@yielded/auth 0.1.0-beta.1

package/dist/oauth/openid-client/connected/protocol.mjs

@@ -0,0 +1,402 @@
+import { reportAuthFailure } from "../../../internal/diagnostics.mjs";
+import { RequestBindingFlowId } from "../../../operations/requestBindingModels.mjs";
+import { OAuthCallbackId, OAuthCodeResponse, OAuthDisplayProfile, OAuthExternalIdentity, OAuthInstant, OAuthProtocolPreparation, OAuthTransactionSecrets } from "../../signInModels.mjs";
+import { OAuthProtocolRejected, OAuthUnavailable } from "../../signInErrors.mjs";
+import { snapshotOAuth } from "../../signInSnapshot.mjs";
+import { OAuthConnectedConfiguration, OAuthConnectedGrantResponse, OAuthConnectedProfile, OAuthConnectedScopes, OAuthConnectedTokenContext, OAuthConnectedTokenMaterial } from "../../connectedModels.mjs";
+import { OAuthConnectedProtocol } from "../../OAuthConnectedProtocol.mjs";
+import { DefiniteTokenRejection } from "../compatibility.mjs";
+import { boundedFetch } from "../transport.mjs";
+import { clientAuthentication } from "../configuration.mjs";
+import { ProviderRevocation } from "../ProviderRevocation.mjs";
+import { installConnectedConfigurations, sameConnectedProfile } from "./configuration.mjs";
+import { Cause, DateTime, Effect, Layer, Redacted, Schema } from "effect";
+import * as client from "openid-client";
+//#region src/oauth/openid-client/connected/protocol.ts
+const unavailable = () => OAuthUnavailable.make({});
+const rejected = () => OAuthProtocolRejected.make({});
+const safe = (effect) => effect.pipe(Effect.tapCause((cause) => Cause.hasDies(cause) ? reportAuthFailure("oauth-protocol", cause) : Effect.void), Effect.catchCause((cause) => {
+	if (Cause.hasInterrupts(cause)) return Effect.interrupt;
+	return Cause.hasDies(cause) ? Effect.fail(unavailable()) : Effect.failCause(cause);
+}));
+/** After possible transmission, validation/transport failures remain ambiguous. */
+const grantError = (error) => error instanceof DefiniteTokenRejection || error instanceof client.ClientError && error.cause instanceof DefiniteTokenRejection || error instanceof client.ResponseBodyError && error.status === 400 && error.error === "invalid_grant" ? rejected() : unavailable();
+const prepareInput = Schema.Struct({
+	profile: OAuthConnectedProfile,
+	callbackId: OAuthCallbackId,
+	flowId: RequestBindingFlowId
+});
+const prepareOutput = Schema.Struct({
+	...OAuthProtocolPreparation.fields,
+	configuration: OAuthConnectedConfiguration
+});
+const exchangeInput = Schema.toType(Schema.Struct({
+	configuration: OAuthConnectedConfiguration,
+	secrets: OAuthTransactionSecrets,
+	response: OAuthCodeResponse,
+	verificationStartedAt: Schema.DateTimeUtcFromMillis
+}));
+const refreshInput = Schema.toType(Schema.Struct({
+	context: OAuthConnectedTokenContext,
+	material: OAuthConnectedTokenMaterial,
+	verificationStartedAt: Schema.DateTimeUtcFromMillis
+}));
+const revokeInput = Schema.Struct({
+	context: OAuthConnectedTokenContext,
+	material: OAuthConnectedTokenMaterial
+});
+const numericDate = Schema.Finite.check(Schema.isBetween({
+	minimum: 0,
+	maximum: 864e10
+}));
+const claimsSchema = Schema.Struct({
+	iss: Schema.String,
+	sub: OAuthExternalIdentity.fields.subject,
+	aud: Schema.Union([Schema.String, Schema.Array(Schema.String).check(Schema.isMinLength(1), Schema.isMaxLength(1))]),
+	azp: Schema.optionalKey(Schema.String),
+	exp: numericDate,
+	iat: numericDate,
+	nbf: Schema.optionalKey(numericDate),
+	auth_time: Schema.optionalKey(numericDate),
+	nonce: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(256)))
+});
+const identitySchema = Schema.Struct({
+	subject: OAuthExternalIdentity.fields.subject,
+	profile: Schema.optionalKey(OAuthDisplayProfile)
+});
+const rawMetadataSchema = Schema.Struct({
+	expires_in: Schema.optionalKey(Schema.Finite.check(Schema.isGreaterThan(0))),
+	scope: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(16447)))
+});
+const rawRefreshExpiry = Schema.UndefinedOr(Schema.Finite.check(Schema.isGreaterThanOrEqualTo(0)));
+const privateConfiguration = (entry, fetch, timeout, signal, purpose, compatibility, receipt) => {
+	const provider = entry.provider;
+	const authentication = purpose === "revoke" && provider.revocation.mode === "rfc7009" ? provider.revocation.authentication : provider.authentication;
+	const configuration = new client.Configuration(entry.metadata, provider.clientId, {
+		[client.clockSkew]: 0,
+		[client.clockTolerance]: 0,
+		...provider.protocol === "oidc" ? { id_token_signed_response_alg: "RS256" } : {}
+	}, clientAuthentication(authentication));
+	const transport = boundedFetch(fetch, signal, entry.allowedUrls);
+	let metadata;
+	configuration.timeout = timeout;
+	configuration[client.customFetch] = async (url, options) => {
+		const response = await transport(url, options);
+		if (purpose === "grant" && url === new URL(entry.metadata.token_endpoint).href && (compatibility !== void 0 || response.status === 200)) {
+			const body = await response.clone().json();
+			signal.throwIfAborted();
+			if (compatibility !== void 0) {
+				if (!receipt) throw unavailable();
+				compatibility.inspectReceipt({
+					body,
+					status: response.status,
+					contentType: response.headers.get("content-type")
+				}, receipt);
+				signal.throwIfAborted();
+			}
+			if (response.status !== 200) return response;
+			if (metadata !== void 0) throw unavailable();
+			const decoded = Schema.decodeUnknownSync(rawMetadataSchema)(body);
+			let refreshExpiresIn;
+			if (provider.refreshExpiry !== "unreported") {
+				refreshExpiresIn = Schema.decodeUnknownSync(rawRefreshExpiry)(Reflect.get(body, provider.refreshExpiry.field));
+				if (refreshExpiresIn === 0 && provider.refreshExpiry.zero === "unreported") refreshExpiresIn = void 0;
+			}
+			metadata = {
+				...decoded.expires_in === void 0 ? {} : { expiresIn: decoded.expires_in },
+				...decoded.scope === void 0 ? {} : { scope: decoded.scope },
+				...refreshExpiresIn === void 0 ? {} : { refreshExpiresIn }
+			};
+		}
+		return response;
+	};
+	if (provider.protocol === "oidc") client.enableNonRepudiationChecks(configuration);
+	return {
+		configuration,
+		metadata: () => {
+			if (!metadata) throw unavailable();
+			return metadata;
+		}
+	};
+};
+const appendResources = (parameters, resources) => {
+	for (const resource of resources) parameters.append("resource", resource);
+};
+const sameStrings = (left, right) => left.length === right.length && [...left].sort().every((value, index) => value === [...right].sort()[index]);
+const makeConnectedProtocolWithCompatibility = Effect.fn("makeOpenIdClientConnectedProtocol")(function* (options, compatibility) {
+	const decoderContext = yield* Effect.context();
+	const providerRevocation = yield* ProviderRevocation;
+	const { installed, fetch, timeoutSeconds } = yield* installConnectedConfigurations(options, compatibility !== void 0);
+	const retained = Effect.fn("OpenIdClientConnected.retained")(function* (saved) {
+		const entry = installed.find(({ provider }) => provider.provider === saved.provider && provider.configurationGeneration === saved.configurationGeneration);
+		const provider = entry?.provider;
+		if (!entry || !provider || provider.protocol !== saved.protocol || provider.issuer !== saved.issuer || provider.responseIssuerMode !== saved.responseIssuerMode || provider.clientRegistrationId !== saved.profile.clientRegistrationId || !provider.profiles.some((profile) => sameConnectedProfile(profile, saved.profile)) || provider.callbacks.find((callback) => callback.callbackId === saved.callbackId)?.redirectUri !== saved.redirectUri) return yield* unavailable();
+		return entry;
+	});
+	const checkedStart = Effect.fn("OpenIdClientConnected.startedAt")(function* (start) {
+		const value = DateTime.toEpochMillis(start);
+		if (!Number.isSafeInteger(value) || value < 0 || value > DateTime.toEpochMillis(yield* DateTime.now)) return yield* unavailable();
+		return value;
+	});
+	const tokenMetadata = Effect.fn("OpenIdClientConnected.tokenMetadata")(function* (profile, metadata, start, refreshRetained) {
+		const scopes = compatibility !== void 0 ? yield* Effect.try({
+			try: () => compatibility.decodeScopes(metadata.scope, profile.scopes),
+			catch: unavailable
+		}) : metadata.scope === void 0 ? profile.scopes : yield* Schema.decodeEffect(OAuthConnectedScopes)(metadata.scope.split(" ")).pipe(Effect.mapError(unavailable));
+		if (new Set(scopes).size !== scopes.length || !sameStrings(scopes, profile.scopes)) return yield* unavailable();
+		const accessExpiresAtMillis = metadata.expiresIn === void 0 ? void 0 : yield* Schema.decodeEffect(OAuthInstant)(Math.floor(start + metadata.expiresIn * 1e3)).pipe(Effect.mapError(unavailable));
+		const refreshExpiresAtMillis = !refreshRetained || metadata.refreshExpiresIn === void 0 ? void 0 : yield* Schema.decodeEffect(OAuthInstant)(Math.floor(start + metadata.refreshExpiresIn * 1e3)).pipe(Effect.mapError(unavailable));
+		const now = DateTime.toEpochMillis(yield* DateTime.now);
+		if (accessExpiresAtMillis !== void 0 && accessExpiresAtMillis <= now || refreshExpiresAtMillis !== void 0 && refreshExpiresAtMillis <= now) return yield* unavailable();
+		return {
+			scopes: [...scopes],
+			resources: [...profile.resources],
+			...accessExpiresAtMillis === void 0 ? {} : { accessExpiresAtMillis },
+			...refreshExpiresAtMillis === void 0 ? {} : { refreshExpiresAtMillis }
+		};
+	});
+	const oidcIdentity = Effect.fn("OpenIdClientConnected.oidcIdentity")(function* (entry, raw, originalNonce, previous) {
+		const provider = entry.provider;
+		if (provider.protocol !== "oidc") return yield* unavailable();
+		const claims = yield* Schema.decodeUnknownEffect(claimsSchema)(raw).pipe(Effect.mapError(unavailable));
+		const now = DateTime.toEpochMillis(yield* DateTime.now) / 1e3;
+		const audience = typeof claims.aud === "string" ? claims.aud : claims.aud[0];
+		if (claims.iss !== provider.issuer || audience !== provider.clientId || claims.azp !== void 0 && claims.azp !== provider.clientId || claims.exp <= now || claims.iat > now || claims.nbf !== void 0 && claims.nbf > now || claims.auth_time !== void 0 && claims.auth_time > now || (previous ? claims.sub !== previous.identity.subject || claims.nonce !== void 0 && claims.nonce !== Redacted.value(originalNonce) || claims.auth_time !== void 0 && claims.auth_time !== previous.continuation.authTime : claims.nonce !== Redacted.value(originalNonce) || provider.maxAgeSeconds !== void 0 && (claims.auth_time === void 0 || claims.auth_time + provider.maxAgeSeconds < Math.floor(now)))) return yield* unavailable();
+		return {
+			identity: {
+				provider: provider.provider,
+				issuer: provider.issuer,
+				subject: claims.sub
+			},
+			continuation: previous?.continuation ?? {
+				_tag: "Oidc",
+				clientId: provider.clientId,
+				nonce: Redacted.make(Redacted.value(originalNonce)),
+				...claims.auth_time === void 0 ? {} : { authTime: claims.auth_time }
+			}
+		};
+	});
+	const decodeIdentity = Effect.fn("OpenIdClientConnected.decodeIdentity")(function* (entry, body) {
+		if (entry.provider.protocol !== "oauth") return yield* unavailable();
+		const decoder = entry.provider.identitySource.decodeIdentity;
+		const result = yield* Effect.suspend(() => decoder(body)).pipe(Effect.provideContext(decoderContext), Effect.catchCause((cause) => {
+			const recovered = Cause.hasInterrupts(cause) ? Effect.interrupt : Effect.fail(unavailable());
+			if (cause.reasons.length === 1 && cause.reasons[0]?._tag === "Fail" && Schema.is(OAuthProtocolRejected)(cause.reasons[0].error)) return recovered;
+			return reportAuthFailure("oauth-identity", cause).pipe(Effect.andThen(recovered));
+		}));
+		const value = yield* Schema.decodeEffect(identitySchema)(result).pipe(Effect.mapError(unavailable));
+		return {
+			identity: {
+				provider: entry.provider.provider,
+				issuer: entry.provider.issuer,
+				subject: value.subject
+			},
+			...value.profile === void 0 ? {} : { profile: value.profile },
+			continuation: { _tag: "OAuth" }
+		};
+	});
+	const prepareAuthorization = Effect.fn("OpenIdClientConnected.prepareAuthorization")(function* (input) {
+		const request = yield* snapshotOAuth(prepareInput, input);
+		const entry = installed.find(({ provider }) => provider.provider === request.profile.provider && provider.issuance === "active" && provider.profiles.some((profile) => profile.issuance === "active" && sameConnectedProfile(profile, request.profile)));
+		const callback = entry?.provider.callbacks.find((value) => value.callbackId === request.callbackId);
+		if (!entry || !callback || request.profile.issuance !== "active") return yield* rejected();
+		const result = yield* Effect.tryPromise({
+			try: async (signal) => {
+				const { configuration } = privateConfiguration(entry, fetch, timeoutSeconds, signal, "grant");
+				const state = client.randomState(), verifier = client.randomPKCECodeVerifier(), nonce = entry.provider.protocol === "oidc" ? client.randomNonce() : void 0;
+				const challenge = await client.calculatePKCECodeChallenge(verifier);
+				signal.throwIfAborted();
+				const parameters = new URLSearchParams(entry.provider.authorizationParameters);
+				for (const [key, value] of Object.entries({
+					response_type: "code",
+					response_mode: "query",
+					redirect_uri: callback.redirectUri,
+					scope: (compatibility?.authorizationScopes(request.profile.scopes, request.profile.retention === "access-and-refresh") ?? request.profile.scopes).join(" "),
+					state,
+					code_challenge: challenge,
+					code_challenge_method: "S256"
+				})) parameters.set(key, value);
+				if (nonce !== void 0) parameters.set("nonce", nonce);
+				if (entry.provider.protocol === "oidc" && entry.provider.maxAgeSeconds !== void 0) parameters.set("max_age", String(entry.provider.maxAgeSeconds));
+				appendResources(parameters, request.profile.resources);
+				return {
+					configuration: {
+						provider: entry.provider.provider,
+						protocol: entry.provider.protocol,
+						configurationGeneration: entry.provider.configurationGeneration,
+						issuer: entry.provider.issuer,
+						responseIssuerMode: entry.provider.responseIssuerMode,
+						callbackId: callback.callbackId,
+						redirectUri: callback.redirectUri,
+						profile: request.profile
+					},
+					authorizationUrl: Redacted.make(client.buildAuthorizationUrl(configuration, parameters).href),
+					secrets: {
+						namespace: "effect-auth/oauth-transaction-secrets/v1",
+						state: Redacted.make(state),
+						pkceVerifier: Redacted.make(verifier),
+						...nonce === void 0 ? {} : { oidcNonce: Redacted.make(nonce) }
+					}
+				};
+			},
+			catch: unavailable
+		});
+		return yield* snapshotOAuth(prepareOutput, result);
+	});
+	const exchangeGrant = Effect.fn("OpenIdClientConnected.exchangeGrant")(function* (input) {
+		const request = yield* snapshotOAuth(exchangeInput, input), saved = request.configuration;
+		const entry = yield* retained(saved), provider = entry.provider;
+		if (provider.protocol === "oidc" !== (request.secrets.oidcNonce !== void 0) || Redacted.value(request.response.state) !== Redacted.value(request.secrets.state) || (provider.responseIssuerMode === "required" ? request.response.issuer !== provider.issuer : request.response.issuer !== void 0)) return yield* rejected();
+		const start = yield* checkedStart(request.verificationStartedAt);
+		const result = yield* Effect.tryPromise({
+			try: async (signal) => {
+				const invocation = privateConfiguration(entry, fetch, timeoutSeconds, signal, "grant", compatibility, {
+					scopes: saved.profile.scopes,
+					refreshRequired: saved.profile.retention === "access-and-refresh",
+					operation: "authorization_code"
+				});
+				const url = new URL(saved.redirectUri);
+				url.searchParams.set("code", Redacted.value(request.response.code));
+				url.searchParams.set("state", Redacted.value(request.response.state));
+				if (request.response.issuer !== void 0) url.searchParams.set("iss", request.response.issuer);
+				const parameters = new URLSearchParams(provider.tokenParameters);
+				appendResources(parameters, saved.profile.resources);
+				const tokens = await client.authorizationCodeGrant(invocation.configuration, url, {
+					expectedState: Redacted.value(request.secrets.state),
+					pkceCodeVerifier: Redacted.value(request.secrets.pkceVerifier),
+					...provider.protocol === "oidc" ? {
+						idTokenExpected: true,
+						expectedNonce: Redacted.value(request.secrets.oidcNonce),
+						...provider.maxAgeSeconds === void 0 ? {} : { maxAge: provider.maxAgeSeconds }
+					} : {}
+				}, parameters);
+				signal.throwIfAborted();
+				if (tokens.token_type !== "bearer") throw unavailable();
+				const metadata = invocation.metadata();
+				let body;
+				if (provider.protocol === "oauth") {
+					const response = await client.fetchProtectedResource(invocation.configuration, tokens.access_token, new URL(provider.identitySource.url), "GET", void 0, new Headers(provider.identitySource.headers));
+					signal.throwIfAborted();
+					if (response.status !== 200 || response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase() !== "application/json") throw unavailable();
+					body = await response.json();
+					signal.throwIfAborted();
+				}
+				return {
+					tokens,
+					metadata,
+					body
+				};
+			},
+			catch: grantError
+		});
+		const identity = provider.protocol === "oidc" ? yield* oidcIdentity(entry, result.tokens.claims(), request.secrets.oidcNonce) : yield* decodeIdentity(entry, result.body);
+		const refreshToken = saved.profile.retention === "access-and-refresh" ? result.tokens.refresh_token : void 0;
+		const metadata = yield* tokenMetadata(saved.profile, result.metadata, start, refreshToken !== void 0);
+		return yield* snapshotOAuth(OAuthConnectedGrantResponse, {
+			...identity,
+			...metadata,
+			material: {
+				namespace: "effect-auth/oauth-connected-token-material/v1",
+				accessToken: Redacted.make(result.tokens.access_token),
+				...refreshToken === void 0 ? {} : { refreshToken: Redacted.make(refreshToken) },
+				continuation: identity.continuation
+			}
+		});
+	});
+	const refreshGrant = Effect.fn("OpenIdClientConnected.refreshGrant")(function* (input) {
+		const request = yield* snapshotOAuth(refreshInput, input), saved = request.context.configuration;
+		const entry = yield* retained(saved), provider = entry.provider, previous = request.material.continuation;
+		if (saved.profile.retention !== "access-and-refresh" || saved.profile.refresh === "unsupported" || !request.material.refreshToken || request.context.identity.provider !== provider.provider || request.context.identity.issuer !== provider.issuer || (provider.protocol === "oidc" ? previous._tag !== "Oidc" || previous.clientId !== provider.clientId || previous.nonce === void 0 : previous._tag !== "OAuth") || !sameStrings(request.context.metadata.scopes, saved.profile.scopes) || !sameStrings(request.context.metadata.resources, saved.profile.resources)) return yield* unavailable();
+		const start = yield* checkedStart(request.verificationStartedAt);
+		if (request.context.metadata.refreshUseUntilMillis !== void 0 && request.context.metadata.refreshUseUntilMillis <= start || request.context.metadata.refreshExpiresAtMillis !== void 0 && request.context.metadata.refreshExpiresAtMillis <= start) return yield* unavailable();
+		const result = yield* Effect.tryPromise({
+			try: async (signal) => {
+				const invocation = privateConfiguration(entry, fetch, timeoutSeconds, signal, "grant", compatibility, {
+					scopes: saved.profile.scopes,
+					refreshRequired: true,
+					operation: "refresh_token"
+				});
+				const parameters = new URLSearchParams(provider.refreshParameters);
+				if (compatibility?.includeRefreshScope !== false) parameters.set("scope", saved.profile.scopes.join(" "));
+				appendResources(parameters, saved.profile.resources);
+				const tokens = await client.refreshTokenGrant(invocation.configuration, Redacted.value(request.material.refreshToken), parameters);
+				signal.throwIfAborted();
+				if (tokens.token_type !== "bearer" || saved.profile.refresh === "rotating" && (!tokens.refresh_token || tokens.refresh_token === Redacted.value(request.material.refreshToken))) throw unavailable();
+				const metadata = invocation.metadata();
+				let body;
+				if (provider.protocol === "oauth") {
+					const response = await client.fetchProtectedResource(invocation.configuration, tokens.access_token, new URL(provider.identitySource.url), "GET", void 0, new Headers(provider.identitySource.headers));
+					signal.throwIfAborted();
+					if (response.status !== 200 || response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase() !== "application/json") throw unavailable();
+					body = await response.json();
+					signal.throwIfAborted();
+				}
+				return {
+					tokens,
+					metadata,
+					body
+				};
+			},
+			catch: grantError
+		});
+		if (provider.protocol === "oidc") {
+			if (previous._tag !== "Oidc" || !previous.nonce) return yield* unavailable();
+			if (result.tokens.id_token !== void 0) yield* oidcIdentity(entry, result.tokens.claims(), previous.nonce, {
+				identity: request.context.identity,
+				continuation: previous
+			});
+		} else if ((yield* decodeIdentity(entry, result.body)).identity.subject !== request.context.identity.subject) return yield* unavailable();
+		const metadata = yield* tokenMetadata(saved.profile, result.metadata, start, true);
+		const finishedAt = DateTime.toEpochMillis(yield* DateTime.now);
+		if (request.context.metadata.refreshUseUntilMillis !== void 0 && request.context.metadata.refreshUseUntilMillis <= finishedAt || request.context.metadata.refreshExpiresAtMillis !== void 0 && request.context.metadata.refreshExpiresAtMillis <= finishedAt) return yield* unavailable();
+		return yield* snapshotOAuth(OAuthConnectedGrantResponse, {
+			identity: request.context.identity,
+			...metadata,
+			material: {
+				namespace: "effect-auth/oauth-connected-token-material/v1",
+				accessToken: Redacted.make(result.tokens.access_token),
+				...result.tokens.refresh_token === void 0 ? {} : { refreshToken: Redacted.make(result.tokens.refresh_token) },
+				continuation: previous
+			}
+		});
+	});
+	const revokeGrant = Effect.fn("OpenIdClientConnected.revokeGrant")(function* (input) {
+		const request = yield* snapshotOAuth(revokeInput, input), saved = request.context.configuration;
+		const entry = yield* retained(saved), revocation = entry.provider.revocation;
+		if (saved.profile.revocation !== "cohort" || revocation.mode === "unsupported" || revocation.mode === "provider-cohort" && compatibility === void 0 || revocation.mode === "rfc7009" && request.material.refreshToken !== void 0 && revocation.tokenTypes !== "access-and-refresh" || request.context.identity.provider !== entry.provider.provider || request.context.identity.issuer !== entry.provider.issuer || (entry.provider.protocol === "oidc" ? request.material.continuation._tag !== "Oidc" || request.material.continuation.clientId !== entry.provider.clientId : request.material.continuation._tag !== "OAuth")) return yield* unavailable();
+		if (revocation.mode === "provider-cohort") {
+			yield* providerRevocation.revoke({
+				clientId: entry.provider.clientId,
+				authentication: entry.provider.authentication,
+				context: request.context,
+				material: request.material
+			});
+			return "Confirmed";
+		}
+		yield* Effect.tryPromise({
+			try: async (signal) => {
+				const { configuration } = privateConfiguration(entry, fetch, timeoutSeconds, signal, "revoke");
+				if (request.material.refreshToken !== void 0) {
+					await client.tokenRevocation(configuration, Redacted.value(request.material.refreshToken), { token_type_hint: "refresh_token" });
+					signal.throwIfAborted();
+				}
+				await client.tokenRevocation(configuration, Redacted.value(request.material.accessToken), { token_type_hint: "access_token" });
+				signal.throwIfAborted();
+			},
+			catch: unavailable
+		});
+		return "Confirmed";
+	});
+	return OAuthConnectedProtocol.of({
+		prepareAuthorization: (input) => safe(prepareAuthorization(input)),
+		exchangeGrant: (input) => safe(exchangeGrant(input)),
+		refreshGrant: (input) => safe(refreshGrant(input)),
+		revokeGrant: (input) => safe(revokeGrant(input))
+	});
+}, safe);
+const makeOpenIdClientConnectedProtocol = (options) => makeConnectedProtocolWithCompatibility(options).pipe(Effect.provide(ProviderRevocation.layerUnsupported));
+const openIdClientConnectedProtocolLayer = (options) => Layer.effect(OAuthConnectedProtocol, makeOpenIdClientConnectedProtocol(options));
+//#endregion
+export { makeConnectedProtocolWithCompatibility, makeOpenIdClientConnectedProtocol, openIdClientConnectedProtocolLayer };
+
+//# sourceMappingURL=protocol.mjs.map

package/dist/oauth/openid-client/connected/protocol.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.mjs","names":["M.OAuthConnectedProfile","M.OAuthConnectedConfiguration","M.OAuthConnectedTokenContext","M.OAuthConnectedTokenMaterial","M.OAuthConnectedScopes","M.OAuthConnectedGrantResponse"],"sources":["../../../../src/oauth/openid-client/connected/protocol.ts"],"sourcesContent":["import { Cause, DateTime, Effect, Layer, Redacted, Schema } from \"effect\";\nimport * as client from \"openid-client\";\n\nimport { reportAuthFailure } from \"../../../internal/diagnostics\";\nimport { RequestBindingFlowId } from \"../../../operations/requestBinding\";\nimport * as M from \"../../connectedModels\";\nimport { OAuthConnectedProtocol } from \"../../OAuthConnectedProtocol\";\nimport { OAuthProtocolRejected, OAuthUnavailable } from \"../../signInErrors\";\nimport {\n  OAuthCallbackId,\n  OAuthCodeResponse,\n  OAuthDisplayProfile,\n  OAuthExternalIdentity,\n  OAuthInstant,\n  OAuthProtocolPreparation,\n  OAuthTransactionSecrets,\n} from \"../../signInModels\";\nimport { snapshotOAuth } from \"../../signInSnapshot\";\nimport {\n  DefiniteTokenRejection,\n  type ConnectedCompatibility,\n  type ConnectedOptions,\n} from \"../compatibility\";\nimport { clientAuthentication } from \"../configuration\";\nimport { type OpenIdClientConfigurationError } from \"../models\";\nimport { ProviderRevocation } from \"../ProviderRevocation\";\nimport { boundedFetch } from \"../transport\";\nimport {\n  installConnectedConfigurations,\n  sameConnectedProfile,\n  type InstalledConnectedProvider,\n} from \"./configuration\";\nimport type { OpenIdClientConnectedProtocolOptions } from \"./models\";\n\nconst unavailable = () => OAuthUnavailable.make({});\nconst rejected = () => OAuthProtocolRejected.make({});\n\nconst safe = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n  effect.pipe(\n    Effect.tapCause((cause) =>\n      Cause.hasDies(cause) ? reportAuthFailure(\"oauth-protocol\", cause) : Effect.void,\n    ),\n    Effect.catchCause((cause): Effect.Effect<never, E | OAuthUnavailable> => {\n      if (Cause.hasInterrupts(cause)) return Effect.interrupt;\n\n      return Cause.hasDies(cause) ? Effect.fail(unavailable()) : Effect.failCause(cause);\n    }),\n  );\n\n/** After possible transmission, validation/transport failures remain ambiguous. */\nconst grantError = (error: unknown) =>\n  error instanceof DefiniteTokenRejection ||\n  (error instanceof client.ClientError && error.cause instanceof DefiniteTokenRejection) ||\n  (error instanceof client.ResponseBodyError &&\n    error.status === 400 &&\n    error.error === \"invalid_grant\")\n    ? rejected()\n    : unavailable();\n\nconst prepareInput = Schema.Struct({\n  profile: M.OAuthConnectedProfile,\n  callbackId: OAuthCallbackId,\n  flowId: RequestBindingFlowId,\n});\n\nconst prepareOutput = Schema.Struct({\n  ...OAuthProtocolPreparation.fields,\n  configuration: M.OAuthConnectedConfiguration,\n});\n\nconst exchangeInput = Schema.toType(\n  Schema.Struct({\n    configuration: M.OAuthConnectedConfiguration,\n    secrets: OAuthTransactionSecrets,\n    response: OAuthCodeResponse,\n    verificationStartedAt: Schema.DateTimeUtcFromMillis,\n  }),\n);\n\nconst refreshInput = Schema.toType(\n  Schema.Struct({\n    context: M.OAuthConnectedTokenContext,\n    material: M.OAuthConnectedTokenMaterial,\n    verificationStartedAt: Schema.DateTimeUtcFromMillis,\n  }),\n);\n\nconst revokeInput = Schema.Struct({\n  context: M.OAuthConnectedTokenContext,\n  material: M.OAuthConnectedTokenMaterial,\n});\n\nconst numericDate = Schema.Finite.check(Schema.isBetween({ minimum: 0, maximum: 8640000000000 }));\n\nconst claimsSchema = Schema.Struct({\n  iss: Schema.String,\n  sub: OAuthExternalIdentity.fields.subject,\n  aud: Schema.Union([\n    Schema.String,\n    Schema.Array(Schema.String).check(Schema.isMinLength(1), Schema.isMaxLength(1)),\n  ]),\n  azp: Schema.optionalKey(Schema.String),\n  exp: numericDate,\n  iat: numericDate,\n  nbf: Schema.optionalKey(numericDate),\n  auth_time: Schema.optionalKey(numericDate),\n  nonce: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(256))),\n});\n\nconst identitySchema = Schema.Struct({\n  subject: OAuthExternalIdentity.fields.subject,\n  profile: Schema.optionalKey(OAuthDisplayProfile),\n});\n\nconst rawMetadataSchema = Schema.Struct({\n  expires_in: Schema.optionalKey(Schema.Finite.check(Schema.isGreaterThan(0))),\n  scope: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(16447))),\n});\n\nconst rawRefreshExpiry = Schema.UndefinedOr(Schema.Finite.check(Schema.isGreaterThanOrEqualTo(0)));\n\ninterface GrantMetadata {\n  readonly expiresIn?: number;\n  readonly scope?: string;\n  readonly refreshExpiresIn?: number;\n}\n\nconst privateConfiguration = <R>(\n  entry: InstalledConnectedProvider<R>,\n  fetch: client.CustomFetch,\n  timeout: number,\n  signal: AbortSignal,\n  purpose: \"grant\" | \"revoke\",\n  compatibility?: ConnectedCompatibility,\n  receipt?: Parameters<ConnectedCompatibility[\"inspectReceipt\"]>[1],\n) => {\n  const provider = entry.provider;\n\n  const authentication =\n    purpose === \"revoke\" && provider.revocation.mode === \"rfc7009\"\n      ? provider.revocation.authentication\n      : provider.authentication;\n\n  const configuration = new client.Configuration(\n    entry.metadata,\n    provider.clientId,\n    {\n      [client.clockSkew]: 0,\n      [client.clockTolerance]: 0,\n      ...(provider.protocol === \"oidc\" ? { id_token_signed_response_alg: \"RS256\" } : {}),\n    },\n    clientAuthentication(authentication),\n  );\n\n  const transport = boundedFetch(fetch, signal, entry.allowedUrls);\n  let metadata: GrantMetadata | undefined;\n\n  configuration.timeout = timeout;\n  configuration[client.customFetch] = async (url, options) => {\n    const response = await transport(url, options);\n\n    if (\n      purpose === \"grant\" &&\n      url === new URL(entry.metadata.token_endpoint!).href &&\n      (compatibility !== undefined || response.status === 200)\n    ) {\n      const body: unknown = await response.clone().json();\n\n      signal.throwIfAborted();\n      if (compatibility !== undefined) {\n        if (!receipt) throw unavailable();\n        compatibility.inspectReceipt(\n          { body, status: response.status, contentType: response.headers.get(\"content-type\") },\n          receipt,\n        );\n        signal.throwIfAborted();\n      }\n      if (response.status !== 200) return response;\n      if (metadata !== undefined) throw unavailable();\n      // oxlint-disable-next-line no-restricted-properties -- Capture bounded raw expiry values before the maintained parser's coercion.\n      const decoded = Schema.decodeUnknownSync(rawMetadataSchema)(body);\n      let refreshExpiresIn: number | undefined;\n\n      if (provider.refreshExpiry !== \"unreported\") {\n        // oxlint-disable-next-line no-restricted-properties -- The extension name and numeric semantics are explicitly installed.\n        refreshExpiresIn = Schema.decodeUnknownSync(rawRefreshExpiry)(\n          Reflect.get(body as object, provider.refreshExpiry.field),\n        );\n        if (refreshExpiresIn === 0 && provider.refreshExpiry.zero === \"unreported\")\n          refreshExpiresIn = undefined;\n      }\n      metadata = {\n        ...(decoded.expires_in === undefined ? {} : { expiresIn: decoded.expires_in }),\n        ...(decoded.scope === undefined ? {} : { scope: decoded.scope }),\n        ...(refreshExpiresIn === undefined ? {} : { refreshExpiresIn }),\n      };\n    }\n\n    return response;\n  };\n  if (provider.protocol === \"oidc\") client.enableNonRepudiationChecks(configuration);\n\n  return {\n    configuration,\n    metadata: () => {\n      if (!metadata) throw unavailable();\n\n      return metadata;\n    },\n  };\n};\n\nconst appendResources = (parameters: URLSearchParams, resources: ReadonlyArray<string>) => {\n  for (const resource of resources) parameters.append(\"resource\", resource);\n};\n\nconst sameStrings = (left: ReadonlyArray<string>, right: ReadonlyArray<string>) =>\n  left.length === right.length &&\n  [...left].sort().every((value, index) => value === [...right].sort()[index]);\n\nexport const makeConnectedProtocolWithCompatibility = Effect.fn(\n  \"makeOpenIdClientConnectedProtocol\",\n)(function* <R = never>(\n  options: ConnectedOptions<R>,\n  compatibility?: ConnectedCompatibility,\n): Effect.fn.Return<\n  OAuthConnectedProtocol[\"Service\"],\n  OpenIdClientConfigurationError | OAuthUnavailable,\n  R | ProviderRevocation\n> {\n  const decoderContext = yield* Effect.context<R>();\n  const providerRevocation = yield* ProviderRevocation;\n\n  const { installed, fetch, timeoutSeconds } = yield* installConnectedConfigurations(\n    options,\n    compatibility !== undefined,\n  );\n\n  const retained = Effect.fn(\"OpenIdClientConnected.retained\")(function* (\n    saved: M.OAuthConnectedConfiguration,\n  ) {\n    const entry = installed.find(\n      ({ provider }) =>\n        provider.provider === saved.provider &&\n        provider.configurationGeneration === saved.configurationGeneration,\n    );\n\n    const provider = entry?.provider;\n\n    if (\n      !entry ||\n      !provider ||\n      provider.protocol !== saved.protocol ||\n      provider.issuer !== saved.issuer ||\n      provider.responseIssuerMode !== saved.responseIssuerMode ||\n      provider.clientRegistrationId !== saved.profile.clientRegistrationId ||\n      !provider.profiles.some((profile) => sameConnectedProfile(profile, saved.profile)) ||\n      provider.callbacks.find((callback) => callback.callbackId === saved.callbackId)\n        ?.redirectUri !== saved.redirectUri\n    )\n      return yield* unavailable();\n\n    return entry;\n  });\n\n  const checkedStart = Effect.fn(\"OpenIdClientConnected.startedAt\")(function* (\n    start: DateTime.Utc,\n  ) {\n    const value = DateTime.toEpochMillis(start);\n\n    if (\n      !Number.isSafeInteger(value) ||\n      value < 0 ||\n      value > DateTime.toEpochMillis(yield* DateTime.now)\n    )\n      return yield* unavailable();\n\n    return value;\n  });\n\n  const tokenMetadata = Effect.fn(\"OpenIdClientConnected.tokenMetadata\")(function* (\n    profile: M.OAuthConnectedProfile,\n    metadata: GrantMetadata,\n    start: number,\n    refreshRetained: boolean,\n  ) {\n    const scopes =\n      compatibility !== undefined\n        ? yield* Effect.try({\n            try: () => compatibility.decodeScopes(metadata.scope, profile.scopes),\n            catch: unavailable,\n          })\n        : metadata.scope === undefined\n          ? profile.scopes\n          : yield* Schema.decodeEffect(M.OAuthConnectedScopes)(metadata.scope.split(\" \")).pipe(\n              Effect.mapError(unavailable),\n            );\n\n    if (new Set(scopes).size !== scopes.length || !sameStrings(scopes, profile.scopes))\n      return yield* unavailable();\n\n    const accessExpiresAtMillis =\n      metadata.expiresIn === undefined\n        ? undefined\n        : yield* Schema.decodeEffect(OAuthInstant)(\n            Math.floor(start + metadata.expiresIn * 1000),\n          ).pipe(Effect.mapError(unavailable));\n\n    const refreshExpiresAtMillis =\n      !refreshRetained || metadata.refreshExpiresIn === undefined\n        ? undefined\n        : yield* Schema.decodeEffect(OAuthInstant)(\n            Math.floor(start + metadata.refreshExpiresIn * 1000),\n          ).pipe(Effect.mapError(unavailable));\n\n    const now = DateTime.toEpochMillis(yield* DateTime.now);\n\n    if (\n      (accessExpiresAtMillis !== undefined && accessExpiresAtMillis <= now) ||\n      (refreshExpiresAtMillis !== undefined && refreshExpiresAtMillis <= now)\n    )\n      return yield* unavailable();\n\n    return {\n      scopes: [...scopes],\n      resources: [...profile.resources],\n      ...(accessExpiresAtMillis === undefined ? {} : { accessExpiresAtMillis }),\n      ...(refreshExpiresAtMillis === undefined ? {} : { refreshExpiresAtMillis }),\n    };\n  });\n\n  const oidcIdentity = Effect.fn(\"OpenIdClientConnected.oidcIdentity\")(function* (\n    entry: InstalledConnectedProvider<R>,\n    raw: unknown,\n    originalNonce: Redacted.Redacted<string>,\n    previous?: {\n      readonly identity: typeof OAuthExternalIdentity.Type;\n      readonly continuation: Extract<\n        M.OAuthConnectedTokenMaterial[\"continuation\"],\n        { readonly _tag: \"Oidc\" }\n      >;\n    },\n  ) {\n    const provider = entry.provider;\n\n    if (provider.protocol !== \"oidc\") return yield* unavailable();\n\n    // oxlint-disable-next-line no-restricted-properties -- Project authenticated foreign ID-token claims into this narrower profile.\n    const claims = yield* Schema.decodeUnknownEffect(claimsSchema)(raw).pipe(\n      Effect.mapError(unavailable),\n    );\n\n    const now = DateTime.toEpochMillis(yield* DateTime.now) / 1000;\n    const audience = typeof claims.aud === \"string\" ? claims.aud : claims.aud[0];\n\n    if (\n      claims.iss !== provider.issuer ||\n      audience !== provider.clientId ||\n      (claims.azp !== undefined && claims.azp !== provider.clientId) ||\n      claims.exp <= now ||\n      claims.iat > now ||\n      (claims.nbf !== undefined && claims.nbf > now) ||\n      (claims.auth_time !== undefined && claims.auth_time > now) ||\n      (previous\n        ? claims.sub !== previous.identity.subject ||\n          (claims.nonce !== undefined && claims.nonce !== Redacted.value(originalNonce)) ||\n          (claims.auth_time !== undefined && claims.auth_time !== previous.continuation.authTime)\n        : claims.nonce !== Redacted.value(originalNonce) ||\n          (provider.maxAgeSeconds !== undefined &&\n            (claims.auth_time === undefined ||\n              claims.auth_time + provider.maxAgeSeconds < Math.floor(now))))\n    )\n      return yield* unavailable();\n\n    return {\n      identity: { provider: provider.provider, issuer: provider.issuer, subject: claims.sub },\n      continuation: previous?.continuation ?? {\n        _tag: \"Oidc\" as const,\n        clientId: provider.clientId,\n        nonce: Redacted.make(Redacted.value(originalNonce)),\n        ...(claims.auth_time === undefined ? {} : { authTime: claims.auth_time }),\n      },\n    };\n  });\n\n  const decodeIdentity = Effect.fn(\"OpenIdClientConnected.decodeIdentity\")(function* (\n    entry: InstalledConnectedProvider<R>,\n    body: unknown,\n  ) {\n    if (entry.provider.protocol !== \"oauth\") return yield* unavailable();\n    const decoder = entry.provider.identitySource.decodeIdentity;\n\n    const result = yield* Effect.suspend(() => decoder(body)).pipe(\n      Effect.provideContext(decoderContext),\n      Effect.catchCause((cause) => {\n        const recovered = Cause.hasInterrupts(cause)\n          ? Effect.interrupt\n          : Effect.fail(unavailable());\n\n        if (\n          cause.reasons.length === 1 &&\n          cause.reasons[0]?._tag === \"Fail\" &&\n          Schema.is(OAuthProtocolRejected)(cause.reasons[0].error)\n        )\n          return recovered;\n\n        return reportAuthFailure(\"oauth-identity\", cause).pipe(Effect.andThen(recovered));\n      }),\n    );\n\n    const value = yield* Schema.decodeEffect(identitySchema)(result).pipe(\n      Effect.mapError(unavailable),\n    );\n\n    return {\n      identity: {\n        provider: entry.provider.provider,\n        issuer: entry.provider.issuer,\n        subject: value.subject,\n      },\n      ...(value.profile === undefined ? {} : { profile: value.profile }),\n      continuation: { _tag: \"OAuth\" as const },\n    };\n  });\n\n  const prepareAuthorization: OAuthConnectedProtocol[\"Service\"][\"prepareAuthorization\"] = Effect.fn(\n    \"OpenIdClientConnected.prepareAuthorization\",\n  )(function* (input) {\n    const request = yield* snapshotOAuth(prepareInput, input);\n\n    const entry = installed.find(\n      ({ provider }) =>\n        provider.provider === request.profile.provider &&\n        provider.issuance === \"active\" &&\n        provider.profiles.some(\n          (profile) =>\n            profile.issuance === \"active\" && sameConnectedProfile(profile, request.profile),\n        ),\n    );\n\n    const callback = entry?.provider.callbacks.find(\n      (value) => value.callbackId === request.callbackId,\n    );\n\n    if (!entry || !callback || request.profile.issuance !== \"active\") return yield* rejected();\n\n    const result = yield* Effect.tryPromise({\n      try: async (signal) => {\n        const { configuration } = privateConfiguration(\n          entry,\n          fetch,\n          timeoutSeconds,\n          signal,\n          \"grant\",\n        );\n\n        const state = client.randomState(),\n          verifier = client.randomPKCECodeVerifier(),\n          nonce = entry.provider.protocol === \"oidc\" ? client.randomNonce() : undefined;\n\n        const challenge = await client.calculatePKCECodeChallenge(verifier);\n\n        signal.throwIfAborted();\n        const parameters = new URLSearchParams(entry.provider.authorizationParameters);\n\n        for (const [key, value] of Object.entries({\n          response_type: \"code\",\n          response_mode: \"query\",\n          redirect_uri: callback.redirectUri,\n          scope: (\n            compatibility?.authorizationScopes(\n              request.profile.scopes,\n              request.profile.retention === \"access-and-refresh\",\n            ) ?? request.profile.scopes\n          ).join(\" \"),\n          state,\n          code_challenge: challenge,\n          code_challenge_method: \"S256\",\n        }))\n          parameters.set(key, value);\n        if (nonce !== undefined) parameters.set(\"nonce\", nonce);\n        if (entry.provider.protocol === \"oidc\" && entry.provider.maxAgeSeconds !== undefined)\n          parameters.set(\"max_age\", String(entry.provider.maxAgeSeconds));\n        appendResources(parameters, request.profile.resources);\n\n        return {\n          configuration: {\n            provider: entry.provider.provider,\n            protocol: entry.provider.protocol,\n            configurationGeneration: entry.provider.configurationGeneration,\n            issuer: entry.provider.issuer,\n            responseIssuerMode: entry.provider.responseIssuerMode,\n            callbackId: callback.callbackId,\n            redirectUri: callback.redirectUri,\n            profile: request.profile,\n          },\n          authorizationUrl: Redacted.make(\n            client.buildAuthorizationUrl(configuration, parameters).href,\n          ),\n          secrets: {\n            namespace: \"effect-auth/oauth-transaction-secrets/v1\" as const,\n            state: Redacted.make(state),\n            pkceVerifier: Redacted.make(verifier),\n            ...(nonce === undefined ? {} : { oidcNonce: Redacted.make(nonce) }),\n          },\n        };\n      },\n      catch: unavailable,\n    });\n\n    return yield* snapshotOAuth(prepareOutput, result);\n  });\n\n  const exchangeGrant: OAuthConnectedProtocol[\"Service\"][\"exchangeGrant\"] = Effect.fn(\n    \"OpenIdClientConnected.exchangeGrant\",\n  )(function* (input) {\n    const request = yield* snapshotOAuth(exchangeInput, input),\n      saved = request.configuration;\n\n    const entry = yield* retained(saved),\n      provider = entry.provider;\n\n    if (\n      (provider.protocol === \"oidc\") !== (request.secrets.oidcNonce !== undefined) ||\n      Redacted.value(request.response.state) !== Redacted.value(request.secrets.state) ||\n      (provider.responseIssuerMode === \"required\"\n        ? request.response.issuer !== provider.issuer\n        : request.response.issuer !== undefined)\n    )\n      return yield* rejected();\n    const start = yield* checkedStart(request.verificationStartedAt);\n\n    const result = yield* Effect.tryPromise({\n      try: async (signal) => {\n        const invocation = privateConfiguration(\n          entry,\n          fetch,\n          timeoutSeconds,\n          signal,\n          \"grant\",\n          compatibility,\n          {\n            scopes: saved.profile.scopes,\n            refreshRequired: saved.profile.retention === \"access-and-refresh\",\n            operation: \"authorization_code\",\n          },\n        );\n\n        const url = new URL(saved.redirectUri);\n\n        url.searchParams.set(\"code\", Redacted.value(request.response.code));\n        url.searchParams.set(\"state\", Redacted.value(request.response.state));\n        if (request.response.issuer !== undefined)\n          url.searchParams.set(\"iss\", request.response.issuer);\n        const parameters = new URLSearchParams(provider.tokenParameters);\n\n        appendResources(parameters, saved.profile.resources);\n\n        const tokens = await client.authorizationCodeGrant(\n          invocation.configuration,\n          url,\n          {\n            expectedState: Redacted.value(request.secrets.state),\n            pkceCodeVerifier: Redacted.value(request.secrets.pkceVerifier),\n            ...(provider.protocol === \"oidc\"\n              ? {\n                  idTokenExpected: true,\n                  expectedNonce: Redacted.value(request.secrets.oidcNonce!),\n                  ...(provider.maxAgeSeconds === undefined\n                    ? {}\n                    : { maxAge: provider.maxAgeSeconds }),\n                }\n              : {}),\n          },\n          parameters,\n        );\n\n        signal.throwIfAborted();\n        if (tokens.token_type !== \"bearer\") throw unavailable();\n        const metadata = invocation.metadata();\n        let body: unknown;\n\n        if (provider.protocol === \"oauth\") {\n          const response = await client.fetchProtectedResource(\n            invocation.configuration,\n            tokens.access_token,\n            new URL(provider.identitySource.url),\n            \"GET\",\n            undefined,\n            new Headers(provider.identitySource.headers),\n          );\n\n          signal.throwIfAborted();\n          if (\n            response.status !== 200 ||\n            response.headers.get(\"content-type\")?.split(\";\", 1)[0]?.trim().toLowerCase() !==\n              \"application/json\"\n          )\n            throw unavailable();\n          body = await response.json();\n          signal.throwIfAborted();\n        }\n\n        return {\n          tokens,\n          metadata,\n          body,\n        };\n      },\n      catch: grantError,\n    });\n\n    const identity =\n      provider.protocol === \"oidc\"\n        ? yield* oidcIdentity(entry, result.tokens.claims(), request.secrets.oidcNonce!)\n        : yield* decodeIdentity(entry, result.body);\n\n    const refreshToken =\n      saved.profile.retention === \"access-and-refresh\" ? result.tokens.refresh_token : undefined;\n\n    const metadata = yield* tokenMetadata(\n      saved.profile,\n      result.metadata,\n      start,\n      refreshToken !== undefined,\n    );\n\n    return yield* snapshotOAuth(M.OAuthConnectedGrantResponse, {\n      ...identity,\n      ...metadata,\n      material: {\n        namespace: \"effect-auth/oauth-connected-token-material/v1\",\n        accessToken: Redacted.make(result.tokens.access_token),\n        ...(refreshToken === undefined ? {} : { refreshToken: Redacted.make(refreshToken) }),\n        continuation: identity.continuation,\n      },\n    });\n  });\n\n  const refreshGrant: OAuthConnectedProtocol[\"Service\"][\"refreshGrant\"] = Effect.fn(\n    \"OpenIdClientConnected.refreshGrant\",\n  )(function* (input) {\n    const request = yield* snapshotOAuth(refreshInput, input),\n      saved = request.context.configuration;\n\n    const entry = yield* retained(saved),\n      provider = entry.provider,\n      previous = request.material.continuation;\n\n    if (\n      saved.profile.retention !== \"access-and-refresh\" ||\n      saved.profile.refresh === \"unsupported\" ||\n      !request.material.refreshToken ||\n      request.context.identity.provider !== provider.provider ||\n      request.context.identity.issuer !== provider.issuer ||\n      (provider.protocol === \"oidc\"\n        ? previous._tag !== \"Oidc\" ||\n          previous.clientId !== provider.clientId ||\n          previous.nonce === undefined\n        : previous._tag !== \"OAuth\") ||\n      !sameStrings(request.context.metadata.scopes, saved.profile.scopes) ||\n      !sameStrings(request.context.metadata.resources, saved.profile.resources)\n    )\n      return yield* unavailable();\n    const start = yield* checkedStart(request.verificationStartedAt);\n\n    if (\n      (request.context.metadata.refreshUseUntilMillis !== undefined &&\n        request.context.metadata.refreshUseUntilMillis <= start) ||\n      (request.context.metadata.refreshExpiresAtMillis !== undefined &&\n        request.context.metadata.refreshExpiresAtMillis <= start)\n    )\n      return yield* unavailable();\n\n    const result = yield* Effect.tryPromise({\n      try: async (signal) => {\n        const invocation = privateConfiguration(\n          entry,\n          fetch,\n          timeoutSeconds,\n          signal,\n          \"grant\",\n          compatibility,\n          {\n            scopes: saved.profile.scopes,\n            refreshRequired: true,\n            operation: \"refresh_token\",\n          },\n        );\n\n        const parameters = new URLSearchParams(provider.refreshParameters);\n\n        if (compatibility?.includeRefreshScope !== false)\n          parameters.set(\"scope\", saved.profile.scopes.join(\" \"));\n        appendResources(parameters, saved.profile.resources);\n\n        const tokens = await client.refreshTokenGrant(\n          invocation.configuration,\n          Redacted.value(request.material.refreshToken!),\n          parameters,\n        );\n\n        signal.throwIfAborted();\n        if (\n          tokens.token_type !== \"bearer\" ||\n          (saved.profile.refresh === \"rotating\" &&\n            (!tokens.refresh_token ||\n              tokens.refresh_token === Redacted.value(request.material.refreshToken!)))\n        )\n          throw unavailable();\n        const metadata = invocation.metadata();\n        let body: unknown;\n\n        if (provider.protocol === \"oauth\") {\n          const response = await client.fetchProtectedResource(\n            invocation.configuration,\n            tokens.access_token,\n            new URL(provider.identitySource.url),\n            \"GET\",\n            undefined,\n            new Headers(provider.identitySource.headers),\n          );\n\n          signal.throwIfAborted();\n          if (\n            response.status !== 200 ||\n            response.headers.get(\"content-type\")?.split(\";\", 1)[0]?.trim().toLowerCase() !==\n              \"application/json\"\n          )\n            throw unavailable();\n          body = await response.json();\n          signal.throwIfAborted();\n        }\n\n        return {\n          tokens,\n          metadata,\n          body,\n        };\n      },\n      catch: grantError,\n    });\n\n    if (provider.protocol === \"oidc\") {\n      if (previous._tag !== \"Oidc\" || !previous.nonce) return yield* unavailable();\n      if (result.tokens.id_token !== undefined)\n        yield* oidcIdentity(entry, result.tokens.claims(), previous.nonce, {\n          identity: request.context.identity,\n          continuation: previous,\n        });\n    } else {\n      const identity = yield* decodeIdentity(entry, result.body);\n\n      if (identity.identity.subject !== request.context.identity.subject)\n        return yield* unavailable();\n    }\n    const metadata = yield* tokenMetadata(saved.profile, result.metadata, start, true);\n    const finishedAt = DateTime.toEpochMillis(yield* DateTime.now);\n\n    if (\n      (request.context.metadata.refreshUseUntilMillis !== undefined &&\n        request.context.metadata.refreshUseUntilMillis <= finishedAt) ||\n      (request.context.metadata.refreshExpiresAtMillis !== undefined &&\n        request.context.metadata.refreshExpiresAtMillis <= finishedAt)\n    )\n      return yield* unavailable();\n\n    return yield* snapshotOAuth(M.OAuthConnectedGrantResponse, {\n      identity: request.context.identity,\n      ...metadata,\n      material: {\n        namespace: \"effect-auth/oauth-connected-token-material/v1\",\n        accessToken: Redacted.make(result.tokens.access_token),\n        ...(result.tokens.refresh_token === undefined\n          ? {}\n          : { refreshToken: Redacted.make(result.tokens.refresh_token) }),\n        continuation: previous,\n      },\n    });\n  });\n\n  const revokeGrant: OAuthConnectedProtocol[\"Service\"][\"revokeGrant\"] = Effect.fn(\n    \"OpenIdClientConnected.revokeGrant\",\n  )(function* (input) {\n    const request = yield* snapshotOAuth(revokeInput, input),\n      saved = request.context.configuration;\n\n    const entry = yield* retained(saved),\n      revocation = entry.provider.revocation;\n\n    if (\n      saved.profile.revocation !== \"cohort\" ||\n      revocation.mode === \"unsupported\" ||\n      (revocation.mode === \"provider-cohort\" && compatibility === undefined) ||\n      (revocation.mode === \"rfc7009\" &&\n        request.material.refreshToken !== undefined &&\n        revocation.tokenTypes !== \"access-and-refresh\") ||\n      request.context.identity.provider !== entry.provider.provider ||\n      request.context.identity.issuer !== entry.provider.issuer ||\n      (entry.provider.protocol === \"oidc\"\n        ? request.material.continuation._tag !== \"Oidc\" ||\n          request.material.continuation.clientId !== entry.provider.clientId\n        : request.material.continuation._tag !== \"OAuth\")\n    )\n      return yield* unavailable();\n    if (revocation.mode === \"provider-cohort\") {\n      yield* providerRevocation.revoke({\n        clientId: entry.provider.clientId,\n        authentication: entry.provider.authentication,\n        context: request.context,\n        material: request.material,\n      });\n\n      return \"Confirmed\" as const;\n    }\n    yield* Effect.tryPromise({\n      try: async (signal) => {\n        const { configuration } = privateConfiguration(\n          entry,\n          fetch,\n          timeoutSeconds,\n          signal,\n          \"revoke\",\n        );\n\n        if (request.material.refreshToken !== undefined) {\n          await client.tokenRevocation(\n            configuration,\n            Redacted.value(request.material.refreshToken),\n            { token_type_hint: \"refresh_token\" },\n          );\n          signal.throwIfAborted();\n        }\n        await client.tokenRevocation(configuration, Redacted.value(request.material.accessToken), {\n          token_type_hint: \"access_token\",\n        });\n        signal.throwIfAborted();\n      },\n      catch: unavailable,\n    });\n\n    return \"Confirmed\" as const;\n  });\n\n  return OAuthConnectedProtocol.of({\n    prepareAuthorization: (input) => safe(prepareAuthorization(input)),\n    exchangeGrant: (input) => safe(exchangeGrant(input)),\n    refreshGrant: (input) => safe(refreshGrant(input)),\n    revokeGrant: (input) => safe(revokeGrant(input)),\n  });\n}, safe);\n\nexport const makeOpenIdClientConnectedProtocol = <R = never>(\n  options: OpenIdClientConnectedProtocolOptions<R>,\n): Effect.Effect<\n  OAuthConnectedProtocol[\"Service\"],\n  OpenIdClientConfigurationError | OAuthUnavailable,\n  R\n> =>\n  makeConnectedProtocolWithCompatibility(options).pipe(\n    Effect.provide(ProviderRevocation.layerUnsupported),\n  );\n\nexport const openIdClientConnectedProtocolLayer = <R = never>(\n  options: OpenIdClientConnectedProtocolOptions<R>,\n) => Layer.effect(OAuthConnectedProtocol, makeOpenIdClientConnectedProtocol(options));\n"],"mappings":";;;;;;;;;;;;;;;AAkCA,MAAM,oBAAoB,iBAAiB,KAAK,CAAC,CAAC;AAClD,MAAM,iBAAiB,sBAAsB,KAAK,CAAC,CAAC;AAEpD,MAAM,QAAiB,WACrB,OAAO,KACL,OAAO,UAAU,UACf,MAAM,QAAQ,KAAK,IAAI,kBAAkB,kBAAkB,KAAK,IAAI,OAAO,IAC7E,GACA,OAAO,YAAY,UAAsD;CACvE,IAAI,MAAM,cAAc,KAAK,GAAG,OAAO,OAAO;CAE9C,OAAO,MAAM,QAAQ,KAAK,IAAI,OAAO,KAAK,YAAY,CAAC,IAAI,OAAO,UAAU,KAAK;AACnF,CAAC,CACH;;AAGF,MAAM,cAAc,UAClB,iBAAiB,0BAChB,iBAAiB,OAAO,eAAe,MAAM,iBAAiB,0BAC9D,iBAAiB,OAAO,qBACvB,MAAM,WAAW,OACjB,MAAM,UAAU,kBACd,SAAS,IACT,YAAY;AAElB,MAAM,eAAe,OAAO,OAAO;CACjC,SAASA;CACT,YAAY;CACZ,QAAQ;AACV,CAAC;AAED,MAAM,gBAAgB,OAAO,OAAO;CAClC,GAAG,yBAAyB;CAC5B,eAAeC;AACjB,CAAC;AAED,MAAM,gBAAgB,OAAO,OAC3B,OAAO,OAAO;CACZ,eAAeA;CACf,SAAS;CACT,UAAU;CACV,uBAAuB,OAAO;AAChC,CAAC,CACH;AAEA,MAAM,eAAe,OAAO,OAC1B,OAAO,OAAO;CACZ,SAASC;CACT,UAAUC;CACV,uBAAuB,OAAO;AAChC,CAAC,CACH;AAEA,MAAM,cAAc,OAAO,OAAO;CAChC,SAASD;CACT,UAAUC;AACZ,CAAC;AAED,MAAM,cAAc,OAAO,OAAO,MAAM,OAAO,UAAU;CAAE,SAAS;CAAG,SAAS;AAAc,CAAC,CAAC;AAEhG,MAAM,eAAe,OAAO,OAAO;CACjC,KAAK,OAAO;CACZ,KAAK,sBAAsB,OAAO;CAClC,KAAK,OAAO,MAAM,CAChB,OAAO,QACP,OAAO,MAAM,OAAO,MAAM,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,CAAC,CAAC,CAChF,CAAC;CACD,KAAK,OAAO,YAAY,OAAO,MAAM;CACrC,KAAK;CACL,KAAK;CACL,KAAK,OAAO,YAAY,WAAW;CACnC,WAAW,OAAO,YAAY,WAAW;CACzC,OAAO,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,iBAAiB,OAAO,OAAO;CACnC,SAAS,sBAAsB,OAAO;CACtC,SAAS,OAAO,YAAY,mBAAmB;AACjD,CAAC;AAED,MAAM,oBAAoB,OAAO,OAAO;CACtC,YAAY,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,cAAc,CAAC,CAAC,CAAC;CAC3E,OAAO,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,KAAK,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,mBAAmB,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,uBAAuB,CAAC,CAAC,CAAC;AAQjG,MAAM,wBACJ,OACA,OACA,SACA,QACA,SACA,eACA,YACG;CACH,MAAM,WAAW,MAAM;CAEvB,MAAM,iBACJ,YAAY,YAAY,SAAS,WAAW,SAAS,YACjD,SAAS,WAAW,iBACpB,SAAS;CAEf,MAAM,gBAAgB,IAAI,OAAO,cAC/B,MAAM,UACN,SAAS,UACT;GACG,OAAO,YAAY;GACnB,OAAO,iBAAiB;EACzB,GAAI,SAAS,aAAa,SAAS,EAAE,8BAA8B,QAAQ,IAAI,CAAC;CAClF,GACA,qBAAqB,cAAc,CACrC;CAEA,MAAM,YAAY,aAAa,OAAO,QAAQ,MAAM,WAAW;CAC/D,IAAI;CAEJ,cAAc,UAAU;CACxB,cAAc,OAAO,eAAe,OAAO,KAAK,YAAY;EAC1D,MAAM,WAAW,MAAM,UAAU,KAAK,OAAO;EAE7C,IACE,YAAY,WACZ,QAAQ,IAAI,IAAI,MAAM,SAAS,cAAe,CAAC,CAAC,SAC/C,kBAAkB,KAAA,KAAa,SAAS,WAAW,MACpD;GACA,MAAM,OAAgB,MAAM,SAAS,MAAM,CAAC,CAAC,KAAK;GAElD,OAAO,eAAe;GACtB,IAAI,kBAAkB,KAAA,GAAW;IAC/B,IAAI,CAAC,SAAS,MAAM,YAAY;IAChC,cAAc,eACZ;KAAE;KAAM,QAAQ,SAAS;KAAQ,aAAa,SAAS,QAAQ,IAAI,cAAc;IAAE,GACnF,OACF;IACA,OAAO,eAAe;GACxB;GACA,IAAI,SAAS,WAAW,KAAK,OAAO;GACpC,IAAI,aAAa,KAAA,GAAW,MAAM,YAAY;GAE9C,MAAM,UAAU,OAAO,kBAAkB,iBAAiB,CAAC,CAAC,IAAI;GAChE,IAAI;GAEJ,IAAI,SAAS,kBAAkB,cAAc;IAE3C,mBAAmB,OAAO,kBAAkB,gBAAgB,CAAC,CAC3D,QAAQ,IAAI,MAAgB,SAAS,cAAc,KAAK,CAC1D;IACA,IAAI,qBAAqB,KAAK,SAAS,cAAc,SAAS,cAC5D,mBAAmB,KAAA;GACvB;GACA,WAAW;IACT,GAAI,QAAQ,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,QAAQ,WAAW;IAC5E,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;IAC9D,GAAI,qBAAqB,KAAA,IAAY,CAAC,IAAI,EAAE,iBAAiB;GAC/D;EACF;EAEA,OAAO;CACT;CACA,IAAI,SAAS,aAAa,QAAQ,OAAO,2BAA2B,aAAa;CAEjF,OAAO;EACL;EACA,gBAAgB;GACd,IAAI,CAAC,UAAU,MAAM,YAAY;GAEjC,OAAO;EACT;CACF;AACF;AAEA,MAAM,mBAAmB,YAA6B,cAAqC;CACzF,KAAK,MAAM,YAAY,WAAW,WAAW,OAAO,YAAY,QAAQ;AAC1E;AAEA,MAAM,eAAe,MAA6B,UAChD,KAAK,WAAW,MAAM,UACtB,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,OAAO,UAAU,UAAU,CAAC,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM;AAE7E,MAAa,yCAAyC,OAAO,GAC3D,mCACF,CAAC,CAAC,WACA,SACA,eAKA;CACA,MAAM,iBAAiB,OAAO,OAAO,QAAW;CAChD,MAAM,qBAAqB,OAAO;CAElC,MAAM,EAAE,WAAW,OAAO,mBAAmB,OAAO,+BAClD,SACA,kBAAkB,KAAA,CACpB;CAEA,MAAM,WAAW,OAAO,GAAG,gCAAgC,CAAC,CAAC,WAC3D,OACA;EACA,MAAM,QAAQ,UAAU,MACrB,EAAE,eACD,SAAS,aAAa,MAAM,YAC5B,SAAS,4BAA4B,MAAM,uBAC/C;EAEA,MAAM,WAAW,OAAO;EAExB,IACE,CAAC,SACD,CAAC,YACD,SAAS,aAAa,MAAM,YAC5B,SAAS,WAAW,MAAM,UAC1B,SAAS,uBAAuB,MAAM,sBACtC,SAAS,yBAAyB,MAAM,QAAQ,wBAChD,CAAC,SAAS,SAAS,MAAM,YAAY,qBAAqB,SAAS,MAAM,OAAO,CAAC,KACjF,SAAS,UAAU,MAAM,aAAa,SAAS,eAAe,MAAM,UAAU,CAAC,EAC3E,gBAAgB,MAAM,aAE1B,OAAO,OAAO,YAAY;EAE5B,OAAO;CACT,CAAC;CAED,MAAM,eAAe,OAAO,GAAG,iCAAiC,CAAC,CAAC,WAChE,OACA;EACA,MAAM,QAAQ,SAAS,cAAc,KAAK;EAE1C,IACE,CAAC,OAAO,cAAc,KAAK,KAC3B,QAAQ,KACR,QAAQ,SAAS,cAAc,OAAO,SAAS,GAAG,GAElD,OAAO,OAAO,YAAY;EAE5B,OAAO;CACT,CAAC;CAED,MAAM,gBAAgB,OAAO,GAAG,qCAAqC,CAAC,CAAC,WACrE,SACA,UACA,OACA,iBACA;EACA,MAAM,SACJ,kBAAkB,KAAA,IACd,OAAO,OAAO,IAAI;GAChB,WAAW,cAAc,aAAa,SAAS,OAAO,QAAQ,MAAM;GACpE,OAAO;EACT,CAAC,IACD,SAAS,UAAU,KAAA,IACjB,QAAQ,SACR,OAAO,OAAO,aAAaC,oBAAsB,CAAC,CAAC,SAAS,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,KAC5E,OAAO,SAAS,WAAW,CAC7B;EAER,IAAI,IAAI,IAAI,MAAM,CAAC,CAAC,SAAS,OAAO,UAAU,CAAC,YAAY,QAAQ,QAAQ,MAAM,GAC/E,OAAO,OAAO,YAAY;EAE5B,MAAM,wBACJ,SAAS,cAAc,KAAA,IACnB,KAAA,IACA,OAAO,OAAO,aAAa,YAAY,CAAC,CACtC,KAAK,MAAM,QAAQ,SAAS,YAAY,GAAI,CAC9C,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;EAEzC,MAAM,yBACJ,CAAC,mBAAmB,SAAS,qBAAqB,KAAA,IAC9C,KAAA,IACA,OAAO,OAAO,aAAa,YAAY,CAAC,CACtC,KAAK,MAAM,QAAQ,SAAS,mBAAmB,GAAI,CACrD,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;EAEzC,MAAM,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG;EAEtD,IACG,0BAA0B,KAAA,KAAa,yBAAyB,OAChE,2BAA2B,KAAA,KAAa,0BAA0B,KAEnE,OAAO,OAAO,YAAY;EAE5B,OAAO;GACL,QAAQ,CAAC,GAAG,MAAM;GAClB,WAAW,CAAC,GAAG,QAAQ,SAAS;GAChC,GAAI,0BAA0B,KAAA,IAAY,CAAC,IAAI,EAAE,sBAAsB;GACvE,GAAI,2BAA2B,KAAA,IAAY,CAAC,IAAI,EAAE,uBAAuB;EAC3E;CACF,CAAC;CAED,MAAM,eAAe,OAAO,GAAG,oCAAoC,CAAC,CAAC,WACnE,OACA,KACA,eACA,UAOA;EACA,MAAM,WAAW,MAAM;EAEvB,IAAI,SAAS,aAAa,QAAQ,OAAO,OAAO,YAAY;EAG5D,MAAM,SAAS,OAAO,OAAO,oBAAoB,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,KAClE,OAAO,SAAS,WAAW,CAC7B;EAEA,MAAM,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG,IAAI;EAC1D,MAAM,WAAW,OAAO,OAAO,QAAQ,WAAW,OAAO,MAAM,OAAO,IAAI;EAE1E,IACE,OAAO,QAAQ,SAAS,UACxB,aAAa,SAAS,YACrB,OAAO,QAAQ,KAAA,KAAa,OAAO,QAAQ,SAAS,YACrD,OAAO,OAAO,OACd,OAAO,MAAM,OACZ,OAAO,QAAQ,KAAA,KAAa,OAAO,MAAM,OACzC,OAAO,cAAc,KAAA,KAAa,OAAO,YAAY,QACrD,WACG,OAAO,QAAQ,SAAS,SAAS,WAChC,OAAO,UAAU,KAAA,KAAa,OAAO,UAAU,SAAS,MAAM,aAAa,KAC3E,OAAO,cAAc,KAAA,KAAa,OAAO,cAAc,SAAS,aAAa,WAC9E,OAAO,UAAU,SAAS,MAAM,aAAa,KAC5C,SAAS,kBAAkB,KAAA,MACzB,OAAO,cAAc,KAAA,KACpB,OAAO,YAAY,SAAS,gBAAgB,KAAK,MAAM,GAAG,KAElE,OAAO,OAAO,YAAY;EAE5B,OAAO;GACL,UAAU;IAAE,UAAU,SAAS;IAAU,QAAQ,SAAS;IAAQ,SAAS,OAAO;GAAI;GACtF,cAAc,UAAU,gBAAgB;IACtC,MAAM;IACN,UAAU,SAAS;IACnB,OAAO,SAAS,KAAK,SAAS,MAAM,aAAa,CAAC;IAClD,GAAI,OAAO,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU,OAAO,UAAU;GACzE;EACF;CACF,CAAC;CAED,MAAM,iBAAiB,OAAO,GAAG,sCAAsC,CAAC,CAAC,WACvE,OACA,MACA;EACA,IAAI,MAAM,SAAS,aAAa,SAAS,OAAO,OAAO,YAAY;EACnE,MAAM,UAAU,MAAM,SAAS,eAAe;EAE9C,MAAM,SAAS,OAAO,OAAO,cAAc,QAAQ,IAAI,CAAC,CAAC,CAAC,KACxD,OAAO,eAAe,cAAc,GACpC,OAAO,YAAY,UAAU;GAC3B,MAAM,YAAY,MAAM,cAAc,KAAK,IACvC,OAAO,YACP,OAAO,KAAK,YAAY,CAAC;GAE7B,IACE,MAAM,QAAQ,WAAW,KACzB,MAAM,QAAQ,EAAE,EAAE,SAAS,UAC3B,OAAO,GAAG,qBAAqB,CAAC,CAAC,MAAM,QAAQ,EAAE,CAAC,KAAK,GAEvD,OAAO;GAET,OAAO,kBAAkB,kBAAkB,KAAK,CAAC,CAAC,KAAK,OAAO,QAAQ,SAAS,CAAC;EAClF,CAAC,CACH;EAEA,MAAM,QAAQ,OAAO,OAAO,aAAa,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,KAC/D,OAAO,SAAS,WAAW,CAC7B;EAEA,OAAO;GACL,UAAU;IACR,UAAU,MAAM,SAAS;IACzB,QAAQ,MAAM,SAAS;IACvB,SAAS,MAAM;GACjB;GACA,GAAI,MAAM,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;GAChE,cAAc,EAAE,MAAM,QAAiB;EACzC;CACF,CAAC;CAED,MAAM,uBAAkF,OAAO,GAC7F,4CACF,CAAC,CAAC,WAAW,OAAO;EAClB,MAAM,UAAU,OAAO,cAAc,cAAc,KAAK;EAExD,MAAM,QAAQ,UAAU,MACrB,EAAE,eACD,SAAS,aAAa,QAAQ,QAAQ,YACtC,SAAS,aAAa,YACtB,SAAS,SAAS,MACf,YACC,QAAQ,aAAa,YAAY,qBAAqB,SAAS,QAAQ,OAAO,CAClF,CACJ;EAEA,MAAM,WAAW,OAAO,SAAS,UAAU,MACxC,UAAU,MAAM,eAAe,QAAQ,UAC1C;EAEA,IAAI,CAAC,SAAS,CAAC,YAAY,QAAQ,QAAQ,aAAa,UAAU,OAAO,OAAO,SAAS;EAEzF,MAAM,SAAS,OAAO,OAAO,WAAW;GACtC,KAAK,OAAO,WAAW;IACrB,MAAM,EAAE,kBAAkB,qBACxB,OACA,OACA,gBACA,QACA,OACF;IAEA,MAAM,QAAQ,OAAO,YAAY,GAC/B,WAAW,OAAO,uBAAuB,GACzC,QAAQ,MAAM,SAAS,aAAa,SAAS,OAAO,YAAY,IAAI,KAAA;IAEtE,MAAM,YAAY,MAAM,OAAO,2BAA2B,QAAQ;IAElE,OAAO,eAAe;IACtB,MAAM,aAAa,IAAI,gBAAgB,MAAM,SAAS,uBAAuB;IAE7E,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ;KACxC,eAAe;KACf,eAAe;KACf,cAAc,SAAS;KACvB,QACE,eAAe,oBACb,QAAQ,QAAQ,QAChB,QAAQ,QAAQ,cAAc,oBAChC,KAAK,QAAQ,QAAQ,OAAA,CACrB,KAAK,GAAG;KACV;KACA,gBAAgB;KAChB,uBAAuB;IACzB,CAAC,GACC,WAAW,IAAI,KAAK,KAAK;IAC3B,IAAI,UAAU,KAAA,GAAW,WAAW,IAAI,SAAS,KAAK;IACtD,IAAI,MAAM,SAAS,aAAa,UAAU,MAAM,SAAS,kBAAkB,KAAA,GACzE,WAAW,IAAI,WAAW,OAAO,MAAM,SAAS,aAAa,CAAC;IAChE,gBAAgB,YAAY,QAAQ,QAAQ,SAAS;IAErD,OAAO;KACL,eAAe;MACb,UAAU,MAAM,SAAS;MACzB,UAAU,MAAM,SAAS;MACzB,yBAAyB,MAAM,SAAS;MACxC,QAAQ,MAAM,SAAS;MACvB,oBAAoB,MAAM,SAAS;MACnC,YAAY,SAAS;MACrB,aAAa,SAAS;MACtB,SAAS,QAAQ;KACnB;KACA,kBAAkB,SAAS,KACzB,OAAO,sBAAsB,eAAe,UAAU,CAAC,CAAC,IAC1D;KACA,SAAS;MACP,WAAW;MACX,OAAO,SAAS,KAAK,KAAK;MAC1B,cAAc,SAAS,KAAK,QAAQ;MACpC,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,SAAS,KAAK,KAAK,EAAE;KACnE;IACF;GACF;GACA,OAAO;EACT,CAAC;EAED,OAAO,OAAO,cAAc,eAAe,MAAM;CACnD,CAAC;CAED,MAAM,gBAAoE,OAAO,GAC/E,qCACF,CAAC,CAAC,WAAW,OAAO;EAClB,MAAM,UAAU,OAAO,cAAc,eAAe,KAAK,GACvD,QAAQ,QAAQ;EAElB,MAAM,QAAQ,OAAO,SAAS,KAAK,GACjC,WAAW,MAAM;EAEnB,IACG,SAAS,aAAa,YAAa,QAAQ,QAAQ,cAAc,KAAA,MAClE,SAAS,MAAM,QAAQ,SAAS,KAAK,MAAM,SAAS,MAAM,QAAQ,QAAQ,KAAK,MAC9E,SAAS,uBAAuB,aAC7B,QAAQ,SAAS,WAAW,SAAS,SACrC,QAAQ,SAAS,WAAW,KAAA,IAEhC,OAAO,OAAO,SAAS;EACzB,MAAM,QAAQ,OAAO,aAAa,QAAQ,qBAAqB;EAE/D,MAAM,SAAS,OAAO,OAAO,WAAW;GACtC,KAAK,OAAO,WAAW;IACrB,MAAM,aAAa,qBACjB,OACA,OACA,gBACA,QACA,SACA,eACA;KACE,QAAQ,MAAM,QAAQ;KACtB,iBAAiB,MAAM,QAAQ,cAAc;KAC7C,WAAW;IACb,CACF;IAEA,MAAM,MAAM,IAAI,IAAI,MAAM,WAAW;IAErC,IAAI,aAAa,IAAI,QAAQ,SAAS,MAAM,QAAQ,SAAS,IAAI,CAAC;IAClE,IAAI,aAAa,IAAI,SAAS,SAAS,MAAM,QAAQ,SAAS,KAAK,CAAC;IACpE,IAAI,QAAQ,SAAS,WAAW,KAAA,GAC9B,IAAI,aAAa,IAAI,OAAO,QAAQ,SAAS,MAAM;IACrD,MAAM,aAAa,IAAI,gBAAgB,SAAS,eAAe;IAE/D,gBAAgB,YAAY,MAAM,QAAQ,SAAS;IAEnD,MAAM,SAAS,MAAM,OAAO,uBAC1B,WAAW,eACX,KACA;KACE,eAAe,SAAS,MAAM,QAAQ,QAAQ,KAAK;KACnD,kBAAkB,SAAS,MAAM,QAAQ,QAAQ,YAAY;KAC7D,GAAI,SAAS,aAAa,SACtB;MACE,iBAAiB;MACjB,eAAe,SAAS,MAAM,QAAQ,QAAQ,SAAU;MACxD,GAAI,SAAS,kBAAkB,KAAA,IAC3B,CAAC,IACD,EAAE,QAAQ,SAAS,cAAc;KACvC,IACA,CAAC;IACP,GACA,UACF;IAEA,OAAO,eAAe;IACtB,IAAI,OAAO,eAAe,UAAU,MAAM,YAAY;IACtD,MAAM,WAAW,WAAW,SAAS;IACrC,IAAI;IAEJ,IAAI,SAAS,aAAa,SAAS;KACjC,MAAM,WAAW,MAAM,OAAO,uBAC5B,WAAW,eACX,OAAO,cACP,IAAI,IAAI,SAAS,eAAe,GAAG,GACnC,OACA,KAAA,GACA,IAAI,QAAQ,SAAS,eAAe,OAAO,CAC7C;KAEA,OAAO,eAAe;KACtB,IACE,SAAS,WAAW,OACpB,SAAS,QAAQ,IAAI,cAAc,CAAC,EAAE,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,YAAY,MACzE,oBAEF,MAAM,YAAY;KACpB,OAAO,MAAM,SAAS,KAAK;KAC3B,OAAO,eAAe;IACxB;IAEA,OAAO;KACL;KACA;KACA;IACF;GACF;GACA,OAAO;EACT,CAAC;EAED,MAAM,WACJ,SAAS,aAAa,SAClB,OAAO,aAAa,OAAO,OAAO,OAAO,OAAO,GAAG,QAAQ,QAAQ,SAAU,IAC7E,OAAO,eAAe,OAAO,OAAO,IAAI;EAE9C,MAAM,eACJ,MAAM,QAAQ,cAAc,uBAAuB,OAAO,OAAO,gBAAgB,KAAA;EAEnF,MAAM,WAAW,OAAO,cACtB,MAAM,SACN,OAAO,UACP,OACA,iBAAiB,KAAA,CACnB;EAEA,OAAO,OAAO,cAAcC,6BAA+B;GACzD,GAAG;GACH,GAAG;GACH,UAAU;IACR,WAAW;IACX,aAAa,SAAS,KAAK,OAAO,OAAO,YAAY;IACrD,GAAI,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,cAAc,SAAS,KAAK,YAAY,EAAE;IAClF,cAAc,SAAS;GACzB;EACF,CAAC;CACH,CAAC;CAED,MAAM,eAAkE,OAAO,GAC7E,oCACF,CAAC,CAAC,WAAW,OAAO;EAClB,MAAM,UAAU,OAAO,cAAc,cAAc,KAAK,GACtD,QAAQ,QAAQ,QAAQ;EAE1B,MAAM,QAAQ,OAAO,SAAS,KAAK,GACjC,WAAW,MAAM,UACjB,WAAW,QAAQ,SAAS;EAE9B,IACE,MAAM,QAAQ,cAAc,wBAC5B,MAAM,QAAQ,YAAY,iBAC1B,CAAC,QAAQ,SAAS,gBAClB,QAAQ,QAAQ,SAAS,aAAa,SAAS,YAC/C,QAAQ,QAAQ,SAAS,WAAW,SAAS,WAC5C,SAAS,aAAa,SACnB,SAAS,SAAS,UAClB,SAAS,aAAa,SAAS,YAC/B,SAAS,UAAU,KAAA,IACnB,SAAS,SAAS,YACtB,CAAC,YAAY,QAAQ,QAAQ,SAAS,QAAQ,MAAM,QAAQ,MAAM,KAClE,CAAC,YAAY,QAAQ,QAAQ,SAAS,WAAW,MAAM,QAAQ,SAAS,GAExE,OAAO,OAAO,YAAY;EAC5B,MAAM,QAAQ,OAAO,aAAa,QAAQ,qBAAqB;EAE/D,IACG,QAAQ,QAAQ,SAAS,0BAA0B,KAAA,KAClD,QAAQ,QAAQ,SAAS,yBAAyB,SACnD,QAAQ,QAAQ,SAAS,2BAA2B,KAAA,KACnD,QAAQ,QAAQ,SAAS,0BAA0B,OAErD,OAAO,OAAO,YAAY;EAE5B,MAAM,SAAS,OAAO,OAAO,WAAW;GACtC,KAAK,OAAO,WAAW;IACrB,MAAM,aAAa,qBACjB,OACA,OACA,gBACA,QACA,SACA,eACA;KACE,QAAQ,MAAM,QAAQ;KACtB,iBAAiB;KACjB,WAAW;IACb,CACF;IAEA,MAAM,aAAa,IAAI,gBAAgB,SAAS,iBAAiB;IAEjE,IAAI,eAAe,wBAAwB,OACzC,WAAW,IAAI,SAAS,MAAM,QAAQ,OAAO,KAAK,GAAG,CAAC;IACxD,gBAAgB,YAAY,MAAM,QAAQ,SAAS;IAEnD,MAAM,SAAS,MAAM,OAAO,kBAC1B,WAAW,eACX,SAAS,MAAM,QAAQ,SAAS,YAAa,GAC7C,UACF;IAEA,OAAO,eAAe;IACtB,IACE,OAAO,eAAe,YACrB,MAAM,QAAQ,YAAY,eACxB,CAAC,OAAO,iBACP,OAAO,kBAAkB,SAAS,MAAM,QAAQ,SAAS,YAAa,IAE1E,MAAM,YAAY;IACpB,MAAM,WAAW,WAAW,SAAS;IACrC,IAAI;IAEJ,IAAI,SAAS,aAAa,SAAS;KACjC,MAAM,WAAW,MAAM,OAAO,uBAC5B,WAAW,eACX,OAAO,cACP,IAAI,IAAI,SAAS,eAAe,GAAG,GACnC,OACA,KAAA,GACA,IAAI,QAAQ,SAAS,eAAe,OAAO,CAC7C;KAEA,OAAO,eAAe;KACtB,IACE,SAAS,WAAW,OACpB,SAAS,QAAQ,IAAI,cAAc,CAAC,EAAE,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,YAAY,MACzE,oBAEF,MAAM,YAAY;KACpB,OAAO,MAAM,SAAS,KAAK;KAC3B,OAAO,eAAe;IACxB;IAEA,OAAO;KACL;KACA;KACA;IACF;GACF;GACA,OAAO;EACT,CAAC;EAED,IAAI,SAAS,aAAa,QAAQ;GAChC,IAAI,SAAS,SAAS,UAAU,CAAC,SAAS,OAAO,OAAO,OAAO,YAAY;GAC3E,IAAI,OAAO,OAAO,aAAa,KAAA,GAC7B,OAAO,aAAa,OAAO,OAAO,OAAO,OAAO,GAAG,SAAS,OAAO;IACjE,UAAU,QAAQ,QAAQ;IAC1B,cAAc;GAChB,CAAC;EACL,OAGE,KAAI,OAFoB,eAAe,OAAO,OAAO,IAAI,EAAA,CAE5C,SAAS,YAAY,QAAQ,QAAQ,SAAS,SACzD,OAAO,OAAO,YAAY;EAE9B,MAAM,WAAW,OAAO,cAAc,MAAM,SAAS,OAAO,UAAU,OAAO,IAAI;EACjF,MAAM,aAAa,SAAS,cAAc,OAAO,SAAS,GAAG;EAE7D,IACG,QAAQ,QAAQ,SAAS,0BAA0B,KAAA,KAClD,QAAQ,QAAQ,SAAS,yBAAyB,cACnD,QAAQ,QAAQ,SAAS,2BAA2B,KAAA,KACnD,QAAQ,QAAQ,SAAS,0BAA0B,YAErD,OAAO,OAAO,YAAY;EAE5B,OAAO,OAAO,cAAcA,6BAA+B;GACzD,UAAU,QAAQ,QAAQ;GAC1B,GAAG;GACH,UAAU;IACR,WAAW;IACX,aAAa,SAAS,KAAK,OAAO,OAAO,YAAY;IACrD,GAAI,OAAO,OAAO,kBAAkB,KAAA,IAChC,CAAC,IACD,EAAE,cAAc,SAAS,KAAK,OAAO,OAAO,aAAa,EAAE;IAC/D,cAAc;GAChB;EACF,CAAC;CACH,CAAC;CAED,MAAM,cAAgE,OAAO,GAC3E,mCACF,CAAC,CAAC,WAAW,OAAO;EAClB,MAAM,UAAU,OAAO,cAAc,aAAa,KAAK,GACrD,QAAQ,QAAQ,QAAQ;EAE1B,MAAM,QAAQ,OAAO,SAAS,KAAK,GACjC,aAAa,MAAM,SAAS;EAE9B,IACE,MAAM,QAAQ,eAAe,YAC7B,WAAW,SAAS,iBACnB,WAAW,SAAS,qBAAqB,kBAAkB,KAAA,KAC3D,WAAW,SAAS,aACnB,QAAQ,SAAS,iBAAiB,KAAA,KAClC,WAAW,eAAe,wBAC5B,QAAQ,QAAQ,SAAS,aAAa,MAAM,SAAS,YACrD,QAAQ,QAAQ,SAAS,WAAW,MAAM,SAAS,WAClD,MAAM,SAAS,aAAa,SACzB,QAAQ,SAAS,aAAa,SAAS,UACvC,QAAQ,SAAS,aAAa,aAAa,MAAM,SAAS,WAC1D,QAAQ,SAAS,aAAa,SAAS,UAE3C,OAAO,OAAO,YAAY;EAC5B,IAAI,WAAW,SAAS,mBAAmB;GACzC,OAAO,mBAAmB,OAAO;IAC/B,UAAU,MAAM,SAAS;IACzB,gBAAgB,MAAM,SAAS;IAC/B,SAAS,QAAQ;IACjB,UAAU,QAAQ;GACpB,CAAC;GAED,OAAO;EACT;EACA,OAAO,OAAO,WAAW;GACvB,KAAK,OAAO,WAAW;IACrB,MAAM,EAAE,kBAAkB,qBACxB,OACA,OACA,gBACA,QACA,QACF;IAEA,IAAI,QAAQ,SAAS,iBAAiB,KAAA,GAAW;KAC/C,MAAM,OAAO,gBACX,eACA,SAAS,MAAM,QAAQ,SAAS,YAAY,GAC5C,EAAE,iBAAiB,gBAAgB,CACrC;KACA,OAAO,eAAe;IACxB;IACA,MAAM,OAAO,gBAAgB,eAAe,SAAS,MAAM,QAAQ,SAAS,WAAW,GAAG,EACxF,iBAAiB,eACnB,CAAC;IACD,OAAO,eAAe;GACxB;GACA,OAAO;EACT,CAAC;EAED,OAAO;CACT,CAAC;CAED,OAAO,uBAAuB,GAAG;EAC/B,uBAAuB,UAAU,KAAK,qBAAqB,KAAK,CAAC;EACjE,gBAAgB,UAAU,KAAK,cAAc,KAAK,CAAC;EACnD,eAAe,UAAU,KAAK,aAAa,KAAK,CAAC;EACjD,cAAc,UAAU,KAAK,YAAY,KAAK,CAAC;CACjD,CAAC;AACH,GAAG,IAAI;AAEP,MAAa,qCACX,YAMA,uCAAuC,OAAO,CAAC,CAAC,KAC9C,OAAO,QAAQ,mBAAmB,gBAAgB,CACpD;AAEF,MAAa,sCACX,YACG,MAAM,OAAO,wBAAwB,kCAAkC,OAAO,CAAC"}

package/dist/oauth/openid-client/models.d.mts

@@ -0,0 +1,67 @@
+import { OAuthProtocolRejected } from "../signInErrors.mjs";
+import { OAuthProtocolConfiguration, OAuthVerifiedExternalIdentity } from "../signInModels.mjs";
+import { Effect, Redacted, Schema } from "effect";
+import { CustomFetch } from "openid-client";
+//#region src/oauth/openid-client/models.d.ts
+declare const OpenIdClientConfigurationError_base: Schema.Class<OpenIdClientConfigurationError, Schema.TaggedStruct<"OpenIdClientConfigurationError", {
+  readonly reason: Schema.Literals<readonly ["provider", "generation", "issuer", "callback", "authentication", "parameters", "metadata", "identity-source"]>;
+}>, import("effect/Cause").YieldableError>;
+declare class OpenIdClientConfigurationError extends OpenIdClientConfigurationError_base {}
+type OpenIdClientAuthentication = {
+  readonly method: "client_secret_basic";
+  readonly secret: Redacted.Redacted<string>;
+} | {
+  readonly method: "client_secret_post";
+  readonly secret: Redacted.Redacted<string>;
+} | {
+  readonly method: "none";
+  readonly publicClient: true;
+};
+interface PlainOAuthIdentity {
+  readonly subject: string;
+  readonly profile?: OAuthVerifiedExternalIdentity["profile"];
+}
+interface ProviderGeneration {
+  readonly provider: OAuthProtocolConfiguration["provider"];
+  readonly configurationGeneration: OAuthProtocolConfiguration["configurationGeneration"];
+  readonly issuance: "active" | "retired";
+  /** Preserve this exact issuer identifier, including an optional trailing slash. */
+  readonly issuer: OAuthProtocolConfiguration["issuer"];
+  readonly responseIssuerMode: OAuthProtocolConfiguration["responseIssuerMode"];
+  readonly clientId: string;
+  readonly authentication: OpenIdClientAuthentication;
+  readonly callbacks: ReadonlyArray<{
+    readonly callbackId: OAuthProtocolConfiguration["callbackId"];
+    readonly redirectUri: OAuthProtocolConfiguration["redirectUri"];
+  }>;
+  readonly scopes: ReadonlyArray<string>;
+  readonly authorizationParameters?: Readonly<Record<string, string>>;
+  readonly tokenParameters?: Readonly<Record<string, string>>;
+}
+interface OpenIdClientOidcProvider extends ProviderGeneration {
+  readonly protocol: "oidc";
+  readonly idTokenSignedResponseAlg: "RS256";
+  readonly maxAgeSeconds?: number;
+}
+interface OpenIdClientOAuthProvider<R = never> extends ProviderGeneration {
+  readonly protocol: "oauth";
+  readonly authorizationEndpoint: string;
+  readonly tokenEndpoint: string;
+  readonly pkceS256: true;
+  readonly identitySource: {
+    readonly url: string;
+    readonly headers?: Readonly<Record<string, string>>;
+    /** Receives only the freshly fetched authenticated identity body, never a grant. */
+    readonly decodeIdentity: (body: unknown) => Effect.Effect<PlainOAuthIdentity, OAuthProtocolRejected, R>;
+  };
+}
+interface OpenIdClientOAuthProtocolOptions<R = never> {
+  readonly providers: ReadonlyArray<OpenIdClientOidcProvider | OpenIdClientOAuthProvider<R>>;
+  /** Per-request deadline; the method separately limits the complete exchange. */
+  readonly timeoutSeconds: number;
+  /** Trusted server transport. Must honor abort and must not retry or log credentials. */
+  readonly fetch?: CustomFetch;
+}
+//#endregion
+export { OpenIdClientAuthentication, OpenIdClientConfigurationError, OpenIdClientOAuthProtocolOptions, OpenIdClientOAuthProvider, OpenIdClientOidcProvider, PlainOAuthIdentity };
+//# sourceMappingURL=models.d.mts.map

package/dist/oauth/openid-client/models.mjs

@@ -0,0 +1,16 @@
+import { Schema } from "effect";
+//#region src/oauth/openid-client/models.ts
+var OpenIdClientConfigurationError = class extends Schema.TaggedError()("OpenIdClientConfigurationError", { reason: Schema.Literals([
+	"provider",
+	"generation",
+	"issuer",
+	"callback",
+	"authentication",
+	"parameters",
+	"metadata",
+	"identity-source"
+]) }) {};
+//#endregion
+export { OpenIdClientConfigurationError };
+
+//# sourceMappingURL=models.mjs.map

package/dist/oauth/openid-client/models.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"models.mjs","names":[],"sources":["../../../src/oauth/openid-client/models.ts"],"sourcesContent":["import { type Effect, type Redacted, Schema } from \"effect\";\nimport type { CustomFetch } from \"openid-client\";\n\nimport type { OAuthProtocolRejected } from \"../signInErrors\";\nimport type { OAuthProtocolConfiguration, OAuthVerifiedExternalIdentity } from \"../signInModels\";\n\nexport class OpenIdClientConfigurationError extends Schema.TaggedError<OpenIdClientConfigurationError>()(\n  \"OpenIdClientConfigurationError\",\n  {\n    reason: Schema.Literals([\n      \"provider\",\n      \"generation\",\n      \"issuer\",\n      \"callback\",\n      \"authentication\",\n      \"parameters\",\n      \"metadata\",\n      \"identity-source\",\n    ]),\n  },\n) {}\n\nexport type OpenIdClientAuthentication =\n  | { readonly method: \"client_secret_basic\"; readonly secret: Redacted.Redacted<string> }\n  | { readonly method: \"client_secret_post\"; readonly secret: Redacted.Redacted<string> }\n  | { readonly method: \"none\"; readonly publicClient: true };\n\nexport interface PlainOAuthIdentity {\n  readonly subject: string;\n  readonly profile?: OAuthVerifiedExternalIdentity[\"profile\"];\n}\n\ninterface ProviderGeneration {\n  readonly provider: OAuthProtocolConfiguration[\"provider\"];\n  readonly configurationGeneration: OAuthProtocolConfiguration[\"configurationGeneration\"];\n  readonly issuance: \"active\" | \"retired\";\n  /** Preserve this exact issuer identifier, including an optional trailing slash. */\n  readonly issuer: OAuthProtocolConfiguration[\"issuer\"];\n  readonly responseIssuerMode: OAuthProtocolConfiguration[\"responseIssuerMode\"];\n  readonly clientId: string;\n  readonly authentication: OpenIdClientAuthentication;\n  readonly callbacks: ReadonlyArray<{\n    readonly callbackId: OAuthProtocolConfiguration[\"callbackId\"];\n    readonly redirectUri: OAuthProtocolConfiguration[\"redirectUri\"];\n  }>;\n  readonly scopes: ReadonlyArray<string>;\n  readonly authorizationParameters?: Readonly<Record<string, string>>;\n  readonly tokenParameters?: Readonly<Record<string, string>>;\n}\n\nexport interface OpenIdClientOidcProvider extends ProviderGeneration {\n  readonly protocol: \"oidc\";\n  readonly idTokenSignedResponseAlg: \"RS256\";\n  readonly maxAgeSeconds?: number;\n}\n\nexport interface OpenIdClientOAuthProvider<R = never> extends ProviderGeneration {\n  readonly protocol: \"oauth\";\n  readonly authorizationEndpoint: string;\n  readonly tokenEndpoint: string;\n  readonly pkceS256: true;\n  readonly identitySource: {\n    readonly url: string;\n    readonly headers?: Readonly<Record<string, string>>;\n    /** Receives only the freshly fetched authenticated identity body, never a grant. */\n    readonly decodeIdentity: (\n      body: unknown,\n    ) => Effect.Effect<PlainOAuthIdentity, OAuthProtocolRejected, R>;\n  };\n}\n\nexport interface OpenIdClientOAuthProtocolOptions<R = never> {\n  readonly providers: ReadonlyArray<OpenIdClientOidcProvider | OpenIdClientOAuthProvider<R>>;\n  /** Per-request deadline; the method separately limits the complete exchange. */\n  readonly timeoutSeconds: number;\n  /** Trusted server transport. Must honor abort and must not retry or log credentials. */\n  readonly fetch?: CustomFetch;\n}\n"],"mappings":";;AAMA,IAAa,iCAAb,cAAoD,OAAO,YAA4C,CAAC,CACtG,kCACA,EACE,QAAQ,OAAO,SAAS;CACtB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC,EACH,CACF,CAAC,CAAC,CAAC"}

package/dist/oauth/openid-client/protocol.d.mts

@@ -0,0 +1,27 @@
+import { RequestBindingFlowId } from "../../operations/requestBindingModels.mjs";
+import "../../operations/requestBinding.mjs";
+import { OAuthProviderKey } from "../schema.mjs";
+import { OAuthProtocolRejected, OAuthRejected, OAuthUnavailable } from "../signInErrors.mjs";
+import { OAuthCallbackId, OAuthCodeResponse, OAuthProtocolConfiguration, OAuthProtocolPreparation, OAuthTransactionSecrets, OAuthVerifiedExternalIdentity } from "../signInModels.mjs";
+import { OAuthProtocol } from "../OAuthProtocol.mjs";
+import { OpenIdClientConfigurationError, OpenIdClientOAuthProtocolOptions } from "./models.mjs";
+import "./compatibility.mjs";
+import { DateTime, Effect, Layer } from "effect";
+//#region src/oauth/openid-client/protocol.d.ts
+declare const makeOpenIdClientOAuthProtocol: <R = never>(options: OpenIdClientOAuthProtocolOptions<R>) => Effect.Effect<{
+  readonly prepareAuthorization: (input: {
+    readonly provider: OAuthProviderKey;
+    readonly callbackId: typeof OAuthCallbackId.Type;
+    readonly flowId: RequestBindingFlowId;
+  }) => Effect.Effect<OAuthProtocolPreparation, OAuthRejected | OAuthUnavailable>;
+  readonly exchangeVerifiedIdentity: (input: {
+    readonly configuration: OAuthProtocolConfiguration;
+    readonly response: OAuthCodeResponse;
+    readonly secrets: OAuthTransactionSecrets;
+    readonly verificationStartedAt: DateTime.Utc;
+  }) => Effect.Effect<OAuthVerifiedExternalIdentity, OAuthProtocolRejected | OAuthUnavailable>;
+}, OAuthUnavailable | OpenIdClientConfigurationError, R>;
+declare const openIdClientOAuthProtocolLayer: <R = never>(options: OpenIdClientOAuthProtocolOptions<R>) => Layer.Layer<OAuthProtocol, OAuthUnavailable | OpenIdClientConfigurationError, Exclude<R, import("effect/Scope").Scope>>;
+//#endregion
+export { makeOpenIdClientOAuthProtocol, openIdClientOAuthProtocolLayer };
+//# sourceMappingURL=protocol.d.mts.map