@yielded/oauth 0.1.0-beta.19

package/README.md

@@ -0,0 +1,60 @@
+# @yielded/oauth
+
+Native Effect OAuth authorization-code and refresh flows, PKCE S256, and signed
+RS256 OpenID Connect. Runtime dependencies are Effect and `@yielded/jose`.
+
+Use `OAuth.make` for an installed client and `Oidc.makeVerifier` for its OIDC
+verifier. Both require `HttpClient` and an owning `Scope`; keep that scope open
+for their lifetime. `Pkce` requires Effect `Crypto`; verification requires
+`Signature` from `@yielded/crypto` and Effect `Crypto`. Runtime Layers belong
+to the application. `Oidc.discover` retrieves metadata from the exact trusted
+issuer's OIDC discovery endpoint.
+
+Closing either factory's scope cancels and joins its active operations; pending
+results and subsequent calls fail with `OAuthUnavailable`. Caller interruption
+cancels and joins that operation while leaving the client or verifier usable.
+
+`client.codeGrant` and `client.refreshGrant` return private `TokenReceipt` values.
+Inspect `Redacted.value(receipt.body)` for provider-specific receipt rules, then
+call `OAuth.tokens`. Its tokens remain redacted. Raw expiry extensions and scope
+strings are retained unchanged, including provider-specific comma scopes.
+`OAuth.tokens` accepts `expires_in` as a finite nonnegative number or a whole
+decimal string such as `"60.5"`; whitespace, numeric-prefix junk, exponent syntax,
+`NaN` and infinity are rejected. Provider checks can still require a raw number.
+A returned receipt has not established grant success or an authenticated identity.
+For OIDC, require an ID token on initial exchange and call `verifier.verify` with
+the captured `verificationStartedAt`, nonce, access token and authorization code.
+It verifies the signature before claims, checks present `at_hash`/`c_hash`, and
+returns redacted verified claims for application-owned identity/profile mapping.
+On refresh, verify any returned ID token with `previous` subject/authentication
+time; an omitted refresh ID token is an application-owned continuation.
+
+The application owns registered callbacks, expected state and response issuer,
+provider generations, permissions, identity callbacks, grant retention and durable
+receipts. This package makes one request per exchange, refresh or revocation.
+`OAuthRejected` identifies a complete HTTP 400 `invalid_grant` or an authenticated
+claim rejection. Malformed responses and expected transport, key and signature
+failures are `OAuthUnavailable`; they do not authorize repeating a possibly
+committed request. Implementation defects, including those in injected services,
+remain in Effect's defect channel.
+
+Provider endpoints require HTTPS and exact response URLs. Redirects, cookies and
+HTTP tracing are disabled for Fetch; custom HttpClients must preserve cancellation
+and have no retry, redirect or cookie middleware. Installed profile endpoints and
+headers are validated before credentials are sent. Responses are bounded to 1 MiB
+by default (configurable downward). JSON is limited to 64 object/array levels and
+65,536 values, including the root in both limits; excess depth or size fails with
+`OAuthUnavailable`. Installed metadata and returned JSON snapshots are deeply
+frozen. Requests to token/revocation endpoints are bounded to 128 KiB and
+authorization URLs to 16 KiB. `timeoutMs` covers each request
+through body consumption. Applications bound their complete multi-step workflow.
+The current Fetch reference is captured when constructing the client/verifier.
+
+Each verifier owns one scoped JOSE JWKS cache: at most 64 keys and 64 waiters, a
+10-minute cache lifetime and a 30-second refresh cooldown. There is no global
+issuer cache, background polling, stale-on-error fallback, or token-supplied key
+endpoint. The supported profile requires advertised code, S256 and RS256 support;
+other OAuth grants and ID-token signature algorithms are outside this profile.
+
+See [third-party notices](THIRD_PARTY_NOTICES.md) for pinned upstream contract
+sources and licenses.

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,107 @@
+# Third-party notices
+
+Selected OAuth/OIDC contracts were adapted into Effect tests from the pinned
+upstream snapshots below. The native runtime uses Effect and owned JOSE, and
+includes the attributed form-encoding adaptation below. Neither upstream SDK is
+a runtime dependency.
+
+The case mappings identify selected assertions and fixtures for Auth's
+authorization-code + S256/RS256 profile. They do not represent complete ports of
+the upstream suites. Local case names below are exact; paths are package-relative.
+
+## openid-client 6.8.8
+
+Version: **6.8.8**. Commit: **`04c59826121f736afc71fe005439c961d5fb6f3b`**.
+
+| Pinned upstream file and case                                                                                                                                                                          | Local adaptation                                                                                                                                              |
+| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [test/token-response.test.ts](https://github.com/panva/openid-client/blob/04c59826121f736afc71fe005439c961d5fb6f3b/test/token-response.test.ts), `expiresIn returns zero for an already expired token` | [test/protocol.test.ts](test/protocol.test.ts), `distinguishes complete invalid_grant400 from ambiguous or malformed receipts`: zero-lifetime assertion only. |
+
+The local `expiresIn` value is the decoded lifetime; the upstream helper's
+elapsed-time/countdown implementation is not included.
+
+```text
+The MIT License (MIT)
+
+Copyright (c) 2016 Filip Skokan
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+```
+
+## oauth4webapi 3.8.8
+
+Version: **3.8.8**. Commit: **`916b97952dbf431d8b72f369840de54f5a286e4d`**.
+
+Runtime adaptation: [src/index.ts, `formUrlEncode`](https://github.com/panva/oauth4webapi/blob/916b97952dbf431d8b72f369840de54f5a286e4d/src/index.ts#L1867),
+used by upstream `ClientSecretBasic`, is adapted as
+[src/OAuth.ts, `basicComponent`](src/OAuth.ts). It form-encodes each credential
+component before joining them with a colon, including escaped punctuation and
+`+` for spaces. The MIT license below covers this adaptation as well as the
+selected test contracts.
+
+| Pinned upstream file and cases                                                                                                                                                                                                                                                                                    | Local adaptation                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [test/client_auth.test.ts](https://github.com/panva/oauth4webapi/blob/916b97952dbf431d8b72f369840de54f5a286e4d/test/client_auth.test.ts): `client_secret_basic`, `client_secret_basic (appendix b)`, `client_secret_post`, `none`                                                                                 | [test/protocol.test.ts](test/protocol.test.ts): `authenticates Basic/Post/None once and preserves private raw provider receipts`, including the Appendix B punctuation fixture.                                                                                                                                                                                                                                                                                                                                           |
+| [test/discovery.test.ts](https://github.com/panva/oauth4webapi/blob/916b97952dbf431d8b72f369840de54f5a286e4d/test/discovery.test.ts): `discoveryRequest() - oidc with a pathname`, `processDiscoveryResponse()`                                                                                                   | [test/protocol.test.ts](test/protocol.test.ts): `discovers the exact issuer including its trailing slash and rejects substituted metadata`, selecting pathname and exact-issuer assertions.                                                                                                                                                                                                                                                                                                                               |
+| [test/authorization_code.test.ts](https://github.com/panva/oauth4webapi/blob/916b97952dbf431d8b72f369840de54f5a286e4d/test/authorization_code.test.ts): `authorizationCodeGrantRequest()`, `authorizationCodeGrantRequest() w/ Extra Parameters`, `processAuthorizationCodeResponse()`                            | [test/protocol.test.ts](test/protocol.test.ts): `authenticates Basic/Post/None once and preserves private raw provider receipts`; `distinguishes complete invalid_grant400 from ambiguous or malformed receipts`, selecting request fields, extra parameters, token values and malformed-response checks.                                                                                                                                                                                                                 |
+| [test/refresh_token.test.ts](https://github.com/panva/oauth4webapi/blob/916b97952dbf431d8b72f369840de54f5a286e4d/test/refresh_token.test.ts): `refreshTokenGrantRequest()`, `processRefreshTokenResponse() without ID Tokens`                                                                                     | [test/protocol.test.ts](test/protocol.test.ts): `refreshes, fetches the installed profile and revokes with separately installed credentials`, selecting refresh request fields and token receipt parsing.                                                                                                                                                                                                                                                                                                                 |
+| [test/revocation.test.ts](https://github.com/panva/oauth4webapi/blob/916b97952dbf431d8b72f369840de54f5a286e4d/test/revocation.test.ts): `revocationRequest()`, `processRevocationResponse()`                                                                                                                      | [test/protocol.test.ts](test/protocol.test.ts): `refreshes, fetches the installed profile and revokes with separately installed credentials`; `bounds bodies, refuses redirects and unexpected URLs, and never repeats failed exchange/revocation`, selecting request fields, empty HTTP 200 success and failed responses.                                                                                                                                                                                                |
+| [test/authorization_code.test.ts](https://github.com/panva/oauth4webapi/blob/916b97952dbf431d8b72f369840de54f5a286e4d/test/authorization_code.test.ts): `processAuthorizationCodeResponse() nonce checks`, `processAuthorizationCodeResponse() auth_time checks`, `processAuthorizationCodeResponse() azp checks` | [test/oidc.test.ts](test/oidc.test.ts): `rejects authenticated wrong issuer/aud/azp/time/nonce/hash claims with no clock tolerance`, selecting nonce, authentication-age and authorized-party checks.                                                                                                                                                                                                                                                                                                                     |
+| [test/auth_time.test.ts](https://github.com/panva/oauth4webapi/blob/916b97952dbf431d8b72f369840de54f5a286e4d/test/auth_time.test.ts): `authorization code auth_time with ${JSON.stringify(options)}`                                                                                                              | [test/oidc.test.ts](test/oidc.test.ts): `rejects authenticated wrong issuer/aud/azp/time/nonce/hash claims with no clock tolerance`, selecting the maximum-age rejection. The upstream explicit-skip variants are not ported.                                                                                                                                                                                                                                                                                             |
+| [test/jwt_claims.test.ts](https://github.com/panva/oauth4webapi/blob/916b97952dbf431d8b72f369840de54f5a286e4d/test/jwt_claims.test.ts): `${process.name}() validates required ID Token claims`, `${name} validates required ID Token claims`, `${name} ID Token policy checks`                                    | [test/oidc.test.ts](test/oidc.test.ts): `verifies signed OIDC claims/hashes, retains profile extensions and clamps authentication time to captured start`; `rejects authenticated wrong issuer/aud/azp/time/nonce/hash claims with no clock tolerance`; `verifies signatures before definite claim rejection and keeps key/signature faults ambiguous`. These adapt claim fixtures and selected nonce/azp/signature checks to signed RS256 tokens; upstream grant, hybrid and detached-signature matrices are not ported. |
+
+The PKCE verifier/challenge vector in [test/protocol.test.ts](test/protocol.test.ts),
+`uses RFC7636 S256 and fresh private 32-byte transaction secrets`, comes from
+[RFC7636 Appendix B](https://www.rfc-editor.org/rfc/rfc7636.html#appendix-B).
+
+Auth supplies the strict single-audience policy, signature-before-rejection
+classification, hash bindings, captured authentication time, refresh continuity,
+private receipts, no retries and scoped cleanup. Refresh continuity in
+`refresh binds subject/optional nonce/auth_time without treating old max_age as a new login`
+is an Auth-profile case guided by
+[OpenID Connect Core 12.2](https://openid.net/specs/openid-connect-core-1_0.html#RefreshTokenResponse).
+The cancellation seam came from this repository's former
+`packages/auth-openid-client/test/protocol.test.ts`. Metadata immutability,
+bounded JSON and close-active-operation regressions are local cases.
+
+```text
+The MIT License (MIT)
+
+Copyright (c) 2022 Filip Skokan
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+```

package/dist/Errors.d.mts

@@ -0,0 +1,17 @@
+import { Schema } from "effect";
+//#region src/Errors.d.ts
+declare const ConfigurationError_base: Schema.Class<ConfigurationError, Schema.TaggedStruct<"OAuthConfigurationError", {
+  readonly reason: Schema.Literals<readonly ["issuer", "metadata", "authentication", "parameters", "endpoint"]>;
+}>, import("effect/Cause").YieldableError>;
+/** Local protocol configuration is invalid; no remote response or credential is retained. */
+export declare class ConfigurationError extends ConfigurationError_base {}
+declare const Rejected_base: Schema.Class<Rejected, Schema.TaggedStruct<"OAuthRejected", {
+  readonly reason: Schema.Literals<readonly ["invalid_grant", "claims"]>;
+}>, import("effect/Cause").YieldableError>;
+/** A definite, authenticated claim rejection or a complete HTTP 400 invalid_grant. */
+export declare class Rejected extends Rejected_base {}
+declare const Unavailable_base: Schema.Class<Unavailable, Schema.TaggedStruct<"OAuthUnavailable", {}>, import("effect/Cause").YieldableError>;
+/** The outcome is unknown. This error never authorizes retrying a grant. */
+export declare class Unavailable extends Unavailable_base {}
+//#endregion
+//# sourceMappingURL=Errors.d.mts.map

package/dist/Errors.mjs

@@ -0,0 +1,18 @@
+import { Schema } from "effect";
+//#region src/Errors.ts
+/** Local protocol configuration is invalid; no remote response or credential is retained. */
+var ConfigurationError = class extends Schema.TaggedError()("OAuthConfigurationError", { reason: Schema.Literals([
+	"issuer",
+	"metadata",
+	"authentication",
+	"parameters",
+	"endpoint"
+]) }) {};
+/** A definite, authenticated claim rejection or a complete HTTP 400 invalid_grant. */
+var Rejected = class extends Schema.TaggedError()("OAuthRejected", { reason: Schema.Literals(["invalid_grant", "claims"]) }) {};
+/** The outcome is unknown. This error never authorizes retrying a grant. */
+var Unavailable = class extends Schema.TaggedError()("OAuthUnavailable", {}) {};
+//#endregion
+export { ConfigurationError, Rejected, Unavailable };
+
+//# sourceMappingURL=Errors.mjs.map

package/dist/Errors.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"Errors.mjs","names":[],"sources":["../src/Errors.ts"],"sourcesContent":["import { Schema } from \"effect\";\n\n/** Local protocol configuration is invalid; no remote response or credential is retained. */\nexport class ConfigurationError extends Schema.TaggedError<ConfigurationError>()(\n  \"OAuthConfigurationError\",\n  {\n    reason: Schema.Literals([\"issuer\", \"metadata\", \"authentication\", \"parameters\", \"endpoint\"]),\n  },\n) {}\n\n/** A definite, authenticated claim rejection or a complete HTTP 400 invalid_grant. */\nexport class Rejected extends Schema.TaggedError<Rejected>()(\"OAuthRejected\", {\n  reason: Schema.Literals([\"invalid_grant\", \"claims\"]),\n}) {}\n\n/** The outcome is unknown. This error never authorizes retrying a grant. */\nexport class Unavailable extends Schema.TaggedError<Unavailable>()(\"OAuthUnavailable\", {}) {}\n"],"mappings":";;;AAGA,IAAa,qBAAb,cAAwC,OAAO,YAAgC,CAAC,CAC9E,2BACA,EACE,QAAQ,OAAO,SAAS;CAAC;CAAU;CAAY;CAAkB;CAAc;AAAU,CAAC,EAC5F,CACF,CAAC,CAAC,CAAC;;AAGH,IAAa,WAAb,cAA8B,OAAO,YAAsB,CAAC,CAAC,iBAAiB,EAC5E,QAAQ,OAAO,SAAS,CAAC,iBAAiB,QAAQ,CAAC,EACrD,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,cAAb,cAAiC,OAAO,YAAyB,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC"}

package/dist/OAuth.d.mts

@@ -0,0 +1,122 @@
+import { ConfigurationError, Rejected, Unavailable } from "./Errors.mjs";
+import { Effect, Redacted, Schema, Scope } from "effect";
+import { HttpClient } from "effect/http";
+//#region src/OAuth.d.ts
+export declare const JsonObject: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+export type JsonObject = typeof JsonObject.Type;
+export declare const Metadata: Schema.Struct<{
+  readonly issuer: Schema.NonEmptyString;
+  readonly authorization_endpoint: Schema.NonEmptyString;
+  readonly token_endpoint: Schema.NonEmptyString;
+  readonly jwks_uri: Schema.optionalKey<Schema.NonEmptyString>;
+  readonly userinfo_endpoint: Schema.optionalKey<Schema.NonEmptyString>;
+  readonly revocation_endpoint: Schema.optionalKey<Schema.NonEmptyString>;
+  readonly code_challenge_methods_supported: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+  readonly response_types_supported: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+  readonly grant_types_supported: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+  readonly id_token_signing_alg_values_supported: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+  readonly token_endpoint_auth_methods_supported: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+  readonly revocation_endpoint_auth_methods_supported: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+  readonly authorization_response_iss_parameter_supported: Schema.optionalKey<Schema.Boolean>;
+}>;
+export type Metadata = typeof Metadata.Type;
+export declare const Authentication: Schema.Union<readonly [Schema.Struct<{
+  readonly method: Schema.Literal<"client_secret_basic">;
+  readonly secret: Schema.Redacted<Schema.NonEmptyString>;
+}>, Schema.Struct<{
+  readonly method: Schema.Literal<"client_secret_post">;
+  readonly secret: Schema.Redacted<Schema.NonEmptyString>;
+}>, Schema.Struct<{
+  readonly method: Schema.Literal<"none">;
+  readonly publicClient: Schema.Literal<true>;
+}>]>;
+export type Authentication = typeof Authentication.Type;
+/** Uninterpreted private receipt. Inspect provider extensions before calling tokens. */
+export declare const TokenReceipt: Schema.Struct<{
+  readonly status: Schema.Int;
+  readonly contentType: Schema.NullOr<Schema.String>;
+  readonly body: Schema.Redacted<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
+}>;
+export type TokenReceipt = typeof TokenReceipt.Type;
+export declare const TokenSet: Schema.Struct<{
+  readonly tokenType: Schema.Literal<"bearer">;
+  readonly accessToken: Schema.Redacted<Schema.NonEmptyString>;
+  readonly refreshToken: Schema.optionalKey<Schema.Redacted<Schema.NonEmptyString>>;
+  readonly idToken: Schema.optionalKey<Schema.Redacted<Schema.NonEmptyString>>;
+  readonly expiresIn: Schema.optionalKey<Schema.Finite>;
+  readonly scope: Schema.optionalKey<Schema.String>;
+}>;
+export type TokenSet = typeof TokenSet.Type;
+export interface RequestOptions {
+  readonly timeoutMs: number;
+  readonly maxResponseBytes?: number;
+}
+export interface ClientOptions extends RequestOptions {
+  readonly metadata: Metadata;
+  readonly clientId: string;
+  readonly authentication: Authentication;
+  readonly profile?: {
+    readonly url: string;
+    readonly headers?: Readonly<Record<string, string>>;
+  };
+  readonly revocationAuthentication?: Authentication;
+}
+export interface Parameters {
+  readonly parameters?: Readonly<Record<string, string>>;
+  readonly resources?: ReadonlyArray<string>;
+}
+export interface AuthorizationInput extends Parameters {
+  readonly redirectUri: string;
+  readonly scopes: ReadonlyArray<string>;
+  readonly state: Redacted.Redacted<string>;
+  readonly codeChallenge: string;
+  readonly nonce?: Redacted.Redacted<string>;
+  readonly maxAgeSeconds?: number;
+}
+export interface CodeGrantInput extends Parameters {
+  readonly code: Redacted.Redacted<string>;
+  readonly redirectUri: string;
+  readonly pkceVerifier: Redacted.Redacted<string>;
+}
+export interface RefreshGrantInput extends Parameters {
+  readonly refreshToken: Redacted.Redacted<string>;
+  readonly scopes?: ReadonlyArray<string>;
+}
+export interface RevocationInput {
+  readonly token: Redacted.Redacted<string>;
+  readonly tokenTypeHint: "access_token" | "refresh_token";
+}
+export interface Client {
+  readonly metadata: Metadata;
+  readonly authorizationUrl: (input: AuthorizationInput) => Effect.Effect<Redacted.Redacted<string>, ConfigurationError | Unavailable>;
+  readonly codeGrant: (input: CodeGrantInput) => Effect.Effect<TokenReceipt, ConfigurationError | Unavailable>;
+  readonly refreshGrant: (input: RefreshGrantInput) => Effect.Effect<TokenReceipt, ConfigurationError | Unavailable>;
+  readonly fetchProfile: (accessToken: Redacted.Redacted<string>) => Effect.Effect<JsonObject, ConfigurationError | Unavailable>;
+  readonly revoke: (input: RevocationInput) => Effect.Effect<void, ConfigurationError | Unavailable>;
+}
+/** Parse once provider-specific receipt checks have succeeded. expires_in accepts
+ * finite nonnegative numbers and whole decimal strings (for example "60.5").
+ * Whitespace, exponent/prefix syntax and nonfinite values are rejected. Raw
+ * receipt extensions/scopes are untouched; no request, retry or claim verification. */
+export declare const tokens: (input: {
+  readonly status: number;
+  readonly contentType: string | null;
+  readonly body: Redacted.Redacted<{
+    readonly [x: string]: Schema.Json;
+  }>;
+}) => Effect.Effect<{
+  readonly tokenType: "bearer";
+  readonly accessToken: Redacted.Redacted<string>;
+  readonly refreshToken?: Redacted.Redacted<string>;
+  readonly idToken?: Redacted.Redacted<string>;
+  readonly expiresIn?: number;
+  readonly scope?: string;
+}, Rejected | Unavailable, never>;
+/** One installed client, exact endpoints, private credentials and owning Scope.
+ * Supply an HttpClient without retry/redirect/cookie middleware. Fetch injection
+ * active at construction is captured. Owner closure cancels and joins active
+ * operations, then rejects their results as unavailable; caller interruption
+ * cancels and joins its operation without closing the client. */
+export declare const make: (input: ClientOptions) => Effect.Effect<Client, ConfigurationError | Unavailable, HttpClient.HttpClient | Scope.Scope>;
+//#endregion
+//# sourceMappingURL=OAuth.d.mts.map

package/dist/OAuth.mjs

@@ -0,0 +1,261 @@
+import { ConfigurationError, Rejected, Unavailable } from "./Errors.mjs";
+import { make as make$1 } from "./internal/ownership.mjs";
+import { Callback, Challenge, Endpoint, Headers, Issuer, JsonObject as JsonObject$1, Parameters, ProtocolEndpoint, RequestOptions, Resources, Scopes, Verifier, configuration, decode, freeze, integer, reveal, secret, text } from "./internal/validation.mjs";
+import { capture, isJson, json, request } from "./internal/transport.mjs";
+import { Effect, Redacted, Schema } from "effect";
+import { Base64 } from "effect/encoding";
+import { HttpClientRequest } from "effect/http";
+//#region src/OAuth.ts
+const JsonObject = JsonObject$1;
+const Metadata = Schema.Struct({
+	issuer: Issuer,
+	authorization_endpoint: ProtocolEndpoint,
+	token_endpoint: ProtocolEndpoint,
+	jwks_uri: Schema.optionalKey(Endpoint),
+	userinfo_endpoint: Schema.optionalKey(Endpoint),
+	revocation_endpoint: Schema.optionalKey(ProtocolEndpoint),
+	code_challenge_methods_supported: Schema.optionalKey(Schema.Array(text(64)).check(Schema.isMaxLength(64))),
+	response_types_supported: Schema.optionalKey(Schema.Array(text(64)).check(Schema.isMaxLength(64))),
+	grant_types_supported: Schema.optionalKey(Schema.Array(text(128)).check(Schema.isMaxLength(64))),
+	id_token_signing_alg_values_supported: Schema.optionalKey(Schema.Array(text(64)).check(Schema.isMaxLength(64))),
+	token_endpoint_auth_methods_supported: Schema.optionalKey(Schema.Array(text(64)).check(Schema.isMaxLength(64))),
+	revocation_endpoint_auth_methods_supported: Schema.optionalKey(Schema.Array(text(64)).check(Schema.isMaxLength(64))),
+	authorization_response_iss_parameter_supported: Schema.optionalKey(Schema.Boolean)
+});
+const Authentication = Schema.Union([
+	Schema.Struct({
+		method: Schema.Literal("client_secret_basic"),
+		secret: secret(4096)
+	}),
+	Schema.Struct({
+		method: Schema.Literal("client_secret_post"),
+		secret: secret(4096)
+	}),
+	Schema.Struct({
+		method: Schema.Literal("none"),
+		publicClient: Schema.Literal(true)
+	})
+]);
+/** Uninterpreted private receipt. Inspect provider extensions before calling tokens. */
+const TokenReceipt = Schema.Struct({
+	status: integer(100, 599),
+	contentType: Schema.NullOr(Schema.String.check(Schema.isMaxLength(512))),
+	body: Schema.Redacted(JsonObject, { disallowJsonEncode: true })
+});
+const TokenSet = Schema.Struct({
+	tokenType: Schema.Literal("bearer"),
+	accessToken: secret(16384),
+	refreshToken: Schema.optionalKey(secret(16384)),
+	idToken: Schema.optionalKey(secret(65536)),
+	expiresIn: Schema.optionalKey(Schema.Finite.check(Schema.isGreaterThanOrEqualTo(0))),
+	scope: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(16447)))
+});
+const ClientOptionsSchema = Schema.Struct({
+	metadata: Metadata,
+	clientId: text(1024),
+	authentication: Authentication,
+	...RequestOptions.fields,
+	profile: Schema.optionalKey(Schema.Struct({
+		url: Endpoint,
+		headers: Schema.optionalKey(Headers)
+	})),
+	revocationAuthentication: Schema.optionalKey(Authentication)
+});
+const additional = {
+	parameters: Schema.optionalKey(Parameters),
+	resources: Schema.optionalKey(Resources)
+};
+const Authorization = Schema.Struct({
+	...additional,
+	redirectUri: Callback,
+	scopes: Scopes,
+	state: secret(256),
+	codeChallenge: Challenge,
+	nonce: Schema.optionalKey(secret(256)),
+	maxAgeSeconds: Schema.optionalKey(integer(0, 86400))
+});
+const CodeGrant = Schema.Struct({
+	...additional,
+	code: secret(16384),
+	redirectUri: Callback,
+	pkceVerifier: Verifier
+});
+const RefreshGrant = Schema.Struct({
+	...additional,
+	refreshToken: secret(16384),
+	scopes: Schema.optionalKey(Scopes)
+});
+const Revocation = Schema.Struct({
+	token: secret(16384),
+	tokenTypeHint: Schema.Literals(["access_token", "refresh_token"])
+});
+const ExpiresIn = Schema.Union([Schema.Finite, Schema.String.check(Schema.isPattern(/^(?:0|[1-9][0-9]*)(?:\.[0-9]+)?$/u)).pipe(Schema.decodeTo(Schema.FiniteFromString))]).check(Schema.isGreaterThanOrEqualTo(0));
+const RawToken = Schema.Struct({
+	access_token: text(16384),
+	token_type: Schema.String.check(Schema.isPattern(/^[Bb][Ee][Aa][Rr][Ee][Rr]$/)),
+	refresh_token: Schema.optionalKey(text(16384)),
+	id_token: Schema.optionalKey(text(65536)),
+	expires_in: Schema.optionalKey(ExpiresIn),
+	scope: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(16447)))
+});
+const Terminal = Schema.Struct({
+	error: text(128),
+	error_description: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(4096))),
+	error_uri: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(2048)))
+});
+const successFields = [
+	"access_token",
+	"refresh_token",
+	"id_token",
+	"token_type",
+	"scope",
+	"expires_in",
+	"refresh_expires_in",
+	"refresh_token_expires_in"
+];
+/** Parse once provider-specific receipt checks have succeeded. expires_in accepts
+* finite nonnegative numbers and whole decimal strings (for example "60.5").
+* Whitespace, exponent/prefix syntax and nonfinite values are rejected. Raw
+* receipt extensions/scopes are untouched; no request, retry or claim verification. */
+const tokens = Effect.fnUntraced(function* (input) {
+	const receipt = yield* decode(TokenReceipt, input);
+	if (!isJson(receipt.contentType)) return yield* Unavailable.make({});
+	const raw = yield* reveal(receipt.body);
+	if (Object.hasOwn(raw, "error")) {
+		if (successFields.some((key) => Object.hasOwn(raw, key))) return yield* Unavailable.make({});
+		const terminal = yield* decode(Terminal, raw);
+		if (receipt.status === 400 && terminal.error === "invalid_grant") return yield* Rejected.make({ reason: "invalid_grant" });
+		return yield* Unavailable.make({});
+	}
+	if (receipt.status !== 200 || Object.hasOwn(raw, "error_description") || Object.hasOwn(raw, "error_uri")) return yield* Unavailable.make({});
+	const value = yield* decode(RawToken, raw);
+	return {
+		tokenType: "bearer",
+		accessToken: Redacted.make(value.access_token),
+		...value.refresh_token === void 0 ? {} : { refreshToken: Redacted.make(value.refresh_token) },
+		...value.id_token === void 0 ? {} : { idToken: Redacted.make(value.id_token) },
+		...value.expires_in === void 0 ? {} : { expiresIn: value.expires_in },
+		...value.scope === void 0 ? {} : { scope: value.scope }
+	};
+});
+const parameters = (input) => {
+	const values = new URLSearchParams(input.parameters);
+	for (const resource of input.resources ?? []) values.append("resource", resource);
+	return values;
+};
+const basicComponent = (value) => encodeURIComponent(value).replace(/[-_.!~*'()]|%20/gu, (part) => part === "%20" ? "+" : `%${part.charCodeAt(0).toString(16).toUpperCase()}`);
+const authenticated = Effect.fnUntraced(function* (url, clientId, authentication, body) {
+	let request = HttpClientRequest.post(url).pipe(HttpClientRequest.acceptJson);
+	if (authentication.method === "client_secret_basic") {
+		const secret = yield* reveal(authentication.secret);
+		const credential = yield* Effect.try({
+			try: () => Base64.encode(`${basicComponent(clientId)}:${basicComponent(secret)}`),
+			catch: () => Unavailable.make({})
+		});
+		request = HttpClientRequest.setHeader(request, "authorization", `Basic ${credential}`);
+	} else {
+		body.set("client_id", clientId);
+		if (authentication.method === "client_secret_post") body.set("client_secret", yield* reveal(authentication.secret));
+	}
+	const encoded = body.toString();
+	if (new TextEncoder().encode(encoded).length > 131072) return yield* ConfigurationError.make({ reason: "parameters" });
+	return HttpClientRequest.bodyText(request, encoded, "application/x-www-form-urlencoded;charset=UTF-8");
+});
+/** One installed client, exact endpoints, private credentials and owning Scope.
+* Supply an HttpClient without retry/redirect/cookie middleware. Fetch injection
+* active at construction is captured. Owner closure cancels and joins active
+* operations, then rejects their results as unavailable; caller interruption
+* cancels and joins its operation without closing the client. */
+const make = Effect.fnUntraced(function* (input) {
+	const options = yield* configuration(ClientOptionsSchema, input, "metadata");
+	const authentication = yield* detachAuthentication(options.authentication);
+	const revocationAuthentication = options.revocationAuthentication === void 0 ? authentication : yield* detachAuthentication(options.revocationAuthentication);
+	const metadata = freeze(options.metadata);
+	const supported = metadata.token_endpoint_auth_methods_supported ?? (metadata.jwks_uri === void 0 ? void 0 : ["client_secret_basic"]);
+	const revokeSupported = metadata.revocation_endpoint_auth_methods_supported ?? (metadata.jwks_uri === void 0 ? void 0 : ["client_secret_basic"]);
+	if (supported !== void 0 && !supported.includes(authentication.method) || options.revocationAuthentication !== void 0 && metadata.revocation_endpoint !== void 0 && revokeSupported !== void 0 && !revokeSupported.includes(revocationAuthentication.method)) return yield* ConfigurationError.make({ reason: "authentication" });
+	const { available, use } = yield* make$1;
+	const http = yield* capture;
+	const profile = options.profile === void 0 ? void 0 : freeze(options.profile);
+	yield* Effect.addFinalizer(() => Effect.sync(() => {
+		if (authentication.method !== "none") Redacted.wipeUnsafe(authentication.secret);
+		if (revocationAuthentication.method !== "none") Redacted.wipeUnsafe(revocationAuthentication.secret);
+	}));
+	const send = Effect.fnUntraced(function* (body) {
+		yield* available;
+		const request$1 = yield* authenticated(new URL(metadata.token_endpoint).href, options.clientId, authentication, body);
+		return yield* json(yield* request(http, request$1, options));
+	});
+	return {
+		metadata,
+		authorizationUrl: Effect.fnUntraced(function* (input) {
+			yield* available;
+			const value = yield* configuration(Authorization, input);
+			const url = new URL(metadata.authorization_endpoint);
+			const body = parameters(value);
+			body.set("client_id", options.clientId);
+			body.set("redirect_uri", value.redirectUri);
+			body.set("response_type", "code");
+			body.set("response_mode", "query");
+			body.set("scope", value.scopes.join(" "));
+			body.set("state", yield* reveal(value.state));
+			body.set("code_challenge", value.codeChallenge);
+			body.set("code_challenge_method", "S256");
+			if (value.nonce !== void 0) body.set("nonce", yield* reveal(value.nonce));
+			if (value.maxAgeSeconds !== void 0) body.set("max_age", String(value.maxAgeSeconds));
+			for (const [key, item] of body) url.searchParams.append(key, item);
+			if (url.href.length > 16384) return yield* ConfigurationError.make({ reason: "parameters" });
+			return Redacted.make(url.href);
+		}, use),
+		codeGrant: Effect.fnUntraced(function* (input) {
+			yield* available;
+			const value = yield* configuration(CodeGrant, input);
+			const body = parameters(value);
+			body.set("grant_type", "authorization_code");
+			body.set("code", yield* reveal(value.code));
+			body.set("code_verifier", yield* reveal(value.pkceVerifier));
+			body.set("redirect_uri", value.redirectUri);
+			return yield* send(body);
+		}, use),
+		refreshGrant: Effect.fnUntraced(function* (input) {
+			yield* available;
+			const value = yield* configuration(RefreshGrant, input);
+			const body = parameters(value);
+			body.set("grant_type", "refresh_token");
+			body.set("refresh_token", yield* reveal(value.refreshToken));
+			if (value.scopes !== void 0) body.set("scope", value.scopes.join(" "));
+			return yield* send(body);
+		}, use),
+		fetchProfile: Effect.fnUntraced(function* (input) {
+			yield* available;
+			if (profile === void 0) return yield* ConfigurationError.make({ reason: "endpoint" });
+			const token = yield* reveal(yield* decode(Bearer, input));
+			const request$2 = HttpClientRequest.get(new URL(profile.url).href).pipe(HttpClientRequest.acceptJson, HttpClientRequest.setHeaders(profile.headers ?? {}), HttpClientRequest.setHeader("authorization", `Bearer ${token}`));
+			const response = yield* request(http, request$2, options);
+			if (response.status !== 200) return yield* Unavailable.make({});
+			return yield* reveal((yield* json(response)).body);
+		}, use),
+		revoke: Effect.fnUntraced(function* (input) {
+			yield* available;
+			if (metadata.revocation_endpoint === void 0) return yield* ConfigurationError.make({ reason: "endpoint" });
+			if (revokeSupported !== void 0 && !revokeSupported.includes(revocationAuthentication.method)) return yield* ConfigurationError.make({ reason: "authentication" });
+			const value = yield* configuration(Revocation, input);
+			const request$3 = yield* authenticated(new URL(metadata.revocation_endpoint).href, options.clientId, revocationAuthentication, new URLSearchParams({
+				token: yield* reveal(value.token),
+				token_type_hint: value.tokenTypeHint
+			}));
+			if ((yield* request(http, request$3, options)).status !== 200) return yield* Unavailable.make({});
+		}, use)
+	};
+});
+const Bearer = Schema.Redacted(text(16384).check(Schema.isPattern(/^[A-Za-z0-9._~+/-]+=*$/u)), { disallowJsonEncode: true });
+const detachAuthentication = Effect.fnUntraced(function* (authentication) {
+	return authentication.method === "none" ? { ...authentication } : {
+		...authentication,
+		secret: Redacted.make(yield* reveal(authentication.secret))
+	};
+});
+//#endregion
+export { Authentication, JsonObject, Metadata, TokenReceipt, TokenSet, make, tokens };
+
+//# sourceMappingURL=OAuth.mjs.map