@yielded/auth 0.1.0-beta.1

package/dist/oauth/openid-client/protocol.mjs

@@ -0,0 +1,218 @@
+import { reportAuthFailure } from "../../internal/diagnostics.mjs";
+import { OAuthProviderKey } from "../schema.mjs";
+import { RequestBindingFlowId } from "../../operations/requestBindingModels.mjs";
+import { OAuthCallbackId, OAuthCodeResponse, OAuthDisplayProfile, OAuthProtocolConfiguration, OAuthProtocolPreparation, OAuthTransactionSecrets, OAuthVerifiedExternalIdentity } from "../signInModels.mjs";
+import { OAuthProtocolRejected, OAuthRejected, OAuthUnavailable } from "../signInErrors.mjs";
+import { snapshotOAuth } from "../signInSnapshot.mjs";
+import { OAuthProtocol } from "../OAuthProtocol.mjs";
+import { DefiniteTokenRejection } from "./compatibility.mjs";
+import { boundedFetch } from "./transport.mjs";
+import { clientAuthentication, installConfigurations, makeAuthorizationParameters } from "./configuration.mjs";
+import { Cause, DateTime, Effect, Layer, Redacted, Schema } from "effect";
+import * as client from "openid-client";
+//#region src/oauth/openid-client/protocol.ts
+const beginInput = Schema.Struct({
+	provider: OAuthProviderKey,
+	callbackId: OAuthCallbackId,
+	flowId: RequestBindingFlowId
+});
+const exchangeInput = Schema.toType(Schema.Struct({
+	configuration: OAuthProtocolConfiguration,
+	response: OAuthCodeResponse,
+	secrets: OAuthTransactionSecrets,
+	verificationStartedAt: Schema.DateTimeUtcFromMillis
+}));
+const numericDate = Schema.Finite.check(Schema.isBetween({
+	minimum: 0,
+	maximum: 864e10
+}));
+const claimsSchema = Schema.Struct({
+	iss: Schema.String,
+	sub: OAuthVerifiedExternalIdentity.fields.identity.fields.subject,
+	aud: Schema.Union([Schema.String, Schema.Array(Schema.String).check(Schema.isMinLength(1), Schema.isMaxLength(1))]),
+	azp: Schema.optionalKey(Schema.String),
+	exp: numericDate,
+	iat: numericDate,
+	nbf: Schema.optionalKey(numericDate),
+	auth_time: Schema.optionalKey(numericDate)
+});
+const plainIdentitySchema = Schema.Struct({
+	subject: OAuthVerifiedExternalIdentity.fields.identity.fields.subject,
+	profile: Schema.optionalKey(OAuthDisplayProfile)
+});
+const unavailable = () => OAuthUnavailable.make({});
+const rejected = () => OAuthProtocolRejected.make({});
+const unavailableOnDefect = (effect) => effect.pipe(Effect.tapCause((cause) => Cause.hasDies(cause) ? reportAuthFailure("oauth-protocol", cause) : Effect.void), Effect.catchCause((cause) => {
+	if (Cause.hasInterrupts(cause)) return Effect.interrupt;
+	if (Cause.hasDies(cause)) return Effect.fail(unavailable());
+	return Effect.failCause(cause);
+}));
+/** Only precise claim errors and a fully parsed invalid_grant are definite.
+* INVALID_RESPONSE also covers signature/key/transport faults; keep it ambiguous. */
+const grantError = (error) => {
+	if (error instanceof DefiniteTokenRejection || error instanceof client.ClientError && error.cause instanceof DefiniteTokenRejection) return rejected();
+	if (error instanceof client.ClientError && (error.code === "OAUTH_JWT_CLAIM_COMPARISON_FAILED" || error.code === "OAUTH_JWT_TIMESTAMP_CHECK_FAILED")) return rejected();
+	if (error instanceof client.ResponseBodyError && error.status === 400 && error.error === "invalid_grant") return rejected();
+	return unavailable();
+};
+const privateConfiguration = (entry, timeout, fetch, signal, compatibility) => {
+	const provider = entry.provider;
+	const configuration = new client.Configuration(entry.metadata, provider.clientId, {
+		[client.clockSkew]: 0,
+		[client.clockTolerance]: 0,
+		...provider.protocol === "oidc" ? { id_token_signed_response_alg: provider.idTokenSignedResponseAlg } : {}
+	}, clientAuthentication(provider.authentication));
+	configuration.timeout = timeout;
+	const transport = boundedFetch(fetch, signal, entry.allowedUrls);
+	configuration[client.customFetch] = compatibility === void 0 ? transport : async (url, options) => {
+		const response = await transport(url, options);
+		if (url === new URL(entry.metadata.token_endpoint).href) {
+			const body = await response.clone().json();
+			signal.throwIfAborted();
+			compatibility.inspectReceipt({
+				body,
+				status: response.status,
+				contentType: response.headers.get("content-type")
+			}, {
+				scopes: provider.scopes,
+				refreshRequired: false,
+				operation: "authorization_code"
+			});
+			signal.throwIfAborted();
+		}
+		return response;
+	};
+	if (provider.protocol === "oidc") client.enableNonRepudiationChecks(configuration);
+	return configuration;
+};
+const makeOAuthProtocolWithCompatibility = Effect.fn("makeOpenIdClientOAuthProtocol")(function* (options, compatibility) {
+	const context = yield* Effect.context();
+	const { installed, fetch, timeoutSeconds } = yield* installConfigurations(options);
+	const prepareAuthorization = Effect.fn("OpenIdClient.prepareAuthorization")(function* (input) {
+		const request = yield* Schema.decodeEffect(beginInput)(input).pipe(Effect.mapError(() => OAuthRejected.make({})));
+		const entry = installed.find(({ provider }) => provider.issuance === "active" && provider.provider === request.provider);
+		const provider = entry?.provider;
+		const callback = provider?.callbacks.find((candidate) => candidate.callbackId === request.callbackId);
+		if (entry === void 0 || provider === void 0 || callback === void 0) return yield* OAuthRejected.make({});
+		const result = yield* Effect.tryPromise({
+			try: async (signal) => {
+				const configuration = privateConfiguration(entry, timeoutSeconds, fetch, signal, compatibility);
+				const state = client.randomState();
+				const verifier = client.randomPKCECodeVerifier();
+				const nonce = provider.protocol === "oidc" ? client.randomNonce() : void 0;
+				const challenge = await client.calculatePKCECodeChallenge(verifier);
+				signal.throwIfAborted();
+				const url = client.buildAuthorizationUrl(configuration, makeAuthorizationParameters(provider, callback.redirectUri, {
+					state,
+					challenge,
+					...nonce === void 0 ? {} : { nonce }
+				}));
+				return {
+					configuration: {
+						provider: provider.provider,
+						protocol: provider.protocol,
+						configurationGeneration: provider.configurationGeneration,
+						issuer: provider.issuer,
+						responseIssuerMode: provider.responseIssuerMode,
+						callbackId: callback.callbackId,
+						redirectUri: callback.redirectUri
+					},
+					authorizationUrl: Redacted.make(url.href),
+					secrets: {
+						namespace: "effect-auth/oauth-transaction-secrets/v1",
+						state: Redacted.make(state),
+						pkceVerifier: Redacted.make(verifier),
+						...nonce === void 0 ? {} : { oidcNonce: Redacted.make(nonce) }
+					}
+				};
+			},
+			catch: unavailable
+		});
+		return yield* snapshotOAuth(OAuthProtocolPreparation, result);
+	});
+	const exchangeVerifiedIdentity = Effect.fn("OpenIdClient.exchangeVerifiedIdentity")(function* (input) {
+		const request = yield* snapshotOAuth(exchangeInput, input);
+		const saved = request.configuration;
+		const entry = installed.find(({ provider }) => provider.provider === saved.provider && provider.configurationGeneration === saved.configurationGeneration);
+		if (entry === void 0) return yield* unavailable();
+		const provider = entry.provider;
+		const callback = provider.callbacks.find((candidate) => candidate.callbackId === saved.callbackId);
+		if (provider.protocol !== saved.protocol || provider.issuer !== saved.issuer || provider.responseIssuerMode !== saved.responseIssuerMode || callback?.redirectUri !== saved.redirectUri) return yield* unavailable();
+		if (provider.protocol === "oidc" !== (request.secrets.oidcNonce !== void 0) || Redacted.value(request.response.state) !== Redacted.value(request.secrets.state) || (provider.responseIssuerMode === "required" ? request.response.issuer !== provider.issuer : request.response.issuer !== void 0)) return yield* rejected();
+		const startedAt = DateTime.toEpochMillis(request.verificationStartedAt);
+		if (startedAt < 0 || startedAt > DateTime.toEpochMillis(yield* DateTime.now)) return yield* rejected();
+		const exchanged = yield* Effect.tryPromise({
+			try: async (signal) => {
+				const configuration = privateConfiguration(entry, timeoutSeconds, fetch, signal, compatibility);
+				const currentUrl = new URL(saved.redirectUri);
+				currentUrl.searchParams.set("code", Redacted.value(request.response.code));
+				currentUrl.searchParams.set("state", Redacted.value(request.response.state));
+				if (request.response.issuer !== void 0) currentUrl.searchParams.set("iss", request.response.issuer);
+				const tokens = await client.authorizationCodeGrant(configuration, currentUrl, {
+					pkceCodeVerifier: Redacted.value(request.secrets.pkceVerifier),
+					expectedState: Redacted.value(request.secrets.state),
+					...provider.protocol === "oidc" ? {
+						expectedNonce: Redacted.value(request.secrets.oidcNonce),
+						idTokenExpected: true,
+						...provider.maxAgeSeconds === void 0 ? {} : { maxAge: provider.maxAgeSeconds }
+					} : {}
+				}, provider.tokenParameters);
+				signal.throwIfAborted();
+				if (provider.protocol === "oidc") return {
+					protocol: "oidc",
+					claims: tokens.claims()
+				};
+				if (tokens.token_type !== "bearer") throw unavailable();
+				const response = await client.fetchProtectedResource(configuration, tokens.access_token, new URL(provider.identitySource.url), "GET", void 0, new Headers(provider.identitySource.headers));
+				signal.throwIfAborted();
+				if (response.status !== 200 || response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase() !== "application/json") throw unavailable();
+				const body = await response.json();
+				signal.throwIfAborted();
+				return {
+					protocol: "oauth",
+					body
+				};
+			},
+			catch: grantError
+		});
+		if (exchanged.protocol === "oidc") {
+			const claims = yield* Schema.decodeUnknownEffect(claimsSchema)(exchanged.claims).pipe(Effect.mapError(rejected));
+			const now = DateTime.toEpochMillis(yield* DateTime.now) / 1e3;
+			const audience = typeof claims.aud === "string" ? claims.aud : claims.aud[0];
+			if (provider.protocol !== "oidc" || claims.iss !== provider.issuer || audience !== provider.clientId || claims.azp !== void 0 && claims.azp !== provider.clientId || claims.exp <= now || claims.iat > now || claims.nbf !== void 0 && claims.nbf > now || claims.auth_time !== void 0 && claims.auth_time > now || provider.maxAgeSeconds !== void 0 && (claims.auth_time === void 0 || claims.auth_time + provider.maxAgeSeconds < Math.floor(now))) return yield* rejected();
+			return yield* snapshotOAuth(OAuthVerifiedExternalIdentity, {
+				identity: {
+					provider: provider.provider,
+					issuer: provider.issuer,
+					subject: claims.sub
+				},
+				...claims.auth_time === void 0 ? {} : { upstreamAuthenticatedAt: DateTime.makeUnsafe(Math.min(startedAt, claims.auth_time * 1e3)) }
+			});
+		}
+		if (provider.protocol !== "oauth") return yield* unavailable();
+		const decoded = yield* Effect.suspend(() => provider.identitySource.decodeIdentity(exchanged.body)).pipe(Effect.provideContext(context), Effect.catchCause((cause) => {
+			if (Cause.hasInterrupts(cause)) return reportAuthFailure("oauth-identity", cause).pipe(Effect.andThen(Effect.interrupt));
+			if (cause.reasons.length === 1 && cause.reasons[0]?._tag === "Fail" && Schema.is(OAuthProtocolRejected)(cause.reasons[0].error)) return Effect.fail(rejected());
+			return reportAuthFailure("oauth-identity", cause).pipe(Effect.andThen(Effect.fail(unavailable())));
+		}));
+		const identity = yield* Schema.decodeEffect(plainIdentitySchema)(decoded).pipe(Effect.mapError(rejected));
+		return yield* snapshotOAuth(OAuthVerifiedExternalIdentity, {
+			identity: {
+				provider: provider.provider,
+				issuer: provider.issuer,
+				subject: identity.subject
+			},
+			...identity.profile === void 0 ? {} : { profile: identity.profile }
+		});
+	});
+	return OAuthProtocol.of({
+		prepareAuthorization: (input) => unavailableOnDefect(prepareAuthorization(input)),
+		exchangeVerifiedIdentity: (input) => unavailableOnDefect(exchangeVerifiedIdentity(input))
+	});
+}, unavailableOnDefect);
+const makeOpenIdClientOAuthProtocol = (options) => makeOAuthProtocolWithCompatibility(options);
+const openIdClientOAuthProtocolLayer = (options) => Layer.effect(OAuthProtocol, makeOpenIdClientOAuthProtocol(options));
+//#endregion
+export { makeOAuthProtocolWithCompatibility, makeOpenIdClientOAuthProtocol, openIdClientOAuthProtocolLayer };
+
+//# sourceMappingURL=protocol.mjs.map

package/dist/oauth/openid-client/protocol.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.mjs","names":[],"sources":["../../../src/oauth/openid-client/protocol.ts"],"sourcesContent":["import { Cause, DateTime, Effect, Layer, Redacted, Schema } from \"effect\";\nimport * as client from \"openid-client\";\n\nimport { reportAuthFailure } from \"../../internal/diagnostics\";\nimport { RequestBindingFlowId } from \"../../operations/requestBinding\";\nimport { OAuthProtocol } from \"../OAuthProtocol\";\nimport { OAuthProviderKey } from \"../schema\";\nimport { OAuthProtocolRejected, OAuthRejected, OAuthUnavailable } from \"../signInErrors\";\nimport {\n  OAuthCallbackId,\n  OAuthCodeResponse,\n  OAuthDisplayProfile,\n  OAuthProtocolConfiguration,\n  OAuthProtocolPreparation,\n  OAuthTransactionSecrets,\n  OAuthVerifiedExternalIdentity,\n} from \"../signInModels\";\nimport { snapshotOAuth } from \"../signInSnapshot\";\nimport { DefiniteTokenRejection, type TokenCompatibility } from \"./compatibility\";\nimport {\n  clientAuthentication,\n  installConfigurations,\n  makeAuthorizationParameters,\n  type InstalledProvider,\n} from \"./configuration\";\nimport {\n  type OpenIdClientConfigurationError,\n  type OpenIdClientOAuthProtocolOptions,\n} from \"./models\";\nimport { boundedFetch } from \"./transport\";\n\nconst beginInput = Schema.Struct({\n  provider: OAuthProviderKey,\n  callbackId: OAuthCallbackId,\n  flowId: RequestBindingFlowId,\n});\n\nconst exchangeInput = Schema.toType(\n  Schema.Struct({\n    configuration: OAuthProtocolConfiguration,\n    response: OAuthCodeResponse,\n    secrets: OAuthTransactionSecrets,\n    verificationStartedAt: Schema.DateTimeUtcFromMillis,\n  }),\n);\n\nconst numericDate = Schema.Finite.check(Schema.isBetween({ minimum: 0, maximum: 8640000000000 }));\n\nconst claimsSchema = Schema.Struct({\n  iss: Schema.String,\n  sub: OAuthVerifiedExternalIdentity.fields.identity.fields.subject,\n  aud: Schema.Union([\n    Schema.String,\n    Schema.Array(Schema.String).check(Schema.isMinLength(1), Schema.isMaxLength(1)),\n  ]),\n  azp: Schema.optionalKey(Schema.String),\n  exp: numericDate,\n  iat: numericDate,\n  nbf: Schema.optionalKey(numericDate),\n  auth_time: Schema.optionalKey(numericDate),\n});\n\nconst plainIdentitySchema = Schema.Struct({\n  subject: OAuthVerifiedExternalIdentity.fields.identity.fields.subject,\n  profile: Schema.optionalKey(OAuthDisplayProfile),\n});\n\nconst unavailable = () => OAuthUnavailable.make({});\nconst rejected = () => OAuthProtocolRejected.make({});\n\nconst unavailableOnDefect = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n  effect.pipe(\n    Effect.tapCause((cause) =>\n      Cause.hasDies(cause) ? reportAuthFailure(\"oauth-protocol\", cause) : Effect.void,\n    ),\n    Effect.catchCause((cause): Effect.Effect<never, E | OAuthUnavailable> => {\n      if (Cause.hasInterrupts(cause)) return Effect.interrupt;\n      if (Cause.hasDies(cause)) return Effect.fail(unavailable());\n\n      return Effect.failCause(cause);\n    }),\n  );\n\n/** Only precise claim errors and a fully parsed invalid_grant are definite.\n * INVALID_RESPONSE also covers signature/key/transport faults; keep it ambiguous. */\nconst grantError = (error: unknown) => {\n  if (\n    error instanceof DefiniteTokenRejection ||\n    (error instanceof client.ClientError && error.cause instanceof DefiniteTokenRejection)\n  )\n    return rejected();\n  if (\n    error instanceof client.ClientError &&\n    (error.code === \"OAUTH_JWT_CLAIM_COMPARISON_FAILED\" ||\n      error.code === \"OAUTH_JWT_TIMESTAMP_CHECK_FAILED\")\n  )\n    return rejected();\n  if (\n    error instanceof client.ResponseBodyError &&\n    error.status === 400 &&\n    error.error === \"invalid_grant\"\n  )\n    return rejected();\n\n  return unavailable();\n};\n\nconst privateConfiguration = <R>(\n  entry: InstalledProvider<R>,\n  timeout: number,\n  fetch: client.CustomFetch,\n  signal: AbortSignal,\n  compatibility?: TokenCompatibility,\n) => {\n  const provider = entry.provider;\n\n  const configuration = new client.Configuration(\n    entry.metadata,\n    provider.clientId,\n    {\n      [client.clockSkew]: 0,\n      [client.clockTolerance]: 0,\n      ...(provider.protocol === \"oidc\"\n        ? { id_token_signed_response_alg: provider.idTokenSignedResponseAlg }\n        : {}),\n    },\n    clientAuthentication(provider.authentication),\n  );\n\n  configuration.timeout = timeout;\n  const transport = boundedFetch(fetch, signal, entry.allowedUrls);\n\n  configuration[client.customFetch] =\n    compatibility === undefined\n      ? transport\n      : async (url, options) => {\n          const response = await transport(url, options);\n\n          if (url === new URL(entry.metadata.token_endpoint!).href) {\n            const body: unknown = await response.clone().json();\n\n            signal.throwIfAborted();\n            compatibility.inspectReceipt(\n              { body, status: response.status, contentType: response.headers.get(\"content-type\") },\n              {\n                scopes: provider.scopes,\n                refreshRequired: false,\n                operation: \"authorization_code\",\n              },\n            );\n            signal.throwIfAborted();\n          }\n\n          return response;\n        };\n  if (provider.protocol === \"oidc\") client.enableNonRepudiationChecks(configuration);\n\n  return configuration;\n};\n\nexport const makeOAuthProtocolWithCompatibility = Effect.fn(\"makeOpenIdClientOAuthProtocol\")(\n  function* <R = never>(\n    options: OpenIdClientOAuthProtocolOptions<R>,\n    compatibility?: TokenCompatibility,\n  ): Effect.fn.Return<\n    OAuthProtocol[\"Service\"],\n    OpenIdClientConfigurationError | OAuthUnavailable,\n    R\n  > {\n    const context = yield* Effect.context<R>();\n    const { installed, fetch, timeoutSeconds } = yield* installConfigurations(options);\n\n    const prepareAuthorization: OAuthProtocol[\"Service\"][\"prepareAuthorization\"] = Effect.fn(\n      \"OpenIdClient.prepareAuthorization\",\n    )(function* (input) {\n      const request = yield* Schema.decodeEffect(beginInput)(input).pipe(\n        Effect.mapError(() => OAuthRejected.make({})),\n      );\n\n      const entry = installed.find(\n        ({ provider }) => provider.issuance === \"active\" && provider.provider === request.provider,\n      );\n\n      const provider = entry?.provider;\n\n      const callback = provider?.callbacks.find(\n        (candidate) => candidate.callbackId === request.callbackId,\n      );\n\n      if (entry === undefined || provider === undefined || callback === undefined)\n        return yield* OAuthRejected.make({});\n\n      const result = yield* Effect.tryPromise({\n        try: async (signal) => {\n          const configuration = privateConfiguration(\n            entry,\n            timeoutSeconds,\n            fetch,\n            signal,\n            compatibility,\n          );\n\n          const state = client.randomState();\n          const verifier = client.randomPKCECodeVerifier();\n          const nonce = provider.protocol === \"oidc\" ? client.randomNonce() : undefined;\n          const challenge = await client.calculatePKCECodeChallenge(verifier);\n\n          signal.throwIfAborted();\n\n          const url = client.buildAuthorizationUrl(\n            configuration,\n            makeAuthorizationParameters(provider, callback.redirectUri, {\n              state,\n              challenge,\n              ...(nonce === undefined ? {} : { nonce }),\n            }),\n          );\n\n          return {\n            configuration: {\n              provider: provider.provider,\n              protocol: provider.protocol,\n              configurationGeneration: provider.configurationGeneration,\n              issuer: provider.issuer,\n              responseIssuerMode: provider.responseIssuerMode,\n              callbackId: callback.callbackId,\n              redirectUri: callback.redirectUri,\n            },\n            authorizationUrl: Redacted.make(url.href),\n            secrets: {\n              namespace: \"effect-auth/oauth-transaction-secrets/v1\" as const,\n              state: Redacted.make(state),\n              pkceVerifier: Redacted.make(verifier),\n              ...(nonce === undefined ? {} : { oidcNonce: Redacted.make(nonce) }),\n            },\n          };\n        },\n        catch: unavailable,\n      });\n\n      return yield* snapshotOAuth(OAuthProtocolPreparation, result);\n    });\n\n    const exchangeVerifiedIdentity: OAuthProtocol[\"Service\"][\"exchangeVerifiedIdentity\"] =\n      Effect.fn(\"OpenIdClient.exchangeVerifiedIdentity\")(function* (input) {\n        const request = yield* snapshotOAuth(exchangeInput, input);\n        const saved = request.configuration;\n\n        const entry = installed.find(\n          ({ provider }) =>\n            provider.provider === saved.provider &&\n            provider.configurationGeneration === saved.configurationGeneration,\n        );\n\n        if (entry === undefined) return yield* unavailable();\n        const provider = entry.provider;\n\n        const callback = provider.callbacks.find(\n          (candidate) => candidate.callbackId === saved.callbackId,\n        );\n\n        if (\n          provider.protocol !== saved.protocol ||\n          provider.issuer !== saved.issuer ||\n          provider.responseIssuerMode !== saved.responseIssuerMode ||\n          callback?.redirectUri !== saved.redirectUri\n        )\n          return yield* unavailable();\n        if (\n          (provider.protocol === \"oidc\") !== (request.secrets.oidcNonce !== undefined) ||\n          Redacted.value(request.response.state) !== Redacted.value(request.secrets.state) ||\n          (provider.responseIssuerMode === \"required\"\n            ? request.response.issuer !== provider.issuer\n            : request.response.issuer !== undefined)\n        )\n          return yield* rejected();\n        const startedAt = DateTime.toEpochMillis(request.verificationStartedAt);\n\n        if (startedAt < 0 || startedAt > DateTime.toEpochMillis(yield* DateTime.now))\n          return yield* rejected();\n\n        const exchanged = yield* Effect.tryPromise({\n          try: async (signal) => {\n            const configuration = privateConfiguration(\n              entry,\n              timeoutSeconds,\n              fetch,\n              signal,\n              compatibility,\n            );\n\n            const currentUrl = new URL(saved.redirectUri);\n\n            currentUrl.searchParams.set(\"code\", Redacted.value(request.response.code));\n            currentUrl.searchParams.set(\"state\", Redacted.value(request.response.state));\n            if (request.response.issuer !== undefined)\n              currentUrl.searchParams.set(\"iss\", request.response.issuer);\n\n            const tokens = await client.authorizationCodeGrant(\n              configuration,\n              currentUrl,\n              {\n                pkceCodeVerifier: Redacted.value(request.secrets.pkceVerifier),\n                expectedState: Redacted.value(request.secrets.state),\n                ...(provider.protocol === \"oidc\"\n                  ? {\n                      expectedNonce: Redacted.value(request.secrets.oidcNonce!),\n                      idTokenExpected: true,\n                      ...(provider.maxAgeSeconds === undefined\n                        ? {}\n                        : { maxAge: provider.maxAgeSeconds }),\n                    }\n                  : {}),\n              },\n              provider.tokenParameters,\n            );\n\n            signal.throwIfAborted();\n            if (provider.protocol === \"oidc\")\n              return { protocol: \"oidc\" as const, claims: tokens.claims() };\n            if (tokens.token_type !== \"bearer\") throw unavailable();\n\n            const response = await client.fetchProtectedResource(\n              configuration,\n              tokens.access_token,\n              new URL(provider.identitySource.url),\n              \"GET\",\n              undefined,\n              new Headers(provider.identitySource.headers),\n            );\n\n            signal.throwIfAborted();\n            if (\n              response.status !== 200 ||\n              response.headers.get(\"content-type\")?.split(\";\", 1)[0]?.trim().toLowerCase() !==\n                \"application/json\"\n            )\n              throw unavailable();\n            const body: unknown = await response.json();\n\n            signal.throwIfAborted();\n\n            return { protocol: \"oauth\" as const, body };\n          },\n          catch: grantError,\n        });\n\n        if (exchanged.protocol === \"oidc\") {\n          // oxlint-disable-next-line no-restricted-properties -- Project validated foreign ID-token claims into the adapter's stricter bounded profile.\n          const claims = yield* Schema.decodeUnknownEffect(claimsSchema)(exchanged.claims).pipe(\n            Effect.mapError(rejected),\n          );\n\n          const now = DateTime.toEpochMillis(yield* DateTime.now) / 1000;\n          const audience = typeof claims.aud === \"string\" ? claims.aud : claims.aud[0];\n\n          if (\n            provider.protocol !== \"oidc\" ||\n            claims.iss !== provider.issuer ||\n            audience !== provider.clientId ||\n            (claims.azp !== undefined && claims.azp !== provider.clientId) ||\n            claims.exp <= now ||\n            claims.iat > now ||\n            (claims.nbf !== undefined && claims.nbf > now) ||\n            (claims.auth_time !== undefined && claims.auth_time > now) ||\n            (provider.maxAgeSeconds !== undefined &&\n              (claims.auth_time === undefined ||\n                claims.auth_time + provider.maxAgeSeconds < Math.floor(now)))\n          )\n            return yield* rejected();\n\n          return yield* snapshotOAuth(OAuthVerifiedExternalIdentity, {\n            identity: { provider: provider.provider, issuer: provider.issuer, subject: claims.sub },\n            ...(claims.auth_time === undefined\n              ? {}\n              : {\n                  upstreamAuthenticatedAt: DateTime.makeUnsafe(\n                    Math.min(startedAt, claims.auth_time * 1000),\n                  ),\n                }),\n          });\n        }\n        if (provider.protocol !== \"oauth\") return yield* unavailable();\n\n        const decoded = yield* Effect.suspend(() =>\n          provider.identitySource.decodeIdentity(exchanged.body),\n        ).pipe(\n          Effect.provideContext(context),\n          Effect.catchCause(\n            (cause): Effect.Effect<never, OAuthProtocolRejected | OAuthUnavailable> => {\n              if (Cause.hasInterrupts(cause))\n                return reportAuthFailure(\"oauth-identity\", cause).pipe(\n                  Effect.andThen(Effect.interrupt),\n                );\n              if (\n                cause.reasons.length === 1 &&\n                cause.reasons[0]?._tag === \"Fail\" &&\n                Schema.is(OAuthProtocolRejected)(cause.reasons[0].error)\n              )\n                return Effect.fail(rejected());\n\n              return reportAuthFailure(\"oauth-identity\", cause).pipe(\n                Effect.andThen(Effect.fail(unavailable())),\n              );\n            },\n          ),\n        );\n\n        const identity = yield* Schema.decodeEffect(plainIdentitySchema)(decoded).pipe(\n          Effect.mapError(rejected),\n        );\n\n        return yield* snapshotOAuth(OAuthVerifiedExternalIdentity, {\n          identity: {\n            provider: provider.provider,\n            issuer: provider.issuer,\n            subject: identity.subject,\n          },\n          ...(identity.profile === undefined ? {} : { profile: identity.profile }),\n        });\n      });\n\n    return OAuthProtocol.of({\n      prepareAuthorization: (input) => unavailableOnDefect(prepareAuthorization(input)),\n      exchangeVerifiedIdentity: (input) => unavailableOnDefect(exchangeVerifiedIdentity(input)),\n    });\n  },\n  unavailableOnDefect,\n);\n\nexport const makeOpenIdClientOAuthProtocol = <R = never>(\n  options: OpenIdClientOAuthProtocolOptions<R>,\n) => makeOAuthProtocolWithCompatibility(options);\n\nexport const openIdClientOAuthProtocolLayer = <R = never>(\n  options: OpenIdClientOAuthProtocolOptions<R>,\n) => Layer.effect(OAuthProtocol, makeOpenIdClientOAuthProtocol(options));\n"],"mappings":";;;;;;;;;;;;;AA+BA,MAAM,aAAa,OAAO,OAAO;CAC/B,UAAU;CACV,YAAY;CACZ,QAAQ;AACV,CAAC;AAED,MAAM,gBAAgB,OAAO,OAC3B,OAAO,OAAO;CACZ,eAAe;CACf,UAAU;CACV,SAAS;CACT,uBAAuB,OAAO;AAChC,CAAC,CACH;AAEA,MAAM,cAAc,OAAO,OAAO,MAAM,OAAO,UAAU;CAAE,SAAS;CAAG,SAAS;AAAc,CAAC,CAAC;AAEhG,MAAM,eAAe,OAAO,OAAO;CACjC,KAAK,OAAO;CACZ,KAAK,8BAA8B,OAAO,SAAS,OAAO;CAC1D,KAAK,OAAO,MAAM,CAChB,OAAO,QACP,OAAO,MAAM,OAAO,MAAM,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,CAAC,CAAC,CAChF,CAAC;CACD,KAAK,OAAO,YAAY,OAAO,MAAM;CACrC,KAAK;CACL,KAAK;CACL,KAAK,OAAO,YAAY,WAAW;CACnC,WAAW,OAAO,YAAY,WAAW;AAC3C,CAAC;AAED,MAAM,sBAAsB,OAAO,OAAO;CACxC,SAAS,8BAA8B,OAAO,SAAS,OAAO;CAC9D,SAAS,OAAO,YAAY,mBAAmB;AACjD,CAAC;AAED,MAAM,oBAAoB,iBAAiB,KAAK,CAAC,CAAC;AAClD,MAAM,iBAAiB,sBAAsB,KAAK,CAAC,CAAC;AAEpD,MAAM,uBAAgC,WACpC,OAAO,KACL,OAAO,UAAU,UACf,MAAM,QAAQ,KAAK,IAAI,kBAAkB,kBAAkB,KAAK,IAAI,OAAO,IAC7E,GACA,OAAO,YAAY,UAAsD;CACvE,IAAI,MAAM,cAAc,KAAK,GAAG,OAAO,OAAO;CAC9C,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,OAAO,KAAK,YAAY,CAAC;CAE1D,OAAO,OAAO,UAAU,KAAK;AAC/B,CAAC,CACH;;;AAIF,MAAM,cAAc,UAAmB;CACrC,IACE,iBAAiB,0BAChB,iBAAiB,OAAO,eAAe,MAAM,iBAAiB,wBAE/D,OAAO,SAAS;CAClB,IACE,iBAAiB,OAAO,gBACvB,MAAM,SAAS,uCACd,MAAM,SAAS,qCAEjB,OAAO,SAAS;CAClB,IACE,iBAAiB,OAAO,qBACxB,MAAM,WAAW,OACjB,MAAM,UAAU,iBAEhB,OAAO,SAAS;CAElB,OAAO,YAAY;AACrB;AAEA,MAAM,wBACJ,OACA,SACA,OACA,QACA,kBACG;CACH,MAAM,WAAW,MAAM;CAEvB,MAAM,gBAAgB,IAAI,OAAO,cAC/B,MAAM,UACN,SAAS,UACT;GACG,OAAO,YAAY;GACnB,OAAO,iBAAiB;EACzB,GAAI,SAAS,aAAa,SACtB,EAAE,8BAA8B,SAAS,yBAAyB,IAClE,CAAC;CACP,GACA,qBAAqB,SAAS,cAAc,CAC9C;CAEA,cAAc,UAAU;CACxB,MAAM,YAAY,aAAa,OAAO,QAAQ,MAAM,WAAW;CAE/D,cAAc,OAAO,eACnB,kBAAkB,KAAA,IACd,YACA,OAAO,KAAK,YAAY;EACtB,MAAM,WAAW,MAAM,UAAU,KAAK,OAAO;EAE7C,IAAI,QAAQ,IAAI,IAAI,MAAM,SAAS,cAAe,CAAC,CAAC,MAAM;GACxD,MAAM,OAAgB,MAAM,SAAS,MAAM,CAAC,CAAC,KAAK;GAElD,OAAO,eAAe;GACtB,cAAc,eACZ;IAAE;IAAM,QAAQ,SAAS;IAAQ,aAAa,SAAS,QAAQ,IAAI,cAAc;GAAE,GACnF;IACE,QAAQ,SAAS;IACjB,iBAAiB;IACjB,WAAW;GACb,CACF;GACA,OAAO,eAAe;EACxB;EAEA,OAAO;CACT;CACN,IAAI,SAAS,aAAa,QAAQ,OAAO,2BAA2B,aAAa;CAEjF,OAAO;AACT;AAEA,MAAa,qCAAqC,OAAO,GAAG,+BAA+B,CAAC,CAC1F,WACE,SACA,eAKA;CACA,MAAM,UAAU,OAAO,OAAO,QAAW;CACzC,MAAM,EAAE,WAAW,OAAO,mBAAmB,OAAO,sBAAsB,OAAO;CAEjF,MAAM,uBAAyE,OAAO,GACpF,mCACF,CAAC,CAAC,WAAW,OAAO;EAClB,MAAM,UAAU,OAAO,OAAO,aAAa,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,KAC5D,OAAO,eAAe,cAAc,KAAK,CAAC,CAAC,CAAC,CAC9C;EAEA,MAAM,QAAQ,UAAU,MACrB,EAAE,eAAe,SAAS,aAAa,YAAY,SAAS,aAAa,QAAQ,QACpF;EAEA,MAAM,WAAW,OAAO;EAExB,MAAM,WAAW,UAAU,UAAU,MAClC,cAAc,UAAU,eAAe,QAAQ,UAClD;EAEA,IAAI,UAAU,KAAA,KAAa,aAAa,KAAA,KAAa,aAAa,KAAA,GAChE,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;EAErC,MAAM,SAAS,OAAO,OAAO,WAAW;GACtC,KAAK,OAAO,WAAW;IACrB,MAAM,gBAAgB,qBACpB,OACA,gBACA,OACA,QACA,aACF;IAEA,MAAM,QAAQ,OAAO,YAAY;IACjC,MAAM,WAAW,OAAO,uBAAuB;IAC/C,MAAM,QAAQ,SAAS,aAAa,SAAS,OAAO,YAAY,IAAI,KAAA;IACpE,MAAM,YAAY,MAAM,OAAO,2BAA2B,QAAQ;IAElE,OAAO,eAAe;IAEtB,MAAM,MAAM,OAAO,sBACjB,eACA,4BAA4B,UAAU,SAAS,aAAa;KAC1D;KACA;KACA,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;IACzC,CAAC,CACH;IAEA,OAAO;KACL,eAAe;MACb,UAAU,SAAS;MACnB,UAAU,SAAS;MACnB,yBAAyB,SAAS;MAClC,QAAQ,SAAS;MACjB,oBAAoB,SAAS;MAC7B,YAAY,SAAS;MACrB,aAAa,SAAS;KACxB;KACA,kBAAkB,SAAS,KAAK,IAAI,IAAI;KACxC,SAAS;MACP,WAAW;MACX,OAAO,SAAS,KAAK,KAAK;MAC1B,cAAc,SAAS,KAAK,QAAQ;MACpC,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,SAAS,KAAK,KAAK,EAAE;KACnE;IACF;GACF;GACA,OAAO;EACT,CAAC;EAED,OAAO,OAAO,cAAc,0BAA0B,MAAM;CAC9D,CAAC;CAED,MAAM,2BACJ,OAAO,GAAG,uCAAuC,CAAC,CAAC,WAAW,OAAO;EACnE,MAAM,UAAU,OAAO,cAAc,eAAe,KAAK;EACzD,MAAM,QAAQ,QAAQ;EAEtB,MAAM,QAAQ,UAAU,MACrB,EAAE,eACD,SAAS,aAAa,MAAM,YAC5B,SAAS,4BAA4B,MAAM,uBAC/C;EAEA,IAAI,UAAU,KAAA,GAAW,OAAO,OAAO,YAAY;EACnD,MAAM,WAAW,MAAM;EAEvB,MAAM,WAAW,SAAS,UAAU,MACjC,cAAc,UAAU,eAAe,MAAM,UAChD;EAEA,IACE,SAAS,aAAa,MAAM,YAC5B,SAAS,WAAW,MAAM,UAC1B,SAAS,uBAAuB,MAAM,sBACtC,UAAU,gBAAgB,MAAM,aAEhC,OAAO,OAAO,YAAY;EAC5B,IACG,SAAS,aAAa,YAAa,QAAQ,QAAQ,cAAc,KAAA,MAClE,SAAS,MAAM,QAAQ,SAAS,KAAK,MAAM,SAAS,MAAM,QAAQ,QAAQ,KAAK,MAC9E,SAAS,uBAAuB,aAC7B,QAAQ,SAAS,WAAW,SAAS,SACrC,QAAQ,SAAS,WAAW,KAAA,IAEhC,OAAO,OAAO,SAAS;EACzB,MAAM,YAAY,SAAS,cAAc,QAAQ,qBAAqB;EAEtE,IAAI,YAAY,KAAK,YAAY,SAAS,cAAc,OAAO,SAAS,GAAG,GACzE,OAAO,OAAO,SAAS;EAEzB,MAAM,YAAY,OAAO,OAAO,WAAW;GACzC,KAAK,OAAO,WAAW;IACrB,MAAM,gBAAgB,qBACpB,OACA,gBACA,OACA,QACA,aACF;IAEA,MAAM,aAAa,IAAI,IAAI,MAAM,WAAW;IAE5C,WAAW,aAAa,IAAI,QAAQ,SAAS,MAAM,QAAQ,SAAS,IAAI,CAAC;IACzE,WAAW,aAAa,IAAI,SAAS,SAAS,MAAM,QAAQ,SAAS,KAAK,CAAC;IAC3E,IAAI,QAAQ,SAAS,WAAW,KAAA,GAC9B,WAAW,aAAa,IAAI,OAAO,QAAQ,SAAS,MAAM;IAE5D,MAAM,SAAS,MAAM,OAAO,uBAC1B,eACA,YACA;KACE,kBAAkB,SAAS,MAAM,QAAQ,QAAQ,YAAY;KAC7D,eAAe,SAAS,MAAM,QAAQ,QAAQ,KAAK;KACnD,GAAI,SAAS,aAAa,SACtB;MACE,eAAe,SAAS,MAAM,QAAQ,QAAQ,SAAU;MACxD,iBAAiB;MACjB,GAAI,SAAS,kBAAkB,KAAA,IAC3B,CAAC,IACD,EAAE,QAAQ,SAAS,cAAc;KACvC,IACA,CAAC;IACP,GACA,SAAS,eACX;IAEA,OAAO,eAAe;IACtB,IAAI,SAAS,aAAa,QACxB,OAAO;KAAE,UAAU;KAAiB,QAAQ,OAAO,OAAO;IAAE;IAC9D,IAAI,OAAO,eAAe,UAAU,MAAM,YAAY;IAEtD,MAAM,WAAW,MAAM,OAAO,uBAC5B,eACA,OAAO,cACP,IAAI,IAAI,SAAS,eAAe,GAAG,GACnC,OACA,KAAA,GACA,IAAI,QAAQ,SAAS,eAAe,OAAO,CAC7C;IAEA,OAAO,eAAe;IACtB,IACE,SAAS,WAAW,OACpB,SAAS,QAAQ,IAAI,cAAc,CAAC,EAAE,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,YAAY,MACzE,oBAEF,MAAM,YAAY;IACpB,MAAM,OAAgB,MAAM,SAAS,KAAK;IAE1C,OAAO,eAAe;IAEtB,OAAO;KAAE,UAAU;KAAkB;IAAK;GAC5C;GACA,OAAO;EACT,CAAC;EAED,IAAI,UAAU,aAAa,QAAQ;GAEjC,MAAM,SAAS,OAAO,OAAO,oBAAoB,YAAY,CAAC,CAAC,UAAU,MAAM,CAAC,CAAC,KAC/E,OAAO,SAAS,QAAQ,CAC1B;GAEA,MAAM,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG,IAAI;GAC1D,MAAM,WAAW,OAAO,OAAO,QAAQ,WAAW,OAAO,MAAM,OAAO,IAAI;GAE1E,IACE,SAAS,aAAa,UACtB,OAAO,QAAQ,SAAS,UACxB,aAAa,SAAS,YACrB,OAAO,QAAQ,KAAA,KAAa,OAAO,QAAQ,SAAS,YACrD,OAAO,OAAO,OACd,OAAO,MAAM,OACZ,OAAO,QAAQ,KAAA,KAAa,OAAO,MAAM,OACzC,OAAO,cAAc,KAAA,KAAa,OAAO,YAAY,OACrD,SAAS,kBAAkB,KAAA,MACzB,OAAO,cAAc,KAAA,KACpB,OAAO,YAAY,SAAS,gBAAgB,KAAK,MAAM,GAAG,IAE9D,OAAO,OAAO,SAAS;GAEzB,OAAO,OAAO,cAAc,+BAA+B;IACzD,UAAU;KAAE,UAAU,SAAS;KAAU,QAAQ,SAAS;KAAQ,SAAS,OAAO;IAAI;IACtF,GAAI,OAAO,cAAc,KAAA,IACrB,CAAC,IACD,EACE,yBAAyB,SAAS,WAChC,KAAK,IAAI,WAAW,OAAO,YAAY,GAAI,CAC7C,EACF;GACN,CAAC;EACH;EACA,IAAI,SAAS,aAAa,SAAS,OAAO,OAAO,YAAY;EAE7D,MAAM,UAAU,OAAO,OAAO,cAC5B,SAAS,eAAe,eAAe,UAAU,IAAI,CACvD,CAAC,CAAC,KACA,OAAO,eAAe,OAAO,GAC7B,OAAO,YACJ,UAA0E;GACzE,IAAI,MAAM,cAAc,KAAK,GAC3B,OAAO,kBAAkB,kBAAkB,KAAK,CAAC,CAAC,KAChD,OAAO,QAAQ,OAAO,SAAS,CACjC;GACF,IACE,MAAM,QAAQ,WAAW,KACzB,MAAM,QAAQ,EAAE,EAAE,SAAS,UAC3B,OAAO,GAAG,qBAAqB,CAAC,CAAC,MAAM,QAAQ,EAAE,CAAC,KAAK,GAEvD,OAAO,OAAO,KAAK,SAAS,CAAC;GAE/B,OAAO,kBAAkB,kBAAkB,KAAK,CAAC,CAAC,KAChD,OAAO,QAAQ,OAAO,KAAK,YAAY,CAAC,CAAC,CAC3C;EACF,CACF,CACF;EAEA,MAAM,WAAW,OAAO,OAAO,aAAa,mBAAmB,CAAC,CAAC,OAAO,CAAC,CAAC,KACxE,OAAO,SAAS,QAAQ,CAC1B;EAEA,OAAO,OAAO,cAAc,+BAA+B;GACzD,UAAU;IACR,UAAU,SAAS;IACnB,QAAQ,SAAS;IACjB,SAAS,SAAS;GACpB;GACA,GAAI,SAAS,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,SAAS,QAAQ;EACxE,CAAC;CACH,CAAC;CAEH,OAAO,cAAc,GAAG;EACtB,uBAAuB,UAAU,oBAAoB,qBAAqB,KAAK,CAAC;EAChF,2BAA2B,UAAU,oBAAoB,yBAAyB,KAAK,CAAC;CAC1F,CAAC;AACH,GACA,mBACF;AAEA,MAAa,iCACX,YACG,mCAAmC,OAAO;AAE/C,MAAa,kCACX,YACG,MAAM,OAAO,eAAe,8BAA8B,OAAO,CAAC"}

package/dist/oauth/openid-client/transport.mjs

@@ -0,0 +1,59 @@
+//#region src/oauth/openid-client/transport.ts
+const maximumBodyBytes = 1048576;
+/** Foreign Fetch boundary: retain both cancellation authorities through body reads.
+* Buffer only bounded responses, never follow redirects or retry a grant. */
+const boundedFetch = (fetch, effectSignal, allowedUrls) => async (url, options) => {
+	if (!allowedUrls.has(url)) throw new Error("OAuth transport unavailable");
+	const signal = AbortSignal.any([effectSignal, ...options.signal === void 0 ? [] : [options.signal]]);
+	signal.throwIfAborted();
+	const response = await fetch(url, {
+		...options,
+		redirect: "manual",
+		signal
+	});
+	signal.throwIfAborted();
+	if (response.redirected || response.status >= 300 && response.status < 400) {
+		await response.body?.cancel();
+		throw new Error("OAuth transport unavailable");
+	}
+	if (response.body === null) return response;
+	const reader = response.body.getReader();
+	const cancel = () => {
+		reader.cancel().catch(() => void 0);
+	};
+	signal.addEventListener("abort", cancel, { once: true });
+	const chunks = [];
+	let length = 0;
+	try {
+		while (true) {
+			signal.throwIfAborted();
+			const next = await reader.read();
+			signal.throwIfAborted();
+			if (next.done) break;
+			length += next.value.byteLength;
+			if (length > maximumBodyBytes) throw new Error("OAuth transport unavailable");
+			chunks.push(next.value);
+		}
+		const bytes = new Uint8Array(length);
+		let offset = 0;
+		for (const chunk of chunks) {
+			bytes.set(chunk, offset);
+			offset += chunk.byteLength;
+		}
+		return new Response(bytes, {
+			status: response.status,
+			statusText: response.statusText,
+			headers: response.headers
+		});
+	} catch (error) {
+		cancel();
+		throw error;
+	} finally {
+		signal.removeEventListener("abort", cancel);
+		reader.releaseLock();
+	}
+};
+//#endregion
+export { boundedFetch };
+
+//# sourceMappingURL=transport.mjs.map

package/dist/oauth/openid-client/transport.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.mjs","names":[],"sources":["../../../src/oauth/openid-client/transport.ts"],"sourcesContent":["import type { CustomFetch } from \"openid-client\";\n\nconst maximumBodyBytes = 1024 * 1024;\n\n/** Foreign Fetch boundary: retain both cancellation authorities through body reads.\n * Buffer only bounded responses, never follow redirects or retry a grant. */\nexport const boundedFetch =\n  (fetch: CustomFetch, effectSignal: AbortSignal, allowedUrls: ReadonlySet<string>): CustomFetch =>\n  async (url, options) => {\n    if (!allowedUrls.has(url)) throw new Error(\"OAuth transport unavailable\");\n\n    const signal = AbortSignal.any([\n      effectSignal,\n      ...(options.signal === undefined ? [] : [options.signal]),\n    ]);\n\n    signal.throwIfAborted();\n    const response = await fetch(url, { ...options, redirect: \"manual\", signal });\n\n    signal.throwIfAborted();\n    if (response.redirected || (response.status >= 300 && response.status < 400)) {\n      await response.body?.cancel();\n      throw new Error(\"OAuth transport unavailable\");\n    }\n    if (response.body === null) return response;\n    const reader = response.body.getReader();\n\n    const cancel = () => {\n      void reader.cancel().catch(() => undefined);\n    };\n\n    signal.addEventListener(\"abort\", cancel, { once: true });\n    const chunks: Uint8Array[] = [];\n    let length = 0;\n\n    try {\n      while (true) {\n        signal.throwIfAborted();\n        const next = await reader.read();\n\n        signal.throwIfAborted();\n        if (next.done) break;\n        length += next.value.byteLength;\n        if (length > maximumBodyBytes) throw new Error(\"OAuth transport unavailable\");\n        chunks.push(next.value);\n      }\n      const bytes = new Uint8Array(length);\n      let offset = 0;\n\n      for (const chunk of chunks) {\n        bytes.set(chunk, offset);\n        offset += chunk.byteLength;\n      }\n\n      return new Response(bytes, {\n        status: response.status,\n        statusText: response.statusText,\n        headers: response.headers,\n      });\n    } catch (error) {\n      cancel();\n      throw error;\n    } finally {\n      signal.removeEventListener(\"abort\", cancel);\n      reader.releaseLock();\n    }\n  };\n"],"mappings":";AAEA,MAAM,mBAAmB;;;AAIzB,MAAa,gBACV,OAAoB,cAA2B,gBAChD,OAAO,KAAK,YAAY;CACtB,IAAI,CAAC,YAAY,IAAI,GAAG,GAAG,MAAM,IAAI,MAAM,6BAA6B;CAExE,MAAM,SAAS,YAAY,IAAI,CAC7B,cACA,GAAI,QAAQ,WAAW,KAAA,IAAY,CAAC,IAAI,CAAC,QAAQ,MAAM,CACzD,CAAC;CAED,OAAO,eAAe;CACtB,MAAM,WAAW,MAAM,MAAM,KAAK;EAAE,GAAG;EAAS,UAAU;EAAU;CAAO,CAAC;CAE5E,OAAO,eAAe;CACtB,IAAI,SAAS,cAAe,SAAS,UAAU,OAAO,SAAS,SAAS,KAAM;EAC5E,MAAM,SAAS,MAAM,OAAO;EAC5B,MAAM,IAAI,MAAM,6BAA6B;CAC/C;CACA,IAAI,SAAS,SAAS,MAAM,OAAO;CACnC,MAAM,SAAS,SAAS,KAAK,UAAU;CAEvC,MAAM,eAAe;EACnB,OAAY,OAAO,CAAC,CAAC,YAAY,KAAA,CAAS;CAC5C;CAEA,OAAO,iBAAiB,SAAS,QAAQ,EAAE,MAAM,KAAK,CAAC;CACvD,MAAM,SAAuB,CAAC;CAC9B,IAAI,SAAS;CAEb,IAAI;EACF,OAAO,MAAM;GACX,OAAO,eAAe;GACtB,MAAM,OAAO,MAAM,OAAO,KAAK;GAE/B,OAAO,eAAe;GACtB,IAAI,KAAK,MAAM;GACf,UAAU,KAAK,MAAM;GACrB,IAAI,SAAS,kBAAkB,MAAM,IAAI,MAAM,6BAA6B;GAC5E,OAAO,KAAK,KAAK,KAAK;EACxB;EACA,MAAM,QAAQ,IAAI,WAAW,MAAM;EACnC,IAAI,SAAS;EAEb,KAAK,MAAM,SAAS,QAAQ;GAC1B,MAAM,IAAI,OAAO,MAAM;GACvB,UAAU,MAAM;EAClB;EAEA,OAAO,IAAI,SAAS,OAAO;GACzB,QAAQ,SAAS;GACjB,YAAY,SAAS;GACrB,SAAS,SAAS;EACpB,CAAC;CACH,SAAS,OAAO;EACd,OAAO;EACP,MAAM;CACR,UAAU;EACR,OAAO,oBAAoB,SAAS,MAAM;EAC1C,OAAO,YAAY;CACrB;AACF"}

package/dist/oauth/policy.d.mts

@@ -0,0 +1,18 @@
+import { Context, Duration, Layer } from "effect";
+//#region src/oauth/policy.d.ts
+interface OAuthPolicyShape {
+  /** Lifetime of one authorization redirect's `state`. */
+  readonly stateLifetime: Duration.Duration;
+  /**
+   * Access tokens are refreshed this long before their recorded expiry, so a
+   * token handed to a caller does not expire mid-request.
+   */
+  readonly accessTokenRefreshMargin: Duration.Duration;
+}
+declare const defaultOAuthPolicy: OAuthPolicyShape;
+declare const OAuthPolicy: Context.Reference<OAuthPolicyShape>;
+/** Builds an OAuth policy layer by overriding the secure library defaults. */
+declare const layerOAuthPolicy: (overrides?: Partial<OAuthPolicyShape>) => Layer.Layer<never, never, never>;
+//#endregion
+export { OAuthPolicy, OAuthPolicyShape, defaultOAuthPolicy, layerOAuthPolicy };
+//# sourceMappingURL=policy.d.mts.map

package/dist/oauth/policy.mjs

@@ -0,0 +1,16 @@
+import { Context, Duration, Layer } from "effect";
+//#region src/oauth/policy.ts
+const defaultOAuthPolicy = {
+	stateLifetime: Duration.minutes(10),
+	accessTokenRefreshMargin: Duration.minutes(1)
+};
+const OAuthPolicy = Context.Reference("effect-auth/OAuthPolicy", { defaultValue: () => defaultOAuthPolicy });
+/** Builds an OAuth policy layer by overriding the secure library defaults. */
+const layerOAuthPolicy = (overrides = {}) => Layer.succeed(OAuthPolicy)({
+	...defaultOAuthPolicy,
+	...overrides
+});
+//#endregion
+export { OAuthPolicy, defaultOAuthPolicy, layerOAuthPolicy };
+
+//# sourceMappingURL=policy.mjs.map

package/dist/oauth/policy.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.mjs","names":[],"sources":["../../src/oauth/policy.ts"],"sourcesContent":["import { Context, Duration, Layer } from \"effect\";\n\nexport interface OAuthPolicyShape {\n  /** Lifetime of one authorization redirect's `state`. */\n  readonly stateLifetime: Duration.Duration;\n  /**\n   * Access tokens are refreshed this long before their recorded expiry, so a\n   * token handed to a caller does not expire mid-request.\n   */\n  readonly accessTokenRefreshMargin: Duration.Duration;\n}\n\n// Ten minutes comfortably covers a consent screen (with a possible provider\n// sign-in in the middle) while keeping abandoned states short-lived.\nexport const defaultOAuthPolicy: OAuthPolicyShape = {\n  stateLifetime: Duration.minutes(10),\n  accessTokenRefreshMargin: Duration.minutes(1),\n};\n\nexport const OAuthPolicy = Context.Reference<OAuthPolicyShape>(\"effect-auth/OAuthPolicy\", {\n  defaultValue: () => defaultOAuthPolicy,\n});\n\n/** Builds an OAuth policy layer by overriding the secure library defaults. */\nexport const layerOAuthPolicy = (overrides: Partial<OAuthPolicyShape> = {}) =>\n  Layer.succeed(OAuthPolicy)({ ...defaultOAuthPolicy, ...overrides });\n"],"mappings":";;AAcA,MAAa,qBAAuC;CAClD,eAAe,SAAS,QAAQ,EAAE;CAClC,0BAA0B,SAAS,QAAQ,CAAC;AAC9C;AAEA,MAAa,cAAc,QAAQ,UAA4B,2BAA2B,EACxF,oBAAoB,mBACtB,CAAC;;AAGD,MAAa,oBAAoB,YAAuC,CAAC,MACvE,MAAM,QAAQ,WAAW,CAAC,CAAC;CAAE,GAAG;CAAoB,GAAG;AAAU,CAAC"}

package/dist/oauth/registration.d.mts

@@ -0,0 +1,24 @@
+import "../Schema.mjs";
+import "../operations/credentials.mjs";
+import "../operations/operation.mjs";
+import "../identity/models.mjs";
+import "../hooks/models.mjs";
+import "../hooks/LifecycleHooks.mjs";
+import "../hooks/commit.mjs";
+import "../operations/requestBinding.mjs";
+import "../Operations.mjs";
+import "../Auth.mjs";
+import "./registrationModels.mjs";
+import "./signInErrors.mjs";
+import "./signInModels.mjs";
+import "./OAuthSignInPersistence.mjs";
+import { Context, Crypto, Effect, Layer, Schema, Types } from "effect";
+//#region src/oauth/registration.d.ts
+interface RegistrationModule<Id extends string, Kind extends string, Codec> {
+  readonly moduleId: Id;
+  readonly kind: Kind;
+  readonly codec: Types.Invariant<Codec>;
+}
+//#endregion
+export { RegistrationModule };
+//# sourceMappingURL=registration.d.mts.map

package/dist/oauth/registration.mjs

@@ -0,0 +1,177 @@
+import { IdentityConflict } from "../identity/models.mjs";
+import { HookDenied, LifecycleEventId, lifecycleEvent, lifecycleSnapshot } from "../hooks/models.mjs";
+import { reportAuthFailure } from "../internal/diagnostics.mjs";
+import { makeOperation, operationGroup } from "../operations/operation.mjs";
+import { LifecycleHooks } from "../hooks/LifecycleHooks.mjs";
+import { hasCommitScope } from "../hooks/commit.mjs";
+import { OAuthCleanupInput, OAuthModuleId } from "./signInModels.mjs";
+import { OAuthRegistrationAccess, OAuthRegistrationDecision, OAuthRegistrationFingerprint, OAuthRegistrationInspection, OAuthRegistrationIntent, OAuthRegistrationPrivateInput, OAuthRegistrationResult } from "./registrationModels.mjs";
+import { OAuthMethodUnsupported, OAuthRejected, OAuthUnavailable } from "./signInErrors.mjs";
+import { freezeOAuth, snapshotOAuthSync } from "./signInSnapshot.mjs";
+import { credentialDigest } from "./registrationSecrets.mjs";
+import { Cause, Context, Crypto, DateTime, Effect, Encoding, Layer, Schema } from "effect";
+//#region src/oauth/registration.ts
+const Failure = Schema.Union([
+	OAuthRejected,
+	OAuthUnavailable,
+	OAuthMethodUnsupported,
+	IdentityConflict,
+	HookDenied
+]);
+const unexpected = (effect) => effect.pipe(Effect.tapCause((cause) => Cause.hasDies(cause) ? reportAuthFailure("oauth-registration", cause) : Effect.void), Effect.catchDefect(() => Effect.fail(OAuthUnavailable.make({}))));
+/** Optional application registration. The first accepted owner command binds
+* application intent; callback identity, bearer and original binder stay fixed. */
+const makeOAuthRegistration = (moduleId, codec, binding) => {
+	const RegistrationCodec = codec;
+	const CompleteInput = Schema.Struct({
+		...OAuthRegistrationPrivateInput.fields,
+		registration: RegistrationCodec
+	});
+	const RegistrationAuthority = Context.Service(`effect-auth/oauth/${moduleId.length}:${moduleId}/RegistrationAuthority`);
+	const Registrations = Context.Service(`effect-auth/oauth/${moduleId.length}:${moduleId}/Registrations`);
+	const layer = Layer.effect(Registrations, Effect.gen(function* () {
+		const id = yield* Schema.decodeEffect(OAuthModuleId)(moduleId).pipe(Effect.mapError(() => OAuthUnavailable.make({})));
+		const { verify } = yield* binding.RequestBinding;
+		const { read, inspect, cleanup } = yield* RegistrationAuthority;
+		const { before } = yield* LifecycleHooks;
+		const crypto = yield* Crypto.Crypto;
+		const { randomBytes } = crypto;
+		const services = yield* Effect.context();
+		const dataCodec = Schema.toCodecJson(Schema.toType(RegistrationCodec));
+		const snapshotData = Effect.fn("OAuthRegistration.snapshotData")(function* (value) {
+			const encoded = yield* Schema.encodeEffect(dataCodec)(value);
+			const data = yield* Schema.decodeEffect(dataCodec)(encoded);
+			freezeOAuth(data);
+			return data;
+		}, Effect.provide(services), Effect.mapError(() => OAuthRejected.make({})));
+		const noAmbient = Effect.fn("OAuthRegistration.noAmbient")(function* () {
+			if (yield* hasCommitScope) return yield* OAuthMethodUnsupported.make({});
+		});
+		return Registrations.of({
+			planComplete: Effect.fn("OAuthRegistration.planComplete")(function* (raw) {
+				yield* noAmbient();
+				const input = snapshotOAuthSync(OAuthRegistrationPrivateInput, raw);
+				const data = yield* snapshotData(raw.registration);
+				const verified = yield* verify(input.flowId, input.requestBinding).pipe(Effect.mapError((error) => error._tag === "RequestBindingInvalid" ? OAuthRejected.make({}) : OAuthUnavailable.make({})));
+				const access = snapshotOAuthSync(OAuthRegistrationAccess, {
+					moduleId: id,
+					reference: input.reference,
+					flowId: input.flowId,
+					requestBindingVerifier: verified.verifier,
+					requestBindingExpiresAtMillis: verified.expiresAtMillis,
+					credentialDigest: yield* credentialDigest(id, input.reference, input.flowId, input.credential),
+					nowMillis: DateTime.toEpochMillis(yield* DateTime.now)
+				});
+				const found = yield* read(snapshotOAuthSync(OAuthRegistrationAccess, access));
+				if (found === void 0) return yield* OAuthRejected.make({});
+				const current = snapshotOAuthSync(OAuthRegistrationInspection, found);
+				const intent = current.intent;
+				const context = intent.context;
+				if (intent.reference !== access.reference || context.moduleId !== id || context.flowId !== access.flowId || context.requestBindingVerifier !== access.requestBindingVerifier || context.requestBindingExpiresAtMillis !== access.requestBindingExpiresAtMillis || intent.credentialDigest !== access.credentialDigest || intent.identity.provider !== context.provider || intent.identity.issuer !== context.issuer || intent.claimedAtMillis < context.issuedAtMillis || intent.claimedAtMillis >= context.expiresAtMillis || intent.issuedAtMillis < intent.claimedAtMillis || intent.verifiedAtMillis > intent.issuedAtMillis || intent.expiresAtMillis <= intent.issuedAtMillis || intent.expiresAtMillis > context.requestBindingExpiresAtMillis || intent.expiresAtMillis <= access.nowMillis || intent.retentionUntilMillis < intent.expiresAtMillis) return yield* OAuthRejected.make({});
+				const inspected = yield* inspect({
+					intent: snapshotOAuthSync(OAuthRegistrationIntent, intent),
+					registration: yield* snapshotData(data)
+				});
+				const checked = snapshotOAuthSync(Schema.Struct({
+					fingerprint: OAuthRegistrationFingerprint,
+					eligible: Schema.Boolean
+				}), inspected);
+				const application = current.application;
+				if (application._tag === "Unbound") {
+					if (!checked.eligible) return yield* OAuthRejected.make({});
+				} else if (application.commandId !== input.commandId || application.fingerprint !== checked.fingerprint) return yield* IdentityConflict.make({});
+				const snapshot = lifecycleSnapshot({
+					action: "registration",
+					operation: `${moduleId}/oauth-registration`,
+					method: context.protocol,
+					identifiers: []
+				});
+				if (application._tag === "Unbound") yield* before(lifecycleSnapshot(snapshot));
+				const eventBytes = yield* randomBytes(32).pipe(Effect.mapError(() => OAuthUnavailable.make({})));
+				const event = lifecycleEvent({
+					id: LifecycleEventId.make(Encoding.encodeBase64Url(eventBytes)),
+					occurredAtMillis: DateTime.toEpochMillis(yield* DateTime.now),
+					snapshot
+				});
+				eventBytes.fill(0);
+				const ownerData = yield* snapshotData(data);
+				const prepare = (rawDecision, journal) => {
+					const decision = snapshotOAuthSync(OAuthRegistrationDecision, rawDecision);
+					if (decision._tag === "Registered" && !decision.replayed) journal.stage(event);
+					const accepted = decision._tag === "Registered" || decision._tag === "ProvisioningPending";
+					return journal.prepare({
+						value: decision._tag === "Registered" ? { _tag: "RegistrationAccepted" } : decision._tag === "ProvisioningPending" ? {
+							_tag: "ProvisioningPending",
+							reference: decision.reference
+						} : { _tag: decision._tag },
+						credentialCommands: accepted && !decision.replayed ? [{
+							_tag: "Clear",
+							slot: "registration"
+						}, {
+							_tag: "Clear",
+							slot: "request-binding"
+						}] : []
+					});
+				};
+				let attempted = false;
+				const commit = Effect.gen(function* () {
+					if (attempted) return yield* OAuthUnavailable.make({});
+					attempted = true;
+					const { register } = yield* RegistrationAuthority;
+					return yield* register({
+						access: snapshotOAuthSync(OAuthRegistrationAccess, access),
+						intent: snapshotOAuthSync(OAuthRegistrationIntent, intent),
+						commandId: input.commandId,
+						registration: ownerData,
+						fingerprint: checked.fingerprint
+					}, prepare);
+				}).pipe(unexpected);
+				return Object.freeze({ commit });
+			}, Effect.provideService(Crypto.Crypto, crypto), unexpected),
+			cleanup: Effect.fn("OAuthRegistration.cleanup")(function* (limit) {
+				yield* noAmbient();
+				const input = yield* Schema.decodeEffect(OAuthCleanupInput)({
+					moduleId: id,
+					limit,
+					nowMillis: DateTime.toEpochMillis(yield* DateTime.now)
+				}).pipe(Effect.mapError(() => OAuthRejected.make({})));
+				return yield* (yield* cleanup(input, (value, journal) => journal.prepare(snapshotOAuthSync(Schema.Struct({
+					removed: Schema.Natural,
+					hasMore: Schema.Boolean
+				}), value)))).read.pipe(Effect.mapError(() => OAuthUnavailable.make({})));
+			}, unexpected)
+		});
+	}));
+	const Complete = makeOperation(`${moduleId}/registration/complete`, {
+		payload: CompleteInput,
+		success: OAuthRegistrationResult,
+		error: Failure,
+		access: "any",
+		exposure: "public",
+		replay: "single-use",
+		credentials: true
+	});
+	const handlersLayer = Complete.credentialHandlerLayer(Effect.fn("OAuthRegistration.Complete")(function* (input) {
+		const result = yield* (yield* (yield* (yield* Registrations).planComplete(input)).commit).read.pipe(Effect.mapError(() => OAuthUnavailable.make({})));
+		if (result.value._tag === "Rejected") return yield* OAuthRejected.make({});
+		if (result.value._tag === "Conflict") return yield* IdentityConflict.make({});
+		return {
+			value: result.value,
+			credentialCommands: result.credentialCommands
+		};
+	}));
+	return Object.freeze({
+		RegistrationCodec,
+		CompleteInput,
+		RegistrationAuthority,
+		Registrations,
+		layer,
+		operations: Object.freeze({ Complete }),
+		handlersLayer,
+		group: operationGroup(Complete)
+	});
+};
+//#endregion
+export { makeOAuthRegistration };
+
+//# sourceMappingURL=registration.mjs.map

package/dist/oauth/registration.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"registration.mjs","names":[],"sources":["../../src/oauth/registration.ts"],"sourcesContent":["import {\n  Cause,\n  Context,\n  Crypto,\n  DateTime,\n  Effect,\n  Encoding,\n  Layer,\n  Schema,\n  type Types,\n} from \"effect\";\n\nimport { hasCommitScope, type PreparedCommit } from \"../hooks/commit\";\nimport { LifecycleHooks } from \"../hooks/LifecycleHooks\";\nimport { HookDenied, LifecycleEventId, lifecycleEvent, lifecycleSnapshot } from \"../hooks/models\";\nimport { IdentityConflict } from \"../identity/models\";\nimport { reportAuthFailure } from \"../internal/diagnostics\";\nimport type { AuthOperationResult } from \"../operations/credentials\";\nimport { makeOperation, operationGroup } from \"../operations/operation\";\nimport type { makeRequestBinding } from \"../operations/requestBinding\";\nimport type { TokenDigest } from \"../Schema\";\nimport type { PrepareOAuthCommit } from \"./OAuthSignInPersistence\";\nimport {\n  OAuthRegistrationAccess,\n  OAuthRegistrationFingerprint,\n  OAuthRegistrationDecision,\n  OAuthRegistrationInspection,\n  OAuthRegistrationIntent,\n  OAuthRegistrationPrivateInput,\n  OAuthRegistrationResult,\n} from \"./registrationModels\";\nimport { credentialDigest } from \"./registrationSecrets\";\nimport { OAuthMethodUnsupported, OAuthRejected, OAuthUnavailable } from \"./signInErrors\";\nimport type { OAuthCommandId } from \"./signInModels\";\nimport { OAuthCleanupInput, OAuthModuleId } from \"./signInModels\";\nimport { freezeOAuth, snapshotOAuthSync } from \"./signInSnapshot\";\n\nconst Failure = Schema.Union([\n  OAuthRejected,\n  OAuthUnavailable,\n  OAuthMethodUnsupported,\n  IdentityConflict,\n  HookDenied,\n]);\n\ntype Failure = typeof Failure.Type;\n\nconst unexpected = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n  effect.pipe(\n    Effect.tapCause((cause) =>\n      Cause.hasDies(cause) ? reportAuthFailure(\"oauth-registration\", cause) : Effect.void,\n    ),\n    Effect.catchDefect(() => Effect.fail(OAuthUnavailable.make({}))),\n  );\n\nexport interface RegistrationModule<Id extends string, Kind extends string, Codec> {\n  readonly moduleId: Id;\n  readonly kind: Kind;\n  readonly codec: Types.Invariant<Codec>;\n}\n\n/** Optional application registration. The first accepted owner command binds\n * application intent; callback identity, bearer and original binder stay fixed. */\nexport const makeOAuthRegistration = <\n  const Id extends string,\n  Registration extends Schema.Codec<unknown, unknown, unknown, unknown>,\n>(\n  moduleId: Id,\n  codec: Registration,\n  binding: ReturnType<typeof makeRequestBinding<Id, \"oauth-entry\">>,\n) => {\n  const RegistrationCodec: Schema.Codec<\n    Registration[\"Type\"],\n    Registration[\"Encoded\"],\n    Registration[\"DecodingServices\"],\n    Registration[\"EncodingServices\"]\n  > = codec;\n\n  const CompleteInput = Schema.Struct({\n    ...OAuthRegistrationPrivateInput.fields,\n    registration: RegistrationCodec,\n  });\n\n  const RegistrationAuthority = Context.Service<\n    RegistrationModule<Id, \"authority\", Registration>,\n    {\n      /** Nonconsuming authenticated lookup. Match both private digests, module/flow/\n       * reference, immutable expiry and accepted generation. Wrong input never binds. */\n      readonly read: (\n        access: OAuthRegistrationAccess,\n      ) => Effect.Effect<OAuthRegistrationInspection | undefined, OAuthUnavailable>;\n      /** Deterministic versioned fingerprint of EVERY meaningful application field.\n       * Roles/tenant/invitations require application authorization; profile email is\n       * not verified. This callback receives its own detached Type graph. */\n      readonly inspect: (input: {\n        readonly intent: OAuthRegistrationIntent;\n        readonly registration: Registration[\"Type\"];\n      }) => Effect.Effect<\n        { readonly fingerprint: TokenDigest; readonly eligible: boolean },\n        OAuthUnavailable\n      >;\n      /** One physical owner compares exact intent/access/current time and first binds\n       * command + fingerprint while provisioning subject + unique full external tuple\n       * + usable OAuth credential/shared factor, or recording protected pending work.\n       * Before external work, pending must reserve the full external tuple across\n       * ALL intents and provisioning jobs in this same owner. Pending-vs-pending and\n       * pending-vs-registration races have one winner and one stable provisioning\n       * identity; an unresolved reservation is never released by bearer expiry.\n       * No orphan, email merge, existing-owner adoption or generic provision-then-bind.\n       * Final eligibility/uniqueness is authoritative. No standalone Bound state.\n       * Exact replay returns stored metadata with replayed=true, without provisioning\n       * or events. Replay equality includes the complete immutable intent (reference,\n       * original flow/binder and external tuple), not only its application fingerprint.\n       * Reusing a module/command for a different intent or data conflicts. Unknown is\n       * never rollback/reset.\n       * Pending preserves exact application data and stable provisioning identity\n       * BEFORE external work; its reference grants no recovery authority. Prepare and\n       * declarative provisioning snapshots are synchronous and precede physical commit.\n       */\n      readonly register: <A>(\n        input: {\n          readonly access: OAuthRegistrationAccess;\n          readonly intent: OAuthRegistrationIntent;\n          readonly commandId: typeof OAuthCommandId.Type;\n          readonly registration: Registration[\"Type\"];\n          readonly fingerprint: TokenDigest;\n        },\n        prepare: PrepareOAuthCommit<OAuthRegistrationDecision, A>,\n      ) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;\n      /** Bounded authority-time/CAS cleanup of expired unbound or proven terminal\n       * records only after retention. Never remove unresolved ProvisioningPending. */\n      readonly cleanup: <A>(\n        input: OAuthCleanupInput,\n        prepare: PrepareOAuthCommit<{ readonly removed: number; readonly hasMore: boolean }, A>,\n      ) => Effect.Effect<PreparedCommit<A>, OAuthUnavailable>;\n    }\n  >(`effect-auth/oauth/${moduleId.length}:${moduleId}/RegistrationAuthority`);\n\n  type Result = AuthOperationResult<\n    | typeof OAuthRegistrationResult.Type\n    | { readonly _tag: \"Rejected\" }\n    | { readonly _tag: \"Conflict\" }\n  >;\n  type Plan = {\n    /** One execution under the current authority. A fresh plan is required after failure. */\n    readonly commit: Effect.Effect<\n      PreparedCommit<Result>,\n      OAuthUnavailable,\n      typeof RegistrationAuthority.Identifier\n    >;\n  };\n\n  const Registrations = Context.Service<\n    RegistrationModule<Id, \"registrations\", Registration>,\n    {\n      readonly planComplete: (input: typeof CompleteInput.Type) => Effect.Effect<Plan, Failure>;\n      readonly cleanup: (\n        limit: number,\n      ) => Effect.Effect<{ readonly removed: number; readonly hasMore: boolean }, Failure>;\n    }\n  >(`effect-auth/oauth/${moduleId.length}:${moduleId}/Registrations`);\n\n  const layer = Layer.effect(\n    Registrations,\n    Effect.gen(function* () {\n      const id = yield* Schema.decodeEffect(OAuthModuleId)(moduleId).pipe(\n        Effect.mapError(() => OAuthUnavailable.make({})),\n      );\n\n      const { verify } = yield* binding.RequestBinding;\n      const { read, inspect, cleanup } = yield* RegistrationAuthority;\n      const { before } = yield* LifecycleHooks;\n      const crypto = yield* Crypto.Crypto;\n      const { randomBytes } = crypto;\n\n      const services = yield* Effect.context<\n        Registration[\"DecodingServices\"] | Registration[\"EncodingServices\"]\n      >();\n\n      const dataCodec = Schema.toCodecJson(Schema.toType(RegistrationCodec));\n\n      const snapshotData = Effect.fn(\"OAuthRegistration.snapshotData\")(\n        function* (value: Registration[\"Type\"]) {\n          const encoded = yield* Schema.encodeEffect(dataCodec)(value);\n          const data = yield* Schema.decodeEffect(dataCodec)(encoded);\n\n          freezeOAuth(data);\n\n          return data;\n        },\n        Effect.provide(services),\n        Effect.mapError(() => OAuthRejected.make({})),\n      );\n\n      const noAmbient = Effect.fn(\"OAuthRegistration.noAmbient\")(function* () {\n        if (yield* hasCommitScope) return yield* OAuthMethodUnsupported.make({});\n      });\n\n      return Registrations.of({\n        planComplete: Effect.fn(\"OAuthRegistration.planComplete\")(\n          function* (raw) {\n            yield* noAmbient();\n            const input = snapshotOAuthSync(OAuthRegistrationPrivateInput, raw);\n            const data = yield* snapshotData(raw.registration);\n\n            const verified = yield* verify(input.flowId, input.requestBinding).pipe(\n              Effect.mapError((error) =>\n                error._tag === \"RequestBindingInvalid\"\n                  ? OAuthRejected.make({})\n                  : OAuthUnavailable.make({}),\n              ),\n            );\n\n            const access = snapshotOAuthSync(OAuthRegistrationAccess, {\n              moduleId: id,\n              reference: input.reference,\n              flowId: input.flowId,\n              requestBindingVerifier: verified.verifier,\n              requestBindingExpiresAtMillis: verified.expiresAtMillis,\n              credentialDigest: yield* credentialDigest(\n                id,\n                input.reference,\n                input.flowId,\n                input.credential,\n              ),\n              nowMillis: DateTime.toEpochMillis(yield* DateTime.now),\n            });\n\n            const found = yield* read(snapshotOAuthSync(OAuthRegistrationAccess, access));\n\n            if (found === undefined) return yield* OAuthRejected.make({});\n            const current = snapshotOAuthSync(OAuthRegistrationInspection, found);\n            const intent = current.intent;\n            const context = intent.context;\n\n            if (\n              intent.reference !== access.reference ||\n              context.moduleId !== id ||\n              context.flowId !== access.flowId ||\n              context.requestBindingVerifier !== access.requestBindingVerifier ||\n              context.requestBindingExpiresAtMillis !== access.requestBindingExpiresAtMillis ||\n              intent.credentialDigest !== access.credentialDigest ||\n              intent.identity.provider !== context.provider ||\n              intent.identity.issuer !== context.issuer ||\n              intent.claimedAtMillis < context.issuedAtMillis ||\n              intent.claimedAtMillis >= context.expiresAtMillis ||\n              intent.issuedAtMillis < intent.claimedAtMillis ||\n              intent.verifiedAtMillis > intent.issuedAtMillis ||\n              intent.expiresAtMillis <= intent.issuedAtMillis ||\n              intent.expiresAtMillis > context.requestBindingExpiresAtMillis ||\n              intent.expiresAtMillis <= access.nowMillis ||\n              intent.retentionUntilMillis < intent.expiresAtMillis\n            )\n              return yield* OAuthRejected.make({});\n\n            const inspected = yield* inspect({\n              intent: snapshotOAuthSync(OAuthRegistrationIntent, intent),\n              registration: yield* snapshotData(data),\n            });\n\n            const checked = snapshotOAuthSync(\n              Schema.Struct({\n                fingerprint: OAuthRegistrationFingerprint,\n                eligible: Schema.Boolean,\n              }),\n              inspected,\n            );\n\n            const application = current.application;\n\n            if (application._tag === \"Unbound\") {\n              if (!checked.eligible) return yield* OAuthRejected.make({});\n            } else if (\n              application.commandId !== input.commandId ||\n              application.fingerprint !== checked.fingerprint\n            )\n              return yield* IdentityConflict.make({});\n\n            const snapshot = lifecycleSnapshot({\n              action: \"registration\",\n              operation: `${moduleId}/oauth-registration`,\n              method: context.protocol,\n              identifiers: [],\n            });\n\n            if (application._tag === \"Unbound\") yield* before(lifecycleSnapshot(snapshot));\n\n            const eventBytes = yield* randomBytes(32).pipe(\n              Effect.mapError(() => OAuthUnavailable.make({})),\n            );\n\n            const event = lifecycleEvent({\n              id: LifecycleEventId.make(Encoding.encodeBase64Url(eventBytes)),\n              occurredAtMillis: DateTime.toEpochMillis(yield* DateTime.now),\n              snapshot,\n            });\n\n            eventBytes.fill(0);\n            const ownerData = yield* snapshotData(data);\n\n            const prepare: PrepareOAuthCommit<OAuthRegistrationDecision, Result> = (\n              rawDecision,\n              journal,\n            ) => {\n              const decision = snapshotOAuthSync(OAuthRegistrationDecision, rawDecision);\n\n              if (decision._tag === \"Registered\" && !decision.replayed) journal.stage(event);\n\n              const accepted =\n                decision._tag === \"Registered\" || decision._tag === \"ProvisioningPending\";\n\n              return journal.prepare({\n                value:\n                  decision._tag === \"Registered\"\n                    ? { _tag: \"RegistrationAccepted\" as const }\n                    : decision._tag === \"ProvisioningPending\"\n                      ? { _tag: \"ProvisioningPending\" as const, reference: decision.reference }\n                      : { _tag: decision._tag },\n                credentialCommands:\n                  accepted && !decision.replayed\n                    ? [\n                        { _tag: \"Clear\" as const, slot: \"registration\" as const },\n                        { _tag: \"Clear\" as const, slot: \"request-binding\" as const },\n                      ]\n                    : [],\n              });\n            };\n\n            let attempted = false;\n\n            const commit = Effect.gen(function* () {\n              if (attempted) return yield* OAuthUnavailable.make({});\n              attempted = true;\n              const { register } = yield* RegistrationAuthority;\n\n              return yield* register(\n                {\n                  access: snapshotOAuthSync(OAuthRegistrationAccess, access),\n                  intent: snapshotOAuthSync(OAuthRegistrationIntent, intent),\n                  commandId: input.commandId,\n                  registration: ownerData,\n                  fingerprint: checked.fingerprint,\n                },\n                prepare,\n              );\n            }).pipe(unexpected);\n\n            return Object.freeze({ commit });\n          },\n          Effect.provideService(Crypto.Crypto, crypto),\n          unexpected,\n        ),\n        cleanup: Effect.fn(\"OAuthRegistration.cleanup\")(function* (limit) {\n          yield* noAmbient();\n\n          const input = yield* Schema.decodeEffect(OAuthCleanupInput)({\n            moduleId: id,\n            limit,\n            nowMillis: DateTime.toEpochMillis(yield* DateTime.now),\n          }).pipe(Effect.mapError(() => OAuthRejected.make({})));\n\n          const receipt = yield* cleanup(input, (value, journal) =>\n            journal.prepare(\n              snapshotOAuthSync(\n                Schema.Struct({ removed: Schema.Natural, hasMore: Schema.Boolean }),\n                value,\n              ),\n            ),\n          );\n\n          return yield* receipt.read.pipe(Effect.mapError(() => OAuthUnavailable.make({})));\n        }, unexpected),\n      });\n    }),\n  );\n\n  const Complete = makeOperation(`${moduleId}/registration/complete`, {\n    payload: CompleteInput,\n    success: OAuthRegistrationResult,\n    error: Failure,\n    access: \"any\",\n    exposure: \"public\",\n    replay: \"single-use\",\n    credentials: true,\n  });\n\n  const handlersLayer = Complete.credentialHandlerLayer(\n    Effect.fn(\"OAuthRegistration.Complete\")(function* (input) {\n      const plan = yield* (yield* Registrations).planComplete(input);\n      const receipt = yield* plan.commit;\n      const result = yield* receipt.read.pipe(Effect.mapError(() => OAuthUnavailable.make({})));\n\n      if (result.value._tag === \"Rejected\") return yield* OAuthRejected.make({});\n      if (result.value._tag === \"Conflict\") return yield* IdentityConflict.make({});\n\n      return { value: result.value, credentialCommands: result.credentialCommands };\n    }),\n  );\n\n  return Object.freeze({\n    RegistrationCodec,\n    CompleteInput,\n    RegistrationAuthority,\n    Registrations,\n    layer,\n    operations: Object.freeze({ Complete }),\n    handlersLayer,\n    group: operationGroup(Complete),\n  });\n};\n"],"mappings":";;;;;;;;;;;;;AAqCA,MAAM,UAAU,OAAO,MAAM;CAC3B;CACA;CACA;CACA;CACA;AACF,CAAC;AAID,MAAM,cAAuB,WAC3B,OAAO,KACL,OAAO,UAAU,UACf,MAAM,QAAQ,KAAK,IAAI,kBAAkB,sBAAsB,KAAK,IAAI,OAAO,IACjF,GACA,OAAO,kBAAkB,OAAO,KAAK,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC,CACjE;;;AAUF,MAAa,yBAIX,UACA,OACA,YACG;CACH,MAAM,oBAKF;CAEJ,MAAM,gBAAgB,OAAO,OAAO;EAClC,GAAG,8BAA8B;EACjC,cAAc;CAChB,CAAC;CAED,MAAM,wBAAwB,QAAQ,QAqDpC,qBAAqB,SAAS,OAAO,GAAG,SAAS,uBAAuB;CAgB1E,MAAM,gBAAgB,QAAQ,QAQ5B,qBAAqB,SAAS,OAAO,GAAG,SAAS,eAAe;CAElE,MAAM,QAAQ,MAAM,OAClB,eACA,OAAO,IAAI,aAAa;EACtB,MAAM,KAAK,OAAO,OAAO,aAAa,aAAa,CAAC,CAAC,QAAQ,CAAC,CAAC,KAC7D,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CACjD;EAEA,MAAM,EAAE,WAAW,OAAO,QAAQ;EAClC,MAAM,EAAE,MAAM,SAAS,YAAY,OAAO;EAC1C,MAAM,EAAE,WAAW,OAAO;EAC1B,MAAM,SAAS,OAAO,OAAO;EAC7B,MAAM,EAAE,gBAAgB;EAExB,MAAM,WAAW,OAAO,OAAO,QAE7B;EAEF,MAAM,YAAY,OAAO,YAAY,OAAO,OAAO,iBAAiB,CAAC;EAErE,MAAM,eAAe,OAAO,GAAG,gCAAgC,CAAC,CAC9D,WAAW,OAA6B;GACtC,MAAM,UAAU,OAAO,OAAO,aAAa,SAAS,CAAC,CAAC,KAAK;GAC3D,MAAM,OAAO,OAAO,OAAO,aAAa,SAAS,CAAC,CAAC,OAAO;GAE1D,YAAY,IAAI;GAEhB,OAAO;EACT,GACA,OAAO,QAAQ,QAAQ,GACvB,OAAO,eAAe,cAAc,KAAK,CAAC,CAAC,CAAC,CAC9C;EAEA,MAAM,YAAY,OAAO,GAAG,6BAA6B,CAAC,CAAC,aAAa;GACtE,IAAI,OAAO,gBAAgB,OAAO,OAAO,uBAAuB,KAAK,CAAC,CAAC;EACzE,CAAC;EAED,OAAO,cAAc,GAAG;GACtB,cAAc,OAAO,GAAG,gCAAgC,CAAC,CACvD,WAAW,KAAK;IACd,OAAO,UAAU;IACjB,MAAM,QAAQ,kBAAkB,+BAA+B,GAAG;IAClE,MAAM,OAAO,OAAO,aAAa,IAAI,YAAY;IAEjD,MAAM,WAAW,OAAO,OAAO,MAAM,QAAQ,MAAM,cAAc,CAAC,CAAC,KACjE,OAAO,UAAU,UACf,MAAM,SAAS,0BACX,cAAc,KAAK,CAAC,CAAC,IACrB,iBAAiB,KAAK,CAAC,CAAC,CAC9B,CACF;IAEA,MAAM,SAAS,kBAAkB,yBAAyB;KACxD,UAAU;KACV,WAAW,MAAM;KACjB,QAAQ,MAAM;KACd,wBAAwB,SAAS;KACjC,+BAA+B,SAAS;KACxC,kBAAkB,OAAO,iBACvB,IACA,MAAM,WACN,MAAM,QACN,MAAM,UACR;KACA,WAAW,SAAS,cAAc,OAAO,SAAS,GAAG;IACvD,CAAC;IAED,MAAM,QAAQ,OAAO,KAAK,kBAAkB,yBAAyB,MAAM,CAAC;IAE5E,IAAI,UAAU,KAAA,GAAW,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;IAC5D,MAAM,UAAU,kBAAkB,6BAA6B,KAAK;IACpE,MAAM,SAAS,QAAQ;IACvB,MAAM,UAAU,OAAO;IAEvB,IACE,OAAO,cAAc,OAAO,aAC5B,QAAQ,aAAa,MACrB,QAAQ,WAAW,OAAO,UAC1B,QAAQ,2BAA2B,OAAO,0BAC1C,QAAQ,kCAAkC,OAAO,iCACjD,OAAO,qBAAqB,OAAO,oBACnC,OAAO,SAAS,aAAa,QAAQ,YACrC,OAAO,SAAS,WAAW,QAAQ,UACnC,OAAO,kBAAkB,QAAQ,kBACjC,OAAO,mBAAmB,QAAQ,mBAClC,OAAO,iBAAiB,OAAO,mBAC/B,OAAO,mBAAmB,OAAO,kBACjC,OAAO,mBAAmB,OAAO,kBACjC,OAAO,kBAAkB,QAAQ,iCACjC,OAAO,mBAAmB,OAAO,aACjC,OAAO,uBAAuB,OAAO,iBAErC,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;IAErC,MAAM,YAAY,OAAO,QAAQ;KAC/B,QAAQ,kBAAkB,yBAAyB,MAAM;KACzD,cAAc,OAAO,aAAa,IAAI;IACxC,CAAC;IAED,MAAM,UAAU,kBACd,OAAO,OAAO;KACZ,aAAa;KACb,UAAU,OAAO;IACnB,CAAC,GACD,SACF;IAEA,MAAM,cAAc,QAAQ;IAE5B,IAAI,YAAY,SAAS,WACnB;SAAA,CAAC,QAAQ,UAAU,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;IAAA,OACrD,IACL,YAAY,cAAc,MAAM,aAChC,YAAY,gBAAgB,QAAQ,aAEpC,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;IAExC,MAAM,WAAW,kBAAkB;KACjC,QAAQ;KACR,WAAW,GAAG,SAAS;KACvB,QAAQ,QAAQ;KAChB,aAAa,CAAC;IAChB,CAAC;IAED,IAAI,YAAY,SAAS,WAAW,OAAO,OAAO,kBAAkB,QAAQ,CAAC;IAE7E,MAAM,aAAa,OAAO,YAAY,EAAE,CAAC,CAAC,KACxC,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CACjD;IAEA,MAAM,QAAQ,eAAe;KAC3B,IAAI,iBAAiB,KAAK,SAAS,gBAAgB,UAAU,CAAC;KAC9D,kBAAkB,SAAS,cAAc,OAAO,SAAS,GAAG;KAC5D;IACF,CAAC;IAED,WAAW,KAAK,CAAC;IACjB,MAAM,YAAY,OAAO,aAAa,IAAI;IAE1C,MAAM,WACJ,aACA,YACG;KACH,MAAM,WAAW,kBAAkB,2BAA2B,WAAW;KAEzE,IAAI,SAAS,SAAS,gBAAgB,CAAC,SAAS,UAAU,QAAQ,MAAM,KAAK;KAE7E,MAAM,WACJ,SAAS,SAAS,gBAAgB,SAAS,SAAS;KAEtD,OAAO,QAAQ,QAAQ;MACrB,OACE,SAAS,SAAS,eACd,EAAE,MAAM,uBAAgC,IACxC,SAAS,SAAS,wBAChB;OAAE,MAAM;OAAgC,WAAW,SAAS;MAAU,IACtE,EAAE,MAAM,SAAS,KAAK;MAC9B,oBACE,YAAY,CAAC,SAAS,WAClB,CACE;OAAE,MAAM;OAAkB,MAAM;MAAwB,GACxD;OAAE,MAAM;OAAkB,MAAM;MAA2B,CAC7D,IACA,CAAC;KACT,CAAC;IACH;IAEA,IAAI,YAAY;IAEhB,MAAM,SAAS,OAAO,IAAI,aAAa;KACrC,IAAI,WAAW,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;KACrD,YAAY;KACZ,MAAM,EAAE,aAAa,OAAO;KAE5B,OAAO,OAAO,SACZ;MACE,QAAQ,kBAAkB,yBAAyB,MAAM;MACzD,QAAQ,kBAAkB,yBAAyB,MAAM;MACzD,WAAW,MAAM;MACjB,cAAc;MACd,aAAa,QAAQ;KACvB,GACA,OACF;IACF,CAAC,CAAC,CAAC,KAAK,UAAU;IAElB,OAAO,OAAO,OAAO,EAAE,OAAO,CAAC;GACjC,GACA,OAAO,eAAe,OAAO,QAAQ,MAAM,GAC3C,UACF;GACA,SAAS,OAAO,GAAG,2BAA2B,CAAC,CAAC,WAAW,OAAO;IAChE,OAAO,UAAU;IAEjB,MAAM,QAAQ,OAAO,OAAO,aAAa,iBAAiB,CAAC,CAAC;KAC1D,UAAU;KACV;KACA,WAAW,SAAS,cAAc,OAAO,SAAS,GAAG;IACvD,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC;IAWrD,OAAO,QAAO,OATS,QAAQ,QAAQ,OAAO,YAC5C,QAAQ,QACN,kBACE,OAAO,OAAO;KAAE,SAAS,OAAO;KAAS,SAAS,OAAO;IAAQ,CAAC,GAClE,KACF,CACF,CACF,EAAA,CAEsB,KAAK,KAAK,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC;GAClF,GAAG,UAAU;EACf,CAAC;CACH,CAAC,CACH;CAEA,MAAM,WAAW,cAAc,GAAG,SAAS,yBAAyB;EAClE,SAAS;EACT,SAAS;EACT,OAAO;EACP,QAAQ;EACR,UAAU;EACV,QAAQ;EACR,aAAa;CACf,CAAC;CAED,MAAM,gBAAgB,SAAS,uBAC7B,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAAW,OAAO;EAGxD,MAAM,SAAS,QAAO,QADC,QADF,OAAO,cAAA,CAAe,aAAa,KAAK,EAAA,CACjC,OAAA,CACE,KAAK,KAAK,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC;EAExF,IAAI,OAAO,MAAM,SAAS,YAAY,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;EACzE,IAAI,OAAO,MAAM,SAAS,YAAY,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;EAE5E,OAAO;GAAE,OAAO,OAAO;GAAO,oBAAoB,OAAO;EAAmB;CAC9E,CAAC,CACH;CAEA,OAAO,OAAO,OAAO;EACnB;EACA;EACA;EACA;EACA;EACA,YAAY,OAAO,OAAO,EAAE,SAAS,CAAC;EACtC;EACA,OAAO,eAAe,QAAQ;CAChC,CAAC;AACH"}