@yielded/auth 0.1.0-beta.1

package/dist/oauth/signInModule.mjs

@@ -0,0 +1,430 @@
+import { TokenDigest } from "../Schema.mjs";
+import { HookDenied } from "../hooks/models.mjs";
+import { reportAuthFailure } from "../internal/diagnostics.mjs";
+import { makeOperation, operationGroup } from "../operations/operation.mjs";
+import { AuthenticationFlowId } from "../sessions/models.mjs";
+import { cryptoLayer, defaultLayer, hooksLayer } from "../auth/defaults.mjs";
+import { hasCommitScope } from "../hooks/commit.mjs";
+import { makeAuthStrategy } from "../auth/AuthStrategy.mjs";
+import { makeRequestBinding } from "../operations/requestBinding.mjs";
+import { OAuthCallbackResponse, OAuthClaim, OAuthClaimDecision, OAuthClaimId, OAuthCredentialSnapshot, OAuthIssueDecision, OAuthModuleId, OAuthPendingFlow, OAuthProtocolConfiguration, OAuthProtocolPreparation, OAuthReturnTarget, OAuthSealedTransaction, OAuthSignInAuthorization, OAuthSignInBegin, OAuthSignInComplete, OAuthSignInPolicy, OAuthSignInTransactionContext, OAuthTransactionSecrets, OAuthVerifiedExternalIdentity } from "./signInModels.mjs";
+import { OAuthRegistrationIntent, OAuthRegistrationPolicy, OAuthRegistrationRequired } from "./registrationModels.mjs";
+import { OAuthRegistrationIntents, OAuthRegistrationSettlement } from "./OAuthRegistrationIntents.mjs";
+import { OAuthSignInPersistence } from "./OAuthSignInPersistence.mjs";
+import { OAuthConfigurationError, OAuthMethodUnsupported, OAuthProtocolRejected, OAuthRejected, OAuthUnavailable } from "./signInErrors.mjs";
+import { snapshotOAuth, snapshotOAuthSync } from "./signInSnapshot.mjs";
+import { OAuthProtocol } from "./OAuthProtocol.mjs";
+import { OAuthReturnTargets } from "./OAuthReturnTargets.mjs";
+import { OAuthTransactionProtector } from "./OAuthTransactionProtector.mjs";
+import { makeOAuthConnected } from "./connected.mjs";
+import { makeOAuthAccounts } from "./accounts.mjs";
+import { prepare } from "./registrationSecrets.mjs";
+import { makeOAuthRegistration } from "./registration.mjs";
+import { Cause, Context, Crypto, DateTime, Effect, Encoding, Exit, Fiber, Layer, Redacted, Result, Schema } from "effect";
+//#region src/oauth/signInModule.ts
+const Failure = Schema.Union([
+	OAuthRejected,
+	OAuthUnavailable,
+	OAuthMethodUnsupported,
+	HookDenied
+]);
+const noAmbient = Effect.fn("OAuth.noAmbient")(function* () {
+	if (yield* hasCommitScope) return yield* OAuthMethodUnsupported.make({});
+});
+const read = (receipt) => receipt.read.pipe(Effect.mapError(() => OAuthUnavailable.make({})));
+const encoder = new TextEncoder();
+const bounded = (effect, millis) => Effect.gen(function* () {
+	const fiber = yield* effect.pipe(Effect.interruptible, Effect.forkDetach);
+	return yield* Fiber.join(fiber).pipe(Effect.timeout(millis), Effect.ensuring(Fiber.interrupt(fiber).pipe(Effect.forkDetach, Effect.asVoid)));
+});
+const flowJson = Schema.fromJsonString(OAuthPendingFlow);
+const contextJson = Schema.fromJsonString(OAuthSignInTransactionContext);
+const responseJson = Schema.fromJsonString(OAuthCallbackResponse);
+const stateMessage = Schema.fromJsonString(Schema.Tuple([
+	Schema.Literal("effect-auth/oauth-state/v1"),
+	OAuthModuleId,
+	OAuthSignInPolicy.fields.generation,
+	OAuthSignInBegin.fields.provider,
+	OAuthSignInBegin.fields.flowId,
+	Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/))
+]));
+/** Guest sign-in only. Durable flow/identity authority, configured protocol,
+* separate transaction encryption and request-binding signing are explicit Layers.
+* This installs no provider, database, registration or connected-token capability.
+*/
+const makeOAuthMethod = (moduleId, options) => {
+	const sessions = options.sessions;
+	const binding = makeRequestBinding(moduleId, "oauth-entry");
+	const ClaimsForOAuth = Context.Service(`effect-auth/oauth/${moduleId.length}:${moduleId}/Claims`);
+	const CompletionResult = Schema.Union([
+		Schema.Struct({
+			completion: sessions.CompletionResult,
+			returnTarget: OAuthReturnTarget
+		}),
+		Schema.TaggedStruct("Cancelled", { returnTarget: OAuthReturnTarget }),
+		OAuthRegistrationRequired
+	]);
+	const SignIn = Context.Service(`effect-auth/oauth/${moduleId.length}:${moduleId}/SignIn`);
+	const makeSignInLayer = (configuration, registrationSource) => {
+		let captured;
+		try {
+			captured = snapshotOAuthSync(OAuthSignInPolicy, configuration);
+		} catch {}
+		return Layer.effect(SignIn, Effect.gen(function* () {
+			const id = yield* Schema.decodeEffect(OAuthModuleId)(moduleId).pipe(Effect.mapError(() => OAuthConfigurationError.make({ reason: "module" })));
+			if (captured === void 0) return yield* OAuthConfigurationError.make({ reason: "policy" });
+			const policy = captured;
+			const registration = yield* registrationSource;
+			const { issue: issueBinding, verify: verifyBinding } = yield* binding.RequestBinding;
+			const { prepareAuthorization, exchangeVerifiedIdentity } = yield* OAuthProtocol;
+			const { resolve: returnTarget } = yield* OAuthReturnTargets;
+			const { seal, open } = yield* OAuthTransactionProtector;
+			const { issue, claim, settle } = yield* OAuthSignInPersistence;
+			const { resolve: resolveClaims } = yield* ClaimsForOAuth;
+			const { prepare: completeAuthentication } = yield* sessions.AuthenticationCompletion;
+			const crypto = yield* Crypto.Crypto;
+			const { randomBytes, digest } = crypto;
+			const hash = Effect.fn("OAuth.hash")(function* (message) {
+				const result = yield* digest("SHA-256", encoder.encode(message)).pipe(Effect.mapError(() => OAuthUnavailable.make({})));
+				return TokenDigest.make(Encoding.encodeBase64Url(result));
+			});
+			const stateDigest = Effect.fn("OAuth.stateDigest")(function* (flowId, provider, state) {
+				const raw = Redacted.value(state);
+				if (!Schema.is(Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)))(raw)) return yield* OAuthRejected.make({});
+				const bytes = Result.getOrUndefined(Encoding.decodeBase64Url(raw));
+				if (bytes === void 0 || bytes.length !== 32 || Encoding.encodeBase64Url(bytes) !== raw) {
+					bytes?.fill(0);
+					return yield* OAuthRejected.make({});
+				}
+				bytes.fill(0);
+				const message = yield* Schema.encodeEffect(stateMessage)([
+					"effect-auth/oauth-state/v1",
+					id,
+					policy.generation,
+					provider,
+					flowId,
+					raw
+				]).pipe(Effect.mapError(() => OAuthUnavailable.make({})));
+				return yield* hash(message);
+			});
+			const binderError = (error) => error._tag === "RequestBindingInvalid" ? OAuthRejected.make({}) : OAuthUnavailable.make({});
+			const begin = Effect.fn("OAuth.SignIn.begin")(function* (raw) {
+				yield* noAmbient();
+				const request = yield* snapshotOAuth(OAuthSignInBegin, raw);
+				const target = yield* returnTarget(request.returnTarget);
+				const canonicalTarget = yield* Schema.decodeEffect(OAuthReturnTarget)(target).pipe(Effect.mapError(() => OAuthUnavailable.make({})));
+				const issuedBinding = yield* issueBinding(request.flowId).pipe(Effect.mapError(binderError));
+				const original = issuedBinding.credentialCommands[0];
+				if (issuedBinding.credentialCommands.length !== 1 || original?._tag !== "Issue" || original.slot !== "request-binding" || issuedBinding.value.flowId !== request.flowId || original.expiresAtMillis !== issuedBinding.value.expiresAtMillis) return yield* OAuthUnavailable.make({});
+				const command = Object.freeze({
+					_tag: "Issue",
+					slot: "request-binding",
+					credential: Redacted.make(Redacted.value(original.credential)),
+					expiresAtMillis: original.expiresAtMillis
+				});
+				const binder = Object.freeze({ ...yield* verifyBinding(request.flowId, Redacted.make(Redacted.value(command.credential))).pipe(Effect.mapError(binderError)) });
+				if (binder.expiresAtMillis !== command.expiresAtMillis) return yield* OAuthUnavailable.make({});
+				const prepared = yield* prepareAuthorization(Object.freeze({
+					provider: request.provider,
+					callbackId: request.callbackId,
+					flowId: request.flowId
+				})).pipe(Effect.flatMap((value) => snapshotOAuth(OAuthProtocolPreparation, value)));
+				if (prepared.configuration.provider !== request.provider || prepared.configuration.callbackId !== request.callbackId || prepared.configuration.protocol === "oidc" !== (prepared.secrets.oidcNonce !== void 0)) return yield* OAuthUnavailable.make({});
+				const now = DateTime.toEpochMillis(yield* DateTime.now);
+				const expiresAtMillis = Math.min(now + policy.lifetimeMillis, binder.expiresAtMillis);
+				if (expiresAtMillis <= now) return yield* OAuthRejected.make({});
+				const context = yield* snapshotOAuth(OAuthSignInTransactionContext, {
+					namespace: "effect-auth/oauth-sign-in-context/v1",
+					moduleId: id,
+					generation: policy.generation,
+					flowId: request.flowId,
+					commandId: request.commandId,
+					...prepared.configuration,
+					returnTarget: canonicalTarget,
+					stateDigest: yield* stateDigest(request.flowId, request.provider, prepared.secrets.state).pipe(Effect.mapError(() => OAuthUnavailable.make({}))),
+					requestBindingVerifier: binder.verifier,
+					requestBindingExpiresAtMillis: binder.expiresAtMillis,
+					issuedAtMillis: now,
+					expiresAtMillis,
+					claimLifetimeMillis: policy.claimLifetimeMillis
+				});
+				const sealed = yield* seal({
+					context: snapshotOAuthSync(OAuthSignInTransactionContext, context),
+					secrets: snapshotOAuthSync(OAuthTransactionSecrets, prepared.secrets)
+				}).pipe(Effect.flatMap((value) => snapshotOAuth(OAuthSealedTransaction, value)));
+				const flow = snapshotOAuthSync(OAuthPendingFlow, {
+					context,
+					sealed,
+					retentionUntilMillis: expiresAtMillis + policy.retentionMillis
+				});
+				const expected = Schema.encodeSync(flowJson)(flow);
+				const receipt = yield* issue(snapshotOAuthSync(OAuthPendingFlow, flow), (decision, journal) => {
+					const checked = snapshotOAuthSync(OAuthIssueDecision, decision);
+					if (checked._tag === "Rejected") return journal.prepare({ _tag: "Rejected" });
+					if (Schema.encodeSync(flowJson)(checked.flow) !== expected) throw OAuthUnavailable.make({});
+					return journal.prepare({
+						_tag: "Issued",
+						result: Object.freeze({
+							value: Object.freeze({
+								flowId: request.flowId,
+								authorizationUrl: prepared.authorizationUrl,
+								expiresAtMillis
+							}),
+							credentialCommands: Object.freeze([command])
+						})
+					});
+				});
+				const committed = yield* read(receipt);
+				if (committed._tag === "Rejected") return yield* OAuthRejected.make({});
+				return committed.result;
+			}, Effect.tapCause((cause) => Cause.hasDies(cause) ? reportAuthFailure("oauth-sign-in", cause) : Effect.void), Effect.catchDefect(() => Effect.fail(OAuthUnavailable.make({}))));
+			const complete = Effect.fn("OAuth.SignIn.complete")(function* (raw) {
+				yield* noAmbient();
+				const request = yield* snapshotOAuth(OAuthSignInComplete, raw);
+				const response = request.response;
+				const serialized = yield* Schema.encodeEffect(responseJson)(response).pipe(Effect.mapError(() => OAuthRejected.make({})));
+				if (encoder.encode(serialized).length > 16384) return yield* OAuthRejected.make({});
+				const binder = Object.freeze({ ...yield* verifyBinding(request.flowId, request.requestBinding).pipe(Effect.mapError(binderError)) });
+				const state = yield* stateDigest(request.flowId, request.provider, response.state);
+				const random = yield* randomBytes(32).pipe(Effect.mapError(() => OAuthUnavailable.make({})));
+				const claimId = OAuthClaimId.make(Encoding.encodeBase64Url(random));
+				random.fill(0);
+				const input = Object.freeze({
+					moduleId: id,
+					generation: policy.generation,
+					flowId: request.flowId,
+					provider: request.provider,
+					callbackId: request.callbackId,
+					stateDigest: state,
+					requestBindingVerifier: binder.verifier,
+					requestBindingExpiresAtMillis: binder.expiresAtMillis,
+					claimId,
+					...response.issuer === void 0 ? {} : { responseIssuer: response.issuer },
+					nowMillis: DateTime.toEpochMillis(yield* DateTime.now)
+				});
+				const { finished, context, verifiedAt, identity, registrationCommand } = yield* Effect.uninterruptibleMask((restore) => Effect.gen(function* () {
+					const receipt = yield* restore(claim(input, (decision, journal) => journal.prepare(snapshotOAuthSync(OAuthClaimDecision, decision))));
+					const decision = yield* read(receipt);
+					if (decision._tag !== "Claimed") return yield* OAuthRejected.make({});
+					const owned = snapshotOAuthSync(OAuthClaim, decision.claim);
+					const context = owned.flow.context;
+					if (owned.claimId !== claimId || context.moduleId !== id || context.generation !== policy.generation || context.flowId !== request.flowId || context.provider !== request.provider || context.callbackId !== request.callbackId || context.stateDigest !== state || context.requestBindingVerifier !== binder.verifier || context.requestBindingExpiresAtMillis !== binder.expiresAtMillis || owned.claimedAtMillis < context.issuedAtMillis || owned.claimedAtMillis >= context.expiresAtMillis || context.expiresAtMillis > context.requestBindingExpiresAtMillis || owned.claimExpiresAtMillis !== owned.claimedAtMillis + context.claimLifetimeMillis || owned.flow.retentionUntilMillis < owned.claimExpiresAtMillis || (context.responseIssuerMode === "required" ? response.issuer !== context.issuer : response.issuer !== void 0)) return yield* OAuthUnavailable.make({});
+					let verifiedAt = owned.claimedAtMillis;
+					const exchange = Effect.gen(function* () {
+						const secrets = yield* open({
+							context: snapshotOAuthSync(OAuthSignInTransactionContext, context),
+							sealed: snapshotOAuthSync(OAuthSealedTransaction, owned.flow.sealed)
+						}).pipe(Effect.flatMap((value) => snapshotOAuth(OAuthTransactionSecrets, value)));
+						if (context.protocol === "oidc" !== (secrets.oidcNonce !== void 0) || (yield* stateDigest(context.flowId, context.provider, secrets.state)) !== context.stateDigest || Redacted.value(secrets.state) !== Redacted.value(response.state)) return yield* OAuthUnavailable.make({});
+						if (response._tag !== "Code") return yield* OAuthProtocolRejected.make({});
+						const start = yield* DateTime.now;
+						verifiedAt = DateTime.toEpochMillis(start);
+						if (verifiedAt >= owned.claimExpiresAtMillis) return yield* OAuthUnavailable.make({});
+						const identity = yield* exchangeVerifiedIdentity({
+							configuration: snapshotOAuthSync(OAuthProtocolConfiguration, context),
+							response: snapshotOAuthSync(OAuthCallbackResponse, response),
+							secrets: snapshotOAuthSync(OAuthTransactionSecrets, secrets),
+							verificationStartedAt: start
+						}).pipe(Effect.flatMap((value) => snapshotOAuth(OAuthVerifiedExternalIdentity, value)));
+						if (identity.identity.provider !== context.provider || identity.identity.issuer !== context.issuer) return yield* OAuthProtocolRejected.make({});
+						if (identity.upstreamAuthenticatedAt !== void 0) verifiedAt = Math.min(verifiedAt, DateTime.toEpochMillis(identity.upstreamAuthenticatedAt));
+						return identity;
+					});
+					const remaining = Math.max(1, owned.claimExpiresAtMillis - DateTime.toEpochMillis(yield* DateTime.now));
+					const exchanged = response._tag === "Error" ? void 0 : yield* Effect.exit(restore(bounded(exchange, remaining)));
+					const definiteRejection = exchanged !== void 0 && Exit.isFailure(exchanged) && exchanged.cause.reasons.length === 1 && exchanged.cause.reasons[0]?._tag === "Fail" && Schema.is(OAuthProtocolRejected)(exchanged.cause.reasons[0].error);
+					if (exchanged !== void 0 && Exit.isFailure(exchanged) && !definiteRejection) yield* reportAuthFailure("oauth-exchange", exchanged.cause);
+					let outcome = exchanged === void 0 ? { _tag: "Cancelled" } : Exit.isSuccess(exchanged) ? {
+						_tag: "Verified",
+						identity: exchanged.value
+					} : definiteRejection ? { _tag: "Rejected" } : { _tag: "Ambiguous" };
+					let registrationPrepared;
+					if (outcome._tag === "Verified" && registration !== void 0) {
+						const prepared = yield* Effect.exit(bounded(prepare(owned, outcome.identity, verifiedAt, registration.policy), remaining));
+						if (Exit.isSuccess(prepared)) registrationPrepared = prepared.value;
+						else {
+							yield* reportAuthFailure("oauth-sign-in", prepared.cause);
+							outcome = { _tag: "Ambiguous" };
+						}
+					}
+					const intentCodec = Schema.fromJsonString(OAuthRegistrationIntent);
+					const expectedIntent = registrationPrepared === void 0 ? void 0 : Schema.encodeSync(intentCodec)(registrationPrepared.intent);
+					const prepare$1 = (value, journal) => {
+						const result = snapshotOAuthSync(OAuthRegistrationSettlement, value);
+						if (result._tag === "RegistrationIssued") {
+							if (outcome._tag !== "Verified" || expectedIntent === void 0 || Schema.encodeSync(intentCodec)(result.intent) !== expectedIntent) throw OAuthUnavailable.make({});
+						} else if (result._tag !== "Rejected" && result._tag !== outcome._tag) throw OAuthUnavailable.make({});
+						return journal.prepare(result);
+					};
+					const nowMillis = DateTime.toEpochMillis(yield* DateTime.now);
+					const commit = outcome._tag === "Verified" && registration !== void 0 ? registration.settle({
+						claim: snapshotOAuthSync(OAuthClaim, owned),
+						identity: snapshotOAuthSync(OAuthVerifiedExternalIdentity, outcome.identity),
+						...registrationPrepared === void 0 ? {} : { intent: snapshotOAuthSync(OAuthRegistrationIntent, registrationPrepared.intent) },
+						nowMillis
+					}, prepare$1) : settle({
+						claim: snapshotOAuthSync(OAuthClaim, owned),
+						outcome,
+						nowMillis
+					}, prepare$1);
+					return {
+						finished: yield* bounded(commit, policy.settlementTimeoutMillis).pipe(Effect.flatMap(read), Effect.mapError(() => OAuthUnavailable.make({}))),
+						registrationCommand: registrationPrepared?.command,
+						context,
+						verifiedAt,
+						identity: outcome._tag === "Verified" ? outcome.identity : void 0
+					};
+				}));
+				if (finished._tag === "RegistrationIssued") {
+					if (registrationCommand === void 0) return yield* OAuthUnavailable.make({});
+					return {
+						value: {
+							_tag: "RegistrationRequired",
+							reference: finished.intent.reference,
+							expiresAtMillis: finished.intent.expiresAtMillis,
+							returnTarget: context.returnTarget
+						},
+						credentialCommands: [registrationCommand]
+					};
+				}
+				if (finished._tag === "Cancelled") return {
+					value: {
+						_tag: "Cancelled",
+						returnTarget: context.returnTarget
+					},
+					credentialCommands: [{
+						_tag: "Clear",
+						slot: "request-binding"
+					}]
+				};
+				if (finished._tag === "Ambiguous") return yield* OAuthUnavailable.make({});
+				if (finished._tag !== "Verified" || identity === void 0) return yield* OAuthRejected.make({});
+				const credential = snapshotOAuthSync(OAuthCredentialSnapshot, finished.credential);
+				if (credential.moduleId !== id || credential.identity.provider !== identity.identity.provider || credential.identity.issuer !== identity.identity.issuer || credential.identity.subject !== identity.identity.subject || new Set(credential.revision.credentials.map((item) => item.credentialId)).size !== credential.revision.credentials.length || !credential.revision.credentials.some((item) => item.credentialId === credential.credentialId && item.revision === credential.credentialRevision)) return yield* OAuthUnavailable.make({});
+				const bindingDigest = yield* hash(yield* Schema.encodeEffect(contextJson)(context).pipe(Effect.mapError(() => OAuthUnavailable.make({}))));
+				const claims = yield* resolveClaims(snapshotOAuthSync(OAuthCredentialSnapshot, credential));
+				const established = yield* completeAuthentication({
+					claims,
+					evidence: {
+						revision: credential.revision,
+						flowId: AuthenticationFlowId.make(context.flowId),
+						bindingDigest,
+						proofs: [{
+							method: context.protocol,
+							credentialId: credential.credentialId,
+							factors: ["possession"],
+							userVerified: false,
+							phishingResistant: false,
+							verifiedAt: DateTime.makeUnsafe(verifiedAt)
+						}]
+					}
+				}).pipe(Effect.mapError((error) => error._tag === "HookDenied" ? error : error._tag === "SessionUnavailable" ? OAuthUnavailable.make({}) : OAuthRejected.make({})), Effect.flatMap(read));
+				return {
+					value: {
+						completion: established.value,
+						returnTarget: context.returnTarget
+					},
+					credentialCommands: [...established.credentialCommands, {
+						_tag: "Clear",
+						slot: "request-binding"
+					}]
+				};
+			}, Effect.provideService(Crypto.Crypto, crypto), Effect.tapCause((cause) => Cause.hasDies(cause) ? reportAuthFailure("oauth-sign-in", cause) : Effect.void), Effect.catchDefect(() => Effect.fail(OAuthUnavailable.make({}))));
+			return SignIn.of({
+				begin,
+				complete
+			});
+		}));
+	};
+	const signInLayer = (configuration) => makeSignInLayer(configuration, Effect.succeed(void 0));
+	const registration = (codec) => {
+		const capability = makeOAuthRegistration(moduleId, codec, binding);
+		const registrationSignInLayer = (configuration, registrationConfiguration) => {
+			let captured;
+			try {
+				captured = snapshotOAuthSync(OAuthRegistrationPolicy, registrationConfiguration);
+			} catch {}
+			return makeSignInLayer(configuration, Effect.gen(function* () {
+				if (captured === void 0) return yield* OAuthConfigurationError.make({ reason: "policy" });
+				const { settle } = yield* OAuthRegistrationIntents;
+				return {
+					settle,
+					policy: captured
+				};
+			}));
+		};
+		return Object.freeze({
+			...capability,
+			signInLayer: registrationSignInLayer,
+			strategy: makeAuthStrategy({ register: capability.operations.Complete.invoke }, capability.handlersLayer.pipe(Layer.provide(defaultLayer(capability.Registrations, capability.layer)), Layer.provide(defaultLayer(binding.RequestBinding, binding.layer)), Layer.provide([cryptoLayer, hooksLayer])))
+		});
+	};
+	const Begin = makeOperation(`${moduleId}/sign-in/begin`, {
+		payload: OAuthSignInBegin,
+		success: OAuthSignInAuthorization,
+		error: Failure,
+		access: "any",
+		exposure: "public",
+		replay: "non-idempotent",
+		credentials: true
+	});
+	const Complete = makeOperation(`${moduleId}/sign-in/complete`, {
+		payload: OAuthSignInComplete,
+		success: CompletionResult,
+		error: Failure,
+		access: "any",
+		exposure: "public",
+		replay: "single-use",
+		credentials: true
+	});
+	const handlersLayer = Layer.mergeAll(Begin.credentialHandlerLayer(Effect.fn("OAuth.Begin")(function* (input) {
+		return yield* (yield* SignIn).begin(input);
+	})), Complete.credentialHandlerLayer(Effect.fn("OAuth.Complete")(function* (input) {
+		return yield* (yield* SignIn).complete(input);
+	})));
+	const layer = (policy) => handlersLayer.pipe(Layer.provide(defaultLayer(SignIn, signInLayer(policy))), Layer.provide(defaultLayer(binding.RequestBinding, binding.layer)), Layer.provide([cryptoLayer, hooksLayer]));
+	const accounts = (policy) => {
+		const module = makeOAuthAccounts(moduleId, sessions, policy);
+		return Object.freeze({
+			...module,
+			strategy: makeAuthStrategy({
+				linkAccount: module.operations.Link.Begin.invoke,
+				completeAccountLink: module.operations.Link.Complete.invoke,
+				unlinkAccount: module.operations.Unlink.invoke
+			}, module.handlersLayer.pipe(Layer.provide(defaultLayer(module.Accounts, module.layer)), Layer.provide(defaultLayer(module.binding.RequestBinding, module.binding.layer)), Layer.provide([cryptoLayer, hooksLayer])))
+		});
+	};
+	const connected = (policy) => {
+		const module = makeOAuthConnected(moduleId, policy);
+		return Object.freeze({
+			...module,
+			strategy: makeAuthStrategy({
+				connectAccount: module.operations.Begin.invoke,
+				completeAccountConnection: module.operations.Complete.invoke,
+				listAccountConnections: module.operations.List.invoke,
+				disconnectAccount: module.operations.Disconnect.invoke
+			}, module.handlersLayer.pipe(Layer.provide(defaultLayer(module.Connected, module.layer)), Layer.provide(defaultLayer(module.binding.RequestBinding, module.binding.layer)), Layer.provide([cryptoLayer, hooksLayer])))
+		});
+	};
+	return Object.freeze({
+		binding,
+		ClaimsForOAuth,
+		SignIn,
+		signInLayer,
+		layer,
+		registration,
+		accounts,
+		connected,
+		CompletionResult,
+		operations: Object.freeze({
+			Begin,
+			Complete
+		}),
+		handlersLayer,
+		group: operationGroup(Begin, Complete)
+	});
+};
+//#endregion
+export { makeOAuthMethod };
+
+//# sourceMappingURL=signInModule.mjs.map

package/dist/oauth/signInModule.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"signInModule.mjs","names":["registrationSecrets.prepare","prepare"],"sources":["../../src/oauth/signInModule.ts"],"sourcesContent":["import {\n  Cause,\n  Context,\n  Crypto,\n  DateTime,\n  Effect,\n  Encoding,\n  Exit,\n  Fiber,\n  Layer,\n  Redacted,\n  Result,\n  Schema,\n  type Types,\n} from \"effect\";\n\nimport { makeAuthStrategy } from \"../auth/AuthStrategy\";\nimport { cryptoLayer, defaultLayer, hooksLayer } from \"../auth/defaults\";\nimport { hasCommitScope, type PreparedCommit } from \"../hooks/commit\";\nimport { HookDenied } from \"../hooks/models\";\nimport { reportAuthFailure } from \"../internal/diagnostics\";\nimport type { AuthOperationResult } from \"../operations/credentials\";\nimport { makeOperation, operationGroup } from \"../operations/operation\";\nimport { makeRequestBinding } from \"../operations/requestBinding\";\nimport { TokenDigest } from \"../Schema\";\nimport { AuthenticationFlowId } from \"../sessions/models\";\nimport type { makeSessionModule } from \"../sessions/module\";\nimport { makeOAuthAccounts } from \"./accounts\";\nimport type { OAuthAccountsPolicy } from \"./accountsModels\";\nimport { makeOAuthConnected } from \"./connected\";\nimport type { OAuthConnectedPolicy } from \"./connectedModels\";\nimport { OAuthProtocol } from \"./OAuthProtocol\";\nimport { OAuthRegistrationIntents, OAuthRegistrationSettlement } from \"./OAuthRegistrationIntents\";\nimport { OAuthReturnTargets } from \"./OAuthReturnTargets\";\nimport { OAuthSignInPersistence, type PrepareOAuthCommit } from \"./OAuthSignInPersistence\";\nimport { OAuthTransactionProtector } from \"./OAuthTransactionProtector\";\nimport { makeOAuthRegistration } from \"./registration\";\nimport {\n  OAuthRegistrationIntent,\n  OAuthRegistrationPolicy,\n  OAuthRegistrationRequired,\n} from \"./registrationModels\";\nimport * as registrationSecrets from \"./registrationSecrets\";\nimport {\n  OAuthConfigurationError,\n  OAuthMethodUnsupported,\n  OAuthProtocolRejected,\n  OAuthRejected,\n  OAuthUnavailable,\n} from \"./signInErrors\";\nimport {\n  OAuthCallbackResponse,\n  OAuthClaim,\n  OAuthClaimDecision,\n  OAuthClaimId,\n  OAuthCredentialSnapshot,\n  OAuthIssueDecision,\n  OAuthModuleId,\n  OAuthPendingFlow,\n  OAuthProtocolConfiguration,\n  OAuthProtocolPreparation,\n  OAuthReturnTarget,\n  OAuthSealedTransaction,\n  OAuthSignInAuthorization,\n  OAuthSignInBegin,\n  OAuthSignInComplete,\n  OAuthSignInPolicy,\n  OAuthSignInTransactionContext,\n  OAuthTransactionSecrets,\n  OAuthVerifiedExternalIdentity,\n} from \"./signInModels\";\nimport { snapshotOAuth, snapshotOAuthSync } from \"./signInSnapshot\";\n\nconst Failure = Schema.Union([OAuthRejected, OAuthUnavailable, OAuthMethodUnsupported, HookDenied]);\n\ntype Failure = typeof Failure.Type;\n\nconst noAmbient = Effect.fn(\"OAuth.noAmbient\")(function* () {\n  if (yield* hasCommitScope) return yield* OAuthMethodUnsupported.make({});\n});\n\nconst read = <A>(receipt: PreparedCommit<A>) =>\n  receipt.read.pipe(Effect.mapError(() => OAuthUnavailable.make({})));\n\nconst encoder = new TextEncoder();\n\n// Waiting is bounded even if an adapter is still finishing cooperative cleanup.\n// A timed-out owner may still commit: its receipt is abandoned, never recovered.\nconst bounded = <A, E, R>(effect: Effect.Effect<A, E, R>, millis: number) =>\n  Effect.gen(function* () {\n    const fiber = yield* effect.pipe(Effect.interruptible, Effect.forkDetach);\n\n    return yield* Fiber.join(fiber).pipe(\n      Effect.timeout(millis),\n      Effect.ensuring(Fiber.interrupt(fiber).pipe(Effect.forkDetach, Effect.asVoid)),\n    );\n  });\n\nconst flowJson = Schema.fromJsonString(OAuthPendingFlow);\nconst contextJson = Schema.fromJsonString(OAuthSignInTransactionContext);\nconst responseJson = Schema.fromJsonString(OAuthCallbackResponse);\n\nconst stateMessage = Schema.fromJsonString(\n  Schema.Tuple([\n    Schema.Literal(\"effect-auth/oauth-state/v1\"),\n    OAuthModuleId,\n    OAuthSignInPolicy.fields.generation,\n    OAuthSignInBegin.fields.provider,\n    OAuthSignInBegin.fields.flowId,\n    Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)),\n  ]),\n);\n\nexport interface OAuthModule<Id extends string, Kind extends string, Claims> {\n  readonly moduleId: Id;\n  readonly kind: Kind;\n  readonly claims: Types.Invariant<Claims>;\n}\n\n/** Guest sign-in only. Durable flow/identity authority, configured protocol,\n * separate transaction encryption and request-binding signing are explicit Layers.\n * This installs no provider, database, registration or connected-token capability.\n */\nexport const makeOAuthMethod = <\n  const Id extends string,\n  const SessionId extends string,\n  Claims extends Schema.Codec<unknown, unknown, unknown, unknown>,\n>(\n  moduleId: Id,\n  options: {\n    readonly sessions: ReturnType<typeof makeSessionModule<SessionId, Claims>>;\n  },\n) => {\n  const sessions = options.sessions;\n  const binding = makeRequestBinding(moduleId, \"oauth-entry\");\n\n  const ClaimsForOAuth = Context.Service<\n    OAuthModule<Id, \"claims\", Claims[\"Type\"]>,\n    {\n      readonly resolve: (\n        credential: OAuthCredentialSnapshot,\n      ) => Effect.Effect<Claims[\"Type\"], OAuthUnavailable>;\n    }\n  >(`effect-auth/oauth/${moduleId.length}:${moduleId}/Claims`);\n\n  const CompletionResult = Schema.Union([\n    Schema.Struct({ completion: sessions.CompletionResult, returnTarget: OAuthReturnTarget }),\n    Schema.TaggedStruct(\"Cancelled\", { returnTarget: OAuthReturnTarget }),\n    OAuthRegistrationRequired,\n  ]);\n\n  type CompletionResult = typeof CompletionResult.Type;\n\n  const SignIn = Context.Service<\n    OAuthModule<Id, \"sign-in\", Claims[\"Type\"]>,\n    {\n      readonly begin: (\n        input: typeof OAuthSignInBegin.Type,\n      ) => Effect.Effect<AuthOperationResult<typeof OAuthSignInAuthorization.Type>, Failure>;\n      readonly complete: (\n        input: typeof OAuthSignInComplete.Type,\n      ) => Effect.Effect<AuthOperationResult<CompletionResult>, Failure>;\n    }\n  >(`effect-auth/oauth/${moduleId.length}:${moduleId}/SignIn`);\n\n  const makeSignInLayer = <R>(\n    configuration: OAuthSignInPolicy,\n    registrationSource: Effect.Effect<\n      | {\n          readonly settle: OAuthRegistrationIntents[\"Service\"][\"settle\"];\n          readonly policy: OAuthRegistrationPolicy;\n        }\n      | undefined,\n      OAuthConfigurationError,\n      R\n    >,\n  ) => {\n    let captured: OAuthSignInPolicy | undefined;\n\n    try {\n      captured = snapshotOAuthSync(OAuthSignInPolicy, configuration);\n    } catch {\n      /* Layer reports configuration failure */\n    }\n\n    return Layer.effect(\n      SignIn,\n      Effect.gen(function* () {\n        const id = yield* Schema.decodeEffect(OAuthModuleId)(moduleId).pipe(\n          Effect.mapError(() => OAuthConfigurationError.make({ reason: \"module\" })),\n        );\n\n        if (captured === undefined)\n          return yield* OAuthConfigurationError.make({ reason: \"policy\" });\n        const policy = captured;\n        const registration = yield* registrationSource;\n        const { issue: issueBinding, verify: verifyBinding } = yield* binding.RequestBinding;\n        const { prepareAuthorization, exchangeVerifiedIdentity } = yield* OAuthProtocol;\n        const { resolve: returnTarget } = yield* OAuthReturnTargets;\n        const { seal, open } = yield* OAuthTransactionProtector;\n        const { issue, claim, settle } = yield* OAuthSignInPersistence;\n        const { resolve: resolveClaims } = yield* ClaimsForOAuth;\n        const { prepare: completeAuthentication } = yield* sessions.AuthenticationCompletion;\n        const crypto = yield* Crypto.Crypto;\n        const { randomBytes, digest } = crypto;\n\n        const hash = Effect.fn(\"OAuth.hash\")(function* (message: string) {\n          const result = yield* digest(\"SHA-256\", encoder.encode(message)).pipe(\n            Effect.mapError(() => OAuthUnavailable.make({})),\n          );\n\n          return TokenDigest.make(Encoding.encodeBase64Url(result));\n        });\n\n        const stateDigest = Effect.fn(\"OAuth.stateDigest\")(function* (\n          flowId: typeof OAuthSignInBegin.Type.flowId,\n          provider: typeof OAuthSignInBegin.Type.provider,\n          state: Redacted.Redacted<string>,\n        ) {\n          const raw = Redacted.value(state);\n\n          if (!Schema.is(Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)))(raw))\n            return yield* OAuthRejected.make({});\n          const bytes = Result.getOrUndefined(Encoding.decodeBase64Url(raw));\n\n          if (\n            bytes === undefined ||\n            bytes.length !== 32 ||\n            Encoding.encodeBase64Url(bytes) !== raw\n          ) {\n            bytes?.fill(0);\n\n            return yield* OAuthRejected.make({});\n          }\n          bytes.fill(0);\n\n          const message = yield* Schema.encodeEffect(stateMessage)([\n            \"effect-auth/oauth-state/v1\",\n            id,\n            policy.generation,\n            provider,\n            flowId,\n            raw,\n          ]).pipe(Effect.mapError(() => OAuthUnavailable.make({})));\n\n          return yield* hash(message);\n        });\n\n        const binderError = (error: { readonly _tag: string }) =>\n          error._tag === \"RequestBindingInvalid\"\n            ? OAuthRejected.make({})\n            : OAuthUnavailable.make({});\n\n        const begin = Effect.fn(\"OAuth.SignIn.begin\")(\n          function* (raw: typeof OAuthSignInBegin.Type) {\n            yield* noAmbient();\n            const request = yield* snapshotOAuth(OAuthSignInBegin, raw);\n            const target = yield* returnTarget(request.returnTarget);\n\n            const canonicalTarget = yield* Schema.decodeEffect(OAuthReturnTarget)(target).pipe(\n              Effect.mapError(() => OAuthUnavailable.make({})),\n            );\n\n            const issuedBinding = yield* issueBinding(request.flowId).pipe(\n              Effect.mapError(binderError),\n            );\n\n            const original = issuedBinding.credentialCommands[0];\n\n            if (\n              issuedBinding.credentialCommands.length !== 1 ||\n              original?._tag !== \"Issue\" ||\n              original.slot !== \"request-binding\" ||\n              issuedBinding.value.flowId !== request.flowId ||\n              original.expiresAtMillis !== issuedBinding.value.expiresAtMillis\n            )\n              return yield* OAuthUnavailable.make({});\n\n            const command = Object.freeze({\n              _tag: \"Issue\" as const,\n              slot: \"request-binding\" as const,\n              credential: Redacted.make(Redacted.value(original.credential)),\n              expiresAtMillis: original.expiresAtMillis,\n            });\n\n            const binder = Object.freeze({\n              ...(yield* verifyBinding(\n                request.flowId,\n                Redacted.make(Redacted.value(command.credential)),\n              ).pipe(Effect.mapError(binderError))),\n            });\n\n            if (binder.expiresAtMillis !== command.expiresAtMillis)\n              return yield* OAuthUnavailable.make({});\n\n            const prepared = yield* prepareAuthorization(\n              Object.freeze({\n                provider: request.provider,\n                callbackId: request.callbackId,\n                flowId: request.flowId,\n              }),\n            ).pipe(Effect.flatMap((value) => snapshotOAuth(OAuthProtocolPreparation, value)));\n\n            if (\n              prepared.configuration.provider !== request.provider ||\n              prepared.configuration.callbackId !== request.callbackId ||\n              (prepared.configuration.protocol === \"oidc\") !==\n                (prepared.secrets.oidcNonce !== undefined)\n            )\n              return yield* OAuthUnavailable.make({});\n            const now = DateTime.toEpochMillis(yield* DateTime.now);\n            const expiresAtMillis = Math.min(now + policy.lifetimeMillis, binder.expiresAtMillis);\n\n            if (expiresAtMillis <= now) return yield* OAuthRejected.make({});\n\n            const context = yield* snapshotOAuth(OAuthSignInTransactionContext, {\n              namespace: \"effect-auth/oauth-sign-in-context/v1\",\n              moduleId: id,\n              generation: policy.generation,\n              flowId: request.flowId,\n              commandId: request.commandId,\n              ...prepared.configuration,\n              returnTarget: canonicalTarget,\n              stateDigest: yield* stateDigest(\n                request.flowId,\n                request.provider,\n                prepared.secrets.state,\n              ).pipe(Effect.mapError(() => OAuthUnavailable.make({}))),\n              requestBindingVerifier: binder.verifier,\n              requestBindingExpiresAtMillis: binder.expiresAtMillis,\n              issuedAtMillis: now,\n              expiresAtMillis,\n              claimLifetimeMillis: policy.claimLifetimeMillis,\n            });\n\n            const sealed = yield* seal({\n              context: snapshotOAuthSync(OAuthSignInTransactionContext, context),\n              secrets: snapshotOAuthSync(OAuthTransactionSecrets, prepared.secrets),\n            }).pipe(Effect.flatMap((value) => snapshotOAuth(OAuthSealedTransaction, value)));\n\n            const flow = snapshotOAuthSync(OAuthPendingFlow, {\n              context,\n              sealed,\n              retentionUntilMillis: expiresAtMillis + policy.retentionMillis,\n            });\n\n            const expected = Schema.encodeSync(flowJson)(flow);\n\n            type Issuance =\n              | { readonly _tag: \"Rejected\" }\n              | {\n                  readonly _tag: \"Issued\";\n                  readonly result: AuthOperationResult<typeof OAuthSignInAuthorization.Type>;\n                };\n\n            const receipt = yield* issue<Issuance>(\n              snapshotOAuthSync(OAuthPendingFlow, flow),\n              (decision, journal) => {\n                const checked = snapshotOAuthSync(OAuthIssueDecision, decision);\n\n                if (checked._tag === \"Rejected\")\n                  return journal.prepare({ _tag: \"Rejected\" as const });\n                if (Schema.encodeSync(flowJson)(checked.flow) !== expected)\n                  throw OAuthUnavailable.make({});\n\n                return journal.prepare({\n                  _tag: \"Issued\" as const,\n                  result: Object.freeze({\n                    value: Object.freeze({\n                      flowId: request.flowId,\n                      authorizationUrl: prepared.authorizationUrl,\n                      expiresAtMillis,\n                    }),\n                    credentialCommands: Object.freeze([command]),\n                  }),\n                });\n              },\n            );\n\n            const committed = yield* read(receipt);\n\n            if (committed._tag === \"Rejected\") return yield* OAuthRejected.make({});\n\n            return committed.result;\n          },\n          Effect.tapCause((cause) =>\n            Cause.hasDies(cause) ? reportAuthFailure(\"oauth-sign-in\", cause) : Effect.void,\n          ),\n          Effect.catchDefect(() => Effect.fail(OAuthUnavailable.make({}))),\n        );\n\n        const complete = Effect.fn(\"OAuth.SignIn.complete\")(\n          function* (raw: typeof OAuthSignInComplete.Type) {\n            yield* noAmbient();\n            const request = yield* snapshotOAuth(OAuthSignInComplete, raw);\n            const response = request.response;\n\n            const serialized = yield* Schema.encodeEffect(responseJson)(response).pipe(\n              Effect.mapError(() => OAuthRejected.make({})),\n            );\n\n            if (encoder.encode(serialized).length > 16384) return yield* OAuthRejected.make({});\n\n            const binder = Object.freeze({\n              ...(yield* verifyBinding(request.flowId, request.requestBinding).pipe(\n                Effect.mapError(binderError),\n              )),\n            });\n\n            const state = yield* stateDigest(request.flowId, request.provider, response.state);\n\n            const random = yield* randomBytes(32).pipe(\n              Effect.mapError(() => OAuthUnavailable.make({})),\n            );\n\n            const claimId = OAuthClaimId.make(Encoding.encodeBase64Url(random));\n\n            random.fill(0);\n\n            const input = Object.freeze({\n              moduleId: id,\n              generation: policy.generation,\n              flowId: request.flowId,\n              provider: request.provider,\n              callbackId: request.callbackId,\n              stateDigest: state,\n              requestBindingVerifier: binder.verifier,\n              requestBindingExpiresAtMillis: binder.expiresAtMillis,\n              claimId,\n              ...(response.issuer === undefined ? {} : { responseIssuer: response.issuer }),\n              nowMillis: DateTime.toEpochMillis(yield* DateTime.now),\n            });\n\n            const settled = yield* Effect.uninterruptibleMask((restore) =>\n              Effect.gen(function* () {\n                const receipt = yield* restore(\n                  claim(input, (decision, journal) =>\n                    journal.prepare(snapshotOAuthSync(OAuthClaimDecision, decision)),\n                  ),\n                );\n\n                const decision = yield* read(receipt);\n\n                if (decision._tag !== \"Claimed\") return yield* OAuthRejected.make({});\n                const owned = snapshotOAuthSync(OAuthClaim, decision.claim);\n                const context = owned.flow.context;\n\n                if (\n                  owned.claimId !== claimId ||\n                  context.moduleId !== id ||\n                  context.generation !== policy.generation ||\n                  context.flowId !== request.flowId ||\n                  context.provider !== request.provider ||\n                  context.callbackId !== request.callbackId ||\n                  context.stateDigest !== state ||\n                  context.requestBindingVerifier !== binder.verifier ||\n                  context.requestBindingExpiresAtMillis !== binder.expiresAtMillis ||\n                  owned.claimedAtMillis < context.issuedAtMillis ||\n                  owned.claimedAtMillis >= context.expiresAtMillis ||\n                  context.expiresAtMillis > context.requestBindingExpiresAtMillis ||\n                  owned.claimExpiresAtMillis !==\n                    owned.claimedAtMillis + context.claimLifetimeMillis ||\n                  owned.flow.retentionUntilMillis < owned.claimExpiresAtMillis ||\n                  (context.responseIssuerMode === \"required\"\n                    ? response.issuer !== context.issuer\n                    : response.issuer !== undefined)\n                )\n                  return yield* OAuthUnavailable.make({});\n                let verifiedAt = owned.claimedAtMillis;\n\n                const exchange = Effect.gen(function* () {\n                  const secrets = yield* open({\n                    context: snapshotOAuthSync(OAuthSignInTransactionContext, context),\n                    sealed: snapshotOAuthSync(OAuthSealedTransaction, owned.flow.sealed),\n                  }).pipe(Effect.flatMap((value) => snapshotOAuth(OAuthTransactionSecrets, value)));\n\n                  if (\n                    (context.protocol === \"oidc\") !== (secrets.oidcNonce !== undefined) ||\n                    (yield* stateDigest(context.flowId, context.provider, secrets.state)) !==\n                      context.stateDigest ||\n                    Redacted.value(secrets.state) !== Redacted.value(response.state)\n                  )\n                    return yield* OAuthUnavailable.make({});\n                  if (response._tag !== \"Code\") return yield* OAuthProtocolRejected.make({});\n                  const start = yield* DateTime.now;\n\n                  verifiedAt = DateTime.toEpochMillis(start);\n                  if (verifiedAt >= owned.claimExpiresAtMillis)\n                    return yield* OAuthUnavailable.make({});\n\n                  const identity = yield* exchangeVerifiedIdentity({\n                    configuration: snapshotOAuthSync(OAuthProtocolConfiguration, context),\n                    response: snapshotOAuthSync(OAuthCallbackResponse, response) as typeof response,\n                    secrets: snapshotOAuthSync(OAuthTransactionSecrets, secrets),\n                    verificationStartedAt: start,\n                  }).pipe(\n                    Effect.flatMap((value) => snapshotOAuth(OAuthVerifiedExternalIdentity, value)),\n                  );\n\n                  if (\n                    identity.identity.provider !== context.provider ||\n                    identity.identity.issuer !== context.issuer\n                  )\n                    return yield* OAuthProtocolRejected.make({});\n                  if (identity.upstreamAuthenticatedAt !== undefined)\n                    verifiedAt = Math.min(\n                      verifiedAt,\n                      DateTime.toEpochMillis(identity.upstreamAuthenticatedAt),\n                    );\n\n                  return identity;\n                });\n\n                const remaining = Math.max(\n                  1,\n                  owned.claimExpiresAtMillis - DateTime.toEpochMillis(yield* DateTime.now),\n                );\n\n                const exchanged =\n                  response._tag === \"Error\"\n                    ? undefined\n                    : yield* Effect.exit(restore(bounded(exchange, remaining)));\n\n                const definiteRejection =\n                  exchanged !== undefined &&\n                  Exit.isFailure(exchanged) &&\n                  exchanged.cause.reasons.length === 1 &&\n                  exchanged.cause.reasons[0]?._tag === \"Fail\" &&\n                  Schema.is(OAuthProtocolRejected)(exchanged.cause.reasons[0].error);\n\n                if (exchanged !== undefined && Exit.isFailure(exchanged) && !definiteRejection)\n                  yield* reportAuthFailure(\"oauth-exchange\", exchanged.cause);\n\n                let outcome =\n                  exchanged === undefined\n                    ? { _tag: \"Cancelled\" as const }\n                    : Exit.isSuccess(exchanged)\n                      ? { _tag: \"Verified\" as const, identity: exchanged.value }\n                      : definiteRejection\n                        ? { _tag: \"Rejected\" as const }\n                        : { _tag: \"Ambiguous\" as const };\n\n                let registrationPrepared: Effect.Success<\n                  ReturnType<typeof registrationSecrets.prepare>\n                >;\n\n                if (outcome._tag === \"Verified\" && registration !== undefined) {\n                  const prepared = yield* Effect.exit(\n                    bounded(\n                      registrationSecrets.prepare(\n                        owned,\n                        outcome.identity,\n                        verifiedAt,\n                        registration.policy,\n                      ),\n                      remaining,\n                    ),\n                  );\n\n                  if (Exit.isSuccess(prepared)) registrationPrepared = prepared.value;\n                  else {\n                    yield* reportAuthFailure(\"oauth-sign-in\", prepared.cause);\n                    outcome = { _tag: \"Ambiguous\" };\n                  }\n                }\n                const intentCodec = Schema.fromJsonString(OAuthRegistrationIntent);\n\n                const expectedIntent =\n                  registrationPrepared === undefined\n                    ? undefined\n                    : Schema.encodeSync(intentCodec)(registrationPrepared.intent);\n\n                const prepare: PrepareOAuthCommit<\n                  OAuthRegistrationSettlement,\n                  OAuthRegistrationSettlement\n                > = (value, journal) => {\n                  const result = snapshotOAuthSync(OAuthRegistrationSettlement, value);\n\n                  if (result._tag === \"RegistrationIssued\") {\n                    if (\n                      outcome._tag !== \"Verified\" ||\n                      expectedIntent === undefined ||\n                      Schema.encodeSync(intentCodec)(result.intent) !== expectedIntent\n                    )\n                      throw OAuthUnavailable.make({});\n                  } else if (result._tag !== \"Rejected\" && result._tag !== outcome._tag)\n                    throw OAuthUnavailable.make({});\n\n                  return journal.prepare(result);\n                };\n\n                const nowMillis = DateTime.toEpochMillis(yield* DateTime.now);\n\n                const commit =\n                  outcome._tag === \"Verified\" && registration !== undefined\n                    ? registration.settle(\n                        {\n                          claim: snapshotOAuthSync(OAuthClaim, owned),\n                          identity: snapshotOAuthSync(\n                            OAuthVerifiedExternalIdentity,\n                            outcome.identity,\n                          ),\n                          ...(registrationPrepared === undefined\n                            ? {}\n                            : {\n                                intent: snapshotOAuthSync(\n                                  OAuthRegistrationIntent,\n                                  registrationPrepared.intent,\n                                ),\n                              }),\n                          nowMillis,\n                        },\n                        prepare,\n                      )\n                    : settle(\n                        { claim: snapshotOAuthSync(OAuthClaim, owned), outcome, nowMillis },\n                        prepare,\n                      );\n\n                const finished = yield* bounded(commit, policy.settlementTimeoutMillis).pipe(\n                  Effect.flatMap(read),\n                  Effect.mapError(() => OAuthUnavailable.make({})),\n                );\n\n                return {\n                  finished,\n                  registrationCommand: registrationPrepared?.command,\n                  context,\n                  verifiedAt,\n                  identity: outcome._tag === \"Verified\" ? outcome.identity : undefined,\n                };\n              }),\n            );\n\n            const { finished, context, verifiedAt, identity, registrationCommand } = settled;\n\n            if (finished._tag === \"RegistrationIssued\") {\n              if (registrationCommand === undefined) return yield* OAuthUnavailable.make({});\n\n              return {\n                value: {\n                  _tag: \"RegistrationRequired\" as const,\n                  reference: finished.intent.reference,\n                  expiresAtMillis: finished.intent.expiresAtMillis,\n                  returnTarget: context.returnTarget,\n                },\n                credentialCommands: [registrationCommand],\n              };\n            }\n\n            if (finished._tag === \"Cancelled\")\n              return {\n                value: { _tag: \"Cancelled\" as const, returnTarget: context.returnTarget },\n                credentialCommands: [{ _tag: \"Clear\" as const, slot: \"request-binding\" as const }],\n              };\n            if (finished._tag === \"Ambiguous\") return yield* OAuthUnavailable.make({});\n            if (finished._tag !== \"Verified\" || identity === undefined)\n              return yield* OAuthRejected.make({});\n            const credential = snapshotOAuthSync(OAuthCredentialSnapshot, finished.credential);\n\n            if (\n              credential.moduleId !== id ||\n              credential.identity.provider !== identity.identity.provider ||\n              credential.identity.issuer !== identity.identity.issuer ||\n              credential.identity.subject !== identity.identity.subject ||\n              new Set(credential.revision.credentials.map((item) => item.credentialId)).size !==\n                credential.revision.credentials.length ||\n              !credential.revision.credentials.some(\n                (item) =>\n                  item.credentialId === credential.credentialId &&\n                  item.revision === credential.credentialRevision,\n              )\n            )\n              return yield* OAuthUnavailable.make({});\n\n            const bindingDigest = yield* hash(\n              yield* Schema.encodeEffect(contextJson)(context).pipe(\n                Effect.mapError(() => OAuthUnavailable.make({})),\n              ),\n            );\n\n            const claims = yield* resolveClaims(\n              snapshotOAuthSync(OAuthCredentialSnapshot, credential),\n            );\n\n            const established = yield* completeAuthentication({\n              claims,\n              evidence: {\n                revision: credential.revision,\n                flowId: AuthenticationFlowId.make(context.flowId),\n                bindingDigest,\n                proofs: [\n                  {\n                    method: context.protocol,\n                    credentialId: credential.credentialId,\n                    factors: [\"possession\"],\n                    userVerified: false,\n                    phishingResistant: false,\n                    verifiedAt: DateTime.makeUnsafe(verifiedAt),\n                  },\n                ],\n              },\n            }).pipe(\n              Effect.mapError((error) =>\n                error._tag === \"HookDenied\"\n                  ? error\n                  : error._tag === \"SessionUnavailable\"\n                    ? OAuthUnavailable.make({})\n                    : OAuthRejected.make({}),\n              ),\n              Effect.flatMap(read),\n            );\n\n            return {\n              value: { completion: established.value, returnTarget: context.returnTarget },\n              credentialCommands: [\n                ...established.credentialCommands,\n                { _tag: \"Clear\" as const, slot: \"request-binding\" as const },\n              ],\n            };\n          },\n          Effect.provideService(Crypto.Crypto, crypto),\n          Effect.tapCause((cause) =>\n            Cause.hasDies(cause) ? reportAuthFailure(\"oauth-sign-in\", cause) : Effect.void,\n          ),\n          Effect.catchDefect(() => Effect.fail(OAuthUnavailable.make({}))),\n        );\n\n        return SignIn.of({ begin, complete });\n      }),\n    );\n  };\n\n  const signInLayer = (configuration: OAuthSignInPolicy) =>\n    makeSignInLayer(configuration, Effect.succeed(undefined));\n\n  const registration = <Registration extends Schema.Codec<unknown, unknown, unknown, unknown>>(\n    codec: Registration,\n  ) => {\n    const capability = makeOAuthRegistration(moduleId, codec, binding);\n\n    const registrationSignInLayer = (\n      configuration: OAuthSignInPolicy,\n      registrationConfiguration: OAuthRegistrationPolicy,\n    ) => {\n      let captured: OAuthRegistrationPolicy | undefined;\n\n      try {\n        captured = snapshotOAuthSync(OAuthRegistrationPolicy, registrationConfiguration);\n      } catch {\n        /* Layer reports invalid policy. */\n      }\n\n      return makeSignInLayer(\n        configuration,\n        Effect.gen(function* () {\n          if (captured === undefined)\n            return yield* OAuthConfigurationError.make({ reason: \"policy\" });\n          const { settle } = yield* OAuthRegistrationIntents;\n\n          return { settle, policy: captured };\n        }),\n      );\n    };\n\n    return Object.freeze({\n      ...capability,\n      signInLayer: registrationSignInLayer,\n      strategy: makeAuthStrategy(\n        { register: capability.operations.Complete.invoke },\n        capability.handlersLayer.pipe(\n          Layer.provide(defaultLayer(capability.Registrations, capability.layer)),\n          Layer.provide(defaultLayer(binding.RequestBinding, binding.layer)),\n          Layer.provide([cryptoLayer, hooksLayer]),\n        ),\n      ),\n    });\n  };\n\n  const Begin = makeOperation(`${moduleId}/sign-in/begin`, {\n    payload: OAuthSignInBegin,\n    success: OAuthSignInAuthorization,\n    error: Failure,\n    access: \"any\",\n    exposure: \"public\",\n    replay: \"non-idempotent\",\n    credentials: true,\n  });\n\n  const Complete = makeOperation(`${moduleId}/sign-in/complete`, {\n    payload: OAuthSignInComplete,\n    success: CompletionResult,\n    error: Failure,\n    access: \"any\",\n    exposure: \"public\",\n    replay: \"single-use\",\n    credentials: true,\n  });\n\n  const handlersLayer = Layer.mergeAll(\n    Begin.credentialHandlerLayer(\n      Effect.fn(\"OAuth.Begin\")(function* (input) {\n        return yield* (yield* SignIn).begin(input);\n      }),\n    ),\n    Complete.credentialHandlerLayer(\n      Effect.fn(\"OAuth.Complete\")(function* (input) {\n        return yield* (yield* SignIn).complete(input);\n      }),\n    ),\n  );\n\n  const layer = (policy: OAuthSignInPolicy) =>\n    handlersLayer.pipe(\n      Layer.provide(defaultLayer(SignIn, signInLayer(policy))),\n      Layer.provide(defaultLayer(binding.RequestBinding, binding.layer)),\n      Layer.provide([cryptoLayer, hooksLayer]),\n    );\n\n  const accounts = (policy: OAuthAccountsPolicy) => {\n    const module = makeOAuthAccounts(moduleId, sessions, policy);\n\n    return Object.freeze({\n      ...module,\n      strategy: makeAuthStrategy(\n        {\n          linkAccount: module.operations.Link.Begin.invoke,\n          completeAccountLink: module.operations.Link.Complete.invoke,\n          unlinkAccount: module.operations.Unlink.invoke,\n        },\n        module.handlersLayer.pipe(\n          Layer.provide(defaultLayer(module.Accounts, module.layer)),\n          Layer.provide(defaultLayer(module.binding.RequestBinding, module.binding.layer)),\n          Layer.provide([cryptoLayer, hooksLayer]),\n        ),\n      ),\n    });\n  };\n\n  const connected = (policy: OAuthConnectedPolicy) => {\n    const module = makeOAuthConnected(moduleId, policy);\n\n    return Object.freeze({\n      ...module,\n      strategy: makeAuthStrategy(\n        {\n          connectAccount: module.operations.Begin.invoke,\n          completeAccountConnection: module.operations.Complete.invoke,\n          listAccountConnections: module.operations.List.invoke,\n          disconnectAccount: module.operations.Disconnect.invoke,\n        },\n        module.handlersLayer.pipe(\n          Layer.provide(defaultLayer(module.Connected, module.layer)),\n          Layer.provide(defaultLayer(module.binding.RequestBinding, module.binding.layer)),\n          Layer.provide([cryptoLayer, hooksLayer]),\n        ),\n      ),\n    });\n  };\n\n  return Object.freeze({\n    binding,\n    ClaimsForOAuth,\n    SignIn,\n    signInLayer,\n    layer,\n    registration,\n    accounts,\n    connected,\n    CompletionResult,\n    operations: Object.freeze({ Begin, Complete }),\n    handlersLayer,\n    group: operationGroup(Begin, Complete),\n  });\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAyEA,MAAM,UAAU,OAAO,MAAM;CAAC;CAAe;CAAkB;CAAwB;AAAU,CAAC;AAIlG,MAAM,YAAY,OAAO,GAAG,iBAAiB,CAAC,CAAC,aAAa;CAC1D,IAAI,OAAO,gBAAgB,OAAO,OAAO,uBAAuB,KAAK,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,QAAW,YACf,QAAQ,KAAK,KAAK,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC;AAEpE,MAAM,UAAU,IAAI,YAAY;AAIhC,MAAM,WAAoB,QAAgC,WACxD,OAAO,IAAI,aAAa;CACtB,MAAM,QAAQ,OAAO,OAAO,KAAK,OAAO,eAAe,OAAO,UAAU;CAExE,OAAO,OAAO,MAAM,KAAK,KAAK,CAAC,CAAC,KAC9B,OAAO,QAAQ,MAAM,GACrB,OAAO,SAAS,MAAM,UAAU,KAAK,CAAC,CAAC,KAAK,OAAO,YAAY,OAAO,MAAM,CAAC,CAC/E;AACF,CAAC;AAEH,MAAM,WAAW,OAAO,eAAe,gBAAgB;AACvD,MAAM,cAAc,OAAO,eAAe,6BAA6B;AACvE,MAAM,eAAe,OAAO,eAAe,qBAAqB;AAEhE,MAAM,eAAe,OAAO,eAC1B,OAAO,MAAM;CACX,OAAO,QAAQ,4BAA4B;CAC3C;CACA,kBAAkB,OAAO;CACzB,iBAAiB,OAAO;CACxB,iBAAiB,OAAO;CACxB,OAAO,OAAO,MAAM,OAAO,UAAU,qBAAqB,CAAC;AAC7D,CAAC,CACH;;;;;AAYA,MAAa,mBAKX,UACA,YAGG;CACH,MAAM,WAAW,QAAQ;CACzB,MAAM,UAAU,mBAAmB,UAAU,aAAa;CAE1D,MAAM,iBAAiB,QAAQ,QAO7B,qBAAqB,SAAS,OAAO,GAAG,SAAS,QAAQ;CAE3D,MAAM,mBAAmB,OAAO,MAAM;EACpC,OAAO,OAAO;GAAE,YAAY,SAAS;GAAkB,cAAc;EAAkB,CAAC;EACxF,OAAO,aAAa,aAAa,EAAE,cAAc,kBAAkB,CAAC;EACpE;CACF,CAAC;CAID,MAAM,SAAS,QAAQ,QAUrB,qBAAqB,SAAS,OAAO,GAAG,SAAS,QAAQ;CAE3D,MAAM,mBACJ,eACA,uBASG;EACH,IAAI;EAEJ,IAAI;GACF,WAAW,kBAAkB,mBAAmB,aAAa;EAC/D,QAAQ,CAER;EAEA,OAAO,MAAM,OACX,QACA,OAAO,IAAI,aAAa;GACtB,MAAM,KAAK,OAAO,OAAO,aAAa,aAAa,CAAC,CAAC,QAAQ,CAAC,CAAC,KAC7D,OAAO,eAAe,wBAAwB,KAAK,EAAE,QAAQ,SAAS,CAAC,CAAC,CAC1E;GAEA,IAAI,aAAa,KAAA,GACf,OAAO,OAAO,wBAAwB,KAAK,EAAE,QAAQ,SAAS,CAAC;GACjE,MAAM,SAAS;GACf,MAAM,eAAe,OAAO;GAC5B,MAAM,EAAE,OAAO,cAAc,QAAQ,kBAAkB,OAAO,QAAQ;GACtE,MAAM,EAAE,sBAAsB,6BAA6B,OAAO;GAClE,MAAM,EAAE,SAAS,iBAAiB,OAAO;GACzC,MAAM,EAAE,MAAM,SAAS,OAAO;GAC9B,MAAM,EAAE,OAAO,OAAO,WAAW,OAAO;GACxC,MAAM,EAAE,SAAS,kBAAkB,OAAO;GAC1C,MAAM,EAAE,SAAS,2BAA2B,OAAO,SAAS;GAC5D,MAAM,SAAS,OAAO,OAAO;GAC7B,MAAM,EAAE,aAAa,WAAW;GAEhC,MAAM,OAAO,OAAO,GAAG,YAAY,CAAC,CAAC,WAAW,SAAiB;IAC/D,MAAM,SAAS,OAAO,OAAO,WAAW,QAAQ,OAAO,OAAO,CAAC,CAAC,CAAC,KAC/D,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CACjD;IAEA,OAAO,YAAY,KAAK,SAAS,gBAAgB,MAAM,CAAC;GAC1D,CAAC;GAED,MAAM,cAAc,OAAO,GAAG,mBAAmB,CAAC,CAAC,WACjD,QACA,UACA,OACA;IACA,MAAM,MAAM,SAAS,MAAM,KAAK;IAEhC,IAAI,CAAC,OAAO,GAAG,OAAO,OAAO,MAAM,OAAO,UAAU,qBAAqB,CAAC,CAAC,CAAC,CAAC,GAAG,GAC9E,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;IACrC,MAAM,QAAQ,OAAO,eAAe,SAAS,gBAAgB,GAAG,CAAC;IAEjE,IACE,UAAU,KAAA,KACV,MAAM,WAAW,MACjB,SAAS,gBAAgB,KAAK,MAAM,KACpC;KACA,OAAO,KAAK,CAAC;KAEb,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;IACrC;IACA,MAAM,KAAK,CAAC;IAEZ,MAAM,UAAU,OAAO,OAAO,aAAa,YAAY,CAAC,CAAC;KACvD;KACA;KACA,OAAO;KACP;KACA;KACA;IACF,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC;IAExD,OAAO,OAAO,KAAK,OAAO;GAC5B,CAAC;GAED,MAAM,eAAe,UACnB,MAAM,SAAS,0BACX,cAAc,KAAK,CAAC,CAAC,IACrB,iBAAiB,KAAK,CAAC,CAAC;GAE9B,MAAM,QAAQ,OAAO,GAAG,oBAAoB,CAAC,CAC3C,WAAW,KAAmC;IAC5C,OAAO,UAAU;IACjB,MAAM,UAAU,OAAO,cAAc,kBAAkB,GAAG;IAC1D,MAAM,SAAS,OAAO,aAAa,QAAQ,YAAY;IAEvD,MAAM,kBAAkB,OAAO,OAAO,aAAa,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,KAC5E,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CACjD;IAEA,MAAM,gBAAgB,OAAO,aAAa,QAAQ,MAAM,CAAC,CAAC,KACxD,OAAO,SAAS,WAAW,CAC7B;IAEA,MAAM,WAAW,cAAc,mBAAmB;IAElD,IACE,cAAc,mBAAmB,WAAW,KAC5C,UAAU,SAAS,WACnB,SAAS,SAAS,qBAClB,cAAc,MAAM,WAAW,QAAQ,UACvC,SAAS,oBAAoB,cAAc,MAAM,iBAEjD,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IAExC,MAAM,UAAU,OAAO,OAAO;KAC5B,MAAM;KACN,MAAM;KACN,YAAY,SAAS,KAAK,SAAS,MAAM,SAAS,UAAU,CAAC;KAC7D,iBAAiB,SAAS;IAC5B,CAAC;IAED,MAAM,SAAS,OAAO,OAAO,EAC3B,GAAI,OAAO,cACT,QAAQ,QACR,SAAS,KAAK,SAAS,MAAM,QAAQ,UAAU,CAAC,CAClD,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC,EACrC,CAAC;IAED,IAAI,OAAO,oBAAoB,QAAQ,iBACrC,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IAExC,MAAM,WAAW,OAAO,qBACtB,OAAO,OAAO;KACZ,UAAU,QAAQ;KAClB,YAAY,QAAQ;KACpB,QAAQ,QAAQ;IAClB,CAAC,CACH,CAAC,CAAC,KAAK,OAAO,SAAS,UAAU,cAAc,0BAA0B,KAAK,CAAC,CAAC;IAEhF,IACE,SAAS,cAAc,aAAa,QAAQ,YAC5C,SAAS,cAAc,eAAe,QAAQ,cAC7C,SAAS,cAAc,aAAa,YAClC,SAAS,QAAQ,cAAc,KAAA,IAElC,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IACxC,MAAM,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG;IACtD,MAAM,kBAAkB,KAAK,IAAI,MAAM,OAAO,gBAAgB,OAAO,eAAe;IAEpF,IAAI,mBAAmB,KAAK,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;IAE/D,MAAM,UAAU,OAAO,cAAc,+BAA+B;KAClE,WAAW;KACX,UAAU;KACV,YAAY,OAAO;KACnB,QAAQ,QAAQ;KAChB,WAAW,QAAQ;KACnB,GAAG,SAAS;KACZ,cAAc;KACd,aAAa,OAAO,YAClB,QAAQ,QACR,QAAQ,UACR,SAAS,QAAQ,KACnB,CAAC,CAAC,KAAK,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC;KACvD,wBAAwB,OAAO;KAC/B,+BAA+B,OAAO;KACtC,gBAAgB;KAChB;KACA,qBAAqB,OAAO;IAC9B,CAAC;IAED,MAAM,SAAS,OAAO,KAAK;KACzB,SAAS,kBAAkB,+BAA+B,OAAO;KACjE,SAAS,kBAAkB,yBAAyB,SAAS,OAAO;IACtE,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,UAAU,cAAc,wBAAwB,KAAK,CAAC,CAAC;IAE/E,MAAM,OAAO,kBAAkB,kBAAkB;KAC/C;KACA;KACA,sBAAsB,kBAAkB,OAAO;IACjD,CAAC;IAED,MAAM,WAAW,OAAO,WAAW,QAAQ,CAAC,CAAC,IAAI;IASjD,MAAM,UAAU,OAAO,MACrB,kBAAkB,kBAAkB,IAAI,IACvC,UAAU,YAAY;KACrB,MAAM,UAAU,kBAAkB,oBAAoB,QAAQ;KAE9D,IAAI,QAAQ,SAAS,YACnB,OAAO,QAAQ,QAAQ,EAAE,MAAM,WAAoB,CAAC;KACtD,IAAI,OAAO,WAAW,QAAQ,CAAC,CAAC,QAAQ,IAAI,MAAM,UAChD,MAAM,iBAAiB,KAAK,CAAC,CAAC;KAEhC,OAAO,QAAQ,QAAQ;MACrB,MAAM;MACN,QAAQ,OAAO,OAAO;OACpB,OAAO,OAAO,OAAO;QACnB,QAAQ,QAAQ;QAChB,kBAAkB,SAAS;QAC3B;OACF,CAAC;OACD,oBAAoB,OAAO,OAAO,CAAC,OAAO,CAAC;MAC7C,CAAC;KACH,CAAC;IACH,CACF;IAEA,MAAM,YAAY,OAAO,KAAK,OAAO;IAErC,IAAI,UAAU,SAAS,YAAY,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;IAEtE,OAAO,UAAU;GACnB,GACA,OAAO,UAAU,UACf,MAAM,QAAQ,KAAK,IAAI,kBAAkB,iBAAiB,KAAK,IAAI,OAAO,IAC5E,GACA,OAAO,kBAAkB,OAAO,KAAK,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC,CACjE;GAEA,MAAM,WAAW,OAAO,GAAG,uBAAuB,CAAC,CACjD,WAAW,KAAsC;IAC/C,OAAO,UAAU;IACjB,MAAM,UAAU,OAAO,cAAc,qBAAqB,GAAG;IAC7D,MAAM,WAAW,QAAQ;IAEzB,MAAM,aAAa,OAAO,OAAO,aAAa,YAAY,CAAC,CAAC,QAAQ,CAAC,CAAC,KACpE,OAAO,eAAe,cAAc,KAAK,CAAC,CAAC,CAAC,CAC9C;IAEA,IAAI,QAAQ,OAAO,UAAU,CAAC,CAAC,SAAS,OAAO,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;IAElF,MAAM,SAAS,OAAO,OAAO,EAC3B,GAAI,OAAO,cAAc,QAAQ,QAAQ,QAAQ,cAAc,CAAC,CAAC,KAC/D,OAAO,SAAS,WAAW,CAC7B,EACF,CAAC;IAED,MAAM,QAAQ,OAAO,YAAY,QAAQ,QAAQ,QAAQ,UAAU,SAAS,KAAK;IAEjF,MAAM,SAAS,OAAO,YAAY,EAAE,CAAC,CAAC,KACpC,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CACjD;IAEA,MAAM,UAAU,aAAa,KAAK,SAAS,gBAAgB,MAAM,CAAC;IAElE,OAAO,KAAK,CAAC;IAEb,MAAM,QAAQ,OAAO,OAAO;KAC1B,UAAU;KACV,YAAY,OAAO;KACnB,QAAQ,QAAQ;KAChB,UAAU,QAAQ;KAClB,YAAY,QAAQ;KACpB,aAAa;KACb,wBAAwB,OAAO;KAC/B,+BAA+B,OAAO;KACtC;KACA,GAAI,SAAS,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,gBAAgB,SAAS,OAAO;KAC3E,WAAW,SAAS,cAAc,OAAO,SAAS,GAAG;IACvD,CAAC;IA2MD,MAAM,EAAE,UAAU,SAAS,YAAY,UAAU,wBAAwB,OAzMlD,OAAO,qBAAqB,YACjD,OAAO,IAAI,aAAa;KACtB,MAAM,UAAU,OAAO,QACrB,MAAM,QAAQ,UAAU,YACtB,QAAQ,QAAQ,kBAAkB,oBAAoB,QAAQ,CAAC,CACjE,CACF;KAEA,MAAM,WAAW,OAAO,KAAK,OAAO;KAEpC,IAAI,SAAS,SAAS,WAAW,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;KACpE,MAAM,QAAQ,kBAAkB,YAAY,SAAS,KAAK;KAC1D,MAAM,UAAU,MAAM,KAAK;KAE3B,IACE,MAAM,YAAY,WAClB,QAAQ,aAAa,MACrB,QAAQ,eAAe,OAAO,cAC9B,QAAQ,WAAW,QAAQ,UAC3B,QAAQ,aAAa,QAAQ,YAC7B,QAAQ,eAAe,QAAQ,cAC/B,QAAQ,gBAAgB,SACxB,QAAQ,2BAA2B,OAAO,YAC1C,QAAQ,kCAAkC,OAAO,mBACjD,MAAM,kBAAkB,QAAQ,kBAChC,MAAM,mBAAmB,QAAQ,mBACjC,QAAQ,kBAAkB,QAAQ,iCAClC,MAAM,yBACJ,MAAM,kBAAkB,QAAQ,uBAClC,MAAM,KAAK,uBAAuB,MAAM,yBACvC,QAAQ,uBAAuB,aAC5B,SAAS,WAAW,QAAQ,SAC5B,SAAS,WAAW,KAAA,IAExB,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;KACxC,IAAI,aAAa,MAAM;KAEvB,MAAM,WAAW,OAAO,IAAI,aAAa;MACvC,MAAM,UAAU,OAAO,KAAK;OAC1B,SAAS,kBAAkB,+BAA+B,OAAO;OACjE,QAAQ,kBAAkB,wBAAwB,MAAM,KAAK,MAAM;MACrE,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,UAAU,cAAc,yBAAyB,KAAK,CAAC,CAAC;MAEhF,IACG,QAAQ,aAAa,YAAa,QAAQ,cAAc,KAAA,OACxD,OAAO,YAAY,QAAQ,QAAQ,QAAQ,UAAU,QAAQ,KAAK,OACjE,QAAQ,eACV,SAAS,MAAM,QAAQ,KAAK,MAAM,SAAS,MAAM,SAAS,KAAK,GAE/D,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;MACxC,IAAI,SAAS,SAAS,QAAQ,OAAO,OAAO,sBAAsB,KAAK,CAAC,CAAC;MACzE,MAAM,QAAQ,OAAO,SAAS;MAE9B,aAAa,SAAS,cAAc,KAAK;MACzC,IAAI,cAAc,MAAM,sBACtB,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;MAExC,MAAM,WAAW,OAAO,yBAAyB;OAC/C,eAAe,kBAAkB,4BAA4B,OAAO;OACpE,UAAU,kBAAkB,uBAAuB,QAAQ;OAC3D,SAAS,kBAAkB,yBAAyB,OAAO;OAC3D,uBAAuB;MACzB,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,UAAU,cAAc,+BAA+B,KAAK,CAAC,CAC/E;MAEA,IACE,SAAS,SAAS,aAAa,QAAQ,YACvC,SAAS,SAAS,WAAW,QAAQ,QAErC,OAAO,OAAO,sBAAsB,KAAK,CAAC,CAAC;MAC7C,IAAI,SAAS,4BAA4B,KAAA,GACvC,aAAa,KAAK,IAChB,YACA,SAAS,cAAc,SAAS,uBAAuB,CACzD;MAEF,OAAO;KACT,CAAC;KAED,MAAM,YAAY,KAAK,IACrB,GACA,MAAM,uBAAuB,SAAS,cAAc,OAAO,SAAS,GAAG,CACzE;KAEA,MAAM,YACJ,SAAS,SAAS,UACd,KAAA,IACA,OAAO,OAAO,KAAK,QAAQ,QAAQ,UAAU,SAAS,CAAC,CAAC;KAE9D,MAAM,oBACJ,cAAc,KAAA,KACd,KAAK,UAAU,SAAS,KACxB,UAAU,MAAM,QAAQ,WAAW,KACnC,UAAU,MAAM,QAAQ,EAAE,EAAE,SAAS,UACrC,OAAO,GAAG,qBAAqB,CAAC,CAAC,UAAU,MAAM,QAAQ,EAAE,CAAC,KAAK;KAEnE,IAAI,cAAc,KAAA,KAAa,KAAK,UAAU,SAAS,KAAK,CAAC,mBAC3D,OAAO,kBAAkB,kBAAkB,UAAU,KAAK;KAE5D,IAAI,UACF,cAAc,KAAA,IACV,EAAE,MAAM,YAAqB,IAC7B,KAAK,UAAU,SAAS,IACtB;MAAE,MAAM;MAAqB,UAAU,UAAU;KAAM,IACvD,oBACE,EAAE,MAAM,WAAoB,IAC5B,EAAE,MAAM,YAAqB;KAEvC,IAAI;KAIJ,IAAI,QAAQ,SAAS,cAAc,iBAAiB,KAAA,GAAW;MAC7D,MAAM,WAAW,OAAO,OAAO,KAC7B,QACEA,QACE,OACA,QAAQ,UACR,YACA,aAAa,MACf,GACA,SACF,CACF;MAEA,IAAI,KAAK,UAAU,QAAQ,GAAG,uBAAuB,SAAS;WACzD;OACH,OAAO,kBAAkB,iBAAiB,SAAS,KAAK;OACxD,UAAU,EAAE,MAAM,YAAY;MAChC;KACF;KACA,MAAM,cAAc,OAAO,eAAe,uBAAuB;KAEjE,MAAM,iBACJ,yBAAyB,KAAA,IACrB,KAAA,IACA,OAAO,WAAW,WAAW,CAAC,CAAC,qBAAqB,MAAM;KAEhE,MAAMC,aAGD,OAAO,YAAY;MACtB,MAAM,SAAS,kBAAkB,6BAA6B,KAAK;MAEnE,IAAI,OAAO,SAAS,sBAEhB;WAAA,QAAQ,SAAS,cACjB,mBAAmB,KAAA,KACnB,OAAO,WAAW,WAAW,CAAC,CAAC,OAAO,MAAM,MAAM,gBAElD,MAAM,iBAAiB,KAAK,CAAC,CAAC;MAAA,OAC3B,IAAI,OAAO,SAAS,cAAc,OAAO,SAAS,QAAQ,MAC/D,MAAM,iBAAiB,KAAK,CAAC,CAAC;MAEhC,OAAO,QAAQ,QAAQ,MAAM;KAC/B;KAEA,MAAM,YAAY,SAAS,cAAc,OAAO,SAAS,GAAG;KAE5D,MAAM,SACJ,QAAQ,SAAS,cAAc,iBAAiB,KAAA,IAC5C,aAAa,OACX;MACE,OAAO,kBAAkB,YAAY,KAAK;MAC1C,UAAU,kBACR,+BACA,QAAQ,QACV;MACA,GAAI,yBAAyB,KAAA,IACzB,CAAC,IACD,EACE,QAAQ,kBACN,yBACA,qBAAqB,MACvB,EACF;MACJ;KACF,GACAA,SACF,IACA,OACE;MAAE,OAAO,kBAAkB,YAAY,KAAK;MAAG;MAAS;KAAU,GAClEA,SACF;KAON,OAAO;MACL,UAAA,OANsB,QAAQ,QAAQ,OAAO,uBAAuB,CAAC,CAAC,KACtE,OAAO,QAAQ,IAAI,GACnB,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CACjD;MAIE,qBAAqB,sBAAsB;MAC3C;MACA;MACA,UAAU,QAAQ,SAAS,aAAa,QAAQ,WAAW,KAAA;KAC7D;IACF,CAAC,CACH;IAIA,IAAI,SAAS,SAAS,sBAAsB;KAC1C,IAAI,wBAAwB,KAAA,GAAW,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;KAE7E,OAAO;MACL,OAAO;OACL,MAAM;OACN,WAAW,SAAS,OAAO;OAC3B,iBAAiB,SAAS,OAAO;OACjC,cAAc,QAAQ;MACxB;MACA,oBAAoB,CAAC,mBAAmB;KAC1C;IACF;IAEA,IAAI,SAAS,SAAS,aACpB,OAAO;KACL,OAAO;MAAE,MAAM;MAAsB,cAAc,QAAQ;KAAa;KACxE,oBAAoB,CAAC;MAAE,MAAM;MAAkB,MAAM;KAA2B,CAAC;IACnF;IACF,IAAI,SAAS,SAAS,aAAa,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IACzE,IAAI,SAAS,SAAS,cAAc,aAAa,KAAA,GAC/C,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;IACrC,MAAM,aAAa,kBAAkB,yBAAyB,SAAS,UAAU;IAEjF,IACE,WAAW,aAAa,MACxB,WAAW,SAAS,aAAa,SAAS,SAAS,YACnD,WAAW,SAAS,WAAW,SAAS,SAAS,UACjD,WAAW,SAAS,YAAY,SAAS,SAAS,WAClD,IAAI,IAAI,WAAW,SAAS,YAAY,KAAK,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,SACxE,WAAW,SAAS,YAAY,UAClC,CAAC,WAAW,SAAS,YAAY,MAC9B,SACC,KAAK,iBAAiB,WAAW,gBACjC,KAAK,aAAa,WAAW,kBACjC,GAEA,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IAExC,MAAM,gBAAgB,OAAO,KAC3B,OAAO,OAAO,aAAa,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,KAC/C,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CACjD,CACF;IAEA,MAAM,SAAS,OAAO,cACpB,kBAAkB,yBAAyB,UAAU,CACvD;IAEA,MAAM,cAAc,OAAO,uBAAuB;KAChD;KACA,UAAU;MACR,UAAU,WAAW;MACrB,QAAQ,qBAAqB,KAAK,QAAQ,MAAM;MAChD;MACA,QAAQ,CACN;OACE,QAAQ,QAAQ;OAChB,cAAc,WAAW;OACzB,SAAS,CAAC,YAAY;OACtB,cAAc;OACd,mBAAmB;OACnB,YAAY,SAAS,WAAW,UAAU;MAC5C,CACF;KACF;IACF,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,UACf,MAAM,SAAS,eACX,QACA,MAAM,SAAS,uBACb,iBAAiB,KAAK,CAAC,CAAC,IACxB,cAAc,KAAK,CAAC,CAAC,CAC7B,GACA,OAAO,QAAQ,IAAI,CACrB;IAEA,OAAO;KACL,OAAO;MAAE,YAAY,YAAY;MAAO,cAAc,QAAQ;KAAa;KAC3E,oBAAoB,CAClB,GAAG,YAAY,oBACf;MAAE,MAAM;MAAkB,MAAM;KAA2B,CAC7D;IACF;GACF,GACA,OAAO,eAAe,OAAO,QAAQ,MAAM,GAC3C,OAAO,UAAU,UACf,MAAM,QAAQ,KAAK,IAAI,kBAAkB,iBAAiB,KAAK,IAAI,OAAO,IAC5E,GACA,OAAO,kBAAkB,OAAO,KAAK,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC,CACjE;GAEA,OAAO,OAAO,GAAG;IAAE;IAAO;GAAS,CAAC;EACtC,CAAC,CACH;CACF;CAEA,MAAM,eAAe,kBACnB,gBAAgB,eAAe,OAAO,QAAQ,KAAA,CAAS,CAAC;CAE1D,MAAM,gBACJ,UACG;EACH,MAAM,aAAa,sBAAsB,UAAU,OAAO,OAAO;EAEjE,MAAM,2BACJ,eACA,8BACG;GACH,IAAI;GAEJ,IAAI;IACF,WAAW,kBAAkB,yBAAyB,yBAAyB;GACjF,QAAQ,CAER;GAEA,OAAO,gBACL,eACA,OAAO,IAAI,aAAa;IACtB,IAAI,aAAa,KAAA,GACf,OAAO,OAAO,wBAAwB,KAAK,EAAE,QAAQ,SAAS,CAAC;IACjE,MAAM,EAAE,WAAW,OAAO;IAE1B,OAAO;KAAE;KAAQ,QAAQ;IAAS;GACpC,CAAC,CACH;EACF;EAEA,OAAO,OAAO,OAAO;GACnB,GAAG;GACH,aAAa;GACb,UAAU,iBACR,EAAE,UAAU,WAAW,WAAW,SAAS,OAAO,GAClD,WAAW,cAAc,KACvB,MAAM,QAAQ,aAAa,WAAW,eAAe,WAAW,KAAK,CAAC,GACtE,MAAM,QAAQ,aAAa,QAAQ,gBAAgB,QAAQ,KAAK,CAAC,GACjE,MAAM,QAAQ,CAAC,aAAa,UAAU,CAAC,CACzC,CACF;EACF,CAAC;CACH;CAEA,MAAM,QAAQ,cAAc,GAAG,SAAS,iBAAiB;EACvD,SAAS;EACT,SAAS;EACT,OAAO;EACP,QAAQ;EACR,UAAU;EACV,QAAQ;EACR,aAAa;CACf,CAAC;CAED,MAAM,WAAW,cAAc,GAAG,SAAS,oBAAoB;EAC7D,SAAS;EACT,SAAS;EACT,OAAO;EACP,QAAQ;EACR,UAAU;EACV,QAAQ;EACR,aAAa;CACf,CAAC;CAED,MAAM,gBAAgB,MAAM,SAC1B,MAAM,uBACJ,OAAO,GAAG,aAAa,CAAC,CAAC,WAAW,OAAO;EACzC,OAAO,QAAQ,OAAO,OAAA,CAAQ,MAAM,KAAK;CAC3C,CAAC,CACH,GACA,SAAS,uBACP,OAAO,GAAG,gBAAgB,CAAC,CAAC,WAAW,OAAO;EAC5C,OAAO,QAAQ,OAAO,OAAA,CAAQ,SAAS,KAAK;CAC9C,CAAC,CACH,CACF;CAEA,MAAM,SAAS,WACb,cAAc,KACZ,MAAM,QAAQ,aAAa,QAAQ,YAAY,MAAM,CAAC,CAAC,GACvD,MAAM,QAAQ,aAAa,QAAQ,gBAAgB,QAAQ,KAAK,CAAC,GACjE,MAAM,QAAQ,CAAC,aAAa,UAAU,CAAC,CACzC;CAEF,MAAM,YAAY,WAAgC;EAChD,MAAM,SAAS,kBAAkB,UAAU,UAAU,MAAM;EAE3D,OAAO,OAAO,OAAO;GACnB,GAAG;GACH,UAAU,iBACR;IACE,aAAa,OAAO,WAAW,KAAK,MAAM;IAC1C,qBAAqB,OAAO,WAAW,KAAK,SAAS;IACrD,eAAe,OAAO,WAAW,OAAO;GAC1C,GACA,OAAO,cAAc,KACnB,MAAM,QAAQ,aAAa,OAAO,UAAU,OAAO,KAAK,CAAC,GACzD,MAAM,QAAQ,aAAa,OAAO,QAAQ,gBAAgB,OAAO,QAAQ,KAAK,CAAC,GAC/E,MAAM,QAAQ,CAAC,aAAa,UAAU,CAAC,CACzC,CACF;EACF,CAAC;CACH;CAEA,MAAM,aAAa,WAAiC;EAClD,MAAM,SAAS,mBAAmB,UAAU,MAAM;EAElD,OAAO,OAAO,OAAO;GACnB,GAAG;GACH,UAAU,iBACR;IACE,gBAAgB,OAAO,WAAW,MAAM;IACxC,2BAA2B,OAAO,WAAW,SAAS;IACtD,wBAAwB,OAAO,WAAW,KAAK;IAC/C,mBAAmB,OAAO,WAAW,WAAW;GAClD,GACA,OAAO,cAAc,KACnB,MAAM,QAAQ,aAAa,OAAO,WAAW,OAAO,KAAK,CAAC,GAC1D,MAAM,QAAQ,aAAa,OAAO,QAAQ,gBAAgB,OAAO,QAAQ,KAAK,CAAC,GAC/E,MAAM,QAAQ,CAAC,aAAa,UAAU,CAAC,CACzC,CACF;EACF,CAAC;CACH;CAEA,OAAO,OAAO,OAAO;EACnB;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,YAAY,OAAO,OAAO;GAAE;GAAO;EAAS,CAAC;EAC7C;EACA,OAAO,eAAe,OAAO,QAAQ;CACvC,CAAC;AACH"}

package/dist/oauth/signInSnapshot.mjs

@@ -0,0 +1,29 @@
+import { OAuthUnavailable } from "./signInErrors.mjs";
+import { DateTime, Effect, Predicate, Schema } from "effect";
+//#region src/oauth/signInSnapshot.ts
+/** Private, bounded codecs only. Project before callbacks, then freeze the entire
+* detached graph; never retain an application's mutable response object. */
+const freezeOAuth = (value) => {
+	if (!Predicate.isObjectOrArray(value) || Object.isFrozen(value)) return;
+	if (DateTime.isDateTime(value)) Object.freeze(DateTime.toPartsUtc(value));
+	for (const child of Object.values(value)) freezeOAuth(child);
+	Object.freeze(value);
+};
+const snapshotOAuthSync = (schema, value) => {
+	try {
+		const codec = Schema.toCodecJson(Schema.toType(schema));
+		const result = Schema.decodeSync(codec)(Schema.encodeSync(codec)(value));
+		freezeOAuth(result);
+		return result;
+	} catch {
+		throw OAuthUnavailable.make({});
+	}
+};
+const snapshotOAuth = (schema, value) => Effect.try({
+	try: () => snapshotOAuthSync(schema, value),
+	catch: () => OAuthUnavailable.make({})
+});
+//#endregion
+export { freezeOAuth, snapshotOAuth, snapshotOAuthSync };
+
+//# sourceMappingURL=signInSnapshot.mjs.map

package/dist/oauth/signInSnapshot.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"signInSnapshot.mjs","names":[],"sources":["../../src/oauth/signInSnapshot.ts"],"sourcesContent":["import { DateTime, Effect, Predicate, Schema } from \"effect\";\n\nimport { OAuthUnavailable } from \"./signInErrors\";\n\n/** Private, bounded codecs only. Project before callbacks, then freeze the entire\n * detached graph; never retain an application's mutable response object. */\nexport const freezeOAuth = (value: unknown): void => {\n  if (!Predicate.isObjectOrArray(value) || Object.isFrozen(value)) return;\n  if (DateTime.isDateTime(value)) Object.freeze(DateTime.toPartsUtc(value));\n  for (const child of Object.values(value)) freezeOAuth(child);\n  Object.freeze(value);\n};\n\nexport const snapshotOAuthSync = <S extends Schema.Codec<unknown, unknown, never, never>>(\n  schema: S,\n  value: S[\"Type\"],\n): S[\"Type\"] => {\n  try {\n    const codec = Schema.toCodecJson(Schema.toType(schema));\n    const result = Schema.decodeSync(codec)(Schema.encodeSync(codec)(value));\n\n    freezeOAuth(result);\n\n    return result;\n  } catch {\n    throw OAuthUnavailable.make({});\n  }\n};\n\nexport const snapshotOAuth = <S extends Schema.Codec<unknown, unknown, never, never>>(\n  schema: S,\n  value: S[\"Type\"],\n) =>\n  Effect.try({\n    try: () => snapshotOAuthSync(schema, value),\n    catch: () => OAuthUnavailable.make({}),\n  });\n"],"mappings":";;;;;AAMA,MAAa,eAAe,UAAyB;CACnD,IAAI,CAAC,UAAU,gBAAgB,KAAK,KAAK,OAAO,SAAS,KAAK,GAAG;CACjE,IAAI,SAAS,WAAW,KAAK,GAAG,OAAO,OAAO,SAAS,WAAW,KAAK,CAAC;CACxE,KAAK,MAAM,SAAS,OAAO,OAAO,KAAK,GAAG,YAAY,KAAK;CAC3D,OAAO,OAAO,KAAK;AACrB;AAEA,MAAa,qBACX,QACA,UACc;CACd,IAAI;EACF,MAAM,QAAQ,OAAO,YAAY,OAAO,OAAO,MAAM,CAAC;EACtD,MAAM,SAAS,OAAO,WAAW,KAAK,CAAC,CAAC,OAAO,WAAW,KAAK,CAAC,CAAC,KAAK,CAAC;EAEvE,YAAY,MAAM;EAElB,OAAO;CACT,QAAQ;EACN,MAAM,iBAAiB,KAAK,CAAC,CAAC;CAChC;AACF;AAEA,MAAa,iBACX,QACA,UAEA,OAAO,IAAI;CACT,WAAW,kBAAkB,QAAQ,KAAK;CAC1C,aAAa,iBAAiB,KAAK,CAAC,CAAC;AACvC,CAAC"}

package/dist/oauth/transactionEncryption.d.mts

@@ -0,0 +1,14 @@
+import "./signInErrors.mjs";
+import "./signInModels.mjs";
+import { Crypto, Effect, Redacted, Schema } from "effect";
+//#region src/oauth/transactionEncryption.d.ts
+interface OAuthTransactionKeyring {
+  readonly activeKeyId: string;
+  readonly keys: ReadonlyArray<{
+    readonly id: string;
+    readonly material: Redacted.Redacted<string>;
+  }>;
+}
+//#endregion
+export { OAuthTransactionKeyring };
+//# sourceMappingURL=transactionEncryption.d.mts.map