@yielded/auth 0.1.0-beta.1

package/dist/identity/operations.mjs

@@ -0,0 +1,124 @@
+import { SubjectId } from "../Schema.mjs";
+import { CredentialId, CredentialSummary, IdentifierBinding, IdentityConflict, IdentityUnavailable, LastSignInMethod, LoginIdentifier, SubjectInactive, SubjectSnapshot } from "./models.mjs";
+import { makeOperation } from "../operations/operation.mjs";
+import { requireAssurance, requireAuthenticated } from "../operations/context.mjs";
+import { IdentityMutation } from "./IdentityMutation.mjs";
+import { IdentityRepository } from "./IdentityRepository.mjs";
+import { InvalidationUnsupported, SubjectCleanupResult, SubjectLifecycle } from "./SubjectLifecycle.mjs";
+import { Effect, Layer, Option, Schema } from "effect";
+//#region src/identity/operations.ts
+const activeSubject = Effect.fn("IdentityOperations.activeSubject")(function* (subjectId) {
+	const subject = yield* (yield* IdentityRepository).findSubject(subjectId);
+	if (Option.isNone(subject) || subject.value.status !== "active") return yield* SubjectInactive.make();
+	return subject.value;
+});
+const InspectIdentity = makeOperation("identity.inspect", {
+	payload: Schema.Void,
+	success: SubjectSnapshot,
+	error: Schema.Union([SubjectInactive, IdentityUnavailable]),
+	access: "authenticated",
+	exposure: "public",
+	replay: "read-only"
+});
+const ListIdentifiers = makeOperation("identity.listIdentifiers", {
+	payload: Schema.Void,
+	success: Schema.Array(IdentifierBinding),
+	error: Schema.Union([SubjectInactive, IdentityUnavailable]),
+	access: "authenticated",
+	exposure: "public",
+	replay: "read-only"
+});
+const ListCredentials = makeOperation("identity.listCredentials", {
+	payload: Schema.Void,
+	success: Schema.Array(CredentialSummary),
+	error: Schema.Union([SubjectInactive, IdentityUnavailable]),
+	access: "authenticated",
+	exposure: "public",
+	replay: "read-only"
+});
+const identityQueryLayer = Layer.mergeAll(InspectIdentity.handlerLayer(Effect.fn("IdentityOperations.inspect")(function* (_, context) {
+	const caller = yield* requireAuthenticated(context);
+	return yield* activeSubject(caller.subjectId);
+})), ListIdentifiers.handlerLayer(Effect.fn("IdentityOperations.listIdentifiers")(function* (_, context) {
+	const caller = yield* requireAuthenticated(context);
+	const repository = yield* IdentityRepository;
+	yield* activeSubject(caller.subjectId);
+	return yield* repository.listIdentifiers(caller.subjectId);
+})), ListCredentials.handlerLayer(Effect.fn("IdentityOperations.listCredentials")(function* (_, context) {
+	const caller = yield* requireAuthenticated(context);
+	const repository = yield* IdentityRepository;
+	yield* activeSubject(caller.subjectId);
+	return yield* repository.listCredentials(caller.subjectId);
+})));
+/** Configure the method/factor policy at the consumer's Layer composition boundary. */
+const makeIdentityChanges = (assurance) => {
+	const RemoveIdentifier = makeOperation("identity.removeIdentifier", {
+		payload: Schema.Struct({ identifier: LoginIdentifier }),
+		success: Schema.Void,
+		error: Schema.Union([
+			IdentityConflict,
+			LastSignInMethod,
+			SubjectInactive,
+			IdentityUnavailable
+		]),
+		access: "authenticated",
+		exposure: "public",
+		replay: "non-idempotent",
+		authorize: (_, context) => requireAssurance(context, assurance).pipe(Effect.asVoid)
+	});
+	const RemoveCredential = makeOperation("identity.removeCredential", {
+		payload: Schema.Struct({ credentialId: CredentialId }),
+		success: Schema.Void,
+		error: Schema.Union([
+			IdentityConflict,
+			LastSignInMethod,
+			SubjectInactive,
+			IdentityUnavailable
+		]),
+		access: "authenticated",
+		exposure: "public",
+		replay: "non-idempotent",
+		authorize: (_, context) => requireAssurance(context, assurance).pipe(Effect.asVoid)
+	});
+	return {
+		RemoveIdentifier,
+		RemoveCredential,
+		layer: Layer.mergeAll(RemoveIdentifier.handlerLayer(Effect.fn("IdentityOperations.removeIdentifier")(function* (payload, context) {
+			const caller = yield* requireAuthenticated(context);
+			yield* (yield* IdentityMutation).removeIdentifier(caller.subjectId, payload.identifier);
+		})), RemoveCredential.handlerLayer(Effect.fn("IdentityOperations.removeCredential")(function* (payload, context) {
+			const caller = yield* requireAuthenticated(context);
+			yield* (yield* IdentityMutation).removeCredential(caller.subjectId, payload.credentialId);
+		})))
+	};
+};
+const terminationPayload = Schema.Struct({
+	subjectId: SubjectId,
+	requestId: Schema.NonEmptyString,
+	invalidation: Schema.Literals(["immediate", "allow-expiry"])
+});
+/** System operations have contracts without being implicitly network-exposed. */
+const DisableSubject = makeOperation("identity.disableSubject", {
+	payload: terminationPayload,
+	success: SubjectCleanupResult,
+	error: Schema.Union([InvalidationUnsupported, IdentityUnavailable]),
+	access: "system",
+	replay: "idempotent"
+});
+const DeleteSubject = makeOperation("identity.deleteSubject", {
+	payload: terminationPayload,
+	success: SubjectCleanupResult,
+	error: Schema.Union([InvalidationUnsupported, IdentityUnavailable]),
+	access: "system",
+	replay: "idempotent"
+});
+/** Install only when the application supports account termination. */
+const subjectLifecycleLayer = Layer.mergeAll(DisableSubject.handlerLayer(Effect.fn("IdentityOperations.disableSubject")(function* (payload) {
+	return yield* (yield* SubjectLifecycle).disable(payload);
+})), DeleteSubject.handlerLayer(Effect.fn("IdentityOperations.deleteSubject")(function* (payload) {
+	return yield* (yield* SubjectLifecycle).delete(payload);
+})));
+//#endregion
+export { DeleteSubject, DisableSubject, InspectIdentity, ListCredentials, ListIdentifiers, identityQueryLayer, makeIdentityChanges, subjectLifecycleLayer };
+
+//# sourceMappingURL=operations.mjs.map

package/dist/identity/operations.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"operations.mjs","names":[],"sources":["../../src/identity/operations.ts"],"sourcesContent":["import { Effect, Layer, Option, Schema } from \"effect\";\n\nimport {\n  type AssuranceRequirement,\n  requireAssurance,\n  requireAuthenticated,\n} from \"../operations/context\";\nimport { makeOperation } from \"../operations/operation\";\nimport { SubjectId } from \"../Schema\";\nimport { IdentityMutation } from \"./IdentityMutation\";\nimport { IdentityRepository } from \"./IdentityRepository\";\nimport {\n  CredentialId,\n  CredentialSummary,\n  IdentifierBinding,\n  IdentityConflict,\n  IdentityUnavailable,\n  LastSignInMethod,\n  LoginIdentifier,\n  SubjectInactive,\n  SubjectSnapshot,\n} from \"./models\";\nimport {\n  InvalidationUnsupported,\n  SubjectCleanupResult,\n  SubjectLifecycle,\n} from \"./SubjectLifecycle\";\n\nconst activeSubject = Effect.fn(\"IdentityOperations.activeSubject\")(function* (\n  subjectId: SubjectId,\n) {\n  const repository = yield* IdentityRepository;\n  const subject = yield* repository.findSubject(subjectId);\n\n  if (Option.isNone(subject) || subject.value.status !== \"active\") {\n    return yield* SubjectInactive.make();\n  }\n\n  return subject.value;\n});\n\nexport const InspectIdentity = makeOperation(\"identity.inspect\", {\n  payload: Schema.Void,\n  success: SubjectSnapshot,\n  error: Schema.Union([SubjectInactive, IdentityUnavailable]),\n  access: \"authenticated\",\n  exposure: \"public\",\n  replay: \"read-only\",\n});\n\nexport const ListIdentifiers = makeOperation(\"identity.listIdentifiers\", {\n  payload: Schema.Void,\n  success: Schema.Array(IdentifierBinding),\n  error: Schema.Union([SubjectInactive, IdentityUnavailable]),\n  access: \"authenticated\",\n  exposure: \"public\",\n  replay: \"read-only\",\n});\n\nexport const ListCredentials = makeOperation(\"identity.listCredentials\", {\n  payload: Schema.Void,\n  success: Schema.Array(CredentialSummary),\n  error: Schema.Union([SubjectInactive, IdentityUnavailable]),\n  access: \"authenticated\",\n  exposure: \"public\",\n  replay: \"read-only\",\n});\n\nexport const identityQueryLayer = Layer.mergeAll(\n  InspectIdentity.handlerLayer(\n    Effect.fn(\"IdentityOperations.inspect\")(function* (_, context) {\n      const caller = yield* requireAuthenticated(context);\n\n      return yield* activeSubject(caller.subjectId);\n    }),\n  ),\n  ListIdentifiers.handlerLayer(\n    Effect.fn(\"IdentityOperations.listIdentifiers\")(function* (_, context) {\n      const caller = yield* requireAuthenticated(context);\n      const repository = yield* IdentityRepository;\n\n      yield* activeSubject(caller.subjectId);\n\n      return yield* repository.listIdentifiers(caller.subjectId);\n    }),\n  ),\n  ListCredentials.handlerLayer(\n    Effect.fn(\"IdentityOperations.listCredentials\")(function* (_, context) {\n      const caller = yield* requireAuthenticated(context);\n      const repository = yield* IdentityRepository;\n\n      yield* activeSubject(caller.subjectId);\n\n      return yield* repository.listCredentials(caller.subjectId);\n    }),\n  ),\n);\n\n/** Configure the method/factor policy at the consumer's Layer composition boundary. */\nexport const makeIdentityChanges = (assurance: AssuranceRequirement) => {\n  const RemoveIdentifier = makeOperation(\"identity.removeIdentifier\", {\n    payload: Schema.Struct({ identifier: LoginIdentifier }),\n    success: Schema.Void,\n    error: Schema.Union([IdentityConflict, LastSignInMethod, SubjectInactive, IdentityUnavailable]),\n    access: \"authenticated\",\n    exposure: \"public\",\n    replay: \"non-idempotent\",\n    authorize: (_, context) => requireAssurance(context, assurance).pipe(Effect.asVoid),\n  });\n\n  const RemoveCredential = makeOperation(\"identity.removeCredential\", {\n    payload: Schema.Struct({ credentialId: CredentialId }),\n    success: Schema.Void,\n    error: Schema.Union([IdentityConflict, LastSignInMethod, SubjectInactive, IdentityUnavailable]),\n    access: \"authenticated\",\n    exposure: \"public\",\n    replay: \"non-idempotent\",\n    authorize: (_, context) => requireAssurance(context, assurance).pipe(Effect.asVoid),\n  });\n\n  const layer = Layer.mergeAll(\n    RemoveIdentifier.handlerLayer(\n      Effect.fn(\"IdentityOperations.removeIdentifier\")(function* (payload, context) {\n        const caller = yield* requireAuthenticated(context);\n        const mutation = yield* IdentityMutation;\n\n        yield* mutation.removeIdentifier(caller.subjectId, payload.identifier);\n      }),\n    ),\n    RemoveCredential.handlerLayer(\n      Effect.fn(\"IdentityOperations.removeCredential\")(function* (payload, context) {\n        const caller = yield* requireAuthenticated(context);\n        const mutation = yield* IdentityMutation;\n\n        yield* mutation.removeCredential(caller.subjectId, payload.credentialId);\n      }),\n    ),\n  );\n\n  return { RemoveIdentifier, RemoveCredential, layer } as const;\n};\n\nconst terminationPayload = Schema.Struct({\n  subjectId: SubjectId,\n  requestId: Schema.NonEmptyString,\n  invalidation: Schema.Literals([\"immediate\", \"allow-expiry\"]),\n});\n\n/** System operations have contracts without being implicitly network-exposed. */\nexport const DisableSubject = makeOperation(\"identity.disableSubject\", {\n  payload: terminationPayload,\n  success: SubjectCleanupResult,\n  error: Schema.Union([InvalidationUnsupported, IdentityUnavailable]),\n  access: \"system\",\n  replay: \"idempotent\",\n});\n\nexport const DeleteSubject = makeOperation(\"identity.deleteSubject\", {\n  payload: terminationPayload,\n  success: SubjectCleanupResult,\n  error: Schema.Union([InvalidationUnsupported, IdentityUnavailable]),\n  access: \"system\",\n  replay: \"idempotent\",\n});\n\n/** Install only when the application supports account termination. */\nexport const subjectLifecycleLayer = Layer.mergeAll(\n  DisableSubject.handlerLayer(\n    Effect.fn(\"IdentityOperations.disableSubject\")(function* (payload) {\n      const lifecycle = yield* SubjectLifecycle;\n\n      return yield* lifecycle.disable(payload);\n    }),\n  ),\n  DeleteSubject.handlerLayer(\n    Effect.fn(\"IdentityOperations.deleteSubject\")(function* (payload) {\n      const lifecycle = yield* SubjectLifecycle;\n\n      return yield* lifecycle.delete(payload);\n    }),\n  ),\n);\n"],"mappings":";;;;;;;;;AA4BA,MAAM,gBAAgB,OAAO,GAAG,kCAAkC,CAAC,CAAC,WAClE,WACA;CAEA,MAAM,UAAU,QAAO,OADG,mBAAA,CACQ,YAAY,SAAS;CAEvD,IAAI,OAAO,OAAO,OAAO,KAAK,QAAQ,MAAM,WAAW,UACrD,OAAO,OAAO,gBAAgB,KAAK;CAGrC,OAAO,QAAQ;AACjB,CAAC;AAED,MAAa,kBAAkB,cAAc,oBAAoB;CAC/D,SAAS,OAAO;CAChB,SAAS;CACT,OAAO,OAAO,MAAM,CAAC,iBAAiB,mBAAmB,CAAC;CAC1D,QAAQ;CACR,UAAU;CACV,QAAQ;AACV,CAAC;AAED,MAAa,kBAAkB,cAAc,4BAA4B;CACvE,SAAS,OAAO;CAChB,SAAS,OAAO,MAAM,iBAAiB;CACvC,OAAO,OAAO,MAAM,CAAC,iBAAiB,mBAAmB,CAAC;CAC1D,QAAQ;CACR,UAAU;CACV,QAAQ;AACV,CAAC;AAED,MAAa,kBAAkB,cAAc,4BAA4B;CACvE,SAAS,OAAO;CAChB,SAAS,OAAO,MAAM,iBAAiB;CACvC,OAAO,OAAO,MAAM,CAAC,iBAAiB,mBAAmB,CAAC;CAC1D,QAAQ;CACR,UAAU;CACV,QAAQ;AACV,CAAC;AAED,MAAa,qBAAqB,MAAM,SACtC,gBAAgB,aACd,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAAW,GAAG,SAAS;CAC7D,MAAM,SAAS,OAAO,qBAAqB,OAAO;CAElD,OAAO,OAAO,cAAc,OAAO,SAAS;AAC9C,CAAC,CACH,GACA,gBAAgB,aACd,OAAO,GAAG,oCAAoC,CAAC,CAAC,WAAW,GAAG,SAAS;CACrE,MAAM,SAAS,OAAO,qBAAqB,OAAO;CAClD,MAAM,aAAa,OAAO;CAE1B,OAAO,cAAc,OAAO,SAAS;CAErC,OAAO,OAAO,WAAW,gBAAgB,OAAO,SAAS;AAC3D,CAAC,CACH,GACA,gBAAgB,aACd,OAAO,GAAG,oCAAoC,CAAC,CAAC,WAAW,GAAG,SAAS;CACrE,MAAM,SAAS,OAAO,qBAAqB,OAAO;CAClD,MAAM,aAAa,OAAO;CAE1B,OAAO,cAAc,OAAO,SAAS;CAErC,OAAO,OAAO,WAAW,gBAAgB,OAAO,SAAS;AAC3D,CAAC,CACH,CACF;;AAGA,MAAa,uBAAuB,cAAoC;CACtE,MAAM,mBAAmB,cAAc,6BAA6B;EAClE,SAAS,OAAO,OAAO,EAAE,YAAY,gBAAgB,CAAC;EACtD,SAAS,OAAO;EAChB,OAAO,OAAO,MAAM;GAAC;GAAkB;GAAkB;GAAiB;EAAmB,CAAC;EAC9F,QAAQ;EACR,UAAU;EACV,QAAQ;EACR,YAAY,GAAG,YAAY,iBAAiB,SAAS,SAAS,CAAC,CAAC,KAAK,OAAO,MAAM;CACpF,CAAC;CAED,MAAM,mBAAmB,cAAc,6BAA6B;EAClE,SAAS,OAAO,OAAO,EAAE,cAAc,aAAa,CAAC;EACrD,SAAS,OAAO;EAChB,OAAO,OAAO,MAAM;GAAC;GAAkB;GAAkB;GAAiB;EAAmB,CAAC;EAC9F,QAAQ;EACR,UAAU;EACV,QAAQ;EACR,YAAY,GAAG,YAAY,iBAAiB,SAAS,SAAS,CAAC,CAAC,KAAK,OAAO,MAAM;CACpF,CAAC;CAqBD,OAAO;EAAE;EAAkB;EAAkB,OAnB/B,MAAM,SAClB,iBAAiB,aACf,OAAO,GAAG,qCAAqC,CAAC,CAAC,WAAW,SAAS,SAAS;GAC5E,MAAM,SAAS,OAAO,qBAAqB,OAAO;GAGlD,QAAO,OAFiB,iBAAA,CAER,iBAAiB,OAAO,WAAW,QAAQ,UAAU;EACvE,CAAC,CACH,GACA,iBAAiB,aACf,OAAO,GAAG,qCAAqC,CAAC,CAAC,WAAW,SAAS,SAAS;GAC5E,MAAM,SAAS,OAAO,qBAAqB,OAAO;GAGlD,QAAO,OAFiB,iBAAA,CAER,iBAAiB,OAAO,WAAW,QAAQ,YAAY;EACzE,CAAC,CACH,CAG+C;CAAE;AACrD;AAEA,MAAM,qBAAqB,OAAO,OAAO;CACvC,WAAW;CACX,WAAW,OAAO;CAClB,cAAc,OAAO,SAAS,CAAC,aAAa,cAAc,CAAC;AAC7D,CAAC;;AAGD,MAAa,iBAAiB,cAAc,2BAA2B;CACrE,SAAS;CACT,SAAS;CACT,OAAO,OAAO,MAAM,CAAC,yBAAyB,mBAAmB,CAAC;CAClE,QAAQ;CACR,QAAQ;AACV,CAAC;AAED,MAAa,gBAAgB,cAAc,0BAA0B;CACnE,SAAS;CACT,SAAS;CACT,OAAO,OAAO,MAAM,CAAC,yBAAyB,mBAAmB,CAAC;CAClE,QAAQ;CACR,QAAQ;AACV,CAAC;;AAGD,MAAa,wBAAwB,MAAM,SACzC,eAAe,aACb,OAAO,GAAG,mCAAmC,CAAC,CAAC,WAAW,SAAS;CAGjE,OAAO,QAAO,OAFW,iBAAA,CAED,QAAQ,OAAO;AACzC,CAAC,CACH,GACA,cAAc,aACZ,OAAO,GAAG,kCAAkC,CAAC,CAAC,WAAW,SAAS;CAGhE,OAAO,QAAO,OAFW,iBAAA,CAED,OAAO,OAAO;AACxC,CAAC,CACH,CACF"}

package/dist/index.d.mts

@@ -0,0 +1,23 @@
+import * as Auth from "./Auth.mjs";
+import * as AuthContract from "./AuthContract.mjs";
+import * as Client from "./Client.mjs";
+import * as Email from "./Email.mjs";
+import * as Hooks from "./Hooks.mjs";
+import * as Identity from "./Identity.mjs";
+import * as OAuth from "./OAuth.mjs";
+import * as Operations from "./Operations.mjs";
+import * as Passkey from "./Passkey.mjs";
+import * as Password from "./Password.mjs";
+import * as PhoneOtp from "./PhoneOtp.mjs";
+import * as Proofs from "./Proofs.mjs";
+import * as Schema from "./Schema.mjs";
+import * as SessionContract from "./SessionContract.mjs";
+import * as Sessions from "./Sessions.mjs";
+import * as Totp from "./Totp.mjs";
+import * as OperationHttp from "./OperationHttp.mjs";
+import * as OperationHttpClient from "./OperationHttpClient.mjs";
+import * as OperationHttpServer from "./OperationHttpServer.mjs";
+import * as Atom from "./Atom.mjs";
+import * as PasskeyContract from "./PasskeyContract.mjs";
+import * as TotpContract from "./TotpContract.mjs";
+export { Atom, Auth, AuthContract, Client, Email, Hooks, Identity, OAuth, OperationHttp, OperationHttpClient, OperationHttpServer, Operations, Passkey, PasskeyContract, Password, PhoneOtp, Proofs, Schema, SessionContract, Sessions, Totp, TotpContract };

package/dist/index.mjs

@@ -0,0 +1,23 @@
+import * as Auth from "./Auth.mjs";
+import * as AuthContract from "./AuthContract.mjs";
+import * as Client from "./Client.mjs";
+import * as Email from "./Email.mjs";
+import * as Hooks from "./Hooks.mjs";
+import * as Identity from "./Identity.mjs";
+import * as OAuth from "./OAuth.mjs";
+import * as Operations from "./Operations.mjs";
+import * as Passkey from "./Passkey.mjs";
+import * as Password from "./Password.mjs";
+import * as PhoneOtp from "./PhoneOtp.mjs";
+import * as Proofs from "./Proofs.mjs";
+import * as Schema from "./Schema.mjs";
+import * as SessionContract from "./SessionContract.mjs";
+import * as Sessions from "./Sessions.mjs";
+import * as Totp from "./Totp.mjs";
+import * as OperationHttp from "./OperationHttp.mjs";
+import * as OperationHttpClient from "./OperationHttpClient.mjs";
+import * as OperationHttpServer from "./OperationHttpServer.mjs";
+import * as Atom from "./Atom.mjs";
+import * as PasskeyContract from "./PasskeyContract.mjs";
+import * as TotpContract from "./TotpContract.mjs";
+export { Atom, Auth, AuthContract, Client, Email, Hooks, Identity, OAuth, OperationHttp, OperationHttpClient, OperationHttpServer, Operations, Passkey, PasskeyContract, Password, PhoneOtp, Proofs, Schema, SessionContract, Sessions, Totp, TotpContract };

package/dist/internal/AuthStoreDecisions.d.mts

@@ -0,0 +1,22 @@
+import { ConsumeChallenge, ConsumeRegistration, VerifiedEmail } from "../Schema.mjs";
+import { AuthStoreError } from "../Errors.mjs";
+import { ConsumeDecision } from "../auth/ConsumeDecision.mjs";
+import { EmailOtpRejectionReason } from "../AuthStore.mjs";
+import { Context, Effect } from "effect";
+//#region src/internal/AuthStoreDecisions.d.ts
+type ChallengeConsumeDecision = {
+  readonly _tag: "accepted";
+  readonly value: VerifiedEmail;
+} | {
+  readonly _tag: "rejected";
+  readonly reason: typeof EmailOtpRejectionReason.Type;
+};
+declare const AuthStoreDecisions_base: Context.ServiceClass<AuthStoreDecisions, "effect-auth/AuthStoreDecisions", {
+  readonly consumeChallenge: (input: ConsumeChallenge) => Effect.Effect<ChallengeConsumeDecision, AuthStoreError>;
+  readonly consumeRegistration: (input: ConsumeRegistration) => Effect.Effect<ConsumeDecision<void>, AuthStoreError>;
+}>;
+/** Translate rejected decisions only after the transaction commits. */
+declare class AuthStoreDecisions extends AuthStoreDecisions_base {}
+//#endregion
+export { AuthStoreDecisions, ChallengeConsumeDecision };
+//# sourceMappingURL=AuthStoreDecisions.d.mts.map

package/dist/internal/AuthStoreDecisions.mjs

@@ -0,0 +1,8 @@
+import { Context } from "effect";
+//#region src/internal/AuthStoreDecisions.ts
+/** Translate rejected decisions only after the transaction commits. */
+var AuthStoreDecisions = class extends Context.Service()("effect-auth/AuthStoreDecisions") {};
+//#endregion
+export { AuthStoreDecisions };
+
+//# sourceMappingURL=AuthStoreDecisions.mjs.map

package/dist/internal/AuthStoreDecisions.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthStoreDecisions.mjs","names":[],"sources":["../../src/internal/AuthStoreDecisions.ts"],"sourcesContent":["import { Context, type Effect } from \"effect\";\n\nimport type { ConsumeDecision } from \"../auth/ConsumeDecision\";\nimport type { EmailOtpRejectionReason } from \"../AuthStore\";\nimport type { AuthStoreError } from \"../Errors\";\nimport type { ConsumeChallenge, ConsumeRegistration, VerifiedEmail } from \"../Schema\";\n\nexport type ChallengeConsumeDecision =\n  | { readonly _tag: \"accepted\"; readonly value: VerifiedEmail }\n  | { readonly _tag: \"rejected\"; readonly reason: typeof EmailOtpRejectionReason.Type };\n\n/** Translate rejected decisions only after the transaction commits. */\nexport class AuthStoreDecisions extends Context.Service<\n  AuthStoreDecisions,\n  {\n    readonly consumeChallenge: (\n      input: ConsumeChallenge,\n    ) => Effect.Effect<ChallengeConsumeDecision, AuthStoreError>;\n    readonly consumeRegistration: (\n      input: ConsumeRegistration,\n    ) => Effect.Effect<ConsumeDecision<void>, AuthStoreError>;\n  }\n>()(\"effect-auth/AuthStoreDecisions\") {}\n"],"mappings":";;;AAYA,IAAa,qBAAb,cAAwC,QAAQ,QAU9C,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC"}

package/dist/internal/CurrentSession.d.mts

@@ -0,0 +1,9 @@
+import { SessionClaims } from "../Schema.mjs";
+import { Context } from "effect";
+//#region src/internal/CurrentSession.d.ts
+declare const CurrentSession_base: Context.ServiceClass<CurrentSession, "effect-auth/http/CurrentSession", SessionClaims>;
+/** Authenticated session claims shared by HTTP and RPC transport middleware. */
+declare class CurrentSession extends CurrentSession_base {}
+//#endregion
+export { CurrentSession };
+//# sourceMappingURL=CurrentSession.d.mts.map

package/dist/internal/CurrentSession.mjs

@@ -0,0 +1,8 @@
+import { Context } from "effect";
+//#region src/internal/CurrentSession.ts
+/** Authenticated session claims shared by HTTP and RPC transport middleware. */
+var CurrentSession = class extends Context.Service()("effect-auth/http/CurrentSession") {};
+//#endregion
+export { CurrentSession };
+
+//# sourceMappingURL=CurrentSession.mjs.map

package/dist/internal/CurrentSession.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"CurrentSession.mjs","names":[],"sources":["../../src/internal/CurrentSession.ts"],"sourcesContent":["import { Context } from \"effect\";\n\nimport type { SessionClaims } from \"../Schema\";\n\n/** Authenticated session claims shared by HTTP and RPC transport middleware. */\nexport class CurrentSession extends Context.Service<CurrentSession, SessionClaims>()(\n  \"effect-auth/http/CurrentSession\",\n) {}\n"],"mappings":";;;AAKA,IAAa,iBAAb,cAAoC,QAAQ,QAAuC,CAAC,CAClF,iCACF,CAAC,CAAC,CAAC"}

package/dist/internal/diagnostics.mjs

@@ -0,0 +1,23 @@
+import { Cause, Context, Effect } from "effect";
+//#region src/internal/diagnostics.ts
+/** Keep Effect's content-free frames, never failure values or arbitrary annotations. */
+const reportAuthFailure = Effect.fn("AuthDiagnostics.reportFailure")(function* (stage, cause) {
+	if (cause.reasons.length === 0 || Cause.hasInterruptsOnly(cause)) return;
+	const diagnostic = Cause.fromReasons(cause.reasons.map((reason) => {
+		const error = new globalThis.Error(`Auth ${stage} failed`);
+		const safe = Cause.isDieReason(reason) ? Cause.makeDieReason(error) : Cause.isFailReason(reason) ? Cause.makeFailReason(error) : Cause.makeInterruptReason(reason.fiberId);
+		const frame = Context.getOrUndefined(Cause.reasonAnnotations(reason), Cause.StackTrace);
+		return frame === void 0 ? safe : safe.annotate(Context.make(Cause.StackTrace, frame));
+	}));
+	yield* Effect.logError("Auth boundary failed", diagnostic);
+});
+/** Report only terminal unexpected persistence reasons, preserving the original Cause. */
+const reportPersistenceFailure = (effect, isExpected) => effect.pipe(Effect.catchCause((cause) => {
+	const reasons = cause.reasons.filter((reason) => Cause.isDieReason(reason) || Cause.isFailReason(reason) && !isExpected(reason.error));
+	if (reasons.length === 0) return Effect.failCause(cause);
+	return reportAuthFailure("auth-persistence", Cause.fromReasons(reasons)).pipe(Effect.andThen(Effect.failCause(cause)));
+}));
+//#endregion
+export { reportAuthFailure, reportPersistenceFailure };
+
+//# sourceMappingURL=diagnostics.mjs.map

package/dist/internal/diagnostics.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnostics.mjs","names":[],"sources":["../../src/internal/diagnostics.ts"],"sourcesContent":["import { Cause, Context, Effect } from \"effect\";\n\ntype FailureStage =\n  | \"local\"\n  | \"rpc\"\n  | \"http\"\n  | \"success-projection\"\n  | \"error-projection\"\n  | \"private-output\"\n  | \"after-hook\"\n  | \"proof-delivery\"\n  | \"oauth-sign-in\"\n  | \"oauth-accounts\"\n  | \"oauth-exchange\"\n  | \"oauth-protocol\"\n  | \"oauth-identity\"\n  | \"oauth-connected\"\n  | \"oauth-registration\"\n  | \"session-sign-out\"\n  | \"password-screening\"\n  | \"password-hashing\"\n  | \"auth-persistence\"\n  | \"passkey-core\"\n  | \"passkey-protocol\";\n\n/** Keep Effect's content-free frames, never failure values or arbitrary annotations. */\nexport const reportAuthFailure = Effect.fn(\"AuthDiagnostics.reportFailure\")(function* <E>(\n  stage: FailureStage,\n  cause: Cause.Cause<E>,\n): Effect.fn.Return<void> {\n  if (cause.reasons.length === 0 || Cause.hasInterruptsOnly(cause)) return;\n\n  const diagnostic = Cause.fromReasons(\n    cause.reasons.map((reason) => {\n      const error = new globalThis.Error(`Auth ${stage} failed`);\n\n      const safe = Cause.isDieReason(reason)\n        ? Cause.makeDieReason(error)\n        : Cause.isFailReason(reason)\n          ? Cause.makeFailReason(error)\n          : Cause.makeInterruptReason(reason.fiberId);\n\n      // Effect.fn / span names must themselves remain free of request content.\n      const frame = Context.getOrUndefined(Cause.reasonAnnotations(reason), Cause.StackTrace);\n\n      return frame === undefined ? safe : safe.annotate(Context.make(Cause.StackTrace, frame));\n    }),\n  );\n\n  yield* Effect.logError(\"Auth boundary failed\", diagnostic);\n});\n\n/** Report only terminal unexpected persistence reasons, preserving the original Cause. */\nexport const reportPersistenceFailure = <A, E, R>(\n  effect: Effect.Effect<A, E, R>,\n  isExpected: (error: E) => boolean,\n): Effect.Effect<A, E, R> =>\n  effect.pipe(\n    Effect.catchCause((cause): Effect.Effect<never, E> => {\n      const reasons = cause.reasons.filter(\n        (reason) =>\n          Cause.isDieReason(reason) || (Cause.isFailReason(reason) && !isExpected(reason.error)),\n      );\n\n      if (reasons.length === 0) return Effect.failCause(cause);\n\n      return reportAuthFailure(\"auth-persistence\", Cause.fromReasons(reasons)).pipe(\n        Effect.andThen(Effect.failCause(cause)),\n      );\n    }),\n  );\n"],"mappings":";;;AA0BA,MAAa,oBAAoB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAC1E,OACA,OACwB;CACxB,IAAI,MAAM,QAAQ,WAAW,KAAK,MAAM,kBAAkB,KAAK,GAAG;CAElE,MAAM,aAAa,MAAM,YACvB,MAAM,QAAQ,KAAK,WAAW;EAC5B,MAAM,QAAQ,IAAI,WAAW,MAAM,QAAQ,MAAM,QAAQ;EAEzD,MAAM,OAAO,MAAM,YAAY,MAAM,IACjC,MAAM,cAAc,KAAK,IACzB,MAAM,aAAa,MAAM,IACvB,MAAM,eAAe,KAAK,IAC1B,MAAM,oBAAoB,OAAO,OAAO;EAG9C,MAAM,QAAQ,QAAQ,eAAe,MAAM,kBAAkB,MAAM,GAAG,MAAM,UAAU;EAEtF,OAAO,UAAU,KAAA,IAAY,OAAO,KAAK,SAAS,QAAQ,KAAK,MAAM,YAAY,KAAK,CAAC;CACzF,CAAC,CACH;CAEA,OAAO,OAAO,SAAS,wBAAwB,UAAU;AAC3D,CAAC;;AAGD,MAAa,4BACX,QACA,eAEA,OAAO,KACL,OAAO,YAAY,UAAmC;CACpD,MAAM,UAAU,MAAM,QAAQ,QAC3B,WACC,MAAM,YAAY,MAAM,KAAM,MAAM,aAAa,MAAM,KAAK,CAAC,WAAW,OAAO,KAAK,CACxF;CAEA,IAAI,QAAQ,WAAW,GAAG,OAAO,OAAO,UAAU,KAAK;CAEvD,OAAO,kBAAkB,oBAAoB,MAAM,YAAY,OAAO,CAAC,CAAC,CAAC,KACvE,OAAO,QAAQ,OAAO,UAAU,KAAK,CAAC,CACxC;AACF,CAAC,CACH"}

package/dist/oauth/GithubOAuthProvider.d.mts

@@ -0,0 +1,43 @@
+import { OAuthProvider } from "./OAuthProvider.mjs";
+import { Redacted } from "effect";
+//#region src/oauth/GithubOAuthProvider.d.ts
+declare const githubOAuthProviderKey: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+/**
+ * Credentials of the GitHub App whose user-to-server flow this provider
+ * drives. These are the app's *OAuth* credentials (client id and client
+ * secret) — not the private key or installation id used to mint
+ * app-as-bot installation tokens. The tokens this provider yields are GitHub
+ * App **user access tokens**: actions taken with them are attributed to the
+ * authorizing user, scoped by the app's permissions and the user's own access.
+ */
+interface GithubOAuthOptions {
+  readonly clientId: string;
+  readonly clientSecret: Redacted.Redacted<string>;
+  /**
+   * Base URL of the GitHub web host owning `/login/oauth/*` (default
+   * `https://github.com`). Override for GitHub Enterprise Server or a test
+   * stand-in.
+   */
+  readonly webBaseUrl?: string;
+  /**
+   * Base URL of the GitHub REST API (default `https://api.github.com`).
+   * Override for GitHub Enterprise Server or a test stand-in.
+   */
+  readonly apiBaseUrl?: string;
+}
+/**
+ * GitHub as an {@link OAuthProvider}. Everything here is mapping: endpoints,
+ * the standard token-response decoder (GitHub answers errors with status 200,
+ * which the standard decoder recognizes), identity normalization, and the
+ * revocation request shape.
+ *
+ * The identity preserves GitHub's stable numeric user id as
+ * `providerAccountId` (decimal string) and the login as `handle`. No scopes
+ * are requested: GitHub App user access tokens derive their permissions from
+ * the app installation, and GitHub ignores the OAuth-App-style `scope`
+ * parameter for them.
+ */
+declare const makeGithubOAuthProvider: (options: GithubOAuthOptions) => OAuthProvider;
+//#endregion
+export { GithubOAuthOptions, githubOAuthProviderKey, makeGithubOAuthProvider };
+//# sourceMappingURL=GithubOAuthProvider.d.mts.map

package/dist/oauth/GithubOAuthProvider.mjs

@@ -0,0 +1,66 @@
+import { OAuthIdentity, OAuthProviderKey } from "./schema.mjs";
+import { OAuthProviderError } from "./errors.mjs";
+import { decodeStandardTokenGrant } from "./OAuthProvider.mjs";
+import { Effect, Option, Redacted, Schema } from "effect";
+import { HttpClientRequest } from "effect/unstable/http";
+//#region src/oauth/GithubOAuthProvider.ts
+const githubOAuthProviderKey = Schema.decodeSync(OAuthProviderKey)("github");
+const GithubUser = Schema.Struct({
+	id: Schema.Natural,
+	login: Schema.NonEmptyString
+});
+const decodeGithubUser = Schema.decodeUnknownEffect(GithubUser);
+const githubApiHeaders = {
+	accept: "application/vnd.github+json",
+	"user-agent": "effect-auth-oauth",
+	"x-github-api-version": "2022-11-28"
+};
+/**
+* GitHub as an {@link OAuthProvider}. Everything here is mapping: endpoints,
+* the standard token-response decoder (GitHub answers errors with status 200,
+* which the standard decoder recognizes), identity normalization, and the
+* revocation request shape.
+*
+* The identity preserves GitHub's stable numeric user id as
+* `providerAccountId` (decimal string) and the login as `handle`. No scopes
+* are requested: GitHub App user access tokens derive their permissions from
+* the app installation, and GitHub ignores the OAuth-App-style `scope`
+* parameter for them.
+*/
+const makeGithubOAuthProvider = (options) => {
+	const webBaseUrl = options.webBaseUrl ?? "https://github.com";
+	const apiBaseUrl = options.apiBaseUrl ?? "https://api.github.com";
+	return {
+		key: githubOAuthProviderKey,
+		displayName: "GitHub",
+		clientId: options.clientId,
+		clientSecret: options.clientSecret,
+		endpoints: {
+			authorization: `${webBaseUrl}/login/oauth/authorize`,
+			token: `${webBaseUrl}/login/oauth/access_token`
+		},
+		scopes: [],
+		authorizationParams: {},
+		decodeTokenGrant: decodeStandardTokenGrant(githubOAuthProviderKey),
+		identity: {
+			url: `${apiBaseUrl}/user`,
+			headers: githubApiHeaders,
+			decode: (payload) => decodeGithubUser(payload).pipe(Effect.mapBoth({
+				onSuccess: (user) => OAuthIdentity.make({
+					provider: githubOAuthProviderKey,
+					providerAccountId: String(user.id),
+					handle: Option.some(user.login)
+				}),
+				onFailure: () => OAuthProviderError.make({
+					provider: githubOAuthProviderKey,
+					message: "GitHub returned an unrecognized user identity"
+				})
+			}))
+		},
+		revocation: Option.some((accessToken) => HttpClientRequest.delete(`${apiBaseUrl}/applications/${encodeURIComponent(options.clientId)}/token`).pipe(HttpClientRequest.setHeaders(githubApiHeaders), HttpClientRequest.basicAuth(options.clientId, options.clientSecret), HttpClientRequest.bodyJsonUnsafe({ access_token: Redacted.value(accessToken) })))
+	};
+};
+//#endregion
+export { githubOAuthProviderKey, makeGithubOAuthProvider };
+
+//# sourceMappingURL=GithubOAuthProvider.mjs.map

package/dist/oauth/GithubOAuthProvider.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"GithubOAuthProvider.mjs","names":[],"sources":["../../src/oauth/GithubOAuthProvider.ts"],"sourcesContent":["import { Effect, Option, Redacted, Schema } from \"effect\";\nimport { HttpClientRequest } from \"effect/unstable/http\";\n\nimport { OAuthProviderError } from \"./errors\";\nimport { type OAuthProvider, decodeStandardTokenGrant } from \"./OAuthProvider\";\nimport { OAuthIdentity, OAuthProviderKey } from \"./schema\";\n\nexport const githubOAuthProviderKey = Schema.decodeSync(OAuthProviderKey)(\"github\");\n\n/**\n * Credentials of the GitHub App whose user-to-server flow this provider\n * drives. These are the app's *OAuth* credentials (client id and client\n * secret) — not the private key or installation id used to mint\n * app-as-bot installation tokens. The tokens this provider yields are GitHub\n * App **user access tokens**: actions taken with them are attributed to the\n * authorizing user, scoped by the app's permissions and the user's own access.\n */\nexport interface GithubOAuthOptions {\n  readonly clientId: string;\n  readonly clientSecret: Redacted.Redacted<string>;\n  /**\n   * Base URL of the GitHub web host owning `/login/oauth/*` (default\n   * `https://github.com`). Override for GitHub Enterprise Server or a test\n   * stand-in.\n   */\n  readonly webBaseUrl?: string;\n  /**\n   * Base URL of the GitHub REST API (default `https://api.github.com`).\n   * Override for GitHub Enterprise Server or a test stand-in.\n   */\n  readonly apiBaseUrl?: string;\n}\n\nconst GithubUser = Schema.Struct({\n  id: Schema.Natural,\n  login: Schema.NonEmptyString,\n});\n\n// oxlint-disable-next-line no-restricted-properties -- The identity payload is untrusted JSON from GitHub.\nconst decodeGithubUser = Schema.decodeUnknownEffect(GithubUser);\n\nconst githubApiHeaders = {\n  accept: \"application/vnd.github+json\",\n  \"user-agent\": \"effect-auth-oauth\",\n  \"x-github-api-version\": \"2022-11-28\",\n};\n\n/**\n * GitHub as an {@link OAuthProvider}. Everything here is mapping: endpoints,\n * the standard token-response decoder (GitHub answers errors with status 200,\n * which the standard decoder recognizes), identity normalization, and the\n * revocation request shape.\n *\n * The identity preserves GitHub's stable numeric user id as\n * `providerAccountId` (decimal string) and the login as `handle`. No scopes\n * are requested: GitHub App user access tokens derive their permissions from\n * the app installation, and GitHub ignores the OAuth-App-style `scope`\n * parameter for them.\n */\nexport const makeGithubOAuthProvider = (options: GithubOAuthOptions): OAuthProvider => {\n  const webBaseUrl = options.webBaseUrl ?? \"https://github.com\";\n  const apiBaseUrl = options.apiBaseUrl ?? \"https://api.github.com\";\n\n  return {\n    key: githubOAuthProviderKey,\n    displayName: \"GitHub\",\n    clientId: options.clientId,\n    clientSecret: options.clientSecret,\n    endpoints: {\n      authorization: `${webBaseUrl}/login/oauth/authorize`,\n      token: `${webBaseUrl}/login/oauth/access_token`,\n    },\n    scopes: [],\n    authorizationParams: {},\n    decodeTokenGrant: decodeStandardTokenGrant(githubOAuthProviderKey),\n    identity: {\n      url: `${apiBaseUrl}/user`,\n      headers: githubApiHeaders,\n      decode: (payload) =>\n        decodeGithubUser(payload).pipe(\n          Effect.mapBoth({\n            onSuccess: (user) =>\n              OAuthIdentity.make({\n                provider: githubOAuthProviderKey,\n                providerAccountId: String(user.id),\n                handle: Option.some(user.login),\n              }),\n            onFailure: () =>\n              OAuthProviderError.make({\n                provider: githubOAuthProviderKey,\n                message: \"GitHub returned an unrecognized user identity\",\n              }),\n          }),\n        ),\n    },\n    revocation: Option.some((accessToken) =>\n      HttpClientRequest.delete(\n        `${apiBaseUrl}/applications/${encodeURIComponent(options.clientId)}/token`,\n      ).pipe(\n        HttpClientRequest.setHeaders(githubApiHeaders),\n        HttpClientRequest.basicAuth(options.clientId, options.clientSecret),\n        HttpClientRequest.bodyJsonUnsafe({ access_token: Redacted.value(accessToken) }),\n      ),\n    ),\n  };\n};\n"],"mappings":";;;;;;AAOA,MAAa,yBAAyB,OAAO,WAAW,gBAAgB,CAAC,CAAC,QAAQ;AA0BlF,MAAM,aAAa,OAAO,OAAO;CAC/B,IAAI,OAAO;CACX,OAAO,OAAO;AAChB,CAAC;AAGD,MAAM,mBAAmB,OAAO,oBAAoB,UAAU;AAE9D,MAAM,mBAAmB;CACvB,QAAQ;CACR,cAAc;CACd,wBAAwB;AAC1B;;;;;;;;;;;;;AAcA,MAAa,2BAA2B,YAA+C;CACrF,MAAM,aAAa,QAAQ,cAAc;CACzC,MAAM,aAAa,QAAQ,cAAc;CAEzC,OAAO;EACL,KAAK;EACL,aAAa;EACb,UAAU,QAAQ;EAClB,cAAc,QAAQ;EACtB,WAAW;GACT,eAAe,GAAG,WAAW;GAC7B,OAAO,GAAG,WAAW;EACvB;EACA,QAAQ,CAAC;EACT,qBAAqB,CAAC;EACtB,kBAAkB,yBAAyB,sBAAsB;EACjE,UAAU;GACR,KAAK,GAAG,WAAW;GACnB,SAAS;GACT,SAAS,YACP,iBAAiB,OAAO,CAAC,CAAC,KACxB,OAAO,QAAQ;IACb,YAAY,SACV,cAAc,KAAK;KACjB,UAAU;KACV,mBAAmB,OAAO,KAAK,EAAE;KACjC,QAAQ,OAAO,KAAK,KAAK,KAAK;IAChC,CAAC;IACH,iBACE,mBAAmB,KAAK;KACtB,UAAU;KACV,SAAS;IACX,CAAC;GACL,CAAC,CACH;EACJ;EACA,YAAY,OAAO,MAAM,gBACvB,kBAAkB,OAChB,GAAG,WAAW,gBAAgB,mBAAmB,QAAQ,QAAQ,EAAE,OACrE,CAAC,CAAC,KACA,kBAAkB,WAAW,gBAAgB,GAC7C,kBAAkB,UAAU,QAAQ,UAAU,QAAQ,YAAY,GAClE,kBAAkB,eAAe,EAAE,cAAc,SAAS,MAAM,WAAW,EAAE,CAAC,CAChF,CACF;CACF;AACF"}

package/dist/oauth/OAuth.d.mts

@@ -0,0 +1,73 @@
+import { SubjectId } from "../Schema.mjs";
+import { AuthStoreError, AuthTokenError } from "../Errors.mjs";
+import { AuthTokenCodec } from "../AuthTokenCodec.mjs";
+import { InvalidOAuthState, OAuthAccessDenied, OAuthConnectionNotFound, OAuthProviderError, OAuthReauthorizationRequired, UnknownOAuthProvider } from "./errors.mjs";
+import { OAuthAuthorization, OAuthConnection, OAuthProviderKey } from "./schema.mjs";
+import { OAuthStateStore } from "./OAuthStateStore.mjs";
+import { OAuthConnectionStore } from "./OAuthConnectionStore.mjs";
+import { OAuthProviders } from "./OAuthProviders.mjs";
+import { Context, Crypto, Effect, Layer, Option, Redacted } from "effect";
+import { HttpClient } from "effect/unstable/http";
+//#region src/oauth/OAuth.d.ts
+interface BeginOAuthInput {
+  readonly provider: OAuthProviderKey;
+  /** The application subject initiating the link; the state is bound to it. */
+  readonly subjectId: SubjectId;
+  /** The callback URL registered with the provider for this application. */
+  readonly redirectUri: string;
+}
+interface CompleteOAuthInput {
+  readonly provider: OAuthProviderKey;
+  /** The subject of the *current* session; must match the one that began the flow. */
+  readonly subjectId: SubjectId;
+  /** Must equal the redirect URI the flow began with. */
+  readonly redirectUri: string;
+  /** The raw callback query parameters, validated internally. */
+  readonly params: unknown;
+}
+type CompleteOAuthError = UnknownOAuthProvider | InvalidOAuthState | OAuthAccessDenied | OAuthProviderError | AuthStoreError | AuthTokenError;
+declare const OAuth_base: Context.ServiceClass<OAuth, "effect-auth/OAuth", {
+  /**
+   * Issues a single-use, expiring `state` bound to the subject and redirect
+   * URI, and returns the provider authorization URL to redirect the actor
+   * to.
+   */
+  readonly begin: (input: BeginOAuthInput) => Effect.Effect<OAuthAuthorization, UnknownOAuthProvider | AuthStoreError | AuthTokenError>;
+  /**
+   * Validates the callback, consumes the state (single use, whatever the
+   * outcome), exchanges the code, fetches and validates the provider
+   * identity, and persists the connection — replacing any previous
+   * connection for the same subject and provider.
+   */
+  readonly complete: (input: CompleteOAuthInput) => Effect.Effect<OAuthConnection, CompleteOAuthError>;
+  /** The subject's current connection, if any. Token fields stay `Redacted`. */
+  readonly connection: (provider: OAuthProviderKey, subjectId: SubjectId) => Effect.Effect<Option.Option<OAuthConnection>, AuthStoreError>;
+  /**
+   * A currently valid access token for the subject, refreshing (and
+   * persisting) it first when it is at or past the refresh margin. Fails
+   * with `OAuthReauthorizationRequired` when no live refresh path exists or
+   * the provider rejects the refresh grant.
+   */
+  readonly accessToken: (provider: OAuthProviderKey, subjectId: SubjectId) => Effect.Effect<Redacted.Redacted<string>, UnknownOAuthProvider | OAuthConnectionNotFound | OAuthReauthorizationRequired | OAuthProviderError | AuthStoreError>;
+  /**
+   * Revokes the provider grant (when the provider supports revocation) and
+   * removes the stored connection. Idempotent: succeeds when no connection
+   * exists. A failed revocation keeps the connection so the caller can
+   * retry.
+   */
+  readonly disconnect: (provider: OAuthProviderKey, subjectId: SubjectId) => Effect.Effect<void, UnknownOAuthProvider | OAuthProviderError | AuthStoreError>;
+}>;
+/**
+ * Provider-independent OAuth 2.0 authorization-code workflow for linking
+ * provider accounts to application subjects. Providers contribute endpoints
+ * and response mappings through `OAuthProviders`; every security-relevant
+ * step — state issuance and single-use validation, subject and redirect-URI
+ * binding, code exchange, token refresh, revocation — lives here so it cannot
+ * vary per provider.
+ */
+declare class OAuth extends OAuth_base {
+  static readonly layer: Layer.Layer<OAuth, never, OAuthProviders | OAuthStateStore | OAuthConnectionStore | AuthTokenCodec | Crypto.Crypto | HttpClient.HttpClient>;
+}
+//#endregion
+export { BeginOAuthInput, CompleteOAuthError, CompleteOAuthInput, OAuth };
+//# sourceMappingURL=OAuth.d.mts.map