@effect-auth/core 0.1.0-alpha.4 → 0.1.0-alpha.6

package/dist/OAuth.js

@@ -0,0 +1,1387 @@
+import { Brand, Context, Data, Duration, Effect, Encoding, Layer, Option, Redacted, } from "effect";
+import { Challenge } from "./Challenge.js";
+import { Crypto } from "./Crypto.js";
+import { ChallengeId, Email, OAuthAccountId, OAuthProviderId, UnixMillis, UserId, } from "./Identifiers.js";
+import { currentUnixMillis } from "./Internal.js";
+import { JwtAlgorithms, JwtError, JwtKeyId, JwtKeys, JwtVerifier, } from "./Jwt.js";
+export const OAuthStateToken = Brand.nominal();
+export const OAuthCodeVerifier = Brand.nominal();
+export const OAuthCodeChallenge = Brand.nominal();
+export const OAuthNonce = Brand.nominal();
+export const OAuthAuthorizationCode = Brand.nominal();
+export const OAuthAccessToken = Brand.nominal();
+export const OAuthRefreshToken = Brand.nominal();
+export const OAuthIdToken = Brand.nominal();
+export const defaultOAuthStateTtl = Duration.minutes(10);
+export const defaultOAuthLinkConfirmationTtl = Duration.minutes(15);
+export const defaultOAuthJwksCacheTtl = Duration.minutes(10);
+export const defaultOAuthStateSecretBytes = 32;
+export const defaultOAuthCodeVerifierBytes = 32;
+export const defaultOAuthLinkConfirmationSecretBytes = 32;
+export const defaultOAuthNonceBytes = 16;
+export const appleSignInProviderId = OAuthProviderId("apple");
+export const appleSignInIssuer = "https://appleid.apple.com";
+export const appleSignInAuthorizationEndpoint = "https://appleid.apple.com/auth/authorize";
+export const appleSignInTokenEndpoint = "https://appleid.apple.com/auth/token";
+export const appleSignInRevocationEndpoint = "https://appleid.apple.com/auth/revoke";
+export const appleSignInJwksUri = "https://appleid.apple.com/auth/keys";
+export const appleSignInPrivateRelayDomain = "privaterelay.appleid.com";
+export const appleSignInDefaultScopes = ["openid", "email", "name"];
+export const appleSignInDefaultAuthorizationParams = {
+    response_mode: "form_post",
+};
+export const githubOAuthProviderId = OAuthProviderId("github");
+export const githubOAuthAuthorizationEndpoint = "https://github.com/login/oauth/authorize";
+export const githubOAuthTokenEndpoint = "https://github.com/login/oauth/access_token";
+export const githubOAuthUserEndpoint = "https://api.github.com/user";
+export const githubOAuthEmailsEndpoint = "https://api.github.com/user/emails";
+export const githubOAuthDefaultScopes = ["read:user", "user:email"];
+export const githubOAuthApiVersion = "2022-11-28";
+export const githubOAuthApiVersionHeader = {
+    "x-github-api-version": githubOAuthApiVersion,
+};
+export const googleOidcProviderId = OAuthProviderId("google");
+export const googleOidcIssuer = "https://accounts.google.com";
+export const googleOidcAuthorizationEndpoint = "https://accounts.google.com/o/oauth2/v2/auth";
+export const googleOidcTokenEndpoint = "https://oauth2.googleapis.com/token";
+export const googleOidcRevocationEndpoint = "https://oauth2.googleapis.com/revoke";
+export const googleOidcUserInfoEndpoint = "https://openidconnect.googleapis.com/v1/userinfo";
+export const googleOidcJwksUri = "https://www.googleapis.com/oauth2/v3/certs";
+export const googleOidcDefaultScopes = ["openid", "email", "profile"];
+export const microsoftOidcProviderId = OAuthProviderId("microsoft");
+export const microsoftOidcLoginBaseUrl = "https://login.microsoftonline.com";
+export const microsoftOidcUserInfoEndpoint = "https://graph.microsoft.com/oidc/userinfo";
+export const microsoftOidcDefaultScopes = ["openid", "email", "profile"];
+export const genericOidcDefaultScopes = ["openid", "email", "profile"];
+const microsoftOidcTenantPathSegment = (tenant) => encodeURIComponent(tenant.trim());
+export const microsoftOidcAuthorizationEndpoint = (tenant) => `${microsoftOidcLoginBaseUrl}/${microsoftOidcTenantPathSegment(tenant)}/oauth2/v2.0/authorize`;
+export const microsoftOidcTokenEndpoint = (tenant) => `${microsoftOidcLoginBaseUrl}/${microsoftOidcTenantPathSegment(tenant)}/oauth2/v2.0/token`;
+export const microsoftOidcJwksUri = (tenant) => `${microsoftOidcLoginBaseUrl}/${microsoftOidcTenantPathSegment(tenant)}/discovery/v2.0/keys`;
+export const microsoftOidcIssuer = (tenant) => `${microsoftOidcLoginBaseUrl}/${microsoftOidcTenantPathSegment(tenant)}/v2.0`;
+export class OAuthProviderError extends Data.TaggedError("OAuthProviderError") {
+}
+export class OAuthUserInfoError extends Data.TaggedError("OAuthUserInfoError") {
+}
+export class OidcIdTokenVerifierError extends Data.TaggedError("OidcIdTokenVerifierError") {
+}
+export class OidcIdTokenVerifier extends Context.Service()("auth/OidcIdTokenVerifier") {
+}
+(function (OidcIdTokenVerifier) {
+    OidcIdTokenVerifier.make = (service) => OidcIdTokenVerifier.of(service);
+})(OidcIdTokenVerifier || (OidcIdTokenVerifier = {}));
+export class OAuthProfileNormalizationError extends Data.TaggedError("OAuthProfileNormalizationError") {
+}
+export class OAuthProfileNormalizer extends Context.Service()("auth/OAuthProfileNormalizer") {
+}
+(function (OAuthProfileNormalizer) {
+    OAuthProfileNormalizer.make = (service) => OAuthProfileNormalizer.of(service);
+})(OAuthProfileNormalizer || (OAuthProfileNormalizer = {}));
+export class OAuthTokenExchangeError extends Data.TaggedError("OAuthTokenExchangeError") {
+}
+export class OAuthTokenExchange extends Context.Service()("auth/OAuthTokenExchange") {
+}
+(function (OAuthTokenExchange) {
+    OAuthTokenExchange.make = (service) => OAuthTokenExchange.of(service);
+})(OAuthTokenExchange || (OAuthTokenExchange = {}));
+export class OAuthProviders extends Context.Service()("auth/OAuthProviders") {
+}
+(function (OAuthProviders) {
+    OAuthProviders.make = (service) => OAuthProviders.of(service);
+})(OAuthProviders || (OAuthProviders = {}));
+export class OAuthStateError extends Data.TaggedError("OAuthStateError") {
+}
+export class OAuthState extends Context.Service()("auth/OAuthState") {
+}
+(function (OAuthState) {
+    OAuthState.make = (service) => OAuthState.of(service);
+})(OAuthState || (OAuthState = {}));
+export class OAuthAccountStoreError extends Data.TaggedError("OAuthAccountStoreError") {
+}
+export class OAuthAccountStore extends Context.Service()("auth/OAuthAccountStore") {
+}
+(function (OAuthAccountStore) {
+    OAuthAccountStore.make = (service) => OAuthAccountStore.of(service);
+})(OAuthAccountStore || (OAuthAccountStore = {}));
+export class OAuthAccountLinkingError extends Data.TaggedError("OAuthAccountLinkingError") {
+}
+export class OAuthAccountLinking extends Context.Service()("auth/OAuthAccountLinking") {
+}
+(function (OAuthAccountLinking) {
+    OAuthAccountLinking.make = (service) => OAuthAccountLinking.of(service);
+})(OAuthAccountLinking || (OAuthAccountLinking = {}));
+export class OAuthAccountUnlinkingError extends Data.TaggedError("OAuthAccountUnlinkingError") {
+}
+export class OAuthAccountUnlinking extends Context.Service()("auth/OAuthAccountUnlinking") {
+}
+(function (OAuthAccountUnlinking) {
+    OAuthAccountUnlinking.make = (service) => OAuthAccountUnlinking.of(service);
+})(OAuthAccountUnlinking || (OAuthAccountUnlinking = {}));
+export class OAuthLinkConfirmationError extends Data.TaggedError("OAuthLinkConfirmationError") {
+}
+export class OAuthLinkConfirmation extends Context.Service()("auth/OAuthLinkConfirmation") {
+}
+(function (OAuthLinkConfirmation) {
+    OAuthLinkConfirmation.make = (service) => OAuthLinkConfirmation.of(service);
+})(OAuthLinkConfirmation || (OAuthLinkConfirmation = {}));
+const oauthStateError = (operation, message, cause) => new OAuthStateError({ operation, message, cause });
+const oauthTokenExchangeError = (operation, message, cause) => new OAuthTokenExchangeError({ operation, message, cause });
+const oidcIdTokenVerifierError = (operation, message, cause) => new OidcIdTokenVerifierError({ operation, message, cause });
+const oauthAccountLinkingError = (operation, message, cause) => new OAuthAccountLinkingError({ operation, message, cause });
+const oauthAccountUnlinkingError = (operation, message, cause) => new OAuthAccountUnlinkingError({ operation, message, cause });
+const oauthLinkConfirmationError = (operation, message, cause) => new OAuthLinkConfirmationError({ operation, message, cause });
+const oauthProfileNormalizationError = (reason, message, cause) => new OAuthProfileNormalizationError({
+    operation: "normalize",
+    reason,
+    message,
+    cause,
+});
+const oauthJwksJwtError = (message, cause) => new JwtError({
+    operation: "keys",
+    message,
+    ...(cause === undefined ? {} : { cause }),
+});
+const oauthUserInfoError = (operation, message, cause) => new OAuthUserInfoError({
+    operation,
+    message,
+    ...(cause === undefined ? {} : { cause }),
+});
+const textEncoder = new TextEncoder();
+const oauthJwksPrivateMembers = new Set([
+    "d",
+    "p",
+    "q",
+    "dp",
+    "dq",
+    "qi",
+    "oth",
+    "k",
+]);
+const validateByteLength = (value, operation, label) => Number.isInteger(value) && value >= 16 && value <= 128
+    ? Effect.succeed(value)
+    : Effect.fail(oauthStateError(operation, `${label} byte length must be an integer between 16 and 128`));
+const validateOAuthLinkConfirmationSecretBytes = (value) => Number.isInteger(value) && value >= 16 && value <= 128
+    ? Effect.succeed(value)
+    : Effect.fail(oauthLinkConfirmationError("start", "OAuth link confirmation secret byte length must be an integer between 16 and 128"));
+const metadataValue = (value) => value === undefined ? undefined : structuredClone(value);
+export const makeAppleSignInProvider = (input) => ({
+    id: input.id ?? appleSignInProviderId,
+    clientId: input.clientId,
+    authorizationEndpoint: appleSignInAuthorizationEndpoint,
+    tokenEndpoint: appleSignInTokenEndpoint,
+    revocationEndpoint: appleSignInRevocationEndpoint,
+    jwksUri: appleSignInJwksUri,
+    issuer: appleSignInIssuer,
+    redirectUri: input.redirectUri,
+    scopes: [...(input.scopes ?? appleSignInDefaultScopes)],
+    authorizationParams: {
+        ...appleSignInDefaultAuthorizationParams,
+        ...input.authorizationParams,
+    },
+    ...(input.metadata === undefined ? {} : { metadata: metadataValue(input.metadata) }),
+});
+export const makeGithubOAuthProvider = (input) => ({
+    id: input.id ?? githubOAuthProviderId,
+    clientId: input.clientId,
+    authorizationEndpoint: githubOAuthAuthorizationEndpoint,
+    tokenEndpoint: githubOAuthTokenEndpoint,
+    userInfoEndpoint: githubOAuthUserEndpoint,
+    redirectUri: input.redirectUri,
+    scopes: [...(input.scopes ?? githubOAuthDefaultScopes)],
+    ...(input.authorizationParams === undefined
+        ? {}
+        : { authorizationParams: { ...input.authorizationParams } }),
+    ...(input.metadata === undefined ? {} : { metadata: metadataValue(input.metadata) }),
+});
+export const makeGoogleOidcProvider = (input) => ({
+    id: input.id ?? googleOidcProviderId,
+    clientId: input.clientId,
+    authorizationEndpoint: googleOidcAuthorizationEndpoint,
+    tokenEndpoint: googleOidcTokenEndpoint,
+    revocationEndpoint: googleOidcRevocationEndpoint,
+    userInfoEndpoint: googleOidcUserInfoEndpoint,
+    jwksUri: googleOidcJwksUri,
+    issuer: googleOidcIssuer,
+    redirectUri: input.redirectUri,
+    scopes: [...(input.scopes ?? googleOidcDefaultScopes)],
+    ...(input.authorizationParams === undefined
+        ? {}
+        : { authorizationParams: { ...input.authorizationParams } }),
+    ...(input.metadata === undefined ? {} : { metadata: metadataValue(input.metadata) }),
+});
+export const makeMicrosoftOidcProvider = (input) => ({
+    id: input.id ?? microsoftOidcProviderId,
+    clientId: input.clientId,
+    authorizationEndpoint: microsoftOidcAuthorizationEndpoint(input.tenant),
+    tokenEndpoint: microsoftOidcTokenEndpoint(input.tenant),
+    userInfoEndpoint: microsoftOidcUserInfoEndpoint,
+    jwksUri: microsoftOidcJwksUri(input.tenant),
+    issuer: microsoftOidcIssuer(input.tenant),
+    redirectUri: input.redirectUri,
+    scopes: [...(input.scopes ?? microsoftOidcDefaultScopes)],
+    ...(input.authorizationParams === undefined
+        ? {}
+        : { authorizationParams: { ...input.authorizationParams } }),
+    ...(input.metadata === undefined ? {} : { metadata: metadataValue(input.metadata) }),
+});
+export const makeGenericOidcProvider = (input) => ({
+    id: input.id,
+    clientId: input.clientId,
+    authorizationEndpoint: input.authorizationEndpoint,
+    tokenEndpoint: input.tokenEndpoint,
+    issuer: input.issuer,
+    redirectUri: input.redirectUri,
+    scopes: [...(input.scopes ?? genericOidcDefaultScopes)],
+    ...(input.userInfoEndpoint === undefined
+        ? {}
+        : { userInfoEndpoint: input.userInfoEndpoint }),
+    ...(input.jwksUri === undefined ? {} : { jwksUri: input.jwksUri }),
+    ...(input.revocationEndpoint === undefined
+        ? {}
+        : { revocationEndpoint: input.revocationEndpoint }),
+    ...(input.authorizationParams === undefined
+        ? {}
+        : { authorizationParams: { ...input.authorizationParams } }),
+    ...(input.metadata === undefined ? {} : { metadata: metadataValue(input.metadata) }),
+});
+const cloneProviderConfig = (provider) => ({
+    ...provider,
+    ...(provider.scopes === undefined ? {} : { scopes: [...provider.scopes] }),
+    ...(provider.authorizationParams === undefined
+        ? {}
+        : { authorizationParams: { ...provider.authorizationParams } }),
+    ...(provider.metadata === undefined ? {} : { metadata: metadataValue(provider.metadata) }),
+});
+const encodeOAuthState = (input) => OAuthStateToken(`${input.challengeId}.${Redacted.value(input.secret)}`);
+export const parseOAuthState = (state) => {
+    const parts = String(state).split(".");
+    return parts.length === 2 && parts[0] !== "" && parts[1] !== ""
+        ? Effect.succeed({
+            challengeId: ChallengeId(parts[0]),
+            secret: Redacted.make(parts[1]),
+        })
+        : Effect.fail(oauthStateError("parse", "OAuth state must use '<id>.<secret>' format"));
+};
+const stringArrayFromUnknown = (value) => Array.isArray(value) && value.every((item) => typeof item === "string")
+    ? value
+    : [];
+const stringFromUnknown = (value) => typeof value === "string" && value.length > 0 ? value : undefined;
+const nonEmptyStringFromUnknown = (value) => typeof value === "string" && value.trim() !== "" ? value : undefined;
+export const githubOAuthVerifiedEmail = (emails) => {
+    for (const email of emails) {
+        if (email.primary === true && email.verified === true) {
+            const value = nonEmptyStringFromUnknown(email.email);
+            if (value !== undefined) {
+                return value;
+            }
+        }
+    }
+    for (const email of emails) {
+        if (email.verified === true) {
+            const value = nonEmptyStringFromUnknown(email.email);
+            if (value !== undefined) {
+                return value;
+            }
+        }
+    }
+    return undefined;
+};
+export const googleOidcHostedDomain = (value) => nonEmptyStringFromUnknown(value.hd);
+export const microsoftOidcTenantId = (value) => nonEmptyStringFromUnknown(value.tid);
+export const microsoftOidcObjectId = (value) => nonEmptyStringFromUnknown(value.oid);
+export const microsoftOidcAccountId = (value) => {
+    const tenantId = microsoftOidcTenantId(value);
+    const objectId = microsoftOidcObjectId(value);
+    return tenantId === undefined || objectId === undefined
+        ? undefined
+        : `${tenantId}:${objectId}`;
+};
+const optionalRecord = (value) => (Object.keys(value).length === 0 ? undefined : value);
+const recordFromUnknown = (value) => typeof value === "object" && value !== null && !Array.isArray(value)
+    ? value
+    : undefined;
+const isJwtAlgorithm = (value) => typeof value === "string" && JwtAlgorithms.includes(value);
+const isPublicJwksAlgorithm = (value) => isJwtAlgorithm(value) && value !== "HS256";
+const booleanFromUnknown = (value) => typeof value === "boolean" ? value : undefined;
+const emailFromUnknown = (value) => {
+    const email = nonEmptyStringFromUnknown(value);
+    return email === undefined ? undefined : Email(email);
+};
+const appleSignInBooleanClaim = (value) => {
+    if (typeof value === "boolean") {
+        return value;
+    }
+    if (value === "true") {
+        return true;
+    }
+    if (value === "false") {
+        return false;
+    }
+    return undefined;
+};
+export const decodeAppleSignInAuthorizationUser = (value) => {
+    const decoded = typeof value === "string"
+        ? (() => {
+            try {
+                return JSON.parse(value);
+            }
+            catch {
+                return undefined;
+            }
+        })()
+        : value;
+    const record = recordFromUnknown(decoded);
+    if (record === undefined) {
+        return undefined;
+    }
+    const nameRecord = recordFromUnknown(record.name);
+    const firstName = nonEmptyStringFromUnknown(nameRecord?.firstName);
+    const lastName = nonEmptyStringFromUnknown(nameRecord?.lastName);
+    const name = firstName === undefined && lastName === undefined
+        ? undefined
+        : {
+            ...(firstName === undefined ? {} : { firstName }),
+            ...(lastName === undefined ? {} : { lastName }),
+        };
+    const email = nonEmptyStringFromUnknown(record.email);
+    return email === undefined && name === undefined
+        ? undefined
+        : {
+            ...(email === undefined ? {} : { email }),
+            ...(name === undefined ? {} : { name }),
+        };
+};
+export const appleSignInAuthorizationUserFullName = (user) => {
+    const firstName = nonEmptyStringFromUnknown(user?.name?.firstName);
+    const lastName = nonEmptyStringFromUnknown(user?.name?.lastName);
+    const parts = [firstName, lastName].filter((part) => part !== undefined);
+    return parts.length === 0 ? undefined : parts.join(" ");
+};
+export const appleSignInAuthorizationUserEmail = (user) => emailFromUnknown(user?.email);
+export const appleSignInIsPrivateEmail = (input) => {
+    const claimValue = appleSignInBooleanClaim(input.claims?.is_private_email);
+    if (claimValue !== undefined) {
+        return claimValue;
+    }
+    const email = nonEmptyStringFromUnknown(input.email);
+    return email === undefined
+        ? undefined
+        : email.toLowerCase().endsWith(`@${appleSignInPrivateRelayDomain}`);
+};
+const firstString = (...values) => {
+    for (const value of values) {
+        const stringValue = nonEmptyStringFromUnknown(value);
+        if (stringValue !== undefined) {
+            return stringValue;
+        }
+    }
+    return undefined;
+};
+const optionalStringArrayFromUnknown = (value) => Array.isArray(value) && value.every((item) => typeof item === "string")
+    ? value
+    : undefined;
+const numberFromUnknown = (value) => {
+    if (typeof value === "number" && Number.isFinite(value)) {
+        return value;
+    }
+    if (typeof value === "string" && value.trim() !== "") {
+        const parsed = Number(value);
+        return Number.isFinite(parsed) ? parsed : undefined;
+    }
+    return undefined;
+};
+const isTokenResponseRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const scopeValues = (value) => {
+    if (typeof value !== "string" || value.trim() === "") {
+        return undefined;
+    }
+    return value.trim().split(/\s+/);
+};
+const audienceValues = (value) => {
+    if (typeof value === "string") {
+        return [value];
+    }
+    if (Array.isArray(value) && value.every((item) => typeof item === "string")) {
+        return value;
+    }
+    return [];
+};
+const oidcIdTokenClaims = (claims, input) => {
+    if (nonEmptyStringFromUnknown(claims.sub) === undefined) {
+        return "missing_subject";
+    }
+    if (typeof claims.exp !== "number" || !Number.isFinite(claims.exp)) {
+        return "missing_expiration";
+    }
+    if (typeof claims.iat !== "number" || !Number.isFinite(claims.iat)) {
+        return "missing_issued_at";
+    }
+    const audiences = audienceValues(claims.aud);
+    const authorizedParty = input.authorizedParty ?? input.provider.clientId;
+    if (audiences.length > 1 && claims.azp === undefined) {
+        return "missing_authorized_party";
+    }
+    if (claims.azp !== undefined && claims.azp !== authorizedParty) {
+        return "authorized_party_mismatch";
+    }
+    if (input.nonce !== undefined && claims.nonce !== String(input.nonce)) {
+        return "nonce_mismatch";
+    }
+    return claims;
+};
+const tokenResponseExtra = (value) => {
+    const extra = Object.fromEntries(Object.entries(value).filter(([key]) => ![
+        "access_token",
+        "token_type",
+        "expires_in",
+        "refresh_token",
+        "id_token",
+        "scope",
+    ].includes(key)));
+    return Object.keys(extra).length === 0 ? undefined : extra;
+};
+const cloneVerifiedOAuthIdentity = (identity) => ({
+    ...identity,
+    ...(identity.metadata === undefined
+        ? {}
+        : { metadata: metadataValue(identity.metadata) }),
+});
+const oauthLinkConfirmationChallengeType = "oauth-link-confirmation";
+const oauthLinkConfirmationMetadata = (input) => ({
+    userId: input.userId,
+    providerId: input.identity.providerId,
+    providerAccountId: input.identity.providerAccountId,
+    ...(input.identity.email === undefined ? {} : { email: input.identity.email }),
+    ...(input.identity.emailVerified === undefined
+        ? {}
+        : { emailVerified: input.identity.emailVerified }),
+    ...(input.identity.metadata === undefined
+        ? {}
+        : { identityMetadata: metadataValue(input.identity.metadata) }),
+    reason: input.reason,
+    ...(input.metadata === undefined ? {} : { metadata: metadataValue(input.metadata) }),
+});
+const pendingOAuthLinkConfirmationFromChallenge = (challenge, operation) => {
+    const metadata = challenge.metadata ?? {};
+    const userId = stringFromUnknown(metadata.userId);
+    const providerId = stringFromUnknown(metadata.providerId);
+    const providerAccountId = stringFromUnknown(metadata.providerAccountId);
+    if (userId === undefined ||
+        userId !== challenge.subject ||
+        providerId === undefined ||
+        providerAccountId === undefined) {
+        return Effect.fail(oauthLinkConfirmationError(operation, "OAuth link confirmation challenge is missing required metadata"));
+    }
+    const email = emailFromUnknown(metadata.email);
+    const emailVerified = booleanFromUnknown(metadata.emailVerified);
+    const identityMetadata = recordFromUnknown(metadata.identityMetadata);
+    const appMetadata = recordFromUnknown(metadata.metadata);
+    return Effect.succeed({
+        challengeId: challenge.id,
+        userId: UserId(userId),
+        identity: {
+            providerId: OAuthProviderId(providerId),
+            providerAccountId,
+            ...(email === undefined ? {} : { email }),
+            ...(emailVerified === undefined ? {} : { emailVerified }),
+            ...(identityMetadata === undefined
+                ? {}
+                : { metadata: metadataValue(identityMetadata) }),
+        },
+        reason: stringFromUnknown(metadata.reason) ??
+            "manual",
+        expiresAt: challenge.expiresAt,
+        ...(appMetadata === undefined ? {} : { metadata: metadataValue(appMetadata) }),
+    });
+};
+const confirmedOAuthLinkConfirmationFromPending = (input) => ({
+    challengeId: input.pending.challengeId,
+    userId: input.pending.userId,
+    identity: cloneVerifiedOAuthIdentity(input.pending.identity),
+    reason: input.pending.reason,
+    ...(input.existingAccount === undefined
+        ? {}
+        : { existingAccount: input.existingAccount }),
+    ...(input.pending.metadata === undefined
+        ? {}
+        : { metadata: metadataValue(input.pending.metadata) }),
+});
+const userInfoRecord = (value) => {
+    if (value === undefined) {
+        return Effect.succeed(undefined);
+    }
+    const record = recordFromUnknown(value);
+    return record === undefined
+        ? Effect.fail(oauthProfileNormalizationError("invalid_userinfo", "OIDC userinfo response must be an object"))
+        : Effect.succeed(record);
+};
+const makeOAuthProfile = (input) => ({
+    providerId: input.providerId,
+    providerAccountId: input.providerAccountId,
+    ...(input.email === undefined ? {} : { email: input.email }),
+    ...(input.emailVerified === undefined
+        ? {}
+        : { emailVerified: input.emailVerified }),
+    ...(input.name === undefined ? {} : { name: input.name }),
+    ...(input.username === undefined ? {} : { username: input.username }),
+    ...(input.avatarUrl === undefined ? {} : { avatarUrl: input.avatarUrl }),
+    ...(input.metadata === undefined ? {} : { metadata: metadataValue(input.metadata) }),
+});
+const oauthJwksPublicJwkFromUnknown = (value) => {
+    const record = recordFromUnknown(value);
+    const kty = record === undefined ? undefined : nonEmptyStringFromUnknown(record.kty);
+    if (record === undefined || kty === undefined) {
+        return undefined;
+    }
+    const jwk = {};
+    for (const [name, member] of Object.entries(record)) {
+        if (!oauthJwksPrivateMembers.has(name) && member !== undefined) {
+            jwk[name] = member;
+        }
+    }
+    return {
+        ...jwk,
+        kty,
+    };
+};
+const oauthJwksAllowsSignatureUse = (jwk) => {
+    const use = nonEmptyStringFromUnknown(jwk.use);
+    const keyOps = optionalStringArrayFromUnknown(jwk.key_ops);
+    return ((use === undefined || use === "sig") &&
+        (keyOps === undefined || keyOps.includes("verify")));
+};
+const oauthJwksDefaultAlgorithms = (jwk) => {
+    switch (jwk.kty) {
+        case "RSA": {
+            return ["RS256"];
+        }
+        case "EC": {
+            return ["ES256"];
+        }
+        case "OKP": {
+            return ["EdDSA"];
+        }
+        default: {
+            return [];
+        }
+    }
+};
+const oauthJwksAlgorithms = (jwk, allowedAlgorithms) => {
+    const jwkAlgorithm = nonEmptyStringFromUnknown(jwk.alg);
+    const algorithms = jwkAlgorithm === undefined
+        ? oauthJwksDefaultAlgorithms(jwk)
+        : isPublicJwksAlgorithm(jwkAlgorithm)
+            ? [jwkAlgorithm]
+            : [];
+    if (allowedAlgorithms === undefined) {
+        return algorithms;
+    }
+    return algorithms.filter((algorithm) => allowedAlgorithms.includes(algorithm));
+};
+const oauthJwksRecordsFromDocument = (provider, document, allowedAlgorithms) => document.keys.flatMap((jwk) => {
+    const kid = nonEmptyStringFromUnknown(jwk.kid);
+    if (kid === undefined || !oauthJwksAllowsSignatureUse(jwk)) {
+        return [];
+    }
+    return oauthJwksAlgorithms(jwk, allowedAlgorithms).map((alg) => ({
+        id: JwtKeyId(kid),
+        alg,
+        status: "active",
+        publicJwk: {
+            ...jwk,
+            kid,
+            alg,
+            use: nonEmptyStringFromUnknown(jwk.use) ?? "sig",
+        },
+        metadata: {
+            providerId: provider.id,
+        },
+    }));
+});
+const oauthJwksKeyUsableAt = (key, now) => now === undefined || key.expiresAt === undefined || Number(now) < Number(key.expiresAt);
+const oauthJwksVerificationKeyMatches = (key, input) => key.id === input.kid &&
+    key.status !== "disabled" &&
+    key.publicJwk !== undefined &&
+    (input.alg === undefined || key.alg === input.alg) &&
+    oauthJwksKeyUsableAt(key, input.now);
+const oauthJwksNow = (now) => now === undefined ? currentUnixMillis : Effect.succeed(now);
+const formUrlEncode = (value) => new URLSearchParams([["", value]]).toString().slice(1);
+const clientSecretBasic = (provider, secret) => `Basic ${Encoding.encodeBase64(textEncoder.encode(`${formUrlEncode(provider.clientId)}:${formUrlEncode(secret)}`))}`;
+const oauthTokenRequestHeaders = () => ({
+    "content-type": "application/x-www-form-urlencoded",
+    accept: "application/json",
+});
+const oauthRequestHeadersWithoutAuthorization = (headers) => {
+    const value = {};
+    for (const [name, headerValue] of Object.entries(headers ?? {})) {
+        if (name.toLowerCase() !== "authorization") {
+            value[name] = headerValue;
+        }
+    }
+    return value;
+};
+const applyOAuthClientAuthentication = (input) => {
+    const clientAuthentication = input.clientAuthentication ?? { method: "none" };
+    if (clientAuthentication.method === "client_secret_basic") {
+        input.body.delete("client_id");
+        input.body.delete("client_secret");
+        input.headers.authorization = clientSecretBasic(input.provider, Redacted.value(clientAuthentication.clientSecret));
+    }
+    else {
+        input.body.set("client_id", input.provider.clientId);
+    }
+    if (clientAuthentication.method === "client_secret_post") {
+        input.body.set("client_secret", Redacted.value(clientAuthentication.clientSecret));
+    }
+};
+export const makeOAuthTokenRequest = (input) => Effect.try({
+    try: () => {
+        if (input.provider.tokenEndpoint === undefined) {
+            throw new Error("OAuth provider tokenEndpoint is required");
+        }
+        const body = new URLSearchParams(input.params);
+        const headers = oauthTokenRequestHeaders();
+        body.set("grant_type", "authorization_code");
+        body.set("code", String(input.code));
+        body.set("redirect_uri", input.redirectUri ?? input.provider.redirectUri);
+        body.set("code_verifier", Redacted.value(input.codeVerifier));
+        applyOAuthClientAuthentication({
+            provider: input.provider,
+            body,
+            headers,
+            clientAuthentication: input.clientAuthentication,
+        });
+        return {
+            url: input.provider.tokenEndpoint,
+            method: "POST",
+            headers,
+            body: body.toString(),
+        };
+    },
+    catch: (cause) => oauthTokenExchangeError("token-request", "Failed to build OAuth token request", cause),
+});
+export const makeOAuthRefreshTokenRequest = (input) => Effect.try({
+    try: () => {
+        if (input.provider.tokenEndpoint === undefined) {
+            throw new Error("OAuth provider tokenEndpoint is required");
+        }
+        const body = new URLSearchParams(input.params);
+        const headers = oauthTokenRequestHeaders();
+        body.set("grant_type", "refresh_token");
+        body.set("refresh_token", Redacted.value(input.refreshToken));
+        if (input.scopes !== undefined) {
+            body.set("scope", input.scopes.join(" "));
+        }
+        applyOAuthClientAuthentication({
+            provider: input.provider,
+            body,
+            headers,
+            clientAuthentication: input.clientAuthentication,
+        });
+        return {
+            url: input.provider.tokenEndpoint,
+            method: "POST",
+            headers,
+            body: body.toString(),
+        };
+    },
+    catch: (cause) => oauthTokenExchangeError("refresh-token-request", "Failed to build OAuth refresh token request", cause),
+});
+export const makeOAuthTokenRevocationRequest = (input) => Effect.try({
+    try: () => {
+        if (input.provider.revocationEndpoint === undefined) {
+            throw new Error("OAuth provider revocationEndpoint is required");
+        }
+        const body = new URLSearchParams(input.params);
+        const headers = oauthTokenRequestHeaders();
+        body.set("token", Redacted.value(input.token));
+        if (input.tokenTypeHint !== undefined) {
+            body.set("token_type_hint", input.tokenTypeHint);
+        }
+        applyOAuthClientAuthentication({
+            provider: input.provider,
+            body,
+            headers,
+            clientAuthentication: input.clientAuthentication,
+        });
+        return {
+            url: input.provider.revocationEndpoint,
+            method: "POST",
+            headers,
+            body: body.toString(),
+        };
+    },
+    catch: (cause) => oauthTokenExchangeError("revocation-request", "Failed to build OAuth token revocation request", cause),
+});
+export const makeOAuthUserInfoRequest = (input) => Effect.try({
+    try: () => {
+        if (input.provider.userInfoEndpoint === undefined) {
+            throw new Error("OAuth provider userInfoEndpoint is required");
+        }
+        const url = new URL(input.provider.userInfoEndpoint);
+        for (const [name, value] of Object.entries(input.params ?? {})) {
+            url.searchParams.set(name, value);
+        }
+        return {
+            url: url.toString(),
+            method: "GET",
+            headers: {
+                accept: "application/json",
+                ...oauthRequestHeadersWithoutAuthorization(input.headers),
+                authorization: `Bearer ${Redacted.value(input.accessToken)}`,
+            },
+        };
+    },
+    catch: (cause) => oauthUserInfoError("request", "Failed to build OAuth userinfo request", cause),
+});
+export const decodeOAuthUserInfoResponse = (value) => {
+    const record = recordFromUnknown(value);
+    return record === undefined
+        ? Effect.fail(oauthUserInfoError("decode", "OAuth userinfo response must be an object"))
+        : Effect.succeed(metadataValue(record) ?? {});
+};
+export const decodeOAuthTokenResponse = (value) => Effect.gen(function* () {
+    if (!isTokenResponseRecord(value)) {
+        return yield* oauthTokenExchangeError("decode-token-response", "OAuth token response must be an object");
+    }
+    const accessToken = stringFromUnknown(value.access_token);
+    const tokenType = stringFromUnknown(value.token_type);
+    if (accessToken === undefined) {
+        return yield* oauthTokenExchangeError("decode-token-response", "OAuth token response is missing access_token");
+    }
+    if (tokenType === undefined) {
+        return yield* oauthTokenExchangeError("decode-token-response", "OAuth token response is missing token_type");
+    }
+    const refreshToken = stringFromUnknown(value.refresh_token);
+    const idToken = stringFromUnknown(value.id_token);
+    return {
+        accessToken: Redacted.make(OAuthAccessToken(accessToken)),
+        tokenType,
+        expiresIn: numberFromUnknown(value.expires_in),
+        ...(refreshToken === undefined
+            ? {}
+            : { refreshToken: Redacted.make(OAuthRefreshToken(refreshToken)) }),
+        ...(idToken === undefined
+            ? {}
+            : { idToken: Redacted.make(OAuthIdToken(idToken)) }),
+        scopes: scopeValues(value.scope),
+        extra: tokenResponseExtra(value),
+    };
+});
+export const makeOidcIdTokenVerifier = (dependencies) => OidcIdTokenVerifier.make({
+    verify: Effect.fn("auth.oidc_id_token.verify")(function* (input) {
+        const { provider } = input;
+        const { issuer } = provider;
+        if (issuer === undefined) {
+            return {
+                valid: false,
+                reason: "missing_provider_issuer",
+            };
+        }
+        const verified = yield* dependencies.jwtVerifier
+            .verify({
+            token: Redacted.make(Redacted.value(input.idToken)),
+            issuer,
+            audience: input.audience ?? provider.clientId,
+            now: input.now,
+            clockTolerance: input.clockTolerance,
+        })
+            .pipe(Effect.mapError((cause) => oidcIdTokenVerifierError("verify", "Failed to verify OIDC ID token JWT", cause)));
+        if (!verified.valid) {
+            return verified;
+        }
+        const claims = oidcIdTokenClaims(verified.claims, input);
+        if (typeof claims === "string") {
+            return { valid: false, reason: claims };
+        }
+        return {
+            valid: true,
+            header: verified.header,
+            claims,
+            key: verified.key,
+        };
+    }),
+});
+export const verifyOidcIdToken = (input) => OidcIdTokenVerifier.use((verifier) => verifier.verify(input));
+export const decodeOAuthJwksDocument = (input) => Effect.gen(function* () {
+    const record = recordFromUnknown(input);
+    if (record === undefined || !Array.isArray(record.keys)) {
+        return yield* oauthJwksJwtError("OAuth JWKS document must contain keys");
+    }
+    const keys = [];
+    for (const key of record.keys) {
+        const publicJwk = oauthJwksPublicJwkFromUnknown(key);
+        if (publicJwk === undefined) {
+            return yield* oauthJwksJwtError("OAuth JWKS key must be a public JWK");
+        }
+        keys.push(publicJwk);
+    }
+    return { keys };
+});
+export const makeOAuthJwksJwtKeys = (dependencies) => {
+    const cacheTtlMillis = Math.max(0, Duration.toMillis(dependencies.cacheTtl ?? defaultOAuthJwksCacheTtl));
+    const allowedAlgorithms = dependencies.allowedAlgorithms?.filter(isPublicJwksAlgorithm);
+    let cache;
+    const loadRecords = (now) => Effect.gen(function* () {
+        if (cache !== undefined && Number(now) < Number(cache.expiresAt)) {
+            return cache.records;
+        }
+        const url = nonEmptyStringFromUnknown(dependencies.provider.jwksUri);
+        if (url === undefined) {
+            return yield* oauthJwksJwtError("OAuth provider JWKS URI is required");
+        }
+        const rawDocument = yield* dependencies.fetch({
+            provider: dependencies.provider,
+            url,
+        });
+        const document = yield* decodeOAuthJwksDocument(rawDocument);
+        const records = oauthJwksRecordsFromDocument(dependencies.provider, document, allowedAlgorithms);
+        cache = {
+            records,
+            expiresAt: UnixMillis(Number(now) + cacheTtlMillis),
+        };
+        return records;
+    });
+    return JwtKeys.make({
+        selectSigningKey: () => Effect.succeed(Option.none()),
+        findVerificationKey: Effect.fn("auth.oauth_jwks.find_verification_key")(function* (input) {
+            const now = yield* oauthJwksNow(input.now);
+            const records = yield* loadRecords(now);
+            const key = records.find((record) => oauthJwksVerificationKeyMatches(record, { ...input, now }));
+            return key === undefined ? Option.none() : Option.some(key);
+        }),
+        listPublicJwks: Effect.fn("auth.oauth_jwks.list_public_jwks")(function* (input) {
+            const now = yield* oauthJwksNow(input?.now);
+            const records = yield* loadRecords(now);
+            return records.flatMap((record) => record.publicJwk === undefined || !oauthJwksKeyUsableAt(record, now)
+                ? []
+                : [record.publicJwk]);
+        }),
+    });
+};
+export const normalizeOidcProfile = (input) => Effect.gen(function* () {
+    const { claims, provider } = input;
+    if (claims === undefined) {
+        return yield* oauthProfileNormalizationError("missing_claims", "OIDC ID token claims are required to normalize an OAuth profile");
+    }
+    const subject = nonEmptyStringFromUnknown(claims.sub);
+    if (subject === undefined) {
+        return yield* oauthProfileNormalizationError("missing_subject", "OIDC profile is missing subject");
+    }
+    const userInfo = yield* userInfoRecord(input.userInfo);
+    const userInfoSubject = userInfo === undefined ? undefined : nonEmptyStringFromUnknown(userInfo.sub);
+    if (userInfoSubject !== undefined && userInfoSubject !== subject) {
+        return yield* oauthProfileNormalizationError("subject_mismatch", "OIDC userinfo subject does not match ID token subject");
+    }
+    const email = emailFromUnknown(userInfo?.email) ?? emailFromUnknown(claims.email);
+    const emailVerified = booleanFromUnknown(userInfo?.email_verified) ??
+        booleanFromUnknown(claims.email_verified);
+    const metadata = optionalRecord({
+        ...(input.metadata === undefined ? {} : input.metadata),
+    });
+    return makeOAuthProfile({
+        providerId: provider.id,
+        providerAccountId: subject,
+        email,
+        emailVerified,
+        name: firstString(userInfo?.name, claims.name),
+        username: firstString(userInfo?.preferred_username, claims.preferred_username),
+        avatarUrl: firstString(userInfo?.picture, claims.picture),
+        metadata,
+    });
+});
+export const makeOidcOAuthProfileNormalizer = () => OAuthProfileNormalizer.make({
+    normalize: Effect.fn("auth.oauth_profile.normalize_oidc")(normalizeOidcProfile),
+});
+export const normalizeOAuthProfile = (input) => OAuthProfileNormalizer.use((normalizer) => normalizer.normalize(input));
+export const verifiedOAuthIdentityFromProfile = (profile) => {
+    const metadata = optionalRecord({
+        ...(profile.name === undefined ? {} : { name: profile.name }),
+        ...(profile.username === undefined ? {} : { username: profile.username }),
+        ...(profile.avatarUrl === undefined ? {} : { avatarUrl: profile.avatarUrl }),
+        ...(profile.metadata === undefined ? {} : profile.metadata),
+    });
+    return {
+        providerId: profile.providerId,
+        providerAccountId: profile.providerAccountId,
+        ...(profile.email === undefined ? {} : { email: profile.email }),
+        ...(profile.emailVerified === undefined
+            ? {}
+            : { emailVerified: profile.emailVerified }),
+        ...(metadata === undefined ? {} : { metadata: metadataValue(metadata) }),
+    };
+};
+export const makeOAuthTokenExchange = (dependencies) => OAuthTokenExchange.make({
+    exchangeAuthorizationCode: Effect.fn("auth.oauth_token.exchange_code")(function* (input) {
+        const request = yield* makeOAuthTokenRequest(input);
+        const response = yield* dependencies.request(request);
+        return yield* decodeOAuthTokenResponse(response).pipe(Effect.mapError((cause) => oauthTokenExchangeError("exchange-code", "Failed to decode OAuth token exchange response", cause)));
+    }),
+});
+export const completeOAuthCallback = (input) => Effect.gen(function* () {
+    const oauthState = yield* OAuthState;
+    const tokenExchange = yield* OAuthTokenExchange;
+    const verifiedState = yield* oauthState.verify({ state: input.state });
+    if (verifiedState.providerId !== input.provider.id) {
+        return yield* oauthStateError("verify", "OAuth callback provider does not match verified state");
+    }
+    const tokens = yield* tokenExchange.exchangeAuthorizationCode({
+        provider: input.provider,
+        code: input.code,
+        codeVerifier: input.codeVerifier,
+        redirectUri: input.redirectUri ?? verifiedState.redirectUri ?? input.provider.redirectUri,
+        clientAuthentication: input.clientAuthentication,
+        params: input.tokenParams,
+    });
+    return { state: verifiedState, tokens };
+});
+export const makeOAuthAccountLinkingPolicy = (dependencies) => OAuthAccountLinking.make({
+    resolve: Effect.fn("auth.oauth_account_linking.resolve")(function* (input) {
+        const identity = cloneVerifiedOAuthIdentity(input.identity);
+        const linked = yield* dependencies.accounts
+            .findByProviderAccount({
+            providerId: identity.providerId,
+            providerAccountId: identity.providerAccountId,
+        })
+            .pipe(Effect.mapError((cause) => oauthAccountLinkingError("resolve", "Failed to look up OAuth provider account", cause)));
+        if (Option.isSome(linked)) {
+            const account = linked.value;
+            if (input.currentUserId !== undefined &&
+                account.userId !== input.currentUserId) {
+                return {
+                    type: "deny",
+                    reason: "provider-account-linked-to-different-user",
+                    identity,
+                    account,
+                    currentUserId: input.currentUserId,
+                };
+            }
+            return {
+                type: "sign-in",
+                reason: "linked-account",
+                userId: account.userId,
+                account,
+            };
+        }
+        if (input.currentUserId !== undefined) {
+            return {
+                type: "link-existing-user",
+                reason: "current-user",
+                userId: input.currentUserId,
+                identity,
+            };
+        }
+        if (input.matchedUserId !== undefined) {
+            if (dependencies.autoLinkVerifiedEmail === true &&
+                identity.emailVerified === true) {
+                return {
+                    type: "link-existing-user",
+                    reason: "verified-email",
+                    userId: input.matchedUserId,
+                    identity,
+                };
+            }
+            return {
+                type: "require-explicit-linking",
+                reason: identity.emailVerified === true ? "matched-email" : "unverified-email",
+                identity,
+                matchedUserId: input.matchedUserId,
+            };
+        }
+        return {
+            type: "require-explicit-linking",
+            reason: "no-linked-account",
+            identity,
+        };
+    }),
+});
+export const resolveOAuthAccountLinking = (input) => OAuthAccountLinking.use((linking) => linking.resolve(input));
+export const makeOAuthAccountUnlinkingPolicy = (dependencies) => OAuthAccountUnlinking.make({
+    resolve: Effect.fn("auth.oauth_account_unlinking.resolve")(function* (input) {
+        const account = yield* dependencies.accounts
+            .findByProviderAccount({
+            providerId: input.providerId,
+            providerAccountId: input.providerAccountId,
+        })
+            .pipe(Effect.mapError((cause) => oauthAccountUnlinkingError("resolve", "Failed to look up OAuth provider account", cause)));
+        if (Option.isNone(account)) {
+            return {
+                type: "deny-not-found",
+                reason: "provider-account-not-found",
+                userId: input.userId,
+                providerId: input.providerId,
+                providerAccountId: input.providerAccountId,
+            };
+        }
+        const linkedAccount = account.value;
+        if (linkedAccount.userId !== input.userId) {
+            return {
+                type: "deny-not-owner",
+                reason: "provider-account-linked-to-different-user",
+                userId: input.userId,
+                account: linkedAccount,
+            };
+        }
+        const remainingAccounts = yield* dependencies.accounts
+            .listByUser({ userId: input.userId })
+            .pipe(Effect.map((accounts) => accounts.filter((linked) => linked.id !== linkedAccount.id)), Effect.mapError((cause) => oauthAccountUnlinkingError("resolve", "Failed to list OAuth provider accounts for user", cause)));
+        if (dependencies.allowLastAccount !== true && remainingAccounts.length === 0) {
+            return {
+                type: "deny-last-account",
+                reason: "last-linked-account",
+                userId: input.userId,
+                account: linkedAccount,
+            };
+        }
+        if (dependencies.requireStepUp === true && input.stepUpSatisfied !== true) {
+            return {
+                type: "requires-step-up",
+                reason: "step-up-required",
+                userId: input.userId,
+                account: linkedAccount,
+                remainingAccounts,
+            };
+        }
+        return {
+            type: "allow",
+            reason: "owned-account",
+            userId: input.userId,
+            account: linkedAccount,
+            remainingAccounts,
+        };
+    }),
+});
+export const resolveOAuthAccountUnlinking = (input) => OAuthAccountUnlinking.use((unlinking) => unlinking.resolve(input));
+const findOAuthLinkConfirmationExistingAccount = (dependencies, input) => dependencies.accounts
+    .findByProviderAccount({
+    providerId: input.identity.providerId,
+    providerAccountId: input.identity.providerAccountId,
+})
+    .pipe(Effect.mapError((cause) => oauthLinkConfirmationError(input.operation, "Failed to look up OAuth provider account", cause)), Effect.flatMap((account) => {
+    if (Option.isNone(account)) {
+        return Effect.succeed(account);
+    }
+    if (account.value.userId !== input.userId) {
+        return Effect.fail(oauthLinkConfirmationError(input.operation, "OAuth provider account is linked to a different user"));
+    }
+    return Effect.succeed(account);
+}));
+export const makeOAuthLinkConfirmation = (dependencies) => OAuthLinkConfirmation.make({
+    start: Effect.fn("auth.oauth_link_confirmation.start")(function* (input) {
+        const identity = cloneVerifiedOAuthIdentity(input.identity);
+        const reason = input.reason ?? "manual";
+        const existing = yield* findOAuthLinkConfirmationExistingAccount(dependencies, {
+            operation: "start",
+            userId: input.userId,
+            identity,
+        });
+        if (Option.isSome(existing)) {
+            return yield* oauthLinkConfirmationError("start", "OAuth provider account is already linked to this user");
+        }
+        const secret = input.secret ??
+            (yield* dependencies.crypto
+                .randomToken(yield* validateOAuthLinkConfirmationSecretBytes(dependencies.secretBytes ?? defaultOAuthLinkConfirmationSecretBytes))
+                .pipe(Effect.map(Redacted.make), Effect.mapError((cause) => oauthLinkConfirmationError("start", "Failed to generate OAuth link confirmation secret", cause))));
+        const issued = yield* dependencies.challenge
+            .issue({
+            type: oauthLinkConfirmationChallengeType,
+            subject: input.userId,
+            ttl: input.ttl ?? defaultOAuthLinkConfirmationTtl,
+            secret,
+            metadata: oauthLinkConfirmationMetadata({
+                userId: input.userId,
+                identity,
+                reason,
+                metadata: input.metadata,
+            }),
+        })
+            .pipe(Effect.mapError((cause) => oauthLinkConfirmationError("start", "Failed to issue OAuth link confirmation challenge", cause)));
+        return {
+            challengeId: issued.id,
+            userId: input.userId,
+            identity,
+            reason,
+            secret,
+            expiresAt: issued.expiresAt,
+            ...(input.metadata === undefined
+                ? {}
+                : { metadata: metadataValue(input.metadata) }),
+        };
+    }),
+    inspect: Effect.fn("auth.oauth_link_confirmation.inspect")(function* (input) {
+        const inspected = yield* dependencies.challenge
+            .inspect({
+            challengeId: input.challengeId,
+            type: oauthLinkConfirmationChallengeType,
+            secret: input.secret,
+        })
+            .pipe(Effect.mapError((cause) => oauthLinkConfirmationError("inspect", "Invalid OAuth link confirmation challenge", cause)));
+        const pending = yield* pendingOAuthLinkConfirmationFromChallenge(inspected, "inspect");
+        yield* findOAuthLinkConfirmationExistingAccount(dependencies, {
+            operation: "inspect",
+            userId: pending.userId,
+            identity: pending.identity,
+        });
+        return pending;
+    }),
+    confirm: Effect.fn("auth.oauth_link_confirmation.confirm")(function* (input) {
+        const inspected = yield* dependencies.challenge
+            .inspect({
+            challengeId: input.challengeId,
+            type: oauthLinkConfirmationChallengeType,
+            secret: input.secret,
+        })
+            .pipe(Effect.mapError((cause) => oauthLinkConfirmationError("confirm", "Invalid OAuth link confirmation challenge", cause)));
+        const pending = yield* pendingOAuthLinkConfirmationFromChallenge(inspected, "confirm");
+        if (input.currentUserId !== undefined && input.currentUserId !== pending.userId) {
+            return yield* oauthLinkConfirmationError("confirm", "OAuth link confirmation does not match current user");
+        }
+        if (input.expectedProviderId !== undefined &&
+            input.expectedProviderId !== pending.identity.providerId) {
+            return yield* oauthLinkConfirmationError("confirm", "OAuth link confirmation provider mismatch");
+        }
+        if (input.expectedProviderAccountId !== undefined &&
+            input.expectedProviderAccountId !== pending.identity.providerAccountId) {
+            return yield* oauthLinkConfirmationError("confirm", "OAuth link confirmation provider account mismatch");
+        }
+        const existing = yield* findOAuthLinkConfirmationExistingAccount(dependencies, {
+            operation: "confirm",
+            userId: pending.userId,
+            identity: pending.identity,
+        });
+        yield* dependencies.challenge
+            .verify({
+            challengeId: input.challengeId,
+            type: oauthLinkConfirmationChallengeType,
+            secret: input.secret,
+        })
+            .pipe(Effect.mapError((cause) => oauthLinkConfirmationError("confirm", "Failed to consume OAuth link confirmation challenge", cause)));
+        return confirmedOAuthLinkConfirmationFromPending({
+            pending,
+            ...(Option.isSome(existing) ? { existingAccount: existing.value } : {}),
+        });
+    }),
+});
+export const startOAuthLinkConfirmation = (input) => OAuthLinkConfirmation.use((confirmation) => confirmation.start(input));
+export const inspectOAuthLinkConfirmation = (input) => OAuthLinkConfirmation.use((confirmation) => confirmation.inspect(input));
+export const confirmOAuthLinkConfirmation = (input) => OAuthLinkConfirmation.use((confirmation) => confirmation.confirm(input));
+const makeOAuthPkceWithCrypto = (dependencies, input) => Effect.gen(function* () {
+    const verifier = input?.codeVerifier === undefined
+        ? yield* dependencies.crypto
+            .randomToken(yield* validateByteLength(input?.verifierBytes ??
+            dependencies.codeVerifierBytes ??
+            defaultOAuthCodeVerifierBytes, "pkce", "OAuth code verifier"))
+            .pipe(Effect.map(OAuthCodeVerifier), Effect.mapError((cause) => oauthStateError("pkce", "Failed to generate OAuth code verifier", cause)))
+        : OAuthCodeVerifier(Redacted.value(input.codeVerifier));
+    const codeChallenge = yield* dependencies.crypto
+        .digestSha256({ data: verifier })
+        .pipe(Effect.map(OAuthCodeChallenge), Effect.mapError((cause) => oauthStateError("pkce", "Failed to calculate OAuth PKCE challenge", cause)));
+    return {
+        codeVerifier: Redacted.make(verifier),
+        codeChallenge,
+        codeChallengeMethod: "S256",
+    };
+});
+export const makeOAuthPkce = (input) => Effect.gen(function* () {
+    const crypto = yield* Crypto;
+    return yield* makeOAuthPkceWithCrypto({ crypto }, input);
+});
+const appendParams = (url, params) => {
+    if (params === undefined) {
+        return;
+    }
+    for (const [key, value] of Object.entries(params)) {
+        if (value !== undefined) {
+            url.searchParams.set(key, value);
+        }
+    }
+};
+const makeAuthorizationUrl = (input) => Effect.try({
+    try: () => {
+        const url = new URL(input.provider.authorizationEndpoint);
+        appendParams(url, input.provider.authorizationParams);
+        appendParams(url, input.params);
+        appendParams(url, {
+            response_type: "code",
+            client_id: input.provider.clientId,
+            redirect_uri: input.redirectUri,
+            scope: input.scopes.length === 0 ? undefined : input.scopes.join(" "),
+            state: input.state,
+            code_challenge: input.pkce.codeChallenge,
+            code_challenge_method: input.pkce.codeChallengeMethod,
+            nonce: input.nonce,
+        });
+        return url.toString();
+    },
+    catch: (cause) => oauthStateError("authorization-url", "Failed to build OAuth authorization URL", cause),
+});
+export const makeOAuthState = (dependencies) => OAuthState.make({
+    start: Effect.fn("auth.oauth_state.start")(function* (input) {
+        const stateSecretBytes = yield* validateByteLength(dependencies.stateSecretBytes ?? defaultOAuthStateSecretBytes, "start", "OAuth state secret");
+        const stateSecret = yield* dependencies.crypto.randomToken(stateSecretBytes).pipe(Effect.map(Redacted.make), Effect.mapError((cause) => oauthStateError("start", "Failed to generate OAuth state secret", cause)));
+        const pkce = yield* makeOAuthPkceWithCrypto(dependencies, {
+            codeVerifier: input.codeVerifier,
+            verifierBytes: dependencies.codeVerifierBytes,
+        });
+        const includeNonce = input.includeNonce ?? input.provider.issuer !== undefined;
+        const nonce = input.nonce === undefined && !includeNonce
+            ? undefined
+            : input.nonce === undefined
+                ? yield* dependencies.crypto
+                    .randomToken(dependencies.nonceBytes ?? defaultOAuthNonceBytes)
+                    .pipe(Effect.map(OAuthNonce), Effect.mapError((cause) => oauthStateError("start", "Failed to generate OAuth nonce", cause)))
+                : OAuthNonce(input.nonce);
+        const redirectUri = input.redirectUri ?? input.provider.redirectUri;
+        const scopes = input.scopes ?? input.provider.scopes ?? [];
+        const issued = yield* dependencies.challenge
+            .issue({
+            type: "oauth-state",
+            subject: input.provider.id,
+            ttl: input.ttl ?? defaultOAuthStateTtl,
+            secret: stateSecret,
+            metadata: {
+                providerId: input.provider.id,
+                redirectUri,
+                scopes,
+                codeChallenge: pkce.codeChallenge,
+                ...(nonce === undefined ? {} : { nonce }),
+                ...(input.metadata === undefined ? {} : { metadata: input.metadata }),
+            },
+        })
+            .pipe(Effect.mapError((cause) => oauthStateError("start", "Failed to issue OAuth state challenge", cause)));
+        const state = encodeOAuthState({ challengeId: issued.id, secret: stateSecret });
+        const authorizationUrl = yield* makeAuthorizationUrl({
+            provider: input.provider,
+            redirectUri,
+            scopes,
+            params: input.authorizationParams,
+            state,
+            pkce,
+            nonce,
+        });
+        return {
+            providerId: input.provider.id,
+            authorizationUrl,
+            state,
+            challengeId: issued.id,
+            expiresAt: issued.expiresAt,
+            codeVerifier: pkce.codeVerifier,
+            codeChallenge: pkce.codeChallenge,
+            codeChallengeMethod: pkce.codeChallengeMethod,
+            ...(nonce === undefined ? {} : { nonce }),
+            redirectUri,
+            scopes,
+        };
+    }),
+    verify: Effect.fn("auth.oauth_state.verify")(function* (input) {
+        const parsed = yield* parseOAuthState(input.state);
+        const verified = yield* dependencies.challenge
+            .verify({
+            challengeId: parsed.challengeId,
+            type: "oauth-state",
+            secret: parsed.secret,
+        })
+            .pipe(Effect.mapError((cause) => oauthStateError("verify", "Failed to verify OAuth state challenge", cause)));
+        const metadata = verified.metadata ?? {};
+        const appMetadata = metadataValue(typeof metadata.metadata === "object" && metadata.metadata !== null
+            ? metadata.metadata
+            : undefined);
+        const codeChallenge = stringFromUnknown(metadata.codeChallenge);
+        const nonce = stringFromUnknown(metadata.nonce);
+        return {
+            challengeId: parsed.challengeId,
+            providerId: OAuthProviderId(verified.subject),
+            redirectUri: stringFromUnknown(metadata.redirectUri),
+            scopes: stringArrayFromUnknown(metadata.scopes),
+            ...(codeChallenge === undefined
+                ? {}
+                : { codeChallenge: OAuthCodeChallenge(codeChallenge) }),
+            ...(nonce === undefined ? {} : { nonce: OAuthNonce(nonce) }),
+            ...(appMetadata === undefined ? {} : { metadata: appMetadata }),
+        };
+    }),
+});
+export const OAuthStateLive = Layer.effect(OAuthState)(Effect.gen(function* () {
+    const crypto = yield* Crypto;
+    const challenge = yield* Challenge;
+    return makeOAuthState({ crypto, challenge });
+}));
+export const makeOAuthProviders = (providers) => {
+    const providersById = new Map(providers.map((provider) => [provider.id, cloneProviderConfig(provider)]));
+    return OAuthProviders.make({
+        get: (id) => Effect.sync(() => {
+            const provider = providersById.get(id);
+            return provider === undefined
+                ? Option.none()
+                : Option.some(cloneProviderConfig(provider));
+        }),
+    });
+};
+export const OAuthProvidersLive = (providers) => Layer.succeed(OAuthProviders)(makeOAuthProviders(providers));
+export const OidcIdTokenVerifierLive = Layer.effect(OidcIdTokenVerifier)(Effect.gen(function* () {
+    const jwtVerifier = yield* JwtVerifier;
+    return makeOidcIdTokenVerifier({ jwtVerifier });
+}));
+export const OAuthOidcProfileNormalizerLive = Layer.succeed(OAuthProfileNormalizer, makeOidcOAuthProfileNormalizer());
+export const OAuthAccountLinkingLive = Layer.effect(OAuthAccountLinking)(Effect.gen(function* () {
+    const accounts = yield* OAuthAccountStore;
+    return makeOAuthAccountLinkingPolicy({ accounts });
+}));
+export const OAuthAccountUnlinkingLive = Layer.effect(OAuthAccountUnlinking)(Effect.gen(function* () {
+    const accounts = yield* OAuthAccountStore;
+    return makeOAuthAccountUnlinkingPolicy({ accounts });
+}));
+export const OAuthLinkConfirmationLive = Layer.effect(OAuthLinkConfirmation)(Effect.gen(function* () {
+    const challenge = yield* Challenge;
+    const accounts = yield* OAuthAccountStore;
+    const crypto = yield* Crypto;
+    return makeOAuthLinkConfirmation({ challenge, accounts, crypto });
+}));
+const accountKey = (input) => `${input.providerId}:${input.providerAccountId}`;
+const cloneOAuthAccountRecord = (record) => ({
+    ...record,
+    ...(record.metadata === undefined ? {} : { metadata: metadataValue(record.metadata) }),
+});
+const includeAccount = (record, includeUnlinked) => includeUnlinked === true || record.unlinkedAt === undefined;
+export const makeOAuthAccountStoreMemory = () => {
+    const accountsById = new Map();
+    const idByProviderAccount = new Map();
+    return OAuthAccountStore.make({
+        insert: (row) => Effect.sync(() => {
+            const cloned = cloneOAuthAccountRecord(row);
+            accountsById.set(row.id, cloned);
+            idByProviderAccount.set(accountKey(row), row.id);
+        }),
+        findById: (id) => Effect.sync(() => {
+            const row = accountsById.get(id);
+            return row === undefined ? Option.none() : Option.some(cloneOAuthAccountRecord(row));
+        }),
+        findByProviderAccount: (input) => Effect.sync(() => {
+            const id = idByProviderAccount.get(accountKey(input));
+            const row = id === undefined ? undefined : accountsById.get(id);
+            return row === undefined || !includeAccount(row, input.includeUnlinked)
+                ? Option.none()
+                : Option.some(cloneOAuthAccountRecord(row));
+        }),
+        listByUser: (input) => Effect.sync(() => [...accountsById.values()]
+            .filter((row) => row.userId === input.userId && includeAccount(row, input.includeUnlinked))
+            .map(cloneOAuthAccountRecord)),
+        unlink: (input) => Effect.sync(() => {
+            const id = idByProviderAccount.get(accountKey(input));
+            const row = id === undefined ? undefined : accountsById.get(id);
+            if (row === undefined) {
+                return Option.none();
+            }
+            const updated = {
+                ...row,
+                unlinkedAt: input.unlinkedAt,
+                metadata: input.reason === undefined
+                    ? row.metadata
+                    : { ...row.metadata, unlinkReason: input.reason },
+            };
+            accountsById.set(row.id, updated);
+            return Option.some(cloneOAuthAccountRecord(updated));
+        }),
+    });
+};
+export const OAuthAccountStoreMemoryLive = Layer.sync(OAuthAccountStore)(makeOAuthAccountStoreMemory);
+//# sourceMappingURL=OAuth.js.map