@yielded/auth 0.1.0-beta.1

package/dist/oauth/github/protocol.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.mjs","names":[],"sources":["../../../src/oauth/github/protocol.ts"],"sourcesContent":["import { Effect, Encoding, Layer, Predicate, Redacted, Schema } from \"effect\";\nimport type { CustomFetch } from \"openid-client\";\n\nimport { OAuthConnectedProfile } from \"../connectedModels\";\nimport { OAuthConnectedProtocol } from \"../OAuthConnectedProtocol\";\nimport { OAuthProtocol } from \"../OAuthProtocol\";\nimport {\n  DefiniteTokenRejection,\n  type ConnectedCompatibility,\n} from \"../openid-client/compatibility\";\nimport { makeConnectedProtocolWithCompatibility } from \"../openid-client/connected/protocol\";\nimport {\n  OpenIdClientConfigurationError,\n  type OpenIdClientOAuthProvider,\n} from \"../openid-client/models\";\nimport { makeOAuthProtocolWithCompatibility } from \"../openid-client/protocol\";\nimport { ProviderRevocation } from \"../openid-client/ProviderRevocation\";\nimport { boundedFetch } from \"../openid-client/transport\";\nimport { OAuthUnavailable } from \"../signInErrors\";\nimport { OAuthCallbackId, OAuthGeneration, OAuthIssuer, OAuthRedirectUri } from \"../signInModels\";\nimport { snapshotOAuthSync } from \"../signInSnapshot\";\nimport { decodeGitHubIdentity, gitHubOAuthAppProviderKey } from \"./identity\";\nimport type {\n  GitHubOAuthAppConnectedProtocolOptions,\n  GitHubOAuthAppGeneration,\n  GitHubOAuthAppProtocolOptions,\n} from \"./models\";\n\nconst unavailable = () => OAuthUnavailable.make({});\nconst invalid = () => OpenIdClientConfigurationError.make({ reason: \"provider\" });\nconst issuer = OAuthIssuer.make(\"https://github.com\");\n\nconst headers = Object.freeze({\n  Accept: \"application/vnd.github+json\",\n  \"User-Agent\": \"effect-auth-github-oauth-app\",\n  \"X-GitHub-Api-Version\": \"2026-03-10\",\n});\n\nconst generation = Schema.Struct({\n  configurationGeneration: OAuthGeneration,\n  issuance: Schema.Literals([\"active\", \"retired\"]),\n  clientId: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9._-]{1,256}$/)),\n  clientSecret: Schema.RedactedFromValue(Schema.NonEmptyString.check(Schema.isMaxLength(4096))),\n  callbacks: Schema.Array(\n    Schema.Struct({ callbackId: OAuthCallbackId, redirectUri: OAuthRedirectUri }),\n  ).check(Schema.isMinLength(1), Schema.isMaxLength(16)),\n});\n\nconst generations = Schema.Array(generation).check(Schema.isMinLength(1), Schema.isMaxLength(64));\n\nconst connectedGenerations = Schema.Array(\n  Schema.Struct({\n    ...generation.fields,\n    profiles: Schema.Array(OAuthConnectedProfile).check(\n      Schema.isMinLength(1),\n      Schema.isMaxLength(64),\n    ),\n  }),\n).check(Schema.isMinLength(1), Schema.isMaxLength(64));\n\nconst timeout = Schema.Finite.check(Schema.isBetween({ minimum: 1, maximum: 30 }));\nconst isTimeout = Schema.is(timeout);\n\nconst capture = <S extends Schema.Codec<unknown, unknown, never, never>>(\n  schema: S,\n  registrations: S[\"Type\"],\n  options: {\n    readonly timeoutSeconds: number;\n    readonly fetch?: GitHubOAuthAppProtocolOptions[\"fetch\"];\n  },\n) =>\n  Effect.try({\n    try: () => {\n      const result = snapshotOAuthSync(schema, registrations);\n      const fetch = options.fetch;\n      const timeoutSeconds = options.timeoutSeconds;\n\n      if (!isTimeout(timeoutSeconds) || (fetch !== undefined && !Predicate.isFunction(fetch)))\n        throw invalid();\n\n      return { registrations: result, timeoutSeconds, ...(fetch === undefined ? {} : { fetch }) };\n    },\n    catch: invalid,\n  });\n\nconst provider = (\n  registration: GitHubOAuthAppGeneration,\n): Omit<OpenIdClientOAuthProvider, \"scopes\"> => ({\n  provider: gitHubOAuthAppProviderKey,\n  configurationGeneration: registration.configurationGeneration,\n  issuance: registration.issuance,\n  issuer,\n  protocol: \"oauth\",\n  responseIssuerMode: \"unsupported\",\n  clientId: registration.clientId,\n  authentication: { method: \"client_secret_post\", secret: registration.clientSecret },\n  callbacks: registration.callbacks,\n  authorizationEndpoint: \"https://github.com/login/oauth/authorize\",\n  tokenEndpoint: \"https://github.com/login/oauth/access_token\",\n  pkceS256: true,\n  identitySource: {\n    url: \"https://api.github.com/user\",\n    headers,\n    decodeIdentity: decodeGitHubIdentity,\n  },\n});\n\nconst csvCell = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_:-]{1,256}$/));\nconst isCell = Schema.is(csvCell);\n\n/** GitHub's receipt is comma-delimited, unlike the generic OAuth scope string. */\nconst scopes = (\n  receipt: string | undefined,\n  expected: ReadonlyArray<string>,\n): ReadonlyArray<string> => {\n  if (receipt === undefined || receipt.length > 16447) throw unavailable();\n\n  const result =\n    receipt === \"\" ? [] : receipt.split(\",\").map((cell) => cell.replace(/^[ \\t]+|[ \\t]+$/g, \"\"));\n\n  if (\n    result.length > 64 ||\n    result.some((cell) => !isCell(cell)) ||\n    new Set(result).size !== result.length ||\n    result.length !== expected.length ||\n    result.some((cell) => !expected.includes(cell))\n  )\n    throw unavailable();\n\n  return result;\n};\n\nconst token = Schema.NonEmptyString.check(Schema.isMaxLength(16384));\nconst expiry = Schema.Finite.check(Schema.isGreaterThan(0));\n\nconst receiptSchema = Schema.Struct({\n  access_token: token,\n  token_type: Schema.String.check(Schema.isPattern(/^[Bb][Ee][Aa][Rr][Ee][Rr]$/)),\n  scope: Schema.String.check(Schema.isMaxLength(16447)),\n  expires_in: Schema.optionalKey(expiry),\n  refresh_token: Schema.optionalKey(token),\n  refresh_token_expires_in: Schema.optionalKey(expiry),\n});\n\n// oxlint-disable-next-line no-restricted-properties -- Inspect the bounded raw receipt before the maintained parser can coerce expiry fields.\nconst decodeReceipt = Schema.decodeUnknownSync(receiptSchema);\n\nconst encodeRevocation = Schema.encodeSync(\n  Schema.fromJsonString(Schema.Struct({ access_token: token })),\n);\n\nconst terminalReceipt = Schema.Struct({\n  error: Schema.NonEmptyString.check(Schema.isMaxLength(128)),\n  error_description: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(4096))),\n  error_uri: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(2048))),\n});\n\n// oxlint-disable-next-line no-restricted-properties -- Fully validate the raw terminal receipt before classifying a provider rejection.\nconst decodeTerminalReceipt = Schema.decodeUnknownSync(terminalReceipt);\n\nconst successKeys = [\n  \"access_token\",\n  \"token_type\",\n  \"scope\",\n  \"expires_in\",\n  \"refresh_token\",\n  \"refresh_token_expires_in\",\n  \"id_token\",\n];\n\nconst compatibility: ConnectedCompatibility = Object.freeze<ConnectedCompatibility>({\n  inspectReceipt: ({ body, status, contentType }, input) => {\n    if (contentType?.split(\";\", 1)[0]?.trim().toLowerCase() !== \"application/json\")\n      throw unavailable();\n    if (!Predicate.isObject(body)) throw unavailable();\n    if (Object.hasOwn(body, \"error\")) {\n      if (successKeys.some((key) => Object.hasOwn(body, key))) throw unavailable();\n      const terminal = decodeTerminalReceipt(body);\n\n      if (\n        (status === 200 || status === 400) &&\n        terminal.error ===\n          (input.operation === \"authorization_code\" ? \"bad_verification_code\" : \"bad_refresh_token\")\n      ) {\n        throw new DefiniteTokenRejection();\n      }\n      throw unavailable();\n    }\n    if (\n      status !== 200 ||\n      [\"error_description\", \"error_uri\", \"id_token\"].some((key) => Object.hasOwn(body, key))\n    )\n      throw unavailable();\n    const receipt = decodeReceipt(body);\n\n    scopes(receipt.scope, input.scopes);\n    if (\n      input.refreshRequired &&\n      (receipt.refresh_token === undefined ||\n        receipt.expires_in === undefined ||\n        receipt.refresh_token_expires_in === undefined)\n    )\n      throw unavailable();\n  },\n  authorizationScopes: (permissions, refresh) =>\n    refresh ? [...permissions, \"offline_access\"] : permissions,\n  decodeScopes: scopes,\n  includeRefreshScope: false,\n});\n\nconst revocationLayer = (\n  options: Pick<GitHubOAuthAppConnectedProtocolOptions, \"fetch\" | \"timeoutSeconds\">,\n) => {\n  const fetch: CustomFetch =\n    options.fetch ??\n    ((url, init) =>\n      globalThis.fetch(url, {\n        ...init,\n        body: init.body instanceof Uint8Array ? new Uint8Array(init.body) : init.body,\n      }));\n\n  const timeoutSeconds = options.timeoutSeconds;\n\n  return Layer.succeed(\n    ProviderRevocation,\n    ProviderRevocation.of({\n      revoke: Effect.fn(\"GitHubOAuthApp.revoke\")(function* (input) {\n        yield* Effect.tryPromise({\n          try: async (effectSignal) => {\n            if (\n              input.authentication.method !== \"client_secret_post\" ||\n              input.context.configuration.profile.clientRegistrationId !== input.clientId ||\n              input.context.identity.provider !== gitHubOAuthAppProviderKey ||\n              input.context.identity.issuer !== issuer\n            )\n              throw unavailable();\n            const url = `https://api.github.com/applications/${encodeURIComponent(input.clientId)}/grant`;\n\n            const signal = AbortSignal.any([\n              effectSignal,\n              AbortSignal.timeout(Math.ceil(timeoutSeconds * 1000)),\n            ]);\n\n            const transport = boundedFetch(fetch, signal, new Set([url]));\n\n            const response = await transport(url, {\n              method: \"DELETE\",\n              redirect: \"manual\",\n              headers: {\n                ...headers,\n                \"Content-Type\": \"application/json\",\n                Authorization: `Basic ${Encoding.encodeBase64(`${input.clientId}:${Redacted.value(input.authentication.secret)}`)}`,\n              },\n              body: encodeRevocation({ access_token: Redacted.value(input.material.accessToken) }),\n              signal,\n            });\n\n            signal.throwIfAborted();\n            if (response.status !== 204) throw unavailable();\n          },\n          catch: unavailable,\n        });\n      }),\n    }),\n  );\n};\n\nexport const makeGitHubOAuthAppProtocol = Effect.fn(\"makeGitHubOAuthAppProtocol\")(function* (\n  options: GitHubOAuthAppProtocolOptions,\n) {\n  const saved = yield* capture(generations, options.registrations, options);\n\n  if (saved.registrations.filter((item) => item.issuance === \"active\").length !== 1)\n    return yield* invalid();\n\n  return yield* makeOAuthProtocolWithCompatibility(\n    {\n      ...saved,\n      providers: saved.registrations.map((item) => ({ ...provider(item), scopes: [\"read:user\"] })),\n    },\n    compatibility,\n  );\n});\n\nexport const makeGitHubOAuthAppConnectedProtocol = Effect.fn(\"makeGitHubOAuthAppConnectedProtocol\")(\n  function* (options: GitHubOAuthAppConnectedProtocolOptions) {\n    const saved = yield* capture(connectedGenerations, options.registrations, options);\n\n    if (saved.registrations.filter((item) => item.issuance === \"active\").length !== 1)\n      return yield* invalid();\n    for (const registration of saved.registrations) {\n      for (const profile of registration.profiles) {\n        if (\n          profile.provider !== gitHubOAuthAppProviderKey ||\n          profile.clientRegistrationId !== registration.clientId ||\n          profile.resources.length !== 0 ||\n          profile.scopes.some((scope) => scope === \"offline_access\" || !isCell(scope)) ||\n          (profile.retention === \"access-only\"\n            ? profile.refresh !== \"unsupported\" ||\n              profile.maximumRefreshLifetimeMillis !== undefined\n            : profile.refresh !== \"rotating\" || profile.maximumRefreshLifetimeMillis === undefined)\n        )\n          return yield* invalid();\n      }\n    }\n\n    return yield* makeConnectedProtocolWithCompatibility(\n      {\n        ...saved,\n        providers: saved.registrations.map((item) => ({\n          ...provider(item),\n          profiles: item.profiles,\n          clientRegistrationId: item.clientId,\n          resourceIndicators: \"unsupported\",\n          refreshExpiry: { field: \"refresh_token_expires_in\", zero: \"expired\" },\n          revocation: { mode: \"provider-cohort\" },\n        })),\n      },\n      compatibility,\n    ).pipe(Effect.provide(revocationLayer(saved)));\n  },\n);\n\nexport const gitHubOAuthAppProtocolLayer = (options: GitHubOAuthAppProtocolOptions) =>\n  Layer.effect(OAuthProtocol, makeGitHubOAuthAppProtocol(options));\n\nexport const gitHubOAuthAppConnectedProtocolLayer = (\n  options: GitHubOAuthAppConnectedProtocolOptions,\n) => Layer.effect(OAuthConnectedProtocol, makeGitHubOAuthAppConnectedProtocol(options));\n"],"mappings":";;;;;;;;;;;;;;;AA4BA,MAAM,oBAAoB,iBAAiB,KAAK,CAAC,CAAC;AAClD,MAAM,gBAAgB,+BAA+B,KAAK,EAAE,QAAQ,WAAW,CAAC;AAChF,MAAM,SAAS,YAAY,KAAK,oBAAoB;AAEpD,MAAM,UAAU,OAAO,OAAO;CAC5B,QAAQ;CACR,cAAc;CACd,wBAAwB;AAC1B,CAAC;AAED,MAAM,aAAa,OAAO,OAAO;CAC/B,yBAAyB;CACzB,UAAU,OAAO,SAAS,CAAC,UAAU,SAAS,CAAC;CAC/C,UAAU,OAAO,OAAO,MAAM,OAAO,UAAU,yBAAyB,CAAC;CACzE,cAAc,OAAO,kBAAkB,OAAO,eAAe,MAAM,OAAO,YAAY,IAAI,CAAC,CAAC;CAC5F,WAAW,OAAO,MAChB,OAAO,OAAO;EAAE,YAAY;EAAiB,aAAa;CAAiB,CAAC,CAC9E,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,EAAE,CAAC;AACvD,CAAC;AAED,MAAM,cAAc,OAAO,MAAM,UAAU,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,EAAE,CAAC;AAEhG,MAAM,uBAAuB,OAAO,MAClC,OAAO,OAAO;CACZ,GAAG,WAAW;CACd,UAAU,OAAO,MAAM,qBAAqB,CAAC,CAAC,MAC5C,OAAO,YAAY,CAAC,GACpB,OAAO,YAAY,EAAE,CACvB;AACF,CAAC,CACH,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,EAAE,CAAC;AAErD,MAAM,UAAU,OAAO,OAAO,MAAM,OAAO,UAAU;CAAE,SAAS;CAAG,SAAS;AAAG,CAAC,CAAC;AACjF,MAAM,YAAY,OAAO,GAAG,OAAO;AAEnC,MAAM,WACJ,QACA,eACA,YAKA,OAAO,IAAI;CACT,WAAW;EACT,MAAM,SAAS,kBAAkB,QAAQ,aAAa;EACtD,MAAM,QAAQ,QAAQ;EACtB,MAAM,iBAAiB,QAAQ;EAE/B,IAAI,CAAC,UAAU,cAAc,KAAM,UAAU,KAAA,KAAa,CAAC,UAAU,WAAW,KAAK,GACnF,MAAM,QAAQ;EAEhB,OAAO;GAAE,eAAe;GAAQ;GAAgB,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;EAAG;CAC5F;CACA,OAAO;AACT,CAAC;AAEH,MAAM,YACJ,kBAC+C;CAC/C,UAAU;CACV,yBAAyB,aAAa;CACtC,UAAU,aAAa;CACvB;CACA,UAAU;CACV,oBAAoB;CACpB,UAAU,aAAa;CACvB,gBAAgB;EAAE,QAAQ;EAAsB,QAAQ,aAAa;CAAa;CAClF,WAAW,aAAa;CACxB,uBAAuB;CACvB,eAAe;CACf,UAAU;CACV,gBAAgB;EACd,KAAK;EACL;EACA,gBAAgB;CAClB;AACF;AAEA,MAAM,UAAU,OAAO,OAAO,MAAM,OAAO,UAAU,yBAAyB,CAAC;AAC/E,MAAM,SAAS,OAAO,GAAG,OAAO;;AAGhC,MAAM,UACJ,SACA,aAC0B;CAC1B,IAAI,YAAY,KAAA,KAAa,QAAQ,SAAS,OAAO,MAAM,YAAY;CAEvE,MAAM,SACJ,YAAY,KAAK,CAAC,IAAI,QAAQ,MAAM,GAAG,CAAC,CAAC,KAAK,SAAS,KAAK,QAAQ,oBAAoB,EAAE,CAAC;CAE7F,IACE,OAAO,SAAS,MAChB,OAAO,MAAM,SAAS,CAAC,OAAO,IAAI,CAAC,KACnC,IAAI,IAAI,MAAM,CAAC,CAAC,SAAS,OAAO,UAChC,OAAO,WAAW,SAAS,UAC3B,OAAO,MAAM,SAAS,CAAC,SAAS,SAAS,IAAI,CAAC,GAE9C,MAAM,YAAY;CAEpB,OAAO;AACT;AAEA,MAAM,QAAQ,OAAO,eAAe,MAAM,OAAO,YAAY,KAAK,CAAC;AACnE,MAAM,SAAS,OAAO,OAAO,MAAM,OAAO,cAAc,CAAC,CAAC;AAE1D,MAAM,gBAAgB,OAAO,OAAO;CAClC,cAAc;CACd,YAAY,OAAO,OAAO,MAAM,OAAO,UAAU,4BAA4B,CAAC;CAC9E,OAAO,OAAO,OAAO,MAAM,OAAO,YAAY,KAAK,CAAC;CACpD,YAAY,OAAO,YAAY,MAAM;CACrC,eAAe,OAAO,YAAY,KAAK;CACvC,0BAA0B,OAAO,YAAY,MAAM;AACrD,CAAC;AAGD,MAAM,gBAAgB,OAAO,kBAAkB,aAAa;AAE5D,MAAM,mBAAmB,OAAO,WAC9B,OAAO,eAAe,OAAO,OAAO,EAAE,cAAc,MAAM,CAAC,CAAC,CAC9D;AAEA,MAAM,kBAAkB,OAAO,OAAO;CACpC,OAAO,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC;CAC1D,mBAAmB,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC,CAAC;CACnF,WAAW,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC,CAAC;AAC7E,CAAC;AAGD,MAAM,wBAAwB,OAAO,kBAAkB,eAAe;AAEtE,MAAM,cAAc;CAClB;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAEA,MAAM,gBAAwC,OAAO,OAA+B;CAClF,iBAAiB,EAAE,MAAM,QAAQ,eAAe,UAAU;EACxD,IAAI,aAAa,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,YAAY,MAAM,oBAC1D,MAAM,YAAY;EACpB,IAAI,CAAC,UAAU,SAAS,IAAI,GAAG,MAAM,YAAY;EACjD,IAAI,OAAO,OAAO,MAAM,OAAO,GAAG;GAChC,IAAI,YAAY,MAAM,QAAQ,OAAO,OAAO,MAAM,GAAG,CAAC,GAAG,MAAM,YAAY;GAC3E,MAAM,WAAW,sBAAsB,IAAI;GAE3C,KACG,WAAW,OAAO,WAAW,QAC9B,SAAS,WACN,MAAM,cAAc,uBAAuB,0BAA0B,sBAExE,MAAM,IAAI,uBAAuB;GAEnC,MAAM,YAAY;EACpB;EACA,IACE,WAAW,OACX;GAAC;GAAqB;GAAa;EAAU,CAAC,CAAC,MAAM,QAAQ,OAAO,OAAO,MAAM,GAAG,CAAC,GAErF,MAAM,YAAY;EACpB,MAAM,UAAU,cAAc,IAAI;EAElC,OAAO,QAAQ,OAAO,MAAM,MAAM;EAClC,IACE,MAAM,oBACL,QAAQ,kBAAkB,KAAA,KACzB,QAAQ,eAAe,KAAA,KACvB,QAAQ,6BAA6B,KAAA,IAEvC,MAAM,YAAY;CACtB;CACA,sBAAsB,aAAa,YACjC,UAAU,CAAC,GAAG,aAAa,gBAAgB,IAAI;CACjD,cAAc;CACd,qBAAqB;AACvB,CAAC;AAED,MAAM,mBACJ,YACG;CACH,MAAM,QACJ,QAAQ,WACN,KAAK,SACL,WAAW,MAAM,KAAK;EACpB,GAAG;EACH,MAAM,KAAK,gBAAgB,aAAa,IAAI,WAAW,KAAK,IAAI,IAAI,KAAK;CAC3E,CAAC;CAEL,MAAM,iBAAiB,QAAQ;CAE/B,OAAO,MAAM,QACX,oBACA,mBAAmB,GAAG,EACpB,QAAQ,OAAO,GAAG,uBAAuB,CAAC,CAAC,WAAW,OAAO;EAC3D,OAAO,OAAO,WAAW;GACvB,KAAK,OAAO,iBAAiB;IAC3B,IACE,MAAM,eAAe,WAAW,wBAChC,MAAM,QAAQ,cAAc,QAAQ,yBAAyB,MAAM,YACnE,MAAM,QAAQ,SAAS,aAAa,6BACpC,MAAM,QAAQ,SAAS,WAAW,QAElC,MAAM,YAAY;IACpB,MAAM,MAAM,uCAAuC,mBAAmB,MAAM,QAAQ,EAAE;IAEtF,MAAM,SAAS,YAAY,IAAI,CAC7B,cACA,YAAY,QAAQ,KAAK,KAAK,iBAAiB,GAAI,CAAC,CACtD,CAAC;IAID,MAAM,WAAW,MAFC,aAAa,OAAO,wBAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,CAE5B,CAAC,CAAC,KAAK;KACpC,QAAQ;KACR,UAAU;KACV,SAAS;MACP,GAAG;MACH,gBAAgB;MAChB,eAAe,SAAS,SAAS,aAAa,GAAG,MAAM,SAAS,GAAG,SAAS,MAAM,MAAM,eAAe,MAAM,GAAG;KAClH;KACA,MAAM,iBAAiB,EAAE,cAAc,SAAS,MAAM,MAAM,SAAS,WAAW,EAAE,CAAC;KACnF;IACF,CAAC;IAED,OAAO,eAAe;IACtB,IAAI,SAAS,WAAW,KAAK,MAAM,YAAY;GACjD;GACA,OAAO;EACT,CAAC;CACH,CAAC,EACH,CAAC,CACH;AACF;AAEA,MAAa,6BAA6B,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAChF,SACA;CACA,MAAM,QAAQ,OAAO,QAAQ,aAAa,QAAQ,eAAe,OAAO;CAExE,IAAI,MAAM,cAAc,QAAQ,SAAS,KAAK,aAAa,QAAQ,CAAC,CAAC,WAAW,GAC9E,OAAO,OAAO,QAAQ;CAExB,OAAO,OAAO,mCACZ;EACE,GAAG;EACH,WAAW,MAAM,cAAc,KAAK,UAAU;GAAE,GAAG,SAAS,IAAI;GAAG,QAAQ,CAAC,WAAW;EAAE,EAAE;CAC7F,GACA,aACF;AACF,CAAC;AAED,MAAa,sCAAsC,OAAO,GAAG,qCAAqC,CAAC,CACjG,WAAW,SAAiD;CAC1D,MAAM,QAAQ,OAAO,QAAQ,sBAAsB,QAAQ,eAAe,OAAO;CAEjF,IAAI,MAAM,cAAc,QAAQ,SAAS,KAAK,aAAa,QAAQ,CAAC,CAAC,WAAW,GAC9E,OAAO,OAAO,QAAQ;CACxB,KAAK,MAAM,gBAAgB,MAAM,eAC/B,KAAK,MAAM,WAAW,aAAa,UACjC,IACE,QAAQ,aAAa,6BACrB,QAAQ,yBAAyB,aAAa,YAC9C,QAAQ,UAAU,WAAW,KAC7B,QAAQ,OAAO,MAAM,UAAU,UAAU,oBAAoB,CAAC,OAAO,KAAK,CAAC,MAC1E,QAAQ,cAAc,gBACnB,QAAQ,YAAY,iBACpB,QAAQ,iCAAiC,KAAA,IACzC,QAAQ,YAAY,cAAc,QAAQ,iCAAiC,KAAA,IAE/E,OAAO,OAAO,QAAQ;CAI5B,OAAO,OAAO,uCACZ;EACE,GAAG;EACH,WAAW,MAAM,cAAc,KAAK,UAAU;GAC5C,GAAG,SAAS,IAAI;GAChB,UAAU,KAAK;GACf,sBAAsB,KAAK;GAC3B,oBAAoB;GACpB,eAAe;IAAE,OAAO;IAA4B,MAAM;GAAU;GACpE,YAAY,EAAE,MAAM,kBAAkB;EACxC,EAAE;CACJ,GACA,aACF,CAAC,CAAC,KAAK,OAAO,QAAQ,gBAAgB,KAAK,CAAC,CAAC;AAC/C,CACF;AAEA,MAAa,+BAA+B,YAC1C,MAAM,OAAO,eAAe,2BAA2B,OAAO,CAAC;AAEjE,MAAa,wCACX,YACG,MAAM,OAAO,wBAAwB,oCAAoC,OAAO,CAAC"}

package/dist/oauth/openid-client/ProviderRevocation.d.mts

@@ -0,0 +1,4 @@
+import "../signInErrors.mjs";
+import "../connectedModels.mjs";
+import "./models.mjs";
+import { Context, Effect, Layer } from "effect";

package/dist/oauth/openid-client/ProviderRevocation.mjs

@@ -0,0 +1,11 @@
+import { OAuthUnavailable } from "../signInErrors.mjs";
+import { Context, Effect, Layer } from "effect";
+//#region src/oauth/openid-client/ProviderRevocation.ts
+/** Private provider-owned cohort revocation; transport belongs to its adapter. */
+var ProviderRevocation = class ProviderRevocation extends Context.Service()("effect-auth/oauth/openid-client/ProviderRevocation") {
+	static layerUnsupported = Layer.succeed(ProviderRevocation, { revoke: () => Effect.fail(OAuthUnavailable.make({})) });
+};
+//#endregion
+export { ProviderRevocation };
+
+//# sourceMappingURL=ProviderRevocation.mjs.map

package/dist/oauth/openid-client/ProviderRevocation.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProviderRevocation.mjs","names":[],"sources":["../../../src/oauth/openid-client/ProviderRevocation.ts"],"sourcesContent":["import { Context, Effect, Layer } from \"effect\";\n\nimport type { OAuthConnectedTokenContext, OAuthConnectedTokenMaterial } from \"../connectedModels\";\nimport { OAuthUnavailable } from \"../signInErrors\";\nimport type { OpenIdClientAuthentication } from \"./models\";\n\n/** Private provider-owned cohort revocation; transport belongs to its adapter. */\nexport class ProviderRevocation extends Context.Service<\n  ProviderRevocation,\n  {\n    readonly revoke: (input: {\n      readonly clientId: string;\n      readonly authentication: OpenIdClientAuthentication;\n      readonly context: OAuthConnectedTokenContext;\n      readonly material: OAuthConnectedTokenMaterial;\n    }) => Effect.Effect<void, OAuthUnavailable>;\n  }\n>()(\"effect-auth/oauth/openid-client/ProviderRevocation\") {\n  static readonly layerUnsupported = Layer.succeed(ProviderRevocation, {\n    revoke: () => Effect.fail(OAuthUnavailable.make({})),\n  });\n}\n"],"mappings":";;;;AAOA,IAAa,qBAAb,MAAa,2BAA2B,QAAQ,QAU9C,CAAC,CAAC,oDAAoD,CAAC,CAAC;CACxD,OAAgB,mBAAmB,MAAM,QAAQ,oBAAoB,EACnE,cAAc,OAAO,KAAK,iBAAiB,KAAK,CAAC,CAAC,CAAC,EACrD,CAAC;AACH"}

package/dist/oauth/openid-client/compatibility.d.mts

@@ -0,0 +1 @@
+import "./connected/models.mjs";

package/dist/oauth/openid-client/compatibility.mjs

@@ -0,0 +1,6 @@
+//#region src/oauth/openid-client/compatibility.ts
+var DefiniteTokenRejection = class extends Error {};
+//#endregion
+export { DefiniteTokenRejection };
+
+//# sourceMappingURL=compatibility.mjs.map

package/dist/oauth/openid-client/compatibility.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"compatibility.mjs","names":[],"sources":["../../../src/oauth/openid-client/compatibility.ts"],"sourcesContent":["import type {\n  OpenIdClientConnectedOAuthProvider,\n  OpenIdClientConnectedProtocolOptions,\n} from \"./connected/models\";\n\n/** Pure private provider rules, never part of the generic public options. */\nexport interface TokenCompatibility {\n  readonly inspectReceipt: (\n    receipt: {\n      readonly body: unknown;\n      readonly status: number;\n      readonly contentType: string | null;\n    },\n    input: {\n      readonly scopes: ReadonlyArray<string>;\n      readonly refreshRequired: boolean;\n      readonly operation: \"authorization_code\" | \"refresh_token\";\n    },\n  ) => void;\n}\n\nexport class DefiniteTokenRejection extends Error {}\n\nexport interface ConnectedCompatibility extends TokenCompatibility {\n  readonly authorizationScopes: (\n    scopes: ReadonlyArray<string>,\n    refresh: boolean,\n  ) => ReadonlyArray<string>;\n  readonly decodeScopes: (\n    receipt: string | undefined,\n    expected: ReadonlyArray<string>,\n  ) => ReadonlyArray<string>;\n  readonly includeRefreshScope: boolean;\n}\n\nexport type ProviderConnectedOAuth<R> = Omit<\n  OpenIdClientConnectedOAuthProvider<R>,\n  \"revocation\"\n> & {\n  readonly revocation: { readonly mode: \"provider-cohort\" };\n};\n\nexport type ConnectedOptions<R> = Omit<OpenIdClientConnectedProtocolOptions<R>, \"providers\"> & {\n  readonly providers: ReadonlyArray<\n    OpenIdClientConnectedProtocolOptions<R>[\"providers\"][number] | ProviderConnectedOAuth<R>\n  >;\n};\n"],"mappings":";AAqBA,IAAa,yBAAb,cAA4C,MAAM,CAAC"}

package/dist/oauth/openid-client/configuration.mjs

@@ -0,0 +1,305 @@
+import { OAuthProviderKey } from "../schema.mjs";
+import { OAuthAuthorizationUrl, OAuthCallbackId, OAuthGeneration, OAuthIssuer, OAuthRedirectUri } from "../signInModels.mjs";
+import { OAuthUnavailable } from "../signInErrors.mjs";
+import { freezeOAuth } from "../signInSnapshot.mjs";
+import { OpenIdClientConfigurationError } from "./models.mjs";
+import { boundedFetch } from "./transport.mjs";
+import { Effect, Predicate, Redacted, Schema } from "effect";
+import * as client from "openid-client";
+//#region src/oauth/openid-client/configuration.ts
+const boundedString = (maximum) => Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(maximum));
+const fields = Schema.Record(Schema.String.check(Schema.isPattern(/^[A-Za-z][A-Za-z0-9._~-]{0,63}$/)), Schema.String.check(Schema.isMaxLength(2048))).check(Schema.makeFilter((record) => Object.keys(record).length <= 16));
+const secret = Schema.RedactedFromValue(boundedString(4096));
+const authentication = Schema.Union([
+	Schema.Struct({
+		method: Schema.Literal("client_secret_basic"),
+		secret
+	}),
+	Schema.Struct({
+		method: Schema.Literal("client_secret_post"),
+		secret
+	}),
+	Schema.Struct({
+		method: Schema.Literal("none"),
+		publicClient: Schema.Literal(true)
+	})
+]);
+const common = {
+	provider: OAuthProviderKey,
+	configurationGeneration: OAuthGeneration,
+	issuance: Schema.Literals(["active", "retired"]),
+	issuer: OAuthIssuer,
+	responseIssuerMode: Schema.Literals(["required", "unsupported"]),
+	clientId: boundedString(1024),
+	authentication,
+	callbacks: Schema.Array(Schema.Struct({
+		callbackId: OAuthCallbackId,
+		redirectUri: OAuthRedirectUri
+	})).check(Schema.isMinLength(1), Schema.isMaxLength(16)),
+	scopes: Schema.Array(Schema.String.check(Schema.isPattern(/^[\x21\x23-\x5b\x5d-\x7e]{1,128}$/))).check(Schema.isMaxLength(32)),
+	authorizationParameters: Schema.optionalKey(fields),
+	tokenParameters: Schema.optionalKey(fields)
+};
+const optionsSchema = () => Schema.toType(Schema.Struct({
+	providers: Schema.Array(Schema.Union([Schema.Struct({
+		...common,
+		protocol: Schema.Literal("oidc"),
+		idTokenSignedResponseAlg: Schema.Literal("RS256"),
+		maxAgeSeconds: Schema.optionalKey(Schema.Int.check(Schema.isBetween({
+			minimum: 0,
+			maximum: 86400
+		})))
+	}), Schema.Struct({
+		...common,
+		protocol: Schema.Literal("oauth"),
+		authorizationEndpoint: boundedString(2048),
+		tokenEndpoint: boundedString(2048),
+		pkceS256: Schema.Literal(true),
+		identitySource: Schema.Struct({
+			url: boundedString(2048),
+			headers: Schema.optionalKey(fields),
+			decodeIdentity: Schema.declare((input) => Predicate.isFunction(input))
+		})
+	})])).check(Schema.isMinLength(1), Schema.isMaxLength(64)),
+	timeoutSeconds: Schema.Finite.check(Schema.isBetween({
+		minimum: 1,
+		maximum: 30
+	})),
+	fetch: Schema.optionalKey(Schema.declare((input) => Predicate.isFunction(input)))
+}));
+const reserved = /* @__PURE__ */ new Set([
+	"client_id",
+	"client_secret",
+	"client_assertion",
+	"client_assertion_type",
+	"redirect_uri",
+	"response_type",
+	"response_mode",
+	"state",
+	"code",
+	"code_verifier",
+	"code_challenge",
+	"code_challenge_method",
+	"nonce",
+	"scope",
+	"iss",
+	"grant_type",
+	"max_age",
+	"request",
+	"request_uri",
+	"authorization_details",
+	"id_token_hint",
+	"login_hint",
+	"login_hint_token",
+	"subject_token",
+	"subject_token_type",
+	"actor_token",
+	"actor_token_type",
+	"requested_token_type"
+]);
+const forbiddenHeaders = /* @__PURE__ */ new Set([
+	"authorization",
+	"proxy-authorization",
+	"cookie",
+	"host",
+	"content-length",
+	"content-type",
+	"transfer-encoding",
+	"connection",
+	"upgrade",
+	"trailer",
+	"te"
+]);
+const configError = (reason) => OpenIdClientConfigurationError.make({ reason });
+const endpoint = (value) => {
+	const url = new URL(value);
+	if (url.protocol !== "https:" || url.username !== "" || url.password !== "" || value.includes("#") || /[\s\\\u0000-\u001f\u007f]/u.test(value)) throw configError("metadata");
+	return url;
+};
+const checkParameters = (parameters) => {
+	for (const key of Object.keys(parameters ?? {})) if (reserved.has(key.toLowerCase())) throw configError("parameters");
+};
+const clientAuthentication = (authentication) => {
+	switch (authentication.method) {
+		case "client_secret_basic": return client.ClientSecretBasic(Redacted.value(authentication.secret));
+		case "client_secret_post": return client.ClientSecretPost(Redacted.value(authentication.secret));
+		case "none": return client.None();
+	}
+};
+const makeAuthorizationParameters = (configuration, redirectUri, generated) => ({
+	...configuration.authorizationParameters,
+	response_type: "code",
+	response_mode: "query",
+	redirect_uri: redirectUri,
+	scope: configuration.scopes.join(" "),
+	state: generated.state,
+	code_challenge: generated.challenge,
+	code_challenge_method: "S256",
+	...generated.nonce === void 0 ? {} : { nonce: generated.nonce },
+	...configuration.protocol === "oidc" && configuration.maxAgeSeconds !== void 0 ? { max_age: String(configuration.maxAgeSeconds) } : {}
+});
+const metadataSchema = Schema.Struct({
+	issuer: OAuthIssuer,
+	authorization_endpoint: boundedString(2048),
+	token_endpoint: boundedString(2048),
+	jwks_uri: Schema.optionalKey(boundedString(2048)),
+	code_challenge_methods_supported: Schema.optionalKey(Schema.Array(boundedString(64))),
+	response_types_supported: Schema.optionalKey(Schema.Array(boundedString(64))),
+	id_token_signing_alg_values_supported: Schema.optionalKey(Schema.Array(boundedString(64))),
+	token_endpoint_auth_methods_supported: Schema.optionalKey(Schema.Array(boundedString(64))),
+	authorization_response_iss_parameter_supported: Schema.optionalKey(Schema.Boolean)
+});
+const installConfigurations = Effect.fn("OpenIdClient.installConfigurations")(function* (input) {
+	const options = yield* Schema.decodeEffect(optionsSchema())(input).pipe(Effect.mapError(() => configError("provider")));
+	const providers = options.providers.map((provider) => {
+		const detached = {
+			callbacks: provider.callbacks.map((callback) => ({ ...callback })),
+			scopes: [...provider.scopes],
+			...provider.authorizationParameters === void 0 ? {} : { authorizationParameters: { ...provider.authorizationParameters } },
+			...provider.tokenParameters === void 0 ? {} : { tokenParameters: { ...provider.tokenParameters } },
+			authentication: provider.authentication.method === "none" ? { ...provider.authentication } : {
+				...provider.authentication,
+				secret: Redacted.make(Redacted.value(provider.authentication.secret))
+			}
+		};
+		return provider.protocol === "oidc" ? {
+			...provider,
+			...detached
+		} : {
+			...provider,
+			...detached,
+			identitySource: {
+				...provider.identitySource,
+				...provider.identitySource.headers === void 0 ? {} : { headers: { ...provider.identitySource.headers } }
+			}
+		};
+	});
+	const fetch = options.fetch ?? ((url, init) => globalThis.fetch(url, {
+		...init,
+		body: init.body instanceof Uint8Array ? new Uint8Array(init.body) : init.body
+	}));
+	yield* Effect.try({
+		try: () => {
+			const generations = /* @__PURE__ */ new Set();
+			const active = /* @__PURE__ */ new Set();
+			const names = /* @__PURE__ */ new Set();
+			for (const provider of providers) {
+				const generation = `${provider.provider.length}:${provider.provider}:${provider.configurationGeneration}`;
+				if (generations.has(generation)) throw configError("generation");
+				generations.add(generation);
+				names.add(provider.provider);
+				if (provider.issuance === "active") {
+					if (active.has(provider.provider)) throw configError("generation");
+					active.add(provider.provider);
+				}
+				const issuer = endpoint(provider.issuer);
+				if (provider.issuer.includes("?") || issuer.pathname.includes("/.well-known/")) throw configError("issuer");
+				if (new Set(provider.scopes).size !== provider.scopes.length) throw configError("parameters");
+				if (provider.protocol === "oidc" !== provider.scopes.includes("openid")) throw configError("parameters");
+				checkParameters(provider.authorizationParameters);
+				checkParameters(provider.tokenParameters);
+				const callbacks = /* @__PURE__ */ new Set();
+				for (const callback of provider.callbacks) {
+					if (endpoint(callback.redirectUri).href !== callback.redirectUri || callback.redirectUri.includes("?") || callbacks.has(callback.callbackId)) throw configError("callback");
+					callbacks.add(callback.callbackId);
+					for (const other of providers) {
+						if (provider.issuer === other.issuer) continue;
+						if (provider.responseIssuerMode === "required" && other.responseIssuerMode === "required") continue;
+						if (other.callbacks.some((candidate) => candidate.redirectUri === callback.redirectUri)) throw configError("callback");
+					}
+				}
+				if (provider.protocol === "oauth") {
+					endpoint(provider.identitySource.url);
+					for (const key of Object.keys(provider.identitySource.headers ?? {})) if (forbiddenHeaders.has(key.toLowerCase())) throw configError("identity-source");
+					new Headers(provider.identitySource.headers);
+				}
+				freezeOAuth(provider);
+			}
+			if (active.size !== names.size) throw configError("generation");
+		},
+		catch: (error) => Schema.is(OpenIdClientConfigurationError)(error) ? error : configError("provider")
+	});
+	const installed = [];
+	for (const provider of providers) {
+		let raw;
+		if (provider.protocol === "oidc") {
+			const discoveryUrl = new URL(provider.issuer);
+			discoveryUrl.pathname = `${discoveryUrl.pathname.replace(/\/$/u, "")}/.well-known/openid-configuration`;
+			raw = (yield* Effect.tryPromise({
+				try: (signal) => client.discovery(new URL(provider.issuer), provider.clientId, {
+					id_token_signed_response_alg: provider.idTokenSignedResponseAlg,
+					[client.clockSkew]: 0,
+					[client.clockTolerance]: 0
+				}, clientAuthentication(provider.authentication), {
+					timeout: options.timeoutSeconds,
+					execute: [client.enableNonRepudiationChecks],
+					[client.customFetch]: boundedFetch(fetch, signal, /* @__PURE__ */ new Set([discoveryUrl.href]))
+				}),
+				catch: () => OAuthUnavailable.make({})
+			})).serverMetadata();
+		} else raw = {
+			issuer: provider.issuer,
+			authorization_endpoint: provider.authorizationEndpoint,
+			token_endpoint: provider.tokenEndpoint,
+			authorization_response_iss_parameter_supported: provider.responseIssuerMode === "required"
+		};
+		const metadata = yield* Schema.decodeUnknownEffect(metadataSchema)(raw).pipe(Effect.mapError(() => configError("metadata")));
+		const allowedUrls = yield* Effect.try({
+			try: () => {
+				if (metadata.issuer !== provider.issuer) throw configError("issuer");
+				if (metadata.authorization_response_iss_parameter_supported === true !== (provider.responseIssuerMode === "required")) throw configError("metadata");
+				const auth = endpoint(metadata.authorization_endpoint);
+				for (const key of auth.searchParams.keys()) if (reserved.has(key.toLowerCase())) throw configError("parameters");
+				const token = endpoint(metadata.token_endpoint);
+				const supportedAuthentication = metadata.token_endpoint_auth_methods_supported ?? (provider.protocol === "oidc" ? ["client_secret_basic"] : void 0);
+				if (supportedAuthentication !== void 0 && !supportedAuthentication.includes(provider.authentication.method)) throw configError("authentication");
+				const urls = /* @__PURE__ */ new Set([token.href]);
+				if (provider.protocol === "oidc") {
+					if (!metadata.code_challenge_methods_supported?.includes("S256") || !metadata.response_types_supported?.includes("code") || !metadata.id_token_signing_alg_values_supported?.includes("RS256") || metadata.jwks_uri === void 0) throw configError("metadata");
+					urls.add(endpoint(metadata.jwks_uri).href);
+				} else urls.add(endpoint(provider.identitySource.url).href);
+				freezeOAuth(metadata);
+				return urls;
+			},
+			catch: (error) => Schema.is(OpenIdClientConfigurationError)(error) ? error : configError("metadata")
+		});
+		const serverMetadata = {
+			...metadata,
+			code_challenge_methods_supported: metadata.code_challenge_methods_supported?.slice(),
+			response_types_supported: metadata.response_types_supported?.slice(),
+			id_token_signing_alg_values_supported: metadata.id_token_signing_alg_values_supported?.slice(),
+			token_endpoint_auth_methods_supported: metadata.token_endpoint_auth_methods_supported?.slice()
+		};
+		const placeholder = "a".repeat(43);
+		const authorization = yield* Effect.try({
+			try: () => new client.Configuration(serverMetadata, provider.clientId),
+			catch: () => configError("parameters")
+		});
+		for (const callback of provider.callbacks) {
+			const url = yield* Effect.try({
+				try: () => client.buildAuthorizationUrl(authorization, makeAuthorizationParameters(provider, callback.redirectUri, {
+					state: placeholder,
+					challenge: placeholder,
+					...provider.protocol === "oidc" ? { nonce: placeholder } : {}
+				})),
+				catch: () => configError("parameters")
+			});
+			yield* Schema.decodeEffect(OAuthAuthorizationUrl)(url.href).pipe(Effect.mapError(() => configError("parameters")));
+		}
+		freezeOAuth(serverMetadata);
+		installed.push({
+			provider,
+			metadata: serverMetadata,
+			allowedUrls
+		});
+	}
+	return {
+		installed,
+		fetch,
+		timeoutSeconds: options.timeoutSeconds
+	};
+});
+//#endregion
+export { clientAuthentication, endpoint, installConfigurations, makeAuthorizationParameters };
+
+//# sourceMappingURL=configuration.mjs.map

package/dist/oauth/openid-client/configuration.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"configuration.mjs","names":[],"sources":["../../../src/oauth/openid-client/configuration.ts"],"sourcesContent":["import { Effect, Predicate, Redacted, Schema } from \"effect\";\nimport * as client from \"openid-client\";\n\nimport { OAuthProviderKey } from \"../schema\";\nimport { OAuthUnavailable } from \"../signInErrors\";\nimport {\n  OAuthAuthorizationUrl,\n  OAuthCallbackId,\n  OAuthGeneration,\n  OAuthIssuer,\n  OAuthRedirectUri,\n} from \"../signInModels\";\nimport { freezeOAuth } from \"../signInSnapshot\";\nimport {\n  OpenIdClientConfigurationError,\n  type OpenIdClientAuthentication,\n  type OpenIdClientOAuthProvider,\n  type OpenIdClientOAuthProtocolOptions,\n  type OpenIdClientOidcProvider,\n} from \"./models\";\nimport { boundedFetch } from \"./transport\";\n\nconst boundedString = (maximum: number) =>\n  Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(maximum));\n\nconst fields = Schema.Record(\n  Schema.String.check(Schema.isPattern(/^[A-Za-z][A-Za-z0-9._~-]{0,63}$/)),\n  Schema.String.check(Schema.isMaxLength(2048)),\n).check(Schema.makeFilter((record) => Object.keys(record).length <= 16));\n\nconst secret = Schema.RedactedFromValue(boundedString(4096));\n\nconst authentication = Schema.Union([\n  Schema.Struct({ method: Schema.Literal(\"client_secret_basic\"), secret }),\n  Schema.Struct({ method: Schema.Literal(\"client_secret_post\"), secret }),\n  Schema.Struct({ method: Schema.Literal(\"none\"), publicClient: Schema.Literal(true) }),\n]);\n\nconst common = {\n  provider: OAuthProviderKey,\n  configurationGeneration: OAuthGeneration,\n  issuance: Schema.Literals([\"active\", \"retired\"]),\n  issuer: OAuthIssuer,\n  responseIssuerMode: Schema.Literals([\"required\", \"unsupported\"]),\n  clientId: boundedString(1024),\n  authentication,\n  callbacks: Schema.Array(\n    Schema.Struct({ callbackId: OAuthCallbackId, redirectUri: OAuthRedirectUri }),\n  ).check(Schema.isMinLength(1), Schema.isMaxLength(16)),\n  scopes: Schema.Array(\n    Schema.String.check(Schema.isPattern(/^[\\x21\\x23-\\x5b\\x5d-\\x7e]{1,128}$/)),\n  ).check(Schema.isMaxLength(32)),\n  authorizationParameters: Schema.optionalKey(fields),\n  tokenParameters: Schema.optionalKey(fields),\n};\n\nconst optionsSchema = <R>() =>\n  Schema.toType(\n    Schema.Struct({\n      providers: Schema.Array(\n        Schema.Union([\n          Schema.Struct({\n            ...common,\n            protocol: Schema.Literal(\"oidc\"),\n            idTokenSignedResponseAlg: Schema.Literal(\"RS256\"),\n            maxAgeSeconds: Schema.optionalKey(\n              Schema.Int.check(Schema.isBetween({ minimum: 0, maximum: 86400 })),\n            ),\n          }),\n          Schema.Struct({\n            ...common,\n            protocol: Schema.Literal(\"oauth\"),\n            authorizationEndpoint: boundedString(2048),\n            tokenEndpoint: boundedString(2048),\n            pkceS256: Schema.Literal(true),\n            identitySource: Schema.Struct({\n              url: boundedString(2048),\n              headers: Schema.optionalKey(fields),\n              // A configured function is trusted application code; its result has a separate schema boundary.\n              decodeIdentity: Schema.declare<\n                OpenIdClientOAuthProvider<R>[\"identitySource\"][\"decodeIdentity\"]\n              >(\n                (\n                  input,\n                ): input is OpenIdClientOAuthProvider<R>[\"identitySource\"][\"decodeIdentity\"] =>\n                  Predicate.isFunction(input),\n              ),\n            }),\n          }),\n        ]),\n      ).check(Schema.isMinLength(1), Schema.isMaxLength(64)),\n      timeoutSeconds: Schema.Finite.check(Schema.isBetween({ minimum: 1, maximum: 30 })),\n      fetch: Schema.optionalKey(\n        Schema.declare<client.CustomFetch>((input): input is client.CustomFetch =>\n          Predicate.isFunction(input),\n        ),\n      ),\n    }),\n  );\n\nconst reserved = new Set([\n  \"client_id\",\n  \"client_secret\",\n  \"client_assertion\",\n  \"client_assertion_type\",\n  \"redirect_uri\",\n  \"response_type\",\n  \"response_mode\",\n  \"state\",\n  \"code\",\n  \"code_verifier\",\n  \"code_challenge\",\n  \"code_challenge_method\",\n  \"nonce\",\n  \"scope\",\n  \"iss\",\n  \"grant_type\",\n  \"max_age\",\n  \"request\",\n  \"request_uri\",\n  \"authorization_details\",\n  \"id_token_hint\",\n  \"login_hint\",\n  \"login_hint_token\",\n  \"subject_token\",\n  \"subject_token_type\",\n  \"actor_token\",\n  \"actor_token_type\",\n  \"requested_token_type\",\n]);\n\nconst forbiddenHeaders = new Set([\n  \"authorization\",\n  \"proxy-authorization\",\n  \"cookie\",\n  \"host\",\n  \"content-length\",\n  \"content-type\",\n  \"transfer-encoding\",\n  \"connection\",\n  \"upgrade\",\n  \"trailer\",\n  \"te\",\n]);\n\nconst configError = (reason: OpenIdClientConfigurationError[\"reason\"]) =>\n  OpenIdClientConfigurationError.make({ reason });\n\nexport const endpoint = (value: string): URL => {\n  const url = new URL(value);\n\n  if (\n    url.protocol !== \"https:\" ||\n    url.username !== \"\" ||\n    url.password !== \"\" ||\n    value.includes(\"#\") ||\n    // oxlint-disable-next-line no-control-regex -- Reject ambiguous protocol URL control characters.\n    /[\\s\\\\\\u0000-\\u001f\\u007f]/u.test(value)\n  )\n    throw configError(\"metadata\");\n\n  return url;\n};\n\nconst checkParameters = (parameters: Readonly<Record<string, string>> | undefined) => {\n  for (const key of Object.keys(parameters ?? {})) {\n    if (reserved.has(key.toLowerCase())) throw configError(\"parameters\");\n  }\n};\n\nexport const clientAuthentication = (\n  authentication: OpenIdClientAuthentication,\n): client.ClientAuth => {\n  switch (authentication.method) {\n    case \"client_secret_basic\":\n      return client.ClientSecretBasic(Redacted.value(authentication.secret));\n    case \"client_secret_post\":\n      return client.ClientSecretPost(Redacted.value(authentication.secret));\n    case \"none\":\n      return client.None();\n  }\n};\n\nexport type Provider<R> = OpenIdClientOidcProvider | OpenIdClientOAuthProvider<R>;\n\nexport interface InstalledProvider<R> {\n  readonly provider: Provider<R>;\n  readonly metadata: client.ServerMetadata;\n  readonly allowedUrls: ReadonlySet<string>;\n}\n\nexport const makeAuthorizationParameters = (\n  configuration: {\n    readonly protocol: \"oauth\" | \"oidc\";\n    readonly authorizationParameters?: Readonly<Record<string, string>>;\n    readonly scopes: ReadonlyArray<string>;\n    readonly maxAgeSeconds?: number;\n  },\n  redirectUri: string,\n  generated: { readonly state: string; readonly challenge: string; readonly nonce?: string },\n): Record<string, string> => ({\n  ...configuration.authorizationParameters,\n  response_type: \"code\",\n  response_mode: \"query\",\n  redirect_uri: redirectUri,\n  scope: configuration.scopes.join(\" \"),\n  state: generated.state,\n  code_challenge: generated.challenge,\n  code_challenge_method: \"S256\",\n  ...(generated.nonce === undefined ? {} : { nonce: generated.nonce }),\n  ...(configuration.protocol === \"oidc\" && configuration.maxAgeSeconds !== undefined\n    ? { max_age: String(configuration.maxAgeSeconds) }\n    : {}),\n});\n\nconst metadataSchema = Schema.Struct({\n  issuer: OAuthIssuer,\n  authorization_endpoint: boundedString(2048),\n  token_endpoint: boundedString(2048),\n  jwks_uri: Schema.optionalKey(boundedString(2048)),\n  code_challenge_methods_supported: Schema.optionalKey(Schema.Array(boundedString(64))),\n  response_types_supported: Schema.optionalKey(Schema.Array(boundedString(64))),\n  id_token_signing_alg_values_supported: Schema.optionalKey(Schema.Array(boundedString(64))),\n  token_endpoint_auth_methods_supported: Schema.optionalKey(Schema.Array(boundedString(64))),\n  authorization_response_iss_parameter_supported: Schema.optionalKey(Schema.Boolean),\n});\n\nexport const installConfigurations = Effect.fn(\"OpenIdClient.installConfigurations\")(function* <R>(\n  input: OpenIdClientOAuthProtocolOptions<R>,\n) {\n  const options = yield* Schema.decodeEffect(optionsSchema<R>())(input).pipe(\n    Effect.mapError(() => configError(\"provider\")),\n  );\n\n  // Detach secrets as well as arrays and records before retaining configuration.\n  const providers = options.providers.map((provider): Provider<R> => {\n    const detached = {\n      callbacks: provider.callbacks.map((callback) => ({ ...callback })),\n      scopes: [...provider.scopes],\n      ...(provider.authorizationParameters === undefined\n        ? {}\n        : { authorizationParameters: { ...provider.authorizationParameters } }),\n      ...(provider.tokenParameters === undefined\n        ? {}\n        : { tokenParameters: { ...provider.tokenParameters } }),\n      authentication:\n        provider.authentication.method === \"none\"\n          ? { ...provider.authentication }\n          : {\n              ...provider.authentication,\n              secret: Redacted.make(Redacted.value(provider.authentication.secret)),\n            },\n    };\n\n    return provider.protocol === \"oidc\"\n      ? { ...provider, ...detached }\n      : {\n          ...provider,\n          ...detached,\n          identitySource: {\n            ...provider.identitySource,\n            ...(provider.identitySource.headers === undefined\n              ? {}\n              : { headers: { ...provider.identitySource.headers } }),\n          },\n        };\n  });\n\n  const fetch: client.CustomFetch =\n    options.fetch ??\n    ((url, init) =>\n      globalThis.fetch(url, {\n        ...init,\n        body: init.body instanceof Uint8Array ? new Uint8Array(init.body) : init.body,\n      }));\n\n  yield* Effect.try({\n    try: () => {\n      const generations = new Set<string>();\n      const active = new Set<string>();\n      const names = new Set<string>();\n\n      for (const provider of providers) {\n        const generation = `${provider.provider.length}:${provider.provider}:${provider.configurationGeneration}`;\n\n        if (generations.has(generation)) throw configError(\"generation\");\n        generations.add(generation);\n        names.add(provider.provider);\n        if (provider.issuance === \"active\") {\n          if (active.has(provider.provider)) throw configError(\"generation\");\n          active.add(provider.provider);\n        }\n        const issuer = endpoint(provider.issuer);\n\n        if (provider.issuer.includes(\"?\") || issuer.pathname.includes(\"/.well-known/\"))\n          throw configError(\"issuer\");\n        if (new Set(provider.scopes).size !== provider.scopes.length)\n          throw configError(\"parameters\");\n        if ((provider.protocol === \"oidc\") !== provider.scopes.includes(\"openid\"))\n          throw configError(\"parameters\");\n        checkParameters(provider.authorizationParameters);\n        checkParameters(provider.tokenParameters);\n        const callbacks = new Set<string>();\n\n        for (const callback of provider.callbacks) {\n          const url = endpoint(callback.redirectUri);\n\n          if (\n            url.href !== callback.redirectUri ||\n            callback.redirectUri.includes(\"?\") ||\n            callbacks.has(callback.callbackId)\n          )\n            throw configError(\"callback\");\n          callbacks.add(callback.callbackId);\n          for (const other of providers) {\n            if (provider.issuer === other.issuer) continue;\n            if (\n              provider.responseIssuerMode === \"required\" &&\n              other.responseIssuerMode === \"required\"\n            )\n              continue;\n            if (other.callbacks.some((candidate) => candidate.redirectUri === callback.redirectUri))\n              throw configError(\"callback\");\n          }\n        }\n        if (provider.protocol === \"oauth\") {\n          endpoint(provider.identitySource.url);\n          for (const key of Object.keys(provider.identitySource.headers ?? {})) {\n            if (forbiddenHeaders.has(key.toLowerCase())) throw configError(\"identity-source\");\n          }\n          new Headers(provider.identitySource.headers);\n        }\n        freezeOAuth(provider);\n      }\n      if (active.size !== names.size) throw configError(\"generation\");\n    },\n    catch: (error) =>\n      Schema.is(OpenIdClientConfigurationError)(error) ? error : configError(\"provider\"),\n  });\n  const installed: InstalledProvider<R>[] = [];\n\n  for (const provider of providers) {\n    let raw: client.ServerMetadata;\n\n    if (provider.protocol === \"oidc\") {\n      const discoveryUrl = new URL(provider.issuer);\n\n      discoveryUrl.pathname = `${discoveryUrl.pathname.replace(/\\/$/u, \"\")}/.well-known/openid-configuration`;\n\n      const configuration = yield* Effect.tryPromise({\n        try: (signal) =>\n          client.discovery(\n            new URL(provider.issuer),\n            provider.clientId,\n            {\n              id_token_signed_response_alg: provider.idTokenSignedResponseAlg,\n              [client.clockSkew]: 0,\n              [client.clockTolerance]: 0,\n            },\n            clientAuthentication(provider.authentication),\n            {\n              timeout: options.timeoutSeconds,\n              execute: [client.enableNonRepudiationChecks],\n              [client.customFetch]: boundedFetch(fetch, signal, new Set([discoveryUrl.href])),\n            },\n          ),\n        catch: () => OAuthUnavailable.make({}),\n      });\n\n      raw = configuration.serverMetadata();\n    } else {\n      raw = {\n        issuer: provider.issuer,\n        authorization_endpoint: provider.authorizationEndpoint,\n        token_endpoint: provider.tokenEndpoint,\n        authorization_response_iss_parameter_supported: provider.responseIssuerMode === \"required\",\n      };\n    }\n\n    // oxlint-disable-next-line no-restricted-properties -- Discovered foreign metadata is not yet validated for this adapter profile.\n    const metadata = yield* Schema.decodeUnknownEffect(metadataSchema)(raw).pipe(\n      Effect.mapError(() => configError(\"metadata\")),\n    );\n\n    const allowedUrls = yield* Effect.try({\n      try: () => {\n        if (metadata.issuer !== provider.issuer) throw configError(\"issuer\");\n        if (\n          (metadata.authorization_response_iss_parameter_supported === true) !==\n          (provider.responseIssuerMode === \"required\")\n        )\n          throw configError(\"metadata\");\n        const auth = endpoint(metadata.authorization_endpoint);\n\n        for (const key of auth.searchParams.keys()) {\n          if (reserved.has(key.toLowerCase())) throw configError(\"parameters\");\n        }\n        const token = endpoint(metadata.token_endpoint);\n\n        const supportedAuthentication =\n          metadata.token_endpoint_auth_methods_supported ??\n          (provider.protocol === \"oidc\" ? [\"client_secret_basic\"] : undefined);\n\n        if (\n          supportedAuthentication !== undefined &&\n          !supportedAuthentication.includes(provider.authentication.method)\n        )\n          throw configError(\"authentication\");\n        const urls = new Set([token.href]);\n\n        if (provider.protocol === \"oidc\") {\n          if (\n            !metadata.code_challenge_methods_supported?.includes(\"S256\") ||\n            !metadata.response_types_supported?.includes(\"code\") ||\n            !metadata.id_token_signing_alg_values_supported?.includes(\"RS256\") ||\n            metadata.jwks_uri === undefined\n          )\n            throw configError(\"metadata\");\n          urls.add(endpoint(metadata.jwks_uri).href);\n        } else {\n          urls.add(endpoint(provider.identitySource.url).href);\n        }\n        freezeOAuth(metadata);\n\n        return urls;\n      },\n      catch: (error) =>\n        Schema.is(OpenIdClientConfigurationError)(error) ? error : configError(\"metadata\"),\n    });\n\n    const serverMetadata: client.ServerMetadata = {\n      ...metadata,\n      code_challenge_methods_supported: metadata.code_challenge_methods_supported?.slice(),\n      response_types_supported: metadata.response_types_supported?.slice(),\n      id_token_signing_alg_values_supported:\n        metadata.id_token_signing_alg_values_supported?.slice(),\n      token_endpoint_auth_methods_supported:\n        metadata.token_endpoint_auth_methods_supported?.slice(),\n    };\n\n    // The SDK encodes each generated 32-byte state/challenge/nonce in 43 URL-safe characters.\n    const placeholder = \"a\".repeat(43);\n\n    const authorization = yield* Effect.try({\n      try: () => new client.Configuration(serverMetadata, provider.clientId),\n      catch: () => configError(\"parameters\"),\n    });\n\n    for (const callback of provider.callbacks) {\n      const url = yield* Effect.try({\n        try: () =>\n          client.buildAuthorizationUrl(\n            authorization,\n            makeAuthorizationParameters(provider, callback.redirectUri, {\n              state: placeholder,\n              challenge: placeholder,\n              ...(provider.protocol === \"oidc\" ? { nonce: placeholder } : {}),\n            }),\n          ),\n        catch: () => configError(\"parameters\"),\n      });\n\n      yield* Schema.decodeEffect(OAuthAuthorizationUrl)(url.href).pipe(\n        Effect.mapError(() => configError(\"parameters\")),\n      );\n    }\n    freezeOAuth(serverMetadata);\n    installed.push({ provider, metadata: serverMetadata, allowedUrls });\n  }\n\n  return { installed, fetch, timeoutSeconds: options.timeoutSeconds };\n});\n"],"mappings":";;;;;;;;;AAsBA,MAAM,iBAAiB,YACrB,OAAO,OAAO,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,OAAO,CAAC;AAExE,MAAM,SAAS,OAAO,OACpB,OAAO,OAAO,MAAM,OAAO,UAAU,iCAAiC,CAAC,GACvE,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC,CAC9C,CAAC,CAAC,MAAM,OAAO,YAAY,WAAW,OAAO,KAAK,MAAM,CAAC,CAAC,UAAU,EAAE,CAAC;AAEvE,MAAM,SAAS,OAAO,kBAAkB,cAAc,IAAI,CAAC;AAE3D,MAAM,iBAAiB,OAAO,MAAM;CAClC,OAAO,OAAO;EAAE,QAAQ,OAAO,QAAQ,qBAAqB;EAAG;CAAO,CAAC;CACvE,OAAO,OAAO;EAAE,QAAQ,OAAO,QAAQ,oBAAoB;EAAG;CAAO,CAAC;CACtE,OAAO,OAAO;EAAE,QAAQ,OAAO,QAAQ,MAAM;EAAG,cAAc,OAAO,QAAQ,IAAI;CAAE,CAAC;AACtF,CAAC;AAED,MAAM,SAAS;CACb,UAAU;CACV,yBAAyB;CACzB,UAAU,OAAO,SAAS,CAAC,UAAU,SAAS,CAAC;CAC/C,QAAQ;CACR,oBAAoB,OAAO,SAAS,CAAC,YAAY,aAAa,CAAC;CAC/D,UAAU,cAAc,IAAI;CAC5B;CACA,WAAW,OAAO,MAChB,OAAO,OAAO;EAAE,YAAY;EAAiB,aAAa;CAAiB,CAAC,CAC9E,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,EAAE,CAAC;CACrD,QAAQ,OAAO,MACb,OAAO,OAAO,MAAM,OAAO,UAAU,mCAAmC,CAAC,CAC3E,CAAC,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC;CAC9B,yBAAyB,OAAO,YAAY,MAAM;CAClD,iBAAiB,OAAO,YAAY,MAAM;AAC5C;AAEA,MAAM,sBACJ,OAAO,OACL,OAAO,OAAO;CACZ,WAAW,OAAO,MAChB,OAAO,MAAM,CACX,OAAO,OAAO;EACZ,GAAG;EACH,UAAU,OAAO,QAAQ,MAAM;EAC/B,0BAA0B,OAAO,QAAQ,OAAO;EAChD,eAAe,OAAO,YACpB,OAAO,IAAI,MAAM,OAAO,UAAU;GAAE,SAAS;GAAG,SAAS;EAAM,CAAC,CAAC,CACnE;CACF,CAAC,GACD,OAAO,OAAO;EACZ,GAAG;EACH,UAAU,OAAO,QAAQ,OAAO;EAChC,uBAAuB,cAAc,IAAI;EACzC,eAAe,cAAc,IAAI;EACjC,UAAU,OAAO,QAAQ,IAAI;EAC7B,gBAAgB,OAAO,OAAO;GAC5B,KAAK,cAAc,IAAI;GACvB,SAAS,OAAO,YAAY,MAAM;GAElC,gBAAgB,OAAO,SAInB,UAEA,UAAU,WAAW,KAAK,CAC9B;EACF,CAAC;CACH,CAAC,CACH,CAAC,CACH,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,EAAE,CAAC;CACrD,gBAAgB,OAAO,OAAO,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAG,CAAC,CAAC;CACjF,OAAO,OAAO,YACZ,OAAO,SAA6B,UAClC,UAAU,WAAW,KAAK,CAC5B,CACF;AACF,CAAC,CACH;AAEF,MAAM,2BAAW,IAAI,IAAI;CACvB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,MAAM,mCAAmB,IAAI,IAAI;CAC/B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,MAAM,eAAe,WACnB,+BAA+B,KAAK,EAAE,OAAO,CAAC;AAEhD,MAAa,YAAY,UAAuB;CAC9C,MAAM,MAAM,IAAI,IAAI,KAAK;CAEzB,IACE,IAAI,aAAa,YACjB,IAAI,aAAa,MACjB,IAAI,aAAa,MACjB,MAAM,SAAS,GAAG,KAElB,6BAA6B,KAAK,KAAK,GAEvC,MAAM,YAAY,UAAU;CAE9B,OAAO;AACT;AAEA,MAAM,mBAAmB,eAA6D;CACpF,KAAK,MAAM,OAAO,OAAO,KAAK,cAAc,CAAC,CAAC,GAC5C,IAAI,SAAS,IAAI,IAAI,YAAY,CAAC,GAAG,MAAM,YAAY,YAAY;AAEvE;AAEA,MAAa,wBACX,mBACsB;CACtB,QAAQ,eAAe,QAAvB;EACE,KAAK,uBACH,OAAO,OAAO,kBAAkB,SAAS,MAAM,eAAe,MAAM,CAAC;EACvE,KAAK,sBACH,OAAO,OAAO,iBAAiB,SAAS,MAAM,eAAe,MAAM,CAAC;EACtE,KAAK,QACH,OAAO,OAAO,KAAK;CACvB;AACF;AAUA,MAAa,+BACX,eAMA,aACA,eAC4B;CAC5B,GAAG,cAAc;CACjB,eAAe;CACf,eAAe;CACf,cAAc;CACd,OAAO,cAAc,OAAO,KAAK,GAAG;CACpC,OAAO,UAAU;CACjB,gBAAgB,UAAU;CAC1B,uBAAuB;CACvB,GAAI,UAAU,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,UAAU,MAAM;CAClE,GAAI,cAAc,aAAa,UAAU,cAAc,kBAAkB,KAAA,IACrE,EAAE,SAAS,OAAO,cAAc,aAAa,EAAE,IAC/C,CAAC;AACP;AAEA,MAAM,iBAAiB,OAAO,OAAO;CACnC,QAAQ;CACR,wBAAwB,cAAc,IAAI;CAC1C,gBAAgB,cAAc,IAAI;CAClC,UAAU,OAAO,YAAY,cAAc,IAAI,CAAC;CAChD,kCAAkC,OAAO,YAAY,OAAO,MAAM,cAAc,EAAE,CAAC,CAAC;CACpF,0BAA0B,OAAO,YAAY,OAAO,MAAM,cAAc,EAAE,CAAC,CAAC;CAC5E,uCAAuC,OAAO,YAAY,OAAO,MAAM,cAAc,EAAE,CAAC,CAAC;CACzF,uCAAuC,OAAO,YAAY,OAAO,MAAM,cAAc,EAAE,CAAC,CAAC;CACzF,gDAAgD,OAAO,YAAY,OAAO,OAAO;AACnF,CAAC;AAED,MAAa,wBAAwB,OAAO,GAAG,oCAAoC,CAAC,CAAC,WACnF,OACA;CACA,MAAM,UAAU,OAAO,OAAO,aAAa,cAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KACpE,OAAO,eAAe,YAAY,UAAU,CAAC,CAC/C;CAGA,MAAM,YAAY,QAAQ,UAAU,KAAK,aAA0B;EACjE,MAAM,WAAW;GACf,WAAW,SAAS,UAAU,KAAK,cAAc,EAAE,GAAG,SAAS,EAAE;GACjE,QAAQ,CAAC,GAAG,SAAS,MAAM;GAC3B,GAAI,SAAS,4BAA4B,KAAA,IACrC,CAAC,IACD,EAAE,yBAAyB,EAAE,GAAG,SAAS,wBAAwB,EAAE;GACvE,GAAI,SAAS,oBAAoB,KAAA,IAC7B,CAAC,IACD,EAAE,iBAAiB,EAAE,GAAG,SAAS,gBAAgB,EAAE;GACvD,gBACE,SAAS,eAAe,WAAW,SAC/B,EAAE,GAAG,SAAS,eAAe,IAC7B;IACE,GAAG,SAAS;IACZ,QAAQ,SAAS,KAAK,SAAS,MAAM,SAAS,eAAe,MAAM,CAAC;GACtE;EACR;EAEA,OAAO,SAAS,aAAa,SACzB;GAAE,GAAG;GAAU,GAAG;EAAS,IAC3B;GACE,GAAG;GACH,GAAG;GACH,gBAAgB;IACd,GAAG,SAAS;IACZ,GAAI,SAAS,eAAe,YAAY,KAAA,IACpC,CAAC,IACD,EAAE,SAAS,EAAE,GAAG,SAAS,eAAe,QAAQ,EAAE;GACxD;EACF;CACN,CAAC;CAED,MAAM,QACJ,QAAQ,WACN,KAAK,SACL,WAAW,MAAM,KAAK;EACpB,GAAG;EACH,MAAM,KAAK,gBAAgB,aAAa,IAAI,WAAW,KAAK,IAAI,IAAI,KAAK;CAC3E,CAAC;CAEL,OAAO,OAAO,IAAI;EAChB,WAAW;GACT,MAAM,8BAAc,IAAI,IAAY;GACpC,MAAM,yBAAS,IAAI,IAAY;GAC/B,MAAM,wBAAQ,IAAI,IAAY;GAE9B,KAAK,MAAM,YAAY,WAAW;IAChC,MAAM,aAAa,GAAG,SAAS,SAAS,OAAO,GAAG,SAAS,SAAS,GAAG,SAAS;IAEhF,IAAI,YAAY,IAAI,UAAU,GAAG,MAAM,YAAY,YAAY;IAC/D,YAAY,IAAI,UAAU;IAC1B,MAAM,IAAI,SAAS,QAAQ;IAC3B,IAAI,SAAS,aAAa,UAAU;KAClC,IAAI,OAAO,IAAI,SAAS,QAAQ,GAAG,MAAM,YAAY,YAAY;KACjE,OAAO,IAAI,SAAS,QAAQ;IAC9B;IACA,MAAM,SAAS,SAAS,SAAS,MAAM;IAEvC,IAAI,SAAS,OAAO,SAAS,GAAG,KAAK,OAAO,SAAS,SAAS,eAAe,GAC3E,MAAM,YAAY,QAAQ;IAC5B,IAAI,IAAI,IAAI,SAAS,MAAM,CAAC,CAAC,SAAS,SAAS,OAAO,QACpD,MAAM,YAAY,YAAY;IAChC,IAAK,SAAS,aAAa,WAAY,SAAS,OAAO,SAAS,QAAQ,GACtE,MAAM,YAAY,YAAY;IAChC,gBAAgB,SAAS,uBAAuB;IAChD,gBAAgB,SAAS,eAAe;IACxC,MAAM,4BAAY,IAAI,IAAY;IAElC,KAAK,MAAM,YAAY,SAAS,WAAW;KAGzC,IAFY,SAAS,SAAS,WAG1B,CAAC,CAAC,SAAS,SAAS,eACtB,SAAS,YAAY,SAAS,GAAG,KACjC,UAAU,IAAI,SAAS,UAAU,GAEjC,MAAM,YAAY,UAAU;KAC9B,UAAU,IAAI,SAAS,UAAU;KACjC,KAAK,MAAM,SAAS,WAAW;MAC7B,IAAI,SAAS,WAAW,MAAM,QAAQ;MACtC,IACE,SAAS,uBAAuB,cAChC,MAAM,uBAAuB,YAE7B;MACF,IAAI,MAAM,UAAU,MAAM,cAAc,UAAU,gBAAgB,SAAS,WAAW,GACpF,MAAM,YAAY,UAAU;KAChC;IACF;IACA,IAAI,SAAS,aAAa,SAAS;KACjC,SAAS,SAAS,eAAe,GAAG;KACpC,KAAK,MAAM,OAAO,OAAO,KAAK,SAAS,eAAe,WAAW,CAAC,CAAC,GACjE,IAAI,iBAAiB,IAAI,IAAI,YAAY,CAAC,GAAG,MAAM,YAAY,iBAAiB;KAElF,IAAI,QAAQ,SAAS,eAAe,OAAO;IAC7C;IACA,YAAY,QAAQ;GACtB;GACA,IAAI,OAAO,SAAS,MAAM,MAAM,MAAM,YAAY,YAAY;EAChE;EACA,QAAQ,UACN,OAAO,GAAG,8BAA8B,CAAC,CAAC,KAAK,IAAI,QAAQ,YAAY,UAAU;CACrF,CAAC;CACD,MAAM,YAAoC,CAAC;CAE3C,KAAK,MAAM,YAAY,WAAW;EAChC,IAAI;EAEJ,IAAI,SAAS,aAAa,QAAQ;GAChC,MAAM,eAAe,IAAI,IAAI,SAAS,MAAM;GAE5C,aAAa,WAAW,GAAG,aAAa,SAAS,QAAQ,QAAQ,EAAE,EAAE;GAsBrE,OAAM,OApBuB,OAAO,WAAW;IAC7C,MAAM,WACJ,OAAO,UACL,IAAI,IAAI,SAAS,MAAM,GACvB,SAAS,UACT;KACE,8BAA8B,SAAS;MACtC,OAAO,YAAY;MACnB,OAAO,iBAAiB;IAC3B,GACA,qBAAqB,SAAS,cAAc,GAC5C;KACE,SAAS,QAAQ;KACjB,SAAS,CAAC,OAAO,0BAA0B;MAC1C,OAAO,cAAc,aAAa,OAAO,wBAAQ,IAAI,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC;IAChF,CACF;IACF,aAAa,iBAAiB,KAAK,CAAC,CAAC;GACvC,CAAC,EAAA,CAEmB,eAAe;EACrC,OACE,MAAM;GACJ,QAAQ,SAAS;GACjB,wBAAwB,SAAS;GACjC,gBAAgB,SAAS;GACzB,gDAAgD,SAAS,uBAAuB;EAClF;EAIF,MAAM,WAAW,OAAO,OAAO,oBAAoB,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,KACtE,OAAO,eAAe,YAAY,UAAU,CAAC,CAC/C;EAEA,MAAM,cAAc,OAAO,OAAO,IAAI;GACpC,WAAW;IACT,IAAI,SAAS,WAAW,SAAS,QAAQ,MAAM,YAAY,QAAQ;IACnE,IACG,SAAS,mDAAmD,UAC5D,SAAS,uBAAuB,aAEjC,MAAM,YAAY,UAAU;IAC9B,MAAM,OAAO,SAAS,SAAS,sBAAsB;IAErD,KAAK,MAAM,OAAO,KAAK,aAAa,KAAK,GACvC,IAAI,SAAS,IAAI,IAAI,YAAY,CAAC,GAAG,MAAM,YAAY,YAAY;IAErE,MAAM,QAAQ,SAAS,SAAS,cAAc;IAE9C,MAAM,0BACJ,SAAS,0CACR,SAAS,aAAa,SAAS,CAAC,qBAAqB,IAAI,KAAA;IAE5D,IACE,4BAA4B,KAAA,KAC5B,CAAC,wBAAwB,SAAS,SAAS,eAAe,MAAM,GAEhE,MAAM,YAAY,gBAAgB;IACpC,MAAM,uBAAO,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC;IAEjC,IAAI,SAAS,aAAa,QAAQ;KAChC,IACE,CAAC,SAAS,kCAAkC,SAAS,MAAM,KAC3D,CAAC,SAAS,0BAA0B,SAAS,MAAM,KACnD,CAAC,SAAS,uCAAuC,SAAS,OAAO,KACjE,SAAS,aAAa,KAAA,GAEtB,MAAM,YAAY,UAAU;KAC9B,KAAK,IAAI,SAAS,SAAS,QAAQ,CAAC,CAAC,IAAI;IAC3C,OACE,KAAK,IAAI,SAAS,SAAS,eAAe,GAAG,CAAC,CAAC,IAAI;IAErD,YAAY,QAAQ;IAEpB,OAAO;GACT;GACA,QAAQ,UACN,OAAO,GAAG,8BAA8B,CAAC,CAAC,KAAK,IAAI,QAAQ,YAAY,UAAU;EACrF,CAAC;EAED,MAAM,iBAAwC;GAC5C,GAAG;GACH,kCAAkC,SAAS,kCAAkC,MAAM;GACnF,0BAA0B,SAAS,0BAA0B,MAAM;GACnE,uCACE,SAAS,uCAAuC,MAAM;GACxD,uCACE,SAAS,uCAAuC,MAAM;EAC1D;EAGA,MAAM,cAAc,IAAI,OAAO,EAAE;EAEjC,MAAM,gBAAgB,OAAO,OAAO,IAAI;GACtC,WAAW,IAAI,OAAO,cAAc,gBAAgB,SAAS,QAAQ;GACrE,aAAa,YAAY,YAAY;EACvC,CAAC;EAED,KAAK,MAAM,YAAY,SAAS,WAAW;GACzC,MAAM,MAAM,OAAO,OAAO,IAAI;IAC5B,WACE,OAAO,sBACL,eACA,4BAA4B,UAAU,SAAS,aAAa;KAC1D,OAAO;KACP,WAAW;KACX,GAAI,SAAS,aAAa,SAAS,EAAE,OAAO,YAAY,IAAI,CAAC;IAC/D,CAAC,CACH;IACF,aAAa,YAAY,YAAY;GACvC,CAAC;GAED,OAAO,OAAO,aAAa,qBAAqB,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAC1D,OAAO,eAAe,YAAY,YAAY,CAAC,CACjD;EACF;EACA,YAAY,cAAc;EAC1B,UAAU,KAAK;GAAE;GAAU,UAAU;GAAgB;EAAY,CAAC;CACpE;CAEA,OAAO;EAAE;EAAW;EAAO,gBAAgB,QAAQ;CAAe;AACpE,CAAC"}