@yielded/auth 0.1.0-beta.2 → 0.1.0-beta.3

package/dist/oauth/github/protocol.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"protocol.mjs","names":[],"sources":["../../../src/oauth/github/protocol.ts"],"sourcesContent":["import { Effect, Encoding, Layer, Predicate, Redacted, Schema } from \"effect\";\nimport type { CustomFetch } from \"openid-client\";\n\nimport { OAuthConnectedProfile } from \"../connectedModels\";\nimport { OAuthConnectedProtocol } from \"../OAuthConnectedProtocol\";\nimport { OAuthProtocol } from \"../OAuthProtocol\";\nimport {\n  DefiniteTokenRejection,\n  type ConnectedCompatibility,\n} from \"../openid-client/compatibility\";\nimport { makeConnectedProtocolWithCompatibility } from \"../openid-client/connected/protocol\";\nimport {\n  OpenIdClientConfigurationError,\n  type OpenIdClientOAuthProvider,\n} from \"../openid-client/models\";\nimport { makeOAuthProtocolWithCompatibility } from \"../openid-client/protocol\";\nimport { ProviderRevocation } from \"../openid-client/ProviderRevocation\";\nimport { boundedFetch } from \"../openid-client/transport\";\nimport { OAuthUnavailable } from \"../signInErrors\";\nimport { OAuthCallbackId, OAuthGeneration, OAuthIssuer, OAuthRedirectUri } from \"../signInModels\";\nimport { snapshotOAuthSync } from \"../signInSnapshot\";\nimport { decodeGitHubIdentity, gitHubOAuthAppProviderKey } from \"./identity\";\nimport type {\n  GitHubOAuthAppConnectedProtocolOptions,\n  GitHubOAuthAppGeneration,\n  GitHubOAuthAppProtocolOptions,\n} from \"./models\";\n\nconst unavailable = () => OAuthUnavailable.make({});\nconst invalid = () => OpenIdClientConfigurationError.make({ reason: \"provider\" });\nconst issuer = OAuthIssuer.make(\"https://github.com\");\n\nconst headers = Object.freeze({\n  Accept: \"application/vnd.github+json\",\n  \"User-Agent\": \"effect-auth-github-oauth-app\",\n  \"X-GitHub-Api-Version\": \"2026-03-10\",\n});\n\nconst generation = Schema.Struct({\n  configurationGeneration: OAuthGeneration,\n  issuance: Schema.Literals([\"active\", \"retired\"]),\n  clientId: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9._-]{1,256}$/)),\n  clientSecret: Schema.RedactedFromValue(Schema.NonEmptyString.check(Schema.isMaxLength(4096))),\n  callbacks: Schema.Array(\n    Schema.Struct({ callbackId: OAuthCallbackId, redirectUri: OAuthRedirectUri }),\n  ).check(Schema.isMinLength(1), Schema.isMaxLength(16)),\n});\n\nconst generations = Schema.Array(generation).check(Schema.isMinLength(1), Schema.isMaxLength(64));\n\nconst connectedGenerations = Schema.Array(\n  Schema.Struct({\n    ...generation.fields,\n    profiles: Schema.Array(OAuthConnectedProfile).check(\n      Schema.isMinLength(1),\n      Schema.isMaxLength(64),\n    ),\n  }),\n).check(Schema.isMinLength(1), Schema.isMaxLength(64));\n\nconst timeout = Schema.Finite.check(Schema.isBetween({ minimum: 1, maximum: 30 }));\nconst isTimeout = Schema.is(timeout);\n\nconst capture = <S extends Schema.Codec<unknown, unknown, never, never>>(\n  schema: S,\n  registrations: S[\"Type\"],\n  options: {\n    readonly timeoutSeconds: number;\n    readonly fetch?: GitHubOAuthAppProtocolOptions[\"fetch\"];\n  },\n) =>\n  Effect.try({\n    try: () => {\n      const result = snapshotOAuthSync(schema, registrations);\n      const fetch = options.fetch;\n      const timeoutSeconds = options.timeoutSeconds;\n\n      if (!isTimeout(timeoutSeconds) || (fetch !== undefined && !Predicate.isFunction(fetch)))\n        throw invalid();\n\n      return { registrations: result, timeoutSeconds, ...(fetch === undefined ? {} : { fetch }) };\n    },\n    catch: invalid,\n  });\n\nconst provider = (\n  registration: GitHubOAuthAppGeneration,\n): Omit<OpenIdClientOAuthProvider, \"scopes\"> => ({\n  provider: gitHubOAuthAppProviderKey,\n  configurationGeneration: registration.configurationGeneration,\n  issuance: registration.issuance,\n  issuer,\n  protocol: \"oauth\",\n  responseIssuerMode: \"unsupported\",\n  clientId: registration.clientId,\n  authentication: { method: \"client_secret_post\", secret: registration.clientSecret },\n  callbacks: registration.callbacks,\n  authorizationEndpoint: \"https://github.com/login/oauth/authorize\",\n  tokenEndpoint: \"https://github.com/login/oauth/access_token\",\n  pkceS256: true,\n  identitySource: {\n    url: \"https://api.github.com/user\",\n    headers,\n    decodeIdentity: decodeGitHubIdentity,\n  },\n});\n\nconst csvCell = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_:-]{1,256}$/));\nconst isCell = Schema.is(csvCell);\n\n/** GitHub's receipt is comma-delimited, unlike the generic OAuth scope string. */\nconst scopes = (\n  receipt: string | undefined,\n  expected: ReadonlyArray<string>,\n): ReadonlyArray<string> => {\n  if (receipt === undefined || receipt.length > 16447) throw unavailable();\n\n  const result =\n    receipt === \"\" ? [] : receipt.split(\",\").map((cell) => cell.replace(/^[ \\t]+|[ \\t]+$/g, \"\"));\n\n  if (\n    result.length > 64 ||\n    result.some((cell) => !isCell(cell)) ||\n    new Set(result).size !== result.length ||\n    result.length !== expected.length ||\n    result.some((cell) => !expected.includes(cell))\n  )\n    throw unavailable();\n\n  return result;\n};\n\nconst token = Schema.NonEmptyString.check(Schema.isMaxLength(16384));\nconst expiry = Schema.Finite.check(Schema.isGreaterThan(0));\n\nconst receiptSchema = Schema.Struct({\n  access_token: token,\n  token_type: Schema.String.check(Schema.isPattern(/^[Bb][Ee][Aa][Rr][Ee][Rr]$/)),\n  scope: Schema.String.check(Schema.isMaxLength(16447)),\n  expires_in: Schema.optionalKey(expiry),\n  refresh_token: Schema.optionalKey(token),\n  refresh_token_expires_in: Schema.optionalKey(expiry),\n});\n\n// oxlint-disable-next-line no-restricted-properties -- Inspect the bounded raw receipt before the maintained parser can coerce expiry fields.\nconst decodeReceipt = Schema.decodeUnknownSync(receiptSchema);\n\nconst encodeRevocation = Schema.encodeSync(\n  Schema.fromJsonString(Schema.Struct({ access_token: token })),\n);\n\nconst terminalReceipt = Schema.Struct({\n  error: Schema.NonEmptyString.check(Schema.isMaxLength(128)),\n  error_description: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(4096))),\n  error_uri: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(2048))),\n});\n\n// oxlint-disable-next-line no-restricted-properties -- Fully validate the raw terminal receipt before classifying a provider rejection.\nconst decodeTerminalReceipt = Schema.decodeUnknownSync(terminalReceipt);\n\nconst successKeys = [\n  \"access_token\",\n  \"token_type\",\n  \"scope\",\n  \"expires_in\",\n  \"refresh_token\",\n  \"refresh_token_expires_in\",\n  \"id_token\",\n];\n\nconst compatibility: ConnectedCompatibility = Object.freeze<ConnectedCompatibility>({\n  inspectReceipt: ({ body, status, contentType }, input) => {\n    if (contentType?.split(\";\", 1)[0]?.trim().toLowerCase() !== \"application/json\")\n      throw unavailable();\n    if (!Predicate.isObject(body)) throw unavailable();\n    if (Object.hasOwn(body, \"error\")) {\n      if (successKeys.some((key) => Object.hasOwn(body, key))) throw unavailable();\n      const terminal = decodeTerminalReceipt(body);\n\n      if (\n        (status === 200 || status === 400) &&\n        terminal.error ===\n          (input.operation === \"authorization_code\" ? \"bad_verification_code\" : \"bad_refresh_token\")\n      ) {\n        throw new DefiniteTokenRejection();\n      }\n      throw unavailable();\n    }\n    if (\n      status !== 200 ||\n      [\"error_description\", \"error_uri\", \"id_token\"].some((key) => Object.hasOwn(body, key))\n    )\n      throw unavailable();\n    const receipt = decodeReceipt(body);\n\n    scopes(receipt.scope, input.scopes);\n    if (\n      input.refreshRequired &&\n      (receipt.refresh_token === undefined ||\n        receipt.expires_in === undefined ||\n        receipt.refresh_token_expires_in === undefined)\n    )\n      throw unavailable();\n  },\n  authorizationScopes: (permissions, refresh) =>\n    refresh ? [...permissions, \"offline_access\"] : permissions,\n  decodeScopes: scopes,\n  includeRefreshScope: false,\n});\n\nconst revocationLayer = (\n  options: Pick<GitHubOAuthAppConnectedProtocolOptions, \"fetch\" | \"timeoutSeconds\">,\n) => {\n  const fetch: CustomFetch =\n    options.fetch ??\n    ((url, init) =>\n      globalThis.fetch(url, {\n        ...init,\n        body: init.body instanceof Uint8Array ? new Uint8Array(init.body) : init.body,\n      }));\n\n  const timeoutSeconds = options.timeoutSeconds;\n\n  return Layer.succeed(\n    ProviderRevocation,\n    ProviderRevocation.of({\n      revoke: Effect.fn(\"GitHubOAuthApp.revoke\")(function* (input) {\n        yield* Effect.tryPromise({\n          try: async (effectSignal) => {\n            if (\n              input.authentication.method !== \"client_secret_post\" ||\n              input.context.configuration.profile.clientRegistrationId !== input.clientId ||\n              input.context.identity.provider !== gitHubOAuthAppProviderKey ||\n              input.context.identity.issuer !== issuer\n            )\n              throw unavailable();\n            const url = `https://api.github.com/applications/${encodeURIComponent(input.clientId)}/grant`;\n\n            const signal = AbortSignal.any([\n              effectSignal,\n              AbortSignal.timeout(Math.ceil(timeoutSeconds * 1000)),\n            ]);\n\n            const transport = boundedFetch(fetch, signal, new Set([url]));\n\n            const response = await transport(url, {\n              method: \"DELETE\",\n              redirect: \"manual\",\n              headers: {\n                ...headers,\n                \"Content-Type\": \"application/json\",\n                Authorization: `Basic ${Encoding.encodeBase64(`${input.clientId}:${Redacted.value(input.authentication.secret)}`)}`,\n              },\n              body: encodeRevocation({ access_token: Redacted.value(input.material.accessToken) }),\n              signal,\n            });\n\n            signal.throwIfAborted();\n            if (response.status !== 204) throw unavailable();\n          },\n          catch: unavailable,\n        });\n      }),\n    }),\n  );\n};\n\nexport const makeGitHubOAuthAppProtocol = Effect.fn(\"makeGitHubOAuthAppProtocol\")(function* (\n  options: GitHubOAuthAppProtocolOptions,\n) {\n  const saved = yield* capture(generations, options.registrations, options);\n\n  if (saved.registrations.filter((item) => item.issuance === \"active\").length !== 1)\n    return yield* invalid();\n\n  return yield* makeOAuthProtocolWithCompatibility(\n    {\n      ...saved,\n      providers: saved.registrations.map((item) => ({ ...provider(item), scopes: [\"read:user\"] })),\n    },\n    compatibility,\n  );\n});\n\nexport const makeGitHubOAuthAppConnectedProtocol = Effect.fn(\"makeGitHubOAuthAppConnectedProtocol\")(\n  function* (options: GitHubOAuthAppConnectedProtocolOptions) {\n    const saved = yield* capture(connectedGenerations, options.registrations, options);\n\n    if (saved.registrations.filter((item) => item.issuance === \"active\").length !== 1)\n      return yield* invalid();\n    for (const registration of saved.registrations) {\n      for (const profile of registration.profiles) {\n        if (\n          profile.provider !== gitHubOAuthAppProviderKey ||\n          profile.clientRegistrationId !== registration.clientId ||\n          profile.resources.length !== 0 ||\n          profile.scopes.some((scope) => scope === \"offline_access\" || !isCell(scope)) ||\n          (profile.retention === \"access-only\"\n            ? profile.refresh !== \"unsupported\" ||\n              profile.maximumRefreshLifetimeMillis !== undefined\n            : profile.refresh !== \"rotating\" || profile.maximumRefreshLifetimeMillis === undefined)\n        )\n          return yield* invalid();\n      }\n    }\n\n    return yield* makeConnectedProtocolWithCompatibility(\n      {\n        ...saved,\n        providers: saved.registrations.map((item) => ({\n          ...provider(item),\n          profiles: item.profiles,\n          clientRegistrationId: item.clientId,\n          resourceIndicators: \"unsupported\",\n          refreshExpiry: { field: \"refresh_token_expires_in\", zero: \"expired\" },\n          revocation: { mode: \"provider-cohort\" },\n        })),\n      },\n      compatibility,\n    ).pipe(Effect.provide(revocationLayer(saved)));\n  },\n);\n\nexport const gitHubOAuthAppProtocolLayer = (options: GitHubOAuthAppProtocolOptions) =>\n  Layer.effect(OAuthProtocol, makeGitHubOAuthAppProtocol(options));\n\nexport const gitHubOAuthAppConnectedProtocolLayer = (\n  options: GitHubOAuthAppConnectedProtocolOptions,\n) => Layer.effect(OAuthConnectedProtocol, makeGitHubOAuthAppConnectedProtocol(options));\n"],"mappings":";;;;;;;;;;;;;;;AA4BA,MAAM,oBAAoB,iBAAiB,KAAK,CAAC,CAAC;AAClD,MAAM,gBAAgB,+BAA+B,KAAK,EAAE,QAAQ,WAAW,CAAC;AAChF,MAAM,SAAS,YAAY,KAAK,oBAAoB;AAEpD,MAAM,UAAU,OAAO,OAAO;CAC5B,QAAQ;CACR,cAAc;CACd,wBAAwB;AAC1B,CAAC;AAED,MAAM,aAAa,OAAO,OAAO;CAC/B,yBAAyB;CACzB,UAAU,OAAO,SAAS,CAAC,UAAU,SAAS,CAAC;CAC/C,UAAU,OAAO,OAAO,MAAM,OAAO,UAAU,yBAAyB,CAAC;CACzE,cAAc,OAAO,kBAAkB,OAAO,eAAe,MAAM,OAAO,YAAY,IAAI,CAAC,CAAC;CAC5F,WAAW,OAAO,MAChB,OAAO,OAAO;EAAE,YAAY;EAAiB,aAAa;CAAiB,CAAC,CAC9E,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,EAAE,CAAC;AACvD,CAAC;AAED,MAAM,cAAc,OAAO,MAAM,UAAU,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,EAAE,CAAC;AAEhG,MAAM,uBAAuB,OAAO,MAClC,OAAO,OAAO;CACZ,GAAG,WAAW;CACd,UAAU,OAAO,MAAM,qBAAqB,CAAC,CAAC,MAC5C,OAAO,YAAY,CAAC,GACpB,OAAO,YAAY,EAAE,CACvB;AACF,CAAC,CACH,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,EAAE,CAAC;AAErD,MAAM,UAAU,OAAO,OAAO,MAAM,OAAO,UAAU;CAAE,SAAS;CAAG,SAAS;AAAG,CAAC,CAAC;AACjF,MAAM,YAAY,OAAO,GAAG,OAAO;AAEnC,MAAM,WACJ,QACA,eACA,YAKA,OAAO,IAAI;CACT,WAAW;EACT,MAAM,SAAS,kBAAkB,QAAQ,aAAa;EACtD,MAAM,QAAQ,QAAQ;EACtB,MAAM,iBAAiB,QAAQ;EAE/B,IAAI,CAAC,UAAU,cAAc,KAAM,UAAU,KAAA,KAAa,CAAC,UAAU,WAAW,KAAK,GACnF,MAAM,QAAQ;EAEhB,OAAO;GAAE,eAAe;GAAQ;GAAgB,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;EAAG;CAC5F;CACA,OAAO;AACT,CAAC;AAEH,MAAM,YACJ,kBAC+C;CAC/C,UAAU;CACV,yBAAyB,aAAa;CACtC,UAAU,aAAa;CACvB;CACA,UAAU;CACV,oBAAoB;CACpB,UAAU,aAAa;CACvB,gBAAgB;EAAE,QAAQ;EAAsB,QAAQ,aAAa;CAAa;CAClF,WAAW,aAAa;CACxB,uBAAuB;CACvB,eAAe;CACf,UAAU;CACV,gBAAgB;EACd,KAAK;EACL;EACA,gBAAgB;CAClB;AACF;AAEA,MAAM,UAAU,OAAO,OAAO,MAAM,OAAO,UAAU,yBAAyB,CAAC;AAC/E,MAAM,SAAS,OAAO,GAAG,OAAO;;AAGhC,MAAM,UACJ,SACA,aAC0B;CAC1B,IAAI,YAAY,KAAA,KAAa,QAAQ,SAAS,OAAO,MAAM,YAAY;CAEvE,MAAM,SACJ,YAAY,KAAK,CAAC,IAAI,QAAQ,MAAM,GAAG,CAAC,CAAC,KAAK,SAAS,KAAK,QAAQ,oBAAoB,EAAE,CAAC;CAE7F,IACE,OAAO,SAAS,MAChB,OAAO,MAAM,SAAS,CAAC,OAAO,IAAI,CAAC,KACnC,IAAI,IAAI,MAAM,CAAC,CAAC,SAAS,OAAO,UAChC,OAAO,WAAW,SAAS,UAC3B,OAAO,MAAM,SAAS,CAAC,SAAS,SAAS,IAAI,CAAC,GAE9C,MAAM,YAAY;CAEpB,OAAO;AACT;AAEA,MAAM,QAAQ,OAAO,eAAe,MAAM,OAAO,YAAY,KAAK,CAAC;AACnE,MAAM,SAAS,OAAO,OAAO,MAAM,OAAO,cAAc,CAAC,CAAC;AAE1D,MAAM,gBAAgB,OAAO,OAAO;CAClC,cAAc;CACd,YAAY,OAAO,OAAO,MAAM,OAAO,UAAU,4BAA4B,CAAC;CAC9E,OAAO,OAAO,OAAO,MAAM,OAAO,YAAY,KAAK,CAAC;CACpD,YAAY,OAAO,YAAY,MAAM;CACrC,eAAe,OAAO,YAAY,KAAK;CACvC,0BAA0B,OAAO,YAAY,MAAM;AACrD,CAAC;AAGD,MAAM,gBAAgB,OAAO,kBAAkB,aAAa;AAE5D,MAAM,mBAAmB,OAAO,WAC9B,OAAO,eAAe,OAAO,OAAO,EAAE,cAAc,MAAM,CAAC,CAAC,CAC9D;AAEA,MAAM,kBAAkB,OAAO,OAAO;CACpC,OAAO,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC;CAC1D,mBAAmB,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC,CAAC;CACnF,WAAW,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC,CAAC;AAC7E,CAAC;AAGD,MAAM,wBAAwB,OAAO,kBAAkB,eAAe;AAEtE,MAAM,cAAc;CAClB;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAEA,MAAM,gBAAwC,OAAO,OAA+B;CAClF,iBAAiB,EAAE,MAAM,QAAQ,eAAe,UAAU;EACxD,IAAI,aAAa,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,YAAY,MAAM,oBAC1D,MAAM,YAAY;EACpB,IAAI,CAAC,UAAU,SAAS,IAAI,GAAG,MAAM,YAAY;EACjD,IAAI,OAAO,OAAO,MAAM,OAAO,GAAG;GAChC,IAAI,YAAY,MAAM,QAAQ,OAAO,OAAO,MAAM,GAAG,CAAC,GAAG,MAAM,YAAY;GAC3E,MAAM,WAAW,sBAAsB,IAAI;GAE3C,KACG,WAAW,OAAO,WAAW,QAC9B,SAAS,WACN,MAAM,cAAc,uBAAuB,0BAA0B,sBAExE,MAAM,IAAI,uBAAuB;GAEnC,MAAM,YAAY;EACpB;EACA,IACE,WAAW,OACX;GAAC;GAAqB;GAAa;EAAU,CAAC,CAAC,MAAM,QAAQ,OAAO,OAAO,MAAM,GAAG,CAAC,GAErF,MAAM,YAAY;EACpB,MAAM,UAAU,cAAc,IAAI;EAElC,OAAO,QAAQ,OAAO,MAAM,MAAM;EAClC,IACE,MAAM,oBACL,QAAQ,kBAAkB,KAAA,KACzB,QAAQ,eAAe,KAAA,KACvB,QAAQ,6BAA6B,KAAA,IAEvC,MAAM,YAAY;CACtB;CACA,sBAAsB,aAAa,YACjC,UAAU,CAAC,GAAG,aAAa,gBAAgB,IAAI;CACjD,cAAc;CACd,qBAAqB;AACvB,CAAC;AAED,MAAM,mBACJ,YACG;CACH,MAAM,QACJ,QAAQ,WACN,KAAK,SACL,WAAW,MAAM,KAAK;EACpB,GAAG;EACH,MAAM,KAAK,gBAAgB,aAAa,IAAI,WAAW,KAAK,IAAI,IAAI,KAAK;CAC3E,CAAC;CAEL,MAAM,iBAAiB,QAAQ;CAE/B,OAAO,MAAM,QACX,oBACA,mBAAmB,GAAG,EACpB,QAAQ,OAAO,GAAG,uBAAuB,CAAC,CAAC,WAAW,OAAO;EAC3D,OAAO,OAAO,WAAW;GACvB,KAAK,OAAO,iBAAiB;IAC3B,IACE,MAAM,eAAe,WAAW,wBAChC,MAAM,QAAQ,cAAc,QAAQ,yBAAyB,MAAM,YACnE,MAAM,QAAQ,SAAS,aAAa,6BACpC,MAAM,QAAQ,SAAS,WAAW,QAElC,MAAM,YAAY;IACpB,MAAM,MAAM,uCAAuC,mBAAmB,MAAM,QAAQ,EAAE;IAEtF,MAAM,SAAS,YAAY,IAAI,CAC7B,cACA,YAAY,QAAQ,KAAK,KAAK,iBAAiB,GAAI,CAAC,CACtD,CAAC;IAID,MAAM,WAAW,MAFC,aAAa,OAAO,wBAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,CAE5B,CAAC,CAAC,KAAK;KACpC,QAAQ;KACR,UAAU;KACV,SAAS;MACP,GAAG;MACH,gBAAgB;MAChB,eAAe,SAAS,SAAS,aAAa,GAAG,MAAM,SAAS,GAAG,SAAS,MAAM,MAAM,eAAe,MAAM,GAAG;KAClH;KACA,MAAM,iBAAiB,EAAE,cAAc,SAAS,MAAM,MAAM,SAAS,WAAW,EAAE,CAAC;KACnF;IACF,CAAC;IAED,OAAO,eAAe;IACtB,IAAI,SAAS,WAAW,KAAK,MAAM,YAAY;GACjD;GACA,OAAO;EACT,CAAC;CACH,CAAC,EACH,CAAC,CACH;AACF;AAEA,MAAa,6BAA6B,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAChF,SACA;CACA,MAAM,QAAQ,OAAO,QAAQ,aAAa,QAAQ,eAAe,OAAO;CAExE,IAAI,MAAM,cAAc,QAAQ,SAAS,KAAK,aAAa,QAAQ,CAAC,CAAC,WAAW,GAC9E,OAAO,OAAO,QAAQ;CAExB,OAAO,OAAO,mCACZ;EACE,GAAG;EACH,WAAW,MAAM,cAAc,KAAK,UAAU;GAAE,GAAG,SAAS,IAAI;GAAG,QAAQ,CAAC,WAAW;EAAE,EAAE;CAC7F,GACA,aACF;AACF,CAAC;AAED,MAAa,sCAAsC,OAAO,GAAG,qCAAqC,CAAC,CACjG,WAAW,SAAiD;CAC1D,MAAM,QAAQ,OAAO,QAAQ,sBAAsB,QAAQ,eAAe,OAAO;CAEjF,IAAI,MAAM,cAAc,QAAQ,SAAS,KAAK,aAAa,QAAQ,CAAC,CAAC,WAAW,GAC9E,OAAO,OAAO,QAAQ;CACxB,KAAK,MAAM,gBAAgB,MAAM,eAC/B,KAAK,MAAM,WAAW,aAAa,UACjC,IACE,QAAQ,aAAa,6BACrB,QAAQ,yBAAyB,aAAa,YAC9C,QAAQ,UAAU,WAAW,KAC7B,QAAQ,OAAO,MAAM,UAAU,UAAU,oBAAoB,CAAC,OAAO,KAAK,CAAC,MAC1E,QAAQ,cAAc,gBACnB,QAAQ,YAAY,iBACpB,QAAQ,iCAAiC,KAAA,IACzC,QAAQ,YAAY,cAAc,QAAQ,iCAAiC,KAAA,IAE/E,OAAO,OAAO,QAAQ;CAI5B,OAAO,OAAO,uCACZ;EACE,GAAG;EACH,WAAW,MAAM,cAAc,KAAK,UAAU;GAC5C,GAAG,SAAS,IAAI;GAChB,UAAU,KAAK;GACf,sBAAsB,KAAK;GAC3B,oBAAoB;GACpB,eAAe;IAAE,OAAO;IAA4B,MAAM;GAAU;GACpE,YAAY,EAAE,MAAM,kBAAkB;EACxC,EAAE;CACJ,GACA,aACF,CAAC,CAAC,KAAK,OAAO,QAAQ,gBAAgB,KAAK,CAAC,CAAC;AAC/C,CACF;AAEA,MAAa,+BAA+B,YAC1C,MAAM,OAAO,eAAe,2BAA2B,OAAO,CAAC;AAEjE,MAAa,wCACX,YACG,MAAM,OAAO,wBAAwB,oCAAoC,OAAO,CAAC"}
+{"version":3,"file":"protocol.mjs","names":[],"sources":["../../../src/oauth/github/protocol.ts"],"sourcesContent":["import { Effect, Encoding, Layer, Predicate, Redacted, Schema } from \"effect\";\nimport type { CustomFetch } from \"openid-client\";\n\nimport { OAuthConnectedProfile } from \"../connectedModels\";\nimport { OAuthConnectedProtocol } from \"../OAuthConnectedProtocol\";\nimport { OAuthProtocol } from \"../OAuthProtocol\";\nimport {\n  DefiniteTokenRejection,\n  tokenCompatibility,\n  type ConnectedCompatibility,\n} from \"../openid-client/compatibility\";\nimport { makeConnectedProtocolWithCompatibility } from \"../openid-client/connected/protocol\";\nimport {\n  OpenIdClientConfigurationError,\n  type OpenIdClientOAuthProvider,\n} from \"../openid-client/models\";\nimport { makeOpenIdClientOAuthProtocol } from \"../openid-client/protocol\";\nimport { ProviderRevocation } from \"../openid-client/ProviderRevocation\";\nimport { boundedFetch } from \"../openid-client/transport\";\nimport { OAuthUnavailable } from \"../signInErrors\";\nimport { OAuthCallbackId, OAuthGeneration, OAuthIssuer, OAuthRedirectUri } from \"../signInModels\";\nimport { snapshotOAuthSync } from \"../signInSnapshot\";\nimport { decodeGitHubIdentity, gitHubOAuthAppProviderKey } from \"./identity\";\nimport type {\n  GitHubOAuthAppConnectedProtocolOptions,\n  GitHubOAuthAppGeneration,\n  GitHubOAuthAppProtocolOptions,\n} from \"./models\";\n\nconst unavailable = () => OAuthUnavailable.make({});\nconst invalid = () => OpenIdClientConfigurationError.make({ reason: \"provider\" });\nconst issuer = OAuthIssuer.make(\"https://github.com\");\n\nconst headers = Object.freeze({\n  Accept: \"application/vnd.github+json\",\n  \"User-Agent\": \"effect-auth-github-oauth-app\",\n  \"X-GitHub-Api-Version\": \"2026-03-10\",\n});\n\nconst generation = Schema.Struct({\n  configurationGeneration: OAuthGeneration,\n  issuance: Schema.Literals([\"active\", \"retired\"]),\n  clientId: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9._-]{1,256}$/)),\n  clientSecret: Schema.RedactedFromValue(Schema.NonEmptyString.check(Schema.isMaxLength(4096))),\n  callbacks: Schema.Array(\n    Schema.Struct({ callbackId: OAuthCallbackId, redirectUri: OAuthRedirectUri }),\n  ).check(Schema.isMinLength(1), Schema.isMaxLength(16)),\n});\n\nconst generations = Schema.Array(generation).check(Schema.isMinLength(1), Schema.isMaxLength(64));\n\nconst connectedGenerations = Schema.Array(\n  Schema.Struct({\n    ...generation.fields,\n    profiles: Schema.Array(OAuthConnectedProfile).check(\n      Schema.isMinLength(1),\n      Schema.isMaxLength(64),\n    ),\n  }),\n).check(Schema.isMinLength(1), Schema.isMaxLength(64));\n\nconst timeout = Schema.Finite.check(Schema.isBetween({ minimum: 1, maximum: 30 }));\nconst isTimeout = Schema.is(timeout);\n\nconst capture = <S extends Schema.Codec<unknown, unknown, never, never>>(\n  schema: S,\n  registrations: S[\"Type\"],\n  options: {\n    readonly timeoutSeconds: number;\n    readonly fetch?: GitHubOAuthAppProtocolOptions[\"fetch\"];\n  },\n) =>\n  Effect.try({\n    try: () => {\n      const result = snapshotOAuthSync(schema, registrations);\n      const fetch = options.fetch;\n      const timeoutSeconds = options.timeoutSeconds;\n\n      if (!isTimeout(timeoutSeconds) || (fetch !== undefined && !Predicate.isFunction(fetch)))\n        throw invalid();\n\n      return { registrations: result, timeoutSeconds, ...(fetch === undefined ? {} : { fetch }) };\n    },\n    catch: invalid,\n  });\n\nconst provider = (\n  registration: GitHubOAuthAppGeneration,\n): Omit<OpenIdClientOAuthProvider, \"scopes\"> => ({\n  provider: gitHubOAuthAppProviderKey,\n  configurationGeneration: registration.configurationGeneration,\n  issuance: registration.issuance,\n  issuer,\n  protocol: \"oauth\",\n  responseIssuerMode: \"unsupported\",\n  clientId: registration.clientId,\n  authentication: { method: \"client_secret_post\", secret: registration.clientSecret },\n  callbacks: registration.callbacks,\n  authorizationEndpoint: \"https://github.com/login/oauth/authorize\",\n  tokenEndpoint: \"https://github.com/login/oauth/access_token\",\n  pkceS256: true,\n  identitySource: {\n    url: \"https://api.github.com/user\",\n    headers,\n    decodeIdentity: decodeGitHubIdentity,\n  },\n});\n\nconst csvCell = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_:-]{1,256}$/));\nconst isCell = Schema.is(csvCell);\n\n/** GitHub's receipt is comma-delimited, unlike the generic OAuth scope string. */\nconst scopes = (\n  receipt: string | undefined,\n  expected: ReadonlyArray<string>,\n): ReadonlyArray<string> => {\n  if (receipt === undefined || receipt.length > 16447) throw unavailable();\n\n  const result =\n    receipt === \"\" ? [] : receipt.split(\",\").map((cell) => cell.replace(/^[ \\t]+|[ \\t]+$/g, \"\"));\n\n  if (\n    result.length > 64 ||\n    result.some((cell) => !isCell(cell)) ||\n    new Set(result).size !== result.length ||\n    result.length !== expected.length ||\n    result.some((cell) => !expected.includes(cell))\n  )\n    throw unavailable();\n\n  return result;\n};\n\nconst token = Schema.NonEmptyString.check(Schema.isMaxLength(16384));\nconst expiry = Schema.Finite.check(Schema.isGreaterThan(0));\n\nconst receiptSchema = Schema.Struct({\n  access_token: token,\n  token_type: Schema.String.check(Schema.isPattern(/^[Bb][Ee][Aa][Rr][Ee][Rr]$/)),\n  scope: Schema.String.check(Schema.isMaxLength(16447)),\n  expires_in: Schema.optionalKey(expiry),\n  refresh_token: Schema.optionalKey(token),\n  refresh_token_expires_in: Schema.optionalKey(expiry),\n});\n\n// oxlint-disable-next-line no-restricted-properties -- Inspect the bounded raw receipt before the maintained parser can coerce expiry fields.\nconst decodeReceipt = Schema.decodeUnknownSync(receiptSchema);\n\nconst encodeRevocation = Schema.encodeSync(\n  Schema.fromJsonString(Schema.Struct({ access_token: token })),\n);\n\nconst terminalReceipt = Schema.Struct({\n  error: Schema.NonEmptyString.check(Schema.isMaxLength(128)),\n  error_description: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(4096))),\n  error_uri: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(2048))),\n});\n\n// oxlint-disable-next-line no-restricted-properties -- Fully validate the raw terminal receipt before classifying a provider rejection.\nconst decodeTerminalReceipt = Schema.decodeUnknownSync(terminalReceipt);\n\nconst successKeys = [\n  \"access_token\",\n  \"token_type\",\n  \"scope\",\n  \"expires_in\",\n  \"refresh_token\",\n  \"refresh_token_expires_in\",\n  \"id_token\",\n];\n\nconst compatibility: ConnectedCompatibility = Object.freeze<ConnectedCompatibility>({\n  inspectReceipt: ({ body, status, contentType }, input) => {\n    if (contentType?.split(\";\", 1)[0]?.trim().toLowerCase() !== \"application/json\")\n      throw unavailable();\n    if (!Predicate.isObject(body)) throw unavailable();\n    if (Object.hasOwn(body, \"error\")) {\n      if (successKeys.some((key) => Object.hasOwn(body, key))) throw unavailable();\n      const terminal = decodeTerminalReceipt(body);\n\n      if (\n        (status === 200 || status === 400) &&\n        terminal.error ===\n          (input.operation === \"authorization_code\" ? \"bad_verification_code\" : \"bad_refresh_token\")\n      ) {\n        throw new DefiniteTokenRejection();\n      }\n      throw unavailable();\n    }\n    if (\n      status !== 200 ||\n      [\"error_description\", \"error_uri\", \"id_token\"].some((key) => Object.hasOwn(body, key))\n    )\n      throw unavailable();\n    const receipt = decodeReceipt(body);\n\n    scopes(receipt.scope, input.scopes);\n    if (\n      input.refreshRequired &&\n      (receipt.refresh_token === undefined ||\n        receipt.expires_in === undefined ||\n        receipt.refresh_token_expires_in === undefined)\n    )\n      throw unavailable();\n  },\n  authorizationScopes: (permissions, refresh) =>\n    refresh ? [...permissions, \"offline_access\"] : permissions,\n  decodeScopes: scopes,\n  includeRefreshScope: false,\n});\n\nconst revocationLayer = (\n  options: Pick<GitHubOAuthAppConnectedProtocolOptions, \"fetch\" | \"timeoutSeconds\">,\n) => {\n  const fetch: CustomFetch =\n    options.fetch ??\n    ((url, init) =>\n      globalThis.fetch(url, {\n        ...init,\n        body: init.body instanceof Uint8Array ? new Uint8Array(init.body) : init.body,\n      }));\n\n  const timeoutSeconds = options.timeoutSeconds;\n\n  return Layer.succeed(\n    ProviderRevocation,\n    ProviderRevocation.of({\n      revoke: Effect.fn(\"GitHubOAuthApp.revoke\")(function* (input) {\n        yield* Effect.tryPromise({\n          try: async (effectSignal) => {\n            if (\n              input.authentication.method !== \"client_secret_post\" ||\n              input.context.configuration.profile.clientRegistrationId !== input.clientId ||\n              input.context.identity.provider !== gitHubOAuthAppProviderKey ||\n              input.context.identity.issuer !== issuer\n            )\n              throw unavailable();\n            const url = `https://api.github.com/applications/${encodeURIComponent(input.clientId)}/grant`;\n\n            const signal = AbortSignal.any([\n              effectSignal,\n              AbortSignal.timeout(Math.ceil(timeoutSeconds * 1000)),\n            ]);\n\n            const transport = boundedFetch(fetch, signal, new Set([url]));\n\n            const response = await transport(url, {\n              method: \"DELETE\",\n              redirect: \"manual\",\n              headers: {\n                ...headers,\n                \"Content-Type\": \"application/json\",\n                Authorization: `Basic ${Encoding.encodeBase64(`${input.clientId}:${Redacted.value(input.authentication.secret)}`)}`,\n              },\n              body: encodeRevocation({ access_token: Redacted.value(input.material.accessToken) }),\n              signal,\n            });\n\n            signal.throwIfAborted();\n            if (response.status !== 204) throw unavailable();\n          },\n          catch: unavailable,\n        });\n      }),\n    }),\n  );\n};\n\n/** A GitHub.com OAuth App generation for the same provider list as generic OIDC.\n * Retains GitHub receipt/error rules and requests read:user, with no repository access.\n * Construction performs no I/O; invalid configuration throws the typed configuration error. */\nexport const gitHubOAuthAppProvider = (\n  registration: GitHubOAuthAppGeneration,\n): OpenIdClientOAuthProvider => {\n  let saved: GitHubOAuthAppGeneration;\n\n  try {\n    saved = snapshotOAuthSync(generation, registration);\n  } catch {\n    throw invalid();\n  }\n\n  return {\n    ...provider(saved),\n    scopes: [\"read:user\"],\n    [tokenCompatibility]: compatibility,\n  };\n};\n\nexport const makeGitHubOAuthAppProtocol = Effect.fn(\"makeGitHubOAuthAppProtocol\")(function* (\n  options: GitHubOAuthAppProtocolOptions,\n) {\n  const saved = yield* capture(generations, options.registrations, options);\n\n  if (saved.registrations.filter((item) => item.issuance === \"active\").length !== 1)\n    return yield* invalid();\n\n  return yield* makeOpenIdClientOAuthProtocol({\n    ...saved,\n    providers: saved.registrations.map(gitHubOAuthAppProvider),\n  });\n});\n\nexport const makeGitHubOAuthAppConnectedProtocol = Effect.fn(\"makeGitHubOAuthAppConnectedProtocol\")(\n  function* (options: GitHubOAuthAppConnectedProtocolOptions) {\n    const saved = yield* capture(connectedGenerations, options.registrations, options);\n\n    if (saved.registrations.filter((item) => item.issuance === \"active\").length !== 1)\n      return yield* invalid();\n    for (const registration of saved.registrations) {\n      for (const profile of registration.profiles) {\n        if (\n          profile.provider !== gitHubOAuthAppProviderKey ||\n          profile.clientRegistrationId !== registration.clientId ||\n          profile.resources.length !== 0 ||\n          profile.scopes.some((scope) => scope === \"offline_access\" || !isCell(scope)) ||\n          (profile.retention === \"access-only\"\n            ? profile.refresh !== \"unsupported\" ||\n              profile.maximumRefreshLifetimeMillis !== undefined\n            : profile.refresh !== \"rotating\" || profile.maximumRefreshLifetimeMillis === undefined)\n        )\n          return yield* invalid();\n      }\n    }\n\n    return yield* makeConnectedProtocolWithCompatibility(\n      {\n        ...saved,\n        providers: saved.registrations.map((item) => ({\n          ...provider(item),\n          profiles: item.profiles,\n          clientRegistrationId: item.clientId,\n          resourceIndicators: \"unsupported\",\n          refreshExpiry: { field: \"refresh_token_expires_in\", zero: \"expired\" },\n          revocation: { mode: \"provider-cohort\" },\n        })),\n      },\n      compatibility,\n    ).pipe(Effect.provide(revocationLayer(saved)));\n  },\n);\n\nexport const gitHubOAuthAppProtocolLayer = (options: GitHubOAuthAppProtocolOptions) =>\n  Layer.effect(OAuthProtocol, makeGitHubOAuthAppProtocol(options));\n\nexport const gitHubOAuthAppConnectedProtocolLayer = (\n  options: GitHubOAuthAppConnectedProtocolOptions,\n) => Layer.effect(OAuthConnectedProtocol, makeGitHubOAuthAppConnectedProtocol(options));\n"],"mappings":";;;;;;;;;;;;;;;AA6BA,MAAM,oBAAoB,iBAAiB,KAAK,CAAC,CAAC;AAClD,MAAM,gBAAgB,+BAA+B,KAAK,EAAE,QAAQ,WAAW,CAAC;AAChF,MAAM,SAAS,YAAY,KAAK,oBAAoB;AAEpD,MAAM,UAAU,OAAO,OAAO;CAC5B,QAAQ;CACR,cAAc;CACd,wBAAwB;AAC1B,CAAC;AAED,MAAM,aAAa,OAAO,OAAO;CAC/B,yBAAyB;CACzB,UAAU,OAAO,SAAS,CAAC,UAAU,SAAS,CAAC;CAC/C,UAAU,OAAO,OAAO,MAAM,OAAO,UAAU,yBAAyB,CAAC;CACzE,cAAc,OAAO,kBAAkB,OAAO,eAAe,MAAM,OAAO,YAAY,IAAI,CAAC,CAAC;CAC5F,WAAW,OAAO,MAChB,OAAO,OAAO;EAAE,YAAY;EAAiB,aAAa;CAAiB,CAAC,CAC9E,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,EAAE,CAAC;AACvD,CAAC;AAED,MAAM,cAAc,OAAO,MAAM,UAAU,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,EAAE,CAAC;AAEhG,MAAM,uBAAuB,OAAO,MAClC,OAAO,OAAO;CACZ,GAAG,WAAW;CACd,UAAU,OAAO,MAAM,qBAAqB,CAAC,CAAC,MAC5C,OAAO,YAAY,CAAC,GACpB,OAAO,YAAY,EAAE,CACvB;AACF,CAAC,CACH,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,EAAE,CAAC;AAErD,MAAM,UAAU,OAAO,OAAO,MAAM,OAAO,UAAU;CAAE,SAAS;CAAG,SAAS;AAAG,CAAC,CAAC;AACjF,MAAM,YAAY,OAAO,GAAG,OAAO;AAEnC,MAAM,WACJ,QACA,eACA,YAKA,OAAO,IAAI;CACT,WAAW;EACT,MAAM,SAAS,kBAAkB,QAAQ,aAAa;EACtD,MAAM,QAAQ,QAAQ;EACtB,MAAM,iBAAiB,QAAQ;EAE/B,IAAI,CAAC,UAAU,cAAc,KAAM,UAAU,KAAA,KAAa,CAAC,UAAU,WAAW,KAAK,GACnF,MAAM,QAAQ;EAEhB,OAAO;GAAE,eAAe;GAAQ;GAAgB,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;EAAG;CAC5F;CACA,OAAO;AACT,CAAC;AAEH,MAAM,YACJ,kBAC+C;CAC/C,UAAU;CACV,yBAAyB,aAAa;CACtC,UAAU,aAAa;CACvB;CACA,UAAU;CACV,oBAAoB;CACpB,UAAU,aAAa;CACvB,gBAAgB;EAAE,QAAQ;EAAsB,QAAQ,aAAa;CAAa;CAClF,WAAW,aAAa;CACxB,uBAAuB;CACvB,eAAe;CACf,UAAU;CACV,gBAAgB;EACd,KAAK;EACL;EACA,gBAAgB;CAClB;AACF;AAEA,MAAM,UAAU,OAAO,OAAO,MAAM,OAAO,UAAU,yBAAyB,CAAC;AAC/E,MAAM,SAAS,OAAO,GAAG,OAAO;;AAGhC,MAAM,UACJ,SACA,aAC0B;CAC1B,IAAI,YAAY,KAAA,KAAa,QAAQ,SAAS,OAAO,MAAM,YAAY;CAEvE,MAAM,SACJ,YAAY,KAAK,CAAC,IAAI,QAAQ,MAAM,GAAG,CAAC,CAAC,KAAK,SAAS,KAAK,QAAQ,oBAAoB,EAAE,CAAC;CAE7F,IACE,OAAO,SAAS,MAChB,OAAO,MAAM,SAAS,CAAC,OAAO,IAAI,CAAC,KACnC,IAAI,IAAI,MAAM,CAAC,CAAC,SAAS,OAAO,UAChC,OAAO,WAAW,SAAS,UAC3B,OAAO,MAAM,SAAS,CAAC,SAAS,SAAS,IAAI,CAAC,GAE9C,MAAM,YAAY;CAEpB,OAAO;AACT;AAEA,MAAM,QAAQ,OAAO,eAAe,MAAM,OAAO,YAAY,KAAK,CAAC;AACnE,MAAM,SAAS,OAAO,OAAO,MAAM,OAAO,cAAc,CAAC,CAAC;AAE1D,MAAM,gBAAgB,OAAO,OAAO;CAClC,cAAc;CACd,YAAY,OAAO,OAAO,MAAM,OAAO,UAAU,4BAA4B,CAAC;CAC9E,OAAO,OAAO,OAAO,MAAM,OAAO,YAAY,KAAK,CAAC;CACpD,YAAY,OAAO,YAAY,MAAM;CACrC,eAAe,OAAO,YAAY,KAAK;CACvC,0BAA0B,OAAO,YAAY,MAAM;AACrD,CAAC;AAGD,MAAM,gBAAgB,OAAO,kBAAkB,aAAa;AAE5D,MAAM,mBAAmB,OAAO,WAC9B,OAAO,eAAe,OAAO,OAAO,EAAE,cAAc,MAAM,CAAC,CAAC,CAC9D;AAEA,MAAM,kBAAkB,OAAO,OAAO;CACpC,OAAO,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC;CAC1D,mBAAmB,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC,CAAC;CACnF,WAAW,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC,CAAC;AAC7E,CAAC;AAGD,MAAM,wBAAwB,OAAO,kBAAkB,eAAe;AAEtE,MAAM,cAAc;CAClB;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAEA,MAAM,gBAAwC,OAAO,OAA+B;CAClF,iBAAiB,EAAE,MAAM,QAAQ,eAAe,UAAU;EACxD,IAAI,aAAa,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,YAAY,MAAM,oBAC1D,MAAM,YAAY;EACpB,IAAI,CAAC,UAAU,SAAS,IAAI,GAAG,MAAM,YAAY;EACjD,IAAI,OAAO,OAAO,MAAM,OAAO,GAAG;GAChC,IAAI,YAAY,MAAM,QAAQ,OAAO,OAAO,MAAM,GAAG,CAAC,GAAG,MAAM,YAAY;GAC3E,MAAM,WAAW,sBAAsB,IAAI;GAE3C,KACG,WAAW,OAAO,WAAW,QAC9B,SAAS,WACN,MAAM,cAAc,uBAAuB,0BAA0B,sBAExE,MAAM,IAAI,uBAAuB;GAEnC,MAAM,YAAY;EACpB;EACA,IACE,WAAW,OACX;GAAC;GAAqB;GAAa;EAAU,CAAC,CAAC,MAAM,QAAQ,OAAO,OAAO,MAAM,GAAG,CAAC,GAErF,MAAM,YAAY;EACpB,MAAM,UAAU,cAAc,IAAI;EAElC,OAAO,QAAQ,OAAO,MAAM,MAAM;EAClC,IACE,MAAM,oBACL,QAAQ,kBAAkB,KAAA,KACzB,QAAQ,eAAe,KAAA,KACvB,QAAQ,6BAA6B,KAAA,IAEvC,MAAM,YAAY;CACtB;CACA,sBAAsB,aAAa,YACjC,UAAU,CAAC,GAAG,aAAa,gBAAgB,IAAI;CACjD,cAAc;CACd,qBAAqB;AACvB,CAAC;AAED,MAAM,mBACJ,YACG;CACH,MAAM,QACJ,QAAQ,WACN,KAAK,SACL,WAAW,MAAM,KAAK;EACpB,GAAG;EACH,MAAM,KAAK,gBAAgB,aAAa,IAAI,WAAW,KAAK,IAAI,IAAI,KAAK;CAC3E,CAAC;CAEL,MAAM,iBAAiB,QAAQ;CAE/B,OAAO,MAAM,QACX,oBACA,mBAAmB,GAAG,EACpB,QAAQ,OAAO,GAAG,uBAAuB,CAAC,CAAC,WAAW,OAAO;EAC3D,OAAO,OAAO,WAAW;GACvB,KAAK,OAAO,iBAAiB;IAC3B,IACE,MAAM,eAAe,WAAW,wBAChC,MAAM,QAAQ,cAAc,QAAQ,yBAAyB,MAAM,YACnE,MAAM,QAAQ,SAAS,aAAa,6BACpC,MAAM,QAAQ,SAAS,WAAW,QAElC,MAAM,YAAY;IACpB,MAAM,MAAM,uCAAuC,mBAAmB,MAAM,QAAQ,EAAE;IAEtF,MAAM,SAAS,YAAY,IAAI,CAC7B,cACA,YAAY,QAAQ,KAAK,KAAK,iBAAiB,GAAI,CAAC,CACtD,CAAC;IAID,MAAM,WAAW,MAFC,aAAa,OAAO,wBAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,CAE5B,CAAC,CAAC,KAAK;KACpC,QAAQ;KACR,UAAU;KACV,SAAS;MACP,GAAG;MACH,gBAAgB;MAChB,eAAe,SAAS,SAAS,aAAa,GAAG,MAAM,SAAS,GAAG,SAAS,MAAM,MAAM,eAAe,MAAM,GAAG;KAClH;KACA,MAAM,iBAAiB,EAAE,cAAc,SAAS,MAAM,MAAM,SAAS,WAAW,EAAE,CAAC;KACnF;IACF,CAAC;IAED,OAAO,eAAe;IACtB,IAAI,SAAS,WAAW,KAAK,MAAM,YAAY;GACjD;GACA,OAAO;EACT,CAAC;CACH,CAAC,EACH,CAAC,CACH;AACF;;;;AAKA,MAAa,0BACX,iBAC8B;CAC9B,IAAI;CAEJ,IAAI;EACF,QAAQ,kBAAkB,YAAY,YAAY;CACpD,QAAQ;EACN,MAAM,QAAQ;CAChB;CAEA,OAAO;EACL,GAAG,SAAS,KAAK;EACjB,QAAQ,CAAC,WAAW;GACnB,qBAAqB;CACxB;AACF;AAEA,MAAa,6BAA6B,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAChF,SACA;CACA,MAAM,QAAQ,OAAO,QAAQ,aAAa,QAAQ,eAAe,OAAO;CAExE,IAAI,MAAM,cAAc,QAAQ,SAAS,KAAK,aAAa,QAAQ,CAAC,CAAC,WAAW,GAC9E,OAAO,OAAO,QAAQ;CAExB,OAAO,OAAO,8BAA8B;EAC1C,GAAG;EACH,WAAW,MAAM,cAAc,IAAI,sBAAsB;CAC3D,CAAC;AACH,CAAC;AAED,MAAa,sCAAsC,OAAO,GAAG,qCAAqC,CAAC,CACjG,WAAW,SAAiD;CAC1D,MAAM,QAAQ,OAAO,QAAQ,sBAAsB,QAAQ,eAAe,OAAO;CAEjF,IAAI,MAAM,cAAc,QAAQ,SAAS,KAAK,aAAa,QAAQ,CAAC,CAAC,WAAW,GAC9E,OAAO,OAAO,QAAQ;CACxB,KAAK,MAAM,gBAAgB,MAAM,eAC/B,KAAK,MAAM,WAAW,aAAa,UACjC,IACE,QAAQ,aAAa,6BACrB,QAAQ,yBAAyB,aAAa,YAC9C,QAAQ,UAAU,WAAW,KAC7B,QAAQ,OAAO,MAAM,UAAU,UAAU,oBAAoB,CAAC,OAAO,KAAK,CAAC,MAC1E,QAAQ,cAAc,gBACnB,QAAQ,YAAY,iBACpB,QAAQ,iCAAiC,KAAA,IACzC,QAAQ,YAAY,cAAc,QAAQ,iCAAiC,KAAA,IAE/E,OAAO,OAAO,QAAQ;CAI5B,OAAO,OAAO,uCACZ;EACE,GAAG;EACH,WAAW,MAAM,cAAc,KAAK,UAAU;GAC5C,GAAG,SAAS,IAAI;GAChB,UAAU,KAAK;GACf,sBAAsB,KAAK;GAC3B,oBAAoB;GACpB,eAAe;IAAE,OAAO;IAA4B,MAAM;GAAU;GACpE,YAAY,EAAE,MAAM,kBAAkB;EACxC,EAAE;CACJ,GACA,aACF,CAAC,CAAC,KAAK,OAAO,QAAQ,gBAAgB,KAAK,CAAC,CAAC;AAC/C,CACF;AAEA,MAAa,+BAA+B,YAC1C,MAAM,OAAO,eAAe,2BAA2B,OAAO,CAAC;AAEjE,MAAa,wCACX,YACG,MAAM,OAAO,wBAAwB,oCAAoC,OAAO,CAAC"}

package/dist/oauth/openid-client/compatibility.d.mts

@@ -1 +1,22 @@
-import "./connected/models.mjs";
+import "./connected/models.mjs";
+import { Schema } from "effect";
+//#region src/oauth/openid-client/compatibility.d.ts
+/** Pure private provider rules, never part of the generic public options. */
+interface TokenCompatibility {
+  readonly inspectReceipt: (receipt: {
+    readonly body: unknown;
+    readonly status: number;
+    readonly contentType: string | null;
+  }, input: {
+    readonly scopes: ReadonlyArray<string>;
+    readonly refreshRequired: boolean;
+    readonly operation: "authorization_code" | "refresh_token";
+  }) => void;
+}
+/** First-party rules travel with the exact provider generation. The symbol stays
+ * private so generic provider options do not expose grant-bearing hooks. */
+declare const tokenCompatibility: unique symbol;
+declare const TokenCompatibility: Schema.declare<TokenCompatibility, TokenCompatibility>;
+//#endregion
+export { TokenCompatibility, tokenCompatibility };
+//# sourceMappingURL=compatibility.d.mts.map

package/dist/oauth/openid-client/compatibility.mjs

@@ -1,6 +1,11 @@
+import { Predicate, Schema } from "effect";
 //#region src/oauth/openid-client/compatibility.ts
+/** First-party rules travel with the exact provider generation. The symbol stays
+* private so generic provider options do not expose grant-bearing hooks. */
+const tokenCompatibility = Symbol("effect-auth/OpenIdClient/tokenCompatibility");
+const TokenCompatibility = Schema.declare((input) => Predicate.isObject(input) && "inspectReceipt" in input && Predicate.isFunction(input.inspectReceipt));
 var DefiniteTokenRejection = class extends Error {};
 //#endregion
-export { DefiniteTokenRejection };
+export { DefiniteTokenRejection, TokenCompatibility, tokenCompatibility };
 
 //# sourceMappingURL=compatibility.mjs.map

package/dist/oauth/openid-client/compatibility.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"compatibility.mjs","names":[],"sources":["../../../src/oauth/openid-client/compatibility.ts"],"sourcesContent":["import type {\n  OpenIdClientConnectedOAuthProvider,\n  OpenIdClientConnectedProtocolOptions,\n} from \"./connected/models\";\n\n/** Pure private provider rules, never part of the generic public options. */\nexport interface TokenCompatibility {\n  readonly inspectReceipt: (\n    receipt: {\n      readonly body: unknown;\n      readonly status: number;\n      readonly contentType: string | null;\n    },\n    input: {\n      readonly scopes: ReadonlyArray<string>;\n      readonly refreshRequired: boolean;\n      readonly operation: \"authorization_code\" | \"refresh_token\";\n    },\n  ) => void;\n}\n\nexport class DefiniteTokenRejection extends Error {}\n\nexport interface ConnectedCompatibility extends TokenCompatibility {\n  readonly authorizationScopes: (\n    scopes: ReadonlyArray<string>,\n    refresh: boolean,\n  ) => ReadonlyArray<string>;\n  readonly decodeScopes: (\n    receipt: string | undefined,\n    expected: ReadonlyArray<string>,\n  ) => ReadonlyArray<string>;\n  readonly includeRefreshScope: boolean;\n}\n\nexport type ProviderConnectedOAuth<R> = Omit<\n  OpenIdClientConnectedOAuthProvider<R>,\n  \"revocation\"\n> & {\n  readonly revocation: { readonly mode: \"provider-cohort\" };\n};\n\nexport type ConnectedOptions<R> = Omit<OpenIdClientConnectedProtocolOptions<R>, \"providers\"> & {\n  readonly providers: ReadonlyArray<\n    OpenIdClientConnectedProtocolOptions<R>[\"providers\"][number] | ProviderConnectedOAuth<R>\n  >;\n};\n"],"mappings":";AAqBA,IAAa,yBAAb,cAA4C,MAAM,CAAC"}
+{"version":3,"file":"compatibility.mjs","names":[],"sources":["../../../src/oauth/openid-client/compatibility.ts"],"sourcesContent":["import { Predicate, Schema } from \"effect\";\n\nimport type {\n  OpenIdClientConnectedOAuthProvider,\n  OpenIdClientConnectedProtocolOptions,\n} from \"./connected/models\";\n\n/** Pure private provider rules, never part of the generic public options. */\nexport interface TokenCompatibility {\n  readonly inspectReceipt: (\n    receipt: {\n      readonly body: unknown;\n      readonly status: number;\n      readonly contentType: string | null;\n    },\n    input: {\n      readonly scopes: ReadonlyArray<string>;\n      readonly refreshRequired: boolean;\n      readonly operation: \"authorization_code\" | \"refresh_token\";\n    },\n  ) => void;\n}\n\n/** First-party rules travel with the exact provider generation. The symbol stays\n * private so generic provider options do not expose grant-bearing hooks. */\nexport const tokenCompatibility = Symbol(\"effect-auth/OpenIdClient/tokenCompatibility\");\n\nexport const TokenCompatibility = Schema.declare<TokenCompatibility>(\n  (input): input is TokenCompatibility =>\n    Predicate.isObject(input) &&\n    \"inspectReceipt\" in input &&\n    Predicate.isFunction(input.inspectReceipt),\n);\n\nexport class DefiniteTokenRejection extends Error {}\n\nexport interface ConnectedCompatibility extends TokenCompatibility {\n  readonly authorizationScopes: (\n    scopes: ReadonlyArray<string>,\n    refresh: boolean,\n  ) => ReadonlyArray<string>;\n  readonly decodeScopes: (\n    receipt: string | undefined,\n    expected: ReadonlyArray<string>,\n  ) => ReadonlyArray<string>;\n  readonly includeRefreshScope: boolean;\n}\n\nexport type ProviderConnectedOAuth<R> = Omit<\n  OpenIdClientConnectedOAuthProvider<R>,\n  \"revocation\"\n> & {\n  readonly revocation: { readonly mode: \"provider-cohort\" };\n};\n\nexport type ConnectedOptions<R> = Omit<OpenIdClientConnectedProtocolOptions<R>, \"providers\"> & {\n  readonly providers: ReadonlyArray<\n    OpenIdClientConnectedProtocolOptions<R>[\"providers\"][number] | ProviderConnectedOAuth<R>\n  >;\n};\n"],"mappings":";;;;AAyBA,MAAa,qBAAqB,OAAO,6CAA6C;AAEtF,MAAa,qBAAqB,OAAO,SACtC,UACC,UAAU,SAAS,KAAK,KACxB,oBAAoB,SACpB,UAAU,WAAW,MAAM,cAAc,CAC7C;AAEA,IAAa,yBAAb,cAA4C,MAAM,CAAC"}

package/dist/oauth/openid-client/configuration.mjs

@@ -3,6 +3,7 @@ import { OAuthAuthorizationUrl, OAuthCallbackId, OAuthGeneration, OAuthIssuer, O
 import { OAuthUnavailable } from "../signInErrors.mjs";
 import { freezeOAuth } from "../signInSnapshot.mjs";
 import { OpenIdClientConfigurationError } from "./models.mjs";
+import { TokenCompatibility, tokenCompatibility } from "./compatibility.mjs";
 import { boundedFetch } from "./transport.mjs";
 import { Effect, Predicate, Redacted, Schema } from "effect";
 import * as client from "openid-client";
@@ -52,6 +53,7 @@ const optionsSchema = () => Schema.toType(Schema.Struct({
 	}), Schema.Struct({
 		...common,
 		protocol: Schema.Literal("oauth"),
+		[tokenCompatibility]: Schema.optionalKey(TokenCompatibility),
 		authorizationEndpoint: boundedString(2048),
 		tokenEndpoint: boundedString(2048),
 		pkceS256: Schema.Literal(true),

package/dist/oauth/openid-client/configuration.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"configuration.mjs","names":[],"sources":["../../../src/oauth/openid-client/configuration.ts"],"sourcesContent":["import { Effect, Predicate, Redacted, Schema } from \"effect\";\nimport * as client from \"openid-client\";\n\nimport { OAuthProviderKey } from \"../schema\";\nimport { OAuthUnavailable } from \"../signInErrors\";\nimport {\n  OAuthAuthorizationUrl,\n  OAuthCallbackId,\n  OAuthGeneration,\n  OAuthIssuer,\n  OAuthRedirectUri,\n} from \"../signInModels\";\nimport { freezeOAuth } from \"../signInSnapshot\";\nimport {\n  OpenIdClientConfigurationError,\n  type OpenIdClientAuthentication,\n  type OpenIdClientOAuthProvider,\n  type OpenIdClientOAuthProtocolOptions,\n  type OpenIdClientOidcProvider,\n} from \"./models\";\nimport { boundedFetch } from \"./transport\";\n\nconst boundedString = (maximum: number) =>\n  Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(maximum));\n\nconst fields = Schema.Record(\n  Schema.String.check(Schema.isPattern(/^[A-Za-z][A-Za-z0-9._~-]{0,63}$/)),\n  Schema.String.check(Schema.isMaxLength(2048)),\n).check(Schema.makeFilter((record) => Object.keys(record).length <= 16));\n\nconst secret = Schema.RedactedFromValue(boundedString(4096));\n\nconst authentication = Schema.Union([\n  Schema.Struct({ method: Schema.Literal(\"client_secret_basic\"), secret }),\n  Schema.Struct({ method: Schema.Literal(\"client_secret_post\"), secret }),\n  Schema.Struct({ method: Schema.Literal(\"none\"), publicClient: Schema.Literal(true) }),\n]);\n\nconst common = {\n  provider: OAuthProviderKey,\n  configurationGeneration: OAuthGeneration,\n  issuance: Schema.Literals([\"active\", \"retired\"]),\n  issuer: OAuthIssuer,\n  responseIssuerMode: Schema.Literals([\"required\", \"unsupported\"]),\n  clientId: boundedString(1024),\n  authentication,\n  callbacks: Schema.Array(\n    Schema.Struct({ callbackId: OAuthCallbackId, redirectUri: OAuthRedirectUri }),\n  ).check(Schema.isMinLength(1), Schema.isMaxLength(16)),\n  scopes: Schema.Array(\n    Schema.String.check(Schema.isPattern(/^[\\x21\\x23-\\x5b\\x5d-\\x7e]{1,128}$/)),\n  ).check(Schema.isMaxLength(32)),\n  authorizationParameters: Schema.optionalKey(fields),\n  tokenParameters: Schema.optionalKey(fields),\n};\n\nconst optionsSchema = <R>() =>\n  Schema.toType(\n    Schema.Struct({\n      providers: Schema.Array(\n        Schema.Union([\n          Schema.Struct({\n            ...common,\n            protocol: Schema.Literal(\"oidc\"),\n            idTokenSignedResponseAlg: Schema.Literal(\"RS256\"),\n            maxAgeSeconds: Schema.optionalKey(\n              Schema.Int.check(Schema.isBetween({ minimum: 0, maximum: 86400 })),\n            ),\n          }),\n          Schema.Struct({\n            ...common,\n            protocol: Schema.Literal(\"oauth\"),\n            authorizationEndpoint: boundedString(2048),\n            tokenEndpoint: boundedString(2048),\n            pkceS256: Schema.Literal(true),\n            identitySource: Schema.Struct({\n              url: boundedString(2048),\n              headers: Schema.optionalKey(fields),\n              // A configured function is trusted application code; its result has a separate schema boundary.\n              decodeIdentity: Schema.declare<\n                OpenIdClientOAuthProvider<R>[\"identitySource\"][\"decodeIdentity\"]\n              >(\n                (\n                  input,\n                ): input is OpenIdClientOAuthProvider<R>[\"identitySource\"][\"decodeIdentity\"] =>\n                  Predicate.isFunction(input),\n              ),\n            }),\n          }),\n        ]),\n      ).check(Schema.isMinLength(1), Schema.isMaxLength(64)),\n      timeoutSeconds: Schema.Finite.check(Schema.isBetween({ minimum: 1, maximum: 30 })),\n      fetch: Schema.optionalKey(\n        Schema.declare<client.CustomFetch>((input): input is client.CustomFetch =>\n          Predicate.isFunction(input),\n        ),\n      ),\n    }),\n  );\n\nconst reserved = new Set([\n  \"client_id\",\n  \"client_secret\",\n  \"client_assertion\",\n  \"client_assertion_type\",\n  \"redirect_uri\",\n  \"response_type\",\n  \"response_mode\",\n  \"state\",\n  \"code\",\n  \"code_verifier\",\n  \"code_challenge\",\n  \"code_challenge_method\",\n  \"nonce\",\n  \"scope\",\n  \"iss\",\n  \"grant_type\",\n  \"max_age\",\n  \"request\",\n  \"request_uri\",\n  \"authorization_details\",\n  \"id_token_hint\",\n  \"login_hint\",\n  \"login_hint_token\",\n  \"subject_token\",\n  \"subject_token_type\",\n  \"actor_token\",\n  \"actor_token_type\",\n  \"requested_token_type\",\n]);\n\nconst forbiddenHeaders = new Set([\n  \"authorization\",\n  \"proxy-authorization\",\n  \"cookie\",\n  \"host\",\n  \"content-length\",\n  \"content-type\",\n  \"transfer-encoding\",\n  \"connection\",\n  \"upgrade\",\n  \"trailer\",\n  \"te\",\n]);\n\nconst configError = (reason: OpenIdClientConfigurationError[\"reason\"]) =>\n  OpenIdClientConfigurationError.make({ reason });\n\nexport const endpoint = (value: string): URL => {\n  const url = new URL(value);\n\n  if (\n    url.protocol !== \"https:\" ||\n    url.username !== \"\" ||\n    url.password !== \"\" ||\n    value.includes(\"#\") ||\n    // oxlint-disable-next-line no-control-regex -- Reject ambiguous protocol URL control characters.\n    /[\\s\\\\\\u0000-\\u001f\\u007f]/u.test(value)\n  )\n    throw configError(\"metadata\");\n\n  return url;\n};\n\nconst checkParameters = (parameters: Readonly<Record<string, string>> | undefined) => {\n  for (const key of Object.keys(parameters ?? {})) {\n    if (reserved.has(key.toLowerCase())) throw configError(\"parameters\");\n  }\n};\n\nexport const clientAuthentication = (\n  authentication: OpenIdClientAuthentication,\n): client.ClientAuth => {\n  switch (authentication.method) {\n    case \"client_secret_basic\":\n      return client.ClientSecretBasic(Redacted.value(authentication.secret));\n    case \"client_secret_post\":\n      return client.ClientSecretPost(Redacted.value(authentication.secret));\n    case \"none\":\n      return client.None();\n  }\n};\n\nexport type Provider<R> = OpenIdClientOidcProvider | OpenIdClientOAuthProvider<R>;\n\nexport interface InstalledProvider<R> {\n  readonly provider: Provider<R>;\n  readonly metadata: client.ServerMetadata;\n  readonly allowedUrls: ReadonlySet<string>;\n}\n\nexport const makeAuthorizationParameters = (\n  configuration: {\n    readonly protocol: \"oauth\" | \"oidc\";\n    readonly authorizationParameters?: Readonly<Record<string, string>>;\n    readonly scopes: ReadonlyArray<string>;\n    readonly maxAgeSeconds?: number;\n  },\n  redirectUri: string,\n  generated: { readonly state: string; readonly challenge: string; readonly nonce?: string },\n): Record<string, string> => ({\n  ...configuration.authorizationParameters,\n  response_type: \"code\",\n  response_mode: \"query\",\n  redirect_uri: redirectUri,\n  scope: configuration.scopes.join(\" \"),\n  state: generated.state,\n  code_challenge: generated.challenge,\n  code_challenge_method: \"S256\",\n  ...(generated.nonce === undefined ? {} : { nonce: generated.nonce }),\n  ...(configuration.protocol === \"oidc\" && configuration.maxAgeSeconds !== undefined\n    ? { max_age: String(configuration.maxAgeSeconds) }\n    : {}),\n});\n\nconst metadataSchema = Schema.Struct({\n  issuer: OAuthIssuer,\n  authorization_endpoint: boundedString(2048),\n  token_endpoint: boundedString(2048),\n  jwks_uri: Schema.optionalKey(boundedString(2048)),\n  code_challenge_methods_supported: Schema.optionalKey(Schema.Array(boundedString(64))),\n  response_types_supported: Schema.optionalKey(Schema.Array(boundedString(64))),\n  id_token_signing_alg_values_supported: Schema.optionalKey(Schema.Array(boundedString(64))),\n  token_endpoint_auth_methods_supported: Schema.optionalKey(Schema.Array(boundedString(64))),\n  authorization_response_iss_parameter_supported: Schema.optionalKey(Schema.Boolean),\n});\n\nexport const installConfigurations = Effect.fn(\"OpenIdClient.installConfigurations\")(function* <R>(\n  input: OpenIdClientOAuthProtocolOptions<R>,\n) {\n  const options = yield* Schema.decodeEffect(optionsSchema<R>())(input).pipe(\n    Effect.mapError(() => configError(\"provider\")),\n  );\n\n  // Detach secrets as well as arrays and records before retaining configuration.\n  const providers = options.providers.map((provider): Provider<R> => {\n    const detached = {\n      callbacks: provider.callbacks.map((callback) => ({ ...callback })),\n      scopes: [...provider.scopes],\n      ...(provider.authorizationParameters === undefined\n        ? {}\n        : { authorizationParameters: { ...provider.authorizationParameters } }),\n      ...(provider.tokenParameters === undefined\n        ? {}\n        : { tokenParameters: { ...provider.tokenParameters } }),\n      authentication:\n        provider.authentication.method === \"none\"\n          ? { ...provider.authentication }\n          : {\n              ...provider.authentication,\n              secret: Redacted.make(Redacted.value(provider.authentication.secret)),\n            },\n    };\n\n    return provider.protocol === \"oidc\"\n      ? { ...provider, ...detached }\n      : {\n          ...provider,\n          ...detached,\n          identitySource: {\n            ...provider.identitySource,\n            ...(provider.identitySource.headers === undefined\n              ? {}\n              : { headers: { ...provider.identitySource.headers } }),\n          },\n        };\n  });\n\n  const fetch: client.CustomFetch =\n    options.fetch ??\n    ((url, init) =>\n      globalThis.fetch(url, {\n        ...init,\n        body: init.body instanceof Uint8Array ? new Uint8Array(init.body) : init.body,\n      }));\n\n  yield* Effect.try({\n    try: () => {\n      const generations = new Set<string>();\n      const active = new Set<string>();\n      const names = new Set<string>();\n\n      for (const provider of providers) {\n        const generation = `${provider.provider.length}:${provider.provider}:${provider.configurationGeneration}`;\n\n        if (generations.has(generation)) throw configError(\"generation\");\n        generations.add(generation);\n        names.add(provider.provider);\n        if (provider.issuance === \"active\") {\n          if (active.has(provider.provider)) throw configError(\"generation\");\n          active.add(provider.provider);\n        }\n        const issuer = endpoint(provider.issuer);\n\n        if (provider.issuer.includes(\"?\") || issuer.pathname.includes(\"/.well-known/\"))\n          throw configError(\"issuer\");\n        if (new Set(provider.scopes).size !== provider.scopes.length)\n          throw configError(\"parameters\");\n        if ((provider.protocol === \"oidc\") !== provider.scopes.includes(\"openid\"))\n          throw configError(\"parameters\");\n        checkParameters(provider.authorizationParameters);\n        checkParameters(provider.tokenParameters);\n        const callbacks = new Set<string>();\n\n        for (const callback of provider.callbacks) {\n          const url = endpoint(callback.redirectUri);\n\n          if (\n            url.href !== callback.redirectUri ||\n            callback.redirectUri.includes(\"?\") ||\n            callbacks.has(callback.callbackId)\n          )\n            throw configError(\"callback\");\n          callbacks.add(callback.callbackId);\n          for (const other of providers) {\n            if (provider.issuer === other.issuer) continue;\n            if (\n              provider.responseIssuerMode === \"required\" &&\n              other.responseIssuerMode === \"required\"\n            )\n              continue;\n            if (other.callbacks.some((candidate) => candidate.redirectUri === callback.redirectUri))\n              throw configError(\"callback\");\n          }\n        }\n        if (provider.protocol === \"oauth\") {\n          endpoint(provider.identitySource.url);\n          for (const key of Object.keys(provider.identitySource.headers ?? {})) {\n            if (forbiddenHeaders.has(key.toLowerCase())) throw configError(\"identity-source\");\n          }\n          new Headers(provider.identitySource.headers);\n        }\n        freezeOAuth(provider);\n      }\n      if (active.size !== names.size) throw configError(\"generation\");\n    },\n    catch: (error) =>\n      Schema.is(OpenIdClientConfigurationError)(error) ? error : configError(\"provider\"),\n  });\n  const installed: InstalledProvider<R>[] = [];\n\n  for (const provider of providers) {\n    let raw: client.ServerMetadata;\n\n    if (provider.protocol === \"oidc\") {\n      const discoveryUrl = new URL(provider.issuer);\n\n      discoveryUrl.pathname = `${discoveryUrl.pathname.replace(/\\/$/u, \"\")}/.well-known/openid-configuration`;\n\n      const configuration = yield* Effect.tryPromise({\n        try: (signal) =>\n          client.discovery(\n            new URL(provider.issuer),\n            provider.clientId,\n            {\n              id_token_signed_response_alg: provider.idTokenSignedResponseAlg,\n              [client.clockSkew]: 0,\n              [client.clockTolerance]: 0,\n            },\n            clientAuthentication(provider.authentication),\n            {\n              timeout: options.timeoutSeconds,\n              execute: [client.enableNonRepudiationChecks],\n              [client.customFetch]: boundedFetch(fetch, signal, new Set([discoveryUrl.href])),\n            },\n          ),\n        catch: () => OAuthUnavailable.make({}),\n      });\n\n      raw = configuration.serverMetadata();\n    } else {\n      raw = {\n        issuer: provider.issuer,\n        authorization_endpoint: provider.authorizationEndpoint,\n        token_endpoint: provider.tokenEndpoint,\n        authorization_response_iss_parameter_supported: provider.responseIssuerMode === \"required\",\n      };\n    }\n\n    // oxlint-disable-next-line no-restricted-properties -- Discovered foreign metadata is not yet validated for this adapter profile.\n    const metadata = yield* Schema.decodeUnknownEffect(metadataSchema)(raw).pipe(\n      Effect.mapError(() => configError(\"metadata\")),\n    );\n\n    const allowedUrls = yield* Effect.try({\n      try: () => {\n        if (metadata.issuer !== provider.issuer) throw configError(\"issuer\");\n        if (\n          (metadata.authorization_response_iss_parameter_supported === true) !==\n          (provider.responseIssuerMode === \"required\")\n        )\n          throw configError(\"metadata\");\n        const auth = endpoint(metadata.authorization_endpoint);\n\n        for (const key of auth.searchParams.keys()) {\n          if (reserved.has(key.toLowerCase())) throw configError(\"parameters\");\n        }\n        const token = endpoint(metadata.token_endpoint);\n\n        const supportedAuthentication =\n          metadata.token_endpoint_auth_methods_supported ??\n          (provider.protocol === \"oidc\" ? [\"client_secret_basic\"] : undefined);\n\n        if (\n          supportedAuthentication !== undefined &&\n          !supportedAuthentication.includes(provider.authentication.method)\n        )\n          throw configError(\"authentication\");\n        const urls = new Set([token.href]);\n\n        if (provider.protocol === \"oidc\") {\n          if (\n            !metadata.code_challenge_methods_supported?.includes(\"S256\") ||\n            !metadata.response_types_supported?.includes(\"code\") ||\n            !metadata.id_token_signing_alg_values_supported?.includes(\"RS256\") ||\n            metadata.jwks_uri === undefined\n          )\n            throw configError(\"metadata\");\n          urls.add(endpoint(metadata.jwks_uri).href);\n        } else {\n          urls.add(endpoint(provider.identitySource.url).href);\n        }\n        freezeOAuth(metadata);\n\n        return urls;\n      },\n      catch: (error) =>\n        Schema.is(OpenIdClientConfigurationError)(error) ? error : configError(\"metadata\"),\n    });\n\n    const serverMetadata: client.ServerMetadata = {\n      ...metadata,\n      code_challenge_methods_supported: metadata.code_challenge_methods_supported?.slice(),\n      response_types_supported: metadata.response_types_supported?.slice(),\n      id_token_signing_alg_values_supported:\n        metadata.id_token_signing_alg_values_supported?.slice(),\n      token_endpoint_auth_methods_supported:\n        metadata.token_endpoint_auth_methods_supported?.slice(),\n    };\n\n    // The SDK encodes each generated 32-byte state/challenge/nonce in 43 URL-safe characters.\n    const placeholder = \"a\".repeat(43);\n\n    const authorization = yield* Effect.try({\n      try: () => new client.Configuration(serverMetadata, provider.clientId),\n      catch: () => configError(\"parameters\"),\n    });\n\n    for (const callback of provider.callbacks) {\n      const url = yield* Effect.try({\n        try: () =>\n          client.buildAuthorizationUrl(\n            authorization,\n            makeAuthorizationParameters(provider, callback.redirectUri, {\n              state: placeholder,\n              challenge: placeholder,\n              ...(provider.protocol === \"oidc\" ? { nonce: placeholder } : {}),\n            }),\n          ),\n        catch: () => configError(\"parameters\"),\n      });\n\n      yield* Schema.decodeEffect(OAuthAuthorizationUrl)(url.href).pipe(\n        Effect.mapError(() => configError(\"parameters\")),\n      );\n    }\n    freezeOAuth(serverMetadata);\n    installed.push({ provider, metadata: serverMetadata, allowedUrls });\n  }\n\n  return { installed, fetch, timeoutSeconds: options.timeoutSeconds };\n});\n"],"mappings":";;;;;;;;;AAsBA,MAAM,iBAAiB,YACrB,OAAO,OAAO,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,OAAO,CAAC;AAExE,MAAM,SAAS,OAAO,OACpB,OAAO,OAAO,MAAM,OAAO,UAAU,iCAAiC,CAAC,GACvE,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC,CAC9C,CAAC,CAAC,MAAM,OAAO,YAAY,WAAW,OAAO,KAAK,MAAM,CAAC,CAAC,UAAU,EAAE,CAAC;AAEvE,MAAM,SAAS,OAAO,kBAAkB,cAAc,IAAI,CAAC;AAE3D,MAAM,iBAAiB,OAAO,MAAM;CAClC,OAAO,OAAO;EAAE,QAAQ,OAAO,QAAQ,qBAAqB;EAAG;CAAO,CAAC;CACvE,OAAO,OAAO;EAAE,QAAQ,OAAO,QAAQ,oBAAoB;EAAG;CAAO,CAAC;CACtE,OAAO,OAAO;EAAE,QAAQ,OAAO,QAAQ,MAAM;EAAG,cAAc,OAAO,QAAQ,IAAI;CAAE,CAAC;AACtF,CAAC;AAED,MAAM,SAAS;CACb,UAAU;CACV,yBAAyB;CACzB,UAAU,OAAO,SAAS,CAAC,UAAU,SAAS,CAAC;CAC/C,QAAQ;CACR,oBAAoB,OAAO,SAAS,CAAC,YAAY,aAAa,CAAC;CAC/D,UAAU,cAAc,IAAI;CAC5B;CACA,WAAW,OAAO,MAChB,OAAO,OAAO;EAAE,YAAY;EAAiB,aAAa;CAAiB,CAAC,CAC9E,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,EAAE,CAAC;CACrD,QAAQ,OAAO,MACb,OAAO,OAAO,MAAM,OAAO,UAAU,mCAAmC,CAAC,CAC3E,CAAC,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC;CAC9B,yBAAyB,OAAO,YAAY,MAAM;CAClD,iBAAiB,OAAO,YAAY,MAAM;AAC5C;AAEA,MAAM,sBACJ,OAAO,OACL,OAAO,OAAO;CACZ,WAAW,OAAO,MAChB,OAAO,MAAM,CACX,OAAO,OAAO;EACZ,GAAG;EACH,UAAU,OAAO,QAAQ,MAAM;EAC/B,0BAA0B,OAAO,QAAQ,OAAO;EAChD,eAAe,OAAO,YACpB,OAAO,IAAI,MAAM,OAAO,UAAU;GAAE,SAAS;GAAG,SAAS;EAAM,CAAC,CAAC,CACnE;CACF,CAAC,GACD,OAAO,OAAO;EACZ,GAAG;EACH,UAAU,OAAO,QAAQ,OAAO;EAChC,uBAAuB,cAAc,IAAI;EACzC,eAAe,cAAc,IAAI;EACjC,UAAU,OAAO,QAAQ,IAAI;EAC7B,gBAAgB,OAAO,OAAO;GAC5B,KAAK,cAAc,IAAI;GACvB,SAAS,OAAO,YAAY,MAAM;GAElC,gBAAgB,OAAO,SAInB,UAEA,UAAU,WAAW,KAAK,CAC9B;EACF,CAAC;CACH,CAAC,CACH,CAAC,CACH,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,EAAE,CAAC;CACrD,gBAAgB,OAAO,OAAO,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAG,CAAC,CAAC;CACjF,OAAO,OAAO,YACZ,OAAO,SAA6B,UAClC,UAAU,WAAW,KAAK,CAC5B,CACF;AACF,CAAC,CACH;AAEF,MAAM,2BAAW,IAAI,IAAI;CACvB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,MAAM,mCAAmB,IAAI,IAAI;CAC/B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,MAAM,eAAe,WACnB,+BAA+B,KAAK,EAAE,OAAO,CAAC;AAEhD,MAAa,YAAY,UAAuB;CAC9C,MAAM,MAAM,IAAI,IAAI,KAAK;CAEzB,IACE,IAAI,aAAa,YACjB,IAAI,aAAa,MACjB,IAAI,aAAa,MACjB,MAAM,SAAS,GAAG,KAElB,6BAA6B,KAAK,KAAK,GAEvC,MAAM,YAAY,UAAU;CAE9B,OAAO;AACT;AAEA,MAAM,mBAAmB,eAA6D;CACpF,KAAK,MAAM,OAAO,OAAO,KAAK,cAAc,CAAC,CAAC,GAC5C,IAAI,SAAS,IAAI,IAAI,YAAY,CAAC,GAAG,MAAM,YAAY,YAAY;AAEvE;AAEA,MAAa,wBACX,mBACsB;CACtB,QAAQ,eAAe,QAAvB;EACE,KAAK,uBACH,OAAO,OAAO,kBAAkB,SAAS,MAAM,eAAe,MAAM,CAAC;EACvE,KAAK,sBACH,OAAO,OAAO,iBAAiB,SAAS,MAAM,eAAe,MAAM,CAAC;EACtE,KAAK,QACH,OAAO,OAAO,KAAK;CACvB;AACF;AAUA,MAAa,+BACX,eAMA,aACA,eAC4B;CAC5B,GAAG,cAAc;CACjB,eAAe;CACf,eAAe;CACf,cAAc;CACd,OAAO,cAAc,OAAO,KAAK,GAAG;CACpC,OAAO,UAAU;CACjB,gBAAgB,UAAU;CAC1B,uBAAuB;CACvB,GAAI,UAAU,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,UAAU,MAAM;CAClE,GAAI,cAAc,aAAa,UAAU,cAAc,kBAAkB,KAAA,IACrE,EAAE,SAAS,OAAO,cAAc,aAAa,EAAE,IAC/C,CAAC;AACP;AAEA,MAAM,iBAAiB,OAAO,OAAO;CACnC,QAAQ;CACR,wBAAwB,cAAc,IAAI;CAC1C,gBAAgB,cAAc,IAAI;CAClC,UAAU,OAAO,YAAY,cAAc,IAAI,CAAC;CAChD,kCAAkC,OAAO,YAAY,OAAO,MAAM,cAAc,EAAE,CAAC,CAAC;CACpF,0BAA0B,OAAO,YAAY,OAAO,MAAM,cAAc,EAAE,CAAC,CAAC;CAC5E,uCAAuC,OAAO,YAAY,OAAO,MAAM,cAAc,EAAE,CAAC,CAAC;CACzF,uCAAuC,OAAO,YAAY,OAAO,MAAM,cAAc,EAAE,CAAC,CAAC;CACzF,gDAAgD,OAAO,YAAY,OAAO,OAAO;AACnF,CAAC;AAED,MAAa,wBAAwB,OAAO,GAAG,oCAAoC,CAAC,CAAC,WACnF,OACA;CACA,MAAM,UAAU,OAAO,OAAO,aAAa,cAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KACpE,OAAO,eAAe,YAAY,UAAU,CAAC,CAC/C;CAGA,MAAM,YAAY,QAAQ,UAAU,KAAK,aAA0B;EACjE,MAAM,WAAW;GACf,WAAW,SAAS,UAAU,KAAK,cAAc,EAAE,GAAG,SAAS,EAAE;GACjE,QAAQ,CAAC,GAAG,SAAS,MAAM;GAC3B,GAAI,SAAS,4BAA4B,KAAA,IACrC,CAAC,IACD,EAAE,yBAAyB,EAAE,GAAG,SAAS,wBAAwB,EAAE;GACvE,GAAI,SAAS,oBAAoB,KAAA,IAC7B,CAAC,IACD,EAAE,iBAAiB,EAAE,GAAG,SAAS,gBAAgB,EAAE;GACvD,gBACE,SAAS,eAAe,WAAW,SAC/B,EAAE,GAAG,SAAS,eAAe,IAC7B;IACE,GAAG,SAAS;IACZ,QAAQ,SAAS,KAAK,SAAS,MAAM,SAAS,eAAe,MAAM,CAAC;GACtE;EACR;EAEA,OAAO,SAAS,aAAa,SACzB;GAAE,GAAG;GAAU,GAAG;EAAS,IAC3B;GACE,GAAG;GACH,GAAG;GACH,gBAAgB;IACd,GAAG,SAAS;IACZ,GAAI,SAAS,eAAe,YAAY,KAAA,IACpC,CAAC,IACD,EAAE,SAAS,EAAE,GAAG,SAAS,eAAe,QAAQ,EAAE;GACxD;EACF;CACN,CAAC;CAED,MAAM,QACJ,QAAQ,WACN,KAAK,SACL,WAAW,MAAM,KAAK;EACpB,GAAG;EACH,MAAM,KAAK,gBAAgB,aAAa,IAAI,WAAW,KAAK,IAAI,IAAI,KAAK;CAC3E,CAAC;CAEL,OAAO,OAAO,IAAI;EAChB,WAAW;GACT,MAAM,8BAAc,IAAI,IAAY;GACpC,MAAM,yBAAS,IAAI,IAAY;GAC/B,MAAM,wBAAQ,IAAI,IAAY;GAE9B,KAAK,MAAM,YAAY,WAAW;IAChC,MAAM,aAAa,GAAG,SAAS,SAAS,OAAO,GAAG,SAAS,SAAS,GAAG,SAAS;IAEhF,IAAI,YAAY,IAAI,UAAU,GAAG,MAAM,YAAY,YAAY;IAC/D,YAAY,IAAI,UAAU;IAC1B,MAAM,IAAI,SAAS,QAAQ;IAC3B,IAAI,SAAS,aAAa,UAAU;KAClC,IAAI,OAAO,IAAI,SAAS,QAAQ,GAAG,MAAM,YAAY,YAAY;KACjE,OAAO,IAAI,SAAS,QAAQ;IAC9B;IACA,MAAM,SAAS,SAAS,SAAS,MAAM;IAEvC,IAAI,SAAS,OAAO,SAAS,GAAG,KAAK,OAAO,SAAS,SAAS,eAAe,GAC3E,MAAM,YAAY,QAAQ;IAC5B,IAAI,IAAI,IAAI,SAAS,MAAM,CAAC,CAAC,SAAS,SAAS,OAAO,QACpD,MAAM,YAAY,YAAY;IAChC,IAAK,SAAS,aAAa,WAAY,SAAS,OAAO,SAAS,QAAQ,GACtE,MAAM,YAAY,YAAY;IAChC,gBAAgB,SAAS,uBAAuB;IAChD,gBAAgB,SAAS,eAAe;IACxC,MAAM,4BAAY,IAAI,IAAY;IAElC,KAAK,MAAM,YAAY,SAAS,WAAW;KAGzC,IAFY,SAAS,SAAS,WAG1B,CAAC,CAAC,SAAS,SAAS,eACtB,SAAS,YAAY,SAAS,GAAG,KACjC,UAAU,IAAI,SAAS,UAAU,GAEjC,MAAM,YAAY,UAAU;KAC9B,UAAU,IAAI,SAAS,UAAU;KACjC,KAAK,MAAM,SAAS,WAAW;MAC7B,IAAI,SAAS,WAAW,MAAM,QAAQ;MACtC,IACE,SAAS,uBAAuB,cAChC,MAAM,uBAAuB,YAE7B;MACF,IAAI,MAAM,UAAU,MAAM,cAAc,UAAU,gBAAgB,SAAS,WAAW,GACpF,MAAM,YAAY,UAAU;KAChC;IACF;IACA,IAAI,SAAS,aAAa,SAAS;KACjC,SAAS,SAAS,eAAe,GAAG;KACpC,KAAK,MAAM,OAAO,OAAO,KAAK,SAAS,eAAe,WAAW,CAAC,CAAC,GACjE,IAAI,iBAAiB,IAAI,IAAI,YAAY,CAAC,GAAG,MAAM,YAAY,iBAAiB;KAElF,IAAI,QAAQ,SAAS,eAAe,OAAO;IAC7C;IACA,YAAY,QAAQ;GACtB;GACA,IAAI,OAAO,SAAS,MAAM,MAAM,MAAM,YAAY,YAAY;EAChE;EACA,QAAQ,UACN,OAAO,GAAG,8BAA8B,CAAC,CAAC,KAAK,IAAI,QAAQ,YAAY,UAAU;CACrF,CAAC;CACD,MAAM,YAAoC,CAAC;CAE3C,KAAK,MAAM,YAAY,WAAW;EAChC,IAAI;EAEJ,IAAI,SAAS,aAAa,QAAQ;GAChC,MAAM,eAAe,IAAI,IAAI,SAAS,MAAM;GAE5C,aAAa,WAAW,GAAG,aAAa,SAAS,QAAQ,QAAQ,EAAE,EAAE;GAsBrE,OAAM,OApBuB,OAAO,WAAW;IAC7C,MAAM,WACJ,OAAO,UACL,IAAI,IAAI,SAAS,MAAM,GACvB,SAAS,UACT;KACE,8BAA8B,SAAS;MACtC,OAAO,YAAY;MACnB,OAAO,iBAAiB;IAC3B,GACA,qBAAqB,SAAS,cAAc,GAC5C;KACE,SAAS,QAAQ;KACjB,SAAS,CAAC,OAAO,0BAA0B;MAC1C,OAAO,cAAc,aAAa,OAAO,wBAAQ,IAAI,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC;IAChF,CACF;IACF,aAAa,iBAAiB,KAAK,CAAC,CAAC;GACvC,CAAC,EAAA,CAEmB,eAAe;EACrC,OACE,MAAM;GACJ,QAAQ,SAAS;GACjB,wBAAwB,SAAS;GACjC,gBAAgB,SAAS;GACzB,gDAAgD,SAAS,uBAAuB;EAClF;EAIF,MAAM,WAAW,OAAO,OAAO,oBAAoB,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,KACtE,OAAO,eAAe,YAAY,UAAU,CAAC,CAC/C;EAEA,MAAM,cAAc,OAAO,OAAO,IAAI;GACpC,WAAW;IACT,IAAI,SAAS,WAAW,SAAS,QAAQ,MAAM,YAAY,QAAQ;IACnE,IACG,SAAS,mDAAmD,UAC5D,SAAS,uBAAuB,aAEjC,MAAM,YAAY,UAAU;IAC9B,MAAM,OAAO,SAAS,SAAS,sBAAsB;IAErD,KAAK,MAAM,OAAO,KAAK,aAAa,KAAK,GACvC,IAAI,SAAS,IAAI,IAAI,YAAY,CAAC,GAAG,MAAM,YAAY,YAAY;IAErE,MAAM,QAAQ,SAAS,SAAS,cAAc;IAE9C,MAAM,0BACJ,SAAS,0CACR,SAAS,aAAa,SAAS,CAAC,qBAAqB,IAAI,KAAA;IAE5D,IACE,4BAA4B,KAAA,KAC5B,CAAC,wBAAwB,SAAS,SAAS,eAAe,MAAM,GAEhE,MAAM,YAAY,gBAAgB;IACpC,MAAM,uBAAO,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC;IAEjC,IAAI,SAAS,aAAa,QAAQ;KAChC,IACE,CAAC,SAAS,kCAAkC,SAAS,MAAM,KAC3D,CAAC,SAAS,0BAA0B,SAAS,MAAM,KACnD,CAAC,SAAS,uCAAuC,SAAS,OAAO,KACjE,SAAS,aAAa,KAAA,GAEtB,MAAM,YAAY,UAAU;KAC9B,KAAK,IAAI,SAAS,SAAS,QAAQ,CAAC,CAAC,IAAI;IAC3C,OACE,KAAK,IAAI,SAAS,SAAS,eAAe,GAAG,CAAC,CAAC,IAAI;IAErD,YAAY,QAAQ;IAEpB,OAAO;GACT;GACA,QAAQ,UACN,OAAO,GAAG,8BAA8B,CAAC,CAAC,KAAK,IAAI,QAAQ,YAAY,UAAU;EACrF,CAAC;EAED,MAAM,iBAAwC;GAC5C,GAAG;GACH,kCAAkC,SAAS,kCAAkC,MAAM;GACnF,0BAA0B,SAAS,0BAA0B,MAAM;GACnE,uCACE,SAAS,uCAAuC,MAAM;GACxD,uCACE,SAAS,uCAAuC,MAAM;EAC1D;EAGA,MAAM,cAAc,IAAI,OAAO,EAAE;EAEjC,MAAM,gBAAgB,OAAO,OAAO,IAAI;GACtC,WAAW,IAAI,OAAO,cAAc,gBAAgB,SAAS,QAAQ;GACrE,aAAa,YAAY,YAAY;EACvC,CAAC;EAED,KAAK,MAAM,YAAY,SAAS,WAAW;GACzC,MAAM,MAAM,OAAO,OAAO,IAAI;IAC5B,WACE,OAAO,sBACL,eACA,4BAA4B,UAAU,SAAS,aAAa;KAC1D,OAAO;KACP,WAAW;KACX,GAAI,SAAS,aAAa,SAAS,EAAE,OAAO,YAAY,IAAI,CAAC;IAC/D,CAAC,CACH;IACF,aAAa,YAAY,YAAY;GACvC,CAAC;GAED,OAAO,OAAO,aAAa,qBAAqB,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAC1D,OAAO,eAAe,YAAY,YAAY,CAAC,CACjD;EACF;EACA,YAAY,cAAc;EAC1B,UAAU,KAAK;GAAE;GAAU,UAAU;GAAgB;EAAY,CAAC;CACpE;CAEA,OAAO;EAAE;EAAW;EAAO,gBAAgB,QAAQ;CAAe;AACpE,CAAC"}
+{"version":3,"file":"configuration.mjs","names":[],"sources":["../../../src/oauth/openid-client/configuration.ts"],"sourcesContent":["import { Effect, Predicate, Redacted, Schema } from \"effect\";\nimport * as client from \"openid-client\";\n\nimport { OAuthProviderKey } from \"../schema\";\nimport { OAuthUnavailable } from \"../signInErrors\";\nimport {\n  OAuthAuthorizationUrl,\n  OAuthCallbackId,\n  OAuthGeneration,\n  OAuthIssuer,\n  OAuthRedirectUri,\n} from \"../signInModels\";\nimport { freezeOAuth } from \"../signInSnapshot\";\nimport { TokenCompatibility, tokenCompatibility } from \"./compatibility\";\nimport {\n  OpenIdClientConfigurationError,\n  type OpenIdClientAuthentication,\n  type OpenIdClientOAuthProvider,\n  type OpenIdClientOAuthProtocolOptions,\n  type OpenIdClientOidcProvider,\n} from \"./models\";\nimport { boundedFetch } from \"./transport\";\n\nconst boundedString = (maximum: number) =>\n  Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(maximum));\n\nconst fields = Schema.Record(\n  Schema.String.check(Schema.isPattern(/^[A-Za-z][A-Za-z0-9._~-]{0,63}$/)),\n  Schema.String.check(Schema.isMaxLength(2048)),\n).check(Schema.makeFilter((record) => Object.keys(record).length <= 16));\n\nconst secret = Schema.RedactedFromValue(boundedString(4096));\n\nconst authentication = Schema.Union([\n  Schema.Struct({ method: Schema.Literal(\"client_secret_basic\"), secret }),\n  Schema.Struct({ method: Schema.Literal(\"client_secret_post\"), secret }),\n  Schema.Struct({ method: Schema.Literal(\"none\"), publicClient: Schema.Literal(true) }),\n]);\n\nconst common = {\n  provider: OAuthProviderKey,\n  configurationGeneration: OAuthGeneration,\n  issuance: Schema.Literals([\"active\", \"retired\"]),\n  issuer: OAuthIssuer,\n  responseIssuerMode: Schema.Literals([\"required\", \"unsupported\"]),\n  clientId: boundedString(1024),\n  authentication,\n  callbacks: Schema.Array(\n    Schema.Struct({ callbackId: OAuthCallbackId, redirectUri: OAuthRedirectUri }),\n  ).check(Schema.isMinLength(1), Schema.isMaxLength(16)),\n  scopes: Schema.Array(\n    Schema.String.check(Schema.isPattern(/^[\\x21\\x23-\\x5b\\x5d-\\x7e]{1,128}$/)),\n  ).check(Schema.isMaxLength(32)),\n  authorizationParameters: Schema.optionalKey(fields),\n  tokenParameters: Schema.optionalKey(fields),\n};\n\nconst optionsSchema = <R>() =>\n  Schema.toType(\n    Schema.Struct({\n      providers: Schema.Array(\n        Schema.Union([\n          Schema.Struct({\n            ...common,\n            protocol: Schema.Literal(\"oidc\"),\n            idTokenSignedResponseAlg: Schema.Literal(\"RS256\"),\n            maxAgeSeconds: Schema.optionalKey(\n              Schema.Int.check(Schema.isBetween({ minimum: 0, maximum: 86400 })),\n            ),\n          }),\n          Schema.Struct({\n            ...common,\n            protocol: Schema.Literal(\"oauth\"),\n            [tokenCompatibility]: Schema.optionalKey(TokenCompatibility),\n            authorizationEndpoint: boundedString(2048),\n            tokenEndpoint: boundedString(2048),\n            pkceS256: Schema.Literal(true),\n            identitySource: Schema.Struct({\n              url: boundedString(2048),\n              headers: Schema.optionalKey(fields),\n              // A configured function is trusted application code; its result has a separate schema boundary.\n              decodeIdentity: Schema.declare<\n                OpenIdClientOAuthProvider<R>[\"identitySource\"][\"decodeIdentity\"]\n              >(\n                (\n                  input,\n                ): input is OpenIdClientOAuthProvider<R>[\"identitySource\"][\"decodeIdentity\"] =>\n                  Predicate.isFunction(input),\n              ),\n            }),\n          }),\n        ]),\n      ).check(Schema.isMinLength(1), Schema.isMaxLength(64)),\n      timeoutSeconds: Schema.Finite.check(Schema.isBetween({ minimum: 1, maximum: 30 })),\n      fetch: Schema.optionalKey(\n        Schema.declare<client.CustomFetch>((input): input is client.CustomFetch =>\n          Predicate.isFunction(input),\n        ),\n      ),\n    }),\n  );\n\nconst reserved = new Set([\n  \"client_id\",\n  \"client_secret\",\n  \"client_assertion\",\n  \"client_assertion_type\",\n  \"redirect_uri\",\n  \"response_type\",\n  \"response_mode\",\n  \"state\",\n  \"code\",\n  \"code_verifier\",\n  \"code_challenge\",\n  \"code_challenge_method\",\n  \"nonce\",\n  \"scope\",\n  \"iss\",\n  \"grant_type\",\n  \"max_age\",\n  \"request\",\n  \"request_uri\",\n  \"authorization_details\",\n  \"id_token_hint\",\n  \"login_hint\",\n  \"login_hint_token\",\n  \"subject_token\",\n  \"subject_token_type\",\n  \"actor_token\",\n  \"actor_token_type\",\n  \"requested_token_type\",\n]);\n\nconst forbiddenHeaders = new Set([\n  \"authorization\",\n  \"proxy-authorization\",\n  \"cookie\",\n  \"host\",\n  \"content-length\",\n  \"content-type\",\n  \"transfer-encoding\",\n  \"connection\",\n  \"upgrade\",\n  \"trailer\",\n  \"te\",\n]);\n\nconst configError = (reason: OpenIdClientConfigurationError[\"reason\"]) =>\n  OpenIdClientConfigurationError.make({ reason });\n\nexport const endpoint = (value: string): URL => {\n  const url = new URL(value);\n\n  if (\n    url.protocol !== \"https:\" ||\n    url.username !== \"\" ||\n    url.password !== \"\" ||\n    value.includes(\"#\") ||\n    // oxlint-disable-next-line no-control-regex -- Reject ambiguous protocol URL control characters.\n    /[\\s\\\\\\u0000-\\u001f\\u007f]/u.test(value)\n  )\n    throw configError(\"metadata\");\n\n  return url;\n};\n\nconst checkParameters = (parameters: Readonly<Record<string, string>> | undefined) => {\n  for (const key of Object.keys(parameters ?? {})) {\n    if (reserved.has(key.toLowerCase())) throw configError(\"parameters\");\n  }\n};\n\nexport const clientAuthentication = (\n  authentication: OpenIdClientAuthentication,\n): client.ClientAuth => {\n  switch (authentication.method) {\n    case \"client_secret_basic\":\n      return client.ClientSecretBasic(Redacted.value(authentication.secret));\n    case \"client_secret_post\":\n      return client.ClientSecretPost(Redacted.value(authentication.secret));\n    case \"none\":\n      return client.None();\n  }\n};\n\nexport type Provider<R> = OpenIdClientOidcProvider | OpenIdClientOAuthProvider<R>;\n\nexport interface InstalledProvider<R> {\n  readonly provider: Provider<R>;\n  readonly metadata: client.ServerMetadata;\n  readonly allowedUrls: ReadonlySet<string>;\n}\n\nexport const makeAuthorizationParameters = (\n  configuration: {\n    readonly protocol: \"oauth\" | \"oidc\";\n    readonly authorizationParameters?: Readonly<Record<string, string>>;\n    readonly scopes: ReadonlyArray<string>;\n    readonly maxAgeSeconds?: number;\n  },\n  redirectUri: string,\n  generated: { readonly state: string; readonly challenge: string; readonly nonce?: string },\n): Record<string, string> => ({\n  ...configuration.authorizationParameters,\n  response_type: \"code\",\n  response_mode: \"query\",\n  redirect_uri: redirectUri,\n  scope: configuration.scopes.join(\" \"),\n  state: generated.state,\n  code_challenge: generated.challenge,\n  code_challenge_method: \"S256\",\n  ...(generated.nonce === undefined ? {} : { nonce: generated.nonce }),\n  ...(configuration.protocol === \"oidc\" && configuration.maxAgeSeconds !== undefined\n    ? { max_age: String(configuration.maxAgeSeconds) }\n    : {}),\n});\n\nconst metadataSchema = Schema.Struct({\n  issuer: OAuthIssuer,\n  authorization_endpoint: boundedString(2048),\n  token_endpoint: boundedString(2048),\n  jwks_uri: Schema.optionalKey(boundedString(2048)),\n  code_challenge_methods_supported: Schema.optionalKey(Schema.Array(boundedString(64))),\n  response_types_supported: Schema.optionalKey(Schema.Array(boundedString(64))),\n  id_token_signing_alg_values_supported: Schema.optionalKey(Schema.Array(boundedString(64))),\n  token_endpoint_auth_methods_supported: Schema.optionalKey(Schema.Array(boundedString(64))),\n  authorization_response_iss_parameter_supported: Schema.optionalKey(Schema.Boolean),\n});\n\nexport const installConfigurations = Effect.fn(\"OpenIdClient.installConfigurations\")(function* <R>(\n  input: OpenIdClientOAuthProtocolOptions<R>,\n) {\n  const options = yield* Schema.decodeEffect(optionsSchema<R>())(input).pipe(\n    Effect.mapError(() => configError(\"provider\")),\n  );\n\n  // Detach secrets as well as arrays and records before retaining configuration.\n  const providers = options.providers.map((provider): Provider<R> => {\n    const detached = {\n      callbacks: provider.callbacks.map((callback) => ({ ...callback })),\n      scopes: [...provider.scopes],\n      ...(provider.authorizationParameters === undefined\n        ? {}\n        : { authorizationParameters: { ...provider.authorizationParameters } }),\n      ...(provider.tokenParameters === undefined\n        ? {}\n        : { tokenParameters: { ...provider.tokenParameters } }),\n      authentication:\n        provider.authentication.method === \"none\"\n          ? { ...provider.authentication }\n          : {\n              ...provider.authentication,\n              secret: Redacted.make(Redacted.value(provider.authentication.secret)),\n            },\n    };\n\n    return provider.protocol === \"oidc\"\n      ? { ...provider, ...detached }\n      : {\n          ...provider,\n          ...detached,\n          identitySource: {\n            ...provider.identitySource,\n            ...(provider.identitySource.headers === undefined\n              ? {}\n              : { headers: { ...provider.identitySource.headers } }),\n          },\n        };\n  });\n\n  const fetch: client.CustomFetch =\n    options.fetch ??\n    ((url, init) =>\n      globalThis.fetch(url, {\n        ...init,\n        body: init.body instanceof Uint8Array ? new Uint8Array(init.body) : init.body,\n      }));\n\n  yield* Effect.try({\n    try: () => {\n      const generations = new Set<string>();\n      const active = new Set<string>();\n      const names = new Set<string>();\n\n      for (const provider of providers) {\n        const generation = `${provider.provider.length}:${provider.provider}:${provider.configurationGeneration}`;\n\n        if (generations.has(generation)) throw configError(\"generation\");\n        generations.add(generation);\n        names.add(provider.provider);\n        if (provider.issuance === \"active\") {\n          if (active.has(provider.provider)) throw configError(\"generation\");\n          active.add(provider.provider);\n        }\n        const issuer = endpoint(provider.issuer);\n\n        if (provider.issuer.includes(\"?\") || issuer.pathname.includes(\"/.well-known/\"))\n          throw configError(\"issuer\");\n        if (new Set(provider.scopes).size !== provider.scopes.length)\n          throw configError(\"parameters\");\n        if ((provider.protocol === \"oidc\") !== provider.scopes.includes(\"openid\"))\n          throw configError(\"parameters\");\n        checkParameters(provider.authorizationParameters);\n        checkParameters(provider.tokenParameters);\n        const callbacks = new Set<string>();\n\n        for (const callback of provider.callbacks) {\n          const url = endpoint(callback.redirectUri);\n\n          if (\n            url.href !== callback.redirectUri ||\n            callback.redirectUri.includes(\"?\") ||\n            callbacks.has(callback.callbackId)\n          )\n            throw configError(\"callback\");\n          callbacks.add(callback.callbackId);\n          for (const other of providers) {\n            if (provider.issuer === other.issuer) continue;\n            if (\n              provider.responseIssuerMode === \"required\" &&\n              other.responseIssuerMode === \"required\"\n            )\n              continue;\n            if (other.callbacks.some((candidate) => candidate.redirectUri === callback.redirectUri))\n              throw configError(\"callback\");\n          }\n        }\n        if (provider.protocol === \"oauth\") {\n          endpoint(provider.identitySource.url);\n          for (const key of Object.keys(provider.identitySource.headers ?? {})) {\n            if (forbiddenHeaders.has(key.toLowerCase())) throw configError(\"identity-source\");\n          }\n          new Headers(provider.identitySource.headers);\n        }\n        freezeOAuth(provider);\n      }\n      if (active.size !== names.size) throw configError(\"generation\");\n    },\n    catch: (error) =>\n      Schema.is(OpenIdClientConfigurationError)(error) ? error : configError(\"provider\"),\n  });\n  const installed: InstalledProvider<R>[] = [];\n\n  for (const provider of providers) {\n    let raw: client.ServerMetadata;\n\n    if (provider.protocol === \"oidc\") {\n      const discoveryUrl = new URL(provider.issuer);\n\n      discoveryUrl.pathname = `${discoveryUrl.pathname.replace(/\\/$/u, \"\")}/.well-known/openid-configuration`;\n\n      const configuration = yield* Effect.tryPromise({\n        try: (signal) =>\n          client.discovery(\n            new URL(provider.issuer),\n            provider.clientId,\n            {\n              id_token_signed_response_alg: provider.idTokenSignedResponseAlg,\n              [client.clockSkew]: 0,\n              [client.clockTolerance]: 0,\n            },\n            clientAuthentication(provider.authentication),\n            {\n              timeout: options.timeoutSeconds,\n              execute: [client.enableNonRepudiationChecks],\n              [client.customFetch]: boundedFetch(fetch, signal, new Set([discoveryUrl.href])),\n            },\n          ),\n        catch: () => OAuthUnavailable.make({}),\n      });\n\n      raw = configuration.serverMetadata();\n    } else {\n      raw = {\n        issuer: provider.issuer,\n        authorization_endpoint: provider.authorizationEndpoint,\n        token_endpoint: provider.tokenEndpoint,\n        authorization_response_iss_parameter_supported: provider.responseIssuerMode === \"required\",\n      };\n    }\n\n    // oxlint-disable-next-line no-restricted-properties -- Discovered foreign metadata is not yet validated for this adapter profile.\n    const metadata = yield* Schema.decodeUnknownEffect(metadataSchema)(raw).pipe(\n      Effect.mapError(() => configError(\"metadata\")),\n    );\n\n    const allowedUrls = yield* Effect.try({\n      try: () => {\n        if (metadata.issuer !== provider.issuer) throw configError(\"issuer\");\n        if (\n          (metadata.authorization_response_iss_parameter_supported === true) !==\n          (provider.responseIssuerMode === \"required\")\n        )\n          throw configError(\"metadata\");\n        const auth = endpoint(metadata.authorization_endpoint);\n\n        for (const key of auth.searchParams.keys()) {\n          if (reserved.has(key.toLowerCase())) throw configError(\"parameters\");\n        }\n        const token = endpoint(metadata.token_endpoint);\n\n        const supportedAuthentication =\n          metadata.token_endpoint_auth_methods_supported ??\n          (provider.protocol === \"oidc\" ? [\"client_secret_basic\"] : undefined);\n\n        if (\n          supportedAuthentication !== undefined &&\n          !supportedAuthentication.includes(provider.authentication.method)\n        )\n          throw configError(\"authentication\");\n        const urls = new Set([token.href]);\n\n        if (provider.protocol === \"oidc\") {\n          if (\n            !metadata.code_challenge_methods_supported?.includes(\"S256\") ||\n            !metadata.response_types_supported?.includes(\"code\") ||\n            !metadata.id_token_signing_alg_values_supported?.includes(\"RS256\") ||\n            metadata.jwks_uri === undefined\n          )\n            throw configError(\"metadata\");\n          urls.add(endpoint(metadata.jwks_uri).href);\n        } else {\n          urls.add(endpoint(provider.identitySource.url).href);\n        }\n        freezeOAuth(metadata);\n\n        return urls;\n      },\n      catch: (error) =>\n        Schema.is(OpenIdClientConfigurationError)(error) ? error : configError(\"metadata\"),\n    });\n\n    const serverMetadata: client.ServerMetadata = {\n      ...metadata,\n      code_challenge_methods_supported: metadata.code_challenge_methods_supported?.slice(),\n      response_types_supported: metadata.response_types_supported?.slice(),\n      id_token_signing_alg_values_supported:\n        metadata.id_token_signing_alg_values_supported?.slice(),\n      token_endpoint_auth_methods_supported:\n        metadata.token_endpoint_auth_methods_supported?.slice(),\n    };\n\n    // The SDK encodes each generated 32-byte state/challenge/nonce in 43 URL-safe characters.\n    const placeholder = \"a\".repeat(43);\n\n    const authorization = yield* Effect.try({\n      try: () => new client.Configuration(serverMetadata, provider.clientId),\n      catch: () => configError(\"parameters\"),\n    });\n\n    for (const callback of provider.callbacks) {\n      const url = yield* Effect.try({\n        try: () =>\n          client.buildAuthorizationUrl(\n            authorization,\n            makeAuthorizationParameters(provider, callback.redirectUri, {\n              state: placeholder,\n              challenge: placeholder,\n              ...(provider.protocol === \"oidc\" ? { nonce: placeholder } : {}),\n            }),\n          ),\n        catch: () => configError(\"parameters\"),\n      });\n\n      yield* Schema.decodeEffect(OAuthAuthorizationUrl)(url.href).pipe(\n        Effect.mapError(() => configError(\"parameters\")),\n      );\n    }\n    freezeOAuth(serverMetadata);\n    installed.push({ provider, metadata: serverMetadata, allowedUrls });\n  }\n\n  return { installed, fetch, timeoutSeconds: options.timeoutSeconds };\n});\n"],"mappings":";;;;;;;;;;AAuBA,MAAM,iBAAiB,YACrB,OAAO,OAAO,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,OAAO,CAAC;AAExE,MAAM,SAAS,OAAO,OACpB,OAAO,OAAO,MAAM,OAAO,UAAU,iCAAiC,CAAC,GACvE,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC,CAC9C,CAAC,CAAC,MAAM,OAAO,YAAY,WAAW,OAAO,KAAK,MAAM,CAAC,CAAC,UAAU,EAAE,CAAC;AAEvE,MAAM,SAAS,OAAO,kBAAkB,cAAc,IAAI,CAAC;AAE3D,MAAM,iBAAiB,OAAO,MAAM;CAClC,OAAO,OAAO;EAAE,QAAQ,OAAO,QAAQ,qBAAqB;EAAG;CAAO,CAAC;CACvE,OAAO,OAAO;EAAE,QAAQ,OAAO,QAAQ,oBAAoB;EAAG;CAAO,CAAC;CACtE,OAAO,OAAO;EAAE,QAAQ,OAAO,QAAQ,MAAM;EAAG,cAAc,OAAO,QAAQ,IAAI;CAAE,CAAC;AACtF,CAAC;AAED,MAAM,SAAS;CACb,UAAU;CACV,yBAAyB;CACzB,UAAU,OAAO,SAAS,CAAC,UAAU,SAAS,CAAC;CAC/C,QAAQ;CACR,oBAAoB,OAAO,SAAS,CAAC,YAAY,aAAa,CAAC;CAC/D,UAAU,cAAc,IAAI;CAC5B;CACA,WAAW,OAAO,MAChB,OAAO,OAAO;EAAE,YAAY;EAAiB,aAAa;CAAiB,CAAC,CAC9E,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,EAAE,CAAC;CACrD,QAAQ,OAAO,MACb,OAAO,OAAO,MAAM,OAAO,UAAU,mCAAmC,CAAC,CAC3E,CAAC,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC;CAC9B,yBAAyB,OAAO,YAAY,MAAM;CAClD,iBAAiB,OAAO,YAAY,MAAM;AAC5C;AAEA,MAAM,sBACJ,OAAO,OACL,OAAO,OAAO;CACZ,WAAW,OAAO,MAChB,OAAO,MAAM,CACX,OAAO,OAAO;EACZ,GAAG;EACH,UAAU,OAAO,QAAQ,MAAM;EAC/B,0BAA0B,OAAO,QAAQ,OAAO;EAChD,eAAe,OAAO,YACpB,OAAO,IAAI,MAAM,OAAO,UAAU;GAAE,SAAS;GAAG,SAAS;EAAM,CAAC,CAAC,CACnE;CACF,CAAC,GACD,OAAO,OAAO;EACZ,GAAG;EACH,UAAU,OAAO,QAAQ,OAAO;GAC/B,qBAAqB,OAAO,YAAY,kBAAkB;EAC3D,uBAAuB,cAAc,IAAI;EACzC,eAAe,cAAc,IAAI;EACjC,UAAU,OAAO,QAAQ,IAAI;EAC7B,gBAAgB,OAAO,OAAO;GAC5B,KAAK,cAAc,IAAI;GACvB,SAAS,OAAO,YAAY,MAAM;GAElC,gBAAgB,OAAO,SAInB,UAEA,UAAU,WAAW,KAAK,CAC9B;EACF,CAAC;CACH,CAAC,CACH,CAAC,CACH,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,EAAE,CAAC;CACrD,gBAAgB,OAAO,OAAO,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAG,CAAC,CAAC;CACjF,OAAO,OAAO,YACZ,OAAO,SAA6B,UAClC,UAAU,WAAW,KAAK,CAC5B,CACF;AACF,CAAC,CACH;AAEF,MAAM,2BAAW,IAAI,IAAI;CACvB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,MAAM,mCAAmB,IAAI,IAAI;CAC/B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,MAAM,eAAe,WACnB,+BAA+B,KAAK,EAAE,OAAO,CAAC;AAEhD,MAAa,YAAY,UAAuB;CAC9C,MAAM,MAAM,IAAI,IAAI,KAAK;CAEzB,IACE,IAAI,aAAa,YACjB,IAAI,aAAa,MACjB,IAAI,aAAa,MACjB,MAAM,SAAS,GAAG,KAElB,6BAA6B,KAAK,KAAK,GAEvC,MAAM,YAAY,UAAU;CAE9B,OAAO;AACT;AAEA,MAAM,mBAAmB,eAA6D;CACpF,KAAK,MAAM,OAAO,OAAO,KAAK,cAAc,CAAC,CAAC,GAC5C,IAAI,SAAS,IAAI,IAAI,YAAY,CAAC,GAAG,MAAM,YAAY,YAAY;AAEvE;AAEA,MAAa,wBACX,mBACsB;CACtB,QAAQ,eAAe,QAAvB;EACE,KAAK,uBACH,OAAO,OAAO,kBAAkB,SAAS,MAAM,eAAe,MAAM,CAAC;EACvE,KAAK,sBACH,OAAO,OAAO,iBAAiB,SAAS,MAAM,eAAe,MAAM,CAAC;EACtE,KAAK,QACH,OAAO,OAAO,KAAK;CACvB;AACF;AAUA,MAAa,+BACX,eAMA,aACA,eAC4B;CAC5B,GAAG,cAAc;CACjB,eAAe;CACf,eAAe;CACf,cAAc;CACd,OAAO,cAAc,OAAO,KAAK,GAAG;CACpC,OAAO,UAAU;CACjB,gBAAgB,UAAU;CAC1B,uBAAuB;CACvB,GAAI,UAAU,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,UAAU,MAAM;CAClE,GAAI,cAAc,aAAa,UAAU,cAAc,kBAAkB,KAAA,IACrE,EAAE,SAAS,OAAO,cAAc,aAAa,EAAE,IAC/C,CAAC;AACP;AAEA,MAAM,iBAAiB,OAAO,OAAO;CACnC,QAAQ;CACR,wBAAwB,cAAc,IAAI;CAC1C,gBAAgB,cAAc,IAAI;CAClC,UAAU,OAAO,YAAY,cAAc,IAAI,CAAC;CAChD,kCAAkC,OAAO,YAAY,OAAO,MAAM,cAAc,EAAE,CAAC,CAAC;CACpF,0BAA0B,OAAO,YAAY,OAAO,MAAM,cAAc,EAAE,CAAC,CAAC;CAC5E,uCAAuC,OAAO,YAAY,OAAO,MAAM,cAAc,EAAE,CAAC,CAAC;CACzF,uCAAuC,OAAO,YAAY,OAAO,MAAM,cAAc,EAAE,CAAC,CAAC;CACzF,gDAAgD,OAAO,YAAY,OAAO,OAAO;AACnF,CAAC;AAED,MAAa,wBAAwB,OAAO,GAAG,oCAAoC,CAAC,CAAC,WACnF,OACA;CACA,MAAM,UAAU,OAAO,OAAO,aAAa,cAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KACpE,OAAO,eAAe,YAAY,UAAU,CAAC,CAC/C;CAGA,MAAM,YAAY,QAAQ,UAAU,KAAK,aAA0B;EACjE,MAAM,WAAW;GACf,WAAW,SAAS,UAAU,KAAK,cAAc,EAAE,GAAG,SAAS,EAAE;GACjE,QAAQ,CAAC,GAAG,SAAS,MAAM;GAC3B,GAAI,SAAS,4BAA4B,KAAA,IACrC,CAAC,IACD,EAAE,yBAAyB,EAAE,GAAG,SAAS,wBAAwB,EAAE;GACvE,GAAI,SAAS,oBAAoB,KAAA,IAC7B,CAAC,IACD,EAAE,iBAAiB,EAAE,GAAG,SAAS,gBAAgB,EAAE;GACvD,gBACE,SAAS,eAAe,WAAW,SAC/B,EAAE,GAAG,SAAS,eAAe,IAC7B;IACE,GAAG,SAAS;IACZ,QAAQ,SAAS,KAAK,SAAS,MAAM,SAAS,eAAe,MAAM,CAAC;GACtE;EACR;EAEA,OAAO,SAAS,aAAa,SACzB;GAAE,GAAG;GAAU,GAAG;EAAS,IAC3B;GACE,GAAG;GACH,GAAG;GACH,gBAAgB;IACd,GAAG,SAAS;IACZ,GAAI,SAAS,eAAe,YAAY,KAAA,IACpC,CAAC,IACD,EAAE,SAAS,EAAE,GAAG,SAAS,eAAe,QAAQ,EAAE;GACxD;EACF;CACN,CAAC;CAED,MAAM,QACJ,QAAQ,WACN,KAAK,SACL,WAAW,MAAM,KAAK;EACpB,GAAG;EACH,MAAM,KAAK,gBAAgB,aAAa,IAAI,WAAW,KAAK,IAAI,IAAI,KAAK;CAC3E,CAAC;CAEL,OAAO,OAAO,IAAI;EAChB,WAAW;GACT,MAAM,8BAAc,IAAI,IAAY;GACpC,MAAM,yBAAS,IAAI,IAAY;GAC/B,MAAM,wBAAQ,IAAI,IAAY;GAE9B,KAAK,MAAM,YAAY,WAAW;IAChC,MAAM,aAAa,GAAG,SAAS,SAAS,OAAO,GAAG,SAAS,SAAS,GAAG,SAAS;IAEhF,IAAI,YAAY,IAAI,UAAU,GAAG,MAAM,YAAY,YAAY;IAC/D,YAAY,IAAI,UAAU;IAC1B,MAAM,IAAI,SAAS,QAAQ;IAC3B,IAAI,SAAS,aAAa,UAAU;KAClC,IAAI,OAAO,IAAI,SAAS,QAAQ,GAAG,MAAM,YAAY,YAAY;KACjE,OAAO,IAAI,SAAS,QAAQ;IAC9B;IACA,MAAM,SAAS,SAAS,SAAS,MAAM;IAEvC,IAAI,SAAS,OAAO,SAAS,GAAG,KAAK,OAAO,SAAS,SAAS,eAAe,GAC3E,MAAM,YAAY,QAAQ;IAC5B,IAAI,IAAI,IAAI,SAAS,MAAM,CAAC,CAAC,SAAS,SAAS,OAAO,QACpD,MAAM,YAAY,YAAY;IAChC,IAAK,SAAS,aAAa,WAAY,SAAS,OAAO,SAAS,QAAQ,GACtE,MAAM,YAAY,YAAY;IAChC,gBAAgB,SAAS,uBAAuB;IAChD,gBAAgB,SAAS,eAAe;IACxC,MAAM,4BAAY,IAAI,IAAY;IAElC,KAAK,MAAM,YAAY,SAAS,WAAW;KAGzC,IAFY,SAAS,SAAS,WAG1B,CAAC,CAAC,SAAS,SAAS,eACtB,SAAS,YAAY,SAAS,GAAG,KACjC,UAAU,IAAI,SAAS,UAAU,GAEjC,MAAM,YAAY,UAAU;KAC9B,UAAU,IAAI,SAAS,UAAU;KACjC,KAAK,MAAM,SAAS,WAAW;MAC7B,IAAI,SAAS,WAAW,MAAM,QAAQ;MACtC,IACE,SAAS,uBAAuB,cAChC,MAAM,uBAAuB,YAE7B;MACF,IAAI,MAAM,UAAU,MAAM,cAAc,UAAU,gBAAgB,SAAS,WAAW,GACpF,MAAM,YAAY,UAAU;KAChC;IACF;IACA,IAAI,SAAS,aAAa,SAAS;KACjC,SAAS,SAAS,eAAe,GAAG;KACpC,KAAK,MAAM,OAAO,OAAO,KAAK,SAAS,eAAe,WAAW,CAAC,CAAC,GACjE,IAAI,iBAAiB,IAAI,IAAI,YAAY,CAAC,GAAG,MAAM,YAAY,iBAAiB;KAElF,IAAI,QAAQ,SAAS,eAAe,OAAO;IAC7C;IACA,YAAY,QAAQ;GACtB;GACA,IAAI,OAAO,SAAS,MAAM,MAAM,MAAM,YAAY,YAAY;EAChE;EACA,QAAQ,UACN,OAAO,GAAG,8BAA8B,CAAC,CAAC,KAAK,IAAI,QAAQ,YAAY,UAAU;CACrF,CAAC;CACD,MAAM,YAAoC,CAAC;CAE3C,KAAK,MAAM,YAAY,WAAW;EAChC,IAAI;EAEJ,IAAI,SAAS,aAAa,QAAQ;GAChC,MAAM,eAAe,IAAI,IAAI,SAAS,MAAM;GAE5C,aAAa,WAAW,GAAG,aAAa,SAAS,QAAQ,QAAQ,EAAE,EAAE;GAsBrE,OAAM,OApBuB,OAAO,WAAW;IAC7C,MAAM,WACJ,OAAO,UACL,IAAI,IAAI,SAAS,MAAM,GACvB,SAAS,UACT;KACE,8BAA8B,SAAS;MACtC,OAAO,YAAY;MACnB,OAAO,iBAAiB;IAC3B,GACA,qBAAqB,SAAS,cAAc,GAC5C;KACE,SAAS,QAAQ;KACjB,SAAS,CAAC,OAAO,0BAA0B;MAC1C,OAAO,cAAc,aAAa,OAAO,wBAAQ,IAAI,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC;IAChF,CACF;IACF,aAAa,iBAAiB,KAAK,CAAC,CAAC;GACvC,CAAC,EAAA,CAEmB,eAAe;EACrC,OACE,MAAM;GACJ,QAAQ,SAAS;GACjB,wBAAwB,SAAS;GACjC,gBAAgB,SAAS;GACzB,gDAAgD,SAAS,uBAAuB;EAClF;EAIF,MAAM,WAAW,OAAO,OAAO,oBAAoB,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,KACtE,OAAO,eAAe,YAAY,UAAU,CAAC,CAC/C;EAEA,MAAM,cAAc,OAAO,OAAO,IAAI;GACpC,WAAW;IACT,IAAI,SAAS,WAAW,SAAS,QAAQ,MAAM,YAAY,QAAQ;IACnE,IACG,SAAS,mDAAmD,UAC5D,SAAS,uBAAuB,aAEjC,MAAM,YAAY,UAAU;IAC9B,MAAM,OAAO,SAAS,SAAS,sBAAsB;IAErD,KAAK,MAAM,OAAO,KAAK,aAAa,KAAK,GACvC,IAAI,SAAS,IAAI,IAAI,YAAY,CAAC,GAAG,MAAM,YAAY,YAAY;IAErE,MAAM,QAAQ,SAAS,SAAS,cAAc;IAE9C,MAAM,0BACJ,SAAS,0CACR,SAAS,aAAa,SAAS,CAAC,qBAAqB,IAAI,KAAA;IAE5D,IACE,4BAA4B,KAAA,KAC5B,CAAC,wBAAwB,SAAS,SAAS,eAAe,MAAM,GAEhE,MAAM,YAAY,gBAAgB;IACpC,MAAM,uBAAO,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC;IAEjC,IAAI,SAAS,aAAa,QAAQ;KAChC,IACE,CAAC,SAAS,kCAAkC,SAAS,MAAM,KAC3D,CAAC,SAAS,0BAA0B,SAAS,MAAM,KACnD,CAAC,SAAS,uCAAuC,SAAS,OAAO,KACjE,SAAS,aAAa,KAAA,GAEtB,MAAM,YAAY,UAAU;KAC9B,KAAK,IAAI,SAAS,SAAS,QAAQ,CAAC,CAAC,IAAI;IAC3C,OACE,KAAK,IAAI,SAAS,SAAS,eAAe,GAAG,CAAC,CAAC,IAAI;IAErD,YAAY,QAAQ;IAEpB,OAAO;GACT;GACA,QAAQ,UACN,OAAO,GAAG,8BAA8B,CAAC,CAAC,KAAK,IAAI,QAAQ,YAAY,UAAU;EACrF,CAAC;EAED,MAAM,iBAAwC;GAC5C,GAAG;GACH,kCAAkC,SAAS,kCAAkC,MAAM;GACnF,0BAA0B,SAAS,0BAA0B,MAAM;GACnE,uCACE,SAAS,uCAAuC,MAAM;GACxD,uCACE,SAAS,uCAAuC,MAAM;EAC1D;EAGA,MAAM,cAAc,IAAI,OAAO,EAAE;EAEjC,MAAM,gBAAgB,OAAO,OAAO,IAAI;GACtC,WAAW,IAAI,OAAO,cAAc,gBAAgB,SAAS,QAAQ;GACrE,aAAa,YAAY,YAAY;EACvC,CAAC;EAED,KAAK,MAAM,YAAY,SAAS,WAAW;GACzC,MAAM,MAAM,OAAO,OAAO,IAAI;IAC5B,WACE,OAAO,sBACL,eACA,4BAA4B,UAAU,SAAS,aAAa;KAC1D,OAAO;KACP,WAAW;KACX,GAAI,SAAS,aAAa,SAAS,EAAE,OAAO,YAAY,IAAI,CAAC;IAC/D,CAAC,CACH;IACF,aAAa,YAAY,YAAY;GACvC,CAAC;GAED,OAAO,OAAO,aAAa,qBAAqB,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAC1D,OAAO,eAAe,YAAY,YAAY,CAAC,CACjD;EACF;EACA,YAAY,cAAc;EAC1B,UAAU,KAAK;GAAE;GAAU,UAAU;GAAgB;EAAY,CAAC;CACpE;CAEA,OAAO;EAAE;EAAW;EAAO,gBAAgB,QAAQ;CAAe;AACpE,CAAC"}

package/dist/oauth/openid-client/connected/protocol.d.mts

@@ -3,9 +3,9 @@ import { OAuthUnavailable } from "../../signInErrors.mjs";
 import "../../signInModels.mjs";
 import "../../connectedModels.mjs";
 import { OAuthConnectedProtocol } from "../../OAuthConnectedProtocol.mjs";
-import { OpenIdClientConfigurationError } from "../models.mjs";
 import { OpenIdClientConnectedProtocolOptions } from "./models.mjs";
 import "../compatibility.mjs";
+import { OpenIdClientConfigurationError } from "../models.mjs";
 import "../ProviderRevocation.mjs";
 import { DateTime, Effect, Layer } from "effect";
 //#region src/oauth/openid-client/connected/protocol.d.ts

package/dist/oauth/openid-client/models.d.mts

@@ -1,5 +1,6 @@
 import { OAuthProtocolRejected } from "../signInErrors.mjs";
 import { OAuthProtocolConfiguration, OAuthVerifiedExternalIdentity } from "../signInModels.mjs";
+import { TokenCompatibility, tokenCompatibility } from "./compatibility.mjs";
 import { Effect, Redacted, Schema } from "effect";
 import { CustomFetch } from "openid-client";
 //#region src/oauth/openid-client/models.d.ts
@@ -44,6 +45,8 @@ interface OpenIdClientOidcProvider extends ProviderGeneration {
   readonly maxAgeSeconds?: number;
 }
 interface OpenIdClientOAuthProvider<R = never> extends ProviderGeneration {
+  /** @internal First-party provider behavior, retained by the configuration codec. */
+  readonly [tokenCompatibility]?: TokenCompatibility;
   readonly protocol: "oauth";
   readonly authorizationEndpoint: string;
   readonly tokenEndpoint: string;

package/dist/oauth/openid-client/models.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"models.mjs","names":[],"sources":["../../../src/oauth/openid-client/models.ts"],"sourcesContent":["import { type Effect, type Redacted, Schema } from \"effect\";\nimport type { CustomFetch } from \"openid-client\";\n\nimport type { OAuthProtocolRejected } from \"../signInErrors\";\nimport type { OAuthProtocolConfiguration, OAuthVerifiedExternalIdentity } from \"../signInModels\";\n\nexport class OpenIdClientConfigurationError extends Schema.TaggedError<OpenIdClientConfigurationError>()(\n  \"OpenIdClientConfigurationError\",\n  {\n    reason: Schema.Literals([\n      \"provider\",\n      \"generation\",\n      \"issuer\",\n      \"callback\",\n      \"authentication\",\n      \"parameters\",\n      \"metadata\",\n      \"identity-source\",\n    ]),\n  },\n) {}\n\nexport type OpenIdClientAuthentication =\n  | { readonly method: \"client_secret_basic\"; readonly secret: Redacted.Redacted<string> }\n  | { readonly method: \"client_secret_post\"; readonly secret: Redacted.Redacted<string> }\n  | { readonly method: \"none\"; readonly publicClient: true };\n\nexport interface PlainOAuthIdentity {\n  readonly subject: string;\n  readonly profile?: OAuthVerifiedExternalIdentity[\"profile\"];\n}\n\ninterface ProviderGeneration {\n  readonly provider: OAuthProtocolConfiguration[\"provider\"];\n  readonly configurationGeneration: OAuthProtocolConfiguration[\"configurationGeneration\"];\n  readonly issuance: \"active\" | \"retired\";\n  /** Preserve this exact issuer identifier, including an optional trailing slash. */\n  readonly issuer: OAuthProtocolConfiguration[\"issuer\"];\n  readonly responseIssuerMode: OAuthProtocolConfiguration[\"responseIssuerMode\"];\n  readonly clientId: string;\n  readonly authentication: OpenIdClientAuthentication;\n  readonly callbacks: ReadonlyArray<{\n    readonly callbackId: OAuthProtocolConfiguration[\"callbackId\"];\n    readonly redirectUri: OAuthProtocolConfiguration[\"redirectUri\"];\n  }>;\n  readonly scopes: ReadonlyArray<string>;\n  readonly authorizationParameters?: Readonly<Record<string, string>>;\n  readonly tokenParameters?: Readonly<Record<string, string>>;\n}\n\nexport interface OpenIdClientOidcProvider extends ProviderGeneration {\n  readonly protocol: \"oidc\";\n  readonly idTokenSignedResponseAlg: \"RS256\";\n  readonly maxAgeSeconds?: number;\n}\n\nexport interface OpenIdClientOAuthProvider<R = never> extends ProviderGeneration {\n  readonly protocol: \"oauth\";\n  readonly authorizationEndpoint: string;\n  readonly tokenEndpoint: string;\n  readonly pkceS256: true;\n  readonly identitySource: {\n    readonly url: string;\n    readonly headers?: Readonly<Record<string, string>>;\n    /** Receives only the freshly fetched authenticated identity body, never a grant. */\n    readonly decodeIdentity: (\n      body: unknown,\n    ) => Effect.Effect<PlainOAuthIdentity, OAuthProtocolRejected, R>;\n  };\n}\n\nexport interface OpenIdClientOAuthProtocolOptions<R = never> {\n  readonly providers: ReadonlyArray<OpenIdClientOidcProvider | OpenIdClientOAuthProvider<R>>;\n  /** Per-request deadline; the method separately limits the complete exchange. */\n  readonly timeoutSeconds: number;\n  /** Trusted server transport. Must honor abort and must not retry or log credentials. */\n  readonly fetch?: CustomFetch;\n}\n"],"mappings":";;AAMA,IAAa,iCAAb,cAAoD,OAAO,YAA4C,CAAC,CACtG,kCACA,EACE,QAAQ,OAAO,SAAS;CACtB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC,EACH,CACF,CAAC,CAAC,CAAC"}
+{"version":3,"file":"models.mjs","names":[],"sources":["../../../src/oauth/openid-client/models.ts"],"sourcesContent":["import { type Effect, type Redacted, Schema } from \"effect\";\nimport type { CustomFetch } from \"openid-client\";\n\nimport type { OAuthProtocolRejected } from \"../signInErrors\";\nimport type { OAuthProtocolConfiguration, OAuthVerifiedExternalIdentity } from \"../signInModels\";\nimport type { TokenCompatibility, tokenCompatibility } from \"./compatibility\";\n\nexport class OpenIdClientConfigurationError extends Schema.TaggedError<OpenIdClientConfigurationError>()(\n  \"OpenIdClientConfigurationError\",\n  {\n    reason: Schema.Literals([\n      \"provider\",\n      \"generation\",\n      \"issuer\",\n      \"callback\",\n      \"authentication\",\n      \"parameters\",\n      \"metadata\",\n      \"identity-source\",\n    ]),\n  },\n) {}\n\nexport type OpenIdClientAuthentication =\n  | { readonly method: \"client_secret_basic\"; readonly secret: Redacted.Redacted<string> }\n  | { readonly method: \"client_secret_post\"; readonly secret: Redacted.Redacted<string> }\n  | { readonly method: \"none\"; readonly publicClient: true };\n\nexport interface PlainOAuthIdentity {\n  readonly subject: string;\n  readonly profile?: OAuthVerifiedExternalIdentity[\"profile\"];\n}\n\ninterface ProviderGeneration {\n  readonly provider: OAuthProtocolConfiguration[\"provider\"];\n  readonly configurationGeneration: OAuthProtocolConfiguration[\"configurationGeneration\"];\n  readonly issuance: \"active\" | \"retired\";\n  /** Preserve this exact issuer identifier, including an optional trailing slash. */\n  readonly issuer: OAuthProtocolConfiguration[\"issuer\"];\n  readonly responseIssuerMode: OAuthProtocolConfiguration[\"responseIssuerMode\"];\n  readonly clientId: string;\n  readonly authentication: OpenIdClientAuthentication;\n  readonly callbacks: ReadonlyArray<{\n    readonly callbackId: OAuthProtocolConfiguration[\"callbackId\"];\n    readonly redirectUri: OAuthProtocolConfiguration[\"redirectUri\"];\n  }>;\n  readonly scopes: ReadonlyArray<string>;\n  readonly authorizationParameters?: Readonly<Record<string, string>>;\n  readonly tokenParameters?: Readonly<Record<string, string>>;\n}\n\nexport interface OpenIdClientOidcProvider extends ProviderGeneration {\n  readonly protocol: \"oidc\";\n  readonly idTokenSignedResponseAlg: \"RS256\";\n  readonly maxAgeSeconds?: number;\n}\n\nexport interface OpenIdClientOAuthProvider<R = never> extends ProviderGeneration {\n  /** @internal First-party provider behavior, retained by the configuration codec. */\n  readonly [tokenCompatibility]?: TokenCompatibility;\n  readonly protocol: \"oauth\";\n  readonly authorizationEndpoint: string;\n  readonly tokenEndpoint: string;\n  readonly pkceS256: true;\n  readonly identitySource: {\n    readonly url: string;\n    readonly headers?: Readonly<Record<string, string>>;\n    /** Receives only the freshly fetched authenticated identity body, never a grant. */\n    readonly decodeIdentity: (\n      body: unknown,\n    ) => Effect.Effect<PlainOAuthIdentity, OAuthProtocolRejected, R>;\n  };\n}\n\nexport interface OpenIdClientOAuthProtocolOptions<R = never> {\n  readonly providers: ReadonlyArray<OpenIdClientOidcProvider | OpenIdClientOAuthProvider<R>>;\n  /** Per-request deadline; the method separately limits the complete exchange. */\n  readonly timeoutSeconds: number;\n  /** Trusted server transport. Must honor abort and must not retry or log credentials. */\n  readonly fetch?: CustomFetch;\n}\n"],"mappings":";;AAOA,IAAa,iCAAb,cAAoD,OAAO,YAA4C,CAAC,CACtG,kCACA,EACE,QAAQ,OAAO,SAAS;CACtB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC,EACH,CACF,CAAC,CAAC,CAAC"}

package/dist/oauth/openid-client/protocol.d.mts

@@ -5,7 +5,6 @@ import { OAuthProtocolRejected, OAuthRejected, OAuthUnavailable } from "../signI
 import { OAuthCallbackId, OAuthCodeResponse, OAuthProtocolConfiguration, OAuthProtocolPreparation, OAuthTransactionSecrets, OAuthVerifiedExternalIdentity } from "../signInModels.mjs";
 import { OAuthProtocol } from "../OAuthProtocol.mjs";
 import { OpenIdClientConfigurationError, OpenIdClientOAuthProtocolOptions } from "./models.mjs";
-import "./compatibility.mjs";
 import { DateTime, Effect, Layer } from "effect";
 //#region src/oauth/openid-client/protocol.d.ts
 declare const makeOpenIdClientOAuthProtocol: <R = never>(options: OpenIdClientOAuthProtocolOptions<R>) => Effect.Effect<{

package/dist/oauth/openid-client/protocol.mjs

@@ -5,7 +5,7 @@ import { OAuthCallbackId, OAuthCodeResponse, OAuthDisplayProfile, OAuthProtocolC
 import { OAuthProtocolRejected, OAuthRejected, OAuthUnavailable } from "../signInErrors.mjs";
 import { snapshotOAuth } from "../signInSnapshot.mjs";
 import { OAuthProtocol } from "../OAuthProtocol.mjs";
-import { DefiniteTokenRejection } from "./compatibility.mjs";
+import { DefiniteTokenRejection, tokenCompatibility } from "./compatibility.mjs";
 import { boundedFetch } from "./transport.mjs";
 import { clientAuthentication, installConfigurations, makeAuthorizationParameters } from "./configuration.mjs";
 import { Cause, DateTime, Effect, Layer, Redacted, Schema } from "effect";
@@ -55,8 +55,9 @@ const grantError = (error) => {
 	if (error instanceof client.ResponseBodyError && error.status === 400 && error.error === "invalid_grant") return rejected();
 	return unavailable();
 };
-const privateConfiguration = (entry, timeout, fetch, signal, compatibility) => {
+const privateConfiguration = (entry, timeout, fetch, signal) => {
 	const provider = entry.provider;
+	const compatibility = provider.protocol === "oauth" ? provider[tokenCompatibility] : void 0;
 	const configuration = new client.Configuration(entry.metadata, provider.clientId, {
 		[client.clockSkew]: 0,
 		[client.clockTolerance]: 0,
@@ -85,7 +86,7 @@ const privateConfiguration = (entry, timeout, fetch, signal, compatibility) => {
 	if (provider.protocol === "oidc") client.enableNonRepudiationChecks(configuration);
 	return configuration;
 };
-const makeOAuthProtocolWithCompatibility = Effect.fn("makeOpenIdClientOAuthProtocol")(function* (options, compatibility) {
+const makeOpenIdClientOAuthProtocol = Effect.fn("makeOpenIdClientOAuthProtocol")(function* (options) {
 	const context = yield* Effect.context();
 	const { installed, fetch, timeoutSeconds } = yield* installConfigurations(options);
 	const prepareAuthorization = Effect.fn("OpenIdClient.prepareAuthorization")(function* (input) {
@@ -96,7 +97,7 @@ const makeOAuthProtocolWithCompatibility = Effect.fn("makeOpenIdClientOAuthProto
 		if (entry === void 0 || provider === void 0 || callback === void 0) return yield* OAuthRejected.make({});
 		const result = yield* Effect.tryPromise({
 			try: async (signal) => {
-				const configuration = privateConfiguration(entry, timeoutSeconds, fetch, signal, compatibility);
+				const configuration = privateConfiguration(entry, timeoutSeconds, fetch, signal);
 				const state = client.randomState();
 				const verifier = client.randomPKCECodeVerifier();
 				const nonce = provider.protocol === "oidc" ? client.randomNonce() : void 0;
@@ -143,7 +144,7 @@ const makeOAuthProtocolWithCompatibility = Effect.fn("makeOpenIdClientOAuthProto
 		if (startedAt < 0 || startedAt > DateTime.toEpochMillis(yield* DateTime.now)) return yield* rejected();
 		const exchanged = yield* Effect.tryPromise({
 			try: async (signal) => {
-				const configuration = privateConfiguration(entry, timeoutSeconds, fetch, signal, compatibility);
+				const configuration = privateConfiguration(entry, timeoutSeconds, fetch, signal);
 				const currentUrl = new URL(saved.redirectUri);
 				currentUrl.searchParams.set("code", Redacted.value(request.response.code));
 				currentUrl.searchParams.set("state", Redacted.value(request.response.state));
@@ -210,9 +211,8 @@ const makeOAuthProtocolWithCompatibility = Effect.fn("makeOpenIdClientOAuthProto
 		exchangeVerifiedIdentity: (input) => unavailableOnDefect(exchangeVerifiedIdentity(input))
 	});
 }, unavailableOnDefect);
-const makeOpenIdClientOAuthProtocol = (options) => makeOAuthProtocolWithCompatibility(options);
 const openIdClientOAuthProtocolLayer = (options) => Layer.effect(OAuthProtocol, makeOpenIdClientOAuthProtocol(options));
 //#endregion
-export { makeOAuthProtocolWithCompatibility, makeOpenIdClientOAuthProtocol, openIdClientOAuthProtocolLayer };
+export { makeOpenIdClientOAuthProtocol, openIdClientOAuthProtocolLayer };
 
 //# sourceMappingURL=protocol.mjs.map

package/dist/oauth/openid-client/protocol.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"protocol.mjs","names":[],"sources":["../../../src/oauth/openid-client/protocol.ts"],"sourcesContent":["import { Cause, DateTime, Effect, Layer, Redacted, Schema } from \"effect\";\nimport * as client from \"openid-client\";\n\nimport { reportAuthFailure } from \"../../internal/diagnostics\";\nimport { RequestBindingFlowId } from \"../../operations/requestBinding\";\nimport { OAuthProtocol } from \"../OAuthProtocol\";\nimport { OAuthProviderKey } from \"../schema\";\nimport { OAuthProtocolRejected, OAuthRejected, OAuthUnavailable } from \"../signInErrors\";\nimport {\n  OAuthCallbackId,\n  OAuthCodeResponse,\n  OAuthDisplayProfile,\n  OAuthProtocolConfiguration,\n  OAuthProtocolPreparation,\n  OAuthTransactionSecrets,\n  OAuthVerifiedExternalIdentity,\n} from \"../signInModels\";\nimport { snapshotOAuth } from \"../signInSnapshot\";\nimport { DefiniteTokenRejection, type TokenCompatibility } from \"./compatibility\";\nimport {\n  clientAuthentication,\n  installConfigurations,\n  makeAuthorizationParameters,\n  type InstalledProvider,\n} from \"./configuration\";\nimport {\n  type OpenIdClientConfigurationError,\n  type OpenIdClientOAuthProtocolOptions,\n} from \"./models\";\nimport { boundedFetch } from \"./transport\";\n\nconst beginInput = Schema.Struct({\n  provider: OAuthProviderKey,\n  callbackId: OAuthCallbackId,\n  flowId: RequestBindingFlowId,\n});\n\nconst exchangeInput = Schema.toType(\n  Schema.Struct({\n    configuration: OAuthProtocolConfiguration,\n    response: OAuthCodeResponse,\n    secrets: OAuthTransactionSecrets,\n    verificationStartedAt: Schema.DateTimeUtcFromMillis,\n  }),\n);\n\nconst numericDate = Schema.Finite.check(Schema.isBetween({ minimum: 0, maximum: 8640000000000 }));\n\nconst claimsSchema = Schema.Struct({\n  iss: Schema.String,\n  sub: OAuthVerifiedExternalIdentity.fields.identity.fields.subject,\n  aud: Schema.Union([\n    Schema.String,\n    Schema.Array(Schema.String).check(Schema.isMinLength(1), Schema.isMaxLength(1)),\n  ]),\n  azp: Schema.optionalKey(Schema.String),\n  exp: numericDate,\n  iat: numericDate,\n  nbf: Schema.optionalKey(numericDate),\n  auth_time: Schema.optionalKey(numericDate),\n});\n\nconst plainIdentitySchema = Schema.Struct({\n  subject: OAuthVerifiedExternalIdentity.fields.identity.fields.subject,\n  profile: Schema.optionalKey(OAuthDisplayProfile),\n});\n\nconst unavailable = () => OAuthUnavailable.make({});\nconst rejected = () => OAuthProtocolRejected.make({});\n\nconst unavailableOnDefect = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n  effect.pipe(\n    Effect.tapCause((cause) =>\n      Cause.hasDies(cause) ? reportAuthFailure(\"oauth-protocol\", cause) : Effect.void,\n    ),\n    Effect.catchCause((cause): Effect.Effect<never, E | OAuthUnavailable> => {\n      if (Cause.hasInterrupts(cause)) return Effect.interrupt;\n      if (Cause.hasDies(cause)) return Effect.fail(unavailable());\n\n      return Effect.failCause(cause);\n    }),\n  );\n\n/** Only precise claim errors and a fully parsed invalid_grant are definite.\n * INVALID_RESPONSE also covers signature/key/transport faults; keep it ambiguous. */\nconst grantError = (error: unknown) => {\n  if (\n    error instanceof DefiniteTokenRejection ||\n    (error instanceof client.ClientError && error.cause instanceof DefiniteTokenRejection)\n  )\n    return rejected();\n  if (\n    error instanceof client.ClientError &&\n    (error.code === \"OAUTH_JWT_CLAIM_COMPARISON_FAILED\" ||\n      error.code === \"OAUTH_JWT_TIMESTAMP_CHECK_FAILED\")\n  )\n    return rejected();\n  if (\n    error instanceof client.ResponseBodyError &&\n    error.status === 400 &&\n    error.error === \"invalid_grant\"\n  )\n    return rejected();\n\n  return unavailable();\n};\n\nconst privateConfiguration = <R>(\n  entry: InstalledProvider<R>,\n  timeout: number,\n  fetch: client.CustomFetch,\n  signal: AbortSignal,\n  compatibility?: TokenCompatibility,\n) => {\n  const provider = entry.provider;\n\n  const configuration = new client.Configuration(\n    entry.metadata,\n    provider.clientId,\n    {\n      [client.clockSkew]: 0,\n      [client.clockTolerance]: 0,\n      ...(provider.protocol === \"oidc\"\n        ? { id_token_signed_response_alg: provider.idTokenSignedResponseAlg }\n        : {}),\n    },\n    clientAuthentication(provider.authentication),\n  );\n\n  configuration.timeout = timeout;\n  const transport = boundedFetch(fetch, signal, entry.allowedUrls);\n\n  configuration[client.customFetch] =\n    compatibility === undefined\n      ? transport\n      : async (url, options) => {\n          const response = await transport(url, options);\n\n          if (url === new URL(entry.metadata.token_endpoint!).href) {\n            const body: unknown = await response.clone().json();\n\n            signal.throwIfAborted();\n            compatibility.inspectReceipt(\n              { body, status: response.status, contentType: response.headers.get(\"content-type\") },\n              {\n                scopes: provider.scopes,\n                refreshRequired: false,\n                operation: \"authorization_code\",\n              },\n            );\n            signal.throwIfAborted();\n          }\n\n          return response;\n        };\n  if (provider.protocol === \"oidc\") client.enableNonRepudiationChecks(configuration);\n\n  return configuration;\n};\n\nexport const makeOAuthProtocolWithCompatibility = Effect.fn(\"makeOpenIdClientOAuthProtocol\")(\n  function* <R = never>(\n    options: OpenIdClientOAuthProtocolOptions<R>,\n    compatibility?: TokenCompatibility,\n  ): Effect.fn.Return<\n    OAuthProtocol[\"Service\"],\n    OpenIdClientConfigurationError | OAuthUnavailable,\n    R\n  > {\n    const context = yield* Effect.context<R>();\n    const { installed, fetch, timeoutSeconds } = yield* installConfigurations(options);\n\n    const prepareAuthorization: OAuthProtocol[\"Service\"][\"prepareAuthorization\"] = Effect.fn(\n      \"OpenIdClient.prepareAuthorization\",\n    )(function* (input) {\n      const request = yield* Schema.decodeEffect(beginInput)(input).pipe(\n        Effect.mapError(() => OAuthRejected.make({})),\n      );\n\n      const entry = installed.find(\n        ({ provider }) => provider.issuance === \"active\" && provider.provider === request.provider,\n      );\n\n      const provider = entry?.provider;\n\n      const callback = provider?.callbacks.find(\n        (candidate) => candidate.callbackId === request.callbackId,\n      );\n\n      if (entry === undefined || provider === undefined || callback === undefined)\n        return yield* OAuthRejected.make({});\n\n      const result = yield* Effect.tryPromise({\n        try: async (signal) => {\n          const configuration = privateConfiguration(\n            entry,\n            timeoutSeconds,\n            fetch,\n            signal,\n            compatibility,\n          );\n\n          const state = client.randomState();\n          const verifier = client.randomPKCECodeVerifier();\n          const nonce = provider.protocol === \"oidc\" ? client.randomNonce() : undefined;\n          const challenge = await client.calculatePKCECodeChallenge(verifier);\n\n          signal.throwIfAborted();\n\n          const url = client.buildAuthorizationUrl(\n            configuration,\n            makeAuthorizationParameters(provider, callback.redirectUri, {\n              state,\n              challenge,\n              ...(nonce === undefined ? {} : { nonce }),\n            }),\n          );\n\n          return {\n            configuration: {\n              provider: provider.provider,\n              protocol: provider.protocol,\n              configurationGeneration: provider.configurationGeneration,\n              issuer: provider.issuer,\n              responseIssuerMode: provider.responseIssuerMode,\n              callbackId: callback.callbackId,\n              redirectUri: callback.redirectUri,\n            },\n            authorizationUrl: Redacted.make(url.href),\n            secrets: {\n              namespace: \"effect-auth/oauth-transaction-secrets/v1\" as const,\n              state: Redacted.make(state),\n              pkceVerifier: Redacted.make(verifier),\n              ...(nonce === undefined ? {} : { oidcNonce: Redacted.make(nonce) }),\n            },\n          };\n        },\n        catch: unavailable,\n      });\n\n      return yield* snapshotOAuth(OAuthProtocolPreparation, result);\n    });\n\n    const exchangeVerifiedIdentity: OAuthProtocol[\"Service\"][\"exchangeVerifiedIdentity\"] =\n      Effect.fn(\"OpenIdClient.exchangeVerifiedIdentity\")(function* (input) {\n        const request = yield* snapshotOAuth(exchangeInput, input);\n        const saved = request.configuration;\n\n        const entry = installed.find(\n          ({ provider }) =>\n            provider.provider === saved.provider &&\n            provider.configurationGeneration === saved.configurationGeneration,\n        );\n\n        if (entry === undefined) return yield* unavailable();\n        const provider = entry.provider;\n\n        const callback = provider.callbacks.find(\n          (candidate) => candidate.callbackId === saved.callbackId,\n        );\n\n        if (\n          provider.protocol !== saved.protocol ||\n          provider.issuer !== saved.issuer ||\n          provider.responseIssuerMode !== saved.responseIssuerMode ||\n          callback?.redirectUri !== saved.redirectUri\n        )\n          return yield* unavailable();\n        if (\n          (provider.protocol === \"oidc\") !== (request.secrets.oidcNonce !== undefined) ||\n          Redacted.value(request.response.state) !== Redacted.value(request.secrets.state) ||\n          (provider.responseIssuerMode === \"required\"\n            ? request.response.issuer !== provider.issuer\n            : request.response.issuer !== undefined)\n        )\n          return yield* rejected();\n        const startedAt = DateTime.toEpochMillis(request.verificationStartedAt);\n\n        if (startedAt < 0 || startedAt > DateTime.toEpochMillis(yield* DateTime.now))\n          return yield* rejected();\n\n        const exchanged = yield* Effect.tryPromise({\n          try: async (signal) => {\n            const configuration = privateConfiguration(\n              entry,\n              timeoutSeconds,\n              fetch,\n              signal,\n              compatibility,\n            );\n\n            const currentUrl = new URL(saved.redirectUri);\n\n            currentUrl.searchParams.set(\"code\", Redacted.value(request.response.code));\n            currentUrl.searchParams.set(\"state\", Redacted.value(request.response.state));\n            if (request.response.issuer !== undefined)\n              currentUrl.searchParams.set(\"iss\", request.response.issuer);\n\n            const tokens = await client.authorizationCodeGrant(\n              configuration,\n              currentUrl,\n              {\n                pkceCodeVerifier: Redacted.value(request.secrets.pkceVerifier),\n                expectedState: Redacted.value(request.secrets.state),\n                ...(provider.protocol === \"oidc\"\n                  ? {\n                      expectedNonce: Redacted.value(request.secrets.oidcNonce!),\n                      idTokenExpected: true,\n                      ...(provider.maxAgeSeconds === undefined\n                        ? {}\n                        : { maxAge: provider.maxAgeSeconds }),\n                    }\n                  : {}),\n              },\n              provider.tokenParameters,\n            );\n\n            signal.throwIfAborted();\n            if (provider.protocol === \"oidc\")\n              return { protocol: \"oidc\" as const, claims: tokens.claims() };\n            if (tokens.token_type !== \"bearer\") throw unavailable();\n\n            const response = await client.fetchProtectedResource(\n              configuration,\n              tokens.access_token,\n              new URL(provider.identitySource.url),\n              \"GET\",\n              undefined,\n              new Headers(provider.identitySource.headers),\n            );\n\n            signal.throwIfAborted();\n            if (\n              response.status !== 200 ||\n              response.headers.get(\"content-type\")?.split(\";\", 1)[0]?.trim().toLowerCase() !==\n                \"application/json\"\n            )\n              throw unavailable();\n            const body: unknown = await response.json();\n\n            signal.throwIfAborted();\n\n            return { protocol: \"oauth\" as const, body };\n          },\n          catch: grantError,\n        });\n\n        if (exchanged.protocol === \"oidc\") {\n          // oxlint-disable-next-line no-restricted-properties -- Project validated foreign ID-token claims into the adapter's stricter bounded profile.\n          const claims = yield* Schema.decodeUnknownEffect(claimsSchema)(exchanged.claims).pipe(\n            Effect.mapError(rejected),\n          );\n\n          const now = DateTime.toEpochMillis(yield* DateTime.now) / 1000;\n          const audience = typeof claims.aud === \"string\" ? claims.aud : claims.aud[0];\n\n          if (\n            provider.protocol !== \"oidc\" ||\n            claims.iss !== provider.issuer ||\n            audience !== provider.clientId ||\n            (claims.azp !== undefined && claims.azp !== provider.clientId) ||\n            claims.exp <= now ||\n            claims.iat > now ||\n            (claims.nbf !== undefined && claims.nbf > now) ||\n            (claims.auth_time !== undefined && claims.auth_time > now) ||\n            (provider.maxAgeSeconds !== undefined &&\n              (claims.auth_time === undefined ||\n                claims.auth_time + provider.maxAgeSeconds < Math.floor(now)))\n          )\n            return yield* rejected();\n\n          return yield* snapshotOAuth(OAuthVerifiedExternalIdentity, {\n            identity: { provider: provider.provider, issuer: provider.issuer, subject: claims.sub },\n            ...(claims.auth_time === undefined\n              ? {}\n              : {\n                  upstreamAuthenticatedAt: DateTime.makeUnsafe(\n                    Math.min(startedAt, claims.auth_time * 1000),\n                  ),\n                }),\n          });\n        }\n        if (provider.protocol !== \"oauth\") return yield* unavailable();\n\n        const decoded = yield* Effect.suspend(() =>\n          provider.identitySource.decodeIdentity(exchanged.body),\n        ).pipe(\n          Effect.provideContext(context),\n          Effect.catchCause(\n            (cause): Effect.Effect<never, OAuthProtocolRejected | OAuthUnavailable> => {\n              if (Cause.hasInterrupts(cause))\n                return reportAuthFailure(\"oauth-identity\", cause).pipe(\n                  Effect.andThen(Effect.interrupt),\n                );\n              if (\n                cause.reasons.length === 1 &&\n                cause.reasons[0]?._tag === \"Fail\" &&\n                Schema.is(OAuthProtocolRejected)(cause.reasons[0].error)\n              )\n                return Effect.fail(rejected());\n\n              return reportAuthFailure(\"oauth-identity\", cause).pipe(\n                Effect.andThen(Effect.fail(unavailable())),\n              );\n            },\n          ),\n        );\n\n        const identity = yield* Schema.decodeEffect(plainIdentitySchema)(decoded).pipe(\n          Effect.mapError(rejected),\n        );\n\n        return yield* snapshotOAuth(OAuthVerifiedExternalIdentity, {\n          identity: {\n            provider: provider.provider,\n            issuer: provider.issuer,\n            subject: identity.subject,\n          },\n          ...(identity.profile === undefined ? {} : { profile: identity.profile }),\n        });\n      });\n\n    return OAuthProtocol.of({\n      prepareAuthorization: (input) => unavailableOnDefect(prepareAuthorization(input)),\n      exchangeVerifiedIdentity: (input) => unavailableOnDefect(exchangeVerifiedIdentity(input)),\n    });\n  },\n  unavailableOnDefect,\n);\n\nexport const makeOpenIdClientOAuthProtocol = <R = never>(\n  options: OpenIdClientOAuthProtocolOptions<R>,\n) => makeOAuthProtocolWithCompatibility(options);\n\nexport const openIdClientOAuthProtocolLayer = <R = never>(\n  options: OpenIdClientOAuthProtocolOptions<R>,\n) => Layer.effect(OAuthProtocol, makeOpenIdClientOAuthProtocol(options));\n"],"mappings":";;;;;;;;;;;;;AA+BA,MAAM,aAAa,OAAO,OAAO;CAC/B,UAAU;CACV,YAAY;CACZ,QAAQ;AACV,CAAC;AAED,MAAM,gBAAgB,OAAO,OAC3B,OAAO,OAAO;CACZ,eAAe;CACf,UAAU;CACV,SAAS;CACT,uBAAuB,OAAO;AAChC,CAAC,CACH;AAEA,MAAM,cAAc,OAAO,OAAO,MAAM,OAAO,UAAU;CAAE,SAAS;CAAG,SAAS;AAAc,CAAC,CAAC;AAEhG,MAAM,eAAe,OAAO,OAAO;CACjC,KAAK,OAAO;CACZ,KAAK,8BAA8B,OAAO,SAAS,OAAO;CAC1D,KAAK,OAAO,MAAM,CAChB,OAAO,QACP,OAAO,MAAM,OAAO,MAAM,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,CAAC,CAAC,CAChF,CAAC;CACD,KAAK,OAAO,YAAY,OAAO,MAAM;CACrC,KAAK;CACL,KAAK;CACL,KAAK,OAAO,YAAY,WAAW;CACnC,WAAW,OAAO,YAAY,WAAW;AAC3C,CAAC;AAED,MAAM,sBAAsB,OAAO,OAAO;CACxC,SAAS,8BAA8B,OAAO,SAAS,OAAO;CAC9D,SAAS,OAAO,YAAY,mBAAmB;AACjD,CAAC;AAED,MAAM,oBAAoB,iBAAiB,KAAK,CAAC,CAAC;AAClD,MAAM,iBAAiB,sBAAsB,KAAK,CAAC,CAAC;AAEpD,MAAM,uBAAgC,WACpC,OAAO,KACL,OAAO,UAAU,UACf,MAAM,QAAQ,KAAK,IAAI,kBAAkB,kBAAkB,KAAK,IAAI,OAAO,IAC7E,GACA,OAAO,YAAY,UAAsD;CACvE,IAAI,MAAM,cAAc,KAAK,GAAG,OAAO,OAAO;CAC9C,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,OAAO,KAAK,YAAY,CAAC;CAE1D,OAAO,OAAO,UAAU,KAAK;AAC/B,CAAC,CACH;;;AAIF,MAAM,cAAc,UAAmB;CACrC,IACE,iBAAiB,0BAChB,iBAAiB,OAAO,eAAe,MAAM,iBAAiB,wBAE/D,OAAO,SAAS;CAClB,IACE,iBAAiB,OAAO,gBACvB,MAAM,SAAS,uCACd,MAAM,SAAS,qCAEjB,OAAO,SAAS;CAClB,IACE,iBAAiB,OAAO,qBACxB,MAAM,WAAW,OACjB,MAAM,UAAU,iBAEhB,OAAO,SAAS;CAElB,OAAO,YAAY;AACrB;AAEA,MAAM,wBACJ,OACA,SACA,OACA,QACA,kBACG;CACH,MAAM,WAAW,MAAM;CAEvB,MAAM,gBAAgB,IAAI,OAAO,cAC/B,MAAM,UACN,SAAS,UACT;GACG,OAAO,YAAY;GACnB,OAAO,iBAAiB;EACzB,GAAI,SAAS,aAAa,SACtB,EAAE,8BAA8B,SAAS,yBAAyB,IAClE,CAAC;CACP,GACA,qBAAqB,SAAS,cAAc,CAC9C;CAEA,cAAc,UAAU;CACxB,MAAM,YAAY,aAAa,OAAO,QAAQ,MAAM,WAAW;CAE/D,cAAc,OAAO,eACnB,kBAAkB,KAAA,IACd,YACA,OAAO,KAAK,YAAY;EACtB,MAAM,WAAW,MAAM,UAAU,KAAK,OAAO;EAE7C,IAAI,QAAQ,IAAI,IAAI,MAAM,SAAS,cAAe,CAAC,CAAC,MAAM;GACxD,MAAM,OAAgB,MAAM,SAAS,MAAM,CAAC,CAAC,KAAK;GAElD,OAAO,eAAe;GACtB,cAAc,eACZ;IAAE;IAAM,QAAQ,SAAS;IAAQ,aAAa,SAAS,QAAQ,IAAI,cAAc;GAAE,GACnF;IACE,QAAQ,SAAS;IACjB,iBAAiB;IACjB,WAAW;GACb,CACF;GACA,OAAO,eAAe;EACxB;EAEA,OAAO;CACT;CACN,IAAI,SAAS,aAAa,QAAQ,OAAO,2BAA2B,aAAa;CAEjF,OAAO;AACT;AAEA,MAAa,qCAAqC,OAAO,GAAG,+BAA+B,CAAC,CAC1F,WACE,SACA,eAKA;CACA,MAAM,UAAU,OAAO,OAAO,QAAW;CACzC,MAAM,EAAE,WAAW,OAAO,mBAAmB,OAAO,sBAAsB,OAAO;CAEjF,MAAM,uBAAyE,OAAO,GACpF,mCACF,CAAC,CAAC,WAAW,OAAO;EAClB,MAAM,UAAU,OAAO,OAAO,aAAa,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,KAC5D,OAAO,eAAe,cAAc,KAAK,CAAC,CAAC,CAAC,CAC9C;EAEA,MAAM,QAAQ,UAAU,MACrB,EAAE,eAAe,SAAS,aAAa,YAAY,SAAS,aAAa,QAAQ,QACpF;EAEA,MAAM,WAAW,OAAO;EAExB,MAAM,WAAW,UAAU,UAAU,MAClC,cAAc,UAAU,eAAe,QAAQ,UAClD;EAEA,IAAI,UAAU,KAAA,KAAa,aAAa,KAAA,KAAa,aAAa,KAAA,GAChE,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;EAErC,MAAM,SAAS,OAAO,OAAO,WAAW;GACtC,KAAK,OAAO,WAAW;IACrB,MAAM,gBAAgB,qBACpB,OACA,gBACA,OACA,QACA,aACF;IAEA,MAAM,QAAQ,OAAO,YAAY;IACjC,MAAM,WAAW,OAAO,uBAAuB;IAC/C,MAAM,QAAQ,SAAS,aAAa,SAAS,OAAO,YAAY,IAAI,KAAA;IACpE,MAAM,YAAY,MAAM,OAAO,2BAA2B,QAAQ;IAElE,OAAO,eAAe;IAEtB,MAAM,MAAM,OAAO,sBACjB,eACA,4BAA4B,UAAU,SAAS,aAAa;KAC1D;KACA;KACA,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;IACzC,CAAC,CACH;IAEA,OAAO;KACL,eAAe;MACb,UAAU,SAAS;MACnB,UAAU,SAAS;MACnB,yBAAyB,SAAS;MAClC,QAAQ,SAAS;MACjB,oBAAoB,SAAS;MAC7B,YAAY,SAAS;MACrB,aAAa,SAAS;KACxB;KACA,kBAAkB,SAAS,KAAK,IAAI,IAAI;KACxC,SAAS;MACP,WAAW;MACX,OAAO,SAAS,KAAK,KAAK;MAC1B,cAAc,SAAS,KAAK,QAAQ;MACpC,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,SAAS,KAAK,KAAK,EAAE;KACnE;IACF;GACF;GACA,OAAO;EACT,CAAC;EAED,OAAO,OAAO,cAAc,0BAA0B,MAAM;CAC9D,CAAC;CAED,MAAM,2BACJ,OAAO,GAAG,uCAAuC,CAAC,CAAC,WAAW,OAAO;EACnE,MAAM,UAAU,OAAO,cAAc,eAAe,KAAK;EACzD,MAAM,QAAQ,QAAQ;EAEtB,MAAM,QAAQ,UAAU,MACrB,EAAE,eACD,SAAS,aAAa,MAAM,YAC5B,SAAS,4BAA4B,MAAM,uBAC/C;EAEA,IAAI,UAAU,KAAA,GAAW,OAAO,OAAO,YAAY;EACnD,MAAM,WAAW,MAAM;EAEvB,MAAM,WAAW,SAAS,UAAU,MACjC,cAAc,UAAU,eAAe,MAAM,UAChD;EAEA,IACE,SAAS,aAAa,MAAM,YAC5B,SAAS,WAAW,MAAM,UAC1B,SAAS,uBAAuB,MAAM,sBACtC,UAAU,gBAAgB,MAAM,aAEhC,OAAO,OAAO,YAAY;EAC5B,IACG,SAAS,aAAa,YAAa,QAAQ,QAAQ,cAAc,KAAA,MAClE,SAAS,MAAM,QAAQ,SAAS,KAAK,MAAM,SAAS,MAAM,QAAQ,QAAQ,KAAK,MAC9E,SAAS,uBAAuB,aAC7B,QAAQ,SAAS,WAAW,SAAS,SACrC,QAAQ,SAAS,WAAW,KAAA,IAEhC,OAAO,OAAO,SAAS;EACzB,MAAM,YAAY,SAAS,cAAc,QAAQ,qBAAqB;EAEtE,IAAI,YAAY,KAAK,YAAY,SAAS,cAAc,OAAO,SAAS,GAAG,GACzE,OAAO,OAAO,SAAS;EAEzB,MAAM,YAAY,OAAO,OAAO,WAAW;GACzC,KAAK,OAAO,WAAW;IACrB,MAAM,gBAAgB,qBACpB,OACA,gBACA,OACA,QACA,aACF;IAEA,MAAM,aAAa,IAAI,IAAI,MAAM,WAAW;IAE5C,WAAW,aAAa,IAAI,QAAQ,SAAS,MAAM,QAAQ,SAAS,IAAI,CAAC;IACzE,WAAW,aAAa,IAAI,SAAS,SAAS,MAAM,QAAQ,SAAS,KAAK,CAAC;IAC3E,IAAI,QAAQ,SAAS,WAAW,KAAA,GAC9B,WAAW,aAAa,IAAI,OAAO,QAAQ,SAAS,MAAM;IAE5D,MAAM,SAAS,MAAM,OAAO,uBAC1B,eACA,YACA;KACE,kBAAkB,SAAS,MAAM,QAAQ,QAAQ,YAAY;KAC7D,eAAe,SAAS,MAAM,QAAQ,QAAQ,KAAK;KACnD,GAAI,SAAS,aAAa,SACtB;MACE,eAAe,SAAS,MAAM,QAAQ,QAAQ,SAAU;MACxD,iBAAiB;MACjB,GAAI,SAAS,kBAAkB,KAAA,IAC3B,CAAC,IACD,EAAE,QAAQ,SAAS,cAAc;KACvC,IACA,CAAC;IACP,GACA,SAAS,eACX;IAEA,OAAO,eAAe;IACtB,IAAI,SAAS,aAAa,QACxB,OAAO;KAAE,UAAU;KAAiB,QAAQ,OAAO,OAAO;IAAE;IAC9D,IAAI,OAAO,eAAe,UAAU,MAAM,YAAY;IAEtD,MAAM,WAAW,MAAM,OAAO,uBAC5B,eACA,OAAO,cACP,IAAI,IAAI,SAAS,eAAe,GAAG,GACnC,OACA,KAAA,GACA,IAAI,QAAQ,SAAS,eAAe,OAAO,CAC7C;IAEA,OAAO,eAAe;IACtB,IACE,SAAS,WAAW,OACpB,SAAS,QAAQ,IAAI,cAAc,CAAC,EAAE,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,YAAY,MACzE,oBAEF,MAAM,YAAY;IACpB,MAAM,OAAgB,MAAM,SAAS,KAAK;IAE1C,OAAO,eAAe;IAEtB,OAAO;KAAE,UAAU;KAAkB;IAAK;GAC5C;GACA,OAAO;EACT,CAAC;EAED,IAAI,UAAU,aAAa,QAAQ;GAEjC,MAAM,SAAS,OAAO,OAAO,oBAAoB,YAAY,CAAC,CAAC,UAAU,MAAM,CAAC,CAAC,KAC/E,OAAO,SAAS,QAAQ,CAC1B;GAEA,MAAM,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG,IAAI;GAC1D,MAAM,WAAW,OAAO,OAAO,QAAQ,WAAW,OAAO,MAAM,OAAO,IAAI;GAE1E,IACE,SAAS,aAAa,UACtB,OAAO,QAAQ,SAAS,UACxB,aAAa,SAAS,YACrB,OAAO,QAAQ,KAAA,KAAa,OAAO,QAAQ,SAAS,YACrD,OAAO,OAAO,OACd,OAAO,MAAM,OACZ,OAAO,QAAQ,KAAA,KAAa,OAAO,MAAM,OACzC,OAAO,cAAc,KAAA,KAAa,OAAO,YAAY,OACrD,SAAS,kBAAkB,KAAA,MACzB,OAAO,cAAc,KAAA,KACpB,OAAO,YAAY,SAAS,gBAAgB,KAAK,MAAM,GAAG,IAE9D,OAAO,OAAO,SAAS;GAEzB,OAAO,OAAO,cAAc,+BAA+B;IACzD,UAAU;KAAE,UAAU,SAAS;KAAU,QAAQ,SAAS;KAAQ,SAAS,OAAO;IAAI;IACtF,GAAI,OAAO,cAAc,KAAA,IACrB,CAAC,IACD,EACE,yBAAyB,SAAS,WAChC,KAAK,IAAI,WAAW,OAAO,YAAY,GAAI,CAC7C,EACF;GACN,CAAC;EACH;EACA,IAAI,SAAS,aAAa,SAAS,OAAO,OAAO,YAAY;EAE7D,MAAM,UAAU,OAAO,OAAO,cAC5B,SAAS,eAAe,eAAe,UAAU,IAAI,CACvD,CAAC,CAAC,KACA,OAAO,eAAe,OAAO,GAC7B,OAAO,YACJ,UAA0E;GACzE,IAAI,MAAM,cAAc,KAAK,GAC3B,OAAO,kBAAkB,kBAAkB,KAAK,CAAC,CAAC,KAChD,OAAO,QAAQ,OAAO,SAAS,CACjC;GACF,IACE,MAAM,QAAQ,WAAW,KACzB,MAAM,QAAQ,EAAE,EAAE,SAAS,UAC3B,OAAO,GAAG,qBAAqB,CAAC,CAAC,MAAM,QAAQ,EAAE,CAAC,KAAK,GAEvD,OAAO,OAAO,KAAK,SAAS,CAAC;GAE/B,OAAO,kBAAkB,kBAAkB,KAAK,CAAC,CAAC,KAChD,OAAO,QAAQ,OAAO,KAAK,YAAY,CAAC,CAAC,CAC3C;EACF,CACF,CACF;EAEA,MAAM,WAAW,OAAO,OAAO,aAAa,mBAAmB,CAAC,CAAC,OAAO,CAAC,CAAC,KACxE,OAAO,SAAS,QAAQ,CAC1B;EAEA,OAAO,OAAO,cAAc,+BAA+B;GACzD,UAAU;IACR,UAAU,SAAS;IACnB,QAAQ,SAAS;IACjB,SAAS,SAAS;GACpB;GACA,GAAI,SAAS,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,SAAS,QAAQ;EACxE,CAAC;CACH,CAAC;CAEH,OAAO,cAAc,GAAG;EACtB,uBAAuB,UAAU,oBAAoB,qBAAqB,KAAK,CAAC;EAChF,2BAA2B,UAAU,oBAAoB,yBAAyB,KAAK,CAAC;CAC1F,CAAC;AACH,GACA,mBACF;AAEA,MAAa,iCACX,YACG,mCAAmC,OAAO;AAE/C,MAAa,kCACX,YACG,MAAM,OAAO,eAAe,8BAA8B,OAAO,CAAC"}
+{"version":3,"file":"protocol.mjs","names":[],"sources":["../../../src/oauth/openid-client/protocol.ts"],"sourcesContent":["import { Cause, DateTime, Effect, Layer, Redacted, Schema } from \"effect\";\nimport * as client from \"openid-client\";\n\nimport { reportAuthFailure } from \"../../internal/diagnostics\";\nimport { RequestBindingFlowId } from \"../../operations/requestBinding\";\nimport { OAuthProtocol } from \"../OAuthProtocol\";\nimport { OAuthProviderKey } from \"../schema\";\nimport { OAuthProtocolRejected, OAuthRejected, OAuthUnavailable } from \"../signInErrors\";\nimport {\n  OAuthCallbackId,\n  OAuthCodeResponse,\n  OAuthDisplayProfile,\n  OAuthProtocolConfiguration,\n  OAuthProtocolPreparation,\n  OAuthTransactionSecrets,\n  OAuthVerifiedExternalIdentity,\n} from \"../signInModels\";\nimport { snapshotOAuth } from \"../signInSnapshot\";\nimport { DefiniteTokenRejection, tokenCompatibility } from \"./compatibility\";\nimport {\n  clientAuthentication,\n  installConfigurations,\n  makeAuthorizationParameters,\n  type InstalledProvider,\n} from \"./configuration\";\nimport {\n  type OpenIdClientConfigurationError,\n  type OpenIdClientOAuthProtocolOptions,\n} from \"./models\";\nimport { boundedFetch } from \"./transport\";\n\nconst beginInput = Schema.Struct({\n  provider: OAuthProviderKey,\n  callbackId: OAuthCallbackId,\n  flowId: RequestBindingFlowId,\n});\n\nconst exchangeInput = Schema.toType(\n  Schema.Struct({\n    configuration: OAuthProtocolConfiguration,\n    response: OAuthCodeResponse,\n    secrets: OAuthTransactionSecrets,\n    verificationStartedAt: Schema.DateTimeUtcFromMillis,\n  }),\n);\n\nconst numericDate = Schema.Finite.check(Schema.isBetween({ minimum: 0, maximum: 8640000000000 }));\n\nconst claimsSchema = Schema.Struct({\n  iss: Schema.String,\n  sub: OAuthVerifiedExternalIdentity.fields.identity.fields.subject,\n  aud: Schema.Union([\n    Schema.String,\n    Schema.Array(Schema.String).check(Schema.isMinLength(1), Schema.isMaxLength(1)),\n  ]),\n  azp: Schema.optionalKey(Schema.String),\n  exp: numericDate,\n  iat: numericDate,\n  nbf: Schema.optionalKey(numericDate),\n  auth_time: Schema.optionalKey(numericDate),\n});\n\nconst plainIdentitySchema = Schema.Struct({\n  subject: OAuthVerifiedExternalIdentity.fields.identity.fields.subject,\n  profile: Schema.optionalKey(OAuthDisplayProfile),\n});\n\nconst unavailable = () => OAuthUnavailable.make({});\nconst rejected = () => OAuthProtocolRejected.make({});\n\nconst unavailableOnDefect = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n  effect.pipe(\n    Effect.tapCause((cause) =>\n      Cause.hasDies(cause) ? reportAuthFailure(\"oauth-protocol\", cause) : Effect.void,\n    ),\n    Effect.catchCause((cause): Effect.Effect<never, E | OAuthUnavailable> => {\n      if (Cause.hasInterrupts(cause)) return Effect.interrupt;\n      if (Cause.hasDies(cause)) return Effect.fail(unavailable());\n\n      return Effect.failCause(cause);\n    }),\n  );\n\n/** Only precise claim errors and a fully parsed invalid_grant are definite.\n * INVALID_RESPONSE also covers signature/key/transport faults; keep it ambiguous. */\nconst grantError = (error: unknown) => {\n  if (\n    error instanceof DefiniteTokenRejection ||\n    (error instanceof client.ClientError && error.cause instanceof DefiniteTokenRejection)\n  )\n    return rejected();\n  if (\n    error instanceof client.ClientError &&\n    (error.code === \"OAUTH_JWT_CLAIM_COMPARISON_FAILED\" ||\n      error.code === \"OAUTH_JWT_TIMESTAMP_CHECK_FAILED\")\n  )\n    return rejected();\n  if (\n    error instanceof client.ResponseBodyError &&\n    error.status === 400 &&\n    error.error === \"invalid_grant\"\n  )\n    return rejected();\n\n  return unavailable();\n};\n\nconst privateConfiguration = <R>(\n  entry: InstalledProvider<R>,\n  timeout: number,\n  fetch: client.CustomFetch,\n  signal: AbortSignal,\n) => {\n  const provider = entry.provider;\n  const compatibility = provider.protocol === \"oauth\" ? provider[tokenCompatibility] : undefined;\n\n  const configuration = new client.Configuration(\n    entry.metadata,\n    provider.clientId,\n    {\n      [client.clockSkew]: 0,\n      [client.clockTolerance]: 0,\n      ...(provider.protocol === \"oidc\"\n        ? { id_token_signed_response_alg: provider.idTokenSignedResponseAlg }\n        : {}),\n    },\n    clientAuthentication(provider.authentication),\n  );\n\n  configuration.timeout = timeout;\n  const transport = boundedFetch(fetch, signal, entry.allowedUrls);\n\n  configuration[client.customFetch] =\n    compatibility === undefined\n      ? transport\n      : async (url, options) => {\n          const response = await transport(url, options);\n\n          if (url === new URL(entry.metadata.token_endpoint!).href) {\n            const body: unknown = await response.clone().json();\n\n            signal.throwIfAborted();\n            compatibility.inspectReceipt(\n              { body, status: response.status, contentType: response.headers.get(\"content-type\") },\n              {\n                scopes: provider.scopes,\n                refreshRequired: false,\n                operation: \"authorization_code\",\n              },\n            );\n            signal.throwIfAborted();\n          }\n\n          return response;\n        };\n  if (provider.protocol === \"oidc\") client.enableNonRepudiationChecks(configuration);\n\n  return configuration;\n};\n\nexport const makeOpenIdClientOAuthProtocol = Effect.fn(\"makeOpenIdClientOAuthProtocol\")(\n  // Capture one provider table; each generation retains its own receipt rules.\n  function* <R = never>(\n    options: OpenIdClientOAuthProtocolOptions<R>,\n  ): Effect.fn.Return<\n    OAuthProtocol[\"Service\"],\n    OpenIdClientConfigurationError | OAuthUnavailable,\n    R\n  > {\n    const context = yield* Effect.context<R>();\n    const { installed, fetch, timeoutSeconds } = yield* installConfigurations(options);\n\n    const prepareAuthorization: OAuthProtocol[\"Service\"][\"prepareAuthorization\"] = Effect.fn(\n      \"OpenIdClient.prepareAuthorization\",\n    )(function* (input) {\n      const request = yield* Schema.decodeEffect(beginInput)(input).pipe(\n        Effect.mapError(() => OAuthRejected.make({})),\n      );\n\n      const entry = installed.find(\n        ({ provider }) => provider.issuance === \"active\" && provider.provider === request.provider,\n      );\n\n      const provider = entry?.provider;\n\n      const callback = provider?.callbacks.find(\n        (candidate) => candidate.callbackId === request.callbackId,\n      );\n\n      if (entry === undefined || provider === undefined || callback === undefined)\n        return yield* OAuthRejected.make({});\n\n      const result = yield* Effect.tryPromise({\n        try: async (signal) => {\n          const configuration = privateConfiguration(entry, timeoutSeconds, fetch, signal);\n\n          const state = client.randomState();\n          const verifier = client.randomPKCECodeVerifier();\n          const nonce = provider.protocol === \"oidc\" ? client.randomNonce() : undefined;\n          const challenge = await client.calculatePKCECodeChallenge(verifier);\n\n          signal.throwIfAborted();\n\n          const url = client.buildAuthorizationUrl(\n            configuration,\n            makeAuthorizationParameters(provider, callback.redirectUri, {\n              state,\n              challenge,\n              ...(nonce === undefined ? {} : { nonce }),\n            }),\n          );\n\n          return {\n            configuration: {\n              provider: provider.provider,\n              protocol: provider.protocol,\n              configurationGeneration: provider.configurationGeneration,\n              issuer: provider.issuer,\n              responseIssuerMode: provider.responseIssuerMode,\n              callbackId: callback.callbackId,\n              redirectUri: callback.redirectUri,\n            },\n            authorizationUrl: Redacted.make(url.href),\n            secrets: {\n              namespace: \"effect-auth/oauth-transaction-secrets/v1\" as const,\n              state: Redacted.make(state),\n              pkceVerifier: Redacted.make(verifier),\n              ...(nonce === undefined ? {} : { oidcNonce: Redacted.make(nonce) }),\n            },\n          };\n        },\n        catch: unavailable,\n      });\n\n      return yield* snapshotOAuth(OAuthProtocolPreparation, result);\n    });\n\n    const exchangeVerifiedIdentity: OAuthProtocol[\"Service\"][\"exchangeVerifiedIdentity\"] =\n      Effect.fn(\"OpenIdClient.exchangeVerifiedIdentity\")(function* (input) {\n        const request = yield* snapshotOAuth(exchangeInput, input);\n        const saved = request.configuration;\n\n        const entry = installed.find(\n          ({ provider }) =>\n            provider.provider === saved.provider &&\n            provider.configurationGeneration === saved.configurationGeneration,\n        );\n\n        if (entry === undefined) return yield* unavailable();\n        const provider = entry.provider;\n\n        const callback = provider.callbacks.find(\n          (candidate) => candidate.callbackId === saved.callbackId,\n        );\n\n        if (\n          provider.protocol !== saved.protocol ||\n          provider.issuer !== saved.issuer ||\n          provider.responseIssuerMode !== saved.responseIssuerMode ||\n          callback?.redirectUri !== saved.redirectUri\n        )\n          return yield* unavailable();\n        if (\n          (provider.protocol === \"oidc\") !== (request.secrets.oidcNonce !== undefined) ||\n          Redacted.value(request.response.state) !== Redacted.value(request.secrets.state) ||\n          (provider.responseIssuerMode === \"required\"\n            ? request.response.issuer !== provider.issuer\n            : request.response.issuer !== undefined)\n        )\n          return yield* rejected();\n        const startedAt = DateTime.toEpochMillis(request.verificationStartedAt);\n\n        if (startedAt < 0 || startedAt > DateTime.toEpochMillis(yield* DateTime.now))\n          return yield* rejected();\n\n        const exchanged = yield* Effect.tryPromise({\n          try: async (signal) => {\n            const configuration = privateConfiguration(entry, timeoutSeconds, fetch, signal);\n\n            const currentUrl = new URL(saved.redirectUri);\n\n            currentUrl.searchParams.set(\"code\", Redacted.value(request.response.code));\n            currentUrl.searchParams.set(\"state\", Redacted.value(request.response.state));\n            if (request.response.issuer !== undefined)\n              currentUrl.searchParams.set(\"iss\", request.response.issuer);\n\n            const tokens = await client.authorizationCodeGrant(\n              configuration,\n              currentUrl,\n              {\n                pkceCodeVerifier: Redacted.value(request.secrets.pkceVerifier),\n                expectedState: Redacted.value(request.secrets.state),\n                ...(provider.protocol === \"oidc\"\n                  ? {\n                      expectedNonce: Redacted.value(request.secrets.oidcNonce!),\n                      idTokenExpected: true,\n                      ...(provider.maxAgeSeconds === undefined\n                        ? {}\n                        : { maxAge: provider.maxAgeSeconds }),\n                    }\n                  : {}),\n              },\n              provider.tokenParameters,\n            );\n\n            signal.throwIfAborted();\n            if (provider.protocol === \"oidc\")\n              return { protocol: \"oidc\" as const, claims: tokens.claims() };\n            if (tokens.token_type !== \"bearer\") throw unavailable();\n\n            const response = await client.fetchProtectedResource(\n              configuration,\n              tokens.access_token,\n              new URL(provider.identitySource.url),\n              \"GET\",\n              undefined,\n              new Headers(provider.identitySource.headers),\n            );\n\n            signal.throwIfAborted();\n            if (\n              response.status !== 200 ||\n              response.headers.get(\"content-type\")?.split(\";\", 1)[0]?.trim().toLowerCase() !==\n                \"application/json\"\n            )\n              throw unavailable();\n            const body: unknown = await response.json();\n\n            signal.throwIfAborted();\n\n            return { protocol: \"oauth\" as const, body };\n          },\n          catch: grantError,\n        });\n\n        if (exchanged.protocol === \"oidc\") {\n          // oxlint-disable-next-line no-restricted-properties -- Project validated foreign ID-token claims into the adapter's stricter bounded profile.\n          const claims = yield* Schema.decodeUnknownEffect(claimsSchema)(exchanged.claims).pipe(\n            Effect.mapError(rejected),\n          );\n\n          const now = DateTime.toEpochMillis(yield* DateTime.now) / 1000;\n          const audience = typeof claims.aud === \"string\" ? claims.aud : claims.aud[0];\n\n          if (\n            provider.protocol !== \"oidc\" ||\n            claims.iss !== provider.issuer ||\n            audience !== provider.clientId ||\n            (claims.azp !== undefined && claims.azp !== provider.clientId) ||\n            claims.exp <= now ||\n            claims.iat > now ||\n            (claims.nbf !== undefined && claims.nbf > now) ||\n            (claims.auth_time !== undefined && claims.auth_time > now) ||\n            (provider.maxAgeSeconds !== undefined &&\n              (claims.auth_time === undefined ||\n                claims.auth_time + provider.maxAgeSeconds < Math.floor(now)))\n          )\n            return yield* rejected();\n\n          return yield* snapshotOAuth(OAuthVerifiedExternalIdentity, {\n            identity: { provider: provider.provider, issuer: provider.issuer, subject: claims.sub },\n            ...(claims.auth_time === undefined\n              ? {}\n              : {\n                  upstreamAuthenticatedAt: DateTime.makeUnsafe(\n                    Math.min(startedAt, claims.auth_time * 1000),\n                  ),\n                }),\n          });\n        }\n        if (provider.protocol !== \"oauth\") return yield* unavailable();\n\n        const decoded = yield* Effect.suspend(() =>\n          provider.identitySource.decodeIdentity(exchanged.body),\n        ).pipe(\n          Effect.provideContext(context),\n          Effect.catchCause(\n            (cause): Effect.Effect<never, OAuthProtocolRejected | OAuthUnavailable> => {\n              if (Cause.hasInterrupts(cause))\n                return reportAuthFailure(\"oauth-identity\", cause).pipe(\n                  Effect.andThen(Effect.interrupt),\n                );\n              if (\n                cause.reasons.length === 1 &&\n                cause.reasons[0]?._tag === \"Fail\" &&\n                Schema.is(OAuthProtocolRejected)(cause.reasons[0].error)\n              )\n                return Effect.fail(rejected());\n\n              return reportAuthFailure(\"oauth-identity\", cause).pipe(\n                Effect.andThen(Effect.fail(unavailable())),\n              );\n            },\n          ),\n        );\n\n        const identity = yield* Schema.decodeEffect(plainIdentitySchema)(decoded).pipe(\n          Effect.mapError(rejected),\n        );\n\n        return yield* snapshotOAuth(OAuthVerifiedExternalIdentity, {\n          identity: {\n            provider: provider.provider,\n            issuer: provider.issuer,\n            subject: identity.subject,\n          },\n          ...(identity.profile === undefined ? {} : { profile: identity.profile }),\n        });\n      });\n\n    return OAuthProtocol.of({\n      prepareAuthorization: (input) => unavailableOnDefect(prepareAuthorization(input)),\n      exchangeVerifiedIdentity: (input) => unavailableOnDefect(exchangeVerifiedIdentity(input)),\n    });\n  },\n  unavailableOnDefect,\n);\n\nexport const openIdClientOAuthProtocolLayer = <R = never>(\n  options: OpenIdClientOAuthProtocolOptions<R>,\n) => Layer.effect(OAuthProtocol, makeOpenIdClientOAuthProtocol(options));\n"],"mappings":";;;;;;;;;;;;;AA+BA,MAAM,aAAa,OAAO,OAAO;CAC/B,UAAU;CACV,YAAY;CACZ,QAAQ;AACV,CAAC;AAED,MAAM,gBAAgB,OAAO,OAC3B,OAAO,OAAO;CACZ,eAAe;CACf,UAAU;CACV,SAAS;CACT,uBAAuB,OAAO;AAChC,CAAC,CACH;AAEA,MAAM,cAAc,OAAO,OAAO,MAAM,OAAO,UAAU;CAAE,SAAS;CAAG,SAAS;AAAc,CAAC,CAAC;AAEhG,MAAM,eAAe,OAAO,OAAO;CACjC,KAAK,OAAO;CACZ,KAAK,8BAA8B,OAAO,SAAS,OAAO;CAC1D,KAAK,OAAO,MAAM,CAChB,OAAO,QACP,OAAO,MAAM,OAAO,MAAM,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,CAAC,CAAC,CAChF,CAAC;CACD,KAAK,OAAO,YAAY,OAAO,MAAM;CACrC,KAAK;CACL,KAAK;CACL,KAAK,OAAO,YAAY,WAAW;CACnC,WAAW,OAAO,YAAY,WAAW;AAC3C,CAAC;AAED,MAAM,sBAAsB,OAAO,OAAO;CACxC,SAAS,8BAA8B,OAAO,SAAS,OAAO;CAC9D,SAAS,OAAO,YAAY,mBAAmB;AACjD,CAAC;AAED,MAAM,oBAAoB,iBAAiB,KAAK,CAAC,CAAC;AAClD,MAAM,iBAAiB,sBAAsB,KAAK,CAAC,CAAC;AAEpD,MAAM,uBAAgC,WACpC,OAAO,KACL,OAAO,UAAU,UACf,MAAM,QAAQ,KAAK,IAAI,kBAAkB,kBAAkB,KAAK,IAAI,OAAO,IAC7E,GACA,OAAO,YAAY,UAAsD;CACvE,IAAI,MAAM,cAAc,KAAK,GAAG,OAAO,OAAO;CAC9C,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,OAAO,KAAK,YAAY,CAAC;CAE1D,OAAO,OAAO,UAAU,KAAK;AAC/B,CAAC,CACH;;;AAIF,MAAM,cAAc,UAAmB;CACrC,IACE,iBAAiB,0BAChB,iBAAiB,OAAO,eAAe,MAAM,iBAAiB,wBAE/D,OAAO,SAAS;CAClB,IACE,iBAAiB,OAAO,gBACvB,MAAM,SAAS,uCACd,MAAM,SAAS,qCAEjB,OAAO,SAAS;CAClB,IACE,iBAAiB,OAAO,qBACxB,MAAM,WAAW,OACjB,MAAM,UAAU,iBAEhB,OAAO,SAAS;CAElB,OAAO,YAAY;AACrB;AAEA,MAAM,wBACJ,OACA,SACA,OACA,WACG;CACH,MAAM,WAAW,MAAM;CACvB,MAAM,gBAAgB,SAAS,aAAa,UAAU,SAAS,sBAAsB,KAAA;CAErF,MAAM,gBAAgB,IAAI,OAAO,cAC/B,MAAM,UACN,SAAS,UACT;GACG,OAAO,YAAY;GACnB,OAAO,iBAAiB;EACzB,GAAI,SAAS,aAAa,SACtB,EAAE,8BAA8B,SAAS,yBAAyB,IAClE,CAAC;CACP,GACA,qBAAqB,SAAS,cAAc,CAC9C;CAEA,cAAc,UAAU;CACxB,MAAM,YAAY,aAAa,OAAO,QAAQ,MAAM,WAAW;CAE/D,cAAc,OAAO,eACnB,kBAAkB,KAAA,IACd,YACA,OAAO,KAAK,YAAY;EACtB,MAAM,WAAW,MAAM,UAAU,KAAK,OAAO;EAE7C,IAAI,QAAQ,IAAI,IAAI,MAAM,SAAS,cAAe,CAAC,CAAC,MAAM;GACxD,MAAM,OAAgB,MAAM,SAAS,MAAM,CAAC,CAAC,KAAK;GAElD,OAAO,eAAe;GACtB,cAAc,eACZ;IAAE;IAAM,QAAQ,SAAS;IAAQ,aAAa,SAAS,QAAQ,IAAI,cAAc;GAAE,GACnF;IACE,QAAQ,SAAS;IACjB,iBAAiB;IACjB,WAAW;GACb,CACF;GACA,OAAO,eAAe;EACxB;EAEA,OAAO;CACT;CACN,IAAI,SAAS,aAAa,QAAQ,OAAO,2BAA2B,aAAa;CAEjF,OAAO;AACT;AAEA,MAAa,gCAAgC,OAAO,GAAG,+BAA+B,CAAC,CAErF,WACE,SAKA;CACA,MAAM,UAAU,OAAO,OAAO,QAAW;CACzC,MAAM,EAAE,WAAW,OAAO,mBAAmB,OAAO,sBAAsB,OAAO;CAEjF,MAAM,uBAAyE,OAAO,GACpF,mCACF,CAAC,CAAC,WAAW,OAAO;EAClB,MAAM,UAAU,OAAO,OAAO,aAAa,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,KAC5D,OAAO,eAAe,cAAc,KAAK,CAAC,CAAC,CAAC,CAC9C;EAEA,MAAM,QAAQ,UAAU,MACrB,EAAE,eAAe,SAAS,aAAa,YAAY,SAAS,aAAa,QAAQ,QACpF;EAEA,MAAM,WAAW,OAAO;EAExB,MAAM,WAAW,UAAU,UAAU,MAClC,cAAc,UAAU,eAAe,QAAQ,UAClD;EAEA,IAAI,UAAU,KAAA,KAAa,aAAa,KAAA,KAAa,aAAa,KAAA,GAChE,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;EAErC,MAAM,SAAS,OAAO,OAAO,WAAW;GACtC,KAAK,OAAO,WAAW;IACrB,MAAM,gBAAgB,qBAAqB,OAAO,gBAAgB,OAAO,MAAM;IAE/E,MAAM,QAAQ,OAAO,YAAY;IACjC,MAAM,WAAW,OAAO,uBAAuB;IAC/C,MAAM,QAAQ,SAAS,aAAa,SAAS,OAAO,YAAY,IAAI,KAAA;IACpE,MAAM,YAAY,MAAM,OAAO,2BAA2B,QAAQ;IAElE,OAAO,eAAe;IAEtB,MAAM,MAAM,OAAO,sBACjB,eACA,4BAA4B,UAAU,SAAS,aAAa;KAC1D;KACA;KACA,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;IACzC,CAAC,CACH;IAEA,OAAO;KACL,eAAe;MACb,UAAU,SAAS;MACnB,UAAU,SAAS;MACnB,yBAAyB,SAAS;MAClC,QAAQ,SAAS;MACjB,oBAAoB,SAAS;MAC7B,YAAY,SAAS;MACrB,aAAa,SAAS;KACxB;KACA,kBAAkB,SAAS,KAAK,IAAI,IAAI;KACxC,SAAS;MACP,WAAW;MACX,OAAO,SAAS,KAAK,KAAK;MAC1B,cAAc,SAAS,KAAK,QAAQ;MACpC,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,SAAS,KAAK,KAAK,EAAE;KACnE;IACF;GACF;GACA,OAAO;EACT,CAAC;EAED,OAAO,OAAO,cAAc,0BAA0B,MAAM;CAC9D,CAAC;CAED,MAAM,2BACJ,OAAO,GAAG,uCAAuC,CAAC,CAAC,WAAW,OAAO;EACnE,MAAM,UAAU,OAAO,cAAc,eAAe,KAAK;EACzD,MAAM,QAAQ,QAAQ;EAEtB,MAAM,QAAQ,UAAU,MACrB,EAAE,eACD,SAAS,aAAa,MAAM,YAC5B,SAAS,4BAA4B,MAAM,uBAC/C;EAEA,IAAI,UAAU,KAAA,GAAW,OAAO,OAAO,YAAY;EACnD,MAAM,WAAW,MAAM;EAEvB,MAAM,WAAW,SAAS,UAAU,MACjC,cAAc,UAAU,eAAe,MAAM,UAChD;EAEA,IACE,SAAS,aAAa,MAAM,YAC5B,SAAS,WAAW,MAAM,UAC1B,SAAS,uBAAuB,MAAM,sBACtC,UAAU,gBAAgB,MAAM,aAEhC,OAAO,OAAO,YAAY;EAC5B,IACG,SAAS,aAAa,YAAa,QAAQ,QAAQ,cAAc,KAAA,MAClE,SAAS,MAAM,QAAQ,SAAS,KAAK,MAAM,SAAS,MAAM,QAAQ,QAAQ,KAAK,MAC9E,SAAS,uBAAuB,aAC7B,QAAQ,SAAS,WAAW,SAAS,SACrC,QAAQ,SAAS,WAAW,KAAA,IAEhC,OAAO,OAAO,SAAS;EACzB,MAAM,YAAY,SAAS,cAAc,QAAQ,qBAAqB;EAEtE,IAAI,YAAY,KAAK,YAAY,SAAS,cAAc,OAAO,SAAS,GAAG,GACzE,OAAO,OAAO,SAAS;EAEzB,MAAM,YAAY,OAAO,OAAO,WAAW;GACzC,KAAK,OAAO,WAAW;IACrB,MAAM,gBAAgB,qBAAqB,OAAO,gBAAgB,OAAO,MAAM;IAE/E,MAAM,aAAa,IAAI,IAAI,MAAM,WAAW;IAE5C,WAAW,aAAa,IAAI,QAAQ,SAAS,MAAM,QAAQ,SAAS,IAAI,CAAC;IACzE,WAAW,aAAa,IAAI,SAAS,SAAS,MAAM,QAAQ,SAAS,KAAK,CAAC;IAC3E,IAAI,QAAQ,SAAS,WAAW,KAAA,GAC9B,WAAW,aAAa,IAAI,OAAO,QAAQ,SAAS,MAAM;IAE5D,MAAM,SAAS,MAAM,OAAO,uBAC1B,eACA,YACA;KACE,kBAAkB,SAAS,MAAM,QAAQ,QAAQ,YAAY;KAC7D,eAAe,SAAS,MAAM,QAAQ,QAAQ,KAAK;KACnD,GAAI,SAAS,aAAa,SACtB;MACE,eAAe,SAAS,MAAM,QAAQ,QAAQ,SAAU;MACxD,iBAAiB;MACjB,GAAI,SAAS,kBAAkB,KAAA,IAC3B,CAAC,IACD,EAAE,QAAQ,SAAS,cAAc;KACvC,IACA,CAAC;IACP,GACA,SAAS,eACX;IAEA,OAAO,eAAe;IACtB,IAAI,SAAS,aAAa,QACxB,OAAO;KAAE,UAAU;KAAiB,QAAQ,OAAO,OAAO;IAAE;IAC9D,IAAI,OAAO,eAAe,UAAU,MAAM,YAAY;IAEtD,MAAM,WAAW,MAAM,OAAO,uBAC5B,eACA,OAAO,cACP,IAAI,IAAI,SAAS,eAAe,GAAG,GACnC,OACA,KAAA,GACA,IAAI,QAAQ,SAAS,eAAe,OAAO,CAC7C;IAEA,OAAO,eAAe;IACtB,IACE,SAAS,WAAW,OACpB,SAAS,QAAQ,IAAI,cAAc,CAAC,EAAE,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,YAAY,MACzE,oBAEF,MAAM,YAAY;IACpB,MAAM,OAAgB,MAAM,SAAS,KAAK;IAE1C,OAAO,eAAe;IAEtB,OAAO;KAAE,UAAU;KAAkB;IAAK;GAC5C;GACA,OAAO;EACT,CAAC;EAED,IAAI,UAAU,aAAa,QAAQ;GAEjC,MAAM,SAAS,OAAO,OAAO,oBAAoB,YAAY,CAAC,CAAC,UAAU,MAAM,CAAC,CAAC,KAC/E,OAAO,SAAS,QAAQ,CAC1B;GAEA,MAAM,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG,IAAI;GAC1D,MAAM,WAAW,OAAO,OAAO,QAAQ,WAAW,OAAO,MAAM,OAAO,IAAI;GAE1E,IACE,SAAS,aAAa,UACtB,OAAO,QAAQ,SAAS,UACxB,aAAa,SAAS,YACrB,OAAO,QAAQ,KAAA,KAAa,OAAO,QAAQ,SAAS,YACrD,OAAO,OAAO,OACd,OAAO,MAAM,OACZ,OAAO,QAAQ,KAAA,KAAa,OAAO,MAAM,OACzC,OAAO,cAAc,KAAA,KAAa,OAAO,YAAY,OACrD,SAAS,kBAAkB,KAAA,MACzB,OAAO,cAAc,KAAA,KACpB,OAAO,YAAY,SAAS,gBAAgB,KAAK,MAAM,GAAG,IAE9D,OAAO,OAAO,SAAS;GAEzB,OAAO,OAAO,cAAc,+BAA+B;IACzD,UAAU;KAAE,UAAU,SAAS;KAAU,QAAQ,SAAS;KAAQ,SAAS,OAAO;IAAI;IACtF,GAAI,OAAO,cAAc,KAAA,IACrB,CAAC,IACD,EACE,yBAAyB,SAAS,WAChC,KAAK,IAAI,WAAW,OAAO,YAAY,GAAI,CAC7C,EACF;GACN,CAAC;EACH;EACA,IAAI,SAAS,aAAa,SAAS,OAAO,OAAO,YAAY;EAE7D,MAAM,UAAU,OAAO,OAAO,cAC5B,SAAS,eAAe,eAAe,UAAU,IAAI,CACvD,CAAC,CAAC,KACA,OAAO,eAAe,OAAO,GAC7B,OAAO,YACJ,UAA0E;GACzE,IAAI,MAAM,cAAc,KAAK,GAC3B,OAAO,kBAAkB,kBAAkB,KAAK,CAAC,CAAC,KAChD,OAAO,QAAQ,OAAO,SAAS,CACjC;GACF,IACE,MAAM,QAAQ,WAAW,KACzB,MAAM,QAAQ,EAAE,EAAE,SAAS,UAC3B,OAAO,GAAG,qBAAqB,CAAC,CAAC,MAAM,QAAQ,EAAE,CAAC,KAAK,GAEvD,OAAO,OAAO,KAAK,SAAS,CAAC;GAE/B,OAAO,kBAAkB,kBAAkB,KAAK,CAAC,CAAC,KAChD,OAAO,QAAQ,OAAO,KAAK,YAAY,CAAC,CAAC,CAC3C;EACF,CACF,CACF;EAEA,MAAM,WAAW,OAAO,OAAO,aAAa,mBAAmB,CAAC,CAAC,OAAO,CAAC,CAAC,KACxE,OAAO,SAAS,QAAQ,CAC1B;EAEA,OAAO,OAAO,cAAc,+BAA+B;GACzD,UAAU;IACR,UAAU,SAAS;IACnB,QAAQ,SAAS;IACjB,SAAS,SAAS;GACpB;GACA,GAAI,SAAS,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,SAAS,QAAQ;EACxE,CAAC;CACH,CAAC;CAEH,OAAO,cAAc,GAAG;EACtB,uBAAuB,UAAU,oBAAoB,qBAAqB,KAAK,CAAC;EAChF,2BAA2B,UAAU,oBAAoB,yBAAyB,KAAK,CAAC;CAC1F,CAAC;AACH,GACA,mBACF;AAEA,MAAa,kCACX,YACG,MAAM,OAAO,eAAe,8BAA8B,OAAO,CAAC"}

package/package.json

@@ -1 +1 @@
-{"name":"@yielded/auth","version":"0.1.0-beta.2","dependencies":{"@noble/ciphers":"2.1.1","@noble/hashes":"2.3.0"},"devDependencies":{"@cloudflare/workers-types":"5.20260825.1","@effect/platform-bun":"4.0.0-rc.112","@effect/platform-node":"4.0.0-rc.112","@effect/sql-d1":"4.0.0-rc.112","@effect/sql-libsql":"4.0.0-rc.112","@effect/sql-mysql2":"4.0.0-rc.112","@effect/sql-pg":"4.0.0-rc.112","@effect/sql-pglite":"4.0.0-rc.112","@effect/sql-sqlite-bun":"4.0.0-rc.112","@effect/sql-sqlite-do":"4.0.0-rc.112","@effect/sql-sqlite-node":"4.0.0-rc.112","@effect/sql-sqlite-wasm":"4.0.0-rc.112","@effect/vitest":"4.0.0-rc.112","@simplewebauthn/browser":"14.0.0","@simplewebauthn/server":"14.0.1","drizzle-orm":"1.0.0-rc.5-ab785fc","effect":"4.0.0-rc.112","effect-cf":"0.40.0","openid-client":"6.8.8","tldts":"7.4.11","typescript":"7.0.2","vite-plus":"0.3.0"},"peerDependencies":{"@effect/sql-d1":">=4.0.0-rc.112","@effect/sql-libsql":">=4.0.0-rc.112","@effect/sql-mysql2":">=4.0.0-rc.112","@effect/sql-pg":">=4.0.0-rc.112","@effect/sql-pglite":">=4.0.0-rc.112","@effect/sql-sqlite-bun":">=4.0.0-rc.112","@effect/sql-sqlite-do":">=4.0.0-rc.112","@effect/sql-sqlite-node":">=4.0.0-rc.112","@effect/sql-sqlite-wasm":">=4.0.0-rc.112","@simplewebauthn/browser":">=14.0.0 <15","@simplewebauthn/server":">=14.0.1 <15","drizzle-orm":">=1.0.0-rc.5-ab785fc","effect":"^4.0.0-rc.112","effect-cf":"^0.40.0","openid-client":">=6.8.8 <7","tldts":">=7.4.11 <8"},"exports":{".":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"./Auth":{"types":"./dist/Auth.d.mts","default":"./dist/Auth.mjs"},"./Drizzle":{"types":"./dist/Drizzle.d.mts","default":"./dist/Drizzle.mjs"},"./DrizzleD1":{"types":"./dist/DrizzleD1.d.mts","default":"./dist/DrizzleD1.mjs"},"./DrizzleLibsql":{"types":"./dist/DrizzleLibsql.d.mts","default":"./dist/DrizzleLibsql.mjs"},"./DrizzleMysql2":{"types":"./dist/DrizzleMysql2.d.mts","default":"./dist/DrizzleMysql2.mjs"},"./DrizzlePglite":{"types":"./dist/DrizzlePglite.d.mts","default":"./dist/DrizzlePglite.mjs"},"./DrizzlePostgres":{"types":"./dist/DrizzlePostgres.d.mts","default":"./dist/DrizzlePostgres.mjs"},"./DrizzleSqliteBun":{"types":"./dist/DrizzleSqliteBun.d.mts","default":"./dist/DrizzleSqliteBun.mjs"},"./DrizzleSqliteDo":{"types":"./dist/DrizzleSqliteDo.d.mts","default":"./dist/DrizzleSqliteDo.mjs"},"./DrizzleSqliteNode":{"types":"./dist/DrizzleSqliteNode.d.mts","default":"./dist/DrizzleSqliteNode.mjs"},"./DrizzleSqliteWasm":{"types":"./dist/DrizzleSqliteWasm.d.mts","default":"./dist/DrizzleSqliteWasm.mjs"},"./Cloudflare":{"types":"./dist/Cloudflare.d.mts","default":"./dist/Cloudflare.mjs"},"./Http":{"types":"./dist/Http.d.mts","default":"./dist/Http.mjs"},"./HttpServer":{"types":"./dist/HttpServer.d.mts","default":"./dist/HttpServer.mjs"},"./OperationHttp":{"types":"./dist/OperationHttp.d.mts","default":"./dist/OperationHttp.mjs"},"./OperationHttpClient":{"types":"./dist/OperationHttpClient.d.mts","default":"./dist/OperationHttpClient.mjs"},"./OperationHttpServer":{"types":"./dist/OperationHttpServer.d.mts","default":"./dist/OperationHttpServer.mjs"},"./Atom":{"types":"./dist/Atom.d.mts","default":"./dist/Atom.mjs"},"./Hooks":{"types":"./dist/Hooks.d.mts","default":"./dist/Hooks.mjs"},"./Identity":{"types":"./dist/Identity.d.mts","default":"./dist/Identity.mjs"},"./OAuth":{"types":"./dist/OAuth.d.mts","default":"./dist/OAuth.mjs"},"./Operations":{"types":"./dist/Operations.d.mts","default":"./dist/Operations.mjs"},"./Rpc":{"types":"./dist/Rpc.d.mts","default":"./dist/Rpc.mjs"},"./Schema":{"types":"./dist/Schema.d.mts","default":"./dist/Schema.mjs"},"./Testing":{"types":"./dist/Testing.d.mts","default":"./dist/Testing.mjs"},"./WebCrypto":{"types":"./dist/WebCrypto.d.mts","default":"./dist/WebCrypto.mjs"},"./Sessions":{"types":"./dist/Sessions.d.mts","default":"./dist/Sessions.mjs"},"./SessionContract":{"types":"./dist/SessionContract.d.mts","default":"./dist/SessionContract.mjs"},"./Proofs":{"types":"./dist/Proofs.d.mts","default":"./dist/Proofs.mjs"},"./Password":{"types":"./dist/Password.d.mts","default":"./dist/Password.mjs"},"./Email":{"types":"./dist/Email.d.mts","default":"./dist/Email.mjs"},"./OpenIdClient":{"types":"./dist/OpenIdClient.d.mts","default":"./dist/OpenIdClient.mjs"},"./OpenIdClientConnected":{"types":"./dist/OpenIdClientConnected.d.mts","default":"./dist/OpenIdClientConnected.mjs"},"./Passkey":{"types":"./dist/Passkey.d.mts","default":"./dist/Passkey.mjs"},"./PasskeyPassword":{"types":"./dist/PasskeyPassword.d.mts","default":"./dist/PasskeyPassword.mjs"},"./PasskeySimpleWebAuthn":{"types":"./dist/PasskeySimpleWebAuthn.d.mts","default":"./dist/PasskeySimpleWebAuthn.mjs"},"./PasskeyBrowser":{"types":"./dist/PasskeyBrowser.d.mts","default":"./dist/PasskeyBrowser.mjs"},"./GitHub":{"types":"./dist/GitHub.d.mts","default":"./dist/GitHub.mjs"},"./AuthSession":{"types":"./dist/AuthSession.d.mts","default":"./dist/AuthSession.mjs"},"./Errors":{"types":"./dist/Errors.d.mts","default":"./dist/Errors.mjs"},"./Workflows":{"types":"./dist/Workflows.d.mts","default":"./dist/Workflows.mjs"},"./PasswordHasher":{"types":"./dist/PasswordHasher.d.mts","default":"./dist/PasswordHasher.mjs"},"./EmailOtp":{"types":"./dist/EmailOtp.d.mts","default":"./dist/EmailOtp.mjs"},"./AuthStore":{"types":"./dist/AuthStore.d.mts","default":"./dist/AuthStore.mjs"},"./PasswordAuth":{"types":"./dist/PasswordAuth.d.mts","default":"./dist/PasswordAuth.mjs"},"./Policy":{"types":"./dist/Policy.d.mts","default":"./dist/Policy.mjs"},"./EmailOtpSender":{"types":"./dist/EmailOtpSender.d.mts","default":"./dist/EmailOtpSender.mjs"},"./AuthTokenCodec":{"types":"./dist/AuthTokenCodec.d.mts","default":"./dist/AuthTokenCodec.mjs"},"./IdentityResolver":{"types":"./dist/IdentityResolver.d.mts","default":"./dist/IdentityResolver.mjs"},"./PasswordCredentialStore":{"types":"./dist/PasswordCredentialStore.d.mts","default":"./dist/PasswordCredentialStore.mjs"},"./PhoneOtp":{"types":"./dist/PhoneOtp.d.mts","default":"./dist/PhoneOtp.mjs"},"./Totp":{"types":"./dist/Totp.d.mts","default":"./dist/Totp.mjs"},"./PasskeyContract":{"types":"./dist/PasskeyContract.d.mts","default":"./dist/PasskeyContract.mjs"},"./TotpContract":{"types":"./dist/TotpContract.d.mts","default":"./dist/TotpContract.mjs"},"./AuthContract":{"types":"./dist/AuthContract.d.mts","default":"./dist/AuthContract.mjs"},"./Client":{"types":"./dist/Client.d.mts","default":"./dist/Client.mjs"}},"description":"Composable authentication, sessions, and identity workflows for Effect.","keywords":["authentication","effect","oauth","passkeys","sessions","typescript"],"homepage":"https://yielded.dev/auth/","bugs":{"url":"https://github.com/yielded-dev/auth/issues"},"license":"MIT","repository":{"type":"git","url":"git+https://github.com/yielded-dev/auth.git","directory":"packages/effect-auth"},"files":["dist","src"],"type":"module","sideEffects":[],"publishConfig":{"access":"public"},"scripts":{"build":"vp pack","check":"tsc --noEmit -p tsconfig.json","test":"vp test --passWithNoTests","e2e":"bun test/e2e/harness.ts","example:totp":"bun test/fixtures/totp-sqlite-bun.ts"},"peerDependenciesMeta":{"@effect/sql-d1":{"optional":true},"@effect/sql-libsql":{"optional":true},"@effect/sql-mysql2":{"optional":true},"@effect/sql-pg":{"optional":true},"@effect/sql-pglite":{"optional":true},"@effect/sql-sqlite-bun":{"optional":true},"@effect/sql-sqlite-do":{"optional":true},"@effect/sql-sqlite-node":{"optional":true},"@effect/sql-sqlite-wasm":{"optional":true},"@simplewebauthn/browser":{"optional":true},"@simplewebauthn/server":{"optional":true},"drizzle-orm":{"optional":true},"effect-cf":{"optional":true},"openid-client":{"optional":true},"tldts":{"optional":true}}}
+{"name":"@yielded/auth","version":"0.1.0-beta.3","dependencies":{"@noble/ciphers":"2.1.1","@noble/hashes":"2.3.0"},"devDependencies":{"@cloudflare/workers-types":"5.20260825.1","@effect/platform-bun":"4.0.0-rc.112","@effect/platform-node":"4.0.0-rc.112","@effect/sql-d1":"4.0.0-rc.112","@effect/sql-libsql":"4.0.0-rc.112","@effect/sql-mysql2":"4.0.0-rc.112","@effect/sql-pg":"4.0.0-rc.112","@effect/sql-pglite":"4.0.0-rc.112","@effect/sql-sqlite-bun":"4.0.0-rc.112","@effect/sql-sqlite-do":"4.0.0-rc.112","@effect/sql-sqlite-node":"4.0.0-rc.112","@effect/sql-sqlite-wasm":"4.0.0-rc.112","@effect/vitest":"4.0.0-rc.112","@simplewebauthn/browser":"14.0.0","@simplewebauthn/server":"14.0.1","drizzle-orm":"1.0.0-rc.5-ab785fc","effect":"4.0.0-rc.112","effect-cf":"0.40.0","openid-client":"6.8.8","tldts":"7.4.11","typescript":"7.0.2","vite-plus":"0.3.0"},"peerDependencies":{"@effect/sql-d1":">=4.0.0-rc.112","@effect/sql-libsql":">=4.0.0-rc.112","@effect/sql-mysql2":">=4.0.0-rc.112","@effect/sql-pg":">=4.0.0-rc.112","@effect/sql-pglite":">=4.0.0-rc.112","@effect/sql-sqlite-bun":">=4.0.0-rc.112","@effect/sql-sqlite-do":">=4.0.0-rc.112","@effect/sql-sqlite-node":">=4.0.0-rc.112","@effect/sql-sqlite-wasm":">=4.0.0-rc.112","@simplewebauthn/browser":">=14.0.0 <15","@simplewebauthn/server":">=14.0.1 <15","drizzle-orm":">=1.0.0-rc.5-ab785fc","effect":"^4.0.0-rc.112","effect-cf":"^0.40.0","openid-client":">=6.8.8 <7","tldts":">=7.4.11 <8"},"exports":{".":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"./Auth":{"types":"./dist/Auth.d.mts","default":"./dist/Auth.mjs"},"./Drizzle":{"types":"./dist/Drizzle.d.mts","default":"./dist/Drizzle.mjs"},"./DrizzleD1":{"types":"./dist/DrizzleD1.d.mts","default":"./dist/DrizzleD1.mjs"},"./DrizzleLibsql":{"types":"./dist/DrizzleLibsql.d.mts","default":"./dist/DrizzleLibsql.mjs"},"./DrizzleMysql2":{"types":"./dist/DrizzleMysql2.d.mts","default":"./dist/DrizzleMysql2.mjs"},"./DrizzlePglite":{"types":"./dist/DrizzlePglite.d.mts","default":"./dist/DrizzlePglite.mjs"},"./DrizzlePostgres":{"types":"./dist/DrizzlePostgres.d.mts","default":"./dist/DrizzlePostgres.mjs"},"./DrizzleSqliteBun":{"types":"./dist/DrizzleSqliteBun.d.mts","default":"./dist/DrizzleSqliteBun.mjs"},"./DrizzleSqliteDo":{"types":"./dist/DrizzleSqliteDo.d.mts","default":"./dist/DrizzleSqliteDo.mjs"},"./DrizzleSqliteNode":{"types":"./dist/DrizzleSqliteNode.d.mts","default":"./dist/DrizzleSqliteNode.mjs"},"./DrizzleSqliteWasm":{"types":"./dist/DrizzleSqliteWasm.d.mts","default":"./dist/DrizzleSqliteWasm.mjs"},"./Cloudflare":{"types":"./dist/Cloudflare.d.mts","default":"./dist/Cloudflare.mjs"},"./Http":{"types":"./dist/Http.d.mts","default":"./dist/Http.mjs"},"./HttpServer":{"types":"./dist/HttpServer.d.mts","default":"./dist/HttpServer.mjs"},"./OperationHttp":{"types":"./dist/OperationHttp.d.mts","default":"./dist/OperationHttp.mjs"},"./OperationHttpClient":{"types":"./dist/OperationHttpClient.d.mts","default":"./dist/OperationHttpClient.mjs"},"./OperationHttpServer":{"types":"./dist/OperationHttpServer.d.mts","default":"./dist/OperationHttpServer.mjs"},"./Atom":{"types":"./dist/Atom.d.mts","default":"./dist/Atom.mjs"},"./Hooks":{"types":"./dist/Hooks.d.mts","default":"./dist/Hooks.mjs"},"./Identity":{"types":"./dist/Identity.d.mts","default":"./dist/Identity.mjs"},"./OAuth":{"types":"./dist/OAuth.d.mts","default":"./dist/OAuth.mjs"},"./Operations":{"types":"./dist/Operations.d.mts","default":"./dist/Operations.mjs"},"./Rpc":{"types":"./dist/Rpc.d.mts","default":"./dist/Rpc.mjs"},"./Schema":{"types":"./dist/Schema.d.mts","default":"./dist/Schema.mjs"},"./Testing":{"types":"./dist/Testing.d.mts","default":"./dist/Testing.mjs"},"./WebCrypto":{"types":"./dist/WebCrypto.d.mts","default":"./dist/WebCrypto.mjs"},"./Sessions":{"types":"./dist/Sessions.d.mts","default":"./dist/Sessions.mjs"},"./SessionContract":{"types":"./dist/SessionContract.d.mts","default":"./dist/SessionContract.mjs"},"./Proofs":{"types":"./dist/Proofs.d.mts","default":"./dist/Proofs.mjs"},"./Password":{"types":"./dist/Password.d.mts","default":"./dist/Password.mjs"},"./Email":{"types":"./dist/Email.d.mts","default":"./dist/Email.mjs"},"./OpenIdClient":{"types":"./dist/OpenIdClient.d.mts","default":"./dist/OpenIdClient.mjs"},"./OpenIdClientConnected":{"types":"./dist/OpenIdClientConnected.d.mts","default":"./dist/OpenIdClientConnected.mjs"},"./Passkey":{"types":"./dist/Passkey.d.mts","default":"./dist/Passkey.mjs"},"./PasskeyPassword":{"types":"./dist/PasskeyPassword.d.mts","default":"./dist/PasskeyPassword.mjs"},"./PasskeySimpleWebAuthn":{"types":"./dist/PasskeySimpleWebAuthn.d.mts","default":"./dist/PasskeySimpleWebAuthn.mjs"},"./PasskeyBrowser":{"types":"./dist/PasskeyBrowser.d.mts","default":"./dist/PasskeyBrowser.mjs"},"./GitHub":{"types":"./dist/GitHub.d.mts","default":"./dist/GitHub.mjs"},"./AuthSession":{"types":"./dist/AuthSession.d.mts","default":"./dist/AuthSession.mjs"},"./Errors":{"types":"./dist/Errors.d.mts","default":"./dist/Errors.mjs"},"./Workflows":{"types":"./dist/Workflows.d.mts","default":"./dist/Workflows.mjs"},"./PasswordHasher":{"types":"./dist/PasswordHasher.d.mts","default":"./dist/PasswordHasher.mjs"},"./EmailOtp":{"types":"./dist/EmailOtp.d.mts","default":"./dist/EmailOtp.mjs"},"./AuthStore":{"types":"./dist/AuthStore.d.mts","default":"./dist/AuthStore.mjs"},"./PasswordAuth":{"types":"./dist/PasswordAuth.d.mts","default":"./dist/PasswordAuth.mjs"},"./Policy":{"types":"./dist/Policy.d.mts","default":"./dist/Policy.mjs"},"./EmailOtpSender":{"types":"./dist/EmailOtpSender.d.mts","default":"./dist/EmailOtpSender.mjs"},"./AuthTokenCodec":{"types":"./dist/AuthTokenCodec.d.mts","default":"./dist/AuthTokenCodec.mjs"},"./IdentityResolver":{"types":"./dist/IdentityResolver.d.mts","default":"./dist/IdentityResolver.mjs"},"./PasswordCredentialStore":{"types":"./dist/PasswordCredentialStore.d.mts","default":"./dist/PasswordCredentialStore.mjs"},"./PhoneOtp":{"types":"./dist/PhoneOtp.d.mts","default":"./dist/PhoneOtp.mjs"},"./Totp":{"types":"./dist/Totp.d.mts","default":"./dist/Totp.mjs"},"./PasskeyContract":{"types":"./dist/PasskeyContract.d.mts","default":"./dist/PasskeyContract.mjs"},"./TotpContract":{"types":"./dist/TotpContract.d.mts","default":"./dist/TotpContract.mjs"},"./AuthContract":{"types":"./dist/AuthContract.d.mts","default":"./dist/AuthContract.mjs"},"./Client":{"types":"./dist/Client.d.mts","default":"./dist/Client.mjs"}},"description":"Composable authentication, sessions, and identity workflows for Effect.","keywords":["authentication","effect","oauth","passkeys","sessions","typescript"],"homepage":"https://yielded.dev/auth/","bugs":{"url":"https://github.com/yielded-dev/auth/issues"},"license":"MIT","repository":{"type":"git","url":"git+https://github.com/yielded-dev/auth.git","directory":"packages/effect-auth"},"files":["dist","src"],"type":"module","sideEffects":[],"publishConfig":{"access":"public"},"scripts":{"build":"vp pack","check":"tsc --noEmit -p tsconfig.json","test":"vp test --passWithNoTests","e2e":"bun test/e2e/harness.ts","example:totp":"bun test/fixtures/totp-sqlite-bun.ts"},"peerDependenciesMeta":{"@effect/sql-d1":{"optional":true},"@effect/sql-libsql":{"optional":true},"@effect/sql-mysql2":{"optional":true},"@effect/sql-pg":{"optional":true},"@effect/sql-pglite":{"optional":true},"@effect/sql-sqlite-bun":{"optional":true},"@effect/sql-sqlite-do":{"optional":true},"@effect/sql-sqlite-node":{"optional":true},"@effect/sql-sqlite-wasm":{"optional":true},"@simplewebauthn/browser":{"optional":true},"@simplewebauthn/server":{"optional":true},"drizzle-orm":{"optional":true},"effect-cf":{"optional":true},"openid-client":{"optional":true},"tldts":{"optional":true}}}