAAe,CAA8B;IACtD,0GAA0G;IACjG,QAAQ,CAAuB;IACxC,mFAAmF;IACnF,YAAY,OAeX;QACG,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;QACnC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;QAC7B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAA;QAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,CAAA;QACrC,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,IAAI,CAAA;QACjD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAA;QAC7C,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,IAAI,CAAA;QACvD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAA;QACzC,MAAM,YAAY,GAAG,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC,CAAA;QAC7E,MAAM,IAAI,GACN,SAAS,KAAK,qBAAqB;YACnC,SAAS,KAAK,mBAAmB;YACjC,SAAS,KAAK,wBAAwB;YACtC,SAAS,KAAK,kBAAkB,CAAA;QACpC,KAAK,CACD,qBAAqB,CAAC;YAClB,OAAO,EAAE,OAAO;YAChB,SAAS;YACT,MAAM;YACN,OAAO;YACP,MAAM;YACN,QAAQ;YACR,gBAAgB,EACZ,UAAU,KAAK,IAAI;gBACf,CAAC,CAAC,CAAC,eAAe,EAAE,WAAW,IAAI,IAAI,CAAC;gBACxC,CAAC,CAAC,mCAAmC,UAAU,EAAE;YACzD,YAAY;YACZ,KAAK,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;SAChC,CAAC,EACF;YACI,IAAI,EAAE,SAAS,MAAM,EAAE;YACvB,IAAI,EAAE,oBAAoB,CAAC;gBACvB,MAAM;gBACN,OAAO;gBACP,MAAM;gBACN,YAAY;gBACZ,QAAQ;gBACR,SAAS,EAAE,eAAe,EAAE,IAAI,IAAI,IAAI;gBACxC,UAAU;gBACV,UAAU,EAAE,eAAe,CAAC,SAAS,EAAE,UAAU,CAAC;gBAClD,IAAI;aACP,CAAC;YACF,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,OAAO,EAAE,gBAAgB,CAAC;gBACtB,SAAS;gBACT,MAAM;gBACN,OAAO;gBACP,MAAM;gBACN,YAAY;gBACZ,UAAU;gBACV,YAAY;gBACZ,IAAI;aACP,CAAC;SACL,CACJ,CAAA;QACD,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;QAC1B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;QACtB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,YAAY,GAAG,YAAY,CAAA;QAChC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;QACrB,IAAI,CAAC,eAAe,GAAG,2BAA2B,CAAC,eAAe,CAAC,CAAA;IACvE,CAAC;CACJ;AAqBD;;GAEG;AACH,MAAM,UAAU,UAAU;IACtB,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IACtD,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IAC3E,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAA;AACjD,CAAC"}