@yielded/auth 0.1.0-beta.3 → 0.1.0-beta.5

package/dist/oauth/registrationSecrets.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"registrationSecrets.mjs","names":[],"sources":["../../src/oauth/registrationSecrets.ts"],"sourcesContent":["import { Crypto, DateTime, Effect, Encoding, Redacted, Result, Schema } from \"effect\";\n\nimport { TokenDigest } from \"../Schema\";\nimport {\n  OAuthRegistrationIntent,\n  OAuthRegistrationReference,\n  type OAuthRegistrationPolicy,\n} from \"./registrationModels\";\nimport { OAuthRejected, OAuthUnavailable } from \"./signInErrors\";\nimport type { OAuthClaim, OAuthVerifiedExternalIdentity } from \"./signInModels\";\nimport { snapshotOAuthSync } from \"./signInSnapshot\";\n\nconst tuple = Schema.fromJsonString(\n  Schema.Tuple([\n    Schema.Literal(\"effect-auth/oauth-registration-bearer/v1\"),\n    OAuthRegistrationIntent.fields.context.fields.moduleId,\n    OAuthRegistrationReference,\n    OAuthRegistrationIntent.fields.context.fields.flowId,\n    Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)),\n  ]),\n);\n\nexport const credentialDigest = Effect.fn(\"OAuthRegistration.credentialDigest\")(function* (\n  moduleId: typeof OAuthRegistrationIntent.Type.context.moduleId,\n  reference: OAuthRegistrationReference,\n  flowId: typeof OAuthRegistrationIntent.Type.context.flowId,\n  credential: Redacted.Redacted<string>,\n) {\n  const { digest } = yield* Crypto.Crypto;\n  const raw = Redacted.value(credential);\n\n  if (!Schema.is(Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)))(raw))\n    return yield* OAuthRejected.make({});\n  const bytes = Result.getOrUndefined(Encoding.decodeBase64Url(raw));\n\n  if (\n    raw.length !== 43 ||\n    bytes === undefined ||\n    bytes.length !== 32 ||\n    Encoding.encodeBase64Url(bytes) !== raw\n  ) {\n    bytes?.fill(0);\n\n    return yield* OAuthRejected.make({});\n  }\n  bytes.fill(0);\n\n  const encoded = yield* Schema.encodeEffect(tuple)([\n    \"effect-auth/oauth-registration-bearer/v1\",\n    moduleId,\n    reference,\n    flowId,\n    raw,\n  ]).pipe(Effect.mapError(() => OAuthRejected.make({})));\n\n  const value = yield* digest(\"SHA-256\", new TextEncoder().encode(encoded)).pipe(\n    Effect.mapError(() => OAuthUnavailable.make({})),\n  );\n\n  return TokenDigest.make(Encoding.encodeBase64Url(value));\n});\n\nexport const prepare = Effect.fn(\"OAuthRegistration.prepareIntent\")(function* (\n  claim: OAuthClaim,\n  identity: OAuthVerifiedExternalIdentity,\n  verifiedAtMillis: number,\n  policy: OAuthRegistrationPolicy,\n) {\n  const { randomBytes } = yield* Crypto.Crypto;\n  const now = DateTime.toEpochMillis(yield* DateTime.now);\n\n  const expiresAtMillis = Math.min(\n    now + policy.lifetimeMillis,\n    claim.flow.context.requestBindingExpiresAtMillis,\n    verifiedAtMillis + policy.maximumVerificationAgeMillis,\n  );\n\n  if (expiresAtMillis <= now) return undefined;\n\n  const referenceBytes = yield* randomBytes(32).pipe(\n    Effect.mapError(() => OAuthUnavailable.make({})),\n  );\n\n  const reference = OAuthRegistrationReference.make(Encoding.encodeBase64Url(referenceBytes));\n\n  referenceBytes.fill(0);\n\n  const credentialBytes = yield* randomBytes(32).pipe(\n    Effect.mapError(() => OAuthUnavailable.make({})),\n  );\n\n  const credential = Redacted.make(Encoding.encodeBase64Url(credentialBytes));\n\n  credentialBytes.fill(0);\n\n  const intent = snapshotOAuthSync(OAuthRegistrationIntent, {\n    namespace: \"effect-auth/oauth-registration-intent/v1\",\n    reference,\n    context: claim.flow.context,\n    claimId: claim.claimId,\n    claimedAtMillis: claim.claimedAtMillis,\n    identity: identity.identity,\n    verifiedAtMillis,\n    credentialDigest: yield* credentialDigest(\n      claim.flow.context.moduleId,\n      reference,\n      claim.flow.context.flowId,\n      credential,\n    ),\n    issuedAtMillis: now,\n    expiresAtMillis,\n    retentionUntilMillis: Math.max(\n      claim.flow.retentionUntilMillis,\n      expiresAtMillis + policy.retentionMillis,\n    ),\n  });\n\n  return {\n    intent,\n    command: Object.freeze({\n      _tag: \"Issue\" as const,\n      slot: \"registration\" as const,\n      credential,\n      expiresAtMillis,\n    }),\n  };\n});\n"],"mappings":";;;;;;AAYA,MAAM,QAAQ,OAAO,eACnB,OAAO,MAAM;CACX,OAAO,QAAQ,0CAA0C;CACzD,wBAAwB,OAAO,QAAQ,OAAO;CAC9C;CACA,wBAAwB,OAAO,QAAQ,OAAO;CAC9C,OAAO,OAAO,MAAM,OAAO,UAAU,qBAAqB,CAAC;AAC7D,CAAC,CACH;AAEA,MAAa,mBAAmB,OAAO,GAAG,oCAAoC,CAAC,CAAC,WAC9E,UACA,WACA,QACA,YACA;CACA,MAAM,EAAE,WAAW,OAAO,OAAO;CACjC,MAAM,MAAM,SAAS,MAAM,UAAU;CAErC,IAAI,CAAC,OAAO,GAAG,OAAO,OAAO,MAAM,OAAO,UAAU,qBAAqB,CAAC,CAAC,CAAC,CAAC,GAAG,GAC9E,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;CACrC,MAAM,QAAQ,OAAO,eAAe,SAAS,gBAAgB,GAAG,CAAC;CAEjE,IACE,IAAI,WAAW,MACf,UAAU,KAAA,KACV,MAAM,WAAW,MACjB,SAAS,gBAAgB,KAAK,MAAM,KACpC;EACA,OAAO,KAAK,CAAC;EAEb,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;CACrC;CACA,MAAM,KAAK,CAAC;CAEZ,MAAM,UAAU,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC;EAChD;EACA;EACA;EACA;EACA;CACF,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC;CAErD,MAAM,QAAQ,OAAO,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,CAAC,KACxE,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CACjD;CAEA,OAAO,YAAY,KAAK,SAAS,gBAAgB,KAAK,CAAC;AACzD,CAAC;AAED,MAAa,UAAU,OAAO,GAAG,iCAAiC,CAAC,CAAC,WAClE,OACA,UACA,kBACA,QACA;CACA,MAAM,EAAE,gBAAgB,OAAO,OAAO;CACtC,MAAM,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG;CAEtD,MAAM,kBAAkB,KAAK,IAC3B,MAAM,OAAO,gBACb,MAAM,KAAK,QAAQ,+BACnB,mBAAmB,OAAO,4BAC5B;CAEA,IAAI,mBAAmB,KAAK,OAAO,KAAA;CAEnC,MAAM,iBAAiB,OAAO,YAAY,EAAE,CAAC,CAAC,KAC5C,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CACjD;CAEA,MAAM,YAAY,2BAA2B,KAAK,SAAS,gBAAgB,cAAc,CAAC;CAE1F,eAAe,KAAK,CAAC;CAErB,MAAM,kBAAkB,OAAO,YAAY,EAAE,CAAC,CAAC,KAC7C,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CACjD;CAEA,MAAM,aAAa,SAAS,KAAK,SAAS,gBAAgB,eAAe,CAAC;CAE1E,gBAAgB,KAAK,CAAC;CAwBtB,OAAO;EACL,QAvBa,kBAAkB,yBAAyB;GACxD,WAAW;GACX;GACA,SAAS,MAAM,KAAK;GACpB,SAAS,MAAM;GACf,iBAAiB,MAAM;GACvB,UAAU,SAAS;GACnB;GACA,kBAAkB,OAAO,iBACvB,MAAM,KAAK,QAAQ,UACnB,WACA,MAAM,KAAK,QAAQ,QACnB,UACF;GACA,gBAAgB;GAChB;GACA,sBAAsB,KAAK,IACzB,MAAM,KAAK,sBACX,kBAAkB,OAAO,eAC3B;EACF,CAGO;EACL,SAAS,OAAO,OAAO;GACrB,MAAM;GACN,MAAM;GACN;GACA;EACF,CAAC;CACH;AACF,CAAC"}
+{"version":3,"file":"registrationSecrets.mjs","names":[],"sources":["../../src/oauth/registrationSecrets.ts"],"sourcesContent":["import { Crypto, DateTime, Effect, Encoding, Redacted, Result, Schema } from \"effect\";\n\nimport { TokenDigest } from \"../Schema\";\nimport {\n  OAuthRegistrationIntent,\n  OAuthRegistrationReference,\n  type OAuthRegistrationPolicy,\n} from \"./registrationModels\";\nimport { OAuthRejected, OAuthUnavailable } from \"./signInErrors\";\nimport type { OAuthClaim, OAuthVerifiedExternalIdentity } from \"./signInModels\";\nimport { snapshotOAuthSync } from \"./signInSnapshot\";\n\nconst tuple = Schema.fromJsonString(\n  Schema.Tuple([\n    Schema.Literal(\"effect-auth/oauth-registration-bearer/v1\"),\n    OAuthRegistrationIntent.fields.context.fields.moduleId,\n    OAuthRegistrationReference,\n    OAuthRegistrationIntent.fields.context.fields.flowId,\n    Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)),\n  ]),\n);\n\nexport const credentialDigest = Effect.fn(\"OAuthRegistration.credentialDigest\")(function* (\n  moduleId: typeof OAuthRegistrationIntent.Type.context.moduleId,\n  reference: OAuthRegistrationReference,\n  flowId: typeof OAuthRegistrationIntent.Type.context.flowId,\n  credential: Redacted.Redacted<string>,\n) {\n  const { digest } = yield* Crypto.Crypto;\n  const raw = Redacted.value(credential);\n\n  if (!Schema.is(Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)))(raw))\n    return yield* OAuthRejected.make({});\n  const bytes = Result.getOrUndefined(Encoding.decodeBase64Url(raw));\n\n  if (\n    raw.length !== 43 ||\n    bytes === undefined ||\n    bytes.length !== 32 ||\n    Encoding.encodeBase64Url(bytes) !== raw\n  ) {\n    bytes?.fill(0);\n\n    return yield* OAuthRejected.make({});\n  }\n  bytes.fill(0);\n\n  const encoded = yield* Schema.encodeEffect(tuple)([\n    \"effect-auth/oauth-registration-bearer/v1\",\n    moduleId,\n    reference,\n    flowId,\n    raw,\n  ]).pipe(Effect.mapError(() => OAuthRejected.make({})));\n\n  const value = yield* digest(\"SHA-256\", new TextEncoder().encode(encoded)).pipe(\n    Effect.mapError(() => OAuthUnavailable.make({})),\n  );\n\n  return TokenDigest.make(Encoding.encodeBase64Url(value));\n});\n\nexport const prepare = Effect.fn(\"OAuthRegistration.prepareIntent\")(function* (\n  claim: OAuthClaim,\n  identity: OAuthVerifiedExternalIdentity,\n  verifiedAtMillis: number,\n  policy: OAuthRegistrationPolicy,\n) {\n  const { randomBytes } = yield* Crypto.Crypto;\n  const now = DateTime.toEpochMillis(yield* DateTime.now);\n\n  const expiresAtMillis = Math.min(\n    now + policy.lifetimeMillis,\n    claim.flow.context.requestBindingExpiresAtMillis,\n    verifiedAtMillis + policy.maximumVerificationAgeMillis,\n  );\n\n  if (expiresAtMillis <= now) return undefined;\n\n  const referenceBytes = yield* randomBytes(32).pipe(\n    Effect.mapError(() => OAuthUnavailable.make({})),\n  );\n\n  const reference = OAuthRegistrationReference.make(Encoding.encodeBase64Url(referenceBytes));\n\n  referenceBytes.fill(0);\n\n  const credentialBytes = yield* randomBytes(32).pipe(\n    Effect.mapError(() => OAuthUnavailable.make({})),\n  );\n\n  const credential = Redacted.make(Encoding.encodeBase64Url(credentialBytes));\n\n  credentialBytes.fill(0);\n\n  const intent = snapshotOAuthSync(OAuthRegistrationIntent, {\n    namespace: \"effect-auth/oauth-registration-intent/v1\",\n    reference,\n    context: claim.flow.context,\n    claimId: claim.claimId,\n    claimedAtMillis: claim.claimedAtMillis,\n    identity: identity.identity,\n    ...(identity.profile === undefined ? {} : { profile: identity.profile }),\n    verifiedAtMillis,\n    credentialDigest: yield* credentialDigest(\n      claim.flow.context.moduleId,\n      reference,\n      claim.flow.context.flowId,\n      credential,\n    ),\n    issuedAtMillis: now,\n    expiresAtMillis,\n    retentionUntilMillis: Math.max(\n      claim.flow.retentionUntilMillis,\n      expiresAtMillis + policy.retentionMillis,\n    ),\n  });\n\n  return {\n    intent,\n    command: Object.freeze({\n      _tag: \"Issue\" as const,\n      slot: \"registration\" as const,\n      credential,\n      expiresAtMillis,\n    }),\n  };\n});\n"],"mappings":";;;;;;AAYA,MAAM,QAAQ,OAAO,eACnB,OAAO,MAAM;CACX,OAAO,QAAQ,0CAA0C;CACzD,wBAAwB,OAAO,QAAQ,OAAO;CAC9C;CACA,wBAAwB,OAAO,QAAQ,OAAO;CAC9C,OAAO,OAAO,MAAM,OAAO,UAAU,qBAAqB,CAAC;AAC7D,CAAC,CACH;AAEA,MAAa,mBAAmB,OAAO,GAAG,oCAAoC,CAAC,CAAC,WAC9E,UACA,WACA,QACA,YACA;CACA,MAAM,EAAE,WAAW,OAAO,OAAO;CACjC,MAAM,MAAM,SAAS,MAAM,UAAU;CAErC,IAAI,CAAC,OAAO,GAAG,OAAO,OAAO,MAAM,OAAO,UAAU,qBAAqB,CAAC,CAAC,CAAC,CAAC,GAAG,GAC9E,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;CACrC,MAAM,QAAQ,OAAO,eAAe,SAAS,gBAAgB,GAAG,CAAC;CAEjE,IACE,IAAI,WAAW,MACf,UAAU,KAAA,KACV,MAAM,WAAW,MACjB,SAAS,gBAAgB,KAAK,MAAM,KACpC;EACA,OAAO,KAAK,CAAC;EAEb,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;CACrC;CACA,MAAM,KAAK,CAAC;CAEZ,MAAM,UAAU,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC;EAChD;EACA;EACA;EACA;EACA;CACF,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC;CAErD,MAAM,QAAQ,OAAO,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,CAAC,KACxE,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CACjD;CAEA,OAAO,YAAY,KAAK,SAAS,gBAAgB,KAAK,CAAC;AACzD,CAAC;AAED,MAAa,UAAU,OAAO,GAAG,iCAAiC,CAAC,CAAC,WAClE,OACA,UACA,kBACA,QACA;CACA,MAAM,EAAE,gBAAgB,OAAO,OAAO;CACtC,MAAM,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG;CAEtD,MAAM,kBAAkB,KAAK,IAC3B,MAAM,OAAO,gBACb,MAAM,KAAK,QAAQ,+BACnB,mBAAmB,OAAO,4BAC5B;CAEA,IAAI,mBAAmB,KAAK,OAAO,KAAA;CAEnC,MAAM,iBAAiB,OAAO,YAAY,EAAE,CAAC,CAAC,KAC5C,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CACjD;CAEA,MAAM,YAAY,2BAA2B,KAAK,SAAS,gBAAgB,cAAc,CAAC;CAE1F,eAAe,KAAK,CAAC;CAErB,MAAM,kBAAkB,OAAO,YAAY,EAAE,CAAC,CAAC,KAC7C,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CACjD;CAEA,MAAM,aAAa,SAAS,KAAK,SAAS,gBAAgB,eAAe,CAAC;CAE1E,gBAAgB,KAAK,CAAC;CAyBtB,OAAO;EACL,QAxBa,kBAAkB,yBAAyB;GACxD,WAAW;GACX;GACA,SAAS,MAAM,KAAK;GACpB,SAAS,MAAM;GACf,iBAAiB,MAAM;GACvB,UAAU,SAAS;GACnB,GAAI,SAAS,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,SAAS,QAAQ;GACtE;GACA,kBAAkB,OAAO,iBACvB,MAAM,KAAK,QAAQ,UACnB,WACA,MAAM,KAAK,QAAQ,QACnB,UACF;GACA,gBAAgB;GAChB;GACA,sBAAsB,KAAK,IACzB,MAAM,KAAK,sBACX,kBAAkB,OAAO,eAC3B;EACF,CAGO;EACL,SAAS,OAAO,OAAO;GACrB,MAAM;GACN,MAAM;GACN;GACA;EACF,CAAC;CACH;AACF,CAAC"}

package/dist/oauth/signInModels.d.mts

@@ -82,10 +82,21 @@ declare const OAuthExternalIdentity: Schema.Struct<{
   readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
   readonly subject: Schema.NonEmptyString;
 }>;
+/** Provider-supplied metadata, never local identity or linking authority. Adapters
+ * project identity responses into this bounded JSON snapshot; tokens and protocol
+ * secrets do not belong here. Applications select their own public session claims. */
 declare const OAuthDisplayProfile: Schema.Struct<{
   readonly displayName: Schema.optionalKey<Schema.String>;
   readonly handle: Schema.optionalKey<Schema.String>;
+  readonly avatarUrl: Schema.optionalKey<Schema.String>;
+  readonly profileUrl: Schema.optionalKey<Schema.String>;
+  readonly email: Schema.optionalKey<Schema.String>;
+  readonly emailVerified: Schema.optionalKey<Schema.Boolean>;
+  /** Provider-specific fields. Use the provider's exported profile Schema to
+   * decode them. Availability follows the existing provider permissions. */
+  readonly providerData: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
 }>;
+type OAuthDisplayProfile = typeof OAuthDisplayProfile.Type;
 declare const OAuthVerifiedExternalIdentity: Schema.Struct<{
   readonly identity: Schema.Struct<{
     readonly provider: Schema.brand<Schema.String, "effect-auth/OAuthProviderKey">;
@@ -96,6 +107,13 @@ declare const OAuthVerifiedExternalIdentity: Schema.Struct<{
   readonly profile: Schema.optionalKey<Schema.Struct<{
     readonly displayName: Schema.optionalKey<Schema.String>;
     readonly handle: Schema.optionalKey<Schema.String>;
+    readonly avatarUrl: Schema.optionalKey<Schema.String>;
+    readonly profileUrl: Schema.optionalKey<Schema.String>;
+    readonly email: Schema.optionalKey<Schema.String>;
+    readonly emailVerified: Schema.optionalKey<Schema.Boolean>;
+    /** Provider-specific fields. Use the provider's exported profile Schema to
+     * decode them. Availability follows the existing provider permissions. */
+    readonly providerData: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
   }>>;
 }>;
 type OAuthVerifiedExternalIdentity = typeof OAuthVerifiedExternalIdentity.Type;

package/dist/oauth/signInModels.mjs

@@ -73,9 +73,19 @@ const OAuthExternalIdentity = Schema.Struct({
 	issuer: OAuthIssuer,
 	subject: Schema.NonEmptyString.check(Schema.isMaxLength(1024))
 });
+/** Provider-supplied metadata, never local identity or linking authority. Adapters
+* project identity responses into this bounded JSON snapshot; tokens and protocol
+* secrets do not belong here. Applications select their own public session claims. */
 const OAuthDisplayProfile = Schema.Struct({
 	displayName: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(256))),
-	handle: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(256)))
+	handle: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(256))),
+	avatarUrl: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(2048))),
+	profileUrl: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(2048))),
+	email: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(320))),
+	emailVerified: Schema.optionalKey(Schema.Boolean),
+	/** Provider-specific fields. Use the provider's exported profile Schema to
+	* decode them. Availability follows the existing provider permissions. */
+	providerData: Schema.optionalKey(Schema.JsonObject.check(Schema.makeFilter((value) => new TextEncoder().encode(JSON.stringify(value)).length <= 65536)))
 });
 const OAuthVerifiedExternalIdentity = Schema.Struct({
 	identity: OAuthExternalIdentity,

package/dist/oauth/signInModels.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"signInModels.mjs","names":[],"sources":["../../src/oauth/signInModels.ts"],"sourcesContent":["import { Schema } from \"effect\";\n\nimport { RequestBindingCredential, RequestBindingFlowId } from \"../operations/requestBinding\";\nimport { SubjectId, TokenDigest } from \"../Schema\";\nimport { SecurityRevision } from \"../sessions/models\";\nimport { OAuthProviderKey } from \"./schema\";\n\nconst label = (maximum: number) =>\n  Schema.String.check(Schema.isPattern(new RegExp(`^[A-Za-z0-9._:/-]{1,${maximum}}$`)));\n\nexport const OAuthModuleId = label(128).pipe(Schema.brand(\"effect-auth/OAuthModuleId\"));\nexport const OAuthCommandId = label(256).pipe(Schema.brand(\"effect-auth/OAuthCommandId\"));\nexport const OAuthCallbackId = label(128).pipe(Schema.brand(\"effect-auth/OAuthCallbackId\"));\n\nexport const OAuthClaimId = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)).pipe(\n  Schema.brand(\"effect-auth/OAuthClaimId\"),\n);\n\nexport const OAuthGeneration = Schema.Int.check(\n  Schema.isBetween({ minimum: 1, maximum: Number.MAX_SAFE_INTEGER }),\n);\n\nexport const OAuthInstant = Schema.Int.check(\n  Schema.isBetween({ minimum: 0, maximum: Number.MAX_SAFE_INTEGER }),\n);\n\nexport const OAuthIssuer = Schema.String.check(\n  Schema.isMinLength(1),\n  Schema.isMaxLength(2048),\n  // oxlint-disable-next-line no-control-regex -- URI boundaries reject control characters.\n  Schema.isPattern(/^[^\\s\\\\\\u0000-\\u001f\\u007f]+$/),\n).pipe(Schema.brand(\"effect-auth/OAuthIssuer\"));\n\nexport const OAuthRedirectUri = Schema.String.check(\n  Schema.isMinLength(1),\n  Schema.isMaxLength(2048),\n  // oxlint-disable-next-line no-control-regex -- URI boundaries reject control characters.\n  Schema.isPattern(/^[^\\s\\\\\\u0000-\\u001f\\u007f#]+$/),\n).pipe(Schema.brand(\"effect-auth/OAuthRedirectUri\"));\n\nexport const OAuthReturnTarget = Schema.String.check(\n  Schema.isMaxLength(2048),\n  Schema.isPattern(/^\\/(?!\\/)[A-Za-z0-9/_-]*$/),\n).pipe(Schema.brand(\"effect-auth/OAuthReturnTarget\"));\n\nexport const OAuthProtocolKind = Schema.Literals([\"oidc\", \"oauth\"]);\n\nexport const OAuthProtocolConfiguration = Schema.Struct({\n  provider: OAuthProviderKey,\n  protocol: OAuthProtocolKind,\n  configurationGeneration: OAuthGeneration,\n  issuer: OAuthIssuer,\n  responseIssuerMode: Schema.Literals([\"required\", \"unsupported\"]),\n  callbackId: OAuthCallbackId,\n  redirectUri: OAuthRedirectUri,\n});\n\nexport type OAuthProtocolConfiguration = typeof OAuthProtocolConfiguration.Type;\n\nexport const OAuthSignInTransactionContext = Schema.Struct({\n  namespace: Schema.Literal(\"effect-auth/oauth-sign-in-context/v1\"),\n  moduleId: OAuthModuleId,\n  generation: OAuthGeneration,\n  flowId: RequestBindingFlowId,\n  commandId: OAuthCommandId,\n  ...OAuthProtocolConfiguration.fields,\n  returnTarget: OAuthReturnTarget,\n  stateDigest: TokenDigest.check(Schema.isMaxLength(43), Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)),\n  requestBindingVerifier: TokenDigest.check(\n    Schema.isMaxLength(43),\n    Schema.isPattern(/^[A-Za-z0-9_-]{43}$/),\n  ),\n  requestBindingExpiresAtMillis: OAuthInstant,\n  issuedAtMillis: OAuthInstant,\n  expiresAtMillis: OAuthInstant,\n  claimLifetimeMillis: Schema.Int.check(Schema.isBetween({ minimum: 1000, maximum: 120000 })),\n});\n\nexport type OAuthSignInTransactionContext = typeof OAuthSignInTransactionContext.Type;\n\nconst randomSecret = Schema.RedactedFromValue(\n  Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)),\n);\n\nexport const OAuthTransactionSecrets = Schema.Struct({\n  namespace: Schema.Literal(\"effect-auth/oauth-transaction-secrets/v1\"),\n  state: randomSecret,\n  pkceVerifier: Schema.RedactedFromValue(\n    Schema.String.check(Schema.isPattern(/^[A-Za-z0-9._~-]{43,128}$/)),\n  ),\n  oidcNonce: Schema.optionalKey(randomSecret),\n});\n\nexport type OAuthTransactionSecrets = typeof OAuthTransactionSecrets.Type;\nexport const OAuthEncryptionKeyId = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{1,64}$/));\n\nexport const OAuthSealedTransaction = Schema.Struct({\n  format: Schema.Literal(\"oauth-xchacha20poly1305-v1\"),\n  keyId: OAuthEncryptionKeyId,\n  nonce: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{32}$/)),\n  ciphertext: Schema.RedactedFromValue(\n    Schema.String.check(\n      Schema.isMinLength(22),\n      Schema.isMaxLength(21867),\n      Schema.isPattern(/^[A-Za-z0-9_-]+$/),\n    ),\n  ),\n});\n\nexport type OAuthSealedTransaction = typeof OAuthSealedTransaction.Type;\n\nexport const OAuthAuthorizationUrl = Schema.RedactedFromValue(\n  Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(16384)),\n);\n\nexport const OAuthProtocolPreparation = Schema.Struct({\n  configuration: OAuthProtocolConfiguration,\n  authorizationUrl: OAuthAuthorizationUrl,\n  secrets: OAuthTransactionSecrets,\n});\n\nexport type OAuthProtocolPreparation = typeof OAuthProtocolPreparation.Type;\n\nexport const OAuthExternalIdentity = Schema.Struct({\n  provider: OAuthProviderKey,\n  issuer: OAuthIssuer,\n  subject: Schema.NonEmptyString.check(Schema.isMaxLength(1024)),\n});\n\nexport const OAuthDisplayProfile = Schema.Struct({\n  displayName: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(256))),\n  handle: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(256))),\n});\n\nexport const OAuthVerifiedExternalIdentity = Schema.Struct({\n  identity: OAuthExternalIdentity,\n  upstreamAuthenticatedAt: Schema.optionalKey(Schema.DateTimeUtcFromMillis),\n  profile: Schema.optionalKey(OAuthDisplayProfile),\n});\n\nexport type OAuthVerifiedExternalIdentity = typeof OAuthVerifiedExternalIdentity.Type;\n\nexport const OAuthCredentialSnapshot = Schema.Struct({\n  moduleId: OAuthModuleId,\n  identity: OAuthExternalIdentity,\n  credentialId: Schema.NonEmptyString.check(Schema.isMaxLength(256)),\n  credentialRevision: SecurityRevision.check(Schema.isMaxLength(256)),\n  revision: Schema.Struct({\n    subjectId: SubjectId.check(Schema.isMaxLength(256)),\n    securityRevision: SecurityRevision.check(Schema.isMaxLength(256)),\n    credentials: Schema.Array(\n      Schema.Struct({\n        credentialId: Schema.NonEmptyString.check(Schema.isMaxLength(256)),\n        revision: SecurityRevision.check(Schema.isMaxLength(256)),\n      }),\n    ).check(Schema.isMinLength(1), Schema.isMaxLength(64)),\n  }),\n});\n\nexport type OAuthCredentialSnapshot = typeof OAuthCredentialSnapshot.Type;\n\nexport const OAuthPendingFlow = Schema.Struct({\n  context: OAuthSignInTransactionContext,\n  sealed: OAuthSealedTransaction,\n  retentionUntilMillis: OAuthInstant,\n});\n\nexport type OAuthPendingFlow = typeof OAuthPendingFlow.Type;\n\nexport const OAuthClaim = Schema.Struct({\n  flow: OAuthPendingFlow,\n  claimId: OAuthClaimId,\n  claimedAtMillis: OAuthInstant,\n  claimExpiresAtMillis: OAuthInstant,\n});\n\nexport type OAuthClaim = typeof OAuthClaim.Type;\n\nexport const OAuthIssueDecision = Schema.Union([\n  Schema.TaggedStruct(\"Issued\", { flow: OAuthPendingFlow }),\n  Schema.TaggedStruct(\"Rejected\", {}),\n]);\n\nexport type OAuthIssueDecision = typeof OAuthIssueDecision.Type;\n\nexport const OAuthClaimDecision = Schema.Union([\n  Schema.TaggedStruct(\"Claimed\", { claim: OAuthClaim }),\n  Schema.TaggedStruct(\"Rejected\", {}),\n]);\n\nexport type OAuthClaimDecision = typeof OAuthClaimDecision.Type;\n\nexport const OAuthSettlementDecision = Schema.Union([\n  Schema.TaggedStruct(\"Verified\", { credential: OAuthCredentialSnapshot }),\n  Schema.TaggedStruct(\"Cancelled\", {}),\n  Schema.TaggedStruct(\"Rejected\", {}),\n  Schema.TaggedStruct(\"Ambiguous\", {}),\n]);\n\nexport type OAuthSettlementDecision = typeof OAuthSettlementDecision.Type;\n\nconst responseBase = {\n  state: Schema.RedactedFromValue(\n    Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(2048)),\n  ),\n  issuer: Schema.optionalKey(OAuthIssuer),\n};\n\nexport const OAuthCodeResponse = Schema.TaggedStruct(\"Code\", {\n  ...responseBase,\n  code: Schema.RedactedFromValue(\n    Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(4096)),\n  ),\n  error: Schema.optionalKey(Schema.Never),\n});\n\nexport type OAuthCodeResponse = typeof OAuthCodeResponse.Type;\n\nexport const OAuthCallbackResponse = Schema.Union([\n  OAuthCodeResponse,\n  Schema.TaggedStruct(\"Error\", {\n    ...responseBase,\n    error: Schema.Literals([\"access-denied\", \"rejected\"]),\n    code: Schema.optionalKey(Schema.Never),\n  }),\n]);\n\nexport const OAuthSignInBegin = Schema.Struct({\n  flowId: RequestBindingFlowId,\n  commandId: OAuthCommandId,\n  provider: OAuthProviderKey,\n  callbackId: OAuthCallbackId,\n  returnTarget: Schema.String.check(Schema.isMaxLength(2048)),\n});\n\nexport const OAuthSignInComplete = Schema.Struct({\n  flowId: RequestBindingFlowId,\n  provider: OAuthProviderKey,\n  callbackId: OAuthCallbackId,\n  requestBinding: RequestBindingCredential,\n  response: OAuthCallbackResponse,\n});\n\nexport const OAuthSignInAuthorization = Schema.Struct({\n  flowId: RequestBindingFlowId,\n  authorizationUrl: OAuthAuthorizationUrl,\n  expiresAtMillis: OAuthInstant,\n});\n\nexport const OAuthSignInPolicy = Schema.Struct({\n  generation: OAuthGeneration,\n  lifetimeMillis: Schema.Int.check(Schema.isBetween({ minimum: 1000, maximum: 1800000 })),\n  claimLifetimeMillis: Schema.Int.check(Schema.isBetween({ minimum: 1000, maximum: 120000 })),\n  settlementTimeoutMillis: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 30000 })),\n  retentionMillis: Schema.Int.check(Schema.isBetween({ minimum: 120000, maximum: 2592000000 })),\n});\n\nexport type OAuthSignInPolicy = typeof OAuthSignInPolicy.Type;\n\nexport const OAuthCleanupInput = Schema.Struct({\n  moduleId: OAuthModuleId,\n  limit: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 1000 })),\n  nowMillis: OAuthInstant,\n});\n\nexport type OAuthCleanupInput = typeof OAuthCleanupInput.Type;\n"],"mappings":";;;;;;AAOA,MAAM,SAAS,YACb,OAAO,OAAO,MAAM,OAAO,UAAU,IAAI,OAAO,uBAAuB,QAAQ,GAAG,CAAC,CAAC;AAEtF,MAAa,gBAAgB,MAAM,GAAG,CAAC,CAAC,KAAK,OAAO,MAAM,2BAA2B,CAAC;AACtF,MAAa,iBAAiB,MAAM,GAAG,CAAC,CAAC,KAAK,OAAO,MAAM,4BAA4B,CAAC;AACxF,MAAa,kBAAkB,MAAM,GAAG,CAAC,CAAC,KAAK,OAAO,MAAM,6BAA6B,CAAC;AAE1F,MAAa,eAAe,OAAO,OAAO,MAAM,OAAO,UAAU,qBAAqB,CAAC,CAAC,CAAC,KACvF,OAAO,MAAM,0BAA0B,CACzC;AAEA,MAAa,kBAAkB,OAAO,IAAI,MACxC,OAAO,UAAU;CAAE,SAAS;CAAG,SAAS,OAAO;AAAiB,CAAC,CACnE;AAEA,MAAa,eAAe,OAAO,IAAI,MACrC,OAAO,UAAU;CAAE,SAAS;CAAG,SAAS,OAAO;AAAiB,CAAC,CACnE;AAEA,MAAa,cAAc,OAAO,OAAO,MACvC,OAAO,YAAY,CAAC,GACpB,OAAO,YAAY,IAAI,GAEvB,OAAO,UAAU,+BAA+B,CAClD,CAAC,CAAC,KAAK,OAAO,MAAM,yBAAyB,CAAC;AAE9C,MAAa,mBAAmB,OAAO,OAAO,MAC5C,OAAO,YAAY,CAAC,GACpB,OAAO,YAAY,IAAI,GAEvB,OAAO,UAAU,gCAAgC,CACnD,CAAC,CAAC,KAAK,OAAO,MAAM,8BAA8B,CAAC;AAEnD,MAAa,oBAAoB,OAAO,OAAO,MAC7C,OAAO,YAAY,IAAI,GACvB,OAAO,UAAU,2BAA2B,CAC9C,CAAC,CAAC,KAAK,OAAO,MAAM,+BAA+B,CAAC;AAEpD,MAAa,oBAAoB,OAAO,SAAS,CAAC,QAAQ,OAAO,CAAC;AAElE,MAAa,6BAA6B,OAAO,OAAO;CACtD,UAAU;CACV,UAAU;CACV,yBAAyB;CACzB,QAAQ;CACR,oBAAoB,OAAO,SAAS,CAAC,YAAY,aAAa,CAAC;CAC/D,YAAY;CACZ,aAAa;AACf,CAAC;AAID,MAAa,gCAAgC,OAAO,OAAO;CACzD,WAAW,OAAO,QAAQ,sCAAsC;CAChE,UAAU;CACV,YAAY;CACZ,QAAQ;CACR,WAAW;CACX,GAAG,2BAA2B;CAC9B,cAAc;CACd,aAAa,YAAY,MAAM,OAAO,YAAY,EAAE,GAAG,OAAO,UAAU,qBAAqB,CAAC;CAC9F,wBAAwB,YAAY,MAClC,OAAO,YAAY,EAAE,GACrB,OAAO,UAAU,qBAAqB,CACxC;CACA,+BAA+B;CAC/B,gBAAgB;CAChB,iBAAiB;CACjB,qBAAqB,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAM,SAAS;CAAO,CAAC,CAAC;AAC5F,CAAC;AAID,MAAM,eAAe,OAAO,kBAC1B,OAAO,OAAO,MAAM,OAAO,UAAU,qBAAqB,CAAC,CAC7D;AAEA,MAAa,0BAA0B,OAAO,OAAO;CACnD,WAAW,OAAO,QAAQ,0CAA0C;CACpE,OAAO;CACP,cAAc,OAAO,kBACnB,OAAO,OAAO,MAAM,OAAO,UAAU,2BAA2B,CAAC,CACnE;CACA,WAAW,OAAO,YAAY,YAAY;AAC5C,CAAC;AAGD,MAAa,uBAAuB,OAAO,OAAO,MAAM,OAAO,UAAU,uBAAuB,CAAC;AAEjG,MAAa,yBAAyB,OAAO,OAAO;CAClD,QAAQ,OAAO,QAAQ,4BAA4B;CACnD,OAAO;CACP,OAAO,OAAO,OAAO,MAAM,OAAO,UAAU,qBAAqB,CAAC;CAClE,YAAY,OAAO,kBACjB,OAAO,OAAO,MACZ,OAAO,YAAY,EAAE,GACrB,OAAO,YAAY,KAAK,GACxB,OAAO,UAAU,kBAAkB,CACrC,CACF;AACF,CAAC;AAID,MAAa,wBAAwB,OAAO,kBAC1C,OAAO,OAAO,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,KAAK,CAAC,CACtE;AAEA,MAAa,2BAA2B,OAAO,OAAO;CACpD,eAAe;CACf,kBAAkB;CAClB,SAAS;AACX,CAAC;AAID,MAAa,wBAAwB,OAAO,OAAO;CACjD,UAAU;CACV,QAAQ;CACR,SAAS,OAAO,eAAe,MAAM,OAAO,YAAY,IAAI,CAAC;AAC/D,CAAC;AAED,MAAa,sBAAsB,OAAO,OAAO;CAC/C,aAAa,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC;CAC5E,QAAQ,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC;AACzE,CAAC;AAED,MAAa,gCAAgC,OAAO,OAAO;CACzD,UAAU;CACV,yBAAyB,OAAO,YAAY,OAAO,qBAAqB;CACxE,SAAS,OAAO,YAAY,mBAAmB;AACjD,CAAC;AAID,MAAa,0BAA0B,OAAO,OAAO;CACnD,UAAU;CACV,UAAU;CACV,cAAc,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC;CACjE,oBAAoB,iBAAiB,MAAM,OAAO,YAAY,GAAG,CAAC;CAClE,UAAU,OAAO,OAAO;EACtB,WAAW,UAAU,MAAM,OAAO,YAAY,GAAG,CAAC;EAClD,kBAAkB,iBAAiB,MAAM,OAAO,YAAY,GAAG,CAAC;EAChE,aAAa,OAAO,MAClB,OAAO,OAAO;GACZ,cAAc,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC;GACjE,UAAU,iBAAiB,MAAM,OAAO,YAAY,GAAG,CAAC;EAC1D,CAAC,CACH,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,EAAE,CAAC;CACvD,CAAC;AACH,CAAC;AAID,MAAa,mBAAmB,OAAO,OAAO;CAC5C,SAAS;CACT,QAAQ;CACR,sBAAsB;AACxB,CAAC;AAID,MAAa,aAAa,OAAO,OAAO;CACtC,MAAM;CACN,SAAS;CACT,iBAAiB;CACjB,sBAAsB;AACxB,CAAC;AAID,MAAa,qBAAqB,OAAO,MAAM,CAC7C,OAAO,aAAa,UAAU,EAAE,MAAM,iBAAiB,CAAC,GACxD,OAAO,aAAa,YAAY,CAAC,CAAC,CACpC,CAAC;AAID,MAAa,qBAAqB,OAAO,MAAM,CAC7C,OAAO,aAAa,WAAW,EAAE,OAAO,WAAW,CAAC,GACpD,OAAO,aAAa,YAAY,CAAC,CAAC,CACpC,CAAC;AAID,MAAa,0BAA0B,OAAO,MAAM;CAClD,OAAO,aAAa,YAAY,EAAE,YAAY,wBAAwB,CAAC;CACvE,OAAO,aAAa,aAAa,CAAC,CAAC;CACnC,OAAO,aAAa,YAAY,CAAC,CAAC;CAClC,OAAO,aAAa,aAAa,CAAC,CAAC;AACrC,CAAC;AAID,MAAM,eAAe;CACnB,OAAO,OAAO,kBACZ,OAAO,OAAO,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,IAAI,CAAC,CACrE;CACA,QAAQ,OAAO,YAAY,WAAW;AACxC;AAEA,MAAa,oBAAoB,OAAO,aAAa,QAAQ;CAC3D,GAAG;CACH,MAAM,OAAO,kBACX,OAAO,OAAO,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,IAAI,CAAC,CACrE;CACA,OAAO,OAAO,YAAY,OAAO,KAAK;AACxC,CAAC;AAID,MAAa,wBAAwB,OAAO,MAAM,CAChD,mBACA,OAAO,aAAa,SAAS;CAC3B,GAAG;CACH,OAAO,OAAO,SAAS,CAAC,iBAAiB,UAAU,CAAC;CACpD,MAAM,OAAO,YAAY,OAAO,KAAK;AACvC,CAAC,CACH,CAAC;AAED,MAAa,mBAAmB,OAAO,OAAO;CAC5C,QAAQ;CACR,WAAW;CACX,UAAU;CACV,YAAY;CACZ,cAAc,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC;AAC5D,CAAC;AAED,MAAa,sBAAsB,OAAO,OAAO;CAC/C,QAAQ;CACR,UAAU;CACV,YAAY;CACZ,gBAAgB;CAChB,UAAU;AACZ,CAAC;AAED,MAAa,2BAA2B,OAAO,OAAO;CACpD,QAAQ;CACR,kBAAkB;CAClB,iBAAiB;AACnB,CAAC;AAED,MAAa,oBAAoB,OAAO,OAAO;CAC7C,YAAY;CACZ,gBAAgB,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAM,SAAS;CAAQ,CAAC,CAAC;CACtF,qBAAqB,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAM,SAAS;CAAO,CAAC,CAAC;CAC1F,yBAAyB,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAM,CAAC,CAAC;CAC1F,iBAAiB,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAQ,SAAS;CAAW,CAAC,CAAC;AAC9F,CAAC;AAID,MAAa,oBAAoB,OAAO,OAAO;CAC7C,UAAU;CACV,OAAO,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAK,CAAC,CAAC;CACvE,WAAW;AACb,CAAC"}
+{"version":3,"file":"signInModels.mjs","names":[],"sources":["../../src/oauth/signInModels.ts"],"sourcesContent":["import { Schema } from \"effect\";\n\nimport { RequestBindingCredential, RequestBindingFlowId } from \"../operations/requestBinding\";\nimport { SubjectId, TokenDigest } from \"../Schema\";\nimport { SecurityRevision } from \"../sessions/models\";\nimport { OAuthProviderKey } from \"./schema\";\n\nconst label = (maximum: number) =>\n  Schema.String.check(Schema.isPattern(new RegExp(`^[A-Za-z0-9._:/-]{1,${maximum}}$`)));\n\nexport const OAuthModuleId = label(128).pipe(Schema.brand(\"effect-auth/OAuthModuleId\"));\nexport const OAuthCommandId = label(256).pipe(Schema.brand(\"effect-auth/OAuthCommandId\"));\nexport const OAuthCallbackId = label(128).pipe(Schema.brand(\"effect-auth/OAuthCallbackId\"));\n\nexport const OAuthClaimId = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)).pipe(\n  Schema.brand(\"effect-auth/OAuthClaimId\"),\n);\n\nexport const OAuthGeneration = Schema.Int.check(\n  Schema.isBetween({ minimum: 1, maximum: Number.MAX_SAFE_INTEGER }),\n);\n\nexport const OAuthInstant = Schema.Int.check(\n  Schema.isBetween({ minimum: 0, maximum: Number.MAX_SAFE_INTEGER }),\n);\n\nexport const OAuthIssuer = Schema.String.check(\n  Schema.isMinLength(1),\n  Schema.isMaxLength(2048),\n  // oxlint-disable-next-line no-control-regex -- URI boundaries reject control characters.\n  Schema.isPattern(/^[^\\s\\\\\\u0000-\\u001f\\u007f]+$/),\n).pipe(Schema.brand(\"effect-auth/OAuthIssuer\"));\n\nexport const OAuthRedirectUri = Schema.String.check(\n  Schema.isMinLength(1),\n  Schema.isMaxLength(2048),\n  // oxlint-disable-next-line no-control-regex -- URI boundaries reject control characters.\n  Schema.isPattern(/^[^\\s\\\\\\u0000-\\u001f\\u007f#]+$/),\n).pipe(Schema.brand(\"effect-auth/OAuthRedirectUri\"));\n\nexport const OAuthReturnTarget = Schema.String.check(\n  Schema.isMaxLength(2048),\n  Schema.isPattern(/^\\/(?!\\/)[A-Za-z0-9/_-]*$/),\n).pipe(Schema.brand(\"effect-auth/OAuthReturnTarget\"));\n\nexport const OAuthProtocolKind = Schema.Literals([\"oidc\", \"oauth\"]);\n\nexport const OAuthProtocolConfiguration = Schema.Struct({\n  provider: OAuthProviderKey,\n  protocol: OAuthProtocolKind,\n  configurationGeneration: OAuthGeneration,\n  issuer: OAuthIssuer,\n  responseIssuerMode: Schema.Literals([\"required\", \"unsupported\"]),\n  callbackId: OAuthCallbackId,\n  redirectUri: OAuthRedirectUri,\n});\n\nexport type OAuthProtocolConfiguration = typeof OAuthProtocolConfiguration.Type;\n\nexport const OAuthSignInTransactionContext = Schema.Struct({\n  namespace: Schema.Literal(\"effect-auth/oauth-sign-in-context/v1\"),\n  moduleId: OAuthModuleId,\n  generation: OAuthGeneration,\n  flowId: RequestBindingFlowId,\n  commandId: OAuthCommandId,\n  ...OAuthProtocolConfiguration.fields,\n  returnTarget: OAuthReturnTarget,\n  stateDigest: TokenDigest.check(Schema.isMaxLength(43), Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)),\n  requestBindingVerifier: TokenDigest.check(\n    Schema.isMaxLength(43),\n    Schema.isPattern(/^[A-Za-z0-9_-]{43}$/),\n  ),\n  requestBindingExpiresAtMillis: OAuthInstant,\n  issuedAtMillis: OAuthInstant,\n  expiresAtMillis: OAuthInstant,\n  claimLifetimeMillis: Schema.Int.check(Schema.isBetween({ minimum: 1000, maximum: 120000 })),\n});\n\nexport type OAuthSignInTransactionContext = typeof OAuthSignInTransactionContext.Type;\n\nconst randomSecret = Schema.RedactedFromValue(\n  Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)),\n);\n\nexport const OAuthTransactionSecrets = Schema.Struct({\n  namespace: Schema.Literal(\"effect-auth/oauth-transaction-secrets/v1\"),\n  state: randomSecret,\n  pkceVerifier: Schema.RedactedFromValue(\n    Schema.String.check(Schema.isPattern(/^[A-Za-z0-9._~-]{43,128}$/)),\n  ),\n  oidcNonce: Schema.optionalKey(randomSecret),\n});\n\nexport type OAuthTransactionSecrets = typeof OAuthTransactionSecrets.Type;\nexport const OAuthEncryptionKeyId = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{1,64}$/));\n\nexport const OAuthSealedTransaction = Schema.Struct({\n  format: Schema.Literal(\"oauth-xchacha20poly1305-v1\"),\n  keyId: OAuthEncryptionKeyId,\n  nonce: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{32}$/)),\n  ciphertext: Schema.RedactedFromValue(\n    Schema.String.check(\n      Schema.isMinLength(22),\n      Schema.isMaxLength(21867),\n      Schema.isPattern(/^[A-Za-z0-9_-]+$/),\n    ),\n  ),\n});\n\nexport type OAuthSealedTransaction = typeof OAuthSealedTransaction.Type;\n\nexport const OAuthAuthorizationUrl = Schema.RedactedFromValue(\n  Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(16384)),\n);\n\nexport const OAuthProtocolPreparation = Schema.Struct({\n  configuration: OAuthProtocolConfiguration,\n  authorizationUrl: OAuthAuthorizationUrl,\n  secrets: OAuthTransactionSecrets,\n});\n\nexport type OAuthProtocolPreparation = typeof OAuthProtocolPreparation.Type;\n\nexport const OAuthExternalIdentity = Schema.Struct({\n  provider: OAuthProviderKey,\n  issuer: OAuthIssuer,\n  subject: Schema.NonEmptyString.check(Schema.isMaxLength(1024)),\n});\n\n/** Provider-supplied metadata, never local identity or linking authority. Adapters\n * project identity responses into this bounded JSON snapshot; tokens and protocol\n * secrets do not belong here. Applications select their own public session claims. */\nexport const OAuthDisplayProfile = Schema.Struct({\n  displayName: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(256))),\n  handle: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(256))),\n  avatarUrl: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(2048))),\n  profileUrl: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(2048))),\n  email: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(320))),\n  emailVerified: Schema.optionalKey(Schema.Boolean),\n  /** Provider-specific fields. Use the provider's exported profile Schema to\n   * decode them. Availability follows the existing provider permissions. */\n  providerData: Schema.optionalKey(\n    Schema.JsonObject.check(\n      Schema.makeFilter(\n        (value) => new TextEncoder().encode(JSON.stringify(value)).length <= 65_536,\n      ),\n    ),\n  ),\n});\n\nexport type OAuthDisplayProfile = typeof OAuthDisplayProfile.Type;\n\nexport const OAuthVerifiedExternalIdentity = Schema.Struct({\n  identity: OAuthExternalIdentity,\n  upstreamAuthenticatedAt: Schema.optionalKey(Schema.DateTimeUtcFromMillis),\n  profile: Schema.optionalKey(OAuthDisplayProfile),\n});\n\nexport type OAuthVerifiedExternalIdentity = typeof OAuthVerifiedExternalIdentity.Type;\n\nexport const OAuthCredentialSnapshot = Schema.Struct({\n  moduleId: OAuthModuleId,\n  identity: OAuthExternalIdentity,\n  credentialId: Schema.NonEmptyString.check(Schema.isMaxLength(256)),\n  credentialRevision: SecurityRevision.check(Schema.isMaxLength(256)),\n  revision: Schema.Struct({\n    subjectId: SubjectId.check(Schema.isMaxLength(256)),\n    securityRevision: SecurityRevision.check(Schema.isMaxLength(256)),\n    credentials: Schema.Array(\n      Schema.Struct({\n        credentialId: Schema.NonEmptyString.check(Schema.isMaxLength(256)),\n        revision: SecurityRevision.check(Schema.isMaxLength(256)),\n      }),\n    ).check(Schema.isMinLength(1), Schema.isMaxLength(64)),\n  }),\n});\n\nexport type OAuthCredentialSnapshot = typeof OAuthCredentialSnapshot.Type;\n\nexport const OAuthPendingFlow = Schema.Struct({\n  context: OAuthSignInTransactionContext,\n  sealed: OAuthSealedTransaction,\n  retentionUntilMillis: OAuthInstant,\n});\n\nexport type OAuthPendingFlow = typeof OAuthPendingFlow.Type;\n\nexport const OAuthClaim = Schema.Struct({\n  flow: OAuthPendingFlow,\n  claimId: OAuthClaimId,\n  claimedAtMillis: OAuthInstant,\n  claimExpiresAtMillis: OAuthInstant,\n});\n\nexport type OAuthClaim = typeof OAuthClaim.Type;\n\nexport const OAuthIssueDecision = Schema.Union([\n  Schema.TaggedStruct(\"Issued\", { flow: OAuthPendingFlow }),\n  Schema.TaggedStruct(\"Rejected\", {}),\n]);\n\nexport type OAuthIssueDecision = typeof OAuthIssueDecision.Type;\n\nexport const OAuthClaimDecision = Schema.Union([\n  Schema.TaggedStruct(\"Claimed\", { claim: OAuthClaim }),\n  Schema.TaggedStruct(\"Rejected\", {}),\n]);\n\nexport type OAuthClaimDecision = typeof OAuthClaimDecision.Type;\n\nexport const OAuthSettlementDecision = Schema.Union([\n  Schema.TaggedStruct(\"Verified\", { credential: OAuthCredentialSnapshot }),\n  Schema.TaggedStruct(\"Cancelled\", {}),\n  Schema.TaggedStruct(\"Rejected\", {}),\n  Schema.TaggedStruct(\"Ambiguous\", {}),\n]);\n\nexport type OAuthSettlementDecision = typeof OAuthSettlementDecision.Type;\n\nconst responseBase = {\n  state: Schema.RedactedFromValue(\n    Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(2048)),\n  ),\n  issuer: Schema.optionalKey(OAuthIssuer),\n};\n\nexport const OAuthCodeResponse = Schema.TaggedStruct(\"Code\", {\n  ...responseBase,\n  code: Schema.RedactedFromValue(\n    Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(4096)),\n  ),\n  error: Schema.optionalKey(Schema.Never),\n});\n\nexport type OAuthCodeResponse = typeof OAuthCodeResponse.Type;\n\nexport const OAuthCallbackResponse = Schema.Union([\n  OAuthCodeResponse,\n  Schema.TaggedStruct(\"Error\", {\n    ...responseBase,\n    error: Schema.Literals([\"access-denied\", \"rejected\"]),\n    code: Schema.optionalKey(Schema.Never),\n  }),\n]);\n\nexport const OAuthSignInBegin = Schema.Struct({\n  flowId: RequestBindingFlowId,\n  commandId: OAuthCommandId,\n  provider: OAuthProviderKey,\n  callbackId: OAuthCallbackId,\n  returnTarget: Schema.String.check(Schema.isMaxLength(2048)),\n});\n\nexport const OAuthSignInComplete = Schema.Struct({\n  flowId: RequestBindingFlowId,\n  provider: OAuthProviderKey,\n  callbackId: OAuthCallbackId,\n  requestBinding: RequestBindingCredential,\n  response: OAuthCallbackResponse,\n});\n\nexport const OAuthSignInAuthorization = Schema.Struct({\n  flowId: RequestBindingFlowId,\n  authorizationUrl: OAuthAuthorizationUrl,\n  expiresAtMillis: OAuthInstant,\n});\n\nexport const OAuthSignInPolicy = Schema.Struct({\n  generation: OAuthGeneration,\n  lifetimeMillis: Schema.Int.check(Schema.isBetween({ minimum: 1000, maximum: 1800000 })),\n  claimLifetimeMillis: Schema.Int.check(Schema.isBetween({ minimum: 1000, maximum: 120000 })),\n  settlementTimeoutMillis: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 30000 })),\n  retentionMillis: Schema.Int.check(Schema.isBetween({ minimum: 120000, maximum: 2592000000 })),\n});\n\nexport type OAuthSignInPolicy = typeof OAuthSignInPolicy.Type;\n\nexport const OAuthCleanupInput = Schema.Struct({\n  moduleId: OAuthModuleId,\n  limit: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 1000 })),\n  nowMillis: OAuthInstant,\n});\n\nexport type OAuthCleanupInput = typeof OAuthCleanupInput.Type;\n"],"mappings":";;;;;;AAOA,MAAM,SAAS,YACb,OAAO,OAAO,MAAM,OAAO,UAAU,IAAI,OAAO,uBAAuB,QAAQ,GAAG,CAAC,CAAC;AAEtF,MAAa,gBAAgB,MAAM,GAAG,CAAC,CAAC,KAAK,OAAO,MAAM,2BAA2B,CAAC;AACtF,MAAa,iBAAiB,MAAM,GAAG,CAAC,CAAC,KAAK,OAAO,MAAM,4BAA4B,CAAC;AACxF,MAAa,kBAAkB,MAAM,GAAG,CAAC,CAAC,KAAK,OAAO,MAAM,6BAA6B,CAAC;AAE1F,MAAa,eAAe,OAAO,OAAO,MAAM,OAAO,UAAU,qBAAqB,CAAC,CAAC,CAAC,KACvF,OAAO,MAAM,0BAA0B,CACzC;AAEA,MAAa,kBAAkB,OAAO,IAAI,MACxC,OAAO,UAAU;CAAE,SAAS;CAAG,SAAS,OAAO;AAAiB,CAAC,CACnE;AAEA,MAAa,eAAe,OAAO,IAAI,MACrC,OAAO,UAAU;CAAE,SAAS;CAAG,SAAS,OAAO;AAAiB,CAAC,CACnE;AAEA,MAAa,cAAc,OAAO,OAAO,MACvC,OAAO,YAAY,CAAC,GACpB,OAAO,YAAY,IAAI,GAEvB,OAAO,UAAU,+BAA+B,CAClD,CAAC,CAAC,KAAK,OAAO,MAAM,yBAAyB,CAAC;AAE9C,MAAa,mBAAmB,OAAO,OAAO,MAC5C,OAAO,YAAY,CAAC,GACpB,OAAO,YAAY,IAAI,GAEvB,OAAO,UAAU,gCAAgC,CACnD,CAAC,CAAC,KAAK,OAAO,MAAM,8BAA8B,CAAC;AAEnD,MAAa,oBAAoB,OAAO,OAAO,MAC7C,OAAO,YAAY,IAAI,GACvB,OAAO,UAAU,2BAA2B,CAC9C,CAAC,CAAC,KAAK,OAAO,MAAM,+BAA+B,CAAC;AAEpD,MAAa,oBAAoB,OAAO,SAAS,CAAC,QAAQ,OAAO,CAAC;AAElE,MAAa,6BAA6B,OAAO,OAAO;CACtD,UAAU;CACV,UAAU;CACV,yBAAyB;CACzB,QAAQ;CACR,oBAAoB,OAAO,SAAS,CAAC,YAAY,aAAa,CAAC;CAC/D,YAAY;CACZ,aAAa;AACf,CAAC;AAID,MAAa,gCAAgC,OAAO,OAAO;CACzD,WAAW,OAAO,QAAQ,sCAAsC;CAChE,UAAU;CACV,YAAY;CACZ,QAAQ;CACR,WAAW;CACX,GAAG,2BAA2B;CAC9B,cAAc;CACd,aAAa,YAAY,MAAM,OAAO,YAAY,EAAE,GAAG,OAAO,UAAU,qBAAqB,CAAC;CAC9F,wBAAwB,YAAY,MAClC,OAAO,YAAY,EAAE,GACrB,OAAO,UAAU,qBAAqB,CACxC;CACA,+BAA+B;CAC/B,gBAAgB;CAChB,iBAAiB;CACjB,qBAAqB,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAM,SAAS;CAAO,CAAC,CAAC;AAC5F,CAAC;AAID,MAAM,eAAe,OAAO,kBAC1B,OAAO,OAAO,MAAM,OAAO,UAAU,qBAAqB,CAAC,CAC7D;AAEA,MAAa,0BAA0B,OAAO,OAAO;CACnD,WAAW,OAAO,QAAQ,0CAA0C;CACpE,OAAO;CACP,cAAc,OAAO,kBACnB,OAAO,OAAO,MAAM,OAAO,UAAU,2BAA2B,CAAC,CACnE;CACA,WAAW,OAAO,YAAY,YAAY;AAC5C,CAAC;AAGD,MAAa,uBAAuB,OAAO,OAAO,MAAM,OAAO,UAAU,uBAAuB,CAAC;AAEjG,MAAa,yBAAyB,OAAO,OAAO;CAClD,QAAQ,OAAO,QAAQ,4BAA4B;CACnD,OAAO;CACP,OAAO,OAAO,OAAO,MAAM,OAAO,UAAU,qBAAqB,CAAC;CAClE,YAAY,OAAO,kBACjB,OAAO,OAAO,MACZ,OAAO,YAAY,EAAE,GACrB,OAAO,YAAY,KAAK,GACxB,OAAO,UAAU,kBAAkB,CACrC,CACF;AACF,CAAC;AAID,MAAa,wBAAwB,OAAO,kBAC1C,OAAO,OAAO,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,KAAK,CAAC,CACtE;AAEA,MAAa,2BAA2B,OAAO,OAAO;CACpD,eAAe;CACf,kBAAkB;CAClB,SAAS;AACX,CAAC;AAID,MAAa,wBAAwB,OAAO,OAAO;CACjD,UAAU;CACV,QAAQ;CACR,SAAS,OAAO,eAAe,MAAM,OAAO,YAAY,IAAI,CAAC;AAC/D,CAAC;;;;AAKD,MAAa,sBAAsB,OAAO,OAAO;CAC/C,aAAa,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC;CAC5E,QAAQ,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC;CACvE,WAAW,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC,CAAC;CAC3E,YAAY,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC,CAAC;CAC5E,OAAO,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC;CACtE,eAAe,OAAO,YAAY,OAAO,OAAO;;;CAGhD,cAAc,OAAO,YACnB,OAAO,WAAW,MAChB,OAAO,YACJ,UAAU,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,UAAU,KAAK,CAAC,CAAC,CAAC,UAAU,KACvE,CACF,CACF;AACF,CAAC;AAID,MAAa,gCAAgC,OAAO,OAAO;CACzD,UAAU;CACV,yBAAyB,OAAO,YAAY,OAAO,qBAAqB;CACxE,SAAS,OAAO,YAAY,mBAAmB;AACjD,CAAC;AAID,MAAa,0BAA0B,OAAO,OAAO;CACnD,UAAU;CACV,UAAU;CACV,cAAc,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC;CACjE,oBAAoB,iBAAiB,MAAM,OAAO,YAAY,GAAG,CAAC;CAClE,UAAU,OAAO,OAAO;EACtB,WAAW,UAAU,MAAM,OAAO,YAAY,GAAG,CAAC;EAClD,kBAAkB,iBAAiB,MAAM,OAAO,YAAY,GAAG,CAAC;EAChE,aAAa,OAAO,MAClB,OAAO,OAAO;GACZ,cAAc,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC;GACjE,UAAU,iBAAiB,MAAM,OAAO,YAAY,GAAG,CAAC;EAC1D,CAAC,CACH,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,EAAE,CAAC;CACvD,CAAC;AACH,CAAC;AAID,MAAa,mBAAmB,OAAO,OAAO;CAC5C,SAAS;CACT,QAAQ;CACR,sBAAsB;AACxB,CAAC;AAID,MAAa,aAAa,OAAO,OAAO;CACtC,MAAM;CACN,SAAS;CACT,iBAAiB;CACjB,sBAAsB;AACxB,CAAC;AAID,MAAa,qBAAqB,OAAO,MAAM,CAC7C,OAAO,aAAa,UAAU,EAAE,MAAM,iBAAiB,CAAC,GACxD,OAAO,aAAa,YAAY,CAAC,CAAC,CACpC,CAAC;AAID,MAAa,qBAAqB,OAAO,MAAM,CAC7C,OAAO,aAAa,WAAW,EAAE,OAAO,WAAW,CAAC,GACpD,OAAO,aAAa,YAAY,CAAC,CAAC,CACpC,CAAC;AAID,MAAa,0BAA0B,OAAO,MAAM;CAClD,OAAO,aAAa,YAAY,EAAE,YAAY,wBAAwB,CAAC;CACvE,OAAO,aAAa,aAAa,CAAC,CAAC;CACnC,OAAO,aAAa,YAAY,CAAC,CAAC;CAClC,OAAO,aAAa,aAAa,CAAC,CAAC;AACrC,CAAC;AAID,MAAM,eAAe;CACnB,OAAO,OAAO,kBACZ,OAAO,OAAO,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,IAAI,CAAC,CACrE;CACA,QAAQ,OAAO,YAAY,WAAW;AACxC;AAEA,MAAa,oBAAoB,OAAO,aAAa,QAAQ;CAC3D,GAAG;CACH,MAAM,OAAO,kBACX,OAAO,OAAO,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,IAAI,CAAC,CACrE;CACA,OAAO,OAAO,YAAY,OAAO,KAAK;AACxC,CAAC;AAID,MAAa,wBAAwB,OAAO,MAAM,CAChD,mBACA,OAAO,aAAa,SAAS;CAC3B,GAAG;CACH,OAAO,OAAO,SAAS,CAAC,iBAAiB,UAAU,CAAC;CACpD,MAAM,OAAO,YAAY,OAAO,KAAK;AACvC,CAAC,CACH,CAAC;AAED,MAAa,mBAAmB,OAAO,OAAO;CAC5C,QAAQ;CACR,WAAW;CACX,UAAU;CACV,YAAY;CACZ,cAAc,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC;AAC5D,CAAC;AAED,MAAa,sBAAsB,OAAO,OAAO;CAC/C,QAAQ;CACR,UAAU;CACV,YAAY;CACZ,gBAAgB;CAChB,UAAU;AACZ,CAAC;AAED,MAAa,2BAA2B,OAAO,OAAO;CACpD,QAAQ;CACR,kBAAkB;CAClB,iBAAiB;AACnB,CAAC;AAED,MAAa,oBAAoB,OAAO,OAAO;CAC7C,YAAY;CACZ,gBAAgB,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAM,SAAS;CAAQ,CAAC,CAAC;CACtF,qBAAqB,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAM,SAAS;CAAO,CAAC,CAAC;CAC1F,yBAAyB,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAM,CAAC,CAAC;CAC1F,iBAAiB,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAQ,SAAS;CAAW,CAAC,CAAC;AAC9F,CAAC;AAID,MAAa,oBAAoB,OAAO,OAAO;CAC7C,UAAU;CACV,OAAO,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAK,CAAC,CAAC;CACvE,WAAW;AACb,CAAC"}

package/dist/oauth/signInModule.d.mts

@@ -21,7 +21,7 @@ import { ModuleService, makeSessionModule } from "../sessions/module.mjs";
 import "../Identity.mjs";
 import { OAuthRegistrationAccess, OAuthRegistrationInspection, OAuthRegistrationIntent, OAuthRegistrationPolicy } from "./registrationModels.mjs";
 import { OAuthConfigurationError, OAuthMethodUnsupported, OAuthRejected, OAuthUnavailable } from "./signInErrors.mjs";
-import { OAuthCleanupInput, OAuthCredentialSnapshot, OAuthSignInAuthorization, OAuthSignInBegin, OAuthSignInComplete, OAuthSignInPolicy } from "./signInModels.mjs";
+import { OAuthCleanupInput, OAuthCredentialSnapshot, OAuthSignInAuthorization, OAuthSignInBegin, OAuthSignInComplete, OAuthSignInPolicy, OAuthVerifiedExternalIdentity } from "./signInModels.mjs";
 import { OAuthSignInPersistence, PrepareOAuthCommit } from "./OAuthSignInPersistence.mjs";
 import { OAuthAccountsPolicy, OAuthActionRequired } from "./accountsModels.mjs";
 import { OAuthConnectedActionRequired, OAuthConnectedBusy, OAuthConnectedPolicy, OAuthConnectedReauthorizationRequired } from "./connectedModels.mjs";
@@ -68,7 +68,10 @@ declare const makeOAuthMethod: <const Id extends string, const SessionId extends
     layer: Layer.Layer<BindingModule<Id, "oauth-entry">, RequestBindingConfigurationError, Crypto.Crypto | RequestBindingConfig | SubtleCrypto>;
   }>;
   ClaimsForOAuth: Context.Service<OAuthModule<Id, "claims", Claims["Type"]>, {
-    readonly resolve: (credential: OAuthCredentialSnapshot) => Effect.Effect<Claims["Type"], OAuthUnavailable>;
+    readonly resolve: (credential: OAuthCredentialSnapshot,
+    /** Fresh provider metadata, after exact local credential/identity matching.
+     * Select application claims explicitly; profile email grants no linking authority. */
+    verified: OAuthVerifiedExternalIdentity) => Effect.Effect<Claims["Type"], OAuthUnavailable>;
   }>;
   SignIn: Context.Service<OAuthModule<Id, "sign-in", Claims["Type"]>, {
     readonly begin: (input: typeof OAuthSignInBegin.Type) => Effect.Effect<AuthOperationResult<typeof OAuthSignInAuthorization.Type>, Failure>;
@@ -183,8 +186,6 @@ declare const makeOAuthMethod: <const Id extends string, const SessionId extends
         readonly fingerprint: TokenDigest;
       }, prepare: PrepareOAuthCommit<{
         readonly _tag: "Rejected";
-      } | {
-        readonly _tag: "Conflict";
       } | {
         readonly _tag: "Registered";
         readonly replayed: boolean;
@@ -192,6 +193,8 @@ declare const makeOAuthMethod: <const Id extends string, const SessionId extends
         readonly _tag: "ProvisioningPending";
         readonly reference: string;
         readonly replayed: boolean;
+      } | {
+        readonly _tag: "Conflict";
       }, A>) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable, never>;
       readonly cleanup: <A>(input: OAuthCleanupInput, prepare: PrepareOAuthCommit<{
         readonly removed: number;
@@ -859,6 +862,13 @@ declare const makeOAuthMethod: <const Id extends string, const SessionId extends
           readonly profile?: {
             readonly displayName?: string | undefined;
             readonly handle?: string | undefined;
+            readonly avatarUrl?: string | undefined;
+            readonly profileUrl?: string | undefined;
+            readonly email?: string | undefined;
+            readonly emailVerified?: boolean | undefined;
+            readonly providerData?: {
+              readonly [x: string]: Schema.Json;
+            } | undefined;
           } | undefined;
           readonly remoteRevocation: "Confirmed" | "Pending" | "Unknown" | "Unsupported";
         }[];
@@ -1002,6 +1012,11 @@ declare const makeOAuthMethod: <const Id extends string, const SessionId extends
           readonly profile: Schema.optionalKey<Schema.Struct<{
             readonly displayName: Schema.optionalKey<Schema.String>;
             readonly handle: Schema.optionalKey<Schema.String>;
+            readonly avatarUrl: Schema.optionalKey<Schema.String>;
+            readonly profileUrl: Schema.optionalKey<Schema.String>;
+            readonly email: Schema.optionalKey<Schema.String>;
+            readonly emailVerified: Schema.optionalKey<Schema.Boolean>;
+            readonly providerData: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
           }>>;
           readonly remoteRevocation: Schema.Literals<readonly ["Pending", "Confirmed", "Unsupported", "Unknown"]>;
         }>>;
@@ -1024,6 +1039,11 @@ declare const makeOAuthMethod: <const Id extends string, const SessionId extends
             readonly profile: Schema.optionalKey<Schema.Struct<{
               readonly displayName: Schema.optionalKey<Schema.String>;
               readonly handle: Schema.optionalKey<Schema.String>;
+              readonly avatarUrl: Schema.optionalKey<Schema.String>;
+              readonly profileUrl: Schema.optionalKey<Schema.String>;
+              readonly email: Schema.optionalKey<Schema.String>;
+              readonly emailVerified: Schema.optionalKey<Schema.Boolean>;
+              readonly providerData: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
             }>>;
             readonly remoteRevocation: Schema.Literals<readonly ["Pending", "Confirmed", "Unsupported", "Unknown"]>;
           }>>;
@@ -1134,6 +1154,13 @@ declare const makeOAuthMethod: <const Id extends string, const SessionId extends
         readonly profile?: {
           readonly displayName?: string | undefined;
           readonly handle?: string | undefined;
+          readonly avatarUrl?: string | undefined;
+          readonly profileUrl?: string | undefined;
+          readonly email?: string | undefined;
+          readonly emailVerified?: boolean | undefined;
+          readonly providerData?: {
+            readonly [x: string]: Schema.Json;
+          } | undefined;
         } | undefined;
         readonly remoteRevocation: "Confirmed" | "Pending" | "Unknown" | "Unsupported";
       }[];
@@ -1205,6 +1232,11 @@ declare const makeOAuthMethod: <const Id extends string, const SessionId extends
         readonly profile: Schema.optionalKey<Schema.Struct<{
           readonly displayName: Schema.optionalKey<Schema.String>;
           readonly handle: Schema.optionalKey<Schema.String>;
+          readonly avatarUrl: Schema.optionalKey<Schema.String>;
+          readonly profileUrl: Schema.optionalKey<Schema.String>;
+          readonly email: Schema.optionalKey<Schema.String>;
+          readonly emailVerified: Schema.optionalKey<Schema.Boolean>;
+          readonly providerData: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
         }>>;
         readonly remoteRevocation: Schema.Literals<readonly ["Pending", "Confirmed", "Unsupported", "Unknown"]>;
       }>>;
@@ -1278,6 +1310,13 @@ declare const makeOAuthMethod: <const Id extends string, const SessionId extends
             readonly profile?: {
               readonly displayName?: string | undefined;
               readonly handle?: string | undefined;
+              readonly avatarUrl?: string | undefined;
+              readonly profileUrl?: string | undefined;
+              readonly email?: string | undefined;
+              readonly emailVerified?: boolean | undefined;
+              readonly providerData?: {
+                readonly [x: string]: Schema.Json;
+              } | undefined;
             } | undefined;
             readonly remoteRevocation: "Confirmed" | "Pending" | "Unknown" | "Unsupported";
           }[];

package/dist/oauth/signInModule.mjs

@@ -302,7 +302,7 @@ const makeOAuthMethod = (moduleId, options) => {
 				const credential = snapshotOAuthSync(OAuthCredentialSnapshot, finished.credential);
 				if (credential.moduleId !== id || credential.identity.provider !== identity.identity.provider || credential.identity.issuer !== identity.identity.issuer || credential.identity.subject !== identity.identity.subject || new Set(credential.revision.credentials.map((item) => item.credentialId)).size !== credential.revision.credentials.length || !credential.revision.credentials.some((item) => item.credentialId === credential.credentialId && item.revision === credential.credentialRevision)) return yield* OAuthUnavailable.make({});
 				const bindingDigest = yield* hash(yield* Schema.encodeEffect(contextJson)(context).pipe(Effect.mapError(() => OAuthUnavailable.make({}))));
-				const claims = yield* resolveClaims(snapshotOAuthSync(OAuthCredentialSnapshot, credential));
+				const claims = yield* resolveClaims(snapshotOAuthSync(OAuthCredentialSnapshot, credential), snapshotOAuthSync(OAuthVerifiedExternalIdentity, identity));
 				const established = yield* completeAuthentication({
 					claims,
 					evidence: {

package/dist/oauth/signInModule.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"signInModule.mjs","names":["registrationSecrets.prepare","prepare"],"sources":["../../src/oauth/signInModule.ts"],"sourcesContent":["import {\n  Cause,\n  Context,\n  Crypto,\n  DateTime,\n  Effect,\n  Encoding,\n  Exit,\n  Fiber,\n  Layer,\n  Redacted,\n  Result,\n  Schema,\n  type Types,\n} from \"effect\";\n\nimport { makeAuthStrategy } from \"../auth/AuthStrategy\";\nimport { cryptoLayer, defaultLayer, hooksLayer } from \"../auth/defaults\";\nimport { hasCommitScope, type PreparedCommit } from \"../hooks/commit\";\nimport { HookDenied } from \"../hooks/models\";\nimport { reportAuthFailure } from \"../internal/diagnostics\";\nimport type { AuthOperationResult } from \"../operations/credentials\";\nimport { makeOperation, operationGroup } from \"../operations/operation\";\nimport { makeRequestBinding } from \"../operations/requestBinding\";\nimport { TokenDigest } from \"../Schema\";\nimport { AuthenticationFlowId } from \"../sessions/models\";\nimport type { makeSessionModule } from \"../sessions/module\";\nimport { makeOAuthAccounts } from \"./accounts\";\nimport type { OAuthAccountsPolicy } from \"./accountsModels\";\nimport { makeOAuthConnected } from \"./connected\";\nimport type { OAuthConnectedPolicy } from \"./connectedModels\";\nimport { OAuthProtocol } from \"./OAuthProtocol\";\nimport { OAuthRegistrationIntents, OAuthRegistrationSettlement } from \"./OAuthRegistrationIntents\";\nimport { OAuthReturnTargets } from \"./OAuthReturnTargets\";\nimport { OAuthSignInPersistence, type PrepareOAuthCommit } from \"./OAuthSignInPersistence\";\nimport { OAuthTransactionProtector } from \"./OAuthTransactionProtector\";\nimport { makeOAuthRegistration } from \"./registration\";\nimport {\n  OAuthRegistrationIntent,\n  OAuthRegistrationPolicy,\n  OAuthRegistrationRequired,\n} from \"./registrationModels\";\nimport * as registrationSecrets from \"./registrationSecrets\";\nimport {\n  OAuthConfigurationError,\n  OAuthMethodUnsupported,\n  OAuthProtocolRejected,\n  OAuthRejected,\n  OAuthUnavailable,\n} from \"./signInErrors\";\nimport {\n  OAuthCallbackResponse,\n  OAuthClaim,\n  OAuthClaimDecision,\n  OAuthClaimId,\n  OAuthCredentialSnapshot,\n  OAuthIssueDecision,\n  OAuthModuleId,\n  OAuthPendingFlow,\n  OAuthProtocolConfiguration,\n  OAuthProtocolPreparation,\n  OAuthReturnTarget,\n  OAuthSealedTransaction,\n  OAuthSignInAuthorization,\n  OAuthSignInBegin,\n  OAuthSignInComplete,\n  OAuthSignInPolicy,\n  OAuthSignInTransactionContext,\n  OAuthTransactionSecrets,\n  OAuthVerifiedExternalIdentity,\n} from \"./signInModels\";\nimport { snapshotOAuth, snapshotOAuthSync } from \"./signInSnapshot\";\n\nconst Failure = Schema.Union([OAuthRejected, OAuthUnavailable, OAuthMethodUnsupported, HookDenied]);\n\ntype Failure = typeof Failure.Type;\n\nconst noAmbient = Effect.fn(\"OAuth.noAmbient\")(function* () {\n  if (yield* hasCommitScope) return yield* OAuthMethodUnsupported.make({});\n});\n\nconst read = <A>(receipt: PreparedCommit<A>) =>\n  receipt.read.pipe(Effect.mapError(() => OAuthUnavailable.make({})));\n\nconst encoder = new TextEncoder();\n\n// Waiting is bounded even if an adapter is still finishing cooperative cleanup.\n// A timed-out owner may still commit: its receipt is abandoned, never recovered.\nconst bounded = <A, E, R>(effect: Effect.Effect<A, E, R>, millis: number) =>\n  Effect.gen(function* () {\n    const fiber = yield* effect.pipe(Effect.interruptible, Effect.forkDetach);\n\n    return yield* Fiber.join(fiber).pipe(\n      Effect.timeout(millis),\n      Effect.ensuring(Fiber.interrupt(fiber).pipe(Effect.forkDetach, Effect.asVoid)),\n    );\n  });\n\nconst flowJson = Schema.fromJsonString(OAuthPendingFlow);\nconst contextJson = Schema.fromJsonString(OAuthSignInTransactionContext);\nconst responseJson = Schema.fromJsonString(OAuthCallbackResponse);\n\nconst stateMessage = Schema.fromJsonString(\n  Schema.Tuple([\n    Schema.Literal(\"effect-auth/oauth-state/v1\"),\n    OAuthModuleId,\n    OAuthSignInPolicy.fields.generation,\n    OAuthSignInBegin.fields.provider,\n    OAuthSignInBegin.fields.flowId,\n    Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)),\n  ]),\n);\n\nexport interface OAuthModule<Id extends string, Kind extends string, Claims> {\n  readonly moduleId: Id;\n  readonly kind: Kind;\n  readonly claims: Types.Invariant<Claims>;\n}\n\n/** Guest sign-in only. Durable flow/identity authority, configured protocol,\n * separate transaction encryption and request-binding signing are explicit Layers.\n * This installs no provider, database, registration or connected-token capability.\n */\nexport const makeOAuthMethod = <\n  const Id extends string,\n  const SessionId extends string,\n  Claims extends Schema.Codec<unknown, unknown, unknown, unknown>,\n>(\n  moduleId: Id,\n  options: {\n    readonly sessions: ReturnType<typeof makeSessionModule<SessionId, Claims>>;\n  },\n) => {\n  const sessions = options.sessions;\n  const binding = makeRequestBinding(moduleId, \"oauth-entry\");\n\n  const ClaimsForOAuth = Context.Service<\n    OAuthModule<Id, \"claims\", Claims[\"Type\"]>,\n    {\n      readonly resolve: (\n        credential: OAuthCredentialSnapshot,\n      ) => Effect.Effect<Claims[\"Type\"], OAuthUnavailable>;\n    }\n  >(`effect-auth/oauth/${moduleId.length}:${moduleId}/Claims`);\n\n  const CompletionResult = Schema.Union([\n    Schema.Struct({ completion: sessions.CompletionResult, returnTarget: OAuthReturnTarget }),\n    Schema.TaggedStruct(\"Cancelled\", { returnTarget: OAuthReturnTarget }),\n    OAuthRegistrationRequired,\n  ]);\n\n  type CompletionResult = typeof CompletionResult.Type;\n\n  const SignIn = Context.Service<\n    OAuthModule<Id, \"sign-in\", Claims[\"Type\"]>,\n    {\n      readonly begin: (\n        input: typeof OAuthSignInBegin.Type,\n      ) => Effect.Effect<AuthOperationResult<typeof OAuthSignInAuthorization.Type>, Failure>;\n      readonly complete: (\n        input: typeof OAuthSignInComplete.Type,\n      ) => Effect.Effect<AuthOperationResult<CompletionResult>, Failure>;\n    }\n  >(`effect-auth/oauth/${moduleId.length}:${moduleId}/SignIn`);\n\n  const makeSignInLayer = <R>(\n    configuration: OAuthSignInPolicy,\n    registrationSource: Effect.Effect<\n      | {\n          readonly settle: OAuthRegistrationIntents[\"Service\"][\"settle\"];\n          readonly policy: OAuthRegistrationPolicy;\n        }\n      | undefined,\n      OAuthConfigurationError,\n      R\n    >,\n  ) => {\n    let captured: OAuthSignInPolicy | undefined;\n\n    try {\n      captured = snapshotOAuthSync(OAuthSignInPolicy, configuration);\n    } catch {\n      /* Layer reports configuration failure */\n    }\n\n    return Layer.effect(\n      SignIn,\n      Effect.gen(function* () {\n        const id = yield* Schema.decodeEffect(OAuthModuleId)(moduleId).pipe(\n          Effect.mapError(() => OAuthConfigurationError.make({ reason: \"module\" })),\n        );\n\n        if (captured === undefined)\n          return yield* OAuthConfigurationError.make({ reason: \"policy\" });\n        const policy = captured;\n        const registration = yield* registrationSource;\n        const { issue: issueBinding, verify: verifyBinding } = yield* binding.RequestBinding;\n        const { prepareAuthorization, exchangeVerifiedIdentity } = yield* OAuthProtocol;\n        const { resolve: returnTarget } = yield* OAuthReturnTargets;\n        const { seal, open } = yield* OAuthTransactionProtector;\n        const { issue, claim, settle } = yield* OAuthSignInPersistence;\n        const { resolve: resolveClaims } = yield* ClaimsForOAuth;\n        const { prepare: completeAuthentication } = yield* sessions.AuthenticationCompletion;\n        const crypto = yield* Crypto.Crypto;\n        const { randomBytes, digest } = crypto;\n\n        const hash = Effect.fn(\"OAuth.hash\")(function* (message: string) {\n          const result = yield* digest(\"SHA-256\", encoder.encode(message)).pipe(\n            Effect.mapError(() => OAuthUnavailable.make({})),\n          );\n\n          return TokenDigest.make(Encoding.encodeBase64Url(result));\n        });\n\n        const stateDigest = Effect.fn(\"OAuth.stateDigest\")(function* (\n          flowId: typeof OAuthSignInBegin.Type.flowId,\n          provider: typeof OAuthSignInBegin.Type.provider,\n          state: Redacted.Redacted<string>,\n        ) {\n          const raw = Redacted.value(state);\n\n          if (!Schema.is(Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)))(raw))\n            return yield* OAuthRejected.make({});\n          const bytes = Result.getOrUndefined(Encoding.decodeBase64Url(raw));\n\n          if (\n            bytes === undefined ||\n            bytes.length !== 32 ||\n            Encoding.encodeBase64Url(bytes) !== raw\n          ) {\n            bytes?.fill(0);\n\n            return yield* OAuthRejected.make({});\n          }\n          bytes.fill(0);\n\n          const message = yield* Schema.encodeEffect(stateMessage)([\n            \"effect-auth/oauth-state/v1\",\n            id,\n            policy.generation,\n            provider,\n            flowId,\n            raw,\n          ]).pipe(Effect.mapError(() => OAuthUnavailable.make({})));\n\n          return yield* hash(message);\n        });\n\n        const binderError = (error: { readonly _tag: string }) =>\n          error._tag === \"RequestBindingInvalid\"\n            ? OAuthRejected.make({})\n            : OAuthUnavailable.make({});\n\n        const begin = Effect.fn(\"OAuth.SignIn.begin\")(\n          function* (raw: typeof OAuthSignInBegin.Type) {\n            yield* noAmbient();\n            const request = yield* snapshotOAuth(OAuthSignInBegin, raw);\n            const target = yield* returnTarget(request.returnTarget);\n\n            const canonicalTarget = yield* Schema.decodeEffect(OAuthReturnTarget)(target).pipe(\n              Effect.mapError(() => OAuthUnavailable.make({})),\n            );\n\n            const issuedBinding = yield* issueBinding(request.flowId).pipe(\n              Effect.mapError(binderError),\n            );\n\n            const original = issuedBinding.credentialCommands[0];\n\n            if (\n              issuedBinding.credentialCommands.length !== 1 ||\n              original?._tag !== \"Issue\" ||\n              original.slot !== \"request-binding\" ||\n              issuedBinding.value.flowId !== request.flowId ||\n              original.expiresAtMillis !== issuedBinding.value.expiresAtMillis\n            )\n              return yield* OAuthUnavailable.make({});\n\n            const command = Object.freeze({\n              _tag: \"Issue\" as const,\n              slot: \"request-binding\" as const,\n              credential: Redacted.make(Redacted.value(original.credential)),\n              expiresAtMillis: original.expiresAtMillis,\n            });\n\n            const binder = Object.freeze({\n              ...(yield* verifyBinding(\n                request.flowId,\n                Redacted.make(Redacted.value(command.credential)),\n              ).pipe(Effect.mapError(binderError))),\n            });\n\n            if (binder.expiresAtMillis !== command.expiresAtMillis)\n              return yield* OAuthUnavailable.make({});\n\n            const prepared = yield* prepareAuthorization(\n              Object.freeze({\n                provider: request.provider,\n                callbackId: request.callbackId,\n                flowId: request.flowId,\n              }),\n            ).pipe(Effect.flatMap((value) => snapshotOAuth(OAuthProtocolPreparation, value)));\n\n            if (\n              prepared.configuration.provider !== request.provider ||\n              prepared.configuration.callbackId !== request.callbackId ||\n              (prepared.configuration.protocol === \"oidc\") !==\n                (prepared.secrets.oidcNonce !== undefined)\n            )\n              return yield* OAuthUnavailable.make({});\n            const now = DateTime.toEpochMillis(yield* DateTime.now);\n            const expiresAtMillis = Math.min(now + policy.lifetimeMillis, binder.expiresAtMillis);\n\n            if (expiresAtMillis <= now) return yield* OAuthRejected.make({});\n\n            const context = yield* snapshotOAuth(OAuthSignInTransactionContext, {\n              namespace: \"effect-auth/oauth-sign-in-context/v1\",\n              moduleId: id,\n              generation: policy.generation,\n              flowId: request.flowId,\n              commandId: request.commandId,\n              ...prepared.configuration,\n              returnTarget: canonicalTarget,\n              stateDigest: yield* stateDigest(\n                request.flowId,\n                request.provider,\n                prepared.secrets.state,\n              ).pipe(Effect.mapError(() => OAuthUnavailable.make({}))),\n              requestBindingVerifier: binder.verifier,\n              requestBindingExpiresAtMillis: binder.expiresAtMillis,\n              issuedAtMillis: now,\n              expiresAtMillis,\n              claimLifetimeMillis: policy.claimLifetimeMillis,\n            });\n\n            const sealed = yield* seal({\n              context: snapshotOAuthSync(OAuthSignInTransactionContext, context),\n              secrets: snapshotOAuthSync(OAuthTransactionSecrets, prepared.secrets),\n            }).pipe(Effect.flatMap((value) => snapshotOAuth(OAuthSealedTransaction, value)));\n\n            const flow = snapshotOAuthSync(OAuthPendingFlow, {\n              context,\n              sealed,\n              retentionUntilMillis: expiresAtMillis + policy.retentionMillis,\n            });\n\n            const expected = Schema.encodeSync(flowJson)(flow);\n\n            type Issuance =\n              | { readonly _tag: \"Rejected\" }\n              | {\n                  readonly _tag: \"Issued\";\n                  readonly result: AuthOperationResult<typeof OAuthSignInAuthorization.Type>;\n                };\n\n            const receipt = yield* issue<Issuance>(\n              snapshotOAuthSync(OAuthPendingFlow, flow),\n              (decision, journal) => {\n                const checked = snapshotOAuthSync(OAuthIssueDecision, decision);\n\n                if (checked._tag === \"Rejected\")\n                  return journal.prepare({ _tag: \"Rejected\" as const });\n                if (Schema.encodeSync(flowJson)(checked.flow) !== expected)\n                  throw OAuthUnavailable.make({});\n\n                return journal.prepare({\n                  _tag: \"Issued\" as const,\n                  result: Object.freeze({\n                    value: Object.freeze({\n                      flowId: request.flowId,\n                      authorizationUrl: prepared.authorizationUrl,\n                      expiresAtMillis,\n                    }),\n                    credentialCommands: Object.freeze([command]),\n                  }),\n                });\n              },\n            );\n\n            const committed = yield* read(receipt);\n\n            if (committed._tag === \"Rejected\") return yield* OAuthRejected.make({});\n\n            return committed.result;\n          },\n          Effect.tapCause((cause) =>\n            Cause.hasDies(cause) ? reportAuthFailure(\"oauth-sign-in\", cause) : Effect.void,\n          ),\n          Effect.catchDefect(() => Effect.fail(OAuthUnavailable.make({}))),\n        );\n\n        const complete = Effect.fn(\"OAuth.SignIn.complete\")(\n          function* (raw: typeof OAuthSignInComplete.Type) {\n            yield* noAmbient();\n            const request = yield* snapshotOAuth(OAuthSignInComplete, raw);\n            const response = request.response;\n\n            const serialized = yield* Schema.encodeEffect(responseJson)(response).pipe(\n              Effect.mapError(() => OAuthRejected.make({})),\n            );\n\n            if (encoder.encode(serialized).length > 16384) return yield* OAuthRejected.make({});\n\n            const binder = Object.freeze({\n              ...(yield* verifyBinding(request.flowId, request.requestBinding).pipe(\n                Effect.mapError(binderError),\n              )),\n            });\n\n            const state = yield* stateDigest(request.flowId, request.provider, response.state);\n\n            const random = yield* randomBytes(32).pipe(\n              Effect.mapError(() => OAuthUnavailable.make({})),\n            );\n\n            const claimId = OAuthClaimId.make(Encoding.encodeBase64Url(random));\n\n            random.fill(0);\n\n            const input = Object.freeze({\n              moduleId: id,\n              generation: policy.generation,\n              flowId: request.flowId,\n              provider: request.provider,\n              callbackId: request.callbackId,\n              stateDigest: state,\n              requestBindingVerifier: binder.verifier,\n              requestBindingExpiresAtMillis: binder.expiresAtMillis,\n              claimId,\n              ...(response.issuer === undefined ? {} : { responseIssuer: response.issuer }),\n              nowMillis: DateTime.toEpochMillis(yield* DateTime.now),\n            });\n\n            const settled = yield* Effect.uninterruptibleMask((restore) =>\n              Effect.gen(function* () {\n                const receipt = yield* restore(\n                  claim(input, (decision, journal) =>\n                    journal.prepare(snapshotOAuthSync(OAuthClaimDecision, decision)),\n                  ),\n                );\n\n                const decision = yield* read(receipt);\n\n                if (decision._tag !== \"Claimed\") return yield* OAuthRejected.make({});\n                const owned = snapshotOAuthSync(OAuthClaim, decision.claim);\n                const context = owned.flow.context;\n\n                if (\n                  owned.claimId !== claimId ||\n                  context.moduleId !== id ||\n                  context.generation !== policy.generation ||\n                  context.flowId !== request.flowId ||\n                  context.provider !== request.provider ||\n                  context.callbackId !== request.callbackId ||\n                  context.stateDigest !== state ||\n                  context.requestBindingVerifier !== binder.verifier ||\n                  context.requestBindingExpiresAtMillis !== binder.expiresAtMillis ||\n                  owned.claimedAtMillis < context.issuedAtMillis ||\n                  owned.claimedAtMillis >= context.expiresAtMillis ||\n                  context.expiresAtMillis > context.requestBindingExpiresAtMillis ||\n                  owned.claimExpiresAtMillis !==\n                    owned.claimedAtMillis + context.claimLifetimeMillis ||\n                  owned.flow.retentionUntilMillis < owned.claimExpiresAtMillis ||\n                  (context.responseIssuerMode === \"required\"\n                    ? response.issuer !== context.issuer\n                    : response.issuer !== undefined)\n                )\n                  return yield* OAuthUnavailable.make({});\n                let verifiedAt = owned.claimedAtMillis;\n\n                const exchange = Effect.gen(function* () {\n                  const secrets = yield* open({\n                    context: snapshotOAuthSync(OAuthSignInTransactionContext, context),\n                    sealed: snapshotOAuthSync(OAuthSealedTransaction, owned.flow.sealed),\n                  }).pipe(Effect.flatMap((value) => snapshotOAuth(OAuthTransactionSecrets, value)));\n\n                  if (\n                    (context.protocol === \"oidc\") !== (secrets.oidcNonce !== undefined) ||\n                    (yield* stateDigest(context.flowId, context.provider, secrets.state)) !==\n                      context.stateDigest ||\n                    Redacted.value(secrets.state) !== Redacted.value(response.state)\n                  )\n                    return yield* OAuthUnavailable.make({});\n                  if (response._tag !== \"Code\") return yield* OAuthProtocolRejected.make({});\n                  const start = yield* DateTime.now;\n\n                  verifiedAt = DateTime.toEpochMillis(start);\n                  if (verifiedAt >= owned.claimExpiresAtMillis)\n                    return yield* OAuthUnavailable.make({});\n\n                  const identity = yield* exchangeVerifiedIdentity({\n                    configuration: snapshotOAuthSync(OAuthProtocolConfiguration, context),\n                    response: snapshotOAuthSync(OAuthCallbackResponse, response) as typeof response,\n                    secrets: snapshotOAuthSync(OAuthTransactionSecrets, secrets),\n                    verificationStartedAt: start,\n                  }).pipe(\n                    Effect.flatMap((value) => snapshotOAuth(OAuthVerifiedExternalIdentity, value)),\n                  );\n\n                  if (\n                    identity.identity.provider !== context.provider ||\n                    identity.identity.issuer !== context.issuer\n                  )\n                    return yield* OAuthProtocolRejected.make({});\n                  if (identity.upstreamAuthenticatedAt !== undefined)\n                    verifiedAt = Math.min(\n                      verifiedAt,\n                      DateTime.toEpochMillis(identity.upstreamAuthenticatedAt),\n                    );\n\n                  return identity;\n                });\n\n                const remaining = Math.max(\n                  1,\n                  owned.claimExpiresAtMillis - DateTime.toEpochMillis(yield* DateTime.now),\n                );\n\n                const exchanged =\n                  response._tag === \"Error\"\n                    ? undefined\n                    : yield* Effect.exit(restore(bounded(exchange, remaining)));\n\n                const definiteRejection =\n                  exchanged !== undefined &&\n                  Exit.isFailure(exchanged) &&\n                  exchanged.cause.reasons.length === 1 &&\n                  exchanged.cause.reasons[0]?._tag === \"Fail\" &&\n                  Schema.is(OAuthProtocolRejected)(exchanged.cause.reasons[0].error);\n\n                if (exchanged !== undefined && Exit.isFailure(exchanged) && !definiteRejection)\n                  yield* reportAuthFailure(\"oauth-exchange\", exchanged.cause);\n\n                let outcome =\n                  exchanged === undefined\n                    ? { _tag: \"Cancelled\" as const }\n                    : Exit.isSuccess(exchanged)\n                      ? { _tag: \"Verified\" as const, identity: exchanged.value }\n                      : definiteRejection\n                        ? { _tag: \"Rejected\" as const }\n                        : { _tag: \"Ambiguous\" as const };\n\n                let registrationPrepared: Effect.Success<\n                  ReturnType<typeof registrationSecrets.prepare>\n                >;\n\n                if (outcome._tag === \"Verified\" && registration !== undefined) {\n                  const prepared = yield* Effect.exit(\n                    bounded(\n                      registrationSecrets.prepare(\n                        owned,\n                        outcome.identity,\n                        verifiedAt,\n                        registration.policy,\n                      ),\n                      remaining,\n                    ),\n                  );\n\n                  if (Exit.isSuccess(prepared)) registrationPrepared = prepared.value;\n                  else {\n                    yield* reportAuthFailure(\"oauth-sign-in\", prepared.cause);\n                    outcome = { _tag: \"Ambiguous\" };\n                  }\n                }\n                const intentCodec = Schema.fromJsonString(OAuthRegistrationIntent);\n\n                const expectedIntent =\n                  registrationPrepared === undefined\n                    ? undefined\n                    : Schema.encodeSync(intentCodec)(registrationPrepared.intent);\n\n                const prepare: PrepareOAuthCommit<\n                  OAuthRegistrationSettlement,\n                  OAuthRegistrationSettlement\n                > = (value, journal) => {\n                  const result = snapshotOAuthSync(OAuthRegistrationSettlement, value);\n\n                  if (result._tag === \"RegistrationIssued\") {\n                    if (\n                      outcome._tag !== \"Verified\" ||\n                      expectedIntent === undefined ||\n                      Schema.encodeSync(intentCodec)(result.intent) !== expectedIntent\n                    )\n                      throw OAuthUnavailable.make({});\n                  } else if (result._tag !== \"Rejected\" && result._tag !== outcome._tag)\n                    throw OAuthUnavailable.make({});\n\n                  return journal.prepare(result);\n                };\n\n                const nowMillis = DateTime.toEpochMillis(yield* DateTime.now);\n\n                const commit =\n                  outcome._tag === \"Verified\" && registration !== undefined\n                    ? registration.settle(\n                        {\n                          claim: snapshotOAuthSync(OAuthClaim, owned),\n                          identity: snapshotOAuthSync(\n                            OAuthVerifiedExternalIdentity,\n                            outcome.identity,\n                          ),\n                          ...(registrationPrepared === undefined\n                            ? {}\n                            : {\n                                intent: snapshotOAuthSync(\n                                  OAuthRegistrationIntent,\n                                  registrationPrepared.intent,\n                                ),\n                              }),\n                          nowMillis,\n                        },\n                        prepare,\n                      )\n                    : settle(\n                        { claim: snapshotOAuthSync(OAuthClaim, owned), outcome, nowMillis },\n                        prepare,\n                      );\n\n                const finished = yield* bounded(commit, policy.settlementTimeoutMillis).pipe(\n                  Effect.flatMap(read),\n                  Effect.mapError(() => OAuthUnavailable.make({})),\n                );\n\n                return {\n                  finished,\n                  registrationCommand: registrationPrepared?.command,\n                  context,\n                  verifiedAt,\n                  identity: outcome._tag === \"Verified\" ? outcome.identity : undefined,\n                };\n              }),\n            );\n\n            const { finished, context, verifiedAt, identity, registrationCommand } = settled;\n\n            if (finished._tag === \"RegistrationIssued\") {\n              if (registrationCommand === undefined) return yield* OAuthUnavailable.make({});\n\n              return {\n                value: {\n                  _tag: \"RegistrationRequired\" as const,\n                  reference: finished.intent.reference,\n                  expiresAtMillis: finished.intent.expiresAtMillis,\n                  returnTarget: context.returnTarget,\n                },\n                credentialCommands: [registrationCommand],\n              };\n            }\n\n            if (finished._tag === \"Cancelled\")\n              return {\n                value: { _tag: \"Cancelled\" as const, returnTarget: context.returnTarget },\n                credentialCommands: [{ _tag: \"Clear\" as const, slot: \"request-binding\" as const }],\n              };\n            if (finished._tag === \"Ambiguous\") return yield* OAuthUnavailable.make({});\n            if (finished._tag !== \"Verified\" || identity === undefined)\n              return yield* OAuthRejected.make({});\n            const credential = snapshotOAuthSync(OAuthCredentialSnapshot, finished.credential);\n\n            if (\n              credential.moduleId !== id ||\n              credential.identity.provider !== identity.identity.provider ||\n              credential.identity.issuer !== identity.identity.issuer ||\n              credential.identity.subject !== identity.identity.subject ||\n              new Set(credential.revision.credentials.map((item) => item.credentialId)).size !==\n                credential.revision.credentials.length ||\n              !credential.revision.credentials.some(\n                (item) =>\n                  item.credentialId === credential.credentialId &&\n                  item.revision === credential.credentialRevision,\n              )\n            )\n              return yield* OAuthUnavailable.make({});\n\n            const bindingDigest = yield* hash(\n              yield* Schema.encodeEffect(contextJson)(context).pipe(\n                Effect.mapError(() => OAuthUnavailable.make({})),\n              ),\n            );\n\n            const claims = yield* resolveClaims(\n              snapshotOAuthSync(OAuthCredentialSnapshot, credential),\n            );\n\n            const established = yield* completeAuthentication({\n              claims,\n              evidence: {\n                revision: credential.revision,\n                flowId: AuthenticationFlowId.make(context.flowId),\n                bindingDigest,\n                proofs: [\n                  {\n                    method: context.protocol,\n                    credentialId: credential.credentialId,\n                    factors: [\"possession\"],\n                    userVerified: false,\n                    phishingResistant: false,\n                    verifiedAt: DateTime.makeUnsafe(verifiedAt),\n                  },\n                ],\n              },\n            }).pipe(\n              Effect.mapError((error) =>\n                error._tag === \"HookDenied\"\n                  ? error\n                  : error._tag === \"SessionUnavailable\"\n                    ? OAuthUnavailable.make({})\n                    : OAuthRejected.make({}),\n              ),\n              Effect.flatMap(read),\n            );\n\n            return {\n              value: { completion: established.value, returnTarget: context.returnTarget },\n              credentialCommands: [\n                ...established.credentialCommands,\n                { _tag: \"Clear\" as const, slot: \"request-binding\" as const },\n              ],\n            };\n          },\n          Effect.provideService(Crypto.Crypto, crypto),\n          Effect.tapCause((cause) =>\n            Cause.hasDies(cause) ? reportAuthFailure(\"oauth-sign-in\", cause) : Effect.void,\n          ),\n          Effect.catchDefect(() => Effect.fail(OAuthUnavailable.make({}))),\n        );\n\n        return SignIn.of({ begin, complete });\n      }),\n    );\n  };\n\n  const signInLayer = (configuration: OAuthSignInPolicy) =>\n    makeSignInLayer(configuration, Effect.succeed(undefined));\n\n  const registration = <Registration extends Schema.Codec<unknown, unknown, unknown, unknown>>(\n    codec: Registration,\n  ) => {\n    const capability = makeOAuthRegistration(moduleId, codec, binding);\n\n    const registrationSignInLayer = (\n      configuration: OAuthSignInPolicy,\n      registrationConfiguration: OAuthRegistrationPolicy,\n    ) => {\n      let captured: OAuthRegistrationPolicy | undefined;\n\n      try {\n        captured = snapshotOAuthSync(OAuthRegistrationPolicy, registrationConfiguration);\n      } catch {\n        /* Layer reports invalid policy. */\n      }\n\n      return makeSignInLayer(\n        configuration,\n        Effect.gen(function* () {\n          if (captured === undefined)\n            return yield* OAuthConfigurationError.make({ reason: \"policy\" });\n          const { settle } = yield* OAuthRegistrationIntents;\n\n          return { settle, policy: captured };\n        }),\n      );\n    };\n\n    return Object.freeze({\n      ...capability,\n      signInLayer: registrationSignInLayer,\n      strategy: makeAuthStrategy(\n        { register: capability.operations.Complete.invoke },\n        capability.handlersLayer.pipe(\n          Layer.provide(defaultLayer(capability.Registrations, capability.layer)),\n          Layer.provide(defaultLayer(binding.RequestBinding, binding.layer)),\n          Layer.provide([cryptoLayer, hooksLayer]),\n        ),\n      ),\n    });\n  };\n\n  const Begin = makeOperation(`${moduleId}/sign-in/begin`, {\n    payload: OAuthSignInBegin,\n    success: OAuthSignInAuthorization,\n    error: Failure,\n    access: \"any\",\n    exposure: \"public\",\n    replay: \"non-idempotent\",\n    credentials: true,\n  });\n\n  const Complete = makeOperation(`${moduleId}/sign-in/complete`, {\n    payload: OAuthSignInComplete,\n    success: CompletionResult,\n    error: Failure,\n    access: \"any\",\n    exposure: \"public\",\n    replay: \"single-use\",\n    credentials: true,\n  });\n\n  const handlersLayer = Layer.mergeAll(\n    Begin.credentialHandlerLayer(\n      Effect.fn(\"OAuth.Begin\")(function* (input) {\n        return yield* (yield* SignIn).begin(input);\n      }),\n    ),\n    Complete.credentialHandlerLayer(\n      Effect.fn(\"OAuth.Complete\")(function* (input) {\n        return yield* (yield* SignIn).complete(input);\n      }),\n    ),\n  );\n\n  const layer = (policy: OAuthSignInPolicy) =>\n    handlersLayer.pipe(\n      Layer.provide(defaultLayer(SignIn, signInLayer(policy))),\n      Layer.provide(defaultLayer(binding.RequestBinding, binding.layer)),\n      Layer.provide([cryptoLayer, hooksLayer]),\n    );\n\n  const accounts = (policy: OAuthAccountsPolicy) => {\n    const module = makeOAuthAccounts(moduleId, sessions, policy);\n\n    return Object.freeze({\n      ...module,\n      strategy: makeAuthStrategy(\n        {\n          linkAccount: module.operations.Link.Begin.invoke,\n          completeAccountLink: module.operations.Link.Complete.invoke,\n          unlinkAccount: module.operations.Unlink.invoke,\n        },\n        module.handlersLayer.pipe(\n          Layer.provide(defaultLayer(module.Accounts, module.layer)),\n          Layer.provide(defaultLayer(module.binding.RequestBinding, module.binding.layer)),\n          Layer.provide([cryptoLayer, hooksLayer]),\n        ),\n      ),\n    });\n  };\n\n  const connected = (policy: OAuthConnectedPolicy) => {\n    const module = makeOAuthConnected(moduleId, policy);\n\n    return Object.freeze({\n      ...module,\n      strategy: makeAuthStrategy(\n        {\n          connectAccount: module.operations.Begin.invoke,\n          completeAccountConnection: module.operations.Complete.invoke,\n          listAccountConnections: module.operations.List.invoke,\n          disconnectAccount: module.operations.Disconnect.invoke,\n        },\n        module.handlersLayer.pipe(\n          Layer.provide(defaultLayer(module.Connected, module.layer)),\n          Layer.provide(defaultLayer(module.binding.RequestBinding, module.binding.layer)),\n          Layer.provide([cryptoLayer, hooksLayer]),\n        ),\n      ),\n    });\n  };\n\n  return Object.freeze({\n    binding,\n    ClaimsForOAuth,\n    SignIn,\n    signInLayer,\n    layer,\n    registration,\n    accounts,\n    connected,\n    CompletionResult,\n    operations: Object.freeze({ Begin, Complete }),\n    handlersLayer,\n    group: operationGroup(Begin, Complete),\n  });\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAyEA,MAAM,UAAU,OAAO,MAAM;CAAC;CAAe;CAAkB;CAAwB;AAAU,CAAC;AAIlG,MAAM,YAAY,OAAO,GAAG,iBAAiB,CAAC,CAAC,aAAa;CAC1D,IAAI,OAAO,gBAAgB,OAAO,OAAO,uBAAuB,KAAK,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,QAAW,YACf,QAAQ,KAAK,KAAK,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC;AAEpE,MAAM,UAAU,IAAI,YAAY;AAIhC,MAAM,WAAoB,QAAgC,WACxD,OAAO,IAAI,aAAa;CACtB,MAAM,QAAQ,OAAO,OAAO,KAAK,OAAO,eAAe,OAAO,UAAU;CAExE,OAAO,OAAO,MAAM,KAAK,KAAK,CAAC,CAAC,KAC9B,OAAO,QAAQ,MAAM,GACrB,OAAO,SAAS,MAAM,UAAU,KAAK,CAAC,CAAC,KAAK,OAAO,YAAY,OAAO,MAAM,CAAC,CAC/E;AACF,CAAC;AAEH,MAAM,WAAW,OAAO,eAAe,gBAAgB;AACvD,MAAM,cAAc,OAAO,eAAe,6BAA6B;AACvE,MAAM,eAAe,OAAO,eAAe,qBAAqB;AAEhE,MAAM,eAAe,OAAO,eAC1B,OAAO,MAAM;CACX,OAAO,QAAQ,4BAA4B;CAC3C;CACA,kBAAkB,OAAO;CACzB,iBAAiB,OAAO;CACxB,iBAAiB,OAAO;CACxB,OAAO,OAAO,MAAM,OAAO,UAAU,qBAAqB,CAAC;AAC7D,CAAC,CACH;;;;;AAYA,MAAa,mBAKX,UACA,YAGG;CACH,MAAM,WAAW,QAAQ;CACzB,MAAM,UAAU,mBAAmB,UAAU,aAAa;CAE1D,MAAM,iBAAiB,QAAQ,QAO7B,qBAAqB,SAAS,OAAO,GAAG,SAAS,QAAQ;CAE3D,MAAM,mBAAmB,OAAO,MAAM;EACpC,OAAO,OAAO;GAAE,YAAY,SAAS;GAAkB,cAAc;EAAkB,CAAC;EACxF,OAAO,aAAa,aAAa,EAAE,cAAc,kBAAkB,CAAC;EACpE;CACF,CAAC;CAID,MAAM,SAAS,QAAQ,QAUrB,qBAAqB,SAAS,OAAO,GAAG,SAAS,QAAQ;CAE3D,MAAM,mBACJ,eACA,uBASG;EACH,IAAI;EAEJ,IAAI;GACF,WAAW,kBAAkB,mBAAmB,aAAa;EAC/D,QAAQ,CAER;EAEA,OAAO,MAAM,OACX,QACA,OAAO,IAAI,aAAa;GACtB,MAAM,KAAK,OAAO,OAAO,aAAa,aAAa,CAAC,CAAC,QAAQ,CAAC,CAAC,KAC7D,OAAO,eAAe,wBAAwB,KAAK,EAAE,QAAQ,SAAS,CAAC,CAAC,CAC1E;GAEA,IAAI,aAAa,KAAA,GACf,OAAO,OAAO,wBAAwB,KAAK,EAAE,QAAQ,SAAS,CAAC;GACjE,MAAM,SAAS;GACf,MAAM,eAAe,OAAO;GAC5B,MAAM,EAAE,OAAO,cAAc,QAAQ,kBAAkB,OAAO,QAAQ;GACtE,MAAM,EAAE,sBAAsB,6BAA6B,OAAO;GAClE,MAAM,EAAE,SAAS,iBAAiB,OAAO;GACzC,MAAM,EAAE,MAAM,SAAS,OAAO;GAC9B,MAAM,EAAE,OAAO,OAAO,WAAW,OAAO;GACxC,MAAM,EAAE,SAAS,kBAAkB,OAAO;GAC1C,MAAM,EAAE,SAAS,2BAA2B,OAAO,SAAS;GAC5D,MAAM,SAAS,OAAO,OAAO;GAC7B,MAAM,EAAE,aAAa,WAAW;GAEhC,MAAM,OAAO,OAAO,GAAG,YAAY,CAAC,CAAC,WAAW,SAAiB;IAC/D,MAAM,SAAS,OAAO,OAAO,WAAW,QAAQ,OAAO,OAAO,CAAC,CAAC,CAAC,KAC/D,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CACjD;IAEA,OAAO,YAAY,KAAK,SAAS,gBAAgB,MAAM,CAAC;GAC1D,CAAC;GAED,MAAM,cAAc,OAAO,GAAG,mBAAmB,CAAC,CAAC,WACjD,QACA,UACA,OACA;IACA,MAAM,MAAM,SAAS,MAAM,KAAK;IAEhC,IAAI,CAAC,OAAO,GAAG,OAAO,OAAO,MAAM,OAAO,UAAU,qBAAqB,CAAC,CAAC,CAAC,CAAC,GAAG,GAC9E,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;IACrC,MAAM,QAAQ,OAAO,eAAe,SAAS,gBAAgB,GAAG,CAAC;IAEjE,IACE,UAAU,KAAA,KACV,MAAM,WAAW,MACjB,SAAS,gBAAgB,KAAK,MAAM,KACpC;KACA,OAAO,KAAK,CAAC;KAEb,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;IACrC;IACA,MAAM,KAAK,CAAC;IAEZ,MAAM,UAAU,OAAO,OAAO,aAAa,YAAY,CAAC,CAAC;KACvD;KACA;KACA,OAAO;KACP;KACA;KACA;IACF,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC;IAExD,OAAO,OAAO,KAAK,OAAO;GAC5B,CAAC;GAED,MAAM,eAAe,UACnB,MAAM,SAAS,0BACX,cAAc,KAAK,CAAC,CAAC,IACrB,iBAAiB,KAAK,CAAC,CAAC;GAE9B,MAAM,QAAQ,OAAO,GAAG,oBAAoB,CAAC,CAC3C,WAAW,KAAmC;IAC5C,OAAO,UAAU;IACjB,MAAM,UAAU,OAAO,cAAc,kBAAkB,GAAG;IAC1D,MAAM,SAAS,OAAO,aAAa,QAAQ,YAAY;IAEvD,MAAM,kBAAkB,OAAO,OAAO,aAAa,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,KAC5E,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CACjD;IAEA,MAAM,gBAAgB,OAAO,aAAa,QAAQ,MAAM,CAAC,CAAC,KACxD,OAAO,SAAS,WAAW,CAC7B;IAEA,MAAM,WAAW,cAAc,mBAAmB;IAElD,IACE,cAAc,mBAAmB,WAAW,KAC5C,UAAU,SAAS,WACnB,SAAS,SAAS,qBAClB,cAAc,MAAM,WAAW,QAAQ,UACvC,SAAS,oBAAoB,cAAc,MAAM,iBAEjD,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IAExC,MAAM,UAAU,OAAO,OAAO;KAC5B,MAAM;KACN,MAAM;KACN,YAAY,SAAS,KAAK,SAAS,MAAM,SAAS,UAAU,CAAC;KAC7D,iBAAiB,SAAS;IAC5B,CAAC;IAED,MAAM,SAAS,OAAO,OAAO,EAC3B,GAAI,OAAO,cACT,QAAQ,QACR,SAAS,KAAK,SAAS,MAAM,QAAQ,UAAU,CAAC,CAClD,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC,EACrC,CAAC;IAED,IAAI,OAAO,oBAAoB,QAAQ,iBACrC,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IAExC,MAAM,WAAW,OAAO,qBACtB,OAAO,OAAO;KACZ,UAAU,QAAQ;KAClB,YAAY,QAAQ;KACpB,QAAQ,QAAQ;IAClB,CAAC,CACH,CAAC,CAAC,KAAK,OAAO,SAAS,UAAU,cAAc,0BAA0B,KAAK,CAAC,CAAC;IAEhF,IACE,SAAS,cAAc,aAAa,QAAQ,YAC5C,SAAS,cAAc,eAAe,QAAQ,cAC7C,SAAS,cAAc,aAAa,YAClC,SAAS,QAAQ,cAAc,KAAA,IAElC,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IACxC,MAAM,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG;IACtD,MAAM,kBAAkB,KAAK,IAAI,MAAM,OAAO,gBAAgB,OAAO,eAAe;IAEpF,IAAI,mBAAmB,KAAK,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;IAE/D,MAAM,UAAU,OAAO,cAAc,+BAA+B;KAClE,WAAW;KACX,UAAU;KACV,YAAY,OAAO;KACnB,QAAQ,QAAQ;KAChB,WAAW,QAAQ;KACnB,GAAG,SAAS;KACZ,cAAc;KACd,aAAa,OAAO,YAClB,QAAQ,QACR,QAAQ,UACR,SAAS,QAAQ,KACnB,CAAC,CAAC,KAAK,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC;KACvD,wBAAwB,OAAO;KAC/B,+BAA+B,OAAO;KACtC,gBAAgB;KAChB;KACA,qBAAqB,OAAO;IAC9B,CAAC;IAED,MAAM,SAAS,OAAO,KAAK;KACzB,SAAS,kBAAkB,+BAA+B,OAAO;KACjE,SAAS,kBAAkB,yBAAyB,SAAS,OAAO;IACtE,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,UAAU,cAAc,wBAAwB,KAAK,CAAC,CAAC;IAE/E,MAAM,OAAO,kBAAkB,kBAAkB;KAC/C;KACA;KACA,sBAAsB,kBAAkB,OAAO;IACjD,CAAC;IAED,MAAM,WAAW,OAAO,WAAW,QAAQ,CAAC,CAAC,IAAI;IASjD,MAAM,UAAU,OAAO,MACrB,kBAAkB,kBAAkB,IAAI,IACvC,UAAU,YAAY;KACrB,MAAM,UAAU,kBAAkB,oBAAoB,QAAQ;KAE9D,IAAI,QAAQ,SAAS,YACnB,OAAO,QAAQ,QAAQ,EAAE,MAAM,WAAoB,CAAC;KACtD,IAAI,OAAO,WAAW,QAAQ,CAAC,CAAC,QAAQ,IAAI,MAAM,UAChD,MAAM,iBAAiB,KAAK,CAAC,CAAC;KAEhC,OAAO,QAAQ,QAAQ;MACrB,MAAM;MACN,QAAQ,OAAO,OAAO;OACpB,OAAO,OAAO,OAAO;QACnB,QAAQ,QAAQ;QAChB,kBAAkB,SAAS;QAC3B;OACF,CAAC;OACD,oBAAoB,OAAO,OAAO,CAAC,OAAO,CAAC;MAC7C,CAAC;KACH,CAAC;IACH,CACF;IAEA,MAAM,YAAY,OAAO,KAAK,OAAO;IAErC,IAAI,UAAU,SAAS,YAAY,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;IAEtE,OAAO,UAAU;GACnB,GACA,OAAO,UAAU,UACf,MAAM,QAAQ,KAAK,IAAI,kBAAkB,iBAAiB,KAAK,IAAI,OAAO,IAC5E,GACA,OAAO,kBAAkB,OAAO,KAAK,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC,CACjE;GAEA,MAAM,WAAW,OAAO,GAAG,uBAAuB,CAAC,CACjD,WAAW,KAAsC;IAC/C,OAAO,UAAU;IACjB,MAAM,UAAU,OAAO,cAAc,qBAAqB,GAAG;IAC7D,MAAM,WAAW,QAAQ;IAEzB,MAAM,aAAa,OAAO,OAAO,aAAa,YAAY,CAAC,CAAC,QAAQ,CAAC,CAAC,KACpE,OAAO,eAAe,cAAc,KAAK,CAAC,CAAC,CAAC,CAC9C;IAEA,IAAI,QAAQ,OAAO,UAAU,CAAC,CAAC,SAAS,OAAO,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;IAElF,MAAM,SAAS,OAAO,OAAO,EAC3B,GAAI,OAAO,cAAc,QAAQ,QAAQ,QAAQ,cAAc,CAAC,CAAC,KAC/D,OAAO,SAAS,WAAW,CAC7B,EACF,CAAC;IAED,MAAM,QAAQ,OAAO,YAAY,QAAQ,QAAQ,QAAQ,UAAU,SAAS,KAAK;IAEjF,MAAM,SAAS,OAAO,YAAY,EAAE,CAAC,CAAC,KACpC,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CACjD;IAEA,MAAM,UAAU,aAAa,KAAK,SAAS,gBAAgB,MAAM,CAAC;IAElE,OAAO,KAAK,CAAC;IAEb,MAAM,QAAQ,OAAO,OAAO;KAC1B,UAAU;KACV,YAAY,OAAO;KACnB,QAAQ,QAAQ;KAChB,UAAU,QAAQ;KAClB,YAAY,QAAQ;KACpB,aAAa;KACb,wBAAwB,OAAO;KAC/B,+BAA+B,OAAO;KACtC;KACA,GAAI,SAAS,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,gBAAgB,SAAS,OAAO;KAC3E,WAAW,SAAS,cAAc,OAAO,SAAS,GAAG;IACvD,CAAC;IA2MD,MAAM,EAAE,UAAU,SAAS,YAAY,UAAU,wBAAwB,OAzMlD,OAAO,qBAAqB,YACjD,OAAO,IAAI,aAAa;KACtB,MAAM,UAAU,OAAO,QACrB,MAAM,QAAQ,UAAU,YACtB,QAAQ,QAAQ,kBAAkB,oBAAoB,QAAQ,CAAC,CACjE,CACF;KAEA,MAAM,WAAW,OAAO,KAAK,OAAO;KAEpC,IAAI,SAAS,SAAS,WAAW,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;KACpE,MAAM,QAAQ,kBAAkB,YAAY,SAAS,KAAK;KAC1D,MAAM,UAAU,MAAM,KAAK;KAE3B,IACE,MAAM,YAAY,WAClB,QAAQ,aAAa,MACrB,QAAQ,eAAe,OAAO,cAC9B,QAAQ,WAAW,QAAQ,UAC3B,QAAQ,aAAa,QAAQ,YAC7B,QAAQ,eAAe,QAAQ,cAC/B,QAAQ,gBAAgB,SACxB,QAAQ,2BAA2B,OAAO,YAC1C,QAAQ,kCAAkC,OAAO,mBACjD,MAAM,kBAAkB,QAAQ,kBAChC,MAAM,mBAAmB,QAAQ,mBACjC,QAAQ,kBAAkB,QAAQ,iCAClC,MAAM,yBACJ,MAAM,kBAAkB,QAAQ,uBAClC,MAAM,KAAK,uBAAuB,MAAM,yBACvC,QAAQ,uBAAuB,aAC5B,SAAS,WAAW,QAAQ,SAC5B,SAAS,WAAW,KAAA,IAExB,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;KACxC,IAAI,aAAa,MAAM;KAEvB,MAAM,WAAW,OAAO,IAAI,aAAa;MACvC,MAAM,UAAU,OAAO,KAAK;OAC1B,SAAS,kBAAkB,+BAA+B,OAAO;OACjE,QAAQ,kBAAkB,wBAAwB,MAAM,KAAK,MAAM;MACrE,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,UAAU,cAAc,yBAAyB,KAAK,CAAC,CAAC;MAEhF,IACG,QAAQ,aAAa,YAAa,QAAQ,cAAc,KAAA,OACxD,OAAO,YAAY,QAAQ,QAAQ,QAAQ,UAAU,QAAQ,KAAK,OACjE,QAAQ,eACV,SAAS,MAAM,QAAQ,KAAK,MAAM,SAAS,MAAM,SAAS,KAAK,GAE/D,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;MACxC,IAAI,SAAS,SAAS,QAAQ,OAAO,OAAO,sBAAsB,KAAK,CAAC,CAAC;MACzE,MAAM,QAAQ,OAAO,SAAS;MAE9B,aAAa,SAAS,cAAc,KAAK;MACzC,IAAI,cAAc,MAAM,sBACtB,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;MAExC,MAAM,WAAW,OAAO,yBAAyB;OAC/C,eAAe,kBAAkB,4BAA4B,OAAO;OACpE,UAAU,kBAAkB,uBAAuB,QAAQ;OAC3D,SAAS,kBAAkB,yBAAyB,OAAO;OAC3D,uBAAuB;MACzB,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,UAAU,cAAc,+BAA+B,KAAK,CAAC,CAC/E;MAEA,IACE,SAAS,SAAS,aAAa,QAAQ,YACvC,SAAS,SAAS,WAAW,QAAQ,QAErC,OAAO,OAAO,sBAAsB,KAAK,CAAC,CAAC;MAC7C,IAAI,SAAS,4BAA4B,KAAA,GACvC,aAAa,KAAK,IAChB,YACA,SAAS,cAAc,SAAS,uBAAuB,CACzD;MAEF,OAAO;KACT,CAAC;KAED,MAAM,YAAY,KAAK,IACrB,GACA,MAAM,uBAAuB,SAAS,cAAc,OAAO,SAAS,GAAG,CACzE;KAEA,MAAM,YACJ,SAAS,SAAS,UACd,KAAA,IACA,OAAO,OAAO,KAAK,QAAQ,QAAQ,UAAU,SAAS,CAAC,CAAC;KAE9D,MAAM,oBACJ,cAAc,KAAA,KACd,KAAK,UAAU,SAAS,KACxB,UAAU,MAAM,QAAQ,WAAW,KACnC,UAAU,MAAM,QAAQ,EAAE,EAAE,SAAS,UACrC,OAAO,GAAG,qBAAqB,CAAC,CAAC,UAAU,MAAM,QAAQ,EAAE,CAAC,KAAK;KAEnE,IAAI,cAAc,KAAA,KAAa,KAAK,UAAU,SAAS,KAAK,CAAC,mBAC3D,OAAO,kBAAkB,kBAAkB,UAAU,KAAK;KAE5D,IAAI,UACF,cAAc,KAAA,IACV,EAAE,MAAM,YAAqB,IAC7B,KAAK,UAAU,SAAS,IACtB;MAAE,MAAM;MAAqB,UAAU,UAAU;KAAM,IACvD,oBACE,EAAE,MAAM,WAAoB,IAC5B,EAAE,MAAM,YAAqB;KAEvC,IAAI;KAIJ,IAAI,QAAQ,SAAS,cAAc,iBAAiB,KAAA,GAAW;MAC7D,MAAM,WAAW,OAAO,OAAO,KAC7B,QACEA,QACE,OACA,QAAQ,UACR,YACA,aAAa,MACf,GACA,SACF,CACF;MAEA,IAAI,KAAK,UAAU,QAAQ,GAAG,uBAAuB,SAAS;WACzD;OACH,OAAO,kBAAkB,iBAAiB,SAAS,KAAK;OACxD,UAAU,EAAE,MAAM,YAAY;MAChC;KACF;KACA,MAAM,cAAc,OAAO,eAAe,uBAAuB;KAEjE,MAAM,iBACJ,yBAAyB,KAAA,IACrB,KAAA,IACA,OAAO,WAAW,WAAW,CAAC,CAAC,qBAAqB,MAAM;KAEhE,MAAMC,aAGD,OAAO,YAAY;MACtB,MAAM,SAAS,kBAAkB,6BAA6B,KAAK;MAEnE,IAAI,OAAO,SAAS,sBAEhB;WAAA,QAAQ,SAAS,cACjB,mBAAmB,KAAA,KACnB,OAAO,WAAW,WAAW,CAAC,CAAC,OAAO,MAAM,MAAM,gBAElD,MAAM,iBAAiB,KAAK,CAAC,CAAC;MAAA,OAC3B,IAAI,OAAO,SAAS,cAAc,OAAO,SAAS,QAAQ,MAC/D,MAAM,iBAAiB,KAAK,CAAC,CAAC;MAEhC,OAAO,QAAQ,QAAQ,MAAM;KAC/B;KAEA,MAAM,YAAY,SAAS,cAAc,OAAO,SAAS,GAAG;KAE5D,MAAM,SACJ,QAAQ,SAAS,cAAc,iBAAiB,KAAA,IAC5C,aAAa,OACX;MACE,OAAO,kBAAkB,YAAY,KAAK;MAC1C,UAAU,kBACR,+BACA,QAAQ,QACV;MACA,GAAI,yBAAyB,KAAA,IACzB,CAAC,IACD,EACE,QAAQ,kBACN,yBACA,qBAAqB,MACvB,EACF;MACJ;KACF,GACAA,SACF,IACA,OACE;MAAE,OAAO,kBAAkB,YAAY,KAAK;MAAG;MAAS;KAAU,GAClEA,SACF;KAON,OAAO;MACL,UAAA,OANsB,QAAQ,QAAQ,OAAO,uBAAuB,CAAC,CAAC,KACtE,OAAO,QAAQ,IAAI,GACnB,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CACjD;MAIE,qBAAqB,sBAAsB;MAC3C;MACA;MACA,UAAU,QAAQ,SAAS,aAAa,QAAQ,WAAW,KAAA;KAC7D;IACF,CAAC,CACH;IAIA,IAAI,SAAS,SAAS,sBAAsB;KAC1C,IAAI,wBAAwB,KAAA,GAAW,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;KAE7E,OAAO;MACL,OAAO;OACL,MAAM;OACN,WAAW,SAAS,OAAO;OAC3B,iBAAiB,SAAS,OAAO;OACjC,cAAc,QAAQ;MACxB;MACA,oBAAoB,CAAC,mBAAmB;KAC1C;IACF;IAEA,IAAI,SAAS,SAAS,aACpB,OAAO;KACL,OAAO;MAAE,MAAM;MAAsB,cAAc,QAAQ;KAAa;KACxE,oBAAoB,CAAC;MAAE,MAAM;MAAkB,MAAM;KAA2B,CAAC;IACnF;IACF,IAAI,SAAS,SAAS,aAAa,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IACzE,IAAI,SAAS,SAAS,cAAc,aAAa,KAAA,GAC/C,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;IACrC,MAAM,aAAa,kBAAkB,yBAAyB,SAAS,UAAU;IAEjF,IACE,WAAW,aAAa,MACxB,WAAW,SAAS,aAAa,SAAS,SAAS,YACnD,WAAW,SAAS,WAAW,SAAS,SAAS,UACjD,WAAW,SAAS,YAAY,SAAS,SAAS,WAClD,IAAI,IAAI,WAAW,SAAS,YAAY,KAAK,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,SACxE,WAAW,SAAS,YAAY,UAClC,CAAC,WAAW,SAAS,YAAY,MAC9B,SACC,KAAK,iBAAiB,WAAW,gBACjC,KAAK,aAAa,WAAW,kBACjC,GAEA,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IAExC,MAAM,gBAAgB,OAAO,KAC3B,OAAO,OAAO,aAAa,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,KAC/C,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CACjD,CACF;IAEA,MAAM,SAAS,OAAO,cACpB,kBAAkB,yBAAyB,UAAU,CACvD;IAEA,MAAM,cAAc,OAAO,uBAAuB;KAChD;KACA,UAAU;MACR,UAAU,WAAW;MACrB,QAAQ,qBAAqB,KAAK,QAAQ,MAAM;MAChD;MACA,QAAQ,CACN;OACE,QAAQ,QAAQ;OAChB,cAAc,WAAW;OACzB,SAAS,CAAC,YAAY;OACtB,cAAc;OACd,mBAAmB;OACnB,YAAY,SAAS,WAAW,UAAU;MAC5C,CACF;KACF;IACF,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,UACf,MAAM,SAAS,eACX,QACA,MAAM,SAAS,uBACb,iBAAiB,KAAK,CAAC,CAAC,IACxB,cAAc,KAAK,CAAC,CAAC,CAC7B,GACA,OAAO,QAAQ,IAAI,CACrB;IAEA,OAAO;KACL,OAAO;MAAE,YAAY,YAAY;MAAO,cAAc,QAAQ;KAAa;KAC3E,oBAAoB,CAClB,GAAG,YAAY,oBACf;MAAE,MAAM;MAAkB,MAAM;KAA2B,CAC7D;IACF;GACF,GACA,OAAO,eAAe,OAAO,QAAQ,MAAM,GAC3C,OAAO,UAAU,UACf,MAAM,QAAQ,KAAK,IAAI,kBAAkB,iBAAiB,KAAK,IAAI,OAAO,IAC5E,GACA,OAAO,kBAAkB,OAAO,KAAK,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC,CACjE;GAEA,OAAO,OAAO,GAAG;IAAE;IAAO;GAAS,CAAC;EACtC,CAAC,CACH;CACF;CAEA,MAAM,eAAe,kBACnB,gBAAgB,eAAe,OAAO,QAAQ,KAAA,CAAS,CAAC;CAE1D,MAAM,gBACJ,UACG;EACH,MAAM,aAAa,sBAAsB,UAAU,OAAO,OAAO;EAEjE,MAAM,2BACJ,eACA,8BACG;GACH,IAAI;GAEJ,IAAI;IACF,WAAW,kBAAkB,yBAAyB,yBAAyB;GACjF,QAAQ,CAER;GAEA,OAAO,gBACL,eACA,OAAO,IAAI,aAAa;IACtB,IAAI,aAAa,KAAA,GACf,OAAO,OAAO,wBAAwB,KAAK,EAAE,QAAQ,SAAS,CAAC;IACjE,MAAM,EAAE,WAAW,OAAO;IAE1B,OAAO;KAAE;KAAQ,QAAQ;IAAS;GACpC,CAAC,CACH;EACF;EAEA,OAAO,OAAO,OAAO;GACnB,GAAG;GACH,aAAa;GACb,UAAU,iBACR,EAAE,UAAU,WAAW,WAAW,SAAS,OAAO,GAClD,WAAW,cAAc,KACvB,MAAM,QAAQ,aAAa,WAAW,eAAe,WAAW,KAAK,CAAC,GACtE,MAAM,QAAQ,aAAa,QAAQ,gBAAgB,QAAQ,KAAK,CAAC,GACjE,MAAM,QAAQ,CAAC,aAAa,UAAU,CAAC,CACzC,CACF;EACF,CAAC;CACH;CAEA,MAAM,QAAQ,cAAc,GAAG,SAAS,iBAAiB;EACvD,SAAS;EACT,SAAS;EACT,OAAO;EACP,QAAQ;EACR,UAAU;EACV,QAAQ;EACR,aAAa;CACf,CAAC;CAED,MAAM,WAAW,cAAc,GAAG,SAAS,oBAAoB;EAC7D,SAAS;EACT,SAAS;EACT,OAAO;EACP,QAAQ;EACR,UAAU;EACV,QAAQ;EACR,aAAa;CACf,CAAC;CAED,MAAM,gBAAgB,MAAM,SAC1B,MAAM,uBACJ,OAAO,GAAG,aAAa,CAAC,CAAC,WAAW,OAAO;EACzC,OAAO,QAAQ,OAAO,OAAA,CAAQ,MAAM,KAAK;CAC3C,CAAC,CACH,GACA,SAAS,uBACP,OAAO,GAAG,gBAAgB,CAAC,CAAC,WAAW,OAAO;EAC5C,OAAO,QAAQ,OAAO,OAAA,CAAQ,SAAS,KAAK;CAC9C,CAAC,CACH,CACF;CAEA,MAAM,SAAS,WACb,cAAc,KACZ,MAAM,QAAQ,aAAa,QAAQ,YAAY,MAAM,CAAC,CAAC,GACvD,MAAM,QAAQ,aAAa,QAAQ,gBAAgB,QAAQ,KAAK,CAAC,GACjE,MAAM,QAAQ,CAAC,aAAa,UAAU,CAAC,CACzC;CAEF,MAAM,YAAY,WAAgC;EAChD,MAAM,SAAS,kBAAkB,UAAU,UAAU,MAAM;EAE3D,OAAO,OAAO,OAAO;GACnB,GAAG;GACH,UAAU,iBACR;IACE,aAAa,OAAO,WAAW,KAAK,MAAM;IAC1C,qBAAqB,OAAO,WAAW,KAAK,SAAS;IACrD,eAAe,OAAO,WAAW,OAAO;GAC1C,GACA,OAAO,cAAc,KACnB,MAAM,QAAQ,aAAa,OAAO,UAAU,OAAO,KAAK,CAAC,GACzD,MAAM,QAAQ,aAAa,OAAO,QAAQ,gBAAgB,OAAO,QAAQ,KAAK,CAAC,GAC/E,MAAM,QAAQ,CAAC,aAAa,UAAU,CAAC,CACzC,CACF;EACF,CAAC;CACH;CAEA,MAAM,aAAa,WAAiC;EAClD,MAAM,SAAS,mBAAmB,UAAU,MAAM;EAElD,OAAO,OAAO,OAAO;GACnB,GAAG;GACH,UAAU,iBACR;IACE,gBAAgB,OAAO,WAAW,MAAM;IACxC,2BAA2B,OAAO,WAAW,SAAS;IACtD,wBAAwB,OAAO,WAAW,KAAK;IAC/C,mBAAmB,OAAO,WAAW,WAAW;GAClD,GACA,OAAO,cAAc,KACnB,MAAM,QAAQ,aAAa,OAAO,WAAW,OAAO,KAAK,CAAC,GAC1D,MAAM,QAAQ,aAAa,OAAO,QAAQ,gBAAgB,OAAO,QAAQ,KAAK,CAAC,GAC/E,MAAM,QAAQ,CAAC,aAAa,UAAU,CAAC,CACzC,CACF;EACF,CAAC;CACH;CAEA,OAAO,OAAO,OAAO;EACnB;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,YAAY,OAAO,OAAO;GAAE;GAAO;EAAS,CAAC;EAC7C;EACA,OAAO,eAAe,OAAO,QAAQ;CACvC,CAAC;AACH"}
+{"version":3,"file":"signInModule.mjs","names":["registrationSecrets.prepare","prepare"],"sources":["../../src/oauth/signInModule.ts"],"sourcesContent":["import {\n  Cause,\n  Context,\n  Crypto,\n  DateTime,\n  Effect,\n  Encoding,\n  Exit,\n  Fiber,\n  Layer,\n  Redacted,\n  Result,\n  Schema,\n  type Types,\n} from \"effect\";\n\nimport { makeAuthStrategy } from \"../auth/AuthStrategy\";\nimport { cryptoLayer, defaultLayer, hooksLayer } from \"../auth/defaults\";\nimport { hasCommitScope, type PreparedCommit } from \"../hooks/commit\";\nimport { HookDenied } from \"../hooks/models\";\nimport { reportAuthFailure } from \"../internal/diagnostics\";\nimport type { AuthOperationResult } from \"../operations/credentials\";\nimport { makeOperation, operationGroup } from \"../operations/operation\";\nimport { makeRequestBinding } from \"../operations/requestBinding\";\nimport { TokenDigest } from \"../Schema\";\nimport { AuthenticationFlowId } from \"../sessions/models\";\nimport type { makeSessionModule } from \"../sessions/module\";\nimport { makeOAuthAccounts } from \"./accounts\";\nimport type { OAuthAccountsPolicy } from \"./accountsModels\";\nimport { makeOAuthConnected } from \"./connected\";\nimport type { OAuthConnectedPolicy } from \"./connectedModels\";\nimport { OAuthProtocol } from \"./OAuthProtocol\";\nimport { OAuthRegistrationIntents, OAuthRegistrationSettlement } from \"./OAuthRegistrationIntents\";\nimport { OAuthReturnTargets } from \"./OAuthReturnTargets\";\nimport { OAuthSignInPersistence, type PrepareOAuthCommit } from \"./OAuthSignInPersistence\";\nimport { OAuthTransactionProtector } from \"./OAuthTransactionProtector\";\nimport { makeOAuthRegistration } from \"./registration\";\nimport {\n  OAuthRegistrationIntent,\n  OAuthRegistrationPolicy,\n  OAuthRegistrationRequired,\n} from \"./registrationModels\";\nimport * as registrationSecrets from \"./registrationSecrets\";\nimport {\n  OAuthConfigurationError,\n  OAuthMethodUnsupported,\n  OAuthProtocolRejected,\n  OAuthRejected,\n  OAuthUnavailable,\n} from \"./signInErrors\";\nimport {\n  OAuthCallbackResponse,\n  OAuthClaim,\n  OAuthClaimDecision,\n  OAuthClaimId,\n  OAuthCredentialSnapshot,\n  OAuthIssueDecision,\n  OAuthModuleId,\n  OAuthPendingFlow,\n  OAuthProtocolConfiguration,\n  OAuthProtocolPreparation,\n  OAuthReturnTarget,\n  OAuthSealedTransaction,\n  OAuthSignInAuthorization,\n  OAuthSignInBegin,\n  OAuthSignInComplete,\n  OAuthSignInPolicy,\n  OAuthSignInTransactionContext,\n  OAuthTransactionSecrets,\n  OAuthVerifiedExternalIdentity,\n} from \"./signInModels\";\nimport { snapshotOAuth, snapshotOAuthSync } from \"./signInSnapshot\";\n\nconst Failure = Schema.Union([OAuthRejected, OAuthUnavailable, OAuthMethodUnsupported, HookDenied]);\n\ntype Failure = typeof Failure.Type;\n\nconst noAmbient = Effect.fn(\"OAuth.noAmbient\")(function* () {\n  if (yield* hasCommitScope) return yield* OAuthMethodUnsupported.make({});\n});\n\nconst read = <A>(receipt: PreparedCommit<A>) =>\n  receipt.read.pipe(Effect.mapError(() => OAuthUnavailable.make({})));\n\nconst encoder = new TextEncoder();\n\n// Waiting is bounded even if an adapter is still finishing cooperative cleanup.\n// A timed-out owner may still commit: its receipt is abandoned, never recovered.\nconst bounded = <A, E, R>(effect: Effect.Effect<A, E, R>, millis: number) =>\n  Effect.gen(function* () {\n    const fiber = yield* effect.pipe(Effect.interruptible, Effect.forkDetach);\n\n    return yield* Fiber.join(fiber).pipe(\n      Effect.timeout(millis),\n      Effect.ensuring(Fiber.interrupt(fiber).pipe(Effect.forkDetach, Effect.asVoid)),\n    );\n  });\n\nconst flowJson = Schema.fromJsonString(OAuthPendingFlow);\nconst contextJson = Schema.fromJsonString(OAuthSignInTransactionContext);\nconst responseJson = Schema.fromJsonString(OAuthCallbackResponse);\n\nconst stateMessage = Schema.fromJsonString(\n  Schema.Tuple([\n    Schema.Literal(\"effect-auth/oauth-state/v1\"),\n    OAuthModuleId,\n    OAuthSignInPolicy.fields.generation,\n    OAuthSignInBegin.fields.provider,\n    OAuthSignInBegin.fields.flowId,\n    Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)),\n  ]),\n);\n\nexport interface OAuthModule<Id extends string, Kind extends string, Claims> {\n  readonly moduleId: Id;\n  readonly kind: Kind;\n  readonly claims: Types.Invariant<Claims>;\n}\n\n/** Guest sign-in only. Durable flow/identity authority, configured protocol,\n * separate transaction encryption and request-binding signing are explicit Layers.\n * This installs no provider, database, registration or connected-token capability.\n */\nexport const makeOAuthMethod = <\n  const Id extends string,\n  const SessionId extends string,\n  Claims extends Schema.Codec<unknown, unknown, unknown, unknown>,\n>(\n  moduleId: Id,\n  options: {\n    readonly sessions: ReturnType<typeof makeSessionModule<SessionId, Claims>>;\n  },\n) => {\n  const sessions = options.sessions;\n  const binding = makeRequestBinding(moduleId, \"oauth-entry\");\n\n  const ClaimsForOAuth = Context.Service<\n    OAuthModule<Id, \"claims\", Claims[\"Type\"]>,\n    {\n      readonly resolve: (\n        credential: OAuthCredentialSnapshot,\n        /** Fresh provider metadata, after exact local credential/identity matching.\n         * Select application claims explicitly; profile email grants no linking authority. */\n        verified: OAuthVerifiedExternalIdentity,\n      ) => Effect.Effect<Claims[\"Type\"], OAuthUnavailable>;\n    }\n  >(`effect-auth/oauth/${moduleId.length}:${moduleId}/Claims`);\n\n  const CompletionResult = Schema.Union([\n    Schema.Struct({ completion: sessions.CompletionResult, returnTarget: OAuthReturnTarget }),\n    Schema.TaggedStruct(\"Cancelled\", { returnTarget: OAuthReturnTarget }),\n    OAuthRegistrationRequired,\n  ]);\n\n  type CompletionResult = typeof CompletionResult.Type;\n\n  const SignIn = Context.Service<\n    OAuthModule<Id, \"sign-in\", Claims[\"Type\"]>,\n    {\n      readonly begin: (\n        input: typeof OAuthSignInBegin.Type,\n      ) => Effect.Effect<AuthOperationResult<typeof OAuthSignInAuthorization.Type>, Failure>;\n      readonly complete: (\n        input: typeof OAuthSignInComplete.Type,\n      ) => Effect.Effect<AuthOperationResult<CompletionResult>, Failure>;\n    }\n  >(`effect-auth/oauth/${moduleId.length}:${moduleId}/SignIn`);\n\n  const makeSignInLayer = <R>(\n    configuration: OAuthSignInPolicy,\n    registrationSource: Effect.Effect<\n      | {\n          readonly settle: OAuthRegistrationIntents[\"Service\"][\"settle\"];\n          readonly policy: OAuthRegistrationPolicy;\n        }\n      | undefined,\n      OAuthConfigurationError,\n      R\n    >,\n  ) => {\n    let captured: OAuthSignInPolicy | undefined;\n\n    try {\n      captured = snapshotOAuthSync(OAuthSignInPolicy, configuration);\n    } catch {\n      /* Layer reports configuration failure */\n    }\n\n    return Layer.effect(\n      SignIn,\n      Effect.gen(function* () {\n        const id = yield* Schema.decodeEffect(OAuthModuleId)(moduleId).pipe(\n          Effect.mapError(() => OAuthConfigurationError.make({ reason: \"module\" })),\n        );\n\n        if (captured === undefined)\n          return yield* OAuthConfigurationError.make({ reason: \"policy\" });\n        const policy = captured;\n        const registration = yield* registrationSource;\n        const { issue: issueBinding, verify: verifyBinding } = yield* binding.RequestBinding;\n        const { prepareAuthorization, exchangeVerifiedIdentity } = yield* OAuthProtocol;\n        const { resolve: returnTarget } = yield* OAuthReturnTargets;\n        const { seal, open } = yield* OAuthTransactionProtector;\n        const { issue, claim, settle } = yield* OAuthSignInPersistence;\n        const { resolve: resolveClaims } = yield* ClaimsForOAuth;\n        const { prepare: completeAuthentication } = yield* sessions.AuthenticationCompletion;\n        const crypto = yield* Crypto.Crypto;\n        const { randomBytes, digest } = crypto;\n\n        const hash = Effect.fn(\"OAuth.hash\")(function* (message: string) {\n          const result = yield* digest(\"SHA-256\", encoder.encode(message)).pipe(\n            Effect.mapError(() => OAuthUnavailable.make({})),\n          );\n\n          return TokenDigest.make(Encoding.encodeBase64Url(result));\n        });\n\n        const stateDigest = Effect.fn(\"OAuth.stateDigest\")(function* (\n          flowId: typeof OAuthSignInBegin.Type.flowId,\n          provider: typeof OAuthSignInBegin.Type.provider,\n          state: Redacted.Redacted<string>,\n        ) {\n          const raw = Redacted.value(state);\n\n          if (!Schema.is(Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)))(raw))\n            return yield* OAuthRejected.make({});\n          const bytes = Result.getOrUndefined(Encoding.decodeBase64Url(raw));\n\n          if (\n            bytes === undefined ||\n            bytes.length !== 32 ||\n            Encoding.encodeBase64Url(bytes) !== raw\n          ) {\n            bytes?.fill(0);\n\n            return yield* OAuthRejected.make({});\n          }\n          bytes.fill(0);\n\n          const message = yield* Schema.encodeEffect(stateMessage)([\n            \"effect-auth/oauth-state/v1\",\n            id,\n            policy.generation,\n            provider,\n            flowId,\n            raw,\n          ]).pipe(Effect.mapError(() => OAuthUnavailable.make({})));\n\n          return yield* hash(message);\n        });\n\n        const binderError = (error: { readonly _tag: string }) =>\n          error._tag === \"RequestBindingInvalid\"\n            ? OAuthRejected.make({})\n            : OAuthUnavailable.make({});\n\n        const begin = Effect.fn(\"OAuth.SignIn.begin\")(\n          function* (raw: typeof OAuthSignInBegin.Type) {\n            yield* noAmbient();\n            const request = yield* snapshotOAuth(OAuthSignInBegin, raw);\n            const target = yield* returnTarget(request.returnTarget);\n\n            const canonicalTarget = yield* Schema.decodeEffect(OAuthReturnTarget)(target).pipe(\n              Effect.mapError(() => OAuthUnavailable.make({})),\n            );\n\n            const issuedBinding = yield* issueBinding(request.flowId).pipe(\n              Effect.mapError(binderError),\n            );\n\n            const original = issuedBinding.credentialCommands[0];\n\n            if (\n              issuedBinding.credentialCommands.length !== 1 ||\n              original?._tag !== \"Issue\" ||\n              original.slot !== \"request-binding\" ||\n              issuedBinding.value.flowId !== request.flowId ||\n              original.expiresAtMillis !== issuedBinding.value.expiresAtMillis\n            )\n              return yield* OAuthUnavailable.make({});\n\n            const command = Object.freeze({\n              _tag: \"Issue\" as const,\n              slot: \"request-binding\" as const,\n              credential: Redacted.make(Redacted.value(original.credential)),\n              expiresAtMillis: original.expiresAtMillis,\n            });\n\n            const binder = Object.freeze({\n              ...(yield* verifyBinding(\n                request.flowId,\n                Redacted.make(Redacted.value(command.credential)),\n              ).pipe(Effect.mapError(binderError))),\n            });\n\n            if (binder.expiresAtMillis !== command.expiresAtMillis)\n              return yield* OAuthUnavailable.make({});\n\n            const prepared = yield* prepareAuthorization(\n              Object.freeze({\n                provider: request.provider,\n                callbackId: request.callbackId,\n                flowId: request.flowId,\n              }),\n            ).pipe(Effect.flatMap((value) => snapshotOAuth(OAuthProtocolPreparation, value)));\n\n            if (\n              prepared.configuration.provider !== request.provider ||\n              prepared.configuration.callbackId !== request.callbackId ||\n              (prepared.configuration.protocol === \"oidc\") !==\n                (prepared.secrets.oidcNonce !== undefined)\n            )\n              return yield* OAuthUnavailable.make({});\n            const now = DateTime.toEpochMillis(yield* DateTime.now);\n            const expiresAtMillis = Math.min(now + policy.lifetimeMillis, binder.expiresAtMillis);\n\n            if (expiresAtMillis <= now) return yield* OAuthRejected.make({});\n\n            const context = yield* snapshotOAuth(OAuthSignInTransactionContext, {\n              namespace: \"effect-auth/oauth-sign-in-context/v1\",\n              moduleId: id,\n              generation: policy.generation,\n              flowId: request.flowId,\n              commandId: request.commandId,\n              ...prepared.configuration,\n              returnTarget: canonicalTarget,\n              stateDigest: yield* stateDigest(\n                request.flowId,\n                request.provider,\n                prepared.secrets.state,\n              ).pipe(Effect.mapError(() => OAuthUnavailable.make({}))),\n              requestBindingVerifier: binder.verifier,\n              requestBindingExpiresAtMillis: binder.expiresAtMillis,\n              issuedAtMillis: now,\n              expiresAtMillis,\n              claimLifetimeMillis: policy.claimLifetimeMillis,\n            });\n\n            const sealed = yield* seal({\n              context: snapshotOAuthSync(OAuthSignInTransactionContext, context),\n              secrets: snapshotOAuthSync(OAuthTransactionSecrets, prepared.secrets),\n            }).pipe(Effect.flatMap((value) => snapshotOAuth(OAuthSealedTransaction, value)));\n\n            const flow = snapshotOAuthSync(OAuthPendingFlow, {\n              context,\n              sealed,\n              retentionUntilMillis: expiresAtMillis + policy.retentionMillis,\n            });\n\n            const expected = Schema.encodeSync(flowJson)(flow);\n\n            type Issuance =\n              | { readonly _tag: \"Rejected\" }\n              | {\n                  readonly _tag: \"Issued\";\n                  readonly result: AuthOperationResult<typeof OAuthSignInAuthorization.Type>;\n                };\n\n            const receipt = yield* issue<Issuance>(\n              snapshotOAuthSync(OAuthPendingFlow, flow),\n              (decision, journal) => {\n                const checked = snapshotOAuthSync(OAuthIssueDecision, decision);\n\n                if (checked._tag === \"Rejected\")\n                  return journal.prepare({ _tag: \"Rejected\" as const });\n                if (Schema.encodeSync(flowJson)(checked.flow) !== expected)\n                  throw OAuthUnavailable.make({});\n\n                return journal.prepare({\n                  _tag: \"Issued\" as const,\n                  result: Object.freeze({\n                    value: Object.freeze({\n                      flowId: request.flowId,\n                      authorizationUrl: prepared.authorizationUrl,\n                      expiresAtMillis,\n                    }),\n                    credentialCommands: Object.freeze([command]),\n                  }),\n                });\n              },\n            );\n\n            const committed = yield* read(receipt);\n\n            if (committed._tag === \"Rejected\") return yield* OAuthRejected.make({});\n\n            return committed.result;\n          },\n          Effect.tapCause((cause) =>\n            Cause.hasDies(cause) ? reportAuthFailure(\"oauth-sign-in\", cause) : Effect.void,\n          ),\n          Effect.catchDefect(() => Effect.fail(OAuthUnavailable.make({}))),\n        );\n\n        const complete = Effect.fn(\"OAuth.SignIn.complete\")(\n          function* (raw: typeof OAuthSignInComplete.Type) {\n            yield* noAmbient();\n            const request = yield* snapshotOAuth(OAuthSignInComplete, raw);\n            const response = request.response;\n\n            const serialized = yield* Schema.encodeEffect(responseJson)(response).pipe(\n              Effect.mapError(() => OAuthRejected.make({})),\n            );\n\n            if (encoder.encode(serialized).length > 16384) return yield* OAuthRejected.make({});\n\n            const binder = Object.freeze({\n              ...(yield* verifyBinding(request.flowId, request.requestBinding).pipe(\n                Effect.mapError(binderError),\n              )),\n            });\n\n            const state = yield* stateDigest(request.flowId, request.provider, response.state);\n\n            const random = yield* randomBytes(32).pipe(\n              Effect.mapError(() => OAuthUnavailable.make({})),\n            );\n\n            const claimId = OAuthClaimId.make(Encoding.encodeBase64Url(random));\n\n            random.fill(0);\n\n            const input = Object.freeze({\n              moduleId: id,\n              generation: policy.generation,\n              flowId: request.flowId,\n              provider: request.provider,\n              callbackId: request.callbackId,\n              stateDigest: state,\n              requestBindingVerifier: binder.verifier,\n              requestBindingExpiresAtMillis: binder.expiresAtMillis,\n              claimId,\n              ...(response.issuer === undefined ? {} : { responseIssuer: response.issuer }),\n              nowMillis: DateTime.toEpochMillis(yield* DateTime.now),\n            });\n\n            const settled = yield* Effect.uninterruptibleMask((restore) =>\n              Effect.gen(function* () {\n                const receipt = yield* restore(\n                  claim(input, (decision, journal) =>\n                    journal.prepare(snapshotOAuthSync(OAuthClaimDecision, decision)),\n                  ),\n                );\n\n                const decision = yield* read(receipt);\n\n                if (decision._tag !== \"Claimed\") return yield* OAuthRejected.make({});\n                const owned = snapshotOAuthSync(OAuthClaim, decision.claim);\n                const context = owned.flow.context;\n\n                if (\n                  owned.claimId !== claimId ||\n                  context.moduleId !== id ||\n                  context.generation !== policy.generation ||\n                  context.flowId !== request.flowId ||\n                  context.provider !== request.provider ||\n                  context.callbackId !== request.callbackId ||\n                  context.stateDigest !== state ||\n                  context.requestBindingVerifier !== binder.verifier ||\n                  context.requestBindingExpiresAtMillis !== binder.expiresAtMillis ||\n                  owned.claimedAtMillis < context.issuedAtMillis ||\n                  owned.claimedAtMillis >= context.expiresAtMillis ||\n                  context.expiresAtMillis > context.requestBindingExpiresAtMillis ||\n                  owned.claimExpiresAtMillis !==\n                    owned.claimedAtMillis + context.claimLifetimeMillis ||\n                  owned.flow.retentionUntilMillis < owned.claimExpiresAtMillis ||\n                  (context.responseIssuerMode === \"required\"\n                    ? response.issuer !== context.issuer\n                    : response.issuer !== undefined)\n                )\n                  return yield* OAuthUnavailable.make({});\n                let verifiedAt = owned.claimedAtMillis;\n\n                const exchange = Effect.gen(function* () {\n                  const secrets = yield* open({\n                    context: snapshotOAuthSync(OAuthSignInTransactionContext, context),\n                    sealed: snapshotOAuthSync(OAuthSealedTransaction, owned.flow.sealed),\n                  }).pipe(Effect.flatMap((value) => snapshotOAuth(OAuthTransactionSecrets, value)));\n\n                  if (\n                    (context.protocol === \"oidc\") !== (secrets.oidcNonce !== undefined) ||\n                    (yield* stateDigest(context.flowId, context.provider, secrets.state)) !==\n                      context.stateDigest ||\n                    Redacted.value(secrets.state) !== Redacted.value(response.state)\n                  )\n                    return yield* OAuthUnavailable.make({});\n                  if (response._tag !== \"Code\") return yield* OAuthProtocolRejected.make({});\n                  const start = yield* DateTime.now;\n\n                  verifiedAt = DateTime.toEpochMillis(start);\n                  if (verifiedAt >= owned.claimExpiresAtMillis)\n                    return yield* OAuthUnavailable.make({});\n\n                  const identity = yield* exchangeVerifiedIdentity({\n                    configuration: snapshotOAuthSync(OAuthProtocolConfiguration, context),\n                    response: snapshotOAuthSync(OAuthCallbackResponse, response) as typeof response,\n                    secrets: snapshotOAuthSync(OAuthTransactionSecrets, secrets),\n                    verificationStartedAt: start,\n                  }).pipe(\n                    Effect.flatMap((value) => snapshotOAuth(OAuthVerifiedExternalIdentity, value)),\n                  );\n\n                  if (\n                    identity.identity.provider !== context.provider ||\n                    identity.identity.issuer !== context.issuer\n                  )\n                    return yield* OAuthProtocolRejected.make({});\n                  if (identity.upstreamAuthenticatedAt !== undefined)\n                    verifiedAt = Math.min(\n                      verifiedAt,\n                      DateTime.toEpochMillis(identity.upstreamAuthenticatedAt),\n                    );\n\n                  return identity;\n                });\n\n                const remaining = Math.max(\n                  1,\n                  owned.claimExpiresAtMillis - DateTime.toEpochMillis(yield* DateTime.now),\n                );\n\n                const exchanged =\n                  response._tag === \"Error\"\n                    ? undefined\n                    : yield* Effect.exit(restore(bounded(exchange, remaining)));\n\n                const definiteRejection =\n                  exchanged !== undefined &&\n                  Exit.isFailure(exchanged) &&\n                  exchanged.cause.reasons.length === 1 &&\n                  exchanged.cause.reasons[0]?._tag === \"Fail\" &&\n                  Schema.is(OAuthProtocolRejected)(exchanged.cause.reasons[0].error);\n\n                if (exchanged !== undefined && Exit.isFailure(exchanged) && !definiteRejection)\n                  yield* reportAuthFailure(\"oauth-exchange\", exchanged.cause);\n\n                let outcome =\n                  exchanged === undefined\n                    ? { _tag: \"Cancelled\" as const }\n                    : Exit.isSuccess(exchanged)\n                      ? { _tag: \"Verified\" as const, identity: exchanged.value }\n                      : definiteRejection\n                        ? { _tag: \"Rejected\" as const }\n                        : { _tag: \"Ambiguous\" as const };\n\n                let registrationPrepared: Effect.Success<\n                  ReturnType<typeof registrationSecrets.prepare>\n                >;\n\n                if (outcome._tag === \"Verified\" && registration !== undefined) {\n                  const prepared = yield* Effect.exit(\n                    bounded(\n                      registrationSecrets.prepare(\n                        owned,\n                        outcome.identity,\n                        verifiedAt,\n                        registration.policy,\n                      ),\n                      remaining,\n                    ),\n                  );\n\n                  if (Exit.isSuccess(prepared)) registrationPrepared = prepared.value;\n                  else {\n                    yield* reportAuthFailure(\"oauth-sign-in\", prepared.cause);\n                    outcome = { _tag: \"Ambiguous\" };\n                  }\n                }\n                const intentCodec = Schema.fromJsonString(OAuthRegistrationIntent);\n\n                const expectedIntent =\n                  registrationPrepared === undefined\n                    ? undefined\n                    : Schema.encodeSync(intentCodec)(registrationPrepared.intent);\n\n                const prepare: PrepareOAuthCommit<\n                  OAuthRegistrationSettlement,\n                  OAuthRegistrationSettlement\n                > = (value, journal) => {\n                  const result = snapshotOAuthSync(OAuthRegistrationSettlement, value);\n\n                  if (result._tag === \"RegistrationIssued\") {\n                    if (\n                      outcome._tag !== \"Verified\" ||\n                      expectedIntent === undefined ||\n                      Schema.encodeSync(intentCodec)(result.intent) !== expectedIntent\n                    )\n                      throw OAuthUnavailable.make({});\n                  } else if (result._tag !== \"Rejected\" && result._tag !== outcome._tag)\n                    throw OAuthUnavailable.make({});\n\n                  return journal.prepare(result);\n                };\n\n                const nowMillis = DateTime.toEpochMillis(yield* DateTime.now);\n\n                const commit =\n                  outcome._tag === \"Verified\" && registration !== undefined\n                    ? registration.settle(\n                        {\n                          claim: snapshotOAuthSync(OAuthClaim, owned),\n                          identity: snapshotOAuthSync(\n                            OAuthVerifiedExternalIdentity,\n                            outcome.identity,\n                          ),\n                          ...(registrationPrepared === undefined\n                            ? {}\n                            : {\n                                intent: snapshotOAuthSync(\n                                  OAuthRegistrationIntent,\n                                  registrationPrepared.intent,\n                                ),\n                              }),\n                          nowMillis,\n                        },\n                        prepare,\n                      )\n                    : settle(\n                        { claim: snapshotOAuthSync(OAuthClaim, owned), outcome, nowMillis },\n                        prepare,\n                      );\n\n                const finished = yield* bounded(commit, policy.settlementTimeoutMillis).pipe(\n                  Effect.flatMap(read),\n                  Effect.mapError(() => OAuthUnavailable.make({})),\n                );\n\n                return {\n                  finished,\n                  registrationCommand: registrationPrepared?.command,\n                  context,\n                  verifiedAt,\n                  identity: outcome._tag === \"Verified\" ? outcome.identity : undefined,\n                };\n              }),\n            );\n\n            const { finished, context, verifiedAt, identity, registrationCommand } = settled;\n\n            if (finished._tag === \"RegistrationIssued\") {\n              if (registrationCommand === undefined) return yield* OAuthUnavailable.make({});\n\n              return {\n                value: {\n                  _tag: \"RegistrationRequired\" as const,\n                  reference: finished.intent.reference,\n                  expiresAtMillis: finished.intent.expiresAtMillis,\n                  returnTarget: context.returnTarget,\n                },\n                credentialCommands: [registrationCommand],\n              };\n            }\n\n            if (finished._tag === \"Cancelled\")\n              return {\n                value: { _tag: \"Cancelled\" as const, returnTarget: context.returnTarget },\n                credentialCommands: [{ _tag: \"Clear\" as const, slot: \"request-binding\" as const }],\n              };\n            if (finished._tag === \"Ambiguous\") return yield* OAuthUnavailable.make({});\n            if (finished._tag !== \"Verified\" || identity === undefined)\n              return yield* OAuthRejected.make({});\n            const credential = snapshotOAuthSync(OAuthCredentialSnapshot, finished.credential);\n\n            if (\n              credential.moduleId !== id ||\n              credential.identity.provider !== identity.identity.provider ||\n              credential.identity.issuer !== identity.identity.issuer ||\n              credential.identity.subject !== identity.identity.subject ||\n              new Set(credential.revision.credentials.map((item) => item.credentialId)).size !==\n                credential.revision.credentials.length ||\n              !credential.revision.credentials.some(\n                (item) =>\n                  item.credentialId === credential.credentialId &&\n                  item.revision === credential.credentialRevision,\n              )\n            )\n              return yield* OAuthUnavailable.make({});\n\n            const bindingDigest = yield* hash(\n              yield* Schema.encodeEffect(contextJson)(context).pipe(\n                Effect.mapError(() => OAuthUnavailable.make({})),\n              ),\n            );\n\n            const claims = yield* resolveClaims(\n              snapshotOAuthSync(OAuthCredentialSnapshot, credential),\n              snapshotOAuthSync(OAuthVerifiedExternalIdentity, identity),\n            );\n\n            const established = yield* completeAuthentication({\n              claims,\n              evidence: {\n                revision: credential.revision,\n                flowId: AuthenticationFlowId.make(context.flowId),\n                bindingDigest,\n                proofs: [\n                  {\n                    method: context.protocol,\n                    credentialId: credential.credentialId,\n                    factors: [\"possession\"],\n                    userVerified: false,\n                    phishingResistant: false,\n                    verifiedAt: DateTime.makeUnsafe(verifiedAt),\n                  },\n                ],\n              },\n            }).pipe(\n              Effect.mapError((error) =>\n                error._tag === \"HookDenied\"\n                  ? error\n                  : error._tag === \"SessionUnavailable\"\n                    ? OAuthUnavailable.make({})\n                    : OAuthRejected.make({}),\n              ),\n              Effect.flatMap(read),\n            );\n\n            return {\n              value: { completion: established.value, returnTarget: context.returnTarget },\n              credentialCommands: [\n                ...established.credentialCommands,\n                { _tag: \"Clear\" as const, slot: \"request-binding\" as const },\n              ],\n            };\n          },\n          Effect.provideService(Crypto.Crypto, crypto),\n          Effect.tapCause((cause) =>\n            Cause.hasDies(cause) ? reportAuthFailure(\"oauth-sign-in\", cause) : Effect.void,\n          ),\n          Effect.catchDefect(() => Effect.fail(OAuthUnavailable.make({}))),\n        );\n\n        return SignIn.of({ begin, complete });\n      }),\n    );\n  };\n\n  const signInLayer = (configuration: OAuthSignInPolicy) =>\n    makeSignInLayer(configuration, Effect.succeed(undefined));\n\n  const registration = <Registration extends Schema.Codec<unknown, unknown, unknown, unknown>>(\n    codec: Registration,\n  ) => {\n    const capability = makeOAuthRegistration(moduleId, codec, binding);\n\n    const registrationSignInLayer = (\n      configuration: OAuthSignInPolicy,\n      registrationConfiguration: OAuthRegistrationPolicy,\n    ) => {\n      let captured: OAuthRegistrationPolicy | undefined;\n\n      try {\n        captured = snapshotOAuthSync(OAuthRegistrationPolicy, registrationConfiguration);\n      } catch {\n        /* Layer reports invalid policy. */\n      }\n\n      return makeSignInLayer(\n        configuration,\n        Effect.gen(function* () {\n          if (captured === undefined)\n            return yield* OAuthConfigurationError.make({ reason: \"policy\" });\n          const { settle } = yield* OAuthRegistrationIntents;\n\n          return { settle, policy: captured };\n        }),\n      );\n    };\n\n    return Object.freeze({\n      ...capability,\n      signInLayer: registrationSignInLayer,\n      strategy: makeAuthStrategy(\n        { register: capability.operations.Complete.invoke },\n        capability.handlersLayer.pipe(\n          Layer.provide(defaultLayer(capability.Registrations, capability.layer)),\n          Layer.provide(defaultLayer(binding.RequestBinding, binding.layer)),\n          Layer.provide([cryptoLayer, hooksLayer]),\n        ),\n      ),\n    });\n  };\n\n  const Begin = makeOperation(`${moduleId}/sign-in/begin`, {\n    payload: OAuthSignInBegin,\n    success: OAuthSignInAuthorization,\n    error: Failure,\n    access: \"any\",\n    exposure: \"public\",\n    replay: \"non-idempotent\",\n    credentials: true,\n  });\n\n  const Complete = makeOperation(`${moduleId}/sign-in/complete`, {\n    payload: OAuthSignInComplete,\n    success: CompletionResult,\n    error: Failure,\n    access: \"any\",\n    exposure: \"public\",\n    replay: \"single-use\",\n    credentials: true,\n  });\n\n  const handlersLayer = Layer.mergeAll(\n    Begin.credentialHandlerLayer(\n      Effect.fn(\"OAuth.Begin\")(function* (input) {\n        return yield* (yield* SignIn).begin(input);\n      }),\n    ),\n    Complete.credentialHandlerLayer(\n      Effect.fn(\"OAuth.Complete\")(function* (input) {\n        return yield* (yield* SignIn).complete(input);\n      }),\n    ),\n  );\n\n  const layer = (policy: OAuthSignInPolicy) =>\n    handlersLayer.pipe(\n      Layer.provide(defaultLayer(SignIn, signInLayer(policy))),\n      Layer.provide(defaultLayer(binding.RequestBinding, binding.layer)),\n      Layer.provide([cryptoLayer, hooksLayer]),\n    );\n\n  const accounts = (policy: OAuthAccountsPolicy) => {\n    const module = makeOAuthAccounts(moduleId, sessions, policy);\n\n    return Object.freeze({\n      ...module,\n      strategy: makeAuthStrategy(\n        {\n          linkAccount: module.operations.Link.Begin.invoke,\n          completeAccountLink: module.operations.Link.Complete.invoke,\n          unlinkAccount: module.operations.Unlink.invoke,\n        },\n        module.handlersLayer.pipe(\n          Layer.provide(defaultLayer(module.Accounts, module.layer)),\n          Layer.provide(defaultLayer(module.binding.RequestBinding, module.binding.layer)),\n          Layer.provide([cryptoLayer, hooksLayer]),\n        ),\n      ),\n    });\n  };\n\n  const connected = (policy: OAuthConnectedPolicy) => {\n    const module = makeOAuthConnected(moduleId, policy);\n\n    return Object.freeze({\n      ...module,\n      strategy: makeAuthStrategy(\n        {\n          connectAccount: module.operations.Begin.invoke,\n          completeAccountConnection: module.operations.Complete.invoke,\n          listAccountConnections: module.operations.List.invoke,\n          disconnectAccount: module.operations.Disconnect.invoke,\n        },\n        module.handlersLayer.pipe(\n          Layer.provide(defaultLayer(module.Connected, module.layer)),\n          Layer.provide(defaultLayer(module.binding.RequestBinding, module.binding.layer)),\n          Layer.provide([cryptoLayer, hooksLayer]),\n        ),\n      ),\n    });\n  };\n\n  return Object.freeze({\n    binding,\n    ClaimsForOAuth,\n    SignIn,\n    signInLayer,\n    layer,\n    registration,\n    accounts,\n    connected,\n    CompletionResult,\n    operations: Object.freeze({ Begin, Complete }),\n    handlersLayer,\n    group: operationGroup(Begin, Complete),\n  });\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAyEA,MAAM,UAAU,OAAO,MAAM;CAAC;CAAe;CAAkB;CAAwB;AAAU,CAAC;AAIlG,MAAM,YAAY,OAAO,GAAG,iBAAiB,CAAC,CAAC,aAAa;CAC1D,IAAI,OAAO,gBAAgB,OAAO,OAAO,uBAAuB,KAAK,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,QAAW,YACf,QAAQ,KAAK,KAAK,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC;AAEpE,MAAM,UAAU,IAAI,YAAY;AAIhC,MAAM,WAAoB,QAAgC,WACxD,OAAO,IAAI,aAAa;CACtB,MAAM,QAAQ,OAAO,OAAO,KAAK,OAAO,eAAe,OAAO,UAAU;CAExE,OAAO,OAAO,MAAM,KAAK,KAAK,CAAC,CAAC,KAC9B,OAAO,QAAQ,MAAM,GACrB,OAAO,SAAS,MAAM,UAAU,KAAK,CAAC,CAAC,KAAK,OAAO,YAAY,OAAO,MAAM,CAAC,CAC/E;AACF,CAAC;AAEH,MAAM,WAAW,OAAO,eAAe,gBAAgB;AACvD,MAAM,cAAc,OAAO,eAAe,6BAA6B;AACvE,MAAM,eAAe,OAAO,eAAe,qBAAqB;AAEhE,MAAM,eAAe,OAAO,eAC1B,OAAO,MAAM;CACX,OAAO,QAAQ,4BAA4B;CAC3C;CACA,kBAAkB,OAAO;CACzB,iBAAiB,OAAO;CACxB,iBAAiB,OAAO;CACxB,OAAO,OAAO,MAAM,OAAO,UAAU,qBAAqB,CAAC;AAC7D,CAAC,CACH;;;;;AAYA,MAAa,mBAKX,UACA,YAGG;CACH,MAAM,WAAW,QAAQ;CACzB,MAAM,UAAU,mBAAmB,UAAU,aAAa;CAE1D,MAAM,iBAAiB,QAAQ,QAU7B,qBAAqB,SAAS,OAAO,GAAG,SAAS,QAAQ;CAE3D,MAAM,mBAAmB,OAAO,MAAM;EACpC,OAAO,OAAO;GAAE,YAAY,SAAS;GAAkB,cAAc;EAAkB,CAAC;EACxF,OAAO,aAAa,aAAa,EAAE,cAAc,kBAAkB,CAAC;EACpE;CACF,CAAC;CAID,MAAM,SAAS,QAAQ,QAUrB,qBAAqB,SAAS,OAAO,GAAG,SAAS,QAAQ;CAE3D,MAAM,mBACJ,eACA,uBASG;EACH,IAAI;EAEJ,IAAI;GACF,WAAW,kBAAkB,mBAAmB,aAAa;EAC/D,QAAQ,CAER;EAEA,OAAO,MAAM,OACX,QACA,OAAO,IAAI,aAAa;GACtB,MAAM,KAAK,OAAO,OAAO,aAAa,aAAa,CAAC,CAAC,QAAQ,CAAC,CAAC,KAC7D,OAAO,eAAe,wBAAwB,KAAK,EAAE,QAAQ,SAAS,CAAC,CAAC,CAC1E;GAEA,IAAI,aAAa,KAAA,GACf,OAAO,OAAO,wBAAwB,KAAK,EAAE,QAAQ,SAAS,CAAC;GACjE,MAAM,SAAS;GACf,MAAM,eAAe,OAAO;GAC5B,MAAM,EAAE,OAAO,cAAc,QAAQ,kBAAkB,OAAO,QAAQ;GACtE,MAAM,EAAE,sBAAsB,6BAA6B,OAAO;GAClE,MAAM,EAAE,SAAS,iBAAiB,OAAO;GACzC,MAAM,EAAE,MAAM,SAAS,OAAO;GAC9B,MAAM,EAAE,OAAO,OAAO,WAAW,OAAO;GACxC,MAAM,EAAE,SAAS,kBAAkB,OAAO;GAC1C,MAAM,EAAE,SAAS,2BAA2B,OAAO,SAAS;GAC5D,MAAM,SAAS,OAAO,OAAO;GAC7B,MAAM,EAAE,aAAa,WAAW;GAEhC,MAAM,OAAO,OAAO,GAAG,YAAY,CAAC,CAAC,WAAW,SAAiB;IAC/D,MAAM,SAAS,OAAO,OAAO,WAAW,QAAQ,OAAO,OAAO,CAAC,CAAC,CAAC,KAC/D,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CACjD;IAEA,OAAO,YAAY,KAAK,SAAS,gBAAgB,MAAM,CAAC;GAC1D,CAAC;GAED,MAAM,cAAc,OAAO,GAAG,mBAAmB,CAAC,CAAC,WACjD,QACA,UACA,OACA;IACA,MAAM,MAAM,SAAS,MAAM,KAAK;IAEhC,IAAI,CAAC,OAAO,GAAG,OAAO,OAAO,MAAM,OAAO,UAAU,qBAAqB,CAAC,CAAC,CAAC,CAAC,GAAG,GAC9E,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;IACrC,MAAM,QAAQ,OAAO,eAAe,SAAS,gBAAgB,GAAG,CAAC;IAEjE,IACE,UAAU,KAAA,KACV,MAAM,WAAW,MACjB,SAAS,gBAAgB,KAAK,MAAM,KACpC;KACA,OAAO,KAAK,CAAC;KAEb,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;IACrC;IACA,MAAM,KAAK,CAAC;IAEZ,MAAM,UAAU,OAAO,OAAO,aAAa,YAAY,CAAC,CAAC;KACvD;KACA;KACA,OAAO;KACP;KACA;KACA;IACF,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC;IAExD,OAAO,OAAO,KAAK,OAAO;GAC5B,CAAC;GAED,MAAM,eAAe,UACnB,MAAM,SAAS,0BACX,cAAc,KAAK,CAAC,CAAC,IACrB,iBAAiB,KAAK,CAAC,CAAC;GAE9B,MAAM,QAAQ,OAAO,GAAG,oBAAoB,CAAC,CAC3C,WAAW,KAAmC;IAC5C,OAAO,UAAU;IACjB,MAAM,UAAU,OAAO,cAAc,kBAAkB,GAAG;IAC1D,MAAM,SAAS,OAAO,aAAa,QAAQ,YAAY;IAEvD,MAAM,kBAAkB,OAAO,OAAO,aAAa,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,KAC5E,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CACjD;IAEA,MAAM,gBAAgB,OAAO,aAAa,QAAQ,MAAM,CAAC,CAAC,KACxD,OAAO,SAAS,WAAW,CAC7B;IAEA,MAAM,WAAW,cAAc,mBAAmB;IAElD,IACE,cAAc,mBAAmB,WAAW,KAC5C,UAAU,SAAS,WACnB,SAAS,SAAS,qBAClB,cAAc,MAAM,WAAW,QAAQ,UACvC,SAAS,oBAAoB,cAAc,MAAM,iBAEjD,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IAExC,MAAM,UAAU,OAAO,OAAO;KAC5B,MAAM;KACN,MAAM;KACN,YAAY,SAAS,KAAK,SAAS,MAAM,SAAS,UAAU,CAAC;KAC7D,iBAAiB,SAAS;IAC5B,CAAC;IAED,MAAM,SAAS,OAAO,OAAO,EAC3B,GAAI,OAAO,cACT,QAAQ,QACR,SAAS,KAAK,SAAS,MAAM,QAAQ,UAAU,CAAC,CAClD,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC,EACrC,CAAC;IAED,IAAI,OAAO,oBAAoB,QAAQ,iBACrC,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IAExC,MAAM,WAAW,OAAO,qBACtB,OAAO,OAAO;KACZ,UAAU,QAAQ;KAClB,YAAY,QAAQ;KACpB,QAAQ,QAAQ;IAClB,CAAC,CACH,CAAC,CAAC,KAAK,OAAO,SAAS,UAAU,cAAc,0BAA0B,KAAK,CAAC,CAAC;IAEhF,IACE,SAAS,cAAc,aAAa,QAAQ,YAC5C,SAAS,cAAc,eAAe,QAAQ,cAC7C,SAAS,cAAc,aAAa,YAClC,SAAS,QAAQ,cAAc,KAAA,IAElC,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IACxC,MAAM,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG;IACtD,MAAM,kBAAkB,KAAK,IAAI,MAAM,OAAO,gBAAgB,OAAO,eAAe;IAEpF,IAAI,mBAAmB,KAAK,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;IAE/D,MAAM,UAAU,OAAO,cAAc,+BAA+B;KAClE,WAAW;KACX,UAAU;KACV,YAAY,OAAO;KACnB,QAAQ,QAAQ;KAChB,WAAW,QAAQ;KACnB,GAAG,SAAS;KACZ,cAAc;KACd,aAAa,OAAO,YAClB,QAAQ,QACR,QAAQ,UACR,SAAS,QAAQ,KACnB,CAAC,CAAC,KAAK,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC;KACvD,wBAAwB,OAAO;KAC/B,+BAA+B,OAAO;KACtC,gBAAgB;KAChB;KACA,qBAAqB,OAAO;IAC9B,CAAC;IAED,MAAM,SAAS,OAAO,KAAK;KACzB,SAAS,kBAAkB,+BAA+B,OAAO;KACjE,SAAS,kBAAkB,yBAAyB,SAAS,OAAO;IACtE,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,UAAU,cAAc,wBAAwB,KAAK,CAAC,CAAC;IAE/E,MAAM,OAAO,kBAAkB,kBAAkB;KAC/C;KACA;KACA,sBAAsB,kBAAkB,OAAO;IACjD,CAAC;IAED,MAAM,WAAW,OAAO,WAAW,QAAQ,CAAC,CAAC,IAAI;IASjD,MAAM,UAAU,OAAO,MACrB,kBAAkB,kBAAkB,IAAI,IACvC,UAAU,YAAY;KACrB,MAAM,UAAU,kBAAkB,oBAAoB,QAAQ;KAE9D,IAAI,QAAQ,SAAS,YACnB,OAAO,QAAQ,QAAQ,EAAE,MAAM,WAAoB,CAAC;KACtD,IAAI,OAAO,WAAW,QAAQ,CAAC,CAAC,QAAQ,IAAI,MAAM,UAChD,MAAM,iBAAiB,KAAK,CAAC,CAAC;KAEhC,OAAO,QAAQ,QAAQ;MACrB,MAAM;MACN,QAAQ,OAAO,OAAO;OACpB,OAAO,OAAO,OAAO;QACnB,QAAQ,QAAQ;QAChB,kBAAkB,SAAS;QAC3B;OACF,CAAC;OACD,oBAAoB,OAAO,OAAO,CAAC,OAAO,CAAC;MAC7C,CAAC;KACH,CAAC;IACH,CACF;IAEA,MAAM,YAAY,OAAO,KAAK,OAAO;IAErC,IAAI,UAAU,SAAS,YAAY,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;IAEtE,OAAO,UAAU;GACnB,GACA,OAAO,UAAU,UACf,MAAM,QAAQ,KAAK,IAAI,kBAAkB,iBAAiB,KAAK,IAAI,OAAO,IAC5E,GACA,OAAO,kBAAkB,OAAO,KAAK,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC,CACjE;GAEA,MAAM,WAAW,OAAO,GAAG,uBAAuB,CAAC,CACjD,WAAW,KAAsC;IAC/C,OAAO,UAAU;IACjB,MAAM,UAAU,OAAO,cAAc,qBAAqB,GAAG;IAC7D,MAAM,WAAW,QAAQ;IAEzB,MAAM,aAAa,OAAO,OAAO,aAAa,YAAY,CAAC,CAAC,QAAQ,CAAC,CAAC,KACpE,OAAO,eAAe,cAAc,KAAK,CAAC,CAAC,CAAC,CAC9C;IAEA,IAAI,QAAQ,OAAO,UAAU,CAAC,CAAC,SAAS,OAAO,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;IAElF,MAAM,SAAS,OAAO,OAAO,EAC3B,GAAI,OAAO,cAAc,QAAQ,QAAQ,QAAQ,cAAc,CAAC,CAAC,KAC/D,OAAO,SAAS,WAAW,CAC7B,EACF,CAAC;IAED,MAAM,QAAQ,OAAO,YAAY,QAAQ,QAAQ,QAAQ,UAAU,SAAS,KAAK;IAEjF,MAAM,SAAS,OAAO,YAAY,EAAE,CAAC,CAAC,KACpC,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CACjD;IAEA,MAAM,UAAU,aAAa,KAAK,SAAS,gBAAgB,MAAM,CAAC;IAElE,OAAO,KAAK,CAAC;IAEb,MAAM,QAAQ,OAAO,OAAO;KAC1B,UAAU;KACV,YAAY,OAAO;KACnB,QAAQ,QAAQ;KAChB,UAAU,QAAQ;KAClB,YAAY,QAAQ;KACpB,aAAa;KACb,wBAAwB,OAAO;KAC/B,+BAA+B,OAAO;KACtC;KACA,GAAI,SAAS,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,gBAAgB,SAAS,OAAO;KAC3E,WAAW,SAAS,cAAc,OAAO,SAAS,GAAG;IACvD,CAAC;IA2MD,MAAM,EAAE,UAAU,SAAS,YAAY,UAAU,wBAAwB,OAzMlD,OAAO,qBAAqB,YACjD,OAAO,IAAI,aAAa;KACtB,MAAM,UAAU,OAAO,QACrB,MAAM,QAAQ,UAAU,YACtB,QAAQ,QAAQ,kBAAkB,oBAAoB,QAAQ,CAAC,CACjE,CACF;KAEA,MAAM,WAAW,OAAO,KAAK,OAAO;KAEpC,IAAI,SAAS,SAAS,WAAW,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;KACpE,MAAM,QAAQ,kBAAkB,YAAY,SAAS,KAAK;KAC1D,MAAM,UAAU,MAAM,KAAK;KAE3B,IACE,MAAM,YAAY,WAClB,QAAQ,aAAa,MACrB,QAAQ,eAAe,OAAO,cAC9B,QAAQ,WAAW,QAAQ,UAC3B,QAAQ,aAAa,QAAQ,YAC7B,QAAQ,eAAe,QAAQ,cAC/B,QAAQ,gBAAgB,SACxB,QAAQ,2BAA2B,OAAO,YAC1C,QAAQ,kCAAkC,OAAO,mBACjD,MAAM,kBAAkB,QAAQ,kBAChC,MAAM,mBAAmB,QAAQ,mBACjC,QAAQ,kBAAkB,QAAQ,iCAClC,MAAM,yBACJ,MAAM,kBAAkB,QAAQ,uBAClC,MAAM,KAAK,uBAAuB,MAAM,yBACvC,QAAQ,uBAAuB,aAC5B,SAAS,WAAW,QAAQ,SAC5B,SAAS,WAAW,KAAA,IAExB,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;KACxC,IAAI,aAAa,MAAM;KAEvB,MAAM,WAAW,OAAO,IAAI,aAAa;MACvC,MAAM,UAAU,OAAO,KAAK;OAC1B,SAAS,kBAAkB,+BAA+B,OAAO;OACjE,QAAQ,kBAAkB,wBAAwB,MAAM,KAAK,MAAM;MACrE,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,UAAU,cAAc,yBAAyB,KAAK,CAAC,CAAC;MAEhF,IACG,QAAQ,aAAa,YAAa,QAAQ,cAAc,KAAA,OACxD,OAAO,YAAY,QAAQ,QAAQ,QAAQ,UAAU,QAAQ,KAAK,OACjE,QAAQ,eACV,SAAS,MAAM,QAAQ,KAAK,MAAM,SAAS,MAAM,SAAS,KAAK,GAE/D,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;MACxC,IAAI,SAAS,SAAS,QAAQ,OAAO,OAAO,sBAAsB,KAAK,CAAC,CAAC;MACzE,MAAM,QAAQ,OAAO,SAAS;MAE9B,aAAa,SAAS,cAAc,KAAK;MACzC,IAAI,cAAc,MAAM,sBACtB,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;MAExC,MAAM,WAAW,OAAO,yBAAyB;OAC/C,eAAe,kBAAkB,4BAA4B,OAAO;OACpE,UAAU,kBAAkB,uBAAuB,QAAQ;OAC3D,SAAS,kBAAkB,yBAAyB,OAAO;OAC3D,uBAAuB;MACzB,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,UAAU,cAAc,+BAA+B,KAAK,CAAC,CAC/E;MAEA,IACE,SAAS,SAAS,aAAa,QAAQ,YACvC,SAAS,SAAS,WAAW,QAAQ,QAErC,OAAO,OAAO,sBAAsB,KAAK,CAAC,CAAC;MAC7C,IAAI,SAAS,4BAA4B,KAAA,GACvC,aAAa,KAAK,IAChB,YACA,SAAS,cAAc,SAAS,uBAAuB,CACzD;MAEF,OAAO;KACT,CAAC;KAED,MAAM,YAAY,KAAK,IACrB,GACA,MAAM,uBAAuB,SAAS,cAAc,OAAO,SAAS,GAAG,CACzE;KAEA,MAAM,YACJ,SAAS,SAAS,UACd,KAAA,IACA,OAAO,OAAO,KAAK,QAAQ,QAAQ,UAAU,SAAS,CAAC,CAAC;KAE9D,MAAM,oBACJ,cAAc,KAAA,KACd,KAAK,UAAU,SAAS,KACxB,UAAU,MAAM,QAAQ,WAAW,KACnC,UAAU,MAAM,QAAQ,EAAE,EAAE,SAAS,UACrC,OAAO,GAAG,qBAAqB,CAAC,CAAC,UAAU,MAAM,QAAQ,EAAE,CAAC,KAAK;KAEnE,IAAI,cAAc,KAAA,KAAa,KAAK,UAAU,SAAS,KAAK,CAAC,mBAC3D,OAAO,kBAAkB,kBAAkB,UAAU,KAAK;KAE5D,IAAI,UACF,cAAc,KAAA,IACV,EAAE,MAAM,YAAqB,IAC7B,KAAK,UAAU,SAAS,IACtB;MAAE,MAAM;MAAqB,UAAU,UAAU;KAAM,IACvD,oBACE,EAAE,MAAM,WAAoB,IAC5B,EAAE,MAAM,YAAqB;KAEvC,IAAI;KAIJ,IAAI,QAAQ,SAAS,cAAc,iBAAiB,KAAA,GAAW;MAC7D,MAAM,WAAW,OAAO,OAAO,KAC7B,QACEA,QACE,OACA,QAAQ,UACR,YACA,aAAa,MACf,GACA,SACF,CACF;MAEA,IAAI,KAAK,UAAU,QAAQ,GAAG,uBAAuB,SAAS;WACzD;OACH,OAAO,kBAAkB,iBAAiB,SAAS,KAAK;OACxD,UAAU,EAAE,MAAM,YAAY;MAChC;KACF;KACA,MAAM,cAAc,OAAO,eAAe,uBAAuB;KAEjE,MAAM,iBACJ,yBAAyB,KAAA,IACrB,KAAA,IACA,OAAO,WAAW,WAAW,CAAC,CAAC,qBAAqB,MAAM;KAEhE,MAAMC,aAGD,OAAO,YAAY;MACtB,MAAM,SAAS,kBAAkB,6BAA6B,KAAK;MAEnE,IAAI,OAAO,SAAS,sBAEhB;WAAA,QAAQ,SAAS,cACjB,mBAAmB,KAAA,KACnB,OAAO,WAAW,WAAW,CAAC,CAAC,OAAO,MAAM,MAAM,gBAElD,MAAM,iBAAiB,KAAK,CAAC,CAAC;MAAA,OAC3B,IAAI,OAAO,SAAS,cAAc,OAAO,SAAS,QAAQ,MAC/D,MAAM,iBAAiB,KAAK,CAAC,CAAC;MAEhC,OAAO,QAAQ,QAAQ,MAAM;KAC/B;KAEA,MAAM,YAAY,SAAS,cAAc,OAAO,SAAS,GAAG;KAE5D,MAAM,SACJ,QAAQ,SAAS,cAAc,iBAAiB,KAAA,IAC5C,aAAa,OACX;MACE,OAAO,kBAAkB,YAAY,KAAK;MAC1C,UAAU,kBACR,+BACA,QAAQ,QACV;MACA,GAAI,yBAAyB,KAAA,IACzB,CAAC,IACD,EACE,QAAQ,kBACN,yBACA,qBAAqB,MACvB,EACF;MACJ;KACF,GACAA,SACF,IACA,OACE;MAAE,OAAO,kBAAkB,YAAY,KAAK;MAAG;MAAS;KAAU,GAClEA,SACF;KAON,OAAO;MACL,UAAA,OANsB,QAAQ,QAAQ,OAAO,uBAAuB,CAAC,CAAC,KACtE,OAAO,QAAQ,IAAI,GACnB,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CACjD;MAIE,qBAAqB,sBAAsB;MAC3C;MACA;MACA,UAAU,QAAQ,SAAS,aAAa,QAAQ,WAAW,KAAA;KAC7D;IACF,CAAC,CACH;IAIA,IAAI,SAAS,SAAS,sBAAsB;KAC1C,IAAI,wBAAwB,KAAA,GAAW,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;KAE7E,OAAO;MACL,OAAO;OACL,MAAM;OACN,WAAW,SAAS,OAAO;OAC3B,iBAAiB,SAAS,OAAO;OACjC,cAAc,QAAQ;MACxB;MACA,oBAAoB,CAAC,mBAAmB;KAC1C;IACF;IAEA,IAAI,SAAS,SAAS,aACpB,OAAO;KACL,OAAO;MAAE,MAAM;MAAsB,cAAc,QAAQ;KAAa;KACxE,oBAAoB,CAAC;MAAE,MAAM;MAAkB,MAAM;KAA2B,CAAC;IACnF;IACF,IAAI,SAAS,SAAS,aAAa,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IACzE,IAAI,SAAS,SAAS,cAAc,aAAa,KAAA,GAC/C,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;IACrC,MAAM,aAAa,kBAAkB,yBAAyB,SAAS,UAAU;IAEjF,IACE,WAAW,aAAa,MACxB,WAAW,SAAS,aAAa,SAAS,SAAS,YACnD,WAAW,SAAS,WAAW,SAAS,SAAS,UACjD,WAAW,SAAS,YAAY,SAAS,SAAS,WAClD,IAAI,IAAI,WAAW,SAAS,YAAY,KAAK,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,SACxE,WAAW,SAAS,YAAY,UAClC,CAAC,WAAW,SAAS,YAAY,MAC9B,SACC,KAAK,iBAAiB,WAAW,gBACjC,KAAK,aAAa,WAAW,kBACjC,GAEA,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IAExC,MAAM,gBAAgB,OAAO,KAC3B,OAAO,OAAO,aAAa,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,KAC/C,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CACjD,CACF;IAEA,MAAM,SAAS,OAAO,cACpB,kBAAkB,yBAAyB,UAAU,GACrD,kBAAkB,+BAA+B,QAAQ,CAC3D;IAEA,MAAM,cAAc,OAAO,uBAAuB;KAChD;KACA,UAAU;MACR,UAAU,WAAW;MACrB,QAAQ,qBAAqB,KAAK,QAAQ,MAAM;MAChD;MACA,QAAQ,CACN;OACE,QAAQ,QAAQ;OAChB,cAAc,WAAW;OACzB,SAAS,CAAC,YAAY;OACtB,cAAc;OACd,mBAAmB;OACnB,YAAY,SAAS,WAAW,UAAU;MAC5C,CACF;KACF;IACF,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,UACf,MAAM,SAAS,eACX,QACA,MAAM,SAAS,uBACb,iBAAiB,KAAK,CAAC,CAAC,IACxB,cAAc,KAAK,CAAC,CAAC,CAC7B,GACA,OAAO,QAAQ,IAAI,CACrB;IAEA,OAAO;KACL,OAAO;MAAE,YAAY,YAAY;MAAO,cAAc,QAAQ;KAAa;KAC3E,oBAAoB,CAClB,GAAG,YAAY,oBACf;MAAE,MAAM;MAAkB,MAAM;KAA2B,CAC7D;IACF;GACF,GACA,OAAO,eAAe,OAAO,QAAQ,MAAM,GAC3C,OAAO,UAAU,UACf,MAAM,QAAQ,KAAK,IAAI,kBAAkB,iBAAiB,KAAK,IAAI,OAAO,IAC5E,GACA,OAAO,kBAAkB,OAAO,KAAK,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC,CACjE;GAEA,OAAO,OAAO,GAAG;IAAE;IAAO;GAAS,CAAC;EACtC,CAAC,CACH;CACF;CAEA,MAAM,eAAe,kBACnB,gBAAgB,eAAe,OAAO,QAAQ,KAAA,CAAS,CAAC;CAE1D,MAAM,gBACJ,UACG;EACH,MAAM,aAAa,sBAAsB,UAAU,OAAO,OAAO;EAEjE,MAAM,2BACJ,eACA,8BACG;GACH,IAAI;GAEJ,IAAI;IACF,WAAW,kBAAkB,yBAAyB,yBAAyB;GACjF,QAAQ,CAER;GAEA,OAAO,gBACL,eACA,OAAO,IAAI,aAAa;IACtB,IAAI,aAAa,KAAA,GACf,OAAO,OAAO,wBAAwB,KAAK,EAAE,QAAQ,SAAS,CAAC;IACjE,MAAM,EAAE,WAAW,OAAO;IAE1B,OAAO;KAAE;KAAQ,QAAQ;IAAS;GACpC,CAAC,CACH;EACF;EAEA,OAAO,OAAO,OAAO;GACnB,GAAG;GACH,aAAa;GACb,UAAU,iBACR,EAAE,UAAU,WAAW,WAAW,SAAS,OAAO,GAClD,WAAW,cAAc,KACvB,MAAM,QAAQ,aAAa,WAAW,eAAe,WAAW,KAAK,CAAC,GACtE,MAAM,QAAQ,aAAa,QAAQ,gBAAgB,QAAQ,KAAK,CAAC,GACjE,MAAM,QAAQ,CAAC,aAAa,UAAU,CAAC,CACzC,CACF;EACF,CAAC;CACH;CAEA,MAAM,QAAQ,cAAc,GAAG,SAAS,iBAAiB;EACvD,SAAS;EACT,SAAS;EACT,OAAO;EACP,QAAQ;EACR,UAAU;EACV,QAAQ;EACR,aAAa;CACf,CAAC;CAED,MAAM,WAAW,cAAc,GAAG,SAAS,oBAAoB;EAC7D,SAAS;EACT,SAAS;EACT,OAAO;EACP,QAAQ;EACR,UAAU;EACV,QAAQ;EACR,aAAa;CACf,CAAC;CAED,MAAM,gBAAgB,MAAM,SAC1B,MAAM,uBACJ,OAAO,GAAG,aAAa,CAAC,CAAC,WAAW,OAAO;EACzC,OAAO,QAAQ,OAAO,OAAA,CAAQ,MAAM,KAAK;CAC3C,CAAC,CACH,GACA,SAAS,uBACP,OAAO,GAAG,gBAAgB,CAAC,CAAC,WAAW,OAAO;EAC5C,OAAO,QAAQ,OAAO,OAAA,CAAQ,SAAS,KAAK;CAC9C,CAAC,CACH,CACF;CAEA,MAAM,SAAS,WACb,cAAc,KACZ,MAAM,QAAQ,aAAa,QAAQ,YAAY,MAAM,CAAC,CAAC,GACvD,MAAM,QAAQ,aAAa,QAAQ,gBAAgB,QAAQ,KAAK,CAAC,GACjE,MAAM,QAAQ,CAAC,aAAa,UAAU,CAAC,CACzC;CAEF,MAAM,YAAY,WAAgC;EAChD,MAAM,SAAS,kBAAkB,UAAU,UAAU,MAAM;EAE3D,OAAO,OAAO,OAAO;GACnB,GAAG;GACH,UAAU,iBACR;IACE,aAAa,OAAO,WAAW,KAAK,MAAM;IAC1C,qBAAqB,OAAO,WAAW,KAAK,SAAS;IACrD,eAAe,OAAO,WAAW,OAAO;GAC1C,GACA,OAAO,cAAc,KACnB,MAAM,QAAQ,aAAa,OAAO,UAAU,OAAO,KAAK,CAAC,GACzD,MAAM,QAAQ,aAAa,OAAO,QAAQ,gBAAgB,OAAO,QAAQ,KAAK,CAAC,GAC/E,MAAM,QAAQ,CAAC,aAAa,UAAU,CAAC,CACzC,CACF;EACF,CAAC;CACH;CAEA,MAAM,aAAa,WAAiC;EAClD,MAAM,SAAS,mBAAmB,UAAU,MAAM;EAElD,OAAO,OAAO,OAAO;GACnB,GAAG;GACH,UAAU,iBACR;IACE,gBAAgB,OAAO,WAAW,MAAM;IACxC,2BAA2B,OAAO,WAAW,SAAS;IACtD,wBAAwB,OAAO,WAAW,KAAK;IAC/C,mBAAmB,OAAO,WAAW,WAAW;GAClD,GACA,OAAO,cAAc,KACnB,MAAM,QAAQ,aAAa,OAAO,WAAW,OAAO,KAAK,CAAC,GAC1D,MAAM,QAAQ,aAAa,OAAO,QAAQ,gBAAgB,OAAO,QAAQ,KAAK,CAAC,GAC/E,MAAM,QAAQ,CAAC,aAAa,UAAU,CAAC,CACzC,CACF;EACF,CAAC;CACH;CAEA,OAAO,OAAO,OAAO;EACnB;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,YAAY,OAAO,OAAO;GAAE;GAAO;EAAS,CAAC;EAC7C;EACA,OAAO,eAAe,OAAO,QAAQ;CACvC,CAAC;AACH"}

package/dist/oauth/signInSnapshot.mjs

@@ -11,7 +11,7 @@ const freezeOAuth = (value) => {
 };
 const snapshotOAuthSync = (schema, value) => {
 	try {
-		const codec = Schema.toCodecJson(Schema.toType(schema));
+		const codec = Schema.fromJsonString(Schema.toCodecJson(Schema.toType(schema)));
 		const result = Schema.decodeSync(codec)(Schema.encodeSync(codec)(value));
 		freezeOAuth(result);
 		return result;

package/dist/oauth/signInSnapshot.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"signInSnapshot.mjs","names":[],"sources":["../../src/oauth/signInSnapshot.ts"],"sourcesContent":["import { DateTime, Effect, Predicate, Schema } from \"effect\";\n\nimport { OAuthUnavailable } from \"./signInErrors\";\n\n/** Private, bounded codecs only. Project before callbacks, then freeze the entire\n * detached graph; never retain an application's mutable response object. */\nexport const freezeOAuth = (value: unknown): void => {\n  if (!Predicate.isObjectOrArray(value) || Object.isFrozen(value)) return;\n  if (DateTime.isDateTime(value)) Object.freeze(DateTime.toPartsUtc(value));\n  for (const child of Object.values(value)) freezeOAuth(child);\n  Object.freeze(value);\n};\n\nexport const snapshotOAuthSync = <S extends Schema.Codec<unknown, unknown, never, never>>(\n  schema: S,\n  value: S[\"Type\"],\n): S[\"Type\"] => {\n  try {\n    const codec = Schema.toCodecJson(Schema.toType(schema));\n    const result = Schema.decodeSync(codec)(Schema.encodeSync(codec)(value));\n\n    freezeOAuth(result);\n\n    return result;\n  } catch {\n    throw OAuthUnavailable.make({});\n  }\n};\n\nexport const snapshotOAuth = <S extends Schema.Codec<unknown, unknown, never, never>>(\n  schema: S,\n  value: S[\"Type\"],\n) =>\n  Effect.try({\n    try: () => snapshotOAuthSync(schema, value),\n    catch: () => OAuthUnavailable.make({}),\n  });\n"],"mappings":";;;;;AAMA,MAAa,eAAe,UAAyB;CACnD,IAAI,CAAC,UAAU,gBAAgB,KAAK,KAAK,OAAO,SAAS,KAAK,GAAG;CACjE,IAAI,SAAS,WAAW,KAAK,GAAG,OAAO,OAAO,SAAS,WAAW,KAAK,CAAC;CACxE,KAAK,MAAM,SAAS,OAAO,OAAO,KAAK,GAAG,YAAY,KAAK;CAC3D,OAAO,OAAO,KAAK;AACrB;AAEA,MAAa,qBACX,QACA,UACc;CACd,IAAI;EACF,MAAM,QAAQ,OAAO,YAAY,OAAO,OAAO,MAAM,CAAC;EACtD,MAAM,SAAS,OAAO,WAAW,KAAK,CAAC,CAAC,OAAO,WAAW,KAAK,CAAC,CAAC,KAAK,CAAC;EAEvE,YAAY,MAAM;EAElB,OAAO;CACT,QAAQ;EACN,MAAM,iBAAiB,KAAK,CAAC,CAAC;CAChC;AACF;AAEA,MAAa,iBACX,QACA,UAEA,OAAO,IAAI;CACT,WAAW,kBAAkB,QAAQ,KAAK;CAC1C,aAAa,iBAAiB,KAAK,CAAC,CAAC;AACvC,CAAC"}
+{"version":3,"file":"signInSnapshot.mjs","names":[],"sources":["../../src/oauth/signInSnapshot.ts"],"sourcesContent":["import { DateTime, Effect, Predicate, Schema } from \"effect\";\n\nimport { OAuthUnavailable } from \"./signInErrors\";\n\n/** Private, bounded codecs only. Project before callbacks, then freeze the entire\n * detached graph; never retain an application's mutable response object. */\nexport const freezeOAuth = (value: unknown): void => {\n  if (!Predicate.isObjectOrArray(value) || Object.isFrozen(value)) return;\n  if (DateTime.isDateTime(value)) Object.freeze(DateTime.toPartsUtc(value));\n  for (const child of Object.values(value)) freezeOAuth(child);\n  Object.freeze(value);\n};\n\nexport const snapshotOAuthSync = <S extends Schema.Codec<unknown, unknown, never, never>>(\n  schema: S,\n  value: S[\"Type\"],\n): S[\"Type\"] => {\n  try {\n    // JSON fields can otherwise retain nested input references through validation.\n    const codec = Schema.fromJsonString(Schema.toCodecJson(Schema.toType(schema)));\n    const result = Schema.decodeSync(codec)(Schema.encodeSync(codec)(value));\n\n    freezeOAuth(result);\n\n    return result;\n  } catch {\n    throw OAuthUnavailable.make({});\n  }\n};\n\nexport const snapshotOAuth = <S extends Schema.Codec<unknown, unknown, never, never>>(\n  schema: S,\n  value: S[\"Type\"],\n) =>\n  Effect.try({\n    try: () => snapshotOAuthSync(schema, value),\n    catch: () => OAuthUnavailable.make({}),\n  });\n"],"mappings":";;;;;AAMA,MAAa,eAAe,UAAyB;CACnD,IAAI,CAAC,UAAU,gBAAgB,KAAK,KAAK,OAAO,SAAS,KAAK,GAAG;CACjE,IAAI,SAAS,WAAW,KAAK,GAAG,OAAO,OAAO,SAAS,WAAW,KAAK,CAAC;CACxE,KAAK,MAAM,SAAS,OAAO,OAAO,KAAK,GAAG,YAAY,KAAK;CAC3D,OAAO,OAAO,KAAK;AACrB;AAEA,MAAa,qBACX,QACA,UACc;CACd,IAAI;EAEF,MAAM,QAAQ,OAAO,eAAe,OAAO,YAAY,OAAO,OAAO,MAAM,CAAC,CAAC;EAC7E,MAAM,SAAS,OAAO,WAAW,KAAK,CAAC,CAAC,OAAO,WAAW,KAAK,CAAC,CAAC,KAAK,CAAC;EAEvE,YAAY,MAAM;EAElB,OAAO;CACT,QAAQ;EACN,MAAM,iBAAiB,KAAK,CAAC,CAAC;CAChC;AACF;AAEA,MAAa,iBACX,QACA,UAEA,OAAO,IAAI;CACT,WAAW,kBAAkB,QAAQ,KAAK;CAC1C,aAAa,iBAAiB,KAAK,CAAC,CAAC;AACvC,CAAC"}