@yielded/auth 0.1.0-beta.1

package/dist/oauth/registrationModels.d.mts

@@ -0,0 +1,152 @@
+import { Schema } from "effect";
+//#region src/oauth/registrationModels.d.ts
+declare const OAuthRegistrationFingerprint: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+declare const OAuthRegistrationBearerDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+declare const OAuthRegistrationReference: Schema.brand<Schema.String, "effect-auth/OAuthRegistrationReference">;
+type OAuthRegistrationReference = typeof OAuthRegistrationReference.Type;
+declare const OAuthRegistrationCredential: Schema.RedactedFromValue<Schema.String>;
+declare const OAuthRegistrationPolicy: Schema.Struct<{
+  readonly lifetimeMillis: Schema.Int;
+  readonly maximumVerificationAgeMillis: Schema.Int;
+  readonly retentionMillis: Schema.Int;
+}>;
+type OAuthRegistrationPolicy = typeof OAuthRegistrationPolicy.Type;
+/** Immutable restricted capability. Application data is first bound by register,
+ * never by the OAuth callback; this record contains no plaintext bearer or tokens. */
+declare const OAuthRegistrationIntent: Schema.Struct<{
+  readonly namespace: Schema.Literal<"effect-auth/oauth-registration-intent/v1">;
+  readonly reference: Schema.brand<Schema.String, "effect-auth/OAuthRegistrationReference">;
+  readonly context: Schema.Struct<{
+    readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+    readonly protocol: Schema.Literals<readonly ["oidc", "oauth"]>;
+    readonly configurationGeneration: Schema.Int;
+    readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+    readonly responseIssuerMode: Schema.Literals<readonly ["required", "unsupported"]>;
+    readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+    readonly redirectUri: Schema.brand<Schema.String, "effect-auth/OAuthRedirectUri">;
+    readonly namespace: Schema.Literal<"effect-auth/oauth-sign-in-context/v1">;
+    readonly moduleId: Schema.brand<Schema.String, "effect-auth/OAuthModuleId">;
+    readonly generation: Schema.Int;
+    readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+    readonly commandId: Schema.brand<Schema.String, "effect-auth/OAuthCommandId">;
+    readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+    readonly stateDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+    readonly requestBindingVerifier: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+    readonly requestBindingExpiresAtMillis: Schema.Int;
+    readonly issuedAtMillis: Schema.Int;
+    readonly expiresAtMillis: Schema.Int;
+    readonly claimLifetimeMillis: Schema.Int;
+  }>;
+  readonly claimId: Schema.brand<Schema.String, "effect-auth/OAuthClaimId">;
+  readonly claimedAtMillis: Schema.Int;
+  readonly identity: Schema.Struct<{
+    readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+    readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+    readonly subject: Schema.NonEmptyString;
+  }>;
+  readonly verifiedAtMillis: Schema.Int;
+  readonly credentialDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+  readonly issuedAtMillis: Schema.Int;
+  readonly expiresAtMillis: Schema.Int;
+  readonly retentionUntilMillis: Schema.Int;
+}>;
+type OAuthRegistrationIntent = typeof OAuthRegistrationIntent.Type;
+declare const OAuthRegistrationRequired: Schema.TaggedStruct<"RegistrationRequired", {
+  readonly reference: Schema.brand<Schema.String, "effect-auth/OAuthRegistrationReference">;
+  readonly expiresAtMillis: Schema.Int;
+  readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+}>;
+declare const OAuthRegistrationAccess: Schema.Struct<{
+  readonly moduleId: Schema.brand<Schema.String, "effect-auth/OAuthModuleId">;
+  readonly reference: Schema.brand<Schema.String, "effect-auth/OAuthRegistrationReference">;
+  readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+  readonly requestBindingVerifier: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+  readonly requestBindingExpiresAtMillis: Schema.Int;
+  readonly credentialDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+  readonly nowMillis: Schema.Int;
+}>;
+type OAuthRegistrationAccess = typeof OAuthRegistrationAccess.Type;
+declare const OAuthRegistrationPrivateInput: Schema.Struct<{
+  readonly reference: Schema.brand<Schema.String, "effect-auth/OAuthRegistrationReference">;
+  readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+  readonly requestBinding: Schema.RedactedFromValue<Schema.String>;
+  readonly credential: Schema.RedactedFromValue<Schema.String>;
+  readonly commandId: Schema.brand<Schema.String, "effect-auth/OAuthCommandId">;
+}>;
+/** A first accepted command atomically reaches one bound outcome. There is no
+ * resettable intermediate state that permits a second provisioning attempt. */
+declare const OAuthRegistrationApplication: Schema.Union<readonly [Schema.TaggedStruct<"Unbound", {}>, Schema.TaggedStruct<"Registered", {
+  commandId: Schema.brand<Schema.String, "effect-auth/OAuthCommandId">;
+  fingerprint: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+}>, Schema.TaggedStruct<"ProvisioningPending", {
+  readonly commandId: Schema.brand<Schema.String, "effect-auth/OAuthCommandId">;
+  readonly fingerprint: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+  readonly reference: Schema.String;
+}>, Schema.TaggedStruct<"Rejected", {
+  commandId: Schema.brand<Schema.String, "effect-auth/OAuthCommandId">;
+  fingerprint: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+}>]>;
+declare const OAuthRegistrationInspection: Schema.Struct<{
+  readonly intent: Schema.Struct<{
+    readonly namespace: Schema.Literal<"effect-auth/oauth-registration-intent/v1">;
+    readonly reference: Schema.brand<Schema.String, "effect-auth/OAuthRegistrationReference">;
+    readonly context: Schema.Struct<{
+      readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+      readonly protocol: Schema.Literals<readonly ["oidc", "oauth"]>;
+      readonly configurationGeneration: Schema.Int;
+      readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+      readonly responseIssuerMode: Schema.Literals<readonly ["required", "unsupported"]>;
+      readonly callbackId: Schema.brand<Schema.String, "effect-auth/OAuthCallbackId">;
+      readonly redirectUri: Schema.brand<Schema.String, "effect-auth/OAuthRedirectUri">;
+      readonly namespace: Schema.Literal<"effect-auth/oauth-sign-in-context/v1">;
+      readonly moduleId: Schema.brand<Schema.String, "effect-auth/OAuthModuleId">;
+      readonly generation: Schema.Int;
+      readonly flowId: Schema.brand<Schema.String, "effect-auth/RequestBindingFlowId">;
+      readonly commandId: Schema.brand<Schema.String, "effect-auth/OAuthCommandId">;
+      readonly returnTarget: Schema.brand<Schema.String, "effect-auth/OAuthReturnTarget">;
+      readonly stateDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+      readonly requestBindingVerifier: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+      readonly requestBindingExpiresAtMillis: Schema.Int;
+      readonly issuedAtMillis: Schema.Int;
+      readonly expiresAtMillis: Schema.Int;
+      readonly claimLifetimeMillis: Schema.Int;
+    }>;
+    readonly claimId: Schema.brand<Schema.String, "effect-auth/OAuthClaimId">;
+    readonly claimedAtMillis: Schema.Int;
+    readonly identity: Schema.Struct<{
+      readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+      readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
+      readonly subject: Schema.NonEmptyString;
+    }>;
+    readonly verifiedAtMillis: Schema.Int;
+    readonly credentialDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+    readonly issuedAtMillis: Schema.Int;
+    readonly expiresAtMillis: Schema.Int;
+    readonly retentionUntilMillis: Schema.Int;
+  }>;
+  readonly application: Schema.Union<readonly [Schema.TaggedStruct<"Unbound", {}>, Schema.TaggedStruct<"Registered", {
+    commandId: Schema.brand<Schema.String, "effect-auth/OAuthCommandId">;
+    fingerprint: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+  }>, Schema.TaggedStruct<"ProvisioningPending", {
+    readonly commandId: Schema.brand<Schema.String, "effect-auth/OAuthCommandId">;
+    readonly fingerprint: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+    readonly reference: Schema.String;
+  }>, Schema.TaggedStruct<"Rejected", {
+    commandId: Schema.brand<Schema.String, "effect-auth/OAuthCommandId">;
+    fingerprint: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+  }>]>;
+}>;
+type OAuthRegistrationInspection = typeof OAuthRegistrationInspection.Type;
+declare const OAuthRegistrationDecision: Schema.Union<readonly [Schema.TaggedStruct<"Registered", {
+  readonly replayed: Schema.Boolean;
+}>, Schema.TaggedStruct<"ProvisioningPending", {
+  readonly reference: Schema.String;
+  readonly replayed: Schema.Boolean;
+}>, Schema.TaggedStruct<"Rejected", {}>, Schema.TaggedStruct<"Conflict", {}>]>;
+type OAuthRegistrationDecision = typeof OAuthRegistrationDecision.Type;
+declare const OAuthRegistrationResult: Schema.Union<readonly [Schema.TaggedStruct<"RegistrationAccepted", {}>, Schema.TaggedStruct<"ProvisioningPending", {
+  readonly reference: Schema.String;
+}>]>;
+//#endregion
+export { OAuthRegistrationAccess, OAuthRegistrationApplication, OAuthRegistrationBearerDigest, OAuthRegistrationCredential, OAuthRegistrationDecision, OAuthRegistrationFingerprint, OAuthRegistrationInspection, OAuthRegistrationIntent, OAuthRegistrationPolicy, OAuthRegistrationPrivateInput, OAuthRegistrationReference, OAuthRegistrationRequired, OAuthRegistrationResult };
+//# sourceMappingURL=registrationModels.d.mts.map

package/dist/oauth/registrationModels.mjs

@@ -0,0 +1,93 @@
+import { TokenDigest } from "../Schema.mjs";
+import { RequestBindingCredential, RequestBindingFlowId } from "../operations/requestBindingModels.mjs";
+import { OAuthClaimId, OAuthCommandId, OAuthExternalIdentity, OAuthInstant, OAuthModuleId, OAuthSignInTransactionContext } from "./signInModels.mjs";
+import { Schema } from "effect";
+//#region src/oauth/registrationModels.ts
+const OAuthRegistrationFingerprint = TokenDigest.check(Schema.isMaxLength(256));
+const OAuthRegistrationBearerDigest = TokenDigest.check(Schema.isPattern(/^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/));
+const OAuthRegistrationReference = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)).pipe(Schema.brand("effect-auth/OAuthRegistrationReference"));
+const OAuthRegistrationCredential = Schema.RedactedFromValue(Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)));
+const OAuthRegistrationPolicy = Schema.Struct({
+	lifetimeMillis: Schema.Int.check(Schema.isBetween({
+		minimum: 1e3,
+		maximum: 18e5
+	})),
+	maximumVerificationAgeMillis: Schema.Int.check(Schema.isBetween({
+		minimum: 1e3,
+		maximum: 18e5
+	})),
+	retentionMillis: Schema.Int.check(Schema.isBetween({
+		minimum: 12e4,
+		maximum: 2592e6
+	}))
+});
+/** Immutable restricted capability. Application data is first bound by register,
+* never by the OAuth callback; this record contains no plaintext bearer or tokens. */
+const OAuthRegistrationIntent = Schema.Struct({
+	namespace: Schema.Literal("effect-auth/oauth-registration-intent/v1"),
+	reference: OAuthRegistrationReference,
+	context: OAuthSignInTransactionContext,
+	claimId: OAuthClaimId,
+	claimedAtMillis: OAuthInstant,
+	identity: OAuthExternalIdentity,
+	verifiedAtMillis: OAuthInstant,
+	credentialDigest: OAuthRegistrationBearerDigest,
+	issuedAtMillis: OAuthInstant,
+	expiresAtMillis: OAuthInstant,
+	retentionUntilMillis: OAuthInstant
+});
+const OAuthRegistrationRequired = Schema.TaggedStruct("RegistrationRequired", {
+	reference: OAuthRegistrationReference,
+	expiresAtMillis: OAuthInstant,
+	returnTarget: OAuthSignInTransactionContext.fields.returnTarget
+});
+const OAuthRegistrationAccess = Schema.Struct({
+	moduleId: OAuthModuleId,
+	reference: OAuthRegistrationReference,
+	flowId: RequestBindingFlowId,
+	requestBindingVerifier: OAuthSignInTransactionContext.fields.requestBindingVerifier,
+	requestBindingExpiresAtMillis: OAuthInstant,
+	credentialDigest: OAuthRegistrationBearerDigest,
+	nowMillis: OAuthInstant
+});
+const OAuthRegistrationPrivateInput = Schema.Struct({
+	reference: OAuthRegistrationReference,
+	flowId: RequestBindingFlowId,
+	requestBinding: RequestBindingCredential,
+	credential: OAuthRegistrationCredential,
+	commandId: OAuthCommandId
+});
+const applicationBinding = {
+	commandId: OAuthCommandId,
+	fingerprint: OAuthRegistrationFingerprint
+};
+const recovery = Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(256));
+/** A first accepted command atomically reaches one bound outcome. There is no
+* resettable intermediate state that permits a second provisioning attempt. */
+const OAuthRegistrationApplication = Schema.Union([
+	Schema.TaggedStruct("Unbound", {}),
+	Schema.TaggedStruct("Registered", applicationBinding),
+	Schema.TaggedStruct("ProvisioningPending", {
+		...applicationBinding,
+		reference: recovery
+	}),
+	Schema.TaggedStruct("Rejected", applicationBinding)
+]);
+const OAuthRegistrationInspection = Schema.Struct({
+	intent: OAuthRegistrationIntent,
+	application: OAuthRegistrationApplication
+});
+const OAuthRegistrationDecision = Schema.Union([
+	Schema.TaggedStruct("Registered", { replayed: Schema.Boolean }),
+	Schema.TaggedStruct("ProvisioningPending", {
+		reference: recovery,
+		replayed: Schema.Boolean
+	}),
+	Schema.TaggedStruct("Rejected", {}),
+	Schema.TaggedStruct("Conflict", {})
+]);
+const OAuthRegistrationResult = Schema.Union([Schema.TaggedStruct("RegistrationAccepted", {}), Schema.TaggedStruct("ProvisioningPending", { reference: recovery })]);
+//#endregion
+export { OAuthRegistrationAccess, OAuthRegistrationApplication, OAuthRegistrationBearerDigest, OAuthRegistrationCredential, OAuthRegistrationDecision, OAuthRegistrationFingerprint, OAuthRegistrationInspection, OAuthRegistrationIntent, OAuthRegistrationPolicy, OAuthRegistrationPrivateInput, OAuthRegistrationReference, OAuthRegistrationRequired, OAuthRegistrationResult };
+
+//# sourceMappingURL=registrationModels.mjs.map

package/dist/oauth/registrationModels.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"registrationModels.mjs","names":[],"sources":["../../src/oauth/registrationModels.ts"],"sourcesContent":["import { Schema } from \"effect\";\n\nimport { RequestBindingCredential, RequestBindingFlowId } from \"../operations/requestBinding\";\nimport { TokenDigest } from \"../Schema\";\nimport {\n  OAuthClaimId,\n  OAuthCommandId,\n  OAuthExternalIdentity,\n  OAuthInstant,\n  OAuthModuleId,\n  OAuthSignInTransactionContext,\n} from \"./signInModels\";\n\nexport const OAuthRegistrationFingerprint = TokenDigest.check(Schema.isMaxLength(256));\n\nexport const OAuthRegistrationBearerDigest = TokenDigest.check(\n  Schema.isPattern(/^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/),\n);\n\nexport const OAuthRegistrationReference = Schema.String.check(\n  Schema.isPattern(/^[A-Za-z0-9_-]{43}$/),\n).pipe(Schema.brand(\"effect-auth/OAuthRegistrationReference\"));\n\nexport type OAuthRegistrationReference = typeof OAuthRegistrationReference.Type;\n\nexport const OAuthRegistrationCredential = Schema.RedactedFromValue(\n  Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)),\n);\n\nexport const OAuthRegistrationPolicy = Schema.Struct({\n  lifetimeMillis: Schema.Int.check(Schema.isBetween({ minimum: 1000, maximum: 1800000 })),\n  maximumVerificationAgeMillis: Schema.Int.check(\n    Schema.isBetween({ minimum: 1000, maximum: 1800000 }),\n  ),\n  retentionMillis: Schema.Int.check(Schema.isBetween({ minimum: 120000, maximum: 2592000000 })),\n});\n\nexport type OAuthRegistrationPolicy = typeof OAuthRegistrationPolicy.Type;\n\n/** Immutable restricted capability. Application data is first bound by register,\n * never by the OAuth callback; this record contains no plaintext bearer or tokens. */\nexport const OAuthRegistrationIntent = Schema.Struct({\n  namespace: Schema.Literal(\"effect-auth/oauth-registration-intent/v1\"),\n  reference: OAuthRegistrationReference,\n  context: OAuthSignInTransactionContext,\n  claimId: OAuthClaimId,\n  claimedAtMillis: OAuthInstant,\n  identity: OAuthExternalIdentity,\n  verifiedAtMillis: OAuthInstant,\n  credentialDigest: OAuthRegistrationBearerDigest,\n  issuedAtMillis: OAuthInstant,\n  expiresAtMillis: OAuthInstant,\n  retentionUntilMillis: OAuthInstant,\n});\n\nexport type OAuthRegistrationIntent = typeof OAuthRegistrationIntent.Type;\n\nexport const OAuthRegistrationRequired = Schema.TaggedStruct(\"RegistrationRequired\", {\n  reference: OAuthRegistrationReference,\n  expiresAtMillis: OAuthInstant,\n  returnTarget: OAuthSignInTransactionContext.fields.returnTarget,\n});\n\nexport const OAuthRegistrationAccess = Schema.Struct({\n  moduleId: OAuthModuleId,\n  reference: OAuthRegistrationReference,\n  flowId: RequestBindingFlowId,\n  requestBindingVerifier: OAuthSignInTransactionContext.fields.requestBindingVerifier,\n  requestBindingExpiresAtMillis: OAuthInstant,\n  credentialDigest: OAuthRegistrationBearerDigest,\n  nowMillis: OAuthInstant,\n});\n\nexport type OAuthRegistrationAccess = typeof OAuthRegistrationAccess.Type;\n\nexport const OAuthRegistrationPrivateInput = Schema.Struct({\n  reference: OAuthRegistrationReference,\n  flowId: RequestBindingFlowId,\n  requestBinding: RequestBindingCredential,\n  credential: OAuthRegistrationCredential,\n  commandId: OAuthCommandId,\n});\n\nconst applicationBinding = { commandId: OAuthCommandId, fingerprint: OAuthRegistrationFingerprint };\nconst recovery = Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(256));\n\n/** A first accepted command atomically reaches one bound outcome. There is no\n * resettable intermediate state that permits a second provisioning attempt. */\nexport const OAuthRegistrationApplication = Schema.Union([\n  Schema.TaggedStruct(\"Unbound\", {}),\n  Schema.TaggedStruct(\"Registered\", applicationBinding),\n  Schema.TaggedStruct(\"ProvisioningPending\", { ...applicationBinding, reference: recovery }),\n  Schema.TaggedStruct(\"Rejected\", applicationBinding),\n]);\n\nexport const OAuthRegistrationInspection = Schema.Struct({\n  intent: OAuthRegistrationIntent,\n  application: OAuthRegistrationApplication,\n});\n\nexport type OAuthRegistrationInspection = typeof OAuthRegistrationInspection.Type;\n\nexport const OAuthRegistrationDecision = Schema.Union([\n  Schema.TaggedStruct(\"Registered\", { replayed: Schema.Boolean }),\n  Schema.TaggedStruct(\"ProvisioningPending\", { reference: recovery, replayed: Schema.Boolean }),\n  Schema.TaggedStruct(\"Rejected\", {}),\n  Schema.TaggedStruct(\"Conflict\", {}),\n]);\n\nexport type OAuthRegistrationDecision = typeof OAuthRegistrationDecision.Type;\n\nexport const OAuthRegistrationResult = Schema.Union([\n  Schema.TaggedStruct(\"RegistrationAccepted\", {}),\n  Schema.TaggedStruct(\"ProvisioningPending\", { reference: recovery }),\n]);\n"],"mappings":";;;;;AAaA,MAAa,+BAA+B,YAAY,MAAM,OAAO,YAAY,GAAG,CAAC;AAErF,MAAa,gCAAgC,YAAY,MACvD,OAAO,UAAU,uCAAuC,CAC1D;AAEA,MAAa,6BAA6B,OAAO,OAAO,MACtD,OAAO,UAAU,qBAAqB,CACxC,CAAC,CAAC,KAAK,OAAO,MAAM,wCAAwC,CAAC;AAI7D,MAAa,8BAA8B,OAAO,kBAChD,OAAO,OAAO,MAAM,OAAO,UAAU,qBAAqB,CAAC,CAC7D;AAEA,MAAa,0BAA0B,OAAO,OAAO;CACnD,gBAAgB,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAM,SAAS;CAAQ,CAAC,CAAC;CACtF,8BAA8B,OAAO,IAAI,MACvC,OAAO,UAAU;EAAE,SAAS;EAAM,SAAS;CAAQ,CAAC,CACtD;CACA,iBAAiB,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAQ,SAAS;CAAW,CAAC,CAAC;AAC9F,CAAC;;;AAMD,MAAa,0BAA0B,OAAO,OAAO;CACnD,WAAW,OAAO,QAAQ,0CAA0C;CACpE,WAAW;CACX,SAAS;CACT,SAAS;CACT,iBAAiB;CACjB,UAAU;CACV,kBAAkB;CAClB,kBAAkB;CAClB,gBAAgB;CAChB,iBAAiB;CACjB,sBAAsB;AACxB,CAAC;AAID,MAAa,4BAA4B,OAAO,aAAa,wBAAwB;CACnF,WAAW;CACX,iBAAiB;CACjB,cAAc,8BAA8B,OAAO;AACrD,CAAC;AAED,MAAa,0BAA0B,OAAO,OAAO;CACnD,UAAU;CACV,WAAW;CACX,QAAQ;CACR,wBAAwB,8BAA8B,OAAO;CAC7D,+BAA+B;CAC/B,kBAAkB;CAClB,WAAW;AACb,CAAC;AAID,MAAa,gCAAgC,OAAO,OAAO;CACzD,WAAW;CACX,QAAQ;CACR,gBAAgB;CAChB,YAAY;CACZ,WAAW;AACb,CAAC;AAED,MAAM,qBAAqB;CAAE,WAAW;CAAgB,aAAa;AAA6B;AAClG,MAAM,WAAW,OAAO,OAAO,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,GAAG,CAAC;;;AAInF,MAAa,+BAA+B,OAAO,MAAM;CACvD,OAAO,aAAa,WAAW,CAAC,CAAC;CACjC,OAAO,aAAa,cAAc,kBAAkB;CACpD,OAAO,aAAa,uBAAuB;EAAE,GAAG;EAAoB,WAAW;CAAS,CAAC;CACzF,OAAO,aAAa,YAAY,kBAAkB;AACpD,CAAC;AAED,MAAa,8BAA8B,OAAO,OAAO;CACvD,QAAQ;CACR,aAAa;AACf,CAAC;AAID,MAAa,4BAA4B,OAAO,MAAM;CACpD,OAAO,aAAa,cAAc,EAAE,UAAU,OAAO,QAAQ,CAAC;CAC9D,OAAO,aAAa,uBAAuB;EAAE,WAAW;EAAU,UAAU,OAAO;CAAQ,CAAC;CAC5F,OAAO,aAAa,YAAY,CAAC,CAAC;CAClC,OAAO,aAAa,YAAY,CAAC,CAAC;AACpC,CAAC;AAID,MAAa,0BAA0B,OAAO,MAAM,CAClD,OAAO,aAAa,wBAAwB,CAAC,CAAC,GAC9C,OAAO,aAAa,uBAAuB,EAAE,WAAW,SAAS,CAAC,CACpE,CAAC"}

package/dist/oauth/registrationSecrets.mjs

@@ -0,0 +1,70 @@
+import { TokenDigest } from "../Schema.mjs";
+import { OAuthRegistrationIntent, OAuthRegistrationReference } from "./registrationModels.mjs";
+import { OAuthRejected, OAuthUnavailable } from "./signInErrors.mjs";
+import { snapshotOAuthSync } from "./signInSnapshot.mjs";
+import { Crypto, DateTime, Effect, Encoding, Redacted, Result, Schema } from "effect";
+//#region src/oauth/registrationSecrets.ts
+const tuple = Schema.fromJsonString(Schema.Tuple([
+	Schema.Literal("effect-auth/oauth-registration-bearer/v1"),
+	OAuthRegistrationIntent.fields.context.fields.moduleId,
+	OAuthRegistrationReference,
+	OAuthRegistrationIntent.fields.context.fields.flowId,
+	Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/))
+]));
+const credentialDigest = Effect.fn("OAuthRegistration.credentialDigest")(function* (moduleId, reference, flowId, credential) {
+	const { digest } = yield* Crypto.Crypto;
+	const raw = Redacted.value(credential);
+	if (!Schema.is(Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)))(raw)) return yield* OAuthRejected.make({});
+	const bytes = Result.getOrUndefined(Encoding.decodeBase64Url(raw));
+	if (raw.length !== 43 || bytes === void 0 || bytes.length !== 32 || Encoding.encodeBase64Url(bytes) !== raw) {
+		bytes?.fill(0);
+		return yield* OAuthRejected.make({});
+	}
+	bytes.fill(0);
+	const encoded = yield* Schema.encodeEffect(tuple)([
+		"effect-auth/oauth-registration-bearer/v1",
+		moduleId,
+		reference,
+		flowId,
+		raw
+	]).pipe(Effect.mapError(() => OAuthRejected.make({})));
+	const value = yield* digest("SHA-256", new TextEncoder().encode(encoded)).pipe(Effect.mapError(() => OAuthUnavailable.make({})));
+	return TokenDigest.make(Encoding.encodeBase64Url(value));
+});
+const prepare = Effect.fn("OAuthRegistration.prepareIntent")(function* (claim, identity, verifiedAtMillis, policy) {
+	const { randomBytes } = yield* Crypto.Crypto;
+	const now = DateTime.toEpochMillis(yield* DateTime.now);
+	const expiresAtMillis = Math.min(now + policy.lifetimeMillis, claim.flow.context.requestBindingExpiresAtMillis, verifiedAtMillis + policy.maximumVerificationAgeMillis);
+	if (expiresAtMillis <= now) return void 0;
+	const referenceBytes = yield* randomBytes(32).pipe(Effect.mapError(() => OAuthUnavailable.make({})));
+	const reference = OAuthRegistrationReference.make(Encoding.encodeBase64Url(referenceBytes));
+	referenceBytes.fill(0);
+	const credentialBytes = yield* randomBytes(32).pipe(Effect.mapError(() => OAuthUnavailable.make({})));
+	const credential = Redacted.make(Encoding.encodeBase64Url(credentialBytes));
+	credentialBytes.fill(0);
+	return {
+		intent: snapshotOAuthSync(OAuthRegistrationIntent, {
+			namespace: "effect-auth/oauth-registration-intent/v1",
+			reference,
+			context: claim.flow.context,
+			claimId: claim.claimId,
+			claimedAtMillis: claim.claimedAtMillis,
+			identity: identity.identity,
+			verifiedAtMillis,
+			credentialDigest: yield* credentialDigest(claim.flow.context.moduleId, reference, claim.flow.context.flowId, credential),
+			issuedAtMillis: now,
+			expiresAtMillis,
+			retentionUntilMillis: Math.max(claim.flow.retentionUntilMillis, expiresAtMillis + policy.retentionMillis)
+		}),
+		command: Object.freeze({
+			_tag: "Issue",
+			slot: "registration",
+			credential,
+			expiresAtMillis
+		})
+	};
+});
+//#endregion
+export { credentialDigest, prepare };
+
+//# sourceMappingURL=registrationSecrets.mjs.map

package/dist/oauth/registrationSecrets.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"registrationSecrets.mjs","names":[],"sources":["../../src/oauth/registrationSecrets.ts"],"sourcesContent":["import { Crypto, DateTime, Effect, Encoding, Redacted, Result, Schema } from \"effect\";\n\nimport { TokenDigest } from \"../Schema\";\nimport {\n  OAuthRegistrationIntent,\n  OAuthRegistrationReference,\n  type OAuthRegistrationPolicy,\n} from \"./registrationModels\";\nimport { OAuthRejected, OAuthUnavailable } from \"./signInErrors\";\nimport type { OAuthClaim, OAuthVerifiedExternalIdentity } from \"./signInModels\";\nimport { snapshotOAuthSync } from \"./signInSnapshot\";\n\nconst tuple = Schema.fromJsonString(\n  Schema.Tuple([\n    Schema.Literal(\"effect-auth/oauth-registration-bearer/v1\"),\n    OAuthRegistrationIntent.fields.context.fields.moduleId,\n    OAuthRegistrationReference,\n    OAuthRegistrationIntent.fields.context.fields.flowId,\n    Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)),\n  ]),\n);\n\nexport const credentialDigest = Effect.fn(\"OAuthRegistration.credentialDigest\")(function* (\n  moduleId: typeof OAuthRegistrationIntent.Type.context.moduleId,\n  reference: OAuthRegistrationReference,\n  flowId: typeof OAuthRegistrationIntent.Type.context.flowId,\n  credential: Redacted.Redacted<string>,\n) {\n  const { digest } = yield* Crypto.Crypto;\n  const raw = Redacted.value(credential);\n\n  if (!Schema.is(Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)))(raw))\n    return yield* OAuthRejected.make({});\n  const bytes = Result.getOrUndefined(Encoding.decodeBase64Url(raw));\n\n  if (\n    raw.length !== 43 ||\n    bytes === undefined ||\n    bytes.length !== 32 ||\n    Encoding.encodeBase64Url(bytes) !== raw\n  ) {\n    bytes?.fill(0);\n\n    return yield* OAuthRejected.make({});\n  }\n  bytes.fill(0);\n\n  const encoded = yield* Schema.encodeEffect(tuple)([\n    \"effect-auth/oauth-registration-bearer/v1\",\n    moduleId,\n    reference,\n    flowId,\n    raw,\n  ]).pipe(Effect.mapError(() => OAuthRejected.make({})));\n\n  const value = yield* digest(\"SHA-256\", new TextEncoder().encode(encoded)).pipe(\n    Effect.mapError(() => OAuthUnavailable.make({})),\n  );\n\n  return TokenDigest.make(Encoding.encodeBase64Url(value));\n});\n\nexport const prepare = Effect.fn(\"OAuthRegistration.prepareIntent\")(function* (\n  claim: OAuthClaim,\n  identity: OAuthVerifiedExternalIdentity,\n  verifiedAtMillis: number,\n  policy: OAuthRegistrationPolicy,\n) {\n  const { randomBytes } = yield* Crypto.Crypto;\n  const now = DateTime.toEpochMillis(yield* DateTime.now);\n\n  const expiresAtMillis = Math.min(\n    now + policy.lifetimeMillis,\n    claim.flow.context.requestBindingExpiresAtMillis,\n    verifiedAtMillis + policy.maximumVerificationAgeMillis,\n  );\n\n  if (expiresAtMillis <= now) return undefined;\n\n  const referenceBytes = yield* randomBytes(32).pipe(\n    Effect.mapError(() => OAuthUnavailable.make({})),\n  );\n\n  const reference = OAuthRegistrationReference.make(Encoding.encodeBase64Url(referenceBytes));\n\n  referenceBytes.fill(0);\n\n  const credentialBytes = yield* randomBytes(32).pipe(\n    Effect.mapError(() => OAuthUnavailable.make({})),\n  );\n\n  const credential = Redacted.make(Encoding.encodeBase64Url(credentialBytes));\n\n  credentialBytes.fill(0);\n\n  const intent = snapshotOAuthSync(OAuthRegistrationIntent, {\n    namespace: \"effect-auth/oauth-registration-intent/v1\",\n    reference,\n    context: claim.flow.context,\n    claimId: claim.claimId,\n    claimedAtMillis: claim.claimedAtMillis,\n    identity: identity.identity,\n    verifiedAtMillis,\n    credentialDigest: yield* credentialDigest(\n      claim.flow.context.moduleId,\n      reference,\n      claim.flow.context.flowId,\n      credential,\n    ),\n    issuedAtMillis: now,\n    expiresAtMillis,\n    retentionUntilMillis: Math.max(\n      claim.flow.retentionUntilMillis,\n      expiresAtMillis + policy.retentionMillis,\n    ),\n  });\n\n  return {\n    intent,\n    command: Object.freeze({\n      _tag: \"Issue\" as const,\n      slot: \"registration\" as const,\n      credential,\n      expiresAtMillis,\n    }),\n  };\n});\n"],"mappings":";;;;;;AAYA,MAAM,QAAQ,OAAO,eACnB,OAAO,MAAM;CACX,OAAO,QAAQ,0CAA0C;CACzD,wBAAwB,OAAO,QAAQ,OAAO;CAC9C;CACA,wBAAwB,OAAO,QAAQ,OAAO;CAC9C,OAAO,OAAO,MAAM,OAAO,UAAU,qBAAqB,CAAC;AAC7D,CAAC,CACH;AAEA,MAAa,mBAAmB,OAAO,GAAG,oCAAoC,CAAC,CAAC,WAC9E,UACA,WACA,QACA,YACA;CACA,MAAM,EAAE,WAAW,OAAO,OAAO;CACjC,MAAM,MAAM,SAAS,MAAM,UAAU;CAErC,IAAI,CAAC,OAAO,GAAG,OAAO,OAAO,MAAM,OAAO,UAAU,qBAAqB,CAAC,CAAC,CAAC,CAAC,GAAG,GAC9E,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;CACrC,MAAM,QAAQ,OAAO,eAAe,SAAS,gBAAgB,GAAG,CAAC;CAEjE,IACE,IAAI,WAAW,MACf,UAAU,KAAA,KACV,MAAM,WAAW,MACjB,SAAS,gBAAgB,KAAK,MAAM,KACpC;EACA,OAAO,KAAK,CAAC;EAEb,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;CACrC;CACA,MAAM,KAAK,CAAC;CAEZ,MAAM,UAAU,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC;EAChD;EACA;EACA;EACA;EACA;CACF,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC;CAErD,MAAM,QAAQ,OAAO,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,CAAC,KACxE,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CACjD;CAEA,OAAO,YAAY,KAAK,SAAS,gBAAgB,KAAK,CAAC;AACzD,CAAC;AAED,MAAa,UAAU,OAAO,GAAG,iCAAiC,CAAC,CAAC,WAClE,OACA,UACA,kBACA,QACA;CACA,MAAM,EAAE,gBAAgB,OAAO,OAAO;CACtC,MAAM,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG;CAEtD,MAAM,kBAAkB,KAAK,IAC3B,MAAM,OAAO,gBACb,MAAM,KAAK,QAAQ,+BACnB,mBAAmB,OAAO,4BAC5B;CAEA,IAAI,mBAAmB,KAAK,OAAO,KAAA;CAEnC,MAAM,iBAAiB,OAAO,YAAY,EAAE,CAAC,CAAC,KAC5C,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CACjD;CAEA,MAAM,YAAY,2BAA2B,KAAK,SAAS,gBAAgB,cAAc,CAAC;CAE1F,eAAe,KAAK,CAAC;CAErB,MAAM,kBAAkB,OAAO,YAAY,EAAE,CAAC,CAAC,KAC7C,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CACjD;CAEA,MAAM,aAAa,SAAS,KAAK,SAAS,gBAAgB,eAAe,CAAC;CAE1E,gBAAgB,KAAK,CAAC;CAwBtB,OAAO;EACL,QAvBa,kBAAkB,yBAAyB;GACxD,WAAW;GACX;GACA,SAAS,MAAM,KAAK;GACpB,SAAS,MAAM;GACf,iBAAiB,MAAM;GACvB,UAAU,SAAS;GACnB;GACA,kBAAkB,OAAO,iBACvB,MAAM,KAAK,QAAQ,UACnB,WACA,MAAM,KAAK,QAAQ,QACnB,UACF;GACA,gBAAgB;GAChB;GACA,sBAAsB,KAAK,IACzB,MAAM,KAAK,sBACX,kBAAkB,OAAO,eAC3B;EACF,CAGO;EACL,SAAS,OAAO,OAAO;GACrB,MAAM;GACN,MAAM;GACN;GACA;EACF,CAAC;CACH;AACF,CAAC"}

package/dist/oauth/schema.d.mts

@@ -0,0 +1,86 @@
+import { Schema } from "effect";
+//#region src/oauth/schema.d.ts
+/**
+ * Stable identifier of one configured OAuth provider ("github", "gitlab").
+ * Doubles as the routing key for callback endpoints, so it is constrained to
+ * URL-safe lowercase slugs.
+ */
+declare const OAuthProviderKey: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+type OAuthProviderKey = typeof OAuthProviderKey.Type;
+declare const OAuthState_base: Schema.Class<OAuthState, Schema.Struct<{
+  readonly stateDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
+  readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+  readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+  readonly redirectUri: Schema.NonEmptyString;
+  readonly issuedAt: Schema.DateTimeUtcFromMillis;
+  readonly expiresAt: Schema.DateTimeUtcFromMillis;
+}>, {}>;
+/**
+ * One pending authorization redirect, stored under the digest of the opaque
+ * `state` token carried through the provider redirect. Binding the subject and
+ * redirect URI here is what lets the callback verify that the response belongs
+ * to the actor and destination that initiated it.
+ */
+declare class OAuthState extends OAuthState_base {}
+declare const OAuthAuthorization_base: Schema.Class<OAuthAuthorization, Schema.Struct<{
+  readonly url: Schema.NonEmptyString;
+  readonly expiresAt: Schema.DateTimeUtcFromMillis;
+}>, {}>;
+/** Where to send the browser to start an authorization, plus the state's expiry. */
+declare class OAuthAuthorization extends OAuthAuthorization_base {}
+declare const OAuthCallbackParams_base: Schema.Class<OAuthCallbackParams, Schema.Struct<{
+  readonly state: Schema.optionalKey<Schema.String>;
+  readonly code: Schema.optionalKey<Schema.String>;
+  readonly error: Schema.optionalKey<Schema.String>;
+  readonly error_description: Schema.optionalKey<Schema.String>;
+}>, {}>;
+/**
+ * The untrusted query parameters a provider redirects back with. Decoded from
+ * `unknown` inside the OAuth workflow, so HTTP handlers can hand the raw
+ * query record straight through.
+ */
+declare class OAuthCallbackParams extends OAuthCallbackParams_base {}
+declare const OAuthTokens_base: Schema.Class<OAuthTokens, Schema.Struct<{
+  readonly accessToken: Schema.Redacted<Schema.NonEmptyString>;
+  /** Normalized to lowercase; "bearer" for every currently supported provider. */
+  readonly tokenType: Schema.NonEmptyString;
+  /** `None` means the provider issues non-expiring access tokens. */
+  readonly accessTokenExpiresAt: Schema.Option<Schema.DateTimeUtcFromMillis>;
+  readonly refreshToken: Schema.Option<Schema.Redacted<Schema.NonEmptyString>>;
+  readonly refreshTokenExpiresAt: Schema.Option<Schema.DateTimeUtcFromMillis>;
+  readonly scope: Schema.Option<Schema.NonEmptyString>;
+}>, {}>;
+/**
+ * The provider-issued token set with absolute expirations. Token values stay
+ * `Redacted` end to end; persistence adapters unwrap them only at their
+ * encryption boundary.
+ */
+declare class OAuthTokens extends OAuthTokens_base {}
+declare const OAuthIdentity_base: Schema.Class<OAuthIdentity, Schema.Struct<{
+  readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+  readonly providerAccountId: Schema.NonEmptyString;
+  readonly handle: Schema.Option<Schema.NonEmptyString>;
+}>, {}>;
+/**
+ * The provider's account identity, validated by the provider layer. The
+ * account id is the provider's *stable* identifier in string form (for GitHub,
+ * the numeric user id in decimal); the handle is the mutable display login.
+ */
+declare class OAuthIdentity extends OAuthIdentity_base {}
+declare const OAuthConnection_base: Schema.Class<OAuthConnection, Schema.Struct<{
+  readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
+  readonly subjectId: Schema.brand<Schema.NonEmptyString, "effect-auth/SubjectId">;
+  readonly identity: typeof OAuthIdentity;
+  readonly tokens: typeof OAuthTokens;
+  readonly connectedAt: Schema.DateTimeUtcFromMillis;
+  readonly updatedAt: Schema.DateTimeUtcFromMillis;
+}>, {}>;
+/**
+ * The durable link between one subject and one provider account: identity plus
+ * the current token set. At most one connection exists per subject and
+ * provider; completing a new authorization replaces it.
+ */
+declare class OAuthConnection extends OAuthConnection_base {}
+//#endregion
+export { OAuthAuthorization, OAuthCallbackParams, OAuthConnection, OAuthIdentity, OAuthProviderKey, OAuthState, OAuthTokens };
+//# sourceMappingURL=schema.d.mts.map

package/dist/oauth/schema.mjs

@@ -0,0 +1,81 @@
+import { SubjectId, TokenDigest } from "../Schema.mjs";
+import { Schema } from "effect";
+//#region src/oauth/schema.ts
+/**
+* Stable identifier of one configured OAuth provider ("github", "gitlab").
+* Doubles as the routing key for callback endpoints, so it is constrained to
+* URL-safe lowercase slugs.
+*/
+const OAuthProviderKey = Schema.String.check(Schema.isPattern(/^[a-z][a-z0-9-]{0,63}$/)).pipe(Schema.brand("effect-auth/OAuthProviderKey"));
+/**
+* One pending authorization redirect, stored under the digest of the opaque
+* `state` token carried through the provider redirect. Binding the subject and
+* redirect URI here is what lets the callback verify that the response belongs
+* to the actor and destination that initiated it.
+*/
+var OAuthState = class extends Schema.Class("effect-auth/OAuthState")({
+	stateDigest: TokenDigest,
+	provider: OAuthProviderKey,
+	subjectId: SubjectId,
+	redirectUri: Schema.NonEmptyString,
+	issuedAt: Schema.DateTimeUtcFromMillis,
+	expiresAt: Schema.DateTimeUtcFromMillis
+}) {};
+/** Where to send the browser to start an authorization, plus the state's expiry. */
+var OAuthAuthorization = class extends Schema.Class("effect-auth/OAuthAuthorization")({
+	url: Schema.NonEmptyString,
+	expiresAt: Schema.DateTimeUtcFromMillis
+}) {};
+/**
+* The untrusted query parameters a provider redirects back with. Decoded from
+* `unknown` inside the OAuth workflow, so HTTP handlers can hand the raw
+* query record straight through.
+*/
+var OAuthCallbackParams = class extends Schema.Class("effect-auth/OAuthCallbackParams")({
+	state: Schema.optionalKey(Schema.String),
+	code: Schema.optionalKey(Schema.String),
+	error: Schema.optionalKey(Schema.String),
+	error_description: Schema.optionalKey(Schema.String)
+}) {};
+/**
+* The provider-issued token set with absolute expirations. Token values stay
+* `Redacted` end to end; persistence adapters unwrap them only at their
+* encryption boundary.
+*/
+var OAuthTokens = class extends Schema.Class("effect-auth/OAuthTokens")({
+	accessToken: Schema.Redacted(Schema.NonEmptyString),
+	/** Normalized to lowercase; "bearer" for every currently supported provider. */
+	tokenType: Schema.NonEmptyString,
+	/** `None` means the provider issues non-expiring access tokens. */
+	accessTokenExpiresAt: Schema.Option(Schema.DateTimeUtcFromMillis),
+	refreshToken: Schema.Option(Schema.Redacted(Schema.NonEmptyString)),
+	refreshTokenExpiresAt: Schema.Option(Schema.DateTimeUtcFromMillis),
+	scope: Schema.Option(Schema.NonEmptyString)
+}) {};
+/**
+* The provider's account identity, validated by the provider layer. The
+* account id is the provider's *stable* identifier in string form (for GitHub,
+* the numeric user id in decimal); the handle is the mutable display login.
+*/
+var OAuthIdentity = class extends Schema.Class("effect-auth/OAuthIdentity")({
+	provider: OAuthProviderKey,
+	providerAccountId: Schema.NonEmptyString,
+	handle: Schema.Option(Schema.NonEmptyString)
+}) {};
+/**
+* The durable link between one subject and one provider account: identity plus
+* the current token set. At most one connection exists per subject and
+* provider; completing a new authorization replaces it.
+*/
+var OAuthConnection = class extends Schema.Class("effect-auth/OAuthConnection")({
+	provider: OAuthProviderKey,
+	subjectId: SubjectId,
+	identity: OAuthIdentity,
+	tokens: OAuthTokens,
+	connectedAt: Schema.DateTimeUtcFromMillis,
+	updatedAt: Schema.DateTimeUtcFromMillis
+}) {};
+//#endregion
+export { OAuthAuthorization, OAuthCallbackParams, OAuthConnection, OAuthIdentity, OAuthProviderKey, OAuthState, OAuthTokens };
+
+//# sourceMappingURL=schema.mjs.map

package/dist/oauth/schema.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.mjs","names":[],"sources":["../../src/oauth/schema.ts"],"sourcesContent":["import { Schema } from \"effect\";\n\nimport { SubjectId, TokenDigest } from \"../Schema\";\n\n// --- Identifiers -----------------------------------------------------------\n\n/**\n * Stable identifier of one configured OAuth provider (\"github\", \"gitlab\").\n * Doubles as the routing key for callback endpoints, so it is constrained to\n * URL-safe lowercase slugs.\n */\nexport const OAuthProviderKey = Schema.String.check(\n  Schema.isPattern(/^[a-z][a-z0-9-]{0,63}$/),\n).pipe(Schema.brand(\"effect-auth/OAuthProviderKey\"));\n\nexport type OAuthProviderKey = typeof OAuthProviderKey.Type;\n\n// --- Authorization state ------------------------------------------------------\n\n/**\n * One pending authorization redirect, stored under the digest of the opaque\n * `state` token carried through the provider redirect. Binding the subject and\n * redirect URI here is what lets the callback verify that the response belongs\n * to the actor and destination that initiated it.\n */\nexport class OAuthState extends Schema.Class<OAuthState>(\"effect-auth/OAuthState\")({\n  stateDigest: TokenDigest,\n  provider: OAuthProviderKey,\n  subjectId: SubjectId,\n  redirectUri: Schema.NonEmptyString,\n  issuedAt: Schema.DateTimeUtcFromMillis,\n  expiresAt: Schema.DateTimeUtcFromMillis,\n}) {}\n\n/** Where to send the browser to start an authorization, plus the state's expiry. */\nexport class OAuthAuthorization extends Schema.Class<OAuthAuthorization>(\n  \"effect-auth/OAuthAuthorization\",\n)({\n  url: Schema.NonEmptyString,\n  expiresAt: Schema.DateTimeUtcFromMillis,\n}) {}\n\n/**\n * The untrusted query parameters a provider redirects back with. Decoded from\n * `unknown` inside the OAuth workflow, so HTTP handlers can hand the raw\n * query record straight through.\n */\nexport class OAuthCallbackParams extends Schema.Class<OAuthCallbackParams>(\n  \"effect-auth/OAuthCallbackParams\",\n)({\n  state: Schema.optionalKey(Schema.String),\n  code: Schema.optionalKey(Schema.String),\n  error: Schema.optionalKey(Schema.String),\n  error_description: Schema.optionalKey(Schema.String),\n}) {}\n\n// --- Tokens -------------------------------------------------------------------\n\n/**\n * The provider-issued token set with absolute expirations. Token values stay\n * `Redacted` end to end; persistence adapters unwrap them only at their\n * encryption boundary.\n */\nexport class OAuthTokens extends Schema.Class<OAuthTokens>(\"effect-auth/OAuthTokens\")({\n  accessToken: Schema.Redacted(Schema.NonEmptyString),\n  /** Normalized to lowercase; \"bearer\" for every currently supported provider. */\n  tokenType: Schema.NonEmptyString,\n  /** `None` means the provider issues non-expiring access tokens. */\n  accessTokenExpiresAt: Schema.Option(Schema.DateTimeUtcFromMillis),\n  refreshToken: Schema.Option(Schema.Redacted(Schema.NonEmptyString)),\n  refreshTokenExpiresAt: Schema.Option(Schema.DateTimeUtcFromMillis),\n  scope: Schema.Option(Schema.NonEmptyString),\n}) {}\n\n// --- Identity -------------------------------------------------------------------\n\n/**\n * The provider's account identity, validated by the provider layer. The\n * account id is the provider's *stable* identifier in string form (for GitHub,\n * the numeric user id in decimal); the handle is the mutable display login.\n */\nexport class OAuthIdentity extends Schema.Class<OAuthIdentity>(\"effect-auth/OAuthIdentity\")({\n  provider: OAuthProviderKey,\n  providerAccountId: Schema.NonEmptyString,\n  handle: Schema.Option(Schema.NonEmptyString),\n}) {}\n\n// --- Connection -------------------------------------------------------------------\n\n/**\n * The durable link between one subject and one provider account: identity plus\n * the current token set. At most one connection exists per subject and\n * provider; completing a new authorization replaces it.\n */\nexport class OAuthConnection extends Schema.Class<OAuthConnection>(\"effect-auth/OAuthConnection\")({\n  provider: OAuthProviderKey,\n  subjectId: SubjectId,\n  identity: OAuthIdentity,\n  tokens: OAuthTokens,\n  connectedAt: Schema.DateTimeUtcFromMillis,\n  updatedAt: Schema.DateTimeUtcFromMillis,\n}) {}\n"],"mappings":";;;;;;;;AAWA,MAAa,mBAAmB,OAAO,OAAO,MAC5C,OAAO,UAAU,wBAAwB,CAC3C,CAAC,CAAC,KAAK,OAAO,MAAM,8BAA8B,CAAC;;;;;;;AAYnD,IAAa,aAAb,cAAgC,OAAO,MAAkB,wBAAwB,CAAC,CAAC;CACjF,aAAa;CACb,UAAU;CACV,WAAW;CACX,aAAa,OAAO;CACpB,UAAU,OAAO;CACjB,WAAW,OAAO;AACpB,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,qBAAb,cAAwC,OAAO,MAC7C,gCACF,CAAC,CAAC;CACA,KAAK,OAAO;CACZ,WAAW,OAAO;AACpB,CAAC,CAAC,CAAC,CAAC;;;;;;AAOJ,IAAa,sBAAb,cAAyC,OAAO,MAC9C,iCACF,CAAC,CAAC;CACA,OAAO,OAAO,YAAY,OAAO,MAAM;CACvC,MAAM,OAAO,YAAY,OAAO,MAAM;CACtC,OAAO,OAAO,YAAY,OAAO,MAAM;CACvC,mBAAmB,OAAO,YAAY,OAAO,MAAM;AACrD,CAAC,CAAC,CAAC,CAAC;;;;;;AASJ,IAAa,cAAb,cAAiC,OAAO,MAAmB,yBAAyB,CAAC,CAAC;CACpF,aAAa,OAAO,SAAS,OAAO,cAAc;;CAElD,WAAW,OAAO;;CAElB,sBAAsB,OAAO,OAAO,OAAO,qBAAqB;CAChE,cAAc,OAAO,OAAO,OAAO,SAAS,OAAO,cAAc,CAAC;CAClE,uBAAuB,OAAO,OAAO,OAAO,qBAAqB;CACjE,OAAO,OAAO,OAAO,OAAO,cAAc;AAC5C,CAAC,CAAC,CAAC,CAAC;;;;;;AASJ,IAAa,gBAAb,cAAmC,OAAO,MAAqB,2BAA2B,CAAC,CAAC;CAC1F,UAAU;CACV,mBAAmB,OAAO;CAC1B,QAAQ,OAAO,OAAO,OAAO,cAAc;AAC7C,CAAC,CAAC,CAAC,CAAC;;;;;;AASJ,IAAa,kBAAb,cAAqC,OAAO,MAAuB,6BAA6B,CAAC,CAAC;CAChG,UAAU;CACV,WAAW;CACX,UAAU;CACV,QAAQ;CACR,aAAa,OAAO;CACpB,WAAW,OAAO;AACpB,CAAC,CAAC,CAAC,CAAC"}

package/dist/oauth/signInErrors.d.mts

@@ -0,0 +1,17 @@
+import { Schema } from "effect";
+//#region src/oauth/signInErrors.d.ts
+declare const OAuthRejected_base: Schema.Class<OAuthRejected, Schema.TaggedStruct<"OAuthRejected", {}>, import("effect/Cause").YieldableError>;
+declare class OAuthRejected extends OAuthRejected_base {}
+declare const OAuthUnavailable_base: Schema.Class<OAuthUnavailable, Schema.TaggedStruct<"OAuthUnavailable", {}>, import("effect/Cause").YieldableError>;
+declare class OAuthUnavailable extends OAuthUnavailable_base {}
+declare const OAuthMethodUnsupported_base: Schema.Class<OAuthMethodUnsupported, Schema.TaggedStruct<"OAuthMethodUnsupported", {}>, import("effect/Cause").YieldableError>;
+declare class OAuthMethodUnsupported extends OAuthMethodUnsupported_base {}
+declare const OAuthProtocolRejected_base: Schema.Class<OAuthProtocolRejected, Schema.TaggedStruct<"OAuthProtocolRejected", {}>, import("effect/Cause").YieldableError>;
+declare class OAuthProtocolRejected extends OAuthProtocolRejected_base {}
+declare const OAuthConfigurationError_base: Schema.Class<OAuthConfigurationError, Schema.TaggedStruct<"OAuthConfigurationError", {
+  readonly reason: Schema.Literals<readonly ["module", "policy", "keyring", "return-target"]>;
+}>, import("effect/Cause").YieldableError>;
+declare class OAuthConfigurationError extends OAuthConfigurationError_base {}
+//#endregion
+export { OAuthConfigurationError, OAuthMethodUnsupported, OAuthProtocolRejected, OAuthRejected, OAuthUnavailable };
+//# sourceMappingURL=signInErrors.d.mts.map

package/dist/oauth/signInErrors.mjs

@@ -0,0 +1,16 @@
+import { Schema } from "effect";
+//#region src/oauth/signInErrors.ts
+var OAuthRejected = class extends Schema.TaggedError()("OAuthRejected", {}) {};
+var OAuthUnavailable = class extends Schema.TaggedError()("OAuthUnavailable", {}) {};
+var OAuthMethodUnsupported = class extends Schema.TaggedError()("OAuthMethodUnsupported", {}) {};
+var OAuthProtocolRejected = class extends Schema.TaggedError()("OAuthProtocolRejected", {}) {};
+var OAuthConfigurationError = class extends Schema.TaggedError()("OAuthConfigurationError", { reason: Schema.Literals([
+	"module",
+	"policy",
+	"keyring",
+	"return-target"
+]) }) {};
+//#endregion
+export { OAuthConfigurationError, OAuthMethodUnsupported, OAuthProtocolRejected, OAuthRejected, OAuthUnavailable };
+
+//# sourceMappingURL=signInErrors.mjs.map

package/dist/oauth/signInErrors.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"signInErrors.mjs","names":[],"sources":["../../src/oauth/signInErrors.ts"],"sourcesContent":["import { Schema } from \"effect\";\n\nexport class OAuthRejected extends Schema.TaggedError<OAuthRejected>()(\"OAuthRejected\", {}) {}\n\nexport class OAuthUnavailable extends Schema.TaggedError<OAuthUnavailable>()(\n  \"OAuthUnavailable\",\n  {},\n) {}\n\nexport class OAuthMethodUnsupported extends Schema.TaggedError<OAuthMethodUnsupported>()(\n  \"OAuthMethodUnsupported\",\n  {},\n) {}\n\nexport class OAuthProtocolRejected extends Schema.TaggedError<OAuthProtocolRejected>()(\n  \"OAuthProtocolRejected\",\n  {},\n) {}\n\nexport class OAuthConfigurationError extends Schema.TaggedError<OAuthConfigurationError>()(\n  \"OAuthConfigurationError\",\n  { reason: Schema.Literals([\"module\", \"policy\", \"keyring\", \"return-target\"]) },\n) {}\n"],"mappings":";;AAEA,IAAa,gBAAb,cAAmC,OAAO,YAA2B,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;AAE7F,IAAa,mBAAb,cAAsC,OAAO,YAA8B,CAAC,CAC1E,oBACA,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,IAAa,yBAAb,cAA4C,OAAO,YAAoC,CAAC,CACtF,0BACA,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,IAAa,wBAAb,cAA2C,OAAO,YAAmC,CAAC,CACpF,yBACA,CAAC,CACH,CAAC,CAAC,CAAC;AAEH,IAAa,0BAAb,cAA6C,OAAO,YAAqC,CAAC,CACxF,2BACA,EAAE,QAAQ,OAAO,SAAS;CAAC;CAAU;CAAU;CAAW;AAAe,CAAC,EAAE,CAC9E,CAAC,CAAC,CAAC"}