@yielded/auth 0.1.0-beta.1

package/dist/oauth/OAuth.mjs

@@ -0,0 +1,180 @@
+import { AuthTokenError } from "../Errors.mjs";
+import { OAuthAuthorization, OAuthCallbackParams, OAuthConnection, OAuthState, OAuthTokens } from "./schema.mjs";
+import { InvalidOAuthState, OAuthAccessDenied, OAuthConnectionNotFound, OAuthProviderError, OAuthReauthorizationRequired } from "./errors.mjs";
+import { OAuthStateStore } from "./OAuthStateStore.mjs";
+import { AuthTokenCodec } from "../AuthTokenCodec.mjs";
+import { OAuthConnectionStore } from "./OAuthConnectionStore.mjs";
+import { OAuthProviders } from "./OAuthProviders.mjs";
+import { OAuthPolicy } from "./policy.mjs";
+import { Context, Crypto, DateTime, Duration, Effect, Encoding, Layer, Option, Redacted, Schema } from "effect";
+import { HttpClient, HttpClientRequest, HttpClientResponse } from "effect/unstable/http";
+//#region src/oauth/OAuth.ts
+const stateTokenScope = "effect-auth/oauth-state-token";
+const decodeCallbackParams = Schema.decodeUnknownEffect(OAuthCallbackParams);
+/**
+* Provider-independent OAuth 2.0 authorization-code workflow for linking
+* provider accounts to application subjects. Providers contribute endpoints
+* and response mappings through `OAuthProviders`; every security-relevant
+* step — state issuance and single-use validation, subject and redirect-URI
+* binding, code exchange, token refresh, revocation — lives here so it cannot
+* vary per provider.
+*/
+var OAuth = class OAuth extends Context.Service()("effect-auth/OAuth") {
+	static layer = Layer.effect(OAuth)(Effect.gen(function* () {
+		const policy = yield* OAuthPolicy;
+		const providers = yield* OAuthProviders;
+		const states = yield* OAuthStateStore;
+		const connections = yield* OAuthConnectionStore;
+		const codec = yield* AuthTokenCodec;
+		const crypto = yield* Crypto.Crypto;
+		const client = yield* HttpClient.HttpClient;
+		const randomStateToken = crypto.randomBytes(32).pipe(Effect.map(Encoding.encodeBase64Url), Effect.mapError(() => AuthTokenError.make({ message: "Secure randomness unavailable" })));
+		const unavailable = (provider, endpoint) => OAuthProviderError.make({
+			provider,
+			message: `The provider's ${endpoint} could not be reached`
+		});
+		/**
+		* One token-endpoint call. Providers such as GitHub answer errors with
+		* status 200 and RFC-compliant providers answer them with status 400,
+		* so the payload — not the status — decides the outcome.
+		*/
+		const requestTokenGrant = Effect.fn("OAuth.requestTokenGrant")(function* (provider, grantParams) {
+			const request = HttpClientRequest.post(provider.endpoints.token).pipe(HttpClientRequest.acceptJson, HttpClientRequest.bodyUrlParams({
+				...grantParams,
+				client_id: provider.clientId,
+				client_secret: Redacted.value(provider.clientSecret)
+			}));
+			const payload = yield* (yield* client.execute(request).pipe(Effect.mapError(() => unavailable(provider.key, "token endpoint")))).json.pipe(Effect.mapError(() => OAuthProviderError.make({
+				provider: provider.key,
+				message: "The token endpoint returned a non-JSON response"
+			})));
+			return yield* provider.decodeTokenGrant(payload);
+		});
+		const fetchIdentity = Effect.fn("OAuth.fetchIdentity")(function* (provider, accessToken) {
+			const request = HttpClientRequest.get(provider.identity.url).pipe(HttpClientRequest.acceptJson, HttpClientRequest.setHeaders(provider.identity.headers), HttpClientRequest.bearerToken(accessToken));
+			const payload = yield* (yield* client.execute(request).pipe(Effect.flatMap(HttpClientResponse.filterStatusOk), Effect.mapError(() => unavailable(provider.key, "identity endpoint")))).json.pipe(Effect.mapError(() => OAuthProviderError.make({
+				provider: provider.key,
+				message: "The identity endpoint returned a non-JSON response"
+			})));
+			return yield* provider.identity.decode(payload);
+		});
+		const tokensFromGrant = (grant, now) => OAuthTokens.make({
+			accessToken: grant.accessToken,
+			tokenType: grant.tokenType,
+			accessTokenExpiresAt: Option.map(grant.expiresIn, (lifetime) => DateTime.addDuration(now, lifetime)),
+			refreshToken: grant.refreshToken,
+			refreshTokenExpiresAt: Option.map(grant.refreshTokenExpiresIn, (lifetime) => DateTime.addDuration(now, lifetime)),
+			scope: grant.scope
+		});
+		return OAuth.of({
+			begin: Effect.fn("OAuth.begin")(function* (input) {
+				const provider = yield* providers.lookup(input.provider);
+				const stateToken = yield* randomStateToken;
+				const stateDigest = yield* codec.digestToken(Redacted.make(stateToken), stateTokenScope);
+				const now = yield* DateTime.now;
+				const expiresAt = DateTime.addDuration(now, policy.stateLifetime);
+				yield* states.issue(OAuthState.make({
+					stateDigest,
+					provider: provider.key,
+					subjectId: input.subjectId,
+					redirectUri: input.redirectUri,
+					issuedAt: now,
+					expiresAt
+				}));
+				const url = yield* Effect.try(() => new URL(provider.endpoints.authorization)).pipe(Effect.orDie);
+				url.searchParams.set("client_id", provider.clientId);
+				url.searchParams.set("redirect_uri", input.redirectUri);
+				url.searchParams.set("response_type", "code");
+				url.searchParams.set("state", stateToken);
+				if (provider.scopes.length > 0) url.searchParams.set("scope", provider.scopes.join(" "));
+				for (const [name, value] of Object.entries(provider.authorizationParams)) url.searchParams.set(name, value);
+				return OAuthAuthorization.make({
+					url: url.toString(),
+					expiresAt
+				});
+			}),
+			complete: Effect.fn("OAuth.complete")(function* (input) {
+				const provider = yield* providers.lookup(input.provider);
+				const params = yield* decodeCallbackParams(input.params).pipe(Effect.mapError(() => InvalidOAuthState.make()));
+				if (params.state === void 0 || params.state === "") return yield* InvalidOAuthState.make();
+				const stateDigest = yield* codec.digestToken(Redacted.make(params.state), stateTokenScope);
+				const state = yield* states.consume(stateDigest);
+				if (state.provider !== provider.key || state.subjectId !== input.subjectId || state.redirectUri !== input.redirectUri) return yield* InvalidOAuthState.make();
+				if (params.error === "access_denied") return yield* OAuthAccessDenied.make();
+				if (params.error !== void 0) return yield* OAuthProviderError.make({
+					provider: provider.key,
+					message: "The provider rejected the authorization request"
+				});
+				if (params.code === void 0 || params.code === "") return yield* InvalidOAuthState.make();
+				const grant = yield* requestTokenGrant(provider, {
+					grant_type: "authorization_code",
+					code: params.code,
+					redirect_uri: input.redirectUri
+				}).pipe(Effect.catchTag("OAuthGrantRejected", (rejection) => rejection.code === "access_denied" ? OAuthAccessDenied.make() : OAuthProviderError.make({
+					provider: provider.key,
+					message: `The provider rejected the code exchange (${rejection.code})`
+				})));
+				const identity = yield* fetchIdentity(provider, grant.accessToken);
+				const now = yield* DateTime.now;
+				const connection = OAuthConnection.make({
+					provider: provider.key,
+					subjectId: input.subjectId,
+					identity,
+					tokens: tokensFromGrant(grant, now),
+					connectedAt: now,
+					updatedAt: now
+				});
+				yield* connections.put(connection);
+				return connection;
+			}),
+			connection: (provider, subjectId) => connections.get(provider, subjectId),
+			accessToken: Effect.fn("OAuth.accessToken")(function* (providerKey, subjectId) {
+				const existing = yield* connections.get(providerKey, subjectId);
+				if (Option.isNone(existing)) return yield* OAuthConnectionNotFound.make();
+				const current = existing.value;
+				const now = yield* DateTime.now;
+				const nowMillis = DateTime.toEpochMillis(now);
+				const marginMillis = Duration.toMillis(policy.accessTokenRefreshMargin);
+				if (Option.isNone(current.tokens.accessTokenExpiresAt) || nowMillis + marginMillis < DateTime.toEpochMillis(current.tokens.accessTokenExpiresAt.value)) return current.tokens.accessToken;
+				const refreshToken = current.tokens.refreshToken;
+				const refreshTokenDead = Option.isNone(refreshToken) || Option.isSome(current.tokens.refreshTokenExpiresAt) && nowMillis >= DateTime.toEpochMillis(current.tokens.refreshTokenExpiresAt.value);
+				if (Option.isNone(refreshToken) || refreshTokenDead) return yield* OAuthReauthorizationRequired.make();
+				const provider = yield* providers.lookup(providerKey);
+				const grant = yield* requestTokenGrant(provider, {
+					grant_type: "refresh_token",
+					refresh_token: Redacted.value(refreshToken.value)
+				}).pipe(Effect.catchTag("OAuthGrantRejected", () => OAuthReauthorizationRequired.make()));
+				const rotated = tokensFromGrant(grant, now);
+				const tokens = Option.isSome(rotated.refreshToken) ? rotated : OAuthTokens.make({
+					...rotated,
+					refreshToken: current.tokens.refreshToken,
+					refreshTokenExpiresAt: current.tokens.refreshTokenExpiresAt
+				});
+				yield* connections.put(OAuthConnection.make({
+					...current,
+					tokens,
+					updatedAt: now
+				}));
+				return tokens.accessToken;
+			}),
+			disconnect: Effect.fn("OAuth.disconnect")(function* (providerKey, subjectId) {
+				const existing = yield* connections.get(providerKey, subjectId);
+				if (Option.isNone(existing)) return;
+				const provider = yield* providers.lookup(providerKey);
+				if (Option.isSome(provider.revocation)) {
+					const response = yield* client.execute(provider.revocation.value(existing.value.tokens.accessToken)).pipe(Effect.mapError(() => unavailable(provider.key, "revocation endpoint")));
+					const alreadyGone = response.status === 404 || response.status === 422;
+					if (!(response.status >= 200 && response.status < 300) && !alreadyGone) return yield* OAuthProviderError.make({
+						provider: provider.key,
+						message: "The provider refused the token revocation"
+					});
+				}
+				yield* connections.remove(providerKey, subjectId);
+			})
+		});
+	}));
+};
+//#endregion
+export { OAuth };
+
+//# sourceMappingURL=OAuth.mjs.map

package/dist/oauth/OAuth.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuth.mjs","names":[],"sources":["../../src/oauth/OAuth.ts"],"sourcesContent":["import {\n  Context,\n  Crypto,\n  DateTime,\n  Duration,\n  Effect,\n  Encoding,\n  Layer,\n  Option,\n  Redacted,\n  Schema,\n} from \"effect\";\nimport { HttpClient, HttpClientRequest, HttpClientResponse } from \"effect/unstable/http\";\n\nimport { AuthTokenCodec } from \"../AuthTokenCodec\";\nimport { type AuthStoreError, AuthTokenError } from \"../Errors\";\nimport type { SubjectId } from \"../Schema\";\nimport {\n  type OAuthGrantRejected,\n  type UnknownOAuthProvider,\n  InvalidOAuthState,\n  OAuthAccessDenied,\n  OAuthConnectionNotFound,\n  OAuthProviderError,\n  OAuthReauthorizationRequired,\n} from \"./errors\";\nimport { OAuthConnectionStore } from \"./OAuthConnectionStore\";\nimport type { OAuthProvider, OAuthTokenGrant } from \"./OAuthProvider\";\nimport { OAuthProviders } from \"./OAuthProviders\";\nimport { OAuthStateStore } from \"./OAuthStateStore\";\nimport { OAuthPolicy } from \"./policy\";\nimport {\n  type OAuthProviderKey,\n  OAuthAuthorization,\n  OAuthCallbackParams,\n  OAuthConnection,\n  OAuthState,\n  OAuthTokens,\n} from \"./schema\";\n\nconst stateTokenScope = \"effect-auth/oauth-state-token\";\n\n// oxlint-disable-next-line no-restricted-properties -- Callback query parameters are untrusted input.\nconst decodeCallbackParams = Schema.decodeUnknownEffect(OAuthCallbackParams);\n\nexport interface BeginOAuthInput {\n  readonly provider: OAuthProviderKey;\n  /** The application subject initiating the link; the state is bound to it. */\n  readonly subjectId: SubjectId;\n  /** The callback URL registered with the provider for this application. */\n  readonly redirectUri: string;\n}\n\nexport interface CompleteOAuthInput {\n  readonly provider: OAuthProviderKey;\n  /** The subject of the *current* session; must match the one that began the flow. */\n  readonly subjectId: SubjectId;\n  /** Must equal the redirect URI the flow began with. */\n  readonly redirectUri: string;\n  /** The raw callback query parameters, validated internally. */\n  readonly params: unknown;\n}\n\nexport type CompleteOAuthError =\n  | UnknownOAuthProvider\n  | InvalidOAuthState\n  | OAuthAccessDenied\n  | OAuthProviderError\n  | AuthStoreError\n  | AuthTokenError;\n\n/**\n * Provider-independent OAuth 2.0 authorization-code workflow for linking\n * provider accounts to application subjects. Providers contribute endpoints\n * and response mappings through `OAuthProviders`; every security-relevant\n * step — state issuance and single-use validation, subject and redirect-URI\n * binding, code exchange, token refresh, revocation — lives here so it cannot\n * vary per provider.\n */\nexport class OAuth extends Context.Service<\n  OAuth,\n  {\n    /**\n     * Issues a single-use, expiring `state` bound to the subject and redirect\n     * URI, and returns the provider authorization URL to redirect the actor\n     * to.\n     */\n    readonly begin: (\n      input: BeginOAuthInput,\n    ) => Effect.Effect<OAuthAuthorization, UnknownOAuthProvider | AuthStoreError | AuthTokenError>;\n    /**\n     * Validates the callback, consumes the state (single use, whatever the\n     * outcome), exchanges the code, fetches and validates the provider\n     * identity, and persists the connection — replacing any previous\n     * connection for the same subject and provider.\n     */\n    readonly complete: (\n      input: CompleteOAuthInput,\n    ) => Effect.Effect<OAuthConnection, CompleteOAuthError>;\n    /** The subject's current connection, if any. Token fields stay `Redacted`. */\n    readonly connection: (\n      provider: OAuthProviderKey,\n      subjectId: SubjectId,\n    ) => Effect.Effect<Option.Option<OAuthConnection>, AuthStoreError>;\n    /**\n     * A currently valid access token for the subject, refreshing (and\n     * persisting) it first when it is at or past the refresh margin. Fails\n     * with `OAuthReauthorizationRequired` when no live refresh path exists or\n     * the provider rejects the refresh grant.\n     */\n    readonly accessToken: (\n      provider: OAuthProviderKey,\n      subjectId: SubjectId,\n    ) => Effect.Effect<\n      Redacted.Redacted<string>,\n      | UnknownOAuthProvider\n      | OAuthConnectionNotFound\n      | OAuthReauthorizationRequired\n      | OAuthProviderError\n      | AuthStoreError\n    >;\n    /**\n     * Revokes the provider grant (when the provider supports revocation) and\n     * removes the stored connection. Idempotent: succeeds when no connection\n     * exists. A failed revocation keeps the connection so the caller can\n     * retry.\n     */\n    readonly disconnect: (\n      provider: OAuthProviderKey,\n      subjectId: SubjectId,\n    ) => Effect.Effect<void, UnknownOAuthProvider | OAuthProviderError | AuthStoreError>;\n  }\n>()(\"effect-auth/OAuth\") {\n  static readonly layer: Layer.Layer<\n    OAuth,\n    never,\n    | OAuthProviders\n    | OAuthStateStore\n    | OAuthConnectionStore\n    | AuthTokenCodec\n    | Crypto.Crypto\n    | HttpClient.HttpClient\n  > = Layer.effect(OAuth)(\n    Effect.gen(function* () {\n      const policy = yield* OAuthPolicy;\n      const providers = yield* OAuthProviders;\n      const states = yield* OAuthStateStore;\n      const connections = yield* OAuthConnectionStore;\n      const codec = yield* AuthTokenCodec;\n      const crypto = yield* Crypto.Crypto;\n      const client = yield* HttpClient.HttpClient;\n\n      const randomStateToken = crypto.randomBytes(32).pipe(\n        Effect.map(Encoding.encodeBase64Url),\n        Effect.mapError(() => AuthTokenError.make({ message: \"Secure randomness unavailable\" })),\n      );\n\n      const unavailable = (provider: OAuthProviderKey, endpoint: string) =>\n        OAuthProviderError.make({\n          provider,\n          message: `The provider's ${endpoint} could not be reached`,\n        });\n\n      /**\n       * One token-endpoint call. Providers such as GitHub answer errors with\n       * status 200 and RFC-compliant providers answer them with status 400,\n       * so the payload — not the status — decides the outcome.\n       */\n      const requestTokenGrant = Effect.fn(\"OAuth.requestTokenGrant\")(function* (\n        provider: OAuthProvider,\n        grantParams: Readonly<Record<string, string>>,\n      ): Effect.fn.Return<OAuthTokenGrant, OAuthGrantRejected | OAuthProviderError> {\n        const request = HttpClientRequest.post(provider.endpoints.token).pipe(\n          HttpClientRequest.acceptJson,\n          HttpClientRequest.bodyUrlParams({\n            ...grantParams,\n            client_id: provider.clientId,\n            client_secret: Redacted.value(provider.clientSecret),\n          }),\n        );\n\n        const response = yield* client\n          .execute(request)\n          .pipe(Effect.mapError(() => unavailable(provider.key, \"token endpoint\")));\n\n        const payload = yield* response.json.pipe(\n          Effect.mapError(() =>\n            OAuthProviderError.make({\n              provider: provider.key,\n              message: \"The token endpoint returned a non-JSON response\",\n            }),\n          ),\n        );\n\n        return yield* provider.decodeTokenGrant(payload);\n      });\n\n      const fetchIdentity = Effect.fn(\"OAuth.fetchIdentity\")(function* (\n        provider: OAuthProvider,\n        accessToken: Redacted.Redacted<string>,\n      ) {\n        const request = HttpClientRequest.get(provider.identity.url).pipe(\n          HttpClientRequest.acceptJson,\n          HttpClientRequest.setHeaders(provider.identity.headers),\n          HttpClientRequest.bearerToken(accessToken),\n        );\n\n        const response = yield* client.execute(request).pipe(\n          Effect.flatMap(HttpClientResponse.filterStatusOk),\n          Effect.mapError(() => unavailable(provider.key, \"identity endpoint\")),\n        );\n\n        const payload = yield* response.json.pipe(\n          Effect.mapError(() =>\n            OAuthProviderError.make({\n              provider: provider.key,\n              message: \"The identity endpoint returned a non-JSON response\",\n            }),\n          ),\n        );\n\n        return yield* provider.identity.decode(payload);\n      });\n\n      const tokensFromGrant = (grant: OAuthTokenGrant, now: DateTime.Utc) =>\n        OAuthTokens.make({\n          accessToken: grant.accessToken,\n          tokenType: grant.tokenType,\n          accessTokenExpiresAt: Option.map(grant.expiresIn, (lifetime) =>\n            DateTime.addDuration(now, lifetime),\n          ),\n          refreshToken: grant.refreshToken,\n          refreshTokenExpiresAt: Option.map(grant.refreshTokenExpiresIn, (lifetime) =>\n            DateTime.addDuration(now, lifetime),\n          ),\n          scope: grant.scope,\n        });\n\n      return OAuth.of({\n        begin: Effect.fn(\"OAuth.begin\")(function* (input) {\n          const provider = yield* providers.lookup(input.provider);\n          const stateToken = yield* randomStateToken;\n          const stateDigest = yield* codec.digestToken(Redacted.make(stateToken), stateTokenScope);\n          const now = yield* DateTime.now;\n          const expiresAt = DateTime.addDuration(now, policy.stateLifetime);\n\n          yield* states.issue(\n            OAuthState.make({\n              stateDigest,\n              provider: provider.key,\n              subjectId: input.subjectId,\n              redirectUri: input.redirectUri,\n              issuedAt: now,\n              expiresAt,\n            }),\n          );\n\n          // An unparseable authorization endpoint is a provider-configuration\n          // defect, not a request failure.\n          const url = yield* Effect.try(() => new URL(provider.endpoints.authorization)).pipe(\n            Effect.orDie,\n          );\n\n          url.searchParams.set(\"client_id\", provider.clientId);\n          url.searchParams.set(\"redirect_uri\", input.redirectUri);\n          url.searchParams.set(\"response_type\", \"code\");\n          url.searchParams.set(\"state\", stateToken);\n          if (provider.scopes.length > 0) {\n            url.searchParams.set(\"scope\", provider.scopes.join(\" \"));\n          }\n          for (const [name, value] of Object.entries(provider.authorizationParams)) {\n            url.searchParams.set(name, value);\n          }\n\n          return OAuthAuthorization.make({ url: url.toString(), expiresAt });\n        }),\n\n        complete: Effect.fn(\"OAuth.complete\")(function* (input) {\n          const provider = yield* providers.lookup(input.provider);\n\n          const params = yield* decodeCallbackParams(input.params).pipe(\n            Effect.mapError(() => InvalidOAuthState.make()),\n          );\n\n          if (params.state === undefined || params.state === \"\") {\n            return yield* InvalidOAuthState.make();\n          }\n\n          // The state is consumed before anything else is inspected, so every\n          // callback — including a denied or malformed one — burns it.\n          const stateDigest = yield* codec.digestToken(\n            Redacted.make(params.state),\n            stateTokenScope,\n          );\n\n          const state = yield* states.consume(stateDigest);\n\n          if (\n            state.provider !== provider.key ||\n            state.subjectId !== input.subjectId ||\n            state.redirectUri !== input.redirectUri\n          ) {\n            return yield* InvalidOAuthState.make();\n          }\n          if (params.error === \"access_denied\") {\n            return yield* OAuthAccessDenied.make();\n          }\n          if (params.error !== undefined) {\n            return yield* OAuthProviderError.make({\n              provider: provider.key,\n              message: \"The provider rejected the authorization request\",\n            });\n          }\n          if (params.code === undefined || params.code === \"\") {\n            return yield* InvalidOAuthState.make();\n          }\n\n          const grant = yield* requestTokenGrant(provider, {\n            grant_type: \"authorization_code\",\n            code: params.code,\n            redirect_uri: input.redirectUri,\n          }).pipe(\n            Effect.catchTag(\n              \"OAuthGrantRejected\",\n              (rejection): Effect.Effect<never, OAuthAccessDenied | OAuthProviderError> =>\n                rejection.code === \"access_denied\"\n                  ? OAuthAccessDenied.make()\n                  : OAuthProviderError.make({\n                      provider: provider.key,\n                      message: `The provider rejected the code exchange (${rejection.code})`,\n                    }),\n            ),\n          );\n\n          const identity = yield* fetchIdentity(provider, grant.accessToken);\n          const now = yield* DateTime.now;\n\n          const connection = OAuthConnection.make({\n            provider: provider.key,\n            subjectId: input.subjectId,\n            identity,\n            tokens: tokensFromGrant(grant, now),\n            connectedAt: now,\n            updatedAt: now,\n          });\n\n          yield* connections.put(connection);\n\n          return connection;\n        }),\n\n        connection: (provider, subjectId) => connections.get(provider, subjectId),\n\n        accessToken: Effect.fn(\"OAuth.accessToken\")(function* (providerKey, subjectId) {\n          const existing = yield* connections.get(providerKey, subjectId);\n\n          if (Option.isNone(existing)) {\n            return yield* OAuthConnectionNotFound.make();\n          }\n          const current = existing.value;\n          const now = yield* DateTime.now;\n          const nowMillis = DateTime.toEpochMillis(now);\n          const marginMillis = Duration.toMillis(policy.accessTokenRefreshMargin);\n\n          const usable =\n            Option.isNone(current.tokens.accessTokenExpiresAt) ||\n            nowMillis + marginMillis <\n              DateTime.toEpochMillis(current.tokens.accessTokenExpiresAt.value);\n\n          if (usable) {\n            return current.tokens.accessToken;\n          }\n          const refreshToken = current.tokens.refreshToken;\n\n          const refreshTokenDead =\n            Option.isNone(refreshToken) ||\n            (Option.isSome(current.tokens.refreshTokenExpiresAt) &&\n              nowMillis >= DateTime.toEpochMillis(current.tokens.refreshTokenExpiresAt.value));\n\n          if (Option.isNone(refreshToken) || refreshTokenDead) {\n            return yield* OAuthReauthorizationRequired.make();\n          }\n          const provider = yield* providers.lookup(providerKey);\n\n          // A rejected refresh grant means the provider-side authorization is\n          // gone; only a fresh authorization can repair it.\n          const grant = yield* requestTokenGrant(provider, {\n            grant_type: \"refresh_token\",\n            refresh_token: Redacted.value(refreshToken.value),\n          }).pipe(Effect.catchTag(\"OAuthGrantRejected\", () => OAuthReauthorizationRequired.make()));\n\n          const rotated = tokensFromGrant(grant, now);\n\n          // Providers that do not rotate refresh tokens omit them from the\n          // refresh response; the previous one then stays valid.\n          const tokens = Option.isSome(rotated.refreshToken)\n            ? rotated\n            : OAuthTokens.make({\n                ...rotated,\n                refreshToken: current.tokens.refreshToken,\n                refreshTokenExpiresAt: current.tokens.refreshTokenExpiresAt,\n              });\n\n          yield* connections.put(OAuthConnection.make({ ...current, tokens, updatedAt: now }));\n\n          return tokens.accessToken;\n        }),\n\n        disconnect: Effect.fn(\"OAuth.disconnect\")(function* (providerKey, subjectId) {\n          const existing = yield* connections.get(providerKey, subjectId);\n\n          if (Option.isNone(existing)) {\n            return;\n          }\n          const provider = yield* providers.lookup(providerKey);\n\n          if (Option.isSome(provider.revocation)) {\n            const response = yield* client\n              .execute(provider.revocation.value(existing.value.tokens.accessToken))\n              .pipe(Effect.mapError(() => unavailable(provider.key, \"revocation endpoint\")));\n\n            const alreadyGone = response.status === 404 || response.status === 422;\n\n            if (!(response.status >= 200 && response.status < 300) && !alreadyGone) {\n              return yield* OAuthProviderError.make({\n                provider: provider.key,\n                message: \"The provider refused the token revocation\",\n              });\n            }\n          }\n          yield* connections.remove(providerKey, subjectId);\n        }),\n      });\n    }),\n  );\n}\n"],"mappings":";;;;;;;;;;;AAwCA,MAAM,kBAAkB;AAGxB,MAAM,uBAAuB,OAAO,oBAAoB,mBAAmB;;;;;;;;;AAoC3E,IAAa,QAAb,MAAa,cAAc,QAAQ,QAqDjC,CAAC,CAAC,mBAAmB,CAAC,CAAC;CACvB,OAAgB,QASZ,MAAM,OAAO,KAAK,CAAC,CACrB,OAAO,IAAI,aAAa;EACtB,MAAM,SAAS,OAAO;EACtB,MAAM,YAAY,OAAO;EACzB,MAAM,SAAS,OAAO;EACtB,MAAM,cAAc,OAAO;EAC3B,MAAM,QAAQ,OAAO;EACrB,MAAM,SAAS,OAAO,OAAO;EAC7B,MAAM,SAAS,OAAO,WAAW;EAEjC,MAAM,mBAAmB,OAAO,YAAY,EAAE,CAAC,CAAC,KAC9C,OAAO,IAAI,SAAS,eAAe,GACnC,OAAO,eAAe,eAAe,KAAK,EAAE,SAAS,gCAAgC,CAAC,CAAC,CACzF;EAEA,MAAM,eAAe,UAA4B,aAC/C,mBAAmB,KAAK;GACtB;GACA,SAAS,kBAAkB,SAAS;EACtC,CAAC;;;;;;EAOH,MAAM,oBAAoB,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC7D,UACA,aAC4E;GAC5E,MAAM,UAAU,kBAAkB,KAAK,SAAS,UAAU,KAAK,CAAC,CAAC,KAC/D,kBAAkB,YAClB,kBAAkB,cAAc;IAC9B,GAAG;IACH,WAAW,SAAS;IACpB,eAAe,SAAS,MAAM,SAAS,YAAY;GACrD,CAAC,CACH;GAMA,MAAM,UAAU,QAAO,OAJC,OACrB,QAAQ,OAAO,CAAC,CAChB,KAAK,OAAO,eAAe,YAAY,SAAS,KAAK,gBAAgB,CAAC,CAAC,EAAA,CAE1C,KAAK,KACnC,OAAO,eACL,mBAAmB,KAAK;IACtB,UAAU,SAAS;IACnB,SAAS;GACX,CAAC,CACH,CACF;GAEA,OAAO,OAAO,SAAS,iBAAiB,OAAO;EACjD,CAAC;EAED,MAAM,gBAAgB,OAAO,GAAG,qBAAqB,CAAC,CAAC,WACrD,UACA,aACA;GACA,MAAM,UAAU,kBAAkB,IAAI,SAAS,SAAS,GAAG,CAAC,CAAC,KAC3D,kBAAkB,YAClB,kBAAkB,WAAW,SAAS,SAAS,OAAO,GACtD,kBAAkB,YAAY,WAAW,CAC3C;GAOA,MAAM,UAAU,QAAO,OALC,OAAO,QAAQ,OAAO,CAAC,CAAC,KAC9C,OAAO,QAAQ,mBAAmB,cAAc,GAChD,OAAO,eAAe,YAAY,SAAS,KAAK,mBAAmB,CAAC,CACtE,EAAA,CAEgC,KAAK,KACnC,OAAO,eACL,mBAAmB,KAAK;IACtB,UAAU,SAAS;IACnB,SAAS;GACX,CAAC,CACH,CACF;GAEA,OAAO,OAAO,SAAS,SAAS,OAAO,OAAO;EAChD,CAAC;EAED,MAAM,mBAAmB,OAAwB,QAC/C,YAAY,KAAK;GACf,aAAa,MAAM;GACnB,WAAW,MAAM;GACjB,sBAAsB,OAAO,IAAI,MAAM,YAAY,aACjD,SAAS,YAAY,KAAK,QAAQ,CACpC;GACA,cAAc,MAAM;GACpB,uBAAuB,OAAO,IAAI,MAAM,wBAAwB,aAC9D,SAAS,YAAY,KAAK,QAAQ,CACpC;GACA,OAAO,MAAM;EACf,CAAC;EAEH,OAAO,MAAM,GAAG;GACd,OAAO,OAAO,GAAG,aAAa,CAAC,CAAC,WAAW,OAAO;IAChD,MAAM,WAAW,OAAO,UAAU,OAAO,MAAM,QAAQ;IACvD,MAAM,aAAa,OAAO;IAC1B,MAAM,cAAc,OAAO,MAAM,YAAY,SAAS,KAAK,UAAU,GAAG,eAAe;IACvF,MAAM,MAAM,OAAO,SAAS;IAC5B,MAAM,YAAY,SAAS,YAAY,KAAK,OAAO,aAAa;IAEhE,OAAO,OAAO,MACZ,WAAW,KAAK;KACd;KACA,UAAU,SAAS;KACnB,WAAW,MAAM;KACjB,aAAa,MAAM;KACnB,UAAU;KACV;IACF,CAAC,CACH;IAIA,MAAM,MAAM,OAAO,OAAO,UAAU,IAAI,IAAI,SAAS,UAAU,aAAa,CAAC,CAAC,CAAC,KAC7E,OAAO,KACT;IAEA,IAAI,aAAa,IAAI,aAAa,SAAS,QAAQ;IACnD,IAAI,aAAa,IAAI,gBAAgB,MAAM,WAAW;IACtD,IAAI,aAAa,IAAI,iBAAiB,MAAM;IAC5C,IAAI,aAAa,IAAI,SAAS,UAAU;IACxC,IAAI,SAAS,OAAO,SAAS,GAC3B,IAAI,aAAa,IAAI,SAAS,SAAS,OAAO,KAAK,GAAG,CAAC;IAEzD,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,SAAS,mBAAmB,GACrE,IAAI,aAAa,IAAI,MAAM,KAAK;IAGlC,OAAO,mBAAmB,KAAK;KAAE,KAAK,IAAI,SAAS;KAAG;IAAU,CAAC;GACnE,CAAC;GAED,UAAU,OAAO,GAAG,gBAAgB,CAAC,CAAC,WAAW,OAAO;IACtD,MAAM,WAAW,OAAO,UAAU,OAAO,MAAM,QAAQ;IAEvD,MAAM,SAAS,OAAO,qBAAqB,MAAM,MAAM,CAAC,CAAC,KACvD,OAAO,eAAe,kBAAkB,KAAK,CAAC,CAChD;IAEA,IAAI,OAAO,UAAU,KAAA,KAAa,OAAO,UAAU,IACjD,OAAO,OAAO,kBAAkB,KAAK;IAKvC,MAAM,cAAc,OAAO,MAAM,YAC/B,SAAS,KAAK,OAAO,KAAK,GAC1B,eACF;IAEA,MAAM,QAAQ,OAAO,OAAO,QAAQ,WAAW;IAE/C,IACE,MAAM,aAAa,SAAS,OAC5B,MAAM,cAAc,MAAM,aAC1B,MAAM,gBAAgB,MAAM,aAE5B,OAAO,OAAO,kBAAkB,KAAK;IAEvC,IAAI,OAAO,UAAU,iBACnB,OAAO,OAAO,kBAAkB,KAAK;IAEvC,IAAI,OAAO,UAAU,KAAA,GACnB,OAAO,OAAO,mBAAmB,KAAK;KACpC,UAAU,SAAS;KACnB,SAAS;IACX,CAAC;IAEH,IAAI,OAAO,SAAS,KAAA,KAAa,OAAO,SAAS,IAC/C,OAAO,OAAO,kBAAkB,KAAK;IAGvC,MAAM,QAAQ,OAAO,kBAAkB,UAAU;KAC/C,YAAY;KACZ,MAAM,OAAO;KACb,cAAc,MAAM;IACtB,CAAC,CAAC,CAAC,KACD,OAAO,SACL,uBACC,cACC,UAAU,SAAS,kBACf,kBAAkB,KAAK,IACvB,mBAAmB,KAAK;KACtB,UAAU,SAAS;KACnB,SAAS,4CAA4C,UAAU,KAAK;IACtE,CAAC,CACT,CACF;IAEA,MAAM,WAAW,OAAO,cAAc,UAAU,MAAM,WAAW;IACjE,MAAM,MAAM,OAAO,SAAS;IAE5B,MAAM,aAAa,gBAAgB,KAAK;KACtC,UAAU,SAAS;KACnB,WAAW,MAAM;KACjB;KACA,QAAQ,gBAAgB,OAAO,GAAG;KAClC,aAAa;KACb,WAAW;IACb,CAAC;IAED,OAAO,YAAY,IAAI,UAAU;IAEjC,OAAO;GACT,CAAC;GAED,aAAa,UAAU,cAAc,YAAY,IAAI,UAAU,SAAS;GAExE,aAAa,OAAO,GAAG,mBAAmB,CAAC,CAAC,WAAW,aAAa,WAAW;IAC7E,MAAM,WAAW,OAAO,YAAY,IAAI,aAAa,SAAS;IAE9D,IAAI,OAAO,OAAO,QAAQ,GACxB,OAAO,OAAO,wBAAwB,KAAK;IAE7C,MAAM,UAAU,SAAS;IACzB,MAAM,MAAM,OAAO,SAAS;IAC5B,MAAM,YAAY,SAAS,cAAc,GAAG;IAC5C,MAAM,eAAe,SAAS,SAAS,OAAO,wBAAwB;IAOtE,IAJE,OAAO,OAAO,QAAQ,OAAO,oBAAoB,KACjD,YAAY,eACV,SAAS,cAAc,QAAQ,OAAO,qBAAqB,KAAK,GAGlE,OAAO,QAAQ,OAAO;IAExB,MAAM,eAAe,QAAQ,OAAO;IAEpC,MAAM,mBACJ,OAAO,OAAO,YAAY,KACzB,OAAO,OAAO,QAAQ,OAAO,qBAAqB,KACjD,aAAa,SAAS,cAAc,QAAQ,OAAO,sBAAsB,KAAK;IAElF,IAAI,OAAO,OAAO,YAAY,KAAK,kBACjC,OAAO,OAAO,6BAA6B,KAAK;IAElD,MAAM,WAAW,OAAO,UAAU,OAAO,WAAW;IAIpD,MAAM,QAAQ,OAAO,kBAAkB,UAAU;KAC/C,YAAY;KACZ,eAAe,SAAS,MAAM,aAAa,KAAK;IAClD,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,4BAA4B,6BAA6B,KAAK,CAAC,CAAC;IAExF,MAAM,UAAU,gBAAgB,OAAO,GAAG;IAI1C,MAAM,SAAS,OAAO,OAAO,QAAQ,YAAY,IAC7C,UACA,YAAY,KAAK;KACf,GAAG;KACH,cAAc,QAAQ,OAAO;KAC7B,uBAAuB,QAAQ,OAAO;IACxC,CAAC;IAEL,OAAO,YAAY,IAAI,gBAAgB,KAAK;KAAE,GAAG;KAAS;KAAQ,WAAW;IAAI,CAAC,CAAC;IAEnF,OAAO,OAAO;GAChB,CAAC;GAED,YAAY,OAAO,GAAG,kBAAkB,CAAC,CAAC,WAAW,aAAa,WAAW;IAC3E,MAAM,WAAW,OAAO,YAAY,IAAI,aAAa,SAAS;IAE9D,IAAI,OAAO,OAAO,QAAQ,GACxB;IAEF,MAAM,WAAW,OAAO,UAAU,OAAO,WAAW;IAEpD,IAAI,OAAO,OAAO,SAAS,UAAU,GAAG;KACtC,MAAM,WAAW,OAAO,OACrB,QAAQ,SAAS,WAAW,MAAM,SAAS,MAAM,OAAO,WAAW,CAAC,CAAC,CACrE,KAAK,OAAO,eAAe,YAAY,SAAS,KAAK,qBAAqB,CAAC,CAAC;KAE/E,MAAM,cAAc,SAAS,WAAW,OAAO,SAAS,WAAW;KAEnE,IAAI,EAAE,SAAS,UAAU,OAAO,SAAS,SAAS,QAAQ,CAAC,aACzD,OAAO,OAAO,mBAAmB,KAAK;MACpC,UAAU,SAAS;MACnB,SAAS;KACX,CAAC;IAEL;IACA,OAAO,YAAY,OAAO,aAAa,SAAS;GAClD,CAAC;EACH,CAAC;CACH,CAAC,CACH;AACF"}

package/dist/oauth/OAuthAccountsPersistence.d.mts

@@ -0,0 +1,109 @@
+import { SubjectId } from "../Schema.mjs";
+import { PreparedCommit } from "../hooks/commit.mjs";
+import { SessionInvalidationWindow } from "../sessions/invalidation.mjs";
+import { OAuthUnavailable } from "./signInErrors.mjs";
+import { OAuthCleanupInput, OAuthCommandId, OAuthCredentialSnapshot, OAuthModuleId } from "./signInModels.mjs";
+import { PrepareOAuthCommit } from "./OAuthSignInPersistence.mjs";
+import { OAuthAccountRevision, OAuthActionAuthorization, OAuthLinkAccess, OAuthLinkClaim, OAuthLinkClaimDecision, OAuthLinkDecision, OAuthLinkIssueDecision, OAuthLinkOutcome, OAuthLinkPendingFlow, OAuthUnlinkDecision, OAuthUnlinkInspection } from "./accountsModels.mjs";
+import { Context, Effect } from "effect";
+//#region src/oauth/OAuthAccountsPersistence.d.ts
+declare const OAuthAccountsPersistence_base: Context.ServiceClass<OAuthAccountsPersistence, "effect-auth/OAuthAccountsPersistence", {
+  /** Active original subject and authoritative credential revisions. Every policy,
+   * binding or credential-set change that affects authority advances securityRevision. */
+  readonly capture: (input: {
+    readonly moduleId: typeof OAuthModuleId.Type;
+    readonly subjectId: SubjectId;
+  }) => Effect.Effect<OAuthAccountRevision | undefined, OAuthUnavailable>;
+  /** Enforce unique module/flow and module/command, exact immutable context/sealed/
+   * retention data, active subject, original revisions, independent begin evidence,
+   * current enabled factor policy and authority-clock freshness in this same owner. */
+  readonly issue: <A>(input: {
+    readonly flow: OAuthLinkPendingFlow;
+    readonly authorization: OAuthActionAuthorization;
+  }, prepare: PrepareOAuthCommit<typeof OAuthLinkIssueDecision.Type, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;
+  /** Before action-factor consumption: check Pending, exact binder/flow/generation/
+   * provider/callback/response issuer, original active subject/revisions and expiry.
+   * Wrong credentials/subject never consume or terminalize the flow. */
+  readonly preflight: (input: OAuthLinkAccess) => Effect.Effect<OAuthLinkPendingFlow | undefined, OAuthUnavailable>;
+  /** Repeat every preflight predicate and exact inspected flow, then current fresh
+   * complete-action evidence/policy. Single CAS; authority sets fixed claim deadline
+   * = claimedAt + captured lifetime. Never reset Pending or renew the lease. */
+  readonly claim: <A>(input: {
+    readonly access: OAuthLinkAccess;
+    readonly flow: OAuthLinkPendingFlow;
+    readonly claimId: OAuthLinkClaim["claimId"];
+    readonly authorization: OAuthActionAuthorization;
+  }, prepare: PrepareOAuthCommit<typeof OAuthLinkClaimDecision.Type, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;
+  /** Exact claim CAS before deadline. Every outcome erases sealed material and
+   * terminalizes. Verified repeats active original subject/revisions, current action
+   * evidence/policy/freshness, and full provider+canonical issuer+stable subject
+   * uniqueness INCLUDING unresolved registration reservations. Never adopt by email.
+   * Same-subject connected-only ownership may add a login; another subject conflicts.
+   * Existing usable same-subject login may return unchanged. Changed joins credential,
+   * shared factor, revision advancement, pending/session/proof invalidation, terminal
+   * result and journal. No mutation/event for unchanged. No session is minted.
+   */
+  readonly settle: <A>(input: {
+    readonly claim: OAuthLinkClaim;
+    readonly outcome: OAuthLinkOutcome;
+    readonly authorization: OAuthActionAuthorization;
+    readonly invalidation: SessionInvalidationWindow;
+    readonly nowMillis: number;
+  }, prepare: PrepareOAuthCommit<typeof OAuthLinkDecision.Type, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;
+  /** Look up durable command first. Exact replay is authenticated safe metadata only
+   * for its original currently active subject under current metadata-access policy;
+   * no fresh factor is consumed. Compare module/command/subject/requested credential
+   * against durable original full intent. Cross-target/subject reuse conflicts.
+   * A missing credential/marker proves neither previous ownership nor rollback.
+   * New targets must be currently owned OAuth LOGIN credentials, not connected grants.
+   */
+  readonly inspectUnlink: (input: {
+    readonly moduleId: typeof OAuthModuleId.Type;
+    readonly subjectId: SubjectId;
+    readonly commandId: typeof OAuthCommandId.Type;
+    readonly credentialId: string;
+  }) => Effect.Effect<typeof OAuthUnlinkInspection.Type, OAuthUnavailable>;
+  /** Recheck exact original target/revisions and fresh independent action evidence,
+   * current enabled factor policy at authority time. Atomically evaluate POST-delete
+   * usable PRIMARY login paths using mapped method eligibility (active/verified/etc),
+   * not shared credential status alone. Factor-only TOTP, recovery, pending registration
+   * and connected grants do not count. Also retain ability to satisfy enabled factor
+   * policy; never silently disable MFA. Concurrent removals leave a viable method.
+   * Join login/shared-factor/proof removal, revision advancement, invalidation, immutable
+   * command result and journal. Retain full-tuple ownership while a connected reference
+   * exists, using an authoritative same-owner reference check when that capability is
+   * installed. No generic password store, async canUnlink boolean or read-count-delete.
+   * Exact durable replay returns original metadata with replayed=true; no writes,
+   * private commands/events/factor consumption. Command identity includes immutable
+   * original target tuple/revisions, not a new proof's bytes. Retain unresolved command
+   * outcomes; absent markers never justify automatic mutation retry.
+   */
+  readonly unlink: <A>(input: {
+    readonly moduleId: typeof OAuthModuleId.Type;
+    readonly commandId: typeof OAuthCommandId.Type;
+    readonly credential: OAuthCredentialSnapshot;
+    readonly authorization: OAuthActionAuthorization;
+    readonly invalidation: SessionInvalidationWindow;
+    readonly nowMillis: number;
+    readonly retentionUntilMillis: number;
+  }, prepare: PrepareOAuthCommit<typeof OAuthUnlinkDecision.Type, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;
+  /** Decode integer limit1..1000. Expire Pending->Rejected and Claimed->Ambiguous;
+   * erase sealed material, never reset. Conditional writes recheck authority clock and
+   * exact status. Terminal tombstones/commands retained through original retention and
+   * claim horizons; unresolved effects/reservations are never released by this cleanup.
+   */
+  readonly cleanup: <A>(input: OAuthCleanupInput, prepare: PrepareOAuthCommit<{
+    readonly terminalized: number;
+    readonly removed: number;
+    readonly hasMore: boolean;
+  }, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;
+}>;
+/** Same-owner semantic authority. Prepare is synchronous before physical commit;
+ * unknown outcomes discard receipts/events and never replay prepare. Standalone
+ * adapters reject ambient owners. No network, raw secrets, provider tokens, Claims
+ * or Registration data is accepted. Reads are nonconsuming and confer no CAS right.
+ */
+declare class OAuthAccountsPersistence extends OAuthAccountsPersistence_base {}
+//#endregion
+export { OAuthAccountsPersistence };
+//# sourceMappingURL=OAuthAccountsPersistence.d.mts.map

package/dist/oauth/OAuthAccountsPersistence.mjs

@@ -0,0 +1,12 @@
+import { Context } from "effect";
+//#region src/oauth/OAuthAccountsPersistence.ts
+/** Same-owner semantic authority. Prepare is synchronous before physical commit;
+* unknown outcomes discard receipts/events and never replay prepare. Standalone
+* adapters reject ambient owners. No network, raw secrets, provider tokens, Claims
+* or Registration data is accepted. Reads are nonconsuming and confer no CAS right.
+*/
+var OAuthAccountsPersistence = class extends Context.Service()("effect-auth/OAuthAccountsPersistence") {};
+//#endregion
+export { OAuthAccountsPersistence };
+
+//# sourceMappingURL=OAuthAccountsPersistence.mjs.map

package/dist/oauth/OAuthAccountsPersistence.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuthAccountsPersistence.mjs","names":[],"sources":["../../src/oauth/OAuthAccountsPersistence.ts"],"sourcesContent":["import { Context, type Effect } from \"effect\";\n\nimport type { PreparedCommit } from \"../hooks/commit\";\nimport type { SubjectId } from \"../Schema\";\nimport type { SessionInvalidationWindow } from \"../sessions/invalidation\";\nimport type {\n  OAuthAccountRevision,\n  OAuthActionAuthorization,\n  OAuthLinkAccess,\n  OAuthLinkClaim,\n  OAuthLinkClaimDecision,\n  OAuthLinkDecision,\n  OAuthLinkIssueDecision,\n  OAuthLinkOutcome,\n  OAuthLinkPendingFlow,\n  OAuthUnlinkDecision,\n  OAuthUnlinkInspection,\n} from \"./accountsModels\";\nimport type { PrepareOAuthCommit } from \"./OAuthSignInPersistence\";\nimport type { OAuthUnavailable } from \"./signInErrors\";\nimport type {\n  OAuthCleanupInput,\n  OAuthCommandId,\n  OAuthCredentialSnapshot,\n  OAuthModuleId,\n} from \"./signInModels\";\n\n/** Same-owner semantic authority. Prepare is synchronous before physical commit;\n * unknown outcomes discard receipts/events and never replay prepare. Standalone\n * adapters reject ambient owners. No network, raw secrets, provider tokens, Claims\n * or Registration data is accepted. Reads are nonconsuming and confer no CAS right.\n */\nexport class OAuthAccountsPersistence extends Context.Service<\n  OAuthAccountsPersistence,\n  {\n    /** Active original subject and authoritative credential revisions. Every policy,\n     * binding or credential-set change that affects authority advances securityRevision. */\n    readonly capture: (input: {\n      readonly moduleId: typeof OAuthModuleId.Type;\n      readonly subjectId: SubjectId;\n    }) => Effect.Effect<OAuthAccountRevision | undefined, OAuthUnavailable>;\n    /** Enforce unique module/flow and module/command, exact immutable context/sealed/\n     * retention data, active subject, original revisions, independent begin evidence,\n     * current enabled factor policy and authority-clock freshness in this same owner. */\n    readonly issue: <A>(\n      input: {\n        readonly flow: OAuthLinkPendingFlow;\n        readonly authorization: OAuthActionAuthorization;\n      },\n      prepare: PrepareOAuthCommit<typeof OAuthLinkIssueDecision.Type, A>,\n    ) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;\n    /** Before action-factor consumption: check Pending, exact binder/flow/generation/\n     * provider/callback/response issuer, original active subject/revisions and expiry.\n     * Wrong credentials/subject never consume or terminalize the flow. */\n    readonly preflight: (\n      input: OAuthLinkAccess,\n    ) => Effect.Effect<OAuthLinkPendingFlow | undefined, OAuthUnavailable>;\n    /** Repeat every preflight predicate and exact inspected flow, then current fresh\n     * complete-action evidence/policy. Single CAS; authority sets fixed claim deadline\n     * = claimedAt + captured lifetime. Never reset Pending or renew the lease. */\n    readonly claim: <A>(\n      input: {\n        readonly access: OAuthLinkAccess;\n        readonly flow: OAuthLinkPendingFlow;\n        readonly claimId: OAuthLinkClaim[\"claimId\"];\n        readonly authorization: OAuthActionAuthorization;\n      },\n      prepare: PrepareOAuthCommit<typeof OAuthLinkClaimDecision.Type, A>,\n    ) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;\n    /** Exact claim CAS before deadline. Every outcome erases sealed material and\n     * terminalizes. Verified repeats active original subject/revisions, current action\n     * evidence/policy/freshness, and full provider+canonical issuer+stable subject\n     * uniqueness INCLUDING unresolved registration reservations. Never adopt by email.\n     * Same-subject connected-only ownership may add a login; another subject conflicts.\n     * Existing usable same-subject login may return unchanged. Changed joins credential,\n     * shared factor, revision advancement, pending/session/proof invalidation, terminal\n     * result and journal. No mutation/event for unchanged. No session is minted.\n     */\n    readonly settle: <A>(\n      input: {\n        readonly claim: OAuthLinkClaim;\n        readonly outcome: OAuthLinkOutcome;\n        readonly authorization: OAuthActionAuthorization;\n        readonly invalidation: SessionInvalidationWindow;\n        readonly nowMillis: number;\n      },\n      prepare: PrepareOAuthCommit<typeof OAuthLinkDecision.Type, A>,\n    ) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;\n    /** Look up durable command first. Exact replay is authenticated safe metadata only\n     * for its original currently active subject under current metadata-access policy;\n     * no fresh factor is consumed. Compare module/command/subject/requested credential\n     * against durable original full intent. Cross-target/subject reuse conflicts.\n     * A missing credential/marker proves neither previous ownership nor rollback.\n     * New targets must be currently owned OAuth LOGIN credentials, not connected grants.\n     */\n    readonly inspectUnlink: (input: {\n      readonly moduleId: typeof OAuthModuleId.Type;\n      readonly subjectId: SubjectId;\n      readonly commandId: typeof OAuthCommandId.Type;\n      readonly credentialId: string;\n    }) => Effect.Effect<typeof OAuthUnlinkInspection.Type, OAuthUnavailable>;\n    /** Recheck exact original target/revisions and fresh independent action evidence,\n     * current enabled factor policy at authority time. Atomically evaluate POST-delete\n     * usable PRIMARY login paths using mapped method eligibility (active/verified/etc),\n     * not shared credential status alone. Factor-only TOTP, recovery, pending registration\n     * and connected grants do not count. Also retain ability to satisfy enabled factor\n     * policy; never silently disable MFA. Concurrent removals leave a viable method.\n     * Join login/shared-factor/proof removal, revision advancement, invalidation, immutable\n     * command result and journal. Retain full-tuple ownership while a connected reference\n     * exists, using an authoritative same-owner reference check when that capability is\n     * installed. No generic password store, async canUnlink boolean or read-count-delete.\n     * Exact durable replay returns original metadata with replayed=true; no writes,\n     * private commands/events/factor consumption. Command identity includes immutable\n     * original target tuple/revisions, not a new proof's bytes. Retain unresolved command\n     * outcomes; absent markers never justify automatic mutation retry.\n     */\n    readonly unlink: <A>(\n      input: {\n        readonly moduleId: typeof OAuthModuleId.Type;\n        readonly commandId: typeof OAuthCommandId.Type;\n        readonly credential: OAuthCredentialSnapshot;\n        readonly authorization: OAuthActionAuthorization;\n        readonly invalidation: SessionInvalidationWindow;\n        readonly nowMillis: number;\n        readonly retentionUntilMillis: number;\n      },\n      prepare: PrepareOAuthCommit<typeof OAuthUnlinkDecision.Type, A>,\n    ) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;\n    /** Decode integer limit1..1000. Expire Pending->Rejected and Claimed->Ambiguous;\n     * erase sealed material, never reset. Conditional writes recheck authority clock and\n     * exact status. Terminal tombstones/commands retained through original retention and\n     * claim horizons; unresolved effects/reservations are never released by this cleanup.\n     */\n    readonly cleanup: <A>(\n      input: OAuthCleanupInput,\n      prepare: PrepareOAuthCommit<\n        { readonly terminalized: number; readonly removed: number; readonly hasMore: boolean },\n        A\n      >,\n    ) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;\n  }\n>()(\"effect-auth/OAuthAccountsPersistence\") {}\n"],"mappings":";;;;;;;AAgCA,IAAa,2BAAb,cAA8C,QAAQ,QA6GpD,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC"}

package/dist/oauth/OAuthActionEvidence.d.mts

@@ -0,0 +1,28 @@
+import { AuthInvocation } from "../operations/context.mjs";
+import { AuthenticationEvidence, AuthenticationRequirement } from "../sessions/models.mjs";
+import { OAuthUnavailable } from "./signInErrors.mjs";
+import { OAuthActionChallenge, OAuthActionRequired } from "./accountsModels.mjs";
+import { Context, Effect, Redacted } from "effect";
+//#region src/oauth/OAuthActionEvidence.d.ts
+declare const OAuthActionEvidence_base: Context.ServiceClass<OAuthActionEvidence, "effect-auth/OAuthActionEvidence", {
+  readonly verify: (input: {
+    readonly invocation: AuthInvocation;
+    readonly challenge: OAuthActionChallenge;
+    readonly proof?: Redacted.Redacted<string>;
+  }) => Effect.Effect<{
+    readonly evidence: AuthenticationEvidence;
+    readonly requirement: AuthenticationRequirement;
+  }, OAuthActionRequired | OAuthUnavailable>;
+}>;
+/** Independent current action authority; no default grants access. Verify exact
+ * challenge/subject/revisions and consume one-time factors in their own authority
+ * before returning. Public session assurance, pending-login and registration
+ * credentials are not action proof. Begin and Complete require separate evidence.
+ * Counter consumption need not replace semantic credential revision; replacement,
+ * revocation and policy/binding changes must advance the corresponding revisions.
+ * A later OAuth CAS rejection does not refund a factor or imply an atomic join.
+ */
+declare class OAuthActionEvidence extends OAuthActionEvidence_base {}
+//#endregion
+export { OAuthActionEvidence };
+//# sourceMappingURL=OAuthActionEvidence.d.mts.map

package/dist/oauth/OAuthActionEvidence.mjs

@@ -0,0 +1,15 @@
+import { Context } from "effect";
+//#region src/oauth/OAuthActionEvidence.ts
+/** Independent current action authority; no default grants access. Verify exact
+* challenge/subject/revisions and consume one-time factors in their own authority
+* before returning. Public session assurance, pending-login and registration
+* credentials are not action proof. Begin and Complete require separate evidence.
+* Counter consumption need not replace semantic credential revision; replacement,
+* revocation and policy/binding changes must advance the corresponding revisions.
+* A later OAuth CAS rejection does not refund a factor or imply an atomic join.
+*/
+var OAuthActionEvidence = class extends Context.Service()("effect-auth/OAuthActionEvidence") {};
+//#endregion
+export { OAuthActionEvidence };
+
+//# sourceMappingURL=OAuthActionEvidence.mjs.map

package/dist/oauth/OAuthActionEvidence.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuthActionEvidence.mjs","names":[],"sources":["../../src/oauth/OAuthActionEvidence.ts"],"sourcesContent":["import { Context, type Effect, type Redacted } from \"effect\";\n\nimport type { AuthInvocation } from \"../operations/context\";\nimport type { AuthenticationEvidence, AuthenticationRequirement } from \"../sessions/models\";\nimport type { OAuthActionChallenge, OAuthActionRequired } from \"./accountsModels\";\nimport type { OAuthUnavailable } from \"./signInErrors\";\n\n/** Independent current action authority; no default grants access. Verify exact\n * challenge/subject/revisions and consume one-time factors in their own authority\n * before returning. Public session assurance, pending-login and registration\n * credentials are not action proof. Begin and Complete require separate evidence.\n * Counter consumption need not replace semantic credential revision; replacement,\n * revocation and policy/binding changes must advance the corresponding revisions.\n * A later OAuth CAS rejection does not refund a factor or imply an atomic join.\n */\nexport class OAuthActionEvidence extends Context.Service<\n  OAuthActionEvidence,\n  {\n    readonly verify: (input: {\n      readonly invocation: AuthInvocation;\n      readonly challenge: OAuthActionChallenge;\n      readonly proof?: Redacted.Redacted<string>;\n    }) => Effect.Effect<\n      {\n        readonly evidence: AuthenticationEvidence;\n        readonly requirement: AuthenticationRequirement;\n      },\n      OAuthActionRequired | OAuthUnavailable\n    >;\n  }\n>()(\"effect-auth/OAuthActionEvidence\") {}\n"],"mappings":";;;;;;;;;;AAeA,IAAa,sBAAb,cAAyC,QAAQ,QAe/C,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC"}

package/dist/oauth/OAuthConnectedActionEvidence.d.mts

@@ -0,0 +1,22 @@
+import { AuthInvocation } from "../operations/context.mjs";
+import { AuthenticationEvidence, AuthenticationRequirement } from "../sessions/models.mjs";
+import { OAuthUnavailable } from "./signInErrors.mjs";
+import { OAuthConnectedActionChallenge, OAuthConnectedActionRequired } from "./connectedModels.mjs";
+import { Context, Effect, Redacted } from "effect";
+//#region src/oauth/OAuthConnectedActionEvidence.d.ts
+declare const OAuthConnectedActionEvidence_base: Context.ServiceClass<OAuthConnectedActionEvidence, "effect-auth/OAuthConnectedActionEvidence", {
+  readonly verify: (input: {
+    readonly invocation: AuthInvocation;
+    readonly challenge: OAuthConnectedActionChallenge;
+    readonly proof?: Redacted.Redacted<string>;
+  }) => Effect.Effect<{
+    readonly evidence: AuthenticationEvidence;
+    readonly requirement: AuthenticationRequirement;
+  }, OAuthConnectedActionRequired | OAuthUnavailable>;
+}>;
+/** Independent exact-action authority. Consume one-time evidence before returning;
+ * later connected CAS loss does not refund it. No session-summary default. */
+declare class OAuthConnectedActionEvidence extends OAuthConnectedActionEvidence_base {}
+//#endregion
+export { OAuthConnectedActionEvidence };
+//# sourceMappingURL=OAuthConnectedActionEvidence.d.mts.map

package/dist/oauth/OAuthConnectedActionEvidence.mjs

@@ -0,0 +1,9 @@
+import { Context } from "effect";
+//#region src/oauth/OAuthConnectedActionEvidence.ts
+/** Independent exact-action authority. Consume one-time evidence before returning;
+* later connected CAS loss does not refund it. No session-summary default. */
+var OAuthConnectedActionEvidence = class extends Context.Service()("effect-auth/OAuthConnectedActionEvidence") {};
+//#endregion
+export { OAuthConnectedActionEvidence };
+
+//# sourceMappingURL=OAuthConnectedActionEvidence.mjs.map

package/dist/oauth/OAuthConnectedActionEvidence.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuthConnectedActionEvidence.mjs","names":[],"sources":["../../src/oauth/OAuthConnectedActionEvidence.ts"],"sourcesContent":["import { Context, type Effect, type Redacted } from \"effect\";\n\nimport type { AuthInvocation } from \"../operations/context\";\nimport type { AuthenticationEvidence, AuthenticationRequirement } from \"../sessions/models\";\nimport type {\n  OAuthConnectedActionChallenge,\n  OAuthConnectedActionRequired,\n} from \"./connectedModels\";\nimport type { OAuthUnavailable } from \"./signInErrors\";\n\n/** Independent exact-action authority. Consume one-time evidence before returning;\n * later connected CAS loss does not refund it. No session-summary default. */\nexport class OAuthConnectedActionEvidence extends Context.Service<\n  OAuthConnectedActionEvidence,\n  {\n    readonly verify: (input: {\n      readonly invocation: AuthInvocation;\n      readonly challenge: OAuthConnectedActionChallenge;\n      readonly proof?: Redacted.Redacted<string>;\n    }) => Effect.Effect<\n      {\n        readonly evidence: AuthenticationEvidence;\n        readonly requirement: AuthenticationRequirement;\n      },\n      OAuthConnectedActionRequired | OAuthUnavailable\n    >;\n  }\n>()(\"effect-auth/OAuthConnectedActionEvidence\") {}\n"],"mappings":";;;;AAYA,IAAa,+BAAb,cAAkD,QAAQ,QAexD,CAAC,CAAC,0CAA0C,CAAC,CAAC,CAAC"}

package/dist/oauth/OAuthConnectedPersistence.d.mts

@@ -0,0 +1,129 @@
+import { SubjectId } from "../Schema.mjs";
+import { PreparedCommit } from "../hooks/commit.mjs";
+import { OAuthUnavailable } from "./signInErrors.mjs";
+import { OAuthClaimId, OAuthCleanupInput, OAuthCommandId, OAuthExternalIdentity, OAuthModuleId } from "./signInModels.mjs";
+import { PrepareOAuthCommit } from "./OAuthSignInPersistence.mjs";
+import { OAuthAccountRevision } from "./accountsModels.mjs";
+import { OAuthConnectedAccess, OAuthConnectedAccessInspection, OAuthConnectedActionAuthorization, OAuthConnectedClaim, OAuthConnectedClaimDecision, OAuthConnectedCleanupResult, OAuthConnectedDisconnectDecision, OAuthConnectedDisconnectGrant, OAuthConnectedDisconnectInspection, OAuthConnectedGrantInspection, OAuthConnectedIssueDecision, OAuthConnectedListResult, OAuthConnectedOutcome, OAuthConnectedPendingFlow, OAuthConnectedRefreshClaim, OAuthConnectedRefreshDecision, OAuthConnectedRefreshOutcome, OAuthConnectedRefreshSettlement, OAuthConnectedRevocationJob, OAuthConnectedSettlementDecision, OAuthConnectedStoredGrant, OAuthConnectedTarget, OAuthConnectedUseAdmission, OAuthConnectedUseAuthorization, OAuthGrantId, OAuthPermissionProfileKey } from "./connectedModels.mjs";
+import { Context, Effect } from "effect";
+//#region src/oauth/OAuthConnectedPersistence.d.ts
+type Mutation<A> = Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;
+declare const OAuthConnectedPersistence_base: Context.ServiceClass<OAuthConnectedPersistence, "effect-auth/OAuthConnectedPersistence", {
+  readonly capture: (input: {
+    readonly moduleId: typeof OAuthModuleId.Type;
+    readonly subjectId: SubjectId;
+    readonly grantId?: typeof OAuthGrantId.Type;
+  }) => Effect.Effect<{
+    readonly revision: OAuthAccountRevision;
+    readonly target?: OAuthConnectedTarget;
+  } | undefined, OAuthUnavailable>;
+  readonly issue: <A>(input: {
+    readonly flow: OAuthConnectedPendingFlow;
+    readonly authorization: OAuthConnectedActionAuthorization;
+  }, prepare: PrepareOAuthCommit<typeof OAuthConnectedIssueDecision.Type, A>) => Mutation<A>;
+  readonly preflight: (input: OAuthConnectedAccess) => Effect.Effect<OAuthConnectedPendingFlow | undefined, OAuthUnavailable>;
+  /** Single Pending->Claimed CAS with fixed engine deadline. Assign durable total
+   * order comparable with later-resolved cohort cutoff; never use caller clock. */
+  readonly claim: <A>(input: {
+    readonly access: OAuthConnectedAccess;
+    readonly flow: OAuthConnectedPendingFlow;
+    readonly claimId: typeof OAuthClaimId.Type;
+    readonly authorization: OAuthConnectedActionAuthorization;
+  }, prepare: PrepareOAuthCommit<typeof OAuthConnectedClaimDecision.Type, A>) => Mutation<A>;
+  /** Nonconsuming current cohort/ownership inspection after identity is known.
+   * Neither this read nor its generation confers a final mutation right.
+   * A recognized cutoff/barrier rejection returns Quarantine with its actual
+   * generation so late tokens can be sealed into exact cohort custody. Foreign
+   * ownership conflicts do not authorize compensating remote revocation. */
+  readonly inspectGrant: (input: {
+    readonly claim: OAuthConnectedClaim;
+    readonly identity: typeof OAuthExternalIdentity.Type;
+  }) => Effect.Effect<typeof OAuthConnectedGrantInspection.Type, OAuthUnavailable>;
+  /** Recheck complete action, original revisions/deadline, global tuple INCLUDING
+   * unresolved registration reservations, exact profile/target/cohort and claim
+   * order after revocation cutoff. Connect cannot overwrite; Reconnect keeps tuple.
+   * Join token ciphertext, ownership, flow erasure, result and journal. Verified
+   * includes sealed cleanup for a cutoff advanced since inspectGrant; route it into
+   * original cohort custody instead of activating. Quarantined can ONLY join sealed
+   * cleanup custody, never Active. No login
+   * credential/factor/session mutation. Unknown outcome MUST NOT trigger revoke. */
+  readonly settle: <A>(input: {
+    readonly claim: OAuthConnectedClaim;
+    readonly outcome: OAuthConnectedOutcome;
+    readonly authorization: OAuthConnectedActionAuthorization;
+    readonly nowMillis: number;
+  }, prepare: PrepareOAuthCommit<typeof OAuthConnectedSettlementDecision.Type, A>) => Mutation<A>;
+  readonly list: (input: {
+    readonly authorization: OAuthConnectedUseAuthorization;
+    readonly limit: number;
+    readonly cursor?: string;
+  }) => Effect.Effect<typeof OAuthConnectedListResult.Type, OAuthUnavailable>;
+  /** Durable command first, current metadata policy on replay; no new factor.
+   * Missing marker/target proves neither prior ownership nor rollback. */
+  readonly inspectDisconnect: (input: {
+    readonly moduleId: typeof OAuthModuleId.Type;
+    readonly subjectId: SubjectId;
+    readonly authorization: OAuthConnectedUseAuthorization;
+    readonly commandId: typeof OAuthCommandId.Type;
+    readonly grantId: typeof OAuthGrantId.Type;
+  }) => Effect.Effect<typeof OAuthConnectedDisconnectInspection.Type, OAuthUnavailable>;
+  /** Local-first: atomic disable + generation/cohort barrier + immutable command +
+   * optional sealed revocation jobs. Conservative cohort-wide sibling invalidation.
+   * Pending refresh counts as unresolved. Retain global ownership while any login,
+   * grant, reservation, admission or unresolved cohort work needs it. No remote I/O. */
+  readonly disconnect: <A>(input: {
+    readonly moduleId: typeof OAuthModuleId.Type;
+    readonly commandId: typeof OAuthCommandId.Type;
+    readonly grant: OAuthConnectedDisconnectGrant;
+    readonly authorization: OAuthConnectedActionAuthorization;
+    readonly revocation?: OAuthConnectedRevocationJob;
+    readonly retentionUntilMillis: number;
+  }, prepare: PrepareOAuthCommit<typeof OAuthConnectedDisconnectDecision.Type, A>) => Mutation<A>;
+  readonly inspectAccess: (input: {
+    readonly authorization: OAuthConnectedUseAuthorization;
+    readonly grantId: typeof OAuthGrantId.Type;
+    readonly profileKey: typeof OAuthPermissionProfileKey.Type;
+  }) => Effect.Effect<typeof OAuthConnectedAccessInspection.Type, OAuthUnavailable>;
+  /** One fixed claim only when due, exact grant/token/cohort/use authority. Busy
+   * losers, no expired takeover/reset/renewal. Claimed work blocks cohort clearing. */
+  readonly claimRefresh: <A>(input: {
+    readonly grant: OAuthConnectedStoredGrant;
+    readonly authorization: OAuthConnectedUseAuthorization;
+    readonly claimId: typeof OAuthClaimId.Type;
+    readonly nextTokenVersion: OAuthConnectedRefreshClaim["nextTokenVersion"];
+    readonly lifetimeMillis: number;
+  }, prepare: PrepareOAuthCommit<typeof OAuthConnectedRefreshDecision.Type, A>) => Mutation<A>;
+  /** Exact CAS plus final policy/time. Late success never resurrects: route its
+   * sealed cleanup to original unresolved cohort; old-token revoke alone cannot
+   * clear pending work. Ambiguous/expired claim invalidates both token uses and
+   * retains unresolved state; no future reuse of possibly spent refresh material. */
+  readonly settleRefresh: <A>(input: {
+    readonly claim: OAuthConnectedRefreshClaim;
+    readonly authorization: OAuthConnectedUseAuthorization;
+    readonly outcome: OAuthConnectedRefreshOutcome;
+  }, prepare: PrepareOAuthCommit<typeof OAuthConnectedRefreshSettlement.Type, A>) => Mutation<A>;
+  /** AFTER decrypt, exact ciphertext/context+grant/token/cohort, active subject,
+   * current policy/revisions/profile/permissions and engine expiry. One confirmed
+   * admission receipt authorizes at most one callback; it does not prove I/O ran. */
+  readonly admitUse: <A>(input: {
+    readonly grant: OAuthConnectedStoredGrant;
+    readonly authorization: OAuthConnectedUseAuthorization;
+    readonly admissionId: typeof OAuthClaimId.Type;
+    readonly lifetimeMillis: number;
+  }, prepare: PrepareOAuthCommit<typeof OAuthConnectedUseAdmission.Type, A>) => Mutation<A>;
+  /** Bounded conditional cleanup; never remove unresolved initial exchanges,
+   * refresh/revocation, ownership or cohort cutoffs, or turn expired work into new
+   * authority. Unknown external tuples retain a conservative client-registration
+   * dependency until exact cohort reconciliation or proven provider quiescence;
+   * ordinary flow retention expiry cannot release that ordering dependency. */
+  readonly cleanup: <A>(input: OAuthCleanupInput, prepare: PrepareOAuthCommit<typeof OAuthConnectedCleanupResult.Type, A>) => Mutation<A>;
+}>;
+/** All joins use ONE physical authority. Synchronous prepare before commit; unknown
+ * outcomes discard receipts/events, never retry prepare/owner/network. No plaintext.
+ * Every relevant policy/binding change advances its authority revision. Final guards
+ * recheck exact input, subject, credential/policy/profile/cohort versions and engine
+ * time after all writes. Standalone operations reject ambient owners. */
+declare class OAuthConnectedPersistence extends OAuthConnectedPersistence_base {}
+//#endregion
+export { OAuthConnectedPersistence };
+//# sourceMappingURL=OAuthConnectedPersistence.d.mts.map

package/dist/oauth/OAuthConnectedPersistence.mjs

@@ -0,0 +1,12 @@
+import { Context } from "effect";
+//#region src/oauth/OAuthConnectedPersistence.ts
+/** All joins use ONE physical authority. Synchronous prepare before commit; unknown
+* outcomes discard receipts/events, never retry prepare/owner/network. No plaintext.
+* Every relevant policy/binding change advances its authority revision. Final guards
+* recheck exact input, subject, credential/policy/profile/cohort versions and engine
+* time after all writes. Standalone operations reject ambient owners. */
+var OAuthConnectedPersistence = class extends Context.Service()("effect-auth/OAuthConnectedPersistence") {};
+//#endregion
+export { OAuthConnectedPersistence };
+
+//# sourceMappingURL=OAuthConnectedPersistence.mjs.map