@yielded/auth 0.1.0-beta.4 → 0.1.0-beta.5

package/dist/oauth/openid-client/connected/protocol.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"protocol.mjs","names":["M.OAuthConnectedProfile","M.OAuthConnectedConfiguration","M.OAuthConnectedTokenContext","M.OAuthConnectedTokenMaterial","M.OAuthConnectedScopes","M.OAuthConnectedGrantResponse"],"sources":["../../../../src/oauth/openid-client/connected/protocol.ts"],"sourcesContent":["import { Cause, DateTime, Effect, Layer, Redacted, Schema } from \"effect\";\nimport * as client from \"openid-client\";\n\nimport { reportAuthFailure } from \"../../../internal/diagnostics\";\nimport { RequestBindingFlowId } from \"../../../operations/requestBinding\";\nimport * as M from \"../../connectedModels\";\nimport { OAuthConnectedProtocol } from \"../../OAuthConnectedProtocol\";\nimport { OAuthProtocolRejected, OAuthUnavailable } from \"../../signInErrors\";\nimport {\n  OAuthCallbackId,\n  OAuthCodeResponse,\n  OAuthDisplayProfile,\n  OAuthExternalIdentity,\n  OAuthInstant,\n  OAuthProtocolPreparation,\n  OAuthTransactionSecrets,\n} from \"../../signInModels\";\nimport { snapshotOAuth } from \"../../signInSnapshot\";\nimport {\n  DefiniteTokenRejection,\n  type ConnectedCompatibility,\n  type ConnectedOptions,\n} from \"../compatibility\";\nimport { clientAuthentication } from \"../configuration\";\nimport { type OpenIdClientConfigurationError } from \"../models\";\nimport { ProviderRevocation } from \"../ProviderRevocation\";\nimport { boundedFetch } from \"../transport\";\nimport {\n  installConnectedConfigurations,\n  sameConnectedProfile,\n  type InstalledConnectedProvider,\n} from \"./configuration\";\nimport type { OpenIdClientConnectedProtocolOptions } from \"./models\";\n\nconst unavailable = () => OAuthUnavailable.make({});\nconst rejected = () => OAuthProtocolRejected.make({});\n\nconst safe = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n  effect.pipe(\n    Effect.tapCause((cause) =>\n      Cause.hasDies(cause) ? reportAuthFailure(\"oauth-protocol\", cause) : Effect.void,\n    ),\n    Effect.catchCause((cause): Effect.Effect<never, E | OAuthUnavailable> => {\n      if (Cause.hasInterrupts(cause)) return Effect.interrupt;\n\n      return Cause.hasDies(cause) ? Effect.fail(unavailable()) : Effect.failCause(cause);\n    }),\n  );\n\n/** After possible transmission, validation/transport failures remain ambiguous. */\nconst grantError = (error: unknown) =>\n  error instanceof DefiniteTokenRejection ||\n  (error instanceof client.ClientError && error.cause instanceof DefiniteTokenRejection) ||\n  (error instanceof client.ResponseBodyError &&\n    error.status === 400 &&\n    error.error === \"invalid_grant\")\n    ? rejected()\n    : unavailable();\n\nconst prepareInput = Schema.Struct({\n  profile: M.OAuthConnectedProfile,\n  callbackId: OAuthCallbackId,\n  flowId: RequestBindingFlowId,\n});\n\nconst prepareOutput = Schema.Struct({\n  ...OAuthProtocolPreparation.fields,\n  configuration: M.OAuthConnectedConfiguration,\n});\n\nconst exchangeInput = Schema.toType(\n  Schema.Struct({\n    configuration: M.OAuthConnectedConfiguration,\n    secrets: OAuthTransactionSecrets,\n    response: OAuthCodeResponse,\n    verificationStartedAt: Schema.DateTimeUtcFromMillis,\n  }),\n);\n\nconst refreshInput = Schema.toType(\n  Schema.Struct({\n    context: M.OAuthConnectedTokenContext,\n    material: M.OAuthConnectedTokenMaterial,\n    verificationStartedAt: Schema.DateTimeUtcFromMillis,\n  }),\n);\n\nconst revokeInput = Schema.Struct({\n  context: M.OAuthConnectedTokenContext,\n  material: M.OAuthConnectedTokenMaterial,\n});\n\nconst numericDate = Schema.Finite.check(Schema.isBetween({ minimum: 0, maximum: 8640000000000 }));\n\nconst claimsSchema = Schema.Struct({\n  iss: Schema.String,\n  sub: OAuthExternalIdentity.fields.subject,\n  aud: Schema.Union([\n    Schema.String,\n    Schema.Array(Schema.String).check(Schema.isMinLength(1), Schema.isMaxLength(1)),\n  ]),\n  azp: Schema.optionalKey(Schema.String),\n  exp: numericDate,\n  iat: numericDate,\n  nbf: Schema.optionalKey(numericDate),\n  auth_time: Schema.optionalKey(numericDate),\n  nonce: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(256))),\n});\n\nconst identitySchema = Schema.Struct({\n  subject: OAuthExternalIdentity.fields.subject,\n  profile: Schema.optionalKey(OAuthDisplayProfile),\n});\n\nconst rawMetadataSchema = Schema.Struct({\n  expires_in: Schema.optionalKey(Schema.Finite.check(Schema.isGreaterThan(0))),\n  scope: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(16447))),\n});\n\nconst rawRefreshExpiry = Schema.UndefinedOr(Schema.Finite.check(Schema.isGreaterThanOrEqualTo(0)));\n\ninterface GrantMetadata {\n  readonly expiresIn?: number;\n  readonly scope?: string;\n  readonly refreshExpiresIn?: number;\n}\n\nconst privateConfiguration = <R>(\n  entry: InstalledConnectedProvider<R>,\n  fetch: client.CustomFetch,\n  timeout: number,\n  signal: AbortSignal,\n  purpose: \"grant\" | \"revoke\",\n  compatibility?: ConnectedCompatibility,\n  receipt?: Parameters<ConnectedCompatibility[\"inspectReceipt\"]>[1],\n) => {\n  const provider = entry.provider;\n\n  const authentication =\n    purpose === \"revoke\" && provider.revocation.mode === \"rfc7009\"\n      ? provider.revocation.authentication\n      : provider.authentication;\n\n  const configuration = new client.Configuration(\n    entry.metadata,\n    provider.clientId,\n    {\n      [client.clockSkew]: 0,\n      [client.clockTolerance]: 0,\n      ...(provider.protocol === \"oidc\" ? { id_token_signed_response_alg: \"RS256\" } : {}),\n    },\n    clientAuthentication(authentication),\n  );\n\n  const transport = boundedFetch(fetch, signal, entry.allowedUrls);\n  let metadata: GrantMetadata | undefined;\n\n  configuration.timeout = timeout;\n  configuration[client.customFetch] = async (url, options) => {\n    const response = await transport(url, options);\n\n    if (\n      purpose === \"grant\" &&\n      url === new URL(entry.metadata.token_endpoint!).href &&\n      (compatibility !== undefined || response.status === 200)\n    ) {\n      const body: unknown = await response.clone().json();\n\n      signal.throwIfAborted();\n      if (compatibility !== undefined) {\n        if (!receipt) throw unavailable();\n        compatibility.inspectReceipt(\n          { body, status: response.status, contentType: response.headers.get(\"content-type\") },\n          receipt,\n        );\n        signal.throwIfAborted();\n      }\n      if (response.status !== 200) return response;\n      if (metadata !== undefined) throw unavailable();\n      // oxlint-disable-next-line no-restricted-properties -- Capture bounded raw expiry values before the maintained parser's coercion.\n      const decoded = Schema.decodeUnknownSync(rawMetadataSchema)(body);\n      let refreshExpiresIn: number | undefined;\n\n      if (provider.refreshExpiry !== \"unreported\") {\n        // oxlint-disable-next-line no-restricted-properties -- The extension name and numeric semantics are explicitly installed.\n        refreshExpiresIn = Schema.decodeUnknownSync(rawRefreshExpiry)(\n          Reflect.get(body as object, provider.refreshExpiry.field),\n        );\n        if (refreshExpiresIn === 0 && provider.refreshExpiry.zero === \"unreported\")\n          refreshExpiresIn = undefined;\n      }\n      metadata = {\n        ...(decoded.expires_in === undefined ? {} : { expiresIn: decoded.expires_in }),\n        ...(decoded.scope === undefined ? {} : { scope: decoded.scope }),\n        ...(refreshExpiresIn === undefined ? {} : { refreshExpiresIn }),\n      };\n    }\n\n    return response;\n  };\n  if (provider.protocol === \"oidc\") client.enableNonRepudiationChecks(configuration);\n\n  return {\n    configuration,\n    metadata: () => {\n      if (!metadata) throw unavailable();\n\n      return metadata;\n    },\n  };\n};\n\nconst appendResources = (parameters: URLSearchParams, resources: ReadonlyArray<string>) => {\n  for (const resource of resources) parameters.append(\"resource\", resource);\n};\n\nconst sameStrings = (left: ReadonlyArray<string>, right: ReadonlyArray<string>) =>\n  left.length === right.length &&\n  [...left].sort().every((value, index) => value === [...right].sort()[index]);\n\nexport const makeConnectedProtocolWithCompatibility = Effect.fn(\n  \"makeOpenIdClientConnectedProtocol\",\n)(function* <R = never>(\n  options: ConnectedOptions<R>,\n  compatibility?: ConnectedCompatibility,\n): Effect.fn.Return<\n  OAuthConnectedProtocol[\"Service\"],\n  OpenIdClientConfigurationError | OAuthUnavailable,\n  R | ProviderRevocation\n> {\n  const decoderContext = yield* Effect.context<R>();\n  const providerRevocation = yield* ProviderRevocation;\n\n  const { installed, fetch, timeoutSeconds } = yield* installConnectedConfigurations(\n    options,\n    compatibility !== undefined,\n  );\n\n  const retained = Effect.fn(\"OpenIdClientConnected.retained\")(function* (\n    saved: M.OAuthConnectedConfiguration,\n  ) {\n    const entry = installed.find(\n      ({ provider }) =>\n        provider.provider === saved.provider &&\n        provider.configurationGeneration === saved.configurationGeneration,\n    );\n\n    const provider = entry?.provider;\n\n    if (\n      !entry ||\n      !provider ||\n      provider.protocol !== saved.protocol ||\n      provider.issuer !== saved.issuer ||\n      provider.responseIssuerMode !== saved.responseIssuerMode ||\n      provider.clientRegistrationId !== saved.profile.clientRegistrationId ||\n      !provider.profiles.some((profile) => sameConnectedProfile(profile, saved.profile)) ||\n      provider.callbacks.find((callback) => callback.callbackId === saved.callbackId)\n        ?.redirectUri !== saved.redirectUri\n    )\n      return yield* unavailable();\n\n    return entry;\n  });\n\n  const checkedStart = Effect.fn(\"OpenIdClientConnected.startedAt\")(function* (\n    start: DateTime.Utc,\n  ) {\n    const value = DateTime.toEpochMillis(start);\n\n    if (\n      !Number.isSafeInteger(value) ||\n      value < 0 ||\n      value > DateTime.toEpochMillis(yield* DateTime.now)\n    )\n      return yield* unavailable();\n\n    return value;\n  });\n\n  const tokenMetadata = Effect.fn(\"OpenIdClientConnected.tokenMetadata\")(function* (\n    profile: M.OAuthConnectedProfile,\n    metadata: GrantMetadata,\n    start: number,\n    refreshRetained: boolean,\n  ) {\n    const scopes =\n      compatibility !== undefined\n        ? yield* Effect.try({\n            try: () => compatibility.decodeScopes(metadata.scope, profile.scopes),\n            catch: unavailable,\n          })\n        : metadata.scope === undefined\n          ? profile.scopes\n          : yield* Schema.decodeEffect(M.OAuthConnectedScopes)(metadata.scope.split(\" \")).pipe(\n              Effect.mapError(unavailable),\n            );\n\n    if (new Set(scopes).size !== scopes.length || !sameStrings(scopes, profile.scopes))\n      return yield* unavailable();\n\n    const accessExpiresAtMillis =\n      metadata.expiresIn === undefined\n        ? undefined\n        : yield* Schema.decodeEffect(OAuthInstant)(\n            Math.floor(start + metadata.expiresIn * 1000),\n          ).pipe(Effect.mapError(unavailable));\n\n    const refreshExpiresAtMillis =\n      !refreshRetained || metadata.refreshExpiresIn === undefined\n        ? undefined\n        : yield* Schema.decodeEffect(OAuthInstant)(\n            Math.floor(start + metadata.refreshExpiresIn * 1000),\n          ).pipe(Effect.mapError(unavailable));\n\n    const now = DateTime.toEpochMillis(yield* DateTime.now);\n\n    if (\n      (accessExpiresAtMillis !== undefined && accessExpiresAtMillis <= now) ||\n      (refreshExpiresAtMillis !== undefined && refreshExpiresAtMillis <= now)\n    )\n      return yield* unavailable();\n\n    return {\n      scopes: [...scopes],\n      resources: [...profile.resources],\n      ...(accessExpiresAtMillis === undefined ? {} : { accessExpiresAtMillis }),\n      ...(refreshExpiresAtMillis === undefined ? {} : { refreshExpiresAtMillis }),\n    };\n  });\n\n  const oidcIdentity = Effect.fn(\"OpenIdClientConnected.oidcIdentity\")(function* (\n    entry: InstalledConnectedProvider<R>,\n    raw: unknown,\n    originalNonce: Redacted.Redacted<string>,\n    previous?: {\n      readonly identity: typeof OAuthExternalIdentity.Type;\n      readonly continuation: Extract<\n        M.OAuthConnectedTokenMaterial[\"continuation\"],\n        { readonly _tag: \"Oidc\" }\n      >;\n    },\n  ) {\n    const provider = entry.provider;\n\n    if (provider.protocol !== \"oidc\") return yield* unavailable();\n\n    // oxlint-disable-next-line no-restricted-properties -- Project authenticated foreign ID-token claims into this narrower profile.\n    const claims = yield* Schema.decodeUnknownEffect(claimsSchema)(raw).pipe(\n      Effect.mapError(unavailable),\n    );\n\n    const now = DateTime.toEpochMillis(yield* DateTime.now) / 1000;\n    const audience = typeof claims.aud === \"string\" ? claims.aud : claims.aud[0];\n\n    if (\n      claims.iss !== provider.issuer ||\n      audience !== provider.clientId ||\n      (claims.azp !== undefined && claims.azp !== provider.clientId) ||\n      claims.exp <= now ||\n      claims.iat > now ||\n      (claims.nbf !== undefined && claims.nbf > now) ||\n      (claims.auth_time !== undefined && claims.auth_time > now) ||\n      (previous\n        ? claims.sub !== previous.identity.subject ||\n          (claims.nonce !== undefined && claims.nonce !== Redacted.value(originalNonce)) ||\n          (claims.auth_time !== undefined && claims.auth_time !== previous.continuation.authTime)\n        : claims.nonce !== Redacted.value(originalNonce) ||\n          (provider.maxAgeSeconds !== undefined &&\n            (claims.auth_time === undefined ||\n              claims.auth_time + provider.maxAgeSeconds < Math.floor(now))))\n    )\n      return yield* unavailable();\n\n    return {\n      identity: { provider: provider.provider, issuer: provider.issuer, subject: claims.sub },\n      continuation: previous?.continuation ?? {\n        _tag: \"Oidc\" as const,\n        clientId: provider.clientId,\n        nonce: Redacted.make(Redacted.value(originalNonce)),\n        ...(claims.auth_time === undefined ? {} : { authTime: claims.auth_time }),\n      },\n    };\n  });\n\n  const decodeIdentity = Effect.fn(\"OpenIdClientConnected.decodeIdentity\")(function* (\n    entry: InstalledConnectedProvider<R>,\n    body: unknown,\n  ) {\n    if (entry.provider.protocol !== \"oauth\") return yield* unavailable();\n    const decoder = entry.provider.identitySource.decodeIdentity;\n\n    const result = yield* Effect.suspend(() => decoder(body)).pipe(\n      Effect.provideContext(decoderContext),\n      Effect.catchCause((cause) => {\n        const recovered = Cause.hasInterrupts(cause)\n          ? Effect.interrupt\n          : Effect.fail(unavailable());\n\n        if (\n          cause.reasons.length === 1 &&\n          cause.reasons[0]?._tag === \"Fail\" &&\n          Schema.is(OAuthProtocolRejected)(cause.reasons[0].error)\n        )\n          return recovered;\n\n        return reportAuthFailure(\"oauth-identity\", cause).pipe(Effect.andThen(recovered));\n      }),\n    );\n\n    const value = yield* Schema.decodeEffect(identitySchema)(result).pipe(\n      Effect.mapError(unavailable),\n    );\n\n    return {\n      identity: {\n        provider: entry.provider.provider,\n        issuer: entry.provider.issuer,\n        subject: value.subject,\n      },\n      ...(value.profile === undefined ? {} : { profile: value.profile }),\n      continuation: { _tag: \"OAuth\" as const },\n    };\n  });\n\n  const prepareAuthorization: OAuthConnectedProtocol[\"Service\"][\"prepareAuthorization\"] = Effect.fn(\n    \"OpenIdClientConnected.prepareAuthorization\",\n  )(function* (input) {\n    const request = yield* snapshotOAuth(prepareInput, input);\n\n    const entry = installed.find(\n      ({ provider }) =>\n        provider.provider === request.profile.provider &&\n        provider.issuance === \"active\" &&\n        provider.profiles.some(\n          (profile) =>\n            profile.issuance === \"active\" && sameConnectedProfile(profile, request.profile),\n        ),\n    );\n\n    const callback = entry?.provider.callbacks.find(\n      (value) => value.callbackId === request.callbackId,\n    );\n\n    if (!entry || !callback || request.profile.issuance !== \"active\") return yield* rejected();\n\n    const result = yield* Effect.tryPromise({\n      try: async (signal) => {\n        const { configuration } = privateConfiguration(\n          entry,\n          fetch,\n          timeoutSeconds,\n          signal,\n          \"grant\",\n        );\n\n        const state = client.randomState(),\n          verifier = client.randomPKCECodeVerifier(),\n          nonce = entry.provider.protocol === \"oidc\" ? client.randomNonce() : undefined;\n\n        const challenge = await client.calculatePKCECodeChallenge(verifier);\n\n        signal.throwIfAborted();\n        const parameters = new URLSearchParams(entry.provider.authorizationParameters);\n\n        for (const [key, value] of Object.entries({\n          response_type: \"code\",\n          response_mode: \"query\",\n          redirect_uri: callback.redirectUri,\n          scope: (\n            compatibility?.authorizationScopes(\n              request.profile.scopes,\n              request.profile.retention === \"access-and-refresh\",\n            ) ?? request.profile.scopes\n          ).join(\" \"),\n          state,\n          code_challenge: challenge,\n          code_challenge_method: \"S256\",\n        }))\n          parameters.set(key, value);\n        if (nonce !== undefined) parameters.set(\"nonce\", nonce);\n        if (entry.provider.protocol === \"oidc\" && entry.provider.maxAgeSeconds !== undefined)\n          parameters.set(\"max_age\", String(entry.provider.maxAgeSeconds));\n        appendResources(parameters, request.profile.resources);\n\n        return {\n          configuration: {\n            provider: entry.provider.provider,\n            protocol: entry.provider.protocol,\n            configurationGeneration: entry.provider.configurationGeneration,\n            issuer: entry.provider.issuer,\n            responseIssuerMode: entry.provider.responseIssuerMode,\n            callbackId: callback.callbackId,\n            redirectUri: callback.redirectUri,\n            profile: request.profile,\n          },\n          authorizationUrl: Redacted.make(\n            client.buildAuthorizationUrl(configuration, parameters).href,\n          ),\n          secrets: {\n            namespace: \"effect-auth/oauth-transaction-secrets/v1\" as const,\n            state: Redacted.make(state),\n            pkceVerifier: Redacted.make(verifier),\n            ...(nonce === undefined ? {} : { oidcNonce: Redacted.make(nonce) }),\n          },\n        };\n      },\n      catch: unavailable,\n    });\n\n    return yield* snapshotOAuth(prepareOutput, result);\n  });\n\n  const exchangeGrant: OAuthConnectedProtocol[\"Service\"][\"exchangeGrant\"] = Effect.fn(\n    \"OpenIdClientConnected.exchangeGrant\",\n  )(function* (input) {\n    const request = yield* snapshotOAuth(exchangeInput, input),\n      saved = request.configuration;\n\n    const entry = yield* retained(saved),\n      provider = entry.provider;\n\n    if (\n      (provider.protocol === \"oidc\") !== (request.secrets.oidcNonce !== undefined) ||\n      Redacted.value(request.response.state) !== Redacted.value(request.secrets.state) ||\n      (provider.responseIssuerMode === \"required\"\n        ? request.response.issuer !== provider.issuer\n        : request.response.issuer !== undefined)\n    )\n      return yield* rejected();\n    const start = yield* checkedStart(request.verificationStartedAt);\n\n    const result = yield* Effect.tryPromise({\n      try: async (signal) => {\n        const invocation = privateConfiguration(\n          entry,\n          fetch,\n          timeoutSeconds,\n          signal,\n          \"grant\",\n          compatibility,\n          {\n            scopes: saved.profile.scopes,\n            refreshRequired: saved.profile.retention === \"access-and-refresh\",\n            operation: \"authorization_code\",\n          },\n        );\n\n        const url = new URL(saved.redirectUri);\n\n        url.searchParams.set(\"code\", Redacted.value(request.response.code));\n        url.searchParams.set(\"state\", Redacted.value(request.response.state));\n        if (request.response.issuer !== undefined)\n          url.searchParams.set(\"iss\", request.response.issuer);\n        const parameters = new URLSearchParams(provider.tokenParameters);\n\n        appendResources(parameters, saved.profile.resources);\n\n        const tokens = await client.authorizationCodeGrant(\n          invocation.configuration,\n          url,\n          {\n            expectedState: Redacted.value(request.secrets.state),\n            pkceCodeVerifier: Redacted.value(request.secrets.pkceVerifier),\n            ...(provider.protocol === \"oidc\"\n              ? {\n                  idTokenExpected: true,\n                  expectedNonce: Redacted.value(request.secrets.oidcNonce!),\n                  ...(provider.maxAgeSeconds === undefined\n                    ? {}\n                    : { maxAge: provider.maxAgeSeconds }),\n                }\n              : {}),\n          },\n          parameters,\n        );\n\n        signal.throwIfAborted();\n        if (tokens.token_type !== \"bearer\") throw unavailable();\n        const metadata = invocation.metadata();\n        let body: unknown;\n\n        if (provider.protocol === \"oauth\") {\n          const response = await client.fetchProtectedResource(\n            invocation.configuration,\n            tokens.access_token,\n            new URL(provider.identitySource.url),\n            \"GET\",\n            undefined,\n            new Headers(provider.identitySource.headers),\n          );\n\n          signal.throwIfAborted();\n          if (\n            response.status !== 200 ||\n            response.headers.get(\"content-type\")?.split(\";\", 1)[0]?.trim().toLowerCase() !==\n              \"application/json\"\n          )\n            throw unavailable();\n          body = await response.json();\n          signal.throwIfAborted();\n        }\n\n        return {\n          tokens,\n          metadata,\n          body,\n        };\n      },\n      catch: grantError,\n    });\n\n    const identity =\n      provider.protocol === \"oidc\"\n        ? yield* oidcIdentity(entry, result.tokens.claims(), request.secrets.oidcNonce!)\n        : yield* decodeIdentity(entry, result.body);\n\n    const refreshToken =\n      saved.profile.retention === \"access-and-refresh\" ? result.tokens.refresh_token : undefined;\n\n    const metadata = yield* tokenMetadata(\n      saved.profile,\n      result.metadata,\n      start,\n      refreshToken !== undefined,\n    );\n\n    return yield* snapshotOAuth(M.OAuthConnectedGrantResponse, {\n      ...identity,\n      ...metadata,\n      material: {\n        namespace: \"effect-auth/oauth-connected-token-material/v1\",\n        accessToken: Redacted.make(result.tokens.access_token),\n        ...(refreshToken === undefined ? {} : { refreshToken: Redacted.make(refreshToken) }),\n        continuation: identity.continuation,\n      },\n    });\n  });\n\n  const refreshGrant: OAuthConnectedProtocol[\"Service\"][\"refreshGrant\"] = Effect.fn(\n    \"OpenIdClientConnected.refreshGrant\",\n  )(function* (input) {\n    const request = yield* snapshotOAuth(refreshInput, input),\n      saved = request.context.configuration;\n\n    const entry = yield* retained(saved),\n      provider = entry.provider,\n      previous = request.material.continuation;\n\n    if (\n      saved.profile.retention !== \"access-and-refresh\" ||\n      saved.profile.refresh === \"unsupported\" ||\n      !request.material.refreshToken ||\n      request.context.identity.provider !== provider.provider ||\n      request.context.identity.issuer !== provider.issuer ||\n      (provider.protocol === \"oidc\"\n        ? previous._tag !== \"Oidc\" ||\n          previous.clientId !== provider.clientId ||\n          previous.nonce === undefined\n        : previous._tag !== \"OAuth\") ||\n      !sameStrings(request.context.metadata.scopes, saved.profile.scopes) ||\n      !sameStrings(request.context.metadata.resources, saved.profile.resources)\n    )\n      return yield* unavailable();\n    const start = yield* checkedStart(request.verificationStartedAt);\n\n    if (\n      (request.context.metadata.refreshUseUntilMillis !== undefined &&\n        request.context.metadata.refreshUseUntilMillis <= start) ||\n      (request.context.metadata.refreshExpiresAtMillis !== undefined &&\n        request.context.metadata.refreshExpiresAtMillis <= start)\n    )\n      return yield* unavailable();\n\n    const result = yield* Effect.tryPromise({\n      try: async (signal) => {\n        const invocation = privateConfiguration(\n          entry,\n          fetch,\n          timeoutSeconds,\n          signal,\n          \"grant\",\n          compatibility,\n          {\n            scopes: saved.profile.scopes,\n            refreshRequired: true,\n            operation: \"refresh_token\",\n          },\n        );\n\n        const parameters = new URLSearchParams(provider.refreshParameters);\n\n        if (compatibility?.includeRefreshScope !== false)\n          parameters.set(\"scope\", saved.profile.scopes.join(\" \"));\n        appendResources(parameters, saved.profile.resources);\n\n        const tokens = await client.refreshTokenGrant(\n          invocation.configuration,\n          Redacted.value(request.material.refreshToken!),\n          parameters,\n        );\n\n        signal.throwIfAborted();\n        if (\n          tokens.token_type !== \"bearer\" ||\n          (saved.profile.refresh === \"rotating\" &&\n            (!tokens.refresh_token ||\n              tokens.refresh_token === Redacted.value(request.material.refreshToken!)))\n        )\n          throw unavailable();\n        const metadata = invocation.metadata();\n        let body: unknown;\n\n        if (provider.protocol === \"oauth\") {\n          const response = await client.fetchProtectedResource(\n            invocation.configuration,\n            tokens.access_token,\n            new URL(provider.identitySource.url),\n            \"GET\",\n            undefined,\n            new Headers(provider.identitySource.headers),\n          );\n\n          signal.throwIfAborted();\n          if (\n            response.status !== 200 ||\n            response.headers.get(\"content-type\")?.split(\";\", 1)[0]?.trim().toLowerCase() !==\n              \"application/json\"\n          )\n            throw unavailable();\n          body = await response.json();\n          signal.throwIfAborted();\n        }\n\n        return {\n          tokens,\n          metadata,\n          body,\n        };\n      },\n      catch: grantError,\n    });\n\n    if (provider.protocol === \"oidc\") {\n      if (previous._tag !== \"Oidc\" || !previous.nonce) return yield* unavailable();\n      if (result.tokens.id_token !== undefined)\n        yield* oidcIdentity(entry, result.tokens.claims(), previous.nonce, {\n          identity: request.context.identity,\n          continuation: previous,\n        });\n    } else {\n      const identity = yield* decodeIdentity(entry, result.body);\n\n      if (identity.identity.subject !== request.context.identity.subject)\n        return yield* unavailable();\n    }\n    const metadata = yield* tokenMetadata(saved.profile, result.metadata, start, true);\n    const finishedAt = DateTime.toEpochMillis(yield* DateTime.now);\n\n    if (\n      (request.context.metadata.refreshUseUntilMillis !== undefined &&\n        request.context.metadata.refreshUseUntilMillis <= finishedAt) ||\n      (request.context.metadata.refreshExpiresAtMillis !== undefined &&\n        request.context.metadata.refreshExpiresAtMillis <= finishedAt)\n    )\n      return yield* unavailable();\n\n    return yield* snapshotOAuth(M.OAuthConnectedGrantResponse, {\n      identity: request.context.identity,\n      ...metadata,\n      material: {\n        namespace: \"effect-auth/oauth-connected-token-material/v1\",\n        accessToken: Redacted.make(result.tokens.access_token),\n        ...(result.tokens.refresh_token === undefined\n          ? {}\n          : { refreshToken: Redacted.make(result.tokens.refresh_token) }),\n        continuation: previous,\n      },\n    });\n  });\n\n  const revokeGrant: OAuthConnectedProtocol[\"Service\"][\"revokeGrant\"] = Effect.fn(\n    \"OpenIdClientConnected.revokeGrant\",\n  )(function* (input) {\n    const request = yield* snapshotOAuth(revokeInput, input),\n      saved = request.context.configuration;\n\n    const entry = yield* retained(saved),\n      revocation = entry.provider.revocation;\n\n    if (\n      saved.profile.revocation !== \"cohort\" ||\n      revocation.mode === \"unsupported\" ||\n      (revocation.mode === \"provider-cohort\" && compatibility === undefined) ||\n      (revocation.mode === \"rfc7009\" &&\n        request.material.refreshToken !== undefined &&\n        revocation.tokenTypes !== \"access-and-refresh\") ||\n      request.context.identity.provider !== entry.provider.provider ||\n      request.context.identity.issuer !== entry.provider.issuer ||\n      (entry.provider.protocol === \"oidc\"\n        ? request.material.continuation._tag !== \"Oidc\" ||\n          request.material.continuation.clientId !== entry.provider.clientId\n        : request.material.continuation._tag !== \"OAuth\")\n    )\n      return yield* unavailable();\n    if (revocation.mode === \"provider-cohort\") {\n      yield* providerRevocation.revoke({\n        clientId: entry.provider.clientId,\n        authentication: entry.provider.authentication,\n        context: request.context,\n        material: request.material,\n      });\n\n      return \"Confirmed\" as const;\n    }\n    yield* Effect.tryPromise({\n      try: async (signal) => {\n        const { configuration } = privateConfiguration(\n          entry,\n          fetch,\n          timeoutSeconds,\n          signal,\n          \"revoke\",\n        );\n\n        if (request.material.refreshToken !== undefined) {\n          await client.tokenRevocation(\n            configuration,\n            Redacted.value(request.material.refreshToken),\n            { token_type_hint: \"refresh_token\" },\n          );\n          signal.throwIfAborted();\n        }\n        await client.tokenRevocation(configuration, Redacted.value(request.material.accessToken), {\n          token_type_hint: \"access_token\",\n        });\n        signal.throwIfAborted();\n      },\n      catch: unavailable,\n    });\n\n    return \"Confirmed\" as const;\n  });\n\n  return OAuthConnectedProtocol.of({\n    prepareAuthorization: (input) => safe(prepareAuthorization(input)),\n    exchangeGrant: (input) => safe(exchangeGrant(input)),\n    refreshGrant: (input) => safe(refreshGrant(input)),\n    revokeGrant: (input) => safe(revokeGrant(input)),\n  });\n}, safe);\n\nexport const makeOpenIdClientConnectedProtocol = <R = never>(\n  options: OpenIdClientConnectedProtocolOptions<R>,\n): Effect.Effect<\n  OAuthConnectedProtocol[\"Service\"],\n  OpenIdClientConfigurationError | OAuthUnavailable,\n  R\n> =>\n  makeConnectedProtocolWithCompatibility(options).pipe(\n    Effect.provide(ProviderRevocation.layerUnsupported),\n  );\n\nexport const openIdClientConnectedProtocolLayer = <R = never>(\n  options: OpenIdClientConnectedProtocolOptions<R>,\n) => Layer.effect(OAuthConnectedProtocol, makeOpenIdClientConnectedProtocol(options));\n"],"mappings":";;;;;;;;;;;;;;;AAkCA,MAAM,oBAAoB,iBAAiB,KAAK,CAAC,CAAC;AAClD,MAAM,iBAAiB,sBAAsB,KAAK,CAAC,CAAC;AAEpD,MAAM,QAAiB,WACrB,OAAO,KACL,OAAO,UAAU,UACf,MAAM,QAAQ,KAAK,IAAI,kBAAkB,kBAAkB,KAAK,IAAI,OAAO,IAC7E,GACA,OAAO,YAAY,UAAsD;CACvE,IAAI,MAAM,cAAc,KAAK,GAAG,OAAO,OAAO;CAE9C,OAAO,MAAM,QAAQ,KAAK,IAAI,OAAO,KAAK,YAAY,CAAC,IAAI,OAAO,UAAU,KAAK;AACnF,CAAC,CACH;;AAGF,MAAM,cAAc,UAClB,iBAAiB,0BAChB,iBAAiB,OAAO,eAAe,MAAM,iBAAiB,0BAC9D,iBAAiB,OAAO,qBACvB,MAAM,WAAW,OACjB,MAAM,UAAU,kBACd,SAAS,IACT,YAAY;AAElB,MAAM,eAAe,OAAO,OAAO;CACjC,SAASA;CACT,YAAY;CACZ,QAAQ;AACV,CAAC;AAED,MAAM,gBAAgB,OAAO,OAAO;CAClC,GAAG,yBAAyB;CAC5B,eAAeC;AACjB,CAAC;AAED,MAAM,gBAAgB,OAAO,OAC3B,OAAO,OAAO;CACZ,eAAeA;CACf,SAAS;CACT,UAAU;CACV,uBAAuB,OAAO;AAChC,CAAC,CACH;AAEA,MAAM,eAAe,OAAO,OAC1B,OAAO,OAAO;CACZ,SAASC;CACT,UAAUC;CACV,uBAAuB,OAAO;AAChC,CAAC,CACH;AAEA,MAAM,cAAc,OAAO,OAAO;CAChC,SAASD;CACT,UAAUC;AACZ,CAAC;AAED,MAAM,cAAc,OAAO,OAAO,MAAM,OAAO,UAAU;CAAE,SAAS;CAAG,SAAS;AAAc,CAAC,CAAC;AAEhG,MAAM,eAAe,OAAO,OAAO;CACjC,KAAK,OAAO;CACZ,KAAK,sBAAsB,OAAO;CAClC,KAAK,OAAO,MAAM,CAChB,OAAO,QACP,OAAO,MAAM,OAAO,MAAM,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,CAAC,CAAC,CAChF,CAAC;CACD,KAAK,OAAO,YAAY,OAAO,MAAM;CACrC,KAAK;CACL,KAAK;CACL,KAAK,OAAO,YAAY,WAAW;CACnC,WAAW,OAAO,YAAY,WAAW;CACzC,OAAO,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,iBAAiB,OAAO,OAAO;CACnC,SAAS,sBAAsB,OAAO;CACtC,SAAS,OAAO,YAAY,mBAAmB;AACjD,CAAC;AAED,MAAM,oBAAoB,OAAO,OAAO;CACtC,YAAY,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,cAAc,CAAC,CAAC,CAAC;CAC3E,OAAO,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,KAAK,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,mBAAmB,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,uBAAuB,CAAC,CAAC,CAAC;AAQjG,MAAM,wBACJ,OACA,OACA,SACA,QACA,SACA,eACA,YACG;CACH,MAAM,WAAW,MAAM;CAEvB,MAAM,iBACJ,YAAY,YAAY,SAAS,WAAW,SAAS,YACjD,SAAS,WAAW,iBACpB,SAAS;CAEf,MAAM,gBAAgB,IAAI,OAAO,cAC/B,MAAM,UACN,SAAS,UACT;GACG,OAAO,YAAY;GACnB,OAAO,iBAAiB;EACzB,GAAI,SAAS,aAAa,SAAS,EAAE,8BAA8B,QAAQ,IAAI,CAAC;CAClF,GACA,qBAAqB,cAAc,CACrC;CAEA,MAAM,YAAY,aAAa,OAAO,QAAQ,MAAM,WAAW;CAC/D,IAAI;CAEJ,cAAc,UAAU;CACxB,cAAc,OAAO,eAAe,OAAO,KAAK,YAAY;EAC1D,MAAM,WAAW,MAAM,UAAU,KAAK,OAAO;EAE7C,IACE,YAAY,WACZ,QAAQ,IAAI,IAAI,MAAM,SAAS,cAAe,CAAC,CAAC,SAC/C,kBAAkB,KAAA,KAAa,SAAS,WAAW,MACpD;GACA,MAAM,OAAgB,MAAM,SAAS,MAAM,CAAC,CAAC,KAAK;GAElD,OAAO,eAAe;GACtB,IAAI,kBAAkB,KAAA,GAAW;IAC/B,IAAI,CAAC,SAAS,MAAM,YAAY;IAChC,cAAc,eACZ;KAAE;KAAM,QAAQ,SAAS;KAAQ,aAAa,SAAS,QAAQ,IAAI,cAAc;IAAE,GACnF,OACF;IACA,OAAO,eAAe;GACxB;GACA,IAAI,SAAS,WAAW,KAAK,OAAO;GACpC,IAAI,aAAa,KAAA,GAAW,MAAM,YAAY;GAE9C,MAAM,UAAU,OAAO,kBAAkB,iBAAiB,CAAC,CAAC,IAAI;GAChE,IAAI;GAEJ,IAAI,SAAS,kBAAkB,cAAc;IAE3C,mBAAmB,OAAO,kBAAkB,gBAAgB,CAAC,CAC3D,QAAQ,IAAI,MAAgB,SAAS,cAAc,KAAK,CAC1D;IACA,IAAI,qBAAqB,KAAK,SAAS,cAAc,SAAS,cAC5D,mBAAmB,KAAA;GACvB;GACA,WAAW;IACT,GAAI,QAAQ,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,QAAQ,WAAW;IAC5E,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;IAC9D,GAAI,qBAAqB,KAAA,IAAY,CAAC,IAAI,EAAE,iBAAiB;GAC/D;EACF;EAEA,OAAO;CACT;CACA,IAAI,SAAS,aAAa,QAAQ,OAAO,2BAA2B,aAAa;CAEjF,OAAO;EACL;EACA,gBAAgB;GACd,IAAI,CAAC,UAAU,MAAM,YAAY;GAEjC,OAAO;EACT;CACF;AACF;AAEA,MAAM,mBAAmB,YAA6B,cAAqC;CACzF,KAAK,MAAM,YAAY,WAAW,WAAW,OAAO,YAAY,QAAQ;AAC1E;AAEA,MAAM,eAAe,MAA6B,UAChD,KAAK,WAAW,MAAM,UACtB,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,OAAO,UAAU,UAAU,CAAC,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM;AAE7E,MAAa,yCAAyC,OAAO,GAC3D,mCACF,CAAC,CAAC,WACA,SACA,eAKA;CACA,MAAM,iBAAiB,OAAO,OAAO,QAAW;CAChD,MAAM,qBAAqB,OAAO;CAElC,MAAM,EAAE,WAAW,OAAO,mBAAmB,OAAO,+BAClD,SACA,kBAAkB,KAAA,CACpB;CAEA,MAAM,WAAW,OAAO,GAAG,gCAAgC,CAAC,CAAC,WAC3D,OACA;EACA,MAAM,QAAQ,UAAU,MACrB,EAAE,eACD,SAAS,aAAa,MAAM,YAC5B,SAAS,4BAA4B,MAAM,uBAC/C;EAEA,MAAM,WAAW,OAAO;EAExB,IACE,CAAC,SACD,CAAC,YACD,SAAS,aAAa,MAAM,YAC5B,SAAS,WAAW,MAAM,UAC1B,SAAS,uBAAuB,MAAM,sBACtC,SAAS,yBAAyB,MAAM,QAAQ,wBAChD,CAAC,SAAS,SAAS,MAAM,YAAY,qBAAqB,SAAS,MAAM,OAAO,CAAC,KACjF,SAAS,UAAU,MAAM,aAAa,SAAS,eAAe,MAAM,UAAU,CAAC,EAC3E,gBAAgB,MAAM,aAE1B,OAAO,OAAO,YAAY;EAE5B,OAAO;CACT,CAAC;CAED,MAAM,eAAe,OAAO,GAAG,iCAAiC,CAAC,CAAC,WAChE,OACA;EACA,MAAM,QAAQ,SAAS,cAAc,KAAK;EAE1C,IACE,CAAC,OAAO,cAAc,KAAK,KAC3B,QAAQ,KACR,QAAQ,SAAS,cAAc,OAAO,SAAS,GAAG,GAElD,OAAO,OAAO,YAAY;EAE5B,OAAO;CACT,CAAC;CAED,MAAM,gBAAgB,OAAO,GAAG,qCAAqC,CAAC,CAAC,WACrE,SACA,UACA,OACA,iBACA;EACA,MAAM,SACJ,kBAAkB,KAAA,IACd,OAAO,OAAO,IAAI;GAChB,WAAW,cAAc,aAAa,SAAS,OAAO,QAAQ,MAAM;GACpE,OAAO;EACT,CAAC,IACD,SAAS,UAAU,KAAA,IACjB,QAAQ,SACR,OAAO,OAAO,aAAaC,oBAAsB,CAAC,CAAC,SAAS,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,KAC5E,OAAO,SAAS,WAAW,CAC7B;EAER,IAAI,IAAI,IAAI,MAAM,CAAC,CAAC,SAAS,OAAO,UAAU,CAAC,YAAY,QAAQ,QAAQ,MAAM,GAC/E,OAAO,OAAO,YAAY;EAE5B,MAAM,wBACJ,SAAS,cAAc,KAAA,IACnB,KAAA,IACA,OAAO,OAAO,aAAa,YAAY,CAAC,CACtC,KAAK,MAAM,QAAQ,SAAS,YAAY,GAAI,CAC9C,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;EAEzC,MAAM,yBACJ,CAAC,mBAAmB,SAAS,qBAAqB,KAAA,IAC9C,KAAA,IACA,OAAO,OAAO,aAAa,YAAY,CAAC,CACtC,KAAK,MAAM,QAAQ,SAAS,mBAAmB,GAAI,CACrD,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;EAEzC,MAAM,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG;EAEtD,IACG,0BAA0B,KAAA,KAAa,yBAAyB,OAChE,2BAA2B,KAAA,KAAa,0BAA0B,KAEnE,OAAO,OAAO,YAAY;EAE5B,OAAO;GACL,QAAQ,CAAC,GAAG,MAAM;GAClB,WAAW,CAAC,GAAG,QAAQ,SAAS;GAChC,GAAI,0BAA0B,KAAA,IAAY,CAAC,IAAI,EAAE,sBAAsB;GACvE,GAAI,2BAA2B,KAAA,IAAY,CAAC,IAAI,EAAE,uBAAuB;EAC3E;CACF,CAAC;CAED,MAAM,eAAe,OAAO,GAAG,oCAAoC,CAAC,CAAC,WACnE,OACA,KACA,eACA,UAOA;EACA,MAAM,WAAW,MAAM;EAEvB,IAAI,SAAS,aAAa,QAAQ,OAAO,OAAO,YAAY;EAG5D,MAAM,SAAS,OAAO,OAAO,oBAAoB,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,KAClE,OAAO,SAAS,WAAW,CAC7B;EAEA,MAAM,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG,IAAI;EAC1D,MAAM,WAAW,OAAO,OAAO,QAAQ,WAAW,OAAO,MAAM,OAAO,IAAI;EAE1E,IACE,OAAO,QAAQ,SAAS,UACxB,aAAa,SAAS,YACrB,OAAO,QAAQ,KAAA,KAAa,OAAO,QAAQ,SAAS,YACrD,OAAO,OAAO,OACd,OAAO,MAAM,OACZ,OAAO,QAAQ,KAAA,KAAa,OAAO,MAAM,OACzC,OAAO,cAAc,KAAA,KAAa,OAAO,YAAY,QACrD,WACG,OAAO,QAAQ,SAAS,SAAS,WAChC,OAAO,UAAU,KAAA,KAAa,OAAO,UAAU,SAAS,MAAM,aAAa,KAC3E,OAAO,cAAc,KAAA,KAAa,OAAO,cAAc,SAAS,aAAa,WAC9E,OAAO,UAAU,SAAS,MAAM,aAAa,KAC5C,SAAS,kBAAkB,KAAA,MACzB,OAAO,cAAc,KAAA,KACpB,OAAO,YAAY,SAAS,gBAAgB,KAAK,MAAM,GAAG,KAElE,OAAO,OAAO,YAAY;EAE5B,OAAO;GACL,UAAU;IAAE,UAAU,SAAS;IAAU,QAAQ,SAAS;IAAQ,SAAS,OAAO;GAAI;GACtF,cAAc,UAAU,gBAAgB;IACtC,MAAM;IACN,UAAU,SAAS;IACnB,OAAO,SAAS,KAAK,SAAS,MAAM,aAAa,CAAC;IAClD,GAAI,OAAO,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU,OAAO,UAAU;GACzE;EACF;CACF,CAAC;CAED,MAAM,iBAAiB,OAAO,GAAG,sCAAsC,CAAC,CAAC,WACvE,OACA,MACA;EACA,IAAI,MAAM,SAAS,aAAa,SAAS,OAAO,OAAO,YAAY;EACnE,MAAM,UAAU,MAAM,SAAS,eAAe;EAE9C,MAAM,SAAS,OAAO,OAAO,cAAc,QAAQ,IAAI,CAAC,CAAC,CAAC,KACxD,OAAO,eAAe,cAAc,GACpC,OAAO,YAAY,UAAU;GAC3B,MAAM,YAAY,MAAM,cAAc,KAAK,IACvC,OAAO,YACP,OAAO,KAAK,YAAY,CAAC;GAE7B,IACE,MAAM,QAAQ,WAAW,KACzB,MAAM,QAAQ,EAAE,EAAE,SAAS,UAC3B,OAAO,GAAG,qBAAqB,CAAC,CAAC,MAAM,QAAQ,EAAE,CAAC,KAAK,GAEvD,OAAO;GAET,OAAO,kBAAkB,kBAAkB,KAAK,CAAC,CAAC,KAAK,OAAO,QAAQ,SAAS,CAAC;EAClF,CAAC,CACH;EAEA,MAAM,QAAQ,OAAO,OAAO,aAAa,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,KAC/D,OAAO,SAAS,WAAW,CAC7B;EAEA,OAAO;GACL,UAAU;IACR,UAAU,MAAM,SAAS;IACzB,QAAQ,MAAM,SAAS;IACvB,SAAS,MAAM;GACjB;GACA,GAAI,MAAM,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;GAChE,cAAc,EAAE,MAAM,QAAiB;EACzC;CACF,CAAC;CAED,MAAM,uBAAkF,OAAO,GAC7F,4CACF,CAAC,CAAC,WAAW,OAAO;EAClB,MAAM,UAAU,OAAO,cAAc,cAAc,KAAK;EAExD,MAAM,QAAQ,UAAU,MACrB,EAAE,eACD,SAAS,aAAa,QAAQ,QAAQ,YACtC,SAAS,aAAa,YACtB,SAAS,SAAS,MACf,YACC,QAAQ,aAAa,YAAY,qBAAqB,SAAS,QAAQ,OAAO,CAClF,CACJ;EAEA,MAAM,WAAW,OAAO,SAAS,UAAU,MACxC,UAAU,MAAM,eAAe,QAAQ,UAC1C;EAEA,IAAI,CAAC,SAAS,CAAC,YAAY,QAAQ,QAAQ,aAAa,UAAU,OAAO,OAAO,SAAS;EAEzF,MAAM,SAAS,OAAO,OAAO,WAAW;GACtC,KAAK,OAAO,WAAW;IACrB,MAAM,EAAE,kBAAkB,qBACxB,OACA,OACA,gBACA,QACA,OACF;IAEA,MAAM,QAAQ,OAAO,YAAY,GAC/B,WAAW,OAAO,uBAAuB,GACzC,QAAQ,MAAM,SAAS,aAAa,SAAS,OAAO,YAAY,IAAI,KAAA;IAEtE,MAAM,YAAY,MAAM,OAAO,2BAA2B,QAAQ;IAElE,OAAO,eAAe;IACtB,MAAM,aAAa,IAAI,gBAAgB,MAAM,SAAS,uBAAuB;IAE7E,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ;KACxC,eAAe;KACf,eAAe;KACf,cAAc,SAAS;KACvB,QACE,eAAe,oBACb,QAAQ,QAAQ,QAChB,QAAQ,QAAQ,cAAc,oBAChC,KAAK,QAAQ,QAAQ,OAAA,CACrB,KAAK,GAAG;KACV;KACA,gBAAgB;KAChB,uBAAuB;IACzB,CAAC,GACC,WAAW,IAAI,KAAK,KAAK;IAC3B,IAAI,UAAU,KAAA,GAAW,WAAW,IAAI,SAAS,KAAK;IACtD,IAAI,MAAM,SAAS,aAAa,UAAU,MAAM,SAAS,kBAAkB,KAAA,GACzE,WAAW,IAAI,WAAW,OAAO,MAAM,SAAS,aAAa,CAAC;IAChE,gBAAgB,YAAY,QAAQ,QAAQ,SAAS;IAErD,OAAO;KACL,eAAe;MACb,UAAU,MAAM,SAAS;MACzB,UAAU,MAAM,SAAS;MACzB,yBAAyB,MAAM,SAAS;MACxC,QAAQ,MAAM,SAAS;MACvB,oBAAoB,MAAM,SAAS;MACnC,YAAY,SAAS;MACrB,aAAa,SAAS;MACtB,SAAS,QAAQ;KACnB;KACA,kBAAkB,SAAS,KACzB,OAAO,sBAAsB,eAAe,UAAU,CAAC,CAAC,IAC1D;KACA,SAAS;MACP,WAAW;MACX,OAAO,SAAS,KAAK,KAAK;MAC1B,cAAc,SAAS,KAAK,QAAQ;MACpC,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,SAAS,KAAK,KAAK,EAAE;KACnE;IACF;GACF;GACA,OAAO;EACT,CAAC;EAED,OAAO,OAAO,cAAc,eAAe,MAAM;CACnD,CAAC;CAED,MAAM,gBAAoE,OAAO,GAC/E,qCACF,CAAC,CAAC,WAAW,OAAO;EAClB,MAAM,UAAU,OAAO,cAAc,eAAe,KAAK,GACvD,QAAQ,QAAQ;EAElB,MAAM,QAAQ,OAAO,SAAS,KAAK,GACjC,WAAW,MAAM;EAEnB,IACG,SAAS,aAAa,YAAa,QAAQ,QAAQ,cAAc,KAAA,MAClE,SAAS,MAAM,QAAQ,SAAS,KAAK,MAAM,SAAS,MAAM,QAAQ,QAAQ,KAAK,MAC9E,SAAS,uBAAuB,aAC7B,QAAQ,SAAS,WAAW,SAAS,SACrC,QAAQ,SAAS,WAAW,KAAA,IAEhC,OAAO,OAAO,SAAS;EACzB,MAAM,QAAQ,OAAO,aAAa,QAAQ,qBAAqB;EAE/D,MAAM,SAAS,OAAO,OAAO,WAAW;GACtC,KAAK,OAAO,WAAW;IACrB,MAAM,aAAa,qBACjB,OACA,OACA,gBACA,QACA,SACA,eACA;KACE,QAAQ,MAAM,QAAQ;KACtB,iBAAiB,MAAM,QAAQ,cAAc;KAC7C,WAAW;IACb,CACF;IAEA,MAAM,MAAM,IAAI,IAAI,MAAM,WAAW;IAErC,IAAI,aAAa,IAAI,QAAQ,SAAS,MAAM,QAAQ,SAAS,IAAI,CAAC;IAClE,IAAI,aAAa,IAAI,SAAS,SAAS,MAAM,QAAQ,SAAS,KAAK,CAAC;IACpE,IAAI,QAAQ,SAAS,WAAW,KAAA,GAC9B,IAAI,aAAa,IAAI,OAAO,QAAQ,SAAS,MAAM;IACrD,MAAM,aAAa,IAAI,gBAAgB,SAAS,eAAe;IAE/D,gBAAgB,YAAY,MAAM,QAAQ,SAAS;IAEnD,MAAM,SAAS,MAAM,OAAO,uBAC1B,WAAW,eACX,KACA;KACE,eAAe,SAAS,MAAM,QAAQ,QAAQ,KAAK;KACnD,kBAAkB,SAAS,MAAM,QAAQ,QAAQ,YAAY;KAC7D,GAAI,SAAS,aAAa,SACtB;MACE,iBAAiB;MACjB,eAAe,SAAS,MAAM,QAAQ,QAAQ,SAAU;MACxD,GAAI,SAAS,kBAAkB,KAAA,IAC3B,CAAC,IACD,EAAE,QAAQ,SAAS,cAAc;KACvC,IACA,CAAC;IACP,GACA,UACF;IAEA,OAAO,eAAe;IACtB,IAAI,OAAO,eAAe,UAAU,MAAM,YAAY;IACtD,MAAM,WAAW,WAAW,SAAS;IACrC,IAAI;IAEJ,IAAI,SAAS,aAAa,SAAS;KACjC,MAAM,WAAW,MAAM,OAAO,uBAC5B,WAAW,eACX,OAAO,cACP,IAAI,IAAI,SAAS,eAAe,GAAG,GACnC,OACA,KAAA,GACA,IAAI,QAAQ,SAAS,eAAe,OAAO,CAC7C;KAEA,OAAO,eAAe;KACtB,IACE,SAAS,WAAW,OACpB,SAAS,QAAQ,IAAI,cAAc,CAAC,EAAE,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,YAAY,MACzE,oBAEF,MAAM,YAAY;KACpB,OAAO,MAAM,SAAS,KAAK;KAC3B,OAAO,eAAe;IACxB;IAEA,OAAO;KACL;KACA;KACA;IACF;GACF;GACA,OAAO;EACT,CAAC;EAED,MAAM,WACJ,SAAS,aAAa,SAClB,OAAO,aAAa,OAAO,OAAO,OAAO,OAAO,GAAG,QAAQ,QAAQ,SAAU,IAC7E,OAAO,eAAe,OAAO,OAAO,IAAI;EAE9C,MAAM,eACJ,MAAM,QAAQ,cAAc,uBAAuB,OAAO,OAAO,gBAAgB,KAAA;EAEnF,MAAM,WAAW,OAAO,cACtB,MAAM,SACN,OAAO,UACP,OACA,iBAAiB,KAAA,CACnB;EAEA,OAAO,OAAO,cAAcC,6BAA+B;GACzD,GAAG;GACH,GAAG;GACH,UAAU;IACR,WAAW;IACX,aAAa,SAAS,KAAK,OAAO,OAAO,YAAY;IACrD,GAAI,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,cAAc,SAAS,KAAK,YAAY,EAAE;IAClF,cAAc,SAAS;GACzB;EACF,CAAC;CACH,CAAC;CAED,MAAM,eAAkE,OAAO,GAC7E,oCACF,CAAC,CAAC,WAAW,OAAO;EAClB,MAAM,UAAU,OAAO,cAAc,cAAc,KAAK,GACtD,QAAQ,QAAQ,QAAQ;EAE1B,MAAM,QAAQ,OAAO,SAAS,KAAK,GACjC,WAAW,MAAM,UACjB,WAAW,QAAQ,SAAS;EAE9B,IACE,MAAM,QAAQ,cAAc,wBAC5B,MAAM,QAAQ,YAAY,iBAC1B,CAAC,QAAQ,SAAS,gBAClB,QAAQ,QAAQ,SAAS,aAAa,SAAS,YAC/C,QAAQ,QAAQ,SAAS,WAAW,SAAS,WAC5C,SAAS,aAAa,SACnB,SAAS,SAAS,UAClB,SAAS,aAAa,SAAS,YAC/B,SAAS,UAAU,KAAA,IACnB,SAAS,SAAS,YACtB,CAAC,YAAY,QAAQ,QAAQ,SAAS,QAAQ,MAAM,QAAQ,MAAM,KAClE,CAAC,YAAY,QAAQ,QAAQ,SAAS,WAAW,MAAM,QAAQ,SAAS,GAExE,OAAO,OAAO,YAAY;EAC5B,MAAM,QAAQ,OAAO,aAAa,QAAQ,qBAAqB;EAE/D,IACG,QAAQ,QAAQ,SAAS,0BAA0B,KAAA,KAClD,QAAQ,QAAQ,SAAS,yBAAyB,SACnD,QAAQ,QAAQ,SAAS,2BAA2B,KAAA,KACnD,QAAQ,QAAQ,SAAS,0BAA0B,OAErD,OAAO,OAAO,YAAY;EAE5B,MAAM,SAAS,OAAO,OAAO,WAAW;GACtC,KAAK,OAAO,WAAW;IACrB,MAAM,aAAa,qBACjB,OACA,OACA,gBACA,QACA,SACA,eACA;KACE,QAAQ,MAAM,QAAQ;KACtB,iBAAiB;KACjB,WAAW;IACb,CACF;IAEA,MAAM,aAAa,IAAI,gBAAgB,SAAS,iBAAiB;IAEjE,IAAI,eAAe,wBAAwB,OACzC,WAAW,IAAI,SAAS,MAAM,QAAQ,OAAO,KAAK,GAAG,CAAC;IACxD,gBAAgB,YAAY,MAAM,QAAQ,SAAS;IAEnD,MAAM,SAAS,MAAM,OAAO,kBAC1B,WAAW,eACX,SAAS,MAAM,QAAQ,SAAS,YAAa,GAC7C,UACF;IAEA,OAAO,eAAe;IACtB,IACE,OAAO,eAAe,YACrB,MAAM,QAAQ,YAAY,eACxB,CAAC,OAAO,iBACP,OAAO,kBAAkB,SAAS,MAAM,QAAQ,SAAS,YAAa,IAE1E,MAAM,YAAY;IACpB,MAAM,WAAW,WAAW,SAAS;IACrC,IAAI;IAEJ,IAAI,SAAS,aAAa,SAAS;KACjC,MAAM,WAAW,MAAM,OAAO,uBAC5B,WAAW,eACX,OAAO,cACP,IAAI,IAAI,SAAS,eAAe,GAAG,GACnC,OACA,KAAA,GACA,IAAI,QAAQ,SAAS,eAAe,OAAO,CAC7C;KAEA,OAAO,eAAe;KACtB,IACE,SAAS,WAAW,OACpB,SAAS,QAAQ,IAAI,cAAc,CAAC,EAAE,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,YAAY,MACzE,oBAEF,MAAM,YAAY;KACpB,OAAO,MAAM,SAAS,KAAK;KAC3B,OAAO,eAAe;IACxB;IAEA,OAAO;KACL;KACA;KACA;IACF;GACF;GACA,OAAO;EACT,CAAC;EAED,IAAI,SAAS,aAAa,QAAQ;GAChC,IAAI,SAAS,SAAS,UAAU,CAAC,SAAS,OAAO,OAAO,OAAO,YAAY;GAC3E,IAAI,OAAO,OAAO,aAAa,KAAA,GAC7B,OAAO,aAAa,OAAO,OAAO,OAAO,OAAO,GAAG,SAAS,OAAO;IACjE,UAAU,QAAQ,QAAQ;IAC1B,cAAc;GAChB,CAAC;EACL,OAGE,KAAI,OAFoB,eAAe,OAAO,OAAO,IAAI,EAAA,CAE5C,SAAS,YAAY,QAAQ,QAAQ,SAAS,SACzD,OAAO,OAAO,YAAY;EAE9B,MAAM,WAAW,OAAO,cAAc,MAAM,SAAS,OAAO,UAAU,OAAO,IAAI;EACjF,MAAM,aAAa,SAAS,cAAc,OAAO,SAAS,GAAG;EAE7D,IACG,QAAQ,QAAQ,SAAS,0BAA0B,KAAA,KAClD,QAAQ,QAAQ,SAAS,yBAAyB,cACnD,QAAQ,QAAQ,SAAS,2BAA2B,KAAA,KACnD,QAAQ,QAAQ,SAAS,0BAA0B,YAErD,OAAO,OAAO,YAAY;EAE5B,OAAO,OAAO,cAAcA,6BAA+B;GACzD,UAAU,QAAQ,QAAQ;GAC1B,GAAG;GACH,UAAU;IACR,WAAW;IACX,aAAa,SAAS,KAAK,OAAO,OAAO,YAAY;IACrD,GAAI,OAAO,OAAO,kBAAkB,KAAA,IAChC,CAAC,IACD,EAAE,cAAc,SAAS,KAAK,OAAO,OAAO,aAAa,EAAE;IAC/D,cAAc;GAChB;EACF,CAAC;CACH,CAAC;CAED,MAAM,cAAgE,OAAO,GAC3E,mCACF,CAAC,CAAC,WAAW,OAAO;EAClB,MAAM,UAAU,OAAO,cAAc,aAAa,KAAK,GACrD,QAAQ,QAAQ,QAAQ;EAE1B,MAAM,QAAQ,OAAO,SAAS,KAAK,GACjC,aAAa,MAAM,SAAS;EAE9B,IACE,MAAM,QAAQ,eAAe,YAC7B,WAAW,SAAS,iBACnB,WAAW,SAAS,qBAAqB,kBAAkB,KAAA,KAC3D,WAAW,SAAS,aACnB,QAAQ,SAAS,iBAAiB,KAAA,KAClC,WAAW,eAAe,wBAC5B,QAAQ,QAAQ,SAAS,aAAa,MAAM,SAAS,YACrD,QAAQ,QAAQ,SAAS,WAAW,MAAM,SAAS,WAClD,MAAM,SAAS,aAAa,SACzB,QAAQ,SAAS,aAAa,SAAS,UACvC,QAAQ,SAAS,aAAa,aAAa,MAAM,SAAS,WAC1D,QAAQ,SAAS,aAAa,SAAS,UAE3C,OAAO,OAAO,YAAY;EAC5B,IAAI,WAAW,SAAS,mBAAmB;GACzC,OAAO,mBAAmB,OAAO;IAC/B,UAAU,MAAM,SAAS;IACzB,gBAAgB,MAAM,SAAS;IAC/B,SAAS,QAAQ;IACjB,UAAU,QAAQ;GACpB,CAAC;GAED,OAAO;EACT;EACA,OAAO,OAAO,WAAW;GACvB,KAAK,OAAO,WAAW;IACrB,MAAM,EAAE,kBAAkB,qBACxB,OACA,OACA,gBACA,QACA,QACF;IAEA,IAAI,QAAQ,SAAS,iBAAiB,KAAA,GAAW;KAC/C,MAAM,OAAO,gBACX,eACA,SAAS,MAAM,QAAQ,SAAS,YAAY,GAC5C,EAAE,iBAAiB,gBAAgB,CACrC;KACA,OAAO,eAAe;IACxB;IACA,MAAM,OAAO,gBAAgB,eAAe,SAAS,MAAM,QAAQ,SAAS,WAAW,GAAG,EACxF,iBAAiB,eACnB,CAAC;IACD,OAAO,eAAe;GACxB;GACA,OAAO;EACT,CAAC;EAED,OAAO;CACT,CAAC;CAED,OAAO,uBAAuB,GAAG;EAC/B,uBAAuB,UAAU,KAAK,qBAAqB,KAAK,CAAC;EACjE,gBAAgB,UAAU,KAAK,cAAc,KAAK,CAAC;EACnD,eAAe,UAAU,KAAK,aAAa,KAAK,CAAC;EACjD,cAAc,UAAU,KAAK,YAAY,KAAK,CAAC;CACjD,CAAC;AACH,GAAG,IAAI;AAEP,MAAa,qCACX,YAMA,uCAAuC,OAAO,CAAC,CAAC,KAC9C,OAAO,QAAQ,mBAAmB,gBAAgB,CACpD;AAEF,MAAa,sCACX,YACG,MAAM,OAAO,wBAAwB,kCAAkC,OAAO,CAAC"}
+{"version":3,"file":"protocol.mjs","names":["M.OAuthConnectedProfile","M.OAuthConnectedConfiguration","M.OAuthConnectedTokenContext","M.OAuthConnectedTokenMaterial","M.OAuthConnectedScopes","M.OAuthConnectedGrantResponse"],"sources":["../../../../src/oauth/openid-client/connected/protocol.ts"],"sourcesContent":["import { Cause, DateTime, Effect, Layer, Redacted, Schema } from \"effect\";\nimport * as client from \"openid-client\";\n\nimport { reportAuthFailure } from \"../../../internal/diagnostics\";\nimport { RequestBindingFlowId } from \"../../../operations/requestBinding\";\nimport * as M from \"../../connectedModels\";\nimport { OAuthConnectedProtocol } from \"../../OAuthConnectedProtocol\";\nimport { OAuthProtocolRejected, OAuthUnavailable } from \"../../signInErrors\";\nimport {\n  OAuthCallbackId,\n  OAuthCodeResponse,\n  OAuthDisplayProfile,\n  OAuthExternalIdentity,\n  OAuthInstant,\n  OAuthProtocolPreparation,\n  OAuthTransactionSecrets,\n} from \"../../signInModels\";\nimport { snapshotOAuth } from \"../../signInSnapshot\";\nimport {\n  DefiniteTokenRejection,\n  type ConnectedCompatibility,\n  type ConnectedOptions,\n} from \"../compatibility\";\nimport { clientAuthentication } from \"../configuration\";\nimport { type OpenIdClientConfigurationError } from \"../models\";\nimport { decodeOidcProfile } from \"../profile\";\nimport { ProviderRevocation } from \"../ProviderRevocation\";\nimport { boundedFetch } from \"../transport\";\nimport {\n  installConnectedConfigurations,\n  sameConnectedProfile,\n  type InstalledConnectedProvider,\n} from \"./configuration\";\nimport type { OpenIdClientConnectedProtocolOptions } from \"./models\";\n\nconst unavailable = () => OAuthUnavailable.make({});\nconst rejected = () => OAuthProtocolRejected.make({});\n\nconst safe = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n  effect.pipe(\n    Effect.tapCause((cause) =>\n      Cause.hasDies(cause) ? reportAuthFailure(\"oauth-protocol\", cause) : Effect.void,\n    ),\n    Effect.catchCause((cause): Effect.Effect<never, E | OAuthUnavailable> => {\n      if (Cause.hasInterrupts(cause)) return Effect.interrupt;\n\n      return Cause.hasDies(cause) ? Effect.fail(unavailable()) : Effect.failCause(cause);\n    }),\n  );\n\n/** After possible transmission, validation/transport failures remain ambiguous. */\nconst grantError = (error: unknown) =>\n  error instanceof DefiniteTokenRejection ||\n  (error instanceof client.ClientError && error.cause instanceof DefiniteTokenRejection) ||\n  (error instanceof client.ResponseBodyError &&\n    error.status === 400 &&\n    error.error === \"invalid_grant\")\n    ? rejected()\n    : unavailable();\n\nconst prepareInput = Schema.Struct({\n  profile: M.OAuthConnectedProfile,\n  callbackId: OAuthCallbackId,\n  flowId: RequestBindingFlowId,\n});\n\nconst prepareOutput = Schema.Struct({\n  ...OAuthProtocolPreparation.fields,\n  configuration: M.OAuthConnectedConfiguration,\n});\n\nconst exchangeInput = Schema.toType(\n  Schema.Struct({\n    configuration: M.OAuthConnectedConfiguration,\n    secrets: OAuthTransactionSecrets,\n    response: OAuthCodeResponse,\n    verificationStartedAt: Schema.DateTimeUtcFromMillis,\n  }),\n);\n\nconst refreshInput = Schema.toType(\n  Schema.Struct({\n    context: M.OAuthConnectedTokenContext,\n    material: M.OAuthConnectedTokenMaterial,\n    verificationStartedAt: Schema.DateTimeUtcFromMillis,\n  }),\n);\n\nconst revokeInput = Schema.Struct({\n  context: M.OAuthConnectedTokenContext,\n  material: M.OAuthConnectedTokenMaterial,\n});\n\nconst numericDate = Schema.Finite.check(Schema.isBetween({ minimum: 0, maximum: 8640000000000 }));\n\nconst claimsSchema = Schema.Struct({\n  iss: Schema.String,\n  sub: OAuthExternalIdentity.fields.subject,\n  aud: Schema.Union([\n    Schema.String,\n    Schema.Array(Schema.String).check(Schema.isMinLength(1), Schema.isMaxLength(1)),\n  ]),\n  azp: Schema.optionalKey(Schema.String),\n  exp: numericDate,\n  iat: numericDate,\n  nbf: Schema.optionalKey(numericDate),\n  auth_time: Schema.optionalKey(numericDate),\n  nonce: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(256))),\n});\n\nconst identitySchema = Schema.Struct({\n  subject: OAuthExternalIdentity.fields.subject,\n  profile: Schema.optionalKey(OAuthDisplayProfile),\n});\n\nconst rawMetadataSchema = Schema.Struct({\n  expires_in: Schema.optionalKey(Schema.Finite.check(Schema.isGreaterThan(0))),\n  scope: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(16447))),\n});\n\nconst rawRefreshExpiry = Schema.UndefinedOr(Schema.Finite.check(Schema.isGreaterThanOrEqualTo(0)));\n\ninterface GrantMetadata {\n  readonly expiresIn?: number;\n  readonly scope?: string;\n  readonly refreshExpiresIn?: number;\n}\n\nconst privateConfiguration = <R>(\n  entry: InstalledConnectedProvider<R>,\n  fetch: client.CustomFetch,\n  timeout: number,\n  signal: AbortSignal,\n  purpose: \"grant\" | \"revoke\",\n  compatibility?: ConnectedCompatibility,\n  receipt?: Parameters<ConnectedCompatibility[\"inspectReceipt\"]>[1],\n) => {\n  const provider = entry.provider;\n\n  const authentication =\n    purpose === \"revoke\" && provider.revocation.mode === \"rfc7009\"\n      ? provider.revocation.authentication\n      : provider.authentication;\n\n  const configuration = new client.Configuration(\n    entry.metadata,\n    provider.clientId,\n    {\n      [client.clockSkew]: 0,\n      [client.clockTolerance]: 0,\n      ...(provider.protocol === \"oidc\" ? { id_token_signed_response_alg: \"RS256\" } : {}),\n    },\n    clientAuthentication(authentication),\n  );\n\n  const transport = boundedFetch(fetch, signal, entry.allowedUrls);\n  let metadata: GrantMetadata | undefined;\n\n  configuration.timeout = timeout;\n  configuration[client.customFetch] = async (url, options) => {\n    const response = await transport(url, options);\n\n    if (\n      purpose === \"grant\" &&\n      url === new URL(entry.metadata.token_endpoint!).href &&\n      (compatibility !== undefined || response.status === 200)\n    ) {\n      const body: unknown = await response.clone().json();\n\n      signal.throwIfAborted();\n      if (compatibility !== undefined) {\n        if (!receipt) throw unavailable();\n        compatibility.inspectReceipt(\n          { body, status: response.status, contentType: response.headers.get(\"content-type\") },\n          receipt,\n        );\n        signal.throwIfAborted();\n      }\n      if (response.status !== 200) return response;\n      if (metadata !== undefined) throw unavailable();\n      // oxlint-disable-next-line no-restricted-properties -- Capture bounded raw expiry values before the maintained parser's coercion.\n      const decoded = Schema.decodeUnknownSync(rawMetadataSchema)(body);\n      let refreshExpiresIn: number | undefined;\n\n      if (provider.refreshExpiry !== \"unreported\") {\n        // oxlint-disable-next-line no-restricted-properties -- The extension name and numeric semantics are explicitly installed.\n        refreshExpiresIn = Schema.decodeUnknownSync(rawRefreshExpiry)(\n          Reflect.get(body as object, provider.refreshExpiry.field),\n        );\n        if (refreshExpiresIn === 0 && provider.refreshExpiry.zero === \"unreported\")\n          refreshExpiresIn = undefined;\n      }\n      metadata = {\n        ...(decoded.expires_in === undefined ? {} : { expiresIn: decoded.expires_in }),\n        ...(decoded.scope === undefined ? {} : { scope: decoded.scope }),\n        ...(refreshExpiresIn === undefined ? {} : { refreshExpiresIn }),\n      };\n    }\n\n    return response;\n  };\n  if (provider.protocol === \"oidc\") client.enableNonRepudiationChecks(configuration);\n\n  return {\n    configuration,\n    metadata: () => {\n      if (!metadata) throw unavailable();\n\n      return metadata;\n    },\n  };\n};\n\nconst appendResources = (parameters: URLSearchParams, resources: ReadonlyArray<string>) => {\n  for (const resource of resources) parameters.append(\"resource\", resource);\n};\n\nconst sameStrings = (left: ReadonlyArray<string>, right: ReadonlyArray<string>) =>\n  left.length === right.length &&\n  [...left].sort().every((value, index) => value === [...right].sort()[index]);\n\nexport const makeConnectedProtocolWithCompatibility = Effect.fn(\n  \"makeOpenIdClientConnectedProtocol\",\n)(function* <R = never>(\n  options: ConnectedOptions<R>,\n  compatibility?: ConnectedCompatibility,\n): Effect.fn.Return<\n  OAuthConnectedProtocol[\"Service\"],\n  OpenIdClientConfigurationError | OAuthUnavailable,\n  R | ProviderRevocation\n> {\n  const decoderContext = yield* Effect.context<R>();\n  const providerRevocation = yield* ProviderRevocation;\n\n  const { installed, fetch, timeoutSeconds } = yield* installConnectedConfigurations(\n    options,\n    compatibility !== undefined,\n  );\n\n  const retained = Effect.fn(\"OpenIdClientConnected.retained\")(function* (\n    saved: M.OAuthConnectedConfiguration,\n  ) {\n    const entry = installed.find(\n      ({ provider }) =>\n        provider.provider === saved.provider &&\n        provider.configurationGeneration === saved.configurationGeneration,\n    );\n\n    const provider = entry?.provider;\n\n    if (\n      !entry ||\n      !provider ||\n      provider.protocol !== saved.protocol ||\n      provider.issuer !== saved.issuer ||\n      provider.responseIssuerMode !== saved.responseIssuerMode ||\n      provider.clientRegistrationId !== saved.profile.clientRegistrationId ||\n      !provider.profiles.some((profile) => sameConnectedProfile(profile, saved.profile)) ||\n      provider.callbacks.find((callback) => callback.callbackId === saved.callbackId)\n        ?.redirectUri !== saved.redirectUri\n    )\n      return yield* unavailable();\n\n    return entry;\n  });\n\n  const checkedStart = Effect.fn(\"OpenIdClientConnected.startedAt\")(function* (\n    start: DateTime.Utc,\n  ) {\n    const value = DateTime.toEpochMillis(start);\n\n    if (\n      !Number.isSafeInteger(value) ||\n      value < 0 ||\n      value > DateTime.toEpochMillis(yield* DateTime.now)\n    )\n      return yield* unavailable();\n\n    return value;\n  });\n\n  const tokenMetadata = Effect.fn(\"OpenIdClientConnected.tokenMetadata\")(function* (\n    profile: M.OAuthConnectedProfile,\n    metadata: GrantMetadata,\n    start: number,\n    refreshRetained: boolean,\n  ) {\n    const scopes =\n      compatibility !== undefined\n        ? yield* Effect.try({\n            try: () => compatibility.decodeScopes(metadata.scope, profile.scopes),\n            catch: unavailable,\n          })\n        : metadata.scope === undefined\n          ? profile.scopes\n          : yield* Schema.decodeEffect(M.OAuthConnectedScopes)(metadata.scope.split(\" \")).pipe(\n              Effect.mapError(unavailable),\n            );\n\n    if (new Set(scopes).size !== scopes.length || !sameStrings(scopes, profile.scopes))\n      return yield* unavailable();\n\n    const accessExpiresAtMillis =\n      metadata.expiresIn === undefined\n        ? undefined\n        : yield* Schema.decodeEffect(OAuthInstant)(\n            Math.floor(start + metadata.expiresIn * 1000),\n          ).pipe(Effect.mapError(unavailable));\n\n    const refreshExpiresAtMillis =\n      !refreshRetained || metadata.refreshExpiresIn === undefined\n        ? undefined\n        : yield* Schema.decodeEffect(OAuthInstant)(\n            Math.floor(start + metadata.refreshExpiresIn * 1000),\n          ).pipe(Effect.mapError(unavailable));\n\n    const now = DateTime.toEpochMillis(yield* DateTime.now);\n\n    if (\n      (accessExpiresAtMillis !== undefined && accessExpiresAtMillis <= now) ||\n      (refreshExpiresAtMillis !== undefined && refreshExpiresAtMillis <= now)\n    )\n      return yield* unavailable();\n\n    return {\n      scopes: [...scopes],\n      resources: [...profile.resources],\n      ...(accessExpiresAtMillis === undefined ? {} : { accessExpiresAtMillis }),\n      ...(refreshExpiresAtMillis === undefined ? {} : { refreshExpiresAtMillis }),\n    };\n  });\n\n  const oidcIdentity = Effect.fn(\"OpenIdClientConnected.oidcIdentity\")(function* (\n    entry: InstalledConnectedProvider<R>,\n    raw: unknown,\n    originalNonce: Redacted.Redacted<string>,\n    previous?: {\n      readonly identity: typeof OAuthExternalIdentity.Type;\n      readonly continuation: Extract<\n        M.OAuthConnectedTokenMaterial[\"continuation\"],\n        { readonly _tag: \"Oidc\" }\n      >;\n    },\n  ) {\n    const provider = entry.provider;\n\n    if (provider.protocol !== \"oidc\") return yield* unavailable();\n\n    // oxlint-disable-next-line no-restricted-properties -- Project authenticated foreign ID-token claims into this narrower profile.\n    const claims = yield* Schema.decodeUnknownEffect(claimsSchema)(raw).pipe(\n      Effect.mapError(unavailable),\n    );\n\n    const now = DateTime.toEpochMillis(yield* DateTime.now) / 1000;\n    const audience = typeof claims.aud === \"string\" ? claims.aud : claims.aud[0];\n\n    if (\n      claims.iss !== provider.issuer ||\n      audience !== provider.clientId ||\n      (claims.azp !== undefined && claims.azp !== provider.clientId) ||\n      claims.exp <= now ||\n      claims.iat > now ||\n      (claims.nbf !== undefined && claims.nbf > now) ||\n      (claims.auth_time !== undefined && claims.auth_time > now) ||\n      (previous\n        ? claims.sub !== previous.identity.subject ||\n          (claims.nonce !== undefined && claims.nonce !== Redacted.value(originalNonce)) ||\n          (claims.auth_time !== undefined && claims.auth_time !== previous.continuation.authTime)\n        : claims.nonce !== Redacted.value(originalNonce) ||\n          (provider.maxAgeSeconds !== undefined &&\n            (claims.auth_time === undefined ||\n              claims.auth_time + provider.maxAgeSeconds < Math.floor(now))))\n    )\n      return yield* unavailable();\n\n    const profile = yield* decodeOidcProfile(raw).pipe(Effect.mapError(unavailable));\n\n    return {\n      identity: { provider: provider.provider, issuer: provider.issuer, subject: claims.sub },\n      ...(profile === undefined ? {} : { profile }),\n      continuation: previous?.continuation ?? {\n        _tag: \"Oidc\" as const,\n        clientId: provider.clientId,\n        nonce: Redacted.make(Redacted.value(originalNonce)),\n        ...(claims.auth_time === undefined ? {} : { authTime: claims.auth_time }),\n      },\n    };\n  });\n\n  const decodeIdentity = Effect.fn(\"OpenIdClientConnected.decodeIdentity\")(function* (\n    entry: InstalledConnectedProvider<R>,\n    body: unknown,\n  ) {\n    if (entry.provider.protocol !== \"oauth\") return yield* unavailable();\n    const decoder = entry.provider.identitySource.decodeIdentity;\n\n    const result = yield* Effect.suspend(() => decoder(body)).pipe(\n      Effect.provideContext(decoderContext),\n      Effect.catchCause((cause) => {\n        const recovered = Cause.hasInterrupts(cause)\n          ? Effect.interrupt\n          : Effect.fail(unavailable());\n\n        if (\n          cause.reasons.length === 1 &&\n          cause.reasons[0]?._tag === \"Fail\" &&\n          Schema.is(OAuthProtocolRejected)(cause.reasons[0].error)\n        )\n          return recovered;\n\n        return reportAuthFailure(\"oauth-identity\", cause).pipe(Effect.andThen(recovered));\n      }),\n    );\n\n    const value = yield* Schema.decodeEffect(identitySchema)(result).pipe(\n      Effect.mapError(unavailable),\n    );\n\n    return {\n      identity: {\n        provider: entry.provider.provider,\n        issuer: entry.provider.issuer,\n        subject: value.subject,\n      },\n      ...(value.profile === undefined ? {} : { profile: value.profile }),\n      continuation: { _tag: \"OAuth\" as const },\n    };\n  });\n\n  const prepareAuthorization: OAuthConnectedProtocol[\"Service\"][\"prepareAuthorization\"] = Effect.fn(\n    \"OpenIdClientConnected.prepareAuthorization\",\n  )(function* (input) {\n    const request = yield* snapshotOAuth(prepareInput, input);\n\n    const entry = installed.find(\n      ({ provider }) =>\n        provider.provider === request.profile.provider &&\n        provider.issuance === \"active\" &&\n        provider.profiles.some(\n          (profile) =>\n            profile.issuance === \"active\" && sameConnectedProfile(profile, request.profile),\n        ),\n    );\n\n    const callback = entry?.provider.callbacks.find(\n      (value) => value.callbackId === request.callbackId,\n    );\n\n    if (!entry || !callback || request.profile.issuance !== \"active\") return yield* rejected();\n\n    const result = yield* Effect.tryPromise({\n      try: async (signal) => {\n        const { configuration } = privateConfiguration(\n          entry,\n          fetch,\n          timeoutSeconds,\n          signal,\n          \"grant\",\n        );\n\n        const state = client.randomState(),\n          verifier = client.randomPKCECodeVerifier(),\n          nonce = entry.provider.protocol === \"oidc\" ? client.randomNonce() : undefined;\n\n        const challenge = await client.calculatePKCECodeChallenge(verifier);\n\n        signal.throwIfAborted();\n        const parameters = new URLSearchParams(entry.provider.authorizationParameters);\n\n        for (const [key, value] of Object.entries({\n          response_type: \"code\",\n          response_mode: \"query\",\n          redirect_uri: callback.redirectUri,\n          scope: (\n            compatibility?.authorizationScopes(\n              request.profile.scopes,\n              request.profile.retention === \"access-and-refresh\",\n            ) ?? request.profile.scopes\n          ).join(\" \"),\n          state,\n          code_challenge: challenge,\n          code_challenge_method: \"S256\",\n        }))\n          parameters.set(key, value);\n        if (nonce !== undefined) parameters.set(\"nonce\", nonce);\n        if (entry.provider.protocol === \"oidc\" && entry.provider.maxAgeSeconds !== undefined)\n          parameters.set(\"max_age\", String(entry.provider.maxAgeSeconds));\n        appendResources(parameters, request.profile.resources);\n\n        return {\n          configuration: {\n            provider: entry.provider.provider,\n            protocol: entry.provider.protocol,\n            configurationGeneration: entry.provider.configurationGeneration,\n            issuer: entry.provider.issuer,\n            responseIssuerMode: entry.provider.responseIssuerMode,\n            callbackId: callback.callbackId,\n            redirectUri: callback.redirectUri,\n            profile: request.profile,\n          },\n          authorizationUrl: Redacted.make(\n            client.buildAuthorizationUrl(configuration, parameters).href,\n          ),\n          secrets: {\n            namespace: \"effect-auth/oauth-transaction-secrets/v1\" as const,\n            state: Redacted.make(state),\n            pkceVerifier: Redacted.make(verifier),\n            ...(nonce === undefined ? {} : { oidcNonce: Redacted.make(nonce) }),\n          },\n        };\n      },\n      catch: unavailable,\n    });\n\n    return yield* snapshotOAuth(prepareOutput, result);\n  });\n\n  const exchangeGrant: OAuthConnectedProtocol[\"Service\"][\"exchangeGrant\"] = Effect.fn(\n    \"OpenIdClientConnected.exchangeGrant\",\n  )(function* (input) {\n    const request = yield* snapshotOAuth(exchangeInput, input),\n      saved = request.configuration;\n\n    const entry = yield* retained(saved),\n      provider = entry.provider;\n\n    if (\n      (provider.protocol === \"oidc\") !== (request.secrets.oidcNonce !== undefined) ||\n      Redacted.value(request.response.state) !== Redacted.value(request.secrets.state) ||\n      (provider.responseIssuerMode === \"required\"\n        ? request.response.issuer !== provider.issuer\n        : request.response.issuer !== undefined)\n    )\n      return yield* rejected();\n    const start = yield* checkedStart(request.verificationStartedAt);\n\n    const result = yield* Effect.tryPromise({\n      try: async (signal) => {\n        const invocation = privateConfiguration(\n          entry,\n          fetch,\n          timeoutSeconds,\n          signal,\n          \"grant\",\n          compatibility,\n          {\n            scopes: saved.profile.scopes,\n            refreshRequired: saved.profile.retention === \"access-and-refresh\",\n            operation: \"authorization_code\",\n          },\n        );\n\n        const url = new URL(saved.redirectUri);\n\n        url.searchParams.set(\"code\", Redacted.value(request.response.code));\n        url.searchParams.set(\"state\", Redacted.value(request.response.state));\n        if (request.response.issuer !== undefined)\n          url.searchParams.set(\"iss\", request.response.issuer);\n        const parameters = new URLSearchParams(provider.tokenParameters);\n\n        appendResources(parameters, saved.profile.resources);\n\n        const tokens = await client.authorizationCodeGrant(\n          invocation.configuration,\n          url,\n          {\n            expectedState: Redacted.value(request.secrets.state),\n            pkceCodeVerifier: Redacted.value(request.secrets.pkceVerifier),\n            ...(provider.protocol === \"oidc\"\n              ? {\n                  idTokenExpected: true,\n                  expectedNonce: Redacted.value(request.secrets.oidcNonce!),\n                  ...(provider.maxAgeSeconds === undefined\n                    ? {}\n                    : { maxAge: provider.maxAgeSeconds }),\n                }\n              : {}),\n          },\n          parameters,\n        );\n\n        signal.throwIfAborted();\n        if (tokens.token_type !== \"bearer\") throw unavailable();\n        const metadata = invocation.metadata();\n        let body: unknown;\n\n        if (provider.protocol === \"oauth\") {\n          const response = await client.fetchProtectedResource(\n            invocation.configuration,\n            tokens.access_token,\n            new URL(provider.identitySource.url),\n            \"GET\",\n            undefined,\n            new Headers(provider.identitySource.headers),\n          );\n\n          signal.throwIfAborted();\n          if (\n            response.status !== 200 ||\n            response.headers.get(\"content-type\")?.split(\";\", 1)[0]?.trim().toLowerCase() !==\n              \"application/json\"\n          )\n            throw unavailable();\n          body = await response.json();\n          signal.throwIfAborted();\n        }\n\n        return {\n          tokens,\n          metadata,\n          body,\n        };\n      },\n      catch: grantError,\n    });\n\n    const identity =\n      provider.protocol === \"oidc\"\n        ? yield* oidcIdentity(entry, result.tokens.claims(), request.secrets.oidcNonce!)\n        : yield* decodeIdentity(entry, result.body);\n\n    const refreshToken =\n      saved.profile.retention === \"access-and-refresh\" ? result.tokens.refresh_token : undefined;\n\n    const metadata = yield* tokenMetadata(\n      saved.profile,\n      result.metadata,\n      start,\n      refreshToken !== undefined,\n    );\n\n    return yield* snapshotOAuth(M.OAuthConnectedGrantResponse, {\n      ...identity,\n      ...metadata,\n      material: {\n        namespace: \"effect-auth/oauth-connected-token-material/v1\",\n        accessToken: Redacted.make(result.tokens.access_token),\n        ...(refreshToken === undefined ? {} : { refreshToken: Redacted.make(refreshToken) }),\n        continuation: identity.continuation,\n      },\n    });\n  });\n\n  const refreshGrant: OAuthConnectedProtocol[\"Service\"][\"refreshGrant\"] = Effect.fn(\n    \"OpenIdClientConnected.refreshGrant\",\n  )(function* (input) {\n    const request = yield* snapshotOAuth(refreshInput, input),\n      saved = request.context.configuration;\n\n    const entry = yield* retained(saved),\n      provider = entry.provider,\n      previous = request.material.continuation;\n\n    if (\n      saved.profile.retention !== \"access-and-refresh\" ||\n      saved.profile.refresh === \"unsupported\" ||\n      !request.material.refreshToken ||\n      request.context.identity.provider !== provider.provider ||\n      request.context.identity.issuer !== provider.issuer ||\n      (provider.protocol === \"oidc\"\n        ? previous._tag !== \"Oidc\" ||\n          previous.clientId !== provider.clientId ||\n          previous.nonce === undefined\n        : previous._tag !== \"OAuth\") ||\n      !sameStrings(request.context.metadata.scopes, saved.profile.scopes) ||\n      !sameStrings(request.context.metadata.resources, saved.profile.resources)\n    )\n      return yield* unavailable();\n    const start = yield* checkedStart(request.verificationStartedAt);\n\n    if (\n      (request.context.metadata.refreshUseUntilMillis !== undefined &&\n        request.context.metadata.refreshUseUntilMillis <= start) ||\n      (request.context.metadata.refreshExpiresAtMillis !== undefined &&\n        request.context.metadata.refreshExpiresAtMillis <= start)\n    )\n      return yield* unavailable();\n\n    const result = yield* Effect.tryPromise({\n      try: async (signal) => {\n        const invocation = privateConfiguration(\n          entry,\n          fetch,\n          timeoutSeconds,\n          signal,\n          \"grant\",\n          compatibility,\n          {\n            scopes: saved.profile.scopes,\n            refreshRequired: true,\n            operation: \"refresh_token\",\n          },\n        );\n\n        const parameters = new URLSearchParams(provider.refreshParameters);\n\n        if (compatibility?.includeRefreshScope !== false)\n          parameters.set(\"scope\", saved.profile.scopes.join(\" \"));\n        appendResources(parameters, saved.profile.resources);\n\n        const tokens = await client.refreshTokenGrant(\n          invocation.configuration,\n          Redacted.value(request.material.refreshToken!),\n          parameters,\n        );\n\n        signal.throwIfAborted();\n        if (\n          tokens.token_type !== \"bearer\" ||\n          (saved.profile.refresh === \"rotating\" &&\n            (!tokens.refresh_token ||\n              tokens.refresh_token === Redacted.value(request.material.refreshToken!)))\n        )\n          throw unavailable();\n        const metadata = invocation.metadata();\n        let body: unknown;\n\n        if (provider.protocol === \"oauth\") {\n          const response = await client.fetchProtectedResource(\n            invocation.configuration,\n            tokens.access_token,\n            new URL(provider.identitySource.url),\n            \"GET\",\n            undefined,\n            new Headers(provider.identitySource.headers),\n          );\n\n          signal.throwIfAborted();\n          if (\n            response.status !== 200 ||\n            response.headers.get(\"content-type\")?.split(\";\", 1)[0]?.trim().toLowerCase() !==\n              \"application/json\"\n          )\n            throw unavailable();\n          body = await response.json();\n          signal.throwIfAborted();\n        }\n\n        return {\n          tokens,\n          metadata,\n          body,\n        };\n      },\n      catch: grantError,\n    });\n\n    if (provider.protocol === \"oidc\") {\n      if (previous._tag !== \"Oidc\" || !previous.nonce) return yield* unavailable();\n      if (result.tokens.id_token !== undefined)\n        yield* oidcIdentity(entry, result.tokens.claims(), previous.nonce, {\n          identity: request.context.identity,\n          continuation: previous,\n        });\n    } else {\n      const identity = yield* decodeIdentity(entry, result.body);\n\n      if (identity.identity.subject !== request.context.identity.subject)\n        return yield* unavailable();\n    }\n    const metadata = yield* tokenMetadata(saved.profile, result.metadata, start, true);\n    const finishedAt = DateTime.toEpochMillis(yield* DateTime.now);\n\n    if (\n      (request.context.metadata.refreshUseUntilMillis !== undefined &&\n        request.context.metadata.refreshUseUntilMillis <= finishedAt) ||\n      (request.context.metadata.refreshExpiresAtMillis !== undefined &&\n        request.context.metadata.refreshExpiresAtMillis <= finishedAt)\n    )\n      return yield* unavailable();\n\n    return yield* snapshotOAuth(M.OAuthConnectedGrantResponse, {\n      identity: request.context.identity,\n      ...metadata,\n      material: {\n        namespace: \"effect-auth/oauth-connected-token-material/v1\",\n        accessToken: Redacted.make(result.tokens.access_token),\n        ...(result.tokens.refresh_token === undefined\n          ? {}\n          : { refreshToken: Redacted.make(result.tokens.refresh_token) }),\n        continuation: previous,\n      },\n    });\n  });\n\n  const revokeGrant: OAuthConnectedProtocol[\"Service\"][\"revokeGrant\"] = Effect.fn(\n    \"OpenIdClientConnected.revokeGrant\",\n  )(function* (input) {\n    const request = yield* snapshotOAuth(revokeInput, input),\n      saved = request.context.configuration;\n\n    const entry = yield* retained(saved),\n      revocation = entry.provider.revocation;\n\n    if (\n      saved.profile.revocation !== \"cohort\" ||\n      revocation.mode === \"unsupported\" ||\n      (revocation.mode === \"provider-cohort\" && compatibility === undefined) ||\n      (revocation.mode === \"rfc7009\" &&\n        request.material.refreshToken !== undefined &&\n        revocation.tokenTypes !== \"access-and-refresh\") ||\n      request.context.identity.provider !== entry.provider.provider ||\n      request.context.identity.issuer !== entry.provider.issuer ||\n      (entry.provider.protocol === \"oidc\"\n        ? request.material.continuation._tag !== \"Oidc\" ||\n          request.material.continuation.clientId !== entry.provider.clientId\n        : request.material.continuation._tag !== \"OAuth\")\n    )\n      return yield* unavailable();\n    if (revocation.mode === \"provider-cohort\") {\n      yield* providerRevocation.revoke({\n        clientId: entry.provider.clientId,\n        authentication: entry.provider.authentication,\n        context: request.context,\n        material: request.material,\n      });\n\n      return \"Confirmed\" as const;\n    }\n    yield* Effect.tryPromise({\n      try: async (signal) => {\n        const { configuration } = privateConfiguration(\n          entry,\n          fetch,\n          timeoutSeconds,\n          signal,\n          \"revoke\",\n        );\n\n        if (request.material.refreshToken !== undefined) {\n          await client.tokenRevocation(\n            configuration,\n            Redacted.value(request.material.refreshToken),\n            { token_type_hint: \"refresh_token\" },\n          );\n          signal.throwIfAborted();\n        }\n        await client.tokenRevocation(configuration, Redacted.value(request.material.accessToken), {\n          token_type_hint: \"access_token\",\n        });\n        signal.throwIfAborted();\n      },\n      catch: unavailable,\n    });\n\n    return \"Confirmed\" as const;\n  });\n\n  return OAuthConnectedProtocol.of({\n    prepareAuthorization: (input) => safe(prepareAuthorization(input)),\n    exchangeGrant: (input) => safe(exchangeGrant(input)),\n    refreshGrant: (input) => safe(refreshGrant(input)),\n    revokeGrant: (input) => safe(revokeGrant(input)),\n  });\n}, safe);\n\nexport const makeOpenIdClientConnectedProtocol = <R = never>(\n  options: OpenIdClientConnectedProtocolOptions<R>,\n): Effect.Effect<\n  OAuthConnectedProtocol[\"Service\"],\n  OpenIdClientConfigurationError | OAuthUnavailable,\n  R\n> =>\n  makeConnectedProtocolWithCompatibility(options).pipe(\n    Effect.provide(ProviderRevocation.layerUnsupported),\n  );\n\nexport const openIdClientConnectedProtocolLayer = <R = never>(\n  options: OpenIdClientConnectedProtocolOptions<R>,\n) => Layer.effect(OAuthConnectedProtocol, makeOpenIdClientConnectedProtocol(options));\n"],"mappings":";;;;;;;;;;;;;;;;AAmCA,MAAM,oBAAoB,iBAAiB,KAAK,CAAC,CAAC;AAClD,MAAM,iBAAiB,sBAAsB,KAAK,CAAC,CAAC;AAEpD,MAAM,QAAiB,WACrB,OAAO,KACL,OAAO,UAAU,UACf,MAAM,QAAQ,KAAK,IAAI,kBAAkB,kBAAkB,KAAK,IAAI,OAAO,IAC7E,GACA,OAAO,YAAY,UAAsD;CACvE,IAAI,MAAM,cAAc,KAAK,GAAG,OAAO,OAAO;CAE9C,OAAO,MAAM,QAAQ,KAAK,IAAI,OAAO,KAAK,YAAY,CAAC,IAAI,OAAO,UAAU,KAAK;AACnF,CAAC,CACH;;AAGF,MAAM,cAAc,UAClB,iBAAiB,0BAChB,iBAAiB,OAAO,eAAe,MAAM,iBAAiB,0BAC9D,iBAAiB,OAAO,qBACvB,MAAM,WAAW,OACjB,MAAM,UAAU,kBACd,SAAS,IACT,YAAY;AAElB,MAAM,eAAe,OAAO,OAAO;CACjC,SAASA;CACT,YAAY;CACZ,QAAQ;AACV,CAAC;AAED,MAAM,gBAAgB,OAAO,OAAO;CAClC,GAAG,yBAAyB;CAC5B,eAAeC;AACjB,CAAC;AAED,MAAM,gBAAgB,OAAO,OAC3B,OAAO,OAAO;CACZ,eAAeA;CACf,SAAS;CACT,UAAU;CACV,uBAAuB,OAAO;AAChC,CAAC,CACH;AAEA,MAAM,eAAe,OAAO,OAC1B,OAAO,OAAO;CACZ,SAASC;CACT,UAAUC;CACV,uBAAuB,OAAO;AAChC,CAAC,CACH;AAEA,MAAM,cAAc,OAAO,OAAO;CAChC,SAASD;CACT,UAAUC;AACZ,CAAC;AAED,MAAM,cAAc,OAAO,OAAO,MAAM,OAAO,UAAU;CAAE,SAAS;CAAG,SAAS;AAAc,CAAC,CAAC;AAEhG,MAAM,eAAe,OAAO,OAAO;CACjC,KAAK,OAAO;CACZ,KAAK,sBAAsB,OAAO;CAClC,KAAK,OAAO,MAAM,CAChB,OAAO,QACP,OAAO,MAAM,OAAO,MAAM,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,CAAC,CAAC,CAChF,CAAC;CACD,KAAK,OAAO,YAAY,OAAO,MAAM;CACrC,KAAK;CACL,KAAK;CACL,KAAK,OAAO,YAAY,WAAW;CACnC,WAAW,OAAO,YAAY,WAAW;CACzC,OAAO,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,iBAAiB,OAAO,OAAO;CACnC,SAAS,sBAAsB,OAAO;CACtC,SAAS,OAAO,YAAY,mBAAmB;AACjD,CAAC;AAED,MAAM,oBAAoB,OAAO,OAAO;CACtC,YAAY,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,cAAc,CAAC,CAAC,CAAC;CAC3E,OAAO,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,KAAK,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,mBAAmB,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,uBAAuB,CAAC,CAAC,CAAC;AAQjG,MAAM,wBACJ,OACA,OACA,SACA,QACA,SACA,eACA,YACG;CACH,MAAM,WAAW,MAAM;CAEvB,MAAM,iBACJ,YAAY,YAAY,SAAS,WAAW,SAAS,YACjD,SAAS,WAAW,iBACpB,SAAS;CAEf,MAAM,gBAAgB,IAAI,OAAO,cAC/B,MAAM,UACN,SAAS,UACT;GACG,OAAO,YAAY;GACnB,OAAO,iBAAiB;EACzB,GAAI,SAAS,aAAa,SAAS,EAAE,8BAA8B,QAAQ,IAAI,CAAC;CAClF,GACA,qBAAqB,cAAc,CACrC;CAEA,MAAM,YAAY,aAAa,OAAO,QAAQ,MAAM,WAAW;CAC/D,IAAI;CAEJ,cAAc,UAAU;CACxB,cAAc,OAAO,eAAe,OAAO,KAAK,YAAY;EAC1D,MAAM,WAAW,MAAM,UAAU,KAAK,OAAO;EAE7C,IACE,YAAY,WACZ,QAAQ,IAAI,IAAI,MAAM,SAAS,cAAe,CAAC,CAAC,SAC/C,kBAAkB,KAAA,KAAa,SAAS,WAAW,MACpD;GACA,MAAM,OAAgB,MAAM,SAAS,MAAM,CAAC,CAAC,KAAK;GAElD,OAAO,eAAe;GACtB,IAAI,kBAAkB,KAAA,GAAW;IAC/B,IAAI,CAAC,SAAS,MAAM,YAAY;IAChC,cAAc,eACZ;KAAE;KAAM,QAAQ,SAAS;KAAQ,aAAa,SAAS,QAAQ,IAAI,cAAc;IAAE,GACnF,OACF;IACA,OAAO,eAAe;GACxB;GACA,IAAI,SAAS,WAAW,KAAK,OAAO;GACpC,IAAI,aAAa,KAAA,GAAW,MAAM,YAAY;GAE9C,MAAM,UAAU,OAAO,kBAAkB,iBAAiB,CAAC,CAAC,IAAI;GAChE,IAAI;GAEJ,IAAI,SAAS,kBAAkB,cAAc;IAE3C,mBAAmB,OAAO,kBAAkB,gBAAgB,CAAC,CAC3D,QAAQ,IAAI,MAAgB,SAAS,cAAc,KAAK,CAC1D;IACA,IAAI,qBAAqB,KAAK,SAAS,cAAc,SAAS,cAC5D,mBAAmB,KAAA;GACvB;GACA,WAAW;IACT,GAAI,QAAQ,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,QAAQ,WAAW;IAC5E,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;IAC9D,GAAI,qBAAqB,KAAA,IAAY,CAAC,IAAI,EAAE,iBAAiB;GAC/D;EACF;EAEA,OAAO;CACT;CACA,IAAI,SAAS,aAAa,QAAQ,OAAO,2BAA2B,aAAa;CAEjF,OAAO;EACL;EACA,gBAAgB;GACd,IAAI,CAAC,UAAU,MAAM,YAAY;GAEjC,OAAO;EACT;CACF;AACF;AAEA,MAAM,mBAAmB,YAA6B,cAAqC;CACzF,KAAK,MAAM,YAAY,WAAW,WAAW,OAAO,YAAY,QAAQ;AAC1E;AAEA,MAAM,eAAe,MAA6B,UAChD,KAAK,WAAW,MAAM,UACtB,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,OAAO,UAAU,UAAU,CAAC,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM;AAE7E,MAAa,yCAAyC,OAAO,GAC3D,mCACF,CAAC,CAAC,WACA,SACA,eAKA;CACA,MAAM,iBAAiB,OAAO,OAAO,QAAW;CAChD,MAAM,qBAAqB,OAAO;CAElC,MAAM,EAAE,WAAW,OAAO,mBAAmB,OAAO,+BAClD,SACA,kBAAkB,KAAA,CACpB;CAEA,MAAM,WAAW,OAAO,GAAG,gCAAgC,CAAC,CAAC,WAC3D,OACA;EACA,MAAM,QAAQ,UAAU,MACrB,EAAE,eACD,SAAS,aAAa,MAAM,YAC5B,SAAS,4BAA4B,MAAM,uBAC/C;EAEA,MAAM,WAAW,OAAO;EAExB,IACE,CAAC,SACD,CAAC,YACD,SAAS,aAAa,MAAM,YAC5B,SAAS,WAAW,MAAM,UAC1B,SAAS,uBAAuB,MAAM,sBACtC,SAAS,yBAAyB,MAAM,QAAQ,wBAChD,CAAC,SAAS,SAAS,MAAM,YAAY,qBAAqB,SAAS,MAAM,OAAO,CAAC,KACjF,SAAS,UAAU,MAAM,aAAa,SAAS,eAAe,MAAM,UAAU,CAAC,EAC3E,gBAAgB,MAAM,aAE1B,OAAO,OAAO,YAAY;EAE5B,OAAO;CACT,CAAC;CAED,MAAM,eAAe,OAAO,GAAG,iCAAiC,CAAC,CAAC,WAChE,OACA;EACA,MAAM,QAAQ,SAAS,cAAc,KAAK;EAE1C,IACE,CAAC,OAAO,cAAc,KAAK,KAC3B,QAAQ,KACR,QAAQ,SAAS,cAAc,OAAO,SAAS,GAAG,GAElD,OAAO,OAAO,YAAY;EAE5B,OAAO;CACT,CAAC;CAED,MAAM,gBAAgB,OAAO,GAAG,qCAAqC,CAAC,CAAC,WACrE,SACA,UACA,OACA,iBACA;EACA,MAAM,SACJ,kBAAkB,KAAA,IACd,OAAO,OAAO,IAAI;GAChB,WAAW,cAAc,aAAa,SAAS,OAAO,QAAQ,MAAM;GACpE,OAAO;EACT,CAAC,IACD,SAAS,UAAU,KAAA,IACjB,QAAQ,SACR,OAAO,OAAO,aAAaC,oBAAsB,CAAC,CAAC,SAAS,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,KAC5E,OAAO,SAAS,WAAW,CAC7B;EAER,IAAI,IAAI,IAAI,MAAM,CAAC,CAAC,SAAS,OAAO,UAAU,CAAC,YAAY,QAAQ,QAAQ,MAAM,GAC/E,OAAO,OAAO,YAAY;EAE5B,MAAM,wBACJ,SAAS,cAAc,KAAA,IACnB,KAAA,IACA,OAAO,OAAO,aAAa,YAAY,CAAC,CACtC,KAAK,MAAM,QAAQ,SAAS,YAAY,GAAI,CAC9C,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;EAEzC,MAAM,yBACJ,CAAC,mBAAmB,SAAS,qBAAqB,KAAA,IAC9C,KAAA,IACA,OAAO,OAAO,aAAa,YAAY,CAAC,CACtC,KAAK,MAAM,QAAQ,SAAS,mBAAmB,GAAI,CACrD,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;EAEzC,MAAM,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG;EAEtD,IACG,0BAA0B,KAAA,KAAa,yBAAyB,OAChE,2BAA2B,KAAA,KAAa,0BAA0B,KAEnE,OAAO,OAAO,YAAY;EAE5B,OAAO;GACL,QAAQ,CAAC,GAAG,MAAM;GAClB,WAAW,CAAC,GAAG,QAAQ,SAAS;GAChC,GAAI,0BAA0B,KAAA,IAAY,CAAC,IAAI,EAAE,sBAAsB;GACvE,GAAI,2BAA2B,KAAA,IAAY,CAAC,IAAI,EAAE,uBAAuB;EAC3E;CACF,CAAC;CAED,MAAM,eAAe,OAAO,GAAG,oCAAoC,CAAC,CAAC,WACnE,OACA,KACA,eACA,UAOA;EACA,MAAM,WAAW,MAAM;EAEvB,IAAI,SAAS,aAAa,QAAQ,OAAO,OAAO,YAAY;EAG5D,MAAM,SAAS,OAAO,OAAO,oBAAoB,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,KAClE,OAAO,SAAS,WAAW,CAC7B;EAEA,MAAM,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG,IAAI;EAC1D,MAAM,WAAW,OAAO,OAAO,QAAQ,WAAW,OAAO,MAAM,OAAO,IAAI;EAE1E,IACE,OAAO,QAAQ,SAAS,UACxB,aAAa,SAAS,YACrB,OAAO,QAAQ,KAAA,KAAa,OAAO,QAAQ,SAAS,YACrD,OAAO,OAAO,OACd,OAAO,MAAM,OACZ,OAAO,QAAQ,KAAA,KAAa,OAAO,MAAM,OACzC,OAAO,cAAc,KAAA,KAAa,OAAO,YAAY,QACrD,WACG,OAAO,QAAQ,SAAS,SAAS,WAChC,OAAO,UAAU,KAAA,KAAa,OAAO,UAAU,SAAS,MAAM,aAAa,KAC3E,OAAO,cAAc,KAAA,KAAa,OAAO,cAAc,SAAS,aAAa,WAC9E,OAAO,UAAU,SAAS,MAAM,aAAa,KAC5C,SAAS,kBAAkB,KAAA,MACzB,OAAO,cAAc,KAAA,KACpB,OAAO,YAAY,SAAS,gBAAgB,KAAK,MAAM,GAAG,KAElE,OAAO,OAAO,YAAY;EAE5B,MAAM,UAAU,OAAO,kBAAkB,GAAG,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;EAE/E,OAAO;GACL,UAAU;IAAE,UAAU,SAAS;IAAU,QAAQ,SAAS;IAAQ,SAAS,OAAO;GAAI;GACtF,GAAI,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ;GAC3C,cAAc,UAAU,gBAAgB;IACtC,MAAM;IACN,UAAU,SAAS;IACnB,OAAO,SAAS,KAAK,SAAS,MAAM,aAAa,CAAC;IAClD,GAAI,OAAO,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU,OAAO,UAAU;GACzE;EACF;CACF,CAAC;CAED,MAAM,iBAAiB,OAAO,GAAG,sCAAsC,CAAC,CAAC,WACvE,OACA,MACA;EACA,IAAI,MAAM,SAAS,aAAa,SAAS,OAAO,OAAO,YAAY;EACnE,MAAM,UAAU,MAAM,SAAS,eAAe;EAE9C,MAAM,SAAS,OAAO,OAAO,cAAc,QAAQ,IAAI,CAAC,CAAC,CAAC,KACxD,OAAO,eAAe,cAAc,GACpC,OAAO,YAAY,UAAU;GAC3B,MAAM,YAAY,MAAM,cAAc,KAAK,IACvC,OAAO,YACP,OAAO,KAAK,YAAY,CAAC;GAE7B,IACE,MAAM,QAAQ,WAAW,KACzB,MAAM,QAAQ,EAAE,EAAE,SAAS,UAC3B,OAAO,GAAG,qBAAqB,CAAC,CAAC,MAAM,QAAQ,EAAE,CAAC,KAAK,GAEvD,OAAO;GAET,OAAO,kBAAkB,kBAAkB,KAAK,CAAC,CAAC,KAAK,OAAO,QAAQ,SAAS,CAAC;EAClF,CAAC,CACH;EAEA,MAAM,QAAQ,OAAO,OAAO,aAAa,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,KAC/D,OAAO,SAAS,WAAW,CAC7B;EAEA,OAAO;GACL,UAAU;IACR,UAAU,MAAM,SAAS;IACzB,QAAQ,MAAM,SAAS;IACvB,SAAS,MAAM;GACjB;GACA,GAAI,MAAM,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;GAChE,cAAc,EAAE,MAAM,QAAiB;EACzC;CACF,CAAC;CAED,MAAM,uBAAkF,OAAO,GAC7F,4CACF,CAAC,CAAC,WAAW,OAAO;EAClB,MAAM,UAAU,OAAO,cAAc,cAAc,KAAK;EAExD,MAAM,QAAQ,UAAU,MACrB,EAAE,eACD,SAAS,aAAa,QAAQ,QAAQ,YACtC,SAAS,aAAa,YACtB,SAAS,SAAS,MACf,YACC,QAAQ,aAAa,YAAY,qBAAqB,SAAS,QAAQ,OAAO,CAClF,CACJ;EAEA,MAAM,WAAW,OAAO,SAAS,UAAU,MACxC,UAAU,MAAM,eAAe,QAAQ,UAC1C;EAEA,IAAI,CAAC,SAAS,CAAC,YAAY,QAAQ,QAAQ,aAAa,UAAU,OAAO,OAAO,SAAS;EAEzF,MAAM,SAAS,OAAO,OAAO,WAAW;GACtC,KAAK,OAAO,WAAW;IACrB,MAAM,EAAE,kBAAkB,qBACxB,OACA,OACA,gBACA,QACA,OACF;IAEA,MAAM,QAAQ,OAAO,YAAY,GAC/B,WAAW,OAAO,uBAAuB,GACzC,QAAQ,MAAM,SAAS,aAAa,SAAS,OAAO,YAAY,IAAI,KAAA;IAEtE,MAAM,YAAY,MAAM,OAAO,2BAA2B,QAAQ;IAElE,OAAO,eAAe;IACtB,MAAM,aAAa,IAAI,gBAAgB,MAAM,SAAS,uBAAuB;IAE7E,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ;KACxC,eAAe;KACf,eAAe;KACf,cAAc,SAAS;KACvB,QACE,eAAe,oBACb,QAAQ,QAAQ,QAChB,QAAQ,QAAQ,cAAc,oBAChC,KAAK,QAAQ,QAAQ,OAAA,CACrB,KAAK,GAAG;KACV;KACA,gBAAgB;KAChB,uBAAuB;IACzB,CAAC,GACC,WAAW,IAAI,KAAK,KAAK;IAC3B,IAAI,UAAU,KAAA,GAAW,WAAW,IAAI,SAAS,KAAK;IACtD,IAAI,MAAM,SAAS,aAAa,UAAU,MAAM,SAAS,kBAAkB,KAAA,GACzE,WAAW,IAAI,WAAW,OAAO,MAAM,SAAS,aAAa,CAAC;IAChE,gBAAgB,YAAY,QAAQ,QAAQ,SAAS;IAErD,OAAO;KACL,eAAe;MACb,UAAU,MAAM,SAAS;MACzB,UAAU,MAAM,SAAS;MACzB,yBAAyB,MAAM,SAAS;MACxC,QAAQ,MAAM,SAAS;MACvB,oBAAoB,MAAM,SAAS;MACnC,YAAY,SAAS;MACrB,aAAa,SAAS;MACtB,SAAS,QAAQ;KACnB;KACA,kBAAkB,SAAS,KACzB,OAAO,sBAAsB,eAAe,UAAU,CAAC,CAAC,IAC1D;KACA,SAAS;MACP,WAAW;MACX,OAAO,SAAS,KAAK,KAAK;MAC1B,cAAc,SAAS,KAAK,QAAQ;MACpC,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,SAAS,KAAK,KAAK,EAAE;KACnE;IACF;GACF;GACA,OAAO;EACT,CAAC;EAED,OAAO,OAAO,cAAc,eAAe,MAAM;CACnD,CAAC;CAED,MAAM,gBAAoE,OAAO,GAC/E,qCACF,CAAC,CAAC,WAAW,OAAO;EAClB,MAAM,UAAU,OAAO,cAAc,eAAe,KAAK,GACvD,QAAQ,QAAQ;EAElB,MAAM,QAAQ,OAAO,SAAS,KAAK,GACjC,WAAW,MAAM;EAEnB,IACG,SAAS,aAAa,YAAa,QAAQ,QAAQ,cAAc,KAAA,MAClE,SAAS,MAAM,QAAQ,SAAS,KAAK,MAAM,SAAS,MAAM,QAAQ,QAAQ,KAAK,MAC9E,SAAS,uBAAuB,aAC7B,QAAQ,SAAS,WAAW,SAAS,SACrC,QAAQ,SAAS,WAAW,KAAA,IAEhC,OAAO,OAAO,SAAS;EACzB,MAAM,QAAQ,OAAO,aAAa,QAAQ,qBAAqB;EAE/D,MAAM,SAAS,OAAO,OAAO,WAAW;GACtC,KAAK,OAAO,WAAW;IACrB,MAAM,aAAa,qBACjB,OACA,OACA,gBACA,QACA,SACA,eACA;KACE,QAAQ,MAAM,QAAQ;KACtB,iBAAiB,MAAM,QAAQ,cAAc;KAC7C,WAAW;IACb,CACF;IAEA,MAAM,MAAM,IAAI,IAAI,MAAM,WAAW;IAErC,IAAI,aAAa,IAAI,QAAQ,SAAS,MAAM,QAAQ,SAAS,IAAI,CAAC;IAClE,IAAI,aAAa,IAAI,SAAS,SAAS,MAAM,QAAQ,SAAS,KAAK,CAAC;IACpE,IAAI,QAAQ,SAAS,WAAW,KAAA,GAC9B,IAAI,aAAa,IAAI,OAAO,QAAQ,SAAS,MAAM;IACrD,MAAM,aAAa,IAAI,gBAAgB,SAAS,eAAe;IAE/D,gBAAgB,YAAY,MAAM,QAAQ,SAAS;IAEnD,MAAM,SAAS,MAAM,OAAO,uBAC1B,WAAW,eACX,KACA;KACE,eAAe,SAAS,MAAM,QAAQ,QAAQ,KAAK;KACnD,kBAAkB,SAAS,MAAM,QAAQ,QAAQ,YAAY;KAC7D,GAAI,SAAS,aAAa,SACtB;MACE,iBAAiB;MACjB,eAAe,SAAS,MAAM,QAAQ,QAAQ,SAAU;MACxD,GAAI,SAAS,kBAAkB,KAAA,IAC3B,CAAC,IACD,EAAE,QAAQ,SAAS,cAAc;KACvC,IACA,CAAC;IACP,GACA,UACF;IAEA,OAAO,eAAe;IACtB,IAAI,OAAO,eAAe,UAAU,MAAM,YAAY;IACtD,MAAM,WAAW,WAAW,SAAS;IACrC,IAAI;IAEJ,IAAI,SAAS,aAAa,SAAS;KACjC,MAAM,WAAW,MAAM,OAAO,uBAC5B,WAAW,eACX,OAAO,cACP,IAAI,IAAI,SAAS,eAAe,GAAG,GACnC,OACA,KAAA,GACA,IAAI,QAAQ,SAAS,eAAe,OAAO,CAC7C;KAEA,OAAO,eAAe;KACtB,IACE,SAAS,WAAW,OACpB,SAAS,QAAQ,IAAI,cAAc,CAAC,EAAE,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,YAAY,MACzE,oBAEF,MAAM,YAAY;KACpB,OAAO,MAAM,SAAS,KAAK;KAC3B,OAAO,eAAe;IACxB;IAEA,OAAO;KACL;KACA;KACA;IACF;GACF;GACA,OAAO;EACT,CAAC;EAED,MAAM,WACJ,SAAS,aAAa,SAClB,OAAO,aAAa,OAAO,OAAO,OAAO,OAAO,GAAG,QAAQ,QAAQ,SAAU,IAC7E,OAAO,eAAe,OAAO,OAAO,IAAI;EAE9C,MAAM,eACJ,MAAM,QAAQ,cAAc,uBAAuB,OAAO,OAAO,gBAAgB,KAAA;EAEnF,MAAM,WAAW,OAAO,cACtB,MAAM,SACN,OAAO,UACP,OACA,iBAAiB,KAAA,CACnB;EAEA,OAAO,OAAO,cAAcC,6BAA+B;GACzD,GAAG;GACH,GAAG;GACH,UAAU;IACR,WAAW;IACX,aAAa,SAAS,KAAK,OAAO,OAAO,YAAY;IACrD,GAAI,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,cAAc,SAAS,KAAK,YAAY,EAAE;IAClF,cAAc,SAAS;GACzB;EACF,CAAC;CACH,CAAC;CAED,MAAM,eAAkE,OAAO,GAC7E,oCACF,CAAC,CAAC,WAAW,OAAO;EAClB,MAAM,UAAU,OAAO,cAAc,cAAc,KAAK,GACtD,QAAQ,QAAQ,QAAQ;EAE1B,MAAM,QAAQ,OAAO,SAAS,KAAK,GACjC,WAAW,MAAM,UACjB,WAAW,QAAQ,SAAS;EAE9B,IACE,MAAM,QAAQ,cAAc,wBAC5B,MAAM,QAAQ,YAAY,iBAC1B,CAAC,QAAQ,SAAS,gBAClB,QAAQ,QAAQ,SAAS,aAAa,SAAS,YAC/C,QAAQ,QAAQ,SAAS,WAAW,SAAS,WAC5C,SAAS,aAAa,SACnB,SAAS,SAAS,UAClB,SAAS,aAAa,SAAS,YAC/B,SAAS,UAAU,KAAA,IACnB,SAAS,SAAS,YACtB,CAAC,YAAY,QAAQ,QAAQ,SAAS,QAAQ,MAAM,QAAQ,MAAM,KAClE,CAAC,YAAY,QAAQ,QAAQ,SAAS,WAAW,MAAM,QAAQ,SAAS,GAExE,OAAO,OAAO,YAAY;EAC5B,MAAM,QAAQ,OAAO,aAAa,QAAQ,qBAAqB;EAE/D,IACG,QAAQ,QAAQ,SAAS,0BAA0B,KAAA,KAClD,QAAQ,QAAQ,SAAS,yBAAyB,SACnD,QAAQ,QAAQ,SAAS,2BAA2B,KAAA,KACnD,QAAQ,QAAQ,SAAS,0BAA0B,OAErD,OAAO,OAAO,YAAY;EAE5B,MAAM,SAAS,OAAO,OAAO,WAAW;GACtC,KAAK,OAAO,WAAW;IACrB,MAAM,aAAa,qBACjB,OACA,OACA,gBACA,QACA,SACA,eACA;KACE,QAAQ,MAAM,QAAQ;KACtB,iBAAiB;KACjB,WAAW;IACb,CACF;IAEA,MAAM,aAAa,IAAI,gBAAgB,SAAS,iBAAiB;IAEjE,IAAI,eAAe,wBAAwB,OACzC,WAAW,IAAI,SAAS,MAAM,QAAQ,OAAO,KAAK,GAAG,CAAC;IACxD,gBAAgB,YAAY,MAAM,QAAQ,SAAS;IAEnD,MAAM,SAAS,MAAM,OAAO,kBAC1B,WAAW,eACX,SAAS,MAAM,QAAQ,SAAS,YAAa,GAC7C,UACF;IAEA,OAAO,eAAe;IACtB,IACE,OAAO,eAAe,YACrB,MAAM,QAAQ,YAAY,eACxB,CAAC,OAAO,iBACP,OAAO,kBAAkB,SAAS,MAAM,QAAQ,SAAS,YAAa,IAE1E,MAAM,YAAY;IACpB,MAAM,WAAW,WAAW,SAAS;IACrC,IAAI;IAEJ,IAAI,SAAS,aAAa,SAAS;KACjC,MAAM,WAAW,MAAM,OAAO,uBAC5B,WAAW,eACX,OAAO,cACP,IAAI,IAAI,SAAS,eAAe,GAAG,GACnC,OACA,KAAA,GACA,IAAI,QAAQ,SAAS,eAAe,OAAO,CAC7C;KAEA,OAAO,eAAe;KACtB,IACE,SAAS,WAAW,OACpB,SAAS,QAAQ,IAAI,cAAc,CAAC,EAAE,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,YAAY,MACzE,oBAEF,MAAM,YAAY;KACpB,OAAO,MAAM,SAAS,KAAK;KAC3B,OAAO,eAAe;IACxB;IAEA,OAAO;KACL;KACA;KACA;IACF;GACF;GACA,OAAO;EACT,CAAC;EAED,IAAI,SAAS,aAAa,QAAQ;GAChC,IAAI,SAAS,SAAS,UAAU,CAAC,SAAS,OAAO,OAAO,OAAO,YAAY;GAC3E,IAAI,OAAO,OAAO,aAAa,KAAA,GAC7B,OAAO,aAAa,OAAO,OAAO,OAAO,OAAO,GAAG,SAAS,OAAO;IACjE,UAAU,QAAQ,QAAQ;IAC1B,cAAc;GAChB,CAAC;EACL,OAGE,KAAI,OAFoB,eAAe,OAAO,OAAO,IAAI,EAAA,CAE5C,SAAS,YAAY,QAAQ,QAAQ,SAAS,SACzD,OAAO,OAAO,YAAY;EAE9B,MAAM,WAAW,OAAO,cAAc,MAAM,SAAS,OAAO,UAAU,OAAO,IAAI;EACjF,MAAM,aAAa,SAAS,cAAc,OAAO,SAAS,GAAG;EAE7D,IACG,QAAQ,QAAQ,SAAS,0BAA0B,KAAA,KAClD,QAAQ,QAAQ,SAAS,yBAAyB,cACnD,QAAQ,QAAQ,SAAS,2BAA2B,KAAA,KACnD,QAAQ,QAAQ,SAAS,0BAA0B,YAErD,OAAO,OAAO,YAAY;EAE5B,OAAO,OAAO,cAAcA,6BAA+B;GACzD,UAAU,QAAQ,QAAQ;GAC1B,GAAG;GACH,UAAU;IACR,WAAW;IACX,aAAa,SAAS,KAAK,OAAO,OAAO,YAAY;IACrD,GAAI,OAAO,OAAO,kBAAkB,KAAA,IAChC,CAAC,IACD,EAAE,cAAc,SAAS,KAAK,OAAO,OAAO,aAAa,EAAE;IAC/D,cAAc;GAChB;EACF,CAAC;CACH,CAAC;CAED,MAAM,cAAgE,OAAO,GAC3E,mCACF,CAAC,CAAC,WAAW,OAAO;EAClB,MAAM,UAAU,OAAO,cAAc,aAAa,KAAK,GACrD,QAAQ,QAAQ,QAAQ;EAE1B,MAAM,QAAQ,OAAO,SAAS,KAAK,GACjC,aAAa,MAAM,SAAS;EAE9B,IACE,MAAM,QAAQ,eAAe,YAC7B,WAAW,SAAS,iBACnB,WAAW,SAAS,qBAAqB,kBAAkB,KAAA,KAC3D,WAAW,SAAS,aACnB,QAAQ,SAAS,iBAAiB,KAAA,KAClC,WAAW,eAAe,wBAC5B,QAAQ,QAAQ,SAAS,aAAa,MAAM,SAAS,YACrD,QAAQ,QAAQ,SAAS,WAAW,MAAM,SAAS,WAClD,MAAM,SAAS,aAAa,SACzB,QAAQ,SAAS,aAAa,SAAS,UACvC,QAAQ,SAAS,aAAa,aAAa,MAAM,SAAS,WAC1D,QAAQ,SAAS,aAAa,SAAS,UAE3C,OAAO,OAAO,YAAY;EAC5B,IAAI,WAAW,SAAS,mBAAmB;GACzC,OAAO,mBAAmB,OAAO;IAC/B,UAAU,MAAM,SAAS;IACzB,gBAAgB,MAAM,SAAS;IAC/B,SAAS,QAAQ;IACjB,UAAU,QAAQ;GACpB,CAAC;GAED,OAAO;EACT;EACA,OAAO,OAAO,WAAW;GACvB,KAAK,OAAO,WAAW;IACrB,MAAM,EAAE,kBAAkB,qBACxB,OACA,OACA,gBACA,QACA,QACF;IAEA,IAAI,QAAQ,SAAS,iBAAiB,KAAA,GAAW;KAC/C,MAAM,OAAO,gBACX,eACA,SAAS,MAAM,QAAQ,SAAS,YAAY,GAC5C,EAAE,iBAAiB,gBAAgB,CACrC;KACA,OAAO,eAAe;IACxB;IACA,MAAM,OAAO,gBAAgB,eAAe,SAAS,MAAM,QAAQ,SAAS,WAAW,GAAG,EACxF,iBAAiB,eACnB,CAAC;IACD,OAAO,eAAe;GACxB;GACA,OAAO;EACT,CAAC;EAED,OAAO;CACT,CAAC;CAED,OAAO,uBAAuB,GAAG;EAC/B,uBAAuB,UAAU,KAAK,qBAAqB,KAAK,CAAC;EACjE,gBAAgB,UAAU,KAAK,cAAc,KAAK,CAAC;EACnD,eAAe,UAAU,KAAK,aAAa,KAAK,CAAC;EACjD,cAAc,UAAU,KAAK,YAAY,KAAK,CAAC;CACjD,CAAC;AACH,GAAG,IAAI;AAEP,MAAa,qCACX,YAMA,uCAAuC,OAAO,CAAC,CAAC,KAC9C,OAAO,QAAQ,mBAAmB,gBAAgB,CACpD;AAEF,MAAa,sCACX,YACG,MAAM,OAAO,wBAAwB,kCAAkC,OAAO,CAAC"}

package/dist/oauth/openid-client/profile.d.mts

@@ -0,0 +1,39 @@
+import "../signInErrors.mjs";
+import { Effect, Schema } from "effect";
+//#region src/oauth/openid-client/profile.d.ts
+/** Standard OpenID Connect user claims returned in a verified ID token. This
+ * does not request additional scopes or fetch UserInfo. Protocol claims and
+ * credentials are excluded; values such as email_verified describe the provider's
+ * assertion and never authorize local account linking by themselves. */
+declare const OidcUserProfile: Schema.Struct<{
+  readonly name: Schema.optionalKey<Schema.String>;
+  readonly given_name: Schema.optionalKey<Schema.String>;
+  readonly family_name: Schema.optionalKey<Schema.String>;
+  readonly middle_name: Schema.optionalKey<Schema.String>;
+  readonly nickname: Schema.optionalKey<Schema.String>;
+  readonly preferred_username: Schema.optionalKey<Schema.String>;
+  readonly profile: Schema.optionalKey<Schema.String>;
+  readonly picture: Schema.optionalKey<Schema.String>;
+  readonly website: Schema.optionalKey<Schema.String>;
+  readonly email: Schema.optionalKey<Schema.String>;
+  readonly email_verified: Schema.optionalKey<Schema.Boolean>;
+  readonly gender: Schema.optionalKey<Schema.String>;
+  readonly birthdate: Schema.optionalKey<Schema.String>;
+  readonly zoneinfo: Schema.optionalKey<Schema.String>;
+  readonly locale: Schema.optionalKey<Schema.String>;
+  readonly phone_number: Schema.optionalKey<Schema.String>;
+  readonly phone_number_verified: Schema.optionalKey<Schema.Boolean>;
+  readonly address: Schema.optionalKey<Schema.Struct<{
+    readonly formatted: Schema.optionalKey<Schema.String>;
+    readonly street_address: Schema.optionalKey<Schema.String>;
+    readonly locality: Schema.optionalKey<Schema.String>;
+    readonly region: Schema.optionalKey<Schema.String>;
+    readonly postal_code: Schema.optionalKey<Schema.String>;
+    readonly country: Schema.optionalKey<Schema.String>;
+  }>>;
+  readonly updated_at: Schema.optionalKey<Schema.Int>;
+}>;
+type OidcUserProfile = typeof OidcUserProfile.Type;
+//#endregion
+export { OidcUserProfile };
+//# sourceMappingURL=profile.d.mts.map

package/dist/oauth/openid-client/profile.mjs

@@ -0,0 +1,58 @@
+import { OAuthProtocolRejected } from "../signInErrors.mjs";
+import { Effect, Schema } from "effect";
+//#region src/oauth/openid-client/profile.ts
+const text = Schema.String.check(Schema.isMaxLength(256));
+const url = Schema.String.check(Schema.isMaxLength(2048));
+/** Standard OpenID Connect user claims returned in a verified ID token. This
+* does not request additional scopes or fetch UserInfo. Protocol claims and
+* credentials are excluded; values such as email_verified describe the provider's
+* assertion and never authorize local account linking by themselves. */
+const OidcUserProfile = Schema.Struct({
+	name: Schema.optionalKey(text),
+	given_name: Schema.optionalKey(text),
+	family_name: Schema.optionalKey(text),
+	middle_name: Schema.optionalKey(text),
+	nickname: Schema.optionalKey(text),
+	preferred_username: Schema.optionalKey(text),
+	profile: Schema.optionalKey(url),
+	picture: Schema.optionalKey(url),
+	website: Schema.optionalKey(url),
+	email: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(320))),
+	email_verified: Schema.optionalKey(Schema.Boolean),
+	gender: Schema.optionalKey(text),
+	birthdate: Schema.optionalKey(text),
+	zoneinfo: Schema.optionalKey(text),
+	locale: Schema.optionalKey(text),
+	phone_number: Schema.optionalKey(text),
+	phone_number_verified: Schema.optionalKey(Schema.Boolean),
+	address: Schema.optionalKey(Schema.Struct({
+		formatted: Schema.optionalKey(url),
+		street_address: Schema.optionalKey(url),
+		locality: Schema.optionalKey(text),
+		region: Schema.optionalKey(text),
+		postal_code: Schema.optionalKey(text),
+		country: Schema.optionalKey(text)
+	})),
+	updated_at: Schema.optionalKey(Schema.Int.check(Schema.isBetween({
+		minimum: 0,
+		maximum: Number.MAX_SAFE_INTEGER
+	})))
+});
+const decodeOidcProfile = Effect.fn("OpenIdClient.decodeProfile")(function* (claims) {
+	const profile = yield* Schema.decodeUnknownEffect(OidcUserProfile)(claims).pipe(Effect.mapError(() => OAuthProtocolRejected.make({})));
+	if (Object.keys(profile).length === 0) return void 0;
+	const displayName = profile.name?.trim() || profile.preferred_username;
+	return {
+		...displayName === void 0 ? {} : { displayName },
+		...profile.preferred_username === void 0 ? {} : { handle: profile.preferred_username },
+		...profile.picture === void 0 ? {} : { avatarUrl: profile.picture },
+		...profile.profile === void 0 ? {} : { profileUrl: profile.profile },
+		...profile.email === void 0 ? {} : { email: profile.email },
+		...profile.email_verified === void 0 ? {} : { emailVerified: profile.email_verified },
+		providerData: profile
+	};
+});
+//#endregion
+export { OidcUserProfile, decodeOidcProfile };
+
+//# sourceMappingURL=profile.mjs.map

package/dist/oauth/openid-client/profile.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.mjs","names":[],"sources":["../../../src/oauth/openid-client/profile.ts"],"sourcesContent":["import { Effect, Schema } from \"effect\";\n\nimport { OAuthProtocolRejected } from \"../signInErrors\";\nimport type { OAuthDisplayProfile } from \"../signInModels\";\n\nconst text = Schema.String.check(Schema.isMaxLength(256));\nconst url = Schema.String.check(Schema.isMaxLength(2048));\n\n/** Standard OpenID Connect user claims returned in a verified ID token. This\n * does not request additional scopes or fetch UserInfo. Protocol claims and\n * credentials are excluded; values such as email_verified describe the provider's\n * assertion and never authorize local account linking by themselves. */\nexport const OidcUserProfile = Schema.Struct({\n  name: Schema.optionalKey(text),\n  given_name: Schema.optionalKey(text),\n  family_name: Schema.optionalKey(text),\n  middle_name: Schema.optionalKey(text),\n  nickname: Schema.optionalKey(text),\n  preferred_username: Schema.optionalKey(text),\n  profile: Schema.optionalKey(url),\n  picture: Schema.optionalKey(url),\n  website: Schema.optionalKey(url),\n  email: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(320))),\n  email_verified: Schema.optionalKey(Schema.Boolean),\n  gender: Schema.optionalKey(text),\n  birthdate: Schema.optionalKey(text),\n  zoneinfo: Schema.optionalKey(text),\n  locale: Schema.optionalKey(text),\n  phone_number: Schema.optionalKey(text),\n  phone_number_verified: Schema.optionalKey(Schema.Boolean),\n  address: Schema.optionalKey(\n    Schema.Struct({\n      formatted: Schema.optionalKey(url),\n      street_address: Schema.optionalKey(url),\n      locality: Schema.optionalKey(text),\n      region: Schema.optionalKey(text),\n      postal_code: Schema.optionalKey(text),\n      country: Schema.optionalKey(text),\n    }),\n  ),\n  updated_at: Schema.optionalKey(\n    Schema.Int.check(Schema.isBetween({ minimum: 0, maximum: Number.MAX_SAFE_INTEGER })),\n  ),\n});\n\nexport type OidcUserProfile = typeof OidcUserProfile.Type;\n\nexport const decodeOidcProfile = Effect.fn(\"OpenIdClient.decodeProfile\")(function* (\n  claims: unknown,\n): Effect.fn.Return<OAuthDisplayProfile | undefined, OAuthProtocolRejected> {\n  // oxlint-disable-next-line no-restricted-properties -- Select standard user claims from an already verified ID token.\n  const profile = yield* Schema.decodeUnknownEffect(OidcUserProfile)(claims).pipe(\n    Effect.mapError(() => OAuthProtocolRejected.make({})),\n  );\n\n  if (Object.keys(profile).length === 0) return undefined;\n  const displayName = profile.name?.trim() || profile.preferred_username;\n\n  return {\n    ...(displayName === undefined ? {} : { displayName }),\n    ...(profile.preferred_username === undefined ? {} : { handle: profile.preferred_username }),\n    ...(profile.picture === undefined ? {} : { avatarUrl: profile.picture }),\n    ...(profile.profile === undefined ? {} : { profileUrl: profile.profile }),\n    ...(profile.email === undefined ? {} : { email: profile.email }),\n    ...(profile.email_verified === undefined ? {} : { emailVerified: profile.email_verified }),\n    providerData: profile,\n  };\n});\n"],"mappings":";;;AAKA,MAAM,OAAO,OAAO,OAAO,MAAM,OAAO,YAAY,GAAG,CAAC;AACxD,MAAM,MAAM,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC;;;;;AAMxD,MAAa,kBAAkB,OAAO,OAAO;CAC3C,MAAM,OAAO,YAAY,IAAI;CAC7B,YAAY,OAAO,YAAY,IAAI;CACnC,aAAa,OAAO,YAAY,IAAI;CACpC,aAAa,OAAO,YAAY,IAAI;CACpC,UAAU,OAAO,YAAY,IAAI;CACjC,oBAAoB,OAAO,YAAY,IAAI;CAC3C,SAAS,OAAO,YAAY,GAAG;CAC/B,SAAS,OAAO,YAAY,GAAG;CAC/B,SAAS,OAAO,YAAY,GAAG;CAC/B,OAAO,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC;CACtE,gBAAgB,OAAO,YAAY,OAAO,OAAO;CACjD,QAAQ,OAAO,YAAY,IAAI;CAC/B,WAAW,OAAO,YAAY,IAAI;CAClC,UAAU,OAAO,YAAY,IAAI;CACjC,QAAQ,OAAO,YAAY,IAAI;CAC/B,cAAc,OAAO,YAAY,IAAI;CACrC,uBAAuB,OAAO,YAAY,OAAO,OAAO;CACxD,SAAS,OAAO,YACd,OAAO,OAAO;EACZ,WAAW,OAAO,YAAY,GAAG;EACjC,gBAAgB,OAAO,YAAY,GAAG;EACtC,UAAU,OAAO,YAAY,IAAI;EACjC,QAAQ,OAAO,YAAY,IAAI;EAC/B,aAAa,OAAO,YAAY,IAAI;EACpC,SAAS,OAAO,YAAY,IAAI;CAClC,CAAC,CACH;CACA,YAAY,OAAO,YACjB,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS,OAAO;CAAiB,CAAC,CAAC,CACrF;AACF,CAAC;AAID,MAAa,oBAAoB,OAAO,GAAG,4BAA4B,CAAC,CAAC,WACvE,QAC0E;CAE1E,MAAM,UAAU,OAAO,OAAO,oBAAoB,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,KACzE,OAAO,eAAe,sBAAsB,KAAK,CAAC,CAAC,CAAC,CACtD;CAEA,IAAI,OAAO,KAAK,OAAO,CAAC,CAAC,WAAW,GAAG,OAAO,KAAA;CAC9C,MAAM,cAAc,QAAQ,MAAM,KAAK,KAAK,QAAQ;CAEpD,OAAO;EACL,GAAI,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY;EACnD,GAAI,QAAQ,uBAAuB,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,QAAQ,mBAAmB;EACzF,GAAI,QAAQ,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,QAAQ,QAAQ;EACtE,GAAI,QAAQ,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY,QAAQ,QAAQ;EACvE,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;EAC9D,GAAI,QAAQ,mBAAmB,KAAA,IAAY,CAAC,IAAI,EAAE,eAAe,QAAQ,eAAe;EACxF,cAAc;CAChB;AACF,CAAC"}

package/dist/oauth/openid-client/protocol.mjs

@@ -8,6 +8,7 @@ import { OAuthProtocol } from "../OAuthProtocol.mjs";
 import { DefiniteTokenRejection, tokenCompatibility } from "./compatibility.mjs";
 import { boundedFetch } from "./transport.mjs";
 import { clientAuthentication, installConfigurations, makeAuthorizationParameters } from "./configuration.mjs";
+import { decodeOidcProfile } from "./profile.mjs";
 import { Cause, DateTime, Effect, Layer, Redacted, Schema } from "effect";
 import * as client from "openid-client";
 //#region src/oauth/openid-client/protocol.ts
@@ -181,12 +182,14 @@ const makeOpenIdClientOAuthProtocol = Effect.fn("makeOpenIdClientOAuthProtocol")
 			const now = DateTime.toEpochMillis(yield* DateTime.now) / 1e3;
 			const audience = typeof claims.aud === "string" ? claims.aud : claims.aud[0];
 			if (provider.protocol !== "oidc" || claims.iss !== provider.issuer || audience !== provider.clientId || claims.azp !== void 0 && claims.azp !== provider.clientId || claims.exp <= now || claims.iat > now || claims.nbf !== void 0 && claims.nbf > now || claims.auth_time !== void 0 && claims.auth_time > now || provider.maxAgeSeconds !== void 0 && (claims.auth_time === void 0 || claims.auth_time + provider.maxAgeSeconds < Math.floor(now))) return yield* rejected();
+			const profile = yield* decodeOidcProfile(exchanged.claims);
 			return yield* snapshotOAuth(OAuthVerifiedExternalIdentity, {
 				identity: {
 					provider: provider.provider,
 					issuer: provider.issuer,
 					subject: claims.sub
 				},
+				...profile === void 0 ? {} : { profile },
 				...claims.auth_time === void 0 ? {} : { upstreamAuthenticatedAt: DateTime.makeUnsafe(Math.min(startedAt, claims.auth_time * 1e3)) }
 			});
 		}

package/dist/oauth/openid-client/protocol.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"protocol.mjs","names":[],"sources":["../../../src/oauth/openid-client/protocol.ts"],"sourcesContent":["import { Cause, DateTime, Effect, Layer, Redacted, Schema } from \"effect\";\nimport * as client from \"openid-client\";\n\nimport { reportAuthFailure } from \"../../internal/diagnostics\";\nimport { RequestBindingFlowId } from \"../../operations/requestBinding\";\nimport { OAuthProtocol } from \"../OAuthProtocol\";\nimport { OAuthProviderKey } from \"../schema\";\nimport { OAuthProtocolRejected, OAuthRejected, OAuthUnavailable } from \"../signInErrors\";\nimport {\n  OAuthCallbackId,\n  OAuthCodeResponse,\n  OAuthDisplayProfile,\n  OAuthProtocolConfiguration,\n  OAuthProtocolPreparation,\n  OAuthTransactionSecrets,\n  OAuthVerifiedExternalIdentity,\n} from \"../signInModels\";\nimport { snapshotOAuth } from \"../signInSnapshot\";\nimport { DefiniteTokenRejection, tokenCompatibility } from \"./compatibility\";\nimport {\n  clientAuthentication,\n  installConfigurations,\n  makeAuthorizationParameters,\n  type InstalledProvider,\n} from \"./configuration\";\nimport {\n  type OpenIdClientConfigurationError,\n  type OpenIdClientOAuthProtocolOptions,\n} from \"./models\";\nimport { boundedFetch } from \"./transport\";\n\nconst beginInput = Schema.Struct({\n  provider: OAuthProviderKey,\n  callbackId: OAuthCallbackId,\n  flowId: RequestBindingFlowId,\n});\n\nconst exchangeInput = Schema.toType(\n  Schema.Struct({\n    configuration: OAuthProtocolConfiguration,\n    response: OAuthCodeResponse,\n    secrets: OAuthTransactionSecrets,\n    verificationStartedAt: Schema.DateTimeUtcFromMillis,\n  }),\n);\n\nconst numericDate = Schema.Finite.check(Schema.isBetween({ minimum: 0, maximum: 8640000000000 }));\n\nconst claimsSchema = Schema.Struct({\n  iss: Schema.String,\n  sub: OAuthVerifiedExternalIdentity.fields.identity.fields.subject,\n  aud: Schema.Union([\n    Schema.String,\n    Schema.Array(Schema.String).check(Schema.isMinLength(1), Schema.isMaxLength(1)),\n  ]),\n  azp: Schema.optionalKey(Schema.String),\n  exp: numericDate,\n  iat: numericDate,\n  nbf: Schema.optionalKey(numericDate),\n  auth_time: Schema.optionalKey(numericDate),\n});\n\nconst plainIdentitySchema = Schema.Struct({\n  subject: OAuthVerifiedExternalIdentity.fields.identity.fields.subject,\n  profile: Schema.optionalKey(OAuthDisplayProfile),\n});\n\nconst unavailable = () => OAuthUnavailable.make({});\nconst rejected = () => OAuthProtocolRejected.make({});\n\nconst unavailableOnDefect = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n  effect.pipe(\n    Effect.tapCause((cause) =>\n      Cause.hasDies(cause) ? reportAuthFailure(\"oauth-protocol\", cause) : Effect.void,\n    ),\n    Effect.catchCause((cause): Effect.Effect<never, E | OAuthUnavailable> => {\n      if (Cause.hasInterrupts(cause)) return Effect.interrupt;\n      if (Cause.hasDies(cause)) return Effect.fail(unavailable());\n\n      return Effect.failCause(cause);\n    }),\n  );\n\n/** Only precise claim errors and a fully parsed invalid_grant are definite.\n * INVALID_RESPONSE also covers signature/key/transport faults; keep it ambiguous. */\nconst grantError = (error: unknown) => {\n  if (\n    error instanceof DefiniteTokenRejection ||\n    (error instanceof client.ClientError && error.cause instanceof DefiniteTokenRejection)\n  )\n    return rejected();\n  if (\n    error instanceof client.ClientError &&\n    (error.code === \"OAUTH_JWT_CLAIM_COMPARISON_FAILED\" ||\n      error.code === \"OAUTH_JWT_TIMESTAMP_CHECK_FAILED\")\n  )\n    return rejected();\n  if (\n    error instanceof client.ResponseBodyError &&\n    error.status === 400 &&\n    error.error === \"invalid_grant\"\n  )\n    return rejected();\n\n  return unavailable();\n};\n\nconst privateConfiguration = <R>(\n  entry: InstalledProvider<R>,\n  timeout: number,\n  fetch: client.CustomFetch,\n  signal: AbortSignal,\n) => {\n  const provider = entry.provider;\n  const compatibility = provider.protocol === \"oauth\" ? provider[tokenCompatibility] : undefined;\n\n  const configuration = new client.Configuration(\n    entry.metadata,\n    provider.clientId,\n    {\n      [client.clockSkew]: 0,\n      [client.clockTolerance]: 0,\n      ...(provider.protocol === \"oidc\"\n        ? { id_token_signed_response_alg: provider.idTokenSignedResponseAlg }\n        : {}),\n    },\n    clientAuthentication(provider.authentication),\n  );\n\n  configuration.timeout = timeout;\n  const transport = boundedFetch(fetch, signal, entry.allowedUrls);\n\n  configuration[client.customFetch] =\n    compatibility === undefined\n      ? transport\n      : async (url, options) => {\n          const response = await transport(url, options);\n\n          if (url === new URL(entry.metadata.token_endpoint!).href) {\n            const body: unknown = await response.clone().json();\n\n            signal.throwIfAborted();\n            compatibility.inspectReceipt(\n              { body, status: response.status, contentType: response.headers.get(\"content-type\") },\n              {\n                scopes: provider.scopes,\n                refreshRequired: false,\n                operation: \"authorization_code\",\n              },\n            );\n            signal.throwIfAborted();\n          }\n\n          return response;\n        };\n  if (provider.protocol === \"oidc\") client.enableNonRepudiationChecks(configuration);\n\n  return configuration;\n};\n\nexport const makeOpenIdClientOAuthProtocol = Effect.fn(\"makeOpenIdClientOAuthProtocol\")(\n  // Capture one provider table; each generation retains its own receipt rules.\n  function* <R = never>(\n    options: OpenIdClientOAuthProtocolOptions<R>,\n  ): Effect.fn.Return<\n    OAuthProtocol[\"Service\"],\n    OpenIdClientConfigurationError | OAuthUnavailable,\n    R\n  > {\n    const context = yield* Effect.context<R>();\n    const { installed, fetch, timeoutSeconds } = yield* installConfigurations(options);\n\n    const prepareAuthorization: OAuthProtocol[\"Service\"][\"prepareAuthorization\"] = Effect.fn(\n      \"OpenIdClient.prepareAuthorization\",\n    )(function* (input) {\n      const request = yield* Schema.decodeEffect(beginInput)(input).pipe(\n        Effect.mapError(() => OAuthRejected.make({})),\n      );\n\n      const entry = installed.find(\n        ({ provider }) => provider.issuance === \"active\" && provider.provider === request.provider,\n      );\n\n      const provider = entry?.provider;\n\n      const callback = provider?.callbacks.find(\n        (candidate) => candidate.callbackId === request.callbackId,\n      );\n\n      if (entry === undefined || provider === undefined || callback === undefined)\n        return yield* OAuthRejected.make({});\n\n      const result = yield* Effect.tryPromise({\n        try: async (signal) => {\n          const configuration = privateConfiguration(entry, timeoutSeconds, fetch, signal);\n\n          const state = client.randomState();\n          const verifier = client.randomPKCECodeVerifier();\n          const nonce = provider.protocol === \"oidc\" ? client.randomNonce() : undefined;\n          const challenge = await client.calculatePKCECodeChallenge(verifier);\n\n          signal.throwIfAborted();\n\n          const url = client.buildAuthorizationUrl(\n            configuration,\n            makeAuthorizationParameters(provider, callback.redirectUri, {\n              state,\n              challenge,\n              ...(nonce === undefined ? {} : { nonce }),\n            }),\n          );\n\n          return {\n            configuration: {\n              provider: provider.provider,\n              protocol: provider.protocol,\n              configurationGeneration: provider.configurationGeneration,\n              issuer: provider.issuer,\n              responseIssuerMode: provider.responseIssuerMode,\n              callbackId: callback.callbackId,\n              redirectUri: callback.redirectUri,\n            },\n            authorizationUrl: Redacted.make(url.href),\n            secrets: {\n              namespace: \"effect-auth/oauth-transaction-secrets/v1\" as const,\n              state: Redacted.make(state),\n              pkceVerifier: Redacted.make(verifier),\n              ...(nonce === undefined ? {} : { oidcNonce: Redacted.make(nonce) }),\n            },\n          };\n        },\n        catch: unavailable,\n      });\n\n      return yield* snapshotOAuth(OAuthProtocolPreparation, result);\n    });\n\n    const exchangeVerifiedIdentity: OAuthProtocol[\"Service\"][\"exchangeVerifiedIdentity\"] =\n      Effect.fn(\"OpenIdClient.exchangeVerifiedIdentity\")(function* (input) {\n        const request = yield* snapshotOAuth(exchangeInput, input);\n        const saved = request.configuration;\n\n        const entry = installed.find(\n          ({ provider }) =>\n            provider.provider === saved.provider &&\n            provider.configurationGeneration === saved.configurationGeneration,\n        );\n\n        if (entry === undefined) return yield* unavailable();\n        const provider = entry.provider;\n\n        const callback = provider.callbacks.find(\n          (candidate) => candidate.callbackId === saved.callbackId,\n        );\n\n        if (\n          provider.protocol !== saved.protocol ||\n          provider.issuer !== saved.issuer ||\n          provider.responseIssuerMode !== saved.responseIssuerMode ||\n          callback?.redirectUri !== saved.redirectUri\n        )\n          return yield* unavailable();\n        if (\n          (provider.protocol === \"oidc\") !== (request.secrets.oidcNonce !== undefined) ||\n          Redacted.value(request.response.state) !== Redacted.value(request.secrets.state) ||\n          (provider.responseIssuerMode === \"required\"\n            ? request.response.issuer !== provider.issuer\n            : request.response.issuer !== undefined)\n        )\n          return yield* rejected();\n        const startedAt = DateTime.toEpochMillis(request.verificationStartedAt);\n\n        if (startedAt < 0 || startedAt > DateTime.toEpochMillis(yield* DateTime.now))\n          return yield* rejected();\n\n        const exchanged = yield* Effect.tryPromise({\n          try: async (signal) => {\n            const configuration = privateConfiguration(entry, timeoutSeconds, fetch, signal);\n\n            const currentUrl = new URL(saved.redirectUri);\n\n            currentUrl.searchParams.set(\"code\", Redacted.value(request.response.code));\n            currentUrl.searchParams.set(\"state\", Redacted.value(request.response.state));\n            if (request.response.issuer !== undefined)\n              currentUrl.searchParams.set(\"iss\", request.response.issuer);\n\n            const tokens = await client.authorizationCodeGrant(\n              configuration,\n              currentUrl,\n              {\n                pkceCodeVerifier: Redacted.value(request.secrets.pkceVerifier),\n                expectedState: Redacted.value(request.secrets.state),\n                ...(provider.protocol === \"oidc\"\n                  ? {\n                      expectedNonce: Redacted.value(request.secrets.oidcNonce!),\n                      idTokenExpected: true,\n                      ...(provider.maxAgeSeconds === undefined\n                        ? {}\n                        : { maxAge: provider.maxAgeSeconds }),\n                    }\n                  : {}),\n              },\n              provider.tokenParameters,\n            );\n\n            signal.throwIfAborted();\n            if (provider.protocol === \"oidc\")\n              return { protocol: \"oidc\" as const, claims: tokens.claims() };\n            if (tokens.token_type !== \"bearer\") throw unavailable();\n\n            const response = await client.fetchProtectedResource(\n              configuration,\n              tokens.access_token,\n              new URL(provider.identitySource.url),\n              \"GET\",\n              undefined,\n              new Headers(provider.identitySource.headers),\n            );\n\n            signal.throwIfAborted();\n            if (\n              response.status !== 200 ||\n              response.headers.get(\"content-type\")?.split(\";\", 1)[0]?.trim().toLowerCase() !==\n                \"application/json\"\n            )\n              throw unavailable();\n            const body: unknown = await response.json();\n\n            signal.throwIfAborted();\n\n            return { protocol: \"oauth\" as const, body };\n          },\n          catch: grantError,\n        });\n\n        if (exchanged.protocol === \"oidc\") {\n          // oxlint-disable-next-line no-restricted-properties -- Project validated foreign ID-token claims into the adapter's stricter bounded profile.\n          const claims = yield* Schema.decodeUnknownEffect(claimsSchema)(exchanged.claims).pipe(\n            Effect.mapError(rejected),\n          );\n\n          const now = DateTime.toEpochMillis(yield* DateTime.now) / 1000;\n          const audience = typeof claims.aud === \"string\" ? claims.aud : claims.aud[0];\n\n          if (\n            provider.protocol !== \"oidc\" ||\n            claims.iss !== provider.issuer ||\n            audience !== provider.clientId ||\n            (claims.azp !== undefined && claims.azp !== provider.clientId) ||\n            claims.exp <= now ||\n            claims.iat > now ||\n            (claims.nbf !== undefined && claims.nbf > now) ||\n            (claims.auth_time !== undefined && claims.auth_time > now) ||\n            (provider.maxAgeSeconds !== undefined &&\n              (claims.auth_time === undefined ||\n                claims.auth_time + provider.maxAgeSeconds < Math.floor(now)))\n          )\n            return yield* rejected();\n\n          return yield* snapshotOAuth(OAuthVerifiedExternalIdentity, {\n            identity: { provider: provider.provider, issuer: provider.issuer, subject: claims.sub },\n            ...(claims.auth_time === undefined\n              ? {}\n              : {\n                  upstreamAuthenticatedAt: DateTime.makeUnsafe(\n                    Math.min(startedAt, claims.auth_time * 1000),\n                  ),\n                }),\n          });\n        }\n        if (provider.protocol !== \"oauth\") return yield* unavailable();\n\n        const decoded = yield* Effect.suspend(() =>\n          provider.identitySource.decodeIdentity(exchanged.body),\n        ).pipe(\n          Effect.provideContext(context),\n          Effect.catchCause(\n            (cause): Effect.Effect<never, OAuthProtocolRejected | OAuthUnavailable> => {\n              if (Cause.hasInterrupts(cause))\n                return reportAuthFailure(\"oauth-identity\", cause).pipe(\n                  Effect.andThen(Effect.interrupt),\n                );\n              if (\n                cause.reasons.length === 1 &&\n                cause.reasons[0]?._tag === \"Fail\" &&\n                Schema.is(OAuthProtocolRejected)(cause.reasons[0].error)\n              )\n                return Effect.fail(rejected());\n\n              return reportAuthFailure(\"oauth-identity\", cause).pipe(\n                Effect.andThen(Effect.fail(unavailable())),\n              );\n            },\n          ),\n        );\n\n        const identity = yield* Schema.decodeEffect(plainIdentitySchema)(decoded).pipe(\n          Effect.mapError(rejected),\n        );\n\n        return yield* snapshotOAuth(OAuthVerifiedExternalIdentity, {\n          identity: {\n            provider: provider.provider,\n            issuer: provider.issuer,\n            subject: identity.subject,\n          },\n          ...(identity.profile === undefined ? {} : { profile: identity.profile }),\n        });\n      });\n\n    return OAuthProtocol.of({\n      prepareAuthorization: (input) => unavailableOnDefect(prepareAuthorization(input)),\n      exchangeVerifiedIdentity: (input) => unavailableOnDefect(exchangeVerifiedIdentity(input)),\n    });\n  },\n  unavailableOnDefect,\n);\n\nexport const openIdClientOAuthProtocolLayer = <R = never>(\n  options: OpenIdClientOAuthProtocolOptions<R>,\n) => Layer.effect(OAuthProtocol, makeOpenIdClientOAuthProtocol(options));\n"],"mappings":";;;;;;;;;;;;;AA+BA,MAAM,aAAa,OAAO,OAAO;CAC/B,UAAU;CACV,YAAY;CACZ,QAAQ;AACV,CAAC;AAED,MAAM,gBAAgB,OAAO,OAC3B,OAAO,OAAO;CACZ,eAAe;CACf,UAAU;CACV,SAAS;CACT,uBAAuB,OAAO;AAChC,CAAC,CACH;AAEA,MAAM,cAAc,OAAO,OAAO,MAAM,OAAO,UAAU;CAAE,SAAS;CAAG,SAAS;AAAc,CAAC,CAAC;AAEhG,MAAM,eAAe,OAAO,OAAO;CACjC,KAAK,OAAO;CACZ,KAAK,8BAA8B,OAAO,SAAS,OAAO;CAC1D,KAAK,OAAO,MAAM,CAChB,OAAO,QACP,OAAO,MAAM,OAAO,MAAM,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,CAAC,CAAC,CAChF,CAAC;CACD,KAAK,OAAO,YAAY,OAAO,MAAM;CACrC,KAAK;CACL,KAAK;CACL,KAAK,OAAO,YAAY,WAAW;CACnC,WAAW,OAAO,YAAY,WAAW;AAC3C,CAAC;AAED,MAAM,sBAAsB,OAAO,OAAO;CACxC,SAAS,8BAA8B,OAAO,SAAS,OAAO;CAC9D,SAAS,OAAO,YAAY,mBAAmB;AACjD,CAAC;AAED,MAAM,oBAAoB,iBAAiB,KAAK,CAAC,CAAC;AAClD,MAAM,iBAAiB,sBAAsB,KAAK,CAAC,CAAC;AAEpD,MAAM,uBAAgC,WACpC,OAAO,KACL,OAAO,UAAU,UACf,MAAM,QAAQ,KAAK,IAAI,kBAAkB,kBAAkB,KAAK,IAAI,OAAO,IAC7E,GACA,OAAO,YAAY,UAAsD;CACvE,IAAI,MAAM,cAAc,KAAK,GAAG,OAAO,OAAO;CAC9C,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,OAAO,KAAK,YAAY,CAAC;CAE1D,OAAO,OAAO,UAAU,KAAK;AAC/B,CAAC,CACH;;;AAIF,MAAM,cAAc,UAAmB;CACrC,IACE,iBAAiB,0BAChB,iBAAiB,OAAO,eAAe,MAAM,iBAAiB,wBAE/D,OAAO,SAAS;CAClB,IACE,iBAAiB,OAAO,gBACvB,MAAM,SAAS,uCACd,MAAM,SAAS,qCAEjB,OAAO,SAAS;CAClB,IACE,iBAAiB,OAAO,qBACxB,MAAM,WAAW,OACjB,MAAM,UAAU,iBAEhB,OAAO,SAAS;CAElB,OAAO,YAAY;AACrB;AAEA,MAAM,wBACJ,OACA,SACA,OACA,WACG;CACH,MAAM,WAAW,MAAM;CACvB,MAAM,gBAAgB,SAAS,aAAa,UAAU,SAAS,sBAAsB,KAAA;CAErF,MAAM,gBAAgB,IAAI,OAAO,cAC/B,MAAM,UACN,SAAS,UACT;GACG,OAAO,YAAY;GACnB,OAAO,iBAAiB;EACzB,GAAI,SAAS,aAAa,SACtB,EAAE,8BAA8B,SAAS,yBAAyB,IAClE,CAAC;CACP,GACA,qBAAqB,SAAS,cAAc,CAC9C;CAEA,cAAc,UAAU;CACxB,MAAM,YAAY,aAAa,OAAO,QAAQ,MAAM,WAAW;CAE/D,cAAc,OAAO,eACnB,kBAAkB,KAAA,IACd,YACA,OAAO,KAAK,YAAY;EACtB,MAAM,WAAW,MAAM,UAAU,KAAK,OAAO;EAE7C,IAAI,QAAQ,IAAI,IAAI,MAAM,SAAS,cAAe,CAAC,CAAC,MAAM;GACxD,MAAM,OAAgB,MAAM,SAAS,MAAM,CAAC,CAAC,KAAK;GAElD,OAAO,eAAe;GACtB,cAAc,eACZ;IAAE;IAAM,QAAQ,SAAS;IAAQ,aAAa,SAAS,QAAQ,IAAI,cAAc;GAAE,GACnF;IACE,QAAQ,SAAS;IACjB,iBAAiB;IACjB,WAAW;GACb,CACF;GACA,OAAO,eAAe;EACxB;EAEA,OAAO;CACT;CACN,IAAI,SAAS,aAAa,QAAQ,OAAO,2BAA2B,aAAa;CAEjF,OAAO;AACT;AAEA,MAAa,gCAAgC,OAAO,GAAG,+BAA+B,CAAC,CAErF,WACE,SAKA;CACA,MAAM,UAAU,OAAO,OAAO,QAAW;CACzC,MAAM,EAAE,WAAW,OAAO,mBAAmB,OAAO,sBAAsB,OAAO;CAEjF,MAAM,uBAAyE,OAAO,GACpF,mCACF,CAAC,CAAC,WAAW,OAAO;EAClB,MAAM,UAAU,OAAO,OAAO,aAAa,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,KAC5D,OAAO,eAAe,cAAc,KAAK,CAAC,CAAC,CAAC,CAC9C;EAEA,MAAM,QAAQ,UAAU,MACrB,EAAE,eAAe,SAAS,aAAa,YAAY,SAAS,aAAa,QAAQ,QACpF;EAEA,MAAM,WAAW,OAAO;EAExB,MAAM,WAAW,UAAU,UAAU,MAClC,cAAc,UAAU,eAAe,QAAQ,UAClD;EAEA,IAAI,UAAU,KAAA,KAAa,aAAa,KAAA,KAAa,aAAa,KAAA,GAChE,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;EAErC,MAAM,SAAS,OAAO,OAAO,WAAW;GACtC,KAAK,OAAO,WAAW;IACrB,MAAM,gBAAgB,qBAAqB,OAAO,gBAAgB,OAAO,MAAM;IAE/E,MAAM,QAAQ,OAAO,YAAY;IACjC,MAAM,WAAW,OAAO,uBAAuB;IAC/C,MAAM,QAAQ,SAAS,aAAa,SAAS,OAAO,YAAY,IAAI,KAAA;IACpE,MAAM,YAAY,MAAM,OAAO,2BAA2B,QAAQ;IAElE,OAAO,eAAe;IAEtB,MAAM,MAAM,OAAO,sBACjB,eACA,4BAA4B,UAAU,SAAS,aAAa;KAC1D;KACA;KACA,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;IACzC,CAAC,CACH;IAEA,OAAO;KACL,eAAe;MACb,UAAU,SAAS;MACnB,UAAU,SAAS;MACnB,yBAAyB,SAAS;MAClC,QAAQ,SAAS;MACjB,oBAAoB,SAAS;MAC7B,YAAY,SAAS;MACrB,aAAa,SAAS;KACxB;KACA,kBAAkB,SAAS,KAAK,IAAI,IAAI;KACxC,SAAS;MACP,WAAW;MACX,OAAO,SAAS,KAAK,KAAK;MAC1B,cAAc,SAAS,KAAK,QAAQ;MACpC,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,SAAS,KAAK,KAAK,EAAE;KACnE;IACF;GACF;GACA,OAAO;EACT,CAAC;EAED,OAAO,OAAO,cAAc,0BAA0B,MAAM;CAC9D,CAAC;CAED,MAAM,2BACJ,OAAO,GAAG,uCAAuC,CAAC,CAAC,WAAW,OAAO;EACnE,MAAM,UAAU,OAAO,cAAc,eAAe,KAAK;EACzD,MAAM,QAAQ,QAAQ;EAEtB,MAAM,QAAQ,UAAU,MACrB,EAAE,eACD,SAAS,aAAa,MAAM,YAC5B,SAAS,4BAA4B,MAAM,uBAC/C;EAEA,IAAI,UAAU,KAAA,GAAW,OAAO,OAAO,YAAY;EACnD,MAAM,WAAW,MAAM;EAEvB,MAAM,WAAW,SAAS,UAAU,MACjC,cAAc,UAAU,eAAe,MAAM,UAChD;EAEA,IACE,SAAS,aAAa,MAAM,YAC5B,SAAS,WAAW,MAAM,UAC1B,SAAS,uBAAuB,MAAM,sBACtC,UAAU,gBAAgB,MAAM,aAEhC,OAAO,OAAO,YAAY;EAC5B,IACG,SAAS,aAAa,YAAa,QAAQ,QAAQ,cAAc,KAAA,MAClE,SAAS,MAAM,QAAQ,SAAS,KAAK,MAAM,SAAS,MAAM,QAAQ,QAAQ,KAAK,MAC9E,SAAS,uBAAuB,aAC7B,QAAQ,SAAS,WAAW,SAAS,SACrC,QAAQ,SAAS,WAAW,KAAA,IAEhC,OAAO,OAAO,SAAS;EACzB,MAAM,YAAY,SAAS,cAAc,QAAQ,qBAAqB;EAEtE,IAAI,YAAY,KAAK,YAAY,SAAS,cAAc,OAAO,SAAS,GAAG,GACzE,OAAO,OAAO,SAAS;EAEzB,MAAM,YAAY,OAAO,OAAO,WAAW;GACzC,KAAK,OAAO,WAAW;IACrB,MAAM,gBAAgB,qBAAqB,OAAO,gBAAgB,OAAO,MAAM;IAE/E,MAAM,aAAa,IAAI,IAAI,MAAM,WAAW;IAE5C,WAAW,aAAa,IAAI,QAAQ,SAAS,MAAM,QAAQ,SAAS,IAAI,CAAC;IACzE,WAAW,aAAa,IAAI,SAAS,SAAS,MAAM,QAAQ,SAAS,KAAK,CAAC;IAC3E,IAAI,QAAQ,SAAS,WAAW,KAAA,GAC9B,WAAW,aAAa,IAAI,OAAO,QAAQ,SAAS,MAAM;IAE5D,MAAM,SAAS,MAAM,OAAO,uBAC1B,eACA,YACA;KACE,kBAAkB,SAAS,MAAM,QAAQ,QAAQ,YAAY;KAC7D,eAAe,SAAS,MAAM,QAAQ,QAAQ,KAAK;KACnD,GAAI,SAAS,aAAa,SACtB;MACE,eAAe,SAAS,MAAM,QAAQ,QAAQ,SAAU;MACxD,iBAAiB;MACjB,GAAI,SAAS,kBAAkB,KAAA,IAC3B,CAAC,IACD,EAAE,QAAQ,SAAS,cAAc;KACvC,IACA,CAAC;IACP,GACA,SAAS,eACX;IAEA,OAAO,eAAe;IACtB,IAAI,SAAS,aAAa,QACxB,OAAO;KAAE,UAAU;KAAiB,QAAQ,OAAO,OAAO;IAAE;IAC9D,IAAI,OAAO,eAAe,UAAU,MAAM,YAAY;IAEtD,MAAM,WAAW,MAAM,OAAO,uBAC5B,eACA,OAAO,cACP,IAAI,IAAI,SAAS,eAAe,GAAG,GACnC,OACA,KAAA,GACA,IAAI,QAAQ,SAAS,eAAe,OAAO,CAC7C;IAEA,OAAO,eAAe;IACtB,IACE,SAAS,WAAW,OACpB,SAAS,QAAQ,IAAI,cAAc,CAAC,EAAE,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,YAAY,MACzE,oBAEF,MAAM,YAAY;IACpB,MAAM,OAAgB,MAAM,SAAS,KAAK;IAE1C,OAAO,eAAe;IAEtB,OAAO;KAAE,UAAU;KAAkB;IAAK;GAC5C;GACA,OAAO;EACT,CAAC;EAED,IAAI,UAAU,aAAa,QAAQ;GAEjC,MAAM,SAAS,OAAO,OAAO,oBAAoB,YAAY,CAAC,CAAC,UAAU,MAAM,CAAC,CAAC,KAC/E,OAAO,SAAS,QAAQ,CAC1B;GAEA,MAAM,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG,IAAI;GAC1D,MAAM,WAAW,OAAO,OAAO,QAAQ,WAAW,OAAO,MAAM,OAAO,IAAI;GAE1E,IACE,SAAS,aAAa,UACtB,OAAO,QAAQ,SAAS,UACxB,aAAa,SAAS,YACrB,OAAO,QAAQ,KAAA,KAAa,OAAO,QAAQ,SAAS,YACrD,OAAO,OAAO,OACd,OAAO,MAAM,OACZ,OAAO,QAAQ,KAAA,KAAa,OAAO,MAAM,OACzC,OAAO,cAAc,KAAA,KAAa,OAAO,YAAY,OACrD,SAAS,kBAAkB,KAAA,MACzB,OAAO,cAAc,KAAA,KACpB,OAAO,YAAY,SAAS,gBAAgB,KAAK,MAAM,GAAG,IAE9D,OAAO,OAAO,SAAS;GAEzB,OAAO,OAAO,cAAc,+BAA+B;IACzD,UAAU;KAAE,UAAU,SAAS;KAAU,QAAQ,SAAS;KAAQ,SAAS,OAAO;IAAI;IACtF,GAAI,OAAO,cAAc,KAAA,IACrB,CAAC,IACD,EACE,yBAAyB,SAAS,WAChC,KAAK,IAAI,WAAW,OAAO,YAAY,GAAI,CAC7C,EACF;GACN,CAAC;EACH;EACA,IAAI,SAAS,aAAa,SAAS,OAAO,OAAO,YAAY;EAE7D,MAAM,UAAU,OAAO,OAAO,cAC5B,SAAS,eAAe,eAAe,UAAU,IAAI,CACvD,CAAC,CAAC,KACA,OAAO,eAAe,OAAO,GAC7B,OAAO,YACJ,UAA0E;GACzE,IAAI,MAAM,cAAc,KAAK,GAC3B,OAAO,kBAAkB,kBAAkB,KAAK,CAAC,CAAC,KAChD,OAAO,QAAQ,OAAO,SAAS,CACjC;GACF,IACE,MAAM,QAAQ,WAAW,KACzB,MAAM,QAAQ,EAAE,EAAE,SAAS,UAC3B,OAAO,GAAG,qBAAqB,CAAC,CAAC,MAAM,QAAQ,EAAE,CAAC,KAAK,GAEvD,OAAO,OAAO,KAAK,SAAS,CAAC;GAE/B,OAAO,kBAAkB,kBAAkB,KAAK,CAAC,CAAC,KAChD,OAAO,QAAQ,OAAO,KAAK,YAAY,CAAC,CAAC,CAC3C;EACF,CACF,CACF;EAEA,MAAM,WAAW,OAAO,OAAO,aAAa,mBAAmB,CAAC,CAAC,OAAO,CAAC,CAAC,KACxE,OAAO,SAAS,QAAQ,CAC1B;EAEA,OAAO,OAAO,cAAc,+BAA+B;GACzD,UAAU;IACR,UAAU,SAAS;IACnB,QAAQ,SAAS;IACjB,SAAS,SAAS;GACpB;GACA,GAAI,SAAS,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,SAAS,QAAQ;EACxE,CAAC;CACH,CAAC;CAEH,OAAO,cAAc,GAAG;EACtB,uBAAuB,UAAU,oBAAoB,qBAAqB,KAAK,CAAC;EAChF,2BAA2B,UAAU,oBAAoB,yBAAyB,KAAK,CAAC;CAC1F,CAAC;AACH,GACA,mBACF;AAEA,MAAa,kCACX,YACG,MAAM,OAAO,eAAe,8BAA8B,OAAO,CAAC"}
+{"version":3,"file":"protocol.mjs","names":[],"sources":["../../../src/oauth/openid-client/protocol.ts"],"sourcesContent":["import { Cause, DateTime, Effect, Layer, Redacted, Schema } from \"effect\";\nimport * as client from \"openid-client\";\n\nimport { reportAuthFailure } from \"../../internal/diagnostics\";\nimport { RequestBindingFlowId } from \"../../operations/requestBinding\";\nimport { OAuthProtocol } from \"../OAuthProtocol\";\nimport { OAuthProviderKey } from \"../schema\";\nimport { OAuthProtocolRejected, OAuthRejected, OAuthUnavailable } from \"../signInErrors\";\nimport {\n  OAuthCallbackId,\n  OAuthCodeResponse,\n  OAuthDisplayProfile,\n  OAuthProtocolConfiguration,\n  OAuthProtocolPreparation,\n  OAuthTransactionSecrets,\n  OAuthVerifiedExternalIdentity,\n} from \"../signInModels\";\nimport { snapshotOAuth } from \"../signInSnapshot\";\nimport { DefiniteTokenRejection, tokenCompatibility } from \"./compatibility\";\nimport {\n  clientAuthentication,\n  installConfigurations,\n  makeAuthorizationParameters,\n  type InstalledProvider,\n} from \"./configuration\";\nimport {\n  type OpenIdClientConfigurationError,\n  type OpenIdClientOAuthProtocolOptions,\n} from \"./models\";\nimport { decodeOidcProfile } from \"./profile\";\nimport { boundedFetch } from \"./transport\";\n\nconst beginInput = Schema.Struct({\n  provider: OAuthProviderKey,\n  callbackId: OAuthCallbackId,\n  flowId: RequestBindingFlowId,\n});\n\nconst exchangeInput = Schema.toType(\n  Schema.Struct({\n    configuration: OAuthProtocolConfiguration,\n    response: OAuthCodeResponse,\n    secrets: OAuthTransactionSecrets,\n    verificationStartedAt: Schema.DateTimeUtcFromMillis,\n  }),\n);\n\nconst numericDate = Schema.Finite.check(Schema.isBetween({ minimum: 0, maximum: 8640000000000 }));\n\nconst claimsSchema = Schema.Struct({\n  iss: Schema.String,\n  sub: OAuthVerifiedExternalIdentity.fields.identity.fields.subject,\n  aud: Schema.Union([\n    Schema.String,\n    Schema.Array(Schema.String).check(Schema.isMinLength(1), Schema.isMaxLength(1)),\n  ]),\n  azp: Schema.optionalKey(Schema.String),\n  exp: numericDate,\n  iat: numericDate,\n  nbf: Schema.optionalKey(numericDate),\n  auth_time: Schema.optionalKey(numericDate),\n});\n\nconst plainIdentitySchema = Schema.Struct({\n  subject: OAuthVerifiedExternalIdentity.fields.identity.fields.subject,\n  profile: Schema.optionalKey(OAuthDisplayProfile),\n});\n\nconst unavailable = () => OAuthUnavailable.make({});\nconst rejected = () => OAuthProtocolRejected.make({});\n\nconst unavailableOnDefect = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n  effect.pipe(\n    Effect.tapCause((cause) =>\n      Cause.hasDies(cause) ? reportAuthFailure(\"oauth-protocol\", cause) : Effect.void,\n    ),\n    Effect.catchCause((cause): Effect.Effect<never, E | OAuthUnavailable> => {\n      if (Cause.hasInterrupts(cause)) return Effect.interrupt;\n      if (Cause.hasDies(cause)) return Effect.fail(unavailable());\n\n      return Effect.failCause(cause);\n    }),\n  );\n\n/** Only precise claim errors and a fully parsed invalid_grant are definite.\n * INVALID_RESPONSE also covers signature/key/transport faults; keep it ambiguous. */\nconst grantError = (error: unknown) => {\n  if (\n    error instanceof DefiniteTokenRejection ||\n    (error instanceof client.ClientError && error.cause instanceof DefiniteTokenRejection)\n  )\n    return rejected();\n  if (\n    error instanceof client.ClientError &&\n    (error.code === \"OAUTH_JWT_CLAIM_COMPARISON_FAILED\" ||\n      error.code === \"OAUTH_JWT_TIMESTAMP_CHECK_FAILED\")\n  )\n    return rejected();\n  if (\n    error instanceof client.ResponseBodyError &&\n    error.status === 400 &&\n    error.error === \"invalid_grant\"\n  )\n    return rejected();\n\n  return unavailable();\n};\n\nconst privateConfiguration = <R>(\n  entry: InstalledProvider<R>,\n  timeout: number,\n  fetch: client.CustomFetch,\n  signal: AbortSignal,\n) => {\n  const provider = entry.provider;\n  const compatibility = provider.protocol === \"oauth\" ? provider[tokenCompatibility] : undefined;\n\n  const configuration = new client.Configuration(\n    entry.metadata,\n    provider.clientId,\n    {\n      [client.clockSkew]: 0,\n      [client.clockTolerance]: 0,\n      ...(provider.protocol === \"oidc\"\n        ? { id_token_signed_response_alg: provider.idTokenSignedResponseAlg }\n        : {}),\n    },\n    clientAuthentication(provider.authentication),\n  );\n\n  configuration.timeout = timeout;\n  const transport = boundedFetch(fetch, signal, entry.allowedUrls);\n\n  configuration[client.customFetch] =\n    compatibility === undefined\n      ? transport\n      : async (url, options) => {\n          const response = await transport(url, options);\n\n          if (url === new URL(entry.metadata.token_endpoint!).href) {\n            const body: unknown = await response.clone().json();\n\n            signal.throwIfAborted();\n            compatibility.inspectReceipt(\n              { body, status: response.status, contentType: response.headers.get(\"content-type\") },\n              {\n                scopes: provider.scopes,\n                refreshRequired: false,\n                operation: \"authorization_code\",\n              },\n            );\n            signal.throwIfAborted();\n          }\n\n          return response;\n        };\n  if (provider.protocol === \"oidc\") client.enableNonRepudiationChecks(configuration);\n\n  return configuration;\n};\n\nexport const makeOpenIdClientOAuthProtocol = Effect.fn(\"makeOpenIdClientOAuthProtocol\")(\n  // Capture one provider table; each generation retains its own receipt rules.\n  function* <R = never>(\n    options: OpenIdClientOAuthProtocolOptions<R>,\n  ): Effect.fn.Return<\n    OAuthProtocol[\"Service\"],\n    OpenIdClientConfigurationError | OAuthUnavailable,\n    R\n  > {\n    const context = yield* Effect.context<R>();\n    const { installed, fetch, timeoutSeconds } = yield* installConfigurations(options);\n\n    const prepareAuthorization: OAuthProtocol[\"Service\"][\"prepareAuthorization\"] = Effect.fn(\n      \"OpenIdClient.prepareAuthorization\",\n    )(function* (input) {\n      const request = yield* Schema.decodeEffect(beginInput)(input).pipe(\n        Effect.mapError(() => OAuthRejected.make({})),\n      );\n\n      const entry = installed.find(\n        ({ provider }) => provider.issuance === \"active\" && provider.provider === request.provider,\n      );\n\n      const provider = entry?.provider;\n\n      const callback = provider?.callbacks.find(\n        (candidate) => candidate.callbackId === request.callbackId,\n      );\n\n      if (entry === undefined || provider === undefined || callback === undefined)\n        return yield* OAuthRejected.make({});\n\n      const result = yield* Effect.tryPromise({\n        try: async (signal) => {\n          const configuration = privateConfiguration(entry, timeoutSeconds, fetch, signal);\n\n          const state = client.randomState();\n          const verifier = client.randomPKCECodeVerifier();\n          const nonce = provider.protocol === \"oidc\" ? client.randomNonce() : undefined;\n          const challenge = await client.calculatePKCECodeChallenge(verifier);\n\n          signal.throwIfAborted();\n\n          const url = client.buildAuthorizationUrl(\n            configuration,\n            makeAuthorizationParameters(provider, callback.redirectUri, {\n              state,\n              challenge,\n              ...(nonce === undefined ? {} : { nonce }),\n            }),\n          );\n\n          return {\n            configuration: {\n              provider: provider.provider,\n              protocol: provider.protocol,\n              configurationGeneration: provider.configurationGeneration,\n              issuer: provider.issuer,\n              responseIssuerMode: provider.responseIssuerMode,\n              callbackId: callback.callbackId,\n              redirectUri: callback.redirectUri,\n            },\n            authorizationUrl: Redacted.make(url.href),\n            secrets: {\n              namespace: \"effect-auth/oauth-transaction-secrets/v1\" as const,\n              state: Redacted.make(state),\n              pkceVerifier: Redacted.make(verifier),\n              ...(nonce === undefined ? {} : { oidcNonce: Redacted.make(nonce) }),\n            },\n          };\n        },\n        catch: unavailable,\n      });\n\n      return yield* snapshotOAuth(OAuthProtocolPreparation, result);\n    });\n\n    const exchangeVerifiedIdentity: OAuthProtocol[\"Service\"][\"exchangeVerifiedIdentity\"] =\n      Effect.fn(\"OpenIdClient.exchangeVerifiedIdentity\")(function* (input) {\n        const request = yield* snapshotOAuth(exchangeInput, input);\n        const saved = request.configuration;\n\n        const entry = installed.find(\n          ({ provider }) =>\n            provider.provider === saved.provider &&\n            provider.configurationGeneration === saved.configurationGeneration,\n        );\n\n        if (entry === undefined) return yield* unavailable();\n        const provider = entry.provider;\n\n        const callback = provider.callbacks.find(\n          (candidate) => candidate.callbackId === saved.callbackId,\n        );\n\n        if (\n          provider.protocol !== saved.protocol ||\n          provider.issuer !== saved.issuer ||\n          provider.responseIssuerMode !== saved.responseIssuerMode ||\n          callback?.redirectUri !== saved.redirectUri\n        )\n          return yield* unavailable();\n        if (\n          (provider.protocol === \"oidc\") !== (request.secrets.oidcNonce !== undefined) ||\n          Redacted.value(request.response.state) !== Redacted.value(request.secrets.state) ||\n          (provider.responseIssuerMode === \"required\"\n            ? request.response.issuer !== provider.issuer\n            : request.response.issuer !== undefined)\n        )\n          return yield* rejected();\n        const startedAt = DateTime.toEpochMillis(request.verificationStartedAt);\n\n        if (startedAt < 0 || startedAt > DateTime.toEpochMillis(yield* DateTime.now))\n          return yield* rejected();\n\n        const exchanged = yield* Effect.tryPromise({\n          try: async (signal) => {\n            const configuration = privateConfiguration(entry, timeoutSeconds, fetch, signal);\n\n            const currentUrl = new URL(saved.redirectUri);\n\n            currentUrl.searchParams.set(\"code\", Redacted.value(request.response.code));\n            currentUrl.searchParams.set(\"state\", Redacted.value(request.response.state));\n            if (request.response.issuer !== undefined)\n              currentUrl.searchParams.set(\"iss\", request.response.issuer);\n\n            const tokens = await client.authorizationCodeGrant(\n              configuration,\n              currentUrl,\n              {\n                pkceCodeVerifier: Redacted.value(request.secrets.pkceVerifier),\n                expectedState: Redacted.value(request.secrets.state),\n                ...(provider.protocol === \"oidc\"\n                  ? {\n                      expectedNonce: Redacted.value(request.secrets.oidcNonce!),\n                      idTokenExpected: true,\n                      ...(provider.maxAgeSeconds === undefined\n                        ? {}\n                        : { maxAge: provider.maxAgeSeconds }),\n                    }\n                  : {}),\n              },\n              provider.tokenParameters,\n            );\n\n            signal.throwIfAborted();\n            if (provider.protocol === \"oidc\")\n              return { protocol: \"oidc\" as const, claims: tokens.claims() };\n            if (tokens.token_type !== \"bearer\") throw unavailable();\n\n            const response = await client.fetchProtectedResource(\n              configuration,\n              tokens.access_token,\n              new URL(provider.identitySource.url),\n              \"GET\",\n              undefined,\n              new Headers(provider.identitySource.headers),\n            );\n\n            signal.throwIfAborted();\n            if (\n              response.status !== 200 ||\n              response.headers.get(\"content-type\")?.split(\";\", 1)[0]?.trim().toLowerCase() !==\n                \"application/json\"\n            )\n              throw unavailable();\n            const body: unknown = await response.json();\n\n            signal.throwIfAborted();\n\n            return { protocol: \"oauth\" as const, body };\n          },\n          catch: grantError,\n        });\n\n        if (exchanged.protocol === \"oidc\") {\n          // oxlint-disable-next-line no-restricted-properties -- Project validated foreign ID-token claims into the adapter's stricter bounded profile.\n          const claims = yield* Schema.decodeUnknownEffect(claimsSchema)(exchanged.claims).pipe(\n            Effect.mapError(rejected),\n          );\n\n          const now = DateTime.toEpochMillis(yield* DateTime.now) / 1000;\n          const audience = typeof claims.aud === \"string\" ? claims.aud : claims.aud[0];\n\n          if (\n            provider.protocol !== \"oidc\" ||\n            claims.iss !== provider.issuer ||\n            audience !== provider.clientId ||\n            (claims.azp !== undefined && claims.azp !== provider.clientId) ||\n            claims.exp <= now ||\n            claims.iat > now ||\n            (claims.nbf !== undefined && claims.nbf > now) ||\n            (claims.auth_time !== undefined && claims.auth_time > now) ||\n            (provider.maxAgeSeconds !== undefined &&\n              (claims.auth_time === undefined ||\n                claims.auth_time + provider.maxAgeSeconds < Math.floor(now)))\n          )\n            return yield* rejected();\n\n          const profile = yield* decodeOidcProfile(exchanged.claims);\n\n          return yield* snapshotOAuth(OAuthVerifiedExternalIdentity, {\n            identity: { provider: provider.provider, issuer: provider.issuer, subject: claims.sub },\n            ...(profile === undefined ? {} : { profile }),\n            ...(claims.auth_time === undefined\n              ? {}\n              : {\n                  upstreamAuthenticatedAt: DateTime.makeUnsafe(\n                    Math.min(startedAt, claims.auth_time * 1000),\n                  ),\n                }),\n          });\n        }\n        if (provider.protocol !== \"oauth\") return yield* unavailable();\n\n        const decoded = yield* Effect.suspend(() =>\n          provider.identitySource.decodeIdentity(exchanged.body),\n        ).pipe(\n          Effect.provideContext(context),\n          Effect.catchCause(\n            (cause): Effect.Effect<never, OAuthProtocolRejected | OAuthUnavailable> => {\n              if (Cause.hasInterrupts(cause))\n                return reportAuthFailure(\"oauth-identity\", cause).pipe(\n                  Effect.andThen(Effect.interrupt),\n                );\n              if (\n                cause.reasons.length === 1 &&\n                cause.reasons[0]?._tag === \"Fail\" &&\n                Schema.is(OAuthProtocolRejected)(cause.reasons[0].error)\n              )\n                return Effect.fail(rejected());\n\n              return reportAuthFailure(\"oauth-identity\", cause).pipe(\n                Effect.andThen(Effect.fail(unavailable())),\n              );\n            },\n          ),\n        );\n\n        const identity = yield* Schema.decodeEffect(plainIdentitySchema)(decoded).pipe(\n          Effect.mapError(rejected),\n        );\n\n        return yield* snapshotOAuth(OAuthVerifiedExternalIdentity, {\n          identity: {\n            provider: provider.provider,\n            issuer: provider.issuer,\n            subject: identity.subject,\n          },\n          ...(identity.profile === undefined ? {} : { profile: identity.profile }),\n        });\n      });\n\n    return OAuthProtocol.of({\n      prepareAuthorization: (input) => unavailableOnDefect(prepareAuthorization(input)),\n      exchangeVerifiedIdentity: (input) => unavailableOnDefect(exchangeVerifiedIdentity(input)),\n    });\n  },\n  unavailableOnDefect,\n);\n\nexport const openIdClientOAuthProtocolLayer = <R = never>(\n  options: OpenIdClientOAuthProtocolOptions<R>,\n) => Layer.effect(OAuthProtocol, makeOpenIdClientOAuthProtocol(options));\n"],"mappings":";;;;;;;;;;;;;;AAgCA,MAAM,aAAa,OAAO,OAAO;CAC/B,UAAU;CACV,YAAY;CACZ,QAAQ;AACV,CAAC;AAED,MAAM,gBAAgB,OAAO,OAC3B,OAAO,OAAO;CACZ,eAAe;CACf,UAAU;CACV,SAAS;CACT,uBAAuB,OAAO;AAChC,CAAC,CACH;AAEA,MAAM,cAAc,OAAO,OAAO,MAAM,OAAO,UAAU;CAAE,SAAS;CAAG,SAAS;AAAc,CAAC,CAAC;AAEhG,MAAM,eAAe,OAAO,OAAO;CACjC,KAAK,OAAO;CACZ,KAAK,8BAA8B,OAAO,SAAS,OAAO;CAC1D,KAAK,OAAO,MAAM,CAChB,OAAO,QACP,OAAO,MAAM,OAAO,MAAM,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,CAAC,CAAC,CAChF,CAAC;CACD,KAAK,OAAO,YAAY,OAAO,MAAM;CACrC,KAAK;CACL,KAAK;CACL,KAAK,OAAO,YAAY,WAAW;CACnC,WAAW,OAAO,YAAY,WAAW;AAC3C,CAAC;AAED,MAAM,sBAAsB,OAAO,OAAO;CACxC,SAAS,8BAA8B,OAAO,SAAS,OAAO;CAC9D,SAAS,OAAO,YAAY,mBAAmB;AACjD,CAAC;AAED,MAAM,oBAAoB,iBAAiB,KAAK,CAAC,CAAC;AAClD,MAAM,iBAAiB,sBAAsB,KAAK,CAAC,CAAC;AAEpD,MAAM,uBAAgC,WACpC,OAAO,KACL,OAAO,UAAU,UACf,MAAM,QAAQ,KAAK,IAAI,kBAAkB,kBAAkB,KAAK,IAAI,OAAO,IAC7E,GACA,OAAO,YAAY,UAAsD;CACvE,IAAI,MAAM,cAAc,KAAK,GAAG,OAAO,OAAO;CAC9C,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,OAAO,KAAK,YAAY,CAAC;CAE1D,OAAO,OAAO,UAAU,KAAK;AAC/B,CAAC,CACH;;;AAIF,MAAM,cAAc,UAAmB;CACrC,IACE,iBAAiB,0BAChB,iBAAiB,OAAO,eAAe,MAAM,iBAAiB,wBAE/D,OAAO,SAAS;CAClB,IACE,iBAAiB,OAAO,gBACvB,MAAM,SAAS,uCACd,MAAM,SAAS,qCAEjB,OAAO,SAAS;CAClB,IACE,iBAAiB,OAAO,qBACxB,MAAM,WAAW,OACjB,MAAM,UAAU,iBAEhB,OAAO,SAAS;CAElB,OAAO,YAAY;AACrB;AAEA,MAAM,wBACJ,OACA,SACA,OACA,WACG;CACH,MAAM,WAAW,MAAM;CACvB,MAAM,gBAAgB,SAAS,aAAa,UAAU,SAAS,sBAAsB,KAAA;CAErF,MAAM,gBAAgB,IAAI,OAAO,cAC/B,MAAM,UACN,SAAS,UACT;GACG,OAAO,YAAY;GACnB,OAAO,iBAAiB;EACzB,GAAI,SAAS,aAAa,SACtB,EAAE,8BAA8B,SAAS,yBAAyB,IAClE,CAAC;CACP,GACA,qBAAqB,SAAS,cAAc,CAC9C;CAEA,cAAc,UAAU;CACxB,MAAM,YAAY,aAAa,OAAO,QAAQ,MAAM,WAAW;CAE/D,cAAc,OAAO,eACnB,kBAAkB,KAAA,IACd,YACA,OAAO,KAAK,YAAY;EACtB,MAAM,WAAW,MAAM,UAAU,KAAK,OAAO;EAE7C,IAAI,QAAQ,IAAI,IAAI,MAAM,SAAS,cAAe,CAAC,CAAC,MAAM;GACxD,MAAM,OAAgB,MAAM,SAAS,MAAM,CAAC,CAAC,KAAK;GAElD,OAAO,eAAe;GACtB,cAAc,eACZ;IAAE;IAAM,QAAQ,SAAS;IAAQ,aAAa,SAAS,QAAQ,IAAI,cAAc;GAAE,GACnF;IACE,QAAQ,SAAS;IACjB,iBAAiB;IACjB,WAAW;GACb,CACF;GACA,OAAO,eAAe;EACxB;EAEA,OAAO;CACT;CACN,IAAI,SAAS,aAAa,QAAQ,OAAO,2BAA2B,aAAa;CAEjF,OAAO;AACT;AAEA,MAAa,gCAAgC,OAAO,GAAG,+BAA+B,CAAC,CAErF,WACE,SAKA;CACA,MAAM,UAAU,OAAO,OAAO,QAAW;CACzC,MAAM,EAAE,WAAW,OAAO,mBAAmB,OAAO,sBAAsB,OAAO;CAEjF,MAAM,uBAAyE,OAAO,GACpF,mCACF,CAAC,CAAC,WAAW,OAAO;EAClB,MAAM,UAAU,OAAO,OAAO,aAAa,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,KAC5D,OAAO,eAAe,cAAc,KAAK,CAAC,CAAC,CAAC,CAC9C;EAEA,MAAM,QAAQ,UAAU,MACrB,EAAE,eAAe,SAAS,aAAa,YAAY,SAAS,aAAa,QAAQ,QACpF;EAEA,MAAM,WAAW,OAAO;EAExB,MAAM,WAAW,UAAU,UAAU,MAClC,cAAc,UAAU,eAAe,QAAQ,UAClD;EAEA,IAAI,UAAU,KAAA,KAAa,aAAa,KAAA,KAAa,aAAa,KAAA,GAChE,OAAO,OAAO,cAAc,KAAK,CAAC,CAAC;EAErC,MAAM,SAAS,OAAO,OAAO,WAAW;GACtC,KAAK,OAAO,WAAW;IACrB,MAAM,gBAAgB,qBAAqB,OAAO,gBAAgB,OAAO,MAAM;IAE/E,MAAM,QAAQ,OAAO,YAAY;IACjC,MAAM,WAAW,OAAO,uBAAuB;IAC/C,MAAM,QAAQ,SAAS,aAAa,SAAS,OAAO,YAAY,IAAI,KAAA;IACpE,MAAM,YAAY,MAAM,OAAO,2BAA2B,QAAQ;IAElE,OAAO,eAAe;IAEtB,MAAM,MAAM,OAAO,sBACjB,eACA,4BAA4B,UAAU,SAAS,aAAa;KAC1D;KACA;KACA,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;IACzC,CAAC,CACH;IAEA,OAAO;KACL,eAAe;MACb,UAAU,SAAS;MACnB,UAAU,SAAS;MACnB,yBAAyB,SAAS;MAClC,QAAQ,SAAS;MACjB,oBAAoB,SAAS;MAC7B,YAAY,SAAS;MACrB,aAAa,SAAS;KACxB;KACA,kBAAkB,SAAS,KAAK,IAAI,IAAI;KACxC,SAAS;MACP,WAAW;MACX,OAAO,SAAS,KAAK,KAAK;MAC1B,cAAc,SAAS,KAAK,QAAQ;MACpC,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,SAAS,KAAK,KAAK,EAAE;KACnE;IACF;GACF;GACA,OAAO;EACT,CAAC;EAED,OAAO,OAAO,cAAc,0BAA0B,MAAM;CAC9D,CAAC;CAED,MAAM,2BACJ,OAAO,GAAG,uCAAuC,CAAC,CAAC,WAAW,OAAO;EACnE,MAAM,UAAU,OAAO,cAAc,eAAe,KAAK;EACzD,MAAM,QAAQ,QAAQ;EAEtB,MAAM,QAAQ,UAAU,MACrB,EAAE,eACD,SAAS,aAAa,MAAM,YAC5B,SAAS,4BAA4B,MAAM,uBAC/C;EAEA,IAAI,UAAU,KAAA,GAAW,OAAO,OAAO,YAAY;EACnD,MAAM,WAAW,MAAM;EAEvB,MAAM,WAAW,SAAS,UAAU,MACjC,cAAc,UAAU,eAAe,MAAM,UAChD;EAEA,IACE,SAAS,aAAa,MAAM,YAC5B,SAAS,WAAW,MAAM,UAC1B,SAAS,uBAAuB,MAAM,sBACtC,UAAU,gBAAgB,MAAM,aAEhC,OAAO,OAAO,YAAY;EAC5B,IACG,SAAS,aAAa,YAAa,QAAQ,QAAQ,cAAc,KAAA,MAClE,SAAS,MAAM,QAAQ,SAAS,KAAK,MAAM,SAAS,MAAM,QAAQ,QAAQ,KAAK,MAC9E,SAAS,uBAAuB,aAC7B,QAAQ,SAAS,WAAW,SAAS,SACrC,QAAQ,SAAS,WAAW,KAAA,IAEhC,OAAO,OAAO,SAAS;EACzB,MAAM,YAAY,SAAS,cAAc,QAAQ,qBAAqB;EAEtE,IAAI,YAAY,KAAK,YAAY,SAAS,cAAc,OAAO,SAAS,GAAG,GACzE,OAAO,OAAO,SAAS;EAEzB,MAAM,YAAY,OAAO,OAAO,WAAW;GACzC,KAAK,OAAO,WAAW;IACrB,MAAM,gBAAgB,qBAAqB,OAAO,gBAAgB,OAAO,MAAM;IAE/E,MAAM,aAAa,IAAI,IAAI,MAAM,WAAW;IAE5C,WAAW,aAAa,IAAI,QAAQ,SAAS,MAAM,QAAQ,SAAS,IAAI,CAAC;IACzE,WAAW,aAAa,IAAI,SAAS,SAAS,MAAM,QAAQ,SAAS,KAAK,CAAC;IAC3E,IAAI,QAAQ,SAAS,WAAW,KAAA,GAC9B,WAAW,aAAa,IAAI,OAAO,QAAQ,SAAS,MAAM;IAE5D,MAAM,SAAS,MAAM,OAAO,uBAC1B,eACA,YACA;KACE,kBAAkB,SAAS,MAAM,QAAQ,QAAQ,YAAY;KAC7D,eAAe,SAAS,MAAM,QAAQ,QAAQ,KAAK;KACnD,GAAI,SAAS,aAAa,SACtB;MACE,eAAe,SAAS,MAAM,QAAQ,QAAQ,SAAU;MACxD,iBAAiB;MACjB,GAAI,SAAS,kBAAkB,KAAA,IAC3B,CAAC,IACD,EAAE,QAAQ,SAAS,cAAc;KACvC,IACA,CAAC;IACP,GACA,SAAS,eACX;IAEA,OAAO,eAAe;IACtB,IAAI,SAAS,aAAa,QACxB,OAAO;KAAE,UAAU;KAAiB,QAAQ,OAAO,OAAO;IAAE;IAC9D,IAAI,OAAO,eAAe,UAAU,MAAM,YAAY;IAEtD,MAAM,WAAW,MAAM,OAAO,uBAC5B,eACA,OAAO,cACP,IAAI,IAAI,SAAS,eAAe,GAAG,GACnC,OACA,KAAA,GACA,IAAI,QAAQ,SAAS,eAAe,OAAO,CAC7C;IAEA,OAAO,eAAe;IACtB,IACE,SAAS,WAAW,OACpB,SAAS,QAAQ,IAAI,cAAc,CAAC,EAAE,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,YAAY,MACzE,oBAEF,MAAM,YAAY;IACpB,MAAM,OAAgB,MAAM,SAAS,KAAK;IAE1C,OAAO,eAAe;IAEtB,OAAO;KAAE,UAAU;KAAkB;IAAK;GAC5C;GACA,OAAO;EACT,CAAC;EAED,IAAI,UAAU,aAAa,QAAQ;GAEjC,MAAM,SAAS,OAAO,OAAO,oBAAoB,YAAY,CAAC,CAAC,UAAU,MAAM,CAAC,CAAC,KAC/E,OAAO,SAAS,QAAQ,CAC1B;GAEA,MAAM,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG,IAAI;GAC1D,MAAM,WAAW,OAAO,OAAO,QAAQ,WAAW,OAAO,MAAM,OAAO,IAAI;GAE1E,IACE,SAAS,aAAa,UACtB,OAAO,QAAQ,SAAS,UACxB,aAAa,SAAS,YACrB,OAAO,QAAQ,KAAA,KAAa,OAAO,QAAQ,SAAS,YACrD,OAAO,OAAO,OACd,OAAO,MAAM,OACZ,OAAO,QAAQ,KAAA,KAAa,OAAO,MAAM,OACzC,OAAO,cAAc,KAAA,KAAa,OAAO,YAAY,OACrD,SAAS,kBAAkB,KAAA,MACzB,OAAO,cAAc,KAAA,KACpB,OAAO,YAAY,SAAS,gBAAgB,KAAK,MAAM,GAAG,IAE9D,OAAO,OAAO,SAAS;GAEzB,MAAM,UAAU,OAAO,kBAAkB,UAAU,MAAM;GAEzD,OAAO,OAAO,cAAc,+BAA+B;IACzD,UAAU;KAAE,UAAU,SAAS;KAAU,QAAQ,SAAS;KAAQ,SAAS,OAAO;IAAI;IACtF,GAAI,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ;IAC3C,GAAI,OAAO,cAAc,KAAA,IACrB,CAAC,IACD,EACE,yBAAyB,SAAS,WAChC,KAAK,IAAI,WAAW,OAAO,YAAY,GAAI,CAC7C,EACF;GACN,CAAC;EACH;EACA,IAAI,SAAS,aAAa,SAAS,OAAO,OAAO,YAAY;EAE7D,MAAM,UAAU,OAAO,OAAO,cAC5B,SAAS,eAAe,eAAe,UAAU,IAAI,CACvD,CAAC,CAAC,KACA,OAAO,eAAe,OAAO,GAC7B,OAAO,YACJ,UAA0E;GACzE,IAAI,MAAM,cAAc,KAAK,GAC3B,OAAO,kBAAkB,kBAAkB,KAAK,CAAC,CAAC,KAChD,OAAO,QAAQ,OAAO,SAAS,CACjC;GACF,IACE,MAAM,QAAQ,WAAW,KACzB,MAAM,QAAQ,EAAE,EAAE,SAAS,UAC3B,OAAO,GAAG,qBAAqB,CAAC,CAAC,MAAM,QAAQ,EAAE,CAAC,KAAK,GAEvD,OAAO,OAAO,KAAK,SAAS,CAAC;GAE/B,OAAO,kBAAkB,kBAAkB,KAAK,CAAC,CAAC,KAChD,OAAO,QAAQ,OAAO,KAAK,YAAY,CAAC,CAAC,CAC3C;EACF,CACF,CACF;EAEA,MAAM,WAAW,OAAO,OAAO,aAAa,mBAAmB,CAAC,CAAC,OAAO,CAAC,CAAC,KACxE,OAAO,SAAS,QAAQ,CAC1B;EAEA,OAAO,OAAO,cAAc,+BAA+B;GACzD,UAAU;IACR,UAAU,SAAS;IACnB,QAAQ,SAAS;IACjB,SAAS,SAAS;GACpB;GACA,GAAI,SAAS,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,SAAS,QAAQ;EACxE,CAAC;CACH,CAAC;CAEH,OAAO,cAAc,GAAG;EACtB,uBAAuB,UAAU,oBAAoB,qBAAqB,KAAK,CAAC;EAChF,2BAA2B,UAAU,oBAAoB,yBAAyB,KAAK,CAAC;CAC1F,CAAC;AACH,GACA,mBACF;AAEA,MAAa,kCACX,YACG,MAAM,OAAO,eAAe,8BAA8B,OAAO,CAAC"}

package/dist/oauth/registrationModels.d.mts

@@ -44,6 +44,17 @@ declare const OAuthRegistrationIntent: Schema.Struct<{
     readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
     readonly subject: Schema.NonEmptyString;
   }>;
+  /** Original authenticated provider snapshot, available only to server-side
+   * provisioning authority. It is not caller-supplied registration data. */
+  readonly profile: Schema.optionalKey<Schema.Struct<{
+    readonly displayName: Schema.optionalKey<Schema.String>;
+    readonly handle: Schema.optionalKey<Schema.String>;
+    readonly avatarUrl: Schema.optionalKey<Schema.String>;
+    readonly profileUrl: Schema.optionalKey<Schema.String>;
+    readonly email: Schema.optionalKey<Schema.String>;
+    readonly emailVerified: Schema.optionalKey<Schema.Boolean>;
+    readonly providerData: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
+  }>>;
   readonly verifiedAtMillis: Schema.Int;
   readonly credentialDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
   readonly issuedAtMillis: Schema.Int;
@@ -118,6 +129,17 @@ declare const OAuthRegistrationInspection: Schema.Struct<{
       readonly issuer: Schema.brand<Schema.String, "effect-auth/OAuthIssuer">;
       readonly subject: Schema.NonEmptyString;
     }>;
+    /** Original authenticated provider snapshot, available only to server-side
+     * provisioning authority. It is not caller-supplied registration data. */
+    readonly profile: Schema.optionalKey<Schema.Struct<{
+      readonly displayName: Schema.optionalKey<Schema.String>;
+      readonly handle: Schema.optionalKey<Schema.String>;
+      readonly avatarUrl: Schema.optionalKey<Schema.String>;
+      readonly profileUrl: Schema.optionalKey<Schema.String>;
+      readonly email: Schema.optionalKey<Schema.String>;
+      readonly emailVerified: Schema.optionalKey<Schema.Boolean>;
+      readonly providerData: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
+    }>>;
     readonly verifiedAtMillis: Schema.Int;
     readonly credentialDigest: Schema.brand<Schema.NonEmptyString, "effect-auth/TokenDigest">;
     readonly issuedAtMillis: Schema.Int;

package/dist/oauth/registrationModels.mjs

@@ -1,6 +1,6 @@
 import { TokenDigest } from "../Schema.mjs";
 import { RequestBindingCredential, RequestBindingFlowId } from "../operations/requestBindingModels.mjs";
-import { OAuthClaimId, OAuthCommandId, OAuthExternalIdentity, OAuthInstant, OAuthModuleId, OAuthSignInTransactionContext } from "./signInModels.mjs";
+import { OAuthClaimId, OAuthCommandId, OAuthDisplayProfile, OAuthExternalIdentity, OAuthInstant, OAuthModuleId, OAuthSignInTransactionContext } from "./signInModels.mjs";
 import { Schema } from "effect";
 //#region src/oauth/registrationModels.ts
 const OAuthRegistrationFingerprint = TokenDigest.check(Schema.isMaxLength(256));
@@ -30,6 +30,9 @@ const OAuthRegistrationIntent = Schema.Struct({
 	claimId: OAuthClaimId,
 	claimedAtMillis: OAuthInstant,
 	identity: OAuthExternalIdentity,
+	/** Original authenticated provider snapshot, available only to server-side
+	* provisioning authority. It is not caller-supplied registration data. */
+	profile: Schema.optionalKey(OAuthDisplayProfile),
 	verifiedAtMillis: OAuthInstant,
 	credentialDigest: OAuthRegistrationBearerDigest,
 	issuedAtMillis: OAuthInstant,

package/dist/oauth/registrationModels.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"registrationModels.mjs","names":[],"sources":["../../src/oauth/registrationModels.ts"],"sourcesContent":["import { Schema } from \"effect\";\n\nimport { RequestBindingCredential, RequestBindingFlowId } from \"../operations/requestBinding\";\nimport { TokenDigest } from \"../Schema\";\nimport {\n  OAuthClaimId,\n  OAuthCommandId,\n  OAuthExternalIdentity,\n  OAuthInstant,\n  OAuthModuleId,\n  OAuthSignInTransactionContext,\n} from \"./signInModels\";\n\nexport const OAuthRegistrationFingerprint = TokenDigest.check(Schema.isMaxLength(256));\n\nexport const OAuthRegistrationBearerDigest = TokenDigest.check(\n  Schema.isPattern(/^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/),\n);\n\nexport const OAuthRegistrationReference = Schema.String.check(\n  Schema.isPattern(/^[A-Za-z0-9_-]{43}$/),\n).pipe(Schema.brand(\"effect-auth/OAuthRegistrationReference\"));\n\nexport type OAuthRegistrationReference = typeof OAuthRegistrationReference.Type;\n\nexport const OAuthRegistrationCredential = Schema.RedactedFromValue(\n  Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)),\n);\n\nexport const OAuthRegistrationPolicy = Schema.Struct({\n  lifetimeMillis: Schema.Int.check(Schema.isBetween({ minimum: 1000, maximum: 1800000 })),\n  maximumVerificationAgeMillis: Schema.Int.check(\n    Schema.isBetween({ minimum: 1000, maximum: 1800000 }),\n  ),\n  retentionMillis: Schema.Int.check(Schema.isBetween({ minimum: 120000, maximum: 2592000000 })),\n});\n\nexport type OAuthRegistrationPolicy = typeof OAuthRegistrationPolicy.Type;\n\n/** Immutable restricted capability. Application data is first bound by register,\n * never by the OAuth callback; this record contains no plaintext bearer or tokens. */\nexport const OAuthRegistrationIntent = Schema.Struct({\n  namespace: Schema.Literal(\"effect-auth/oauth-registration-intent/v1\"),\n  reference: OAuthRegistrationReference,\n  context: OAuthSignInTransactionContext,\n  claimId: OAuthClaimId,\n  claimedAtMillis: OAuthInstant,\n  identity: OAuthExternalIdentity,\n  verifiedAtMillis: OAuthInstant,\n  credentialDigest: OAuthRegistrationBearerDigest,\n  issuedAtMillis: OAuthInstant,\n  expiresAtMillis: OAuthInstant,\n  retentionUntilMillis: OAuthInstant,\n});\n\nexport type OAuthRegistrationIntent = typeof OAuthRegistrationIntent.Type;\n\nexport const OAuthRegistrationRequired = Schema.TaggedStruct(\"RegistrationRequired\", {\n  reference: OAuthRegistrationReference,\n  expiresAtMillis: OAuthInstant,\n  returnTarget: OAuthSignInTransactionContext.fields.returnTarget,\n});\n\nexport const OAuthRegistrationAccess = Schema.Struct({\n  moduleId: OAuthModuleId,\n  reference: OAuthRegistrationReference,\n  flowId: RequestBindingFlowId,\n  requestBindingVerifier: OAuthSignInTransactionContext.fields.requestBindingVerifier,\n  requestBindingExpiresAtMillis: OAuthInstant,\n  credentialDigest: OAuthRegistrationBearerDigest,\n  nowMillis: OAuthInstant,\n});\n\nexport type OAuthRegistrationAccess = typeof OAuthRegistrationAccess.Type;\n\nexport const OAuthRegistrationPrivateInput = Schema.Struct({\n  reference: OAuthRegistrationReference,\n  flowId: RequestBindingFlowId,\n  requestBinding: RequestBindingCredential,\n  credential: OAuthRegistrationCredential,\n  commandId: OAuthCommandId,\n});\n\nconst applicationBinding = { commandId: OAuthCommandId, fingerprint: OAuthRegistrationFingerprint };\nconst recovery = Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(256));\n\n/** A first accepted command atomically reaches one bound outcome. There is no\n * resettable intermediate state that permits a second provisioning attempt. */\nexport const OAuthRegistrationApplication = Schema.Union([\n  Schema.TaggedStruct(\"Unbound\", {}),\n  Schema.TaggedStruct(\"Registered\", applicationBinding),\n  Schema.TaggedStruct(\"ProvisioningPending\", { ...applicationBinding, reference: recovery }),\n  Schema.TaggedStruct(\"Rejected\", applicationBinding),\n]);\n\nexport const OAuthRegistrationInspection = Schema.Struct({\n  intent: OAuthRegistrationIntent,\n  application: OAuthRegistrationApplication,\n});\n\nexport type OAuthRegistrationInspection = typeof OAuthRegistrationInspection.Type;\n\nexport const OAuthRegistrationDecision = Schema.Union([\n  Schema.TaggedStruct(\"Registered\", { replayed: Schema.Boolean }),\n  Schema.TaggedStruct(\"ProvisioningPending\", { reference: recovery, replayed: Schema.Boolean }),\n  Schema.TaggedStruct(\"Rejected\", {}),\n  Schema.TaggedStruct(\"Conflict\", {}),\n]);\n\nexport type OAuthRegistrationDecision = typeof OAuthRegistrationDecision.Type;\n\nexport const OAuthRegistrationResult = Schema.Union([\n  Schema.TaggedStruct(\"RegistrationAccepted\", {}),\n  Schema.TaggedStruct(\"ProvisioningPending\", { reference: recovery }),\n]);\n"],"mappings":";;;;;AAaA,MAAa,+BAA+B,YAAY,MAAM,OAAO,YAAY,GAAG,CAAC;AAErF,MAAa,gCAAgC,YAAY,MACvD,OAAO,UAAU,uCAAuC,CAC1D;AAEA,MAAa,6BAA6B,OAAO,OAAO,MACtD,OAAO,UAAU,qBAAqB,CACxC,CAAC,CAAC,KAAK,OAAO,MAAM,wCAAwC,CAAC;AAI7D,MAAa,8BAA8B,OAAO,kBAChD,OAAO,OAAO,MAAM,OAAO,UAAU,qBAAqB,CAAC,CAC7D;AAEA,MAAa,0BAA0B,OAAO,OAAO;CACnD,gBAAgB,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAM,SAAS;CAAQ,CAAC,CAAC;CACtF,8BAA8B,OAAO,IAAI,MACvC,OAAO,UAAU;EAAE,SAAS;EAAM,SAAS;CAAQ,CAAC,CACtD;CACA,iBAAiB,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAQ,SAAS;CAAW,CAAC,CAAC;AAC9F,CAAC;;;AAMD,MAAa,0BAA0B,OAAO,OAAO;CACnD,WAAW,OAAO,QAAQ,0CAA0C;CACpE,WAAW;CACX,SAAS;CACT,SAAS;CACT,iBAAiB;CACjB,UAAU;CACV,kBAAkB;CAClB,kBAAkB;CAClB,gBAAgB;CAChB,iBAAiB;CACjB,sBAAsB;AACxB,CAAC;AAID,MAAa,4BAA4B,OAAO,aAAa,wBAAwB;CACnF,WAAW;CACX,iBAAiB;CACjB,cAAc,8BAA8B,OAAO;AACrD,CAAC;AAED,MAAa,0BAA0B,OAAO,OAAO;CACnD,UAAU;CACV,WAAW;CACX,QAAQ;CACR,wBAAwB,8BAA8B,OAAO;CAC7D,+BAA+B;CAC/B,kBAAkB;CAClB,WAAW;AACb,CAAC;AAID,MAAa,gCAAgC,OAAO,OAAO;CACzD,WAAW;CACX,QAAQ;CACR,gBAAgB;CAChB,YAAY;CACZ,WAAW;AACb,CAAC;AAED,MAAM,qBAAqB;CAAE,WAAW;CAAgB,aAAa;AAA6B;AAClG,MAAM,WAAW,OAAO,OAAO,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,GAAG,CAAC;;;AAInF,MAAa,+BAA+B,OAAO,MAAM;CACvD,OAAO,aAAa,WAAW,CAAC,CAAC;CACjC,OAAO,aAAa,cAAc,kBAAkB;CACpD,OAAO,aAAa,uBAAuB;EAAE,GAAG;EAAoB,WAAW;CAAS,CAAC;CACzF,OAAO,aAAa,YAAY,kBAAkB;AACpD,CAAC;AAED,MAAa,8BAA8B,OAAO,OAAO;CACvD,QAAQ;CACR,aAAa;AACf,CAAC;AAID,MAAa,4BAA4B,OAAO,MAAM;CACpD,OAAO,aAAa,cAAc,EAAE,UAAU,OAAO,QAAQ,CAAC;CAC9D,OAAO,aAAa,uBAAuB;EAAE,WAAW;EAAU,UAAU,OAAO;CAAQ,CAAC;CAC5F,OAAO,aAAa,YAAY,CAAC,CAAC;CAClC,OAAO,aAAa,YAAY,CAAC,CAAC;AACpC,CAAC;AAID,MAAa,0BAA0B,OAAO,MAAM,CAClD,OAAO,aAAa,wBAAwB,CAAC,CAAC,GAC9C,OAAO,aAAa,uBAAuB,EAAE,WAAW,SAAS,CAAC,CACpE,CAAC"}
+{"version":3,"file":"registrationModels.mjs","names":[],"sources":["../../src/oauth/registrationModels.ts"],"sourcesContent":["import { Schema } from \"effect\";\n\nimport { RequestBindingCredential, RequestBindingFlowId } from \"../operations/requestBinding\";\nimport { TokenDigest } from \"../Schema\";\nimport {\n  OAuthClaimId,\n  OAuthCommandId,\n  OAuthDisplayProfile,\n  OAuthExternalIdentity,\n  OAuthInstant,\n  OAuthModuleId,\n  OAuthSignInTransactionContext,\n} from \"./signInModels\";\n\nexport const OAuthRegistrationFingerprint = TokenDigest.check(Schema.isMaxLength(256));\n\nexport const OAuthRegistrationBearerDigest = TokenDigest.check(\n  Schema.isPattern(/^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/),\n);\n\nexport const OAuthRegistrationReference = Schema.String.check(\n  Schema.isPattern(/^[A-Za-z0-9_-]{43}$/),\n).pipe(Schema.brand(\"effect-auth/OAuthRegistrationReference\"));\n\nexport type OAuthRegistrationReference = typeof OAuthRegistrationReference.Type;\n\nexport const OAuthRegistrationCredential = Schema.RedactedFromValue(\n  Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)),\n);\n\nexport const OAuthRegistrationPolicy = Schema.Struct({\n  lifetimeMillis: Schema.Int.check(Schema.isBetween({ minimum: 1000, maximum: 1800000 })),\n  maximumVerificationAgeMillis: Schema.Int.check(\n    Schema.isBetween({ minimum: 1000, maximum: 1800000 }),\n  ),\n  retentionMillis: Schema.Int.check(Schema.isBetween({ minimum: 120000, maximum: 2592000000 })),\n});\n\nexport type OAuthRegistrationPolicy = typeof OAuthRegistrationPolicy.Type;\n\n/** Immutable restricted capability. Application data is first bound by register,\n * never by the OAuth callback; this record contains no plaintext bearer or tokens. */\nexport const OAuthRegistrationIntent = Schema.Struct({\n  namespace: Schema.Literal(\"effect-auth/oauth-registration-intent/v1\"),\n  reference: OAuthRegistrationReference,\n  context: OAuthSignInTransactionContext,\n  claimId: OAuthClaimId,\n  claimedAtMillis: OAuthInstant,\n  identity: OAuthExternalIdentity,\n  /** Original authenticated provider snapshot, available only to server-side\n   * provisioning authority. It is not caller-supplied registration data. */\n  profile: Schema.optionalKey(OAuthDisplayProfile),\n  verifiedAtMillis: OAuthInstant,\n  credentialDigest: OAuthRegistrationBearerDigest,\n  issuedAtMillis: OAuthInstant,\n  expiresAtMillis: OAuthInstant,\n  retentionUntilMillis: OAuthInstant,\n});\n\nexport type OAuthRegistrationIntent = typeof OAuthRegistrationIntent.Type;\n\nexport const OAuthRegistrationRequired = Schema.TaggedStruct(\"RegistrationRequired\", {\n  reference: OAuthRegistrationReference,\n  expiresAtMillis: OAuthInstant,\n  returnTarget: OAuthSignInTransactionContext.fields.returnTarget,\n});\n\nexport const OAuthRegistrationAccess = Schema.Struct({\n  moduleId: OAuthModuleId,\n  reference: OAuthRegistrationReference,\n  flowId: RequestBindingFlowId,\n  requestBindingVerifier: OAuthSignInTransactionContext.fields.requestBindingVerifier,\n  requestBindingExpiresAtMillis: OAuthInstant,\n  credentialDigest: OAuthRegistrationBearerDigest,\n  nowMillis: OAuthInstant,\n});\n\nexport type OAuthRegistrationAccess = typeof OAuthRegistrationAccess.Type;\n\nexport const OAuthRegistrationPrivateInput = Schema.Struct({\n  reference: OAuthRegistrationReference,\n  flowId: RequestBindingFlowId,\n  requestBinding: RequestBindingCredential,\n  credential: OAuthRegistrationCredential,\n  commandId: OAuthCommandId,\n});\n\nconst applicationBinding = { commandId: OAuthCommandId, fingerprint: OAuthRegistrationFingerprint };\nconst recovery = Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(256));\n\n/** A first accepted command atomically reaches one bound outcome. There is no\n * resettable intermediate state that permits a second provisioning attempt. */\nexport const OAuthRegistrationApplication = Schema.Union([\n  Schema.TaggedStruct(\"Unbound\", {}),\n  Schema.TaggedStruct(\"Registered\", applicationBinding),\n  Schema.TaggedStruct(\"ProvisioningPending\", { ...applicationBinding, reference: recovery }),\n  Schema.TaggedStruct(\"Rejected\", applicationBinding),\n]);\n\nexport const OAuthRegistrationInspection = Schema.Struct({\n  intent: OAuthRegistrationIntent,\n  application: OAuthRegistrationApplication,\n});\n\nexport type OAuthRegistrationInspection = typeof OAuthRegistrationInspection.Type;\n\nexport const OAuthRegistrationDecision = Schema.Union([\n  Schema.TaggedStruct(\"Registered\", { replayed: Schema.Boolean }),\n  Schema.TaggedStruct(\"ProvisioningPending\", { reference: recovery, replayed: Schema.Boolean }),\n  Schema.TaggedStruct(\"Rejected\", {}),\n  Schema.TaggedStruct(\"Conflict\", {}),\n]);\n\nexport type OAuthRegistrationDecision = typeof OAuthRegistrationDecision.Type;\n\nexport const OAuthRegistrationResult = Schema.Union([\n  Schema.TaggedStruct(\"RegistrationAccepted\", {}),\n  Schema.TaggedStruct(\"ProvisioningPending\", { reference: recovery }),\n]);\n"],"mappings":";;;;;AAcA,MAAa,+BAA+B,YAAY,MAAM,OAAO,YAAY,GAAG,CAAC;AAErF,MAAa,gCAAgC,YAAY,MACvD,OAAO,UAAU,uCAAuC,CAC1D;AAEA,MAAa,6BAA6B,OAAO,OAAO,MACtD,OAAO,UAAU,qBAAqB,CACxC,CAAC,CAAC,KAAK,OAAO,MAAM,wCAAwC,CAAC;AAI7D,MAAa,8BAA8B,OAAO,kBAChD,OAAO,OAAO,MAAM,OAAO,UAAU,qBAAqB,CAAC,CAC7D;AAEA,MAAa,0BAA0B,OAAO,OAAO;CACnD,gBAAgB,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAM,SAAS;CAAQ,CAAC,CAAC;CACtF,8BAA8B,OAAO,IAAI,MACvC,OAAO,UAAU;EAAE,SAAS;EAAM,SAAS;CAAQ,CAAC,CACtD;CACA,iBAAiB,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAQ,SAAS;CAAW,CAAC,CAAC;AAC9F,CAAC;;;AAMD,MAAa,0BAA0B,OAAO,OAAO;CACnD,WAAW,OAAO,QAAQ,0CAA0C;CACpE,WAAW;CACX,SAAS;CACT,SAAS;CACT,iBAAiB;CACjB,UAAU;;;CAGV,SAAS,OAAO,YAAY,mBAAmB;CAC/C,kBAAkB;CAClB,kBAAkB;CAClB,gBAAgB;CAChB,iBAAiB;CACjB,sBAAsB;AACxB,CAAC;AAID,MAAa,4BAA4B,OAAO,aAAa,wBAAwB;CACnF,WAAW;CACX,iBAAiB;CACjB,cAAc,8BAA8B,OAAO;AACrD,CAAC;AAED,MAAa,0BAA0B,OAAO,OAAO;CACnD,UAAU;CACV,WAAW;CACX,QAAQ;CACR,wBAAwB,8BAA8B,OAAO;CAC7D,+BAA+B;CAC/B,kBAAkB;CAClB,WAAW;AACb,CAAC;AAID,MAAa,gCAAgC,OAAO,OAAO;CACzD,WAAW;CACX,QAAQ;CACR,gBAAgB;CAChB,YAAY;CACZ,WAAW;AACb,CAAC;AAED,MAAM,qBAAqB;CAAE,WAAW;CAAgB,aAAa;AAA6B;AAClG,MAAM,WAAW,OAAO,OAAO,MAAM,OAAO,YAAY,CAAC,GAAG,OAAO,YAAY,GAAG,CAAC;;;AAInF,MAAa,+BAA+B,OAAO,MAAM;CACvD,OAAO,aAAa,WAAW,CAAC,CAAC;CACjC,OAAO,aAAa,cAAc,kBAAkB;CACpD,OAAO,aAAa,uBAAuB;EAAE,GAAG;EAAoB,WAAW;CAAS,CAAC;CACzF,OAAO,aAAa,YAAY,kBAAkB;AACpD,CAAC;AAED,MAAa,8BAA8B,OAAO,OAAO;CACvD,QAAQ;CACR,aAAa;AACf,CAAC;AAID,MAAa,4BAA4B,OAAO,MAAM;CACpD,OAAO,aAAa,cAAc,EAAE,UAAU,OAAO,QAAQ,CAAC;CAC9D,OAAO,aAAa,uBAAuB;EAAE,WAAW;EAAU,UAAU,OAAO;CAAQ,CAAC;CAC5F,OAAO,aAAa,YAAY,CAAC,CAAC;CAClC,OAAO,aAAa,YAAY,CAAC,CAAC;AACpC,CAAC;AAID,MAAa,0BAA0B,OAAO,MAAM,CAClD,OAAO,aAAa,wBAAwB,CAAC,CAAC,GAC9C,OAAO,aAAa,uBAAuB,EAAE,WAAW,SAAS,CAAC,CACpE,CAAC"}

package/dist/oauth/registrationSecrets.mjs

@@ -50,6 +50,7 @@ const prepare = Effect.fn("OAuthRegistration.prepareIntent")(function* (claim, i
 			claimId: claim.claimId,
 			claimedAtMillis: claim.claimedAtMillis,
 			identity: identity.identity,
+			...identity.profile === void 0 ? {} : { profile: identity.profile },
 			verifiedAtMillis,
 			credentialDigest: yield* credentialDigest(claim.flow.context.moduleId, reference, claim.flow.context.flowId, credential),
 			issuedAtMillis: now,