@yielded/auth 0.1.0-beta.1

package/dist/oauth/accountsModels.d.mts

@@ -0,0 +1,463 @@
+import { Schema } from "effect";
+//#region src/oauth/accountsModels.d.ts
+declare const OAuthActionRequired_base: Schema.Class<OAuthActionRequired, Schema.TaggedStruct<"OAuthActionRequired", {}>, import("effect/Cause").YieldableError>;
+declare class OAuthActionRequired extends OAuthActionRequired_base {}
+declare const OAuthAccountsPolicy: Schema.Struct<{
+  readonly generation: Schema.Int;
+  readonly lifetimeMillis: Schema.Int;
+  readonly claimLifetimeMillis: Schema.Int;
+  readonly settlementTimeoutMillis: Schema.Int;
+  readonly retentionMillis: Schema.Int;
+  readonly maximumEvidenceAgeMillis: Schema.Int;
+  readonly requireImmediateInvalidation: Schema.Boolean;
+}>;
+type OAuthAccountsPolicy = typeof OAuthAccountsPolicy.Type;
+declare const OAuthActionDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+declare const OAuthAccountRevision: Schema.Struct<{
+  readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+  readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+  readonly credentials: Schema.$Array<Schema.Struct<{
+    readonly credentialId: Schema.NonEmptyString;
+    readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+  }>>;
+}>;
+type OAuthAccountRevision = typeof OAuthAccountRevision.Type;
+declare const OAuthLinkTransactionContext: Schema.Struct<{
+  readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+  readonly protocol: Schema.Literals<readonly ["oidc", "oauth"]>;
+  readonly configurationGeneration: Schema.Int;
+  readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+  readonly responseIssuerMode: Schema.Literals<readonly ["required", "unsupported"]>;
+  readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+  readonly redirectUri: Schema.brand<Schema.String, "effect-auth/OAuthRedirectUri">;
+  readonly moduleId: Schema.brand<Schema.String, "effect-auth/OAuthModuleId">;
+  readonly generation: Schema.Int;
+  readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+  readonly commandId: Schema.brand<Schema.String, "effect-auth/OAuthCommandId">;
+  readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+  readonly stateDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+  readonly requestBindingVerifier: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+  readonly requestBindingExpiresAtMillis: Schema.Int;
+  readonly issuedAtMillis: Schema.Int;
+  readonly expiresAtMillis: Schema.Int;
+  readonly claimLifetimeMillis: Schema.Int;
+  readonly namespace: Schema.Literal<"effect-auth/oauth-link-context/v1">;
+  readonly revision: Schema.Struct<{
+    readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+    readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly credentials: Schema.$Array<Schema.Struct<{
+      readonly credentialId: Schema.NonEmptyString;
+      readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    }>>;
+  }>;
+  readonly maximumEvidenceAgeMillis: Schema.Int;
+}>;
+type OAuthLinkTransactionContext = typeof OAuthLinkTransactionContext.Type;
+declare const OAuthLinkPendingFlow: Schema.Struct<{
+  readonly context: Schema.Struct<{
+    readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+    readonly protocol: Schema.Literals<readonly ["oidc", "oauth"]>;
+    readonly configurationGeneration: Schema.Int;
+    readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+    readonly responseIssuerMode: Schema.Literals<readonly ["required", "unsupported"]>;
+    readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+    readonly redirectUri: Schema.brand<Schema.String, "effect-auth/OAuthRedirectUri">;
+    readonly moduleId: Schema.brand<Schema.String, "effect-auth/OAuthModuleId">;
+    readonly generation: Schema.Int;
+    readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+    readonly commandId: Schema.brand<Schema.String, "effect-auth/OAuthCommandId">;
+    readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+    readonly stateDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+    readonly requestBindingVerifier: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+    readonly requestBindingExpiresAtMillis: Schema.Int;
+    readonly issuedAtMillis: Schema.Int;
+    readonly expiresAtMillis: Schema.Int;
+    readonly claimLifetimeMillis: Schema.Int;
+    readonly namespace: Schema.Literal<"effect-auth/oauth-link-context/v1">;
+    readonly revision: Schema.Struct<{
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly credentials: Schema.$Array<Schema.Struct<{
+        readonly credentialId: Schema.NonEmptyString;
+        readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      }>>;
+    }>;
+    readonly maximumEvidenceAgeMillis: Schema.Int;
+  }>;
+  readonly sealed: Schema.Struct<{
+    readonly format: Schema.Literal<"oauth-xchacha20poly1305-v1">;
+    readonly keyId: Schema.String;
+    readonly nonce: Schema.String;
+    readonly ciphertext: Schema.RedactedFromValue<Schema.String>;
+  }>;
+  readonly retentionUntilMillis: Schema.Int;
+}>;
+type OAuthLinkPendingFlow = typeof OAuthLinkPendingFlow.Type;
+declare const OAuthLinkClaim: Schema.Struct<{
+  readonly flow: Schema.Struct<{
+    readonly context: Schema.Struct<{
+      readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+      readonly protocol: Schema.Literals<readonly ["oidc", "oauth"]>;
+      readonly configurationGeneration: Schema.Int;
+      readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+      readonly responseIssuerMode: Schema.Literals<readonly ["required", "unsupported"]>;
+      readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+      readonly redirectUri: Schema.brand<Schema.String, "effect-auth/OAuthRedirectUri">;
+      readonly moduleId: Schema.brand<Schema.String, "effect-auth/OAuthModuleId">;
+      readonly generation: Schema.Int;
+      readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+      readonly commandId: Schema.brand<Schema.String, "effect-auth/OAuthCommandId">;
+      readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+      readonly stateDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+      readonly requestBindingVerifier: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+      readonly requestBindingExpiresAtMillis: Schema.Int;
+      readonly issuedAtMillis: Schema.Int;
+      readonly expiresAtMillis: Schema.Int;
+      readonly claimLifetimeMillis: Schema.Int;
+      readonly namespace: Schema.Literal<"effect-auth/oauth-link-context/v1">;
+      readonly revision: Schema.Struct<{
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly credentials: Schema.$Array<Schema.Struct<{
+          readonly credentialId: Schema.NonEmptyString;
+          readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        }>>;
+      }>;
+      readonly maximumEvidenceAgeMillis: Schema.Int;
+    }>;
+    readonly sealed: Schema.Struct<{
+      readonly format: Schema.Literal<"oauth-xchacha20poly1305-v1">;
+      readonly keyId: Schema.String;
+      readonly nonce: Schema.String;
+      readonly ciphertext: Schema.RedactedFromValue<Schema.String>;
+    }>;
+    readonly retentionUntilMillis: Schema.Int;
+  }>;
+  readonly claimId: Schema.brand<Schema.String, "effect-auth/OAuthClaimId">;
+  readonly claimedAtMillis: Schema.Int;
+  readonly claimExpiresAtMillis: Schema.Int;
+}>;
+type OAuthLinkClaim = typeof OAuthLinkClaim.Type;
+declare const OAuthLinkBegin: Schema.Struct<{
+  readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+  readonly commandId: Schema.brand<Schema.String, "effect-auth/OAuthCommandId">;
+  readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+  readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+  readonly returnTarget: Schema.String;
+  readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.String>>;
+}>;
+declare const OAuthLinkComplete: Schema.Struct<{
+  readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+  readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+  readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+  readonly requestBinding: Schema.RedactedFromValue<Schema.String>;
+  readonly response: Schema.Union<readonly [Schema.TaggedStruct<"Code", {
+    readonly state: Schema.RedactedFromValue<Schema.String>;
+    readonly issuer: Schema.optionalKey<Schema.brand<Schema.String, "effect-auth/OAuthIssuer">>;
+    readonly code: Schema.RedactedFromValue<Schema.String>;
+    readonly error: Schema.optionalKey<Schema.Never>;
+  }>, Schema.TaggedStruct<"Error", {
+    readonly state: Schema.RedactedFromValue<Schema.String>;
+    readonly issuer: Schema.optionalKey<Schema.brand<Schema.String, "effect-auth/OAuthIssuer">>;
+    readonly error: Schema.Literals<readonly ["access-denied", "rejected"]>;
+    readonly code: Schema.optionalKey<Schema.Never>;
+  }>]>;
+  readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.String>>;
+}>;
+declare const OAuthUnlink: Schema.Struct<{
+  readonly commandId: Schema.brand<Schema.String, "effect-auth/OAuthCommandId">;
+  readonly credentialId: Schema.NonEmptyString;
+  readonly actionProof: Schema.optionalKey<Schema.RedactedFromValue<Schema.String>>;
+}>;
+declare const OAuthActionChallenge: Schema.Struct<{
+  readonly moduleId: Schema.brand<Schema.String, "effect-auth/OAuthModuleId">;
+  readonly action: Schema.Literals<readonly ["link-begin", "link-complete", "unlink"]>;
+  readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+  readonly commandId: Schema.brand<Schema.String, "effect-auth/OAuthCommandId">;
+  readonly revision: Schema.Struct<{
+    readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+    readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly credentials: Schema.$Array<Schema.Struct<{
+      readonly credentialId: Schema.NonEmptyString;
+      readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    }>>;
+  }>;
+  /** Hash of the exact link context or unlink credential; no client authority. */
+  readonly intentDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+  readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+}>;
+type OAuthActionChallenge = typeof OAuthActionChallenge.Type;
+declare const OAuthActionAuthorization: Schema.Struct<{
+  readonly challenge: Schema.Struct<{
+    readonly moduleId: Schema.brand<Schema.String, "effect-auth/OAuthModuleId">;
+    readonly action: Schema.Literals<readonly ["link-begin", "link-complete", "unlink"]>;
+    readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+    readonly commandId: Schema.brand<Schema.String, "effect-auth/OAuthCommandId">;
+    readonly revision: Schema.Struct<{
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly credentials: Schema.$Array<Schema.Struct<{
+        readonly credentialId: Schema.NonEmptyString;
+        readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      }>>;
+    }>;
+    /** Hash of the exact link context or unlink credential; no client authority. */
+    readonly intentDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+    readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+  }>;
+  readonly evidence: Schema.Struct<{
+    readonly revision: Schema.Struct<{
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly credentials: Schema.$Array<Schema.Struct<{
+        readonly credentialId: Schema.NonEmptyString;
+        readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      }>>;
+    }>;
+    readonly flowId: Schema.brand<Schema.NonEmptyString, "effect-auth/AuthenticationFlowId">;
+    readonly bindingDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+    readonly proofs: Schema.NonEmptyArray<Schema.Struct<{
+      readonly userVerified: Schema.Boolean;
+      readonly phishingResistant: Schema.Boolean;
+      readonly verifiedAt: Schema.DateTimeUtcFromMillis;
+      readonly method: Schema.NonEmptyString;
+      readonly credentialId: Schema.NonEmptyString;
+      readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+    }>>;
+  }>;
+  readonly requirement: Schema.Struct<{
+    readonly maximumAgeMillis: Schema.Int;
+    readonly alternatives: Schema.NonEmptyArray<Schema.Struct<{
+      readonly userVerified: Schema.Boolean;
+      readonly phishingResistant: Schema.Boolean;
+      readonly factors: Schema.$Array<Schema.Literals<readonly ["knowledge", "possession", "inherence"]>>;
+      readonly minimumCredentials: Schema.Int;
+    }>>;
+  }>;
+}>;
+type OAuthActionAuthorization = typeof OAuthActionAuthorization.Type;
+declare const OAuthLinked: Schema.Union<readonly [Schema.TaggedStruct<"Linked", {
+  readonly credentialId: Schema.NonEmptyString;
+  readonly changed: Schema.Literal<true>;
+  readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+  readonly invalidation: Schema.Struct<{
+    readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+    readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+    readonly maximumExposureMillis: Schema.Natural;
+    readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+  }>;
+}>, Schema.TaggedStruct<"Linked", {
+  readonly credentialId: Schema.NonEmptyString;
+  readonly changed: Schema.Literal<false>;
+  readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+  readonly invalidation: Schema.optionalKey<Schema.Never>;
+}>]>;
+declare const OAuthUnlinked: Schema.TaggedStruct<"Unlinked", {
+  readonly credentialId: Schema.NonEmptyString;
+  readonly invalidation: Schema.Struct<{
+    readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+    readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+    readonly maximumExposureMillis: Schema.Natural;
+    readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+  }>;
+}>;
+declare const OAuthLinkResult: Schema.Union<readonly [Schema.Union<readonly [Schema.TaggedStruct<"Linked", {
+  readonly credentialId: Schema.NonEmptyString;
+  readonly changed: Schema.Literal<true>;
+  readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+  readonly invalidation: Schema.Struct<{
+    readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+    readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+    readonly maximumExposureMillis: Schema.Natural;
+    readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+  }>;
+}>, Schema.TaggedStruct<"Linked", {
+  readonly credentialId: Schema.NonEmptyString;
+  readonly changed: Schema.Literal<false>;
+  readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+  readonly invalidation: Schema.optionalKey<Schema.Never>;
+}>]>, Schema.TaggedStruct<"Cancelled", {
+  readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+}>]>;
+declare const OAuthLinkAccess: Schema.Struct<{
+  readonly moduleId: Schema.brand<Schema.String, "effect-auth/OAuthModuleId">;
+  readonly generation: Schema.Int;
+  readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+  readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+  readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+  readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+  readonly stateDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+  readonly requestBindingVerifier: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+  readonly requestBindingExpiresAtMillis: Schema.Int;
+  readonly responseIssuer: Schema.optionalKey<Schema.brand<Schema.String, "effect-auth/OAuthIssuer">>;
+  readonly nowMillis: Schema.Int;
+}>;
+type OAuthLinkAccess = typeof OAuthLinkAccess.Type;
+declare const OAuthLinkIssueDecision: Schema.Union<readonly [Schema.TaggedStruct<"Issued", {
+  readonly flow: Schema.Struct<{
+    readonly context: Schema.Struct<{
+      readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+      readonly protocol: Schema.Literals<readonly ["oidc", "oauth"]>;
+      readonly configurationGeneration: Schema.Int;
+      readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+      readonly responseIssuerMode: Schema.Literals<readonly ["required", "unsupported"]>;
+      readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+      readonly redirectUri: Schema.brand<Schema.String, "effect-auth/OAuthRedirectUri">;
+      readonly moduleId: Schema.brand<Schema.String, "effect-auth/OAuthModuleId">;
+      readonly generation: Schema.Int;
+      readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+      readonly commandId: Schema.brand<Schema.String, "effect-auth/OAuthCommandId">;
+      readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+      readonly stateDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+      readonly requestBindingVerifier: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+      readonly requestBindingExpiresAtMillis: Schema.Int;
+      readonly issuedAtMillis: Schema.Int;
+      readonly expiresAtMillis: Schema.Int;
+      readonly claimLifetimeMillis: Schema.Int;
+      readonly namespace: Schema.Literal<"effect-auth/oauth-link-context/v1">;
+      readonly revision: Schema.Struct<{
+        readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+        readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        readonly credentials: Schema.$Array<Schema.Struct<{
+          readonly credentialId: Schema.NonEmptyString;
+          readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+        }>>;
+      }>;
+      readonly maximumEvidenceAgeMillis: Schema.Int;
+    }>;
+    readonly sealed: Schema.Struct<{
+      readonly format: Schema.Literal<"oauth-xchacha20poly1305-v1">;
+      readonly keyId: Schema.String;
+      readonly nonce: Schema.String;
+      readonly ciphertext: Schema.RedactedFromValue<Schema.String>;
+    }>;
+    readonly retentionUntilMillis: Schema.Int;
+  }>;
+}>, Schema.TaggedStruct<"Rejected", {}>]>;
+declare const OAuthLinkClaimDecision: Schema.Union<readonly [Schema.TaggedStruct<"Claimed", {
+  readonly claim: Schema.Struct<{
+    readonly flow: Schema.Struct<{
+      readonly context: Schema.Struct<{
+        readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+        readonly protocol: Schema.Literals<readonly ["oidc", "oauth"]>;
+        readonly configurationGeneration: Schema.Int;
+        readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+        readonly responseIssuerMode: Schema.Literals<readonly ["required", "unsupported"]>;
+        readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+        readonly redirectUri: Schema.brand<Schema.String, "effect-auth/OAuthRedirectUri">;
+        readonly moduleId: Schema.brand<Schema.String, "effect-auth/OAuthModuleId">;
+        readonly generation: Schema.Int;
+        readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+        readonly commandId: Schema.brand<Schema.String, "effect-auth/OAuthCommandId">;
+        readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+        readonly stateDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+        readonly requestBindingVerifier: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+        readonly requestBindingExpiresAtMillis: Schema.Int;
+        readonly issuedAtMillis: Schema.Int;
+        readonly expiresAtMillis: Schema.Int;
+        readonly claimLifetimeMillis: Schema.Int;
+        readonly namespace: Schema.Literal<"effect-auth/oauth-link-context/v1">;
+        readonly revision: Schema.Struct<{
+          readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+          readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          readonly credentials: Schema.$Array<Schema.Struct<{
+            readonly credentialId: Schema.NonEmptyString;
+            readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+          }>>;
+        }>;
+        readonly maximumEvidenceAgeMillis: Schema.Int;
+      }>;
+      readonly sealed: Schema.Struct<{
+        readonly format: Schema.Literal<"oauth-xchacha20poly1305-v1">;
+        readonly keyId: Schema.String;
+        readonly nonce: Schema.String;
+        readonly ciphertext: Schema.RedactedFromValue<Schema.String>;
+      }>;
+      readonly retentionUntilMillis: Schema.Int;
+    }>;
+    readonly claimId: Schema.brand<Schema.String, "effect-auth/OAuthClaimId">;
+    readonly claimedAtMillis: Schema.Int;
+    readonly claimExpiresAtMillis: Schema.Int;
+  }>;
+}>, Schema.TaggedStruct<"Rejected", {}>]>;
+declare const OAuthLinkOutcome: Schema.Union<readonly [Schema.TaggedStruct<"Verified", {
+  readonly identity: Schema.Struct<{
+    readonly identity: Schema.Struct<{
+      readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+      readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+      readonly subject: Schema.NonEmptyString;
+    }>;
+    readonly upstreamAuthenticatedAt: Schema.optionalKey<Schema.DateTimeUtcFromMillis>;
+    readonly profile: Schema.optionalKey<Schema.Struct<{
+      readonly displayName: Schema.optionalKey<Schema.String>;
+      readonly handle: Schema.optionalKey<Schema.String>;
+    }>>;
+  }>;
+}>, Schema.TaggedStruct<"Cancelled", {}>, Schema.TaggedStruct<"Rejected", {}>, Schema.TaggedStruct<"Ambiguous", {}>]>;
+type OAuthLinkOutcome = typeof OAuthLinkOutcome.Type;
+declare const OAuthLinkDecision: Schema.Union<readonly [Schema.TaggedStruct<"Linked", {
+  readonly credential: Schema.Struct<{
+    readonly moduleId: Schema.brand<Schema.String, "effect-auth/OAuthModuleId">;
+    readonly identity: Schema.Struct<{
+      readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+      readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+      readonly subject: Schema.NonEmptyString;
+    }>;
+    readonly credentialId: Schema.NonEmptyString;
+    readonly credentialRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly revision: Schema.Struct<{
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly credentials: Schema.$Array<Schema.Struct<{
+        readonly credentialId: Schema.NonEmptyString;
+        readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      }>>;
+    }>;
+  }>;
+  readonly changed: Schema.Boolean;
+}>, Schema.TaggedStruct<"Cancelled", {}>, Schema.TaggedStruct<"Rejected", {}>, Schema.TaggedStruct<"Conflict", {}>, Schema.TaggedStruct<"Ambiguous", {}>]>;
+declare const OAuthUnlinkInspection: Schema.Union<readonly [Schema.TaggedStruct<"Target", {
+  readonly credential: Schema.Struct<{
+    readonly moduleId: Schema.brand<Schema.String, "effect-auth/OAuthModuleId">;
+    readonly identity: Schema.Struct<{
+      readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+      readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+      readonly subject: Schema.NonEmptyString;
+    }>;
+    readonly credentialId: Schema.NonEmptyString;
+    readonly credentialRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+    readonly revision: Schema.Struct<{
+      readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+      readonly securityRevision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      readonly credentials: Schema.$Array<Schema.Struct<{
+        readonly credentialId: Schema.NonEmptyString;
+        readonly revision: Schema.brand<Schema.NonEmptyString, "effect-auth/SecurityRevision">;
+      }>>;
+    }>;
+  }>;
+}>, Schema.TaggedStruct<"Replay", {
+  readonly result: Schema.TaggedStruct<"Unlinked", {
+    readonly credentialId: Schema.NonEmptyString;
+    readonly invalidation: Schema.Struct<{
+      readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+      readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+      readonly maximumExposureMillis: Schema.Natural;
+      readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+    }>;
+  }>;
+}>, Schema.TaggedStruct<"Rejected", {}>, Schema.TaggedStruct<"Conflict", {}>]>;
+declare const OAuthUnlinkDecision: Schema.Union<readonly [Schema.TaggedStruct<"Unlinked", {
+  readonly result: Schema.TaggedStruct<"Unlinked", {
+    readonly credentialId: Schema.NonEmptyString;
+    readonly invalidation: Schema.Struct<{
+      readonly trigger: Schema.Literals<readonly ["password-reset", "factor-reset", "credential-change", "subject-disable", "subject-delete", "identifier-change", "all-session-revocation"]>;
+      readonly existingSessions: Schema.Literals<readonly ["immediate", "original-absolute-expiry"]>;
+      readonly maximumExposureMillis: Schema.Natural;
+      readonly oldAuthenticationEvidence: Schema.Literal<"rejected">;
+    }>;
+  }>;
+  readonly replayed: Schema.Boolean;
+}>, Schema.TaggedStruct<"Rejected", {}>, Schema.TaggedStruct<"Conflict", {}>, Schema.TaggedStruct<"LastSignInMethod", {}>]>;
+//#endregion
+export { OAuthAccountRevision, OAuthAccountsPolicy, OAuthActionAuthorization, OAuthActionChallenge, OAuthActionDigest, OAuthActionRequired, OAuthLinkAccess, OAuthLinkBegin, OAuthLinkClaim, OAuthLinkClaimDecision, OAuthLinkComplete, OAuthLinkDecision, OAuthLinkIssueDecision, OAuthLinkOutcome, OAuthLinkPendingFlow, OAuthLinkResult, OAuthLinkTransactionContext, OAuthLinked, OAuthUnlink, OAuthUnlinkDecision, OAuthUnlinkInspection, OAuthUnlinked };
+//# sourceMappingURL=accountsModels.d.mts.map

package/dist/oauth/accountsModels.mjs

@@ -0,0 +1,155 @@
+import { TokenDigest } from "../Schema.mjs";
+import { SessionInvalidationWindow } from "../sessions/invalidation.mjs";
+import { AssuranceAlternative, AuthenticationEvidence, AuthenticationProof, AuthenticationRequirement } from "../sessions/models.mjs";
+import { RequestBindingFlowId } from "../operations/requestBindingModels.mjs";
+import { OAuthClaimId, OAuthCommandId, OAuthCredentialSnapshot, OAuthInstant, OAuthModuleId, OAuthSealedTransaction, OAuthSignInBegin, OAuthSignInComplete, OAuthSignInPolicy, OAuthSignInTransactionContext, OAuthVerifiedExternalIdentity } from "./signInModels.mjs";
+import { Schema } from "effect";
+//#region src/oauth/accountsModels.ts
+var OAuthActionRequired = class extends Schema.TaggedError()("OAuthActionRequired", {}) {};
+const OAuthAccountsPolicy = Schema.Struct({
+	...OAuthSignInPolicy.fields,
+	maximumEvidenceAgeMillis: Schema.Int.check(Schema.isBetween({
+		minimum: 1e3,
+		maximum: 3e5
+	})),
+	requireImmediateInvalidation: Schema.Boolean
+});
+const OAuthActionDigest = TokenDigest.check(Schema.isPattern(/^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/));
+const OAuthAccountRevision = OAuthCredentialSnapshot.fields.revision;
+const OAuthLinkTransactionContext = Schema.Struct({
+	...OAuthSignInTransactionContext.fields,
+	namespace: Schema.Literal("effect-auth/oauth-link-context/v1"),
+	revision: OAuthAccountRevision,
+	maximumEvidenceAgeMillis: OAuthAccountsPolicy.fields.maximumEvidenceAgeMillis
+});
+const OAuthLinkPendingFlow = Schema.Struct({
+	context: OAuthLinkTransactionContext,
+	sealed: OAuthSealedTransaction,
+	retentionUntilMillis: OAuthInstant
+});
+const OAuthLinkClaim = Schema.Struct({
+	flow: OAuthLinkPendingFlow,
+	claimId: OAuthClaimId,
+	claimedAtMillis: OAuthInstant,
+	claimExpiresAtMillis: OAuthInstant
+});
+const proof = Schema.optionalKey(Schema.RedactedFromValue(Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(16384))));
+const OAuthLinkBegin = Schema.Struct({
+	...OAuthSignInBegin.fields,
+	actionProof: proof
+});
+const OAuthLinkComplete = Schema.Struct({
+	...OAuthSignInComplete.fields,
+	actionProof: proof
+});
+const OAuthUnlink = Schema.Struct({
+	commandId: OAuthCommandId,
+	credentialId: OAuthCredentialSnapshot.fields.credentialId,
+	actionProof: proof
+});
+const OAuthActionChallenge = Schema.Struct({
+	moduleId: OAuthModuleId,
+	action: Schema.Literals([
+		"link-begin",
+		"link-complete",
+		"unlink"
+	]),
+	flowId: RequestBindingFlowId,
+	commandId: OAuthCommandId,
+	revision: OAuthAccountRevision,
+	/** Hash of the exact link context or unlink credential; no client authority. */
+	intentDigest: OAuthActionDigest,
+	bindingDigest: OAuthActionDigest
+});
+const OAuthActionAuthorization = Schema.Struct({
+	challenge: OAuthActionChallenge,
+	evidence: Schema.Struct({
+		...AuthenticationEvidence.fields,
+		revision: OAuthAccountRevision,
+		flowId: AuthenticationEvidence.fields.flowId.check(Schema.isMaxLength(256)),
+		bindingDigest: OAuthActionDigest,
+		proofs: Schema.NonEmptyArray(Schema.Struct({
+			...AuthenticationProof.fields,
+			method: Schema.NonEmptyString.check(Schema.isMaxLength(128)),
+			credentialId: OAuthCredentialSnapshot.fields.credentialId,
+			factors: AuthenticationProof.fields.factors.check(Schema.isMaxLength(8))
+		})).check(Schema.isMaxLength(64))
+	}),
+	requirement: Schema.Struct({
+		...AuthenticationRequirement.fields,
+		alternatives: Schema.NonEmptyArray(Schema.Struct({
+			...AssuranceAlternative.fields,
+			factors: AssuranceAlternative.fields.factors.check(Schema.isMaxLength(8)),
+			minimumCredentials: Schema.Int.check(Schema.isBetween({
+				minimum: 1,
+				maximum: 64
+			}))
+		})).check(Schema.isMaxLength(64))
+	})
+});
+const OAuthLinked = Schema.Union([Schema.TaggedStruct("Linked", {
+	credentialId: OAuthCredentialSnapshot.fields.credentialId,
+	changed: Schema.Literal(true),
+	returnTarget: OAuthLinkTransactionContext.fields.returnTarget,
+	invalidation: SessionInvalidationWindow
+}), Schema.TaggedStruct("Linked", {
+	credentialId: OAuthCredentialSnapshot.fields.credentialId,
+	changed: Schema.Literal(false),
+	returnTarget: OAuthLinkTransactionContext.fields.returnTarget,
+	invalidation: Schema.optionalKey(Schema.Never)
+})]);
+const OAuthUnlinked = Schema.TaggedStruct("Unlinked", {
+	credentialId: OAuthCredentialSnapshot.fields.credentialId,
+	invalidation: SessionInvalidationWindow
+});
+const OAuthLinkResult = Schema.Union([OAuthLinked, Schema.TaggedStruct("Cancelled", { returnTarget: OAuthLinkTransactionContext.fields.returnTarget })]);
+const OAuthLinkAccess = Schema.Struct({
+	moduleId: OAuthModuleId,
+	generation: OAuthAccountsPolicy.fields.generation,
+	subjectId: OAuthAccountRevision.fields.subjectId,
+	flowId: RequestBindingFlowId,
+	provider: OAuthSignInComplete.fields.provider,
+	callbackId: OAuthSignInComplete.fields.callbackId,
+	stateDigest: OAuthLinkTransactionContext.fields.stateDigest,
+	requestBindingVerifier: OAuthLinkTransactionContext.fields.requestBindingVerifier,
+	requestBindingExpiresAtMillis: OAuthInstant,
+	responseIssuer: Schema.optionalKey(OAuthLinkTransactionContext.fields.issuer),
+	nowMillis: OAuthInstant
+});
+const OAuthLinkIssueDecision = Schema.Union([Schema.TaggedStruct("Issued", { flow: OAuthLinkPendingFlow }), Schema.TaggedStruct("Rejected", {})]);
+const OAuthLinkClaimDecision = Schema.Union([Schema.TaggedStruct("Claimed", { claim: OAuthLinkClaim }), Schema.TaggedStruct("Rejected", {})]);
+const OAuthLinkOutcome = Schema.Union([
+	Schema.TaggedStruct("Verified", { identity: OAuthVerifiedExternalIdentity }),
+	Schema.TaggedStruct("Cancelled", {}),
+	Schema.TaggedStruct("Rejected", {}),
+	Schema.TaggedStruct("Ambiguous", {})
+]);
+const OAuthLinkDecision = Schema.Union([
+	Schema.TaggedStruct("Linked", {
+		credential: OAuthCredentialSnapshot,
+		changed: Schema.Boolean
+	}),
+	Schema.TaggedStruct("Cancelled", {}),
+	Schema.TaggedStruct("Rejected", {}),
+	Schema.TaggedStruct("Conflict", {}),
+	Schema.TaggedStruct("Ambiguous", {})
+]);
+const OAuthUnlinkInspection = Schema.Union([
+	Schema.TaggedStruct("Target", { credential: OAuthCredentialSnapshot }),
+	Schema.TaggedStruct("Replay", { result: OAuthUnlinked }),
+	Schema.TaggedStruct("Rejected", {}),
+	Schema.TaggedStruct("Conflict", {})
+]);
+const OAuthUnlinkDecision = Schema.Union([
+	Schema.TaggedStruct("Unlinked", {
+		result: OAuthUnlinked,
+		replayed: Schema.Boolean
+	}),
+	Schema.TaggedStruct("Rejected", {}),
+	Schema.TaggedStruct("Conflict", {}),
+	Schema.TaggedStruct("LastSignInMethod", {})
+]);
+//#endregion
+export { OAuthAccountRevision, OAuthAccountsPolicy, OAuthActionAuthorization, OAuthActionChallenge, OAuthActionDigest, OAuthActionRequired, OAuthLinkAccess, OAuthLinkBegin, OAuthLinkClaim, OAuthLinkClaimDecision, OAuthLinkComplete, OAuthLinkDecision, OAuthLinkIssueDecision, OAuthLinkOutcome, OAuthLinkPendingFlow, OAuthLinkResult, OAuthLinkTransactionContext, OAuthLinked, OAuthUnlink, OAuthUnlinkDecision, OAuthUnlinkInspection, OAuthUnlinked };
+
+//# sourceMappingURL=accountsModels.mjs.map

package/dist/oauth/accountsModels.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"accountsModels.mjs","names":[],"sources":["../../src/oauth/accountsModels.ts"],"sourcesContent":["import { Schema } from \"effect\";\n\nimport { RequestBindingFlowId } from \"../operations/requestBinding\";\nimport { TokenDigest } from \"../Schema\";\nimport { SessionInvalidationWindow } from \"../sessions/invalidation\";\nimport {\n  AuthenticationEvidence,\n  AuthenticationRequirement,\n  AuthenticationProof,\n  AssuranceAlternative,\n} from \"../sessions/models\";\nimport {\n  OAuthClaimId,\n  OAuthCredentialSnapshot,\n  OAuthInstant,\n  OAuthModuleId,\n  OAuthSealedTransaction,\n  OAuthSignInBegin,\n  OAuthSignInComplete,\n  OAuthSignInPolicy,\n  OAuthSignInTransactionContext,\n  OAuthCommandId,\n  OAuthVerifiedExternalIdentity,\n} from \"./signInModels\";\n\nexport class OAuthActionRequired extends Schema.TaggedError<OAuthActionRequired>()(\n  \"OAuthActionRequired\",\n  {},\n) {}\n\nexport const OAuthAccountsPolicy = Schema.Struct({\n  ...OAuthSignInPolicy.fields,\n  maximumEvidenceAgeMillis: Schema.Int.check(Schema.isBetween({ minimum: 1000, maximum: 300000 })),\n  requireImmediateInvalidation: Schema.Boolean,\n});\n\nexport type OAuthAccountsPolicy = typeof OAuthAccountsPolicy.Type;\n\nexport const OAuthActionDigest = TokenDigest.check(\n  Schema.isPattern(/^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/),\n);\n\nexport const OAuthAccountRevision = OAuthCredentialSnapshot.fields.revision;\nexport type OAuthAccountRevision = typeof OAuthAccountRevision.Type;\n\nexport const OAuthLinkTransactionContext = Schema.Struct({\n  ...OAuthSignInTransactionContext.fields,\n  namespace: Schema.Literal(\"effect-auth/oauth-link-context/v1\"),\n  revision: OAuthAccountRevision,\n  maximumEvidenceAgeMillis: OAuthAccountsPolicy.fields.maximumEvidenceAgeMillis,\n});\n\nexport type OAuthLinkTransactionContext = typeof OAuthLinkTransactionContext.Type;\n\nexport const OAuthLinkPendingFlow = Schema.Struct({\n  context: OAuthLinkTransactionContext,\n  sealed: OAuthSealedTransaction,\n  retentionUntilMillis: OAuthInstant,\n});\n\nexport type OAuthLinkPendingFlow = typeof OAuthLinkPendingFlow.Type;\n\nexport const OAuthLinkClaim = Schema.Struct({\n  flow: OAuthLinkPendingFlow,\n  claimId: OAuthClaimId,\n  claimedAtMillis: OAuthInstant,\n  claimExpiresAtMillis: OAuthInstant,\n});\n\nexport type OAuthLinkClaim = typeof OAuthLinkClaim.Type;\n\nconst proof = Schema.optionalKey(\n  Schema.RedactedFromValue(Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(16384))),\n);\n\nexport const OAuthLinkBegin = Schema.Struct({ ...OAuthSignInBegin.fields, actionProof: proof });\n\nexport const OAuthLinkComplete = Schema.Struct({\n  ...OAuthSignInComplete.fields,\n  actionProof: proof,\n});\n\nexport const OAuthUnlink = Schema.Struct({\n  commandId: OAuthCommandId,\n  credentialId: OAuthCredentialSnapshot.fields.credentialId,\n  actionProof: proof,\n});\n\nexport const OAuthActionChallenge = Schema.Struct({\n  moduleId: OAuthModuleId,\n  action: Schema.Literals([\"link-begin\", \"link-complete\", \"unlink\"]),\n  flowId: RequestBindingFlowId,\n  commandId: OAuthCommandId,\n  revision: OAuthAccountRevision,\n  /** Hash of the exact link context or unlink credential; no client authority. */\n  intentDigest: OAuthActionDigest,\n  bindingDigest: OAuthActionDigest,\n});\n\nexport type OAuthActionChallenge = typeof OAuthActionChallenge.Type;\n\nexport const OAuthActionAuthorization = Schema.Struct({\n  challenge: OAuthActionChallenge,\n  evidence: Schema.Struct({\n    ...AuthenticationEvidence.fields,\n    revision: OAuthAccountRevision,\n    flowId: AuthenticationEvidence.fields.flowId.check(Schema.isMaxLength(256)),\n    bindingDigest: OAuthActionDigest,\n    proofs: Schema.NonEmptyArray(\n      Schema.Struct({\n        ...AuthenticationProof.fields,\n        method: Schema.NonEmptyString.check(Schema.isMaxLength(128)),\n        credentialId: OAuthCredentialSnapshot.fields.credentialId,\n        factors: AuthenticationProof.fields.factors.check(Schema.isMaxLength(8)),\n      }),\n    ).check(Schema.isMaxLength(64)),\n  }),\n  requirement: Schema.Struct({\n    ...AuthenticationRequirement.fields,\n    alternatives: Schema.NonEmptyArray(\n      Schema.Struct({\n        ...AssuranceAlternative.fields,\n        factors: AssuranceAlternative.fields.factors.check(Schema.isMaxLength(8)),\n        minimumCredentials: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 64 })),\n      }),\n    ).check(Schema.isMaxLength(64)),\n  }),\n});\n\nexport type OAuthActionAuthorization = typeof OAuthActionAuthorization.Type;\n\nexport const OAuthLinked = Schema.Union([\n  Schema.TaggedStruct(\"Linked\", {\n    credentialId: OAuthCredentialSnapshot.fields.credentialId,\n    changed: Schema.Literal(true),\n    returnTarget: OAuthLinkTransactionContext.fields.returnTarget,\n    invalidation: SessionInvalidationWindow,\n  }),\n  Schema.TaggedStruct(\"Linked\", {\n    credentialId: OAuthCredentialSnapshot.fields.credentialId,\n    changed: Schema.Literal(false),\n    returnTarget: OAuthLinkTransactionContext.fields.returnTarget,\n    invalidation: Schema.optionalKey(Schema.Never),\n  }),\n]);\n\nexport const OAuthUnlinked = Schema.TaggedStruct(\"Unlinked\", {\n  credentialId: OAuthCredentialSnapshot.fields.credentialId,\n  invalidation: SessionInvalidationWindow,\n});\n\nexport const OAuthLinkResult = Schema.Union([\n  OAuthLinked,\n  Schema.TaggedStruct(\"Cancelled\", {\n    returnTarget: OAuthLinkTransactionContext.fields.returnTarget,\n  }),\n]);\n\nexport const OAuthLinkAccess = Schema.Struct({\n  moduleId: OAuthModuleId,\n  generation: OAuthAccountsPolicy.fields.generation,\n  subjectId: OAuthAccountRevision.fields.subjectId,\n  flowId: RequestBindingFlowId,\n  provider: OAuthSignInComplete.fields.provider,\n  callbackId: OAuthSignInComplete.fields.callbackId,\n  stateDigest: OAuthLinkTransactionContext.fields.stateDigest,\n  requestBindingVerifier: OAuthLinkTransactionContext.fields.requestBindingVerifier,\n  requestBindingExpiresAtMillis: OAuthInstant,\n  responseIssuer: Schema.optionalKey(OAuthLinkTransactionContext.fields.issuer),\n  nowMillis: OAuthInstant,\n});\n\nexport type OAuthLinkAccess = typeof OAuthLinkAccess.Type;\n\nexport const OAuthLinkIssueDecision = Schema.Union([\n  Schema.TaggedStruct(\"Issued\", { flow: OAuthLinkPendingFlow }),\n  Schema.TaggedStruct(\"Rejected\", {}),\n]);\n\nexport const OAuthLinkClaimDecision = Schema.Union([\n  Schema.TaggedStruct(\"Claimed\", { claim: OAuthLinkClaim }),\n  Schema.TaggedStruct(\"Rejected\", {}),\n]);\n\nexport const OAuthLinkOutcome = Schema.Union([\n  Schema.TaggedStruct(\"Verified\", { identity: OAuthVerifiedExternalIdentity }),\n  Schema.TaggedStruct(\"Cancelled\", {}),\n  Schema.TaggedStruct(\"Rejected\", {}),\n  Schema.TaggedStruct(\"Ambiguous\", {}),\n]);\n\nexport type OAuthLinkOutcome = typeof OAuthLinkOutcome.Type;\n\nexport const OAuthLinkDecision = Schema.Union([\n  Schema.TaggedStruct(\"Linked\", { credential: OAuthCredentialSnapshot, changed: Schema.Boolean }),\n  Schema.TaggedStruct(\"Cancelled\", {}),\n  Schema.TaggedStruct(\"Rejected\", {}),\n  Schema.TaggedStruct(\"Conflict\", {}),\n  Schema.TaggedStruct(\"Ambiguous\", {}),\n]);\n\nexport const OAuthUnlinkInspection = Schema.Union([\n  Schema.TaggedStruct(\"Target\", { credential: OAuthCredentialSnapshot }),\n  Schema.TaggedStruct(\"Replay\", { result: OAuthUnlinked }),\n  Schema.TaggedStruct(\"Rejected\", {}),\n  Schema.TaggedStruct(\"Conflict\", {}),\n]);\n\nexport const OAuthUnlinkDecision = Schema.Union([\n  Schema.TaggedStruct(\"Unlinked\", { result: OAuthUnlinked, replayed: Schema.Boolean }),\n  Schema.TaggedStruct(\"Rejected\", {}),\n  Schema.TaggedStruct(\"Conflict\", {}),\n  Schema.TaggedStruct(\"LastSignInMethod\", {}),\n]);\n"],"mappings":";;;;;;;AAyBA,IAAa,sBAAb,cAAyC,OAAO,YAAiC,CAAC,CAChF,uBACA,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,MAAa,sBAAsB,OAAO,OAAO;CAC/C,GAAG,kBAAkB;CACrB,0BAA0B,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAM,SAAS;CAAO,CAAC,CAAC;CAC/F,8BAA8B,OAAO;AACvC,CAAC;AAID,MAAa,oBAAoB,YAAY,MAC3C,OAAO,UAAU,uCAAuC,CAC1D;AAEA,MAAa,uBAAuB,wBAAwB,OAAO;AAGnE,MAAa,8BAA8B,OAAO,OAAO;CACvD,GAAG,8BAA8B;CACjC,WAAW,OAAO,QAAQ,mCAAmC;CAC7D,UAAU;CACV,0BAA0B,oBAAoB,OAAO;AACvD,CAAC;AAID,MAAa,uBAAuB,OAAO,OAAO;CAChD,SAAS;CACT,QAAQ;CACR,sBAAsB;AACxB,CAAC;AAID,MAAa,iBAAiB,OAAO,OAAO;CAC1C,MAAM;CACN,SAAS;CACT,iBAAiB;CACjB,sBAAsB;AACxB,CAAC;AAID,MAAM,QAAQ,OAAO,YACnB,OAAO,kBAAkB,OAAO,OAAO,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,KAAK,CAAC,CAAC,CAChG;AAEA,MAAa,iBAAiB,OAAO,OAAO;CAAE,GAAG,iBAAiB;CAAQ,aAAa;AAAM,CAAC;AAE9F,MAAa,oBAAoB,OAAO,OAAO;CAC7C,GAAG,oBAAoB;CACvB,aAAa;AACf,CAAC;AAED,MAAa,cAAc,OAAO,OAAO;CACvC,WAAW;CACX,cAAc,wBAAwB,OAAO;CAC7C,aAAa;AACf,CAAC;AAED,MAAa,uBAAuB,OAAO,OAAO;CAChD,UAAU;CACV,QAAQ,OAAO,SAAS;EAAC;EAAc;EAAiB;CAAQ,CAAC;CACjE,QAAQ;CACR,WAAW;CACX,UAAU;;CAEV,cAAc;CACd,eAAe;AACjB,CAAC;AAID,MAAa,2BAA2B,OAAO,OAAO;CACpD,WAAW;CACX,UAAU,OAAO,OAAO;EACtB,GAAG,uBAAuB;EAC1B,UAAU;EACV,QAAQ,uBAAuB,OAAO,OAAO,MAAM,OAAO,YAAY,GAAG,CAAC;EAC1E,eAAe;EACf,QAAQ,OAAO,cACb,OAAO,OAAO;GACZ,GAAG,oBAAoB;GACvB,QAAQ,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC;GAC3D,cAAc,wBAAwB,OAAO;GAC7C,SAAS,oBAAoB,OAAO,QAAQ,MAAM,OAAO,YAAY,CAAC,CAAC;EACzE,CAAC,CACH,CAAC,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC;CAChC,CAAC;CACD,aAAa,OAAO,OAAO;EACzB,GAAG,0BAA0B;EAC7B,cAAc,OAAO,cACnB,OAAO,OAAO;GACZ,GAAG,qBAAqB;GACxB,SAAS,qBAAqB,OAAO,QAAQ,MAAM,OAAO,YAAY,CAAC,CAAC;GACxE,oBAAoB,OAAO,IAAI,MAAM,OAAO,UAAU;IAAE,SAAS;IAAG,SAAS;GAAG,CAAC,CAAC;EACpF,CAAC,CACH,CAAC,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC;CAChC,CAAC;AACH,CAAC;AAID,MAAa,cAAc,OAAO,MAAM,CACtC,OAAO,aAAa,UAAU;CAC5B,cAAc,wBAAwB,OAAO;CAC7C,SAAS,OAAO,QAAQ,IAAI;CAC5B,cAAc,4BAA4B,OAAO;CACjD,cAAc;AAChB,CAAC,GACD,OAAO,aAAa,UAAU;CAC5B,cAAc,wBAAwB,OAAO;CAC7C,SAAS,OAAO,QAAQ,KAAK;CAC7B,cAAc,4BAA4B,OAAO;CACjD,cAAc,OAAO,YAAY,OAAO,KAAK;AAC/C,CAAC,CACH,CAAC;AAED,MAAa,gBAAgB,OAAO,aAAa,YAAY;CAC3D,cAAc,wBAAwB,OAAO;CAC7C,cAAc;AAChB,CAAC;AAED,MAAa,kBAAkB,OAAO,MAAM,CAC1C,aACA,OAAO,aAAa,aAAa,EAC/B,cAAc,4BAA4B,OAAO,aACnD,CAAC,CACH,CAAC;AAED,MAAa,kBAAkB,OAAO,OAAO;CAC3C,UAAU;CACV,YAAY,oBAAoB,OAAO;CACvC,WAAW,qBAAqB,OAAO;CACvC,QAAQ;CACR,UAAU,oBAAoB,OAAO;CACrC,YAAY,oBAAoB,OAAO;CACvC,aAAa,4BAA4B,OAAO;CAChD,wBAAwB,4BAA4B,OAAO;CAC3D,+BAA+B;CAC/B,gBAAgB,OAAO,YAAY,4BAA4B,OAAO,MAAM;CAC5E,WAAW;AACb,CAAC;AAID,MAAa,yBAAyB,OAAO,MAAM,CACjD,OAAO,aAAa,UAAU,EAAE,MAAM,qBAAqB,CAAC,GAC5D,OAAO,aAAa,YAAY,CAAC,CAAC,CACpC,CAAC;AAED,MAAa,yBAAyB,OAAO,MAAM,CACjD,OAAO,aAAa,WAAW,EAAE,OAAO,eAAe,CAAC,GACxD,OAAO,aAAa,YAAY,CAAC,CAAC,CACpC,CAAC;AAED,MAAa,mBAAmB,OAAO,MAAM;CAC3C,OAAO,aAAa,YAAY,EAAE,UAAU,8BAA8B,CAAC;CAC3E,OAAO,aAAa,aAAa,CAAC,CAAC;CACnC,OAAO,aAAa,YAAY,CAAC,CAAC;CAClC,OAAO,aAAa,aAAa,CAAC,CAAC;AACrC,CAAC;AAID,MAAa,oBAAoB,OAAO,MAAM;CAC5C,OAAO,aAAa,UAAU;EAAE,YAAY;EAAyB,SAAS,OAAO;CAAQ,CAAC;CAC9F,OAAO,aAAa,aAAa,CAAC,CAAC;CACnC,OAAO,aAAa,YAAY,CAAC,CAAC;CAClC,OAAO,aAAa,YAAY,CAAC,CAAC;CAClC,OAAO,aAAa,aAAa,CAAC,CAAC;AACrC,CAAC;AAED,MAAa,wBAAwB,OAAO,MAAM;CAChD,OAAO,aAAa,UAAU,EAAE,YAAY,wBAAwB,CAAC;CACrE,OAAO,aAAa,UAAU,EAAE,QAAQ,cAAc,CAAC;CACvD,OAAO,aAAa,YAAY,CAAC,CAAC;CAClC,OAAO,aAAa,YAAY,CAAC,CAAC;AACpC,CAAC;AAED,MAAa,sBAAsB,OAAO,MAAM;CAC9C,OAAO,aAAa,YAAY;EAAE,QAAQ;EAAe,UAAU,OAAO;CAAQ,CAAC;CACnF,OAAO,aAAa,YAAY,CAAC,CAAC;CAClC,OAAO,aAAa,YAAY,CAAC,CAAC;CAClC,OAAO,aAAa,oBAAoB,CAAC,CAAC;AAC5C,CAAC"}