@yielded/auth 0.1.0-beta.1

package/dist/oauth/OAuthConnectionStore.d.mts

@@ -0,0 +1,33 @@
+import { SubjectId } from "../Schema.mjs";
+import { AuthStoreError } from "../Errors.mjs";
+import { OAuthConnection, OAuthProviderKey } from "./schema.mjs";
+import { Context, Effect, Layer, Option } from "effect";
+//#region src/oauth/OAuthConnectionStore.d.ts
+declare const OAuthConnectionStore_base: Context.ServiceClass<OAuthConnectionStore, "effect-auth/OAuthConnectionStore", {
+  readonly get: (provider: OAuthProviderKey, subjectId: SubjectId) => Effect.Effect<Option.Option<OAuthConnection>, AuthStoreError>;
+  readonly put: (connection: OAuthConnection) => Effect.Effect<void, AuthStoreError>;
+  readonly remove: (provider: OAuthProviderKey, subjectId: SubjectId) => Effect.Effect<void, AuthStoreError>;
+}>;
+/**
+ * Consumer-implemented persistence for provider connections, keyed by
+ * `(provider, subjectId)`. This is the package's explicit token-persistence
+ * boundary:
+ *
+ * - **Production adapters MUST encrypt the token values at rest.** The
+ *   `OAuthConnection` token fields are `Redacted`; an adapter unwraps them
+ *   with `Redacted.value` only inside its encryption boundary and re-wraps on
+ *   read. Storing the unwrapped values verbatim is a security defect.
+ * - Token values must never appear in logs, errors, or telemetry; the
+ *   `Redacted` wrapper protects accidental stringification, nothing more.
+ * - `put` replaces any existing connection for the same key.
+ */
+declare class OAuthConnectionStore extends OAuthConnectionStore_base {
+  /**
+   * In-memory adapter for tests and local development; never durable and
+   * never encrypted, so never a production adapter.
+   */
+  static readonly layerMemory: Layer.Layer<OAuthConnectionStore>;
+}
+//#endregion
+export { OAuthConnectionStore };
+//# sourceMappingURL=OAuthConnectionStore.d.mts.map

package/dist/oauth/OAuthConnectionStore.mjs

@@ -0,0 +1,38 @@
+import { Context, Effect, Layer, Option } from "effect";
+//#region src/oauth/OAuthConnectionStore.ts
+/**
+* Consumer-implemented persistence for provider connections, keyed by
+* `(provider, subjectId)`. This is the package's explicit token-persistence
+* boundary:
+*
+* - **Production adapters MUST encrypt the token values at rest.** The
+*   `OAuthConnection` token fields are `Redacted`; an adapter unwraps them
+*   with `Redacted.value` only inside its encryption boundary and re-wraps on
+*   read. Storing the unwrapped values verbatim is a security defect.
+* - Token values must never appear in logs, errors, or telemetry; the
+*   `Redacted` wrapper protects accidental stringification, nothing more.
+* - `put` replaces any existing connection for the same key.
+*/
+var OAuthConnectionStore = class OAuthConnectionStore extends Context.Service()("effect-auth/OAuthConnectionStore") {
+	/**
+	* In-memory adapter for tests and local development; never durable and
+	* never encrypted, so never a production adapter.
+	*/
+	static layerMemory = Layer.sync(OAuthConnectionStore)(() => {
+		const connections = /* @__PURE__ */ new Map();
+		const key = (provider, subjectId) => `${provider}|${subjectId}`;
+		return OAuthConnectionStore.of({
+			get: (provider, subjectId) => Effect.sync(() => Option.fromNullishOr(connections.get(key(provider, subjectId)))),
+			put: (connection) => Effect.sync(() => {
+				connections.set(key(connection.provider, connection.subjectId), connection);
+			}),
+			remove: (provider, subjectId) => Effect.sync(() => {
+				connections.delete(key(provider, subjectId));
+			})
+		});
+	});
+};
+//#endregion
+export { OAuthConnectionStore };
+
+//# sourceMappingURL=OAuthConnectionStore.mjs.map

package/dist/oauth/OAuthConnectionStore.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuthConnectionStore.mjs","names":[],"sources":["../../src/oauth/OAuthConnectionStore.ts"],"sourcesContent":["import { Context, Effect, Layer, Option } from \"effect\";\n\nimport type { AuthStoreError } from \"../Errors\";\nimport type { SubjectId } from \"../Schema\";\nimport type { OAuthConnection, OAuthProviderKey } from \"./schema\";\n\n/**\n * Consumer-implemented persistence for provider connections, keyed by\n * `(provider, subjectId)`. This is the package's explicit token-persistence\n * boundary:\n *\n * - **Production adapters MUST encrypt the token values at rest.** The\n *   `OAuthConnection` token fields are `Redacted`; an adapter unwraps them\n *   with `Redacted.value` only inside its encryption boundary and re-wraps on\n *   read. Storing the unwrapped values verbatim is a security defect.\n * - Token values must never appear in logs, errors, or telemetry; the\n *   `Redacted` wrapper protects accidental stringification, nothing more.\n * - `put` replaces any existing connection for the same key.\n */\nexport class OAuthConnectionStore extends Context.Service<\n  OAuthConnectionStore,\n  {\n    readonly get: (\n      provider: OAuthProviderKey,\n      subjectId: SubjectId,\n    ) => Effect.Effect<Option.Option<OAuthConnection>, AuthStoreError>;\n    readonly put: (connection: OAuthConnection) => Effect.Effect<void, AuthStoreError>;\n    readonly remove: (\n      provider: OAuthProviderKey,\n      subjectId: SubjectId,\n    ) => Effect.Effect<void, AuthStoreError>;\n  }\n>()(\"effect-auth/OAuthConnectionStore\") {\n  /**\n   * In-memory adapter for tests and local development; never durable and\n   * never encrypted, so never a production adapter.\n   */\n  static readonly layerMemory: Layer.Layer<OAuthConnectionStore> = Layer.sync(OAuthConnectionStore)(\n    () => {\n      const connections = new Map<string, OAuthConnection>();\n      const key = (provider: OAuthProviderKey, subjectId: SubjectId) => `${provider}|${subjectId}`;\n\n      return OAuthConnectionStore.of({\n        get: (provider, subjectId) =>\n          Effect.sync(() => Option.fromNullishOr(connections.get(key(provider, subjectId)))),\n\n        put: (connection) =>\n          Effect.sync(() => {\n            connections.set(key(connection.provider, connection.subjectId), connection);\n          }),\n\n        remove: (provider, subjectId) =>\n          Effect.sync(() => {\n            connections.delete(key(provider, subjectId));\n          }),\n      });\n    },\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;AAmBA,IAAa,uBAAb,MAAa,6BAA6B,QAAQ,QAahD,CAAC,CAAC,kCAAkC,CAAC,CAAC;;;;;CAKtC,OAAgB,cAAiD,MAAM,KAAK,oBAAoB,CAAC,OACzF;EACJ,MAAM,8BAAc,IAAI,IAA6B;EACrD,MAAM,OAAO,UAA4B,cAAyB,GAAG,SAAS,GAAG;EAEjF,OAAO,qBAAqB,GAAG;GAC7B,MAAM,UAAU,cACd,OAAO,WAAW,OAAO,cAAc,YAAY,IAAI,IAAI,UAAU,SAAS,CAAC,CAAC,CAAC;GAEnF,MAAM,eACJ,OAAO,WAAW;IAChB,YAAY,IAAI,IAAI,WAAW,UAAU,WAAW,SAAS,GAAG,UAAU;GAC5E,CAAC;GAEH,SAAS,UAAU,cACjB,OAAO,WAAW;IAChB,YAAY,OAAO,IAAI,UAAU,SAAS,CAAC;GAC7C,CAAC;EACL,CAAC;CACH,CACF;AACF"}

package/dist/oauth/OAuthLinkTransactionProtector.d.mts

@@ -0,0 +1,25 @@
+import { OAuthConfigurationError, OAuthUnavailable } from "./signInErrors.mjs";
+import { OAuthSealedTransaction, OAuthTransactionSecrets } from "./signInModels.mjs";
+import { OAuthLinkTransactionContext } from "./accountsModels.mjs";
+import { OAuthTransactionKeyring } from "./transactionEncryption.mjs";
+import { Context, Effect, Layer } from "effect";
+//#region src/oauth/OAuthLinkTransactionProtector.d.ts
+declare const OAuthLinkTransactionProtector_base: Context.ServiceClass<OAuthLinkTransactionProtector, "effect-auth/OAuthLinkTransactionProtector", {
+  readonly seal: (input: {
+    readonly context: OAuthLinkTransactionContext;
+    readonly secrets: OAuthTransactionSecrets;
+  }) => Effect.Effect<OAuthSealedTransaction, OAuthUnavailable>;
+  readonly open: (input: {
+    readonly context: OAuthLinkTransactionContext;
+    readonly sealed: OAuthSealedTransaction;
+  }) => Effect.Effect<OAuthTransactionSecrets, OAuthUnavailable>;
+}>;
+/** Typed authenticated-link domain, isolated from guest sign-in. Dedicated keyring
+ * retention covers issued and claimed link horizons and deployment convergence;
+ * link-binder signing keys have their own independent retention obligation. */
+declare class OAuthLinkTransactionProtector extends OAuthLinkTransactionProtector_base {
+  static readonly xchacha20poly1305: (keyring: OAuthTransactionKeyring) => Layer.Layer<OAuthLinkTransactionProtector, OAuthConfigurationError, import("effect/Crypto").Crypto>;
+}
+//#endregion
+export { OAuthLinkTransactionProtector };
+//# sourceMappingURL=OAuthLinkTransactionProtector.d.mts.map

package/dist/oauth/OAuthLinkTransactionProtector.mjs

@@ -0,0 +1,39 @@
+import { OAuthEncryptionKeyId, OAuthSealedTransaction } from "./signInModels.mjs";
+import { OAuthLinkTransactionContext } from "./accountsModels.mjs";
+import { OAuthUnavailable } from "./signInErrors.mjs";
+import { snapshotOAuthSync } from "./signInSnapshot.mjs";
+import { transactionEncryption } from "./transactionEncryption.mjs";
+import { Context, Layer, Schema } from "effect";
+//#region src/oauth/OAuthLinkTransactionProtector.ts
+const codec = Schema.fromJsonString(Schema.Tuple([
+	Schema.Literal("effect-auth/oauth-link-aead/v1"),
+	OAuthSealedTransaction.fields.format,
+	OAuthEncryptionKeyId,
+	OAuthLinkTransactionContext
+]));
+const encoder = new TextEncoder();
+const aad = (context, keyId) => {
+	const value = Schema.encodeSync(codec)([
+		"effect-auth/oauth-link-aead/v1",
+		"oauth-xchacha20poly1305-v1",
+		keyId,
+		snapshotOAuthSync(OAuthLinkTransactionContext, context)
+	]);
+	if (value.length > 16384) throw OAuthUnavailable.make({});
+	const bytes = encoder.encode(value);
+	if (bytes.length > 16384) {
+		bytes.fill(0);
+		throw OAuthUnavailable.make({});
+	}
+	return bytes;
+};
+/** Typed authenticated-link domain, isolated from guest sign-in. Dedicated keyring
+* retention covers issued and claimed link horizons and deployment convergence;
+* link-binder signing keys have their own independent retention obligation. */
+var OAuthLinkTransactionProtector = class extends Context.Service()("effect-auth/OAuthLinkTransactionProtector") {
+	static xchacha20poly1305 = (keyring) => Layer.effect(this, transactionEncryption(OAuthLinkTransactionContext, aad, keyring));
+};
+//#endregion
+export { OAuthLinkTransactionProtector };
+
+//# sourceMappingURL=OAuthLinkTransactionProtector.mjs.map

package/dist/oauth/OAuthLinkTransactionProtector.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuthLinkTransactionProtector.mjs","names":[],"sources":["../../src/oauth/OAuthLinkTransactionProtector.ts"],"sourcesContent":["import { Context, type Effect, Layer, Schema } from \"effect\";\n\nimport { OAuthLinkTransactionContext } from \"./accountsModels\";\nimport { OAuthUnavailable } from \"./signInErrors\";\nimport type { OAuthTransactionSecrets } from \"./signInModels\";\nimport { OAuthEncryptionKeyId, OAuthSealedTransaction } from \"./signInModels\";\nimport { snapshotOAuthSync } from \"./signInSnapshot\";\nimport { transactionEncryption, type OAuthTransactionKeyring } from \"./transactionEncryption\";\n\nconst codec = Schema.fromJsonString(\n  Schema.Tuple([\n    Schema.Literal(\"effect-auth/oauth-link-aead/v1\"),\n    OAuthSealedTransaction.fields.format,\n    OAuthEncryptionKeyId,\n    OAuthLinkTransactionContext,\n  ]),\n);\n\nconst encoder = new TextEncoder();\n\nconst aad = (context: OAuthLinkTransactionContext, keyId: string) => {\n  const value = Schema.encodeSync(codec)([\n    \"effect-auth/oauth-link-aead/v1\",\n    \"oauth-xchacha20poly1305-v1\",\n    keyId,\n    snapshotOAuthSync(OAuthLinkTransactionContext, context),\n  ]);\n\n  if (value.length > 16384) throw OAuthUnavailable.make({});\n  const bytes = encoder.encode(value);\n\n  if (bytes.length > 16384) {\n    bytes.fill(0);\n    throw OAuthUnavailable.make({});\n  }\n\n  return bytes;\n};\n\n/** Typed authenticated-link domain, isolated from guest sign-in. Dedicated keyring\n * retention covers issued and claimed link horizons and deployment convergence;\n * link-binder signing keys have their own independent retention obligation. */\nexport class OAuthLinkTransactionProtector extends Context.Service<\n  OAuthLinkTransactionProtector,\n  {\n    readonly seal: (input: {\n      readonly context: OAuthLinkTransactionContext;\n      readonly secrets: OAuthTransactionSecrets;\n    }) => Effect.Effect<OAuthSealedTransaction, OAuthUnavailable>;\n    readonly open: (input: {\n      readonly context: OAuthLinkTransactionContext;\n      readonly sealed: OAuthSealedTransaction;\n    }) => Effect.Effect<OAuthTransactionSecrets, OAuthUnavailable>;\n  }\n>()(\"effect-auth/OAuthLinkTransactionProtector\") {\n  static readonly xchacha20poly1305 = (keyring: OAuthTransactionKeyring) =>\n    Layer.effect(this, transactionEncryption(OAuthLinkTransactionContext, aad, keyring));\n}\n"],"mappings":";;;;;;;AASA,MAAM,QAAQ,OAAO,eACnB,OAAO,MAAM;CACX,OAAO,QAAQ,gCAAgC;CAC/C,uBAAuB,OAAO;CAC9B;CACA;AACF,CAAC,CACH;AAEA,MAAM,UAAU,IAAI,YAAY;AAEhC,MAAM,OAAO,SAAsC,UAAkB;CACnE,MAAM,QAAQ,OAAO,WAAW,KAAK,CAAC,CAAC;EACrC;EACA;EACA;EACA,kBAAkB,6BAA6B,OAAO;CACxD,CAAC;CAED,IAAI,MAAM,SAAS,OAAO,MAAM,iBAAiB,KAAK,CAAC,CAAC;CACxD,MAAM,QAAQ,QAAQ,OAAO,KAAK;CAElC,IAAI,MAAM,SAAS,OAAO;EACxB,MAAM,KAAK,CAAC;EACZ,MAAM,iBAAiB,KAAK,CAAC,CAAC;CAChC;CAEA,OAAO;AACT;;;;AAKA,IAAa,gCAAb,cAAmD,QAAQ,QAYzD,CAAC,CAAC,2CAA2C,CAAC,CAAC;CAC/C,OAAgB,qBAAqB,YACnC,MAAM,OAAO,MAAM,sBAAsB,6BAA6B,KAAK,OAAO,CAAC;AACvF"}

package/dist/oauth/OAuthProtocol.d.mts

@@ -0,0 +1,33 @@
+import { RequestBindingFlowId } from "../operations/requestBindingModels.mjs";
+import "../operations/requestBinding.mjs";
+import { OAuthProviderKey } from "./schema.mjs";
+import { OAuthProtocolRejected, OAuthRejected, OAuthUnavailable } from "./signInErrors.mjs";
+import { OAuthCallbackId, OAuthCodeResponse, OAuthProtocolConfiguration, OAuthProtocolPreparation, OAuthTransactionSecrets, OAuthVerifiedExternalIdentity } from "./signInModels.mjs";
+import { Context, DateTime, Effect } from "effect";
+//#region src/oauth/OAuthProtocol.d.ts
+declare const OAuthProtocol_base: Context.ServiceClass<OAuthProtocol, "effect-auth/OAuthProtocol", {
+  readonly prepareAuthorization: (input: {
+    readonly provider: OAuthProviderKey;
+    readonly callbackId: typeof OAuthCallbackId.Type;
+    readonly flowId: RequestBindingFlowId;
+  }) => Effect.Effect<OAuthProtocolPreparation, OAuthRejected | OAuthUnavailable>;
+  readonly exchangeVerifiedIdentity: (input: {
+    readonly configuration: OAuthProtocolConfiguration;
+    readonly response: OAuthCodeResponse;
+    readonly secrets: OAuthTransactionSecrets;
+    readonly verificationStartedAt: DateTime.Utc;
+  }) => Effect.Effect<OAuthVerifiedExternalIdentity, OAuthProtocolRejected | OAuthUnavailable>;
+}>;
+/** Configured protocol authority. Resolve exact captured configuration generations;
+ * preparation/exchange run outside persistence owners. Discard all provider tokens
+ * in sign-in adapters; profile/email never selects application identity.
+ * The adapter owns canonical issuer, exact configured redirect, fixed provider
+ * authorization origin/parameters, S256 and nonce validation, and retention of
+ * each configuration generation through its issued flow horizon. Never discover
+ * a caller-supplied issuer or substitute a newer configuration at completion.
+ * No network implementation is installed by the core method.
+ */
+declare class OAuthProtocol extends OAuthProtocol_base {}
+//#endregion
+export { OAuthProtocol };
+//# sourceMappingURL=OAuthProtocol.d.mts.map

package/dist/oauth/OAuthProtocol.mjs

@@ -0,0 +1,16 @@
+import { Context } from "effect";
+//#region src/oauth/OAuthProtocol.ts
+/** Configured protocol authority. Resolve exact captured configuration generations;
+* preparation/exchange run outside persistence owners. Discard all provider tokens
+* in sign-in adapters; profile/email never selects application identity.
+* The adapter owns canonical issuer, exact configured redirect, fixed provider
+* authorization origin/parameters, S256 and nonce validation, and retention of
+* each configuration generation through its issued flow horizon. Never discover
+* a caller-supplied issuer or substitute a newer configuration at completion.
+* No network implementation is installed by the core method.
+*/
+var OAuthProtocol = class extends Context.Service()("effect-auth/OAuthProtocol") {};
+//#endregion
+export { OAuthProtocol };
+
+//# sourceMappingURL=OAuthProtocol.mjs.map

package/dist/oauth/OAuthProtocol.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuthProtocol.mjs","names":[],"sources":["../../src/oauth/OAuthProtocol.ts"],"sourcesContent":["import { Context, type DateTime, type Effect } from \"effect\";\n\nimport type { RequestBindingFlowId } from \"../operations/requestBinding\";\nimport type { OAuthProviderKey } from \"./schema\";\nimport type { OAuthProtocolRejected, OAuthRejected, OAuthUnavailable } from \"./signInErrors\";\nimport type {\n  OAuthCallbackId,\n  OAuthCodeResponse,\n  OAuthProtocolConfiguration,\n  OAuthProtocolPreparation,\n  OAuthTransactionSecrets,\n  OAuthVerifiedExternalIdentity,\n} from \"./signInModels\";\n\n/** Configured protocol authority. Resolve exact captured configuration generations;\n * preparation/exchange run outside persistence owners. Discard all provider tokens\n * in sign-in adapters; profile/email never selects application identity.\n * The adapter owns canonical issuer, exact configured redirect, fixed provider\n * authorization origin/parameters, S256 and nonce validation, and retention of\n * each configuration generation through its issued flow horizon. Never discover\n * a caller-supplied issuer or substitute a newer configuration at completion.\n * No network implementation is installed by the core method.\n */\nexport class OAuthProtocol extends Context.Service<\n  OAuthProtocol,\n  {\n    readonly prepareAuthorization: (input: {\n      readonly provider: OAuthProviderKey;\n      readonly callbackId: typeof OAuthCallbackId.Type;\n      readonly flowId: RequestBindingFlowId;\n    }) => Effect.Effect<OAuthProtocolPreparation, OAuthRejected | OAuthUnavailable>;\n    readonly exchangeVerifiedIdentity: (input: {\n      readonly configuration: OAuthProtocolConfiguration;\n      readonly response: OAuthCodeResponse;\n      readonly secrets: OAuthTransactionSecrets;\n      readonly verificationStartedAt: DateTime.Utc;\n    }) => Effect.Effect<OAuthVerifiedExternalIdentity, OAuthProtocolRejected | OAuthUnavailable>;\n  }\n>()(\"effect-auth/OAuthProtocol\") {}\n"],"mappings":";;;;;;;;;;;AAuBA,IAAa,gBAAb,cAAmC,QAAQ,QAezC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC"}

package/dist/oauth/OAuthProvider.d.mts

@@ -0,0 +1,70 @@
+import { OAuthGrantRejected, OAuthProviderError } from "./errors.mjs";
+import { OAuthIdentity, OAuthProviderKey } from "./schema.mjs";
+import { Duration, Effect, Option, Redacted } from "effect";
+import { HttpClientRequest } from "effect/unstable/http";
+//#region src/oauth/OAuthProvider.d.ts
+/**
+ * One token-endpoint grant in wire-relative form: lifetimes are durations
+ * because the response carries `expires_in`, not instants. The OAuth workflow
+ * stamps absolute expirations against its own clock.
+ */
+interface OAuthTokenGrant {
+  readonly accessToken: Redacted.Redacted<string>;
+  readonly tokenType: string;
+  readonly expiresIn: Option.Option<Duration.Duration>;
+  readonly refreshToken: Option.Option<Redacted.Redacted<string>>;
+  readonly refreshTokenExpiresIn: Option.Option<Duration.Duration>;
+  readonly scope: Option.Option<string>;
+}
+/** Where and how the workflow fetches the provider's account identity. */
+interface OAuthIdentityEndpoint {
+  readonly url: string;
+  /** Static headers merged into the request; authorization is added by the workflow. */
+  readonly headers: Readonly<Record<string, string>>;
+  /** Validates the untrusted identity payload and normalizes it. */
+  readonly decode: (payload: unknown) => Effect.Effect<OAuthIdentity, OAuthProviderError>;
+}
+/**
+ * Everything provider-specific about one OAuth integration: endpoints,
+ * credentials, response mappings, and identity normalization. Deliberately
+ * data-plus-decoders — the `OAuth` workflow owns every orchestration step
+ * (state, redirects, code exchange, refresh, revocation execution), so a
+ * provider cannot diverge from the flow's security behavior.
+ */
+interface OAuthProvider {
+  readonly key: OAuthProviderKey;
+  readonly displayName: string;
+  readonly clientId: string;
+  readonly clientSecret: Redacted.Redacted<string>;
+  readonly endpoints: {
+    readonly authorization: string;
+    readonly token: string;
+  };
+  /** Scopes requested at authorization; when empty the `scope` parameter is omitted. */
+  readonly scopes: ReadonlyArray<string>;
+  /** Extra static query parameters for the authorization redirect. */
+  readonly authorizationParams: Readonly<Record<string, string>>;
+  /**
+   * Decodes one token-endpoint JSON payload into a normalized grant, or into
+   * `OAuthGrantRejected` when the payload is a well-formed OAuth error.
+   * Providers following RFC 6749 use {@link decodeStandardTokenGrant}.
+   */
+  readonly decodeTokenGrant: (payload: unknown) => Effect.Effect<OAuthTokenGrant, OAuthGrantRejected | OAuthProviderError>;
+  readonly identity: OAuthIdentityEndpoint;
+  /**
+   * Builds the provider's token-revocation request; `None` when the provider
+   * offers no revocation API. The workflow executes the request and treats
+   * 2xx and "grant already gone" statuses (404, 422) as revoked.
+   */
+  readonly revocation: Option.Option<(accessToken: Redacted.Redacted<string>) => HttpClientRequest.HttpClientRequest>;
+}
+/**
+ * Token-grant decoder for RFC 6749 token responses (`access_token`,
+ * `expires_in`, `refresh_token`, …) that also recognizes the standard
+ * `{ "error": … }` payload — which some providers, GitHub included, return
+ * with status 200.
+ */
+declare const decodeStandardTokenGrant: (provider: OAuthProviderKey) => (payload: unknown) => Effect.Effect<OAuthTokenGrant, OAuthGrantRejected | OAuthProviderError>;
+//#endregion
+export { OAuthIdentityEndpoint, OAuthProvider, OAuthTokenGrant, decodeStandardTokenGrant };
+//# sourceMappingURL=OAuthProvider.d.mts.map

package/dist/oauth/OAuthProvider.mjs

@@ -0,0 +1,39 @@
+import { OAuthGrantRejected, OAuthProviderError } from "./errors.mjs";
+import { Duration, Effect, Option, Redacted, Schema } from "effect";
+//#region src/oauth/OAuthProvider.ts
+const StandardTokenSuccess = Schema.Struct({
+	access_token: Schema.NonEmptyString,
+	token_type: Schema.optionalKey(Schema.String),
+	expires_in: Schema.optionalKey(Schema.Finite),
+	refresh_token: Schema.optionalKey(Schema.NonEmptyString),
+	refresh_token_expires_in: Schema.optionalKey(Schema.Finite),
+	scope: Schema.optionalKey(Schema.String)
+});
+const StandardTokenError = Schema.Struct({ error: Schema.NonEmptyString });
+const StandardTokenResponse = Schema.Union([StandardTokenSuccess, StandardTokenError]);
+const decodeStandardTokenResponse = Schema.decodeUnknownEffect(StandardTokenResponse);
+const positiveSeconds = (seconds) => seconds !== void 0 && seconds > 0 ? Option.some(Duration.seconds(seconds)) : Option.none();
+/**
+* Token-grant decoder for RFC 6749 token responses (`access_token`,
+* `expires_in`, `refresh_token`, …) that also recognizes the standard
+* `{ "error": … }` payload — which some providers, GitHub included, return
+* with status 200.
+*/
+const decodeStandardTokenGrant = (provider) => (payload) => decodeStandardTokenResponse(payload).pipe(Effect.mapError(() => OAuthProviderError.make({
+	provider,
+	message: "The token endpoint returned an unrecognized response"
+})), Effect.flatMap((response) => "error" in response ? OAuthGrantRejected.make({
+	provider,
+	code: response.error
+}) : Effect.succeed({
+	accessToken: Redacted.make(response.access_token),
+	tokenType: (response.token_type ?? "bearer").toLowerCase(),
+	expiresIn: positiveSeconds(response.expires_in),
+	refreshToken: response.refresh_token !== void 0 ? Option.some(Redacted.make(response.refresh_token)) : Option.none(),
+	refreshTokenExpiresIn: positiveSeconds(response.refresh_token_expires_in),
+	scope: response.scope !== void 0 && response.scope !== "" ? Option.some(response.scope) : Option.none()
+})));
+//#endregion
+export { decodeStandardTokenGrant };
+
+//# sourceMappingURL=OAuthProvider.mjs.map

package/dist/oauth/OAuthProvider.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuthProvider.mjs","names":[],"sources":["../../src/oauth/OAuthProvider.ts"],"sourcesContent":["import { Duration, Effect, Option, Redacted, Schema } from \"effect\";\nimport type { HttpClientRequest } from \"effect/unstable/http\";\n\nimport { OAuthGrantRejected, OAuthProviderError } from \"./errors\";\nimport type { OAuthIdentity, OAuthProviderKey } from \"./schema\";\n\n/**\n * One token-endpoint grant in wire-relative form: lifetimes are durations\n * because the response carries `expires_in`, not instants. The OAuth workflow\n * stamps absolute expirations against its own clock.\n */\nexport interface OAuthTokenGrant {\n  readonly accessToken: Redacted.Redacted<string>;\n  readonly tokenType: string;\n  readonly expiresIn: Option.Option<Duration.Duration>;\n  readonly refreshToken: Option.Option<Redacted.Redacted<string>>;\n  readonly refreshTokenExpiresIn: Option.Option<Duration.Duration>;\n  readonly scope: Option.Option<string>;\n}\n\n/** Where and how the workflow fetches the provider's account identity. */\nexport interface OAuthIdentityEndpoint {\n  readonly url: string;\n  /** Static headers merged into the request; authorization is added by the workflow. */\n  readonly headers: Readonly<Record<string, string>>;\n  /** Validates the untrusted identity payload and normalizes it. */\n  readonly decode: (payload: unknown) => Effect.Effect<OAuthIdentity, OAuthProviderError>;\n}\n\n/**\n * Everything provider-specific about one OAuth integration: endpoints,\n * credentials, response mappings, and identity normalization. Deliberately\n * data-plus-decoders — the `OAuth` workflow owns every orchestration step\n * (state, redirects, code exchange, refresh, revocation execution), so a\n * provider cannot diverge from the flow's security behavior.\n */\nexport interface OAuthProvider {\n  readonly key: OAuthProviderKey;\n  readonly displayName: string;\n  readonly clientId: string;\n  readonly clientSecret: Redacted.Redacted<string>;\n  readonly endpoints: {\n    readonly authorization: string;\n    readonly token: string;\n  };\n  /** Scopes requested at authorization; when empty the `scope` parameter is omitted. */\n  readonly scopes: ReadonlyArray<string>;\n  /** Extra static query parameters for the authorization redirect. */\n  readonly authorizationParams: Readonly<Record<string, string>>;\n  /**\n   * Decodes one token-endpoint JSON payload into a normalized grant, or into\n   * `OAuthGrantRejected` when the payload is a well-formed OAuth error.\n   * Providers following RFC 6749 use {@link decodeStandardTokenGrant}.\n   */\n  readonly decodeTokenGrant: (\n    payload: unknown,\n  ) => Effect.Effect<OAuthTokenGrant, OAuthGrantRejected | OAuthProviderError>;\n  readonly identity: OAuthIdentityEndpoint;\n  /**\n   * Builds the provider's token-revocation request; `None` when the provider\n   * offers no revocation API. The workflow executes the request and treats\n   * 2xx and \"grant already gone\" statuses (404, 422) as revoked.\n   */\n  readonly revocation: Option.Option<\n    (accessToken: Redacted.Redacted<string>) => HttpClientRequest.HttpClientRequest\n  >;\n}\n\n// --- Standard token responses -----------------------------------------------------\n\nconst StandardTokenSuccess = Schema.Struct({\n  access_token: Schema.NonEmptyString,\n  token_type: Schema.optionalKey(Schema.String),\n  expires_in: Schema.optionalKey(Schema.Finite),\n  refresh_token: Schema.optionalKey(Schema.NonEmptyString),\n  refresh_token_expires_in: Schema.optionalKey(Schema.Finite),\n  scope: Schema.optionalKey(Schema.String),\n});\n\nconst StandardTokenError = Schema.Struct({\n  error: Schema.NonEmptyString,\n});\n\nconst StandardTokenResponse = Schema.Union([StandardTokenSuccess, StandardTokenError]);\n\n// oxlint-disable-next-line no-restricted-properties -- Token endpoint payloads are untrusted JSON.\nconst decodeStandardTokenResponse = Schema.decodeUnknownEffect(StandardTokenResponse);\n\nconst positiveSeconds = (seconds: number | undefined): Option.Option<Duration.Duration> =>\n  seconds !== undefined && seconds > 0 ? Option.some(Duration.seconds(seconds)) : Option.none();\n\n/**\n * Token-grant decoder for RFC 6749 token responses (`access_token`,\n * `expires_in`, `refresh_token`, …) that also recognizes the standard\n * `{ \"error\": … }` payload — which some providers, GitHub included, return\n * with status 200.\n */\nexport const decodeStandardTokenGrant =\n  (provider: OAuthProviderKey) =>\n  (payload: unknown): Effect.Effect<OAuthTokenGrant, OAuthGrantRejected | OAuthProviderError> =>\n    decodeStandardTokenResponse(payload).pipe(\n      Effect.mapError(() =>\n        OAuthProviderError.make({\n          provider,\n          message: \"The token endpoint returned an unrecognized response\",\n        }),\n      ),\n      Effect.flatMap((response) =>\n        \"error\" in response\n          ? OAuthGrantRejected.make({ provider, code: response.error })\n          : Effect.succeed<OAuthTokenGrant>({\n              accessToken: Redacted.make(response.access_token),\n              tokenType: (response.token_type ?? \"bearer\").toLowerCase(),\n              expiresIn: positiveSeconds(response.expires_in),\n              refreshToken:\n                response.refresh_token !== undefined\n                  ? Option.some(Redacted.make(response.refresh_token))\n                  : Option.none(),\n              refreshTokenExpiresIn: positiveSeconds(response.refresh_token_expires_in),\n              scope:\n                response.scope !== undefined && response.scope !== \"\"\n                  ? Option.some(response.scope)\n                  : Option.none(),\n            }),\n      ),\n    );\n"],"mappings":";;;AAsEA,MAAM,uBAAuB,OAAO,OAAO;CACzC,cAAc,OAAO;CACrB,YAAY,OAAO,YAAY,OAAO,MAAM;CAC5C,YAAY,OAAO,YAAY,OAAO,MAAM;CAC5C,eAAe,OAAO,YAAY,OAAO,cAAc;CACvD,0BAA0B,OAAO,YAAY,OAAO,MAAM;CAC1D,OAAO,OAAO,YAAY,OAAO,MAAM;AACzC,CAAC;AAED,MAAM,qBAAqB,OAAO,OAAO,EACvC,OAAO,OAAO,eAChB,CAAC;AAED,MAAM,wBAAwB,OAAO,MAAM,CAAC,sBAAsB,kBAAkB,CAAC;AAGrF,MAAM,8BAA8B,OAAO,oBAAoB,qBAAqB;AAEpF,MAAM,mBAAmB,YACvB,YAAY,KAAA,KAAa,UAAU,IAAI,OAAO,KAAK,SAAS,QAAQ,OAAO,CAAC,IAAI,OAAO,KAAK;;;;;;;AAQ9F,MAAa,4BACV,cACA,YACC,4BAA4B,OAAO,CAAC,CAAC,KACnC,OAAO,eACL,mBAAmB,KAAK;CACtB;CACA,SAAS;AACX,CAAC,CACH,GACA,OAAO,SAAS,aACd,WAAW,WACP,mBAAmB,KAAK;CAAE;CAAU,MAAM,SAAS;AAAM,CAAC,IAC1D,OAAO,QAAyB;CAC9B,aAAa,SAAS,KAAK,SAAS,YAAY;CAChD,YAAY,SAAS,cAAc,SAAA,CAAU,YAAY;CACzD,WAAW,gBAAgB,SAAS,UAAU;CAC9C,cACE,SAAS,kBAAkB,KAAA,IACvB,OAAO,KAAK,SAAS,KAAK,SAAS,aAAa,CAAC,IACjD,OAAO,KAAK;CAClB,uBAAuB,gBAAgB,SAAS,wBAAwB;CACxE,OACE,SAAS,UAAU,KAAA,KAAa,SAAS,UAAU,KAC/C,OAAO,KAAK,SAAS,KAAK,IAC1B,OAAO,KAAK;AACpB,CAAC,CACP,CACF"}

package/dist/oauth/OAuthProviders.d.mts

@@ -0,0 +1,27 @@
+import { UnknownOAuthProvider } from "./errors.mjs";
+import { OAuthProviderKey } from "./schema.mjs";
+import { OAuthProvider } from "./OAuthProvider.mjs";
+import { Context, Effect, Layer } from "effect";
+//#region src/oauth/OAuthProviders.d.ts
+declare const OAuthProviders_base: Context.ServiceClass<OAuthProviders, "effect-auth/OAuthProviders", {
+  readonly lookup: (key: OAuthProviderKey) => Effect.Effect<OAuthProvider, UnknownOAuthProvider>;
+}>;
+/**
+ * The set of configured OAuth providers. Applications construct the complete
+ * set in one place, so provider selection is deterministic and duplicate keys
+ * fail during layer construction:
+ *
+ * ```ts
+ * const OAuthLive = OAuth.layer.pipe(
+ *   Layer.provide(OAuthProviders.layer([
+ *     makeGithubOAuthProvider({ clientId, clientSecret }),
+ *   ])),
+ * )
+ * ```
+ */
+declare class OAuthProviders extends OAuthProviders_base {
+  static readonly layer: (configured?: Iterable<OAuthProvider>) => Layer.Layer<OAuthProviders>;
+}
+//#endregion
+export { OAuthProviders };
+//# sourceMappingURL=OAuthProviders.d.mts.map

package/dist/oauth/OAuthProviders.mjs

@@ -0,0 +1,33 @@
+import { UnknownOAuthProvider } from "./errors.mjs";
+import { Context, Effect, Layer } from "effect";
+//#region src/oauth/OAuthProviders.ts
+/**
+* The set of configured OAuth providers. Applications construct the complete
+* set in one place, so provider selection is deterministic and duplicate keys
+* fail during layer construction:
+*
+* ```ts
+* const OAuthLive = OAuth.layer.pipe(
+*   Layer.provide(OAuthProviders.layer([
+*     makeGithubOAuthProvider({ clientId, clientSecret }),
+*   ])),
+* )
+* ```
+*/
+var OAuthProviders = class OAuthProviders extends Context.Service()("effect-auth/OAuthProviders") {
+	static layer = (configured = []) => Layer.effect(OAuthProviders, Effect.gen(function* () {
+		const providers = /* @__PURE__ */ new Map();
+		for (const provider of configured) {
+			if (providers.has(provider.key)) return yield* Effect.die(/* @__PURE__ */ new Error(`OAuth provider "${provider.key}" is configured more than once`));
+			providers.set(provider.key, provider);
+		}
+		return OAuthProviders.of({ lookup: (key) => Effect.suspend(() => {
+			const provider = providers.get(key);
+			return provider === void 0 ? Effect.fail(UnknownOAuthProvider.make({ provider: key })) : Effect.succeed(provider);
+		}) });
+	}));
+};
+//#endregion
+export { OAuthProviders };
+
+//# sourceMappingURL=OAuthProviders.mjs.map

package/dist/oauth/OAuthProviders.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuthProviders.mjs","names":[],"sources":["../../src/oauth/OAuthProviders.ts"],"sourcesContent":["import { Context, Effect, Layer } from \"effect\";\n\nimport { UnknownOAuthProvider } from \"./errors\";\nimport type { OAuthProvider } from \"./OAuthProvider\";\nimport type { OAuthProviderKey } from \"./schema\";\n\n/**\n * The set of configured OAuth providers. Applications construct the complete\n * set in one place, so provider selection is deterministic and duplicate keys\n * fail during layer construction:\n *\n * ```ts\n * const OAuthLive = OAuth.layer.pipe(\n *   Layer.provide(OAuthProviders.layer([\n *     makeGithubOAuthProvider({ clientId, clientSecret }),\n *   ])),\n * )\n * ```\n */\nexport class OAuthProviders extends Context.Service<\n  OAuthProviders,\n  {\n    readonly lookup: (key: OAuthProviderKey) => Effect.Effect<OAuthProvider, UnknownOAuthProvider>;\n  }\n>()(\"effect-auth/OAuthProviders\") {\n  static readonly layer = (configured: Iterable<OAuthProvider> = []): Layer.Layer<OAuthProviders> =>\n    Layer.effect(\n      OAuthProviders,\n      Effect.gen(function* () {\n        const providers = new Map<OAuthProviderKey, OAuthProvider>();\n\n        for (const provider of configured) {\n          if (providers.has(provider.key)) {\n            return yield* Effect.die(\n              new Error(`OAuth provider \"${provider.key}\" is configured more than once`),\n            );\n          }\n          providers.set(provider.key, provider);\n        }\n\n        return OAuthProviders.of({\n          lookup: (key) =>\n            Effect.suspend(() => {\n              const provider = providers.get(key);\n\n              return provider === undefined\n                ? Effect.fail(UnknownOAuthProvider.make({ provider: key }))\n                : Effect.succeed(provider);\n            }),\n        });\n      }),\n    );\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAmBA,IAAa,iBAAb,MAAa,uBAAuB,QAAQ,QAK1C,CAAC,CAAC,4BAA4B,CAAC,CAAC;CAChC,OAAgB,SAAS,aAAsC,CAAC,MAC9D,MAAM,OACJ,gBACA,OAAO,IAAI,aAAa;EACtB,MAAM,4BAAY,IAAI,IAAqC;EAE3D,KAAK,MAAM,YAAY,YAAY;GACjC,IAAI,UAAU,IAAI,SAAS,GAAG,GAC5B,OAAO,OAAO,OAAO,oBACnB,IAAI,MAAM,mBAAmB,SAAS,IAAI,+BAA+B,CAC3E;GAEF,UAAU,IAAI,SAAS,KAAK,QAAQ;EACtC;EAEA,OAAO,eAAe,GAAG,EACvB,SAAS,QACP,OAAO,cAAc;GACnB,MAAM,WAAW,UAAU,IAAI,GAAG;GAElC,OAAO,aAAa,KAAA,IAChB,OAAO,KAAK,qBAAqB,KAAK,EAAE,UAAU,IAAI,CAAC,CAAC,IACxD,OAAO,QAAQ,QAAQ;EAC7B,CAAC,EACL,CAAC;CACH,CAAC,CACH;AACJ"}

package/dist/oauth/OAuthRegistrationIntents.d.mts

@@ -0,0 +1,87 @@
+import { PreparedCommit } from "../hooks/commit.mjs";
+import { OAuthRegistrationIntent } from "./registrationModels.mjs";
+import { OAuthUnavailable } from "./signInErrors.mjs";
+import { OAuthClaim, OAuthVerifiedExternalIdentity } from "./signInModels.mjs";
+import { PrepareOAuthCommit } from "./OAuthSignInPersistence.mjs";
+import { Context, Effect, Schema } from "effect";
+//#region src/oauth/OAuthRegistrationIntents.d.ts
+declare const OAuthRegistrationSettlement: Schema.Union<readonly [Schema.Union<readonly [Schema.TaggedStruct<"Verified", {
+  readonly credential: Schema.Struct<{
+    readonly moduleId: Schema.brand<Schema.String, "effect-auth/OAuthModuleId">;
+    readonly identity: Schema.Struct<{
+      readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+      readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+      readonly subject: Schema.NonEmptyString;
+    }>;
+    readonly credentialId: Schema.NonEmptyString;
+    readonly credentialRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly revision: Schema.Struct<{
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly credentials: Schema.$Array<Schema.Struct<{
+        readonly credentialId: Schema.NonEmptyString;
+        readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      }>>;
+    }>;
+  }>;
+}>, Schema.TaggedStruct<"Cancelled", {}>, Schema.TaggedStruct<"Rejected", {}>, Schema.TaggedStruct<"Ambiguous", {}>]>, Schema.TaggedStruct<"RegistrationIssued", {
+  readonly intent: Schema.Struct<{
+    readonly namespace: Schema.Literal<"effect-auth/oauth-registration-intent/v1">;
+    readonly reference: Schema.brand<Schema.String, "effect-auth/OAuthRegistrationReference">;
+    readonly context: Schema.Struct<{
+      readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+      readonly protocol: Schema.Literals<readonly ["oidc", "oauth"]>;
+      readonly configurationGeneration: Schema.Int;
+      readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+      readonly responseIssuerMode: Schema.Literals<readonly ["required", "unsupported"]>;
+      readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+      readonly redirectUri: Schema.brand<Schema.String, "effect-auth/OAuthRedirectUri">;
+      readonly namespace: Schema.Literal<"effect-auth/oauth-sign-in-context/v1">;
+      readonly moduleId: Schema.brand<Schema.String, "effect-auth/OAuthModuleId">;
+      readonly generation: Schema.Int;
+      readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+      readonly commandId: Schema.brand<Schema.String, "effect-auth/OAuthCommandId">;
+      readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+      readonly stateDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+      readonly requestBindingVerifier: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+      readonly requestBindingExpiresAtMillis: Schema.Int;
+      readonly issuedAtMillis: Schema.Int;
+      readonly expiresAtMillis: Schema.Int;
+      readonly claimLifetimeMillis: Schema.Int;
+    }>;
+    readonly claimId: Schema.brand<Schema.String, "effect-auth/OAuthClaimId">;
+    readonly claimedAtMillis: Schema.Int;
+    readonly identity: Schema.Struct<{
+      readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+      readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+      readonly subject: Schema.NonEmptyString;
+    }>;
+    readonly verifiedAtMillis: Schema.Int;
+    readonly credentialDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+    readonly issuedAtMillis: Schema.Int;
+    readonly expiresAtMillis: Schema.Int;
+    readonly retentionUntilMillis: Schema.Int;
+  }>;
+}>]>;
+type OAuthRegistrationSettlement = typeof OAuthRegistrationSettlement.Type;
+declare const OAuthRegistrationIntents_base: Context.ServiceClass<OAuthRegistrationIntents, "effect-auth/OAuthRegistrationIntents", {
+  readonly settle: <A>(input: {
+    readonly claim: OAuthClaim;
+    readonly identity: OAuthVerifiedExternalIdentity;
+    readonly intent?: OAuthRegistrationIntent;
+    readonly nowMillis: number;
+  }, prepare: PrepareOAuthCommit<OAuthRegistrationSettlement, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;
+}>;
+/** Optional replacement for VERIFIED sign-in settlement, under the same flow and
+ * identity authority. Existing active credentials sign in. Only a globally unowned,
+ * currently permitted and unreserved full tuple may create the exact supplied restricted intent.
+ * Connected-only, disabled or otherwise owned identities never count as unknown.
+ * Exact claim/context/deadline CAS, terminal erasure, unique intent/reference,
+ * ownership check, and the prepared decision commit together. No provisioning.
+ * If intent is absent/expired, unknown identity commits Rejected. Retain original
+ * binder and immutable time horizons. Unknown outcomes discard every receipt.
+ */
+declare class OAuthRegistrationIntents extends OAuthRegistrationIntents_base {}
+//#endregion
+export { OAuthRegistrationIntents, OAuthRegistrationSettlement };
+//# sourceMappingURL=OAuthRegistrationIntents.d.mts.map

package/dist/oauth/OAuthRegistrationIntents.mjs

@@ -0,0 +1,19 @@
+import { OAuthSettlementDecision } from "./signInModels.mjs";
+import { OAuthRegistrationIntent } from "./registrationModels.mjs";
+import { Context, Schema } from "effect";
+//#region src/oauth/OAuthRegistrationIntents.ts
+const OAuthRegistrationSettlement = Schema.Union([OAuthSettlementDecision, Schema.TaggedStruct("RegistrationIssued", { intent: OAuthRegistrationIntent })]);
+/** Optional replacement for VERIFIED sign-in settlement, under the same flow and
+* identity authority. Existing active credentials sign in. Only a globally unowned,
+* currently permitted and unreserved full tuple may create the exact supplied restricted intent.
+* Connected-only, disabled or otherwise owned identities never count as unknown.
+* Exact claim/context/deadline CAS, terminal erasure, unique intent/reference,
+* ownership check, and the prepared decision commit together. No provisioning.
+* If intent is absent/expired, unknown identity commits Rejected. Retain original
+* binder and immutable time horizons. Unknown outcomes discard every receipt.
+*/
+var OAuthRegistrationIntents = class extends Context.Service()("effect-auth/OAuthRegistrationIntents") {};
+//#endregion
+export { OAuthRegistrationIntents, OAuthRegistrationSettlement };
+
+//# sourceMappingURL=OAuthRegistrationIntents.mjs.map

package/dist/oauth/OAuthRegistrationIntents.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuthRegistrationIntents.mjs","names":[],"sources":["../../src/oauth/OAuthRegistrationIntents.ts"],"sourcesContent":["import { Context, Schema, type Effect } from \"effect\";\n\nimport type { PreparedCommit } from \"../hooks/commit\";\nimport type { PrepareOAuthCommit } from \"./OAuthSignInPersistence\";\nimport { OAuthRegistrationIntent } from \"./registrationModels\";\nimport type { OAuthUnavailable } from \"./signInErrors\";\nimport {\n  OAuthSettlementDecision,\n  type OAuthClaim,\n  type OAuthVerifiedExternalIdentity,\n} from \"./signInModels\";\n\nexport const OAuthRegistrationSettlement = Schema.Union([\n  OAuthSettlementDecision,\n  Schema.TaggedStruct(\"RegistrationIssued\", { intent: OAuthRegistrationIntent }),\n]);\n\nexport type OAuthRegistrationSettlement = typeof OAuthRegistrationSettlement.Type;\n\n/** Optional replacement for VERIFIED sign-in settlement, under the same flow and\n * identity authority. Existing active credentials sign in. Only a globally unowned,\n * currently permitted and unreserved full tuple may create the exact supplied restricted intent.\n * Connected-only, disabled or otherwise owned identities never count as unknown.\n * Exact claim/context/deadline CAS, terminal erasure, unique intent/reference,\n * ownership check, and the prepared decision commit together. No provisioning.\n * If intent is absent/expired, unknown identity commits Rejected. Retain original\n * binder and immutable time horizons. Unknown outcomes discard every receipt.\n */\nexport class OAuthRegistrationIntents extends Context.Service<\n  OAuthRegistrationIntents,\n  {\n    readonly settle: <A>(\n      input: {\n        readonly claim: OAuthClaim;\n        readonly identity: OAuthVerifiedExternalIdentity;\n        readonly intent?: OAuthRegistrationIntent;\n        readonly nowMillis: number;\n      },\n      prepare: PrepareOAuthCommit<OAuthRegistrationSettlement, A>,\n    ) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;\n  }\n>()(\"effect-auth/OAuthRegistrationIntents\") {}\n"],"mappings":";;;;AAYA,MAAa,8BAA8B,OAAO,MAAM,CACtD,yBACA,OAAO,aAAa,sBAAsB,EAAE,QAAQ,wBAAwB,CAAC,CAC/E,CAAC;;;;;;;;;;AAaD,IAAa,2BAAb,cAA8C,QAAQ,QAapD,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC"}

package/dist/oauth/OAuthReturnTargets.d.mts

@@ -0,0 +1,15 @@
+import { OAuthConfigurationError, OAuthRejected, OAuthUnavailable } from "./signInErrors.mjs";
+import { OAuthReturnTarget } from "./signInModels.mjs";
+import { Context, Effect, Layer } from "effect";
+//#region src/oauth/OAuthReturnTargets.d.ts
+declare const OAuthReturnTargets_base: Context.ServiceClass<OAuthReturnTargets, "effect-auth/OAuthReturnTargets", {
+  readonly resolve: (input: string) => Effect.Effect<typeof OAuthReturnTarget.Type, OAuthRejected | OAuthUnavailable>;
+}>;
+/** Application authority; resolve before issuance and retain that exact route.
+ * The callback cannot select a replacement. Core never performs redirects. */
+declare class OAuthReturnTargets extends OAuthReturnTargets_base {
+  static readonly exactRoutes: (routes: ReadonlyArray<string>) => Layer.Layer<OAuthReturnTargets, OAuthConfigurationError, never>;
+}
+//#endregion
+export { OAuthReturnTargets };
+//# sourceMappingURL=OAuthReturnTargets.d.mts.map

package/dist/oauth/OAuthReturnTargets.mjs

@@ -0,0 +1,24 @@
+import { OAuthReturnTarget } from "./signInModels.mjs";
+import { OAuthConfigurationError, OAuthRejected } from "./signInErrors.mjs";
+import { Context, Effect, Layer, Schema } from "effect";
+//#region src/oauth/OAuthReturnTargets.ts
+/** Application authority; resolve before issuance and retain that exact route.
+* The callback cannot select a replacement. Core never performs redirects. */
+var OAuthReturnTargets = class OAuthReturnTargets extends Context.Service()("effect-auth/OAuthReturnTargets") {
+	static exactRoutes = (routes) => {
+		const captured = [...routes];
+		return Layer.effect(this, Effect.gen(function* () {
+			const checked = yield* Schema.decodeEffect(Schema.Array(OAuthReturnTarget).check(Schema.isMinLength(1), Schema.isMaxLength(128)))(captured).pipe(Effect.mapError(() => OAuthConfigurationError.make({ reason: "return-target" })));
+			const allowed = new Set(checked);
+			return OAuthReturnTargets.of({ resolve: Effect.fn("OAuthReturnTargets.resolve")(function* (input) {
+				const target = yield* Schema.decodeEffect(OAuthReturnTarget)(input).pipe(Effect.mapError(() => OAuthRejected.make({})));
+				if (!allowed.has(target)) return yield* OAuthRejected.make({});
+				return target;
+			}) });
+		}));
+	};
+};
+//#endregion
+export { OAuthReturnTargets };
+
+//# sourceMappingURL=OAuthReturnTargets.mjs.map

package/dist/oauth/OAuthReturnTargets.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuthReturnTargets.mjs","names":[],"sources":["../../src/oauth/OAuthReturnTargets.ts"],"sourcesContent":["import { Context, Effect, Layer, Schema } from \"effect\";\n\nimport { OAuthConfigurationError, OAuthRejected, type OAuthUnavailable } from \"./signInErrors\";\nimport { OAuthReturnTarget } from \"./signInModels\";\n\n/** Application authority; resolve before issuance and retain that exact route.\n * The callback cannot select a replacement. Core never performs redirects. */\nexport class OAuthReturnTargets extends Context.Service<\n  OAuthReturnTargets,\n  {\n    readonly resolve: (\n      input: string,\n    ) => Effect.Effect<typeof OAuthReturnTarget.Type, OAuthRejected | OAuthUnavailable>;\n  }\n>()(\"effect-auth/OAuthReturnTargets\") {\n  static readonly exactRoutes = (routes: ReadonlyArray<string>) => {\n    const captured = [...routes];\n\n    return Layer.effect(\n      this,\n      Effect.gen(function* () {\n        const checked = yield* Schema.decodeEffect(\n          Schema.Array(OAuthReturnTarget).check(Schema.isMinLength(1), Schema.isMaxLength(128)),\n        )(captured).pipe(\n          Effect.mapError(() => OAuthConfigurationError.make({ reason: \"return-target\" })),\n        );\n\n        const allowed = new Set<string>(checked);\n\n        return OAuthReturnTargets.of({\n          resolve: Effect.fn(\"OAuthReturnTargets.resolve\")(function* (input) {\n            const target = yield* Schema.decodeEffect(OAuthReturnTarget)(input).pipe(\n              Effect.mapError(() => OAuthRejected.make({})),\n            );\n\n            if (!allowed.has(target)) return yield* OAuthRejected.make({});\n\n            return target;\n          }),\n        });\n      }),\n    );\n  };\n}\n"],"mappings":";;;;;;AAOA,IAAa,qBAAb,MAAa,2BAA2B,QAAQ,QAO9C,CAAC,CAAC,gCAAgC,CAAC,CAAC;CACpC,OAAgB,eAAe,WAAkC;EAC/D,MAAM,WAAW,CAAC,GAAG,MAAM;EAE3B,OAAO,MAAM,OACX,MACA,OAAO,IAAI,aAAa;GACtB,MAAM,UAAU,OAAO,OAAO,aAC5B,OAAO,MAAM,iBAAiB,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,GAAG,CAAC,CACtF,CAAC,CAAC,QAAQ,CAAC,CAAC,KACV,OAAO,eAAe,wBAAwB,KAAK,EAAE,QAAQ,gBAAgB,CAAC,CAAC,CACjF;GAEA,MAAM,UAAU,IAAI,IAAY,OAAO;GAEvC,OAAO,mBAAmB,GAAG,EAC3B,SAAS,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAAW,OAAO;IACjE,MAAM,SAAS,OAAO,OAAO,aAAa,iBAAiB,CAAC,CAAC,KAAK,CAAC,CAAC,KAClE,OAAO,eAAe,cAAc,KAAK,CAAC,CAAC,CAAC,CAC9C;IAEA,IAAI,CAAC,QAAQ,IAAI,MAAM,GAAG,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;IAE7D,OAAO;GACT,CAAC,EACH,CAAC;EACH,CAAC,CACH;CACF;AACF"}