@yielded/oauth 0.1.0-beta.19

package/src/Oidc.ts

@@ -0,0 +1,256 @@
+import * as Jwks from "@yielded/jose/Jwks";
+import type * as Jws from "@yielded/jose/Jws";
+import * as Jwt from "@yielded/jose/Jwt";
+import {
+  Clock,
+  Context,
+  Crypto,
+  DateTime,
+  Effect,
+  Layer,
+  Redacted,
+  Schema,
+  type Scope,
+} from "effect";
+import { Base64Url } from "effect/encoding";
+import { HttpClient, HttpClientRequest } from "effect/http";
+
+import { ConfigurationError, Rejected, Unavailable } from "./Errors";
+import * as Ownership from "./internal/ownership";
+import * as Transport from "./internal/transport";
+import * as V from "./internal/validation";
+import { JsonObject, Metadata, type RequestOptions } from "./OAuth";
+
+export interface VerifierOptions extends RequestOptions {
+  readonly metadata: Metadata;
+  readonly clientId: string;
+}
+
+export interface VerificationInput {
+  readonly verificationStartedAt: DateTime.Utc;
+  readonly nonce: Redacted.Redacted<string>;
+  readonly maxAgeSeconds?: number;
+  readonly accessToken?: Redacted.Redacted<string>;
+  readonly code?: Redacted.Redacted<string>;
+  /** Refresh continuation: same subject, optional nonce must match, auth_time cannot change. */
+  readonly previous?: { readonly subject: string; readonly authTime?: number };
+}
+
+export interface Verified {
+  readonly claims: Redacted.Redacted<JsonObject>;
+  readonly subject: string;
+  readonly authTime?: number;
+  readonly upstreamAuthenticatedAt?: DateTime.Utc;
+}
+
+type VerificationRequirements =
+  | Exclude<Effect.Services<ReturnType<typeof Jws.verifyWithKeySet>>, Jwks.Jwks>
+  | Crypto.Crypto;
+
+export interface Verifier {
+  readonly verify: (
+    token: Redacted.Redacted<string>,
+    input: VerificationInput,
+  ) => Effect.Effect<Verified, Rejected | Unavailable, VerificationRequirements>;
+}
+
+const Configuration = Schema.Struct({
+  metadata: Metadata,
+  clientId: V.text(1024),
+  ...V.RequestOptions.fields,
+});
+
+const VerifyInput = Schema.Struct({
+  verificationStartedAt: Schema.DateTimeUtc,
+  nonce: V.secret(256),
+  maxAgeSeconds: Schema.optional(V.integer(0, 86400)),
+  accessToken: Schema.optional(V.secret(16384)),
+  code: Schema.optional(V.secret(16384)),
+  previous: Schema.optional(
+    Schema.Struct({ subject: V.text(1024), authTime: Schema.optional(V.NumericDate) }),
+  ),
+});
+
+const IdClaims = Schema.Struct({
+  iss: V.text(2048),
+  sub: V.text(1024),
+  aud: Schema.Union([
+    V.text(1024),
+    Schema.Array(V.text(1024)).check(Schema.isMinLength(1), Schema.isMaxLength(1)),
+  ]),
+  azp: Schema.optionalKey(V.text(1024)),
+  exp: V.NumericDate,
+  iat: V.NumericDate,
+  nbf: Schema.optionalKey(V.NumericDate),
+  auth_time: Schema.optionalKey(V.NumericDate),
+  nonce: Schema.optionalKey(V.text(256)),
+  // The RS256 half digest is 128 bits (22 base64url characters).
+  at_hash: Schema.optionalKey(Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{22}$/u))),
+  c_hash: Schema.optionalKey(Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{22}$/u))),
+});
+
+/** OIDC discovery uses the trusted issuer identifier, retaining its exact
+ * spelling for claim comparison even if its network URL normalizes. */
+export const discover = Effect.fnUntraced(function* (
+  input: string,
+  inputOptions: RequestOptions,
+): Effect.fn.Return<Metadata, ConfigurationError | Unavailable, HttpClient.HttpClient> {
+  const issuer = yield* V.configuration(V.Issuer, input, "issuer");
+
+  const options = yield* V.configuration(V.RequestOptions, inputOptions);
+
+  const url = new URL(issuer);
+
+  url.pathname = `${url.pathname.replace(/\/$/u, "")}/.well-known/openid-configuration`;
+  const http = yield* Transport.capture;
+
+  const response = yield* Transport.request(
+    http,
+    HttpClientRequest.get(url.href).pipe(HttpClientRequest.acceptJson),
+    options,
+  );
+
+  if (response.status !== 200) return yield* Unavailable.make({});
+  const document = yield* Transport.json(response);
+  const metadata = yield* V.configuration(Metadata, yield* V.reveal(document.body), "metadata");
+
+  if (metadata.issuer !== issuer) return yield* ConfigurationError.make({ reason: "issuer" });
+
+  return V.freeze(metadata);
+});
+
+const claimFailure = () => Rejected.make({ reason: "claims" });
+
+/** RS256-only signed ID tokens. Verification and the bounded JWKS cache belong
+ * to the caller's Scope. Owner closure cancels and joins active verification,
+ * returning Unavailable; caller interruption joins its operation without closing
+ * the verifier. No process cache or automatic exchange retry is created. */
+export const makeVerifier = Effect.fnUntraced(function* (
+  input: VerifierOptions,
+): Effect.fn.Return<
+  Verifier,
+  ConfigurationError | Unavailable,
+  HttpClient.HttpClient | Scope.Scope
+> {
+  const options = yield* V.configuration(Configuration, input, "metadata");
+
+  const metadata = V.freeze(options.metadata);
+
+  if (
+    metadata.jwks_uri === undefined ||
+    !metadata.code_challenge_methods_supported?.includes("S256") ||
+    !metadata.response_types_supported?.includes("code") ||
+    !metadata.id_token_signing_alg_values_supported?.includes("RS256")
+  )
+    return yield* ConfigurationError.make({ reason: "metadata" });
+  const http = yield* Transport.capture;
+
+  const context = yield* Layer.build(
+    Jwks.layerRemote({
+      url: metadata.jwks_uri,
+      timeoutMs: options.timeoutMs,
+      maxResponseBytes: options.maxResponseBytes,
+    }).pipe(Layer.provide(Layer.succeed(HttpClient.HttpClient, http))),
+  ).pipe(Effect.mapError(() => Unavailable.make({})));
+
+  const keys = Context.get(context, Jwks.Jwks);
+  const { use } = yield* Ownership.make;
+
+  const verify = Effect.fnUntraced(function* (
+    token: Redacted.Redacted<string>,
+    input: VerificationInput,
+  ): Effect.fn.Return<Verified, Rejected | Unavailable, VerificationRequirements> {
+    // Capture caller policy and secret values before key lookup or cryptography.
+    const policy = yield* V.decode(VerifyInput, input);
+    const start = DateTime.toEpochMillis(policy.verificationStartedAt);
+    const expectedNonce = yield* V.reveal(policy.nonce);
+
+    const accessToken =
+      policy.accessToken === undefined ? undefined : yield* V.reveal(policy.accessToken);
+
+    const code = policy.code === undefined ? undefined : yield* V.reveal(policy.code);
+
+    // Jwt verifies the signature before any registered/application claim checks.
+    // Unauthenticated malformed/key/signature failures must never burn a receipt.
+    const verified = yield* Jwt.verifyWithKeySet(JsonObject, token, {
+      algorithms: ["RS256"],
+      issuer: metadata.issuer,
+      audience: options.clientId,
+      requiredClaims: ["iss", "sub", "aud", "exp", "iat"],
+      clockTolerance: 0,
+    }).pipe(
+      Effect.provideService(Jwks.Jwks, keys),
+      Effect.mapError((error) =>
+        error._tag === "JoseClaimValidationFailed" ? claimFailure() : Unavailable.make({}),
+      ),
+    );
+
+    const claims = yield* V.decode(IdClaims, verified.claims).pipe(Effect.mapError(claimFailure));
+
+    const now = (yield* Clock.currentTimeMillis) / 1000;
+
+    if (
+      start < 0 ||
+      start > now * 1000 ||
+      (claims.azp !== undefined && claims.azp !== options.clientId) ||
+      claims.exp <= now ||
+      claims.iat > now ||
+      (claims.nbf !== undefined && claims.nbf > now) ||
+      (claims.auth_time !== undefined && claims.auth_time > now)
+    )
+      return yield* claimFailure();
+    if (policy.previous === undefined) {
+      if (
+        claims.nonce !== expectedNonce ||
+        (policy.maxAgeSeconds !== undefined &&
+          (claims.auth_time === undefined ||
+            claims.auth_time + policy.maxAgeSeconds < Math.floor(now)))
+      )
+        return yield* claimFailure();
+    } else if (
+      claims.sub !== policy.previous.subject ||
+      (claims.nonce !== undefined && claims.nonce !== expectedNonce) ||
+      (claims.auth_time !== undefined && claims.auth_time !== policy.previous.authTime)
+    )
+      return yield* claimFailure();
+    for (const [hash, secret] of [
+      [claims.at_hash, accessToken],
+      [claims.c_hash, code],
+    ] as const) {
+      if (hash === undefined) continue;
+      if (secret === undefined) return yield* claimFailure();
+      const crypto = yield* Crypto.Crypto;
+
+      const digest = yield* crypto
+        .digest("SHA-256", new TextEncoder().encode(secret))
+        .pipe(Effect.mapError(() => Unavailable.make({})));
+
+      if (digest.length !== 32) return yield* Unavailable.make({});
+      if (hash !== Base64Url.encode(digest.subarray(0, 16))) return yield* claimFailure();
+    }
+    // Re-read time after optional digest I/O so expired tokens cannot escape.
+    const finished = (yield* Clock.currentTimeMillis) / 1000;
+
+    if (
+      claims.exp <= finished ||
+      (policy.previous === undefined &&
+        policy.maxAgeSeconds !== undefined &&
+        claims.auth_time !== undefined &&
+        claims.auth_time + policy.maxAgeSeconds < Math.floor(finished))
+    )
+      return yield* claimFailure();
+
+    return {
+      claims: Redacted.make(V.freeze(verified.claims)),
+      subject: claims.sub,
+      ...(claims.auth_time === undefined
+        ? {}
+        : {
+            authTime: claims.auth_time,
+            upstreamAuthenticatedAt: DateTime.makeUnsafe(Math.min(start, claims.auth_time * 1000)),
+          }),
+    };
+  }, use);
+
+  return { verify };
+});

package/src/Pkce.ts

@@ -0,0 +1,37 @@
+import { Crypto, Effect, Redacted } from "effect";
+import { Base64Url } from "effect/encoding";
+
+import { Unavailable } from "./Errors";
+import * as V from "./internal/validation";
+
+/** A fresh 256-bit state, nonce, or PKCE verifier; application policy owns storage. */
+export const random = Effect.fnUntraced(
+  function* () {
+    const crypto = yield* Crypto.Crypto;
+    const bytes = yield* crypto.randomBytes(32);
+
+    if (bytes.length !== 32) return yield* Unavailable.make({});
+
+    return Redacted.make(Base64Url.encode(bytes));
+  },
+  Effect.mapError(() => Unavailable.make({})),
+);
+
+export const challenge = Effect.fnUntraced(
+  function* (input: Redacted.Redacted<string>) {
+    const verifier = yield* V.reveal(yield* V.decode(V.Verifier, input));
+    const crypto = yield* Crypto.Crypto;
+    const digest = yield* crypto.digest("SHA-256", new TextEncoder().encode(verifier));
+
+    if (digest.length !== 32) return yield* Unavailable.make({});
+
+    return Base64Url.encode(digest);
+  },
+  Effect.mapError(() => Unavailable.make({})),
+);
+
+export const make = Effect.fnUntraced(function* () {
+  const verifier = yield* random();
+
+  return { verifier, challenge: yield* challenge(verifier) };
+});

package/src/index.ts

@@ -0,0 +1,4 @@
+export * as Errors from "./Errors.ts";
+export * as OAuth from "./OAuth.ts";
+export * as Oidc from "./Oidc.ts";
+export * as Pkce from "./Pkce.ts";

package/src/internal/ownership.ts

@@ -0,0 +1,30 @@
+import { Effect, Fiber } from "effect";
+
+import { Unavailable } from "../Errors";
+
+/** Each operation belongs to the factory's Scope and is joined by its caller. */
+export const make = Effect.gen(function* () {
+  const scope = yield* Effect.scope;
+
+  const available = Effect.suspend(() =>
+    scope.state._tag === "Closed" ? Effect.fail(Unavailable.make({})) : Effect.void,
+  );
+
+  // Inspect the exit only after checking the owner: closure must stay unavailable,
+  // even when an interrupted operation was about to return a definite rejection.
+  const use = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
+    Effect.acquireUseRelease(
+      available.pipe(Effect.andThen(Effect.forkIn(effect, scope, { uninterruptible: false }))),
+      (fiber) =>
+        Effect.gen(function* () {
+          const exit = yield* Fiber.await(fiber);
+
+          yield* available;
+
+          return yield* exit;
+        }),
+      Fiber.interrupt,
+    );
+
+  return { available, use };
+});

package/src/internal/transport.ts

@@ -0,0 +1,100 @@
+import { Effect, Redacted, Schema, Stream, Tracer } from "effect";
+import { FetchHttpClient, HttpClient, type HttpClientRequest } from "effect/http";
+
+import { Unavailable } from "../Errors";
+import * as V from "./validation";
+
+export interface Options {
+  readonly timeoutMs: number;
+  readonly maxResponseBytes: number;
+}
+
+/** Caller supplies a nonretrying, nonredirecting HttpClient. Each body and socket
+ * belongs to this request's Scope; cancellation reaches the entire body read. */
+export const request = Effect.fnUntraced(
+  function* (
+    client: HttpClient.HttpClient,
+    request: HttpClientRequest.HttpClientRequest,
+    options: Options,
+  ) {
+    const response = yield* HttpClient.withScope(client).execute(request);
+
+    if (response.url !== request.url || (response.status >= 300 && response.status < 400))
+      return yield* Unavailable.make({});
+    const announced = response.headers["content-length"];
+
+    if (
+      announced !== undefined &&
+      (!/^\d+$/u.test(announced) || Number(announced) > options.maxResponseBytes)
+    )
+      return yield* Unavailable.make({});
+    const buffer = new Uint8Array(options.maxResponseBytes);
+
+    const length = yield* Stream.runFoldEffect(
+      response.stream,
+      () => 0,
+      (length, chunk) => {
+        if (chunk.byteLength > buffer.length - length) return Effect.fail(Unavailable.make({}));
+        buffer.set(chunk, length);
+
+        return Effect.succeed(length + chunk.byteLength);
+      },
+    ).pipe(Effect.catchReason("HttpClientError", "EmptyBodyError", () => Effect.succeed(0)));
+
+    return {
+      status: response.status,
+      contentType: response.headers["content-type"] ?? null,
+      bytes: Redacted.make(buffer.subarray(0, length)),
+    };
+  },
+  (effect, _client, _request, options) =>
+    effect.pipe(
+      Effect.scoped,
+      Effect.provideService(FetchHttpClient.RequestInit, {
+        redirect: "error",
+        credentials: "omit",
+        cache: "no-store",
+      }),
+      Effect.provideService(Tracer.DisablePropagation, true),
+      Effect.mapError(() => Unavailable.make({})),
+      Effect.timeoutOrElse({ duration: options.timeoutMs, orElse: () => Unavailable.make({}) }),
+    ),
+);
+
+export const isJson = (contentType: string | null) =>
+  contentType?.split(";", 1)[0]?.trim().toLowerCase() === "application/json";
+
+export const json = Effect.fnUntraced(function* (
+  response: Effect.Success<ReturnType<typeof request>>,
+) {
+  if (!isJson(response.contentType)) return yield* Unavailable.make({});
+  const bytes = yield* V.reveal(response.bytes);
+
+  const text = yield* Effect.try({
+    try: () => new TextDecoder("utf-8", { fatal: true }).decode(bytes),
+    catch: () => Unavailable.make({}),
+  });
+
+  const body = yield* V.decode(Json, text);
+
+  return {
+    status: response.status,
+    contentType: response.contentType,
+    body: Redacted.make(V.freeze(body)),
+  };
+});
+
+const Json = Schema.fromJsonString(V.JsonObject);
+
+/** Capture Fetch's optional reference at the installed-client boundary too. */
+export const capture = Effect.gen(function* () {
+  const client = yield* HttpClient.HttpClient;
+  const fetch = yield* FetchHttpClient.Fetch;
+
+  return HttpClient.transformResponse(client, (effect) =>
+    effect.pipe(
+      Effect.provideService(FetchHttpClient.Fetch, fetch),
+      Effect.provideService(Tracer.DisablePropagation, true),
+    ),
+  );
+});

package/src/internal/validation.ts

@@ -0,0 +1,236 @@
+import { Effect, Predicate, Redacted, Schema } from "effect";
+
+import { ConfigurationError, Unavailable } from "../Errors";
+
+export const text = (maximum: number) => Schema.NonEmptyString.check(Schema.isMaxLength(maximum));
+
+export const integer = (minimum: number, maximum: number) =>
+  Schema.Int.check(Schema.isBetween({ minimum, maximum }));
+
+export const secret = (maximum: number) =>
+  Schema.Redacted(text(maximum), { disallowJsonEncode: true });
+
+/** At most 64 nested containers and 65,536 values, including the root object. */
+export const JsonObject = Schema.Record(Schema.String, Schema.Json).check(
+  Schema.makeFilter((value) => {
+    const pending: Array<{ value: Schema.JsonObject | Schema.JsonArray; depth: number }> = [
+      { value, depth: 1 },
+    ];
+
+    let values = 1;
+
+    for (let entry = pending.pop(); entry !== undefined; entry = pending.pop()) {
+      const { value, depth } = entry;
+
+      if (depth > 64) return false;
+      const children = Object.values(value);
+
+      values += children.length;
+      if (values > 65536) return false;
+      for (const child of children)
+        if (child !== null && typeof child === "object")
+          pending.push({ value: child, depth: depth + 1 });
+    }
+
+    return true;
+  }),
+);
+
+const validUrl = (value: string, loopback: boolean) => {
+  try {
+    const url = new URL(value);
+
+    return (
+      (url.protocol === "https:" ||
+        (loopback &&
+          url.protocol === "http:" &&
+          ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname))) &&
+      url.username === "" &&
+      url.password === "" &&
+      !value.includes("#") &&
+      // oxlint-disable-next-line no-control-regex -- Reject URL parser normalization of untrusted controls.
+      !/[\s\\\u0000-\u001f\u007f]/u.test(value)
+    );
+  } catch {
+    return false;
+  }
+};
+
+export const Endpoint = text(2048).check(Schema.makeFilter((value) => validUrl(value, false)));
+
+export const Issuer = Endpoint.check(
+  Schema.makeFilter(
+    (value) => !value.includes("?") && !new URL(value).pathname.includes("/.well-known/"),
+  ),
+);
+
+export const Callback = text(2048).check(
+  Schema.makeFilter(
+    (value) => validUrl(value, true) && new URL(value).href === value && !value.includes("?"),
+  ),
+);
+
+// oxlint-disable-next-line no-control-regex -- RFC6749 scope-token permits these visible ASCII ranges.
+export const ScopeName = Schema.String.check(Schema.isPattern(/^[\x21\x23-\x5b\x5d-\x7e]{1,256}$/));
+
+export const Scopes = Schema.Array(ScopeName).check(
+  Schema.isMaxLength(64),
+  Schema.makeFilter((values) => new Set(values).size === values.length),
+);
+
+export const Resource = text(2048).check(
+  Schema.makeFilter((value) => {
+    try {
+      const url = new URL(value);
+
+      return (
+        // oxlint-disable-next-line no-control-regex -- Preserve exact resource identifiers.
+        url.username === "" && url.password === "" && !/[\s\\#\u0000-\u001f\u007f]/u.test(value)
+      );
+    } catch {
+      return false;
+    }
+  }),
+);
+
+export const Resources = Schema.Array(Resource).check(Schema.isMaxLength(64));
+
+export const RequestOptions = Schema.Struct({
+  timeoutMs: Schema.Finite.check(Schema.isBetween({ minimum: 1, maximum: 60000 })),
+  maxResponseBytes: integer(1, 1048576).pipe(
+    Schema.withDecodingDefaultKey(Effect.succeed(1048576)),
+  ),
+});
+
+export const Verifier = Schema.Redacted(
+  Schema.String.check(Schema.isPattern(/^[A-Za-z0-9._~-]{43,128}$/)),
+  { disallowJsonEncode: true },
+);
+
+export const Challenge = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/));
+
+export const NumericDate = Schema.Finite.check(
+  Schema.isBetween({ minimum: 0, maximum: 8640000000000 }),
+);
+
+export const reserved = new Set([
+  "client_id",
+  "client_secret",
+  "client_assertion",
+  "client_assertion_type",
+  "redirect_uri",
+  "response_type",
+  "response_mode",
+  "state",
+  "code",
+  "code_verifier",
+  "code_challenge",
+  "code_challenge_method",
+  "nonce",
+  "scope",
+  "iss",
+  "grant_type",
+  "refresh_token",
+  "token",
+  "token_type_hint",
+  "max_age",
+  "request",
+  "request_uri",
+  "authorization_details",
+  "id_token_hint",
+  "login_hint",
+  "login_hint_token",
+  "subject_token",
+  "subject_token_type",
+  "actor_token",
+  "actor_token_type",
+  "requested_token_type",
+]);
+
+export const Parameters = Schema.Record(
+  Schema.String.check(Schema.isPattern(/^[A-Za-z][A-Za-z0-9._~-]{0,63}$/)),
+  Schema.String.check(Schema.isMaxLength(2048)),
+).check(
+  Schema.makeFilter(
+    (value) =>
+      Object.keys(value).length <= 16 &&
+      Object.keys(value).every((key) => !reserved.has(key.toLowerCase())),
+  ),
+);
+
+const forbiddenHeaders = new Set([
+  "authorization",
+  "proxy-authorization",
+  "cookie",
+  "host",
+  "content-length",
+  "content-type",
+  "transfer-encoding",
+  "connection",
+  "upgrade",
+  "trailer",
+  "te",
+  "traceparent",
+  "tracestate",
+  "baggage",
+]);
+
+export const Headers = Schema.Record(
+  Schema.String.check(Schema.isPattern(/^[!#$%&'*+.^_`|~0-9A-Za-z-]{1,64}$/)),
+  Schema.String.check(Schema.isMaxLength(2048)),
+).check(
+  Schema.makeFilter((value) => {
+    const names = Object.keys(value).map((name) => name.toLowerCase());
+
+    return (
+      names.length <= 16 &&
+      new Set(names).size === names.length &&
+      names.every((name) => !forbiddenHeaders.has(name)) &&
+      Object.values(value).every((value) => !/[\r\n]/u.test(value))
+    );
+  }),
+);
+
+export const ProtocolEndpoint = Endpoint.check(
+  Schema.makeFilter((value) =>
+    Array.from(new URL(value).searchParams.keys()).every((key) => !reserved.has(key.toLowerCase())),
+  ),
+);
+
+// Keep exceptions from hostile input access and erased Redacted values inside
+// schema decoding; service execution must remain outside these catches.
+export const configuration = <S extends Schema.Constraint>(
+  schema: S,
+  input: unknown,
+  reason: ConfigurationError["reason"] = "parameters",
+) =>
+  Effect.suspend(() => Schema.decodeUnknownEffect(schema)(input, { reportInput: false })).pipe(
+    Effect.mapError(() => ConfigurationError.make({ reason })),
+    Effect.catchDefect(() => ConfigurationError.make({ reason })),
+  );
+
+export const decode = <S extends Schema.Constraint>(schema: S, input: unknown) =>
+  Effect.suspend(() => Schema.decodeUnknownEffect(schema)(input, { reportInput: false })).pipe(
+    Effect.mapError(() => Unavailable.make({})),
+    Effect.catchDefect(() => Unavailable.make({})),
+  );
+
+export const reveal = <A>(value: Redacted.Redacted<A>) =>
+  Effect.try({ try: () => Redacted.value(value), catch: () => Unavailable.make({}) });
+
+/** Freeze owned configuration snapshots or freshly parsed wire JSON, not caller-owned graphs. */
+export const freeze = <A>(value: A): A => {
+  const pending: Array<unknown> = [value];
+  const seen = new WeakSet<object>();
+
+  while (pending.length > 0) {
+    const item = pending.pop();
+
+    if (!Predicate.isObjectOrArray(item) || Redacted.isRedacted(item) || seen.has(item)) continue;
+    seen.add(item);
+    for (const child of Object.values(item)) pending.push(child);
+    Object.freeze(item);
+  }
+
+  return value;
+};