@voltro/plugin-auth-social 0.86.0 → 0.87.0

package/dist/callback.js

@@ -2,112 +2,128 @@ import { SocialAuthError as e, SocialConfigError as t, SocialExchangeError as n,
 import { socialProvider as a } from "./providers.js";
 import { appleClientSecret as o, isApplePrivateRelayEmail as s, parseAppleUserPayload as c } from "./apple.js";
 import { fetchGithubIdentity as l } from "./github.js";
-import { timingSafeStringEqual as u } from "@voltro/protocol/session";
-import { JwtVerifyError as d, verifyJwt as f } from "@voltro/protocol/jwt";
+import { fetchDiscordIdentity as u } from "./discord.js";
+import { fetchEpicIdentity as d } from "./epic.js";
+import { timingSafeStringEqual as f } from "@voltro/protocol/session";
+import { JwtVerifyError as p, verifyJwt as m } from "@voltro/protocol/jwt";
 //#region src/callback.ts
-var p = (e) => e === !0 || e === "true", m = (e) => typeof e == "string" && e.length > 0 ? e : null, h = async (h) => {
-	let g = a(h.provider, h.endpoints ?? {});
-	if (!h.code) throw new e(400, "missing_code", "socialCompleteLogin: missing `code`");
-	if (!h.expectedState) throw new i("socialCompleteLogin: no `expectedState` — the login was never started by this server, or the state cookie expired. Refusing to exchange the code.");
-	if (!h.state || !u(h.state, h.expectedState)) throw new i("socialCompleteLogin: `state` does not match the value minted for this browser (possible login CSRF).");
-	if (!h.codeVerifier) throw new e(400, "missing_verifier", "socialCompleteLogin: missing `codeVerifier` (PKCE)");
-	if (g.kind === "oidc" && !h.expectedNonce) throw new t(`socialCompleteLogin: ${g.id} returns an ID token, so \`expectedNonce\` is required — without it a token captured from another login replays here.`);
-	let _ = g.id === "apple" ? o(h.clientId, h.appleKey ?? (() => {
+var h = (e) => e === !0 || e === "true", g = (e) => typeof e == "string" && e.length > 0 ? e : null, _ = async (_) => {
+	let v = a(_.provider, _.endpoints ?? {});
+	if (!_.code) throw new e(400, "missing_code", "socialCompleteLogin: missing `code`");
+	if (!_.expectedState) throw new i("socialCompleteLogin: no `expectedState` — the login was never started by this server, or the state cookie expired. Refusing to exchange the code.");
+	if (!_.state || !f(_.state, _.expectedState)) throw new i("socialCompleteLogin: `state` does not match the value minted for this browser (possible login CSRF).");
+	if (!_.codeVerifier) throw new e(400, "missing_verifier", "socialCompleteLogin: missing `codeVerifier` (PKCE)");
+	if (v.kind === "oidc" && !_.expectedNonce) throw new t(`socialCompleteLogin: ${v.id} returns an ID token, so \`expectedNonce\` is required — without it a token captured from another login replays here.`);
+	let y = v.id === "apple" ? o(_.clientId, _.appleKey ?? (() => {
 		throw new t("apple: `appleKey` (teamId + keyId + .p8) is required");
-	})(), h.now ?? Date.now) : h.clientSecret ?? (() => {
-		throw new t(`${g.id}: \`clientSecret\` is required`);
-	})(), v = h.fetchImpl ?? fetch, y = new URLSearchParams({
+	})(), _.now ?? Date.now) : _.clientSecret ?? (() => {
+		throw new t(`${v.id}: \`clientSecret\` is required`);
+	})(), b = _.fetchImpl ?? fetch, x = new URLSearchParams({
 		grant_type: "authorization_code",
-		client_id: h.clientId,
-		client_secret: _,
-		code: h.code,
-		redirect_uri: h.redirectUri,
-		code_verifier: h.codeVerifier
-	}), b = await v(g.tokenUrl, {
-		method: "POST",
-		headers: {
-			"content-type": "application/x-www-form-urlencoded",
-			accept: "application/json"
-		},
-		body: y.toString()
+		client_id: _.clientId,
+		client_secret: y,
+		code: _.code,
+		redirect_uri: _.redirectUri,
+		code_verifier: _.codeVerifier
 	});
-	if (!b.ok) {
-		let e = await b.text().catch(() => "");
-		throw new n("exchange_failed", `${g.id}: token exchange failed (${b.status}): ${e.slice(0, 200)}`);
+	v.id === "epic" && (x.delete("client_id"), x.delete("client_secret"));
+	let S;
+	try {
+		S = await b(v.tokenUrl, {
+			method: "POST",
+			headers: {
+				"content-type": "application/x-www-form-urlencoded",
+				accept: "application/json",
+				...v.id === "epic" ? { authorization: `Basic ${Buffer.from(`${encodeURIComponent(_.clientId)}:${encodeURIComponent(y)}`, "utf8").toString("base64")}` } : {}
+			},
+			body: x.toString(),
+			redirect: "error"
+		});
+	} catch {
+		throw new n("exchange_failed", `${v.id}: token exchange request failed`);
 	}
-	let x;
+	if (!S.ok) throw new n("exchange_failed", `${v.id}: token exchange failed (${S.status})`);
+	let C;
 	try {
-		x = await b.json();
+		let e = await S.json();
+		if (typeof e != "object" || !e || Array.isArray(e)) throw Error();
+		C = e;
 	} catch {
-		throw new n("malformed_token_response", `${g.id}: token endpoint returned a body that is not JSON`);
+		throw new n("malformed_token_response", `${v.id}: token endpoint returned a body that is not JSON`);
 	}
-	if (x.error) throw new n("exchange_failed", `${g.id}: token exchange refused: ${x.error}${x.error_description ? ` (${x.error_description})` : ""}`);
-	if (g.kind === "oauth2") {
-		if (!x.access_token) throw new n("malformed_token_response", `${g.id}: token response carries no access_token`);
-		if (!g.apiBase) throw new t(`${g.id}: no apiBase configured`);
-		let e = await l(x.access_token, {
-			apiBase: g.apiBase,
-			...h.fetchImpl === void 0 ? {} : { fetchImpl: h.fetchImpl }
-		});
+	if (C.error) throw new n("exchange_failed", `${v.id}: token exchange refused`);
+	if (v.kind === "oauth2") {
+		if (typeof C.access_token != "string" || !C.access_token) throw new n("malformed_token_response", `${v.id}: token response carries no access_token`);
+		if (!v.apiBase) throw new t(`${v.id}: no apiBase configured`);
+		let e = {
+			apiBase: v.apiBase,
+			..._.fetchImpl === void 0 ? {} : { fetchImpl: _.fetchImpl }
+		}, r = v.id === "github" ? await l(C.access_token, e) : v.id === "discord" ? await u(C.access_token, e) : v.id === "epic" ? await d(C.access_token, {
+			...e,
+			clientId: _.clientId,
+			..._.now ? { now: _.now } : {}
+		}) : (() => {
+			throw new t(`${v.id}: no OAuth identity adapter`);
+		})();
 		return {
-			provider: g.id,
-			providerAccountId: e.accountId,
-			email: e.email,
-			emailVerified: e.emailVerified,
+			provider: v.id,
+			providerAccountId: r.accountId,
+			email: r.email,
+			emailVerified: r.emailVerified,
 			emailIsPrivateRelay: !1,
-			name: e.name ?? e.login,
+			name: r.name ?? r.login,
 			firstName: null,
 			lastName: null,
-			avatarUrl: e.avatarUrl,
+			avatarUrl: r.avatarUrl,
 			nameIsFirstAuthorizationOnly: !1,
-			raw: { ...e }
+			raw: { ...r }
 		};
 	}
-	if (!x.id_token) throw new n("malformed_token_response", `${g.id}: token response carries no id_token`);
-	if (!g.jwksUrl || !g.issuer) throw new t(`${g.id}: no JWKS/issuer configured`);
-	let S;
+	if (typeof C.id_token != "string" || !C.id_token) throw new n("malformed_token_response", `${v.id}: token response carries no id_token`);
+	if (!v.jwksUrl || !v.issuer) throw new t(`${v.id}: no JWKS/issuer configured`);
+	let w;
 	try {
-		S = await f(x.id_token, g.jwksUrl, {
-			issuer: g.issuer,
-			audience: h.clientId
+		w = await m(C.id_token, v.jwksUrl, {
+			issuer: v.issuer,
+			audience: _.clientId
 		});
 	} catch (e) {
-		throw e instanceof d ? new r("id_token_invalid", `${g.id}: id_token ${e.code}: ${e.message}`) : new r("id_token_invalid", `${g.id}: id_token verification failed: ${e.message}`);
+		throw e instanceof p ? new r("id_token_invalid", `${v.id}: id_token verification refused (${e.code})`) : new r("id_token_invalid", `${v.id}: id_token verification failed`);
 	}
-	let C = m(S.nonce);
-	if (!C || !u(C, h.expectedNonce ?? "")) throw new r("nonce_mismatch", `${g.id}: id_token nonce does not match the value minted for this login (possible replay).`);
-	let w = m(S.sub);
-	if (!w) throw new r("id_token_invalid", `${g.id}: id_token has no sub claim`);
-	let T = m(S.email), E = p(S.email_verified);
-	if (g.id === "apple") {
-		let e = c(h.appleUserPayload), t = p(S.is_private_email) || s(T), n = e?.firstName ?? null, r = e?.lastName ?? null, i = [n, r].filter((e) => e !== null).join(" ");
+	let T = g(w.nonce);
+	if (!T || !f(T, _.expectedNonce ?? "")) throw new r("nonce_mismatch", `${v.id}: id_token nonce does not match the value minted for this login (possible replay).`);
+	let E = g(w.sub);
+	if (!E) throw new r("id_token_invalid", `${v.id}: id_token has no sub claim`);
+	let D = g(w.email), O = D !== null && v.assertsEmailVerification && h(w.email_verified);
+	if (v.id === "apple") {
+		let e = c(_.appleUserPayload), t = h(w.is_private_email) || s(D), n = e?.firstName ?? null, r = e?.lastName ?? null, i = [n, r].filter((e) => e !== null).join(" ");
 		return {
 			provider: "apple",
-			providerAccountId: w,
-			email: T ?? e?.email ?? null,
-			emailVerified: E,
+			providerAccountId: E,
+			email: D ?? e?.email ?? null,
+			emailVerified: O,
 			emailIsPrivateRelay: t,
 			name: i.length > 0 ? i : null,
 			firstName: n,
 			lastName: r,
 			avatarUrl: null,
 			nameIsFirstAuthorizationOnly: e !== null,
-			raw: S
+			raw: w
 		};
 	}
 	return {
-		provider: g.id,
-		providerAccountId: w,
-		email: T,
-		emailVerified: E,
+		provider: v.id,
+		providerAccountId: E,
+		email: D,
+		emailVerified: O,
 		emailIsPrivateRelay: !1,
-		name: m(S.name),
-		firstName: m(S.given_name),
-		lastName: m(S.family_name),
-		avatarUrl: m(S.picture),
+		name: g(w.name) ?? (v.id === "twitch" ? g(w.preferred_username) : null),
+		firstName: g(w.given_name),
+		lastName: g(w.family_name),
+		avatarUrl: g(w.picture),
 		nameIsFirstAuthorizationOnly: !1,
-		raw: S
+		raw: w
 	};
 };
 //#endregion
-export { h as socialCompleteLogin };
+export { _ as socialCompleteLogin };

package/dist/discord.js

@@ -0,0 +1,38 @@
+import { SocialExchangeError as e } from "./errors.js";
+//#region src/discord.ts
+var t = async (t, n) => {
+	if (!t) throw new e("malformed_token_response", "discord: missing access token");
+	let r;
+	try {
+		r = await (n.fetchImpl ?? fetch)(`${n.apiBase}/users/@me`, {
+			headers: {
+				authorization: `Bearer ${t}`,
+				accept: "application/json"
+			},
+			redirect: "error"
+		});
+	} catch {
+		throw new e("exchange_failed", "discord: identity request failed");
+	}
+	if (!r.ok) throw new e("exchange_failed", `discord: identity request refused (${r.status})`);
+	let i;
+	try {
+		i = await r.json();
+	} catch {
+		throw new e("malformed_token_response", "discord: identity response is not JSON");
+	}
+	if (typeof i != "object" || !i || Array.isArray(i)) throw new e("malformed_token_response", "discord: malformed identity response");
+	let a = i;
+	if (typeof a.id != "string" || !/^[0-9]{1,20}$/.test(a.id) || typeof a.username != "string" || a.username.length === 0) throw new e("malformed_token_response", "discord: identity response has no stable id/username");
+	let o = typeof a.email == "string" && a.email.length > 0 ? a.email : null;
+	return {
+		accountId: a.id,
+		login: a.username,
+		name: typeof a.global_name == "string" && a.global_name.length > 0 ? a.global_name : null,
+		avatarUrl: null,
+		email: o,
+		emailVerified: o !== null && a.verified === !0
+	};
+};
+//#endregion
+export { t as fetchDiscordIdentity };

package/dist/epic.js

@@ -0,0 +1,39 @@
+import { SocialExchangeError as e } from "./errors.js";
+//#region src/epic.ts
+var t = async (t, n) => {
+	if (!t || !n.clientId) throw new e("malformed_token_response", "epic: missing token/client binding");
+	let r;
+	try {
+		r = await (n.fetchImpl ?? fetch)(`${n.apiBase}/tokenInfo`, {
+			method: "POST",
+			headers: {
+				"content-type": "application/x-www-form-urlencoded",
+				accept: "application/json"
+			},
+			body: new URLSearchParams({ token: t }).toString(),
+			redirect: "error"
+		});
+	} catch {
+		throw new e("exchange_failed", "epic: token verification request failed");
+	}
+	if (!r.ok) throw new e("exchange_failed", `epic: token verification refused (${r.status})`);
+	let i;
+	try {
+		i = await r.json();
+	} catch {
+		throw new e("malformed_token_response", "epic: token verification response is not JSON");
+	}
+	if (typeof i != "object" || !i || Array.isArray(i)) throw new e("malformed_token_response", "epic: malformed token verification response");
+	let a = i, o = (n.now ?? Date.now)(), s = typeof a.expires_at == "string" ? Date.parse(a.expires_at) : NaN;
+	if (a.active !== !0 || a.client_id !== n.clientId || typeof a.account_id != "string" || !/^[a-f0-9]{32}$/.test(a.account_id) || typeof a.token_type != "string" || a.token_type.toLowerCase() !== "bearer" || !Number.isFinite(o) || !Number.isFinite(s) || s <= o) throw new e("exchange_failed", "epic: inactive, expired or unbound account token");
+	return {
+		accountId: a.account_id,
+		login: a.account_id,
+		name: null,
+		avatarUrl: null,
+		email: null,
+		emailVerified: !1
+	};
+};
+//#endregion
+export { t as fetchEpicIdentity };

package/dist/errors.js

@@ -19,12 +19,16 @@ var e = class extends Error {
 	}
 }, i = class extends e {
 	constructor(e) {
-		super(500, "config", e), this.name = "SocialConfigError";
+		super(401, "ticket_rejected", e), this.name = "PlatformTicketError";
 	}
 }, a = class extends e {
+	constructor(e) {
+		super(500, "config", e), this.name = "SocialConfigError";
+	}
+}, o = class extends e {
 	constructor(e, t, n = 409) {
 		super(n, e, t), this.name = "SocialAccountLinkError";
 	}
 };
 //#endregion
-export { a as SocialAccountLinkError, e as SocialAuthError, i as SocialConfigError, n as SocialExchangeError, r as SocialIdTokenError, t as SocialStateMismatchError };
+export { i as PlatformTicketError, o as SocialAccountLinkError, e as SocialAuthError, a as SocialConfigError, n as SocialExchangeError, r as SocialIdTokenError, t as SocialStateMismatchError };

package/dist/github.js

@@ -6,14 +6,17 @@ var t = (e) => ({
 	"x-github-api-version": "2022-11-28",
 	"user-agent": "voltro-plugin-auth-social"
 }), n = async (n, r) => {
-	let i = r.fetchImpl ?? fetch, a = await i(`${r.apiBase}/user`, { headers: t(n) });
-	if (!a.ok) {
-		let t = await a.text().catch(() => "");
-		throw new e("exchange_failed", `github: GET /user failed (${a.status}): ${t.slice(0, 200)}`);
-	}
+	let i = r.fetchImpl ?? fetch, a = await i(`${r.apiBase}/user`, {
+		headers: t(n),
+		redirect: "error"
+	});
+	if (!a.ok) throw new e("exchange_failed", `github: GET /user failed (${a.status})`);
 	let o = await a.json();
 	if (o.id === void 0 || o.id === null || !o.login) throw new e("malformed_token_response", "github: GET /user response is missing id/login");
-	let s = null, c = !1, l = await i(`${r.apiBase}/user/emails`, { headers: t(n) });
+	let s = null, c = !1, l = await i(`${r.apiBase}/user/emails`, {
+		headers: t(n),
+		redirect: "error"
+	});
 	if (l.ok) {
 		let e = await l.json();
 		if (Array.isArray(e)) {

package/dist/guestHandoff.js

@@ -0,0 +1,61 @@
+import { SocialConfigError as e } from "./errors.js";
+import { isSocialProviderId as t } from "./providers.js";
+import { signAuthClaims as n, verifyAuthClaims as r } from "@voltro/plugin-auth";
+//#region src/guestHandoff.ts
+var i = (t, r) => {
+	let i = t.profile, a = n({
+		exp: t.exp,
+		audience: t.audience,
+		guest: t.guest,
+		profile: {
+			provider: i.provider,
+			providerAccountId: i.providerAccountId,
+			email: i.email,
+			emailVerified: i.emailVerified,
+			emailIsPrivateRelay: i.emailIsPrivateRelay,
+			firstName: i.firstName,
+			lastName: i.lastName,
+			nameIsFirstAuthorizationOnly: i.nameIsFirstAuthorizationOnly
+		}
+	}, r.current.secret, "social-upgrade");
+	if (a.length > 3400) throw new e("Guest upgrade handoff exceeds its cookie budget");
+	return a;
+}, a = (e) => typeof e == "object" && e && !Array.isArray(e) ? e : null, o = (e) => {
+	let t = a(e), n = a(t?.metadata);
+	return t?.type !== "user" || t.kind !== "guest" || typeof t.id != "string" || !/^guest_[A-Za-z0-9_-]+$/.test(t.id) || typeof t.tenantId != "string" || !t.tenantId.trim() || typeof n?.sessionId != "string" || !n.sessionId || typeof n.guestDeviceId != "string" || !/^gdev_[A-Za-z0-9_-]+$/.test(n.guestDeviceId) || typeof n.guestDeviceGeneration != "number" || !Number.isSafeInteger(n.guestDeviceGeneration) || n.guestDeviceGeneration < 0 ? null : {
+		type: "user",
+		kind: "guest",
+		id: t.id,
+		tenantId: t.tenantId,
+		metadata: {
+			sessionId: n.sessionId,
+			guestDeviceId: n.guestDeviceId,
+			guestDeviceGeneration: n.guestDeviceGeneration
+		}
+	};
+}, s = (e, n, i) => {
+	if (!e || e.length > 3400) return null;
+	let s = [n.current, n.previous].filter((e) => e !== void 0).map((t) => r(e, t.secret, "social-upgrade")).find((e) => e !== null);
+	if (!s || s.audience !== i || typeof s.exp != "number") return null;
+	let c = o(s.guest), l = a(s.profile), u = (e) => e === null || typeof e == "string";
+	return !c || !l || typeof l.provider != "string" || !t(l.provider) || typeof l.providerAccountId != "string" || !l.providerAccountId || !u(l.email) || !u(l.firstName) || !u(l.lastName) || typeof l.emailVerified != "boolean" || typeof l.emailIsPrivateRelay != "boolean" || typeof l.nameIsFirstAuthorizationOnly != "boolean" ? null : {
+		guest: c,
+		exp: s.exp,
+		audience: i,
+		profile: {
+			provider: l.provider,
+			providerAccountId: l.providerAccountId,
+			email: l.email,
+			emailVerified: l.emailVerified,
+			emailIsPrivateRelay: l.emailIsPrivateRelay,
+			firstName: l.firstName,
+			lastName: l.lastName,
+			nameIsFirstAuthorizationOnly: l.nameIsFirstAuthorizationOnly,
+			name: null,
+			avatarUrl: null,
+			raw: {}
+		}
+	};
+};
+//#endregion
+export { s as decodeGuestUpgradeHandoff, i as encodeGuestUpgradeHandoff, o as guestIdentityOf };

package/dist/guestUpgrade.js

@@ -0,0 +1,97 @@
+import { SOCIAL_IDENTITY_TABLE as e, dataStoreSocialIdentityStore as t } from "./identityStore.js";
+import { Effect as n } from "effect";
+import { and as r, eq as i } from "@voltro/database";
+import { GuestAuthError as a, dataStoreGuestAuth as o, dataStoreSessionRegistry as s, issueUserSession as c, runSubjectGuards as l } from "@voltro/plugin-auth";
+//#region src/guestUpgrade.ts
+var u = (e, t, n) => ({
+	table: e,
+	predicate: i(t, n),
+	order: [],
+	take: void 0,
+	skip: void 0,
+	projection: void 0
+}), d = (d) => {
+	if (d.config.defaultTenantId !== d.guest.tenantId || d.config.ensureActor !== void 0 && d.configForTransaction === void 0) return n.succeed({
+		kind: "refused",
+		status: 500,
+		code: "config",
+		message: "Guest upgrade requires a matching tenant and transaction-bound actor hooks."
+	});
+	let f = d.profile, p = f.email === null || f.email.length === 0 ? null : f.email;
+	return (d.service ?? o(d.store, d.guest)).upgrade(d.credential, async (o) => {
+		let m = o.store, h = t(m);
+		if (await n.runPromise(h.findByProviderAccount(f.provider, f.providerAccountId)) !== null || p !== null && (await m.query(u("users", "email", p))).length !== 0) throw new a({ code: "upgrade_conflict" });
+		let g = {
+			id: o.subjectId,
+			tenantId: o.tenantId,
+			email: p,
+			passwordHash: null,
+			createdAt: o.createdAt,
+			mfaSecret: null,
+			mfaEnrolledAt: null,
+			emailVerifiedAt: p !== null && f.emailVerified ? /* @__PURE__ */ new Date() : null
+		}, _ = d.configForTransaction?.(m) ?? d.config;
+		if (_.defaultTenantId !== o.tenantId || !(await n.runPromise(l(_.subjectGuards ?? [], g))).ok) throw new a({ code: "credential_rejected" });
+		if (await m.insert("users", {
+			...g,
+			updatedAt: /* @__PURE__ */ new Date()
+		}), !await n.runPromise(h.insert({
+			userId: g.id,
+			provider: f.provider,
+			providerAccountId: f.providerAccountId,
+			email: p,
+			emailVerified: p !== null && f.emailVerified
+		}).pipe(n.as(!0), n.catchTag("SocialIdentityConflict", () => n.succeed(!1))))) throw new a({ code: "upgrade_conflict" });
+		let v = {
+			...d.users,
+			...s(m),
+			listMemberships: (e) => n.promise(async () => (await m.query({
+				...u("memberships", "userId", e),
+				predicate: r(i("userId", e), i("tenantId", o.tenantId))
+			})).map((t) => {
+				if (t.userId !== e || t.tenantId !== o.tenantId || typeof t.role != "string") throw new a({ code: "store_unavailable" });
+				let n = t.joinedAt instanceof Date ? t.joinedAt : new Date(String(t.joinedAt));
+				if (!Number.isFinite(n.getTime())) throw new a({ code: "store_unavailable" });
+				return {
+					userId: e,
+					tenantId: o.tenantId,
+					role: t.role,
+					joinedAt: n
+				};
+			}))
+		}, y = await n.runPromise(c(g, v, _, {
+			clearLoginFailures: !1,
+			ipAddress: d.ipAddress ?? null,
+			userAgent: d.userAgent ?? null
+		})), b = y.subject.type === "user" ? y.subject.metadata?.sessionId : null;
+		if (typeof b != "string" || (await m.query(u("sessions", "id", b))).length !== 1) throw new a({ code: "store_unavailable" });
+		let x = (await m.query({
+			...u(e, "provider", f.provider),
+			predicate: r(i("provider", f.provider), i("providerAccountId", f.providerAccountId))
+		}))[0];
+		if (!x || x.provider !== f.provider || x.providerAccountId !== f.providerAccountId || x.userId !== g.id) throw new a({ code: "upgrade_conflict" });
+		return {
+			kind: "ok",
+			userId: g.id,
+			subject: y.subject,
+			setCookie: y.setCookie,
+			session: {
+				value: y.value,
+				expiresAt: y.expiresAt
+			},
+			created: !0,
+			linked: !0,
+			oneTimeName: f.nameIsFirstAuthorizationOnly ? {
+				firstName: f.firstName,
+				lastName: f.lastName
+			} : null
+		};
+	}).pipe(n.catch((e) => n.succeed({
+		kind: "refused",
+		status: e.code === "upgrade_conflict" ? 409 : e.code === "credential_rejected" ? 403 : 503,
+		code: e.code === "upgrade_conflict" ? "account_merge_required" : e.code,
+		message: e.code === "upgrade_conflict" ? "The provider or email belongs to an existing account. Confirm both accounts before merging." : e.code === "credential_rejected" ? "Guest upgrade was refused." : "Guest upgrade storage is unavailable."
+	})));
+};
+//#endregion
+export { d as completeGuestSocialUpgrade };