@yielded/auth 0.1.0-beta.3 → 0.1.0-beta.5

package/package.json

@@ -1 +1 @@
-{"name":"@yielded/auth","version":"0.1.0-beta.3","dependencies":{"@noble/ciphers":"2.1.1","@noble/hashes":"2.3.0"},"devDependencies":{"@cloudflare/workers-types":"5.20260825.1","@effect/platform-bun":"4.0.0-rc.112","@effect/platform-node":"4.0.0-rc.112","@effect/sql-d1":"4.0.0-rc.112","@effect/sql-libsql":"4.0.0-rc.112","@effect/sql-mysql2":"4.0.0-rc.112","@effect/sql-pg":"4.0.0-rc.112","@effect/sql-pglite":"4.0.0-rc.112","@effect/sql-sqlite-bun":"4.0.0-rc.112","@effect/sql-sqlite-do":"4.0.0-rc.112","@effect/sql-sqlite-node":"4.0.0-rc.112","@effect/sql-sqlite-wasm":"4.0.0-rc.112","@effect/vitest":"4.0.0-rc.112","@simplewebauthn/browser":"14.0.0","@simplewebauthn/server":"14.0.1","drizzle-orm":"1.0.0-rc.5-ab785fc","effect":"4.0.0-rc.112","effect-cf":"0.40.0","openid-client":"6.8.8","tldts":"7.4.11","typescript":"7.0.2","vite-plus":"0.3.0"},"peerDependencies":{"@effect/sql-d1":">=4.0.0-rc.112","@effect/sql-libsql":">=4.0.0-rc.112","@effect/sql-mysql2":">=4.0.0-rc.112","@effect/sql-pg":">=4.0.0-rc.112","@effect/sql-pglite":">=4.0.0-rc.112","@effect/sql-sqlite-bun":">=4.0.0-rc.112","@effect/sql-sqlite-do":">=4.0.0-rc.112","@effect/sql-sqlite-node":">=4.0.0-rc.112","@effect/sql-sqlite-wasm":">=4.0.0-rc.112","@simplewebauthn/browser":">=14.0.0 <15","@simplewebauthn/server":">=14.0.1 <15","drizzle-orm":">=1.0.0-rc.5-ab785fc","effect":"^4.0.0-rc.112","effect-cf":"^0.40.0","openid-client":">=6.8.8 <7","tldts":">=7.4.11 <8"},"exports":{".":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"./Auth":{"types":"./dist/Auth.d.mts","default":"./dist/Auth.mjs"},"./Drizzle":{"types":"./dist/Drizzle.d.mts","default":"./dist/Drizzle.mjs"},"./DrizzleD1":{"types":"./dist/DrizzleD1.d.mts","default":"./dist/DrizzleD1.mjs"},"./DrizzleLibsql":{"types":"./dist/DrizzleLibsql.d.mts","default":"./dist/DrizzleLibsql.mjs"},"./DrizzleMysql2":{"types":"./dist/DrizzleMysql2.d.mts","default":"./dist/DrizzleMysql2.mjs"},"./DrizzlePglite":{"types":"./dist/DrizzlePglite.d.mts","default":"./dist/DrizzlePglite.mjs"},"./DrizzlePostgres":{"types":"./dist/DrizzlePostgres.d.mts","default":"./dist/DrizzlePostgres.mjs"},"./DrizzleSqliteBun":{"types":"./dist/DrizzleSqliteBun.d.mts","default":"./dist/DrizzleSqliteBun.mjs"},"./DrizzleSqliteDo":{"types":"./dist/DrizzleSqliteDo.d.mts","default":"./dist/DrizzleSqliteDo.mjs"},"./DrizzleSqliteNode":{"types":"./dist/DrizzleSqliteNode.d.mts","default":"./dist/DrizzleSqliteNode.mjs"},"./DrizzleSqliteWasm":{"types":"./dist/DrizzleSqliteWasm.d.mts","default":"./dist/DrizzleSqliteWasm.mjs"},"./Cloudflare":{"types":"./dist/Cloudflare.d.mts","default":"./dist/Cloudflare.mjs"},"./Http":{"types":"./dist/Http.d.mts","default":"./dist/Http.mjs"},"./HttpServer":{"types":"./dist/HttpServer.d.mts","default":"./dist/HttpServer.mjs"},"./OperationHttp":{"types":"./dist/OperationHttp.d.mts","default":"./dist/OperationHttp.mjs"},"./OperationHttpClient":{"types":"./dist/OperationHttpClient.d.mts","default":"./dist/OperationHttpClient.mjs"},"./OperationHttpServer":{"types":"./dist/OperationHttpServer.d.mts","default":"./dist/OperationHttpServer.mjs"},"./Atom":{"types":"./dist/Atom.d.mts","default":"./dist/Atom.mjs"},"./Hooks":{"types":"./dist/Hooks.d.mts","default":"./dist/Hooks.mjs"},"./Identity":{"types":"./dist/Identity.d.mts","default":"./dist/Identity.mjs"},"./OAuth":{"types":"./dist/OAuth.d.mts","default":"./dist/OAuth.mjs"},"./Operations":{"types":"./dist/Operations.d.mts","default":"./dist/Operations.mjs"},"./Rpc":{"types":"./dist/Rpc.d.mts","default":"./dist/Rpc.mjs"},"./Schema":{"types":"./dist/Schema.d.mts","default":"./dist/Schema.mjs"},"./Testing":{"types":"./dist/Testing.d.mts","default":"./dist/Testing.mjs"},"./WebCrypto":{"types":"./dist/WebCrypto.d.mts","default":"./dist/WebCrypto.mjs"},"./Sessions":{"types":"./dist/Sessions.d.mts","default":"./dist/Sessions.mjs"},"./SessionContract":{"types":"./dist/SessionContract.d.mts","default":"./dist/SessionContract.mjs"},"./Proofs":{"types":"./dist/Proofs.d.mts","default":"./dist/Proofs.mjs"},"./Password":{"types":"./dist/Password.d.mts","default":"./dist/Password.mjs"},"./Email":{"types":"./dist/Email.d.mts","default":"./dist/Email.mjs"},"./OpenIdClient":{"types":"./dist/OpenIdClient.d.mts","default":"./dist/OpenIdClient.mjs"},"./OpenIdClientConnected":{"types":"./dist/OpenIdClientConnected.d.mts","default":"./dist/OpenIdClientConnected.mjs"},"./Passkey":{"types":"./dist/Passkey.d.mts","default":"./dist/Passkey.mjs"},"./PasskeyPassword":{"types":"./dist/PasskeyPassword.d.mts","default":"./dist/PasskeyPassword.mjs"},"./PasskeySimpleWebAuthn":{"types":"./dist/PasskeySimpleWebAuthn.d.mts","default":"./dist/PasskeySimpleWebAuthn.mjs"},"./PasskeyBrowser":{"types":"./dist/PasskeyBrowser.d.mts","default":"./dist/PasskeyBrowser.mjs"},"./GitHub":{"types":"./dist/GitHub.d.mts","default":"./dist/GitHub.mjs"},"./AuthSession":{"types":"./dist/AuthSession.d.mts","default":"./dist/AuthSession.mjs"},"./Errors":{"types":"./dist/Errors.d.mts","default":"./dist/Errors.mjs"},"./Workflows":{"types":"./dist/Workflows.d.mts","default":"./dist/Workflows.mjs"},"./PasswordHasher":{"types":"./dist/PasswordHasher.d.mts","default":"./dist/PasswordHasher.mjs"},"./EmailOtp":{"types":"./dist/EmailOtp.d.mts","default":"./dist/EmailOtp.mjs"},"./AuthStore":{"types":"./dist/AuthStore.d.mts","default":"./dist/AuthStore.mjs"},"./PasswordAuth":{"types":"./dist/PasswordAuth.d.mts","default":"./dist/PasswordAuth.mjs"},"./Policy":{"types":"./dist/Policy.d.mts","default":"./dist/Policy.mjs"},"./EmailOtpSender":{"types":"./dist/EmailOtpSender.d.mts","default":"./dist/EmailOtpSender.mjs"},"./AuthTokenCodec":{"types":"./dist/AuthTokenCodec.d.mts","default":"./dist/AuthTokenCodec.mjs"},"./IdentityResolver":{"types":"./dist/IdentityResolver.d.mts","default":"./dist/IdentityResolver.mjs"},"./PasswordCredentialStore":{"types":"./dist/PasswordCredentialStore.d.mts","default":"./dist/PasswordCredentialStore.mjs"},"./PhoneOtp":{"types":"./dist/PhoneOtp.d.mts","default":"./dist/PhoneOtp.mjs"},"./Totp":{"types":"./dist/Totp.d.mts","default":"./dist/Totp.mjs"},"./PasskeyContract":{"types":"./dist/PasskeyContract.d.mts","default":"./dist/PasskeyContract.mjs"},"./TotpContract":{"types":"./dist/TotpContract.d.mts","default":"./dist/TotpContract.mjs"},"./AuthContract":{"types":"./dist/AuthContract.d.mts","default":"./dist/AuthContract.mjs"},"./Client":{"types":"./dist/Client.d.mts","default":"./dist/Client.mjs"}},"description":"Composable authentication, sessions, and identity workflows for Effect.","keywords":["authentication","effect","oauth","passkeys","sessions","typescript"],"homepage":"https://yielded.dev/auth/","bugs":{"url":"https://github.com/yielded-dev/auth/issues"},"license":"MIT","repository":{"type":"git","url":"git+https://github.com/yielded-dev/auth.git","directory":"packages/effect-auth"},"files":["dist","src"],"type":"module","sideEffects":[],"publishConfig":{"access":"public"},"scripts":{"build":"vp pack","check":"tsc --noEmit -p tsconfig.json","test":"vp test --passWithNoTests","e2e":"bun test/e2e/harness.ts","example:totp":"bun test/fixtures/totp-sqlite-bun.ts"},"peerDependenciesMeta":{"@effect/sql-d1":{"optional":true},"@effect/sql-libsql":{"optional":true},"@effect/sql-mysql2":{"optional":true},"@effect/sql-pg":{"optional":true},"@effect/sql-pglite":{"optional":true},"@effect/sql-sqlite-bun":{"optional":true},"@effect/sql-sqlite-do":{"optional":true},"@effect/sql-sqlite-node":{"optional":true},"@effect/sql-sqlite-wasm":{"optional":true},"@simplewebauthn/browser":{"optional":true},"@simplewebauthn/server":{"optional":true},"drizzle-orm":{"optional":true},"effect-cf":{"optional":true},"openid-client":{"optional":true},"tldts":{"optional":true}}}
+{"name":"@yielded/auth","version":"0.1.0-beta.5","dependencies":{"@noble/ciphers":"2.1.1","@noble/hashes":"2.3.0"},"devDependencies":{"@cloudflare/workers-types":"5.20260825.1","@effect/platform-bun":"4.0.0-rc.112","@effect/platform-node":"4.0.0-rc.112","@effect/sql-d1":"4.0.0-rc.112","@effect/sql-libsql":"4.0.0-rc.112","@effect/sql-mysql2":"4.0.0-rc.112","@effect/sql-pg":"4.0.0-rc.112","@effect/sql-pglite":"4.0.0-rc.112","@effect/sql-sqlite-bun":"4.0.0-rc.112","@effect/sql-sqlite-do":"4.0.0-rc.112","@effect/sql-sqlite-node":"4.0.0-rc.112","@effect/sql-sqlite-wasm":"4.0.0-rc.112","@effect/vitest":"4.0.0-rc.112","@simplewebauthn/browser":"14.0.0","@simplewebauthn/server":"14.0.1","drizzle-orm":"1.0.0-rc.5-ab785fc","effect":"4.0.0-rc.112","effect-cf":"0.40.0","openid-client":"6.8.8","tldts":"7.4.11","typescript":"7.0.2","vite-plus":"0.3.0"},"peerDependencies":{"@effect/sql-d1":">=4.0.0-rc.112","@effect/sql-libsql":">=4.0.0-rc.112","@effect/sql-mysql2":">=4.0.0-rc.112","@effect/sql-pg":">=4.0.0-rc.112","@effect/sql-pglite":">=4.0.0-rc.112","@effect/sql-sqlite-bun":">=4.0.0-rc.112","@effect/sql-sqlite-do":">=4.0.0-rc.112","@effect/sql-sqlite-node":">=4.0.0-rc.112","@effect/sql-sqlite-wasm":">=4.0.0-rc.112","@simplewebauthn/browser":">=14.0.0 <15","@simplewebauthn/server":">=14.0.1 <15","drizzle-orm":">=1.0.0-rc.5-ab785fc","effect":"^4.0.0-rc.112","effect-cf":"^0.40.0","openid-client":">=6.8.8 <7","tldts":">=7.4.11 <8"},"exports":{".":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"./Auth":{"types":"./dist/Auth.d.mts","default":"./dist/Auth.mjs"},"./Drizzle":{"types":"./dist/Drizzle.d.mts","default":"./dist/Drizzle.mjs"},"./DrizzleD1":{"types":"./dist/DrizzleD1.d.mts","default":"./dist/DrizzleD1.mjs"},"./DrizzleLibsql":{"types":"./dist/DrizzleLibsql.d.mts","default":"./dist/DrizzleLibsql.mjs"},"./DrizzleMysql2":{"types":"./dist/DrizzleMysql2.d.mts","default":"./dist/DrizzleMysql2.mjs"},"./DrizzlePglite":{"types":"./dist/DrizzlePglite.d.mts","default":"./dist/DrizzlePglite.mjs"},"./DrizzlePostgres":{"types":"./dist/DrizzlePostgres.d.mts","default":"./dist/DrizzlePostgres.mjs"},"./DrizzleSqliteBun":{"types":"./dist/DrizzleSqliteBun.d.mts","default":"./dist/DrizzleSqliteBun.mjs"},"./DrizzleSqliteDo":{"types":"./dist/DrizzleSqliteDo.d.mts","default":"./dist/DrizzleSqliteDo.mjs"},"./DrizzleSqliteNode":{"types":"./dist/DrizzleSqliteNode.d.mts","default":"./dist/DrizzleSqliteNode.mjs"},"./DrizzleSqliteWasm":{"types":"./dist/DrizzleSqliteWasm.d.mts","default":"./dist/DrizzleSqliteWasm.mjs"},"./Cloudflare":{"types":"./dist/Cloudflare.d.mts","default":"./dist/Cloudflare.mjs"},"./Http":{"types":"./dist/Http.d.mts","default":"./dist/Http.mjs"},"./HttpServer":{"types":"./dist/HttpServer.d.mts","default":"./dist/HttpServer.mjs"},"./OperationHttp":{"types":"./dist/OperationHttp.d.mts","default":"./dist/OperationHttp.mjs"},"./OperationHttpClient":{"types":"./dist/OperationHttpClient.d.mts","default":"./dist/OperationHttpClient.mjs"},"./OperationHttpServer":{"types":"./dist/OperationHttpServer.d.mts","default":"./dist/OperationHttpServer.mjs"},"./Atom":{"types":"./dist/Atom.d.mts","default":"./dist/Atom.mjs"},"./Hooks":{"types":"./dist/Hooks.d.mts","default":"./dist/Hooks.mjs"},"./Identity":{"types":"./dist/Identity.d.mts","default":"./dist/Identity.mjs"},"./OAuth":{"types":"./dist/OAuth.d.mts","default":"./dist/OAuth.mjs"},"./Operations":{"types":"./dist/Operations.d.mts","default":"./dist/Operations.mjs"},"./Rpc":{"types":"./dist/Rpc.d.mts","default":"./dist/Rpc.mjs"},"./Schema":{"types":"./dist/Schema.d.mts","default":"./dist/Schema.mjs"},"./Testing":{"types":"./dist/Testing.d.mts","default":"./dist/Testing.mjs"},"./WebCrypto":{"types":"./dist/WebCrypto.d.mts","default":"./dist/WebCrypto.mjs"},"./Sessions":{"types":"./dist/Sessions.d.mts","default":"./dist/Sessions.mjs"},"./SessionContract":{"types":"./dist/SessionContract.d.mts","default":"./dist/SessionContract.mjs"},"./Proofs":{"types":"./dist/Proofs.d.mts","default":"./dist/Proofs.mjs"},"./Password":{"types":"./dist/Password.d.mts","default":"./dist/Password.mjs"},"./Email":{"types":"./dist/Email.d.mts","default":"./dist/Email.mjs"},"./OpenIdClient":{"types":"./dist/OpenIdClient.d.mts","default":"./dist/OpenIdClient.mjs"},"./OpenIdClientConnected":{"types":"./dist/OpenIdClientConnected.d.mts","default":"./dist/OpenIdClientConnected.mjs"},"./Passkey":{"types":"./dist/Passkey.d.mts","default":"./dist/Passkey.mjs"},"./PasskeyPassword":{"types":"./dist/PasskeyPassword.d.mts","default":"./dist/PasskeyPassword.mjs"},"./PasskeySimpleWebAuthn":{"types":"./dist/PasskeySimpleWebAuthn.d.mts","default":"./dist/PasskeySimpleWebAuthn.mjs"},"./PasskeyBrowser":{"types":"./dist/PasskeyBrowser.d.mts","default":"./dist/PasskeyBrowser.mjs"},"./GitHub":{"types":"./dist/GitHub.d.mts","default":"./dist/GitHub.mjs"},"./AuthSession":{"types":"./dist/AuthSession.d.mts","default":"./dist/AuthSession.mjs"},"./Errors":{"types":"./dist/Errors.d.mts","default":"./dist/Errors.mjs"},"./Workflows":{"types":"./dist/Workflows.d.mts","default":"./dist/Workflows.mjs"},"./PasswordHasher":{"types":"./dist/PasswordHasher.d.mts","default":"./dist/PasswordHasher.mjs"},"./EmailOtp":{"types":"./dist/EmailOtp.d.mts","default":"./dist/EmailOtp.mjs"},"./AuthStore":{"types":"./dist/AuthStore.d.mts","default":"./dist/AuthStore.mjs"},"./PasswordAuth":{"types":"./dist/PasswordAuth.d.mts","default":"./dist/PasswordAuth.mjs"},"./Policy":{"types":"./dist/Policy.d.mts","default":"./dist/Policy.mjs"},"./EmailOtpSender":{"types":"./dist/EmailOtpSender.d.mts","default":"./dist/EmailOtpSender.mjs"},"./AuthTokenCodec":{"types":"./dist/AuthTokenCodec.d.mts","default":"./dist/AuthTokenCodec.mjs"},"./IdentityResolver":{"types":"./dist/IdentityResolver.d.mts","default":"./dist/IdentityResolver.mjs"},"./PasswordCredentialStore":{"types":"./dist/PasswordCredentialStore.d.mts","default":"./dist/PasswordCredentialStore.mjs"},"./PhoneOtp":{"types":"./dist/PhoneOtp.d.mts","default":"./dist/PhoneOtp.mjs"},"./Totp":{"types":"./dist/Totp.d.mts","default":"./dist/Totp.mjs"},"./PasskeyContract":{"types":"./dist/PasskeyContract.d.mts","default":"./dist/PasskeyContract.mjs"},"./TotpContract":{"types":"./dist/TotpContract.d.mts","default":"./dist/TotpContract.mjs"},"./AuthContract":{"types":"./dist/AuthContract.d.mts","default":"./dist/AuthContract.mjs"},"./Client":{"types":"./dist/Client.d.mts","default":"./dist/Client.mjs"}},"description":"Composable authentication, sessions, and identity workflows for Effect.","keywords":["authentication","effect","oauth","passkeys","sessions","typescript"],"homepage":"https://yielded.dev/auth/","bugs":{"url":"https://github.com/yielded-dev/auth/issues"},"license":"MIT","repository":{"type":"git","url":"git+https://github.com/yielded-dev/auth.git","directory":"packages/effect-auth"},"files":["dist","src"],"type":"module","sideEffects":[],"publishConfig":{"access":"public"},"scripts":{"build":"vp pack","check":"tsc --noEmit -p tsconfig.json","test":"vp test --passWithNoTests","e2e":"bun test/e2e/harness.ts","example:totp":"bun test/fixtures/totp-sqlite-bun.ts"},"peerDependenciesMeta":{"@effect/sql-d1":{"optional":true},"@effect/sql-libsql":{"optional":true},"@effect/sql-mysql2":{"optional":true},"@effect/sql-pg":{"optional":true},"@effect/sql-pglite":{"optional":true},"@effect/sql-sqlite-bun":{"optional":true},"@effect/sql-sqlite-do":{"optional":true},"@effect/sql-sqlite-node":{"optional":true},"@effect/sql-sqlite-wasm":{"optional":true},"@simplewebauthn/browser":{"optional":true},"@simplewebauthn/server":{"optional":true},"drizzle-orm":{"optional":true},"effect-cf":{"optional":true},"openid-client":{"optional":true},"tldts":{"optional":true}}}

package/src/GitHub.ts

@@ -15,3 +15,4 @@ export {
 } from "./oauth/github/protocol";
 
 export { gitHubOAuthAppProviderKey } from "./oauth/github/identity";
+export { GitHubUserProfile } from "./oauth/github/profile";

package/src/OpenIdClient.ts

@@ -11,3 +11,5 @@ export {
   makeOpenIdClientOAuthProtocol,
   openIdClientOAuthProtocolLayer,
 } from "./oauth/openid-client/protocol";
+
+export { OidcUserProfile } from "./oauth/openid-client/profile";

package/src/drizzle/oauth-registration.ts

@@ -11,6 +11,7 @@ import {
 } from "../oauth/registrationModels";
 import {
   OAuthCredentialSnapshot,
+  OAuthDisplayProfile,
   OAuthSignInTransactionContext,
   type OAuthExternalIdentity,
 } from "../oauth/signInModels";
@@ -25,6 +26,7 @@ import { invariant, oauthIdentityKey, sameIdentity, storage } from "./oauth-stat
 export const intentStorage = storage(OAuthRegistrationIntent);
 const decisionStorage = storage(OAuthRegistrationDecision);
 const contextStorage = storage(OAuthSignInTransactionContext);
+const profileStorage = storage(Schema.NullOr(OAuthDisplayProfile));
 
 const reservationStorage = storage(
   Schema.Struct({
@@ -174,6 +176,8 @@ export const settleRegistrationIntent = (mapping: any, input: any) =>
 
         invariant(
           sameIdentity(intent.identity, identity) &&
+            profileStorage.encode(intent.profile ?? null) ===
+              profileStorage.encode(input.identity.profile ?? null) &&
             intent.claimId === input.claim.claimId &&
             intent.claimedAtMillis === input.claim.claimedAtMillis &&
             contextStorage.encode(c) === contextStorage.encode(context),

package/src/oauth/github/identity.ts

@@ -3,24 +3,28 @@ import { Effect, Schema } from "effect";
 import type { PlainOAuthIdentity } from "../openid-client/models";
 import { OAuthProviderKey } from "../schema";
 import { OAuthProtocolRejected } from "../signInErrors";
+import { GitHubUserProfile } from "./profile";
 
 export const gitHubOAuthAppProviderKey = OAuthProviderKey.make("github");
 
-const identity = Schema.Struct({
-  id: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: Number.MAX_SAFE_INTEGER })),
-  login: Schema.optionalKey(Schema.NonEmptyString.check(Schema.isMaxLength(256))),
-});
-
 // oxlint-disable-next-line no-restricted-properties -- GitHub /user is an untyped, freshly authenticated JSON boundary.
-const decode = Schema.decodeUnknownEffect(identity);
+const decode = Schema.decodeUnknownEffect(GitHubUserProfile);
 
 export const decodeGitHubIdentity = Effect.fn("GitHubOAuthApp.decodeIdentity")(function* (
   body: unknown,
 ): Effect.fn.Return<PlainOAuthIdentity, OAuthProtocolRejected> {
   const value = yield* decode(body).pipe(Effect.mapError(() => OAuthProtocolRejected.make({})));
+  const displayName = value.name?.trim() || value.login;
 
   return {
     subject: String(value.id),
-    ...(value.login === undefined ? {} : { profile: { displayName: value.login } }),
+    profile: {
+      ...(displayName === undefined ? {} : { displayName }),
+      ...(value.login === undefined ? {} : { handle: value.login }),
+      ...(value.avatar_url === undefined ? {} : { avatarUrl: value.avatar_url }),
+      ...(value.html_url === undefined ? {} : { profileUrl: value.html_url }),
+      ...(value.email === null || value.email === undefined ? {} : { email: value.email }),
+      providerData: value,
+    },
   };
 });

package/src/oauth/github/profile.ts

@@ -0,0 +1,64 @@
+import { Schema } from "effect";
+
+const text = Schema.String.check(Schema.isMaxLength(2048));
+const name = Schema.String.check(Schema.isMaxLength(256));
+const count = Schema.Int.check(Schema.isBetween({ minimum: 0, maximum: Number.MAX_SAFE_INTEGER }));
+const optionalText = Schema.optionalKey(text);
+const nullableText = Schema.optionalKey(Schema.NullOr(text));
+
+/** All documented GitHub /user fields, with provider spelling and nulls retained.
+ * Only the numeric ID establishes identity. Other fields are optional because
+ * availability differs by permission and provider response. This does not fetch
+ * repositories, email lists, or any additional endpoint. Unknown fields are omitted.
+ * URLs are metadata, not approved redirect or server-fetch targets. */
+export const GitHubUserProfile = Schema.Struct({
+  id: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: Number.MAX_SAFE_INTEGER })),
+  login: Schema.optionalKey(Schema.NonEmptyString.check(Schema.isMaxLength(256))),
+  name: Schema.optionalKey(Schema.NullOr(name)),
+  user_view_type: optionalText,
+  node_id: optionalText,
+  avatar_url: optionalText,
+  gravatar_id: nullableText,
+  url: optionalText,
+  html_url: optionalText,
+  followers_url: optionalText,
+  following_url: optionalText,
+  gists_url: optionalText,
+  starred_url: optionalText,
+  subscriptions_url: optionalText,
+  organizations_url: optionalText,
+  repos_url: optionalText,
+  events_url: optionalText,
+  received_events_url: optionalText,
+  type: optionalText,
+  site_admin: Schema.optionalKey(Schema.Boolean),
+  company: nullableText,
+  blog: nullableText,
+  location: nullableText,
+  email: Schema.optionalKey(Schema.NullOr(Schema.String.check(Schema.isMaxLength(320)))),
+  notification_email: Schema.optionalKey(
+    Schema.NullOr(Schema.String.check(Schema.isMaxLength(320))),
+  ),
+  hireable: Schema.optionalKey(Schema.NullOr(Schema.Boolean)),
+  bio: nullableText,
+  twitter_username: nullableText,
+  public_repos: Schema.optionalKey(count),
+  public_gists: Schema.optionalKey(count),
+  followers: Schema.optionalKey(count),
+  following: Schema.optionalKey(count),
+  created_at: optionalText,
+  updated_at: optionalText,
+  private_gists: Schema.optionalKey(count),
+  total_private_repos: Schema.optionalKey(count),
+  owned_private_repos: Schema.optionalKey(count),
+  disk_usage: Schema.optionalKey(count),
+  collaborators: Schema.optionalKey(count),
+  two_factor_authentication: Schema.optionalKey(Schema.Boolean),
+  plan: Schema.optionalKey(
+    Schema.Struct({ collaborators: count, name: text, space: count, private_repos: count }),
+  ),
+  business_plus: Schema.optionalKey(Schema.Boolean),
+  ldap_dn: optionalText,
+});
+
+export type GitHubUserProfile = typeof GitHubUserProfile.Type;

package/src/oauth/github/protocol.ts

@@ -29,7 +29,8 @@ import type {
 
 const unavailable = () => OAuthUnavailable.make({});
 const invalid = () => OpenIdClientConfigurationError.make({ reason: "provider" });
-const issuer = OAuthIssuer.make("https://github.com");
+// GitHub's OAuth authorization server issuer, including its RFC 9207 callback value.
+const issuer = OAuthIssuer.make("https://github.com/login/oauth");
 
 const headers = Object.freeze({
   Accept: "application/vnd.github+json",
@@ -92,7 +93,7 @@ const provider = (
   issuance: registration.issuance,
   issuer,
   protocol: "oauth",
-  responseIssuerMode: "unsupported",
+  responseIssuerMode: "required",
   clientId: registration.clientId,
   authentication: { method: "client_secret_post", secret: registration.clientSecret },
   callbacks: registration.callbacks,

package/src/oauth/openid-client/connected/protocol.ts

@@ -23,6 +23,7 @@ import {
 } from "../compatibility";
 import { clientAuthentication } from "../configuration";
 import { type OpenIdClientConfigurationError } from "../models";
+import { decodeOidcProfile } from "../profile";
 import { ProviderRevocation } from "../ProviderRevocation";
 import { boundedFetch } from "../transport";
 import {
@@ -372,8 +373,11 @@ export const makeConnectedProtocolWithCompatibility = Effect.fn(
     )
       return yield* unavailable();
 
+    const profile = yield* decodeOidcProfile(raw).pipe(Effect.mapError(unavailable));
+
     return {
       identity: { provider: provider.provider, issuer: provider.issuer, subject: claims.sub },
+      ...(profile === undefined ? {} : { profile }),
       continuation: previous?.continuation ?? {
         _tag: "Oidc" as const,
         clientId: provider.clientId,

package/src/oauth/openid-client/profile.ts

@@ -0,0 +1,68 @@
+import { Effect, Schema } from "effect";
+
+import { OAuthProtocolRejected } from "../signInErrors";
+import type { OAuthDisplayProfile } from "../signInModels";
+
+const text = Schema.String.check(Schema.isMaxLength(256));
+const url = Schema.String.check(Schema.isMaxLength(2048));
+
+/** Standard OpenID Connect user claims returned in a verified ID token. This
+ * does not request additional scopes or fetch UserInfo. Protocol claims and
+ * credentials are excluded; values such as email_verified describe the provider's
+ * assertion and never authorize local account linking by themselves. */
+export const OidcUserProfile = Schema.Struct({
+  name: Schema.optionalKey(text),
+  given_name: Schema.optionalKey(text),
+  family_name: Schema.optionalKey(text),
+  middle_name: Schema.optionalKey(text),
+  nickname: Schema.optionalKey(text),
+  preferred_username: Schema.optionalKey(text),
+  profile: Schema.optionalKey(url),
+  picture: Schema.optionalKey(url),
+  website: Schema.optionalKey(url),
+  email: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(320))),
+  email_verified: Schema.optionalKey(Schema.Boolean),
+  gender: Schema.optionalKey(text),
+  birthdate: Schema.optionalKey(text),
+  zoneinfo: Schema.optionalKey(text),
+  locale: Schema.optionalKey(text),
+  phone_number: Schema.optionalKey(text),
+  phone_number_verified: Schema.optionalKey(Schema.Boolean),
+  address: Schema.optionalKey(
+    Schema.Struct({
+      formatted: Schema.optionalKey(url),
+      street_address: Schema.optionalKey(url),
+      locality: Schema.optionalKey(text),
+      region: Schema.optionalKey(text),
+      postal_code: Schema.optionalKey(text),
+      country: Schema.optionalKey(text),
+    }),
+  ),
+  updated_at: Schema.optionalKey(
+    Schema.Int.check(Schema.isBetween({ minimum: 0, maximum: Number.MAX_SAFE_INTEGER })),
+  ),
+});
+
+export type OidcUserProfile = typeof OidcUserProfile.Type;
+
+export const decodeOidcProfile = Effect.fn("OpenIdClient.decodeProfile")(function* (
+  claims: unknown,
+): Effect.fn.Return<OAuthDisplayProfile | undefined, OAuthProtocolRejected> {
+  // oxlint-disable-next-line no-restricted-properties -- Select standard user claims from an already verified ID token.
+  const profile = yield* Schema.decodeUnknownEffect(OidcUserProfile)(claims).pipe(
+    Effect.mapError(() => OAuthProtocolRejected.make({})),
+  );
+
+  if (Object.keys(profile).length === 0) return undefined;
+  const displayName = profile.name?.trim() || profile.preferred_username;
+
+  return {
+    ...(displayName === undefined ? {} : { displayName }),
+    ...(profile.preferred_username === undefined ? {} : { handle: profile.preferred_username }),
+    ...(profile.picture === undefined ? {} : { avatarUrl: profile.picture }),
+    ...(profile.profile === undefined ? {} : { profileUrl: profile.profile }),
+    ...(profile.email === undefined ? {} : { email: profile.email }),
+    ...(profile.email_verified === undefined ? {} : { emailVerified: profile.email_verified }),
+    providerData: profile,
+  };
+});

package/src/oauth/openid-client/protocol.ts

@@ -27,6 +27,7 @@ import {
   type OpenIdClientConfigurationError,
   type OpenIdClientOAuthProtocolOptions,
 } from "./models";
+import { decodeOidcProfile } from "./profile";
 import { boundedFetch } from "./transport";
 
 const beginInput = Schema.Struct({
@@ -357,8 +358,11 @@ export const makeOpenIdClientOAuthProtocol = Effect.fn("makeOpenIdClientOAuthPro
           )
             return yield* rejected();
 
+          const profile = yield* decodeOidcProfile(exchanged.claims);
+
           return yield* snapshotOAuth(OAuthVerifiedExternalIdentity, {
             identity: { provider: provider.provider, issuer: provider.issuer, subject: claims.sub },
+            ...(profile === undefined ? {} : { profile }),
             ...(claims.auth_time === undefined
               ? {}
               : {

package/src/oauth/registrationModels.ts

@@ -5,6 +5,7 @@ import { TokenDigest } from "../Schema";
 import {
   OAuthClaimId,
   OAuthCommandId,
+  OAuthDisplayProfile,
   OAuthExternalIdentity,
   OAuthInstant,
   OAuthModuleId,
@@ -46,6 +47,9 @@ export const OAuthRegistrationIntent = Schema.Struct({
   claimId: OAuthClaimId,
   claimedAtMillis: OAuthInstant,
   identity: OAuthExternalIdentity,
+  /** Original authenticated provider snapshot, available only to server-side
+   * provisioning authority. It is not caller-supplied registration data. */
+  profile: Schema.optionalKey(OAuthDisplayProfile),
   verifiedAtMillis: OAuthInstant,
   credentialDigest: OAuthRegistrationBearerDigest,
   issuedAtMillis: OAuthInstant,

package/src/oauth/registrationSecrets.ts

@@ -100,6 +100,7 @@ export const prepare = Effect.fn("OAuthRegistration.prepareIntent")(function* (
     claimId: claim.claimId,
     claimedAtMillis: claim.claimedAtMillis,
     identity: identity.identity,
+    ...(identity.profile === undefined ? {} : { profile: identity.profile }),
     verifiedAtMillis,
     credentialDigest: yield* credentialDigest(
       claim.flow.context.moduleId,

package/src/oauth/signInModels.ts

@@ -127,11 +127,29 @@ export const OAuthExternalIdentity = Schema.Struct({
   subject: Schema.NonEmptyString.check(Schema.isMaxLength(1024)),
 });
 
+/** Provider-supplied metadata, never local identity or linking authority. Adapters
+ * project identity responses into this bounded JSON snapshot; tokens and protocol
+ * secrets do not belong here. Applications select their own public session claims. */
 export const OAuthDisplayProfile = Schema.Struct({
   displayName: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(256))),
   handle: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(256))),
+  avatarUrl: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(2048))),
+  profileUrl: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(2048))),
+  email: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(320))),
+  emailVerified: Schema.optionalKey(Schema.Boolean),
+  /** Provider-specific fields. Use the provider's exported profile Schema to
+   * decode them. Availability follows the existing provider permissions. */
+  providerData: Schema.optionalKey(
+    Schema.JsonObject.check(
+      Schema.makeFilter(
+        (value) => new TextEncoder().encode(JSON.stringify(value)).length <= 65_536,
+      ),
+    ),
+  ),
 });
 
+export type OAuthDisplayProfile = typeof OAuthDisplayProfile.Type;
+
 export const OAuthVerifiedExternalIdentity = Schema.Struct({
   identity: OAuthExternalIdentity,
   upstreamAuthenticatedAt: Schema.optionalKey(Schema.DateTimeUtcFromMillis),

package/src/oauth/signInModule.ts

@@ -139,6 +139,9 @@ export const makeOAuthMethod = <
     {
       readonly resolve: (
         credential: OAuthCredentialSnapshot,
+        /** Fresh provider metadata, after exact local credential/identity matching.
+         * Select application claims explicitly; profile email grants no linking authority. */
+        verified: OAuthVerifiedExternalIdentity,
       ) => Effect.Effect<Claims["Type"], OAuthUnavailable>;
     }
   >(`effect-auth/oauth/${moduleId.length}:${moduleId}/Claims`);
@@ -681,6 +684,7 @@ export const makeOAuthMethod = <
 
             const claims = yield* resolveClaims(
               snapshotOAuthSync(OAuthCredentialSnapshot, credential),
+              snapshotOAuthSync(OAuthVerifiedExternalIdentity, identity),
             );
 
             const established = yield* completeAuthentication({

package/src/oauth/signInSnapshot.ts

@@ -16,7 +16,8 @@ export const snapshotOAuthSync = <S extends Schema.Codec<unknown, unknown, never
   value: S["Type"],
 ): S["Type"] => {
   try {
-    const codec = Schema.toCodecJson(Schema.toType(schema));
+    // JSON fields can otherwise retain nested input references through validation.
+    const codec = Schema.fromJsonString(Schema.toCodecJson(Schema.toType(schema)));
     const result = Schema.decodeSync(codec)(Schema.encodeSync(codec)(value));
 
     freezeOAuth(result);