@yielded/auth 0.1.0-beta.3 → 0.1.0-beta.5

package/dist/oauth/definition.d.mts

@@ -22,7 +22,7 @@ import { ModuleService } from "../sessions/module.mjs";
 import "../Identity.mjs";
 import { OAuthRegistrationAccess, OAuthRegistrationInspection, OAuthRegistrationIntent, OAuthRegistrationPolicy } from "./registrationModels.mjs";
 import { OAuthConfigurationError, OAuthMethodUnsupported, OAuthRejected, OAuthUnavailable } from "./signInErrors.mjs";
-import { OAuthCleanupInput, OAuthCredentialSnapshot, OAuthSignInPolicy } from "./signInModels.mjs";
+import { OAuthCleanupInput, OAuthCredentialSnapshot, OAuthSignInPolicy, OAuthVerifiedExternalIdentity } from "./signInModels.mjs";
 import { OAuthSignInPersistence, PrepareOAuthCommit } from "./OAuthSignInPersistence.mjs";
 import { OAuthAccountsPolicy, OAuthActionRequired } from "./accountsModels.mjs";
 import { OAuthConnectedActionRequired, OAuthConnectedBusy, OAuthConnectedPolicy, OAuthConnectedReauthorizationRequired } from "./connectedModels.mjs";
@@ -77,7 +77,7 @@ declare const bindDefine: <const Namespace extends string | undefined, Claims ex
     layer: Layer.Layer<BindingModule<Id, "oauth-entry">, RequestBindingConfigurationError, import("effect/Crypto").Crypto | RequestBindingConfig | SubtleCrypto>;
   }>;
   ClaimsForOAuth: import("effect/Context").Service<OAuthModule<Id, "claims", Claims["Type"]>, {
-    readonly resolve: (credential: OAuthCredentialSnapshot) => import("effect/Effect").Effect<Claims["Type"], OAuthUnavailable, never>;
+    readonly resolve: (credential: OAuthCredentialSnapshot, verified: OAuthVerifiedExternalIdentity) => import("effect/Effect").Effect<Claims["Type"], OAuthUnavailable, never>;
   }>;
   SignIn: import("effect/Context").Service<OAuthModule<Id, "sign-in", Claims["Type"]>, {
     readonly begin: (input: {
@@ -904,6 +904,13 @@ declare const bindDefine: <const Namespace extends string | undefined, Claims ex
           readonly profile?: {
             readonly displayName?: string | undefined;
             readonly handle?: string | undefined;
+            readonly avatarUrl?: string | undefined;
+            readonly profileUrl?: string | undefined;
+            readonly email?: string | undefined;
+            readonly emailVerified?: boolean | undefined;
+            readonly providerData?: {
+              readonly [x: string]: import("effect/Schema").Json;
+            } | undefined;
           } | undefined;
           readonly remoteRevocation: "Confirmed" | "Pending" | "Unknown" | "Unsupported";
         }[];
@@ -1047,6 +1054,11 @@ declare const bindDefine: <const Namespace extends string | undefined, Claims ex
           readonly profile: import("effect/Schema").optionalKey<import("effect/Schema").Struct<{
             readonly displayName: import("effect/Schema").optionalKey<import("effect/Schema").String>;
             readonly handle: import("effect/Schema").optionalKey<import("effect/Schema").String>;
+            readonly avatarUrl: import("effect/Schema").optionalKey<import("effect/Schema").String>;
+            readonly profileUrl: import("effect/Schema").optionalKey<import("effect/Schema").String>;
+            readonly email: import("effect/Schema").optionalKey<import("effect/Schema").String>;
+            readonly emailVerified: import("effect/Schema").optionalKey<import("effect/Schema").Boolean>;
+            readonly providerData: import("effect/Schema").optionalKey<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Codec<import("effect/Schema").Json, import("effect/Schema").Json, never, never>>>;
           }>>;
           readonly remoteRevocation: import("effect/Schema").Literals<readonly ["Pending", "Confirmed", "Unsupported", "Unknown"]>;
         }>>;
@@ -1069,6 +1081,11 @@ declare const bindDefine: <const Namespace extends string | undefined, Claims ex
             readonly profile: import("effect/Schema").optionalKey<import("effect/Schema").Struct<{
               readonly displayName: import("effect/Schema").optionalKey<import("effect/Schema").String>;
               readonly handle: import("effect/Schema").optionalKey<import("effect/Schema").String>;
+              readonly avatarUrl: import("effect/Schema").optionalKey<import("effect/Schema").String>;
+              readonly profileUrl: import("effect/Schema").optionalKey<import("effect/Schema").String>;
+              readonly email: import("effect/Schema").optionalKey<import("effect/Schema").String>;
+              readonly emailVerified: import("effect/Schema").optionalKey<import("effect/Schema").Boolean>;
+              readonly providerData: import("effect/Schema").optionalKey<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Codec<import("effect/Schema").Json, import("effect/Schema").Json, never, never>>>;
             }>>;
             readonly remoteRevocation: import("effect/Schema").Literals<readonly ["Pending", "Confirmed", "Unsupported", "Unknown"]>;
           }>>;
@@ -1179,6 +1196,13 @@ declare const bindDefine: <const Namespace extends string | undefined, Claims ex
         readonly profile?: {
           readonly displayName?: string | undefined;
           readonly handle?: string | undefined;
+          readonly avatarUrl?: string | undefined;
+          readonly profileUrl?: string | undefined;
+          readonly email?: string | undefined;
+          readonly emailVerified?: boolean | undefined;
+          readonly providerData?: {
+            readonly [x: string]: import("effect/Schema").Json;
+          } | undefined;
         } | undefined;
         readonly remoteRevocation: "Confirmed" | "Pending" | "Unknown" | "Unsupported";
       }[];
@@ -1250,6 +1274,11 @@ declare const bindDefine: <const Namespace extends string | undefined, Claims ex
         readonly profile: import("effect/Schema").optionalKey<import("effect/Schema").Struct<{
           readonly displayName: import("effect/Schema").optionalKey<import("effect/Schema").String>;
           readonly handle: import("effect/Schema").optionalKey<import("effect/Schema").String>;
+          readonly avatarUrl: import("effect/Schema").optionalKey<import("effect/Schema").String>;
+          readonly profileUrl: import("effect/Schema").optionalKey<import("effect/Schema").String>;
+          readonly email: import("effect/Schema").optionalKey<import("effect/Schema").String>;
+          readonly emailVerified: import("effect/Schema").optionalKey<import("effect/Schema").Boolean>;
+          readonly providerData: import("effect/Schema").optionalKey<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Codec<import("effect/Schema").Json, import("effect/Schema").Json, never, never>>>;
         }>>;
         readonly remoteRevocation: import("effect/Schema").Literals<readonly ["Pending", "Confirmed", "Unsupported", "Unknown"]>;
       }>>;
@@ -1323,6 +1352,13 @@ declare const bindDefine: <const Namespace extends string | undefined, Claims ex
             readonly profile?: {
               readonly displayName?: string | undefined;
               readonly handle?: string | undefined;
+              readonly avatarUrl?: string | undefined;
+              readonly profileUrl?: string | undefined;
+              readonly email?: string | undefined;
+              readonly emailVerified?: boolean | undefined;
+              readonly providerData?: {
+                readonly [x: string]: import("effect/Schema").Json;
+              } | undefined;
             } | undefined;
             readonly remoteRevocation: "Confirmed" | "Pending" | "Unknown" | "Unsupported";
           }[];
@@ -1683,7 +1719,7 @@ declare const bindDefineRegistration: <Registration extends ClaimsCodec, const N
     layer: Layer.Layer<BindingModule<Id, "oauth-entry">, RequestBindingConfigurationError, import("effect/Crypto").Crypto | RequestBindingConfig | SubtleCrypto>;
   }>;
   ClaimsForOAuth: import("effect/Context").Service<OAuthModule<Id, "claims", Claims["Type"]>, {
-    readonly resolve: (credential: OAuthCredentialSnapshot) => import("effect/Effect").Effect<Claims["Type"], OAuthUnavailable, never>;
+    readonly resolve: (credential: OAuthCredentialSnapshot, verified: OAuthVerifiedExternalIdentity) => import("effect/Effect").Effect<Claims["Type"], OAuthUnavailable, never>;
   }>;
   SignIn: import("effect/Context").Service<OAuthModule<Id, "sign-in", Claims["Type"]>, {
     readonly begin: (input: {
@@ -2358,6 +2394,13 @@ declare const bindDefineRegistration: <Registration extends ClaimsCodec, const N
           readonly profile?: {
             readonly displayName?: string | undefined;
             readonly handle?: string | undefined;
+            readonly avatarUrl?: string | undefined;
+            readonly profileUrl?: string | undefined;
+            readonly email?: string | undefined;
+            readonly emailVerified?: boolean | undefined;
+            readonly providerData?: {
+              readonly [x: string]: import("effect/Schema").Json;
+            } | undefined;
           } | undefined;
           readonly remoteRevocation: "Confirmed" | "Pending" | "Unknown" | "Unsupported";
         }[];
@@ -2501,6 +2544,11 @@ declare const bindDefineRegistration: <Registration extends ClaimsCodec, const N
           readonly profile: import("effect/Schema").optionalKey<import("effect/Schema").Struct<{
             readonly displayName: import("effect/Schema").optionalKey<import("effect/Schema").String>;
             readonly handle: import("effect/Schema").optionalKey<import("effect/Schema").String>;
+            readonly avatarUrl: import("effect/Schema").optionalKey<import("effect/Schema").String>;
+            readonly profileUrl: import("effect/Schema").optionalKey<import("effect/Schema").String>;
+            readonly email: import("effect/Schema").optionalKey<import("effect/Schema").String>;
+            readonly emailVerified: import("effect/Schema").optionalKey<import("effect/Schema").Boolean>;
+            readonly providerData: import("effect/Schema").optionalKey<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Codec<import("effect/Schema").Json, import("effect/Schema").Json, never, never>>>;
           }>>;
           readonly remoteRevocation: import("effect/Schema").Literals<readonly ["Pending", "Confirmed", "Unsupported", "Unknown"]>;
         }>>;
@@ -2523,6 +2571,11 @@ declare const bindDefineRegistration: <Registration extends ClaimsCodec, const N
             readonly profile: import("effect/Schema").optionalKey<import("effect/Schema").Struct<{
               readonly displayName: import("effect/Schema").optionalKey<import("effect/Schema").String>;
               readonly handle: import("effect/Schema").optionalKey<import("effect/Schema").String>;
+              readonly avatarUrl: import("effect/Schema").optionalKey<import("effect/Schema").String>;
+              readonly profileUrl: import("effect/Schema").optionalKey<import("effect/Schema").String>;
+              readonly email: import("effect/Schema").optionalKey<import("effect/Schema").String>;
+              readonly emailVerified: import("effect/Schema").optionalKey<import("effect/Schema").Boolean>;
+              readonly providerData: import("effect/Schema").optionalKey<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Codec<import("effect/Schema").Json, import("effect/Schema").Json, never, never>>>;
             }>>;
             readonly remoteRevocation: import("effect/Schema").Literals<readonly ["Pending", "Confirmed", "Unsupported", "Unknown"]>;
           }>>;
@@ -2633,6 +2686,13 @@ declare const bindDefineRegistration: <Registration extends ClaimsCodec, const N
         readonly profile?: {
           readonly displayName?: string | undefined;
           readonly handle?: string | undefined;
+          readonly avatarUrl?: string | undefined;
+          readonly profileUrl?: string | undefined;
+          readonly email?: string | undefined;
+          readonly emailVerified?: boolean | undefined;
+          readonly providerData?: {
+            readonly [x: string]: import("effect/Schema").Json;
+          } | undefined;
         } | undefined;
         readonly remoteRevocation: "Confirmed" | "Pending" | "Unknown" | "Unsupported";
       }[];
@@ -2704,6 +2764,11 @@ declare const bindDefineRegistration: <Registration extends ClaimsCodec, const N
         readonly profile: import("effect/Schema").optionalKey<import("effect/Schema").Struct<{
           readonly displayName: import("effect/Schema").optionalKey<import("effect/Schema").String>;
           readonly handle: import("effect/Schema").optionalKey<import("effect/Schema").String>;
+          readonly avatarUrl: import("effect/Schema").optionalKey<import("effect/Schema").String>;
+          readonly profileUrl: import("effect/Schema").optionalKey<import("effect/Schema").String>;
+          readonly email: import("effect/Schema").optionalKey<import("effect/Schema").String>;
+          readonly emailVerified: import("effect/Schema").optionalKey<import("effect/Schema").Boolean>;
+          readonly providerData: import("effect/Schema").optionalKey<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Codec<import("effect/Schema").Json, import("effect/Schema").Json, never, never>>>;
         }>>;
         readonly remoteRevocation: import("effect/Schema").Literals<readonly ["Pending", "Confirmed", "Unsupported", "Unknown"]>;
       }>>;
@@ -2777,6 +2842,13 @@ declare const bindDefineRegistration: <Registration extends ClaimsCodec, const N
             readonly profile?: {
               readonly displayName?: string | undefined;
               readonly handle?: string | undefined;
+              readonly avatarUrl?: string | undefined;
+              readonly profileUrl?: string | undefined;
+              readonly email?: string | undefined;
+              readonly emailVerified?: boolean | undefined;
+              readonly providerData?: {
+                readonly [x: string]: import("effect/Schema").Json;
+              } | undefined;
             } | undefined;
             readonly remoteRevocation: "Confirmed" | "Pending" | "Unknown" | "Unsupported";
           }[];
@@ -3945,6 +4017,13 @@ declare const bindDefineConnected: <const Namespace extends string | undefined,
         readonly profile?: {
           readonly displayName?: string | undefined;
           readonly handle?: string | undefined;
+          readonly avatarUrl?: string | undefined;
+          readonly profileUrl?: string | undefined;
+          readonly email?: string | undefined;
+          readonly emailVerified?: boolean | undefined;
+          readonly providerData?: {
+            readonly [x: string]: import("effect/Schema").Json;
+          } | undefined;
         } | undefined;
         readonly remoteRevocation: "Confirmed" | "Pending" | "Unknown" | "Unsupported";
       }[];
@@ -4088,6 +4167,11 @@ declare const bindDefineConnected: <const Namespace extends string | undefined,
         readonly profile: import("effect/Schema").optionalKey<import("effect/Schema").Struct<{
           readonly displayName: import("effect/Schema").optionalKey<import("effect/Schema").String>;
           readonly handle: import("effect/Schema").optionalKey<import("effect/Schema").String>;
+          readonly avatarUrl: import("effect/Schema").optionalKey<import("effect/Schema").String>;
+          readonly profileUrl: import("effect/Schema").optionalKey<import("effect/Schema").String>;
+          readonly email: import("effect/Schema").optionalKey<import("effect/Schema").String>;
+          readonly emailVerified: import("effect/Schema").optionalKey<import("effect/Schema").Boolean>;
+          readonly providerData: import("effect/Schema").optionalKey<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Codec<import("effect/Schema").Json, import("effect/Schema").Json, never, never>>>;
         }>>;
         readonly remoteRevocation: import("effect/Schema").Literals<readonly ["Pending", "Confirmed", "Unsupported", "Unknown"]>;
       }>>;
@@ -4110,6 +4194,11 @@ declare const bindDefineConnected: <const Namespace extends string | undefined,
           readonly profile: import("effect/Schema").optionalKey<import("effect/Schema").Struct<{
             readonly displayName: import("effect/Schema").optionalKey<import("effect/Schema").String>;
             readonly handle: import("effect/Schema").optionalKey<import("effect/Schema").String>;
+            readonly avatarUrl: import("effect/Schema").optionalKey<import("effect/Schema").String>;
+            readonly profileUrl: import("effect/Schema").optionalKey<import("effect/Schema").String>;
+            readonly email: import("effect/Schema").optionalKey<import("effect/Schema").String>;
+            readonly emailVerified: import("effect/Schema").optionalKey<import("effect/Schema").Boolean>;
+            readonly providerData: import("effect/Schema").optionalKey<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Codec<import("effect/Schema").Json, import("effect/Schema").Json, never, never>>>;
           }>>;
           readonly remoteRevocation: import("effect/Schema").Literals<readonly ["Pending", "Confirmed", "Unsupported", "Unknown"]>;
         }>>;
@@ -4220,6 +4309,13 @@ declare const bindDefineConnected: <const Namespace extends string | undefined,
       readonly profile?: {
         readonly displayName?: string | undefined;
         readonly handle?: string | undefined;
+        readonly avatarUrl?: string | undefined;
+        readonly profileUrl?: string | undefined;
+        readonly email?: string | undefined;
+        readonly emailVerified?: boolean | undefined;
+        readonly providerData?: {
+          readonly [x: string]: import("effect/Schema").Json;
+        } | undefined;
       } | undefined;
       readonly remoteRevocation: "Confirmed" | "Pending" | "Unknown" | "Unsupported";
     }[];
@@ -4291,6 +4387,11 @@ declare const bindDefineConnected: <const Namespace extends string | undefined,
       readonly profile: import("effect/Schema").optionalKey<import("effect/Schema").Struct<{
         readonly displayName: import("effect/Schema").optionalKey<import("effect/Schema").String>;
         readonly handle: import("effect/Schema").optionalKey<import("effect/Schema").String>;
+        readonly avatarUrl: import("effect/Schema").optionalKey<import("effect/Schema").String>;
+        readonly profileUrl: import("effect/Schema").optionalKey<import("effect/Schema").String>;
+        readonly email: import("effect/Schema").optionalKey<import("effect/Schema").String>;
+        readonly emailVerified: import("effect/Schema").optionalKey<import("effect/Schema").Boolean>;
+        readonly providerData: import("effect/Schema").optionalKey<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Codec<import("effect/Schema").Json, import("effect/Schema").Json, never, never>>>;
       }>>;
       readonly remoteRevocation: import("effect/Schema").Literals<readonly ["Pending", "Confirmed", "Unsupported", "Unknown"]>;
     }>>;
@@ -4364,6 +4465,13 @@ declare const bindDefineConnected: <const Namespace extends string | undefined,
           readonly profile?: {
             readonly displayName?: string | undefined;
             readonly handle?: string | undefined;
+            readonly avatarUrl?: string | undefined;
+            readonly profileUrl?: string | undefined;
+            readonly email?: string | undefined;
+            readonly emailVerified?: boolean | undefined;
+            readonly providerData?: {
+              readonly [x: string]: import("effect/Schema").Json;
+            } | undefined;
           } | undefined;
           readonly remoteRevocation: "Confirmed" | "Pending" | "Unknown" | "Unsupported";
         }[];

package/dist/oauth/github/identity.mjs

@@ -1,21 +1,23 @@
 import { OAuthProviderKey } from "../schema.mjs";
 import { OAuthProtocolRejected } from "../signInErrors.mjs";
+import { GitHubUserProfile } from "./profile.mjs";
 import { Effect, Schema } from "effect";
 //#region src/oauth/github/identity.ts
 const gitHubOAuthAppProviderKey = OAuthProviderKey.make("github");
-const identity = Schema.Struct({
-	id: Schema.Int.check(Schema.isBetween({
-		minimum: 1,
-		maximum: Number.MAX_SAFE_INTEGER
-	})),
-	login: Schema.optionalKey(Schema.NonEmptyString.check(Schema.isMaxLength(256)))
-});
-const decode = Schema.decodeUnknownEffect(identity);
+const decode = Schema.decodeUnknownEffect(GitHubUserProfile);
 const decodeGitHubIdentity = Effect.fn("GitHubOAuthApp.decodeIdentity")(function* (body) {
 	const value = yield* decode(body).pipe(Effect.mapError(() => OAuthProtocolRejected.make({})));
+	const displayName = value.name?.trim() || value.login;
 	return {
 		subject: String(value.id),
-		...value.login === void 0 ? {} : { profile: { displayName: value.login } }
+		profile: {
+			...displayName === void 0 ? {} : { displayName },
+			...value.login === void 0 ? {} : { handle: value.login },
+			...value.avatar_url === void 0 ? {} : { avatarUrl: value.avatar_url },
+			...value.html_url === void 0 ? {} : { profileUrl: value.html_url },
+			...value.email === null || value.email === void 0 ? {} : { email: value.email },
+			providerData: value
+		}
 	};
 });
 //#endregion

package/dist/oauth/github/identity.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"identity.mjs","names":[],"sources":["../../../src/oauth/github/identity.ts"],"sourcesContent":["import { Effect, Schema } from \"effect\";\n\nimport type { PlainOAuthIdentity } from \"../openid-client/models\";\nimport { OAuthProviderKey } from \"../schema\";\nimport { OAuthProtocolRejected } from \"../signInErrors\";\n\nexport const gitHubOAuthAppProviderKey = OAuthProviderKey.make(\"github\");\n\nconst identity = Schema.Struct({\n  id: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: Number.MAX_SAFE_INTEGER })),\n  login: Schema.optionalKey(Schema.NonEmptyString.check(Schema.isMaxLength(256))),\n});\n\n// oxlint-disable-next-line no-restricted-properties -- GitHub /user is an untyped, freshly authenticated JSON boundary.\nconst decode = Schema.decodeUnknownEffect(identity);\n\nexport const decodeGitHubIdentity = Effect.fn(\"GitHubOAuthApp.decodeIdentity\")(function* (\n  body: unknown,\n): Effect.fn.Return<PlainOAuthIdentity, OAuthProtocolRejected> {\n  const value = yield* decode(body).pipe(Effect.mapError(() => OAuthProtocolRejected.make({})));\n\n  return {\n    subject: String(value.id),\n    ...(value.login === undefined ? {} : { profile: { displayName: value.login } }),\n  };\n});\n"],"mappings":";;;;AAMA,MAAa,4BAA4B,iBAAiB,KAAK,QAAQ;AAEvE,MAAM,WAAW,OAAO,OAAO;CAC7B,IAAI,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS,OAAO;CAAiB,CAAC,CAAC;CACvF,OAAO,OAAO,YAAY,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC;AAChF,CAAC;AAGD,MAAM,SAAS,OAAO,oBAAoB,QAAQ;AAElD,MAAa,uBAAuB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAC7E,MAC6D;CAC7D,MAAM,QAAQ,OAAO,OAAO,IAAI,CAAC,CAAC,KAAK,OAAO,eAAe,sBAAsB,KAAK,CAAC,CAAC,CAAC,CAAC;CAE5F,OAAO;EACL,SAAS,OAAO,MAAM,EAAE;EACxB,GAAI,MAAM,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,EAAE,aAAa,MAAM,MAAM,EAAE;CAC/E;AACF,CAAC"}
+{"version":3,"file":"identity.mjs","names":[],"sources":["../../../src/oauth/github/identity.ts"],"sourcesContent":["import { Effect, Schema } from \"effect\";\n\nimport type { PlainOAuthIdentity } from \"../openid-client/models\";\nimport { OAuthProviderKey } from \"../schema\";\nimport { OAuthProtocolRejected } from \"../signInErrors\";\nimport { GitHubUserProfile } from \"./profile\";\n\nexport const gitHubOAuthAppProviderKey = OAuthProviderKey.make(\"github\");\n\n// oxlint-disable-next-line no-restricted-properties -- GitHub /user is an untyped, freshly authenticated JSON boundary.\nconst decode = Schema.decodeUnknownEffect(GitHubUserProfile);\n\nexport const decodeGitHubIdentity = Effect.fn(\"GitHubOAuthApp.decodeIdentity\")(function* (\n  body: unknown,\n): Effect.fn.Return<PlainOAuthIdentity, OAuthProtocolRejected> {\n  const value = yield* decode(body).pipe(Effect.mapError(() => OAuthProtocolRejected.make({})));\n  const displayName = value.name?.trim() || value.login;\n\n  return {\n    subject: String(value.id),\n    profile: {\n      ...(displayName === undefined ? {} : { displayName }),\n      ...(value.login === undefined ? {} : { handle: value.login }),\n      ...(value.avatar_url === undefined ? {} : { avatarUrl: value.avatar_url }),\n      ...(value.html_url === undefined ? {} : { profileUrl: value.html_url }),\n      ...(value.email === null || value.email === undefined ? {} : { email: value.email }),\n      providerData: value,\n    },\n  };\n});\n"],"mappings":";;;;;AAOA,MAAa,4BAA4B,iBAAiB,KAAK,QAAQ;AAGvE,MAAM,SAAS,OAAO,oBAAoB,iBAAiB;AAE3D,MAAa,uBAAuB,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAC7E,MAC6D;CAC7D,MAAM,QAAQ,OAAO,OAAO,IAAI,CAAC,CAAC,KAAK,OAAO,eAAe,sBAAsB,KAAK,CAAC,CAAC,CAAC,CAAC;CAC5F,MAAM,cAAc,MAAM,MAAM,KAAK,KAAK,MAAM;CAEhD,OAAO;EACL,SAAS,OAAO,MAAM,EAAE;EACxB,SAAS;GACP,GAAI,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY;GACnD,GAAI,MAAM,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,MAAM;GAC3D,GAAI,MAAM,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,MAAM,WAAW;GACxE,GAAI,MAAM,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY,MAAM,SAAS;GACrE,GAAI,MAAM,UAAU,QAAQ,MAAM,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;GAClF,cAAc;EAChB;CACF;AACF,CAAC"}

package/dist/oauth/github/profile.d.mts

@@ -0,0 +1,61 @@
+import { Schema } from "effect";
+//#region src/oauth/github/profile.d.ts
+/** All documented GitHub /user fields, with provider spelling and nulls retained.
+ * Only the numeric ID establishes identity. Other fields are optional because
+ * availability differs by permission and provider response. This does not fetch
+ * repositories, email lists, or any additional endpoint. Unknown fields are omitted.
+ * URLs are metadata, not approved redirect or server-fetch targets. */
+declare const GitHubUserProfile: Schema.Struct<{
+  readonly id: Schema.Int;
+  readonly login: Schema.optionalKey<Schema.NonEmptyString>;
+  readonly name: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+  readonly user_view_type: Schema.optionalKey<Schema.String>;
+  readonly node_id: Schema.optionalKey<Schema.String>;
+  readonly avatar_url: Schema.optionalKey<Schema.String>;
+  readonly gravatar_id: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+  readonly url: Schema.optionalKey<Schema.String>;
+  readonly html_url: Schema.optionalKey<Schema.String>;
+  readonly followers_url: Schema.optionalKey<Schema.String>;
+  readonly following_url: Schema.optionalKey<Schema.String>;
+  readonly gists_url: Schema.optionalKey<Schema.String>;
+  readonly starred_url: Schema.optionalKey<Schema.String>;
+  readonly subscriptions_url: Schema.optionalKey<Schema.String>;
+  readonly organizations_url: Schema.optionalKey<Schema.String>;
+  readonly repos_url: Schema.optionalKey<Schema.String>;
+  readonly events_url: Schema.optionalKey<Schema.String>;
+  readonly received_events_url: Schema.optionalKey<Schema.String>;
+  readonly type: Schema.optionalKey<Schema.String>;
+  readonly site_admin: Schema.optionalKey<Schema.Boolean>;
+  readonly company: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+  readonly blog: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+  readonly location: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+  readonly email: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+  readonly notification_email: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+  readonly hireable: Schema.optionalKey<Schema.NullOr<Schema.Boolean>>;
+  readonly bio: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+  readonly twitter_username: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+  readonly public_repos: Schema.optionalKey<Schema.Int>;
+  readonly public_gists: Schema.optionalKey<Schema.Int>;
+  readonly followers: Schema.optionalKey<Schema.Int>;
+  readonly following: Schema.optionalKey<Schema.Int>;
+  readonly created_at: Schema.optionalKey<Schema.String>;
+  readonly updated_at: Schema.optionalKey<Schema.String>;
+  readonly private_gists: Schema.optionalKey<Schema.Int>;
+  readonly total_private_repos: Schema.optionalKey<Schema.Int>;
+  readonly owned_private_repos: Schema.optionalKey<Schema.Int>;
+  readonly disk_usage: Schema.optionalKey<Schema.Int>;
+  readonly collaborators: Schema.optionalKey<Schema.Int>;
+  readonly two_factor_authentication: Schema.optionalKey<Schema.Boolean>;
+  readonly plan: Schema.optionalKey<Schema.Struct<{
+    readonly collaborators: Schema.Int;
+    readonly name: Schema.String;
+    readonly space: Schema.Int;
+    readonly private_repos: Schema.Int;
+  }>>;
+  readonly business_plus: Schema.optionalKey<Schema.Boolean>;
+  readonly ldap_dn: Schema.optionalKey<Schema.String>;
+}>;
+type GitHubUserProfile = typeof GitHubUserProfile.Type;
+//#endregion
+export { GitHubUserProfile };
+//# sourceMappingURL=profile.d.mts.map

package/dist/oauth/github/profile.mjs

@@ -0,0 +1,72 @@
+import { Schema } from "effect";
+//#region src/oauth/github/profile.ts
+const text = Schema.String.check(Schema.isMaxLength(2048));
+const name = Schema.String.check(Schema.isMaxLength(256));
+const count = Schema.Int.check(Schema.isBetween({
+	minimum: 0,
+	maximum: Number.MAX_SAFE_INTEGER
+}));
+const optionalText = Schema.optionalKey(text);
+const nullableText = Schema.optionalKey(Schema.NullOr(text));
+/** All documented GitHub /user fields, with provider spelling and nulls retained.
+* Only the numeric ID establishes identity. Other fields are optional because
+* availability differs by permission and provider response. This does not fetch
+* repositories, email lists, or any additional endpoint. Unknown fields are omitted.
+* URLs are metadata, not approved redirect or server-fetch targets. */
+const GitHubUserProfile = Schema.Struct({
+	id: Schema.Int.check(Schema.isBetween({
+		minimum: 1,
+		maximum: Number.MAX_SAFE_INTEGER
+	})),
+	login: Schema.optionalKey(Schema.NonEmptyString.check(Schema.isMaxLength(256))),
+	name: Schema.optionalKey(Schema.NullOr(name)),
+	user_view_type: optionalText,
+	node_id: optionalText,
+	avatar_url: optionalText,
+	gravatar_id: nullableText,
+	url: optionalText,
+	html_url: optionalText,
+	followers_url: optionalText,
+	following_url: optionalText,
+	gists_url: optionalText,
+	starred_url: optionalText,
+	subscriptions_url: optionalText,
+	organizations_url: optionalText,
+	repos_url: optionalText,
+	events_url: optionalText,
+	received_events_url: optionalText,
+	type: optionalText,
+	site_admin: Schema.optionalKey(Schema.Boolean),
+	company: nullableText,
+	blog: nullableText,
+	location: nullableText,
+	email: Schema.optionalKey(Schema.NullOr(Schema.String.check(Schema.isMaxLength(320)))),
+	notification_email: Schema.optionalKey(Schema.NullOr(Schema.String.check(Schema.isMaxLength(320)))),
+	hireable: Schema.optionalKey(Schema.NullOr(Schema.Boolean)),
+	bio: nullableText,
+	twitter_username: nullableText,
+	public_repos: Schema.optionalKey(count),
+	public_gists: Schema.optionalKey(count),
+	followers: Schema.optionalKey(count),
+	following: Schema.optionalKey(count),
+	created_at: optionalText,
+	updated_at: optionalText,
+	private_gists: Schema.optionalKey(count),
+	total_private_repos: Schema.optionalKey(count),
+	owned_private_repos: Schema.optionalKey(count),
+	disk_usage: Schema.optionalKey(count),
+	collaborators: Schema.optionalKey(count),
+	two_factor_authentication: Schema.optionalKey(Schema.Boolean),
+	plan: Schema.optionalKey(Schema.Struct({
+		collaborators: count,
+		name: text,
+		space: count,
+		private_repos: count
+	})),
+	business_plus: Schema.optionalKey(Schema.Boolean),
+	ldap_dn: optionalText
+});
+//#endregion
+export { GitHubUserProfile };
+
+//# sourceMappingURL=profile.mjs.map

package/dist/oauth/github/profile.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.mjs","names":[],"sources":["../../../src/oauth/github/profile.ts"],"sourcesContent":["import { Schema } from \"effect\";\n\nconst text = Schema.String.check(Schema.isMaxLength(2048));\nconst name = Schema.String.check(Schema.isMaxLength(256));\nconst count = Schema.Int.check(Schema.isBetween({ minimum: 0, maximum: Number.MAX_SAFE_INTEGER }));\nconst optionalText = Schema.optionalKey(text);\nconst nullableText = Schema.optionalKey(Schema.NullOr(text));\n\n/** All documented GitHub /user fields, with provider spelling and nulls retained.\n * Only the numeric ID establishes identity. Other fields are optional because\n * availability differs by permission and provider response. This does not fetch\n * repositories, email lists, or any additional endpoint. Unknown fields are omitted.\n * URLs are metadata, not approved redirect or server-fetch targets. */\nexport const GitHubUserProfile = Schema.Struct({\n  id: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: Number.MAX_SAFE_INTEGER })),\n  login: Schema.optionalKey(Schema.NonEmptyString.check(Schema.isMaxLength(256))),\n  name: Schema.optionalKey(Schema.NullOr(name)),\n  user_view_type: optionalText,\n  node_id: optionalText,\n  avatar_url: optionalText,\n  gravatar_id: nullableText,\n  url: optionalText,\n  html_url: optionalText,\n  followers_url: optionalText,\n  following_url: optionalText,\n  gists_url: optionalText,\n  starred_url: optionalText,\n  subscriptions_url: optionalText,\n  organizations_url: optionalText,\n  repos_url: optionalText,\n  events_url: optionalText,\n  received_events_url: optionalText,\n  type: optionalText,\n  site_admin: Schema.optionalKey(Schema.Boolean),\n  company: nullableText,\n  blog: nullableText,\n  location: nullableText,\n  email: Schema.optionalKey(Schema.NullOr(Schema.String.check(Schema.isMaxLength(320)))),\n  notification_email: Schema.optionalKey(\n    Schema.NullOr(Schema.String.check(Schema.isMaxLength(320))),\n  ),\n  hireable: Schema.optionalKey(Schema.NullOr(Schema.Boolean)),\n  bio: nullableText,\n  twitter_username: nullableText,\n  public_repos: Schema.optionalKey(count),\n  public_gists: Schema.optionalKey(count),\n  followers: Schema.optionalKey(count),\n  following: Schema.optionalKey(count),\n  created_at: optionalText,\n  updated_at: optionalText,\n  private_gists: Schema.optionalKey(count),\n  total_private_repos: Schema.optionalKey(count),\n  owned_private_repos: Schema.optionalKey(count),\n  disk_usage: Schema.optionalKey(count),\n  collaborators: Schema.optionalKey(count),\n  two_factor_authentication: Schema.optionalKey(Schema.Boolean),\n  plan: Schema.optionalKey(\n    Schema.Struct({ collaborators: count, name: text, space: count, private_repos: count }),\n  ),\n  business_plus: Schema.optionalKey(Schema.Boolean),\n  ldap_dn: optionalText,\n});\n\nexport type GitHubUserProfile = typeof GitHubUserProfile.Type;\n"],"mappings":";;AAEA,MAAM,OAAO,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC;AACzD,MAAM,OAAO,OAAO,OAAO,MAAM,OAAO,YAAY,GAAG,CAAC;AACxD,MAAM,QAAQ,OAAO,IAAI,MAAM,OAAO,UAAU;CAAE,SAAS;CAAG,SAAS,OAAO;AAAiB,CAAC,CAAC;AACjG,MAAM,eAAe,OAAO,YAAY,IAAI;AAC5C,MAAM,eAAe,OAAO,YAAY,OAAO,OAAO,IAAI,CAAC;;;;;;AAO3D,MAAa,oBAAoB,OAAO,OAAO;CAC7C,IAAI,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS,OAAO;CAAiB,CAAC,CAAC;CACvF,OAAO,OAAO,YAAY,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC;CAC9E,MAAM,OAAO,YAAY,OAAO,OAAO,IAAI,CAAC;CAC5C,gBAAgB;CAChB,SAAS;CACT,YAAY;CACZ,aAAa;CACb,KAAK;CACL,UAAU;CACV,eAAe;CACf,eAAe;CACf,WAAW;CACX,aAAa;CACb,mBAAmB;CACnB,mBAAmB;CACnB,WAAW;CACX,YAAY;CACZ,qBAAqB;CACrB,MAAM;CACN,YAAY,OAAO,YAAY,OAAO,OAAO;CAC7C,SAAS;CACT,MAAM;CACN,UAAU;CACV,OAAO,OAAO,YAAY,OAAO,OAAO,OAAO,OAAO,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC,CAAC;CACrF,oBAAoB,OAAO,YACzB,OAAO,OAAO,OAAO,OAAO,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC,CAC5D;CACA,UAAU,OAAO,YAAY,OAAO,OAAO,OAAO,OAAO,CAAC;CAC1D,KAAK;CACL,kBAAkB;CAClB,cAAc,OAAO,YAAY,KAAK;CACtC,cAAc,OAAO,YAAY,KAAK;CACtC,WAAW,OAAO,YAAY,KAAK;CACnC,WAAW,OAAO,YAAY,KAAK;CACnC,YAAY;CACZ,YAAY;CACZ,eAAe,OAAO,YAAY,KAAK;CACvC,qBAAqB,OAAO,YAAY,KAAK;CAC7C,qBAAqB,OAAO,YAAY,KAAK;CAC7C,YAAY,OAAO,YAAY,KAAK;CACpC,eAAe,OAAO,YAAY,KAAK;CACvC,2BAA2B,OAAO,YAAY,OAAO,OAAO;CAC5D,MAAM,OAAO,YACX,OAAO,OAAO;EAAE,eAAe;EAAO,MAAM;EAAM,OAAO;EAAO,eAAe;CAAM,CAAC,CACxF;CACA,eAAe,OAAO,YAAY,OAAO,OAAO;CAChD,SAAS;AACX,CAAC"}

package/dist/oauth/github/protocol.mjs

@@ -15,7 +15,7 @@ import { Effect, Encoding, Layer, Predicate, Redacted, Schema } from "effect";
 //#region src/oauth/github/protocol.ts
 const unavailable = () => OAuthUnavailable.make({});
 const invalid = () => OpenIdClientConfigurationError.make({ reason: "provider" });
-const issuer = OAuthIssuer.make("https://github.com");
+const issuer = OAuthIssuer.make("https://github.com/login/oauth");
 const headers = Object.freeze({
 	Accept: "application/vnd.github+json",
 	"User-Agent": "effect-auth-github-oauth-app",
@@ -61,7 +61,7 @@ const provider = (registration) => ({
 	issuance: registration.issuance,
 	issuer,
 	protocol: "oauth",
-	responseIssuerMode: "unsupported",
+	responseIssuerMode: "required",
 	clientId: registration.clientId,
 	authentication: {
 		method: "client_secret_post",

package/dist/oauth/github/protocol.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"protocol.mjs","names":[],"sources":["../../../src/oauth/github/protocol.ts"],"sourcesContent":["import { Effect, Encoding, Layer, Predicate, Redacted, Schema } from \"effect\";\nimport type { CustomFetch } from \"openid-client\";\n\nimport { OAuthConnectedProfile } from \"../connectedModels\";\nimport { OAuthConnectedProtocol } from \"../OAuthConnectedProtocol\";\nimport { OAuthProtocol } from \"../OAuthProtocol\";\nimport {\n  DefiniteTokenRejection,\n  tokenCompatibility,\n  type ConnectedCompatibility,\n} from \"../openid-client/compatibility\";\nimport { makeConnectedProtocolWithCompatibility } from \"../openid-client/connected/protocol\";\nimport {\n  OpenIdClientConfigurationError,\n  type OpenIdClientOAuthProvider,\n} from \"../openid-client/models\";\nimport { makeOpenIdClientOAuthProtocol } from \"../openid-client/protocol\";\nimport { ProviderRevocation } from \"../openid-client/ProviderRevocation\";\nimport { boundedFetch } from \"../openid-client/transport\";\nimport { OAuthUnavailable } from \"../signInErrors\";\nimport { OAuthCallbackId, OAuthGeneration, OAuthIssuer, OAuthRedirectUri } from \"../signInModels\";\nimport { snapshotOAuthSync } from \"../signInSnapshot\";\nimport { decodeGitHubIdentity, gitHubOAuthAppProviderKey } from \"./identity\";\nimport type {\n  GitHubOAuthAppConnectedProtocolOptions,\n  GitHubOAuthAppGeneration,\n  GitHubOAuthAppProtocolOptions,\n} from \"./models\";\n\nconst unavailable = () => OAuthUnavailable.make({});\nconst invalid = () => OpenIdClientConfigurationError.make({ reason: \"provider\" });\nconst issuer = OAuthIssuer.make(\"https://github.com\");\n\nconst headers = Object.freeze({\n  Accept: \"application/vnd.github+json\",\n  \"User-Agent\": \"effect-auth-github-oauth-app\",\n  \"X-GitHub-Api-Version\": \"2026-03-10\",\n});\n\nconst generation = Schema.Struct({\n  configurationGeneration: OAuthGeneration,\n  issuance: Schema.Literals([\"active\", \"retired\"]),\n  clientId: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9._-]{1,256}$/)),\n  clientSecret: Schema.RedactedFromValue(Schema.NonEmptyString.check(Schema.isMaxLength(4096))),\n  callbacks: Schema.Array(\n    Schema.Struct({ callbackId: OAuthCallbackId, redirectUri: OAuthRedirectUri }),\n  ).check(Schema.isMinLength(1), Schema.isMaxLength(16)),\n});\n\nconst generations = Schema.Array(generation).check(Schema.isMinLength(1), Schema.isMaxLength(64));\n\nconst connectedGenerations = Schema.Array(\n  Schema.Struct({\n    ...generation.fields,\n    profiles: Schema.Array(OAuthConnectedProfile).check(\n      Schema.isMinLength(1),\n      Schema.isMaxLength(64),\n    ),\n  }),\n).check(Schema.isMinLength(1), Schema.isMaxLength(64));\n\nconst timeout = Schema.Finite.check(Schema.isBetween({ minimum: 1, maximum: 30 }));\nconst isTimeout = Schema.is(timeout);\n\nconst capture = <S extends Schema.Codec<unknown, unknown, never, never>>(\n  schema: S,\n  registrations: S[\"Type\"],\n  options: {\n    readonly timeoutSeconds: number;\n    readonly fetch?: GitHubOAuthAppProtocolOptions[\"fetch\"];\n  },\n) =>\n  Effect.try({\n    try: () => {\n      const result = snapshotOAuthSync(schema, registrations);\n      const fetch = options.fetch;\n      const timeoutSeconds = options.timeoutSeconds;\n\n      if (!isTimeout(timeoutSeconds) || (fetch !== undefined && !Predicate.isFunction(fetch)))\n        throw invalid();\n\n      return { registrations: result, timeoutSeconds, ...(fetch === undefined ? {} : { fetch }) };\n    },\n    catch: invalid,\n  });\n\nconst provider = (\n  registration: GitHubOAuthAppGeneration,\n): Omit<OpenIdClientOAuthProvider, \"scopes\"> => ({\n  provider: gitHubOAuthAppProviderKey,\n  configurationGeneration: registration.configurationGeneration,\n  issuance: registration.issuance,\n  issuer,\n  protocol: \"oauth\",\n  responseIssuerMode: \"unsupported\",\n  clientId: registration.clientId,\n  authentication: { method: \"client_secret_post\", secret: registration.clientSecret },\n  callbacks: registration.callbacks,\n  authorizationEndpoint: \"https://github.com/login/oauth/authorize\",\n  tokenEndpoint: \"https://github.com/login/oauth/access_token\",\n  pkceS256: true,\n  identitySource: {\n    url: \"https://api.github.com/user\",\n    headers,\n    decodeIdentity: decodeGitHubIdentity,\n  },\n});\n\nconst csvCell = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_:-]{1,256}$/));\nconst isCell = Schema.is(csvCell);\n\n/** GitHub's receipt is comma-delimited, unlike the generic OAuth scope string. */\nconst scopes = (\n  receipt: string | undefined,\n  expected: ReadonlyArray<string>,\n): ReadonlyArray<string> => {\n  if (receipt === undefined || receipt.length > 16447) throw unavailable();\n\n  const result =\n    receipt === \"\" ? [] : receipt.split(\",\").map((cell) => cell.replace(/^[ \\t]+|[ \\t]+$/g, \"\"));\n\n  if (\n    result.length > 64 ||\n    result.some((cell) => !isCell(cell)) ||\n    new Set(result).size !== result.length ||\n    result.length !== expected.length ||\n    result.some((cell) => !expected.includes(cell))\n  )\n    throw unavailable();\n\n  return result;\n};\n\nconst token = Schema.NonEmptyString.check(Schema.isMaxLength(16384));\nconst expiry = Schema.Finite.check(Schema.isGreaterThan(0));\n\nconst receiptSchema = Schema.Struct({\n  access_token: token,\n  token_type: Schema.String.check(Schema.isPattern(/^[Bb][Ee][Aa][Rr][Ee][Rr]$/)),\n  scope: Schema.String.check(Schema.isMaxLength(16447)),\n  expires_in: Schema.optionalKey(expiry),\n  refresh_token: Schema.optionalKey(token),\n  refresh_token_expires_in: Schema.optionalKey(expiry),\n});\n\n// oxlint-disable-next-line no-restricted-properties -- Inspect the bounded raw receipt before the maintained parser can coerce expiry fields.\nconst decodeReceipt = Schema.decodeUnknownSync(receiptSchema);\n\nconst encodeRevocation = Schema.encodeSync(\n  Schema.fromJsonString(Schema.Struct({ access_token: token })),\n);\n\nconst terminalReceipt = Schema.Struct({\n  error: Schema.NonEmptyString.check(Schema.isMaxLength(128)),\n  error_description: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(4096))),\n  error_uri: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(2048))),\n});\n\n// oxlint-disable-next-line no-restricted-properties -- Fully validate the raw terminal receipt before classifying a provider rejection.\nconst decodeTerminalReceipt = Schema.decodeUnknownSync(terminalReceipt);\n\nconst successKeys = [\n  \"access_token\",\n  \"token_type\",\n  \"scope\",\n  \"expires_in\",\n  \"refresh_token\",\n  \"refresh_token_expires_in\",\n  \"id_token\",\n];\n\nconst compatibility: ConnectedCompatibility = Object.freeze<ConnectedCompatibility>({\n  inspectReceipt: ({ body, status, contentType }, input) => {\n    if (contentType?.split(\";\", 1)[0]?.trim().toLowerCase() !== \"application/json\")\n      throw unavailable();\n    if (!Predicate.isObject(body)) throw unavailable();\n    if (Object.hasOwn(body, \"error\")) {\n      if (successKeys.some((key) => Object.hasOwn(body, key))) throw unavailable();\n      const terminal = decodeTerminalReceipt(body);\n\n      if (\n        (status === 200 || status === 400) &&\n        terminal.error ===\n          (input.operation === \"authorization_code\" ? \"bad_verification_code\" : \"bad_refresh_token\")\n      ) {\n        throw new DefiniteTokenRejection();\n      }\n      throw unavailable();\n    }\n    if (\n      status !== 200 ||\n      [\"error_description\", \"error_uri\", \"id_token\"].some((key) => Object.hasOwn(body, key))\n    )\n      throw unavailable();\n    const receipt = decodeReceipt(body);\n\n    scopes(receipt.scope, input.scopes);\n    if (\n      input.refreshRequired &&\n      (receipt.refresh_token === undefined ||\n        receipt.expires_in === undefined ||\n        receipt.refresh_token_expires_in === undefined)\n    )\n      throw unavailable();\n  },\n  authorizationScopes: (permissions, refresh) =>\n    refresh ? [...permissions, \"offline_access\"] : permissions,\n  decodeScopes: scopes,\n  includeRefreshScope: false,\n});\n\nconst revocationLayer = (\n  options: Pick<GitHubOAuthAppConnectedProtocolOptions, \"fetch\" | \"timeoutSeconds\">,\n) => {\n  const fetch: CustomFetch =\n    options.fetch ??\n    ((url, init) =>\n      globalThis.fetch(url, {\n        ...init,\n        body: init.body instanceof Uint8Array ? new Uint8Array(init.body) : init.body,\n      }));\n\n  const timeoutSeconds = options.timeoutSeconds;\n\n  return Layer.succeed(\n    ProviderRevocation,\n    ProviderRevocation.of({\n      revoke: Effect.fn(\"GitHubOAuthApp.revoke\")(function* (input) {\n        yield* Effect.tryPromise({\n          try: async (effectSignal) => {\n            if (\n              input.authentication.method !== \"client_secret_post\" ||\n              input.context.configuration.profile.clientRegistrationId !== input.clientId ||\n              input.context.identity.provider !== gitHubOAuthAppProviderKey ||\n              input.context.identity.issuer !== issuer\n            )\n              throw unavailable();\n            const url = `https://api.github.com/applications/${encodeURIComponent(input.clientId)}/grant`;\n\n            const signal = AbortSignal.any([\n              effectSignal,\n              AbortSignal.timeout(Math.ceil(timeoutSeconds * 1000)),\n            ]);\n\n            const transport = boundedFetch(fetch, signal, new Set([url]));\n\n            const response = await transport(url, {\n              method: \"DELETE\",\n              redirect: \"manual\",\n              headers: {\n                ...headers,\n                \"Content-Type\": \"application/json\",\n                Authorization: `Basic ${Encoding.encodeBase64(`${input.clientId}:${Redacted.value(input.authentication.secret)}`)}`,\n              },\n              body: encodeRevocation({ access_token: Redacted.value(input.material.accessToken) }),\n              signal,\n            });\n\n            signal.throwIfAborted();\n            if (response.status !== 204) throw unavailable();\n          },\n          catch: unavailable,\n        });\n      }),\n    }),\n  );\n};\n\n/** A GitHub.com OAuth App generation for the same provider list as generic OIDC.\n * Retains GitHub receipt/error rules and requests read:user, with no repository access.\n * Construction performs no I/O; invalid configuration throws the typed configuration error. */\nexport const gitHubOAuthAppProvider = (\n  registration: GitHubOAuthAppGeneration,\n): OpenIdClientOAuthProvider => {\n  let saved: GitHubOAuthAppGeneration;\n\n  try {\n    saved = snapshotOAuthSync(generation, registration);\n  } catch {\n    throw invalid();\n  }\n\n  return {\n    ...provider(saved),\n    scopes: [\"read:user\"],\n    [tokenCompatibility]: compatibility,\n  };\n};\n\nexport const makeGitHubOAuthAppProtocol = Effect.fn(\"makeGitHubOAuthAppProtocol\")(function* (\n  options: GitHubOAuthAppProtocolOptions,\n) {\n  const saved = yield* capture(generations, options.registrations, options);\n\n  if (saved.registrations.filter((item) => item.issuance === \"active\").length !== 1)\n    return yield* invalid();\n\n  return yield* makeOpenIdClientOAuthProtocol({\n    ...saved,\n    providers: saved.registrations.map(gitHubOAuthAppProvider),\n  });\n});\n\nexport const makeGitHubOAuthAppConnectedProtocol = Effect.fn(\"makeGitHubOAuthAppConnectedProtocol\")(\n  function* (options: GitHubOAuthAppConnectedProtocolOptions) {\n    const saved = yield* capture(connectedGenerations, options.registrations, options);\n\n    if (saved.registrations.filter((item) => item.issuance === \"active\").length !== 1)\n      return yield* invalid();\n    for (const registration of saved.registrations) {\n      for (const profile of registration.profiles) {\n        if (\n          profile.provider !== gitHubOAuthAppProviderKey ||\n          profile.clientRegistrationId !== registration.clientId ||\n          profile.resources.length !== 0 ||\n          profile.scopes.some((scope) => scope === \"offline_access\" || !isCell(scope)) ||\n          (profile.retention === \"access-only\"\n            ? profile.refresh !== \"unsupported\" ||\n              profile.maximumRefreshLifetimeMillis !== undefined\n            : profile.refresh !== \"rotating\" || profile.maximumRefreshLifetimeMillis === undefined)\n        )\n          return yield* invalid();\n      }\n    }\n\n    return yield* makeConnectedProtocolWithCompatibility(\n      {\n        ...saved,\n        providers: saved.registrations.map((item) => ({\n          ...provider(item),\n          profiles: item.profiles,\n          clientRegistrationId: item.clientId,\n          resourceIndicators: \"unsupported\",\n          refreshExpiry: { field: \"refresh_token_expires_in\", zero: \"expired\" },\n          revocation: { mode: \"provider-cohort\" },\n        })),\n      },\n      compatibility,\n    ).pipe(Effect.provide(revocationLayer(saved)));\n  },\n);\n\nexport const gitHubOAuthAppProtocolLayer = (options: GitHubOAuthAppProtocolOptions) =>\n  Layer.effect(OAuthProtocol, makeGitHubOAuthAppProtocol(options));\n\nexport const gitHubOAuthAppConnectedProtocolLayer = (\n  options: GitHubOAuthAppConnectedProtocolOptions,\n) => Layer.effect(OAuthConnectedProtocol, makeGitHubOAuthAppConnectedProtocol(options));\n"],"mappings":";;;;;;;;;;;;;;;AA6BA,MAAM,oBAAoB,iBAAiB,KAAK,CAAC,CAAC;AAClD,MAAM,gBAAgB,+BAA+B,KAAK,EAAE,QAAQ,WAAW,CAAC;AAChF,MAAM,SAAS,YAAY,KAAK,oBAAoB;AAEpD,MAAM,UAAU,OAAO,OAAO;CAC5B,QAAQ;CACR,cAAc;CACd,wBAAwB;AAC1B,CAAC;AAED,MAAM,aAAa,OAAO,OAAO;CAC/B,yBAAyB;CACzB,UAAU,OAAO,SAAS,CAAC,UAAU,SAAS,CAAC;CAC/C,UAAU,OAAO,OAAO,MAAM,OAAO,UAAU,yBAAyB,CAAC;CACzE,cAAc,OAAO,kBAAkB,OAAO,eAAe,MAAM,OAAO,YAAY,IAAI,CAAC,CAAC;CAC5F,WAAW,OAAO,MAChB,OAAO,OAAO;EAAE,YAAY;EAAiB,aAAa;CAAiB,CAAC,CAC9E,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,EAAE,CAAC;AACvD,CAAC;AAED,MAAM,cAAc,OAAO,MAAM,UAAU,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,EAAE,CAAC;AAEhG,MAAM,uBAAuB,OAAO,MAClC,OAAO,OAAO;CACZ,GAAG,WAAW;CACd,UAAU,OAAO,MAAM,qBAAqB,CAAC,CAAC,MAC5C,OAAO,YAAY,CAAC,GACpB,OAAO,YAAY,EAAE,CACvB;AACF,CAAC,CACH,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,EAAE,CAAC;AAErD,MAAM,UAAU,OAAO,OAAO,MAAM,OAAO,UAAU;CAAE,SAAS;CAAG,SAAS;AAAG,CAAC,CAAC;AACjF,MAAM,YAAY,OAAO,GAAG,OAAO;AAEnC,MAAM,WACJ,QACA,eACA,YAKA,OAAO,IAAI;CACT,WAAW;EACT,MAAM,SAAS,kBAAkB,QAAQ,aAAa;EACtD,MAAM,QAAQ,QAAQ;EACtB,MAAM,iBAAiB,QAAQ;EAE/B,IAAI,CAAC,UAAU,cAAc,KAAM,UAAU,KAAA,KAAa,CAAC,UAAU,WAAW,KAAK,GACnF,MAAM,QAAQ;EAEhB,OAAO;GAAE,eAAe;GAAQ;GAAgB,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;EAAG;CAC5F;CACA,OAAO;AACT,CAAC;AAEH,MAAM,YACJ,kBAC+C;CAC/C,UAAU;CACV,yBAAyB,aAAa;CACtC,UAAU,aAAa;CACvB;CACA,UAAU;CACV,oBAAoB;CACpB,UAAU,aAAa;CACvB,gBAAgB;EAAE,QAAQ;EAAsB,QAAQ,aAAa;CAAa;CAClF,WAAW,aAAa;CACxB,uBAAuB;CACvB,eAAe;CACf,UAAU;CACV,gBAAgB;EACd,KAAK;EACL;EACA,gBAAgB;CAClB;AACF;AAEA,MAAM,UAAU,OAAO,OAAO,MAAM,OAAO,UAAU,yBAAyB,CAAC;AAC/E,MAAM,SAAS,OAAO,GAAG,OAAO;;AAGhC,MAAM,UACJ,SACA,aAC0B;CAC1B,IAAI,YAAY,KAAA,KAAa,QAAQ,SAAS,OAAO,MAAM,YAAY;CAEvE,MAAM,SACJ,YAAY,KAAK,CAAC,IAAI,QAAQ,MAAM,GAAG,CAAC,CAAC,KAAK,SAAS,KAAK,QAAQ,oBAAoB,EAAE,CAAC;CAE7F,IACE,OAAO,SAAS,MAChB,OAAO,MAAM,SAAS,CAAC,OAAO,IAAI,CAAC,KACnC,IAAI,IAAI,MAAM,CAAC,CAAC,SAAS,OAAO,UAChC,OAAO,WAAW,SAAS,UAC3B,OAAO,MAAM,SAAS,CAAC,SAAS,SAAS,IAAI,CAAC,GAE9C,MAAM,YAAY;CAEpB,OAAO;AACT;AAEA,MAAM,QAAQ,OAAO,eAAe,MAAM,OAAO,YAAY,KAAK,CAAC;AACnE,MAAM,SAAS,OAAO,OAAO,MAAM,OAAO,cAAc,CAAC,CAAC;AAE1D,MAAM,gBAAgB,OAAO,OAAO;CAClC,cAAc;CACd,YAAY,OAAO,OAAO,MAAM,OAAO,UAAU,4BAA4B,CAAC;CAC9E,OAAO,OAAO,OAAO,MAAM,OAAO,YAAY,KAAK,CAAC;CACpD,YAAY,OAAO,YAAY,MAAM;CACrC,eAAe,OAAO,YAAY,KAAK;CACvC,0BAA0B,OAAO,YAAY,MAAM;AACrD,CAAC;AAGD,MAAM,gBAAgB,OAAO,kBAAkB,aAAa;AAE5D,MAAM,mBAAmB,OAAO,WAC9B,OAAO,eAAe,OAAO,OAAO,EAAE,cAAc,MAAM,CAAC,CAAC,CAC9D;AAEA,MAAM,kBAAkB,OAAO,OAAO;CACpC,OAAO,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC;CAC1D,mBAAmB,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC,CAAC;CACnF,WAAW,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC,CAAC;AAC7E,CAAC;AAGD,MAAM,wBAAwB,OAAO,kBAAkB,eAAe;AAEtE,MAAM,cAAc;CAClB;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAEA,MAAM,gBAAwC,OAAO,OAA+B;CAClF,iBAAiB,EAAE,MAAM,QAAQ,eAAe,UAAU;EACxD,IAAI,aAAa,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,YAAY,MAAM,oBAC1D,MAAM,YAAY;EACpB,IAAI,CAAC,UAAU,SAAS,IAAI,GAAG,MAAM,YAAY;EACjD,IAAI,OAAO,OAAO,MAAM,OAAO,GAAG;GAChC,IAAI,YAAY,MAAM,QAAQ,OAAO,OAAO,MAAM,GAAG,CAAC,GAAG,MAAM,YAAY;GAC3E,MAAM,WAAW,sBAAsB,IAAI;GAE3C,KACG,WAAW,OAAO,WAAW,QAC9B,SAAS,WACN,MAAM,cAAc,uBAAuB,0BAA0B,sBAExE,MAAM,IAAI,uBAAuB;GAEnC,MAAM,YAAY;EACpB;EACA,IACE,WAAW,OACX;GAAC;GAAqB;GAAa;EAAU,CAAC,CAAC,MAAM,QAAQ,OAAO,OAAO,MAAM,GAAG,CAAC,GAErF,MAAM,YAAY;EACpB,MAAM,UAAU,cAAc,IAAI;EAElC,OAAO,QAAQ,OAAO,MAAM,MAAM;EAClC,IACE,MAAM,oBACL,QAAQ,kBAAkB,KAAA,KACzB,QAAQ,eAAe,KAAA,KACvB,QAAQ,6BAA6B,KAAA,IAEvC,MAAM,YAAY;CACtB;CACA,sBAAsB,aAAa,YACjC,UAAU,CAAC,GAAG,aAAa,gBAAgB,IAAI;CACjD,cAAc;CACd,qBAAqB;AACvB,CAAC;AAED,MAAM,mBACJ,YACG;CACH,MAAM,QACJ,QAAQ,WACN,KAAK,SACL,WAAW,MAAM,KAAK;EACpB,GAAG;EACH,MAAM,KAAK,gBAAgB,aAAa,IAAI,WAAW,KAAK,IAAI,IAAI,KAAK;CAC3E,CAAC;CAEL,MAAM,iBAAiB,QAAQ;CAE/B,OAAO,MAAM,QACX,oBACA,mBAAmB,GAAG,EACpB,QAAQ,OAAO,GAAG,uBAAuB,CAAC,CAAC,WAAW,OAAO;EAC3D,OAAO,OAAO,WAAW;GACvB,KAAK,OAAO,iBAAiB;IAC3B,IACE,MAAM,eAAe,WAAW,wBAChC,MAAM,QAAQ,cAAc,QAAQ,yBAAyB,MAAM,YACnE,MAAM,QAAQ,SAAS,aAAa,6BACpC,MAAM,QAAQ,SAAS,WAAW,QAElC,MAAM,YAAY;IACpB,MAAM,MAAM,uCAAuC,mBAAmB,MAAM,QAAQ,EAAE;IAEtF,MAAM,SAAS,YAAY,IAAI,CAC7B,cACA,YAAY,QAAQ,KAAK,KAAK,iBAAiB,GAAI,CAAC,CACtD,CAAC;IAID,MAAM,WAAW,MAFC,aAAa,OAAO,wBAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,CAE5B,CAAC,CAAC,KAAK;KACpC,QAAQ;KACR,UAAU;KACV,SAAS;MACP,GAAG;MACH,gBAAgB;MAChB,eAAe,SAAS,SAAS,aAAa,GAAG,MAAM,SAAS,GAAG,SAAS,MAAM,MAAM,eAAe,MAAM,GAAG;KAClH;KACA,MAAM,iBAAiB,EAAE,cAAc,SAAS,MAAM,MAAM,SAAS,WAAW,EAAE,CAAC;KACnF;IACF,CAAC;IAED,OAAO,eAAe;IACtB,IAAI,SAAS,WAAW,KAAK,MAAM,YAAY;GACjD;GACA,OAAO;EACT,CAAC;CACH,CAAC,EACH,CAAC,CACH;AACF;;;;AAKA,MAAa,0BACX,iBAC8B;CAC9B,IAAI;CAEJ,IAAI;EACF,QAAQ,kBAAkB,YAAY,YAAY;CACpD,QAAQ;EACN,MAAM,QAAQ;CAChB;CAEA,OAAO;EACL,GAAG,SAAS,KAAK;EACjB,QAAQ,CAAC,WAAW;GACnB,qBAAqB;CACxB;AACF;AAEA,MAAa,6BAA6B,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAChF,SACA;CACA,MAAM,QAAQ,OAAO,QAAQ,aAAa,QAAQ,eAAe,OAAO;CAExE,IAAI,MAAM,cAAc,QAAQ,SAAS,KAAK,aAAa,QAAQ,CAAC,CAAC,WAAW,GAC9E,OAAO,OAAO,QAAQ;CAExB,OAAO,OAAO,8BAA8B;EAC1C,GAAG;EACH,WAAW,MAAM,cAAc,IAAI,sBAAsB;CAC3D,CAAC;AACH,CAAC;AAED,MAAa,sCAAsC,OAAO,GAAG,qCAAqC,CAAC,CACjG,WAAW,SAAiD;CAC1D,MAAM,QAAQ,OAAO,QAAQ,sBAAsB,QAAQ,eAAe,OAAO;CAEjF,IAAI,MAAM,cAAc,QAAQ,SAAS,KAAK,aAAa,QAAQ,CAAC,CAAC,WAAW,GAC9E,OAAO,OAAO,QAAQ;CACxB,KAAK,MAAM,gBAAgB,MAAM,eAC/B,KAAK,MAAM,WAAW,aAAa,UACjC,IACE,QAAQ,aAAa,6BACrB,QAAQ,yBAAyB,aAAa,YAC9C,QAAQ,UAAU,WAAW,KAC7B,QAAQ,OAAO,MAAM,UAAU,UAAU,oBAAoB,CAAC,OAAO,KAAK,CAAC,MAC1E,QAAQ,cAAc,gBACnB,QAAQ,YAAY,iBACpB,QAAQ,iCAAiC,KAAA,IACzC,QAAQ,YAAY,cAAc,QAAQ,iCAAiC,KAAA,IAE/E,OAAO,OAAO,QAAQ;CAI5B,OAAO,OAAO,uCACZ;EACE,GAAG;EACH,WAAW,MAAM,cAAc,KAAK,UAAU;GAC5C,GAAG,SAAS,IAAI;GAChB,UAAU,KAAK;GACf,sBAAsB,KAAK;GAC3B,oBAAoB;GACpB,eAAe;IAAE,OAAO;IAA4B,MAAM;GAAU;GACpE,YAAY,EAAE,MAAM,kBAAkB;EACxC,EAAE;CACJ,GACA,aACF,CAAC,CAAC,KAAK,OAAO,QAAQ,gBAAgB,KAAK,CAAC,CAAC;AAC/C,CACF;AAEA,MAAa,+BAA+B,YAC1C,MAAM,OAAO,eAAe,2BAA2B,OAAO,CAAC;AAEjE,MAAa,wCACX,YACG,MAAM,OAAO,wBAAwB,oCAAoC,OAAO,CAAC"}
+{"version":3,"file":"protocol.mjs","names":[],"sources":["../../../src/oauth/github/protocol.ts"],"sourcesContent":["import { Effect, Encoding, Layer, Predicate, Redacted, Schema } from \"effect\";\nimport type { CustomFetch } from \"openid-client\";\n\nimport { OAuthConnectedProfile } from \"../connectedModels\";\nimport { OAuthConnectedProtocol } from \"../OAuthConnectedProtocol\";\nimport { OAuthProtocol } from \"../OAuthProtocol\";\nimport {\n  DefiniteTokenRejection,\n  tokenCompatibility,\n  type ConnectedCompatibility,\n} from \"../openid-client/compatibility\";\nimport { makeConnectedProtocolWithCompatibility } from \"../openid-client/connected/protocol\";\nimport {\n  OpenIdClientConfigurationError,\n  type OpenIdClientOAuthProvider,\n} from \"../openid-client/models\";\nimport { makeOpenIdClientOAuthProtocol } from \"../openid-client/protocol\";\nimport { ProviderRevocation } from \"../openid-client/ProviderRevocation\";\nimport { boundedFetch } from \"../openid-client/transport\";\nimport { OAuthUnavailable } from \"../signInErrors\";\nimport { OAuthCallbackId, OAuthGeneration, OAuthIssuer, OAuthRedirectUri } from \"../signInModels\";\nimport { snapshotOAuthSync } from \"../signInSnapshot\";\nimport { decodeGitHubIdentity, gitHubOAuthAppProviderKey } from \"./identity\";\nimport type {\n  GitHubOAuthAppConnectedProtocolOptions,\n  GitHubOAuthAppGeneration,\n  GitHubOAuthAppProtocolOptions,\n} from \"./models\";\n\nconst unavailable = () => OAuthUnavailable.make({});\nconst invalid = () => OpenIdClientConfigurationError.make({ reason: \"provider\" });\n// GitHub's OAuth authorization server issuer, including its RFC 9207 callback value.\nconst issuer = OAuthIssuer.make(\"https://github.com/login/oauth\");\n\nconst headers = Object.freeze({\n  Accept: \"application/vnd.github+json\",\n  \"User-Agent\": \"effect-auth-github-oauth-app\",\n  \"X-GitHub-Api-Version\": \"2026-03-10\",\n});\n\nconst generation = Schema.Struct({\n  configurationGeneration: OAuthGeneration,\n  issuance: Schema.Literals([\"active\", \"retired\"]),\n  clientId: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9._-]{1,256}$/)),\n  clientSecret: Schema.RedactedFromValue(Schema.NonEmptyString.check(Schema.isMaxLength(4096))),\n  callbacks: Schema.Array(\n    Schema.Struct({ callbackId: OAuthCallbackId, redirectUri: OAuthRedirectUri }),\n  ).check(Schema.isMinLength(1), Schema.isMaxLength(16)),\n});\n\nconst generations = Schema.Array(generation).check(Schema.isMinLength(1), Schema.isMaxLength(64));\n\nconst connectedGenerations = Schema.Array(\n  Schema.Struct({\n    ...generation.fields,\n    profiles: Schema.Array(OAuthConnectedProfile).check(\n      Schema.isMinLength(1),\n      Schema.isMaxLength(64),\n    ),\n  }),\n).check(Schema.isMinLength(1), Schema.isMaxLength(64));\n\nconst timeout = Schema.Finite.check(Schema.isBetween({ minimum: 1, maximum: 30 }));\nconst isTimeout = Schema.is(timeout);\n\nconst capture = <S extends Schema.Codec<unknown, unknown, never, never>>(\n  schema: S,\n  registrations: S[\"Type\"],\n  options: {\n    readonly timeoutSeconds: number;\n    readonly fetch?: GitHubOAuthAppProtocolOptions[\"fetch\"];\n  },\n) =>\n  Effect.try({\n    try: () => {\n      const result = snapshotOAuthSync(schema, registrations);\n      const fetch = options.fetch;\n      const timeoutSeconds = options.timeoutSeconds;\n\n      if (!isTimeout(timeoutSeconds) || (fetch !== undefined && !Predicate.isFunction(fetch)))\n        throw invalid();\n\n      return { registrations: result, timeoutSeconds, ...(fetch === undefined ? {} : { fetch }) };\n    },\n    catch: invalid,\n  });\n\nconst provider = (\n  registration: GitHubOAuthAppGeneration,\n): Omit<OpenIdClientOAuthProvider, \"scopes\"> => ({\n  provider: gitHubOAuthAppProviderKey,\n  configurationGeneration: registration.configurationGeneration,\n  issuance: registration.issuance,\n  issuer,\n  protocol: \"oauth\",\n  responseIssuerMode: \"required\",\n  clientId: registration.clientId,\n  authentication: { method: \"client_secret_post\", secret: registration.clientSecret },\n  callbacks: registration.callbacks,\n  authorizationEndpoint: \"https://github.com/login/oauth/authorize\",\n  tokenEndpoint: \"https://github.com/login/oauth/access_token\",\n  pkceS256: true,\n  identitySource: {\n    url: \"https://api.github.com/user\",\n    headers,\n    decodeIdentity: decodeGitHubIdentity,\n  },\n});\n\nconst csvCell = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_:-]{1,256}$/));\nconst isCell = Schema.is(csvCell);\n\n/** GitHub's receipt is comma-delimited, unlike the generic OAuth scope string. */\nconst scopes = (\n  receipt: string | undefined,\n  expected: ReadonlyArray<string>,\n): ReadonlyArray<string> => {\n  if (receipt === undefined || receipt.length > 16447) throw unavailable();\n\n  const result =\n    receipt === \"\" ? [] : receipt.split(\",\").map((cell) => cell.replace(/^[ \\t]+|[ \\t]+$/g, \"\"));\n\n  if (\n    result.length > 64 ||\n    result.some((cell) => !isCell(cell)) ||\n    new Set(result).size !== result.length ||\n    result.length !== expected.length ||\n    result.some((cell) => !expected.includes(cell))\n  )\n    throw unavailable();\n\n  return result;\n};\n\nconst token = Schema.NonEmptyString.check(Schema.isMaxLength(16384));\nconst expiry = Schema.Finite.check(Schema.isGreaterThan(0));\n\nconst receiptSchema = Schema.Struct({\n  access_token: token,\n  token_type: Schema.String.check(Schema.isPattern(/^[Bb][Ee][Aa][Rr][Ee][Rr]$/)),\n  scope: Schema.String.check(Schema.isMaxLength(16447)),\n  expires_in: Schema.optionalKey(expiry),\n  refresh_token: Schema.optionalKey(token),\n  refresh_token_expires_in: Schema.optionalKey(expiry),\n});\n\n// oxlint-disable-next-line no-restricted-properties -- Inspect the bounded raw receipt before the maintained parser can coerce expiry fields.\nconst decodeReceipt = Schema.decodeUnknownSync(receiptSchema);\n\nconst encodeRevocation = Schema.encodeSync(\n  Schema.fromJsonString(Schema.Struct({ access_token: token })),\n);\n\nconst terminalReceipt = Schema.Struct({\n  error: Schema.NonEmptyString.check(Schema.isMaxLength(128)),\n  error_description: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(4096))),\n  error_uri: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(2048))),\n});\n\n// oxlint-disable-next-line no-restricted-properties -- Fully validate the raw terminal receipt before classifying a provider rejection.\nconst decodeTerminalReceipt = Schema.decodeUnknownSync(terminalReceipt);\n\nconst successKeys = [\n  \"access_token\",\n  \"token_type\",\n  \"scope\",\n  \"expires_in\",\n  \"refresh_token\",\n  \"refresh_token_expires_in\",\n  \"id_token\",\n];\n\nconst compatibility: ConnectedCompatibility = Object.freeze<ConnectedCompatibility>({\n  inspectReceipt: ({ body, status, contentType }, input) => {\n    if (contentType?.split(\";\", 1)[0]?.trim().toLowerCase() !== \"application/json\")\n      throw unavailable();\n    if (!Predicate.isObject(body)) throw unavailable();\n    if (Object.hasOwn(body, \"error\")) {\n      if (successKeys.some((key) => Object.hasOwn(body, key))) throw unavailable();\n      const terminal = decodeTerminalReceipt(body);\n\n      if (\n        (status === 200 || status === 400) &&\n        terminal.error ===\n          (input.operation === \"authorization_code\" ? \"bad_verification_code\" : \"bad_refresh_token\")\n      ) {\n        throw new DefiniteTokenRejection();\n      }\n      throw unavailable();\n    }\n    if (\n      status !== 200 ||\n      [\"error_description\", \"error_uri\", \"id_token\"].some((key) => Object.hasOwn(body, key))\n    )\n      throw unavailable();\n    const receipt = decodeReceipt(body);\n\n    scopes(receipt.scope, input.scopes);\n    if (\n      input.refreshRequired &&\n      (receipt.refresh_token === undefined ||\n        receipt.expires_in === undefined ||\n        receipt.refresh_token_expires_in === undefined)\n    )\n      throw unavailable();\n  },\n  authorizationScopes: (permissions, refresh) =>\n    refresh ? [...permissions, \"offline_access\"] : permissions,\n  decodeScopes: scopes,\n  includeRefreshScope: false,\n});\n\nconst revocationLayer = (\n  options: Pick<GitHubOAuthAppConnectedProtocolOptions, \"fetch\" | \"timeoutSeconds\">,\n) => {\n  const fetch: CustomFetch =\n    options.fetch ??\n    ((url, init) =>\n      globalThis.fetch(url, {\n        ...init,\n        body: init.body instanceof Uint8Array ? new Uint8Array(init.body) : init.body,\n      }));\n\n  const timeoutSeconds = options.timeoutSeconds;\n\n  return Layer.succeed(\n    ProviderRevocation,\n    ProviderRevocation.of({\n      revoke: Effect.fn(\"GitHubOAuthApp.revoke\")(function* (input) {\n        yield* Effect.tryPromise({\n          try: async (effectSignal) => {\n            if (\n              input.authentication.method !== \"client_secret_post\" ||\n              input.context.configuration.profile.clientRegistrationId !== input.clientId ||\n              input.context.identity.provider !== gitHubOAuthAppProviderKey ||\n              input.context.identity.issuer !== issuer\n            )\n              throw unavailable();\n            const url = `https://api.github.com/applications/${encodeURIComponent(input.clientId)}/grant`;\n\n            const signal = AbortSignal.any([\n              effectSignal,\n              AbortSignal.timeout(Math.ceil(timeoutSeconds * 1000)),\n            ]);\n\n            const transport = boundedFetch(fetch, signal, new Set([url]));\n\n            const response = await transport(url, {\n              method: \"DELETE\",\n              redirect: \"manual\",\n              headers: {\n                ...headers,\n                \"Content-Type\": \"application/json\",\n                Authorization: `Basic ${Encoding.encodeBase64(`${input.clientId}:${Redacted.value(input.authentication.secret)}`)}`,\n              },\n              body: encodeRevocation({ access_token: Redacted.value(input.material.accessToken) }),\n              signal,\n            });\n\n            signal.throwIfAborted();\n            if (response.status !== 204) throw unavailable();\n          },\n          catch: unavailable,\n        });\n      }),\n    }),\n  );\n};\n\n/** A GitHub.com OAuth App generation for the same provider list as generic OIDC.\n * Retains GitHub receipt/error rules and requests read:user, with no repository access.\n * Construction performs no I/O; invalid configuration throws the typed configuration error. */\nexport const gitHubOAuthAppProvider = (\n  registration: GitHubOAuthAppGeneration,\n): OpenIdClientOAuthProvider => {\n  let saved: GitHubOAuthAppGeneration;\n\n  try {\n    saved = snapshotOAuthSync(generation, registration);\n  } catch {\n    throw invalid();\n  }\n\n  return {\n    ...provider(saved),\n    scopes: [\"read:user\"],\n    [tokenCompatibility]: compatibility,\n  };\n};\n\nexport const makeGitHubOAuthAppProtocol = Effect.fn(\"makeGitHubOAuthAppProtocol\")(function* (\n  options: GitHubOAuthAppProtocolOptions,\n) {\n  const saved = yield* capture(generations, options.registrations, options);\n\n  if (saved.registrations.filter((item) => item.issuance === \"active\").length !== 1)\n    return yield* invalid();\n\n  return yield* makeOpenIdClientOAuthProtocol({\n    ...saved,\n    providers: saved.registrations.map(gitHubOAuthAppProvider),\n  });\n});\n\nexport const makeGitHubOAuthAppConnectedProtocol = Effect.fn(\"makeGitHubOAuthAppConnectedProtocol\")(\n  function* (options: GitHubOAuthAppConnectedProtocolOptions) {\n    const saved = yield* capture(connectedGenerations, options.registrations, options);\n\n    if (saved.registrations.filter((item) => item.issuance === \"active\").length !== 1)\n      return yield* invalid();\n    for (const registration of saved.registrations) {\n      for (const profile of registration.profiles) {\n        if (\n          profile.provider !== gitHubOAuthAppProviderKey ||\n          profile.clientRegistrationId !== registration.clientId ||\n          profile.resources.length !== 0 ||\n          profile.scopes.some((scope) => scope === \"offline_access\" || !isCell(scope)) ||\n          (profile.retention === \"access-only\"\n            ? profile.refresh !== \"unsupported\" ||\n              profile.maximumRefreshLifetimeMillis !== undefined\n            : profile.refresh !== \"rotating\" || profile.maximumRefreshLifetimeMillis === undefined)\n        )\n          return yield* invalid();\n      }\n    }\n\n    return yield* makeConnectedProtocolWithCompatibility(\n      {\n        ...saved,\n        providers: saved.registrations.map((item) => ({\n          ...provider(item),\n          profiles: item.profiles,\n          clientRegistrationId: item.clientId,\n          resourceIndicators: \"unsupported\",\n          refreshExpiry: { field: \"refresh_token_expires_in\", zero: \"expired\" },\n          revocation: { mode: \"provider-cohort\" },\n        })),\n      },\n      compatibility,\n    ).pipe(Effect.provide(revocationLayer(saved)));\n  },\n);\n\nexport const gitHubOAuthAppProtocolLayer = (options: GitHubOAuthAppProtocolOptions) =>\n  Layer.effect(OAuthProtocol, makeGitHubOAuthAppProtocol(options));\n\nexport const gitHubOAuthAppConnectedProtocolLayer = (\n  options: GitHubOAuthAppConnectedProtocolOptions,\n) => Layer.effect(OAuthConnectedProtocol, makeGitHubOAuthAppConnectedProtocol(options));\n"],"mappings":";;;;;;;;;;;;;;;AA6BA,MAAM,oBAAoB,iBAAiB,KAAK,CAAC,CAAC;AAClD,MAAM,gBAAgB,+BAA+B,KAAK,EAAE,QAAQ,WAAW,CAAC;AAEhF,MAAM,SAAS,YAAY,KAAK,gCAAgC;AAEhE,MAAM,UAAU,OAAO,OAAO;CAC5B,QAAQ;CACR,cAAc;CACd,wBAAwB;AAC1B,CAAC;AAED,MAAM,aAAa,OAAO,OAAO;CAC/B,yBAAyB;CACzB,UAAU,OAAO,SAAS,CAAC,UAAU,SAAS,CAAC;CAC/C,UAAU,OAAO,OAAO,MAAM,OAAO,UAAU,yBAAyB,CAAC;CACzE,cAAc,OAAO,kBAAkB,OAAO,eAAe,MAAM,OAAO,YAAY,IAAI,CAAC,CAAC;CAC5F,WAAW,OAAO,MAChB,OAAO,OAAO;EAAE,YAAY;EAAiB,aAAa;CAAiB,CAAC,CAC9E,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,EAAE,CAAC;AACvD,CAAC;AAED,MAAM,cAAc,OAAO,MAAM,UAAU,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,EAAE,CAAC;AAEhG,MAAM,uBAAuB,OAAO,MAClC,OAAO,OAAO;CACZ,GAAG,WAAW;CACd,UAAU,OAAO,MAAM,qBAAqB,CAAC,CAAC,MAC5C,OAAO,YAAY,CAAC,GACpB,OAAO,YAAY,EAAE,CACvB;AACF,CAAC,CACH,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,EAAE,CAAC;AAErD,MAAM,UAAU,OAAO,OAAO,MAAM,OAAO,UAAU;CAAE,SAAS;CAAG,SAAS;AAAG,CAAC,CAAC;AACjF,MAAM,YAAY,OAAO,GAAG,OAAO;AAEnC,MAAM,WACJ,QACA,eACA,YAKA,OAAO,IAAI;CACT,WAAW;EACT,MAAM,SAAS,kBAAkB,QAAQ,aAAa;EACtD,MAAM,QAAQ,QAAQ;EACtB,MAAM,iBAAiB,QAAQ;EAE/B,IAAI,CAAC,UAAU,cAAc,KAAM,UAAU,KAAA,KAAa,CAAC,UAAU,WAAW,KAAK,GACnF,MAAM,QAAQ;EAEhB,OAAO;GAAE,eAAe;GAAQ;GAAgB,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;EAAG;CAC5F;CACA,OAAO;AACT,CAAC;AAEH,MAAM,YACJ,kBAC+C;CAC/C,UAAU;CACV,yBAAyB,aAAa;CACtC,UAAU,aAAa;CACvB;CACA,UAAU;CACV,oBAAoB;CACpB,UAAU,aAAa;CACvB,gBAAgB;EAAE,QAAQ;EAAsB,QAAQ,aAAa;CAAa;CAClF,WAAW,aAAa;CACxB,uBAAuB;CACvB,eAAe;CACf,UAAU;CACV,gBAAgB;EACd,KAAK;EACL;EACA,gBAAgB;CAClB;AACF;AAEA,MAAM,UAAU,OAAO,OAAO,MAAM,OAAO,UAAU,yBAAyB,CAAC;AAC/E,MAAM,SAAS,OAAO,GAAG,OAAO;;AAGhC,MAAM,UACJ,SACA,aAC0B;CAC1B,IAAI,YAAY,KAAA,KAAa,QAAQ,SAAS,OAAO,MAAM,YAAY;CAEvE,MAAM,SACJ,YAAY,KAAK,CAAC,IAAI,QAAQ,MAAM,GAAG,CAAC,CAAC,KAAK,SAAS,KAAK,QAAQ,oBAAoB,EAAE,CAAC;CAE7F,IACE,OAAO,SAAS,MAChB,OAAO,MAAM,SAAS,CAAC,OAAO,IAAI,CAAC,KACnC,IAAI,IAAI,MAAM,CAAC,CAAC,SAAS,OAAO,UAChC,OAAO,WAAW,SAAS,UAC3B,OAAO,MAAM,SAAS,CAAC,SAAS,SAAS,IAAI,CAAC,GAE9C,MAAM,YAAY;CAEpB,OAAO;AACT;AAEA,MAAM,QAAQ,OAAO,eAAe,MAAM,OAAO,YAAY,KAAK,CAAC;AACnE,MAAM,SAAS,OAAO,OAAO,MAAM,OAAO,cAAc,CAAC,CAAC;AAE1D,MAAM,gBAAgB,OAAO,OAAO;CAClC,cAAc;CACd,YAAY,OAAO,OAAO,MAAM,OAAO,UAAU,4BAA4B,CAAC;CAC9E,OAAO,OAAO,OAAO,MAAM,OAAO,YAAY,KAAK,CAAC;CACpD,YAAY,OAAO,YAAY,MAAM;CACrC,eAAe,OAAO,YAAY,KAAK;CACvC,0BAA0B,OAAO,YAAY,MAAM;AACrD,CAAC;AAGD,MAAM,gBAAgB,OAAO,kBAAkB,aAAa;AAE5D,MAAM,mBAAmB,OAAO,WAC9B,OAAO,eAAe,OAAO,OAAO,EAAE,cAAc,MAAM,CAAC,CAAC,CAC9D;AAEA,MAAM,kBAAkB,OAAO,OAAO;CACpC,OAAO,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC;CAC1D,mBAAmB,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC,CAAC;CACnF,WAAW,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC,CAAC;AAC7E,CAAC;AAGD,MAAM,wBAAwB,OAAO,kBAAkB,eAAe;AAEtE,MAAM,cAAc;CAClB;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAEA,MAAM,gBAAwC,OAAO,OAA+B;CAClF,iBAAiB,EAAE,MAAM,QAAQ,eAAe,UAAU;EACxD,IAAI,aAAa,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,YAAY,MAAM,oBAC1D,MAAM,YAAY;EACpB,IAAI,CAAC,UAAU,SAAS,IAAI,GAAG,MAAM,YAAY;EACjD,IAAI,OAAO,OAAO,MAAM,OAAO,GAAG;GAChC,IAAI,YAAY,MAAM,QAAQ,OAAO,OAAO,MAAM,GAAG,CAAC,GAAG,MAAM,YAAY;GAC3E,MAAM,WAAW,sBAAsB,IAAI;GAE3C,KACG,WAAW,OAAO,WAAW,QAC9B,SAAS,WACN,MAAM,cAAc,uBAAuB,0BAA0B,sBAExE,MAAM,IAAI,uBAAuB;GAEnC,MAAM,YAAY;EACpB;EACA,IACE,WAAW,OACX;GAAC;GAAqB;GAAa;EAAU,CAAC,CAAC,MAAM,QAAQ,OAAO,OAAO,MAAM,GAAG,CAAC,GAErF,MAAM,YAAY;EACpB,MAAM,UAAU,cAAc,IAAI;EAElC,OAAO,QAAQ,OAAO,MAAM,MAAM;EAClC,IACE,MAAM,oBACL,QAAQ,kBAAkB,KAAA,KACzB,QAAQ,eAAe,KAAA,KACvB,QAAQ,6BAA6B,KAAA,IAEvC,MAAM,YAAY;CACtB;CACA,sBAAsB,aAAa,YACjC,UAAU,CAAC,GAAG,aAAa,gBAAgB,IAAI;CACjD,cAAc;CACd,qBAAqB;AACvB,CAAC;AAED,MAAM,mBACJ,YACG;CACH,MAAM,QACJ,QAAQ,WACN,KAAK,SACL,WAAW,MAAM,KAAK;EACpB,GAAG;EACH,MAAM,KAAK,gBAAgB,aAAa,IAAI,WAAW,KAAK,IAAI,IAAI,KAAK;CAC3E,CAAC;CAEL,MAAM,iBAAiB,QAAQ;CAE/B,OAAO,MAAM,QACX,oBACA,mBAAmB,GAAG,EACpB,QAAQ,OAAO,GAAG,uBAAuB,CAAC,CAAC,WAAW,OAAO;EAC3D,OAAO,OAAO,WAAW;GACvB,KAAK,OAAO,iBAAiB;IAC3B,IACE,MAAM,eAAe,WAAW,wBAChC,MAAM,QAAQ,cAAc,QAAQ,yBAAyB,MAAM,YACnE,MAAM,QAAQ,SAAS,aAAa,6BACpC,MAAM,QAAQ,SAAS,WAAW,QAElC,MAAM,YAAY;IACpB,MAAM,MAAM,uCAAuC,mBAAmB,MAAM,QAAQ,EAAE;IAEtF,MAAM,SAAS,YAAY,IAAI,CAC7B,cACA,YAAY,QAAQ,KAAK,KAAK,iBAAiB,GAAI,CAAC,CACtD,CAAC;IAID,MAAM,WAAW,MAFC,aAAa,OAAO,wBAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,CAE5B,CAAC,CAAC,KAAK;KACpC,QAAQ;KACR,UAAU;KACV,SAAS;MACP,GAAG;MACH,gBAAgB;MAChB,eAAe,SAAS,SAAS,aAAa,GAAG,MAAM,SAAS,GAAG,SAAS,MAAM,MAAM,eAAe,MAAM,GAAG;KAClH;KACA,MAAM,iBAAiB,EAAE,cAAc,SAAS,MAAM,MAAM,SAAS,WAAW,EAAE,CAAC;KACnF;IACF,CAAC;IAED,OAAO,eAAe;IACtB,IAAI,SAAS,WAAW,KAAK,MAAM,YAAY;GACjD;GACA,OAAO;EACT,CAAC;CACH,CAAC,EACH,CAAC,CACH;AACF;;;;AAKA,MAAa,0BACX,iBAC8B;CAC9B,IAAI;CAEJ,IAAI;EACF,QAAQ,kBAAkB,YAAY,YAAY;CACpD,QAAQ;EACN,MAAM,QAAQ;CAChB;CAEA,OAAO;EACL,GAAG,SAAS,KAAK;EACjB,QAAQ,CAAC,WAAW;GACnB,qBAAqB;CACxB;AACF;AAEA,MAAa,6BAA6B,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAChF,SACA;CACA,MAAM,QAAQ,OAAO,QAAQ,aAAa,QAAQ,eAAe,OAAO;CAExE,IAAI,MAAM,cAAc,QAAQ,SAAS,KAAK,aAAa,QAAQ,CAAC,CAAC,WAAW,GAC9E,OAAO,OAAO,QAAQ;CAExB,OAAO,OAAO,8BAA8B;EAC1C,GAAG;EACH,WAAW,MAAM,cAAc,IAAI,sBAAsB;CAC3D,CAAC;AACH,CAAC;AAED,MAAa,sCAAsC,OAAO,GAAG,qCAAqC,CAAC,CACjG,WAAW,SAAiD;CAC1D,MAAM,QAAQ,OAAO,QAAQ,sBAAsB,QAAQ,eAAe,OAAO;CAEjF,IAAI,MAAM,cAAc,QAAQ,SAAS,KAAK,aAAa,QAAQ,CAAC,CAAC,WAAW,GAC9E,OAAO,OAAO,QAAQ;CACxB,KAAK,MAAM,gBAAgB,MAAM,eAC/B,KAAK,MAAM,WAAW,aAAa,UACjC,IACE,QAAQ,aAAa,6BACrB,QAAQ,yBAAyB,aAAa,YAC9C,QAAQ,UAAU,WAAW,KAC7B,QAAQ,OAAO,MAAM,UAAU,UAAU,oBAAoB,CAAC,OAAO,KAAK,CAAC,MAC1E,QAAQ,cAAc,gBACnB,QAAQ,YAAY,iBACpB,QAAQ,iCAAiC,KAAA,IACzC,QAAQ,YAAY,cAAc,QAAQ,iCAAiC,KAAA,IAE/E,OAAO,OAAO,QAAQ;CAI5B,OAAO,OAAO,uCACZ;EACE,GAAG;EACH,WAAW,MAAM,cAAc,KAAK,UAAU;GAC5C,GAAG,SAAS,IAAI;GAChB,UAAU,KAAK;GACf,sBAAsB,KAAK;GAC3B,oBAAoB;GACpB,eAAe;IAAE,OAAO;IAA4B,MAAM;GAAU;GACpE,YAAY,EAAE,MAAM,kBAAkB;EACxC,EAAE;CACJ,GACA,aACF,CAAC,CAAC,KAAK,OAAO,QAAQ,gBAAgB,KAAK,CAAC,CAAC;AAC/C,CACF;AAEA,MAAa,+BAA+B,YAC1C,MAAM,OAAO,eAAe,2BAA2B,OAAO,CAAC;AAEjE,MAAa,wCACX,YACG,MAAM,OAAO,wBAAwB,oCAAoC,OAAO,CAAC"}

package/dist/oauth/openid-client/connected/protocol.mjs

@@ -8,6 +8,7 @@ import { OAuthConnectedProtocol } from "../../OAuthConnectedProtocol.mjs";
 import { DefiniteTokenRejection } from "../compatibility.mjs";
 import { boundedFetch } from "../transport.mjs";
 import { clientAuthentication } from "../configuration.mjs";
+import { decodeOidcProfile } from "../profile.mjs";
 import { ProviderRevocation } from "../ProviderRevocation.mjs";
 import { installConnectedConfigurations, sameConnectedProfile } from "./configuration.mjs";
 import { Cause, DateTime, Effect, Layer, Redacted, Schema } from "effect";
@@ -162,12 +163,14 @@ const makeConnectedProtocolWithCompatibility = Effect.fn("makeOpenIdClientConnec
 		const now = DateTime.toEpochMillis(yield* DateTime.now) / 1e3;
 		const audience = typeof claims.aud === "string" ? claims.aud : claims.aud[0];
 		if (claims.iss !== provider.issuer || audience !== provider.clientId || claims.azp !== void 0 && claims.azp !== provider.clientId || claims.exp <= now || claims.iat > now || claims.nbf !== void 0 && claims.nbf > now || claims.auth_time !== void 0 && claims.auth_time > now || (previous ? claims.sub !== previous.identity.subject || claims.nonce !== void 0 && claims.nonce !== Redacted.value(originalNonce) || claims.auth_time !== void 0 && claims.auth_time !== previous.continuation.authTime : claims.nonce !== Redacted.value(originalNonce) || provider.maxAgeSeconds !== void 0 && (claims.auth_time === void 0 || claims.auth_time + provider.maxAgeSeconds < Math.floor(now)))) return yield* unavailable();
+		const profile = yield* decodeOidcProfile(raw).pipe(Effect.mapError(unavailable));
 		return {
 			identity: {
 				provider: provider.provider,
 				issuer: provider.issuer,
 				subject: claims.sub
 			},
+			...profile === void 0 ? {} : { profile },
 			continuation: previous?.continuation ?? {
 				_tag: "Oidc",
 				clientId: provider.clientId,