@yielded/auth 0.1.0-beta.1

package/dist/oauth/OAuthConnectedPersistence.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuthConnectedPersistence.mjs","names":[],"sources":["../../src/oauth/OAuthConnectedPersistence.ts"],"sourcesContent":["import { Context, type Effect } from \"effect\";\n\nimport type { PreparedCommit } from \"../hooks/commit\";\nimport type { SubjectId } from \"../Schema\";\nimport type { OAuthAccountRevision } from \"./accountsModels\";\nimport type * as M from \"./connectedModels\";\nimport type { PrepareOAuthCommit } from \"./OAuthSignInPersistence\";\nimport type { OAuthUnavailable } from \"./signInErrors\";\nimport type {\n  OAuthClaimId,\n  OAuthCleanupInput,\n  OAuthCommandId,\n  OAuthExternalIdentity,\n  OAuthModuleId,\n} from \"./signInModels\";\n\ntype Mutation<A> = Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;\n\n/** All joins use ONE physical authority. Synchronous prepare before commit; unknown\n * outcomes discard receipts/events, never retry prepare/owner/network. No plaintext.\n * Every relevant policy/binding change advances its authority revision. Final guards\n * recheck exact input, subject, credential/policy/profile/cohort versions and engine\n * time after all writes. Standalone operations reject ambient owners. */\nexport class OAuthConnectedPersistence extends Context.Service<\n  OAuthConnectedPersistence,\n  {\n    readonly capture: (input: {\n      readonly moduleId: typeof OAuthModuleId.Type;\n      readonly subjectId: SubjectId;\n      readonly grantId?: typeof M.OAuthGrantId.Type;\n    }) => Effect.Effect<\n      | { readonly revision: OAuthAccountRevision; readonly target?: M.OAuthConnectedTarget }\n      | undefined,\n      OAuthUnavailable\n    >;\n    readonly issue: <A>(\n      input: {\n        readonly flow: M.OAuthConnectedPendingFlow;\n        readonly authorization: M.OAuthConnectedActionAuthorization;\n      },\n      prepare: PrepareOAuthCommit<typeof M.OAuthConnectedIssueDecision.Type, A>,\n    ) => Mutation<A>;\n    readonly preflight: (\n      input: M.OAuthConnectedAccess,\n    ) => Effect.Effect<M.OAuthConnectedPendingFlow | undefined, OAuthUnavailable>;\n    /** Single Pending->Claimed CAS with fixed engine deadline. Assign durable total\n     * order comparable with later-resolved cohort cutoff; never use caller clock. */\n    readonly claim: <A>(\n      input: {\n        readonly access: M.OAuthConnectedAccess;\n        readonly flow: M.OAuthConnectedPendingFlow;\n        readonly claimId: typeof OAuthClaimId.Type;\n        readonly authorization: M.OAuthConnectedActionAuthorization;\n      },\n      prepare: PrepareOAuthCommit<typeof M.OAuthConnectedClaimDecision.Type, A>,\n    ) => Mutation<A>;\n    /** Nonconsuming current cohort/ownership inspection after identity is known.\n     * Neither this read nor its generation confers a final mutation right.\n     * A recognized cutoff/barrier rejection returns Quarantine with its actual\n     * generation so late tokens can be sealed into exact cohort custody. Foreign\n     * ownership conflicts do not authorize compensating remote revocation. */\n    readonly inspectGrant: (input: {\n      readonly claim: M.OAuthConnectedClaim;\n      readonly identity: typeof OAuthExternalIdentity.Type;\n    }) => Effect.Effect<typeof M.OAuthConnectedGrantInspection.Type, OAuthUnavailable>;\n    /** Recheck complete action, original revisions/deadline, global tuple INCLUDING\n     * unresolved registration reservations, exact profile/target/cohort and claim\n     * order after revocation cutoff. Connect cannot overwrite; Reconnect keeps tuple.\n     * Join token ciphertext, ownership, flow erasure, result and journal. Verified\n     * includes sealed cleanup for a cutoff advanced since inspectGrant; route it into\n     * original cohort custody instead of activating. Quarantined can ONLY join sealed\n     * cleanup custody, never Active. No login\n     * credential/factor/session mutation. Unknown outcome MUST NOT trigger revoke. */\n    readonly settle: <A>(\n      input: {\n        readonly claim: M.OAuthConnectedClaim;\n        readonly outcome: M.OAuthConnectedOutcome;\n        readonly authorization: M.OAuthConnectedActionAuthorization;\n        readonly nowMillis: number;\n      },\n      prepare: PrepareOAuthCommit<typeof M.OAuthConnectedSettlementDecision.Type, A>,\n    ) => Mutation<A>;\n    readonly list: (input: {\n      readonly authorization: M.OAuthConnectedUseAuthorization;\n      readonly limit: number;\n      readonly cursor?: string;\n    }) => Effect.Effect<typeof M.OAuthConnectedListResult.Type, OAuthUnavailable>;\n    /** Durable command first, current metadata policy on replay; no new factor.\n     * Missing marker/target proves neither prior ownership nor rollback. */\n    readonly inspectDisconnect: (input: {\n      readonly moduleId: typeof OAuthModuleId.Type;\n      readonly subjectId: SubjectId;\n      readonly authorization: M.OAuthConnectedUseAuthorization;\n      readonly commandId: typeof OAuthCommandId.Type;\n      readonly grantId: typeof M.OAuthGrantId.Type;\n    }) => Effect.Effect<typeof M.OAuthConnectedDisconnectInspection.Type, OAuthUnavailable>;\n    /** Local-first: atomic disable + generation/cohort barrier + immutable command +\n     * optional sealed revocation jobs. Conservative cohort-wide sibling invalidation.\n     * Pending refresh counts as unresolved. Retain global ownership while any login,\n     * grant, reservation, admission or unresolved cohort work needs it. No remote I/O. */\n    readonly disconnect: <A>(\n      input: {\n        readonly moduleId: typeof OAuthModuleId.Type;\n        readonly commandId: typeof OAuthCommandId.Type;\n        readonly grant: M.OAuthConnectedDisconnectGrant;\n        readonly authorization: M.OAuthConnectedActionAuthorization;\n        readonly revocation?: M.OAuthConnectedRevocationJob;\n        readonly retentionUntilMillis: number;\n      },\n      prepare: PrepareOAuthCommit<typeof M.OAuthConnectedDisconnectDecision.Type, A>,\n    ) => Mutation<A>;\n    readonly inspectAccess: (input: {\n      readonly authorization: M.OAuthConnectedUseAuthorization;\n      readonly grantId: typeof M.OAuthGrantId.Type;\n      readonly profileKey: typeof M.OAuthPermissionProfileKey.Type;\n    }) => Effect.Effect<typeof M.OAuthConnectedAccessInspection.Type, OAuthUnavailable>;\n    /** One fixed claim only when due, exact grant/token/cohort/use authority. Busy\n     * losers, no expired takeover/reset/renewal. Claimed work blocks cohort clearing. */\n    readonly claimRefresh: <A>(\n      input: {\n        readonly grant: M.OAuthConnectedStoredGrant;\n        readonly authorization: M.OAuthConnectedUseAuthorization;\n        readonly claimId: typeof OAuthClaimId.Type;\n        readonly nextTokenVersion: M.OAuthConnectedRefreshClaim[\"nextTokenVersion\"];\n        readonly lifetimeMillis: number;\n      },\n      prepare: PrepareOAuthCommit<typeof M.OAuthConnectedRefreshDecision.Type, A>,\n    ) => Mutation<A>;\n    /** Exact CAS plus final policy/time. Late success never resurrects: route its\n     * sealed cleanup to original unresolved cohort; old-token revoke alone cannot\n     * clear pending work. Ambiguous/expired claim invalidates both token uses and\n     * retains unresolved state; no future reuse of possibly spent refresh material. */\n    readonly settleRefresh: <A>(\n      input: {\n        readonly claim: M.OAuthConnectedRefreshClaim;\n        readonly authorization: M.OAuthConnectedUseAuthorization;\n        readonly outcome: M.OAuthConnectedRefreshOutcome;\n      },\n      prepare: PrepareOAuthCommit<typeof M.OAuthConnectedRefreshSettlement.Type, A>,\n    ) => Mutation<A>;\n    /** AFTER decrypt, exact ciphertext/context+grant/token/cohort, active subject,\n     * current policy/revisions/profile/permissions and engine expiry. One confirmed\n     * admission receipt authorizes at most one callback; it does not prove I/O ran. */\n    readonly admitUse: <A>(\n      input: {\n        readonly grant: M.OAuthConnectedStoredGrant;\n        readonly authorization: M.OAuthConnectedUseAuthorization;\n        readonly admissionId: typeof OAuthClaimId.Type;\n        readonly lifetimeMillis: number;\n      },\n      prepare: PrepareOAuthCommit<typeof M.OAuthConnectedUseAdmission.Type, A>,\n    ) => Mutation<A>;\n    /** Bounded conditional cleanup; never remove unresolved initial exchanges,\n     * refresh/revocation, ownership or cohort cutoffs, or turn expired work into new\n     * authority. Unknown external tuples retain a conservative client-registration\n     * dependency until exact cohort reconciliation or proven provider quiescence;\n     * ordinary flow retention expiry cannot release that ordering dependency. */\n    readonly cleanup: <A>(\n      input: OAuthCleanupInput,\n      prepare: PrepareOAuthCommit<typeof M.OAuthConnectedCleanupResult.Type, A>,\n    ) => Mutation<A>;\n  }\n>()(\"effect-auth/OAuthConnectedPersistence\") {}\n"],"mappings":";;;;;;;AAuBA,IAAa,4BAAb,cAA+C,QAAQ,QA2IrD,CAAC,CAAC,uCAAuC,CAAC,CAAC,CAAC"}

package/dist/oauth/OAuthConnectedProtocol.d.mts

@@ -0,0 +1,41 @@
+import { RequestBindingFlowId } from "../operations/requestBindingModels.mjs";
+import "../operations/requestBinding.mjs";
+import { OAuthProtocolRejected, OAuthUnavailable } from "./signInErrors.mjs";
+import { OAuthCallbackId, OAuthCodeResponse, OAuthProtocolPreparation, OAuthTransactionSecrets } from "./signInModels.mjs";
+import { OAuthConnectedConfiguration, OAuthConnectedGrantResponse, OAuthConnectedProfile, OAuthConnectedTokenContext, OAuthConnectedTokenMaterial } from "./connectedModels.mjs";
+import { Context, DateTime, Effect } from "effect";
+//#region src/oauth/OAuthConnectedProtocol.d.ts
+declare const OAuthConnectedProtocol_base: Context.ServiceClass<OAuthConnectedProtocol, "effect-auth/OAuthConnectedProtocol", {
+  readonly prepareAuthorization: (input: {
+    readonly profile: OAuthConnectedProfile;
+    readonly callbackId: typeof OAuthCallbackId.Type;
+    readonly flowId: RequestBindingFlowId;
+  }) => Effect.Effect<Omit<OAuthProtocolPreparation, "configuration"> & {
+    readonly configuration: OAuthConnectedConfiguration;
+  }, OAuthProtocolRejected | OAuthUnavailable>;
+  readonly exchangeGrant: (input: {
+    readonly configuration: OAuthConnectedConfiguration;
+    readonly secrets: OAuthTransactionSecrets;
+    readonly response: OAuthCodeResponse;
+    readonly verificationStartedAt: DateTime.Utc;
+  }) => Effect.Effect<OAuthConnectedGrantResponse, OAuthProtocolRejected | OAuthUnavailable>;
+  readonly refreshGrant: (input: {
+    readonly context: OAuthConnectedTokenContext;
+    readonly material: OAuthConnectedTokenMaterial;
+    readonly verificationStartedAt: DateTime.Utc;
+  }) => Effect.Effect<OAuthConnectedGrantResponse, OAuthProtocolRejected | OAuthUnavailable>;
+  readonly revokeGrant: (input: {
+    readonly context: OAuthConnectedTokenContext;
+    readonly material: OAuthConnectedTokenMaterial;
+  }) => Effect.Effect<"Confirmed", OAuthUnavailable>;
+}>;
+/** Explicit server-only token capability; ordinary OAuthProtocol stays token-free.
+ * All provider/identity/refresh/revocation HTTP stays outside database owners.
+ * Exact retained config and fixed profiles only. No automatic exchange retry.
+ * Refresh validates original identity, optional OIDC nonce/auth_time and permissions;
+ * it never upgrades authentication freshness. Unknown outcomes are unavailable.
+ * Revocation reports Confirmed only under the declared provider cohort contract. */
+declare class OAuthConnectedProtocol extends OAuthConnectedProtocol_base {}
+//#endregion
+export { OAuthConnectedProtocol };
+//# sourceMappingURL=OAuthConnectedProtocol.d.mts.map

package/dist/oauth/OAuthConnectedProtocol.mjs

@@ -0,0 +1,13 @@
+import { Context } from "effect";
+//#region src/oauth/OAuthConnectedProtocol.ts
+/** Explicit server-only token capability; ordinary OAuthProtocol stays token-free.
+* All provider/identity/refresh/revocation HTTP stays outside database owners.
+* Exact retained config and fixed profiles only. No automatic exchange retry.
+* Refresh validates original identity, optional OIDC nonce/auth_time and permissions;
+* it never upgrades authentication freshness. Unknown outcomes are unavailable.
+* Revocation reports Confirmed only under the declared provider cohort contract. */
+var OAuthConnectedProtocol = class extends Context.Service()("effect-auth/OAuthConnectedProtocol") {};
+//#endregion
+export { OAuthConnectedProtocol };
+
+//# sourceMappingURL=OAuthConnectedProtocol.mjs.map

package/dist/oauth/OAuthConnectedProtocol.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuthConnectedProtocol.mjs","names":[],"sources":["../../src/oauth/OAuthConnectedProtocol.ts"],"sourcesContent":["import { Context, type DateTime, type Effect } from \"effect\";\n\nimport type { RequestBindingFlowId } from \"../operations/requestBinding\";\nimport type {\n  OAuthConnectedConfiguration,\n  OAuthConnectedGrantResponse,\n  OAuthConnectedProfile,\n  OAuthConnectedTokenContext,\n  OAuthConnectedTokenMaterial,\n} from \"./connectedModels\";\nimport type { OAuthProtocolRejected, OAuthUnavailable } from \"./signInErrors\";\nimport type {\n  OAuthCallbackId,\n  OAuthCodeResponse,\n  OAuthProtocolPreparation,\n  OAuthTransactionSecrets,\n} from \"./signInModels\";\n\n/** Explicit server-only token capability; ordinary OAuthProtocol stays token-free.\n * All provider/identity/refresh/revocation HTTP stays outside database owners.\n * Exact retained config and fixed profiles only. No automatic exchange retry.\n * Refresh validates original identity, optional OIDC nonce/auth_time and permissions;\n * it never upgrades authentication freshness. Unknown outcomes are unavailable.\n * Revocation reports Confirmed only under the declared provider cohort contract. */\nexport class OAuthConnectedProtocol extends Context.Service<\n  OAuthConnectedProtocol,\n  {\n    readonly prepareAuthorization: (input: {\n      readonly profile: OAuthConnectedProfile;\n      readonly callbackId: typeof OAuthCallbackId.Type;\n      readonly flowId: RequestBindingFlowId;\n    }) => Effect.Effect<\n      Omit<OAuthProtocolPreparation, \"configuration\"> & {\n        readonly configuration: OAuthConnectedConfiguration;\n      },\n      OAuthProtocolRejected | OAuthUnavailable\n    >;\n    readonly exchangeGrant: (input: {\n      readonly configuration: OAuthConnectedConfiguration;\n      readonly secrets: OAuthTransactionSecrets;\n      readonly response: OAuthCodeResponse;\n      readonly verificationStartedAt: DateTime.Utc;\n    }) => Effect.Effect<OAuthConnectedGrantResponse, OAuthProtocolRejected | OAuthUnavailable>;\n    readonly refreshGrant: (input: {\n      readonly context: OAuthConnectedTokenContext;\n      readonly material: OAuthConnectedTokenMaterial;\n      readonly verificationStartedAt: DateTime.Utc;\n    }) => Effect.Effect<OAuthConnectedGrantResponse, OAuthProtocolRejected | OAuthUnavailable>;\n    readonly revokeGrant: (input: {\n      readonly context: OAuthConnectedTokenContext;\n      readonly material: OAuthConnectedTokenMaterial;\n    }) => Effect.Effect<\"Confirmed\", OAuthUnavailable>;\n  }\n>()(\"effect-auth/OAuthConnectedProtocol\") {}\n"],"mappings":";;;;;;;;AAwBA,IAAa,yBAAb,cAA4C,QAAQ,QA6BlD,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC"}

package/dist/oauth/OAuthConnectedRevocations.d.mts

@@ -0,0 +1,167 @@
+import { PreparedCommit } from "../hooks/commit.mjs";
+import { OAuthUnavailable } from "./signInErrors.mjs";
+import { OAuthClaimId, OAuthModuleId } from "./signInModels.mjs";
+import { PrepareOAuthCommit } from "./OAuthSignInPersistence.mjs";
+import { Context, Effect, Schema } from "effect";
+//#region src/oauth/OAuthConnectedRevocations.d.ts
+declare const OAuthConnectedRevocationClaim: Schema.Struct<{
+  readonly job: Schema.Struct<{
+    readonly context: Schema.Struct<{
+      readonly namespace: Schema.Literal<"effect-auth/oauth-connected-revocation-context/v1">;
+      readonly jobId: Schema.brand<Schema.String, "effect-auth/OAuthClaimId">;
+      readonly token: Schema.Struct<{
+        readonly namespace: Schema.Literal<"effect-auth/oauth-connected-token-context/v1">;
+        readonly moduleId: Schema.brand<Schema.String, "effect-auth/OAuthModuleId">;
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly identity: Schema.Struct<{
+          readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+          readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+          readonly subject: Schema.NonEmptyString;
+        }>;
+        readonly configuration: Schema.Struct<{
+          readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+          readonly protocol: Schema.Literals<readonly ["oidc", "oauth"]>;
+          readonly configurationGeneration: Schema.Int;
+          readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+          readonly responseIssuerMode: Schema.Literals<readonly ["required", "unsupported"]>;
+          readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+          readonly redirectUri: Schema.brand<Schema.String, "effect-auth/OAuthRedirectUri">;
+          readonly profile: Schema.Struct<{
+            readonly key: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+            readonly generation: Schema.Int;
+            readonly issuance: Schema.Literals<readonly ["active", "retired"]>;
+            readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+            readonly clientRegistrationId: Schema.String;
+            readonly scopes: Schema.$Array<Schema.String>;
+            readonly resources: Schema.$Array<Schema.NonEmptyString>;
+            readonly retention: Schema.Literals<readonly ["access-only", "access-and-refresh"]>;
+            readonly maximumAccessLifetimeMillis: Schema.Int;
+            readonly maximumRefreshLifetimeMillis: Schema.optionalKey<Schema.Int>;
+            readonly refreshAheadMillis: Schema.Int;
+            readonly refresh: Schema.Literals<readonly ["unsupported", "confidential", "rotating"]>;
+            readonly revocation: Schema.Literals<readonly ["unsupported", "cohort"]>;
+          }>;
+        }>;
+        readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+        readonly grantVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly tokenVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly cohortGeneration: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly metadata: Schema.Struct<{
+          readonly scopes: Schema.$Array<Schema.String>;
+          readonly resources: Schema.$Array<Schema.NonEmptyString>;
+          readonly accessExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+          readonly refreshExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+          readonly useUntilMillis: Schema.Int;
+          readonly refreshUseUntilMillis: Schema.optionalKey<Schema.Int>;
+          readonly obtainedAtMillis: Schema.Int;
+          readonly profile: Schema.optionalKey<Schema.Struct<{
+            readonly displayName: Schema.optionalKey<Schema.String>;
+            readonly handle: Schema.optionalKey<Schema.String>;
+          }>>;
+        }>;
+      }>;
+    }>;
+    readonly sealed: Schema.Struct<{
+      readonly format: Schema.Literal<"oauth-connected-xchacha20poly1305-v1">;
+      readonly keyId: Schema.String;
+      readonly nonce: Schema.String;
+      readonly ciphertext: Schema.RedactedFromValue<Schema.String>;
+    }>;
+  }>;
+  readonly claimId: Schema.brand<Schema.String, "effect-auth/OAuthClaimId">;
+  readonly claimedAtMillis: Schema.Int;
+  readonly claimExpiresAtMillis: Schema.Int;
+}>;
+type OAuthConnectedRevocationClaim = typeof OAuthConnectedRevocationClaim.Type;
+declare const OAuthConnectedRevocationDecision: Schema.Union<readonly [Schema.TaggedStruct<"Claimed", {
+  readonly claim: Schema.Struct<{
+    readonly job: Schema.Struct<{
+      readonly context: Schema.Struct<{
+        readonly namespace: Schema.Literal<"effect-auth/oauth-connected-revocation-context/v1">;
+        readonly jobId: Schema.brand<Schema.String, "effect-auth/OAuthClaimId">;
+        readonly token: Schema.Struct<{
+          readonly namespace: Schema.Literal<"effect-auth/oauth-connected-token-context/v1">;
+          readonly moduleId: Schema.brand<Schema.String, "effect-auth/OAuthModuleId">;
+          readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+          readonly identity: Schema.Struct<{
+            readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+            readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+            readonly subject: Schema.NonEmptyString;
+          }>;
+          readonly configuration: Schema.Struct<{
+            readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+            readonly protocol: Schema.Literals<readonly ["oidc", "oauth"]>;
+            readonly configurationGeneration: Schema.Int;
+            readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+            readonly responseIssuerMode: Schema.Literals<readonly ["required", "unsupported"]>;
+            readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+            readonly redirectUri: Schema.brand<Schema.String, "effect-auth/OAuthRedirectUri">;
+            readonly profile: Schema.Struct<{
+              readonly key: Schema.brand<Schema.String, "effect-auth/OAuthPermissionProfileKey">;
+              readonly generation: Schema.Int;
+              readonly issuance: Schema.Literals<readonly ["active", "retired"]>;
+              readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+              readonly clientRegistrationId: Schema.String;
+              readonly scopes: Schema.$Array<Schema.String>;
+              readonly resources: Schema.$Array<Schema.NonEmptyString>;
+              readonly retention: Schema.Literals<readonly ["access-only", "access-and-refresh"]>;
+              readonly maximumAccessLifetimeMillis: Schema.Int;
+              readonly maximumRefreshLifetimeMillis: Schema.optionalKey<Schema.Int>;
+              readonly refreshAheadMillis: Schema.Int;
+              readonly refresh: Schema.Literals<readonly ["unsupported", "confidential", "rotating"]>;
+              readonly revocation: Schema.Literals<readonly ["unsupported", "cohort"]>;
+            }>;
+          }>;
+          readonly grantId: Schema.brand<Schema.String, "effect-auth/OAuthGrantId">;
+          readonly grantVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          readonly tokenVersion: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          readonly cohortGeneration: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          readonly metadata: Schema.Struct<{
+            readonly scopes: Schema.$Array<Schema.String>;
+            readonly resources: Schema.$Array<Schema.NonEmptyString>;
+            readonly accessExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+            readonly refreshExpiresAtMillis: Schema.optionalKey<Schema.Int>;
+            readonly useUntilMillis: Schema.Int;
+            readonly refreshUseUntilMillis: Schema.optionalKey<Schema.Int>;
+            readonly obtainedAtMillis: Schema.Int;
+            readonly profile: Schema.optionalKey<Schema.Struct<{
+              readonly displayName: Schema.optionalKey<Schema.String>;
+              readonly handle: Schema.optionalKey<Schema.String>;
+            }>>;
+          }>;
+        }>;
+      }>;
+      readonly sealed: Schema.Struct<{
+        readonly format: Schema.Literal<"oauth-connected-xchacha20poly1305-v1">;
+        readonly keyId: Schema.String;
+        readonly nonce: Schema.String;
+        readonly ciphertext: Schema.RedactedFromValue<Schema.String>;
+      }>;
+    }>;
+    readonly claimId: Schema.brand<Schema.String, "effect-auth/OAuthClaimId">;
+    readonly claimedAtMillis: Schema.Int;
+    readonly claimExpiresAtMillis: Schema.Int;
+  }>;
+}>, Schema.TaggedStruct<"Empty", {}>]>;
+declare const OAuthConnectedRevocations_base: Context.ServiceClass<OAuthConnectedRevocations, "effect-auth/OAuthConnectedRevocations", {
+  readonly claim: <A>(input: {
+    readonly moduleId: typeof OAuthModuleId.Type;
+    readonly claimId: typeof OAuthClaimId.Type;
+    readonly lifetimeMillis: number;
+  }, prepare: PrepareOAuthCommit<typeof OAuthConnectedRevocationDecision.Type, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;
+  readonly settle: <A>(input: {
+    readonly claim: OAuthConnectedRevocationClaim;
+    readonly outcome: "Confirmed" | "Unknown";
+  }, prepare: PrepareOAuthCommit<{
+    readonly settled: boolean;
+  }, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;
+}>;
+/** Optional durable revocation authority sharing Disconnect's physical store.
+ * Claimed attempts never overlap by expired takeover. Retry only under explicit
+ * provider quiescence/idempotency semantics; Unknown/timeout cannot clear barriers.
+ * Cohort identity/order survives module/profile/secret rotation and queue cleanup.
+ * Confirmed job alone cannot clear outstanding refresh or earlier ambiguous work. */
+declare class OAuthConnectedRevocations extends OAuthConnectedRevocations_base {}
+//#endregion
+export { OAuthConnectedRevocationClaim, OAuthConnectedRevocationDecision, OAuthConnectedRevocations };
+//# sourceMappingURL=OAuthConnectedRevocations.d.mts.map

package/dist/oauth/OAuthConnectedRevocations.mjs

@@ -0,0 +1,21 @@
+import { OAuthClaimId, OAuthInstant } from "./signInModels.mjs";
+import { OAuthConnectedRevocationJob } from "./connectedModels.mjs";
+import { Context, Schema } from "effect";
+//#region src/oauth/OAuthConnectedRevocations.ts
+const OAuthConnectedRevocationClaim = Schema.Struct({
+	job: OAuthConnectedRevocationJob,
+	claimId: OAuthClaimId,
+	claimedAtMillis: OAuthInstant,
+	claimExpiresAtMillis: OAuthInstant
+});
+const OAuthConnectedRevocationDecision = Schema.Union([Schema.TaggedStruct("Claimed", { claim: OAuthConnectedRevocationClaim }), Schema.TaggedStruct("Empty", {})]);
+/** Optional durable revocation authority sharing Disconnect's physical store.
+* Claimed attempts never overlap by expired takeover. Retry only under explicit
+* provider quiescence/idempotency semantics; Unknown/timeout cannot clear barriers.
+* Cohort identity/order survives module/profile/secret rotation and queue cleanup.
+* Confirmed job alone cannot clear outstanding refresh or earlier ambiguous work. */
+var OAuthConnectedRevocations = class extends Context.Service()("effect-auth/OAuthConnectedRevocations") {};
+//#endregion
+export { OAuthConnectedRevocationClaim, OAuthConnectedRevocationDecision, OAuthConnectedRevocations };
+
+//# sourceMappingURL=OAuthConnectedRevocations.mjs.map

package/dist/oauth/OAuthConnectedRevocations.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuthConnectedRevocations.mjs","names":[],"sources":["../../src/oauth/OAuthConnectedRevocations.ts"],"sourcesContent":["import { Context, type Effect, Schema } from \"effect\";\n\nimport type { PreparedCommit } from \"../hooks/commit\";\nimport { OAuthConnectedRevocationJob } from \"./connectedModels\";\nimport type { PrepareOAuthCommit } from \"./OAuthSignInPersistence\";\nimport type { OAuthUnavailable } from \"./signInErrors\";\nimport type { OAuthModuleId } from \"./signInModels\";\nimport { OAuthClaimId, OAuthInstant } from \"./signInModels\";\n\nexport const OAuthConnectedRevocationClaim = Schema.Struct({\n  job: OAuthConnectedRevocationJob,\n  claimId: OAuthClaimId,\n  claimedAtMillis: OAuthInstant,\n  claimExpiresAtMillis: OAuthInstant,\n});\n\nexport type OAuthConnectedRevocationClaim = typeof OAuthConnectedRevocationClaim.Type;\n\nexport const OAuthConnectedRevocationDecision = Schema.Union([\n  Schema.TaggedStruct(\"Claimed\", { claim: OAuthConnectedRevocationClaim }),\n  Schema.TaggedStruct(\"Empty\", {}),\n]);\n\n/** Optional durable revocation authority sharing Disconnect's physical store.\n * Claimed attempts never overlap by expired takeover. Retry only under explicit\n * provider quiescence/idempotency semantics; Unknown/timeout cannot clear barriers.\n * Cohort identity/order survives module/profile/secret rotation and queue cleanup.\n * Confirmed job alone cannot clear outstanding refresh or earlier ambiguous work. */\nexport class OAuthConnectedRevocations extends Context.Service<\n  OAuthConnectedRevocations,\n  {\n    readonly claim: <A>(\n      input: {\n        readonly moduleId: typeof OAuthModuleId.Type;\n        readonly claimId: typeof OAuthClaimId.Type;\n        readonly lifetimeMillis: number;\n      },\n      prepare: PrepareOAuthCommit<typeof OAuthConnectedRevocationDecision.Type, A>,\n    ) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;\n    readonly settle: <A>(\n      input: {\n        readonly claim: OAuthConnectedRevocationClaim;\n        readonly outcome: \"Confirmed\" | \"Unknown\";\n      },\n      prepare: PrepareOAuthCommit<{ readonly settled: boolean }, A>,\n    ) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;\n  }\n>()(\"effect-auth/OAuthConnectedRevocations\") {}\n"],"mappings":";;;;AASA,MAAa,gCAAgC,OAAO,OAAO;CACzD,KAAK;CACL,SAAS;CACT,iBAAiB;CACjB,sBAAsB;AACxB,CAAC;AAID,MAAa,mCAAmC,OAAO,MAAM,CAC3D,OAAO,aAAa,WAAW,EAAE,OAAO,8BAA8B,CAAC,GACvE,OAAO,aAAa,SAAS,CAAC,CAAC,CACjC,CAAC;;;;;;AAOD,IAAa,4BAAb,cAA+C,QAAQ,QAmBrD,CAAC,CAAC,uCAAuC,CAAC,CAAC,CAAC"}

package/dist/oauth/OAuthConnectedTokenProtector.d.mts

@@ -0,0 +1,24 @@
+import { OAuthConfigurationError, OAuthUnavailable } from "./signInErrors.mjs";
+import { OAuthConnectedProtectionContext, OAuthConnectedSealedTokens, OAuthConnectedTokenMaterial } from "./connectedModels.mjs";
+import { OAuthTransactionKeyring } from "./transactionEncryption.mjs";
+import { Context, Crypto, Effect, Layer } from "effect";
+//#region src/oauth/OAuthConnectedTokenProtector.d.ts
+type OAuthConnectedTokenKeyring = OAuthTransactionKeyring;
+declare const OAuthConnectedTokenProtector_base: Context.ServiceClass<OAuthConnectedTokenProtector, "effect-auth/OAuthConnectedTokenProtector", {
+  readonly seal: (input: {
+    readonly context: OAuthConnectedProtectionContext;
+    readonly material: OAuthConnectedTokenMaterial;
+  }) => Effect.Effect<OAuthConnectedSealedTokens, OAuthUnavailable>;
+  readonly open: (input: {
+    readonly context: OAuthConnectedProtectionContext;
+    readonly sealed: OAuthConnectedSealedTokens;
+  }) => Effect.Effect<OAuthConnectedTokenMaterial, OAuthUnavailable>;
+}>;
+/** Explicit encrypted long-lived tokens; dedicated key retention covers all live
+ * grants and unresolved refresh/revocation work. Fixed typed AAD, no raw context. */
+declare class OAuthConnectedTokenProtector extends OAuthConnectedTokenProtector_base {
+  static readonly xchacha20poly1305: (keyring: OAuthConnectedTokenKeyring) => Layer.Layer<OAuthConnectedTokenProtector, OAuthConfigurationError, Crypto.Crypto>;
+}
+//#endregion
+export { OAuthConnectedTokenKeyring, OAuthConnectedTokenProtector };
+//# sourceMappingURL=OAuthConnectedTokenProtector.d.mts.map

package/dist/oauth/OAuthConnectedTokenProtector.mjs

@@ -0,0 +1,153 @@
+import { OAuthEncryptionKeyId } from "./signInModels.mjs";
+import { OAuthConfigurationError, OAuthUnavailable } from "./signInErrors.mjs";
+import { snapshotOAuthSync } from "./signInSnapshot.mjs";
+import { OAuthConnectedProtectionContext, OAuthConnectedSealedTokens, OAuthConnectedTokenMaterial } from "./connectedModels.mjs";
+import { Context, Crypto, Effect, Encoding, Layer, Redacted, Result, Schema } from "effect";
+import { xchacha20poly1305 } from "@noble/ciphers/chacha.js";
+//#region src/oauth/OAuthConnectedTokenProtector.ts
+const keyringSchema = Schema.Struct({
+	activeKeyId: OAuthEncryptionKeyId,
+	keys: Schema.Array(Schema.Struct({
+		id: OAuthEncryptionKeyId,
+		material: Schema.Redacted(Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)))
+	})).check(Schema.isMinLength(1), Schema.isMaxLength(8))
+});
+const materialCodec = Schema.fromJsonString(OAuthConnectedTokenMaterial);
+const contextCodec = Schema.fromJsonString(Schema.Tuple([
+	Schema.Literal("effect-auth/oauth-connected-token-aead/v1"),
+	OAuthConnectedSealedTokens.fields.format,
+	OAuthEncryptionKeyId,
+	OAuthConnectedProtectionContext
+]));
+const encoder = new TextEncoder();
+const decode = (value, maximum, exact) => {
+	if (value.length > Math.ceil(maximum * 4 / 3) || value.length % 4 === 1 || !/^[A-Za-z0-9_-]+$/.test(value)) throw OAuthUnavailable.make({});
+	const bytes = Result.getOrUndefined(Encoding.decodeBase64Url(value));
+	if (!bytes || bytes.length > maximum || exact !== void 0 && bytes.length !== exact || Encoding.encodeBase64Url(bytes) !== value) {
+		bytes?.fill(0);
+		throw OAuthUnavailable.make({});
+	}
+	return bytes;
+};
+const validate = (context, input) => {
+	const material = snapshotOAuthSync(OAuthConnectedTokenMaterial, input);
+	const token = context.namespace === "effect-auth/oauth-connected-token-context/v1" ? context : context.token;
+	if (token.configuration.protocol === "oidc" !== (material.continuation._tag === "Oidc") || token.configuration.profile.retention === "access-only" && material.refreshToken !== void 0) throw OAuthUnavailable.make({});
+	return material;
+};
+const aad = (context, keyId) => {
+	const json = Schema.encodeSync(contextCodec)([
+		"effect-auth/oauth-connected-token-aead/v1",
+		"oauth-connected-xchacha20poly1305-v1",
+		keyId,
+		context
+	]);
+	if (json.length > 262144) throw OAuthUnavailable.make({});
+	const bytes = encoder.encode(json);
+	if (bytes.length > 262144) {
+		bytes.fill(0);
+		throw OAuthUnavailable.make({});
+	}
+	return bytes;
+};
+const make = (keyring) => {
+	let captured;
+	try {
+		captured = snapshotOAuthSync(keyringSchema, keyring);
+	} catch {}
+	return Effect.gen(function* () {
+		if (!captured) return yield* OAuthConfigurationError.make({ reason: "keyring" });
+		const configuration = captured;
+		const { randomBytes } = yield* Crypto.Crypto;
+		const keys = yield* Effect.try({
+			try: () => {
+				const map = /* @__PURE__ */ new Map();
+				try {
+					for (const key of configuration.keys) {
+						if (map.has(key.id)) throw OAuthUnavailable.make({});
+						map.set(key.id, decode(Redacted.value(key.material), 32, 32));
+					}
+					if (!map.has(configuration.activeKeyId)) throw OAuthUnavailable.make({});
+					return map;
+				} catch (error) {
+					for (const key of map.values()) key.fill(0);
+					throw error;
+				}
+			},
+			catch: () => OAuthConfigurationError.make({ reason: "keyring" })
+		});
+		return {
+			seal: Effect.fn("OAuthConnectedTokenProtector.seal")(function* (input) {
+				const retained = yield* Effect.try({
+					try: () => {
+						const context = snapshotOAuthSync(OAuthConnectedProtectionContext, input.context);
+						return {
+							context,
+							material: validate(context, input.material)
+						};
+					},
+					catch: () => OAuthUnavailable.make({})
+				});
+				const nonce = yield* randomBytes(24).pipe(Effect.mapError(() => OAuthUnavailable.make({})));
+				return yield* Effect.try({
+					try: () => {
+						let plaintext, ciphertext, associated;
+						try {
+							plaintext = encoder.encode(Schema.encodeSync(materialCodec)(retained.material));
+							associated = aad(retained.context, configuration.activeKeyId);
+							if (plaintext.length > 98304 || nonce.length !== 24) throw OAuthUnavailable.make({});
+							ciphertext = xchacha20poly1305(keys.get(configuration.activeKeyId), nonce, associated).encrypt(plaintext);
+							return snapshotOAuthSync(OAuthConnectedSealedTokens, {
+								format: "oauth-connected-xchacha20poly1305-v1",
+								keyId: configuration.activeKeyId,
+								nonce: Encoding.encodeBase64Url(nonce),
+								ciphertext: Redacted.make(Encoding.encodeBase64Url(ciphertext))
+							});
+						} finally {
+							plaintext?.fill(0);
+							ciphertext?.fill(0);
+							associated?.fill(0);
+							nonce.fill(0);
+						}
+					},
+					catch: () => OAuthUnavailable.make({})
+				});
+			}),
+			open: Effect.fn("OAuthConnectedTokenProtector.open")((input) => Effect.try({
+				try: () => {
+					const context = snapshotOAuthSync(OAuthConnectedProtectionContext, input.context);
+					const sealed = snapshotOAuthSync(OAuthConnectedSealedTokens, input.sealed);
+					const key = keys.get(sealed.keyId);
+					if (!key) throw OAuthUnavailable.make({});
+					let nonce, ciphertext, plaintext, associated;
+					try {
+						nonce = decode(sealed.nonce, 24, 24);
+						ciphertext = decode(Redacted.value(sealed.ciphertext), 98320);
+						associated = aad(context, sealed.keyId);
+						plaintext = xchacha20poly1305(key, nonce, associated).decrypt(ciphertext);
+						if (plaintext.length > 98304) throw OAuthUnavailable.make({});
+						const json = new TextDecoder("utf-8", { fatal: true }).decode(plaintext);
+						const material = Schema.decodeSync(materialCodec)(json);
+						if (Schema.encodeSync(materialCodec)(material) !== json) throw OAuthUnavailable.make({});
+						return validate(context, material);
+					} finally {
+						nonce?.fill(0);
+						ciphertext?.fill(0);
+						plaintext?.fill(0);
+						associated?.fill(0);
+					}
+				},
+				catch: () => OAuthUnavailable.make({})
+			}))
+		};
+	});
+};
+/** Explicit encrypted long-lived tokens; dedicated key retention covers all live
+* grants and unresolved refresh/revocation work. Fixed typed AAD, no raw context. */
+var OAuthConnectedTokenProtector = class extends Context.Service()("effect-auth/OAuthConnectedTokenProtector") {
+	static xchacha20poly1305 = (keyring) => Layer.effect(this, make(keyring));
+};
+//#endregion
+export { OAuthConnectedTokenProtector };
+
+//# sourceMappingURL=OAuthConnectedTokenProtector.mjs.map

package/dist/oauth/OAuthConnectedTokenProtector.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuthConnectedTokenProtector.mjs","names":[],"sources":["../../src/oauth/OAuthConnectedTokenProtector.ts"],"sourcesContent":["// oxlint-disable-next-line import/extensions -- Noble exposes only its explicit .js subpath.\nimport { xchacha20poly1305 } from \"@noble/ciphers/chacha.js\";\nimport { Context, Crypto, Effect, Encoding, Layer, Redacted, Result, Schema } from \"effect\";\n\nimport {\n  OAuthConnectedProtectionContext,\n  OAuthConnectedSealedTokens,\n  OAuthConnectedTokenMaterial,\n} from \"./connectedModels\";\nimport { OAuthConfigurationError, OAuthUnavailable } from \"./signInErrors\";\nimport { OAuthEncryptionKeyId } from \"./signInModels\";\nimport { snapshotOAuthSync } from \"./signInSnapshot\";\nimport type { OAuthTransactionKeyring } from \"./transactionEncryption\";\n\nexport type OAuthConnectedTokenKeyring = OAuthTransactionKeyring;\n\nconst keyringSchema = Schema.Struct({\n  activeKeyId: OAuthEncryptionKeyId,\n  keys: Schema.Array(\n    Schema.Struct({\n      id: OAuthEncryptionKeyId,\n      material: Schema.Redacted(Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/))),\n    }),\n  ).check(Schema.isMinLength(1), Schema.isMaxLength(8)),\n});\n\nconst materialCodec = Schema.fromJsonString(OAuthConnectedTokenMaterial);\n\nconst contextCodec = Schema.fromJsonString(\n  Schema.Tuple([\n    Schema.Literal(\"effect-auth/oauth-connected-token-aead/v1\"),\n    OAuthConnectedSealedTokens.fields.format,\n    OAuthEncryptionKeyId,\n    OAuthConnectedProtectionContext,\n  ]),\n);\n\nconst encoder = new TextEncoder();\n\nconst decode = (value: string, maximum: number, exact?: number) => {\n  if (\n    value.length > Math.ceil((maximum * 4) / 3) ||\n    value.length % 4 === 1 ||\n    !/^[A-Za-z0-9_-]+$/.test(value)\n  )\n    throw OAuthUnavailable.make({});\n  const bytes = Result.getOrUndefined(Encoding.decodeBase64Url(value));\n\n  if (\n    !bytes ||\n    bytes.length > maximum ||\n    (exact !== undefined && bytes.length !== exact) ||\n    Encoding.encodeBase64Url(bytes) !== value\n  ) {\n    bytes?.fill(0);\n    throw OAuthUnavailable.make({});\n  }\n\n  return bytes;\n};\n\nconst validate = (context: OAuthConnectedProtectionContext, input: OAuthConnectedTokenMaterial) => {\n  const material = snapshotOAuthSync(OAuthConnectedTokenMaterial, input);\n\n  const token =\n    context.namespace === \"effect-auth/oauth-connected-token-context/v1\" ? context : context.token;\n\n  if (\n    (token.configuration.protocol === \"oidc\") !== (material.continuation._tag === \"Oidc\") ||\n    (token.configuration.profile.retention === \"access-only\" && material.refreshToken !== undefined)\n  )\n    throw OAuthUnavailable.make({});\n\n  return material;\n};\n\nconst aad = (context: OAuthConnectedProtectionContext, keyId: string) => {\n  const json = Schema.encodeSync(contextCodec)([\n    \"effect-auth/oauth-connected-token-aead/v1\",\n    \"oauth-connected-xchacha20poly1305-v1\",\n    keyId,\n    context,\n  ]);\n\n  if (json.length > 262144) throw OAuthUnavailable.make({});\n  const bytes = encoder.encode(json);\n\n  if (bytes.length > 262144) {\n    bytes.fill(0);\n    throw OAuthUnavailable.make({});\n  }\n\n  return bytes;\n};\n\nconst make = (keyring: OAuthConnectedTokenKeyring) => {\n  let captured: typeof keyringSchema.Type | undefined;\n\n  try {\n    captured = snapshotOAuthSync(keyringSchema, keyring);\n  } catch {\n    /* Layer validates. */\n  }\n\n  return Effect.gen(function* () {\n    if (!captured) return yield* OAuthConfigurationError.make({ reason: \"keyring\" });\n    const configuration = captured;\n    const { randomBytes } = yield* Crypto.Crypto;\n\n    const keys = yield* Effect.try({\n      try: () => {\n        const map = new Map<string, Uint8Array>();\n\n        try {\n          for (const key of configuration.keys) {\n            if (map.has(key.id)) throw OAuthUnavailable.make({});\n            map.set(key.id, decode(Redacted.value(key.material), 32, 32));\n          }\n          if (!map.has(configuration.activeKeyId)) throw OAuthUnavailable.make({});\n\n          return map;\n        } catch (error) {\n          for (const key of map.values()) key.fill(0);\n          throw error;\n        }\n      },\n      catch: () => OAuthConfigurationError.make({ reason: \"keyring\" }),\n    });\n\n    return {\n      seal: Effect.fn(\"OAuthConnectedTokenProtector.seal\")(function* (input: {\n        readonly context: OAuthConnectedProtectionContext;\n        readonly material: OAuthConnectedTokenMaterial;\n      }) {\n        const retained = yield* Effect.try({\n          try: () => {\n            const context = snapshotOAuthSync(OAuthConnectedProtectionContext, input.context);\n\n            return { context, material: validate(context, input.material) };\n          },\n          catch: () => OAuthUnavailable.make({}),\n        });\n\n        const nonce = yield* randomBytes(24).pipe(Effect.mapError(() => OAuthUnavailable.make({})));\n\n        return yield* Effect.try({\n          try: () => {\n            let plaintext: Uint8Array | undefined,\n              ciphertext: Uint8Array | undefined,\n              associated: Uint8Array | undefined;\n\n            try {\n              plaintext = encoder.encode(Schema.encodeSync(materialCodec)(retained.material));\n              associated = aad(retained.context, configuration.activeKeyId);\n              if (plaintext.length > 98304 || nonce.length !== 24) throw OAuthUnavailable.make({});\n              ciphertext = xchacha20poly1305(\n                keys.get(configuration.activeKeyId)!,\n                nonce,\n                associated,\n              ).encrypt(plaintext);\n\n              return snapshotOAuthSync(OAuthConnectedSealedTokens, {\n                format: \"oauth-connected-xchacha20poly1305-v1\",\n                keyId: configuration.activeKeyId,\n                nonce: Encoding.encodeBase64Url(nonce),\n                ciphertext: Redacted.make(Encoding.encodeBase64Url(ciphertext)),\n              });\n            } finally {\n              plaintext?.fill(0);\n              ciphertext?.fill(0);\n              associated?.fill(0);\n              nonce.fill(0);\n            }\n          },\n          catch: () => OAuthUnavailable.make({}),\n        });\n      }),\n      open: Effect.fn(\"OAuthConnectedTokenProtector.open\")(\n        (input: {\n          readonly context: OAuthConnectedProtectionContext;\n          readonly sealed: OAuthConnectedSealedTokens;\n        }) =>\n          Effect.try({\n            try: () => {\n              const context = snapshotOAuthSync(OAuthConnectedProtectionContext, input.context);\n              const sealed = snapshotOAuthSync(OAuthConnectedSealedTokens, input.sealed);\n              const key = keys.get(sealed.keyId);\n\n              if (!key) throw OAuthUnavailable.make({});\n\n              let nonce: Uint8Array | undefined,\n                ciphertext: Uint8Array | undefined,\n                plaintext: Uint8Array | undefined,\n                associated: Uint8Array | undefined;\n\n              try {\n                nonce = decode(sealed.nonce, 24, 24);\n                ciphertext = decode(Redacted.value(sealed.ciphertext), 98320);\n                associated = aad(context, sealed.keyId);\n                plaintext = xchacha20poly1305(key, nonce, associated).decrypt(ciphertext);\n                if (plaintext.length > 98304) throw OAuthUnavailable.make({});\n                const json = new TextDecoder(\"utf-8\", { fatal: true }).decode(plaintext);\n                const material = Schema.decodeSync(materialCodec)(json);\n\n                if (Schema.encodeSync(materialCodec)(material) !== json)\n                  throw OAuthUnavailable.make({});\n\n                return validate(context, material);\n              } finally {\n                nonce?.fill(0);\n                ciphertext?.fill(0);\n                plaintext?.fill(0);\n                associated?.fill(0);\n              }\n            },\n            catch: () => OAuthUnavailable.make({}),\n          }),\n      ),\n    };\n  });\n};\n\n/** Explicit encrypted long-lived tokens; dedicated key retention covers all live\n * grants and unresolved refresh/revocation work. Fixed typed AAD, no raw context. */\nexport class OAuthConnectedTokenProtector extends Context.Service<\n  OAuthConnectedTokenProtector,\n  {\n    readonly seal: (input: {\n      readonly context: OAuthConnectedProtectionContext;\n      readonly material: OAuthConnectedTokenMaterial;\n    }) => Effect.Effect<OAuthConnectedSealedTokens, OAuthUnavailable>;\n    readonly open: (input: {\n      readonly context: OAuthConnectedProtectionContext;\n      readonly sealed: OAuthConnectedSealedTokens;\n    }) => Effect.Effect<OAuthConnectedTokenMaterial, OAuthUnavailable>;\n  }\n>()(\"effect-auth/OAuthConnectedTokenProtector\") {\n  static readonly xchacha20poly1305 = (keyring: OAuthConnectedTokenKeyring) =>\n    Layer.effect(this, make(keyring));\n}\n"],"mappings":";;;;;;;AAgBA,MAAM,gBAAgB,OAAO,OAAO;CAClC,aAAa;CACb,MAAM,OAAO,MACX,OAAO,OAAO;EACZ,IAAI;EACJ,UAAU,OAAO,SAAS,OAAO,OAAO,MAAM,OAAO,UAAU,qBAAqB,CAAC,CAAC;CACxF,CAAC,CACH,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,gBAAgB,OAAO,eAAe,2BAA2B;AAEvE,MAAM,eAAe,OAAO,eAC1B,OAAO,MAAM;CACX,OAAO,QAAQ,2CAA2C;CAC1D,2BAA2B,OAAO;CAClC;CACA;AACF,CAAC,CACH;AAEA,MAAM,UAAU,IAAI,YAAY;AAEhC,MAAM,UAAU,OAAe,SAAiB,UAAmB;CACjE,IACE,MAAM,SAAS,KAAK,KAAM,UAAU,IAAK,CAAC,KAC1C,MAAM,SAAS,MAAM,KACrB,CAAC,mBAAmB,KAAK,KAAK,GAE9B,MAAM,iBAAiB,KAAK,CAAC,CAAC;CAChC,MAAM,QAAQ,OAAO,eAAe,SAAS,gBAAgB,KAAK,CAAC;CAEnE,IACE,CAAC,SACD,MAAM,SAAS,WACd,UAAU,KAAA,KAAa,MAAM,WAAW,SACzC,SAAS,gBAAgB,KAAK,MAAM,OACpC;EACA,OAAO,KAAK,CAAC;EACb,MAAM,iBAAiB,KAAK,CAAC,CAAC;CAChC;CAEA,OAAO;AACT;AAEA,MAAM,YAAY,SAA0C,UAAuC;CACjG,MAAM,WAAW,kBAAkB,6BAA6B,KAAK;CAErE,MAAM,QACJ,QAAQ,cAAc,iDAAiD,UAAU,QAAQ;CAE3F,IACG,MAAM,cAAc,aAAa,YAAa,SAAS,aAAa,SAAS,WAC7E,MAAM,cAAc,QAAQ,cAAc,iBAAiB,SAAS,iBAAiB,KAAA,GAEtF,MAAM,iBAAiB,KAAK,CAAC,CAAC;CAEhC,OAAO;AACT;AAEA,MAAM,OAAO,SAA0C,UAAkB;CACvE,MAAM,OAAO,OAAO,WAAW,YAAY,CAAC,CAAC;EAC3C;EACA;EACA;EACA;CACF,CAAC;CAED,IAAI,KAAK,SAAS,QAAQ,MAAM,iBAAiB,KAAK,CAAC,CAAC;CACxD,MAAM,QAAQ,QAAQ,OAAO,IAAI;CAEjC,IAAI,MAAM,SAAS,QAAQ;EACzB,MAAM,KAAK,CAAC;EACZ,MAAM,iBAAiB,KAAK,CAAC,CAAC;CAChC;CAEA,OAAO;AACT;AAEA,MAAM,QAAQ,YAAwC;CACpD,IAAI;CAEJ,IAAI;EACF,WAAW,kBAAkB,eAAe,OAAO;CACrD,QAAQ,CAER;CAEA,OAAO,OAAO,IAAI,aAAa;EAC7B,IAAI,CAAC,UAAU,OAAO,OAAO,wBAAwB,KAAK,EAAE,QAAQ,UAAU,CAAC;EAC/E,MAAM,gBAAgB;EACtB,MAAM,EAAE,gBAAgB,OAAO,OAAO;EAEtC,MAAM,OAAO,OAAO,OAAO,IAAI;GAC7B,WAAW;IACT,MAAM,sBAAM,IAAI,IAAwB;IAExC,IAAI;KACF,KAAK,MAAM,OAAO,cAAc,MAAM;MACpC,IAAI,IAAI,IAAI,IAAI,EAAE,GAAG,MAAM,iBAAiB,KAAK,CAAC,CAAC;MACnD,IAAI,IAAI,IAAI,IAAI,OAAO,SAAS,MAAM,IAAI,QAAQ,GAAG,IAAI,EAAE,CAAC;KAC9D;KACA,IAAI,CAAC,IAAI,IAAI,cAAc,WAAW,GAAG,MAAM,iBAAiB,KAAK,CAAC,CAAC;KAEvE,OAAO;IACT,SAAS,OAAO;KACd,KAAK,MAAM,OAAO,IAAI,OAAO,GAAG,IAAI,KAAK,CAAC;KAC1C,MAAM;IACR;GACF;GACA,aAAa,wBAAwB,KAAK,EAAE,QAAQ,UAAU,CAAC;EACjE,CAAC;EAED,OAAO;GACL,MAAM,OAAO,GAAG,mCAAmC,CAAC,CAAC,WAAW,OAG7D;IACD,MAAM,WAAW,OAAO,OAAO,IAAI;KACjC,WAAW;MACT,MAAM,UAAU,kBAAkB,iCAAiC,MAAM,OAAO;MAEhF,OAAO;OAAE;OAAS,UAAU,SAAS,SAAS,MAAM,QAAQ;MAAE;KAChE;KACA,aAAa,iBAAiB,KAAK,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,QAAQ,OAAO,YAAY,EAAE,CAAC,CAAC,KAAK,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC;IAE1F,OAAO,OAAO,OAAO,IAAI;KACvB,WAAW;MACT,IAAI,WACF,YACA;MAEF,IAAI;OACF,YAAY,QAAQ,OAAO,OAAO,WAAW,aAAa,CAAC,CAAC,SAAS,QAAQ,CAAC;OAC9E,aAAa,IAAI,SAAS,SAAS,cAAc,WAAW;OAC5D,IAAI,UAAU,SAAS,SAAS,MAAM,WAAW,IAAI,MAAM,iBAAiB,KAAK,CAAC,CAAC;OACnF,aAAa,kBACX,KAAK,IAAI,cAAc,WAAW,GAClC,OACA,UACF,CAAC,CAAC,QAAQ,SAAS;OAEnB,OAAO,kBAAkB,4BAA4B;QACnD,QAAQ;QACR,OAAO,cAAc;QACrB,OAAO,SAAS,gBAAgB,KAAK;QACrC,YAAY,SAAS,KAAK,SAAS,gBAAgB,UAAU,CAAC;OAChE,CAAC;MACH,UAAU;OACR,WAAW,KAAK,CAAC;OACjB,YAAY,KAAK,CAAC;OAClB,YAAY,KAAK,CAAC;OAClB,MAAM,KAAK,CAAC;MACd;KACF;KACA,aAAa,iBAAiB,KAAK,CAAC,CAAC;IACvC,CAAC;GACH,CAAC;GACD,MAAM,OAAO,GAAG,mCAAmC,CAAC,EACjD,UAIC,OAAO,IAAI;IACT,WAAW;KACT,MAAM,UAAU,kBAAkB,iCAAiC,MAAM,OAAO;KAChF,MAAM,SAAS,kBAAkB,4BAA4B,MAAM,MAAM;KACzE,MAAM,MAAM,KAAK,IAAI,OAAO,KAAK;KAEjC,IAAI,CAAC,KAAK,MAAM,iBAAiB,KAAK,CAAC,CAAC;KAExC,IAAI,OACF,YACA,WACA;KAEF,IAAI;MACF,QAAQ,OAAO,OAAO,OAAO,IAAI,EAAE;MACnC,aAAa,OAAO,SAAS,MAAM,OAAO,UAAU,GAAG,KAAK;MAC5D,aAAa,IAAI,SAAS,OAAO,KAAK;MACtC,YAAY,kBAAkB,KAAK,OAAO,UAAU,CAAC,CAAC,QAAQ,UAAU;MACxE,IAAI,UAAU,SAAS,OAAO,MAAM,iBAAiB,KAAK,CAAC,CAAC;MAC5D,MAAM,OAAO,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,OAAO,SAAS;MACvE,MAAM,WAAW,OAAO,WAAW,aAAa,CAAC,CAAC,IAAI;MAEtD,IAAI,OAAO,WAAW,aAAa,CAAC,CAAC,QAAQ,MAAM,MACjD,MAAM,iBAAiB,KAAK,CAAC,CAAC;MAEhC,OAAO,SAAS,SAAS,QAAQ;KACnC,UAAU;MACR,OAAO,KAAK,CAAC;MACb,YAAY,KAAK,CAAC;MAClB,WAAW,KAAK,CAAC;MACjB,YAAY,KAAK,CAAC;KACpB;IACF;IACA,aAAa,iBAAiB,KAAK,CAAC,CAAC;GACvC,CAAC,CACL;EACF;CACF,CAAC;AACH;;;AAIA,IAAa,+BAAb,cAAkD,QAAQ,QAYxD,CAAC,CAAC,0CAA0C,CAAC,CAAC;CAC9C,OAAgB,qBAAqB,YACnC,MAAM,OAAO,MAAM,KAAK,OAAO,CAAC;AACpC"}

package/dist/oauth/OAuthConnectedTransactionProtector.d.mts

@@ -0,0 +1,23 @@
+import { OAuthConfigurationError, OAuthUnavailable } from "./signInErrors.mjs";
+import { OAuthSealedTransaction, OAuthTransactionSecrets } from "./signInModels.mjs";
+import { OAuthConnectedTransactionContext } from "./connectedModels.mjs";
+import { OAuthTransactionKeyring } from "./transactionEncryption.mjs";
+import { Context, Effect, Layer } from "effect";
+//#region src/oauth/OAuthConnectedTransactionProtector.d.ts
+declare const OAuthConnectedTransactionProtector_base: Context.ServiceClass<OAuthConnectedTransactionProtector, "effect-auth/OAuthConnectedTransactionProtector", {
+  readonly seal: (input: {
+    readonly context: OAuthConnectedTransactionContext;
+    readonly secrets: OAuthTransactionSecrets;
+  }) => Effect.Effect<OAuthSealedTransaction, OAuthUnavailable>;
+  readonly open: (input: {
+    readonly context: OAuthConnectedTransactionContext;
+    readonly sealed: OAuthSealedTransaction;
+  }) => Effect.Effect<OAuthTransactionSecrets, OAuthUnavailable>;
+}>;
+/** Separate connected purpose. Key retention includes original claim horizons. */
+declare class OAuthConnectedTransactionProtector extends OAuthConnectedTransactionProtector_base {
+  static readonly xchacha20poly1305: (keyring: OAuthTransactionKeyring) => Layer.Layer<OAuthConnectedTransactionProtector, OAuthConfigurationError, import("effect/Crypto").Crypto>;
+}
+//#endregion
+export { OAuthConnectedTransactionProtector };
+//# sourceMappingURL=OAuthConnectedTransactionProtector.d.mts.map

package/dist/oauth/OAuthConnectedTransactionProtector.mjs

@@ -0,0 +1,37 @@
+import { OAuthSealedTransaction } from "./signInModels.mjs";
+import { OAuthUnavailable } from "./signInErrors.mjs";
+import { snapshotOAuthSync } from "./signInSnapshot.mjs";
+import { OAuthConnectedTransactionContext } from "./connectedModels.mjs";
+import { transactionEncryption } from "./transactionEncryption.mjs";
+import { Context, Layer, Schema } from "effect";
+//#region src/oauth/OAuthConnectedTransactionProtector.ts
+const codec = Schema.fromJsonString(Schema.Tuple([
+	Schema.Literal("effect-auth/oauth-connected-aead/v1"),
+	OAuthSealedTransaction.fields.format,
+	OAuthSealedTransaction.fields.keyId,
+	OAuthConnectedTransactionContext
+]));
+const encoder = new TextEncoder();
+const aad = (context, keyId) => {
+	const value = Schema.encodeSync(codec)([
+		"effect-auth/oauth-connected-aead/v1",
+		"oauth-xchacha20poly1305-v1",
+		keyId,
+		snapshotOAuthSync(OAuthConnectedTransactionContext, context)
+	]);
+	if (value.length > 262144) throw OAuthUnavailable.make({});
+	const bytes = encoder.encode(value);
+	if (bytes.length > 262144) {
+		bytes.fill(0);
+		throw OAuthUnavailable.make({});
+	}
+	return bytes;
+};
+/** Separate connected purpose. Key retention includes original claim horizons. */
+var OAuthConnectedTransactionProtector = class extends Context.Service()("effect-auth/OAuthConnectedTransactionProtector") {
+	static xchacha20poly1305 = (keyring) => Layer.effect(this, transactionEncryption(OAuthConnectedTransactionContext, aad, keyring));
+};
+//#endregion
+export { OAuthConnectedTransactionProtector };
+
+//# sourceMappingURL=OAuthConnectedTransactionProtector.mjs.map

package/dist/oauth/OAuthConnectedTransactionProtector.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuthConnectedTransactionProtector.mjs","names":[],"sources":["../../src/oauth/OAuthConnectedTransactionProtector.ts"],"sourcesContent":["import { Context, type Effect, Layer, Schema } from \"effect\";\n\nimport { OAuthConnectedTransactionContext } from \"./connectedModels\";\nimport { OAuthUnavailable } from \"./signInErrors\";\nimport type { OAuthTransactionSecrets } from \"./signInModels\";\nimport { OAuthSealedTransaction } from \"./signInModels\";\nimport { snapshotOAuthSync } from \"./signInSnapshot\";\nimport { transactionEncryption, type OAuthTransactionKeyring } from \"./transactionEncryption\";\n\nconst codec = Schema.fromJsonString(\n  Schema.Tuple([\n    Schema.Literal(\"effect-auth/oauth-connected-aead/v1\"),\n    OAuthSealedTransaction.fields.format,\n    OAuthSealedTransaction.fields.keyId,\n    OAuthConnectedTransactionContext,\n  ]),\n);\n\nconst encoder = new TextEncoder();\n\nconst aad = (context: OAuthConnectedTransactionContext, keyId: string) => {\n  const value = Schema.encodeSync(codec)([\n    \"effect-auth/oauth-connected-aead/v1\",\n    \"oauth-xchacha20poly1305-v1\",\n    keyId,\n    snapshotOAuthSync(OAuthConnectedTransactionContext, context),\n  ]);\n\n  if (value.length > 262144) throw OAuthUnavailable.make({});\n  const bytes = encoder.encode(value);\n\n  if (bytes.length > 262144) {\n    bytes.fill(0);\n    throw OAuthUnavailable.make({});\n  }\n\n  return bytes;\n};\n\n/** Separate connected purpose. Key retention includes original claim horizons. */\nexport class OAuthConnectedTransactionProtector extends Context.Service<\n  OAuthConnectedTransactionProtector,\n  {\n    readonly seal: (input: {\n      readonly context: OAuthConnectedTransactionContext;\n      readonly secrets: OAuthTransactionSecrets;\n    }) => Effect.Effect<OAuthSealedTransaction, OAuthUnavailable>;\n    readonly open: (input: {\n      readonly context: OAuthConnectedTransactionContext;\n      readonly sealed: OAuthSealedTransaction;\n    }) => Effect.Effect<OAuthTransactionSecrets, OAuthUnavailable>;\n  }\n>()(\"effect-auth/OAuthConnectedTransactionProtector\") {\n  static readonly xchacha20poly1305 = (keyring: OAuthTransactionKeyring) =>\n    Layer.effect(this, transactionEncryption(OAuthConnectedTransactionContext, aad, keyring));\n}\n"],"mappings":";;;;;;;AASA,MAAM,QAAQ,OAAO,eACnB,OAAO,MAAM;CACX,OAAO,QAAQ,qCAAqC;CACpD,uBAAuB,OAAO;CAC9B,uBAAuB,OAAO;CAC9B;AACF,CAAC,CACH;AAEA,MAAM,UAAU,IAAI,YAAY;AAEhC,MAAM,OAAO,SAA2C,UAAkB;CACxE,MAAM,QAAQ,OAAO,WAAW,KAAK,CAAC,CAAC;EACrC;EACA;EACA;EACA,kBAAkB,kCAAkC,OAAO;CAC7D,CAAC;CAED,IAAI,MAAM,SAAS,QAAQ,MAAM,iBAAiB,KAAK,CAAC,CAAC;CACzD,MAAM,QAAQ,QAAQ,OAAO,KAAK;CAElC,IAAI,MAAM,SAAS,QAAQ;EACzB,MAAM,KAAK,CAAC;EACZ,MAAM,iBAAiB,KAAK,CAAC,CAAC;CAChC;CAEA,OAAO;AACT;;AAGA,IAAa,qCAAb,cAAwD,QAAQ,QAY9D,CAAC,CAAC,gDAAgD,CAAC,CAAC;CACpD,OAAgB,qBAAqB,YACnC,MAAM,OAAO,MAAM,sBAAsB,kCAAkC,KAAK,OAAO,CAAC;AAC5F"}

package/dist/oauth/OAuthConnectedUseAuthority.d.mts

@@ -0,0 +1,22 @@
+import { AuthInvocation } from "../operations/context.mjs";
+import { OAuthRejected, OAuthUnavailable } from "./signInErrors.mjs";
+import { OAuthModuleId } from "./signInModels.mjs";
+import { OAuthConnectedUseAuthorization, OAuthGrantId, OAuthPermissionProfileKey } from "./connectedModels.mjs";
+import { Context, Effect } from "effect";
+//#region src/oauth/OAuthConnectedUseAuthority.d.ts
+declare const OAuthConnectedUseAuthority_base: Context.ServiceClass<OAuthConnectedUseAuthority, "effect-auth/OAuthConnectedUseAuthority", {
+  readonly authorize: (input: {
+    readonly invocation: AuthInvocation;
+    readonly moduleId: typeof OAuthModuleId.Type;
+    readonly purpose: "metadata" | "use";
+    readonly grantId?: typeof OAuthGrantId.Type;
+    readonly profileKey?: typeof OAuthPermissionProfileKey.Type;
+  }) => Effect.Effect<OAuthConnectedUseAuthorization, OAuthRejected | OAuthUnavailable>;
+}>;
+/** Current application metadata/use authority, not a boolean. Persistence must
+ * recheck the captured private revisions, policy and horizon in its final owner.
+ * Cross-authority rules cannot promise stronger consistency than their validity. */
+declare class OAuthConnectedUseAuthority extends OAuthConnectedUseAuthority_base {}
+//#endregion
+export { OAuthConnectedUseAuthority };
+//# sourceMappingURL=OAuthConnectedUseAuthority.d.mts.map

package/dist/oauth/OAuthConnectedUseAuthority.mjs

@@ -0,0 +1,10 @@
+import { Context } from "effect";
+//#region src/oauth/OAuthConnectedUseAuthority.ts
+/** Current application metadata/use authority, not a boolean. Persistence must
+* recheck the captured private revisions, policy and horizon in its final owner.
+* Cross-authority rules cannot promise stronger consistency than their validity. */
+var OAuthConnectedUseAuthority = class extends Context.Service()("effect-auth/OAuthConnectedUseAuthority") {};
+//#endregion
+export { OAuthConnectedUseAuthority };
+
+//# sourceMappingURL=OAuthConnectedUseAuthority.mjs.map

package/dist/oauth/OAuthConnectedUseAuthority.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuthConnectedUseAuthority.mjs","names":[],"sources":["../../src/oauth/OAuthConnectedUseAuthority.ts"],"sourcesContent":["import { Context, type Effect } from \"effect\";\n\nimport type { AuthInvocation } from \"../operations/context\";\nimport type {\n  OAuthConnectedUseAuthorization,\n  OAuthGrantId,\n  OAuthPermissionProfileKey,\n} from \"./connectedModels\";\nimport type { OAuthRejected, OAuthUnavailable } from \"./signInErrors\";\nimport type { OAuthModuleId } from \"./signInModels\";\n\n/** Current application metadata/use authority, not a boolean. Persistence must\n * recheck the captured private revisions, policy and horizon in its final owner.\n * Cross-authority rules cannot promise stronger consistency than their validity. */\nexport class OAuthConnectedUseAuthority extends Context.Service<\n  OAuthConnectedUseAuthority,\n  {\n    readonly authorize: (input: {\n      readonly invocation: AuthInvocation;\n      readonly moduleId: typeof OAuthModuleId.Type;\n      readonly purpose: \"metadata\" | \"use\";\n      readonly grantId?: typeof OAuthGrantId.Type;\n      readonly profileKey?: typeof OAuthPermissionProfileKey.Type;\n    }) => Effect.Effect<OAuthConnectedUseAuthorization, OAuthRejected | OAuthUnavailable>;\n  }\n>()(\"effect-auth/OAuthConnectedUseAuthority\") {}\n"],"mappings":";;;;;AAcA,IAAa,6BAAb,cAAgD,QAAQ,QAWtD,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAC"}