@yielded/auth 0.1.0-beta.1

package/dist/oauth/OAuthSignInPersistence.d.mts

@@ -0,0 +1,68 @@
+import { TokenDigest } from "../Schema.mjs";
+import { CommitJournal, PreparedCommit } from "../hooks/commit.mjs";
+import { RequestBindingFlowId } from "../operations/requestBindingModels.mjs";
+import "../operations/requestBinding.mjs";
+import { OAuthProviderKey } from "./schema.mjs";
+import { OAuthUnavailable } from "./signInErrors.mjs";
+import { OAuthCallbackId, OAuthClaim, OAuthClaimDecision, OAuthClaimId, OAuthCleanupInput, OAuthIssueDecision, OAuthIssuer, OAuthModuleId, OAuthPendingFlow, OAuthSettlementDecision, OAuthVerifiedExternalIdentity } from "./signInModels.mjs";
+import { Context, Effect } from "effect";
+//#region src/oauth/OAuthSignInPersistence.d.ts
+type PrepareOAuthCommit<Value, A> = (value: Value, journal: CommitJournal) => PreparedCommit<A>;
+declare const OAuthSignInPersistence_base: Context.ServiceClass<OAuthSignInPersistence, "effect-auth/OAuthSignInPersistence", {
+  /** Duplicate module/flow or module/command rejects; never return an existing row. */
+  readonly issue: <A>(input: OAuthPendingFlow, prepare: PrepareOAuthCommit<OAuthIssueDecision, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;
+  /** Atomically check Pending, module/generation/provider/callback/state/binder,
+   * authoritative expiry, and required/unsupported response issuer. Wrong binding
+   * does not mutate. Only one claim; no reset, lease renewal or re-exchange.
+   * Use authority time; set claimExpiresAt = claimedAt + captured claimLifetime.
+   */
+  readonly claim: <A>(input: {
+    readonly moduleId: typeof OAuthModuleId.Type;
+    readonly generation: number;
+    readonly flowId: RequestBindingFlowId;
+    readonly provider: OAuthProviderKey;
+    readonly callbackId: typeof OAuthCallbackId.Type;
+    readonly stateDigest: TokenDigest;
+    readonly requestBindingVerifier: TokenDigest;
+    readonly requestBindingExpiresAtMillis: number;
+    readonly responseIssuer?: typeof OAuthIssuer.Type;
+    readonly claimId: typeof OAuthClaimId.Type;
+    readonly nowMillis: number;
+  }, prepare: PrepareOAuthCommit<OAuthClaimDecision, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;
+  /** CAS exact claim/context/generation before the captured deadline. Erase sealed
+   * material on every terminal result. Verified resolves the full external tuple
+   * to an active subject, usable OAuth credential and matching shared factor in
+   * this same owner. No match commits Rejected, with no provisioning or session.
+   * A stale claim rejects; infrastructure/unknown outcome is unavailable.
+   */
+  readonly settle: <A>(input: {
+    readonly claim: OAuthClaim;
+    readonly outcome: {
+      readonly _tag: "Verified";
+      readonly identity: OAuthVerifiedExternalIdentity;
+    } | {
+      readonly _tag: "Cancelled" | "Rejected" | "Ambiguous";
+    };
+    readonly nowMillis: number;
+  }, prepare: PrepareOAuthCommit<OAuthSettlementDecision, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;
+  /** At most limit rows: expire Pending -> Rejected and Claimed -> Ambiguous,
+   * erasing sealed material; never make them Pending again. Remove terminal
+   * tombstones only after their original retentionUntil and claim deadline.
+   * Decode OAuthCleanupInput (integer limit 1..1000) before querying.
+   * Re-read authority time and exact status/version for each conditional write.
+   */
+  readonly cleanup: <A>(input: OAuthCleanupInput, prepare: PrepareOAuthCommit<{
+    readonly terminalized: number;
+    readonly removed: number;
+    readonly hasMore: boolean;
+  }, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;
+}>;
+/** Semantic commands with one physical authority per call. Prepare is synchronous
+ * and runs before commit; unknown outcomes discard receipts. No callback replay.
+ * Standalone adapters reject ambient owners; bound services share an explicit owner.
+ * No method accepts a bearer, callback code, plaintext transaction secret, or Claims.
+ */
+declare class OAuthSignInPersistence extends OAuthSignInPersistence_base {}
+//#endregion
+export { OAuthSignInPersistence, PrepareOAuthCommit };
+//# sourceMappingURL=OAuthSignInPersistence.d.mts.map

package/dist/oauth/OAuthSignInPersistence.mjs

@@ -0,0 +1,12 @@
+import { Context } from "effect";
+//#region src/oauth/OAuthSignInPersistence.ts
+/** Semantic commands with one physical authority per call. Prepare is synchronous
+* and runs before commit; unknown outcomes discard receipts. No callback replay.
+* Standalone adapters reject ambient owners; bound services share an explicit owner.
+* No method accepts a bearer, callback code, plaintext transaction secret, or Claims.
+*/
+var OAuthSignInPersistence = class extends Context.Service()("effect-auth/OAuthSignInPersistence") {};
+//#endregion
+export { OAuthSignInPersistence };
+
+//# sourceMappingURL=OAuthSignInPersistence.mjs.map

package/dist/oauth/OAuthSignInPersistence.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuthSignInPersistence.mjs","names":[],"sources":["../../src/oauth/OAuthSignInPersistence.ts"],"sourcesContent":["import { Context, type Effect } from \"effect\";\n\nimport type { CommitJournal, PreparedCommit } from \"../hooks/commit\";\nimport type { RequestBindingFlowId } from \"../operations/requestBinding\";\nimport type { TokenDigest } from \"../Schema\";\nimport type { OAuthProviderKey } from \"./schema\";\nimport type { OAuthUnavailable } from \"./signInErrors\";\nimport type {\n  OAuthCallbackId,\n  OAuthClaim,\n  OAuthClaimDecision,\n  OAuthClaimId,\n  OAuthCleanupInput,\n  OAuthIssueDecision,\n  OAuthIssuer,\n  OAuthModuleId,\n  OAuthPendingFlow,\n  OAuthSettlementDecision,\n  OAuthVerifiedExternalIdentity,\n} from \"./signInModels\";\n\nexport type PrepareOAuthCommit<Value, A> = (\n  value: Value,\n  journal: CommitJournal,\n) => PreparedCommit<A>;\n\n/** Semantic commands with one physical authority per call. Prepare is synchronous\n * and runs before commit; unknown outcomes discard receipts. No callback replay.\n * Standalone adapters reject ambient owners; bound services share an explicit owner.\n * No method accepts a bearer, callback code, plaintext transaction secret, or Claims.\n */\nexport class OAuthSignInPersistence extends Context.Service<\n  OAuthSignInPersistence,\n  {\n    /** Duplicate module/flow or module/command rejects; never return an existing row. */\n    readonly issue: <A>(\n      input: OAuthPendingFlow,\n      prepare: PrepareOAuthCommit<OAuthIssueDecision, A>,\n    ) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;\n    /** Atomically check Pending, module/generation/provider/callback/state/binder,\n     * authoritative expiry, and required/unsupported response issuer. Wrong binding\n     * does not mutate. Only one claim; no reset, lease renewal or re-exchange.\n     * Use authority time; set claimExpiresAt = claimedAt + captured claimLifetime.\n     */\n    readonly claim: <A>(\n      input: {\n        readonly moduleId: typeof OAuthModuleId.Type;\n        readonly generation: number;\n        readonly flowId: RequestBindingFlowId;\n        readonly provider: OAuthProviderKey;\n        readonly callbackId: typeof OAuthCallbackId.Type;\n        readonly stateDigest: TokenDigest;\n        readonly requestBindingVerifier: TokenDigest;\n        readonly requestBindingExpiresAtMillis: number;\n        readonly responseIssuer?: typeof OAuthIssuer.Type;\n        readonly claimId: typeof OAuthClaimId.Type;\n        readonly nowMillis: number;\n      },\n      prepare: PrepareOAuthCommit<OAuthClaimDecision, A>,\n    ) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;\n    /** CAS exact claim/context/generation before the captured deadline. Erase sealed\n     * material on every terminal result. Verified resolves the full external tuple\n     * to an active subject, usable OAuth credential and matching shared factor in\n     * this same owner. No match commits Rejected, with no provisioning or session.\n     * A stale claim rejects; infrastructure/unknown outcome is unavailable.\n     */\n    readonly settle: <A>(\n      input: {\n        readonly claim: OAuthClaim;\n        readonly outcome:\n          | { readonly _tag: \"Verified\"; readonly identity: OAuthVerifiedExternalIdentity }\n          | { readonly _tag: \"Cancelled\" | \"Rejected\" | \"Ambiguous\" };\n        readonly nowMillis: number;\n      },\n      prepare: PrepareOAuthCommit<OAuthSettlementDecision, A>,\n    ) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;\n    /** At most limit rows: expire Pending -> Rejected and Claimed -> Ambiguous,\n     * erasing sealed material; never make them Pending again. Remove terminal\n     * tombstones only after their original retentionUntil and claim deadline.\n     * Decode OAuthCleanupInput (integer limit 1..1000) before querying.\n     * Re-read authority time and exact status/version for each conditional write.\n     */\n    readonly cleanup: <A>(\n      input: OAuthCleanupInput,\n      prepare: PrepareOAuthCommit<\n        { readonly terminalized: number; readonly removed: number; readonly hasMore: boolean },\n        A\n      >,\n    ) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;\n  }\n>()(\"effect-auth/OAuthSignInPersistence\") {}\n"],"mappings":";;;;;;;AA+BA,IAAa,yBAAb,cAA4C,QAAQ,QA2DlD,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC"}

package/dist/oauth/OAuthStateDecisions.d.mts

@@ -0,0 +1,14 @@
+import { TokenDigest } from "../Schema.mjs";
+import { AuthStoreError } from "../Errors.mjs";
+import { ConsumeDecision } from "../auth/ConsumeDecision.mjs";
+import { OAuthState } from "./schema.mjs";
+import { Context, Effect } from "effect";
+//#region src/oauth/OAuthStateDecisions.d.ts
+declare const OAuthStateDecisions_base: Context.ServiceClass<OAuthStateDecisions, "effect-auth/OAuthStateDecisions", {
+  readonly consumeOAuthState: (digest: TokenDigest) => Effect.Effect<ConsumeDecision<OAuthState>, AuthStoreError>;
+}>;
+/** Transaction-scoped consume; translate rejection only after the owner commits. */
+declare class OAuthStateDecisions extends OAuthStateDecisions_base {}
+//#endregion
+export { OAuthStateDecisions };
+//# sourceMappingURL=OAuthStateDecisions.d.mts.map

package/dist/oauth/OAuthStateDecisions.mjs

@@ -0,0 +1,8 @@
+import { Context } from "effect";
+//#region src/oauth/OAuthStateDecisions.ts
+/** Transaction-scoped consume; translate rejection only after the owner commits. */
+var OAuthStateDecisions = class extends Context.Service()("effect-auth/OAuthStateDecisions") {};
+//#endregion
+export { OAuthStateDecisions };
+
+//# sourceMappingURL=OAuthStateDecisions.mjs.map

package/dist/oauth/OAuthStateDecisions.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuthStateDecisions.mjs","names":[],"sources":["../../src/oauth/OAuthStateDecisions.ts"],"sourcesContent":["import { Context, type Effect } from \"effect\";\n\nimport type { ConsumeDecision } from \"../auth/ConsumeDecision\";\nimport type { AuthStoreError } from \"../Errors\";\nimport type { TokenDigest } from \"../Schema\";\nimport type { OAuthState } from \"./schema\";\n\n/** Transaction-scoped consume; translate rejection only after the owner commits. */\nexport class OAuthStateDecisions extends Context.Service<\n  OAuthStateDecisions,\n  {\n    readonly consumeOAuthState: (\n      digest: TokenDigest,\n    ) => Effect.Effect<ConsumeDecision<OAuthState>, AuthStoreError>;\n  }\n>()(\"effect-auth/OAuthStateDecisions\") {}\n"],"mappings":";;;AAQA,IAAa,sBAAb,cAAyC,QAAQ,QAO/C,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC"}

package/dist/oauth/OAuthStateStore.d.mts

@@ -0,0 +1,35 @@
+import { TokenDigest } from "../Schema.mjs";
+import { AuthStoreError } from "../Errors.mjs";
+import { AuthStoreBackend } from "../AuthStore.mjs";
+import { InvalidOAuthState } from "./errors.mjs";
+import { OAuthState } from "./schema.mjs";
+import { Context, Effect, Layer } from "effect";
+//#region src/oauth/OAuthStateStore.d.ts
+declare const OAuthStateStore_base: Context.ServiceClass<OAuthStateStore, "effect-auth/OAuthStateStore", {
+  readonly issue: (state: OAuthState) => Effect.Effect<void, AuthStoreError>;
+  /**
+   * Checks existence, expiry, and prior consumption as one atomic
+   * operation, then marks the state consumed.
+   */
+  readonly consume: (stateDigest: TokenDigest) => Effect.Effect<OAuthState, InvalidOAuthState | AuthStoreError>;
+}>;
+/**
+ * Single-use persistence for pending authorization states. `consume` must be
+ * atomic: exactly one of concurrent consumptions of the same state may
+ * succeed, and every failure mode (unknown, expired, already consumed)
+ * collapses to `InvalidOAuthState`.
+ *
+ * Adapters implement the interface directly against a store with real
+ * transactions, or provide an `AuthStoreBackend` to `layerBackend` — the same
+ * backend the challenge/registration `AuthStore` uses; key namespaces are
+ * disjoint, so one backend can serve both.
+ */
+declare class OAuthStateStore extends OAuthStateStore_base {
+  /** The canonical state machine over whichever `AuthStoreBackend` is provided. */
+  static readonly layerBackend: Layer.Layer<OAuthStateStore, never, AuthStoreBackend>;
+  /** In-memory adapter for tests and local development; never durable. */
+  static readonly layerMemory: Layer.Layer<OAuthStateStore>;
+}
+//#endregion
+export { OAuthStateStore };
+//# sourceMappingURL=OAuthStateStore.d.mts.map

package/dist/oauth/OAuthStateStore.mjs

@@ -0,0 +1,64 @@
+import { AuthStoreError } from "../Errors.mjs";
+import { AuthStoreBackend } from "../AuthStore.mjs";
+import { OAuthState } from "./schema.mjs";
+import { InvalidOAuthState } from "./errors.mjs";
+import { Context, DateTime, Effect, Layer, Schema, Semaphore } from "effect";
+//#region src/oauth/OAuthStateStore.ts
+var StoredOAuthState = class extends Schema.Class("effect-auth/StoredOAuthState")({
+	state: OAuthState,
+	consumed: Schema.Boolean
+}) {};
+const decodeStateRow = Schema.decodeUnknownEffect(StoredOAuthState);
+const encodeStateRow = Schema.encodeEffect(StoredOAuthState);
+const stateKey = (stateDigest) => `oauth-state:${stateDigest}`;
+const readFailed = AuthStoreError.make({ message: "Auth store read failed" });
+const writeFailed = AuthStoreError.make({ message: "Auth store write failed" });
+const makeBackendOAuthStateStore = Effect.gen(function* () {
+	const backend = yield* AuthStoreBackend;
+	const serialized = (yield* Semaphore.make(1)).withPermits(1);
+	const issue = Effect.fn("OAuthStateStore.issue")(function* (state) {
+		const row = yield* encodeStateRow(StoredOAuthState.make({
+			state,
+			consumed: false
+		}));
+		yield* backend.put(stateKey(state.stateDigest), row);
+	}, Effect.mapError(() => writeFailed));
+	const consume = Effect.fn("OAuthStateStore.consume")(function* (stateDigest) {
+		const now = DateTime.toEpochMillis(yield* DateTime.now);
+		const value = yield* backend.get(stateKey(stateDigest)).pipe(Effect.mapError(() => readFailed));
+		if (value === void 0) return yield* InvalidOAuthState.make();
+		const row = yield* decodeStateRow(value).pipe(Effect.mapError(() => AuthStoreError.make({ message: "Corrupt auth store row" })));
+		if (row.consumed || now >= DateTime.toEpochMillis(row.state.expiresAt)) return yield* InvalidOAuthState.make();
+		const consumedRow = yield* encodeStateRow(StoredOAuthState.make({
+			...row,
+			consumed: true
+		})).pipe(Effect.mapError(() => writeFailed));
+		yield* backend.put(stateKey(stateDigest), consumedRow).pipe(Effect.mapError(() => writeFailed));
+		return row.state;
+	});
+	return {
+		issue: (state) => serialized(issue(state)),
+		consume: (stateDigest) => serialized(consume(stateDigest))
+	};
+});
+/**
+* Single-use persistence for pending authorization states. `consume` must be
+* atomic: exactly one of concurrent consumptions of the same state may
+* succeed, and every failure mode (unknown, expired, already consumed)
+* collapses to `InvalidOAuthState`.
+*
+* Adapters implement the interface directly against a store with real
+* transactions, or provide an `AuthStoreBackend` to `layerBackend` — the same
+* backend the challenge/registration `AuthStore` uses; key namespaces are
+* disjoint, so one backend can serve both.
+*/
+var OAuthStateStore = class OAuthStateStore extends Context.Service()("effect-auth/OAuthStateStore") {
+	/** The canonical state machine over whichever `AuthStoreBackend` is provided. */
+	static layerBackend = Layer.effect(OAuthStateStore)(makeBackendOAuthStateStore);
+	/** In-memory adapter for tests and local development; never durable. */
+	static layerMemory = OAuthStateStore.layerBackend.pipe(Layer.provide(AuthStoreBackend.layerMemory));
+};
+//#endregion
+export { OAuthStateStore };
+
+//# sourceMappingURL=OAuthStateStore.mjs.map

package/dist/oauth/OAuthStateStore.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuthStateStore.mjs","names":[],"sources":["../../src/oauth/OAuthStateStore.ts"],"sourcesContent":["import { Context, DateTime, Effect, Layer, Schema, Semaphore } from \"effect\";\n\nimport { AuthStoreBackend } from \"../AuthStore\";\nimport { AuthStoreError } from \"../Errors\";\nimport type { TokenDigest } from \"../Schema\";\nimport { InvalidOAuthState } from \"./errors\";\nimport { OAuthState } from \"./schema\";\n\nclass StoredOAuthState extends Schema.Class<StoredOAuthState>(\"effect-auth/StoredOAuthState\")({\n  state: OAuthState,\n  consumed: Schema.Boolean,\n}) {}\n\n// oxlint-disable-next-line no-restricted-properties -- AuthStoreBackend intentionally returns unknown persisted values.\nconst decodeStateRow = Schema.decodeUnknownEffect(StoredOAuthState);\nconst encodeStateRow = Schema.encodeEffect(StoredOAuthState);\n\nconst stateKey = (stateDigest: string) => `oauth-state:${stateDigest}`;\n\nconst readFailed = AuthStoreError.make({ message: \"Auth store read failed\" });\nconst writeFailed = AuthStoreError.make({ message: \"Auth store write failed\" });\n\nconst makeBackendOAuthStateStore = Effect.gen(function* () {\n  const backend = yield* AuthStoreBackend;\n  const semaphore = yield* Semaphore.make(1);\n  const serialized = semaphore.withPermits(1);\n\n  const issue = Effect.fn(\"OAuthStateStore.issue\")(\n    function* (state: OAuthState) {\n      const row = yield* encodeStateRow(StoredOAuthState.make({ state, consumed: false }));\n\n      yield* backend.put(stateKey(state.stateDigest), row);\n    },\n    Effect.mapError(() => writeFailed),\n  );\n\n  const consume = Effect.fn(\"OAuthStateStore.consume\")(function* (stateDigest: TokenDigest) {\n    const now = DateTime.toEpochMillis(yield* DateTime.now);\n    const value = yield* backend.get(stateKey(stateDigest)).pipe(Effect.mapError(() => readFailed));\n\n    if (value === undefined) {\n      return yield* InvalidOAuthState.make();\n    }\n\n    const row = yield* decodeStateRow(value).pipe(\n      Effect.mapError(() => AuthStoreError.make({ message: \"Corrupt auth store row\" })),\n    );\n\n    if (row.consumed || now >= DateTime.toEpochMillis(row.state.expiresAt)) {\n      return yield* InvalidOAuthState.make();\n    }\n\n    // The consumed tombstone (rather than a delete) is what makes replays of a\n    // captured callback URL fail deterministically until the row expires out.\n    const consumedRow = yield* encodeStateRow(\n      StoredOAuthState.make({ ...row, consumed: true }),\n    ).pipe(Effect.mapError(() => writeFailed));\n\n    yield* backend.put(stateKey(stateDigest), consumedRow).pipe(Effect.mapError(() => writeFailed));\n\n    return row.state;\n  });\n\n  return {\n    issue: (state: OAuthState) => serialized(issue(state)),\n    consume: (stateDigest: TokenDigest) => serialized(consume(stateDigest)),\n  };\n});\n\n/**\n * Single-use persistence for pending authorization states. `consume` must be\n * atomic: exactly one of concurrent consumptions of the same state may\n * succeed, and every failure mode (unknown, expired, already consumed)\n * collapses to `InvalidOAuthState`.\n *\n * Adapters implement the interface directly against a store with real\n * transactions, or provide an `AuthStoreBackend` to `layerBackend` — the same\n * backend the challenge/registration `AuthStore` uses; key namespaces are\n * disjoint, so one backend can serve both.\n */\nexport class OAuthStateStore extends Context.Service<\n  OAuthStateStore,\n  {\n    readonly issue: (state: OAuthState) => Effect.Effect<void, AuthStoreError>;\n    /**\n     * Checks existence, expiry, and prior consumption as one atomic\n     * operation, then marks the state consumed.\n     */\n    readonly consume: (\n      stateDigest: TokenDigest,\n    ) => Effect.Effect<OAuthState, InvalidOAuthState | AuthStoreError>;\n  }\n>()(\"effect-auth/OAuthStateStore\") {\n  /** The canonical state machine over whichever `AuthStoreBackend` is provided. */\n  static readonly layerBackend: Layer.Layer<OAuthStateStore, never, AuthStoreBackend> =\n    Layer.effect(OAuthStateStore)(makeBackendOAuthStateStore);\n\n  /** In-memory adapter for tests and local development; never durable. */\n  static readonly layerMemory: Layer.Layer<OAuthStateStore> = OAuthStateStore.layerBackend.pipe(\n    Layer.provide(AuthStoreBackend.layerMemory),\n  );\n}\n"],"mappings":";;;;;;AAQA,IAAM,mBAAN,cAA+B,OAAO,MAAwB,8BAA8B,CAAC,CAAC;CAC5F,OAAO;CACP,UAAU,OAAO;AACnB,CAAC,CAAC,CAAC,CAAC;AAGJ,MAAM,iBAAiB,OAAO,oBAAoB,gBAAgB;AAClE,MAAM,iBAAiB,OAAO,aAAa,gBAAgB;AAE3D,MAAM,YAAY,gBAAwB,eAAe;AAEzD,MAAM,aAAa,eAAe,KAAK,EAAE,SAAS,yBAAyB,CAAC;AAC5E,MAAM,cAAc,eAAe,KAAK,EAAE,SAAS,0BAA0B,CAAC;AAE9E,MAAM,6BAA6B,OAAO,IAAI,aAAa;CACzD,MAAM,UAAU,OAAO;CAEvB,MAAM,cAAa,OADM,UAAU,KAAK,CAAC,EAAA,CACZ,YAAY,CAAC;CAE1C,MAAM,QAAQ,OAAO,GAAG,uBAAuB,CAAC,CAC9C,WAAW,OAAmB;EAC5B,MAAM,MAAM,OAAO,eAAe,iBAAiB,KAAK;GAAE;GAAO,UAAU;EAAM,CAAC,CAAC;EAEnF,OAAO,QAAQ,IAAI,SAAS,MAAM,WAAW,GAAG,GAAG;CACrD,GACA,OAAO,eAAe,WAAW,CACnC;CAEA,MAAM,UAAU,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAAW,aAA0B;EACxF,MAAM,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG;EACtD,MAAM,QAAQ,OAAO,QAAQ,IAAI,SAAS,WAAW,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,UAAU,CAAC;EAE9F,IAAI,UAAU,KAAA,GACZ,OAAO,OAAO,kBAAkB,KAAK;EAGvC,MAAM,MAAM,OAAO,eAAe,KAAK,CAAC,CAAC,KACvC,OAAO,eAAe,eAAe,KAAK,EAAE,SAAS,yBAAyB,CAAC,CAAC,CAClF;EAEA,IAAI,IAAI,YAAY,OAAO,SAAS,cAAc,IAAI,MAAM,SAAS,GACnE,OAAO,OAAO,kBAAkB,KAAK;EAKvC,MAAM,cAAc,OAAO,eACzB,iBAAiB,KAAK;GAAE,GAAG;GAAK,UAAU;EAAK,CAAC,CAClD,CAAC,CAAC,KAAK,OAAO,eAAe,WAAW,CAAC;EAEzC,OAAO,QAAQ,IAAI,SAAS,WAAW,GAAG,WAAW,CAAC,CAAC,KAAK,OAAO,eAAe,WAAW,CAAC;EAE9F,OAAO,IAAI;CACb,CAAC;CAED,OAAO;EACL,QAAQ,UAAsB,WAAW,MAAM,KAAK,CAAC;EACrD,UAAU,gBAA6B,WAAW,QAAQ,WAAW,CAAC;CACxE;AACF,CAAC;;;;;;;;;;;;AAaD,IAAa,kBAAb,MAAa,wBAAwB,QAAQ,QAY3C,CAAC,CAAC,6BAA6B,CAAC,CAAC;;CAEjC,OAAgB,eACd,MAAM,OAAO,eAAe,CAAC,CAAC,0BAA0B;;CAG1D,OAAgB,cAA4C,gBAAgB,aAAa,KACvF,MAAM,QAAQ,iBAAiB,WAAW,CAC5C;AACF"}

package/dist/oauth/OAuthTransactionProtector.d.mts

@@ -0,0 +1,26 @@
+import { OAuthConfigurationError, OAuthUnavailable } from "./signInErrors.mjs";
+import { OAuthSealedTransaction, OAuthSignInTransactionContext, OAuthTransactionSecrets } from "./signInModels.mjs";
+import { OAuthTransactionKeyring } from "./transactionEncryption.mjs";
+import { Context, Effect, Layer } from "effect";
+//#region src/oauth/OAuthTransactionProtector.d.ts
+declare const OAuthTransactionProtector_base: Context.ServiceClass<OAuthTransactionProtector, "effect-auth/OAuthTransactionProtector", {
+  readonly seal: (input: {
+    readonly context: OAuthSignInTransactionContext;
+    readonly secrets: OAuthTransactionSecrets;
+  }) => Effect.Effect<OAuthSealedTransaction, OAuthUnavailable>;
+  readonly open: (input: {
+    readonly context: OAuthSignInTransactionContext;
+    readonly sealed: OAuthSealedTransaction;
+  }) => Effect.Effect<OAuthTransactionSecrets, OAuthUnavailable>;
+}>;
+/** Dedicated transaction encryption. Retain retired keys through every pending
+ * and claimed flow horizon and deployment convergence; binder signing keys have
+ * an independent retention obligation. Never reuse session or connected-token keys.
+ * Redacted prevents formatting, not memory disclosure or JavaScript zeroization.
+ */
+declare class OAuthTransactionProtector extends OAuthTransactionProtector_base {
+  static readonly xchacha20poly1305: (keyring: OAuthTransactionKeyring) => Layer.Layer<OAuthTransactionProtector, OAuthConfigurationError, import("effect/Crypto").Crypto>;
+}
+//#endregion
+export { OAuthTransactionProtector };
+//# sourceMappingURL=OAuthTransactionProtector.d.mts.map

package/dist/oauth/OAuthTransactionProtector.mjs

@@ -0,0 +1,78 @@
+import { OAuthEncryptionKeyId, OAuthSealedTransaction, OAuthSignInTransactionContext } from "./signInModels.mjs";
+import { OAuthUnavailable } from "./signInErrors.mjs";
+import { snapshotOAuthSync } from "./signInSnapshot.mjs";
+import { transactionEncryption } from "./transactionEncryption.mjs";
+import { Context, Layer, Schema } from "effect";
+//#region src/oauth/OAuthTransactionProtector.ts
+const c = OAuthSignInTransactionContext.fields;
+const aadCodec = Schema.fromJsonString(Schema.Tuple([
+	Schema.Literal("effect-auth/oauth-sign-in-aead/v1"),
+	OAuthSealedTransaction.fields.format,
+	OAuthEncryptionKeyId,
+	c.namespace,
+	c.moduleId,
+	c.generation,
+	c.flowId,
+	c.commandId,
+	c.provider,
+	c.protocol,
+	c.configurationGeneration,
+	c.issuer,
+	c.responseIssuerMode,
+	c.callbackId,
+	c.redirectUri,
+	c.returnTarget,
+	c.stateDigest,
+	c.requestBindingVerifier,
+	c.requestBindingExpiresAtMillis,
+	c.issuedAtMillis,
+	c.expiresAtMillis,
+	c.claimLifetimeMillis
+]));
+const encoder = new TextEncoder();
+const aad = (context, keyId) => {
+	const v = snapshotOAuthSync(OAuthSignInTransactionContext, context);
+	const encoded = Schema.encodeSync(aadCodec)([
+		"effect-auth/oauth-sign-in-aead/v1",
+		"oauth-xchacha20poly1305-v1",
+		keyId,
+		v.namespace,
+		v.moduleId,
+		v.generation,
+		v.flowId,
+		v.commandId,
+		v.provider,
+		v.protocol,
+		v.configurationGeneration,
+		v.issuer,
+		v.responseIssuerMode,
+		v.callbackId,
+		v.redirectUri,
+		v.returnTarget,
+		v.stateDigest,
+		v.requestBindingVerifier,
+		v.requestBindingExpiresAtMillis,
+		v.issuedAtMillis,
+		v.expiresAtMillis,
+		v.claimLifetimeMillis
+	]);
+	if (encoded.length > 16384) throw OAuthUnavailable.make({});
+	const bytes = encoder.encode(encoded);
+	if (bytes.length > 16384) {
+		bytes.fill(0);
+		throw OAuthUnavailable.make({});
+	}
+	return bytes;
+};
+/** Dedicated transaction encryption. Retain retired keys through every pending
+* and claimed flow horizon and deployment convergence; binder signing keys have
+* an independent retention obligation. Never reuse session or connected-token keys.
+* Redacted prevents formatting, not memory disclosure or JavaScript zeroization.
+*/
+var OAuthTransactionProtector = class extends Context.Service()("effect-auth/OAuthTransactionProtector") {
+	static xchacha20poly1305 = (keyring) => Layer.effect(this, transactionEncryption(OAuthSignInTransactionContext, aad, keyring));
+};
+//#endregion
+export { OAuthTransactionProtector };
+
+//# sourceMappingURL=OAuthTransactionProtector.mjs.map

package/dist/oauth/OAuthTransactionProtector.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuthTransactionProtector.mjs","names":[],"sources":["../../src/oauth/OAuthTransactionProtector.ts"],"sourcesContent":["import { Context, type Effect, Layer, Schema } from \"effect\";\n\nimport { OAuthUnavailable } from \"./signInErrors\";\nimport type { OAuthTransactionSecrets } from \"./signInModels\";\nimport {\n  OAuthEncryptionKeyId,\n  OAuthSealedTransaction,\n  OAuthSignInTransactionContext,\n} from \"./signInModels\";\nimport { snapshotOAuthSync } from \"./signInSnapshot\";\nimport { transactionEncryption, type OAuthTransactionKeyring } from \"./transactionEncryption\";\nexport type { OAuthTransactionKeyring } from \"./transactionEncryption\";\nconst c = OAuthSignInTransactionContext.fields;\n\nconst aadCodec = Schema.fromJsonString(\n  Schema.Tuple([\n    Schema.Literal(\"effect-auth/oauth-sign-in-aead/v1\"),\n    OAuthSealedTransaction.fields.format,\n    OAuthEncryptionKeyId,\n    c.namespace,\n    c.moduleId,\n    c.generation,\n    c.flowId,\n    c.commandId,\n    c.provider,\n    c.protocol,\n    c.configurationGeneration,\n    c.issuer,\n    c.responseIssuerMode,\n    c.callbackId,\n    c.redirectUri,\n    c.returnTarget,\n    c.stateDigest,\n    c.requestBindingVerifier,\n    c.requestBindingExpiresAtMillis,\n    c.issuedAtMillis,\n    c.expiresAtMillis,\n    c.claimLifetimeMillis,\n  ]),\n);\n\nconst encoder = new TextEncoder();\n\nconst aad = (context: OAuthSignInTransactionContext, keyId: string) => {\n  const v = snapshotOAuthSync(OAuthSignInTransactionContext, context);\n\n  const encoded = Schema.encodeSync(aadCodec)([\n    \"effect-auth/oauth-sign-in-aead/v1\",\n    \"oauth-xchacha20poly1305-v1\",\n    keyId,\n    v.namespace,\n    v.moduleId,\n    v.generation,\n    v.flowId,\n    v.commandId,\n    v.provider,\n    v.protocol,\n    v.configurationGeneration,\n    v.issuer,\n    v.responseIssuerMode,\n    v.callbackId,\n    v.redirectUri,\n    v.returnTarget,\n    v.stateDigest,\n    v.requestBindingVerifier,\n    v.requestBindingExpiresAtMillis,\n    v.issuedAtMillis,\n    v.expiresAtMillis,\n    v.claimLifetimeMillis,\n  ]);\n\n  if (encoded.length > 16384) throw OAuthUnavailable.make({});\n  const bytes = encoder.encode(encoded);\n\n  if (bytes.length > 16384) {\n    bytes.fill(0);\n    throw OAuthUnavailable.make({});\n  }\n\n  return bytes;\n};\n\n/** Dedicated transaction encryption. Retain retired keys through every pending\n * and claimed flow horizon and deployment convergence; binder signing keys have\n * an independent retention obligation. Never reuse session or connected-token keys.\n * Redacted prevents formatting, not memory disclosure or JavaScript zeroization.\n */\nexport class OAuthTransactionProtector extends Context.Service<\n  OAuthTransactionProtector,\n  {\n    readonly seal: (input: {\n      readonly context: OAuthSignInTransactionContext;\n      readonly secrets: OAuthTransactionSecrets;\n    }) => Effect.Effect<OAuthSealedTransaction, OAuthUnavailable>;\n    readonly open: (input: {\n      readonly context: OAuthSignInTransactionContext;\n      readonly sealed: OAuthSealedTransaction;\n    }) => Effect.Effect<OAuthTransactionSecrets, OAuthUnavailable>;\n  }\n>()(\"effect-auth/OAuthTransactionProtector\") {\n  static readonly xchacha20poly1305 = (keyring: OAuthTransactionKeyring) =>\n    Layer.effect(this, transactionEncryption(OAuthSignInTransactionContext, aad, keyring));\n}\n"],"mappings":";;;;;;AAYA,MAAM,IAAI,8BAA8B;AAExC,MAAM,WAAW,OAAO,eACtB,OAAO,MAAM;CACX,OAAO,QAAQ,mCAAmC;CAClD,uBAAuB,OAAO;CAC9B;CACA,EAAE;CACF,EAAE;CACF,EAAE;CACF,EAAE;CACF,EAAE;CACF,EAAE;CACF,EAAE;CACF,EAAE;CACF,EAAE;CACF,EAAE;CACF,EAAE;CACF,EAAE;CACF,EAAE;CACF,EAAE;CACF,EAAE;CACF,EAAE;CACF,EAAE;CACF,EAAE;CACF,EAAE;AACJ,CAAC,CACH;AAEA,MAAM,UAAU,IAAI,YAAY;AAEhC,MAAM,OAAO,SAAwC,UAAkB;CACrE,MAAM,IAAI,kBAAkB,+BAA+B,OAAO;CAElE,MAAM,UAAU,OAAO,WAAW,QAAQ,CAAC,CAAC;EAC1C;EACA;EACA;EACA,EAAE;EACF,EAAE;EACF,EAAE;EACF,EAAE;EACF,EAAE;EACF,EAAE;EACF,EAAE;EACF,EAAE;EACF,EAAE;EACF,EAAE;EACF,EAAE;EACF,EAAE;EACF,EAAE;EACF,EAAE;EACF,EAAE;EACF,EAAE;EACF,EAAE;EACF,EAAE;EACF,EAAE;CACJ,CAAC;CAED,IAAI,QAAQ,SAAS,OAAO,MAAM,iBAAiB,KAAK,CAAC,CAAC;CAC1D,MAAM,QAAQ,QAAQ,OAAO,OAAO;CAEpC,IAAI,MAAM,SAAS,OAAO;EACxB,MAAM,KAAK,CAAC;EACZ,MAAM,iBAAiB,KAAK,CAAC,CAAC;CAChC;CAEA,OAAO;AACT;;;;;;AAOA,IAAa,4BAAb,cAA+C,QAAQ,QAYrD,CAAC,CAAC,uCAAuC,CAAC,CAAC;CAC3C,OAAgB,qBAAqB,YACnC,MAAM,OAAO,MAAM,sBAAsB,+BAA+B,KAAK,OAAO,CAAC;AACzF"}

package/dist/oauth/accounts.d.mts

@@ -0,0 +1,29 @@
+import "../operations/errors.mjs";
+import "../operations/context.mjs";
+import "../operations/credentials.mjs";
+import "../operations/operation.mjs";
+import "../identity/models.mjs";
+import "../hooks/models.mjs";
+import "../hooks/LifecycleHooks.mjs";
+import "../WebCrypto.mjs";
+import "../operations/requestBinding.mjs";
+import "../Operations.mjs";
+import "../Auth.mjs";
+import "../sessions/module.mjs";
+import "./signInErrors.mjs";
+import "./signInModels.mjs";
+import "./accountsModels.mjs";
+import "./OAuthAccountsPersistence.mjs";
+import "./OAuthActionEvidence.mjs";
+import "./OAuthLinkTransactionProtector.mjs";
+import "./OAuthProtocol.mjs";
+import "./OAuthReturnTargets.mjs";
+import { Context, Crypto, Effect, Layer, Redacted, Schema } from "effect";
+//#region src/oauth/accounts.d.ts
+interface AccountsModule<Id extends string> {
+  readonly moduleId: Id;
+  readonly kind: "oauth-accounts";
+}
+//#endregion
+export { AccountsModule };
+//# sourceMappingURL=accounts.d.mts.map