@yielded/auth 0.1.0-beta.1

package/dist/oauth/definition.mjs

@@ -0,0 +1,120 @@
+import { cryptoLayer, defaultLayer, hooksLayer } from "../auth/defaults.mjs";
+import { makeAuthStrategy } from "../auth/AuthStrategy.mjs";
+import { makeOAuthMethod } from "./signInModule.mjs";
+import { Array, Layer } from "effect";
+//#region src/oauth/definition.ts
+const captureDefine = (_namespace, input) => {
+	return { options: Object.freeze({
+		...input,
+		policy: Object.freeze({ ...input.policy })
+	}) };
+};
+const bindDefine = (binding, captured) => {
+	const { options } = captured;
+	const module = makeOAuthMethod(binding.namespace, { sessions: binding.sessions });
+	return Object.freeze({
+		...module,
+		strategy: makeAuthStrategy({
+			signIn: module.operations.Begin.invoke,
+			completeSignIn: module.operations.Complete.invoke
+		}, module.layer(options.policy), { completion: true })
+	});
+};
+const define = (namespace, input) => {
+	const captured = captureDefine(namespace, input);
+	const bind = (binding) => bindDefine(binding, captured);
+	return Object.freeze({
+		namespace,
+		bind
+	});
+};
+function make(options) {
+	return define(options.namespace, options);
+}
+const captureDefineRegistration = (_namespace, input) => {
+	return { options: Object.freeze({
+		...input,
+		policy: Object.freeze({ ...input.policy }),
+		registrationPolicy: Object.freeze({ ...input.registrationPolicy })
+	}) };
+};
+const bindDefineRegistration = (binding, captured) => {
+	const { options } = captured;
+	const module = makeOAuthMethod(binding.namespace, { sessions: binding.sessions });
+	const registration = module.registration(options.registration);
+	const layer = Layer.merge(module.handlersLayer, registration.handlersLayer).pipe(Layer.provide(Layer.merge(defaultLayer(module.SignIn, registration.signInLayer(options.policy, options.registrationPolicy)), defaultLayer(registration.Registrations, registration.layer))), Layer.provide(defaultLayer(module.binding.RequestBinding, module.binding.layer)), Layer.provide([cryptoLayer, hooksLayer]));
+	return Object.freeze({
+		...module,
+		registration,
+		strategy: makeAuthStrategy({
+			signIn: module.operations.Begin.invoke,
+			completeSignIn: module.operations.Complete.invoke,
+			register: registration.operations.Complete.invoke
+		}, layer, { completion: true })
+	});
+};
+const defineRegistration = (namespace, input) => {
+	const captured = captureDefineRegistration(namespace, input);
+	const bind = (binding) => bindDefineRegistration(binding, captured);
+	return Object.freeze({
+		namespace,
+		bind
+	});
+};
+/** Registration selects the protocol's registration transition and its separate completion. */
+function makeRegistration(options) {
+	return defineRegistration(options.namespace, options);
+}
+const captureDefineAccounts = (_namespace, input) => {
+	return { options: Object.freeze({
+		...input,
+		policy: Object.freeze({ ...input.policy })
+	}) };
+};
+const bindDefineAccounts = (binding, captured) => {
+	const { options } = captured;
+	return makeOAuthMethod(binding.namespace, { sessions: binding.sessions }).accounts(options.policy);
+};
+const defineAccounts = (namespace, input) => {
+	const captured = captureDefineAccounts(namespace, input);
+	const bind = (binding) => bindDefineAccounts(binding, captured);
+	return Object.freeze({
+		namespace,
+		bind
+	});
+};
+function makeAccounts(options) {
+	return defineAccounts(options.namespace, options);
+}
+const captureDefineConnected = (_namespace, input) => {
+	return { options: Object.freeze({
+		...input,
+		policy: Object.freeze({
+			...input.policy,
+			profiles: globalThis.Array.isArray(input.policy?.profiles) ? Object.freeze(Array.map(input.policy?.profiles, (profile) => Object.freeze({
+				...profile,
+				scopes: globalThis.Array.isArray(profile?.scopes) ? Object.freeze([...profile.scopes]) : profile?.scopes,
+				resources: globalThis.Array.isArray(profile?.resources) ? Object.freeze([...profile.resources]) : profile?.resources
+			}))) : input.policy?.profiles
+		})
+	}) };
+};
+const bindDefineConnected = (binding, captured) => {
+	const { options } = captured;
+	return makeOAuthMethod(binding.namespace, { sessions: binding.sessions }).connected(options.policy);
+};
+const defineConnected = (namespace, input) => {
+	const captured = captureDefineConnected(namespace, input);
+	const bind = (binding) => bindDefineConnected(binding, captured);
+	return Object.freeze({
+		namespace,
+		bind
+	});
+};
+function makeConnected(options) {
+	return defineConnected(options.namespace, options);
+}
+//#endregion
+export { make, makeAccounts, makeConnected, makeRegistration };
+
+//# sourceMappingURL=definition.mjs.map

package/dist/oauth/definition.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"definition.mjs","names":[],"sources":["../../src/oauth/definition.ts"],"sourcesContent":["import { Array, Layer } from \"effect\";\n\nimport { makeAuthStrategy } from \"../auth/AuthStrategy\";\nimport { cryptoLayer, defaultLayer, hooksLayer } from \"../auth/defaults\";\nimport type {\n  BindingOf,\n  ClaimsCodec,\n  StrategyBinding,\n  StrategyDefinition,\n  StrategyTypeLambda,\n} from \"../auth/definition\";\nimport type { OAuthAccountsPolicy } from \"./accountsModels\";\nimport type { OAuthConnectedPolicy } from \"./connectedModels\";\nimport type { OAuthRegistrationPolicy } from \"./registrationModels\";\nimport type { OAuthSignInPolicy } from \"./signInModels\";\nimport { makeOAuthMethod } from \"./signInModule\";\n\nexport interface OAuthOptions<Namespace extends string | undefined = undefined> {\n  readonly namespace?: Namespace;\n  readonly policy: OAuthSignInPolicy;\n}\n\nexport interface OAuthRegistrationOptions<\n  Registration extends ClaimsCodec,\n  Namespace extends string | undefined = undefined,\n> extends OAuthOptions<Namespace> {\n  readonly registration: Registration;\n  readonly registrationPolicy: OAuthRegistrationPolicy;\n}\n\nconst captureDefine = <const Namespace extends string | undefined>(\n  _namespace: Namespace,\n  input: OAuthOptions<Namespace>,\n) => {\n  const options = Object.freeze({ ...input, policy: Object.freeze({ ...input.policy }) });\n\n  return { options };\n};\n\nconst bindDefine = <\n  const Namespace extends string | undefined,\n  Claims extends ClaimsCodec,\n  const Id extends string,\n  const SessionId extends string,\n>(\n  binding: StrategyBinding<Claims, Id, SessionId>,\n  captured: ReturnType<typeof captureDefine<Namespace>>,\n) => {\n  const { options } = captured;\n\n  const module = makeOAuthMethod<Id, SessionId, Claims>(binding.namespace, {\n    sessions: binding.sessions,\n  });\n\n  return Object.freeze({\n    ...module,\n    strategy: makeAuthStrategy(\n      {\n        signIn: module.operations.Begin.invoke,\n        completeSignIn: module.operations.Complete.invoke,\n      },\n      module.layer(options.policy),\n      { completion: true },\n    ),\n  });\n};\n\nexport interface DefineStrategy<Namespace extends string | undefined> extends StrategyTypeLambda {\n  readonly type: ReturnType<\n    typeof bindDefine<\n      Namespace,\n      BindingOf<this>[\"claims\"],\n      BindingOf<this>[\"namespace\"],\n      BindingOf<this>[\"sessionNamespace\"]\n    >\n  >;\n}\n\nconst define = <const Namespace extends string | undefined>(\n  namespace: Namespace,\n  input: OAuthOptions<Namespace>,\n) => {\n  const captured = captureDefine<Namespace>(namespace, input);\n\n  const bind = <\n    Claims extends ClaimsCodec,\n    const Id extends string,\n    const SessionId extends string,\n  >(\n    binding: StrategyBinding<Claims, Id, SessionId>,\n  ) => bindDefine<Namespace, Claims, Id, SessionId>(binding, captured);\n\n  const definition: StrategyDefinition<DefineStrategy<Namespace>, Namespace> = {\n    namespace,\n    bind,\n  };\n\n  return Object.freeze(definition);\n};\n\nexport function make<const Namespace extends string>(\n  options: OAuthOptions<Namespace> & { readonly namespace: Namespace },\n): ReturnType<typeof define<Namespace>>;\n\nexport function make<const Namespace extends string | undefined = undefined>(\n  options: OAuthOptions<Namespace>,\n): ReturnType<typeof define<Namespace | undefined>>;\n\nexport function make<const Namespace extends string | undefined>(options: OAuthOptions<Namespace>) {\n  return define(options.namespace, options);\n}\n\nconst captureDefineRegistration = <\n  Registration extends ClaimsCodec,\n  const Namespace extends string | undefined = undefined,\n>(\n  _namespace: Namespace,\n  input: OAuthRegistrationOptions<Registration, Namespace>,\n) => {\n  const options = Object.freeze({\n    ...input,\n    policy: Object.freeze({ ...input.policy }),\n    registrationPolicy: Object.freeze({ ...input.registrationPolicy }),\n  });\n\n  return { options };\n};\n\nconst bindDefineRegistration = <\n  Registration extends ClaimsCodec,\n  const Namespace extends string | undefined,\n  Claims extends ClaimsCodec,\n  const Id extends string,\n  const SessionId extends string,\n>(\n  binding: StrategyBinding<Claims, Id, SessionId>,\n  captured: ReturnType<typeof captureDefineRegistration<Registration, Namespace>>,\n) => {\n  const { options } = captured;\n\n  const module = makeOAuthMethod<Id, SessionId, Claims>(binding.namespace, {\n    sessions: binding.sessions,\n  });\n\n  const registration = module.registration(options.registration);\n\n  const layer = Layer.merge(module.handlersLayer, registration.handlersLayer).pipe(\n    Layer.provide(\n      Layer.merge(\n        defaultLayer(\n          module.SignIn,\n          registration.signInLayer(options.policy, options.registrationPolicy),\n        ),\n        defaultLayer(registration.Registrations, registration.layer),\n      ),\n    ),\n    Layer.provide(defaultLayer(module.binding.RequestBinding, module.binding.layer)),\n    Layer.provide([cryptoLayer, hooksLayer]),\n  );\n\n  return Object.freeze({\n    ...module,\n    registration,\n    strategy: makeAuthStrategy(\n      {\n        signIn: module.operations.Begin.invoke,\n        completeSignIn: module.operations.Complete.invoke,\n        register: registration.operations.Complete.invoke,\n      },\n      layer,\n      { completion: true },\n    ),\n  });\n};\n\nexport interface DefineRegistrationStrategy<\n  Registration extends ClaimsCodec,\n  Namespace extends string | undefined = undefined,\n> extends StrategyTypeLambda {\n  readonly type: ReturnType<\n    typeof bindDefineRegistration<\n      Registration,\n      Namespace,\n      BindingOf<this>[\"claims\"],\n      BindingOf<this>[\"namespace\"],\n      BindingOf<this>[\"sessionNamespace\"]\n    >\n  >;\n}\n\nconst defineRegistration = <\n  Registration extends ClaimsCodec,\n  const Namespace extends string | undefined = undefined,\n>(\n  namespace: Namespace,\n  input: OAuthRegistrationOptions<Registration, Namespace>,\n) => {\n  const captured = captureDefineRegistration<Registration, Namespace>(namespace, input);\n\n  const bind = <\n    Claims extends ClaimsCodec,\n    const Id extends string,\n    const SessionId extends string,\n  >(\n    binding: StrategyBinding<Claims, Id, SessionId>,\n  ) => bindDefineRegistration<Registration, Namespace, Claims, Id, SessionId>(binding, captured);\n\n  const definition: StrategyDefinition<\n    DefineRegistrationStrategy<Registration, Namespace>,\n    Namespace\n  > = {\n    namespace,\n    bind,\n  };\n\n  return Object.freeze(definition);\n};\n\nexport function makeRegistration<Registration extends ClaimsCodec, const Namespace extends string>(\n  options: OAuthRegistrationOptions<Registration, Namespace> & { readonly namespace: Namespace },\n): ReturnType<typeof defineRegistration<Registration, Namespace>>;\n\nexport function makeRegistration<\n  Registration extends ClaimsCodec,\n  const Namespace extends string | undefined = undefined,\n>(\n  options: OAuthRegistrationOptions<Registration, Namespace>,\n): ReturnType<typeof defineRegistration<Registration, Namespace | undefined>>;\n\n/** Registration selects the protocol's registration transition and its separate completion. */\nexport function makeRegistration<\n  Registration extends ClaimsCodec,\n  const Namespace extends string | undefined,\n>(options: OAuthRegistrationOptions<Registration, Namespace>) {\n  return defineRegistration(options.namespace, options);\n}\n\nexport interface OAuthAccountsOptions<Namespace extends string | undefined = undefined> {\n  readonly namespace?: Namespace;\n  readonly policy: OAuthAccountsPolicy;\n}\n\nconst captureDefineAccounts = <const Namespace extends string | undefined>(\n  _namespace: Namespace,\n  input: OAuthAccountsOptions<Namespace>,\n) => {\n  const options = Object.freeze({ ...input, policy: Object.freeze({ ...input.policy }) });\n\n  return { options };\n};\n\nconst bindDefineAccounts = <\n  const Namespace extends string | undefined,\n  Claims extends ClaimsCodec,\n  const Id extends string,\n  const SessionId extends string,\n>(\n  binding: StrategyBinding<Claims, Id, SessionId>,\n  captured: ReturnType<typeof captureDefineAccounts<Namespace>>,\n) => {\n  const { options } = captured;\n\n  return makeOAuthMethod<Id, SessionId, Claims>(binding.namespace, {\n    sessions: binding.sessions,\n  }).accounts(options.policy);\n};\n\nexport interface DefineAccountsStrategy<\n  Namespace extends string | undefined,\n> extends StrategyTypeLambda {\n  readonly type: ReturnType<\n    typeof bindDefineAccounts<\n      Namespace,\n      BindingOf<this>[\"claims\"],\n      BindingOf<this>[\"namespace\"],\n      BindingOf<this>[\"sessionNamespace\"]\n    >\n  >;\n}\n\nconst defineAccounts = <const Namespace extends string | undefined>(\n  namespace: Namespace,\n  input: OAuthAccountsOptions<Namespace>,\n) => {\n  const captured = captureDefineAccounts<Namespace>(namespace, input);\n\n  const bind = <\n    Claims extends ClaimsCodec,\n    const Id extends string,\n    const SessionId extends string,\n  >(\n    binding: StrategyBinding<Claims, Id, SessionId>,\n  ) => bindDefineAccounts<Namespace, Claims, Id, SessionId>(binding, captured);\n\n  const definition: StrategyDefinition<DefineAccountsStrategy<Namespace>, Namespace> = {\n    namespace,\n    bind,\n  };\n\n  return Object.freeze(definition);\n};\n\nexport function makeAccounts<const Namespace extends string>(\n  options: OAuthAccountsOptions<Namespace> & { readonly namespace: Namespace },\n): ReturnType<typeof defineAccounts<Namespace>>;\n\nexport function makeAccounts<const Namespace extends string | undefined = undefined>(\n  options: OAuthAccountsOptions<Namespace>,\n): ReturnType<typeof defineAccounts<Namespace | undefined>>;\n\nexport function makeAccounts<const Namespace extends string | undefined>(\n  options: OAuthAccountsOptions<Namespace>,\n) {\n  return defineAccounts(options.namespace, options);\n}\n\nexport interface OAuthConnectedOptions<Namespace extends string | undefined = undefined> {\n  readonly namespace?: Namespace;\n  readonly policy: OAuthConnectedPolicy;\n}\n\nconst captureDefineConnected = <const Namespace extends string | undefined>(\n  _namespace: Namespace,\n  input: OAuthConnectedOptions<Namespace>,\n) => {\n  const options = Object.freeze({\n    ...input,\n    policy: Object.freeze({\n      ...input.policy,\n      profiles: globalThis.Array.isArray(input.policy?.profiles)\n        ? Object.freeze(\n            Array.map(input.policy?.profiles, (profile) =>\n              Object.freeze({\n                ...profile,\n                scopes: globalThis.Array.isArray(profile?.scopes)\n                  ? Object.freeze([...profile.scopes])\n                  : profile?.scopes,\n                resources: globalThis.Array.isArray(profile?.resources)\n                  ? Object.freeze([...profile.resources])\n                  : profile?.resources,\n              }),\n            ),\n          )\n        : input.policy?.profiles,\n    }),\n  });\n\n  return { options };\n};\n\nconst bindDefineConnected = <\n  const Namespace extends string | undefined,\n  Claims extends ClaimsCodec,\n  const Id extends string,\n  const SessionId extends string,\n>(\n  binding: StrategyBinding<Claims, Id, SessionId>,\n  captured: ReturnType<typeof captureDefineConnected<Namespace>>,\n) => {\n  const { options } = captured;\n\n  return makeOAuthMethod<Id, SessionId, Claims>(binding.namespace, {\n    sessions: binding.sessions,\n  }).connected(options.policy);\n};\n\nexport interface DefineConnectedStrategy<\n  Namespace extends string | undefined,\n> extends StrategyTypeLambda {\n  readonly type: ReturnType<\n    typeof bindDefineConnected<\n      Namespace,\n      BindingOf<this>[\"claims\"],\n      BindingOf<this>[\"namespace\"],\n      BindingOf<this>[\"sessionNamespace\"]\n    >\n  >;\n}\n\nconst defineConnected = <const Namespace extends string | undefined>(\n  namespace: Namespace,\n  input: OAuthConnectedOptions<Namespace>,\n) => {\n  const captured = captureDefineConnected<Namespace>(namespace, input);\n\n  const bind = <\n    Claims extends ClaimsCodec,\n    const Id extends string,\n    const SessionId extends string,\n  >(\n    binding: StrategyBinding<Claims, Id, SessionId>,\n  ) => bindDefineConnected<Namespace, Claims, Id, SessionId>(binding, captured);\n\n  const definition: StrategyDefinition<DefineConnectedStrategy<Namespace>, Namespace> = {\n    namespace,\n    bind,\n  };\n\n  return Object.freeze(definition);\n};\n\nexport function makeConnected<const Namespace extends string>(\n  options: OAuthConnectedOptions<Namespace> & { readonly namespace: Namespace },\n): ReturnType<typeof defineConnected<Namespace>>;\n\nexport function makeConnected<const Namespace extends string | undefined = undefined>(\n  options: OAuthConnectedOptions<Namespace>,\n): ReturnType<typeof defineConnected<Namespace | undefined>>;\n\nexport function makeConnected<const Namespace extends string | undefined>(\n  options: OAuthConnectedOptions<Namespace>,\n) {\n  return defineConnected(options.namespace, options);\n}\n"],"mappings":";;;;;AA8BA,MAAM,iBACJ,YACA,UACG;CAGH,OAAO,EAAE,SAFO,OAAO,OAAO;EAAE,GAAG;EAAO,QAAQ,OAAO,OAAO,EAAE,GAAG,MAAM,OAAO,CAAC;CAAE,CAEtE,EAAE;AACnB;AAEA,MAAM,cAMJ,SACA,aACG;CACH,MAAM,EAAE,YAAY;CAEpB,MAAM,SAAS,gBAAuC,QAAQ,WAAW,EACvE,UAAU,QAAQ,SACpB,CAAC;CAED,OAAO,OAAO,OAAO;EACnB,GAAG;EACH,UAAU,iBACR;GACE,QAAQ,OAAO,WAAW,MAAM;GAChC,gBAAgB,OAAO,WAAW,SAAS;EAC7C,GACA,OAAO,MAAM,QAAQ,MAAM,GAC3B,EAAE,YAAY,KAAK,CACrB;CACF,CAAC;AACH;AAaA,MAAM,UACJ,WACA,UACG;CACH,MAAM,WAAW,cAAyB,WAAW,KAAK;CAE1D,MAAM,QAKJ,YACG,WAA6C,SAAS,QAAQ;CAOnE,OAAO,OAAO,OAAO;EAJnB;EACA;CAG4B,CAAC;AACjC;AAUA,SAAgB,KAAiD,SAAkC;CACjG,OAAO,OAAO,QAAQ,WAAW,OAAO;AAC1C;AAEA,MAAM,6BAIJ,YACA,UACG;CAOH,OAAO,EAAE,SANO,OAAO,OAAO;EAC5B,GAAG;EACH,QAAQ,OAAO,OAAO,EAAE,GAAG,MAAM,OAAO,CAAC;EACzC,oBAAoB,OAAO,OAAO,EAAE,GAAG,MAAM,mBAAmB,CAAC;CACnE,CAEe,EAAE;AACnB;AAEA,MAAM,0BAOJ,SACA,aACG;CACH,MAAM,EAAE,YAAY;CAEpB,MAAM,SAAS,gBAAuC,QAAQ,WAAW,EACvE,UAAU,QAAQ,SACpB,CAAC;CAED,MAAM,eAAe,OAAO,aAAa,QAAQ,YAAY;CAE7D,MAAM,QAAQ,MAAM,MAAM,OAAO,eAAe,aAAa,aAAa,CAAC,CAAC,KAC1E,MAAM,QACJ,MAAM,MACJ,aACE,OAAO,QACP,aAAa,YAAY,QAAQ,QAAQ,QAAQ,kBAAkB,CACrE,GACA,aAAa,aAAa,eAAe,aAAa,KAAK,CAC7D,CACF,GACA,MAAM,QAAQ,aAAa,OAAO,QAAQ,gBAAgB,OAAO,QAAQ,KAAK,CAAC,GAC/E,MAAM,QAAQ,CAAC,aAAa,UAAU,CAAC,CACzC;CAEA,OAAO,OAAO,OAAO;EACnB,GAAG;EACH;EACA,UAAU,iBACR;GACE,QAAQ,OAAO,WAAW,MAAM;GAChC,gBAAgB,OAAO,WAAW,SAAS;GAC3C,UAAU,aAAa,WAAW,SAAS;EAC7C,GACA,OACA,EAAE,YAAY,KAAK,CACrB;CACF,CAAC;AACH;AAiBA,MAAM,sBAIJ,WACA,UACG;CACH,MAAM,WAAW,0BAAmD,WAAW,KAAK;CAEpF,MAAM,QAKJ,YACG,uBAAuE,SAAS,QAAQ;CAU7F,OAAO,OAAO,OAAO;EAJnB;EACA;CAG4B,CAAC;AACjC;;AAcA,SAAgB,iBAGd,SAA4D;CAC5D,OAAO,mBAAmB,QAAQ,WAAW,OAAO;AACtD;AAOA,MAAM,yBACJ,YACA,UACG;CAGH,OAAO,EAAE,SAFO,OAAO,OAAO;EAAE,GAAG;EAAO,QAAQ,OAAO,OAAO,EAAE,GAAG,MAAM,OAAO,CAAC;CAAE,CAEtE,EAAE;AACnB;AAEA,MAAM,sBAMJ,SACA,aACG;CACH,MAAM,EAAE,YAAY;CAEpB,OAAO,gBAAuC,QAAQ,WAAW,EAC/D,UAAU,QAAQ,SACpB,CAAC,CAAC,CAAC,SAAS,QAAQ,MAAM;AAC5B;AAeA,MAAM,kBACJ,WACA,UACG;CACH,MAAM,WAAW,sBAAiC,WAAW,KAAK;CAElE,MAAM,QAKJ,YACG,mBAAqD,SAAS,QAAQ;CAO3E,OAAO,OAAO,OAAO;EAJnB;EACA;CAG4B,CAAC;AACjC;AAUA,SAAgB,aACd,SACA;CACA,OAAO,eAAe,QAAQ,WAAW,OAAO;AAClD;AAOA,MAAM,0BACJ,YACA,UACG;CAuBH,OAAO,EAAE,SAtBO,OAAO,OAAO;EAC5B,GAAG;EACH,QAAQ,OAAO,OAAO;GACpB,GAAG,MAAM;GACT,UAAU,WAAW,MAAM,QAAQ,MAAM,QAAQ,QAAQ,IACrD,OAAO,OACL,MAAM,IAAI,MAAM,QAAQ,WAAW,YACjC,OAAO,OAAO;IACZ,GAAG;IACH,QAAQ,WAAW,MAAM,QAAQ,SAAS,MAAM,IAC5C,OAAO,OAAO,CAAC,GAAG,QAAQ,MAAM,CAAC,IACjC,SAAS;IACb,WAAW,WAAW,MAAM,QAAQ,SAAS,SAAS,IAClD,OAAO,OAAO,CAAC,GAAG,QAAQ,SAAS,CAAC,IACpC,SAAS;GACf,CAAC,CACH,CACF,IACA,MAAM,QAAQ;EACpB,CAAC;CACH,CAEe,EAAE;AACnB;AAEA,MAAM,uBAMJ,SACA,aACG;CACH,MAAM,EAAE,YAAY;CAEpB,OAAO,gBAAuC,QAAQ,WAAW,EAC/D,UAAU,QAAQ,SACpB,CAAC,CAAC,CAAC,UAAU,QAAQ,MAAM;AAC7B;AAeA,MAAM,mBACJ,WACA,UACG;CACH,MAAM,WAAW,uBAAkC,WAAW,KAAK;CAEnE,MAAM,QAKJ,YACG,oBAAsD,SAAS,QAAQ;CAO5E,OAAO,OAAO,OAAO;EAJnB;EACA;CAG4B,CAAC;AACjC;AAUA,SAAgB,cACd,SACA;CACA,OAAO,gBAAgB,QAAQ,WAAW,OAAO;AACnD"}

package/dist/oauth/errors.d.mts

@@ -0,0 +1,49 @@
+import { Schema } from "effect";
+//#region src/oauth/errors.d.ts
+declare const UnknownOAuthProvider_base: Schema.Class<UnknownOAuthProvider, Schema.TaggedStruct<"UnknownOAuthProvider", {
+  readonly provider: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** The callback names a provider the application did not configure. */
+declare class UnknownOAuthProvider extends UnknownOAuthProvider_base {}
+declare const InvalidOAuthState_base: Schema.Class<InvalidOAuthState, Schema.TaggedStruct<"InvalidOAuthState", {}>, import("effect/Cause").YieldableError>;
+/**
+ * Authorization state failure. The reasons (missing, unknown, expired,
+ * already consumed, wrong subject, wrong provider, wrong redirect URI, missing
+ * code) deliberately collapse into one payload-free error so callback
+ * responses cannot be used to probe state.
+ */
+declare class InvalidOAuthState extends InvalidOAuthState_base {}
+declare const OAuthAccessDenied_base: Schema.Class<OAuthAccessDenied, Schema.TaggedStruct<"OAuthAccessDenied", {}>, import("effect/Cause").YieldableError>;
+/** The actor declined the provider's consent screen. */
+declare class OAuthAccessDenied extends OAuthAccessDenied_base {}
+declare const OAuthReauthorizationRequired_base: Schema.Class<OAuthReauthorizationRequired, Schema.TaggedStruct<"OAuthReauthorizationRequired", {}>, import("effect/Cause").YieldableError>;
+/**
+ * No usable access token exists for the subject: the access token expired and
+ * there is no live refresh token, or the provider rejected the refresh grant.
+ * The application must send the actor back through {@link OAuth.begin}.
+ */
+declare class OAuthReauthorizationRequired extends OAuthReauthorizationRequired_base {}
+declare const OAuthConnectionNotFound_base: Schema.Class<OAuthConnectionNotFound, Schema.TaggedStruct<"OAuthConnectionNotFound", {}>, import("effect/Cause").YieldableError>;
+/** The subject has no connection for the provider. */
+declare class OAuthConnectionNotFound extends OAuthConnectionNotFound_base {}
+declare const OAuthGrantRejected_base: Schema.Class<OAuthGrantRejected, Schema.TaggedStruct<"OAuthGrantRejected", {
+  readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+  /** The provider's `error` code (e.g. `access_denied`, `bad_verification_code`). */
+  readonly code: Schema.NonEmptyString;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * The provider's token endpoint answered with a well-formed OAuth error
+ * payload. Raised by provider token-grant decoders; the workflow maps it to
+ * `OAuthAccessDenied`, `OAuthReauthorizationRequired`, or
+ * `OAuthProviderError` depending on the grant being attempted.
+ */
+declare class OAuthGrantRejected extends OAuthGrantRejected_base {}
+declare const OAuthProviderError_base: Schema.Class<OAuthProviderError, Schema.TaggedStruct<"OAuthProviderError", {
+  readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+  readonly message: Schema.NonEmptyString;
+}>, import("effect/Cause").YieldableError>;
+/** The provider is unreachable or answered outside its contract. */
+declare class OAuthProviderError extends OAuthProviderError_base {}
+//#endregion
+export { InvalidOAuthState, OAuthAccessDenied, OAuthConnectionNotFound, OAuthGrantRejected, OAuthProviderError, OAuthReauthorizationRequired, UnknownOAuthProvider };
+//# sourceMappingURL=errors.d.mts.map

package/dist/oauth/errors.mjs

@@ -0,0 +1,42 @@
+import { OAuthProviderKey } from "./schema.mjs";
+import { Schema } from "effect";
+//#region src/oauth/errors.ts
+/** The callback names a provider the application did not configure. */
+var UnknownOAuthProvider = class extends Schema.TaggedError()("UnknownOAuthProvider", { provider: Schema.String }, { httpApiStatus: 404 }) {};
+/**
+* Authorization state failure. The reasons (missing, unknown, expired,
+* already consumed, wrong subject, wrong provider, wrong redirect URI, missing
+* code) deliberately collapse into one payload-free error so callback
+* responses cannot be used to probe state.
+*/
+var InvalidOAuthState = class extends Schema.TaggedError()("InvalidOAuthState", {}, { httpApiStatus: 401 }) {};
+/** The actor declined the provider's consent screen. */
+var OAuthAccessDenied = class extends Schema.TaggedError()("OAuthAccessDenied", {}, { httpApiStatus: 403 }) {};
+/**
+* No usable access token exists for the subject: the access token expired and
+* there is no live refresh token, or the provider rejected the refresh grant.
+* The application must send the actor back through {@link OAuth.begin}.
+*/
+var OAuthReauthorizationRequired = class extends Schema.TaggedError()("OAuthReauthorizationRequired", {}, { httpApiStatus: 409 }) {};
+/** The subject has no connection for the provider. */
+var OAuthConnectionNotFound = class extends Schema.TaggedError()("OAuthConnectionNotFound", {}, { httpApiStatus: 404 }) {};
+/**
+* The provider's token endpoint answered with a well-formed OAuth error
+* payload. Raised by provider token-grant decoders; the workflow maps it to
+* `OAuthAccessDenied`, `OAuthReauthorizationRequired`, or
+* `OAuthProviderError` depending on the grant being attempted.
+*/
+var OAuthGrantRejected = class extends Schema.TaggedError()("OAuthGrantRejected", {
+	provider: OAuthProviderKey,
+	/** The provider's `error` code (e.g. `access_denied`, `bad_verification_code`). */
+	code: Schema.NonEmptyString
+}) {};
+/** The provider is unreachable or answered outside its contract. */
+var OAuthProviderError = class extends Schema.TaggedError()("OAuthProviderError", {
+	provider: OAuthProviderKey,
+	message: Schema.NonEmptyString
+}) {};
+//#endregion
+export { InvalidOAuthState, OAuthAccessDenied, OAuthConnectionNotFound, OAuthGrantRejected, OAuthProviderError, OAuthReauthorizationRequired, UnknownOAuthProvider };
+
+//# sourceMappingURL=errors.mjs.map

package/dist/oauth/errors.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.mjs","names":[],"sources":["../../src/oauth/errors.ts"],"sourcesContent":["import { Schema } from \"effect\";\n\nimport { OAuthProviderKey } from \"./schema\";\n\n// Declared in the style of the package's root `errors.ts`: expected\n// transport-facing errors carry their HTTP status as a schema annotation;\n// infrastructure failures carry none and are mapped at the HTTP boundary.\n// Messages must never contain tokens, codes, or state values.\n\n/** The callback names a provider the application did not configure. */\nexport class UnknownOAuthProvider extends Schema.TaggedError<UnknownOAuthProvider>()(\n  \"UnknownOAuthProvider\",\n  {\n    provider: Schema.String,\n  },\n  { httpApiStatus: 404 },\n) {}\n\n/**\n * Authorization state failure. The reasons (missing, unknown, expired,\n * already consumed, wrong subject, wrong provider, wrong redirect URI, missing\n * code) deliberately collapse into one payload-free error so callback\n * responses cannot be used to probe state.\n */\nexport class InvalidOAuthState extends Schema.TaggedError<InvalidOAuthState>()(\n  \"InvalidOAuthState\",\n  {},\n  { httpApiStatus: 401 },\n) {}\n\n/** The actor declined the provider's consent screen. */\nexport class OAuthAccessDenied extends Schema.TaggedError<OAuthAccessDenied>()(\n  \"OAuthAccessDenied\",\n  {},\n  { httpApiStatus: 403 },\n) {}\n\n/**\n * No usable access token exists for the subject: the access token expired and\n * there is no live refresh token, or the provider rejected the refresh grant.\n * The application must send the actor back through {@link OAuth.begin}.\n */\nexport class OAuthReauthorizationRequired extends Schema.TaggedError<OAuthReauthorizationRequired>()(\n  \"OAuthReauthorizationRequired\",\n  {},\n  { httpApiStatus: 409 },\n) {}\n\n/** The subject has no connection for the provider. */\nexport class OAuthConnectionNotFound extends Schema.TaggedError<OAuthConnectionNotFound>()(\n  \"OAuthConnectionNotFound\",\n  {},\n  { httpApiStatus: 404 },\n) {}\n\n/**\n * The provider's token endpoint answered with a well-formed OAuth error\n * payload. Raised by provider token-grant decoders; the workflow maps it to\n * `OAuthAccessDenied`, `OAuthReauthorizationRequired`, or\n * `OAuthProviderError` depending on the grant being attempted.\n */\nexport class OAuthGrantRejected extends Schema.TaggedError<OAuthGrantRejected>()(\n  \"OAuthGrantRejected\",\n  {\n    provider: OAuthProviderKey,\n    /** The provider's `error` code (e.g. `access_denied`, `bad_verification_code`). */\n    code: Schema.NonEmptyString,\n  },\n) {}\n\n/** The provider is unreachable or answered outside its contract. */\nexport class OAuthProviderError extends Schema.TaggedError<OAuthProviderError>()(\n  \"OAuthProviderError\",\n  {\n    provider: OAuthProviderKey,\n    message: Schema.NonEmptyString,\n  },\n) {}\n"],"mappings":";;;;AAUA,IAAa,uBAAb,cAA0C,OAAO,YAAkC,CAAC,CAClF,wBACA,EACE,UAAU,OAAO,OACnB,GACA,EAAE,eAAe,IAAI,CACvB,CAAC,CAAC,CAAC;;;;;;;AAQH,IAAa,oBAAb,cAAuC,OAAO,YAA+B,CAAC,CAC5E,qBACA,CAAC,GACD,EAAE,eAAe,IAAI,CACvB,CAAC,CAAC,CAAC;;AAGH,IAAa,oBAAb,cAAuC,OAAO,YAA+B,CAAC,CAC5E,qBACA,CAAC,GACD,EAAE,eAAe,IAAI,CACvB,CAAC,CAAC,CAAC;;;;;;AAOH,IAAa,+BAAb,cAAkD,OAAO,YAA0C,CAAC,CAClG,gCACA,CAAC,GACD,EAAE,eAAe,IAAI,CACvB,CAAC,CAAC,CAAC;;AAGH,IAAa,0BAAb,cAA6C,OAAO,YAAqC,CAAC,CACxF,2BACA,CAAC,GACD,EAAE,eAAe,IAAI,CACvB,CAAC,CAAC,CAAC;;;;;;;AAQH,IAAa,qBAAb,cAAwC,OAAO,YAAgC,CAAC,CAC9E,sBACA;CACE,UAAU;;CAEV,MAAM,OAAO;AACf,CACF,CAAC,CAAC,CAAC;;AAGH,IAAa,qBAAb,cAAwC,OAAO,YAAgC,CAAC,CAC9E,sBACA;CACE,UAAU;CACV,SAAS,OAAO;AAClB,CACF,CAAC,CAAC,CAAC"}

package/dist/oauth/github/identity.d.mts

@@ -0,0 +1,8 @@
+import "../signInErrors.mjs";
+import "../openid-client/models.mjs";
+import { Effect } from "effect";
+//#region src/oauth/github/identity.d.ts
+declare const gitHubOAuthAppProviderKey: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
+//#endregion
+export { gitHubOAuthAppProviderKey };
+//# sourceMappingURL=identity.d.mts.map

package/dist/oauth/github/identity.mjs

@@ -0,0 +1,24 @@
+import { OAuthProviderKey } from "../schema.mjs";
+import { OAuthProtocolRejected } from "../signInErrors.mjs";
+import { Effect, Schema } from "effect";
+//#region src/oauth/github/identity.ts
+const gitHubOAuthAppProviderKey = OAuthProviderKey.make("github");
+const identity = Schema.Struct({
+	id: Schema.Int.check(Schema.isBetween({
+		minimum: 1,
+		maximum: Number.MAX_SAFE_INTEGER
+	})),
+	login: Schema.optionalKey(Schema.NonEmptyString.check(Schema.isMaxLength(256)))
+});
+const decode = Schema.decodeUnknownEffect(identity);
+const decodeGitHubIdentity = Effect.fn("GitHubOAuthApp.decodeIdentity")(function* (body) {
+	const value = yield* decode(body).pipe(Effect.mapError(() => OAuthProtocolRejected.make({})));
+	return {
+		subject: String(value.id),
+		...value.login === void 0 ? {} : { profile: { displayName: value.login } }
+	};
+});
+//#endregion
+export { decodeGitHubIdentity, gitHubOAuthAppProviderKey };
+
+//# sourceMappingURL=identity.mjs.map

package/dist/oauth/github/identity.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.mjs","names":[],"sources":["../../../src/oauth/github/identity.ts"],"sourcesContent":["import { Effect, Schema } from \"effect\";\n\nimport type { PlainOAuthIdentity } from \"../openid-client/models\";\nimport { OAuthProviderKey } from \"../schema\";\nimport { OAuthProtocolRejected } from \"../signInErrors\";\n\nexport const gitHubOAuthAppProviderKey = OAuthProviderKey.make(\"github\");\n\nconst identity = Schema.Struct({\n  id: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: Number.MAX_SAFE_INTEGER })),\n  login: Schema.optionalKey(Schema.NonEmptyString.check(Schema.isMaxLength(256))),\n});\n\n// oxlint-disable-next-line no-restricted-properties -- GitHub /user is an untyped, freshly authenticated JSON boundary.\nconst decode = Schema.decodeUnknownEffect(identity);\n\nexport const decodeGitHubIdentity = Effect.fn(\"GitHubOAuthApp.decodeIdentity\")(function* (\n  body: unknown,\n): Effect.fn.Return<PlainOAuthIdentity, OAuthProtocolRejected> {\n  const value = yield* decode(body).pipe(Effect.mapError(() => OAuthProtocolRejected.make({})));\n\n  return {\n    subject: String(value.id),\n    ...(value.login === undefined ? {} : { profile: { displayName: value.login } }),\n  };\n});\n"],"mappings":";;;;AAMA,MAAa,4BAA4B,iBAAiB,KAAK,QAAQ;AAEvE,MAAM,WAAW,OAAO,OAAO;CAC7B,IAAI,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS,OAAO;CAAiB,CAAC,CAAC;CACvF,OAAO,OAAO,YAAY,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC;AAChF,CAAC;AAGD,MAAM,SAAS,OAAO,oBAAoB,QAAQ;AAElD,MAAa,uBAAuB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAC7E,MAC6D;CAC7D,MAAM,QAAQ,OAAO,OAAO,IAAI,CAAC,CAAC,KAAK,OAAO,eAAe,sBAAsB,KAAK,CAAC,CAAC,CAAC,CAAC;CAE5F,OAAO;EACL,SAAS,OAAO,MAAM,EAAE;EACxB,GAAI,MAAM,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,EAAE,aAAa,MAAM,MAAM,EAAE;CAC/E;AACF,CAAC"}

package/dist/oauth/github/models.d.mts

@@ -0,0 +1,34 @@
+import { OAuthProtocolConfiguration } from "../signInModels.mjs";
+import { OAuthConnectedProfile } from "../connectedModels.mjs";
+import { OpenIdClientConfigurationError } from "../openid-client/models.mjs";
+import { Redacted } from "effect";
+import { CustomFetch } from "openid-client";
+//#region src/oauth/github/models.d.ts
+/** GitHub.com OAuth App credentials, distinct from GitHub App installation or user tokens. */
+interface GitHubOAuthAppGeneration {
+  readonly configurationGeneration: OAuthProtocolConfiguration["configurationGeneration"];
+  readonly issuance: "active" | "retired";
+  readonly clientId: string;
+  readonly clientSecret: Redacted.Redacted<string>;
+  readonly callbacks: ReadonlyArray<{
+    readonly callbackId: OAuthProtocolConfiguration["callbackId"];
+    readonly redirectUri: OAuthProtocolConfiguration["redirectUri"];
+  }>;
+}
+interface GitHubOAuthAppProtocolOptions {
+  readonly registrations: ReadonlyArray<GitHubOAuthAppGeneration>;
+  readonly timeoutSeconds: number;
+  /** Trusted transport: preserve endpoint authority and cancellation; never retry or log credentials. */
+  readonly fetch?: CustomFetch;
+}
+interface GitHubOAuthAppConnectedProtocolOptions {
+  readonly registrations: ReadonlyArray<GitHubOAuthAppGeneration & {
+    /** Each profile uses provider "github" and its actual clientId as clientRegistrationId. */
+    readonly profiles: ReadonlyArray<OAuthConnectedProfile>;
+  }>;
+  readonly timeoutSeconds: number;
+  readonly fetch?: CustomFetch;
+}
+//#endregion
+export { GitHubOAuthAppConnectedProtocolOptions, GitHubOAuthAppGeneration, GitHubOAuthAppProtocolOptions };
+//# sourceMappingURL=models.d.mts.map

package/dist/oauth/github/protocol.d.mts

@@ -0,0 +1,54 @@
+import { RequestBindingFlowId } from "../../operations/requestBindingModels.mjs";
+import "../../Operations.mjs";
+import { OAuthProviderKey } from "../schema.mjs";
+import { OAuthProtocolRejected, OAuthRejected, OAuthUnavailable } from "../signInErrors.mjs";
+import { OAuthCallbackId, OAuthCodeResponse, OAuthProtocolConfiguration, OAuthProtocolPreparation, OAuthTransactionSecrets, OAuthVerifiedExternalIdentity } from "../signInModels.mjs";
+import { OAuthConnectedConfiguration, OAuthConnectedGrantResponse, OAuthConnectedProfile, OAuthConnectedTokenContext, OAuthConnectedTokenMaterial } from "../connectedModels.mjs";
+import { OAuthConnectedProtocol } from "../OAuthConnectedProtocol.mjs";
+import { OAuthProtocol } from "../OAuthProtocol.mjs";
+import { OpenIdClientConfigurationError } from "../openid-client/models.mjs";
+import { GitHubOAuthAppConnectedProtocolOptions, GitHubOAuthAppProtocolOptions } from "./models.mjs";
+import { Effect, Layer } from "effect";
+//#region src/oauth/github/protocol.d.ts
+declare const makeGitHubOAuthAppProtocol: (options: GitHubOAuthAppProtocolOptions) => Effect.Effect<{
+  readonly prepareAuthorization: (input: {
+    readonly provider: OAuthProviderKey;
+    readonly callbackId: typeof OAuthCallbackId.Type;
+    readonly flowId: RequestBindingFlowId;
+  }) => Effect.Effect<OAuthProtocolPreparation, OAuthRejected | OAuthUnavailable>;
+  readonly exchangeVerifiedIdentity: (input: {
+    readonly configuration: OAuthProtocolConfiguration;
+    readonly response: OAuthCodeResponse;
+    readonly secrets: OAuthTransactionSecrets;
+    readonly verificationStartedAt: import("effect/DateTime").Utc;
+  }) => Effect.Effect<OAuthVerifiedExternalIdentity, OAuthProtocolRejected | OAuthUnavailable>;
+}, OAuthUnavailable | OpenIdClientConfigurationError, never>;
+declare const makeGitHubOAuthAppConnectedProtocol: (options: GitHubOAuthAppConnectedProtocolOptions) => Effect.Effect<{
+  readonly prepareAuthorization: (input: {
+    readonly profile: OAuthConnectedProfile;
+    readonly callbackId: typeof OAuthCallbackId.Type;
+    readonly flowId: RequestBindingFlowId;
+  }) => Effect.Effect<Omit<OAuthProtocolPreparation, "configuration"> & {
+    readonly configuration: OAuthConnectedConfiguration;
+  }, OAuthProtocolRejected | OAuthUnavailable>;
+  readonly exchangeGrant: (input: {
+    readonly configuration: OAuthConnectedConfiguration;
+    readonly secrets: OAuthTransactionSecrets;
+    readonly response: OAuthCodeResponse;
+    readonly verificationStartedAt: import("effect/DateTime").Utc;
+  }) => Effect.Effect<OAuthConnectedGrantResponse, OAuthProtocolRejected | OAuthUnavailable>;
+  readonly refreshGrant: (input: {
+    readonly context: OAuthConnectedTokenContext;
+    readonly material: OAuthConnectedTokenMaterial;
+    readonly verificationStartedAt: import("effect/DateTime").Utc;
+  }) => Effect.Effect<OAuthConnectedGrantResponse, OAuthProtocolRejected | OAuthUnavailable>;
+  readonly revokeGrant: (input: {
+    readonly context: OAuthConnectedTokenContext;
+    readonly material: OAuthConnectedTokenMaterial;
+  }) => Effect.Effect<"Confirmed", OAuthUnavailable>;
+}, OAuthUnavailable | OpenIdClientConfigurationError, never>;
+declare const gitHubOAuthAppProtocolLayer: (options: GitHubOAuthAppProtocolOptions) => Layer.Layer<OAuthProtocol, OAuthUnavailable | OpenIdClientConfigurationError, never>;
+declare const gitHubOAuthAppConnectedProtocolLayer: (options: GitHubOAuthAppConnectedProtocolOptions) => Layer.Layer<OAuthConnectedProtocol, OAuthUnavailable | OpenIdClientConfigurationError, never>;
+//#endregion
+export { gitHubOAuthAppConnectedProtocolLayer, gitHubOAuthAppProtocolLayer, makeGitHubOAuthAppConnectedProtocol, makeGitHubOAuthAppProtocol };
+//# sourceMappingURL=protocol.d.mts.map

package/dist/oauth/github/protocol.mjs

@@ -0,0 +1,204 @@
+import { OAuthCallbackId, OAuthGeneration, OAuthIssuer, OAuthRedirectUri } from "../signInModels.mjs";
+import { OAuthUnavailable } from "../signInErrors.mjs";
+import { snapshotOAuthSync } from "../signInSnapshot.mjs";
+import { OAuthConnectedProfile } from "../connectedModels.mjs";
+import { OAuthConnectedProtocol } from "../OAuthConnectedProtocol.mjs";
+import { OAuthProtocol } from "../OAuthProtocol.mjs";
+import { OpenIdClientConfigurationError } from "../openid-client/models.mjs";
+import { DefiniteTokenRejection } from "../openid-client/compatibility.mjs";
+import { boundedFetch } from "../openid-client/transport.mjs";
+import { makeOAuthProtocolWithCompatibility } from "../openid-client/protocol.mjs";
+import { ProviderRevocation } from "../openid-client/ProviderRevocation.mjs";
+import { makeConnectedProtocolWithCompatibility } from "../openid-client/connected/protocol.mjs";
+import { decodeGitHubIdentity, gitHubOAuthAppProviderKey } from "./identity.mjs";
+import { Effect, Encoding, Layer, Predicate, Redacted, Schema } from "effect";
+//#region src/oauth/github/protocol.ts
+const unavailable = () => OAuthUnavailable.make({});
+const invalid = () => OpenIdClientConfigurationError.make({ reason: "provider" });
+const issuer = OAuthIssuer.make("https://github.com");
+const headers = Object.freeze({
+	Accept: "application/vnd.github+json",
+	"User-Agent": "effect-auth-github-oauth-app",
+	"X-GitHub-Api-Version": "2026-03-10"
+});
+const generation = Schema.Struct({
+	configurationGeneration: OAuthGeneration,
+	issuance: Schema.Literals(["active", "retired"]),
+	clientId: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9._-]{1,256}$/)),
+	clientSecret: Schema.RedactedFromValue(Schema.NonEmptyString.check(Schema.isMaxLength(4096))),
+	callbacks: Schema.Array(Schema.Struct({
+		callbackId: OAuthCallbackId,
+		redirectUri: OAuthRedirectUri
+	})).check(Schema.isMinLength(1), Schema.isMaxLength(16))
+});
+const generations = Schema.Array(generation).check(Schema.isMinLength(1), Schema.isMaxLength(64));
+const connectedGenerations = Schema.Array(Schema.Struct({
+	...generation.fields,
+	profiles: Schema.Array(OAuthConnectedProfile).check(Schema.isMinLength(1), Schema.isMaxLength(64))
+})).check(Schema.isMinLength(1), Schema.isMaxLength(64));
+const timeout = Schema.Finite.check(Schema.isBetween({
+	minimum: 1,
+	maximum: 30
+}));
+const isTimeout = Schema.is(timeout);
+const capture = (schema, registrations, options) => Effect.try({
+	try: () => {
+		const result = snapshotOAuthSync(schema, registrations);
+		const fetch = options.fetch;
+		const timeoutSeconds = options.timeoutSeconds;
+		if (!isTimeout(timeoutSeconds) || fetch !== void 0 && !Predicate.isFunction(fetch)) throw invalid();
+		return {
+			registrations: result,
+			timeoutSeconds,
+			...fetch === void 0 ? {} : { fetch }
+		};
+	},
+	catch: invalid
+});
+const provider = (registration) => ({
+	provider: gitHubOAuthAppProviderKey,
+	configurationGeneration: registration.configurationGeneration,
+	issuance: registration.issuance,
+	issuer,
+	protocol: "oauth",
+	responseIssuerMode: "unsupported",
+	clientId: registration.clientId,
+	authentication: {
+		method: "client_secret_post",
+		secret: registration.clientSecret
+	},
+	callbacks: registration.callbacks,
+	authorizationEndpoint: "https://github.com/login/oauth/authorize",
+	tokenEndpoint: "https://github.com/login/oauth/access_token",
+	pkceS256: true,
+	identitySource: {
+		url: "https://api.github.com/user",
+		headers,
+		decodeIdentity: decodeGitHubIdentity
+	}
+});
+const csvCell = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_:-]{1,256}$/));
+const isCell = Schema.is(csvCell);
+/** GitHub's receipt is comma-delimited, unlike the generic OAuth scope string. */
+const scopes = (receipt, expected) => {
+	if (receipt === void 0 || receipt.length > 16447) throw unavailable();
+	const result = receipt === "" ? [] : receipt.split(",").map((cell) => cell.replace(/^[ \t]+|[ \t]+$/g, ""));
+	if (result.length > 64 || result.some((cell) => !isCell(cell)) || new Set(result).size !== result.length || result.length !== expected.length || result.some((cell) => !expected.includes(cell))) throw unavailable();
+	return result;
+};
+const token = Schema.NonEmptyString.check(Schema.isMaxLength(16384));
+const expiry = Schema.Finite.check(Schema.isGreaterThan(0));
+const receiptSchema = Schema.Struct({
+	access_token: token,
+	token_type: Schema.String.check(Schema.isPattern(/^[Bb][Ee][Aa][Rr][Ee][Rr]$/)),
+	scope: Schema.String.check(Schema.isMaxLength(16447)),
+	expires_in: Schema.optionalKey(expiry),
+	refresh_token: Schema.optionalKey(token),
+	refresh_token_expires_in: Schema.optionalKey(expiry)
+});
+const decodeReceipt = Schema.decodeUnknownSync(receiptSchema);
+const encodeRevocation = Schema.encodeSync(Schema.fromJsonString(Schema.Struct({ access_token: token })));
+const terminalReceipt = Schema.Struct({
+	error: Schema.NonEmptyString.check(Schema.isMaxLength(128)),
+	error_description: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(4096))),
+	error_uri: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(2048)))
+});
+const decodeTerminalReceipt = Schema.decodeUnknownSync(terminalReceipt);
+const successKeys = [
+	"access_token",
+	"token_type",
+	"scope",
+	"expires_in",
+	"refresh_token",
+	"refresh_token_expires_in",
+	"id_token"
+];
+const compatibility = Object.freeze({
+	inspectReceipt: ({ body, status, contentType }, input) => {
+		if (contentType?.split(";", 1)[0]?.trim().toLowerCase() !== "application/json") throw unavailable();
+		if (!Predicate.isObject(body)) throw unavailable();
+		if (Object.hasOwn(body, "error")) {
+			if (successKeys.some((key) => Object.hasOwn(body, key))) throw unavailable();
+			const terminal = decodeTerminalReceipt(body);
+			if ((status === 200 || status === 400) && terminal.error === (input.operation === "authorization_code" ? "bad_verification_code" : "bad_refresh_token")) throw new DefiniteTokenRejection();
+			throw unavailable();
+		}
+		if (status !== 200 || [
+			"error_description",
+			"error_uri",
+			"id_token"
+		].some((key) => Object.hasOwn(body, key))) throw unavailable();
+		const receipt = decodeReceipt(body);
+		scopes(receipt.scope, input.scopes);
+		if (input.refreshRequired && (receipt.refresh_token === void 0 || receipt.expires_in === void 0 || receipt.refresh_token_expires_in === void 0)) throw unavailable();
+	},
+	authorizationScopes: (permissions, refresh) => refresh ? [...permissions, "offline_access"] : permissions,
+	decodeScopes: scopes,
+	includeRefreshScope: false
+});
+const revocationLayer = (options) => {
+	const fetch = options.fetch ?? ((url, init) => globalThis.fetch(url, {
+		...init,
+		body: init.body instanceof Uint8Array ? new Uint8Array(init.body) : init.body
+	}));
+	const timeoutSeconds = options.timeoutSeconds;
+	return Layer.succeed(ProviderRevocation, ProviderRevocation.of({ revoke: Effect.fn("GitHubOAuthApp.revoke")(function* (input) {
+		yield* Effect.tryPromise({
+			try: async (effectSignal) => {
+				if (input.authentication.method !== "client_secret_post" || input.context.configuration.profile.clientRegistrationId !== input.clientId || input.context.identity.provider !== gitHubOAuthAppProviderKey || input.context.identity.issuer !== issuer) throw unavailable();
+				const url = `https://api.github.com/applications/${encodeURIComponent(input.clientId)}/grant`;
+				const signal = AbortSignal.any([effectSignal, AbortSignal.timeout(Math.ceil(timeoutSeconds * 1e3))]);
+				const response = await boundedFetch(fetch, signal, /* @__PURE__ */ new Set([url]))(url, {
+					method: "DELETE",
+					redirect: "manual",
+					headers: {
+						...headers,
+						"Content-Type": "application/json",
+						Authorization: `Basic ${Encoding.encodeBase64(`${input.clientId}:${Redacted.value(input.authentication.secret)}`)}`
+					},
+					body: encodeRevocation({ access_token: Redacted.value(input.material.accessToken) }),
+					signal
+				});
+				signal.throwIfAborted();
+				if (response.status !== 204) throw unavailable();
+			},
+			catch: unavailable
+		});
+	}) }));
+};
+const makeGitHubOAuthAppProtocol = Effect.fn("makeGitHubOAuthAppProtocol")(function* (options) {
+	const saved = yield* capture(generations, options.registrations, options);
+	if (saved.registrations.filter((item) => item.issuance === "active").length !== 1) return yield* invalid();
+	return yield* makeOAuthProtocolWithCompatibility({
+		...saved,
+		providers: saved.registrations.map((item) => ({
+			...provider(item),
+			scopes: ["read:user"]
+		}))
+	}, compatibility);
+});
+const makeGitHubOAuthAppConnectedProtocol = Effect.fn("makeGitHubOAuthAppConnectedProtocol")(function* (options) {
+	const saved = yield* capture(connectedGenerations, options.registrations, options);
+	if (saved.registrations.filter((item) => item.issuance === "active").length !== 1) return yield* invalid();
+	for (const registration of saved.registrations) for (const profile of registration.profiles) if (profile.provider !== gitHubOAuthAppProviderKey || profile.clientRegistrationId !== registration.clientId || profile.resources.length !== 0 || profile.scopes.some((scope) => scope === "offline_access" || !isCell(scope)) || (profile.retention === "access-only" ? profile.refresh !== "unsupported" || profile.maximumRefreshLifetimeMillis !== void 0 : profile.refresh !== "rotating" || profile.maximumRefreshLifetimeMillis === void 0)) return yield* invalid();
+	return yield* makeConnectedProtocolWithCompatibility({
+		...saved,
+		providers: saved.registrations.map((item) => ({
+			...provider(item),
+			profiles: item.profiles,
+			clientRegistrationId: item.clientId,
+			resourceIndicators: "unsupported",
+			refreshExpiry: {
+				field: "refresh_token_expires_in",
+				zero: "expired"
+			},
+			revocation: { mode: "provider-cohort" }
+		}))
+	}, compatibility).pipe(Effect.provide(revocationLayer(saved)));
+});
+const gitHubOAuthAppProtocolLayer = (options) => Layer.effect(OAuthProtocol, makeGitHubOAuthAppProtocol(options));
+const gitHubOAuthAppConnectedProtocolLayer = (options) => Layer.effect(OAuthConnectedProtocol, makeGitHubOAuthAppConnectedProtocol(options));
+//#endregion
+export { gitHubOAuthAppConnectedProtocolLayer, gitHubOAuthAppProtocolLayer, makeGitHubOAuthAppConnectedProtocol, makeGitHubOAuthAppProtocol };
+
+//# sourceMappingURL=protocol.mjs.map