@yielded/auth 0.1.0-beta.1

package/dist/oauth/openid-client/connected/configuration.mjs

@@ -0,0 +1,338 @@
+import { OAuthProviderKey } from "../../schema.mjs";
+import { OAuthCallbackId, OAuthGeneration, OAuthIssuer, OAuthRedirectUri } from "../../signInModels.mjs";
+import { OAuthUnavailable } from "../../signInErrors.mjs";
+import { freezeOAuth, snapshotOAuthSync } from "../../signInSnapshot.mjs";
+import { OAuthConnectedProfile } from "../../connectedModels.mjs";
+import { OpenIdClientConfigurationError } from "../models.mjs";
+import { boundedFetch } from "../transport.mjs";
+import { clientAuthentication, endpoint } from "../configuration.mjs";
+import { Effect, Predicate, Redacted, Schema } from "effect";
+import * as client from "openid-client";
+//#region src/oauth/openid-client/connected/configuration.ts
+const text = (maximum) => Schema.NonEmptyString.check(Schema.isMaxLength(maximum));
+const fields = Schema.Record(Schema.String.check(Schema.isPattern(/^[A-Za-z][A-Za-z0-9._~-]{0,63}$/)), Schema.String.check(Schema.isMaxLength(2048))).check(Schema.makeFilter((value) => Object.keys(value).length <= 16));
+const authentication = Schema.Union([
+	Schema.Struct({
+		method: Schema.Literal("client_secret_basic"),
+		secret: Schema.RedactedFromValue(text(4096))
+	}),
+	Schema.Struct({
+		method: Schema.Literal("client_secret_post"),
+		secret: Schema.RedactedFromValue(text(4096))
+	}),
+	Schema.Struct({
+		method: Schema.Literal("none"),
+		publicClient: Schema.Literal(true)
+	})
+]);
+const common = {
+	provider: OAuthProviderKey,
+	configurationGeneration: OAuthGeneration,
+	issuance: Schema.Literals(["active", "retired"]),
+	issuer: OAuthIssuer,
+	responseIssuerMode: Schema.Literals(["required", "unsupported"]),
+	clientId: text(1024),
+	authentication,
+	callbacks: Schema.Array(Schema.Struct({
+		callbackId: OAuthCallbackId,
+		redirectUri: OAuthRedirectUri
+	})).check(Schema.isMinLength(1), Schema.isMaxLength(16)),
+	authorizationParameters: Schema.optionalKey(fields),
+	tokenParameters: Schema.optionalKey(fields),
+	refreshParameters: Schema.optionalKey(fields),
+	clientRegistrationId: OAuthConnectedProfile.fields.clientRegistrationId,
+	profiles: Schema.Array(OAuthConnectedProfile).check(Schema.isMinLength(1), Schema.isMaxLength(64)),
+	resourceIndicators: Schema.Literals(["unsupported", "rfc8707"]),
+	refreshExpiry: Schema.Union([Schema.Literal("unreported"), Schema.Struct({
+		field: Schema.Literals(["refresh_expires_in", "refresh_token_expires_in"]),
+		zero: Schema.Literals(["unreported", "expired"])
+	})]),
+	revocation: Schema.Union([Schema.Struct({ mode: Schema.Literal("unsupported") }), Schema.Struct({
+		mode: Schema.Literal("rfc7009"),
+		scope: Schema.Literal("cohort"),
+		tokenTypes: Schema.Literals(["access", "access-and-refresh"]),
+		authentication,
+		endpoint: Schema.optionalKey(text(2048))
+	})])
+};
+const optionsSchema = (providerCohort) => Schema.toType(Schema.Struct({
+	providers: Schema.Array(Schema.Union([Schema.Struct({
+		...common,
+		protocol: Schema.Literal("oidc"),
+		idTokenSignedResponseAlg: Schema.Literal("RS256"),
+		maxAgeSeconds: Schema.optionalKey(Schema.Int.check(Schema.isBetween({
+			minimum: 0,
+			maximum: 86400
+		})))
+	}), Schema.Struct({
+		...common,
+		revocation: providerCohort ? Schema.Union([common.revocation, Schema.Struct({ mode: Schema.Literal("provider-cohort") })]) : common.revocation,
+		protocol: Schema.Literal("oauth"),
+		authorizationEndpoint: text(2048),
+		tokenEndpoint: text(2048),
+		pkceS256: Schema.Literal(true),
+		identitySource: Schema.Struct({
+			url: text(2048),
+			headers: Schema.optionalKey(fields),
+			decodeIdentity: Schema.declare((value) => Predicate.isFunction(value))
+		})
+	})])).check(Schema.isMinLength(1), Schema.isMaxLength(64)),
+	timeoutSeconds: Schema.Finite.check(Schema.isBetween({
+		minimum: 1,
+		maximum: 30
+	})),
+	fetch: Schema.optionalKey(Schema.declare((value) => Predicate.isFunction(value)))
+}));
+const reserved = /* @__PURE__ */ new Set([
+	"client_id",
+	"client_secret",
+	"client_assertion",
+	"client_assertion_type",
+	"redirect_uri",
+	"response_type",
+	"response_mode",
+	"state",
+	"code",
+	"code_verifier",
+	"code_challenge",
+	"code_challenge_method",
+	"nonce",
+	"scope",
+	"resource",
+	"audience",
+	"iss",
+	"grant_type",
+	"refresh_token",
+	"token",
+	"token_type_hint",
+	"max_age",
+	"request",
+	"request_uri",
+	"authorization_details",
+	"id_token_hint",
+	"login_hint",
+	"login_hint_token",
+	"subject_token",
+	"subject_token_type",
+	"actor_token",
+	"actor_token_type",
+	"requested_token_type"
+]);
+const tupleKey = (values) => JSON.stringify(values);
+const forbiddenHeaders = /* @__PURE__ */ new Set([
+	"authorization",
+	"proxy-authorization",
+	"cookie",
+	"host",
+	"content-length",
+	"content-type",
+	"transfer-encoding",
+	"connection",
+	"upgrade",
+	"trailer",
+	"te"
+]);
+const configurationError = (reason) => OpenIdClientConfigurationError.make({ reason });
+const copyAuth = (value) => value.method === "none" ? { ...value } : {
+	...value,
+	secret: Redacted.make(Redacted.value(value.secret))
+};
+const copyRevocation = (value) => value.mode === "rfc7009" ? {
+	...value,
+	authentication: copyAuth(value.authentication)
+} : { ...value };
+const metadataSchema = Schema.Struct({
+	issuer: OAuthIssuer,
+	authorization_endpoint: text(2048),
+	token_endpoint: text(2048),
+	jwks_uri: Schema.optionalKey(text(2048)),
+	revocation_endpoint: Schema.optionalKey(text(2048)),
+	code_challenge_methods_supported: Schema.optionalKey(Schema.Array(text(64)).check(Schema.isMaxLength(64))),
+	response_types_supported: Schema.optionalKey(Schema.Array(text(64)).check(Schema.isMaxLength(64))),
+	grant_types_supported: Schema.optionalKey(Schema.Array(text(128)).check(Schema.isMaxLength(64))),
+	id_token_signing_alg_values_supported: Schema.optionalKey(Schema.Array(text(64)).check(Schema.isMaxLength(64))),
+	token_endpoint_auth_methods_supported: Schema.optionalKey(Schema.Array(text(64)).check(Schema.isMaxLength(64))),
+	revocation_endpoint_auth_methods_supported: Schema.optionalKey(Schema.Array(text(64)).check(Schema.isMaxLength(64))),
+	authorization_response_iss_parameter_supported: Schema.optionalKey(Schema.Boolean)
+});
+/** The issuance flag selects new authorization only; retained profile content is immutable. */
+const sameConnectedProfile = (registered, saved) => Schema.encodeSync(Schema.fromJsonString(OAuthConnectedProfile))({
+	...registered,
+	issuance: saved.issuance
+}) === Schema.encodeSync(Schema.fromJsonString(OAuthConnectedProfile))(saved);
+const installConnectedConfigurations = Effect.fn("OpenIdClient.installConnectedConfigurations")(function* (input, providerCohort = false) {
+	const options = yield* Schema.decodeEffect(optionsSchema(providerCohort))(input).pipe(Effect.mapError(() => configurationError("provider")));
+	const providers = yield* Effect.try({
+		try: () => options.providers.map((provider) => {
+			const detached = {
+				authentication: copyAuth(provider.authentication),
+				callbacks: provider.callbacks.map((value) => ({ ...value })),
+				profiles: provider.profiles.map((value) => snapshotOAuthSync(OAuthConnectedProfile, value)),
+				...provider.authorizationParameters ? { authorizationParameters: { ...provider.authorizationParameters } } : {},
+				...provider.tokenParameters ? { tokenParameters: { ...provider.tokenParameters } } : {},
+				...provider.refreshParameters ? { refreshParameters: { ...provider.refreshParameters } } : {},
+				refreshExpiry: provider.refreshExpiry === "unreported" ? provider.refreshExpiry : { ...provider.refreshExpiry }
+			};
+			return provider.protocol === "oidc" ? {
+				...provider,
+				...detached,
+				revocation: copyRevocation(provider.revocation)
+			} : {
+				...provider,
+				...detached,
+				revocation: copyRevocation(provider.revocation),
+				identitySource: {
+					...provider.identitySource,
+					...provider.identitySource.headers ? { headers: { ...provider.identitySource.headers } } : {}
+				}
+			};
+		}),
+		catch: () => configurationError("provider")
+	});
+	const fetch = options.fetch ?? ((url, init) => globalThis.fetch(url, {
+		...init,
+		body: init.body instanceof Uint8Array ? new Uint8Array(init.body) : init.body
+	}));
+	yield* Effect.try({
+		try: () => {
+			const generations = /* @__PURE__ */ new Set(), active = /* @__PURE__ */ new Set(), aliases = /* @__PURE__ */ new Map(), registrations = /* @__PURE__ */ new Map();
+			let profileCount = 0;
+			for (const provider of providers) {
+				const generationKey = tupleKey([provider.provider, provider.configurationGeneration]);
+				if (generations.has(generationKey) || provider.issuance === "active" && active.has(provider.provider)) throw configurationError("generation");
+				generations.add(generationKey);
+				if (provider.issuance === "active") active.add(provider.provider);
+				const issuer = endpoint(provider.issuer);
+				if (provider.issuer.includes("?")) throw configurationError("issuer");
+				const aliasKey = tupleKey([issuer.href, provider.clientId]), alias = tupleKey([provider.provider, provider.clientRegistrationId]);
+				if (aliases.has(aliasKey) && aliases.get(aliasKey) !== alias) throw configurationError("provider");
+				aliases.set(aliasKey, alias);
+				const registration = tupleKey([
+					provider.provider,
+					issuer.href,
+					provider.clientRegistrationId
+				]);
+				if (registrations.has(registration) && registrations.get(registration) !== provider.clientId) throw configurationError("provider");
+				registrations.set(registration, provider.clientId);
+				const callbacks = /* @__PURE__ */ new Set();
+				for (const callback of provider.callbacks) {
+					const url = endpoint(callback.redirectUri);
+					if (callbacks.has(callback.callbackId) || callback.redirectUri.includes("?") || url.href !== callback.redirectUri) throw configurationError("callback");
+					callbacks.add(callback.callbackId);
+				}
+				for (const parameters of [
+					provider.authorizationParameters,
+					provider.tokenParameters,
+					provider.refreshParameters
+				]) for (const key of Object.keys(parameters ?? {})) if (reserved.has(key.toLowerCase())) throw configurationError("parameters");
+				const profiles = /* @__PURE__ */ new Set(), activeProfiles = /* @__PURE__ */ new Set();
+				for (const profile of provider.profiles) {
+					if (++profileCount > 64) throw configurationError("provider");
+					const key = tupleKey([profile.key, profile.generation]);
+					if (profiles.has(key) || profile.issuance === "active" && activeProfiles.has(profile.key) || profile.provider !== provider.provider || profile.clientRegistrationId !== provider.clientRegistrationId || new Set(profile.scopes).size !== profile.scopes.length || new Set(profile.resources).size !== profile.resources.length || profile.refreshAheadMillis >= profile.maximumAccessLifetimeMillis || provider.protocol === "oidc" && !profile.scopes.includes("openid") || provider.resourceIndicators === "unsupported" && profile.resources.length !== 0 || profile.retention === "access-only" && profile.refresh !== "unsupported" || profile.retention === "access-and-refresh" && (profile.refresh === "unsupported" || profile.maximumRefreshLifetimeMillis === void 0 || provider.authentication.method === "none" && profile.refresh !== "rotating") || profile.revocation === "cohort" && (provider.revocation.mode === "unsupported" || provider.revocation.mode === "rfc7009" && profile.retention === "access-and-refresh" && provider.revocation.tokenTypes !== "access-and-refresh")) throw configurationError("provider");
+					profiles.add(key);
+					if (profile.issuance === "active") activeProfiles.add(profile.key);
+					for (const resource of profile.resources) {
+						const uri = new URL(resource);
+						if (resource.includes("#") || /[\s\\\u0000-\u001f\u007f]/u.test(resource) || uri.username !== "" || uri.password !== "") throw configurationError("parameters");
+					}
+				}
+				if (provider.protocol === "oauth") {
+					endpoint(provider.authorizationEndpoint);
+					endpoint(provider.tokenEndpoint);
+					endpoint(provider.identitySource.url);
+					const headers = /* @__PURE__ */ new Set();
+					for (const [name, value] of Object.entries(provider.identitySource.headers ?? {})) {
+						const lower = name.toLowerCase();
+						if (forbiddenHeaders.has(lower) || headers.has(lower) || /[\r\n]/u.test(value)) throw configurationError("identity-source");
+						headers.add(lower);
+					}
+				}
+				if (provider.revocation.mode === "rfc7009") {
+					if (provider.protocol === "oauth" && provider.revocation.endpoint === void 0) throw configurationError("metadata");
+					if (provider.revocation.endpoint) endpoint(provider.revocation.endpoint);
+				}
+				freezeOAuth(provider);
+			}
+		},
+		catch: (error) => Schema.is(OpenIdClientConfigurationError)(error) ? error : configurationError("provider")
+	});
+	const installed = [];
+	for (const provider of providers) {
+		let raw;
+		if (provider.protocol === "oidc") {
+			const discovery = new URL(provider.issuer);
+			discovery.pathname = `${discovery.pathname.replace(/\/$/u, "")}/.well-known/openid-configuration`;
+			raw = (yield* Effect.tryPromise({
+				try: (signal) => client.discovery(new URL(provider.issuer), provider.clientId, {
+					id_token_signed_response_alg: "RS256",
+					[client.clockSkew]: 0,
+					[client.clockTolerance]: 0
+				}, clientAuthentication(provider.authentication), {
+					timeout: options.timeoutSeconds,
+					execute: [client.enableNonRepudiationChecks],
+					[client.customFetch]: boundedFetch(fetch, signal, /* @__PURE__ */ new Set([discovery.href]))
+				}),
+				catch: () => OAuthUnavailable.make({})
+			})).serverMetadata();
+		} else raw = {
+			issuer: provider.issuer,
+			authorization_endpoint: provider.authorizationEndpoint,
+			token_endpoint: provider.tokenEndpoint,
+			authorization_response_iss_parameter_supported: provider.responseIssuerMode === "required",
+			...provider.revocation.mode === "rfc7009" ? { revocation_endpoint: provider.revocation.endpoint } : {}
+		};
+		const metadata = yield* Schema.decodeUnknownEffect(metadataSchema)(raw).pipe(Effect.mapError(() => configurationError("metadata")));
+		const allowedUrls = yield* Effect.try({
+			try: () => {
+				if (metadata.issuer !== provider.issuer) throw configurationError("issuer");
+				if (metadata.authorization_response_iss_parameter_supported === true !== (provider.responseIssuerMode === "required")) throw configurationError("metadata");
+				const authorization = endpoint(metadata.authorization_endpoint);
+				for (const key of authorization.searchParams.keys()) if (reserved.has(key.toLowerCase())) throw configurationError("parameters");
+				const token = endpoint(metadata.token_endpoint);
+				for (const key of token.searchParams.keys()) if (reserved.has(key.toLowerCase())) throw configurationError("parameters");
+				const urls = /* @__PURE__ */ new Set([token.href]);
+				const tokenAuthentication = metadata.token_endpoint_auth_methods_supported ?? (provider.protocol === "oidc" ? ["client_secret_basic"] : void 0);
+				if (tokenAuthentication && !tokenAuthentication.includes(provider.authentication.method)) throw configurationError("authentication");
+				if (provider.protocol === "oidc") {
+					if (!metadata.code_challenge_methods_supported?.includes("S256") || !metadata.response_types_supported?.includes("code") || !metadata.id_token_signing_alg_values_supported?.includes("RS256") || metadata.jwks_uri === void 0 || provider.profiles.some((profile) => profile.retention === "access-and-refresh") && !metadata.grant_types_supported?.includes("refresh_token")) throw configurationError("metadata");
+					urls.add(endpoint(metadata.jwks_uri).href);
+				} else urls.add(endpoint(provider.identitySource.url).href);
+				if (provider.revocation.mode === "rfc7009") {
+					if (!metadata.revocation_endpoint || provider.revocation.endpoint !== void 0 && provider.revocation.endpoint !== metadata.revocation_endpoint) throw configurationError("metadata");
+					const auth = metadata.revocation_endpoint_auth_methods_supported ?? (provider.protocol === "oidc" ? ["client_secret_basic"] : void 0);
+					if (auth && !auth.includes(provider.revocation.authentication.method)) throw configurationError("authentication");
+					const revoke = endpoint(metadata.revocation_endpoint);
+					for (const key of revoke.searchParams.keys()) if (reserved.has(key.toLowerCase())) throw configurationError("parameters");
+					urls.add(revoke.href);
+				}
+				return urls;
+			},
+			catch: (error) => Schema.is(OpenIdClientConfigurationError)(error) ? error : configurationError("metadata")
+		});
+		const serverMetadata = {
+			...metadata,
+			code_challenge_methods_supported: metadata.code_challenge_methods_supported?.slice(),
+			response_types_supported: metadata.response_types_supported?.slice(),
+			grant_types_supported: metadata.grant_types_supported?.slice(),
+			id_token_signing_alg_values_supported: metadata.id_token_signing_alg_values_supported?.slice(),
+			token_endpoint_auth_methods_supported: metadata.token_endpoint_auth_methods_supported?.slice(),
+			revocation_endpoint_auth_methods_supported: metadata.revocation_endpoint_auth_methods_supported?.slice()
+		};
+		freezeOAuth(serverMetadata);
+		installed.push({
+			provider,
+			metadata: serverMetadata,
+			allowedUrls
+		});
+	}
+	return {
+		installed,
+		fetch,
+		timeoutSeconds: options.timeoutSeconds
+	};
+});
+//#endregion
+export { installConnectedConfigurations, sameConnectedProfile };
+
+//# sourceMappingURL=configuration.mjs.map

package/dist/oauth/openid-client/connected/configuration.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"configuration.mjs","names":[],"sources":["../../../../src/oauth/openid-client/connected/configuration.ts"],"sourcesContent":["import { Effect, Predicate, Redacted, Schema } from \"effect\";\nimport * as client from \"openid-client\";\n\nimport { OAuthConnectedProfile } from \"../../connectedModels\";\nimport { OAuthProviderKey } from \"../../schema\";\nimport { OAuthUnavailable } from \"../../signInErrors\";\nimport {\n  OAuthCallbackId,\n  OAuthGeneration,\n  OAuthIssuer,\n  OAuthRedirectUri,\n} from \"../../signInModels\";\nimport { freezeOAuth, snapshotOAuthSync } from \"../../signInSnapshot\";\nimport type { ConnectedOptions, ProviderConnectedOAuth } from \"../compatibility\";\nimport { clientAuthentication, endpoint } from \"../configuration\";\nimport { OpenIdClientConfigurationError, type OpenIdClientAuthentication } from \"../models\";\nimport { boundedFetch } from \"../transport\";\nimport type {\n  OpenIdClientConnectedOAuthProvider,\n  OpenIdClientConnectedOidcProvider,\n} from \"./models\";\n\nconst text = (maximum: number) => Schema.NonEmptyString.check(Schema.isMaxLength(maximum));\n\nconst fields = Schema.Record(\n  Schema.String.check(Schema.isPattern(/^[A-Za-z][A-Za-z0-9._~-]{0,63}$/)),\n  Schema.String.check(Schema.isMaxLength(2048)),\n).check(Schema.makeFilter((value) => Object.keys(value).length <= 16));\n\nconst authentication = Schema.Union([\n  Schema.Struct({\n    method: Schema.Literal(\"client_secret_basic\"),\n    secret: Schema.RedactedFromValue(text(4096)),\n  }),\n  Schema.Struct({\n    method: Schema.Literal(\"client_secret_post\"),\n    secret: Schema.RedactedFromValue(text(4096)),\n  }),\n  Schema.Struct({ method: Schema.Literal(\"none\"), publicClient: Schema.Literal(true) }),\n]);\n\nconst common = {\n  provider: OAuthProviderKey,\n  configurationGeneration: OAuthGeneration,\n  issuance: Schema.Literals([\"active\", \"retired\"]),\n  issuer: OAuthIssuer,\n  responseIssuerMode: Schema.Literals([\"required\", \"unsupported\"]),\n  clientId: text(1024),\n  authentication,\n  callbacks: Schema.Array(\n    Schema.Struct({ callbackId: OAuthCallbackId, redirectUri: OAuthRedirectUri }),\n  ).check(Schema.isMinLength(1), Schema.isMaxLength(16)),\n  authorizationParameters: Schema.optionalKey(fields),\n  tokenParameters: Schema.optionalKey(fields),\n  refreshParameters: Schema.optionalKey(fields),\n  clientRegistrationId: OAuthConnectedProfile.fields.clientRegistrationId,\n  profiles: Schema.Array(OAuthConnectedProfile).check(\n    Schema.isMinLength(1),\n    Schema.isMaxLength(64),\n  ),\n  resourceIndicators: Schema.Literals([\"unsupported\", \"rfc8707\"]),\n  refreshExpiry: Schema.Union([\n    Schema.Literal(\"unreported\"),\n    Schema.Struct({\n      field: Schema.Literals([\"refresh_expires_in\", \"refresh_token_expires_in\"]),\n      zero: Schema.Literals([\"unreported\", \"expired\"]),\n    }),\n  ]),\n  revocation: Schema.Union([\n    Schema.Struct({ mode: Schema.Literal(\"unsupported\") }),\n    Schema.Struct({\n      mode: Schema.Literal(\"rfc7009\"),\n      scope: Schema.Literal(\"cohort\"),\n      tokenTypes: Schema.Literals([\"access\", \"access-and-refresh\"]),\n      authentication,\n      endpoint: Schema.optionalKey(text(2048)),\n    }),\n  ]),\n};\n\nconst optionsSchema = <R>(providerCohort: boolean) =>\n  Schema.toType(\n    Schema.Struct({\n      providers: Schema.Array(\n        Schema.Union([\n          Schema.Struct({\n            ...common,\n            protocol: Schema.Literal(\"oidc\"),\n            idTokenSignedResponseAlg: Schema.Literal(\"RS256\"),\n            maxAgeSeconds: Schema.optionalKey(\n              Schema.Int.check(Schema.isBetween({ minimum: 0, maximum: 86400 })),\n            ),\n          }),\n          Schema.Struct({\n            ...common,\n            revocation: providerCohort\n              ? Schema.Union([\n                  common.revocation,\n                  Schema.Struct({ mode: Schema.Literal(\"provider-cohort\") }),\n                ])\n              : common.revocation,\n            protocol: Schema.Literal(\"oauth\"),\n            authorizationEndpoint: text(2048),\n            tokenEndpoint: text(2048),\n            pkceS256: Schema.Literal(true),\n            identitySource: Schema.Struct({\n              url: text(2048),\n              headers: Schema.optionalKey(fields),\n              decodeIdentity: Schema.declare<\n                OpenIdClientConnectedOAuthProvider<R>[\"identitySource\"][\"decodeIdentity\"]\n              >(\n                (\n                  value,\n                ): value is OpenIdClientConnectedOAuthProvider<R>[\"identitySource\"][\"decodeIdentity\"] =>\n                  Predicate.isFunction(value),\n              ),\n            }),\n          }),\n        ]),\n      ).check(Schema.isMinLength(1), Schema.isMaxLength(64)),\n      timeoutSeconds: Schema.Finite.check(Schema.isBetween({ minimum: 1, maximum: 30 })),\n      fetch: Schema.optionalKey(\n        Schema.declare<client.CustomFetch>((value): value is client.CustomFetch =>\n          Predicate.isFunction(value),\n        ),\n      ),\n    }),\n  );\n\nconst reserved = new Set([\n  \"client_id\",\n  \"client_secret\",\n  \"client_assertion\",\n  \"client_assertion_type\",\n  \"redirect_uri\",\n  \"response_type\",\n  \"response_mode\",\n  \"state\",\n  \"code\",\n  \"code_verifier\",\n  \"code_challenge\",\n  \"code_challenge_method\",\n  \"nonce\",\n  \"scope\",\n  \"resource\",\n  \"audience\",\n  \"iss\",\n  \"grant_type\",\n  \"refresh_token\",\n  \"token\",\n  \"token_type_hint\",\n  \"max_age\",\n  \"request\",\n  \"request_uri\",\n  \"authorization_details\",\n  \"id_token_hint\",\n  \"login_hint\",\n  \"login_hint_token\",\n  \"subject_token\",\n  \"subject_token_type\",\n  \"actor_token\",\n  \"actor_token_type\",\n  \"requested_token_type\",\n]);\n\n// oxlint-disable-next-line no-restricted-properties -- Collision-free fingerprints for bounded local configuration tuple indexes.\nconst tupleKey = (values: ReadonlyArray<string | number>) => JSON.stringify(values);\n\nconst forbiddenHeaders = new Set([\n  \"authorization\",\n  \"proxy-authorization\",\n  \"cookie\",\n  \"host\",\n  \"content-length\",\n  \"content-type\",\n  \"transfer-encoding\",\n  \"connection\",\n  \"upgrade\",\n  \"trailer\",\n  \"te\",\n]);\n\nconst configurationError = (reason: OpenIdClientConfigurationError[\"reason\"]) =>\n  OpenIdClientConfigurationError.make({ reason });\n\nconst copyAuth = (value: OpenIdClientAuthentication): OpenIdClientAuthentication =>\n  value.method === \"none\"\n    ? { ...value }\n    : { ...value, secret: Redacted.make(Redacted.value(value.secret)) };\n\nconst copyRevocation = <\n  T extends\n    | OpenIdClientConnectedOAuthProvider<never>[\"revocation\"]\n    | ProviderConnectedOAuth<never>[\"revocation\"],\n>(\n  value: T,\n): T =>\n  value.mode === \"rfc7009\"\n    ? { ...value, authentication: copyAuth(value.authentication) }\n    : { ...value };\n\nexport type ConnectedProvider<R> =\n  | OpenIdClientConnectedOidcProvider\n  | (Omit<OpenIdClientConnectedOAuthProvider<R>, \"revocation\"> & {\n      readonly revocation:\n        | OpenIdClientConnectedOAuthProvider<R>[\"revocation\"]\n        | ProviderConnectedOAuth<R>[\"revocation\"];\n    });\n\nexport interface InstalledConnectedProvider<R> {\n  readonly provider: ConnectedProvider<R>;\n  readonly metadata: client.ServerMetadata;\n  readonly allowedUrls: ReadonlySet<string>;\n}\n\nconst metadataSchema = Schema.Struct({\n  issuer: OAuthIssuer,\n  authorization_endpoint: text(2048),\n  token_endpoint: text(2048),\n  jwks_uri: Schema.optionalKey(text(2048)),\n  revocation_endpoint: Schema.optionalKey(text(2048)),\n  code_challenge_methods_supported: Schema.optionalKey(\n    Schema.Array(text(64)).check(Schema.isMaxLength(64)),\n  ),\n  response_types_supported: Schema.optionalKey(\n    Schema.Array(text(64)).check(Schema.isMaxLength(64)),\n  ),\n  grant_types_supported: Schema.optionalKey(Schema.Array(text(128)).check(Schema.isMaxLength(64))),\n  id_token_signing_alg_values_supported: Schema.optionalKey(\n    Schema.Array(text(64)).check(Schema.isMaxLength(64)),\n  ),\n  token_endpoint_auth_methods_supported: Schema.optionalKey(\n    Schema.Array(text(64)).check(Schema.isMaxLength(64)),\n  ),\n  revocation_endpoint_auth_methods_supported: Schema.optionalKey(\n    Schema.Array(text(64)).check(Schema.isMaxLength(64)),\n  ),\n  authorization_response_iss_parameter_supported: Schema.optionalKey(Schema.Boolean),\n});\n\n/** The issuance flag selects new authorization only; retained profile content is immutable. */\nexport const sameConnectedProfile = (\n  registered: OAuthConnectedProfile,\n  saved: OAuthConnectedProfile,\n) =>\n  Schema.encodeSync(Schema.fromJsonString(OAuthConnectedProfile))({\n    ...registered,\n    issuance: saved.issuance,\n  }) === Schema.encodeSync(Schema.fromJsonString(OAuthConnectedProfile))(saved);\n\nexport const installConnectedConfigurations = Effect.fn(\n  \"OpenIdClient.installConnectedConfigurations\",\n)(function* <R>(input: ConnectedOptions<R>, providerCohort = false) {\n  const options = yield* Schema.decodeEffect(optionsSchema<R>(providerCohort))(input).pipe(\n    Effect.mapError(() => configurationError(\"provider\")),\n  );\n\n  const providers: ConnectedProvider<R>[] = yield* Effect.try({\n    try: () =>\n      options.providers.map((provider): ConnectedProvider<R> => {\n        const detached = {\n          authentication: copyAuth(provider.authentication),\n          callbacks: provider.callbacks.map((value) => ({ ...value })),\n          profiles: provider.profiles.map((value) =>\n            snapshotOAuthSync(OAuthConnectedProfile, value),\n          ),\n          ...(provider.authorizationParameters\n            ? { authorizationParameters: { ...provider.authorizationParameters } }\n            : {}),\n          ...(provider.tokenParameters ? { tokenParameters: { ...provider.tokenParameters } } : {}),\n          ...(provider.refreshParameters\n            ? { refreshParameters: { ...provider.refreshParameters } }\n            : {}),\n          refreshExpiry:\n            provider.refreshExpiry === \"unreported\"\n              ? provider.refreshExpiry\n              : { ...provider.refreshExpiry },\n        };\n\n        return provider.protocol === \"oidc\"\n          ? { ...provider, ...detached, revocation: copyRevocation(provider.revocation) }\n          : {\n              ...provider,\n              ...detached,\n              revocation: copyRevocation(provider.revocation),\n              identitySource: {\n                ...provider.identitySource,\n                ...(provider.identitySource.headers\n                  ? { headers: { ...provider.identitySource.headers } }\n                  : {}),\n              },\n            };\n      }),\n    catch: () => configurationError(\"provider\"),\n  });\n\n  const fetch: client.CustomFetch =\n    options.fetch ??\n    ((url, init) =>\n      globalThis.fetch(url, {\n        ...init,\n        body: init.body instanceof Uint8Array ? new Uint8Array(init.body) : init.body,\n      }));\n\n  yield* Effect.try({\n    try: () => {\n      const generations = new Set<string>(),\n        active = new Set<string>(),\n        aliases = new Map<string, string>(),\n        registrations = new Map<string, string>();\n\n      let profileCount = 0;\n\n      for (const provider of providers) {\n        const generationKey = tupleKey([provider.provider, provider.configurationGeneration]);\n\n        if (\n          generations.has(generationKey) ||\n          (provider.issuance === \"active\" && active.has(provider.provider))\n        )\n          throw configurationError(\"generation\");\n        generations.add(generationKey);\n        if (provider.issuance === \"active\") active.add(provider.provider);\n        const issuer = endpoint(provider.issuer);\n\n        if (provider.issuer.includes(\"?\")) throw configurationError(\"issuer\");\n\n        const aliasKey = tupleKey([issuer.href, provider.clientId]),\n          alias = tupleKey([provider.provider, provider.clientRegistrationId]);\n\n        if (aliases.has(aliasKey) && aliases.get(aliasKey) !== alias)\n          throw configurationError(\"provider\");\n        aliases.set(aliasKey, alias);\n\n        const registration = tupleKey([\n          provider.provider,\n          issuer.href,\n          provider.clientRegistrationId,\n        ]);\n\n        if (\n          registrations.has(registration) &&\n          registrations.get(registration) !== provider.clientId\n        )\n          throw configurationError(\"provider\");\n        registrations.set(registration, provider.clientId);\n        const callbacks = new Set<string>();\n\n        for (const callback of provider.callbacks) {\n          const url = endpoint(callback.redirectUri);\n\n          if (\n            callbacks.has(callback.callbackId) ||\n            callback.redirectUri.includes(\"?\") ||\n            url.href !== callback.redirectUri\n          )\n            throw configurationError(\"callback\");\n          callbacks.add(callback.callbackId);\n        }\n        for (const parameters of [\n          provider.authorizationParameters,\n          provider.tokenParameters,\n          provider.refreshParameters,\n        ])\n          for (const key of Object.keys(parameters ?? {}))\n            if (reserved.has(key.toLowerCase())) throw configurationError(\"parameters\");\n\n        const profiles = new Set<string>(),\n          activeProfiles = new Set<string>();\n\n        for (const profile of provider.profiles) {\n          if (++profileCount > 64) throw configurationError(\"provider\");\n          const key = tupleKey([profile.key, profile.generation]);\n\n          if (\n            profiles.has(key) ||\n            (profile.issuance === \"active\" && activeProfiles.has(profile.key)) ||\n            profile.provider !== provider.provider ||\n            profile.clientRegistrationId !== provider.clientRegistrationId ||\n            new Set(profile.scopes).size !== profile.scopes.length ||\n            new Set(profile.resources).size !== profile.resources.length ||\n            profile.refreshAheadMillis >= profile.maximumAccessLifetimeMillis ||\n            (provider.protocol === \"oidc\" && !profile.scopes.includes(\"openid\")) ||\n            (provider.resourceIndicators === \"unsupported\" && profile.resources.length !== 0) ||\n            (profile.retention === \"access-only\" && profile.refresh !== \"unsupported\") ||\n            (profile.retention === \"access-and-refresh\" &&\n              (profile.refresh === \"unsupported\" ||\n                profile.maximumRefreshLifetimeMillis === undefined ||\n                (provider.authentication.method === \"none\" && profile.refresh !== \"rotating\"))) ||\n            (profile.revocation === \"cohort\" &&\n              (provider.revocation.mode === \"unsupported\" ||\n                (provider.revocation.mode === \"rfc7009\" &&\n                  profile.retention === \"access-and-refresh\" &&\n                  provider.revocation.tokenTypes !== \"access-and-refresh\")))\n          )\n            throw configurationError(\"provider\");\n          profiles.add(key);\n          if (profile.issuance === \"active\") activeProfiles.add(profile.key);\n          for (const resource of profile.resources) {\n            const uri = new URL(resource);\n\n            if (\n              resource.includes(\"#\") ||\n              // oxlint-disable-next-line no-control-regex -- Preserve exact resource URIs and reject ambiguous control characters.\n              /[\\s\\\\\\u0000-\\u001f\\u007f]/u.test(resource) ||\n              uri.username !== \"\" ||\n              uri.password !== \"\"\n            )\n              throw configurationError(\"parameters\");\n          }\n        }\n        if (provider.protocol === \"oauth\") {\n          endpoint(provider.authorizationEndpoint);\n          endpoint(provider.tokenEndpoint);\n          endpoint(provider.identitySource.url);\n          const headers = new Set<string>();\n\n          for (const [name, value] of Object.entries(provider.identitySource.headers ?? {})) {\n            const lower = name.toLowerCase();\n\n            if (forbiddenHeaders.has(lower) || headers.has(lower) || /[\\r\\n]/u.test(value))\n              throw configurationError(\"identity-source\");\n            headers.add(lower);\n          }\n        }\n        if (provider.revocation.mode === \"rfc7009\") {\n          if (provider.protocol === \"oauth\" && provider.revocation.endpoint === undefined)\n            throw configurationError(\"metadata\");\n          if (provider.revocation.endpoint) endpoint(provider.revocation.endpoint);\n        }\n        freezeOAuth(provider);\n      }\n    },\n    catch: (error) =>\n      Schema.is(OpenIdClientConfigurationError)(error) ? error : configurationError(\"provider\"),\n  });\n  const installed: InstalledConnectedProvider<R>[] = [];\n\n  for (const provider of providers) {\n    let raw: client.ServerMetadata;\n\n    if (provider.protocol === \"oidc\") {\n      const discovery = new URL(provider.issuer);\n\n      discovery.pathname = `${discovery.pathname.replace(/\\/$/u, \"\")}/.well-known/openid-configuration`;\n\n      const configuration = yield* Effect.tryPromise({\n        try: (signal) =>\n          client.discovery(\n            new URL(provider.issuer),\n            provider.clientId,\n            {\n              id_token_signed_response_alg: \"RS256\",\n              [client.clockSkew]: 0,\n              [client.clockTolerance]: 0,\n            },\n            clientAuthentication(provider.authentication),\n            {\n              timeout: options.timeoutSeconds,\n              execute: [client.enableNonRepudiationChecks],\n              [client.customFetch]: boundedFetch(fetch, signal, new Set([discovery.href])),\n            },\n          ),\n        catch: () => OAuthUnavailable.make({}),\n      });\n\n      raw = configuration.serverMetadata();\n    } else\n      raw = {\n        issuer: provider.issuer,\n        authorization_endpoint: provider.authorizationEndpoint,\n        token_endpoint: provider.tokenEndpoint,\n        authorization_response_iss_parameter_supported: provider.responseIssuerMode === \"required\",\n        ...(provider.revocation.mode === \"rfc7009\"\n          ? { revocation_endpoint: provider.revocation.endpoint }\n          : {}),\n      };\n\n    // oxlint-disable-next-line no-restricted-properties -- Validate foreign discovery metadata at this adapter's bounded boundary.\n    const metadata = yield* Schema.decodeUnknownEffect(metadataSchema)(raw).pipe(\n      Effect.mapError(() => configurationError(\"metadata\")),\n    );\n\n    const allowedUrls = yield* Effect.try({\n      try: () => {\n        if (metadata.issuer !== provider.issuer) throw configurationError(\"issuer\");\n        if (\n          (metadata.authorization_response_iss_parameter_supported === true) !==\n          (provider.responseIssuerMode === \"required\")\n        )\n          throw configurationError(\"metadata\");\n        const authorization = endpoint(metadata.authorization_endpoint);\n\n        for (const key of authorization.searchParams.keys())\n          if (reserved.has(key.toLowerCase())) throw configurationError(\"parameters\");\n        const token = endpoint(metadata.token_endpoint);\n\n        for (const key of token.searchParams.keys())\n          if (reserved.has(key.toLowerCase())) throw configurationError(\"parameters\");\n        const urls = new Set([token.href]);\n\n        const tokenAuthentication =\n          metadata.token_endpoint_auth_methods_supported ??\n          (provider.protocol === \"oidc\" ? [\"client_secret_basic\"] : undefined);\n\n        if (tokenAuthentication && !tokenAuthentication.includes(provider.authentication.method))\n          throw configurationError(\"authentication\");\n        if (provider.protocol === \"oidc\") {\n          if (\n            !metadata.code_challenge_methods_supported?.includes(\"S256\") ||\n            !metadata.response_types_supported?.includes(\"code\") ||\n            !metadata.id_token_signing_alg_values_supported?.includes(\"RS256\") ||\n            metadata.jwks_uri === undefined ||\n            (provider.profiles.some((profile) => profile.retention === \"access-and-refresh\") &&\n              !metadata.grant_types_supported?.includes(\"refresh_token\"))\n          )\n            throw configurationError(\"metadata\");\n          urls.add(endpoint(metadata.jwks_uri).href);\n        } else urls.add(endpoint(provider.identitySource.url).href);\n        if (provider.revocation.mode === \"rfc7009\") {\n          if (\n            !metadata.revocation_endpoint ||\n            (provider.revocation.endpoint !== undefined &&\n              provider.revocation.endpoint !== metadata.revocation_endpoint)\n          )\n            throw configurationError(\"metadata\");\n\n          const auth =\n            metadata.revocation_endpoint_auth_methods_supported ??\n            (provider.protocol === \"oidc\" ? [\"client_secret_basic\"] : undefined);\n\n          if (auth && !auth.includes(provider.revocation.authentication.method))\n            throw configurationError(\"authentication\");\n          const revoke = endpoint(metadata.revocation_endpoint);\n\n          for (const key of revoke.searchParams.keys())\n            if (reserved.has(key.toLowerCase())) throw configurationError(\"parameters\");\n          urls.add(revoke.href);\n        }\n\n        return urls;\n      },\n      catch: (error) =>\n        Schema.is(OpenIdClientConfigurationError)(error) ? error : configurationError(\"metadata\"),\n    });\n\n    const serverMetadata: client.ServerMetadata = {\n      ...metadata,\n      code_challenge_methods_supported: metadata.code_challenge_methods_supported?.slice(),\n      response_types_supported: metadata.response_types_supported?.slice(),\n      grant_types_supported: metadata.grant_types_supported?.slice(),\n      id_token_signing_alg_values_supported:\n        metadata.id_token_signing_alg_values_supported?.slice(),\n      token_endpoint_auth_methods_supported:\n        metadata.token_endpoint_auth_methods_supported?.slice(),\n      revocation_endpoint_auth_methods_supported:\n        metadata.revocation_endpoint_auth_methods_supported?.slice(),\n    };\n\n    freezeOAuth(serverMetadata);\n    installed.push({ provider, metadata: serverMetadata, allowedUrls });\n  }\n\n  return { installed, fetch, timeoutSeconds: options.timeoutSeconds };\n});\n"],"mappings":";;;;;;;;;;;AAsBA,MAAM,QAAQ,YAAoB,OAAO,eAAe,MAAM,OAAO,YAAY,OAAO,CAAC;AAEzF,MAAM,SAAS,OAAO,OACpB,OAAO,OAAO,MAAM,OAAO,UAAU,iCAAiC,CAAC,GACvE,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC,CAC9C,CAAC,CAAC,MAAM,OAAO,YAAY,UAAU,OAAO,KAAK,KAAK,CAAC,CAAC,UAAU,EAAE,CAAC;AAErE,MAAM,iBAAiB,OAAO,MAAM;CAClC,OAAO,OAAO;EACZ,QAAQ,OAAO,QAAQ,qBAAqB;EAC5C,QAAQ,OAAO,kBAAkB,KAAK,IAAI,CAAC;CAC7C,CAAC;CACD,OAAO,OAAO;EACZ,QAAQ,OAAO,QAAQ,oBAAoB;EAC3C,QAAQ,OAAO,kBAAkB,KAAK,IAAI,CAAC;CAC7C,CAAC;CACD,OAAO,OAAO;EAAE,QAAQ,OAAO,QAAQ,MAAM;EAAG,cAAc,OAAO,QAAQ,IAAI;CAAE,CAAC;AACtF,CAAC;AAED,MAAM,SAAS;CACb,UAAU;CACV,yBAAyB;CACzB,UAAU,OAAO,SAAS,CAAC,UAAU,SAAS,CAAC;CAC/C,QAAQ;CACR,oBAAoB,OAAO,SAAS,CAAC,YAAY,aAAa,CAAC;CAC/D,UAAU,KAAK,IAAI;CACnB;CACA,WAAW,OAAO,MAChB,OAAO,OAAO;EAAE,YAAY;EAAiB,aAAa;CAAiB,CAAC,CAC9E,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,EAAE,CAAC;CACrD,yBAAyB,OAAO,YAAY,MAAM;CAClD,iBAAiB,OAAO,YAAY,MAAM;CAC1C,mBAAmB,OAAO,YAAY,MAAM;CAC5C,sBAAsB,sBAAsB,OAAO;CACnD,UAAU,OAAO,MAAM,qBAAqB,CAAC,CAAC,MAC5C,OAAO,YAAY,CAAC,GACpB,OAAO,YAAY,EAAE,CACvB;CACA,oBAAoB,OAAO,SAAS,CAAC,eAAe,SAAS,CAAC;CAC9D,eAAe,OAAO,MAAM,CAC1B,OAAO,QAAQ,YAAY,GAC3B,OAAO,OAAO;EACZ,OAAO,OAAO,SAAS,CAAC,sBAAsB,0BAA0B,CAAC;EACzE,MAAM,OAAO,SAAS,CAAC,cAAc,SAAS,CAAC;CACjD,CAAC,CACH,CAAC;CACD,YAAY,OAAO,MAAM,CACvB,OAAO,OAAO,EAAE,MAAM,OAAO,QAAQ,aAAa,EAAE,CAAC,GACrD,OAAO,OAAO;EACZ,MAAM,OAAO,QAAQ,SAAS;EAC9B,OAAO,OAAO,QAAQ,QAAQ;EAC9B,YAAY,OAAO,SAAS,CAAC,UAAU,oBAAoB,CAAC;EAC5D;EACA,UAAU,OAAO,YAAY,KAAK,IAAI,CAAC;CACzC,CAAC,CACH,CAAC;AACH;AAEA,MAAM,iBAAoB,mBACxB,OAAO,OACL,OAAO,OAAO;CACZ,WAAW,OAAO,MAChB,OAAO,MAAM,CACX,OAAO,OAAO;EACZ,GAAG;EACH,UAAU,OAAO,QAAQ,MAAM;EAC/B,0BAA0B,OAAO,QAAQ,OAAO;EAChD,eAAe,OAAO,YACpB,OAAO,IAAI,MAAM,OAAO,UAAU;GAAE,SAAS;GAAG,SAAS;EAAM,CAAC,CAAC,CACnE;CACF,CAAC,GACD,OAAO,OAAO;EACZ,GAAG;EACH,YAAY,iBACR,OAAO,MAAM,CACX,OAAO,YACP,OAAO,OAAO,EAAE,MAAM,OAAO,QAAQ,iBAAiB,EAAE,CAAC,CAC3D,CAAC,IACD,OAAO;EACX,UAAU,OAAO,QAAQ,OAAO;EAChC,uBAAuB,KAAK,IAAI;EAChC,eAAe,KAAK,IAAI;EACxB,UAAU,OAAO,QAAQ,IAAI;EAC7B,gBAAgB,OAAO,OAAO;GAC5B,KAAK,KAAK,IAAI;GACd,SAAS,OAAO,YAAY,MAAM;GAClC,gBAAgB,OAAO,SAInB,UAEA,UAAU,WAAW,KAAK,CAC9B;EACF,CAAC;CACH,CAAC,CACH,CAAC,CACH,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,EAAE,CAAC;CACrD,gBAAgB,OAAO,OAAO,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAG,CAAC,CAAC;CACjF,OAAO,OAAO,YACZ,OAAO,SAA6B,UAClC,UAAU,WAAW,KAAK,CAC5B,CACF;AACF,CAAC,CACH;AAEF,MAAM,2BAAW,IAAI,IAAI;CACvB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAGD,MAAM,YAAY,WAA2C,KAAK,UAAU,MAAM;AAElF,MAAM,mCAAmB,IAAI,IAAI;CAC/B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,MAAM,sBAAsB,WAC1B,+BAA+B,KAAK,EAAE,OAAO,CAAC;AAEhD,MAAM,YAAY,UAChB,MAAM,WAAW,SACb,EAAE,GAAG,MAAM,IACX;CAAE,GAAG;CAAO,QAAQ,SAAS,KAAK,SAAS,MAAM,MAAM,MAAM,CAAC;AAAE;AAEtE,MAAM,kBAKJ,UAEA,MAAM,SAAS,YACX;CAAE,GAAG;CAAO,gBAAgB,SAAS,MAAM,cAAc;AAAE,IAC3D,EAAE,GAAG,MAAM;AAgBjB,MAAM,iBAAiB,OAAO,OAAO;CACnC,QAAQ;CACR,wBAAwB,KAAK,IAAI;CACjC,gBAAgB,KAAK,IAAI;CACzB,UAAU,OAAO,YAAY,KAAK,IAAI,CAAC;CACvC,qBAAqB,OAAO,YAAY,KAAK,IAAI,CAAC;CAClD,kCAAkC,OAAO,YACvC,OAAO,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC,CACrD;CACA,0BAA0B,OAAO,YAC/B,OAAO,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC,CACrD;CACA,uBAAuB,OAAO,YAAY,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC,CAAC;CAC/F,uCAAuC,OAAO,YAC5C,OAAO,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC,CACrD;CACA,uCAAuC,OAAO,YAC5C,OAAO,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC,CACrD;CACA,4CAA4C,OAAO,YACjD,OAAO,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC,CACrD;CACA,gDAAgD,OAAO,YAAY,OAAO,OAAO;AACnF,CAAC;;AAGD,MAAa,wBACX,YACA,UAEA,OAAO,WAAW,OAAO,eAAe,qBAAqB,CAAC,CAAC,CAAC;CAC9D,GAAG;CACH,UAAU,MAAM;AAClB,CAAC,MAAM,OAAO,WAAW,OAAO,eAAe,qBAAqB,CAAC,CAAC,CAAC,KAAK;AAE9E,MAAa,iCAAiC,OAAO,GACnD,6CACF,CAAC,CAAC,WAAc,OAA4B,iBAAiB,OAAO;CAClE,MAAM,UAAU,OAAO,OAAO,aAAa,cAAiB,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAClF,OAAO,eAAe,mBAAmB,UAAU,CAAC,CACtD;CAEA,MAAM,YAAoC,OAAO,OAAO,IAAI;EAC1D,WACE,QAAQ,UAAU,KAAK,aAAmC;GACxD,MAAM,WAAW;IACf,gBAAgB,SAAS,SAAS,cAAc;IAChD,WAAW,SAAS,UAAU,KAAK,WAAW,EAAE,GAAG,MAAM,EAAE;IAC3D,UAAU,SAAS,SAAS,KAAK,UAC/B,kBAAkB,uBAAuB,KAAK,CAChD;IACA,GAAI,SAAS,0BACT,EAAE,yBAAyB,EAAE,GAAG,SAAS,wBAAwB,EAAE,IACnE,CAAC;IACL,GAAI,SAAS,kBAAkB,EAAE,iBAAiB,EAAE,GAAG,SAAS,gBAAgB,EAAE,IAAI,CAAC;IACvF,GAAI,SAAS,oBACT,EAAE,mBAAmB,EAAE,GAAG,SAAS,kBAAkB,EAAE,IACvD,CAAC;IACL,eACE,SAAS,kBAAkB,eACvB,SAAS,gBACT,EAAE,GAAG,SAAS,cAAc;GACpC;GAEA,OAAO,SAAS,aAAa,SACzB;IAAE,GAAG;IAAU,GAAG;IAAU,YAAY,eAAe,SAAS,UAAU;GAAE,IAC5E;IACE,GAAG;IACH,GAAG;IACH,YAAY,eAAe,SAAS,UAAU;IAC9C,gBAAgB;KACd,GAAG,SAAS;KACZ,GAAI,SAAS,eAAe,UACxB,EAAE,SAAS,EAAE,GAAG,SAAS,eAAe,QAAQ,EAAE,IAClD,CAAC;IACP;GACF;EACN,CAAC;EACH,aAAa,mBAAmB,UAAU;CAC5C,CAAC;CAED,MAAM,QACJ,QAAQ,WACN,KAAK,SACL,WAAW,MAAM,KAAK;EACpB,GAAG;EACH,MAAM,KAAK,gBAAgB,aAAa,IAAI,WAAW,KAAK,IAAI,IAAI,KAAK;CAC3E,CAAC;CAEL,OAAO,OAAO,IAAI;EAChB,WAAW;GACT,MAAM,8BAAc,IAAI,IAAY,GAClC,yBAAS,IAAI,IAAY,GACzB,0BAAU,IAAI,IAAoB,GAClC,gCAAgB,IAAI,IAAoB;GAE1C,IAAI,eAAe;GAEnB,KAAK,MAAM,YAAY,WAAW;IAChC,MAAM,gBAAgB,SAAS,CAAC,SAAS,UAAU,SAAS,uBAAuB,CAAC;IAEpF,IACE,YAAY,IAAI,aAAa,KAC5B,SAAS,aAAa,YAAY,OAAO,IAAI,SAAS,QAAQ,GAE/D,MAAM,mBAAmB,YAAY;IACvC,YAAY,IAAI,aAAa;IAC7B,IAAI,SAAS,aAAa,UAAU,OAAO,IAAI,SAAS,QAAQ;IAChE,MAAM,SAAS,SAAS,SAAS,MAAM;IAEvC,IAAI,SAAS,OAAO,SAAS,GAAG,GAAG,MAAM,mBAAmB,QAAQ;IAEpE,MAAM,WAAW,SAAS,CAAC,OAAO,MAAM,SAAS,QAAQ,CAAC,GACxD,QAAQ,SAAS,CAAC,SAAS,UAAU,SAAS,oBAAoB,CAAC;IAErE,IAAI,QAAQ,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,MAAM,OACrD,MAAM,mBAAmB,UAAU;IACrC,QAAQ,IAAI,UAAU,KAAK;IAE3B,MAAM,eAAe,SAAS;KAC5B,SAAS;KACT,OAAO;KACP,SAAS;IACX,CAAC;IAED,IACE,cAAc,IAAI,YAAY,KAC9B,cAAc,IAAI,YAAY,MAAM,SAAS,UAE7C,MAAM,mBAAmB,UAAU;IACrC,cAAc,IAAI,cAAc,SAAS,QAAQ;IACjD,MAAM,4BAAY,IAAI,IAAY;IAElC,KAAK,MAAM,YAAY,SAAS,WAAW;KACzC,MAAM,MAAM,SAAS,SAAS,WAAW;KAEzC,IACE,UAAU,IAAI,SAAS,UAAU,KACjC,SAAS,YAAY,SAAS,GAAG,KACjC,IAAI,SAAS,SAAS,aAEtB,MAAM,mBAAmB,UAAU;KACrC,UAAU,IAAI,SAAS,UAAU;IACnC;IACA,KAAK,MAAM,cAAc;KACvB,SAAS;KACT,SAAS;KACT,SAAS;IACX,GACE,KAAK,MAAM,OAAO,OAAO,KAAK,cAAc,CAAC,CAAC,GAC5C,IAAI,SAAS,IAAI,IAAI,YAAY,CAAC,GAAG,MAAM,mBAAmB,YAAY;IAE9E,MAAM,2BAAW,IAAI,IAAY,GAC/B,iCAAiB,IAAI,IAAY;IAEnC,KAAK,MAAM,WAAW,SAAS,UAAU;KACvC,IAAI,EAAE,eAAe,IAAI,MAAM,mBAAmB,UAAU;KAC5D,MAAM,MAAM,SAAS,CAAC,QAAQ,KAAK,QAAQ,UAAU,CAAC;KAEtD,IACE,SAAS,IAAI,GAAG,KACf,QAAQ,aAAa,YAAY,eAAe,IAAI,QAAQ,GAAG,KAChE,QAAQ,aAAa,SAAS,YAC9B,QAAQ,yBAAyB,SAAS,wBAC1C,IAAI,IAAI,QAAQ,MAAM,CAAC,CAAC,SAAS,QAAQ,OAAO,UAChD,IAAI,IAAI,QAAQ,SAAS,CAAC,CAAC,SAAS,QAAQ,UAAU,UACtD,QAAQ,sBAAsB,QAAQ,+BACrC,SAAS,aAAa,UAAU,CAAC,QAAQ,OAAO,SAAS,QAAQ,KACjE,SAAS,uBAAuB,iBAAiB,QAAQ,UAAU,WAAW,KAC9E,QAAQ,cAAc,iBAAiB,QAAQ,YAAY,iBAC3D,QAAQ,cAAc,yBACpB,QAAQ,YAAY,iBACnB,QAAQ,iCAAiC,KAAA,KACxC,SAAS,eAAe,WAAW,UAAU,QAAQ,YAAY,eACrE,QAAQ,eAAe,aACrB,SAAS,WAAW,SAAS,iBAC3B,SAAS,WAAW,SAAS,aAC5B,QAAQ,cAAc,wBACtB,SAAS,WAAW,eAAe,uBAEzC,MAAM,mBAAmB,UAAU;KACrC,SAAS,IAAI,GAAG;KAChB,IAAI,QAAQ,aAAa,UAAU,eAAe,IAAI,QAAQ,GAAG;KACjE,KAAK,MAAM,YAAY,QAAQ,WAAW;MACxC,MAAM,MAAM,IAAI,IAAI,QAAQ;MAE5B,IACE,SAAS,SAAS,GAAG,KAErB,6BAA6B,KAAK,QAAQ,KAC1C,IAAI,aAAa,MACjB,IAAI,aAAa,IAEjB,MAAM,mBAAmB,YAAY;KACzC;IACF;IACA,IAAI,SAAS,aAAa,SAAS;KACjC,SAAS,SAAS,qBAAqB;KACvC,SAAS,SAAS,aAAa;KAC/B,SAAS,SAAS,eAAe,GAAG;KACpC,MAAM,0BAAU,IAAI,IAAY;KAEhC,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,SAAS,eAAe,WAAW,CAAC,CAAC,GAAG;MACjF,MAAM,QAAQ,KAAK,YAAY;MAE/B,IAAI,iBAAiB,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,UAAU,KAAK,KAAK,GAC3E,MAAM,mBAAmB,iBAAiB;MAC5C,QAAQ,IAAI,KAAK;KACnB;IACF;IACA,IAAI,SAAS,WAAW,SAAS,WAAW;KAC1C,IAAI,SAAS,aAAa,WAAW,SAAS,WAAW,aAAa,KAAA,GACpE,MAAM,mBAAmB,UAAU;KACrC,IAAI,SAAS,WAAW,UAAU,SAAS,SAAS,WAAW,QAAQ;IACzE;IACA,YAAY,QAAQ;GACtB;EACF;EACA,QAAQ,UACN,OAAO,GAAG,8BAA8B,CAAC,CAAC,KAAK,IAAI,QAAQ,mBAAmB,UAAU;CAC5F,CAAC;CACD,MAAM,YAA6C,CAAC;CAEpD,KAAK,MAAM,YAAY,WAAW;EAChC,IAAI;EAEJ,IAAI,SAAS,aAAa,QAAQ;GAChC,MAAM,YAAY,IAAI,IAAI,SAAS,MAAM;GAEzC,UAAU,WAAW,GAAG,UAAU,SAAS,QAAQ,QAAQ,EAAE,EAAE;GAsB/D,OAAM,OApBuB,OAAO,WAAW;IAC7C,MAAM,WACJ,OAAO,UACL,IAAI,IAAI,SAAS,MAAM,GACvB,SAAS,UACT;KACE,8BAA8B;MAC7B,OAAO,YAAY;MACnB,OAAO,iBAAiB;IAC3B,GACA,qBAAqB,SAAS,cAAc,GAC5C;KACE,SAAS,QAAQ;KACjB,SAAS,CAAC,OAAO,0BAA0B;MAC1C,OAAO,cAAc,aAAa,OAAO,wBAAQ,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC;IAC7E,CACF;IACF,aAAa,iBAAiB,KAAK,CAAC,CAAC;GACvC,CAAC,EAAA,CAEmB,eAAe;EACrC,OACE,MAAM;GACJ,QAAQ,SAAS;GACjB,wBAAwB,SAAS;GACjC,gBAAgB,SAAS;GACzB,gDAAgD,SAAS,uBAAuB;GAChF,GAAI,SAAS,WAAW,SAAS,YAC7B,EAAE,qBAAqB,SAAS,WAAW,SAAS,IACpD,CAAC;EACP;EAGF,MAAM,WAAW,OAAO,OAAO,oBAAoB,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,KACtE,OAAO,eAAe,mBAAmB,UAAU,CAAC,CACtD;EAEA,MAAM,cAAc,OAAO,OAAO,IAAI;GACpC,WAAW;IACT,IAAI,SAAS,WAAW,SAAS,QAAQ,MAAM,mBAAmB,QAAQ;IAC1E,IACG,SAAS,mDAAmD,UAC5D,SAAS,uBAAuB,aAEjC,MAAM,mBAAmB,UAAU;IACrC,MAAM,gBAAgB,SAAS,SAAS,sBAAsB;IAE9D,KAAK,MAAM,OAAO,cAAc,aAAa,KAAK,GAChD,IAAI,SAAS,IAAI,IAAI,YAAY,CAAC,GAAG,MAAM,mBAAmB,YAAY;IAC5E,MAAM,QAAQ,SAAS,SAAS,cAAc;IAE9C,KAAK,MAAM,OAAO,MAAM,aAAa,KAAK,GACxC,IAAI,SAAS,IAAI,IAAI,YAAY,CAAC,GAAG,MAAM,mBAAmB,YAAY;IAC5E,MAAM,uBAAO,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC;IAEjC,MAAM,sBACJ,SAAS,0CACR,SAAS,aAAa,SAAS,CAAC,qBAAqB,IAAI,KAAA;IAE5D,IAAI,uBAAuB,CAAC,oBAAoB,SAAS,SAAS,eAAe,MAAM,GACrF,MAAM,mBAAmB,gBAAgB;IAC3C,IAAI,SAAS,aAAa,QAAQ;KAChC,IACE,CAAC,SAAS,kCAAkC,SAAS,MAAM,KAC3D,CAAC,SAAS,0BAA0B,SAAS,MAAM,KACnD,CAAC,SAAS,uCAAuC,SAAS,OAAO,KACjE,SAAS,aAAa,KAAA,KACrB,SAAS,SAAS,MAAM,YAAY,QAAQ,cAAc,oBAAoB,KAC7E,CAAC,SAAS,uBAAuB,SAAS,eAAe,GAE3D,MAAM,mBAAmB,UAAU;KACrC,KAAK,IAAI,SAAS,SAAS,QAAQ,CAAC,CAAC,IAAI;IAC3C,OAAO,KAAK,IAAI,SAAS,SAAS,eAAe,GAAG,CAAC,CAAC,IAAI;IAC1D,IAAI,SAAS,WAAW,SAAS,WAAW;KAC1C,IACE,CAAC,SAAS,uBACT,SAAS,WAAW,aAAa,KAAA,KAChC,SAAS,WAAW,aAAa,SAAS,qBAE5C,MAAM,mBAAmB,UAAU;KAErC,MAAM,OACJ,SAAS,+CACR,SAAS,aAAa,SAAS,CAAC,qBAAqB,IAAI,KAAA;KAE5D,IAAI,QAAQ,CAAC,KAAK,SAAS,SAAS,WAAW,eAAe,MAAM,GAClE,MAAM,mBAAmB,gBAAgB;KAC3C,MAAM,SAAS,SAAS,SAAS,mBAAmB;KAEpD,KAAK,MAAM,OAAO,OAAO,aAAa,KAAK,GACzC,IAAI,SAAS,IAAI,IAAI,YAAY,CAAC,GAAG,MAAM,mBAAmB,YAAY;KAC5E,KAAK,IAAI,OAAO,IAAI;IACtB;IAEA,OAAO;GACT;GACA,QAAQ,UACN,OAAO,GAAG,8BAA8B,CAAC,CAAC,KAAK,IAAI,QAAQ,mBAAmB,UAAU;EAC5F,CAAC;EAED,MAAM,iBAAwC;GAC5C,GAAG;GACH,kCAAkC,SAAS,kCAAkC,MAAM;GACnF,0BAA0B,SAAS,0BAA0B,MAAM;GACnE,uBAAuB,SAAS,uBAAuB,MAAM;GAC7D,uCACE,SAAS,uCAAuC,MAAM;GACxD,uCACE,SAAS,uCAAuC,MAAM;GACxD,4CACE,SAAS,4CAA4C,MAAM;EAC/D;EAEA,YAAY,cAAc;EAC1B,UAAU,KAAK;GAAE;GAAU,UAAU;GAAgB;EAAY,CAAC;CACpE;CAEA,OAAO;EAAE;EAAW;EAAO,gBAAgB,QAAQ;CAAe;AACpE,CAAC"}

package/dist/oauth/openid-client/connected/models.d.mts

@@ -0,0 +1,42 @@
+import { OAuthConnectedProfile } from "../../connectedModels.mjs";
+import { OpenIdClientAuthentication, OpenIdClientConfigurationError, OpenIdClientOAuthProvider, OpenIdClientOidcProvider, PlainOAuthIdentity } from "../models.mjs";
+import { CustomFetch } from "openid-client";
+//#region src/oauth/openid-client/connected/models.d.ts
+type OpenIdClientConnectedRevocation = {
+  readonly mode: "unsupported";
+} | {
+  readonly mode: "rfc7009";
+  /** Verified provider effects stay within the stable connected cohort.
+   * This does not promise remote erasure of all sibling tokens. */
+  readonly scope: "cohort";
+  readonly tokenTypes: "access" | "access-and-refresh";
+  readonly authentication: OpenIdClientAuthentication;
+  /** Required for plain OAuth; OIDC overrides must equal discovery exactly. */
+  readonly endpoint?: string;
+};
+type OpenIdClientConnectedRefreshExpiry = "unreported" | {
+  readonly field: "refresh_expires_in" | "refresh_token_expires_in";
+  readonly zero: "unreported" | "expired";
+};
+interface ConnectedProvider {
+  readonly clientRegistrationId: OAuthConnectedProfile["clientRegistrationId"];
+  readonly profiles: ReadonlyArray<OAuthConnectedProfile>;
+  /** Explicit issuer issuance contract. Values are declared grant targets,
+   * not proof of an opaque access token's audience. */
+  readonly resourceIndicators: "unsupported" | "rfc8707";
+  readonly refreshParameters?: Readonly<Record<string, string>>;
+  readonly refreshExpiry: OpenIdClientConnectedRefreshExpiry;
+  readonly revocation: OpenIdClientConnectedRevocation;
+}
+interface OpenIdClientConnectedOidcProvider extends Omit<OpenIdClientOidcProvider, "scopes">, ConnectedProvider {}
+interface OpenIdClientConnectedOAuthProvider<R = never> extends Omit<OpenIdClientOAuthProvider<R>, "scopes">, ConnectedProvider {}
+interface OpenIdClientConnectedProtocolOptions<R = never> {
+  readonly providers: ReadonlyArray<OpenIdClientConnectedOidcProvider | OpenIdClientConnectedOAuthProvider<R>>;
+  readonly timeoutSeconds: number;
+  /** Trusted server transport: honor abort, preserve endpoint authority, never
+   * retry a token request or log credentials. */
+  readonly fetch?: CustomFetch;
+}
+//#endregion
+export { OpenIdClientConnectedOAuthProvider, OpenIdClientConnectedOidcProvider, OpenIdClientConnectedProtocolOptions, OpenIdClientConnectedRefreshExpiry, OpenIdClientConnectedRevocation };
+//# sourceMappingURL=models.d.mts.map

package/dist/oauth/openid-client/connected/protocol.d.mts

@@ -0,0 +1,16 @@
+import "../../../operations/requestBinding.mjs";
+import { OAuthUnavailable } from "../../signInErrors.mjs";
+import "../../signInModels.mjs";
+import "../../connectedModels.mjs";
+import { OAuthConnectedProtocol } from "../../OAuthConnectedProtocol.mjs";
+import { OpenIdClientConfigurationError } from "../models.mjs";
+import { OpenIdClientConnectedProtocolOptions } from "./models.mjs";
+import "../compatibility.mjs";
+import "../ProviderRevocation.mjs";
+import { DateTime, Effect, Layer } from "effect";
+//#region src/oauth/openid-client/connected/protocol.d.ts
+declare const makeOpenIdClientConnectedProtocol: <R = never>(options: OpenIdClientConnectedProtocolOptions<R>) => Effect.Effect<OAuthConnectedProtocol["Service"], OpenIdClientConfigurationError | OAuthUnavailable, R>;
+declare const openIdClientConnectedProtocolLayer: <R = never>(options: OpenIdClientConnectedProtocolOptions<R>) => Layer.Layer<OAuthConnectedProtocol, OAuthUnavailable | OpenIdClientConfigurationError, Exclude<R, import("effect/Scope").Scope>>;
+//#endregion
+export { makeOpenIdClientConnectedProtocol, openIdClientConnectedProtocolLayer };
+//# sourceMappingURL=protocol.d.mts.map